panic logging out on serial console

[Tim Zingelman]

On Mon, 5 Dec 2005, Bjoern A. Zeeb wrote:

> On Mon, 5 Dec 2005, Gavin Atkinson wrote:
>
> > On Mon, 2005-12-05 at 11:47 +0000, Bjoern A. Zeeb wrote:
> >> I had been logged in on serial console and typed 'exit' and the
> >> RELENG_6 machine went *kaboom*. I hadn't seen sth like this befire on
> >> any of my other machines:
> >>
> >> i386/RELENG_6 from around 2005-11-17 11:00 UTC.
> >>
> >> --- 8< 8< 8< ---
> >> foo# exit
> >> logout
> >>
> >> Fatal trap 12: page fault while in kernel mode
> >> fault virtual address   = 0x0
> >> fault code              = supervisor read, page not present
> >> instruction pointer     = 0x20:0x0
> >> stack pointer           = 0x28:0xef699954
> >> frame pointer           = 0x28:0xef699968
> >> code segment            = base 0x0, limit 0xfffff, type 0x1b
> >>                          = DPL 0, pres 1, def32 1, gran 1
> >> processor eflags        = interrupt enabled, resume, IOPL = 0
> >> current process         = 70703 (getty)
> >> trap number             = 12
> >> panic: page fault
> >>
> >> I have the core file and can save it for some days but it won't
> >> help a lot unless someone tells me how I can skip the frame with
> >> the null pointer in kgdb.
> >
> > I've never had a problem with backtraces (even when IP=0x0) but don't
> > forget you can always look at the stack with
> >
> > (gdb) x/40xw 0xef699954
>
> oh thanks. I'll paste it in for the arguments:
>
> (kgdb) x/40xw 0xef699954
> 0xef699954:   * 0xc05b60db      0x00000000      0xc23b5c00      0xc23b4400
> 0xef699964:     0xc23b5c00      0xef699980    * 0xc0600ec8      0xc23b5cac
> 0xef699974:     0x00000000      0x00000000      0xc278a900      0xef699998
>
> (kgdb) l *0xc05b60db
> 0xc05b60db is in knote (/u1/src/RELENG_6/sys/kern/kern_event.c:1534).
>
> (kgdb) l *0xc0600ec8
> 0xc0600ec8 is in ttwwakeup (/u1/src/RELENG_6/sys/kern/tty.c:2451).

Any resolution on this... I have a panic on 6.1-RELEASE that looks
remarkably similar:

Fatal trap 12: page fault while in kernel mode
fault virtual address   = 0x0
fault code              = supervisor read, page not present
instruction pointer     = 0x20:0x0
stack pointer           = 0x28:0xcd490974
frame pointer           = 0x28:0xcd490988
code segment            = base 0x0, limit 0xfffff, type 0x1b
                        = DPL 0, pres 1, def32 1, gran 1
processor eflags        = interrupt enabled, resume, IOPL = 0
current process         = 4404 (sshd)
trap number             = 12
panic: page fault
Uptime: 13d2h18m44s
Dumping 255 MB (2 chunks)
  chunk 0: 1MB (160 pages) ... ok
  chunk 1: 255MB (65280 pages) 240 224 208 192 176 160 144 128 112 96 80
64 48 32 16

(kgdb) bt
#0  doadump () at pcpu.h:165
#1  0xc064dee1 in boot (howto=260) at
/usr/src/sys/kern/kern_shutdown.c:402
#2  0xc064e178 in panic (fmt=0xc088cb0e "%s")
    at /usr/src/sys/kern/kern_shutdown.c:558
#3  0xc0841d94 in trap_fatal (frame=0xcd490934, eva=0)
    at /usr/src/sys/i386/i386/trap.c:836
#4  0xc0841afb in trap_pfault (frame=0xcd490934, usermode=0, eva=0)
    at /usr/src/sys/i386/i386/trap.c:744
#5  0xc0841739 in trap (frame=
      {tf_fs = -1036845048, tf_es = -850853848, tf_ds = -1066794968,
tf_edi = -1032680832, tf_esi = -1031428864, tf_ebp = -850851448, tf_isp =
-850851488, tf_ebx = -1036994560, tf_edx = -1063786400, tf_ecx =
-1032680832, tf_eax = -1036994424, tf_trapno = 12, tf_err = 0, tf_eip = 0,
tf_cs = 32, tf_eflags = 66118, tf_esp = -1067241889, tf_ss = 0}) at
/usr/src/sys/i386/i386/trap.c:434
#6  0xc0830c9a in calltrap () at /usr/src/sys/i386/i386/exception.s:139
#7  0x00000000 in ?? ()
Previous frame inner to this frame (corrupt stack?)

(kgdb) x/40xw 0xcd490974
0xcd490974:     0xc0632e5f      0x00000000      0xc230b800      0xc285a500
0xcd490984:     0xc2728a80      0xcd4909a4      0xc067d8fd      0xc230b888
0xcd490994:     0x00000000      0x00000000      0xc230b810      0xc230b800
0xcd4909a4:     0xcd4909bc      0xc067c50c      0xc230b800      0xc230b800
0xcd4909b4:     0xc230b800      0xc285a500      0xcd4909d8      0xc0680bcc
0xcd4909c4:     0xc230b800      0x00000001      0xc285a500      0xcd490bcc
0xcd4909d4:     0xc091dba0      0xcd4909f4      0xc0624d2f      0xc285a500
0xcd4909e4:     0x00000003      0x00002000      0xc2728a80      0x00000000
0xcd4909f4:     0xcd490a34      0xc060361f      0xc285a500      0x00000003
0xcd490a04:     0x00002000      0xc2728a80      0xc285a500      0xc2d57dd0

(kgdb) l *0xc0632e5f
0xc0632e5f is in knote (/usr/src/sys/kern/kern_event.c:1534).

(kgdb) l *0xc067d8fd
0xc067d8fd is in ttwakeup (/usr/src/sys/kern/tty.c:2427).

But I was not using the serial port at the time...

 - Tim