After doing a buildworld - builkernel - installkernel - singleuser-boot - installworld cycle with sources cvsup'ed from cvsup3.de on 2001/08/11, the system panicked when it entered multiuser mode and tried to configure the network. The kernel used for installworld in singleuser was the GENERIC kernel. The problem seemingly occured because if_rl and miibus were preloaded. When the system was booted without these modules and the GENERIC kernel, it worked. Fix: Do not boot kernels with support for things one has already preloaded? Seriously: This has not been a problem until now. If this is a feature, it should be documented in UPDATING. How-To-Repeat: I cannot tell whether other network card modules trigger this problem. When using a card supported by the if_rl module, preload this module and boot a generic kernel with support for this nic compiled in.
State Changed From-To: open->feedback Does this problem persist in recent releases? If so, please obtain a debugging traceback as explained in http://www.freebsd.org/doc/en_US.ISO8859-1/books/developers-handbook/kerneldebug.html
* Kris Kennaway (kris@FreeBSD.org): > Synopsis: ifconfig causes kernel panic in 4.4-PRERELEASE > > State-Changed-From-To: open->feedback > State-Changed-By: kris > State-Changed-When: Mon Jul 14 03:18:14 PDT 2003 > State-Changed-Why: > Does this problem persist in recent releases? If so, > please obtain a debugging traceback as explained in > http://www.freebsd.org/doc/en_US.ISO8859-1/books/developers-handbook/kerneldebug.html > > http://www.freebsd.org/cgi/query-pr.cgi?pr=29626 Yes, it does. I just generated a panic with a -STABLE system as of July 12, 2003 by loading if_rl on top of a kernel with support for rl(4) compiled in. A basic analysis is attached, I can try to put the core online and will do further analysis if desired. Script started on Mon Jul 14 18:46:35 2003 GNU gdb 4.18 (FreeBSD) Copyright 1998 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "i386-unknown-freebsd". (kgdb) symbol-file /kernel.debug Reading symbols from /kernel.debug...Deprecated bfd_read called at /usr/src/gnu/usr.bin/binutils/gdb/../../../../contrib/gdb/gdb/dbxread.c line 2627 in elfstab_build_psymtabs Deprecated bfd_read called at /usr/src/gnu/usr.bin/binutils/gdb/../../../../contrib/gdb/gdb/dbxread.c line 933 in fill_symbuf done. (kgdb) exec-file /var/crash/kernel.1 (kgdb) core-file /var/crash/vmcore.1 IdlePTD at phsyical address 0x003bf000 initial pcb at physical address 0x003063c0 panicstr: page fault panic messages: --- Fatal trap 12: page fault while in kernel mode fault virtual address = 0x8 fault code = supervisor read, page not present instruction pointer = 0x8:0xc0394b63 stack pointer = 0x10:0xcff62cf8 frame pointer = 0x10:0xcff62d04 code segment = base rx0, limit 0xfffff, type 0x1b = DPL 0, pres 1, def32 1, gran 1 processor eflags = interrupt enabled, resume, IOPL = 0 current process = 50 (ifconfig) interrupt mask = net trap number = 12 panic: page fault syncing disks... 8 3 2 2 done Uptime: 3s dumping to dev #ad/0x40021, offset 492768 dump ata2: resetting devices .. done 255 254 253 252 251 250 249 248 247 246 245 244 243 242 241 240 239 238 237 236 235 234 233 232 231 230 229 228 227 226 225 224 223 222 221 220 219 218 217 216 215 214 213 212 211 210 209 208 207 206 205 204 203 202 201 200 199 198 197 196 195 194 193 192 191 190 189 188 187 186 185 184 183 182 181 180 179 178 177 176 175 174 173 172 171 170 169 168 167 166 165 164 163 162 161 160 159 158 157 156 155 154 153 152 151 150 149 148 147 146 145 144 143 142 141 140 139 138 137 136 135 134 133 132 131 130 129 128 127 126 125 124 123 122 121 120 119 118 117 116 115 114 113 112 111 110 109 108 107 106 105 104 103 102 101 100 99 98 97 96 95 94 93 92 91 90 89 88 87 86 85 84 83 82 81 80 79 78 77 76 75 74 73 72 71 70 69 68 67 66 65 64 63 62 61 60 59 58 57 56 55 54 53 52 51 50 49 48 47 46 45 44 43 42 41 40 39 38 37 36 35 34 33 32 31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 --- #0 dumpsys () at /usr/src/sys/kern/kern_shutdown.c:487 487 if (dumping++) { (kgdb) where #0 dumpsys () at /usr/src/sys/kern/kern_shutdown.c:487 #1 0xc0156207 in boot (howto=256) at /usr/src/sys/kern/kern_shutdown.c:316 #2 0xc015662c in poweroff_wait (junk=0xc02c0a4c, howto=-1070856881) at /usr/src/sys/kern/kern_shutdown.c:595 #3 0xc0280c22 in trap_fatal (frame=0xcff62cb8, eva=8) at /usr/src/sys/i386/i386/trap.c:974 #4 0xc02808f5 in trap_pfault (frame=0xcff62cb8, usermode=0, eva=8) at /usr/src/sys/i386/i386/trap.c:867 #5 0xc02804df in trap (frame={tf_fs = 16, tf_es = -886374384, tf_ds = -1070596080, tf_edi = -1059788992, tf_esi = 0, tf_ebp = -805950204, tf_isp = -805950236, tf_ebx = -1059789056, tf_edx = -1059788992, tf_ecx = 0, tf_eax = -1069986988, tf_trapno = 12, tf_err = 0, tf_eip = -1069986973, tf_cs = 8, tf_eflags = 66182, tf_esp = -1059789056, tf_ss = -1059788992}) at /usr/src/sys/i386/i386/trap.c:466 #6 0xc0394b63 in ?? () #7 0xc0135689 in mii_mediachg (mii=0xc0d4e740) at /usr/src/sys/dev/mii/mii.c:293 #8 0xc038b7c9 in ?? () #9 0xc019b7f6 in ether_ioctl (ifp=0xc0d45800, command=-2145359604, data=0xc0e22d00 " -âÀ°-âÀÀ-âÀ") at /usr/src/sys/net/if_ethersubr.c:904 #10 0xc038b8eb in ?? () #11 0xc01a37f9 in in_ifinit (ifp=0xc0d45800, ia=0xc0e22d00, sin=0xcff62eb8, scrub=0) at /usr/src/sys/netinet/in.c:682 #12 0xc01a3127 in in_control (so=0xcf6e2f00, cmd=2151704858, data=0xcff62ea8 "rl0", ifp=0xc0d45800, p=0xcb2b82a0) at /usr/src/sys/netinet/in.c:406 #13 0xc019a12a in ifioctl (so=0xcf6e2f00, cmd=2151704858, data=0xcff62ea8 "rl0", p=0xcb2b82a0) at /usr/src/sys/net/if.c:1200 #14 0xc0168a1a in soo_ioctl (fp=0xc0df0040, cmd=2151704858, data=0xcff62ea8 "rl0", p=0xcb2b82a0) at /usr/src/sys/kern/sys_socket.c:143 #15 0xc01658fe in ioctl (p=0xcb2b82a0, uap=0xcff62f80) at /usr/src/sys/sys/file.h:178 #16 0xc0280ed1 in syscall2 (frame={tf_fs = 47, tf_es = 47, tf_ds = 47, tf_edi = 0, tf_esi = -1077936704, tf_ebp = -1077936944, tf_isp = -805949484, tf_ebx = 134682820, tf_edx = 3, tf_ecx = 134768368, tf_eax = 54, tf_trapno = 12, tf_err = 2, tf_eip = 134536316, tf_cs = 31, tf_eflags = 659, tf_esp = -1077937084, tf_ss = 47}) at /usr/src/sys/i386/i386/trap.c:1175 #17 0xc0274ad5 in Xint0x80_syscall () #18 0x80487b1 in ?? () #19 0x804813e in ?? () (kgdb) quit Script done on Mon Jul 14 18:48:31 2003 Regards, -- Thomas Seck
On Mon, Jul 14, 2003 at 07:03:58PM +0200, Thomas Seck wrote: > I just generated a panic with a -STABLE system as of July 12, 2003 by > loading if_rl on top of a kernel with support for rl(4) compiled in. That's the real problem here, I think. This is normally supposed to fail. Kris
* Kris Kennaway (kris@obsecurity.org): > On Mon, Jul 14, 2003 at 07:03:58PM +0200, Thomas Seck wrote: > > > I just generated a panic with a -STABLE system as of July 12, 2003 by > > loading if_rl on top of a kernel with support for rl(4) compiled in. > > That's the real problem here, I think. This is normally supposed to fail. Just to be clear: the problem arises when preloading a module via the loader, not via kldload. It definitely "worked" (or the loading of the module silently failed) with 4.3 and before and broke during the 4.4-prerelease cycle. I did unfortunately not have the time to identify the culprit. Regards, -- Thomas Seck
Hi Thomas, I've just checked on RELENG_4 system with GENERIC kernel: if_rl_load="YES" in /boot/loader.conf makes no harm at all. Is it still a problem for you? Thanks! -- Maxim Konovalov
* Maxim Konovalov (maxim@macomnet.ru): Thanks for having a look at this! > I've just checked on RELENG_4 system with GENERIC kernel: > if_rl_load="YES" in /boot/loader.conf makes no harm at all. Is it > still a problem for you? Thanks! Yes, unfortunately. This system is a stripped down RELENG_4 GENERIC kernel, last updated from 2006-03-12 sources, that contains if_rl and miibus. When putting if_rl_load="YES" in /boot/loader.conf and rebooting, if_rl and miibus are loaded on top of the kernel without error or warning. The system explodes when entering multiuser mode and ifconfig tries to configure the rl interface. I have not yet checked whether this issue exists in 5.x or later, I admit I totally forgot about it :) Transcript of debugging session: Script started on Sun Jun 11 20:54:25 2006 % sudo gdb -k /kernel.debug /var/crash/vmcore.1 Please enter your sudo password: GNU gdb 4.18 (FreeBSD) Copyright 1998 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "i386-unknown-freebsd"...Deprecated bfd_read called at /usr/src/gnu/usr.bin/binutils/gdb/../../../../contrib/gdb/gdb/dbxread.c line 2627 in elfstab_build_psymtabs Deprecated bfd_read called at /usr/src/gnu/usr.bin/binutils/gdb/../../../../contrib/gdb/gdb/dbxread.c line 933 in fill_symbuf IdlePTD at physical address 0x003a0000 initial pcb at physical address 0x002ea940 panicstr: page fault panic messages: --- Fatal trap 12: page fault while in kernel mode fault virtual address = 0x8 fault code = supervisor read, page not present instruction pointer = 0x8:0xc03742cf stack pointer = 0x10:0xc8910db4 frame pointer = 0x10:0xc8910dc0 code segment = base rx0, limit 0xfffff, type 0x1b = DPL 0, pres 1, def32 1, gran 1 processor eflags = interrupt enabled, resume, IOPL = 0 current process = 63 (ifconfig) interrupt mask = net trap number = 12 panic: page fault syncing disks... 10 10 6 6 3 3 done Uptime: 4s dumping to dev #ad/0x20001, offset 398 dump ata0: resetting devices .. done [dump details elided] --- #0 dumpsys () at /usr/src/sys/kern/kern_shutdown.c:487 487 if (dumping++) { (kgdb) bt full #0 dumpsys () at /usr/src/sys/kern/kern_shutdown.c:487 error = 0 #1 0xc015672f in boot (howto=256) at /usr/src/sys/kern/kern_shutdown.c:316 howto = 256 #2 0xc0156b54 in poweroff_wait (junk=0xc02a5fec, howto=-1070966033) at /usr/src/sys/kern/kern_shutdown.c:595 fmt = 0xc02a5fec "%s" bootopt = 256 buf = "page fault", '\000' <repeats 245 times> #3 0xc0267b22 in trap_fatal (frame=0xc8910d74, eva=8) at /usr/src/sys/i386/i386/trap.c:974 frame = (struct trapframe *) 0x100 code = -1070964756 type = 12 ss = -1070964756 esp = 0 softseg = {ssd_base = 0, ssd_limit = 1048575, ssd_type = 27, ssd_dpl = 0, ssd_p = 1, ssd_xx = 7, ssd_xx1 = 3, ssd_def32 = 1, ssd_gran = 1} #4 0xc02677f5 in trap_pfault (frame=0xc8910d74, usermode=0, eva=8) at /usr/src/sys/i386/i386/trap.c:867 va = 0 vm = (struct vmspace *) 0x0 map = 0xc7be7dc0 rv = 0 ftype = 1 '\001' p = (struct proc *) 0xc7be4100 #5 0xc02673b3 in trap (frame={tf_fs = 16, tf_es = 16, tf_ds = 16, tf_edi = -1061480128, tf_esi = 0, tf_ebp = -930017856, tf_isp = -930017888, tf_ebx = -1061480192, tf_edx = -1061480128, tf_ecx = 0, tf_eax = -1070120256, tf_trapno = 12, tf_err = 0, tf_eip = -1070120241, tf_cs = 8, tf_eflags = 66182, tf_esp = -1061480192, tf_ss = -1061480128}) at /usr/src/sys/i386/i386/trap.c:466 p = (struct proc *) 0xc7be4100 sticks = 13848283118714789888 i = 0 ucode = 0 type = 12 code = 0 eva = 8 #6 0xc03742cf in ?? () No symbol table info available. #7 0xc013363d in mii_mediachg (mii=0xc0bb1940) at /usr/src/sys/dev/mii/mii.c:293 mii = (struct mii_data *) 0x0 child = (struct mii_softc *) 0x660600 rv = 0 #8 0xc03697c1 in ?? () No symbol table info available. #9 0xc0369923 in ?? () No symbol table info available. #10 0xc019acff in ifioctl (so=0xc81e5ee0, cmd=2149607696, data=0xc8910ea8 "rl0", p=0xc7be4100) at /usr/src/sys/net/if.c:1057 cmd = 3233437696 p = (struct proc *) 0x6 ifp = (struct ifnet *) 0xc0bb1940 ifr = (struct ifreq *) 0xc8910ea8 error = 6 new_flags = 6 ---Type <return> to continue, or q <return> to quit--- #11 0xc016910a in soo_ioctl (fp=0xc0c4ad80, cmd=2149607696, data=0xc8910ea8 "rl0", p=0xc7be4100) at /usr/src/sys/kern/sys_socket.c:143 fp = (struct file *) 0x0 cmd = 0 data = 0xc8910ea8 "rl0" p = (struct proc *) 0xc7be4100 so = (struct socket *) 0x0 #12 0xc0166006 in ioctl (p=0xc7be4100, uap=0xc8910f80) at /usr/src/sys/sys/file.h:178 error = 0 fp = (struct file *) 0xc0c4ad80 com = 2149607696 data = 0xc8910ea8 "rl0" p = (struct proc *) 0xc7be4100 fp = (struct file *) 0xc0c4ad80 fdp = (struct filedesc *) 0x0 com = 2149607696 error = 0 size = 32 data = 0xc8910ea8 "rl0" memp = 0x0 tmp = 0 ubuf = { stkbuf = "rl0", '\000' <repeats 13 times>, "\003\210", '\000' <repeats 18 times>, "l\232LÀÄS/À\001\000\000\000l\232LÀÄS/À\001\000\000\000À}¾ÇPù.À", '\000' <repeats 13 times>, "A¾Ç\000A¾ÇÀ}¾Ç\000 \a\b\000A¾Ç\000A¾Ç\001\000\000\000\200\017\221È\000\000\000\000à^\036È\200\017\221È\003\000\000", align = 3173490} #13 0xc0267dd1 in syscall2 (frame={tf_fs = 47, tf_es = 47, tf_ds = 47, tf_edi = 3, tf_esi = 1, tf_ebp = -1077937056, tf_isp = -930017324, tf_ebx = -1077937088, tf_edx = 34818, tf_ecx = -1077937072, tf_eax = 54, tf_trapno = 12, tf_err = 2, tf_eip = 134536332, tf_cs = 31, tf_eflags = 663, tf_esp = -1077937132, tf_ss = 47}) at /usr/src/sys/i386/i386/trap.c:1175 params = 0xbfbffc18 "\003" i = 0 callp = (struct sysent *) 0xc02b3570 p = (struct proc *) 0xc7be4100 orig_tf_eflags = 663 sticks = 0 error = 0 narg = 3 args = {3, -2145359600, -1077937088, 0, 0, 0, 0, 0} have_mplock = 1 code = 54 #14 0xc025bd95 in Xint0x80_syscall () No symbol table info available. #15 0x80489b2 in ?? () No symbol table info available. #16 0x80487c1 in ?? () No symbol table info available. #17 0x804813e in ?? () No symbol table info available. (kgdb) quit % Script done on Sun Jun 11 20:55:15 2006
State Changed From-To: feedback->open Feedback had been recieved.
State Changed From-To: open->feedback Hey there, Would it be possible to test a standard GENERIC kernel on the machine to see whether that would resolve the problem? This means we can focus more explicitly on the problem and see what might be the issue.
Responsible Changed From-To: freebsd-bugs->remko Grab the PR for me tracing the feedback.
State Changed From-To: feedback->closed The submitter mentions that recent versions do no longer have this problem and this PR ticket can be resolved. He mentioned that someone might be able to fix this in RELENG_4 as well so I am asking around a bit for that, if you think you can do this, please make it happen (dont load modules if the support is already in the kernel). thanks Thomas for the quick reply and feedback!