Date: Sun, 30 Apr 2006 05:20:24 GMT From: Eugene Grosbein <eugen@grosbein.pp.ru> To: freebsd-usb@FreeBSD.org Subject: Re: usb/93949 : ugen(4)-related repeatable kernel panic in 6.1-PRERELEASE Message-ID: <200604300520.k3U5KOo7000629@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
The following reply was made to PR usb/93949; it has been noted by GNATS.
From: Eugene Grosbein <eugen@grosbein.pp.ru>
To: bug-followup@freebsd.org
Cc: Anish Mistry <amistry@am-productions.biz>
Subject: Re: usb/93949 : ugen(4)-related repeatable kernel panic in 6.1-PRERELEASE
Date: Sun, 30 Apr 2006 13:16:26 +0800
>> I've tried, it still panices just after USB cable is unlugged.
> I'm not sure what the problem is that you're seeing. Since the
> backtrace you posted in the PR has the important part corrupted.
> Would you be able to hook up a firewire or serial console and see if
> you can get a usable backtrace?
Here it comes (obtained with serial console):
ugen0: at uhub0 port 2 (addr 3) disconnected
All threads purged from ugen0.1
All threads purged from ugen0
ugen0: detached
Fatal trap 12: page fault while in kernel mode
fault virtual address = 0xc4beb2f4
fault code = supervisor write, page not present
instruction pointer = 0x20:0xc058c910
stack pointer = 0x28:0xdd047b74
frame pointer = 0x28:0xdd047b88
code segment = base 0x0, limit 0xfffff, type 0x1b
= DPL 0, pres 1, def32 1, gran 1
processor eflags = interrupt enabled, resume, IOPL = 0
current process = 707 (apcupsd)
trap number = 12
panic: page fault
KDB: stack backtrace:
kdb_backtrace(c07792e5,c07ea480,c0762228,dd047a7c,100) at 0xc057ecfe = kdb_backtrace+0x2e
panic(c0762228,c0799e37,c4e559b8,1,1) at 0xc0560fb7 = panic+0xb7
trap_fatal(dd047b34,c4beb2f4,2,0,c4e51180) at 0xc072c7ee = trap_fatal+0x33e
trap_pfault(dd047b34,0,c4beb2f4,dd047b18,c4beb2f4) at 0xc072c482 = trap_pfault+0x1b2
trap(c0770008,28,28,c4e51180,0) at 0xc072c05e = trap+0x36e
calltrap() at 0xc0718c7a = calltrap+0x5
--- trap 0xc, eip = 0xc058c910, esp = 0xdd047b74, ebp = 0xdd047b88 ---
clear_selinfo_list(c4e51180,c07ef4c0,217f,3c6,18) at 0xc058c910 = clear_selinfo_list+0x40
poll(c4e51180,dd047d04,c,41d,3) at 0xc058c5e0 = poll+0x470
syscall(3b,3b,3b,28140144,0) at 0xc072cb20 = syscall+0x2c0
Xint0x80_syscall() at 0xc0718ccf = Xint0x80_syscall+0x1f
--- syscall (209, FreeBSD ELF32, poll), eip = 0x280fd648, esp = 0x806ff3c, ebp = 0x806ff98 ---
Uptime: 1m22s
Dumping 575 MB (2 chunks)
chunk 0: 1MB (159 pages) ... ok
chunk 1: 575MB (147184 pages) 559 543 527 511 495 479 463 447 431 415 399 383 367 351 335 319 303 287 271 255 239 223 207 191 175 159 143 127 111 95 79 63 47 31 15 ... ok
Dump complete
Automatic reboot in 15 seconds - press a key on the console to abort
Rebooting...
> Also would you post your dmesg output and "ls -l /dev/ugen*" with the
> device connected.
$ ls -l /dev/ugen*
crw-r--r-- 1 root operator 0, 90 Apr 30 12:42 /dev/ugen0
crw-r--r-- 1 root operator 0, 91 Apr 30 12:42 /dev/ugen0.1
Here is /var/run/dmesg.boot
Copyright (c) 1992-2006 The FreeBSD Project.
Copyright (c) 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994
The Regents of the University of California. All rights reserved.
FreeBSD 6.1-RC #10: Sun Apr 30 12:36:13 KRAST 2006
root@grosbein.pp.ru:/mnt/usr/local/obj6/usr/src/sys/DADV
WARNING: debug.mpsafenet forced to 0 as ipsec requires Giant
WARNING: MPSAFE network stack disabled, expect reduced performance.
MEMGUARD DEBUGGING ALLOCATOR INITIALIZED:
MEMGUARD map base: 0xc36c9000
MEMGUARD map limit: 0xc495b000
MEMGUARD map size: 19472384 (Bytes)
Timecounter "i8254" frequency 1193182 Hz quality 0
CPU: Intel Celeron (902.05-MHz 686-class CPU)
Origin = "GenuineIntel" Id = 0x68a Stepping = 10
Features=0x383f9ff<FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,MMX,FXSR,SSE>
real memory = 603914240 (575 MB)
avail memory = 581664768 (554 MB)
npx0: [FAST]
npx0: <math processor> on motherboard
npx0: INT 16 interface
acpi0: <AWARD AWRDACPI> on motherboard
acpi0: Power Button (fixed)
Timecounter "ACPI-safe" frequency 3579545 Hz quality 1000
acpi_timer0: <24-bit timer at 3.579545MHz> port 0x4008-0x400b on acpi0
cpu0: <ACPI CPU> on acpi0
acpi_throttle0: <ACPI CPU Throttling> on cpu0
acpi_button0: <Power Button> on acpi0
pcib0: <ACPI Host-PCI bridge> port 0xcf8-0xcff,0x4000-0x4041,0x5000-0x500f on acpi0
pcib0: failed to force attach of \\_SB_.PCI0.ISA_.LNKA
pcib0: failed to force attach of \\_SB_.PCI0.ISA_.LNKB
pcib0: failed to force attach of \\_SB_.PCI0.ISA_.LNKC
pcib0: failed to force attach of \\_SB_.PCI0.ISA_.LNKD
pcib0: failed to force attach of \\_SB_.PCI0.ISA_.LNKB
pcib0: failed to force attach of \\_SB_.PCI0.ISA_.LNKC
pcib0: failed to force attach of \\_SB_.PCI0.ISA_.LNKD
pcib0: failed to force attach of \\_SB_.PCI0.ISA_.LNKA
pcib0: failed to force attach of \\_SB_.PCI0.ISA_.LNKC
pcib0: failed to force attach of \\_SB_.PCI0.ISA_.LNKD
pcib0: failed to force attach of \\_SB_.PCI0.ISA_.LNKA
pcib0: failed to force attach of \\_SB_.PCI0.ISA_.LNKB
pcib0: failed to force attach of \\_SB_.PCI0.ISA_.LNKD
pcib0: failed to force attach of \\_SB_.PCI0.ISA_.LNKA
pcib0: failed to force attach of \\_SB_.PCI0.ISA_.LNKB
pcib0: failed to force attach of \\_SB_.PCI0.ISA_.LNKC
pcib0: failed to force attach of \\_SB_.PCI0.ISA_.LNKA
pcib0: failed to force attach of \\_SB_.PCI0.ISA_.LNKB
pcib0: failed to force attach of \\_SB_.PCI0.ISA_.LNKC
pcib0: failed to force attach of \\_SB_.PCI0.ISA_.LNKD
pcib0: failed to force attach of \\_SB_.PCI0.ISA_.LNKA
pcib0: failed to force attach of \\_SB_.PCI0.ISA_.LNKB
pcib0: failed to force attach of \\_SB_.PCI0.ISA_.LNKC
pcib0: failed to force attach of \\_SB_.PCI0.ISA_.LNKD
pci0: <ACPI PCI bus> on pcib0
agp0: <Intel 82443BX (440 BX) host to PCI bridge> mem 0xe8000000-0xebffffff at device 0.0 on pci0
pcib1: <PCI-PCI bridge> at device 1.0 on pci0
pci1: <PCI bus> on pcib1
drm0: <ATI Radeon RV280 9200 SE> port 0x9000-0x90ff mem 0xd8000000-0xdfffffff,0xed000000-0xed00ffff irq 11 at device 0.0 on pci1
info: [drm] AGP at 0xe8000000 64MB
info: [drm] Initialized radeon 1.19.0 20050911
pci1: <display> at device 0.1 (no driver attached)
isab0: <PCI-ISA bridge> at device 7.0 on pci0
isa0: <ISA bus> on isab0
atapci0: <Intel PIIX4 UDMA33 controller> port 0x1f0-0x1f7,0x3f6,0x170-0x177,0x376,0xf000-0xf00f at device 7.1 on pci0
ata0: <ATA channel 0> on atapci0
ata1: <ATA channel 1> on atapci0
uhci0: <Intel 82371AB/EB (PIIX4) USB controller> port 0xa000-0xa01f irq 9 at device 7.2 on pci0
uhci0: [GIANT-LOCKED]
usb0: <Intel 82371AB/EB (PIIX4) USB controller> on uhci0
usb0: USB revision 1.0
uhub0: Intel UHCI root hub, class 9/0, rev 1.00/1.00, addr 1
uhub0: 2 ports with 2 removable, self powered
pci0: <bridge> at device 7.3 (no driver attached)
fxp0: <Intel 82557 Pro/100 Ethernet> port 0xa400-0xa41f mem 0xf0104000-0xf0104fff,0xf0000000-0xf00fffff irq 9 at device 16.0 on pci0
miibus0: <MII bus> on fxp0
inphy0: <i82555 10/100 media interface> on miibus0
inphy0: 10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, auto
fxp0: Ethernet address: 00:a0:c9:89:95:1f
fxp0: [GIANT-LOCKED]
atapci1: <Promise PDC20268 UDMA100 controller> port 0xa800-0xa807,0xac00-0xac03,0xb000-0xb007,0xb400-0xb403,0xb800-0xb80f mem 0xf0100000-0xf0103fff irq 10 at device 18.0 on pci0
ata2: <ATA channel 0> on atapci1
ata3: <ATA channel 1> on atapci1
uhci1: <VIA 83C572 USB controller> port 0xbc00-0xbc1f irq 9 at device 19.0 on pci0
uhci1: [GIANT-LOCKED]
usb1: <VIA 83C572 USB controller> on uhci1
usb1: USB revision 1.0
uhub1: VIA UHCI root hub, class 9/0, rev 1.00/1.00, addr 1
uhub1: 2 ports with 2 removable, self powered
uhci2: <VIA 83C572 USB controller> port 0xc000-0xc01f irq 11 at device 19.1 on pci0
uhci2: [GIANT-LOCKED]
usb2: <VIA 83C572 USB controller> on uhci2
usb2: USB revision 1.0
uhub2: VIA UHCI root hub, class 9/0, rev 1.00/1.00, addr 1
uhub2: 2 ports with 2 removable, self powered
ehci0: <VIA VT6202 USB 2.0 controller> mem 0xf0105000-0xf01050ff irq 9 at device 19.2 on pci0
ehci0: [GIANT-LOCKED]
usb3: EHCI version 1.0
usb3: companion controllers, 2 ports each: usb1 usb2
usb3: <VIA VT6202 USB 2.0 controller> on ehci0
usb3: USB revision 2.0
uhub3: VIA EHCI root hub, class 9/0, rev 2.00/1.00, addr 1
uhub3: 4 ports with 4 removable, self powered
fwohci0: <VIA Fire II (VT6306)> port 0xc400-0xc47f mem 0xf0106000-0xf01067ff irq 9 at device 19.3 on pci0
fwohci0: [GIANT-LOCKED]
fwohci0: OHCI version 1.10 (ROM=1)
fwohci0: No. of Isochronous channels is 4.
fwohci0: EUI64 00:11:06:66:00:00:0d:c9
fwohci0: Phy 1394a available S400, 3 ports.
fwohci0: Link S400, max_rec 2048 bytes.
firewire0: <IEEE1394(FireWire) bus> on fwohci0
sbp0: <SBP-2/SCSI over FireWire> on firewire0
fwe0: <Ethernet over FireWire> on firewire0
if_fwe0: Fake Ethernet address: 02:11:06:00:0d:c9
fwe0: Ethernet address: 02:11:06:00:0d:c9
fwohci0: Initiate bus reset
fwohci0: node_id=0xc800ffc0, gen=1, CYCLEMASTER mode
firewire0: 1 nodes, maxhop <= 0, cable IRM = 0 (me)
firewire0: bus manager 0 (me)
acpi_tz0: <Thermal Zone> on acpi0
fdc0: <floppy drive controller> port 0x3f2-0x3f5,0x3f7 irq 6 drq 2 on acpi0
fdc0: [FAST]
fd0: <1440-KB 3.5" drive> on fdc0 drive 0
sio0: <16550A-compatible COM port> port 0x3f8-0x3ff irq 4 flags 0x10 on acpi0
sio0: type 16550A
sio1: <16550A-compatible COM port> port 0x2f8-0x2ff irq 3 on acpi0
sio1: type 16550A
ppc0: <ECP parallel printer port> port 0x378-0x37f,0x778-0x77b irq 7 drq 3 on acpi0
ppc0: SMC-like chipset (ECP/EPP/PS2/NIBBLE) in COMPATIBLE mode
ppc0: FIFO with 16/16/16 bytes threshold
ppbus0: <Parallel port bus> on ppc0
lpt0: <Printer> on ppbus0
lpt0: Interrupt-driven port
ppi0: <Parallel I/O> on ppbus0
atkbdc0: <Keyboard controller (i8042)> port 0x60,0x64 irq 1 on acpi0
atkbd0: <AT Keyboard> irq 1 on atkbdc0
kbd0 at atkbd0
atkbd0: [GIANT-LOCKED]
psm0: current command byte:0047
psm0: found NetMouse/NetScroll Optical
psm0: <PS/2 Mouse> irq 12 on atkbdc0
psm0: [GIANT-LOCKED]
psm0: model NetMouse/NetScroll Optical, device ID 0-00, 3 buttons
psm0: config:00000000, flags:00000008, packet size:4
psm0: syncmask:08, syncbits:00
pmtimer0 on isa0
orm0: <ISA Option ROMs> at iomem 0xc0000-0xccfff,0xd0000-0xd27ff on isa0
sc0: <System console> at flags 0x100 on isa0
sc0: VGA <16 virtual consoles, flags=0x300>
vga0: <Generic ISA VGA> at port 0x3c0-0x3df iomem 0xa0000-0xbffff on isa0
pcm0: <Yamaha OPL-SAx> at port 0x220-0x22f,0x530-0x537,0x388-0x38f,0x330-0x331,0x370-0x371 irq 5 drq 0,1 on isa0
pcm0: [GIANT-LOCKED]
uscanner0: Hewlett-Packard HP ScanJet 2200C, rev 1.10/1.00, addr 2
ugen0: American Power Conversion Back-UPS 500 FW: 6.5.I USB FW: c1, rev 1.10/1.00, addr 3
Timecounter "TSC" frequency 902050193 Hz quality 800
Timecounters tick every 1.000 msec
IPsec: Initialized Security Association Processing.
ipfw2 (+ipv6) initialized, divert loadable, rule-based forwarding enabled, default to deny, logging disabled
acd0: DVDR <NEC DVD RW ND-3500AG/2.18> at ata1-master UDMA33
ad4: 76319MB <WDC WD800JB-00FMA0 13.03G13> at ata2-master UDMA100
ad6: 39266MB <IC35L040AVER07 0 ER4OA45A> at ata3-master UDMA100
Trying to mount root from ufs:/dev/ad6s2a
WARNING: / was not properly dismounted
Here is one more kdb backtrace obtained from vmcore after reboot.
Please note this time I have next options in the kernel:
options KDB
options KDB_TRACE
options KDB_UNATTENDED
options DDB
options DDB_NUMSYM
options GDB
options INVARIANTS
options INVARIANT_SUPPORT
options DEBUG_MEMGUARD
It seems that INVARIANTS do not catch the bug.
GNU gdb 6.1.1 [FreeBSD]
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB. Type "show warranty" for details.
This GDB was configured as "i386-marcel-freebsd".
Unread portion of the kernel message buffer:
Fatal trap 12: page fault while in kernel mode
fault virtual address = 0xc4beb2f4
fault code = supervisor write, page not present
instruction pointer = 0x20:0xc058c910
stack pointer = 0x28:0xdd047b74
frame pointer = 0x28:0xdd047b88
code segment = base 0x0, limit 0xfffff, type 0x1b
= DPL 0, pres 1, def32 1, gran 1
processor eflags = interrupt enabled, resume, IOPL = 0
current process = 707 (apcupsd)
trap number = 12
panic: page fault
KDB: stack backtrace:
kdb_backtrace(c07792e5,c07ea480,c0762228,dd047a7c,100) at 0xc057ecfe = kdb_backtrace+0x2e
panic(c0762228,c0799e37,c4e559b8,1,1) at 0xc0560fb7 = panic+0xb7
trap_fatal(dd047b34,c4beb2f4,2,0,c4e51180) at 0xc072c7ee = trap_fatal+0x33e
trap_pfault(dd047b34,0,c4beb2f4,dd047b18,c4beb2f4) at 0xc072c482 = trap_pfault+0x1b2
trap(c0770008,28,28,c4e51180,0) at 0xc072c05e = trap+0x36e
calltrap() at 0xc0718c7a = calltrap+0x5
--- trap 0xc, eip = 0xc058c910, esp = 0xdd047b74, ebp = 0xdd047b88 ---
clear_selinfo_list(c4e51180,c07ef4c0,217f,3c6,18) at 0xc058c910 = clear_selinfo_list+0x40
poll(c4e51180,dd047d04,c,41d,3) at 0xc058c5e0 = poll+0x470
syscall(3b,3b,3b,28140144,0) at 0xc072cb20 = syscall+0x2c0
Xint0x80_syscall() at 0xc0718ccf = Xint0x80_syscall+0x1f
--- syscall (209, FreeBSD ELF32, poll), eip = 0x280fd648, esp = 0x806ff3c, ebp = 0x806ff98 ---
Uptime: 1m22s
Dumping 575 MB (2 chunks)
chunk 0: 1MB (159 pages) ... ok
chunk 1: 575MB (147184 pages) 559 543 527 511 495 479 463 447 431 415 399 383 367 351 335 319 303 287 271 255 239 223 207 191 175 159 143 127 111 95 79 63 47 31 15
#0 doadump () at pcpu.h:165
165 __asm __volatile("movl %%fs:0,%0" : "=r" (td));
(kgdb) bt
#0 doadump () at pcpu.h:165
#1 0xc0560cda in boot (howto=260) at /usr/src/sys/kern/kern_shutdown.c:402
#2 0xc0561048 in panic (fmt=0xc0762228 "%s")
at /usr/src/sys/kern/kern_shutdown.c:558
#3 0xc072c7ee in trap_fatal (frame=0xdd047b34, eva=0)
at /usr/src/sys/i386/i386/trap.c:836
#4 0xc072c482 in trap_pfault (frame=0xdd047b34, usermode=0, eva=3300831988)
at /usr/src/sys/i386/i386/trap.c:744
#5 0xc072c05e in trap (frame=
{tf_fs = -1065943032, tf_es = 40, tf_ds = 40, tf_edi = -991620736, tf_esi = 0, tf_ebp = -586908792, tf_isp = -586908832, tf_ebx = -991620736, tf_edx = -991620736, tf_ecx = 1, tf_eax = -994135316, tf_trapno = 12, tf_err = 2, tf_eip = -1067923184, tf_cs = 32, tf_eflags = 590466, tf_esp = -1065421632, tf_ss = 1})
at /usr/src/sys/i386/i386/trap.c:434
#6 0xc0718c7a in calltrap () at /usr/src/sys/i386/i386/exception.s:139
#7 0xc058c910 in clear_selinfo_list (td=0xc4e51180)
at /usr/src/sys/kern/sys_generic.c:1078
#8 0xc058c5e0 in poll (td=0xc4e51180, uap=0xdd047d04)
at /usr/src/sys/kern/sys_generic.c:977
#9 0xc072cb20 in syscall (frame=
{tf_fs = 59, tf_es = 59, tf_ds = 59, tf_edi = 672399684, tf_esi = 0, tf_ebp = 134676376, tf_isp = -586908316, tf_ebx = 672407692, tf_edx = -1078989268, tf_ecx = 8574, tf_eax = 209, tf_trapno = 22, tf_err = 2, tf_eip = 672126536, tf_cs = 51, tf_eflags = 515, tf_esp = 134676284, tf_ss = 59})
at /usr/src/sys/i386/i386/trap.c:981
#10 0xc0718ccf in Xint0x80_syscall () at /usr/src/sys/i386/i386/exception.s:200
#11 0x00000033 in ?? ()
(kgdb) quit
Eugene Grosbein
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200604300520.k3U5KOo7000629>