DragonFlyBSD

Is this an smp system? which altq classifier/queue do you use?

i think the dump is needed to get some details.

cheers
simon

Yes. I have smp enabled on my ht pentium (not for performance, more
for smp testing).

i think the dump is needed to get some details.

Available in ~kylebutt/crash on leaf

Kyle

sorry for the repeat, but It was class based queuing.
Here are the applicable sections of pf.conf:

1. $OpenBSD: pf.conf,v 1.25 2004/01/29 18:54:29 todd Exp $
2. $DragonFly: src/etc/pf.conf,v 1.1 2004/09/21 21:25:28 joerg Exp $ #
3. See pf.conf(5) and /usr/share/pf for syntax and examples.

ext_if="em0"

#altq on $ext_if cbq bandwidth 256Kb queue {ssh, http, other}
#queue other bandwidth 10% cbq(default, borrow)
#queue http bandwidth 65% cbq(borrow)
#queue ssh bandwidth 25% {ssh_login, ssh_data}
#queue ssh_login bandwidth 25% priority 4 cbq(ecn)
#queue ssh_data bandwidth 75% cbq(ecn, borrow)

#pass out on $ext_if proto tcp to any port http modulate state queue http
#pass out on $ext_if proto tcp to any port ssh modulate state queue (ssh_data, ssh_login)

:Yes. I have smp enabled on my ht pentium (not for performance, more
:for smp testing).
:>
:> i think the dump is needed to get some details.
:
:Available in ~kylebutt/crash on leaf
:
:Kyle

There is still a mbuf in the IFQ and ifq_len is non-zero.  The
    altq_purge() call did not purge the IFQ.

In this case altq_purge() calls cbq_request() which calls cbq_purge().
    Either cbq_purge() did not get called or it did not actually purge the
    whole queue.

Here's a question for the PF masters.... when cbq_add_altq() is called
    is it possible for the IFQ to already have packets queued to it?
    Because if that is the case then those packets will never be placed
    under CBQ management and can cause this situation to occur.

I have included a patch that should theoretically panic if CBQ is
    associated with an IFQ that has packets in it already.  Try this
    and tell me if it panics here rather then later.

-Matt
                    Matthew Dillon 
                    <dillon@backplane.com>

Index: altq/altq_cbq.c ===================================================================
RCS file: /cvs/src/sys/net/altq/altq_cbq.c,v
retrieving revision 1.4
diff u -r1.4 altq_cbq.c
-- altq/altq_cbq.c 5 Sep 2006 00:55:47 0000 1.4
++ altq/altq_cbq.c 11 Oct 2006 16:53:28 -0000
@ -231,6 +231,7 @
callout_init(&cbqp>cbq_callout);
cbqp->cbq_qlen = 0;
cbqp->ifnp.ifq_ = &ifp->if_snd; /* keep the ifq */
KKASSERT;

/* keep the state in pf_altq */
     a->altq_disc = cbqp;

KGDB SESSION TRACE

(kgdb) print *ifq
$1 = {
ifq_head = 0xd6c74b00, <<<<<<<<<< MBUF STILL IN QUEUE
ifq_tail = 0xd6c74b00,
ifq_len = 1, <<<<<<<<<< COUNT OF 1 IS CORRECT
ifq_maxlen = 255,
ifq_drops = 0,
altq_type = 1,
altq_flags = 1,
altq_disc = 0xcce421c0,
altq_ifp = 0xd500d9c0,
altq_enqueue = 0xc031a2da <cbq_enqueue>,
altq_dequeue = 0xc031a425 <cbq_dequeue>,
altq_request = 0xc0319c09 <cbq_request>,
altq_clfier = 0x0,
altq_classify = 0,
altq_tbr = 0x0
}
(kgdb) frame
#12 0xc0320389 in altq_enable (ifq=0xd500da84)
at /usr/src/sys/net/altq/altq_subr.c:155
155 KKASSERT(ifq->ifq_len 0);
(kgdb)

int
altq_enable(struct ifaltq *ifq) {
if (!ifq_is_ready(ifq))
return ENXIO;
if (ifq_is_enabled(ifq))
return 0;

crit_enter();
        ifq_purge(ifq);
        KKASSERT(ifq->ifq_len  0);    <<<<<<<<<<<<<<<<<,
        ifq->altq_flags |= ALTQF_ENABLED;
        if (ifq->altq_clfier != NULL)
                ifq->altq_flags |= ALTQF_CLASSIFY;
        crit_exit();

return 0;
}

(kgdb) print *(cbq_state_t *)ifq->altq_disc
$3 = {
cbq_qlen = 0, <<<<<<<<<<<< COUNT OF 0 IS INCORRECT,
OR THE CBQ NEVER SAW
THE PACKET IN THE IFQ
cbq_class_tbl = {0x0, 0xc1894e60, 0xc1894f40, 0xc1895020, 0xc1895100,
0xc18951e0, 0xc18952c0, 0x0 <repeats 249 times>},
ifnp = {
queued_ = 0,
efficient_ = 0,
wrr_ = 1,
ns_per_byte_ = 31250,
maxqueued_ = 1,
maxpkt_ = 1500,
qi_ = 0,
qo_ = 0,
active_ = {0xc1894e60, 0xc1894f40, 0x0, 0x0, 0xc18951e0, 0x0, 0x0, 0x0},
na_ = {0, 0, 0, 0, 0, 0, 0, 0},
num_ = {1, 4, 0, 0, 1, 0, 0, 0},
alloc_ = {32000, 38000, 0, 0, 2000, 0, 0, 0},
M_ = {21, 6, 0, 0, 1, 0, 0, 0},
ifq_ = 0xd500da84,
default_ = 0xc1894f40,
root_ = 0xc1894e60,
ctl_ = 0x0,
restart = 0xc031a4ec <cbqrestart>,
borrowed_ = {0x0},
class_ = {0x0},
curlen_ = {0},
now_ = {{
tv_sec = 0,
tv_usec = 0
}},
is_overlimit_ = {0},
cutoff_ = 32,
ifnow_ = {
tv_sec = 0,
tv_usec = 0
},
maxiftime_ = 187500,
pollcache_ = 0x0
},
cbq_callout = {
c_links = {
sle = {
sle_next = 0x0
},
tqe = {
tqe_next = 0x0,
tqe_prev = 0x0
}
},
c_time = 0,
c_arg = 0x0,
c_func = 0,
c_flags = 16,
c_gd = 0x0
}
}
(kgdb)

Yes, It crashes right there with the patch applied. I can upload core/kernel
if you'd like.

Kyle.

:
:
:Kyle Butt <kylebutt@gmail.com> added the comment:
:
:Yes, It crashes right there with the patch applied. I can upload core/kernel
:if you'd like.
:
:Kyle.

No, don't bother, that's proof enough.  I think the easiest thing to do
    is to have the cbq and other queue types clean out the altq before
    attaching.  I'll work up a patch this evening.

-Matt
                    Matthew Dillon 
                    <dillon@backplane.com>

Ok Kyle, remove the old patch and please try this patch. If it works
I will add the ifq_purge() to all the ALTQ classes.

-Matt
                    Matthew Dillon 
                    <dillon@backplane.com>

Index: altq/altq_cbq.c ===================================================================
RCS file: /cvs/src/sys/net/altq/altq_cbq.c,v
retrieving revision 1.4
diff u -r1.4 altq_cbq.c
-- altq/altq_cbq.c 5 Sep 2006 00:55:47 0000 1.4
++ altq/altq_cbq.c 13 Oct 2006 16:31:49 -0000
@ -231,6 +231,7 @
callout_init(&cbqp>cbq_callout);
cbqp->cbq_qlen = 0;
cbqp->ifnp.ifq_ = &ifp->if_snd; /* keep the ifq */
ifq_purge(&ifp->if_snd);

/* keep the state in pf_altq */
     a->altq_disc = cbqp;

is this fixed by the patch?

Yeah, that fixed it.

Kyle

Fix committed:
http://leaf.dragonflybsd.org/mailarchive/commits/2006-10/msg00170.html