Highlighted
Absent Member.
Absent Member.
2831 views

Nw6.5Sp8 CIFS / Win 7 / Abend

Hi All,

We have enabled our OES / Netware 6.5 SP8+ fleet of servers with CIFS access.

Since then, accessing via a Win 7 Sp1 x64 client hangs then abends the server intermittently when someone types in just the (CIFS) server name in Windows Explorer. i.e. when the server is asked to provide a list of shares.
The servers we are seeing this primarily on have 12 volumes.


Our servers are all running on VMware ESXi 5.1u2 and the CPU consumed pegs 100% when the fault starts.
The Netware server becomes unresponsive then abends. Unfortunately the first abend recorded in abend.log is abend 3 with what appears to be an NSS spinlock condition (for what that is worth).
I assume that the first abend will be a CPU Hog timeout going by the delay before the abend.


The CIFS config is a Workgroup, Local Auth (edir), export all volumes, Oplocks off, DFS on (required by us), SMB signing disabled.

Our Group Policy allows Win7 to not require signing (allow lower LM versions)

We have the following relevant patches on the servers:
MM65SP8a
N65nss8c
edir885
edir 885 Patch 6

Anyone know we stop this happening ?

Cheers
Ian
Labels (1)
0 Likes
13 Replies
Highlighted
Absent Member.
Absent Member.

You have the last ever public patch for CIFS.nlm . I believe there are one or two later field test versions, but you have to log a call with NTS to get them. Without the abend log we can't tell if they will likely address your specific issue though.

Andrew C Taubman (Sorry, support is not provided via e-mail) Opinions expressed above are not necessarily those of Micro Focus.
0 Likes
Highlighted
Visitor.

Post the abend log even if you do not get the initial abend / break.

Also, if the VM is configured with multiple cores, either dumb it down to a single CPU and reboot ( which you have to do to change the VM config anyway ) or if you can't tolerate the down time, issue a STOP PROCESSORS on the NetWare console, safe to do, it doesn't stop all of them 😉 This will dumb down the server to a single processor. This may avoid certain deadlocks which require multiple cores.

If you happen to catch the server in the middle of hanging, you can issue a NMI, which will break the server in the middle of the loop. This can help identify the code point which is the problem. This can be done from the ESX root prompt using /sbin/vmdumper world_id_of_guest nmi you should google around as to the proper usage, its been a while since i had to do this.

I see very few CIFS abends which are not supposedly resolved in the code you have. However the abend log will include modules listing, which may show something. The register / stack dump may also show what path is being accessed.

-- Bob
0 Likes
Highlighted
Absent Member.
Absent Member.

Hi Andrew,

Yeah and I also spotted the NICI update that prevented a abend when CIFS got stuck in the NICI code - hence the edir885 install.

My last attempt to get the FTF netted me a version date stamped OLDER then nss B patch....

Do you think if I turn off abend recovery I might get a proper log ?

Cheers
Ian
0 Likes
Highlighted
Visitor.

Oh, and yes, triggering an NMI WILL abend the guest. Guest fall down, go boom. But you should get an abend in the middle of the problem.

-- Bob
0 Likes
Highlighted
Absent Member.
Absent Member.

Under VMware the Netware template only allows one vCPU in any case. 🙂 So no SMP or hyperthreading.

I am trying to reproduce on a non-critical server rather than a highly used production host !

Have turned Auto restart After Abend to 0 so we will see if that helps getting a clean abend.log.

I'll bear the "virtual NMI button" trick in mind. Thanks.

Cheers
Ian
0 Likes
Highlighted
Knowledge Partner
Knowledge Partner

Am 30.09.2014 03:36, schrieb iblackwood:
>
> My last attempt to get the FTF netted me a version date stamped OLDER
> then nss B patch....


That may sound strange, but it correct if I recall correctly. There was
a vital CIFS released before nssB patch, but it is *NOT* included in the
public nss B patch.


CU,
--
Massimo Rosen
Novell Knowledge Partner
No emails please!
http://www.cfc-it.de
CU,
--
Massimo Rosen
Micro Focus Knowledge Partner
No emails please!
http://www.cfc-it.de
0 Likes
Highlighted
Absent Member.
Absent Member.

Hi Massimo,

Doesn't sound strange at all. 🙂

The FTF I was after at the time had the fix that stopped Windows Explorer hanging when traversing folders. I quoted the defect number to get it.

I *hope* that fix is in the nss C patch.

Update: I am also testing to see if I define all the shares/volumes instead of leaving the list blank (share all mounted volume) is a possible workaround. I suspect some sort of deadlock whilst CIFS is waiting on NSS/MM to supply a list of volumes to enumerate as shares.

Of course it won't fail since I changed the abend settings. Obviously waiting for critical time dependent end of month processing work to start (a.k.a. people doing the paperwork they have put off for a month).

Cheers
Ian
0 Likes
Highlighted
Absent Member.
Absent Member.

Researching the various CIFS.NLM shows the following:

1. nss8b - CIFS 3.27.02 dated 11 November 2009 - has explorer hang issue
2. FTF - CIFS 3.27.02 (blind rev) dated 5th March 2010 - has bug 580964 fixed - this is the explorer hang issue. I believe this is also TID 7006763 (September 2010) although no bug number is listed.
3. nss8c - CIFS 3.27.03 dated 7th June 2010 - has explorer hang issue again !

Attempting to load the FTF with nss8c patch installed fails with a version check on the CIFS module. NWConfig doesn't let you uninstall nss8c. Sigh...

Reinstalling nss8b patch, then the FTF and then reboot to reload the older NSS code is required. Of course this doesn't remove the product record for the nss8c patch from nwconfig but I won't be connecting with btrieve to manual remove it !

Since nss8c has "1. Fixed a security problem with a pre-authentication vulnerability in CIFS.NLM that causes the server to abend." it would be nice to have both fixes. 🙂

Of course this doesn't address the abend issue I am seeing with nss8c, but I may be able to workaround that. Bug 580964 cannot be worked around and makes the nss8c patch unusable.

Any info on to confirm whether an FTF exists nss8c with the 580964 fix would be greatly appreciated. Last incident I got what I asked for (fix for specific bug) but not the latest and greatest FTF (I hope !).

Update: Hamish mentioned in another thread that one exists dated 2/2/2011. Am investigating...

Cheers
Ian
0 Likes
Highlighted
Absent Member.
Absent Member.

Changing the Abend Restart setting to zero allowed me to see that we are getting a:
Page Fault Processor Exception (Error Code 00000000)
...problem executing code in CIFS.NLM or passed to it by Server.nlm

Unfortunately servicedesk staff decided to power off at that point instead of update abend.log and then exit.

They have been suitably ribbed for not reading the message on the screen - but at least they took a screen shot.

Cheers
Ian
0 Likes
Highlighted
Absent Member.
Absent Member.

That defect has a cifs.nlm attached 3.27.03 - 20100607 . So it's not the absolute last one ever, but ought to fix this bug.

The last ever cifs.nlm appears to be attached to defect 735400 and is dated December 2011.

Andrew C Taubman (Sorry, support is not provided via e-mail) Opinions expressed above are not necessarily those of Micro Focus.
0 Likes
Highlighted
Visitor.

iblackwood;2335297 wrote:
Changing the Abend Restart setting to zero allowed me to see that we are getting a:
Page Fault Processor Exception (Error Code 00000000)
...problem executing code in CIFS.NLM or passed to it by Server.nlm

Unfortunately servicedesk staff decided to power off at that point instead of update abend.log and then exit.


Oy Vez! Better luck next time.... and regrettably there will be a next time?

-- Bob
0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.