kern/67301: uftdi, RTS and system panic

[Mike Durian]

>Number:         67301
>Category:       kern
>Synopsis:       uftdi, RTS and system panic
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Fri May 28 10:00:46 PDT 2004
>Closed-Date:
>Last-Modified:
>Originator:     Mike Durian
>Release:        FreeBSD 5.2-CURRENT i386
>Organization:
>Environment:
System: FreeBSD man.boogie.com 5.2-CURRENT FreeBSD 5.2-CURRENT #6: Thu May 27 16:56:56 MDT 2004 root at man.boogie.com:/disk2/obj/disk2/src/sys/BOOGIE i386


	
>Description:
	I've got two parts to this PR.  First, a patch to add support
	for Intrepid Control Systems' ValueCAN CAN bus interface.
	It uses a FTDI interface and will look like a ucom device
	when the attached USB product/vendor patch is applied.

	The second part is a bug that results in a system panic.
	When I try to execute the following user code to clear RTS
	in the ValueCAN device, I get a panic.  Here is the code
	snippet.

        /* XXX This panics the system */
        com_state &= ~TIOCM_RTS;
        if (ioctl(fd, TIOCMSET, &com_state) == -1) {
                fprintf(stderr, "ioctl failed: %s\n", strerror(errno));
                exit(EXIT_FAILURE);
        }

        if (ioctl(fd, TIOCMGET, &com_state) == -1) {
                fprintf(stderr, "ioctl failed: %s\n", strerror(errno));
                exit(EXIT_FAILURE);
        }


	I enabled some USB debugging and collected the following data
	after the crash.  I've had to write it down and retype it, so
	there might be some minor typos, especially with white space.

	ucomioctl: cmd = 0x8004746d
	disc_optim: bypass l_rint
	ucomioctl: our cmd = 0x8004746d
	ucomioctl: TIOCMSET, 0x3
	ucomctl: bits = 0x3, how = 0
	ucom_dtr: onoff = 1
	uftdi_set: sc=0xc6216400, port=1 reg=1 onoff=1
	uftdi_set: reqtype=0x40 req=0x01 value=0x0101 index=0x0001 len=0
	ucomreadcb: status = 0
	ucomreadcb: got 2 chars, tp = 0xc61e5200
	uftdi_read: sc=0xc6216400, port=1 count=2
	uftdi_read: status change msr=0xb0(0xf0) lsr=0x60(0x60)
	uftdi_status: msr=0xb0 lsr=0x60
	ucom_status_change: DCD changed to 1
	ucomstartread: start
	ucomctl: bits = 0x2, how = 1
	ucom_dtr: onoff = 1
	uftdi_set: sc=0xc6216400, port=1 reg=1 onoff=1
	uftdi_set: reqtype=0x40 req=0x01 value=0x0101 index=0x0001 len=0
	panic: uhci_abort_xfer: not in process context
	at line 1943 in file /disk2/src/sys/dev/usb/uhci.c
	Debugger("panic")
	stopped at Debugger+0x45:	xchgl %ebx,in_Debugger.0

	Then a trace from the debugger prompt shows:
	Debugger(c06da6d9) at Debugger+0x45
	__panic(c06ce57c,797,c06ce554,c6212000,c6216700) at __panic+0xc7
	uhci_abort_xfer(c67dda00,f) at uhci_abort_xfer+0x8d
	uhci_timeout_task(c67dda00,c61faa50,c0f9bd34,c0526099,0) at uhci_timeout_task+0x28
	usb_task_thread(0,e0f9bd48) at usb_task_thread+0xb9
	fork_exit(c04f0d34,0,e0f9bd48) at fork_exit+0x71
	fork_trampoline() at fork_trampoline+0x8
	--- trap 0x1, eip = 0, esp = 0xe0f9bd7c, ebp = 0 ---


>How-To-Repeat:
	This problem is reproducable 100% of the time.  If I remove the
	code that clears RTS from my program, I do not get the panic.
	This is despite having other code that set RTS and clears/sets DTR.
	It is only clearing RTS that causes the problem.
>Fix:

	No work around, but the following patch does add support to uftdi
	for the ValueCAN device.

	--- usbdevs.orig	Thu May 20 19:36:48 2004
	+++ usbdevs	Thu May 27 14:37:43 2004
	@@ -316,6 +316,7 @@
	 vendor BIOMETRIC	0x0929	American Biometric Company
	 vendor TOSHIBA		0x0930	Toshiba Corporation
	 vendor PLEXTOR		0x093b  Plextor Corp.
	+vendor INTREPIDCS	0x093c	Intrepid Control Systems
	 vendor YANO		0x094f	Yano
	 vendor KINGSTON		0x0951	Kingston Technology
	 vendor BLUEWATER	0x0956	BlueWater Systems
	@@ -793,6 +794,9 @@
	 
	 /* Intersil products */
	 product INTERSIL PRISM_2X	0x3642	Prism2.x or Atmel WLAN
	+
	+/* Interpid Control Systems products */
	+product INTREPIDCS VALUECAN	0x0601	ValueCAN CAN bus interface
	 
	 /* I/O DATA products */
	 product IODATA USBETT		0x0901	USB ETT
	--- uftdi.c.orig	Wed Mar 17 18:02:46 2004
	+++ uftdi.c	Thu May 27 14:38:26 2004
	@@ -164,6 +164,14 @@
		     uaa->product == USB_PRODUCT_FTDI_LK204))
			return (UMATCH_VENDOR_PRODUCT);
	 
	+	/*
	+	 * The Intrepid Control Systems' ValueCAN CAN interface uses
	+	 * the FTDI interface.
	+	 */
	+	if (uaa->vendor == USB_VENDOR_INTREPIDCS &&
	+	    uaa->product == USB_PRODUCT_INTREPIDCS_VALUECAN)
	+		return (UMATCH_VENDOR_PRODUCT);
	+
		return (UMATCH_NONE);
	 }
	 
	@@ -223,6 +231,7 @@
		case USB_PRODUCT_FTDI_MX4_5:
		case USB_PRODUCT_FTDI_LK202:
		case USB_PRODUCT_FTDI_LK204:
	+	case USB_PRODUCT_INTREPIDCS_VALUECAN:
			sc->sc_type = UFTDI_TYPE_8U232AM;
			sc->sc_hdrlen = 0;
			break;

>Release-Note:
>Audit-Trail:
>Unformatted: