Bug 83504

Summary: [kernel] [patch] SpeedTouch USB stop working on recent current (and RELENG_6) [regression]
Product: Base System Reporter: Diego <siarod>
Component: usbAssignee: freebsd-usb (Nobody) <usb>
Status: Open ---    
Severity: Affects Only Me    
Priority: Normal    
Version: Unspecified   
Hardware: Any   
OS: Any   

Description Diego 2005-07-15 12:30:15 UTC
I'm using speedtouch-1.3.1 with pppoa2

When I run ppp -background adsl it crash and kernel report this backtrace:

Jul 15 11:30:32  kernel: Purging 2 threads from ugen0.1
Jul 15 11:30:32  kernel: Sleeping on "usbdly" with the following non-sleepable locks held:
Jul 15 11:30:32  kernel: exclusive sleep mutex cdev r = 0 (0xc091c0a0) locked @ /usr/src/sys/kern/kern_conf.c:60
Jul 15 11:30:32  kernel: KDB: stack backtrace:
Jul 15 11:30:32  kernel: kdb_backtrace(1,c1da4830,c1da5900,c2863800,de987ac0) at kdb_backtrace+0x29
Jul 15 11:30:32  kernel: witness_warn(5,0,c08552d2,c084b980) at witness_warn+0x18e
Jul 15 11:30:32  kernel: msleep(de987ae8,0,4c,c084b980,15) at msleep+0x42
Jul 15 11:30:32  kernel: usb_delay_ms(c1afe000,14) at usb_delay_ms+0x67
Jul 15 11:30:32  kernel: ohci_abort_xfer(c2863800,6,de987b28,c05d77d7,c2863800) at ohci_abort_xfer+0x110
Jul 15 11:30:32  kernel: ohci_device_intr_abort(c2863800) at ohci_device_intr_abort+0x1c
Jul 15 11:30:32  kernel: usbd_ar_pipe(c1fde580) at usbd_ar_pipe+0x1f
Jul 15 11:30:32  kernel: usbd_abort_pipe(c1fde580) at usbd_abort_pipe+0xb
Jul 15 11:30:32  kernel: ugenpurge(c2787a00,c08511cd,2,c2787a78,1) at ugenpurge+0x56
Jul 15 11:30:32  kernel: destroy_devl(c2787a00,de987b88,c05c762e,c2787a00,0) at destroy_devl+0xe2
Jul 15 11:30:32  kernel: destroy_dev(c2787a00) at destroy_dev+0x10
Jul 15 11:30:32  kernel: ugen_destroy_devnodes(c1b4b000,303db60,c1bf4640,3856317,c1b11b1c) at ugen_destroy_devnodes+0x62
Jul 15 11:30:32  kernel: ugen_set_interface(c1b4b000,1,1) at ugen_set_interface+0x13e
Jul 15 11:30:32  kernel: ugen_do_ioctl(c1b4b000,0,c00c5567,c1bf4650,3) at ugen_do_ioctl+0x2a5
Jul 15 11:30:32  kernel: ugenioctl(c1b23a00,c00c5567,c1bf4650,3,c1da5900) at ugenioctl+0x63
Jul 15 11:30:32  kernel: devfs_ioctl_f(c1c28678,c00c5567,c1bf4650,c2252080,c1da5900) at devfs_ioctl_f+0xc7
Jul 15 11:30:32  kernel: ioctl(c1da5900,de987d04,3,3,296) at ioctl+0x370
Jul 15 11:30:32  kernel: syscall(3b,3b,3b,3,0) at syscall+0x22f
Jul 15 11:30:32  kernel: Xint0x80_syscall() at Xint0x80_syscall+0x1f
Jul 15 11:30:32  kernel: --- syscall (54, FreeBSD ELF32, ioctl), eip = 0x280b9287, esp = 0xbfbfde9c, ebp = 0xbfbfdec8 ---
Jul 15 11:30:32  kernel: lock order reversal
Jul 15 11:30:32  kernel: 1st 0xc091c0a0 cdev (cdev) @ /usr/src/sys/kern/kern_conf.c:60
Jul 15 11:30:32  kernel: 2nd 0xc091dba0 Giant (Giant) @ /usr/src/sys/kern/kern_synch.c:236
Jul 15 11:30:32  kernel: KDB: stack backtrace:
Jul 15 11:30:32  kernel: kdb_backtrace(0,ffffffff,c092eaa0,c092efc8,c08b9464) at kdb_backtrace+0x29
Jul 15 11:30:32  kernel: witness_checkorder(c091dba0,9,c085530b,ec) at witness_checkorder+0x564
Jul 15 11:30:32  kernel: _mtx_lock_flags(c091dba0,0,c085530b,ec) at _mtx_lock_flags+0x5b
Jul 15 11:30:32  kernel: msleep(de987ae8,0,4c,c084b980,15) at msleep+0x386
Jul 15 11:30:32  kernel: usb_delay_ms(c1afe000,14) at usb_delay_ms+0x67
Jul 15 11:30:32  kernel: ohci_abort_xfer(c2863800,6,de987b28,c05d77d7,c2863800) at ohci_abort_xfer+0x110
Jul 15 11:30:32  kernel: ohci_device_intr_abort(c2863800) at ohci_device_intr_abort+0x1c
Jul 15 11:30:32  kernel: usbd_ar_pipe(c1fde580) at usbd_ar_pipe+0x1f
Jul 15 11:30:32  kernel: usbd_abort_pipe(c1fde580) at usbd_abort_pipe+0xb
Jul 15 11:30:32  kernel: ugenpurge(c2787a00,c08511cd,2,c2787a78,1) at ugenpurge+0x56
Jul 15 11:30:32  kernel: destroy_devl(c2787a00,de987b88,c05c762e,c2787a00,0) at destroy_devl+0xe2
Jul 15 11:30:32  kernel: destroy_dev(c2787a00) at destroy_dev+0x10
Jul 15 11:30:32  kernel: ugen_destroy_devnodes(c1b4b000,303db60,c1bf4640,3856317,c1b11b1c) at ugen_destroy_devnodes+0x62
Jul 15 11:30:32  kernel: ugen_set_interface(c1b4b000,1,1) at ugen_set_interface+0x13e
Jul 15 11:30:32  kernel: ugen_do_ioctl(c1b4b000,0,c00c5567,c1bf4650,3) at ugen_do_ioctl+0x2a5
Jul 15 11:30:32  kernel: ugenioctl(c1b23a00,c00c5567,c1bf4650,3,c1da5900) at ugenioctl+0x63
Jul 15 11:30:32  kernel: devfs_ioctl_f(c1c28678,c00c5567,c1bf4650,c2252080,c1da5900) at devfs_ioctl_f+0xc7
Jul 15 11:30:32  kernel: ioctl(c1da5900,de987d04,3,3,296) at ioctl+0x370
Jul 15 11:30:32  kernel: syscall(3b,3b,3b,3,0) at syscall+0x22f
Jul 15 11:30:32  kernel: Xint0x80_syscall() at Xint0x80_syscall+0x1f
Jul 15 11:30:32  kernel: --- syscall (54, FreeBSD ELF32, ioctl), eip = 0x280b9287, esp = 0xbfbfde9c, ebp = 0xbfbfdec8 ---
Jul 15 11:30:32  kernel: Purging 2 threads from ugen0.1
Jul 15 11:30:44  last message repeated 118 times

and then infinitely repeat "Purging 2 threads from ugen0.1" in loop
Comment 1 Mark Linimon freebsd_committer freebsd_triage 2005-11-23 01:32:59 UTC
State Changed
From-To: open->feedback

There have been some recent changes in 6-STABLE.  Does this problem 
still recur?
Comment 2 Nick.Forbes 2005-11-23 10:07:38 UTC
Hi,

I can confirm this problem still occurs with 6.0-RELEASE, exactly as
described above. It occurs with both pppoa2 and pppoa3.

I have several of these modems of various revisions and would be happy
to do provide any extra information or do any testing required to try to
resolve this.

Thanks,

Nick.
Comment 3 Mark Linimon freebsd_committer freebsd_triage 2005-11-25 15:05:55 UTC
State Changed
From-To: feedback->open

Submitter notes that this problem persists in 6-STABLE.
Comment 4 Diego 2005-11-25 16:23:40 UTC
This problem persists in 6-STABLE.
Comment 5 Tim Bishop freebsd_committer 2006-02-11 19:07:47 UTC
Just to confirm that I've just seen this on the 6.1 BETA. It'd be great to 
see this fixed, but looks like I'll have to go back to 5-STABLE :-(

Tim.
Comment 6 Raaf 2006-02-12 07:59:51 UTC
The problem seems to happen because modem_run has one
of the modem's endpoints open while pppoa2 is setting
an alternate interface.

I don't have a fix, but a workaround that might work
for you:

Don't let pppoa2 set an alternate interface (this was
the default behavior of older versions of pppoa2 anyway).

You can do this by setting the pppoa2 '-e' switch to -1.

Example ppp.conf:
set device !"/usr/local/sbin/pppoa2 -e -1 -vpi 8 -vci 48 -v 1"
Comment 7 Tim Bishop freebsd_committer 2006-02-12 11:41:49 UTC
Raaf,

That worked! It'd be great to see the bug fixed obviously, but at least I 
can now get back online without the aid of a modem :-)

Tim.
Comment 8 iedowse 2006-02-25 17:33:59 UTC
Hi, could you see if the following patch helps? Since the code is
already prepared to release devmtx and sleep, and since there is a
timeout specified, it seems there should be no harm in dropping
the devmtx lock around the d_purge call too.

Ian

Index: kern_conf.c
===================================================================
RCS file: /dump/FreeBSD-CVS/src/sys/kern/kern_conf.c,v
retrieving revision 1.186.2.5
diff -u -r1.186.2.5 kern_conf.c
--- kern_conf.c	6 Nov 2005 15:58:06 -0000	1.186.2.5
+++ kern_conf.c	25 Feb 2006 17:26:12 -0000
@@ -662,7 +662,9 @@
 	while (csw != NULL && csw->d_purge != NULL && dev->si_threadcount) {
 		printf("Purging %lu threads from %s\n",
 		    dev->si_threadcount, devtoname(dev));
+		dev_unlock();
 		csw->d_purge(dev);
+		dev_lock();
 		msleep(csw, &devmtx, PRIBIO, "devprg", hz/10);
 	}
 	if (csw != NULL && csw->d_purge != NULL)
Comment 9 Mark Linimon freebsd_committer freebsd_triage 2007-07-05 21:56:04 UTC
Responsible Changed
From-To: freebsd-usb->freebsd-bugs

There is a patch here, but it's against kern_conf.c.
Comment 10 Mark Linimon freebsd_committer freebsd_triage 2008-05-05 02:18:08 UTC
Responsible Changed
From-To: freebsd-bugs->freebsd-usb

Reclassify.
Comment 11 Eitan Adler freebsd_committer freebsd_triage 2017-12-31 07:59:46 UTC
For bugs matching the following criteria:

Status: In Progress Changed: (is less than) 2014-06-01

Reset to default assignee and clear in-progress tags.

Mail being skipped