From owner-freebsd-sparc64@FreeBSD.ORG Tue Nov 30 20:15:06 2004 Return-Path: Delivered-To: freebsd-sparc64@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id D3BE116A4D0 for ; Tue, 30 Nov 2004 20:15:06 +0000 (GMT) Received: from mail6.speakeasy.net (mail6.speakeasy.net [216.254.0.206]) by mx1.FreeBSD.org (Postfix) with ESMTP id 6C5DB43D5D for ; Tue, 30 Nov 2004 20:15:06 +0000 (GMT) (envelope-from jhb@FreeBSD.org) Received: (qmail 13535 invoked from network); 30 Nov 2004 20:15:06 -0000 Received: from dsl027-160-063.atl1.dsl.speakeasy.net (HELO server.baldwin.cx) ([216.27.160.63]) (envelope-sender ) encrypted SMTP for ; 30 Nov 2004 20:11:11 -0000 Received: from qa4379.itdev.weather.com (gw1.twc.weather.com [216.133.140.1]) (authenticated bits=0) by server.baldwin.cx (8.12.11/8.12.11) with ESMTP id iAUKAW0C089425; Tue, 30 Nov 2004 15:10:56 -0500 (EST) (envelope-from jhb@FreeBSD.org) From: John Baldwin To: freebsd-sparc64@FreeBSD.org Date: Tue, 30 Nov 2004 14:10:46 -0500 User-Agent: KMail/1.6.2 References: <200411301035.12035.jhb@FreeBSD.org> In-Reply-To: <200411301035.12035.jhb@FreeBSD.org> MIME-Version: 1.0 Content-Disposition: inline Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit Message-Id: <200411301410.46329.jhb@FreeBSD.org> X-Spam-Checker-Version: SpamAssassin 2.63 (2004-01-11) on server.baldwin.cx cc: Poul-Henning Kamp cc: sparc64@FreeBSD.org Subject: Re: Duplicate mbuf free panic in hme(4) X-BeenThere: freebsd-sparc64@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Porting FreeBSD to the Sparc List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 30 Nov 2004 20:15:07 -0000 On Tuesday 30 November 2004 10:35 am, John Baldwin wrote: > I got the following panic on my ultra60 while the box was idle over the > holidays: > > Nov 26 00:20:25 amd[293]: reload of map /etc/amd.map is not needed (in > sync) Nov 26 01:24:26 amd[293]: reload of map /etc/amd.map is not needed > (in sync) Nov 26 02:28:26 amd[293]: reload of map /etc/amd.map is not > needed (in sync) Nov 26 03:32:26 amd[293]: reload of map /etc/amd.map is > not needed (in sync) Slab at 0xfffff80085467ed8, freei 2 = 0. > panic: Duplicate free of item 0xfffff80085466200 from zone > 0xfffff80027ffd5c0 (Mbuf) > > cpuid = 0 > KDB: enter: panic > [thread 100039] > Stopped at kdb_enter+0x38: ta %xcc, 1 > db> tr > panic() at panic+0x19c > uma_dbg_free() at uma_dbg_free+0x138 > uma_zfree_arg() at uma_zfree_arg+0x1a4 > m_freem() at m_freem+0x4c > hme_intr() at hme_intr+0x2d0 > psycho_intr_stub() at psycho_intr_stub+0x8 > ithread_loop() at ithread_loop+0x218 > fork_exit() at fork_exit+0x9c > fork_trampoline() at fork_trampoline+0x8 > db> > > Perhaps this can also explain the memory used after free panics that myself > and others see on our sparcs under load? Slightly more info: (gdb) l *hme_intr+0x2d0 0xc00bb4d0 is in hme_intr (../../../dev/hme/if_hme.c:1206). 1201 bus_dmamap_sync(sc->sc_tdmatag, htx->htx_dmamap, 1202 BUS_DMASYNC_POSTWRITE); 1203 bus_dmamap_unload(sc->sc_tdmatag, htx->htx_dmamap); 1204 1205 ifp->if_opackets++; 1206 m_freem(htx->htx_m); 1207 htx->htx_m = NULL; 1208 STAILQ_REMOVE_HEAD(&sc->sc_rb.rb_txbusyq, htx_q); 1209 STAILQ_INSERT_TAIL(&sc->sc_rb.rb_txfreeq, htx, htx_q); 1210 htx = STAILQ_FIRST(&sc->sc_rb.rb_txbusyq); > ident /sys/dev/hme/if_hme.c /sys/dev/hme/if_hme.c: $FreeBSD: src/sys/dev/hme/if_hme.c,v 1.32 2004/11/22 06:46:30 yongari Exp$ -- John Baldwin <>< http://www.FreeBSD.org/~jhb/ "Power Users Use the Power to Serve" = http://www.FreeBSD.org