Bug 25478

When I start my system, the vlan-devices will be set up like this:

  ifconfig vlan0 vlan 10 vlandev fxp0
  ifconfig vlan1 vlan 50 vlandev fxp0
  ifconfig vlan2 vlan 20 vlandev fxp0
  (...etc...)

The state of the patent interface is:

fxp0: flags=8802<BROADCAST,SIMPLEX,MULTICAST> mtu 1500
     ether 00:02:b3:29:99:6b 
     media: autoselect (100baseTX <full-duplex>) status: active
     supported media: autoselect 100baseTX <full-duplex> 100baseTX 10baseT/UTP <full-duplex> 10baseT/UTP

Please note, that the state is _not_ "UP", its just like an
untached interface after booting.

After the Interfaces have been setup with the vlan information,
the system starts zebra, which does the rest of the setup (inet-
addresses and "ifconfig <if> up", etc).

The result is a kernel panic.

You will find some debugging output below, if you need more
information/debugging output, contact me.


Here are some additional informations:

--- general output ---

IdlePTD 3072000
initial pcb at 26e5e0
panicstr: page fault
panic messages:
---
Fatal trap 12: page fault while in kernel mode
fault virtual address    = 0x0
fault code               = supervisor read, page not present
instruction pointer      = 0x8:0xc01b74b2
stack pointer            = 0x10:0xc87b6c9c
frame pointer            = 0x10:0xc87b6cb4
code segment             = base rx0, limit 0xfffff, type 0x1b
                         = DPL 0, pres 1, def32 1, gran 1
processor eflags         = interrupt enabled, resume, IOPL = 0
current process          = 422 (zebra)
interrupt mask           = net 
trap number              = 12
panic: page fault



--- backtrace output ---
#0  dumpsys () at ../../kern/kern_shutdown.c:469
#1  0xc0154087 in boot (howto=256) at ../../kern/kern_shutdown.c:309
#2  0xc0154404 in poweroff_wait (junk=0xc0246bcf, howto=-941828704)
    at ../../kern/kern_shutdown.c:556
#3  0xc020f229 in trap_fatal (frame=0xc87b6c5c, eva=0)
    at ../../i386/i386/trap.c:951
#4  0xc020ef01 in trap_pfault (frame=0xc87b6c5c, usermode=0, eva=0)
    at ../../i386/i386/trap.c:844
#5  0xc020eae7 in trap (frame={tf_fs = 7077904, tf_es = -1063059440, 
      tf_ds = -931463152, tf_edi = -1071190144, tf_esi = -1063041536, 
      tf_ebp = -931435340, tf_isp = -931435384, tf_ebx = 4, 
      tf_edx = -1063041536, tf_ecx = -1071190144, tf_eax = 0, tf_trapno =
12, 
      tf_err = 0, tf_eip = -1071942478, tf_cs = 8, tf_eflags = 66118, 
      tf_esp = 4, tf_ss = -1063041536}) at ../../i386/i386/trap.c:443
#6  0xc01b74b2 in fxp_start (ifp=0xc0a34600) at ../../pci/if_fxp.c:1083
#7  0xc0197fde in vlan_start (ifp=0xc026ef80) at ../../net/if_vlan.c:273
#8  0xc0195ce8 in ether_output_frame (ifp=0xc026ef80, m=0xc078d800)
    at ../../net/if_ethersubr.c:400
#9  0xc0195c56 in ether_output (ifp=0xc026ef80, m=0xc078d800,
dst=0xc87b6d4c, 
    rt0=0x0) at ../../net/if_ethersubr.c:354
#10 0xc019c053 in arprequest (ac=0xc026ef80, sip=0xc0b002cc, tip=0xc0b002cc, 
    enaddr=0xc026f058 "") at ../../netinet/if_ether.c:348
#11 0xc019c995 in arp_ifinit (ac=0xc026ef80, ifa=0xc0b00280)
    at ../../netinet/if_ether.c:800
#12 0xc019833f in vlan_ioctl (ifp=0xc026ef80, cmd=2149607692, 
    data=0xc0b00280 "È\002°ÀØ\002°Àè\002°À\200ï&À") at
../../net/if_vlan.c:454
#13 0xc019dc71 in in_ifinit (ifp=0xc026ef80, ia=0xc0b00280, sin=0xc87b6ebc, 
    scrub=0) at ../../netinet/in.c:660
#14 0xc019d7e7 in in_control (so=0xc7c70540, cmd=2151704858, 
    data=0xc87b6eac "vlan0", ifp=0xc026ef80, p=0xc7dcd5a0)
    at ../../netinet/in.c:412
#15 0xc01951b7 in ifioctl (so=0xc7c70540, cmd=2151704858, 
    data=0xc87b6eac "vlan0", p=0xc7dcd5a0) at ../../net/if.c:972
#16 0xc016575a in soo_ioctl (fp=0xc0b073c0, cmd=2151704858, 
    data=0xc87b6eac "vlan0", p=0xc7dcd5a0) at ../../kern/sys_socket.c:143
#17 0xc016272a in ioctl (p=0xc7dcd5a0, uap=0xc87b6f80) at
../../sys/file.h:178
#18 0xc020f4d5 in syscall2 (frame={tf_fs = 47, tf_es = 47, tf_ds = 47, 
      tf_edi = 0, tf_esi = 7, tf_ebp = -1077937928, tf_isp = -931434540, 
      tf_ebx = -1077937724, tf_edx = -1, tf_ecx = -1077937857, tf_eax = 54, 
      tf_trapno = 12, tf_err = 2, tf_eip = 672090628, tf_cs = 31, 
      tf_eflags = 643, tf_esp = -1077937972, tf_ss = 47})
    at ../../i386/i386/trap.c:1150
#19 0xc0204325 in Xint0x80_syscall ()
#20 0x804dd0b in ?? ()


--- debugging output of point where trap happens ---
(kgdb) up 6
#6  0xc01b74b2 in fxp_start (ifp=0xc0a34600) at ../../pci/if_fxp.c:1083
1083           txp = sc->cbl_last->next;
(kgdb) print txp
$1 = (struct fxp_cb_tx *) 0x0
(kgdb) print sc->cbl_last->next
Cannot access memory at address 0x0.
(kgdb) 
---------------------------------------------------------------------

Fix: 

I found a workaround:
"ifconfig fxp0 up" before setting up vlan interfaces prevents
beeing paniced by the kernel :-)
How-To-Repeat: 
- boot a machine with an fxp0, which will be not configured by
  startup-scripts.
- ifconfig vlan0 vlan 10 vlandev fxp0
- ifconfig vlan0 inet 212.8.196.129 netmask 255.255.255.248 up

...and you will see a kernel panic