Bug 122539

Summary: [ohci] [panic] AnyDATA ADU-E1000D - kernel panic: ohci_abort_xfer: not in process context
Product: Base System Reporter: Artur Zabronski <artur.zabronski>
Component: usbAssignee: freebsd-usb (Nobody) <usb>
Status: Open ---    
Severity: Affects Only Me Keywords: crash
Priority: Normal    
Version: 7.0-RELEASE   
Hardware: Any   
OS: Any   

Description Artur Zabronski 2008-04-07 18:40:02 UTC
When I am using AnyDATA ADU-E1000D CDMA/EV-DO modem connected to HP
NX6125 notebook kernel panic is randomly raised up.

dmesg:
Copyright (c) 1992-2008 The FreeBSD Project.
Copyright (c) 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994
        The Regents of the University of California. All rights reserved.
FreeBSD is a registered trademark of The FreeBSD Foundation.
FreeBSD 7.0-RELEASE #: Thu Mar 27 10:26:58 CET 2008
    artur@hpnx6125-laptop1.zabronski.com:/usr/obj/usr/src/sys/HPNX6125-LAPTOP1
Timecounter "i8254" frequency 1193182 Hz quality 0
CPU: AMD Turion(tm) 64 Mobile ML-40                  (2194.52-MHz 686-class CPU)
  Origin = "AuthenticAMD"  Id = 0x20f42  Stepping = 2
  Features=0x78bfbff<FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CLFLUSH,MMX,FXSR,SSE,SSE2>
  Features2=0x1<SSE3>
  AMD Features=0xe2500800<SYSCALL,NX,MMX+,FFXSR,LM,3DNow!+,3DNow!>
  AMD Features2=0x1<LAHF>
real memory  = 1039990784 (991 MB)
avail memory = 1003978752 (957 MB)
kbd1 at kbdmux0
kqemu version 0x00010300
kqemu: KQEMU installed, max_locked_mem=501388kB.
ath_hal: 0.9.20.3 (AR5210, AR5211, AR5212, RF5111, RF5112, RF2413, RF5413)
hptrr: HPT RocketRAID controller driver v1.1 (Mar 27 2008 10:26:40)
acpi0: <HP 0944> on motherboard
acpi0: [ITHREAD]
acpi0: Power Button (fixed)
unknown: I/O range not supported
acpi0: reservation of 0, a0000 (3) failed
acpi0: reservation of 100000, 3df00000 (3) failed
Timecounter "ACPI-fast" frequency 3579545 Hz quality 1000
acpi_timer0: <32-bit timer at 3.579545MHz> port 0x8008-0x800b on acpi0
acpi_ec0: <Embedded Controller: GPE 0x11> port 0x62,0x66 on acpi0
cpu0: <ACPI CPU> on acpi0
powernow0: <PowerNow! K8> on cpu0
pcib0: <ACPI Host-PCI bridge> port 0xcf8-0xcff on acpi0
pci_link1: BIOS IRQ 5 for 0.20.INTB is invalid
pci0: <ACPI PCI bus> on pcib0
pcib1: <ACPI PCI-PCI bridge> at device 1.0 on pci0
pci_link1: BIOS IRQ 5 for 1.5.INTA is invalid
pci1: <ACPI PCI bus> on pcib1
vgapci0: <VGA-compatible display> port 0x3000-0x30ff mem 0xc0000000-0xc3ffffff,0xc4600000-0xc460ffff irq 9 at device 5.0 on pci1
pcib2: <ACPI PCI-PCI bridge> at device 4.0 on pci0
pci16: <ACPI PCI bus> on pcib2
pcib3: <ACPI PCI-PCI bridge> at device 5.0 on pci0
pci32: <ACPI PCI bus> on pcib3
ohci0: <ATI SB400 USB Controller> mem 0xc4a00000-0xc4a00fff irq 10 at device 19.0 on pci0
ohci0: [GIANT-LOCKED]
ohci0: [ITHREAD]
usb0: OHCI version 1.0, legacy support
usb0: <ATI SB400 USB Controller> on ohci0
usb0: USB revision 1.0
uhub0: <ATI OHCI root hub, class 9/0, rev 1.00/1.00, addr 1> on usb0
uhub0: 4 ports with 4 removable, self powered
ohci1: <ATI SB400 USB Controller> mem 0xc4a01000-0xc4a01fff irq 10 at device 19.1 on pci0
ohci1: [GIANT-LOCKED]
ohci1: [ITHREAD]
usb1: OHCI version 1.0, legacy support
usb1: <ATI SB400 USB Controller> on ohci1
usb1: USB revision 1.0
uhub1: <ATI OHCI root hub, class 9/0, rev 1.00/1.00, addr 1> on usb1
uhub1: 4 ports with 4 removable, self powered
ehci0: <ATI SB400 USB 2.0 controller> mem 0xc4a02000-0xc4a02fff irq 10 at device 19.2 on pci0
ehci0: [GIANT-LOCKED]
ehci0: [ITHREAD]
usb2: EHCI version 1.0
usb2: companion controllers, 4 ports each: usb0 usb1
usb2: <ATI SB400 USB 2.0 controller> on ehci0
usb2: USB revision 2.0
uhub2: <ATI EHCI root hub, class 9/0, rev 2.00/1.00, addr 1> on usb2
uhub2: 8 ports with 8 removable, self powered
pci0: <serial bus, SMBus> at device 20.0 (no driver attached)
atapci0: <ATI IXP400 UDMA133 controller> port 0x1f0-0x1f7,0x3f6,0x170-0x177,0x376,0x4010-0x401f irq 10 at device 20.1 on pci0
ata0: <ATA channel 0> on atapci0
ata0: [ITHREAD]
ata1: <ATA channel 1> on atapci0
ata1: [ITHREAD]
isab0: <PCI-ISA bridge> at device 20.3 on pci0
isa0: <ISA bus> on isab0
pcib4: <ACPI PCI-PCI bridge> at device 20.4 on pci0
pci_link6: BIOS IRQ 5 for 2.2.INTA is invalid
pci2: <ACPI PCI bus> on pcib4
bge0: <Broadcom NetXtreme Gigabit Ethernet Controller, ASIC rev. 0x3003> mem 0xc4000000-0xc400ffff irq 10 at device 1.0 on pci2
miibus0: <MII bus> on bge0
brgphy0: <BCM5705 10/100/1000baseTX PHY> PHY 1 on miibus0
brgphy0:  10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, 1000baseT, 1000baseT-FDX, auto
bge0: Ethernet address: 00:16:d4:05:53:d2
bge0: [ITHREAD]
ndis0: <Broadcom 802.11b/g WLAN> mem 0xc4010000-0xc4011fff irq 11 at device 2.0 on pci2
ndis0: [ITHREAD]
ndis0: NDIS API version: 5.1
ndis0: using obsoleted if_watchdog interface
ndis0: Ethernet address: 00:14:a5:a5:4d:ea
cbb0: <TI6411 PCI-CardBus Bridge> mem 0xc4012000-0xc4012fff irq 11 at device 4.0 on pci2
cardbus0: <CardBus bus> on cbb0
pccard0: <16-bit PCCard bus> on cbb0
cbb0: [ITHREAD]
fwohci0: <1394 Open Host Controller Interface> mem 0xc4013000-0xc40137ff,0xc4014000-0xc4017fff irq 9 at device 4.2 on pci2
fwohci0: [FILTER]
fwohci0: OHCI version 1.10 (ROM=0)
fwohci0: No. of Isochronous channels is 4.
fwohci0: EUI64 00:02:3f:99:29:31:22:0c
fwohci0: Phy 1394a available S400, 2 ports.
fwohci0: Link S400, max_rec 2048 bytes.
firewire0: <IEEE1394(FireWire) bus> on fwohci0
fwe0: <Ethernet over FireWire> on firewire0
if_fwe0: Fake Ethernet address: 02:02:3f:31:22:0c
fwe0: Ethernet address: 02:02:3f:31:22:0c
fwip0: <IP over FireWire> on firewire0
fwip0: Firewire address: 00:02:3f:99:29:31:22:0c @ 0xfffe00000000, S400, maxrec 2048
sbp0: <SBP-2/SCSI over FireWire> on firewire0
dcons_crom0: <dcons configuration ROM> on firewire0
dcons_crom0: bus_addr 0x3cd78000
fwohci0: Initiate bus reset
fwohci0: BUS reset
fwohci0: node_id=0xc800ffc0, gen=2, CYCLEMASTER mode
pci2: <mass storage> at device 4.3 (no driver attached)
pci2: <base peripheral> at device 4.4 (no driver attached)
pcm0: <ATI IXP 400> mem 0xc4a04000-0xc4a040ff irq 9 at device 20.5 on pci0
pcm0: [ITHREAD]
pci0: <simple comms, generic modem> at device 20.6 (no driver attached)
battery0: <ACPI Control Method Battery> on acpi0
battery1: <ACPI Control Method Battery> on acpi0
acpi_acad0: <AC Adapter> on acpi0
acpi_button0: <Sleep Button> on acpi0
acpi_lid0: <Control Method Lid Switch> on acpi0
acpi_tz0: <Thermal Zone> on acpi0
acpi_tz1: <Thermal Zone> on acpi0
acpi_tz2: <Thermal Zone> on acpi0
acpi_tz3: <Thermal Zone> on acpi0
atkbdc0: <Keyboard controller (i8042)> port 0x60,0x64 irq 1 on acpi0
atkbd0: <AT Keyboard> irq 1 on atkbdc0
kbd0 at atkbd0
atkbd0: [GIANT-LOCKED]
atkbd0: [ITHREAD]
psm0: <PS/2 Mouse> irq 12 on atkbdc0
psm0: [GIANT-LOCKED]
psm0: [ITHREAD]
psm0: model Synaptics Touchpad, device ID 0
pmtimer0 on isa0
orm0: <ISA Option ROM> at iomem 0xc0000-0xcefff pnpid ORM0000 on isa0
ppc0: <Parallel port> at port 0x378-0x37f irq 7 on isa0
ppc0: SMC-like chipset (ECP/EPP/PS2/NIBBLE) in COMPATIBLE mode
ppc0: FIFO with 16/16/8 bytes threshold
ppbus0: <Parallel port bus> on ppc0
ppbus0: [ITHREAD]
plip0: <PLIP network interface> on ppbus0
lpt0: <Printer> on ppbus0
lpt0: Interrupt-driven port
ppi0: <Parallel I/O> on ppbus0
ppc0: [GIANT-LOCKED]
ppc0: [ITHREAD]
sc0: <System console> at flags 0x100 on isa0
sc0: VGA <16 virtual consoles, flags=0x300>
sio0: configured irq 4 not in bitmap of probed irqs 0
sio0: port may not be enabled
sio0: configured irq 4 not in bitmap of probed irqs 0
sio0: port may not be enabled
sio0 at port 0x3f8-0x3ff irq 4 flags 0x10 on isa0
sio0: type 8250 or not responding
sio0: [FILTER]
sio1: configured irq 3 not in bitmap of probed irqs 0
sio1: port may not be enabled
vga0: <Generic ISA VGA> at port 0x3c0-0x3df iomem 0xa0000-0xbffff on isa0
ucom0: <AnyDATA Corporation AnyDATA CDMA Products, class 0/0, rev 1.10/0.00, addr 2> on uhub0
ugen0: <vendor 0x08ff Fingerprint Sensor, class 255/255, rev 1.10/6.21, addr 2> on uhub1
ums0: <A4Tech PS/2+USB Mouse, class 0/0, rev 1.10/0.01, addr 3> on uhub1
ums0: 8 buttons and Z dir.
Timecounter "TSC" frequency 2194517620 Hz quality 800
Timecounters tick every 1.000 msec
ipfw2 (+ipv6) initialized, divert loadable, rule-based forwarding enabled, default to deny, logging limited to 100 packets/entry by default
firewire0: 1 nodes, maxhop <= 0, cable IRM = 0 (me)
firewire0: bus manager 0 (me)
fwohci0: phy int
hptrr: no controller detected.
ad0: 76319MB <FUJITSU MHV2080AH 00830097> at ata0-master UDMA100
acd0: DVDR <MATSHITAUJ-840D/1.02> at ata1-master PIO4
pcm0: <Conexant CX20468-21 AC97 Codec>
acd0: FAILURE - INQUIRY ILLEGAL REQUEST asc=0x24 ascq=0x00 
cd0 at ata1 bus 0 target 0 lun 0
cd0: <MATSHITA UJ-840D 1.02> Removable CD-ROM SCSI-0 device 
cd0: 16.000MB/s transfers
cd0: Attempt to query device size failed: NOT READY, Medium not present
Trying to mount root from ufs:/dev/ad0s1a
WARNING: attempt to net_add_domain(bluetooth) after domainfinalize()
fuse4bsd: version 0.3.9-pre1, FUSE ABI 7.8
ucom0: ubsa_request: STALLED
ucom0: ubsa_request: STALLED
ucom0: ubsa_request: STALLED
ucom0: ubsa_request: STALLED
ucom0: ubsa_request: STALLED
ucom0: ubsa_request: STALLED
ucom0: ubsa_request: STALLED
panic: ohci_abort_xfer: not in process context
cpuid = 0
Uptime: 8m38s
Physical memory: 979 MB
Dumping 134 MB: 119 103 87 71 55 39 23 7
Dump complete
Automatic reboot in 15 seconds - press a key on the console to abort
Rebooting...


usbdevs -v:
Controller /dev/usb0:
addr 1: full speed, self powered, config 1, OHCI root hub(0x0000), ATI(0x0000), rev 1.00
 port 1 powered
 port 2 powered
 port 3 addr 2: full speed, power 500 mA, config 1, AnyDATA CDMA Products(0x6501), AnyDATA Corporation(0x16d5), rev 0.00
 port 4 powered
Controller /dev/usb1:
addr 1: full speed, self powered, config 1, OHCI root hub(0x0000), ATI(0x0000), rev 1.00
 port 1 addr 2: full speed, power 100 mA, config 1, Fingerprint Sensor(0x2580), vendor 0x08ff(0x08ff), rev 6.21
 port 2 powered
 port 3 addr 3: low speed, power 100 mA, config 1, PS/2+USB Mouse(0x000a), A4Tech(0x09da), rev 0.01
 port 4 powered
Controller /dev/usb2:
addr 1: high speed, self powered, config 1, EHCI root hub(0x0000), ATI(0x0000), rev 1.00
 port 1 powered
 port 2 powered
 port 3 powered
 port 4 powered
 port 5 powered
 port 6 powered
 port 7 powered
 port 8 powered


kgdb:
[GDB will not be able to debug user-mode threads: /usr/lib/libthread_db.so: Undefined symbol "ps_pglobal_lookup"]
GNU gdb 6.1.1 [FreeBSD]
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i386-marcel-freebsd".

Unread portion of the kernel message buffer:
panic: ohci_abort_xfer: not in process context
cpuid = 0
Uptime: 8m38s
Physical memory: 979 MB
Dumping 134 MB: 119 103 87 71 55 39 23 7

#0  doadump () at pcpu.h:195
195	pcpu.h: No such file or directory.
	in pcpu.h
(kgdb) bt
#0  doadump () at pcpu.h:195
#1  0xc07544f6 in boot (howto=260) at /usr/src/sys/kern/kern_shutdown.c:409
#2  0xc07547bc in panic (fmt=Variable "fmt" is not available.
) at /usr/src/sys/kern/kern_shutdown.c:563
#3  0xc06bc47d in ohci_abort_xfer (xfer=0xc4e6c200, status=USBD_NORMAL_COMPLETION) at /usr/src/sys/dev/usb/ohci.c:2222
#4  0xc06bcd00 in ohci_timeout_task (addr=0xc4e6c200) at /usr/src/sys/dev/usb/ohci.c:1942
#5  0xc06d0241 in usb_task_thread (arg=0xc0be34a0) at /usr/src/sys/dev/usb/usb.c:483
(kgdb)
Comment 1 Mark Linimon freebsd_committer freebsd_triage 2008-04-07 23:19:05 UTC
Responsible Changed
From-To: freebsd-bugs->freebsd-usb

Over to maintainer(s).
Comment 2 John E. Hein 2009-03-12 17:44:21 UTC
Note: this is not specific to ohci or the device originally used in
this PR.  The problem is more generic.

This happens for us when hardware flow control is turned on when using
a usb serial device (specifically an ftdi based one).  Eventually if
hardware flow has to kick in and RTS is to be set, uftdi_set() is
called in uftdi.c (old usb stack).

In uftdi_set() there is this...

        (void)usbd_do_request(ucom->sc_udev, &req, NULL);

Since we're calling this from the interrupt context, the response
to the request times out (because the reply is not processed), the
ohci_abort_xfer which performas the panic because we're not in
the process context.

Here is a patch that uses the usbd_do_request_async() call (instead of the
synchronous version) to assert flow control when the input buffer reaches
the highwater mark (which is detected from within interupt context).

(patch against today's version of uftdi.c in the old usb stack)

Index: sys/legacy/dev/usb/uftdi.c
===================================================================
RCS file: /base/FreeBSD-CVS/src/sys/legacy/dev/usb/uftdi.c,v
retrieving revision 1.1
diff -u -p -r1.1 uftdi.c
--- uftdi.c	23 Feb 2009 18:16:17 -0000	1.1
+++ uftdi.c	12 Mar 2009 17:34:27 -0000
@@ -557,7 +557,7 @@ uftdi_set(void *vsc, int portno, int reg
 	DPRINTFN(2,("uftdi_set: reqtype=0x%02x req=0x%02x value=0x%04x "
 		    "index=0x%04x len=%d\n", req.bmRequestType, req.bRequest,
 		    UGETW(req.wValue), UGETW(req.wIndex), UGETW(req.wLength)));
-	(void)usbd_do_request(ucom->sc_udev, &req, NULL);
+	(void)usbd_do_request_async(ucom->sc_udev, &req, NULL);
 }
 
 static int


This is not specific to FTDI devices.  It would probably be better to
handle this in the usb serial layer.  Whatever better fix someone
comes up with should be merged to 7.x if possible (and 6).

I have not yet looked to see if the new usb stack has the same
problem.  Please let me know if someone does this analysis.
Comment 3 John E. Hein 2009-03-12 18:14:42 UTC
The code to pull the patch out of the text of the last submission for
the web page was too agressive and pulled some text into the patch
blurb.  So it's not missed, here is that last bit of text separately...

======================
This is not specific to FTDI devices.  It would probably be better to
handle this in the usb serial layer.  Whatever better fix someone
comes up with should be merged to 7.x if possible (and 6).

I have not yet looked to see if the new usb stack has the same
problem.  Please let me know if someone does this analysis.
======================
Comment 4 Eitan Adler freebsd_committer freebsd_triage 2017-12-31 08:01:06 UTC
For bugs matching the following criteria:

Status: In Progress Changed: (is less than) 2014-06-01

Reset to default assignee and clear in-progress tags.

Mail being skipped
Comment 5 Graham Perrin freebsd_committer freebsd_triage 2022-10-17 12:18:05 UTC
Keyword: 

    crash

– in lieu of summary line prefix: 

    [panic]

* bulk change for the keyword
* summary lines may be edited manually (not in bulk). 

Keyword descriptions and search interface: 

    <https://bugs.freebsd.org/bugzilla/describekeywords.cgi>