From jh@sirocco.sandstorm.net  Tue Mar  7 22:41:01 2006
Return-Path: <jh@sirocco.sandstorm.net>
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 5554416A420
	for <FreeBSD-gnats-submit@freebsd.org>; Tue,  7 Mar 2006 22:41:01 +0000 (GMT)
	(envelope-from jh@sirocco.sandstorm.net)
Received: from sirocco.sandstorm.net (ip-69-33-111-75.bos.megapath.net [69.33.111.75])
	by mx1.FreeBSD.org (Postfix) with ESMTP id B3A5643D78
	for <FreeBSD-gnats-submit@freebsd.org>; Tue,  7 Mar 2006 22:40:48 +0000 (GMT)
	(envelope-from jh@sirocco.sandstorm.net)
Received: from sirocco.sandstorm.net (localhost [127.0.0.1])
	by sirocco.sandstorm.net (8.13.3/8.13.3) with ESMTP id k27MdMjC065631;
	Tue, 7 Mar 2006 17:39:22 -0500 (EST)
	(envelope-from jh@sirocco.sandstorm.net)
Received: (from jh@localhost)
	by sirocco.sandstorm.net (8.13.3/8.13.3/Submit) id k27MdLeM065630;
	Tue, 7 Mar 2006 17:39:21 -0500 (EST)
	(envelope-from jh)
Message-Id: <200603072239.k27MdLeM065630@sirocco.sandstorm.net>
Date: Tue, 7 Mar 2006 17:39:21 -0500 (EST)
From: John Hood <cgull@glup.org>
Reply-To: John Hood <cgull@glup.org>, ni-bugs@sandstorm.net
To: FreeBSD-gnats-submit@freebsd.org
Cc: John Hood <cgull@glup.org>, ni-bugs@sandstorm.net
Subject: [dc] if_dc panics on bad hardware
X-Send-Pr-Version: 3.113
X-GNATS-Notify:

>Number:         94196
>Category:       kern
>Synopsis:       [dc] if_dc panics on bad hardware
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    freebsd-bugs
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Tue Mar 07 22:50:02 GMT 2006
>Closed-Date:    Fri Apr 27 08:14:57 GMT 2007
>Last-Modified:  Fri Apr 27 17:40:10 GMT 2007
>Originator:     john hood
>Release:        FreeBSD 6.0-RELEASE i386
>Organization:
Sandstorm Enterprises
>Environment:

Software: FreeBSD (Sandstorm internal machine) 6.0-RELEASE FreeBSD 6.0-RELEASE #0: Thu Nov 3 09:36:13 UTC 2005 root@x64.samsco.home:/usr/obj/usr/src/sys/GENERIC i386

Hardware: Intel D845EPT2 motherboard in a 2U box with a 3-slot riser card;
the riser card has little paddleboards to pick off slot-geographic
signals on 2 other motherboard slots (the motherboard is not designed
for a riser card).  A Netgear FA310TX ethercard and an Intel
82559-family card are installed on the riser.  One of the little
paddle boards is not fully seated...

Software:  6.0-RELEASE install CD

>Description:

Kernel panics during boot when probing a misfunctioning Netgear
FA310TX card.

>How-To-Repeat:

By examination, mostly.  Unfortunately, the the problem went away when
the paddleboard was reseated.

Reproduce above hardware configuration, such that a card probed by the
dc driver responds to PCI config-space reads/writes, but fails to
operate normally when the driver tries to reset it.  Boot 6.0 install
CD, observe panic.  Boot 5.3 install CD, observe dc printing a
message, failing to attach, and the system otherwise continuing
normally.  Examine stack trace of debug kernel, note that the kernel
has paniced with a null-pointer dereference under
  if_printf(sc->dc_ifp, "reset never completed!\n");
in dc_reset(), from dc_attach().

Alternately, one could alter dc_reset() so that it always calls
if_printf() and boot the resulting kernel on any system with a
dc-driven card.

Sorry about the lack of a concrete report.  If you have trouble
understanding/reproducing the problem, I can generate a proper report
with stack trace, but it should be fairly obvious on examination.

>Fix:

Make sure your hardware works...

Looks like the bug was introduced with 1.163, where if_printf() was
substituted for printf().  dc_attach() does not set sc->dc_ifp until
after dc_reset() is called.  Things need to be rearranged so dc_reset
doesn't have this dependency or sc->dc_ifp is set before it's called.

I haven't looked. but it's been suggested that this may be a problem
in other drivers, if similar changes have been made.  The original
author (jhb) should review this problem.

>Release-Note:
>Audit-Trail:

From: Gavin Atkinson <gavin.atkinson@ury.york.ac.uk>
To: bug-followup@FreeBSD.org, cgull@glup.org
Cc: glebius@FreeBSD.org
Subject: Re: kern/94196: [dc] if_dc panics on bad hardware
Date: Thu, 26 Apr 2007 15:01:02 +0100

 This appears to have been fixed by glebius in src/sys/dev/dc/if_dc.c
 1.185, although there was no plan to MFC it mentioned in the commit.
 Gleb, is this worth MFCing so that this PR can be closed?
 
 Thanks,
 
 Gavin

From: Gleb Smirnoff <glebius@FreeBSD.org>
To: Gavin Atkinson <gavin.atkinson@ury.york.ac.uk>
Cc: bug-followup@FreeBSD.org, cgull@glup.org, marius@FreeBSD.org
Subject: Re: kern/94196: [dc] if_dc panics on bad hardware
Date: Thu, 26 Apr 2007 19:00:16 +0400

 On Thu, Apr 26, 2007 at 03:01:02PM +0100, Gavin Atkinson wrote:
 G> This appears to have been fixed by glebius in src/sys/dev/dc/if_dc.c
 G> 1.185, although there was no plan to MFC it mentioned in the commit.
 G> Gleb, is this worth MFCing so that this PR can be closed?
 
 It was already MFC'ed by marius in revision 1.160.2.12.
 
 Can you please confirm, that fresh RELENG_6 doesn't panic?
 
 -- 
 Totus tuus, Glebius.
 GLEBIUS-RIPN GLEB-RIPE
State-Changed-From-To: open->feedback 
State-Changed-By: linimon 
State-Changed-When: Thu Apr 26 22:48:26 UTC 2007 
State-Changed-Why:  
Note that submitter has been asked for feedback. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=94196 
State-Changed-From-To: feedback->closed 
State-Changed-By: glebius 
State-Changed-When: Fri Apr 27 08:14:03 UTC 2007 
State-Changed-Why:  
Looks like the PR is fixed in 6.2-RELEASE. If not, I will reopen the PR. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=94196 

From: John Hood <jh@sandstorm.net>
To: Gleb Smirnoff <glebius@FreeBSD.org>
Cc: Gavin Atkinson <gavin.atkinson@ury.york.ac.uk>, bug-followup@FreeBSD.org,
        cgull@glup.org, marius@FreeBSD.org
Subject: Re: kern/94196: [dc] if_dc panics on bad hardware
Date: Fri, 27 Apr 2007 13:37:39 -0400

 On Thu, Apr 26, 2007 at 07:00:16PM +0400, Gleb Smirnoff wrote:
 > On Thu, Apr 26, 2007 at 03:01:02PM +0100, Gavin Atkinson wrote:
 > G> This appears to have been fixed by glebius in src/sys/dev/dc/if_dc.c
 > G> 1.185, although there was no plan to MFC it mentioned in the commit.
 > G> Gleb, is this worth MFCing so that this PR can be closed?
 > 
 > It was already MFC'ed by marius in revision 1.160.2.12.
 > 
 > Can you please confirm, that fresh RELENG_6 doesn't panic?
 
 Sorry to not respond earlier, I was out yesterday.
 
 Sorry-- as I said, the bug depended on an unseated connector, now
 reseated, that would be hard to reproduce.  I can't reproduce the
 machine's config anyway.
 
 I agree that the bug appears to be fixed after inspecting the code.
 
   --jh
>Unformatted:
