kern/50837: kernel panic, fatal page fault in supervisor mode, USB mouse triggered

[dmcmahill%NetBSD.org@localhost]

>Number:         50837
>Category:       kern
>Synopsis:       kernel panic, fatal page fault in supervisor mode, USB mouse triggered
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Mon Feb 22 14:50:00 +0000 2016
>Originator:     Dan McMahill
>Release:        7.0
>Organization:
>Environment:
NetBSD aaa.bbb.ccc.ddd 7.0 NetBSD 7.0 (GENERIC.201509250726Z) amd64


>Description:
I installed the released version of NetBSD-7.0 a month or two back on an HP proliant machine.   The machine isn't really doing anything as I've been swamped with other projects and haven't really done anything aside from install the OS.  Still, it has paniced several times (not good considering this is destined to replace a couple of ancient machines).  I've noticed that the USB keyboard/mouse seem to detach and reattach a lot and this seems to trigger the panic.  I am *not* running X.  Just the generic AMD64 kernel and console.  Actually, I have seen this panic both with a Xen DOMU kernel (the stock one from the 7.0 release) and a normal (non-Xen) kernel.

So far the panics (maybe every few weeks) have happened when I wasn't in front of the console.  Today, I was starting to poke around and see what info I could get for a PR.  I happened to wiggle the mouse and it produced:

wskbd0: detached
ukbd0: detached
uhidev0: detached
uhidev0: at uhub6 port 1 (addr 3) disconnected
wsmouse0: detached
ums0: detached
uhid0: detached
uhid1: detached
uhidev1: detached
uhidev1: at uhub6 port 1 (addr 3) disconnected
uvm_fault(0xffffffff8104c240, 0x0, 2) -> e
fatal page fault in supervisor mode
trap type 6 code 2 rip ffffffff809217e0 cs 8 rflags 10286 cr2 0 ilevel 8 rsp fffffe810ac64ec8
curlwp 0xfffffe810ac22960 pid 0.29 lowest kstack 0xfffffe810ac622c0
panic: trap
cpu0: Begin traceback...
vpanic() at netbsd:vpanic+0x13c
snprintf() at netbsd:snprintf
startlwp() at netbsd:startlwp
alltraps() at netbsd:alltraps+0x96
cpu0: End traceback...

dumping to dev 0,1 (offset=2640, size=1539886):


When I ran "dmesg -M netbsd.0.core -N netbsd.0" on a previous /var/crash/ crashdump, I saw something identical to the above.

If it matters, the keyboard is an older (but expensive) Kinesis keyboard connected via a PS2 to USB converter.  The mouse is an unknown USB mouse.  After the PS2 to USB converter it goes to a powered USB hub and then to a USB A/B switch (http://plugable.com/products/usb2-switch2) because I use the keyboard and mouse with another computer.  The other computer involved was happy with this arrangement for a year or so.  Then I replaced that one and had some issues with the mouse resetting a lot.  Adding the powered hub eliminate all issues on the other computer (a windows 7 computer).  

The PS2 to USB converter shows up as:

uhidev0: CHESEN PS2 to USB Converter, rev 1.10/0.10, addr 3, iclass 3/1 


Wiggling the mouse does not reliably panic the machine although it triggers the usb detach and attach messages nearly every time (even if I keep the A/B switch in the position which connects to the NetBSD computer in question).  


When the mouse is wiggled (after sitting a bit or switching A/B and back):

wskbd0: detached
ukbd0: detached
uhidev0: detached
uhidev0: at uhub6 port 1 (addr 3) disconnected
wsmouse0: detached
ums0: detached
uhid0: detached
uhid1: detached
uhidev1: detached
uhidev1: at uhub6 port 1 (addr 3) disconnected
uhidev0 at uhub6 port 1 configuration 1 interface 0
uhidev0: CHESEN PS2 to USB Converter, rev 1.10/0.10, addr 3, iclass 3/1
ukbd0 at uhidev0
wskbd0 at ukbd0 mux 1
wskbd0: connecting to wsdisplay0
uhidev1 at uhub6 port 1 configuration 1 interface 1
uhidev1: CHESEN PS2 to USB Converter, rev 1.10/0.10, addr 3, iclass 3/1
uhidev1: 3 report ids
ums0 at uhidev1 reportid 1: 5 buttons and Z dir
wsmouse0 at ums0 mux 0
uhid0 at uhidev1 reportid 2: input=1, output=0, feature=0
uhid1 at uhidev1 reportid 3: input=3, output=0, feature=0

That is for a successful switch.  I get this message fairly regularly even if I don't switch the A/B switch.


>How-To-Repeat:
wiggle the mouse several times.  After about 2-5 times of getting the detached and attach messages, I get a panic.  

>Fix: