Bug 31530

Summary: Fatal trap 12 when reading from DVD.
Product: Base System Reporter: heath <heath>
Component: kernAssignee: freebsd-bugs (Nobody) <bugs>
Status: Closed FIXED    
Severity: Affects Only Me    
Priority: Normal    
Version: 4.4-STABLE   
Hardware: Any   
OS: Any   
Attachments:
Description Flags
crash-dump.out none

Description heath 2001-10-27 08:30:01 UTC 
When I try to open a DVD disc for playing, the DVD-ROM drive accesses the
disc for a time, then the computer panics.  A message is logged to syslog:

hershey /kernel: ata1-master: too many segments in DMA table

The crash dump is as follows:

(kgdb) symbol-file kernel.debug
Reading symbols from kernel.debug...done.
(kgdb) exec-file /usr/crash/kernel.0
(kgdb) core-file /usr/crash/vmcore.0
IdlePTD 3805184
initial pcb at 2dae20
panicstr: page fault
panic messages:
---
Fatal trap 12: page fault while in kernel mode
fault virtual address	= 0x3a
fault code		= supervisor write, page not present
instruction pointer	= 0x8:0xc021e20f
stack pointer	        = 0x10:0xc02b3d3c
frame pointer	        = 0x10:0xc02b3ddc
code segment		= base rx0, limit 0xfffff, type 0x1b
			= DPL 0, pres 1, def32 1, gran 1
processor eflags	= interrupt enabled, resume, IOPL = 0
current process		= Idle
interrupt mask		= bio 
trap number		= 12
panic: page fault

syncing disks... 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 
giving up on 1 buffers
Uptime: 5h12m19s

dumping to dev #ad/0x20001, offset 16512
dump ata0: resetting devices .. done
[...]
---
#0  dumpsys () at ../../kern/kern_shutdown.c:473
473		if (dumping++) {
(kgdb) set output-radix 16
Output radix now set to decimal 16, hex 10, octal 20.
(kgdb) bt
#0  dumpsys () at ../../kern/kern_shutdown.c:473
#1  0xc015a4b3 in boot (howto=0x100) at ../../kern/kern_shutdown.c:313
#2  0xc015a880 in poweroff_wait (junk=0xc02ab9ec, howto=0xc02ab50f)
    at ../../kern/kern_shutdown.c:581
#3  0xc026843a in trap_fatal (frame=0xc02b3cfc, eva=0x3a)
    at ../../i386/i386/trap.c:956
#4  0xc026810d in trap_pfault (frame=0xc02b3cfc, usermode=0x0, eva=0x3a)
    at ../../i386/i386/trap.c:849
#5  0xc0267cf7 in trap (frame={tf_fs = 0x10, tf_es = 0x10, tf_ds = 0x10, 
      tf_edi = 0xd1558000, tf_esi = 0xc02e2e0c, tf_ebp = 0xc02b3ddc, 
      tf_isp = 0xc02b3d28, tf_ebx = 0x0, tf_edx = 0x0, tf_ecx = 0xc02b3d88, 
      tf_eax = 0x1, tf_trapno = 0xc, tf_err = 0x2, tf_eip = 0xc021e20f, 
      tf_cs = 0x8, tf_eflags = 0x210286, tf_esp = 0x0, tf_ss = 0xc02e2e0c})
    at ../../i386/i386/trap.c:448
#6  0xc021e20f in vm_fault (map=0xc02e2e0c, vaddr=0xd1558000, fault_type=0x3, 
    fault_flags=0x0) at ../../vm/vm_object.h:189
#7  0xc02680ba in trap_pfault (frame=0xc02b3e50, usermode=0x0, eva=0xd1558000)
    at ../../i386/i386/trap.c:838
#8  0xc0267cf7 in trap (frame={tf_fs = 0x10, tf_es = 0x10, tf_ds = 0x10, 
      tf_edi = 0xd1558000, tf_esi = 0xd000, tf_ebp = 0xc02b3ea0, 
      tf_isp = 0xc02b3e7c, tf_ebx = 0xc245fa00, tf_edx = 0x170, 
      tf_ecx = 0x2f7f, tf_eax = 0xc135ca80, tf_trapno = 0xc, tf_err = 0x2, 
      tf_eip = 0xc02457d2, tf_cs = 0x8, tf_eflags = 0x210216,
      tf_esp = 0xc137fb20, tf_ss = 0xc245fa00}) at ../../i386/i386/trap.c:448
#9  0xc02457d2 in atapi_read (request=0xc245fa00, length=0xd000)
    at machine/cpufunc.h:225
#10 0xc0245267 in atapi_interrupt (request=0xc245fa00)
    at ../../dev/ata/atapi-all.c:391
#11 0xc023e6e2 in ata_intr (data=0xc135ca80) at ../../dev/ata/ata-all.c:1165
(kgdb) up 10
#10 0xc0245267 in atapi_interrupt (request=0xc245fa00)
    at ../../dev/ata/atapi-all.c:391
391		    atapi_read(request, length);
(kgdb) print *request
$1 = {device = 0xc137fb20, ccb = "(\000\0001ÎoßÄú\000\000\000\000\000\000", 
  ccbsize = 0xc, bytecount = 0xfe27d000, donecount = 0x0, timeout = 0xbb8, 
  timeout_handle = {callout = 0xcba19678}, retries = 0x0, result = 0x0, 
  error = 0x0, sense = {error_code = 0x0, valid = 0x0, segment = 0x0, 
    sense_key = 0x0, reserved2_4 = 0x0, ili = 0x0, eom = 0x0, filemark = 0x0, 
    cmd_info = 0x0, sense_length = 0x0, cmd_specific_info = 0x0, asc = 0x0, 
    ascq = 0x0, replaceable_unit_code = 0x0, sk_specific = 0x0, sksv = 0x0, 
    sk_specific1 = 0x0, sk_specific2 = 0x0}, flags = 0x1, 
  data = 0xd1556dfc "", callback = 0xc0247f30 <acd_done>, dmatab = 0xc151f000, 
  driver = 0xcba3001c, chain = {tqe_next = 0x0, tqe_prev = 0xc135cae0}}
(kgdb) 
	
If I set the DVD drive to PIO mode, the panic is the same with the exception
that there is no message logged to syslog.  This happens with every DVD I've
tried and is repeatable every time.  Full dmesg is:

Copyright (c) 1992-2001 The FreeBSD Project.
Copyright (c) 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994
        The Regents of the University of California. All rights reserved.
FreeBSD 4.4-STABLE #1: Fri Oct 12 22:28:00 MDT 2001
    heath@hershey.dyn.bar.net:/usr/src/sys/compile/HERSHEY
Timecounter "i8254"  frequency 1193182 Hz
CPU: AMD-K7(tm) Processor (704.94-MHz 686-class CPU)
  Origin = "AuthenticAMD"  Id = 0x612  Stepping = 2
  Features=0x81f9ff<FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,SEP,MTRR,PGE,MCA,CMOV,PAT,MMX>
  AMD Features=0xc0400000<AMIE,DSP,3DNow!>
real memory  = 536805376 (524224K bytes)
avail memory = 519147520 (506980K bytes)
Preloaded elf kernel "kernel" at 0xc0382000.
Preloaded elf module "if_vr.ko" at 0xc038209c.
Preloaded elf module "miibus.ko" at 0xc038213c.
Preloaded elf module "snd_es137x.ko" at 0xc03821dc.
Preloaded elf module "snd_pcm.ko" at 0xc0382280.
Pentium Pro MTRR support enabled
md0: Malloc disk
Using $PIR table, 7 entries at 0xc00f8110
npx0: <math processor> on motherboard
npx0: INT 16 interface
pcib0: <AMD-751 host to PCI bridge> on motherboard
pci0: <PCI bus> on pcib0
pcib1: <AMD-751 PCI-PCI (AGP) bridge> at device 1.0 on pci0
pci1: <PCI bus> on pcib1
pci1: <NVidia Riva TNT graphics accelerator> at 5.0 irq 11
isab0: <VIA 82C686 PCI-ISA bridge> at device 4.0 on pci0
isa0: <ISA bus> on isab0
atapci0: <VIA 82C686 ATA66 controller> port 0xffa0-0xffaf at device 4.1 on pci0
ata0: at 0x1f0 irq 14 on atapci0
ata1: at 0x170 irq 15 on atapci0
uhci0: <VIA 83C572 USB controller> port 0xd000-0xd01f irq 9 at device 4.2 on pci0
usb0: <VIA 83C572 USB controller> on uhci0
usb0: USB revision 1.0
uhub0: VIA UHCI root hub, class 9/0, rev 1.00/1.00, addr 1
uhub0: 2 ports with 2 removable, self powered
ukbd0: Microsoft Natural Keyboard Elite, rev 1.00/1.04, addr 2, iclass 3/1
kbd0 at ukbd0
uhub1: Philips Semiconductors hub, class 9/0, rev 1.10/1.10, addr 3
uhub1: 5 ports with 5 removable, self powered
ugen0: Hewlett Packard HP USB CD-Writer Plus, rev 1.00/0.01, addr 4
usbd_transfer_cb: short transfer 0<8
usbd_new_device: addr=5, getting first desc failed
uhub_explore: usb_new_device failed, error=IOERROR
uhub1: device problem, disabling port 5
uhci1: <VIA 83C572 USB controller> port 0xd400-0xd41f irq 9 at device 4.3 on pci0
usb1: <VIA 83C572 USB controller> on uhci1
usb1: USB revision 1.0
uhub2: VIA UHCI root hub, class 9/0, rev 1.00/1.00, addr 1
uhub2: 2 ports with 2 removable, self powered
chip1: <VIA 82C686 ACPI interface> at device 4.4 on pci0
pcm0: <AudioPCI ES1370> port 0xcc00-0xcc3f irq 11 at device 13.0 on pci0
ahc0: <Adaptec 2902/04/10/15/20/30C SCSI adapter> port 0xdc00-0xdcff mem 0xeffff000-0xefffffff irq 10 at device 14.0 on pci0
aic7850: Single Channel A, SCSI Id=7, 3/255 SCBs
vr0: <VIA VT3043 Rhine I 10/100BaseTX> port 0xc800-0xc87f mem 0xefffef80-0xefffefff irq 9 at device 16.0 on pci0
vr0: Ethernet address: 00:50:ba:04:cc:81
miibus0: <MII bus> on vr0
amphy0: <DM9101 10/100 media interface> on miibus0
amphy0:  10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, auto
orm0: <Option ROM> at iomem 0xc0000-0xcbfff on isa0
fdc0: <NEC 72065B or clone> at port 0x3f0-0x3f5,0x3f7 irq 6 drq 2 on isa0
fdc0: FIFO enabled, 8 bytes threshold
fd0: <1440-KB 3.5" drive> on fdc0 drive 0
atkbdc0: <Keyboard controller (i8042)> at port 0x60,0x64 on isa0
psm0: <PS/2 Mouse> irq 12 on atkbdc0
psm0: model IntelliMouse, device ID 3
vga0: <Generic ISA VGA> at port 0x3c0-0x3df iomem 0xa0000-0xbffff on isa0
sc0: <System console> at flags 0x100 on isa0
sc0: VGA <16 virtual consoles, flags=0x300>
sio0 at port 0x3f8-0x3ff irq 4 flags 0x10 on isa0
sio0: type 16550A
sio1 at port 0x2f8-0x2ff irq 3 on isa0
sio1: type 16550A
ppc0: <Parallel port> at port 0x378-0x37f irq 7 on isa0
ppc0: SMC-like chipset (ECP/EPP/PS2/NIBBLE) in COMPATIBLE mode
ppc0: FIFO with 16/16/8 bytes threshold
ppbus0: IEEE1284 device found /NIBBLE/ECP
Probing for PnP devices on ppbus0:
ppbus0: <HEWLETT-PACKARD DESKJET 990C> PRINTER MLC,PCL,PML
ppi0: <Parallel I/O> on ppbus0
plip0: <PLIP network interface> on ppbus0
lpt0: <Printer> on ppbus0
lpt0: Interrupt-driven port
ad0: 29333MB <WDC WD307AA> [59598/16/63] at ata0-master UDMA66
acd0: DVD-ROM <DVD-ROM DDU220E> at ata1-master using WDMA2
Waiting 5 seconds for SCSI devices to settle
pass0 at ahc0 bus 0 target 5 lun 0
pass0: <UMAX Astra 1220S V1.2> Fixed Scanner SCSI-2 device 
pass0: 3.300MB/s transfers 

If there is any additional information I can provide, let me know.

How-To-Repeat: Install /usr/ports/graphics/ogle_gui.
Run ogle and open a disc with a DVD in the drive.
Comment 1 Jeroen Ruigrok van der Werven freebsd_committer freebsd_triage 2001-11-04 16:25:12 UTC 
Responsible Changed
From-To: freebsd-bugs->asmodai

I'm looking after MFC'ing the ATA bits from CURRENT to STABLE.
Comment 2 Jeroen Ruigrok van der Werven freebsd_committer freebsd_triage 2001-11-15 20:48:34 UTC 
State Changed
From-To: open->analyzed

This seems to definately be something I can fix with the MFC. 
Hope to get most done the coming weekend.
Comment 3 Jeroen Ruigrok van der Werven freebsd_committer freebsd_triage 2001-11-16 10:27:56 UTC 
Responsible Changed
From-To: asmodai->freebsd-bugs

Move back to the bugs list.
Comment 4 dmmiller 2001-12-30 10:26:50 UTC 
FWIW, I'm seeing these problems right now on 4.5-PRERELEASE.  My crash 
dump is attached.  I also have my sources cvsupped and up-to-date as of 
this email.

Donn.
Comment 5 Brian Somers freebsd_committer freebsd_triage 2002-05-19 02:29:45 UTC 
State Changed
From-To: analyzed->closed

In a message from Heath: 

: Subject: Re: kern/31530: Fatal trap 12 when reading from DVD. 
: From: Heath Nielson <heath@poseidon.cs.byu.edu> 
: Date: Sat, 18 May 2002 17:22:01 -0600 (MDT) (Sun 00:22 BST) 
: To: gnats-admin@FreeBSD.ORG, <freebsd-bugs@FreeBSD.ORG> 
: Cc: Heath Nielson <heath@cs.byu.edu> 
:  
: This problem has been fixed (I can no longer reproduce the problem) as of 
: FreeBSD 4.5 with an MFC of the ATA code.  (I can't recall the exact 
: version of the code that fixed the problem.) 
: 
: Heath