From peter@rulingia.com  Sun Aug 11 08:02:08 2013
Return-Path: <peter@rulingia.com>
Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115])
	(using TLSv1 with cipher ADH-AES256-SHA (256/256 bits))
	(No client certificate requested)
	by hub.freebsd.org (Postfix) with ESMTP id 08EE9ED
	for <FreeBSD-gnats-submit@freebsd.org>; Sun, 11 Aug 2013 08:02:08 +0000 (UTC)
	(envelope-from peter@rulingia.com)
Received: from vps.rulingia.com (host-122-100-2-194.octopus.com.au [122.100.2.194])
	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
	(No client certificate requested)
	by mx1.freebsd.org (Postfix) with ESMTPS id 96AF72880
	for <FreeBSD-gnats-submit@freebsd.org>; Sun, 11 Aug 2013 08:02:06 +0000 (UTC)
Received: from server.rulingia.com (c220-239-237-213.belrs5.nsw.optusnet.com.au [220.239.237.213])
	by vps.rulingia.com (8.14.5/8.14.5) with ESMTP id r7B7w3Ag014294
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK)
	for <FreeBSD-gnats-submit@freebsd.org>; Sun, 11 Aug 2013 17:58:04 +1000 (EST)
	(envelope-from peter@rulingia.com)
Received: from server.rulingia.com (localhost.rulingia.com [127.0.0.1])
	by server.rulingia.com (8.14.7/8.14.7) with ESMTP id r7B7vvLf087372
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO);
	Sun, 11 Aug 2013 17:57:57 +1000 (EST)
	(envelope-from peter@server.rulingia.com)
Received: (from peter@localhost)
	by server.rulingia.com (8.14.7/8.14.7/Submit) id r7B7vu2L087371;
	Sun, 11 Aug 2013 17:57:56 +1000 (EST)
	(envelope-from peter)
Message-Id: <201308110757.r7B7vu2L087371@server.rulingia.com>
Date: Sun, 11 Aug 2013 17:57:56 +1000 (EST)
From: Peter Jeremy <peterj@freebsd.org>
Reply-To: Peter Jeremy <peterj@freebsd.org>
To: FreeBSD-gnats-submit@freebsd.org
Cc: peter@server.rulingia.com
Subject: 8.4p2 panics during boot
X-Send-Pr-Version: 3.113
X-GNATS-Notify:

>Number:         181222
>Category:       kern
>Synopsis:       [panic] 8.4p2 panics during boot on Campaq M700 P3-650 [regression]
>Confidential:   no
>Severity:       serious
>Priority:       low
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Sun Aug 11 08:10:00 UTC 2013
>Closed-Date:    
>Last-Modified:  Sun Aug 11 13:42:02 UTC 2013
>Originator:     Peter Jeremy
>Release:        FreeBSD 8.4RELEASE-p2 i386
>Organization:
>Environment:
System: FreeBSD fwall2.rulingia.com 8.4-RELEASE-p2 FreeBSD 8.4-RELEASE-p2 #0: Sun Aug 11 13:55:10 EST 2013 root@fwall2.rulingia.com:/var/obj/usr/src/8.4/sys/GENERIC i386

>Description:
	A GENERIC 8.4p2 kernel panics on my Campaq M700 P3-650 whilst running
	ata_identify().  The same system has no problems with 7.x or 8.3.  I
	got the same panic running my custom kernel and built GENERIC to
	check it wasn't something I did.

	Photos of the panic are at
	https://plus.google.com/photos/106067987156035735826/albums/5910753509123036529

	The relevant (hand-transcribed) bits are:
Fatal trap 12: page fault while in kernel mode
fault virtual address = 0xf0008277
fault code = supervisor read, page not present
instruction pointer = 0x20:0xc057ddf4
...
#5 0xc0cf5edc at calltrap+0x6
#6 0xc0c57e00 at ata_boot_attach+0x70
#7 0xc09328ac at run_interrupt_driven_config_hooks+0x10c
	
	A disassembly of 0xc057ddf4 shows the problem is the arrowed
	expression.

ata_identify(device_t dev)
{
    struct ata_channel *ch = device_get_softc(dev);
    struct ata_device *atadev;
    device_t *children;
    device_t child, master = NULL;
    int nchildren, i, n = ch->devices;
                          ^^^^^^^^^^^

	The disk controller is a Intel PIIX4 with a single WD1600BEVE
	disk attached.

>How-To-Repeat:
	Boot 8.4 on a Compaq M700.

>Fix:
	Unknown.
>Release-Note:
>Audit-Trail:
>Unformatted:
