Bug 1171

Summary: panic: setrunnable after touching long idle windows
Product: Base System Reporter: Heikki Suonsivu <hsu>
Component: kernAssignee: freebsd-bugs (Nobody) <bugs>
Status: Closed FIXED    
Severity: Affects Only Me    
Priority: Normal    
Version: 2.2-CURRENT   
Hardware: Any   
OS: Any   

Description Heikki Suonsivu 1996-05-03 01:00:01 UTC 
Kernel and dump will be available in

ftp://ftp.clinet.fi/pub/FreeBSD/crashdumps/cantina/*.2.gz

within 15 minutes I submitted this one (gzip going).

System paniced with setrunnable panic after couple of old processes
running in the machine were woken up (I came to work and touched
windows running in it).

GDB is free software and you are welcome to distribute copies of it
 under certain conditions; type "show copying" to see the conditions.
There is absolutely no warranty for GDB; type "show warranty" for details.
GDB 4.13 (i386-unknown-freebsd), 
Copyright 1994 Free Software Foundation, Inc...
IdlePTD 259000
current pcb at 2183bc
panic: page fault
#0  boot (howto=260) at ../../i386/i386/machdep.c:940
940                                     savectx(&dumppcb);
(kgdb) bt
#0  boot (howto=260) at ../../i386/i386/machdep.c:940
#1  0xf0116326 in panic (fmt=0xf01c4f4e "page fault")
    at ../../kern/subr_prf.c:125
#2  0xf01c5a6a in trap_fatal (frame=0xf01f4758) at ../../i386/i386/trap.c:758
#3  0xf01c55dc in trap_pfault (frame=0xf01f4758, usermode=0)
    at ../../i386/i386/trap.c:680
#4  0xf01c527b in trap (frame={tf_es = 16, tf_ds = 16, tf_edi = -235470848, 
      tf_esi = -266385416, tf_ebp = -266385508, tf_isp = -266385536, 
      tf_ebx = -235470848, tf_edx = 0, tf_ecx = -265772956, 
      tf_eax = -265772924, tf_trapno = 12, tf_err = 0, tf_eip = -266647016, 
      tf_cs = 8, tf_eflags = 66067, tf_esp = -266385256, tf_ss = -265772956})
    at ../../i386/i386/trap.c:320
#5  0xf01bda31 in calltrap ()
#6  0xf01b5c94 in vm_map_lookup (var_map=0xf01f48c4, vaddr=4059496448, 
    fault_type=1 '\001', out_entry=0xf01f4898, object=0xf01f4894, 
    pindex=0xf01f4890, out_prot=0xf01f488f "\a\225\013", wired=0xf01f4888, 
    single_use=0xf01f4884) at ../../vm/vm_map.c:2032
#7  0xf01b1832 in vm_fault (map=0xf028a064, vaddr=4059496448, 
    fault_type=1 '\001', change_wiring=0) at ../../vm/vm_fault.c:193
#8  0xf01c5592 in trap_pfault (frame=0xf01f4920, usermode=0)
    at ../../i386/i386/trap.c:669
#9  0xf01c527b in trap (frame={tf_es = 16, tf_ds = 16, tf_edi = -242699264, 
      tf_esi = -239127424, tf_ebp = -266385060, tf_isp = -266385080, 
      tf_ebx = -239886208, tf_edx = -242569984, tf_ecx = 33, 
      tf_eax = -235468288, tf_trapno = 12, tf_err = 0, tf_eip = -266673200, 
      tf_cs = 8, tf_eflags = 66118, tf_esp = -266385028, tf_ss = -267191392})
    at ../../i386/i386/trap.c:320
#10 0xf01bda31 in calltrap ()
#11 0xf012fba0 in vfs_msync (mp=0xf188b400, flags=2) at ./vnode_if.h:815
#12 0xf0130130 in sync (p=0xf02431c8, uap=0x0, retval=0x0)
    at ../../kern/vfs_syscalls.c:355
#13 0xf01c021a in boot (howto=256) at ../../i386/i386/machdep.c:889
#14 0xf0116326 in panic (fmt=0xf01c4f4e "page fault")
    at ../../kern/subr_prf.c:125
#15 0xf01c5a6a in trap_fatal (frame=0xf01f4a60) at ../../i386/i386/trap.c:758
#16 0xf01c55dc in trap_pfault (frame=0xf01f4a60, usermode=0)
    at ../../i386/i386/trap.c:680
#17 0xf01c527b in trap (frame={tf_es = 16, tf_ds = 16, tf_edi = -235601920, 
      tf_esi = -266384640, tf_ebp = -266384732, tf_isp = -266384760, 
      tf_ebx = -235601920, tf_edx = 0, tf_ecx = -265772956, 
      tf_eax = -265772924, tf_trapno = 12, tf_err = 0, tf_eip = -266647016, 
      tf_cs = 8, tf_eflags = 66067, tf_esp = -266384480, tf_ss = -265772956})
    at ../../i386/i386/trap.c:320
#18 0xf01bda31 in calltrap ()
#19 0xf01b5c94 in vm_map_lookup (var_map=0xf01f4bcc, vaddr=4059365376, 
    fault_type=1 '\001', out_entry=0xf01f4ba0, object=0xf01f4b9c, 
    pindex=0xf01f4b98, out_prot=0xf01f4b97 "ð\001", wired=0xf01f4b90, 
    single_use=0xf01f4b8c) at ../../vm/vm_map.c:2032
#20 0xf01b1832 in vm_fault (map=0xf028a064, vaddr=4059365376, 
    fault_type=1 '\001', change_wiring=0) at ../../vm/vm_fault.c:193
#21 0xf01c5592 in trap_pfault (frame=0xf01f4c28, usermode=0)
    at ../../i386/i386/trap.c:669
#22 0xf01c527b in trap (frame={tf_es = 16, tf_ds = 16, tf_edi = 12, 
      tf_esi = -1, tf_ebp = -266384276, tf_isp = -266384304, 
      tf_ebx = -241323776, tf_edx = -266065788, tf_ecx = -235599872, 
      tf_eax = 448, tf_trapno = 12, tf_err = 0, tf_eip = -267313518, 
      tf_cs = 8, tf_eflags = 66054, tf_esp = -241323776, tf_ss = -1})
    at ../../i386/i386/trap.c:320
#23 0xf01bda31 in calltrap ()
#24 0xf01121c6 in setrunnable (p=0xf19db100) at ../../kern/kern_synch.c:648
#25 0xf011874d in selwakeup (sip=0xf0203c38) at ../../kern/sys_generic.c:703
#26 0xf0116146 in logwakeup () at ../../kern/subr_log.c:183
#27 0xf011661c in printf (
    fmt=0xf01c5611 "\n\nFatal trap %d: %s while in %s mode\n")
    at ../../kern/subr_prf.c:306
#28 0xf01c5847 in trap_fatal (frame=0xf01f4d40) at ../../i386/i386/trap.c:703
#29 0xf01c55dc in trap_pfault (frame=0xf01f4d40, usermode=0)
    at ../../i386/i386/trap.c:680
#30 0xf01c527b in trap (frame={tf_es = 16, tf_ds = 16, tf_edi = -235601920, 
      tf_esi = -266383904, tf_ebp = -266383996, tf_isp = -266384024, 
      tf_ebx = -235601920, tf_edx = 0, tf_ecx = -265772956, 
      tf_eax = -265772924, tf_trapno = 12, tf_err = 0, tf_eip = -266647016, 
      tf_cs = 8, tf_eflags = 66067, tf_esp = -266383744, tf_ss = -265772956})
    at ../../i386/i386/trap.c:320
#31 0xf01bda31 in calltrap ()
---Type <return> to continue, or q <return> to quit---
#32 0xf01b5c94 in vm_map_lookup (var_map=0xf01f4eac, vaddr=4059365376, 
    fault_type=1 '\001', out_entry=0xf01f4e80, object=0xf01f4e7c, 
    pindex=0xf01f4e78, out_prot=0xf01f4e77 "\a'\017", wired=0xf01f4e70, 
    single_use=0xf01f4e6c) at ../../vm/vm_map.c:2032
#33 0xf01b1832 in vm_fault (map=0xf028a064, vaddr=4059365376, 
    fault_type=1 '\001', change_wiring=0) at ../../vm/vm_fault.c:193
#34 0xf01c5592 in trap_pfault (frame=0xf01f4f08, usermode=0)
    at ../../i386/i386/trap.c:669
#35 0xf01c527b in trap (frame={tf_es = 16, tf_ds = 16, tf_edi = -1073741824, 
      tf_esi = -1, tf_ebp = -266383540, tf_isp = -266383568, 
      tf_ebx = -240950016, tf_edx = -266065788, tf_ecx = -235599872, 
      tf_eax = 448, tf_trapno = 12, tf_err = 0, tf_eip = -267313518, 
      tf_cs = 8, tf_eflags = 66054, tf_esp = -240950016, tf_ss = -1})
    at ../../i386/i386/trap.c:320
#36 0xf01bda31 in calltrap ()
#37 0xf01121c6 in setrunnable (p=0xf1a36500) at ../../kern/kern_synch.c:648
#38 0xf0111c87 in endtsleep (arg=0xf1a36500) at ../../kern/kern_synch.c:408
#39 0xf01082cc in softclock () at ../../kern/kern_clock.c:664
#40 0xf01bed87 in doreti_swi ()
#41 0xf01c99c4 in vm_page_zero_idle () at ../../i386/i386/vm_machdep.c:855
(kgdb) 
(kgdb) frame 37
#37 0xf01121c6 in setrunnable (p=0xf1a36500) at ../../kern/kern_synch.c:648
648             case SRUN:
(kgdb) list
643             register int s;
644
645             s = splhigh();
646             switch (p->p_stat) {
647             case 0:
648             case SRUN:
649             case SZOMB:
650             default:
651                     panic("setrunnable");
652             case SSTOP:
(kgdb) print p
$1 = (struct proc *) 0xf1a36500
(kgdb) print p->p_stat
$2 = 3 '\003'
(kgdb)

(The source may be later than feb 22, I supped couple of nights ago).

How-To-Repeat: 
I do not know, and this one is new, I do not think I have seen it
before.
Comment 1 davidg 1996-05-03 02:56:40 UTC 
>#35 0xf01c527b in trap (frame={tf_es = 16, tf_ds = 16, tf_edi = -1073741824, 
>      tf_esi = -1, tf_ebp = -266383540, tf_isp = -266383568, 
>      tf_ebx = -240950016, tf_edx = -266065788, tf_ecx = -235599872, 
>      tf_eax = 448, tf_trapno = 12, tf_err = 0, tf_eip = -267313518, 
>      tf_cs = 8, tf_eflags = 66054, tf_esp = -240950016, tf_ss = -1})
>    at ../../i386/i386/trap.c:320
>#36 0xf01bda31 in calltrap ()
>#37 0xf01121c6 in setrunnable (p=0xf1a36500) at ../../kern/kern_synch.c:648
>#38 0xf0111c87 in endtsleep (arg=0xf1a36500) at ../../kern/kern_synch.c:408
>#39 0xf01082cc in softclock () at ../../kern/kern_clock.c:664
>#40 0xf01bed87 in doreti_swi ()
>#41 0xf01c99c4 in vm_page_zero_idle () at ../../i386/i386/vm_machdep.c:855
>(kgdb) 
>(kgdb) frame 37
>#37 0xf01121c6 in setrunnable (p=0xf1a36500) at ../../kern/kern_synch.c:648
>648             case SRUN:
>(kgdb) list
>643             register int s;
>644
>645             s = splhigh();
>646             switch (p->p_stat) {
>647             case 0:
>648             case SRUN:
>649             case SZOMB:
>650             default:
>651                     panic("setrunnable");
>652             case SSTOP:
>(kgdb) print p
>$1 = (struct proc *) 0xf1a36500
>(kgdb) print p->p_stat
>$2 = 3 '\003'

   Given the supplied information, there is no way that a page fault could
have occurred at that location unless the kernel text was either corrupted
or had one or more memory bit errors. In other words, I think this is a
hardware problem, not a software problem.

-DG

David Greenman
Core-team/Principal Architect, The FreeBSD Project
Comment 2 scrappy freebsd_committer freebsd_triage 1996-10-22 05:24:05 UTC 
State Changed
From-To: open->feedback


checking Status
Comment 3 scrappy freebsd_committer freebsd_triage 1996-10-23 06:48:23 UTC 
State Changed
From-To: feedback->closed


Originator Confirmed Closure