kernel panic trying to utilize a da(4)/umass(4) device with ohci(4)

[Doug White]

The OHCI driver is largely synced with NetBSD so you might see if they
have the same bug.

This might be the underlying wierdness we were seeing in gtetlow's
microdrive with transfers over 8k.  The one-page-crossing ohci limitation
is really annoying.

On Thu, 20 Nov 2003, Brian F. Feldman wrote:

> Thanks for the patches to try!  They unfortunately didn't fix the crash I
> have, but I found out why it's occurring.
>
> See ohci.c:1389:
>                 if (std->td.td_cbp != 0)
>                         len -= le32toh(std->td.td_be) -
>                                le32toh(std->td.td_cbp) + 1;
>
> In one of my transfers (look in my log for the 2560 byte one) that statement
> actually adds 8192 to len, which is utterly bogus because you can see it
> only allocates 2560 -- hence when it tries to finish the transfer it
> memcpy()'s way too much memory and my kernel segfaults.  If I #if 0 this out,
> I'm left only with "umass0: BBB reset failed, STALLED" messages... which is
> a lot better than before!  I don't know under what situations that bit of
> code makes sense, but it definitely needs more reviewing!

Stalls usually come from the device receiving bad data.  Rather than
return errors, usb generally just hangs the endpoint.

-- 
Doug White                    |  FreeBSD: The Power to Serve
dwhite at gumbysoft.com          |  www.FreeBSD.org