From nobody@FreeBSD.org  Fri Mar  5 13:34:19 2010
Return-Path: <nobody@FreeBSD.org>
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 4881E106564A
	for <freebsd-gnats-submit@FreeBSD.org>; Fri,  5 Mar 2010 13:34:19 +0000 (UTC)
	(envelope-from nobody@FreeBSD.org)
Received: from www.freebsd.org (www.freebsd.org [IPv6:2001:4f8:fff6::21])
	by mx1.freebsd.org (Postfix) with ESMTP id 372D38FC16
	for <freebsd-gnats-submit@FreeBSD.org>; Fri,  5 Mar 2010 13:34:19 +0000 (UTC)
Received: from www.freebsd.org (localhost [127.0.0.1])
	by www.freebsd.org (8.14.3/8.14.3) with ESMTP id o25DYI9G037237
	for <freebsd-gnats-submit@FreeBSD.org>; Fri, 5 Mar 2010 13:34:18 GMT
	(envelope-from nobody@www.freebsd.org)
Received: (from nobody@localhost)
	by www.freebsd.org (8.14.3/8.14.3/Submit) id o25DYIeA037236;
	Fri, 5 Mar 2010 13:34:18 GMT
	(envelope-from nobody)
Message-Id: <201003051334.o25DYIeA037236@www.freebsd.org>
Date: Fri, 5 Mar 2010 13:34:18 GMT
From: Rainer Bredehorn <Bredehorn@gmx.de>
To: freebsd-gnats-submit@FreeBSD.org
Subject: The fxp driver does not handle Frame Check Sequence (CRC) errors correctly.
X-Send-Pr-Version: www-3.1
X-GNATS-Notify:

>Number:         144492
>Category:       kern
>Synopsis:       [fxp] The fxp driver does not handle Frame Check Sequence (CRC) errors correctly.
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    yongari
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Fri Mar 05 13:40:01 UTC 2010
>Closed-Date:    
>Last-Modified:  Wed Sep 28 16:23:42 UTC 2011
>Originator:     Rainer Bredehorn
>Release:        FreeBSD 7.1
>Organization:
>Environment:
>Description:
If a Frame Check Sequence (FCS) of a packet is wrong you can see this
packet with a packet sniffer (wireshark/tcpdump) via the BPF hook in
the ether_input() function.  Other network driver discard the frame.

File: sys/dev/fxp/if_fxp.c
Function: fxp_intr_body

The error handling after checking the status flag FXP_RFA_STATUS_CRC
seems to be wrong. 
>How-To-Repeat:
Connect the FreeBSD 7.1 machine to a ethernet hub. Generate traffic so
that the hub shows collisions.

>Fix:


>Release-Note:
>Audit-Trail:
Responsible-Changed-From-To: freebsd-i386->freebsd-net 
Responsible-Changed-By: linimon 
Responsible-Changed-When: Mon Mar 8 07:12:23 UTC 2010 
Responsible-Changed-Why:  
This does not sound i386-specific. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=144492 
State-Changed-From-To: open->feedback 
State-Changed-By: yongari 
State-Changed-When: Mon Mar 8 18:46:31 UTC 2010 
State-Changed-Why:  
I don't think 7.1-RELEASE has enhancements made by me so it may 
have some edge cases. But the description looks odd. Would you 
elaborate what's your problem on fxp(4)? 
fxp(4) driver drops frames with CRC errors(e.g. FCS errors) so you 
can't even see these frames with bpf(4)? Also show me the output of 
"pciconf -lcbv". 


Responsible-Changed-From-To: freebsd-net->yongari 
Responsible-Changed-By: yongari 
Responsible-Changed-When: Mon Mar 8 18:46:31 UTC 2010 
Responsible-Changed-Why:  
Take. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=144492 

From: "Rainer Bredehorn" <Bredehorn@gmx.de>
To: bug-followup@freebsd.org
Cc:  
Subject: Re: kern/144492: [fxp] The fxp driver does not handle Frame Check
 Sequence (CRC) errors correctly.
Date: Tue, 09 Mar 2010 10:01:39 +0100

 The problem is that I can see packets with wrong Frame Check Sequence with a packet sniffer. This shouldn't happen. The driver should discard the packet but he dosen't.
 Wireshark shows strange packets in this case e.g mac addresses with 34:34:34:34:34:34.
 
 The driver source code shows that the FXP_RFA_STATUS_CRC flag of the status register is checked. If it is set the mbuf is deleted and a "continue" follows. Otherwise the ether_input function is called ( (*ifp->if_input)(ifp, m) ).
 
 The FXP_RFA_STATUS_CRC flag is checked after the fxp_add_rfabuf(sc, rxp) function. If I check this flag and discard the packet before calling the fxp_add_rbuf() function the packet is not seen by a packet sniffer.
 
 FreeBSD 6.1 shows the same behavior. I have also tried a Linux (Knoppix) on the same hardware. Linux discards the packets correctly.
 
 Even on different hardware platforms which use the same (fxp) networkdriver I can see the "strange" packets on a packet sniffer.
 
 Here is the pciconf output from one hardware:
 
 hostb0@pci0:0:0:0:	class=0x060000 card=0x00000000 chip=0x35808086 rev=0x02 hdr=0x00
     vendor     = 'Intel Corporation'
     device     = '82852GM/GME/GMV/PM, 855GM/GME Montara Host-Hub Interface Bridge'
     class      = bridge
     subclass   = HOST-PCI
     cap 09[40] = vendor (length 5) Intel cap 8 version 1
 none0@pci0:0:0:1:	class=0x088000 card=0x35848086 chip=0x35848086 rev=0x02 hdr=0x00
     vendor     = 'Intel Corporation'
     device     = '82852GM/GME/GMV/PM, 855GM/GME Montara System Memory Controller'
     class      = base peripheral
 none1@pci0:0:0:3:	class=0x088000 card=0x35858086 chip=0x35858086 rev=0x02 hdr=0x00
     vendor     = 'Intel Corporation'
     device     = '82852GM/GME/GMV/PM, 855GM/GME Montara Configuration Process'
     class      = base peripheral
 vgapci0@pci0:0:2:0:	class=0x030000 card=0x35828086 chip=0x35828086 rev=0x02 hdr=0x00
     vendor     = 'Intel Corporation'
     device     = '82852GM/GME/GMV/PM, 855GM/GME Montara Integrated Graphics Device'
     class      = display
     subclass   = VGA
     cap 01[d0] = powerspec 1  supports D0 D1 D3  current D0
 vgapci1@pci0:0:2:1:	class=0x038000 card=0x35828086 chip=0x35828086 rev=0x02 hdr=0x00
     vendor     = 'Intel Corporation'
     device     = '82852GM/GME/GMV/PM, 855GM/GME Montara Integrated Graphics Device'
     class      = display
     cap 01[d0] = powerspec 1  supports D0 D1 D3  current D0
 uhci0@pci0:0:29:0:	class=0x0c0300 card=0x24c08086 chip=0x24c28086 rev=0x02 hdr=0x00
     vendor     = 'Intel Corporation'
     device     = '82801DB/DBL/DBM (ICH4/ICH4-L/ICH4-M) USB UHCI Controller'
     class      = serial bus
     subclass   = USB
 uhci1@pci0:0:29:1:	class=0x0c0300 card=0x24c08086 chip=0x24c48086 rev=0x02 hdr=0x00
     vendor     = 'Intel Corporation'
     device     = '82801DB/DBL/DBM (ICH4/ICH4-L/ICH4-M) USB UHCI Controller'
     class      = serial bus
     subclass   = USB
 uhci2@pci0:0:29:2:	class=0x0c0300 card=0x24c08086 chip=0x24c78086 rev=0x02 hdr=0x00
     vendor     = 'Intel Corporation'
     device     = '82801DB/DBL/DBM (ICH4/ICH4-L/ICH4-M) USB UHCI Controller'
     class      = serial bus
     subclass   = USB
 ehci0@pci0:0:29:7:	class=0x0c0320 card=0x24c08086 chip=0x24cd8086 rev=0x02 hdr=0x00
     vendor     = 'Intel Corporation'
     device     = '82801DB/DBL/DBM (ICH4/ICH4-L/ICH4-M) USB 2.0 EHCI Controller'
     class      = serial bus
     subclass   = USB
     cap 01[50] = powerspec 2  supports D0 D3  current D0
     cap 0a[58] = EHCI Debug Port at offset 0x80 in map 0x14
 pcib1@pci0:0:30:0:	class=0x060400 card=0x00000000 chip=0x244e8086 rev=0x82 hdr=0x01
     vendor     = 'Intel Corporation'
     device     = '82801 Family (ICH2/3/4/4/5/5/6/7/8/9,63xxESB) Hub Interface to PCI Bridge'
     class      = bridge
     subclass   = PCI-PCI
 isab0@pci0:0:31:0:	class=0x060100 card=0x00000000 chip=0x24c08086 rev=0x02 hdr=0x00
     vendor     = 'Intel Corporation'
     device     = '82801DB/DBL (ICH4/ICH4-L) LPC Interface Bridge'
     class      = bridge
     subclass   = PCI-ISA
 atapci0@pci0:0:31:1:	class=0x01018a card=0x24c08086 chip=0x24cb8086 rev=0x02 hdr=0x00
     vendor     = 'Intel Corporation'
     device     = '82801DB/DBL (ICH4/ICH4-L) UltraATA/100 EIDE Controller'
     class      = mass storage
     subclass   = ATA
 none2@pci0:0:31:3:	class=0x0c0500 card=0x24c08086 chip=0x24c38086 rev=0x02 hdr=0x00
     vendor     = 'Intel Corporation'
     device     = '82801DB/DBL/DBM (ICH4/ICH4-L/ICH4-M) SMBus Controller'
     class      = serial bus
     subclass   = SMBus
 none3@pci0:0:31:5:	class=0x040100 card=0x4740414c chip=0x24c58086 rev=0x02 hdr=0x00
     vendor     = 'Intel Corporation'
     device     = '82801DB/DBL/DBM (ICH4/ICH4-L/ICH4-M) AC'97 Audio Controller'
     class      = multimedia
     subclass   = audio
     cap 01[50] = powerspec 2  supports D0 D3  current D0
 fxp0@pci0:1:4:0:	class=0x020000 card=0x000c8086 chip=0x12298086 rev=0x10 hdr=0x00
     vendor     = 'Intel Corporation'
     device     = '82550/1/7/8/9 EtherExpress PRO/100(B) Ethernet Adapter'
     class      = network
     subclass   = ethernet
     cap 01[dc] = powerspec 2  supports D0 D1 D2 D3  current D0
 fxp1@pci0:1:12:0:	class=0x020000 card=0x00708086 chip=0x12098086 rev=0x10 hdr=0x00
     vendor     = 'Intel Corporation'
     device     = '8255xER/IT Fast Ethernet Controller'
     class      = network
     subclass   = ethernet
     cap 01[dc] = powerspec 2  supports D0 D1 D2 D3  current D0
 
 Best regards, 
 
 Rainer Bredehorn
 -- 
 Sicherer, schneller und einfacher. Die aktuellen Internet-Browser -
 jetzt kostenlos herunterladen! http://portal.gmx.net/de/go/chbrowser
State-Changed-From-To: feedback->open 
State-Changed-By: yongari 
State-Changed-When: Wed Sep 28 16:22:59 UTC 2011 
State-Changed-Why:  
Feedback received and it's still issue on latest stable/7. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=144492 
>Unformatted:
