Greetings. I have a 3/260 with a Xylogics 451 controller and a
pair of Fujitsu-M2333 drives, and I've been playing with NetBSD on
it. Since I don't have a SCSI disk, I've been booting it diskless from
my i386 box. After I got it up and running, I compiled a kernel with
the Xylogics 450/451 devices added. This kernel crashed while booting,
right after printing the message that the xyc0 controller had been
found.

xyc0 at vmes0 addr 0xffffee40 level 2 vector 0x48panic: dvma_kvtopa: bad dmva addr 0x0

and dumps me into the debugger. The stack trace goes like this:

dvma_kvtopa
xyc_rqtopb
xyc_cmd
xycattach
config_attach
... and a bunch more stuff winding its way up the configuration chain.

Diving into the code (src/sys/arch/sun3/dev/xy.c) finds the following
interesting chain of events:

Line 387, xycattach()
	err = xyc_cmd(xyc, XYCMD_ST, 0, 0, 0, 0, 0, XY_SUB_POLL);

The last zero gets fed into char *dptr in xyc_cmd, which is next used
on line 1188:

	xyc_rqinit(iorq, xycsc,
	    (unit == XYC_NOUNIT) ? NULL : xycsc->sc_drives[unit],
	    fullmode, block, scnt, dptr, NULL);

.. where it gets fed into caddr_t db of xyc_rqinit(), which sticks it
in iorq->dbuf , returns to xyc_cmd which at line 1194 feeds it to xyc_rqtopb():

	xyc_rqtopb(iorq, iopb, cmd, subfn);

.. which on line 1122 goes and calls dvma_kvtopa():

	dp = dvma_kvtopa((long)iorq->dbuf, BUS_VME16);
 
   and promptly panics, since dbuf is a null pointer. 


	My understanding of NetBSD kernel and device driver internals
is none too great, so I don't really understand this code. It seems to
me that there's no way for that zero to avoid being used as a
parameter to dvma_kvtopa() and panicing. Does anyone know what ought
to be going on here? Has anyone successfully used the SMD code with
the 451 controller? 

	If anyone has suggestions or code, I'll be quite happy to try
them out and pound on the SMD support. 

	- Nathan	<nathanw@mit.edu>