From owner-freebsd-current@FreeBSD.ORG Fri Jan 10 18:45:30 2014 Return-Path: Delivered-To: freebsd-current@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 258A0EC1; Fri, 10 Jan 2014 18:45:30 +0000 (UTC) Received: from mail-wi0-x236.google.com (mail-wi0-x236.google.com [IPv6:2a00:1450:400c:c05::236]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by mx1.freebsd.org (Postfix) with ESMTPS id 5E6C114AF; Fri, 10 Jan 2014 18:45:29 +0000 (UTC) Received: by mail-wi0-f182.google.com with SMTP id en1so5231111wid.9 for ; Fri, 10 Jan 2014 10:45:27 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=FKwjYpvySfQUUA+GFwe/kx68zwdo7zPXlfpl6S98BKQ=; b=OaAccOktTp6YFs8woe4hh0XGFhoaR64xvyB29cTaHzwFGorM0Y8O3UfNIk7GSwUn03 9+BSI1hEkqsMRg3HSYRB2n7Em1okr+8DClTq7grR+bpQfdu54aJTu8KkPRjk/Dq5uXGi o9dHO1tGyPdSCdgF291DzAXwd3sbJjjt6IAMkn9lUAfxQXUHIDHukkWJOGUh1m6kdBkN 0JytOW+uEB526JYIxfFYRyiIK4xTWOMXca5SW8dAQR0L15gB2QKbwUbTjaHfQUFBPKDB E3TX9LHYqDFs9F4nhhu1iFMjp6iOhoHAc4KcIi88II1PqFpTVK3TYYQGNYDLyXdrd9JY IYNQ== MIME-Version: 1.0 X-Received: by 10.194.2.70 with SMTP id 6mr10102197wjs.25.1389379527555; Fri, 10 Jan 2014 10:45:27 -0800 (PST) Received: by 10.194.20.162 with HTTP; Fri, 10 Jan 2014 10:45:27 -0800 (PST) In-Reply-To: <20140110103529.GE73147@FreeBSD.org> References: <48005124.ny58tnLn4d@pc-alex> <20140110012114.GA3103@michelle.cdnetworks.com> <20140110103529.GE73147@FreeBSD.org> Date: Fri, 10 Jan 2014 10:45:27 -0800 Message-ID: Subject: Re: FreeBSD 10-RC4: Got crash in igb driver From: Jack Vogel To: Gleb Smirnoff Content-Type: text/plain; charset=ISO-8859-1 X-Content-Filtered-By: Mailman/MimeDel 2.1.17 Cc: Yonghyeon PYUN , Damien Deville , Fabien Thomas , Alexandre Martins , FreeBSD Current , Jack F Vogel X-BeenThere: freebsd-current@freebsd.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Discussions about the use of FreeBSD-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 10 Jan 2014 18:45:30 -0000 The changes to igb were to add IPV6 support which previously was only in ixgbe, the transmit path code came from that code base, we did not see this issue in testing. Its not a simple matter of a few lines of code, I think we need to go forward not back... I'll look at the code. Jack On Fri, Jan 10, 2014 at 2:35 AM, Gleb Smirnoff wrote: > Yonghyeon, > > On Fri, Jan 10, 2014 at 10:21:14AM +0900, Yonghyeon PYUN wrote: > Y> > I experience some troubles with the igb device driver on FreeBSD > 10-RC4. > Y> > > Y> > The kernel make a pagefault in the igb_tx_ctx_setup function when > accessing to > Y> > a IPv6 header. > Y> > > Y> > The network configuration is the following: > Y> > - box acting as an IPv6 router > Y> > - one interface with an IPv6 (igb0) > Y> > - another interface with a vlan, and IPv6 on it (vlan0 on igb1) > Y> > > Y> > Vlan Hardware tagging is set on both interfaces. > Y> > > Y> > The packet that cause the crash come from igb0 and go to vlan0. > Y> > > Y> > After investigation, i see that the mbuf is split in two. The first > one carry > Y> > the ethernet header, the second, the IPv6 header and data payload. > Y> > > Y> > The split is due to the "m_copy" done in ip6_forward, that make the > mbuf not > Y> > writable and the "M_PREPEND" in ether_output that insert the new mbuf > before > Y> > the original one. > Y> > > Y> > The kernel crashes only if the newly allocated mbuf is at the end of > a memory > Y> > page, and no page is available after this one. So, it's extremly rare. > Y> > > Y> > I inserted a "KASSERT" into the function (see attached patch) to > check this > Y> > behavior, and it raises on every IPv6 forwarded packet to the vlan. > The > Y> > problem disapear if i remove hardware tagging. > Y> > > Y> > In the commit 256200, i see that pullups has been removed. May it be > related ? > Y> > Y> I think I introduced the header parsing code to meet controller > Y> requirement in em(4) and Jack borrowed that code in the past but it > Y> seems it was removed in r256200. It seems igb_tx_ctx_setup() > Y> assumes it can access ethernet/IP/TCP/UDP headers in the first mbuf > Y> of the chain. > Y> This looks wrong to me. > > Can you please restore the important code in head ASAP? Although crashes > happen > only when the mbuf is last in a page and page isn't mapped, we read thrash > from > next allocation on almost every packet. > > -- > Totus tuus, Glebius. >