Bug 21831

Summary: kernel trap 12 crash in 4.1.1-STABLE
Product: Base System Reporter: bjlin <bjlin>
Component: kernAssignee: Justin T. Gibbs <gibbs>
Status: Closed FIXED    
Severity: Affects Only Me    
Priority: Normal    
Version: 4.1.1-STABLE   
Hardware: Any   
OS: Any   

Description bjlin 2000-10-08 18:50:00 UTC
I've got random crash on 4.1.1-Stable.

I just updated the system 30 min. ago, and it just crashes 
when I make ports (or kernel, system).
It says fatal error 12 (page fault in kernel mode).
The debug message is:

Fault Virtual Address:  0x30
Fault Code: supervisor read, page not present.
Instruction Pointer: 0x8, 0xc01f7758
Stack Pointer: 0x10, 0xc028435c
Frame Pointer: 0x10, 0xc0284360
Code Segement: base rx0,limit 0xfffff type 0x1b
             : DPL 0,pres 1,def 32 1, gran 1
Processir eflags: int enabled, resume, IOPL=0
Current process: Idle
interrupt mask: bio cam
trap number : 12

How-To-Repeat: random crash, usually crash within 10 min.
Comment 1 gibbs 2000-10-08 19:12:13 UTC
> I've got random crash on 4.1.1-Stable.
> 
> I just updated the system 30 min. ago, and it just crashes 
> when I make ports (or kernel, system).
> It says fatal error 12 (page fault in kernel mode).
> The debug message is:

You need to:

a) Provide a dmesg listing from a boot -v of your system
   before the problems began.

b) Perform an nm /kernel | sort and locate the function that
   contains the instruction 0xc01f7758.

or even better yet

c) put options DDB into your kernel config file and provide
   the output of "trace" when you system panics.
 
--
Justin
Comment 2 wing 2000-10-10 14:27:11 UTC
>You need to:
>
> a) Provide a dmesg listing from a boot -v of your system
>    before the problems began.
%uname -a
FreeBSD camera.stic.gov.tw 4.1.1-STABLE FreeBSD 4.1.1-STABLE #1: Sun Oct  8
21:04:31 GMT 2000     root@camera.stic.gov.tw:/usr/src/sys/compile/camera
i386

%dmesg
Copyright (c) 1992-2000 The FreeBSD Project.
Copyright (c) 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994
        The Regents of the University of California. All rights reserved.
FreeBSD 4.1.1-STABLE #1: Sun Oct  8 21:04:31 GMT 2000
    root@camera.stic.gov.tw:/usr/src/sys/compile/camera
Timecounter "i8254"  frequency 1193182 Hz
CPU: Pentium III/Pentium III Xeon/Celeron (598.98-MHz 686-class CPU)
  Origin = "GenuineIntel"  Id = 0x673  Stepping = 3

Features=0x383fbff<FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,
CMOV,PAT,PSE36,MMX,FXSR,SSE>
real memory  = 536858624 (524276K bytes)
avail memory = 519630848 (507452K bytes)
Preloaded elf kernel "kernel" at 0xc030f000.
Pentium Pro MTRR support enabled
npx0: <math processor> on motherboard
npx0: INT 16 interface
pcib0: <Intel 82443BX (440 BX) host to PCI bridge> on motherboard
pci0: <PCI bus> on pcib0
pcib1: <Intel 82443BX (440 BX) PCI-PCI (AGP) bridge> at device 1.0 on pci0
pci1: <PCI bus> on pcib1
pci1: <Matrox MGA G400 AGP graphics accelerator> at 0.0 irq 9
fxp0: <Intel Pro 10/100B/100+ Ethernet> port 0x68e0-0x68ff mem
0xf7600000-0xf76fffff,0xeffff000-0xefffffff irq 14 at device 2.0 on pci0
fxp0: Ethernet address 00:06:29:ee:9f:be
ahc0: <Adaptec aic7895 Ultra SCSI adapter> port 0x7000-0x70ff mem
0xf75fd000-0xf75fdfff irq 10 at device 3.0 on pci0
aic7895C: Wide Channel A, SCSI Id=7, 32/255 SCBs
ahc1: <Adaptec aic7895 Ultra SCSI adapter> port 0x7400-0x74ff mem
0xf75fe000-0xf75fefff irq 10 at device 3.1 on pci0
aic7895C: Wide Channel B, SCSI Id=7, 32/255 SCBs
isab0: <Intel 82371AB PCI to ISA bridge> at device 4.0 on pci0
isa0: <ISA bus> on isab0
atapci0: <Intel PIIX4 ATA33 controller> port 0xfff0-0xffff at device 4.1 on
pci0
ata1: at 0x170 irq 15 on atapci0
pci0: <Intel 82371AB/EB (PIIX4) USB controller> at 4.2 irq 10
chip1: <Intel 82371AB Power management controller> port 0xfe00-0xfe0f at
device 4.3 on pci0
ahc2: <Adaptec 2940 Ultra2 SCSI adapter> port 0x7800-0x78ff mem
0xf75ff000-0xf75fffff irq 14 at device 14.0 on pci0
aic7890/91: Wide Channel A, SCSI Id=7, 32/255 SCBs
xl0: <3Com 3c905C-TX Fast Etherlink XL> port 0x6c00-0x6c7f mem
0xf75fcf80-0xf75fcfff irq 9 at device 16.0 on pci0
xl0: Ethernet address: 00:50:da:8a:6e:08
miibus0: <MII bus> on xl0
xlphy0: <3c905C 10/100 internal PHY> on miibus0
xlphy0:  10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, auto
fdc0: <NEC 72065B or clone> at port 0x3f0-0x3f5,0x3f7 irq 6 drq 2 on isa0
fdc0: FIFO enabled, 8 bytes threshold
fd0: <1440-KB 3.5" drive> on fdc0 drive 0
atkbdc0: <Keyboard controller (i8042)> at port 0x60,0x64 on isa0
atkbd0: <AT Keyboard> flags 0x1 irq 1 on atkbdc0
kbd0 at atkbd0
vga0: <Generic ISA VGA> at port 0x3c0-0x3df iomem 0xa0000-0xbffff on isa0
sc0: <System console> at flags 0x100 on isa0
sc0: VGA <16 virtual consoles, flags=0x300>
sio0 at port 0x3f8-0x3ff irq 4 flags 0x10 on isa0
sio0: type 16550A
sio1 at port 0x2f8-0x2ff irq 3 on isa0
sio1: type 16550A
ppc0: <Parallel port> at port 0x378-0x37f irq 7 on isa0
ppc0: Generic chipset (ECP/PS2/NIBBLE) in COMPATIBLE mode
ppc0: FIFO with 16/16/8 bytes threshold
ppi0: <Parallel I/O> on ppbus0
plip0: <PLIP network interface> on ppbus0
lpt0: <Printer> on ppbus0
lpt0: Interrupt-driven port
acd0: CDROM <LTN403> at ata1-master using PIO4
Waiting 5 seconds for SCSI devices to settle
da3 at ahc2 bus 0 target 6 lun 0
da3: <Proware 5960RN > Fixed Direct Access SCSI-2 device
da3: 40.000MB/s transfers (20.000MHz, offset 31, 16bit), Tagged Queueing
Enabled
da3: 208384MB (426770432 512 byte sectors: 255H 63S/T 26565C)
da0 at ahc0 bus 0 target 0 lun 0
da0: <IBM DMVS36V 0100> Fixed Direct Access SCSI-3 device
da0: 40.000MB/s transfers (20.000MHz, offset 8, 16bit), Tagged Queueing
Enabled
da0: 35003MB (71687340 512 byte sectors: 255H 63S/T 4462C)
da1 at ahc0 bus 0 target 1 lun 0
da1: <IBM DMVS36V 0100> Fixed Direct Access SCSI-3 device
da1: 40.000MB/s transfers (20.000MHz, offset 8, 16bit), Tagged Queueing
Enabled
da1: 35003MB (71687340 512 byte sectors: 255H 63S/T 4462C)
da2 at ahc1 bus 0 target 9 lun 0
da2: <Proware 5960RN > Fixed Direct Access SCSI-2 device
da2: 20.000MB/s transfers (10.000MHz, offset 8, 16bit), Tagged Queueing
Enabled
da2: 208384MB (426770432 512 byte sectors: 255H 63S/T 26565C)

>b) Perform an nm /kernel | sort and locate the function that
>   contains the instruction 0xc01f7758.
> nm /kernel | sort | grep c01f7

c01f7464 t ffs_indirtrunc
c01f771c t acquire_lock
c01f776c t free_lock
c01f7794 t acquire_lock_interlocked
c01f77d8 t free_lock_interlocked
c01f77fc t sema_init
c01f7828 t sema_get
c01f7894 t sema_release
c01f78d8 t worklist_insert
c01f7924 t worklist_remove
c01f7974 t workitem_free
c01f79b4 t add_to_worklist
c01f7a1c t softdep_process_worklist
c01f7c20 t softdep_move_dependencies
c01f7cd0 T softdep_flushfiles
c01f7e40 t pagedep_lookup
c01f7f94 t inodedep_lookup
Comment 3 bjlin 2000-10-12 09:55:50 UTC
I've just recompiled kernel with DDB option, here is the pr update:

ahc0:A:0:  ahc_intr - referenced scb not valid during seqint 0x73 scb (29)
ahc0: WARNING no command for scb 29 (cmdcmplt)
QOUTPOS: 100

Fault Virtual Address:  0x0
Fault Code: supervisor read, page not present.
Instruction Pointer: 0x8, 0xc01330fd
Stack Pointer: 0x10, 0xd5e46e90
Frame Pointer: 0x10, 0xd5e46ea0
Code Segement: base rx0,limit 0xfffff type 0x1b
             : DPL 0,pres 1,def 32 1, gran 1
Processir eflags: int enabled, resume, IOPL=0
Current process: 562 (cc1)
interrupt mask: cam
trap number : type 12,code = 0
stop at: ahc_match_scb+0x15:  movl 0(%edi),%eax

db>trace
ahc_match_scb(c14c9400,0,0,41,0,ff,0) at ahc_match_scb+0x15
ahc_search_qinfifo(c14c9400,0,41,0,ff) at ahc_search_qinfifo+0xef
ahc_freeze_devq(c14c9400,c14d63a8)at ahc_freeze_devq+0x5d
ahc_handle_seqint(c14c9400,6c4400,81ff8e0,9,bfbfa898) at
ahc_handle_seqint+0x148
ahc_freebsd_intr(c14c9400,6c4400,81ff8e0,9,bfbfa898 at ahc_freebsd_intr+0x94
intr_mux(c1039760,0,2f,2f,2f) at intr_mux+0x1d)
Xresume10() at Xresume10+0x2b
--interrupt, eip: 0x814383c, esp=0xd5e46fe0, ebp=0xbfbfa898

> nm /kernel | sort | grep c0133
c0133088 t ahc_busy_tcl
c01330e8 t ahc_match_scb
c01331dc T ahc_freeze_devq
c0133240 t ahc_qinfifo_requeue
c0133298 T ahc_search_qinfifo
c013371c T ahc_search_disc_list
c0133840 t ahc_rem_scb_from_disc_list
c01338b0 t ahc_add_curscb_to_free_list
c01338e8 t ahc_rem_wscb
c013397c t ahc_abort_scbs
c0133c60 t ahc_reset_current_bus
c0133ca8 T ahc_reset_channel
c0133ff0 t ahc_calc_residual

> uname -a
FreeBSD camera.stic.gov.tw 4.1.1-STABLE FreeBSD 4.1.1-STABLE #2: Wed Oct 11
11:32:54 GMT 2000     root@camera.stic.gov.tw:/usr/src/sys/compile/camera
i386

>dmesg
Copyright (c) 1992-2000 The FreeBSD Project.
Copyright (c) 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994
        The Regents of the University of California. All rights reserved.
FreeBSD 4.1.1-STABLE #2: Wed Oct 11 11:32:54 GMT 2000
    root@camera.stic.gov.tw:/usr/src/sys/compile/camera
Timecounter "i8254"  frequency 1193182 Hz
Timecounter "TSC"  frequency 598980154 Hz
CPU: Pentium III/Pentium III Xeon/Celeron (598.98-MHz 686-class CPU)
  Origin = "GenuineIntel"  Id = 0x673  Stepping = 3

Features=0x383fbff<FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,
CM
OV,PAT,PSE36,MMX,FXSR,SSE>
real memory  = 536858624 (524276K bytes)
avail memory = 519692288 (507512K bytes)
Preloaded elf kernel "kernel" at 0xc0301000.
Pentium Pro MTRR support enabled
npx0: <math processor> on motherboard
npx0: INT 16 interface
pcib0: <Intel 82443BX (440 BX) host to PCI bridge> on motherboard
pci0: <PCI bus> on pcib0
pcib1: <Intel 82443BX (440 BX) PCI-PCI (AGP) bridge> at device 1.0 on pci0
pci1: <PCI bus> on pcib1
pci1: <Matrox MGA G400 AGP graphics accelerator> at 0.0 irq 9
fxp0: <Intel Pro 10/100B/100+ Ethernet> port 0x68e0-0x68ff mem
0xf7600000-0xf76f
ffff,0xeffff000-0xefffffff irq 14 at device 2.0 on pci0
fxp0: Ethernet address 00:06:29:ee:9f:be
ahc0: <Adaptec aic7895 Ultra SCSI adapter> port 0x7000-0x70ff mem
0xf75fd000-0xf
75fdfff irq 10 at device 3.0 on pci0
aic7895C: Wide Channel A, SCSI Id=7, 32/255 SCBs
ahc1: <Adaptec aic7895 Ultra SCSI adapter> port 0x7400-0x74ff mem
0xf75fe000-0xf
75fefff irq 10 at device 3.1 on pci0
aic7895C: Wide Channel B, SCSI Id=7, 32/255 SCBs
isab0: <Intel 82371AB PCI to ISA bridge> at device 4.0 on pci0
isa0: <ISA bus> on isab0
atapci0: <Intel PIIX4 ATA33 controller> port 0xfff0-0xffff at device 4.1 on
pci0
ata1: at 0x170 irq 15 on atapci0
pci0: <Intel 82371AB/EB (PIIX4) USB controller> at 4.2 irq 10
chip1: <Intel 82371AB Power management controller> port 0xfe00-0xfe0f at
device
4.3 on pci0
ahc2: <Adaptec 2940 Ultra2 SCSI adapter> port 0x7800-0x78ff mem
0xf75ff000-0xf75
fffff irq 14 at device 14.0 on pci0
aic7890/91: Wide Channel A, SCSI Id=7, 32/255 SCBs
xl0: <3Com 3c905C-TX Fast Etherlink XL> port 0x6c00-0x6c7f mem
0xf75fcf80-0xf75f
cfff irq 9 at device 16.0 on pci0
xl0: Ethernet address: 00:50:da:8a:6e:08
miibus0: <MII bus> on xl0
xlphy0: <3c905C 10/100 internal PHY> on miibus0
xlphy0:  10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, auto
fdc0: <NEC 72065B or clone> at port 0x3f0-0x3f5,0x3f7 irq 6 drq 2 on isa0
fdc0: FIFO enabled, 8 bytes threshold
fd0: <1440-KB 3.5" drive> on fdc0 drive 0
atkbdc0: <Keyboard controller (i8042)> at port 0x60,0x64 on isa0
atkbd0: <AT Keyboard> flags 0x1 irq 1 on atkbdc0
kbd0 at atkbd0
vga0: <Generic ISA VGA> at port 0x3c0-0x3df iomem 0xa0000-0xbffff on isa0
sc0: <System console> at flags 0x100 on isa0
sc0: VGA <16 virtual consoles, flags=0x300>
sio0 at port 0x3f8-0x3ff irq 4 flags 0x10 on isa0
sio0: type 16550A
sio1 at port 0x2f8-0x2ff irq 3 on isa0
sio1: type 16550A
ppc0: <Parallel port> at port 0x378-0x37f irq 7 on isa0
ppc0: Generic chipset (ECP/PS2/NIBBLE) in COMPATIBLE mode
ppc0: FIFO with 16/16/8 bytes threshold
plip0: <PLIP network interface> on ppbus0
lpt0: <Printer> on ppbus0
lpt0: Interrupt-driven port
ppi0: <Parallel I/O> on ppbus0
acd0: CDROM <LTN403> at ata1-master using PIO4
Waiting 5 seconds for SCSI devices to settle
da3 at ahc2 bus 0 target 6 lun 0
da3: <Proware 5960RN > Fixed Direct Access SCSI-2 device
da3: 40.000MB/s transfers (20.000MHz, offset 31, 16bit), Tagged Queueing
Enabled
da3: 208384MB (426770432 512 byte sectors: 255H 63S/T 26565C)
da0 at ahc0 bus 0 target 0 lun 0
da0: <IBM DMVS36V 0100> Fixed Direct Access SCSI-3 device
da0: 40.000MB/s transfers (20.000MHz, offset 8, 16bit), Tagged Queueing
Enabled
da0: 35003MB (71687340 512 byte sectors: 255H 63S/T 4462C)
da1 at ahc0 bus 0 target 1 lun 0
da1: <IBM DMVS36V 0100> Fixed Direct Access SCSI-3 device
da1: 40.000MB/s transfers (20.000MHz, offset 8, 16bit), Tagged Queueing
Enabled
da1: 35003MB (71687340 512 byte sectors: 255H 63S/T 4462C)
da2 at ahc1 bus 0 target 9 lun 0
da2: <Proware 5960RN > Fixed Direct Access SCSI-2 device
da2: 20.000MB/s transfers (10.000MHz, offset 8, 16bit), Tagged Queueing
Enabled
da2: 208384MB (426770432 512 byte sectors: 255H 63S/T 26565C)


kernel config:
machine         i386
cpu             I686_CPU
ident           camera
maxusers        64

#makeoptions    DEBUG=-g                #Build kernel with gdb(1) debug
symbols
makeoptions     COPTFLAGS="-O2 -pipe"

options         MATH_EMULATE            #Support for x87 emulation
options         INET                    #InterNETworking
options         FFS                     #Berkeley Fast Filesystem
options         FFS_ROOT                #FFS usable as root device [keep
this!]
options         SOFTUPDATES             #Enable FFS soft updates support
options         NFS                     #Network Filesystem
options         CD9660                  #ISO 9660 Filesystem
options         PROCFS                  #Process filesystem
options         COMPAT_43               #Compatible with BSD 4.3 [KEEP
THIS!]
options         SCSI_DELAY=5000         #Delay (in ms) before probing SCSI
options         UCONSOLE                #Allow users to grab the console
options         USERCONFIG              #boot -c editor
options         VISUAL_USERCONFIG       #visual boot -c editor
options         KTRACE                  #ktrace(1) support
options         SYSVSHM                 #SYSV-style shared memory
options         SYSVMSG                 #SYSV-style message queues
options         SYSVSEM                 #SYSV-style semaphores
options         P1003_1B                #Posix P1003_1B real-time extensions
options         _KPOSIX_PRIORITY_SCHEDULING
options         ICMP_BANDLIM            #Rate limit bad replies
options         KBD_INSTALL_CDEV        # install a CDEV entry in /dev

# To make an SMP kernel, the next two are needed
#options        SMP                     # Symmetric MultiProcessor Kernel
#options        APIC_IO                 # Symmetric (APIC) I/O
# Optionally these may need tweaked, (defaults shown):
#options        NCPU=2                  # number of CPUs
#options        NBUS=4                  # number of busses
#options        NAPIC=1                 # number of IO APICs
#options        NINTR=24                # number of INTs

#
# Enable the kernel debugger.
#
options         DDB

device          isa
device          pci

# Floppy drives
device          fdc0    at isa? port IO_FD1 irq 6 drq 2
device          fd0     at fdc0 drive 0
device          fd1     at fdc0 drive 1

# ATA and ATAPI devices
device          ata0    at isa? port IO_WD1 irq 14
device          ata1    at isa? port IO_WD2 irq 15
device          ata
device          atadisk                 # ATA disk drives
device          atapicd                 # ATAPI CDROM drives
device          atapifd                 # ATAPI floppy drives
device          atapist                 # ATAPI tape drives
options         ATA_STATIC_ID           #Static device numbering
#options        ATA_ENABLE_ATAPI_DMA    #Enable DMA on ATAPI devices

# SCSI Controllers
device          ahc             # AHA2940 and onboard AIC7xxx devices

# SCSI peripherals
device          scbus           # SCSI bus (required)
device          da              # Direct Access (disks)
#device         sa              # Sequential Access (tape etc)
device          cd              # CD
device          pass            # Passthrough device (direct SCSI access)

# atkbdc0 controls both the keyboard and the PS/2 mouse
device          atkbdc0 at isa? port IO_KBD
device          atkbd0  at atkbdc? irq 1 flags 0x1
device          psm0    at atkbdc? irq 12

device          vga0    at isa?

# splash screen/screen saver
pseudo-device   splash

# syscons is the default console driver, resembling an SCO console
device          sc0     at isa? flags 0x100

# Enable this and PCVT_FREEBSD for pcvt vt220 compatible console driver
#device         vt0     at isa?
#options        XSERVER                 # support for X server on a vt
console
#options        FAT_CURSOR              # start with block cursor
# If you have a ThinkPAD, uncomment this along with the rest of the PCVT
lines
#options        PCVT_SCANSET=2          # IBM keyboards are non-std

# Floating point support - do not disable.
device          npx0    at nexus? port IO_NPX irq 13

# Power management support (see LINT for more options)
#device         apm0    at nexus? disable flags 0x20 # Advanced Power
Management

# PCCARD (PCMCIA) support
#device         card
#device         pcic0   at isa? irq 10 port 0x3e0 iomem 0xd0000
#device         pcic1   at isa? irq 11 port 0x3e2 iomem 0xd4000 disable

# Serial (COM) ports
device          sio0    at isa? port IO_COM1 flags 0x10 irq 4
device          sio1    at isa? port IO_COM2 irq 3
device          sio2    at isa? disable port IO_COM3 irq 5
device          sio3    at isa? disable port IO_COM4 irq 9

# Parallel port
device          ppc0    at isa? irq 7
device          ppbus           # Parallel port bus (required)
device          lpt             # Printer
device          plip            # TCP/IP over parallel
device          ppi             # Parallel port interface device
#device         vpo             # Requires scbus and da


# PCI Ethernet NICs.
device          fxp             # Intel EtherExpress PRO/100B (82557, 82558)

# PCI Ethernet NICs that use the common MII bus controller code.
device          miibus          # MII bus support
device          xl              # 3Com 3c90x (``Boomerang'', ``Cyclone'')

# Pseudo devices - the number indicates how many units to allocated.
pseudo-device   loop            # Network loopback
pseudo-device   ether           # Ethernet support
pseudo-device   tun             # Packet tunnel.
pseudo-device   pty             # Pseudo-ttys (telnet etc)

# The `bpf' pseudo-device enables the Berkeley Packet Filter.
# Be aware of the administrative consequences of enabling this!
pseudo-device   bpf     4       #Berkeley packet filter
pseudo-device   snp     4

options         TCP_DROP_SYNFIN
options         TCP_RESTRICT_RST
Comment 4 Johan Karlsson freebsd_committer freebsd_triage 2000-10-15 13:55:21 UTC
Responsible Changed
From-To: freebsd-bugs->gibbs

In the latest follow-up this seems to be ahc related.
Comment 5 Justin T. Gibbs freebsd_committer freebsd_triage 2001-02-24 19:54:10 UTC
State Changed
From-To: open->closed

I believe this was fixed by the correction of an spl bug several months ago. 
Please reopen a PR if this is not the case.