Bug 31468

The last 2 weeks my bsd-box started crashing spontaneously. Leading up to these crashes I upgraded XFree from 4.0.3 to 4.1 with drm-kmod and startet playing around with mplayer and it's dvd-capabilities.

Most crashes have been related to mplayer, but twice I've had crashes just running in console. These happened when I returned to the machine and deactivated (hit a key) the screenblanker/saver.

I've have since recompiled kernel, system and most apps, but still crashes.

gdb-dumpfile and dmesg to follow:

root:/sys/compile/MEKANIX$ gdb -k
GNU gdb 4.18
Copyright 1998 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i386-unknown-freebsd".
(kgdb) set output-radix 16
Output radix now set to decimal 16, hex 10, octal 20.
(kgdb) symbol-file kernel.debug
Reading symbols from kernel.debug...done.
(kgdb) exec-file /var/crash/kernel.4
(kgdb) core-file /var/crash/vmcore.4
IdlePTD 5242880
initial pcb at 4232a0
panicstr: page fault
panic messages:
---
Fatal trap 12: page fault while in kernel mode
fault virtual address   = 0x52535453
fault code              = supervisor read, page not present
instruction pointer     = 0x8:0x52535453
stack pointer           = 0x10:0xcb7d7f04
frame pointer           = 0x10:0xcb7d7f14
code segment            = base rx0, limit 0xfffff, type 0x1b
                        = DPL 0, pres 1, def32 1, gran 1
processor eflags        = interrupt enabled, resume, IOPL = 0
current process         = 49443 (mplayer)
interrupt mask          = none
trap number             = 12
panic: page fault
 
syncing disks...
 
Fatal trap 12: page fault while in kernel mode
fault virtual address   = 0x52535453
fault code              = supervisor read, page not present
instruction pointer     = 0x8:0x52535453
stack pointer           = 0x10:0xcb7d7d04
frame pointer           = 0x10:0xcb7d7d18
code segment            = base rx0, limit 0xfffff, type 0x1b
                        = DPL 0, pres 1, def32 1, gran 1
processor eflags        = interrupt enabled, resume, IOPL = 0
current process         = 49443 (mplayer)
interrupt mask          = net tty bio cam
trap number             = 12
panic: page fault
Uptime: 15214d17h1m53s
 
dumping to dev #ad/0x50001, offset 128
dump ata0: resetting devices .. done
255 254 253 252 251 250 249 248 247 246 245 244 243 242 241 240 239 238 237 236 235 234 233 232 231 230 229 228 227 226 225 224 223 222 221 220 219 218 217 216 215 214 213 212 211 210 209 208 207
206 205 204 203 202 201 200 199 198 197 196 195 194 193 192 191 190 189 188 187 186 185 184 183 182 181 180 179 178 177 176 175 174 173 172 171 170 169 168 167 166 165 164 163 162 161 160 159 158
157 156 155 154 153 152 151 150 149 148 147 146 145 144 143 142 141 140 139 138 137 136 135 134 133 132 131 130 129 128 127 126 125 124 123 122 121 120 119 118 117 116 115 114 113 112 111 110 109
108 107 106 105 104 103 102 101 100 99 98 97 96 95 94 93 92 91 90 89 88 87 86 85 84 83 82 81 80 79 78 77 76 75 74 73 72 71 70 69 68 67 66 65 64 63 62 61 60 59 58 57 56 55 54 53 52 51 50 49 48 47 46 45 44 43 42 41 40 39 38 37 36 35 34 33 32 31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
---
#0  dumpsys () at ../../kern/kern_shutdown.c:473
473             if (dumping++) {
(kgdb) where
#0  dumpsys () at ../../kern/kern_shutdown.c:473
#1  0xc01c0df3 in boot (howto=0x104) at ../../kern/kern_shutdown.c:313
#2  0xc01c11c0 in poweroff_wait (junk=0xc03cb42c, howto=0xc03caf4f) at ../../kern/kern_shutdown.c:581
#3  0xc0358416 in trap_fatal (frame=0xcb7d7cc4, eva=0x52535453) at ../../i386/i386/trap.c:956
#4  0xc03580e9 in trap_pfault (frame=0xcb7d7cc4, usermode=0x0, eva=0x52535453) at ../../i386/i386/trap.c:849
#5  0xc0357ca7 in trap (frame={tf_fs = 0x10, tf_es = 0x10, tf_ds = 0x10, tf_edi = 0xc0e3bbdc, tf_esi = 0xc0e3bddc, tf_ebp = 0xcb7d7d18, tf_isp = 0xcb7d7cf0, tf_ebx = 0xc0e3bb80,
      tf_edx = 0xc0e3bc00, tf_ecx = 0x0, tf_eax = 0x52535453, tf_trapno = 0xc, tf_err = 0x0, tf_eip = 0x52535453, tf_cs = 0x8, tf_eflags = 0x10202, tf_esp = 0xc01b51cd, tf_ss = 0xc0e3bb80})
    at ../../i386/i386/trap.c:448
#6  0x52535453 in ?? ()
#7  0xc01b5224 in tco_forward (force=0x0) at ../../kern/kern_clock.c:761
#8  0xc01b49b4 in hardclock (frame=0xcb7d7d58) at ../../kern/kern_clock.c:236
#9  0xc035cbb7 in clkintr (frame={cf_vec = 0x0, cf_ppl = 0x0, cf_fs = 0x10, cf_es = 0x10, cf_ds = 0x10, cf_edi = 0xcb7d7db8, cf_esi = 0xcb7d7dbc, cf_ebp = 0xcb7d7dc8, 0xcb7d7d8c,
      cf_ebx = 0xcb717680, cf_edx = 0xcb7d7db8, cf_ecx = 0xcb717680, cf_eax = 0xcb6e0360, 0x0, 0x0, cf_eip = 0xc01ef112, cf_cs = 0x8, cf_eflags = 0x246, cf_esp = 0xc11c5c00, cf_ss = 0x0})
    at ../../i386/isa/clock.c:216
#10 0xc01ef112 in vfs_msync (mp=0xc11c5c00, flags=0x2) at ../../kern/vfs_subr.c:2536
#11 0xc01f00e0 in sync (p=0xc043d760, uap=0x0) at ../../kern/vfs_syscalls.c:544
#12 0xc01c0bd2 in boot (howto=0x100) at ../../kern/kern_shutdown.c:234
#13 0xc01c11c0 in poweroff_wait (junk=0xc03cb42c, howto=0xc03caf4f) at ../../kern/kern_shutdown.c:581
#14 0xc0358416 in trap_fatal (frame=0xcb7d7ec4, eva=0x52535453) at ../../i386/i386/trap.c:956
#15 0xc03580e9 in trap_pfault (frame=0xcb7d7ec4, usermode=0x0, eva=0x52535453) at ../../i386/i386/trap.c:849
#16 0xc0357ca7 in trap (frame={tf_fs = 0x10, tf_es = 0x10, tf_ds = 0x10, tf_edi = 0xcb7d7f80, tf_esi = 0xcb7d7f24, tf_ebp = 0xcb7d7f14, tf_isp = 0xcb7d7ef0, tf_ebx = 0xc0e3bd80,
      tf_edx = 0xc03df9c0, tf_ecx = 0xc03df9c0, tf_eax = 0x52535453, tf_trapno = 0xc, tf_err = 0x0, tf_eip = 0x52535453, tf_cs = 0x8, tf_eflags = 0x10282, tf_esp = 0xc01b4d27,
      tf_ss = 0xc0e3bd80}) at ../../i386/i386/trap.c:448
#17 0x52535453 in ?? ()
#18 0xc01c6472 in gettimeofday (p=0xcb684ea0, uap=0xcb7d7f80) at ../../kern/kern_time.c:307
#19 0xc03586c1 in syscall2 (frame={tf_fs = 0x2f, tf_es = 0x2f, tf_ds = 0x2f, tf_edi = 0x8376000, tf_esi = 0xb6df, tf_ebp = 0xbfbff83c, tf_isp = 0xcb7d7fd4, tf_ebx = 0x32315659,
      tf_edx = 0xbfbff77c, tf_ecx = 0x286b7d00, tf_eax = 0x74, tf_trapno = 0x0, tf_err = 0x2, tf_eip = 0x286473bc, tf_cs = 0x1f, tf_eflags = 0x283, tf_esp = 0xbfbff810, tf_ss = 0x2f})
    at ../../i386/i386/trap.c:1155
#20 0xc0349ce5 in Xint0x80_syscall ()
#21 0x8068b2c in ?? ()
#22 0x8064540 in ?? ()
#23 0x8061f7d in ?? ()

x$ dmesg
Copyright (c) 1992-2001 The FreeBSD Project.
Copyright (c) 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994
        The Regents of the University of California. All rights reserved.
FreeBSD 4.4-STABLE #4: Fri Oct 19 10:14:36 CEST 2001
    mekanix@mekanix.my.domain:/usr/src/sys/compile/MEKANIX
Timecounter "i8254"  frequency 1193182 Hz
CPU: AMD Duron(tm) Processor (801.83-MHz 686-class CPU)
  Origin = "AuthenticAMD"  Id = 0x630  Stepping = 0
  Features=0x183f9ff<FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,MMX,FXSR>
  AMD Features=0xc0440000<<b18>,AMIE,DSP,3DNow!>
real memory  = 268369920 (262080K bytes)
avail memory = 256307200 (250300K bytes)
Preloaded elf kernel "kernel" at 0xc04e1000.
Preloaded elf module "splash_bmp.ko" at 0xc04e109c.
Preloaded splash_image_data "/boot/splash.bmp" at 0xc04e1140.
VESA: v2.0, 16384k memory, flags:0x1, mode table:0xc00c6974 (c0006974)
VESA: Matrox Graphics Inc.
Pentium Pro MTRR support enabled
md0: Malloc disk
Using $PIR table, 9 entries at 0xc00fdd90
npx0: <math processor> on motherboard
npx0: INT 16 interface
pcib0: <Host to PCI bridge> on motherboard
pci0: <PCI bus> on pcib0
agp0: <VIA 82C8363 (Apollo KT133A) host to PCI bridge> mem 0xd0000000-0xd3ffffff at device 0.0 on pci0
pcib1: <PCI to PCI bridge (vendor=1106 device=8305)> at device 1.0 on pci0
pci1: <PCI bus> on pcib1
pci1: <Matrox MGA G400 AGP graphics accelerator> at 0.0 irq 10
isab0: <VIA 82C686 PCI-ISA bridge> at device 7.0 on pci0
isa0: <ISA bus> on isab0
atapci0: <VIA 82C686 ATA100 controller> port 0xc000-0xc00f at device 7.1 on pci0
ata0: at 0x1f0 irq 14 on atapci0
ata1: at 0x170 irq 15 on atapci0
uhci0: <VIA 83C572 USB controller> port 0xc400-0xc41f irq 11 at device 7.2 on pci0
usb0: <VIA 83C572 USB controller> on uhci0
usb0: USB revision 1.0
uhub0: VIA UHCI root hub, class 9/0, rev 1.00/1.00, addr 1
uhub0: 2 ports with 2 removable, self powered
chip0: <VIA 82C686 ACPI interface> at device 7.4 on pci0
xl0: <3Com 3c905C-TX Fast Etherlink XL> port 0xcc00-0xcc7f mem 0xda000000-0xda00007f irq 11 at device 9.0 on pci0
xl0: Ethernet address: 00:01:02:f6:03:03
miibus0: <MII bus> on xl0
xlphy0: <3c905C 10/100 internal PHY> on miibus0
xlphy0:  10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, auto
pcm0: <AudioPCI ES1373-B> port 0xd000-0xd03f irq 9 at device 10.0 on pci0
atapci1: <HighPoint HPT370 ATA100 controller> port 0xe400-0xe4ff,0xe000-0xe003,0xdc00-0xdc07,0xd800-0xd803,0xd400-0xd407 irq 11 at device 14.0 on pci0
ata2: at 0xd400 on atapci1
ata3: at 0xdc00 on atapci1
orm0: <Option ROMs> at iomem 0xc0000-0xc7fff,0xc8000-0xc87ff on isa0
fdc0: <NEC 72065B or clone> at port 0x3f0-0x3f5,0x3f7 irq 6 drq 2 on isa0
fdc0: FIFO enabled, 8 bytes threshold
fd0: <1440-KB 3.5" drive> on fdc0 drive 0
atkbdc0: <Keyboard controller (i8042)> at port 0x60,0x64 on isa0
atkbd0: <AT Keyboard> flags 0x1 irq 1 on atkbdc0
kbd0 at atkbd0
psm0: <PS/2 Mouse> irq 12 on atkbdc0
psm0: model IntelliMouse, device ID 3
vga0: <Generic ISA VGA> at port 0x3c0-0x3df iomem 0xa0000-0xbffff on isa0
sc0: <System console> at flags 0x100 on isa0
sc0: VGA <16 virtual consoles, flags=0x300>
sio0 at port 0x3f8-0x3ff irq 4 flags 0x10 on isa0
sio0: type 16550A
sio1 at port 0x2f8-0x2ff irq 3 on isa0
sio1: type 16550A
ppc0: <Parallel port> at port 0x378-0x37f irq 7 on isa0
ppc0: SMC-like chipset (ECP/EPP/PS2/NIBBLE) in COMPATIBLE mode
ppc0: FIFO with 16/16/8 bytes threshold
plip0: <PLIP network interface> on ppbus0
lpt0: <Printer> on ppbus0
lpt0: Interrupt-driven port
ppi0: <Parallel I/O> on ppbus0
IP packet filtering initialized, divert enabled, rule-based forwarding disabled, default to deny, logging limited to 100 packets/entry by default
ad0: 12949MB <IBM-DJNA-371350> [26310/16/63] at ata0-master UDMA66
ad1: 19574MB <IBM-DPTA-372050> [39770/16/63] at ata0-slave UDMA66
ata1-master: DMA limited to UDMA33, non-ATA66 compliant cable
acd0: DVD-ROM <ASUS DVD-ROM E612> at ata1-master using UDMA33
acd1: CD-RW <Hewlett-Packard CD-Writer Plus 8200> at ata1-slave using WDMA2
Mounting root from ufs:/dev/ad0s4a
ad0s2: raw partition size != slice size
ad0s2: start 4000185, end 5960114, size 1959930
ad0s2c: start 4000185, end 11165174, size 7164990
ad0s2: truncating raw partition
ad0s2: rejecting partition in BSD label: it isn't entirely within the slice
ad0s2: start 4000185, end 5960114, size 1959930
ad0s2f: start 4940457, end 11165174, size 6224718
linux: syscall setup is obsoleted or not implemented (pid=247)
linux: syscall setup is obsoleted or not implemented (pid=247)
linux: syscall fstat64 is obsoleted or not implemented (pid=247)
linux: syscall setup is obsoleted or not implemented (pid=247)

How-To-Repeat: Running mplayer with xvideo as output-display seems to be able to provoke a crash eventually (within 1-60 minutes).