From owner-freebsd-bugs  Wed Nov  8 13: 0: 7 2000
Delivered-To: freebsd-bugs@freebsd.org
Received: from freefall.freebsd.org (freefall.FreeBSD.org [216.136.204.21])
	by hub.freebsd.org (Postfix) with ESMTP id DCD2337B4C5
	for <freebsd-bugs@FreeBSD.org>; Wed,  8 Nov 2000 13:00:01 -0800 (PST)
Received: (from gnats@localhost)
	by freefall.freebsd.org (8.9.3/8.9.2) id NAA89873;
	Wed, 8 Nov 2000 13:00:01 -0800 (PST)
	(envelope-from gnats@FreeBSD.org)
Received: by hub.freebsd.org (Postfix, from userid 32767)
	id 651A737B479; Wed,  8 Nov 2000 12:58:59 -0800 (PST)
Message-Id: <20001108205859.651A737B479@hub.freebsd.org>
Date: Wed,  8 Nov 2000 12:58:59 -0800 (PST)
From: twatson@chiaro.com
To: freebsd-gnats-submit@FreeBSD.org
X-Send-Pr-Version: www-1.0
Subject: kern/22700: IDE disk driver ad has defect when doing kernel dump using reboot -d on large memory system
Sender: owner-freebsd-bugs@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.org


>Number:         22700
>Category:       kern
>Synopsis:       IDE disk driver ad has defect when doing kernel dump using reboot -d on large memory system
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Wed Nov 08 13:00:01 PST 2000
>Closed-Date:
>Last-Modified:
>Originator:     Tom Watson
>Release:        FreeBSD 4.0
>Organization:
Chiaro Networks, Ltd.
>Environment:
<not available or relevant>
>Description:
The function addump in file ata-disk.c is called with interrupts off to do a crashdump. This function calls ad_transfer to transfer a page size chunk. Ad_transfer calls timeout if panicstr is NULL. Not all dump situations result from a panic, e.g. "reboot -d", meaning panicstr isn't always NULL when doing a dump. The timeouts are never cleared by the interrupt handler since interrupts are disabled. Consequently, on large memory machines, the timeout table overflows and you panic during the crashdump with panic("timeout table full").
>How-To-Repeat:
Do a "reboot -d" with crash dumps configured on a 256 MB. machine with IDE swap device.
>Fix:
I changed the ata-disk.c driver as follows (calling untimeout in addump):
*** ata-disk.c	Wed Nov  8 13:49:50 2000
--- ata-disk.c.orig	Wed Nov  8 09:36:02 2000
***************
*** 293,299 ****
  	    request.donecount += request.currentsize;
  	    request.bytecount -= request.currentsize;
  	    DELAY(20);
- 	    untimeout((timeout_t *)ad_timeout, &request,request. timeout_handle);
  	}
  
  	if (addr % (1024 * 1024) == 0) {
--- 293,298 ----
***************
*** 363,368 ****
--- 362,370 ----
      if (request->donecount == 0) {
  
  	/* start timeout for this transfer */
+ 	if (panicstr)
+ 	    request->timeout_handle.callout = NULL;
+ 	else
  	    request->timeout_handle = 
  		timeout((timeout_t*)ad_timeout, request, 10 * hz);
  

>Release-Note:
>Audit-Trail:
>Unformatted:


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-bugs" in the body of the message