Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id ; Thu, 6 Feb 2003 17:20:56 -0500 Received: (majordomo@vger.kernel.org) by vger.kernel.org id ; Thu, 6 Feb 2003 17:20:56 -0500 Received: from franka.aracnet.com ([216.99.193.44]:38106 "EHLO franka.aracnet.com") by vger.kernel.org with ESMTP id ; Thu, 6 Feb 2003 17:20:50 -0500 Date: Thu, 06 Feb 2003 14:30:09 -0800 From: "Martin J. Bligh" To: James Bottomley , mikeand@us.ibm.com cc: linux-kernel@vger.kernel.org Subject: Re: Broken SCSI code in the BK tree (was: 2.5.59-mm8) Message-ID: <275930000.1044570608@[10.10.2.4]> In-Reply-To: <265170000.1044564655@[10.10.2.4]> References: <20030203233156.39be7770.akpm@digeo.com><167540000.1044346173@[10.10.2.4]> <20030204001709.5e2942e8.akpm@digeo.com><384960000.1044396931@flay> <211570000.1044508407@[10.10.2.4]> <265170000.1044564655@[10.10.2.4]> X-Mailer: Mulberry/2.2.1 (Linux/x86) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Content-Disposition: inline Sender: linux-kernel-owner@vger.kernel.org X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 18604 Lines: 390 > OK, I threw a little bit of debug in there: > I'd show you the code, except it just ate my root filesystem. > Likelihood of me doing further research is thus small. Hmmmm .... did a disassemble of this on a similar machine (see end of email) data seems to contradict what I was looking at previously .... not sure what happened, but this set makes much more sense, as it leads to 13c in the offset ;-) 0xc01c1ac6 : mov %eax,0x13c(%ebp) which is drivers/scsi/qlogicisp.c:1051 Cmnd->result = isp1020_return_status(sts); seemingly Cmnd is null ... this is in while (out_ptr != in_ptr) { u_int cmd_slot; sts = (struct Status_Entry *) &hostdata->res_cpu[out_ptr]; out_ptr = (out_ptr + 1) & RES_QUEUE_LEN; cmd_slot = sts->handle; Cmnd = hostdata->cmd_slots[cmd_slot]; hostdata->cmd_slots[cmd_slot] = NULL; TRACE("done", out_ptr, Cmnd); if (le16_to_cpu(sts->completion_status) == CS_RESET_OCCURRED || le16_to_cpu(sts->completion_status) == CS_ABORTED || (le16_to_cpu(sts->status_flags) & STF_BUS_RESET)) hostdata->send_marker = 1; if (le16_to_cpu(sts->state_flags) & SF_GOT_SENSE) memcpy(Cmnd->sense_buffer, sts->req_sense_data, sizeof(Cmnd->sense_buffer)); DEBUG_INTR(isp1020_print_status_entry(sts)); if (sts->hdr.entry_type == ENTRY_STATUS) Cmnd->result = isp1020_return_status(sts); else Cmnd->result = DID_ERROR << 16; if (Cmnd->use_sg) pci_unmap_sg(hostdata->pci_dev, (struct scatterlist *)Cmnd->buffer, Cmnd->use_sg, scsi_to_pci_dma_dir(Cmnd->sc_data_direction)); else if (Cmnd->request_bufflen) pci_unmap_single(hostdata->pci_dev, #ifdef CONFIG_QL_ISP_A64 (dma_addr_t)((long)Cmnd->SCp.ptr), #else (u32)((long)Cmnd->SCp.ptr), #endif Cmnd->request_bufflen, scsi_to_pci_dma_dir(Cmnd->sc_data_direction)); isp_outw(out_ptr, host, MBOX5); (*Cmnd->scsi_done)(Cmnd); } Changes in this patch to qlogicisp.c were as below. Looks suspciciously close to the problem area to me, but I don't understand it enough to say for sure (if this wasn't related to some SCSI subsystem change, can I just revert out this section?) M. # drivers/scsi/qlogicisp.c 1.15 -> 1.17 diff -Nru a/drivers/scsi/qlogicisp.c b/drivers/scsi/qlogicisp.c --- a/drivers/scsi/qlogicisp.c Mon Feb 3 21:31:47 2003 +++ b/drivers/scsi/qlogicisp.c Mon Feb 3 21:31:47 2003 @@ -802,7 +802,7 @@ ENTER("isp1020_queuecommand"); - host = Cmnd->host; + host = Cmnd->device->host; hostdata = (struct isp1020_hostdata *) host->hostdata; Cmnd->scsi_done = done; @@ -853,8 +853,8 @@ cmd->hdr.entry_type = ENTRY_COMMAND; cmd->hdr.entry_cnt = 1; - cmd->target_lun = Cmnd->lun; - cmd->target_id = Cmnd->target; + cmd->target_lun = Cmnd->device->lun; + cmd->target_id = Cmnd->device->id; cmd->cdb_length = cpu_to_le16(Cmnd->cmd_len); cmd->control_flags = cpu_to_le16(CFLAG_READ | CFLAG_WRITE); cmd->time_out = cpu_to_le16(30); @@ -1175,7 +1175,7 @@ ENTER("isp1020_abort"); - host = Cmnd->host; + host = Cmnd->device->host; hostdata = (struct isp1020_hostdata *) host->hostdata; for (i = 0; i < QLOGICISP_REQ_QUEUE_LEN + 1; i++) @@ -1186,7 +1186,7 @@ isp1020_disable_irqs(host); param[0] = MBOX_ABORT; - param[1] = (((u_short) Cmnd->target) << 8) | Cmnd->lun; + param[1] = (((u_short) Cmnd->device->id) << 8) | Cmnd->device->lun; param[2] = cmd_cookie >> 16; param[3] = cmd_cookie & 0xffff; @@ -1214,7 +1214,7 @@ ENTER("isp1020_reset"); - host = Cmnd->host; + host = Cmnd->device->host; hostdata = (struct isp1020_hostdata *) host->hostdata; param[0] = MBOX_BUS_RESET; >> Unable to handle kernel NULL pointer dereference at virtual address >> 0000013c printing eip: >> c01c1986 >> *pde = 00000000 >> Oops: 0002 >> CPU: 3 >> EIP: 0060:[] Not tainted >> EFLAGS: 00010046 >> EIP is at isp1020_intr_handler+0x1e6/0x290 >> eax: 00000000 ebx: f7c42080 ecx: 00000000 edx: 00000054 >> esi: 00000002 edi: 00000013 ebp: 00000000 esp: f7f97efc >> ds: 007b es: 007b ss: 0068 >> Process swapper (pid: 0, threadinfo=f7f96000 task=f7f9d240) >> Stack: f7c42080 f7c52800 00000002 00000013 f7f97f80 00000003 00000003 >> f7c5289c f7c52800 c01c1791 00000013 f7c52800 f7f97f80 f7ffe1e0 >> 24000001 c010a815 00000013 f7c52800 f7f97f80 c028fa60 00000260 >> 00000013 f7f97f78 c010a9e6 Call Trace: >> [] do_isp1020_intr_handler+0x25/0x34 >> [] handle_IRQ_event+0x29/0x4c >> [] do_IRQ+0x96/0x100 >> [] default_idle+0x0/0x34 >> [] common_interrupt+0x18/0x20 >> [] default_idle+0x0/0x34 >> [] default_idle+0x29/0x34 >> [] cpu_idle+0x37/0x48 >> [] printk+0x149/0x160 >> >> Code: 89 85 3c 01 00 00 83 c4 04 eb 0a c7 85 3c 01 00 00 00 00 07 >> <0>Kernel panic: Aiee, killing interrupt handler! >> In interrupt handler - not syncing Dump of assembler code for function isp1020_intr_handler: 0xc01c18e0 : sub $0x10,%esp 0xc01c18e3 : push %ebp 0xc01c18e4 : push %edi 0xc01c18e5 : push %esi 0xc01c18e6 : push %ebx 0xc01c18e7 : mov 0x28(%esp,1),%eax 0xc01c18eb : mov %eax,0x1c(%esp,1) 0xc01c18ef : mov 0x1c(%esp,1),%edx 0xc01c18f3 : add $0x9c,%eax 0xc01c18f8 : mov %eax,0x18(%esp,1) 0xc01c18fc : mov 0x9c(%edx),%eax 0xc01c1902 : test %eax,%eax 0xc01c1904 : je 0xc01c1910 0xc01c1906 : movzwl 0xa(%eax),%eax 0xc01c190a : jmp 0xc01c191c 0xc01c190c : lea 0x0(%esi,1),%esi 0xc01c1910 : mov 0x1c(%esp,1),%eax 0xc01c1914 : mov 0x6c(%eax),%edx 0xc01c1917 : add $0xa,%edx 0xc01c191a : in (%dx),%ax 0xc01c191c : test $0x4,%al 0xc01c191e : je 0xc01c1b66 0xc01c1924 : mov 0x1c(%esp,1),%edx 0xc01c1928 : mov 0x9c(%edx),%eax 0xc01c192e : test %eax,%eax 0xc01c1930 : je 0xc01c1938 0xc01c1932 : movzwl 0x7a(%eax),%eax 0xc01c1936 : jmp 0xc01c1944 0xc01c1938 : mov 0x1c(%esp,1),%eax 0xc01c193c : mov 0x6c(%eax),%edx 0xc01c193f : add $0x7a,%edx 0xc01c1942 : in (%dx),%ax 0xc01c1944 : mov 0x1c(%esp,1),%edx 0xc01c1948 : movzwl %ax,%eax 0xc01c194b : mov %eax,0x14(%esp,1) 0xc01c194f : mov $0x7000,%ecx 0xc01c1954 : mov 0x9c(%edx),%eax 0xc01c195a : test %eax,%eax 0xc01c195c : je 0xc01c1967 0xc01c195e : mov %cx,0xc0(%eax) 0xc01c1965 : jmp 0xc01c1978 0xc01c1967 : mov 0x1c(%esp,1),%eax 0xc01c196b : mov 0x6c(%eax),%edx 0xc01c196e : add $0xc0,%edx 0xc01c1974 : mov %ecx,%eax 0xc01c1976 : out %ax,(%dx) 0xc01c1978 : mov 0x1c(%esp,1),%edx 0xc01c197c : mov 0x9c(%edx),%eax 0xc01c1982 : test %eax,%eax 0xc01c1984 : je 0xc01c1990 0xc01c1986 : movzwl 0xc(%eax),%eax 0xc01c198a : jmp 0xc01c199c 0xc01c198c : lea 0x0(%esi,1),%esi 0xc01c1990 : mov 0x1c(%esp,1),%eax 0xc01c1994 : mov 0x6c(%eax),%edx 0xc01c1997 : add $0xc,%edx 0xc01c199a : in (%dx),%ax 0xc01c199c : test $0x1,%al 0xc01c199e : je 0xc01c1a34 0xc01c19a4 : mov 0x1c(%esp,1),%edx 0xc01c19a8 : mov 0x9c(%edx),%eax 0xc01c19ae : test %eax,%eax 0xc01c19b0 : je 0xc01c19b8 0xc01c19b2 : movzwl 0x70(%eax),%eax 0xc01c19b6 : jmp 0xc01c19c4 0xc01c19b8 : mov 0x1c(%esp,1),%eax 0xc01c19bc : mov 0x6c(%eax),%edx 0xc01c19bf : add $0x70,%edx 0xc01c19c2 : in (%dx),%ax 0xc01c19c4 : movzwl %ax,%eax 0xc01c19c7 : cmp $0x4006,%eax 0xc01c19cc : jg 0xc01c19e5 0xc01c19ce : cmp $0x4005,%eax 0xc01c19d3 : jge 0xc01c1a03 0xc01c19d5 : cmp $0x4002,%eax 0xc01c19da : jg 0xc01c1a10 0xc01c19dc : cmp $0x4001,%eax 0xc01c19e1 : jl 0xc01c1a10 0xc01c19e3 : jmp 0xc01c1a03 0xc01c19e5 : cmp $0x8001,%eax 0xc01c19ea : je 0xc01c19f3 0xc01c19ec : cmp $0x8006,%eax 0xc01c19f1 : jne 0xc01c1a10 0xc01c19f3 : mov 0x18(%esp,1),%edx 0xc01c19f7 : movl $0x1,0xf8(%edx) 0xc01c1a01 : jmp 0xc01c1a10 0xc01c1a03 : push $0xc0246f20 0xc01c1a08 : call 0xc0119bd8 0xc01c1a0d : add $0x4,%esp 0xc01c1a10 : mov 0x1c(%esp,1),%edx 0xc01c1a14 : mov 0x9c(%edx),%eax 0xc01c1a1a : test %eax,%eax 0xc01c1a1c : je 0xc01c1a26 0xc01c1a1e : movw $0x0,0xc(%eax) 0xc01c1a24 : jmp 0xc01c1a34 0xc01c1a26 : mov 0x1c(%esp,1),%eax 0xc01c1a2a : mov 0x6c(%eax),%edx 0xc01c1a2d : add $0xc,%edx 0xc01c1a30 : xor %eax,%eax 0xc01c1a32 : out %ax,(%dx) 0xc01c1a34 : mov 0x18(%esp,1),%edx 0xc01c1a38 : mov 0x14(%esp,1),%eax 0xc01c1a3c : mov 0xf4(%edx),%edx 0xc01c1a42 : mov %edx,0x10(%esp,1) 0xc01c1a46 : cmp %eax,%edx 0xc01c1a48 : je 0xc01c1b58 0xc01c1a4e : mov %esi,%esi 0xc01c1a50 : mov 0x10(%esp,1),%ebx 0xc01c1a54 : mov 0x18(%esp,1),%edx 0xc01c1a58 : mov 0x18(%esp,1),%eax 0xc01c1a5c : shl $0x6,%ebx 0xc01c1a5f : add $0xfc,%eax 0xc01c1a64 : add 0xe8(%edx),%ebx 0xc01c1a6a : incl 0x10(%esp,1) 0xc01c1a6e : andl $0x7,0x10(%esp,1) 0xc01c1a73 : mov 0x4(%ebx),%edx 0xc01c1a76 : shl $0x2,%edx 0xc01c1a79 : mov (%edx,%eax,1),%ebp 0xc01c1a7c : movl $0x0,(%edx,%eax,1) 0xc01c1a83 : movzwl 0xa(%ebx),%eax 0xc01c1a87 : add $0xfffffffc,%ax 0xc01c1a8b : cmp $0x1,%ax 0xc01c1a8f : jbe 0xc01c1a97 0xc01c1a91 : testb $0x8,0xe(%ebx) 0xc01c1a95 : je 0xc01c1aa5 0xc01c1a97 : mov 0x18(%esp,1),%eax 0xc01c1a9b : movl $0x1,0xf8(%eax) 0xc01c1aa5 : testb $0x20,0xd(%ebx) 0xc01c1aa9 : je 0xc01c1abb 0xc01c1aab : lea 0xc0(%ebp),%edi 0xc01c1ab1 : lea 0x20(%ebx),%esi 0xc01c1ab4 : mov $0x10,%ecx 0xc01c1ab9 : repz movsl %ds:(%esi),%es:(%edi) 0xc01c1abb : cmpb $0x3,(%ebx) 0xc01c1abe : jne 0xc01c1ad1 0xc01c1ac0 : push %ebx 0xc01c1ac1 : call 0xc01c1b70 0xc01c1ac6 : mov %eax,0x13c(%ebp) 0xc01c1acc : add $0x4,%esp 0xc01c1acf : jmp 0xc01c1adb 0xc01c1ad1 : movl $0x70000,0x13c(%ebp) 0xc01c1adb : cmpw $0x0,0x9e(%ebp) 0xc01c1ae3 : je 0xc01c1af5 0xc01c1ae5 : cmpb $0x3,0x52(%ebp) 0xc01c1ae9 : jne 0xc01c1b10 0xc01c1aeb : ud2a 0xc01c1aed : inc %ebp 0xc01c1aee : add %ch,%bl 0xc01c1af0 : out %al,(%dx) 0xc01c1af1 : and %eax,%eax 0xc01c1af3 : jmp 0xc01c1b10 0xc01c1af5 : cmpl $0x0,0x64(%ebp) 0xc01c1af9 : je 0xc01c1b10 0xc01c1afb : cmpb $0x3,0x52(%ebp) 0xc01c1aff : jne 0xc01c1b10 0xc01c1b01 : ud2a 0xc01c1b03 : sbb $0x0,%al 0xc01c1b05 : jmp 0xc01c1af5 0xc01c1b07 : and %eax,%eax 0xc01c1b09 : lea 0x0(%esi,1),%esi 0xc01c1b10 : mov 0x1c(%esp,1),%edx 0xc01c1b14 : mov 0x10(%esp,1),%ecx 0xc01c1b18 : mov 0x9c(%edx),%eax 0xc01c1b1e : test %eax,%eax 0xc01c1b20 : je 0xc01c1b30 0xc01c1b22 : mov %ecx,%edx 0xc01c1b24 : mov %dx,0x7a(%eax) 0xc01c1b28 : jmp 0xc01c1b3e 0xc01c1b2a : lea 0x0(%esi),%esi 0xc01c1b30 : mov 0x1c(%esp,1),%eax 0xc01c1b34 : mov 0x6c(%eax),%edx 0xc01c1b37 : add $0x7a,%edx 0xc01c1b3a : mov %ecx,%eax 0xc01c1b3c : out %ax,(%dx) 0xc01c1b3e : push %ebp 0xc01c1b3f : mov 0x108(%ebp),%eax 0xc01c1b45 : call *%eax 0xc01c1b47 : add $0x4,%esp 0xc01c1b4a : mov 0x14(%esp,1),%edx 0xc01c1b4e : cmp %edx,0x10(%esp,1) 0xc01c1b52 : jne 0xc01c1a50 0xc01c1b58 : mov 0x10(%esp,1),%edx 0xc01c1b5c : mov 0x18(%esp,1),%eax 0xc01c1b60 : mov %edx,0xf4(%eax) 0xc01c1b66 : pop %ebx 0xc01c1b67 : pop %esi 0xc01c1b68 : pop %edi 0xc01c1b69 : pop %ebp 0xc01c1b6a : add $0x10,%esp 0xc01c1b6d : ret End of assembler dump. - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/