Panic in ath driver with SMP

[Cédric Jonas]

Hello,

Since 1 or 2 months, I experienced panics when I use the ath interface of our server (configured as hostap). 
Also, the system hangs often (without panic) during the boot process at the "Setting hostname: icarus." 
level. Because I had absolutely no time, I couldn't learn to use the kernel debugger before. 



	icarus# uname -a
	FreeBSD icarus 5.4-STABLE FreeBSD 5.4-STABLE #0: Sun Jul  3 15:14:13 CEST 2005     cedric at icarus:/usr/obj/usr/src/sys/ICARUS  i386

Sources are from July, 1


	debug.mpsafenet: 1



After compiling the kernel with debug options, I get the following during the boot process:

	Setting hostname: icarus.
	lock order reversal
	 1st 0xc2cd4c6c ath0 (network driver) @ /usr/src/sys/dev/ath/if_ath.c:893
	 2nd 0xc30583c8 user map (user map) @ /usr/src/sys/vm/vm_map.c:2998

I suppose this explains the occasional hangups during the boot process?


The following was obtained after a panic (which occured only when I use the ath interface):

	icarus# kgdb kernel.debug /var/crash/vmcore.86
	[GDB will not be able to debug user-mode threads: /usr/lib/libthread_db.so: Undefined symbol "ps_pglobal_lookup"]
	GNU gdb 6.1.1 [FreeBSD]
	Copyright 2004 Free Software Foundation, Inc.
	GDB is free software, covered by the GNU General Public License, and you are
	welcome to change it and/or distribute copies of it under certain conditions.
	Type "show copying" to see the conditions.
	There is absolutely no warranty for GDB.  Type "show warranty" for details.
	This GDB was configured as "i386-marcel-freebsd".
	#0  doadump () at pcpu.h:160
	160             __asm __volatile("movl %%fs:0,%0" : "=r" (td));
	(kgdb) list *0xc0695dfd
	0xc0695dfd is in bus_dmamap_load_mbuf (pmap.h:201).
	196
	197             if ((pa = PTD[va >> PDRSHIFT]) & PG_PS) {
	198                     pa = (pa & ~(NBPDR - 1)) | (va & (NBPDR - 1));
	199             } else {
	200                     pa = *vtopte(va);
	201                     pa = (pa & PG_FRAME) | (va & PAGE_MASK);
	202             }
	203             return pa;
	204     }
	205
	(kgdb) backtrace
	#0  doadump () at pcpu.h:160
	#1  0xc05241dc in boot (howto=260) at /usr/src/sys/kern/kern_shutdown.c:410
	#2  0xc05244f1 in panic (fmt=0xc06f0b1f "%s") at /usr/src/sys/kern/kern_shutdown.c:566
	#3  0xc06a96ec in trap_fatal (frame=0xe5ba3b80, eva=3221110944) at /usr/src/sys/i386/i386/trap.c:817
	#4  0xc06a941f in trap_pfault (frame=0xe5ba3b80, usermode=0, eva=3221110944) at /usr/src/sys/i386/i386/trap.c:735
	#5  0xc06a9085 in trap (frame=
      {tf_fs = -440795112, tf_es = -1068433392, tf_ds = -1027473392, tf_edi = -1026674344, tf_esi = -1026496768, tf_ebp = -440779748, tf_isp = -440779860, tf_ebx = 0, tf_edx = 0, tf_ecx = -117273402, tf_eax = 1019944, tf_trapno = 12, tf_err = 0, tf_eip = -1066836483, tf_cs = 8, tf_eflags = 66055, tf_esp = -440779804, tf_ss = -1068382496}) at /usr/src/sys/i386/i386/trap.c:425
	#6  0xc069796a in calltrap () at /usr/src/sys/i386/i386/exception.s:140
	#7  0xe5ba0018 in ?? ()
	#8  0xc0510010 in exit1 (td=0xc2cba680, rv=-440779764) at /usr/src/sys/kern/kern_exit.c:394
	#9  0xc0494122 in ath_rxbuf_init (sc=0xc2cd4000, bf=0xc2ce3158) at /usr/src/sys/dev/ath/if_ath.c:1601
	#10 0xc0494560 in ath_rx_proc (arg=0xc2cd4000, npending=1) at /usr/src/sys/dev/ath/if_ath.c:1818
	#11 0xc0540c57 in taskqueue_run (queue=0xc2c94dc0) at /usr/src/sys/kern/subr_taskqueue.c:191
	#12 0xc0540cbe in taskqueue_swi_run (dummy=0x0) at /usr/src/sys/kern/subr_taskqueue.c:213
	#13 0xc0512ad8 in ithread_loop (arg=0xc2c28300) at /usr/src/sys/kern/kern_intr.c:547
	#14 0xc0511ed4 in fork_exit (callout=0xc05129b4 <ithread_loop>, arg=0xc2c28300, frame=0xe5ba3d38) at /usr/src/sys/kern/kern_fork.c:791
	#15 0xc06979cc in fork_trampoline () at /usr/src/sys/i386/i386/exception.s:209
	(kgdb) 


Kernel config is attached.


Another important detail could be that I use a dual Xeon box, with HT enabled, which results
in 4 logical CPU's (SMP issue?) and explain why anybody reported this problem before?!
I tried to disable PREEMPTION, the hyperthreading functionality (=> 2 logical CPU), and I set
debug.mpsafenet to 0, but the LOR (+ Panic when ath0 is used) continue to occure...
I tried also to downgrade to 5.3-RELEASE, where the problems do _not_ occur... but that's not
a solution.

I hope somebody could help, if you need additional informations, let me know.
Thank you.

-- 
Best regards, 
 Cédric Jonas
-------------- next part --------------
A non-text attachment was scrubbed...
Name: ICARUS
Type: application/octet-stream
Size: 6245 bytes
Desc: not available
Url : http://lists.freebsd.org/pipermail/freebsd-smp/attachments/20050707/0db63667/ICARUS.obj