Date: Thu, 8 Feb 2001 00:00:49 -0800 (PST) From: Luigi Rizzo <rizzo@aciri.org> To: richw@webcom.com (Rich Wales) Cc: rizzo@aciri.org, bmilekic@technokratis.com, luigi@FreeBSD.ORG, freebsd-net@FreeBSD.ORG Subject: Re: Fw: if_ed.c && BRIDGE Message-ID: <200102080800.f1880s410219@iguana.aciri.org> In-Reply-To: <20010208042021.71196.richw@wyattearp.stanford.edu> from Rich Wales at "Feb 7, 2001 8:26:58 pm"
next in thread | previous in thread | raw e-mail | index | archive | help
interesting dump... because it shows a bogus "length" parameter passed to ed_pio_readmem() Can you by chance find out what is the "len" value passed to ed_get_packet ? The printout in line #10 below is partially deleted by some error message. Now, NE2000 clones if you look at the driver are known for occasionally swapping the bytes of the length, but the driver was supposed to take care of this. Evidently there is some odd thing... cheers luigi > > > Just one thing, before posting details could you verify that > > the problem still occurs with the code that is in -STABLE as > > of today? I have done a bunch of changes to this and related > > code over the last couple of weeks, including testing on an > > "ed" card, and have not seen any panic on that lately (I did > > manage to produce a panic before some of these commits so I > > am not claiming that the problem never existed). > > I built a new kernel from the -STABLE code (cvsup'ed last night, Tue. > 2/6 at 20:26), and stress-tested it by downloading a large file over > a high-speed (1.3Mbit/sec) DSL line using a Compex NE2000-compatible > PCI NIC (ed0) as part of a bridge cluster. It crashed; see below for > a trace of the crash dump. > > Rich Wales richw@webcom.com http://www.webcom.com/richw/ > > ======================================================================== > > gateway# gdb -k > GNU gdb 4.18 > Copyright 1998 Free Software Foundation, Inc. > GDB is free software, covered by the GNU General Public License, and you are > welcome to change it and/or distribute copies of it under certain conditions. > Type "show copying" to see the conditions. > There is absolutely no warranty for GDB. Type "show warranty" for details. > This GDB was configured as "i386-unknown-freebsd". > (kgdb) symbol-file kernel-d.debug > Reading symbols from kernel.debug...done. > (kgdb) exec-file /var/crash/kernel.3 > (kgdb) core-file /var/crash/vmcore.3 > IdlePTD 4284416 > initial pcb at 374340 > panic messages: > --- > Fatal trap 12: page fault while in kernel mode > fault virtual address = 0xc0947000 > fault code = supervisor write, page not present > instruction pointer = 0x8:0xc02aa2b9 > stack pointer = 0x10:0xc0342a7c > frame pointer = 0x10:0xc0342a88 > code segment = base 0x0, limit 0xfffff, type 0x1b > = DPL 0, pres 1, def32 1, gran 1 > processor eflags = interrupt enabled, resume, IOPL = 0 > current process = Idle > interrupt mask = net > > dumping to dev #ad/0x30001, offset 53248 > dump ata0: resetting devices .. done > 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 > --- > #0 dumpsys () at /big/4.2/usr/STABLE/src/sys/kern/kern_shutdown.c:469 > 469 if (dumping++) { > (kgdb) where > #0 dumpsys () at /big/4.2/usr/STABLE/src/sys/kern/kern_shutdown.c:469 > #1 0xc013a495 in db_fncall (dummy1=0, dummy2=0, dummy3=0, > dummy4=0xc03428e8 "4)4À") > at /big/4.2/usr/STABLE/src/sys/ddb/db_command.c:532 > #2 0xc013a2c1 in db_command (last_cmdp=0xc0345d1c, cmd_table=0xc0345b7c, > aux_cmd_tablep=0xc036f034) > at /big/4.2/usr/STABLE/src/sys/ddb/db_command.c:333 > #3 0xc013a386 in db_command_loop () > at /big/4.2/usr/STABLE/src/sys/ddb/db_command.c:455 > #4 0xc013c493 in db_trap (type=12, code=0) > at /big/4.2/usr/STABLE/src/sys/ddb/db_trap.c:71 > #5 0xc02be0ba in kdb_trap (type=12, code=0, regs=0xc0342a3c) > at /big/4.2/usr/STABLE/src/sys/i386/i386/db_interface.c:158 > #6 0xc02cd2c0 in trap_fatal (frame=0xc0342a3c, eva=3230953472) > at /big/4.2/usr/STABLE/src/sys/i386/i386/trap.c:946 > #7 0xc02ccf99 in trap_pfault (frame=0xc0342a3c, usermode=0, eva=3230953472) > at /big/4.2/usr/STABLE/src/sys/i386/i386/trap.c:844 > #8 0xc02ccb0f in trap (frame={tf_fs = 16, tf_es = 16, tf_ds = 16, > tf_edi = -1064013824, tf_esi = 54272, tf_ebp = -1070323064, > tf_isp = -1070323096, tf_ebx = 16, tf_edx = 54288, tf_ecx = 27932, > tf_eax = -1061304128, tf_trapno = 12, tf_err = 2, tf_eip = -1070947655, > tf_cs = 8, tf_eflags = 66118, tf_esp = 6126, tf_ss = -1064017366}) > at /big/4.2/usr/STABLE/src/sys/i386/i386/trap.c:443 > #9 0xc02aa2b9 in ed_pio_readmem (sc=0xc0bdda00, src=19456, > dst=0xc094622a "ÔF·GõCÄ3\211ç\005®Ô\2004gÅ¡c\204H\2135Éÿ\023¬xog@\025\226ã¥z\a+Óþôt\217p¦upô", amount=59406) at machine/cpufunc.h:213 > #10 0xc02aa12b in ed_get_packet (sc=0xc0bdda00, buf=0x6804cannot read proc at 0 > ) > at /big/4.2/usr/STABLE/src/sys/dev/ed/if_ed.c:2587 > #11 0xc02a9a2b in edintr (arg=0xc0bdda00) > at /big/4.2/usr/STABLE/src/sys/dev/ed/if_ed.c:2179 > #12 0xc02d52a5 in intr_mux (arg=0xc08b64e0) > at /big/4.2/usr/STABLE/src/sys/i386/isa/intr_machdep.c:582 > (kgdb) > > ======================================================================== > > > > To Unsubscribe: send mail to majordomo@FreeBSD.org > with "unsubscribe freebsd-net" in the body of the message > To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-net" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200102080800.f1880s410219>