In message <200108140426.f7E4QHx00824@mirage.ceres.dti.ne.jp>, Izumi Tsutsui wr
ites:
>In article <20010813214012.22B807B76@berkshire.research.att.com>
>smb@research.att.com wrote:
>
>> Aug 13 09:48:15 berkshire /netbsd: panic: pool_get(mclpl): free list modifie
>d: magic=a020beef; page 0xd2269000; item addr 0xd2269800
>> Aug 13 09:48:15 berkshire /netbsd: 
>> Aug 13 09:48:15 berkshire /netbsd: Begin traceback...
>> Aug 13 09:48:15 berkshire /netbsd: _pool_get(c0477680,0,c0392a42,662,c099080
>0) at _pool_get+0x4f0
>> Aug 13 09:48:15 berkshire /netbsd: fxp_add_rfabuf(c0991000,c0994240,1,c0992e
>60,d287bb20) at fxp_add_rfabuf+0xf1
>> Aug 13 09:48:15 berkshire /netbsd: fxp_intr(c0991000) at fxp_intr+0x590
>
>How about the attached patch?
>I saw the similar panic. I'm afraid there are some race conditions
>when fxp runs out of its RFAs, but I cannot reproduce the panic
>any longer...

I'll try it, but as you say, the problem isn't reproducible.  And I 
don't use fxp0 much; most of my connectivity is via wi0.

>
>--- i82557var.h.orig	Tue Aug 14 13:17:28 2001
>+++ i82557var.h	Tue Aug 14 13:17:32 2001
>@@ -294,7 +294,8 @@
> 	__rfa->size = htole16(FXP_RXBUFSIZE((sc), (m)));		\
> 	/* BIG_ENDIAN: no need to swap to store 0 */			\
> 	__rfa->rfa_status = 0;						\
>-	__rfa->rfa_control = htole16(FXP_RFA_CONTROL_EL);		\
>+	__rfa->rfa_control =						\
>+	    htole16(FXP_RFA_CONTROL_EL|FXP_RFA_CONTROL_S);		\
> 	/* BIG_ENDIAN: no need to swap to store 0 */			\
> 	__rfa->actual_size = 0;						\
> 									\
>@@ -317,7 +318,8 @@
> 		    BUS_DMASYNC_POSTREAD|BUS_DMASYNC_POSTWRITE);	\
> 		memcpy((void *)&__p_rfa->link_addr, &__v,		\
> 		    sizeof(__v));					\
>-		__p_rfa->rfa_control &= htole16(~FXP_RFA_CONTROL_EL);	\
>+		__p_rfa->rfa_control &=					\
>+		    htole16(~(FXP_RFA_CONTROL_EL|FXP_RFA_CONTROL_S));	\
> 		FXP_RFASYNC((sc), __p_m,				\
> 		    BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);		\
> 	}								\
>


		--Steve Bellovin, http://www.research.att.com/~smb