Panic on CardBus card eject (ubsa(4))

[Niki Denev]

Henrik Brix Andersen wrote:
> Hi,
>
> I got a new CardBus 3G modem today, a Huawei E620, which is supported
> by the ubsa(4) driver. However, ejecting the card produces the
> following panic:
>
> Script started on Mon Jul 30 17:48:49 2007
> lothlorien# kgdb kernel /var/crash/vmcore.3
> [GDB will not be able to debug user-mode threads: /usr/lib/libthread_db.so: Undefined symbol "ps_pglobal_lookup"]
> GNU gdb 6.1.1 [FreeBSD]
> Copyright 2004 Free Software Foundation, Inc.
> GDB is free software, covered by the GNU General Public License, and you are
> welcome to change it and/or distribute copies of it under certain conditions.
> Type "show copying" to see the conditions.
> There is absolutely no warranty for GDB.  Type "show warranty" for details.
> This GDB was configured as "i386-marcel-freebsd".
>
> Unread portion of the kernel message buffer:
> ucom0: detached
> (null): at uhub5 port 1 (addr 2) disconnected
>
>
> Fatal trap 12: page fault while in kernel mode
> cpuid = 0; apic id = 00
> fault virtual address	= 0x400
> fault code		= supervisor read, page not present
> instruction pointer	= 0x20:0xc0634c08
> stack pointer	        = 0x28:0xe3f4fb48
> frame pointer	        = 0x28:0xe3f4fb68
> code segment		= base 0x0, limit 0xfffff, type 0x1b
> 			= DPL 0, pres 1, def32 1, gran 1
> processor eflags	= interrupt enabled, resume, IOPL = 0
> current process		= 37 (cbb0 event thread)
> trap number		= 12
> panic: page fault
> cpuid = 1
> Uptime: 28m23s
> Physical memory: 1006 MB
> Dumping 83 MB: 68 52 36 20 4
>
> #0  doadump () at pcpu.h:195
> 195		__asm __volatile("movl %%fs:0,%0" : "=r" (td));
> (kgdb) bt
> #0  doadump () at pcpu.h:195
> #1  0xc060e59a in boot (howto=260) at /usr/src/sys/kern/kern_shutdown.c:409
> #2  0xc060e86d in panic (fmt=Variable "fmt" is not available.
> ) at /usr/src/sys/kern/kern_shutdown.c:563
> #3  0xc07e8f5e in trap_fatal (frame=0xe3f4fb08, eva=Variable "eva" is not available.
> ) at /usr/src/sys/i386/i386/trap.c:870
> #4  0xc07e91ae in trap_pfault (frame=0xe3f4fb08, usermode=0, eva=1024) at /usr/src/sys/i386/i386/trap.c:784
> #5  0xc07e9a98 in trap (frame=0xe3f4fb08) at /usr/src/sys/i386/i386/trap.c:462
> #6  0xc07d1d3b in calltrap () at /usr/src/sys/i386/i386/exception.s:139
> #7  0xc0634c08 in kobj_delete (obj=0xc4547e00, mtype=0xc0894320) at /usr/src/sys/kern/subr_kobj.c:332
> #8  0xc062f122 in device_delete_child (dev=0xc4559180, child=0xc4547e00) at /usr/src/sys/kern/subr_bus.c:1617
> #9  0xc059ea7c in usb_disconnect_port (up=0xc4559430, parent=0xc4559180) at /usr/src/sys/dev/usb/usb_subr.c:1382
> #10 0xc0594d84 in uhub_detach (self=0xc4559180) at /usr/src/sys/dev/usb/uhub.c:575
> #11 0xc062eedc in device_detach (dev=0xc4559180) at device_if.h:212
> #12 0xc062f0bf in device_delete_child (dev=0xc4194080, child=0xc4559180) at /usr/src/sys/kern/subr_bus.c:1611
> #13 0xc062f0aa in device_delete_child (dev=0xc454da80, child=0xc4194080) at /usr/src/sys/kern/subr_bus.c:1606
> #14 0xc058be62 in ohci_pci_detach (self=0xc454da80) at /usr/src/sys/dev/usb/ohci_pci.c:371
> #15 0xc062eedc in device_detach (dev=0xc454da80) at device_if.h:212
> #16 0xc04eb32b in cardbus_detach_card (cbdev=0xc3c4b600) at /usr/src/sys/dev/cardbus/cardbus.c:235
> #17 0xc0537f95 in cbb_event_thread (arg=0xc3b79000) at card_if.h:95
> #18 0xc05effd1 in fork_exit (callout=0xc0537df0 <cbb_event_thread>, arg=0xc3b79000, frame=0xe3f4fd38)
>     at /usr/src/sys/kern/kern_fork.c:797
> #19 0xc07d1db0 in fork_trampoline () at /usr/src/sys/i386/i386/exception.s:205
> (kgdb) up 7
> #7  0xc0634c08 in kobj_delete (obj=0xc4547e00, mtype=0xc0894320) at /usr/src/sys/kern/subr_kobj.c:332
> 332		kobj_class_t cls = obj->ops->cls;
> (kgdb) print obj->ops
> $1 = 0x0
> (kgdb) quit
> lothlorien# exit
> Script done on Mon Jul 30 17:49:36 2007
>
> Anybody seen this before?
>
> This is with -current from yesterday:
>
> $ uname -a
> FreeBSD lothlorien.brixandersen.dk 7.0-CURRENT FreeBSD 7.0-CURRENT #59: Sun Jul 29 13:32:00 CEST 2007     root at lothlorien.brixandersen.dk:/usr/obj/usr/src/sys/LOTHLORIEN  i386
>
> Regards,
> Brix
>   

I have the same problem with the same card : 
http://monkey.org/freebsd/archive/freebsd-current/200706/msg00423.html
Unfortunately there is no fix for this in the standard freebsd usb 
stack, but with HPS's new usb stack this problem does not exist.