From owner-freebsd-stable@FreeBSD.ORG  Fri Jan 18 11:58:23 2013
Return-Path: <owner-freebsd-stable@FreeBSD.ORG>
Delivered-To: stable@FreeBSD.org
Received: from mx1.freebsd.org (mx1.freebsd.org
 [IPv6:2001:1900:2254:206a::19:1])
 by hub.freebsd.org (Postfix) with ESMTP id EE5B02C5
 for <stable@FreeBSD.org>; Fri, 18 Jan 2013 11:58:23 +0000 (UTC)
 (envelope-from avg@FreeBSD.org)
Received: from citadel.icyb.net.ua (citadel.icyb.net.ua [212.40.38.140])
 by mx1.freebsd.org (Postfix) with ESMTP id 4650D187
 for <stable@FreeBSD.org>; Fri, 18 Jan 2013 11:58:23 +0000 (UTC)
Received: from porto.starpoint.kiev.ua (porto-e.starpoint.kiev.ua
 [212.40.38.100])
 by citadel.icyb.net.ua (8.8.8p3/ICyb-2.3exp) with ESMTP id NAA20863;
 Fri, 18 Jan 2013 13:58:13 +0200 (EET) (envelope-from avg@FreeBSD.org)
Received: from localhost ([127.0.0.1])
 by porto.starpoint.kiev.ua with esmtp (Exim 4.34 (FreeBSD))
 id 1TwAaK-0001aD-IH; Fri, 18 Jan 2013 13:58:12 +0200
Message-ID: <50F938D2.80304@FreeBSD.org>
Date: Fri, 18 Jan 2013 13:58:10 +0200
From: Andriy Gapon <avg@FreeBSD.org>
User-Agent: Mozilla/5.0 (X11; FreeBSD amd64;
 rv:17.0) Gecko/17.0 Thunderbird/17.0
MIME-Version: 1.0
To: Po-Li Soong <polis@spectralogic.com>
Subject: Re: zio_done panic on unadulterated FreeBSD Release 9.1
References: <0C4D65F6A0FC9E4B95EA114508C7E0FE5F66DDB6@reactor.sldomain.com>
 <20130109234924.GM2561@kib.kiev.ua>
 <0C4D65F6A0FC9E4B95EA114508C7E0FE5F66E4F3@reactor.sldomain.com>
In-Reply-To: <0C4D65F6A0FC9E4B95EA114508C7E0FE5F66E4F3@reactor.sldomain.com>
X-Enigmail-Version: 1.4.6
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Cc: Konstantin Belousov <kostikbel@gmail.com>,
 "stable@FreeBSD.org" <stable@FreeBSD.org>
X-BeenThere: freebsd-stable@freebsd.org
X-Mailman-Version: 2.1.14
Precedence: list
List-Id: Production branch of FreeBSD source code <freebsd-stable.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/options/freebsd-stable>,
 <mailto:freebsd-stable-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-stable>
List-Post: <mailto:freebsd-stable@freebsd.org>
List-Help: <mailto:freebsd-stable-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-stable>,
 <mailto:freebsd-stable-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Fri, 18 Jan 2013 11:58:24 -0000

on 11/01/2013 17:09 Po-Li Soong said the following:
> (kgdb) p/x *(struct vm_object *)0xffffffff81281580
[snip]
> 
> (kgdb)  p/x *(struct vm_page *)0xfffffe00cd733ab0
> $2 = {pageq = {tqe_next = 0x0, tqe_prev = 0xfffffe00c7e7d678}, listq = {
>     tqe_next = 0xfffffe00cd733b28, tqe_prev = 0xfffffe00cd7331d8},
>   left = 0xfffffe00c9b31c38, right = 0xfffffe00cd735c70,
>   object = 0xfffffffb81281580

So, the correct object pointer is 0xffffffff81281580, but vm_page has object =
0xfffffffb81281580.

0xffffffff81281580
0xfffffffb81281580
One bit flip (0x400000000).

Either there is some HW issue or we've got some code that arbitrarily flips bits
in vm_page_array (and perhaps beyond it).

-- 
Andriy Gapon