On Sun, 13 Jun 2004, Peter Schuller wrote: > Hello, > > i am experiencing a reproducable 'page fault while in kernel mode' with > CURRENT (from a couple of weeks ago aswell as one cvsuped today). It happens > extremely early during boot right after the root filesystem is mounted. This > does not happen with 5.2.1-RELEASE. That's what I saw on my T40. However, this only happens if I boot with a GENERIC kernel instead of a custom one. > I have tried setting 'dumpdev' appropriately (/dev/ad0s2b in my case), but no > crash dumps are written (not automatically, and not in response to the > 'panic' command in the kernel debugger). What should I do in order to provide > the necessary information about this bug? I'm not sure about that; however, I can get the backtrace reliably by issuing a 'panic' command in DDB. > The bug *may* be triggered by the fact that the root filesystem has been > mounted read-write since the last crash that originally marked the file > system dirty. I do this sometimes to get around the fact that the startup > sequence won't defer the root fs for bgfsck until it's been mounted rw at > least once since being marked dirty. Perhaps this is also related to the thread "Thinkpad panic woes (was Re: CDRW causes Thinkpad T41 to panic)" about two weeks ago? http://lists.freebsd.org/pipermail/freebsd-current/2004-June/028173.html > > If I boot into single user mount it will survive mounting the root filesystem > ro. It has also survived, at least once, remounting rw, but then crashed when > I did a 'sync'. On another occasion, I let it boot to single user mode, > mounting ro, after which it crashed when I did 'sysctl -a | grep dumpdev'. > > So. I have kept the filesystem dirty, interrupting the bg fsck_ufs when > booting with 5.2.1 in order to maintain the state which triggers the bug. I > had meant to post a full stack trace but since I am unable to obtain a dump, > I will at least include what's on the screen even though it's probably > useless: > > == > Memory modified after free 0xc1c08600(508) val=1000100 _at_ 0xc1c08600 > > Fatal trap 12: page fault while in kernel mode > fault virtual address = 0x1000120 > fault code = supervisor read, page not present > instruction pointer = 0x8 :0xc063d63e > stack pointer = 0x10 :0xd5469984 > frame pointer = 0x10 :0xd54699a0 > code segment = base 0x0, limit 0xfffff, type 0x1b > = DPL 0, pres 1, def32 1, gran 1 > processor eflags = interrupt enabled, resume, IOPL = 0 > current process = 64 (sh) > kernel: type 12 trap, code=0 > Stopped at mtrash_ctor+0x3a: movl 0x20(%eax),%eax It looks like the second panic message around line 138 triggered this panic "earlier" -- the content of *ksp is trashed; therefore, the reference through (*ksp) to ks_shortdesc caused this panic. # cvsup'ed on Jun-11-2004 CST # Memory modified after free 0xc1740a00(508) val=1000100 _at_ 0xc1740a00 # kernel configuration file: /sys/i386/conf/GENERIC # panic: from debugger panic messages: --- Fatal trap 12: page fault while in kernel mode cpuid = 0; apic id = 00 fault virtual address = 0x1000120 fault code = supervisor read, page not present instruction pointer = 0x8:0xc072cf4e stack pointer = 0x10:0xdd153984 frame pointer = 0x10:0xdd1539a0 code segment = base 0x0, limit 0xfffff, type 0x1b = DPL 0, pres 1, def32 1, gran 1 processor eflags = interrupt enabled, resume, IOPL = 0 current process = 624 (csh) kernel: type 12 trap, code=0 Fatal trap 12: page fault while in kernel mode cpuid = 0; apic id = 00 fault virtual address = 0x1000120 fault code = supervisor read, page not present instruction pointer = 0x8:0xc072cf4e stack pointer = 0x10:0xdd153984 frame pointer = 0x10:0xdd1539a0 code segment = base 0x0, limit 0xfffff, type 0x1b = DPL 0, pres 1, def32 1, gran 1 processor eflags = interrupt enabled, resume, IOPL = 0 current process = 624 (csh) kernel: type 12 trap, code=0 exclusive sleep mutex Giant r = 0 (0xc0888140) locked _at_ /home/avatar/ncvs/src/sys/vm/vm_map.c:1393 panic: from debugger cpuid = 0; Fatal trap 3: breakpoint instruction fault while in kernel mode cpuid = 0; apic id = 00 instruction pointer = 0x8:0xc074ea3e stack pointer = 0x10:0xdd153768 frame pointer = 0x10:0xdd15376c code segment = base 0x0, limit 0xfffff, type 0x1b = DPL 0, pres 1, def32 1, gran 1 processor eflags = IOPL = 0 current process = 624 (csh) panic: from debugger cpuid = 0; Uptime: 1m17s Dumping 255 MB 16 32 48 64 80 96 112 128 144 160 176 192 208 224 240 --- Reading symbols from /boot/kernel/linux.ko...done. Loaded symbols for /boot/kernel/linux.ko Reading symbols from /boot/kernel/if_em.ko...done. Loaded symbols for /boot/kernel/if_em.ko Reading symbols from /boot/kernel/if_wi.ko...done. Loaded symbols for /boot/kernel/if_wi.ko Reading symbols from /boot/kernel/snd_ich.ko...done. Loaded symbols for /boot/kernel/snd_ich.ko Reading symbols from /boot/kernel/snd_pcm.ko...done. Loaded symbols for /boot/kernel/snd_pcm.ko Reading symbols from /boot/kernel/ums.ko...done. Loaded symbols for /boot/kernel/ums.ko Reading symbols from /boot/kernel/umass.ko...done. Loaded symbols for /boot/kernel/umass.ko Reading symbols from /boot/kernel/if_ath.ko...done. Loaded symbols for /boot/kernel/if_ath.ko Reading symbols from /boot/kernel/ath_hal.ko...done. Loaded symbols for /boot/kernel/ath_hal.ko Reading symbols from /boot/kernel/smbfs.ko...done. Loaded symbols for /boot/kernel/smbfs.ko Reading symbols from /boot/kernel/libmchain.ko...done. Loaded symbols for /boot/kernel/libmchain.ko Reading symbols from /boot/kernel/libiconv.ko...done. Loaded symbols for /boot/kernel/libiconv.ko Reading symbols from /boot/kernel/radeon.ko...done. Loaded symbols for /boot/kernel/radeon.ko Reading symbols from /boot/kernel/acpi.ko...done. Loaded symbols for /boot/kernel/acpi.ko Reading symbols from /boot/kernel/msdosfs_iconv.ko...done. Loaded symbols for /boot/kernel/msdosfs_iconv.ko Reading symbols from /boot/kernel/linprocfs.ko...done. Loaded symbols for /boot/kernel/linprocfs.ko #0 doadump () at /home/avatar/ncvs/src/sys/kern/kern_shutdown.c:236 236 dumping++; (kgdb) where #0 doadump () at /home/avatar/ncvs/src/sys/kern/kern_shutdown.c:236 #1 0xc05eba4c in boot (howto=260) at /home/avatar/ncvs/src/sys/kern/kern_shutdown.c:370 #2 0xc05ebd77 in panic () at /home/avatar/ncvs/src/sys/kern/kern_shutdown.c:548 #3 0xc045d985 in db_panic () at /home/avatar/ncvs/src/sys/ddb/db_command.c:453 #4 0xc045d91c in db_command (last_cmdp=0xc086b6e0, cmd_table=0xc07f6400, aux_cmd_tablep=0xc07ed508, aux_cmd_tablep_end=0xc07ed520) at /home/avatar/ncvs/src/sys/ddb/db_command.c:348 #5 0xc045d9f4 in db_command_loop () at /home/avatar/ncvs/src/sys/ddb/db_command.c:475 #6 0xc0460179 in db_trap (type=12, code=0) at /home/avatar/ncvs/src/sys/ddb/db_trap.c:73 #7 0xc074e781 in kdb_trap (type=12, code=0, regs=0xdd153944) at /home/avatar/ncvs/src/sys/i386/i386/db_interface.c:159 #8 0xc0761563 in trap_fatal (frame=0xdd153944, eva=16777504) at /home/avatar/ncvs/src/sys/i386/i386/trap.c:810 #9 0xc07612a7 in trap_pfault (frame=0xdd153944, usermode=0, eva=16777504) at /home/avatar/ncvs/src/sys/i386/i386/trap.c:733 #10 0xc0760f09 in trap (frame= {tf_fs = 24, tf_es = 16, tf_ds = 16, tf_edi = 0, tf_esi = -1049359872, tf_ebp = -585811552, tf_isp = -585811600, tf_ebx = -1049359364, tf_edx = 0, tf_ecx = -1056882688, tf_eax = 16777472, tf_trapno = 12, tf_err = 0, tf_eip = -10662176 50, tf_cs = 8, tf_eflags = 66054, tf_esp = -1065474503, tf_ss = -1049359872}) at /home/avatar/ncvs/src/sys/i386/i386/trap.c:420 #11 0xc072cf4e in mtrash_ctor (mem=0xc1740a00, size=0, arg=0x0) at /home/avatar/ncvs/src/sys/vm/uma_dbg.c:137 #12 0xc072b9cc in uma_zalloc_arg (zone=0xc10359a0, udata=0x0, flags=2) at /home/avatar/ncvs/src/sys/vm/uma_core.c:1642 #13 0xc05e29ca in malloc (size=3238288352, type=0xc0822a40, flags=2) at /home/avatar/ncvs/src/sys/vm/uma.h:270 #14 0xc05c9b09 in elf32_load_file (p=0xc19c4c08, file=0x0, addr=0xdd153ab0, entry=0x0, pagesize=4096) at /home/avatar/ncvs/src/sys/kern/imgact_elf.c:518 #15 0xc05ca307 in exec_elf32_imgact (imgp=0xdd153b94) at /home/avatar/ncvs/src/sys/kern/imgact_elf.c:827 #16 0xc05d582a in kern_execve (td=0xc19c6b00, fname=---Can't read userspace from dump, or kernel process---) at /home/avatar/ncvs/src/sys/kern/kern_exec.c:382 #17 0xc05d54cc in execve (td=0xc19c6b00, uap=0x0) at /home/avatar/ncvs/src/sys/kern/kern_exec.c:174 #18 0xc0761833 in syscall (frame= {tf_fs = 47, tf_es = 47, tf_ds = 47, tf_edi = 135295360, tf_esi = 135063552, tf_ebp = -1077958264, tf_isp = -585810572, tf_ebx = 672975340, tf_edx = 135063559, tf_ecx = 672975340, tf_eax = 59, tf_trapno = 22, tf_err = 2, tf_eip = 672504151, tf_cs = 31, tf_eflags = 514, tf_esp = -1077958292, tf_ss = 47}) at /home/avatar/ncvs/src/sys/i386/i386/trap.c:1004 #19 0x28159957 in ?? () ---Can't read userspace from dump, or kernel process--- (kgdb) f 11 #11 0xc072cf4e in mtrash_ctor (mem=0xc1740a00, size=0, arg=0x0) at /home/avatar/ncvs/src/sys/vm/uma_dbg.c:137 137 panic("Most recently used by %s\n", (*ksp == NULL)? (kgdb) l 132 133 for (p = mem; cnt > 0; cnt--, p++) 134 if (*p != uma_junk) { 135 printf("Memory modified after free %p(%d) val=%x _at_ %p\n", 136 mem, size, *p, p); 137 panic("Most recently used by %s\n", (*ksp == NULL)? 138 "none" : (*ksp)->ks_shortdesc); 139 } 140 } 141 (kgdb) print ksp $1 = (struct malloc_type **) 0xc1740bfc (kgdb) print *ksp $2 = (struct malloc_type *) 0x1000100 (kgdb) print *ksp->ks_shortdesc ---Can't read userspace from dump, or kernel process---Received on Mon Jun 14 2004 - 00:34:10 UTC
This archive was generated by hypermail 2.4.0 : Wed May 19 2021 - 11:37:57 UTC