Re: port-amd64/39630: New ipmi(4) attachment code triggers kernel panic

[Matthias Scheler <tron%zhadum.org.uk@localhost>]

The following reply was made to PR port-amd64/39630; it has been noted by GNATS.

From: Matthias Scheler <tron%zhadum.org.uk@localhost>
To: netbsd-bugs%NetBSD.org@localhost, gnats-bugs%NetBSD.org@localhost
Cc: 
Subject: Re: port-amd64/39630: New ipmi(4) attachment code triggers kernel panic
Date: Tue, 4 Nov 2008 17:55:57 +0000

        Hello,
 
 I've added the following debugging output:
 
 Index: ipmi.c
 ===================================================================
 RCS file: /cvsroot/src/sys/arch/x86/x86/ipmi.c,v
 retrieving revision 1.21
 diff -u -r1.21 ipmi.c
 --- ipmi.c     30 Oct 2008 20:28:02 -0000      1.21
 +++ ipmi.c     4 Nov 2008 17:53:45 -0000
 @@ -292,19 +292,23 @@
        struct ipmi_softc       *sc = arg;
        struct ipmi_bmc_args    *a = sc->sc_iowait_args;
  
 +      aprint_normal("_bmc_io_wait: sc=%p, a=%p\n", sc, a);
        *a->v = bmc_read(sc, a->offset);
        if ((*a->v & a->mask) == a->value) {
 +              aprint_normal("_bmc_io_wait: wakeup success\n");
                sc->sc_wakeup = 0;
                wakeup(sc);
                return;
        }
  
        if (++sc->sc_retries > sc->sc_max_retries) {
 +              aprint_normal("_bmc_io_wait: wakeup failure\n");
                sc->sc_wakeup = 0;
                wakeup(sc);
                return;
        }
  
 +      aprint_normal("_bmc_io_wait: callout\n");
        callout_schedule(&sc->sc_callout, 1);
  }
  
 @@ -1756,6 +1760,7 @@
        sc->sc_max_retries = hz / 2; /* 0.5 seconds max */
        callout_init(&sc->sc_callout, 0);
        callout_setfunc(&sc->sc_callout, _bmc_io_wait, sc);
 +      aprint_normal("Callout initialized at %p\n", &sc->sc_callout);
  
        /* Map registers */
        ipmi_map_regs(sc, ia);
 
 And I get this output:
 
 attimer0: attached to pcppi0
 _bmc_io_wait: sc=0xffffffff807dea30, a=0xffffffff807de900
 _bmc_io_wait: callout
 uvm_fault(0xffffffff806e7ae0, 0x0, 1) -> e
 fatal page fault in supervisor mode
 
 It looks to me like _bmc_io_wait() is called before "sc->sc_callout"
 has been initialized.
 
        Kind regards
 
 -- 
 Matthias Scheler                                  http://zhadum.org.uk/