FreeBSD Bugzilla – Attachment 152990 Details for
Bug 197535
[re] [panic] if_re (Realtek 8168) causes memory write after free and kernel panic
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
Remember
[x]
|
Forgot Password
Login:
[x]
[patch]
re_cfgv2.diff
re_cfgv2.diff (text/plain), 11.75 KB, created by
Marius Strobl
on 2015-02-15 00:00:59 UTC
(
hide
)
Description:
re_cfgv2.diff
Filename:
MIME Type:
Creator:
Marius Strobl
Created:
2015-02-15 00:00:59 UTC
Size:
11.75 KB
patch
obsolete
>Index: re/if_re.c >=================================================================== >--- re/if_re.c (revision 278524) >+++ re/if_re.c (working copy) >@@ -655,11 +655,19 @@ re_set_rxmode(struct rl_softc *sc) > > ifp = sc->rl_ifp; > >- rxfilt = RL_RXCFG_CONFIG | RL_RXCFG_RX_INDIV | RL_RXCFG_RX_BROAD; >+ rxfilt = RL_RX_MAXDMA | RL_RXCFG_RX_INDIV | RL_RXCFG_RX_BROAD; > if ((sc->rl_flags & RL_FLAG_EARLYOFF) != 0) > rxfilt |= RL_RXCFG_EARLYOFF; > else if ((sc->rl_flags & RL_FLAG_EARLYOFFV2) != 0) > rxfilt |= RL_RXCFG_EARLYOFFV2; >+ if ((sc->rl_flags & RL_FLAG_FETCHMULTI) != 0) >+ rxfilt |= RL_RXCFG_FETCHMULTI; >+ else if ((sc->rl_flags & RL_FLAG_SINGLEFETCHV2) != 0) >+ rxfilt |= RL_RXCFG_SINGLEFETCHV2; >+ if ((sc->rl_flags & RL_FLAG_128INT) != 0) >+ rxfilt |= RL_RXCFG_128INT; >+ if ((sc->rl_flags & RL_FLAG_FIFOTHRESH) != 0) >+ rxfilt |= RL_RXFIFO_NOTHRESH; > > if (ifp->if_flags & (IFF_ALLMULTI | IFF_PROMISC)) { > if (ifp->if_flags & IFF_PROMISC) >@@ -1404,24 +1412,27 @@ re_attach(device_t dev) > > switch (hw_rev->rl_rev) { > case RL_HWREV_8139CPLUS: >- sc->rl_flags |= RL_FLAG_FASTETHER | RL_FLAG_AUTOPAD; >+ sc->rl_flags |= RL_FLAG_FASTETHER | RL_FLAG_AUTOPAD | >+ RL_FLAG_FIFOTHRESH; > break; > case RL_HWREV_8100E: > case RL_HWREV_8101E: >- sc->rl_flags |= RL_FLAG_PHYWAKE | RL_FLAG_FASTETHER; >+ sc->rl_flags |= RL_FLAG_PHYWAKE | RL_FLAG_FASTETHER | >+ RL_FLAG_FIFOTHRESH; > break; >+ case RL_HWREV_8103E: >+ sc->rl_flags |= RL_FLAG_MACSLEEP; >+ /* FALLTHROUGH */ > case RL_HWREV_8102E: > case RL_HWREV_8102EL: > case RL_HWREV_8102EL_SPIN1: > sc->rl_flags |= RL_FLAG_PHYWAKE | RL_FLAG_PAR | RL_FLAG_DESCV2 | > RL_FLAG_MACSTAT | RL_FLAG_FASTETHER | RL_FLAG_CMDSTOP | >- RL_FLAG_AUTOPAD; >+ RL_FLAG_AUTOPAD | RL_FLAG_FIFOTHRESH; > break; >- case RL_HWREV_8103E: >- sc->rl_flags |= RL_FLAG_PHYWAKE | RL_FLAG_PAR | RL_FLAG_DESCV2 | >- RL_FLAG_MACSTAT | RL_FLAG_FASTETHER | RL_FLAG_CMDSTOP | >- RL_FLAG_AUTOPAD | RL_FLAG_MACSLEEP; >- break; >+ case RL_HWREV_8402: >+ sc->rl_flags |= RL_FLAG_CMDSTOP_WAIT_TXQ; >+ /* FALLTHROUGH */ > case RL_HWREV_8401E: > case RL_HWREV_8105E: > case RL_HWREV_8105E_SPIN1: >@@ -1428,17 +1439,12 @@ re_attach(device_t dev) > case RL_HWREV_8106E: > sc->rl_flags |= RL_FLAG_PHYWAKE | RL_FLAG_PHYWAKE_PM | > RL_FLAG_PAR | RL_FLAG_DESCV2 | RL_FLAG_MACSTAT | >- RL_FLAG_FASTETHER | RL_FLAG_CMDSTOP | RL_FLAG_AUTOPAD; >- break; >- case RL_HWREV_8402: >- sc->rl_flags |= RL_FLAG_PHYWAKE | RL_FLAG_PHYWAKE_PM | >- RL_FLAG_PAR | RL_FLAG_DESCV2 | RL_FLAG_MACSTAT | > RL_FLAG_FASTETHER | RL_FLAG_CMDSTOP | RL_FLAG_AUTOPAD | >- RL_FLAG_CMDSTOP_WAIT_TXQ; >+ RL_FLAG_FIFOTHRESH; > break; > case RL_HWREV_8168B_SPIN1: > case RL_HWREV_8168B_SPIN2: >- sc->rl_flags |= RL_FLAG_WOLRXENB; >+ sc->rl_flags |= RL_FLAG_WOLRXENB | RL_FLAG_FIFOTHRESH; > /* FALLTHROUGH */ > case RL_HWREV_8168B_SPIN3: > sc->rl_flags |= RL_FLAG_PHYWAKE | RL_FLAG_MACSTAT; >@@ -1453,25 +1459,22 @@ re_attach(device_t dev) > case RL_HWREV_8168CP: > sc->rl_flags |= RL_FLAG_PHYWAKE | RL_FLAG_PAR | > RL_FLAG_DESCV2 | RL_FLAG_MACSTAT | RL_FLAG_CMDSTOP | >- RL_FLAG_AUTOPAD | RL_FLAG_JUMBOV2 | RL_FLAG_WOL_MANLINK; >+ RL_FLAG_AUTOPAD | RL_FLAG_JUMBOV2 | RL_FLAG_WOL_MANLINK | >+ RL_FLAG_FETCHMULTI | RL_FLAG_128INT; > break; > case RL_HWREV_8168D: >+ case RL_HWREV_8168E: > sc->rl_flags |= RL_FLAG_PHYWAKE | RL_FLAG_PHYWAKE_PM | > RL_FLAG_PAR | RL_FLAG_DESCV2 | RL_FLAG_MACSTAT | > RL_FLAG_CMDSTOP | RL_FLAG_AUTOPAD | RL_FLAG_JUMBOV2 | >- RL_FLAG_WOL_MANLINK; >+ RL_FLAG_WOL_MANLINK | RL_FLAG_128INT; > break; > case RL_HWREV_8168DP: > sc->rl_flags |= RL_FLAG_PHYWAKE | RL_FLAG_PAR | > RL_FLAG_DESCV2 | RL_FLAG_MACSTAT | RL_FLAG_AUTOPAD | >- RL_FLAG_JUMBOV2 | RL_FLAG_WAIT_TXPOLL | RL_FLAG_WOL_MANLINK; >+ RL_FLAG_JUMBOV2 | RL_FLAG_WAIT_TXPOLL | >+ RL_FLAG_WOL_MANLINK | RL_FLAG_128INT | RL_FLAG_LGSENDV2; > break; >- case RL_HWREV_8168E: >- sc->rl_flags |= RL_FLAG_PHYWAKE | RL_FLAG_PHYWAKE_PM | >- RL_FLAG_PAR | RL_FLAG_DESCV2 | RL_FLAG_MACSTAT | >- RL_FLAG_CMDSTOP | RL_FLAG_AUTOPAD | RL_FLAG_JUMBOV2 | >- RL_FLAG_WOL_MANLINK; >- break; > case RL_HWREV_8168E_VL: > case RL_HWREV_8168F: > sc->rl_flags |= RL_FLAG_EARLYOFF; >@@ -1480,7 +1483,8 @@ re_attach(device_t dev) > sc->rl_flags |= RL_FLAG_PHYWAKE | RL_FLAG_PAR | > RL_FLAG_DESCV2 | RL_FLAG_MACSTAT | RL_FLAG_CMDSTOP | > RL_FLAG_AUTOPAD | RL_FLAG_JUMBOV2 | >- RL_FLAG_CMDSTOP_WAIT_TXQ | RL_FLAG_WOL_MANLINK; >+ RL_FLAG_CMDSTOP_WAIT_TXQ | RL_FLAG_WOL_MANLINK | >+ RL_FLAG_128INT | RL_FLAG_AUTOFIFO; > break; > case RL_HWREV_8168EP: > case RL_HWREV_8168G: >@@ -1489,7 +1493,8 @@ re_attach(device_t dev) > RL_FLAG_DESCV2 | RL_FLAG_MACSTAT | RL_FLAG_CMDSTOP | > RL_FLAG_AUTOPAD | RL_FLAG_JUMBOV2 | > RL_FLAG_CMDSTOP_WAIT_TXQ | RL_FLAG_WOL_MANLINK | >- RL_FLAG_EARLYOFFV2 | RL_FLAG_RXDV_GATED; >+ RL_FLAG_EARLYOFFV2 | RL_FLAG_RXDV_GATED | >+ RL_FLAG_SINGLEFETCHV2 | RL_FLAG_128INT | RL_FLAG_AUTOFIFO; > break; > case RL_HWREV_8168GU: > if (pci_get_device(dev) == RT_DEVICEID_8101E) { >@@ -1501,7 +1506,8 @@ re_attach(device_t dev) > sc->rl_flags |= RL_FLAG_PHYWAKE | RL_FLAG_PAR | > RL_FLAG_DESCV2 | RL_FLAG_MACSTAT | RL_FLAG_CMDSTOP | > RL_FLAG_AUTOPAD | RL_FLAG_CMDSTOP_WAIT_TXQ | >- RL_FLAG_EARLYOFFV2 | RL_FLAG_RXDV_GATED; >+ RL_FLAG_EARLYOFFV2 | RL_FLAG_RXDV_GATED | >+ RL_FLAG_SINGLEFETCHV2 | RL_FLAG_128INT | RL_FLAG_AUTOFIFO; > break; > case RL_HWREV_8169_8110SB: > case RL_HWREV_8169_8110SBL: >@@ -1512,7 +1518,7 @@ re_attach(device_t dev) > case RL_HWREV_8169: > case RL_HWREV_8169S: > case RL_HWREV_8110S: >- sc->rl_flags |= RL_FLAG_MACRESET; >+ sc->rl_flags |= RL_FLAG_MACRESET | RL_FLAG_FIFOTHRESH; > break; > default: > break; >@@ -1674,7 +1680,7 @@ re_attach(device_t dev) > ifp->if_capenable &= ~(IFCAP_WOL_UCAST | IFCAP_WOL_MCAST); > /* > * Don't enable TSO by default. It is known to generate >- * corrupted TCP segments(bad TCP options) under certain >+ * corrupted TCP segments (bad TCP options) under certain > * circumstances. > */ > ifp->if_hwassist &= ~CSUM_TSO; >@@ -2813,7 +2819,11 @@ re_encap(struct rl_softc *sc, struct mbuf **m_head > vlanctl = 0; > csum_flags = 0; > if (((*m_head)->m_pkthdr.csum_flags & CSUM_TSO) != 0) { >- if ((sc->rl_flags & RL_FLAG_DESCV2) != 0) { >+ if ((sc->rl_flags & RL_FLAG_LGSENDV2) != 0) { >+ vlanctl |= RL_TDESC_CMD_LGSENDV2 | >+ ((uint32_t)(*m_head)->m_pkthdr.tso_segsz << >+ RL_TDESC_CMD_MSSVALV2_SHIFT); >+ } else if ((sc->rl_flags & RL_FLAG_DESCV2) != 0) { > csum_flags |= RL_TDESC_CMD_LGSEND; > vlanctl |= ((uint32_t)(*m_head)->m_pkthdr.tso_segsz << > RL_TDESC_CMD_MSSVALV2_SHIFT); >@@ -2824,9 +2834,9 @@ re_encap(struct rl_softc *sc, struct mbuf **m_head > } > } else { > /* >- * Unconditionally enable IP checksum if TCP or UDP >- * checksum is required. Otherwise, TCP/UDP checksum >- * doesn't make effects. >+ * Unconditionally enable IP checksuming if TCP or UDP >+ * checksum is required. Otherwise, TCP/UDP checksuming >+ * doesn't take effect. > */ > if (((*m_head)->m_pkthdr.csum_flags & RE_CSUM_FEATURES) != 0) { > if ((sc->rl_flags & RL_FLAG_DESCV2) == 0) { >@@ -2885,9 +2895,9 @@ re_encap(struct rl_softc *sc, struct mbuf **m_head > desc->rl_cmdstat |= htole32(RL_TDESC_CMD_OWN | RL_TDESC_CMD_SOF); > > /* >- * Insure that the map for this transmission >- * is placed at the array index of the last descriptor >- * in this chain. (Swap last and first dmamaps.) >+ * Ensure that the map for this transmission is placed at the array >+ * index of the last descriptor in this chain (swap last and first >+ * dmamap). > */ > txd_last = &sc->rl_ldata.rl_tx_desc[ei]; > map = txd->tx_dmamap; >@@ -3191,9 +3201,10 @@ re_init_locked(struct rl_softc *sc) > CSR_WRITE_4(sc, RL_TXLIST_ADDR_LO, > RL_ADDR_LO(sc->rl_ldata.rl_tx_list_addr)); > >- if ((sc->rl_flags & RL_FLAG_RXDV_GATED) != 0) >- CSR_WRITE_4(sc, RL_MISC, CSR_READ_4(sc, RL_MISC) & >- ~0x00080000); >+ if ((sc->rl_flags & RL_FLAG_RXDV_GATED) != 0) { >+ CSR_WRITE_1(sc, RL_PPSW, CSR_READ_1(sc, RL_PPSW) & ~0x08); >+ DELAY(2000); >+ } > > /* > * Enable transmit and receive. >@@ -3203,17 +3214,18 @@ re_init_locked(struct rl_softc *sc) > /* > * Set the initial TX configuration. > */ >+ reg = RL_TXCFG_CONFIG; > if (sc->rl_testmode) { > if (sc->rl_type == RL_8169) >- CSR_WRITE_4(sc, RL_TXCFG, >- RL_TXCFG_CONFIG|RL_LOOPTEST_ON); >+ reg |= RL_LOOPTEST_ON; > else >- CSR_WRITE_4(sc, RL_TXCFG, >- RL_TXCFG_CONFIG|RL_LOOPTEST_ON_CPLUS); >- } else >- CSR_WRITE_4(sc, RL_TXCFG, RL_TXCFG_CONFIG); >+ reg |= RL_LOOPTEST_ON_CPLUS; >+ } >+ if ((sc->rl_flags & RL_FLAG_AUTOFIFO) != 0) >+ reg |= RL_TXCFG_AUTOFIFO; >+ CSR_WRITE_4(sc, RL_TXCFG, reg); > >- CSR_WRITE_1(sc, RL_EARLY_TX_THRESH, 16); >+ CSR_WRITE_1(sc, RL_EARLY_TX_THRESH, RL_EARLYTXTHRESH_CNT); > > /* > * Set the initial RX configuration. >@@ -3584,6 +3596,11 @@ re_stop(struct rl_softc *sc) > ~(RL_RXCFG_RX_ALLPHYS | RL_RXCFG_RX_INDIV | RL_RXCFG_RX_MULTI | > RL_RXCFG_RX_BROAD)); > >+ if ((sc->rl_flags & RL_FLAG_RXDV_GATED) != 0) { >+ CSR_WRITE_1(sc, RL_PPSW, CSR_READ_1(sc, RL_PPSW) | 0x08); >+ DELAY(2000); >+ } >+ > if ((sc->rl_flags & RL_FLAG_WAIT_TXPOLL) != 0) { > for (i = RL_TIMEOUT; i > 0; i--) { > if ((CSR_READ_1(sc, sc->rl_txstart) & >Index: rl/if_rlreg.h >=================================================================== >--- rl/if_rlreg.h (revision 278524) >+++ rl/if_rlreg.h (working copy) >@@ -146,11 +146,13 @@ > #define RL_MAXRXPKTLEN 0x00DA /* 16 bits, chip multiplies by 8 */ > #define RL_INTRMOD 0x00E2 /* 16 bits */ > #define RL_MISC 0x00F0 >+#define RL_PPSW 0x00F2 > > /* > * TX config register bits > */ > #define RL_TXCFG_CLRABRT 0x00000001 /* retransmit aborted pkt */ >+#define RL_TXCFG_AUTOFIFO 0x00000080 /* 8168E-VL or higher */ > #define RL_TXCFG_MAXDMA 0x00000700 /* max DMA burst size */ > #define RL_TXCFG_QUEUE_EMPTY 0x00000800 /* 8168E-VL or higher */ > #define RL_TXCFG_CRCAPPEND 0x00010000 /* CRC append (0 = yes) */ >@@ -286,11 +288,16 @@ > #define RL_RXCFG_RX_BROAD 0x00000008 /* accept all broadcast */ > #define RL_RXCFG_RX_RUNT 0x00000010 > #define RL_RXCFG_RX_ERRPKT 0x00000020 >+#define RL_RXCFG_9356SEL 0x00000040 > #define RL_RXCFG_WRAP 0x00000080 > #define RL_RXCFG_EARLYOFFV2 0x00000800 > #define RL_RXCFG_MAXDMA 0x00000700 > #define RL_RXCFG_BUFSZ 0x00001800 >+#define RL_RXCFG_HALFREFETCH 0x00002000 > #define RL_RXCFG_EARLYOFF 0x00003800 >+#define RL_RXCFG_FETCHMULTI 0x00004000 >+#define RL_RXCFG_SINGLEFETCHV2 0x00004000 >+#define RL_RXCFG_128INT 0x00008000 > #define RL_RXCFG_FIFOTHRESH 0x0000E000 > #define RL_RXCFG_EARLYTHRESH 0x07000000 > >@@ -656,7 +663,7 @@ struct rl_desc { > #define RL_TDESC_CMD_IPCSUM 0x00040000 /* IP header checksum enable */ > #define RL_TDESC_CMD_MSSVAL 0x07FF0000 /* Large send MSS value */ > #define RL_TDESC_CMD_MSSVAL_SHIFT 16 /* Large send MSS value shift */ >-#define RL_TDESC_CMD_LGSEND 0x08000000 /* TCP large send enb */ >+#define RL_TDESC_CMD_LGSEND 0x08000000 /* TCP large send enable */ > #define RL_TDESC_CMD_EOF 0x10000000 /* end of frame marker */ > #define RL_TDESC_CMD_SOF 0x20000000 /* start of frame marker */ > #define RL_TDESC_CMD_EOR 0x40000000 /* end of ring marker */ >@@ -664,6 +671,8 @@ struct rl_desc { > > #define RL_TDESC_VLANCTL_TAG 0x00020000 /* Insert VLAN tag */ > #define RL_TDESC_VLANCTL_DATA 0x0000FFFF /* TAG data */ >+/* 8168DP */ >+#define RL_TDESC_CMD_LGSENDV2 0x00010000 > /* RTL8168C/RTL8168CP/RTL8111C/RTL8111CP */ > #define RL_TDESC_CMD_UDPCSUMV2 0x80000000 > #define RL_TDESC_CMD_TCPCSUMV2 0x40000000 >@@ -932,6 +941,12 @@ struct rl_softc { > #define RL_FLAG_EARLYOFF 0x00020000 > #define RL_FLAG_EARLYOFFV2 0x00040000 > #define RL_FLAG_RXDV_GATED 0x00080000 >+#define RL_FLAG_FETCHMULTI 0x00100000 >+#define RL_FLAG_SINGLEFETCHV2 0x00200000 >+#define RL_FLAG_128INT 0x00400000 >+#define RL_FLAG_FIFOTHRESH 0x00800000 >+#define RL_FLAG_AUTOFIFO 0x01000000 >+#define RL_FLAG_LGSENDV2 0x02000000 > #define RL_FLAG_PCIE 0x40000000 > #define RL_FLAG_LINK 0x80000000 > };
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
Attachments on
bug 197535
:
152865
|
152866
| 152990 |
153780