From owner-freebsd-bugs@FreeBSD.ORG Mon Dec 5 22:10:36 2005 Return-Path: X-Original-To: freebsd-bugs@hub.freebsd.org Delivered-To: freebsd-bugs@hub.freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 3E9D116A4EE for ; Mon, 5 Dec 2005 22:10:36 +0000 (GMT) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [216.136.204.21]) by mx1.FreeBSD.org (Postfix) with ESMTP id 132C143D95 for ; Mon, 5 Dec 2005 22:10:06 +0000 (GMT) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1]) by freefall.freebsd.org (8.13.3/8.13.3) with ESMTP id jB5MA6Fc031566 for ; Mon, 5 Dec 2005 22:10:06 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.13.3/8.13.1/Submit) id jB5MA6hQ031565; Mon, 5 Dec 2005 22:10:06 GMT (envelope-from gnats) Resent-Date: Mon, 5 Dec 2005 22:10:06 GMT Resent-Message-Id: <200512052210.jB5MA6hQ031565@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-bugs@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, Evgeny Zislis Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 94E9F16A420 for ; Mon, 5 Dec 2005 22:02:47 +0000 (GMT) (envelope-from kesor@kesor.net) Received: from smtp1.actcom.co.il (smtp1.actcom.co.il [192.114.47.64]) by mx1.FreeBSD.org (Postfix) with ESMTP id A08FE43D58 for ; Mon, 5 Dec 2005 22:02:45 +0000 (GMT) (envelope-from kesor@kesor.net) Received: from mail.kesor.net (line133-201.adsl.actcom.co.il [192.115.133.201]) by smtp1.actcom.co.il (8.13.3/8.13.3) with ESMTP id jB5M2cF4004560 for ; Tue, 6 Dec 2005 00:02:42 +0200 Received: from localhost (localhost [127.0.0.1]) by mail.kesor.net (Postfix) with ESMTP id 1018C5D for ; Tue, 6 Dec 2005 00:02:34 +0200 (IST) Received: from mail.kesor.net ([127.0.0.1]) by localhost (monster.kesor.net [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 71243-02 for ; Tue, 6 Dec 2005 00:00:51 +0200 (IST) Received: from thinky5e.kesor.net (thinky5e [192.168.1.45]) by mail.kesor.net (Postfix) with ESMTP id 883A459 for ; Tue, 6 Dec 2005 00:00:45 +0200 (IST) Received: from thinky5e.kesor.net (localhost [127.0.0.1]) by thinky5e.kesor.net (8.13.4/8.13.4) with ESMTP id jB5M0kYc001620 for ; Tue, 6 Dec 2005 00:00:46 +0200 (IST) (envelope-from kesor@thinky5e.kesor.net) Received: (from root@localhost) by thinky5e.kesor.net (8.13.4/8.13.4/Submit) id jB5M0jQw001619; Tue, 6 Dec 2005 00:00:45 +0200 (IST) (envelope-from kesor) Message-Id: <200512052200.jB5M0jQw001619@thinky5e.kesor.net> Date: Tue, 6 Dec 2005 00:00:45 +0200 (IST) From: Evgeny Zislis To: FreeBSD-gnats-submit@FreeBSD.org X-Send-Pr-Version: 3.113 Cc: Subject: kern/89997: panic on iPod mini detach X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: Evgeny Zislis List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 05 Dec 2005 22:10:36 -0000 >Number: 89997 >Category: kern >Synopsis: panic on iPod mini detach >Confidential: no >Severity: serious >Priority: high >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Mon Dec 05 22:10:06 GMT 2005 >Closed-Date: >Last-Modified: >Originator: Evgeny Zislis >Release: FreeBSD 6.0-STABLE i386 >Organization: >Environment: System: FreeBSD thinky5e.kesor.net 6.0-STABLE FreeBSD 6.0-STABLE #1: Mon Dec 5 20:36:54 IST 2005 root@thinky5e.kesor.net:/usr/obj/usr/src/sys/THINKY5E.debug i386 ThinkPad R50e , FreeBSD 6.0-STABLE (2005-11-05) >Description: When connecting an iPod mini to the computer, it is added as a device with the umass driver. When removing the usb cable the device is detached and the kernel panics. >How-To-Repeat: 1. Plug iPod mini into laptop 2. unplug iPod mini from laptop. my /etc/usbd.conf got these lines in it : device "Apple iPod mini" devname "umass[0-9]+" vendor 0x05ac product 0x1205 release 0x0000 attach "mount /dev/${DEVNAME} /mnt/ipod" Though the device doesnt mounts anyway . . ., and afaik its supposed to create a da0 device. (but thats another bug) >Fix: Kernel output : umass0: at uhub3 port 3 (addr 2) disconnected Fatal trap 12: page fault while in kernel mode fault virtual address = 0xdeadc116 fault code = supervisor write, page not present instruction pointer = 0x20:0xc044ce33 stack pointer = 0x28:0xd3ff9c74 frame pointer = 0x28:0xd3ff9c9c code segment = base 0x0, limit 0xfffff, type 0x1b = DPL 0, pres 1, def32 1, gran 1 processor eflags = interrupt enabled, resume, IOPL = 0 current process = 32 (swi2: cambio) trap number = 12 panic: page fault And another attempt yielded the same result : umass0: BBB reset failed, IOERROR umass0: at uhub3 port 4 (addr 2) disconnected Fatal trap 12: page fault while in kernel mode fault virtual address = 0xdeadc116 fault code = supervisor write, page not present instruction pointer = 0x20:0xc044ce33 stack pointer = 0x28:0xd3ff9c74 frame pointer = 0x28:0xd3ff9c9c code segment = base 0x0, limit 0xfffff, type 0x1b = DPL 0, pres 1, def32 1, gran 1 processor eflags = interrupt enabled, resume, IOPL = 0 current process = 32 (swi2: cambio) trap number = 12 panic: page fault The backtrace is the same for both cases (except frame addresses) : #0 doadump () at pcpu.h:165 #1 0xc05a7e72 in boot (howto=260) at /usr/src/sys/kern/kern_shutdown.c:399 #2 0xc05a81e8 in panic (fmt=0xc07ae405 "%s") at /usr/src/sys/kern/kern_shutdown.c:555 #3 0xc0764d0e in trap_fatal (frame=0xd3ff9c34, eva=0) at /usr/src/sys/i386/i386/trap.c:836 #4 0xc07649a2 in trap_pfault (frame=0xd3ff9c34, usermode=0, eva=3735929110) at /usr/src/sys/i386/i386/trap.c:744 #5 0xc076457e in trap (frame={tf_fs = -1065222136, tf_es = 40, tf_ds = -1065287640, tf_edi = -1004700672, tf_esi = -1018231808, tf_ebp = -738222948, tf_isp = -738223008, tf_ebx = -1018231808, tf_edx = -1004700568, tf_ecx = -1004700604, tf_eax = -559038242, tf_trapno = 12, tf_err = 2, tf_eip = -1069232589, tf_cs = 32, tf_eflags = 590338, tf_esp = -1065250240, tf_ss = 0}) at /usr/src/sys/i386/i386/trap.c:434 #6 0xc075573a in calltrap () at /usr/src/sys/i386/i386/exception.s:139 #7 0xc044ce33 in camisr (V_queue=0xc34f0400) at /usr/src/sys/cam/cam_xpt.c:7099 #8 0xc058d6f6 in ithread_loop (arg=0xc326ca00) at /usr/src/sys/kern/kern_intr.c:547 #9 0xc058c2b4 in fork_exit (callout=0xc058d480 , arg=0xdeadc0de, frame=0xdeadc0de) at /usr/src/sys/kern/kern_fork.c:789 #10 0xc075579c in fork_trampoline () at /usr/src/sys/i386/i386/exception.s:208 Kernel configuration contains these relevant lines : device scbus device da device pass device usb device uhci device ehci device ugen device uhid device umass USB device list without the iPod : # usbdevs -v Controller /dev/usb0: addr 1: full speed, self powered, config 1, UHCI root hub(0x0000), Intel(0x0000), rev 1.00 port 1 powered port 2 powered Controller /dev/usb1: addr 1: full speed, self powered, config 1, UHCI root hub(0x0000), Intel(0x0000), rev 1.00 port 1 powered port 2 powered Controller /dev/usb2: addr 1: full speed, self powered, config 1, UHCI root hub(0x0000), Intel(0x0000), rev 1.00 port 1 powered port 2 powered Controller /dev/usb3: addr 1: high speed, self powered, config 1, EHCI root hub(0x0000), Intel(0x0000), rev 1.00 port 1 powered port 2 powered port 3 powered port 4 powered port 5 powered port 6 powered USB device list with the iPod : # usbdevs -v Controller /dev/usb0: addr 1: full speed, self powered, config 1, UHCI root hub(0x0000), Intel(0x0000), rev 1.00 port 1 powered port 2 powered Controller /dev/usb1: addr 1: full speed, self powered, config 1, UHCI root hub(0x0000), Intel(0x0000), rev 1.00 port 1 powered port 2 powered Controller /dev/usb2: addr 1: full speed, self powered, config 1, UHCI root hub(0x0000), Intel(0x0000), rev 1.00 port 1 powered port 2 powered Controller /dev/usb3: addr 1: high speed, self powered, config 1, EHCI root hub(0x0000), Intel(0x0000), rev 1.00 port 1 powered port 2 powered port 3 addr 2: high speed, power 500 mA, config 1, iPod mini(0x1205), Apple(0x05ac), rev 0.01 port 4 powered port 5 powered port 6 powered When iPod attached the kernel dmesg shows : umass0: Apple iPod mini, rev 2.00/0.01, addr 2 >Release-Note: >Audit-Trail: >Unformatted: