Re: port-amd64/39630: New ipmi(4) attachment code triggers kernel panic

[Christoph Egger <Christoph_Egger%gmx.de@localhost>]

The following reply was made to PR port-amd64/39630; it has been noted by GNATS.

From: Christoph Egger <Christoph_Egger%gmx.de@localhost>
To: Matthias Scheler <tron%zhadum.org.uk@localhost>
Cc: netbsd-bugs%NetBSD.org@localhost, gnats-bugs%NetBSD.org@localhost
Subject: Re: port-amd64/39630: New ipmi(4) attachment code triggers kernel
 panic
Date: Tue, 04 Nov 2008 18:59:40 +0100

 Matthias Scheler wrote:
 >      Hello,
 > 
 > I've added the following debugging output:
 > 
 > Index: ipmi.c
 > ===================================================================
 > RCS file: /cvsroot/src/sys/arch/x86/x86/ipmi.c,v
 > retrieving revision 1.21
 > diff -u -r1.21 ipmi.c
 > --- ipmi.c   30 Oct 2008 20:28:02 -0000      1.21
 > +++ ipmi.c   4 Nov 2008 17:53:45 -0000
 > @@ -292,19 +292,23 @@
 >      struct ipmi_softc       *sc = arg;
 >      struct ipmi_bmc_args    *a = sc->sc_iowait_args;
 >  
 > +    aprint_normal("_bmc_io_wait: sc=%p, a=%p\n", sc, a);
 >      *a->v = bmc_read(sc, a->offset);
 >      if ((*a->v & a->mask) == a->value) {
 > +            aprint_normal("_bmc_io_wait: wakeup success\n");
 >              sc->sc_wakeup = 0;
 >              wakeup(sc);
 >              return;
 >      }
 >  
 >      if (++sc->sc_retries > sc->sc_max_retries) {
 > +            aprint_normal("_bmc_io_wait: wakeup failure\n");
 >              sc->sc_wakeup = 0;
 >              wakeup(sc);
 >              return;
 >      }
 >  
 > +    aprint_normal("_bmc_io_wait: callout\n");
 >      callout_schedule(&sc->sc_callout, 1);
 >  }
 >  
 > @@ -1756,6 +1760,7 @@
 >      sc->sc_max_retries = hz / 2; /* 0.5 seconds max */
 >      callout_init(&sc->sc_callout, 0);
 >      callout_setfunc(&sc->sc_callout, _bmc_io_wait, sc);
 > +    aprint_normal("Callout initialized at %p\n", &sc->sc_callout);
 >  
 >      /* Map registers */
 >      ipmi_map_regs(sc, ia);
 > 
 > And I get this output:
 > 
 > attimer0: attached to pcppi0
 > _bmc_io_wait: sc=0xffffffff807dea30, a=0xffffffff807de900
 > _bmc_io_wait: callout
 > uvm_fault(0xffffffff806e7ae0, 0x0, 1) -> e
 > fatal page fault in supervisor mode
 > 
 > It looks to me like _bmc_io_wait() is called before "sc->sc_callout"
 > has been initialized.
 
 This has been fixed by christos:
 http://mail-index.netbsd.org/source-changes/2008/11/03/msg212193.html
 
 Christoph