vchans related page fault

Hi!

Looks like the vchans code still is broken.  I get panics approx. twice
a day on, all related to sound usage.

FreeBSD fump.kawo2.rwth-aachen.de 5.1-CURRENT FreeBSD 5.1-CURRENT #9:
Wed Jul  9 19:26:12 CEST 2003
alex_at_fump.kawo2.rwth-aachen.de:/data/obj/usr/src/sys/ZEROGRAVITY  i386

It begins with xmms _sometimes_ not being able to open /dev/dsp
(Operation not by device) (after heavy usage before), then when trying to
play again it outputs "DSP_SETSPEED: ..." (can't remember exactly), and
then the system already hangs (in X => after a short while reboot with
crashdump)

I currently don't understand everything of the the feeder code, but it
seems sometimes there is no feeder_feed function available, so this
results in a page fault:

p 12: page fault while in kernel mode
fault virtual address   = 0x0
fault code              = supervisor read, page not present
instruction pointer     = 0x8:0x0
stack pointer           = 0x10:0xd67bcba0
frame pointer           = 0x10:0xd67bcbd0
code segment            = base 0x0, limit 0xfffff, type 0x1b
                        = DPL 0, pres 1, def32 1, gran 1
processor eflags        = interrupt enabled, resume, IOPL = 0
current process         = 24 (irq5: fwohci0 pcm0)
trap number             = 12
panic: page fault
Stack backtrace:

syncing disks, buffers remaining... 3803 3802 3802 3802 3802 3802 3802
3802 3802 3802 3802 3802 3802 3802 3802 3802 3802 3802 3802 3802 3802 
giving up on 779 buffers
Uptime: 20h31m28s
Dumping 511 MB
ata0: resetting devices ..
done
ad0: timeout waiting for DRQata0: resetting devices ..
done
[CTRL-C to abort] [CTRL-C to abort]  16 32 48 64 80 96 112 128 144 160
176 192 208 224 240 256 272 288 304 320 336 352[CTRL-C to abort] [CTRL-C
to abort] [CTRL-C to abort] [CTRL-C to abort]  368 384 400 416 432 448
464 480 496
---

(kgdb) where
#0  doadump () at /usr/src/sys/kern/kern_shutdown.c:240
#1  0xc023184a in boot (howto=256) at
/usr/src/sys/kern/kern_shutdown.c:372
#2  0xc0231bf4 in panic () at /usr/src/sys/kern/kern_shutdown.c:550
#3  0xc039726b in trap_fatal (frame=0xd67bcb60, eva=0) at
/usr/src/sys/i386/i386/trap.c:836
#4  0xc0396f53 in trap_pfault (frame=0xd67bcb60, usermode=0, eva=0) at
/usr/src/sys/i386/i386/trap.c:750
#5  0xc0396ac8 in trap (frame=
      {tf_fs = 24, tf_es = 16, tf_ds = 16, tf_edi = 0, tf_esi =
-990232576, tf_ebp = -696529968, tf_isp = -696530036, tf_ebx = 2044,
tf_edx = 0, tf_ecx = 0, tf_eax = -967561216, tf_trapno = 12, tf_err = 0,
tf_eip = 0, tf_cs = 8, tf_eflags = 66182, tf_esp = -1071922962, tf_ss =
-990232576}) at /usr/src/sys/i386/i386/trap.c:435
#6  0xc03873c8 in calltrap () at {standard input}:96
#7  0xc01c03d4 in FEEDER_FEED (feeder=0xc4fa4000, c=0x0, buffer=0x0,
count=0, source=0x0) at feeder_if.h:61
#8  0xc01bfcb7 in feed_vchan_s16 (f=0xc4211dc0, c=0x0, b=---Can't read
userspace from dump, or kernel process---

) at /usr/src/sys/dev/sound/pcm/vchan.c:98
#9  0xc01b5dc4 in FEEDER_FEED (feeder=0xc4211dc0, c=0x0, buffer=0x0,
count=0, source=0x0) at feeder_if.h:61
#10 0xc01b5c07 in sndbuf_feed (from=0x0, to=0xc4211dc0, channel=0x0,
feeder=0x0, count=3291058728)
    at /usr/src/sys/dev/sound/pcm/buffer.c:538
#11 0xc01b61bb in chn_wrfeed (c=0xc4036a80) at
/usr/src/sys/dev/sound/pcm/channel.c:218
#12 0xc01b620c in chn_wrintr (c=0xc4299228) at
/usr/src/sys/dev/sound/pcm/channel.c:234
#13 0xc01b66f2 in chn_intr (c=0xc4299228) at
/usr/src/sys/dev/sound/pcm/channel.c:443
#14 0xc0198ab1 in cmi_intr (data=0xc4036600) at
/usr/src/sys/dev/sound/pci/cmi.c:537
#15 0xc021cc92 in ithread_loop (arg=0xc4036780) at
/usr/src/sys/kern/kern_intr.c:534
#16 0xc021b9ff in fork_exit (callout=0xc021cad0 <ithread_loop>, arg=0x0,
frame=0x0)
    at /usr/src/sys/kern/kern_fork.c:794
(kgdb) up 7
#7  0xc01c03d4 in FEEDER_FEED (feeder=0xc4fa4000, c=0x0, buffer=0x0,
count=0, source=0x0) at feeder_if.h:61
61      feeder_if.h: No such file or directory.
        in feeder_if.h
(kgdb) print *feeder
$1 = {ops = 0x1f40, align = 8000, desc = 0x0, desc_static = {type = 0,
in = 0, out = 0, flags = 2, idx = 0}, 
  data = 0x0, class = 0x0, source = 0x0, parent = 0x0}
(kgdb) print *(feeder->ops)
---Can't read userspace from dump, or kernel process---
(kgdb) print feeder->ops
$2 = (struct kobj_ops *) 0x1f40
56      in feeder_if.h
(kgdb) up
#8  0xc01bfcb7 in feed_vchan_s16 (f=0xc4211dc0, c=0x0, b=---Can't read
userspace from dump, or kernel process---

) at /usr/src/sys/dev/sound/pcm/vchan.c:98
98                              cnt = FEEDER_FEED(ch->feeder, ch,
(u_int8_t *)tmp, count, ch->bufsoft);
(kgdb) list
93              SLIST_FOREACH(cce, &c->children, link) {
94                      ch = cce->channel;
95                      if (ch->flags & CHN_F_TRIGGERED) {
96                              if (ch->flags & CHN_F_MAPPED)
97                                      sndbuf_acquire(ch->bufsoft,
NULL, sndbuf_getfree(ch->bufsoft));
98                              cnt = FEEDER_FEED(ch->feeder, ch,
(u_int8_t *)tmp, count, ch->bufsoft);
99                              vchan_mix_s16(dst, tmp, cnt / 2);
100                     }
101             }
102     

The page-fault resulting line is this one:
	return ((feeder_feed_t *) _m)(feeder, c, buffer, count, source);
as in feeder_if.h:
static __inline int FEEDER_FEED(struct pcm_feeder* feeder,
                                struct pcm_channel* c, u_int8_t* buffer,
                                u_int32_t count, void* source)
{
	kobjop_t _m;
	KOBJOPLOOKUP(((kobj_t)feeder)->ops,feeder_feed);
	return ((feeder_feed_t *) _m)(feeder, c, buffer, count, source);
}

so obviously there was no method "feeder_feed" for this feeder,
resulting in a page fault when trying to execute (*_m)().

Any ideas?  Fixes?

[ Why do I get the "---Can't read userspace from dump, or kernel
process---" error?  Does this mean there could be a memory leak
somewhere? (gdb didn't load the vmware kernel modules as it couldn't
find them) ]

Thanks

Alex