From kargl@troutmask.apl.washington.edu  Thu Mar 19 22:21:55 2009
Return-Path: <kargl@troutmask.apl.washington.edu>
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 109BB106566B;
	Thu, 19 Mar 2009 22:21:55 +0000 (UTC)
	(envelope-from kargl@troutmask.apl.washington.edu)
Received: from troutmask.apl.washington.edu (troutmask.apl.washington.edu [128.208.78.105])
	by mx1.freebsd.org (Postfix) with ESMTP id E78108FC0A;
	Thu, 19 Mar 2009 22:21:54 +0000 (UTC)
	(envelope-from kargl@troutmask.apl.washington.edu)
Received: from troutmask.apl.washington.edu (localhost.apl.washington.edu [127.0.0.1])
	by troutmask.apl.washington.edu (8.14.3/8.14.3) with ESMTP id n2JMLsLR001452;
	Thu, 19 Mar 2009 15:21:54 -0700 (PDT)
	(envelope-from kargl@troutmask.apl.washington.edu)
Received: (from kargl@localhost)
	by troutmask.apl.washington.edu (8.14.3/8.14.3/Submit) id n2JMLsXH001451;
	Thu, 19 Mar 2009 15:21:54 -0700 (PDT)
	(envelope-from kargl)
Message-Id: <200903192221.n2JMLsXH001451@troutmask.apl.washington.edu>
Date: Thu, 19 Mar 2009 15:21:54 -0700 (PDT)
From: "Steven G. Kargl" <kargl@troutmask.apl.washington.edu>
Reply-To: "Steven G. Kargl" <kargl@troutmask.apl.washington.edu>
To: FreeBSD-gnats-submit@freebsd.org
Cc: alc@freebsd.org
Subject: panic: vm_page_free_toq: freeing mapped page
X-Send-Pr-Version: 3.113
X-GNATS-Notify:

>Number:         132827
>Category:       kern
>Synopsis:       [vm] [panic] vm_page_free_toq: freeing mapped page
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    freebsd-bugs
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Thu Mar 19 22:30:01 UTC 2009
>Closed-Date:    Sat May 02 22:18:18 UTC 2009
>Last-Modified:  Wed May 27 18:50:01 UTC 2009
>Originator:     Steven G. Kargl
>Release:        FreeBSD 8.0-CURRENT amd64
>Organization:
APL-UW
>Environment:
System: FreeBSD troutmask.apl.washington.edu 8.0-CURRENT FreeBSD 8.0-CURRENT #4: Mon Mar 16 15:46:09 PDT 2009 root@troutmask.apl.washington.edu:/usr/obj/usr/src/sys/SPEW amd64


	
>Description:


panic: vm_page_free_toq: freeing mapped page 0xffffff01fe2bc980
cpuid = 1
Uptime: 2d0h34m41s
Physical memory: 8117 MB
Dumping 848 MB: 833 817 801 785 769 753 737 721 705 689 673 657 641 625 609 593 
577 561 545 529 513 497 481 465 449 433 (CTRL-C to abort)  417 401 385 369 353 3
37 321 305 289 273 257 241 225 209 193 177 161 145 (CTRL-C to abort)  129 (CTRL-
C to abort)  113 (CTRL-C to abort)  97 81 65 (CTRL-C to abort)  49 (CTRL-C to ab
ort)  (CTRL-C to abort)  33 17 (CTRL-C to abort)  1

#0  doadump () at pcpu.h:215
215     pcpu.h: No such file or directory.
        in pcpu.h
(kgdb) bt
#0  doadump () at pcpu.h:215
#1  0xffffffff802e9aea in boot (howto=260)
    at /usr/src/sys/kern/kern_shutdown.c:420
#2  0xffffffff802e9f5c in panic (fmt=Variable "fmt" is not available.)
    at /usr/src/sys/kern/kern_shutdown.c:576
#3  0xffffffff804ccd5d in vm_page_free_toq (m=0xffffff01fe2bc980)
    at /usr/src/sys/vm/vm_page.c:1370
#4  0xffffffff804c9807 in vm_object_terminate (object=0xffffff017f6c0320)
    at /usr/src/sys/vm/vm_object.c:677
#5  0xffffffff804cb047 in vm_object_deallocate (object=0xffffff017f6c0320)
    at /usr/src/sys/vm/vm_object.c:589
#6  0xffffffff804c3700 in _vm_map_unlock (map=0xffffff012afaf180,
    file=Variable "file" is not available.)
    at /usr/src/sys/vm/vm_map.c:476
#7  0xffffffff804c3cbf in vm_map_remove (map=0xffffff012afaf180,
    start=Variable "start" is not available.)
    at /usr/src/sys/vm/vm_map.c:2596
#8  0xffffffff804c4b25 in vmspace_free (vm=0xffffff012afaf180)
    at /usr/src/sys/vm/vm_map.c:325
#9  0xffffffff804c5f26 in vmspace_exec (p=0xffffff000467b000,
    minuser=Variable "minuser" is not available.)
    at /usr/src/sys/vm/vm_map.c:3228
#10 0xffffffff802c5552 in exec_new_vmspace (imgp=0xffffffff23ff49f0, 
    sv=0xffffffff8075d8c0) at /usr/src/sys/kern/kern_exec.c:1013
#11 0xffffffff8052ef1e in exec_elf32_imgact (imgp=0xffffffff23ff49f0)
    at imgact_elf.c:694
#12 0xffffffff802c59bb in kern_execve (td=0xffffff00046a06e0, 
    args=0xffffffff23ff4af0, mac_p=Variable "mac_p" is not available.)
    at /usr/src/sys/kern/kern_exec.c:470
#13 0xffffffff802c681d in execve (td=0xffffff00046a06e0,
    uap=Variable "uap" is not available.)
    at /usr/src/sys/kern/kern_exec.c:203
#14 0xffffffff80502bed in syscall (frame=0xffffffff23ff4c80)
    at /usr/src/sys/amd64/amd64/trap.c:882
#15 0xffffffff804dfefb in Xfast_syscall ()
    at /usr/src/sys/amd64/amd64/exception.S:338
#16 0x0000000200927c4c in ?? ()

>How-To-Repeat:

Not sure how reproducible this problem is.  It has occurred twice within
the last 2 or 3 days.  The 2nd panic occurred while I was in Xorg, running
portupgrade on cmake, running an gmp/mpfr application, and *starting* 
linux's acroread.  Perhaps, something is broken in the linuxalator.

>Fix:

	


>Release-Note:
>Audit-Trail:

From: "Steven G. Kargl" <kargl@troutmask.apl.washington.edu>
To: Alan Cox <alc@cs.rice.edu>
Cc: bug-followup@FreeBSD.org
Subject: Re: kern/132827: [vm] [panic] vm_page_free_toq: freeing
 mapped page
Date: Fri, 1 May 2009 10:07:40 -0700 (PDT)

 Alan Cox wrote:
 > There has been no reported re-occurrence of this assertion failure since 
 > the submitter removed ZERO_COPY_SOCKETS from his kernel configuration.
 
 Yes, that is correct.  The panics stopped after removal of
 ZERO_COPY_SOCKETS.  I'd suggest adding a big warning in
 the various NOTES files that ZERO_COPY_SOCKETS is broken.
 
 -- 
 Steve
 http://troutmask.apl.washington.edu/~kargl/

From: Alan Cox <alc@cs.rice.edu>
To: bug-followup@FreeBSD.org, kargl@troutmask.apl.washington.edu
Cc:  
Subject: Re: kern/132827: [vm] [panic] vm_page_free_toq: freeing mapped page
Date: Fri, 01 May 2009 11:46:44 -0500

 There has been no reported re-occurrence of this assertion failure since 
 the submitter removed ZERO_COPY_SOCKETS from his kernel configuration.
 

From: Alan Cox <alc@cs.rice.edu>
To: "Steven G. Kargl" <kargl@troutmask.apl.washington.edu>
Cc: bug-followup@FreeBSD.org
Subject: Re: kern/132827: [vm] [panic] vm_page_free_toq: freeing mapped page
Date: Fri, 01 May 2009 12:41:37 -0500

 Steven G. Kargl wrote:
 > Alan Cox wrote:
 >   
 >> There has been no reported re-occurrence of this assertion failure since 
 >> the submitter removed ZERO_COPY_SOCKETS from his kernel configuration.
 >>     
 >
 > Yes, that is correct.  The panics stopped after removal of
 > ZERO_COPY_SOCKETS.  I'd suggest adding a big warning in
 > the various NOTES files that ZERO_COPY_SOCKETS is broken.
 >
 >   
 
 I will gladly commit appropriately frightening language.  Send me a 
 patch.  :-)
 
 Alan
 
State-Changed-From-To: open->closed 
State-Changed-By: alc 
State-Changed-When: Sat May 2 22:15:18 UTC 2009 
State-Changed-Why:  
The crash was caused by the use of a buggy, experimental feature. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=132827 

From: "Steven G. Kargl" <kargl@troutmask.apl.washington.edu>
To: Alan Cox <alc@cs.rice.edu>
Cc: bug-followup@FreeBSD.org
Subject: Re: kern/132827: [vm] [panic] vm_page_free_toq: freeing
 mapped page
Date: Wed, 27 May 2009 11:43:46 -0700 (PDT)

 Alan Cox wrote:
 > Steven G. Kargl wrote:
 > > Alan Cox wrote:
 > >   
 > >> There has been no reported re-occurrence of this assertion failure since 
 > >> the submitter removed ZERO_COPY_SOCKETS from his kernel configuration.
 > >>     
 > >
 > > Yes, that is correct.  The panics stopped after removal of
 > > ZERO_COPY_SOCKETS.  I'd suggest adding a big warning in
 > > the various NOTES files that ZERO_COPY_SOCKETS is broken.
 > >
 > >   
 > 
 > I will gladly commit appropriately frightening language.  Send me a 
 > patch.  :-)
 > 
 
 Index: NOTES
 ===================================================================
 --- NOTES       (revision 191256)
 +++ NOTES       (working copy)
 @@ -930,7 +930,9 @@
  # receiving data via a socket.  The send side works for any type of NIC,
  # the receive side only works for NICs that support MTUs greater than the
  # page size of your architecture and that support header splitting.  See
 -# zero_copy(9) for more details.
 +# zero_copy(9) for more details.  This option is assocated with a rare,
 +# but possible, kernel panic in vm_page_free_toq().  See kern/132827 for
 +# additional details.
  options        ZERO_COPY_SOCKETS
 
 -- 
 Steve
 http://troutmask.apl.washington.edu/~kargl/
>Unformatted:
