>Number:         9229
>Category:       kern
>Synopsis:       Panic from pool_get: free list modified
>Confidential:   no
>Severity:       serious
>Priority:       high
>Responsible:    kern-bug-people (Kernel Bug People)
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Tue Jan 18 14:20:59 2000
>Last-Modified:
>Originator:     Bernd Ernesti
>Organization:
	
>Release:        NetBSD-current 09-Jan-2000
>Environment:
	
NetBSD druuf.inka.de 1.4P NetBSD 1.4P (DRUUF) #58: Sun Jan  9 13:46:20 MET 2000     bernd@druuf.inka.de:/home/work/obj_alpha/src.alpha/sys/arch/alpha/compile/DRUUF alpha


>Description:
	The alpha paniced in a busy 100MBit network when I used a fxp/ex or
	fxp/tlp card combination to route that network to a 10MBit network.
	Where most of the traffic stayed in the internal network.

	The panics disappeared when I removed the fxp card and used either
	an ex/tlp or tlp/tlp card combination.

	This is a backtrace when I had the fxp and the ex in the alpha:

(gdb) target kcore netbsd.0.core
panic: pool_get(%s): free list modified: magic=%x; page %p; item addr %p

#0  0xfffffc00005b5a98 in dumpsys ()
    at /src/sys/arch/alpha/alpha/machdep.c:1333
1333            savectx(&dumppcb);
(gdb) bt
#0  0xfffffc00005b5a98 in dumpsys ()
    at /src/sys/arch/alpha/alpha/machdep.c:1333
#1  0xfffffc00005b56ac in cpu_reboot (howto=260, bootstr=0x0)
    at /src/sys/arch/alpha/alpha/machdep.c:1152
#2  0xfffffc00003e0b9c in panic (fmt=0xfffffc00005f8323 "pr_enter")
    at /src/sys/kern/subr_prf.c:217
#3  0xfffffc00003debbc in _pool_get (pp=0xfffffc00006cb980, flags=0, 
    file=0xfffffc00005e71b6 "/src/sys/dev/ic/elinkxl.c", line=1622)
    at /src/sys/kern/subr_pool.c:223
#4  0xfffffc0000321a50 in ex_add_rxbuf (sc=0xfffffe00000d0000, 
    rxd=0xfffffe00000d0820) at /src/sys/dev/ic/elinkxl.c:1622
#5  0xfffffc000032058c in ex_intr (arg=0x0) at /src/sys/dev/ic/elinkxl.c:1202
#6  0xfffffc000052aabc in alpha_shared_intr_dispatch (intr=0x0, num=0)
    at /src/sys/arch/alpha/common/shared_intr.c:111
#7  0xfffffc00005af5ec in eb164_iointr (framep=0x0, vec=0)
    at /src/sys/arch/alpha/pci/pci_eb164.c:360
#8  0xfffffc00005b3da8 in interrupt (a0=0, a1=0, a2=0, framep=0x0)
    at /src/sys/arch/alpha/alpha/interrupt.c:147
#9  0xfffffc00003003dc in XentInt () at /src/sys/arch/alpha/alpha/locore.s:540
#10 0xfffffc0000409d74 in vfs_shutdown () at /src/sys/kern/vfs_subr.c:2281
can not access 0xfffffffd, invalid translation (invalid L1 PTE)
can not access 0xfffffffd, invalid translation (invalid L1 PTE)
Cannot access memory at address 0xfffffffffffffffd.

>How-To-Repeat:
	I can't reproduce it anymore since the machine is no longer in the
	network, but I have a crashdump and the netbsd.gdb to supply further
	informations.
>Fix:
>Audit-Trail:
>Unformatted: