From owner-freebsd-usb@FreeBSD.ORG Sun Mar 16 03:20:03 2008 Return-Path: Delivered-To: freebsd-usb@hub.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id DEFCD1065672 for ; Sun, 16 Mar 2008 03:20:02 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [IPv6:2001:4f8:fff6::28]) by mx1.freebsd.org (Postfix) with ESMTP id C1C9A8FC16 for ; Sun, 16 Mar 2008 03:20:02 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1]) by freefall.freebsd.org (8.14.2/8.14.2) with ESMTP id m2G3K2ba003313 for ; Sun, 16 Mar 2008 03:20:02 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.14.2/8.14.1/Submit) id m2G3K2Uk003306; Sun, 16 Mar 2008 03:20:02 GMT (envelope-from gnats) Resent-Date: Sun, 16 Mar 2008 03:20:02 GMT Resent-Message-Id: <200803160320.m2G3K2Uk003306@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-usb@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, Marcin Cieslak Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id DA403106566C for ; Sun, 16 Mar 2008 03:16:36 +0000 (UTC) (envelope-from saper@saper.info) Received: from system.pl (system.pl [87.98.232.30]) by mx1.freebsd.org (Postfix) with ESMTP id 65CAB8FC14 for ; Sun, 16 Mar 2008 03:16:36 +0000 (UTC) (envelope-from saper@saper.info) Received: (qmail 10422 invoked by uid 10); 16 Mar 2008 04:13:47 +0100 Received: from radziecki.saper.info (localhost [127.0.0.1]) by radziecki.saper.info (8.14.2/8.14.2) with ESMTP id m2G3Fn9w014332 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Sun, 16 Mar 2008 04:15:51 +0100 (CET) (envelope-from saper@saper.info) Received: (from saper@localhost) by radziecki.saper.info (8.14.2/8.14.2/Submit) id m2G3FhNu014253; Sun, 16 Mar 2008 04:15:43 +0100 (CET) (envelope-from saper) Message-Id: <200803160315.m2G3FhNu014253@radziecki.saper.info> Date: Sun, 16 Mar 2008 04:15:43 +0100 (CET) From: Marcin Cieslak To: FreeBSD-gnats-submit@FreeBSD.org X-Send-Pr-Version: 3.113 Cc: usb@FreeBSD.org, saper@SYSTEM.PL, nike_d@cytexbg.com Subject: usb/121755: [patch] Fix panic after ohci/uhub cardbus device eject X-BeenThere: freebsd-usb@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: Marcin Cieslak List-Id: FreeBSD support for USB List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 16 Mar 2008 03:20:03 -0000 >Number: 121755 >Category: usb >Synopsis: [patch] Fix panic after ohci/uhub cardbus device eject >Confidential: no >Severity: critical >Priority: high >Responsible: freebsd-usb >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Sun Mar 16 03:20:02 UTC 2008 >Closed-Date: >Last-Modified: >Originator: Marcin Cieslak >Release: FreeBSD 7.0-PRERELEASE amd64 >Organization: >Environment: System: FreeBSD radziecki.saper.info 7.0-PRERELEASE FreeBSD 7.0-PRERELEASE #9: Sat Jan 26 01:36:13 CET 2008 saper@radziecki.saper.info:/usr/obj/usr/src/sys/VAIO amd64 >Description: When ejecting Cardbus card implementing OHCI inteface, one may get panic: ohci_rem_ed: ED not found or ucom0: detached (null): at uhub4 port 1 (addr 2) disconnected Fatal trap 12: page fault while in kernel mode fault virtual address = 0x400 fault code = supervisor read, page not present instruction pointer = 0x20:0xc0661e84 stack pointer = 0x28:0xd4d63b4c frame pointer = 0x28:0xd4d63b6c code segment = base 0x0, limit 0xfffff, type 0x1b = DPL 0, pres 1, def32 1, gran 1 processor eflags = interrupt enabled, resume, IOPL = 0 current process = 31 (cbb0 event thread) [thread pid 31 tid 100027 ] Stopped at kobj_delete+0x14: movl 0x400(%eax),%ebx when unplugging the device, as reported in this thread: http://thread.gmane.org/gmane.os.freebsd.current/92196 http://thread.gmane.org/gmane.os.freebsd.current/92196/focus=100202 >How-To-Repeat: Try removing Option GTMAX 7.2 3G UMTS modem device (also reported with HUAWEI datacards). >Fix: First patch fixes the ohci_rem_ed panic, the next one fixes the kobj_delete problem. Index: ohci_pci.c =================================================================== RCS file: /usr/home/ncvs/src/sys/dev/usb/ohci_pci.c,v retrieving revision 1.50 diff -u -u -r1.50 ohci_pci.c --- ohci_pci.c 21 Jun 2007 14:42:33 -0000 1.50 +++ ohci_pci.c 16 Mar 2008 01:33:07 -0000 @@ -348,6 +348,11 @@ { ohci_softc_t *sc = device_get_softc(self); + if (sc->sc_bus.bdev) { + device_delete_child(self, sc->sc_bus.bdev); + sc->sc_bus.bdev = NULL; + } + if (sc->sc_flags & OHCI_SCFLG_DONEINIT) { ohci_detach(sc, 0); sc->sc_flags &= ~OHCI_SCFLG_DONEINIT; @@ -367,10 +372,6 @@ err); sc->ih = NULL; } - if (sc->sc_bus.bdev) { - device_delete_child(self, sc->sc_bus.bdev); - sc->sc_bus.bdev = NULL; - } if (sc->irq_res) { bus_release_resource(self, SYS_RES_IRQ, 0, sc->irq_res); sc->irq_res = NULL; Index: usb_subr.c =================================================================== RCS file: /usr/home/ncvs/src/sys/dev/usb/usb_subr.c,v retrieving revision 1.95 diff -u -u -r1.95 usb_subr.c --- usb_subr.c 30 Jun 2007 20:18:44 -0000 1.95 +++ usb_subr.c 16 Mar 2008 02:51:05 -0000 @@ -1379,8 +1379,6 @@ device_get_ivars(dev->subdevs[i]); device_detach(dev->subdevs[i]); free(uaap, M_USB); - device_delete_child(device_get_parent(dev->subdevs[i]), - dev->subdevs[i]); dev->subdevs[i] = NULL; } } >Release-Note: >Audit-Trail: >Unformatted: