From owner-freebsd-bugs Wed Oct 24 12:20:28 2001 Delivered-To: freebsd-bugs@hub.freebsd.org Received: from freefall.freebsd.org (freefall.FreeBSD.org [216.136.204.21]) by hub.freebsd.org (Postfix) with ESMTP id 0F2FF37B403 for ; Wed, 24 Oct 2001 12:20:04 -0700 (PDT) Received: (from gnats@localhost) by freefall.freebsd.org (8.11.4/8.11.4) id f9OJK3b89011; Wed, 24 Oct 2001 12:20:03 -0700 (PDT) (envelope-from gnats) Date: Wed, 24 Oct 2001 12:20:03 -0700 (PDT) Message-Id: <200110241920.f9OJK3b89011@freefall.freebsd.org> To: freebsd-bugs@FreeBSD.org Cc: From: Syam Gadde Subject: Re: kern/31460: ATAPI CD-ROM makes system reboot with DVD movie. Reply-To: Syam Gadde Sender: owner-freebsd-bugs@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org The following reply was made to PR kern/31460; it has been noted by GNATS. From: Syam Gadde To: freebsd-gnats-submit@FreeBSD.org, juha.o.ylitalo@nokia.com Cc: Subject: Re: kern/31460: ATAPI CD-ROM makes system reboot with DVD movie. Date: Wed, 24 Oct 2001 15:11:34 -0400 (I submitted a PR about this too, but I neglected to put in a valid email address in the From header so it may have been rejected) I've been seeing this for a while now too, at least since just after 4.4-RELEASE. Attached is a backtrace and dmesg from my panic (note the bytecount field of the atapi_request - it seems wacky). These panics always come through atapi_intr => atapi_interrupt => atapi_read, and always occur at the insl() instruction in atapi_read. This panic occurs whenever I attempt to read a file that exists beyond the 4GB boundary, but only on my encrypted DVDs (say, The Matrix and A Bug's Life). So, for example cat /cdrom0/video_ts/vts_02_6.vob > /dev/null will cause a panic on my machine. Note also this occurs even when the DVD is still locked, so it may happen before the kernel recognizes a read error. yosemite gadde [0] 48> uname -a FreeBSD yosemite.cs.duke.edu 4.4-STABLE FreeBSD 4.4-STABLE #73: Mon Oct 15 16:01:58 EDT 2001 gadde@yosemite.cs.duke.edu:/usr/src/sys/compile/YOSEMITE i386 GDB output: GNU gdb 4.18 Copyright 1998 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "i386-unknown-freebsd"... IdlePTD 3596288 initial pcb at 2d6f40 panicstr: from debugger panic messages: --- panic: vm_fault: fault on nofault entry, addr: c5658000 panic: from debugger Uptime: 6m32s dumping to dev #ad/0x20009, offset 393216 dump ata0: resetting devices .. ata0: mask=03 ostat0=50 ostat2=50 ata0-master: ATAPI probe a=00 b=00 ata0-slave: ATAPI probe a=00 b=00 ata0: mask=03 status0=50 status1=50 ata0-master: ATA probe a=01 b=a5 ata0-slave: ATA probe a=01 b=a5 ata0: devices=03 ata0-master: success setting UDMA2 on Intel chip ata0-slave: success setting PIO4 on generic chip done 192 191 190 189 188 187 186 185 184 183 182 181 180 179 178 177 176 175 174 173 172 171 170 169 168 167 166 165 164 163 162 161 160 159 158 157 156 155 154 153 152 151 150 149 148 147 146 145 144 143 142 141 140 139 138 137 136 135 134 133 132 131 130 129 128 127 126 125 124 123 122 121 120 119 118 117 116 115 114 113 112 111 110 109 108 107 106 105 104 103 102 101 100 99 98 97 96 95 94 93 92 91 90 89 88 87 86 85 84 83 82 81 80 79 78 77 76 75 74 73 72 71 70 69 68 67 66 65 64 63 62 61 60 59 58 57 56 55 54 53 52 51 50 49 48 47 46 45 44 43 42 41 40 39 38 37 36 35 34 33 32 31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 --- #0 dumpsys () at ../../kern/kern_shutdown.c:473 473 if (dumping++) { (kgdb) set output-radix 16 Output radix now set to decimal 16, hex 10, octal 20. (kgdb) bt #0 dumpsys () at ../../kern/kern_shutdown.c:473 #1 0xc015191b in boot (howto=0x104) at ../../kern/kern_shutdown.c:313 #2 0xc0151d01 in panic (fmt=0xc027b284 "from debugger") at ../../kern/kern_shutdown.c:581 #3 0xc0122bed in db_panic (addr=0xc0251f74, have_addr=0x0, count=0xffffffff, modif=0xc02b04c8 "") at ../../ddb/db_command.c:435 #4 0xc0122b8d in db_command (last_cmdp=0xc02b1994, cmd_table=0xc02b17d4, aux_cmd_tablep=0xc02d1fb8) at ../../ddb/db_command.c:333 #5 0xc0122c52 in db_command_loop () at ../../ddb/db_command.c:457 #6 0xc0124d6f in db_trap (type=0x3, code=0x0) at ../../ddb/db_trap.c:71 #7 0xc0251d16 in kdb_trap (type=0x3, code=0x0, regs=0xc02b05d0) at ../../i386/i386/db_interface.c:158 #8 0xc0261bc8 in trap (frame={tf_fs = 0xc02d0010, tf_es = 0xc02d0010, tf_ds = 0xc5650010, tf_edi = 0xc5658000, tf_esi = 0x100, tf_ebp = 0xc02b0618, tf_isp = 0xc02b05fc, tf_ebx = 0xc02927e0, tf_edx = 0x0, tf_ecx = 0x20, tf_eax = 0x12, tf_trapno = 0x3, tf_err = 0x0, tf_eip = 0xc0251f74, tf_cs = 0x8, tf_eflags = 0x246, ---Type to continue, or q to quit--- tf_esp = 0xc02a1e5f, tf_ss = 0xc028189b}) at ../../i386/i386/trap.c:574 #9 0xc0251f74 in Debugger (msg=0xc028189b "panic") at machine/cpufunc.h:67 #10 0xc0151cf8 in panic ( fmt=0xc02927e0 "vm_fault: fault on nofault entry, addr: %lx") at ../../kern/kern_shutdown.c:579 #11 0xc020a154 in vm_fault (map=0xc02de52c, vaddr=0xc5658000, fault_type=0x3, fault_flags=0x0) at ../../vm/vm_fault.c:240 #12 0xc0261ece in trap_pfault (frame=0xc02b0750, usermode=0x0, eva=0xc5658000) at ../../i386/i386/trap.c:838 #13 0xc0261a9b in trap (frame={tf_fs = 0xc0150010, tf_es = 0xffff0010, tf_ds = 0xc49c0010, tf_edi = 0xc5658000, tf_esi = 0x800, tf_ebp = 0xc02b07a0, tf_isp = 0xc02b077c, tf_ebx = 0xc0d11a80, tf_edx = 0x170, tf_ecx = 0x200, tf_eax = 0xc0be5c00, tf_trapno = 0xc, tf_err = 0x2, tf_eip = 0xc0235172, tf_cs = 0x8, tf_eflags = 0x10206, tf_esp = 0xc0bfada0, tf_ss = 0xc0d11a80}) at ../../i386/i386/trap.c:448 #14 0xc0235172 in atapi_read (request=0xc0d11a80, length=0x800) at machine/cpufunc.h:225 ---Type to continue, or q to quit--- #15 0xc0234c07 in atapi_interrupt (request=0xc0d11a80) at ../../dev/ata/atapi-all.c:391 #16 0xc022e0a6 in ata_intr (data=0xc0be5c00) at ../../dev/ata/ata-all.c:1165 (kgdb) up 14 #14 0xc0235172 in atapi_read (request=0xc0d11a80, length=0x800) at machine/cpufunc.h:225 225 __asm __volatile("cld; rep; insl" (kgdb) info locals port = 0x0 addr = (void *) 0xc5658000 cnt = 0x0 request = (struct atapi_request *) 0x68c048 buffer = (int8_t **) 0xc0d11acc size = 0x800 resid = 0xc5658000 (kgdb) info registers eax 0x0 0x0 ecx 0x0 0x0 edx 0x0 0x0 ebx 0x68c048 0x68c048 esp 0xc02b0448 0xc02b0448 ebp 0xc02b07a0 0xc02b07a0 esi 0x800 0x800 edi 0xc5658000 0xc5658000 eip 0xc0252a40 0xc0252a40 eflags 0x0 0x0 cs 0x0 0x0 ss 0x0 0x0 ds 0x0 0x0 es 0x0 0x0 fs cannot read u area ptr for proc at 0 (kgdb) up #15 0xc0234c07 in atapi_interrupt (request=0xc0d11a80) at ../../dev/ata/atapi-all.c:391 391 atapi_read(request, length); (kgdb) p *request $1 = {device = 0xc0bfada0, ccb = "(\000\000/[.ó¤Ñ\000\000\000\000\000\000", ccbsize = 0xc, bytecount = 0x9d267800, donecount = 0x1000, timeout = 0xbb8, timeout_handle = {callout = 0xc49c56f0}, retries = 0x0, result = 0x0, error = 0x0, sense = {error_code = 0x0, valid = 0x0, segment = 0x0, sense_key = 0x0, reserved2_4 = 0x0, ili = 0x0, eom = 0x0, filemark = 0x0, cmd_info = 0x0, sense_length = 0x0, cmd_specific_info = 0x0, asc = 0x0, ascq = 0x0, replaceable_unit_code = 0x0, sk_specific = 0x0, sksv = 0x0, sk_specific1 = 0x0, sk_specific2 = 0x0}, flags = 0x1, data = 0xc5658000
, callback = 0xc02379a0 , dmatab = 0x0, driver = 0xc4a1bcc0, chain = {tqe_next = 0x0, tqe_prev = 0xc0be5c60}} (kgdb) info locals length = 0x800 request = (struct atapi_request *) 0xc0d11a80 atp = (struct atapi_softc *) 0xc0bfada0 reason = 0x0 dma_stat = 0x0 (kgdb) DMESG output (sorry for the pnp nonsense): Copyright (c) 1992-2001 The FreeBSD Project. Copyright (c) 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994 The Regents of the University of California. All rights reserved. FreeBSD 4.4-STABLE #73: Mon Oct 15 16:01:58 EDT 2001 gadde@yosemite.cs.duke.edu:/usr/src/sys/compile/YOSEMITE Calibrating clock(s) ... TSC clock: 451056844 Hz, i8254 clock: 1193271 Hz CLK_USE_I8254_CALIBRATION not specified - using default frequency Timecounter "i8254" frequency 1193182 Hz CLK_USE_TSC_CALIBRATION not specified - using old calibration method CPU: Pentium III/Pentium III Xeon/Celeron (451.02-MHz 686-class CPU) Origin = "GenuineIntel" Id = 0x672 Stepping = 2 Features=0x383f9ff real memory = 201326592 (196608K bytes) Physical memory chunk(s): 0x00001000 - 0x0009efff, 647168 bytes (158 pages) 0x00377000 - 0x0bff7fff, 197660672 bytes (48257 pages) avail memory = 192544768 (188032K bytes) bios32: Found BIOS32 Service Directory header at 0xc00faf00 bios32: Entry = 0xfb380 (c00fb380) Rev = 0 Len = 1 pcibios: PCI BIOS entry at 0xb3b0 pnpbios: Found PnP BIOS data at 0xc00fbfd0 pnpbios: Entry = f0000:bff8 Rev = 1.0 Other BIOS signatures found: ACPI: 00000000 Preloaded elf kernel "kernel" at 0xc034f000. Pentium Pro MTRR support enabled Math emulator present pci_open(1): mode 1 addr port (0x0cf8) is 0x8000005c pci_open(1a): mode1res=0x80000000 (0x80000000) pci_cfgcheck: device 0 [class=060000] [hdr=00] is there (id=71908086) Using $PIR table, 7 entries at 0xc00fdf00 npx0: on motherboard npx0: INT 16 interface pcib0: on motherboard found-> vendor=0x8086, dev=0x7190, revid=0x03 class=06-00-00, hdrtype=0x00, mfdev=0 subordinatebus=0 secondarybus=0 map[10]: type 1, range 32, base d0000000, size 26 found-> vendor=0x8086, dev=0x7191, revid=0x03 class=06-04-00, hdrtype=0x01, mfdev=0 subordinatebus=1 secondarybus=1 found-> vendor=0x8086, dev=0x7110, revid=0x02 class=06-01-00, hdrtype=0x00, mfdev=1 subordinatebus=0 secondarybus=0 found-> vendor=0x8086, dev=0x7111, revid=0x01 class=01-01-80, hdrtype=0x00, mfdev=0 subordinatebus=0 secondarybus=0 map[20]: type 1, range 32, base 0000f000, size 4 found-> vendor=0x8086, dev=0x7112, revid=0x01 class=0c-03-00, hdrtype=0x00, mfdev=0 subordinatebus=0 secondarybus=0 intpin=d, irq=3 map[20]: type 1, range 32, base 0000e000, size 5 found-> vendor=0x8086, dev=0x7113, revid=0x02 class=06-80-00, hdrtype=0x00, mfdev=0 subordinatebus=0 secondarybus=0 map[90]: type 1, range 32, base 00005000, size 4 found-> vendor=0x109e, dev=0x036e, revid=0x02 class=04-00-00, hdrtype=0x00, mfdev=1 subordinatebus=0 secondarybus=0 intpin=a, irq=3 map[10]: type 1, range 32, base d7140000, size 12 found-> vendor=0x109e, dev=0x0878, revid=0x02 class=04-80-00, hdrtype=0x00, mfdev=1 subordinatebus=0 secondarybus=0 intpin=a, irq=3 map[10]: type 1, range 32, base d7141000, size 12 found-> vendor=0x12eb, dev=0x0002, revid=0xfe class=04-01-00, hdrtype=0x00, mfdev=0 subordinatebus=0 secondarybus=0 intpin=a, irq=5 map[10]: type 1, range 32, base d7100000, size 18 map[14]: type 1, range 32, base 0000e400, size 3 map[18]: type 1, range 32, base 0000e800, size 3 found-> vendor=0x10ec, dev=0x8029, revid=0x00 class=02-00-00, hdrtype=0x00, mfdev=0 subordinatebus=0 secondarybus=0 intpin=a, irq=10 map[10]: type 1, range 32, base 0000ec00, size 5 found-> vendor=0x1105, dev=0x8300, revid=0x01 class=04-80-00, hdrtype=0x00, mfdev=0 subordinatebus=0 secondarybus=0 intpin=a, irq=11 map[10]: type 1, range 32, base d7000000, size 20 pci0: on pcib0 pcib1: at device 1.0 on pci0 found-> vendor=0x10de, dev=0x0020, revid=0x04 class=03-00-00, hdrtype=0x00, mfdev=0 subordinatebus=0 secondarybus=0 intpin=a, irq=11 map[10]: type 1, range 32, base d4000000, size 24 map[14]: type 1, range 32, base d6000000, size 24 pci1: on pcib1 pci1: (vendor=0x10de, dev=0x0020) at 0.0 irq 11 isab0: at device 7.0 on pci0 isa0: on isab0 atapci0: port 0xf000-0xf00f at device 7.1 on pci0 ata0: iobase=0x01f0 altiobase=0x03f6 bmaddr=0xf000 ata0: mask=03 status0=50 status1=50 ata0: mask=03 ostat0=50 ostat2=50 ata0-master: ATAPI probe a=00 b=00 ata0-slave: ATAPI probe a=00 b=00 ata0: mask=03 status0=52 status1=50 ata0-master: ATA probe a=01 b=a5 ata0-slave: ATA probe a=01 b=a5 ata0: devices=03 ata0: at 0x1f0 irq 14 on atapci0 ata1: iobase=0x0170 altiobase=0x0376 bmaddr=0xf008 ata1: mask=03 status0=50 status1=50 ata1: mask=03 ostat0=50 ostat2=50 ata1-master: ATAPI probe a=14 b=eb ata1-slave: ATAPI probe a=14 b=eb ata1: mask=03 status0=00 status1=10 ata1: devices=0c ata1: at 0x170 irq 15 on atapci0 uhci0: port 0xe000-0xe01f irq 3 at device 7.2 on pci0 usb0: on uhci0 usb0: USB revision 1.0 uhub0: Intel UHCI root hub, class 9/0, rev 1.00/1.00, addr 1 uhub0: 2 ports with 2 removable, self powered chip1: port 0x5000-0x500f at device 7.3 on pci0 bktr0: mem 0xd7140000-0xd7140fff irq 3 at device 9.0 on pci0 using shared irq3. iicbb0: on bti2c0 iicbus0: on iicbb0 master-only iicbus: iic devclass not found iicsmb0: on iicbus0 smbus0: on iicsmb0 smb0: on smbus0 smbus1: on bti2c0 smb1: on smbus1 brooktree0: PCI bus latency is 32. bktr0: buffer size 3555328, addr 0x5000000 bktr0: GPIO is 0x00fffffb bktr0: subsystem 0x0070 0x13eb bktr0: Hauppauge Model 62471 A bktr0: Hauppauge WinCast/TV, Philips FR1236 NTSC FM tuner, dbx stereo. pci0: (vendor=0x109e, dev=0x0878) at 9.1 irq 3 pci0: (vendor=0x12eb, dev=0x0002) at 11.0 irq 5 ed0: port 0xec00-0xec1f irq 10 at device 13.0 on pci0 bpf: ed0 attached ed0: address 00:80:c8:fc:a6:20, type NE2000 (16 bit) pci0: (vendor=0x1105, dev=0x8300) at 15.0 irq 11 Trying Read_Port at 203 SCM0469: adding io range 0x3e0-0x3ff, size=0x2, align=0x2 pnpbios: 16 devices, largest 69 bytes PNP0000: adding irq mask 00x4 PNP0000: adding io range 0x20-0x21, size=0x2, align=0 PNP0000: adding io range 0xa0-0xa1, size=0x2, align=0 PNP0000: end config pnpbios: handle 0 device ID PNP0000 (0000d041) PNP0200: adding dma mask 0x10 PNP0200: adding io range 0-0xf, size=0x10, align=0 PNP0200: adding io range 0x81-0x83, size=0x3, align=0 PNP0200: adding io range 0x87-0x87, size=0x1, align=0 PNP0200: adding io range 0x89-0x8b, size=0x3, align=0 PNP0200: adding io range 0x8f-0x91, size=0x3, align=0 PNP0200: adding io range 0xc0-0xdf, size=0x20, align=0 PNP0200: end config pnpbios: handle 1 device ID PNP0200 (0002d041) PNP0100: adding irq mask 00x1 PNP0100: adding io range 0x40-0x43, size=0x4, align=0 PNP0100: end config pnpbios: handle 2 device ID PNP0100 (0001d041) PNP0b00: adding irq mask 0x100 PNP0b00: adding io range 0x70-0x71, size=0x2, align=0 PNP0b00: end config pnpbios: handle 3 device ID PNP0b00 (000bd041) PNP0303: adding irq mask 00x2 PNP0303: adding io range 0x60-0x60, size=0x1, align=0 PNP0303: adding io range 0x64-0x64, size=0x1, align=0 PNP0303: end config pnpbios: handle 4 device ID PNP0303 (0303d041) PNP0800: adding io range 0x61-0x61, size=0x1, align=0 PNP0800: end config pnpbios: handle 5 device ID PNP0800 (0008d041) PNP0c04: adding irq mask 0x2000 PNP0c04: adding io range 0xf0-0xff, size=0x10, align=0 PNP0c04: end config pnpbios: handle 6 device ID PNP0c04 (040cd041) PNP0c01: adding fixed memory32 range 0-0x9ffff, size=0xa0000 PNP0c01: adding fixed memory32 range 0xfffe0000-0xffffffff, size=0x20000 PNP0c01: adding fixed memory32 range 0x100000-0xbffffff, size=0xbf00000 PNP0c01: end config pnpbios: handle 7 device ID PNP0c01 (010cd041) PNP0c02: adding fixed memory32 range 0xf0000-0xf3fff, size=0x4000 PNP0c02: adding fixed memory32 range 0xf4000-0xf7fff, size=0x4000 PNP0c02: adding fixed memory32 range 0xf8000-0xfffff, size=0x8000 PNP0c02: adding fixed memory32 range 0xc8800-0xcbfff, size=0x3800 PNP0c02: end config pnpbios: handle 8 device ID PNP0c02 (020cd041) PNP0a03: adding io range 0x294-0x297, size=0x4, align=0 PNP0a03: adding io range 0x4d0-0x4d1, size=0x2, align=0 PNP0a03: adding io range 0xcf8-0xcff, size=0x8, align=0 PNP0a03: adding io range 0x480-0x48f, size=0x10, align=0 PNP0a03: adding io range 0x4000-0x403f, size=0x40, align=0 PNP0a03: adding io range 0x5000-0x501f, size=0x20, align=0 PNP0a03: end config pnpbios: handle 9 device ID PNP0a03 (030ad041) PNP0f13: adding irq mask 0x1000 PNP0f13: end config pnpbios: handle 10 device ID PNP0f13 (130fd041) PNP0c02: adding io range 0x208-0x20f, size=0x8, align=0 PNP0c02: end config pnpbios: handle 11 device ID PNP0c02 (020cd041) PNP0501: adding irq mask 0x10 PNP0501: adding io range 0x3f8-0x3ff, size=0x8, align=0 PNP0501: end config pnpbios: handle 12 device ID PNP0501 (0105d041) PNP0700: adding dma mask 0x4 PNP0700: adding io range 0x3f2-0x3f5, size=0x4, align=0 PNP0700: adding irq mask 0x40 PNP0700: end config pnpbios: handle 13 device ID PNP0700 (0007d041) PNP0400: adding irq mask 0x80 PNP0400: adding io range 0x378-0x37f, size=0x8, align=0 PNP0400: end config pnpbios: handle 14 device ID PNP0400 (0004d041) PNP0501: adding irq mask 0000 PNP0501: adding io range 0-0xffffffff, size=0, align=0 PNP0501: end config pnpbios: handle 16 device ID PNP0501 (0105d041) isa_probe_children: disabling PnP devices isa_probe_children: probing non-PnP devices orm0: