Date: Tue, 6 Dec 2005 00:00:45 +0200 (IST) From: Evgeny Zislis <kesor@kesor.net> To: FreeBSD-gnats-submit@FreeBSD.org Subject: kern/89997: panic on iPod mini detach Message-ID: <200512052200.jB5M0jQw001619@thinky5e.kesor.net> Resent-Message-ID: <200512052210.jB5MA6hQ031565@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
>Number: 89997
>Category: kern
>Synopsis: panic on iPod mini detach
>Confidential: no
>Severity: serious
>Priority: high
>Responsible: freebsd-bugs
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: sw-bug
>Submitter-Id: current-users
>Arrival-Date: Mon Dec 05 22:10:06 GMT 2005
>Closed-Date:
>Last-Modified:
>Originator: Evgeny Zislis
>Release: FreeBSD 6.0-STABLE i386
>Organization:
>Environment:
System: FreeBSD thinky5e.kesor.net 6.0-STABLE FreeBSD 6.0-STABLE #1: Mon Dec 5 20:36:54 IST 2005 root@thinky5e.kesor.net:/usr/obj/usr/src/sys/THINKY5E.debug i386
ThinkPad R50e , FreeBSD 6.0-STABLE (2005-11-05)
>Description:
When connecting an iPod mini to the computer, it is added as a device
with the umass driver. When removing the usb cable the device is detached
and the kernel panics.
>How-To-Repeat:
1. Plug iPod mini into laptop
2. unplug iPod mini from laptop.
my /etc/usbd.conf got these lines in it :
device "Apple iPod mini"
devname "umass[0-9]+"
vendor 0x05ac
product 0x1205
release 0x0000
attach "mount /dev/${DEVNAME} /mnt/ipod"
Though the device doesnt mounts anyway . . ., and afaik its supposed to create a da0 device. (but thats another bug)
>Fix:
Kernel output :
umass0: at uhub3 port 3 (addr 2) disconnected
Fatal trap 12: page fault while in kernel mode
fault virtual address = 0xdeadc116
fault code = supervisor write, page not present
instruction pointer = 0x20:0xc044ce33
stack pointer = 0x28:0xd3ff9c74
frame pointer = 0x28:0xd3ff9c9c
code segment = base 0x0, limit 0xfffff, type 0x1b
= DPL 0, pres 1, def32 1, gran 1
processor eflags = interrupt enabled, resume, IOPL = 0
current process = 32 (swi2: cambio)
trap number = 12
panic: page fault
And another attempt yielded the same result :
umass0: BBB reset failed, IOERROR
umass0: at uhub3 port 4 (addr 2) disconnected
Fatal trap 12: page fault while in kernel mode
fault virtual address = 0xdeadc116
fault code = supervisor write, page not present
instruction pointer = 0x20:0xc044ce33
stack pointer = 0x28:0xd3ff9c74
frame pointer = 0x28:0xd3ff9c9c
code segment = base 0x0, limit 0xfffff, type 0x1b
= DPL 0, pres 1, def32 1, gran 1
processor eflags = interrupt enabled, resume, IOPL = 0
current process = 32 (swi2: cambio)
trap number = 12
panic: page fault
The backtrace is the same for both cases (except frame addresses) :
#0 doadump () at pcpu.h:165
#1 0xc05a7e72 in boot (howto=260) at /usr/src/sys/kern/kern_shutdown.c:399
#2 0xc05a81e8 in panic (fmt=0xc07ae405 "%s") at /usr/src/sys/kern/kern_shutdown.c:555
#3 0xc0764d0e in trap_fatal (frame=0xd3ff9c34, eva=0) at /usr/src/sys/i386/i386/trap.c:836
#4 0xc07649a2 in trap_pfault (frame=0xd3ff9c34, usermode=0, eva=3735929110) at /usr/src/sys/i386/i386/trap.c:744
#5 0xc076457e in trap (frame={tf_fs = -1065222136, tf_es = 40, tf_ds = -1065287640, tf_edi = -1004700672, tf_esi = -1018231808, tf_ebp = -738222948, tf_isp = -738223008, tf_ebx = -1018231808, tf_edx = -1004700568, tf_ecx = -1004700604, tf_eax = -559038242, tf_trapno = 12, tf_err = 2, tf_eip = -1069232589, tf_cs = 32, tf_eflags = 590338, tf_esp = -1065250240, tf_ss = 0}) at /usr/src/sys/i386/i386/trap.c:434
#6 0xc075573a in calltrap () at /usr/src/sys/i386/i386/exception.s:139
#7 0xc044ce33 in camisr (V_queue=0xc34f0400) at /usr/src/sys/cam/cam_xpt.c:7099
#8 0xc058d6f6 in ithread_loop (arg=0xc326ca00) at /usr/src/sys/kern/kern_intr.c:547
#9 0xc058c2b4 in fork_exit (callout=0xc058d480 <ithread_loop>, arg=0xdeadc0de, frame=0xdeadc0de) at /usr/src/sys/kern/kern_fork.c:789
#10 0xc075579c in fork_trampoline () at /usr/src/sys/i386/i386/exception.s:208
Kernel configuration contains these relevant lines :
device scbus
device da
device pass
device usb
device uhci
device ehci
device ugen
device uhid
device umass
USB device list without the iPod :
# usbdevs -v
Controller /dev/usb0:
addr 1: full speed, self powered, config 1, UHCI root hub(0x0000), Intel(0x0000), rev 1.00
port 1 powered
port 2 powered
Controller /dev/usb1:
addr 1: full speed, self powered, config 1, UHCI root hub(0x0000), Intel(0x0000), rev 1.00
port 1 powered
port 2 powered
Controller /dev/usb2:
addr 1: full speed, self powered, config 1, UHCI root hub(0x0000), Intel(0x0000), rev 1.00
port 1 powered
port 2 powered
Controller /dev/usb3:
addr 1: high speed, self powered, config 1, EHCI root hub(0x0000), Intel(0x0000), rev 1.00
port 1 powered
port 2 powered
port 3 powered
port 4 powered
port 5 powered
port 6 powered
USB device list with the iPod :
# usbdevs -v
Controller /dev/usb0:
addr 1: full speed, self powered, config 1, UHCI root hub(0x0000), Intel(0x0000), rev 1.00
port 1 powered
port 2 powered
Controller /dev/usb1:
addr 1: full speed, self powered, config 1, UHCI root hub(0x0000), Intel(0x0000), rev 1.00
port 1 powered
port 2 powered
Controller /dev/usb2:
addr 1: full speed, self powered, config 1, UHCI root hub(0x0000), Intel(0x0000), rev 1.00
port 1 powered
port 2 powered
Controller /dev/usb3:
addr 1: high speed, self powered, config 1, EHCI root hub(0x0000), Intel(0x0000), rev 1.00
port 1 powered
port 2 powered
port 3 addr 2: high speed, power 500 mA, config 1, iPod mini(0x1205), Apple(0x05ac), rev 0.01
port 4 powered
port 5 powered
port 6 powered
When iPod attached the kernel dmesg shows :
umass0: Apple iPod mini, rev 2.00/0.01, addr 2
>Release-Note:
>Audit-Trail:
>Unformatted:
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200512052200.jB5M0jQw001619>