From louie@whizzo.transsys.com  Tue Mar 11 05:44:21 2003
Return-Path: <louie@whizzo.transsys.com>
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP
	id 4D47C37B401; Tue, 11 Mar 2003 05:44:21 -0800 (PST)
Received: from whizzo.transsys.com (whizzo.TransSys.COM [144.202.42.10])
	by mx1.FreeBSD.org (Postfix) with ESMTP
	id 163F543FD7; Tue, 11 Mar 2003 05:44:20 -0800 (PST)
	(envelope-from louie@whizzo.transsys.com)
Received: from whizzo.transsys.com (#6@localhost [127.0.0.1])
	by whizzo.transsys.com (8.12.8/8.12.7) with ESMTP id h2BDiJlp006454
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO);
	Tue, 11 Mar 2003 08:44:19 -0500 (EST)
	(envelope-from louie@whizzo.transsys.com)
Received: (from louie@localhost)
	by whizzo.transsys.com (8.12.8/8.12.7/Submit) id h2BDiJoa006453;
	Tue, 11 Mar 2003 08:44:19 -0500 (EST)
	(envelope-from louie)
Message-Id: <200303111344.h2BDiJoa006453@whizzo.transsys.com>
Date: Tue, 11 Mar 2003 08:44:19 -0500 (EST)
From: Louis Mamakos <louie@TransSys.COM>
Reply-To: Louis Mamakos <louie@TransSys.COM>
To: FreeBSD-gnats-submit@freebsd.org
Cc: Scott Johnson <scottj@insane.com>, iedowse@freebsd.org,
	joe@freebsd.org, re@freebsd.org
Subject: UHCI driver panic while booting if any USB device connected
X-Send-Pr-Version: 3.113
X-GNATS-Notify:

>Number:         49110
>Category:       kern
>Synopsis:       UHCI driver panic while booting if any USB device connected
>Confidential:   no
>Severity:       critical
>Priority:       high
>Responsible:    njl
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Tue Mar 11 05:50:14 PST 2003
>Closed-Date:    Fri Aug 22 00:00:00 PDT 2003
>Last-Modified:  Fri Aug 22 00:00:00 PDT 2003
>Originator:     Louis Mamakos
>Release:        FreeBSD 4.8-RC i386
>Organization:
>Environment:
System: FreeBSD whizzo.transsys.com 4.8-RC FreeBSD 4.8-RC #4: Mon Mar 10 09:26:50 EST 2003 louie@whizzo.transsys.com:/a/obj/usr/src/sys/WHIZZO i386

Dual-CPU Intel P-III XEON, and K6-III, each with
	device crypto
	device cryptodev
	device hifn
	device uhci

>Description:

Panic while booting in the UHCI driver if any devices are connected to
the system.  This seems to be provoked by having crypto configured in
the kernel which seems to have enabled interrupts during the probe
process.  uhci_done() is called with a null pointer during the probe
process.

>How-To-Repeat:

As above.  Enable cypto, cyptodev, hifn, uhci devices, boot with any
USB peripheral plugged into UHCI controller.

>Fix:

This fix via  Scott Johnson <scottj@insane.com> addresses the problem on
two different systems: dual-CPU P-III, K6-III, each with
	device crypto
	device cryptodev
	device hifn
and a UHCI adapter.

This *really* should be integrated into RELENG_4 prior to the 4.8
release.  I've been running with this change on these two different systems
with different sorts of USB peripherals on each with no problems.

Index: sys/dev/usb/uhci.c
===================================================================
RCS file: /a/cvs/src/sys/dev/usb/uhci.c,v
retrieving revision 1.40.2.10
diff -u -u -r1.40.2.10 uhci.c
--- sys/dev/usb/uhci.c  12 Jan 2003 02:13:58 -0000      1.40.2.10
+++ sys/dev/usb/uhci.c  10 Mar 2003 13:09:21 -0000
@@ -1202,11 +1202,10 @@
        for (; timo >= 0; timo--) {
                usb_delay_ms(&sc->sc_bus, 1);
                DPRINTFN(20,("uhci_waitintr: 0x%04x\n", UREAD2(sc, UHCI_STS)));
-               if (UREAD2(sc, UHCI_STS) & UHCI_STS_USBINT) {
+               if (UREAD2(sc, UHCI_STS) & UHCI_STS_USBINT)
                        uhci_intr(sc);
-                       if (xfer->status != USBD_IN_PROGRESS)
-                               return;
-               }
+               if (xfer->status != USBD_IN_PROGRESS)
+                       return;
        }
 
        /* Timeout */


Date: Mon, 10 Mar 2003 19:14:46 -0600
To: "Louis A. Mamakos" <louie@TransSys.COM>
From: Scott Johnson <scottj@insane.com>
Cc: freebsd-stable@FreeBSD.ORG
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"; format=flowed
Sender: owner-freebsd-stable@FreeBSD.ORG
List-ID: <freebsd-stable.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-stable>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-stable>
X-Loop: FreeBSD.ORG

So what do we need to do to get this patch into the source tree?  Is
there anyone around here who can help?

Thanks,
Scott


At 07:34 AM 3/10/2003, Louis A. Mamakos wrote:

>Release-Note:
>Audit-Trail:
Responsible-Changed-From-To: freebsd-bugs->joe 
Responsible-Changed-By: kris 
Responsible-Changed-When: Thu Jul 17 17:27:37 PDT 2003 
Responsible-Changed-Why:  
Assign to USB maintainer 

http://www.freebsd.org/cgi/query-pr.cgi?pr=49110 
Responsible-Changed-From-To: joe->njl 
Responsible-Changed-By: njl 
Responsible-Changed-When: Thu Aug 21 21:41:19 PDT 2003 
Responsible-Changed-Why:  
Looking into this and will try to address before 4.9 

http://www.freebsd.org/cgi/query-pr.cgi?pr=49110 
State-Changed-From-To: open->closed 
State-Changed-By: njl 
State-Changed-When: Thu Aug 21 23:59:17 PDT 2003 
State-Changed-Why:  
A fix went into -current in uhci.c:1.133 and showed up in 5.1R.  I just MFCd 
the fix into -stable and it will be in 4.9R. 
Thanks for the patch to iedowse@ 

http://www.freebsd.org/cgi/query-pr.cgi?pr=49110 
>Unformatted:
 >I was having the same problem with a panic during boot if I had anything
 >plugged into the USB adapter on my system.  (Actually, on two different
 >systems.)  I also recently added the crypto, crypodev and hifn devices
 >to my configuration.
 >
 >When I (manually) applied the patch enclosed in the email message, the
 >problem was resolved!!  Yay!
 >
 >This really should be tested and integrated into RELENG_4 prior to
 >the 4.8 release.
 >
 >louie
 >
 >
 > > Hello,
 > >
 > > About a month ago, I realized that I could not boot with the new  pseudo-device
 > > crypto in my kernel.  After quite a bit of email was exchanged with various
 > > parties, Ian Dowse recommended that I patch uhci.c.  Ian originally said
 > > something along the lines of "Is it possible that interrupts are  inadvertently
 > > getting enabled too early during device probe time? The loop in  uhci_waitintr()
 > > looks as if it will do the wrong thing if a real interrupt comes in and  invokes
 > > uhci_intr(), as the interrupt info will not be found because it has already
 > > been handled."
 > >
 > > Based on this theory, Ian suggested the patch below.  Without this patch, I
 > > cannot boot my system if I'm trying to use a kernel with crypto.  With the
 > > patch, everything seems to be working ok. OpenSSL is using my crypto  hardware
 > > just fine.  But I haven't tested any of the USB functionality.  And I don't
 > > have the resources to do so either.
 > >
 > > So my question is this: Is this patch something that needs to be incorporated
 > > into the tree?  Or is my hardware just strange?  I've been staying current
 > > with -STABLE, and as of March 7, -STABLE with crypto enabled still would not
 > > boot on my machine.
 > >
 > > Thanks in advance for any helpful advice.
 > > -Scott
 > >
 > >
 > > Here's the patch:
 > >
 > > ===================================================================
 > > RCS file: /home/ncvs/src/sys/dev/usb/uhci.c,v
 > > retrieving revision 1.132
 > > diff -u -p -r1.132 uhci.c
 > > --- uhci.c      2003/02/28 19:28:29     1.132
 > > +++ uhci.c      2003/03/10 11:01:08
 > > @@ -1511,11 +1511,10 @@ uhci_waitintr(uhci_softc_t *sc, usbd_xfe
 > >          for (; timo >= 0; timo--) {
 > >                  usb_delay_ms(&sc->sc_bus, 1);
 > >                  DPRINTFN(20,("uhci_waitintr: 0x%04x\n", UREAD2(sc,
 > > UHCI_STS)));
 > > -               if (UREAD2(sc, UHCI_STS) & UHCI_STS_USBINT) {
 > > +               if (UREAD2(sc, UHCI_STS) & UHCI_STS_USBINT)
 > >                          uhci_intr1(sc);
 > > -                       if (xfer->status != USBD_IN_PROGRESS)
 > > +               if (xfer->status != USBD_IN_PROGRESS)
 > >                                  return;
 > > -               }
 > >          }
 > >
 > >          /* Timeout */
 > >
 > >
 > > And here's my dmesg (patched kernel):
 > >
 > > Copyright (c) 1992-2003 The FreeBSD Project.
 > > Copyright (c) 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994
 > >          The Regents of the University of California. All rights reserved.
 > > FreeBSD 4.8-RC #1: Fri Mar  7 01:41:57 CST 2003
 > >      root@test01.insane.com:/usr/obj/usr/src/sys/CRYPTO
 > > Timecounter "i8254"  frequency 1193182 Hz
 > > CPU: AMD Athlon(tm) Processor (1008.99-MHz 686-class CPU)
 > >    Origin = "AuthenticAMD"  Id = 0x642  Stepping = 2
 > > 
 > Features=0x183f9ff<FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,MMX,FXSR>
 > >    AMD Features=0xc0440000<RSVD,AMIE,DSP,3DNow!>
 > > real memory  = 536788992 (524208K bytes)
 > > avail memory = 516943872 (504828K bytes)
 > > Preloaded elf kernel "kernel" at 0xc053d000.
 > > Pentium Pro MTRR support enabled
 > > md0: Malloc disk
 > > Using $PIR table, 9 entries at 0xc00f1750
 > > npx0: <math processor> on motherboard
 > > npx0: INT 16 interface
 > > pcib0: <Host to PCI bridge> on motherboard
 > > pci0: <PCI bus> on pcib0
 > > agp0: <VIA 82C8363 (Apollo KT133A) host to PCI bridge> mem
 > > 0xe4000000-0xe7ffffff at device 0.0 on pci0
 > > pcib1: <VIA 8363 (Apollo KT133) PCI-PCI (AGP) bridge> at device 1.0 on pci0
 > > pci1: <PCI bus> on pcib1
 > > isab0: <VIA 82C686 PCI-ISA bridge> at device 4.0 on pci0
 > > isa0: <ISA bus> on isab0
 > > atapci0: <VIA 82C686 ATA66 controller> port 0xd800-0xd80f at device 4.1 on pci0
 > > ata0: at 0x1f0 irq 14 on atapci0
 > > ata1: at 0x170 irq 15 on atapci0
 > > uhci0: <VIA 83C572 USB controller> port 0xd400-0xd41f irq 10 at device 4.2
 > > on pci0
 > > usb0: <VIA 83C572 USB controller> on uhci0
 > > usb0: USB revision 1.0
 > > uhub0: VIA UHCI root hub, class 9/0, rev 1.00/1.00, addr 1
 > > uhub0: 2 ports with 2 removable, self powered
 > > uhci1: <VIA 83C572 USB controller> port 0xd000-0xd01f irq 10 at device 4.3
 > > on pci0
 > > usb1: <VIA 83C572 USB controller> on uhci1
 > > usb1: USB revision 1.0
 > > uhub1: VIA UHCI root hub, class 9/0, rev 1.00/1.00, addr 1
 > > uhub1: 2 ports with 2 removable, self powered
 > > uhub2: ALCOR Generic USB Hub, class 9/0, rev 1.10/1.00, addr 2
 > > uhub2: 4 ports with 4 removable, self powered
 > > pci0: <unknown card> (vendor=0x1106, dev=0x3057) at 4.4
 > > hifn0 mem 0xe2800000-0xe2800fff,0xe3000000-0xe3000fff irq 10 at device 9.0
 > > on pci0
 > > hifn0: Hifn 7951, rev 0, 128KB sram, 193 sessions
 > > fxp0: <Intel Pro 10/100B/100+ Ethernet> port 0xa400-0xa43f mem
 > > 0xe1800000-0xe18fffff,0xe2000000-0xe2000fff irq 10 at device 13.0 on pci0
 > > fxp0: Ethernet address 00:02:b3:10:7a:39
 > > inphy0: <i82555 10/100 media interface> on miibus0
 > > inphy0:  10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, auto
 > > atapci1: <Promise ATA100 controller> port
 > > 0x8800-0x883f,0x9000-0x9003,0x9400-0x9407,0x9800-0x9803,0xa000-0xa007 mem
 > > 0xe1000000-0xe101ffff irq 11 at device 17.0 on pci0
 > > ata2: at 0xa000 on atapci1
 > > ata3: at 0x9400 on atapci1
 > > orm0: <Option ROM> at iomem 0xc8000-0xc8fff on isa0
 > > fdc0: ready for input in output
 > > fdc0: cmd 3 failed at out byte 1 of 3
 > > atkbdc0: <Keyboard controller (i8042)> at port 0x60,0x64 on isa0
 > > sio0 at port 0x3f8-0x3ff irq 4 flags 0x10 on isa0
 > > sio0: type 16550A, console
 > > sio1 at port 0x2f8-0x2ff irq 3 on isa0
 > > sio1: type 16550A
 > > ppc0: <Parallel port> at port 0x378-0x37f irq 7 on isa0
 > > ppc0: SMC-like chipset (ECP/EPP/PS2/NIBBLE) in COMPATIBLE mode
 > > ppc0: FIFO with 16/16/8 bytes threshold
 > > plip0: <PLIP network interface> on ppbus0
 > > lpt0: <Printer> on ppbus0
 > > lpt0: Interrupt-driven port
 > > ppi0: <Parallel I/O> on ppbus0
 > > IPsec: Initialized Security Association Processing.
 > > ata2-slave: ATA identify retries exceeded
 > > ata2-master: ATA identify retries exceeded
 > > ata3-slave: ATA identify retries exceeded
 > > ata3-master: ATA identify retries exceeded
 > > ad0: 3681MB <QUANTUM FIREBALL_TM3840A> [7480/16/63] at ata0-master WDMA2
 > > acd0: CDROM <Compaq CRD-8402B> at ata1-slave PIO4
 > > Mounting root from ufs:/dev/ad0s1a
 
 
 also reported on 16 Feb 2003:
 
 > X-Mailer: exmh version 2.5 07/13/2001 with nmh-1.0.4
 > X-Image-URL: http://www.transsys.com/louie/images/louie-mail.jpg
 > To: freebsd-stable@freebsd.org
 > From: "Louis A. Mamakos" <louie@TransSys.COM>
 > Subject: UHCI/USB related panic while 
 > Mime-Version: 1.0
 > Content-Type: text/plain; charset=us-ascii
 > Date: Sun, 16 Feb 2003 21:42:41 -0500
 > Sender: louie@whizzo.transsys.com
 > 
 > 
 > I just upgraded a machine to this morning's version of the RELENG_4
 > branch of FreeBSD.  I had problems booting it, where it would hang for
 > a bit, and then panic while probing for USB peripherals.  
 > 
 > There was a USB hub plugged into the UHCI 2-port built-in "hub", and a USB
 > mouse plugged into the external hub.  Attempting to boot with just the
 > external hub or just the external USB mouse seemed to break the same
 > way.  As this machine has a somewhat critical role, I couldn't spend
 > a lot of time experimenting.  I did jot down some of the information,
 > and it seems like uhci_idone() is invoked with a null pointer; the
 > fault virtual address is 0x4, which happens to be the offset of 
 > ii->xfer in the structure..
 > 
 > What's interesting is that after the system is booted, I can plug
 > in the USB mouse, and things work just fine.
 > 
 > Does this ring a bell for anyone? 
 > 
 > (kgdb) x/i 0xc02afecc
 > 0xc02afecc <uhci_idone+12>:     mov    0x4(%eax),%ebx
 > (kgdb) list *0xc02afecc
 > 0xc02afecc is in uhci_idone (/usr/src/sys/dev/usb/uhci.c:1065).
 > 1060    
 > 1061    /* Called at splusb() */
 > 1062    void
 > 1063    uhci_idone(uhci_intr_info_t *ii)
 > 1064    {
 > 1065            usbd_xfer_handle xfer = ii->xfer;
 > 1066            struct uhci_pipe *upipe = (struct uhci_pipe *)xfer->pipe;
 > 1067            uhci_soft_td_t *std;
 > 1068            u_int32_t status = 0, nstatus;
 > 1069            int actlen;
 > (kgdb) 
 > 
 > 
 > When the system boots, I see this much on the console:
 > 
 > uhci0: <Intel 82371AB/EB (PIIX4) USB controller> port 0xdce0-0xdcff irq 2 at device 7.2 on pci0
 > usb0: <Intel 82371AB/EB (PIIX4) USB controller> on uhci0
 > usb0: USB revision 1.0
 > uhub0: Intel UHCI root hub, class 9/0, rev 1.00/1.00, addr 1
 > uhub0: 2 ports with 2 removable, self powered
 > 
 > and then there's this ominious hang followed by the panic. 
 > 
 > louie
 > 
