freebsd stable - Jul 2006 - ncplogin panic

I am having a problem getting ncplogin to work on my 6.1-stable
system.  When I run ncplogin I get the following panic (hand
transcribed):


Fatal trap 12: page fault while in kernel mode
cpuid = 1; apic id = 01
fault virtual address           = 0x0
fault code                      = supervisor write, page not present
instruction pointer             = 0x20:0xc052d0a7
stack pointer                   = 0x28:0xc6021a98
stack frame                     = 0x28:0xc6021ab4
code segment                    = base 0x0, limit 0xfffff, type 0x1b
                                = DPL 0, pres 1, def32 1, gran 1
processor eflags                = interrupt enabled, resume, IOPL = 0
current process                 = 863 (ncplogin)
trap number                     = 12
panic: page fault
cpuid = 1

I tried to get a good core dump, but am failing at that also.  Setting
hw.physmem="64M" (or 128M, 256M, 512M or 1024M) results in the machine
becoming unresponsive before it starts to dump anything.  It prints
"Dumping XXMB (2 chunks) and then hangs until I hit the power switch.
I got one core dump with the full 2G of memory enabled, but kgdb
couldn't use it.
One other thing to note is that this is with an SMP kernel.  A uni
kernel doesn't dump core, but is still unable to connect to our novell
server.  I know this report is rather sparse, but I don't have much to
go on.  I have attached a dmesg dump and will try to provide any other
information if someone is willing to help.

Thanks
Eric
-------------- next part --------------
A non-text attachment was scrubbed...
Name: dmesg.out
Type: application/octet-stream
Size: 6220 bytes
Desc: not available
Url :
http://lists.freebsd.org/pipermail/freebsd-stable/attachments/20060731/88766e99/dmesg.obj

Hi,

i had the same problem. See my thread on the freebsd-fs mailinglist

http://lists.freebsd.org/pipermail/freebsd-fs/2006-July/002060.html


After some research i use the attached patch against ncp_sock.c.

So it is not the real solution to this problem it only avoids the panics.
I'm using it quiet a while without any other known
problems.
Hopefully someone with more knowledge can help on this.

I also get some "md_get_mem(461): incomplete copy" messages which seem
to do no harm, so far.

Regards,

Maik


!!! Use atyour own risk !!!

--- ncp_sock.c.orig            Fri Jan  7 02:45:49 2005
+++ ncp_sock.c           Thu Jul 20 14:12:45 2006
@@ -189,7 +189,12 @@
     struct thread *td = curthread;
     struct ucred *cred = NULL;

-    return so->so_proto->pr_usrreqs->pru_sopoll(so, events, cred, td);
+    if ( td->td_selq.tqh_last == NULL ) {
+        printf("ncp_poll: td->td_selq.tqh_last == NULL\n");
+        return 0;
+    }
+
+   return so->so_proto->pr_usrreqs->pru_sopoll(so, events, cred, td);
 }

 int

---- pach ends here ---

On Monday 31 July 2006 15:15, ejc wrote:
> I am having a problem getting ncplogin to work on my 6.1-stable
> system.  When I run ncplogin I get the following panic (hand
> transcribed):
> 
> 
> Fatal trap 12: page fault while in kernel mode
> cpuid = 1; apic id = 01
> fault virtual address           = 0x0
> fault code                      = supervisor write, page not present
> instruction pointer             = 0x20:0xc052d0a7
> stack pointer                   = 0x28:0xc6021a98
> stack frame                     = 0x28:0xc6021ab4
> code segment                    = base 0x0, limit 0xfffff, type 0x1b
>                                 = DPL 0, pres 1, def32 1, gran 1
> processor eflags                = interrupt enabled, resume, IOPL = 0
> current process                 = 863 (ncplogin)
> trap number                     = 12
> panic: page fault
> cpuid = 1
Can you run 'gdb /path/to/kernel.debug' and do 'l *0xc052d0a7'
(the value of
instruction pointer above)?

-- 
John Baldwin

> Can you jump to the 'selrecord' frame and do 'p
selector->td_selq' and
> 'p *sip'?
Here is what i get.

(kgdb) up 7
#7  0xc068a3fc in selrecord (selector=0xc33f9a80, sip=0xc363a8a8) at
/usr/src/sys/kern/sys_generic.c:1105
1105                                
TAILQ_INSERT_TAIL(&selector->td_selq, sip, si_thrlist);
(kgdb) p selector->td_selq
$1 = {
  tqh_first = 0x0,
  tqh_last = 0x0
}
(kgdb) p *sip
$2 = {
  si_thrlist = {
    tqe_next = 0x0,
    tqe_prev = 0x0
  },
  si_thread = 0xc33f9a80,
  si_note = {
    kl_list = {
      slh_first = 0x0
    },
    kl_lock = 0xc064bf08 <knlist_mtx_lock>,
    kl_unlock = 0xc064bf3c <knlist_mtx_unlock>,
    kl_locked = 0xc064bf78 <knlist_mtx_locked>,
    kl_lockarg = 0xc363a8cc
  },
  si_flags = 0x0
}
(kgdb)

With this changes (i use Version 1.17 from cvs) i get no more panics.

But i still get some

md_get_mem(461): incomplete copy

messages.

I aslo still got the problem that i can't copy smal files (<8M) with
"cp". I get an "invalid argument" message from
"cp". So "less"
or "cat" can display the smal files without problems.

Maybe someone can have a look at that.

Thanks in advance,

maik