kern/178177: intermittent, random page fault panics

Fri Apr 26 09:00:01 UTC 2013

>Number:         178177
>Category:       kern
>Synopsis:       intermittent, random page fault panics
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Fri Apr 26 09:00:00 UTC 2013
>Closed-Date:
>Last-Modified:
>Originator:     Jaap Boender
>Release:        9.1-STABLE
>Organization:
>Environment:
FreeBSD purcell.mdx.ac.uk 9.1-STABLE FreeBSD 9.1-STABLE #4 r249764: Mon Apr 22 12:54:53 BST 2013     root at purcell.mdx.ac.uk:/usr/obj/usr/src/sys/PURCELL  amd64
>Description:
I'm getting intermittent 'page fault while in kernel mode' panics with 9.1-STABLE. There is no particular cause that I can find, though it's happened two or three times when I activate HTML formatting for a mail in Kontact (from ports) - no idea if there is a connection. The usual pattern is that my system will panic five minutes after I boot it in the morning, and then I'll be safe for the day - but this is not always the case, sometimes  I just get a panic at random.

The panics started occurring after I switched from running X with the vesa drivers to running it with the Intel DRM drivers (WITH_NEW_XORG and WITH_KMS set to YES), but again, not sure if there is a connection. The graphics chip in the laptop is an Intel IvyBridge, pciconf -l says:
vgapci0 at pci0:0:2:0:     class=0x030000 card=0x05331028 chip=0x01668086 rev=0x09 hdr=0x00

and dmesg:
vgapci0: <VGA-compatible display> port 0xf000-0xf03f mem 0xf6400000-0xf67fffff,0
xe0000000-0xefffffff irq 16 at device 2.0 on pci0
agp0: <IvyBridge mobile GT2 IG> on vgapci0
agp0: aperture size is 256M, detected 65532k stolen memory

I've attached the start of the core.txt file of the latest crash here; obviously, if more information is needed, I'll be happy to provide it.
>How-To-Repeat:
It seems to occur at random, see description.
>Fix:
n/a

Patch attached with submission follows:

panic: page fault

GNU gdb 6.1.1 [FreeBSD]
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "amd64-marcel-freebsd"...

Unread portion of the kernel message buffer:

Fatal trap 12: page fault while in kernel mode
cpuid = 1; apic id = 01
fault virtual address	= 0x0
fault code		= supervisor read data, page not present
instruction pointer	= 0x20:0xffffffff806f770b
stack pointer	        = 0x28:0xffffff823ef7b790
frame pointer	        = 0x28:0xffffff823ef7b830
code segment		= base 0x0, limit 0xfffff, type 0x1b
			= DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags	= interrupt enabled, resume, IOPL = 0
current process		= 1519 (kontact)
trap number		= 12
panic: page fault
cpuid = 1
KDB: stack backtrace:
#0 0xffffffff804c7e26 at kdb_backtrace+0x66
#1 0xffffffff8049204d at panic+0x1cd
#2 0xffffffff806ff010 at trap_fatal+0x290
#3 0xffffffff806ff348 at trap_pfault+0x1e8
#4 0xffffffff806ff94e at trap+0x3be
#5 0xffffffff806e903f at calltrap+0x8
#6 0xffffffff806fbd34 at pmap_copy+0x524
#7 0xffffffff806d0e43 at vmspace_fork+0x453
#8 0xffffffff804630c8 at fork1+0x328
#9 0xffffffff80464b32 at sys_fork+0x22
#10 0xffffffff806fe8f0 at amd64_syscall+0x540
#11 0xffffffff806e9327 at Xfast_syscall+0xf7
Uptime: 3m47s
(ada0:ahcich0:0:0:0): FLUSHCACHE48. ACB: ea 00 00 00 00 40 00 00 00 00 00 00
(ada0:ahcich0:0:0:0): CAM status: CCB request is in progress
(ada0:ahcich0:0:0:0): Error 5, Retries exhausted
(ada0:ahcich0:0:0:0): Synchronize cache failed
Dumping 748 out of 8063 MB:..3%..11%..22%..33%..41%..52%..62%..71%..82%..92%

Reading symbols from /boot/modules/cuse4bsd.ko...done.
Loaded symbols for /boot/modules/cuse4bsd.ko
Reading symbols from /boot/kernel/linprocfs.ko...Reading symbols from /boot/kernel/linprocfs.ko.symbols...done.
done.
Loaded symbols for /boot/kernel/linprocfs.ko
Reading symbols from /boot/kernel/linux.ko...Reading symbols from /boot/kernel/linux.ko.symbols...done.
done.
Loaded symbols for /boot/kernel/linux.ko
Reading symbols from /boot/kernel/i915kms.ko...Reading symbols from /boot/kernel/i915kms.ko.symbols...done.
done.
Loaded symbols for /boot/kernel/i915kms.ko
Reading symbols from /boot/kernel/iicbb.ko...Reading symbols from /boot/kernel/iicbb.ko.symbols...done.
done.
Loaded symbols for /boot/kernel/iicbb.ko
Reading symbols from /boot/kernel/iic.ko...Reading symbols from /boot/kernel/iic.ko.symbols...done.
done.
Loaded symbols for /boot/kernel/iic.ko
Reading symbols from /boot/kernel/drm2.ko...Reading symbols from /boot/kernel/drm2.ko.symbols...done.
done.
Loaded symbols for /boot/kernel/drm2.ko
#0  doadump (textdump=<value optimized out>)
    at /usr/src/sys/kern/kern_shutdown.c:272
272			dumpsys(&dumper);
(kgdb) #0  doadump (textdump=<value optimized out>)
    at /usr/src/sys/kern/kern_shutdown.c:272
#1  0xffffffff80491b1f in kern_reboot (howto=260)
    at /usr/src/sys/kern/kern_shutdown.c:449
#2  0xffffffff80492023 in panic (fmt=0x104 <Address 0x104 out of bounds>)
    at /usr/src/sys/kern/kern_shutdown.c:637
#3  0xffffffff806ff010 in trap_fatal (frame=0xc, eva=<value optimized out>)
    at /usr/src/sys/amd64/amd64/trap.c:878
#4  0xffffffff806ff348 in trap_pfault (frame=0xffffff823ef7b6e0, usermode=0)
    at /usr/src/sys/amd64/amd64/trap.c:794
#5  0xffffffff806ff94e in trap (frame=0xffffff823ef7b6e0)
    at /usr/src/sys/amd64/amd64/trap.c:463
#6  0xffffffff806e903f in calltrap ()
    at /usr/src/sys/amd64/amd64/exception.S:228
#7  0xffffffff806f770b in pmap_demote_pde_locked (pmap=0xfffffe0004a36ef8, 
    pde=0xfffffe01cb6b19d0, va=36092796928, lockp=0x0)
    at /usr/src/sys/amd64/amd64/pmap.c:2800
#8  0xffffffff806fbd34 in pmap_copy (dst_pmap=0xfffffe0004a36ef8, 
    src_pmap=0xfffffe0004a458d8, dst_addr=<value optimized out>, 
    len=<value optimized out>, src_addr=<value optimized out>)
    at /usr/src/sys/amd64/amd64/pmap.c:1904
#9  0xffffffff806d0e43 in vmspace_fork (vm1=0xfffffe0004a457a8, 
    fork_charge=0xffffff823ef7b968) at /usr/src/sys/vm/vm_map.c:3027
#10 0xffffffff804630c8 in fork1 (td=0xfffffe0054050490, flags=20, pages=4, 
    procp=0xffffff823ef7b9c0, procdescp=<value optimized out>, 
    pdflags=<value optimized out>) at /usr/src/sys/kern/kern_fork.c:841
#11 0xffffffff80464b32 in sys_fork (td=0xfffffe0054050490, 
    uap=<value optimized out>) at /usr/src/sys/kern/kern_fork.c:110
#12 0xffffffff806fe8f0 in amd64_syscall (td=0xfffffe0054050490, traced=0)
    at subr_syscall.c:135
#13 0xffffffff806e9327 in Xfast_syscall ()
    at /usr/src/sys/amd64/amd64/exception.S:387
#14 0x000000080780c20c in ?? ()
Previous frame inner to this frame (corrupt stack?)
(kgdb) 

>Release-Note:
>Audit-Trail:
>Unformatted: