From chu@gpi.ru  Sun Jan 27 13:02:41 2002
Return-Path: <chu@gpi.ru>
Received: from h33.erkki.ton.tut.fi (h33.erkki.ton.tut.fi [193.166.84.86])
	by hub.freebsd.org (Postfix) with ESMTP id 9C30537B400
	for <FreeBSD-gnats-submit@freebsd.org>; Sun, 27 Jan 2002 13:02:39 -0800 (PST)
Received: from gpi.ru (chu@localhost [127.0.0.1])
	by h33.erkki.ton.tut.fi (8.11.6/8.11.6) with ESMTP id g0RL2XS81433
	for <FreeBSD-gnats-submit@freebsd.org>; Sun, 27 Jan 2002 23:02:37 +0200 (EET)
	(envelope-from chu@gpi.ru)
Message-Id: <3C546AE8.C6EAEE60@gpi.ru>
Date: Sun, 27 Jan 2002 23:02:32 +0200
From: Vladimir Tchoukharev <chu@gpi.ru>
Sender: chu@h33.erkki.ton.tut.fi
To: FreeBSD-gnats-submit@freebsd.org
Subject: USB joystick causes panic on boot
References: <200201271735.g0RHZlT48919@h33.erkki.ton.tut.fi>

>Number:         34352
>Category:       i386
>Synopsis:       USB joystick makes panic on boot
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    joe
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Sun Jan 27 13:10:01 PST 2002
>Closed-Date:    Wed Jan 30 05:50:28 PST 2002
>Last-Modified:  Wed Jan 30 11:00:00 PST 2002
>Originator:     Vladimir Chukharev
>Release:        FreeBSD 4.4-STABLE i386
>Organization:
>Environment:
System: FreeBSD svak.h33.erkki.ton.tut.fi 4.4-STABLE FreeBSD 4.4-STABLE
#1: Sat Dec 29 01:26:24 EET 2001
root@svak.h33.erkki.ton.tut.fi:/usr/src/sys/compile/H33 i386
>Description:
  I have a multi-OS box. Recently I get a Logitec WingMan Extrem Digital
3D
joystick. It has a USB connector (actually with game/USB adaptor, but I
do
use the adaptor always). If this joystick is connected to the computer,
FreeBSD cannot be booted, it panics with trap 12 while detecting the USB
devices, then tries to reboot again.

OK, here goes my dmesg whithout joystick connected.
---------------
Copyright (c) 1992-2001 The FreeBSD Project.
Copyright (c) 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994
        The Regents of the University of California. All rights
reserved.
FreeBSD 4.4-STABLE #1: Sat Dec 29 01:26:24 EET 2001
    root@svak.h33.erkki.ton.tut.fi:/usr/src/sys/compile/H33
Timecounter "i8254"  frequency 1193182 Hz
CPU: Pentium III/Pentium III Xeon/Celeron (869.61-MHz 686-class CPU)
  Origin = "GenuineIntel"  Id = 0x68a  Stepping = 10
 
Features=0x383f9ff<FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,MMX,FXSR,SSE>
real memory  = 268369920 (262080K bytes)
avail memory = 257556480 (251520K bytes)
Preloaded elf kernel "kernel" at 0xc0388000.
VESA: v3.0, 32768k memory, flags:0x1, mode table:0xc031b002 (1000022)
VESA: NVidia
netsmb_dev: loaded
Pentium Pro MTRR support enabled
md0: Malloc disk
Using $PIR table, 7 entries at 0xc00fdd50
apm0: <APM BIOS> on motherboard
apm: found APM BIOS v1.2, connected at v1.2
npx0: <math processor> on motherboard
npx0: INT 16 interface
pcib0: <Host to PCI bridge> on motherboard
pci0: <PCI bus> on pcib0
pcib1: <VIA 82C598MVP (Apollo MVP3) PCI-PCI (AGP) bridge> at device 1.0
on pci0
pci1: <PCI bus> on pcib1
pci1: <NVidia model 0111 graphics accelerator> at 0.0 irq 10
isab0: <VIA 82C686 PCI-ISA bridge> at device 7.0 on pci0
isa0: <ISA bus> on isab0
atapci0: <VIA 82C686 ATA100 controller> port 0xd000-0xd00f at device 7.1
on pci0
ata0: at 0x1f0 irq 14 on atapci0
ata1: at 0x170 irq 15 on atapci0
uhci0: <VIA 83C572 USB controller> port 0xd400-0xd41f irq 9 at device
7.2 on pci0
usb0: <VIA 83C572 USB controller> on uhci0
usb0: USB revision 1.0
uhub0: VIA UHCI root hub, class 9/0, rev 1.00/1.00, addr 1
uhub0: 2 ports with 2 removable, self powered
uhci1: <VIA 83C572 USB controller> port 0xd800-0xd81f irq 9 at device
7.3 on pci0
usb1: <VIA 83C572 USB controller> on uhci1
usb1: USB revision 1.0
uhub1: VIA UHCI root hub, class 9/0, rev 1.00/1.00, addr 1
uhub1: 2 ports with 2 removable, self powered
chip1: <VIA 82C686 ACPI interface> at device 7.4 on pci0
pcm0: <VIA VT82C686A> port 0xe400-0xe403,0xe000-0xe003,0xdc00-0xdcff irq
11 at device 7.5 on pci0
chip2: <VIA 82C686 AC97 Modem> port 0xe800-0xe8ff irq 11 at device 7.6
on pci0
rl0: <RealTek 8139 10/100BaseTX> port 0xec00-0xecff mem
0xde000000-0xde0000ff irq 11 at device 10.0 on pci0
rl0: Ethernet address: 00:40:f4:24:d1:e9
miibus0: <MII bus> on rl0
rlphy0: <RealTek internal media interface> on miibus0
rlphy0:  10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, auto
orm0: <Option ROMs> at iomem 0xc0000-0xca7ff,0xd0000-0xd7fff on isa0
fdc0: <NEC 72065B or clone> at port 0x3f0-0x3f5,0x3f7 irq 6 drq 2 on
isa0
fdc0: FIFO enabled, 8 bytes threshold
fd0: <1440-KB 3.5" drive> on fdc0 drive 0
atkbdc0: <Keyboard controller (i8042)> at port 0x60,0x64 on isa0
atkbd0: <AT Keyboard> flags 0x1 irq 1 on atkbdc0
kbd0 at atkbd0
psm0: <PS/2 Mouse> irq 12 on atkbdc0
psm0: model IntelliMouse, device ID 3
vga0: <Generic ISA VGA> at port 0x3c0-0x3df iomem 0xa0000-0xbffff on
isa0
sc0: <System console> at flags 0x100 on isa0
sc0: VGA <16 virtual consoles, flags=0x300>
sio0 at port 0x3f8-0x3ff irq 4 flags 0x10 on isa0
sio0: type 16550A
sio1 at port 0x2f8-0x2ff irq 3 on isa0
sio1: type 16550A
ppc0: <Parallel port> at port 0x378-0x37f irq 7 on isa0
ppc0: SMC-like chipset (ECP/EPP/PS2/NIBBLE) in COMPATIBLE mode
ppc0: FIFO with 16/16/8 bytes threshold
plip0: <PLIP network interface> on ppbus0
lpt0: <Printer> on ppbus0
lpt0: Interrupt-driven port
ppi0: <Parallel I/O> on ppbus0
sbc0: <SoundBlaster Pro> at port 0x220-0x22f irq 5 drq 1 flags 0x15 on
isa0
pcm2: <SB DSP 3.02> on sbc0
pca0 at port 0x40 on isa0
IPFW: MOD_LOAD
IP packet filtering initialized, divert enabled, rule-based forwarding
enabled, default to deny, logging limited to 100 packets/entry by
default
ad0: 39266MB <IC35L040AVER07-0> [79780/16/63] at ata0-master tagged
UDMA100
acd0: DVD-ROM <HITACHI DVD-ROM GD-8000> at ata1-master using PIO4
Mounting root from ufs:/dev/ad0s3a
---------------

And now I will try to reproduce what I have written down from the
screen.
It was right after the last line with uhub0 in it (replacing everything
starting from "uhci1:")

---------------
ugen0: Logitec Inc. product 0x207, rev 1.00/1.04 addr 2, iclass 3/0
uhid0: no report descriptor
device_probe_and_attach: uhid0 attach return 6
ugen0: Logitec Inc. product 0x207, rev 1.00/1.04 addr 2
ugen0: setting configuration index 0 failed
device_probe_and_attach: ugen0 attach return 6
uhci1: <VIA 83C572 USB controller> port 0xd800-0xd81f irq 9 at device
7.3 on p0
usb1: <VIA 83C572 USB controller> on uhci1
usb1: USB revision 1.0

Fatal trap 12: page fault while in kernel mode
fault virtual address   = 0x64003a
fault code              = supervisor read, page not present
instruction pointer     = 0x8:0xc0152b0a
stack pointer           = 0x10:0xc03aa9a4
frame pointer           = 0x10:0xc03aa9b8
code segment            = base 0x0, limit 0xfffff, type 0x1b
                        = DPL 0, pres 1, def32 1, gran 1
processor eflags        = interrupt enabled, resume, IOPL = 0
current process         = 0 (swapper)
interrupt mask          = net tty bio cam
trap number             = 12
panic: page fault
Uptime: 0s
Automatic reboot in 15 seconds - press a key on the console to abort
---------------

Mistypings are probable, sorry :(

>How-To-Repeat:
>Fix:
  Workaround: disconnect the joystick.

Best regards,
Vladimir Chukharev
>Release-Note:
>Audit-Trail:

From: Mike Makonnen <mike_makonnen@yahoo.com>
To: Vladimir Tchoukharev <chu@gpi.ru>
Cc: FreeBSD-gnats-submit@FreeBSD.ORG, joe@FreeBSD.ORG
Subject: Re: i386/34352: USB joystick causes panic on boot
Date: Sun, 27 Jan 2002 15:08:06 -0800

 On Sun, 27 Jan 2002 23:02:32 +0200
 Vladimir Tchoukharev <chu@gpi.ru> wrote:
 > ---------------
 > ugen0: Logitec Inc. product 0x207, rev 1.00/1.04 addr 2, iclass 3/0
 > uhid0: no report descriptor
 > device_probe_and_attach: uhid0 attach return 6
 > ugen0: Logitec Inc. product 0x207, rev 1.00/1.04 addr 2
 > ugen0: setting configuration index 0 failed
 > device_probe_and_attach: ugen0 attach return 6
 > uhci1: <VIA 83C572 USB controller> port 0xd800-0xd81f irq 9 at device
 > 7.3 on p0
 > usb1: <VIA 83C572 USB controller> on uhci1
 > usb1: USB revision 1.0
 > 
 > Fatal trap 12: page fault while in kernel mode
 > fault virtual address   = 0x64003a
 > fault code              = supervisor read, page not present
 > instruction pointer     = 0x8:0xc0152b0a
 > stack pointer           = 0x10:0xc03aa9a4
 > frame pointer           = 0x10:0xc03aa9b8
 > code segment            = base 0x0, limit 0xfffff, type 0x1b
 >                         = DPL 0, pres 1, def32 1, gran 1
 > processor eflags        = interrupt enabled, resume, IOPL = 0
 > current process         = 0 (swapper)
 > interrupt mask          = net tty bio cam
 > trap number             = 12
 > panic: page fault
 > Uptime: 0s
 > Automatic reboot in 15 seconds - press a key on the console to abort
 > ---------------
 
 This was fixed in -CURRENT in June 2001 (PR 27370), but someone forgot
 to MFC it.[I've cc'd joe@freebsd.org since he's the current maintainer]
 
 Anyways, here's the patch for -STABLE,
 
 cheers,
 mike makonnen
 
 Index: sys/dev/usb/uhid.c
 ===================================================================
 RCS file: /home/ncvs/src/sys/dev/usb/uhid.c,v
 retrieving revision 1.27.2.6
 diff -u -r1.27.2.6 uhid.c
 --- sys/dev/usb/uhid.c	5 Oct 2001 07:02:48 -0000	1.27.2.6
 +++ sys/dev/usb/uhid.c	27 Jan 2002 22:55:20 -0000
 @@ -229,8 +229,6 @@
  	if (err) {
  		printf("%s: no report descriptor\n", USBDEVNAME(sc->sc_dev));
  		sc->sc_dying = 1;
 -		if (desc != NULL)
 -			free(desc, M_USBDEV);
  		USB_ATTACH_ERROR_RETURN;
  	}
  	
 Index: sys/dev/usb/usbdi_util.c
 ===================================================================
 RCS file: /home/ncvs/src/sys/dev/usb/usbdi_util.c,v
 retrieving revision 1.15.2.3
 diff -u -r1.15.2.3 usbdi_util.c
 --- sys/dev/usb/usbdi_util.c	31 Oct 2000 23:23:30 -0000	1.15.2.3
 +++ sys/dev/usb/usbdi_util.c	27 Jan 2002 22:54:52 -0000
 @@ -460,6 +460,7 @@
  				       *sizep, *descp);
  	if (err) {
  		free(*descp, mem);
 +		*descp = NULL;
  		return (err);
  	}
  	return (USBD_NORMAL_COMPLETION);

From: Peter Pentchev <roam@ringlet.net>
To: Josef Karthauser <joe@FreeBSD.org>
Cc: bug-followup@FreeBSD.org
Subject: Re: i386/34352: USB joystick causes panic on boot
Date: Mon, 28 Jan 2002 10:18:38 +0200

 On Sun, Jan 27, 2002 at 03:10:01PM -0800, Mike Makonnen wrote:
 > The following reply was made to PR i386/34352; it has been noted by GNATS.
 > 
 > From: Mike Makonnen <mike_makonnen@yahoo.com>
 > To: Vladimir Tchoukharev <chu@gpi.ru>
 > Cc: FreeBSD-gnats-submit@FreeBSD.ORG, joe@FreeBSD.ORG
 > Subject: Re: i386/34352: USB joystick causes panic on boot
 > Date: Sun, 27 Jan 2002 15:08:06 -0800
 > 
 >  On Sun, 27 Jan 2002 23:02:32 +0200
 >  Vladimir Tchoukharev <chu@gpi.ru> wrote:
 >  > ---------------
 >  > ugen0: Logitec Inc. product 0x207, rev 1.00/1.04 addr 2, iclass 3/0
 >  > uhid0: no report descriptor
 >  > device_probe_and_attach: uhid0 attach return 6
 >  > ugen0: Logitec Inc. product 0x207, rev 1.00/1.04 addr 2
 >  > ugen0: setting configuration index 0 failed
 >  > device_probe_and_attach: ugen0 attach return 6
 >  > uhci1: <VIA 83C572 USB controller> port 0xd800-0xd81f irq 9 at device
 >  > 7.3 on p0
 >  > usb1: <VIA 83C572 USB controller> on uhci1
 >  > usb1: USB revision 1.0
 >  > 
 >  > Fatal trap 12: page fault while in kernel mode
 >  > fault virtual address   = 0x64003a
 >  > fault code              = supervisor read, page not present
 >  > instruction pointer     = 0x8:0xc0152b0a
 >  > stack pointer           = 0x10:0xc03aa9a4
 >  > frame pointer           = 0x10:0xc03aa9b8
 >  > code segment            = base 0x0, limit 0xfffff, type 0x1b
 >  >                         = DPL 0, pres 1, def32 1, gran 1
 >  > processor eflags        = interrupt enabled, resume, IOPL = 0
 >  > current process         = 0 (swapper)
 >  > interrupt mask          = net tty bio cam
 >  > trap number             = 12
 >  > panic: page fault
 >  > Uptime: 0s
 >  > Automatic reboot in 15 seconds - press a key on the console to abort
 >  > ---------------
 >  
 >  This was fixed in -CURRENT in June 2001 (PR 27370), but someone forgot
 >  to MFC it.[I've cc'd joe@freebsd.org since he's the current maintainer]
 >  
 >  Anyways, here's the patch for -STABLE,
 >  
 >  cheers,
 >  mike makonnen
 >  
 >  Index: sys/dev/usb/uhid.c
 >  ===================================================================
 >  RCS file: /home/ncvs/src/sys/dev/usb/uhid.c,v
 >  retrieving revision 1.27.2.6
 >  diff -u -r1.27.2.6 uhid.c
 >  --- sys/dev/usb/uhid.c	5 Oct 2001 07:02:48 -0000	1.27.2.6
 >  +++ sys/dev/usb/uhid.c	27 Jan 2002 22:55:20 -0000
 >  @@ -229,8 +229,6 @@
 >   	if (err) {
 >   		printf("%s: no report descriptor\n", USBDEVNAME(sc->sc_dev));
 >   		sc->sc_dying = 1;
 >  -		if (desc != NULL)
 >  -			free(desc, M_USBDEV);
 >   		USB_ATTACH_ERROR_RETURN;
 >   	}
 >   	
 >  Index: sys/dev/usb/usbdi_util.c
 >  ===================================================================
 >  RCS file: /home/ncvs/src/sys/dev/usb/usbdi_util.c,v
 >  retrieving revision 1.15.2.3
 >  diff -u -r1.15.2.3 usbdi_util.c
 >  --- sys/dev/usb/usbdi_util.c	31 Oct 2000 23:23:30 -0000	1.15.2.3
 >  +++ sys/dev/usb/usbdi_util.c	27 Jan 2002 22:54:52 -0000
 >  @@ -460,6 +460,7 @@
 >   				       *sizep, *descp);
 >   	if (err) {
 >   		free(*descp, mem);
 >  +		*descp = NULL;
 >   		return (err);
 >   	}
 >   	return (USBD_NORMAL_COMPLETION);
 
 Joe, if you decide to MFC this, maybe you should ask the release
 engineers for a MFC right now, before 4.5 goes out?  A crash as soon
 as a joystick is attached sounds like possible bad publicity to me.. :)
 
 G'luck,
 Peter
 
 -- 
 This sentence contains exactly threee erors.

From: Hiten Pandya <hiten@uk.FreeBSD.org>
To: bug-followup@FreeBSD.org
Cc: chu@gpi.ru
Subject: re: i386/34352 (close request)
Date: Wed, 30 Jan 2002 08:49:07 +0000

 hi,
 I beleive this PR can be closed, as solutions were suggested by
 Mike Makonnen w/ patches.
 
 regards,
 
  - Hiten Pandya
  - <hiten@uk.FreeBSD.org

From: Vladimir Tchoukharev <chu@kempc17.me.tut.fi>
To: bug-followup@FreeBSD.org
Cc:  
Subject: Re: i386/34352 (close request)
Date: Wed, 30 Jan 2002 12:00:32 +0200

 I try to check if the patch works for me on -STABLE,
 but yesterday installworld stuck... Hope to overcome
 in the evening today, albeit cannot be sure about time...
 
 Well, I  think it's OK to close PR now, I don't expect 
 problems with the patch itself. Or wait one day more, 
 I promise to report the result.
 
 Vladimir Chukharev (PR originator)
 
 Hiten Pandya wrote:
 > 
 > hi,
 > I beleive this PR can be closed, as solutions were suggested by
 > Mike Makonnen w/ patches.
 > 
 > regards,
 > 
 >  - Hiten Pandya
 >  - <hiten@uk.FreeBSD.org
Responsible-Changed-From-To: freebsd-bugs->joe 
Responsible-Changed-By: dwmalone 
Responsible-Changed-When: Wed Jan 30 02:15:32 PST 2002 
Responsible-Changed-Why:  
Joe, can you MFC this patch? 

http://www.FreeBSD.org/cgi/query-pr.cgi?pr=34352 
State-Changed-From-To: open->closed 
State-Changed-By: joe 
State-Changed-When: Wed Jan 30 05:50:28 PST 2002 
State-Changed-Why:  
I've merged this to -stable. 

http://www.FreeBSD.org/cgi/query-pr.cgi?pr=34352 

From: Vladimir Tchoukharev <chu@gpi.ru>
To: freebsd-gnats-submit@FreeBSD.org, chu@gpi.ru
Cc:  
Subject: Re: i386/34352: USB joystick makes panic on boot
Date: Wed, 30 Jan 2002 20:55:36 +0200

 The patch works for me OK. Thanks!
 
 Vladimir Chukharev
>Unformatted:
