From owner-freebsd-bugs@FreeBSD.ORG Wed Dec 10 23:40:24 2003 Return-Path: Delivered-To: freebsd-bugs@hub.freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id D4F7316A4CF for ; Wed, 10 Dec 2003 23:40:24 -0800 (PST) Received: from freefall.freebsd.org (freefall.freebsd.org [216.136.204.21]) by mx1.FreeBSD.org (Postfix) with ESMTP id C023C43D2D for ; Wed, 10 Dec 2003 23:40:20 -0800 (PST) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1]) by freefall.freebsd.org (8.12.9/8.12.9) with ESMTP id hBB7eKFY053424 for ; Wed, 10 Dec 2003 23:40:20 -0800 (PST) (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.12.9/8.12.9/Submit) id hBB7eKOx053423; Wed, 10 Dec 2003 23:40:20 -0800 (PST) (envelope-from gnats) Resent-Date: Wed, 10 Dec 2003 23:40:20 -0800 (PST) Resent-Message-Id: <200312110740.hBB7eKOx053423@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-bugs@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, Gordon Burditt Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id A0BCB16A4CE for ; Wed, 10 Dec 2003 23:31:42 -0800 (PST) Received: from hammy.burditt.org (hammy.burditt.org [206.138.224.67]) by mx1.FreeBSD.org (Postfix) with ESMTP id AE17C43D2A for ; Wed, 10 Dec 2003 23:31:39 -0800 (PST) (envelope-from gordon@hammy.burditt.org) Received: from gordon by hammy.burditt.org with local (Exim 4.24; FreeBSD) id 1AULIQ-000Iyz-Ot; Thu, 11 Dec 2003 01:31:38 -0600 Message-Id: Date: Thu, 11 Dec 2003 01:31:38 -0600 From: Gordon Burditt Sender: Gordon Burditt To: FreeBSD-gnats-submit@FreeBSD.org X-Send-Pr-Version: 3.113 cc: gordonb@airmail.net Subject: kern/60131: Page fault on disconnect of USB device X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list Reply-To: Gordon Burditt List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 11 Dec 2003 07:40:25 -0000 >Number: 60131 >Category: kern >Synopsis: Page fault on disconnect of USB device >Confidential: no >Severity: non-critical >Priority: low >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Wed Dec 10 23:40:18 PST 2003 >Closed-Date: >Last-Modified: >Originator: Gordon Burditt >Release: FreeBSD 5.2-BETA i386 >Organization: >Environment: System: FreeBSD hammy.burditt.org 4.9-STABLE FreeBSD 4.9-STABLE #7: Sat Nov 22 14:13:11 CST 2003 gordon@hammy.burditt.org:/scratch5/i386-obj/usr/src/sys/HAMMY i386 Reporting from FreeBSD 4.9, laptop runs -CURRENT. FreeBSD-CURRENT (identifies itself as FreeBSD 5.2-BETA), from December 3, 2003 The GPS device is a serial-to-USB converter with a serial GPS. port 1 addr 2: low speed, power 150 mA, config 1, Talon Technology 4800 baud serial interface(0x0001), Talon Technology(0x0a99), rev 1.05 It is detected as ugen0. My gpsd daemon (my own code) opens /dev/ugen0.1, loops doing fgets() and stuffs data into a mmap()ed shared memory segment. If it detects an error, it closes the device, waits a few seconds, and tries to open it again. >Description: If I disconnect my USB GPS device, I get a kernel page fault. At the time of the disconnect, my gpsd daemon has /dev/ugen0.1 open and the device is sending data more or less continually. The panic does not occur if the device is not open (although it is still sending data more or less continually). From the stack trace it appears gpsd detects an error, closes the device, and panics in close. This started to be a problem with FreeBSD-CURRENT cvsup'd around November 18 and was not a problem with an earlier kernel estimated to be 2 months earlier. It is still a problem with FreeBSD-CURRENT on December 3. >How-To-Repeat: Boot laptop with GPS connected. gpsd starts. Disconnect USB connector. Kaboom! panic: page fault panic messages: --- Fatal trap 12: page fault while in kernel mode fault virtual address = 0xc2d852a0 fault code = supervisor write, page not present instruction pointer = 0x8:0xc05f3806 stack pointer = 0x10:0xd714cb24 frame pointer = 0x10:0xd714cb4c code segment = base 0x0, limit 0xfffff, type 0x1b = DPL 0, pres 1, def32 1, gran 1 processor eflags = interrupt enabled, resume, IOPL = 0 current process = 1311 (gpsd) trap number = 12 panic: page fault syncing disks, buffers remaining... 1972 1972 1970 1970 1970 1970 1970 1970 1970 1970 1970 1970 1970 1970 1970 1970 1970 1970 1970 1970 1970 1970 giving up on 1171 buffers Uptime: 2h1m4s stray irq7 Shutting down ACPI Automatic reboot in 15 seconds - press a key on the console to abort --> Press a key on the console to reboot, --> or switch off the system now. Rebooting... Copyright (c) 1992-2003 The FreeBSD Project. Copyright (c) 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994 The Regents of the University of California. All rights reserved. FreeBSD 5.2-BETA #1: Wed Dec 3 20:29:36 CST 2003 gordon@book.burditt.org:/home/obj/usr/src/sys/BOOK Preloaded elf kernel "/boot/kernel/kernel" at 0xc0ad0000. Preloaded elf module "/boot/kernel/snd_via82c686.ko" at 0xc0ad0244. Preloaded elf module "/boot/kernel/snd_pcm.ko" at 0xc0ad02f8. Preloaded elf module "/boot/kernel/aout.ko" at 0xc0ad03a4. Preloaded elf module "/boot/kernel/if_ath.ko" at 0xc0ad0450. Preloaded elf module "/boot/kernel/ath_hal.ko" at 0xc0ad04fc. Timecounter "i8254" frequency 1193182 Hz quality 0 CPU: AMD Athlon(tm) Processor (1000.04-MHz 686-class CPU) Origin = "AuthenticAMD" Id = 0x662 Stepping = 2 Features=0x383f9ff AMD Features=0xc0480000 real memory = 268435456 (256 MB) avail memory = 251027456 (239 MB) Pentium Pro MTRR support enabled acpi0: on motherboard pcibios: BIOS version 2.10 Using $PIR table, 6 entries at 0xc00fdf60 acpi0: Power Button (fixed) Timecounter "ACPI-safe" frequency 3579545 Hz quality 1000 acpi_timer0: <32-bit timer at 3.579545MHz> port 0x8008-0x800b on acpi0 acpi_cpu0: on acpi0 acpi_tz0: on acpi0 acpi_button0: on acpi0 pcib0: port 0xcf8-0xcff on acpi0 pci0: on pcib0 pcib0: slot 7 INTD is routed to irq 9 pcib0: slot 7 INTD is routed to irq 9 pcib0: slot 7 INTC is routed to irq 5 pcib0: slot 7 INTC is routed to irq 5 pcib0: slot 10 INTA is routed to irq 9 pcib0: slot 10 INTB is routed to irq 10 pcib0: slot 14 INTA is routed to irq 9 pcib0: slot 16 INTA is routed to irq 10 agp0: mem 0xf0000000-0xf7ffffff at device 0.0 on pci0 pcib1: at device 1.0 on pci0 pci1: on pcib1 pcib1: slot 0 INTA is routed to irq 5 pci1: at device 0.0 (no driver attached) isab0: at device 7.0 on pci0 isa0: on isab0 atapci0: port 0x1c40-0x1c4f at device 7.1 on pci0 atapci0: Correcting VIA config for southbridge data corruption bug ata0: at 0x1f0 irq 14 on atapci0 ata0: [MPSAFE] ata1: at 0x170 irq 15 on atapci0 ata1: [MPSAFE] uhci0: port 0x1c00-0x1c1f irq 9 at device 7.2 on pci0 uhci0: LegSup = 0x0000 usb0: on uhci0 usb0: USB revision 1.0 uhub0: VIA UHCI root hub, class 9/0, rev 1.00/1.00, addr 1 uhub0: 2 ports with 2 removable, self powered ugen0: Talon Technology Talon Technology 4800 baud serial interface, rev 1.00/1.05, addr 2 uhci1: port 0x1c20-0x1c3f irq 9 at device 7.3 on pci0 uhci1: LegSup = 0x0000 usb1: on uhci1 usb1: USB revision 1.0 uhub1: VIA UHCI root hub, class 9/0, rev 1.00/1.00, addr 1 uhub1: 2 ports with 2 removable, self powered isab1: at device 7.4 on pci0 device_probe_and_attach: isab1 attach returned 6 pcm0: port 0x1c50-0x1c53,0x1c54-0x1c57,0x1000-0x10ff irq 5 at device 7.5 on pci0 pcm0: pci0: at device 7.6 (no driver attached) cbb0: mem 0x88000000-0x88000fff irq 9 at device 10.0 on pci0 cardbus0: on cbb0 pccard0: <16-bit PCCard bus> on cbb0 cbb0: [MPSAFE] cbb1: mem 0x88001000-0x88001fff irq 10 at device 10.1 on pci0 cardbus1: on cbb1 pccard1: <16-bit PCCard bus> on cbb1 cbb1: [MPSAFE] fwohci0: mem 0xe8000000-0xe8003fff,0xe8004000-0xe80047ff irq 9 at device 14.0 on pci0 fwohci0: OHCI version 1.0 (ROM=1) fwohci0: No. of Isochronous channel is 4. fwohci0: EUI64 08:00:46:03:01:13:53:bc fwohci0: Phy 1394a available S400, 1 ports. fwohci0: Link S400, max_rec 2048 bytes. firewire0: on fwohci0 fwe0: on firewire0 if_fwe0: Fake Ethernet address: 0a:00:46:13:53:bc sbp0: on firewire0 fwohci0: Initiate bus reset fwohci0: BUS reset fwohci0: node_id=0xc000ffc0, gen=1, CYCLEMASTER mode firewire0: 1 nodes, maxhop <= 0, cable IRM = 0 (me) firewire0: bus manager 0 (me) rl0: port 0x1800-0x18ff mem 0xe8004800-0xe80048ff irq 10 at device 16.0 on pci0 rl0: Ethernet address: 08:00:46:59:6d:f9 miibus0: on rl0 rlphy0: on miibus0 rlphy0: 10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, auto acpi_acad0: on acpi0 acpi_cmbat0: on acpi0 acpi_cmbat1: on acpi0 acpi_lid0: on acpi0 speaker0 port 0x61 on acpi0 fdc0: port 0x3f7,0x3f0-0x3f5 irq 6 drq 2 on acpi0 fdc0: FIFO enabled, 8 bytes threshold fd0: <1440-KB 3.5" drive> on fdc0 drive 0 sio0 port 0x3f8-0x3ff irq 4 on acpi0 sio0: type 16550A atkbdc0: port 0x64,0x60 irq 1 on acpi0 atkbd0: flags 0x1 irq 1 on atkbdc0 kbd0 at atkbd0 psm0: irq 12 on atkbdc0 psm0: model GlidePoint, device ID 0 acpi_ec0: port 0x66,0x62 on acpi0 npx0: [FAST] npx0: on motherboard npx0: INT 16 interface orm0: