lkml.org 
[lkml]   [1999]   [Jun]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
SubjectRe: massive e2fs corruption with 2.2.9/10?


The change you mention has been posted to the list on may 10.
It fixed a common problem reported when using the ncr/sym53c8xx
drivers (I have attached some post about).

The consequence of providing a wrong CDB length to a low level driver may
be catastrophic, especially when this low level driver does not perform
any check against the length of the CDB when feeding the device with the
SCSI command, or when this driver copies the CDB using bogus length in
another place.

The ncr/sym53c8xx drivers are able to detect a wrong phase when the device
request more bytes that expected. This allowed to guess the cause of the
problem and to propose a fix that has been reported to eradicate the data
corruption. I donnot know how this problem can affect other low-level
drivers.

I noticed that recent st drivers have been fixed against the cmd_len
miss-fill-up problem, but other SCSI device drivers haven't been (not the
sd driver for example).

In fact and in my opinion :), the thing that is way broken by design in
the first place is the interface with the scsi.c driver:

The scsi_do_cmd() interface does not allow to pass the CDB length, but
requires to pass the CDB address.

The only thing that may make a bit of sense could be that the CDB length
is kind of _implicit_ parameter. If fact, the length of a CDB only depends
on the group of the command and this probably worked this way in the early
time of the SCSI code. The current code does not fill-up the cmd_len field
of the command control block if it is non zero. I donnot know when this
hack has been added, but it was already present in 2.0 kernels.

Gérard.


On Fri, 18 Jun 1999, Adrian Baugh wrote:

> Another data-point for you. I have a dual P2/300 (Gigabyte motherboard
> with an on-board Adaptec aic7895 SCSI adaptor) and an IBM 4.5GB SCSI hard
> drive, model DDRS-34560W. Also is a very old Quantum TRB850A 850MB IDE
> hard drive (it doesn't use DMA). I tried Larry's lmdd using 650MB, 100MB
> and 75MB file sizes, both random access and the normal checking mode,
> doing several operations simultaneously, on different partitions, disks
> etc - everything I could think of. I didn't see any corruption.
> This is with 2.2.10 SMP compiled on pgcc-2.91.66 (based on the egcs-1.1.2
> release). I applied the following patch to drivers/scsi/sd.c (someone on
> here mentioned it a while back):
>
> --- drivers/scsi/sd.c.orig Fri Jun 18 00:52:10 1999
> +++ drivers/scsi/sd.c Fri Jun 18 00:52:39 1999
> @@ -1050,6 +1050,7 @@
>
> SCpnt->transfersize = rscsi_disks[dev].sector_size;
> SCpnt->underflow = this_count << 9;
> + SCpnt->cmd_len = 0;
> scsi_do_cmd (SCpnt, (void *) cmd, buff,
> this_count * rscsi_disks[dev].sector_size,
> rw_intr,
>
> More information on request.
> Please cc: me as I'm not on the list after the end of term (tomorrow).
>
> Adrian Baugh.
>
> --
> Hi! I'm a .signature virus! Copy me into your ~/.signature to help me
> spread!
>
>
> -
> To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
> the body of a message to majordomo@vger.rutgers.edu
> Please read the FAQ at http://www.tux.org/lkml/
>
>

From groudier@club-internet.fr Sat Jun 19 09:00:52 1999
Date: Mon, 10 May 1999 21:41:07 +0200 (MET DST)
From: Gerard Roudier <groudier@club-internet.fr>
To: Rainer Clasen <bj@ncc.cicely.de>
Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>, linux-kernel@vger.rutgers.edu,
Shaw Carruthers <shaw@shawc.demon.co.uk>
Subject: Re: sym/ncr53c8xx phase error: Some progress


Hello,

I just mailed Shaw the following.
Could you give it a try. It is untested and, by the way, applies to
the SCSI code.

: From groudier@club-internet.fr Mon May 10 21:36:20 1999
: Date: Mon, 10 May 1999 20:57:27 +0200 (MET DST)
: From: Gerard Roudier <groudier@club-internet.fr>
: To: Shaw Carruthers <shaw@shawc.demon.co.uk>
: Subject: Re: Phase change problem: error log
:
:
:
: On Mon, 10 May 1999, Shaw Carruthers wrote:
:
: Nice!!!!!!!!!!!!!!!!!
:
: > sym53c860-0-<4,0>: phase change 2-3 6@0037ea45 resid=2.
: > sym53c860-0-<4,0>: ERROR: cmd=28 host_status=84 scsi_status=2
:
: Command is 28 which is a READ(10) but the CDB is reported as 6 bytes by
: the driver. It should be 10 bytes. If the ERROR refers to the
: phase change then something is really WRONG there and the device is
: right to complain and to destroy everything when it is unable to
: detect the problem. :-)
:
: > sym53c860-0-<4,0>: sense data: 70 0 5 0 0 0 0 18 0 0 0 0 24 0.
:
: 5 : means ILLEGAL REQUEST
: 24 0 : means INVALID FIELD IN CDB
:
: > attempt to access beyond end of device
: > 08:06: rw=0, want=226304033, limit=704907
:
: This may well be a bug in the SCSI code.
: The following Code seems suspicious to me (scsi_do_cmd()/scsi.c)
:
: if (SCpnt->cmd_len == 0)
: SCpnt->cmd_len = COMMAND_SIZE(SCpnt->cmnd[0]);
:
: If cmd_len is not zero for some reason, it will not be loaded with the
: right value of the CDB length.
:
: You may want to try this untested patch and let me know how it make
: differences:) . IMO, if it boots it has chance to fix.
: (against 2.2.7)
:
: --- linux/drivers/scsi/sd.c.orig Mon May 10 20:47:23 1999
: +++ linux/drivers/scsi/sd.c Mon May 10 20:49:45 1999
: @@ -1037,6 +1037,7 @@
:
: SCpnt->transfersize = rscsi_disks[dev].sector_size;
: SCpnt->underflow = this_count << 9;
: + SCpnt->cmd_len = 0;
: scsi_do_cmd (SCpnt, (void *) cmd, buff,
: this_count * rscsi_disks[dev].sector_size,
: rw_intr,
:
: Gérard.



On Mon, 10 May 1999, Rainer Clasen wrote:

> Hallo erstmal!
>
> On Sun, May 09, 1999 at 11:27:57PM +0200, Gerard Roudier wrote:
> > Basically, a target that detects a PARITY ERROR in COMMAND phase may elect
> > to switch to MESSAGE IN phase and send a RESTORE POINTERS message (that
> > will have the effect of a no-op), and then enter again the COMMAND phase
> > (this behaviour may explain 'phase change 2-7' driver messages)
> >
> > After some exhausted number of retries, the target may switch to STATUS
> > phase and report CHECK CONDITION with sense 'ABORTED COMMAND'.
> > (this behaviour may explain 'phase change 2-3' driver messages.
>
> But usually the phase changes appear in the reverse order. There is only one
> 2-3 phase change and the number of 2-7 messages varies. I've seen 0 to 10 of
> them.
>
> > Could you boot your system using the following boot options:
> > sym53c8xx=debug:0x10
>
> did this as module:
> modprobe sym53c8xx sym53c8xx="verb:y debug:0x10"
>
> here's the syslog:
>
> May 10 19:25:46 trans kernel: sym53c8xx: setup=disc:y,specf:3,ultra:2,tags:8,sync:12,burst:7,wide:y,diff:0,revprob:n,buschk:0x1
> May 10 19:25:46 trans kernel: sym53c8xx: setup=mpar:y,spar:y,fsn=n,verb:2,debug:0x0,led:n,settle:2,irqm:0x0,nvram:0x1,pcifix:0x0
> May 10 19:25:46 trans kernel: sym53c8xx: at PCI bus 0, device 8, function 0
> May 10 19:25:46 trans kernel: sym53c8xx: setting PCI_COMMAND_PARITY...(fix-up)
> May 10 19:25:46 trans kernel: sym53c8xx: 53c810a detected
> May 10 19:25:46 trans kernel: sym53c810a-0: rev=0x23, base=0xe1002000, io_port=0x6400, irq=15
> May 10 19:25:46 trans kernel: sym53c810a-0: using memory mapped IO
> May 10 19:25:46 trans kernel: sym53c810a-0: ID 7, Fast-10, Parity Checking
> May 10 19:25:46 trans kernel: sym53c810a-0: initial SCNTL3/DMODE/DCNTL/CTEST3/4/5 = (hex) 03/8e/a0/01/00/00
> May 10 19:25:46 trans kernel: sym53c810a-0: final SCNTL3/DMODE/DCNTL/CTEST3/4/5 = (hex) 03/ce/a0/00/08/00
> May 10 19:25:46 trans kernel: sym53c810a-0: resetting, command processing suspended for 2 seconds
> May 10 19:25:46 trans kernel: sym53c810a-0: restart (scsi reset).
> May 10 19:25:46 trans kernel: scsi1 : sym53c8xx - version 1.3c
> May 10 19:25:46 trans kernel: scsi : 2 hosts.
> May 10 19:25:48 trans kernel: sym53c810a-0: command processing resumed
> May 10 19:25:49 trans kernel: Vendor: IBM Model: DDRS-34560 Rev: S97B
> May 10 19:25:49 trans kernel: Type: Direct-Access ANSI SCSI revision: 02
> May 10 19:25:49 trans kernel: Detected scsi disk sdc at scsi1, channel 0, id 1, lun 0
> May 10 19:25:49 trans kernel: Vendor: YAMAHA Model: CDR102 Rev: 1.01
> May 10 19:25:49 trans kernel: Type: WORM ANSI SCSI revision: 02
> May 10 19:25:51 trans kernel: sym53c810a-0-<1,0>: tagged command queue depth set to 8
> May 10 19:25:51 trans kernel: sym53c810a-0-<1,*>: FAST-10 SCSI 10.0 MB/s (100 ns, offset 8)
> May 10 19:25:51 trans kernel: SCSI device sdc: hdwr sector= 512 bytes. Sectors= 8925000 [4357 MB] [4.4 GB]
> May 10 19:25:51 trans kernel: sdc: sdc1 < sdc5 >
> May 10 19:28:04 trans kernel: sym53c810a-0: detaching ...
> May 10 19:28:04 trans kernel: sym53c810a-0: resetting chip
> May 10 19:28:04 trans kernel: scsi : 1 host.
> May 10 19:28:09 trans kernel: sym53c8xx_setup: unexpected boot option 'debug=0x10 verb:' ignored
> May 10 19:28:09 trans kernel: sym53c8xx: setup=disc:y,specf:3,ultra:2,tags:8,sync:12,burst:7,wide:y,diff:0,revprob:n,buschk:0x1
> May 10 19:28:09 trans kernel: sym53c8xx: setup=mpar:y,spar:y,fsn=n,verb:2,debug:0x0,led:n,settle:2,irqm:0x0,nvram:0x1,pcifix:0x0
> May 10 19:28:09 trans kernel: sym53c8xx: at PCI bus 0, device 8, function 0
> May 10 19:28:09 trans kernel: sym53c8xx: 53c810a detected
> May 10 19:28:09 trans kernel: sym53c810a-0: rev=0x23, base=0xe1002000, io_port=0x6400, irq=15
> May 10 19:28:09 trans kernel: sym53c810a-0: using memory mapped IO
> May 10 19:28:09 trans kernel: sym53c810a-0: ID 7, Fast-10, Parity Checking
> May 10 19:28:09 trans kernel: sym53c810a-0: initial SCNTL3/DMODE/DCNTL/CTEST3/4/5 = (hex) 03/8e/a0/01/00/00
> May 10 19:28:09 trans kernel: sym53c810a-0: final SCNTL3/DMODE/DCNTL/CTEST3/4/5 = (hex) 03/ce/a0/00/08/00
> May 10 19:28:09 trans kernel: sym53c810a-0: resetting, command processing suspended for 2 seconds
> May 10 19:28:09 trans kernel: sym53c810a-0: restart (scsi reset).
> May 10 19:28:09 trans kernel: scsi1 : sym53c8xx - version 1.3c
> May 10 19:28:09 trans kernel: scsi : 2 hosts.
> May 10 19:28:11 trans kernel: sym53c810a-0: command processing resumed
> May 10 19:28:11 trans kernel: Vendor: IBM Model: DDRS-34560 Rev: S97B
> May 10 19:28:11 trans kernel: Type: Direct-Access ANSI SCSI revision: 02
> May 10 19:28:11 trans kernel: Detected scsi disk sdc at scsi1, channel 0, id 1, lun 0
> May 10 19:28:11 trans kernel: Vendor: YAMAHA Model: CDR102 Rev: 1.01
> May 10 19:28:11 trans kernel: Type: WORM ANSI SCSI revision: 02
> May 10 19:28:14 trans kernel: sym53c810a-0-<1,0>: tagged command queue depth set to 8
> May 10 19:28:14 trans kernel: sym53c810a-0-<1,*>: FAST-10 SCSI 10.0 MB/s (100 ns, offset 8)
> May 10 19:28:14 trans kernel: SCSI device sdc: hdwr sector= 512 bytes. Sectors= 8925000 [4357 MB] [4.4 GB]
> May 10 19:28:14 trans kernel: sdc: sdc1 < sdc5 >
> May 10 19:28:56 trans kernel: sym53c810a-0: detaching ...
> May 10 19:28:56 trans kernel: sym53c810a-0: resetting chip
> May 10 19:28:56 trans kernel: scsi : 1 host.
> May 10 19:29:13 trans kernel: sym53c8xx: setup=disc:y,specf:3,ultra:2,tags:8,sync:12,burst:7,wide:y,diff:0,revprob:n,buschk:0x1
> May 10 19:29:13 trans kernel: sym53c8xx: setup=mpar:y,spar:y,fsn=n,verb:2,debug:0x10,led:n,settle:2,irqm:0x0,nvram:0x1,pcifix:0x0
> May 10 19:29:13 trans kernel: sym53c8xx: at PCI bus 0, device 8, function 0
> May 10 19:29:13 trans kernel: sym53c8xx: 53c810a detected
> May 10 19:29:13 trans kernel: sym53c810a-0: rev=0x23, base=0xe1002000, io_port=0x6400, irq=15
> May 10 19:29:13 trans kernel: sym53c810a-0: using memory mapped IO
> May 10 19:29:13 trans kernel: sym53c810a-0: ID 7, Fast-10, Parity Checking
> May 10 19:29:13 trans kernel: sym53c810a-0: initial SCNTL3/DMODE/DCNTL/CTEST3/4/5 = (hex) 03/8e/a0/01/00/00
> May 10 19:29:13 trans kernel: sym53c810a-0: final SCNTL3/DMODE/DCNTL/CTEST3/4/5 = (hex) 03/ce/a0/00/08/00
> May 10 19:29:13 trans kernel: sym53c810a-0: resetting, command processing suspended for 2 seconds
> May 10 19:29:13 trans kernel: sym53c810a-0: restart (scsi reset).
> May 10 19:29:13 trans kernel: scsi1 : sym53c8xx - version 1.3c
> May 10 19:29:13 trans kernel: scsi : 2 hosts.
> May 10 19:29:15 trans kernel: sym53c810a-0: command processing resumed
> May 10 19:29:15 trans kernel: sym53c810a-0-<0,0>: ERROR: cmd=0 host_status=85 scsi_status=ff
> May 10 19:29:16 trans kernel: sym53c810a-0-<0,0>: ERROR: cmd=0 host_status=85 scsi_status=ff
> May 10 19:29:16 trans kernel: sym53c810a-0-<1,0>: ERROR: cmd=0 host_status=84 scsi_status=2
> May 10 19:29:16 trans kernel: sym53c810a-0-<1,0>: sense data: 70 0 6 0 0 0 0 18 0 0 0 0 29 0.
> May 10 19:29:16 trans kernel: Vendor: IBM Model: DDRS-34560 Rev: S97B
> May 10 19:29:16 trans kernel: Type: Direct-Access ANSI SCSI revision: 02
> May 10 19:29:16 trans kernel: Detected scsi disk sdc at scsi1, channel 0, id 1, lun 0
> May 10 19:29:16 trans kernel: sym53c810a-0-<1,1>: ERROR: cmd=0 host_status=84 scsi_status=2
> May 10 19:29:16 trans kernel: sym53c810a-0-<1,1>: sense data: 70 0 5 0 0 0 0 18 0 0 0 0 25 0.
> May 10 19:29:16 trans kernel: sym53c810a-0-<1,2>: ERROR: cmd=0 host_status=84 scsi_status=2
> May 10 19:29:16 trans kernel: sym53c810a-0-<1,2>: sense data: 70 0 5 0 0 0 0 18 0 0 0 0 25 0.
> May 10 19:29:16 trans kernel: sym53c810a-0-<1,3>: ERROR: cmd=0 host_status=84 scsi_status=2
> May 10 19:29:16 trans kernel: sym53c810a-0-<1,3>: sense data: 70 0 5 0 0 0 0 18 0 0 0 0 25 0.
> May 10 19:29:16 trans kernel: sym53c810a-0-<1,4>: ERROR: cmd=0 host_status=84 scsi_status=2
> May 10 19:29:16 trans kernel: sym53c810a-0-<1,4>: sense data: 70 0 5 0 0 0 0 18 0 0 0 0 25 0.
> May 10 19:29:16 trans kernel: sym53c810a-0-<1,5>: ERROR: cmd=0 host_status=84 scsi_status=2
> May 10 19:29:16 trans kernel: sym53c810a-0-<1,5>: sense data: 70 0 5 0 0 0 0 18 0 0 0 0 25 0.
> May 10 19:29:16 trans kernel: sym53c810a-0-<1,6>: ERROR: cmd=0 host_status=84 scsi_status=2
> May 10 19:29:16 trans kernel: sym53c810a-0-<1,6>: sense data: 70 0 5 0 0 0 0 18 0 0 0 0 25 0.
> May 10 19:29:16 trans kernel: sym53c810a-0-<1,7>: ERROR: cmd=0 host_status=84 scsi_status=2
> May 10 19:29:16 trans kernel: sym53c810a-0-<1,7>: sense data: 70 0 5 0 0 0 0 18 0 0 0 0 25 0.
> May 10 19:29:16 trans kernel: sym53c810a-0-<2,0>: ERROR: cmd=0 host_status=84 scsi_status=2
> May 10 19:29:16 trans kernel: sym53c810a-0-<2,0>: sense data: 70 0 6 0 0 0 0 a 0 0 0 0 29 0.
> May 10 19:29:16 trans kernel: Vendor: YAMAHA Model: CDR102 Rev: 1.01
> May 10 19:29:16 trans kernel: Type: WORM ANSI SCSI revision: 02
> May 10 19:29:16 trans kernel: sym53c810a-0-<3,0>: ERROR: cmd=0 host_status=85 scsi_status=ff
> May 10 19:29:16 trans kernel: sym53c810a-0-<3,0>: ERROR: cmd=0 host_status=85 scsi_status=ff
> May 10 19:29:17 trans kernel: sym53c810a-0-<4,0>: ERROR: cmd=0 host_status=85 scsi_status=ff
> May 10 19:29:17 trans kernel: sym53c810a-0-<4,0>: ERROR: cmd=0 host_status=85 scsi_status=ff
> May 10 19:29:17 trans kernel: sym53c810a-0-<5,0>: ERROR: cmd=0 host_status=85 scsi_status=ff
> May 10 19:29:17 trans kernel: sym53c810a-0-<5,0>: ERROR: cmd=0 host_status=85 scsi_status=ff
> May 10 19:29:18 trans kernel: sym53c810a-0-<6,0>: ERROR: cmd=0 host_status=85 scsi_status=ff
> May 10 19:29:18 trans kernel: sym53c810a-0-<6,0>: ERROR: cmd=0 host_status=85 scsi_status=ff
> May 10 19:29:18 trans kernel: sym53c810a-0-<1,0>: tagged command queue depth set to 8
> May 10 19:29:18 trans kernel: sym53c810a-0-<1,*>: FAST-10 SCSI 10.0 MB/s (100 ns, offset 8)
> May 10 19:29:18 trans kernel: SCSI device sdc: hdwr sector= 512 bytes. Sectors= 8925000 [4357 MB] [4.4 GB]
> May 10 19:29:18 trans kernel: sdc: sdc1 < sdc5 >
> May 10 19:37:31 trans kernel: sym53c810a-0-<1,0>: phase change 2-3 6@04a55045 resid=2.
> May 10 19:37:31 trans kernel: sym53c810a-0-<1,0>: ERROR: cmd=2a host_status=84 scsi_status=2
> May 10 19:37:31 trans kernel: sym53c810a-0-<1,0>: sense data: 70 0 5 0 0 0 0 18 0 0 0 0 24 0.
> May 10 19:37:31 trans kernel: sym53c810a-0-<1,0>: phase change 2-7 10@04a55645 resid=4.
> May 10 19:37:31 trans kernel: sym53c810a-0-<1,0>: phase change 2-7 10@04a55a45 resid=4.
> May 10 19:37:31 trans kernel: sym53c810a-0-<1,0>: phase change 2-7 10@00dffe45 resid=4.
> May 10 19:37:31 trans kernel: sym53c810a-0-<1,0>: phase change 2-7 10@04a55445 resid=4.
> May 10 19:40:00 trans /USR/SBIN/CRON[664]: (root) CMD (test -f /proc/modules && /sbin/rmmod -a)
> May 10 19:47:14 trans kernel: Filesystem panic (dev 08:25).
> May 10 19:47:15 trans kernel: File without EOF
> May 10 19:47:15 trans kernel: File system has been set read-only
> May 10 19:47:15 trans kernel: FAT: fat_truncate called though fs is read-only, uhh...
>
> As you may see, I switched back to non-simplified SCSI-cabling. It didn't
> matter anyway. Now it looks like:
>
> + NCR 810A with passive onboard termination
> |
> - HD-DSub50 - Centronics Adapter
> |
> | external cable (50 cm) (a flat one as used for internal cablings)
> |
> --+ external SCSI tower (with ~40cm cable total)
> |
> + DDRS
> |
> + Yamaha recorder
> |
> <-+
> external, active Centronics terminator
>
> Rainer
>
> --
> KeyID=58341901 fingerprint=A5 57 04 B3 69 88 A1 FB 78 1D B5 64 E0 BF 72 EB
>
>
>

\
 
 \ /
  Last update: 2005-03-22 13:52    [W:0.031 / U:0.400 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site