Skip site navigation (1)Skip section navigation (2)
Date:      Wed, 9 Dec 2009 23:41:18 +0100
From:      Marco van Tol <marco@tols.org>
To:        freebsd-stable@freebsd.org
Subject:   kldunload ipl - spontaneous reboot
Message-ID:  <20091209224118.GA1072@donald.home.tols.org>

next in thread | raw e-mail | index | archive | help

--dDRMvlgZJXvWKvBx
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

Hi there,

I was toy'ing around with ipfilter while deciding which firewall package to
use, and ran into the following:

- Build some testing rules in /etc/ipf.conf
- boot the system with ipfilter_enable="YES", ipmon_enable="YES",
  ipmon_flags="-L security -Ds" in /etc/rc.conf
- Browse the web a bit, let pidgin start and authenticate with ICQ and MSN
- Browse email using mutt on an nfs mounted mailstore
- Check out the firewall statistics using for example "ipfstat -hio" and
  "ipfstat -t"
- Probably other stuff I forgot to mention

Extra info: I'm using sudo to do root things.

Then I decided it was time to "/etc/rc.d/ipmon stop", "/etc/rc.d/ipfilter
stop" and "kldunload ipl".

When I did the final "kldunload ipl" from an xterm inside Xorg, my system
spontaneously rebooted seconds later. 

The kernel did see the chance to flush "Dec  9 21:52:45 donald kernel: IP
Filter: v4.1.28 unloaded" to /var/log/messages through syslog(d).

No core was dumped, but I'm pretty sure that it never would, since I happen
to have the silly combination of dumpdev="/dev/ad4s1b" in /etc/rc.conf, but
also kern.coredump=0 in /etc/sysctl.conf.  At some point I got bored by
linux-firefox/linux-flash dumping core in my nfs mounted homedirectory and
fixed it with the syscontrol, but didn't bother to get rid of the rc.conf
entry.  That particular issue got fixed by the way, thank the gods for
freebsd native firefox in combination with linux-flashplayer10.  But I'm
sidetracking here.

I'd be willing to send my firewall rules to some freebsd security address
somewhere, but I don't consider it wise to include it in an email to a
public list.  Even though it ran on a test system behind a NAT gateway running
on my ADSL modem.
What I can share about it here is that it was a default open list in that
the rules for incoming and outgoing ended with the following for the sake of
diagnostics output/counters:
pass out log first quick on nfe0 proto tcp all
pass out log first quick on nfe0 proto udp all
pass out log first quick on nfe0 proto icmp all
pass out log first quick on nfe0 all
pass in log first quick on nfe0 all

I'm including my current rc.conf, pciconf -lv output, kernel config and
uname -a output assuming that might be usefull in case anyone wants to look
at this.  I'm also willing to try to trigger it again while kern.coredump=1
if needed, hoping it wouldn't take to long. ;-)
You will see the ipfilter things taken out of the rc.conf, cause I booted
single-user and took it out for now, they used to be there however.

Other things that may be related is that I do load the days-ago released
nvidia kernel module, and also run powerd.

Anybody interested? :-)
For now I'll step away from ipfilter, but I may revisit it again later.

Thanks!

Marco van Tol

-- 
Micro$oft likes to discard vulnerabilities by `no standard client
would do this.'  No, and no `standard visitor' would apply a crowbar
to your patio door, either." - H. Peter Anvin in linux-kernel.

--dDRMvlgZJXvWKvBx
Content-Type: text/plain; charset=us-ascii
Content-Disposition: attachment; filename=DONALD

cpu		HAMMER
ident		DONALD

makeoptions	DEBUG=-g		# Build kernel with gdb(1) debug symbols

options 	SCHED_ULE		# ULE scheduler
options 	PREEMPTION		# Enable kernel thread preemption
options 	INET			# InterNETworking
options 	INET6			# IPv6 communications protocols
options 	SCTP			# Stream Control Transmission Protocol
options 	FFS			# Berkeley Fast Filesystem
options 	SOFTUPDATES		# Enable FFS soft updates support
options 	UFS_ACL			# Support for access control lists
options 	UFS_DIRHASH		# Improve performance on big directories
options 	UFS_GJOURNAL		# Enable gjournal-based UFS journaling
options 	NFSCLIENT		# Network Filesystem Client
options 	NFSLOCKD		# Network Lock Manager
options 	NTFS			# NT File System
options 	MSDOSFS			# MSDOS Filesystem
options 	CD9660			# ISO 9660 Filesystem
options 	PROCFS			# Process filesystem (requires PSEUDOFS)
options 	PSEUDOFS		# Pseudo-filesystem framework
options 	GEOM_PART_GPT		# GUID Partition Tables.
options 	GEOM_LABEL		# Provides labelization
options 	COMPAT_43TTY		# BSD 4.3 TTY compat (sgtty)
options 	COMPAT_IA32		# Compatible with i386 binaries
options 	SCSI_DELAY=5000		# Delay (in ms) before probing SCSI
options 	KTRACE			# ktrace(1) support
options 	STACK			# stack(9) support
options 	SYSVSHM			# SYSV-style shared memory
options 	SYSVMSG			# SYSV-style message queues
options 	SYSVSEM			# SYSV-style semaphores
options 	P1003_1B_SEMAPHORES	# POSIX-style semaphores
options 	_KPOSIX_PRIORITY_SCHEDULING # POSIX P1003_1B real-time extensions
options 	PRINTF_BUFR_SIZE=128	# Prevent printf output being interspersed.
options 	KBD_INSTALL_CDEV	# install a CDEV entry in /dev
options 	HWPMC_HOOKS		# Necessary kernel hooks for hwpmc(4)
options 	AUDIT			# Security event auditing
options 	MAC			# TrustedBSD MAC Framework
options 	FLOWTABLE		# per-cpu routing cache

# Make an SMP-capable kernel by default
options 	SMP			# Symmetric MultiProcessor Kernel

# CPU frequency control
device		cpufreq

# Bus support.
device		acpi
device		pci

# Floppy drives
device		fdc

# ATA and ATAPI devices
device		ata
device		atadisk		# ATA disk drives
device		ataraid		# ATA RAID drives
device		atapicd		# ATAPI CDROM drives
device		atapifd		# ATAPI floppy drives
options 	ATA_STATIC_ID	# Static device numbering

# SCSI peripherals
device		scbus		# SCSI bus (required for SCSI)
device		ch		# SCSI media changers
device		da		# Direct Access (disks)
device		cd		# CD
device		pass		# Passthrough device (direct SCSI access)
device		ses		# SCSI Environmental Services (and SAF-TE)

# atkbdc0 controls both the keyboard and the PS/2 mouse
device		atkbdc		# AT keyboard controller
device		atkbd		# AT keyboard
device		psm		# PS/2 mouse

device		kbdmux		# keyboard multiplexer

device		vga		# VGA video card driver

device		splash		# Splash screen and screen saver support

# syscons is the default console driver, resembling an SCO console
device		sc

device		agp		# support several AGP chipsets

# Serial (COM) ports
device		uart		# Generic UART driver

# Parallel port
device		ppc
device		ppbus		# Parallel port bus (required)
device		lpt		# Printer
device		ppi		# Parallel port interface device

# PCI Ethernet NICs that use the common MII bus controller code.
# NOTE: Be sure to keep the 'device miibus' line in order to use these NICs!
device		miibus		# MII bus support
device		nfe		# nVidia nForce MCP on-board Ethernet

# Pseudo devices.
device		loop		# Network loopback
device		random		# Entropy device
device		ether		# Ethernet support
device		pty		# BSD-style compatibility pseudo ttys
device		md		# Memory "disks"
device		firmware	# firmware assist module

# The `bpf' device enables the Berkeley Packet Filter.
# Be aware of the administrative consequences of enabling this!
# Note that 'bpf' is required for DHCP.
device		bpf		# Berkeley packet filter

# USB support
device		ohci		# OHCI PCI->USB interface
device		ehci		# EHCI PCI->USB interface (USB 2.0)
device		usb		# USB Bus (required)
device		uhid		# "Human Interface Devices"
device		ukbd		# Keyboard
device		ulpt		# Printer
device		umass		# Disks/Mass storage - Requires scbus and da
device		ums		# Mouse

# FireWire support
device		firewire	# FireWire bus code
device		dcons		# Dumb console driver
device		dcons_crom	# Configuration ROM for dcons

#
# marco@tols.org
#
device		smbus		# Bus support, required for smb below.
device		nfsmb		# NVIDIA nForce2/3/4 MCP SMBus 2.0 Controller
device		smb

device		sound
device		snd_ich

options 	COMPAT_LINUX32	# Enable Linux ABI emulation
options 	LINPROCFS	# Enable the linux-like proc filesystem support
options 	LINSYSFS	# Enable the linux-like sys filesystem support

# Direct Rendering modules for 3D acceleration.
device		drm

# amdtemp: on-die sensor on AMD K8/K10/K11 CPUs
device		amdtemp

--dDRMvlgZJXvWKvBx
Content-Type: text/plain; charset=us-ascii
Content-Disposition: attachment; filename="pciconf-lv.out"

none0@pci0:0:0:0:	class=0x058000 card=0x50001458 chip=0x005e10de rev=0xa3 hdr=0x00
    vendor     = 'Nvidia Corp'
    device     = 'nForce4 Memory Controller'
    class      = memory
isab0@pci0:0:1:0:	class=0x060100 card=0x0c111458 chip=0x005010de rev=0xa3 hdr=0x00
    vendor     = 'Nvidia Corp'
    device     = 'nForce4 PCI to ISA Bridge'
    class      = bridge
    subclass   = PCI-ISA
nfsmb0@pci0:0:1:1:	class=0x0c0500 card=0x0c111458 chip=0x005210de rev=0xa2 hdr=0x00
    vendor     = 'Nvidia Corp'
    device     = 'nForce4 SMBus'
    class      = serial bus
    subclass   = SMBus
ohci0@pci0:0:2:0:	class=0x0c0310 card=0x50041458 chip=0x005a10de rev=0xa2 hdr=0x00
    vendor     = 'Nvidia Corp'
    device     = 'nForce4 USB Controller'
    class      = serial bus
    subclass   = USB
ehci0@pci0:0:2:1:	class=0x0c0320 card=0x50041458 chip=0x005b10de rev=0xa3 hdr=0x00
    vendor     = 'Nvidia Corp'
    device     = 'nForce4 USB 2.0 Controller'
    class      = serial bus
    subclass   = USB
pcm0@pci0:0:4:0:	class=0x040100 card=0xae011458 chip=0x005910de rev=0xa2 hdr=0x00
    vendor     = 'Nvidia Corp'
    device     = 'Realtek AC'97 Audio (Realtek ALC850)'
    class      = multimedia
    subclass   = audio
atapci0@pci0:0:6:0:	class=0x01018a card=0x50021458 chip=0x005310de rev=0xf2 hdr=0x00
    vendor     = 'Nvidia Corp'
    device     = 'nForce4 Parallel ATA Controller'
    class      = mass storage
    subclass   = ATA
atapci1@pci0:0:7:0:	class=0x010185 card=0xb0031458 chip=0x005410de rev=0xf3 hdr=0x00
    vendor     = 'Nvidia Corp'
    device     = 'CK804 SATA/RAID Controller (CK804)'
    class      = mass storage
    subclass   = ATA
atapci2@pci0:0:8:0:	class=0x010185 card=0xb0031458 chip=0x005510de rev=0xf3 hdr=0x00
    vendor     = 'Nvidia Corp'
    device     = 'CK804 SATA/RAID Controller (CK804)'
    class      = mass storage
    subclass   = ATA
pcib1@pci0:0:9:0:	class=0x060401 card=0x00000000 chip=0x005c10de rev=0xa2 hdr=0x01
    vendor     = 'Nvidia Corp'
    device     = 'nForce4 PCI Bridge'
    class      = bridge
    subclass   = PCI-PCI
nfe0@pci0:0:10:0:	class=0x068000 card=0xe0001458 chip=0x005710de rev=0xa3 hdr=0x00
    vendor     = 'Nvidia Corp'
    device     = 'NVidia Network Bus Enumerator Description du priphriquenVIDIA nForce4 SLI (CK8-04) - LAN Controll (nForce4 Ultra)'
    class      = bridge
pcib2@pci0:0:11:0:	class=0x060400 card=0x00000000 chip=0x005d10de rev=0xa3 hdr=0x01
    vendor     = 'Nvidia Corp'
    device     = 'nForce4 PCIe Bridge'
    class      = bridge
    subclass   = PCI-PCI
pcib3@pci0:0:12:0:	class=0x060400 card=0x00000000 chip=0x005d10de rev=0xa3 hdr=0x01
    vendor     = 'Nvidia Corp'
    device     = 'nForce4 PCIe Bridge'
    class      = bridge
    subclass   = PCI-PCI
pcib4@pci0:0:13:0:	class=0x060400 card=0x00000000 chip=0x005d10de rev=0xa3 hdr=0x01
    vendor     = 'Nvidia Corp'
    device     = 'nForce4 PCIe Bridge'
    class      = bridge
    subclass   = PCI-PCI
pcib5@pci0:0:14:0:	class=0x060400 card=0x00000000 chip=0x005d10de rev=0xa3 hdr=0x01
    vendor     = 'Nvidia Corp'
    device     = 'nForce4 PCIe Bridge'
    class      = bridge
    subclass   = PCI-PCI
hostb0@pci0:0:24:0:	class=0x060000 card=0x00000000 chip=0x11001022 rev=0x00 hdr=0x00
    vendor     = 'Advanced Micro Devices (AMD)'
    device     = 'Athlon64/Opteron/Sempron (K8 Family) HyperTransport Technology Configuration'
    class      = bridge
    subclass   = HOST-PCI
hostb1@pci0:0:24:1:	class=0x060000 card=0x00000000 chip=0x11011022 rev=0x00 hdr=0x00
    vendor     = 'Advanced Micro Devices (AMD)'
    device     = 'Athlon64/Opteron/Sempron (K8 Family) Address Map'
    class      = bridge
    subclass   = HOST-PCI
hostb2@pci0:0:24:2:	class=0x060000 card=0x00000000 chip=0x11021022 rev=0x00 hdr=0x00
    vendor     = 'Advanced Micro Devices (AMD)'
    device     = 'Athlon64/Opteron/Sempron (K8 Family) DRAM Controller'
    class      = bridge
    subclass   = HOST-PCI
hostb3@pci0:0:24:3:	class=0x060000 card=0x00000000 chip=0x11031022 rev=0x00 hdr=0x00
    vendor     = 'Advanced Micro Devices (AMD)'
    device     = 'Athlon64/Opteron/Sempron (K8 Family) Miscellaneous Control'
    class      = bridge
    subclass   = HOST-PCI
fwohci0@pci0:1:10:0:	class=0x0c0010 card=0x10001458 chip=0x8025104c rev=0x01 hdr=0x00
    vendor     = 'Texas Instruments (TI)'
    device     = '1394b OHCI-Lynx IEEE 1394 Host Controller (TSB82AA2)'
    class      = serial bus
    subclass   = FireWire
vgapci0@pci0:5:0:0:	class=0x030000 card=0x21801682 chip=0x009110de rev=0xa1 hdr=0x00
    vendor     = 'Nvidia Corp'
    device     = 'GeForce 7800 GTX (G70)'
    class      = display
    subclass   = VGA

--dDRMvlgZJXvWKvBx
Content-Type: text/plain; charset=us-ascii
Content-Disposition: attachment; filename="uname-a.out"

FreeBSD donald.home.tols.org 8.0-STABLE FreeBSD 8.0-STABLE #2: Sat Dec  5 02:31:09 CET 2009     root@donald.home.tols.org:/usr/obj/usr/src/sys/DONALD  amd64

--dDRMvlgZJXvWKvBx
Content-Type: text/plain; charset=us-ascii
Content-Disposition: attachment; filename="rc.conf"

# -- sysinstall generated deltas -- # Mon Sep 22 14:34:31 2008
# Created: Mon Sep 22 14:34:31 2008
# Enable network daemons for user convenience.
# Please make all changes to this file, not to /etc/defaults/rc.conf.
# This file now contains just the overrides from /etc/defaults/rc.conf.
anacron_enable="YES"
background_fsck="NO"
cupsd_enable="YES"
dbus_enable="YES"
dumpdev="/dev/ad4s1b"
fsck_y_enable="YES"
hald_enable="YES"
hostname="donald.home.tols.org"
linux_enable="YES"
ntpd_enable="YES"
ntpd_sync_on_start="YES"
powerd_enable="YES"
smartd_enable="YES"
smartd_flags="-l local0"
sshd_enable="YES"
syslogd_flags="-ss"

# Interface settings
# Synchronus dhcp, otherwise ntpd and nfs mounts fail
ifconfig_nfe0="syncdhcp"

# NFS Settings
nfs_client_enable="YES"
rpc_lockd_enable="YES"
rpc_statd_enable="YES"

--dDRMvlgZJXvWKvBx--



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20091209224118.GA1072>