From owner-freebsd-bugs Sun Sep 30 22:30: 7 2001 Delivered-To: freebsd-bugs@hub.freebsd.org Received: from freefall.freebsd.org (freefall.FreeBSD.org [216.136.204.21]) by hub.freebsd.org (Postfix) with ESMTP id 8DCC037B40B for ; Sun, 30 Sep 2001 22:30:01 -0700 (PDT) Received: (from gnats@localhost) by freefall.freebsd.org (8.11.4/8.11.4) id f915U1q19580; Sun, 30 Sep 2001 22:30:01 -0700 (PDT) (envelope-from gnats) Received: from moi.tla.org (64-152-8-49-rev-l3.inyc.com [64.152.8.49]) by hub.freebsd.org (Postfix) with ESMTP id 2FB1A37B40D for ; Sun, 30 Sep 2001 22:22:45 -0700 (PDT) Received: by moi.tla.org (Postfix, from userid 1761) id CE83A7C2F; Mon, 1 Oct 2001 01:22:25 -0400 (EDT) Message-Id: <20011001052225.CE83A7C2F@moi.tla.org> Date: Mon, 1 Oct 2001 01:22:25 -0400 (EDT) From: John "Heldenprogrammer" Ioannidis Reply-To: John "Heldenprogrammer" Ioannidis To: FreeBSD-gnats-submit@freebsd.org X-Send-Pr-Version: 3.113 Subject: kern/30952: kernel panics with 3C905[BC] cards / xl driver Sender: owner-freebsd-bugs@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org >Number: 30952 >Category: kern >Synopsis: kernel panics with 3C905[BC] cards / xl driver >Confidential: no >Severity: serious >Priority: high >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Sun Sep 30 22:30:01 PDT 2001 >Closed-Date: >Last-Modified: >Originator: John "Heldenprogrammer" Ioannidis >Release: FreeBSD 4.4-STABLE i386 >Organization: AT&T Labs - Research >Environment: System: FreeBSD moi.tla.org 4.4-STABLE FreeBSD 4.4-STABLE #0: Mon Sep 17 22:29:36 EDT 2001 ji@eml.research.att.com:/usr/cvsrc/src/sys/compile/EMLGENERIC i386 generic PCs (Pentium-II and Pentium-III processors, enough memory (64M-1G), various Tyan and Supermicro motherboards, 3com 3C905B and 3c905C cards. FreeBSD 4.3-RELEASE through 4.4-STABLE >Description: I'm getting kernel panics when running tcpdump when sniffing my external link. The traps almost always occur in xl_newbuf() (in pci/if_xl.c) where it calls MCLGET(), which would indicate a corrupted, thought to be free, mbuf cluster having been put on the free list. In about twenty crashes I saw the crash occur once in an mget call inside one of the bpf routines, but I was never able to recreate that crash. Here are the relevant facts: * The ethernet signal is known to have bad traffic on it; another driver running under OpenBSD 2.9 (the de(4) driver, called dc(4) in FreeBSD) reports "bad crc" and "alignment problem" errors with received packets, at a rate of a couple of packets per second. * It is not a particular packet that's doing it (two identical machines running identical software crash at different times). * It takes 1-5 minutes on a lightly loaded network (~20Mbps) before the crash occurs, so not all (bad) packets are causing this problem. * If I replay captured traffic (with a sort-of tcpundump program I wrote) in a controlled environment, no crash occurs, so the fault must lie with the bad packets that exist on the wire. * The problem does not exist in other drivers (e.g., the dc(4) driver); I used another machine with that interface to capture the traffic for the experiment in the previous step. * The problem occurs on machines with a variety of hardware speeds (300MHz - 1GHz), with four different motherboards by two different manufacturers (Tyan and Supermicro), and for both the 3c905B and 3c905C versions of the card. * The problem also manifests itself under OpenBSD 2.9 (I don't know about earlier versions). I suspect that when the card is in promiscuous mode, it does something improper when DMAing. I hope there is a way of finding out what's wrong without having to break out my PCI bus analyzer! >How-To-Repeat: good question. I don't know. >Fix: none yet >Release-Note: >Audit-Trail: >Unformatted: To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-bugs" in the body of the message