>Number:         26727
>Category:       kern
>Synopsis:       recurrent panics when usb flash stalls
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sat Aug 21 13:13:00 UTC 2004
>Closed-Date:
>Last-Modified:
>Originator:     Denis Lagno
>Release:        NetBSD 2.0G
>Organization:
>Environment:
System: NetBSD cheburante.gado 2.0G NetBSD 2.0G (GENERIC_LAPTOP) #0: Fri Aug 13 17:06:35 MSD 2004 dina@flamante.local.domain:/volatile/worksrc/netbsd-current/src/sys/arch/i386/compile/obj.FLAMANTE/GENERIC_LAPTOP i386
Architecture: i386
Machine: i386

ohci0 at pci0 dev 10 function 0: Acer Labs M5237 USB Host Controller (rev. 0x03)
ohci0: interrupting at irq 11
ohci0: OHCI version 1.0, legacy support
usb0 at ohci0: USB revision 1.0
uhub0 at usb0
uhub0: Acer Labs OHCI root hub, class 9/0, rev 1.00/1.00, addr 1
uhub0: 2 ports with 2 removable, self powered
ohci1 at pci0 dev 10 function 1: Acer Labs M5237 USB Host Controller (rev. 0x03)
ohci1: interrupting at irq 5
ohci1: OHCI version 1.0, legacy support
usb1 at ohci1: USB revision 1.0
uhub1 at usb1
uhub1: Acer Labs OHCI root hub, class 9/0, rev 1.00/1.00, addr 1
uhub1: 2 ports with 2 removable, self powered
ohci2 at pci0 dev 10 function 2: Acer Labs M5237 USB Host Controller (rev. 0x03)
ohci2: interrupting at irq 9
ohci2: OHCI version 1.0, legacy support
usb2 at ohci2: USB revision 1.0
uhub2 at usb2
uhub2: Acer Labs OHCI root hub, class 9/0, rev 1.00/1.00, addr 1
uhub2: 2 ports with 2 removable, self powered
ehci0 at pci0 dev 10 function 3: Acer Labs product 0x5239 (rev. 0x01)
ehci0: interrupting at irq 10
ehci0: EHCI version 1.0
ehci0: companion controllers, 2 ports each: ohci0 ohci1 ohci2
usb3 at ehci0: USB revision 2.0
uhub3 at usb3
uhub3: Acer Labs EHCI root hub, class 9/0, rev 2.00/1.00, addr 1
uhub3: 6 ports with 6 removable, self powered

>Description:
I insert flash drive:

umass0 at uhub3 port 4 configuration 1 interface 0
umass0: USB Flash Disk, rev 2.00/2.00, addr 2
umass0: using SCSI over Bulk-Only
scsibus0 at umass0: 2 targets, 1 lun per target
sd0 at scsibus0 target 0 lun 0: <JetFlash, TS256MJF2B, 2.00> disk removable
sd0: fabricating a geometry
sd0: 250 MB, 250 cyl, 64 head, 32 sec, 512 bytes/sect x 512000 sectors

mount it:

mount -t msdos /dev/sd0d /mnt

/mnt is NFS exported.  On that other machine I try to cp -R /mnt/* /somewhere
Sometimes all passes OK.  Sometimes flash stalls.
In that case in kernel log appears:

umass0: BBB reset failed, TIMEOUT
umass0: BBB bulk-in clear stall failed, TIMEOUT
umass0: BBB bulk-out clear stall failed, TIMEOUT
umass0: BBB reset failed, TIMEOUT
umass0: BBB bulk-in clear stall failed, TIMEOUT
umass0: BBB bulk-out clear stall failed, TIMEOUT
umass0: BBB reset failed, TIMEOUT

In that case if I remove flash then kernel panics.  Or one time it paniced even without
touching flash.

Panic is something like:

uvm_fault(0xc060a340, 0x20393000, 0, 1) -> 0xe
kernel: page fault trap, code=0
Stopped in pid 280.1 (scsibus0) at	netbsd:usb_allocmem+0x7e:	cmpl	%edx,0(%eax)
db> bt
usb_allocmem(c0bc0c00,1f,0,c0bc1f3c,0) at netbsd:usb_allocmem+0x7e
ehci_allocm(c0bc0c00,c0bc1f3c,1f,c0bc1f3c,0) at netbsd:ehci_allocm+0x16
usbd_transfer(c0bc1f00,0,fde8,c0477518,c1088c68) at netbsd:usbd_transfer+0x174
umass_setup_transfer(c1088c00,c0f6d480,c1088c68,1f,0) at netbsd:umass_setup_transfer+0x47
umass_bbb_transfer(c1088c00,0,c1094084,a,c46bd000) at netbsd:umass_bbb_transfer+0x129
umass_scsipi_request(c1086138,0,c1094000,0,0) at netbsd:umass_scsipi_request+0x9d
scsipi_run_queue(c1086138,c0398868,8,246,c038f3a2) at netbsd:scsipi_run_queue:0x140
scsipi_completion_thread(c1086138,6bd000,6c5000,0,c0100321) at netbsd:scsipi_completion_thread+0xda

>How-To-Repeat:
>Fix:

>Release-Note:
>Audit-Trail:
>Unformatted: