Fatal trap 12 in g_event

[Rostislav Krasny]

Hi,

I use FreeBSD 6.0-STABLE on my Pentium III machine with following ATA
configuration:

ad0: 19541MB <Maxtor 5T020H2 TAH71DP0> at ata0-master UDMA100
ad1: 14324MB <IBM DTLA-307015 TX2DA5AA> at ata0-slave UDMA100
ad2: 14649MB <IBM DTLA-307015 TX2OA5AA> at ata1-master UDMA100
acd0: CDRW <YAMAHA CRW2200E/1.0D> at ata1-slave UDMA33

FreeBSD is installed on the ad1 in DD mode. On the ad0 I have one NTFS
filesystem and on the ad2 I have two FAT32 filesystems. Normally only
ad1* are mounted. I have an old (original) CD of a "UNIX Unleashed"
book. I inserted this CD into the acd0, mounted it read-only to /cdrom
and then ran following command as a normal user (well, the user is also
in the wheel group):

cp -Rv /cdrom/* ~/unleashied

That old CD probably has bad blocks. After some time, when the cp was
still running, I got following kernel panic:

ad2: detached


Fatal trap 12: page fault while in kernel mode
fault virtual address   = 0x3b0
fault code              = supervisor read, page not present
instruction pointer     = 0x20:0xc0447742
stack pointer           = 0x28:0xc7b5ccc8
frame pointer           = 0x28:0xc7b5ccd8
code segment            = base 0x0, limit 0xfffff, type 0x1b
                        = DPL 0, pres 1, def32 1, gran 1
processor eflags        = interrupt enabled, resume, IOPL = 0
current process         = 2 (g_event)
trap number             = 12
panic: page fault
Uptime: 7m46s
Dumping 127 MB (2 chunks)
  chunk 0: 1MB (159 pages) ... ok
  chunk 1: 127MB (32512 pages) 112 96 80 64 48 32 16


You can find a trace in the attached text file. Further information can
be sent upon request.

Thank you in advance
-------------- next part --------------
Script started on Thu Dec 29 00:46:54 2005
saturn# pwd
/usr/obj/usr/src/sys/MYKERNEL
saturn# kgdb kernel.debug /var/crash/vmcore.0
[GDB will not be able to debug user-mode threads: /usr/lib/libthread_db.so: Undefined symbol "ps_pglobal_lookup"]
GNU gdb 6.1.1 [FreeBSD]
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i386-marcel-freebsd".

Unread portion of the kernel message buffer:
ad2: detached


Fatal trap 12: page fault while in kernel mode
fault virtual address	= 0x3b0
fault code		= supervisor read, page not present
instruction pointer	= 0x20:0xc0447742
stack pointer	        = 0x28:0xc7b5ccc8
frame pointer	        = 0x28:0xc7b5ccd8
code segment		= base 0x0, limit 0xfffff, type 0x1b
			= DPL 0, pres 1, def32 1, gran 1
processor eflags	= interrupt enabled, resume, IOPL = 0
current process		= 2 (g_event)
trap number		= 12
panic: page fault
Uptime: 7m46s
Dumping 127 MB (2 chunks)
  chunk 0: 1MB (159 pages) ... ok
  chunk 1: 127MB (32512 pages) 112 96 80 64 48 32 16

#0  doadump () at pcpu.h:165
165		__asm __volatile("movl %%fs:0,%0" : "=r" (td));
(kgdb) where
#0  doadump () at pcpu.h:165
#1  0xc04d3d66 in boot (howto=260) at /usr/src/sys/kern/kern_shutdown.c:399
#2  0xc04d3ffc in panic (fmt=0xc0620955 "%s")
    at /usr/src/sys/kern/kern_shutdown.c:555
#3  0xc0602b44 in trap_fatal (frame=0xc7b5cc88, eva=944)
    at /usr/src/sys/i386/i386/trap.c:836
#4  0xc06028ab in trap_pfault (frame=0xc7b5cc88, usermode=0, eva=944)
    at /usr/src/sys/i386/i386/trap.c:744
#5  0xc0602509 in trap (frame=
      {tf_fs = -1049886712, tf_es = -944439256, tf_ds = -1068957656, tf_edi = 0, tf_esi = 0, tf_ebp = -944386856, tf_isp = -944386892, tf_ebx = -1050171520, tf_edx = -1051733632, tf_ecx = 4, tf_eax = 0, tf_trapno = 12, tf_err = 0, tf_eip = -1069254846, tf_cs = 32, tf_eflags = 590338, tf_esp = 6, tf_ss = -1050171520})
    at /usr/src/sys/i386/i386/trap.c:434
#6  0xc05f2c4a in calltrap () at /usr/src/sys/i386/i386/exception.s:139
#7  0xc0447742 in acd_geom_detach (arg=0xc167a780, flag=0)
    at /usr/src/sys/dev/ata/atapi-cd.c:199
#8  0xc049af75 in one_event () at /usr/src/sys/geom/geom_event.c:206
#9  0xc049b04d in g_run_events () at /usr/src/sys/geom/geom_event.c:226
#10 0xc049bec1 in g_event_procbody () at /usr/src/sys/geom/geom_kern.c:141
#11 0xc04beb84 in fork_exit (callout=0xc049be4c <g_event_procbody>, arg=0x0, 
    frame=0xc7b5cd38) at /usr/src/sys/kern/kern_fork.c:789
#12 0xc05f2cac in fork_trampoline () at /usr/src/sys/i386/i386/exception.s:208
(kgdb) q
saturn# ^Dexit

Script done on Thu Dec 29 00:47:24 2005