kern/128076: Fatal trap 12: page fault while in kernel mode

Mon Oct 13 22:10:01 UTC 2008

>Number:         128076
>Category:       kern
>Synopsis:       Fatal trap 12: page fault while in kernel mode
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Mon Oct 13 22:10:01 UTC 2008
>Closed-Date:
>Last-Modified:
>Originator:     Barbara
>Release:        6-STABLE
>Organization:
>Environment:
FreeBSD satanasso.local.net 6.4-PRERELEASE FreeBSD 6.4-PRERELEASE #0: Sun Oct  5 16:37:54 CEST 2008     root at satanasso.local.net:/usr/obj/usr/src/sys/SATANASSO  i386
>Description:
Since about a week I'm having some kernel faults.
The backtrace obtained today points to the same portion of code of the first one reported by me two days ago here:
http://lists.freebsd.org/pipermail/freebsd-stable/2008-October/045865.html

There is at least one similar case for 7.1-PRERELEASE reported here:
http://lists.freebsd.org/pipermail/freebsd-stable/2008-September/045405.html

Even this time there are messages about acd0 but no media was inserted during the whole uptime.

# kgdb kernel.debug /var/crash/vmcore.4
GNU gdb 6.1.1 [FreeBSD]
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i386-marcel-freebsd"...

Unread portion of the kernel message buffer:
acd0: WARNING - TEST_UNIT_READY read data overrun 18>0
kernel trap 12 with interrupts disabled

Fatal trap 12: page fault while in kernel mode
cpuid = 0; apic id = 00
fault virtual address	= 0x104
fault code		= supervisor read, page not present
instruction pointer	= 0x20:0xc05419e5
stack pointer	        = 0x28:0xe5928c00
frame pointer	        = 0x28:0xe5928c18
code segment		= base 0x0, limit 0xfffff, type 0x1b
			= DPL 0, pres 1, def32 1, gran 1
processor eflags	= resume, IOPL = 0
current process		= 17 (swi6: task queue)
trap number		= 12
panic: page fault
cpuid = 0
Uptime: 13h53m36s
Physical memory: 2031 MB
Dumping 269 MB: 254 238 222 206 190 174 158 142 126 110 94 78 62 46 30 14

Reading symbols from /boot/kernel/linux.ko...done.
Loaded symbols for /boot/kernel/linux.ko
Reading symbols from /boot/modules/nvidia.ko...done.
Loaded symbols for /boot/modules/nvidia.ko
Reading symbols from /boot/kernel/acpi.ko...done.
Loaded symbols for /boot/kernel/acpi.ko
Reading symbols from /boot/kernel/linprocfs.ko...done.
Loaded symbols for /boot/kernel/linprocfs.ko
Reading symbols from /boot/kernel/logo_saver.ko...done.
Loaded symbols for /boot/kernel/logo_saver.ko
#0  doadump () at pcpu.h:165
165	pcpu.h: No such file or directory.
	in pcpu.h
(kgdb) bt
#0  doadump () at pcpu.h:165
#1  0xc054d419 in boot (howto=260) at /usr/src/sys/kern/kern_shutdown.c:410
#2  0xc054d7e6 in panic (fmt=0xc0736da9 "%s")
    at /usr/src/sys/kern/kern_shutdown.c:566
#3  0xc071822c in trap_fatal (frame=0xe5928bc0, eva=0)
    at /usr/src/sys/i386/i386/trap.c:838
#4  0xc07178e4 in trap (frame=
      {tf_fs = 8, tf_es = 40, tf_ds = 40, tf_edi = -960560384, tf_esi = 4, tf_ebp = -443380712, tf_isp = -443380756, tf_ebx = -928399708, tf_edx = 6, tf_ecx = 4, tf_eax = 1, tf_trapno = 12, tf_err = 0, tf_eip = -1068230171, tf_cs = 32, tf_eflags = 65538, tf_esp = -928399708, tf_ss = 0})
    at /usr/src/sys/i386/i386/trap.c:270
#5  0xc06ffaaa in calltrap () at /usr/src/sys/i386/i386/exception.s:139
#6  0xc05419e5 in _mtx_lock_sleep (m=0xc8a9bea4, tid=3334406912, opts=0, 
    file=0x0, line=0) at /usr/src/sys/kern/kern_mutex.c:546
#7  0xc054c6b9 in _sema_post (sema=0xc8a9bea4, file=0x0, line=0)
    at /usr/src/sys/kern/kern_sema.c:79
#8  0xc04705e3 in ata_completed (context=0xc8a9be58, dummy=1)
    at /usr/src/sys/dev/ata/ata-queue.c:481
#9  0xc05757dd in taskqueue_run (queue=0xc6c8a000)
    at /usr/src/sys/kern/subr_taskqueue.c:257
#10 0xc0575af3 in taskqueue_swi_run (dummy=0x0)
    at /usr/src/sys/kern/subr_taskqueue.c:299
---Type <return> to continue, or q <return> to quit---
#11 0xc052fbcb in ithread_execute_handlers (p=0xc6bef860, ie=0xc6c44e80)
    at /usr/src/sys/kern/kern_intr.c:682
#12 0xc052fd27 in ithread_loop (arg=0xc6c62550)
    at /usr/src/sys/kern/kern_intr.c:766
#13 0xc052e4b0 in fork_exit (callout=0xc052fcc0 <ithread_loop>, arg=0x1, 
    frame=0x1) at /usr/src/sys/kern/kern_fork.c:788
#14 0xc06ffb0c in fork_trampoline () at /usr/src/sys/i386/i386/exception.s:208
(kgdb) up 6
#6  0xc05419e5 in _mtx_lock_sleep (m=0xc8a9bea4, tid=3334406912, opts=0, 
    file=0x0, line=0) at /usr/src/sys/kern/kern_mutex.c:546
546			owner = (struct thread *)(v & MTX_FLAGMASK);
(kgdb) list
541	#if defined(SMP) && !defined(NO_ADAPTIVE_MUTEXES)
542			/*
543			 * If the current owner of the lock is executing on another
544			 * CPU, spin instead of blocking.
545			 */
546			owner = (struct thread *)(v & MTX_FLAGMASK);
547	#ifdef ADAPTIVE_GIANT
548			if (TD_IS_RUNNING(owner)) {
549	#else
550			if (m != &Giant && TD_IS_RUNNING(owner)) {
(kgdb) print v
$1 = 6
(kgdb) q
#

>How-To-Repeat:

>Fix:

>Release-Note:
>Audit-Trail:
>Unformatted: