Attachment 147826 Details for Bug 228067 – Analysis of oops

Analysis of oops

analysis.txt (text/plain), 9.33 KB, created by Dave Wysochanski on 2007-02-09 23:39:50 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Dave Wysochanski

Created: 2007-02-09 23:39:50 UTC

Size: 9.33 KB

patch

obsolete

>Faulting instruction is: dm_mirror:mirror_end_io+102
>0x2c44+102d = 0x2caa
>
>%rdi, %rsi, %rdx, %rcx, %r8, %9, for arguments.
>%rdi == 1st arg == 'ti'
>%rsi == 2nd arg == 'bio'
>%rdx == 3rd arg == 'error'
>%rcx == 4th arg == 'map_context'
>
>static int mirror_end_io(struct dm_target *ti, struct bio *bio,
>			 int error, union map_info *map_context)
>
>
>0000000000002c44 <mirror_end_io>:
>    2c44:       41 57                   push   %r15
>    2c46:       41 89 d7                mov    %edx,%r15d
>    2c49:       41 56                   push   %r14
>    2c4b:       49 89 ce                mov    %rcx,%r14
>    2c4e:       41 55                   push   %r13
>    2c50:       41 54                   push   %r12
>    2c52:       55                      push   %rbp
>    2c53:       48 89 f5                mov    %rsi,%rbp
>    2c56:       53                      push   %rbx
>    2c57:       41 55                   push   %r13
># (-2): %rax gets 0x20(%rsi), which seems to involve deref of 'bio'
>    2c59:       48 8b 46 20             mov    0x20(%rsi),%rax
>#
># ?? if I had to guess here, I'd say this is that bio flag check
># code seems to confirm this...
>#
>    2c5d:       89 c2                   mov    %eax,%edx
>    2c5f:       83 e2 03                and    $0x3,%edx
>    2c62:       89 54 24 04             mov    %edx,0x4(%rsp)
>#
># so it looks like at this point 0x4(%rsp) has that rw flag value
># no clue why "dec %edx" is here - maybe just processor pipeline instr?
>#
>    2c66:       ff ca                   dec    %edx
>#
># %rdi == 'ti' so we're derefing here and storing in %r13, this is
># our 'ms' variable
>#
>    2c68:       4c 8b 6f 40             mov    0x40(%rdi),%r13
>    2c6c:       0f 85 d9 00 00 00       jne    2d4b <mirror_end_io+0x107>
>    2c72:       4c 8b 21                mov    (%rcx),%r12
>    2c75:       49 8d 5d 30             lea    0x30(%r13),%rbx
>    2c79:       49 8d 6d 18             lea    0x18(%r13),%rbp
>    2c7d:       45 31 f6                xor    %r14d,%r14d
>    2c80:       48 89 df                mov    %rbx,%rdi
># (These callqs with 0 offset are null instructions)
>    2c83:       e8 00 00 00 00          callq  2c88 <mirror_end_io+0x44>
>#
># here we call __rh_lookup(%rdi, %rsi); %rsi has %r12, which got (%rcx)
># earlier ('map_context' param to mirror_end_io()); %rdi gets %rbp, 
># which earlier gets 0x18(%r13), which is our 'ms' assignment from 
># 'ti->private' earlier
># NOTE: rh_dec() is inlined so that's why we see __rh_lookup() here
>#
>    2c88:       4c 89 e6                mov    %r12,%rsi
>    2c8b:       48 89 ef                mov    %rbp,%rdi
>    2c8e:       e8 16 e0 ff ff          callq  ca9 <__rh_lookup>
>    2c93:       48 89 df                mov    %rbx,%rdi
>#
># (-1) %r12 gets contents of %rax; ah, since we're calling __rh_lookup, it
># must be that %rax is the return value...; so we looked up the region,
># didn't find it, and returned null, which caused the fault?  rh_dec()
># code seems to confirm this
>#
>    2c96:       49 89 c4                mov    %rax,%r12
># again, more callq null instructions...
>    2c99:       e8 00 00 00 00          callq  2c9e <mirror_end_io+0x5a>
>    2c9e:       49 8d 7d 50             lea    0x50(%r13),%rdi
>    2ca2:       e8 00 00 00 00          callq  2ca7 <mirror_end_io+0x63>
>    2ca7:       48 89 c6                mov    %rax,%rsi
># faulting instruction is 0x2caa
># deref %r12, which apparently is 0
># This must be the middle of rh_dec() where we're doing this:
># 	if (atomic_dec_and_test(&reg->pending)) {
>
>    2caa:       f0 41 ff 4c 24 38       lock decl 0x38(%r12)
>    2cb0:       0f 94 c0                sete   %al
>    2cb3:       84 c0                   test   %al,%al
>    2cb5:       74 66                   je     2d1d <mirror_end_io+0xd9>
>    2cb7:       41 8b 44 24 10          mov    0x10(%r12),%eax
>    2cbc:       83 f8 03                cmp    $0x3,%eax
>    2cbf:       75 22                   jne    2ce3 <mirror_end_io+0x9f>
>    2cc1:       49 8d 95 90 00 00 00    lea    0x90(%r13),%rdx
>    2cc8:       49 8d 44 24 28          lea    0x28(%r12),%rax
>    2ccd:       48 8b 4a 08             mov    0x8(%rdx),%rcx
>    2cd1:       49 89 54 24 28          mov    %rdx,0x28(%r12)
>    2cd6:       48 89 42 08             mov    %rax,0x8(%rdx)
>    2cda:       48 89 01                mov    %rax,(%rcx)
>    2cdd:       48 89 48 08             mov    %rcx,0x8(%rax)
>    2ce1:       eb 34                   jmp    2d17 <mirror_end_io+0xd3>
>    2ce3:       ff c8                   dec    %eax
>    2ce5:       75 30                   jne    2d17 <mirror_end_io+0xd3>
>    2ce7:       41 c7 44 24 10 00 00    movl   $0x0,0x10(%r12)
>    2cee:       00 00
>    2cf0:       49 8b 95 80 00 00 00    mov    0x80(%r13),%rdx
>    2cf7:       49 8d 44 24 28          lea    0x28(%r12),%rax
>    2cfc:       49 8d 8d 80 00 00 00    lea    0x80(%r13),%rcx
>    2d03:       48 89 42 08             mov    %rax,0x8(%rdx)
>    2d07:       49 89 54 24 28          mov    %rdx,0x28(%r12)
>    2d0c:       48 89 48 08             mov    %rcx,0x8(%rax)
>    2d10:       49 89 85 80 00 00 00    mov    %rax,0x80(%r13)
>    2d17:       41 be 01 00 00 00       mov    $0x1,%r14d
>    2d1d:       48 8d 7d 38             lea    0x38(%rbp),%rdi
>    2d21:       e8 00 00 00 00          callq  2d26 <mirror_end_io+0xe2>
>    2d26:       45 85 f6                test   %r14d,%r14d
>    2d29:       0f 84 1c 01 00 00       je     2e4b <mirror_end_io+0x207>
>    2d2f:       48 8b 45 00             mov    0x0(%rbp),%rax
>    2d33:       48 8b b8 38 01 00 00    mov    0x138(%rax),%rdi
>    2d3a:       48 8d b0 40 01 00 00    lea    0x140(%rax),%rsi
>    2d41:       e8 00 00 00 00          callq  2d46 <mirror_end_io+0x102>
>    2d46:       e9 00 01 00 00          jmpq   2e4b <mirror_end_io+0x207>
>    2d4b:       41 83 ff a1             cmp    $0xffffffffffffffa1,%r15d
>    2d4f:       0f 84 e2 00 00 00       je     2e37 <mirror_end_io+0x1f3>
>    2d55:       41 83 ff f5             cmp    $0xfffffffffffffff5,%r15d
>    2d59:       75 0a                   jne    2d65 <mirror_end_io+0x121>
>    2d5b:       a8 02                   test   $0x2,%al
>    2d5d:       0f 85 d4 00 00 00       jne    2e37 <mirror_end_io+0x1f3>
>    2d63:       eb 09                   jmp    2d6e <mirror_end_io+0x12a>
>    2d65:       45 85 ff                test   %r15d,%r15d
>    2d68:       0f 84 c9 00 00 00       je     2e37 <mirror_end_io+0x1f3>
>    2d6e:       31 c0                   xor    %eax,%eax
>    2d70:       48 c7 c7 00 00 00 00    mov    $0x0,%rdi
>    2d77:       e8 00 00 00 00          callq  2d7c <mirror_end_io+0x138>
>    2d7c:       49 8b 06                mov    (%r14),%rax
>    2d7f:       48 85 c0                test   %rax,%rax
>    2d82:       75 16                   jne    2d9a <mirror_end_io+0x156>
>    2d84:       48 c7 c7 00 00 00 00    mov    $0x0,%rdi
>    2d8b:       e8 00 00 00 00          callq  2d90 <mirror_end_io+0x14c>
>    2d90:       ba fb ff ff ff          mov    $0xfffffffb,%edx
>    2d95:       e9 b4 00 00 00          jmpq   2e4e <mirror_end_io+0x20a>
>    2d9a:       48 8b 18                mov    (%rax),%rbx
>    2d9d:       48 89 df                mov    %rbx,%rdi
>    2da0:       e8 ef e3 ff ff          callq  1194 <fail_mirror>
>    2da5:       48 89 df                mov    %rbx,%rdi
>    2da8:       e8 fb e5 ff ff          callq  13a8 <default_ok>
>    2dad:       85 c0                   test   %eax,%eax
>    2daf:       75 0f                   jne    2dc0 <mirror_end_io+0x17c>
>    2db1:       48 89 ee                mov    %rbp,%rsi
>    2db4:       4c 89 ef                mov    %r13,%rdi
>    2db7:       e8 02 e6 ff ff          callq  13be <mirror_available>
>    2dbc:       85 c0                   test   %eax,%eax
>    2dbe:       74 69                   je     2e29 <mirror_end_io+0x1e5>
>    2dc0:       4d 8b 26                mov    (%r14),%r12
>
>
>
>static int mirror_end_io(struct dm_target *ti, struct bio *bio,
>			 int error, union map_info *map_context)
>{
>	int rw = bio_rw(bio);
>	struct mirror_set *ms = (struct mirror_set *) ti->private;
>	struct mirror *m = NULL;
>	struct dm_bio_details *bd = NULL;
>
>	/*
>	 * We need to dec pending if this was a write.
>	 */
>	if (rw == WRITE) {
>		rh_dec(&ms->rh, map_context->ll);
>		return error;
>	}
>
>	if (error == -EOPNOTSUPP)
>		goto out;
>
>	if ((error == -EWOULDBLOCK) && bio_rw_ahead(bio))
>		goto out;
>
>	if (unlikely(error)) {
>		DMERR("A read failure occurred on a mirror device.");
>		if (!map_context->ptr) {
>			/*
>			 * There wasn't enough memory to record necessary
>			 * information for a retry or there was no other
>			 * mirror in-sync.
>			 */
>			DMERR("Unable to retry read.");
>			return -EIO;
>		}
>		m = ((struct bio_map_info *)map_context->ptr)->bmi_m;
>		fail_mirror(m); /* Flag error on mirror. */
>
>		/*
>		 * A failed read needs to get queued
>		 * to the daemon for another shot to
>		 * one (if any) intact mirrors.
>		 */
>		if (default_ok(m) || mirror_available(ms, bio)) {
>			bd = &(((struct bio_map_info *)map_context->ptr)->bmi_bd);
>
>			DMWARN("Trying different device.");
>			dm_bio_restore(bd, bio);
>			mempool_free(map_context->ptr, bio_map_info_pool);
>			map_context->ptr = NULL;
>			queue_bio(ms, bio, rw);
>			/* We want another shot on the bio. */
>			return DM_ENDIO_INCOMPLETE;
>		}
>		DMERR("All replicated volumes dead, failing I/O");
>	}
>
> out:
>	if (map_context->ptr)
>		mempool_free(map_context->ptr, bio_map_info_pool);
>
>	return error;
>}
>
>/*
> * return READ, READA, or WRITE
> */
>#define bio_rw(bio)             ((bio)->bi_rw & (RW_MASK | RWA_MASK))
>
>
>
>
>#define RW_MASK         1
>#define RWA_MASK        2

Actions: View

Attachments on bug 228067: 147826 | 153521