From ji@tla.org  Sun Sep 30 22:26:46 2001
Return-Path: <ji@tla.org>
Received: from moi.tla.org (64-152-8-49-rev-l3.inyc.com [64.152.8.49])
	by hub.freebsd.org (Postfix) with ESMTP id 2FB1A37B40D
	for <FreeBSD-gnats-submit@freebsd.org>; Sun, 30 Sep 2001 22:22:45 -0700 (PDT)
Received: by moi.tla.org (Postfix, from userid 1761)
	id CE83A7C2F; Mon,  1 Oct 2001 01:22:25 -0400 (EDT)
Message-Id: <20011001052225.CE83A7C2F@moi.tla.org>
Date: Mon,  1 Oct 2001 01:22:25 -0400 (EDT)
From: John "Heldenprogrammer" Ioannidis <ji@tla.org>
Reply-To: John "Heldenprogrammer" Ioannidis <ji@tla.org>
To: FreeBSD-gnats-submit@freebsd.org
Subject: kernel panics with 3C905[BC] cards / xl driver
X-Send-Pr-Version: 3.113
X-GNATS-Notify:

>Number:         30952
>Category:       kern
>Synopsis:       kernel panics with 3C905[BC] cards / xl driver
>Confidential:   no
>Severity:       serious
>Priority:       high
>Responsible:    silby
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Sun Sep 30 22:30:01 PDT 2001
>Closed-Date:    Mon Aug 18 20:24:12 PDT 2003
>Last-Modified:  Mon Aug 18 20:24:12 PDT 2003
>Originator:     John "Heldenprogrammer" Ioannidis
>Release:        FreeBSD 4.4-STABLE i386
>Organization:
AT&T Labs - Research
>Environment:
System: FreeBSD moi.tla.org 4.4-STABLE FreeBSD 4.4-STABLE #0: Mon Sep 17 22:29:36 EDT 2001 ji@eml.research.att.com:/usr/cvsrc/src/sys/compile/EMLGENERIC i386

	generic PCs (Pentium-II and Pentium-III processors,
	enough memory (64M-1G), various Tyan and Supermicro motherboards,
	3com 3C905B and 3c905C cards.

	FreeBSD 4.3-RELEASE through 4.4-STABLE
>Description:

I'm getting kernel panics when running tcpdump when sniffing my
external link.  The traps almost always occur in xl_newbuf() (in
pci/if_xl.c) where it calls MCLGET(), which would indicate a corrupted,
thought to be free, mbuf cluster having been put on the free list.  In
about twenty crashes I saw the crash occur once in an mget call inside
one of the bpf routines, but I was never able to recreate that crash.

Here are the relevant facts:

* The ethernet signal is known to have bad traffic on it; another
  driver running under OpenBSD 2.9 (the de(4) driver, called dc(4) in
  FreeBSD) reports "bad crc" and "alignment problem" errors with
  received packets, at a rate of a couple of packets per second.

* It is not a particular packet that's doing it (two identical
  machines running identical software crash at different times).

* It takes 1-5 minutes on a lightly loaded network (~20Mbps) before
  the crash occurs, so not all (bad) packets are causing this problem.

* If I replay captured traffic (with a sort-of tcpundump program I
  wrote) in a controlled environment, no crash occurs, so the fault
  must lie with the bad packets that exist on the wire.

* The problem does not exist in other drivers (e.g., the dc(4)
  driver); I used another machine with that interface to capture the
  traffic for the experiment in the previous step.

* The problem occurs on machines with a variety of hardware speeds
  (300MHz - 1GHz), with four different motherboards by two different
  manufacturers (Tyan and Supermicro), and for both the 3c905B and
  3c905C versions of the card.

* The problem also manifests itself under OpenBSD 2.9 (I don't know
  about earlier versions).

I suspect that when the card is in promiscuous mode, it does something
improper when DMAing.  I hope there is a way of finding out what's
wrong without having to break out my PCI bus analyzer!

>How-To-Repeat:
	good question. I don't know.
>Fix:
	none yet

>Release-Note:
>Audit-Trail:
Responsible-Changed-From-To: freebsd-bugs->silby 
Responsible-Changed-By: silby 
Responsible-Changed-When: Sun Dec 1 00:43:30 PST 2002 
Responsible-Changed-Why:  
I'll take a shot at this. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=30952 
State-Changed-From-To: open->closed 
State-Changed-By: silby 
State-Changed-When: Mon Aug 18 20:23:44 PDT 2003 
State-Changed-Why:  
The busdma'd driver recently MFC'd to 4.8-stable appears to solve this          
problem.  

http://www.freebsd.org/cgi/query-pr.cgi?pr=30952 
>Unformatted:
