From owner-freebsd-bugs@FreeBSD.ORG  Thu Mar 15 04:30:07 2007
Return-Path: <owner-freebsd-bugs@FreeBSD.ORG>
X-Original-To: freebsd-bugs@hub.freebsd.org
Delivered-To: freebsd-bugs@hub.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52])
	by hub.freebsd.org (Postfix) with ESMTP id EF3D316A400
	for <freebsd-bugs@hub.freebsd.org>;
	Thu, 15 Mar 2007 04:30:07 +0000 (UTC)
	(envelope-from gnats@FreeBSD.org)
Received: from freefall.freebsd.org (freefall.freebsd.org [69.147.83.40])
	by mx1.freebsd.org (Postfix) with ESMTP id C749613C465
	for <freebsd-bugs@hub.freebsd.org>;
	Thu, 15 Mar 2007 04:30:07 +0000 (UTC)
	(envelope-from gnats@FreeBSD.org)
Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1])
	by freefall.freebsd.org (8.13.4/8.13.4) with ESMTP id l2F4U7RH069048
	for <freebsd-bugs@freefall.freebsd.org>; Thu, 15 Mar 2007 04:30:07 GMT
	(envelope-from gnats@freefall.freebsd.org)
Received: (from gnats@localhost)
	by freefall.freebsd.org (8.13.4/8.13.4/Submit) id l2F4U7Kk069045;
	Thu, 15 Mar 2007 04:30:07 GMT (envelope-from gnats)
Date: Thu, 15 Mar 2007 04:30:07 GMT
Message-Id: <200703150430.l2F4U7Kk069045@freefall.freebsd.org>
To: freebsd-bugs@FreeBSD.org
From: Doug Ambrisko <ambrisko@ambrisko.com>
Cc: 
Subject: Re: kern/109152: [rp] RocketPort panic from device_unbusy()
X-BeenThere: freebsd-bugs@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
Reply-To: Doug Ambrisko <ambrisko@ambrisko.com>
List-Id: Bug reports <freebsd-bugs.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-bugs>,
	<mailto:freebsd-bugs-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-bugs>
List-Post: <mailto:freebsd-bugs@freebsd.org>
List-Help: <mailto:freebsd-bugs-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-bugs>,
	<mailto:freebsd-bugs-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 15 Mar 2007 04:30:08 -0000

The following reply was made to PR kern/109152; it has been noted by GNATS.

From: Doug Ambrisko <ambrisko@ambrisko.com>
To: Craig Leres <leres@ee.lbl.gov>
Cc: bug-followup@FreeBSD.org
Subject: Re: kern/109152: [rp] RocketPort panic from device_unbusy()
Date: Wed, 14 Mar 2007 19:55:48 -0800 (PST)

 Craig Leres writes:
 | I was still able to crash Doug Ambrisko's version of the rp driver.
 | I think the problem is that in some cases rp_handle_port() calls
 | rpclose() which calls device_unbusy(). Later rpclose() is called
 | again and we hit the panic.
 | 
 | I looked at the last known good version of the driver I'd used,
 | 1.45.2.2 from 4.10-RELEASE, and found it has code to avoid calling
 | rpclose() twice. I did something similar that seems to work.
 | 
 | Note: The appended diffs are against version 1.67.2.2 of rp.c.
 | 
 | 		Craig
 | 
 | ===================================================================
 | RCS file: RCS/rp.c,v
 | retrieving revision 1.2
 | retrieving revision 1.3
 | diff -c -r1.2 -r1.3
 | *** rp.c	2007/03/08 04:07:10	1.2
 | --- rp.c	2007/03/14 02:23:17	1.3
 | ***************
 | *** 573,578 ****
 | --- 573,579 ----
 |   
 |   static	void	rpbreak(struct tty *, int);
 |   static	void	rpclose(struct tty *tp);
 | + static	void	rphardclose(struct tty *tp);
 |   static	int	rpmodem(struct tty *, int, int);
 |   static	int	rpparam(struct tty *, struct termios *);
 |   static	void	rpstart(struct tty *);
 | ***************
 | *** 697,703 ****
 |   			if((tp->t_state & TS_CARR_ON)) {
 |   				(void)ttyld_modem(tp, 0);
 |   				if(ttyld_modem(tp, 0) == 0) {
 | ! 					rpclose(tp);
 |   				}
 |   			}
 |   		}
 | --- 698,704 ----
 |   			if((tp->t_state & TS_CARR_ON)) {
 |   				(void)ttyld_modem(tp, 0);
 |   				if(ttyld_modem(tp, 0) == 0) {
 | ! 					rphardclose(tp);
 |   				}
 |   			}
 |   		}
 | ***************
 | *** 936,941 ****
 | --- 937,952 ----
 |   rpclose(struct tty *tp)
 |   {
 |   	struct	rp_port	*rp;
 | + 
 | + 	rp = tp->t_sc;
 | + 	rphardclose(tp);
 | + 	device_unbusy(rp->rp_ctlp->dev);
 | + }
 | + 
 | + static void
 | + rphardclose(struct tty *tp)
 | + {
 | + 	struct	rp_port	*rp;
 |   	CHANNEL_t	*cp;
 |   
 |   	rp = tp->t_sc;
 | ***************
 | *** 959,965 ****
 |   	tp->t_actout = FALSE;
 |   	wakeup(&tp->t_actout);
 |   	wakeup(TSA_CARR_ON(tp));
 | - 	device_unbusy(rp->rp_ctlp->dev);
 |   }
 |   
 |   static void
 | --- 970,975 ----
 | 
 
 I wonder if this should be a reference count?  Good find.
 
 Doug A.