From owner-freebsd-hackers  Thu Mar 27 10:21:11 1997
Return-Path: <owner-hackers>
Received: (from root@localhost)
          by freefall.freebsd.org (8.8.5/8.8.5) id KAA06482
          for hackers-outgoing; Thu, 27 Mar 1997 10:21:11 -0800 (PST)
Received: from news.IAEhv.nl (root@news.IAEhv.nl [194.151.64.4])
          by freefall.freebsd.org (8.8.5/8.8.5) with SMTP id KAA06466
          for <hackers@freebsd.org>; Thu, 27 Mar 1997 10:21:02 -0800 (PST)
Received: from truk.brandinnovators.com (uucp@localhost) 
          by news.IAEhv.nl (8.6.13/1.63) with IAEhv.nl; pid 6545
          on Thu, 27 Mar 1997 19:20:45 +0100; id TAA06545
          efrom: hans@truk.brandinnovators.com; eto: hackers@freebsd.org
Received: by truk.brandinnovators.com (8.7.5/BI96070101) 
    for <hackers@freebsd.org> id SAA00260; Thu, 27 Mar 1997 18:56:02 +0100 (MET)
Message-Id: <199703271756.SAA00260@truk.brandinnovators.com>
From: hans@brandinnovators.com (Hans Zuidam)
Subject: driver panic
To: hackers@freebsd.org
Date: Thu, 27 Mar 1997 18:56:02 +0100 (MET)
X-Mailer: ELM [version 2.4ME+ PL22 (25)]
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: owner-hackers@freebsd.org
X-Loop: FreeBSD.org
Precedence: bulk

Hi,

I have a driver which does:

    /*
     * As long as there's data, try to fill the output buffer to
     * it's maximum size.  If the number of bytes is not a multiple
     * of four round down, effectively forgetting up to three bytes.
     */
    while ((n = min((BUFSIZE - bp->b_olen), uio->uio_resid)) != 0) {
        if (n & 0x3) n &= ~0x3;
        if (n > 0) {
            uiomove(((u_char *) bp->b_obuf) + bp->b_olen, n, uio);
            bp->b_olen += n;
        }
        else {
            splx(s);
            return 0;
        }

        /*
         * As long as there's something in the output buffer, write it.
         */
        while (bp->b_olen) {

		...
	}

	...
    }

while a test program did:

	u_long wo = 0L;
	r = write(fd, (char *) wo, 4);

which is obviously wrong.  What makes me wonder is why this causes
a page fault.  As far as I can see uiomove() is the only one
accessing the write buffer.  When I do the right thing (i.e. (char *) &wo)
everything is fine.  Anyone any idea?

Thanks in advance,
				Hans

-- 
H. Zuidam                        E-Mail: hans@brandinnovators.com
Brand Innovators B.V.            P-Mail: P.O. Box 1377
de Pinckart 54                   5602 BJ Eindhoven, The Netherlands
5674 CC Nuenen                   Tel. +31 40 2631134, Fax. +31 40 2831138