Skip site navigation (1)Skip section navigation (2)
Date:      Fri, 16 May 2003 13:33:22 -0400 (EDT)
From:      Andre Guibert de Bruet <andy@siliconlandmark.com>
To:        Robert Watson <rwatson@freebsd.org>
Cc:        current@freebsd.org
Subject:   Re: USB CF Reader causes Fatal trap 12
Message-ID:  <20030516132126.P28986@alpha.siliconlandmark.com>
In-Reply-To: <Pine.NEB.3.96L.1030516131352.24024a-100000@fledge.watson.org>
References:  <Pine.NEB.3.96L.1030516131352.24024a-100000@fledge.watson.org>

next in thread | previous in thread | raw e-mail | index | archive | help

"It" was the dump, yes. I accidentally deleted the dump and I'm off to
work at the moment, so I won't be able to produce another dump until later
today. Anyway, here are the source code offsets for the functions listed
in the trace:

(kgdb) l *g_disk_access+0xa9
0xc01daf29 is in g_disk_access (../../../geom/geom_disk.c:109).
104             w += pp->acw;
105             e += pp->ace;
106             dp = pp->geom->softc;
107             error = 0;
108             if ((pp->acr + pp->acw + pp->ace) == 0 && (r + w + e) > 0) {
109                     if (dp->d_open != NULL) {
110                             g_disk_lock_giant(dp);
111                             error = dp->d_open(dp);
112                             if (error != 0)
113                                     printf("Opened disk %s -> %d\n",
(kgdb) l *g_access_rel+0x20e
0xc01dfa3e is in g_access_rel (../../../geom/geom_subr.c:513).
508             else if ((dcr > 0 || dcw > 0 || dce > 0) && pp->error != 0)
509                     return (pp->error);
510
511             /* Ok then... */
512
513             error = pp->geom->access(pp, dcr, dcw, dce);
514             if (!error) {
515                     /*
516                      * If we open first write, spoil any partner consumers.
517                      * If we close last write, trigger re-taste.
(kgdb) l *g_slice_new+0xdb
0xc01de8eb is in g_slice_new (../../../geom/geom_slice.c:457).
452             gp->dumpconf = g_slice_dumpconf;
453             cp = g_new_consumer(gp);
454             error = g_attach(cp, pp);
455             if (error == 0)
456                     error = g_access_rel(cp, 1, 0, 0);
457             if (error) {
458                     g_wither_geom(gp, ENXIO);
459                     return (NULL);
460             }
461             *vp = gsp->softc;
(kgdb) l *g_bsd_taste+0xa9
0xc0349b29 is in g_bsd_taste (../../../geom/geom_bsd.c:571).
566              * and a softc structure for us.  Specify the provider to attach
567              * the consumer to and our "start" routine for special requests.
568              * The provider is opened with mode (1,0,0) so we can do reads
569              * from it.
570              */
571             gp = g_slice_new(mp, MAXPARTITIONS, pp, &cp, &ms,
572                  sizeof(*ms), g_bsd_start);
573             if (gp == NULL)
574                     return (NULL);
575
(kgdb) l *g_new_provider_event+0x9c
0xc01df20c is in g_new_provider_event (../../../geom/geom_subr.c:258).
253                             if (cp->geom->class == mp)
254                                     i = 0;
255                     if (!i)
256                             continue;
257                     mp->taste(mp, pp, 0);
258                     g_topology_assert();
259             }
260     }
261
262
(kgdb) l *one_event+0x20a
0xc01dc77a is in one_event (../../../geom/geom_event.c:180).
175             }
176             TAILQ_REMOVE(&g_events, ep, events);
177             mtx_unlock(&g_eventlock);
178             g_topology_assert();
179             ep->func(ep->arg, 0);
180             g_topology_assert();
181             if (ep->flag & EV_WAKEUP) {
182                     ep->flag |= EV_DONE;
183                     wakeup(ep);
184             } else {
(kgdb) l *g_run_events+0x8
0xc01dc858 is in g_run_events (../../../geom/geom_event.c:199).
194
195     void
196     g_run_events()
197     {
198
199             while (one_event())
200                     ;
201     }
202
203     void
(kgdb) l *g_event_procbody+0x45
0xc01dd7a5 is in g_event_procbody (../../../geom/geom_kern.c:134).
129
130             mtx_assert(&Giant, MA_NOTOWNED);
131             tp->td_base_pri = PRIBIO;
132             for(;;) {
133                     g_run_events();
134                     tsleep(&g_wait_event, PRIBIO, "g_events", hz/10);
135             }
136     }
137
138     static struct kproc_desc g_event_kp = {

> Andre Guibert de Bruet | Enterprise Software Consultant >
> Silicon Landmark, LLC. | http://siliconlandmark.com/    >

On Fri, 16 May 2003, Robert Watson wrote:

> On Fri, 16 May 2003, Andre Guibert de Bruet wrote:
>
> > No go on the backtrace. It appears as if it got corrupted somehow...
>
> I assume "it" here is the dump.  You can still generate source code
> offsets using the function+offset values in the ddb trace by attaching gdb
> to the debugging kernel on disk and using:
>
> (kgdb) l *g_disk_access+0xa9
> ...
> (kgdb) l *g_access_rel+0x20e
> ...
>
> And so on.  No local variable inspection, but helps if your source code
> and build options aren't quite in sync with the ones of the person doing
> the debugging.
>
> > On Fri, 16 May 2003, Andre Guibert de Bruet wrote:
> >
> > > The reader I'm using is a Dazzle 6 in 1 unit. It has worked flawlessly up
> > > until last night's USB commit. At last boot, it came up as:
> > >
> > > > umass0: SCM Microsystems Inc. eUSB ORCA Quad Reader, rev 1.10/5.07, addr 4
> > > > da0 at umass-sim0 bus 0 target 0 lun 0
> > > > da0: <eUSB Compact Flash 5.07> Removable Direct Access SCSI-2 device
> > > > da0: 1.000MB/s transfers
> > > > da0: 122MB (250368 512 byte sectors: 64H 32S/T 122C)
> > >
> > > Upon connection, at the console:
> > >
> > > [... some messages that i couldn't copy and paste in time...]
> > > umass0: Invalid CSW: tag 0 should be 10
> > > (da0:umass-sim0:0:0:0): AutoSense Failed
> > > (da0:umass-sim0:0:0:0): removing device entry
> > > Opened disk da0 -> 5
> > >
> > > Fatal trap 12: page fault while in kernel mode
> > > cpuid = 0; lapic.id = 00000000
> > > fault virtual address   = 0x1c
> > > fault code              = supervisor read, page not present
> > > instruction pointer     = 0x8:0xc01daf29
> > > stack pointer           = 0x10:0xe42e8b5c
> > > frame pointer           = 0x10:0xe42e8b84
> > > code segment            = base 0x0, limit 0xfffff, type 0x1b
> > >                         = DPL 0, pres 1, def32 1, gran 1
> > > processor eflags        = interrupt enabled, resume, IOPL = 0
> > > current process         = 2 (g_event)
> > > kernel: type 12 trap, code=0
> > > Stopped at      g_disk_access+0xa9:     cmpl    $0,0x1c(%esi)
> > > db> call doadump
> > > Dumping 3583 MB
> > > ata3: resetting devices ..
> > > done
> > >  16 32 48 64 80 [... snip ...] 3568
> > > Dump complete
> > > 0xf
> > >
> > > db> tr
> > > g_disk_access(caafdd80,1,0,0,0) at g_disk_access+0xa9
> > > g_access_rel(cb598b80,1,0,0,e42e8c30) at g_access_rel+0x20e
> > > g_slice_new(c0406b20,8,caafdd80,e42e8c2c,e42e8c30) at g_slice_new+0xdb
> > > g_bsd_taste(c0406b20,caafdd80,0,102,caafdd00) at g_bsd_taste+0xa9
> > > g_new_provider_event(caafdd80,0,c03a3701,b2,66666667) at g_new_provider_event+0x9c
> > > one_event(e42e8d14,c01dd7a5,c041b30c,0,4c) at one_event+0x20a
> > > g_run_events(c041b30c,0,4c,c03a3a23,a) at g_run_events+0x8
> > > g_event_procbody(0,e42e8d48,c03a5629,2f8,c60f7e40) at g_event_procbody+0x45
> > > fork_exit(c01dd760,0,e42e8d48) at fork_exit+0xc0
> > > fork_trampoline() at fork_trampoline+0x1a
> > > --- trap 0x1, eip = 0, esp = 0xe42e8d7c, ebp = 0 ---
> > >
> > > GDB trace to follow. Stay tuned...



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20030516132126.P28986>