PMD analysis of a panic in ohci.c

Hello,

with a recent -CURRENT I got a panic while moving the mouse the first
time since I booted my IBM laptop or while starting usbd(8).
I can keep the dump for a while, so if someone needs to talk me through
deeper analysis.

Bjoern Fischer

I wrote some comments into the gdb session...

#0  doadump () at ../../../kern/kern_shutdown.c:240
240             dumping++;
(kgdb) bt
#0  doadump () at ../../../kern/kern_shutdown.c:240
#1  0xc052db7a in boot (howto=256) at ../../../kern/kern_shutdown.c:374
#2  0xc052dfdb in __panic () at ../../../kern/kern_shutdown.c:552
#3  0xc06ae286 in trap_fatal (frame=0xcd150c4c, eva=0)
    at ../../../i386/i386/trap.c:819
#4  0xc06adef2 in trap_pfault (frame=0xcd150c4c, usermode=0, eva=8)
    at ../../../i386/i386/trap.c:733
#5  0xc06ada6d in trap (frame=
      {tf_fs = -1052049384, tf_es = -854261744, tf_ds = -1068236784, tf_edi = 0,
 tf_esi = -1052088320, tf_ebp = -854258512, tf_isp = -854258568, tf_ebx = -10298
86976, tf_edx = 0, tf_ecx = -1029886976, tf_eax = 1862656, tf_trapno = 12, tf_er
r = 2, tf_eip = -1068700480, tf_cs = 8, tf_eflags = 66055, tf_esp = -1030074368,
 tf_ss = -1029887024}) at ../../../i386/i386/trap.c:420
#6  0xc04cecc0 in ohci_softintr (v=0xc29a5000) at ../../../dev/usb/ohci.c:1438
#7  0xc04e0d42 in usb_schedsoftintr (bus=0x0) at ../../../dev/usb/usb.c:840
#8  0xc04ce8d1 in ohci_intr1 (sc=0xc29a5000) at ../../../dev/usb/ohci.c:1216
#9  0xc04ce73f in ohci_intr (p=0xc29a5000) at ../../../dev/usb/ohci.c:1145
#10 0xc0517328 in ithread_loop (arg=0xc2953200)
    at ../../../kern/kern_intr.c:547
#11 0xc0515f58 in fork_exit (callout=0xc0517150 <ithread_loop>, arg=0x0, 
    frame=0x0) at ../../../kern/kern_fork.c:802
(kgdb) frame 6
#6  0xc04cecc0 in ohci_softintr (v=0xc29a5000) at ../../../dev/usb/ohci.c:1438
1438                            opipe->sed->ed.ed_headp = htole32(p->physaddr);
(kgdb) list
1433                                    n = p->nexttd;
1434                                    ohci_free_std(sc, p);
1435                            }
1436
1437                            /* clear halt */
1438                            opipe->sed->ed.ed_headp = htole32(p->physaddr);
1439                            OWRITE4(sc, OHCI_COMMAND_STATUS, OHCI_CLF);
1440
1441                            if (cc == OHCI_CC_STALL)
1442                                    xfer->status = USBD_STALLED;
(kgdb) print opipe
$1 = (struct ohci_pipe *) 0xc2953900
(kgdb) print opipe->sed
$2 = (ohci_soft_ed_t *) 0x0

!! ok, opipe is initialized as (struct ohci_pipe *)xfer->pipe, which
!! is a (struct usbd_pipe *)

(kgdb) print xfer->pipe
$3 = (struct usbd_pipe *) 0xc2953900
(kgdb) print *(xfer->pipe)
$4 = {iface = 0x0, device = 0xc2953b00, endpoint = 0xc2953b24, refcnt = 1, 
  running = 0 '\0', aborting = 0 '\0', queue = {stqh_first = 0x0, 
    stqh_last = 0xc2953914}, next = {le_next = 0x0, le_prev = 0x0}, 
  intrxfer = 0x0, repeat = 0 '\0', interval = -1, methods = 0xc0721d1c}
(kgdb) print *(opipe)
$5 = {pipe = {iface = 0x0, device = 0xc2953b00, endpoint = 0xc2953b24, 
    refcnt = 1, running = 0 '\0', aborting = 0 '\0', queue = {
      stqh_first = 0x0, stqh_last = 0xc2953914}, next = {le_next = 0x0, 
      le_prev = 0x0}, intrxfer = 0x0, repeat = 0 '\0', interval = -1, 
    methods = 0xc0721d1c}, sed = 0x0, aborting = 0, tail = {td = 0x0, 
    itd = 0x0}, u = {ctl = {reqdma = {block = 0x0, offs = 0, len = 0}, 
      length = 0, setup = 0x0, data = 0x0, stat = 0x0}, intr = {nslots = 0, 
      pos = 0}, bulk = {length = 0, isread = 0}, iso = {next = 0, inuse = 0}}}

!! seems like ohci_softintr() expects xfer->pipe to point really to a
!! whole struct ohci_pipe, not just the struct usbd_pipe part. Either
!! somehow the remainder of (struct ohci_pipe *)xfer->pipe was not
!! initialized properly, or it is simply a struct usbd_pipe.