Hard lockup with ata_piix 2.6.21.1: strange traceback, too

Hi guys,

I'm debugging a system here based on ICH7/ata_piix. When we hot-pull a drive, it locks up solid. That's fine, but I'd like to find/fix the lockup.

So as part of poking around, I rebuilt the kernel with frame pointers, and inserted a WARN_ON(1) into ata_busy_sleep() to see who was calling it just before things locked up.

Here's the result: http://rtr.ca/libata.png

Can anyone here make sense of that traceback??
Are we *really* recursing inside the EH code?

Thanks

It looks like SCSI EH -> piix_sata_error_handler -> ata_eh_recover -> ata_std_softreset -> ata_std_prereset -> ata_busy_sleep with lots of bogus entries inbetween.

tejun