From: Daniel Wagner <dwagner@suse.de>
To: linux-scsi@vger.kernel.org
Cc: linux-kernel@vger.kernel.org, Nilesh Javali <njavali@marvell.com>,
Daniel Wagner <dwagner@suse.de>
Subject: [PATCH 0/4] qla2xxx: A couple crash fixes
Date: Thu, 27 Aug 2020 11:58:25 +0200 [thread overview]
Message-ID: <20200827095829.63871-1-dwagner@suse.de> (raw)
Hi,
The first crash we observed is due memory corruption in the srb memory
pool. Unforuntatly, I couldn't find the source of the problem but the
workaround by resetting the cleanup callbacks 'fixes' this problem
(patch #1). I think as intermeditate step this should be merged until
the real cause can be identified.
The second crash is due a race condition(?) in the firmware. The sts
entries are not updated in time which leads to this crash pattern
which several customers have reported:
#0 [c00000ffffd1bb80] scsi_dma_unmap at d00000001e4904d4 [scsi_mod]
#1 [c00000ffffd1bbe0] qla2x00_sp_compl at d0000000204803cc [qla2xxx]
#2 [c00000ffffd1bc20] qla24xx_process_response_queue at d0000000204c5810 [qla2xxx]
#3 [c00000ffffd1bd50] qla24xx_msix_rsp_q at d0000000204c8fd8 [qla2xxx]
#4 [c00000ffffd1bde0] __handle_irq_event_percpu at c000000000189510
#5 [c00000ffffd1bea0] handle_irq_event_percpu at c00000000018978c
#6 [c00000ffffd1bee0] handle_irq_event at c00000000018984c
#7 [c00000ffffd1bf10] handle_fasteoi_irq at c00000000018efc0
#8 [c00000ffffd1bf40] generic_handle_irq at c000000000187f10
#9 [c00000ffffd1bf60] __do_irq at c000000000018784
#10 [c00000ffffd1bf90] call_do_irq at c00000000002caa4
#11 [c00000ecca417a00] do_IRQ at c000000000018970
#12 [c00000ecca417a50] restore_check_irq_replay at c00000000000de98
From analyzing the crash dump it was clear that
qla24xx_mbx_iocb_entry() calls sp->done (qla2x00_sp_compl) which
crashes because the response is not a mailbox entry, it is a status
entry. Patch #4 changes the process logic for mailbox commands so that
the sp is parsed before calling the correct proccess function.
Thanks,
Daniel
Daniel Wagner (4):
qla2xxx: Reset done and free callback pointer on release
qla2xxx: Simplify return value logic in qla2x00_get_sp_from_handle()
qla2xxx: Drop unused function argument from
qla2x00_get_sp_from_handle()
qla2xxx: Handle incorrect entry_type entries
drivers/scsi/qla2xxx/qla_gbl.h | 3 +-
drivers/scsi/qla2xxx/qla_inline.h | 2 ++
drivers/scsi/qla2xxx/qla_isr.c | 72 ++++++++++++++++++++++-----------------
drivers/scsi/qla2xxx/qla_mr.c | 9 ++---
4 files changed, 47 insertions(+), 39 deletions(-)
--
2.16.4
next reply other threads:[~2020-08-27 9:58 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-08-27 9:58 Daniel Wagner [this message]
2020-08-27 9:58 ` [PATCH 1/4] qla2xxx: Reset done and free callback pointer on release Daniel Wagner
2020-08-27 10:12 ` Martin Wilck
2020-08-27 11:42 ` Daniel Wagner
2020-08-27 9:58 ` [PATCH 2/4] qla2xxx: Simplify return value logic in qla2x00_get_sp_from_handle() Daniel Wagner
2020-08-27 9:58 ` [PATCH 3/4] qla2xxx: Drop unused function argument from qla2x00_get_sp_from_handle() Daniel Wagner
2020-08-27 9:58 ` [PATCH 4/4] qla2xxx: Handle incorrect entry_type entries Daniel Wagner
2020-08-27 10:17 ` Martin Wilck
2020-08-27 11:46 ` Daniel Wagner
2020-08-27 12:45 ` Martin Wilck
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200827095829.63871-1-dwagner@suse.de \
--to=dwagner@suse.de \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-scsi@vger.kernel.org \
--cc=njavali@marvell.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).