diff options
| author | jkh <jkh@FreeBSD.org> | 1999-05-11 11:03:18 +0000 |
|---|---|---|
| committer | jkh <jkh@FreeBSD.org> | 1999-05-11 11:03:18 +0000 |
| commit | c419340e61b2dfc42b30b0f84bb59219cc032d17 (patch) | |
| tree | 6cdce7273abfc166e060fb9eb591dc526bf3d2e2 /sys/dev/dpt | |
| parent | 9a5315b2f67f70d3521e675bb1981d9eef763873 (diff) | |
| download | FreeBSD-src-c419340e61b2dfc42b30b0f84bb59219cc032d17.zip FreeBSD-src-c419340e61b2dfc42b30b0f84bb59219cc032d17.tar.gz | |
During probe, the page lockdown code in dpt_control.c does some
bad math: it does not handle page-boundary conditions, and will not
end up mapping all of the requested addresses. This will cause a panic:
page fault during probe on some systems. I have a machine that will
panic every time (when using the dpt driver) on kernel probe when there
are 5 drives installed. When there are 4 drives, it is fine.
Fix is to always allocate/deallocate an extra page.
There is also a bonus splx() fix on an early error return.
Submitted by: Mark J. Taylor <mtaylor@cybernet.com>
PR: 9367
Diffstat (limited to 'sys/dev/dpt')
| -rw-r--r-- | sys/dev/dpt/dpt_control.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/sys/dev/dpt/dpt_control.c b/sys/dev/dpt/dpt_control.c index b28fb67..e117b99 100644 --- a/sys/dev/dpt/dpt_control.c +++ b/sys/dev/dpt/dpt_control.c @@ -36,7 +36,7 @@ * future. */ -#ident "$Id: dpt_control.c,v 1.9 1998/09/15 08:33:31 gibbs Exp $" +#ident "$Id: dpt_control.c,v 1.10 1998/12/04 22:54:45 archie Exp $" #include "opt_dpt.h" @@ -150,6 +150,7 @@ dpt_physmap(u_int32_t req_paddr, vm_size_t req_size) if (va == (vm_offset_t) 0) return (va); + size += PAGE_SIZE; for (ndx = 0; ndx < size; ndx += PAGE_SIZE) { pmap_kenter(va + ndx, paddr + ndx); invltlb(); @@ -161,7 +162,7 @@ dpt_physmap(u_int32_t req_paddr, vm_size_t req_size) /* * Release virtual space allocated by physmap We ASSUME that the correct - * srart address and the correct LENGTH are given. + * start address and the correct LENGTH are given. * * Disaster will follow if these assumptions are false! */ @@ -419,6 +420,7 @@ dpt_open(dev_t dev, int flags, int fmt, struct proc * p) printf("dpt%d: Failed to obtain an I/O buffer\n", minor_no & ~SCSI_CONTROL_MASK); #endif + splx(ospl); return (EINVAL); } } |
