ADD 800850 - XFS + CONFIG_HIGHMEM4GB bug

[pv@xxxxxxxxxxxxx (chait@xxxxxxxxxxxx)]

View Incident: 
http://co-op.engr.sgi.com/BugWorks/code/bwxquery.cgi?search=Search&wlong=1&view_type=Bug&wi=800850

 Status : open                         Priority : 2                         
 Assigned Engineer : lord              Submitter : dxm                      
*Modified User : chait                *Modified User Domain : engr          
*Description :
Enabling CONFIG_HIGHMEM4GB on bruce (a 1400), then
running QA trips the following BUG() in QA 001:

kernel BUG at highmem.c:231!

Entering kdb (0xf6eec000) on processor 0 Panic: invalid operand
due to panic @ 0xc013077b
eax = 0x0000001d ebx = 0xfe268000 ecx = 0xc02b406c edx = 0x00000028 
esi = 0x00000000 edi = 0xc2055790 esp = 0xf6eedda0 eip = 0xc013077b 
ebp = 0xf6eeddb4  ss = 0x00000018  cs = 0x00000010 eflags = 0x00010246 

.....


==========================
ADDITIONAL INFORMATION (ADD)
From: chait@engr (BugWorks)
Date: Sep 08 2000 03:51:00PM
==========================

Interesting....I'm seeing the highmem oops occur also via 
xfs_bulkstat() invoking xfs_itobp(). The trace below is via a
call to xfs_itobp() from xfs_sync() as in Daniel's trace. I've 
included info. about the offending pagebuf/kiobuf/pages.

Lemme know if you need more information.

-Chait.

pagebuf_offset(): Highmem page at 0xc2029984
xfs_itobp(): pagebuf_offset() shoulda found highmem page!
pagebuf ptr = 0xe9c80400
Unable to handle kernel NULL pointer dereference at virtual address 00000000
 printing eip:
c01a7785
*pde = 00000000

Entering kdb (current=0xe9bba000, pid 1228) on processor 0 Panic: Oops
due to panic @ 0xc01a7785
eax = 0x00000019 ebx = 0xea100000 ecx = 0xc038820c edx = 0x00000000 
esi = 0x00000000 edi = 0x00000000 esp = 0xe9bbbe88 eip = 0xc01a7785 
ebp = 0xe9bbbebc  ss = 0x00000018  cs = 0x00000010 eflags = 0x00010296 
 ds = 0x00000018  es = 0x00000018 origeax = 0xffffffff &regs = 0xe9bbbe54
[0]kdb> bt
    EBP       EIP         Function(args)
0xe9bbbebc 0xc01a7785 xfs_itobp+0x175 (0xea100000, 0x0, 0xe9bfd100, 0xe9bbbf38, 
0xe9bbbf3c)
                               kernel .text 0xc0100000 0xc01a7610 0xc01a780c
0xe9bbbf54 0xc01beddb xfs_syncsub+0x4e3 (0xea100000, 0x31, 0x0, 0x0)
                               kernel .text 0xc0100000 0xc01be8f8 0xc01bf3f0
0xe9bbbf6c 0xc01be8f2 xfs_sync+0x16 (0xea100000, 0x31, 0xc0407480)
                               kernel .text 0xc0100000 0xc01be8dc 0xc01be8f8
0xe9bbbf84 0xc01cef0e linvfs_write_super+0x2a (0xf7bfe400)
                               kernel .text 0xc0100000 0xc01ceee4 0xc01cef1c
0xe9bbbf98 0xc0135b08 sync_supers+0x6c (0x0)
                               kernel .text 0xc0100000 0xc0135a9c 0xc0135b30
0xe9bbbfb0 0xc0131a53 fsync_dev+0x3f (0x0)
                               kernel .text 0xc0100000 0xc0131a14 0xc0131aa8
0xe9bbbfbc 0xc0131ab2 sys_sync+0xa (0x804ec08, 0x7213b053, 0x7213b053, 
0x4000ae60, 0xbffffa14)
                               kernel .text 0xc0100000 0xc0131aa8 0xc0131ab8
           0xc0109040 system_call+0x34
                               kernel .text 0xc0100000 0xc010900c 0xc0109044
[0]kdb> pb 0xe9c80400
page_buf_t at 0xe9c80400
  pb_flags ASYNC DELWRI LONG_TERM LOCK LOCKABLE ALL_PAGES_MAPPED MEM_ALLOCATED
  pb_target 0xe9bfe1e0 pb_hold 2 pb_next 0xe9cd9660 pb_prev 0xe9cd93e0
  pb_file_offset 0x44228000 pb_buffer_length 0x2000 pb_addr 0x00000000
  pb_bn 0x221140 pb_count_desired 0x2000
  pb_io_remaining 0   pb_error 0 pba_kiovec[0] 0xe9cd8a80 pba_kiocnt 1
  pb_iodonesema (0,0) pb_sema (0,0) pincount (0) last holder 0xe9bba000
pb_fspriv 0xe9ca1f18 pb_fspriv2 0x00000000
[0]kdb> kiobuf 0xe9cd8a80
kiobuf at 0xe9cd8a80
  nr_pages 2 array_len 17 offset 0x0 length 0x2000
  errno 0 pb 0x00000000
    page_struct   page_addr     cnt  flags
    0xc2029984    0x0    2    0x100c
    0xc2029940    0x0    2    0x100c
[0]kdb> page 0xc2029984
struct page at 0xc2029984
  next 0xc20299c8 prev 0xc2029940 addr space 0xe9bfe27c index 279080 (offset 
0x44228000)
  count 2 flags PG_referenced PG_uptodate PG_highmem virtual 0x0
  buffers 0x00000000  block_map 11111111000000000000000000000000
[0]kdb> page 0xc2029940
struct page at 0xc2029940
  next 0xc2029984 prev 0xc1b03260 addr space 0xe9bfe27c index 279081 (offset 
0x44229000)
  count 2 flags PG_referenced PG_uptodate PG_highmem virtual 0x0
  buffers 0x00000000  block_map 11111111000000000000000000000000
[0]kdb>