From owner-freebsd-current@FreeBSD.ORG Sun Jul 3 00:38:10 2005 Return-Path: X-Original-To: current@freebsd.org Delivered-To: freebsd-current@FreeBSD.ORG Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id E6B6316A4C1; Sun, 3 Jul 2005 00:37:38 +0000 (GMT) (envelope-from ps@mu.org) Received: from elvis.mu.org (elvis.mu.org [192.203.228.196]) by mx1.FreeBSD.org (Postfix) with ESMTP id 032734447B; Sun, 3 Jul 2005 00:21:15 +0000 (GMT) (envelope-from ps@mu.org) Received: by elvis.mu.org (Postfix, from userid 1000) id 023F8624B0; Sat, 2 Jul 2005 17:20:05 -0700 (PDT) X-Original-To: ps@mu.org Delivered-To: ps@mu.org Received: from mx2.freebsd.org (mx2.freebsd.org [216.136.204.119]) by elvis.mu.org (Postfix) with ESMTP id 083B95C990 for ; Sun, 27 Feb 2005 11:56:50 -0800 (PST) Received: from hub.freebsd.org (hub.freebsd.org [216.136.204.18]) by mx2.freebsd.org (Postfix) with ESMTP id 3EEDB568B6; Sun, 27 Feb 2005 19:56:35 +0000 (GMT) (envelope-from owner-freebsd-stable@freebsd.org) Received: from hub.freebsd.org (localhost [127.0.0.1]) by hub.freebsd.org (Postfix) with ESMTP id C2B3B16A4D8; Sun, 27 Feb 2005 19:56:33 +0000 (GMT) Delivered-To: freebsd-stable@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id A7CB116A4CE; Sun, 27 Feb 2005 19:56:29 +0000 (GMT) Received: from ylpvm15.prodigy.net (ylpvm15-ext.prodigy.net [207.115.57.46]) by mx1.FreeBSD.org (Postfix) with ESMTP id 381F343D2D; Sun, 27 Feb 2005 19:56:29 +0000 (GMT) (envelope-from nate@root.org) Received: from [10.0.0.115] (adsl-64-171-186-189.dsl.snfc21.pacbell.net [64.171.186.189])j1RJqDki021146; Sun, 27 Feb 2005 14:52:13 -0500 Message-ID: <422225D6.5020009@root.org> From: Nate Lawson User-Agent: Mozilla Thunderbird 1.0RC1 (X11/20041205) X-Accept-Language: en-us, en MIME-Version: 1.0 To: current@freebsd.org Content-Type: multipart/mixed; boundary="------------090503090002020109050805" X-BeenThere: freebsd-stable@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list Sender: owner-freebsd-stable@freebsd.org Errors-To: owner-freebsd-stable@freebsd.org X-Spam-Checker-Version: SpamAssassin 3.0.2 (2004-11-16) on elvis.mu.org X-Spam-Status: No, score=-2.5 required=5.0 tests=AWL,BAYES_00 autolearn=ham version=3.0.2 X-Spam-Level: Cc: stable@freebsd.org Subject: patch: fix ata panic with Thinkpad CD and DVD drives X-BeenThere: freebsd-current@freebsd.org List-Id: Discussions about the use of FreeBSD-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Date: Sun, 03 Jul 2005 00:38:12 -0000 X-Original-Date: Sun, 27 Feb 2005 11:56:06 -0800 X-List-Received-Date: Sun, 03 Jul 2005 00:38:12 -0000 This is a multi-part message in MIME format. --------------090503090002020109050805 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit If you've been having "memory modified after free" panics on -current and have a Thinkpad, the attached patch should fix things for you. A quick check of RELENG_5 indicates that the bug is probably there also but I haven't tested for it there. The bug is triggered by timeouts in the ata_getparam() probe path. The ata_timeout() fires and ata_end_transaction() is called to get the status. However, it continues down into ata_pio_read() even though there is no data available since we had a timeout, not read completion. ata_pio_read() reads 512 bytes of probably bogus data. The important problem is that it also advances donecount. On subsequent timeouts (note there are 4 below), donecount advances into unallocated memory and so subsequent ata_pio_read() calls overwrite 512 bytes of someone else's memory. The fix is to exit immediately if ATA_R_TIMEOUT is set after reading the status in ata_end_transaction(). It shouldn't go into ata_pio_read() if there was a timeout. The patch does this. However, it only handles PIO timeouts since I wasn't sure the best way to proceed for unwinding DMA state and the like for the other cases. This is enough to fix the overwrite and subsequent panic on my systems. I've run heavy IO stress and DVD accesses for a while and no further panics. While looking into this, I found another potential problem. In one reinjection case, donecount wasn't reset to 0. The patch for ata-queue.c does this and I think it's necessary but don't hit this case in testing so I can't be sure. Finally, there's one whitespace nit that helps with clarity. These are similar bugs to one found back in August that had the same effect. Here's the closest reference I could find in the mail archives for this: http://lists.freebsd.org/mailman/htdig/freebsd-current/2004-August/033033.html Please fix this before 5.4-R, thanks. Here is the hardware in question. This bug is triggered by various CD, DVD, CDRW, etc. drives shipped with Thinkpads. atapci0: port 0x1860-0x186f,0x376,0x170-0x177,0x3f6,0x1f0-0x1f7 at device 31.1 on pci0 ata0: channel #0 on atapci0 ata1: channel #1 on atapci0 ad0: 19077MB [41344/15/63] at ata0-master UDMA100 ata1-slave: FAILURE - ATAPI_IDENTIFY timed out ata1-slave: FAILURE - ATAPI_IDENTIFY timed out ata1-slave: FAILURE - ATAPI_IDENTIFY timed out ata1-slave: FAILURE - ATAPI_IDENTIFY timed out acd0: FAILURE - SETFEATURES SET TRANSFER MODE timed out acd0: DVDROM at ata1-master UDMA33 -- Nate --------------090503090002020109050805 Content-Type: text/plain; name="ata_panic.diff" Content-Transfer-Encoding: 7bit Content-Disposition: inline; filename="ata_panic.diff" Index: sys/dev/ata/ata-lowlevel.c =================================================================== RCS file: /home/ncvs/src/sys/dev/ata/ata-lowlevel.c,v retrieving revision 1.51 diff -u -r1.51 ata-lowlevel.c --- sys/dev/ata/ata-lowlevel.c 24 Dec 2004 13:38:25 -0000 1.51 +++ sys/dev/ata/ata-lowlevel.c 27 Feb 2005 19:23:09 -0000 @@ -297,6 +297,9 @@ /* ATA PIO data transfer and control commands */ default: + /* XXX Doesn't handle the non-PIO case. */ + if (request->flags & ATA_R_TIMEOUT) + return ATA_OP_FINISHED; /* on control commands read back registers to the request struct */ if (request->flags & ATA_R_CONTROL) { @@ -321,7 +324,7 @@ ata_pio_read(request, request->transfersize); /* update how far we've gotten */ - request->donecount += request->transfersize; + request->donecount += request->transfersize; /* do we need a scoop more ? */ if (request->bytecount > request->donecount) { Index: sys/dev/ata/ata-queue.c =================================================================== RCS file: /home/ncvs/src/sys/dev/ata/ata-queue.c,v retrieving revision 1.41 diff -u -r1.41 ata-queue.c --- sys/dev/ata/ata-queue.c 8 Dec 2004 11:16:33 -0000 1.41 +++ sys/dev/ata/ata-queue.c 27 Feb 2005 19:22:16 -0000 @@ -249,6 +249,7 @@ && request->device->param){ request->flags &= ~(ATA_R_TIMEOUT | ATA_R_DEBUG); request->flags |= (ATA_R_IMMEDIATE | ATA_R_REQUEUE); + request->donecount = 0; ATA_DEBUG_RQ(request, "completed reinject"); ata_queue_request(request); return; --------------090503090002020109050805 Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ freebsd-stable@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-stable To unsubscribe, send any mail to "freebsd-stable-unsubscribe@freebsd.org" --------------090503090002020109050805--