usb/129129: panic with device Meizu MiniPlayer M6 (SL) under usb2

[Hans Petter Selasky]

The following reply was made to PR usb/129129; it has been noted by GNATS.

From: Hans Petter Selasky <hselasky at c2i.net>
To: freebsd-usb at freebsd.org
Cc: Alex <freebsd.alex at spamfoodie.com>,
 freebsd-gnats-submit at freebsd.org,
 Scott Long <scottl at samsco.org>
Subject: Re: usb/129129: panic with device Meizu MiniPlayer M6 (SL) under usb2
Date: Mon, 24 Nov 2008 16:54:47 +0100

 On Monday 24 November 2008, Alex wrote:
 > >Number:         129129
 > >Category:       usb
 > >Synopsis:       panic with device Meizu MiniPlayer M6 (SL) under usb2
 > >Confidential:   no
 > >Severity:       critical
 > >Priority:       high
 > >Responsible:    freebsd-usb
 > >State:          open
 > >Quarter:
 > >Keywords:
 > >Date-Required:
 > >Class:          sw-bug
 > >Submitter-Id:   current-users
 > >Arrival-Date:   Mon Nov 24 12:20:01 UTC 2008
 > >Closed-Date:
 > >Last-Modified:
 > >Originator:     Alex
 > >Release:        8-CURRENT
 > >Organization:
 > >Environment:
 >
 > FreeBSD moshnroll 8.0-CURRENT FreeBSD 8.0-CURRENT #0: Fri Nov 21 18:47:55
 > CET 2008     root at moshnroll:/usr/obj/usr/src/sys/ARUNDEL  i386
 >
 > >Description:
 >
 > when i connect my mp3 player under usb2 the system panics. i attached
 > msgbuf.txt version.txt and ddb.txt which got generated by this ddb script:
 >
 > db.enter.panic="textdump set; capture on; show allpcpu; bt;ps; alltrace;
 > show alllock; call doadump; reset"
 >
 > please tell me if you need a backtrace from a regular core dump. this panic
 > is 100% reproducable.
 >
 > under 7-STABLE this device requires some quirks in order to work, but it
 > won't cause a panic without them. the quirks needed are described in PR
 > usb/127549.
 >
 
 Hi,
 
 I looks like you get a panic because a lock is not locked. This code is not 
 part of the USB(2) stack, and maybe something that Scott Long should look at. 
 He is the one that implemented a Giant free CAM-layer.
 
 Hence the USB(2) mass storage driver is free of Giant, I would expect this 
 kind of error.
 
 --HPS
 
 > umass0: <Meizu   Electronics MiniPlayer, class 0/0, rev 2.00/1.00, addr 2>
 > on usbus3 umass0:  SCSI over Bulk-Only; quirks = 0x0000
 > umass0:11:0:-1: Attached to scbus11
 > (da0:umass-sim0:0:0:0): got CAM status 0x4
 > (da0:umass-sim0:0:0:0): fatal error, failed to attach to device
 > (da0:umass-sim0:0:0:0): lost device
 > (da0:umass-sim0:0:0:0): removing device entry
 > panic: lock (sleep mutex) UMASS lock not locked @
 > /usr/src/sys/cam/cam_periph.h:188 cpuid = 1
 > KDB: stack backtrace:
 > db_trace_self_wrapper(c07d0afa,c52d97a0,c0582eb1,c07fa3b8,1,...) at
 > db_trace_self_wrapper+0x26
 > kdb_backtrace(c07fa3b8,1,c07d3445,c52d97ac,1,...) at kdb_backtrace+0x29
 > panic(c07d3445,c07f25ab,c07ba016,c07a8e81,bc,...) at panic+0x114
 > witness_unlock(c0866d60,8,c07a8e81,bc,c5688400,...) at witness_unlock+0xf0
 > _mtx_unlock_flags(c0866d60,0,c07a8e81,bc,c55275c8,...) at
 > _mtx_unlock_flags+0xb6
 > dacleanup(c645ac80,c07a9010,c09a8fa0,c09df530,c09a8f90,...) at
 > dacleanup+0x72 camperiphfree(c5688400,c52d9b20,c0452c72,c645ac80,0,...) at
 > camperiphfree+0xbd cam_periph_release(c645ac80,0,c07a8e81,bc,c59f1a50,...)
 > at cam_periph_release+0x2a daopen(c63fee00,4,c07c5c98,75,0,...) at
 > daopen+0x40e
 > g_disk_access(c6024b80,1,0,0,0,...) at g_disk_access+0x111
 > g_access(c61a1340,1,0,0,c6024b80,...) at g_access+0x233
 > g_slice_new(c081a880,8,c6024b80,c52d9c10,c52d9c08,...) at g_slice_new+0x13b
 > g_bsd_taste(c081a880,c6024b80,0,20f,c6023280,...) at g_bsd_taste+0xa5
 > g_new_provider_event(c6024b80,0,c07c6197,d2,c5537000,...) at
 > g_new_provider_event+0xbc g_run_events(c0867278,0,4c,c07c4fe9,64,...) at
 > g_run_events+0x353
 > g_event_procbody(0,c52d9d38,c07c9ce2,327,c55357d4,...) at
 > g_event_procbody+0x8a fork_exit(c05376ad,0,c52d9d38) at fork_exit+0xb8
 > fork_trampoline() at fork_trampoline+0x8
 > --- trap 0, eip = 0, esp = 0xc52d9d70, ebp = 0 ---
 > KDB: enter: panic
 > exclusive sx so_rcv_sx (so_rcv_sx) r = 0 (0xc5bd3e4c) locked @
 > /usr/src/sys/kern/uipc_sockbuf.c:148 exclusive sx GEOM topology (GEOM
 > topology) r = 0 (0xc0867248) locked @ /usr/src/sys/geom/geom_event.c:185
 > FreeBSD 8.0-CURRENT #0: Fri Nov 21 18:47:55 CET 2008