page fault in isdn4bsd-kmod

Hi,
I hope this list is still active !

I run the following configuration without any troubles for more than two
years:

   FreeBSD 8.4-STABLE #3 r284383
   asterisk18:        1.8.32.1
   chan_capi:         2.0.17, with sleep patch from
     lists.freebsd.org/pipermail/freebsd-isdn/2016-February/001050.html
   libcapi:           2.0.2
   isdn4bsd-kmod:     2.0.11

But now a had two identical crashes, from the first one:

Fatal trap 12: page fault while in kernel mode
cpuid =3D 0; apic id =3D 03
fault virtual address   =3D 0x4c
fault code              =3D supervisor read, page not present
instruction pointer     =3D 0x20:0xc0c631b9
stack pointer           =3D 0x28:0xe7ad8b08
frame pointer           =3D 0x28:0xe7ad8b34
code segment            =3D base 0x0, limit 0xfffff, type 0x1b
                        =3D DPL 0, pres 1, def32 1, gran 1
processor eflags        =3D interrupt enabled, resume, IOPL =3D 0
current process         =3D 1103 (asterisk)
Physical memory: 1011 MB
Dumping 239 MB: 224 208 192 176 160 144 128 112 96 80 64 48 32 16

Reading symbols from /boot/kernel/linux.ko...Reading symbols from
/boot/kernel/linux.ko.symbols...done.
done.
Loaded symbols for /boot/kernel/linux.ko
Reading symbols from /boot/kernel/amr_linux.ko...Reading symbols from
/boot/kernel/amr_linux.ko.symbols...done.
done.
Loaded symbols for /boot/kernel/amr_linux.ko
Reading symbols from /boot/modules/i4b.ko...Reading symbols from
/boot/modules/i4b.ko.symbols...done.
done.
Loaded symbols for /boot/modules/i4b.ko
Reading symbols from /boot/kernel/sppp.ko...Reading symbols from
/boot/kernel/sppp.ko.symbols...done.
done.
Loaded symbols for /boot/kernel/sppp.ko
#0  doadump () at pcpu.h:244
244     #endif /* !_MACHINE_PCPU_H_ */
(kgdb) where
#0  doadump () at pcpu.h:244
#1  0xc04ece49 in db_fncall (dummy1=3D0, dummy2=3D0, dummy3=3D0,
dummy4=3D0xe7ad87a4 "=B8\207=AD=E7") at /usr/src/sys/ddb/db_comman
d.c:548
#2  0xc04ed27f in db_command (last_cmdp=3D0xc0a49a3c, cmd_table=3D0x0,
dopager=3D0) at /usr/src/sys/ddb/db_command.c:445
#3  0xc04ed334 in db_command_script (command=3D0xc0a4a917 "call doadump")
at /usr/src/sys/ddb/db_command.c:516
#4  0xc04f1260 in db_script_exec (scriptname=3D0xc098b378
"kdb.enter.default", warnifnotfound=3D<value optimized out>)
    at /usr/src/sys/ddb/db_script.c:302
#5  0xc04f135b in db_script_kdbenter (eventname=3D0xc09d83f3 "unknown") at
/usr/src/sys/ddb/db_script.c:325
#6  0xc04ef2e8 in db_trap (type=3D12, code=3D0) at
/usr/src/sys/ddb/db_main.c:230
#7  0xc073c788 in kdb_trap (type=3D12, code=3D0, tf=3D0xe7ad8ac8) at
/usr/src/sys/kern/subr_kdb.c:654
#8  0xc0930a0f in trap_fatal (frame=3D0xe7ad8ac8, eva=3D76) at
/usr/src/sys/i386/i386/trap.c:1001
#9  0xc0930b3d in trap_pfault (frame=3D0xe7ad8ac8, usermode=3D0, eva=3D76) =
at
/usr/src/sys/i386/i386/trap.c:872
#10 0xc0931c55 in trap (frame=3D0xe7ad8ac8) at
/usr/src/sys/i386/i386/trap.c:546
#11 0xc0916fac in calltrap () at /usr/src/sys/i386/i386/exception.s:168
#12 0xc0c631b9 in cd_update (cd=3D0xc50cb920, pipe=3D0x0, event=3D11) at
dss1_l3fsm.h:359
#13 0xc0c69c7a in capi_write (dev=3D0xc5402900, uio=3D0xc579a8c0, flag=3D4)
    at
/wrkdirs/usr/ports/comms/isdn4bsd-kmod/work/isdn4bsd-2.0.11/module/../src/s=
ys/i4b/layer4/i4b_capidrv.c:2417
#14 0xc067209f in devfs_write_f (fp=3D0xc56784d0, uio=3D0xc579a8c0,
cred=3D0xc57e6200, flags=3D0, td=3D0xc7c348a0)
    at /usr/src/sys/fs/devfs/devfs_vnops.c:1559
#15 0xc074f727 in dofilewrite (td=3D0xc7c348a0, fd=3D13, fp=3D0xc56784d0,
auio=3D0xc579a8c0, offset=3D-1, flags=3D0) at file.h:254
#16 0xc074fa18 in kern_writev (td=3D0xc7c348a0, fd=3D13, auio=3D0xc579a8c0)=
 at
/usr/src/sys/kern/sys_generic.c:447
#17 0xc074fc76 in writev (td=3D0xc7c348a0, uap=3D0xe7ad8cec) at
/usr/src/sys/kern/sys_generic.c:433
#18 0xc0931222 in syscall (frame=3D0xe7ad8d28) at subr_syscall.c:114
#19 0xc0917041 in Xint0x80_syscall () at
/usr/src/sys/i386/i386/exception.s:266
#20 0x00000033 in ?? ()
Previous frame inner to this frame (corrupt stack?)

(kgdb) f 13
#13 0xc0c69c7a in capi_write (dev=3D0xc5402900, uio=3D0xc579a8c0, flag=3D4)
    at
/wrkdirs/usr/ports/comms/isdn4bsd-kmod/work/isdn4bsd-2.0.11/module/../src/s=
ys/i4b/layer4/i4b_capidrv.c:2417
2417                  N_DISCONNECT_REQUEST(cd, cd->cause_in);
(kgdb) list
2412                   * the following will always call
2413                   * "i4b_l4_disconnect_ind()", which
2414                   * will send the CAPI disconnect
2415                   * indications
2416                   */
2417                  N_DISCONNECT_REQUEST(cd, cd->cause_in);
2418
2419                  cd =3D NULL; /* call descriptor is freed ! */
2420
2421                  break;

(kgdb) p *cd
$1 =3D {cdid =3D 0, p_cntl =3D 0xc0cc4174, pipe =3D 0x0, cr =3D 23, channel=
_id =3D
-1, channel_bprot =3D 4 '\004', channel_bsubprot =3D 1 '\001',
  driver_type =3D 7, driver_unit =3D 0, driver_type_copy =3D 7,
driver_unit_copy =3D 0, curr_max_packet_size =3D 160, new_max_packet_size =
=3D 0,
  cause_in =3D 256, cause_out =3D 256, call_state =3D 10 '\n', dst_telno =
=3D
"04514906159", '\0' <repeats 29 times>,
  dst_telno_ptr =3D 0xc50cb960 "", dst_telno_part =3D '\0' <repeats 40
times>, dst_telno_early =3D '\0' <repeats 40 times>,
  dst_subaddr =3D '\0' <repeats 20 times>, src =3D {{ton =3D 2 '\002', scr_=
ind
=3D 1 '\001', prs_ind =3D 1 '\001',
      telno =3D "4514900157", '\0' <repeats 30 times>, subaddr =3D '\0'
<repeats 20 times>}, {ton =3D 0 '\0', scr_ind =3D 0 '\0',
      prs_ind =3D 0 '\0', telno =3D '\0' <repeats 40 times>, subaddr =3D '\=
0'
<repeats 20 times>}}, dst_ton =3D 0 '\0', state =3D 0 '\0',
  status_enquiry_timeout =3D 0 '\0', fifo_translator_capi_std =3D 0x0,
fifo_translator_capi_bridge =3D 0x0, fifo_translator_tone_gen =3D 0x0,
  ai_type =3D 0 '\0', ai_ptr =3D 0x0, not_end_to_end_digital =3D 0 '\0',
is_sms =3D 0 '\0', aocd_flag =3D 0 '\0', channel_allocated =3D 0 '\0',
  dir_incoming =3D 0 '\0', need_release =3D 1 '\001', peer_responded =3D 1
'\001', want_late_inband =3D 0 '\0', sending_complete =3D 1 '\001',
  b_link_want_active =3D 0 '\0', call_is_on_hold =3D 0 '\0',
call_is_retrieving =3D 0 '\0', received_src_telno_1 =3D 0 '\0',
  received_src_telno_2 =3D 0 '\0', setup_interleave =3D 0 '\0', li_cdid =3D=
 0,
li_cdid_last =3D 0, li_data_ptr =3D 0x0, tone_gen_ptr =3D 0x0,
  tone_gen_state =3D 0 '\0', tone_gen_pos =3D 0, connect_ind_count =3D 0,
idle_callout =3D {co =3D {c_links =3D {sle =3D {sle_next =3D 0x0}, tqe =3D {
          tqe_next =3D 0x0, tqe_prev =3D 0xd8c9d518}}, c_time =3D -19703660=
93,
c_arg =3D 0xc50cb920, c_func =3D 0xc0c6fae0 <i4b_idle_check>,
      c_lock =3D 0xc0cc3fa4, c_flags =3D 0, c_cpu =3D 0}}, set_state_callou=
t =3D
{co =3D {c_links =3D {sle =3D {sle_next =3D 0x0}, tqe =3D {
          tqe_next =3D 0x0, tqe_prev =3D 0xd8cc7c10}}, c_time =3D -19704099=
02,
c_arg =3D 0xc50cb920,
      c_func =3D 0xc0c64690 <cd_set_state_timeout>, c_lock =3D 0xc0cc3fa4,
c_flags =3D 0, c_cpu =3D 0}}, idle_state =3D 2 '\002',
  connect_time =3D 32392203, last_active_time =3D 32392203, shorthold_data =
=3D
{shorthold_algorithm =3D 0, unitlen_time =3D 60, idle_time =3D 0,
    earlyhup_time =3D 0}, last_aocd_time =3D 0, units =3D 0, units_type =3D=
 3,
cunits =3D 1, isdntxdelay =3D 0,
  display =3D "\000. Wreth <57>", '\0' <repeats 77 times>, idate_time_data
=3D "\022\003\020\f\023\000\000", idate_time_len =3D 6 '\006',
  odate_time_data =3D "\000\000\000\000\000\000\000", odate_time_len =3D 0
'\0', keypad =3D '\0' <repeats 34 times>,
  user_user =3D '\0' <repeats 128 times>}

(kgdb) f 12
#12 0xc0c631b9 in cd_update (cd=3D0xc50cb920, pipe=3D0x0, event=3D11) at
dss1_l3fsm.h:359
359             l2softc_t *sc =3D ((__typeof(pipe))(cd->pipe))->L5_sc;
(kgdb) list
354      * NOTE: pipe might be zero!
355      */
356     static void
357     cd_update(call_desc_t *cd, DSS1_TCP_pipe_t *pipe, int event)
358     {
359             l2softc_t *sc =3D ((__typeof(pipe))(cd->pipe))->L5_sc;
360             __typeof(cd->state)
361               state =3D cd->state;
362
363             /*

The page fault occurs because cd->pipe is zero.

I can give more information from the kerneldumps.



Andreas Longwitz

_______________________________________________
[email protected] mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-isdn
To unsubscribe, send any mail to "[email protected]"