cvs commit: src/sys/dev/ata ata-chipset.c

[Nate Lawson]

Sam Leffler wrote:
> SXren Schmidt wrote:
> 
>> sos         2005-01-01 19:24:25 UTC
>>
>>   FreeBSD src repository
>>
>>   Modified files:
>>     sys/dev/ata          ata-chipset.c   Log:
>>   Further update to the Promise code.
>>   Support should now cover all old and current products.
> 
> 
> My thinkpads continue to panic at boot with memory use after free when
> probing the DVD drive. I've been rolling back ata-queue.c to 1.39 to
> correct the problem. From a working boot:
> 
> aku# dmesg|grep ata
> atapci0: <Intel ICH4 UDMA100 controller> port
> 0x1860-0x186f,0x376,0x170-0x177,0x3f6,0x1f0-0x1f7 at device 31.1 on pci0
> ata0: channel #0 on atapci0
> ata1: channel #1 on atapci0
> ad0: 34796MB <IC25N040ATMR04-0/MO2OAD0A> [70697/16/63] at ata0-master
> UDMA100
> ata1-slave: FAILURE - ATAPI_IDENTIFY timed out
> ata1-slave: FAILURE - ATAPI_IDENTIFY timed out
> ata1-slave: FAILURE - ATAPI_IDENTIFY timed out
> acd0: DVDR <MATSHITADVD-RAM UJ-812/K104> at ata1-master UDMA33
> 
> When I told you this you said your code base had diverged too far from
> CVS to attempt to diagnose the problem.  Perhaps you have something else
> yet to commit that will remedy this?

This has been a recurring issue since about 8/2003 when ATAng appeared. 
  It has been fixed and then broken again several times.  I also spent 
some time looking into it so let me summarize what I know.

On Thinkpads with the included CD, DVD, DVD/CDRW, etc. drives, a phantom 
slave appears on the secondary channel even though there is no device 
there.  This "drive" appears to exist but doesn't respond to the 
IDENTIFY command.

The current ATA driver is event-driven and does its own error handling. 
  There's a timeout handler to attempt to restart commands if they don't 
respond.  When probing drives at boot, the IDENTIFY command sent to the 
"drive" times out and the timeout handler reinjects the command.  This 
command is started from a different path that it is synchronous, waiting 
until the command completes instead of doing the normal ata_start, 
interrupt, ata_done path.

Since the timeout path is different, past issues have included not 
reseting the residual count resulting in a memory overwrite.  The last 
time Soeren talked about these devices, he said he didn't have one and 
couldn't reproduce the error.  That's likely why the workaround for them 
keeps getting broken with updates to the rest of the driver.

-- 
Nate