From owner-freebsd-usb@freebsd.org Fri Sep 30 08:53:34 2016 Return-Path: Delivered-To: freebsd-usb@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 8A2EDC032D7 for ; Fri, 30 Sep 2016 08:53:34 +0000 (UTC) (envelope-from hps@selasky.org) Received: from mail.turbocat.net (mail.turbocat.net [IPv6:2a01:4f8:d16:4514::2]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 23D7113AD; Fri, 30 Sep 2016 08:53:34 +0000 (UTC) (envelope-from hps@selasky.org) Received: from laptop015.home.selasky.org (unknown [62.141.129.119]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.turbocat.net (Postfix) with ESMTPSA id 2B0001FE022; Fri, 30 Sep 2016 10:53:29 +0200 (CEST) Subject: Re: Status of PCIe Hotplug? To: Alexander Motin , Jan Henrik Sylvester References: <3c6ab189-aad0-2593-1d3c-f221de294174@janh.de> <1635480.htdnZkDgDb@ralph.baldwin.cx> <6742d46b-304c-79c9-7233-61cd86ef6542@selasky.org> <623f33ff-faaf-02e0-0c6e-725b9e0319e1@selasky.org> Cc: John Baldwin , FreeBSD-USB Mailing List , Warner Losh From: Hans Petter Selasky Message-ID: <35e7392f-fe89-a97b-d3e2-d0554a46e897@selasky.org> Date: Fri, 30 Sep 2016 10:58:22 +0200 User-Agent: Mozilla/5.0 (X11; FreeBSD amd64; rv:45.0) Gecko/20100101 Thunderbird/45.3.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit X-BeenThere: freebsd-usb@freebsd.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: FreeBSD support for USB List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 30 Sep 2016 08:53:34 -0000 On 09/29/16 20:20, Alexander Motin wrote: > On 29.09.2016 02:40, Hans Petter Selasky wrote: >> On 09/29/16 11:24, Jan Henrik Sylvester wrote: >>> On 09/29/2016 10:17, Hans Petter Selasky wrote: >>>> Hi, >>>> >>>> I created this differential review: >>>> >>>> https://reviews.freebsd.org/D8070 >>>> >>>> Jan Henrik: Can you download this patch and try it instead of the one I >>>> sent? >>>> >>>> --HPS >>> >>> Pulling the naked USB 3.0 ExpressCard without detaching it does not lead >>> to a panic anymore. >>> >>> Anyhow, the scenario that happened frequently on 10.3 for me without a >>> panic was pulling the USB 3.0 ExpressCard together with an usb stick. >>> That still leads to a panic on 11.0 + D8070: >>> >>> fault code = supervisor read data, page not present >>> instruction pointer = 0x20:0xffffffff80ab48ca >>> stack pointer = 0x28:0xfffffe022476ba20 >>> frame pointer = 0x28:0xfffffe022476baa0 >>> code segment = base 0x0, limit 0xfffff, type 0x1b >>> = DPL 0, pres 1, long 1, def32 0, gran 1 >>> processor eflags = interrupt enabled, resume, IOPL = 0 >>> current process = 4 (doneq0) >>> trap number = 12 >>> panic: page fault >>> cpuid = 1 >>> KDB: stack backtrace: >>> #0 0xffffffff80b24107 at kdb_backtrace+0x67 >>> #1 0xffffffff80ad93e2 at vpanic+0x182 >>> #2 0xffffffff80ad9253 at panic+0x43 >>> #3 0xffffffff80fa0d31 at trap_fatal+0x351 >>> #4 0xffffffff80fa0f23 at trap_pfault+0x1e3 >>> #5 0xffffffff80fa04cc at trap+0x26c >>> #6 0xffffffff80f841d1 at calltrap+0x8 >>> #7 0xffffffff8030a879 at xpt_release_simq+0x79 >>> #8 0xffffffff8030a649 at xpt_async_process+0x409 >>> #9 0xffffffff8030b187 at xpt_done_process+0x807 >>> #10 0xffffffff8030d916 at xpt_done_td+0x146 >>> #11 0xffffffff80a90055 at fork_exit+0x85 >>> #12 0xffffffff80f8467e at fork_trampoline+0xe >>> >> >> Hi, >> >> This panic seems to be an issue within the CAM subsystem. Apparently the >> CAM sim detach is not waiting for the release to complete, so functions >> inside umass.ko are referred after umass.ko is unloaded. >> >> imp+mav: Any comments? > > cam_sim_free() that should be called as part of SIM destruction process > waits for all of SIM references to be dropped, that also recursively > implies all other references. It worked file last time I tested it, but > it was quite a long time ago. I can not say what went wrong here, but I > guess that either USB somehow did not wait for cam_sim_free(), or > something somewhere did not do reference counting properly, allowing > destruction of some still referenced item. > Hi, I've updated: https://reviews.freebsd.org/D8070 Can you tra again Jan? Also, can you get some more dmesg, from the panicing case? --HPS