From owner-freebsd-current@FreeBSD.ORG  Tue Jul 21 13:43:56 2009
Return-Path: <owner-freebsd-current@FreeBSD.ORG>
Delivered-To: freebsd-current@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id A5396106564A;
	Tue, 21 Jul 2009 13:43:56 +0000 (UTC) (envelope-from jhb@freebsd.org)
Received: from cyrus.watson.org (cyrus.watson.org [65.122.17.42])
	by mx1.freebsd.org (Postfix) with ESMTP id 769658FC13;
	Tue, 21 Jul 2009 13:43:56 +0000 (UTC) (envelope-from jhb@freebsd.org)
Received: from bigwig.baldwin.cx (66.111.2.69.static.nyinternet.net
	[66.111.2.69])
	by cyrus.watson.org (Postfix) with ESMTPSA id 2D0F646B53;
	Tue, 21 Jul 2009 09:43:56 -0400 (EDT)
Received: from jhbbsd.hudson-trading.com (unknown [209.249.190.8])
	by bigwig.baldwin.cx (Postfix) with ESMTPA id 410B08A0A1;
	Tue, 21 Jul 2009 09:43:55 -0400 (EDT)
From: John Baldwin <jhb@freebsd.org>
To: freebsd-current@freebsd.org
Date: Tue, 21 Jul 2009 08:57:01 -0400
User-Agent: KMail/1.9.7
References: <4A659F98.2060007@haruhiism.net>
In-Reply-To: <4A659F98.2060007@haruhiism.net>
MIME-Version: 1.0
Content-Type: text/plain;
  charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
Message-Id: <200907210857.01690.jhb@freebsd.org>
X-Greylist: Sender succeeded SMTP AUTH, not delayed by milter-greylist-4.0.1
	(bigwig.baldwin.cx); Tue, 21 Jul 2009 09:43:55 -0400 (EDT)
X-Virus-Scanned: clamav-milter 0.95.1 at bigwig.baldwin.cx
X-Virus-Status: Clean
X-Spam-Status: No, score=-2.5 required=4.2 tests=AWL,BAYES_00,RDNS_NONE
	autolearn=no version=3.2.5
X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on bigwig.baldwin.cx
Cc: Lawrence Stewart <lstewart@freebsd.org>
Subject: Re: [follow-up] Fatal trap 12 in r195146+ in netisr_queue_internal
X-BeenThere: freebsd-current@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: Discussions about the use of FreeBSD-current
	<freebsd-current.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-current>, 
	<mailto:freebsd-current-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-current>
List-Post: <mailto:freebsd-current@freebsd.org>
List-Help: <mailto:freebsd-current-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-current>,
	<mailto:freebsd-current-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Tue, 21 Jul 2009 13:43:57 -0000

On Tuesday 21 July 2009 6:59:36 am Kamigishi Rei wrote:
> Hello, hope you're having a good day,
> 
> I've been researching the issue I mentioned in my last message in 
> "r194546 amd64: kernel panic in tcp_sack.c" thread since July 07 and 
> here are some of the findings:
> The fatal trap triggers inside mtx_lock_sleep() during a dereference of 
> a pointer (owner, points to struct thread @ m->mtx_lock & 
> ~MTX_FLAGMASK). The code goes like this (shortened):
> 
> v = m->mtx_lock;
> if (v == MTX_UNOWNED) { turnstile_cancel(ts); continue; }
> owner = (struct thread *)(v & ~MTX_FLAGMASK);
> if (TD_IS_RUNNING(owner)) { turnstile_cancel(ts); continue; }
> 
> Everything goes fine until - under heavy load on an interface, usually - 
> we reach a point where:
> 
> 1. m->mtx_lock is 4 (== MTX_UNOWNED).
> 2. v is assigned mtx_lock's value (4 == MTX_UNOWNED).
> 3. condition (v == MTX_UNOWNED) fails.

This will not happen.  If you look at the disassembly you will see this can't 
happen either.  Do you have a crashdump from a crash?

-- 
John Baldwin