Re: kern/38956 (rb tree corruption?)

[Izumi Tsutsui <tsutsui%ceres.dti.ne.jp@localhost>]

> please try the latest source.

mac68k gets the similar hangup during ls(1).
---

[send break during hang]

db> tr
cpu_Debugger(8,10bff000,159be0,96700c,967000) + 6
zstty_stint(96700c,0) + 146
zsc_intr_hard(967000,6cd40,700d50,4944d0c,231cd0) + 106
zshard(967000,4944d34,356a,70,1) + 12
intr_dispatch(70) + 3a
intrhand(?)
rb_tree_iterate(2d38a0,700d50,1,6cd40,10bff000) + a
rb_tree_remove_node(2d38a0,700d50,6cd40,10bff000,1e05000) + ce
uvm_pagefree(700d50,ffffc000,ffffd000,ffffd000,0) + aa
pmap_remove_mapping(3e79f54,ffffc000,10bffff0,0) + 360
pmap_do_remove(3e79f54,ffff0000,ffffd000,1) + 10c
pmap_remove(3e79f54,ffff0000,ffffd000) + 14
uvm_unmap_remove(3e78d00,0,ffffd000,4944e6c,0) + 208
uvmspace_free(3e78d00) + a4
uvm_proc_exit(3e73a80) + 54
exit1(3e70c20,0,2952d8,ffffbe04,4944f80) + 152
sys_exit(3e70c20,4944f38,4944f78) + 42
syscall_plain(1,3e70c20,4944fb4,2,10) + bc
syscall(1) + 60
trap0() + e
db> 
---

news68k gets panic before init(8) invoked:
(uvm_kernel_object seems corrupted after uvm_pagelookup()
 in m68k/pmap_motorola.c:pmap_ptpage_addref(), and
 hp300 and x68k had the same problem)
---
NetBSD 4.99.65 (GENERIC) #46: Wed Jun 18 00:58:56 JST 2008
        tsutsui@mirage:/usr/src/sys/arch/news68k/compile/GENERIC
SONY NET WORK STATION, Model NWS-1750, Machine ID #10557
total memory = 16368 KB
avail memory = 12336 KB
mainbus0 (root)

 :

boot device: sd0
root on sd0a dumps on sd0b
root file system type: ffs
trap: bad kernel read/write access at 0x34
trap type 8, code = 0x802072d, v = 0x34
kernel program counter = 0x1da7a4
kernel: MMU fault trap
pid = 1, lid = 1, pc = 001DA7A4, ps = 2000, sfc = 1, dfc = 1

 : [register and kernel stack dump]

panic: MMU fault
Stopped in pid 1.1 (init) at    netbsd:cpu_Debugger+0x6:        unlk    a6
db> tr
cpu_Debugger(8022010,8,2ad7e00,33bcb00,33bcb68) + 6
panic(22e0fa,103ff000,e25000,22,0) + 172
trap(33bcb80,8,802072d,34) + 22e
pmap_ptpage_addref(103ff000) + 34
pmap_enter(2addf9c,ffeff000,e25000,7,22) + 9c
uvm_fault_internal(2adcea0,ffeff000,2,0) + 74a
trap(33bcde4,8,4010711,ffeffff5) + 3a2
copyout(2ad42a0) + 70
lwp_trampoline() + e
db> 

---
Izumi Tsutsui