>Number:         36806
>Category:       kern
>Synopsis:       uvisor inaccessible, diagnostic kernel crashes
>Confidential:   no
>Severity:       critical
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Mon Aug 20 05:30:00 +0000 2007
>Originator:     =09
>Release:        NetBSD 4.99.29 as of midnight (MSD) 20. Aug. 2007
>Organization:
>Environment:
System: NetBSD asau.local 4.99.29 NetBSD 4.99.29 (KERN) #5: Mon Aug 20 08:4=
7:23 MSD 2007 bsd@asau.local:/usr/obj/sys/arch/i386/compile/KERN i386
Architecture: i386
Machine: i386
>Description:
	pilot-xfer (comms/pilot-link) does not backup Palm device.

	With kernel built for USB diagnostic, the following is logged
	when accessing Palm:

		ehci0: handing over full speed device on port 8 to uhci3
		uhub4: port 8, device disappeared after reset

	"pilot-xfer -b" finishes normally, except for incomplete result.
	Relevant kernel options:

		uvisor*	at uhub? port ?
		ucom*	at uvisor?
		options	UVISOR_DEBUG
		options USB_DEBUG
		options UCOM_DEBUG

	Kernel built with options:

		options 	DIAGNOSTIC
		options 	DEBUG

	after running pilot-xfer crashes:

	#0  0xc033905f in cpu_reboot (howto=3D0, bootstr=3D0x0)
	    at /usr/src/sys/arch/i386/i386/machdep.c:853
	#1  0xc017e0e0 in db_sync_cmd (addr=3D0, have_addr=3Dfalse, count=3D-10686=
32667,=20
	    modif=3D0xcbb2e0c8 "=D0=B3=CC=80M=E2=94=94=D0=B4=CC=80M=E2=94=94c") at=
 /usr/src/sys/ddb/db_command.c:839
	#2  0xc017e5e6 in db_command (last_cmdp=3D0xc04ce6bc, cmd_table=3D0x0)
	    at /usr/src/sys/ddb/db_command.c:512
	#3  0xc017e9d5 in db_command_loop () at /usr/src/sys/ddb/db_command.c:300
	#4  0xc01817e2 in db_trap (type=3D1, code=3D0) at /usr/src/sys/ddb/db_trap=
.c:101
	#5  0xc0335054 in kdb_trap (type=3D1, code=3D0, regs=3D0xcbb2e2f0)
	    at /usr/src/sys/arch/i386/i386/db_interface.c:226
	#6  0xc0344175 in trap (frame=3D0xcbb2e2f0)
	    at /usr/src/sys/arch/i386/i386/trap.c:316
	#7  0xc010d56e in calltrap ()
	#8  0xc0334c14 in cpu_Debugger () at ./machine/cpufunc.h:332
	#9  0xc02ad435 in panic (fmt=3D0xc04b0418 "TLB IPI rendezvous failed (mask=
 %x)")
	    at /usr/src/sys/kern/subr_prf.c:240
	#10 0xc033e799 in pmap_tlb_shootnow (cpumask=3D3)
	    at /usr/src/sys/arch/i386/i386/pmap.c:3469
	#11 0xc034296e in pmap_clear_attrs (pg=3D0xc0cd2e80, clearbits=3D2)
	    at /usr/src/sys/arch/i386/i386/pmap.c:2883
	#12 0xc02f224b in genfs_do_putpages (vp=3D0xcbcd9374, startoff=3D0,=20
	    endoff=3D9223372036854771712, flags=3D17, busypg=3D0x0) at ./machine/p=
map.h:427
	#13 0xc02f228d in genfs_putpages (v=3D0xcbb2e594)
	    at /usr/src/sys/miscfs/genfs/genfs_vnops.c:1052
	#14 0xc02eeb90 in VOP_PUTPAGES (vp=3D0xcbcd9374, offlo=3D1, offhi=3D1, fla=
gs=3D17)
	    at /usr/src/sys/kern/vnode_if.c:1742
	#15 0xc01f4089 in ffs_fsync (v=3D0xcbb2e67c)
	    at /usr/src/sys/ufs/ffs/ffs_vnops.c:371
	#16 0xc02ee6b9 in VOP_FSYNC (vp=3D0xcbcd9374, cred=3D0xcbbd0704, flags=3D0=
,=20
	    offlo=3D0, offhi=3D0, l=3D0xcbb061c0) at /usr/src/sys/kern/vnode_if.c:=
792
	#17 0xc01f3059 in ffs_sync (mp=3D0xc116e000, waitfor=3D2, cred=3D0xcbbd070=
4,=20
	    l=3D0xcbb061c0) at /usr/src/sys/ufs/ffs/ffs_vfsops.c:1359
	#18 0xc02e8e61 in sys_sync (l=3D0xcbb061c0, v=3D0x0, retval=3D0x0)
	    at /usr/src/sys/kern/vfs_syscalls.c:744
	#19 0xc02e0446 in vfs_shutdown () at /usr/src/sys/kern/vfs_subr.c:1618
	#20 0xc03390ed in cpu_reboot (howto=3D256, bootstr=3D0x0)
	    at /usr/src/sys/arch/i386/i386/machdep.c:839
	#21 0xc017e0e0 in db_sync_cmd (addr=3D0, have_addr=3Dfalse, count=3D-10686=
32667,=20
	    modif=3D0xcbb2e7b4 "=D0=B3=CC=80M=E2=94=94=D0=B4=CC=80M=E2=94=94c") at=
 /usr/src/sys/ddb/db_command.c:839
	#22 0xc017e5e6 in db_command (last_cmdp=3D0xc04ce6bc, cmd_table=3D0xc04047=
80)
	    at /usr/src/sys/ddb/db_command.c:512
	#23 0xc017e9d5 in db_command_loop () at /usr/src/sys/ddb/db_command.c:300
	#24 0xc01817e2 in db_trap (type=3D1, code=3D0) at /usr/src/sys/ddb/db_trap=
.c:101
	#25 0xc0335054 in kdb_trap (type=3D1, code=3D0, regs=3D0xcbb2e9dc)
	    at /usr/src/sys/arch/i386/i386/db_interface.c:226
	#26 0xc0344175 in trap (frame=3D0xcbb2e9dc)
	    at /usr/src/sys/arch/i386/i386/trap.c:316
	#27 0xc010d56e in calltrap ()
	#28 0xc0334c14 in cpu_Debugger () at ./machine/cpufunc.h:332
	#29 0xc02ad435 in panic (
	    fmt=3D0xc04c89c8 "kernel %sassertion \"%s\" failed: file \"%s\", line =
%d")
	    at /usr/src/sys/kern/subr_prf.c:240
	#30 0xc03f1209 in __assert (t=3D0xc0465be7 "diagnostic ",=20
	    f=3D0xc04aaa44 "/usr/src/sys/kern/sys_generic.c", l=3D1209,=20
	    e=3D0xc0472aa7 "sip->sel_lwp =3D=3D l")
	    at /usr/src/sys/lib/libkern/__assert.c:50
	#31 0xc02b4371 in selclear () at /usr/src/sys/kern/sys_generic.c:1209
	#32 0xc02b4d1d in selcommon (l=3D0xcbb061c0, retval=3D0xcbb2ec68, nd=3D4,=
=20
	    u_in=3D0xbfbfe244, u_ou=3D0x0, u_ex=3D0x0, tv=3D0xcbb2ec0c, mask=3D0x0)
	    at /usr/src/sys/kern/sys_generic.c:881
	#33 0xc02b4f19 in sys_select (l=3D0xcbb061c0, v=3D0xcbb2ec48, retval=3D0xc=
bb2ec68)
	    at /usr/src/sys/kern/sys_generic.c:802
	#34 0xc0343c7a in syscall_plain (frame=3D0xcbb2ec88)
	    at /usr/src/sys/arch/i386/i386/syscall.c:145
	#35 0xc010058c in syscall1 ()
>How-To-Repeat:
	Build kernel with uvisor support, build comms/pilot-link
	from pkgsrc, run "pilot-xfer -b /tmp/some-dir"
>Fix: