Re: panic: kernel diagnostic assertion "offset < map->dm_maps" failed

That looks the same trace I reported on the 29th of September. At least is
probably not due to my specific no-name 2.5gb interface…

On Tue, 17 Oct 2023 at 07:10, matthew green <[email protected]> wrote:

> > #3  0xffffffff80fe6e5f in kern_assert ()
> > #4  0xffffffff8058be67 in bus_dmamap_sync ()
> > #5  0xffffffff8044edc7 in rge_rxeof ()
> > #6  0xffffffff804536fd in rge_intr ()
>
> i'm pretty sure this is the 2nd bus_dmamap_sync() call, as that's
> the only dma map that has load/unload applied at run time, vs the
> init sequence only, and it implies to me that rx dma map has had
> allocation failures to deplete the entire ring of mbufs, and then
> there are no mappings in the dma map, which leaves the dm_mapsize
> as 0, and triggers this bug.
>
> if i'm right, what's happened is this:
>
> 1237         for (i = sc->rge_ldata.rge_rxq_considx; ; i =
> RGE_NEXT_RX_DESC(i)) {
>
> 1245                 if (RGE_OWN(cur_rx))
> 1246                         break;
>
> 1252                 rxq = &sc->rge_ldata.rge_rxq[i];
> 1253                 m = rxq->rxq_mbuf;
>
> 1257                 /* Invalidate the RX mbuf and unload its map. */
> 1258                 bus_dmamap_sync(sc->sc_dmat, rxq->rxq_dmamap, 0,
> 1259                     rxq->rxq_dmamap->dm_mapsize,
> BUS_DMASYNC_POSTREAD);
> 1260                 bus_dmamap_unload(sc->sc_dmat, rxq->rxq_dmamap);
>
> 1283                  * If allocating a replacement mbuf fails,
> 1284                  * reload the current one.
>
> 1287                 if (rge_newbuf(sc, i) != 0) {
> 1288                         if (sc->rge_head != NULL) {
> 1289                                 m_freem(sc->rge_head);
> 1290                                 sc->rge_head = sc->rge_tail = NULL;
> 1291                         }
> 1292                         rge_discard_rxbuf(sc, i);
> 1293                         continue;
> 1294                 }
>
> loop 'i' has the ability to range between 0 and 1023, and
> accesses each ring entries rge_rxq.  if, over time, each
> value between 0 and 1023 triggers the rge_newbuf() failure
> path, each successive entry will be lost, never to be
> replaced unless an explicit ifconfig down/up occurs.
>
> hmmm, but in thie case, no buffers would should be set to
> be available for rx, so nowthing should pass RGE_OWN() at
> L1245 i'd hope.  i still see the problem with everything
> being depleted, but then it should just stop getting any
> rx packets at all...
>
> networking folks, am i missing something here?  i see the
> same problem in wm(4) as well.  if wm_add_rxbuf() fails,
> where will this ring entry's mbuf ever be replaced again?
>
>
> .mrg.
>