kern/39757: ciss(8) driver stuffup with exceeded cmd buffer

To: kern-bug-people%netbsd.org@localhost,gnats-admin%netbsd.org@localhost,netbsd-bugs%netbsd.org@localhost
Subject: kern/39757: ciss(8) driver stuffup with exceeded cmd buffer
From: mishka%netbsd.org@localhost
Date: Fri, 17 Oct 2008 13:45:00 +0000 (UTC)
>Number:         39757
>Category:       kern
>Synopsis:       ciss(8) driver stuffup with exceeded cmd buffer
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Fri Oct 17 13:45:00 +0000 2008
>Originator:     Mike M. Volokhov
>Release:        NetBSD 4.99.72
>Organization:
        The NetBSD Project
>Environment:
System: NetBSD nostromo.od5.lohika.com 4.99.72 NetBSD 4.99.72 (GENERIC) #0: Thu 
Aug 14 22:18:41 EEST 2008 
mishka%nostromo.od5.lohika.com@localhost:/build/ab/obj-amd64-20080814/sys/arch/amd64/compile/GENERIC
 amd64
Architecture: x86_64
Machine: amd64
>Description:

        Hello,

        I have HP Smart Array E200 with SATA disks, but stock NetBSD
        doesn't working well with it. Please examine dmesg below.

Copyright (c) 1996, 1997, 1998, 1999, 2000, 2001, 2002, 2003, 2004, 2005,
    2006, 2007, 2008
    The NetBSD Foundation, Inc.  All rights reserved.
Copyright (c) 1982, 1986, 1989, 1991, 1993
    The Regents of the University of California.  All rights reserved.

NetBSD 4.99.72 (INSTALL) #0: Sun Oct  5 06:39:32 EEST 2008
        
mishka%nostromo.od5.lohika.com@localhost:/build/ab/obj-amd64-20081005/sys/arch/amd64/compile/INSTALL
total memory = 4093 MB
avail memory = 3949 MB
timecounter: Timecounters tick every 10.000 msec
RTC BIOS diagnostic error b<fixed_disk>
timecounter: Timecounter "i8254" frequency 1193182 Hz quality 100
SMBIOS rev. 2.5 @ 0xdfdfa000 (63 entries)
Intel Corporation S3210SH
mainbus0 (root)
cpu0 at mainbus0 apid 0: Intel 686-class, 2493MHz, id 0x10677
cpu1 at mainbus0 apid 2: Intel 686-class, 2493MHz, id 0x10677
cpu2 at mainbus0 apid 1: Intel 686-class, 2493MHz, id 0x10677
cpu3 at mainbus0 apid 3: Intel 686-class, 2493MHz, id 0x10677
ioapic0 at mainbus0 apid 5: pa 0xfec00000, version 20, 24 pins
acpi0 at mainbus0: Intel ACPICA 20080321
acpi0: X/RSDT: OemId <INTEL ,S3200SHC,00000000>, AslId <INTL,01000013>
acpi0: SCI interrupting at int 9
acpi0: fixed-feature power button present
timecounter: Timecounter "ACPI-Fast" frequency 3579545 Hz quality 1000
ACPI-Fast 24-bit timer
acpibut0 at acpi0 (SLPB, PNP0C0E): ACPI Sleep Button
acpibut1 at acpi0 (PWRB, PNP0C0C-170): ACPI Power Button
attimer1 at acpi0 (TMR, PNP0100): AT Timer
attimer1: io 0x40-0x43,0x50-0x53 irq 0
pcppi1 at acpi0 (SPKR, PNP0800)
pcppi1: io 0x61
midi0 at pcppi1: PC speaker (CPU-intensive output)
sysbeep0 at pcppi1
UAR1 (PNP0501) at acpi0 not configured
UAR2 (PNP0501) at acpi0 not configured
pckbc1 at acpi0 (PS2M, PNP0F03): aux port
pckbc1: irq 12
pckbc2 at acpi0 (PS2K, PNP0303): kbd port
pckbc2: io 0x60,0x64 irq 1
FDC0 (PNP0700) at acpi0 not configured
APIC (PNP0003) at acpi0 not configured
hpet0 at acpi0 (HPET, PNP0103)
hpet0: mem 0xfed00000-0xfed003ff
timecounter: Timecounter "hpet0" frequency 14318179 Hz quality 2000
attimer1: attached to pcppi1
pckbd0 at pckbc2 (kbd slot)
pckbc2: using irq 1 for kbd slot
wskbd0 at pckbd0: console keyboard
ipmi0 at mainbus0
pci0 at mainbus0 bus 0: configuration mode 1
pci0: i/o space, memory space enabled, rd/line, rd/mult, wr/inv ok
pchb0 at pci0 dev 0 function 0
pchb0: vendor 0x8086 product 0x29f0 (rev. 0x00)
wm0 at pci0 dev 25 function 0: 82801I (AMT) LAN Controller, rev. 2
wm0: interrupting at ioapic0 pin 20
wm0: PCI-Express bus
wm0: FLASH
wm0: Ethernet address 00:15:17:28:3d:66
uhci0 at pci0 dev 26 function 0: vendor 0x8086 product 0x2937 (rev. 0x02)
uhci0: interrupting at ioapic0 pin 18
usb0 at uhci0: USB revision 1.0
uhci1 at pci0 dev 26 function 1: vendor 0x8086 product 0x2938 (rev. 0x02)
uhci1: interrupting at ioapic0 pin 21
usb1 at uhci1: USB revision 1.0
uhci2 at pci0 dev 26 function 2: vendor 0x8086 product 0x2939 (rev. 0x02)
uhci2: interrupting at ioapic0 pin 17
usb2 at uhci2: USB revision 1.0
ehci0 at pci0 dev 26 function 7: vendor 0x8086 product 0x293c (rev. 0x02)
ehci0: interrupting at ioapic0 pin 17
ehci0: EHCI version 1.0
ehci0: companion controllers, 2 ports each: uhci0 uhci1 uhci2
usb3 at ehci0: USB revision 2.0
ppb0 at pci0 dev 28 function 0: vendor 0x8086 product 0x2940 (rev. 0x02)
pci1 at ppb0 bus 1
pci1: i/o space, memory space enabled, rd/line, wr/inv ok
ppb1 at pci1 dev 0 function 0: vendor 0x1166 product 0x0103 (rev. 0xb4)
pci2 at ppb1 bus 2
pci2: i/o space, memory space enabled, rd/line, wr/inv ok
ppb2 at pci2 dev 4 function 0: vendor 0x1166 product 0x0104 (rev. 0xb2)
pci3 at ppb2 bus 3
pci3: i/o space, memory space enabled, rd/line, wr/inv ok
ciss0 at pci2 dev 8 function 0: Smart Array E200
ciss0: interrupting at ioapic0 pin 16
ciss0: 1 LD, HW rev 0, FW 1.72/1.72
scsibus0 at ciss0: 1 target, 1 lun per target
ppb3 at pci0 dev 28 function 4: vendor 0x8086 product 0x2948 (rev. 0x02)
pci4 at ppb3 bus 4
pci4: i/o space, memory space enabled, rd/line, wr/inv ok
vga0 at pci4 dev 0 function 0: vendor 0x102b product 0x0522 (rev. 0x02)
wsdisplay0 at vga0 kbdmux 1: console (80x25, vt100 emulation), using wskbd0
wsmux1: connecting to wsdisplay0
drm at vga0 not configured
uhci3 at pci0 dev 29 function 0: vendor 0x8086 product 0x2934 (rev. 0x02)
uhci3: interrupting at ioapic0 pin 23
usb4 at uhci3: USB revision 1.0
uhci4 at pci0 dev 29 function 1: vendor 0x8086 product 0x2935 (rev. 0x02)
uhci4: interrupting at ioapic0 pin 19
usb5 at uhci4: USB revision 1.0
uhci5 at pci0 dev 29 function 2: vendor 0x8086 product 0x2936 (rev. 0x02)
uhci5: interrupting at ioapic0 pin 18
usb6 at uhci5: USB revision 1.0
ehci1 at pci0 dev 29 function 7: vendor 0x8086 product 0x293a (rev. 0x02)
ehci1: interrupting at ioapic0 pin 23
ehci1: EHCI version 1.0
ehci1: companion controllers, 2 ports each: uhci3 uhci4 uhci5
usb7 at ehci1: USB revision 2.0
ppb4 at pci0 dev 30 function 0: vendor 0x8086 product 0x244e (rev. 0x92)
pci5 at ppb4 bus 5
pci5: i/o space, memory space enabled
wm1 at pci5 dev 2 function 0: Intel i82541GI 1000BASE-T Ethernet, rev. 5
wm1: interrupting at ioapic0 pin 18
wm1: 32-bit 33MHz PCI bus
wm1: 65536 word (16 address bits) SPI EEPROM
wm1: Ethernet address 00:15:17:28:3d:64
igphy0 at wm1 phy 1: Intel IGP01E1000 Gigabit PHY, rev. 0
igphy0: 10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, 1000baseT, 
1000baseT-FDX, auto
pcib0 at pci0 dev 31 function 0
pcib0: vendor 0x8086 product 0x2916 (rev. 0x02)
ichsmb0 at pci0 dev 31 function 3: vendor 0x8086 product 0x2930 (rev. 0x02)
ichsmb0: interrupting at ioapic0 pin 18
iic0 at ichsmb0: I2C bus
isa0 at pcib0
com0 at isa0 port 0x3f8-0x3ff irq 4: ns16550a, working fifo
com1 at isa0 port 0x2f8-0x2ff irq 3: ns16550a, working fifo
fdc0 at isa0 port 0x3f0-0x3f7 irq 6 drq 2
timecounter: Timecounter "clockinterrupt" frequency 100 Hz quality 0
scsibus0: waiting 2 seconds for devices to settle...
uhub0 at usb0: vendor 0x8086 UHCI root hub, class 9/0, rev 1.00/1.00, addr 1
uhub0: 2 ports with 2 removable, self powered
uhub1 at usb1: vendor 0x8086 UHCI root hub, class 9/0, rev 1.00/1.00, addr 1
uhub1: 2 ports with 2 removable, self powered
uhub2 at usb2: vendor 0x8086 UHCI root hub, class 9/0, rev 1.00/1.00, addr 1
uhub2: 2 ports with 2 removable, self powered
uhub3 at usb3: vendor 0x8086 EHCI root hub, class 9/0, rev 2.00/1.00, addr 1
uhub3: 6 ports with 6 removable, self powered
uhub4 at usb4: vendor 0x8086 UHCI root hub, class 9/0, rev 1.00/1.00, addr 1
uhub4: 2 ports with 2 removable, self powered
uhub5 at usb5: vendor 0x8086 UHCI root hub, class 9/0, rev 1.00/1.00, addr 1
uhub5: 2 ports with 2 removable, self powered
uhub6 at usb6: vendor 0x8086 UHCI root hub, class 9/0, rev 1.00/1.00, addr 1
uhub6: 2 ports with 2 removable, self powered
fd0 at fdc0 drive 0: 1.44MB, 80 cyl, 2 head, 18 sec
uhub7 at usb7: vendor 0x8086 EHCI root hub, class 9/0, rev 2.00/1.00, addr 1
uhub7: 6 ports with 6 removable, self powered
umass0 at uhub7 port 4 configuration 1 interface 0
umass0: Prolific Technology Inc. Mass Storage Device, rev 2.00/1.00, addr 2
umass0: using SCSI over Bulk-Only
scsibus1 at umass0: 2 targets, 1 lun per target
sd0 at scsibus0 target 0 lun 0: <HP, LOGICAL VOLUME, 1.72> disk fixed
ciss driver stuffup in /usr/mishka/NetBSD/src/sys/dev/ic/ciss.c:1023: 
ciss_scsi_cmd()
sd0(ciss0:0:0:0): generic HBA error
sd0(ciss0:0:0:0):  Check Condition on CDB: 0x23 00 00 00 00 00 00 00 0c 00
    SENSE KEY:  Illegal Request
     ASC/ASCQ:  Invalid Command Operation Code

sd0: drive offline
ciss driver stuffup in /usr/mishka/NetBSD/src/sys/dev/ic/ciss.c:1023: 
ciss_scsi_cmd()
sd0(ciss0:0:0:0): generic HBA error
sd0(ciss0:0:0:0):  Check Condition on CDB: 0x23 00 00 00 00 00 00 00 0c 00
    SENSE KEY:  Illegal Request
     ASC/ASCQ:  Invalid Command Operation Code

sd0: unable to open device, error = 6
cd0 at scsibus1 target 0 lun 0: <ASUS, DRW-1608P3S, 1.06> cdrom removable
ipmi0: version 2.0 interface KCS iobase 0xca2/2 spacing 1
Kernelized RAIDframe activated
md0: internal 5000 KB image area
pad0: outputs: 44100Hz, 16-bit, stereo
audio0 at pad0: half duplex
ciss driver stuffup in /usr/mishka/NetBSD/src/sys/dev/ic/ciss.c:1023: 
ciss_scsi_cmd()
sd0(ciss0:0:0:0): generic HBA error
sd0(ciss0:0:0:0):  Check Condition on CDB: 0x23 00 00 00 00 00 00 00 0c 00
    SENSE KEY:  Illegal Request
     ASC/ASCQ:  Invalid Command Operation Code

ciss driver stuffup in /usr/mishka/NetBSD/src/sys/dev/ic/ciss.c:1023: 
ciss_scsi_cmd()
sd0(ciss0:0:0:0): generic HBA error
sd0(ciss0:0:0:0):  Check Condition on CDB: 0x23 00 00 00 00 00 00 00 0c 00
    SENSE KEY:  Illegal Request
     ASC/ASCQ:  Invalid Command Operation Code

boot device: <unknown>
root on md0a dumps on md0b
root file system type: ffs
WARNING: clock gained 11 days
WARNING: CHECK AND RESET THE DATE!
warning: no /dev/console
ciss0: normal state on 'ciss0:0' (online)

>How-To-Repeat:

        Don't know. I have the E200 only which works as it described
        above.
        
>Fix:

        By fact, xs->cmdlen (ciss.c) is set to 16 when the problem
        occurs, while CISS_MAX_CDB is limits this value by 12.
        Interesting, that both OpenBSD's CISS_MAX_CDB and FreeBSD's
        CISS_CDB_BUFFER_SIZE are set to 16, and simply increasing
        the limit does a trick for me:

sd0 at scsibus0 target 0 lun 0: <HP, LOGICAL VOLUME, 1.72> disk fixed
sd0: 4191 GB, 65535 cyl, 255 head, 526 sec, 512 bytes/sect x 8790500592 sectors
sd0: GPT GUID: e2474f93-400d-4d03-9265-8d78b7a9afd3
sd0: bad GPT partition array CRC

        The patch is:

Index: cissreg.h
===================================================================
RCS file: /cvsroot/src/sys/dev/ic/cissreg.h,v
retrieving revision 1.2
diff -u -r1.2 cissreg.h
--- cissreg.h   25 May 2008 20:08:34 -0000      1.2
+++ cissreg.h   17 Oct 2008 12:09:47 -0000
@@ -425,7 +425,7 @@
 #define        CISS_CDB_IN     0x80
 #define        CISS_CDB_OUT    0x40
        u_int16_t       tmo;    /* 16: timeout in seconds */
-#define        CISS_MAX_CDB    12
+#define        CISS_MAX_CDB    16
        u_int8_t        cdb[16];/* 18 */
 
        u_int64_t       err_pa; /* 28: pa(struct ciss_error *) */
Prev by Date: Re: port-i386/39299
Next by Date: Re: port-i386/39299
Previous by Thread: Re: port-i386/39299
Next by Thread: port-amd64/39758: if_iwn.c 1.20 makes iwn(4) inoperable
Indexes:
Home | Main Index | Thread Index | Old Index