Hi,
We are having problems with the usb-serial ipaq driver in 2.6.16 (debian
backports 2.6.16-1-686, but also reproducible with self-compiled
kernel.org kernel)
Sometimes, we get the following on disconnect:
Unable to handle kernel paging request at virtual address 723d4ec3
printing eip:
b01ea93d
*pde = 00000000
Oops: 0000 [#1]
Modules linked in: ppp_async crc_ccitt ppp_generic slhc ipaq usbserial uhci_hcd ohci_hcd usbhid ehci_hcd usbcore 8139too mii sr_mod sbp2 scsi_mod ieee1394 psmouse ide_generic ide_cd cdrom genrtc ext3 jbd mbcache ide_disk generic via82cxxx ide_core evdev mousedev
CPU: 0
EIP: 0060:[<b01ea93d>] Not tainted VLI
EFLAGS: 00010246 (2.6.16-1-686 #2)
EIP is at check_tty_count+0x33/0x7a
eax: 723d4e4f ebx: 00000000 ecx: c97cb000 edx: c97cb170
esi: cbfe55a0 edi: 00000283 ebp: c97cb000 esp: cbe87f18
ds: 007b es: 007b ss: 0068
Process events/0 (pid: 4, threadinfo=cbe86000 task=cbfdfab0)
Stack: <0>c97cb000 b01eb558 c97cb000 b029719d 00000000 00000000 00000000 c97cb13c
cbfe55a0 00000283 c97cb000 b012277d c97cb000 b01eb507 cbe86000 cbe87f84
cbe87fa4 cbfe55a0 b01228a9 cbfe55a0 ffffffff ffffffff 00000001 00000000
Call Trace:
[<b01eb558>] do_tty_hangup+0x51/0x294
[<b012277d>] run_workqueue+0x6e/0xa2
[<b01eb507>] do_tty_hangup+0x0/0x294
[<b01228a9>] worker_thread+0xf8/0x12a
[<b01138c3>] default_wake_function+0x0/0x12
[<b026dabd>] schedule+0x45f/0x4cd
[<b01138c3>] default_wake_function+0x0/0x12
[<b01227b1>] worker_thread+0x0/0x12a
[<b0124ece>] kthread+0x79/0xa3
[<b0124e55>] kthread+0x0/0xa3
[<b01012cd>] kernel_thread_helper+0x5/0xb
Code: 91 70 01 00 00 8b 02 0f 18 00 90 8d 81 70 01 00 00 39 c2 74 13 8b 12 43 8b 02 0f 18 00 90 8d 81 70 01 00 00 39 c2 75 ed 8b 41 04 <81> 78 74 04 00 02 00 75 17 8b 91 cc 00 00 00 85 d2 74 0d 83 ba
I don't know enough about the tty system to find the problem, but it
seems to me that the tty structure might be released too soon.
We have a hotplug script that starts ppp on connect, and we can
reproduce this by repeatedly plugging and unplugging the ipaq.
Frank
--
Frank Gevaerts [email protected]
fks bvba - Formal and Knowledge Systems http://www.fks.be/
Stationsstraat 108 Tel: ++32-(0)11-21 49 11
B-3570 ALKEN Fax: ++32-(0)11-22 04 19
On Mon, May 22, 2006 at 04:30:48PM +0200, Frank Gevaerts wrote:
> Hi,
>
> We are having problems with the usb-serial ipaq driver in 2.6.16 (debian
> backports 2.6.16-1-686, but also reproducible with self-compiled
> kernel.org kernel)
>
> Sometimes, we get the following on disconnect:
<snip>
Can you duplicate this on 2.6.17-rc4? A number of tty changes went into
that release that should have fixed this issue.
thanks,
greg k-h
On Mon, May 22, 2006 at 02:44:03PM -0700, Greg KH wrote:
> On Mon, May 22, 2006 at 04:30:48PM +0200, Frank Gevaerts wrote:
> > Hi,
> >
> > We are having problems with the usb-serial ipaq driver in 2.6.16 (debian
> > backports 2.6.16-1-686, but also reproducible with self-compiled
> > kernel.org kernel)
> >
> > Sometimes, we get the following on disconnect:
>
> <snip>
>
> Can you duplicate this on 2.6.17-rc4? A number of tty changes went into
> that release that should have fixed this issue.
I'll try it in the morning. In the meantime, we found some other
problems in ipaq.c : apparently pocketpc accepts usb enumeration long
before it accepts usb-serial commands (sometimes 50 or more seconds),
which makes ipaq_open fail. When it fails, the read urb is not killed,
while the associated structures are freed, which gives a panic when
the urb completes. The following patch solves that :
Since changing this, I also have not seen the original problem anymore,
but I will do some more testing tomorrow.
Signed-off-by: Frank Gevaerts <[email protected]>
--- linux-2.6.16/drivers/usb/serial/ipaq.c 2006-03-20 06:53:29.000000000 +0100
+++ linux-2.6.16.ipaq/drivers/usb/serial/ipaq.c 2006-05-23 00:00:33.000000000 +0200
@@ -59,7 +59,7 @@
#include "usb-serial.h"
#include "ipaq.h"
-#define KP_RETRIES 100
+#define KP_RETRIES 1000
/*
* Version Information
@@ -652,12 +652,6 @@
usb_rcvbulkpipe(serial->dev, port->bulk_in_endpointAddress),
port->read_urb->transfer_buffer, port->read_urb->transfer_buffer_length,
ipaq_read_bulk_callback, port);
- result = usb_submit_urb(port->read_urb, GFP_KERNEL);
- if (result) {
- err("%s - failed submitting read urb, error %d", __FUNCTION__, result);
- goto error;
- }
-
/*
* Send out control message observed in win98 sniffs. Not sure what
* it does, but from empirical observations, it seems that the device
@@ -671,8 +665,15 @@
usb_sndctrlpipe(serial->dev, 0), 0x22, 0x21,
0x1, 0, NULL, 0, 100);
if (result == 0) {
+ result = usb_submit_urb(port->read_urb, GFP_KERNEL);
+ if (result) {
+ err("%s - failed submitting read urb, error %d", __FUNCTION__, result);
+ goto error;
+ }
+
return 0;
}
+ msleep(100);
}
err("%s - failed doing control urb, error %d", __FUNCTION__, result);
goto error;
>
> thanks,
>
> greg k-h
>
--
Frank Gevaerts [email protected]
fks bvba - Formal and Knowledge Systems http://www.fks.be/
Stationsstraat 108 Tel: ++32-(0)11-21 49 11
B-3570 ALKEN Fax: ++32-(0)11-22 04 19
On Tue, May 23, 2006 at 12:04:59AM +0200, Frank Gevaerts wrote:
> On Mon, May 22, 2006 at 02:44:03PM -0700, Greg KH wrote:
> > On Mon, May 22, 2006 at 04:30:48PM +0200, Frank Gevaerts wrote:
> > > Hi,
> > >
> > > We are having problems with the usb-serial ipaq driver in 2.6.16 (debian
> > > backports 2.6.16-1-686, but also reproducible with self-compiled
> > > kernel.org kernel)
> > >
> > > Sometimes, we get the following on disconnect:
> >
> > <snip>
> >
> > Can you duplicate this on 2.6.17-rc4? A number of tty changes went into
> > that release that should have fixed this issue.
>
> I'll try it in the morning. In the meantime, we found some other
> problems in ipaq.c : apparently pocketpc accepts usb enumeration long
> before it accepts usb-serial commands (sometimes 50 or more seconds),
> which makes ipaq_open fail. When it fails, the read urb is not killed,
> while the associated structures are freed, which gives a panic when
> the urb completes. The following patch solves that :
> Since changing this, I also have not seen the original problem anymore,
> but I will do some more testing tomorrow.
I cannot reproduce the original problem anymore with my patch applied
Frank
>
> Signed-off-by: Frank Gevaerts <[email protected]>
>
> --- linux-2.6.16/drivers/usb/serial/ipaq.c 2006-03-20 06:53:29.000000000 +0100
> +++ linux-2.6.16.ipaq/drivers/usb/serial/ipaq.c 2006-05-23 00:00:33.000000000 +0200
> @@ -59,7 +59,7 @@
> #include "usb-serial.h"
> #include "ipaq.h"
>
> -#define KP_RETRIES 100
> +#define KP_RETRIES 1000
>
> /*
> * Version Information
> @@ -652,12 +652,6 @@
> usb_rcvbulkpipe(serial->dev, port->bulk_in_endpointAddress),
> port->read_urb->transfer_buffer, port->read_urb->transfer_buffer_length,
> ipaq_read_bulk_callback, port);
> - result = usb_submit_urb(port->read_urb, GFP_KERNEL);
> - if (result) {
> - err("%s - failed submitting read urb, error %d", __FUNCTION__, result);
> - goto error;
> - }
> -
> /*
> * Send out control message observed in win98 sniffs. Not sure what
> * it does, but from empirical observations, it seems that the device
> @@ -671,8 +665,15 @@
> usb_sndctrlpipe(serial->dev, 0), 0x22, 0x21,
> 0x1, 0, NULL, 0, 100);
> if (result == 0) {
> + result = usb_submit_urb(port->read_urb, GFP_KERNEL);
> + if (result) {
> + err("%s - failed submitting read urb, error %d", __FUNCTION__, result);
> + goto error;
> + }
> +
> return 0;
> }
> + msleep(100);
> }
> err("%s - failed doing control urb, error %d", __FUNCTION__, result);
> goto error;
>
> >
> > thanks,
> >
> > greg k-h
> >
>
> --
> Frank Gevaerts [email protected]
> fks bvba - Formal and Knowledge Systems http://www.fks.be/
> Stationsstraat 108 Tel: ++32-(0)11-21 49 11
> B-3570 ALKEN Fax: ++32-(0)11-22 04 19
--
Frank Gevaerts [email protected]
fks bvba - Formal and Knowledge Systems http://www.fks.be/
Stationsstraat 108 Tel: ++32-(0)11-21 49 11
B-3570 ALKEN Fax: ++32-(0)11-22 04 19