Panic in RELENG_7_1 with fxp(4)

[Robert Watson]

On Tue, 6 Jan 2009, Brandon Weisz wrote:

>> http://people.freebsd.org/~yongari/fxp/if_fxp.c
>> http://people.freebsd.org/~yongari/fxp/if_fxpreg.h
>> http://people.freebsd.org/~yongari/fxp/if_fxpvar.h
>
> With this version, the system still panics as before.
>
> After the system panic with this patch, I went into the bios and disabled 
> all unnecessary hardware such as parallel port, usb controller and on-board 
> audio.  The resulting panic below appears different.

Without contributing anything too constructive to this conversation, this 
crash looks a bit like it might be a device driver bug in which a packet is 
passed to if_input() from the device driver, but then modified by the device 
driver after it is handed off.

Robert N M Watson
Computer Laboratory
University of Cambridge

>
> Fatal trap 12: page fault while in kernel mode
> cpuid = 0; apic id = 00
> fault virtual address	= 0x400
> fault code		= supervisor read, page not present
> instruction pointer	= 0x20:0xc07eefec
> stack pointer	        = 0x28:0xe4339ac0
> frame pointer	        = 0x28:0xe4339ae4
> code segment		= base 0x0, limit 0xfffff, type 0x1b
> 			= DPL 0, pres 1, def32 1, gran 1
> processor eflags	= interrupt enabled, resume, IOPL = 0
> current process		= 28 (irq23: vr0)
> trap number		= 12
> panic: page fault
> cpuid = 0
> Uptime: 50s
> Physical memory: 995 MB
> Dumping 162 MB: 147 131 115 99 83 67 51 35 19 3
>
> ....
>
> (kgdb) list *0xc07eefec
> 0xc07eefec is in sbappendaddr_locked 
> (/usr/src.local/sys/kern/uipc_sockbuf.c:652).
> 647		if (n)
> 648			n->m_next = m0;		/* concatenate data to 
> control */
> 649		else
> 650			control = m0;
> 651		m->m_next = control;
> 652		for (n = m; n->m_next != NULL; n = n->m_next)
> 653			sballoc(sb, n);
> 654		sballoc(sb, n);
> 655		nlast = n;
> 656		SBLINKRECORD(sb, m);
> (kgdb) bt
> #0  doadump () at pcpu.h:196
> #1  0xc079cf07 in boot (howto=260) at 
> /usr/src.local/sys/kern/kern_shutdown.c:418
> #2  0xc079d1d9 in panic (fmt=Variable "fmt" is not available.
> ) at /usr/src.local/sys/kern/kern_shutdown.c:574
> #3  0xc0ab110c in trap_fatal (frame=0xe4339a80, eva=1024) at 
> /usr/src.local/sys/i386/i386/trap.c:939
> #4  0xc0ab1390 in trap_pfault (frame=0xe4339a80, usermode=0, eva=1024) at 
> /usr/src.local/sys/i386/i386/trap.c:852
> #5  0xc0ab1d4c in trap (frame=0xe4339a80) at 
> /usr/src.local/sys/i386/i386/trap.c:530
> #6  0xc0a97bbb in calltrap () at /usr/src.local/sys/i386/i386/exception.s:159
> #7  0xc07eefec in sbappendaddr_locked (sb=0xc5bacd50, asa=0xe4339b90, 
> m0=0xc4167000, control=0xc4167000) at 
> /usr/src.local/sys/kern/uipc_sockbuf.c:652
> #8  0xc08ecb71 in udp_append (inp=Variable "inp" is not available.
> ) at /usr/src.local/sys/netinet/udp_usrreq.c:254
> #9  0xc08edf7a in udp_input (m=0xc4167000, off=20) at 
> /usr/src.local/sys/netinet/udp_usrreq.c:567
> #10 0xc087d320 in ip_input (m=0xc4167000) at 
> /usr/src.local/sys/netinet/ip_input.c:665
> #11 0xc0842a85 in netisr_dispatch (num=2, m=0xc4167000) at 
> /usr/src.local/sys/net/netisr.c:185
> #12 0xc08389f1 in ether_demux (ifp=0xc41b6800, m=0xc4167000) at 
> /usr/src.local/sys/net/if_ethersubr.c:834
> #13 0xc0838de3 in ether_input (ifp=0xc41b6800, m=0xc4167000) at 
> /usr/src.local/sys/net/if_ethersubr.c:692
> #14 0xc071750b in vr_intr (arg=0xc41c8000) at 
> /usr/src.local/sys/dev/vr/if_vr.c:1415
> #15 0xc077bf0b in ithread_loop (arg=0xc41c5550) at 
> /usr/src.local/sys/kern/kern_intr.c:1088
> #16 0xc0778a79 in fork_exit (callout=0xc077bd50 <ithread_loop>, 
> arg=0xc41c5550, frame=0xe4339d38) at /usr/src.local/sys/kern/kern_fork.c:804
> #17 0xc0a97c30 in fork_trampoline () at 
> /usr/src.local/sys/i386/i386/exception.s:264
> (kgdb)
>
> _______________________________________________
> freebsd-stable at freebsd.org mailing list
> http://lists.freebsd.org/mailman/listinfo/freebsd-stable
> To unsubscribe, send any mail to "freebsd-stable-unsubscribe at freebsd.org"
>