>Number:         8280
>Category:       port-amiga
>Synopsis:       NetBSD/amiga ed driver with ASDG panics kernel
>Confidential:   yes
>Severity:       serious
>Priority:       medium
>Responsible:    port-amiga-maintainer (NetBSD/amiga Portmaster)
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Thu Aug 26 11:50:00 1999
>Last-Modified:
>Originator:     Karl F. Schilke
>Organization:
>Release:        1.3.3
>Environment:
	
System: NetBSD coredump 1.3.3 NetBSD 1.3.3 (COREDUMP) #3: Wed Apr 21 13:04:07 PDT 1999 rat@coredump:/src/sys/arch/amiga/compile/COREDUMP amiga


>Description:
This is a duplicate of 8218/amiga, which appears to have been lost.

The kernel on my Amiga3000 panics a few times a day with a 'trap' while
processing packets on the ethernet.  There appears to be no correlation
between traffic pattern and the panic.  The machine has been stable for
days, only to fall over after transferring a few KB via NFS or FTP.

I can reliably crash the machine by attempting to transfer a large file from
it to my 1.3.3 i386 box.  I have crashed it using everything from flood pings
to tftp, as well as just ssh interactive traffic.  So I believe there is 
little correlation to any specific traffic pattern.

The machine sometimes panic's several times a day, leading to intense user
frustration.

I have included the panic message from dmesg(1) below:

======= DMESG OUTPUT BEGINS HERE ========
ed0: reset
ed0: device timeout
ed0: reset
trap type 16, code = 0, v = 0
pid = -1, pc = 000BB926, ps = 2204, sfc = 1, dfc = 1
Registers:
               0        1        2        3        4        5        6        7
dreg: 00000000 00000000 00000101 00000002 00000100 000ED314 00000000 00000040
areg: 04F10001 00000000 0058EA00 0058EA3C 0235DE88 0235DF88 0235DD98 0DFFFC80

Kernel stack (0235DCE4):
35DCE4: 000D4D8E 0235DD4C 00000080 000D4D28 00000010 00000000 00000000 00000010
35DD04: 0235DD38 000D52BE 00000010 00000000 00000000 0235DD4C 00000101 00000002
35DD24: 00000100 000ED314 00000000 00000040 0058EA00 0235DD98 0000203C 00000010
35DD44: 00000000 00000000 00000000 00000000 00000101 00000002 00000100 000ED314
35DD64: 00000000 00000040 04F10001 00000000 0058EA00 0058EA3C 0235DE88 0235DF88
35DD84: 0235DD98 0DFFFC80 00000000 2204000B B926002C 0235DDB8 000BC318 0058EA00
35DDA4: 00000007 00000188 00000002 0058EA28 005C0200 0235DDD0 000D2EB8 0058EA00
35DDC4: 0000002A 00002704 000F97A0 0235DE1C 00002352 00002200 00000020 00000000
35DDE4: 000F24F8 00000547 20000000 27900068 0001E33C 005C0200 00000000 00002704
35DE04: 00000100 000ED314 005C0200 00000000 37C56D29 00085A4A 0235DE40 0001DF0A
35DE24: 00000000 00002004 005C0200 00000000 0235DF80 00000004 00000004 0235DF48
35DE44: 0002325A 000ED314 00000118 00023024 00000000 00000000 0000005D 00000000
35DE64: 0000024F 0804BD66 00000000 005C0200 00000014 0DFFFC84 000E197C FFFFFFFF
35DE84: 7FFF0000 00000038 00000000 00000000 00000000 00000000 00000000 FFFFFFFF
35DEA4: FFFFFFFF 7FFF0000 FFFFFFFF FFFFFFFF 7FFF0000 FFFFFFFF FFFFFFFF 7FFF0000
35DEC4: FFFFFFFF FFFFFFFF 00000000 04000000 00000000 00000000 00000000 0DFFFC80
panic: trap
syncing disks... done

dumping to dev 401, offset 130635
dump 18 17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 succeeded


rebooting...
NetBSD 1.3.3 (COREDUMP) #3: Wed Apr 21 13:04:07 PDT 1999
    rat@coredump:/src/sys/arch/amiga/compile/COREDUMP
Amiga 3000 (m68030 CPU/MMU m68882 FPU)
real  mem = 16777216 (2048 pages)
avail mem = 14237696 (1738 pages)
using 115 buffers containing 942080 bytes of memory
memory segment 0 at 7000000 size 1000000
memory segment 1 at 0 size 200000
mainbus0 (root)
clock0 at mainbus0: CIA B system hz 100 hardware hz 715909
Calibrating delay loop... 334/1024 us
a34kbbc0 at mainbus0
ser0 at mainbus0: input fifo 512 output fifo 32
par0 at mainbus0
kbd0 at mainbus0: CIA A type Amiga
ms0 at mainbus0
ms1 at mainbus0
grfcc0 at mainbus0
grf0 at grfcc0: width 640 height 400 colors 4
ite0 at grf0: rows 33 cols 80 repeat at (30/100)s next at (10/100)s has keyboard
fdc0 at mainbus0: dmabuf pa 0x1e44c4: dmabuf ka 0x4de04c4
fd0 at fdc0 unit 0: 3.5dd 80 cyl, 2 head, 11 sec [9 sec], 512 bytes/sec
ahsc0 at mainbus0
scsibus0 at ahsc0: 8 targets
ahsc0: target 0 now synchronous, period=208ns, offset=12.
sd0 at scsibus0 targ 0 lun 0: <Quantum, XP32150W, L912> SCSI2 0/direct fixed
sd0: 2050MB, 3907 cyl, 10 head, 107 sec, 512 bytes/sect x 4199760 sectors
ahsc0: target 1 now synchronous, period=208ns, offset=12.
sd1 at scsibus0 targ 1 lun 0: <MAXTOR, MXT-540SL, J1.5> SCSI2 0/direct fixed
sd1: 521MB, 2234 cyl, 7 head, 68 sec, 512 bytes/sect x 1067740 sectors
ahsc0: target 5 now synchronous, period=220ns, offset=12.
st0 at scsibus0 targ 5 lun 0: <ARCHIVE, Python 28849-XXX, 4.CM> SCSI2 1/sequential removable
st0: drive empty
ch0 at scsibus0 targ 5 lun 1: <ARCHIVE, Python 28849-XXX, 4.CM> SCSI2 8/changer removable
ch0: 0 slots, 1 drive, 1 picker, 0 portals
aucc0 at mainbus0
audio0 at aucc0
zbus0 at mainbus0
ed0 at zbus0 pa 0xe90000 man/pro 1023/254: address 00:c0:fc:00:03:f1
4 views configured
root on sd0a dumps on sd0b
root file system type: ffs
ed0: NIC memory corrupt - invalid packet length 65292
ed0: reset
ed0: reset
trap type 16, code = 0, v = 0
pid = 307, pc = 000BB926, ps = 2204, sfc = 1, dfc = 1
Registers:
             0        1        2        3        4        5        6        7
dreg: 00000000 00000007 00000002 00000002 000043B8 00000000 00002004 00002404
areg: 04F10001 04E50000 0058EA00 0058EA3C 0062DC80 000F959A 023BDDF0 0DFFF450

Kernel stack (023BDD3C):
3BDD3C: 000D4D8E 023BDDA4 00000080 000D4D28 00000010 00000000 00000000 00000010
3BDD5C: 023BDD90 000D52BE 00000010 00000000 00000000 023BDDA4 00000002 00000002
3BDD7C: 000043B8 00000000 00002004 00002404 0058EA00 023BDDF0 0000203C 00000010
3BDD9C: 00000000 00000000 00000000 00000007 00000002 00000002 000043B8 00000000
3BDDBC: 00002004 00002404 04F10001 04E50000 0058EA00 0058EA3C 0062DC80 000F959A
3BDDDC: 023BDDF0 0DFFF450 00000000 2204000B B926002C 023BDE10 000BC220 0058EA00
3BDDFC: 00000005 00000008 00000002 0058EA28 0061C600 023BDE28 000D2EB8 0058EA00
3BDE1C: 00000014 00000000 0062DC80 023BDE74 00002352 00002200 00000000 6EE37397
3BDE3C: 023BDDA8 000FA3D8 21040005 D2DE0068 00000014 00000000 000043B8 00000000
3BDE5C: 00002004 00002404 0062DC80 0061C600 0062DC80 000F959A 023BDEC8 0002CD8C
3BDE7C: 0061C600 00000009 0062DC80 00000000 00000000 00615000 00000000 00000014
3BDE9C: 00000005 0000022B 080B825E 0DFFF554 023BDF88 00615000 023BDF80 023BDF20
3BDEBC: 00000000 00000000 00615000 023BDEE8 00023B84 0061C600 00000000 023BDF28
3BDEDC: 0062DC80 00000000 00000000 023BDF48 000228CE 0061F480 023BDF28 00589C80
3BDEFC: 00000000 00000004 00000000 00615000 0000000C 0DFFF454 000E16B4 00000000
3BDF1C: 0001F3D2 00032014 00000000 023BDF20 00000001 00615000 0000001C 00000000
panic: trap
syncing disks... 3 2 done

dumping to dev 401, offset 130635
dump 18 17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 succeeded


rebooting...
NetBSD 1.3.3 (COREDUMP) #3: Wed Apr 21 13:04:07 PDT 1999
    rat@coredump:/src/sys/arch/amiga/compile/COREDUMP
Amiga 3000 (m68030 CPU/MMU m68882 FPU)
real  mem = 16777216 (2048 pages)
avail mem = 14237696 (1738 pages)
using 115 buffers containing 942080 bytes of memory
memory segment 0 at 7000000 size 1000000
memory segment 1 at 0 size 200000
mainbus0 (root)
clock0 at mainbus0: CIA B system hz 100 hardware hz 715909
Calibrating delay loop... 334/1024 us
a34kbbc0 at mainbus0
ser0 at mainbus0: input fifo 512 output fifo 32
par0 at mainbus0
kbd0 at mainbus0: CIA A type Amiga
ms0 at mainbus0
ms1 at mainbus0
grfcc0 at mainbus0
grf0 at grfcc0: width 640 height 400 colors 4
ite0 at grf0: rows 33 cols 80 repeat at (30/100)s next at (10/100)s has keyboard
fdc0 at mainbus0: dmabuf pa 0x1e44c4: dmabuf ka 0x4de04c4
fd0 at fdc0 unit 0: 3.5dd 80 cyl, 2 head, 11 sec [9 sec], 512 bytes/sec
ahsc0 at mainbus0
scsibus0 at ahsc0: 8 targets
ahsc0: target 0 now synchronous, period=208ns, offset=12.
sd0 at scsibus0 targ 0 lun 0: <Quantum, XP32150W, L912> SCSI2 0/direct fixed
sd0: 2050MB, 3907 cyl, 10 head, 107 sec, 512 bytes/sect x 4199760 sectors
ahsc0: target 1 now synchronous, period=208ns, offset=12.
sd1 at scsibus0 targ 1 lun 0: <MAXTOR, MXT-540SL, J1.5> SCSI2 0/direct fixed
sd1: 521MB, 2234 cyl, 7 head, 68 sec, 512 bytes/sect x 1067740 sectors
ahsc0: target 5 now synchronous, period=220ns, offset=12.
st0 at scsibus0 targ 5 lun 0: <ARCHIVE, Python 28849-XXX, 4.CM> SCSI2 1/sequential removable
st0: drive empty
ch0 at scsibus0 targ 5 lun 1: <ARCHIVE, Python 28849-XXX, 4.CM> SCSI2 8/changer removable
ch0: 0 slots, 1 drive, 1 picker, 0 portals
aucc0 at mainbus0
audio0 at aucc0
zbus0 at mainbus0
ed0 at zbus0 pa 0xe90000 man/pro 1023/254: address 00:c0:fc:00:03:f1
4 views configured
root on sd0a dumps on sd0b
root file system type: ffs
ed0: NIC memory corrupt - invalid packet length 65292
ed0: reset
======= DMESG OUTPUT BEGINS HERE ========

>How-To-Repeat:
The crash is very repeatable -- any large transfer from my amiga to my i386
box will cause it.  I would be pleased to provide access to the machine and 
support for kernel installs, etc, to whomever will be working on this problem.

>Fix:
Unknown.  Jason Thorpe has worked on this bug in the past, but has not resolved
it.
>Audit-Trail:
>Unformatted:
no
NetBSD/amiga catchs a "trap" while processing packets from ASDG ed ethernet
critical
high
sw-bug