[Bug 243126] Assertion fl->ifl_cidx == cidx failed at /usr/src/sys/net/iflib.c:2531

[bugzilla-noreply at freebsd.org]

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=243126

Andriy Gapon <avg at FreeBSD.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|New                         |Open

--- Comment #3 from Andriy Gapon <avg at FreeBSD.org> ---
I wonder if irf_idx can "jump ahead" of ifl_cidx because of a skipped
zero-length packet?

Hmm, it seems like it could be the case.
Given the current value of iri_cidx/ifr_cq_cidx, I examined three descriptors
before that index:

(kgdb) p $19.vxcr_u.rxcd[476]
$21 = {rxd_idx = 142, pad1 = 0, eop = 1, sop = 1, qid = 0, rss_type = 2,
no_csum = 0, pad2 = 0, rss_hash = 600473664, len = 1514, error = 0, vlan = 0,
vtag = 0, csum = 0, csum_ok = 1, udp = 0, tcp = 1, ipcsum_ok = 1, ipv6 = 0, 
  ipv4 = 1, fragment = 0, fcs = 0, type = 3, gen = 1}

(kgdb) p $19.vxcr_u.rxcd[475]
$22 = {rxd_idx = 141, pad1 = 0, eop = 1, sop = 1, qid = 0, rss_type = 0,
no_csum = 0, pad2 = 0, rss_hash = 0, len = 0, error = 0, vlan = 0, vtag = 0,
csum = 0, csum_ok = 0, udp = 0, tcp = 0, ipcsum_ok = 0, ipv6 = 0, ipv4 = 0, 
  fragment = 0, fcs = 0, type = 3, gen = 1}

(kgdb) p $19.vxcr_u.rxcd[474]
$23 = {rxd_idx = 140, pad1 = 0, eop = 1, sop = 1, qid = 0, rss_type = 2,
no_csum = 0, pad2 = 0, rss_hash = 600473664, len = 66, error = 0, vlan = 0,
vtag = 0, csum = 0, csum_ok = 1, udp = 0, tcp = 1, ipcsum_ok = 1, ipv6 = 0, 
  ipv4 = 1, fragment = 0, fcs = 0, type = 3, gen = 1}

The descriptor at 476 with rxd_idx = 142 seems like the current packet.
And the previous descriptor at 475 with rxd_idx = 141 is a zero-length packet:
eop = 1, sop = 1, len = 0.
The packet before it is a normal packet again: eop = 1, sop = 1,  len = 66.

Now, how to fix the problem?
I see two ways:
- a driver can notify iflib of a zero length packet (via a new callback), so
that iflib can skip the corresponding entry in the appropriate free list
- rxd_frag_to_sd() can skip through fl entries until ifl_cidx becomes equal to
irf_idx

-- 
You are receiving this mail because:
You are the assignee for the bug.