From owner-freebsd-current@FreeBSD.ORG  Fri Aug  6 20:33:56 2004
Return-Path: <owner-freebsd-current@FreeBSD.ORG>
Delivered-To: freebsd-current@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id AD29F16A4CE
	for <current@freebsd.org>; Fri,  6 Aug 2004 20:33:56 +0000 (GMT)
Received: from www.cryptography.com (li-22.members.linode.com [64.5.53.22])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 6F7A443D58
	for <current@freebsd.org>; Fri,  6 Aug 2004 20:33:56 +0000 (GMT)
	(envelope-from nate@root.org)
Received: from [10.0.0.34] (adsl-67-127-84-57.dsl.snfc21.pacbell.net
	[67.127.84.57])
	by www.cryptography.com (8.12.8/8.12.8) with ESMTP id i76KXk8U027283;
	Fri, 6 Aug 2004 13:33:46 -0700
Message-ID: <4113EB2A.7060401@root.org>
Date: Fri, 06 Aug 2004 13:33:46 -0700
From: Nate Lawson <nate@root.org>
User-Agent: Mozilla Thunderbird 0.7 (X11/20040702)
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: Radek Kozlowski <radek@raadradd.com>,
	Ceri Davies <ceri@submonkey.net>
Content-Type: multipart/mixed;
 boundary="------------030405010909090504040801"
cc: current@freebsd.org
cc: sos@deepcore.dk
Subject: Re: Panic on boot with today's CURRENT, ata related
X-BeenThere: freebsd-current@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Discussions about the use of FreeBSD-current
	<freebsd-current.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-current>,
	<mailto:freebsd-current-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-current>
List-Post: <mailto:freebsd-current@freebsd.org>
List-Help: <mailto:freebsd-current-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-current>,
	<mailto:freebsd-current-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Fri, 06 Aug 2004 20:33:56 -0000

This is a multi-part message in MIME format.
--------------030405010909090504040801
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit

I took a quick look at this ATA panic.  The exact same one occurs for 
Ceri.  A quick dissassemble shows that the testb is the check for the 
DMA flag at the very end of ata_generic_transaction().  The bug appears 
to be that this may be a PIO request (since the DMA check is outside the 
switch() statement).  The fix is to make sure it's a DMA request before 
dereferencing an element of the DMA struct.  Try the attached patch.

-Nate

--------------030405010909090504040801
Content-Type: text/plain;
 name="ata-dmafix.diff"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline;
 filename="ata-dmafix.diff"

Index: ata-lowlevel.c
===================================================================
RCS file: /home/ncvs/src/sys/dev/ata/ata-lowlevel.c,v
retrieving revision 1.40
diff -u -r1.40 ata-lowlevel.c
--- ata-lowlevel.c	24 Jul 2004 19:03:28 -0000	1.40
+++ ata-lowlevel.c	6 Aug 2004 20:28:15 -0000
@@ -294,7 +294,7 @@
     }
 
     /* request finish here */
-    if (ch->dma->flags & ATA_DMA_ACTIVE)
+    if ((request->flags & ATA_R_DMA) && ch->dma->flags & ATA_DMA_ACTIVE)
 	ch->dma->unload(ch);
     ch->running = NULL;
     return ATA_OP_FINISHED;

--------------030405010909090504040801--