From nobody@FreeBSD.org  Tue Sep 23 09:29:05 2008
Return-Path: <nobody@FreeBSD.org>
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 1E1D91065672
	for <freebsd-gnats-submit@FreeBSD.org>; Tue, 23 Sep 2008 09:29:05 +0000 (UTC)
	(envelope-from nobody@FreeBSD.org)
Received: from www.freebsd.org (www.freebsd.org [IPv6:2001:4f8:fff6::21])
	by mx1.freebsd.org (Postfix) with ESMTP id 0E3038FC12
	for <freebsd-gnats-submit@FreeBSD.org>; Tue, 23 Sep 2008 09:29:05 +0000 (UTC)
	(envelope-from nobody@FreeBSD.org)
Received: from www.freebsd.org (localhost [127.0.0.1])
	by www.freebsd.org (8.14.3/8.14.3) with ESMTP id m8N9T4Et048820
	for <freebsd-gnats-submit@FreeBSD.org>; Tue, 23 Sep 2008 09:29:04 GMT
	(envelope-from nobody@www.freebsd.org)
Received: (from nobody@localhost)
	by www.freebsd.org (8.14.3/8.14.3/Submit) id m8N9T48M048819;
	Tue, 23 Sep 2008 09:29:04 GMT
	(envelope-from nobody)
Message-Id: <200809230929.m8N9T48M048819@www.freebsd.org>
Date: Tue, 23 Sep 2008 09:29:04 GMT
From: KOIE Hidetaka <koie@suri.co.jp>
To: freebsd-gnats-submit@FreeBSD.org
Subject: panic at closing uvisor.
X-Send-Pr-Version: www-3.1
X-GNATS-Notify:

>Number:         127561
>Category:       kern
>Synopsis:       [usb] [tty] [panic] panic at closing uvisor.
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    ed
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Tue Sep 23 09:30:04 UTC 2008
>Closed-Date:    Wed Sep 24 11:16:24 UTC 2008
>Last-Modified:  Thu Aug 26 11:25:25 UTC 2010
>Originator:     KOIE Hidetaka
>Release:        8.0-CURRENT
>Organization:
SURIGIKEN
>Environment:
FreeBSD guriandgura 8.0-CURRENT FreeBSD 8.0-CURRENT #1: Tue Sep 23 17:45:26 JST 2008     koie@guriandgura:/usr/obj/usr/src/sys/GURIANDGURA  amd64
>Description:
I'm using pilot-xfer(/usr/ports/palm/pilot-link) via uvisor(4) to hotsync, and
/usr/sbin/ppp via /dev/cuaU0 to connect network.
Since change new TTY layer, at end of hotsync and closing ppp session, kernel panics:
guriandgura# kgdb /boot/kernel/kernel.symbols vmcore.0
GNU gdb 6.1.1 [FreeBSD]
..
Unread portion of the kernel message buffer:
ucom0: at uhub0 port 5 (addr 2) disconnected
ucom0: detached


Fatal trap 12: page fault while in kernel mode
cpuid = 2; apic id = 02
fault virtual address   = 0x134
fault code              = supervisor read data, page not present
instruction pointer     = 0x8:0xffffffff80304522
stack pointer           = 0x10:0xffffffff7fe4f890
frame pointer           = 0x10:0xffffffff7fe4f8c0
code segment            = base 0x0, limit 0xfffff, type 0x1b
                        = DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags        = interrupt enabled, resume, IOPL = 0
current process         = 1808 (ppp)
..
(kgdb) bt
#0  doadump () at pcpu.h:196
#1  0xffffffff801b450c in db_fncall (dummy1=Variable "dummy1" is not available.
)
    at /usr/src/sys/ddb/db_command.c:549
#2  0xffffffff801b4a61 in db_command (last_cmdp=0xffffffff807f7d60, cmd_table=Variable "cmd_table" is not available.

) at /usr/src/sys/ddb/db_command.c:446
#3  0xffffffff801b4cb0 in db_command_loop ()
    at /usr/src/sys/ddb/db_command.c:499
#4  0xffffffff801b6a19 in db_trap (type=Variable "type" is not available.
) at /usr/src/sys/ddb/db_main.c:228
#5  0xffffffff8036a465 in kdb_trap (type=12, code=0, tf=0xffffffff7fe4f7e0)
    at /usr/src/sys/kern/subr_kdb.c:534
#6  0xffffffff8059dd2d in trap_fatal (frame=0xffffffff7fe4f7e0, eva=Variable "eva" is not available.
)
    at /usr/src/sys/amd64/amd64/trap.c:754
#7  0xffffffff8059e104 in trap_pfault (frame=0xffffffff7fe4f7e0, usermode=0)
    at /usr/src/sys/amd64/amd64/trap.c:675
#8  0xffffffff8059ea69 in trap (frame=0xffffffff7fe4f7e0)
    at /usr/src/sys/amd64/amd64/trap.c:444
#9  0xffffffff8058174e in calltrap ()
    at /usr/src/sys/amd64/amd64/exception.S:217
#10 0xffffffff80304522 in destroy_dev_sched_cb (dev=0x0,
    cb=0xffffffff80386a00 <tty_dealloc>, arg=0xffffff0004e22c00)
    at /usr/src/sys/kern/kern_conf.c:1136
#11 0xffffffff80387eec in ttydev_close (dev=Variable "dev" is not available.
) at /usr/src/sys/kern/tty.c:312
#12 0xffffffff802c67b4 in devfs_close (ap=0xffffffff7fe4f960)
    at /usr/src/sys/fs/devfs/devfs_vnops.c:458
#13 0xffffffff803cfd5d in vn_close (vp=0xffffff00b787e000, flags=3,
    file_cred=0xffffff000ff0aa00, td=0xffffff000f4bc000) at vnode_if.h:225
#14 0xffffffff803cfdf9 in vn_closefile (fp=0xffffff00054b6370,
    td=0xffffff000f4bc000) at /usr/src/sys/kern/vfs_vnops.c:920
#15 0xffffffff802c62ea in devfs_close_f (fp=Variable "fp" is not available.
)
    at /usr/src/sys/fs/devfs/devfs_vnops.c:471
#16 0xffffffff8030b1e3 in _fdrop (fp=0xffffff00054b6370, td=Variable "td" is not available.
) at file.h:293
#17 0xffffffff8030c34b in closef (fp=0xffffff00054b6370,
    td=0xffffff000f4bc000) at /usr/src/sys/kern/kern_descrip.c:2003
#18 0xffffffff8030cb26 in kern_close (td=0xffffff000f4bc000, fd=Variable "fd" is not available.
)
    at /usr/src/sys/kern/kern_descrip.c:1105
#19 0xffffffff8059e376 in syscall (frame=0xffffffff7fe4fc90)
    at /usr/src/sys/amd64/amd64/trap.c:898
#20 0xffffffff8058195b in Xfast_syscall ()
    at /usr/src/sys/amd64/amd64/exception.S:338
#21 0x0000000801278a5c in ?? ()
Previous frame inner to this frame (corrupt stack?)



>How-To-Repeat:

>Fix:
I'm patching the follwing:
RCS file: /museum/freebsd/repo/usr/src/sys/kern/tty.c,v
retrieving revision 1.290
diff -u -p -r1.290 tty.c
--- kern/tty.c  22 Sep 2008 19:25:14 -0000      1.290
+++ kern/tty.c  23 Sep 2008 08:45:20 -0000
@@ -936,6 +936,17 @@ tty_rel_free(struct tty *tp)
        tp->t_dev = NULL;
        tty_unlock(tp);

+#if 1 /*KOIE*/
+       printf("%s: pid=%ld tp=%p t_dev=%p\n",
+               __func__,
+               (curproc ? (long)curproc->p_pid : 0L),
+               tp,
+               dev);
+       if (dev == NULL) {
+           printf("dev is already destroyed; skip\n");
+           return;
+       }
+#endif
        destroy_dev_sched_cb(dev, tty_dealloc, tp);
 }

The follwing message is gotten to run hotsync:
ucom0: <Palm. Inc. Palm Handheld, class 0/0, rev 1.10/1.00, addr 2> on uhub0
ucom0: at uhub0 port 5 (addr 2) disconnected
tty_rel_free: pid=14 tp=0xffffff0005284000 t_dev=0xffffff00921b1800
ucom0: detached
tty_rel_free: pid=1815 tp=0xffffff0005284000 t_dev=0
dev is already destroyed; skip

pid 14 is usb0 (that is a kernen process).
pid 1815 is pilot-xfer.

It seems that destroy_dev_sched_cb() is called twice.

>Release-Note:
>Audit-Trail:
Responsible-Changed-From-To: freebsd-bugs->ed 
Responsible-Changed-By: remko 
Responsible-Changed-When: Tue Sep 23 11:51:33 UTC 2008 
Responsible-Changed-Why:  
REassign to Ed, might be that the new TTY implementation is 
responsible for this, according to the submitter. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=127561 

From: Ed Schouten <ed@80386.nl>
To: bug-followup@FreeBSD.org, koie@suri.co.jp
Cc:  
Subject: Re: kern/127561: [usb] [tty]: panic at closing uvisor.
Date: Tue, 23 Sep 2008 17:37:42 +0200

 --dDdTYOCAbkFo0FQC
 Content-Type: text/plain; charset=us-ascii
 Content-Disposition: inline
 Content-Transfer-Encoding: quoted-printable
 
 Hello,
 
 Is this on a kernel running INVARIANTS(_SUPPORT)?
 
 --=20
  Ed Schouten <ed@80386.nl>
  WWW: http://80386.nl/
 
 --dDdTYOCAbkFo0FQC
 Content-Type: application/pgp-signature
 Content-Disposition: inline
 
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1.4.9 (FreeBSD)
 
 iEYEARECAAYFAkjZDUYACgkQ52SDGA2eCwXJ8ACdH45o5RCaDibvJx6pgu6snYk+
 jGIAnjQBDs7W+cojc3IwbRXJQn1PwosL
 =jyHE
 -----END PGP SIGNATURE-----
 
 --dDdTYOCAbkFo0FQC--

From: Ed Schouten <ed@80386.nl>
To: bug-followup@FreeBSD.org, koie@suri.co.jp
Cc: thompsa@FreeBSD.org
Subject: Re: kern/127561: [usb] [tty]: panic at closing uvisor.
Date: Tue, 23 Sep 2008 21:21:20 +0200

 --9rRS2CJFk/mxouRY
 Content-Type: text/plain; charset=us-ascii
 Content-Disposition: inline
 Content-Transfer-Encoding: quoted-printable
 
 Hello submitter,
 
 Quite a coincidence; Andrew Thompson (thompsa@) just found the same bug
 in the TTY layer. Could you please try the following patch?
 
 %%%
 Index: tty.c
 =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
 =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
 =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
 --- tty.c	(revision 183276)
 +++ tty.c	(working copy)
 @@ -924,8 +924,8 @@
 =20
  	tty_lock_assert(tp, MA_OWNED);
 =20
 -	if (tp->t_sessioncnt !=3D 0 ||
 -	    (tp->t_flags & (TF_GONE|TF_OPENED|TF_HOOK)) !=3D TF_GONE) {
 +#define	TF_ACTIVITY	(TF_GONE|TF_OPENED|TF_HOOK|TF_OPENCLOSE)
 +	if (tp->t_sessioncnt !=3D 0 || (tp->t_flags & TF_ACTIVITY) !=3D TF_GONE) {
  		/* TTY is still in use. */
  		tty_unlock(tp);
  		return;
 %%%
 
 Thanks!
 
 --=20
  Ed Schouten <ed@80386.nl>
  WWW: http://80386.nl/
 
 --9rRS2CJFk/mxouRY
 Content-Type: application/pgp-signature
 Content-Disposition: inline
 
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1.4.9 (FreeBSD)
 
 iEYEARECAAYFAkjZQbAACgkQ52SDGA2eCwU2owCdEtCbmeASlUUgUFv3WDlLUlwS
 GsEAn0TsUM9x0A4e8ZYZUbmcrRVZ5dXT
 =Ep8W
 -----END PGP SIGNATURE-----
 
 --9rRS2CJFk/mxouRY--

From: KOIE Hidetaka (=?iso-2022-jp?B?GyRCOHE5PjFRTjQhdz90TX01OzgmGyhC?=)
 <koie@suri.co.jp>
To: ed@80386.nl
Cc: bug-followup@FreeBSD.org
Subject: Re: kern/127561: [usb] [tty]: panic at closing uvisor.
Date: Wed, 24 Sep 2008 14:17:23 +0900 (JST)

   Message-Id: <20080923192120.GO81522@hoeg.nl>
   Date:       Tue, 23 Sep 2008 21:21:20 +0200
   From:       Ed Schouten <ed@80386.nl>
   Subject:    Re: kern/127561: [usb] [tty]: panic at closing uvisor.
 
   | Quite a coincidence; Andrew Thompson (thompsa@) just found the same bug
   | in the TTY layer. Could you please try the following patch?
 
 I apply the patch, and the problem is fixed.
 Thank you!
 
   Message-Id: <20080923153742.GM81522@hoeg.nl>
   Date:       Tue, 23 Sep 2008 17:37:42 +0200
   From:       Ed Schouten <ed@80386.nl>
   Subject:    Re: kern/127561: [usb] [tty]: panic at closing uvisor.
 
   | Is this on a kernel running INVARIANTS(_SUPPORT)?
 
 No.
 I try to enable these options.
         options	INVARIANTS
         options INVARIANT_SUPPORT
         options WITNESS
         options WITNESS_SKIPSPIN
 
 I get the following message with many LOR ;-(
   ----------------begin----------------
   | Copyright (c) 1992-2008 The FreeBSD Project.
   | Copyright (c) 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994
   | 	The Regents of the University of California. All rights reserved.
   | FreeBSD is a registered trademark of The FreeBSD Foundation.
   | FreeBSD 8.0-CURRENT #4: Wed Sep 24 12:36:12 JST 2008
   |     koie@guriandgura:/usr/obj/usr/src/sys/GURIANDGURA
   | WARNING: WITNESS option enabled, expect reduced performance.
   | Timecounter "i8254" frequency 1193182 Hz quality 0
   | CPU: Dual-Core AMD Opteron(tm) Processor 2210 (1800.09-MHz K8-class CPU)
   |   Origin = "AuthenticAMD"  Id = 0x40f12  Stepping = 2
   |   Features=0x178bfbff<FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CLFLUSH,MMX,FXSR,SSE,SSE2,HTT>
   |   Features2=0x2001<SSE3,CX16>
   |   AMD Features=0xea500800<SYSCALL,NX,MMX+,FFXSR,RDTSCP,LM,3DNow!+,3DNow!>
   |   AMD Features2=0x1f<LAHF,CMP,SVM,ExtAPIC,CR8>
   |   Cores per package: 2
   | usable memory = 11799638016 (11253 MB)
   | avail memory  = 11410788352 (10882 MB)
   | ACPI APIC Table: <A M I  OEMAPIC >
   | FreeBSD/SMP: Multiprocessor System Detected: 4 CPUs
   |  cpu0 (BSP): APIC ID:  0
   |  cpu1 (AP): APIC ID:  1
   |  cpu2 (AP): APIC ID:  2
   |  cpu3 (AP): APIC ID:  3
   | ioapic0 <Version 1.1> irqs 0-23 on motherboard
   | XXX: OLD ATA DRIVER INSTALLED
   | kbd1 at kbdmux0
   | cryptosoft0: <software crypto> on motherboard
   | acpi0: <A M I OEMXSDT> on motherboard
   | acpi0: [ITHREAD]
   | acpi0: Power Button (fixed)
   | acpi0: reservation of fec00000, 1000 (3) failed
   | acpi0: reservation of fee00000, 1000 (3) failed
   | acpi0: reservation of 0, a0000 (3) failed
   | acpi0: reservation of 100000, c7f00000 (3) failed
   | Timecounter "ACPI-safe" frequency 3579545 Hz quality 850
   | acpi_timer0: <24-bit timer at 3.579545MHz> port 0x2008-0x200b on acpi0
   | pcib0: <ACPI Host-PCI bridge> port 0xcf8-0xcff on acpi0
   | pci0: <ACPI PCI bus> on pcib0
   | pci0: <memory, RAM> at device 0.0 (no driver attached)
   | isab0: <PCI-ISA bridge> at device 1.0 on pci0
   | isa0: <ISA bus> on isab0
   | pci0: <serial bus, SMBus> at device 1.1 (no driver attached)
   | ohci0: <OHCI (generic) USB controller> mem 0xfbefb000-0xfbefbfff irq 21 at device 2.0 on pci0
   | ohci0: [GIANT-LOCKED]
   | ohci0: [ITHREAD]
   | usb0: OHCI version 1.0, legacy support
   | usb0: <OHCI (generic) USB controller> on ohci0
   | usb0: USB revision 1.0
   | uhub0: <nVidia OHCI root hub, class 9/0, rev 1.00/1.00, addr 1> on usb0
   | uhub0: 10 ports with 10 removable, self powered
   | ehci0: <EHCI (generic) USB 2.0 controller> mem 0xfbefac00-0xfbefacff irq 22 at device 2.1 on pci0
   | ehci0: [GIANT-LOCKED]
   | ehci0: [ITHREAD]
   | usb1: EHCI version 1.0
   | usb1: companion controller, 10 ports each: usb0
   | usb1: <EHCI (generic) USB 2.0 controller> on ehci0
   | usb1: USB revision 2.0
   | uhub1: <nVidia EHCI root hub, class 9/0, rev 2.00/1.00, addr 1> on usb1
   | uhub1: 10 ports with 10 removable, self powered
   | uhub2: <vendor 0x0424 product 0x2502, class 9/0, rev 2.00/0.01, addr 2> on uhub1
   | uhub2: single transaction translator
   | uhub2: 2 ports with 1 removable, self powered
   | uhub3: <vendor 0x0424 product 0x2602, class 9/0, rev 2.00/0.00, addr 3> on uhub2
   | uhub3: multiple transaction translators
   | uhub3: 4 ports with 3 removable, self powered
   | umass0: <Generic Flash Card Reader, class 0/0, rev 2.00/4.44, addr 4> on uhub3
   | ukbd0: <FujitsuTakamisawaComponent USBkeyboard, class 0/0, rev 1.10/1.01, addr 5> on uhub3
   | kbd2 at ukbd0
   | ums0: <ELECOM ELECOM USB mouse with wheel, class 0/0, rev 1.10/22.87, addr 6> on uhub3
   | ums0: 3 buttons and Z dir.
   | umass1: <Generic USB2.0-CRW, class 0/0, rev 2.00/11.22, addr 7> on uhub1
   | atapci0: <nVidia nForce MCP55 UDMA133 controller> port 0x1f0-0x1f7,0x3f6,0x170-0x177,0x376,0xffa0-0xffaf at device 4.0 on pci0
   | ata0: <ATA channel 0> on atapci0
   | ata0: [ITHREAD]
   | ata1: <ATA channel 1> on atapci0
   | ata1: [ITHREAD]
   | atapci1: <nVidia nForce MCP55 SATA300 controller> port 0xd480-0xd487,0xd400-0xd403,0xd080-0xd087,0xd000-0xd003,0xcc00-0xcc0f mem 0xfbef9000-0xfbef9fff irq 23 at device 5.0 on pci0
   | atapci1: [ITHREAD]
   | ata2: <ATA channel 0> on atapci1
   | ata2: [ITHREAD]
   | ata3: <ATA channel 1> on atapci1
   | ata3: [ITHREAD]
   | atapci2: <nVidia nForce MCP55 SATA300 controller> port 0xc880-0xc887,0xc800-0xc803,0xc480-0xc487,0xc400-0xc403,0xc080-0xc08f mem 0xfbef8000-0xfbef8fff irq 20 at device 5.1 on pci0
   | atapci2: [ITHREAD]
   | ata4: <ATA channel 0> on atapci2
   | ata4: [ITHREAD]
   | ata5: <ATA channel 1> on atapci2
   | ata5: [ITHREAD]
   | atapci3: <nVidia nForce MCP55 SATA300 controller> port 0xc000-0xc007,0xbc00-0xbc03,0xb880-0xb887,0xb800-0xb803,0xb480-0xb48f mem 0xfbef7000-0xfbef7fff irq 21 at device 5.2 on pci0
   | atapci3: [ITHREAD]
   | ata6: <ATA channel 0> on atapci3
   | ata6: [ITHREAD]
   | ata7: <ATA channel 1> on atapci3
   | ata7: [ITHREAD]
   | pcib1: <ACPI PCI-PCI bridge> at device 6.0 on pci0
   | pci1: <ACPI PCI bus> on pcib1
   | fwohci0: <VIA Fire II (VT6306)> port 0xec00-0xec7f mem 0xfbfff800-0xfbffffff irq 16 at device 5.0 on pci1
   | fwohci0: [FILTER]
   | fwohci0: OHCI version 1.10 (ROM=1)
   | fwohci0: No. of Isochronous channels is 4.
   | fwohci0: EUI64 00:e0:81:00:00:27:6a:bf
   | fwohci0: Phy 1394a available S400, 2 ports.
   | fwohci0: Link S400, max_rec 2048 bytes.
   | firewire0: <IEEE1394(FireWire) bus> on fwohci0
   | fwe0: <Ethernet over FireWire> on firewire0
   | if_fwe0: Fake Ethernet address: 02:e0:81:27:6a:bf
   | fwe0: Ethernet address: 02:e0:81:27:6a:bf
   | fwip0: <IP over FireWire> on firewire0
   | fwip0: Firewire address: 00:e0:81:00:00:27:6a:bf @ 0xfffe00000000, S400, maxrec 2048
   | sbp0: <SBP-2/SCSI over FireWire> on firewire0
   | dcons_crom0: <dcons configuration ROM> on firewire0
   | dcons_crom0: bus_addr 0x1abc000
   | fwohci0: Initiate bus reset
   | fwohci0: BUS reset
   | fwohci0: node_id=0xc800ffc0, gen=1, CYCLEMASTER mode
   | atapci4: <SiI SiI 0680 UDMA133 controller> port 0xe880-0xe887,0xe800-0xe803,0xe480-0xe487,0xe400-0xe403,0xe080-0xe08f mem 0xfbfff400-0xfbfff4ff irq 16 at device 7.0 on pci1
   | atapci4: [ITHREAD]
   | ata8: <ATA channel 0> on atapci4
   | ata8: [ITHREAD]
   | ata9: <ATA channel 1> on atapci4
   | ata9: [ITHREAD]
   | hdac0: <NVidia MCP55 High Definition Audio Controller> mem 0xfbef0000-0xfbef3fff irq 22 at device 6.1 on pci0
   | hdac0: <HDA Driver Revision: 20080916_0112>
   | hdac0: [ITHREAD]
   | nfe0: <NVIDIA nForce MCP55 Networking Adapter> port 0xb400-0xb407 mem 0xfbef6000-0xfbef6fff,0xfbefa800-0xfbefa8ff,0xfbefa400-0xfbefa40f irq 23 at device 8.0 on pci0
   | miibus0: <MII bus> on nfe0
   | e1000phy0: <Marvell 88E1116 Gigabit PHY> PHY 2 on miibus0
   | e1000phy0:  10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, 1000baseTX-FDX, auto
   | nfe0: Ethernet address: 00:e0:81:74:ef:e4
   | nfe0: [FILTER]
   | nfe0: [FILTER]
   | nfe0: [FILTER]
   | nfe0: [FILTER]
   | nfe0: [FILTER]
   | nfe0: [FILTER]
   | nfe0: [FILTER]
   | nfe0: [FILTER]
   | nfe1: <NVIDIA nForce MCP55 Networking Adapter> port 0xb080-0xb087 mem 0xfbef5000-0xfbef5fff,0xfbefa000-0xfbefa0ff,0xfbef4c00-0xfbef4c0f irq 20 at device 9.0 on pci0
   | miibus1: <MII bus> on nfe1
   | e1000phy1: <Marvell 88E1116 Gigabit PHY> PHY 3 on miibus1
   | e1000phy1:  10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, 1000baseTX-FDX, auto
   | nfe1: Ethernet address: 00:e0:81:74:ef:e5
   | nfe1: [FILTER]
   | nfe1: [FILTER]
   | nfe1: [FILTER]
   | nfe1: [FILTER]
   | nfe1: [FILTER]
   | nfe1: [FILTER]
   | nfe1: [FILTER]
   | nfe1: [FILTER]
   | pcib2: <ACPI PCI-PCI bridge> at device 10.0 on pci0
   | pci2: <ACPI PCI bus> on pcib2
   | pcib3: <ACPI PCI-PCI bridge> at device 11.0 on pci0
   | pci3: <ACPI PCI bus> on pcib3
   | pcib4: <ACPI PCI-PCI bridge> at device 12.0 on pci0
   | pci4: <ACPI PCI bus> on pcib4
   | pcib5: <ACPI PCI-PCI bridge> at device 13.0 on pci0
   | pci5: <ACPI PCI bus> on pcib5
   | pcib6: <ACPI PCI-PCI bridge> at device 14.0 on pci0
   | pci6: <ACPI PCI bus> on pcib6
   | pcib7: <ACPI PCI-PCI bridge> at device 15.0 on pci0
   | pci7: <ACPI PCI bus> on pcib7
   | vgapci0: <VGA-compatible display> mem 0xfd000000-0xfdffffff,0xd0000000-0xdfffffff,0xfc000000-0xfcffffff irq 17 at device 0.0 on pci7
   | k8temp0: <AMD K8 Thermal Sensors> on hostb3
   | k8temp1: <AMD K8 Thermal Sensors> on hostb7
   | acpi_button0: <Power Button> on acpi0
   | atrtc0: <AT realtime clock> port 0x70-0x71 irq 8 on acpi0
   | uart0: <16550 or compatible> port 0x3f8-0x3ff irq 4 flags 0x10 on acpi0
   | uart0: [FILTER]
   | uart1: <16550 or compatible> port 0x2f8-0x2ff irq 3 drq 0 on acpi0
   | uart1: [FILTER]
   | acpi_hpet0: <High Precision Event Timer> iomem 0xfed00000-0xfed00fff on acpi0
   | Timecounter "HPET" frequency 25000000 Hz quality 900
   | atkbdc0: <Keyboard controller (i8042)> port 0x60,0x64 irq 1 on acpi0
   | atkbd0: <AT Keyboard> irq 1 on atkbdc0
   | kbd0 at atkbd0
   | atkbd0: [GIANT-LOCKED]
   | atkbd0: [ITHREAD]
   | psm0: <PS/2 Mouse> irq 12 on atkbdc0
   | psm0: [GIANT-LOCKED]
   | psm0: [ITHREAD]
   | psm0: model MouseMan+, device ID 0
   | cpu0: <ACPI CPU> on acpi0
   | powernow0: <PowerNow! K8> on cpu0
   | cpu1: <ACPI CPU> on acpi0
   | powernow1: <PowerNow! K8> on cpu1
   | cpu2: <ACPI CPU> on acpi0
   | powernow2: <PowerNow! K8> on cpu2
   | cpu3: <ACPI CPU> on acpi0
   | powernow3: <PowerNow! K8> on cpu3
   | ppc0: cannot reserve I/O port range
   | sc0: <System console> at flags 0x100 on isa0
   | sc0: VGA <16 virtual consoles, flags=0x300>
   | vga0: <Generic ISA VGA> at port 0x3c0-0x3df iomem 0xa0000-0xbffff on isa0
   | Timecounters tick every 1.000 msec
   | IPsec: Initialized Security Association Processing.
   | firewire0: 1 nodes, maxhop <= 0, cable IRM = 0 (me)
   | firewire0: bus manager 0 (me)
   | acd0: DVDR <PIONEER DVD-RW DVR-112/1.21> at ata0-master UDMA66
   | ad4: 35304MB <WDC WD360ADFD-00NLR1 20.07P20> at ata2-master SATA150
   | acd0: FAILURE - INQUIRY ILLEGAL REQUEST asc=0x24 ascq=0x00 sks=0x48 0x00 0x01
   | ad6: 715404MB <Hitachi HUA721075KLA330 GK8OA70M> at ata3-master SATA300
   | ad8: 715404MB <Hitachi HUA721075KLA330 GK8OA70M> at ata4-master SATA300
   | ad10: 715404MB <Hitachi HUA721075KLA330 GK8OA70M> at ata5-master SATA300
   | ad16: 58644MB <Maxtor 6Y060P0 YAR41BW0> at ata8-master UDMA133
   | ad18: 58644MB <Maxtor 6Y060P0 YAR41BW0> at ata9-master UDMA133
   | hdac0: <HDA Codec #0: Realtek ALC262>
   | pcm0: <HDA codec #0 Realtek ALC262 PCM #0> on hdac0
   | pcm1: <HDA codec #0 Realtek ALC262 PCM #1> on hdac0
   | GEOM_LABEL: Label for provider ad4s1 is ntfs/RAPTOR.
   | GEOM_LABEL: Label for provider ad6s3 is msdosfs/1B.
   | ar0: writing of Silicon Image Medley metadata is NOT supported yet
   | ar0: 58643MB <Silicon Image Medley RAID1> status: READY
   | ar0: disk0 READY (master) using ad16 at ata8-master
   | ar0: disk1 READY (mirror) using ad18 at ata9-master
   | SMP: AP CPU #1 Launched!
   | SMP: AP CPU #2 Launched!
   | SMP: AP CPU #3 Launched!
 printf racing!!
   | cd0 at atah0w pbmucs:  0 TtSaCr/g1e/t0 x02 0l<uRnE A0> K8/4
   | /c0dx01:f f<<IPINOTN,EUSERR, SDYVSD,-ERDWG , TDHVRR,-R1E1A2, W1R.I2,1I>N RVe,mQoUvAa>b
   | leW ACRDN-IRNOGM:  SWCISTIN-E0S S doepvtiicoen  
   | encadb0l:e d6,6 .e0x0p0eMcBt/ sr etdruacnesdf epresrf
   | ocrdm0a:n cAet.tem
   | pt to query device size failed: NOT READY, Medium not present
   | da2 at umass-sim1 bus 1 target 0 lun 0
   | da2: <Generic- Compact Flash 1.00> Removable Direct Access SCSI-0 device 
   | da2: 40.000MB/s transfers
   | da2: Attempt to query device size failed: NOT READY, Medium not present
   | da3 at umass-sim1 bus 1 target 0 lun 1
   | da3: <Generic- SM/xD-Picture 1.00> Removable Direct Access SCSI-0 device 
   | da3: 40.000MB/s transfers
   | da3: Attempt to query device size failed: NOT READY, Medium not present
   | da0 at umass-sim0 bus 0 target 0 lun 0
   | da0: <Generic Flash HS-CF 4.44> Removable Direct Access SCSI-0 device 
   | da0: 40.000MB/s transfers
   | da0: Attempt to query device size failed: NOT READY, Medium not present
   | da4 at umass-sim1 bus 1 target 0 lun 2
   | da4: <Generic- SD/MMC 1.00> Removable Direct Access SCSI-0 device 
   | da4: 40.000MB/s transfers
   | da4: Attempt to query device size failed: NOT READY, Medium not present
   | da5 at umass-sim1 bus 1 target 0 lun 3
   | da5: <Generic- MS/MS-Pro 1.00> Removable Direct Access SCSI-0 device 
   | da5: 40.000MB/s transfers
   | da5: Attempt to query device size failed: NOT READY, Medium not present
   | da1 at umass-sim0 bus 0 target 0 lun 1
   | da1: <Generic Flash HS-COMBO 4.44> Removable Direct Access SCSI-0 device 
   | da1: 40.000MB/s transfers
   | da1: Attempt to query device size failed: NOT READY, Medium not present
   | GEOM_LABEL: Label for provider ad8s3 is msdosfs/2B.
   | GEOM_LABEL: Label for provider ad10s3 is msdosfs/3B.
   | GEOM_LABEL: Label for provider ad4s2d is label/xxx.
   | GEOM_LABEL: Label for provider ad16s1 is msdosfs/MAXTOR RAID.
   | Trying to mount root from ufs:/dev/ad4s2a
   | lock order reversal:
   |  1st 0xffffff00053a4000 vfslock (vfslock) @ /usr/src/sys/kern/vfs_subr.c:372
   |  2nd 0xffffff00053a5448 devfs (devfs) @ /usr/src/sys/kern/vfs_lookup.c:432
   |  3rd 0xffffff00053a3c80 vfslock (vfslock) @ /usr/src/sys/kern/vfs_subr.c:372
   | KDB: stack backtrace:
   | db_trace_self_wrapper() at db_trace_self_wrapper+0x2a
   | _witness_debugger() at _witness_debugger+0x2e
   | witness_checkorder() at witness_checkorder+0x7d8
   | __lockmgr_args() at __lockmgr_args+0xca8
   | vfs_busy() at vfs_busy+0xe7
   | vfs_mount_alloc() at vfs_mount_alloc+0x88
   | vfs_donmount() at vfs_donmount+0xdbd
   | kernel_mount() at kernel_mount+0xa1
   | kernel_vmount() at kernel_vmount+0xce
   | vfs_mountroot_try() at vfs_mountroot_try+0x102
   | vfs_mountroot() at vfs_mountroot+0x3f0
   | start_init() at start_init+0x62
   | fork_exit() at fork_exit+0x12a
   | fork_trampoline() at fork_trampoline+0xe
   | --- trap 0, rip = 0, rsp = 0xfffffffe40030d40, rbp = 0 ---
   | lock order reversal:
   |  1st 0xffffff00053b57f8 ufs (ufs) @ /usr/src/sys/kern/vfs_subr.c:2051
   |  2nd 0xffffff00053a4000 vfslock (vfslock) @ /usr/src/sys/kern/vfs_subr.c:372
   | KDB: stack backtrace:
   | db_trace_self_wrapper() at db_trace_self_wrapper+0x2a
   | _witness_debugger() at _witness_debugger+0x2e
   | witness_checkorder() at witness_checkorder+0x7d8
   | __lockmgr_args() at __lockmgr_args+0xca8
   | vfs_busy() at vfs_busy+0xe7
   | lookup() at lookup+0x8c2
   | namei() at namei+0x43f
   | kern_unlinkat() at kern_unlinkat+0x9d
   | vfs_mountroot_try() at vfs_mountroot_try+0x418
   | vfs_mountroot() at vfs_mountroot+0x3f0
   | start_init() at start_init+0x62
   | fork_exit() at fork_exit+0x12a
   | fork_trampoline() at fork_trampoline+0xe
   | --- trap 0, rip = 0, rsp = 0xfffffffe40030d40, rbp = 0 ---
   | lock order reversal:
   |  1st 0xffffff0001a86070 user map (user map) @ /usr/src/sys/vm/vm_map.c:3115
   |  2nd 0xffffff00053b5448 ufs (ufs) @ /usr/src/sys/kern/vfs_subr.c:2051
   | KDB: stack backtrace:
   | db_trace_self_wrapper() at db_trace_self_wrapper+0x2a
   | _witness_debugger() at _witness_debugger+0x2e
   | witness_checkorder() at witness_checkorder+0x7d8
   | __lockmgr_args() at __lockmgr_args+0xca8
   | ffs_lock() at ffs_lock+0x8c
   | VOP_LOCK1_APV() at VOP_LOCK1_APV+0x9b
   | _vn_lock() at _vn_lock+0x47
   | vget() at vget+0x92
   | vnode_pager_lock() at vnode_pager_lock+0x1d3
   | vm_fault() at vm_fault+0x1e2
   | trap_pfault() at trap_pfault+0x128
   | trap() at trap+0x51c
   | calltrap() at calltrap+0x8
   | --- trap 0xc, rip = 0x40014f, rsp = 0x7fffffffee70, rbp = 0x7fffffffee90 ---
   | This module (opensolaris) contains code covered by the
   | Common Development and Distribution License (CDDL)
   | see http://opensolaris.org/os/licensing/opensolaris_license/
   | WARNING: ZFS is considered to be an experimental feature in FreeBSD.
   | ZFS filesystem version 6
   | ZFS storage pool version 6
   | lock order reversal:
   |  1st 0xffffff0005494098 zfs (zfs) @ /usr/src/sys/kern/vfs_subr.c:2051
   |  2nd 0xffffff000f53a320 vfslock (vfslock) @ /usr/src/sys/kern/vfs_subr.c:372
   | KDB: stack backtrace:
   | db_trace_self_wrapper() at db_trace_self_wrapper+0x2a
   | _witness_debugger() at _witness_debugger+0x2e
   | witness_checkorder() at witness_checkorder+0x7d8
   | __lockmgr_args() at __lockmgr_args+0xca8
   | vfs_busy() at vfs_busy+0xe7
   | vfs_mount_alloc() at vfs_mount_alloc+0x88
   | vfs_donmount() at vfs_donmount+0xdbd
   | nmount() at nmount+0xa6
   | syscall() at syscall+0x1bf
   | Xfast_syscall() at Xfast_syscall+0xab
   | --- syscall (378, FreeBSD ELF64, nmount), rip = 0x800f28afc, rsp = 0x7fffffffd378, rbp = 0x7fffffffd398 ---
   | lock order reversal:
   |  1st 0xffffff0001a85c30 user map (user map) @ /usr/src/sys/vm/vm_map.c:3115
   |  2nd 0xffffff000f597270 zfs (zfs) @ /usr/src/sys/kern/vfs_subr.c:2051
   | KDB: stack backtrace:
   | db_trace_self_wrapper() at db_trace_self_wrapper+0x2a
   | _witness_debugger() at _witness_debugger+0x2e
   | witness_checkorder() at witness_checkorder+0x7d8
   | __lockmgr_args() at __lockmgr_args+0xca8
   | vop_stdlock() at vop_stdlock+0x39
   | VOP_LOCK1_APV() at VOP_LOCK1_APV+0x9b
   | _vn_lock() at _vn_lock+0x47
   | vget() at vget+0x92
   | vnode_pager_lock() at vnode_pager_lock+0x1d3
   | vm_fault() at vm_fault+0x1e2
   | trap_pfault() at trap_pfault+0x128
   | trap() at trap+0x51c
   | calltrap() at calltrap+0x8
   | --- trap 0xc, rip = 0x80052793b, rsp = 0x7fffffffe368, rbp = 0x7fffffffe450 ---
   | lock order reversal:
   |  1st 0xffffff00053a4000 vfslock (vfslock) @ /usr/src/sys/kern/vfs_subr.c:372
   |  2nd 0xffffff000f83eba8 syncer (syncer) @ /usr/src/sys/kern/vfs_subr.c:3292
   | KDB: stack backtrace:
   | db_trace_self_wrapper() at db_trace_self_wrapper+0x2a
   | _witness_debugger() at _witness_debugger+0x2e
   | witness_checkorder() at witness_checkorder+0x7d8
   | __lockmgr_args() at __lockmgr_args+0xc2a
   | vop_stdlock() at vop_stdlock+0x39
   | VOP_LOCK1_APV() at VOP_LOCK1_APV+0x9b
   | _vn_lock() at _vn_lock+0x47
   | vfs_allocate_syncvnode() at vfs_allocate_syncvnode+0x75
   | vfs_donmount() at vfs_donmount+0xf98
   | nmount() at nmount+0xa6
   | syscall() at syscall+0x1bf
   | Xfast_syscall() at Xfast_syscall+0xab
   | --- syscall (378, FreeBSD ELF64, nmount), rip = 0x8007a9afc, rsp = 0x7fffffffe808, rbp = 0x60e358 ---
   | nfe0: link state changed to UP
   | WARNING: attempt to net_add_domain(bluetooth) after domainfinalize()
   | pid 1835 (mlterm) is using legacy pty devices
   | pid 1876 (kterm) is using legacy pty devices
   | tty_rel_free: pid=1835 tp=0xffffff000567a400 t_dev=0xffffff008279c200
   | pid 1917 (mlterm) is using legacy pty devices
   | tty_rel_free: pid=1917 tp=0xffffff00056bd800 t_dev=0xffffff013d291a00
   | pid 3078 (mlterm) is using legacy pty devices
   | pid 3144 (mlterm) is using legacy pty devices
   | tty_rel_free: pid=3144 tp=0xffffff0106052800 t_dev=0xffffff02d5ac4800
   | pid 3156 (mlterm) is using legacy pty devices
   | tty_rel_free: pid=3156 tp=0xffffff0090245000 t_dev=0xffffff001294fc00
   | tty_rel_free: pid=3078 tp=0xffffff00056c5800 t_dev=0xffffff013dcce600
   | tty_rel_free: pid=1899 tp=0xffffff00051f6800 t_dev=0xffffff00b6aef000
   | pid 3180 (mlterm) is using legacy pty devices
   | ucom0: <Palm. Inc. Palm Handheld, class 0/0, rev 1.10/1.00, addr 2> on uhub0
   | ucom0: at uhub0 port 5 (addr 2) disconnected
   | ucom0: detached
 The problem is fixed.
   | tty_rel_free: pid=3200 tp=0xffffff0182e61c00 t_dev=0xffffff001240e400
   ----------------end----------------
 
 --
 KOIE Hidetaka / koie@suri.co.jp / SURIGIKEN Co.,LTD.
State-Changed-From-To: open->closed 
State-Changed-By: ed 
State-Changed-When: Wed Sep 24 11:16:23 UTC 2008 
State-Changed-Why:  
Committed. Thanks! 

http://www.freebsd.org/cgi/query-pr.cgi?pr=127561 
>Unformatted:
