From owner-freebsd-stable@FreeBSD.ORG  Fri Jan 25 14:39:31 2008
Return-Path: <owner-freebsd-stable@FreeBSD.ORG>
Delivered-To: freebsd-stable@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 45FD616A581
	for <freebsd-stable@freebsd.org>; Fri, 25 Jan 2008 14:39:31 +0000 (UTC)
	(envelope-from jhb@freebsd.org)
Received: from elvis.mu.org (elvis.mu.org [192.203.228.196])
	by mx1.freebsd.org (Postfix) with ESMTP id 30BCF13C468
	for <freebsd-stable@freebsd.org>; Fri, 25 Jan 2008 14:39:31 +0000 (UTC)
	(envelope-from jhb@freebsd.org)
Received: from zion.baldwin.cx (66-23-211-162.clients.speedfactory.net
	[66.23.211.162]) by elvis.mu.org (Postfix) with ESMTP id 6DB121A4D80;
	Fri, 25 Jan 2008 06:35:30 -0800 (PST)
From: John Baldwin <jhb@freebsd.org>
To: Pete French <petefrench@ticketswitch.com>
Date: Fri, 25 Jan 2008 08:37:49 -0500
User-Agent: KMail/1.9.7
References: <E1JIO5y-0000Mb-Ky@dilbert.ticketswitch.com>
In-Reply-To: <E1JIO5y-0000Mb-Ky@dilbert.ticketswitch.com>
MIME-Version: 1.0
Content-Type: text/plain;
  charset="iso-8859-15"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
Message-Id: <200801250837.49793.jhb@freebsd.org>
Cc: freebsd-stable@freebsd.org
Subject: Re: panic: vm_fault: fault on nofualt entry, addr: 81423000
X-BeenThere: freebsd-stable@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: Production branch of FreeBSD source code <freebsd-stable.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-stable>, 
	<mailto:freebsd-stable-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-stable>
List-Post: <mailto:freebsd-stable@freebsd.org>
List-Help: <mailto:freebsd-stable-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-stable>,
	<mailto:freebsd-stable-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Fri, 25 Jan 2008 14:39:31 -0000

On Friday 25 January 2008 07:55:46 am Pete French wrote:
> > Hmm, so that's fine.  What pointer is returned by madt_map_table?
> 
> 0x800e7610

That isn't page-aligned which is unexpected, though it should still
work fine.

> I also put some prints in afterwards to try and see how far through
> the loop it was getting:
> 
> 		count = (xsdt->Header.Length - sizeof(ACPI_TABLE_HEADER)) /
>                     sizeof(UINT64);
>                 printf("DEBUG: count is %d\n", count);
>                 for (i = 0; i < count; i++) {
>                         printf("DEBUG: probing %d - offset %p\n",
>                                         i, xsdt->TableOffsetEntry[i]);
>                         if (madt_probe_table(xsdt->TableOffsetEntry[i]))
>                                 break;
>                 }
> 
> The output is interesting - I get count printed as 6, but then nothing
> else, just the panic. Which leads me to believe that it is the access
> to xsdt->TableOffsetEntry[0] which is causing the panic.

Hmm, that is odd.  The header.Length and the the actual table should all be
in the same page, so you shouldn't be getting a page fault.  Can you add
some printfs to madt_map() to see what the final starting (pa, length) are
before the call to pmap_kenter_temporary() and then add a printf for each
iteration of the while loop showing the (pa, la, remaining length)?

-- 
John Baldwin