>Number:         22691
>Category:       kern
>Synopsis:       Multiple sip interfaces & kernel compiled without IPv6 causes panic
>Confidential:   no
>Severity:       critical
>Priority:       low
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Fri Sep 05 02:09:00 UTC 2003
>Closed-Date:
>Last-Modified:
>Originator:     jmitchel@bigjar.com
>Release:        1.6-release & current
>Organization:
>Environment:
NetBSD 1.6X (NET4501)  Thu Sep  4 20:35:28 EDT 2003
>Description:
On a machine with 3 sip interfaces and a kernel compiled without IPv6 support, sending more than approx. 127 packets to sip2 causes a kernel panic that looks like this:

sip2: can't load rx DMA map 127, error = 22
panic: sip_add_rxbuf
syncing disks... done

dump to dev 17,1 not possible
rebooting...

The hardware is a soekris Net4501 (a single board computer with an AMD Elan chip and 64Mb RAM -- see www.soekris.com for more details)
The affected computers also have a gif interface configured. The packets are being routed from sip2 to gif0 (which is reached via sip1). Sip0 is configured the same way as sip2, but is not affected.

Here's the rest of the config:

# $NetBSD: NET4501,v 1.20 2003/04/10 22:06:59 christos Exp $
#
# NET4501 -- kernel configuration for a Soekris Engineering net4501
# single-board computer.
#
#	http://www.soekris.com/
# 

include 	"arch/i386/conf/std.i386"

maxusers	32		# estimated number of users
options 	I486_CPU
# AMD Elan SC520's timer runs at a different frequency
options 	TIMER_FREQ=1189200

makeoptions	COPTS="-Os -mcpu=i486"
options 	VNODE_OP_NOINLINE

options         MEMORY_DISK_HOOKS
options         MEMORY_DISK_IS_ROOT
options         MEMORY_DISK_SERVER=0
options         MEMORY_DISK_ROOT_SIZE=9216

options 	DUMMY_NOPS


options 	RTC_OFFSET=0	# hardware clock is this many mins. 
options 	NTP		# NTP phase/frequency locked loop

file-system     FFS
file-system 	MFS		# memory file system

# Networking options
options 	GATEWAY		# packet forwarding
options 	INET		# IP + ICMP + TCP + UDP
#options 	INET6		# IPV6
#options 	IPSEC		# IP security
#options 	IPSEC_ESP	# IP security (encryption part; define w/IPSEC)
#options 	IPSEC_DEBUG	# debug for IP security
#options 	MROUTING	# IP multicast routing
#options 	NS		# XNS
#options 	NSIP		# XNS tunneling over IP
#options 	ISO,TPIP	# OSI
#options 	EON		# OSI tunneling over IP
#options 	CCITT,LLC,HDLC	# X.25
#options 	NETATALK	# AppleTalk networking protocols
#options 	PPP_BSDCOMP	# BSD-Compress compression support for PPP
#options 	PPP_DEFLATE	# Deflate compression support for PPP
#options 	PPP_FILTER	# Active filter support for PPP (requires bpf)
options 	PFIL_HOOKS	# pfil(9) packet filter hooks
#options 	IPFILTER_LOG	# ipmon(8) log support
#options 	TCP_DEBUG	# Record last TCP_NDEBUG packets with SO_DEBUG

# These options enable verbose messages for several subsystems.
# Warning, these may compile large string tables into the kernel!
#options 	MIIVERBOSE	# verbose PHY autoconfig messages
#options 	PCIVERBOSE	# verbose PCI device autoconfig messages
#options 	PCI_CONFIG_DUMP	# verbosely dump PCI config space

options 	NFS_BOOT_DHCP,NFS_BOOT_BOOTPARAM

# Kernel root file system and dump configuration.
config		netbsd	root on ? type ?
#config		netbsd	root on sd0a type ffs
#config		netbsd	root on ? type nfs

#
# Device configuration
#

mainbus0 at root
cpu0 	at mainbus0

# Basic Bus Support

# PCI bus support
pci*	at mainbus? bus ?

# Configure PCI using BIOS information
#options 	PCIBIOS			# PCI BIOS support
#options 	PCIBIOSVERBOSE		# PCI BIOS verbose info
#options 	PCIBIOS_ADDR_FIXUP	# fixup PCI I/O addresses
#options 	PCIBIOS_BUS_FIXUP	# fixup PCI bus numbering
#options 	PCIBIOS_INTR_FIXUP	# fixup PCI interrupt routing
#options 	PCIBIOS_IRQS_HINT=0x0a00 # PCI interrupts hint. IRQ 9 or 11
#options 	PCIBIOS_INTR_GUESS	# see pcibios(4)
#options 	PCIINTR_DEBUG		# super-verbose PCI interrupt fixup

# PCI bridges
elansc*	at pci? dev ? function ?	# Elan SC520 System Controller

# ISA bus support
isa0	at mainbus?

# CardBus bridge support
#cbb*		at pci? dev ? function ?
#cardslot*	at cbb?

# CardBus bus support
#cardbus*	at cardslot?
#pcmcia* 	at cardslot?

# Coprocessor Support

# Math Coprocessor support
npx0	at isa? port 0xf0 irq 13	# x86 math coprocessor

# ISA serial interfaces
com0	at isa? port 0x3f8 irq 4	# Standard PC serial ports
com1	at isa? port 0x2f8 irq 3

# IDE and related devices

# ISA ST506, ESDI, and IDE controllers
# Use flags 0x01 if you want to try to use 32bits data I/O (the driver will
# fall back to 16bits I/O if 32bits I/O are not functional).
# Some controllers pass the initial 32bit test, but will fail later.
wdc0	at isa? port 0x1f0 irq 14 flags 0x00

# IDE drives
# Flags are used only with controllers that support DMA operations
# and mode settings (e.g. some pciide controllers)
# The lowest order four bits (rightmost digit) of the flags define the PIO
# mode to use, the next set of four bits the DMA mode and the third set the
# UltraDMA mode. For each set of four bits, the 3 lower bits define the mode
# to use, and the last bit must be 1 for this setting to be used.
# For DMA and UDMA, 0xf (1111) means 'disable'.
# 0x0fac means 'use PIO mode 4, DMA mode 2, disable UltraDMA'.
# (0xc=1100, 0xa=1010, 0xf=1111)
# 0x0000 means "use whatever the drive claims to support".
wd*	at wdc? channel ? drive ? flags 0x0000

# Network Interfaces

# PCI network interfaces
sip*	at pci? dev ? function ?	# SiS 900/DP83815 Ethernet
#wi*	at pci? dev ? function ?	# Intersil Prism Mini-PCI (802.11b)

# PCMCIA network interfaces
#wi*	at pcmcia? function ?		# Lucent/Intersil WaveLan IEEE (802.11)

# MII/PHY support
nsphyter* at mii? phy ?			# NS83843 PHYs

# Pseudo-Devices

# network pseudo-devices
pseudo-device	bpfilter	16	# Berkeley packet filter
pseudo-device	ipfilter		# IP filter (firewall) and NAT
pseudo-device	loop			# network loopback
#pseudo-device	ppp		2	# Point-to-Point Protocol
#pseudo-device	pppoe			# PPP over Ethernet (RFC 2516)
#pseudo-device	sl		2	# Serial Line IP
#pseudo-device	strip		2	# Starmode Radio IP (Metricom)
#pseudo-device	tun		2	# network tunneling over tty
#pseudo-device	gre		2	# generic L3 over IP tunnel
pseudo-device	gif		4	# IPv[46] over IPv[46] tunnel (RFC1933)
#pseudo-device	faith		1	# IPv[46] tcp relay translation i/f
#pseudo-device	stf		1	# 6to4 IPv6 over IPv4 encapsulation
#pseudo-device	vlan			# IEEE 802.1q encapsulation
#pseudo-device	bridge			# simple inter-network bridging
pseudo-device	md		1

# miscellaneous pseudo-devices
pseudo-device	pty			# pseudo-terminals
#pseudo-device	tb		1	# tablet line discipline
#pseudo-device	sequencer	1	# MIDI sequencer
# rnd works; RND_COM does not on port i386 yet.
pseudo-device	rnd			# /dev/random and in-kernel generator
#options 	RND_COM			# use "com" randomness as well (BROKEN)
pseudo-device	clockctl		# user control of clock subsystem
>How-To-Repeat:
On a kernel as described above, sending approx. 127 packets causes the panic. This happens on at least 3 identical boards with identical NetBSD images. Unfortunately, I don't have another type of machine with three sip interfaces to test with.
>Fix:
Compile the kernel with: options INET6. Make the sip interface code (or the gif interface code) require INET6.

>Release-Note:
>Audit-Trail:
>Unformatted: