usb/89889: [QUIRK] Motorola E398 Mobile Phone (TransFlash drive)
Wojciech A. Koszek
dunstan at freebsd.czest.pl
Sat Dec 3 18:40:03 GMT 2005
>Number: 89889
>Category: usb
>Synopsis: [QUIRK] Motorola E398 Mobile Phone (TransFlash drive)
>Confidential: no
>Severity: non-critical
>Priority: low
>Responsible: freebsd-usb
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: sw-bug
>Submitter-Id: current-users
>Arrival-Date: Sat Dec 03 18:40:02 GMT 2005
>Closed-Date:
>Last-Modified:
>Originator: Wojciech A. Koszek
>Release: FreeBSD 7.0-CURRENT i386
>Organization:
>Environment:
System: FreeBSD laptop.freebsd.czest.pl 7.0-CURRENT FreeBSD 7.0-CURRENT #1: Sat Dec 3 00:02:49 CET 2005 dunstan at laptop.freebsd.czest.pl:/usr/obj/usr/src/sys/LAPTOP i386
Copyright (c) 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994
The Regents of the University of California. All rights reserved.
FreeBSD 7.0-CURRENT #1: Sat Dec 3 00:02:49 CET 2005
dunstan at laptop.freebsd.czest.pl:/usr/obj/usr/src/sys/LAPTOP
WARNING: WITNESS option enabled, expect reduced performance.
WARNING: DIAGNOSTIC option enabled, expect reduced performance.
WARNING: debug.mpsafenet forced to 0 as ipsec requires Giant
WARNING: MPSAFE network stack disabled, expect reduced performance.
acpi_alloc_wakeup_handler: can't alloc wake memory
ACPI APIC Table: <A M I OEMAPIC >
Timecounter "i8254" frequency 1193182 Hz quality 0
CPU: Mobile AMD Sempron(tm) Processor 3000+ (1795.38-MHz 686-class CPU)
Origin = "AuthenticAMD" Id = 0x10fc0 Stepping = 0
Features=0x78bfbff<FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CLFLUSH,MMX,FXSR,SSE,SSE2>
AMD Features=0xc2500800<SYSCALL,NX,MMX+,FFXSR,3DNow+,3DNow>
real memory = 536084480 (511 MB)
avail memory = 513728512 (489 MB)
ioapic0 <Version 1.1> irqs 0-23 on motherboard
acpi0: <A M I OEMRSDT> on motherboard
acpi0: Power Button (fixed)
acpi_ec0: <Embedded Controller: GPE 0x25> port 0x62,0x66 on acpi0
Timecounter "ACPI-fast" frequency 3579545 Hz quality 1000
acpi_timer0: <24-bit timer at 3.579545MHz> port 0x4008-0x400b on acpi0
cpu0: <ACPI CPU> on acpi0
acpi_perf0: invalid _PSS package
[..cut to save space ]
acpi_perf0: invalid _PSS package
powernow0: <PowerNow! K8> on cpu0
pcib0: <ACPI Host-PCI bridge> port 0xcf8-0xcff on acpi0
pci0: <ACPI PCI bus> on pcib0
agp0: <NVIDIA nForce3 AGP Controller> mem 0xf0000000-0xf7ffffff at device 0.0 on pci0
isab0: <PCI-ISA bridge> at device 1.0 on pci0
isa0: <ISA bus> on isab0
pci0: <serial bus, SMBus> at device 1.1 (no driver attached)
ohci0: <nVidia nForce3 USB Controller> mem 0xfebfb000-0xfebfbfff irq 20 at device 2.0 on pci0
ohci0: [GIANT-LOCKED]
usb0: OHCI version 1.0, legacy support
usb0: <nVidia nForce3 USB Controller> on ohci0
usb0: USB revision 1.0
usbd_get_string: getting lang failed, using 0
uhub0: nVidia OHCI root hub, class 9/0, rev 1.00/1.00, addr 1
uhub0: 3 ports with 3 removable, self powered
ohci1: <nVidia nForce3 USB Controller> mem 0xfebfc000-0xfebfcfff irq 20 at device 2.1 on pci0
ohci1: [GIANT-LOCKED]
usb1: OHCI version 1.0, legacy support
usb1: <nVidia nForce3 USB Controller> on ohci1
usb1: USB revision 1.0
usbd_get_string: getting lang failed, using 0
uhub1: nVidia OHCI root hub, class 9/0, rev 1.00/1.00, addr 1
uhub1: 3 ports with 3 removable, self powered
ehci0: <NVIDIA nForce3 USB 2.0 controller> mem 0xfebfdc00-0xfebfdcff irq 20 at device 2.2 on pci0
ehci0: [GIANT-LOCKED]
usb2: EHCI version 1.0
usb2: companion controllers, 4 ports each: usb0 usb1
usb2: <NVIDIA nForce3 USB 2.0 controller> on ehci0
usb2: USB revision 2.0
uhub2: nVidia EHCI root hub, class 9/0, rev 2.00/1.00, addr 1
uhub2: 6 ports with 6 removable, self powered
usb_new_device: set address 2 failed - trying a port reset
usb_new_device: set address 2 failed - trying a port reset
usb_new_device: set address 2 failed - trying a port reset
usb_new_device: set address 2 failed
uhub_explore: usb_new_device failed, error=SET_ADDR_FAILED
uhub2: device problem (SET_ADDR_FAILED), disabling port 5
pcm0: <nVidia nForce3> port 0xe400-0xe4ff,0xe080-0xe0ff mem 0xfebfe000-0xfebfefff irq 21 at device 6.0 on pci0
pcm0: <Avance Logic ALC650 AC97 Codec>
pci0: <simple comms, generic modem> at device 6.1 (no driver attached)
atapci0: <nVidia nForce3 UDMA133 controller> port 0x1f0-0x1f7,0x3f6,0x170-0x177,0x376,0xffa0-0xffaf at device 8.0 on pci0
ata0: <ATA channel 0> on atapci0
ata1: <ATA channel 1> on atapci0
pcib1: <ACPI PCI-PCI bridge> at device 10.0 on pci0
pci2: <ACPI PCI bus> on pcib1
skc0: <Marvell Gigabit Ethernet> port 0xd800-0xd8ff mem 0xfeaf8000-0xfeafbfff irq 19 at device 0.0 on pci2
skc0: Marvell Yukon Lite Gigabit Ethernet rev. (0x9)
sk0: <Marvell Semiconductor, Inc. Yukon> on skc0
sk0: Ethernet address: 00:11:d8:a8:10:ab
miibus0: <MII bus> on sk0
e1000phy0: <Marvell 88E1000 Gigabit PHY> on miibus0
e1000phy0: 10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, 1000baseTX-FDX, auto
skc0: [GIANT-LOCKED]
cbb0: <RF5C476 PCI-CardBus Bridge> mem 0xfd200000-0xfd200fff at device 1.0 on pci2
cardbus0: <CardBus bus> on cbb0
pccard0: <16-bit PCCard bus> on cbb0
pci2: <serial bus, FireWire> at device 1.1 (no driver attached)
pci2: <base peripheral> at device 1.2 (no driver attached)
pci2: <base peripheral> at device 1.3 (no driver attached)
pcib2: <ACPI PCI-PCI bridge> at device 11.0 on pci0
pci1: <ACPI PCI bus> on pcib2
drm0: <ATI Radeon RV280 Mobility> port 0xb000-0xb0ff mem 0xe0000000-0xe7ffffff,0xfb9f0000-0xfb9fffff irq 17 at device 0.0 on pci1
info: [drm] AGP at 0xf0000000 128MB
info: [drm] Initialized radeon 1.16.0 20050311 on minor 0
acpi_button0: <Sleep Button> on acpi0
acpi_lid0: <Control Method Lid Switch> on acpi0
acpi_button1: <Power Button> on acpi0
acpi_tz0: <Thermal Zone> on acpi0
acpi_acad0: <AC Adapter> on acpi0
battery0: <ACPI Control Method Battery> on acpi0
ppc0: <ECP parallel printer port> port 0x378-0x37f irq 7 drq 0 on acpi0
ppc0: SMC-like chipset (ECP/EPP/PS2/NIBBLE) in COMPATIBLE mode
ppc0: FIFO with 16/16/15 bytes threshold
ppbus0: <Parallel port bus> on ppc0
atkbdc0: <Keyboard controller (i8042)> port 0x60,0x64 irq 1 on acpi0
atkbd0: <AT Keyboard> irq 1 on atkbdc0
kbd0 at atkbd0
atkbd0: [GIANT-LOCKED]
psm0: <PS/2 Mouse> irq 12 on atkbdc0
psm0: [GIANT-LOCKED]
psm0: model IntelliMouse, device ID 3
npx0: [FAST]
npx0: <math processor> on motherboard
npx0: INT 16 interface
pmtimer0 on isa0
orm0: <ISA Option ROM> at iomem 0xc0000-0xcffff pnpid ORM0000 on isa0
sc0: <System console> at flags 0x100 on isa0
sc0: VGA <16 virtual consoles, flags=0x300>
vga0: <Generic ISA VGA> at port 0x3c0-0x3df iomem 0xa0000-0xbffff on isa0
Timecounter "TSC" frequency 1795378699 Hz quality 800
Timecounters tick every 1.000 msec
IPsec: Initialized Security Association Processing.
ad0: 38154MB <HTS424040M9AT00 MA2OA71A> at ata0-master UDMA100
battery0: critically low charge!
cpu0: Cx states changed
Expensive timeout(9) function: 0xc04cd0c8(0xc354dd00) 0.002382425 s
Expensive timeout(9) function: 0xc04602d8(0xc3650a28) 0.110111201 s
acd0: CDRW <UJDA760 DVD/CDRW/1.00> at ata1-master UDMA33
Trying to mount root from ufs:/dev/ad0s1a
cpu0: Cx states changed
sk0: link state changed to UP
>Description:
Motorola E398 Mobile Phone comes with TransFlash drive (64MB in default
configuration). It's possible to connect to the phone via USB cable. Without
patching, this is what I get:
dmesg(8) output:
[..]
usb2: handing over full speed device on port 2 to usb0
uhub2: port 2, device disappeared after reset
umass0: Motorola Inc. Motorola Phone (E398), rev 1.10/0.01, addr 2
umass0: SCSI over Bulk-Only; quirks = 0x0000
umass0: Get Max Lun not supported (IOERROR)
umass0:0:0:-1: Attached to scbus0
[..]
usbdevs(8) -v output:
Controller /dev/usb0:
addr 1: full speed, self powered, config 1, OHCI root hub(0x0000), nVidia(0x0000), rev 1.00
port 1 powered
port 2 addr 2: full speed, self powered, config 1, Motorola Phone (E398)(0x4810), Motorola Inc.(0x22b8), rev 0.01
port 3 powered
Controller /dev/usb1:
addr 1: full speed, self powered, config 1, OHCI root hub(0x0000), nVidia(0x0000), rev 1.00
port 1 powered
port 2 powered
port 3 powered
Controller /dev/usb2:
addr 1: high speed, self powered, config 1, EHCI root hub(0x0000), nVidia(0x0000), rev 1.00
port 1 powered
port 2 powered
port 3 powered
port 4 powered
port 5 powered
port 6 powered
After detaching the phone, I get following panic:
umass0: at uhub0 port 2 (addr 2) disconnected
panic: vm_fault: fault on nofault entry, addr: deadc000
KDB: stack backtrace:
kdb_backtrace(100,c3420d00,0,c3423d20,2) at 0xc04c6cfd = kdb_backtrace+0x29
panic(c0647dfe,deadc000,c350d49c,0,c36b8c00) at 0xc04ac0b4 = panic+0xa8
vm_fault(c1043000,deadc000,2,0,c3420d00) at 0xc05b7734 = vm_fault+0x1e0
trap_pfault(d4433c78,0,deadc116) at 0xc05ffb73 = trap_pfault+0x117
trap(8,28,28,c36b8400,c350d400) at 0xc05ff801 = trap+0x3ed
calltrap() at 0xc05ef15a = calltrap+0x5
--- trap 0xc, eip = 0xc04391b7, esp = 0xd4433cb8, ebp = 0xd4433cd0 ---
camisr(c0683358) at 0xc04391b7 = camisr+0x12b
ithread_execute_handlers(c3423d20,c34d7280) at 0xc0496493 = ithread_execute_handlers+0x11f
ithread_loop(c3487420,d4433d38,c3487420,c0496560,0) at 0xc04965fa = ithread_loop+0x9a
fork_exit(c0496560,c3487420,d4433d38) at 0xc0495588 = fork_exit+0xd4
fork_trampoline() at 0xc05ef1bc = fork_trampoline+0x8
--- trap 0x1, eip = 0, esp = 0xd4433d6c, ebp = 0 ---
Uptime: 1m33s
Dumping 510 MB (2 chunks)
chunk 0: 1MB (159 pages) ... ok
chunk 1: 511MB (130624 pages) 495 479 463 447 431 415 399 383 367 351 335 319 303 287 271 255 239 223 207 191 175 159 143 127 111 95 79 63 47 31 15
#0 doadump () at pcpu.h:165
165 pcpu.h: No such file or directory.
in pcpu.h
After patching umass(4), this is what I get on 'camcontrol devlist' output:
# camcontrol devlist
<Motorola Motorola Phone 2.31> at scbus0 target 0 lun 0 (da0,pass0)
I may also safely plug in and out phone's cable:
[..]
umass0: Motorola Inc. Motorola Phone (E398), rev 1.10/0.01, addr 2
umass0: Get Max Lun not supported (IOERROR)
da0 at umass-sim0 bus 0 target 0 lun 0
da0: <Motorola Motorola Phone 2.31> Removable Direct Access SCSI-2 device
da0: 1.000MB/s transfers
da0: 59MB (121857 512 byte sectors: 64H 32S/T 59C)
(da0:umass-sim0:0:0:0): lost device
(da0:umass-sim0:0:0:0): removing device entry
umass0: detached
[..]
At this stage it's possible to mount filesystem. Because E398 doesn't like
synchronizing, after any filesystem activity, ('find /mountpoint') umount(8)
will hang (and later causing system to reboot). This is why quirk da(4) is
needed. This is what I get after patching da(4) and umass(4) [final version of
the patch attached]:
dmesg(8) output:
[..]
umass0: Motorola Inc. Motorola Phone (E398), rev 1.10/0.01, addr 2
umass0: Get Max Lun not supported (IOERROR)
da0 at umass-sim0 bus 0 target 0 lun 0
da0: <Motorola Motorola Phone 2.31> Removable Direct Access SCSI-2 device
da0: 1.000MB/s transfers
da0: 59MB (121857 512 byte sectors: 64H 32S/T 59C)
[..]
usbdevs(8) -v output:
Controller /dev/usb0:
addr 1: full speed, self powered, config 1, OHCI root hub(0x0000), nVidia(0x0000), rev 1.00
port 1 powered
port 2 addr 2: full speed, self powered, config 1, Motorola Phone (E398)(0x4810), Motorola Inc.(0x22b8), rev 0.01
port 3 powered
Controller /dev/usb1:
addr 1: full speed, self powered, config 1, OHCI root hub(0x0000), nVidia(0x0000), rev 1.00
port 1 powered
port 2 powered
port 3 powered
Controller /dev/usb2:
addr 1: high speed, self powered, config 1, EHCI root hub(0x0000), nVidia(0x0000), rev 1.00
port 1 powered
port 2 powered
port 3 powered
port 4 powered
port 5 powered
port 6 powered
root at laptop:(/home/dunstan/projects/FreeBSD/patches/motorola_e398)# camcontrol inquiry da0
pass0: <Motorola Motorola Phone 2.31> Removable Direct Access SCSI-2 device
pass0: 1.000MB/s transfers
>How-To-Repeat:
FreeBSD-CURRENT (and earlier versions) are not able to handle connecting E398
via USB cable, so all you need to get a panic is to plug the cable in and out
(when umass(4) is loaded or compiled in).
>Fix:
http://freebsd.czest.pl/dunstan/FreeBSD/diff.0.e398
--- diff.0.e398 begins here ---
(c) 2005 <Wojciech A. Koszek dunstan^freebsd.czest.pl>
Patch against FreeBSD 7.0-CURRENT, kern.osreldate: 700007.
diff -upr /usr/src/sys/cam/scsi/scsi_da.c src/sys/cam/scsi/scsi_da.c
--- /usr/src/sys/cam/scsi/scsi_da.c Fri Nov 18 03:43:49 2005
+++ src/sys/cam/scsi/scsi_da.c Sat Dec 3 17:49:24 2005
@@ -354,6 +354,16 @@ static struct da_quirk_entry da_quirk_ta
{T_DIRECT, SIP_MEDIA_REMOVABLE, "Kingston" , "DataTraveler II+", "*"},
/*quirks*/ DA_Q_NO_SYNC_CACHE
},
+ {
+ /*
+ * Motorola E398 Mobile Phone (TransFlash Drive).
+ * Reported by: Wojciech A. Koszek <dunstan at FreeBSD.czest.pl>
+ * PR:
+ */
+ {T_DIRECT, SIP_MEDIA_REMOVABLE, "Motorola" , "Motorola Phone",
+ "*"},
+ /*quirks*/ DA_Q_NO_SYNC_CACHE
+ },
};
static disk_strategy_t dastrategy;
diff -upr /usr/src/sys/dev/usb/umass.c src/sys/dev/usb/umass.c
--- /usr/src/sys/dev/usb/umass.c Mon Nov 28 08:37:48 2005
+++ src/sys/dev/usb/umass.c Sat Dec 3 18:14:25 2005
@@ -381,6 +381,10 @@ Static struct umass_devdescr_t umass_dev
UMASS_PROTO_SCSI | UMASS_PROTO_CBI,
NO_TEST_UNIT_READY | NO_START_STOP
},
+ { USB_VENDOR_MOTOROLA2, USB_PRODUCT_MOTOROLA2_E398, RID_WILDCARD,
+ UMASS_PROTO_SCSI | UMASS_PROTO_BBB,
+ FORCE_SHORT_INQUIRY | NO_INQUIRY_EVPD | NO_GETMAXLUN
+ },
{ USB_VENDOR_MSYSTEMS, USB_PRODUCT_MSYSTEMS_DISKONKEY, RID_WILDCARD,
UMASS_PROTO_SCSI | UMASS_PROTO_BBB,
IGNORE_RESIDUE | NO_GETMAXLUN | RS_NO_CLEAR_UA
diff -upr /usr/src/sys/dev/usb/usbdevs src/sys/dev/usb/usbdevs
--- /usr/src/sys/dev/usb/usbdevs Wed Sep 28 21:41:25 2005
+++ src/sys/dev/usb/usbdevs Sat Dec 3 15:41:50 2005
@@ -1202,6 +1202,7 @@ product MITSUMI BT_DONGLE 0x641f Bluetoo
/* Motorola products */
product MOTOROLA MC141555 0x1555 MC141555 hub controller
product MOTOROLA SB4100 0x4100 SB4100 USB Cable Modem
+product MOTOROLA2 E398 0x4810 E398 Mobile Phone
/* MultiTech products */
product MULTITECH ATLAS 0xf101 MT5634ZBA-USB modem
--- diff.0.e398 ends here ---
>Release-Note:
>Audit-Trail:
>Unformatted:
More information about the freebsd-usb
mailing list