>Number:         24655
>Category:       kern
>Synopsis:       kernel panic with mpt(4) while stoppping disks
>Confidential:   no
>Severity:       serious
>Priority:       low
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Wed Mar 03 13:01:00 UTC 2004
>Closed-Date:
>Last-Modified:
>Originator:     Nicolas Joly
>Release:        NetBSD 1.6ZK (-current 20040303)
>Organization:
	Institut Pasteur
>Environment:
System: NetBSD calimero.sis.pasteur.fr 1.6ZK NetBSD 1.6ZK (CALIMERO) #7: Wed Mar 3 11:25:41 CET 2004 njoly@calimero.sis.pasteur.fr:/local/src/NetBSD/obj/amd64/sys/arch/amd64/compile/CALIMERO amd64
Architecture: x86_64
Machine: amd64
>Description:
I just hit a kernel panic in mpt(4) scsci driver while attempting to stop a
disk (currently unused) with scsictl(8) command :

root@calimero [~]# scsictl sd2 identify
/dev/rsd2d: scsibus0 target 2 lun 0 <IBM, IC35L036UCDY10-0, S27E>
root@calimero [~]# scsictl sd2 stop
/dev/rsd2d: SCSI command timed out

sd2(mpt0:0:2:0): command timeout
mpt0: timeout on request index = 0xf2, seq = 0x0000088b
mpt0: Status 0x00000000, Mask 0x00000001, Doorbell 0x24000000
mpt0: request state: On Chip
mpt0: mpt_done: no scsipi_xfer, index = 0xf2, seq = 0x00000000
mpt0: request state: Free
mpt0: mpt_request:
SCSI IO Request @ 0xffff800012574e38
        Chain Offset  0x00
        MsgFlags      0x00
        MsgContext    0x000000f2
        Bus:                0
        TargetID            0
        SenseBufferLength   32
        LUN:              0x0
        Control           0x01000000  WRITE  SIMPLEQ 
        DataLength      0x00002000
        SenseBufAddr    0x0b5ca5e0
        CDB[0:10]       2a 00 02 20 c8 4e 00 00 10 00 
        SE32 0xffff800012c9f430: Addr=0xe772000 FlagsLength=0xd5002000
         HOST_TO_IOC LAST_ELEMENT END_OF_BUFFER END_OF_LIST
mpt0: context reply: 0x000000f2
panic: mpt_get_request: corrupted request free list (xfer)

Stopped in pid 13.1 (ioflush) at        netbsd:cpu_Debugger+0x5:
db{0}> bt
cpu_Debugger() at netbsd:cpu_Debugger+0x5
panic() at netbsd:panic+0x1c8
mpt_get_request() at netbsd:mpt_get_request+0x54
mpt_run_xfer() at netbsd:mpt_run_xfer+0x45
scsipi_run_queue() at netbsd:scsipi_run_queue+0x166
scsipi_execute_xs() at netbsd:scsipi_execute_xs+0x1e1
scsi_scsipi_cmd() at netbsd:scsi_scsipi_cmd+0xa9
scsipi_command() at netbsd:scsipi_command+0x7f
sdstart() at netbsd:sdstart+0x16b
sdstrategy() at netbsd:sdstrategy+0x190
spec_strategy() at netbsd:spec_strategy+0x1cd
VOP_STRATEGY() at netbsd:VOP_STRATEGY+0x2a
bwrite() at netbsd:bwrite+0x151
VOP_BWRITE() at netbsd:VOP_BWRITE+0x2a
ffs_cgupdate() at netbsd:ffs_cgupdate+0xbb
ffs_sync() at netbsd:ffs_sync+0x181
sync_fsync() at netbsd:sync_fsync+0xbc
VOP_FSYNC() at netbsd:VOP_FSYNC+0x39
sched_sync() at netbsd:sched_sync+0x219

mpt0 at pci2 dev 10 function 0: LSI Logic 53c1030 Ultra320 SCSI
mpt0: interrupting at ioapic1 pin 0 (irq 5)
scsibus0 at mpt0: 16 targets, 8 luns per target
mpt1 at pci2 dev 10 function 1: LSI Logic 53c1030 Ultra320 SCSI
mpt1: interrupting at ioapic1 pin 1 (irq 10)
scsibus1 at mpt1: 16 targets, 8 luns per target
[...]
sd0 at scsibus0 target 0 lun 0: <IBM, IC35L036UCDY10-0, S27E> disk fixed
sd0: 35003 MB, 36703 cyl, 3 head, 651 sec, 512 bytes/sect x 71687340 sectors
sd0: sync (6.25ns offset 127), 16-bit (320.000MB/s) transfers, tagged queueing
sd1 at scsibus0 target 1 lun 0: <IBM, IC35L036UCDY10-0, S23C> disk fixed
sd1: 35003 MB, 36703 cyl, 3 head, 651 sec, 512 bytes/sect x 71687340 sectors
sd1: sync (6.25ns offset 127), 16-bit (320.000MB/s) transfers, tagged queueing
sd2 at scsibus0 target 2 lun 0: <IBM, IC35L036UCDY10-0, S27E> disk fixed
sd2: 35003 MB, 36703 cyl, 3 head, 651 sec, 512 bytes/sect x 71687340 sectors
sd2: sync (6.25ns offset 127), 16-bit (320.000MB/s) transfers, tagged queueing
sd3 at scsibus0 target 3 lun 0: <SEAGATE, ST318275LC, 0001> disk fixed
sd3: 17366 MB, 11721 cyl, 10 head, 303 sec, 512 bytes/sect x 35566480 sectors
sd3: sync (25.00ns offset 15), 16-bit (80.000MB/s) transfers, tagged queueing

>How-To-Repeat:
scscictl sd2 stop
>Fix:
unknown
>Release-Note:
>Audit-Trail:
>Unformatted: