From owner-freebsd-current@FreeBSD.ORG Mon Jan 13 02:10:24 2014 Return-Path: Delivered-To: freebsd-current@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id AF8E7E0E; Mon, 13 Jan 2014 02:10:24 +0000 (UTC) Received: from mail-pd0-x233.google.com (mail-pd0-x233.google.com [IPv6:2607:f8b0:400e:c02::233]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by mx1.freebsd.org (Postfix) with ESMTPS id 760B61583; Mon, 13 Jan 2014 02:10:24 +0000 (UTC) Received: by mail-pd0-f179.google.com with SMTP id y13so4301385pdi.38 for ; Sun, 12 Jan 2014 18:10:24 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=from:date:to:cc:subject:message-id:reply-to:references:mime-version :content-type:content-disposition:in-reply-to:user-agent; bh=9TRPHy68mjHw0UHL+L1nJvQ3/tSxVDzfDfij228eiqA=; b=sRF7YlxnydUgOfRAfuHyMuRvjPbVZ5UcAz3t8buIyJ2OsFGx5tk6etSSVP0pFyiTI5 of2/IRJ+A8rPyCEze/j6xsSzzDrFaxzm5EA6DvrRE4iETYFlWwkKsplNAsoSE5K8FK5B EcgarAFsZxCIeDjJtLT6FI2KX8QW3xKFW8YW/jYxHVO1gi5m5xM7OKH6PhwbMCP7k7yH +t15X1ZBHdbDpppzBEBC0HkZSMSZf5JxJBHAbZBPJoXsyDmfyegrQcxTY7xY4ZL5YzVh emr/JeQSxfDnl9ltf2JLza+HFz6vc5kAtgnmcY6pcBSNWk9d0h6A0Tvu56Z2+faLIwe2 7sDw== X-Received: by 10.66.158.132 with SMTP id wu4mr27102773pab.66.1389579024182; Sun, 12 Jan 2014 18:10:24 -0800 (PST) Received: from pyunyh@gmail.com (lpe4.p59-icn.cdngp.net. [114.111.62.249]) by mx.google.com with ESMTPSA id y9sm43576841pas.10.2014.01.12.18.10.20 for (version=TLSv1 cipher=RC4-SHA bits=128/128); Sun, 12 Jan 2014 18:10:23 -0800 (PST) Received: by pyunyh@gmail.com (sSMTP sendmail emulation); Mon, 13 Jan 2014 11:10:18 +0900 From: Yonghyeon PYUN Date: Mon, 13 Jan 2014 11:10:18 +0900 To: Gleb Smirnoff Subject: Re: FreeBSD 10-RC4: Got crash in igb driver Message-ID: <20140113021018.GA3500@michelle.cdnetworks.com> References: <48005124.ny58tnLn4d@pc-alex> <20140110012114.GA3103@michelle.cdnetworks.com> <20140110103529.GE73147@FreeBSD.org> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20140110103529.GE73147@FreeBSD.org> User-Agent: Mutt/1.4.2.3i Cc: jfv@freebsd.org, Alexandre Martins , freebsd-current@freebsd.org, fabien.thomas@netasq.com, damien.deville@netasq.com X-BeenThere: freebsd-current@freebsd.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: pyunyh@gmail.com List-Id: Discussions about the use of FreeBSD-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 13 Jan 2014 02:10:24 -0000 On Fri, Jan 10, 2014 at 02:35:29PM +0400, Gleb Smirnoff wrote: > Yonghyeon, > > On Fri, Jan 10, 2014 at 10:21:14AM +0900, Yonghyeon PYUN wrote: > Y> > I experience some troubles with the igb device driver on FreeBSD 10-RC4. > Y> > > Y> > The kernel make a pagefault in the igb_tx_ctx_setup function when accessing to > Y> > a IPv6 header. > Y> > > Y> > The network configuration is the following: > Y> > - box acting as an IPv6 router > Y> > - one interface with an IPv6 (igb0) > Y> > - another interface with a vlan, and IPv6 on it (vlan0 on igb1) > Y> > > Y> > Vlan Hardware tagging is set on both interfaces. > Y> > > Y> > The packet that cause the crash come from igb0 and go to vlan0. > Y> > > Y> > After investigation, i see that the mbuf is split in two. The first one carry > Y> > the ethernet header, the second, the IPv6 header and data payload. > Y> > > Y> > The split is due to the "m_copy" done in ip6_forward, that make the mbuf not > Y> > writable and the "M_PREPEND" in ether_output that insert the new mbuf before > Y> > the original one. > Y> > > Y> > The kernel crashes only if the newly allocated mbuf is at the end of a memory > Y> > page, and no page is available after this one. So, it's extremly rare. > Y> > > Y> > I inserted a "KASSERT" into the function (see attached patch) to check this > Y> > behavior, and it raises on every IPv6 forwarded packet to the vlan. The > Y> > problem disapear if i remove hardware tagging. > Y> > > Y> > In the commit 256200, i see that pullups has been removed. May it be related ? > Y> > Y> I think I introduced the header parsing code to meet controller > Y> requirement in em(4) and Jack borrowed that code in the past but it > Y> seems it was removed in r256200. It seems igb_tx_ctx_setup() > Y> assumes it can access ethernet/IP/TCP/UDP headers in the first mbuf > Y> of the chain. > Y> This looks wrong to me. > > Can you please restore the important code in head ASAP? Although crashes happen > only when the mbuf is last in a page and page isn't mapped, we read thrash from > next allocation on almost every packet. > It seems other Intel ethernet drivers except em(4) have similar issues. I didn't check recent Intel controllers/drivers for long time so I don't know details on hardware requirements of offloading. Since Jack is very responsive and has hardwares to verify, he would be more appropriate person to handle these issues.