panic in arptimer

2015-10-19 Thread Takahiro Hayashi 

Hello,

Kernel panics in arptimer after detaching network interface.
See dmesg below please.
It happened on NetBSD/amd64 on GENERIC.201510182130Z from nyftp.
I think this problem looks like kern/50186.

How-To-Repeat:
1. Boot kernel into single user mode with "boot netbsd -s".
2. sysctl -w net.inet6.ip6.auto_linklocal=0
3. ifconfig interface .
4. Send one ping to other host.
5. Detach the interface with "drvctl -d".
6. Wait about 1200 seconds (actually 1200 sec after ping is sent).


I saw following panic after detaching "re0".

fatal page fault in supervisor mode
trap type 6 code 0 rip 808cbf2f cs 8 rflags 10246 cr2 873c7368 
ilevel 2 rsp fe80dabd1f08
curlwp 0xfe81071a30c0 pid 0.22 lowest kstack 0xfe80dabce2c0
kernel: page fault trap, code=0
Stopped in pid 0.22 (system) at netbsd:arptimer+0xc4:   movq360(%r15),%rdi
db{1}> bt
arptimer() at netbsd:arptimer+0xc4
callout_softclock() at netbsd:callout_softclock+0x1d0
softint_dispatch() at netbsd:softint_dispatch+0xd3
DDB lost frame for netbsd:Xsoftintr+0x4f, trying 0xfe80dabd1ff0
Xsoftintr() at netbsd:Xsoftintr+0x4f
--- interrupt ---
0:
db{1}> show reg
ds  1ee8
es  4040
fs  600
gs  3d5e
rdi fe81078c8a00
rsi f800
rbp fe80dabd1f38
rbx fe81078c8908
rdx 0
rcx 7
rax fe81071a30c4
r8  fe8107184040
r9  7d
r10 fe811eb244f4
r11 246
r12 fe81078c8a00
r13 fe81078c89b0
r14 0
r15 873c7008
rip 808cbf2farptimer+0xc4
cs  8
rflags  10246
rsp fe80dabd1f08
ss  10
netbsd:arptimer+0xc4:   movq360(%r15),%rdi
db{1}>


I met folloging panic after "drvctl -d axe0".

fatal page fault in supervisor mode
trap type 6 code 2 rip 8011bcdd cs 8 rflags 10282 cr2 0 ilevel 2 rsp 
fe80dabd1f00
curlwp 0xfe81071a30c0 pid 0.22 lowest kstack 0xfe80dabce2c0
kernel: page fault trap, code=0
Stopped in pid 0.22 (system) at netbsd:rw_enter+0x2d:   lock cmpxchgq   %rcx,0(%
rdi)
db{1}> bt
rw_enter() at netbsd:rw_enter+0x2d
callout_softclock() at netbsd:callout_softclock+0x1d0
softint_dispatch() at netbsd:softint_dispatch+0xd3
DDB lost frame for netbsd:Xsoftintr+0x4f, trying 0xfe80dabd1ff0
Xsoftintr() at netbsd:Xsoftintr+0x4f
--- interrupt ---
0:
db{1}> show reg
ds  1ee8
es  0
fs  fc00
gs  3d5e
rdi 0
rsi 1
rbp fe80dabd1f38
rbx fe811dbc8188
rdx 0
rcx fe81071a30c4
rax 0
r8  fe8107184040
r9  7d
r10 fe811eb244f4
r11 246
r12 fe811dbc8280
r13 fe811dbc8230
r14 0
r15 fe811de0b010
rip 8011bcddrw_enter+0x2d
cs  8
rflags  10282
rsp fe80dabd1f00
ss  10
netbsd:rw_enter+0x2d:   lock cmpxchgq   %rcx,0(%rdi)
db{1}>


--
t-hash

Re: panic in arptimer

2015-10-19 Thread Ryota Ozaki 
Hi,

I've reproduced the panic on my machine and I'm investing
the problem.

Thank you for the report,
  ozaki-r

On Mon, Oct 19, 2015 at 4:10 PM, Takahiro Hayashi  wrote:
> Hello,
>
> Kernel panics in arptimer after detaching network interface.
> See dmesg below please.
> It happened on NetBSD/amd64 on GENERIC.201510182130Z from nyftp.
> I think this problem looks like kern/50186.
>
> How-To-Repeat:
> 1. Boot kernel into single user mode with "boot netbsd -s".
> 2. sysctl -w net.inet6.ip6.auto_linklocal=0
> 3. ifconfig interface .
> 4. Send one ping to other host.
> 5. Detach the interface with "drvctl -d".
> 6. Wait about 1200 seconds (actually 1200 sec after ping is sent).
>
>
> I saw following panic after detaching "re0".
>
> fatal page fault in supervisor mode
> trap type 6 code 0 rip 808cbf2f cs 8 rflags 10246 cr2
> 873c7368 ilevel 2 rsp fe80dabd1f08
> curlwp 0xfe81071a30c0 pid 0.22 lowest kstack 0xfe80dabce2c0
> kernel: page fault trap, code=0
> Stopped in pid 0.22 (system) at netbsd:arptimer+0xc4:   movq
> 360(%r15),%rdi
> db{1}> bt
> arptimer() at netbsd:arptimer+0xc4
> callout_softclock() at netbsd:callout_softclock+0x1d0
> softint_dispatch() at netbsd:softint_dispatch+0xd3
> DDB lost frame for netbsd:Xsoftintr+0x4f, trying 0xfe80dabd1ff0
> Xsoftintr() at netbsd:Xsoftintr+0x4f
> --- interrupt ---
> 0:
> db{1}> show reg
> ds  1ee8
> es  4040
> fs  600
> gs  3d5e
> rdi fe81078c8a00
> rsi f800
> rbp fe80dabd1f38
> rbx fe81078c8908
> rdx 0
> rcx 7
> rax fe81071a30c4
> r8  fe8107184040
> r9  7d
> r10 fe811eb244f4
> r11 246
> r12 fe81078c8a00
> r13 fe81078c89b0
> r14 0
> r15 873c7008
> rip 808cbf2farptimer+0xc4
> cs  8
> rflags  10246
> rsp fe80dabd1f08
> ss  10
> netbsd:arptimer+0xc4:   movq360(%r15),%rdi
> db{1}>
>
>
> I met folloging panic after "drvctl -d axe0".
>
> fatal page fault in supervisor mode
> trap type 6 code 2 rip 8011bcdd cs 8 rflags 10282 cr2 0 ilevel 2 rsp
> fe80dabd1f00
> curlwp 0xfe81071a30c0 pid 0.22 lowest kstack 0xfe80dabce2c0
> kernel: page fault trap, code=0
> Stopped in pid 0.22 (system) at netbsd:rw_enter+0x2d:   lock cmpxchgq
> %rcx,0(%
> rdi)
> db{1}> bt
> rw_enter() at netbsd:rw_enter+0x2d
> callout_softclock() at netbsd:callout_softclock+0x1d0
> softint_dispatch() at netbsd:softint_dispatch+0xd3
> DDB lost frame for netbsd:Xsoftintr+0x4f, trying 0xfe80dabd1ff0
> Xsoftintr() at netbsd:Xsoftintr+0x4f
> --- interrupt ---
> 0:
> db{1}> show reg
> ds  1ee8
> es  0
> fs  fc00
> gs  3d5e
> rdi 0
> rsi 1
> rbp fe80dabd1f38
> rbx fe811dbc8188
> rdx 0
> rcx fe81071a30c4
> rax 0
> r8  fe8107184040
> r9  7d
> r10 fe811eb244f4
> r11 246
> r12 fe811dbc8280
> r13 fe811dbc8230
> r14 0
> r15 fe811de0b010
> rip 8011bcddrw_enter+0x2d
> cs  8
> rflags  10282
> rsp fe80dabd1f00
> ss  10
> netbsd:rw_enter+0x2d:   lock cmpxchgq   %rcx,0(%rdi)
> db{1}>
>
>
> --
> t-hash

Re: NFS related panic? (was: Re: Killing a zombie process?)

2015-10-19 Thread Rhialto 
On Tue 20 Oct 2015 at 01:04:59 +0200, Rhialto wrote:
> with a rebuilt netbsd.gdb (hopefully the addresses match)
> 
> #5  0x806b94b4 in nfs_sigintr (nmp=0x0, rep=0xfe81163730a8,
> l=0x0) at ../../../../nfs/nfs_socket.c:871

nmp should not be NULL here... let's look at rep, where it comes from
via "nmp = rep->r_nmp;"

(gdb) print *(struct nfsreq *)0xfe81163730a8
$1 = {r_chain = {tqe_next = 0xfe811edcee40, tqe_prev = 0x1}, r_mreq = 
0x828f9888, r_mrep = 0x0, r_md = 0x0, r_dpos = 0x0, r_nmp = 0x0, r_xid 
= 0, r_flags = 0, r_retry = 0, r_rexmit = 0, r_procnum = 0, r_rtt = 0, 
  r_lwp = 0x0}

well, r_chain.tqe_prev looks bogus (unless that's a special marker), so
let's look at tqe_next:

(gdb) print *((struct nfsreq *)0xfe81163730a8)->r_chain.tqe_next
$3 = {r_chain = {tqe_next = 0x0, tqe_prev = 0x15aa3c85d}, r_mreq = 
0xbd83e8af8fe58282, r_mrep = 0x81e39981e3a781e3, r_md = 0xe39d81e38180e38c, 
r_dpos = 0x8890e5b4a0e5ae81, r_nmp = 0xe57baf81e3ab81e3, r_xid = 2179183259, 
  r_flags = -1565268289, r_retry = 0, r_rexmit = 0, r_procnum = 1520683101, 
r_rtt = 1, r_lwp = 0x80e39981e3a781e3}

well, even more bogus. Too bad that the next frame has its argument
optimized out...

-Olaf.
-- 
___ Olaf 'Rhialto' Seibert  -- The Doctor: No, 'eureka' is Greek for
\X/ rhialto/at/xs4all.nl-- 'this bath is too hot.'


signature.asc
Description: PGP signature

Re: NFS related panic? (was: Re: Killing a zombie process?)

2015-10-19 Thread Rhialto 
with a rebuilt netbsd.gdb (hopefully the addresses match)

(gdb) target kvm netbsd.5.core
0x8063d735 in cpu_reboot (howto=howto@entry=260,
bootstr=bootstr@entry=0x0) at ../../../../arch/amd64/amd64/machdep.c:671
671 dumpsys();
(gdb) bt
#0  0x8063d735 in cpu_reboot (howto=howto@entry=260,
bootstr=bootstr@entry=0x0) at ../../../../arch/amd64/amd64/machdep.c:671
#1  0x80865182 in vpanic (fmt=0x80d123b2 "trap",
fmt@entry=0x80d123d2 "otection fault",
ap=ap@entry=0xfe80b9fc1d10) at ../../../../kern/subr_prf.c:340
#2  0x8086523d in panic (fmt=fmt@entry=0x80d123d2
"otection fault") at ../../../../kern/subr_prf.c:256
#3  0x808a84d6 in trap (frame=0xfe80b9fc1e30) at
../../../../arch/amd64/amd64/trap.c:298
#4  0x80100f46 in alltraps ()
#5  0x806b94b4 in nfs_sigintr (nmp=0x0, rep=0xfe81163730a8,
l=0x0) at ../../../../nfs/nfs_socket.c:871
#6  0x806b9b0e in nfs_timer (arg=) at
../../../../nfs/nfs_socket.c:752
#7  0x805e9458 in callout_softclock (v=) at
../../../../kern/kern_timeout.c:736
#8  0x805df84a in softint_execute (l=,
s=, si=) at
../../../../kern/kern_softint.c:589
#9  softint_dispatch (pinned=, s=2) at
../../../../kern/kern_softint.c:871
#10 0x8011402f in Xsoftintr ()

(gdb) kvm proc 0xfe813fb39860
nfs_timer (arg=) at ../../../../nfs/nfs_socket.c:735
735 {
(gdb) bt
#0  nfs_timer (arg=) at ../../../../nfs/nfs_socket.c:735
#1  0x in ?? ()

-Olaf.
-- 
___ Olaf 'Rhialto' Seibert  -- The Doctor: No, 'eureka' is Greek for
\X/ rhialto/at/xs4all.nl-- 'this bath is too hot.'


signature.asc
Description: PGP signature

NFS related panic? (was: Re: Killing a zombie process?)

2015-10-19 Thread Rhialto 
On Fri 16 Oct 2015 at 16:31:18 +0200, J. Hannken-Illjes wrote:
> On 16 Oct 2015, at 13:44, Rhialto  wrote:
> 
> > "Interesting" results: it built packages overnight (from around 22:30 to
> > 12:13, so for nearly 14 hours), then, when I didn't look, it rebooted.
> 
> With panic?

I re-tried and with a pure GENERIC 7.0 kernel it happened again and now
I have a crash dump. Its dmesg ends with this:

nfs server 10.0.0.16:/mnt/scratch: not responding
nfs server 10.0.0.16:/mnt/scratch: is alive again
fatal page fault in supervisor mode
trap type 6 code 0 rip 806b94b4 cs 8 rflags 10246 cr2 38 ilevel 2 rsp ff
fffe80b9fc1f28
curlwp 0xfe813fb39860 pid 0.5 lowest kstack 0xfe80b9fbf2c0
panic: trap
cpu0: Begin traceback...
vpanic() at netbsd:vpanic+0x13c
snprintf() at netbsd:snprintf
startlwp() at netbsd:startlwp
alltraps() at netbsd:alltraps+0x96
callout_softclock() at netbsd:callout_softclock+0x248
softint_dispatch() at netbsd:softint_dispatch+0x79
DDB lost frame for netbsd:Xsoftintr+0x4f, trying 0xfe80b9fc1ff0
Xsoftintr() at netbsd:Xsoftintr+0x4f
--- interrupt ---
0:
cpu0: End traceback...

dumping to dev 0,1 (offset=199775, size=1023726):


pid 0.5 is this:

PIDLID S CPU FLAGS   STRUCT LWP *   NAME WAIT
0>   5 7   0   200   fe813fb39860  softclk/0

gdb (without debugging symbols) so far thinks this is in nfs_timer():

(gdb) kvm proc 0xfe813fb39860
0x806b9aab in nfs_timer ()
(gdb) bt
#0  0x806b9aab in nfs_timer ()
#1  0x in ?? ()

-Olaf.
-- 
___ Olaf 'Rhialto' Seibert  -- The Doctor: No, 'eureka' is Greek for
\X/ rhialto/at/xs4all.nl-- 'this bath is too hot.'


signature.asc
Description: PGP signature

daily CVS update output

2015-10-19 Thread NetBSD source update 

Updating src tree:
P src/distrib/sets/lists/xserver/md.sgimips
P src/external/mit/xorg/server/drivers/Makefile
P src/share/man/man4/shmif.4
P src/share/mk/bsd.man.mk
P src/share/mk/bsd.own.mk
P src/sys/arch/arm/nvidia/files.tegra
P src/sys/arch/arm/nvidia/tegra_hdmi.c
P src/sys/arch/evbarm/tegra/tegra_machdep.c
P src/sys/dev/pci/pcidevs
P src/sys/dev/pci/pcidevs.h
P src/sys/dev/pci/pcidevs_data.h
P 
src/sys/external/bsd/drm2/dist/drm/nouveau/core/subdev/fb/nouveau_subdev_fb_ramgk20a.c
P src/sys/net/npf/npf.c
P src/sys/rump/Makefile.rump
P src/sys/rump/dev/lib/libaudio/Makefile
P src/sys/rump/dev/lib/libaudio_ac97/Makefile
P src/sys/rump/dev/lib/libbpf/Makefile
P src/sys/rump/dev/lib/libcgd/Makefile
P src/sys/rump/dev/lib/libdisk/Makefile
P src/sys/rump/dev/lib/libdm/Makefile
P src/sys/rump/dev/lib/libdrvctl/Makefile
P src/sys/rump/dev/lib/libfss/Makefile
P src/sys/rump/dev/lib/libhdaudio_hdafg/Makefile
P src/sys/rump/dev/lib/libmd/Makefile
P src/sys/rump/dev/lib/libmiiphy/Makefile
P src/sys/rump/dev/lib/libnetsmb/Makefile
P src/sys/rump/dev/lib/libopencrypto/Makefile
P src/sys/rump/dev/lib/libpad/Makefile
P src/sys/rump/dev/lib/libpci/Makefile
P src/sys/rump/dev/lib/libpci_auich/Makefile
P src/sys/rump/dev/lib/libpci_eap/Makefile
P src/sys/rump/dev/lib/libpci_hdaudio/Makefile
P src/sys/rump/dev/lib/libpci_if_iwn/Makefile
P src/sys/rump/dev/lib/libpci_if_pcn/Makefile
P src/sys/rump/dev/lib/libpci_if_wm/Makefile
P src/sys/rump/dev/lib/libpci_usbhc/Makefile
P src/sys/rump/dev/lib/libpci_virtio/Makefile
P src/sys/rump/dev/lib/libpud/Makefile
P src/sys/rump/dev/lib/libputter/Makefile
P src/sys/rump/dev/lib/libraidframe/Makefile
P src/sys/rump/dev/lib/librnd/Makefile
P src/sys/rump/dev/lib/libscsipi/Makefile
P src/sys/rump/dev/lib/libsysmon/Makefile
P src/sys/rump/dev/lib/libubt/Makefile
P src/sys/rump/dev/lib/libucom/Makefile
P src/sys/rump/dev/lib/libugenhc/Makefile
P src/sys/rump/dev/lib/libulpt/Makefile
P src/sys/rump/dev/lib/libumass/Makefile
P src/sys/rump/dev/lib/libusb/Makefile
P src/sys/rump/dev/lib/libvirtio_if_vioif/Makefile
P src/sys/rump/dev/lib/libvirtio_ld/Makefile
P src/sys/rump/dev/lib/libvirtio_viornd/Makefile
P src/sys/rump/dev/lib/libvnd/Makefile
P src/sys/rump/dev/lib/libwscons/Makefile
P src/sys/rump/fs/lib/libaio/Makefile
P src/sys/rump/fs/lib/libcd9660/Makefile
P src/sys/rump/fs/lib/libefs/Makefile
P src/sys/rump/fs/lib/libext2fs/Makefile
P src/sys/rump/fs/lib/libfdesc/Makefile
P src/sys/rump/fs/lib/libffs/Makefile
P src/sys/rump/fs/lib/libfifovfs/Makefile
P src/sys/rump/fs/lib/libhfs/Makefile
P src/sys/rump/fs/lib/libkernfs/Makefile
P src/sys/rump/fs/lib/liblayervfs/Makefile
P src/sys/rump/fs/lib/liblfs/Makefile
P src/sys/rump/fs/lib/libmfs/Makefile
P src/sys/rump/fs/lib/libmsdos/Makefile
P src/sys/rump/fs/lib/libnfs/Makefile
P src/sys/rump/fs/lib/libnfsserver/Makefile
P src/sys/rump/fs/lib/libnilfs/Makefile
P src/sys/rump/fs/lib/libntfs/Makefile
P src/sys/rump/fs/lib/libnull/Makefile
P src/sys/rump/fs/lib/libptyfs/Makefile
P src/sys/rump/fs/lib/libsmbfs/Makefile
P src/sys/rump/fs/lib/libsyspuffs/Makefile
P src/sys/rump/fs/lib/libsysvbfs/Makefile
P src/sys/rump/fs/lib/libtmpfs/Makefile
P src/sys/rump/fs/lib/libudf/Makefile
P src/sys/rump/fs/lib/libumap/Makefile
P src/sys/rump/fs/lib/libunion/Makefile
P src/sys/rump/fs/lib/libv7fs/Makefile
P src/sys/rump/fs/lib/libzfs/Makefile
P src/sys/rump/kern/lib/libcrypto/Makefile
P src/sys/rump/kern/lib/libsljit/Makefile
P src/sys/rump/kern/lib/libsolaris/Makefile
P src/sys/rump/kern/lib/libsys_cygwin/Makefile
P src/sys/rump/kern/lib/libsys_linux/Makefile
P src/sys/rump/kern/lib/libsys_sunos/Makefile
P src/sys/rump/kern/lib/libsysproxy/Makefile
P src/sys/rump/kern/lib/libtty/Makefile
P src/sys/rump/kern/lib/libz/Makefile
P src/sys/rump/librump/rumpdev/Makefile.rumpdev
P src/sys/rump/librump/rumpkern/Makefile.rumpkern
P src/sys/rump/librump/rumpnet/Makefile.rumpnet
P src/sys/rump/librump/rumpvfs/Makefile.rumpvfs
P src/sys/rump/net/lib/libagr/Makefile
P src/sys/rump/net/lib/libbpfjit/Makefile
P src/sys/rump/net/lib/libbridge/Makefile
P src/sys/rump/net/lib/liblocal/Makefile
P src/sys/rump/net/lib/libnet/Makefile
P src/sys/rump/net/lib/libnet80211/Makefile
P src/sys/rump/net/lib/libnetbt/Makefile
P src/sys/rump/net/lib/libnetinet/Makefile
P src/sys/rump/net/lib/libnetinet6/Makefile
P src/sys/rump/net/lib/libnetmpls/Makefile
P src/sys/rump/net/lib/libnpf/Makefile
P src/sys/rump/net/lib/libshmif/Makefile
P src/sys/rump/net/lib/libsockin/Makefile
P src/sys/rump/net/lib/libtap/Makefile
P src/sys/rump/net/lib/libvirtif/Makefile
P src/sys/ufs/lfs/lfs_accessors.h
P src/sys/ufs/lfs/lfs_segment.c
P src/sys/ufs/lfs/lfs_vfsops.c

Updating xsrc tree:


Killing core files:

Running the SUP scanner:
SUP Scan for current starting at Tue Oct 20 03:05:20 2015
SUP Scan for current completed at Tue Oct 20 03:06:36 2015
SUP Scan for mirror starting at Tue Oct 20 03:06:36 2015
SUP Scan for mirror completed at Tue Oct 20 03:10:20 2015




Updating file list:
-rw-rw-r--  1