Re: Potential re(4) / netbsd-4 / i386 problem?

[Brad du Plessis <bradd%cat.co.za@localhost>]

On 3/6/2010 1:34 AM, David Young wrote:
> On Wed, Mar 03, 2010 at 08:23:39AM +0200, Brad du Plessis wrote:
>    
> > Hi all,
> >
> > I've been seeing panics on a netbsd-4/i386 machine which appears to
> > be related to the reception of oversized frames:
> >
> > re0: discarding oversize frame (len=8813)
> > re0: discarding oversize frame (len=2191)
> > re0: discarding oversize frame (len=10478)
> >      
> A few questions come to mind as I read re_rxeof():
>
> Does the hardware always respect the buffer length that NetBSD writes to
> the Rx descriptors?  Buffer-overrun bugs do happen, even in hardware.
>
> How many fragments do the oversize frames come in?
>
> The driver seems to expect that !RE_RDESC_STAT_EOF is mutually exclusive
> with RE_RDESC_STAT_RXERRSUM.  Maybe that is not really so?
>    

I put a printout in re_rxeof() when sc->re_head!=NULL and I never see 
this (even before it panics)
so I assume I'm never actually getting to process multi-fragment 
packets. I also enabled the
RE_DEBUG printouts (in re_rexeof) and I saw a few of those printouts 
moments before the panic:

re0: discarding oversize frame (len=-4)
re0: RX error (rxstat = 0x1f97e350), frame alignment error, out of 
buffer space, CRC error
re0: RX error (rxstat = 0x1970a3b0), frame alignment error, FIFO 
overrun, giant packet
re0: discarding oversize frame (len=10703)
re0: RX error (rxstat = 0x1d52f996), frame alignment error, FIFO overrun
re0: RX error (rxstat = 0x18736652), frame alignment error, FIFO 
overrun, giant packet
re0: RX error (rxstat = 0x18706240), frame alignment error, FIFO 
overrunm giant packet
uvm_fault(0xc0c90dc0, 0x264b9000, 1) -> 0xe

Not sure if this helps at all.

Regards,
 Brad