>Number:         1964
>Category:       port-i386
>Synopsis:       i386 kernel page faults when processes are swapped out
>Confidential:   no
>Severity:       serious
>Priority:       high
>Responsible:    gnats-admin (GNATS administrator)
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sun Jan 21 17:05:01 1996
>Last-Modified:
>Originator:     Frank van der Linden
>Organization:
Organized? Me?
>Release:        1.1A
>Environment:
NetBSD natte 1.1A NetBSD 1.1A (NATTE) #2: Sun Jan 21 17:33:02 MET 1996     root@:/usr/src/sys/arch/i386/compile/NATTE i386

>Description:
	Recently, swapping was enabled for the i386 port. However, when the
	system actually starts swapping, things may go wrong. When a process
	exits, gdt_compact() will get called in kernel mode, curproc = 0.
	gdt_compact() references the user areas of all processes, so a
	kernel page fault trap will occur when one of these happens to be
	swapped out.
>How-To-Repeat:
	Start up some big processes, let them run for a bit and then
	terminate one. For example: start up a kernel compile with
	'-pipe' in the CFLAGS, and use 'make -j 8'. (This will not
	work properly because of the vnode_if.* dependency and possibly
	others, but that is another story), and stop it after some time.

	DDB output:
kernel page fault trap, code=0
Stopped at      _gdt_compact+0x30:      movl    0x68(%ecx),%edx
db> trace
_gdt_compact(f81f17b0,f8213000,f875b600,f9b6b000,f9b6d000) at _gdt_compact+0x30
_gdt_put_slot(1f,f8214f44,f8100aeb,f9b46000,ffffffff) at _gdt_put_slot+0x76
_tss_free(f9b46000,ffffffff,0,f81f54a0,0) at _tss_free+0x17
_switch_exit(0,0,f8213194,0,f8214f7c) at _switch_exit+0x57
bpendtsleep(f81f27b0,4,f8191672,0) at bpendtsleep
_scheduler(f8719b00,f81106b8,212fb0,212000,221000) at _scheduler+0x60
_main(0,0,0,0,0) at _main+0x4da
db> show registers
es                    0x10
ds              0xf8210010  _end+0x170a0
edi                   0x30
esi                    0x3
ebp             0xf8214ed8  _end+0x1bf68
ebx                    0x6
edx                    0x3
ecx             0xf9b3f000  _end+0x1946090
eax                   0x20
eip             0xf819c310  _gdt_compact+0x30
cs              0xf8190008  _lock_clear_recursive+0x5cc
eflags             0x10286
esp             0xf8214ec4  _end+0x1bf54
ss              0xffff0010  _APTmap+0x3f0010
_gdt_compact+0x30:          movl 0x68(%ecx),%edx


>Fix:
	gdt_compact referencing all user areas rather seems to defeat
	the use of having them swapped out, store the needed info in the
	proc struct? (just a first thought, I haven't given it much
	thought)
>Audit-Trail:
>Unformatted: