From t.seck@ndh.net  Sat Aug 11 07:21:21 2001
Return-Path: <t.seck@ndh.net>
Received: from public.ndh.com (public.ndh.net [195.94.90.21])
	by hub.freebsd.org (Postfix) with ESMTP id DA15037B407
	for <FreeBSD-gnats-submit@freebsd.org>; Sat, 11 Aug 2001 07:21:19 -0700 (PDT)
	(envelope-from t.seck@ndh.net)
Received: from basildon (port2204.duesseldorf.ndh.net [195.227.37.204]) by public.ndh.com (8.9.3/8.8.0) with ESMTP id QAA29674 for <FreeBSD-gnats-submit@freebsd.org>; Sat, 11 Aug 2001 16:21:15 +0200 (MET DST)
Received: from tmseck by basildon with local (Exim 3.32 #1)
	id 15VZd7-00008Y-00
	for FreeBSD-gnats-submit@freebsd.org; Sat, 11 Aug 2001 16:20:45 +0200
Message-Id: <E15VZd7-00008Y-00@basildon>
Date: Sat, 11 Aug 2001 16:20:45 +0200
From: Thomas Seck <tmseck@web.de>
Sender: Thomas Seck <tmseck@basildon.FreeBSD.ORG>
Reply-To: Thomas Seck <tmseck@web.de>
To: FreeBSD-gnats-submit@freebsd.org
Cc:
Subject: ifconfig causes kernel panic in 4.4-PRERELEASE
X-Send-Pr-Version: 3.113
X-GNATS-Notify:

>Number:         29626
>Category:       kern
>Synopsis:       [modules] loading a module that is already compiled in causes a panic (regression)
>Confidential:   no
>Severity:       serious
>Priority:       high
>Responsible:    remko
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Sat Aug 11 07:30:00 PDT 2001
>Closed-Date:    Wed Dec 13 19:51:05 GMT 2006
>Last-Modified:  Wed Dec 13 19:51:05 GMT 2006
>Originator:     Thomas Seck
>Release:        FreeBSD 4.4-PRERELEASE i386
>Organization:
private site in Germany
>Environment:
System: FreeBSD basildon 4.4-PRERELEASE FreeBSD 4.4-PRERELEASE #2: Sat Aug 11 15:26:06 CEST 2001 root@basildon:/usr/obj/usr/src/sys/BASILDON i386

>Description:

After doing a buildworld - builkernel - installkernel - singleuser-boot
- installworld  cycle with sources cvsup'ed from cvsup3.de on 2001/08/11,
the system panicked when it entered multiuser mode and tried to configure
the network. The kernel used for installworld in singleuser was the
GENERIC kernel.

The problem seemingly occured because if_rl and miibus were preloaded.
When the system was booted without these modules and the GENERIC kernel,
it worked.

>How-To-Repeat:

I cannot tell whether other network card modules trigger this problem.
When using a card supported by the if_rl module, preload this module and
boot a generic kernel with support for this nic compiled in.

>Fix:

Do not boot kernels with support for things one has already preloaded?

Seriously: This has not been a problem until now. If this is a feature,
it should be documented in UPDATING.
>Release-Note:
>Audit-Trail:
State-Changed-From-To: open->feedback 
State-Changed-By: kris 
State-Changed-When: Mon Jul 14 03:18:14 PDT 2003 
State-Changed-Why:  
Does this problem persist in recent releases?  If so, 
please obtain a debugging traceback as explained in 
http://www.freebsd.org/doc/en_US.ISO8859-1/books/developers-handbook/kerneldebug.html 

http://www.freebsd.org/cgi/query-pr.cgi?pr=29626 

From: Thomas Seck <tmseck@netcologne.de>
To: bug-followup@freebsd.org
Cc: kris@freebsd.org
Subject: Re: kern/29626: ifconfig causes kernel panic in 4.4-PRERELEASE
Date: Mon, 14 Jul 2003 19:03:58 +0200

 * Kris Kennaway (kris@FreeBSD.org):
 
 > Synopsis: ifconfig causes kernel panic in 4.4-PRERELEASE
 > 
 > State-Changed-From-To: open->feedback
 > State-Changed-By: kris
 > State-Changed-When: Mon Jul 14 03:18:14 PDT 2003
 > State-Changed-Why: 
 > Does this problem persist in recent releases?  If so,
 > please obtain a debugging traceback as explained in
 > http://www.freebsd.org/doc/en_US.ISO8859-1/books/developers-handbook/kerneldebug.html
 > 
 > http://www.freebsd.org/cgi/query-pr.cgi?pr=29626
 
 
 Yes, it does.
 
 I just generated a panic with a -STABLE system as of July 12, 2003 by
 loading if_rl on top of a kernel with support for rl(4) compiled in.
 
 A basic analysis is attached, I can try to put the core online and will
 do further analysis if desired.
 
 
 Script started on Mon Jul 14 18:46:35 2003
 GNU gdb 4.18 (FreeBSD)
 Copyright 1998 Free Software Foundation, Inc.
 GDB is free software, covered by the GNU General Public License, and you are
 welcome to change it and/or distribute copies of it under certain conditions.
 Type "show copying" to see the conditions.
 There is absolutely no warranty for GDB.  Type "show warranty" for details.
 This GDB was configured as "i386-unknown-freebsd".
 (kgdb) symbol-file /kernel.debug
 Reading symbols from /kernel.debug...Deprecated bfd_read called at /usr/src/gnu/usr.bin/binutils/gdb/../../../../contrib/gdb/gdb/dbxread.c line 2627 in elfstab_build_psymtabs
 Deprecated bfd_read called at /usr/src/gnu/usr.bin/binutils/gdb/../../../../contrib/gdb/gdb/dbxread.c line 933 in fill_symbuf
 done.
 (kgdb) exec-file /var/crash/kernel.1
 (kgdb) core-file /var/crash/vmcore.1
 IdlePTD at phsyical address 0x003bf000
 initial pcb at physical address 0x003063c0
 panicstr: page fault
 panic messages:
 ---
 Fatal trap 12: page fault while in kernel mode
 fault virtual address	= 0x8
 fault code		= supervisor read, page not present
 instruction pointer	= 0x8:0xc0394b63
 stack pointer	        = 0x10:0xcff62cf8
 frame pointer	        = 0x10:0xcff62d04
 code segment		= base 0x0, limit 0xfffff, type 0x1b
 			= DPL 0, pres 1, def32 1, gran 1
 processor eflags	= interrupt enabled, resume, IOPL = 0
 current process		= 50 (ifconfig)
 interrupt mask		= net 
 trap number		= 12
 panic: page fault
 
 syncing disks... 8 3 2 2 
 done
 Uptime: 3s
 
 dumping to dev #ad/0x40021, offset 492768
 dump ata2: resetting devices .. done
 255 254 253 252 251 250 249 248 247 246 245 244 243 242 241 240 239 238 237 236 235 234 233 232 231 230 229 228 227 226 225 224 223 222 221 220 219 218 217 216 215 214 213 212 211 210 209 208 207 206 205 204 203 202 201 200 199 198 197 196 195 194 193 192 191 190 189 188 187 186 185 184 183 182 181 180 179 178 177 176 175 174 173 172 171 170 169 168 167 166 165 164 163 162 161 160 159 158 157 156 155 154 153 152 151 150 149 148 147 146 145 144 143 142 141 140 139 138 137 136 135 134 133 132 131 130 129 128  127 126 125 124 123 122 121 120 119 118 117 116 115 114 113 112 111 110 109 108 107 106 105 104 103 102 101 100 99 98 97 96 95 94 93 92 91 90 89 88 87 86 85 84 83 82 81 80 79 78 77 76 75 74 73 72 71 70 69 68 67 66 65 64 63 62 61 60 59 58 57 56 55 54 53 52 51 50 49 48 47 46 45 44 43 42 41 40 39 38 37 36 35 34 33 32 31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 
 ---
 #0  dumpsys () at /usr/src/sys/kern/kern_shutdown.c:487
 487		if (dumping++) {
 (kgdb) where
 #0  dumpsys () at /usr/src/sys/kern/kern_shutdown.c:487
 #1  0xc0156207 in boot (howto=256) at /usr/src/sys/kern/kern_shutdown.c:316
 #2  0xc015662c in poweroff_wait (junk=0xc02c0a4c, howto=-1070856881)
     at /usr/src/sys/kern/kern_shutdown.c:595
 #3  0xc0280c22 in trap_fatal (frame=0xcff62cb8, eva=8)
     at /usr/src/sys/i386/i386/trap.c:974
 #4  0xc02808f5 in trap_pfault (frame=0xcff62cb8, usermode=0, eva=8)
     at /usr/src/sys/i386/i386/trap.c:867
 #5  0xc02804df in trap (frame={tf_fs = 16, tf_es = -886374384, 
       tf_ds = -1070596080, tf_edi = -1059788992, tf_esi = 0, 
       tf_ebp = -805950204, tf_isp = -805950236, tf_ebx = -1059789056, 
       tf_edx = -1059788992, tf_ecx = 0, tf_eax = -1069986988, tf_trapno = 12, 
       tf_err = 0, tf_eip = -1069986973, tf_cs = 8, tf_eflags = 66182, 
       tf_esp = -1059789056, tf_ss = -1059788992})
     at /usr/src/sys/i386/i386/trap.c:466
 #6  0xc0394b63 in ?? ()
 #7  0xc0135689 in mii_mediachg (mii=0xc0d4e740)
     at /usr/src/sys/dev/mii/mii.c:293
 #8  0xc038b7c9 in ?? ()
 #9  0xc019b7f6 in ether_ioctl (ifp=0xc0d45800, command=-2145359604, 
     data=0xc0e22d00 "---") at /usr/src/sys/net/if_ethersubr.c:904
 #10 0xc038b8eb in ?? ()
 #11 0xc01a37f9 in in_ifinit (ifp=0xc0d45800, ia=0xc0e22d00, sin=0xcff62eb8, 
     scrub=0) at /usr/src/sys/netinet/in.c:682
 #12 0xc01a3127 in in_control (so=0xcf6e2f00, cmd=2151704858, 
     data=0xcff62ea8 "rl0", ifp=0xc0d45800, p=0xcb2b82a0)
     at /usr/src/sys/netinet/in.c:406
 #13 0xc019a12a in ifioctl (so=0xcf6e2f00, cmd=2151704858, 
     data=0xcff62ea8 "rl0", p=0xcb2b82a0) at /usr/src/sys/net/if.c:1200
 #14 0xc0168a1a in soo_ioctl (fp=0xc0df0040, cmd=2151704858, 
     data=0xcff62ea8 "rl0", p=0xcb2b82a0) at /usr/src/sys/kern/sys_socket.c:143
 #15 0xc01658fe in ioctl (p=0xcb2b82a0, uap=0xcff62f80)
     at /usr/src/sys/sys/file.h:178
 #16 0xc0280ed1 in syscall2 (frame={tf_fs = 47, tf_es = 47, tf_ds = 47, 
       tf_edi = 0, tf_esi = -1077936704, tf_ebp = -1077936944, 
       tf_isp = -805949484, tf_ebx = 134682820, tf_edx = 3, tf_ecx = 134768368, 
       tf_eax = 54, tf_trapno = 12, tf_err = 2, tf_eip = 134536316, tf_cs = 31, 
       tf_eflags = 659, tf_esp = -1077937084, tf_ss = 47})
     at /usr/src/sys/i386/i386/trap.c:1175
 #17 0xc0274ad5 in Xint0x80_syscall ()
 #18 0x80487b1 in ?? ()
 #19 0x804813e in ?? ()
 (kgdb) quit
 
 Script done on Mon Jul 14 18:48:31 2003
 
 Regards,
 -- 
 Thomas Seck

From: Kris Kennaway <kris@obsecurity.org>
To: Thomas Seck <tmseck@netcologne.de>
Cc: bug-followup@freebsd.org, kris@freebsd.org
Subject: Re: kern/29626: ifconfig causes kernel panic in 4.4-PRERELEASE
Date: Fri, 15 Aug 2003 20:20:03 -0700

 On Mon, Jul 14, 2003 at 07:03:58PM +0200, Thomas Seck wrote:
 
 > I just generated a panic with a -STABLE system as of July 12, 2003 by
 > loading if_rl on top of a kernel with support for rl(4) compiled in.
 
 That's the real problem here, I think.  This is normally supposed to fail.
 
 Kris

From: Thomas Seck <tmseck@netcologne.de>
To: Kris Kennaway <kris@obsecurity.org>
Cc: bug-followup@freebsd.org
Subject: Re: kern/29626: ifconfig causes kernel panic in 4.4-PRERELEASE
Date: Sat, 16 Aug 2003 14:21:04 +0200

 * Kris Kennaway (kris@obsecurity.org):
 
 > On Mon, Jul 14, 2003 at 07:03:58PM +0200, Thomas Seck wrote:
 > 
 > > I just generated a panic with a -STABLE system as of July 12, 2003 by
 > > loading if_rl on top of a kernel with support for rl(4) compiled in.
 > 
 > That's the real problem here, I think.  This is normally supposed to fail.
 
 Just to be clear: the problem arises when preloading a module via the
 loader, not via kldload.
 
 It definitely "worked" (or the loading of the module silently failed)
 with 4.3 and before and broke during the 4.4-prerelease cycle.  I did
 unfortunately not have the time to identify the culprit.
 
 Regards,
 -- 
 Thomas Seck

From: Maxim Konovalov <maxim@macomnet.ru>
To: Thomas Seck <tmseck@web.de>
Cc: bug-followup@freebsd.org
Subject: kern/29626
Date: Sun, 11 Jun 2006 21:16:00 +0400 (MSD)

 Hi Thomas,
 
 I've just checked on RELENG_4 system with GENERIC kernel:
 if_rl_load="YES" in /boot/loader.conf makes no harm at all.  Is it
 still a problem for you?  Thanks!
 
 -- 
 Maxim Konovalov

From: Thomas-Martin Seck <tmseck@web.de>
To: Maxim Konovalov <maxim@macomnet.ru>
Cc: bug-followup@freebsd.org
Subject: Re: kern/29626
Date: Sun, 11 Jun 2006 21:06:15 +0200

 * Maxim Konovalov (maxim@macomnet.ru):
 
 Thanks for having a look at this!
 
 > I've just checked on RELENG_4 system with GENERIC kernel:
 > if_rl_load="YES" in /boot/loader.conf makes no harm at all.  Is it
 > still a problem for you?  Thanks!
 
 Yes, unfortunately. This system is a stripped down RELENG_4 GENERIC
 kernel, last updated from 2006-03-12 sources, that contains if_rl
 and miibus. When putting if_rl_load="YES" in /boot/loader.conf and
 rebooting, if_rl and miibus are loaded on top of the kernel without
 error or warning. The system explodes when entering multiuser mode and
 ifconfig tries to configure the rl interface.
 
 I have not yet checked whether this issue exists in 5.x or later, I
 admit I totally forgot about it :)
 
 Transcript of debugging session:
 
 Script started on Sun Jun 11 20:54:25 2006
 % sudo gdb -k /kernel.debug /var/crash/vmcore.1
 Please enter your sudo password: 
 GNU gdb 4.18 (FreeBSD)
 Copyright 1998 Free Software Foundation, Inc.
 GDB is free software, covered by the GNU General Public License, and you are
 welcome to change it and/or distribute copies of it under certain conditions.
 Type "show copying" to see the conditions.
 There is absolutely no warranty for GDB.  Type "show warranty" for details.
 This GDB was configured as "i386-unknown-freebsd"...Deprecated bfd_read called at /usr/src/gnu/usr.bin/binutils/gdb/../../../../contrib/gdb/gdb/dbxread.c line 2627 in elfstab_build_psymtabs
 Deprecated bfd_read called at /usr/src/gnu/usr.bin/binutils/gdb/../../../../contrib/gdb/gdb/dbxread.c line 933 in fill_symbuf
 
 IdlePTD at physical address 0x003a0000
 initial pcb at physical address 0x002ea940
 panicstr: page fault
 panic messages:
 ---
 Fatal trap 12: page fault while in kernel mode
 fault virtual address	= 0x8
 fault code		= supervisor read, page not present
 instruction pointer	= 0x8:0xc03742cf
 stack pointer	        = 0x10:0xc8910db4
 frame pointer	        = 0x10:0xc8910dc0
 code segment		= base 0x0, limit 0xfffff, type 0x1b
 			= DPL 0, pres 1, def32 1, gran 1
 processor eflags	= interrupt enabled, resume, IOPL = 0
 current process		= 63 (ifconfig)
 interrupt mask		= net 
 trap number		= 12
 panic: page fault
 
 syncing disks... 10 10 6 6 3 3 
 done
 Uptime: 4s
 
 dumping to dev #ad/0x20001, offset 398
 dump ata0: resetting devices .. done
 
 [dump details elided]
 
 ---
 #0  dumpsys () at /usr/src/sys/kern/kern_shutdown.c:487
 487		if (dumping++) {
 (kgdb) bt full
 #0  dumpsys () at /usr/src/sys/kern/kern_shutdown.c:487
 	error = 0
 #1  0xc015672f in boot (howto=256) at /usr/src/sys/kern/kern_shutdown.c:316
 	howto = 256
 #2  0xc0156b54 in poweroff_wait (junk=0xc02a5fec, howto=-1070966033)
     at /usr/src/sys/kern/kern_shutdown.c:595
 	fmt = 0xc02a5fec "%s"
 	bootopt = 256
 	buf = "page fault", '\000' <repeats 245 times>
 #3  0xc0267b22 in trap_fatal (frame=0xc8910d74, eva=8)
     at /usr/src/sys/i386/i386/trap.c:974
 	frame = (struct trapframe *) 0x100
 	code = -1070964756
 	type = 12
 	ss = -1070964756
 	esp = 0
 	softseg = {ssd_base = 0, ssd_limit = 1048575, ssd_type = 27, 
   ssd_dpl = 0, ssd_p = 1, ssd_xx = 7, ssd_xx1 = 3, ssd_def32 = 1, ssd_gran = 1}
 #4  0xc02677f5 in trap_pfault (frame=0xc8910d74, usermode=0, eva=8)
     at /usr/src/sys/i386/i386/trap.c:867
 	va = 0
 	vm = (struct vmspace *) 0x0
 	map = 0xc7be7dc0
 	rv = 0
 	ftype = 1 '\001'
 	p = (struct proc *) 0xc7be4100
 #5  0xc02673b3 in trap (frame={tf_fs = 16, tf_es = 16, tf_ds = 16, 
       tf_edi = -1061480128, tf_esi = 0, tf_ebp = -930017856, 
       tf_isp = -930017888, tf_ebx = -1061480192, tf_edx = -1061480128, 
       tf_ecx = 0, tf_eax = -1070120256, tf_trapno = 12, tf_err = 0, 
       tf_eip = -1070120241, tf_cs = 8, tf_eflags = 66182, 
       tf_esp = -1061480192, tf_ss = -1061480128})
     at /usr/src/sys/i386/i386/trap.c:466
 	p = (struct proc *) 0xc7be4100
 	sticks = 13848283118714789888
 	i = 0
 	ucode = 0
 	type = 12
 	code = 0
 	eva = 8
 #6  0xc03742cf in ?? ()
 No symbol table info available.
 #7  0xc013363d in mii_mediachg (mii=0xc0bb1940)
     at /usr/src/sys/dev/mii/mii.c:293
 	mii = (struct mii_data *) 0x0
 	child = (struct mii_softc *) 0x660600
 	rv = 0
 #8  0xc03697c1 in ?? ()
 No symbol table info available.
 #9  0xc0369923 in ?? ()
 No symbol table info available.
 #10 0xc019acff in ifioctl (so=0xc81e5ee0, cmd=2149607696, 
     data=0xc8910ea8 "rl0", p=0xc7be4100) at /usr/src/sys/net/if.c:1057
 	cmd = 3233437696
 	p = (struct proc *) 0x6
 	ifp = (struct ifnet *) 0xc0bb1940
 	ifr = (struct ifreq *) 0xc8910ea8
 	error = 6
 	new_flags = 6
 ---Type <return> to continue, or q <return> to quit---
 #11 0xc016910a in soo_ioctl (fp=0xc0c4ad80, cmd=2149607696, 
     data=0xc8910ea8 "rl0", p=0xc7be4100) at /usr/src/sys/kern/sys_socket.c:143
 	fp = (struct file *) 0x0
 	cmd = 0
 	data = 0xc8910ea8 "rl0"
 	p = (struct proc *) 0xc7be4100
 	so = (struct socket *) 0x0
 #12 0xc0166006 in ioctl (p=0xc7be4100, uap=0xc8910f80)
     at /usr/src/sys/sys/file.h:178
 	error = 0
 	fp = (struct file *) 0xc0c4ad80
 	com = 2149607696
 	data = 0xc8910ea8 "rl0"
 	p = (struct proc *) 0xc7be4100
 	fp = (struct file *) 0xc0c4ad80
 	fdp = (struct filedesc *) 0x0
 	com = 2149607696
 	error = 0
 	size = 32
 	data = 0xc8910ea8 "rl0"
 	memp = 0x0
 	tmp = 0
 	ubuf = {
   stkbuf = "rl0", '\000' <repeats 13 times>, "\003\210", '\000' <repeats 18 times>, "l\232LS/\001\000\000\000l\232LS/\001\000\000\000}P.", '\000' <repeats 13 times>, "A\000A}\000\a\b\000A\000A\001\000\000\000\200\017\221\000\000\000\000^\036\200\017\221\003\000\000", align = 3173490}
 #13 0xc0267dd1 in syscall2 (frame={tf_fs = 47, tf_es = 47, tf_ds = 47, 
       tf_edi = 3, tf_esi = 1, tf_ebp = -1077937056, tf_isp = -930017324, 
       tf_ebx = -1077937088, tf_edx = 34818, tf_ecx = -1077937072, tf_eax = 54, 
       tf_trapno = 12, tf_err = 2, tf_eip = 134536332, tf_cs = 31, 
       tf_eflags = 663, tf_esp = -1077937132, tf_ss = 47})
     at /usr/src/sys/i386/i386/trap.c:1175
 	params = 0xbfbffc18 "\003"
 	i = 0
 	callp = (struct sysent *) 0xc02b3570
 	p = (struct proc *) 0xc7be4100
 	orig_tf_eflags = 663
 	sticks = 0
 	error = 0
 	narg = 3
 	args = {3, -2145359600, -1077937088, 0, 0, 0, 0, 0}
 	have_mplock = 1
 	code = 54
 #14 0xc025bd95 in Xint0x80_syscall ()
 No symbol table info available.
 #15 0x80489b2 in ?? ()
 No symbol table info available.
 #16 0x80487c1 in ?? ()
 No symbol table info available.
 #17 0x804813e in ?? ()
 No symbol table info available.
 (kgdb) quit
 %
 
 Script done on Sun Jun 11 20:55:15 2006
State-Changed-From-To: feedback->open 
State-Changed-By: remko 
State-Changed-When: Sun Nov 12 10:32:03 UTC 2006 
State-Changed-Why:  
Feedback had been recieved. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=29626 
State-Changed-From-To: open->feedback 
State-Changed-By: remko 
State-Changed-When: Wed Dec 13 14:25:23 UTC 2006 
State-Changed-Why:  
Hey there, 

Would it be possible to test a standard GENERIC kernel on the machine 
to see whether that would resolve the problem? This means we can 
focus more explicitly on the problem and see what might be the 
issue. 

Thanks 


Responsible-Changed-From-To: freebsd-bugs->remko 
Responsible-Changed-By: remko 
Responsible-Changed-When: Wed Dec 13 14:25:23 UTC 2006 
Responsible-Changed-Why:  
Grab the PR for me tracing the feedback. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=29626 
State-Changed-From-To: feedback->closed 
State-Changed-By: remko 
State-Changed-When: Wed Dec 13 19:51:04 UTC 2006 
State-Changed-Why:  
The submitter mentions that recent versions do no longer have this 
problem and this PR ticket can be resolved. He mentioned that someone 
might be able to fix this in RELENG_4 as well so I am asking around a 
bit for that, if you think you can do this, please make it happen (dont 
load modules if the support is already in the kernel). thanks Thomas for 
the quick reply and feedback! 

http://www.freebsd.org/cgi/query-pr.cgi?pr=29626 
>Unformatted:
