10.0 BETA 3 with redports kernel panic

[Sean Bruno]

On Tue, 2013-12-17 at 05:04 -0800, Sean Bruno wrote:
> On Tue, 2013-12-17 at 14:00 +0200, Konstantin Belousov wrote:
> > On Mon, Dec 16, 2013 at 10:45:58AM -0800, Sean Bruno wrote:
> > > On Mon, 2013-12-16 at 10:04 -0800, Sean Bruno wrote:
> > > > > What is the source line for memrw+0x195 ?
> > > > 
> > > > My apologies for the delay on this.  Its been frustrating getting a
> > > > crashdump on these machines due to their very large tmpfs usage.
> > > > Currently, I am dumping a crash of 13+GB to a third HD that we had
> > > > installed for this purpose.
> > > > 
> > > > The machines are still running RC3 of 10.0r.
> > > > 
> > > > I will attempt to get the requested information shortly.
> > > > 
> > > > sean
> > > > 
> > > > 
> > > 
> > > I've updated http://people.freebsd.org/~sbruno/redbuild_panic.txt
> > > 
> > > It looks like its dying in uiomove() ?
> > 
> > I believe I already posted the following patch, with no feedback.
> > 
> > diff --git a/sys/amd64/amd64/mem.c b/sys/amd64/amd64/mem.c
> > index abbbb21..e371499 100644
> > --- a/sys/amd64/amd64/mem.c
> > +++ b/sys/amd64/amd64/mem.c
> > @@ -98,7 +98,11 @@ memrw(struct cdev *dev, struct uio *uio, int flags)
> >  kmemphys:
> >  			o = v & PAGE_MASK;
> >  			c = min(uio->uio_resid, (u_int)(PAGE_SIZE - o));
> > -			error = uiomove((void *)PHYS_TO_DMAP(v), (int)c, uio);
> > +			v = PHYS_TO_DMAP(v);
> > +			if (v < DMAP_MIN_ADDRESS || v >= DMAP_MAX_ADDRESS ||
> > +			    pmap_kextract(v) == 0)
> > +				return (EFAULT);
> > +			error = uiomove((void *)v, (int)c, uio);
> >  			continue;
> >  		}
> >  		else if (dev2unit(dev) == CDEV_MINOR_KMEM) {
> 
> Will begin testing immediately
> 
> sean


Huh ... both machines panic'd this morning.  It'll take 30 minutes or so
to get a crash dump, but it looks like its still in the same place.  

db> whe
Tracing pid 489 tid 101801 td 0xfffff80322946490
kdb_enter() at kdb_enter+0x3e/frame 0xfffffe1839d26220
panic() at panic+0x175/frame 0xfffffe1839d262a0
vm_fault_hold() at vm_fault_hold+0x14ed/frame 0xfffffe1839d26500
vm_fault() at vm_fault+0x77/frame 0xfffffe1839d26540
trap_pfault() at trap_pfault+0x19b/frame 0xfffffe1839d265f0
trap() at trap+0x5e6/frame 0xfffffe1839d26810
calltrap() at calltrap+0x8/frame 0xfffffe1839d26810
--- trap 0xc, rip = 0xffffffff80cae47b, rsp = 0xfffffe1839d268d0, rbp =
0xfffffe1839d26920 ---
copyout() at copyout+0x3b/frame 0xfffffe1839d26920
memrw() at memrw+0x1b6/frame 0xfffffe1839d26960
giant_read() at giant_read+0x7a/frame 0xfffffe1839d269a0
devfs_read_f() at devfs_read_f+0xea/frame 0xfffffe1839d26a00
dofileread() at dofileread+0x7b/frame 0xfffffe1839d26a40
kern_readv() at kern_readv+0x65/frame 0xfffffe1839d26a90
sys_read() at sys_read+0x63/frame 0xfffffe1839d26ae0
amd64_syscall() at amd64_syscall+0x357/frame 0xfffffe1839d26bf0
Xfast_syscall() at Xfast_syscall+0xfb/frame 0xfffffe1839d26bf0
--- syscall (3, FreeBSD ELF64, sys_read), rip = 0x800b750aa, rsp =
0x7fffffffd068, rbp = 0x7fffffffd0b0 ---
db> call doadump