Re: panic: vm_fault: fault on nofault entry

On Tue, 13 May 2008 23:48:09 -0700, Jos Backus <jos_at_catnook.com> wrote:
> I've been seeing the following panic for a few weeks now. It happens
> every couple of days, sometimes perhaps a little more frequently.

> #2  0xc0548947 in panic (fmt=Variable "fmt" is not available.
> ) at /usr/src/sys/kern/kern_shutdown.c:572
> #3  0xc064bac8 in vm_fault (map=0xc1054000, vaddr=3265183744, fault_type=Variable "fault_type" is not available.
> ) at /usr/src/sys/vm/vm_fault.c:277
> #4  0xc06a43b7 in trap_pfault (frame=0xe6e76a40, usermode=0, eva=3265183752) at /usr/src/sys/i386/i386/trap.c:796
> #5  0xc06a4ce2 in trap (frame=0xe6e76a40) at /usr/src/sys/i386/i386/trap.c:485
> #6  0xc068c51b in calltrap () at /usr/src/sys/i386/i386/exception.s:146
> #7  0xc0662b52 in vm_reserv_alloc_page (object=0xc4e70d00, pindex=839369) at /usr/src/sys/vm/vm_reserv.c:320
> #8  0xc065c24e in vm_page_alloc (object=0xc4e70d00, pindex=839369, req=64) at /usr/src/sys/vm/vm_page.c:1066
> #9  0xc064c032 in vm_fault (map=0xc4cd3674, vaddr=912048128, fault_type=2 '\002', fault_flags=Variable "fault_flags" is not available.
> ) at /usr/src/sys/vm/vm_fault.c:441
> #10 0xc06a4349 in trap_pfault (frame=0xe6e76d38, usermode=1, eva=912049792) at /usr/src/sys/i386/i386/trap.c:784
> #11 0xc06a4b42 in trap (frame=0xe6e76d38) at /usr/src/sys/i386/i386/trap.c:352
> #12 0xc068c51b in calltrap () at /usr/src/sys/i386/i386/exception.s:146

This looks similar to the panics I was seeing.

Alan has posted the following patch:

%%%
Index: vm/vm_page.c
===================================================================
RCS file: /home/ncvs/src/sys/vm/vm_page.c,v
retrieving revision 1.369
diff -p -u -r1.369 vm_page.c
--- vm/vm_page.c	6 Apr 2008 18:09:28 -0000	1.369
+++ vm/vm_page.c	14 May 2008 04:40:59 -0000
_at__at_ -1063,7 +1063,7 _at__at_ vm_page_alloc(vm_object_t object, vm_pin
 			mtx_unlock(&vm_page_queue_free_mtx);
 			return (NULL);
 #if VM_NRESERVLEVEL > 0
-		} else if (object == NULL ||
+		} else if (object == NULL || object->type == OBJT_DEVICE ||
 		    (object->flags & OBJ_COLORED) == 0 ||
 		    (m = vm_reserv_alloc_page(object, pindex)) == NULL) {
 #else
%%%

Can you also give it a try?

I'm building a new kernel with the patch as I type this, but I can't
reliably reproduce the panic all the time.  It seems to be triggered
more often when I fire up mplayer, but that's merely a "guess".