From nobody@FreeBSD.org  Wed Jun  6 11:10:22 2007
Return-Path: <nobody@FreeBSD.org>
Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52])
	by hub.freebsd.org (Postfix) with ESMTP id 497DD16A46B
	for <freebsd-gnats-submit@FreeBSD.org>; Wed,  6 Jun 2007 11:10:22 +0000 (UTC)
	(envelope-from nobody@FreeBSD.org)
Received: from www.freebsd.org (www.freebsd.org [69.147.83.33])
	by mx1.freebsd.org (Postfix) with ESMTP id 3A89013C484
	for <freebsd-gnats-submit@FreeBSD.org>; Wed,  6 Jun 2007 11:10:22 +0000 (UTC)
	(envelope-from nobody@FreeBSD.org)
Received: from www.freebsd.org (localhost [127.0.0.1])
	by www.freebsd.org (8.13.1/8.13.1) with ESMTP id l56BALD6062880
	for <freebsd-gnats-submit@FreeBSD.org>; Wed, 6 Jun 2007 11:10:21 GMT
	(envelope-from nobody@www.freebsd.org)
Received: (from nobody@localhost)
	by www.freebsd.org (8.13.1/8.13.1/Submit) id l56BAL91062870;
	Wed, 6 Jun 2007 11:10:21 GMT
	(envelope-from nobody)
Message-Id: <200706061110.l56BAL91062870@www.freebsd.org>
Date: Wed, 6 Jun 2007 11:10:21 GMT
From: Richard Smith<rdls@satamatics.com>
To: freebsd-gnats-submit@FreeBSD.org
Subject: Page fault in XL0 device driver
X-Send-Pr-Version: www-3.0

>Number:         113406
>Category:       kern
>Synopsis:       [xl] Page fault in XL0 device driver (regression)
>Confidential:   no
>Severity:       serious
>Priority:       low
>Responsible:    freebsd-bugs
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Wed Jun 06 11:20:02 GMT 2007
>Closed-Date:    Thu Apr 24 09:46:54 UTC 2008
>Last-Modified:  Thu Apr 24 09:46:54 UTC 2008
>Originator:     Richard Smith
>Release:        6.2-RELEASE-p5
>Organization:
Satamatics Ltd
>Environment:
FreeBSD controller.satamatics.net 6.2-RELEASE-p5 FreeBSD 6.2-RELEASE-p5 #0: Fri Jun  1 23:39:24 UTC 2007     rdls@:/usr/obj/usr/src/sys/GENERIC  i386
>Description:
Installed device causing problem:
xl0: <3Com 3c900B-COMBO Etherlink XL> port 0xb800-0xb87f mem 0xefdfff80-0xefdfffff irq 10 at device 6.0 on pci2
xl0: selecting 10baseT transceiver, half duplex
xl0: Ethernet address: 00:50:da:43:bc:b4

Command causing problem:
ifconfig xl0 media 10base2/BNC

Full details of panic copied from the screen:
Fatal trap 12: page fault while in kernel mode
fault virtual address = 0x24
fault code = supervisor read, page not present
instruction pointer = 0x20:0xc0692dde
stack pointer = 0x28:0xd0a04c54
frame pointer = 0x28:0xd0a04c68
code segment = base 0x0, limit 0xfffff, type 0x1b
 = DPL 0, pres 1, def32 1, gran 1
processor eflags = resume, IOPL = 0
current process = 23 (irq10: rl0 xl0+)
trap number = 12
panic: page fault

Problem also appears in:
FreeBSD 6.2-RELEASE

Problem does NOT appear in:
FreeBSD 5.4-RELEASE
>How-To-Repeat:
Install a COMBO NIC (one supporting 10base2/BNC and 10baseT/UTP) for the
XL0 device driver and issue the following command:

ifconfig xl0 inet 10.1.1.1 netmask 255.255.255.0
ifconfig xl0 media 10base2/BNC

immediate panic

>Fix:
The only fix we currently have is to use an alternative OS version (e.g.
5.4-R) or an alternative combo card (e.g. we have combo cards using the
ed0 device that do not present a problem).


>Release-Note:
>Audit-Trail:
Responsible-Changed-From-To: freebsd-i386->freebsd-bin 
Responsible-Changed-By: linimon 
Responsible-Changed-When: Mon Jun 11 13:31:17 UTC 2007 
Responsible-Changed-Why:  
This does not sound i386-specific. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=113406 

From: NORCOTT381@aol.com
To: bug-followup@FreeBSD.org, rdls@satamatics.com
Cc:  
Subject: Re: kern/113406: [xl] Page fault in XL0 device driver (regression)
Date: Tue, 4 Sep 2007 14:51:34 EDT

 -------------------------------1188931894
 Content-Type: text/plain; charset="US-ASCII"
 Content-Transfer-Encoding: 7bit
 
 Hi, On my pc running the ifconfig command 2 times recreates the error. 
 Looking at the code in if_xl.c:
  
  
  
 static int
 xl_ifmedia_upd(struct ifnet *ifp)
 {
 struct xl_softc *sc  = ifp->if_softc;
 struct ifmedia *ifm = NULL;
 struct mii_data *mii =  NULL;
 
 XL_LOCK(sc);
 
 if (sc->xl_miibus != NULL)
 mii =  device_get_softc(sc->xl_miibus);
 if (mii == NULL)
 ifm =  &sc->ifmedia;
 else
 ifm = &mii->mii_media;
 
 switch  (IFM_SUBTYPE(ifm->ifm_media)) {
 case IFM_100_FX:
 case  IFM_10_FL:
 case IFM_10_2:
 case IFM_10_5:
 xl_setmode(sc,  ifm->ifm_media);
 return (0);    <---------- *** does not release lock  ****
 break;
 default:
 break;
 }
 
 if (sc->xl_media &  XL_MEDIAOPT_MII ||
 sc->xl_media & XL_MEDIAOPT_BTX  ||
 sc->xl_media & XL_MEDIAOPT_BT4)  {
 xl_init_locked(sc);
 } else {
 xl_setmode(sc,  ifm->ifm_media);
 }
 
 XL_UNLOCK(sc);
 
 return (0);
 }
 
 
 
 This return does not release the lock at the begining.
  
 I removed the 'return(0);' and the pc does not produce the error and allows  
 me to change the media.
  
 At the moment I cannot test the BNC part.
  
  
  
 pn.
 
 
 
    
 
 -------------------------------1188931894
 Content-Type: text/html; charset="US-ASCII"
 Content-Transfer-Encoding: quoted-printable
 
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
 <HTML><HEAD>
 <META http-equiv=3DContent-Type content=3D"text/html; charset=3DUS-ASCII">
 <META content=3D"MSHTML 6.00.2900.2963" name=3DGENERATOR></HEAD>
 <BODY id=3Drole_body style=3D"FONT-SIZE: 10pt; COLOR: #000000; FONT-FAMILY:=20=
 Arial"=20
 bottomMargin=3D7 leftMargin=3D7 topMargin=3D7 rightMargin=3D7><FONT id=3Drol=
 e_document=20
 face=3DArial color=3D#000000 size=3D2>
 <DIV>Hi, On my pc running the ifconfig command 2 times&nbsp;recreates the er=
 ror.=20
 </DIV>
 <DIV>Looking at the code&nbsp;in if_xl.c:</DIV>
 <DIV>&nbsp;</DIV>
 <DIV>&nbsp;</DIV>
 <DIV>&nbsp;</DIV>
 <DIV>static int<BR>xl_ifmedia_upd(struct ifnet *ifp)<BR>{<BR>struct xl_softc=
  *sc=20
 =3D ifp-&gt;if_softc;<BR>struct ifmedia *ifm =3D NULL;<BR>struct mii_data *m=
 ii =3D=20
 NULL;<BR><BR>XL_LOCK(sc);<BR><BR>if (sc-&gt;xl_miibus !=3D NULL)<BR>mii =3D=20
 device_get_softc(sc-&gt;xl_miibus);<BR>if (mii =3D=3D NULL)<BR>ifm =3D=20
 &amp;sc-&gt;ifmedia;<BR>else<BR>ifm =3D &amp;mii-&gt;mii_media;<BR><BR>switc=
 h=20
 (IFM_SUBTYPE(ifm-&gt;ifm_media)) {<BR>case IFM_100_FX:<BR>case=20
 IFM_10_FL:<BR>case IFM_10_2:<BR>case IFM_10_5:<BR>xl_setmode(sc,=20
 ifm-&gt;ifm_media);<BR><STRONG>return (0);</STRONG>&nbsp;&nbsp;=20
 &lt;----------&nbsp;*** does not release lock=20
 ****<BR>break;<BR>default:<BR>break;<BR>}<BR><BR>if (sc-&gt;xl_media &amp;=20
 XL_MEDIAOPT_MII ||<BR>&nbsp;&nbsp;&nbsp; sc-&gt;xl_media &amp; XL_MEDIAOPT_B=
 TX=20
 ||<BR>&nbsp;&nbsp;&nbsp; sc-&gt;xl_media &amp; XL_MEDIAOPT_BT4)=20
 {<BR>xl_init_locked(sc);<BR>} else {<BR>xl_setmode(sc,=20
 ifm-&gt;ifm_media);<BR>}<BR><BR>XL_UNLOCK(sc);<BR><BR>return (0);<BR>}<BR></=
 DIV>
 <DIV>&nbsp;</DIV>
 <DIV>&nbsp;</DIV>
 <DIV>This return does not release the lock at the begining.</DIV>
 <DIV>&nbsp;</DIV>
 <DIV>I removed the 'return(0);' and the pc does not produce the error and al=
 lows=20
 me to change the media.</DIV>
 <DIV>&nbsp;</DIV>
 <DIV>At the moment I cannot test the BNC part.</DIV>
 <DIV>&nbsp;</DIV>
 <DIV>&nbsp;</DIV>
 <DIV>&nbsp;</DIV>
 <DIV>pn.</DIV></FONT>   </BODY></HTML>
 
 -------------------------------1188931894--

From: dfilter@FreeBSD.ORG (dfilter service)
To: bug-followup@FreeBSD.org
Cc:  
Subject: Re: kern/113406: commit references a PR
Date: Mon, 24 Mar 2008 17:49:13 +0000 (UTC)

 marius      2008-03-24 17:49:06 UTC
 
   FreeBSD src repository
 
   Modified files:
     sys/pci              if_xl.c if_xlreg.h 
   Log:
   - Take advantage of bus_dmamap_load_mbuf_sg(9).
   - Take advantage of m_collapse(9).
   - Sync with other NIC drivers and prepend a TX mbuf if the first attempt
     to load it fails with an error other than EFBIG and stop trying instead
     of freeing it and keeping on trying to enqueue more mbufs. Also ensure
     the driver queue isn't empty before trying to enqueue mbufs in order to
     reduce locking operations.
   - In xl_ifmedia_upd() add a missing XL_UNLOCK(). [1]
   - Const'ify the xl_devs array.
   - Remove an outdated comment.
   
   PR:             113406 [1]
   MFC after:      1 month
   
   Revision  Changes    Path
   1.213     +69 -93    src/sys/pci/if_xl.c
   1.60      +2 -1      src/sys/pci/if_xlreg.h
 _______________________________________________
 cvs-all@freebsd.org mailing list
 http://lists.freebsd.org/mailman/listinfo/cvs-all
 To unsubscribe, send any mail to "cvs-all-unsubscribe@freebsd.org"
 

From: dfilter@FreeBSD.ORG (dfilter service)
To: bug-followup@FreeBSD.org
Cc:  
Subject: Re: kern/113406: commit references a PR
Date: Wed, 23 Apr 2008 21:28:36 +0000 (UTC)

 marius      2008-04-23 21:28:30 UTC
 
   FreeBSD src repository
 
   Modified files:        (Branch: RELENG_7)
     sys/pci              if_xl.c if_xlreg.h 
   Log:
   - Spelling fix for interupt -> interrupt
   - Take advantage of bus_dmamap_load_mbuf_sg(9).
   - Take advantage of m_collapse(9).
   - Sync with other NIC drivers and prepend a TX mbuf if the first attempt
     to load it fails with an error other than EFBIG and stop trying instead
     of freeing it and keeping on trying to enqueue more mbufs. Also ensure
     the driver queue isn't empty before trying to enqueue mbufs in order to
     reduce locking operations.
   - In xl_ifmedia_upd() add a missing XL_UNLOCK(). [1]
   - Const'ify the xl_devs array.
   - Remove an outdated comment.
   
   PR:             113406 [1]
   
   Revision   Changes    Path
   1.210.2.2  +71 -95    src/sys/pci/if_xl.c
   1.59.2.1   +2 -1      src/sys/pci/if_xlreg.h
 _______________________________________________
 cvs-all@freebsd.org mailing list
 http://lists.freebsd.org/mailman/listinfo/cvs-all
 To unsubscribe, send any mail to "cvs-all-unsubscribe@freebsd.org"
 

From: dfilter@FreeBSD.ORG (dfilter service)
To: bug-followup@FreeBSD.org
Cc:  
Subject: Re: kern/113406: commit references a PR
Date: Wed, 23 Apr 2008 21:38:34 +0000 (UTC)

 marius      2008-04-23 21:38:29 UTC
 
   FreeBSD src repository
 
   Modified files:        (Branch: RELENG_6)
     sys/pci              if_xl.c if_xlreg.h 
   Log:
   MFC: if_xl.c 1.211, 1.212, 1.213 (partial); if_xlreg.h 1.60
   
   - Spelling fix for interupt -> interrupt
   - Fix function prototype for device_shutdown method.
   - Take advantage of bus_dmamap_load_mbuf_sg(9).
   - Sync with other NIC drivers and prepend a TX mbuf if the first attempt
     to load it fails with an error other than EFBIG and stop trying instead
     of freeing it and keeping on trying to enqueue more mbufs. Also ensure
     the driver queue isn't empty before trying to enqueue mbufs in order to
     reduce locking operations.
   - In xl_ifmedia_upd() add a missing XL_UNLOCK(). [1]
   - Const'ify the xl_devs array.
   - Remove an outdated comment.
   
   PR:             113406 [1]
   
   Revision    Changes    Path
   1.190.2.12  +75 -97    src/sys/pci/if_xl.c
   1.55.2.3    +2 -1      src/sys/pci/if_xlreg.h
 _______________________________________________
 cvs-all@freebsd.org mailing list
 http://lists.freebsd.org/mailman/listinfo/cvs-all
 To unsubscribe, send any mail to "cvs-all-unsubscribe@freebsd.org"
 
State-Changed-From-To: open->closed 
State-Changed-By: marius 
State-Changed-When: Thu Apr 24 09:46:25 UTC 2008 
State-Changed-Why:  

Close; this PR has been fully dealt with. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=113406 
>Unformatted:
