kern/69319: aue(4) startup panic

Scott Mitchell scott+freebsd at
Mon Jul 19 16:30:26 PDT 2004

>Number:         69319
>Category:       kern
>Synopsis:       aue(4) startup panic
>Confidential:   no
>Severity:       critical
>Priority:       high
>Responsible:    freebsd-bugs
>State:          open
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Mon Jul 19 23:30:26 GMT 2004
>Originator:     Scott Mitchell
>Release:        FreeBSD 4.10-STABLE i386
System: FreeBSD 4.10-STABLE FreeBSD 4.10-STABLE #0: Sat Jul 17 18:04:57 BST 2004 scott at i386


Just upgraded my little mini-ITX server from 4.9p4 to 4.10p2.  The new kernel
booted single-user fine before I did the installworld, but panics when
bringing up my aue0 interface during multi-user boot.  aue0 is my 'outside'
interface which I didn't need during installworld, otherwise I might have
caught this earlier.  The kernel is GENERIC + ipfilter.

I have since been able to reproduce the same panic on a -STABLE (as of ~1 week
ago) machine, with 2 different aue(4) devices - a Belkin F5D5050 and a LinkSys
USB100TX.  The device and associated PHY appear to attach correctly; the panic
occurs when I run dhclient on the interface.  I have not tried a manual
ifconfig on the interface.

I've attached a DDB stack trace and dmesg.boot from the old 4.9 kernel that
fortunately still works.  Unfortunately I don't seem to be able to get a crash
dump - if I try I just get a few hundred repetitions of:

panic: uhci_abort_xfer: not in process context
Uptime: 18s

then the machine reboots.  This looks like it's happening deep inside the USB
stack, so I guess it's related to the USB mega-MFC before the 4.10 release.
I'm not at all familiar with the guts of our USB so I'm not sure where to
start debugging this... I'd also rather not have to crash my server too many
more times to figure out what's going on here.


Plug in a USB Ethernet device supported by the aue(4) driver, or boot with
such a device connected.

# dhclient aue0


 ----- Attachment 1: ddb.txt -----
 Automatic boot in progress...
 /dev/ad0s1a: clean, 21432 free (376 frags, 2632 blocks, 0.6% fragmentation)
 /dev/ad0s1g: clean, 20431499 free (8363 frags, 2552892 blocks, 0.0% fragmentation)
 /dev/ad0s1f: clean, 307946 free (11362 frags, 37073 blocks, 2.2% fragmentation)
 /dev/ad0s1e: clean, 483015 free (551 frags, 60308 blocks, 0.1% fragmentation)
 Doing initial network setup: hostname ipmon ipfilter ipnat0 entries flushed from NAT table
 0 entries flushed from NAT list
 module_register: module miibus/ukphy already exists!
 linker_file_sysinit "miibus.ko" failed to register! 17
 Fatal trap 12: page fault while in kernel mode
 fault virtual address	= 0x70
 fault code		= supervisor read, page not present
 instruction pointer	= 0x8:0xc0242d20
 stack pointer	        = 0x10:0xc044ff74
 frame pointer	        = 0x10:0xc044ff98
 code segment		= base 0x0, limit 0xfffff, type 0x1b
 			= DPL 0, pres 1, def32 1, gran 1
 processor eflags	= interrupt enabled, resume, IOPL = 0
 current process		= Idle
 interrupt mask		= net tty bio cam 
 kernel: type 12 trap, code=0
 Stopped at      tsleep+0x74:    cmpl    $0,0x70(%ebx)
 db> tr
 tsleep(c20b3f00,10,c0431b18,0) at tsleep+0x74
 usbd_transfer(c20b3f00,c044fff4,c036f10d,c20b3f00,0) at usbd_transfer+0x127
 usbd_sync_transfer(c20b3f00,0,c1df5200,1,c03b784c) at usbd_sync_transfer+0x10
 usbd_do_request_flags_pipe(c1ecc000,c1ed7f80,c045004c,c0450064,0) at usbd_do_request_flags_pipe+0x61
 usbd_do_request_flags(c1ecc000,c045004c,c0450064,0,0) at usbd_do_request_flags+0x20
 usbd_do_request(c1ecc000,c045004c,c0450064,f140,10025) at usbd_do_request+0x1a
 aue_csr_write_1(c1df5200,25,0,1,0) at aue_csr_write_1+0x6c
 aue_miibus_readreg(c1ed7f00,0,1,c04500a4,c01f6117) at aue_miibus_readreg+0x35
 MIIBUS_READREG(c1ed7f00,0,1,c1ed7e80,c1e00720) at MIIBUS_READREG+0x34
 miibus_readreg(c1ed7e80,0,1,c04500d8,c01f68fd) at miibus_readreg+0x1b
 MIIBUS_READREG(c1ed7e80,0,1,c1ecba00,c1ecba40) at MIIBUS_READREG+0x34
 ukphy_service(c1ecba00,c1ecba40,1) at ukphy_service+0x121
 mii_tick(c1ecba40) at mii_tick+0x19
 aue_tick(c1df5200,400000,0,0,ffffffff) at aue_tick+0x26
 softclock(0,10,10,10,ffffffff) at softclock+0xd1
 doreti_swi(7,673,1,803035,0) at doreti_swi+0xf
 idle_loop() at idle_loop+0x1d
 ----- Attachement 2: dmesg.boot -----
 Copyright (c) 1992-2003 The FreeBSD Project.
 Copyright (c) 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994
 	The Regents of the University of California. All rights reserved.
 FreeBSD 4.9-RELEASE-p4 #0: Tue Mar 23 21:27:51 GMT 2004
     scott at
 Timecounter "i8254"  frequency 1193182 Hz
 CPU: VIA C3 Samuel 2 (599.71-MHz 686-class CPU)
   Origin = "CentaurHauls"  Id = 0x673  Stepping = 3
 real memory  = 503316480 (491520K bytes)
 avail memory = 484147200 (472800K bytes)
 Preloaded elf kernel "kernel.old" at 0xc0563000.
 md0: Malloc disk
 Using $PIR table, 5 entries at 0xc00fded0
 apm0: <APM BIOS> on motherboard
 apm0: found APM BIOS v1.2, connected at v1.2
 npx0: <math processor> on motherboard
 npx0: INT 16 interface
 pcib0: <Host to PCI bridge> on motherboard
 pci0: <PCI bus> on pcib0
 agp0: <VIA Generic host to PCI bridge> mem 0xd0000000-0xd7ffffff at device 0.0 on pci0
 pcib1: <PCI to PCI bridge (vendor=1106 device=b091)> at device 1.0 on pci0
 pci1: <PCI bus> on pcib1
 pci1: <VGA-compatible display device> at 0.0 irq 11
 fwohci0: <VIA VT6306> port 0xc000-0xc07f mem 0xde000000-0xde0007ff irq 10 at device 13.0 on pci0
 fwohci0: OHCI version 1.0 (ROM=1)
 fwohci0: No. of Isochronous channel is 4.
 fwohci0: EUI64 00:40:63:00:00:02:95:7e
 fwohci0: Phy 1394a available S400, 2 ports.
 fwohci0: Link S400, max_rec 2048 bytes.
 firewire0: <IEEE1394(FireWire) bus> on fwohci0
 if_fwe0: <Ethernet over FireWire> on firewire0
 if_fwe0: Fake Ethernet address: 02:40:63:02:95:7e
 sbp0: <SBP2/SCSI over firewire> on firewire0
 fwohci0: Initiate bus reset
 fwohci0: BUS reset
 fwohci0: node_id=0xc800ffc0, gen=1, CYCLEMASTER mode
 firewire0: 1 nodes, maxhop <= 0, cable IRM = 0 (me)
 firewire0: bus manager 0 (me)
 uhci0: <VIA 83C572 USB controller> port 0xc400-0xc41f irq 11 at device 16.0 on pci0
 usb0: <VIA 83C572 USB controller> on uhci0
 usb0: USB revision 1.0
 uhub0: VIA UHCI root hub, class 9/0, rev 1.00/1.00, addr 1
 uhub0: 2 ports with 2 removable, self powered
 aue0: LINKSYS Inc. LINKSYS USB Adapter, rev 1.10/1.01, addr 2
 aue0: Ethernet address: 00:04:5a:07:c6:86
 miibus0: <MII bus> on aue0
 ukphy0: <Generic IEEE 802.3u media interface> on miibus0
 ukphy0:  10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, auto
 uhci1: <VIA 83C572 USB controller> port 0xc800-0xc81f irq 10 at device 16.1 on pci0
 usb1: <VIA 83C572 USB controller> on uhci1
 usb1: USB revision 1.0
 uhub1: VIA UHCI root hub, class 9/0, rev 1.00/1.00, addr 1
 uhub1: 2 ports with 2 removable, self powered
 uhci2: <VIA 83C572 USB controller> port 0xcc00-0xcc1f irq 12 at device 16.2 on pci0
 usb2: <VIA 83C572 USB controller> on uhci2
 usb2: USB revision 1.0
 uhub2: VIA UHCI root hub, class 9/0, rev 1.00/1.00, addr 1
 uhub2: 2 ports with 2 removable, self powered
 pci0: <USB controller> at 16.3 irq 5
 isab0: <PCI to ISA bridge (vendor=1106 device=3177)> at device 17.0 on pci0
 isa0: <ISA bus> on isab0
 atapci0: <VIA 8235 ATA133 controller> port 0xd000-0xd00f at device 17.1 on pci0
 ata0: at 0x1f0 irq 14 on atapci0
 ata1: at 0x170 irq 15 on atapci0
 pci0: <unknown card> (vendor=0x1106, dev=0x3059) at 17.5 irq 12
 vr0: <VIA VT6102 Rhine II 10/100BaseTX> port 0xdc00-0xdcff mem 0xde002000-0xde0020ff irq 11 at device 18.0 on pci0
 vr0: Ethernet address: 00:40:63:c5:8d:63
 miibus1: <MII bus> on vr0
 ukphy1: <Generic IEEE 802.3u media interface> on miibus1
 ukphy1:  10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, auto
 wi0: <PRISM2STA WaveLAN> port 0xe400-0xe43f,0xe000-0xe07f mem 0xde003000-0xde003fff irq 10 at device 20.0 on pci0
 wi0: 802.11 address: 00:04:e2:0e:36:b0
 wi0: using RF:PRISM2 MAC:HFA3841 CARD:HWB3163 rev.A
 wi0: Intersil Firmware: Primary 0.03.00, Station 0.08.03
 orm0: <Option ROM> at iomem 0xd0000-0xd9fff on isa0
 pmtimer0 on isa0
 fdc0: ready for input in output
 fdc0: cmd 3 failed at out byte 1 of 3
 atkbdc0: <Keyboard controller (i8042)> at port 0x60,0x64 on isa0
 vga0: <Generic ISA VGA> at port 0x3c0-0x3df iomem 0xa0000-0xbffff on isa0
 sc0: <System console> at flags 0x100 on isa0
 sc0: VGA <16 virtual consoles, flags=0x100>
 sio0 at port 0x3f8-0x3ff irq 4 flags 0x10 on isa0
 sio0: type 16550A, console
 sio1 at port 0x2f8-0x2ff irq 3 on isa0
 sio1: type 16550A
 ppc0: <Parallel port> at port 0x378-0x37f irq 7 on isa0
 ppc0: Generic chipset (EPP/NIBBLE) in COMPATIBLE mode
 ppi0: <Parallel I/O> on ppbus0
 plip0: <PLIP network interface> on ppbus0
 lpt0: <Printer> on ppbus0
 lpt0: Interrupt-driven port
 IP Filter: v3.4.31 initialized.  Default = pass all, Logging = enabled
 ad0: 76319MB <ST380011A> [155061/16/63] at ata0-master UDMA100
 Mounting root from ufs:/dev/ad0s1a
 WARNING: / was not properly dismounted

More information about the freebsd-bugs mailing list