fork_findpid() - Fatal trap 12: page fault while in kernel mode
Fabian Keil
freebsd-listen at fabiankeil.de
Tue Dec 15 17:19:44 UTC 2015
I've seen the following panic a couple of times in the last three
months, usually while poudriere was running and with sh being the
current process.
This one is from a system based on r290926 running with
kern.randompid=9001 and forking frequently (>1000 forks/second)
due to poudriere and afl-fuzz:
Fatal trap 12: page fault while in kernel mode
cpuid = 1; apic id = 04
fault virtual address = 0x618b00a8
fault code = supervisor read data, page not present
instruction pointer = 0x20:0xffffffff80909158
stack pointer = 0x28:0xfffffe011e03b940
frame pointer = 0x28:0xfffffe011e03b960
code segment = base 0x0, limit 0xfffff, type 0x1b
= DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags = interrupt enabled, resume, IOPL = 0
current process = 71325 (sh)
trap number = 12
panic: page fault
cpuid = 1
KDB: stack backtrace:
[...]
Uptime: 13d20h43m20s
[...]
(kgdb) where
#0 doadump (textdump=1) at pcpu.h:221
#1 0xffffffff8094a923 in kern_reboot (howto=260) at /usr/src/sys/kern/kern_shutdown.c:364
#2 0xffffffff8094ae8b in vpanic (fmt=<value optimized out>, ap=<value optimized out>) at /usr/src/sys/kern/kern_shutdown.c:757
#3 0xffffffff8094acc3 in panic (fmt=0x0) at /usr/src/sys/kern/kern_shutdown.c:688
#4 0xffffffff80c2fbb1 in trap_fatal (frame=<value optimized out>, eva=<value optimized out>) at /usr/src/sys/amd64/amd64/trap.c:834
#5 0xffffffff80c2fda4 in trap_pfault (frame=0xfffffe011e03b890, usermode=<value optimized out>) at /usr/src/sys/amd64/amd64/trap.c:684
#6 0xffffffff80c2f55e in trap (frame=0xfffffe011e03b890) at /usr/src/sys/amd64/amd64/trap.c:435
#7 0xffffffff80c120a7 in calltrap () at /usr/src/sys/amd64/amd64/exception.S:234
#8 0xffffffff80909158 in fork_findpid (flags=<value optimized out>) at /usr/src/sys/kern/kern_fork.c:281
#9 0xffffffff80907225 in do_fork (td=0xfffff8009db9a9a0, flags=20, p2=0xfffff8009dbe1a90, td2=0xfffff800aa6884d0, vm2=0xfffff800a9eee000, pdflags=0) at /usr/src/sys/kern/kern_fork.c:385
#10 0xffffffff80906c08 in fork1 (td=0xfffff8009db9a9a0, flags=20, pages=<value optimized out>, procp=0xfffffe011e03bac0, procdescp=0x0, pdflags=99999, fcaps=<value optimized out>)
at /usr/src/sys/kern/kern_fork.c:937
#11 0xffffffff809066ca in sys_fork (td=0xfffff8009db9a9a0, uap=<value optimized out>) at /usr/src/sys/kern/kern_fork.c:108
#12 0xffffffff80c3054b in amd64_syscall (td=0xfffff8009db9a9a0, traced=0) at subr_syscall.c:140
#13 0xffffffff80c1238b in Xfast_syscall () at /usr/src/sys/amd64/amd64/exception.S:394
#14 0x00000008009257aa in ?? ()
Previous frame inner to this frame (corrupt stack?)
Current language: auto; currently minimal
(kgdb) f 8
#8 0xffffffff80909158 in fork_findpid (flags=<value optimized out>) at /usr/src/sys/kern/kern_fork.c:281
warning: Source file is more recent than executable.
281 (p->p_pgrp != NULL &&
(kgdb) l -
271 * id is kept reserved only while there is a
272 * non-reaped process in the subtree, so amount of
273 * reserved pids is limited by process limit times
274 * two.
275 */
276 p = LIST_FIRST(&allproc);
277 again:
278 for (; p != NULL; p = LIST_NEXT(p, p_list)) {
279 while (p->p_pid == trypid ||
280 p->p_reapsubtree == trypid ||
(kgdb) l
281 (p->p_pgrp != NULL &&
282 (p->p_pgrp->pg_id == trypid ||
283 (p->p_session != NULL &&
284 p->p_session->s_sid == trypid)))) {
285 trypid++;
286 if (trypid >= pidchecked)
287 goto retry;
288 }
289 if (p->p_pid > trypid && pidchecked > p->p_pid)
290 pidchecked = p->p_pid;
(kgdb) f 6
#6 0xffffffff80c2f55e in trap (frame=0xfffffe011e03b890) at /usr/src/sys/amd64/amd64/trap.c:435
warning: Source file is more recent than executable.
435 (void) trap_pfault(frame, FALSE);
(kgdb) p *frame
$2 = {tf_rdi = 1636499584, tf_rsi = 51281, tf_rdx = -8795282608128, tf_rcx = 1, tf_r8 = 99999, tf_r9 = 99999, tf_rax = 0, tf_rbx = 60137, tf_rbp = -2194224727712, tf_r10 = 0, tf_r11 = 0,
tf_r12 = -8793446540656, tf_r13 = -2194224727360, tf_r14 = 0, tf_r15 = -8793450915184, tf_trapno = 12, tf_fs = 19, tf_gs = 27, tf_addr = 1636499624, tf_flags = 1, tf_es = 59, tf_ds = 59, tf_err = 0,
tf_rip = -2138009256, tf_cs = 32, tf_rflags = 66050, tf_rsp = -2194224727728, tf_ss = 40}
(kgdb) f 9
#9 0xffffffff80907225 in do_fork (td=0xfffff8009db9a9a0, flags=20, p2=0xfffff8009dbe1a90, td2=0xfffff800aa6884d0, vm2=0xfffff800a9eee000, pdflags=0) at /usr/src/sys/kern/kern_fork.c:385
385 trypid = fork_findpid(flags);
(kgdb) p flags
$3 = 20
(kgdb) p *td
$4 = {td_lock = 0xffffffff8129b100, td_proc = 0xfffff8009d7b5a90, td_plist = {tqe_next = 0x0, tqe_prev = 0xfffff8009d7b5aa0}, td_runq = {tqe_next = 0x0, tqe_prev = 0xffffffff8129b740}, td_slpq = {
tqe_next = 0x0, tqe_prev = 0xfffff800066de400}, td_lockq = {tqe_next = 0x0, tqe_prev = 0xfffffe011e176908}, td_hash = {le_next = 0x0, le_prev = 0xfffffe0000c98d98}, td_cpuset = 0xfffff800a943f9c0,
td_sel = 0xfffff800a9b20e00, td_sleepqueue = 0xfffff800066de400, td_turnstile = 0xfffff8000672b480, td_rlqe = 0xfffff8000688ba28, td_umtxq = 0xfffff80024736880, td_vm_dom_policy = {seq = 0, p = {
policy = VM_POLICY_NONE, domain = -1}}, td_tid = 101811, td_sigqueue = {sq_signals = {__bits = 0xfffff8009db9aa40}, sq_kill = {__bits = 0xfffff8009db9aa50}, sq_list = {tqh_first = 0x0,
tqh_last = 0xfffff8009db9aa60}, sq_proc = 0xfffff8009d7b5a90, sq_flags = 1}, td_lend_user_pri = 255 'ÿ', td_flags = 67174406, td_inhibitors = 0, td_pflags = 0, td_dupfd = 0, td_sqqueue = 0,
td_wchan = 0x0, td_wmesg = 0x0, td_owepreempt = 0 '\0', td_tsqueue = 0 '\0', td_locks = 0, td_rw_rlocks = 0, td_lk_slocks = 0, td_stopsched = 1, td_blocked = 0x0, td_lockname = 0x0, td_contested = {
lh_first = 0x0}, td_sleeplocks = 0x0, td_intr_nesting_level = 0, td_pinned = 1, td_ucred = 0xfffff8009d8d5200, td_limit = 0xfffff80118817a00, td_estcpu = 0, td_slptick = 0, td_blktick = 0,
td_swvoltick = -950283881, td_cow = 55789, td_ru = {ru_utime = {tv_sec = 0, tv_usec = 0}, ru_stime = {tv_sec = 0, tv_usec = 0}, ru_maxrss = 3044, ru_ixrss = 175824, ru_idrss = 15984, ru_isrss = 170496,
ru_minflt = 99693, ru_majflt = 0, ru_nswap = 0, ru_inblock = 151, ru_oublock = 19, ru_msgsnd = 0, ru_msgrcv = 0, ru_nsignals = 0, ru_nvcsw = 5210, ru_nivcsw = 18301}, td_rux = {rux_runtime = 11803416060,
rux_uticks = 428, rux_sticks = 122, rux_iticks = 0, rux_uu = 0, rux_su = 0, rux_tu = 0}, td_incruntime = 399768428, td_runtime = 12203184488, td_pticks = 764, td_sticks = 777, td_iticks = 0,
td_uticks = 5, td_intrval = 0, td_oldsigmask = {__bits = 0xfffff8009db9abf4}, td_generation = 23511, td_sigstk = {ss_sp = 0x0, ss_size = 0, ss_flags = 4}, td_xsig = 0, td_profil_addr = 0,
td_profil_ticks = 0, td_name = 0xfffff8009db9ac34 "sh", td_fpop = 0x0, td_dbgflags = 0, td_dbgksi = {ksi_link = {tqe_next = 0x0, tqe_prev = 0x0}, ksi_info = {si_signo = 0, si_errno = 0, si_code = 0,
si_pid = 0, si_uid = 0, si_status = 0, si_addr = 0x0, si_value = {sival_int = 0, sival_ptr = 0x0, sigval_int = 0, sigval_ptr = 0x0}, _reason = {_fault = {_trapno = 0}, _timer = {_timerid = 0,
_overrun = 0}, _mesgq = {_mqd = 0}, _poll = {_band = 0}, __spare__ = {__spare1__ = 0, __spare2__ = 0xfffff8009db9ac98}}}, ksi_flags = 0, ksi_sigq = 0x0}, td_ng_outbound = 0, td_osd = {
osd_nslots = 0, osd_slots = 0x0, osd_next = {le_next = 0x0, le_prev = 0x0}}, td_map_def_user = 0x0, td_dbg_forked = 0, td_vp_reserv = 0, td_no_sleeping = 0, td_dom_rr_idx = 0, td_su = 0x0, td_sigmask = {
__bits = 0xfffff8009db9ad10}, td_rqindex = 25 '\031', td_base_pri = 174 '®', td_priority = 174 '®', td_pri_class = 3 '\003', td_user_pri = 187 '»', td_base_user_pri = 187 '»', td_dbg_sc_code = 0,
td_dbg_sc_narg = 0, td_pcb = 0xfffffe011e03bcc0, td_state = TDS_RUNNING, td_uretoff = {tdu_retval = 0xfffff8009db9ad40, tdu_off = 0}, td_cowgen = 0, td_slpcallout = {c_links = {le = {le_next = 0x0,
le_prev = 0xfffffe0000cde4d0}, sle = {sle_next = 0x0}, tqe = {tqe_next = 0x0, tqe_prev = 0xfffffe0000cde4d0}}, c_time = 5144514421357134, c_precision = 268435437, c_arg = 0xfffff8009db9a9a0,
c_func = 0xffffffff8099c020 <sleepq_timeout>, c_lock = 0x0, c_flags = 0, c_iflags = 272, c_cpu = 1}, td_frame = 0xfffffe011e03bc00, td_kstack_obj = 0xfffff8009d99b700, td_kstack = 18446741879484809216,
td_kstack_pages = 4, td_critnest = 4294960822, td_md = {md_spinlock_count = -6474, md_saved_flags = 582, md_spurflt_addr = 0}, td_sched = 0xfffff8009db9ae40, td_ar = 0x0, td_lprof = 0xfffff8009db9ade0,
td_dtrace = 0xfffff8009d2b6400, td_errno = 0, td_vnet = 0x0, td_vnet_lpush = 0x0, td_intr_frame = 0x0, td_rfppwait_p = 0xfffff800a99e4548, td_ma = 0x0, td_ma_cnt = 0, td_emuldata = 0x0, td_lastcpu = 1,
td_oncpu = 1}
(kgdb) p *p2
$5 = {p_list = {le_next = 0x0, le_prev = 0xffffffff813f3cd0}, p_threads = {tqh_first = 0xfffff800aa6884d0, tqh_last = 0xfffff800aa6884e0}, p_slock = {lock_object = {
lo_name = 0xffffffff80e22449 "process slock", lo_flags = 537067520, lo_data = 0, lo_witness = 0x0}, mtx_lock = 4}, p_ucred = 0xfffff8009d8d5200, p_fd = 0x0, p_fdtol = 0x0, p_stats = 0xfffff800aaa08a00,
p_limit = 0x0, p_limco = {c_links = {le = {le_next = 0x0, le_prev = 0x0}, sle = {sle_next = 0x0}, tqe = {tqe_next = 0x0, tqe_prev = 0x0}}, c_time = 0, c_precision = 0, c_arg = 0x0, c_func = 0,
c_lock = 0xfffff8009dbe1bb0, c_flags = 0, c_iflags = 0, c_cpu = 0}, p_sigacts = 0x0, p_flag = 268460034, p_flag2 = 0, p_state = PRS_ZOMBIE, p_pid = 49173, p_hash = {le_next = 0xfffff8000643b000,
le_prev = 0xfffffe0000c8a0a8}, p_pglist = {le_next = 0xfffff80023df1000, le_prev = 0xfffff8009d7b5b60}, p_pptr = 0xfffff8009d7b5a90, p_sibling = {le_next = 0xfffff80023df1000,
le_prev = 0xfffff8009d7b5b88}, p_children = {lh_first = 0x0}, p_reaper = 0xfffff800029a5548, p_reaplist = {lh_first = 0x0}, p_reapsibling = {le_next = 0xfffff800a99e4548, le_prev = 0xfffff800029a5650},
p_mtx = {lock_object = {lo_name = 0xffffffff80e2243c "process lock", lo_flags = 558039040, lo_data = 0, lo_witness = 0x0}, mtx_lock = 4}, p_statmtx = {lock_object = {lo_name = 0xffffffff80e22457 "pstatl",
lo_flags = 537067520, lo_data = 0, lo_witness = 0x0}, mtx_lock = 4}, p_itimmtx = {lock_object = {lo_name = 0xffffffff80e2245e "pitiml", lo_flags = 537067520, lo_data = 0, lo_witness = 0x0},
mtx_lock = 4}, p_profmtx = {lock_object = {lo_name = 0xffffffff80e22465 "pprofl", lo_flags = 537067520, lo_data = 0, lo_witness = 0x0}, mtx_lock = 4}, p_ksi = 0xfffff8000639dd20, p_sigqueue = {
sq_signals = {__bits = 0xfffff8009dbe1c38}, sq_kill = {__bits = 0xfffff8009dbe1c48}, sq_list = {tqh_first = 0x0, tqh_last = 0xfffff8009dbe1c58}, sq_proc = 0xfffff8009dbe1a90, sq_flags = 1}, p_oppid = 0,
p_vmspace = 0x0, p_swtick = 3344683415, p_cowgen = 0, p_realtimer = {it_interval = {tv_sec = 0, tv_usec = 0}, it_value = {tv_sec = 0, tv_usec = 0}}, p_ru = {ru_utime = {tv_sec = 0, tv_usec = 0}, ru_stime = {
tv_sec = 0, tv_usec = 0}, ru_maxrss = 0, ru_ixrss = 0, ru_idrss = 0, ru_isrss = 0, ru_minflt = 74, ru_majflt = 0, ru_nswap = 0, ru_inblock = 0, ru_oublock = 0, ru_msgsnd = 0, ru_msgrcv = 0,
ru_nsignals = 0, ru_nvcsw = 2, ru_nivcsw = 2}, p_rux = {rux_runtime = 2047260, rux_uticks = 0, rux_sticks = 0, rux_iticks = 0, rux_uu = 0, rux_su = 0, rux_tu = 0}, p_crux = {rux_runtime = 0,
rux_uticks = 0, rux_sticks = 0, rux_iticks = 0, rux_uu = 0, rux_su = 0, rux_tu = 0}, p_profthreads = 0, p_exitthreads = 0, p_traceflag = 0, p_tracevp = 0x0, p_tracecred = 0x0, p_textvp = 0x0, p_lock = 0,
p_sigiolst = {slh_first = 0x0}, p_sigparent = 20, p_sig = 0, p_code = 0, p_stops = 0, p_stype = 0, p_step = 0 '\0', p_pfsflags = 0 '\0', p_nlminfo = 0x0, p_aioinfo = 0x0, p_singlethread = 0x0,
p_suspcount = 0, p_xthread = 0xfffff800aa6884d0, p_boundary_count = 0, p_pendingcnt = 0, p_itimers = 0x0, p_procdesc = 0x0, p_treeflag = 0, p_magic = 3203398350, p_osrel = 1100090,
p_comm = 0xfffff8009dbe1e54 "pwait", p_pgrp = 0x0, p_sysent = 0xffffffff8118f9f8, p_args = 0x0, p_cpulimit = 9223372036854775807, p_nice = 0 '\0', p_fibnum = 0, p_reapsubtree = 28, p_xexit = 0, p_xsig = 0,
p_klist = {kl_list = {slh_first = 0x0}, kl_lock = 0xffffffff808fc960 <knlist_mtx_lock>, kl_unlock = 0xffffffff808fc9c0 <knlist_mtx_unlock>, kl_assert_locked = 0xffffffff808fca30 <knlist_mtx_assert_locked>,
kl_assert_unlocked = 0xffffffff808fca40 <knlist_mtx_assert_unlocked>, kl_lockarg = 0xfffff8009dbe1bb0}, p_numthreads = 1, p_md = {md_ldt = 0x0, md_ldt_sd = {sd_lolimit = 0, sd_lobase = 0, sd_type = 0,
sd_dpl = 0, sd_p = 0, sd_hilimit = 0, sd_xx0 = 0, sd_gran = 0, sd_hibase = 0, sd_xx1 = 0, sd_mbz = 0, sd_xx2 = 0}}, p_itcallout = {c_links = {le = {le_next = 0x0, le_prev = 0x0}, sle = {sle_next = 0x0},
tqe = {tqe_next = 0x0, tqe_prev = 0x0}}, c_time = 0, c_precision = 0, c_arg = 0x0, c_func = 0, c_lock = 0xfffff8009dbe1bb0, c_flags = 0, c_iflags = 0, c_cpu = 0}, p_acflag = 0, p_peers = 0x0,
p_leader = 0xfffff8009dbe1a90, p_emuldata = 0x0, p_label = 0x0, p_sched = 0xfffff8009dbe1fd8, p_ktr = {stqh_first = 0x0, stqh_last = 0xfffff8009dbe1f60}, p_mqnotifier = {lh_first = 0x0},
p_dtrace = 0xfffff80061b41e80, p_pwait = {cv_description = 0xffffffff80e22d2a "ppwait", cv_waiters = 0}, p_dbgwait = {cv_description = 0xffffffff80e22d31 "dbgwait", cv_waiters = 0}, p_prev_runtime = 0,
p_racct = 0x0, p_throttled = 0 '\0', p_vm_dom_policy = {seq = 2, p = {policy = VM_POLICY_NONE, domain = -1}}, p_orphan = {le_next = 0x0, le_prev = 0x0}, p_orphans = {lh_first = 0x0}}
(kgdb) p *td2
$6 = {td_lock = 0xffffffff8129b100, td_proc = 0xfffff8009dbe1a90, td_plist = {tqe_next = 0x0, tqe_prev = 0xfffff8009dbe1aa0}, td_runq = {tqe_next = 0x0, tqe_prev = 0xffffffff8129b610}, td_slpq = {
tqe_next = 0x0, tqe_prev = 0xfffff8013a4f5180}, td_lockq = {tqe_next = 0x0, tqe_prev = 0xfffffe011e1d08a8}, td_hash = {le_next = 0x0, le_prev = 0xfffffe0000c98dc8}, td_cpuset = 0x0,
td_sel = 0xfffff8009d8a4680, td_sleepqueue = 0xfffff8013a4f5180, td_turnstile = 0xfffff800b24dba80, td_rlqe = 0xfffff8000688b8e8, td_umtxq = 0xfffff800a9c45c00, td_vm_dom_policy = {seq = 0, p = {
policy = VM_POLICY_NONE, domain = -1}}, td_tid = 101817, td_sigqueue = {sq_signals = {__bits = 0xfffff800aa688570}, sq_kill = {__bits = 0xfffff800aa688580}, sq_list = {tqh_first = 0x0,
tqh_last = 0xfffff800aa688590}, sq_proc = 0xfffff8009dbe1a90, sq_flags = 1}, td_lend_user_pri = 255 'ÿ', td_flags = 65540, td_inhibitors = 0, td_pflags = 0, td_dupfd = 0, td_sqqueue = 0, td_wchan = 0x0,
td_wmesg = 0x0, td_owepreempt = 0 '\0', td_tsqueue = 0 '\0', td_locks = 0, td_rw_rlocks = 0, td_lk_slocks = 0, td_stopsched = 0, td_blocked = 0x0, td_lockname = 0x0, td_contested = {lh_first = 0x0},
td_sleeplocks = 0x0, td_intr_nesting_level = 0, td_pinned = 0, td_ucred = 0xfffff8009d8d5200, td_limit = 0xfffff80118817a00, td_estcpu = 0, td_slptick = 0, td_blktick = 0, td_swvoltick = -950283880,
td_cow = 20, td_ru = {ru_utime = {tv_sec = 0, tv_usec = 0}, ru_stime = {tv_sec = 0, tv_usec = 0}, ru_maxrss = 0, ru_ixrss = 0, ru_idrss = 0, ru_isrss = 0, ru_minflt = 74, ru_majflt = 0, ru_nswap = 0,
ru_inblock = 0, ru_oublock = 0, ru_msgsnd = 0, ru_msgrcv = 0, ru_nsignals = 0, ru_nvcsw = 2, ru_nivcsw = 2}, td_rux = {rux_runtime = 2047260, rux_uticks = 0, rux_sticks = 0, rux_iticks = 0, rux_uu = 0,
rux_su = 0, rux_tu = 0}, td_incruntime = 0, td_runtime = 2047260, td_pticks = 0, td_sticks = 0, td_iticks = 0, td_uticks = 0, td_intrval = 0, td_oldsigmask = {__bits = 0xfffff800aa688724},
td_generation = 3, td_sigstk = {ss_sp = 0x0, ss_size = 0, ss_flags = 4}, td_xsig = 0, td_profil_addr = 0, td_profil_ticks = 0, td_name = 0xfffff800aa688764 "pwait", td_fpop = 0x0, td_dbgflags = 0,
td_dbgksi = {ksi_link = {tqe_next = 0x0, tqe_prev = 0x0}, ksi_info = {si_signo = 0, si_errno = 0, si_code = 0, si_pid = 0, si_uid = 0, si_status = 0, si_addr = 0x0, si_value = {sival_int = 0,
sival_ptr = 0x0, sigval_int = 0, sigval_ptr = 0x0}, _reason = {_fault = {_trapno = 0}, _timer = {_timerid = 0, _overrun = 0}, _mesgq = {_mqd = 0}, _poll = {_band = 0}, __spare__ = {__spare1__ = 0,
__spare2__ = 0xfffff800aa6887c8}}}, ksi_flags = 0, ksi_sigq = 0x0}, td_ng_outbound = 0, td_osd = {osd_nslots = 0, osd_slots = 0x0, osd_next = {le_next = 0x0, le_prev = 0x0}}, td_map_def_user = 0x0,
td_dbg_forked = 0, td_vp_reserv = 0, td_no_sleeping = 0, td_dom_rr_idx = 0, td_su = 0x0, td_sigmask = {__bits = 0xfffff800aa688840}, td_rqindex = 6 '\006', td_base_pri = 152 '\230',
td_priority = 152 '\230', td_pri_class = 3 '\003', td_user_pri = 174 '®', td_base_user_pri = 174 '®', td_dbg_sc_code = 0, td_dbg_sc_narg = 0, td_pcb = 0xfffffe011e059cc0, td_state = TDS_INACTIVE,
td_uretoff = {tdu_retval = 0xfffff800aa688870, tdu_off = 0}, td_cowgen = 0, td_slpcallout = {c_links = {le = {le_next = 0x0, le_prev = 0xfffffe0000c56d68}, sle = {sle_next = 0x0}, tqe = {tqe_next = 0x0,
tqe_prev = 0xfffffe0000c56d68}}, c_time = 5144519038446659, c_precision = 268435437, c_arg = 0xfffff800aa6884d0, c_func = 0xffffffff8099c020 <sleepq_timeout>, c_lock = 0x0, c_flags = 0,
c_iflags = 272, c_cpu = 0}, td_frame = 0xfffffe011e059c00, td_kstack_obj = 0xfffff800aab1d300, td_kstack = 18446741879484932096, td_kstack_pages = 4, td_critnest = 1, td_md = {md_spinlock_count = 1,
md_saved_flags = 582, md_spurflt_addr = 0}, td_sched = 0xfffff800aa688970, td_ar = 0x0, td_lprof = 0xfffff800aa688910, td_dtrace = 0xfffff800aad29900, td_errno = 0, td_vnet = 0x0, td_vnet_lpush = 0x0,
td_intr_frame = 0x0, td_rfppwait_p = 0xfffff80040628a90, td_ma = 0x0, td_ma_cnt = 0, td_emuldata = 0x0, td_lastcpu = 1, td_oncpu = -1}
(kgdb) p *vm2
$7 = {vm_map = {header = {prev = 0xfffff80109260280, next = 0xfffff80083e33400, left = 0x0, right = 0x0, start = 4096, end = 140737488355328, avail_ssize = 0, adj_free = 0, max_free = 0, object = {
vm_object = 0x0, sub_map = 0x0}, offset = 0, eflags = 0, protection = 0 '\0', max_protection = 0 '\0', inheritance = 0 '\0', read_ahead = 0 '\0', wired_count = 0, next_read = 0, cred = 0x0,
wiring_thread = 0x0}, lock = {lock_object = {lo_name = 0xffffffff80e56895 "vm map (user)", lo_flags = 36896768, lo_data = 0, lo_witness = 0x0}, sx_lock = 1}, system_mtx = {lock_object = {
lo_name = 0xffffffff80e56885 "vm map (system)", lo_flags = 21168128, lo_data = 0, lo_witness = 0x0}, mtx_lock = 4}, nentries = 12, size = 8597504, timestamp = 1, needs_wakeup = 0 '\0',
system_map = 0 '\0', flags = 0 '\0', root = 0xfffff80109260280, pmap = 0xfffff800a9eee138, busy = 0}, vm_shm = 0x0, vm_swrss = 0, vm_tsize = 33, vm_dsize = 3, vm_ssize = 32,
vm_taddr = 0x400000 <Address 0x400000 out of bounds>, vm_daddr = 0x621000 <Address 0x621000 out of bounds>, vm_maxsaddr = 0x7fffdffff000 <Address 0x7fffdffff000 out of bounds>, vm_refcnt = 1, vm_pmap = {
pm_mtx = {lock_object = {lo_name = 0xffffffff80e56880 "pmap", lo_flags = 21168128, lo_data = 0, lo_witness = 0x0}, mtx_lock = 4}, pm_pml4 = 0xfffff800b6314000, pm_cr3 = 3056680960, pm_pvchunk = {
tqh_first = 0xfffff80069221000, tqh_last = 0xfffff8008cf38008}, pm_active = {__bits = 0xfffff800a9eee178}, pm_type = PT_X86, pm_stats = {resident_count = 761, wired_count = 0}, pm_root = {rt_root = 0,
rt_flags = 0 '\0'}, pm_eptgen = 0, pm_flags = 256, pm_pcids = 0xfffff800a9eee1cc}}
(kgdb)
Fabian
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 181 bytes
Desc: OpenPGP digital signature
URL: <http://lists.freebsd.org/pipermail/freebsd-current/attachments/20151215/b244c6cb/attachment.sig>
More information about the freebsd-current
mailing list