Re: Panic on evbarm triggered by dumpfs

[Eduardo Horvath <eeh%NetBSD.org@localhost>]

On Wed, 15 Jan 2014, Petri Laakso wrote:

> On Wed, 15 Jan 2014 16:43:39 +0000 (UTC)
> Eduardo Horvath <eeh%NetBSD.org@localhost> wrote:
> 
> > Can you toggle DIAGNOSTIC and see if there is a change in the behavior?  
> > If you hit the first panic, disabling DIAGNOSTIC will make it go away
> > (although things may crash a different way later).  If you hit the second 
> > panic, DIAGNOSTIC may give more useful information about something going 
> > wrong earlier.
> 
> Thank you!
> 
> Here is panic with options DIAGNOSTIC. I'll try understand the problem and
> provide more information before weekend...
> 
> # panic: pool_get(pvepl): free list modified: magic=0; page 0xc82cc000; item 
> add
> r 0xc82cc1e0
> 
> Stopped in pid 11.1 (sh) at     netbsd:cpu_Debugger+0x4:        bx      r14
> db> bt
> 0xcbab7d70: netbsd:vpanic+0x10
> 0xcbab7d88: netbsd:printf_nolog
> 0xcbab7dc8: netbsd:pool_get+0x548
> 0xcbab7e1c: netbsd:pmap_enter+0x770
> 0xcbab7f48: netbsd:uvm_fault_internal+0xe50
> 0xcbab7fac: netbsd:prefetch_abort_handler+0x174
> 
> # from ddb show pools
> POOL pvepl: size 16, align 4, ioff 0, roflags 0x00000040
>         alloc 0xc044e1f0
>         minitems 512, minpages 3, maxpages 4294967295, npages 6
>         itemsperpage 254, nitems 539, nout 985, hardlimit 4294967295
>         nget 3691, nfail 0, nput 2706
>         npagealloc 6, npagefree 0, hiwat 6, nidle 2

In this case it looks like the pool page header is ok but one of the free 
items has been stepped on.  Maybe it was accessed after it was freed.

I would suggest turning on DEBUG as well since it will add additional 
checking.

There are three modifiers to the ddb `show pool' command, `l', `c', and 
`p' to display the log, cache entries, and pages.  Maybe there's some 
interesting information there.  Can you try all three?  Printing the page 
list should dump the headers for each page.

You have the address of the page and the item.  Try to dump the item and 
some of the surrounding memory.  I think it should be 16 bytes.  If we can 
see some pattern, such as a segment of memory that's been zero-ed, it 
might tell us something useful.  And depending on the results of dumping 
the page header, you might want to do the same thing for the header.

Eduardo