Bug 49151 - NULL pointer dereference in pata_acpi
NULL pointer dereference in pata_acpi
Status: CLOSED CODE_FIX
Product: IO/Storage
Classification: Unclassified
Component: IDE
All Linux
: P1 normal
Assigned To: Aaron Lu
:
Depends on:
Blocks: 56331
  Show dependency treegraph
 
Reported: 2012-10-20 10:19 UTC by Phillip Wood
Modified: 2013-04-09 06:23 UTC (History)
12 users (show)

See Also:
Kernel Version: 3.6.2
Tree: Mainline
Regression: No


Attachments
Second page of backtrace (216.67 KB, image/jpeg)
2012-10-20 10:31 UTC, Phillip Wood
Details
First page of backtrace (214.93 KB, image/jpeg)
2012-10-20 10:33 UTC, Phillip Wood
Details
crash on A8N-E (127.56 KB, image/jpeg)
2012-10-23 20:41 UTC, Szymon Janc
Details
crash on asus m2n32_sli_deluxe (701.47 KB, image/jpeg)
2012-10-29 13:36 UTC, cthx
Details
dmesg (53.86 KB, text/plain)
2012-11-15 18:07 UTC, Szymon Janc
Details
Fix ata_dma_enabled (1.06 KB, patch)
2012-11-29 02:22 UTC, Aaron Lu
Details | Diff

Description Phillip Wood 2012-10-20 10:19:22 UTC
Just upgraded from 3.2.20 to 3.6.2 and when I try to boot a get

BUG unable to handle kernel NULL pointer dereference at 00000010
IP [<efe4c2407>] pacpi_set_dmamode+0x50/0xa0 [pata_acpi]

and it wont find my hard disc. I'm using the standard arch linux kernel config available at https://projects.archlinux.org/svntogit/packages.git/tree/trunk/config?h=packages/linux

I've attached a couple of photos of the message and backtrace
Comment 1 Phillip Wood 2012-10-20 10:31:00 UTC
Created attachment 84101 [details]
Second page of backtrace
Comment 2 Phillip Wood 2012-10-20 10:33:09 UTC
Created attachment 84111 [details]
First page of backtrace
Comment 3 Borislav Petkov 2012-10-20 12:00:52 UTC
On Sat, Oct 20, 2012 at 10:19:22AM +0000, bugzilla-daemon@bugzilla.kernel.org wrote:
> https://bugzilla.kernel.org/show_bug.cgi?id=49151
> 
>            Summary: NULL pointer dereference in pata_acpi
>            Product: IO/Storage
>            Version: 2.5
>     Kernel Version: 3.6.2
>           Platform: All
>         OS/Version: Linux
>               Tree: Mainline
>             Status: NEW
>           Severity: normal
>           Priority: P1
>          Component: IDE
>         AssignedTo: io_ide@kernel-bugs.osdl.org
>         ReportedBy: phillip.wood@dunelm.org.uk
>         Regression: No
> 
> 
> Just upgraded from 3.2.20 to 3.6.2 and when I try to boot a get
> 
> BUG unable to handle kernel NULL pointer dereference at 00000010
> IP [<efe4c2407>] pacpi_set_dmamode+0x50/0xa0 [pata_acpi]
> 
> and it wont find my hard disc. I'm using the standard arch linux kernel config
> available at
> https://projects.archlinux.org/svntogit/packages.git/tree/trunk/config?h=packages/linux
> 
> I've attached a couple of photos of the message and backtrace

Ok,

let's first switch to mail.

FWIW, there's another report of this

http://marc.info/?l=linux-ide&m=134995465614435&w=2

and it is on 64-bit while Phillip's is 32-bit. Adding Anton and a couple
more people to CC.

From Anton's disassembly I get:

Ä 2.703078Ü Code: 01 00 00 00 f6 43 10 10 74 0a 41 89 c7 43 8d 0c 3f 41 d3 e6 41 0f b6 bd e1 02 00 00 e8 ce 74 0f 00 41 80 bd e1 02 00 00 3f 77 44 <0f> b7 40 10 41 f7 d6 44 21 73 10 4d 63 ff 42 89 44 fb 04 48 89
All code
========
   0:   01 00                   add    %eax,(%rax)
   2:   00 00                   add    %al,(%rax)
   4:   f6 43 10 10             testb  $0x10,0x10(%rbx)
   8:   74 0a                   je     0x14
   a:   41 89 c7                mov    %eax,%r15d
   d:   43 8d 0c 3f             lea    (%r15,%r15,1),%ecx
  11:   41 d3 e6                shl    %cl,%r14d
  14:   41 0f b6 bd e1 02 00    movzbl 0x2e1(%r13),%edi
  1b:   00 
  1c:   e8 ce 74 0f 00          callq  0xf74ef
  21:   41 80 bd e1 02 00 00    cmpb   $0x3f,0x2e1(%r13)
  28:   3f 
  29:   77 44                   ja     0x6f
  2b:*  0f b7 40 10             movzwl 0x10(%rax),%eax     <-- trapping instruction
  2f:   41 f7 d6                not    %r14d
  32:   44 21 73 10             and    %r14d,0x10(%rbx)
  36:   4d 63 ff                movslq %r15d,%r15
  39:   42 89 44 fb 04          mov    %eax,0x4(%rbx,%r15,8)
  3e:   48                      rex.W
  3f:   89                      .byte 0x89

And although I cannot generate the exact code here, building
drivers/ata/pata_acpi.c locally gives only one instruction like the
trapping one (thankfully, function is short enough):

	sall	%cl, %eax	# tmp92, tmp93
	orl	%eax, 16(%rbx)	# tmp93, acpi_6->gtm.flags
	jmp	.L30	#
.LVL46:
.L29:
	.loc 1 151 0
	movzwl	16(%rax), %eax	# t_12->cycle, t_12->cycle		<---
.LVL47:
	.loc 1 152 0
	leal	(%r12,%r12), %ecx	#, tmp97

which could mean that ata_timing_find_mode() might be returning NULL
on those systems (t is in %(r|e)ax in both oopses and the 0x10 offset
points to ata_timing->cycle).

So, Anton, Phillip, can you guys try the following debugging patch
to confirm (it is against mainline but should apply cleanly ontop of
3.6-stable):

---
diff --git a/drivers/ata/pata_acpi.c b/drivers/ata/pata_acpi.c
index 09723b76beac..c5a54faecb98 100644
--- a/drivers/ata/pata_acpi.c
+++ b/drivers/ata/pata_acpi.c
@@ -144,6 +144,12 @@ static void pacpi_set_dmamode(struct ata_port *ap, struct ata_device *adev)
 
 	/* Now stuff the nS values into the structure */
 	t = ata_timing_find_mode(adev->dma_mode);
+
+	if (!t) {
+		WARN(1, "%s: ata_timing_find_mode gives NULL\n", __func__);
+		return;
+	}
+
 	if (adev->dma_mode >= XFER_UDMA_0) {
 		acpi->gtm.drive[unit].dma = t->udma;
 		acpi->gtm.flags |= (1 << (2 * unit));
--

Thanks.
Comment 4 Anonymous Emailer 2012-10-21 16:04:17 UTC
Reply-To: phillip.wood@talktalk.net

On 10/20/2012 01:00 PM, Borislav Petkov wrote:
> On Sat, Oct 20, 2012 at 10:19:22AM +0000, bugzilla-daemon@bugzilla.kernel.org wrote:
>> https://bugzilla.kernel.org/show_bug.cgi?id=49151
>>
>>             Summary: NULL pointer dereference in pata_acpi
>>             Product: IO/Storage
>>             Version: 2.5
>>      Kernel Version: 3.6.2
>>            Platform: All
>>          OS/Version: Linux
>>                Tree: Mainline
>>              Status: NEW
>>            Severity: normal
>>            Priority: P1
>>           Component: IDE
>>          AssignedTo: io_ide@kernel-bugs.osdl.org
>>          ReportedBy: phillip.wood@dunelm.org.uk
>>          Regression: No
>>
>>
>> Just upgraded from 3.2.20 to 3.6.2 and when I try to boot a get
>>
>> BUG unable to handle kernel NULL pointer dereference at 00000010
>> IP [<efe4c2407>] pacpi_set_dmamode+0x50/0xa0 [pata_acpi]
>>
>> and it wont find my hard disc. I'm using the standard arch linux kernel config
>> available at
>> https://projects.archlinux.org/svntogit/packages.git/tree/trunk/config?h=packages/linux
>>
>> I've attached a couple of photos of the message and backtrace
>
> Ok,
>
> let's first switch to mail.
>
> FWIW, there's another report of this
>
> http://marc.info/?l=linux-ide&m=134995465614435&w=2
>
> and it is on 64-bit while Phillip's is 32-bit. Adding Anton and a couple
> more people to CC.
>
>  From Anton's disassembly I get:
>
> Ä 2.703078Ü Code: 01 00 00 00 f6 43 10 10 74 0a 41 89 c7 43 8d 0c 3f 41 d3 e6 41 0f b6 bd e1 02 00 00 e8 ce 74 0f 00 41 80 bd e1 02 00 00 3f 77 44 <0f> b7 40 10 41 f7 d6 44 21 73 10 4d 63 ff 42 89 44 fb 04 48 89
> All code
> ========
>     0:   01 00                   add    %eax,(%rax)
>     2:   00 00                   add    %al,(%rax)
>     4:   f6 43 10 10             testb  $0x10,0x10(%rbx)
>     8:   74 0a                   je     0x14
>     a:   41 89 c7                mov    %eax,%r15d
>     d:   43 8d 0c 3f             lea    (%r15,%r15,1),%ecx
>    11:   41 d3 e6                shl    %cl,%r14d
>    14:   41 0f b6 bd e1 02 00    movzbl 0x2e1(%r13),%edi
>    1b:   00
>    1c:   e8 ce 74 0f 00          callq  0xf74ef
>    21:   41 80 bd e1 02 00 00    cmpb   $0x3f,0x2e1(%r13)
>    28:   3f
>    29:   77 44                   ja     0x6f
>    2b:*  0f b7 40 10             movzwl 0x10(%rax),%eax     <-- trapping instruction
>    2f:   41 f7 d6                not    %r14d
>    32:   44 21 73 10             and    %r14d,0x10(%rbx)
>    36:   4d 63 ff                movslq %r15d,%r15
>    39:   42 89 44 fb 04          mov    %eax,0x4(%rbx,%r15,8)
>    3e:   48                      rex.W
>    3f:   89                      .byte 0x89
>
> And although I cannot generate the exact code here, building
> drivers/ata/pata_acpi.c locally gives only one instruction like the
> trapping one (thankfully, function is short enough):
>
> 	sall	%cl, %eax	# tmp92, tmp93
> 	orl	%eax, 16(%rbx)	# tmp93, acpi_6->gtm.flags
> 	jmp	.L30	#
> .LVL46:
> .L29:
> 	.loc 1 151 0
> 	movzwl	16(%rax), %eax	# t_12->cycle, t_12->cycle		<---
> .LVL47:
> 	.loc 1 152 0
> 	leal	(%r12,%r12), %ecx	#, tmp97
>
> which could mean that ata_timing_find_mode() might be returning NULL
> on those systems (t is in %(r|e)ax in both oopses and the 0x10 offset
> points to ata_timing->cycle).
>
> So, Anton, Phillip, can you guys try the following debugging patch
> to confirm (it is against mainline but should apply cleanly ontop of
> 3.6-stable):
>
> ---
> diff --git a/drivers/ata/pata_acpi.c b/drivers/ata/pata_acpi.c
> index 09723b76beac..c5a54faecb98 100644
> --- a/drivers/ata/pata_acpi.c
> +++ b/drivers/ata/pata_acpi.c
> @@ -144,6 +144,12 @@ static void pacpi_set_dmamode(struct ata_port *ap, struct ata_device *adev)
>
>   	/* Now stuff the nS values into the structure */
>   	t = ata_timing_find_mode(adev->dma_mode);
> +
> +	if (!t) {
> +		WARN(1, "%s: ata_timing_find_mode gives NULL\n", __func__);
> +		return;
> +	}
> +
>   	if (adev->dma_mode >= XFER_UDMA_0) {
>   		acpi->gtm.drive[unit].dma = t->udma;
>   		acpi->gtm.flags |= (1 << (2 * unit));
> --
>
> Thanks.
>
Hi Borislav

Thanks for responding to the bug report so quickly. I've applied your 
patch and the kernel now finds my hard drive and the logs (pasted below) 
have a couple of warnings generated by the patch. So if I've understood 
correctly then your theory that ata_timing_find_mode() is returning NULL 
is correct.

Thanks for looking into this, just let me know if you want me to do 
anything else

Best Wishes

Phillip


  [    1.932509] ------------[ cut here ]------------
  [    1.932509] WARNING: at drivers/ata/pata_acpi.c:149 
pacpi_set_dmamode+0xc7/0xe0 [pata_acpi]()
  [    1.932509] Hardware name: Portable PC
  [    1.932509] pacpi_set_dmamode: ata_timing_find_mode gives NULL
  [    1.932509] Modules linked in: pata_acpi ata_generic
  [    1.932509] Pid: 857, comm: scsi_eh_0 Not tainted 3.6.0-1-custom #1
  [    1.932509] Call Trace:
  [    1.932509]  [<c102cd28>] ? warn_slowpath_common+0x78/0xb0
  [    1.932509]  [<ef77e2b7>] ? pacpi_set_dmamode+0xc7/0xe0 [pata_acpi]
  [    1.932509]  [<ef77e2b7>] ? pacpi_set_dmamode+0xc7/0xe0 [pata_acpi]
  [    1.932509]  [<c102cdf3>] ? warn_slowpath_fmt+0x33/0x40
  [    1.932509]  [<ef77e2b7>] ? pacpi_set_dmamode+0xc7/0xe0 [pata_acpi]
  [    1.932509]  [<ef77e375>] ? pacpi_qc_issue+0x45/0x64 [pata_acpi]
  [    1.932509]  [<c126dfb2>] ? ata_qc_issue+0x152/0x320
  [    1.932509]  [<c140d1bd>] ? schedule_timeout+0xed/0x170
  [    1.932509]  [<c126e3c9>] ? ata_exec_internal_sg+0x249/0x510
  [    1.932509]  [<c127d2d0>] ? ata_release_transport+0x40/0x40
  [    1.932509]  [<c1039145>] ? msleep+0x15/0x20
  [    1.932509]  [<c126e6f2>] ? ata_exec_internal+0x62/0xa0
  [    1.932509]  [<c126e755>] ? ata_do_dev_read_id+0x25/0x30
  [    1.932509]  [<c126ea35>] ? ata_dev_read_id+0x245/0x560
  [    1.932509]  [<c127af72>] ? ata_eh_recover+0x762/0x1270
  [    1.932509]  [<c127dcb0>] ? ata_sff_drain_fifo+0x80/0x80
  [    1.932509]  [<ef77e180>] ? pacpi_port_start+0x80/0x80 [pata_acpi]
  [    1.932509]  [<c127e210>] ? ata_sff_wait_after_reset+0x130/0x130
  [    1.932509]  [<c127dcb0>] ? ata_sff_drain_fifo+0x80/0x80
  [    1.932509]  [<c127c490>] ? ata_do_eh+0x40/0xb0
  [    1.932509]  [<c127dcb0>] ? ata_sff_drain_fifo+0x80/0x80
  [    1.932509]  [<c127e210>] ? ata_sff_wait_after_reset+0x130/0x130
  [    1.932509]  [<ef77e180>] ? pacpi_port_start+0x80/0x80 [pata_acpi]
  [    1.932509]  [<c127e210>] ? ata_sff_wait_after_reset+0x130/0x130
  [    1.932509]  [<c127ec77>] ? ata_sff_error_handler+0xb7/0x120
  [    1.932509]  [<c127dcb0>] ? ata_sff_drain_fifo+0x80/0x80
  [    1.932509]  [<c127bfc5>] ? ata_scsi_port_error_handler+0x495/0x860
  [    1.932509]  [<c127ece0>] ? ata_sff_error_handler+0x120/0x120
  [    1.932509]  [<c127c413>] ? ata_scsi_error+0x83/0xc0
  [    1.932509]  [<c125533c>] ? scsi_error_handler+0x8c/0x470
  [    1.932509]  [<c104f6b4>] ? __wake_up_common+0x44/0x70
  [    1.932509]  [<c12552b0>] ? scsi_eh_get_sense+0xd0/0xd0
  [    1.932509]  [<c12552b0>] ? scsi_eh_get_sense+0xd0/0xd0
  [    1.932509]  [<c104719c>] ? kthread+0x6c/0x80
  [    1.932509]  [<c1047130>] ? kthread_freezable_should_stop+0x50/0x50
  [    1.932509]  [<c140f8f6>] ? kernel_thread_helper+0x6/0xd
  [    1.932509] ---[ end trace 7db6a26b2c0e9208 ]---


  [    2.106520] ------------[ cut here ]------------
  [    2.106520] WARNING: at drivers/ata/pata_acpi.c:149 
pacpi_set_dmamode+0xc7/0xe0 [pata_acpi]()
  [    2.106520] Hardware name: Portable PC
  [    2.106520] pacpi_set_dmamode: ata_timing_find_mode gives NULL
  [    1.951725] ACPI: Invalid Power Resource to register!
  [    2.106520] Modules linked in: pata_acpi ata_generic
  [    2.106520] Pid: 863, comm: scsi_eh_1 Tainted: G        W 
3.6.0-1-custom #1
  [    2.106520] Call Trace:
  [    2.106520]  [<c102cd28>] ? warn_slowpath_common+0x78/0xb0
  [    2.106520]  [<ef77e2b7>] ? pacpi_set_dmamode+0xc7/0xe0 [pata_acpi]
  [    2.106520]  [<ef77e2b7>] ? pacpi_set_dmamode+0xc7/0xe0 [pata_acpi]
  [    2.106520]  [<c102cdf3>] ? warn_slowpath_fmt+0x33/0x40
  [    2.106520]  [<ef77e2b7>] ? pacpi_set_dmamode+0xc7/0xe0 [pata_acpi]
  [    2.106520]  [<ef77e375>] ? pacpi_qc_issue+0x45/0x64 [pata_acpi]
  [    2.106520]  [<c126dfb2>] ? ata_qc_issue+0x152/0x320
  [    2.106520]  [<c11cda30>] ? acpi_os_release_object+0x5/0x8
  [    2.106520]  [<c10b0e7b>] ? __kmalloc+0x2b/0x130
  [    2.106520]  [<c126e3c9>] ? ata_exec_internal_sg+0x249/0x510
  [    2.106520]  [<c140d1bd>] ? schedule_timeout+0xed/0x170
  [    2.106520]  [<c11eaa87>] ? acpi_ut_delete_internal_obj+0x162/0x172
  [    2.106520]  [<c126e6f2>] ? ata_exec_internal+0x62/0xa0
  [    2.106520]  [<c126e755>] ? ata_do_dev_read_id+0x25/0x30
  [    2.106520]  [<c126ea35>] ? ata_dev_read_id+0x245/0x560
  [    2.106520]  [<c127af72>] ? ata_eh_recover+0x762/0x1270
  [    2.106520]  [<c127dcb0>] ? ata_sff_drain_fifo+0x80/0x80
  [    2.106520]  [<ef77e180>] ? pacpi_port_start+0x80/0x80 [pata_acpi]
  [    2.106520]  [<c127e210>] ? ata_sff_wait_after_reset+0x130/0x130
  [    2.106520]  [<c127dcb0>] ? ata_sff_drain_fifo+0x80/0x80
  [    2.106520]  [<c127c490>] ? ata_do_eh+0x40/0xb0
  [    2.106520]  [<c127dcb0>] ? ata_sff_drain_fifo+0x80/0x80
  [    2.106520]  [<c127e210>] ? ata_sff_wait_after_reset+0x130/0x130
  [    2.106520]  [<ef77e180>] ? pacpi_port_start+0x80/0x80 [pata_acpi]
  [    2.106520]  [<c127e210>] ? ata_sff_wait_after_reset+0x130/0x130
  [    2.106520]  [<c127ec77>] ? ata_sff_error_handler+0xb7/0x120
  [    2.106520]  [<c127dcb0>] ? ata_sff_drain_fifo+0x80/0x80
  [    2.106520]  [<c127bfc5>] ? ata_scsi_port_error_handler+0x495/0x860
  [    2.106520]  [<c127ece0>] ? ata_sff_error_handler+0x120/0x120
  [    2.106520]  [<c127c413>] ? ata_scsi_error+0x83/0xc0
  [    2.106520]  [<c125533c>] ? scsi_error_handler+0x8c/0x470
  [    2.106520]  [<c104f6b4>] ? __wake_up_common+0x44/0x70
  [    2.106520]  [<c12552b0>] ? scsi_eh_get_sense+0xd0/0xd0
  [    2.106520]  [<c12552b0>] ? scsi_eh_get_sense+0xd0/0xd0
  [    2.106520]  [<c104719c>] ? kthread+0x6c/0x80
  [    2.106520]  [<c1047130>] ? kthread_freezable_should_stop+0x50/0x50
  [    2.106520]  [<c140f8f6>] ? kernel_thread_helper+0x6/0xd
  [    2.106520] ---[ end trace 7db6a26b2c0e9209 ]---
Comment 5 Borislav Petkov 2012-10-21 16:58:00 UTC
On Sun, Oct 21, 2012 at 05:04:12PM +0100, Phillip Wood wrote:
> Thanks for responding to the bug report so quickly. I've applied your
> patch and the kernel now finds my hard drive and the logs (pasted
> below) have a couple of warnings generated by the patch. So if I've
> understood correctly then your theory that ata_timing_find_mode() is
> returning NULL is correct.

Yes, it appears so.

> Thanks for looking into this, just let me know if you want me to do
> anything else.

Right, so we know what exactly happens and I think we have the right
people on CC who can make sense of why it happens.

If I'd be to guess, this is most probably a BIOS bug (what else?! :-))
which the pata_acpi code is not ready to handle.

Btw, Jeff, AFAICT, libata code should the very least catch this
situation so that we know. Patch for this below. From a quick look there
a couple of drivers which do not check ata_timing_find_mode()'s retval
and I guess at least issuing a warning in such situations could be
helpful with future issues.

However, I don't know how chatty this warning could become and whether
this is the right approach and not auditing all users is better.

What you can do, Phillip, is check whether some other specific PATA
driver supports your hardware and enable it instead of PATA_ACPI. What
does lspci on the box say? Or rather 'lspci -v' for more details. You
can also send dmesg from the box.

Thanks.

--
From: Borislav Petkov <bp@alien8.de>
Date: Sun, 21 Oct 2012 18:49:08 +0200
Subject: [PATCH] libata: Warn when unable to find timing descriptor based on
 xfer_mode

ata_timing_find_mode could return NULL which is not checked by all
low-level ATA drivers using it and cause a NULL ptr deref. Warn at least
so that possible issues can get fixed easily.

Signed-off-by: Borislav Petkov <bp@alien8.de>
---
 drivers/ata/libata-core.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 3cc7096cfda7..f46fbd3bd3fb 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -2942,6 +2942,10 @@ const struct ata_timing *ata_timing_find_mode(u8 xfer_mode)
 
 	if (xfer_mode == t->mode)
 		return t;
+
+	WARN_ONCE(true, "%s: unable to find timing for xfer_mode 0x%x\n",
+			__func__, xfer_mode);
+
 	return NULL;
 }
Comment 6 Anton Boyarshinov 2012-10-22 12:15:50 UTC
Thank you for responce!
There is a log with both patches applied. System boots and works.
-------------------------
[    1.108357] ata3: PATA max UDMA/133 cmd 0xf80 ctl 0xf00 bmdma 0xb800 irq 21
[    1.108363] ata4: PATA max UDMA/133 cmd 0xe80 ctl 0xe00 bmdma 0xb808 irq 21
[    1.264255] ------------[ cut here ]------------
[    1.264303] WARNING: at drivers/ata/libata-core.c:2928 ata_timing_find_mode+0x6a/0x80 [libata]()
[    1.264307] Hardware name: ATLANT \xffffffd52 4800/251
[    1.264312] ata_timing_find_mode: unable to find timing for xfer_mode 0x0
[    1.264315] Modules linked in: ahci libahci pata_acpi libata scsi_mod
[    1.264332] Pid: 547, comm: scsi_eh_2 Not tainted 3.6.3-un-def-alt1 #1
[    1.264336] Call Trace:
[    1.264353]  [<ffffffff81059b2a>] warn_slowpath_common+0x7a/0xb0
[    1.264361]  [<ffffffff81059c01>] warn_slowpath_fmt+0x41/0x50
[    1.264380]  [<ffffffffa0097b4a>] ata_timing_find_mode+0x6a/0x80 [libata]
[    1.264391]  [<ffffffffa0037282>] pacpi_set_dmamode+0x42/0xf0 [pata_acpi]
[    1.264401]  [<ffffffffa00373fa>] pacpi_qc_issue+0x5a/0x7c [pata_acpi]
[    1.264421]  [<ffffffffa00997af>] ata_qc_issue+0x1ff/0x370 [libata]
[    1.264433]  [<ffffffff81047e73>] ? default_spin_lock_flags+0x13/0x20
[    1.264453]  [<ffffffffa0099c61>] ata_exec_internal_sg+0x341/0x640 [libata]
[    1.264475]  [<ffffffffa00aaf27>] ? ata_sff_dev_classify+0x67/0x110 [libata]
[    1.264494]  [<ffffffffa0099fd4>] ata_exec_internal+0x74/0xb0 [libata]
[    1.264514]  [<ffffffffa00ab450>] ? ata_sff_wait_after_reset+0x140/0x140 [libata]
[    1.264533]  [<ffffffffa009a0b5>] ata_do_dev_read_id+0x25/0x30 [libata]
[    1.264553]  [<ffffffffa00a5d8c>] ? ata_eh_reset+0x24c/0xc80 [libata]
[    1.264571]  [<ffffffffa009a3e4>] ata_dev_read_id+0x324/0x5a0 [libata]
[    1.264590]  [<ffffffffa00ab450>] ? ata_sff_wait_after_reset+0x140/0x140 [libata]
[    1.264599]  [<ffffffff81047e73>] ? default_spin_lock_flags+0x13/0x20
[    1.264619]  [<ffffffffa00a7164>] ata_eh_recover+0x824/0x13e0 [libata]
[    1.264629]  [<ffffffff810993e1>] ? load_balance+0x611/0x8c0
[    1.264649]  [<ffffffffa00aae20>] ? ata_sff_drain_fifo+0x80/0x80 [libata]
[    1.264668]  [<ffffffffa00ab450>] ? ata_sff_wait_after_reset+0x140/0x140 [libata]
[    1.264677]  [<ffffffffa00371c0>] ? pacpi_port_start+0xa0/0xa0 [pata_acpi]
[    1.264687]  [<ffffffff814acf39>] ? _raw_spin_lock_irq+0x39/0x50
[    1.264696]  [<ffffffff810789cb>] ? wait_on_work+0x1fb/0x210
[    1.264705]  [<ffffffffa00371c0>] ? pacpi_port_start+0xa0/0xa0 [pata_acpi]
[    1.264724]  [<ffffffffa00ab450>] ? ata_sff_wait_after_reset+0x140/0x140 [libata]
[    1.264744]  [<ffffffffa00a869d>] ata_do_eh+0x4d/0xc0 [libata]
[    1.264763]  [<ffffffffa00aae20>] ? ata_sff_drain_fifo+0x80/0x80 [libata]
[    1.264782]  [<ffffffffa00ab450>] ? ata_sff_wait_after_reset+0x140/0x140 [libata]
[    1.264802]  [<ffffffffa00aabee>] ata_sff_error_handler+0xce/0x130 [libata]
[    1.264821]  [<ffffffffa00aacdf>] ata_bmdma_error_handler+0x8f/0x150 [libata]
[    1.264841]  [<ffffffffa00a82a9>] ata_scsi_port_error_handler+0x499/0x770 [libata]
[    1.264861]  [<ffffffffa00a8613>] ata_scsi_error+0x93/0xd0 [libata]
[    1.264896]  [<ffffffffa0007eba>] scsi_error_handler+0x12a/0x720 [scsi_mod]
[    1.264915]  [<ffffffffa0007d90>] ? scsi_eh_get_sense+0x210/0x210 [scsi_mod]
[    1.264933]  [<ffffffffa0007d90>] ? scsi_eh_get_sense+0x210/0x210 [scsi_mod]
[    1.264940]  [<ffffffff8107f386>] kthread+0x96/0xa0
[    1.264950]  [<ffffffff814b5804>] kernel_thread_helper+0x4/0x10
[    1.264957]  [<ffffffff8107f2f0>] ? kthread_freezable_should_stop+0x80/0x80
[    1.264964]  [<ffffffff814b5800>] ? gs_change+0x13/0x13
[    1.264969] ---[ end trace a98d36ed22847d07 ]---
[    1.264972] ------------[ cut here ]------------
[    1.264980] WARNING: at drivers/ata/pata_acpi.c:149 pacpi_set_dmamode+0xdf/0xf0 [pata_acpi]()
[    1.264983] Hardware name: ATLANT \xffffffd52 4800/251
[    1.264987] pacpi_set_dmamode: ata_timing_find_mode gives NULL
[    1.264989] Modules linked in: ahci libahci pata_acpi libata scsi_mod
[    1.265002] Pid: 547, comm: scsi_eh_2 Tainted: G        W    3.6.3-un-def-alt1 #1
[    1.265005] Call Trace:
[    1.265013]  [<ffffffff81059b2a>] warn_slowpath_common+0x7a/0xb0
[    1.265020]  [<ffffffff81059c01>] warn_slowpath_fmt+0x41/0x50
[    1.265030]  [<ffffffffa003731f>] pacpi_set_dmamode+0xdf/0xf0 [pata_acpi]
[    1.265038]  [<ffffffffa00373fa>] pacpi_qc_issue+0x5a/0x7c [pata_acpi]
[    1.265057]  [<ffffffffa00997af>] ata_qc_issue+0x1ff/0x370 [libata]
[    1.265065]  [<ffffffff81047e73>] ? default_spin_lock_flags+0x13/0x20
[    1.265084]  [<ffffffffa0099c61>] ata_exec_internal_sg+0x341/0x640 [libata]
[    1.265104]  [<ffffffffa00aaf27>] ? ata_sff_dev_classify+0x67/0x110 [libata]
[    1.265123]  [<ffffffffa0099fd4>] ata_exec_internal+0x74/0xb0 [libata]
[    1.265142]  [<ffffffffa00ab450>] ? ata_sff_wait_after_reset+0x140/0x140 [libata]
[    1.265161]  [<ffffffffa009a0b5>] ata_do_dev_read_id+0x25/0x30 [libata]
[    1.265180]  [<ffffffffa00a5d8c>] ? ata_eh_reset+0x24c/0xc80 [libata]
[    1.265198]  [<ffffffffa009a3e4>] ata_dev_read_id+0x324/0x5a0 [libata]
[    1.265217]  [<ffffffffa00ab450>] ? ata_sff_wait_after_reset+0x140/0x140 [libata]
[    1.265226]  [<ffffffff81047e73>] ? default_spin_lock_flags+0x13/0x20
[    1.265246]  [<ffffffffa00a7164>] ata_eh_recover+0x824/0x13e0 [libata]
[    1.265254]  [<ffffffff810993e1>] ? load_balance+0x611/0x8c0
[    1.265273]  [<ffffffffa00aae20>] ? ata_sff_drain_fifo+0x80/0x80 [libata]
[    1.265292]  [<ffffffffa00ab450>] ? ata_sff_wait_after_reset+0x140/0x140 [libata]
[    1.265301]  [<ffffffffa00371c0>] ? pacpi_port_start+0xa0/0xa0 [pata_acpi]
[    1.265308]  [<ffffffff814acf39>] ? _raw_spin_lock_irq+0x39/0x50
[    1.265315]  [<ffffffff810789cb>] ? wait_on_work+0x1fb/0x210
[    1.265324]  [<ffffffffa00371c0>] ? pacpi_port_start+0xa0/0xa0 [pata_acpi]
[    1.265343]  [<ffffffffa00ab450>] ? ata_sff_wait_after_reset+0x140/0x140 [libata]
[    1.265363]  [<ffffffffa00a869d>] ata_do_eh+0x4d/0xc0 [libata]
[    1.265382]  [<ffffffffa00aae20>] ? ata_sff_drain_fifo+0x80/0x80 [libata]
[    1.265401]  [<ffffffffa00ab450>] ? ata_sff_wait_after_reset+0x140/0x140 [libata]
[    1.265420]  [<ffffffffa00aabee>] ata_sff_error_handler+0xce/0x130 [libata]
[    1.265440]  [<ffffffffa00aacdf>] ata_bmdma_error_handler+0x8f/0x150 [libata]
[    1.265460]  [<ffffffffa00a82a9>] ata_scsi_port_error_handler+0x499/0x770 [libata]
[    1.265480]  [<ffffffffa00a8613>] ata_scsi_error+0x93/0xd0 [libata]
[    1.265499]  [<ffffffffa0007eba>] scsi_error_handler+0x12a/0x720 [scsi_mod]
[    1.265518]  [<ffffffffa0007d90>] ? scsi_eh_get_sense+0x210/0x210 [scsi_mod]
[    1.265535]  [<ffffffffa0007d90>] ? scsi_eh_get_sense+0x210/0x210 [scsi_mod]
[    1.265542]  [<ffffffff8107f386>] kthread+0x96/0xa0
[    1.265550]  [<ffffffff814b5804>] kernel_thread_helper+0x4/0x10
[    1.265558]  [<ffffffff8107f2f0>] ? kthread_freezable_should_stop+0x80/0x80
[    1.265565]  [<ffffffff814b5800>] ? gs_change+0x13/0x13
[    1.265568] ---[ end trace a98d36ed22847d08 ]---
Comment 7 Anton Boyarshinov 2012-10-22 12:21:55 UTC
lspci -v from the box above
----------------
00:00.0 RAM memory: NVIDIA Corporation MCP65 Memory Controller (rev a3)
	Subsystem: Micro-Star International Co., Ltd. Device 7369
	Flags: bus master, 66MHz, fast devsel, latency 0
	Capabilities: [44] HyperTransport: Slave or Primary Interface
	Capabilities: [dc] HyperTransport: MSI Mapping Enable+ Fixed-

00:01.0 ISA bridge: NVIDIA Corporation MCP65 LPC Bridge (rev a3)
	Subsystem: Micro-Star International Co., Ltd. Device 7369
	Flags: bus master, 66MHz, fast devsel, latency 0
	I/O ports at 2f00 [size=256]

00:01.1 SMBus: NVIDIA Corporation MCP65 SMBus (rev a1)
	Subsystem: Micro-Star International Co., Ltd. Device 7369
	Flags: 66MHz, fast devsel, IRQ 11
	I/O ports at 2900 [size=64]
	I/O ports at 2d00 [size=64]
	I/O ports at 2e00 [size=64]
	Capabilities: [44] Power Management version 2
	Kernel driver in use: nForce2_smbus

00:01.2 RAM memory: NVIDIA Corporation MCP65 Memory Controller (rev a1)
	Subsystem: Micro-Star International Co., Ltd. Device 7369
	Flags: 66MHz, fast devsel

00:02.0 USB controller: NVIDIA Corporation MCP65 USB Controller (rev a3) (prog-if 10 [OHCI])
	Subsystem: Micro-Star International Co., Ltd. Device 7369
	Flags: bus master, 66MHz, fast devsel, latency 0, IRQ 23
	Memory at f9eff000 (32-bit, non-prefetchable) [size=4K]
	Capabilities: [44] Power Management version 2
	Kernel driver in use: ohci_hcd

00:02.1 USB controller: NVIDIA Corporation MCP65 USB Controller (rev a3) (prog-if 20 [EHCI])
	Subsystem: Micro-Star International Co., Ltd. Device 7369
	Flags: bus master, 66MHz, fast devsel, latency 0, IRQ 22
	Memory at f9efec00 (32-bit, non-prefetchable) [size=256]
	Capabilities: [44] Debug port: BAR=1 offset=0098
	Capabilities: [80] Power Management version 2
	Kernel driver in use: ehci_hcd

00:08.0 PCI bridge: NVIDIA Corporation MCP65 PCI bridge (rev a1) (prog-if 01 [Subtractive decode])
	Flags: bus master, 66MHz, fast devsel, latency 0
	Bus: primary=00, secondary=01, subordinate=01, sec-latency=64
	Capabilities: [b8] Subsystem: Micro-Star International Co., Ltd. Device 7369
	Capabilities: [8c] HyperTransport: MSI Mapping Enable- Fixed-

00:09.0 IDE interface: NVIDIA Corporation MCP65 IDE (rev a1) (prog-if 8a [Master SecP PriP])
	Subsystem: Micro-Star International Co., Ltd. Device 7369
	Flags: bus master, 66MHz, fast devsel, latency 0
	[virtual] Memory at 000001f0 (32-bit, non-prefetchable) [size=8]
	[virtual] Memory at 000003f0 (type 3, non-prefetchable)
	[virtual] Memory at 00000170 (32-bit, non-prefetchable) [size=8]
	[virtual] Memory at 00000370 (type 3, non-prefetchable)
	I/O ports at ffa0 [size=16]
	Capabilities: [44] Power Management version 2
	Kernel driver in use: pata_acpi

00:0a.0 IDE interface: NVIDIA Corporation MCP65 SATA Controller (rev a3) (prog-if 85 [Master SecO PriO])
	Subsystem: Micro-Star International Co., Ltd. Device 7369
	Flags: bus master, 66MHz, fast devsel, latency 0, IRQ 21
	I/O ports at 0f80 [size=8]
	I/O ports at 0f00 [size=4]
	I/O ports at 0e80 [size=8]
	I/O ports at 0e00 [size=4]
	I/O ports at b800 [size=16]
	Memory at f9efc000 (32-bit, non-prefetchable) [size=8K]
	Capabilities: [44] Power Management version 2
	Capabilities: [b0] MSI: Enable- Count=1/8 Maskable- 64bit+
	Capabilities: [cc] HyperTransport: MSI Mapping Enable- Fixed+
	Kernel driver in use: pata_acpi

00:0b.0 PCI bridge: NVIDIA Corporation Device 045b (rev a1) (prog-if 00 [Normal decode])
	Flags: bus master, fast devsel, latency 0
	Bus: primary=00, secondary=02, subordinate=02, sec-latency=0
	Capabilities: [40] Subsystem: NVIDIA Corporation Device 0000
	Capabilities: [48] Power Management version 2
	Capabilities: [50] MSI: Enable+ Count=1/2 Maskable- 64bit+
	Capabilities: [60] HyperTransport: MSI Mapping Enable- Fixed-
	Capabilities: [80] Express Root Port (Slot+), MSI 00
	Capabilities: [100] Virtual Channel
	Kernel driver in use: pcieport

00:0c.0 PCI bridge: NVIDIA Corporation MCP65 PCI Express bridge (rev a1) (prog-if 00 [Normal decode])
	Flags: bus master, fast devsel, latency 0
	Bus: primary=00, secondary=03, subordinate=03, sec-latency=0
	I/O behind bridge: 0000d000-0000dfff
	Memory behind bridge: f9f00000-f9ffffff
	Capabilities: [40] Subsystem: NVIDIA Corporation Device 0000
	Capabilities: [48] Power Management version 2
	Capabilities: [50] MSI: Enable+ Count=1/2 Maskable- 64bit+
	Capabilities: [60] HyperTransport: MSI Mapping Enable- Fixed-
	Capabilities: [80] Express Root Port (Slot+), MSI 00
	Capabilities: [100] Virtual Channel
	Kernel driver in use: pcieport

00:0d.0 PCI bridge: NVIDIA Corporation MCP65 PCI Express bridge (rev a1) (prog-if 00 [Normal decode])
	Flags: bus master, fast devsel, latency 0
	Bus: primary=00, secondary=04, subordinate=04, sec-latency=0
	I/O behind bridge: 0000e000-0000efff
	Memory behind bridge: fa000000-febfffff
	Prefetchable memory behind bridge: 00000000d0000000-00000000dfffffff
	Capabilities: [40] Subsystem: NVIDIA Corporation Device 0000
	Capabilities: [48] Power Management version 2
	Capabilities: [50] MSI: Enable+ Count=1/2 Maskable- 64bit+
	Capabilities: [60] HyperTransport: MSI Mapping Enable- Fixed-
	Capabilities: [80] Express Root Port (Slot+), MSI 00
	Capabilities: [100] Virtual Channel
	Kernel driver in use: pcieport

00:0e.0 PCI bridge: NVIDIA Corporation MCP65 PCI Express bridge (rev a1) (prog-if 00 [Normal decode])
	Flags: bus master, fast devsel, latency 0
	Bus: primary=00, secondary=05, subordinate=05, sec-latency=0
	Capabilities: [40] Subsystem: NVIDIA Corporation Device 0000
	Capabilities: [48] Power Management version 2
	Capabilities: [50] MSI: Enable+ Count=1/2 Maskable- 64bit+
	Capabilities: [60] HyperTransport: MSI Mapping Enable- Fixed-
	Capabilities: [80] Express Root Port (Slot+), MSI 00
	Capabilities: [100] Virtual Channel
	Kernel driver in use: pcieport

00:18.0 Host bridge: Advanced Micro Devices [AMD] K8 [Athlon64/Opteron] HyperTransport Technology Configuration
	Flags: fast devsel
	Capabilities: [80] HyperTransport: Host or Secondary Interface

00:18.1 Host bridge: Advanced Micro Devices [AMD] K8 [Athlon64/Opteron] Address Map
	Flags: fast devsel

00:18.2 Host bridge: Advanced Micro Devices [AMD] K8 [Athlon64/Opteron] DRAM Controller
	Flags: fast devsel

00:18.3 Host bridge: Advanced Micro Devices [AMD] K8 [Athlon64/Opteron] Miscellaneous Control
	Flags: fast devsel
	Capabilities: [f0] Secure device <?>
	Kernel driver in use: k8temp

03:00.0 Ethernet controller: Realtek Semiconductor Co., Ltd. RTL8111/8168B PCI Express Gigabit Ethernet controller (rev 01)
	Subsystem: Micro-Star International Co., Ltd. Device 369c
	Flags: bus master, fast devsel, latency 0, IRQ 44
	I/O ports at d800 [size=256]
	Memory at f9fff000 (64-bit, non-prefetchable) [size=4K]
	Expansion ROM at f9fc0000 [disabled] [size=128K]
	Capabilities: [40] Power Management version 2
	Capabilities: [48] Vital Product Data
	Capabilities: [50] MSI: Enable+ Count=1/2 Maskable- 64bit+
	Capabilities: [60] Express Endpoint, MSI 00
	Capabilities: [84] Vendor Specific Information: Len=4c <?>
	Capabilities: [100] Advanced Error Reporting
	Capabilities: [12c] Virtual Channel
	Capabilities: [148] Device Serial Number 1d-00-00-00-10-ec-81-68
	Capabilities: [154] Power Budgeting <?>
	Kernel driver in use: r8169

04:00.0 VGA compatible controller: NVIDIA Corporation G84 [GeForce 8600 GT] (rev a1) (prog-if 00 [VGA controller])
	Flags: bus master, fast devsel, latency 0, IRQ 18
	Memory at fd000000 (32-bit, non-prefetchable) [size=16M]
	Memory at d0000000 (64-bit, prefetchable) [size=256M]
	Memory at fa000000 (64-bit, non-prefetchable) [size=32M]
	I/O ports at ec00 [size=128]
	Expansion ROM at febe0000 [disabled] [size=128K]
	Capabilities: [60] Power Management version 2
	Capabilities: [68] MSI: Enable- Count=1/1 Maskable- 64bit+
	Capabilities: [78] Express Endpoint, MSI 00
	Capabilities: [100] Virtual Channel
	Capabilities: [128] Power Budgeting <?>
	Capabilities: [600] Vendor Specific Information: ID=0001 Rev=1 Len=024 <?>
	Kernel driver in use: nouveau
Comment 8 Anton Boyarshinov 2012-10-22 12:42:35 UTC
lspci -v from another box with the same problem and the same reaction on this workaround.
---------------------------
00:00.0 RAM memory: NVIDIA Corporation C51 Host Bridge (rev a2)
	Subsystem: ASUSTeK Computer Inc. Device 81c0
	Flags: bus master, 66MHz, fast devsel, latency 0
	Capabilities: [44] HyperTransport: Slave or Primary Interface
	Capabilities: [e0] HyperTransport: MSI Mapping Enable+ Fixed-

00:00.1 RAM memory: NVIDIA Corporation C51 Memory Controller 0 (rev a2)
	Subsystem: ASUSTeK Computer Inc. Device 81c0
	Flags: 66MHz, fast devsel

00:00.2 RAM memory: NVIDIA Corporation C51 Memory Controller 1 (rev a2)
	Subsystem: ASUSTeK Computer Inc. Device 81c0
	Flags: 66MHz, fast devsel

00:00.3 RAM memory: NVIDIA Corporation C51 Memory Controller 5 (rev a2)
	Subsystem: ASUSTeK Computer Inc. Device 81c0
	Flags: 66MHz, fast devsel

00:00.4 RAM memory: NVIDIA Corporation C51 Memory Controller 4 (rev a2)
	Subsystem: ASUSTeK Computer Inc. Device 81c0
	Flags: bus master, 66MHz, fast devsel, latency 0

00:00.5 RAM memory: NVIDIA Corporation C51 Host Bridge (rev a2)
	Subsystem: ASUSTeK Computer Inc. Device 81c0
	Flags: bus master, 66MHz, fast devsel, latency 0
	Capabilities: [44] #00 [00fe]
	Capabilities: [fc] #00 [0000]

00:00.6 RAM memory: NVIDIA Corporation C51 Memory Controller 3 (rev a2)
	Subsystem: ASUSTeK Computer Inc. Device 81c0
	Flags: 66MHz, fast devsel

00:00.7 RAM memory: NVIDIA Corporation C51 Memory Controller 2 (rev a2)
	Subsystem: ASUSTeK Computer Inc. Device 81c0
	Flags: 66MHz, fast devsel

00:02.0 PCI bridge: NVIDIA Corporation C51 PCI Express Bridge (rev a1) (prog-if 00 [Normal decode])
	Flags: bus master, fast devsel, latency 0
	Bus: primary=00, secondary=01, subordinate=01, sec-latency=0
	I/O behind bridge: 0000a000-0000afff
	Memory behind bridge: fdd00000-fddfffff
	Prefetchable memory behind bridge: 00000000fda00000-00000000fdafffff
	Capabilities: [40] Subsystem: NVIDIA Corporation Device 0000
	Capabilities: [48] Power Management version 2
	Capabilities: [50] MSI: Enable+ Count=1/2 Maskable- 64bit+
	Capabilities: [60] HyperTransport: MSI Mapping Enable- Fixed-
	Capabilities: [80] Express Root Port (Slot+), MSI 00
	Capabilities: [100] Virtual Channel
	Kernel driver in use: pcieport

00:03.0 PCI bridge: NVIDIA Corporation C51 PCI Express Bridge (rev a1) (prog-if 00 [Normal decode])
	Flags: bus master, fast devsel, latency 0
	Bus: primary=00, secondary=02, subordinate=02, sec-latency=0
	I/O behind bridge: 00008000-00008fff
	Memory behind bridge: fd900000-fd9fffff
	Prefetchable memory behind bridge: 00000000fde00000-00000000fdefffff
	Capabilities: [40] Subsystem: NVIDIA Corporation Device 0000
	Capabilities: [48] Power Management version 2
	Capabilities: [50] MSI: Enable+ Count=1/2 Maskable- 64bit+
	Capabilities: [60] HyperTransport: MSI Mapping Enable- Fixed-
	Capabilities: [80] Express Root Port (Slot+), MSI 00
	Capabilities: [100] Virtual Channel
	Kernel driver in use: pcieport

00:04.0 PCI bridge: NVIDIA Corporation C51 PCI Express Bridge (rev a1) (prog-if 00 [Normal decode])
	Flags: bus master, fast devsel, latency 0
	Bus: primary=00, secondary=03, subordinate=03, sec-latency=0
	I/O behind bridge: 0000b000-0000bfff
	Memory behind bridge: fa000000-fcffffff
	Prefetchable memory behind bridge: 00000000e0000000-00000000efffffff
	Capabilities: [40] Subsystem: NVIDIA Corporation Device 0000
	Capabilities: [48] Power Management version 2
	Capabilities: [50] MSI: Enable+ Count=1/2 Maskable- 64bit+
	Capabilities: [60] HyperTransport: MSI Mapping Enable- Fixed-
	Capabilities: [80] Express Root Port (Slot+), MSI 00
	Capabilities: [100] Virtual Channel
	Kernel driver in use: pcieport

00:09.0 RAM memory: NVIDIA Corporation MCP51 Host Bridge (rev a2)
	Subsystem: ASUSTeK Computer Inc. Device 81c0
	Flags: bus master, 66MHz, fast devsel, latency 0
	Capabilities: [44] HyperTransport: Slave or Primary Interface
	Capabilities: [e0] HyperTransport: MSI Mapping Enable- Fixed-

00:0a.0 ISA bridge: NVIDIA Corporation MCP51 LPC Bridge (rev a3)
	Subsystem: ASUSTeK Computer Inc. Device 81c0
	Flags: bus master, 66MHz, fast devsel, latency 0

00:0a.1 SMBus: NVIDIA Corporation MCP51 SMBus (rev a3)
	Subsystem: ASUSTeK Computer Inc. Device 81c0
	Flags: 66MHz, fast devsel, IRQ 5
	I/O ports at 4c00 [size=64]
	I/O ports at 4c40 [size=64]
	Capabilities: [44] Power Management version 2
	Kernel driver in use: nForce2_smbus

00:0a.2 RAM memory: NVIDIA Corporation MCP51 Memory Controller 0 (rev a3)
	Subsystem: ASUSTeK Computer Inc. Device 81c0
	Flags: 66MHz, fast devsel

00:0b.0 USB controller: NVIDIA Corporation MCP51 USB Controller (rev a3) (prog-if 10 [OHCI])
	Subsystem: ASUSTeK Computer Inc. Device 81c0
	Flags: bus master, 66MHz, fast devsel, latency 0, IRQ 23
	Memory at fe02f000 (32-bit, non-prefetchable) [size=4K]
	Capabilities: [44] Power Management version 2
	Kernel driver in use: ohci_hcd

00:0b.1 USB controller: NVIDIA Corporation MCP51 USB Controller (rev a3) (prog-if 20 [EHCI])
	Subsystem: ASUSTeK Computer Inc. Device 81c0
	Flags: bus master, 66MHz, fast devsel, latency 0, IRQ 22
	Memory at fe02e000 (32-bit, non-prefetchable) [size=256]
	Capabilities: [44] Debug port: BAR=1 offset=0098
	Capabilities: [80] Power Management version 2
	Kernel driver in use: ehci_hcd

00:0d.0 IDE interface: NVIDIA Corporation MCP51 IDE (rev a1) (prog-if 8a [Master SecP PriP])
	Subsystem: ASUSTeK Computer Inc. Device 81c0
	Flags: bus master, 66MHz, fast devsel, latency 0
	[virtual] Memory at 000001f0 (32-bit, non-prefetchable) [size=8]
	[virtual] Memory at 000003f0 (type 3, non-prefetchable)
	[virtual] Memory at 00000170 (32-bit, non-prefetchable) [size=8]
	[virtual] Memory at 00000370 (type 3, non-prefetchable)
	I/O ports at f400 [size=16]
	Capabilities: [44] Power Management version 2
	Kernel driver in use: pata_acpi

00:0e.0 IDE interface: NVIDIA Corporation MCP51 Serial ATA Controller (rev a1) (prog-if 85 [Master SecO PriO])
	Subsystem: ASUSTeK Computer Inc. Device 81c0
	Flags: bus master, 66MHz, fast devsel, latency 0, IRQ 21
	I/O ports at 09f0 [size=8]
	I/O ports at 0bf0 [size=4]
	I/O ports at 0970 [size=8]
	I/O ports at 0b70 [size=4]
	I/O ports at e000 [size=16]
	Memory at fe02d000 (32-bit, non-prefetchable) [size=4K]
	Capabilities: [44] Power Management version 2
	Capabilities: [b0] MSI: Enable- Count=1/4 Maskable- 64bit+
	Capabilities: [cc] HyperTransport: MSI Mapping Enable+ Fixed+
	Kernel driver in use: pata_acpi

00:0f.0 IDE interface: NVIDIA Corporation MCP51 Serial ATA Controller (rev a1) (prog-if 85 [Master SecO PriO])
	Subsystem: ASUSTeK Computer Inc. Device 81c0
	Flags: bus master, 66MHz, fast devsel, latency 0, IRQ 20
	I/O ports at 09e0 [size=8]
	I/O ports at 0be0 [size=4]
	I/O ports at 0960 [size=8]
	I/O ports at 0b60 [size=4]
	I/O ports at cc00 [size=16]
	Memory at fe02c000 (32-bit, non-prefetchable) [size=4K]
	Capabilities: [44] Power Management version 2
	Capabilities: [b0] MSI: Enable- Count=1/4 Maskable- 64bit+
	Capabilities: [cc] HyperTransport: MSI Mapping Enable+ Fixed+
	Kernel driver in use: pata_acpi

00:10.0 PCI bridge: NVIDIA Corporation MCP51 PCI Bridge (rev a2) (prog-if 01 [Subtractive decode])
	Flags: bus master, 66MHz, fast devsel, latency 0
	Bus: primary=00, secondary=04, subordinate=04, sec-latency=128
	I/O behind bridge: 00009000-00009fff
	Memory behind bridge: fdc00000-fdcfffff
	Prefetchable memory behind bridge: fdb00000-fdbfffff
	Capabilities: [b8] Subsystem: Gammagraphx, Inc. (or missing ID) Device 0000
	Capabilities: [8c] HyperTransport: MSI Mapping Enable+ Fixed-

00:10.1 Audio device: NVIDIA Corporation MCP51 High Definition Audio (rev a2)
	Subsystem: ASUSTeK Computer Inc. Device 81cb
	Flags: bus master, 66MHz, fast devsel, latency 0, IRQ 22
	Memory at fe024000 (32-bit, non-prefetchable) [size=16K]
	Capabilities: [44] Power Management version 2
	Capabilities: [50] MSI: Enable- Count=1/1 Maskable+ 64bit+
	Capabilities: [6c] HyperTransport: MSI Mapping Enable+ Fixed+
	Kernel driver in use: snd_hda_intel

00:14.0 Bridge: NVIDIA Corporation MCP51 Ethernet Controller (rev a3)
	Subsystem: ASUSTeK Computer Inc. Device 816a
	Flags: bus master, 66MHz, fast devsel, latency 0, IRQ 23
	Memory at fe02b000 (32-bit, non-prefetchable) [size=4K]
	I/O ports at c800 [size=8]
	Capabilities: [44] Power Management version 2
	Kernel driver in use: forcedeth

00:18.0 Host bridge: Advanced Micro Devices [AMD] K8 [Athlon64/Opteron] HyperTransport Technology Configuration
	Flags: fast devsel
	Capabilities: [80] HyperTransport: Host or Secondary Interface

00:18.1 Host bridge: Advanced Micro Devices [AMD] K8 [Athlon64/Opteron] Address Map
	Flags: fast devsel

00:18.2 Host bridge: Advanced Micro Devices [AMD] K8 [Athlon64/Opteron] DRAM Controller
	Flags: fast devsel

00:18.3 Host bridge: Advanced Micro Devices [AMD] K8 [Athlon64/Opteron] Miscellaneous Control
	Flags: fast devsel
	Capabilities: [f0] Secure device <?>

03:00.0 VGA compatible controller: NVIDIA Corporation G73 [GeForce 7600 GS] (rev a1) (prog-if 00 [VGA controller])
	Subsystem: Giga-byte Technology Device 341a
	Flags: bus master, fast devsel, latency 0, IRQ 5
	Memory at fa000000 (32-bit, non-prefetchable) [size=16M]
	Memory at e0000000 (64-bit, prefetchable) [size=256M]
	Memory at fb000000 (64-bit, non-prefetchable) [size=16M]
	I/O ports at bc00 [size=128]
	Expansion ROM at fcfe0000 [disabled] [size=128K]
	Capabilities: [60] Power Management version 2
	Capabilities: [68] MSI: Enable- Count=1/1 Maskable- 64bit+
	Capabilities: [78] Express Endpoint, MSI 00
	Capabilities: [100] Virtual Channel
	Capabilities: [128] Power Budgeting <?>

04:05.0 FireWire (IEEE 1394): Texas Instruments TSB43AB22A IEEE-1394a-2000 Controller (PHY/Link) [iOHCI-Lynx] (prog-if 10 [OHCI])
	Subsystem: ASUSTeK Computer Inc. K8N4-E Mainboard
	Flags: bus master, medium devsel, latency 32, IRQ 19
	Memory at fdcff000 (32-bit, non-prefetchable) [size=2K]
	Memory at fdcf8000 (32-bit, non-prefetchable) [size=16K]
	Capabilities: [44] Power Management version 2
	Kernel driver in use: firewire_ohci

04:09.0 Ethernet controller: Realtek Semiconductor Co., Ltd. RTL-8139/8139C/8139C+ (rev 10)
	Subsystem: Realtek Semiconductor Co., Ltd. RTL-8139/8139C/8139C+
	Flags: bus master, medium devsel, latency 32, IRQ 17
	I/O ports at 9c00 [size=256]
	Memory at fdcfe000 (32-bit, non-prefetchable) [size=256]
	Expansion ROM at fdce0000 [disabled] [size=64K]
	Capabilities: [50] Power Management version 2
	Kernel driver in use: 8139too
Comment 9 Anonymous Emailer 2012-10-22 15:47:59 UTC
Reply-To: phillip.wood@talktalk.net

On 10/21/2012 05:57 PM, Borislav Petkov wrote:
>
> What you can do, Phillip, is check whether some other specific PATA
> driver supports your hardware and enable it instead of PATA_ACPI. What
> does lspci on the box say? Or rather 'lspci -v' for more details. You
> can also send dmesg from the box.
>
lspci -v gives

00:00.0 Host bridge: ULi Electronics Inc. M1644/M1644T 
Northbridge+Trident (rev 01)
	Flags: bus master, medium devsel, latency 0
	Memory at f0000000 (32-bit, prefetchable) [size=64M]
	Capabilities: [b0] AGP version 2.0
	Capabilities: [a4] Power Management version 1
	Kernel driver in use: agpgart-ali

00:01.0 PCI bridge: ULi Electronics Inc. PCI to AGP Controller (prog-if 
00 [Normal decode])
	Flags: bus master, slow devsel, latency 0
	Bus: primary=00, secondary=01, subordinate=01, sec-latency=0
	Memory behind bridge: f7f00000-fdffffff
	Prefetchable memory behind bridge: 30100000-301fffff

00:02.0 USB controller: ULi Electronics Inc. USB 1.1 Controller (rev 03) 
(prog-if 10 [OHCI])
	Subsystem: Toshiba America Info Systems Device 0004
	Flags: bus master, medium devsel, latency 64, IRQ 11
	Memory at f7eff000 (32-bit, non-prefetchable) [size=4K]
	Capabilities: [60] Power Management version 2
	Kernel driver in use: ohci_hcd

00:04.0 IDE interface: ULi Electronics Inc. M5229 IDE (rev c3) (prog-if f0)
	Subsystem: Toshiba America Info Systems Device 0004
	Flags: bus master, medium devsel, latency 64, IRQ 255
	[virtual] Memory at 000001f0 (32-bit, non-prefetchable) [size=8]
	[virtual] Memory at 000003f0 (type 3, non-prefetchable)
	[virtual] Memory at 00000170 (32-bit, non-prefetchable) [size=8]
	[virtual] Memory at 00000370 (type 3, non-prefetchable)
	I/O ports at eff0 [size=16]
	Capabilities: [60] Power Management version 2
	Kernel driver in use: pata_ali

00:06.0 Multimedia audio controller: ULi Electronics Inc. M5451 PCI 
AC-Link Controller Audio Device (rev 01)
	Subsystem: Toshiba America Info Systems Device 0001
	Flags: bus master, medium devsel, latency 64, IRQ 11
	I/O ports at 1000 [size=256]
	Memory at 30001000 (32-bit, non-prefetchable) [size=4K]
	Capabilities: [dc] Power Management version 2
	Kernel driver in use: snd_ali5451

00:07.0 ISA bridge: ULi Electronics Inc. M1533/M1535/M1543 PCI to ISA 
Bridge [Aladdin IV/V/V+]
	Subsystem: Toshiba America Info Systems Device 0004
	Flags: bus master, medium devsel, latency 0
	Capabilities: [a0] Power Management version 1

00:08.0 Bridge: ULi Electronics Inc. M7101 Power Management Controller [PMU]
	Subsystem: Toshiba America Info Systems Device 0001
	Flags: medium devsel
	Kernel driver in use: ali1535_smbus

00:0a.0 Ethernet controller: Intel Corporation 82557/8/9/0/1 Ethernet 
Pro 100 (rev 0d)
	Subsystem: Toshiba America Info Systems 8255x-based Ethernet Adapter 
(10/100)
	Flags: bus master, medium devsel, latency 64, IRQ 11
	Memory at f7efe000 (32-bit, non-prefetchable) [size=4K]
	I/O ports at eec0 [size=64]
	Memory at f7ec0000 (32-bit, non-prefetchable) [size=128K]
	Capabilities: [dc] Power Management version 2
	Kernel driver in use: e100

00:11.0 CardBus bridge: Toshiba America Info Systems ToPIC100 PCI to 
Cardbus Bridge with ZV Support (rev 32)
	Subsystem: Toshiba America Info Systems Device 0001
	Flags: bus master, slow devsel, latency 168, IRQ 11
	Memory at 30000000 (32-bit, non-prefetchable) [size=4K]
	Bus: primary=00, secondary=02, subordinate=05, sec-latency=0
	Memory window 0: 34000000-37ffffff (prefetchable)
	Memory window 1: 38000000-3bffffff
	I/O window 0: 00001400-000014ff
	I/O window 1: 00001800-000018ff
	16-bit legacy interface ports at 0001
	Kernel driver in use: yenta_cardbus

00:11.1 CardBus bridge: Toshiba America Info Systems ToPIC100 PCI to 
Cardbus Bridge with ZV Support (rev 32)
	Subsystem: Toshiba America Info Systems Device 0001
	Flags: bus master, slow devsel, latency 168, IRQ 11
	Memory at 3c000000 (32-bit, non-prefetchable) [size=4K]
	Bus: primary=00, secondary=06, subordinate=09, sec-latency=0
	Memory window 0: 40000000-43ffffff (prefetchable)
	Memory window 1: 44000000-47ffffff
	I/O window 0: 00001c00-00001cff
	I/O window 1: 00002000-000020ff
	16-bit legacy interface ports at 0001
	Kernel driver in use: yenta_cardbus

00:12.0 System peripheral: Toshiba America Info Systems SD TypA 
Controller (rev 03)
	Subsystem: Toshiba America Info Systems Device 0001
	Flags: medium devsel, IRQ 255
	Memory at 30002000 (32-bit, non-prefetchable) [disabled] [size=512]
	Capabilities: [80] Power Management version 2

01:00.0 VGA compatible controller: Trident Microsystems CyberBlade XPAi1 
(rev 82) (prog-if 00 [VGA controller])
	Subsystem: Toshiba America Info Systems Device 0001
	Flags: bus master, 66MHz, medium devsel, latency 8, IRQ 11
	Memory at fc000000 (32-bit, non-prefetchable) [size=32M]
	Memory at fbc00000 (32-bit, non-prefetchable) [size=4M]
	Memory at f8000000 (32-bit, non-prefetchable) [size=32M]
	Memory at f7ff8000 (32-bit, non-prefetchable) [size=32K]
	[virtual] Expansion ROM at 30100000 [disabled] [size=64K]
	Capabilities: [80] AGP version 2.0
	Capabilities: [90] Power Management version 2

06:00.0 Network controller: Broadcom Corporation BCM4306 802.11b/g 
Wireless LAN Controller (rev 03)
	Subsystem: Belkin F5D7011 v1000 High-Speed Mode Wireless G Notebook Card
	Flags: bus master, fast devsel, latency 64, IRQ 11
	Memory at 44000000 (32-bit, non-prefetchable) [size=8K]
	Kernel driver in use: b43-pci-bridge

If I blacklist pata_acpi and remove it from the initrd image then my 
unpatched distro kernel boots and seems to run fine (I've not checked if 
the hard drive power management is affected though). I've attached the 
dmesg from the patched kernel which was built with a minimal config.

Best Wishes

Phillip
Comment 10 Borislav Petkov 2012-10-22 20:27:37 UTC
On Mon, Oct 22, 2012 at 04:47:52PM +0100, Phillip Wood wrote:
> 00:04.0 IDE interface: ULi Electronics Inc. M5229 IDE (rev c3) (prog-if f0)
> 	Subsystem: Toshiba America Info Systems Device 0004
> 	Flags: bus master, medium devsel, latency 64, IRQ 255
> 	[virtual] Memory at 000001f0 (32-bit, non-prefetchable) [size=8]
> 	[virtual] Memory at 000003f0 (type 3, non-prefetchable)
> 	[virtual] Memory at 00000170 (32-bit, non-prefetchable) [size=8]
> 	[virtual] Memory at 00000370 (type 3, non-prefetchable)
> 	I/O ports at eff0 [size=16]
> 	Capabilities: [60] Power Management version 2
> 	Kernel driver in use: pata_ali

Ok, your IDE interface is supported by pata_ali...

[ … ]

> If I blacklist pata_acpi and remove it from the initrd image then my
> unpatched distro kernel boots and seems to run fine (I've not checked
> if the hard drive power management is affected though). I've attached
> the dmesg from the patched kernel which was built with a minimal
> config.

Right, as it looks above, pata_ali should be able to support your IDE
interface, so you might not be needing the pata_acpi thing after all.

So yes, blacklisting it and verifying that your system still operates
normally would be something to do. If it does, you could also build a
kernel with pata_acpi disabled (that is, provided you build your own
kernels).

HTH.
Comment 11 Borislav Petkov 2012-10-22 20:40:44 UTC
(In reply to comment #7)
[ … ]

> 00:09.0 IDE interface: NVIDIA Corporation MCP65 IDE (rev a1) (prog-if 8a
> [Master SecP PriP])
>     Subsystem: Micro-Star International Co., Ltd. Device 7369
>     Flags: bus master, 66MHz, fast devsel, latency 0
>     [virtual] Memory at 000001f0 (32-bit, non-prefetchable) [size=8]
>     [virtual] Memory at 000003f0 (type 3, non-prefetchable)
>     [virtual] Memory at 00000170 (32-bit, non-prefetchable) [size=8]
>     [virtual] Memory at 00000370 (type 3, non-prefetchable)
>     I/O ports at ffa0 [size=16]
>     Capabilities: [44] Power Management version 2
>     Kernel driver in use: pata_acpi
> 
> 00:0a.0 IDE interface: NVIDIA Corporation MCP65 SATA Controller (rev a3)
> (prog-if 85 [Master SecO PriO])
>     Subsystem: Micro-Star International Co., Ltd. Device 7369
>     Flags: bus master, 66MHz, fast devsel, latency 0, IRQ 21
>     I/O ports at 0f80 [size=8]
>     I/O ports at 0f00 [size=4]
>     I/O ports at 0e80 [size=8]
>     I/O ports at 0e00 [size=4]
>     I/O ports at b800 [size=16]
>     Memory at f9efc000 (32-bit, non-prefetchable) [size=8K]
>     Capabilities: [44] Power Management version 2
>     Capabilities: [b0] MSI: Enable- Count=1/8 Maskable- 64bit+
>     Capabilities: [cc] HyperTransport: MSI Mapping Enable- Fixed+
>     Kernel driver in use: pata_acpi

can you try blacklisting pata_acpi and booting the box then (provided
this is a distro kernel and it has all sata drivers as modules and in
the initrd - basically what Phillip did).

From the looks of it, yours should be supported by sata_nv so that you
don't need to use pata_acpi at all.

All IMHO, of course.

Thanks.
Comment 12 Borislav Petkov 2012-10-22 21:06:26 UTC
... and pata_amd should be supporting your IDE interface.

Thanks.
Comment 13 Alan 2012-10-23 10:01:07 UTC
> So yes, blacklisting it and verifying that your system still operates
> normally would be something to do. If it does, you could also build a
> kernel with pata_acpi disabled (that is, provided you build your own
> kernels).

The crash is still a bug. It needs chasing down.

Alan
Comment 14 Borislav Petkov 2012-10-23 10:17:54 UTC
On Tue, Oct 23, 2012 at 11:05:49AM +0100, Alan Cox wrote:
> > So yes, blacklisting it and verifying that your system still operates
> > normally would be something to do. If it does, you could also build a
> > kernel with pata_acpi disabled (that is, provided you build your own
> > kernels).
> 
> The crash is still a bug. It needs chasing down.

Yes, ata_timing_find_mode gives NULL, we found that out.

Anton, Phillip, anyone willing to run this hunk below and get us the
output:

---
diff --git a/drivers/ata/pata_acpi.c b/drivers/ata/pata_acpi.c
index 09723b76beac..80d594d6e7c8 100644
--- a/drivers/ata/pata_acpi.c
+++ b/drivers/ata/pata_acpi.c
@@ -144,6 +144,13 @@ static void pacpi_set_dmamode(struct ata_port *ap, struct ata_device *adev)
 
 	/* Now stuff the nS values into the structure */
 	t = ata_timing_find_mode(adev->dma_mode);
+	if (!t) {
+		pr_err("%s: ata_timing_find_mode gives NULL; adev->dma_mode: 0x%x\n",
+		       __func__, adev->dma_mode);
+
+		return;
+	}
+
 	if (adev->dma_mode >= XFER_UDMA_0) {
 		acpi->gtm.drive[unit].dma = t->udma;
 		acpi->gtm.flags |= (1 << (2 * unit));
--

Thanks.
Comment 15 Anton Boyarshinov 2012-10-23 11:02:33 UTC
> can you try blacklisting pata_acpi and booting the box then (provided
> this is a distro kernel and it has all sata drivers as modules and in
> the initrd - basically what Phillip did).
In this configuration it works (and using pata_amd on second box), but it is not a good solution for distro kernel. And especially for distro installer kernel wich should support as more hardware as it possible.
 
> From the looks of it, yours should be supported by sata_nv so that you
> don't need to use pata_acpi at all.
It seems that more special modules should be loaded before pata_acpi, but it loads first.
Comment 16 Anton Boyarshinov 2012-10-23 12:54:17 UTC
> +        pr_err("%s: ata_timing_find_mode gives NULL; adev->dma_mode: 0x%x\n",
> +               __func__, adev->dma_mode);

pacpi_set_dmamode: ata_timing_find_mode gives NULL; adev->dma_mode: 0x0
Comment 17 Borislav Petkov 2012-10-23 16:12:18 UTC
On Tue, Oct 23, 2012 at 12:17:51PM +0200, Borislav Petkov wrote:
> On Tue, Oct 23, 2012 at 11:05:49AM +0100, Alan Cox wrote:
> > > So yes, blacklisting it and verifying that your system still operates
> > > normally would be something to do. If it does, you could also build a
> > > kernel with pata_acpi disabled (that is, provided you build your own
> > > kernels).
> > 
> > The crash is still a bug. It needs chasing down.
> 
> Yes, ata_timing_find_mode gives NULL, we found that out.
> 
> Anton, Phillip, anyone willing to run this hunk below and get us the
> output:
> 
> ---
> diff --git a/drivers/ata/pata_acpi.c b/drivers/ata/pata_acpi.c
> index 09723b76beac..80d594d6e7c8 100644
> --- a/drivers/ata/pata_acpi.c
> +++ b/drivers/ata/pata_acpi.c
> @@ -144,6 +144,13 @@ static void pacpi_set_dmamode(struct ata_port *ap, struct ata_device *adev)
>  
>  	/* Now stuff the nS values into the structure */
>  	t = ata_timing_find_mode(adev->dma_mode);
> +	if (!t) {
> +		pr_err("%s: ata_timing_find_mode gives NULL; adev->dma_mode: 0x%x\n",
> +		       __func__, adev->dma_mode);
> +
> +		return;
> +	}
> +
>  	if (adev->dma_mode >= XFER_UDMA_0) {
>  		acpi->gtm.drive[unit].dma = t->udma;
>  		acpi->gtm.flags |= (1 << (2 * unit));
> --

Ok, here's the output from Anton's box
(https://bugzilla.kernel.org/show_bug.cgi?id=49151#c16):

pacpi_set_dmamode: ata_timing_find_mode gives NULL; adev->dma_mode: 0x0

And in that case we should've matched XFER_PIO_SLOW but it is commented
out for some reason.

Judging by 70cd071e4ecc06c985189665af75c108601fd5a3, I think we should
involve Tejun into this.

@Tejun: so basically there are two people with oopses when using
pata_acpi because pacpi_set_dmamode queries xfer mode with
adev->dma_mode = 0x0 and ata_timing_find_mode returns NULL (presumably a
BIOS bug, I'd say).

More details if you follow the thread here:
http://marc.info/?l=linux-ide&m=135073445731432

I don't know how to fix this since if BIOS gives xfer_mode 0, how can
each pata controller find its max mode? Sure, we can always fall back to
0x0 but that is the slowest and not necessarily optimal.

One other possibility could be to load chipset-specific drivers first
and pata_acpi only as a last resort but I don't know whether this is
doable at all.

Thanks.
Comment 18 Szymon Janc 2012-10-23 16:39:42 UTC
Hi,

I see this crash on pc with ASUS A8N-E board (about half of boot attempts).

But only if both pata_acpi and pata_amd are loaded... I've disabled pata_amd
and I'm not able to reproduce this (tried 10 reboots) if only pata_acpi is used.


BR
Szymon
Comment 19 Borislav Petkov 2012-10-23 20:11:07 UTC
(In reply to comment #18)
> Hi,
> 
> I see this crash on pc with ASUS A8N-E board (about half of boot attempts).
> 
> But only if both pata_acpi and pata_amd are loaded... I've disabled pata_amd
> and I'm not able to reproduce this (tried 10 reboots) if only pata_acpi is
> used.

Can you catch the oops and upload it, a readable photo from a digicam
suffices too, as long as the oops is complete.

Thanks.
Comment 20 Szymon Janc 2012-10-23 20:41:38 UTC
Created attachment 84521 [details]
crash on A8N-E

not scaled image (~2MiB) available at http://janc.net.pl/DSC_1062.jpg
Comment 21 Borislav Petkov 2012-10-23 20:52:57 UTC
Ok, looks like the same issue. You could try the debugging patch in comment #14 but I'll go ahead and guess that it'll say

pacpi_set_dmamode: ata_timing_find_mode gives NULL; adev->dma_mode: 0x0

on your system too.

Thanks.
Comment 22 Szymon Janc 2012-10-23 21:10:25 UTC
sure, i'll put info when build is finished.

btw: I forgot to mention that I don't have any pata drives in that pc.
Comment 23 Anton Boyarshinov 2012-10-24 06:43:10 UTC
Hello

В Tue, 23 Oct 2012 18:12:16 +0200
Borislav Petkov wrote:

> @Tejun: so basically there are two people with oopses when using
> pata_acpi
Not two. We have two boxes in our office (about 20 boxes) and more then
ten reports from our users (only from early adopters yet). It seems
that this problem doesn't exists when someone build kernel for his own
box, but will be triggered very often when 3.6 will be wide used distro
kernel.
Comment 24 Anonymous Emailer 2012-10-24 09:28:47 UTC
Reply-To: phillip.wood@talktalk.net

On 10/23/2012 11:17 AM, Borislav Petkov wrote:
> ---
> diff --git a/drivers/ata/pata_acpi.c b/drivers/ata/pata_acpi.c
> index 09723b76beac..80d594d6e7c8 100644
> --- a/drivers/ata/pata_acpi.c
> +++ b/drivers/ata/pata_acpi.c
> @@ -144,6 +144,13 @@ static void pacpi_set_dmamode(struct ata_port *ap, struct ata_device *adev)
>
>   	/* Now stuff the nS values into the structure */
>   	t = ata_timing_find_mode(adev->dma_mode);
> +	if (!t) {
> +		pr_err("%s: ata_timing_find_mode gives NULL; adev->dma_mode: 0x%x\n",
> +		       __func__, adev->dma_mode);
> +
> +		return;
> +	}
> +
>   	if (adev->dma_mode >= XFER_UDMA_0) {
>   		acpi->gtm.drive[unit].dma = t->udma;
>   		acpi->gtm.flags |= (1 << (2 * unit));
> --

pacpi_set_dmamode: ata_timing_find_mode gives NULL; adev->dma_mode: 0x0

as well here if I build pata_acpi as a module, if I build it into the 
kernel I don't get any message.
Comment 25 Alan 2012-10-24 10:52:56 UTC
On Wed, 24 Oct 2012 10:28:42 +0100
Phillip Wood <phillip.wood@talktalk.net> wrote:

> On 10/23/2012 11:17 AM, Borislav Petkov wrote:
> > ---
> > diff --git a/drivers/ata/pata_acpi.c b/drivers/ata/pata_acpi.c
> > index 09723b76beac..80d594d6e7c8 100644
> > --- a/drivers/ata/pata_acpi.c
> > +++ b/drivers/ata/pata_acpi.c
> > @@ -144,6 +144,13 @@ static void pacpi_set_dmamode(struct ata_port *ap, struct ata_device *adev)
> >
> >   	/* Now stuff the nS values into the structure */
> >   	t = ata_timing_find_mode(adev->dma_mode);
> > +	if (!t) {
> > +		pr_err("%s: ata_timing_find_mode gives NULL; adev->dma_mode: 0x%x\n",
> > +		       __func__, adev->dma_mode);
> > +
> > +		return;
> > +	}
> > +
> >   	if (adev->dma_mode >= XFER_UDMA_0) {
> >   		acpi->gtm.drive[unit].dma = t->udma;
> >   		acpi->gtm.flags |= (1 << (2 * unit));
> > --
> 
> pacpi_set_dmamode: ata_timing_find_mode gives NULL; adev->dma_mode: 0x0

Which is an ATA layer bug - adev->dma_mode should never be called without
a DMA mode in normal use.
 
> as well here if I build pata_acpi as a module, if I build it into the 
> kernel I don't get any message.

If you build the drivers into the kernel the link order ensures the
generic drivers execute last so the native driver will already have been
used. When loading modules it is expected that the distribution is smart
enough to get this right.

So the built in case is covering up the failure case because the code
never gets executed,

 Alan
Comment 26 Szymon Janc 2012-10-24 15:25:34 UTC
just to confirm..

[    5.004024] pacpi_set_dmamode: ata_timing_find_mode gives NULL; adev->dma_mode: 0x0
[    5.770251] pacpi_set_dmamode: ata_timing_find_mode gives NULL; adev->dma_mode: 0x0
Comment 27 Marius Cirsta 2012-10-25 14:31:16 UTC
 I'm also getting this with the 3.6 kernel, it's comming from initrd which seems to be using dracut. 

 Here's the lspci -v:

lspci -v
00:00.0 Host bridge: Intel Corporation 82Q35 Express DRAM Controller (rev 02)
        Subsystem: Lenovo Device 3037
        Flags: bus master, fast devsel, latency 0
        Capabilities: [e0] Vendor Specific Information <?>
        Kernel driver in use: agpgart-intel
        Kernel modules: intel-agp

00:02.0 VGA compatible controller: Intel Corporation 82Q35 Express Integrated Graphics Controller (rev 02) (prog-if 00 [VGA controller])
        Subsystem: Lenovo Device 3037
        Flags: bus master, fast devsel, latency 0, IRQ 16
        Memory at d4400000 (32-bit, non-prefetchable) [size=512K]
        I/O ports at 1c70 [size=8]
        Memory at c0000000 (32-bit, prefetchable) [size=256M]
        Memory at d4300000 (32-bit, non-prefetchable) [size=1M]
        Capabilities: [90] Message Signalled Interrupts: Mask- 64bit- Count=1/1 Enable-
        Capabilities: [d0] Power Management version 2

00:02.1 Display controller: Intel Corporation 82Q35 Express Integrated Graphics Controller (rev 02)
        Subsystem: Lenovo Device 3037
        Flags: fast devsel
        Memory at d4500000 (32-bit, non-prefetchable) [disabled] [size=512K]
        Capabilities: [d0] Power Management version 2

00:03.0 Communication controller: Intel Corporation 82Q35 Express MEI Controller (rev 02)
        Subsystem: Lenovo Device 3037
        Flags: bus master, fast devsel, latency 0, IRQ 16
        Memory at d46a6000 (64-bit, non-prefetchable) [size=16]
        Capabilities: [50] Power Management version 3
        Capabilities: [8c] Message Signalled Interrupts: Mask- 64bit+ Count=1/1 Enable-
        Kernel driver in use: heci
        Kernel modules: heci

00:03.2 IDE interface: Intel Corporation 82Q35 Express PT IDER Controller (rev 02) (prog-if 85 [Master SecO PriO])
        Subsystem: Lenovo Device 3037
        Flags: bus master, 66MHz, fast devsel, latency 0, IRQ 5
        I/O ports at 1c88 [disabled] [size=8]
        I/O ports at 1c7c [disabled] [size=4]
        I/O ports at 1c80 [disabled] [size=8]
        I/O ports at 1c78 [disabled] [size=4]
        I/O ports at 1c20 [disabled] [size=16]
        Capabilities: [c8] Power Management version 3
        Capabilities: [d0] Message Signalled Interrupts: Mask- 64bit+ Count=1/1 Enable-
        Kernel modules: ide-pci-generic, ata_generic, pata_acpi

00:03.3 Serial controller: Intel Corporation 82Q35 Express Serial KT Controller (rev 02) (prog-if 02 [16550])
        Subsystem: Lenovo Device 3037
        Flags: bus master, 66MHz, fast devsel, latency 0, IRQ 17
        I/O ports at 1c90 [size=8]
        Memory at d44a4000 (32-bit, non-prefetchable) [size=4K]
        Capabilities: [c8] Power Management version 3
        Capabilities: [d0] Message Signalled Interrupts: Mask- 64bit+ Count=1/1 Enable-
        Kernel driver in use: serial

00:19.0 Ethernet controller: Intel Corporation 82566DM-2 Gigabit Network Connection (rev 02)
        Subsystem: Lenovo Device 3037
        Flags: bus master, fast devsel, latency 0, IRQ 4351
        Memory at d4480000 (32-bit, non-prefetchable) [size=128K]
        Memory at d44a5000 (32-bit, non-prefetchable) [size=4K]
        I/O ports at 1820 [size=32]
        Capabilities: [c8] Power Management version 2
        Capabilities: [d0] Message Signalled Interrupts: Mask- 64bit+ Count=1/1 Enable+
        Capabilities: [e0] PCIe advanced features <?>
        Kernel driver in use: e1000e
        Kernel modules: e1000e

00:1a.0 USB Controller: Intel Corporation 82801I (ICH9 Family) USB UHCI Controller #4 (rev 02) (prog-if 00 [UHCI])
        Subsystem: Lenovo Device 3037
        Flags: bus master, medium devsel, latency 0, IRQ 16
        I/O ports at 1840 [size=32]
        Capabilities: [50] PCIe advanced features <?>
        Kernel driver in use: uhci_hcd
        Kernel modules: uhci-hcd

00:1a.1 USB Controller: Intel Corporation 82801I (ICH9 Family) USB UHCI Controller #5 (rev 02) (prog-if 00 [UHCI])
        Subsystem: Lenovo Device 3037
        Flags: bus master, medium devsel, latency 0, IRQ 17
        I/O ports at 1860 [size=32]
        Capabilities: [50] PCIe advanced features <?>
        Kernel driver in use: uhci_hcd
        Kernel modules: uhci-hcd

00:1a.2 USB Controller: Intel Corporation 82801I (ICH9 Family) USB UHCI Controller #6 (rev 02) (prog-if 00 [UHCI])
        Subsystem: Lenovo Device 3037
        Flags: bus master, medium devsel, latency 0, IRQ 18
        I/O ports at 1880 [size=32]
        Capabilities: [50] PCIe advanced features <?>
        Kernel driver in use: uhci_hcd
        Kernel modules: uhci-hcd

00:1a.7 USB Controller: Intel Corporation 82801I (ICH9 Family) USB2 EHCI Controller #2 (rev 02) (prog-if 20 [EHCI])
        Subsystem: Lenovo Device 3037
        Flags: bus master, medium devsel, latency 0, IRQ 18
        Memory at d46a6800 (32-bit, non-prefetchable) [size=1K]
        Capabilities: [50] Power Management version 2
        Capabilities: [58] Debug port: BAR=1 offset=00a0
        Capabilities: [98] PCIe advanced features <?>
        Kernel driver in use: ehci_hcd
        Kernel modules: ehci-hcd

00:1b.0 Audio device: Intel Corporation 82801I (ICH9 Family) HD Audio Controller (rev 02)
        Subsystem: Lenovo Device 3037
        Flags: bus master, fast devsel, latency 0, IRQ 3
        Memory at d44a0000 (64-bit, non-prefetchable) [size=16K]
        Capabilities: [50] Power Management version 2
        Capabilities: [60] Message Signalled Interrupts: Mask- 64bit+ Count=1/1 Enable-
        Capabilities: [70] Express Root Complex Integrated Endpoint, MSI 00
        Capabilities: [100] Virtual Channel <?>
        Capabilities: [130] Root Complex Link <?>
        Kernel modules: snd-hda-intel

00:1d.0 USB Controller: Intel Corporation 82801I (ICH9 Family) USB UHCI Controller #1 (rev 02) (prog-if 00 [UHCI])
        Subsystem: Lenovo Device 3037
        Flags: bus master, medium devsel, latency 0, IRQ 16
        I/O ports at 18a0 [size=32]
        Capabilities: [50] PCIe advanced features <?>
        Kernel driver in use: uhci_hcd
        Kernel modules: uhci-hcd

00:1d.1 USB Controller: Intel Corporation 82801I (ICH9 Family) USB UHCI Controller #2 (rev 02) (prog-if 00 [UHCI])
        Subsystem: Lenovo Device 3037
        Flags: bus master, medium devsel, latency 0, IRQ 17
        I/O ports at 18c0 [size=32]
        Capabilities: [50] PCIe advanced features <?>
        Kernel driver in use: uhci_hcd
        Kernel modules: uhci-hcd

00:1d.2 USB Controller: Intel Corporation 82801I (ICH9 Family) USB UHCI Controller #3 (rev 02) (prog-if 00 [UHCI])
        Subsystem: Lenovo Device 3037
        Flags: bus master, medium devsel, latency 0, IRQ 18
        I/O ports at 18e0 [size=32]
        Capabilities: [50] PCIe advanced features <?>
        Kernel driver in use: uhci_hcd
        Kernel modules: uhci-hcd

00:1d.7 USB Controller: Intel Corporation 82801I (ICH9 Family) USB2 EHCI Controller #1 (rev 02) (prog-if 20 [EHCI])
        Subsystem: Lenovo Device 3037
        Flags: bus master, medium devsel, latency 0, IRQ 16
        Memory at d46a6c00 (32-bit, non-prefetchable) [size=1K]
        Capabilities: [50] Power Management version 2
        Capabilities: [58] Debug port: BAR=1 offset=00a0
        Capabilities: [98] PCIe advanced features <?>
        Kernel driver in use: ehci_hcd
        Kernel modules: ehci-hcd

00:1e.0 PCI bridge: Intel Corporation 82801 PCI Bridge (rev 92) (prog-if 01 [Subtractive decode])
        Flags: bus master, fast devsel, latency 0
        Bus: primary=00, secondary=11, subordinate=11, sec-latency=32
        I/O behind bridge: 00002000-00002fff
        Memory behind bridge: d0000000-d42fffff
        Capabilities: [50] Subsystem: Lenovo Device 3037

00:1f.0 ISA bridge: Intel Corporation 82801IO (ICH9DO) LPC Interface Controller (rev 02)
        Subsystem: Lenovo Device 3037
        Flags: bus master, medium devsel, latency 0
        Capabilities: [e0] Vendor Specific Information <?>
        Kernel modules: iTCO_wdt

00:1f.2 IDE interface: Intel Corporation 82801IR/IO/IH (ICH9R/DO/DH) 4 port SATA IDE Controller (rev 02) (prog-if 8a [Master SecP PriP])
        Subsystem: Lenovo Device 3037
        Flags: bus master, 66MHz, medium devsel, latency 0, IRQ 17
        I/O ports at 01f0 [size=8]
        I/O ports at 03f4 [size=1]
        I/O ports at 0170 [size=8]
        I/O ports at 0374 [size=1]
        I/O ports at 1c40 [size=16]
        I/O ports at 1c30 [size=16]
        Capabilities: [70] Power Management version 3
        Capabilities: [b0] PCIe advanced features <?>
        Kernel driver in use: ata_piix
        Kernel modules: ide-pci-generic, ata_generic, pata_acpi, ata_piix

00:1f.3 SMBus: Intel Corporation 82801I (ICH9 Family) SMBus Controller (rev 02)
        Subsystem: Lenovo Device 3037
        Flags: medium devsel, IRQ 17
        Memory at d46a7000 (64-bit, non-prefetchable) [size=256]
        I/O ports at 1c00 [size=32]
        Kernel driver in use: i801_smbus
        Kernel modules: i2c-i801

00:1f.5 IDE interface: Intel Corporation 82801I (ICH9 Family) 2 port SATA IDE Controller (rev 02) (prog-if 85 [Master SecO PriO])
        Subsystem: Lenovo Device 3037
        Flags: bus master, 66MHz, medium devsel, latency 0, IRQ 18
        I/O ports at 1cc0 [size=8]
        I/O ports at 1cb4 [size=4]
        I/O ports at 1cb8 [size=8]
        I/O ports at 1cb0 [size=4]
        I/O ports at 1c60 [size=16]
        I/O ports at 1c50 [size=16]
        Capabilities: [70] Power Management version 3
        Capabilities: [b0] PCIe advanced features <?>
        Kernel driver in use: ata_piix
        Kernel modules: ide-pci-generic, ata_generic, pata_acpi, ata_piix

11:0a.0 Audio device: Creative Labs SB X-Fi
        Subsystem: Creative Labs Device 6007
        Flags: bus master, medium devsel, latency 32, IRQ 22
        Memory at d4200000 (32-bit, non-prefetchable) [size=16K]
        Memory at d4000000 (64-bit, non-prefetchable) [size=2M]
        Memory at d0000000 (64-bit, non-prefetchable) [size=64M]
        I/O ports at 2000 [size=32]
        Capabilities: [40] Power Management version 2
        Capabilities: [50] Message Signalled Interrupts: Mask- 64bit+ Count=1/1 Enable-
        Kernel driver in use: CTALSA
        Kernel modules: ctxfi

 The machine is an Intel based one as you can see. Happens on every boot.
Comment 28 cthx 2012-10-29 13:15:31 UTC
I have this crash at asus M2N32-SLI-Deluxe mainboard (kernel 3.6.2, 3.6.3)

lspci -v

00:00.0 RAM memory: NVIDIA Corporation C51 Host Bridge (rev a2)
	Subsystem: NVIDIA Corporation C51 Host Bridge
	Flags: bus master, 66MHz, fast devsel, latency 0
	Capabilities: [44] HyperTransport: Slave or Primary Interface
	Capabilities: [e0] HyperTransport: MSI Mapping Enable+ Fixed-

00:00.1 RAM memory: NVIDIA Corporation C51 Memory Controller 0 (rev a2)
	Subsystem: NVIDIA Corporation C51 Memory Controller 0
	Flags: 66MHz, fast devsel

00:00.2 RAM memory: NVIDIA Corporation C51 Memory Controller 1 (rev a2)
	Subsystem: NVIDIA Corporation C51 Memory Controller 1
	Flags: 66MHz, fast devsel

00:00.3 RAM memory: NVIDIA Corporation C51 Memory Controller 5 (rev a2)
	Subsystem: NVIDIA Corporation C51 Memory Controller 5
	Flags: 66MHz, fast devsel

00:00.4 RAM memory: NVIDIA Corporation C51 Memory Controller 4 (rev a2)
	Subsystem: NVIDIA Corporation C51 Memory Controller 4
	Flags: bus master, 66MHz, fast devsel, latency 0

00:00.5 RAM memory: NVIDIA Corporation C51 Host Bridge (rev a2)
	Subsystem: NVIDIA Corporation C51 Host Bridge
	Flags: bus master, 66MHz, fast devsel, latency 0
	Capabilities: [44] #00 [0000]

00:00.6 RAM memory: NVIDIA Corporation C51 Memory Controller 3 (rev a2)
	Subsystem: NVIDIA Corporation C51 Memory Controller 3
	Flags: 66MHz, fast devsel

00:00.7 RAM memory: NVIDIA Corporation C51 Memory Controller 2 (rev a2)
	Subsystem: NVIDIA Corporation C51 Memory Controller 2
	Flags: 66MHz, fast devsel

00:04.0 PCI bridge: NVIDIA Corporation C51 PCI Express Bridge (rev a1) (prog-if 00 [Normal decode])
	Flags: bus master, fast devsel, latency 0
	Bus: primary=00, secondary=01, subordinate=01, sec-latency=0
	I/O behind bridge: 0000a000-0000afff
	Memory behind bridge: fa000000-fcffffff
	Prefetchable memory behind bridge: 00000000e0000000-00000000efffffff
	Capabilities: [40] Subsystem: NVIDIA Corporation Device 0000
	Capabilities: [48] Power Management version 2
	Capabilities: [50] MSI: Enable+ Count=1/2 Maskable- 64bit+
	Capabilities: [60] HyperTransport: MSI Mapping Enable- Fixed-
	Capabilities: [80] Express Root Port (Slot+), MSI 00
	Capabilities: [100] Virtual Channel
	Kernel driver in use: pcieport

00:08.0 RAM memory: NVIDIA Corporation MCP55 Memory Controller (rev a1)
	Subsystem: ASUSTeK Computer Inc. Device cb84
	Flags: bus master, 66MHz, fast devsel, latency 0
	Capabilities: [44] HyperTransport: Slave or Primary Interface
	Capabilities: [e0] #00 [fee0]

00:09.0 ISA bridge: NVIDIA Corporation MCP55 LPC Bridge (rev a2)
	Subsystem: ASUSTeK Computer Inc. Device cb84
	Flags: bus master, 66MHz, fast devsel, latency 0

00:09.1 SMBus: NVIDIA Corporation MCP55 SMBus (rev a2)
	Subsystem: ASUSTeK Computer Inc. Device cb84
	Flags: 66MHz, fast devsel, IRQ 5
	I/O ports at 1c00 [size=64]
	I/O ports at 1c40 [size=64]
	Capabilities: [44] Power Management version 2
	Kernel driver in use: nForce2_smbus

00:0a.0 USB controller: NVIDIA Corporation MCP55 USB Controller (rev a1) (prog-if 10 [OHCI])
	Subsystem: ASUSTeK Computer Inc. Device cb84
	Flags: bus master, 66MHz, fast devsel, latency 0, IRQ 23
	Memory at fe02f000 (32-bit, non-prefetchable) [size=4K]
	Capabilities: [44] Power Management version 2
	Kernel driver in use: ohci_hcd

00:0a.1 USB controller: NVIDIA Corporation MCP55 USB Controller (rev a2) (prog-if 20 [EHCI])
	Subsystem: ASUSTeK Computer Inc. Device cb84
	Flags: bus master, 66MHz, fast devsel, latency 0, IRQ 22
	Memory at fe02e000 (32-bit, non-prefetchable) [size=256]
	Capabilities: [44] Debug port: BAR=1 offset=0098
	Capabilities: [80] Power Management version 2
	Kernel driver in use: ehci_hcd

00:0c.0 IDE interface: NVIDIA Corporation MCP55 IDE (rev a1) (prog-if 8a [Master SecP PriP])
	Subsystem: ASUSTeK Computer Inc. Device cb84
	Flags: bus master, 66MHz, fast devsel, latency 0
	[virtual] Memory at 000001f0 (32-bit, non-prefetchable) [size=8]
	[virtual] Memory at 000003f0 (type 3, non-prefetchable)
	[virtual] Memory at 00000170 (32-bit, non-prefetchable) [size=8]
	[virtual] Memory at 00000370 (type 3, non-prefetchable)
	I/O ports at f400 [size=16]
	Capabilities: [44] Power Management version 2
	Kernel driver in use: pata_amd

00:0d.0 IDE interface: NVIDIA Corporation MCP55 SATA Controller (rev a2) (prog-if 85 [Master SecO PriO])
	Subsystem: ASUSTeK Computer Inc. Device cb84
	Flags: bus master, 66MHz, fast devsel, latency 0, IRQ 21
	I/O ports at 09f0 [size=8]
	I/O ports at 0bf0 [size=4]
	I/O ports at 0970 [size=8]
	I/O ports at 0b70 [size=4]
	I/O ports at e000 [size=16]
	Memory at fe02d000 (32-bit, non-prefetchable) [size=4K]
	Capabilities: [44] Power Management version 2
	Capabilities: [b0] MSI: Enable- Count=1/4 Maskable- 64bit+
	Capabilities: [cc] HyperTransport: MSI Mapping Enable+ Fixed+
	Kernel driver in use: sata_nv

00:0d.1 IDE interface: NVIDIA Corporation MCP55 SATA Controller (rev a2) (prog-if 85 [Master SecO PriO])
	Subsystem: ASUSTeK Computer Inc. Device cb84
	Flags: bus master, 66MHz, fast devsel, latency 0, IRQ 20
	I/O ports at 09e0 [size=8]
	I/O ports at 0be0 [size=4]
	I/O ports at 0960 [size=8]
	I/O ports at 0b60 [size=4]
	I/O ports at cc00 [size=16]
	Memory at fe02c000 (32-bit, non-prefetchable) [size=4K]
	Capabilities: [44] Power Management version 2
	Capabilities: [b0] MSI: Enable- Count=1/4 Maskable- 64bit+
	Capabilities: [cc] HyperTransport: MSI Mapping Enable+ Fixed+
	Kernel driver in use: sata_nv

00:0d.2 IDE interface: NVIDIA Corporation MCP55 SATA Controller (rev a2) (prog-if 85 [Master SecO PriO])
	Subsystem: ASUSTeK Computer Inc. Device cb84
	Flags: bus master, 66MHz, fast devsel, latency 0, IRQ 23
	I/O ports at c800 [size=8]
	I/O ports at c400 [size=4]
	I/O ports at c000 [size=8]
	I/O ports at bc00 [size=4]
	I/O ports at b800 [size=16]
	Memory at fe02b000 (32-bit, non-prefetchable) [size=4K]
	Capabilities: [44] Power Management version 2
	Capabilities: [b0] MSI: Enable- Count=1/4 Maskable- 64bit+
	Capabilities: [cc] HyperTransport: MSI Mapping Enable+ Fixed+
	Kernel driver in use: sata_nv

00:0e.0 PCI bridge: NVIDIA Corporation MCP55 PCI bridge (rev a2) (prog-if 01 [Subtractive decode])
	Flags: bus master, 66MHz, fast devsel, latency 0
	Bus: primary=00, secondary=02, subordinate=02, sec-latency=32
	Memory behind bridge: fdf00000-fdffffff
	Capabilities: [b8] Subsystem: NVIDIA Corporation Device cb84
	Capabilities: [8c] HyperTransport: MSI Mapping Enable+ Fixed-

00:0e.1 Audio device: NVIDIA Corporation MCP55 High Definition Audio (rev a2)
	Subsystem: ASUSTeK Computer Inc. Device 81f6
	Flags: bus master, 66MHz, fast devsel, latency 0, IRQ 20
	Memory at fe020000 (32-bit, non-prefetchable) [size=16K]
	Capabilities: [44] Power Management version 2
	Capabilities: [50] MSI: Enable- Count=1/1 Maskable+ 64bit+
	Capabilities: [6c] HyperTransport: MSI Mapping Enable+ Fixed+
	Kernel driver in use: snd_hda_intel

00:10.0 Bridge: NVIDIA Corporation MCP55 Ethernet (rev a2)
	Subsystem: ASUSTeK Computer Inc. Device cb84
	Flags: bus master, 66MHz, fast devsel, latency 0, IRQ 42
	Memory at fe02a000 (32-bit, non-prefetchable) [size=4K]
	I/O ports at b400 [size=8]
	Memory at fe029000 (32-bit, non-prefetchable) [size=256]
	Memory at fe028000 (32-bit, non-prefetchable) [size=16]
	Capabilities: [44] Power Management version 2
	Capabilities: [70] MSI-X: Enable- Count=8 Masked-
	Capabilities: [50] MSI: Enable+ Count=1/8 Maskable+ 64bit+
	Capabilities: [6c] HyperTransport: MSI Mapping Enable+ Fixed+
	Kernel driver in use: forcedeth

00:11.0 Bridge: NVIDIA Corporation MCP55 Ethernet (rev a2)
	Subsystem: ASUSTeK Computer Inc. Device cb84
	Flags: bus master, 66MHz, fast devsel, latency 0, IRQ 21
	Memory at fe027000 (32-bit, non-prefetchable) [size=4K]
	I/O ports at b000 [size=8]
	Memory at fe026000 (32-bit, non-prefetchable) [size=256]
	Memory at fe025000 (32-bit, non-prefetchable) [size=16]
	Capabilities: [44] Power Management version 2
	Capabilities: [70] MSI-X: Enable- Count=8 Masked-
	Capabilities: [50] MSI: Enable- Count=1/8 Maskable+ 64bit+
	Capabilities: [6c] HyperTransport: MSI Mapping Enable+ Fixed+
	Kernel driver in use: forcedeth

00:16.0 PCI bridge: NVIDIA Corporation MCP55 PCI Express bridge (rev a2) (prog-if 00 [Normal decode])
	Flags: bus master, fast devsel, latency 0
	Bus: primary=00, secondary=03, subordinate=03, sec-latency=0
	I/O behind bridge: 00009000-00009fff
	Memory behind bridge: fde00000-fdefffff
	Capabilities: [40] Subsystem: NVIDIA Corporation Device 0000
	Capabilities: [48] Power Management version 2
	Capabilities: [50] MSI: Enable+ Count=1/2 Maskable- 64bit+
	Capabilities: [60] HyperTransport: MSI Mapping Enable+ Fixed-
	Capabilities: [80] Express Root Port (Slot+), MSI 00
	Capabilities: [100] Virtual Channel
	Kernel driver in use: pcieport

00:18.0 Host bridge: Advanced Micro Devices [AMD] K8 [Athlon64/Opteron] HyperTransport Technology Configuration
	Flags: fast devsel
	Capabilities: [80] HyperTransport: Host or Secondary Interface

00:18.1 Host bridge: Advanced Micro Devices [AMD] K8 [Athlon64/Opteron] Address Map
	Flags: fast devsel

00:18.2 Host bridge: Advanced Micro Devices [AMD] K8 [Athlon64/Opteron] DRAM Controller
	Flags: fast devsel

00:18.3 Host bridge: Advanced Micro Devices [AMD] K8 [Athlon64/Opteron] Miscellaneous Control
	Flags: fast devsel
	Capabilities: [f0] Secure device <?>
	Kernel driver in use: k8temp

01:00.0 VGA compatible controller: NVIDIA Corporation G71 [GeForce 7900 GS] (rev a1) (prog-if 00 [VGA controller])
	Subsystem: eVga.com. Corp. Device e624
	Flags: bus master, fast devsel, latency 0, IRQ 16
	Memory at fa000000 (32-bit, non-prefetchable) [size=16M]
	Memory at e0000000 (64-bit, prefetchable) [size=256M]
	Memory at fb000000 (64-bit, non-prefetchable) [size=16M]
	I/O ports at ac00 [size=128]
	[virtual] Expansion ROM at fcfe0000 [disabled] [size=128K]
	Capabilities: [60] Power Management version 2
	Capabilities: [68] MSI: Enable- Count=1/1 Maskable- 64bit+
	Capabilities: [78] Express Endpoint, MSI 00
	Capabilities: [100] Virtual Channel
	Capabilities: [128] Power Budgeting <?>
	Kernel driver in use: nvidia

02:0b.0 FireWire (IEEE 1394): Texas Instruments TSB43AB22A IEEE-1394a-2000 Controller (PHY/Link) [iOHCI-Lynx] (prog-if 10 [OHCI])
	Subsystem: ASUSTeK Computer Inc. P5W DH Deluxe Motherboard
	Flags: bus master, medium devsel, latency 32, IRQ 16
	Memory at fdfff000 (32-bit, non-prefetchable) [size=2K]
	Memory at fdff8000 (32-bit, non-prefetchable) [size=16K]
	Capabilities: [44] Power Management version 2
	Kernel driver in use: firewire_ohci

03:00.0 Mass storage controller: Silicon Image, Inc. SiI 3132 Serial ATA Raid II Controller (rev 01)
	Subsystem: ASUSTeK Computer Inc. Device 819f
	Flags: bus master, fast devsel, latency 0, IRQ 16
	Memory at fdeff000 (64-bit, non-prefetchable) [size=128]
	Memory at fdef8000 (64-bit, non-prefetchable) [size=16K]
	I/O ports at 9c00 [size=128]
	Expansion ROM at fde00000 [disabled] [size=512K]
	Capabilities: [54] Power Management version 2
	Capabilities: [5c] MSI: Enable- Count=1/1 Maskable- 64bit+
	Capabilities: [70] Express Legacy Endpoint, MSI 00
	Capabilities: [100] Advanced Error Reporting
	Kernel driver in use: sata_sil24
Comment 29 cthx 2012-10-29 13:36:13 UTC
Created attachment 85211 [details]
crash on asus m2n32_sli_deluxe
Comment 30 Roland Bogner 2012-11-01 15:18:29 UTC
crash on 3.7 rc-3 too.
Asus M2N32-SLI
Last working kernel was 3-5.x
Comment 31 Roland Bogner 2012-11-02 12:07:37 UTC
Re-Compiled ubuntu mainline kernel without enabling "ATA-ACPI Support" then i was able to boot the kernel without the freeze.

Unfortunaly none IDE HDD's works then.
Comment 32 Borislav Petkov 2012-11-03 04:23:21 UTC
You could try enabling the platform-specific pata driver for your system and don't compile pata_acpi at all. Until libata folks fix this properly, that is...

Thanks.
Comment 33 Borislav Petkov 2012-11-03 04:26:39 UTC
On Wed, Oct 24, 2012 at 11:57:46AM +0100, Alan Cox wrote:
> Which is an ATA layer bug - adev->dma_mode should never be called
> without a DMA mode in normal use.

Ok, it looks like this would take a while to fix.

Alan, what is your suggestion for a proper fix, uncomment XFER_PIO_SLOW
and drop to it with a big warning that ACPI is giving botched
information on those chips and people should try using the
platform-specific driver if they want better/optimal speeds?

Thanks.
Comment 34 Roland Bogner 2012-11-03 07:37:04 UTC
(In reply to comment #32)
> You could try enabling the platform-specific pata driver for your system and
> don't compile pata_acpi at all. Until libata folks fix this properly, that
> is...
> 
> Thanks.

well for me it is not a big problem without IDE, since my system runs completly on SATA and this still works fine with the kernel.

Unfortunatly distribution dudes will have big problems when they release the kernel for the masses, they can't just disable IDE support at all.

Why this problems appeaers now in the kernel, previous ones worked pretty fine.
Comment 35 Alan 2012-11-03 16:25:43 UTC
On Sat, 3 Nov 2012 05:26:35 +0100
Borislav Petkov <bp@alien8.de> wrote:

> On Wed, Oct 24, 2012 at 11:57:46AM +0100, Alan Cox wrote:
> > Which is an ATA layer bug - adev->dma_mode should never be called
> > without a DMA mode in normal use.
> 
> Ok, it looks like this would take a while to fix.
> 
> Alan, what is your suggestion for a proper fix, uncomment XFER_PIO_SLOW
> and drop to it with a big warning that ACPI is giving botched

No. The proper fix is to find out how it got called with no DMA mode set.
There is no reason ACPI can't return pure PIO answers. If it does however
then the DMA mode setting call should not be made by the core libata
code. Lots of our ATA driver code relies upon that so if it's actually
what is happening that is what needs fixing.

Alan
Comment 36 Alan 2012-11-03 16:43:14 UTC
On Sat, 3 Nov 2012 05:26:35 +0100
Borislav Petkov <bp@alien8.de> wrote:

> On Wed, Oct 24, 2012 at 11:57:46AM +0100, Alan Cox wrote:
> > Which is an ATA layer bug - adev->dma_mode should never be called
> > without a DMA mode in normal use.
> 
> Ok, it looks like this would take a while to fix.

So a 30 second glance says that the problem is that you seem to have
dma_mode uninitialised as zero which is bogus.

That means either ata_acpi_gtm_xfermask broke (it should have set the
bits to 0xFF if no mode is found), ata_dma_enabled is broken, or
pacpi_qc_issue got called before pacpi_port_start (which seems wildly
unlikely)

Needs someone to go and dump the relevant values in the right places and
see what is breaking in the pata_acpi setup logic.

Alan
Comment 37 Szymon Janc 2012-11-15 18:05:10 UTC
Hi,

I did some bisecting (10 successful boots == good) and got this:

30dcf76acc695cbd2fa919e294670fe9552e16e7 is the first bad commit
commit 30dcf76acc695cbd2fa919e294670fe9552e16e7
Author: Matthew Garrett <mjg@redhat.com>
Date:   Mon Jun 25 16:13:04 2012 +0800

    libata: migrate ACPI code over to new bindings
    
    Now that we have the ability to directly glue the ACPI namespace to the
    driver model in libata, we don't need the custom code to handle the same
    thing. Remove it and migrate the functions over to the new code.
    
    Signed-off-by: Matthew Garrett <mjg@redhat.com>
    Signed-off-by: Holger Macht <holger@homac.de>
    Signed-off-by: Lin Ming <ming.m.lin@intel.com>
    Signed-off-by: Jeff Garzik <jgarzik@redhat.com>


I've also added some prints:
pacpi_port_start is called before pacpi_qc_issue but ata_do_set_mode is called after pacpi_qc_issue..  that seems not right, right?

Hope this will help someone familiar with that code..

I'll upload full dmesg as well.

-- 
BR
Szymon Janc
Comment 38 Szymon Janc 2012-11-15 18:07:31 UTC
Created attachment 86441 [details]
dmesg

dmesg on A8N-E with some extra prints
Comment 39 Jeff Garzik 2012-11-16 04:50:43 UTC
On 11/03/2012 12:48 PM, Alan Cox wrote:
> On Sat, 3 Nov 2012 05:26:35 +0100
> Borislav Petkov <bp@alien8.de> wrote:
>
>> On Wed, Oct 24, 2012 at 11:57:46AM +0100, Alan Cox wrote:
>>> Which is an ATA layer bug - adev->dma_mode should never be called
>>> without a DMA mode in normal use.
>>
>> Ok, it looks like this would take a while to fix.
>
> So a 30 second glance says that the problem is that you seem to have
> dma_mode uninitialised as zero which is bogus.
>
> That means either ata_acpi_gtm_xfermask broke (it should have set the
> bits to 0xFF if no mode is found), ata_dma_enabled is broken, or
> pacpi_qc_issue got called before pacpi_port_start (which seems wildly
> unlikely)
>
> Needs someone to go and dump the relevant values in the right places and
> see what is breaking in the pata_acpi setup logic.

Agreed -- though the WARN_ONCE() will at least give us trivially better 
poops.

	Jeff
Comment 40 Jeff Garzik 2012-11-16 04:59:50 UTC
@Szymon Janc: useful bisection, thanks!
Comment 41 Aaron Lu 2012-11-16 08:39:33 UTC
The problem I see is:
During init time, identify command needs to be sent;
pacpi_qc_issue is invoked, and if the chipset can not set timing independently for each drive, and the qc is not for the current drive, dma mode will be set for the target device if ata_dma_enabled returns true;
At this time, ata_device->dma_mode is still un-initialized as 0, but ata_dma_enabled would treat this as valid, and the ata_timing table doesn't handle mode 0, so we get NULL. This problem only occurs when processing identify command.

So I think we should init ata_device->dma_mode to 0xff when we are to reset the drive, and the real value will get set in ata_set_mode afterwards. This way, when pacpi_qc_issue is invoked, it will not attempt to set dma mode for the device.

And for Szymon's bisect, I think the 'offending' commit actually fixed a problem of pata_acpi(maybe a long standing problem). And due to this fix, pata_acpi module triggered this bug.

In previous kernels(pre the 'offending' commit Szymon bisected), the acpi_port_start function will always fail due to ap->acpi_handle is NULL, the reason is showed in the following call sequence:

ata_host_start
  ap->ops->port_start -> pacpi_port_start -> where ap->acpi_handle is used
ata_host_register
  ata_associate_acpi -> where the ap->acpi_handle is assigned

So in previous kernels, pata_acpi module will always fail to init the controller, effectively hiding this bug.

Please someone test the following patch, as I do not have a system to reproduce this:

diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 3cc7096..e04cdc2 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -2560,6 +2560,7 @@ int ata_bus_probe(struct ata_port *ap)
 		 * bus as we may be talking too fast.
 		 */
 		dev->pio_mode = XFER_PIO_0;
+		dev->dma_mode = 0xff;
 
 		/* If the controller has a pio mode setup function
 		 * then use it to set the chipset to rights. Don't
diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c
index e60437c..bf039b0 100644
--- a/drivers/ata/libata-eh.c
+++ b/drivers/ata/libata-eh.c
@@ -2657,6 +2657,7 @@ int ata_eh_reset(struct ata_link *link, int classify,
 		 * bus as we may be talking too fast.
 		 */
 		dev->pio_mode = XFER_PIO_0;
+		dev->dma_mode = 0xff;
 
 		/* If the controller has a pio mode setup function
 		 * then use it to set the chipset to rights. Don't
Comment 42 dutra.julio 2012-11-17 16:29:15 UTC
Works great.
Comment 43 Szymon Janc 2012-11-17 17:22:52 UTC
Boots fine here as well. Thanks!
Would be also great to see it in stable :)

Tested-by: Szymon Janc <szymon@janc.net.pl>
Comment 44 Szymon Janc 2012-11-25 12:55:44 UTC
Hi,

Any progress with getting Aaron's patch upstream (and 3.6.x)?

BR
Szymon Janc
Comment 45 Aaron Lu 2012-11-29 02:22:11 UTC
Created attachment 87661 [details]
Fix ata_dma_enabled

Hi all,

After another thought, 0 is actually not a valid dma mode either, so probably we should fix ata_dma_enabled instead of setting 0xff beforehand.

Attached a new patch for test, sorry for the trouble.
Comment 46 dutra.julio 2012-11-29 11:21:36 UTC
Works too.
Comment 47 Bernd Buschinski 2012-11-30 17:10:34 UTC
Also boots fine here, thx :)
That makes the first bootable 3.6 kernel(with patch) for me, I hope this patch gets upstream soon
Comment 48 Szymon Janc 2012-12-02 17:46:37 UTC
Hi Aaron,

second patch works for me as well!

BR
Szymon Janc
Comment 49 Aaron Lu 2012-12-03 00:51:46 UTC
Thank you all for your test result, I'll update the patch with all of your Tested-by tag, please let me know if you don't think I can add yours. And then I'll send it to linux-ide mailing list, then Jeff will probably take this patch.
Comment 50 Aaron Lu 2012-12-03 03:39:16 UTC
Turned out Alan Cox prefer the first approach, so I sent that patch out. Sorry for the trouble brought by the 2nd patch.
Comment 51 Aaron Lu 2012-12-07 07:00:37 UTC
The patch 'libata: set dma_mode to 0xff in reset' is taken by Jeff so this bug can be closed, thanks.
Comment 52 Roland Bogner 2012-12-18 07:13:02 UTC
Is this now fixed in the final 3.7 ?
Comment 53 Aaron Lu 2012-12-18 07:26:50 UTC
No I'm afraid. But it already arrived in Linus' tree so should appear in 3.7 stable tree some time later.
Comment 54 Aaron Lu 2012-12-18 12:48:09 UTC
Assign the bug to me to close it.
Comment 55 Aaron Lu 2012-12-18 12:49:07 UTC
Patch arrived in Linus' tree as 3.8 material, should also arrive in 3.7 stable tree some time later.
Comment 56 Florian Mickler 2012-12-22 09:33:35 UTC
A patch referencing this bug report has been merged in Linux v3.8-rc1:

commit 5416912af75de9cba5d1c75b99a7888b0bbbd2fb
Author: Aaron Lu <aaron.lu@intel.com>
Date:   Mon Dec 3 11:35:02 2012 +0800

    libata: set dma_mode to 0xff in reset

Note You need to log in before you can comment on or make changes to this bug.