Bug 144492 - [fxp] The fxp driver does not handle Frame Check Sequence (CRC) errors correctly.
Summary: [fxp] The fxp driver does not handle Frame Check Sequence (CRC) errors correc...
Status: Open
Alias: None
Product: Base System
Classification: Unclassified
Component: kern (show other bugs)
Version: Unspecified
Hardware: Any Any
: Normal Affects Only Me
Assignee: freebsd-bugs (Nobody)
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2010-03-05 13:40 UTC by Rainer Bredehorn
Modified: 2017-12-31 22:32 UTC (History)
0 users

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Rainer Bredehorn 2010-03-05 13:40:01 UTC
If a Frame Check Sequence (FCS) of a packet is wrong you can see this
packet with a packet sniffer (wireshark/tcpdump) via the BPF hook in
the ether_input() function.  Other network driver discard the frame.

File: sys/dev/fxp/if_fxp.c
Function: fxp_intr_body

The error handling after checking the status flag FXP_RFA_STATUS_CRC
seems to be wrong.

How-To-Repeat: Connect the FreeBSD 7.1 machine to a ethernet hub. Generate traffic so
that the hub shows collisions.
Comment 1 Mark Linimon freebsd_committer freebsd_triage 2010-03-08 07:12:23 UTC
Responsible Changed
From-To: freebsd-i386->freebsd-net

This does not sound i386-specific.
Comment 2 Pyun YongHyeon freebsd_committer freebsd_triage 2010-03-08 18:46:31 UTC
State Changed
From-To: open->feedback

I don't think 7.1-RELEASE has enhancements made by me so it may 
have some edge cases. But the description looks odd. Would you 
elaborate what's your problem on fxp(4)? 
fxp(4) driver drops frames with CRC errors(e.g. FCS errors) so you 
can't even see these frames with bpf(4)? Also show me the output of 
"pciconf -lcbv". 


Comment 3 Pyun YongHyeon freebsd_committer freebsd_triage 2010-03-08 18:46:31 UTC
Responsible Changed
From-To: freebsd-net->yongari

Take.
Comment 4 Rainer Bredehorn 2010-03-09 09:01:39 UTC
The problem is that I can see packets with wrong Frame Check Sequence with a packet sniffer. This shouldn't happen. The driver should discard the packet but he dosen't.
Wireshark shows strange packets in this case e.g mac addresses with 34:34:34:34:34:34.

The driver source code shows that the FXP_RFA_STATUS_CRC flag of the status register is checked. If it is set the mbuf is deleted and a "continue" follows. Otherwise the ether_input function is called ( (*ifp->if_input)(ifp, m) ).

The FXP_RFA_STATUS_CRC flag is checked after the fxp_add_rfabuf(sc, rxp) function. If I check this flag and discard the packet before calling the fxp_add_rbuf() function the packet is not seen by a packet sniffer.

FreeBSD 6.1 shows the same behavior. I have also tried a Linux (Knoppix) on the same hardware. Linux discards the packets correctly.

Even on different hardware platforms which use the same (fxp) networkdriver I can see the "strange" packets on a packet sniffer.

Here is the pciconf output from one hardware:

hostb0@pci0:0:0:0:	class=0x060000 card=0x00000000 chip=0x35808086 rev=0x02 hdr=0x00
    vendor     = 'Intel Corporation'
    device     = '82852GM/GME/GMV/PM, 855GM/GME Montara Host-Hub Interface Bridge'
    class      = bridge
    subclass   = HOST-PCI
    cap 09[40] = vendor (length 5) Intel cap 8 version 1
none0@pci0:0:0:1:	class=0x088000 card=0x35848086 chip=0x35848086 rev=0x02 hdr=0x00
    vendor     = 'Intel Corporation'
    device     = '82852GM/GME/GMV/PM, 855GM/GME Montara System Memory Controller'
    class      = base peripheral
none1@pci0:0:0:3:	class=0x088000 card=0x35858086 chip=0x35858086 rev=0x02 hdr=0x00
    vendor     = 'Intel Corporation'
    device     = '82852GM/GME/GMV/PM, 855GM/GME Montara Configuration Process'
    class      = base peripheral
vgapci0@pci0:0:2:0:	class=0x030000 card=0x35828086 chip=0x35828086 rev=0x02 hdr=0x00
    vendor     = 'Intel Corporation'
    device     = '82852GM/GME/GMV/PM, 855GM/GME Montara Integrated Graphics Device'
    class      = display
    subclass   = VGA
    cap 01[d0] = powerspec 1  supports D0 D1 D3  current D0
vgapci1@pci0:0:2:1:	class=0x038000 card=0x35828086 chip=0x35828086 rev=0x02 hdr=0x00
    vendor     = 'Intel Corporation'
    device     = '82852GM/GME/GMV/PM, 855GM/GME Montara Integrated Graphics Device'
    class      = display
    cap 01[d0] = powerspec 1  supports D0 D1 D3  current D0
uhci0@pci0:0:29:0:	class=0x0c0300 card=0x24c08086 chip=0x24c28086 rev=0x02 hdr=0x00
    vendor     = 'Intel Corporation'
    device     = '82801DB/DBL/DBM (ICH4/ICH4-L/ICH4-M) USB UHCI Controller'
    class      = serial bus
    subclass   = USB
uhci1@pci0:0:29:1:	class=0x0c0300 card=0x24c08086 chip=0x24c48086 rev=0x02 hdr=0x00
    vendor     = 'Intel Corporation'
    device     = '82801DB/DBL/DBM (ICH4/ICH4-L/ICH4-M) USB UHCI Controller'
    class      = serial bus
    subclass   = USB
uhci2@pci0:0:29:2:	class=0x0c0300 card=0x24c08086 chip=0x24c78086 rev=0x02 hdr=0x00
    vendor     = 'Intel Corporation'
    device     = '82801DB/DBL/DBM (ICH4/ICH4-L/ICH4-M) USB UHCI Controller'
    class      = serial bus
    subclass   = USB
ehci0@pci0:0:29:7:	class=0x0c0320 card=0x24c08086 chip=0x24cd8086 rev=0x02 hdr=0x00
    vendor     = 'Intel Corporation'
    device     = '82801DB/DBL/DBM (ICH4/ICH4-L/ICH4-M) USB 2.0 EHCI Controller'
    class      = serial bus
    subclass   = USB
    cap 01[50] = powerspec 2  supports D0 D3  current D0
    cap 0a[58] = EHCI Debug Port at offset 0x80 in map 0x14
pcib1@pci0:0:30:0:	class=0x060400 card=0x00000000 chip=0x244e8086 rev=0x82 hdr=0x01
    vendor     = 'Intel Corporation'
    device     = '82801 Family (ICH2/3/4/4/5/5/6/7/8/9,63xxESB) Hub Interface to PCI Bridge'
    class      = bridge
    subclass   = PCI-PCI
isab0@pci0:0:31:0:	class=0x060100 card=0x00000000 chip=0x24c08086 rev=0x02 hdr=0x00
    vendor     = 'Intel Corporation'
    device     = '82801DB/DBL (ICH4/ICH4-L) LPC Interface Bridge'
    class      = bridge
    subclass   = PCI-ISA
atapci0@pci0:0:31:1:	class=0x01018a card=0x24c08086 chip=0x24cb8086 rev=0x02 hdr=0x00
    vendor     = 'Intel Corporation'
    device     = '82801DB/DBL (ICH4/ICH4-L) UltraATA/100 EIDE Controller'
    class      = mass storage
    subclass   = ATA
none2@pci0:0:31:3:	class=0x0c0500 card=0x24c08086 chip=0x24c38086 rev=0x02 hdr=0x00
    vendor     = 'Intel Corporation'
    device     = '82801DB/DBL/DBM (ICH4/ICH4-L/ICH4-M) SMBus Controller'
    class      = serial bus
    subclass   = SMBus
none3@pci0:0:31:5:	class=0x040100 card=0x4740414c chip=0x24c58086 rev=0x02 hdr=0x00
    vendor     = 'Intel Corporation'
    device     = '82801DB/DBL/DBM (ICH4/ICH4-L/ICH4-M) AC'97 Audio Controller'
    class      = multimedia
    subclass   = audio
    cap 01[50] = powerspec 2  supports D0 D3  current D0
fxp0@pci0:1:4:0:	class=0x020000 card=0x000c8086 chip=0x12298086 rev=0x10 hdr=0x00
    vendor     = 'Intel Corporation'
    device     = '82550/1/7/8/9 EtherExpress PRO/100(B) Ethernet Adapter'
    class      = network
    subclass   = ethernet
    cap 01[dc] = powerspec 2  supports D0 D1 D2 D3  current D0
fxp1@pci0:1:12:0:	class=0x020000 card=0x00708086 chip=0x12098086 rev=0x10 hdr=0x00
    vendor     = 'Intel Corporation'
    device     = '8255xER/IT Fast Ethernet Controller'
    class      = network
    subclass   = ethernet
    cap 01[dc] = powerspec 2  supports D0 D1 D2 D3  current D0

Best regards, 

Rainer Bredehorn
-- 
Sicherer, schneller und einfacher. Die aktuellen Internet-Browser -
jetzt kostenlos herunterladen! http://portal.gmx.net/de/go/chbrowser
Comment 5 Pyun YongHyeon freebsd_committer freebsd_triage 2011-09-28 17:22:59 UTC
State Changed
From-To: feedback->open

Feedback received and it's still issue on latest stable/7.
Comment 6 Eitan Adler freebsd_committer freebsd_triage 2017-12-31 07:59:57 UTC
For bugs matching the following criteria:

Status: In Progress Changed: (is less than) 2014-06-01

Reset to default assignee and clear in-progress tags.

Mail being skipped