kern/41754: Attach/detach of generic USB device causes crash

[Wim Lewis <wiml%hhhh.org@localhost>]

>Number:         41754
>Category:       kern
>Synopsis:       Attach/detach of generic USB device causes crash
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Mon Jul 20 06:50:00 +0000 2009
>Originator:     Wim Lewis
>Release:        NetBSD 5.0
>Environment:
System: NetBSD 5.0_STABLE (PIPPIN) #4: Sun Jul 19 13:29:31 PDT 2009
        
wiml%pippin.hhhh.org@localhost:/mnt/bsd4/home/wiml/usr/src/sys/arch/macppc/compile/PIPPIN
Architecture: powerpc
Machine: macppc
cpu0 at mainbus0: 7447A (Revision 1.2), ID 0 (primary)
uhub0 at usb0: Apple Computer OHCI root hub, class 9/0, rev 1.00/1.00, addr 1
uhub0: 2 ports with 2 removable, self powered
uhub1 at usb1: NEC OHCI root hub, class 9/0, rev 1.00/1.00, addr 1
uhub1: 3 ports with 3 removable, self powered
uhub3 at usb3: NEC EHCI root hub, class 9/0, rev 2.00/1.00, addr 1
uhub3: 5 ports with 5 removable, self powered
>Description:
Detaching a particular USB device (or, more rarely, attaching it) can
cause my machine to crash. Usually it simply becomes completely unresponsive;
sometimes it will spontaneously reboot. In some cases, kernel messages
will still be written to the console, but userland is completely hung.

The machine is a PPC Mac Mini. The device is an AT91SAM7S64 development
board, which does not have any drivers on the NetBSD machine (I am interacting
with it using ugen and libusb). By "detaching" I mean any of: physically
pulling the USB cable; hitting the reset switch on the board (which
should be electrically almost the same as pulling the cable); and changing
the firmware on the board (which would cause it to stop responding to USB
requests without actually signaling a detached state on the bus).

I've had this problem with the following kernels (PIPPIN is a local
configuration with a number of unneccessary devices disabled, and
options DIAGNOSTIC, DEBUG, DDB_ONPANIC, USB_DEBUG, and OHCI_DEBUG
enabled):
  4.0.1 (GENERIC binary distro kernel)
  5.0-RC1 (GENERIC)
  5.0-RC3 (GENERIC binary distro, GENERIC compiled locally, PIPPIN compiled 
locally)
  5.0_STABLE 20090719 (PIPPIN compiled locally)

I've tried increasing the kernel's verbosity with usbdebug (from pkgsrc)
but haven't found any telling differences between the messages emitted
when the machine does vs. doesn't crash, or between the usb device I'm
having trouble with and other innocuous devices. I'm not sure what to
look for, though.

Other than the USB problem, the machine is quite stable. I've run (e.g.)
CPANSmoke on it for months with no trouble.
>How-To-Repeat:
I can't get this to happen on demand; sometimes it happens the first
time I attach/detach the device, sometimes I can plug and unplug the device
many times without a problem. Other USB devices (keyboard, mouse, flash
drive) have no problems.

It's not necessary to interact with the device from user space at all to
cause the problem (that is, plugging it in, waiting for it to enumerate,
and then unplugging it can cause the crash).

>Fix:

Unknown