>Number:         1483
>Category:       kern
>Synopsis:       ncr53c810 driver botches minphys, kills DIAGNOSTIC kernel
>Confidential:   no
>Severity:       serious
>Priority:       high
>Responsible:    kern-bug-people (Kernel Bug People)
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Tue Sep 19 21:50:05 1995
>Last-Modified:
>Originator:     John Kohl
>Organization:
NetBSD Kernel Hackers `R` Us
>Release:        NetBSD-current, 1995/09/19
>Environment:
	
System: NetBSD pattern 1.0A NetBSD 1.0A (PATTERN) #117: Tue Sep 19 21:26:33 EDT 1995 jtk@pattern:/u1/NetBSD-current/src/sys/arch/i386/compile/PATTERN i386


>Description:
raw I/O to a device on an NCR 53c810 PCI scsi controller (e.g. on i386
port) can lead to panic on DIAGNOSTIC kernel.

>How-To-Repeat:
	try saving a kernel crashdump (after applying previous fixes)
>Fix:
	ncr's idea of MAXPHYS is more than /sys/kern/kern_physio.c's
idea.  Clamp ncr's idea:

===================================================================
RCS file: RCS/ncr.c,v
retrieving revision 1.14.1.2
diff -c -r1.14.1.2 sys/dev/pci/ncr.c
*** sys/dev/pci/ncr.c	1995/08/13 12:36:47	1.14.1.2
--- sys/dev/pci/ncr.c	1995/09/20 01:25:35
***************
*** 3065,3072 ****
  ncr_minphys (struct  buf *bp)
  {
  
! 	if (bp->b_bcount > MAX_SIZE)
! 		bp->b_bcount = MAX_SIZE;
  	minphys(bp);
  }
  
--- 3065,3072 ----
  ncr_minphys (struct  buf *bp)
  {
  
! 	if (bp->b_bcount > min(MAX_SIZE,MAXPHYS))
! 		bp->b_bcount = min(MAX_SIZE,MAXPHYS);
  	minphys(bp);
  }
  

>Audit-Trail:
>Unformatted: