From owner-freebsd-bugs@FreeBSD.ORG Fri Apr 1 05:10:14 2005 Return-Path: Delivered-To: freebsd-bugs@hub.freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 840F716A4D1 for ; Fri, 1 Apr 2005 05:10:14 +0000 (GMT) Received: from freefall.freebsd.org (freefall.freebsd.org [216.136.204.21]) by mx1.FreeBSD.org (Postfix) with ESMTP id 7F99743D48 for ; Fri, 1 Apr 2005 05:10:11 +0000 (GMT) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1]) by freefall.freebsd.org (8.13.3/8.13.3) with ESMTP id j315ABOI024031 for ; Fri, 1 Apr 2005 05:10:11 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.13.3/8.13.1/Submit) id j315ABd4024030; Fri, 1 Apr 2005 05:10:11 GMT (envelope-from gnats) Resent-Date: Fri, 1 Apr 2005 05:10:11 GMT Resent-Message-Id: <200504010510.j315ABd4024030@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-bugs@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, mike@sentex.net Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id A038116A4D4 for ; Fri, 1 Apr 2005 05:06:40 +0000 (GMT) Received: from avscan2.sentex.ca (avscan2.sentex.ca [199.212.134.19]) by mx1.FreeBSD.org (Postfix) with ESMTP id B5EE343D46 for ; Fri, 1 Apr 2005 05:06:39 +0000 (GMT) (envelope-from mdtancsa@customer.sentex.ca) Received: from localhost (localhost.sentex.ca [127.0.0.1]) by avscan2.sentex.ca (8.12.11/8.12.11) with ESMTP id j3156fdr075633 for ; Fri, 1 Apr 2005 00:06:41 -0500 (EST) (envelope-from mdtancsa@customer.sentex.ca) Received: from avscan2.sentex.ca ([127.0.0.1]) by localhost (avscan2.sentex.ca [127.0.0.1]) (amavisd-new, port 10024) with LMTP id 75562-01 for ; Fri, 1 Apr 2005 00:06:41 -0500 (EST) Received: from lava.sentex.ca (pyroxene.sentex.ca [199.212.134.18]) by avscan2.sentex.ca (8.12.11/8.12.11) with ESMTP id j3156ebE075619 for ; Fri, 1 Apr 2005 00:06:40 -0500 (EST) (envelope-from mdtancsa@customer.sentex.ca) Received: from releng5-865.sentex.ca ([192.168.43.34]) by lava.sentex.ca (8.12.11/8.12.11) with ESMTP id j3156Wk7029413 for ; Fri, 1 Apr 2005 00:06:32 -0500 (EST) (envelope-from mdtancsa@customer.sentex.ca) Received: from releng5-865.sentex.ca (localhost [127.0.0.1]) by releng5-865.sentex.ca (8.13.3/8.13.1) with ESMTP id j3156Whw002668 for ; Fri, 1 Apr 2005 00:06:32 -0500 (EST) (envelope-from mdtancsa@releng5-865.sentex.ca) Received: (from root@localhost) by releng5-865.sentex.ca (8.13.3/8.13.1/Submit) id j3156W8C002667; Fri, 1 Apr 2005 00:06:32 -0500 (EST) (envelope-from mdtancsa) Message-Id: <200504010506.j3156W8C002667@releng5-865.sentex.ca> Date: Fri, 1 Apr 2005 00:06:32 -0500 (EST) From: mike@sentex.net To: FreeBSD-gnats-submit@FreeBSD.org X-Send-Pr-Version: 3.113 Subject: kern/79420: panic using uplcom or uftdi serial adaptor and modem (USB) X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list Reply-To: mike@sentex.net List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 01 Apr 2005 05:10:14 -0000 >Number: 79420 >Category: kern >Synopsis: panic using uplcom or uftdi serial adaptor and modem (USB) >Confidential: no >Severity: serious >Priority: medium >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Fri Apr 01 05:10:11 GMT 2005 >Closed-Date: >Last-Modified: >Originator: Mike Tancsa >Release: FreeBSD 5.4-PRERELEASE i386 >Organization: Sentex Communications >Environment: System: FreeBSD releng5-865.sentex.ca 5.4-PRERELEASE FreeBSD 5.4-PRERELEASE #9: Thu Mar 31 17:28:54 EST 2005 mdtancsa@releng5-865.sentex.ca:/usr/obj/usr/src/sys/pioneer i386 >Description: If an application is blasting out data on a modem attached to a USB serial adaptor the box will eventually panic. On the box I was testing on, about 1 to 4 hrs [releng5-865]# kgdb kernel.debug /var/crash/vmcore.14 [GDB will not be able to debug user-mode threads: /usr/lib/libthread_db.so: Undefined symbol "ps_pglobal_lookup"] GNU gdb 6.1.1 [FreeBSD] Copyright 2004 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "i386-marcel-freebsd". #0 doadump () at pcpu.h:159 159 __asm __volatile("movl %%fs:0,%0" : "=r" (td)); (kgdb) bt #0 doadump () at pcpu.h:159 #1 0xc0520f5a in boot (howto=260) at /usr/src/sys/kern/kern_shutdown.c:410 #2 0xc05211f0 in panic (fmt=0xc06fdc75 "uhci_abort_xfer: not in process context") at /usr/src/sys/kern/kern_shutdown.c:566 #3 0xc04c7143 in uhci_abort_xfer (xfer=0xc1910300, status=USBD_NORMAL_COMPLETION) at /usr/src/sys/dev/usb/uhci.c:1958 #4 0xc04c70c5 in uhci_device_bulk_abort (xfer=0xc1910300) at /usr/src/sys/dev/usb/uhci.c:1921 #5 0xc04d43b7 in usbd_ar_pipe (pipe=0xc19bf500) at /usr/src/sys/dev/usb/usbdi.c:762 #6 0xc04d411b in usbd_abort_pipe (pipe=0xc19bf500) at /usr/src/sys/dev/usb/usbdi.c:556 #7 0xc04c3d4d in ucomstopread (sc=0x0) at /usr/src/sys/dev/usb/ucom.c:1160 #8 0xc04c3912 in ucomstop (tp=0xc166ee00, flag=1) at /usr/src/sys/dev/usb/ucom.c:934 #9 0xc054c88f in ttyflush (tp=0xc166ee00, rw=1) at /usr/src/sys/kern/tty.c:1420 #10 0xc054ac49 in ttyinput (c=26, tp=0xc166ee00) at /usr/src/sys/kern/tty.c:445 #11 0xc04c3c3d in ucomreadcb (xfer=0xc1910300, p=0xc1617e80, status=USBD_NORMAL_COMPLETION) at linedisc.h:122 #12 0xc04d44f8 in usb_transfer_complete (xfer=0xc1910300) at /usr/src/sys/dev/usb/usbdi.c:851 #13 0xc04c69ab in uhci_idone (ii=0x0) at /usr/src/sys/dev/usb/uhci.c:1500 #14 0xc04c6888 in uhci_check_intr (sc=0xc15e0000, ii=0xc191036c) at /usr/src/sys/dev/usb/uhci.c:1375 #15 0xc04c67da in uhci_softintr (v=0xc15e0000) at /usr/src/sys/dev/usb/uhci.c:1305 #16 0xc04d1995 in usb_schedsoftintr (bus=0x0) at /usr/src/sys/dev/usb/usb.c:864 #17 0xc04c67a7 in uhci_intr1 (sc=0xc15e0000) at /usr/src/sys/dev/usb/uhci.c:1275 #18 0xc04c6638 in uhci_intr (arg=0xc15e0000) at /usr/src/sys/dev/usb/uhci.c:1190 #19 0xc050d86d in ithread_loop (arg=0xc14f7400) at /usr/src/sys/kern/kern_intr.c:547 #20 0xc050cb00 in fork_exit (callout=0xc050d71c , arg=0xc14f7400, frame=0xcbc67d48) at /usr/src/sys/kern/kern_fork.c:790 #21 0xc06a3fec in fork_trampoline () at /usr/src/sys/i386/i386/exception.s:209 (kgdb) bt full #0 doadump () at pcpu.h:159 No locals. #1 0xc0520f5a in boot (howto=260) at /usr/src/sys/kern/kern_shutdown.c:410 first_buf_printf = 1 #2 0xc05211f0 in panic (fmt=0xc06fdc75 "uhci_abort_xfer: not in process context") at /usr/src/sys/kern/kern_shutdown.c:566 td = (struct thread *) 0xc14fa000 bootopt = 260 newpanic = 0 ap = 0xc14fa000 "Ä\001PÁðêOÁ" buf = "uhci_abort_xfer: not in process context", '\0' #3 0xc04c7143 in uhci_abort_xfer (xfer=0xc1910300, status=USBD_NORMAL_COMPLETION) at /usr/src/sys/dev/usb/uhci.c:1958 uxfer = (struct uhci_xfer *) 0xc1910300 ii = (uhci_intr_info_t *) 0xc191036c upipe = (struct uhci_pipe *) 0xc19bf500 sc = (uhci_softc_t *) 0xc15e0000 std = (uhci_soft_td_t *) 0x0 #4 0xc04c70c5 in uhci_device_bulk_abort (xfer=0xc1910300) at /usr/src/sys/dev/usb/uhci.c:1921 No locals. #5 0xc04d43b7 in usbd_ar_pipe (pipe=0xc19bf500) at /usr/src/sys/dev/usb/usbdi.c:762 xfer = 0x0 #6 0xc04d411b in usbd_abort_pipe (pipe=0xc19bf500) at /usr/src/sys/dev/usb/usbdi.c:556 err = USBD_NORMAL_COMPLETION #7 0xc04c3d4d in ucomstopread (sc=0x0) at /usr/src/sys/dev/usb/ucom.c:1160 No locals. #8 0xc04c3912 in ucomstop (tp=0xc166ee00, flag=1) at /usr/src/sys/dev/usb/ucom.c:934 sc = (struct ucom_softc *) 0xc1617e80 #9 0xc054c88f in ttyflush (tp=0xc166ee00, rw=1) at /usr/src/sys/kern/tty.c:1420 No locals. #10 0xc054ac49 in ttyinput (c=26, tp=0xc166ee00) at /usr/src/sys/kern/tty.c:445 iflag = 11010 lflag = 1483 cc = (cc_t *) 0xc166eeb4 "\004ÿÿ\177\027\025\022\b\003\034\032\031\021\023\026\017\001" i = 0 err = 0 #11 0xc04c3c3d in ucomreadcb (xfer=0xc1910300, p=0xc1617e80, status=USBD_NORMAL_COMPLETION) at linedisc.h:122 sc = (struct ucom_softc *) 0xc1617e80 tp = (struct tty *) 0xc166ee00 err = USBD_NORMAL_COMPLETION cc = 10 cp = (u_char *) 0xc15e9e6d "\032\033\034\035\036\037 !\"#æçèéêëìíîøùúûüýþÿ" lostcc = 0 #12 0xc04d44f8 in usb_transfer_complete (xfer=0xc1910300) at /usr/src/sys/dev/usb/usbdi.c:851 pipe = 0xc19bf500 dmap = (usb_dma_t *) 0xc191033c sync = 0 erred = 0 ---Type to continue, or q to quit--- repeat = 0 polling = 0 #13 0xc04c69ab in uhci_idone (ii=0x0) at /usr/src/sys/dev/usb/uhci.c:1500 xfer = 0xc1910300 upipe = (struct uhci_pipe *) 0xc19bf500 std = (uhci_soft_td_t *) 0x0 status = 0 nstatus = 0 actlen = 55 #14 0xc04c6888 in uhci_check_intr (sc=0xc15e0000, ii=0xc191036c) at /usr/src/sys/dev/usb/uhci.c:1375 std = (uhci_soft_td_t *) 0x0 lstd = (uhci_soft_td_t *) 0xc15e5f80 status = 0 #15 0xc04c67da in uhci_softintr (v=0xc15e0000) at /usr/src/sys/dev/usb/uhci.c:1305 sc = (uhci_softc_t *) 0xc15e0000 ii = (uhci_intr_info_t *) 0x0 nextii = (uhci_intr_info_t *) 0x0 #16 0xc04d1995 in usb_schedsoftintr (bus=0x0) at /usr/src/sys/dev/usb/usb.c:864 No locals. #17 0xc04c67a7 in uhci_intr1 (sc=0xc15e0000) at /usr/src/sys/dev/usb/uhci.c:1275 status = 1 ack = 1 #18 0xc04c6638 in uhci_intr (arg=0xc15e0000) at /usr/src/sys/dev/usb/uhci.c:1190 sc = (uhci_softc_t *) 0x0 #19 0xc050d86d in ithread_loop (arg=0xc14f7400) at /usr/src/sys/kern/kern_intr.c:547 ithd = (struct ithd *) 0xc14f7400 ih = (struct intrhand *) 0xc15db740 td = (struct thread *) 0xc14fa000 p = (struct proc *) 0xc15001c4 count = 0 warming = 0 warned = 0 #20 0xc050cb00 in fork_exit (callout=0xc050d71c , arg=0xc14f7400, frame=0xcbc67d48) at /usr/src/sys/kern/kern_fork.c:790 p = (struct proc *) 0xc15001c4 td = (struct thread *) 0x0 #21 0xc06a3fec in fork_trampoline () at /usr/src/sys/i386/i386/exception.s:209 No locals. (kgdb) [releng5-865]# cat /var/run/dmesg.boot Copyright (c) 1992-2005 The FreeBSD Project. Copyright (c) 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994 The Regents of the University of California. All rights reserved. FreeBSD 5.4-PRERELEASE #9: Thu Mar 31 17:28:54 EST 2005 mdtancsa@releng5-865.sentex.ca:/usr/obj/usr/src/sys/pioneer Timecounter "i8254" frequency 1193182 Hz quality 0 CPU: Intel(R) Celeron(R) CPU 2.40GHz (2400.41-MHz 686-class CPU) Origin = "GenuineIntel" Id = 0xf33 Stepping = 3 Features=0xbfebfbff real memory = 267321344 (254 MB) avail memory = 251940864 (240 MB) ACPI APIC Table: ioapic0 irqs 0-23 on motherboard npx0: on motherboard npx0: INT 16 interface acpi0: on motherboard acpi0: Power Button (fixed) Timecounter "ACPI-fast" frequency 3579545 Hz quality 1000 acpi_timer0: <24-bit timer at 3.579545MHz> port 0x4008-0x400b on acpi0 cpu0: on acpi0 acpi_button0: on acpi0 pcib0: port 0xcf8-0xcff on acpi0 pci0: on pcib0 agp0: port 0xd000-0xd007 mem 0xfa000000-0xfa07ffff,0xf0000000-0xf7ffffff irq 16 at device 2.0 on pci0 agp0: detected 892k stolen memory agp0: aperture size is 128M uhci0: port 0xc000-0xc01f irq 16 at device 29.0 on pci0 usb0: on uhci0 usb0: USB revision 1.0 uhub0: Intel UHCI root hub, class 9/0, rev 1.00/1.00, addr 1 uhub0: 2 ports with 2 removable, self powered uhci1: port 0xc400-0xc41f irq 19 at device 29.1 on pci0 usb1: on uhci1 usb1: USB revision 1.0 uhub1: Intel UHCI root hub, class 9/0, rev 1.00/1.00, addr 1 uhub1: 2 ports with 2 removable, self powered uhci2: port 0xc800-0xc81f irq 18 at device 29.2 on pci0 usb2: on uhci2 usb2: USB revision 1.0 uhub2: Intel UHCI root hub, class 9/0, rev 1.00/1.00, addr 1 uhub2: 2 ports with 2 removable, self powered uhci3: port 0xcc00-0xcc1f irq 16 at device 29.3 on pci0 usb3: on uhci3 usb3: USB revision 1.0 uhub3: Intel UHCI root hub, class 9/0, rev 1.00/1.00, addr 1 uhub3: 2 ports with 2 removable, self powered pcib1: at device 30.0 on pci0 pci1: on pcib1 rl0: port 0xa000-0xa0ff mem 0xf9000000-0xf90000ff irq 16 at device 4.0 on pci1 miibus0: on rl0 rlphy0: on miibus0 rlphy0: 10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, auto rl0: Ethernet address: 00:50:fc:f9:6b:7a pci1: at device 5.0 (no driver attached) fxp0: port 0xa800-0xa83f mem 0xf9001000-0xf9001fff irq 20 at device 8.0 on pci1 miibus1: on fxp0 inphy0: on miibus1 inphy0: 10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, auto fxp0: Ethernet address: 00:01:80:54:b3:b8 puc0: port 0xb000-0xb007,0xac00-0xac07 irq 18 at device 10.0 on pci1 sio4: on puc0 sio4: type 16550A sio4: unable to activate interrupt in fast mode - using normal mode sio5: on puc0 sio5: type 16550A sio5: unable to activate interrupt in fast mode - using normal mode puc1: port 0xb800-0xb807,0xb400-0xb407 irq 18 at device 10.1 on pci1 sio6: on puc1 sio6: type 16550A sio6: unable to activate interrupt in fast mode - using normal mode sio7: on puc1 sio7: type 16550A sio7: unable to activate interrupt in fast mode - using normal mode isab0: at device 31.0 on pci0 isa0: on isab0 atapci0: port 0xf000-0xf00f,0x376,0x170-0x177,0x3f6,0x1f0-0x1f7 at device 31.1 on pci0 ata0: channel #0 on atapci0 ata1: channel #1 on atapci0 pci0: at device 31.3 (no driver attached) acpi_tz0: on acpi0 fdc0: port 0x3f7,0x3f0-0x3f5 irq 6 drq 2 on acpi0 sio0: <16550A-compatible COM port> port 0x3f8-0x3ff irq 4 flags 0x10 on acpi0 sio0: type 16550A, console sio1: <16550A-compatible COM port> port 0x2f8-0x2ff irq 3 on acpi0 sio1: type 16550A atkbdc0: port 0x64,0x60 irq 1 on acpi0 atkbd0: irq 1 on atkbdc0 kbd0 at atkbd0 orm0: at iomem 0xc0000-0xc9fff on isa0 sc0: at flags 0x100 on isa0 sc0: VGA <16 virtual consoles, flags=0x300> vga0: at port 0x3c0-0x3df iomem 0xa0000-0xbffff on isa0 ucom0: FTDI USB FAST SERIAL ADAPTER, rev 2.00/5.00, addr 2 Timecounter "TSC" frequency 2400412599 Hz quality 800 Timecounters tick every 10.000 msec Fast IPsec: Initialized Security Association Processing. ipfw2 initialized, divert disabled, rule-based forwarding disabled, default to accept, logging limited to 31000 packets/entry by default ad0: 38166MB [77545/16/63] at ata0-master UDMA100 Mounting root from ufs:/dev/ad0s1a WARNING: / was not properly dismounted [releng5-865]# >How-To-Repeat: connect via dialup modem on the other end of an USB-RS232 adaptor (uplcom of utfdi) and run the following program #!/usr/bin/perl # # replace $target with an IP you can ping across the dialup connection # srand (time ^ $$ ^ unpack "%L*", `ps axww | gzip`); $target="192.168.1.10"; while (1) { $len = int(rand( 1200 ) ) + 25; $cnt = int(rand( 20 ) ) + 1; $slp = int(rand( 9 ) ) + 1; $cmd="/sbin/ping -q -i .5 -c $cnt -s $len $target"; select(undef, undef, undef, (1/$slp)); system($cmd); } >Fix: More details and analysis at http://lists.freebsd.org/pipermail/freebsd-usb/2005-March/000855.html >Release-Note: >Audit-Trail: >Unformatted: