Section of backtrace that is related to ACPIBacklight:
Code:
0xffffff809932bdf0 : 0xffffff7f813be320
[B]0xffffff809932be10 : 0xffffff7f82838b85 <-- this is what we need to look at...
0xffffff809932be50 : 0xffffff7f82838c37
0xffffff809932be70 : 0xffffff7f82837c03 [/B]
0xffffff809932bea0 : 0xffffff80008d9d03
Doing math based on:
Code:
com.darwin.driver.ACPIBacklight(2.0.3)[29388338-9088-340C-80DF-362CB4BEACF6]@0xffffff7f82836000->0xffffff7f82839fff
0xffffff7f82838b85 - 0xffffff7f82836000 = 0x2b85....
So... it maps to this assembly:
Code:
0000000000002b34 be20000000 movl $0x20, %esi
0000000000002b39 e800000000 callq __ZN8OSNumber10withNumberEyj
0000000000002b3e 488945d8 movq %rax, -0x28(%rbp)
0000000000002b42 4180bed000000000 cmpb $0x0, 0xd0(%r14)
0000000000002b4a 488d0d27030000 leaq 0x327(%rip), %rcx ## literal pool for: "XBCM"
0000000000002b51 488d1d2f030000 leaq 0x32f(%rip), %rbx ## literal pool for: "_BCM"
0000000000002b58 480f45d9 cmovneq %rcx, %rbx
0000000000002b5c 4885c0 testq %rax, %rax
0000000000002b5f 7428 je 0x2b89
0000000000002b61 498bbe98000000 movq 0x98(%r14), %rdi
0000000000002b68 488b07 movq (%rdi), %rax
0000000000002b6b 488d55e0 leaq -0x20(%rbp), %rdx
0000000000002b6f 488d4dd8 leaq -0x28(%rbp), %rcx
0000000000002b73 41b801000000 movl $0x1, %r8d
0000000000002b79 4531c9 xorl %r9d, %r9d
0000000000002b7c 4889de movq %rbx, %rsi
0000000000002b7f ff90c0080000 callq *0x8c0(%rax) ;<<-- this is the call...
[B]0000000000002b85 85c0 testl %eax, %eax[/B] ;<<-- this is the return address
Which maps to this C++ code in ACPIBacklight.kext:
Code:
void ACPIBacklightPanel::setACPIBrightnessLevel(UInt32 level)
{
//DbgLog("%s::%s()\n", this->getName(),__FUNCTION__);
OSObject * ret = NULL;
OSNumber * number = OSNumber::withNumber(level, 32);
const char* method = _extended ? "XBCM" : "_BCM";
if (number && kIOReturnSuccess == [B]backLightDevice->evaluateObject(method, &ret, (OSObject**)&number, 1)[/B])
{
OSSafeRelease(ret);
////DbgLog("%s: setACPIBrightnessLevel %s(%u)\n", this->getName(), method, level);
// just FYI... set RawBrightness property to actual current level
setProperty(kRawBrightness, queryACPICurentBrightnessLevel(), 32);
}
else
IOLog("ACPIBacklight: Error in setACPIBrightnessLevel %s(%u)\n", method, level);
OSSafeRelease(number);
}
I made the actual call bold.
It is the code which calls _BCM and/or XBCM (XBCM in our case because of the DSDT patching).
So... it is crashing in the bowels of AppleACPIPlatform.kext, which implies some sort of DSDT issue, or lower level issue than that (eg. CPU management).