RELENG_5 PAE panic

[Robert Watson]

On Thu, 28 Jul 2005, Frank McConnell wrote:

> --- begin paste ---
> Fatal trap 12: page fault while in kernel mode
> fault virtual address  = 0x24
> fault code             = supervisor read, page not present
> instruction pointer    = 0x8:0xc03db1cf
> stack pointer          = 0x10:0xeb328c64
> frame pointer          = 0x10:0xeb328c78
> code segment           = base 0x0, limit 0xfffff, type 0x1b
>                       = DPL 0, pres 1, def32 1, gran 1
> processor eflags       = resume, IOPL = 0
> current process        = 70 (pagedaemon)
> [thread pid 70 tid 100080 ]
> Stopped at      0xc03db1cf = propagate_priority+0x7f:  movl    0x24(%eax),%eax
> db> trace
> Tracing pid 70 tid 100080 td 0xc6a89000
> propagate_priority(c6a89000,c0628280,c0636c60,c6a89000,c6cdaa82) at 0xc03db1cf = propagate_priority+0x7f
> turnstile_wait(c6a6f240,c0636c60,c6cdaa80) at 0xc03db84a = turnstile_wait + 0x266
> _mtx_lock_sleep(c0636c60,c6a89000,0,0,0) at 0xc03b4c25 = _mtx_lock_speed+0xad
> msleep(c0637104,c0636c60,44,c059aa74,1f4) at 0xc03c37ea = msleep+0x39a
> vm_pageout(0,eb328d38) at 0xc04fb0e4 = vm_pageout+0x280
> fork_exit(c04fae64,0,eb328d38) at 0xc03a8680 = fork_exit+0x74
> fork_trampoline() at 0xc0539d9c = fork_trampoline+0x8
> --- trap 0x1, eip = 0, esp = 0xeb328d6c, ebp = 0 ---
> db>

This appears to be a NULL pointer dereference in propagate_priotity(). 
Often a panic in propagate_priority is actually a symptom of a slightly 
earlier problem which is discovered by propagate_priority when it trips 
over, for example, a bad mutex.  If you're set up with a serial port to 
copy and paste debugging output, the output of 'ps' and 'show pcpu' for 
each of the cpus (as well as 'show pcpu without a cpu argument) would be 
helpful.  It wouldn't hurt also to use gdb on a copy of the kernel with 
debugging sybols to map 'vm_pageout+0x280' into a line number.  Details on 
these various activities can be found in the handbook.

Robert N M Watson