kern/162932: [ed][panic][patch] large traffic yields occasional panics

[Peter Much]

>Number:         162932
>Category:       kern
>Synopsis:       [ed][panic][patch] large traffic yields occasional panics
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Mon Nov 28 23:50:12 UTC 2011
>Closed-Date:
>Last-Modified:
>Originator:     Peter Much
>Release:        FreeBSD 7.4-STABLE i386
>Organization:
n/a
>Environment:
System: FreeBSD edge.oper.dinoex.org 7.4-STABLE FreeBSD 7.4-STABLE #1: Sun Nov 27 04:10:51 UTC 2011 root at disp.oper.dinoex.org:/usr/src/sys/i386/compile/E1R74V1 i386

Interface card is WD8013 (ISA 16bit).

I found (and fixed) this with RELEASE-7.2, but it seems I forgot to
publish it. 

The patch does still apply cleanly, so the bug may still linger 
around, or it may not. 
Also, it may be applicaple to higher releases too, or it may not.

>Description:

Panic happens when sending large amounts of data.

>From my understanding, that seems to happen when an mbuf content 
has uneven bytesize and ends at a page boundary.

>How-To-Repeat:

1. have such nice old hardware, and 
2. just send data over it. 

>Fix:

*** sys/dev/ed/if_ed.c.orig	Sat Nov 12 02:31:09 2011
--- sys/dev/ed/if_ed.c	Sat Nov 12 02:56:03 2011
***************
*** 1690,1700 ****
  		}
  	}
  	for (len = 0; m != 0; m = m->m_next) {
! 		if (sc->isa16bit)
! 			bus_space_write_region_2(sc->mem_bst,
! 			    sc->mem_bsh, dst,
! 			    mtod(m, uint16_t *), (m->m_len + 1)/ 2);
! 		else
  			bus_space_write_region_1(sc->mem_bst,
  			    sc->mem_bsh, dst,
  			    mtod(m, uint8_t *), m->m_len);
--- 1690,1704 ----
  		}
  	}
  	for (len = 0; m != 0; m = m->m_next) {
! 		if (sc->isa16bit) {
! 			if(m->m_len > 1)
! 				bus_space_write_region_2(sc->mem_bst,
! 				    sc->mem_bsh, dst, mtod(m, uint16_t *),
! 				    m->m_len / 2);
! 			bus_space_write_1(sc->mem_bst, sc->mem_bsh,
! 			    dst + m->m_len - 1,
! 			    *(mtod(m, uint8_t *) + m->m_len - 1));
! 		} else
  			bus_space_write_region_1(sc->mem_bst,
  			    sc->mem_bsh, dst,
  			    mtod(m, uint8_t *), m->m_len);


>Release-Note:
>Audit-Trail:
>Unformatted: