XPT LOR/panic with USB stick and Giantless CAM

From: Rene Ladan <r.c.ladan_at_gmail.com>
Date: Sun, 15 Apr 2007 21:13:22 +0200
Hi,

when I plug and unplug an USB stick using FreeBSD 7.0 2007-04-15 18:37
UTC , I get a LOR followed by a panic (attached).  USB sticks worked
fine on my previous CURRENT (2007-04-11 20:56 UTC)

Regards,
Rene
-- 
GPG fingerprint = E738 5471 D185 7013 0EE0  4FC8 3C1D 6F83 12E1 84F6
(subkeys.pgp.net)

"It won't fit on the line."
		-- me, 2001


[GDB will not be able to debug user-mode threads: /usr/lib/libthread_db.so: Undefined symbol "ps_pglobal_lookup"]
GNU gdb 6.1.1 [FreeBSD]
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i386-marcel-freebsd".

Unread portion of the kernel message buffer:
[...]
umass0: <Generic Flash Disk, class 0/0, rev 1.10/1.00, addr 2> on uhub0
da0 at umass-sim0 bus 0 target 0 lun 0
da0: <Generic USB Flash  Disk %z!Y> Removable Direct Access SCSI-2 device 
da0: 1.000MB/s transfers
da0: 250MB (512000 512 byte sectors: 64H 32S/T 250C)
<118># 
<118>crw-r-----  1 root  operator    0,  98 Apr 15 20:47 /dev/da0
<118># 
umass0: at uhub0 port 1 (addr 2) disconnected
(da0:umass-sim0:0:0:0): lost device
(da0:umass-sim0:0:0:0): removing device entry
uma_zalloc_arg: zone "128" with the following non-sleepable locks held:
exclusive sleep mutex XPT topology lock r = 0 (0xc06f478c) locked _at_ /usr/src/sys/cam/cam_xpt.c:7230
KDB: stack backtrace:
db_trace_self_wrapper(c069cc83,e39e87e0,c053091b,c075abbc,e39e87f4,...) at db_trace_self_wrapper+0x27
kdb_backtrace(c075abbc,e39e87f4,1,0,c106d000,...) at kdb_backtrace+0x2f
witness_warn(5,0,c06b0946,c0697e7a,c052f8bb,...) at witness_warn+0x1af
uma_zalloc_arg(c106d000,0,102,c1074880,0,...) at uma_zalloc_arg+0x35
malloc(64,c06cc500,102,c51bb680,2,...) at malloc+0xd0
g_post_event_x(c04b71a4,c51bb680,2,0,0,...) at g_post_event_x+0x7f
g_post_event(c04b71a4,c51bb680,2,0) at g_post_event+0x4b
disk_destroy(c51bb680,c06876f1,c4cde98c,c51bb580,e39e8b30,...) at disk_destroy+0x4b
dacleanup(c51bb580,c06b44bd,c0698f3e,fc,c070b760,...) at dacleanup+0x59
camperiphfree(c51bb580,0,e39e8b50,c04345fb,c51bb580,...) at camperiphfree+0x5e
cam_periph_invalidate(c51bb580,e39e8b68,e39e8b88,c04456fc,c51bb580,...) at cam_periph_invalidate+0x3d
cam_periph_async(c51bb580,100,e39e8c00,0,c050da3e,c5011bb4,1c,c63bba00,c5011a00,c5f62a00) at cam_periph_async+0x2d
daasync(c51bb580,100,e39e8c00,0,c6d1de00,...) at daasync+0x111
xpt_async_bcast(c6d1de74,100,e39e8c00,0,0,...) at xpt_async_bcast+0x38
xpt_async(100,e39e8c00,0,ffffffff,ffffffff,...) at xpt_async+0xf6
xpt_bus_deregister(2,c671ca00,c5ec9e00,e39e8c4c,c08b7c95,...) at xpt_bus_deregister+0x5a
umass_cam_detach_sim(c671caf4,1,c5ec9e00,c5ec9e00,0,...) at umass_cam_detach_sim+0x25
umass_detach(c5ec9e00,c4d5c850,c06cd6ac,970,c63bd1c0,...) at umass_detach+0xc3
device_detach(c5ec9e00,2,c4e18200,c4e18200,3,...) at device_detach+0x8f
usb_disconnect_port(c4e22630,c4e22680,10,271,e5,...) at usb_disconnect_port+0xae
uhub_explore(c4e22880,c4e1bb40,e39e8cfc,c04a886b,c4e1bb40,...) at uhub_explore+0x181
usb_discover(c4e1bb40,0,5c,c0691f7e,ea60,...) at usb_discover+0x34
usb_event_thread(c4e1bb40,e39e8d38,c0696c42,326,c4d53d80,...) at usb_event_thread+0x8f
fork_exit(c04a87dc,c4e1bb40,e39e8d38) at fork_exit+0xcc
fork_trampoline() at fork_trampoline+0x8
--- trap 0, eip = 0, esp = 0xe39e8d70, ebp = 0 ---
lock order reversal: (Giant after non-sleepable)
 1st 0xc06f478c XPT topology lock (XPT topology lock) _at_ /usr/src/sys/cam/cam_xpt.c:7230
 2nd 0xc070d8c8 Giant (Giant) _at_ /usr/src/sys/cam/cam_periph.c:561
KDB: stack backtrace:
db_trace_self_wrapper(c069cc83,e39e8858,c05300ed,c069ed3a,c070d8c8,...) at db_trace_self_wrapper+0x27
kdb_backtrace(c069ed3a,c070d8c8,c06992ea,c06992ea,c0682fe9,...) at kdb_backtrace+0x2f
witness_checkorder(c070d8c8,9,c0682fe9,231,c4e9bacc,...) at witness_checkorder+0x6e4
_mtx_lock_flags(c070d8c8,0,c0682fe9,231,e39e88b0,...) at _mtx_lock_flags+0xb9
cam_periph_lock(c51bb580,1,c4cde98c,c51bb580,e39e8b30,...) at cam_periph_lock+0x2f
dacleanup(c51bb580,c06b44bd,c0698f3e,fc,c070b760,...) at dacleanup+0x7f
camperiphfree(c51bb580,0,e39e8b50,c04345fb,c51bb580,...) at camperiphfree+0x5e
cam_periph_invalidate(c51bb580,e39e8b68,e39e8b88,c04456fc,c51bb580,...) at cam_periph_invalidate+0x3d
cam_periph_async(c51bb580,100,e39e8c00,0,c050da3e,c5011bb4,1c,c63bba00,c5011a00,c5f62a00) at cam_periph_async+0x2d
daasync(c51bb580,100,e39e8c00,0,c6d1de00,...) at daasync+0x111
xpt_async_bcast(c6d1de74,100,e39e8c00,0,0,...) at xpt_async_bcast+0x38
xpt_async(100,e39e8c00,0,ffffffff,ffffffff,...) at xpt_async+0xf6
xpt_bus_deregister(2,c671ca00,c5ec9e00,e39e8c4c,c08b7c95,...) at xpt_bus_deregister+0x5a
umass_cam_detach_sim(c671caf4,1,c5ec9e00,c5ec9e00,0,...) at umass_cam_detach_sim+0x25
umass_detach(c5ec9e00,c4d5c850,c06cd6ac,970,c63bd1c0,...) at umass_detach+0xc3
device_detach(c5ec9e00,2,c4e18200,c4e18200,3,...) at device_detach+0x8f
usb_disconnect_port(c4e22630,c4e22680,10,271,e5,...) at usb_disconnect_port+0xae
uhub_explore(c4e22880,c4e1bb40,e39e8cfc,c04a886b,c4e1bb40,...) at uhub_explore+0x181
usb_discover(c4e1bb40,0,5c,c0691f7e,ea60,...) at usb_discover+0x34
usb_event_thread(c4e1bb40,e39e8d38,c0696c42,326,c4d53d80,...) at usb_event_thread+0x8f
fork_exit(c04a87dc,c4e1bb40,e39e8d38) at fork_exit+0xcc
fork_trampoline() at fork_trampoline+0x8
--- trap 0, eip = 0, esp = 0xe39e8d70, ebp = 0 ---


Fatal trap 12: page fault while in kernel mode
cpuid = 0; apic id = 00
fault virtual address	= 0x10
fault code		= supervisor read, page not present
instruction pointer	= 0x20:0xc04f1b03
stack pointer	        = 0x28:0xe39fdc5c
frame pointer	        = 0x28:0xe39fdc78
code segment		= base 0x0, limit 0xfffff, type 0x1b
			= DPL 0, pres 1, def32 1, gran 1
processor eflags	= interrupt enabled, resume, IOPL = 0
current process		= 5 (thread taskq)
Physical memory: 2039 MB
Dumping 93 MB: 78 62 46 30 14

#0  doadump () at pcpu.h:172
172	pcpu.h: No such file or directory.
	in pcpu.h
(kgdb) bt f
#0  doadump () at pcpu.h:172
No locals.
#1  0xc04484f1 in db_fncall (dummy1=0, dummy2=0, dummy3=1999, 
    dummy4=0xe39fda0c "") at /usr/src/sys/ddb/db_command.c:486
	fn_addr = -1068512160
	args = {-1066642080, -476063272, -1066443712, -476063256, 
  -1069252782, -1066443712, -1066642080, -476063224, -476063272, 0}
	nargs = 0
	retval = -992956160
	t = 0
#2  0xc04482c0 in db_command (last_cmdp=0xc06f53c4, cmd_table=0x0)
    at /usr/src/sys/ddb/db_command.c:401
	cmd = (struct command *) 0xc06c5560
	t = 0
	modif = "\000\000\000\000\000\026ÑÄíu\227À_at_\201vÀ`·pÀ\r\000\000\000\001\000\000\000HÚ\237ãtHIÀ\000±ÐÄ\aK\004 ä·pÀÀ¬uÀÀ\\oÀx\000\000\000À\\oÀF\002\000\000lÚ\237ã·¦DÀ\230£iÀÌ£DÀ\000\000\000\000\020\000\000\000F\002\000\000À\\oÀ\234\232DÀÀ\\oÀxToÀx\000\000\000ÈÚ\237ã"
	addr = 0
	count = 1999
	have_addr = 0
	result = 0
#3  0xc0448387 in db_command_loop () at /usr/src/sys/ddb/db_command.c:453
No locals.
#4  0xc044a2f5 in db_trap (type=12, code=0) at /usr/src/sys/ddb/db_main.c:222
	jb = {{_jb = {-476063032, -476063060, -476062980, 1, 582, 
      -1069243756, 1, 582, -476062980, -1068326414, -476062980, -1068359553}}}
	prev_jb = (void *) 0x0
	bkpt = 0
---Type <return> to continue, or q <return> to quit--- 
#5  0xc0522127 in kdb_trap (type=0, code=0, tf=0xe39fdc1c)
    at /usr/src/sys/kern/subr_kdb.c:502
	intr = 582
	did_stop_cpus = 1
	handled = -476062692
#6  0xc065e05e in trap_fatal (frame=0xe39fdc1c, eva=16)
    at /usr/src/sys/i386/i386/trap.c:867
	code = 0
	type = 12
	ss = 40
	esp = 0
	softseg = {ssd_base = 0, ssd_limit = 1048575, ssd_type = 27, 
  ssd_dpl = 0, ssd_p = 1, ssd_xx = 15, ssd_xx1 = 0, ssd_def32 = 1, 
  ssd_gran = 1}
	msg = 0x0
#7  0xc065dd4c in trap_pfault (frame=0xe39fdc1c, usermode=0, eva=16)
    at /usr/src/sys/i386/i386/trap.c:785
	va = 0
	vm = (struct vmspace *) 0x0
	map = 0xc070c420
	rv = 1
	ftype = 1 '\001'
	td = (struct thread *) 0xc4d14d80
	p = (struct proc *) 0xc4d15d80
#8  0xc065d915 in trap (frame=0xe39fdc1c) at /usr/src/sys/i386/i386/trap.c:462
	td = (struct thread *) 0xc4d14d80
	p = (struct proc *) 0xc4d15d80
	i = 0
	ucode = 0
---Type <return> to continue, or q <return> to quit---
	type = 12
	code = 0
	addr = -476062788
	eva = 16
	ksi = {ksi_link = {tqe_next = 0xfc, tqe_prev = 0xc075abac}, 
  ksi_info = {si_signo = -1066727757, si_errno = -476062760, 
    si_code = -1068304197, si_pid = -1066727757, si_uid = 3228166884, 
    si_status = 3, si_addr = 0xc4d14d80, si_value = {sival_int = -476062712, 
      sival_ptr = 0xe39fdc08}, _reason = {_fault = {_trapno = 582}, _timer = {
        _timerid = 582, _overrun = -1066727757}, _mesgq = {_mqd = 582}, 
      _poll = {_band = 582}, __spare__ = {__spare1__ = 582, __spare2__ = {
          -1066727757, -476062716, -1068301910, -1066030168, -1056487672, 
          582, -1066581500}}}}, ksi_flags = -1056487672, ksi_sigq = 0x8d6}
#9  0xc0645e7b in calltrap () at /usr/src/sys/i386/i386/exception.s:139
No locals.
#10 0xc04f1b03 in _mtx_unlock_flags (m=0x0, opts=0, 
    file=0xc0683711 "/usr/src/sys/cam/cam_xpt.c", line=3010)
    at /usr/src/sys/kern/kern_mutex.c:204
No locals.
#11 0xc0437fee in xpt_action_sasync_cb (context=0xc6bff5e0, pending=1)
    at /usr/src/sys/cam/cam_xpt.c:3010
	start_ccb = (union ccb *) 0xc50a8000
	task = (struct xpt_task *) 0xc6bff5e0
	csa = (struct ccb_setasync *) 0xc50a8000
	cur_entry = (struct async_node *) 0xc639a180
	async_head = (struct async_list *) 0xc6d1de74
	added = 0
#12 0xc052ac57 in taskqueue_run (queue=0xc4dbab80)
    at /usr/src/sys/kern/subr_taskqueue.c:255
---Type <return> to continue, or q <return> to quit---
	task = (struct task *) 0xc6bff5e0
	owned = 1
	pending = 1
#13 0xc052b11d in taskqueue_thread_loop (arg=0xc4d14d80)
    at /usr/src/sys/kern/subr_taskqueue.c:374
	tq = (struct taskqueue *) 0xc4dbab80
#14 0xc04e1daf in fork_exit (callout=0xc052b0b2 <taskqueue_thread_loop>, 
    arg=0xc4d14d80, frame=0xc4d14d80) at /usr/src/sys/kern/kern_fork.c:814
	p = (struct proc *) 0xc4d15d80
	td = (struct thread *) 0xc4d14d80
#15 0xc0645ef0 in fork_trampoline () at /usr/src/sys/i386/i386/exception.s:205
No locals.
Received on Sun Apr 15 2007 - 17:40:38 UTC

This archive was generated by hypermail 2.4.0 : Wed May 19 2021 - 11:39:08 UTC