panic with HEAD

[Steve Mynott <steve.mynott@xxxxxxxxx>]

I get a panic with HEAD of a few hours ago apparently related to the wi device

can supply kernel/vmcore whatever if needed....

wi0: <WaveLAN/IEEE> at port 0x100-0x13f irq 10 function 0 config 1 on pccard0
wi0: using Lucent Technologies, WaveLAN/IEEE
wi0: Lucent Firmware: Station (6.6.1)

Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i386-dragonfly"...
panic: from debugger
panic messages:
---
panic: assertion: (ifp->if_serializer)->last_td == curthread in ether_input
panic: from debugger
Uptime: 2m54s
wi0: detached
kthread 0xc60b0c00 cbb0 has exited

dumping to dev #ad/0x20001, offset 1541344
dump ata0: resetting devices .. done
255 254 253 252 251 250 249 248 247 246 245 244 243 242 241 240 239 238 237 236
235 234 233 232 231 230 229 228 227 226 225 224 223 222 221 220 219 218 217 216
215 214 213 212 211 210 209 208 207 206 205 204 203 202 201 200 199 198 197 196
195 194 193 192 191 190 189 188 187 186 185 184 183 182 181 180 179 178 177 176
175 174 173 172 171 170 169 168 167 166 165 164 163 162 161 160 159 158 157 156
155 154 153 152 151 150 149 148 147 146 145 144 143 142 141 140 139 138 137 136
135 134 133 132 131 130 129 128 127 126 125 124 123 122 121 120 119 118 117 116
115 114 113 112 111 110 109 108 107 106 105 104 103 102 101 100 99 98 97 96 95 9
4 93 92 91 90 89 88 87 86 85 84 83 82 81 80 79 78 77 76 75 74 73 72 71 70 69 68
67 66 65 64 63 62 61 60 59 58 57 56 55 54 53 52 51 50 49 48 47 46 45 44 43 42 41
 40 39 38 37 36 35 34 33 32 31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 1
4 13 12 11 10 9 8 7 6 5 4 3 2 1 0
---
#0  dumpsys () at /usr/src/sys/kern/kern_shutdown.c:527
527             if (dumping++) {
dumpsys () at /usr/src/sys/kern/kern_shutdown.c:527
527             if (dumping++) {
(kgdb) bt full
#0  dumpsys () at /usr/src/sys/kern/kern_shutdown.c:527
        error = -1067716444
#1  0xc02aa344 in boot (howto=260) at /usr/src/sys/kern/kern_shutdown.c:360
No locals.
#2  0xc02aa7f6 in panic (fmt=0xc04f3e5c "from debugger")
    at /usr/src/sys/kern/kern_shutdown.c:673
        bootopt = 260
        newpanic = 0
        buf = "from debugger\000p->if_serializer)->last_td == curthread in ether
_input", '\0' <repeats 187 times>
#3  0xc01622ae in db_panic (addr=-1068907114, have_addr=0, count=-1,
    modif=0xcda82a3c "") at /usr/src/sys/ddb/db_command.c:449
No locals.
#4  0xc0162243 in db_command (last_cmdp=0xc05a9af0, cmd_table=0x0,
    aux_cmd_tablep=0xc054d5ec, aux_cmd_tablep_end=0xc054d604)
    at /usr/src/sys/ddb/db_command.c:345
        cmd = (struct command *) 0xc04cbab8
        t = 0
        modif = "\000\a\000\000\000\000\000\000\200\026_?\200\026_?\000\000\000\
000d*??r2I?\001\000\000\000\001\000\000\000\200\026_?\204*???0I?@?^?\aK\000 x\00
0\000\000?Z?\000\000\000\000\234*??c<\026???O???J?x\000\000\000??J?\000\000\000
\000?Z??5\026??Z?\210\234Z?x\000\000\000\003\000\000"
        addr = -1068907114
        count = -1
        have_addr = 0
        result = 0
#5  0xc0162323 in db_command_loop () at /usr/src/sys/ddb/db_command.c:471
No locals.
#6  0xc0165000 in db_trap (type=3, code=0) at /usr/src/sys/ddb/db_trap.c:72
        bkpt = 0
#7  0xc049c240 in kdb_trap (type=3, code=0, regs=0xcda82b54)
    at /usr/src/sys/i386/i386/db_interface.c:150
        ddb_mode = 1
---Type <return> to continue, or q <return> to quit---
#8  0xc04b07b2 in trap (frame=
      {tf_fs = 24, tf_es = 16, tf_ds = 16, tf_edi = 1, tf_esi = -1068268612, tf_
ebp = -844616804, tf_isp = -844616832, tf_ebx = 256, tf_edx = -1072988160, tf_ec
x = 32, tf_eax = 18, tf_trapno = 3, tf_err = 0, tf_eip = -1068907114, tf_cs = 8,
 tf_eflags = 658, tf_esp = -1068410192, tf_ss = -1068483217})
    at /usr/src/sys/i386/i386/trap.c:811
        gd = (struct globaldata *) 0x3
        td = (struct thread *) 0xc05bf0a4
        lp = (struct lwp *) 0x0
        p = (struct proc *) 0x0
        sticks = 0
        i = 0
        ucode = 0
        type = 3
        code = 0
        eva = 0
        __func__ = "trap"
#9  0xc049d51f in calltrap () at /usr/src/sys/i386/i386/exception.s:774
No locals.
#10 0x00000018 in ?? ()
No symbol table info available.
#11 0x00000010 in ?? ()
No symbol table info available.
#12 0x00000010 in ?? ()
No symbol table info available.
#13 0x00000001 in ?? ()
No symbol table info available.
#14 0xc05383bc in ?? ()
No symbol table info available.
#15 0xcda82b9c in ?? ()
No symbol table info available.
#16 0xcda82b80 in ?? ()
No symbol table info available.
---Type <return> to continue, or q <return> to quit---
#17 0x00000100 in ?? ()
No symbol table info available.
#18 0xc00b8000 in ?? ()
No symbol table info available.
#19 0x00000020 in ?? ()
No symbol table info available.
#20 0x00000012 in ?? ()
No symbol table info available.
#21 0x00000003 in ?? ()
No symbol table info available.
#22 0x00000000 in ?? ()
No symbol table info available.
#23 0xc049c596 in Debugger (msg=0x0) at cpufunc.h:68
        in_Debugger = 1 '\001'
#24 0xc02aa7ee in panic (
    fmt=0xc05383bc "assertion: (ifp->if_serializer)->last_td == curthread in %s"
) at /usr/src/sys/kern/kern_shutdown.c:671
        bootopt = 256
        newpanic = 1
        buf = "from debugger\000p->if_serializer)->last_td == curthread in ether
_input", '\0' <repeats 187 times>
#25 0xc03100ed in ether_input (ifp=0xc9876000, eh=0x0, m=0xc126a800)
    at /usr/src/sys/net/if_ethersubr.c:568
        save_eh = {ether_dhost = "\006\000\000\000\b\002",
  ether_shost = "?\000\000\002-\t", ether_type = 36198}
        __func__ = "ether_input"
#26 0xc03100ad in ether_input_internal (ifp=0x0, m=0x0)
    at /usr/src/sys/net/if_ethersubr.c:539
No locals.
#27 0xc031fde3 in ieee80211_input (ifp=0xc9876000, m=0xc126a800,
    ni=0xc1189f38, rssi=106, rstamp=1400552)
    at /usr/src/sys/netproto/802_11/ieee80211_input.c:302
        ic = (struct ieee80211com *) 0xc9876000
---Type <return> to continue, or q <return> to quit---
        wh = (struct ieee80211_frame *) 0x0
        eh = (struct ether_header *) 0x0
        m1 = (struct mbuf *) 0x0
        len = 0
        dir = 2 '\002'
        type = 8 '\b'
        subtype = 168 '?'
        bssid = (uint8_t *) 0x0
        rxseq = 0
        __func__ = "ieee80211_input"
#28 0xc027b64d in wi_rx_intr (sc=0xc1189f38)
    at /usr/src/sys/dev/netif/wi/if_wi.c:1504
        ic = (struct ieee80211com *) 0xc9876000
        ifp = (struct ifnet *) 0xc9876000
        frmhdr = {wi_status = 8192, wi_rx_tstamp1 = 24296, wi_rx_tstamp0 = 21,
  wi_rx_silence = 54 '6', wi_rx_signal = 106 'j', wi_rx_rate = 110 'n',
  wi_rx_flow = 0 '\0', wi_tx_rtry = 0 '\0', wi_tx_rate = 0 '\0',
  wi_tx_ctl = 0, wi_whdr = {i_fc = "\bB", i_dur = "?",
    i_addr1 = "\000\002-\tf\215", i_addr2 = "\000\r\223\201e?",
    i_addr3 = "\000\r\223!?<", i_seq = "p\027", i_addr4 = "[&\204\016,\221"},
  wi_dat_len = 36, wi_ehdr = {ether_dhost = "\000\002-\tf\215",
    ether_shost = "\000\r\223!?<", ether_type = 9216}}
        m = (struct mbuf *) 0xc126a800
        wh = (struct ieee80211_frame *) 0xc126a838
        ni = (struct ieee80211_node *) 0xc1189f38
        fid = 251
        len = 36
        rssi = 106
        status = 0
        rstamp = 1400552
#29 0xc0279507 in wi_intr (arg=0xc9876000)
    at /usr/src/sys/dev/netif/wi/if_wi.c:591
        sc = (struct wi_softc *) 0xc9876000
---Type <return> to continue, or q <return> to quit---
        ifp = (struct ifnet *) 0xc9876000
        status = 32769
#30 0xc0398d84 in pccard_intr (arg=0xc1169f00)
    at /usr/src/sys/bus/pccard/pccard.c:1209
        pf = (struct pccard_function *) 0xc1169f00
        reg = 0
        doisr = 1
#31 0xc016c1ef in cbb_intr (arg=0xc12c96c8)
    at /usr/src/sys/dev/pccard/pccbb/pccbb.c:1060
        sc = (struct cbb_softc *) 0xc12c96c8
        sockevent = 0
        ih = (struct cbb_intrhand *) 0xc1041e40
#32 0xc028e8fb in ithread_handler (arg=0xa)
    at /usr/src/sys/kern/kern_intr.c:750
        info = (struct intr_info *) 0xc05bf0a0
        use_limit = 0
        lticks = 17325
        lcount = 0
        intr = 10
        list = (struct intrec **) 0xc05bf0a0
        rec = 0x0
        nrec = 0x0
        gd = 0xff800000
        ill_timer = {node = {tqe_next = 0x0, tqe_prev = 0x0}, queue = 0x0,
  time = 0, periodic = 0, func = 0, data = 0x0, flags = 0, gd = 0x0}
        ill_count = 18
#33 0xc02b0b2f in lwkt_create (func=0, arg=0x0, tdp=0xc05bf0a4, template=0x0,
        ifp = (struct ifnet *) 0xc9876000
        status = 32769
#30 0xc0398d84 in pccard_intr (arg=0xc1169f00)
    at /usr/src/sys/bus/pccard/pccard.c:1209
        pf = (struct pccard_function *) 0xc1169f00
        reg = 0
        doisr = 1
#31 0xc016c1ef in cbb_intr (arg=0xc12c96c8)
    at /usr/src/sys/dev/pccard/pccbb/pccbb.c:1060
        sc = (struct cbb_softc *) 0xc12c96c8
        sockevent = 0
        ih = (struct cbb_intrhand *) 0xc1041e40
#32 0xc028e8fb in ithread_handler (arg=0xa)
    at /usr/src/sys/kern/kern_intr.c:750
        info = (struct intr_info *) 0xc05bf0a0
        use_limit = 0
        lticks = 17325
        lcount = 0
        intr = 10
        list = (struct intrec **) 0xc05bf0a0
        rec = 0x0
        nrec = 0x0
        gd = 0xff800000
        ill_timer = {node = {tqe_next = 0x0, tqe_prev = 0x0}, queue = 0x0,
  time = 0, periodic = 0, func = 0, data = 0x0, flags = 0, gd = 0x0}
        ill_count = 18
#33 0xc02b0b2f in lwkt_create (func=0, arg=0x0, tdp=0xc05bf0a4, template=0x0,
    tdflags=---Can't read userspace from dump, or kernel process---

) at /usr/src/sys/kern/lwkt_thread.c:1362
        td = 0xff8003a8
Previous frame inner to this frame (corrupt stack?)