kern/42376: ahd-driver bug in cmd-queuing - duplicate TAG send to device

[Wolfgang.Stukenbrock%nagler-company.com@localhost]

>Number:         42376
>Category:       kern
>Synopsis:       ahd-driver bug in cmd-queuing - duplicate TAG send to device
>Confidential:   no
>Severity:       serious
>Priority:       high
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Wed Nov 25 12:45:00 +0000 2009
>Originator:     W. Stukenbrock
>Release:        NetBSD 4.0
>Organization:
Dr. Nagler & Company GmbH
        
>Environment:
        
        
System: NetBSD test-s0 4.0 NetBSD 4.0 (NSW-WS) #2: Fri Nov 6 11:14:49 CET 2009 
wgstuken@s012:/export/NetBSD-4.0/N+C-build/.OBJDIR_amd64/export/NetBSD-4.0/src/sys/arch/amd64/compile/NSW-WS
 amd64
Architecture: x86_64
Machine: amd64
>Description:
        The ADH driver manages 512 SBC entries, but there are only 256 different
        cmd-TAGs possbile on the SCSI-bus.
        So there is a SCB-manaagment implemented, that avoid the use of a
        conflicting SCB-tag on a device.
        Accedently the check, if a conflict may happen or not is broken.
        Command queuing is enabled on the scspi-layer, if xs_tag_type is
        set to the correct SCSI-message value.
        Now in aic79xx_osm.c this value is checked for non-zero to be
        non-cnflicting in any case. It should be checked for zero instead.
>How-To-Repeat:
        This is not easy ...
        I've the problem, that on some disks on heavy load some commands are
rejected by some oth the disk drives with ASC=4d (Deivce reports conflicting 
TAG).
        After that a device timeout happens with the SCB with the same TAG
        pattern in the lower 8 bits as reported .
        I've found no way to reproduce it on demand up to now.
        I've analysed the code to find the reason for it - see patch and
        description above..
>Fix:
        The following patch to /usr/src/sys/ic/aic79xx_osm.c will fix the
        problem:

--- aic79xx_osm.c       2008/09/26 11:20:25     1.2
+++ aic79xx_osm.c       2009/11/25 10:12:40
@@ -312,7 +312,7 @@
                tinfo = ahd_fetch_transinfo(ahd, channel, our_id,
                                            target_id, &tstate);
 
-               if (xs->xs_tag_type != 0 ||
+               if (xs->xs_tag_type == 0 ||
                    (tinfo->curr.ppr_options & MSG_EXT_PPR_IU_REQ) != 0)
                        col_idx = AHD_NEVER_COL_IDX;
                else

>Unformatted: