Re: PowerEdge 2950 Dom0 panics in mfi(4) attach routines

[Christoph Egger <Christoph_Egger%gmx.de@localhost>]

Brian A. Seklecki wrote:
> Full dump at: 
>
> http://people.collaborativefusion.com/~seklecki/dellPE2950r3_xen31_nbsdCurrent_mfiPanic_040908.txt
>
>
> So close ... so close (This is -current/amd64 as of today):
>
> mfi0 at pci8 dev 14 function 0ioapic1: int14
> 1a9a8<vector=a8,delmode=1,logical,actlo,level,masked,dest=>
> : Dell PERC 5/i integrated
> mfi0: interrupting at ioapic1 pin 14, event channel 5
> mfi0: cannot create ccb dmamap (12)
> kernel: protection fault trap, code=0
> Stopped in pid 0.1 (system) at  netbsd:_bus_dmamap_destroy+0x23:
> testb   $
> 0x2,0(%rbx)
> _bus_dmamap_destroy() at netbsd:_bus_dmamap_destroy+0x23
> mfi_attach() at netbsd:mfi_attach+0x4ab
> mfi_pci_attach() at netbsd:mfi_pci_attach+0x163
> config_attach_loc() at netbsd:config_attach_loc+0x14d
> pci_probe_device() at netbsd:pci_probe_device+0x24c
> pci_enumerate_bus() at netbsd:pci_enumerate_bus+0x13b
> pcirescan() at netbsd:pcirescan+0x4f
> pciattach() at netbsd:pciattach+0x1b7
> config_attach_loc() at netbsd:config_attach_loc+0x14d
> ppbattach() at netbsd:ppbattach+0x15f
> config_attach_loc() at netbsd:config_attach_loc+0x14d
> pci_probe_device() at netbsd:pci_probe_device+0x24c
> pci_enumerate_bus() at netbsd:pci_enumerate_bus+0x13b
> pcirescan() at netbsd:pcirescan+0x4f
> pciattach() at netbsd:pciattach+0x1b7
> config_attach_loc() at netbsd:config_attach_loc+0x14d
> ppbattach() at netbsd:ppbattach+0x15f
> config_attach_loc() at netbsd:config_attach_loc+0x14d
> pci_probe_device() at netbsd:pci_probe_device+0x24c
> pci_enumerate_bus() at netbsd:pci_enumerate_bus+0x13b
> pcirescan() at netbsd:pcirescan+0x4f

Does the attached patch fix this kernel protection fault?


Christoph

Index: mfi.c
===================================================================
RCS file: /cvsroot/src/sys/dev/ic/mfi.c,v
retrieving revision 1.15
diff -u -p -r1.15 mfi.c
--- mfi.c       8 Apr 2008 12:07:26 -0000       1.15
+++ mfi.c       10 Apr 2008 20:22:10 -0000
@@ -231,10 +231,15 @@ mfi_init_ccb(struct mfi_softc *sc)
        return 0;
 destroy:
        /* free dma maps and ccb memory */
-       while (i) {
+       if (i > 0) {
+               i--; /* the failing index hasn't been allocated */
+               for (; i > 0; i--) {
+                       ccb = &sc->sc_ccb[i];
+                       bus_dmamap_destroy(sc->sc_dmat, ccb->ccb_dmamap);
+               }
+               KASSERT(i == 0);
                ccb = &sc->sc_ccb[i];
                bus_dmamap_destroy(sc->sc_dmat, ccb->ccb_dmamap);
-               i--;
        }
 
        free(sc->sc_ccb, M_DEVBUF);