From sa@gw2.svzserv.kemerovo.su  Mon Oct 14 03:34:23 2002
Return-Path: <sa@gw2.svzserv.kemerovo.su>
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 243A837B401
	for <FreeBSD-gnats-submit@freebsd.org>; Mon, 14 Oct 2002 03:34:23 -0700 (PDT)
Received: from gw2.svzserv.kemerovo.su (gw2.svzserv.kemerovo.su [213.184.65.69])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 1ED2343EA9
	for <FreeBSD-gnats-submit@freebsd.org>; Mon, 14 Oct 2002 03:34:21 -0700 (PDT)
	(envelope-from sa@gw2.svzserv.kemerovo.su)
Received: from gw2.svzserv.kemerovo.su (localhost [127.0.0.1])
	by gw2.svzserv.kemerovo.su (8.12.5/8.12.5) with ESMTP id g9EAYFP1001569
	for <FreeBSD-gnats-submit@freebsd.org>; Mon, 14 Oct 2002 18:34:15 +0800 (KRAST)
	(envelope-from sa@gw2.svzserv.kemerovo.su)
Received: (from root@localhost)
	by gw2.svzserv.kemerovo.su (8.12.5/8.12.5/Submit) id g9EAYEi3001568;
	Mon, 14 Oct 2002 18:34:14 +0800 (KRAST)
Message-Id: <200210141034.g9EAYEi3001568@gw2.svzserv.kemerovo.su>
Date: Mon, 14 Oct 2002 18:34:14 +0800 (KRAST)
From: Eugene Grosbein <eugen@grosbein.pp.ru>
To: FreeBSD-gnats-submit@freebsd.org
Cc:
Subject: kernel panic (page fault) with dummynet
X-Send-Pr-Version: 3.113
X-GNATS-Notify:

>Number:         44045
>Category:       kern
>Synopsis:       kernel panic (page fault) with dummynet
>Confidential:   no
>Severity:       serious
>Priority:       high
>Responsible:    maxim
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Mon Oct 14 03:40:01 PDT 2002
>Closed-Date:    Fri Mar 28 03:54:52 PST 2003
>Last-Modified:  Fri Mar 28 04:20:11 PST 2003
>Originator:     Eugene Grosbein
>Release:        FreeBSD 4.6-STABLE i386
>Organization:
Svyaz Service JSC
>Environment:
System: FreeBSD gw2.svzserv.kemerovo.su 4.6-STABLE FreeBSD 4.6-STABLE #4: Tue Aug 20 16:22:37 KRAST 2002 sa@gw2b.svzserv.kemerovo.su:/usr/obj/usr/src/sys/GW2 i386

>Description:
	My router crashed today while loading dummynet rules using
	ipfw /path/to/rules. I was prepared (better safe than sorry)
	and have crashdump (32Mb). This hardware worked flawlessly
	from the beginning of the September 2002. Here is backtrace:

Script started on Mon Oct 14 18:13:06 2002
GNU gdb 4.18 (FreeBSD)
Copyright 1998 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i386-unknown-freebsd"...
IdlePTD at phsyical address 0x00356000
initial pcb at physical address 0x002c4000
panicstr: page fault
panic messages:
---
Fatal trap 12: page fault while in kernel mode
fault virtual address	= 0xc0a8140b
fault code		= supervisor read, page not present
instruction pointer	= 0x8:0xc01c148e
stack pointer	        = 0x10:0xc5ec2c08
frame pointer	        = 0x10:0xc5ec2ca8
code segment		= base 0x0, limit 0xfffff, type 0x1b
			= DPL 0, pres 1, def32 1, gran 1
processor eflags	= interrupt enabled, resume, IOPL = 0
current process		= 44786 (ipfw)
interrupt mask		= net tty 
trap number		= 12
panic: page fault

syncing disks... 33 9 7 6 5 3 2 
done
Uptime: 5d4h50m28s

dumping to dev #ad/0x20001, offset 196624
dump ata0: resetting devices .. done
31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 
---
#0  dumpsys () at /usr/src/sys/kern/kern_shutdown.c:487
487		if (dumping++) {
(kgdb) bt
#0  dumpsys () at /usr/src/sys/kern/kern_shutdown.c:487
#1  0xc01621e8 in boot (howto=256) at /usr/src/sys/kern/kern_shutdown.c:316
#2  0xc0162635 in panic (fmt=0xc02944ac "%s")
    at /usr/src/sys/kern/kern_shutdown.c:595
#3  0xc025e688 in trap_fatal (frame=0xc5ec2bc8, eva=3232240651)
    at /usr/src/sys/i386/i386/trap.c:974
#4  0xc025e325 in trap_pfault (frame=0xc5ec2bc8, usermode=0, eva=3232240651)
    at /usr/src/sys/i386/i386/trap.c:867
#5  0xc025de97 in trap (frame={tf_fs = 16, tf_es = 16, tf_ds = -1066860528, 
      tf_edi = 1, tf_esi = 0, tf_ebp = -974377816, tf_isp = -974377996, 
      tf_ebx = 0, tf_edx = -1039958400, tf_ecx = -1062726645, 
      tf_eax = -1039958400, tf_trapno = 12, tf_err = 0, tf_eip = -1071901554, 
      tf_cs = 8, tf_eflags = 66182, tf_esp = -1040139776, tf_ss = -1070831816})
    at /usr/src/sys/i386/i386/trap.c:466
#6  0xc01c148e in ip_output (m0=0xc2037e80, opt=0x0, ro=0xc200ba2c, flags=0, 
    imo=0x0) at /usr/src/sys/netinet/ip_output.c:187
#7  0xc01b77d6 in transmit_event (pipe=0xc1e08b00)
    at /usr/src/sys/netinet/ip_dummynet.c:429
#8  0xc01b7f6a in dummynet (unused=0x0)
    at /usr/src/sys/netinet/ip_dummynet.c:743
#9  0xc01682bd in softclock () at /usr/src/sys/kern/kern_timeout.c:131
#10 0xc0250733 in doreti_swi ()
#11 0xc01b9952 in ip_dn_ctl (sopt=0xc5ec2f10)
    at /usr/src/sys/netinet/ip_dummynet.c:1905
---Type <return> to continue, or q <return> to quit---
#12 0xc01c3779 in rip_ctloutput (so=0xc4efe700, sopt=0xc5ec2f10)
    at /usr/src/sys/netinet/raw_ip.c:348
#13 0xc01823de in sosetopt (so=0xc4efe700, sopt=0xc5ec2f10)
    at /usr/src/sys/kern/uipc_socket.c:1125
#14 0xc018576f in setsockopt (p=0xc5d9d9c0, uap=0xc5ec2f80)
    at /usr/src/sys/kern/uipc_syscalls.c:1114
#15 0xc025e94d in syscall2 (frame={tf_fs = 47, tf_es = 134807599, 
      tf_ds = -1078001617, tf_edi = -1077939856, tf_esi = 0, 
      tf_ebp = -1077939680, tf_isp = -974377004, tf_ebx = -1077939516, 
      tf_edx = 0, tf_ecx = 0, tf_eax = 105, tf_trapno = 0, tf_err = 2, 
      tf_eip = 134538028, tf_cs = 31, tf_eflags = 647, tf_esp = -1077940156, 
      tf_ss = 47}) at /usr/src/sys/i386/i386/trap.c:1175
#16 0xc024f315 in Xint0x80_syscall ()
#17 0x804d3c4 in ?? ()
#18 0x804db57 in ?? ()
#19 0x8048135 in ?? ()
(kgdb) quit

Script done on Mon Oct 14 18:13:15 2002

Then there is my kernel config:

# GW2 kernel config
#
# Hardware:
# 	Intel Motherboard AL440LX, 
#	see http://www.intel.com/support/motherboards/desktop/AL440LX/
#	Intel Pentium II-233 processor
#
#	NICs: rl0, rf1, fxp0, fxp1. 
# 	Polling is compiled in but NOT enabled
#
options		INCLUDE_CONFIG_FILE

machine		i386
#cpu		I386_CPU
#cpu		I486_CPU
cpu		I586_CPU
cpu		I686_CPU
ident		GW2
maxusers	32
options		MAXDSIZ=(256*1024*1024)
options		DFLDSIZ=(256*1024*1024)

makeoptions	DEBUG=-g		#Build kernel with gdb(1) debug symbols

options 	MATH_EMULATE		#Support for x87 emulation
options		CLK_CALIBRATION_LOOP
options		CLK_USE_I8254_CALIBRATION
options		CLK_USE_TSC_CALIBRATION

options 	INET			#InterNETworking
#options 	INET6			#IPv6 communications protocols
options 	FFS			#Berkeley Fast Filesystem
options 	FFS_ROOT		#FFS usable as root device [keep this!]
options 	SOFTUPDATES		#Enable FFS soft updates support
options 	MFS			#Memory Filesystem
#options 	MD_ROOT			#MD is a potential root device
options 	NFS			#Network Filesystem
#options 	NFS_ROOT		#NFS usable as root device, NFS required
#options 	MSDOSFS			#MSDOS Filesystem
#options 	CD9660			#ISO 9660 Filesystem
#options 	CD9660_ROOT		#CD-ROM usable as root, CD9660 required
#options 	PROCFS			#Process filesystem
options 	COMPAT_43		#Compatible with BSD 4.3 [KEEP THIS!]
options 	SCSI_DELAY=15000	#Delay (in ms) before probing SCSI
#options 	UCONSOLE		#Allow users to grab the console
options 	USERCONFIG		#boot -c editor
options 	VISUAL_USERCONFIG	#visual boot -c editor
options 	KTRACE			#ktrace(1) support
options 	SYSVSHM			#SYSV-style shared memory
options 	SYSVMSG			#SYSV-style message queues
options 	SYSVSEM			#SYSV-style semaphores
options		SHMMAXPGS=4096
options 	P1003_1B		#Posix P1003_1B real-time extensions
options 	_KPOSIX_PRIORITY_SCHEDULING
options		ICMP_BANDLIM		#Rate limit bad replies
options 	KBD_INSTALL_CDEV	# install a CDEV entry in /dev
options		PPP_BSDCOMP
options		PPP_DEFLATE
options		PPP_FILTER
options		NSWAPDEV=4
options		MSGBUF_SIZE=140960

device		isa
#options		"AUTO_EOI_1"

device		eisa
device		pci

# Floppy drives
device		fdc0	at isa? port IO_FD1 irq 6 drq 2
device		fd0	at fdc0 drive 0
#device		fd1	at fdc0 drive 1
#
# If you have a Toshiba Libretto with its Y-E Data PCMCIA floppy,
# don't use the above line for fdc0 but the following one:
#device		fdc0

# ATA and ATAPI devices
#device		ata0	at isa? port IO_WD1 irq 14
#device		ata1	at isa? port IO_WD2 irq 15
device		ata
device		atadisk			# ATA disk drives
device		atapicd			# ATAPI CDROM drives
#device		atapifd			# ATAPI floppy drives
#device		atapist			# ATAPI tape drives
options 	ATA_STATIC_ID		#Static device numbering

# atkbdc0 controls both the keyboard and the PS/2 mouse
device		atkbdc0	at isa? port IO_KBD
device		atkbd0	at atkbdc? irq 1 flags 0x0
#device		psm0	at atkbdc? irq 12

device		vga0	at isa?
#options		VESA

# splash screen/screen saver
#pseudo-device	splash

# syscons is the default console driver, resembling an SCO console
device		sc0	at isa? flags 0x100
options		MAXCONS=16
options		SC_HISTORY_SIZE=1000

# Floating point support - do not disable.
device		npx0	at nexus? port IO_NPX irq 13

# Power management support (see LINT for more options)
#device		apm0    at nexus? disable flags 0x20 # Advanced Power Management

# Serial (COM) ports
device		sio0	at isa? port IO_COM1 flags 0x10 irq 4
#device		sio1	at isa? port IO_COM2 irq 3
#device		sio2	at isa? disable port IO_COM3 irq 5
#device		sio3	at isa? disable port IO_COM4 irq 9

# Parallel port
#device		ppc0	at isa? irq 7
#device		ppbus		# Parallel port bus (required)
#device		lpt		# Printer
#device		plip		# TCP/IP over parallel
#device		ppi		# Parallel port interface device
#device		vpo		# Requires scbus and da

# PCI Ethernet NICs.
#device		de		# DEC/Intel DC21x4x (``Tulip'')
#device		txp		# 3Com 3cR990 (``Typhoon'')
#device		vx		# 3Com 3c590, 3c595 (``Vortex'')

# PCI Ethernet NICs that use the common MII bus controller code.
# NOTE: Be sure to keep the 'device miibus' line in order to use these NICs!
device		miibus		# MII bus support
#device		dc		# DEC/Intel 21143 and various workalikes
device		de
device		fxp		# Intel EtherExpress PRO/100B (82557, 82558)
#device		pcn		# AMD Am79C97x PCI 10/100 NICs
device		rl		# RealTek 8129/8139
#device		sf		# Adaptec AIC-6915 (``Starfire'')
#device		sis		# Silicon Integrated Systems SiS 900/SiS 7016
#device		ste		# Sundance ST201 (D-Link DFE-550TX)
#device		tl		# Texas Instruments ThunderLAN
#device		tx		# SMC EtherPower II (83c170 ``EPIC'')
#device		vr		# VIA Rhine, Rhine II
#device		wb		# Winbond W89C840F
#device		wx		# Intel Gigabit Ethernet Card (``Wiseman'')
#device		xl		# 3Com 3c90x (``Boomerang'', ``Cyclone'')

#device		ed0	at isa? port 0x300 irq 5 iomem 0xd0000
#device		ed1	at isa? port 0x320 irq 10 iomem 0xd8000

#device pcm0 at isa? port ? irq 5 drq 1

# Pseudo devices - the number indicates how many units to allocate.
pseudo-device	loop		# Network loopback
pseudo-device	ether		# Ethernet support
#pseudo-device	sl	1	# Kernel SLIP
pseudo-device	ppp	6	# Kernel PPP
pseudo-device	tun		# Packet tunnel.
pseudo-device	pty	64	# Pseudo-ttys (telnet etc)
pseudo-device	snp	4
pseudo-device	vn
pseudo-device	gzip
pseudo-device	speaker
#pseudo-device	md		# Memory "disks"
pseudo-device	gif		# IPv6 and IPv4 tunneling
#pseudo-device	faith	1	# IPv6-to-IPv4 relaying (translation)

# The `bpf' pseudo-device enables the Berkeley Packet Filter.
# Be aware of the administrative consequences of enabling this!
pseudo-device	bpf		#Berkeley packet filter

options		MROUTING	# not used currently
options 	IPFIREWALL
options 	IPFIREWALL_VERBOSE
#options 	IPFIREWALL_VERBOSE_LIMIT=100
options 	IPDIVERT
options 	IPFIREWALL_FORWARD
options		IPSTEALTH	# not used currently

options		IPFILTER	# not used currently
options		IPFILTER_LOG

##options	NATM			#native mode atm

#options 	ALTQ		#alternate queueing
#options 	CBQ		#class based queueing
#options 	WFQ		#weighted fair queueing
##options 	FIFOQ		#fifo queueing
#options 	RED		#random early detection
##options 	FLOWVALVE	#flowvalve for RED (needs RED)
#options 	RIO		#twin red for diffserv (needs RED)
#options 	CBQ_RED		#red for cbq (needs CBQ and RED)
#options 	CBQ_RIO		#rio for cbq (needs CBQ, RIO, RED, CBQ_RED)
##options 	LOCALQ		#local use
##options 	HFSC		#hierarchical fair service curve
##options 	HFSC_RED	#red for hfsc (needs HFSC and RED)
##options 	HFSC_RIO	#rio for hfsc (needs HFSC, RIO, RED, HFSC_RED)
#options 	ALTQ_ACCOUNT	#altq accounting
##options 	ALTQ_ECN	#ecn extention to tcp
#options 	CDNR		#diffserv traffic conditioner
##options 	BLUE		#blue by wu-chang feng
## you might want to set kernel timer to 1kHz if you use CBQ,
## especially with 100baseT
options 	HZ=1000
options		DEVICE_POLLING

options 	TCP_DROP_SYNFIN		#drop TCP packets with SYN+FIN
options 	DUMMYNET
options		NMBCLUSTERS=8192
options		DDB
options		DDB_UNATTENDED
options		RANDOM_IP_ID
options		UFS_DIRHASH
#options		USER_LDT
#options		UCONSOLE

>How-To-Repeat:
	I have a file that was feed to ipfw to reload dummynet pipes/queues.
	I failed to repeat panic (it is processed OK after reboot) 
	but have crashdump and will be happy to supply any details to track
	this case. The file is 54Kb in size so it follows compressed with
	bzip2 and uuencoded.

begin 644 ipfw.bz2
M0EIH.3%!62936;T^UFP`%.==@$`00`/_X``(/^__X&`?'```]\`-"6'!X&^!
M]0`#[PYT9Z/:#G?$D'3WR\YOOM:#O1WO#>]KX]Y]\^]OKOI[QNC'N<[UW>I:
MW/B%`$"KXV`!L#2AC/U51*C`````DAH35$I31@`0#)H)3RH1`I0!@$T8)@D]
M5$D:IJ-!D&!`::`4E1J0DRGBGII,:`,F2!4U*2:BCT09!B:--#(?%K5N_=^/
MU8QC&,8QC&,8QC&,8QC&,8QC&,8QC&,8QC&,8HC&,8QC&,8QC&,8QC&,\QC&
M,8QC&,8QC&,8QC&,8QC&,8QGF,;SRU5Y57;^NUJW`"`!`"`!`"`!`"`!`"`!
M`"$````````````!T&V;9IILV9F92DEEF9F9A)))(29E*29FFF9)2F9F]`"`
M!`"`!`"`!`"`!`"`!`"$````````````#_WU_#XX^WCS6KO\>55???FD7T2+
MUWV4K'9C&,8QHHHHHHHHHB****(BBBBB(HB****(BBB9%%$11$41%$111111
M$441$11$441$R*(BB(HB*(B(HB*(B(HHHYG'%$R**(BBBB(B**(BB(HHHB**
M(BB(@W-M#;?D_-)))(DDDDDDDDDDDDHB221$DDDDDDDDDG-MMSDDDDDDDDDD
MDG-L>$;;O"TDDDDDDDDDDDDB)*2222222222222222222223(DE)(B222222
M2229G15VF2DS)3I(NDND5FE*^9(OZ2+BB\*%@7\I%[Z]]\K]#_KBY<N7;N[.
MW+DY:^5^E\+];MW=G;XW)RR:Y<..7G.IZ5<JL9FY=<ET:\\B)+DY$2)!Q;&7
MS>M:UK6M:T#6M:UK6M:``&M`UH7=EEEV9C'+UI`-;+NRRRRV,6#&,8`6"[,Q
MC@!=V`7=@.#&8NRRYY;%W>6VVVVWR2N[N^1=W=M\E=WRS+Y9EWP9?$SAF<*9
MOEF7RS+Y9VYQN\;G&YQO;O&[G+,N^#+XS,Y9EW?(N[Y9G&9E\&7?+,ODX[N;
M;=.&VVVY;EMMMPVZ;;;&VVVVV-MMC;;;;;;;;;;;;;;;;;;=]W)+D-)II@QB
M:::;&,8^.7#CER<N.'+E[9%[GS)%_`!PPP,Z^[PKY9\L\=NWCIVSQT[=);ML
M[Y&W:O'3QVSIXK.W3.WC/'CQXGSJ73Q7BNW3MF=/2/*>,KITKQVZ=NWC*JO&
M9XKQ/IJZ5XFJZ=L[9V].WCI/C]%?+/EG^CMV\=.V>.G;IG;MG;QV[5XZ>.V=
M/%9VZ9V\9]/3T]/0X\>/'7CCCKT/3CTX.NCCMT[=O&55>,SQ7C/%=NF>.V?'
M'CT\>G?JM:M^[]X`-LVS;-LTTTTV;-FS,S,S,I2E))++++,S,S,S,S`DDDDD
MDDD"23,S*4I223,S----,S,DDI2E,S,S,RX`````````````````````````
M```````````_Y6KG```````#EM;<X``!RUKG```.6YP`````````````!555
M5?N&#F8WW&V>Y3<GUH``_0@`/R[B)O\G/U0_T_TF'7ZLO,?9;R.WSLZ&`;)$
MX^JSKZKD]=/&1FQDU$=!>>J(-//<O8?>F'6Y>8^RWD=OG9T,`V2)Q]5G7U7)
MZZ>,C-C)J(Z"\]40:>?\H],;,=3XFGD^I\SJ:>3N?$]SU/<]SR?4]SU/)[FG
MU/B?,\GJ1?4^P`ZT^BX=XB(B(B(B(B(]3J1:=3YGN?<[GJ1>YZGW.YZG4B^I
MZG<\GN>2+3W/B:>YU.YII]S2+U/<^9W--(OB1?,W/8`%77DE:&DTTP8Q----
MC&,;&F#&FAIC!IK@^+ZI^+[(QD,;*30QIKK.7'<Y<NI=3JN7+AQQ^LA3V9$"
MC[W$W/>BV[FH'\^SI\=;OB?2]BV[FH'GIT\ZTT\$GB1FD%C&6240#,/$FAX9
M1JV,NJJJ***)10(0+P9,1!#./@^#P^A\=4G#0C/9`C%>1A@NC#S(K#P>"3HX
MAA[(XB...(7E21Q[/;NJ<YZ(]$1Z/"$1ZP?+WW=SG.&'HC;T?'E2>#(\/9Q;
MC/AA[QW-G8AY;=NF\\WDSK'G0YU839\,STWA@X&89T#FW$J<2H3$(LJM.M6D
MT:(T:JJ(@,S*JHB,PP[,PQ?R$(%8A`OV``&]\.OX1]/GQ?7'''+C;J"(V@U"
M=((1C,S,S+"!`(0@B%<RO)JIE.>:[\WO@`````5$%*W)4FY52E8A%BA]79AE
M>R\]U]54(0+UC+#<CP2:HCQPN<+@Y5'"Y5'$AQTQP<'.$B(WUU(BNNDB(WU2
M)&=)VB)DR9,F1$1(B(D1$1$B)$2)QP<''&QW<Y+V+B[4+Q5Q;J?7Z3V^]V[W
MMZRJZNCT^]D[:E^RGT>R'/>])N54[?>=5[VWD37.(YMR;L7%VH6E7%NI]?I/
M;[W;O>WKJN[T>]<Y:E^RGT=D.>]Z3<JMOO95>]MY$UT#-[U1D-RX<,9(R!D%
MVB1W:S?/W\=W<YSP^IF-^3,;T;P@VB!?\`@#Z(0+6_D_>;K[%9$0081)=#)P
M9)1A!14VV\FX)G,NIRJPB[T0@6$B]$B]%*Z>/-L[VVV6VV\)&Y;A&EA'M(.;
M5N$YI:W"<)!M;@*H"VR")J]?D6Q>%*U6:K+]A!Z)%Y55RMSE16)USGG.<]?^
M]@`BJ2D145=R[N[L`#.^]9,R^M]^9RR=:]>N_5]-NG#&,H9!X-D8T<L2PV9R
MBJJE1110^&]K'Z8@C]!"!:6%FFE&C+F[?BWCQX\<\6]#[O2QD*]4Q6FEII8/
MBF:L,`+!,!P<QJHJV'T,,CMZRS66&<:P1&ZI7#A%=2=S5.SJ=5'1JF,B+-$(
MG5*X>3MQSM%H:PL@L+("PL@L+(+"R"PL@M$ZJGIO7:/1V"+0M%HM%HM'K.W'
M9VX[.55<7NT<=HLR,UO,@K;57%MO+1YG:R#95;:O"VWGG;G:KMV6LM9;PQM9
MG64N.SSSMSM1$H$I1`@E>/J/JU)K/I%569GW\_.[N[N"```$524B*BCRY=\R
M<I^WW>(?WI^;Z[N[NRRRRRS:2D5EEHY9&[555%%%$`O@`H!%`("`0F(1P(.#
MP2)"5!``OP$'TOZ955^"U4PP=ALV'#1HT-:36A;2:T>`ZP2AZ<\^7;MVZ;K;
MN74UIBXUF'6U5Q;1W:)F;3(56U<6T.9Q6JN+<R*K5\S9K>'T(]9X5J7H[>L\
M9S/(ZHNV';S/&=E%+PSCLLJLHF&#BBK3B@B$1ALWG,\Y\SGH><US?OW\?``%
M*12N<YSOG.`9F9F+UCLQT[\;VQQX^&Z_55518QC&J/->5K=O=+4(D1F!F?#,
M,SW[]UZ]+J^9VJ`DHBBS"22S"""B5$Q55#IU#BJJ'3^:WQ>?M3#WMN[%B+?2
MO.I@K7=@V:6[7>I@UVC!VFYME!BEI1@4RM*#"F^F=MN*U++=G,XJBRUDJZZZ
MZDZU7JOBMUOW.N]^;W\>_CV`````4I%*\;Q-Z\UNYD7TGNKJ2=]57EKMH=ZN
M]=V68KME=LNWEU>=QXSO//?541&@.P0#T`"$$`9A`AA\,,(,VJB>`@]=>[UQ
MZ\<WT?!5S!$1.E#)-&0::6.G=0S'EY65&&/+I^T^<?+.SR4O*I.<>9V\JUD^
MK6HB%JM9(HX):U$155K%7'25Q(',0*3B8<P0!&1Q6Q11P1]:B(FJUFE<<(*1
M!,1$1`1**37@O3X3=N[_/GOO=W=W,%*1(G.<YSFN`&9F=]=;R<MT[O'HNM-^
MY;;;8QC&4I&>@TM0`DL"`3%^"R;^:\^?AL1"40R3331FFF7.7>3[]^_?KW[[
MV?+Y9&-N;:U*J)V6ZD*2N:Y7&!3?3J0<KHPIN]2#FNJ!2NZ:X*%*YIN(FD^4
MPY@S2<3#D1"B"$0H1*12P)58:35N[_/SY\[N[N[N`&`#!2D2(SK63?,ZSNS.
MKK97X;-Y*+])ADYDHS)6!A)AA(C#"5<*4QA9@?`7X""]W[W=D?;_`R(@(L\>
M+&>/&$'BR,RV9M:;NO3=K2P\D0T"FT&C]E-7&"H,5RJWSKFZ@W:U5W7-T1VE
M[\2#FO%!KRO/$@[KP4:\KE:W?.1$-5<#;BJ'`PMHBKAS/!K*K)DG>]ZWOW\>
M_8`*JDBD1)SG.<YQP`9FR7CCN\X[Y=Z9ZZSSNN.]];WW6[DL@LLD5ED*!CU1
M$(5AE01"@@N\F<NH^?0<1"B&6822,PH@PIS#5V6[CUO7J^-\UOGVD':XP4TH
M,5V<,.E7"ZEQ<J5+C7)`>O:0=[)WJ0-[OBO-M[O=<[O6]O?L`````JJ2*0<$
MW@[S=G?9TYNOM>U555%%%(#P4F;.L/:HB`9P,0@T73WU7K?7N5>PZ)(,-))-
M&155,NQNXNIF[&]7N])))-5YZ$3>XB)JM:52U$1-5K0B6HB*JM:5<,#,L*$5
M55((B(B(B""*$40:J1J]M7-7???O=W=W=PJ(*5=W=W=E@#?GF]+G/,YOF-]5
M4/NN5KEN4V2,9(F4VM319]"@1\,PS.1SUVWQ5>'`C9P2)M3;WO6YSSUY"$56
M(/:8<$Y]$@YV'-.$YIR0`)S;R69K,M:0>R:&F7S$+B2J^21?TD72J1\DB_<D
M7XDB[BJOP)%]5M;6UDUIK36;-,W].$;F9,F3+,S&3,SG(-R9,F3&3)C*9<X1
MN9E,9F3*9F3&X@ML$6V(+;-L;9-LMLVQJMJLJTVF:95IFFD::VS8V39J;)L6
MC)9,6,EDQL4E246)*2;:V5%DK)8U&2R8L9+)BQDLF*$D;6F)*2*)*2*)*2*)
M*2,)(V8DI(T9+)C8I*DHL24D:,EDQ4:2TFBHR63&B2DBQ25)1L9+)BQDLM;6
MA-OJD7\I%YQ57Y157(D7S?4D7J4@]JJ1DB_=_"1?80OH2+WI%X)%[:J1]$B^
MJ1>A(O^)%[Q!YQ57P2+U/\)%]R18D790OO52/(D7V)%[B1?Z`U5-7Z>XB(B;
M9;9MEMFEIHFK*U96LM9:RUEC#&)*2EE99699EF699EK34I(D2)$B1(D4I(D6
MFM-$(A(D6FM-9,LF6FM-(D1#&&LM9:RUJZ2+[ZH5WV(B(B(B(B(B(B(B(B(B
M(B(B(B(B(B(B(B(B(B(B(B(B(B(B(B(B(B(B(B(B(B(B(B(B(B(B(B+:B(B(
MB(B(B(B(B(B*ML1$1$1$5M$1$1$1%1$1$1$1$1$1$1$1$1$1$1$1$1$1$14I
M2E*WV,QH8/H9C?FS%^#V)%Q(O]2+U)%[HJKM47Q2+*%U$B^T2+X.Q"^*19(O
06`_$H7_Q=R13A0D+T^UFP```
`
end


>Fix:

	Unknown to me.
>Release-Note:
>Audit-Trail:

From: Eugene Grosbein <eugen@grosbein.pp.ru>
To: bug-followup@FreeBSD.org
Cc:  
Subject: Re: kern/44045: kernel panic (page fault) with dummynet
Date: Mon, 14 Oct 2002 18:49:55 +0800

 Forgot to attach dmesg output. Note lines like this:
 
 ++ ref to pipe 20 from fs 48
 
 That is what I do not understand.
 Note also next line:
 
 No pipe 18 for queue 18, drop pkt
 
 That's seems to be wrong as I configure a pipe just before add queue using
 the pipe. You can check in uuencoded file of rules, that's the same
 file used after reboot.
 
 dmesg output follows:
 
 Copyright (c) 1992-2002 The FreeBSD Project.
 Copyright (c) 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994
 	The Regents of the University of California. All rights reserved.
 FreeBSD 4.6-STABLE #4: Tue Aug 20 16:22:37 KRAST 2002
     sa@gw2b.svzserv.kemerovo.su:/usr/obj/usr/src/sys/GW2
 Timecounter "i8254"  frequency 1193109 Hz
 Timecounter "TSC"  frequency 233273313 Hz
 CPU: Pentium II/Pentium II Xeon/Celeron (233.27-MHz 686-class CPU)
   Origin = "GenuineIntel"  Id = 0x634  Stepping = 4
   Features=0x80f9ff<FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,SEP,MTRR,PGE,MCA,CMOV,MMX>
 real memory  = 33546240 (32760K bytes)
 config> di pcic0
 No such device: pcic0
 Invalid command or syntax.  Type `?' for help.
 config> di psm0
 No such device: psm0
 Invalid command or syntax.  Type `?' for help.
 config> di sio1
 No such device: sio1
 Invalid command or syntax.  Type `?' for help.
 config> di ppc0
 No such device: ppc0
 Invalid command or syntax.  Type `?' for help.
 config> di sn0
 No such device: sn0
 Invalid command or syntax.  Type `?' for help.
 config> di lnc0
 No such device: lnc0
 Invalid command or syntax.  Type `?' for help.
 config> di ie0
 No such device: ie0
 Invalid command or syntax.  Type `?' for help.
 config> di fe0
 No such device: fe0
 Invalid command or syntax.  Type `?' for help.
 config> di ed0
 No such device: ed0
 Invalid command or syntax.  Type `?' for help.
 config> di cs0
 No such device: cs0
 Invalid command or syntax.  Type `?' for help.
 config> di bt0
 No such device: bt0
 Invalid command or syntax.  Type `?' for help.
 config> di ata1
 No such device: ata1
 Invalid command or syntax.  Type `?' for help.
 config> di aic0
 No such device: aic0
 Invalid command or syntax.  Type `?' for help.
 config> di aha0
 No such device: aha0
 Invalid command or syntax.  Type `?' for help.
 config> di adv0
 No such device: adv0
 Invalid command or syntax.  Type `?' for help.
 config> en ed0
 No such device: ed0
 Invalid command or syntax.  Type `?' for help.
 config> po ed0 0x300
 No such device: ed0
 Invalid command or syntax.  Type `?' for help.
 config> ir ed0 5
 No such device: ed0
 Invalid command or syntax.  Type `?' for help.
 config> iom ed0 0xd0000
 No such device: ed0
 Invalid command or syntax.  Type `?' for help.
 config> f ed0 0
 No such device: ed0
 Invalid command or syntax.  Type `?' for help.
 config> en ed1
 No such device: ed1
 Invalid command or syntax.  Type `?' for help.
 config> po ed1 0x320
 No such device: ed1
 Invalid command or syntax.  Type `?' for help.
 config> ir ed1 3
 No such device: ed1
 Invalid command or syntax.  Type `?' for help.
 config> iom ed1 0xd8000
 No such device: ed1
 Invalid command or syntax.  Type `?' for help.
 config> f ed1 0
 No such device: ed1
 Invalid command or syntax.  Type `?' for help.
 config> q
 avail memory = 29245440 (28560K bytes)
 Preloaded elf kernel "kernel" at 0xc0337000.
 Preloaded userconfig_script "/boot/kernel.conf" at 0xc033709c.
 Pentium Pro MTRR support enabled
 Using $PIR table, 8 entries at 0xc00fdf40
 npx0: <math processor> on motherboard
 npx0: INT 16 interface
 pcib0: <Intel 82443LX (440 LX) host to PCI bridge> on motherboard
 pci0: <PCI bus> on pcib0
 pcib1: <Intel 82443LX (440 LX) PCI-PCI (AGP) bridge> at device 1.0 on pci0
 pci1: <PCI bus> on pcib1
 isab0: <Intel 82371AB PCI to ISA bridge> at device 7.0 on pci0
 isa0: <ISA bus> on isab0
 atapci0: <Intel PIIX4 ATA33 controller> port 0x1880-0x188f at device 7.1 on pci0
 ata0: at 0x1f0 irq 14 on atapci0
 ata1: at 0x170 irq 15 on atapci0
 pci0: <Intel 82371AB/EB (PIIX4) USB controller> at 7.2 irq 9
 chip1: <Intel 82371AB Power management controller> port 0x7000-0x700f at device 7.3 on pci0
 rl0: <D-Link DFE-530TX+ 10/100BaseTX> port 0x1000-0x10ff mem 0xf4201000-0xf42010ff irq 10 at device 13.0 on pci0
 rl0: Ethernet address: 00:50:ba:5c:d8:70
 miibus0: <MII bus> on rl0
 rlphy0: <RealTek internal media interface> on miibus0
 rlphy0:  10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, auto
 rl1: <D-Link DFE-530TX+ 10/100BaseTX> port 0x1400-0x14ff mem 0xf4201400-0xf42014ff irq 15 at device 14.0 on pci0
 rl1: Ethernet address: 00:50:ba:5d:09:24
 miibus1: <MII bus> on rl1
 rlphy1: <RealTek internal media interface> on miibus1
 rlphy1:  10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, auto
 fxp0: <Intel Pro 10/100B/100+ Ethernet> port 0x1800-0x183f mem 0xf4000000-0xf40fffff,0xf4200000-0xf4200fff irq 11 at device 15.0 on pci0
 fxp0: Ethernet address 00:d0:b7:60:70:76
 inphy0: <i82555 10/100 media interface> on miibus2
 inphy0:  10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, auto
 fxp1: <Intel Pro 10/100B/100+ Ethernet> port 0x1860-0x187f mem 0xf4100000-0xf41fffff,0xf4202000-0xf4202fff irq 9 at device 16.0 on pci0
 fxp1: Ethernet address 00:a0:c9:4b:be:21
 inphy1: <i82555 10/100 media interface> on miibus3
 inphy1:  10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, auto
 orm0: <Option ROMs> at iomem 0xc0000-0xc7fff,0xc8000-0xc8fff,0xe4000-0xeffff on isa0
 fdc0: <NEC 72065B or clone> at port 0x3f0-0x3f5,0x3f7 irq 6 drq 2 on isa0
 fdc0: FIFO enabled, 8 bytes threshold
 fd0: <1440-KB 3.5" drive> on fdc0 drive 0
 atkbdc0: <Keyboard controller (i8042)> at port 0x60,0x64 on isa0
 atkbd0: <AT Keyboard> irq 1 on atkbdc0
 kbd0 at atkbd0
 vga0: <Generic ISA VGA> at port 0x3c0-0x3df iomem 0xa0000-0xbffff on isa0
 sc0: <System console> at flags 0x100 on isa0
 sc0: VGA <16 virtual consoles, flags=0x300>
 sio0 at port 0x3f8-0x3ff irq 4 flags 0x10 on isa0
 sio0: type 16550A
 IP packet filtering initialized, divert enabled, rule-based forwarding enabled, default to deny, unlimited logging
 DUMMYNET initialized (011031)
 IP Filter: v3.4.27 initialized.  Default = pass all, Logging = enabled
 ad0: 9541MB <Maxtor 2B010H1> [19386/16/63] at ata0-master UDMA33
 Mounting root from ufs:/dev/ad0s1a
 WARNING: / was not properly dismounted
 ++ ref to pipe 20 from fs 48
 rl1: promiscuous mode enabled
 fxp1: promiscuous mode enabled
 ++ ref to pipe 17 from fs 17
 ++ ref to pipe 17 from fs 17
 No pipe 18 for queue 18, drop pkt
 ++ ref to pipe 18 from fs 18
 ++ ref to pipe 28 from fs 84
 ++ ref to pipe 28 from fs 84
 ++ ref to pipe 60 from fs 168
 ++ ref to pipe 17 from fs 17
 ++ ref to pipe 18 from fs 18
 ++ ref to pipe 17 from fs 17
 ++ ref to pipe 17 from fs 17
 ++ ref to pipe 18 from fs 18
 ++ ref to pipe 17 from fs 17
 ++ ref to pipe 20 from fs 52
 ++ ref to pipe 27 from fs 83
 ++ ref to pipe 28 from fs 84
 ++ ref to pipe 27 from fs 83
 ++ ref to pipe 32 from fs 100
 ++ ref to pipe 32 from fs 100
 
 Eugene Grosbein

From: Maxim Konovalov <maxim@macomnet.ru>
To: bug-followup@freebsd.org
Cc:  
Subject: kern/44045
Date: Tue, 22 Oct 2002 16:53:51 +0400 (MSD)

 Could you please put somewhere on ftp or www a crash dump and
 kernel.debug?
 
 -- 
 Maxim Konovalov, MAcomnet, Internet Dept., system engineer
 phone: +7 (095) 796-9079, mailto:maxim@macomnet.ru
 
 

From: Eugene Grosbein <eugen@kuzbass.ru>
To: Maxim Konovalov <maxim@macomnet.ru>
Cc: bug-followup@freebsd.org
Subject: Re: kern/44045
Date: Wed, 23 Oct 2002 15:36:27 +0800

 Maxim Konovalov wrote:
 > 
 > Could you please put somewhere on ftp or www a crash dump and
 > kernel.debug?
 
 I'll send a link via private mail.
 
 Eugene
Responsible-Changed-From-To: freebsd-bugs->luigi 
Responsible-Changed-By: luigi 
Responsible-Changed-When: Mon Nov 18 14:10:47 PST 2002 
Responsible-Changed-Why:  
my code... 


http://www.freebsd.org/cgi/query-pr.cgi?pr=44045 

From: Eugene Grosbein <eugen@kuzbass.ru>
To: bug-followup@freebsd.org
Cc: luigi@freebsd.org, maxim@freebsd.org
Subject: Re: kern/44045: kernel panic (page fault) with dummynet
Date: Tue, 04 Feb 2003 17:22:32 +0700

 Hi!
 
 What about this case?
 
 Eugene Grosbein
State-Changed-From-To: open->closed 
State-Changed-By: maxim 
State-Changed-When: Fri Mar 28 03:54:21 PST 2003 
State-Changed-Why:  
I believe your problem report is a duplicate of bin/37573. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=37573 

I have already commit a fix for it in -CURRENT and will 
going to MFC to -STABLE in six weeks. 


Responsible-Changed-From-To: luigi->maxim 
Responsible-Changed-By: maxim 
Responsible-Changed-When: Fri Mar 28 03:54:21 PST 2003 
Responsible-Changed-Why:  
Feedbacks trap. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=44045 

From: Eugene Grosbein <eugen@kuzbass.ru>
To: Maxim Konovalov <maxim@FreeBSD.org>
Cc: eugen@grosbein.pp.ru, luigi@FreeBSD.org, bug-followup@FreeBSD.org
Subject: Re: kern/44045: kernel panic (page fault) with dummynet
Date: Fri, 28 Mar 2003 19:09:47 +0700

 Maxim Konovalov wrote:
 
 > I have already commit a fix for it in -CURRENT and will
 > going to MFC to -STABLE in six weeks.
 
 Thank you!
 
 I'll wait MFC and pay extra attention to dummynet behavour
 after MFC.
 
 Eugene Grosbein
>Unformatted:
