>Number:         16315
>Category:       kern
>Synopsis:       panic: malloc: out of space in kmem_map [sparc 1.5.3]
>Confidential:   no
>Severity:       critical
>Priority:       high
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Thu Apr 11 23:06:00 PDT 2002
>Closed-Date:
>Last-Modified:
>Originator:     David Pickworth
>Release:        NetBSD 1.5.3
>Organization:
Guns-Media
>Environment:
NetBSD baal.guns-media.com 1.5.3 NetBSD 1.5.3 (BAAL) #2: Fri Apr 12 00:24:17 EST 2002 david@hermes.guns-media.com:/usr/src/sys/arch/sparc/compile/BAAL sparc
>Description:

baal# gdb netbsd.gdb
GNU gdb 4.17
Copyright 1998 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "sparc--netbsd"...
(gdb) target kcore netbsd.0.core
panic: malloc: out of space in kmem_map
#0  mi_switch (p=0xf01825b0) at ../../../../kern/kern_synch.c:825
825             cpu_switch(p);
(gdb) bt
#0  mi_switch (p=0xf01825b0) at ../../../../kern/kern_synch.c:825
#1  0xf002a3a8 in bpendtsleep () at ../../../../kern/kern_synch.c:482
#2  0xf00dd720 in uvm_scheduler () at ../../../../uvm/uvm_glue.c:453
#3  0xf001b38c in check_console (p=0xf0182000)
    at ../../../../kern/init_main.c:522
#4  0xf00072b0 in cpu_hatch ()
can not access 0x390360, invalid address (390360)
can not access 0x390360, invalid address (390360)
can not access 0x390360, invalid address (390360)
can not access 0x390360, invalid address (390360)
can not access 0xefffffd8, invalid address (efffffd8)
can not access 0xefffffd8, invalid address (efffffd8)
Cannot access memory at address 0xefffffd8.
(gdb) frame 0
#0  mi_switch (p=0xf01825b0) at ../../../../kern/kern_synch.c:825
825             cpu_switch(p);
(gdb) print p
$1 = (struct proc *) 0xf01825b0
(gdb) print {struct proc *}0xf01825b0
$2 = (struct proc *) 0x0
(gdb) quit
baal# exit

I have the kernel and core available to debug this crash if needed, just email.


NetBSD 1.5.3 (BAAL) #2: Fri Apr 12 00:24:17 EST 2002
    david@hermes.guns-media.com:/usr/src/sys/arch/sparc/compile/BAAL
total memory = 383 MB
avail memory = 353 MB
using 896 buffers containing 19732 KB of memory
bootpath: /iommu@f,e0000000/sbus@f,e0001000/espdma@f,400000/esp@f,800000/sd@3,0
mainbus0 (root): SUNW,SPARCstation-20
cpu0 at mainbus0: RT620/625 @ 180 MHz, on-chip FPU
cpu0: 512K byte write-back, 32 bytes/line, sw flush: cache enabled
obio0 at mainbus0
clock0 at obio0 slot 0 offset 0x200000: mk48t08 (eeprom)
timer0 at obio0 slot 0 offset 0x300000 delay constant 59
zs0 at obio0 slot 0 offset 0x100000 level 12 softpri 6
zstty0 at zs0 channel 0 (console i/o)
zstty1 at zs0 channel 1
zs1 at obio0 slot 0 offset 0x0 level 12 softpri 6
kbd0 at zs1 channel 0
ms0 at zs1 channel 1
SUNW,fdtwo at obio0 slot 0 offset 0x700000 level 11 not configured
auxreg0 at obio0 slot 0 offset 0x800000
power0 at obio0 slot 0 offset 0xa01000 level 2
iommu0 at mainbus0 ioaddr 0xe0000000: version 0x1/0x1, page-size 4096, range 64MB
sbus0 at iommu0: clock = 25 MHz
dma0 at sbus0 slot 15 offset 0x400000: rev 2
esp0 at dma0 slot 15 offset 0x800000 level 4: ESP200, 40MHz, SCSI ID 7
scsibus0 at esp0: 8 targets, 8 luns per target
ledma0 at sbus0 slot 15 offset 0x400010: rev 2
le0 at ledma0 slot 15 offset 0xc00000 level 6: address 08:00:20:20:2b:1c
le0: 8 receive buffers, 2 transmit buffers
bpp0 at sbus0 slot 15 offset 0x4800000 level 2 (ipl 3): rev 2
SUNW,DBRIe at sbus0 slot 14 offset 0x10000 level 9 not configured
eccmemctl0 at mainbus0: version 0x0/0x2
scsibus0: waiting 2 seconds for devices to settle...
probe(esp0:1:0): max sync rate 10.00MB/s
sd0 at scsibus0 target 1 lun 0: <IBM, DDRS34560SUN4.2G, S98E> SCSI2 0/direct fixed
sd0: 4094 MB, 3882 cyl, 16 head, 135 sec, 512 bytes/sect x 8385121 sectors
probe(esp0:3:0): max sync rate 10.00MB/s
sd1 at scsibus0 target 3 lun 0: <IBM, DDRS34560SUN4.2G, S98E> SCSI2 0/direct fixed
sd1: 4094 MB, 3882 cyl, 16 head, 135 sec, 512 bytes/sect x 8385121 sectors
root on sd1a dumps on sd1b
root file system type: ffs
IP Filter: v3.4.23 initialized.  Default = pass all, Logging = enabled


include "arch/sparc/conf/std.sparc"

#ident 		"GENERIC-$Revision: 1.107.2.5 $"

maxusers	64	

## System kernel configuration.  See options(4) for more detail.


# Options for variants of the Sun SPARC architecure.
# We currently support three architecture types; at least one is required.
options 	SUN4M		# sun4m - SS10, SS20, Classic, etc.

config		netbsd	root on ? type ?

## System call tracing (see ktrace(1)).
options 	KTRACE

## Collect statistics on kernel malloc's and free's.  This does have a
## significant performance hit on slower machines, so it is intended for
## diagnostic use only.
#options 	KMEMSTATS

## System V compatible IPC subsystem.  (msgctl(2), semctl(2), and shmctl(2))
options 	SYSVMSG		# System V message queues
options 	SYSVSEM		# System V semaphores
options 	SYSVSHM		# System V shared memory
#options 	SHMMAXPGS=1024	# 1024 pages is the default

## Loadable kernel module support; still under development.
#options 	LKM


## The DDB in-kernel debugger runs at panic (unless DDB_ONPANIC=0), or at
## serial console break or keyboard reset, where the PROM would normally
## intercept.  DDB_HISTORY_SIZE adds up/down arrow command history.
options 	DDB			# kernel dynamic debugger
options 	DDB_HISTORY_SIZE=100	# enable history editing in DDB
options 	DDB_ONPANIC=0		# see also sysctl(8): `ddb.onpanic'

## You may also use gdb, on another computer connected to this machine over
## a serial port.  Both KGDBDEV and KGDBRATE should be specified; KGDBDEV is
## a dev_t encoded device number of the serial port to use, where the minor
## device number encodes the PROM enumeration of the serial ports, i.e.:
## 0xc00 = ttya, 0xc01 = ttyb, 0xc02 = ttyc, 0xc03 = ttyd.  (Note: ttyc and
## ttyd are available only on some sun4 models)
#options 	KGDB		# support for kernel gdb
#options 	KGDBDEV=0xc00	# kgdb device number (this sample is `ttyb')
#options 	KGDBRATE=38400	# baud rate


## Compile the kernel with debugging symbols (`netbsd.gdb' is the debug file),
## such that gdb(1) can be used on a kernel coredump.

makeoptions 	DEBUG="-g"


## Adds code to the kernel that does internal consistency checks, and will
## cause the kernel to panic if corruption of internal data structures
## is detected.
#options 	DIAGNOSTIC	# extra kernel sanity checking

## Enable (possibly expensive) debugging code that may also display messages
## on the system console
#options 	DEBUG

## Make SCSI error messages more verbose when explaining their meanings.
#options 	SCSIVERBOSE

#options 	MIIVERBOSE	# verbose PHY autoconfig messages

## `INSECURE' turns off the kernel security level (securelevel = 0 always).
## This allows writing to /dev/mem, loading kernel modules while multi-user,
## and other insecurities good only for development work.  Do not use this
## option on a production machine.
#options 	INSECURE

## Allow non-root users to grab /dev/console with programs such as xconsole.
## `xconsole' therefore does not need setuid root with this option enabled.
#options 	UCONSOLE

## File systems.  You probably need at least one of FFS or NFS.
file-system	FFS		# Berkeley Fast Filesystem
file-system	NFS		# Sun NFS-compatible filesystem client
file-system	KERNFS		# kernel data-structure filesystem

## File system options.
#options 	NFSSERVER	# Sun NFS-compatible filesystem server
options 	QUOTA		# FFS quotas
#options 	FFS_EI		# FFS Endian Independent support
options 	SOFTDEP         # FFS soft updates support.

## Network protocol support.  In most environments, INET is required.
options 	INET		# IP (Internet Protocol) v4
#options 	INET6		# IPV6
#options 	IPSEC		# IP security
#options 	IPSEC_ESP	# IP security (encryption part; define w/IPSEC)
#options 	IPSEC_DEBUG	# debug for IP security
#options 	GATEWAY		# packet forwarding ("router switch")
#options 	MROUTING	# packet forwarding of multicast packets
#options 	DIRECTED_BROADCAST	# allow broadcasts through routers
options 	NTP		# Network Time Protocol in-kernel support
#options 	PPS_SYNC	# Add serial line synchronization for NTP
options 	PFIL_HOOKS	# Add pfil(9) hooks, intended for custom LKMs.
options 	IPFILTER_LOG	# Add ipmon(8) logging for ipfilter device

#### Main bus and CPU .. all systems.
mainbus0 at root
cpu0	at mainbus0

#### Bus types found on SPARC systems.

#sbus0	at mainbus0				# sun4c
obio0	at mainbus0				# sun4 and sun4m
#sparcvme0	at mainbus0				# sun4
iommu0	at mainbus0				# sun4m
sbus0	at iommu0				# sun4m
sparcvme0	at iommu0				# sun4m
#vme0	at sparcvme0		# mi VME attachment

## SBus expander box
#xbox*	at sbus? slot ? offset ?
#sbus*	at xbox?

#### Standard system devices -- all required for a given architecture

## Auxiliary system registers on sun4c and sun4m
#auxreg0	at mainbus0				# sun4c
auxreg0	at obio0				# sun4m

## Power status and control register on Sun4m systems
power0	at obio0

## Mostek clock found on 4/300, sun4c, and sun4m systems.
### The Mostek clock NVRAM is the "eeprom" on sun4/300 systems.
clock0	at mainbus0				# sun4c
clock0	at obio0 addr 0xf2000000		# sun4/300
## Memory error registers.
#memreg0	at mainbus0				# sun4c
memreg0	at obio0				# sun4m

## ECC memory control
eccmemctl0 at mainbus0				# sun4m

## Timer chip found on 4/300, sun4c, and sun4m systems.
timer0	at obio0				# sun4m

## Zilog 8530 serial chips.  Each has two-channels.
## zs0 is ttya and ttyb.  zs1 is the keyboard and mouse.
zs0	at obio0					# sun4m
zstty0	at zs0 channel 0				# ttya
zstty1	at zs0 channel 1				# ttyb

zs1	at obio0					# sun4m
kbd0	at zs1 channel 0				# keyboard
ms0	at zs1 channel 1				# mouse

# Parallel port.
bpp*	at sbus? slot? offset ?

#### Disk controllers and disks

#

## The following flags may be set for the NCR53c94 based esp driver:
##	bits 0-7:  disable disconnect/reselect for the corresponding target
##	bits 8-15: disable synchronous negotiation for target [bit-8]

## sun4/300, sun4c, sun4m on-board SCSI, and FSBE/S SBus SCSI cards.
## Both `dma' and `esp' are needed in all cases.
## Two kinds of additional SBus SCSI interfaces are available.  One uses
## "esp at sbus" like the sun4c on-board; the other uses "esp at dma".

## sun4/300 SCSI - an NCR53c94 or equivalent behind
## an LSI Logic DMA controller

dma0	at sbus0 slot ? offset ?			# sun4c/sun4m
esp0	at dma0 flags 0x0000				# sun4m

# FSBE/S SCSI
dma*	at sbus? slot ? offset ?			# SBus
esp*	at sbus? slot ? offset ? flags 0x0000		# SBus (older proms)
esp*	at dma? flags 0x0000				# SBus

scsibus* at esp?

## Qlogic ISP SBus SCSI Card
#isp*	at sbus? slot ? offset ?
#scsibus* at isp?

## NCR5380-based "Sun SCSI 3" VME SCSI controller.
## This driver has several flags which may be enabled by OR'ing
## the values and using the "flags" directive.
## Valid flags are:
##
##	0x01		Use DMA (may be polled)
##	0x02		Use DMA completion interrupts
##	0x04		Allow disconnect/reselect
##
## E.g. the following would enable DMA, interrupts, and reselect:
## si0	at vme0 addr 0x200000 irq 3 vect 0x40 flags 0x07
##
## By default, DMA is enabled in the driver.


## NCR5380-based "SCSI Weird" on-board SCSI interface found
## on sun4/100 systems.  The flags are the same as the "si"
## controller.  Note, while DMA is enabled by default, only
## polled DMA works at this time, and reselects do not work
## on this particular controller.

sw0	at obio0 addr 0x0a000000 level 3
scsibus* at sw?

## These entries find devices on all SCSI busses and assign
## unit numbers dynamically.
sd*	at scsibus? target ? lun ?		# SCSI disks
st*	at scsibus? target ? lun ?		# SCSI tapes
cd*	at scsibus? target ? lun ?		# SCSI CD-ROMs
ch*	at scsibus? target ? lun ?		# SCSI changer devices
ss*	at scsibus? target ? lun ?		# SCSI scanners
uk*	at scsibus? target ? lun ?		# unknown SCSI


## Xylogics 753 or 7053 VME SMD disk controllers and disks, found
## on sun4 systems.
#xdc0	at vme0 addr 0xee80 irq 3 vect 0x44
#xdc1	at vme0 addr 0xee90 irq 3 vect 0x45
#xdc2	at vme0 addr 0xeea0 irq 3 vect 0x46
#xdc3	at vme0 addr 0xeeb0 irq 3 vect 0x47
#xd*	at xdc? drive ?

## Xylogics 451 or 451 VME SMD disk controllers and disks, found
## on sun4 systems.
#xyc0	at vme0 addr 0xee40 irq 3 vect 0x48
#xyc1	at vme0 addr 0xee48 irq 3 vect 0x49
#xy*	at xyc? drive ?


## Floppy controller and drive found on SPARCstations.

## A disk-like interface to files.  Can be used to create floppy, CD,
## miniroot images, etc.

#pseudo-device	vnd	4

## Concatenated and striped disks; with this, you can create a software-based
## disk array similar to a "RAID 0" setup.  See ccd(4).

#pseudo-device	ccd	4

## RAIDframe disk driver: software RAID driver.  See raid(4).

#pseudo-device	raid	4
#options 	RAID_AUTOCONFIG		# auto-configuration of RAID components

## Memory disk device, used on boot floppies with compressed
## kernel-plus-root-disk images.

#pseudo-device	md	1


#### Network interfaces

## LANCE Ethernet - an AMD 7990 LANCE behind specialized DMA glue
## Three flavors of additional SBus ethernets are available.  One attaches
## directly like the sun4c on-board, one uses the ledma device like the
## sun4m on-board, and one uses the lebuffer device.

ledma0		at sbus0 slot ? offset ?		# sun4m on-board
le0		at ledma0				# sun4m on-board
le*		at sbus? slot ? offset ?		# SBus
ledma*		at sbus? slot ? offset ?		# SBus
le*		at ledma?				# SBus
lebuffer0	at sbus? slot ? offset ?		# SBus
le0		at lebuffer?				# SBus
lebuffer*	at sbus? slot ? offset ?		# SBus
le*		at lebuffer?				# SBus


## sun4/100 and sun4/200 Ethernet - an Intel 82586 on-board
## or on a Multibus/VME card.
#ie0	at obio0 addr 0xf6000000 level 6		# sun4/200 on-board
#ie0	at obio0 addr 0x06000000 level 6		# sun4/100 on-board
## VME: the first [addr,len] pair specifies the device registers;
##	the second pair specifies the on-board memory buffer
#ie1	at vme0 addr 0xe88000,0xe00000 len -1,0x40000 irq 3 vect 0x75
#ie2	at vme0 addr 0x31ff02,0x300000 len -1,0x40000 irq 3 vect 0x76
#ie3	at vme0 addr 0x35ff02,0x300000 len -1,0x40000 irq 3 vect 0x77
#ie4	at vme0 addr 0x2dff02,0x200000 len -1,0x40000 irq 3 vect 0x7c

## Quad Ethernet Controller with BigMac (be, 10/100MBd) and Mace Ethernet
## (qe, 10MBd) attached.
#qec*	at sbus? slot ? offset ?		# Quad Ethernet Controller
#be*	at qec?					# BigMac Ethernet (10/100MBd)
#qe*	at qec?					# Mace Ethernet (10MBd)

## Happy Meal Ethernet
#hme*	at sbus? slot ? offset ?

# midway ATM
#en0	at sbus? slot ? offset ?

# MII/PHY support
#exphy*	at mii? phy ?			# 3Com internal PHYs
#icsphy*	at mii? phy ?			# Integrated Circuit Systems ICS1890
#inphy*	at mii? phy ?			# Intel 82555 PHYs
#lxtphy*	at mii? phy ?			# Level One LXT-970 PHYs
#nsphy*	at mii? phy ?			# NS83840 PHYs
>How-To-Repeat:

>Fix:

>Release-Note:
>Audit-Trail:
>Unformatted: