>Number:         13842
>Category:       kern
>Synopsis:       upl(4) causes a kernel panic.
>Confidential:   no
>Severity:       critical
>Priority:       high
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sat Sep 01 06:19:00 PDT 2001
>Closed-Date:
>Last-Modified:
>Originator:     Francesco Cristiano
>Release:        1.5
>Organization:
>Environment:
NetBSD  1.5 NetBSD 1.5 (GENERIC) #1: Sun Nov 19 21:42:11 MET 2000     fvdl@sushi:/work/trees/netbsd-1-5/sys/arch/i386/compile/GENERIC i386
>Description:
I've two hosts which are connected via "PL2301 Host-Host interface, Prolific Technology Inc."
if I ping (obviously  from A) host B, while it is not physically attached or it is turned off,
then a kernel panic appears.

	-----------------			       -----------------
	|    host A	|---------------------------\ \|       host B   |
	-----------------			       -----------------

Bootstrap message, on turned-on host that in this case is A, is:

NetBSD 1.5 (GENERIC) #1: Sun Nov 19 21:42:11 MET 2000
    fvdl@sushi:/work/trees/netbsd-1-5/sys/arch/i386/compile/GENERIC
cpu0: Intel Pentium II (Deschutes) (686-class)
total memory = 65152 KB
avail memory = 55268 KB
using 840 buffers containing 3360 KB of memory
BIOS32 rev. 0 found at 0xeb040
mainbus0 (root)
pci0 at mainbus0 bus 0: configuration mode 1
pci0: i/o space, memory space enabled
pchb0 at pci0 dev 0 function 0
pchb0: Intel 82443BX Host Bridge/Controller (AGP disabled) (rev. 0x02)
vga1 at pci0 dev 2 function 0: S3 ViRGE/MXP (rev. 0x03)
wsdisplay0 at vga1: console (80x25, vt100 emulation)
Texas Instruments PCI1250 PCI-CardBus Bridge (CardBus bridge, revision 0x02) at pci0 dev 3 function 0 not configured
Texas Instruments PCI1250 PCI-CardBus Bridge (CardBus bridge, revision 0x02) at pci0 dev 3 function 1 not configured
pcib0 at pci0 dev 7 function 0
pcib0: Intel 82371AB PCI-to-ISA Bridge (PIIX4) (rev. 0x01)
pciide0 at pci0 dev 7 function 1: Intel 82371AB IDE controller (PIIX4) (rev. 0x01)
pciide0: bus-master DMA support present
pciide0: primary channel wired to compatibility mode
wd0 at pciide0 channel 0 drive 0: <IBM-DTCA-24090>
wd0: drive supports 16-sector pio transfers, lba addressing
wd0: 3909 MB, 7944 cyl, 16 head, 63 sec, 512 bytes/sect x 8007552 sectors
wd0: 32-bit data port
wd0: drive supports PIO mode 4, DMA mode 2, Ultra-DMA mode 2
pciide0: primary channel interrupting at irq 14
wd0(pciide0:0:0): using PIO mode 4, Ultra-DMA mode 2 (using DMA data transfers)
pciide0: secondary channel wired to compatibility mode
atapibus0 at pciide0 channel 1
cd0 at atapibus0 drive 0: <TOSHIBA CD-ROM XM-1702B, \134377\134377\134377\134377, 1150> type 5 cdrom removable
cd0: 32-bit data port
cd0: drive supports PIO mode 4, DMA mode 2
pciide0: secondary channel interrupting at irq 15
cd0(pciide0:1:0): using PIO mode 4, DMA mode 2 (using DMA data transfers)
uhci0 at pci0 dev 7 function 2: Intel 82371AB USB Host Controller (PIIX4) (rev. 0x01)
uhci0: interrupting at irq 11
usb0 at uhci0: USB revision 1.0
uhub0 at usb0
uhub0: Intel UHCI root hub, class 9/0, rev 1.00/1.00, addr 1
uhub0: 2 ports with 2 removable, self powered
Intel 82371AB Power Management Controller (PIIX4) (miscellaneous bridge, revision 0x01) at pci0 dev 7 function 3 not configured
isa0 at pcib0
com0 at isa0 port 0x3f8-0x3ff irq 4: ns16550a, working fifo
pckbc0 at isa0 port 0x60-0x64
pckbd0 at pckbc0 (kbd slot)
pckbc0: using irq 1 for kbd slot
wskbd0 at pckbd0: console keyboard, using wsdisplay0
pms0 at pckbc0 (aux slot)
pckbc0: using irq 12 for aux slot
wsmouse0 at pms0 mux 0
lpt0 at isa0 port 0x378-0x37b irq 7
sb0 at isa0 port 0x220-0x237 irq 5 drq 1: dsp v3.01
audio0 at sb0: half duplex, mmap, independent
midi0 at sb0: SB MIDI UART
opl0 at sb0: model OPL3
midi1 at opl0: SB Yamaha OPL3
pcppi0 at isa0 port 0x61
midi2 at pcppi0: PC speaker
sysbeep0 at pcppi0
isapnp0 at isa0 port 0x279: ISA Plug 'n Play device support
npx0 at isa0 port 0xf0-0xff: using exception 16
fdc0 at isa0 port 0x3f0-0x3f7 irq 6 drq 2
fd0 at fdc0 drive 0: 1.44MB, 80 cyl, 2 head, 18 sec
pcic0 at isa0 port 0x3e0-0x3e1 iomem 0xd0000-0xdffff
pcic0: controller 0 (Intel 82365SL Revision 1) has sockets A and B
pcic0: controller 1 (Intel 82365SL Revision 1) has no sockets
pcmcia0 at pcic0 controller 0 socket 0
pcmcia1 at pcic0 controller 0 socket 1
isapnp0: no ISA Plug 'n Play devices found
biomask ef4d netmask ef4d ttymask ffcf
pcic0: controller 0 detecting irqs with mask 0xdeb8:..3..9..10
pcic0: using irq 3 for socket events
boot device: wd0
root on wd0a dumps on wd0b
root file system type: ffs
upl0 at uhub0 port 1
upl0: Prolific Technology Inc. PL2301 Host-Host interface, rev 1.00/0.00, addr 2
upl0: not multicast capable, IPv6 not enabled
wsdisplay0: screen 1 added (80x25, vt100 emulation)
wsdisplay0: screen 2 added (80x25, vt100 emulation)
wsdisplay0: screen 3 added (80x25, vt100 emulation)
wsdisplay0: screen 4 added (80x25, vt100 emulation)
wsmux1: connecting to wsdisplay0

>How-To-Repeat:
On host A

1) System starts with default installation conditions (for a 1.5 version).

2) root logs in

3) sets the address for upl0 interface typing:
	#ifconfig upl0 inet 192.168.1.1 192.168.1.2 netmask 255.255.255.0

4) now try to ping 192.168.1.2 typing: (warning the system will goes in kernel panic)
	#ping 192.168.1.2

On host B: 
make nothing because kernel panic appears only if:
		"the other point, over an Host-Host upl interface, is not reachable."
So you must:
 or 1)keep it turned-off.
 or 2)turned-on it but detach upl interface.
 or 3)turned-on it attach upl interface but not configure it via ifconfig(8).

>Fix:
Following the in-kernel debugger I deduce that the problem is in a not corrected interface 
(/sys/dev/usb/if_upl.c) to the driver implementation.

>Release-Note:
>Audit-Trail:
>Unformatted: