ng_ether(4) panic with ef(4)

From: Charlie Root (root_at_swp.bspu.secna.ru)
Date: 06/08/04

  • Next message: Charlie Root: "kernel panic by mars_nwe (nwserv -k)"
    Date: Tue, 8 Jun 2004 10:57:14 +0700
    To: archie@freebsd.org, bp@freebsd.org
    
    

    helo.

    if if_ef.ko was loaded before ng_ether.ko or if i have "device ef" in
    kernel and ng_ether.ko loaded as module then IPXrouted panic my kernel
    for 15-30 seconds after boot.

    ~# kldstat
    Id Refs Address Size Name
     1 37 0xc0400000 34c150 kernel
     2 1 0xc074d000 5e40 vesa.ko
     3 1 0xc0753000 2d0c if_ef.ko
     4 2 0xc0756000 1ac7c miibus.ko
     5 1 0xc0771000 b2b4 if_fxp.ko
     6 2 0xc077d000 1e58c snd_pcm.ko
     7 1 0xc079c000 67d8 snd_es137x.ko
     8 1 0xc07a3000 b8b4 random.ko
     9 1 0xc07af000 51b48 acpi.ko
    10 1 0xc0801000 7d40 fdc.ko
    11 1 0xc0809000 3bcc speaker.ko
    12 1 0xc1d81000 c7000 vinum.ko
    13 2 0xc1eea000 5000 procfs.ko
    14 2 0xc1eef000 6000 pseudofs.ko
    15 1 0xc1efb000 6000 linprocfs.ko
    16 4 0xc1f01000 19000 linux.ko
    17 1 0xc1f27000 4000 sysvmsg.ko
    18 1 0xc1f2f000 5000 sysvsem.ko
    19 1 0xc1f34000 4000 sysvshm.ko
    20 1 0xc1f52000 17000 ipl.ko
    21 1 0xc1faa000 2f000 nfsclient.ko
    22 1 0xc2013000 1b000 nfsserver.ko
    23 1 0xc2054000 22000 usb.ko
    24 1 0xc20b3000 2000 snake_saver.ko
    25 1 0xc20f2000 9000 vmmon_up.ko
    26 1 0xc20fb000 2000 vmnet.ko
    27 1 0xc20fd000 4000 if_tap.ko
    28 5 0xc2101000 12000 netgraph.ko
    29 1 0xc2118000 4000 ng_socket.ko
    30 2 0xc211d000 4000 ng_ether.ko
    31 1 0xc2121000 3000 ng_tee.ko
    32 1 0xc2125000 5000 ng_bridge.ko
    33 1 0xc221c000 2000 rtc.ko

    ~# ifconfig
    fxp0: flags=9943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,LINK0,MULTICAST> mtu 1500
            inet 212.192.2.73 netmask 0xffffffe0 broadcast 212.192.2.95
            ether 00:03:47:05:6f:5b
            media: Ethernet autoselect (100baseTX <full-duplex>)
            status: active
    fxp0f0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
            ipx 10000H.347056f5b
            ether 00:03:47:05:6f:5b
    fxp0f1: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
            ipx 10001H.347056f5b
            ether 00:03:47:05:6f:5b
    fxp0f2: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
            ipx 10002H.347056f5b
            ether 00:03:47:05:6f:5b
    fxp0f3: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
            ipx 10003H.347056f5b
            ether 00:03:47:05:6f:5b
    lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> mtu 16384
            inet 127.0.0.1 netmask 0xff000000
            inet 10.250.0.2 netmask 0xffffffff
            ipx 20040605H.1H
    vmnet0: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1500
            ether 00:bd:a7:20:00:00
    vmnet1: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1500
            ether 00:bd:b1:20:00:01
    vmnet2: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1500
            ether 00:bd:bb:20:00:02
    vmnet3: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1500
            ether 00:bd:c6:20:00:03

    /usr/src/sys/i386/compile/aj_kernel# gdb -k kernel
    GNU gdb 5.2.1 (FreeBSD)
    Copyright 2002 Free Software Foundation, Inc.
    GDB is free software, covered by the GNU General Public License, and you are
    welcome to change it and/or distribute copies of it under certain conditions.
    Type "show copying" to see the conditions.
    There is absolutely no warranty for GDB. Type "show warranty" for details.
    This GDB was configured as "i386-unknown-freebsd"...
    (no debugging symbols found)...
    (kgdb) file kernel.debug
    Reading symbols from kernel.debug...done.
    (kgdb) target remote /dev/uart0
    Remote debugging using /dev/uart0
    0xc211e5bd in ?? ()
    warning: Unable to find dynamic linker breakpoint function.
    GDB will be unable to debug shared library initializers
    and track explicitly loaded dynamic code.
    warning: shared library handler failed to enable breakpoint
    (kgdb) bt
    #0 0xc211e5bd in ?? ()
    #1 0xc05301fe in ether_output (ifp=0x0, m=0xc16ef000, dst=0xce651b20, rt0=0x0)
        at ../../../net/if_ethersubr.c:303
    #2 0xc0576add in ipx_outputfl (m0=0xc16ef000, ro=0x0, flags=48)
        at ../../../netipx/ipx_outputfl.c:134
    #3 0xc0577a71 in ipx_output (ipxp=0xc200ba00, m0=0xc16ef0be)
        at ../../../netipx/ipx_usrreq.c:310
    #4 0xc0577ec2 in ipx_send (so=0xc16e1200, flags=0, m=0xc16ef000,
        nam=0xc21240a0, control=0x0, td=0xc16e1200)
        at ../../../netipx/ipx_usrreq.c:559
    #5 0xc04ff08d in sosend (so=0xc1f755a0, addr=0xc21240a0, uio=0xce651c4c,
        top=0xc16ef000, control=0x0, flags=4, td=0xc1d5d3c0)
        at ../../../kern/uipc_socket.c:715
    #6 0xc05038cc in kern_sendit (td=0xc1d5d3c0, s=4, mp=0xce651cc4,
        flags=-1049751040, control=0xc16e1200) at ../../../kern/uipc_syscalls.c:723
    #7 0xc050371e in sendit (td=0xc16e1200, s=-1049751040, mp=0xce651cc4,
        flags=-1049751040) at ../../../kern/uipc_syscalls.c:663
    #8 0xc0503a5b in sendto (td=0xc16e1200, uap=0xc1d5d3c0)
        at ../../../kern/uipc_syscalls.c:784
    #9 0xc060e2a0 in syscall (frame=
          {tf_fs = 47, tf_es = 47, tf_ds = 47, tf_edi = 34, tf_esi = 34, tf_ebp = -1077940968, tf_isp = -832234124, tf_ebx = -1077941008, tf_edx = 4, tf_ecx = 1, tf_eax = 133, tf_trapno = 12, tf_err = 2, tf_eip = 671938895, tf_cs = 31, tf_eflags = 518, tf_esp = -1077941044, tf_ss = 47}) at ../../../i386/i386/trap.c:1010
    ---Type <return> to continue, or q <return> to quit---
    #10 0xc05fefed in Xint0x80_syscall () at {standard input}:136
    #11 0x0804a9ae in ?? ()
    #12 0x0804a60e in ?? ()
    #13 0x0804befb in ?? ()
    #14 0x0804a019 in ?? ()
    #15 0x08048d22 in ?? ()
    (kgdb) bt full
    #0 0xc211e5bd in ?? ()
    No symbol table info available.
    #1 0xc05301fe in ether_output (ifp=0x0, m=0xc16ef000, dst=0xce651b20, rt0=0x0)
        at ../../../net/if_ethersubr.c:303
            type = 18432
            error = 0
            hdrcmplt = 0
            esrc = "?\002\0\0àJ"
            edst = "ÿÿÿÿÿÿ"
            rt = (struct rtentry *) 0x0
            eh = (struct ether_header *) 0x0
            loop_copy = 0
            hlen = 22
            ac = (struct arpcom *) 0xc16e1200
    #2 0xc0576add in ipx_outputfl (m0=0xc16ef000, ro=0x0, flags=48)
        at ../../../netipx/ipx_outputfl.c:134
            ipx = (struct ipx *) 0xce651b20
            ifp = (struct ifnet *) 0xc16e1200
            error = 13
            dst = (struct sockaddr_ipx *) 0x0
            ipxroute = {ro_rt = 0x0, ro_dst = {sa_len = 16 '\020',
        sa_family = 23 '\027', sa_data = "\0\001\0\003ÿÿÿÿÿÿ\0\0\0"}}
    #3 0xc0577a71 in ipx_output (ipxp=0xc200ba00, m0=0xc16ef0be)
        at ../../../netipx/ipx_usrreq.c:310
            ipx = (struct ipx *) 0xc16ef0be
            so = (struct socket *) 0xc1d5d3c0
            len = 64
            ro = (struct route *) 0xc16e1200
            m = (struct mbuf *) 0xc16ef000
            mprev = (struct mbuf *) 0xc1d5d3c0
    #4 0xc0577ec2 in ipx_send (so=0xc16e1200, flags=0, m=0xc16ef000,
        nam=0xc21240a0, control=0x0, td=0xc16e1200)
        at ../../../netipx/ipx_usrreq.c:559
            error = 0
            ipxp = (struct ipxpcb *) 0xc200ba00
            laddr = {x_net = {c_net = "\0\0\0", s_net = {0, 0}}, x_host = {
        c_host = "\0\0\0\0\0", s_host = {0, 0, 0}}, x_port = 21252}
    #5 0xc04ff08d in sosend (so=0xc1f755a0, addr=0xc21240a0, uio=0xce651c4c,
        top=0xc16ef000, control=0x0, flags=4, td=0xc1d5d3c0)
        at ../../../kern/uipc_socket.c:715
            mp = (struct mbuf **) 0xc16ef000
            m = (struct mbuf *) 0xc200ba00
            space = 0
            len = -1049694208
            resid = 0
            clen = -1040139776
            error = 0
            dontroute = 1
            mlen = 208
            atomic = 1
            cow_send = 0
    #6 0xc05038cc in kern_sendit (td=0xc1d5d3c0, s=4, mp=0xce651cc4,
        flags=-1049751040, control=0xc16e1200) at ../../../kern/uipc_syscalls.c:723
            auio = {uio_iov = 0xce651cbc, uio_iovcnt = 1, uio_offset = 34,
      uio_resid = 0, uio_segflg = UIO_USERSPACE, uio_rw = UIO_WRITE,
      uio_td = 0xc1d5d3c0}
            iov = (struct iovec *) 0xc1d5d3c0
            so = (struct socket *) 0xc1f755a0
            i = -1042951232
            len = 34
            error = 22
            ktriov = (struct iovec *) 0x0
            ktruio = {uio_iov = 0x0, uio_iovcnt = -832234408,
      uio_offset = -4582091130731257156, uio_resid = 0, uio_segflg = 3227917479,
      uio_rw = 265, uio_td = 0xc21240a0}
    #7 0xc050371e in sendit (td=0xc16e1200, s=-1049751040, mp=0xce651cc4,
        flags=-1049751040) at ../../../kern/uipc_syscalls.c:663
            control = (struct mbuf *) 0x0
            to = (struct sockaddr *) 0xc21240a0
            error = 0
    #8 0xc0503a5b in sendto (td=0xc16e1200, uap=0xc1d5d3c0)
        at ../../../kern/uipc_syscalls.c:784
            msg = {msg_name = 0xc21240a0, msg_namelen = 16, msg_iov = 0xce651cbc,
      msg_iovlen = 1, msg_control = 0x0, msg_controllen = 3254741312,
      msg_flags = 0}
            aiov = {iov_base = 0x804f8e0, iov_len = 0}
            error = -1049751040
    #9 0xc060e2a0 in syscall (frame=
          {tf_fs = 47, tf_es = 47, tf_ds = 47, tf_edi = 34, tf_esi = 34, tf_ebp = -1077940968, tf_isp = -832234124, tf_ebx = -1077941008, tf_edx = 4, tf_ecx = 1, tf_eax = 133, tf_trapno = 12, tf_err = 2, tf_eip = 671938895, tf_cs = 31, tf_eflags = 518, tf_esp = -1077941044, tf_ss = 47}) at ../../../i386/i386/trap.c:1010
            params = 0xbfbfecd0 "\004"
            callp = (struct sysent *) 0xc068a868
            td = (struct thread *) 0xc1d5d3c0
            p = (struct proc *) 0xce651cc4
            orig_tf_eflags = 518
            sticks = 0
            error = 0
            narg = 6
            args = {4, 134543550, 34, 4, -1077941008, 16, 0, 1}
            code = 133
    #10 0xc05fefed in Xint0x80_syscall () at {standard input}:136
    No locals.
    #11 0x0804a9ae in ?? ()
    No symbol table info available.
    ---Type <return> to continue, or q <return> to quit---
    #12 0x0804a60e in ?? ()
    No symbol table info available.
    #13 0x0804befb in ?? ()
    No symbol table info available.
    #14 0x0804a019 in ?? ()
    No symbol table info available.
    #15 0x08048d22 in ?? ()
    No symbol table info available.
    (kgdb) up
    #1 0xc05301fe in ether_output (ifp=0x0, m=0xc16ef000, dst=0xce651b20, rt0=0x0)
        at ../../../net/if_ethersubr.c:303
    303 if ((error = (*ng_ether_output_p)(ifp, &m)) != 0) {
    (kgdb) list
    298 }
    299 }
    300
    301 /* Handle ng_ether(4) processing, if any */
    302 if (ng_ether_output_p != NULL) {
    303 if ((error = (*ng_ether_output_p)(ifp, &m)) != 0) {
    304 bad: if (m != NULL)
    305 m_freem(m);
    306 return (error);
    307 }
    (kgdb) p ifp
    $1 = (struct ifnet *) 0x0
    (kgdb) up
    #2 0xc0576add in ipx_outputfl (m0=0xc16ef000, ro=0x0, flags=48)
        at ../../../netipx/ipx_outputfl.c:134
    134 error = (*ifp->if_output)(ifp, m0,
    (kgdb) p ifp
    $2 = (struct ifnet *) 0xc16e1200
    (kgdb) list
    129 if (htons(ipx->ipx_len) <= ifp->if_mtu) {
    130 ipxstat.ipxs_localout++;
    131 if (ipx_copy_output) {
    132 ipx_watch_output(m0, ifp);
    133 }
    134 error = (*ifp->if_output)(ifp, m0,
    135 (struct sockaddr *)dst, ro->ro_rt);
    136 goto done;
    137 } else {
    138 ipxstat.ipxs_mtutoosmall++;
    (kgdb) quit

    this hack prevent panic

    index: sys/netgraph/ng_ether.c
    ===================================================================
    RCS file: /usr/cvs/freebsd/ncvs/src/sys/netgraph/ng_ether.c,v
    retrieving revision 1.27
    diff -u -r1.27 ng_ether.c
    --- sys/netgraph/ng_ether.c 31 Oct 2003 18:32:11 -0000 1.27
    +++ sys/netgraph/ng_ether.c 6 Jun 2004 14:00:25 -0000
    @@ -269,9 +269,36 @@
     static int
     ng_ether_output(struct ifnet *ifp, struct mbuf **mp)
     {
    - const node_p node = IFP2NG(ifp);
    - const priv_p priv = NG_NODE_PRIVATE(node);
    + const node_p node;
    + const priv_p priv;
            int error = 0;
    +
    + if (!ifp) {
    + printf("%s(): ifp = 0\n", __func__);
    + return (EINVAL);
    + }
    + if (!(node = IFP2NG(ifp))) {
    + printf( "%s(): IFP2NG(ifp:%p) = 0 \\\n"
    + "\t{ if_xname = \"%s\", if_dname = \"%s\", "
    + "if_index = %d }\n",
    + __func__,
    + ifp,
    + ifp->if_xname,
    + ifp->if_dname,
    + ifp->if_index);
    + return (EINVAL);
    + }
    + if (!(priv = NG_NODE_PRIVATE(node))) {
    + printf( "%s(): NG_NODE_PRIVATE(IFP2NG(ifp:%p):%p) = 0 \\\n"
    + "\t{ if_xname = \"%s\", if_dname = \"%s\", "
    + "if_index = %d }\n",
    + __func__,
    + ifp, node,
    + ifp->if_xname,
    + ifp->if_dname,
    + ifp->if_index);
    + return (EINVAL);
    + }
     
            /* If "upper" hook not connected, let packet continue */
            if (priv->upper == NULL)

    messages on console...

    ng_ether_output(): IFP2NG(ifp:0xc16e1200) = 0 \
            { if_xname = "fxp0f3", if_dname = "ef", if_index = 5 }
    ng_ether_output(): IFP2NG(ifp:0xc16e1400) = 0 \
            { if_xname = "fxp0f2", if_dname = "ef", if_index = 4 }
    ng_ether_output(): IFP2NG(ifp:0xc16e1600) = 0 \
            { if_xname = "fxp0f1", if_dname = "ef", if_index = 3 }
    ng_ether_output(): IFP2NG(ifp:0xc16e1800) = 0 \
            { if_xname = "fxp0f0", if_dname = "ef", if_index = 2 }

    dmesg & netgraph start script here...
    http://bspu.secna.ru/~swp/freebsd/panic/panic.1

    /swp

    _______________________________________________
    freebsd-net@freebsd.org mailing list
    http://lists.freebsd.org/mailman/listinfo/freebsd-net
    To unsubscribe, send any mail to "freebsd-net-unsubscribe@freebsd.org"


  • Next message: Charlie Root: "kernel panic by mars_nwe (nwserv -k)"

    Relevant Pages

    • Re: [RFC] [Crash-utility] Patch to use gdbs bt in crash - works great with kgdb! - KGDB
      ... understand why you wouldn't want to simply use gdb alone ... I don't see any reason for core file not to be read correctly by ... that also might work with kernel core files. ... I expect that if you run a kgdb kernel, including the drarf code, ...
      (Linux-Kernel)
    • Fatal trap in rt_msg2
      ... I could boot and get a working system using the old kernel.. ... Here is my gdb session: ... page fault while in kernel mode ...
      (freebsd-net)
    • Re: double panic, and whats apic_cmd? (kqemu crash...)
      ... I also have KDB_TRACE and KDB_UNATTENDED in the kernel config. ... GDB is free software, covered by the GNU General Public License, and you are ... Fatal trap 12: page fault while in kernel mode ...
      (freebsd-hackers)
    • Re: double panic, and whats apic_cmd? (kqemu crash...)
      ... I also have KDB_TRACE and KDB_UNATTENDED in the kernel config. ... GDB is free software, covered by the GNU General Public License, and you are ... Fatal trap 12: page fault while in kernel mode ...
      (freebsd-hackers)
    • IPSec panics
      ... GNU gdb 6.1.1 ... Unread portion of the kernel message buffer: ... Fatal trap 12: page fault while in kernel mode ...
      (freebsd-current)