Re: panic: vm_fault: fault on nofault entry

After CVSup'ing to latest source, it can be reproduced.  It happens at
"make release".  "/mnt" below may indicates this happened at making
floppies with mfs filesystem.


----- serial console
/mnt: correcting fs_sblockloc from 8192 to 65536
panic: vm_fault: fault on nofault entry, addr: daef5000
cpuid = 0; 
Debugger("panic")
Stopped at      Debugger+0x55:  xchgl   %ebx,in_Debugger.0
db> trace
Debugger(c075e5bd,0,c0777dc0,ece63608,100) at Debugger+0x55
panic(c0777dc0,daef5000,1,ece636b8,ece636a8) at panic+0x156
vm_fault(c1031000,daef5000,1,0,c8f21500) at vm_fault+0x122e
trap_pfault(ece6379c,0,daef5000,c07617f2,daef5000) at trap_pfault+0x152
trap(ece60018,c0550010,c0810010,cacfa000,daef5000) at trap+0x313
calltrap() at calltrap+0x5
--- trap 0xc, eip = 0xc0699384, esp = 0xece637dc, ebp = 0xece637f0 ---
ffs_load_inode(d4cc6310,caaff1a4,c87cb000,150,0) at ffs_load_inode+0xa4
ffs_vget(c8f53c00,150,2,ece638e0,8180) at ffs_vget+0x3a2
ffs_valloc(cacf4410,8180,c9082780,ece638e0,ece638f8) at ffs_valloc+0x100
ufs_makeinode(8180,cacf4410,ece63bec,ece63c00,202) at ufs_makeinode+0x69
ufs_create(ece63a68,ece63b24,c05c690e,ece63a68,ece63a64) at ufs_create+0x39
ufs_vnoperate(ece63a68,ece63a64,2,c07e0940,c8f21500) at ufs_vnoperate+0x18
vn_open_cred(ece63bd8,ece63cd8,180,c9082780,4) at vn_open_cred+0x19e
vn_open(ece63bd8,ece63cd8,180,4,c07e2690) at vn_open+0x33
kern_open(c8f21500,8059040,0,202,180) at kern_open+0xce
open(c8f21500,ece63d10,c077efce,3ee,3) at open+0x30
syscall(2f,2f,2f,3,bfbfe7b0) at syscall+0x2c0
Xint0x80_syscall() at Xint0x80_syscall+0x1d
--- syscall (5, FreeBSD ELF32, open), eip = 0x280ca08f, esp = 0xbfbfe78c, ebp = 0xbfbfe898 ---

----- gdb -k
#0  doadump () at ../../../kern/kern_shutdown.c:240
240             dumping++;
(kgdb) where
#0  doadump () at ../../../kern/kern_shutdown.c:240
#1  0xc055fa7b in boot (howto=260) at ../../../kern/kern_shutdown.c:372
#2  0xc055fe7d in panic () at ../../../kern/kern_shutdown.c:550
#3  0xc046f632 in db_panic () at ../../../ddb/db_command.c:450
#4  0xc046f592 in db_command (last_cmdp=0xc07d2760, cmd_table=0x0, 
    aux_cmd_tablep=0xc0784658, aux_cmd_tablep_end=0xc078465c)
    at ../../../ddb/db_command.c:346
#5  0xc046f6d5 in db_command_loop () at ../../../ddb/db_command.c:472
#6  0xc04726d5 in db_trap (type=3, code=0) at ../../../ddb/db_trap.c:73
#7  0xc06f8f8c in kdb_trap (type=3, code=0, regs=0xece6357c)
    at ../../../i386/i386/db_interface.c:171
#8  0xc070e678 in trap (frame=
      {tf_fs = -1065484264, tf_es = -923664368, tf_ds = 16, tf_edi = -1065910848, tf_esi = 1, tf_ebp = -320457272, tf_isp = -320457304, tf_ebx = 0, tf_edx = 0, tf_ecx = 1, tf_eax = 18, tf_trapno = 3, tf_err = 0, tf_eip = -1066429803, tf_cs = 8, tf_eflags = 642, tf_esp = -1065892694, tf_ss = -1066015299})
    at ../../../i386/i386/trap.c:580
#9  0xc06fa9d8 in calltrap () at {standard input}:94
#10 0xc055fe16 in panic (
    fmt=0xc0777dc0 "vm_fault: fault on nofault entry, addr: %lx")
    at ../../../kern/kern_shutdown.c:534
#11 0xc06b0fae in vm_fault (map=0xc1031000, vaddr=3673116672, 
    fault_type=1 '\001', fault_flags=0) at ../../../vm/vm_fault.c:891
#12 0xc070e8c2 in trap_pfault (frame=0xece6379c, usermode=0, eva=3673116672)
    at ../../../i386/i386/trap.c:723
#13 0xc070e4f3 in trap (frame=
      {tf_fs = -320471016, tf_es = -1068171248, tf_ds = -1065287664, tf_edi = -892362752, tf_esi = -621850624, tf_ebp = -320456720, tf_isp = -320456760, tf_ebx = -894439004, tf_edx = -621850624, tf_ecx = 64, tf_eax = 10, tf_trapno = 12, tf_err = 0, tf_eip = -1066822780, tf_cs = 8, tf_eflags = 66182, tf_esp = -892362752, tf_ss = 16}) at ../../../i386/i386/trap.c:420
#14 0xc06fa9d8 in calltrap () at {standard input}:94
#15 0xc069c362 in ffs_vget (mp=0xc8f53c00, ino=3402604544, flags=2, 
    vpp=0xece638e0) at ../../../ufs/ffs/ffs_vfsops.c:1333
#16 0xc0681400 in ffs_valloc (pvp=0xcacf4410, mode=33152, cred=0xc9082780, 
    vpp=0xece638e0) at ../../../ufs/ffs/ffs_alloc.c:861
#17 0xc06aac19 in ufs_makeinode (mode=33152, dvp=0xcacf4410, vpp=0xece63bec, 
    cnp=0xece63c00) at ../../../ufs/ufs/ufs_vnops.c:2358
#18 0xc06a71b9 in ufs_create (ap=0xece63a68)
    at ../../../ufs/ufs/ufs_vnops.c:199
#19 0xc06ab328 in ufs_vnoperate (ap=0x0) at ../../../ufs/ufs/ufs_vnops.c:2793
#20 0xc05c690e in vn_open_cred (ndp=0xece63bd8, flagp=0xece63cd8, cmode=384, 
    cred=0xc9082780, fdidx=0) at vnode_if.h:118
#21 0xc05c6763 in vn_open (ndp=0x0, flagp=0x0, cmode=0, fdidx=0)
    at ../../../kern/vfs_vnops.c:93
#22 0xc05bfc3e in kern_open (td=0xc8f21500, path=0x0, pathseg=UIO_USERSPACE, 
    flags=514, mode=384) at ../../../kern/vfs_syscalls.c:963
#23 0xc05bfb60 in open (td=0x0, uap=0x0) at ../../../kern/vfs_syscalls.c:933
#24 0xc070f020 in syscall (frame=
      {tf_fs = 47, tf_es = 47, tf_ds = 47, tf_edi = 3, tf_esi = -1077942352, tf_ebp = -1077942120, tf_isp = -320455308, tf_ebx = -1077942344, tf_edx = -1, tf_ecx = 2, tf_eax = 5, tf_trapno = 0, tf_err = 2, tf_eip = 671916175, tf_cs = 31, tf_eflags = 518, tf_esp = -1077942388, tf_ss = 47})
    at ../../../i386/i386/trap.c:1010
#25 0xc06faa2d in Xint0x80_syscall () at {standard input}:136
---Can't read userspace from dump, or kernel process---

(kgdb) up 11
#11 0xc06b0fae in vm_fault (map=0xc1031000, vaddr=3673116672, 
    fault_type=1 '\001', fault_flags=0) at ../../../vm/vm_fault.c:891
891             KASSERT(fs.m->flags & PG_BUSY,
(kgdb) list
886             }
887     
888             /*
889              * Page had better still be busy
890              */
891             KASSERT(fs.m->flags & PG_BUSY,
892                     ("vm_fault: page %p not busy!", fs.m));
893             /*
894              * Sanity check: page must be completely valid or it is not fit to
895              * map into user space.  vm_pager_get_pages() ensures this.


-- 
Jun Kuriyama <kuriyama_at_imgsrc.co.jp> // IMG SRC, Inc.
             <kuriyama_at_FreeBSD.org> // FreeBSD Project