port-mac68k/49480: reproducable panic

[martin%NetBSD.org@localhost]

>Number:         49480
>Category:       port-mac68k
>Synopsis:       reproducable panic
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    port-mac68k-maintainer
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Tue Dec 16 12:20:01 +0000 2014
>Originator:     martin%NetBSD.org@localhost
>Release:        NetBSD 7.99.3
>Organization:
The NetBSD Foundation, Inc.
>Environment:
System: NetBSD mac-beth.duskware.de 7.99.3 NetBSD 7.99.3 (GENERIC) #1: Tue Dec 16 12:00:51 CET 2014 martin%night-owl.duskware.de@localhost:/usr/src/sys/arch/mac68k/compile/GENERIC mac68k
Architecture: m68k
Machine: mac68k
>Description:

I have a reproducable panic on my mac68k when running the libevent tests:

panic: enter: out of address space
cpu0: Begin traceback...
?(?)
db_panic(e049000,1c,ffffffff,26c501c,472ccac) at 0
vpanic(2a309e,472ccb8,472cd00,188ba4,2a309e) + 15e
panic(2a309e,e049000,22,1,0) + c
pmap_enter_ptpage(91df54,e049000,1) + 10e
pmap_enter(91df54,e049000,1118000,3,22,7c01d0) + da
uvm_fault_lower_enter.isra.9(?)
bufinit(472ce08,472ce24,0,7c01d0) + 5a
uvm_fault_internal(8ebca8,e049000,2,0,45b4e08) + cf2
trap(472cf80,8,481,e049ffc) + 590
faultstkadj() + 4


If I adjust the pmap_enter_ptpage function to check it's "can_fail" argument
and make it return ENOMEM (see patch below) it turns into an endless sleep.

The panic happens in the h_event helper, which uses a few threads, when 
extending the stack. The same test seems to work on other mac68k machines
(memory differences? kernel tuning paramaters?) and on amiga.

I think mhitch told me we should extend the '40 pmap and add another
level of indirection, but I am not sure this is the same problem we talked
about last time ;-)

So, any suggestions?

Martin


sleepq_block(0,0,342d7c,8a5000,342ec8,295632,3186a4,84809c,848474) + 16e
mtsleep(342ec8,204,295632,0,342d7c) + 8a                                
uvm_pageout(8a5000) + 8e                
lwp_trampoline() + e    
db> show uvm        
Current UVM status:
  pagesize=4096 (0x1000), pagemask=0xfff, pageshift=12
, ncolors=1  10093 VM pages: 2660 active, 1639 inactive, 1897 wired, 1898 free
  pages  3144 anon, 1427 file, 1699 exec                                      
  freemin=50, free-target=66, wired-max=3364
  cpu0:                                     
    faults=195892, traps=218360, intrs=333294, ctxswitch=6258957
    softint=71075, syscalls=810880                              
  fault counts:                   
    noram=0, noanon=0, pgwait=0, pgrele=0
    ok relocks(total)=1138(1138), anget(retrys)=3133103(8), amapcopy=26402
    neighbor anon/obj pg=40596/355739, gets(lock/unlock)=102953/1130      
    cases: anon=3114135, anoncow=18924, obj=82671, prcopy=20282, przero=42280
  daemon and swap counts:                                                    
    woke=3083144, revs=4, scans=2316, obscans=410, anscans=239
    busy=0, freed=649, reactivate=0, deactivate=4431          
    pageouts=16, pending=224, nswget=9              
    nswapdev=1, swpgavail=32767       
    swpages=32767, swpginuse=240, swpgonly=231, paging=0



Index: pmap_motorola.c
===================================================================
RCS file: /cvsroot/src/sys/arch/m68k/m68k/pmap_motorola.c,v
retrieving revision 1.67
diff -u -r1.67 pmap_motorola.c
--- pmap_motorola.c	25 Oct 2013 20:51:14 -0000	1.67
+++ pmap_motorola.c	16 Dec 2014 10:59:56 -0000
@@ -2471,8 +2471,11 @@
 			void *addr;
 
 			ix = bmtol2(pmap->pm_stfree);
-			if (ix == -1)
+			if (ix == -1) {
+				if (can_fail)
+					return ENOMEM;
 				panic("enter: out of address space"); /* XXX */
+			}
 			pmap->pm_stfree &= ~l2tobm(ix);
 			addr = (void *)&pmap->pm_stab[ix*SG4_LEV2SIZE];
 			memset(addr, 0, SG4_LEV2SIZE*sizeof(st_entry_t));


>How-To-Repeat:

cd /usr/tests/lib/libevent
atf-run | atf-report

>Fix:
n/a