Partial fix for Adaptec 2940 Stack corruption

Nick Kralevich (nickkral@bmw.autobahn.org)
Tue, 25 Mar 1997 06:13:45 -0800 (PST)


Some background:

Users of the Adaptec 2940 are reporting messages showing up in "dmesg" to
the effect of

release: ipop3d kernel stack corruption. Aiee

(kernel 2.0.29 included)

This is due to gcc creating huge stack frames with the Adaptec 2940
driver. A beta driver which reports to fix this problem is located at

ftp://ftp.pcnet.com/users/eischen/Linux/

I want to make sure that people know about this bug, and that this bug is
fixed, before 2.0.30 is released.

In addition, if you don't feel confortable with running a beta driver, you
can try the patch below.

----- Begin -----
Subject: Re: kernel stack corruption. Aiee on DualPPro
From: Ingo Molnar <mingo@pc5829.hil.siemens.at>
Date: 1997/03/22
Message-Id: <5h0jtu$b8l@zwei.siemens.at>
Newsgroups: comp.os.linux.development.system
[More Headers]

Rick Ellis <ellis@ftel.net> wrote:

: >I've been using this for a week now, and haven't had the kernel stack
: >corruptions at all. Thanks again, Andrew.

: We tried the beta driver here. It didn't work well at all.

i use a hack that doesnt endanger the stability of the current driver, but
removes the code that causes kernel stack corruption. You have to disable
tagged queueing and apply this patch in drivers/scsi:

[the patch is against 2.1.29]:

------------------------------------------------------------->
--- aic7xxx.c.old Sat Mar 22 14:18:39 1997
+++ aic7xxx.c Sat Mar 22 14:34:11 1997
@@ -2461,6 +2461,7 @@
outb(disc_scb, SCBPTR + base);
tag = inb(SCB_TAG + base);
outscb = (p->scb_array[tag]);
+ goto ayiee;
if ((outscb->control & 0x23) != TAG_ENB)
{
/*
@@ -2469,7 +2470,7 @@
* the queue instead.
*/
int i;
- int saved_queue[AIC7XXX_MAXSCB];
+ int saved_queue[1];
int queued = inb(QINCNT + base) & p->qcntmask;

/* Count the command we removed already */
@@ -2509,6 +2510,9 @@
outb(CLRSELTIMEO, CLRSINT1 + base);
outb(0, RETURN_1 + base);
}
+ ayiee:
+ printk("you shouldnt use this patch with tagged queueing...\n");
+ panic("ayiee therefore.");
}
}
else
<-------------------------------------------------------------

it works for me. Should be 0 hassle to use it under a 2.0 kernel.
When the new (and tested) driver gets into the stock kernel, you
should remove this hack.

-- mingo

----- End -----