>Number:         26912
>Category:       kern
>Synopsis:       ehci(4) crashed while reading from disk
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sat Sep 11 20:18:03 UTC 2004
>Closed-Date:
>Last-Modified:
>Originator:     
>Release:        NetBSD 2.0G 2004-09-10 sources
>Organization:
Matthias Scheler                                  http://scheler.de/~matthias/
>Environment:
System: NetBSD lyssa.zhadum.de 2.0G NetBSD 2.0G (LYSSA) #0: Fri Sep 10 08:42:40 CEST 2004 tron@lyssa.zhadum.de:/src/sys/compile/LYSSA i386
Architecture: i386
Machine: i386
>Description:
After trying to scrape data from a faulty IDE disk in an USB 2.0 case my
system paniced in the ehci(4) driver:

sd4(umass1:0:0:0):  Check Condition on CDB: 0x28 00 00 0f 96 f1 00 00 01 00
    SENSE KEY:  Media Error
     ASC/ASCQ:  Data Phase Error

sd4: fabricating a geometry
sd4: fabricating a geometry
sd4: fabricating a geometry
ehci_idone: need toggle update status=18003d40 nstatus=50000d80
uvm_fault(0xc0510c00, 0x7cb9000, 0, 1) -> 0xe
fatal page fault in supervisor mode
trap type 6 code 0 eip c03b3ba8 cs 8 eflags 10282 cr2 7cb97f8 ilevel 5
panic: trap
Begin traceback...
trap() at netbsd:trap+0x162
--- trap (number 6) ---
usb_allocmem(c1889000,1f,0,c18a7d40,7d00) at netbsd:usb_allocmem+0x85
ehci_allocm(c1889000,c18a7d40,1f,c034ea11,c21e56e0) at netbsd:ehci_allocm+0x27
usbd_transfer(c18a7d00,c180ce80,c227f400,c227f46c,1f) at netbsd:usbd_transfer+0x59
umass_setup_transfer(c227f400,c180ce80,c227f46c,1f,0) at netbsd:umass_setup_transfer+0x66
umass_bbb_transfer(c227f400,0,c1952084,a,caf97000) at netbsd:umass_bbb_transfer+0x14e
umass_scsipi_request(c1806838,0,c1952000,296,1) at netbsd:umass_scsipi_request+0xcd
scsipi_run_queue(c1806838,10,c0462ac4,0,0) at netbsd:scsipi_run_queue+0x154
scsipi_completion_thread(c1806838,590000,598000,0,c0100321) at netbsd:scsipi_completion_thread+0xd6
End traceback...

It's an Intel i865PE based motherboard using the ICH5's USB 2.0 controller:

ehci0 at pci0 dev 29 function 7: Intel 82801EB/ER USB EHCI Controller (rev. 0x02)
ehci0: interrupting at ioapic0 pin 23 (irq 9)
ehci0: EHCI version 1.0
ehci0: companion controllers, 2 ports each: uhci0 uhci1 uhci2 uhci3
usb4 at ehci0: USB revision 2.0
uhub4 at usb4

And here is the attachment message of the USB 2.0 case:

umass0 at uhub4 port 4 configuration 1 interface 0
umass0: Macpower OXSEMI Mass Storage, rev 2.00/0.00, addr 2
umass0: using SCSI over Bulk-Only
ehci_idone: need toggle update status=80018d40 nstatus=80008c80
scsibus0 at umass0: 2 targets, 1 lun per target
sd0 at scsibus0 target 0 lun 0: <IC35L040, AVER07-0, ER4O> disk fixed
sd0: fabricating a geometry
sd0: 39266 MB, 39266 cyl, 64 head, 32 sec, 512 bytes/sect x 80418240 sectors

[Yes, that's the same disk. It got another minor number because it was
 present at system startup after the panic.]

>How-To-Repeat:
Read data from a faulty disk via ehci(4).

>Fix:
None provided.

>Release-Note:
>Audit-Trail:
>Unformatted: