>Number: 6553
>Category: i386
>Synopsis: crash in ohci_timeout when plugging/unplugging USB device
>Confidential: yes
>Severity: serious
>Priority: medium
>Responsible: bugs
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: sw-bug
>Submitter-Id: unknown
>Arrival-Date: Sun Jan 30 15:10:01 GMT 2011
>Closed-Date:
>Last-Modified:
>Originator:
>Release:
>Organization:
>Environment:
System : OpenBSD 4.8
Details : OpenBSD 4.8-stable (NET4801) #2: Thu Nov 18 11:13:30 CET
2010
root@lab:/usr/src/sys/arch/i386/compile/NET4801
Architecture: OpenBSD.i386
Machine : i386
>Description:
When USB to 1-wire controller DS9490R (handled by uow(4) driver) was
attached to Soekris 4801 box for the first time the box panicked.
There is no USB hub, the device is plugged directly to the USB port.
There is no other USB device connected to the system.
I tried to reproduce this by plugging and uplugging and after couple
of tries the machine panicked with the following (console output):
owtemp0 at onewire0 "Temperature" sn 000002cfc0e2
owtemp1 at onewire0 "Temperature" sn 000002cfbbe9
owid0 at onewire0 "ID" sn 0000002e86f8
ohci_freex: xfer=0xd0dba200 not busy, 0x46524545
owid0 detached
uow0: cmd failed, type 0x01, cmd 0x0043, param 0x0000: IOERROR
uow0: cmd failed, type 0x00, cmd 0x0000, param 0x0000: IOERROR
owtemp1 detached
owtemp0 detached
onewire0 detached
uow0 detached
uow0 at uhub0 port 1 "vendor 0x04fa product 0x2490" rev 1.00/0.02 addr 2
onewire0 at uow0
owtemp0 at onewire0 "Temperature" sn 000002cfc0e2
owtemp1 at onewire0 "Temperature" sn 000002cfbbe9
owid0 at onewire0 "ID" sn 0000002e86f8
ohci_freex: xfer=0xd0dbaf00 not busy, 0x46524545
uow0: cmd failed, type 0x01, cmd 0x0043, param 0x0000: IOERROR
uow0: cmd failed, type 0x00, cmd 0x0000, param 0x0000: IOERROR
uow0: cmd failed, type 0x01, cmd 0x0043, param 0x0000: IOERROR
uow0: cmd failed, type 0x00, cmd 0x0000, param 0x0000: IOERROR
uow0: cmd failed, type 0x01, cmd 0x0043, param 0x0000: IOERROR
uow0: cmd failed, type 0x00, cmd 0x0000, param 0x0000: IOERROR
uow0: cmd failed, type 0x01, cmd 0x0053, param 0x00f0: IOERROR
uow0: cmd failed, type 0x00, cmd 0x0000, param 0x0000: IOERROR
uow0: cmd failed, type 0x01, cmd 0x0029, param 0x0000: IOERROR
uow0: cmd failed, type 0x00, cmd 0x0000, param 0x0000: IOERROR
uow0: cmd failed, type 0x01, cmd 0x0029, param 0x0000: IOERROR
uow0: cmd failed, type 0x00, cmd 0x0000, param 0x0000: IOERROR
uow0: cmd failed, type 0x01, cmd 0x0029, param 0x0000: IOERROR
uow0: cmd failed, type 0x00, cmd 0x0000, param 0x0000: IOERROR
owid0 detached
owtemp1 detached
owtemp0 detached
onewire0 detached
uow0 detached
uow0 at uhub0 port 1 "vendor 0x04fa product 0x2490" rev 1.00/0.02 addr 2
onewire0 at uow0
ohci_freex: xfer=0xd0dbaa80 not busy, 0x4f4e5155
uvm_fault(0xd081a4c0, 0xefff0000, 0, 1) -> e
kernel: page fault trap, code=0
Stopped at ohci_timeout+0xe: movl 0(%eax),%eax
ddb> trace
ohci_timeout(d0dbaa80,d41d2f00,d0285356,d41d2ef4,d0bfebc0) at ohci_timeout+0xe
softclock(0,d41d2f10,d03def0e,0,d0201f7a) at softclock+0x225
softintr_dispatch(0) at softintr_dispatch+0x4f
Xsoftclock() at Xsoftclock+0x12
--- interrupt ---
cpu_idle_cycle(d085fd40) at cpu_idle_cycle+0xf
Bad frame pointer: 0xd08a0e48
ddb> ps
PID PPID PGRP UID S FLAGS WAIT COMMAND
3221 0 0 0 3 0x100200 usbsyn onewire0
23500 1 23500 0 3 0x4080 ttyin getty
9902 1 9902 0 3 0x80 select cron
2593 1 2593 0 3 0x80 nanosleep watchdogd
16709 1 16709 0 3 0x80080 nanosleep sensorsd
7802 1 7802 32767 3 0x180 kqread thttpd
7760 1 7760 71 3 0x180 kqread ftp-proxy
22335 1 22335 77 3 0x180 poll dhcpd
3090 1 3090 0 3 0x80 select sshd
8132 1 8132 0 3 0x80 poll ntpd
19020 5942 19020 83 3 0x180 poll ntpd
5942 1 5942 83 3 0x180 poll ntpd
26829 13618 13618 70 3 0x180 select named
13618 1 13618 0 3 0x180 netio named
8385 19140 19140 74 3 0x180 bpf pflogd
19140 1 19140 0 3 0x80 netio pflogd
25043 2949 2949 73 2 0x180 syslogd
2949 1 2949 0 3 0x88 netio syslogd
15949 1 15949 77 3 0x180 poll dhclient
2716 1 6737 0 3 0x80 poll dhclient
29749 1 29749 0 3 0x80 mfsidl mount_mfs
9097 1 9097 0 3 0x80 mfsidl mount_mfs
14 0 0 0 3 0x100200 bored crypto
13 0 0 0 3 0x100200 aiodoned aiodoned
12 0 0 0 3 0x100200 syncer update
11 0 0 0 3 0x100200 cleaner cleaner
10 0 0 0 3 0x100200 reaper reaper
9 0 0 0 3 0x100200 pgdaemon pagedaemon
7 0 0 0 3 0x100200 pftm pfpurge
6 0 0 0 3 0x100200 usbtsk usbtask
5 0 0 0 3 0x100200 owdt usb0
4 0 0 0 3 0x100200 bored syswq
* 3 0 0 0 7 0x40100200 idle0
2 0 0 0 3 0x100200 kmalloc kmthread
1 0 1 0 3 0x4080 wait init
0 -1 0 0 3 0x80200 scheduler swapper
ddb>
I believe the cause of the panic is the same as described in 2004 by
Ted Unangst here:
http://marc.info/?l=openbsd-tech&m=109247316506733&w=2
>How-To-Repeat:
Continuously plug and unplug USB device to Soekris box (in this case
DS9490R)
>Fix:
The idea which might be worth trying is highlighted in the email
referenced above.
dmesg:
OpenBSD 4.8-stable (NET4801) #2: Thu Nov 18 11:13:30 CET 2010
root@lab:/usr/src/sys/arch/i386/compile/NET4801
cpu0: Geode(TM) Integrated Processor by National Semi ("Geode by NSC"
586-class) 234 MHz
cpu0: FPU,TSC,MSR,CX8,CMOV,MMX
real mem = 133787648 (127MB)
avail mem = 124633088 (118MB)
mainbus0 at root
bios0 at mainbus0: AT/286+ BIOS, date 20/80/03, BIOS32 rev. 0 @ 0xf7840
pcibios0 at bios0: rev 2.0 @ 0xf0000/0x10000
pcibios0: pcibios_get_intr_routing - function not supported
pcibios0: PCI IRQ Routing information unavailable.
pcibios0: PCI bus #0 is the last bus
cpu0 at mainbus0: (uniprocessor)
cpu0: TSC disabled
pci0 at mainbus0 bus 0: configuration mode 1 (bios)
pchb0 at pci0 dev 0 function 0 "Cyrix GXm PCI" rev 0x00
sis0 at pci0 dev 6 function 0 "NS DP83815 10/100" rev 0x00, DP83816A:
irq 10, address 00:00:24:cd:32:60
nsphyter0 at sis0 phy 0: DP83815 10/100 PHY, rev. 1
sis1 at pci0 dev 7 function 0 "NS DP83815 10/100" rev 0x00, DP83816A:
irq 10, address 00:00:24:cd:32:61
nsphyter1 at sis1 phy 0: DP83815 10/100 PHY, rev. 1
sis2 at pci0 dev 8 function 0 "NS DP83815 10/100" rev 0x00, DP83816A:
irq 10, address 00:00:24:cd:32:62
nsphyter2 at sis2 phy 0: DP83815 10/100 PHY, rev. 1
hifn0 at pci0 dev 14 function 0 "Hifn 7951" rev 0x01: LZS 3DES ARC4
MD5 SHA1 RNG PK, 128KB sram, irq 11
gscpcib0 at pci0 dev 18 function 0 "NS SC1100 ISA" rev 0x00
gpio0 at gscpcib0: 64 pins
"NS SC1100 SMI" rev 0x00 at pci0 dev 18 function 1 not configured
pciide0 at pci0 dev 18 function 2 "NS SCx200 IDE" rev 0x01: DMA,
channel 0 wired to compatibility, channel 1 wired to compatibility
wd0 at pciide0 channel 0 drive 0: <SanDisk SDCFB-1024>
wd0: 4-sector PIO, LBA, 977MB, 2001888 sectors
wd1 at pciide0 channel 0 drive 1: <Flash Card>
wd1: 1-sector PIO, LBA, 62MB, 128256 sectors
wd0(pciide0:0:0): using PIO mode 4, DMA mode 2
wd1(pciide0:0:1): using PIO mode 4
geodesc0 at pci0 dev 18 function 5 "NS SC1100 X-Bus" rev 0x00: iid 6
revision 3 wdstatus 9<WDRST,WDOVF>
ohci0 at pci0 dev 19 function 0 "Compaq USB OpenHost" rev 0x08: irq 5,
version 1.0, legacy support
isa0 at gscpcib0
isadma0 at isa0
com0 at isa0 port 0x3f8/8 irq 4: ns16550a, 16 byte fifo
com0: console
com1 at isa0 port 0x2f8/8 irq 3: ns16550a, 16 byte fifo
nsclpcsio0 at isa0 port 0x2e/2: NSC PC87366 rev 9: GPIO VLM TMS
gpio1 at nsclpcsio0: 29 pins
gscsio0 at isa0 port 0x15c/2: SC1100 SIO rev 1:
npx0 at isa0 port 0xf0/16: reported by CPUID; using exception 16
usb0 at ohci0: USB revision 1.0
uhub0 at usb0 "Compaq OHCI root hub" rev 1.00/1.00 addr 1
biomask f3e7 netmask ffe7 ttymask ffff
rd0: fixed, 7480 blocks
uow0 at uhub0 port 1 "vendor 0x04fa product 0x2490" rev 1.00/0.02 addr 2
onewire0 at uow0
root on rd0a swap on rd0b dump on rd0b
owtemp0 at onewire0 "Temperature" sn 000002cfc0e2
owtemp1 at onewire0 "Temperature" sn 000002cfbbe9
owid0 at onewire0 "ID" sn 0000002e86f8
usbdevs:
Controller /dev/usb0:
addr 1: full speed, self powered, config 1, OHCI root hub(0x0000),
Compaq(0x0e11), rev 1.00
port 1 addr 2: full speed, power 100 mA, config 1, product
0x2490(0x2490), vendor 0x04fa(0x04fa), rev 0.02
port 2 powered
port 3 powered
>Release-Note:
>Audit-Trail:
>Unformatted:
