From owner-freebsd-current@FreeBSD.ORG Wed Jul 7 02:32:30 2004 Return-Path: Delivered-To: freebsd-current@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 886D216A4CE for ; Wed, 7 Jul 2004 02:32:30 +0000 (GMT) Received: from pandora.afflictions.org (asylum.afflictions.org [64.7.134.90]) by mx1.FreeBSD.org (Postfix) with ESMTP id 0C88D43D31 for ; Wed, 7 Jul 2004 02:32:27 +0000 (GMT) (envelope-from dgerow@afflictions.org) Received: from dementia.afflictions.org (dementia.afflictions.org [172.19.206.56]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by pandora.afflictions.org (Postfix) with ESMTP id A9A9E78C7D for ; Tue, 6 Jul 2004 22:34:36 -0400 (EDT) Received: by dementia.afflictions.org (Postfix, from userid 1001) id E97B3170C3; Tue, 6 Jul 2004 22:32:05 -0400 (EDT) Date: Tue, 6 Jul 2004 22:32:05 -0400 From: Damian Gerow To: current@freebsd.org Message-ID: <20040707023205.GA24734@afflictions.org> Mail-Followup-To: current@freebsd.org Mime-Version: 1.0 Content-Type: text/plain; charset=unknown-8bit Content-Disposition: inline Content-Transfer-Encoding: 8bit X-Operating-System: FreeBSD 5.2-CURRENT on a i386 X-GPG-Fingerprint: B3D7 D901 A53A 1A99 BFD6 E6DF 9F3B 742B C288 9CC9 User-Agent: Mutt/1.5.6i Subject: Repeatable, reproducible, and random panics when ripping a CD X-BeenThere: freebsd-current@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Discussions about the use of FreeBSD-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 07 Jul 2004 02:32:30 -0000 (Continuation of split thread from a few days ago.) I've rebooted into a -CURRENT from this morning, patching manually for the ULE/preemption disagreement. Wondering if the ithread fixup from earlier this week would have any bearing on my panics (as some of them had something to do with ithread), I tried again, and retrieved yet another panic -- this time somewhere in ACPI. Here's the crash. I'll refrain from producing any more panics to avoid confusion, but am willing to dig into this further if asked. Before the crash, I received a large number of SCSI TRANSPORT errors -- I'm ripping through cd(4) devices. I believe I still get a crash if I rip through acd(4) devices. ---- # gdb6 -k kernel.debug /var/crash/vmcore.0 GNU gdb 20040615 [GDB v6.x for FreeBSD] Copyright 2004 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "i386-portbld-freebsd5.2"... panic messages: --- Fatal trap 12: page fault while in kernel mode cpuid = 1; apic id = 01 fault virtual address = 0x66 fault code = supervisor read, page not present instruction pointer = 0x8:0xc046258e stack pointer = 0x10:0xd3f3eb14 frame pointer = 0x10:0xd3f3eb34 code segment = base 0x0, limit 0xfffff, type 0x1b = DPL 0, pres 1, def32 1, gran 1 processor eflags = interrupt enabled, resume, IOPL = 0 current process = 46 (acpi_thermal) kernel: type 12 trap, code=0 Dumping 511 MB 16 32 48 64 80 96 112 128 144 160 176 192 208 224 240 256 272 288 304 320 336 352 368 384 400 416 432 448 464 480 496 --- #0 doadump () at /usr/src/sys/kern/kern_shutdown.c:236 236 dumping++; doadump () at /usr/src/sys/kern/kern_shutdown.c:236 236 dumping++; (kgdb) backtrace #0 doadump () at /usr/src/sys/kern/kern_shutdown.c:236 #1 0xc048380e in db_fncall (dummy1=1936, dummy2=0, dummy3=0, dummy4=0xd3f3e930 "Ï\a") at /usr/src/sys/ddb/db_command.c:551 #2 0xc04834ce in db_command (last_cmdp=0xc07bcb70, cmd_table=0x0, aux_cmd_tablep=0xc078339c, aux_cmd_tablep_end=0xc07833a0) at /usr/src/sys/ddb/db_command.c:348 #3 0xc0483713 in db_command_loop () at /usr/src/sys/ddb/db_command.c:475 #4 0xc048636a in db_trap (type=12, code=0) at /usr/src/sys/ddb/db_trap.c:73 #5 0xc0701351 in kdb_trap (type=12, code=0, regs=0xd3f3ead4) at /usr/src/sys/i386/i386/db_interface.c:159 #6 0xc0716fff in trap_fatal (frame=0xd3f3ead4, eva=0) at /usr/src/sys/i386/i386/trap.c:810 #7 0xc0716cae in trap_pfault (frame=0xd3f3ead4, usermode=0, eva=102) at /usr/src/sys/i386/i386/trap.c:733 #8 0xc07168ef in trap (frame= {tf_fs = -739049448, tf_es = -739049456, tf_ds = -739049456, tf_edi = 36803, tf_esi = -1046789344, tf_ebp = -738989260, tf_isp = -738989312, tf_ebx = 100, tf_edx = 100, tf_ecx = 0, tf_eax = 100, tf_trapno = 12, tf_err = 0, tf_eip = -1069144690, tf_cs = 8, tf_eflags = 66050, tf_esp = 0, tf_ss = -1046789344}) at /usr/src/sys/i386/i386/trap.c:420 #9 0xc0702b9a in calltrap () at /usr/src/sys/i386/i386/exception.s:140 #10 0xd3f30018 in ?? () #11 0xd3f30010 in ?? () #12 0xd3f30010 in ?? () #13 0x00008fc3 in ?? () #14 0xc19b4320 in ?? () #15 0xd3f3eb34 in ?? () #16 0xd3f3eb00 in ?? () #17 0x00000064 in ?? () #18 0x00000064 in ?? () #19 0x00000000 in ?? () #20 0x00000064 in ?? () #21 0x0000000c in ?? () #22 0x00000000 in ?? () #23 0xc046258e in AcpiNsDeleteNamespaceByOwner (OwnerId=36803) at /usr/src/sys/contrib/dev/acpica/nsalloc.c:748 #24 0xc04543d8 in AcpiDsTerminateControlMethod (WalkState=0xc1a5b000) at /usr/src/sys/contrib/dev/acpica/dsmethod.c:679 #25 0xc046616a in AcpiPsParseAml (WalkState=0xc1a5b000) at /usr/src/sys/contrib/dev/acpica/psparse.c:1355 #26 0xc0466bfc in AcpiPsxExecute (Info=0xd3f3ec44) at /usr/src/sys/contrib/dev/acpica/psxface.c:288 #27 0xc04628b9 in AcpiNsExecuteControlMethod (Info=0xd3f3ec44) at /usr/src/sys/contrib/dev/acpica/nseval.c:518 #28 0xc046284c in AcpiNsEvaluateByHandle (Info=0xd3f3ec44) at /usr/src/sys/contrib/dev/acpica/nseval.c:418 #29 0xc04626dd in AcpiNsEvaluateRelative (Pathname=0x0, Info=0xd3f3ec44) at /usr/src/sys/contrib/dev/acpica/nseval.c:229 #30 0xc046411b in AcpiEvaluateObject (Handle=0xc19b8c40, Pathname=0xc075506a "_TMP", ExternalParams=0x0, ReturnBuffer=0xd3f3ec78) at /usr/src/sys/contrib/dev/acpica/nsxfeval.c:363 #31 0xc0488a04 in acpi_GetInteger (handle=0xc19b8c40, path=0xc075506a "_TMP", number=0xd3f3ecd4) at /usr/src/sys/dev/acpica/acpi.c:1528 #32 0xc04940c5 in acpi_tz_monitor (Context=0xc1a44a00) at /usr/src/sys/dev/acpica/acpi_thermal.c:403 #33 0xc0494944 in acpi_tz_thread (arg=0x0) at /usr/src/sys/dev/acpica/acpi_thermal.c:799 #34 0xc0520ffb in fork_exit (callout=0xc049486b , arg=0x0, frame=0x0) at /usr/src/sys/kern/kern_fork.c:815 #35 0xc0702bfc in fork_trampoline () at /usr/src/sys/i386/i386/exception.s:209 (kgdb) list *0xc046258e 0xc046258e is in AcpiNsDeleteNamespaceByOwner (/usr/src/sys/contrib/dev/acpica/nsalloc.c:750). 745 DeletionNode = NULL; 746 } 747 748 if (ChildNode) 749 { 750 if (ChildNode->OwnerId == OwnerId) 751 { 752 /* Found a matching child node - detach any attached object */ 753 754 AcpiNsDetachObject (ChildNode); (kgdb)