netgraph/ng_eiface double panic & turnstile/sio lock order reversal in 5.2-BETA

Robin Breathe robin at isometry.net
Tue Nov 25 12:52:35 PST 2003


I've been experiencing a repeatable panic using ng_eiface(4) on -CURRENT 
of the last few days.


Environment:
FreeBSD twiddle.local 5.2-BETA FreeBSD 5.2-BETA #0: Tue Nov 25 19:28:22 
UTC 2003     root at twiddle.local:/home/data/work/usr/src/sys/TWIDDLE  i386

Description:
Shutting down an ng_eiface node which has a non-zero lladdr causes a panic.

How-To-Repeat:
Configure an ng_eiface(4) node, set its lladdr with ifconfig(8), shut it 
down:

################

# cat >/tmp/ngctl
  mkpeer . eiface hook ether
  name .:hook vif0
  rmhook . hook

# ngctl -f /tmp/ngctl
# ifconfig ngeth0 link '00:bd:03:11:25:01'
# ngctl shutdown vif0:
lock order reversal
  1st 0xc0765d8c turnstile chain (turnstile chain) @ 
/usr/src/sys/kern/subr_turnstile.c:370
  2nd 0xc079a500 sio (sio) @ /usr/src/sys/dev/sio/sio.c:3203
Stack backtrace:
backtrace(c070794e,c079a500,c07502c0,c07502c0,c0719757) at backtrace+0x17
witness_lock(c079a500,8,c0719757,c83,3f8) at witness_lock+0x672
_mtx_lock_spin_flags(c079a500,0,c0719757,c83,1) at _mtx_lock_spin_flags+0xda
siocnputc(c0750440,6b,5,ddcb08b4,6b) at siocnputc+0x81
cnputc(6b,c076e780,1,c4a40500,c071d675) at cnputc+0x7a
putchar(6b,ddcb08b4,c053a72d,c076e800,1) at putchar+0x6c
kvprintf(c071d674,c0564b80,ddcb08b4,a,ddcb08d4) at kvprintf+0x8d
printf(c071d674,c,c056ced2,c078ac40,38) at printf+0x57
trap(c0760018,c0760010,c0760010,0,c4a40500) at trap+0xd7
calltrap() at calltrap+0x5
--- trap 0xc, eip = 0xc056a146, esp = 0xddcb0958, ebp = 0xddcb0978 ---
turnstile_wait(0,c479b9c8,1103bd00,1cc,c479b9c8) at turnstile_wait+0x86
_mtx_lock_sleep(c479b9c8,0,c070c7ca,250,c49efe7c) at _mtx_lock_sleep+0x115
_mtx_lock_flags(c479b9c8,0,c070c7ca,250,c0538e1c) at _mtx_lock_flags+0x97
if_detach(c479b808,c4d64300,ddcb0a58,c4dbfa51,c479b808) at if_detach+0x394
ether_ifdetach(c479b808,c070d32d,820,c4d64300,c4d64300) at 
ether_ifdetach+0x30
ng_eiface_rmnode(c4d64300,0,0,c4d64300,c4d64300) at ng_eiface_rmnode+0x61
ng_rmnode(c4d64300,0,0,0,0) at ng_rmnode+0xc7
ng_generic_msg(c4d64300,c48b7780,0,c0768598,c07acfd4) at 
ng_generic_msg+0x11f
ng_apply_item(c4d64300,c48b7780,c070d32d,7d6,c48b7780) at 
ng_apply_item+0x365
ng_snd_item(c48b7780,0,c47a4360,0,0) at ng_snd_item+0x7b6
ngc_send(c4ab4780,0,c1d12800,c47a4820,0) at ngc_send+0x146
sosend(c4ab4780,c47a4820,ddcb0c4c,c1d12800,0) at sosend+0x4cd
kern_sendit(c4a40500,3,ddcb0cc4,0,0) at kern_sendit+0x17c
sendit(c4a40500,3,ddcb0cc4,0,804f034) at sendit+0x16e
sendto(c4a40500,ddcb0d14,c071d6f6,3ee,6) at sendto+0x5b
syscall(2f,2f,2f,bfbfe9c0,bfbfe9c2) at syscall+0x2c0
Xint0x80_syscall() at Xint0x80_syscall+0x1d
--- syscall (133), eip = 0x280c58cf, esp = 0xbfbfe96c, ebp = 0xbfbfebe8 ---
kernel trap 12 with interrupts disabled


Fatal trap 12: page fault while in kernel mode
fault virtual address   = 0x1103bd00
fault code              = supervisor read, page not present
instruction pointer     = 0x8:0xc056a146
stack pointer           = 0x10:0xddcb0958
frame pointer           = 0x10:0xddcb0978
code segment            = base 0x0, limit 0xfffff, type 0x1b
                         = DPL 0, pres 1, def32 1, gran 1
processor eflags        = resume, IOPL = 0
current process         = 582 (ngctl)
kernel: type 12 trap, code=0
Stopped at      turnstile_wait+0x86:    movl    0(%edx),%eax
db> panic
panic: from debugger
Debugger("panic")


Fatal trap 3: breakpoint instruction fault while in kernel mode
instruction pointer     = 0x8:0xc06a9254
stack pointer           = 0x10:0xddcb0720
frame pointer           = 0x10:0xddcb072c
code segment            = base 0x0, limit 0xfffff, type 0x1b
                         = DPL 0, pres 1, def32 1, gran 1
processor eflags        = IOPL = 0
current process         = 582 (ngctl)
Stopped at      turnstile_wait+0x86:    movl    0(%edx),%eax
db> where
turnstile_wait(0,c479b9c8,1103bd00,1cc,c479b9c8) at turnstile_wait+0x86
_mtx_lock_sleep(c479b9c8,0,c070c7ca,250,c49efe7c) at _mtx_lock_sleep+0x115
_mtx_lock_flags(c479b9c8,0,c070c7ca,250,c0538e1c) at _mtx_lock_flags+0x97
if_detach(c479b808,c4d64300,ddcb0a58,c4dbfa51,c479b808) at if_detach+0x394
ether_ifdetach(c479b808,c070d32d,820,c4d64300,c4d64300) at 
ether_ifdetach+0x30
ng_eiface_rmnode(c4d64300,0,0,c4d64300,c4d64300) at ng_eiface_rmnode+0x61
ng_rmnode(c4d64300,0,0,0,0) at ng_rmnode+0xc7
ng_generic_msg(c4d64300,c48b7780,0,c0768598,c07acfd4) at 
ng_generic_msg+0x11f
ng_apply_item(c4d64300,c48b7780,c070d32d,7d6,c48b7780) at 
ng_apply_item+0x365
ng_snd_item(c48b7780,0,c47a4360,0,0) at ng_snd_item+0x7b6
ngc_send(c4ab4780,0,c1d12800,c47a4820,0) at ngc_send+0x146
sosend(c4ab4780,c47a4820,ddcb0c4c,c1d12800,0) at sosend+0x4cd
kern_sendit(c4a40500,3,ddcb0cc4,0,0) at kern_sendit+0x17c
sendit(c4a40500,3,ddcb0cc4,0,804f034) at sendit+0x16e
sendto(c4a40500,ddcb0d14,c071d6f6,3ee,6) at sendto+0x5b
syscall(2f,2f,2f,bfbfe9c0,bfbfe9c2) at syscall+0x2c0
Xint0x80_syscall() at Xint0x80_syscall+0x1d
--- syscall (133, FreeBSD ELF32, sendto), eip = 0x280c58cf, esp = 
0xbfbfe96c, ebp = 0xbfbfebe8 ---
db> panic
panic: from debugger
Uptime: 2m3s
panic: mi_switch: switch in a critical section
Uptime: 2m3s
panic: msleep
Uptime: 2m3s
# repeated a few times
Uptime: 2m3s
panic: msleep
Uptime: 2m3s
panic: msleep

Fatal double fault:
eip = 0xc053a580
esp = 0xddcaf000
ebp = 0xddcaf030
panic: double fault
Uptime: 2m3s
panic: msleep
Uptime: 2m3s
# repeated a few more times
panic: msleep
Uptime: 2m3s
panic: msleep
spin lock sched lock held by Console: serial port

################

Notes:
With kernel debugging options disabled, but still 'options DDB; 
makeoptions DEBUG=-g', the LOR doesn't show up, but the netgraph panic 
is still present.
The above panic is from -CURRENT as of Tue Nov 25 18:00:00 UTC 2003.

This, at least superficially, looks similar to kern/55784 filed against 
4.8-STABLE.

Find attached a full dmesg, with example script, panic and kernel 
config. The system is failing to dump core. I'll happily help debug this 
as much as is necessary before 5.2-REL.

Hopeful,
- Robin

-- 
Robin Breathe              robin at isometry.net              +441865741800
-------------- next part --------------
Copyright (c) 1992-2003 The FreeBSD Project.
Copyright (c) 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994
        The Regents of the University of California. All rights reserved.
FreeBSD 5.2-BETA #0: Tue Nov 25 19:28:22 UTC 2003
    root at twiddle.local:/home/data/work/usr/src/sys/TWIDDLE
Preloaded elf kernel "/boot/kernel/kernel" at 0xc0848000.
Timecounter "i8254" frequency 1193182 Hz quality 0
CPU: Intel(R) Pentium(R) III CPU - S         1400MHz (1407.05-MHz 686-class CPU)
  Origin = "GenuineIntel"  Id = 0x6b4  Stepping = 4
  Features=0x383fbff<FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,MMX,FXSR,SSE>
real memory  = 536784896 (511 MB)
avail memory = 511860736 (488 MB)
ACPI APIC Table: <ASUS   TUSL2-C >
ioapic0 <Version 2.0> irqs 0-23 on motherboard
Pentium Pro MTRR support enabled
VESA: v3.0, 32768k memory, flags:0x1, mode table:0xc07af442 (1000022)
VESA: NVidia
acpi0: <ASUS   TUSL2-C > on motherboard
acpi0: Overriding SCI Interrupt from IRQ 9 to IRQ 20
pcibios: BIOS version 2.10
Using $PIR table, 11 entries at 0xc00f13a0
acpi0: Power Button (fixed)
Timecounter "ACPI-fast" frequency 3579545 Hz quality 1000
acpi_timer0: <24-bit timer at 3.579545MHz> port 0xe408-0xe40b on acpi0
acpi_cpu0: <CPU> on acpi0
acpi_button0: <Power Button> on acpi0
pcib0: <ACPI Host-PCI bridge> port 0xcf8-0xcff on acpi0
pci0: <ACPI PCI bus> on pcib0
agp0: <Intel 82815 (i815 GMCH) host to PCI bridge> mem 0xf8000000-0xfbffffff at device 0.0 on pci0
pcib1: <ACPI PCI-PCI bridge> at device 1.0 on pci0
pci1: <ACPI PCI bus> on pcib1
pci1: <display, VGA> at device 0.0 (no driver attached)
pcib2: <ACPI PCI-PCI bridge> at device 30.0 on pci0
pci2: <ACPI PCI bus> on pcib2
ahc0: <Adaptec 29160 Ultra160 SCSI adapter> port 0xd800-0xd8ff mem 0xed800000-0xed800fff irq 21 at device 9.0 on pci2
aic7892: Ultra160 Wide Channel A, SCSI Id=7, 32/253 SCBs
fxp0: <Intel 82550 Pro/100 Ethernet> port 0xd400-0xd43f mem 0xec800000-0xec81ffff,0xed000000-0xed000fff irq 22 at device 10.0 on pci2
fxp0: Ethernet address 00:02:b3:a7:de:2b
miibus0: <MII bus> on fxp0
inphy0: <i82555 10/100 media interface> on miibus0
inphy0:  10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, auto
pcib3: <PCI-PCI bridge> at device 11.0 on pci2
pci3: <PCI bus> on pcib3
pcib3: slot 8 INTA is routed to irq 23
pcib3: slot 8 INTB is routed to irq 20
pcib3: slot 8 INTC is routed to irq 21
pcib3: slot 11 INTA is routed to irq 22
ohci0: <NEC uPD 9210 USB controller> mem 0xec000000-0xec000fff irq 23 at device 8.0 on pci3
usb0: OHCI version 1.0
usb0: <NEC uPD 9210 USB controller> on ohci0
usb0: USB revision 1.0
uhub0: NEC OHCI root hub, class 9/0, rev 1.00/1.00, addr 1
uhub0: 3 ports with 3 removable, self powered
ohci1: <NEC uPD 9210 USB controller> mem 0xeb800000-0xeb800fff irq 20 at device 8.1 on pci3
usb1: OHCI version 1.0
usb1: <NEC uPD 9210 USB controller> on ohci1
usb1: USB revision 1.0
uhub1: NEC OHCI root hub, class 9/0, rev 1.00/1.00, addr 1
uhub1: 2 ports with 2 removable, self powered
pci3: <serial bus, USB> at device 8.2 (no driver attached)
fwohci0: <Texas Instruments TSB12LV26> mem 0xea000000-0xea003fff,0xea800000-0xea8007ff irq 22 at device 11.0 on pci3
fwohci0: OHCI version 1.0 (ROM=1)
fwohci0: No. of Isochronous channel is 4.
fwohci0: EUI64 00:50:42:b5:00:01:11:36
fwohci0: Phy 1394a available S400, 3 ports.
fwohci0: Link S400, max_rec 2048 bytes.
firewire0: <IEEE1394(FireWire) bus> on fwohci0
sbp0: <SBP-2/SCSI over FireWire> on firewire0
fwohci0: Initiate bus reset
fwohci0: BUS reset
fwohci0: node_id=0xc800ffc0, gen=1, CYCLEMASTER mode
firewire0: 1 nodes, maxhop <= 0, cable IRM = 0 (me)
firewire0: bus manager 0 (me)
pci2: <multimedia, audio> at device 12.0 (no driver attached)
pci2: <input device> at device 12.1 (no driver attached)
isab0: <PCI-ISA bridge> at device 31.0 on pci0
isa0: <ISA bus> on isab0
atapci0: <Intel ICH2 UDMA100 controller> port 0xa800-0xa80f at device 31.1 on pci0
ata0: at 0x1f0 irq 14 on atapci0
ata0: [MPSAFE]
ata1: at 0x170 irq 15 on atapci0
ata1: [MPSAFE]
uhci0: <Intel 82801BA/BAM (ICH2) USB controller USB-A> port 0xa400-0xa41f irq 19 at device 31.2 on pci0
usb2: <Intel 82801BA/BAM (ICH2) USB controller USB-A> on uhci0
usb2: USB revision 1.0
uhub2: Intel UHCI root hub, class 9/0, rev 1.00/1.00, addr 1
uhub2: 2 ports with 2 removable, self powered
ichsmb0: <Intel 82801BA (ICH2) SMBus controller> port 0xe800-0xe80f irq 17 at device 31.3 on pci0
smbus0: <System Management Bus> on ichsmb0
smb0: <SMBus generic I/O> on smbus0
uhci1: <Intel 82801BA/BAM (ICH2) USB controller USB-B> port 0xa000-0xa01f irq 23 at device 31.4 on pci0
usb3: <Intel 82801BA/BAM (ICH2) USB controller USB-B> on uhci1
usb3: USB revision 1.0
uhub3: Intel UHCI root hub, class 9/0, rev 1.00/1.00, addr 1
uhub3: 2 ports with 2 removable, self powered
sio0 port 0x3f8-0x3ff irq 4 on acpi0
sio0: type 16550A, console
sio1 port 0x2f8-0x2ff irq 3 on acpi0
sio1: type 16550A
atkbdc0: <Keyboard controller (i8042)> port 0x64,0x60 irq 1 on acpi0
npx0: [FAST]
stray irq13
npx0: <math processor> on motherboard
npx0: INT 16 interface
orm0: <Option ROM> at iomem 0xd4000-0xd57ff on isa0
pmtimer0 on isa0
sc0: <System console> at flags 0x100 on isa0
sc0: VGA <16 virtual consoles, flags=0x100>
vga0: <Generic ISA VGA> at port 0x3c0-0x3df iomem 0xa0000-0xbffff on isa0
Timecounter "TSC" frequency 1407045712 Hz quality 800
Timecounters tick every 1.000 msec
acd0: DVDROM <JLMS XJ-HD166S> at ata0-master PIO4
Waiting 10 seconds for SCSI devices to settle
GEOM: create disk da0 dp=0xc4a06050
da0 at ahc0 bus 0 target 0 lun 0
da0: <FUJITSU MAP3367NP 5605> Fixed Direct Access SCSI-3 device
da0: 160.000MB/s transfers (80.000MHz, offset 127, 16bit), Tagged Queueing Enabled
da0: 34732MB (71132959 512 byte sectors: 64H 32S/T 34732C)
Mounting root from ufs:/dev/da0s1a
Loading configuration files.
Entropy harvesting: interrupts ethernet point_to_point.
kernel dumps on /dev/da0s1b
swapon: adding /dev/da0s1b as swap device
Starting file system checks:
/dev/da0s1a: FILE SYSTEM CLEAN; SKIPPING CHECKS
/dev/da0s1a: clean, 92026 free (778 frags, 11406 blocks, 0.6% fragmentation)
/dev/da0s1e: FILE SYSTEM CLEAN; SKIPPING CHECKS
/dev/da0s1e: clean, 3544678 free (28734 frags, 439493 blocks, 0.7% fragmentation)
/dev/da0s1d: FILE SYSTEM CLEAN; SKIPPING CHECKS
/dev/da0s1d: clean, 185934 free (110 frags, 23228 blocks, 0.0% fragmentation)
/dev/da0s2d: FILE SYSTEM CLEAN; SKIPPING CHECKS
/dev/da0s2d: clean, 1006689 free (33 frags, 125832 blocks, 0.0% fragmentation)
/dev/da0s2e: FILE SYSTEM CLEAN; SKIPPING CHECKS
/dev/da0s2e: clean, 1133573 free (789 frags, 141598 blocks, 0.0% fragmentation)
/dev/da0s2f: FILE SYSTEM CLEAN; SKIPPING CHECKS
/dev/da0s2f: clean, 9025368 free (1392 frags, 1127997 blocks, 0.0% fragmentation)
Setting hostname: twiddle.local.
fxp0: Microcode loaded, int_delay: 1000 usec  bundle_max: 6
fxp0: Microcode loaded, int_delay: 1000 usec  bundle_max: 6
fxp0: flags=9843<UP,BROADCAST,RUNNING,SIMPLEX,LINK0,MULTICAST> mtu 1500
        options=3<RXCSUM,TXCSUM>
        inet 195.137.51.153 netmask 0xfffffff0 broadcast 195.137.51.159
        inet6 fe80::202:b3ff:fea7:de2b%fxp0 prefixlen 64 tentative scopeid 0x1
        ether 00:02:b3:a7:de:2b
        media: Ethernet autoselect (100baseTX <full-duplex>)
        status: active
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> mtu 16384
        inet 127.0.0.1 netmask 0xff000000
        inet6 ::1 prefixlen 128
        inet6 fe80::1%lo0 prefixlen 64 scopeid 0x2
add net default: gateway 195.137.51.158
Additional routing options:.
hw.bus.devctl_disable: 0 -> 1
Mounting NFS file systems:.
Starting syslogd.
Nov 25 19:43:03 twiddle syslogd: kernel boot file is /boot/kernel/kernel
Checking for core dump...
savecore: no dumps found
Turning on accounting.
NFS access cache time=2
Nov 25 19:43:03 twiddle kernel: Accounting enabled
ELF ldconfig path: /lib /usr/lib /usr/lib/compat /usr/X11R6/lib /usr/local/lib
a.out ldconfig path: /usr/lib/aout /usr/lib/compat/aout /usr/X11R6/lib/aout
Recovering vi editor sessions:.
Starting usbd.
Starting local daemons:.
Updating motd.
Starting ntpd.
Configuring syscons: blanktime.
Starting sshd.
Initial i386 initialization:.
Additional ABI support:.
Starting cron.
Local package initialization:.
Additional TCP options:.
Starting background file system checks in 60 seconds.

Tue Nov 25 19:43:06 UTC 2003

FreeBSD/i386
FreeBSD/i386 (twiddle.local) (console)

login: root
Nov 25 19:44:05 twiddle login: ROOT LOGIN (root) ON console
Last login: Tue Nov 25 19:03:06 on console
Copyright (c) 1992-2003 The FreeBSD Project.
Copyright (c) 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994
        The Regents of the University of California. All rights reserved.

FreeBSD 5.2-BETA (TWIDDLE) #0: Tue Nov 25 19:28:22 UTC 2003

You have new mail.
twiddle# uname -a
FreeBSD twiddle.local 5.2-BETA FreeBSD 5.2-BETA #0: Tue Nov 25 19:28:22 UTC 2003     root at twiddle.local:/home/data/work/usr/src/sys/TWIDDLE  i386
twiddle# cat ./panic
#!/bin/sh -x

################################################################################
# 
# How to repeat the panic:
#

cat <<'EOF' >/tmp/ngctl.cmd
 list
 mkpeer . eiface hook ether
 name .:hook vif0
 rmhook . hook
 list
 show vif0:
EOF
ngctl -f /tmp/ngctl.cmd

ifconfig ngeth0
ifconfig ngeth0 link '00:bd:03:11:25:01'
ifconfig ngeth0

ngctl show vif0:
sleep 1

ngctl shutdown vif0:
# !PANIC

################################################################################

twiddle# ./panic
+ cat
+ ngctl -f /tmp/ngctl.cmd
There are 2 total nodes:
  Name: ngctl576        Type: socket          ID: 00000002   Num hooks: 0
  Name: fxp0            Type: ether           ID: 00000001   Num hooks: 0
There are 4 total nodes:
  Name: ngeth0          Type: ether           ID: 00000004   Num hooks: 0
  Name: vif0            Type: eiface          ID: 00000003   Num hooks: 0
  Name: ngctl576        Type: socket          ID: 00000002   Num hooks: 0
  Name: fxp0            Type: ether           ID: 00000001   Num hooks: 0
  Name: vif0            Type: eiface          ID: 00000003   Num hooks: 0
+ ifconfig ngeth0
ngeth0: flags=8802<BROADCAST,SIMPLEX,MULTICAST> mtu 1500
        ether 00:00:00:00:00:00
+ ifconfig ngeth0 link 00:bd:03:11:25:01
+ ifconfig ngeth0
ngeth0: flags=8802<BROADCAST,SIMPLEX,MULTICAST> mtu 1500
        ether 00:bd:03:11:25:01
+ ngctl show vif0:
  Name: vif0            Type: eiface          ID: 00000003   Num hooks: 0
+ sleep 1
+ ngctl shutdown vif0:
lock order reversal
 1st 0xc0765d8c turnstile chain (turnstile chain) @ /usr/src/sys/kern/subr_turnstile.c:370
 2nd 0xc079a500 sio (sio) @ /usr/src/sys/dev/sio/sio.c:3203
Stack backtrace:
backtrace(c070794e,c079a500,c07502c0,c07502c0,c0719757) at backtrace+0x17
witness_lock(c079a500,8,c0719757,c83,3f8) at witness_lock+0x672
_mtx_lock_spin_flags(c079a500,0,c0719757,c83,1) at _mtx_lock_spin_flags+0xda
siocnputc(c0750440,6b,5,ddcb08b4,6b) at siocnputc+0x81
cnputc(6b,c076e780,1,c4a40500,c071d675) at cnputc+0x7a
putchar(6b,ddcb08b4,c053a72d,c076e800,1) at putchar+0x6c
kvprintf(c071d674,c0564b80,ddcb08b4,a,ddcb08d4) at kvprintf+0x8d
printf(c071d674,c,c056ced2,c078ac40,38) at printf+0x57
trap(c0760018,c0760010,c0760010,0,c4a40500) at trap+0xd7
calltrap() at calltrap+0x5
--- trap 0xc, eip = 0xc056a146, esp = 0xddcb0958, ebp = 0xddcb0978 ---
turnstile_wait(0,c479b9c8,1103bd00,1cc,c479b9c8) at turnstile_wait+0x86
_mtx_lock_sleep(c479b9c8,0,c070c7ca,250,c49efe7c) at _mtx_lock_sleep+0x115
_mtx_lock_flags(c479b9c8,0,c070c7ca,250,c0538e1c) at _mtx_lock_flags+0x97
if_detach(c479b808,c4d64300,ddcb0a58,c4dbfa51,c479b808) at if_detach+0x394
ether_ifdetach(c479b808,c070d32d,820,c4d64300,c4d64300) at ether_ifdetach+0x30
ng_eiface_rmnode(c4d64300,0,0,c4d64300,c4d64300) at ng_eiface_rmnode+0x61
ng_rmnode(c4d64300,0,0,0,0) at ng_rmnode+0xc7
ng_generic_msg(c4d64300,c48b7780,0,c0768598,c07acfd4) at ng_generic_msg+0x11f
ng_apply_item(c4d64300,c48b7780,c070d32d,7d6,c48b7780) at ng_apply_item+0x365
ng_snd_item(c48b7780,0,c47a4360,0,0) at ng_snd_item+0x7b6
ngc_send(c4ab4780,0,c1d12800,c47a4820,0) at ngc_send+0x146
sosend(c4ab4780,c47a4820,ddcb0c4c,c1d12800,0) at sosend+0x4cd
kern_sendit(c4a40500,3,ddcb0cc4,0,0) at kern_sendit+0x17c
sendit(c4a40500,3,ddcb0cc4,0,804f034) at sendit+0x16e
sendto(c4a40500,ddcb0d14,c071d6f6,3ee,6) at sendto+0x5b
syscall(2f,2f,2f,bfbfe9c0,bfbfe9c2) at syscall+0x2c0
Xint0x80_syscall() at Xint0x80_syscall+0x1d
--- syscall (133), eip = 0x280c58cf, esp = 0xbfbfe96c, ebp = 0xbfbfebe8 ---
kernel trap 12 with interrupts disabled


Fatal trap 12: page fault while in kernel mode
fault virtual address   = 0x1103bd00
fault code              = supervisor read, page not present
instruction pointer     = 0x8:0xc056a146
stack pointer           = 0x10:0xddcb0958
frame pointer           = 0x10:0xddcb0978
code segment            = base 0x0, limit 0xfffff, type 0x1b
                        = DPL 0, pres 1, def32 1, gran 1
processor eflags        = resume, IOPL = 0
current process         = 582 (ngctl)
kernel: type 12 trap, code=0
Stopped at      turnstile_wait+0x86:    movl    0(%edx),%eax
db> where
turnstile_wait(0,c479b9c8,1103bd00,1cc,c479b9c8) at turnstile_wait+0x86
_mtx_lock_sleep(c479b9c8,0,c070c7ca,250,c49efe7c) at _mtx_lock_sleep+0x115
_mtx_lock_flags(c479b9c8,0,c070c7ca,250,c0538e1c) at _mtx_lock_flags+0x97
if_detach(c479b808,c4d64300,ddcb0a58,c4dbfa51,c479b808) at if_detach+0x394
ether_ifdetach(c479b808,c070d32d,820,c4d64300,c4d64300) at ether_ifdetach+0x30
ng_eiface_rmnode(c4d64300,0,0,c4d64300,c4d64300) at ng_eiface_rmnode+0x61
ng_rmnode(c4d64300,0,0,0,0) at ng_rmnode+0xc7
ng_generic_msg(c4d64300,c48b7780,0,c0768598,c07acfd4) at ng_generic_msg+0x11f
ng_apply_item(c4d64300,c48b7780,c070d32d,7d6,c48b7780) at ng_apply_item+0x365
ng_snd_item(c48b7780,0,c47a4360,0,0) at ng_snd_item+0x7b6
ngc_send(c4ab4780,0,c1d12800,c47a4820,0) at ngc_send+0x146
sosend(c4ab4780,c47a4820,ddcb0c4c,c1d12800,0) at sosend+0x4cd
kern_sendit(c4a40500,3,ddcb0cc4,0,0) at kern_sendit+0x17c
sendit(c4a40500,3,ddcb0cc4,0,804f034) at sendit+0x16e
sendto(c4a40500,ddcb0d14,c071d6f6,3ee,6) at sendto+0x5b
syscall(2f,2f,2f,bfbfe9c0,bfbfe9c2) at syscall+0x2c0
Xint0x80_syscall() at Xint0x80_syscall+0x1d
--- syscall (133, FreeBSD ELF32, sendto), eip = 0x280c58cf, esp = 0xbfbfe96c, ebp = 0xbfbfebe8 ---
db> panic
panic: from debugger
Debugger("panic")


Fatal trap 3: breakpoint instruction fault while in kernel mode
instruction pointer     = 0x8:0xc06a9254
stack pointer           = 0x10:0xddcb0720
frame pointer           = 0x10:0xddcb072c
code segment            = base 0x0, limit 0xfffff, type 0x1b
                        = DPL 0, pres 1, def32 1, gran 1
processor eflags        = IOPL = 0
current process         = 582 (ngctl)
Stopped at      turnstile_wait+0x86:    movl    0(%edx),%eax
db> where
turnstile_wait(0,c479b9c8,1103bd00,1cc,c479b9c8) at turnstile_wait+0x86
_mtx_lock_sleep(c479b9c8,0,c070c7ca,250,c49efe7c) at _mtx_lock_sleep+0x115
_mtx_lock_flags(c479b9c8,0,c070c7ca,250,c0538e1c) at _mtx_lock_flags+0x97
if_detach(c479b808,c4d64300,ddcb0a58,c4dbfa51,c479b808) at if_detach+0x394
ether_ifdetach(c479b808,c070d32d,820,c4d64300,c4d64300) at ether_ifdetach+0x30
ng_eiface_rmnode(c4d64300,0,0,c4d64300,c4d64300) at ng_eiface_rmnode+0x61
ng_rmnode(c4d64300,0,0,0,0) at ng_rmnode+0xc7
ng_generic_msg(c4d64300,c48b7780,0,c0768598,c07acfd4) at ng_generic_msg+0x11f
ng_apply_item(c4d64300,c48b7780,c070d32d,7d6,c48b7780) at ng_apply_item+0x365
ng_snd_item(c48b7780,0,c47a4360,0,0) at ng_snd_item+0x7b6
ngc_send(c4ab4780,0,c1d12800,c47a4820,0) at ngc_send+0x146
sosend(c4ab4780,c47a4820,ddcb0c4c,c1d12800,0) at sosend+0x4cd
kern_sendit(c4a40500,3,ddcb0cc4,0,0) at kern_sendit+0x17c
sendit(c4a40500,3,ddcb0cc4,0,804f034) at sendit+0x16e
sendto(c4a40500,ddcb0d14,c071d6f6,3ee,6) at sendto+0x5b
syscall(2f,2f,2f,bfbfe9c0,bfbfe9c2) at syscall+0x2c0
Xint0x80_syscall() at Xint0x80_syscall+0x1d
--- syscall (133, FreeBSD ELF32, sendto), eip = 0x280c58cf, esp = 0xbfbfe96c, ebp = 0xbfbfebe8 ---
db> panic
panic: from debugger
Uptime: 2m3s
panic: mi_switch: switch in a critical section
Uptime: 2m3s
panic: msleep
Uptime: 2m3s
panic: msleep
Uptime: 2m3s
panic: msleep
Uptime: 2m3s
panic: msleep
Uptime: 2m3s
panic: msleep
Uptime: 2m3s
panic: msleep
Uptime: 2m3s
panic: msleep
Uptime: 2m3s
panic: msleep
Uptime: 2m3s
panic: msleep
Uptime: 2m3s
panic: msleep
Uptime: 2m3s
panic: msleep
Uptime: 2m3s
panic: msleep
Uptime: 2m3s
panic: msleep
Uptime: 2m3s
panic: msleep
Uptime: 2m3s
panic: msleep
Uptime: 2m3s
panic: msleep
Uptime: 2m3s
panic: msleep
Uptime: 2m3s
panic: msleep

Fatal double fault:
eip = 0xc053a580
esp = 0xddcaf000
ebp = 0xddcaf030
panic: double fault
Uptime: 2m3s
panic: msleep
Uptime: 2m3s
panic: msleep
Uptime: 2m3s
panic: msleep
Uptime: 2m3s
panic: msleep
Uptime: 2m3s
panic: msleep
Uptime: 2m3s
panic: msleep
Uptime: 2m3s
panic: msleep
Uptime: 2m3s
panic: msleep
Uptime: 2m3s
panic: msleep
Uptime: 2m3s
panic: msleep
Uptime: 2m3s
panic: msleep
Uptime: 2m3s
panic: msleep
Uptime: 2m3s
panic: msleep
Uptime: 2m3s
panic: msleep
Uptime: 2m3s
panic: msleep
Uptime: 2m3s
panic: msleep
Uptime: 2m3s
panic: msleep
Uptime: 2m3s
panic: msleep
Uptime: 2m3s
panic: msleep
Uptime: 2m3s
panic: msleep
Uptime: 2m3s
panic: msleep
Uptime: 2m3s
panic: msleep
spin lock sched lock held by Console: serial port

################################################################################
################################################################################

twiddle# cat /usr/src/sys/i386/conf/TWIDDLE
#
# TWIDDLE -- kernel configuration file for FreeBSD/i386
#

machine         i386
cpu             I686_CPU
ident           TWIDDLE

options         INCLUDE_CONFIG_FILE     # Include this file in kernel
options         ROOTDEVNAME=\"ufs:da0s1a\"

# Debugging for use in -current
options         DDB                     #Enable the kernel debugger
makeoptions     DEBUG=-g                #Build kernel with gdb(1) debug symbols

options         INVARIANTS              #Enable calls of extra sanity checking
options         INVARIANT_SUPPORT       #Extra sanity checks of internal structures, required by INVARIANTS
options         WITNESS                 #Enable checks to detect deadlocks and cycles
#options        WITNESS_SKIPSPIN        #Don't run witness on spinlocks for speed

# Network performance options
options         ZERO_COPY_SOCKETS       #zero_copy(9)
options         DEVICE_POLLING          #polling(4)
options         HZ=1000                 #Smoother packet processing

#To statically compile in device wiring instead of /boot/device.hints
#hints          "TWIDDLE.hints"         #Default places to look for devices.

options         SCHED_4BSD              #4BSD scheduler
#options        SCHED_ULE               #Alternative SMP scheduler
options         INET                    #InterNETworking
options         INET6                   #IPv6 communications protocols
options         FFS                     #Berkeley Fast Filesystem
options         SOFTUPDATES             #Enable FFS soft updates support
options         UFS_ACL                 #Support for access control lists
options         UFS_DIRHASH             #Improve performance on big directories
options         MD_ROOT                 #MD is a potential root device
options         NFSCLIENT               #Network Filesystem Client
options         NFSSERVER               #Network Filesystem Server
#options        NFS_ROOT                #NFS usable as root device, requires NFSCLIENT
#options        MSDOSFS                 #MSDOS Filesystem
options         CD9660                  #ISO 9660 Filesystem
options         PROCFS                  #Process filesystem (requires PSEUDOFS)
options         PSEUDOFS                #Pseudo-filesystem framework
options         COMPAT_43               #Compatible with BSD 4.3 [KEEP THIS!]
options         COMPAT_FREEBSD4         #Compatible with FreeBSD4
options         SCSI_DELAY=10000        #Delay (in ms) before probing SCSI
options         KTRACE                  #ktrace(1) support
options         SYSVSHM                 #SYSV-style shared memory
options         SYSVMSG                 #SYSV-style message queues
options         SYSVSEM                 #SYSV-style semaphores
options         _KPOSIX_PRIORITY_SCHEDULING #Posix P1003_1B real-time extensions
options         KBD_INSTALL_CDEV        # install a CDEV entry in /dev
#options        AHC_REG_PRETTY_PRINT    # Print register bitfields in debug
                                        # output.  Adds ~128k to driver.
#options        AHD_REG_PRETTY_PRINT    # Print register bitfields in debug
                                        # output.  Adds ~215k to driver.

device          apic

device          acpi
device          isa
device          pci

# SMBus for healthd
device          smbus                   # Bus support, required for smb below.
device          intpm
device          ichsmb
device          smb
device          iicbus
device          iicbb
device          iic
device          iicsmb

# Floppy drives
#device         fdc

# ATA and ATAPI devices
device          ata
device          atadisk                 # ATA disk drives
device          atapicd                 # ATAPI CDROM drives
options         ATA_STATIC_ID           #Static device numbering

# SCSI Controllers
device          ahc             # AHA2940 and onboard AIC7xxx devices
#device         ahd             # AHA39320/29320 and onboard AIC79xx devices

# SCSI peripherals
device          scbus           # SCSI bus (required)
#device         ch              # SCSI media changers
device          da              # Direct Access (disks)
device          sa              # Sequential Access (tape etc)
device          cd              # CD
device          pass            # Passthrough device (direct SCSI access)
device          ses             # SCSI Environmental Services (and SAF-TE)

# RAID controllers
#device         twe             # 3ware ATA RAID

# atkbdc0 controls both the keyboard and the PS/2 mouse
device          atkbdc          # AT keyboard controller
device          atkbd           # AT keyboard
device          psm             # PS/2 mouse

device          vga             # VGA video card driver

device          splash          # Splash screen and screen saver support

# syscons is the default console driver, resembling an SCO console
device          sc
options         SC_HISTORY_SIZE=2048

# Enable this for the pcvt (VT220 compatible) console driver
#device         vt
#options        XSERVER                 # support for X server on a vt console
#options        FAT_CURSOR              # start with block cursor

device          agp             # support several AGP chipsets

options         VESA            # SUpport for VESA video modes

# Floating point support - do not disable.
device          npx

# Power management support (see NOTES for more options)
#device         apm
# Add suspend/resume support for the i8254.
device          pmtimer

# -- sio(4): Serial (COM) ports
device          sio             # 8250, 16[45]50 based serial ports
options         CONSPEED=115200 # speed for serial console
                                # (default 9600)

# -- ppc(4): Parallel port
#device         ppc
#device         ppbus           # Parallel port bus (required)
#device         lpt             # Printer
#device         ppi             # Parallel port interface device

# PCI Ethernet NICs that use the common MII bus controller code.
# NOTE: Be sure to keep the 'device miibus' line in order to use these NICs!
device          miibus          # MII bus support
device          fxp             # Intel EtherExpress PRO/100B (82557, 82558)
device          bge             # Broadcom BCM570xx Gigabit Ethernet

# -- netgraph(4)
options         NETGRAPH
options         NETGRAPH_ETHER  # No autoload

# Pseudo devices - the number indicates how many units to allocate.
device          random          # Entropy device
device          loop            # Network loopback
device          ether           # Ethernet support
#device         sl              # Kernel SLIP
#device         ppp             # Kernel PPP
device          tun             # Packet tunnel.
device          pty             # Pseudo-ttys (telnet etc)
device          md              # Memory "disks"
device          gif             # IPv6 and IPv4 tunneling
device          faith           # IPv6-to-IPv4 relaying (translation)

# The `bpf' device enables the Berkeley Packet Filter.
# Be aware of the administrative consequences of enabling this!
device          bpf             # Berkeley packet filter

# USB support
device          uhci            # UHCI PCI->USB interface
device          ohci            # OHCI PCI->USB interface
device          usb             # USB Bus (required)
#device         udbp            # USB Double Bulk Pipe devices
device          ugen            # Generic
device          uhid            # "Human Interface Devices"
device          ukbd            # Keyboard
device          ums             # Mouse

# FireWire support
device          firewire        # FireWire bus code
device          sbp             # SCSI over FireWire (Requires scbus and da)
#device         fwe             # Ethernet over FireWire (non-standard!)



More information about the freebsd-current mailing list