devfs kernel panic

[Richard Cox]

I was trying to get xine going on 5.2 Current and ran into a kernel panic.  
After a bit of investigating, I discovered I could reproduce the panic 
consistently just by trying to stat /dev/dsp1 (i.e., just an 'ls /dev/dsp1' 
will cause the kernel to panic).  Here are the particulars, please let me 
know if there is any more information you would need to track this down:

rocket:/usr/src/sys/fs/devfs]# kldstat
Id Refs Address    Size     Name
 1   11 0xc0400000 3a3d08   kernel
 2    1 0xc07a4000 1ceac    linux.ko
 3    1 0xc07c1000 8744     snd_emu10k1.ko
 4    2 0xc07ca000 1d5d8    snd_pcm.ko
 5    1 0xc07e8000 1af00    radeon.ko
 6    1 0xc0803000 4da2c    acpi.ko

gdb traceback:

(kgdb) where
#0  doadump () at /usr/src/sys/kern/kern_shutdown.c:240
#1  0xc04ff58c in boot (howto=256) at /usr/src/sys/kern/kern_shutdown.c:372
#2  0xc04ff8ff in poweroff_wait (junk=0xc06b5e99, howto=821)
    at /usr/src/sys/kern/kern_shutdown.c:550
#3  0xc0668d4d in trap_fatal (frame=0xc06ae406, eva=0)
    at /usr/src/sys/i386/i386/trap.c:821
#4  0xc0668a5c in trap_pfault (frame=0xe54769d8, usermode=0, eva=0)
    at /usr/src/sys/i386/i386/trap.c:735
#5  0xc066863c in trap (frame=
      {tf_fs = -448331752, tf_es = -1067253744, tf_ds = 16, tf_edi = 3, tf_esi 
= -448304353, tf_ebp = -448304552, tf_isp = -448304636, tf_ebx = 1, tf_edx = 
0, tf_ecx = 1, tf_eax = 0, tf_trapno = 12, tf_err = 0, tf_eip = -969554095, 
tf_cs = 8, tf_eflags = 66118, tf_esp = -971754816, tf_ss = 1}) 
at /usr/src/sys/i386/i386/trap.c:420
#6  0xc065b408 in calltrap () at {standard input}:94
#7  0xc04b2f94 in devfs_lookupx (ap=0x0) 
at /usr/src/sys/fs/devfs/devfs_vnops.c:386
#8  0xc04b32f3 in devfs_lookup (ap=0xe5476b88) 
at /usr/src/sys/fs/devfs/devfs_vnops.c:455
#9  0xc0551dac in lookup (ndp=0xe5476c28) at vnode_if.h:52
#10 0xc05517d4 in namei (ndp=0xe5476c28) at /usr/src/sys/kern/vfs_lookup.c:183
#11 0xc055f9a7 in lstat (td=0xc60febd0, uap=0xe5476d14)
    at /usr/src/sys/kern/vfs_syscalls.c:2036
#12 0xc06690c2 in syscall (frame=
      {tf_fs = 47, tf_es = 47, tf_ds = 47, tf_edi = 134542080, tf_esi = 
134542152, tf_ebp = -1077942680, tf_isp = -448303756, tf_ebx = 672751904, 
tf_edx = 134557824, tf_ecx = 0, tf_eax = 190, tf_trapno = 12, tf_err = 2, 
tf_eip = 672244687, tf_cs = 31, tf_eflags = 582, tf_esp = -1077942836, tf_ss 
= 47}) at /usr/src/sys/i386/i386/trap.c:1010
#13 0xc065b45d in Xint0x80_syscall () at {standard input}:136

dmesg output:

Copyright (c) 1992-2004 The FreeBSD Project.
Copyright (c) 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994
        The Regents of the University of California. All rights reserved.
FreeBSD 5.2-CURRENT #1: Sat Jan 24 13:06:57 EST 2004
    root at rocket.leaguetrax.com:/usr/obj/usr/src/sys/ROCKET
Preloaded elf kernel "/boot/kernel/kernel" at 0xc0852000.
Preloaded elf module "/boot/kernel/linux.ko" at 0xc0852294.
Preloaded elf module "/boot/kernel/snd_emu10k1.ko" at 0xc0852340.
Preloaded elf module "/boot/kernel/snd_pcm.ko" at 0xc08523f0.
Preloaded elf module "/boot/kernel/radeon.ko" at 0xc085249c.
Preloaded elf module "/boot/kernel/acpi.ko" at 0xc0852548.
module_register: module pci/DRIVER_NAME already exists!
Module pci/DRIVER_NAME failed to register: 17
Timecounter "i8254" frequency 1193182 Hz quality 0
CPU: Intel(R) Pentium(R) 4 CPU 2.20GHz (2193.35-MHz 686-class CPU)
  Origin = "GenuineIntel"  Id = 0xf24  Stepping = 4
  Features=0x3febfbff<FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CLFLUSH,DTS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM>
real memory  = 1073479680 (1023 MB)
avail memory = 1040945152 (992 MB)
Pentium Pro MTRR support enabled
npx0: [FAST]
npx0: <math processor> on motherboard
npx0: INT 16 interface
acpi0: <GATEWA N0CPP116> on motherboard
pcibios: BIOS version 2.10
Using $PIR table, 13 entries at 0xc00f2aa0
acpi0: Power Button (fixed)
Timecounter "ACPI-safe" frequency 3579545 Hz quality 1000
    ACPI-1287: *** Error: Method execution failed [\\_SB_.PCI0.MDET] (Node 
0xc224a180), AE_AML_REGION_LIMIT
    ACPI-1287: *** Error: Method execution failed [\\_SB_.PCI0._CRS] (Node 
0xc224a280), AE_AML_REGION_LIMIT
    ACPI-0175: *** Error: Method execution failed [\\_SB_.PCI0._CRS] (Node 
0xc224a280), AE_AML_REGION_LIMIT
can't fetch resources for \\_SB_.PCI0 - AE_AML_REGION_LIMIT
    ACPI-1287: *** Error: Method execution failed [\\_SB_.PCI0.MDET] (Node 
0xc224a180), AE_AML_REGION_LIMIT
    ACPI-1287: *** Error: Method execution failed [\\_SB_.MEM_._CRS] (Node 
0xc226d400), AE_AML_REGION_LIMIT
    ACPI-0175: *** Error: Method execution failed [\\_SB_.MEM_._CRS] (Node 
0xc226d400), AE_AML_REGION_LIMIT
can't fetch resources for \\_SB_.MEM_ - AE_AML_REGION_LIMIT
acpi_timer0: <24-bit timer at 3.579545MHz> port 0x408-0x40b on acpi0
acpi_cpu0: <CPU> on acpi0
acpi_cpu1: <CPU> on acpi0
device_probe_and_attach: acpi_cpu1 attach returned 6
acpi_button0: <Power Button> on acpi0
pcib0: <ACPI Host-PCI bridge> on acpi0
pci0: <ACPI PCI bus> on pcib0
pcib0: slot 31 INTD is routed to irq 5
pcib0: slot 31 INTB is routed to irq 10
agp0: <Intel 82850 host to AGP bridge> mem 0xf8000000-0xfbffffff at device 0.0 
on pci0
pcib1: <PCI-PCI bridge> at device 1.0 on pci0
pci1: <PCI bus> on pcib1
pcib0: slot 1 INTA is routed to irq 11
pcib1: slot 0 INTA is routed to irq 11
drm0: <ATI Radeon QL R200 8500 LE> port 0xc800-0xc8ff mem 
0xff8f0000-0xff8fffff,0xe0000000-0xe7ffffff irq 11 at device 0.0 on pci1
info: [drm] AGP at 0xf8000000 64MB
info: [drm] Initialized radeon 1.10.0 20020828 on minor 0
pcib2: <ACPI PCI-PCI bridge> at device 30.0 on pci0
pci2: <ACPI PCI bus> on pcib2
pcib2: slot 1 INTA is routed to irq 5
pcib2: slot 1 INTB is routed to irq 3
pcib2: slot 1 INTC is routed to irq 9
pcib2: slot 8 INTA is routed to irq 11
pcib2: slot 10 INTA is routed to irq 11
pcib2: slot 11 INTA is routed to irq 9
pcib2: slot 12 INTA is routed to irq 10
pcib2: slot 13 INTA is routed to irq 11
ohci0: <NEC uPD 9210 USB controller> mem 0xff9fd000-0xff9fdfff irq 5 at device 
1.0 on pci2
usb0: OHCI version 1.0
usb0: SMM does not respond, resetting
usb0: <NEC uPD 9210 USB controller> on ohci0
usb0: USB revision 1.0
uhub0: NEC OHCI root hub, class 9/0, rev 1.00/1.00, addr 1
uhub0: 2 ports with 2 removable, self powered
ums0: Logitech USB Optical Mouse, rev 1.10/21.00, addr 2, iclass 3/1
ums0: 3 buttons and Z dir.
ohci1: <NEC uPD 9210 USB controller> mem 0xff9fe000-0xff9fefff irq 3 at device 
1.1 on pci2
usb1: OHCI version 1.0
usb1: SMM does not respond, resetting
usb1: <NEC uPD 9210 USB controller> on ohci1
usb1: USB revision 1.0
uhub1: NEC OHCI root hub, class 9/0, rev 1.00/1.00, addr 1
uhub1: 2 ports with 2 removable, self powered
pci2: <serial bus, USB> at device 1.2 (no driver attached)
fxp0: <Intel 82801BA/CAM (ICH2/3) Pro/100 Ethernet> port 0xdf00-0xdf3f mem 
0xff9fc000-0xff9fcfff irq 11 at device 8.0 on pci2
fxp0: Ethernet address 00:03:47:d3:fb:ac
miibus0: <MII bus> on fxp0
inphy0: <i82562ET 10/100 media interface> on miibus0
inphy0:  10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, auto
pci2: <multimedia, video> at device 10.0 (no driver attached)
fwohci0: <Texas Instruments TSB12LV26> mem 
0xff9f8000-0xff9fbfff,0xff9ff000-0xff9ff7ff irq 9 at device 11.0 on pci2
fwohci0: OHCI version 1.0 (ROM=1)
fwohci0: No. of Isochronous channel is 4.
fwohci0: EUI64 00:05:3f:52:00:00:16:14
fwohci0: Phy 1394a available S400, 3 ports.
fwohci0: Link S400, max_rec 2048 bytes.
firewire0: <IEEE1394(FireWire) bus> on fwohci0
sbp0: <SBP-2/SCSI over FireWire> on firewire0
fwe0: <Ethernet over FireWire> on firewire0
if_fwe0: Fake Ethernet address: 02:05:3f:00:16:14
fwohci0: Initiate bus reset
fwohci0: BUS reset
fwohci0: node_id=0xc800ffc0, gen=1, CYCLEMASTER mode
firewire0: 1 nodes, maxhop <= 0, cable IRM = 0 (me)
firewire0: bus manager 0 (me)
pcm0: <Creative EMU10K1> port 0xdf80-0xdf9f irq 10 at device 12.0 on pci2
pcm0: <TriTech TR28602 AC97 Codec>
pci2: <simple comms> at device 13.0 (no driver attached)
isab0: <PCI-ISA bridge> at device 31.0 on pci0
isa0: <ISA bus> on isab0
atapci0: <Intel ICH2 UDMA100 controller> port 0xffa0-0xffaf at device 31.1 on 
pci0
ata0: at 0x1f0 irq 14 on atapci0
ata0: [MPSAFE]
ata1: at 0x170 irq 15 on atapci0
ata1: [MPSAFE]
uhci0: <Intel 82801BA/BAM (ICH2) USB controller USB-A> port 0xef80-0xef9f irq 
5 at device 31.2 on pci0
usb2: <Intel 82801BA/BAM (ICH2) USB controller USB-A> on uhci0
usb2: USB revision 1.0
uhub2: Intel UHCI root hub, class 9/0, rev 1.00/1.00, addr 1
uhub2: 2 ports with 2 removable, self powered
pci0: <serial bus, SMBus> at device 31.3 (no driver attached)
atkbdc0: <Keyboard controller (i8042)> port 0x64,0x60 irq 1 on acpi0
atkbd0: <AT Keyboard> flags 0x1 irq 1 on atkbdc0
kbd0 at atkbd0
fdc0: <Enhanced floppy controller (i82077, NE72065 or clone)> port 
0x3f7,0x3f4-0x3f5,0x3f2-0x3f3,0x3f0-0x3f1 irq 6 drq 2 on acpi0
fdc0: FIFO enabled, 8 bytes threshold
fd0: <1440-KB 3.5" drive> on fdc0 drive 0
sio0 port 0x3f8-0x3ff irq 4 on acpi0
sio0: type 16550A
ppc0 port 0x778-0x77f,0x378-0x37f irq 7 drq 3 on acpi0
ppc0: SMC-like chipset (ECP/EPP/PS2/NIBBLE) in COMPATIBLE mode
ppc0: FIFO with 16/16/8 bytes threshold
ppbus0: <Parallel port bus> on ppc0
lpt0: <Printer> on ppbus0
lpt0: Interrupt-driven port
ppi0: <Parallel I/O> on ppbus0
acpi_cpu1: <CPU> on acpi0
device_probe_and_attach: acpi_cpu1 attach returned 6
pmtimer0 on isa0
orm0: <Option ROMs> at iomem 0xec000-0xec7ff,0xc0000-0xccfff on isa0
sc0: <System console> on isa0
sc0: VGA <16 virtual consoles, flags=0x200>
vga0: <Generic ISA VGA> at port 0x3c0-0x3df iomem 0xa0000-0xbffff on isa0
sio1: configured irq 3 not in bitmap of probed irqs 0
sio1: port may not be enabled
Timecounter "TSC" frequency 2193348328 Hz quality 800
Timecounters tick every 10.000 msec
ad0: 114473MB <WDC WD1200BB-53CAA0> [232581/16/63] at ata0-master UDMA100
acd0: DVDR <MATSHITADVD-RAM LF-D311> at ata1-master PIO4
acd1: CDRW <LITE-ON LTR-24102B> at ata1-slave PIO4
Mounting root from ufs:/dev/ad0s2a
WARNING: / was not properly dismounted
WARNING: /usr was not properly dismounted
info: [drm] Loading R200 Microcode
drm0: [MPSAFE]