kern/161407: iwn panic on 9.0-BETA3

[Rene Ladan]

>Number:         161407
>Category:       kern
>Synopsis:       iwn panic on 9.0-BETA3
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Sat Oct 08 22:20:07 UTC 2011
>Closed-Date:
>Last-Modified:
>Originator:     Rene Ladan
>Release:        9.0-BETA3-amd64
>Organization:
>Environment:
FreeBSD acer 9.0-BETA3 FreeBSD 9.0-BETA3 #0 r225874: Thu Sep 29 16:29:00 CEST 2011     rene at acer:/usr/obj/usr/src/9/sys/ACER  amd64

GENERIC with CAPABILITIES compiled with clang and CPUTYPE?=core2
>Description:
My network card: iwn0: <Intel(R) WiFi Link 5100> mem
0xf5200000-0xf5201fff irq 17 at device 0.0 on pci3

iwn0: flags=8803<UP,BROADCAST,SIMPLEX,MULTICAST> metric 0 mtu 2290
       ether 00:26:c6:xx:xx:xx
       nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>
       media: IEEE 802.11 Wireless Ethernet autoselect mode 11b
       status: associated

Some snippets from /var/crash/core.txt.24 :

Unread portion of the kernel message buffer:
Kernel page fault with the following non-sleepable locks held:
exclusive sleep mutex iwn0 (network driver) r = 0 (0xffffff8000882018)
locked @ /usr/src/9/sys/dev/iwn/if_iwn.c:3135
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x2b
kdb_backtrace() at kdb_backtrace+0x39
witness_warn() at witness_warn+0x438
trap() at trap+0x14c
calltrap() at calltrap+0x8
--- trap 0xc, rip = 0xffffffff804fd1c7, rsp = 0xffffff811850a9d0, rbp =
0xffffff811850aa30 ---
iwn_ampdu_tx_done() at iwn_ampdu_tx_done+0xa7
iwn_notif_intr() at iwn_notif_intr+0x523
iwn_intr() at iwn_intr+0x60c
intr_event_execute_handlers() at intr_event_execute_handlers+0x7e
ithread_loop() at ithread_loop+0xf0
fork_exit() at fork_exit+0x80
fork_trampoline() at fork_trampoline+0xe
--- trap 0, rip = 0, rsp = 0xffffff811850ad00, rbp = 0 ---

Fatal trap 12: page fault while in kernel mode
cpuid = 0; apic id = 00
fault virtual address   = 0xa
fault code              = supervisor read data, page not present
instruction pointer     = 0x20:0xffffffff804fd1c7
stack pointer           = 0x28:0xffffff811850a9d0
frame pointer           = 0x28:0xffffff811850aa30
code segment            = base 0x0, limit 0xfffff, type 0x1b
                       = DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags        = interrupt enabled, resume, IOPL = 0
current process         = 12 (irq259: iwn0)
trap number             = 12
panic: page fault
cpuid = 0
Uptime: 1h23m24s
Dumping 692 out of 4055 MB:..3%..12%..21%..31%..42%..51%..61%..72%..81%..91%

No symbol "dumptid" in current context.
[...]

#0  sched_switch (td=dwarf2_read_address: Corrupted DWARF expression.
) at /usr/src/9/sys/kern/sched_ule.c:1854
1854    /usr/src/9/sys/kern/sched_ule.c: No such file or directory.
       in /usr/src/9/sys/kern/sched_ule.c
(kgdb) #0  sched_switch (td=dwarf2_read_address: Corrupted DWARF expression.
) at /usr/src/9/sys/kern/sched_ule.c:1854
#1  0xffffffff807f23c9 in mi_switch (flags=dwarf2_read_address:
Corrupted DWARF expression.
)
   at /usr/src/9/sys/kern/kern_synch.c:448
#2  0x0000000000000000 in ?? ()
#3  0xffffff811c0367d0 in ?? ()
#4  0x0000000000000046 in ?? ()
#5  0xffffff811c036810 in ?? ()
#6  0xffffffff807c2075 in intr_event_handle (ie=dwarf2_read_address:
Corrupted DWARF expression.
)
   at /usr/src/9/sys/kern/kern_intr.c:1476
Previous frame inner to this frame (corrupt stack?)

[...]

This was with the MeetingPlaza network during EuroBSDCon 2011, I normally use wired network at home (too much neighbors).

>How-To-Repeat:

>Fix:


>Release-Note:
>Audit-Trail:
>Unformatted: