Skip site navigation (1)Skip section navigation (2)
Date:      Sun, 24 Sep 2006 07:12:30 +1000
From:      Peter Jeremy <peterjeremy@optushome.com.au>
To:        freebsd-stable@freebsd.org
Cc:        Callum Gibson <callumgibson@optusnet.com.au>
Subject:   Re: panic unloading bluetooth module
Message-ID:  <20060923211230.GB6066@turion.vk2pj.dyndns.org>
In-Reply-To: <20060923115645.GA96872@omma.gibson.athome>
References:  <20060923115645.GA96872@omma.gibson.athome>

next in thread | previous in thread | raw e-mail | index | archive | help

--IiVenqGWf+H9Y6IX
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Sat, 2006-Sep-23 21:56:45 +1000, Callum Gibson wrote:
>I just experienced a panic after playing around with bluetooth. After a
>fresh boot I decided to try and unload the ng_ubt module and noted all
>the dependencies. So I tried to unload all of them in turn a few times.
>Some seemed to unload but kldstat showed many of them still and it seemed
>like I wasn't going to be able to unload them all. Then I pressed
>the wlan/bluetooth toggle button and had the panic.

I'm running the same laptop (HP nx6125) with RELENG_6/amd64 from 21st
September and can mostly reproduce the problem - my laptop hasn't
panic'd yet but I suspect that's only because I haven't generated an
irq19.

When I kldload ng_ubt, it pulls in=20
 7    1 0xffffffffa3f63000 5025     ng_ubt.ko
 8    5 0xffffffffa3f69000 89b2     netgraph.ko
 9    4 0xffffffffa3f72000 86d      ng_bluetooth.ko
10    1 0xffffffffa3f73000 9535     ng_hci.ko
11    1 0xffffffffa3f7d000 bee6     ng_l2cap.ko
12    1 0xffffffffa3f89000 13461    ng_btsocket.ko
13    1 0xffffffffa3f9d000 1d0d     ng_socket.ko
Bluetooth (ubt0) then attaches/detaches as expected.

With bluetooth off, I can only unload ng_ubt.ko, ng_hci.ko and ng_l2cap.ko.
The remaining modules report:
  kldunload: can't unload file: Device busy
and I also get two "attempt to unload file that was loaded by the kernel"
but I'm not sure which modules they are associated with.

Toggling bluetooth then attaches/detaches ugen1 - as expected.

I then tried:
a) Turn off bluetooth
b) kldload ng_ubt
   ng_ubt.ko, ng_hci.ko and ng_l2cap.ko are laoded.
c) Turn bluetooth on
   ubt0 attachs
d) kldunload all the netgraph modules
   ng_hci.ko and ng_l2cap.ko unload
   ng_ubt.ko reports:
     kldunload: can't unload file: No such file or directory
   The remaining modules report "device busy"
e) Turn off bluetooth
   I get the same disconnect message as Callum:
     (null): at uhub0 port 2 (addr 2) disconnected

At this point "kldload ng_ubt.ko" consistently reports "File exists" whilst
"kldunload ng_ubt.ko" consistently reports "No such file or directory".

Callum's panic is a dereference to a null structure pointer in the
irq19 handler.  It looks to me like attempting to kldunload ng_ubt.ko
has freed the ubt0 structures and the next irq 19 (USB) causes things
to go pear-shaped.

Can anyone suggest how/why ng_ubt.ko would get into a "you can see me
but I'm not here" state?

The other anomoly I see (which is possibly related) is that if ng_ubt
is not loaded, I get a single "ugen1 attached" message.  If ng_ubt is
loaded, I get two identical messages:
 ubt0: Broadcom HP integrated Bluetooth module, rev 1.10/0.17, addr 2
though the rest of the probe/attach looks sane.

--=20
Peter Jeremy

--IiVenqGWf+H9Y6IX
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (FreeBSD)

iD8DBQFFFaM+/opHv/APuIcRArM1AKCLUnU3IaXsLWjUhAxQagVCdgqpgACffKmL
1D24Hgz3O8/XnXqJeMH1VgA=
=RrFz
-----END PGP SIGNATURE-----

--IiVenqGWf+H9Y6IX--



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20060923211230.GB6066>