kern/40601: netbsd-5-0-RC2 bge + NFS root panics on DELL OptiPlex 745

[uebayasi%tombi.co.jp@localhost]

>Number:         40601
>Category:       kern
>Synopsis:       netbsd-5-0-RC2 bge + NFS root panics on DELL OptiPlex 745
>Confidential:   no
>Severity:       critical
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Tue Feb 10 13:55:00 +0000 2009
>Originator:     Masao Uebayashi
>Release:        NetBSD 5.0_RC2
>Organization:
        Tombi Inc.
>Environment:
Release: 5.0_RC2
Architecture: x86_64
Machine: amd64
>Description:
        While it tries to mount / via NFS via bge(4) it panics.
        If I understand ddb output correctly, interrupt stack is overflowed?

Copyright (c) 1996, 1997, 1998, 1999, 2000, 2001, 2002, 2003, 2004, 2005,
    2006, 2007, 2008
    The NetBSD Foundation, Inc.  All rights reserved.
Copyright (c) 1982, 1986, 1989, 1991, 1993
    The Regents of the University of California.  All rights reserved.

NetBSD 5.0_RC2 (GOLDTOWN) #6: Tue Feb 10 21:30:39 JST 2009
        
uebayasi%sidebeach.uebayasi.my.domain@localhost:/src/netbsd/work.netbsd-5/amd64/ob
j/sys/arch/amd64/compile/GOLDTOWN
total memory = 1013 MB
avail memory = 966 MB
timecounter: Timecounters tick every 10.000 msec
timecounter: Timecounter "i8254" frequency 1193182 Hz quality 100
SMBIOS rev. 2.3 @ 0xf0450 (76 entries)
Dell Inc.                 OptiPlex 745
mainbus0 (root)
cpu0 at mainbus0 apid 0: Intel 686-class, 2126MHz, id 0x6f6
cpu1 at mainbus0 apid 1: Intel 686-class, 2126MHz, id 0x6f6
ioapic0 at mainbus0 apid 8: pa 0xfec00000, version 20, 24 pins
acpi0 at mainbus0: Intel ACPICA 20080321
acpi0: X/RSDT: OemId <DELL  , B8K    ,00000014>, AslId <ASL ,00000061>
acpi0: SCI interrupting at int 9
acpi0: fixed-feature power button present
timecounter: Timecounter "ACPI-Fast" frequency 3579545 Hz quality 1000
ACPI-Fast 24-bit timer
acpibut0 at acpi0 (VBTN, PNP0C0C): ACPI Power Button
pcppi1 at acpi0 (SPK, PNP0800)
pcppi1: io 0x61
midi0 at pcppi1: PC speaker (CPU-intensive output)
sysbeep0 at pcppi1
attimer1 at acpi0 (TMR, PNP0100): AT Timer
attimer1: io 0x40-0x5f irq 0
PRT (PNP0401) at acpi0 not configured
COMA (PNP0501) at acpi0 not configured
hpet0 at acpi0 (HPET, PNP0103)
hpet0: mem 0xfed00000-0xfed003ff
timecounter: Timecounter "hpet0" frequency 14318179 Hz quality 2000
attimer1: attached to pcppi1
pci0 at mainbus0 bus 0: configuration mode 1
pci0: i/o space, memory space enabled, rd/line, rd/mult, wr/inv ok
pchb0 at pci0 dev 0 function 0
pchb0: vendor 0x8086 product 0x2990 (rev. 0x02)
agp0 at pchb0: detected 7676k stolen memory
agp0: aperture at 0xc0000000, size 0x20000000
ppb0 at pci0 dev 1 function 0: vendor 0x8086 product 0x2991 (rev. 0x02)
pci1 at ppb0 bus 1
pci1: i/o space, memory space enabled, rd/line, wr/inv ok
vga0 at pci0 dev 2 function 0: vendor 0x8086 product 0x2992 (rev. 0x02)
wsdisplay0 at vga0 kbdmux 1
wsmux1: connecting to wsdisplay0
drm at vga0 not configured
vendor 0x8086 product 0x2993 (miscellaneous display, revision 0x02) at pci0 dev 
2
 function 1 not configured
vendor 0x8086 product 0x2834 (USB serial bus, revision 0x02) at pci0 dev 26 func
tion 0 not configured
vendor 0x8086 product 0x2835 (USB serial bus, revision 0x02) at pci0 dev 26 func
tion 1 not configured
ehci0 at pci0 dev 26 function 7: vendor 0x8086 product 0x283a (rev. 0x02)
ehci0: interrupting at ioapic0 pin 22
ehci0: BIOS has given up ownership
ehci0: EHCI version 1.0
ehci0: wrong number of companions (2 != 0)
ehci0: ohci or uhci probably not configured
usb0 at ehci0: USB revision 2.0
azalia0 at pci0 dev 27 function 0: Generic High Definition Audio Controller
azalia0: interrupting at ioapic0 pin 16
azalia0: host: 0x8086/0x284b (rev. 2), HDA rev. 1.0
ppb1 at pci0 dev 28 function 0: vendor 0x8086 product 0x283f (rev. 0x02)
pci2 at ppb1 bus 2
pci2: i/o space, memory space enabled, rd/line, wr/inv ok
ppb2 at pci0 dev 28 function 4: vendor 0x8086 product 0x2847 (rev. 0x02)
pci3 at ppb2 bus 3
pci3: i/o space, memory space enabled, rd/line, wr/inv ok
bge0 at pci3 dev 0 function 0: Broadcom BCM5754 Gigabit Ethernet
bge0: interrupting at ioapic0 pin 16
bge0: ASIC BCM5754/5787 A2 (0xb002), Ethernet address 00:18:8b:5c:62:08
bge0: setting short Tx thresholds
brgphy0 at bge0 phy 1: BCM5754/5787 1000BASE-T media interface, rev. 0
brgphy0: 10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, 1000baseT, 1000baseT-FD
X, auto
vendor 0x8086 product 0x2830 (USB serial bus, revision 0x02) at pci0 dev 29 func
tion 0 not configured
vendor 0x8086 product 0x2831 (USB serial bus, revision 0x02) at pci0 dev 29 func
tion 1 not configured
vendor 0x8086 product 0x2832 (USB serial bus, revision 0x02) at pci0 dev 29 func
tion 2 not configured
ehci1 at pci0 dev 29 function 7: vendor 0x8086 product 0x2836 (rev. 0x02)
ehci1: interrupting at ioapic0 pin 23
ehci1: EHCI version 1.0
ehci1: wrong number of companions (3 != 0)
ehci1: ohci or uhci probably not configured
usb1 at ehci1: USB revision 2.0
ppb3 at pci0 dev 30 function 0: vendor 0x8086 product 0x244e (rev. 0xf2)
pci4 at ppb3 bus 4
pci4: i/o space, memory space enabled
ichlpcib0 at pci0 dev 31 function 0
ichlpcib0: vendor 0x8086 product 0x2810 (rev. 0x02)
timecounter: Timecounter "ichlpcib0" frequency 3579545 Hz quality 1000
ichlpcib0: 24-bit timer
ichlpcib0: TCO timer reboot disabled by hardware; hope SMBIOS properly handles i
t.
ichlpcib0: TCO (watchdog) timer configured.
piixide0 at pci0 dev 31 function 2
piixide0: Intel 82801H Serial ATA Controller (ICH8) (rev. 0x02)
piixide0: bus-master DMA support present
piixide0: primary channel configured to native-PCI mode
piixide0: using ioapic0 pin 20 for native-PCI interrupt
atabus0 at piixide0 channel 0
piixide0: secondary channel configured to native-PCI mode
atabus1 at piixide0 channel 1
ichsmb0 at pci0 dev 31 function 3: vendor 0x8086 product 0x283e (rev. 0x02)
ichsmb0: interrupting at ioapic0 pin 20
iic0 at ichsmb0: I2C bus
piixide1 at pci0 dev 31 function 5
piixide1: Intel 82801H Serial ATA Controller (ICH8) (rev. 0x02)
piixide1: bus-master DMA support present
piixide1: primary channel wired to native-PCI mode
piixide1: using ioapic0 pin 20 for native-PCI interrupt
atabus2 at piixide1 channel 0
piixide1: secondary channel wired to native-PCI mode
atabus3 at piixide1 channel 1
isa0 at ichlpcib0
lpt0 at isa0 port 0x378-0x37b irq 7
com0 at isa0 port 0x3f8-0x3ff irq 4: ns16550a, working fifo
com0: console
pckbc0 at isa0 port 0x60-0x64
pckbdprobe: reset error 5
pmsprobe: reset error 5
timecounter: Timecounter "clockinterrupt" frequency 100 Hz quality 0
timecounter: Timecounter "TSC" frequency 2126552160 Hz quality 3000
azalia0: codec[0]: Analog Devices AD1983 (rev. 4.0), HDA rev. 1.0
audio0 at azalia0: full duplex, independent
uhub0 at usb0: vendor 0x8086 EHCI root hub, class 9/0, rev 2.00/1.00, addr 1
uhub0: 4 ports with 4 removable, self powered
uhub1 at usb1: vendor 0x8086 EHCI root hub, class 9/0, rev 2.00/1.00, addr 1
uhub1: 6 ports with 6 removable, self powered
wd0 at atabus0 drive 0: <WDC WD10EADS-00L5B1>
wd0: drive supports 16-sector PIO transfers, LBA48 addressing
wd0: 931 GB, 1938021 cyl, 16 head, 63 sec, 512 bytes/sect x 1953525168 sectors
wd0: GPT GUID: d1d8e642-f200-11dd-bfe9-00188b5c6208
dk0 at wd0: d1d8e64c-f200-11dd-bfe9-00188b5c6208
dk0: 974 blocks at 34, type: ffs
dk1 at wd0: d1d8e64c-f200-11dd-bfea-00188b5c6208
dk1: 16257024 blocks at 1008, type: ffs
dk2 at wd0: d1d8e656-f200-11dd-bfea-00188b5c6208
dk2: 260112384 blocks at 16258032, type: ffs
dk3 at wd0: d1d8e656-f200-11dd-bfeb-00188b5c6208
dk3: 1040449536 blocks at 276370416, type: ffs
wd0: 32-bit data port
wd0: drive supports PIO mode 4, DMA mode 2, Ultra-DMA mode 6 (Ultra/133)
wd0(piixide0:0:0): using PIO mode 4, Ultra-DMA mode 6 (Ultra/133) (using DMA)
atapibus0 at atabus1: 2 targets
cd0 at atapibus0 drive 0: <TEAC CD-ROM CD-224E-N, , D.AB> cdrom removable
cd0: 32-bit data port
cd0: drive supports PIO mode 4, DMA mode 2, Ultra-DMA mode 2 (Ultra/33)
cd0(piixide0:1:0): using PIO mode 4, Ultra-DMA mode 2 (Ultra/33) (using DMA)
raidattach: Asked for 8 units
Kernelized RAIDframe activated
pad: requested 1 units
pad0: outputs: 44100Hz, 16-bit, stereo
audio1 at pad0: half duplex
Searching for RAID components...
boot device: bge0
root on bge0
mountroot: trying lfs...
mountroot: trying ffs...
mountroot: trying ext2fs...
mountroot: trying nfs...
nfs_boot: trying DHCP/BOOTP
nfs_boot: DHCP next-server: 172.16.0.1
nfs_boot: my_addr=172.16.0.5
nfs_boot: my_mask=255.255.255.0
nfs_boot: gateway=0.0.0.0
root on 172.16.0.1:/src/netbsd/work.netbsd-5/amd64/dest.goldtown
root time: 0x49912dcd
root file system type: nfs
init: copying out path `/sbin/init' 11
fatal double fault in supervisor mode
trap type 13 code 0 rip ffffffff80519144 cs 8 rflags 10282 cr2  ffff80004580ffc8
 cpl 6 rsp ffff80004580ffd0
db{0}> bt
_bus_dmamap_load_mbuf() at netbsd:_bus_dmamap_load_mbuf+0x14
bge_start() at netbsd:bge_start+0x75a
ifq_enqueue() at netbsd:ifq_enqueue+0xc5
ether_output() at netbsd:ether_output+0x680
ip_output() at netbsd:ip_output+0xb89
udp_output() at netbsd:udp_output+0x223
udp_usrreq() at netbsd:udp_usrreq+0x318
udp_usrreq_wrapper() at netbsd:udp_usrreq_wrapper+0x51
sosend() at netbsd:sosend+0x506
nfs_send() at netbsd:nfs_send+0xa9
nfs_request() at netbsd:nfs_request+0x355
nfs_readrpc() at netbsd:nfs_readrpc+0x377
nfs_doio() at netbsd:nfs_doio+0x762
VOP_STRATEGY() at netbsd:VOP_STRATEGY+0x3d
genfs_getpages() at netbsd:genfs_getpages+0x111b
nfs_getpages() at netbsd:nfs_getpages+0xd8
VOP_GETPAGES() at netbsd:VOP_GETPAGES+0x59
uvn_get() at netbsd:uvn_get+0xcf
ubc_fault() at netbsd:ubc_fault+0x15c
uvm_fault_internal() at netbsd:uvm_fault_internal+0x62f
trap() at netbsd:trap+0x865
--- trap (number 1166154688) ---
Bad frame pointer: 0xffff8000450c5000
0x400040:
db{0}> sh r
ds          0
es          0
fs          0
gs          0
rdi         0xffffffff80bfc700  pci_bus_dma64_tag
rsi         0xffff8000022ad800
rbp         0xffff800045810040
rbx         0
rdx         0xffff8000022c7a00
rcx         0x1
rax         0xffffffff80bfc700  pci_bus_dma64_tag
r8          0xffff8000022c0948
r9          0x800000
r10         0x90a0e340
r11         0xffffffff80519130  _bus_dmamap_load_mbuf
r12         0xffff8000022ad800
r13         0x4
r14         0xffff800045770000
r15         0xffff8000022ad800
rip         0xffffffff80519144  _bus_dmamap_load_mbuf+0x14
cs          0x8
rflags      0x10282
rsp         0xffff80004580ffd0
ss          0x10
netbsd:_bus_dmamap_load_mbuf+0x14:      movq    %rdi,0xffffffffffffffb0(%rbp)

>How-To-Repeat:
        Do it.
>Fix:
        N/A