From owner-freebsd-questions@FreeBSD.ORG  Thu Feb 23 14:36:48 2006
Return-Path: <owner-freebsd-questions@FreeBSD.ORG>
X-Original-To: freebsd-questions@freebsd.org
Delivered-To: freebsd-questions@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 0524A16A420
	for <freebsd-questions@freebsd.org>;
	Thu, 23 Feb 2006 14:36:48 +0000 (GMT)
	(envelope-from tinguely@casselton.net)
Received: from casselton.net (casselton.net [63.165.140.2])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 98F1943D48
	for <freebsd-questions@freebsd.org>;
	Thu, 23 Feb 2006 14:36:47 +0000 (GMT)
	(envelope-from tinguely@casselton.net)
Received: from casselton.net (localhost [127.0.0.1])
	by casselton.net (8.12.11/8.12.11) with ESMTP id k1NEaggM044573;
	Thu, 23 Feb 2006 08:36:42 -0600 (CST)
	(envelope-from tinguely@casselton.net)
Received: (from tinguely@localhost)
	by casselton.net (8.12.11/8.12.11/Submit) id k1NEaguY044572;
	Thu, 23 Feb 2006 08:36:42 -0600 (CST) (envelope-from tinguely)
Date: Thu, 23 Feb 2006 08:36:42 -0600 (CST)
From: Mark Tinguely <tinguely@casselton.net>
Message-Id: <200602231436.k1NEaguY044572@casselton.net>
To: davel@compbook.co.uk, freebsd-questions@freebsd.org
In-Reply-To: <43FD067B.4040604@compbook.co.uk>
X-Spam-Status: No, score=0.0 required=5.0 tests=none autolearn=failed 
	version=3.1.0
X-Spam-Checker-Version: SpamAssassin 3.1.0 (2005-09-13) on ccn.casselton.net
Cc: 
Subject: Re: Page Fault - Wireless problem?
X-BeenThere: freebsd-questions@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: User questions <freebsd-questions.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
	<mailto:freebsd-questions-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-questions>
List-Post: <mailto:freebsd-questions@freebsd.org>
List-Help: <mailto:freebsd-questions-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
	<mailto:freebsd-questions-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 23 Feb 2006 14:36:48 -0000

>  Unread portion of the kernel message buffer:
>  ural0: could not transmit buffer: SHORT_XFER
>
>
>  Fatal trap 12: page fault while in kernel mode
>  fault virtual address   = 0x4
>  fault code              = supervisor read, page not present
>  instruction pointer     = 0x20:0xc0667091
>  stack pointer           = 0x28:0xd33e4c00
>  frame pointer           = 0x28:0xd33e4c0c
>  code segment            = base 0x0, limit 0xfffff, type 0x1b
>                         = DPL 0, pres 1, def32 1, gran 1
>  processor eflags        = interrupt enabled, resume, IOPL = 0
>  current process         = 32 (irq21: uhci0 uhci1+)
>  trap number             = 12
>  panic: page fault

I am not a USB/Ralink expert, but it the node can be removed
mid-transmission elsewhere (ural_free_tx_list) on input errors.
I don't know about threading issues that would require extra locking
as well:

in sys/dev/usb/
--- if_ural.c.orig	Sun Jan 29 08:16:36 2006
+++ if_ural.c	Thu Feb 23 08:30:36 2006
@@ -881,8 +881,10 @@
 
 	m_freem(data->m);
 	data->m = NULL;
-	ieee80211_free_node(data->ni);
-	data->ni = NULL;
+	if (data->ni != NULL) {
+		ieee80211_free_node(data->ni);
+		data->ni = NULL;
+	}
 
 	sc->tx_queued--;
 	ifp->if_opackets++;