NetBSD Problem Report #36019

From tsutsui@ceres.dti.ne.jp  Fri Mar 16 19:40:04 2007
Return-Path: <tsutsui@ceres.dti.ne.jp>
Received: from mail.netbsd.org (mail.netbsd.org [204.152.190.11])
	by narn.NetBSD.org (Postfix) with ESMTP id DBD3763B8C3
	for <gnats-bugs@gnats.NetBSD.org>; Fri, 16 Mar 2007 19:40:03 +0000 (UTC)
Message-Id: <200703161940.l2GJe1Ph021656@mirage.ceres.dti.ne.jp>
Date: Sat, 17 Mar 2007 04:40:01 +0900 (JST)
From: tsutsui@ceres.dti.ne.jp
Reply-To: tsutsui@ceres.dti.ne.jp
To: gnats-bugs@NetBSD.org
Cc: tsutsui@ceres.dti.ne.jp
Subject: uvm_readahead.c:ra_startio() assumes (MAXPHYS & (MAXPHYS - 1)) == 0
X-Send-Pr-Version: 3.95

>Number:         36019
>Category:       kern
>Synopsis:       uvm_readahead.c:ra_startio() assumes (MAXPHYS & (MAXPHYS - 1)) == 0
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    yamt
>State:          analyzed
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Fri Mar 16 19:45:00 +0000 2007
>Closed-Date:    
>Last-Modified:  Tue Feb 05 05:19:04 +0000 2008
>Originator:     Izumi Tsutsui
>Release:        NetBSD 4.99.15
>Organization:
>Environment:
System: NetBSD mirage 4.99.15
Architecture: m68000
Machine: sun2
maybe sun3 is also affected and
4.0_BETA2 has the same problem

>Description:
There is the following KASSERT() in sys/uvm/uvm_readahead.c:ra_startoi():
---
#define	RA_IOCHUNK	MAXPHYS			/* read-ahead i/o chunk size */
 :
		const size_t chunksize = RA_IOCHUNK;
 :
		KASSERT((chunksize & (chunksize - 1)) == 0);
		KASSERT((off & PAGE_MASK) == 0);
		bytelen = ((off + chunksize) & -(off_t)chunksize) - off;
		KASSERT((bytelen & PAGE_MASK) == 0);
		npages = orignpages = bytelen >> PAGE_SHIFT;
---
but (MAXPHYS & (MAXPHYS - 1)) could be != 0 on some ports
so "KASSERT((chunksize & (chunksize - 1)) == 0)" can fail.

On sun2 (and sun3), MAXPHYS is 0xe000.
This will cause a panic "genfs_getpages: too many pages" later
on a kernel without DIAGNOSTIC due to wrong bytelen and npages.

>How-To-Repeat:
Boot sun2 GENERIC kernel (on TME) and copy a file into filesystem.

>Fix:
Choose proper RA_IOCHUNK in any case?

>Release-Note:

>Audit-Trail:

Responsible-Changed-From-To: kern-bug-people->yamt
Responsible-Changed-By: yamt@netbsd.org
Responsible-Changed-When: Sat, 24 Mar 2007 13:16:17 +0000
Responsible-Changed-Why:
mine.


From: Izumi Tsutsui <tsutsui@ceres.dti.ne.jp>
To: gnats-bugs@NetBSD.org
Cc: yamt@NetBSD.org, kern-bug-people@NetBSD.org,
	netbsd-bugs@NetBSD.org, gnats-admin@NetBSD.org, yamt@NetBSD.org,
	tsutsui@ceres.dti.ne.jp
Subject: Re: kern/36019 (uvm_readahead.c:ra_startio() assumes (MAXPHYS & (MAXPHYS
	 - 1)) == 0)
Date: Thu, 10 May 2007 08:34:16 +0900

 yamt@NetBSD.org wrote:

 > Synopsis: uvm_readahead.c:ra_startio() assumes (MAXPHYS & (MAXPHYS - 1)) == 0
  :
 > Responsible-Changed-Why:
 > mine.

 Is it okay to commit this as temporary workaround (for 4.0)?
 ---
 Index: uvm_readahead.c
 ===================================================================
 RCS file: /cvsroot/src/sys/uvm/uvm_readahead.c,v
 retrieving revision 1.3
 diff -u -r1.3 uvm_readahead.c
 --- uvm_readahead.c	12 Mar 2007 18:18:39 -0000	1.3
 +++ uvm_readahead.c	9 May 2007 23:24:23 -0000
 @@ -66,6 +66,12 @@
  	off_t ra_next;		/* next offset to read-ahead */
  };

 +#if defined(sun2) || (defined(sun3) && defined(_SUN3_))
 +/* XXX: on sun2 and sun3 (but not sun3x) MAXPHYS is 0xe000 */
 +#undef MAXPHYS	
 +#define MAXPHYS		0x8000	/* XXX */
 +#endif
 +
  #define	RA_WINSIZE_INIT	MAXPHYS			/* initial window size */
  #define	RA_WINSIZE_MAX	(MAXPHYS * 8)		/* max window size */
  #define	RA_WINSIZE_SEQENTIAL	RA_WINSIZE_MAX	/* fixed window size used for

 ---
 Izumi Tsutsui

From: yamt@mwd.biglobe.ne.jp (YAMAMOTO Takashi)
To: tsutsui@ceres.dti.ne.jp
Cc: gnats-bugs@NetBSD.org, yamt@NetBSD.org,
	kern-bug-people@NetBSD.org, netbsd-bugs@NetBSD.org,
	gnats-admin@NetBSD.org, yamt@NetBSD.org
Subject: Re: kern/36019 (uvm_readahead.c:ra_startio() assumes (MAXPHYS &
 (MAXPHYS
	 - 1)) == 0)
Date: Fri, 11 May 2007 01:28:23 +0900 (JST)

 > Is it okay to commit this as temporary workaround (for 4.0)?

 please go ahead.  thanks.

 YAMAMOTO Takashi

From: Izumi Tsutsui <tsutsui@netbsd.org>
To: gnats-bugs@NetBSD.org
Cc: 
Subject: PR/36019 CVS commit: src/sys/uvm
Date: Fri, 11 May 2007 12:11:09 +0000 (UTC)

 Module Name:	src
 Committed By:	tsutsui
 Date:		Fri May 11 12:11:09 UTC 2007

 Modified Files:
 	src/sys/uvm: uvm_readahead.c

 Log Message:
 Add temporary workaround for PR kern/36019 (panic on sun2 and sun3).
 Ok'ed by yamt.


 To generate a diff of this commit:
 cvs rdiff -r1.3 -r1.4 src/sys/uvm/uvm_readahead.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

From: Pavel Cahyna <pavel@netbsd.org>
To: gnats-bugs@NetBSD.org
Cc: 
Subject: PR/36019 CVS commit: [netbsd-4] src/sys/uvm
Date: Sun, 13 May 2007 07:56:15 +0000 (UTC)

 Module Name:	src
 Committed By:	pavel
 Date:		Sun May 13 07:56:15 UTC 2007

 Modified Files:
 	src/sys/uvm [netbsd-4]: uvm_readahead.c

 Log Message:
 Pull up following revision(s) (requested by tsutsui in ticket #641):
 	sys/uvm/uvm_readahead.c: revision 1.4
 Add temporary workaround for PR kern/36019 (panic on sun2 and sun3).
 Ok'ed by yamt.


 To generate a diff of this commit:
 cvs rdiff -r1.2 -r1.2.28.1 src/sys/uvm/uvm_readahead.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

State-Changed-From-To: open->analyzed
State-Changed-By: yamt@narn.netbsd.org
State-Changed-When: Tue, 05 Feb 2008 05:19:04 +0000
State-Changed-Why:
workarounded


>Unformatted:

Home	PR Database Search