usb/76554: Panram "yoyo" USB MP3 player causes panic when unplugged on ohci, no device nodes appear

[Steve Hodgson]

>Number:         76554
>Category:       usb
>Synopsis:       Panram "yoyo" USB MP3 player causes panic when unplugged on ohci, no device nodes appear
>Confidential:   no
>Severity:       serious
>Priority:       low
>Responsible:    freebsd-usb
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Fri Jan 21 23:20:28 GMT 2005
>Closed-Date:
>Last-Modified:
>Originator:     Steve Hodgson
>Release:        5.3-STABLE. cvsup circa 10 January
>Organization:
>Environment:
FreeBSD congo.princess.local 5.3-STABLE FreeBSD 5.3-STABLE #0: Thu Jan 20 19:35:36 GMT 2005     root at congo.princess.local:/usr/obj/usr/src/sys/CONGO  i386
>Description:
When plugging in the MP3 player I got the following messages on the console. Sorry, I didn't enable hw.usb.debug, but I can repeat if required.

=============
Jan 21 21:13:12 congo kernel: umass0: vendor 0x0ef8 PANRAM, rev 1.10/1.00, addr 2
Jan 21 21:13:12 congo kernel: umass0: 8070i (ATAPI) over Bulk-Only; quirks = 0x0000
Jan 21 21:13:12 congo kernel: umass0:2:0:-1: Attached to scbus2
=============

No devices appeared in /dev/.
Left it for a bit, removed the drive and got this panic. Hand transposed from DDB

=============
Fatal trap 12: page fault while in kernel mode
fault virtual address   = 0x4
fault code              = supervisor read, page not present
instruction pointer     = 0x8:0xc04a2f5e
stack pointer           = 0x10:0xd338ebbc
frame pointer           = 0x10:0xd338ebf4
code segment            = base 0x0, limit 0xfffff, type 0x1b
                        = DPL 0, pres 1, def32 1, gran 1
processor eflags        = interrupt enabled, resume, IOPL = 0
current process         = 31 (irq21:ohci1)
[thread pid 31 tid 100027 ]
Stopped at      ohci_device_bulk_start+0xe:     movl    0x4(%esi),%eax
db> trace
Tracing pid 31 tid 100027 td 0xc1cf6af0
ohci_device_bulk_start(c24f1600,0,c2145300,c2145300,c2089500) at ohci_device_bullk_start+0xe
usbd_start_next(c2145300,c24f1700,d,d338ec48,c052808f) at usbd_start_next+0x49
usb_transfer_complete(x2089500,c24f5f30,0,d338ec6c,c053c5da) at usb_transfer_coimplete+0x1fa
ohci_softintr(c1ded000,2) at ohci_softintr+0x279
usb_schedsoftintr(c1ded000,11589f30,35c632ba,c06f0855,83a) at usb_schedsoftintr+0x39
ohci_intr1(c1ded000,d338ed14,c0fff5d0,c1ded000,0) at ohci_intr1+0x1d1
ohci_intr(c1ded000,0,0,0,0) at ohci_intr+0x36
--- trap 0x1, eip = 0, esp = 0xd338ed7c, ebp = 0 ---
=============

>From the resulting core dump I got this backtrace from kgdb

=============
#8  0xc06ecb32 in trap (frame=
      {tf_fs = 24, tf_es = 16, tf_ds = 16, tf_edi = 0, tf_esi = 0, tf_ebp = -751244300, tf_isp = -751244376, tf_ebx = -1035004416, tf_edx = 1, tf_ecx = 7377, tf_eax= -1035004416, tf_trapno = 12, tf_err = 0, tf_eip = -1068880034, tf_cs = 8, tf_eflags = 66194, tf_esp = -1035004160, tf_ss = -1038039168})
    at /usr/src/sys/i386/i386/trap.c:417
#9  0xc06da77a in calltrap () at /usr/src/sys/i386/i386/exception.s:140
#10 0x00000018 in ?? ()
#11 0x00000010 in ?? ()
#12 0x00000010 in ?? ()
#13 0x00000000 in ?? ()
#14 0x00000000 in ?? ()
#15 0xd338ebf4 in ?? ()
#16 0xd338eba8 in ?? ()
#17 0xc24f1600 in ?? ()
#18 0x00000001 in ?? ()
#19 0x00001cd1 in ?? ()
#20 0xc24f1600 in ?? ()
#21 0x0000000c in ?? ()
#22 0x00000000 in ?? ()
#23 0xc04a2f5e in ohci_device_bulk_start (xfer=0xc24f1600) at /usr/src/sys/dev/usb/ohci.c:2925
#24 0xc04bbd69 in usbd_start_next (pipe=0xc2145300) at /usr/src/sys/dev/usb/usbdi.c:915
#25 0xc04bbc9a in usb_transfer_complete (xfer=0xc2089500) at /usr/src/sys/dev/usb/usbdi.c:856
#26 0xc04a0bd9 in ohci_softintr (v=0xc1ded000) at /usr/src/sys/dev/usb/ohci.c:1469
#27 0xc04b7a99 in usb_schedsoftintr (bus=0xc1ded000) at /usr/src/sys/dev/usb/usb.c:859
#28 0xc04a0671 in ohci_intr1 (sc=0xc1ded000) at /usr/src/sys/dev/usb/ohci.c:1236
#29 0xc04a0496 in ohci_intr (p=0xc1ded000) at /usr/src/sys/dev/usb/ohci.c:1165
#30 0xc04ff5d0 in ithread_loop (arg=0xc1cec300) at /usr/src/sys/kern/kern_intr.c:547
#31 0xc04fe3af in fork_exit (callout=0xc04ff430 <ithread_loop>, arg=0x0, frame=0x0) at /usr/src/sys/kern/kern_fork.c:807
#32 0xc06da7dc in fork_trampoline () at /usr/src/sys/i386/i386/exception.s:209
(kgdb) frame 23
#23 0xc04a2f5e in ohci_device_bulk_start (xfer=0xc24f1600) at /usr/src/sys/dev/usb/ohci.c:2925
2925            struct ohci_pipe *opipe = (struct ohci_pipe *)xfer->pipe;
(kgdb) print opipe
$1 = (struct ohci_pipe(kgdb) frame 24
#24 0xc04bbd69 in usbd_start_next (pipe=0xc2145300) at /usr/src/sys/dev/usb/usbdi.c:915
915                     err = pipe->methods->start(xfer);
(kgdb) print pipe
$2 = 0xc2145300
(kgdb) print pipe->methods
$3 = (struct usbd_pipe_methods *) 0xc075623c
(kgdb) print xfer
$4 = 0xc24f1600
==============

>How-To-Repeat:
Plugin a panram "yoyo" usb mp3 player into an ohci controller.
>Fix:
      
>Release-Note:
>Audit-Trail:
>Unformatted: