panic: double fault with 11.0-CURRENT r258504

[Don Lewis]

On 27 Nov, Konstantin Belousov wrote:
> On Wed, Nov 27, 2013 at 11:02:57AM -0800, Don Lewis wrote:
>> On 27 Nov, Konstantin Belousov wrote:
>> > On Wed, Nov 27, 2013 at 10:33:30AM -0800, Don Lewis wrote:
>> >> On 27 Nov, Konstantin Belousov wrote:
>> >> > On Wed, Nov 27, 2013 at 09:41:36AM -0800, Don Lewis wrote:
>> >> >> On 27 Nov, Konstantin Belousov wrote:
>> >> >> > On Wed, Nov 27, 2013 at 02:49:12AM -0800, Don Lewis wrote:
>> >> >> >> <http://people.freebsd.org/~truckman/doublefault2.JPG>
>> >> >> > 
>> >> >> > What is the instruction at cpu_switch+0x9b ?
>> >> >> 
>> >> >> movl 0x8(%edx),%eax
>> >> > So it is line 176 in swtch.s. Is machine still in ddb, or did you
>> >> > obtained the core ? If yes, please print out the content of words at
>> >> > 0xe4f62bb0 + 4, +8 (*), +16. Please print the content of the word at
>> >> > address (*) + 8.
>> >> 
>> >> It is still in ddb.
>> >> 
>> >> <http://people.freebsd.org/~truckman/doublefault3.JPG>, though not in
>> >> the above order.
>> > Uhm, sorry, I mistyped the last part of the instructions.
>> > 
>> > The new thread pointer is 0xd2f4e000, there is nothing incriminating.
>> > Please print the word at 0xd2f4e000+0x254 == 0xd2f4e254, which would be
>> > the address of the new thread pcb. It is load from the pcb + 8 which
>> > faults.
>> 
>> 0xf3d44d60
> Again, the pointer looks fine, and its tail is 0xd60, which is correct for
> the pcb offset in the last page of the thread stack.
> 
> Please do 'show thread 0xd2f4e000' before trying below instructions.

Ok, see below:
 
> What happens if you try to read word at 0xf3d44d68 ?

Nothing bad ...

<http://people.freebsd.org/~truckman/doublefault4.JPG>