Re: linux kernel panic when ejecting ieee1394 ipod

[Andrew de Quincey <adq_dvb@lidskialf.net>]

[-- Attachment #1: Type: text/plain, Size: 1993 bytes --]

On Thursday 08 December 2005 01:59, Andrew de Quincey wrote:
> On Thursday 08 December 2005 01:19, Andrew de Quincey wrote:
> > On Wednesday 07 December 2005 23:58, Andrew de Quincey wrote:
> > > Reposting to the -devel list since there was no response on -user.
> > >
> > > Hi, I'm using linux kernel 2.6.14 with an generation 1 ipod connected
> > > via ieee1394/sbp2.
> > >
> > > I can mount/unmount it and use it fine. It even works with HAL now.
> > >
> > > The problem comes when I want to remove it. If I do:
> > >
> > > eject /dev/sdb
> > >
> > > The kernel panics with the following error:
> > > Kernel panic - not syncing: PCI-DMA: high address but no IOMMU
> > >
> > > I'm using an nforce 4 motherboard (Asus A8N-SLI Deluxe). The ipod is
> > > attached to the ieee1394 port on a creative labs Audigy2 sound card
> > > (uses OHCI-1394).
> >
> > More info (I'm on an AMD64 in 64 bit mode BTW):
> >
> > eject sends a CDROMEJECT ioctl first of all. It is this IOCTL that kills
> > my system. If I hack/tell it to just use a "SCSI eject", it works and
> > actually makes my ipod show that tick thing showing it is safe to remove
> > it.
>
> Yet more info:
>
> eject -s sends the following SCSI packet command to the sbp/ipod device:
>
> 1b 00 00 00 02 00 with a direction of DMA_NONE
>
> eject -r results in the same via the CDROMEJECT translator in
> scsi_cmd_ioctl(), but with a direction of DMA_TO_DEVICE. Thats what crashes
> it - looks like its trying to set up a DMA transfer for 0 bytes or
> something. I just added a really horrible hack to the start of
> sbp2_send_command() to check, as follows:
>
>    if (*cmd == 0x1b) {
>       SCpnt->sc_data_direction = 3;
>    }
>
> Now, eject -r works perfectly. Though thats obviously not a good way to fix
> it :)

Possible "proper" patch attached - no idea if its a good way to do this. 
Basically if it gets a command with a scsi_request_bufflen of zero bytes, it 
forces dma_dir to DMA_NONE.

The ipod works perfectly with this now.

[-- Attachment #2: possible-sbp2-eject-fix-1.patch --]
[-- Type: text/x-diff, Size: 552 bytes --]

--- linux-2.6.14/drivers/ieee1394/sbp2.c	2005-12-08 02:05:27.000000000 +0000
+++ linux/drivers/ieee1394/sbp2.c	2005-12-08 02:06:18.000000000 +0000
@@ -1760,6 +1760,10 @@
 	command_orb->misc |= ORB_SET_SPEED(scsi_id->speed_code);
 	command_orb->misc |= ORB_SET_NOTIFY(1);		/* Notify us when complete */
 
+	/* check for duff DMA transfer direction with a zero length buffer */
+	if (scsi_request_bufflen == 0)
+		dma_dir = DMA_NONE;
+
 	/*
 	 * Get the direction of the transfer. If the direction is unknown, then use our
 	 * goofy table as a back-up.