DragonFlyBSD

On Sun, Jul 25, 2010 at 04:59:55PM +0200, Max Herrg?rd wrote:

This is a continuation of issue 1785: http://bugs.dragonflybsd.org/issue1785

I'm now running with BUS_DMA_NOWAIT as Joe Talbott told me. See attached patch.

My problem right now is when I fool around with wpa_supplicant. On a second use it panics.

zoidberg# ifconfig wlan0 create wlandev ral0 up
ral0: need multicast update callback
zoidberg# wpa_supplicant -i wlan0 -c /etc/wpa_supplicant.conf
Trying to associate with 00:1d:7e:f0:fd:1f (SSID='moh' freq=2422 MHz)
Associated with 00:1d:7e:f0:fd:1f
WPA: Key negotiation completed with 00:1d:7e:f0:fd:1f [PTK=CCMP GTK=CCMP]
CTRL-EVENT-CONNECTED - Connection to 00:1d:7e:f0:fd:1f completed (auth) [id=0 id_str=]
^C
CTRL-EVENT-TERMINATING - signal 2 received
ioctl[SIOCS80211, op 20, len 7]: Can't assign requested address
ioctl[SIOCS80211, op 26, arg 0x0]: Operation not supported
Failed to disable WPA in the driver.
ioctl[SIOCS80211, op 26, arg 0x0]: Operation not supported
ELOOP: remaining socket: sock=4 eloop_data=0x283c0080 user_data=0x28400070 handler=0x806518b
zoidberg# wpa_supplicant -i wlan0 -c /etc/wpa_supplicant.conf
panic

Same if I set it up in rc.conf and do a 'rcrestart netif'

The panic looks like this:

Unread portion of the kernel message buffer:

Fatal trap 12: page fault while in kernel mode
fault virtual address = 0
fault code = supervisor read, page not present
instruction pointer = 0x8:0xc029fcfc
stack pointer = 0x10:0xd7c78cb8
frame pointer = 0x10:0xd7c78d08
code segment = base 0x0, limit 0xfffff, type 0x1b = DPL 0, pres 1, def32 1, gran 1
processor eflags = interrupt enabled, resume, IOPL = 0
current process = Idle
current thread = pri 60 (CRIT)

kernel: type 12 trap, code=0
panic: from debugger

Fatal trap 3: breakpoint instruction fault while in kernel mode
instruction pointer = 0x8:0xc05517f8
stack pointer = 0x10:0xd7c78ac8
frame pointer = 0x10:0xd7c78ad0
code segment = base 0x0, limit 0xfffff, type 0x1b = DPL 0, pres 1, def32 1, gran 1
processor eflags = interrupt enabled, IOPL = 0
current process = Idle
current thread = pri 92 (CRIT)

panic: from debugger
Uptime: 3m49s
Physical memory: 2038 MB
Dumping 159 MB: 144 128 112 96 80 64 48 32 16

Reading symbols from /boot/modules/vesa.ko...done.
Loaded symbols for /boot/modules/vesa.ko
Reading symbols from /boot/modules/snd_emu10k1.ko...done.
Loaded symbols for /boot/modules/snd_emu10k1.ko
Reading symbols from /boot/modules/sound.ko...done.
Loaded symbols for /boot/modules/sound.ko
Reading symbols from /boot/modules/dsched_fq.ko...done.
Loaded symbols for /boot/modules/dsched_fq.ko
Reading symbols from /boot/modules/acpi.ko...done.
Loaded symbols for /boot/modules/acpi.ko
Reading symbols from /boot/modules/ehci.ko...done.
Loaded symbols for /boot/modules/ehci.ko
get_mycpu (di=0xc06d8280) at ./machine/thread.h:83
83 __asm ("movl %%fs:globaldata,%0" : "=r" (gd) : "m"(_mycpu__dummy));
(kgdb) bt
#0 _get_mycpu (di=0xc06d8280) at ./machine/thread.h:83
#1 md_dumpsys (di=0xc06d8280) at /usr/src/sys/platform/pc32/i386/dump_machdep.c:263
#2 0xc031a259 in dumpsys () at /usr/src/sys/kern/kern_shutdown.c:839
#3 0xc031a7d4 in boot (howto=260) at /usr/src/sys/kern/kern_shutdown.c:388
#4 0xc031a8fa in panic (fmt=0xc05ae872 "from debugger") at /usr/src/sys/kern/kern_shutdown.c:745
#5 0xc0178965 in db_panic (addr=-1070990084, have_addr=0, count=-1, modif=0xd7c78b30 "") at /usr/src/sys/ddb/db_command.c:448
#6 0xc0178fda in db_command () at /usr/src/sys/ddb/db_command.c:344
#7 db_command_loop () at /usr/src/sys/ddb/db_command.c:470
#8 0xc017b5e8 in db_trap (type=12, code=0) at /usr/src/sys/ddb/db_trap.c:71
#9 0xc0551964 in kdb_trap (type=12, code=0, regs=0xd7c78c70) at /usr/src/sys/platform/pc32/i386/db_interface.c:152
#10 0xc05637a0 in trap_fatal (frame=0xd7c78c70, eva=<value optimized out>) at /usr/src/sys/platform/pc32/i386/trap.c:1120
#11 0xc0563902 in trap_pfault (frame=0xd7c78c70, usermode=0, eva=0) at /usr/src/sys/platform/pc32/i386/trap.c:1026
#12 0xc0563dd4 in trap (frame=0xd7c78c70) at /usr/src/sys/platform/pc32/i386/trap.c:713
#13 0xc0552d37 in calltrap () at /usr/src/sys/platform/pc32/i386/exception.s:785
#14 0xc029fcfc in rt2661_tx_intr (arg=0xd7bfc748) at /usr/src/sys/dev/netif/ral/rt2661.c:902
#15 rt2661_intr (arg=0xd7bfc748) at /usr/src/sys/dev/netif/ral/rt2661.c:1204
#16 0xc03251db in lwkt_serialize_handler_call (s=0xc48e95e4, func=0xc029f765 <rt2661_intr>, arg=0xd7bfc748, frame=0x0) at /usr/src/sys/kern/lwkt_serialize.c:228
#17 0xc02fb49e in ithread_handler (arg=0xb) at /usr/src/sys/kern/kern_intr.c:814
#18 0xc0322b2f in lwkt_deschedule_self (td=Cannot access memory at address 0x8) at /usr/src/sys/kern/lwkt_thread.c:250
Backtrace stopped: previous frame inner to this frame (corrupt stack?)

Max,

Can you upload your kernel image and core to leaf so I can take a
look?

Thanks,
Joe

Max

25 jul 2010 kl. 18.14 Joe Talbott wrote:

On Sun, Jul 25, 2010 at 04:59:55PM +0200, Max Herrg?rd wrote:

(kgdb) bt
#0 _get_mycpu (di=0xc06d8280) at ./machine/thread.h:83
#1 md_dumpsys (di=0xc06d8280) at /usr/src/sys/platform/pc32/i386/dump_machdep.c:263
#2 0xc031a259 in dumpsys () at /usr/src/sys/kern/kern_shutdown.c:839
#3 0xc031a7d4 in boot (howto=260) at /usr/src/sys/kern/kern_shutdown.c:388
#4 0xc031a8fa in panic (fmt=0xc05ae872 "from debugger") at /usr/src/sys/kern/kern_shutdown.c:745
#5 0xc0178965 in db_panic (addr=-1070990084, have_addr=0, count=-1, modif=0xd7c78b30 "") at /usr/src/sys/ddb/db_command.c:448
#6 0xc0178fda in db_command () at /usr/src/sys/ddb/db_command.c:344
#7 db_command_loop () at /usr/src/sys/ddb/db_command.c:470
#8 0xc017b5e8 in db_trap (type=12, code=0) at /usr/src/sys/ddb/db_trap.c:71
#9 0xc0551964 in kdb_trap (type=12, code=0, regs=0xd7c78c70) at /usr/src/sys/platform/pc32/i386/db_interface.c:152
#10 0xc05637a0 in trap_fatal (frame=0xd7c78c70, eva=<value optimized out>) at /usr/src/sys/platform/pc32/i386/trap.c:1120
#11 0xc0563902 in trap_pfault (frame=0xd7c78c70, usermode=0, eva=0) at /usr/src/sys/platform/pc32/i386/trap.c:1026
#12 0xc0563dd4 in trap (frame=0xd7c78c70) at /usr/src/sys/platform/pc32/i386/trap.c:713
#13 0xc0552d37 in calltrap () at /usr/src/sys/platform/pc32/i386/exception.s:785
#14 0xc029fcfc in rt2661_tx_intr (arg=0xd7bfc748) at /usr/src/sys/dev/netif/ral/rt2661.c:902
#15 rt2661_intr (arg=0xd7bfc748) at /usr/src/sys/dev/netif/ral/rt2661.c:1204
#16 0xc03251db in lwkt_serialize_handler_call (s=0xc48e95e4, func=0xc029f765 <rt2661_intr>, arg=0xd7bfc748, frame=0x0) at /usr/src/sys/kern/lwkt_serialize.c:228
#17 0xc02fb49e in ithread_handler (arg=0xb) at /usr/src/sys/kern/kern_intr.c:814
#18 0xc0322b2f in lwkt_deschedule_self (td=Cannot access memory at address 0x8) at /usr/src/sys/kern/lwkt_thread.c:250
Backtrace stopped: previous frame inner to this frame (corrupt stack?)

Max,

Can you upload your kernel image and core to leaf so I can take a
look?

Thanks,
Joe

Hi Joe,

It's uploaded to leaf~mh and called *.14.

I also uploaded this other panic as *.15. It too came when playing around with wpa_supplicant, together with lots of those intr livelock limit engaged msgs. It looks like this:

Unread portion of the kernel message buffer:
panic: rate 0 has no info
Trace beginning at frame 0xc453598c
panic(ffffffff) at panic+0x8e
panic(c05bdb65,0,c48e9400,d7bfc748,d7deeab8) at panic+0x8e
rt2661_start_locked(d7bfc95c,2,c06df0d4,c48e94f0,c4535ab8) at rt2661_start_locked+0x7fa
rt2661_start(c48e9400,205ad0,0,1,0) at rt2661_start+0x1f
ifq_dispatch(c48e9400,dc2f5500,c4535acc,b5a10800,dd865b39) at ifq_dispatch+0x13a
ieee80211_handoff(c48e9400,dc2f5500) at ieee80211_handoff+0x28
ieee80211_start(c48e9200,c4535c80,0,1,0) at ieee80211_start+0x677
ifq_dispatch(c48e9200,dc2f5500,c4535b58) at ifq_dispatch+0x13a
ether_output_frame(c48e9200,dc2f5500,dc2f55ca,dc2f55ca,0) at ether_output_frame+0x1be
ether_output(c48e9200,dc2f5500,c4535cb8,0,0) at ether_output+0x29b
ieee80211_output(c48e9200,dc2f5500,c4535cb8,0,d7b25278) at ieee80211_output+0x2f
nd6_output(c48e9200,c48e9200,dc2f5500,c4535cb8,0) at nd6_output+0x29e
ip6_output(dc2f5500,c071af60,c4535cb4,0,c4535d24) at ip6_output+0xca4
mld6_sendpkt(c0685ec0,c0686080,c4535d54,c03e7d98,c4535d64) at mld6_sendpkt+0x181
mld6_fasttimeo(c4535d64,c034ca27,c06df0d4,c06df0c0,c4535d84) at mld6_fasttimeo+0x61
icmp6_fasttimo(c06df0d4,c06df0c0,c4535d84,c032cc2b,0) at icmp6_fasttimo+0x8
pffasttimo(0,d4315c58,c034ca07,c06bfc60,ff800000) at pffasttimo+0x20
softclock_handler(c06df0c0,0,0,0,0) at softclock_handler+0x108
lwkt_exit() at lwkt_exit
Debugger("panic")
panic: from debugger
Uptime: 1m52s
Physical memory: 2038 MB
Dumping 150 MB: 135 119 103 87 71 55 39 23 7

Reading symbols from /boot/modules/vesa.ko...done.
Loaded symbols for /boot/modules/vesa.ko
Reading symbols from /boot/modules/dsched_fq.ko...done.
Loaded symbols for /boot/modules/dsched_fq.ko
Reading symbols from /boot/modules/acpi.ko...done.
Loaded symbols for /boot/modules/acpi.ko
get_mycpu (di=0xc06d8300) at ./machine/thread.h:83
83 __asm ("movl %%fs:globaldata,%0" : "=r" (gd) : "m"(_mycpu__dummy));
(kgdb) bt
#0 _get_mycpu (di=0xc06d8300) at ./machine/thread.h:83
#1 md_dumpsys (di=0xc06d8300) at /usr/src/sys/platform/pc32/i386/dump_machdep.c:263
#2 0xc031a265 in dumpsys () at /usr/src/sys/kern/kern_shutdown.c:839
#3 0xc031a7e0 in boot (howto=260) at /usr/src/sys/kern/kern_shutdown.c:388
#4 0xc031a906 in panic (fmt=0xc05ae8b2 "from debugger") at /usr/src/sys/kern/kern_shutdown.c:745
#5 0xc0178965 in db_panic (addr=-1068165080, have_addr=0, count=-1, modif=0xc4535844 "") at /usr/src/sys/ddb/db_command.c:448
#6 0xc0178fda in db_command () at /usr/src/sys/ddb/db_command.c:344
#7 db_command_loop () at /usr/src/sys/ddb/db_command.c:470
#8 0xc017b5e8 in db_trap (type=3, code=0) at /usr/src/sys/ddb/db_trap.c:71
#9 0xc0551994 in kdb_trap (type=3, code=0, regs=0xc453593c) at /usr/src/sys/platform/pc32/i386/db_interface.c:152
#10 0xc0563f27 in trap (frame=0xc453593c) at /usr/src/sys/platform/pc32/i386/trap.c:837
#11 0xc0552d67 in calltrap () at /usr/src/sys/platform/pc32/i386/exception.s:785
#12 0xc0551828 in breakpoint (msg=0xc05c67ca "panic") at ./cpu/cpufunc.h:73
#13 Debugger (msg=0xc05c67ca "panic") at /usr/src/sys/platform/pc32/i386/db_interface.c:334
#14 0xc031a8fd in panic (fmt=0xc05bdb65 "rate %d has no info") at /usr/src/sys/kern/kern_shutdown.c:743
#15 0xc029f58e in rt2661_tx_data (ifp=0xc48e9400) at /usr/src/sys/netproto/802_11/ieee80211_phy.h:126
#16 rt2661_start_locked (ifp=0xc48e9400) at /usr/src/sys/dev/netif/ral/rt2661.c:1639
#17 0xc029f753 in rt2661_start (ifp=0xc48e9400) at /usr/src/sys/dev/netif/ral/rt2661.c:1655
#18 0xc038b612 in ifq_dispatch (ifp=0xc48e9400, m=0xdc2f5500, pa=0xc4535acc) at /usr/src/sys/net/if.c:2275
#19 0xc03a563a in ieee80211_handoff (dst_ifp=0xc48e9400, m=0x12) at /usr/src/sys/netproto/802_11/wlan/ieee80211_dragonfly.c:734
#20 0xc03bf36f in ieee80211_start (ifp=0xc48e9200) at /usr/src/sys/netproto/802_11/wlan/ieee80211_output.c:363
#21 0xc038b612 in ifq_dispatch (ifp=0xc48e9200, m=0xdc2f5500, pa=0xc4535b58) at /usr/src/sys/net/if.c:2275
#22 0xc038cb7d in ether_output_frame (ifp=0xc48e9200, m=0xdc2f5500) at /usr/src/sys/net/if_ethersubr.c:534
#23 0xc038ce2a in ether_output (ifp=0xc48e9200, m=0xdc2f5500, dst=0xc4535cb8, rt=0x0) at /usr/src/sys/net/if_ethersubr.c:468
#24 0xc03bcc3c in ieee80211_output (ifp=0xc48e9200, m=0xdc2f5500, dst=0xc4535cb8, rt=0x0) at /usr/src/sys/netproto/802_11/wlan/ieee80211_output.c:408
#25 0xc03fc87d in nd6_output (ifp=0xc48e9200, origifp=0xc48e9200, m=0xdc2f5500, dst=0xc4535cb8, rt=0x0) at /usr/src/sys/netinet6/nd6.c:1959
#26 0xc03f4dac in ip6_output (m0=0xdc2f5500, opt=0xc071af60, ro=0xc4535cb4, flags=0, im6o=0xc4535d24, ifpp=0xc4535d20, inp=0x0) at /usr/src/sys/netinet6/ip6_output.c:956
#27 0xc03fb639 in mld6_sendpkt (in6m=0xc4603660, type=<value optimized out>, dst=0x0) at /usr/src/sys/netinet6/mld6.c:452
#28 0xc03fbbbf in mld6_fasttimeo () at /usr/src/sys/netinet6/mld6.c:362
#29 0xc03e7d98 in icmp6_fasttimo () at /usr/src/sys/netinet6/icmp6.c:2108
#30 0xc034ca27 in pffasttimo (arg=0x0) at /usr/src/sys/kern/uipc_domain.c:260
#31 0xc032cc2b in softclock_handler (arg=0xc06df0c0) at /usr/src/sys/kern/kern_timeout.c:307
#32 0xc0322b3b in lwkt_deschedule_self (td=Cannot access memory at address 0x8
) at /usr/src/sys/kern/lwkt_thread.c:250
Backtrace stopped: previous frame inner to this frame (corrupt stack?)

Max

On Mon, Jul 26, 2010 at 05:48:47PM +0200, Max Herrg?rd wrote:

25 jul 2010 kl. 18.14 Joe Talbott wrote:

On Sun, Jul 25, 2010 at 04:59:55PM +0200, Max Herrg?rd wrote:

(kgdb) bt
#0 _get_mycpu (di=0xc06d8280) at ./machine/thread.h:83
#1 md_dumpsys (di=0xc06d8280) at /usr/src/sys/platform/pc32/i386/dump_machdep.c:263
#2 0xc031a259 in dumpsys () at /usr/src/sys/kern/kern_shutdown.c:839
#3 0xc031a7d4 in boot (howto=260) at /usr/src/sys/kern/kern_shutdown.c:388
#4 0xc031a8fa in panic (fmt=0xc05ae872 "from debugger") at /usr/src/sys/kern/kern_shutdown.c:745
#5 0xc0178965 in db_panic (addr=-1070990084, have_addr=0, count=-1, modif=0xd7c78b30 "") at /usr/src/sys/ddb/db_command.c:448
#6 0xc0178fda in db_command () at /usr/src/sys/ddb/db_command.c:344
#7 db_command_loop () at /usr/src/sys/ddb/db_command.c:470
#8 0xc017b5e8 in db_trap (type=12, code=0) at /usr/src/sys/ddb/db_trap.c:71
#9 0xc0551964 in kdb_trap (type=12, code=0, regs=0xd7c78c70) at /usr/src/sys/platform/pc32/i386/db_interface.c:152
#10 0xc05637a0 in trap_fatal (frame=0xd7c78c70, eva=<value optimized out>) at /usr/src/sys/platform/pc32/i386/trap.c:1120
#11 0xc0563902 in trap_pfault (frame=0xd7c78c70, usermode=0, eva=0) at /usr/src/sys/platform/pc32/i386/trap.c:1026
#12 0xc0563dd4 in trap (frame=0xd7c78c70) at /usr/src/sys/platform/pc32/i386/trap.c:713
#13 0xc0552d37 in calltrap () at /usr/src/sys/platform/pc32/i386/exception.s:785
#14 0xc029fcfc in rt2661_tx_intr (arg=0xd7bfc748) at /usr/src/sys/dev/netif/ral/rt2661.c:902
#15 rt2661_intr (arg=0xd7bfc748) at /usr/src/sys/dev/netif/ral/rt2661.c:1204
#16 0xc03251db in lwkt_serialize_handler_call (s=0xc48e95e4, func=0xc029f765 <rt2661_intr>, arg=0xd7bfc748, frame=0x0) at /usr/src/sys/kern/lwkt_serialize.c:228
#17 0xc02fb49e in ithread_handler (arg=0xb) at /usr/src/sys/kern/kern_intr.c:814
#18 0xc0322b2f in lwkt_deschedule_self (td=Cannot access memory at address 0x8) at /usr/src/sys/kern/lwkt_thread.c:250
Backtrace stopped: previous frame inner to this frame (corrupt stack?)

Max,

Can you upload your kernel image and core to leaf so I can take a
look?

Thanks,
Joe

Hi Joe,

It's uploaded to leaf~mh and called *.14.

Max,

Please try this patch for the first panic. I'm still looking at the
second one.

Thanks,
Joe

I'll close this now since my ral card seems to work ok.