Kernel panic when reboot on server with a Promise SX4000 and two ATA disks RAID1.

[Magnus Kling]

2009/5/20 Alexander Motin <mav at freebsd.org>

> Magnus Kling wrote:
>
>> Addr2line gives me /usr/src/sys/dev/ata/chipsets/ata-promise.c:1066
>>
>> struct ata_dma_prdentry *prd = request->dma->sg;
>>
>> Can we do an if statement with pointer prd? Or check what "sg" is at the
>> moment? What is "sg"?
>>
>
> A-ha! That explains a lot! I have got it!
>
> Flush command has no data and does not uses DMA. Dereference of NULL
> request->dma pointer crashes the system. That dereference is just not needed
> there. Try please attached patch.
>
> --
> Alexander Motin
>
> --- ata-promise.c.prev  2009-05-20 01:24:31.000000000 +0300
> +++ ata-promise.c       2009-05-20 09:51:13.000000000 +0300
> @@ -1054,7 +1054,7 @@ ata_promise_sx4_command(struct ata_reque
>     device_t gparent = GRANDPARENT(request->dev);
>     struct ata_pci_controller *ctlr = device_get_softc(gparent);
>     struct ata_channel *ch = device_get_softc(request->parent);
> -    struct ata_dma_prdentry *prd = request->dma->sg;
> +    struct ata_dma_prdentry *prd;
>     caddr_t window = rman_get_virtual(ctlr->r_res1);
>     u_int32_t *wordp;
>     int i, idx, length = 0;
> @@ -1098,6 +1098,7 @@ ata_promise_sx4_command(struct ata_reque
>     case ATA_READ_DMA48:
>     case ATA_WRITE_DMA:
>     case ATA_WRITE_DMA48:
> +       prd = request->dma->sg;
>        wordp = (u_int32_t *)
>            (window + (ch->unit * ATA_PDC_CHN_OFFSET) + ATA_PDC_HSG_OFFSET);
>        i = idx = 0;
>
>
I can confirm that the above patch works fine!
Thank you for taking your time to solve this bug.

/Magnus