>Number:         7809
>Category:       kern
>Synopsis:       epic driver can get stuck on transmit
>Confidential:   no
>Severity:       serious
>Priority:       high
>Responsible:    kern-bug-people (Kernel Bug People)
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Fri Jun 18 10:20:01 1999
>Last-Modified:
>Originator:     Zdenek Salvet
>Organization:
Masaryk University, Brno, Czech Republic
>Release:        1.4
>Environment:
NetBSD/i386 1.4, SMC Etherpower II ethernet adapter
>Description:

    Trying to send IP packet to machine that does not have our ARP info
    cached, transmission often halts and five seconds later
    "epic0: device timeout" message is printed.

    This is caused by epic driver incorrectly setting length of packet
    on receive and ARP code that fights back with ARP reply in the same mbuf
    with unchanged length. 2046 bytes long frame then makes the transmit
    pipe of the 83c170 chip hang.
 
    Epic driver also never increments input packet counter.

>How-To-Repeat:
>Fix:

--- dev/ic/smc83c170.c.orig     Thu Mar 25 15:19:59 1999
+++ dev/ic/smc83c170.c  Fri Jun 18 10:54:22 1999
@@ -708,7 +708,7 @@
                                continue;
                        }
 
-                       len = rxd->er_buflength;
+                       len = rxd->er_rxlength;
                        if (len < sizeof(struct ether_header)) {
                                m_freem(m);
                                continue;
@@ -739,6 +739,7 @@
                        /* Remove the Ethernet header and pass it on. */
                        m_adj(m, sizeof(struct ether_header));
                        ether_input(ifp, eh, m);
+                       ifp->if_ipackets++;
                }
 
                /* Update the recieve pointer. */
--- netinet/if_arp.c.orig       Fri Jun 18 10:57:48 1999
+++ netinet/if_arp.c    Fri Jun 18 11:12:25 1999
@@ -691,6 +691,9 @@
        ah->ar_op = htons(ARPOP_REPLY);
        ah->ar_pro = htons(ETHERTYPE_IP); /* let's be sure! */
        m->m_flags &= ~(M_BCAST|M_MCAST); /* never reply by broadcast */
+       m->m_len = sizeof(*ah) + 2*sizeof(struct in_addr) +
+           2*ifp->if_data.ifi_addrlen;
+       m->m_pkthdr.len = m->m_len;
        sa.sa_family = AF_ARP;
        sa.sa_len = 2;
        (*ifp->if_output)(ifp, m, &sa, (struct rtentry *)0);

>Audit-Trail:
>Unformatted: