From owner-freebsd-current@FreeBSD.ORG  Wed Nov 27 19:35:27 2013
Return-Path: <owner-freebsd-current@FreeBSD.ORG>
Delivered-To: freebsd-current@FreeBSD.org
Received: from mx1.freebsd.org (mx1.freebsd.org
 [IPv6:2001:1900:2254:206a::19:1])
 (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits))
 (No client certificate requested)
 by hub.freebsd.org (Postfix) with ESMTPS id 1569A98D
 for <freebsd-current@FreeBSD.org>; Wed, 27 Nov 2013 19:35:27 +0000 (UTC)
Received: from gw.catspoiler.org (gw.catspoiler.org [75.1.14.242])
 (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
 (No client certificate requested)
 by mx1.freebsd.org (Postfix) with ESMTPS id EC87B2382
 for <freebsd-current@FreeBSD.org>; Wed, 27 Nov 2013 19:35:26 +0000 (UTC)
Received: from catspoiler.org (mousie.catspoiler.org [192.168.101.2])
 by gw.catspoiler.org (8.13.3/8.13.3) with ESMTP id rARJZJfC042361;
 Wed, 27 Nov 2013 11:35:23 -0800 (PST)
 (envelope-from spamvictim@catspoiler.org)
Message-Id: <201311271935.rARJZJfC042361@gw.catspoiler.org>
Date: Wed, 27 Nov 2013 11:35:19 -0800 (PST)
From: Don Lewis <spamvictim@catspoiler.org>
Subject: Re: panic: double fault with 11.0-CURRENT r258504
To: kostikbel@gmail.com
In-Reply-To: <20131127192008.GD59496@kib.kiev.ua>
MIME-Version: 1.0
Content-Type: TEXT/plain; charset=us-ascii
X-Mailman-Approved-At: Wed, 27 Nov 2013 20:24:47 +0000
Cc: freebsd-current@FreeBSD.org
X-BeenThere: freebsd-current@freebsd.org
X-Mailman-Version: 2.1.16
Precedence: list
List-Id: Discussions about the use of FreeBSD-current
 <freebsd-current.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/options/freebsd-current>, 
 <mailto:freebsd-current-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-current/>
List-Post: <mailto:freebsd-current@freebsd.org>
List-Help: <mailto:freebsd-current-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-current>,
 <mailto:freebsd-current-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Wed, 27 Nov 2013 19:35:27 -0000

On 27 Nov, Konstantin Belousov wrote:
> On Wed, Nov 27, 2013 at 11:02:57AM -0800, Don Lewis wrote:
>> On 27 Nov, Konstantin Belousov wrote:
>> > On Wed, Nov 27, 2013 at 10:33:30AM -0800, Don Lewis wrote:
>> >> On 27 Nov, Konstantin Belousov wrote:
>> >> > On Wed, Nov 27, 2013 at 09:41:36AM -0800, Don Lewis wrote:
>> >> >> On 27 Nov, Konstantin Belousov wrote:
>> >> >> > On Wed, Nov 27, 2013 at 02:49:12AM -0800, Don Lewis wrote:
>> >> >> >> <http://people.freebsd.org/~truckman/doublefault2.JPG>
>> >> >> > 
>> >> >> > What is the instruction at cpu_switch+0x9b ?
>> >> >> 
>> >> >> movl 0x8(%edx),%eax
>> >> > So it is line 176 in swtch.s. Is machine still in ddb, or did you
>> >> > obtained the core ? If yes, please print out the content of words at
>> >> > 0xe4f62bb0 + 4, +8 (*), +16. Please print the content of the word at
>> >> > address (*) + 8.
>> >> 
>> >> It is still in ddb.
>> >> 
>> >> <http://people.freebsd.org/~truckman/doublefault3.JPG>, though not in
>> >> the above order.
>> > Uhm, sorry, I mistyped the last part of the instructions.
>> > 
>> > The new thread pointer is 0xd2f4e000, there is nothing incriminating.
>> > Please print the word at 0xd2f4e000+0x254 == 0xd2f4e254, which would be
>> > the address of the new thread pcb. It is load from the pcb + 8 which
>> > faults.
>> 
>> 0xf3d44d60
> Again, the pointer looks fine, and its tail is 0xd60, which is correct for
> the pcb offset in the last page of the thread stack.
> 
> Please do 'show thread 0xd2f4e000' before trying below instructions.

Ok, see below:
 
> What happens if you try to read word at 0xf3d44d68 ?

Nothing bad ...

<http://people.freebsd.org/~truckman/doublefault4.JPG>