From pmc@citylink.dinoex.sub.org  Wed Feb 20 19:33:40 2008
Return-Path: <pmc@citylink.dinoex.sub.org>
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id CE0B816A403
	for <FreeBSD-gnats-submit@freebsd.org>; Wed, 20 Feb 2008 19:33:40 +0000 (UTC)
	(envelope-from pmc@citylink.dinoex.sub.org)
Received: from uucp.dinoex.sub.de (uucp.dinoex.sub.de [194.45.71.2])
	by mx1.freebsd.org (Postfix) with ESMTP id 2F73313C45B
	for <FreeBSD-gnats-submit@freebsd.org>; Wed, 20 Feb 2008 19:33:39 +0000 (UTC)
	(envelope-from pmc@citylink.dinoex.sub.org)
Received: from uucp.dinoex.sub.de (uucp@uucp.dinoex.sub.de [194.45.71.2] (may be forged))
	by uucp.dinoex.sub.de (8.14.1/8.14.0) with ESMTP id m1KJ2qPD086115
	for <FreeBSD-gnats-submit@freebsd.org>; Wed, 20 Feb 2008 20:02:52 +0100 (CET)
	(envelope-from pmc@citylink.dinoex.sub.org)
Received: from citylink.dinoex.sub.org (uucp@localhost)
	by uucp.dinoex.sub.de (8.14.1/8.14.0/Submit) with UUCP id m1KJ2pcP086114
	for FreeBSD-gnats-submit@freebsd.org; Wed, 20 Feb 2008 20:02:51 +0100 (CET)
	(envelope-from pmc@citylink.dinoex.sub.org)
Received: from gate.oper.dinoex.org (gate-e [192.168.98.2])
	by citylink.dinoex.sub.de (8.13.6/8.13.6) with ESMTP id m1KImR5m037965
	for <FreeBSD-gnats-submit@freebsd.org>; Wed, 20 Feb 2008 19:48:27 +0100 (CET)
	(envelope-from peter@gate.oper.dinoex.org)
Received: from gate.oper.dinoex.org (gate-e [192.168.98.2])
	by gate.oper.dinoex.org (8.13.6/8.13.6) with ESMTP id m1KIlIQw037893
	for <FreeBSD-gnats-submit@freebsd.org>; Wed, 20 Feb 2008 19:47:19 +0100 (CET)
	(envelope-from peter@gate.oper.dinoex.org)
Received: (from peter@localhost)
	by gate.oper.dinoex.org (8.13.6/8.13.6/Submit) id m1KIlI3E037892;
	Wed, 20 Feb 2008 19:47:18 +0100 (CET)
	(envelope-from peter)
Message-Id: <200802201847.m1KIlI3E037892@gate.oper.dinoex.org>
Date: Wed, 20 Feb 2008 19:47:18 +0100 (CET)
From: Peter Much <pmc@citylink.dinoex.sub.org>
Reply-To: Peter Much <pmc@citylink.dinoex.sub.org>
To: FreeBSD-gnats-submit@freebsd.org
Cc:
Subject: GENERIC does not boot: if_de is broken
X-Send-Pr-Version: 3.113
X-GNATS-Notify:

>Number:         120915
>Category:       kern
>Synopsis:       [de] [patch] GENERIC does not boot: if_de is broken
>Confidential:   no
>Severity:       serious
>Priority:       high
>Responsible:    jhb
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Wed Feb 20 19:40:02 UTC 2008
>Closed-Date:    Tue Apr 08 14:23:49 UTC 2008
>Last-Modified:  Tue Apr 08 14:23:49 UTC 2008
>Originator:     Peter Much
>Release:        FreeBSD 6.3-RELEASE-p1 i386
>Organization:
n/a
>Environment:

	kernel: FreeBSD 6.3-RELEASE-p1

	de0: <Digital 21040 Ethernet> port 0xa000-0xa07f mem 
		0xf4800000-0xf480007f at device 13.0 on pci0
	de0: SMC 8432BT 21040 [10Mb/s] pass 2.3

>Description:

	After upgrade from 5.5 to 6.3 kernel has pagefault on boot.
	kernel.GENERIC has the same problem.

	Location: tulip_txput+0x1eb

	Backtrace (more or less, due to optimization):
		device_attach
		-> tulip_pci_attach
		   -> tulip_reset
		      -> tulip_media_select
			 -> tulip_txprobe
			    -> tulip_txput

	compiling a kernel without if_de will help (depending on the
	definition of "help"), but when loading if_de.ko the
	pagefault is here again.

>How-To-Repeat:

	Try to boot generic with the appropriate netif card.

>Fix:

	The problem seems to be that during attach a mediaselect
	is done, during mediaselect a testpacket is sent and during
	packetsend the BPF is fed - but at that point of the attach
	the BPF structure seems not yet available - which is nowhere
	checked.
	Patch (see below) helps for me, while I do not know if this
	is now the way things should be done. And what I do not really 
	understand is how such a thing can go undetected for seemingly 
	two+ years, as it is practically a "can-not-work-by-design" 
	condition.

*** sys/pci/if_de.c.orig        Wed Feb 20 18:37:57 2008
--- sys/pci/if_de.c     Wed Feb 20 19:00:09 2008
***************
*** 4041,4047 ****
      /*
       * bounce a copy to the bpf listener, if any.
       */
!     BPF_MTAP(sc->tulip_ifp, m);
  
      /*
       * The descriptors have been filled in.  Now get ready
--- 4041,4048 ----
      /*
       * bounce a copy to the bpf listener, if any.
       */
!     if(sc->tulip_ifp->if_bpf != NULL)
!       BPF_MTAP(sc->tulip_ifp, m);
  
      /*
       * The descriptors have been filled in.  Now get ready
***************
*** 4403,4408 ****
--- 4404,4410 ----
  
      /* XXX: driver name/unit should be set some other way */
      if_initname(ifp, "de", sc->tulip_unit);
+     ifp->if_bpf = NULL;
      ifp->if_softc = sc;
      ifp->if_flags = IFF_BROADCAST|IFF_SIMPLEX|IFF_MULTICAST;
      ifp->if_ioctl = tulip_ifioctl;
>Release-Note:
>Audit-Trail:

From: John Baldwin <jhb@FreeBSD.org>
To: bug-followup@FreeBSD.org, pmc@citylink.dinoex.sub.org
Cc:  
Subject: Re: kern/120915: [de] [patch] GENERIC does not boot: if_de is broken
Date: Wed, 26 Mar 2008 17:01:24 -0400

 This patch is a slight variant on the above and other places in the driver use 
 the DEVICEPROBE test to determine if the mediaselect testpacket bit is being 
 done:
 
 Index: if_de.c
 ===================================================================
 RCS file: /usr/cvs/src/sys/dev/de/if_de.c,v
 retrieving revision 1.183
 diff -u -r1.183 if_de.c
 --- if_de.c	7 Jun 2007 00:28:47 -0000	1.183
 +++ if_de.c	26 Mar 2008 20:58:19 -0000
 @@ -4053,7 +4053,8 @@
      /*
       * bounce a copy to the bpf listener, if any.
       */
 -    BPF_MTAP(sc->tulip_ifp, m);
 +    if (!(sc->tulip_flags & TULIP_DEVICEPROBE))
 +	    BPF_MTAP(sc->tulip_ifp, m);
  
      /*
       * The descriptors have been filled in.  Now get ready
 
 -- 
 John Baldwin

From: Peter Much <pmc@citylink.dinoex.sub.org>
To: John Baldwin <jhb@FreeBSD.org>
Cc: bug-followup@FreeBSD.org
Subject: Re: kern/120915: [de] [patch] GENERIC does not boot: if_de is broken
Date: Fri, 28 Mar 2008 00:31:48 +0100

 On Wed, Mar 26, 2008 at 05:01:24PM -0400, John Baldwin wrote:
 ! This patch is a slight variant on the above and other places in the driver use 
 ! the DEVICEPROBE test to determine if the mediaselect testpacket bit is being 
 ! done:
 
 I tested this (still with 6.3-RELEASE-p1), it compiles, but, sorry to
 say, this one does panick on attach like before. (I did not yet check
 further for reasons like what this DEVICEPROBE value is supposed to
 contain.)
 
 PMc

From: John Baldwin <jhb@freebsd.org>
To: Peter Much <pmc@citylink.dinoex.sub.org>
Cc: bug-followup@freebsd.org
Subject: Re: kern/120915: [de] [patch] GENERIC does not boot: if_de is broken
Date: Thu, 3 Apr 2008 16:53:22 -0400

 On Thursday 27 March 2008 07:31:48 pm Peter Much wrote:
 > On Wed, Mar 26, 2008 at 05:01:24PM -0400, John Baldwin wrote:
 > ! This patch is a slight variant on the above and other places in the driver 
 use 
 > ! the DEVICEPROBE test to determine if the mediaselect testpacket bit is 
 being 
 > ! done:
 > 
 > I tested this (still with 6.3-RELEASE-p1), it compiles, but, sorry to
 > say, this one does panick on attach like before. (I did not yet check
 > further for reasons like what this DEVICEPROBE value is supposed to
 > contain.)
 
 Try this instead then.  It keeps DEVICEPROBE set slightly longer and shouldn't 
 clear it until BPF is fully setup.
 
 Index: if_de.c
 ===================================================================
 RCS file: /usr/cvs/src/sys/dev/de/if_de.c,v
 retrieving revision 1.183
 diff -u -r1.183 if_de.c
 --- if_de.c	7 Jun 2007 00:28:47 -0000	1.183
 +++ if_de.c	3 Apr 2008 20:51:51 -0000
 @@ -4053,7 +4053,8 @@
      /*
       * bounce a copy to the bpf listener, if any.
       */
 -    BPF_MTAP(sc->tulip_ifp, m);
 +    if (!(sc->tulip_flags & TULIP_DEVICEPROBE))
 +	    BPF_MTAP(sc->tulip_ifp, m);
  
      /*
       * The descriptors have been filled in.  Now get ready
 @@ -4437,13 +4438,16 @@
      ifmedia_init(&sc->tulip_ifmedia, 0,
  		 tulip_ifmedia_change,
  		 tulip_ifmedia_status);
 -    sc->tulip_flags &= ~TULIP_DEVICEPROBE;
      tulip_ifmedia_add(sc);
  
      tulip_reset(sc);
      TULIP_UNLOCK(sc);
  
      ether_ifattach(sc->tulip_ifp, sc->tulip_enaddr);
 +
 +    TULIP_LOCK(sc);
 +    sc->tulip_flags &= ~TULIP_DEVICEPROBE;
 +    TULIP_UNLOCK(sc);
  }
  
  /* Release memory for a single descriptor ring. */
 
 -- 
 John Baldwin

From: Peter Much <pmc@citylink.dinoex.sub.org>
To: John Baldwin <jhb@freebsd.org>
Cc: bug-followup@freebsd.org
Subject: Re: kern/120915: [de] [patch] GENERIC does not boot: if_de is broken
Date: Sat, 5 Apr 2008 04:09:24 +0200

 On Thu, Apr 03, 2008 at 04:53:22PM -0400, John Baldwin wrote:
 
 ! Try this instead then.  It keeps DEVICEPROBE set slightly longer and shouldn't 
 ! clear it until BPF is fully setup.
 
 This one compiles, boots, and seems to run. :)
 
 PMc
State-Changed-From-To: open->patched 
State-Changed-By: jhb 
State-Changed-When: Sat Apr 5 17:24:58 UTC 2008 
State-Changed-Why:  
Fix committed to HEAD. 


Responsible-Changed-From-To: freebsd-bugs->jhb 
Responsible-Changed-By: jhb 
Responsible-Changed-When: Sat Apr 5 17:24:58 UTC 2008 
Responsible-Changed-Why:  
Fix committed to HEAD. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=120915 

From: dfilter@FreeBSD.ORG (dfilter service)
To: bug-followup@FreeBSD.org
Cc:  
Subject: Re: kern/120915: commit references a PR
Date: Sat,  5 Apr 2008 17:24:56 +0000 (UTC)

 jhb         2008-04-05 17:24:44 UTC
 
   FreeBSD src repository
 
   Modified files:
     sys/dev/de           if_de.c 
   Log:
   During attach on some de(4) adapters the driver sends out a test packet as
   part of detecting the media.  Explicitly ensure that we don't send it to
   bpf(4) as bpf(4) isn't setup yet.  This worked by accident before the bpf
   interface stuff was reworked to avoid other races (bpf_peers_present, etc.)
   but now it needs an explicit check to avoid a panic.
   
   MFC after:      3 days
   PR:             kern/120915
   
   Revision  Changes    Path
   1.184     +6 -2      src/sys/dev/de/if_de.c
 _______________________________________________
 cvs-all@freebsd.org mailing list
 http://lists.freebsd.org/mailman/listinfo/cvs-all
 To unsubscribe, send any mail to "cvs-all-unsubscribe@freebsd.org"
 
State-Changed-From-To: patched->closed 
State-Changed-By: jhb 
State-Changed-When: Tue Apr 8 14:23:31 UTC 2008 
State-Changed-Why:  
Fix MFC'd to 6.x and 7.x. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=120915 
>Unformatted:
