From javier@aurora.diatel.upm.es Fri Apr 16 03:51:08 1999
Return-Path: <javier@aurora.diatel.upm.es>
Received: from aurora.diatel.upm.es (aurora.diatel.upm.es [138.100.49.70])
	by hub.freebsd.org (Postfix) with ESMTP id C84C2153E0
	for <FreeBSD-gnats-submit@freebsd.org>; Fri, 16 Apr 1999 03:50:23 -0700 (PDT)
	(envelope-from javier@aurora.diatel.upm.es)
Received: (from javier@localhost)
	by aurora.diatel.upm.es (8.9.2/8.8.5) id MAA00483;
	Fri, 16 Apr 1999 12:47:51 +0200 (CEST)
Message-Id: <199904161047.MAA00483@aurora.diatel.upm.es>
Date: Fri, 16 Apr 1999 12:47:51 +0200 (CEST)
From: jmrueda@diatel.upm.es
Sender: javier@aurora.diatel.upm.es
Reply-To: jmrueda@diatel.upm.es
To: FreeBSD-gnats-submit@freebsd.org
Subject: ie network driver panics with less than 16KB on NIC
X-Send-Pr-Version: 3.2

>Number:         11164
>Category:       kern
>Synopsis:       The ie network driver panics during the initialization if the card has less than 16 KB of RAM on-board
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    freebsd-bugs
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Fri Apr 16 03:50:00 PDT 1999
>Closed-Date:    Fri Mar 10 03:11:58 PST 2000
>Last-Modified:  Fri Mar 10 03:12:23 PST 2000
>Originator:     Javier Martn Rueda
>Release:        FreeBSD 3.1-RELEASE i386
>Organization:
Dpto. DIATEL, Universidad Politcnica de Madrid
>Environment:

Any card that uses the ie driver and has less than 16 KB of RAM. In
my particular case, I was using a NI5210 with 8 KB.
	

>Description:

	

>How-To-Repeat:

Boot, and it will crash as soon as you attempt an ifconfig with the card.
	

>Fix:
	
	
The problem is that the driver computes the size of several tables with
the assumption that the card has at least 16 KB of RAM. When that is not
true, some of the tables have zero length, and so the indexes overflow,
causing a kernel panic at initialization time.

I enclose a patch that computes those sizes for any amount of memory:


*** if_ie.c.orig	Thu Dec 10 02:49:49 1998
--- if_ie.c	Fri Apr 16 14:25:54 1999
***************
*** 281,290 ****
  both transmit and receive buffers.
  */
  
  #define NFRAMES		8	/* number of receive frames */
  #define NRXBUFS		48	/* number of buffers to allocate */
- #define IE_RBUF_SIZE	256	/* size of each buffer, MUST BE POWER OF TWO */
  #define NTXBUFS		2	/* number of transmit commands */
  #define IE_TBUF_SIZE	ETHER_MAX_LEN	/* size of transmit buffer */
  
  /*
--- 281,293 ----
  both transmit and receive buffers.
  */
  
+ #ifdef NODEF
+ /* Now, these are computed on the fly. */
  #define NFRAMES		8	/* number of receive frames */
  #define NRXBUFS		48	/* number of buffers to allocate */
  #define NTXBUFS		2	/* number of transmit commands */
+ #endif
+ #define IE_RBUF_SIZE	256	/* size of each buffer, MUST BE POWER OF TWO */
  #define IE_TBUF_SIZE	ETHER_MAX_LEN	/* size of transmit buffer */
  
  /*
***************
*** 784,790 ****
  int
  ieattach(struct isa_device *dvp)
  {
- 	int	factor;
  	int	unit = dvp->id_unit;
  	struct ie_softc *ie = &ie_softc[unit];
  	struct ifnet *ifp = &ie->arpcom.ac_if;
--- 787,792 ----
***************
*** 796,805 ****
  	 * based on the amount of memory we have, allocate our tx and rx
  	 * resources.
  	 */
! 	factor = dvp->id_msize / 16384;
! 	ie->nframes = factor * NFRAMES;
! 	ie->nrxbufs = factor * NRXBUFS;
! 	ie->ntxbufs = factor * NTXBUFS;
  
  	/*
  	 * Since all of these guys are arrays of pointers, allocate as one
--- 798,808 ----
  	 * based on the amount of memory we have, allocate our tx and rx
  	 * resources.
  	 */
! 	ie->nframes = dvp->id_msize / 1024;
! 	ie->ntxbufs = dvp->id_msize / 8192;
! 	if (ie->ntxbufs == 0)
! 	  ie->ntxbufs = 1;
! 	ie->nrxbufs = (dvp->id_msize - 8 - 16 - ie->nframes * 24 - ie->ntxbufs * 1538) / (256 + 12);
  
  	/*
  	 * Since all of these guys are arrays of pointers, allocate as one

>Release-Note:
>Audit-Trail:
Responsible-Changed-From-To: gnats-admin->freebsd-bugs 
Responsible-Changed-By: steve 
Responsible-Changed-When: Sun Apr 18 21:23:52 PDT 1999 
Responsible-Changed-Why:  
Misfiled PR. 

From: "Ted Mittelstaedt" <tedm@toybox.placo.com>
To: <freebsd-gnats-submit@FreeBSD.org>, <jmrueda@diatel.upm.es>
Cc:  
Subject: Re: kern/11164: The ie network driver panics during the initialization if the card has less than 16 KB of RAM on-board
Date: Thu, 9 Mar 2000 23:18:43 -0800

 This PR should be attached to PR i386/16214
 
 Ted
 
State-Changed-From-To: open->closed 
State-Changed-By: sheldonh 
State-Changed-When: Fri Mar 10 03:11:58 PST 2000 
State-Changed-Why:  
Superseded by PR 16214. 
>Unformatted:
