OOPS: deref 0x14 at pdc_port_start+0x82 [Was: 2.6.20-rc1-mm1]

OOPS: deref 0x14 at pdc_port_start+0x82 [Was: 2.6.20-rc1-mm1]

[Jiri Slaby]

Andrew Morton wrote:
> Temporarily at
> 
> 	http://userweb.kernel.org/~akpm/2.6.20-rc1-mm1/
> 
> Will appear later at
> 
> 	ftp://ftp.kernel.org/pub/linux/kernel/people/akpm/patches/2.6/2.6.20-rc1/2.6.20-rc1-mm1/

The kernel panics at boot in pdc_port_start+0x82 with deref of 0x14:
http://www.fi.muni.cz/~xslaby/sklad/pdc_oops.png

ATA port is not connected, only 2 SATA disks on my
# lspci -vvxs 02:01.0
02:01.0 Mass storage controller: Promise Technology, Inc. PDC40775 (SATA 300
TX2plus) (rev 02)
        Subsystem: Promise Technology, Inc. PDC40775 (SATA 300 TX2plus)
        Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr-
Stepping- SERR- FastB2B-
        Status: Cap+ 66MHz+ UDF- FastB2B- ParErr- DEVSEL=medium >TAbort-
<TAbort- <MAbort- >SERR- <PERR-
        Latency: 72 (1000ns min, 4500ns max), Cache Line Size: 4 bytes
        Interrupt: pin A routed to IRQ 19
        Region 0: I/O ports at 8000 [size=128]
        Region 2: I/O ports at 8400 [size=256]
        Region 3: Memory at fb025000 (32-bit, non-prefetchable) [size=4K]
        Region 4: Memory at fb000000 (32-bit, non-prefetchable) [size=128K]
        [virtual] Expansion ROM at 50000000 [disabled] [size=32K]
        Capabilities: [60] Power Management version 2
                Flags: PMEClk- DSI+ D1+ D2- AuxCurrent=0mA
PME(D0-,D1-,D2-,D3hot-,D3cold-)
                Status: D0 PME-Enable- DSel=0 DScale=0 PME-
00: 5a 10 73 3d 07 00 30 02 02 00 80 01 01 48 00 00
10: 01 80 00 00 00 00 00 00 01 84 00 00 00 50 02 fb
20: 00 00 00 fb 00 00 00 00 00 00 00 00 5a 10 73 3d
30: 00 00 00 00 60 00 00 00 00 00 00 00 0a 01 04 12

2.6.19-rc6-mm2 is OK (2.6.19-mm1 untested and won't be)

regards,
-- 
http://www.fi.muni.cz/~xslaby/            Jiri Slaby
faculty of informatics, masaryk university, brno, cz
e-mail: jirislaby gmail com, gpg pubkey fingerprint:
B674 9967 0407 CE62 ACC8  22A0 32CC 55C3 39D4 7A7E

Re: OOPS: deref 0x14 at pdc_port_start+0x82 [Was: 2.6.20-rc1-mm1]

[Andrew Morton]

On Fri, 15 Dec 2006 15:45:55 +0059
Jiri Slaby <jirislaby@gmail.com> wrote:

> Andrew Morton wrote:
> > Temporarily at
> > 
> > 	http://userweb.kernel.org/~akpm/2.6.20-rc1-mm1/
> > 
> > Will appear later at
> > 
> > 	ftp://ftp.kernel.org/pub/linux/kernel/people/akpm/patches/2.6/2.6.20-rc1/2.6.20-rc1-mm1/
> 
> The kernel panics at boot in pdc_port_start+0x82 with deref of 0x14:
> http://www.fi.muni.cz/~xslaby/sklad/pdc_oops.png
> 
> ATA port is not connected, only 2 SATA disks on my
> # lspci -vvxs 02:01.0
> 02:01.0 Mass storage controller: Promise Technology, Inc. PDC40775 (SATA 300
> TX2plus) (rev 02)
>         Subsystem: Promise Technology, Inc. PDC40775 (SATA 300 TX2plus)
>         Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr-
> Stepping- SERR- FastB2B-
>         Status: Cap+ 66MHz+ UDF- FastB2B- ParErr- DEVSEL=medium >TAbort-
> <TAbort- <MAbort- >SERR- <PERR-
>         Latency: 72 (1000ns min, 4500ns max), Cache Line Size: 4 bytes
>         Interrupt: pin A routed to IRQ 19
>         Region 0: I/O ports at 8000 [size=128]
>         Region 2: I/O ports at 8400 [size=256]
>         Region 3: Memory at fb025000 (32-bit, non-prefetchable) [size=4K]
>         Region 4: Memory at fb000000 (32-bit, non-prefetchable) [size=128K]
>         [virtual] Expansion ROM at 50000000 [disabled] [size=32K]
>         Capabilities: [60] Power Management version 2
>                 Flags: PMEClk- DSI+ D1+ D2- AuxCurrent=0mA
> PME(D0-,D1-,D2-,D3hot-,D3cold-)
>                 Status: D0 PME-Enable- DSel=0 DScale=0 PME-
> 00: 5a 10 73 3d 07 00 30 02 02 00 80 01 01 48 00 00
> 10: 01 80 00 00 00 00 00 00 01 84 00 00 00 50 02 fb
> 20: 00 00 00 fb 00 00 00 00 00 00 00 00 5a 10 73 3d
> 30: 00 00 00 00 60 00 00 00 00 00 00 00 0a 01 04 12
> 

Presumably

                void __iomem *mmio = (void __iomem *) ap->ioaddr.scr_addr;

gave us a null pointer.

Something like this:

diff -puN drivers/ata/sata_promise.c~a drivers/ata/sata_promise.c
--- a/drivers/ata/sata_promise.c~a
+++ a/drivers/ata/sata_promise.c
@@ -294,6 +294,10 @@ static int pdc_port_start(struct ata_por
 		void __iomem *mmio = (void __iomem *) ap->ioaddr.scr_addr;
 		unsigned int tmp;
 
+		if (!mmio) {
+			rc = -EDOM;
+			goto out_kfree;
+		}
 		tmp = readl(mmio + 0x014);
 		tmp = (tmp & ~3) | 1;	/* set bits 1:0 = 0:1 */
 		writel(tmp, mmio + 0x014);
_

should perhaps let you wobble to a state where you can get us the full
dmesg output, please.

Actually, that should already be possible simply using netconsole.

Re: OOPS: deref 0x14 at pdc_port_start+0x82 [Was: 2.6.20-rc1-mm1]

[Jiri Slaby]

Andrew Morton wrote:
> On Fri, 15 Dec 2006 15:45:55 +0059
> Jiri Slaby <jirislaby@gmail.com> wrote:
> 
>> Andrew Morton wrote:
>>> Temporarily at
>>>
>>> 	http://userweb.kernel.org/~akpm/2.6.20-rc1-mm1/
>>>
>>> Will appear later at
>>>
>>> 	ftp://ftp.kernel.org/pub/linux/kernel/people/akpm/patches/2.6/2.6.20-rc1/2.6.20-rc1-mm1/
>> The kernel panics at boot in pdc_port_start+0x82 with deref of 0x14:
>> http://www.fi.muni.cz/~xslaby/sklad/pdc_oops.png
>>
>> ATA port is not connected, only 2 SATA disks on my
>> # lspci -vvxs 02:01.0
>> 02:01.0 Mass storage controller: Promise Technology, Inc. PDC40775 (SATA 300
>> TX2plus) (rev 02)
>>         Subsystem: Promise Technology, Inc. PDC40775 (SATA 300 TX2plus)
>>         Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr-
>> Stepping- SERR- FastB2B-
>>         Status: Cap+ 66MHz+ UDF- FastB2B- ParErr- DEVSEL=medium >TAbort-
>> <TAbort- <MAbort- >SERR- <PERR-
>>         Latency: 72 (1000ns min, 4500ns max), Cache Line Size: 4 bytes
>>         Interrupt: pin A routed to IRQ 19
>>         Region 0: I/O ports at 8000 [size=128]
>>         Region 2: I/O ports at 8400 [size=256]
>>         Region 3: Memory at fb025000 (32-bit, non-prefetchable) [size=4K]
>>         Region 4: Memory at fb000000 (32-bit, non-prefetchable) [size=128K]
>>         [virtual] Expansion ROM at 50000000 [disabled] [size=32K]
>>         Capabilities: [60] Power Management version 2
>>                 Flags: PMEClk- DSI+ D1+ D2- AuxCurrent=0mA
>> PME(D0-,D1-,D2-,D3hot-,D3cold-)
>>                 Status: D0 PME-Enable- DSel=0 DScale=0 PME-
>> 00: 5a 10 73 3d 07 00 30 02 02 00 80 01 01 48 00 00
>> 10: 01 80 00 00 00 00 00 00 01 84 00 00 00 50 02 fb
>> 20: 00 00 00 fb 00 00 00 00 00 00 00 00 5a 10 73 3d
>> 30: 00 00 00 00 60 00 00 00 00 00 00 00 0a 01 04 12
>>
> 
> Presumably
> 
>                 void __iomem *mmio = (void __iomem *) ap->ioaddr.scr_addr;
> 
> gave us a null pointer.
> 
> Something like this:
> 
> diff -puN drivers/ata/sata_promise.c~a drivers/ata/sata_promise.c
> --- a/drivers/ata/sata_promise.c~a
> +++ a/drivers/ata/sata_promise.c
> @@ -294,6 +294,10 @@ static int pdc_port_start(struct ata_por
>  		void __iomem *mmio = (void __iomem *) ap->ioaddr.scr_addr;
>  		unsigned int tmp;
>  
> +		if (!mmio) {
> +			rc = -EDOM;
> +			goto out_kfree;
> +		}
>  		tmp = readl(mmio + 0x014);
>  		tmp = (tmp & ~3) | 1;	/* set bits 1:0 = 0:1 */
>  		writel(tmp, mmio + 0x014);
> _
> 
> should perhaps let you wobble to a state where you can get us the full
> dmesg output, please.
> 
> Actually, that should already be possible simply using netconsole.

I set it up and here it comes:
[    6.779351] ACPI: PCI Interrupt 0000:02:01.0[A] -> GSI 21 (level, low) -> IRQ 19
[    6.779483] sata_promise PATA port found
[    6.779584] ata3: SATA max UDMA/133 cmd 0xF8816200 ctl 0xF8816238 bmdma 0x0
irq 19
[    6.779708] ata4: SATA max UDMA/133 cmd 0xF8816280 ctl 0xF88162B8 bmdma 0x0
irq 19
[    6.779831] BUG: unable to handle kernel NULL pointer dereference at virtual
address 00000014
[    6.779958]  printing eip:
[    6.780020] c02753b9
[    6.780080] *pde = 00000000
[    6.780142] Oops: 0000 [#1]
[    6.780202] SMP
[    6.780328] last sysfs file:
[    6.780389] Modules linked in:
[    6.780488] CPU:    1
[    6.780488] EIP:    0060:[<c02753b9>]    Not tainted VLI
[    6.780490] EFLAGS: 00010202   (2.6.20-rc1-mm1 #203)
[    6.780680] EIP is at pdc_port_start+0x82/0xb0
[    6.780742] eax: 00000001   ebx: f7e3d9a0   ecx: 00000000   edx: 00000000
[    6.780808] esi: f7dcc2e8   edi: 00000000   ebp: c193fe3c   esp: c193fe24
[    6.780873] ds: 007b   es: 007b   fs: 00d8  gs: 0000  ss: 0068
[    6.780938] Process swapper (pid: 1, ti=c193e000 task=c1923a90 task.ti=c193e000)
[    6.781004] Stack: 000000d0 c1a59a80 c1adcc48 f7ea4000 f88162b8 f7dcc2e8
c193fe90 c026c724
[    6.781398]        00000078 00000004 00000053 c043d998 f8816280 f88162b8
00000000 00000013
[    6.781789]        f7ea4000 f7d91b00 f8816280 c1adcc48 00000013 c1adcc00
00000002 c01de64f
[    6.782180] Call Trace:
[    6.782298]  [<c0103f1b>] show_trace_log_lvl+0x1a/0x30
[    6.782396]  [<c0103fd6>] show_stack_log_lvl+0xa5/0xca
[    6.782494]  [<c01041ce>] show_registers+0x1d3/0x2b8
[    6.782591]  [<c01043d4>] die+0x121/0x243
[    6.782690]  [<c01193b0>] do_page_fault+0x2b8/0x5e8
[    6.782788]  [<c0389e74>] error_code+0x7c/0x84
[    6.782885]  [<c026c724>] ata_device_add+0x1b1/0x516
[    6.782983]  [<c027568e>] pdc_ata_init_one+0x2a7/0x3e9
[    6.783081]  [<c01e057e>] pci_device_probe+0x44/0x5f
[    6.783180]  [<c02432a2>] driver_probe_device+0x75/0x12c
[    6.783279]  [<c0243470>] __driver_attach+0x8c/0x8e
[    6.783376]  [<c02428b3>] bus_for_each_dev+0x44/0x62
[    6.783476]  [<c0243161>] driver_attach+0x19/0x1b
[    6.783574]  [<c0242ba7>] bus_add_driver+0x6a/0x188
[    6.783671]  [<c02436c9>] driver_register+0x54/0x84
[    6.783768]  [<c01e06e0>] __pci_register_driver+0x45/0x73
[    6.783865]  [<c0520f34>] pdc_ata_init+0xf/0x1b
[    6.783967]  [<c01004b6>] init+0x10d/0x310
[    6.784063]  [<c0103bbf>] kernel_thread_helper+0x7/0x18
[    6.784160]  =======================
[    6.784224] Code: 00 8b 45 f0 e8 ca 25 e9 ff 89 03 85 c0 74 32 89 9e 54 20 00
00 8b 45 ec f6 00 01 74 b6 89 f0 e8 99 1b ff ff 85 c0 74 ab 8b 56 64 <8b> 42 14
83 e0 fc 83 c8 01 89 42 14 89 f8 83 c4 0c 5b 5e 5f 5d
[    6.786508] EIP: [<c02753b9>] pdc_port_start+0x82/0xb0 SS:ESP 0068:c193fe24
[    6.786641]  <0>Kernel panic - not syncing: Attempted to kill init!
[    6.787970]

regards,
-- 
http://www.fi.muni.cz/~xslaby/            Jiri Slaby
faculty of informatics, masaryk university, brno, cz
e-mail: jirislaby gmail com, gpg pubkey fingerprint:
B674 9967 0407 CE62 ACC8  22A0 32CC 55C3 39D4 7A7E

Re: OOPS: deref 0x14 at pdc_port_start+0x82 [Was: 2.6.20-rc1-mm1]

[Mikael Pettersson]

On Fri, 15 Dec 2006 11:24:12 -0800, Andrew Morton wrote:
>On Fri, 15 Dec 2006 15:45:55 +0059
>Jiri Slaby <jirislaby@gmail.com> wrote:
>
>> Andrew Morton wrote:
>> > Temporarily at
>> > 
>> > 	http://userweb.kernel.org/~akpm/2.6.20-rc1-mm1/
>> > 
>> > Will appear later at
>> > 
>> > 	ftp://ftp.kernel.org/pub/linux/kernel/people/akpm/patches/2.6/2.6.20-rc1/2.6.20-rc1-mm1/
>> 
>> The kernel panics at boot in pdc_port_start+0x82 with deref of 0x14:
>> http://www.fi.muni.cz/~xslaby/sklad/pdc_oops.png
>> 
>> ATA port is not connected, only 2 SATA disks on my
>> # lspci -vvxs 02:01.0
>> 02:01.0 Mass storage controller: Promise Technology, Inc. PDC40775 (SATA 300
>> TX2plus) (rev 02)
>>         Subsystem: Promise Technology, Inc. PDC40775 (SATA 300 TX2plus)
>>         Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr-
>> Stepping- SERR- FastB2B-
>>         Status: Cap+ 66MHz+ UDF- FastB2B- ParErr- DEVSEL=medium >TAbort-
>> <TAbort- <MAbort- >SERR- <PERR-
>>         Latency: 72 (1000ns min, 4500ns max), Cache Line Size: 4 bytes
>>         Interrupt: pin A routed to IRQ 19
>>         Region 0: I/O ports at 8000 [size=128]
>>         Region 2: I/O ports at 8400 [size=256]
>>         Region 3: Memory at fb025000 (32-bit, non-prefetchable) [size=4K]
>>         Region 4: Memory at fb000000 (32-bit, non-prefetchable) [size=128K]
>>         [virtual] Expansion ROM at 50000000 [disabled] [size=32K]
>>         Capabilities: [60] Power Management version 2
>>                 Flags: PMEClk- DSI+ D1+ D2- AuxCurrent=0mA
>> PME(D0-,D1-,D2-,D3hot-,D3cold-)
>>                 Status: D0 PME-Enable- DSel=0 DScale=0 PME-
>> 00: 5a 10 73 3d 07 00 30 02 02 00 80 01 01 48 00 00
>> 10: 01 80 00 00 00 00 00 00 01 84 00 00 00 50 02 fb
>> 20: 00 00 00 fb 00 00 00 00 00 00 00 00 5a 10 73 3d
>> 30: 00 00 00 00 60 00 00 00 00 00 00 00 0a 01 04 12
>> 
>
>Presumably
>
>                void __iomem *mmio = (void __iomem *) ap->ioaddr.scr_addr;
>
>gave us a null pointer.

Yes, it does look like pdc_port_start() is invoked with scr_addr
being zero for the port.

The -mm patch kit includes the Promise 2037x PATA support patch,
via libata-all. That patch is incomplete and actually breaks 2057x
chips: it leaves the SATA flag set for all ports on 2057x, which
makes sata_scr_valid() erroneously return true for the PATA port,
and that breaks many things including pdc_port_start().

Applying the trivial patch below on top of 2.6.20-rc1-mm1 should
fix the oops and even make the PATA port work on the 2057x.
With this patch -mm1's sata_promise.c will match what I've been
using recently to access both SATA and PATA devices on 2057x.

/Mikael

diff -rupN linux-2.6.20-rc1-mm1/drivers/ata/sata_promise.c linux-2.6.20-rc1-mm1.sata_promise-2057x-pata-fix/drivers/ata/sata_promise.c
--- linux-2.6.20-rc1-mm1/drivers/ata/sata_promise.c	2006-12-15 23:33:17.000000000 +0100
+++ linux-2.6.20-rc1-mm1.sata_promise-2057x-pata-fix/drivers/ata/sata_promise.c	2006-12-15 23:58:09.000000000 +0100
@@ -213,7 +213,7 @@ static const struct ata_port_info pdc_po
 	/* board_2057x */
 	{
 		.sht		= &pdc_ata_sht,
-		.flags		= PDC_COMMON_FLAGS | ATA_FLAG_SATA,
+		.flags		= PDC_COMMON_FLAGS /* | ATA_FLAG_SATA */,
 		.pio_mask	= 0x1f, /* pio0-4 */
 		.mwdma_mask	= 0x07, /* mwdma0-2 */
 		.udma_mask	= 0x7f, /* udma0-6 ; FIXME */

Re: OOPS: deref 0x14 at pdc_port_start+0x82 [Was: 2.6.20-rc1-mm1]

[Jiri Slaby]

Mikael Pettersson wrote:
> Applying the trivial patch below on top of 2.6.20-rc1-mm1 should

Yup, Jeff fwd me this yet and it works.

thanks,
-- 
http://www.fi.muni.cz/~xslaby/            Jiri Slaby
faculty of informatics, masaryk university, brno, cz
e-mail: jirislaby gmail com, gpg pubkey fingerprint:
B674 9967 0407 CE62 ACC8  22A0 32CC 55C3 39D4 7A7E

[-mm patch] drivers/ide/pci/tc86c001.c: make a function static

[Adrian Bunk]

On Thu, Dec 14, 2006 at 10:59:13PM -0800, Andrew Morton wrote:
>...
> Changes since 2.6.19-mm1:
>...
> +toshiba-tc86c001-ide-driver-take-2.patch
>...
>  Misc.
>...

This patch makes the needlessly global init_hwif_tc86c001() static.

Signed-off-by: Adrian Bunk <bunk@stusta.de>

---

BTW:
I'm not sure whether it'd be a good idea to include such a driver for 
the legacy IDE subsystem without a libata based driver for the same 
hardware.

--- linux-2.6.20-rc1-mm1/drivers/ide/pci/tc86c001.c.old	2006-12-15 21:58:44.000000000 +0100
+++ linux-2.6.20-rc1-mm1/drivers/ide/pci/tc86c001.c	2006-12-15 21:58:54.000000000 +0100
@@ -204,7 +204,7 @@
 	return 0;
 }
 
-void __devinit init_hwif_tc86c001(ide_hwif_t *hwif)
+static void __devinit init_hwif_tc86c001(ide_hwif_t *hwif)
 {
 	unsigned long sc_base	= pci_resource_start(hwif->pci_dev, 5);
 	u16 scr1		= hwif->INW(sc_base + 0x00);;

Re: [-mm patch] drivers/ide/pci/tc86c001.c: make a function static

[Alan]

> I'm not sure whether it'd be a good idea to include such a driver for 
> the legacy IDE subsystem without a libata based driver for the same 
> hardware.

It would be nice to have a libata driver but having the hardware
supported is far better than no support at all.

Re: [-mm patch] drivers/ide/pci/tc86c001.c: make a function static

[Sergei Shtylyov]

Hello.

Adrian Bunk wrote:

>>+toshiba-tc86c001-ide-driver-take-2.patch

> This patch makes the needlessly global init_hwif_tc86c001() static.

    Duh, I hoped tha this driver may get into 2.6.20-rc1 and finally 
overlooked this. Sigh, uou won't believe how much time this driver rewrite 
spent in an unfinished state in my internal tree... :-/

> Signed-off-by: Adrian Bunk <bunk@stusta.de>
> 
> ---
> 
> BTW:
> I'm not sure whether it'd be a good idea to include such a driver for 
> the legacy IDE subsystem without a libata based driver for the same 
> hardware.

    Well, I'd agree with Alan here. Don't expect me to convert this to libata 
in the foreseeable future... I'd like to join the folks hacking on libata but 
this certainly won't happen soon (if at all)...

WBR, Sergei

Re: [-mm patch] drivers/ide/pci/tc86c001.c: make a function static

[Sergei Shtylyov]

Hello.

Adrian Bunk wrote:

> This patch makes the needlessly global init_hwif_tc86c001() static.

> Signed-off-by: Adrian Bunk <bunk@stusta.de>

    If this patch hasn't been accepted by Andrew yet, could you add another 
fixlet: init_chipset_tc86c001() should've been __devinit.  If not or it's 
already accepted, I'll post the patchlet myself later...

WBR, Sergei