Bug 48029

SMP 2 cpus
IdlePTD at phsyical address 0x002dd000
initial pcb at physical address 0x00257c00
panicstr: page fault
panic messages:
---
Fatal trap 12: page fault while in kernel mode
mp_lock = 01000002; cpuid = 1; lapic.id = 01000000
fault virtual address   = 0x0
fault code              = supervisor read, page not present
instruction pointer     = 0x8:0xc01fe4f6
stack pointer           = 0x10:0xea667c04
frame pointer           = 0x10:0xea667c30
code segment            = base rx0, limit 0xfffff, type 0x1b
                        = DPL 0, pres 1, def32 1, gran 1
processor eflags        = interrupt enabled, resume, IOPL = 0
current process         = 5 (syncer)
interrupt mask          = none <- SMP: XXX
trap number             = 12
panic: page fault
mp_lock = 01000002; cpuid = 1; lapic.id = 01000000
boot() called on cpu#1


...


(kgdb) where
#0  0xc7c11256 in ?? ()
#1  0xc014e46c in boot (howto=256) at /usr/src/sys/kern/kern_shutdown.c:223
#2  0xc014eb91 in panic (fmt=0xc022fc99 "%s") at /usr/src/sys/kern/kern_shutdown.c:595
#3  0xc01ffb29 in trap_fatal (frame=0xea667bc4, eva=0) at /usr/src/sys/i386/i386/trap.c:974
#4  0xc01ff795 in trap_pfault (frame=0xea667bc4, usermode=0, eva=0) at /usr/src/sys/i386/i386/trap.c:867
#5  0xc01ff2ef in trap (frame={tf_fs = -932970472, tf_es = -735379440, tf_ds = -735379440, tf_edi = -618967040, tf_esi = 0, tf_ebp = -362382288,
      tf_isp = -362382352, tf_ebx = 8192, tf_edx = -618967040, tf_ecx = 2048, tf_eax = -618967040, tf_trapno = 12, tf_err = 0, tf_eip = -1071651594,
      tf_cs = 8, tf_eflags = 66054, tf_esp = -362382048, tf_ss = -362382076}) at /usr/src/sys/i386/i386/trap.c:466
#6  0xc01fe4f6 in generic_bcopy ()
#7  0xc01be0c1 in ffs_write (ap=0xea667cc8) at /usr/src/sys/ufs/ufs/ufs_readwrite.c:531
#8  0xc7e8fd59 in ?? ()
#9  0xc01d51a4 in vnode_pager_generic_putpages (vp=0xecdb5380, m=0xea667de4, bytecount=8192, flags=12, rtvals=0xea667db0) at vnode_if.h:363
#10 0xc7e8fbca in ?? ()
#11 0xc01d4fc6 in vnode_pager_putpages (object=0xee2b5240, m=0xea667de4, count=2, sync=12, rtvals=0xea667db0) at vnode_if.h:1147
#12 0xc01d1f0b in vm_pageout_flush (mc=0xea667de4, count=2, flags=12) at /usr/src/sys/vm/vm_pager.h:147
#13 0xc01cee8b in vm_object_page_collect_flush (object=0xee2b5240, p=0xc1dd35f4, curgeneration=175, pagerflags=12) at /usr/src/sys/vm/vm_object.c:806
#14 0xc01cea69 in vm_object_page_clean (object=0xee2b5240, start=0, end=0, flags=4) at /usr/src/sys/vm/vm_object.c:605
#15 0xc017e4fc in vfs_msync (mp=0xc9931600, flags=2) at /usr/src/sys/kern/vfs_subr.c:2710
#16 0xc017e8ca in sync_fsync (ap=0xea667f7c) at /usr/src/sys/kern/vfs_subr.c:2971
#17 0xc017cbb3 in sched_sync () at vnode_if.h:558
(kgdb) up 5
#5  0xc01ff2ef in trap (frame={tf_fs = -932970472, tf_es = -735379440, tf_ds = -735379440, tf_edi = -618967040, tf_esi = 0, tf_ebp = -362382288,
      tf_isp = -362382352, tf_ebx = 8192, tf_edx = -618967040, tf_ecx = 2048, tf_eax = -618967040, tf_trapno = 12, tf_err = 0, tf_eip = -1071651594,
      tf_cs = 8, tf_eflags = 66054, tf_esp = -362382048, tf_ss = -362382076}) at /usr/src/sys/i386/i386/trap.c:466
466                             (void) trap_pfault(&frame, FALSE, eva);
(kgdb) frame frame->tf_ebp frame->tf_eip
#0  0xc01fe4f6 in generic_bcopy ()
(kgdb) list
461     kernel_trap:
462                     /* kernel trap */
463
464                     switch (type) {
465                     case T_PAGEFLT:                 /* page fault */
466                             (void) trap_pfault(&frame, FALSE, eva);
467                             return;
468
469                     case T_DNA:
470     #if NNPX > 0
(kgdb) up
#1  0x31372000 in ?? ()
(kgdb) up
#2  0xc01be0c1 in ffs_write (ap=0xea667cc8) at /usr/src/sys/ufs/ufs/ufs_readwrite.c:531
warning: Source file is more recent than executable.

531                     error =
(kgdb) list
526
527                     size = BLKSIZE(fs, ip, lbn) - bp->b_resid;
528                     if (size < xfersize)
529                             xfersize = size;
530
531                     error =
532                         uiomove((char *)bp->b_data + blkoffset, (int)xfersize, uio);
533                     if ((ioflag & (IO_VMIO|IO_DIRECT)) &&
534                         (LIST_FIRST(&bp->b_dep) == NULL)) {
535                             bp->b_flags |= B_RELBUF;