FreeBSD 6.x/7.x & mpt => "panic: Bad link elm 0xc406d450 next->prev != elm"

Hi,

i filled a PR (http://www.freebsd.org/cgi/query-pr.cgi?pr=115606) regarding
some problems i have with FreeBSD 6.x/7.x and the mpt controller.

Basically, any i/o activity on a disk attached to that controller brings a
panic.

mpt0: mpt_cam_event: 0xc0
mpt0: Unhandled Event Notify Frame. Event 0xc0afa2c0 (ACK not required).
mpt0: completing timedout/aborted req 0xc406d450:5896
panic: Bad link elm 0xc406d450 next->prev != elm
cpuid = 0
KDB: enter: panic
Dumping 1023 MB (2 chunks)
chunk 0: 1MB (157 pages) ... ok
chunk 1: 1023MB (261868 pages) 1007 991 975 959 943 927 911 895 879 863 847 831 815 799 783 767 751 735 719 703 687 671 655 639 623 607 591 575 559 543 527 511 495 479 463 447 431 415 399 383 367 351 335 319 303 287 271 255 239 223 207 191 175 159 143 127 111 95 79 63 47 31 15

#0 doadump () at pcpu.h:195
195 pcpu.h: No such file or directory.
in pcpu.h
(kgdb) bt
#0 doadump () at pcpu.h:195
H") at /usr/src/sys/ddb/db_command.c:486
#2 0xc048d095 in db_command_loop () at /usr/src/sys/ddb/db_command.c:401
#3 0xc048e805 in db_trap (type=3, code=0) at /usr/src/sys/ddb/db_main.c:222
#4 0xc0773066 in kdb_trap (type=3, code=0, tf=0xe43fcb80) at /usr/src/sys/kern/subr_kdb.c:502
#5 0xc09fd15b in trap (frame=0xe43fcb80) at /usr/src/sys/i386/i386/trap.c:621
#6 0xc09e2b7b in calltrap () at /usr/src/sys/i386/i386/exception.s:139
#7 0xc07731e2 in kdb_enter (msg=0xc0a93413 "panic") at cpufunc.h:60
#8 0xc074c3e4 in panic (fmt=0xc0a49d68 "Bad link elm %p next->prev != elm") at /usr/src/sys/kern/kern_shutdown.c:547
#9 0xc06065c5 in mpt_scsi_reply_handler (mpt=0xc4066000, req=0xc406d450, reply_desc=65820, reply_frame=0xe43fcc58) at /usr/src/sys/dev/mpt/mpt_cam.c:2661
#10 0xc06033be in mpt_complete_request_chain (mpt=0xc4066000, chain=0xc40663c4, iocstatus=8) at /usr/src/sys/dev/mpt/mpt.c:849
#11 0xc0606734 in mpt_cam_ioc_reset (mpt=0xc4066000, type=0) at /usr/src/sys/dev/mpt/mpt_cam.c:3041
#12 0xc0604acf in mpt_reset (mpt=0xc4066000, reinit=1) at /usr/src/sys/dev/mpt/mpt.c:1145
#13 0xc0607bf2 in mpt_recovery_thread (arg=0xc4066000) at /usr/src/sys/dev/mpt/mpt_cam.c:4176
#14 0xc072e258 in fork_exit (callout=0xc0607920 <mpt_recovery_thread>, arg=0xc4066000, frame=0xe43fcd38) at /usr/src/sys/kern/kern_fork.c:797
#15 0xc09e2bf0 in fork_trampoline () at /usr/src/sys/i386/i386/exception.s:205
#1 0xc048cb29 in db_fncall (dummy1=-465581460, dummy2=0, dummy3=524358, dummy4=0xe43fc9d8 "

kernel.debug and vmcore are available here:

fetch http://people.tomato.it/piso/vmcore.1.gz
fetch http://people.tomato.it/piso/kernel.debug.gz

On FreeBSD 6.x the panic was different, something like "trap 12: page fault in kernel mode" in softclock thread
then i updated the box to 7.x to see if the panic was fixed. The same hw worked flawlessly with FreeBSD 4.x.

Hope someone can shed some light.

bye,
P.