From gnn@jchurch.neville-neil.com  Sat Jan 10 19:45:42 2004
Return-Path: <gnn@jchurch.neville-neil.com>
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id D1B8416A4CE
	for <FreeBSD-gnats-submit@freebsd.org>; Sat, 10 Jan 2004 19:45:42 -0800 (PST)
Received: from jchurch.neville-neil.com (jchurch.neville-neil.com [209.157.133.226])
	by mx1.FreeBSD.org (Postfix) with ESMTP id AC4E043D3F
	for <FreeBSD-gnats-submit@freebsd.org>; Sat, 10 Jan 2004 19:45:41 -0800 (PST)
	(envelope-from gnn@jchurch.neville-neil.com)
Received: from jchurch.neville-neil.com (localhost [127.0.0.1])
	by jchurch.neville-neil.com (8.12.10/8.12.10) with ESMTP id i0B3jfqt000455
	for <FreeBSD-gnats-submit@freebsd.org>; Sat, 10 Jan 2004 19:45:41 -0800 (PST)
	(envelope-from gnn@jchurch.neville-neil.com)
Received: (from gnn@localhost)
	by jchurch.neville-neil.com (8.12.10/8.12.10/Submit) id i0B3jeMG000454;
	Sat, 10 Jan 2004 19:45:40 -0800 (PST)
	(envelope-from gnn)
Message-Id: <200401110345.i0B3jeMG000454@jchurch.neville-neil.com>
Date: Sat, 10 Jan 2004 19:45:40 -0800 (PST)
From: "George V. Neville-Neil" <gnn@jchurch.neville-neil.com>
Reply-To: "George V. Neville-Neil" <gnn@jchurch.neville-neil.com>
To: FreeBSD-gnats-submit@freebsd.org
Cc:
Subject: System panic on USB vs. Serial problems
X-Send-Pr-Version: 3.113
X-GNATS-Notify:

>Number:         61191
>Category:       kern
>Synopsis:       [usb] [panic] USB vs. Serial problems
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    freebsd-usb
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Sat Jan 10 19:50:15 PST 2004
>Closed-Date:    Sat Jul 23 04:14:36 GMT 2005
>Last-Modified:  Thu Aug 26 11:24:21 UTC 2010
>Originator:     George V. Neville-Neil
>Release:        FreeBSD 4.9-STABLE i386
>Organization:
Neville-Neil Consulting
>Environment:
System: FreeBSD jchurch.neville-neil.com 4.9-STABLE FreeBSD 4.9-STABLE #6: Mon Dec 22 21:14:11 PST 2003 root@jchurch.neville-neil.com:/usr/obj/usr/local/src-STABLE/src/sys/JCHURCH i386


>Description:
	I am attempting to use my desktop as a console to my 
-CURRENT target system.  To do this I have hooked COM1 on the desktop to COM1 
on the target system with a nul modem, 9 pin, cable.  While my cu session is
open on the target I get random crashes of my desktop.  I do not get a 
kernel core dump (alas) but the panic is:

Jan 10 19:17:40 jchurch /kernel: panic: clist reservation botch

This panic occurs only in one place in the kernel:

sys/kern/tty_subr.c:

cblock_alloc()
{
	struct cblock *cblockp;

	cblockp = cfreelist;
	if (cblockp == NULL)
		panic("clist reservation botch");
	cfreelist = cblockp->c_next;
	cblockp->c_next = NULL;
	cfreecount -= CBSIZE;
	return (cblockp);
}

My desktop has both the serial cable plugged into COM1 as well as a 
USB Keyboard and USB trackpad.  I know this is USB related for two reasons:

1) Someone else mentioned they were having similar problems.

2) The machine actually hangs, and only resets when I unplug the USB keyboard.

>How-To-Repeat:
>Fix:

>Release-Note:
>Audit-Trail:

From: Bruce Evans <bde@zeta.org.au>
To: "George V. Neville-Neil" <gnn@jchurch.neville-neil.com>
Cc: FreeBSD-gnats-submit@freebsd.org, freebsd-bugs@freebsd.org
Subject: Re: kern/61191: System panic on USB vs. Serial problems
Date: Mon, 12 Jan 2004 02:08:41 +1100 (EST)

 On Sat, 10 Jan 2004, George V. Neville-Neil wrote:
 
 > >Description:
 > 	I am attempting to use my desktop as a console to my
 > -CURRENT target system.  To do this I have hooked COM1 on the desktop to COM1
 > on the target system with a nul modem, 9 pin, cable.  While my cu session is
 > open on the target I get random crashes of my desktop.  I do not get a
 > kernel core dump (alas) but the panic is:
 >
 > Jan 10 19:17:40 jchurch /kernel: panic: clist reservation botch
 > ...
 > My desktop has both the serial cable plugged into COM1 as well as a
 > USB Keyboard and USB trackpad.  I know this is USB related for two reasons:
 >
 > 1) Someone else mentioned they were having similar problems.
 >
 > 2) The machine actually hangs, and only resets when I unplug the USB keyboard.
 
 Apparently usb is still missing some spltty()'s or spltty() doesn't mask
 usb interrupts.  spltty() is programmed to masked usb interrupts here
 in RELENG_4:
 
 % int
 % uhidopen(dev_t dev, int flag, int mode, usb_proc_ptr p)
 % {
 % 	struct uhid_softc *sc;
 % 	usbd_status err;
 % #if defined(__FreeBSD__) && defined(__i386__)
 % 	static int hid_opened;
 %
 % 	if (hid_opened == 0) {
 % 		int s;
 % 		s = splhigh();
 % 		tty_imask |= bio_imask;
 % 		update_intr_masks();
 % 		splx(s);
 % 		hid_opened = 1;
 % 	}
 % #endif
 
 This probably should work, but is not very robust.  It has extra code
 to avoid changing the masks twice, but changing the masks more than
 once may be needed to pick up new masks as new devices are attached.
 I don't know if the obove is called for all systems with usb.
 
 I think making splusb() (= splbio()) mask tty interrupts (using
 bio_imask = tty_imask in the above) is not required, but would be safer.
 Consider a usb interrupt.  It will not necessarily be masked by
 spltty(), but its interrupt handler may call into the tty subsystem.
 E.g.:
 
 % void
 % uhid_intr(usbd_xfer_handle xfer, usbd_private_handle addr, usbd_status status)
 % {
 % 	struct uhid_softc *sc = addr;
 % ...
 % 	(void) b_to_q(sc->sc_ibuf, sc->sc_isize, &sc->sc_q);
   	       ^^^^^^^
 
 There are no problems here, since b_to_q() calls spltty() internally
 and usb can't interrupt a critical region locked by spltty() (since
 spltty() is stronger than splusb()).  However, some other entry points
 require their callers to do the spltty().  Try adding SPLASSERT()s to
 all of these to find broken callers (*).  The most important such entry
 point is ttyinput(), but usb seems to only use it in ucom.c and umodem.c
 and it is correctly spl'ed there.
 
 (*) I'm not sure if SPLASSERT() works.  It is still in RELENG_4, but
 proved to be so useful that there are almost no references to it in
 the cvs repository except in the files that implemented it and in
 commit messages.
 
 Bruce
Responsible-Changed-From-To: freebsd-bugs->freebsd-usb 
Responsible-Changed-By: linimon 
Responsible-Changed-When: Thu Nov 4 06:53:17 GMT 2004 
Responsible-Changed-Why:  
Reassign to appropriate mailing list. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=61191 
State-Changed-From-To: open->feedback 
State-Changed-By: iedowse 
State-Changed-When: Wed Mar 23 02:23:00 GMT 2005 
State-Changed-Why:  

Do these panics still occur with more recent releases? 

http://www.freebsd.org/cgi/query-pr.cgi?pr=61191 
State-Changed-From-To: feedback->closed 
State-Changed-By: linimon 
State-Changed-When: Sat Jul 23 04:14:17 GMT 2005 
State-Changed-Why:  
Feedback timeout (> 3 months). 

http://www.freebsd.org/cgi/query-pr.cgi?pr=61191 
>Unformatted:
