From owner-freebsd-bugs@FreeBSD.ORG  Wed Mar 14 02:50:08 2007
Return-Path: <owner-freebsd-bugs@FreeBSD.ORG>
X-Original-To: freebsd-bugs@hub.freebsd.org
Delivered-To: freebsd-bugs@hub.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52])
	by hub.freebsd.org (Postfix) with ESMTP id 8E49516A400
	for <freebsd-bugs@hub.freebsd.org>;
	Wed, 14 Mar 2007 02:50:08 +0000 (UTC)
	(envelope-from gnats@FreeBSD.org)
Received: from freefall.freebsd.org (freefall.freebsd.org [69.147.83.40])
	by mx1.freebsd.org (Postfix) with ESMTP id 319BD13C465
	for <freebsd-bugs@hub.freebsd.org>;
	Wed, 14 Mar 2007 02:50:08 +0000 (UTC)
	(envelope-from gnats@FreeBSD.org)
Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1])
	by freefall.freebsd.org (8.13.4/8.13.4) with ESMTP id l2E2o7fr050048
	for <freebsd-bugs@freefall.freebsd.org>; Wed, 14 Mar 2007 02:50:08 GMT
	(envelope-from gnats@freefall.freebsd.org)
Received: (from gnats@localhost)
	by freefall.freebsd.org (8.13.4/8.13.4/Submit) id l2E2o7vg050044;
	Wed, 14 Mar 2007 02:50:07 GMT (envelope-from gnats)
Date: Wed, 14 Mar 2007 02:50:07 GMT
Message-Id: <200703140250.l2E2o7vg050044@freefall.freebsd.org>
To: freebsd-bugs@FreeBSD.org
From: Craig Leres <leres@ee.lbl.gov>
Cc: 
Subject: Re: kern/109152: [rp] RocketPort panic from device_unbusy() 
X-BeenThere: freebsd-bugs@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
Reply-To: Craig Leres <leres@ee.lbl.gov>
List-Id: Bug reports <freebsd-bugs.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-bugs>,
	<mailto:freebsd-bugs-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-bugs>
List-Post: <mailto:freebsd-bugs@freebsd.org>
List-Help: <mailto:freebsd-bugs-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-bugs>,
	<mailto:freebsd-bugs-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Wed, 14 Mar 2007 02:50:08 -0000

The following reply was made to PR kern/109152; it has been noted by GNATS.

From: Craig Leres <leres@ee.lbl.gov>
To: bug-followup@FreeBSD.org
Cc: ambrisko@ambrisko.com
Subject: Re: kern/109152: [rp] RocketPort panic from device_unbusy() 
Date: Tue, 13 Mar 2007 19:27:01 -0700

 I was still able to crash Doug Ambrisko's version of the rp driver.
 I think the problem is that in some cases rp_handle_port() calls
 rpclose() which calls device_unbusy(). Later rpclose() is called
 again and we hit the panic.
 
 I looked at the last known good version of the driver I'd used,
 1.45.2.2 from 4.10-RELEASE, and found it has code to avoid calling
 rpclose() twice. I did something similar that seems to work.
 
 Note: The appended diffs are against version 1.67.2.2 of rp.c.
 
 		Craig
 
 ===================================================================
 RCS file: RCS/rp.c,v
 retrieving revision 1.2
 retrieving revision 1.3
 diff -c -r1.2 -r1.3
 *** rp.c	2007/03/08 04:07:10	1.2
 --- rp.c	2007/03/14 02:23:17	1.3
 ***************
 *** 573,578 ****
 --- 573,579 ----
   
   static	void	rpbreak(struct tty *, int);
   static	void	rpclose(struct tty *tp);
 + static	void	rphardclose(struct tty *tp);
   static	int	rpmodem(struct tty *, int, int);
   static	int	rpparam(struct tty *, struct termios *);
   static	void	rpstart(struct tty *);
 ***************
 *** 697,703 ****
   			if((tp->t_state & TS_CARR_ON)) {
   				(void)ttyld_modem(tp, 0);
   				if(ttyld_modem(tp, 0) == 0) {
 ! 					rpclose(tp);
   				}
   			}
   		}
 --- 698,704 ----
   			if((tp->t_state & TS_CARR_ON)) {
   				(void)ttyld_modem(tp, 0);
   				if(ttyld_modem(tp, 0) == 0) {
 ! 					rphardclose(tp);
   				}
   			}
   		}
 ***************
 *** 936,941 ****
 --- 937,952 ----
   rpclose(struct tty *tp)
   {
   	struct	rp_port	*rp;
 + 
 + 	rp = tp->t_sc;
 + 	rphardclose(tp);
 + 	device_unbusy(rp->rp_ctlp->dev);
 + }
 + 
 + static void
 + rphardclose(struct tty *tp)
 + {
 + 	struct	rp_port	*rp;
   	CHANNEL_t	*cp;
   
   	rp = tp->t_sc;
 ***************
 *** 959,965 ****
   	tp->t_actout = FALSE;
   	wakeup(&tp->t_actout);
   	wakeup(TSA_CARR_ON(tp));
 - 	device_unbusy(rp->rp_ctlp->dev);
   }
   
   static void
 --- 970,975 ----