Date: Wed, 8 Nov 2000 12:58:59 -0800 (PST) From: twatson@chiaro.com To: freebsd-gnats-submit@FreeBSD.org Subject: kern/22700: IDE disk driver ad has defect when doing kernel dump using reboot -d on large memory system Message-ID: <20001108205859.651A737B479@hub.freebsd.org>
next in thread | raw e-mail | index | archive | help
>Number: 22700
>Category: kern
>Synopsis: IDE disk driver ad has defect when doing kernel dump using reboot -d on large memory system
>Confidential: no
>Severity: non-critical
>Priority: low
>Responsible: freebsd-bugs
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: sw-bug
>Submitter-Id: current-users
>Arrival-Date: Wed Nov 08 13:00:01 PST 2000
>Closed-Date:
>Last-Modified:
>Originator: Tom Watson
>Release: FreeBSD 4.0
>Organization:
Chiaro Networks, Ltd.
>Environment:
<not available or relevant>
>Description:
The function addump in file ata-disk.c is called with interrupts off to do a crashdump. This function calls ad_transfer to transfer a page size chunk. Ad_transfer calls timeout if panicstr is NULL. Not all dump situations result from a panic, e.g. "reboot -d", meaning panicstr isn't always NULL when doing a dump. The timeouts are never cleared by the interrupt handler since interrupts are disabled. Consequently, on large memory machines, the timeout table overflows and you panic during the crashdump with panic("timeout table full").
>How-To-Repeat:
Do a "reboot -d" with crash dumps configured on a 256 MB. machine with IDE swap device.
>Fix:
I changed the ata-disk.c driver as follows (calling untimeout in addump):
*** ata-disk.c Wed Nov 8 13:49:50 2000
--- ata-disk.c.orig Wed Nov 8 09:36:02 2000
***************
*** 293,299 ****
request.donecount += request.currentsize;
request.bytecount -= request.currentsize;
DELAY(20);
- untimeout((timeout_t *)ad_timeout, &request,request. timeout_handle);
}
if (addr % (1024 * 1024) == 0) {
--- 293,298 ----
***************
*** 363,368 ****
--- 362,370 ----
if (request->donecount == 0) {
/* start timeout for this transfer */
+ if (panicstr)
+ request->timeout_handle.callout = NULL;
+ else
request->timeout_handle =
timeout((timeout_t*)ad_timeout, request, 10 * hz);
>Release-Note:
>Audit-Trail:
>Unformatted:
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-bugs" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20001108205859.651A737B479>