From owner-freebsd-virtualization@FreeBSD.ORG Mon Jul 22 06:38:59 2013 Return-Path: Delivered-To: freebsd-virtualization@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) by hub.freebsd.org (Postfix) with ESMTP id 0EE4E9C1; Mon, 22 Jul 2013 06:38:59 +0000 (UTC) (envelope-from adrian.chadd@gmail.com) Received: from mail-we0-x232.google.com (mail-we0-x232.google.com [IPv6:2a00:1450:400c:c03::232]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by mx1.freebsd.org (Postfix) with ESMTPS id 44407243A; Mon, 22 Jul 2013 06:38:58 +0000 (UTC) Received: by mail-we0-f178.google.com with SMTP id u57so1126143wes.37 for ; Sun, 21 Jul 2013 23:38:56 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:sender:in-reply-to:references:date :x-google-sender-auth:message-id:subject:from:to:cc:content-type; bh=7E4zLFltRebQSfMPTjoml4w9s3pN4SpPu5xymdj34Qs=; b=oAAInPUeP3OPwFlO9jxwbR2xxvtkZtNOEQFHZk19/mImLN6CIOLNg2K/1hzvz/IhDI DPUyz1THZ1cLu8m8Lm6AMMb+uHA8CSzGDwfGZd7XXs6OnMHl/OcJRRQmSe9TVwLxY8rL a3cbZjPa+W3X3I4pg2eVfTqbjUBXTmE/De8V4AzpVTJBQ2JRCkFM17k7e0lH1feMnW4D E8L9Qx2EYkP5yubKC9SsMNhWrjrty/Qs6ndCob4zFaGuFIQNMUUwI8mjd1TbIlmwJl+7 6vRPxlRWB3akk6hTQzj2GScwf7ml1GJ/vP2Qq4y7a06N8IL5Q8XPzZj5Crlun5KccSyg sWHQ== MIME-Version: 1.0 X-Received: by 10.180.14.105 with SMTP id o9mr22493980wic.30.1374475136458; Sun, 21 Jul 2013 23:38:56 -0700 (PDT) Sender: adrian.chadd@gmail.com Received: by 10.217.94.132 with HTTP; Sun, 21 Jul 2013 23:38:56 -0700 (PDT) In-Reply-To: References: Date: Sun, 21 Jul 2013 23:38:56 -0700 X-Google-Sender-Auth: 7hLqRJwskX0ETfzYi7S_vbSqDIk Message-ID: Subject: Re: VIMAGE + PF crash in mbuf destructor From: Adrian Chadd To: Craig Rodrigues Content-Type: text/plain; charset=ISO-8859-1 Cc: "freebsd-virtualization@freebsd.org" , freebsd-pf@freebsd.org X-BeenThere: freebsd-virtualization@freebsd.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: "Discussion of various virtualization techniques FreeBSD supports." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 22 Jul 2013 06:38:59 -0000 hm. There's lots of mbuf free calls in the net80211 TX and RX path; do we have to have to set the vnet context during the whole tx/rx path? -adrian On 21 July 2013 23:32, Craig Rodrigues wrote: > Hi, > > I used a kernel config with the following lines: > > include GENERIC > options VIMAGE > > and compiled a CURRENT kernel from svn://svn.freebsd.org/base/head@253346 . > > I also have PF enabled on my system. > > Once in a while I have been getting kernel panics like these: > > > ==================================================================== > (kgdb) #0 doadump (textdump=1) at pcpu.h:236 > #1 0xffffffff808bc617 in kern_reboot (howto=260) > at /usr/home/rodrigc/freebsd/head/sys/kern/kern_shutdown.c:447 > #2 0xffffffff808bcb25 in vpanic (fmt=, > ap=) > at /usr/home/rodrigc/freebsd/head/sys/kern/kern_shutdown.c:754 > #3 0xffffffff808bcb73 in panic (fmt=) > at /usr/home/rodrigc/freebsd/head/sys/kern/kern_shutdown.c:683 > #4 0xffffffff8033dff7 in db_panic (addr=, > have_addr=, count=, > modif=) > at /usr/home/rodrigc/freebsd/head/sys/ddb/db_command.c:482 > #5 0xffffffff8033dbcd in db_command (cmd_table=) > at /usr/home/rodrigc/freebsd/head/sys/ddb/db_command.c:449 > #6 0xffffffff8033d944 in db_command_loop () > at /usr/home/rodrigc/freebsd/head/sys/ddb/db_command.c:502 > #7 0xffffffff803402f0 in db_trap (type=, code=0) > at /usr/home/rodrigc/freebsd/head/sys/ddb/db_main.c:231 > #8 0xffffffff808f3623 in kdb_trap (type=12, code=0, tf= out>) > at /usr/home/rodrigc/freebsd/head/sys/kern/subr_kdb.c:654 > #9 0xffffffff80cda43a in trap_fatal (frame=0xffffff811dbab6b0, > eva=) > at /usr/home/rodrigc/freebsd/head/sys/amd64/amd64/trap.c:868 > #10 0xffffffff80cda6f4 in trap_pfault (frame=0x0, usermode=0) > at /usr/home/rodrigc/freebsd/head/sys/amd64/amd64/trap.c:699 > #11 0xffffffff80cd9ef0 in trap (frame=0xffffff811dbab6b0) > at /usr/home/rodrigc/freebsd/head/sys/amd64/amd64/trap.c:463 > #12 0xffffffff80cc31a2 in calltrap () > at /usr/home/rodrigc/freebsd/head/sys/amd64/amd64/exception.S:232 > #13 0xffffffff8208f7b7 in pf_mtag_free (t=0xfffffe00a8797870) > at > /usr/home/rodrigc/freebsd/head/sys/modules/pf/../../netpfil/pf/pf.c:830 > #14 0xffffffff808a51c9 in mb_dtor_mbuf (mem=0xfffffe000d0bc500, size=256, > arg=0x0) at /usr/home/rodrigc/freebsd/head/sys/kern/kern_mbuf.c:499 > #15 0xffffffff80b55d4d in uma_zfree_arg (zone=0xfffffe000b4ab900, > item=0xfffffe000d0bc500, udata=0x0) > at /usr/home/rodrigc/freebsd/head/sys/vm/uma_core.c:2560 > #16 0xffffffff8092d1f5 in m_freem (mb=) at uma.h:364 > #17 0xffffffff8058ba72 in iwn_tx_done (sc=0xffffff8000974000, > desc=, ackfailcnt=16, status=131 '\203') > at /usr/home/rodrigc/freebsd/head/sys/dev/iwn/if_iwn.c:2817 > #18 0xffffffff80583e60 in iwn_notif_intr (sc=0xffffff8000974000) > at /usr/home/rodrigc/freebsd/head/sys/dev/iwn/if_iwn.c:3015 > #19 0xffffffff80583684 in iwn_intr (arg=0xffffff8000974000) > at /usr/home/rodrigc/freebsd/head/sys/dev/iwn/if_iwn.c:3306 > #20 0xffffffff8088daf3 in intr_event_execute_handlers ( > p=, ie=0xfffffe000b696600) > at /usr/home/rodrigc/freebsd/head/sys/kern/kern_intr.c:1263 > #21 0xffffffff8088e4c6 in ithread_loop (arg=0xfffffe000b31b040) > at /usr/home/rodrigc/freebsd/head/sys/kern/kern_intr.c:1276 > #22 0xffffffff8088b3f4 in fork_exit ( > callout=0xffffffff8088e420 , arg=0xfffffe000b31b040, > frame=0xffffff811dbabac0) > at /usr/home/rodrigc/freebsd/head/sys/kern/kern_fork.c:991 > #23 0xffffffff80cc36de in fork_trampoline () > at /usr/home/rodrigc/freebsd/head/sys/amd64/amd64/exception.S:606 > #24 0x0000000000000000 in ?? () > Current language: auto; currently minimal > (kgdb) > ==================================================================== > > > It turns out that in this file: src/sys/netpfil/pf/pf.c > > 826 static void > 827 pf_mtag_free(struct m_tag *t) > 828 { > 829 > 830 uma_zfree(V_pf_mtag_z, t); > 831 } > > when line 830 is hit, it turns out that curthread->td_vnet is NULL. > > Does anyone have an idea as to the best place > to put CURVNET_SET() to avoid this problem? > > I am a little less famiiar with mbuf and pf. > > Thanks. > -- > Craig > >