>Number:         6505
>Category:       bin
>Synopsis:       egcs-compiled kernel dies in we_write_mbuf
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    bin-bug-people (Utility Bug People)
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sat Nov 28 08:05:00 1998
>Last-Modified:
>Originator:     bouyer@antioche.lip6.fr (Manuel Bouyer)
>Organization:

LIP6, Universite Paris VI.

>Release:        kernel source cvs co'd yesterday. Userland is a week old.
>Environment:
	
System: NetBSD rochebonne.lip6.fr 1.3I NetBSD 1.3I (ROCHEBONNE) #3: Sat Nov 28 16:11:38 MET 1998 bouyer@rochebonne.lip6.fr:/home/bouyer/1.3I/src/sys/arch/i386/compile/ROCHEBONNE i386


>Description:

	(submitted in category bin, because I believe this is a compiler bug).
	A kernel compiled with egcs dies at ifconfig time. This machine has
	a:
	we1 at isa0 port 0x300-0x31f iomem 0xcc000-0xcffff irq 10
	we1: WD8013EBT Ethernet (16-bit)
	we1: Ethernet address 00:80:ad:03:2c:c1
	(kernel config file below).

	At ifconfig time I get:
	uvm_fault(0xfdf412b0, 0x0, 0 ,1) -> 1
	kernel: page fault trap, code=0
	Stopped in ifconfig at _we_write_mbuf+0x2ab: movl 0x1c8(%edx),%ebx

	The start of the trace is: 
	we_write_mbuf(f042c200,0,2a,e000d442,0) at we_write_mbuf+0x2ab
	dp8390_start(f042c234) at dp8390_start+0xca
	ether_output(f042c234,f044d000,fdf5bc58,0,f042b380) at ether_output+0x43c
	[...]

	dp8390_start+0xca is:
	(gdb) list *(dp8390_start+0xca)
	0xf010281a is in dp8390_start (../../../../dev/ic/dp8390.c:470).
	465             /* txb_new points to next open buffer slot. */
	466             buffer = sc->mem_start +
	467                 ((sc->txb_new * ED_TXBUF_SIZE) << ED_PAGE_SHIFT);
	468
	469             if (sc->write_mbuf)
	470                     len = (*sc->write_mbuf)(sc, m0, buffer);
	471             else
	472                     len = dp8390_write_mbuf(sc, m0, buffer);
	473
	474             m_freem(m0);

	we_write_mbuf+0x2ab is:
	(gdb) list *(we_write_mbuf+0x2ab)
	0xf01e2417 is in we_write_mbuf (../../../../dev/isa/if_we.c:756).
	751             we_readmem(wsc, src, dst, amount);
	752
	753             return (src + amount);
	754     }
	755
	756     void
	757     we_read_hdr(sc, packet_ptr, packet_hdrp)
	758             struct dp8390_softc *sc;
	759             int packet_ptr;
	760             struct dp8390_ring *packet_hdrp;

	So here's the weird thing: at line 754, this is the closing brace of
	_we_ring_copy, not _we_write_mbuf. Either the stack trace got
	corrupted, or the 'ret' of _we_write_mbuf was skipped. Unfortunably
	I don't understand the assembly output, so I can't tell
	more here.

	Recompiling if_we.c with cc -g -O instead of cc -g -O2 produce a
	working kernel. This problem is not new: it was already here when
	egcs was the i386's default compiler the first time.

	I can provide the assembly output for both -O and -O2, as well as a
	kernel binary and core dump.

	Here's the config file:

#	$NetBSD: GENERIC,v 1.82.2.1 1997/07/01 17:33:55 bouyer Exp $
#
#	GENERIC -- everything that's currently supported
#

include "arch/i386/conf/std.i386"

options 	I486_CPU
options 	VM86		# Virtual 8086 emulation

# Some BIOSes don't get the size of extended memory right.  If you
# have a broken BIOS, uncomment the following and set the value
# properly for your system.
#options 	BIOSEXTMEM=...	# size of extended memory

#options 	DUMMY_NOPS	# speed hack; recommended
options 	XSERVER,UCONSOLE
#options 	INSECURE	# insecure; allow /dev/mem writing for X

maxusers	32		# estimated number of users
options 	RTC_OFFSET=0	# hardware clock is this many mins. west of GMT
#options 	NTP		# NTP phase/frequency locked loop

options 	DDB		# in-kernel debugger
makeoptions	DEBUG="-g"	# compile full symbol table
options 	DIAGNOSTIC	# internal consistency checks
options 	KTRACE		# system call tracing, a la ktrace(1)

options 	SYSVMSG		# System V-like message queues
options 	SYSVSEM		# System V-like semaphores
options 	SYSVSHM		# System V-like memory sharing
#options 	SHMMAXPGS=1024	# 1024 pages is the default

options 	COMPAT_NOMID	# compatibility with 386BSD, BSDI, NetBSD 0.8,
options 	COMPAT_09	# NetBSD 0.9,
options 	COMPAT_10	# NetBSD 1.0,
options 	COMPAT_11	# NetBSD 1.1,
options 	COMPAT_12	# NetBSD 1.2,
options 	COMPAT_13	# NetBSD 1.3,
options 	COMPAT_43	# and 4.3BSD
options 	TCP_COMPAT_42	# TCP bug compatibility with 4.2BSD
options 	COMPAT_386BSD_MBRPART # recognize old partition ID

#options 	COMPAT_SVR4	# binary compatibility with SVR4
#options 	COMPAT_IBCS2	# binary compatibility with SCO and ISC
#options 	COMPAT_LINUX	# binary compatibility with Linux
options 	COMPAT_FREEBSD	# binary compatibility with FreeBSD

#options 	EXEC_ELF32	# 32-bit ELF executables (SVR4, Linux)

options 	USER_LDT	# user-settable LDT; used by WINE
options 	LKM		# loadable kernel modules

file-system 	FFS		# UFS
#file-system 	EXT2FS		# second extended file system (linux)
#file-system 	LFS		# log-structured file system
file-system 	MFS		# memory file system
file-system 	NFS		# Network File System client
file-system 	CD9660		# ISO 9660 + Rock Ridge file system
#file-system 	MSDOSFS		# MS-DOS file system
#file-system 	FDESC		# /dev/fd
#file-system 	KERNFS		# /kern
file-system 	NULLFS		# loopback file system
#file-system 	PORTAL		# portal filesystem (still experimental)
#file-system 	PROCFS		# /proc
#file-system 	UMAPFS		# NULLFS + uid and gid remapping
file-system 	UNION		# union file system

#options 	QUOTA		# UFS quotas
options 	FFS_EI		# FFS Endian Independant support
options 	NFSSERVER	# Network File System server
options 	FIFO		# FIFOs; RECOMMENDED
#options 	EXT2FS_SYSTEM_FLAGS # makes ext2fs file flags (append and
				# immutable) behave as system flags.

options 	GATEWAY		# packet forwarding
options 	INET		# IP + ICMP + TCP + UDP
#options 	MROUTING	# IP multicast routing
#options 	NS		# XNS
#options 	NSIP		# XNS tunneling over IP
#options 	ISO,TPIP	# OSI
#options 	EON		# OSI tunneling over IP
#options 	CCITT,LLC,HDLC	# X.25
#options 	PFIL_HOOKS	# pfil(9) packet filter hooks
#options 	IPFILTER_LOG # ipmon(8) log support

config		netbsd	root on ? type ?
#options 	COMCONSOLE=0,CONADDR=0x3f8,CONUNIT=0,CONSPEED=9600

#options 	EISAVERBOSE	# verbose EISA device messages
#options 	PCIVERBOSE	# verbose PCI device messages
options 	SCSIVERBOSE	# human readable SCSI error messages

options		NBUF=5000
options		BUFPAGES=5000
options 	NKMEMCLUSTERS=8192

mainbus0 at root

pci0	at mainbus0 bus ?
eisa0	at mainbus0

#ppb*	at pci? dev ? function ?	# PCI-PCI bridges
#pci*	at ppb? bus ?
pchb*	at pci? dev ? function ?	# PCI-Host bridges
pci*	at pchb?
pcib*	at pci? dev ? function ?	# PCI-ISA bridges

isa*	at pcib?			# ISA on PCI-ISA bridge
isa*	at mainbus0			# all other ISA

#apm0	at mainbus0			# Advanced power management

npx0	at isa? port 0xf0 irq 13	# math coprocessor

pc0	at isa? port 0x60 irq 1		# generic PC console device
#vt0	at isa? port 0x60 irq 1

pcppi0	at isa?
sysbeep0	at pcppi?

com0	at isa? port 0x3f8 irq 4	# standard PC serial ports
com1	at isa? port 0x2f8 irq 3
com2	at isa? port 0x3e8 irq 5
#com3	at isa? port 0x2e8 irq 9
#ast0	at isa? port 0x1a0 irq 5	# AST 4-port serial cards
#com*	at ast? slave ?
#boca0	at isa? port 0x100 irq 5	# BOCA 8-port serial cards
#com*	at boca? slave ?
#rtfps0	at isa? port 0x1230 irq 10	# RT 4-port serial cards
#com*	at rtfps? slave ?
#cy0	at isa? iomem 0xd4000 irq 12	# Cyclades serial cards
#cy*	at pci? dev ? function ?	# Cyclades serial cards
  
#lpt0	at isa? port 0x378 irq 7	# standard PC parallel ports
#lpt1	at isa? port 0x278
#lpt2	at isa? port 0x3bc

#lms0	at isa? port 0x23c irq 5	# Logitech bus mouse
#lms1	at isa? port 0x238 irq 5
#mms0	at isa? port 0x23c irq 5	# Microsoft InPort mouse
#mms1	at isa? port 0x238 irq 5
#pms0	at pckbd? irq 12		# PS/2 auxiliary port mouse

#aha0	at isa? port 0x330 irq ? drq ?	# Adaptec 154[02] SCSI controllers
#aha1	at isa? port 0x334 irq ? drq ?	# Adaptec 154[02] SCSI controllers
#scsibus* at aha?
#ahb*	at eisa? slot ?			# Adaptec 174[024] SCSI controllers
#scsibus* at ahb?
#ahc0	at isa? port ? irq ?		# Adaptec 284x SCSI controllers
#ahc*	at eisa? slot ?			# Adaptec 274x, aic7770 SCSI controllers
#ahc*	at pci? dev ? function ?	# Adaptec [23]94x, aic78x0 SCSI controllers
#scsibus* at ahc?
#aic0	at isa? port 0x340 irq 11	# Adaptec 152[02] SCSI controllers
#scsibus* at aic?
#bha0	at isa? port 0x330 irq ? drq ?	# BusLogic [57]4X SCSI controllers
#bha1	at isa? port 0x334 irq ? drq ?	# BusLogic [57]4X SCSI controllers
#bha*	at eisa? slot ?
#bha*	at pci? dev ? function ?
#scsibus* at bha?
ncr*	at pci? dev ? function ?	# NCR 538XX SCSI controllers
scsibus* at ncr?
#sea0	at isa? iomem 0xc8000 irq 5
#scsibus* at sea?
#uha0	at isa? port 0x330 irq ? drq ?	# UltraStor [13]4f SCSI controllers
#uha1	at isa? port 0x334 irq ? drq ?	# UltraStor [13]4f SCSI controllers
#uha*	at eisa? slot ?			# UltraStor 24f SCSI controllers
#scsibus* at uha?
#wds0	at isa? port 0x350 irq 15 drq 6	# WD7000 and TMC-7000 controllers
#wds1	at isa? port 0x358 irq 11 drq 5
#scsibus* at wds?
#isp*	at pci? dev ? function ?	# Qlogic ISP 10x0 SCSI controllers
#scsibus* at isp?

sd*	at scsibus? target ? lun ?	# SCSI disk drives
#st*	at scsibus? target ? lun ?	# SCSI tape drives
#cd*	at scsibus? target ? lun ?	# SCSI CD-ROM drives
#ch*	at scsibus? target ? lun ?	# SCSI autochangers
#ss*	at scsibus? target ? lun ?	# SCSI scanners
#uk*	at scsibus? target ? lun ?	# SCSI unknown
#se0    at scsibus? target ? lun ?

fdc0	at isa? port 0x3f0 irq 6 drq 2	# standard PC floppy controllers
#fdc1	at isa? port 0x370 irq ? drq ?
fd*	at fdc? drive ?

#mcd0	at isa? port 0x300 irq 10	# Mitsumi CD-ROM drives

pciide* at pci? dev ? function ? # PCI IDE
wdc0	at isa? port 0x1f0 irq 14	# ST506, ESDI, and IDE controllers
wdc1	at isa? port 0x170 irq 15
wd*	at wdc? channel ? drive ?
wd*	at pciide? channel ? drive ?
atapibus* at wdc? channel ?
atapibus* at pciide? channel ?
cd* at atapibus? drive ?
uk* at atapibus? drive ?

# note: the wt driver conflicts unpleasantly with ed devices at the
# same I/O address. The probe reprograms their eeproms. Don't
# uncomment it unless you are actually using it.
#wt0	at isa? port 0x300 irq 5 drq 1	# Archive and Wangtek QIC tape drives

we0 	at isa? port 0x280 iomem 0xd0000 irq 9  # WD/SMC Ethernet
we1 	at isa? port 0x300 iomem 0xcc000 irq 10
#eg0	at isa? ...				# 3C505 ethernet cards
#el0	at isa? port 0x300 irq 9		# 3C501 ethernet cards
#ep0	at isa? port ? irq ?			# 3C509 ethernet cards
#ie0	at isa? port 0x360 iomem 0xd0000 irq 7	# StarLAN and 3C507
#ie1	at isa? port 0x300 irq 10		# EtherExpress
#le0	at isa? port 0x320 irq 10 drq 7		# IsoLan, NE2100, and DEPCA
#ep*	at eisa? slot ?				# 3C579 ethernet cards
#fea*	at eisa? slot ?				# DEC DEFEA FDDI cards
#le*	at pci? dev ? function ?		# PCnet-PCI based ethernet cards
#de*	at pci? dev ? function ?		# DC21X4X-based ethernet cards
#ep*	at pci? dev ? function ?		# 3C590 ethernet cards
#fpa*	at pci? dev ? function ?		# DEC DEFPA FDDI cards
#fxp*	at pci? dev ? function ?		# Intel EEPRO 10/100B

#pss0	at isa? port 0x220 irq 7 drq 6  # Personal Sound System
#sp0	at pss0 port 0x530 irq 10 drq 0	# 	sound port driver

#sb0	at isa? port 0x220 irq 7 drq 1	# SoundBlaster
#wss0	at isa? port 0x530 irq 10 drq 0	# Windows Sound System
#pas0	at isa? port 0x220 irq 7 drq 1	# ProAudio Spectrum
#gus0	at isa? port 0x220 irq 7 drq 1 flags 6 # Gravis Ultra Sound (flags is record drq for full-duplex)
#spkr0	at pcppi?

# Joystick driver. Probe is a little strange; add only if you have one.
#joy0	at isa? port 0x201

# PnP bus and devices should be declared last 
#isapnp0	at isa? 
#ep*	at isapnp?
#sb*	at isapnp?
#joy*	at isapnp?

pseudo-device	loop	1		# network loopback
pseudo-device	bpfilter 8		# packet filter
pseudo-device	sl	2		# CSLIP
pseudo-device	ppp	2		# PPP
pseudo-device	tun	2		# network tunneling over tty
#pseudo-device	ipfilter		# ip filter

pseudo-device	pty	64		# pseudo-terminals
pseudo-device	tb	1		# tablet line discipline
pseudo-device	vnd	4		# paging to files
#pseudo-device	ccd	4		# concatenated disk devices

>How-To-Repeat:
	Build a -current kernel with egcs. Boot in on a machine which uses
	a WD8013EBT ethernet board. ifconfig the board.
>Fix:
	unknow fix. As a workaround, compiling if_we.o with cc -O instead
	of cc -O2 produces a working kernel.
>Audit-Trail:
>Unformatted: