Latest working kernel version: Earliest failing kernel version: 2.6.27-rc7 Distribution: Debian Hardware Environment: Software Environment: Problem Description: Steps to reproduce: Mount a DVD-ROM [150430.437461] ------------[ cut here ]------------ [150430.437470] WARNING: at arch/x86/kernel/pci-nommu.c:62 nommu_map_sg+0x29/0x80() [150430.437473] Modules linked in: nls_cp437 vfat fat isofs zlib_inflate nls_utf8 ntfs ext4dev jbd2 crc16 udf nls_base crc_itu_t radeon drm tun autofs4 ipv6 video output ac battery nfsd auth_rpcgss exportfs nfs lockd nfs_acl sunrpc quota_v2 fuse it87 hwmon_vid eeprom tuner_simple tuner_types tuner snd_cs4232 snd_opl3_lib snd_hwdep snd_cs4231_lib snd_mpu401 snd_mpu401_uart bttv ns558 gameport snd_seq_midi snd_rawmidi snd_intel8x0 snd_ac97_codec videodev v4l1_compat rtc_cmos ac97_bus snd_pcm_oss ir_common rtc_core snd_mixer_oss compat_ioctl32 i2c_algo_bit rtc_lib v4l2_common videobuf_dma_sg videobuf_core snd_bt87x btcx_risc tveeprom snd_pcm snd_seq_dummy serio_raw pcspkr psmouse shpchp snd_seq_oss pci_hotplug snd_seq_midi_event snd_seq snd_timer snd_seq_device snd soundcore snd_page_alloc parport_pc parport button i2c_nforce2 nvidia_agp i2c_core agpgart evdev sd_mod joydev ext3 jbd mbcache dm_mirror dm_log dm_snapshot dm_mod usbhid hid ff_memless ide_cd_mod cdrom ide_disk ata_generic usb_storage libata scsi_mod dock 8139cp amd74xx floppy 8139too mii ide_pci_generic ide_core ehci_hcd ohci_hcd usbcore thermal processor fan thermal_sys [150430.437587] Pid: 19225, comm: firefox-bin Tainted: G W 2.6.27-rc7-686 #1 [150430.437591] [<c0123d17>] warn_on_slowpath+0x40/0x63 [150430.437600] [<c01356f2>] enqueue_hrtimer+0xc9/0xd4 [150430.437606] [<c0135cf3>] hrtimer_start+0x104/0x11f [150430.437610] [<c011adea>] hrtick_start_fair+0x120/0x156 [150430.437614] [<c0119e00>] resched_task+0x1a/0x59 [150430.437621] [<c01217d0>] check_preempt_wakeup+0x14b/0x153 [150430.437626] [<c01754d3>] slab_destroy+0x2b/0x40 [150430.437632] [<c010817f>] nommu_map_sg+0x29/0x80 [150430.437641] [<f9025d7c>] ide_build_sglist+0x45/0x4a [ide_core] [150430.437667] [<f9025dac>] ide_build_dmatable+0x2b/0x11d [ide_core] [150430.437683] [<f9025fa1>] ide_dma_setup+0x2f/0xc3 [ide_core] [150430.437698] [<f905a179>] cdrom_do_newpc_cont+0x0/0x13 [ide_cd_mod] [150430.437708] [<f9059c87>] ide_cd_do_request+0x53c/0x5e8 [ide_cd_mod] [150430.437716] [<f9021138>] ide_wait_stat+0x3f/0x6c [ide_core] [150430.437731] [<f901fca7>] ide_do_request+0x642/0x86b [ide_core] [150430.437746] [<f905a274>] cdrom_newpc_intr+0xc2/0x502 [ide_cd_mod] [150430.437753] [<c012b297>] lock_timer_base+0x19/0x35 [150430.437761] [<f902004c>] ide_intr+0x17c/0x1a3 [ide_core] [150430.437774] [<c01540a2>] handle_IRQ_event+0x23/0x51 [150430.437779] [<c0155359>] handle_edge_irq+0xc4/0x104 [150430.437784] [<c0105faf>] do_IRQ+0x4d/0x66 [150430.437789] [<c0104297>] common_interrupt+0x23/0x28 [150430.437794] ======================= [150430.437796] ---[ end trace 6b02c72c822d6675 ]--- [150430.676787] ISO 9660 Extensions: Microsoft Joliet Level 3 [150430.710752] ISOFS: changing to secondary root
I recategorised this to IDE. I assume it is a regression also. It might be that we just added more debug stuff and the problme has been there for some time.
Not idea - trace is a completely gaga mmu mapping failure. I'd say its a bust box or someone has loaded corrupting modules
If you need more information please tell me. Kernel is from: http://kernel-archive.buildserver.net/debian-kernel
(In reply to comment #2) > Not idea - trace is a completely gaga mmu mapping failure. I'd say its a bust > box or someone has loaded corrupting modules Hmm, I'd say it's a warn_on which triggers due to ide code calling dma_map_sg() from ide_build_sglist() with totally bogus parameters. WARN_ON(nents == 0 || sg[0].length == 0); Giving the handle back to ide :)
IDE gets arguments for dma_map_sg() from blk_rq_map_sg() so everything should be sweet... Vedran: - is the problem reproducible with vanilla 2.6.27? - is it a regression?
> IDE gets arguments for dma_map_sg() from blk_rq_map_sg() so everything should > be sweet... Adding Jens to the mix :)
Initially it looks like IDE calling dma mapping for a request with no data attached. blk_rq_map_sg() returns 0 if no data is attached, it has no error case. So saying that IDE just passes that on to dma mapping doesn't say a whole lot. To be sure, it would be interesting to catch a blktrace of this happening so we can see more closely. So, IOW, do: 1) In one termimal, run blktrace /dev/hdX (eg /dev/hda, or whatever is your cdrom). 2) In another terminal, mount the drive or whatever reproduces the error. 3) In that first terminal, ctrl-c blktrace. Then run blkparse hdX -o output and attach output to this bug.
Created attachment 18337 [details] blkparse output New info: - Still happens with -rc9 (will try with vanilla 27 within next few days) - Doesn't happen with 2.6.26 - Happens only with one drive (out of two tested, so it could be hw problem) - Doesn't happen always, seem random but usually 2-3 times out of ten mounts - It seems that it happens only when hal is running blkparse output attached (more then one (u)mount) Regards!
Could you try 2.6.28-rc3? We've fixed some bugs related to ide-cd recently so this problem may get fixed as well.
Should have been fixed by: commit 9e772d0135a5b5f8355320be429efa339700d52d Author: Borislav Petkov <petkovbb@googlemail.com> Date: Mon Feb 2 20:12:21 2009 +0100 ide-cd: fix DMA for non bio-backed requests This one fixes http://bugzilla.kernel.org/show_bug.cgi?id=12320. Signed-off-by: Borislav Petkov <petkovbb@gmail.com> Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>