From nobody@FreeBSD.org  Sat Mar 11 01:57:41 2006
Return-Path: <nobody@FreeBSD.org>
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id E241E16A49A
	for <freebsd-gnats-submit@FreeBSD.org>; Sat, 11 Mar 2006 01:57:32 +0000 (GMT)
	(envelope-from nobody@FreeBSD.org)
Received: from www.freebsd.org (www.freebsd.org [216.136.204.117])
	by mx1.FreeBSD.org (Postfix) with ESMTP id D1B144F1EC
	for <freebsd-gnats-submit@FreeBSD.org>; Fri, 10 Mar 2006 22:49:39 +0000 (GMT)
	(envelope-from nobody@FreeBSD.org)
Received: from www.freebsd.org (localhost [127.0.0.1])
	by www.freebsd.org (8.13.1/8.13.1) with ESMTP id k2AMnddB007325
	for <freebsd-gnats-submit@FreeBSD.org>; Fri, 10 Mar 2006 22:49:39 GMT
	(envelope-from nobody@www.freebsd.org)
Received: (from nobody@localhost)
	by www.freebsd.org (8.13.1/8.13.1/Submit) id k2AMndKc007324;
	Fri, 10 Mar 2006 22:49:39 GMT
	(envelope-from nobody)
Message-Id: <200603102249.k2AMndKc007324@www.freebsd.org>
Date: Fri, 10 Mar 2006 22:49:39 GMT
From: "Byron L. Hicks" <bhicks@nmsu.edu>
To: freebsd-gnats-submit@FreeBSD.org
Subject: kernel panics when passing trafffic through bge1
X-Send-Pr-Version: www-2.3

>Number:         94307
>Category:       kern
>Synopsis:       [bge] kernel panics when passing trafffic through bge1
>Confidential:   no
>Severity:       serious
>Priority:       high
>Responsible:    linimon
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Sat Mar 11 02:00:38 GMT 2006
>Closed-Date:    Mon Jul 23 03:54:14 GMT 2007
>Last-Modified:  Mon Jul 23 03:54:14 GMT 2007
>Originator:     Byron L. Hicks
>Release:        6.1-PRERELEASE
>Organization:
NMSU ICT
>Environment:
FreeBSD monitor-temp.nmsu.edu 6.1-PRERELEASE FreeBSD 6.1-PRERELEASE #0: Fri Dec 16 05:02:27 MST 2005     root@monitor-temp.nmsu.edu:/usr/obj/usr/src/sys/DL320  i386
>Description:
I can enable the bge1 interface, add an IP address, and a default route.  Once I start trying to pass traffic, the kernel panics.

Here is the output of a kernel debug:

monitor-temp# kgdb kernel.debug /usr/local/crash/vmcore.0
[GDB will not be able to debug user-mode threads: /usr/lib/libthread_db.so: Undefined symbol "ps_pglobal_lookup"]
GNU gdb 6.1.1 [FreeBSD]
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i386-marcel-freebsd".

Unread portion of the kernel message buffer:
bge1: discard frame w/o leading ethernet header (len 4294967292 pkt len 4294967292)


Fatal trap 12: page fault while in kernel mode
fault virtual address   = 0xc
fault code              = supervisor write, page not present
instruction pointer     = 0x20:0xc0459053
stack pointer           = 0x28:0xe4c7fca8
frame pointer           = 0x28:0xe4c7fcd0
code segment            = base 0x0, limit 0xfffff, type 0x1b
                        = DPL 0, pres 1, def32 1, gran 1
processor eflags        = interrupt enabled, resume, IOPL = 0
current process         = 28 (irq17: bge1 atapci+)
trap number             = 12
panic: page fault
Uptime: 3m8s
Dumping 1023 MB (2 chunks)
  chunk 0: 1MB (159 pages) ... ok
  chunk 1: 1023MB (261848 pages) 1007 991 975 959 943 927 911 895 879 863 847 831 815 799 783 767 751 735 719 703 687 671 655 639 623 607 591 575 559 543 527 511 495 479 463 447 431 415 399 383 367 351 335 319 303 287 271 255 239 223 207 191 175 159 143 127 111 95 79 63 47 31 15

#0  doadump () at pcpu.h:165
165             __asm __volatile("movl %%fs:0,%0" : "=r" (td));

Here is the dmesg from the boot:

Copyright (c) 1992-2006 The FreeBSD Project.
Copyright (c) 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994
        The Regents of the University of California. All rights reserved.
FreeBSD 6.1-PRERELEASE #0: Fri Dec 16 05:02:27 MST 2005
    root@monitor-temp.nmsu.edu:/usr/obj/usr/src/sys/DL320
Timecounter "i8254" frequency 1193182 Hz quality 0
CPU: Intel(R) Pentium(R) D CPU 2.80GHz (2793.02-MHz 686-class CPU)
  Origin = "GenuineIntel"  Id = 0xf44  Stepping = 4
  Features=0xbfebfbff<FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,C
MOV,PAT,PSE36,CLFLUSH,DTS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,PBE>
  Features2=0x641d<SSE3,RSVD2,MON,DS_CPL,CNTX-ID,CX16,<b14>>
  AMD Features=0x20000000<LM>
  Hyperthreading: 2 logical CPUs
real memory  = 1073577984 (1023 MB)
avail memory = 1045958656 (997 MB)
ACPI APIC Table: <HP     00000083>
ioapic0 <Version 2.0> irqs 0-23 on motherboard
npx0: [FAST]
npx0: <math processor> on motherboard
npx0: INT 16 interface
acpi0: <HP D20> on motherboard
acpi0: Power Button (fixed)
Timecounter "ACPI-fast" frequency 3579545 Hz quality 1000
acpi_timer0: <24-bit timer at 3.579545MHz> port 0x908-0x90b on acpi0
cpu0: <ACPI CPU> on acpi0
pcib0: <ACPI Host-PCI bridge> on acpi0
pci0: <ACPI PCI bus> on pcib0
pcib0: no PRT entry for 0.31.INTA
pcib1: <ACPI PCI-PCI bridge> at device 1.0 on pci0
pci4: <ACPI PCI bus> on pcib1
pcib2: <ACPI PCI-PCI bridge> at device 0.0 on pci4
pci5: <ACPI PCI bus> on pcib2
bge0: <Broadcom BCM5714C Gigabit Ethernet, ASIC rev. 0x9001> mem 0xfdff0000-0xfd
ffffff,0xfdfe0000-0xfdfeffff irq 16 at device 4.0 on pci5
miibus0: <MII bus> on bge0
brgphy0: <BCM5714 10/100/1000baseTX PHY> on miibus0
brgphy0:  10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, 1000baseTX, 1000baseTX
-FDX, auto
bge0: Ethernet address: 00:16:35:5a:9d:35
bge1: <Broadcom BCM5714C Gigabit Ethernet, ASIC rev. 0x9001> mem 0xfdfd0000-0xfd
fdffff,0xfdfc0000-0xfdfcffff irq 17 at device 4.1 on pci5
miibus1: <MII bus> on bge1
brgphy1: <BCM5714 10/100/1000baseTX PHY> on miibus1
brgphy1:  10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, 1000baseTX, 1000baseTX
-FDX, auto
bge1: Ethernet address: 00:16:35:5a:9d:36
pcib3: <ACPI PCI-PCI bridge> at device 8.0 on pci5
pci6: <ACPI PCI bus> on pcib3
pcib4: <ACPI PCI-PCI bridge> at device 28.0 on pci0
pci2: <ACPI PCI bus> on pcib4
pcib5: <ACPI PCI-PCI bridge> at device 28.4 on pci0
pci3: <ACPI PCI bus> on pcib5
pci0: <serial bus, USB> at device 29.0 (no driver attached)
pci0: <serial bus, USB> at device 29.1 (no driver attached)
pci0: <serial bus, USB> at device 29.2 (no driver attached)
pci0: <serial bus, USB> at device 29.3 (no driver attached)
pci0: <serial bus, USB> at device 29.7 (no driver attached)
pcib6: <ACPI PCI-PCI bridge> at device 30.0 on pci0
pci1: <ACPI PCI bus> on pcib6
pci1: <display, VGA> at device 3.0 (no driver attached)
pci1: <base peripheral> at device 4.0 (no driver attached)
pci1: <base peripheral> at device 4.2 (no driver attached)
pci1: <serial bus, USB> at device 4.4 (no driver attached)
isab0: <PCI-ISA bridge> at device 31.0 on pci0
isa0: <ISA bus> on isab0
atapci0: <Intel ICH7 UDMA100 controller> port 0x1f0-0x1f7,0x3f6,0x170-0x177,0x37
6,0x500-0x50f irq 7 at device 31.1 on pci0
ata0: <ATA channel 0> on atapci0
ata1: <ATA channel 1> on atapci0
atapci1: <Intel ICH7 SATA300 controller> port 0x1080-0x1087,0x1088-0x108b,0x1090
-0x1097,0x1098-0x109b,0x10a0-0x10af mem 0xfdde0000-0xfdde03ff irq 17 at device 3
1.2 on pci0
ata2: <ATA channel 0> on atapci1
ata3: <ATA channel 1> on atapci1
acpi_tz0: <Thermal Zone> on acpi0
atkbdc0: <Keyboard controller (i8042)> port 0x60,0x64 irq 1 on acpi0
atkbd0: <AT Keyboard> irq 1 on atkbdc0
kbd0 at atkbd0
atkbd0: [GIANT-LOCKED]
psm0: <PS/2 Mouse> irq 12 on atkbdc0
psm0: [GIANT-LOCKED]
psm0: model Generic PS/2 mouse, device ID 0
sio0: <Standard PC COM port> port 0x3f8-0x3ff irq 4 flags 0x10 on acpi0
sio0: type 16550A, console
fdc0: <floppy drive controller (FDE)> port 0x3f2-0x3f5 irq 6 drq 2 on acpi0
fdc0: does not respond
device_attach: fdc0 attach returned 6
fdc0: <floppy drive controller (FDE)> port 0x3f2-0x3f5 irq 6 drq 2 on acpi0
fdc0: does not respond
device_attach: fdc0 attach returned 6
pmtimer0 on isa0
orm0: <ISA Option ROMs> at iomem 0xc0000-0xcafff,0xee000-0xeffff on isa0
sc0: <System console> at flags 0x100 on isa0
sc0: VGA <16 virtual consoles, flags=0x100>
sio1 at port 0x2f8-0x2ff irq 3 on isa0
sio1: type 16550A
vga0: <Generic ISA VGA> at port 0x3c0-0x3df iomem 0xa0000-0xbffff on isa0
Timecounter "TSC" frequency 2793023303 Hz quality 800
Timecounters tick every 1.000 msec
acd0: DVDROM <DV-28E-C/B.4F> at ata0-master PIO4
ad4: 76319MB <Maxtor 6L080M0 BANC1G10> at ata2-master SATA150
Trying to mount root from ufs:/dev/ad4s1a
WARNING: / was not properly dismounted
WARNING: /tmp was not properly dismounted
WARNING: /usr was not properly dismounted
WARNING: /var was not properly dismounted
/var: mount pending error: blocks 300 files 1

The machine in question is an HP Proliant Server DL320 G4.  It has a Dual Core Pentium D 2.8Ghz processor and 1G RAM.  This has been duplicated on two identical servers, so it is unlikely to be faulty hardware.
>How-To-Repeat:
Try to send traffic through the bge1 interface after it has been configured.
>Fix:

>Release-Note:
>Audit-Trail:

From: Kris Kennaway <kris@obsecurity.org>
To: "Byron L. Hicks" <bhicks@nmsu.edu>
Cc: freebsd-gnats-submit@FreeBSD.org
Subject: Re: kern/94307: kernel panics when passing trafffic through bge1
Date: Fri, 10 Mar 2006 23:42:42 -0500

 You forgot to obtain the backtrace, which is usually the relevant
 part.  See the chapter on kernel debugging in the developers handbook.
 
 Kris

From: "Byron L. Hicks" <bhicks@nmsu.edu>
To: bug-followup@FreeBSD.org, bhicks@nmsu.edu
Cc:  
Subject: Re: kern/94307: [bge] kernel panics when passing trafffic through
 bge1
Date: Mon, 13 Mar 2006 09:01:55 -0700

 -----BEGIN PGP SIGNED MESSAGE-----
 Hash: SHA1
 
 Sorry, here is the stack trace:
 
 monitor-temp# kgdb kernel.debug /usr/local/crash/vmcore.0
 [GDB will not be able to debug user-mode threads:
 /usr/lib/libthread_db.so: Undefined symbol "ps_pglobal_lookup"]
 GNU gdb 6.1.1 [FreeBSD]
 Copyright 2004 Free Software Foundation, Inc.
 GDB is free software, covered by the GNU General Public License, and you are
 welcome to change it and/or distribute copies of it under certain
 conditions.
 Type "show copying" to see the conditions.
 There is absolutely no warranty for GDB.  Type "show warranty" for details.
 This GDB was configured as "i386-marcel-freebsd".
 
 Unread portion of the kernel message buffer:
 bge1: discard frame w/o leading ethernet header (len 4294967292 pkt len
 4294967292)
 
 
 Fatal trap 12: page fault while in kernel mode
 fault virtual address   = 0xc
 fault code              = supervisor write, page not present
 instruction pointer     = 0x20:0xc0459053
 stack pointer           = 0x28:0xe4c7fca8
 frame pointer           = 0x28:0xe4c7fcd0
 code segment            = base 0x0, limit 0xfffff, type 0x1b
                         = DPL 0, pres 1, def32 1, gran 1
 processor eflags        = interrupt enabled, resume, IOPL = 0
 current process         = 28 (irq17: bge1 atapci+)
 trap number             = 12
 panic: page fault
 Uptime: 3m8s
 Dumping 1023 MB (2 chunks)
   chunk 0: 1MB (159 pages) ... ok
   chunk 1: 1023MB (261848 pages) 1007 991 975 959 943 927 911 895 879
 863 847 831 815 799 783 767 751 735 719 703 687 671 655 639 623 607 591
 575 559 543 527 511 495 479 463 447 431 415 399 383 367 351 335 319 303
 287 271 255 239 223 207 191 175 159 143 127 111 95 79 63 47 31 15
 
 #0  doadump () at pcpu.h:165
 165             __asm __volatile("movl %%fs:0,%0" : "=r" (td));
 (kgdb) list *0xc0459053
 0xc0459053 is in bge_rxeof (/usr/src/sys/dev/bge/if_bge.c:2626).
 warning: Source file is more recent than executable.
 
 2621                                cur_rx->bge_len);
 2622                            m->m_data += ETHER_ALIGN;
 2623                    }
 2624    #endif
 2625                    eh = mtod(m, struct ether_header *);
 2626                    m->m_pkthdr.len = m->m_len = cur_rx->bge_len -
 ETHER_CRC_LEN;
 2627                    m->m_pkthdr.rcvif = ifp;
 2628
 2629                    if (ifp->if_capenable & IFCAP_RXCSUM) {
 2630                            if (cur_rx->bge_flags &
 BGE_RXBDFLAG_IP_CSUM) {
 
 
 - --
 Byron L. Hicks
 Network Engineer
 NMSU ICT/CHECS-NET
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1.4.1 (Darwin)
 Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org
 
 iD8DBQFEFZdzIuuK+iJ+1EMRAlcFAJwMGONOlQVwBYXOea9/8unV+Oz2aACaAxP3
 favzdoey+5z235DQ4K70IWQ=
 =Vk0v
 -----END PGP SIGNATURE-----

From: Gleb Smirnoff <glebius@FreeBSD.org>
To: "Byron L. Hicks" <bhicks@nmsu.edu>
Cc: freebsd-gnats-submit@FreeBSD.org, oleg@FreeBSD.org
Subject: Re: kern/94307: kernel panics when passing trafffic through bge1
Date: Wed, 15 Mar 2006 18:25:21 +0300

   Byron,
 
   first question: is this a regression or not? Have you tried 6.0-RELEASE
 on this box?
 
   Second one: in the last kgdb output, you showed there is an important
 warning:
 
  warning: Source file is more recent than executable.
 
 I'd recommend to update to latemost RELENG_6 (we've got important bugfix
 in mbuf allocator, that affects all NIC drivers), build a new kernel,
 and obtain a dump with it. Then open the dump with kgdb, type 'bt',
 then go into the crash frame and look at variables. Then please send
 the output of this as followup to PR.
 
 -- 
 Totus tuus, Glebius.
 GLEBIUS-RIPN GLEB-RIPE

From: "Byron L. Hicks" <bhicks@nmsu.edu>
To: bug-followup@FreeBSD.org, bhicks@nmsu.edu
Cc:  
Subject: Re: kern/94307: [bge] kernel panics when passing trafffic through
 bge1
Date: Thu, 16 Mar 2006 13:09:55 -0700

 -----BEGIN PGP SIGNED MESSAGE-----
 Hash: SHA1
 
 I recompiled world and kernel from a new set of 6.1-PRERELEASE stable
 sources.  It crashes in the same place.  Here is another kernel debug
 with the dmesg.boot for good measure.
 
 monitor-temp# kgdb kernel.debug /usr/crash/vmcore.0
 [GDB will not be able to debug user-mode threads:
 /usr/lib/libthread_db.so: Undefined symbol "ps_pglobal_lookup"]
 GNU gdb 6.1.1 [FreeBSD]
 Copyright 2004 Free Software Foundation, Inc.
 GDB is free software, covered by the GNU General Public License, and you are
 welcome to change it and/or distribute copies of it under certain
 conditions.
 Type "show copying" to see the conditions.
 There is absolutely no warranty for GDB.  Type "show warranty" for details.
 This GDB was configured as "i386-marcel-freebsd".
 
 Unread portion of the kernel message buffer:
 bge1: discard frame w/o leading ethernet header (len 4294967292 pkt len
 4294967292)
 
 
 Fatal trap 12: page fault while in kernel mode
 fault virtual address   = 0xc
 fault code              = supervisor write, page not present
 instruction pointer     = 0x20:0xc04ed93b
 stack pointer           = 0x28:0xe500cca8
 frame pointer           = 0x28:0xe500ccd0
 code segment            = base 0x0, limit 0xfffff, type 0x1b
                         = DPL 0, pres 1, def32 1, gran 1
 processor eflags        = interrupt enabled, resume, IOPL = 0
 current process         = 28 (irq17: bge1 uhci1+)
 trap number             = 12
 panic: page fault
 Uptime: 58s
 Dumping 1023 MB (2 chunks)
   chunk 0: 1MB (159 pages) ... ok
   chunk 1: 1023MB (261848 pages) 1007 991 975 959 943 927 911 895 879
 863 847 831 815 799 783 767 751 735 719 703 687 671 655 639 623 607 591
 575 559 543 527 511 495 479 463 447 431 415 399 383 367 351 335 319 303
 287 271 255 239 223 207 191 175 159 143 127 111 95 79 63 47 31 15
 
 #0  doadump () at pcpu.h:165
 165             __asm __volatile("movl %%fs:0,%0" : "=r" (td));
 (kgdb) list *0xc04ed93b
 0xc04ed93b is in bge_rxeof (/usr/src/sys/dev/bge/if_bge.c:2626).
 2621                                cur_rx->bge_len);
 2622                            m->m_data += ETHER_ALIGN;
 2623                    }
 2624    #endif
 2625                    eh = mtod(m, struct ether_header *);
 2626                    m->m_pkthdr.len = m->m_len = cur_rx->bge_len -
 ETHER_CRC_LEN;
 2627                    m->m_pkthdr.rcvif = ifp;
 2628
 2629                    if (ifp->if_capenable & IFCAP_RXCSUM) {
 2630                            if (cur_rx->bge_flags &
 BGE_RXBDFLAG_IP_CSUM) {
 (kgdb) backtrace
 #0  doadump () at pcpu.h:165
 #1  0xc063f6b2 in boot (howto=260) at /usr/src/sys/kern/kern_shutdown.c:399
 #2  0xc063f948 in panic (fmt=0xc08367d7 "%s")
     at /usr/src/sys/kern/kern_shutdown.c:555
 #3  0xc07ee6b4 in trap_fatal (frame=0xe500cc68, eva=12)
     at /usr/src/sys/i386/i386/trap.c:836
 #4  0xc07ee41b in trap_pfault (frame=0xe500cc68, usermode=0, eva=12)
     at /usr/src/sys/i386/i386/trap.c:744
 #5  0xc07ee079 in trap (frame=
       {tf_fs = -994312184, tf_es = 822280232, tf_ds = -994312152, tf_edi
 = -452247520, tf_esi = -994267136, tf_ebp = -452932400, tf_isp =
 - -452932460, tf_ebx = 0, tf_edx = 0, tf_ecx = -994290688, tf_eax = -4,
 tf_trapno = 12, tf_err = 2, tf_eip = -1068574405, tf_cs = 32, tf_eflags
 = 590487, tf_esp = 1014144642, tf_ss = 0}) at
 /usr/src/sys/i386/i386/trap.c:434
 #6  0xc07ddfca in calltrap () at /usr/src/sys/i386/i386/exception.s:139
 #7  0xc04ed93b in bge_rxeof (sc=0xc4bcb000)
     at /usr/src/sys/dev/bge/if_bge.c:2626
 #8  0xc04edd6c in bge_intr (xsc=0xc4bcb000)
     at /usr/src/sys/dev/bge/if_bge.c:2818
 #9  0xc062ae2d in ithread_loop (arg=0xc4a87400)
     at /usr/src/sys/kern/kern_intr.c:547
 #10 0xc062a0b4 in fork_exit (callout=0xc062acd4 <ithread_loop>,
     arg=0xc4a87400, frame=0xe500cd38) at /usr/src/sys/kern/kern_fork.c:789
 - ---Type <return> to continue, or q <return> to quit---
 #11 0xc07de02c in fork_trampoline () at
 /usr/src/sys/i386/i386/exception.s:208
 (kgdb) quit
 
 
 Copyright (c) 1992-2006 The FreeBSD Project.
 Copyright (c) 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994
         The Regents of the University of California. All rights reserved.
 FreeBSD 6.1-PRERELEASE #0: Wed Mar 15 19:48:08 MST 2006
     root@:/usr/obj/usr/src/sys/DL320
 Timecounter "i8254" frequency 1193182 Hz quality 0
 CPU: Intel(R) Pentium(R) D CPU 2.80GHz (2793.02-MHz 686-class CPU)
   Origin = "GenuineIntel"  Id = 0xf44  Stepping = 4
 
 Features=0xbfebfbff<FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CLFLUSH,DTS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,PBE>
   Features2=0x641d<SSE3,RSVD2,MON,DS_CPL,CNTX-ID,CX16,<b14>>
   AMD Features=0x20000000<LM>
   Hyperthreading: 2 logical CPUs
 real memory  = 1073577984 (1023 MB)
 avail memory = 1041752064 (993 MB)
 ACPI APIC Table: <HP     00000083>
 ioapic0 <Version 2.0> irqs 0-23 on motherboard
 npx0: [FAST]
 npx0: <math processor> on motherboard
 npx0: INT 16 interface
 acpi0: <HP D20> on motherboard
 acpi0: Power Button (fixed)
 Timecounter "ACPI-fast" frequency 3579545 Hz quality 1000
 acpi_timer0: <24-bit timer at 3.579545MHz> port 0x908-0x90b on acpi0
 cpu0: <ACPI CPU> on acpi0
 pcib0: <ACPI Host-PCI bridge> on acpi0
 pci0: <ACPI PCI bus> on pcib0
 pcib0: no PRT entry for 0.31.INTA
 pcib1: <ACPI PCI-PCI bridge> at device 1.0 on pci0
 pci4: <ACPI PCI bus> on pcib1
 pcib2: <ACPI PCI-PCI bridge> at device 0.0 on pci4
 pci5: <ACPI PCI bus> on pcib2
 bge0: <Broadcom BCM5714C Gigabit Ethernet, ASIC rev. 0x9001> mem
 0xfdff0000-0xfdffffff,0xfdfe0000-0xfdfeffff irq 16 at device 4.0 on pci5
 miibus0: <MII bus> on bge0
 brgphy0: <BCM5714 10/100/1000baseTX PHY> on miibus0
 brgphy0:  10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, 1000baseTX,
 1000baseTX-FDX, auto
 bge0: Ethernet address: 00:16:35:5a:9d:35
 bge1: <Broadcom BCM5714C Gigabit Ethernet, ASIC rev. 0x9001> mem
 0xfdfd0000-0xfdfdffff,0xfdfc0000-0xfdfcffff irq 17 at device 4.1 on pci5
 miibus1: <MII bus> on bge1
 brgphy1: <BCM5714 10/100/1000baseTX PHY> on miibus1
 brgphy1:  10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, 1000baseTX,
 1000baseTX-FDX, auto
 bge1: Ethernet address: 00:16:35:5a:9d:36
 pcib3: <ACPI PCI-PCI bridge> at device 8.0 on pci5
 pci6: <ACPI PCI bus> on pcib3
 pcib4: <ACPI PCI-PCI bridge> at device 28.0 on pci0
 pci2: <ACPI PCI bus> on pcib4
 pcib5: <ACPI PCI-PCI bridge> at device 28.4 on pci0
 pci3: <ACPI PCI bus> on pcib5
 uhci0: <UHCI (generic) USB controller> port 0x1000-0x101f irq 16 at
 device 29.0 on pci0
 uhci0: [GIANT-LOCKED]
 usb0: <UHCI (generic) USB controller> on uhci0
 usb0: USB revision 1.0
 uhub0: Intel UHCI root hub, class 9/0, rev 1.00/1.00, addr 1
 uhub0: 2 ports with 2 removable, self powered
 uhci1: <UHCI (generic) USB controller> port 0x1020-0x103f irq 17 at
 device 29.1 on pci0
 uhci1: [GIANT-LOCKED]
 usb1: <UHCI (generic) USB controller> on uhci1
 usb1: USB revision 1.0
 uhub1: Intel UHCI root hub, class 9/0, rev 1.00/1.00, addr 1
 uhub1: 2 ports with 2 removable, self powered
 uhci2: <UHCI (generic) USB controller> port 0x1040-0x105f irq 18 at
 device 29.2 on pci0
 uhci2: [GIANT-LOCKED]
 usb2: <UHCI (generic) USB controller> on uhci2
 usb2: USB revision 1.0
 uhub2: Intel UHCI root hub, class 9/0, rev 1.00/1.00, addr 1
 uhub2: 2 ports with 2 removable, self powered
 uhci3: <UHCI (generic) USB controller> port 0x1060-0x107f irq 19 at
 device 29.3 on pci0
 uhci3: [GIANT-LOCKED]
 usb3: <UHCI (generic) USB controller> on uhci3
 usb3: USB revision 1.0
 uhub3: Intel UHCI root hub, class 9/0, rev 1.00/1.00, addr 1
 uhub3: 2 ports with 2 removable, self powered
 ehci0: <Intel 82801GB/R (ICH7) USB 2.0 controller> at device 29.7 on pci0
 ehci0: [GIANT-LOCKED]
 usb4: EHCI version 1.0
 usb4: companion controllers, 2 ports each: usb0 usb1 usb2 usb3
 usb4: <Intel 82801GB/R (ICH7) USB 2.0 controller> on ehci0
 usb4: USB revision 2.0
 uhub4: Intel EHCI root hub, class 9/0, rev 2.00/1.00, addr 1
 uhub4: 8 ports with 8 removable, self powered
 pcib6: <ACPI PCI-PCI bridge> at device 30.0 on pci0
 pci1: <ACPI PCI bus> on pcib6
 pci1: <display, VGA> at device 3.0 (no driver attached)
 pci1: <base peripheral> at device 4.0 (no driver attached)
 pci1: <base peripheral> at device 4.2 (no driver attached)
 uhci4: <UHCI (generic) USB controller> port 0x3800-0x381f irq 23 at
 device 4.4 on pci1
 uhci4: [GIANT-LOCKED]
 usb5: <UHCI (generic) USB controller> on uhci4
 usb5: USB revision 1.0
 uhub5: (0x103c) UHCI root hub, class 9/0, rev 1.00/1.00, addr 1
 uhub5: 2 ports with 2 removable, self powered
 isab0: <PCI-ISA bridge> at device 31.0 on pci0
 isa0: <ISA bus> on isab0
 atapci0: <Intel ICH7 UDMA100 controller> port
 0x1f0-0x1f7,0x3f6,0x170-0x177,0x376,0x500-0x50f irq 7 at device 31.1 on pci0
 ata0: <ATA channel 0> on atapci0
 ata1: <ATA channel 1> on atapci0
 atapci1: <Intel ICH7 SATA300 controller> port
 0x1080-0x1087,0x1088-0x108b,0x1090-0x1097,0x1098-0x109b,0x10a0-0x10af
 mem 0xfddf0000-0xfddf03ff irq 17 at device 31.2 on pci0
 ata2: <ATA channel 0> on atapci1
 ata3: <ATA channel 1> on atapci1
 acpi_tz0: <Thermal Zone> on acpi0
 atkbdc0: <Keyboard controller (i8042)> port 0x60,0x64 irq 1 on acpi0
 atkbd0: <AT Keyboard> irq 1 on atkbdc0
 kbd0 at atkbd0
 atkbd0: [GIANT-LOCKED]
 psm0: <PS/2 Mouse> irq 12 on atkbdc0
 psm0: [GIANT-LOCKED]
 psm0: model Generic PS/2 mouse, device ID 0
 sio0: <Standard PC COM port> port 0x3f8-0x3ff irq 4 flags 0x10 on acpi0
 sio0: type 16550A, console
 fdc0: <floppy drive controller (FDE)> port 0x3f2-0x3f5 irq 6 drq 2 on acpi0
 fdc0: does not respond
 device_attach: fdc0 attach returned 6
 fdc0: <floppy drive controller (FDE)> port 0x3f2-0x3f5 irq 6 drq 2 on acpi0
 fdc0: does not respond
 device_attach: fdc0 attach returned 6
 pmtimer0 on isa0
 orm0: <ISA Option ROMs> at iomem 0xc0000-0xcafff,0xee000-0xeffff on isa0
 ppc0: parallel port not found.
 sc0: <System console> at flags 0x100 on isa0
 sc0: VGA <16 virtual consoles, flags=0x100>
 sio1: configured irq 3 not in bitmap of probed irqs 0
 sio1: port may not be enabled
 vga0: <Generic ISA VGA> at port 0x3c0-0x3df iomem 0xa0000-0xbffff on isa0
 ukbd0: HP Virtual Keyboard, rev 1.10/0.01, addr 2, iclass 3/1
 kbd1 at ukbd0
 ums0: HP Virtual Keyboard, rev 1.10/0.01, addr 2, iclass 3/1
 ums0: 3 buttons.
 uhub6: HP Virtual Hub, class 9/0, rev 1.10/0.01, addr 3
 uhub6: 7 ports with 7 removable, self powered
 Timecounter "TSC" frequency 2793019754 Hz quality 800
 Timecounters tick every 1.000 msec
 acd0: DVDROM <DV-28E-C/B.4F> at ata0-master PIO4
 ad4: 76319MB <Maxtor 6L080M0 BANC1G10> at ata2-master SATA150
 Trying to mount root from ufs:/dev/ad4s1a
 WARNING: /tmp was not properly dismounted
 WARNING: /usr was not properly dismounted
 WARNING: /var was not properly dismounted
 
 - --
 Byron L. Hicks
 Network Engineer
 NMSU ICT/CHECS-NET
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1.4.1 (Darwin)
 Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org
 
 iD8DBQFEGcYTIuuK+iJ+1EMRAos2AKDOwfZzeC/9YtKaRhg21UOp6959GACfTM/j
 m0mCMK+Bn6fqcXdRBtv6g5Q=
 =0hpu
 -----END PGP SIGNATURE-----

From: "Byron L. Hicks" <bhicks@nmsu.edu>
To: bug-followup@FreeBSD.org, bhicks@nmsu.edu
Cc:  
Subject: Re: kern/94307: [bge] kernel panics when passing trafffic through
 bge1
Date: Thu, 16 Mar 2006 08:35:42 -0700

 -----BEGIN PGP SIGNED MESSAGE-----
 Hash: SHA1
 
 Here is the latest crash.  I recompiled world and kernel, and it crashes
 in the same spot.
 
 > monitor-temp# kgdb kernel.debug /usr/crash/vmcore.0
 > [GDB will not be able to debug user-mode threads: /usr/lib/libthread_db.so: Undefined symbol "ps_pglobal_lookup"]
 > GNU gdb 6.1.1 [FreeBSD]
 > Copyright 2004 Free Software Foundation, Inc.
 > GDB is free software, covered by the GNU General Public License, and you are
 > welcome to change it and/or distribute copies of it under certain conditions.
 > Type "show copying" to see the conditions.
 > There is absolutely no warranty for GDB.  Type "show warranty" for details.
 > This GDB was configured as "i386-marcel-freebsd".
 > 
 > Unread portion of the kernel message buffer:
 > bge1: discard frame w/o leading ethernet header (len 4294967292 pkt len 4294967292)
 > 
 > 
 > Fatal trap 12: page fault while in kernel mode
 > fault virtual address   = 0xc
 > fault code              = supervisor write, page not present
 > instruction pointer     = 0x20:0xc04ed93b
 > stack pointer           = 0x28:0xe500cca8
 > frame pointer           = 0x28:0xe500ccd0
 > code segment            = base 0x0, limit 0xfffff, type 0x1b
 >                         = DPL 0, pres 1, def32 1, gran 1
 > processor eflags        = interrupt enabled, resume, IOPL = 0
 > current process         = 28 (irq17: bge1 uhci1+)
 > trap number             = 12
 > panic: page fault
 > Uptime: 58s
 > Dumping 1023 MB (2 chunks)
 >   chunk 0: 1MB (159 pages) ... ok
 >   chunk 1: 1023MB (261848 pages) 1007 991 975 959 943 927 911 895 879 863 847 831 815 799 783 767 751 735 719 703 687 671 655 639 623 607 591 575 559 543 527 511 495 479 463 447 431 415 399 383 367 351 335 319 303 287 271 255 239 223 207 191 175 159 143 127 111 95 79 63 47 31 15
 > 
 > #0  doadump () at pcpu.h:165
 > 165             __asm __volatile("movl %%fs:0,%0" : "=r" (td));
 > (kgdb) list *0xc04ed93b
 > 0xc04ed93b is in bge_rxeof (/usr/src/sys/dev/bge/if_bge.c:2626).
 > 2621                                cur_rx->bge_len);
 > 2622                            m->m_data += ETHER_ALIGN;
 > 2623                    }
 > 2624    #endif
 > 2625                    eh = mtod(m, struct ether_header *);
 > 2626                    m->m_pkthdr.len = m->m_len = cur_rx->bge_len - ETHER_CRC_LEN;
 > 2627                    m->m_pkthdr.rcvif = ifp;
 > 2628    
 > 2629                    if (ifp->if_capenable & IFCAP_RXCSUM) {
 > 2630                            if (cur_rx->bge_flags & BGE_RXBDFLAG_IP_CSUM) {
 > (kgdb) backtrace
 > #0  doadump () at pcpu.h:165
 > #1  0xc063f6b2 in boot (howto=260) at /usr/src/sys/kern/kern_shutdown.c:399
 > #2  0xc063f948 in panic (fmt=0xc08367d7 "%s")
 >     at /usr/src/sys/kern/kern_shutdown.c:555
 > #3  0xc07ee6b4 in trap_fatal (frame=0xe500cc68, eva=12)
 >     at /usr/src/sys/i386/i386/trap.c:836
 > #4  0xc07ee41b in trap_pfault (frame=0xe500cc68, usermode=0, eva=12)
 >     at /usr/src/sys/i386/i386/trap.c:744
 > #5  0xc07ee079 in trap (frame=
 >       {tf_fs = -994312184, tf_es = 822280232, tf_ds = -994312152, tf_edi = -452247520, tf_esi = -994267136, tf_ebp = -452932400, tf_isp = -452932460, tf_ebx = 0, tf_edx = 0, tf_ecx = -994290688, tf_eax = -4, tf_trapno = 12, tf_err = 2, tf_eip = -1068574405, tf_cs = 32, tf_eflags = 590487, tf_esp = 1014144642, tf_ss = 0}) at /usr/src/sys/i386/i386/trap.c:434
 > #6  0xc07ddfca in calltrap () at /usr/src/sys/i386/i386/exception.s:139
 > #7  0xc04ed93b in bge_rxeof (sc=0xc4bcb000)
 >     at /usr/src/sys/dev/bge/if_bge.c:2626
 > #8  0xc04edd6c in bge_intr (xsc=0xc4bcb000)
 >     at /usr/src/sys/dev/bge/if_bge.c:2818
 > #9  0xc062ae2d in ithread_loop (arg=0xc4a87400)
 >     at /usr/src/sys/kern/kern_intr.c:547
 > #10 0xc062a0b4 in fork_exit (callout=0xc062acd4 <ithread_loop>, 
 >     arg=0xc4a87400, frame=0xe500cd38) at /usr/src/sys/kern/kern_fork.c:789
 > ---Type <return> to continue, or q <return> to quit---
 > #11 0xc07de02c in fork_trampoline () at /usr/src/sys/i386/i386/exception.s:208
 > (kgdb) quit
 
 If it helps, here is my dmesg.boot:
 
 > Copyright (c) 1992-2006 The FreeBSD Project.
 > Copyright (c) 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994
 >         The Regents of the University of California. All rights reserved.
 > FreeBSD 6.1-PRERELEASE #0: Wed Mar 15 19:48:08 MST 2006
 >     root@:/usr/obj/usr/src/sys/DL320
 > Timecounter "i8254" frequency 1193182 Hz quality 0
 > CPU: Intel(R) Pentium(R) D CPU 2.80GHz (2793.02-MHz 686-class CPU)
 >   Origin = "GenuineIntel"  Id = 0xf44  Stepping = 4
 >   Features=0xbfebfbff<FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CLFLUSH,DTS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,PBE>
 >   Features2=0x641d<SSE3,RSVD2,MON,DS_CPL,CNTX-ID,CX16,<b14>>
 >   AMD Features=0x20000000<LM>
 >   Hyperthreading: 2 logical CPUs
 > real memory  = 1073577984 (1023 MB)
 > avail memory = 1041752064 (993 MB)
 > ACPI APIC Table: <HP     00000083>
 > ioapic0 <Version 2.0> irqs 0-23 on motherboard
 > npx0: [FAST]
 > npx0: <math processor> on motherboard
 > npx0: INT 16 interface
 > acpi0: <HP D20> on motherboard
 > acpi0: Power Button (fixed)
 > Timecounter "ACPI-fast" frequency 3579545 Hz quality 1000
 > acpi_timer0: <24-bit timer at 3.579545MHz> port 0x908-0x90b on acpi0
 > cpu0: <ACPI CPU> on acpi0
 > pcib0: <ACPI Host-PCI bridge> on acpi0
 > pci0: <ACPI PCI bus> on pcib0
 > pcib0: no PRT entry for 0.31.INTA
 > pcib1: <ACPI PCI-PCI bridge> at device 1.0 on pci0
 > pci4: <ACPI PCI bus> on pcib1
 > pcib2: <ACPI PCI-PCI bridge> at device 0.0 on pci4
 > pci5: <ACPI PCI bus> on pcib2
 > bge0: <Broadcom BCM5714C Gigabit Ethernet, ASIC rev. 0x9001> mem 0xfdff0000-0xfdffffff,0xfdfe0000-0xfdfeffff irq 16 at device 4.0 on pci5
 > miibus0: <MII bus> on bge0
 > brgphy0: <BCM5714 10/100/1000baseTX PHY> on miibus0
 > brgphy0:  10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, 1000baseTX, 1000baseTX-FDX, auto
 > bge0: Ethernet address: 00:16:35:5a:9d:35
 > bge1: <Broadcom BCM5714C Gigabit Ethernet, ASIC rev. 0x9001> mem 0xfdfd0000-0xfdfdffff,0xfdfc0000-0xfdfcffff irq 17 at device 4.1 on pci5
 > miibus1: <MII bus> on bge1
 > brgphy1: <BCM5714 10/100/1000baseTX PHY> on miibus1
 > brgphy1:  10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, 1000baseTX, 1000baseTX-FDX, auto
 > bge1: Ethernet address: 00:16:35:5a:9d:36
 > pcib3: <ACPI PCI-PCI bridge> at device 8.0 on pci5
 > pci6: <ACPI PCI bus> on pcib3
 > pcib4: <ACPI PCI-PCI bridge> at device 28.0 on pci0
 > pci2: <ACPI PCI bus> on pcib4
 > pcib5: <ACPI PCI-PCI bridge> at device 28.4 on pci0
 > pci3: <ACPI PCI bus> on pcib5
 > uhci0: <UHCI (generic) USB controller> port 0x1000-0x101f irq 16 at device 29.0 on pci0
 > uhci0: [GIANT-LOCKED]
 > usb0: <UHCI (generic) USB controller> on uhci0
 > usb0: USB revision 1.0
 > uhub0: Intel UHCI root hub, class 9/0, rev 1.00/1.00, addr 1
 > uhub0: 2 ports with 2 removable, self powered
 > uhci1: <UHCI (generic) USB controller> port 0x1020-0x103f irq 17 at device 29.1 on pci0
 > uhci1: [GIANT-LOCKED]
 > usb1: <UHCI (generic) USB controller> on uhci1
 > usb1: USB revision 1.0
 > uhub1: Intel UHCI root hub, class 9/0, rev 1.00/1.00, addr 1
 > uhub1: 2 ports with 2 removable, self powered
 > uhci2: <UHCI (generic) USB controller> port 0x1040-0x105f irq 18 at device 29.2 on pci0
 > uhci2: [GIANT-LOCKED]
 > usb2: <UHCI (generic) USB controller> on uhci2
 > usb2: USB revision 1.0
 > uhub2: Intel UHCI root hub, class 9/0, rev 1.00/1.00, addr 1
 > uhub2: 2 ports with 2 removable, self powered
 > uhci3: <UHCI (generic) USB controller> port 0x1060-0x107f irq 19 at device 29.3 on pci0
 > uhci3: [GIANT-LOCKED]
 > usb3: <UHCI (generic) USB controller> on uhci3
 > usb3: USB revision 1.0
 > uhub3: Intel UHCI root hub, class 9/0, rev 1.00/1.00, addr 1
 > uhub3: 2 ports with 2 removable, self powered
 > ehci0: <Intel 82801GB/R (ICH7) USB 2.0 controller> at device 29.7 on pci0
 > ehci0: [GIANT-LOCKED]
 > usb4: EHCI version 1.0
 > usb4: companion controllers, 2 ports each: usb0 usb1 usb2 usb3
 > usb4: <Intel 82801GB/R (ICH7) USB 2.0 controller> on ehci0
 > usb4: USB revision 2.0
 > uhub4: Intel EHCI root hub, class 9/0, rev 2.00/1.00, addr 1
 > uhub4: 8 ports with 8 removable, self powered
 > pcib6: <ACPI PCI-PCI bridge> at device 30.0 on pci0
 > pci1: <ACPI PCI bus> on pcib6
 > pci1: <display, VGA> at device 3.0 (no driver attached)
 > pci1: <base peripheral> at device 4.0 (no driver attached)
 > pci1: <base peripheral> at device 4.2 (no driver attached)
 > uhci4: <UHCI (generic) USB controller> port 0x3800-0x381f irq 23 at device 4.4 on pci1
 > uhci4: [GIANT-LOCKED]
 > usb5: <UHCI (generic) USB controller> on uhci4
 > usb5: USB revision 1.0
 > uhub5: (0x103c) UHCI root hub, class 9/0, rev 1.00/1.00, addr 1
 > uhub5: 2 ports with 2 removable, self powered
 > isab0: <PCI-ISA bridge> at device 31.0 on pci0
 > isa0: <ISA bus> on isab0
 > atapci0: <Intel ICH7 UDMA100 controller> port 0x1f0-0x1f7,0x3f6,0x170-0x177,0x376,0x500-0x50f irq 7 at device 31.1 on pci0
 > ata0: <ATA channel 0> on atapci0
 > ata1: <ATA channel 1> on atapci0
 > atapci1: <Intel ICH7 SATA300 controller> port 0x1080-0x1087,0x1088-0x108b,0x1090-0x1097,0x1098-0x109b,0x10a0-0x10af mem 0xfddf0000-0xfddf03ff irq 17 at device 31.2 on pci0
 > ata2: <ATA channel 0> on atapci1
 > ata3: <ATA channel 1> on atapci1
 > acpi_tz0: <Thermal Zone> on acpi0
 > atkbdc0: <Keyboard controller (i8042)> port 0x60,0x64 irq 1 on acpi0
 > atkbd0: <AT Keyboard> irq 1 on atkbdc0
 > kbd0 at atkbd0
 > atkbd0: [GIANT-LOCKED]
 > psm0: <PS/2 Mouse> irq 12 on atkbdc0
 > psm0: [GIANT-LOCKED]
 > psm0: model Generic PS/2 mouse, device ID 0
 > sio0: <Standard PC COM port> port 0x3f8-0x3ff irq 4 flags 0x10 on acpi0
 > sio0: type 16550A, console
 > fdc0: <floppy drive controller (FDE)> port 0x3f2-0x3f5 irq 6 drq 2 on acpi0
 > fdc0: does not respond
 > device_attach: fdc0 attach returned 6
 > fdc0: <floppy drive controller (FDE)> port 0x3f2-0x3f5 irq 6 drq 2 on acpi0
 > fdc0: does not respond
 > device_attach: fdc0 attach returned 6
 > pmtimer0 on isa0
 > orm0: <ISA Option ROMs> at iomem 0xc0000-0xcafff,0xee000-0xeffff on isa0
 > ppc0: parallel port not found.
 > sc0: <System console> at flags 0x100 on isa0
 > sc0: VGA <16 virtual consoles, flags=0x100>
 > sio1: configured irq 3 not in bitmap of probed irqs 0
 > sio1: port may not be enabled
 > vga0: <Generic ISA VGA> at port 0x3c0-0x3df iomem 0xa0000-0xbffff on isa0
 > ukbd0: HP Virtual Keyboard, rev 1.10/0.01, addr 2, iclass 3/1
 > kbd1 at ukbd0
 > ums0: HP Virtual Keyboard, rev 1.10/0.01, addr 2, iclass 3/1
 > ums0: 3 buttons.
 > uhub6: HP Virtual Hub, class 9/0, rev 1.10/0.01, addr 3
 > uhub6: 7 ports with 7 removable, self powered
 > Timecounter "TSC" frequency 2793019754 Hz quality 800
 > Timecounters tick every 1.000 msec
 > acd0: DVDROM <DV-28E-C/B.4F> at ata0-master PIO4
 > ad4: 76319MB <Maxtor 6L080M0 BANC1G10> at ata2-master SATA150
 > Trying to mount root from ufs:/dev/ad4s1a
 > WARNING: /tmp was not properly dismounted
 > WARNING: /usr was not properly dismounted
 > WARNING: /var was not properly dismounted
 
 I'm using bge1 because bge0 locks the machine with no crash dump.  bge1
 just kernel panics and gives me a kernel dump file.
 
 - --
 Byron L. Hicks
 Network Engineer
 NMSU ICT/CHECS-NET
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1.4.1 (Darwin)
 Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org
 
 iD8DBQFEGYXOIuuK+iJ+1EMRAtiWAJ4qaHObqXRlQ6DupI4TNuT+YOlV7QCfZ9dX
 2FeONdiUhQqh+EgMaQmToNQ=
 =KMZa
 -----END PGP SIGNATURE-----

From: Gleb Smirnoff <glebius@FreeBSD.org>
To: "Byron L. Hicks" <bhicks@nmsu.edu>
Cc: freebsd-gnats-submit@FreeBSD.org, oleg@FreeBSD.org
Subject: Re: kern/94307: [bge] kernel panics when passing trafffic through bge1
Date: Fri, 17 Mar 2006 12:07:26 +0300

   Byron,
 
   Can you please do the following in kgdb:
 
 B>  (kgdb) backtrace
 B>  #0  doadump () at pcpu.h:165
 B>  #1  0xc063f6b2 in boot (howto=260) at /usr/src/sys/kern/kern_shutdown.c:399
 B>  #2  0xc063f948 in panic (fmt=0xc08367d7 "%s")
 B>      at /usr/src/sys/kern/kern_shutdown.c:555
 B>  #3  0xc07ee6b4 in trap_fatal (frame=0xe500cc68, eva=12)
 B>      at /usr/src/sys/i386/i386/trap.c:836
 B>  #4  0xc07ee41b in trap_pfault (frame=0xe500cc68, usermode=0, eva=12)
 B>      at /usr/src/sys/i386/i386/trap.c:744
 B>  #5  0xc07ee079 in trap (frame=
 B>        {tf_fs = -994312184, tf_es = 822280232, tf_ds = -994312152, tf_edi
 B>  = -452247520, tf_esi = -994267136, tf_ebp = -452932400, tf_isp =
 B>  - -452932460, tf_ebx = 0, tf_edx = 0, tf_ecx = -994290688, tf_eax = -4,
 B>  tf_trapno = 12, tf_err = 2, tf_eip = -1068574405, tf_cs = 32, tf_eflags
 B>  = 590487, tf_esp = 1014144642, tf_ss = 0}) at
 B>  /usr/src/sys/i386/i386/trap.c:434
 B>  #6  0xc07ddfca in calltrap () at /usr/src/sys/i386/i386/exception.s:139
 B>  #7  0xc04ed93b in bge_rxeof (sc=0xc4bcb000)
 B>      at /usr/src/sys/dev/bge/if_bge.c:2626
 B>  #8  0xc04edd6c in bge_intr (xsc=0xc4bcb000)
 B>      at /usr/src/sys/dev/bge/if_bge.c:2818
 B>  #9  0xc062ae2d in ithread_loop (arg=0xc4a87400)
 B>      at /usr/src/sys/kern/kern_intr.c:547
 B>  #10 0xc062a0b4 in fork_exit (callout=0xc062acd4 <ithread_loop>,
 B>      arg=0xc4a87400, frame=0xe500cd38) at /usr/src/sys/kern/kern_fork.c:789
 B>  - ---Type <return> to continue, or q <return> to quit---
 B>  #11 0xc07de02c in fork_trampoline () at
 B>  /usr/src/sys/i386/i386/exception.s:208
 B>  (kgdb) quit
 
 frame 7
 p m
 p *m
 p cur_rx 
 p *cur_rx
 p ifp
 p *ifp
 
 -- 
 Totus tuus, Glebius.
 GLEBIUS-RIPN GLEB-RIPE

From: Gleb Smirnoff <glebius@FreeBSD.org>
To: "Byron L. Hicks" <bhicks@nmsu.edu>
Cc: freebsd-gnats-submit@FreeBSD.org, oleg@FreeBSD.org
Subject: Re: kern/94307: [bge] kernel panics when passing trafffic through bge1
Date: Fri, 17 Mar 2006 12:16:02 +0300

   Byron,
 
 B>  I recompiled world and kernel from a new set of 6.1-PRERELEASE stable
 B>  sources.  It crashes in the same place.  Here is another kernel debug
 B>  with the dmesg.boot for good measure.
 
 What exact version of kern_mbuf.c do you have? Please show:
 
 ident /boot/kernel/kernel | grep kern_mbuf.c
 
 -- 
 Totus tuus, Glebius.
 GLEBIUS-RIPN GLEB-RIPE

From: "Byron L. Hicks" <bhicks@nmsu.edu>
To: bug-followup@FreeBSD.org, bhicks@nmsu.edu
Cc:  
Subject: Re: kern/94307: [bge] kernel panics when passing trafffic through
 bge1
Date: Mon, 20 Mar 2006 10:19:03 -0700

 -----BEGIN PGP SIGNED MESSAGE-----
 Hash: SHA1
 
 monitor-temp# cd /usr/obj/usr/src/sys/DL320
 monitor-temp# kgdb kernel.debug /usr/crash/vmcore.0
 [GDB will not be able to debug user-mode threads:
 /usr/lib/libthread_db.so: Undefined symbol "ps_pglobal_lookup"]
 GNU gdb 6.1.1 [FreeBSD]
 Copyright 2004 Free Software Foundation, Inc.
 GDB is free software, covered by the GNU General Public License, and you are
 welcome to change it and/or distribute copies of it under certain
 conditions.
 Type "show copying" to see the conditions.
 There is absolutely no warranty for GDB.  Type "show warranty" for details.
 This GDB was configured as "i386-marcel-freebsd".
 
 Unread portion of the kernel message buffer:
 bge1: discard frame w/o leading ethernet header (len 4294967292 pkt len
 4294967292)
 
 
 Fatal trap 12: page fault while in kernel mode
 fault virtual address   = 0xc
 fault code              = supervisor write, page not present
 instruction pointer     = 0x20:0xc04ed93b
 stack pointer           = 0x28:0xe500cca8
 frame pointer           = 0x28:0xe500ccd0
 code segment            = base 0x0, limit 0xfffff, type 0x1b
                         = DPL 0, pres 1, def32 1, gran 1
 processor eflags        = interrupt enabled, resume, IOPL = 0
 current process         = 28 (irq17: bge1 uhci1+)
 trap number             = 12
 panic: page fault
 Uptime: 58s
 Dumping 1023 MB (2 chunks)
   chunk 0: 1MB (159 pages) ... ok
   chunk 1: 1023MB (261848 pages) 1007 991 975 959 943 927 911 895 879
 863 847 831 815 799 783 767 751 735 719 703 687 671 655 639 623 607 591
 575 559 543 527 511 495 479 463 447 431 415 399 383 367 351 335 319 303
 287 271 255 239 223 207 191 175 159 143 127 111 95 79 63 47 31 15
 
 #0  doadump () at pcpu.h:165
 165             __asm __volatile("movl %%fs:0,%0" : "=r" (td));
 (kgdb) list 0xc04ed93b
 Function "0xc04ed93b" not defined.
 (kgdb) list *0xc04ed93b
 0xc04ed93b is in bge_rxeof (/usr/src/sys/dev/bge/if_bge.c:2626).
 2621                                cur_rx->bge_len);
 2622                            m->m_data += ETHER_ALIGN;
 2623                    }
 2624    #endif
 2625                    eh = mtod(m, struct ether_header *);
 2626                    m->m_pkthdr.len = m->m_len = cur_rx->bge_len -
 ETHER_CRC_LEN;
 2627                    m->m_pkthdr.rcvif = ifp;
 2628
 2629                    if (ifp->if_capenable & IFCAP_RXCSUM) {
 2630                            if (cur_rx->bge_flags &
 BGE_RXBDFLAG_IP_CSUM) {
 (kgdb) backtrace
 #0  doadump () at pcpu.h:165
 #1  0xc063f6b2 in boot (howto=260) at /usr/src/sys/kern/kern_shutdown.c:399
 #2  0xc063f948 in panic (fmt=0xc08367d7 "%s")
     at /usr/src/sys/kern/kern_shutdown.c:555
 #3  0xc07ee6b4 in trap_fatal (frame=0xe500cc68, eva=12)
     at /usr/src/sys/i386/i386/trap.c:836
 #4  0xc07ee41b in trap_pfault (frame=0xe500cc68, usermode=0, eva=12)
     at /usr/src/sys/i386/i386/trap.c:744
 #5  0xc07ee079 in trap (frame=
       {tf_fs = -994312184, tf_es = 822280232, tf_ds = -994312152, tf_edi
 = -452247520, tf_esi = -994267136, tf_ebp = -452932400, tf_isp =
 - -452932460, tf_ebx = 0, tf_edx = 0, tf_ecx = -994290688, tf_eax = -4,
 tf_trapno = 12, tf_err = 2, tf_eip = -1068574405, tf_cs = 32, tf_eflags
 = 590487, tf_esp = 1014144642, tf_ss = 0}) at
 /usr/src/sys/i386/i386/trap.c:434
 #6  0xc07ddfca in calltrap () at /usr/src/sys/i386/i386/exception.s:139
 #7  0xc04ed93b in bge_rxeof (sc=0xc4bcb000)
     at /usr/src/sys/dev/bge/if_bge.c:2626
 #8  0xc04edd6c in bge_intr (xsc=0xc4bcb000)
     at /usr/src/sys/dev/bge/if_bge.c:2818
 #9  0xc062ae2d in ithread_loop (arg=0xc4a87400)
     at /usr/src/sys/kern/kern_intr.c:547
 #10 0xc062a0b4 in fork_exit (callout=0xc062acd4 <ithread_loop>,
     arg=0xc4a87400, frame=0xe500cd38) at /usr/src/sys/kern/kern_fork.c:789
 - ---Type <return> to continue, or q <return> to quit---
 #11 0xc07de02c in fork_trampoline () at
 /usr/src/sys/i386/i386/exception.s:208
 (kgdb) frame 7
 #7  0xc04ed93b in bge_rxeof (sc=0xc4bcb000)
     at /usr/src/sys/dev/bge/if_bge.c:2626
 2626                    m->m_pkthdr.len = m->m_len = cur_rx->bge_len -
 ETHER_CRC_LEN;
 (kgdb) p m
 $1 = (struct mbuf *) 0x0
 (kgdb) p *m
 Cannot access memory at address 0x0
 (kgdb) p cur_rx
 $2 = (struct bge_rx_bd *) 0xe50b4020
 (kgdb) p *cur_rx
 $3 = {bge_addr = {bge_addr_hi = 0, bge_addr_lo = 0}, bge_len = 0,
 bge_idx = 0,
   bge_flags = 0, bge_type = 0, bge_tcp_udp_csum = 0, bge_ip_csum = 0,
   bge_vlan_tag = 0, bge_error_flag = 0, bge_rsvd = 0, bge_opaque = 0}
 (kgdb) p ifp
 $4 = (struct ifnet *) 0xc4bc5400
 (kgdb) p *ifp
 $5 = {if_softc = 0xc4bcb000, if_l2com = 0xc4bc31f0, if_link = {
     tqe_next = 0xc4c5e800, tqe_prev = 0xc4bbd808},
   if_xname = "bge1", '\0' <repeats 11 times>, if_dname = 0xc4ad3dec "bge",
   if_dunit = 1, if_addrhead = {tqh_first = 0xc4b9d400, tqh_last =
 0xc4d9bb60},
   if_klist = {kl_list = {slh_first = 0x0},
     kl_lock = 0xc0624d8c <knlist_mtx_lock>,
     kl_unlock = 0xc0624dc0 <knlist_mtx_unlock>,
     kl_locked = 0xc0624dfc <knlist_mtx_locked>, kl_lockarg = 0xc0907360},
   if_pcount = 0, if_carp = 0x0, if_bpf = 0x0, if_index = 2, if_timer = 0,
   if_nvlans = 0, if_flags = 34819, if_capabilities = 27, if_capenable = 27,
   if_linkmib = 0x0, if_linkmiblen = 0, if_data = {ifi_type = 6 '\006',
     ifi_physical = 0 '\0', ifi_addrlen = 6 '\006', ifi_hdrlen = 14 '\016',
     ifi_link_state = 2 '\002', ifi_recvquota = 0 '\0', ifi_xmitquota = 0
 '\0',
     ifi_datalen = 80 'P', ifi_mtu = 1500, ifi_metric = 0,
     ifi_baudrate = 10000000, ifi_ipackets = 610, ifi_ierrors = 1252492992,
     ifi_opackets = 375, ifi_oerrors = 2944995602, ifi_collisions =
 2706406393,
     ifi_ibytes = 770316, ifi_obytes = 24940, ifi_imcasts = 71,
     ifi_omcasts = 0, ifi_iqdrops = 0, ifi_noproto = 0, ifi_hwassist = 7,
     ifi_epoch = 0, ifi_lastchange = {tv_sec = 1142522343, tv_usec =
 446415}},
   if_multiaddrs = {tqh_first = 0xc4c289c0, tqh_last = 0xc4c289a0},
   if_amcount = 0, if_output = 0xc06ac748 <ether_output>,
   if_input = 0xc06acf80 <ether_input>, if_start = 0xc04ee84c <bge_start>,
   if_ioctl = 0xc04eee6c <bge_ioctl>, if_watchdog = 0xc04ef1bc
 <bge_watchdog>,
 - ---Type <return> to continue, or q <return> to quit---
   if_init = 0xc04eebb4 <bge_init>,
   if_resolvemulti = 0xc06ad78c <ether_resolvemulti>, if_spare1 = 0x0,
   if_spare2 = 0x0, if_spare3 = 0x0, if_drv_flags = 64, if_spare_flags2 = 0,
   if_snd = {ifq_head = 0x0, ifq_tail = 0x0, ifq_len = 0, ifq_maxlen = 511,
     ifq_drops = 0, ifq_mtx = {mtx_object = {lo_class = 0xc08a9884,
         lo_name = 0xc4bc5410 "bge1", lo_type = 0xc0855521 "if send queue",
         lo_flags = 196608, lo_list = {tqe_next = 0x0, tqe_prev = 0x0},
         lo_witness = 0x0}, mtx_lock = 4, mtx_recurse = 0}, ifq_drv_head
 = 0x0,
     ifq_drv_tail = 0x0, ifq_drv_len = 0, ifq_drv_maxlen = 511, altq_type
 = 0,
     altq_flags = 1, altq_disc = 0x0, altq_ifp = 0xc4bc5400, altq_enqueue
 = 0,
     altq_dequeue = 0, altq_request = 0, altq_clfier = 0x0, altq_classify
 = 0,
     altq_tbr = 0x0, altq_cdnr = 0x0}, if_broadcastaddr = 0xc0810c20
 "??????",
   if_bridge = 0x0, lltables = 0x0, if_label = 0x0, if_prefixhead = {
     tqh_first = 0x0, tqh_last = 0xc4bc557c}, if_afdata = {
     0x0 <repeats 37 times>}, if_afdata_initialized = 2, if_afdata_mtx = {
     mtx_object = {lo_class = 0xc08a9884, lo_name = 0xc0855511 "if_afdata",
       lo_type = 0xc0855511 "if_afdata", lo_flags = 196608, lo_list = {
         tqe_next = 0x0, tqe_prev = 0x0}, lo_witness = 0x0}, mtx_lock = 4,
     mtx_recurse = 0}, if_starttask = {ta_link = {stqe_next = 0x0},
     ta_pending = 0, ta_priority = 0, ta_func = 0xc06ab8f4
 <if_start_deferred>,
     ta_context = 0xc4bc5400}, if_linktask = {ta_link = {stqe_next = 0x0},
     ta_pending = 0, ta_priority = 0,
     ta_func = 0xc06a9a00 <do_link_state_change>, ta_context = 0xc4bc5400},
 - ---Type <return> to continue, or q <return> to quit---
   if_addr_mtx = {mtx_object = {lo_class = 0xc08a9884,
       lo_name = 0xc08554a7 "if_addr_mtx", lo_type = 0xc08554a7
 "if_addr_mtx",
       lo_flags = 196608, lo_list = {tqe_next = 0x0, tqe_prev = 0x0},
       lo_witness = 0x0}, mtx_lock = 4, mtx_recurse = 0}}
 
 monitor-temp# ident /boot/kernel/kernel | grep kern_mbuf.c
      $FreeBSD: src/sys/kern/kern_mbuf.c,v 1.9.2.5 2006/03/01 20:51:49
 andre Exp $
 
 - --
 Byron L. Hicks
 Network Engineer
 NMSU ICT/CHECS-NET
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1.4.1 (Darwin)
 Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org
 
 iD8DBQFEHuQHIuuK+iJ+1EMRAosXAKDZ7cVr8tUd1wf3MKhvObbvdGi1UQCgyKlB
 iKtAZ3JTdg7pdTGrdr/AxMo=
 =Wkmo
 -----END PGP SIGNATURE-----

From: Gleb Smirnoff <glebius@FreeBSD.org>
To: "Byron L. Hicks" <bhicks@nmsu.edu>
Cc: bug-followup@FreeBSD.org
Subject: Re: kern/94307: [bge] kernel panics when passing trafffic through bge1
Date: Wed, 22 Mar 2006 12:07:15 +0300

   Byron,
 
 On Mon, Mar 20, 2006 at 05:20:19PM +0000, Byron L. Hicks wrote:
 B>  monitor-temp# ident /boot/kernel/kernel | grep kern_mbuf.c
 B>       $FreeBSD: src/sys/kern/kern_mbuf.c,v 1.9.2.5 2006/03/01 20:51:49
 B>  andre Exp $
 
 As I said before, you need to update to newer RELENG_6. I bet your
 problem is fixed in kern_mbuf.c rev. 1.9.2.6.
 
 -- 
 Totus tuus, Glebius.
 GLEBIUS-RIPN GLEB-RIPE
State-Changed-From-To: open->feedback 
State-Changed-By: glebius 
State-Changed-When: Wed Mar 22 09:19:37 UTC 2006 
State-Changed-Why:  
Not closing PR, since we need confirmation from submitter, but 
putting it into feedback state. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=94307 

From: "Internet Partners, Inc. Tech Support" <support@ipinc.net>
To: <bug-followup@FreeBSD.org>, <bhicks@nmsu.edu>
Cc:  
Subject: Re: kern/94307: [bge] kernel panics when passing trafffic through bge1
Date: Fri, 31 Mar 2006 17:19:36 -0800

 Hi All,
 
   We also have a brand new HP Proliant DL320 G4 that is the same hardware.
 
   I have booted FreeBSD 6.1-BETA4 #0 on this and I can report
 this is still broken, but the fix is getting closer.  Here is what
 we found:
 
 1) Kernel does not panic anymore
 2) interface bge0 does not seem to work at all
 3) interface bge1 does seem to work but in a weird
 way, if I hard-code an IP on it I can ping the interface
 from a host elsewhere on the network.  However, I cannot
 access any FTP site from the server.  Nor can I obtain
 an IP number via DHCP.
 
 Ted Mittelstaedt

From: "Byron L. Hicks" <bhicks@nmsu.edu>
To: "Internet Partners, Inc. Tech Support" <support@ipinc.net>
Cc: bug-followup@FreeBSD.org
Subject: Re: kern/94307: [bge] kernel panics when passing trafffic through
 bge1
Date: Fri, 31 Mar 2006 18:36:06 -0700

 -----BEGIN PGP SIGNED MESSAGE-----
 Hash: SHA1
 
 Internet Partners, Inc. Tech Support wrote:
 > Hi All,
 > 
 >   We also have a brand new HP Proliant DL320 G4 that is the same hardware.
 > 
 >   I have booted FreeBSD 6.1-BETA4 #0 on this and I can report
 > this is still broken, but the fix is getting closer.  Here is what
 > we found:
 > 
 > 1) Kernel does not panic anymore
 > 2) interface bge0 does not seem to work at all
 > 3) interface bge1 does seem to work but in a weird
 > way, if I hard-code an IP on it I can ping the interface
 > from a host elsewhere on the network.  However, I cannot
 > access any FTP site from the server.  Nor can I obtain
 > an IP number via DHCP.
 > 
 > Ted Mittelstaedt
 
 After many iterations of both FreeBSD installs, and Fedora installs
 (none successful), I have returned my two HP DL320 G4's to HP.  I have
 since ordered DL320 G3's.  I have three running 6.x-stable right now,
 with no problems, so the new servers should run FreeBSD without the hassles.
 
 I'm not sure what was different, other than the dual core processors.
 
 
 
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1.4.2 (MingW32)
 Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org
 
 iD8DBQFELdkGIuuK+iJ+1EMRAvJGAJ0do6Ygk9+D0GRsnMWZSuVEu50QtQCfexkB
 bwQHSw9939KszZpXt/l909w=
 =TJEZ
 -----END PGP SIGNATURE-----

From: "Ted Mittelstaedt" <tedm@toybox.placo.com>
To: <bug-followup@FreeBSD.org>, <bhicks@nmsu.edu>
Cc:  
Subject: Re: kern/94307: [bge] kernel panics when passing trafffic through bge1
Date: Wed, 5 Apr 2006 03:10:06 -0700

 Can you post a dmesg for the DL320 G3 please?

From: Peter Grehan <grehan@freebsd.org>
To: bug-followup@FreeBSD.org, bhicks@nmsu.edu
Cc:  
Subject: Re: kern/94307: [bge] kernel panics when passing trafffic through
 bge1
Date: Wed, 12 Apr 2006 11:52:51 -0700

 This bug is caused by the ASIC rev not being correctly recognised by 
 FreeBSD:
 
 bge1: <Broadcom BCM5714C Gigabit Ethernet, ASIC rev. 0x9001>
 
 This needs to be added to if_bgereg.h and treated the same as ASIC rev 
 5, BGE_ASICREV_BCM5714.
 
 Otherwise, the ring sizes don't match up resulting in the panic you are 
 seeing (bge maintainers, disable the ASICREV_BCM5714 test to see what 
 happens with a working 5714 :)
 
 later,
 
 Peter.

From: "Internet Partners, Inc. Tech Support" <support@ipinc.net>
To: <bug-followup@FreeBSD.org>, <bhicks@nmsu.edu>, <grehan@FreeBSD.org>
Cc:  
Subject: RE: Re: kern/94307: [bge] kernel panics when passing trafffic through bge1
Date: Fri, 28 Apr 2006 17:26:45 -0700

 It looks like there's more than one ASIC rev, here is the dmesg
 output from our brand new HP DL 320:
 
 Copyright (c) 1992-2006 The FreeBSD Project.
 Copyright (c) 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994
         The Regents of the University of California. All rights reserved.
 FreeBSD 6.1-RC1 #0: Mon Apr 10 17:03:22 UTC 2006
     root@opus.cse.buffalo.edu:/usr/obj/usr/src/sys/SMP
 Timecounter "i8254" frequency 1193182 Hz quality 0
 CPU: Intel(R) Pentium(R) D CPU 3.00GHz (2992.52-MHz 686-class CPU)
   Origin = "GenuineIntel"  Id = 0xf62  Stepping = 2
 
 Features=0xbfebfbff<FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA
 ,CMOV,PAT,PSE36,CLFLUSH,DTS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,PBE>
   Features2=0xe43d<SSE3,RSVD2,MON,DS_CPL,VMX,CNTX-ID,CX16,<b14>,<b15>>
   AMD Features=0x20000000<LM>
   Hyperthreading: 2 logical CPUs
 real memory  = 2147319808 (2047 MB)
 avail memory = 2096300032 (1999 MB)
 ACPI APIC Table: <HP     00000083>
 FreeBSD/SMP: Multiprocessor System Detected: 2 CPUs
  cpu0 (BSP): APIC ID:  0
  cpu1 (AP): APIC ID:  1
 ioapic0 <Version 2.0> irqs 0-23 on motherboard
 kbd1 at kbdmux0
 npx0: [FAST]
 .
 .
 .
 bge0: <Broadcom BCM5714C Gigabit Ethernet, ASIC rev. 0x9003> mem
 0xfdff0000-0xfdffffff,0xfdfe0000-0xfdfeffff irq 16 at device 4.0 on pci5
 miibus0: <MII bus> on bge0
 brgphy0: <BCM5714 10/100/1000baseTX PHY> on miibus0
 brgphy0:  10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, 1000baseTX,
 1000baseTX-FDX, auto
 bge0: Ethernet address: 00:17:a4:11:70:03
 bge1: <Broadcom BCM5714C Gigabit Ethernet, ASIC rev. 0x9003> mem
 0xfdfd0000-0xfdfdffff,0xfdfc0000-0xfdfcffff irq 17 at device 4.1 on pci5
 miibus1: <MII bus> on bge1
 brgphy1: <BCM5714 10/100/1000baseTX PHY> on miibus1
 brgphy1:  10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, 1000baseTX,
 1000baseTX-FDX, auto
 bge1: Ethernet address: 00:17:a4:11:70:04
 .
 .
 .
 
 And after even more testing we have found this is just as broken as before -
 bge0
 panics immediately, bge1 panics after a few kilobytes of data have been
 passed
 over the interface.  The panics are the same error message
 
 Peter, do you have a suggested patch for if_bgereg.h?  I looked at this file
 on RC1 and I can't figure out what to do to make the change you have
 suggested.
 
 Ted
 

From: "Internet Partners, Inc. Tech Support" <support@ipinc.net>
To: <bug-followup@FreeBSD.org>, <grehan@FreeBSD.org>
Cc: <glebius@FreeBSD.org>
Subject: Re: kern/94307: [bge] kernel panics when passing trafffic through bge1
Date: Mon, 1 May 2006 16:27:19 -0700

 OK More info,
 
 Here is the output of pciconf from our DL320 G4:
 
 # pciconf -l |grep bge
 bge0@pci5:4:0:  class=0x020000 card=0x7039103c chip=0x166814e4 rev=0xa3
 hdr=0x00
 bge1@pci5:4:1:  class=0x020000 card=0x7039103c chip=0x166814e4 rev=0xa3
 hdr=0x00
 #
 
 Here is the rev of kern_mbuf.c:
 
 # ident /boot/kernel/kernel | grep kern_mbuf.c
      $FreeBSD: src/sys/kern/kern_mbuf.c,v 1.9.2.7 2006/03/18 21:55:43
 glebius Exp $
 #
 
 We pulled the cover off the server and pulled the heatsink off
 the ethernet chip and here are the numbers from the top of the chip:
 
 Broadcom
 BCM5714CKPB
 CC0610  P13
 773778  P2
 
 
 
 
 
 

From: "Internet Partners, Inc. Tech Support" <support@ipinc.net>
To: <bug-followup@FreeBSD.org>, <grehan@FreeBSD.org>
Cc:  
Subject: Re: kern/94307: [bge] kernel panics when passing trafffic through bge1
Date: Tue, 2 May 2006 18:06:23 -0700

 I made the following change in the FreeBSD driver:
 
 $ diff -c if_bge.c.dist if_bge.c
 *** if_bge.c.dist       Tue May  2 10:58:41 2006
 --- if_bge.c    Tue May  2 11:55:39 2006
 ***************
 *** 2099,2109 ****
         sc->bge_chiprev = BGE_CHIPREV(sc->bge_chipid);
 
         /*
 !        * Treat the 5714 and the 5752 like the 5750 until we have more info
          * on this chip.
          */
 !       if (sc->bge_asicrev == BGE_ASICREV_BCM5714 ||
 !             sc->bge_asicrev == BGE_ASICREV_BCM5752)
                 sc->bge_asicrev = BGE_ASICREV_BCM5750;
 
         /*
 --- 2099,2108 ----
         sc->bge_chiprev = BGE_CHIPREV(sc->bge_chipid);
 
         /*
 !        * Treat the 5752 like the 5750 until we have more info
          * on this chip.
          */
 !       if (sc->bge_asicrev == BGE_ASICREV_BCM5752)
                 sc->bge_asicrev = BGE_ASICREV_BCM5750;
 
         /*
 $
 
 And the HP DL320 G4 _still_ panics when more than a few K of data is
 passed over the ethernet interface.  Additionally, I have corrected the
 ASIC revs in the driver and added some more, see PR/94863
 
 In looking at the latest Linux driver from Broadcom, it appears they
 are special-casing the BCM5714 in a number of places in the Linux
 driver.  I have tested the Linux driver on OpenSUSE and it works fine,
 no panics on OpenSUSE.  In particular in the Linux driver look at this
 section:
 
 
         /* Prevent chip from dropping frames when flow control
          * is enabled.
          */
         tw32_f(MAC_LOW_WMARK_MAX_RX_FRAME, 2);
 
         if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5704 &&
             (tp->tg3_flags2 & TG3_FLG2_PHY_SERDES)) {
                 /* Use hardware link auto-negotiation */
                 tp->tg3_flags2 |= TG3_FLG2_HW_AUTONEG;
         }
 
         if ((tp->tg3_flags2 & TG3_FLG2_MII_SERDES) &&
             (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5714)) {
                 u32 tmp;
 
                 tmp = tr32(SERDES_RX_CTRL);
                 tw32(SERDES_RX_CTRL, tmp | SERDES_RX_SIG_DETECT);
                 tp->grc_local_ctrl &= ~GRC_LCLCTRL_USE_EXT_SIG_DETECT;
                 tp->grc_local_ctrl |= GRC_LCLCTRL_USE_SIG_DETECT;
                 tw32(GRC_LOCAL_CTRL, tp->grc_local_ctrl);
         }
 
 And look at this section:
 
 
                         /* Set bit 23 to enable PCIX hw bug fix */
                         tp->dma_rwctrl |= 0x009f0000;
                 } else if (GET_ASIC_REV(tp->pci_chip_rev_id) ==
 ASIC_REV_5780) {
                         /* 5780 always in PCIX mode */
                         tp->dma_rwctrl |= 0x00144000;
                 } else if (GET_ASIC_REV(tp->pci_chip_rev_id) ==
 ASIC_REV_5714) {
                         /* 5714 always in PCIX mode */
                         tp->dma_rwctrl |= 0x00148000;
                 } else {
                         tp->dma_rwctrl |= 0x001b000f;
                 }
 
 Note also that in PR/94863 regarding the IBM e326m Opteron server, that the
 originator of the PR concluded that his server had a BCM5780 chip in it.
 
 I don't know where in the FreeBSD driver the cooresponding "PCI-X" bugfix
 would be located.  There's a lot similar between the Linux driver and the
 FreeBSD driver but a lot also that's different.
 
 Ted
 
 

From: "No@SPAM@mgEDV.net" <nospam@mgedv.net>
To: <bug-followup@FreeBSD.org>
Cc: <bhicks@nmsu.edu>, <tedm@toybox.placo.com>
Subject: Re: kern/94307: [bge] kernel panics when passing trafffic through bge1
Date: Thu, 4 May 2006 00:07:31 +0200

 hi together,
 
 we own a DL320 G4 (same model as in this PR) with a 3.4Ghz CPU and
 a different broadcom bge chipset (BCM5704C), that does not cause any
 kernel panic with network traffic (like BCM5714).
 
 our mbuf.c version:
      $FreeBSD: src/sys/kern/kern_mbuf.c,v 1.9.2.7 2006/03/18 21:55:43
 glebius Exp $
 
 pciconf -l|grep bge:
 	bge0@pci6:1:0:	class=0x020000 card=0x00d00e11 chip=0x164814e4
 rev=0x10 hdr=0x00
 	bge1@pci6:1:1:	class=0x020000 card=0x00d00e11 chip=0x164814e4
 rev=0x10 hdr=0x00
 
 our dmesg (shorted):
 ------------------------------------------------------------------------
 FreeBSD 6.1-RC2 #0: Sun Apr 30 09:42:38 UTC 2006
     root@opus.cse.buffalo.edu:/usr/obj/usr/src/sys/GENERIC
 ACPI APIC Table: <HP     00000083>
 Timecounter "i8254" frequency 1193182 Hz quality 0
 CPU: Intel(R) Pentium(R) 4 CPU 3.40GHz (3391.52-MHz 686-class CPU)
   Origin = "GenuineIntel"  Id = 0xf43  Stepping = 3
  
 Features=0xbfebfbff<FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA
 ,CMOV,PAT,PSE36,CLFLUSH,DTS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,PBE>
   Features2=0x649d<SSE3,RSVD2,MON,DS_CPL,EST,CNTX-ID,CX16,<b14>>
   AMD Features=0x20000000<LM>
   Logical CPUs per core: 2
 real memory  = 1073688576 (1023 MB)
 avail memory = 1041743872 (993 MB)
 ioapic0 <Version 2.0> irqs 0-23 on motherboard
 ioapic1 <Version 2.0> irqs 24-47 on motherboard
 ioapic2 <Version 2.0> irqs 48-71 on motherboard
 kbd1 at kbdmux0
 acpi0: <HP D18> on motherboard
 acpi0: Power Button (fixed)
 Timecounter "ACPI-fast" frequency 3579545 Hz quality 1000
 acpi_timer0: <24-bit timer at 3.579545MHz> port 0x908-0x90b on acpi0
 cpu0: <ACPI CPU> on acpi0
 pcib0: <ACPI Host-PCI bridge> on acpi0
 pci0: <ACPI PCI bus> on pcib0
 pcib0: no PRT entry for 0.31.INTA
 pcib1: <ACPI PCI-PCI bridge> at device 1.0 on pci0
 pci5: <ACPI PCI bus> on pcib1
 pcib2: <ACPI PCI-PCI bridge> at device 0.0 on pci5
 pci6: <ACPI PCI bus> on pcib2
 bge0: <Broadcom BCM5704C Dual Gigabit Ethernet, ASIC rev. 0x2100> mem
 0xfdff0000-0xfdffffff irq 24 at device 1.0 on pci6
 miibus0: <MII bus> on bge0
 brgphy0: <BCM5704 10/100/1000baseTX PHY> on miibus0
 brgphy0:  10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, 1000baseTX,
 1000baseTX-FDX, auto
 bge0: Ethernet address: 00:15:60:aa:39:d2
 bge1: <Broadcom BCM5704C Dual Gigabit Ethernet, ASIC rev. 0x2100> mem
 0xfdfe0000-0xfdfeffff irq 25 at device 1.1 on pci6
 miibus1: <MII bus> on bge1
 brgphy1: <BCM5704 10/100/1000baseTX PHY> on miibus1
 brgphy1:  10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, 1000baseTX,
 1000baseTX-FDX, auto
 bge1: Ethernet address: 00:15:60:aa:39:d1
 pcib3: <ACPI PCI-PCI bridge> at device 0.2 on pci5
 pci9: <ACPI PCI bus> on pcib3
 pcib4: <ACPI PCI-PCI bridge> at device 28.0 on pci0
 pci2: <ACPI PCI bus> on pcib4
 .
 <snip>
 .
 pcib5: <ACPI PCI-PCI bridge> at device 30.0 on pci0
 pci1: <ACPI PCI bus> on pcib5
 pci1: <base peripheral> at device 2.0 (no driver attached)
 pci1: <base peripheral> at device 2.2 (no driver attached)
 .
 <snip>
 .
 Timecounter "TSC" frequency 3391523265 Hz quality 800
 Timecounters tick every 1.000 msec
 ------------------------------------------------------------------------
 
 our sysctl|grep bge
 ------------------------------------------------------------------------
 dev.bge.0.%desc: Broadcom BCM5704C Dual Gigabit Ethernet, ASIC rev. 0x2100
 dev.bge.0.%driver: bge
 dev.bge.0.%location: slot=1 function=0
 dev.bge.0.%pnpinfo: vendor=0x14e4 device=0x1648 subvendor=0x0e11
 subdevice=0x00d0 class=0x020000
 dev.bge.0.%parent: pci6
 dev.bge.1.%desc: Broadcom BCM5704C Dual Gigabit Ethernet, ASIC rev. 0x2100
 dev.bge.1.%driver: bge
 dev.bge.1.%location: slot=1 function=1
 dev.bge.1.%pnpinfo: vendor=0x14e4 device=0x1648 subvendor=0x0e11
 subdevice=0x00d0 class=0x020000
 dev.bge.1.%parent: pci6
 dev.miibus.0.%parent: bge0
 dev.miibus.1.%parent: bge1
 ------------------------------------------------------------------------
 
 hope that helps!
 <EOM>
 

From: "Internet Partners, Inc. Tech Support" <support@ipinc.net>
To: <bug-followup@FreeBSD.org>, <bhicks@nmsu.edu>
Cc:  
Subject: Re: kern/94307: [bge] kernel panics when passing trafffic through bge1
Date: Thu, 4 May 2006 22:43:58 -0700

 Please try applying the patch in PR kern/96806 this should correct this.
 
 Ted
State-Changed-From-To: feedback->open 
State-Changed-By: linimon 
State-Changed-When: Tue Jun 12 07:30:53 UTC 2007 
State-Changed-Why:  
To submitter: did the commit fix the problem? 


Responsible-Changed-From-To: freebsd-bugs->linimon 
Responsible-Changed-By: linimon 
Responsible-Changed-When: Tue Jun 12 07:30:53 UTC 2007 
Responsible-Changed-Why:  

http://www.freebsd.org/cgi/query-pr.cgi?pr=94307 
State-Changed-From-To: open->closed 
State-Changed-By: linimon 
State-Changed-When: Mon Jul 23 03:53:55 UTC 2007 
State-Changed-Why:  
Feedback timeout (1 month). 

http://www.freebsd.org/cgi/query-pr.cgi?pr=94307 
>Unformatted:
