Skip site navigation (1)Skip section navigation (2)
Date:      Mon,  1 Oct 2001 01:22:25 -0400 (EDT)
From:      John "Heldenprogrammer" Ioannidis <ji@tla.org>
To:        FreeBSD-gnats-submit@freebsd.org
Subject:   kern/30952: kernel panics with 3C905[BC] cards / xl driver
Message-ID:  <20011001052225.CE83A7C2F@moi.tla.org>

next in thread | raw e-mail | index | archive | help

>Number:         30952
>Category:       kern
>Synopsis:       kernel panics with 3C905[BC] cards / xl driver
>Confidential:   no
>Severity:       serious
>Priority:       high
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Sun Sep 30 22:30:01 PDT 2001
>Closed-Date:
>Last-Modified:
>Originator:     John "Heldenprogrammer" Ioannidis
>Release:        FreeBSD 4.4-STABLE i386
>Organization:
AT&T Labs - Research
>Environment:
System: FreeBSD moi.tla.org 4.4-STABLE FreeBSD 4.4-STABLE #0: Mon Sep 17 22:29:36 EDT 2001 ji@eml.research.att.com:/usr/cvsrc/src/sys/compile/EMLGENERIC i386

	generic PCs (Pentium-II and Pentium-III processors,
	enough memory (64M-1G), various Tyan and Supermicro motherboards,
	3com 3C905B and 3c905C cards.

	FreeBSD 4.3-RELEASE through 4.4-STABLE
>Description:

I'm getting kernel panics when running tcpdump when sniffing my
external link.  The traps almost always occur in xl_newbuf() (in
pci/if_xl.c) where it calls MCLGET(), which would indicate a corrupted,
thought to be free, mbuf cluster having been put on the free list.  In
about twenty crashes I saw the crash occur once in an mget call inside
one of the bpf routines, but I was never able to recreate that crash.

Here are the relevant facts:

* The ethernet signal is known to have bad traffic on it; another
  driver running under OpenBSD 2.9 (the de(4) driver, called dc(4) in
  FreeBSD) reports "bad crc" and "alignment problem" errors with
  received packets, at a rate of a couple of packets per second.

* It is not a particular packet that's doing it (two identical
  machines running identical software crash at different times).

* It takes 1-5 minutes on a lightly loaded network (~20Mbps) before
  the crash occurs, so not all (bad) packets are causing this problem.

* If I replay captured traffic (with a sort-of tcpundump program I
  wrote) in a controlled environment, no crash occurs, so the fault
  must lie with the bad packets that exist on the wire.

* The problem does not exist in other drivers (e.g., the dc(4)
  driver); I used another machine with that interface to capture the
  traffic for the experiment in the previous step.

* The problem occurs on machines with a variety of hardware speeds
  (300MHz - 1GHz), with four different motherboards by two different
  manufacturers (Tyan and Supermicro), and for both the 3c905B and
  3c905C versions of the card.

* The problem also manifests itself under OpenBSD 2.9 (I don't know
  about earlier versions).

I suspect that when the card is in promiscuous mode, it does something
improper when DMAing.  I hope there is a way of finding out what's
wrong without having to break out my PCI bus analyzer!

>How-To-Repeat:
	good question. I don't know.
>Fix:
	none yet

>Release-Note:
>Audit-Trail:
>Unformatted:

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-bugs" in the body of the message




Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20011001052225.CE83A7C2F>