kern/42375: ahd driver uses wrong mask if CND-queuing failed

[Wolfgang.Stukenbrock%nagler-company.com@localhost]

>Number:         42375
>Category:       kern
>Synopsis:       ahd driver uses wrong mask if CND-queuing failed
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Wed Nov 25 10:55:00 +0000 2009
>Originator:     W. Stukenbrock
>Release:        NetBSD 4.0
>Organization:
Dr. Nagler & Company GmbH
        
>Environment:
        
        
System: NetBSD test-s0 4.0 NetBSD 4.0 (NSW-WS) #2: Fri Nov 6 11:14:49 CET 2009 
wgstuken@s012:/export/NetBSD-4.0/N+C-build/.OBJDIR_amd64/export/NetBSD-4.0/src/sys/arch/amd64/compile/NSW-WS
 amd64
Architecture: x86_64
Machine: amd64
>Description:
        If a device rejects comamnd-queing as requested by the host,
        the fallback switching code in the ahd driver is broken.
        It checks the control byte with the simple-queue mask (this is not
        100% OK, but it would work ...) and than tries to check the tag_type
        if it it is simple queuing or something more sofisticated.
        If it was only simple it will turn of cmd-queuing for that device,
        otherwiese the driver next tries simple queuing mode.
        Here is the bug: while masking the relevant bits, some bits are
        lost.
>How-To-Repeat:
        Found by a look into the source.
        It would happen if someone setup a device to use an advanced queing
        mode, but that device does not support it.
>Fix:
        The problem is located in /usr/src/sys/dev/ic/aic79xx.c.
        The following patch will fix this problem:

--- aic79xx.c   2008/09/26 11:28:03     1.2
+++ aic79xx.c   2009/11/25 10:10:13
@@ -4672,11 +4672,16 @@
                       "Using asynchronous transfers\n",
                       ahd_name(ahd), devinfo->channel,
                       devinfo->target, devinfo->lun);
-       } else if ((scb->hscb->control & MSG_SIMPLE_TASK) != 0) {
+       } else if ((scb->hscb->control & 0x23) != 0) {
+/* remark: cannot use MSG_SIMPLE_TASK here - other bits are also needed
+ *         the mask 0x23 is used below - so use it here too
+ *
+ * W. Stukenbrock 25.11.2009
+ */
                int tag_type;
                int mask;
 
-               tag_type = (scb->hscb->control & MSG_SIMPLE_TASK);
+               tag_type = (scb->hscb->control & 0x23);
 
                if (tag_type == MSG_SIMPLE_TASK) {
                        printf("(%s:%c:%d:%d): refuses tagged commands.  "

>Unformatted: