From owner-freebsd-net@FreeBSD.ORG Thu Apr 5 19:53:49 2007 Return-Path: X-Original-To: freebsd-net@freebsd.org Delivered-To: freebsd-net@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id B6BCB16A401 for ; Thu, 5 Apr 2007 19:53:49 +0000 (UTC) (envelope-from wawa@yandex-team.ru) Received: from cmail.yandex.ru (cmail.yandex.ru [213.180.193.1]) by mx1.freebsd.org (Postfix) with ESMTP id B383D13C46C for ; Thu, 5 Apr 2007 19:53:48 +0000 (UTC) (envelope-from wawa@yandex-team.ru) Received: from [87.250.227.254] (v3-227-254.yandex.net [87.250.227.254]) by cmail.yandex.ru (8.13.8/8.13.8) with ESMTP id l35JAu1n003995 for ; Thu, 5 Apr 2007 23:10:57 +0400 (MSD) (envelope-from wawa@yandex-team.ru) Message-ID: <461549BD.1020800@yandex-team.ru> Date: Thu, 05 Apr 2007 23:10:53 +0400 From: Vladimir Ivanov User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.13) Gecko/20060717 Debian/1.7.13-0.2ubuntu1 X-Accept-Language: en MIME-Version: 1.0 To: freebsd-net@freebsd.org Content-Type: multipart/mixed; boundary="------------040209070900020908020409" X-Spam-Ystatus: hits=-1000.6 ALLTRUSTEDIP LV_YOU_CAN SICKNESS LV_FREE SP_HTTP_URI FAKE_TEXT_CONTENT_TYPE STRANGE_DUPLETS ALEN_5000 NEWBAYES_099 __MESS_NO_BODY SH_9_100 SH_6_1111 WB_6_D_D SH_6_500 WB_6_B_E __IMAGE__LINK REAL_NAME_TO_ABSENT SPF_PASS DL_DLWC_15 X-Spam-Flag: NO X-Spam-Yversion: Spamooborona 1.7.0-nda Subject: Serious bug in most (?) ethernet drivers (bge, bce, ixgb etc.). X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 05 Apr 2007 19:53:49 -0000 This is a multi-part message in MIME format. --------------040209070900020908020409 Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Hi, We have reported serious bug with em driver (http://www.freebsd.org/cgi/query-pr.cgi?pr=kern/87418) one year and half ago. It's very funny but most freebsd ethernet drivers cloned this bug I seem. You can see same bug in bce, bge, ixgb and so on. I've attached draft patch for bce driver to illustrate the problem. WBR, Vladimir Ivanov Yandex LLC --------------040209070900020908020409 Content-Type: text/x-patch; name="if_bce.c.patch" Content-Transfer-Encoding: 7bit Content-Disposition: inline; filename="if_bce.c.patch" --- if_bce.c.orig Fri Mar 16 00:58:25 2007 +++ if_bce.c Thu Apr 5 02:57:39 2007 @@ -3943,6 +3943,8 @@ bce_rx_intr(struct bce_softc *sc) unsigned int len; u32 status; + m = NULL; + /* Convert the producer/consumer indices to an actual rx_bd index. */ sw_chain_cons = RX_CHAIN_IDX(sw_cons); sw_chain_prod = RX_CHAIN_IDX(sw_prod); @@ -4131,16 +4133,30 @@ bce_rx_intr(struct bce_softc *sc) ifp->if_ipackets++; DBPRINT(sc, BCE_VERBOSE_RECV, "%s(): Passing received frame up.\n", __FUNCTION__); - BCE_UNLOCK(sc); - (*ifp->if_input)(ifp, m); - DBRUNIF(1, sc->rx_mbuf_alloc--); - BCE_LOCK(sc); bce_rx_int_next_rx: sw_prod = NEXT_RX_BD(sw_prod); } sw_cons = NEXT_RX_BD(sw_cons); + + if (m) { + sc->rx_cons = sw_cons; + sc->rx_prod = sw_prod; + sc->rx_prod_bseq = sw_prod_bseq; + + BCE_UNLOCK(sc); + (*ifp->if_input)(ifp, m); + BCE_LOCK(sc); + DBRUNIF(1, sc->rx_mbuf_alloc--); + + sw_cons = sc->rx_cons; + sw_prod = sc->rx_prod; + sw_prod_bseq = sc->rx_prod_bseq; + hw_cons = sc->hw_rx_cons = sblk->status_rx_quick_consumer_index0; + if ((hw_cons & USABLE_RX_BD_PER_PAGE) == USABLE_RX_BD_PER_PAGE) + hw_cons++; + } /* Refresh hw_cons to see if there's new work */ if (sw_cons == hw_cons) { --------------040209070900020908020409--