From owner-freebsd-current@FreeBSD.ORG Wed May 20 06:57:25 2009 Return-Path: Delivered-To: freebsd-current@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 08CBC106564A for ; Wed, 20 May 2009 06:57:25 +0000 (UTC) (envelope-from mav@FreeBSD.org) Received: from cmail.optima.ua (cmail.optima.ua [195.248.191.121]) by mx1.freebsd.org (Postfix) with ESMTP id 786068FC13 for ; Wed, 20 May 2009 06:57:24 +0000 (UTC) (envelope-from mav@FreeBSD.org) X-Spam-Flag: SKIP X-Spam-Yversion: Spamooborona-2.1.0 Received: from [212.86.226.226] (account mav@alkar.net HELO mavbook.mavhome.dp.ua) by cmail.optima.ua (CommuniGate Pro SMTP 5.2.9) with ESMTPSA id 243286064; Wed, 20 May 2009 09:57:23 +0300 Message-ID: <4A13A9D0.5080706@FreeBSD.org> Date: Wed, 20 May 2009 09:57:20 +0300 From: Alexander Motin User-Agent: Thunderbird 2.0.0.21 (X11/20090405) MIME-Version: 1.0 To: Magnus Kling References: <43b1bb350905150939s5d503f00x27116e7ffe79a37@mail.gmail.com> <4A10F3E3.40306@FreeBSD.org> <43b1bb350905180025g682d3764qba5a450d85d8f961@mail.gmail.com> <43b1bb350905181331r44b35b13i22aa1ba6a18103ed@mail.gmail.com> <4A121C40.7040201@FreeBSD.org> <43b1bb350905182353v3812c523pa52cdf41ce886907@mail.gmail.com> <4A1264E8.2080707@FreeBSD.org> <43b1bb350905190554i511c1b32sa9320b10a86e2af2@mail.gmail.com> <4A130C5C.6090104@FreeBSD.org> <43b1bb350905192321h4e43e178vc9a00b646d0e2340@mail.gmail.com> In-Reply-To: <43b1bb350905192321h4e43e178vc9a00b646d0e2340@mail.gmail.com> Content-Type: multipart/mixed; boundary="------------020809000101070208030201" Cc: freebsd-current@freebsd.org Subject: Re: Kernel panic when reboot on server with a Promise SX4000 and two ATA disks RAID1. X-BeenThere: freebsd-current@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussions about the use of FreeBSD-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 20 May 2009 06:57:25 -0000 This is a multi-part message in MIME format. --------------020809000101070208030201 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Magnus Kling wrote: > Addr2line gives me /usr/src/sys/dev/ata/chipsets/ata-promise.c:1066 > > struct ata_dma_prdentry *prd = request->dma->sg; > > Can we do an if statement with pointer prd? Or check what "sg" is at the > moment? What is "sg"? A-ha! That explains a lot! I have got it! Flush command has no data and does not uses DMA. Dereference of NULL request->dma pointer crashes the system. That dereference is just not needed there. Try please attached patch. -- Alexander Motin --------------020809000101070208030201 Content-Type: text/plain; name="ata-promise.c.nodma.patch" Content-Transfer-Encoding: 7bit Content-Disposition: inline; filename="ata-promise.c.nodma.patch" --- ata-promise.c.prev 2009-05-20 01:24:31.000000000 +0300 +++ ata-promise.c 2009-05-20 09:51:13.000000000 +0300 @@ -1054,7 +1054,7 @@ ata_promise_sx4_command(struct ata_reque device_t gparent = GRANDPARENT(request->dev); struct ata_pci_controller *ctlr = device_get_softc(gparent); struct ata_channel *ch = device_get_softc(request->parent); - struct ata_dma_prdentry *prd = request->dma->sg; + struct ata_dma_prdentry *prd; caddr_t window = rman_get_virtual(ctlr->r_res1); u_int32_t *wordp; int i, idx, length = 0; @@ -1098,6 +1098,7 @@ ata_promise_sx4_command(struct ata_reque case ATA_READ_DMA48: case ATA_WRITE_DMA: case ATA_WRITE_DMA48: + prd = request->dma->sg; wordp = (u_int32_t *) (window + (ch->unit * ATA_PDC_CHN_OFFSET) + ATA_PDC_HSG_OFFSET); i = idx = 0; --------------020809000101070208030201--