From owner-freebsd-stable@FreeBSD.ORG  Fri Jan 25 12:55:47 2008
Return-Path: <owner-freebsd-stable@FreeBSD.ORG>
Delivered-To: freebsd-stable@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id AD2C316A41B;
	Fri, 25 Jan 2008 12:55:47 +0000 (UTC)
	(envelope-from petefrench@ticketswitch.com)
Received: from angel.ticketswitch.com (angel.ticketswitch.com
	[IPv6:2002:57e0:1d4e::1])
	by mx1.freebsd.org (Postfix) with ESMTP id 7B8AE13C457;
	Fri, 25 Jan 2008 12:55:47 +0000 (UTC)
	(envelope-from petefrench@ticketswitch.com)
Received: from [10.50.50.2] (helo=smaug.rattatosk)
	by angel.ticketswitch.com with esmtps (TLSv1:AES256-SHA:256)
	(Exim 4.68 (FreeBSD)) (envelope-from <petefrench@ticketswitch.com>)
	id 1JIO5y-000FQ3-Nk; Fri, 25 Jan 2008 12:55:46 +0000
Received: from dilbert.rattatosk ([10.50.50.6] helo=dilbert.ticketswitch.com)
	by smaug.rattatosk with esmtp (Exim 4.68 (FreeBSD))
	(envelope-from <petefrench@ticketswitch.com>)
	id 1JIO5y-0004fD-Kr; Fri, 25 Jan 2008 12:55:46 +0000
Received: from petefrench by dilbert.ticketswitch.com with local (Exim 4.68
	(FreeBSD)) (envelope-from <petefrench@ticketswitch.com>)
	id 1JIO5y-0000Mb-Ky; Fri, 25 Jan 2008 12:55:46 +0000
To: jhb@freebsd.org
In-Reply-To: <200801241357.18238.jhb@freebsd.org>
Message-Id: <E1JIO5y-0000Mb-Ky@dilbert.ticketswitch.com>
From: Pete French <petefrench@ticketswitch.com>
Date: Fri, 25 Jan 2008 12:55:46 +0000
Cc: freebsd-stable@freebsd.org
Subject: Re: panic: vm_fault: fault on nofualt entry, addr: 81423000
X-BeenThere: freebsd-stable@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: Production branch of FreeBSD source code <freebsd-stable.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-stable>, 
	<mailto:freebsd-stable-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-stable>
List-Post: <mailto:freebsd-stable@freebsd.org>
List-Help: <mailto:freebsd-stable-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-stable>,
	<mailto:freebsd-stable-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Fri, 25 Jan 2008 12:55:47 -0000

> Hmm, so that's fine.  What pointer is returned by madt_map_table?

0x800e7610

I also put some prints in afterwards to try and see how far through
the loop it was getting:

		count = (xsdt->Header.Length - sizeof(ACPI_TABLE_HEADER)) /
                    sizeof(UINT64);
                printf("DEBUG: count is %d\n", count);
                for (i = 0; i < count; i++) {
                        printf("DEBUG: probing %d - offset %p\n",
                                        i, xsdt->TableOffsetEntry[i]);
                        if (madt_probe_table(xsdt->TableOffsetEntry[i]))
                                break;
                }

The output is interesting - I get count printed as 6, but then nothing
else, just the panic. Which leads me to believe that it is the access
to xsdt->TableOffsetEntry[0] which is causing the panic.

-pete.