From owner-freebsd-current@FreeBSD.ORG Fri Jan 10 10:35:32 2014 Return-Path: Delivered-To: freebsd-current@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 5230AA41; Fri, 10 Jan 2014 10:35:32 +0000 (UTC) Received: from cell.glebius.int.ru (glebius.int.ru [81.19.69.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx1.freebsd.org (Postfix) with ESMTPS id B25CD1E62; Fri, 10 Jan 2014 10:35:31 +0000 (UTC) Received: from cell.glebius.int.ru (localhost [127.0.0.1]) by cell.glebius.int.ru (8.14.7/8.14.7) with ESMTP id s0AAZTlE033533 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Fri, 10 Jan 2014 14:35:29 +0400 (MSK) (envelope-from glebius@FreeBSD.org) Received: (from glebius@localhost) by cell.glebius.int.ru (8.14.7/8.14.7/Submit) id s0AAZTix033532; Fri, 10 Jan 2014 14:35:29 +0400 (MSK) (envelope-from glebius@FreeBSD.org) X-Authentication-Warning: cell.glebius.int.ru: glebius set sender to glebius@FreeBSD.org using -f Date: Fri, 10 Jan 2014 14:35:29 +0400 From: Gleb Smirnoff To: Yonghyeon PYUN Subject: Re: FreeBSD 10-RC4: Got crash in igb driver Message-ID: <20140110103529.GE73147@FreeBSD.org> References: <48005124.ny58tnLn4d@pc-alex> <20140110012114.GA3103@michelle.cdnetworks.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20140110012114.GA3103@michelle.cdnetworks.com> User-Agent: Mutt/1.5.22 (2013-10-16) Cc: jfv@freebsd.org, Alexandre Martins , freebsd-current@freebsd.org, fabien.thomas@netasq.com, damien.deville@netasq.com X-BeenThere: freebsd-current@freebsd.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Discussions about the use of FreeBSD-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 10 Jan 2014 10:35:32 -0000 Yonghyeon, On Fri, Jan 10, 2014 at 10:21:14AM +0900, Yonghyeon PYUN wrote: Y> > I experience some troubles with the igb device driver on FreeBSD 10-RC4. Y> > Y> > The kernel make a pagefault in the igb_tx_ctx_setup function when accessing to Y> > a IPv6 header. Y> > Y> > The network configuration is the following: Y> > - box acting as an IPv6 router Y> > - one interface with an IPv6 (igb0) Y> > - another interface with a vlan, and IPv6 on it (vlan0 on igb1) Y> > Y> > Vlan Hardware tagging is set on both interfaces. Y> > Y> > The packet that cause the crash come from igb0 and go to vlan0. Y> > Y> > After investigation, i see that the mbuf is split in two. The first one carry Y> > the ethernet header, the second, the IPv6 header and data payload. Y> > Y> > The split is due to the "m_copy" done in ip6_forward, that make the mbuf not Y> > writable and the "M_PREPEND" in ether_output that insert the new mbuf before Y> > the original one. Y> > Y> > The kernel crashes only if the newly allocated mbuf is at the end of a memory Y> > page, and no page is available after this one. So, it's extremly rare. Y> > Y> > I inserted a "KASSERT" into the function (see attached patch) to check this Y> > behavior, and it raises on every IPv6 forwarded packet to the vlan. The Y> > problem disapear if i remove hardware tagging. Y> > Y> > In the commit 256200, i see that pullups has been removed. May it be related ? Y> Y> I think I introduced the header parsing code to meet controller Y> requirement in em(4) and Jack borrowed that code in the past but it Y> seems it was removed in r256200. It seems igb_tx_ctx_setup() Y> assumes it can access ethernet/IP/TCP/UDP headers in the first mbuf Y> of the chain. Y> This looks wrong to me. Can you please restore the important code in head ASAP? Although crashes happen only when the mbuf is last in a page and page isn't mapped, we read thrash from next allocation on almost every packet. -- Totus tuus, Glebius.