From owner-cvs-all@FreeBSD.ORG Wed Feb 2 08:35:12 2005 Return-Path: Delivered-To: cvs-all@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 9C59816A4D1; Wed, 2 Feb 2005 08:35:12 +0000 (GMT) Received: from repoman.freebsd.org (repoman.freebsd.org [216.136.204.115]) by mx1.FreeBSD.org (Postfix) with ESMTP id 79A1243D5A; Wed, 2 Feb 2005 08:35:12 +0000 (GMT) (envelope-from yongari@FreeBSD.org) Received: from repoman.freebsd.org (localhost [127.0.0.1]) by repoman.freebsd.org (8.13.1/8.13.1) with ESMTP id j128ZCap018805; Wed, 2 Feb 2005 08:35:12 GMT (envelope-from yongari@repoman.freebsd.org) Received: (from yongari@localhost) by repoman.freebsd.org (8.13.1/8.13.1/Submit) id j128ZC9g018804; Wed, 2 Feb 2005 08:35:12 GMT (envelope-from yongari) Message-Id: <200502020835.j128ZC9g018804@repoman.freebsd.org> From: Pyun YongHyeon Date: Wed, 2 Feb 2005 08:35:11 +0000 (UTC) To: src-committers@FreeBSD.org, cvs-src@FreeBSD.org, cvs-all@FreeBSD.org X-FreeBSD-CVS-Branch: HEAD Subject: cvs commit: src/sys/dev/hme if_hme.c X-BeenThere: cvs-all@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: CVS commit messages for the entire tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 02 Feb 2005 08:35:12 -0000 yongari 2005-02-02 08:35:11 UTC FreeBSD src repository Modified files: sys/dev/hme if_hme.c Log: Fix "Duplicate mbuf free panic". The cause of "Duplicate mbuf free panic" is in the programming error of hme_load_txmbuf(). The code path of the panic is the following. 1. Due to unknown reason DMA engine was freezed. So TX descritors of HME become full and the last failed attempt to transmit a packet had set its associated mbuf address to hme_txdesc structure. Also the failed packet is requeued into interface queue structure in order to retrasmit it when there are more available TX descritors. 2. Since DMA engine was freezed, if_timer starts to decrement its counter. When if_timer expires it tries to reset HME. During the reset phase, hme_meminit() is called and it frees all associated mbuf with descriptors. The last failed mbuf is also freed here. 3. After HME reset completed, HME starts to retransmit packets by dequeing the first packet in interface queue.(Note! the packet was already freed in hme_meminit()!) 4. When a TX completion interrupt is posted by the HME, driver tries to free the successfylly transmitted mbuf. Since the mbuf was freed in step2, now we get "Duplicate mbuf free panic". However, the real cause is in DMA engine freeze. Since no fatal errors reported via interrupts, there might be other cause of the freeze. I tried hard to understand the cause of DMA engine freeze but couldn't find any clues. It seems that the freeze happens under very high network loads(e.g. 7.5-8.0 MB/s TX speed). Though this fix is not enough to eliminate DMA engine freeze it's better than panic. Reported by: jhb via sparc64 ML Revision Changes Path 1.35 +1 -1 src/sys/dev/hme/if_hme.c