Re: kern/49831: kernel panic on close of ucom tty

[Iain Hibbert <plunky%ogmig.net@localhost>]

The following reply was made to PR kern/49831; it has been noted by GNATS.

From: Iain Hibbert <plunky%ogmig.net@localhost>
To: Nick Hudson <skrll%netbsd.org@localhost>, gnats-bugs%netbsd.org@localhost
Cc: 
Subject: Re: kern/49831: kernel panic on close of ucom tty
Date: Sat, 25 Jun 2016 09:51:07 +0100 (BST)

 On Sat, 25 Jun 2016, Iain Hibbert wrote:
 
 > anyway, I tried this on the T61p running a standard NetBSD amd64 7.99.29 
 > kernel and had a slightly different process but similar result. I plugged 
 > the serial/parallel adapter in and it attached as normal
 
 gah please disregard that. I was using the wrong adapter!
 
 Ok so I tried this again, with the right adapter and the NetBSD amd64 
 7.99.29 kernel that I am already using. Same result as originally
 
 ehci0: handing over full speed device on port 3 to uhci1
 umct0 at uhub2 port 1
 umct0: Targus Group Intl Targus Group Intl, rev 1.10/1.03, addr 2
 ucom0 at umct0
 
 attaches as normal, but with 'cu -l /dev/ttyU0' upon disconnect it fails 
 (at least this laptop doesn't wipe its message buffer on reboot)
 
 panic: kernel diagnostic assertion "xfer->ux_pipe->up_intrxfer == xfer" failed: file "/var/cvs/NetBSD-current/src/sys/dev/usb/uhci.c", line 2878 
 cpu0: Begin traceback...
 vpanic() at netbsd:vpanic+0x13c
 valid_user_selector() at netbsd:valid_user_selector
 uhci_device_intr_abort() at netbsd:uhci_device_intr_abort+0x89
 usbd_ar_pipe() at netbsd:usbd_ar_pipe+0x37
 usbd_abort_pipe() at netbsd:usbd_abort_pipe+0x27
 ucom_cleanup() at netbsd:ucom_cleanup+0xa2
 ucomclose() at netbsd:ucomclose+0xe2
 spec_close() at netbsd:spec_close+0x12c
 VOP_CLOSE() at netbsd:VOP_CLOSE+0x33
 vn_close() at netbsd:vn_close+0x33
 closef() at netbsd:closef+0x54
 fd_free() at netbsd:fd_free+0xcc
 exit1() at netbsd:exit1+0x10d
 sys_exit() at netbsd:sys_exit+0x39
 syscall() at netbsd:syscall+0xbe
 --- syscall (number 1) ---
 78d004d13f2a:
 cpu0: End traceback...
 fatal breakpoint trap in supervisor mode
 trap type 1 code 0 rip ffffffff80114ae5 cs 8 rflags 246 cr2 78d004f5ee10 ilevel 0 rsp fffffe8040e49b78
 curlwp 0xfffffe813ad6b240 pid 15.1 lowest kstack 0xfffffe8040e462c0
 
 dumping to dev 0,1 (offset=8, size=1031757):
 dump succeeded
 
 and I do have a core dump, if that is helpful.
 
 So then, I tried your amd64 kernel - disabled nouveau in userconf so I 
 could see what was going on and booted single-user
 
 NetBSD 7.99.29 (GENERIC) #21: Thu Jun  9 06:18:11 BST 2016
 	nick@zoom:/wrk/nhusb/obj.amd64/wrk/nhusb/src/sys/arch/amd64/compile/GENERIC
 
 and  the device attaches ok,
 
  ehci0: handing over full speed device on port 3 to uhci1
  umct0 at uhub2 port 1
  umct0: Targus Group Intl Targus Group Intl, rev 1.10/1.03, addr 2
  ucom0 at umct0
 
 but when I connect to the device (cu -l /dev/ttyU0) it says Connected but 
 when I pressed a button, immediately page fault.
 
 fatal page fault in supervisor mode
 trap type 6 code 0 rip ffffffff80335434 cs 8 rflags 10246 cr2 0 ilevel 4 rsp fffffe8040007e58
 curlwp 0xfffffe813bb32420 pid 0.3 lowest kstack 0xfffffe80400042c0
  
 dumping to dev 0,1 (offset=8, size=1031757):
 dump succeeded
 
 although.. didn't get a savecore this time (I don't know enough about 
 that) and there was more information shown on the screen about the panic 
 but it doesn't make it into the message buffer, hmm..  a photo of the 
 screen is here
 
 	http://www.netbsd.org/~plunky/nhusb.screen.0.jpg
 
 regards,
 iain