Patch Name: PHNE_29473 Patch Description: s700_800 11.00 cumulative ARPA Transport patch Creation Date: 04/01/02 Post Date: 04/03/12 Hardware Platforms - OS Releases: s700: 11.00 s800: 11.00 Products: N/A Filesets: OS-Core.CORE2-KRN,fr=B.11.00,fa=HP-UX_B.11.00_32,v=HP Networking.NET-KRN,fr=B.11.00,fa=HP-UX_B.11.00_32/64,v=HP Networking.NET-PRG,fr=B.11.00,fa=HP-UX_B.11.00_32/64,v=HP Networking.NET-RUN,fr=B.11.00,fa=HP-UX_B.11.00_32/64,v=HP Networking.NET2-KRN,fr=B.11.00,fa=HP-UX_B.11.00_32,v=HP Networking.NMS2-KRN,fr=B.11.00,fa=HP-UX_B.11.00_32,v=HP OS-Core.CORE2-KRN,fr=B.11.00,fa=HP-UX_B.11.00_64,v=HP Networking.NET2-KRN,fr=B.11.00,fa=HP-UX_B.11.00_64,v=HP Networking.NMS2-KRN,fr=B.11.00,fa=HP-UX_B.11.00_64,v=HP Automatic Reboot?: Yes Status: General Release Critical: Yes PHNE_29473: PANIC MEMORY_LEAK PHNE_28538: PANIC HANG PHNE_27886: PANIC PHNE_27058: PANIC HANG MEMORY_LEAK PHNE_26771: CORRUPTION PHNE_26445: PANIC PHNE_26412: CORRUPTION PHNE_25423: PANIC HANG CORRUPTION PHNE_25381: PANIC PHNE_25135: PANIC PHNE_24715: PANIC PHNE_24289: PANIC PHNE_24075: PANIC PHNE_23456: PANIC PHNE_22869: PANIC PHNE_22527: PANIC PHNE_22397: PANIC PHNE_22318: PANIC PHNE_22067: PANIC PHNE_21890: PANIC PHNE_21767: PANIC PHNE_21606: PANIC PHNE_21318: PANIC PHNE_21038: PANIC PHNE_20735: PANIC PHNE_20633: PANIC PHNE_20436: PANIC PHNE_20041: PANIC PHNE_19899: PANIC PHNE_19375: PANIC PHNE_19110: PANIC PHNE_18708: PANIC PHNE_18611: PANIC PHNE_18554: PANIC PHNE_18553: PANIC PHNE_17662: PANIC PHNE_17613: PANIC PHNE_17446: PANIC PHNE_17227: PANIC PHNE_17117: PANIC PHNE_17018: PANIC PHNE_17017: PANIC PHNE_16645: PANIC PHNE_16497: PANIC PHNE_16283: PANIC PHNE_15995: PANIC PHNE_15911: PANIC PHNE_15692: PANIC PHNE_15583: PANIC PHNE_15047: PANIC PHNE_14876: PANIC PHNE_14730: PANIC PHNE_14702: PANIC PHNE_14575: PANIC PHNE_14279: PANIC PHNE_14274: PANIC PHNE_14260: PANIC PHNE_14017: PANIC PHNE_13692: PANIC PHNE_13405: PANIC Category Tags: defect_repair general_release critical panic halts_system corruption memory_leak Path Name: /hp-ux_patches/s700_800/11.X/PHNE_29473 Symptoms: PHNE_29473: This patch replaces PHNE_28538 ( SR: 8606285107 CR: JAGae49049 ) Disrupted IGMP membership reporting. ( SR: 8606328253 CR: JAGae89895 ) read() returns ECONNRESET instead of ECONNREFUSED. ( SR: 8606297439 CR: JAGae60941 ) System panics with the following stack trace: optcom_req+0xb8 tcp_wput_proto+0xa4 tcp_wput+0x458 ( SR: 8606304572 CR: JAGae67915 ) System panics with the following stack trace: ip_bind+0x334 ip_wput_nondata+0x38 ip_wput+0x108 putnext+0xcc tcp_connect+0x204 tcp_wput_proto+0xc4 tcp_wput+0x574 putnext+0xcc str_async_ioctl+0x210 hpstreams_ioctl_int+0x548 streams_ioctl+0x34 soconnect+0x140 connect+0xdc ( SR: 8606306857 CR: JAGae69891 ) System panics with the following stack trace: freeb+0x18 ire_delete_now+0x6c ip_dfg_flush+0x158 invoke_callouts_for_self+0xc0 sw_service+0xb0 up_ext_interrupt+0x118 ihandler+0x8c4 ( SR: 8606312501 CR: JAGae75317 ) Data page fault in tcp_detach() with the following stack trace: panic+0x14 report_trap_or_int_and_panic+0x84 trap+0xd9c nokgdb+0x8 tcp_detach+0x5d8 tcp_close+0xf0 close_wrapper+0x38 csq_protect+0x120 osr_pop_subr+0x214 osr_close_subr+0xf50 hpstreams_close_int+0x31c streams_close+0x14 soclose+0xf0 soo_close+0x90 ( SR: 8606318794 CR: JAGae81284 ) Panic while closing the socket, with the following stack trace: panic+0x14 too_much_time+0x2e0 wait_for_lock+0x14c slu_retry+0x1c hpstreams_ioctl_int+0x6a4 streams_ioctl+0x34 sotocache+0x164 sounlock+0x704 mp_socket_unlock+0x10 soclose+0x964 soo_close+0x90 closef+0x64 close+0x90 syscall+0x28c $syscallrtn+0x0 ( SR: 8606331109 CR: JAGae92230 ) Unexpected memory consumption of M_DATA mblks in 512 bytes bucket resulting in memory starvation. ( SR: 8606248122 CR: JAGae14522 ) The "ifconfig lanx:y" command which is supposed to display the current configuration of lanx:y, will display a dummy entry for lanx:y if that interface does not exist. ( SR: 8606317300 CR: JAGae79861 ) Memory leak in 512 bytes bucket. ( SR: 8606298990 CR: JAGae62486 ) IREs of type IRE_LOOPBACK remain in the system even after a RST is sent to the peer TCP. ( SR: 8606322708 CR: JAGae85175 ) Route entries associated with loopback interfaces intermittently get deleted. PHNE_28538: This patch replaces PHNE_27886 ( SR number: 8606224462 ; Defect: JAGad93550 ) Message getting displayed on console: tcp_timer: strange state (-6) [5767,d425] TCP_CLOSED ( SR number: 8606257154 ; Defect: JAGae21460 ) connect(2) over AF_INET socket hangs. System TOC with the following stack trace: _swtch+0xc4 _sleep+0x318 read_sleep+0x17c streams_getmsg+0x3c8 soconnect+0x188 connect+0xdc syscall+0x62c syscallinit+0x554 ( SR number: 8606274495 ; Defect: JAGae38572 ) When the timestamp value passed in the timestamp option in the TCP packet rolls over after the connection is established, TCP connection drops packets and applications may hang or time out. ( SR number: 8606283209 ; Defect: JAGae47164 ) Bucket allocation usage is too high when there is a TCP traffic burst. ( SR number: 8606283966 ; Defect: JAGae47912 ) System panics with the following stack trace: stack trace for event 0 crash event was a panic panic+0x14 sbflush+0x130 sbrelease+0x14 sorflush+0x98 sofree+0x98 soclose+0x1b4 soo_close+0x90 closef+0x64 close+0x90 syscall+0x6f8 $syscallrtn+0x0 ( SR number: 8606286419 ; Defect: JAGae50362 ) send(2) may take a long time to complete for AF_UNIX/SOCK_STREAM type of sockets. ( SR number: 8606292583 ; Defect: JAGae56336 ) When an ICMP Address Mask Request packet is sent to a unicast address, an ICMP Address Mask Reply is sent even though the tunable ip_respond_to_address_mask_broadcast is turned OFF. ( SR number: 8606294788 ; Defect: JAGae58482 ) The number of collisions between threads executing select(2) is exceedingly high in some cases. ( SR number: 8606294967 ; Defect: JAGae58664 ) select(2) may take more time for AF_UNIX domain sockets in some cases. ( SR number: 8606294977 ; Defect: JAGae58674 ) read(2) on a socket, may return ECONNREFUSED instead of ECONNRESET. ( SR number: 8606295188 ; Defect: JAGae58883 ) System panics with the following stack trace: panic+0x14 report_trap_or_int_and_panic+0x4c interrupt+0x1e8 $ihndlr_rtn+0x0 ipc_walk+0x7c ill_down_ind+0x118 ip_rput_dlpi+0x9b0 ip_rput+0x394 putnext+0xc4 hp_dlpi_event+0x1b0 HP1_ospif_mib_event+0x150 ospif_watchdog+0x3c HP1_oim_timeout+0x10 invoke_callouts_for_self+0xac sw_service+0x8c inttr_emulate_save_fpu+0x100 drv_priv+0x0 ip_open+0x11c open_wrapper+0x44 csq_protect+0x10c osr_open+0xaec pse_open+0xe4 streams_open+0x48 soclone+0x178 soaccept+0xf4 sodequeue+0xac accept+0x204 syscall+0x6e8 $syscallrtn+0x0 PHNE_27886: This patch replaces PHNE_27058 ( SR number: 8606244252 ; Defect: JAGae10742 ) Data transfer over TCP is very slow. ( SR number: 8606248840 ; Defect: JAGae15237 ) System panics with the following stack trace panic+0xa0 assfail+0x3c _assfail+0x2c b_vsema+0x36c sounlock+0x974 mp_socket_unlock+0x10 function name is not available pstat_socket+0x400 pstat+0x380 syscall+0x834 syscallinit+0x554 ( SR number: 8606272841 ; Defect: JAGae36947 ) It is not possible to know if the support for RFC 1948 is enabled or disabled. ( SR number: 8606272891 ; Defect: JAGae36997 ) The HP-UX 11.0 client does not transmit multicast packets when INADDR_ANY is used. ( SR number: 8606277294 ; Defect: JAGae41365 ) Applications using UDP via XTI or applications using remote file locking via NFS may cause datagram packets to be dropped. PHNE_27058: This patch replaces PHNE_26771 ( SR number: 8606226976 ; Defect: JAGad96038 ) Repeatedly joining and leaving various multicast groups and rejoining already joined groups causes the system to hang. ( SR number: 8606233305 ; Defect: JAGae02529 ) Application hangs in the accept(2) system call. ( SR number: 8606238262 ; Defect: JAGae07289 ) Data corruption occurs in the socket structure during a connect(2). ( SR number: 8606241187 ; Defect: JAGae08450 ) The system does not respond to any keystrokes or commands and appears to hang. A Service Guard system will perform TOC. ( SR number: 8606241192 ; Defect: JAGae08455 ) Memory leak of timer related mblks in 512-byte bucket. ( SR number: 8606242679 ; Defect: JAGae09914 ) A process appears to hang in accept(2) and cannot be killed when there is another process doing a getsockopt(2) on the same socket. ( SR number: 8606247193 ; Defect: JAGae13633 ) System panics with either of the following stack traces: stack trace for event 0 crash event was a panic panic+0x14 too_much_time+0x2d4 wait_for_lock+0x120 sl_retry+0x18 ip_trash+0x18 ip_rtimer+0x38 ip_rput+0x3c0 puthere+0x140 mi_timeout_exec+0x224 sw_service+0x8c mp_ext_interrupt+0x108 ivti_patch_to_nop3+0x0 idle+0xd5c swidle_exit+0x0 stack trace for event 0 crash event was a panic panic+0x14 report_trap_or_int_and_panic+0x80 trap+0xdb8 nokgdb+0x8 ilm_lookup_exact+0x4 ip_delmulti+0x40 ilg_delete+0x90 ilg_delete_all+0x34 ip_close+0x58 close_wrapper+0x38 csq_protect+0x120 osr_pop_subr+0x214 osr_close_subr+0xcbc hpstreams_close_int+0x31c streams_close+0x14 soclose+0x308 soo_close+0x90 closef+0x64 close+0x90 syscall+0x200 $syscallrtn+0x0 ( SR number: 8606248331 ; Defect: JAGae14731 ) System panics during boot after building the kernel with tcphashsz value less than 256. ( SR number: 8606249571 ; Defect: JAGae15961 ) System panics with either of the following stack traces: stack trace for event 0 crash event was a panic panic+0x14 report_trap_or_int_and_panic+0x84 interrupt+0x1d4 $ihndlr_rtn+0x0 ip_rput_unbind_do+0x1ec ip_rput_dlpi+0x2f4 ip_rput+0x4c0 csq_turnover_with_lock+0x84 putnext+0x258 hp_dlpi_mblk_fast_in+0x354 hp_dlpi_mblk_intr_put+0x960 streams_put+0xe8 streams_put_release+0x168 hp_dlpi_mblk_intr+0x14c apa_intr+0x184 lanc_ether_ics+0x114 _btlan3_receive_pkts+0x588 _btlan3_isr+0x198 dino_isr+0xcc mp_ext_interrupt+0x318 ivti_patch_to_nop3+0x0 idle+0x1054 swidle_exit+0x0 stack trace for event 0 crash event was a panic panic+0x14 report_trap_or_int_and_panic+0x84 interrupt+0x1d4 $ihndlr_rtn+0x0 ip_rput_dlpi_up+0x550 ip_rput_dlpi+0x98 ip_rput+0x4c0 csq_turnover_with_lock+0x84 putnext+0x258 ar_client_notify+0x78 ar_rput+0x7d0 putnext+0xcc hp_dlpi_unitdata_in+0x1504 hp_dlpi_intr_put+0x8b0 streams_put+0xe8 hp_dlpi_intr+0x214 lan2_process_packet+0x87c lan2_int_fr_rnr+0x1b0 lan2_isr+0x164 lasi_interrupt+0x64 mp_ext_interrupt+0x318 ivti_patch_to_nop3+0x0 sounlock+0x90 mp_socket_unlock+0x10 soreceive+0x4bc recvit+0x144 recv+0x54 syscall+0x6f8 ( SR number: 8606250217 ; Defect: JAGae16597 ) System panics with the following stack trace: panic+0x14 report_trap_or_int_and_panic+0x84 trap+0xd9c nokgdb+0x8 ill_delete+0x5c8 ip_close+0x1e4 close_wrapper+0x38 csq_protect+0x120 osr_pop_subr+0x214 osr_close_subr+0xf50 osr_unlink+0x1fc str_plumb_ioctl+0x4a4 hpstreams_ioctl_int+0x398 hpstreams_ioctl+0x50 spec_ioctl+0xac vno_ioctl+0x90 ioctl+0x78 syscall+0x6f8 $syscallrtn+0x0 ( SR number: 8606257697 ; Defect: JAGae22000 ) System panics with the following stack trace: stack trace for event 0 crash event was a panic panic+0x14 too_much_time+0x2e0 wait_for_lock+0x14c slu_retry+0x1c mp_socket_lock+0x2c TPI_ok_ack+0x1a4 soaccept+0x5f4 sodequeue+0x30c accept+0x168 syscall+0x200 $syscallrtn+0x0 ( SR number: 8606259311 ; Defect: JAGae23629 ) POSIX recvmsg() returns incorrect "cmsg_len". PHNE_26771: This patch replaces PHNE_26445 ( SR number: 8606236775 ; Defect: JAGae05826 ) SIOCATMARK ioctl returns with the flag parameter set even after reading out-of-band data when the SO_OOBINLINE socket option is set. ( SR number: 8606237266 ; Defect: JAGae06311 ) Passing invalid arguments to connect() on an already connected datagram socket does not disconnect the socket, as documented in the connect() manpage. ( SR number: 8606238197 ; Defect: JAGae07224 ) rlogin and other applications that call recv() with the MSG_OOB flag lose data if the urgent byte has not arrived when the call to recv() is made. ( SR number: 8606250322 ; Defect: JAGae16697 ) AF_UNIX domain datagram type socket applications fail on recv() call. PHNE_26445: This patch replaces PHNE_25423 ( SR number: 8606213513 ; Defect: JAGad82705 ) Systems relying on random increments for choosing less predictable TCP ISN values, are still vulnerable to statistical attacks. ( SR number: 8606218753 ; Defect: JAGad87901 ) System runs out of memory when it is under heavy inbound TCP traffic. ( SR number: 8606223127 ; Defect: JAGad92230 ) Memory Leak in the 2k bucket when sanmgr hostagent is running. ( SR number: 8606224045 ; Defect: JAGad93141 ) System runs out of memory and seems to hang. ( SR number: 8606224560 ; Defect: JAGad93648 ) FTP hangs when transfering files from PC DOS to HP-UX. ( SR number: 8606225324 ; Defect: JAGad94412 ) "Communication stops" occur due to incorrect host route in the routing table. ( SR number: 8606228310 ; Defect: JAGad97367 ) read() done on a socket returned by accept() returns the EWOULDBLOCK error. ( SR number: 8606229279 ; Defect: JAGad98332 ) System panics with the following stack trace: tcp_icmp_error+0x38 tcp_rput_other+0x518 tcp_rput+0x58 csq_turnover_with_lock+0x84 str_spu_sw_isr+0x654 sw_service+0xb0 mp_ext_interrupt+0x150 ivti_patch_to_nop3+0x0 idle+0x104 ( SR number: 8606229650 ; Defect: JAGad98702 ) System panics with the following stack trace: igmp_timeout_handler+0x160 ip_rtimer+0x100 ip_rput+0x408 puthere+0x148 mi_timeout_exec+0x288 sw_service+0xb0 mp_ext_interrupt+0x150 ihandler+0x904 idle+0xe24 swidle+0x20 ( SR number: 8606230164 ; Defect: JAGad99215 ) performance degradation after installing PHNE_23456. ( SR number: 8606231247 ; Defect: JAGae00485 ) System panics with the following stack trace: panic+0x14 report_trap_or_int_and_panic+0x80 trap+0xdb8 nokgdb+0x8 tcp_get_ucred+0x1d4 tcp_wput_ioctl+0x160 tcp_wput+0x918 putnext+0xcc wait_iocack+0x68 str_istr_ioctl+0x72c hpstreams_ioctl_int+0x370 hpstreams_ioctl+0x50 spec_ioctl+0xac vno_ioctl+0x90 ioctl+0x78 syscall+0x6f8 $syscallrtn+0x0 ( SR number: 8606231526 ; Defect: JAGae00764 ) System panics with the following stacks: tcp_wput+0x58 csq_turnover_with_lock+0x84 str_spu_sw_isr+0x654 or tcp_wput+0x58 putnext+0xcc sth_wsrv+0x204 sq_wrapper+0x94 str_sched_up_daemon+0x1c4 str_sched_daemon+0x1a4 main+0x854 ( SR number: 8606231951 ; Defect: JAGae01187 ) System panics with the following stack trace: tcp_rsrv_comm+0x18 tcp_rput+0x3620 csq_turnover_with_lock+0x7c str_spu_sw_isr+0x5f8 sw_service+0x8c ( SR number: 8606232185 ; Defect: JAGae01421 ) System panics with the following stack trace: tcp_rsrv_comm+0x18 tcp_rsrv+0x10 sq_wrapper+0x90 str_sched_mp_daemon+0x130 str_sched_daemon+0x2dc main+0xa9c $vstart+0x34 $locore+0x90 ( SR number: 8606232612 ; Defect: JAGae01847 ) If the primary route for an interface is deleted, then a host on the same subnet is not reachable through the secondary route, though the secondary network route exists. ( SR number: 8606233090 ; Defect: JAGae02314 ) In some cases urgent data gets retransmitted unnecessarily impairing performance. ( SR number: 8606233164 ; Defect: JAGae02387 ) connect() call for the SOCK_STREAMS socket returns the ETIMEDOUT error. This occurs when another connection already bound to the same address (with 4-tuple being the same) has received RST from the remote side, and has not been closed by the application. PHNE_26412: ( SR number: 8606221602 ; Defect: JAGad90736 ) read() sometimes loses data and returns 0 on system with PHNE_23456. PHNE_25423: This patch replaces PHNE_25135 ( SR number: 8606146239 ; Defect: JAGad15575 ) Intermittent hangs exhibited in close() when using so_linger. ( SR number: 8606160572 ; Defect: JAGad29893 ) When both ts option and socket cache are used, tcp conection gets timed out. ( SR number: 8606189015 ; Defect: JAGad58231 ) UNIX domain socket programme uses a large amount of CPU. This can be observed in some cases of fast producer and a slow consumer type of client server programmes. ( SR number: 8606211448 ; Defect: JAGad80636 ) When IPSEC is active, nettl can turn on layer 4 tracing ( SR number: 8606217657 ; Defect: JAGad86809 ) ifconfig lan10000 fails, but ifconfig lan9999 succeeds. ( SR number: 8606219937 ; Defect: JAGad89079 ) On UP boxes when 2 (or more) aio_reads are pending on the same socket and ioctl(SIOCAIOABORT) is used, a close on that socket will result in an unkillable hung process. ( SR number: 8606220568 ; Defect: JAGad89705 ) Sometimes telnet session initiated by W2K to HP-UX 11.00 machine hangs. ( SR number: 8606220677 ; Defect: JAGad89814 ) Data retransmission sometimes takes a long time. ( SR number: 8606221602 ; Defect: JAGad90736 ) read() sometimes lose data and return 0 on system with PHNE_23456. ( SR number: 8606221777 ; Defect: JAGad90911 ) When setting ip_pmtu_strategy to 0 any non-local networks have a maximum MTU of 576. ( SR number: 8606222508 ; Defect: JAGad91621 ) When system memory use is very high the accept system call returns ENOBUFS. ( SR number: 8606223947 ; Defect: JAGad93042 ) When loopback address, 127.n.n.n (where n can 0 to 255) is pinged and ping succeeds, netstat -rn displays entries for each pinged address other than 127.0.0.1 PHNE_25381: System panics on sbflush panic 2: trace event 0 stack trace for event 0 crash event was a panic panic+0x14 sbflush+0x68 sbrelease+0x14 sorflush+0xa4 sofree+0x15c soclose+0x23c soo_close+0xc8 closef+0x64 close+0x90 syscall+0x6f8 $syscallrtn+0x0 PHNE_25135: This patch replaces PHNE_24715 ( SR number: 8606193755 ; Defect: JAGab72514 ) When using shutdown() and stack-caching the mss value could be set to one (1) byte. ( SR number: 8606137536 ; Defect: JAGad06654 ) Tcpdump trace showed that sendfile sends trailer buffers as a swparate "send". ( SR number: 8606203612 ; Defect: JAGad72784 ) Examination of code found a problem. ( SR number: 8606215148 ; Defect: JAGad84339 ) System panics on sbflush panic 2: trace event 0 stack trace for event 0 crash event was a panic panic+0x14 sbflush+0x68 sbrelease+0x14 sorflush+0xa4 sofree+0x15c soclose+0x23c soo_close+0xc8 closef+0x64 close+0x90 syscall+0x6f8 $syscallrtn+0x0 PHNE_24715: This patch replaces PHNE_24289 ( SR number: 8606193754 ; Defect: JAGad62965 ) Customer noted that performance of ftp over hyper-fabric was very slow when putting a file after installing PHNE_22397. ( SR number: 8606206542 ; Defect: JAGad75715 ) Some packets are dropped intermittently and not retransmitted for a long time. ( SR number: 8606206806 ; Defect: JAGad75979 ) Since PHNE_21767, all outbound datagrams have the "Don't Fragment" bit set for Path MTU Discovery. ( SR number: 8606139436 ; Defect: JAGad08735 ) system panic on X.25 socket. The panic stack is as follows: A possible deadlock situation stack trace for event 0 crash event was a panic panic+0x10 spin_deadlock_failure+0x38 deadlock_check+0x9c sl_pre_check+0x54 spinlock+0x14 mp_socket_lock+0x34 mp_socket_lock2+0x38 XLS_F_handler+0x6c4 XSO_F_handler+0x958 XLS_F0_a_connect_ind+0x188 XLS_F_handler+0x6a4 XST_F_read_put+0x398 putnext+0x1f4 CI_touser+0x268 Rx_CALL+0x384 L2_datind+0x4ac dlpi_rxll+0xb4 x25lrsrv+0x60 sq_wrapper+0xc8 str_sched_mp_daemon+0x33c str_sched_daemon+0x29c im_mpnetstr+0x28 DoCalllist+0x38 main+0x24 $vstart+0x34 $locore+0x90 ( SR number: 8606140093 ; Defect: JAGad09415 ) TCP connections where both ends close at the same time may experience an unnecessary delay of 1.5 seconds or more. This problem has an especially high probability of being seen on loopback connections where one end of the connection has the SO_LINGER option turned on. ( SR number: 8606167654 ; Defect: JAGad36937 ) Sometimes nettl is unable to capture reply packets. ( SR number: 8606198667 ; Defect: JAGad67856 ) Closing a socket with socket caching turned on and SO_LINGER set will cause a loop in the kernel. The connection will be left in an IDLE state. ( SR number: 8606202518 ; Defect: JAGad71692 ) Synptom: System panic on X.25 socket. Panic stack is : panic+0x14 report_trap_or_int_and_panic+0x80 trap+0xdb8 nokgdb+0x8 XIQ_F_handler+0xc0 XSO_F0_cleanup_pcb+0xa4 XSO_F_handler+0x12dc XPR_F_pr_usrreq+0x298 soclose+0x250 soo_close+0x90 closef+0x64 close+0x90 syscall+0x200 $syscallrtn+0x0 ( SR number: 8606202738 ; Defect: JAGad71912 ) PHNE_23456 shows duplicate uipc_socket.c what strings. ( SR number: 8606203039 ; Defect: JAGad72213 ) A UDP broadcast is sent once for each IP address configured on the interface. ( SR number: 8606203900 ; Defect: JAGad73078 ) TCP connection hangs in an ESTABLISHED state. ( SR number: 8606204354 ; Defect: JAGad73536 ) UDP datagrams are silently dropped. ( SR number: 8606204948 ; Defect: JAGad74124 ) System hang while ftping and concurrent file truncation. ( SR number: 8606205538 ; Defect: JAGad74714 ) System panics while executing accept call. The panic stack is as follows: panic+0x6c report_trap_or_int_and_panic+0x94 interrupt+0x208 ihandler+0x930 x_mi_timer+0xc tcp_accept+0x510 tcp_wput_proto+0x18c tcp_wput+0xa0 csq_turnover_with_lock+0x8c puthere+0x260 tcp_icmp_error+0x270 tcp_rput_other+0x600 tcp_rput+0x60 putnext+0xcc icmp_inbound_error+0xa74 icmp_inbound+0x38c ip_rput_local+0xd58 ip_rput+0x188 putnext+0xcc hp_dlpi_mblk_fast_in+0xa0 hp_dlpi_mblk_intr_put+0xb8 streams_put+0xdc streams_put_release+0x4c hp_dlpi_mblk_intr+0x5c lanc_ether_ics+0x11c btlan_receive_frame+0x5e4 btlan_isr+0xfc sapic_interrupt+0x2c mp_ext_interrupt+0x2ec ihandler+0x90c ( SR number: 8606206366 ; Defect: JAGad75539 ) System panics with the following stack trace: panic report_trap_or_int_and_panic trap nokgdb ipif_up ip_sioctl_copyin_done ip_wput_nondata ip_wput csq_turnover_with_lock putnext udp_wput_other udp_wput putnext wait_iocack str_trans_ioctl hpstreams_ioctl_int streams_ioctl ifioctl soo_ioctl ioctl syscall ( SR number: 8606207797 ; Defect: JAGad76974 ) Performance degradation in IPSEC. ( SR number: 8606209138 ; Defect: JAGad78325 ) With ATM on system and IP traffic, system panics with forllowing panic stack: panic+0x6c report_trap_or_int_and_panic+0x94 interrupt+0x208 ihandler+0x930 bcopy_pcxu_method+0x0 LDI_F_set_fastpath+0x100 LEC_F0_uwioctl+0x1d8 LEC_F0_uwput+0xac csq_turnover_with_lock+0x84 putnext+0x258 CAM_F0_sp_dataind+0x70 streams_put+0xe4 CAM_F_data_ind+0x404 alx_receive_it+0x13fc alx_isr+0x25c wsio_interrupt+0x54 mp_ext_interrupt+0x34c ivti_patch_to_nop3+0x0 sounlock+0x90 mp_socket_unlock+0x10 soo_select2+0x1c4 soo_select+0x14 select+0xac4 syscall+0x480 ( SR number: 8606209264 ; Defect: JAGad78451 ) When 2 (or more) aio_read are pending on the same socket and ioctl(SIOCAIOABORT) is used, a close on that socket will cause to process to hang and the process is not killable. PHNE_24289: This patch replaces PHNE_24075 ( SR number: 8606131836 ; Defect: JAGad00986 ) RAW socket behaviour for HP-UX 11.0 is inconsistent with HP-UX 10.20 and HP-UX 11.11. Non-root user is allowed to open a RAW socket. ( SR number: 8606162623 ; Defect: JAGad31939 ) Service Guard system TOC with the following trace: x_mi_mpprintf_putc+0x1c x_mi_iprintf+0x280 x_mi_mpprintf+0x64 tcp_status_report+0x188 x_nd_getset+0x148 tcp_wput_ioctl+0x9c tcp_wput+0x82c putnext+0xcc wait_iocack+0x68 s tr_istr_ioctl+0x738 hpstreams_ioctl_int+0x6a8 hpstreams_ioctl+0x50 spec_ioctl+0xac vno_ioctl+0x90 ioctl+0x7c syscall+0x480 $syscallrtn+0x0 ( SR number: 8606187409 ; Defect: JAGad56616 ) An AF_UNIX socket application hangs on MP system. ( SR number: 1653284372 ; Defect: JAGaa44209 ) STCP recv() with MSG_PEEK is different from BSD. ( SR number: 5003411751 ; Defect: JAGaa27047 ) A connection in FIN_WAIT_2 can stay forever. Note: This defect was fixed in PHNE_19899, but it was not documented in the patch. ( SR number: 8606198555 ; Defect: JAGad67744 ) Problems compiling recent versions of transport source code within ClearCase. These compilation failures are not visible to customers ( SR number: 8606198614 ; Defect: JAGad67803 ) System hangs and free memory is zero. System TOC with the following trace: putnext+0x188 ip_wput_ire+0x398 ip_wput+0x470 putnext+0xcc tcp_rput+0x1088 csq_turnover_with_lock+0x84 str_spu_sw_isr+0x200 sw_service+0xb0 mp_ext_interrupt+0x150 ivti_patch_to_nop3+0x0 ki_accum_push_TOS+0xa0 syscall+0x808 $syscallrtn+0x0 PHNE_24075: This patch replaces PHNE_23456 ( SR number: 8606197851 ; Defect: JAGad67042 ) T_ALLOPT option in XTI/TLI will fail with TBADOPT. Also the tcp initial congestion window is too large possibly causing performance problems at connect time. ( SR number: 8606154818 ; Defect: JAGad24135 ) The system with IPSEC installed can panic with the following trace: panic+0x14 report_trap_or_int_and_panic+0x80 trap+0xdb8 nokgdb+0x8 ip_flush_readers+0x1a8 ip_close+0x238 close_wrapper+0x38 csq_protect+0x120 osr_pop_subr+0x1fc osr_close_subr+0x324 hpstreams_close_int+0xd40 streams_close+0x14 soclose+0x670 soaccept+0x2d8 sodequeue+0x224 accept+0x23c syscall+0x480 $syscallrtn+0x0 ( SR number: 8606160792 ; Defect: JAGad30111 ) A server program listening for incoming connection requests with select() or accept() can receive notification of a connection's existence before it is fully established. ( SR number: 8606164046 ; Defect: JAGad33347 ) Some customers using the Raptor Firewall product found the daemon processes (tcp_gspd) spinning and eating CPU time (70-80% of a cpu on UP systems). ( SR number: 8606166814 ; Defect: JAGad36101 ) Remsh hangs. ( SR number: 8606176180 ; Defect: JAGad45420 ) UDP socket bound to local IP address cannot receive broadcast packet. ( SR number: 8606178029 ; Defect: JAGad47256 ) gettcpstate() is not available in 11.0. ( SR number: 8606178097 ; Defect: JAGad47324 ) The system has a Data Page Fault panic with either of the following two traces: Trace 1: panic+0x14 report_trap_or_int_and_panic+0x4c interrupt+0x1e8 $ihndlr_rtn+0x0 puthere+0x44 mi_timeout_exec+0x224 sw_service+0x8c mp_ext_interrupt+0x108 ivti_patch_to_nop3+0x0 idle+0x1e8 swidle_exit+0x0 Trace 2: panic+0x14 report_trap_or_int_and_panic+0x4c interrupt+0x1e8 $ihndlr_rtn+0x0 puthere+0x44 tcp_rput_context_check+0x4a4 tcp_rput+0x784 putnext+0x16c ip_rput_local+0x524 ip_rput+0x648 putnext+0x16c hp_dlpi_mbuf_fast_in+0x70 hp_dlpi_intr_put+0x154 streams_put+0x134 hp_dlpi_intr+0x84 lan2_process_packet+0xcc lan2_int_fr_rnr+0x19c lan2_isr+0x184 eisa_int+0x134 lasi_interrupt+0x5c mp_ext_interrupt+0x300 ivti_patch_to_nop3+0x0 idle+0x1b8 swidle_exit+0x0 ( SR number: 8606183744 ; Defect: JAGad52955 ) Individual host route on local interface does not work if the subnet route for the subnet containing that host is removed. ( SR number: 8606187509 ; Defect: JAGad56716 ) When a program uses the ICMP TIMESTAMP request message to query an HP-UX system for the current time, the reply generated provides less precise information than was available from a 10.20 system. ( SR number: 8606194889 ; Defect: JAGad64095 ) Partially-completed incoming connection requests can occupy excessive system memory. PHNE_23456: This patch replaces PHNE_22869 ( SR number: 8606147348 ; Defect: JAGad16691 ) Data is received with garbage bytes appended to it. The length of the received data will have a size which is a multiple of STRMSGSZ (where STRMSGSZ is the value of the kernel parameter STRMSGSZ on the system sending the data). For this to occur, the kernel parameter STRMSGSZ must have been changed to a value smaller than the default on the system which sends the data. ( SR number: 8606151945 ; Defect: JAGad21284 ) The system experiences extensive memory consumption when processing large numbers of routes. ( SR number: 8606155790 ; Defect: JAGad25103 ) X-terminals are not able to boot from a server operating in a Service Guard environment. ( SR number: 8606169570 ; Defect: JAGad38845 ) panic: Data memory protection fault gelan_if_resolved_output+0x106c hp_dlpi_mblk_CKO_fast_out+0x60 hp_dlpi_wput+0x64 putnext+0xcc ip_wput_ire+0x454 ip_wput+0x470 csq_turnover_with_lock+0x84 putnext+0x258 hp_dlpi_mblk_fast_in+0x98 hp_dlpi_mblk_intr_put+0xc8 streams_put_release+0x1cc hp_dlpi_mblk_intr+0x4c lanc_ether_ics+0x240 ( SR number: 8606170531 ; Defect: JAGad39795 ) Large numbers of connections on WWW servers fail to close completely. They are left stranded forever in the the CLOSE_WAIT state. ( SR number: 8606175299 ; Defect: JAGad44542 ) The system panics with a Data Page Fault. A possible stack looks like this: panic+0x14 report_trap_or_int_and_panic+0x84 trap+0xd9c nokgdb+0x8 ipc_hash_insert+0x84 ip_bind+0xc28 ip_wput_nondata+0x38 . . . ( SR number: 8606175531 ; Defect: JAGad44771 ) An IGMP_HOST_MEMBERSHIP_QUERY can cause a divide by zero panic. igmp_input+0x7e4 ip_rput_local+0xc00 ip_rput+0x238 putnext+0xcc hp_dlpi_unitdata_in+0x1108 hp_dlpi_mblk_intr_put+0x7bc streams_put_release+0x1cc hp_dlpi_mblk_intr+0x4c lanc_ether_ics+0x240 _btlan3_receive_pkts+0x3a0 _btlan3_isr+0x178 sapic_interrupt+0x2c mp_ext_interrupt+0x34c ivti_patch_to_nop3+0x0 idle+0x814 swidle_exit+0x0 ( SR number: 8606177050 ; Defect: JAGad46285 ) If inbound UDP packets are dropped because of socket receive buffer overflow, it is difficult to discern which UDP connection is getting overflowed and how many times it has happened. ( SR number: 8606178227 ; Defect: JAGad47454 ) Keepalive probes exceed the desired length of time set by the ndd tunable tcp_keepalive_interval. ( SR number: 8606181319 ; Defect: JAGad50536 ) An ENOTCONN is intermittently returned when a read is done on a non-blocking socket. ( SR number: 8606184465 ; Defect: JAGad53672 ) Event_port not supported by sockets. ( SR number: 8606184470 ; Defect: JAGad53677 ) System panics whenever a "poll" is done via "event_port" on an AF_UNIX socket that was created by socketpair(). Here is the panic; soo_select2+0x8 soo_select+0x14 unp_poll_handler+0x40 so_poll_switch+0x74 evp_dp_poll+0x20c evp_ioctl+0x104 spec_ioctl+0xac vno_ioctl+0x90 ioctl+0x1f4 syscall+0x480 $syscallrtn+0x0 ( SR number: 8606185191 ; Defect: JAGad54393 ) System panic's with the following stack; unp_eventreg+0x4 so_eventreg+0x6c evp_dereg_objhdr+0xa0 evp_close+0x15c call_open_close+0x1f8 closed+0xb0 spec_close+0x54 vn_close+0x48 vno_close+0x20 closef+0x64 exit+0x324 rexit+0x28 syscall+0x200 $syscallrtn+0x0 PHNE_22869: ( SR number: 4701419036 ; Defect: JAGaa93907 ) If one urgent byte is on a socket, and a recv() is done without MSG_OOB on that socket, the urgent byte will disappear. Subsequent recvmsg() calls with the MSG_OOB flag on will return EINVAL, instead of returning the urgent byte. ( SR number: 8606160311 ; Defect: JAGad29635 ) Bringing up an interface with ifconfig may fail occasionally. This is also visible in errors from the ServiceGuard daemon "cmcld" if a network cable is rapidly and repeatedly unplugged and plugged back in. ( SR number: 8606162823 ; Defect: JAGad32139 ) The sytem panics with a stack overflow. panic+0x14 report_trap_or_int_and_panic+0x94 trap+0x9f4 nokgdb+0x8 lanc_media_control+0x10e0 hp_dlpi_ioctl+0x658 hp_dlpi_control+0x184 hp_dlpi_wput+0xb24 putnext+0xcc ip_wput_ctl+0x13c ip_wput_nondata+0x41c ip_wput+0xa0 puthere+0x148 ar_entry_squery+0x140 ar_cmd_dispatch+0xb0 ar_rput+0x58 puthere+0x148 ip_newroute_ipif+0x348 ip_wput_multicast+0x218 igmp_sendpkt_defrd+0x44 ip_newroute_ipif+0x378 ip_wput_multicast+0x218 igmp_sendpkt_defrd+0x44 ip_newroute_ipif+0x378 ip_wput_multicast+0x218 igmp_sendpkt_defrd+0x44 . . . ip_newroute_ipif+0x378 ip_wput_multicast+0x218 igmp_sendpkt_defrd+0x44 ip_close+0x5a0 close_wrapper+0x38 csq_protect+0x120 osr_pop_subr+0x22c osr_close_subr+0x2f8 hpstreams_close_int+0x2f8 streams_close+0x14 soclose+0x214 soo_close+0x90 closef+0x178 exit+0x944 rexit+0x24 syscall+0x610 $syscallrtn+0x0 ( SR number: 8606165984 ; Defect: JAGad35271 ) Panic during FIN processing on a system experiencing memory pressure. 0x000e4450 (set_protid_registers+0x1bfc) 0x004e6ff4 (tcp_hash_insert_port+0x2c) 0x004ee800 (tcp_reinit+0x4d0) 0x004e31c8 (tcp_clean_death+0x280) 0x004f00e0 (tcp_rput+0x1838) 0x0057ea68 (csq_turnover_with_lock+0xb0) 0x0056ede0 (putnext+0x2b0) 0x0059f75c (streams_write_uio+0x204) 0x003832b0 (sosend+0x1230) 0x003783a4 (sendit+0x41c) 0x00377eac (send+0x74) 0x0031b304 (syscall+0x754) ( SR number: 8606170482 ; Defect: JAGad39746 ) Data transfer accross TCP connections which involve PMTU is extremely slow. ( SR number: 8606167240 ; Defect: JAGad36526 ) Symptom: System panic's with; 4) putnext+0x18 5) ip_wput_local+0x528 6) ip_wput_ire+0x43c 7) ip_wput+0x458 8) csq_turnover_with_lock+0x88 9) osr_pop_subr+0x98c 10) osr_close_subr+0xb00 11) hpstreams_close_int+0xd40 12) hpstreams_close+0x2c 13) call_open_close+0x1f8 14) closed+0xb0 15) spec_close+0x54 16) vn_close+0x48 17) vno_close+0x20 18) closef+0x68 19) close+0x48 20) syscall+0x200 When using XTI programs over loopback. PHNE_22527: ( SR number: 8606152595 ; Defect: JAGad21925 ) The following type of message fills up too much space in the syslog file. vmunix: tunioctl(0): Unknown ioctl ( SR number: 8606157385 ; Defect: JAGad26717 ) Data Page Fault Panic when memory allocation has had to be delayed. trap+0x10f0 nokgdb+0x8 qenable+0x10 mi_ibc_qenable+0x6c csq_protect+0x1c0 bufcall_rsrv+0xf4 str_mem_daemon+0x214 im_strmem+0x1c DoCalllist+0xc0 ( SR number: 8606158668 ; Defect: JAGad27998 ) A shutdown() called on a LISTEN socket returns EINVAL. ( SR number: 8606159910 ; Defect: JAGad29236 ) Connections getting ETIMEDOUT errors after a connection is established. ( SR number: 8606161281 ; Defect: JAGad30597 ) The following message repeatedly appears in the system logfile. "T_ERROR_ACK, ERROR_prim==1" ( SR number: 8606164864 ; Defect: JAGad34161 ) A MSG_OOB recv() on a socket which has been set to non-blocking and for which there is no OOB data blocks rather than returning an error. ( SR number: 8606165518 ; Defect: JAGad34812 ) Need to pre-enable the select performance code. ( SR number: 8606165729 ; Defect: JAGad35020 ) Customer is seeing RESET's during connects if the requested MSS is smaller than the tcp_mss_min set on the system. ( SR number: 8606159784 ; Defect: JAGad29110 ) getsockname() hangs for a SOCK_RAW socket. PHNE_22397: ( SR number: 8606158528 ; Defect: JAGad27858 ) Customer's cannot load latest patch (PHNE_22067) unresolved external streams_select3() ( SR number: 8606140338 ; Defect: JAGad09705 ) Applications that quickly reconnect to the same remote port (e.g. remsh) can experience 2-second delays in connection establishment. ( SR number: 8606160948 ; Defect: JAGad30266 ) TCP connections exhibit poor performance over cellular-style wireless links. PHNE_22318: ( SR number: 8606158410 ; Defect: JAGad27740 ) System or processor appears to be hung. Symptoms are not observed in patches PHNE_21767 or earlier. ( SR number: 8606147084 ; Defect: JAGad16427 ) A client will continue to use a stale route for a virtual IP address when that address has been reassigned to a different server. ( SR number: 8606147559 ; Defect: JAGad16901 ) The ACKs from the receiver machine are off by many windows. Unfortunately, the sender machine doesn't seem to notice, and it continues to increase the number of segments in the window with each send -- Until the ACKs *finally* fall outside the window gap. Then the sender drops back to begin slow-start all over again. ( SR number: 8606154650 ; Defect: JAGad23967 ) Some clients can cause TCP connections to be set up which will cause excessive memory consumption by data buffers. ( SR number: 8606156407 ; Defect: JAGad25744 ) An application listening on a server TCP socket can hang if many clients are initiating connections and then aborting them (resetting them) before the server can complete the connection accept operation. ( SR number: 8606157574 ; Defect: JAGad26905 ) Anomalous error returns may happen while executing the accept system call. PHNE_22067: ( SR number: 8606134419 ; Defect: JAGad03554 ) System panics with a data page fault. Two different stack traces are possible. Trace 1: crfree+0x3c closef+0x80 close+0x48 syscall+0x480 Trace 2: soo_select+0x10 pollscan+0xb0 poll+0x104 syscall+0x480 ( SR number: 8606134761 ; Defect: JAGad03896 ) When the SO_RCVBUF socket option is set with setsockopt() to a large value which exceeds the maximum allowed, no error is returned and the actual value set (which can be obtained with a subsequent getsockopt() call) is 65535 instead of the maximum allowed. ( SR number: 8606137889 ; Defect: JAGad07049 ) HP-UX does not respond to unicast arp replies. ( SR number: 8606141085 ; Defect: JAGad10446 ) When an application sets up to do asyncronous I/O (signals) on a socket and calls connect(2), if it catches a signal during the connect(2) call, connect(2) returns EINTR. This is a correct return. However, if the program calls connect(2) again, connect(2) returns EINVAL. In this case, this is an incorrect return. ( SR number: 8606144006 ; Defect: JAGad13339 ) Non-privileged users cannot open a UDP socket with an ephemeral port. ( SR number: 8606145162 ; Defect: JAGad14500 ) Application server hangs in recv. ( SR number: 8606146766 ; Defect: JAGad16109 ) The public domain ipfilter product cannot be installed on 11.x due to undefined symbols (if_lookup_on_name and ir_lookup). PHNE_21890: ( SR number: 8606126852 ; Defect: JAGac59693 ) Select based applications slow down when moving from 10.20 to 11.00. ( SR number: 8606134574 ; Defect: JAGad03709 ) Inbound packet traffic is seen mostly on one processor. Need enhancement to make inbound packet schedualing better. better. PHNE_21767: ( SR number: 1653286641 ; Defect: JAGaa44778 ) recvmsg() returns EMSGSIZE, when the message size is correct. PHNE_21606: ( SR number: 8606132568 ; Defect: JAGad01717 ) The connection will hang when an out of order FIN arrives and is never retransmitted. ( SR number: 8606134441 ; Defect: JAGad03576 ) Under special network load conditions in which a machine is frequently making ARP requests which do not succeed, a memory leak occurs which can eventually use up all system memory and cause a system to panic. Symptoms are not observed in patches prior to PHNE_20436, and certain details depend upon which patch is in place. In patches starting with PHNE_20436 but prior to PHNE_21038, the memory leak is in the 32-byte bucket. Starting with PHNE_21038, the leak is in the 64-byte bucket. PHNE_21318: ( SR number: 8606127632 ; Defect: JAGac78434 ) select() can hang when called following a connect() call that returned EINPROGRESS. ( SR number: 8606129427 ; Defect: JAGac86974 ) Double system panics occurred duing an X.25 test. stack trace for event 0 crash event was a panic panic+0x14 too_much_time+0x2d8 wait_for_lock+0x120 slu_retry+0x18 mp_socket_lock+0x2c XLS_F0_a_connect_ind+0x4c XLS_F_handler+0x6a4 XST_F_read_put+0x398 putnext+0x16c N2Z_F0_rserv+0x2b0 sq_wrapper+0x90 str_sched_mp_daemon+0x104 str_sched_daemon+0x2b8 main+0x538 $vstart+0x34 $locore+0x90 trace event 1 stack trace for event 1 crash event was a panic panic+0x14 wait_for_lock+0x2b4 slu_retry+0x18 mp_socket_lock+0x2c soaccept+0x28 sodequeue+0x19c accept+0x154 syscall+0x1c8 $syscallrtn+0x0 Defect Decription: A spinlock was not released correctly, it cause a spinlock deadlock. ( SR number: 8606130980 ; Defect: JAGad00139 ) "Lock not held" Panic stack: panic+0x14 sodequeue+0x530 accept+0x1b8 syscall+0x1c8 $syscallrtn+0x0 ( SR number: 8606131229 ; Defect: JAGad00380 ) The HP-UX system does not respond to keepalive requests. ( SR number: 8606125525 ; Defect: JAGac40915 ) A system can hang when applications take away system resources by successfully allocating extremely large buffers. PHNE_21038: ( SR number: 5003453233 ; Defect: JAGaa95389 ) System panics when the opening of /dev/nuls races with the closing of /dev/nuls. This device is used by netstat. mi_close_comm1+0x44 x_mi_close_comm+0x14 nuls_close+0x14 close_wrapper+0x38 csq_protect+0xd0 osr_pop_subr+0x1b8 osr_close_subr+0x2b8 hpstreams_close_int+0x2a0 hpstreams_close+0x24 call_open_close+0x1bc closed+0xa0 ( SR not found ; Defect: JAGab67537 ) System panic when ifconfig is running on a X.25 interface. ( SR number: 8606112028 ; Defect: JAGab84237 ) Panic during system startup ONLY on DEBUG KERNELS. Panic message and top of stack backtrace (output by kernel during panic) look like this: panic: assertion failed (alloc_spinlock: spinlocks held) at line 1844 in /ux/core/kern/sys/spinlock.c PC-Offset Stack Trace (read down, top of stack is 1st): 0x001cb4fc (panic+0x54) 0x001cbf5c (assfail+0x3c) 0x001cc118 (_assfail+0x30) 0x001d4f74 (alloc_spinlock+0x11c) 0x00539364 (ire_create+0xec) 0x00547400 (ipif_up_arp_and_ires+0x430) 0x00546d28 (ipif_up+0x308) 0x00545d08 (ipif_loopback_init+0x110) 0x00519394 (ip_open+0x364) ( SR number: 8606114887 ; Defect: JAGac29660 ) IP addresses assigned to loopback interfaces (lo0:) can not be reached from the network. ( SR number: 8606124808 ; Defect: JAGac40200 ) T_ORDREL_REQ out of state error messages appear in nettl.LOG file. ( SR number: 8606125177 ; Defect: JAGac40568 ) The command 'netstat -a' sometimes causes a panic with the following stack trace. udp_snmp_get+0x218 snmpcom_req+0x130 udp_wput_other+0x218 udp_wput+0x1c0 putnext+0x198 putmsg_subr+0x174 putmsg+0x190 syscall+0x200 $syscallrtn+0x0 ( SR number: 8606125342 ; Defect: JAGac40733 ) System panics with the following stack trace. ip_rput_local+0x21c ip_rput+0x894 putnext+0x1a4 hp_dlpi_unitdata_in+0x5a0 hp_dlpi_mblk_intr_put+0x2d8 streams_put_release+0x2c8 hp_dlpi_mblk_intr+0x80 --- --- ( SR number: 8606126203 ; Defect: JAGac56768 ) A RST is sent when a SYN is received. Defect Discription: If TCP initial sequence numbers are messed up, a RST packet is sent in response to a SYN received during TCP TIME_WAIT state. PHNE_20735: ( SR number: 8606110756 ; Defect: JAGab83504 ) Accept() threads don't exist when their process is killed. ( SR number: 8606123969 ; Defect: JAGac39329 ) System panics when closing AF_UNIX sockets with the following stack; b_owns_sema+0x8 unp_discard+0x60 unp_scan+0x88 unp_dispose+0x1c sorflush+0x90 sofree+0x8c soclose+0x7d0 soo_close+0x7c closef+0x64 exit+0x2f0 psig+0x220 syscall+0x914 $syscallrtn+0x0 PHNE_20633: ( SR number: 8606107486 ; Defect: JAGab77719 ) A temporary file /tmp/stcp.conf is left around unnecessarily. ( SR number: 4701413963 ; Defect: INDaa30107 ) Ifconfig may initialize network interfaces incorrectly during system startup. ( SR number: 4701430850 ; Defect: JAGab50646 ) When using a sendfile related application, the system can panic. Stack trace with vmtrace on crash event was a panic panic+0x14 vmtrace_kfree+0x230 kfree_common+0x2d0 getnewbuf+0x828 ogetblk+0x110 getblk1+0x290 realloccg+0x2f8 bmap+0x710 rwip+0xecc ufs_rdwr+0x388 vno_rw+0x84 write+0x108 syscall+0x200 $syscallrtn+0x0 ( SR number: 8606110207 ; Defect: JAGab82910 ) SNMP returns wrong tcpCurrEstab mib value ( SR number: 8606110239 ; Defect: JAGab82942 ) If a server receives a RESET on a socket and does not close it, all new connections for the SAME remote port will be dropped. ( SR number: 8606110349 ; Defect: JAGab83053 ) System panic - Data page fault panic+0x14 report_trap_or_int_and_panic+0x80 trap+0xdb8 nokgdb+0x8 TPI_conn_conf+0x14 so_check_inb_conn_conf+0xc8 soo_select+0x328 select+0x12c4 syscall+0x480 $syscallrtn+0x0 ( SR number: 8606112290 ; Defect: JAGab84607 ) SYNs sent to an XTI listen socket are sometimes dropped. PHNE_20436: ( SR not found ; Defect: JAGaa95395 ) SO_LINGER does not work. ( SR number: 1653309039 ; Defect: JAGab25258 ) Programs or subsystems (such as NFS) using large packet sizes could see data corruption when used on multiprocessor systems with multiple clients sending data to the same server. ( SR not found ; Defect: JAGab32011 ) Data page fault: stack trace for event 0 crash event was a panic panic+0x14 report_trap_or_int_and_panic+0x80 trap+0xe08 nokgdb+0x8 ip_rput_dlpi+0x1c4 ip_rput+0x6ec putnext+0x80 LDI_F0_send_error_ack+0x78 LDI_F_error_ack+0x8c LDI_F0_error_action+0x50 LDI_F_handler+0x2c8 LEC_F0_uwproto+0x158 LEC_F0_uwput+0x94 puthere+0x84 ip_wput_nondata+0x26c ip_wput+0x16c ... ( SR number: 8606104338 ; Defect: JAGab71774 ) T_ORDREL_REQ out of state error messages appear in nettl.LOG file. ( SR number: 8606106267 ; Defect: JAGab75241 ) For a connection between 10.20 and 11.00, when the 10.20 advertises 0 window for some period of time, 11.00 can get hung. ( SR number: 8606106481 ; Defect: JAGab75639 ) Panic in kmalloc() called via sockname(). panic+0x14 trap+0xdb8 nokgdb+0x8 kmalloc+0x350 allocb_wait+0x290 sockname+0x54 ( SR number: 8606113535 ; Defect: JAGab75825 ) When the receive side of a socketpair (AF_UNIX) is "full" the system leaks memory and loses data. ( SR number: 8606113563 ; Defect: JAGab76769 ) When the receive side of a socketpair (AF_UNIX) contains file descriptors and the socket is closed without reading the data the system loses those descriptors. ( SR number: 8606113564 ; Defect: JAGab76776 ) Blocking sendmsg() returns EMSGSIZE when receive side is close to being full. This can happen on blocking or non-blocking. ( SR number: 8606107144 ; Defect: JAGab76839 ) A debug kernel panics when sleeping while holding a lock. ( SR number: 8606107729 ; Defect: JAGab78013 ) Cose version of recvmsg does not get the file. ( SR number: 8606107946 ; Defect: JAGab78256 ) q4> trace event 0 stack trace for event 0 crash event was a panic panic+0x14 report_trap_or_int_and_panic+0x80 trap+0xdb8 nokgdb+0x8 tcp_detach+0x5b0 tcp_close+0xec close_wrapper+0x38 csq_protect+0x120 osr_pop_subr+0x1f4 osr_close_subr+0xb00 hpstreams_close_int+0xc3c streams_close+0x14 soclose+0xe8 soo_close+0x90 closef+0x68 close+0x48 syscall+0x8f0 $syscallrtn+0x0 ( SR number: 8606108899 ; Defect: JAGab81600 ) By using a special scanner, TCP Initial sequence number exposes a small possibility of predictability. ( SR number: 8606109254 ; Defect: JAGab81953 ) memory corruption. ( SR number: 8606109950 ; Defect: JAGab82651 ) OOB data was not removed from data queue PHNE_20041: ( SR number: 8606105057 ; Defect: JAGab72884 ) Ping still sends packets when a lan cable is disconnected. ( SR number: 8606105583 ; Defect: JAGab73749 ) When the receive side of a socketpair (AF_UNIX) is "full" the system leaks file descriptors and loses data. ( SR number: 8606106074 ; Defect: JAGab74913 ) A non-blocking accept() call blocks in the kernel. PHNE_19899: ( SR number: 8606104784 ; Defect: JAGab65709 ) System panic in streams write queue. sth_putq_owned+0x124 sth_rput_slow+0x620 sth_rput+0x870 putnext+0x50 tcp_rput_other+0x4ac tcp_rput+0x1734 putnext+0x15c ip_rput_local+0x328 ip_rput+0x648 putnext+0x50 hp_dlpi_mblk_fast_in+0x50 hp_dlpi_mblk_intr_put+0x6d0 streams_put_release+0x154 hp_dlpi_mblk_intr+0x3clanc_ether_ics+0xf8 btlan4_process_packet+0xac btlan4_receive_pkts+0x944 btlan4_isr+0x110 dino_isr+0x128 mp_ext_interrupt+0x33c ivti_patch_to_nop3+0x0 lanc_ether_ics+0xf8 btlan4_process_packet+0xac ( SR number: 5003448498 ; Defect: JAGaa46666 ) getsockname() doesn't return address family if socket is not bound. ( SR number: 8606102973 ; Defect: JAGab69105 ) The system hangs due to a timing issue. ( SR not found ; Defect: JAGab69620 ) System panics when dereferencing a null pointer. ( SR not found ; Defect: JAGab71212 ) When a heavily-loaded multiprocessor system is running a program with multiple threads or processes accessing the same non-blocking socket, and doing both 'connect' and 'select' operations simultaneously, the kernel can panic. (Seen with Netscape proxy server as application.) ( SR number: 8606104549 ; Defect: JAGab72160 ) System TOCs due to three simultaneous MIB extractions. PHNE_19375: ( SR not found ; Defect: JAGaa57204 ) Transfer of data over loopback connections is slow. First data packet takes about one second to transfer. ( SR not found ; Defect: JAGab12875 ) System panics in network interface drivers. ( SR number: 1653309237 ; Defect: JAGab25385 ) Sometimes Service Guard switch does not work. ( SR number: 4701431221 ; Defect: JAGab53651 ) ifconfig unplumb can leave behind stale routes. If IP attempts to use these stale routes, the system will panic. ( SR not found ; Defect: JAGab65705 ) IP multicast local switch does not work properly. PHNE_19110: See Defect Description PHNE_18708: See Defect Description PHNE_18611: See Defect Description PHNE_18554: See Defect Description PHNE_18553: See Defect Description PHNE_17662: See Defect Description PHNE_17613: See Defect Description PHNE_17446: See Defect Description PHNE_17227: See Defect Description PHNE_17117: See Defect Description PHNE_17018: See Defect Description PHNE_17017: See Defect Description PHNE_16645: See Defect Description PHNE_16497: See Defect Description PHNE_16283: See Defect Description PHNE_15995: See Defect Description PHNE_15911: See Defect Description PHNE_15692: See Defect Description PHNE_15583: See Defect Description PHNE_15047: See Defect Description PHNE_14876: See Defect Description PHNE_14730: See Defect Description PHNE_14702: See Defect Description PHNE_14575: See Defect Description PHNE_14279: See Defect Description PHNE_14274: See Defect Description PHNE_14260: See Defect Description PHNE_14017: See Defect Description PHNE_13692: See Defect Description PHNE_13405: See Defect Description Defect Description: PHNE_29473: ( SR: 8606285107 CR: JAGae49049 ) Symptom: Disrupted IGMP membership reporting. Defect Description: Disruption in IGMP membership reporting. Resolution: IGMP membership reporting has been improved. ( SR: 8606328253 CR: JAGae89895 ) Symptom: read() returns ECONNRESET instead of ECONNREFUSED. Defect Description: Upon receiving an RST from the peer when establishing connection, a read(2) performed on the socket returns ECONNRESET instead of ECONNREFUSED. Resolution: After a non-blocking connect(2) is performed, read(2) now returns ECONNREFUSED if the peer refuses the connection. ( SR: 8606297439 CR: JAGae60941 ) Symptom: System panics with the following stack trace: optcom_req+0xb8 tcp_wput_proto+0xa4 tcp_wput+0x458 Defect Description: The system may panic due to improperly aligned data in optcom_req(). Resolution: Code has been modified to check for proper boundary conditions and alignment. ( SR: 8606304572 CR: JAGae67915 ) System panics with the following stack trace: ip_bind+0x334 ip_wput_nondata+0x38 ip_wput+0x108 putnext+0xcc tcp_connect+0x204 tcp_wput_proto+0xc4 tcp_wput+0x574 putnext+0xcc str_async_ioctl+0x210 hpstreams_ioctl_int+0x548 streams_ioctl+0x34 soconnect+0x140 connect+0xdc syscall+0x6f8 syscallinit+0x54c Defect Description: While switching from one interface to another using the SIOCSIFADDR ioctl, a LOOPBACK IRE is created which is never removed when the `from' interface is unplumbed. Any subsequent operation which accesses this IRE will now cause a DPF and crash the system. Resolution: Code has been modified to ensure that a LOOPBACK IRE is not unnecessarily created. ( SR: 8606306857 CR: JAGae69891 ) Symptom: System panics with the following stack trace: freeb+0x18 ire_delete_now+0x6c ip_dfg_flush+0x158 invoke_callouts_for_self+0xc0 sw_service+0xb0 up_ext_interrupt+0x118 ihandler+0x8c4 Defect Description: While deleting an IRE by linking it to deferred list, no check is made to see if the IRE already exists in deferred list. In the absence of such a check, the same IRE may get added to the list more than once. Resolution: Code has been added to check if an IRE already exists in the deferred list. If it is present the same IRE is not linked to the deferred list again. By doing this, double free data page fault type panic is avoided. ( SR: 8606312501 CR: JAGae75317 ) Symptom: Data page fault in tcp_detach() with the following stack trace: panic+0x14 report_trap_or_int_and_panic+0x84 trap+0xd9c nokgdb+0x8 tcp_detach+0x5d8 tcp_close+0xf0 close_wrapper+0x38 csq_protect+0x120 osr_pop_subr+0x214 osr_close_subr+0xf50 hpstreams_close_int+0x31c streams_close+0x14 soclose+0xf0 soo_close+0x90 closef+0x64 close+0x90 syscall+0x28c $syscallrtn+0x0 Defect Description: When a TCP connection is getting closed, it is possible for a timer associated with that TCP instance to expire and free the instance data corresponding to that TCP connection. When the freed data is accessed, a data page fault results as the data is stale. Resolution: Code has been modified to ensure that timers for a TCP instance do not expire at the same time when its data structures are being accessed in the close path. ( SR: 8606318794 CR: JAGae81284 ) Symptom: Panic while closing the socket, with the following stack trace: panic+0x14 too_much_time+0x2e0 wait_for_lock+0x14c slu_retry+0x1c hpstreams_ioctl_int+0x6a4 streams_ioctl+0x34 sotocache+0x164 sounlock+0x704 mp_socket_unlock+0x10 soclose+0x964 soo_close+0x90 closef+0x64 close+0x90 syscall+0x28c $syscallrtn+0x0 Defect Description: A race between two threads, one inserting a stream into socket cache and another removing a cached entry from the socket cache causes panic. Resolution: Code has been modified to avoid the race between threads while inserting and removing a stream from the socket cache. ( SR: 8606331109 CR: JAGae92230 ) Symptom: Unexpected memory consumption of M_DATA mblks in 512 bytes bucket resulting in memory starvation. Defect Description: Mblks of type M_DATA in 512 bytes bucket are not freed before closing the socket. Resolution: Code has been modified to free the queued M_DATA mblks when the socket is being closed. ( SR: 8606248122 CR: JAGae14522 ) Symptom: The "ifconfig lanx:y" command which is supposed to display the current configuration of lanx:y, will display a dummy entry for lanx:y if that interface does not exist. Defect Description: If the interface does not exist, the ifconfig interface command creates a NULL entry and displays the same. Resolution: "ifconfig" command checks for the existence of the interface configuration entry when asked to display current configuration parameters. If the entry does not exist, an error message is displayed. ( SR: 8606317300 CR: JAGae79861 ) Symptom: Memory leak in 512 bytes bucket. Defect Description: Memory allocated by ip module is not freed even after the socket is closed. Resolution: Memory is being freed when the socket is closed. ( SR: 8606298990 CR: JAGae62486 ) Symptom: IREs of type IRE_LOOPBACK remain in the system even after a RST is sent to the peer TCP. Defect Description: The function that deletes the IREs after a RST is sent to the peer TCP deletes only IREs of type IRE_ROUTE and not IRE_LOOPBACK. Resolution: The code has been modified to delete IRE_LOOPBACK IREs as well when they are no longer needed. ( SR: 8606322708 CR: JAGae85175 ) Symptom: Route entries associated with loopback interfaces intermittently get deleted. Defect Description: When a TCP connection request on a loopback address times out, TCP notifies IP to remove the corresponding route table entry associated with the loopback interface (IRE_LOOPBACK). Resolution: The route table entry corresponding to the loopback interface (IRE_LOOPBACK) is not removed when the Upper Layer Protocol notifies IP that a TCP connection timed out. PHNE_28538: ( SR number: 8606224462 ; Defect: JAGad93550 ) Symptom: Message getting displayed on console: tcp_timer: strange state (-6) [5767,d425] TCP_CLOSED Defect Description: The tcp state was set to TCP_CLOSED without stopping the timer. Resolution: When changing the tcp state to TCP_CLOSED in the case of a connection waiting to be accepted, the timers on the connection are now cleaned up. ( SR number: 8606257154 ; Defect: JAGae21460 ) Symptom: connect(2) over AF_INET socket hangs. System TOC with the following stack trace: _swtch+0xc4 _sleep+0x318 read_sleep+0x17c streams_getmsg+0x3c8 soconnect+0x188 connect+0xdc syscall+0x62c syscallinit+0x554 Defect Description: select(2) may cause connect(2) to hang if a small window of a race condition is met. Resolution: The window of race condition has been removed. ( SR number: 8606274495 ; Defect: JAGae38572 ) Symptom: When the timestamp value passed in the timestamp option in the TCP packet rolls over after the connection is established, TCP connection drops packets and applications may hang or time out. Defect Description: When the timestamp option is used for a tcp connection between two nodes and a roll over of time takes place from 0xffffffff to 0, the remote side which may receive a packet whose time has rolled over, will drop the packet, thinking it is old. This makes the local node to continuously retransmit the packets. Resolution: Code has been modified to handle roll over time placed in the timestamp option of the TCP packet. ( SR number: 8606283209 ; Defect: JAGae47164 ) Symptom: Bucket allocation usage is too high when there is a TCP traffic burst. Defect Description: TCP Default Queue is using too much kernel memory. Resolution: Default Queue memory management code has been modified to attenuate the TCP kernel memory consumption. ( SR number: 8606283966 ; Defect: JAGae47912 ) Symptom: System panics with the following stack trace: stack trace for event 0 crash event was a panic panic+0x14 sbflush+0x130 sbrelease+0x14 sorflush+0x98 sofree+0x98 soclose+0x1b4 soo_close+0x90 closef+0x64 close+0x90 syscall+0x6f8 $syscallrtn+0x0 Defect Description: When using AF_CCITT sockets, the system panics in sbflush if there is a zero-length data message block in the socket's receive buffer. Resolution: The socket's receive buffer can now handle zero-length data message blocks. ( SR number: 8606286419 ; Defect: JAGae50362 ) Symptom: send(2) may take a long time to complete for AF_UNIX/SOCK_STREAM type of sockets. Defect Description: Frequent allocation and deallocation of memory may result in longer completion time for send(2). Resolution: Code has been changed to reduce the number of memory allocations and deallocations to improve performance. ( SR number: 8606292583 ; Defect: JAGae56336 ) Symptom: When an ICMP Address Mask Request packet is sent to a unicast address, an ICMP Address Mask Reply is sent even though the tunable ip_respond_to_address_mask_broadcast is turned OFF. Defect Description: Unsetting the ndd tunable ip_respond_to_address_mask_broadcast will suppress the replies to the requests sent to the broadcast address only. Resolution: Code has been modified to completely suppress any reply to the address mask request when the ip_respond_to_address_mask_broadcast tunable is turned OFF. ( SR number: 8606294788 ; Defect: JAGae58482 ) Symptom: The number of collisions between threads executing select(2) is exceedingly high in some cases. Defect Description: The number of collisions between threads executing select(2) is more. As a result, select may take more time in some cases. Resolution: The number of collisions in such cases has been reduced. ( SR number: 8606294967 ; Defect: JAGae58664 ) Symptom: select(2) may take more time for AF_UNIX domain sockets in some cases. Defect Description: The additional check was basically designed for AF_INET sockets. It was being done also for UNIX domain sockets. Due to this, select(2) may take more time for AF_UNIX sockets for some cases. Resolution: Now, the additional check is not performed for AF_UNIX sockets. ( SR number: 8606294977 ; Defect: JAGae58674 ) Symptom: read(2) on a socket may return ECONNREFUSED instead of ECONNRESET. Defect Description: In some cases, TCP sends a ECONNREFUSED and read(2) returns it to the application. Resolution: read(2) now returns ECONNRESET whenever it receives a ECONNREFUSED from TCP. ( SR number: 8606295188 ; Defect: JAGae58883 ) Symptom: System panics with the following stack trace: panic+0x14 report_trap_or_int_and_panic+0x4c interrupt+0x1e8 $ihndlr_rtn+0x0 ipc_walk+0x7c ill_down_ind+0x118 ip_rput_dlpi+0x9b0 ip_rput+0x394 putnext+0xc4 hp_dlpi_event+0x1b0 HP1_ospif_mib_event+0x150 ospif_watchdog+0x3c HP1_oim_timeout+0x10 invoke_callouts_for_self+0xac sw_service+0x8c inttr_emulate_save_fpu+0x100 drv_priv+0x0 ip_open+0x11c open_wrapper+0x44 csq_protect+0x10c osr_open+0xaec pse_open+0xe4 streams_open+0x48 soclone+0x178 soaccept+0xf4 sodequeue+0xac accept+0x204 syscall+0x6e8 $syscallrtn+0x0 Defect Description: An IP instance data structure was inserted into the hash array before it was initialized. As a result if a thread tries to access any of its fields when walking through the hash array, it may panic. Resolution: Necessary checks have been added before accessing the IP instance data structures to avoid the panic. PHNE_27886: ( SR number: 8606244252 ; Defect: JAGae10742 ) Symptom: Data transfer over TCP is very slow. Defect Description: If the receiving buffer size is reduced by the application after the 3-way handshake, TCP window scales down. Resolution: TCP window scale calculation has been corrected to have an accurate setting. ( SR number: 8606248840 ; Defect: JAGae15237 ) Symptom: System panics with the following stack trace panic+0xa0 assfail+0x3c _assfail+0x2c b_vsema+0x36c sounlock+0x974 mp_socket_unlock+0x10 function name is not available pstat_socket+0x400 pstat+0x380 syscall+0x834 syscallinit+0x554 Defect Description: A race condition exists when two threads try to lock a pair of sockets. Resolution: Changes have been made in the socket locking code to avoid the race. ( SR number: 8606272841 ; Defect: JAGae36947 ) Symptom: It is not possible to know if the support for RFC 1948 is enabled or disabled. Defect Description: The support for RFC 1948 can be enabled by setting the ndd tunable tcp_isn_passphrase. However, "ndd -get /dev/tcp tcp_isn_passphrase" fails with the error: "operation failed, Permission denied" Resolution: "ndd -get /dev/tcp tcp_isn_passphrase" will now output: 0 - if the support for RFC 1948 is disabled 1 - if the support for RFC 1948 is enabled ( SR number: 8606272891 ; Defect: JAGae36997 ) Symptom: The HP-UX 11.0 client does not transmit multicast packets when INADDR_ANY is used. Defect Description: When the kernel has to choose an outgoing interface, it does not search for the route added to a destination multicast group. Hence, the packet is not sent out. Resolution: The outgoing interface search is now done correctly based on the destination multicast group when INADDR_ANY is specified. ( SR number: 8606277294 ; Defect: JAGae41365 ) Symptom: Applications using UDP via XTI or applications using remote file locking via NFS may cause datagram packets to be dropped. Defect Description: The default receive buffer size for UDP stream is reduced to 512. So the number of inbound UDP packets that are dropped increases if the receiving application does not read the data fast enough. Resolution: The default receive buffer size for UDP has been restored to 65536. PHNE_27058: ( SR number: 8606226976 ; Defect: JAGad96038 ) Symptom: Repeatedly joining and leaving various multicast groups and rejoining already joined groups causes the system to hang. Defect Description: The kernel allocates memory to copy user data into kernel and this memory is not freed upon encountering certain error. Resolution: The memory allocated by kernel to copy user data when joining or leaving a multicast group is freed upon encountering an error. ( SR number: 8606233305 ; Defect: JAGae02529 ) Symptom: Application hangs in the accept(2) system call. Defect Description: A message is being sent to the wrong thread or process during accept(2) processing. Resolution: A new ioctl for streams has been introduced to make the connection request to TCP atomic. ( SR number: 8606238262 ; Defect: JAGae07289 ) Symptom: Data corruption occurs in the socket structure during a connect(2). Defect Description: While doing a connect(2), fields are changed in the socket structure without holding a lock. This can result in data corruption. Resolution: The socket structure is locked before its fields are modified. This prevents race conditions and the associated data corruption. ( SR number: 8606241187 ; Defect: JAGae08450 ) Symptom: The system does not respond to any keystrokes or commands and appears to hang. A Service Guard system will perform TOC. Defect Description: A broadcast SYN packet is being delivered to TCP. There is a huge buildup in the established connection array. This causes lookups into the array to take a long time making the system appear to hang. Resolution: Inbound broadcast packets are prevented from reaching TCP. These packets are filtered out at the IP level. ( SR number: 8606241192 ; Defect: JAGae08455 ) Symptom: Memory leak of timer related mblks in 512-byte bucket. Defect Description: Timer mblks are allocated at the time of opening a TCP stream in 512-byte bucket. In a rare case, these mblks are not freed on closing the TCP stream. Resolution: Code has been modified to ensure that the timer related mblks are freed at the time of closing the TCP stream. ( SR number: 8606242679 ; Defect: JAGae09914 ) Symptom: A process appears to hang in accept(2) and cannot be killed when there is another process doing a getsockopt(2) on the same socket. Defect Description: If the remote client sends a RST before the connection request is accepted, the T_DISCON_IND message can be appropriated by getsockopt(2). This causes accept(2) to wait forever. Resolution: TCP no longer removes the T_DISCON_IND message from the stream head when processing the SO_ERROR socket option from a listen socket. ( SR number: 8606247193 ; Defect: JAGae13633 ) Symptom: System panics with either of the following stack traces: stack trace for event 0 crash event was a panic panic+0x14 too_much_time+0x2d4 wait_for_lock+0x120 sl_retry+0x18 ip_trash+0x18 ip_rtimer+0x38 ip_rput+0x3c0 puthere+0x140 mi_timeout_exec+0x224 sw_service+0x8c mp_ext_interrupt+0x108 ivti_patch_to_nop3+0x0 idle+0xd5c swidle_exit+0x0 stack trace for event 0 crash event was a panic panic+0x14 report_trap_or_int_and_panic+0x80 trap+0xdb8 nokgdb+0x8 ilm_lookup_exact+0x4 ip_delmulti+0x40 ilg_delete+0x90 ilg_delete_all+0x34 ip_close+0x58 close_wrapper+0x38 csq_protect+0x120 osr_pop_subr+0x214 osr_close_subr+0xcbc hpstreams_close_int+0x31c streams_close+0x14 soclose+0x308 soo_close+0x90 closef+0x64 close+0x90 syscall+0x200 $syscallrtn+0x0 Defect Description: A multicast application which has not done a bind calls SIOCSWITCHIFADDR to switch interface and when it closes the socket, the system panics since multicast interface information was not updated with the new interface. Resolution: Code has been changed to search through both bound and unbonud IP streams to update the new interface for the multicast information. ( SR number: 8606248331 ; Defect: JAGae14731 ) Symptom: System panics during boot after building the kernel with tcphashsz value less than 256. Defect Description: A hash table derived its size from the value of tcphashsz and any value less than 256 caused the size of this hash table to be zero resulting in panic on boot. Resolution: If the value specified for tcphashsz is less than 256, default it to 256. ( SR number: 8606249571 ; Defect: JAGae15961 ) Symptom: System panics with either of the following stack traces: stack trace for event 0 crash event was a panic panic+0x14 report_trap_or_int_and_panic+0x84 interrupt+0x1d4 $ihndlr_rtn+0x0 ip_rput_unbind_do+0x1ec ip_rput_dlpi+0x2f4 ip_rput+0x4c0 csq_turnover_with_lock+0x84 putnext+0x258 hp_dlpi_mblk_fast_in+0x354 hp_dlpi_mblk_intr_put+0x960 streams_put+0xe8 streams_put_release+0x168 hp_dlpi_mblk_intr+0x14c apa_intr+0x184 lanc_ether_ics+0x114 _btlan3_receive_pkts+0x588 _btlan3_isr+0x198 dino_isr+0xcc mp_ext_interrupt+0x318 ivti_patch_to_nop3+0x0 idle+0x1054 swidle_exit+0x0 stack trace for event 0 crash event was a panic panic+0x14 report_trap_or_int_and_panic+0x84 interrupt+0x1d4 $ihndlr_rtn+0x0 ip_rput_dlpi_up+0x550 ip_rput_dlpi+0x98 ip_rput+0x4c0 csq_turnover_with_lock+0x84 putnext+0x258 ar_client_notify+0x78 ar_rput+0x7d0 putnext+0xcc hp_dlpi_unitdata_in+0x1504 hp_dlpi_intr_put+0x8b0 streams_put+0xe8 hp_dlpi_intr+0x214 lan2_process_packet+0x87c lan2_int_fr_rnr+0x1b0 lan2_isr+0x164 lasi_interrupt+0x64 mp_ext_interrupt+0x318 ivti_patch_to_nop3+0x0 sounlock+0x90 mp_socket_unlock+0x10 soreceive+0x4bc recvit+0x144 recv+0x54 syscall+0x6f8 Defect Description: A pointer to a streams queue is retreived from a message and dereferenced. The validity of this pointer depends on the type of the message. A panic occurs when a pointer is dereferenced from a message of incompatible type. Resolution: The queue pointer will be retreived only if the message currently handled is of the correct type. ( SR number: 8606250217 ; Defect: JAGae16597 ) Symptom: System panics with the following stack trace: panic+0x14 report_trap_or_int_and_panic+0x84 trap+0xd9c nokgdb+0x8 ill_delete+0x5c8 ip_close+0x1e4 close_wrapper+0x38 csq_protect+0x120 osr_pop_subr+0x214 osr_close_subr+0xf50 osr_unlink+0x1fc str_plumb_ioctl+0x4a4 hpstreams_ioctl_int+0x398 hpstreams_ioctl+0x50 spec_ioctl+0xac vno_ioctl+0x90 ioctl+0x78 syscall+0x6f8 $syscallrtn+0x0 Defect Description: In one of the lists, messages coming from the driver will not have a pointer to the queue set in the mblk. The ill_delete() code assumed that a pointer to the queue was available and deferenced it, causing a panic. Resolution: While walking through the list of mblks at the time of deletion, simply free the mblk if it is from a driver. ( SR number: 8606257697 ; Defect: JAGae22000 ) Symptom: System panics with the following stack trace: stack trace for event 0 crash event was a panic panic+0x14 too_much_time+0x2e0 wait_for_lock+0x14c slu_retry+0x1c mp_socket_lock+0x2c TPI_ok_ack+0x1a4 soaccept+0x5f4 sodequeue+0x30c accept+0x168 syscall+0x200 $syscallrtn+0x0 Defect Description: A spinlock is held before calling a function that could go to sleep. In the meanwhile, if another thread tries to acquire that spinlock, the system panics. Resolution: Release the socket lock before calling the function that could go to sleep and then reacquire it after returning from the function. ( SR number: 8606259311 ; Defect: JAGae23629 ) Symptom: POSIX recvmsg() returns incorrect "cmsg_len". Defect Description: When a 32 bit POSIX application is run on a 64 bit kernel, necessary adjustments for certain fields in a message header is done twice. Resolution: Code has been modified to ensure that the necessary adjustments for the fields in the message header is done only once. PHNE_26771: ( SR number: 8606236775 ; Defect: JAGae05826 ) Defect Description: The variable that provides the value for the flag parameter in the SIOCATMARK ioctl is not cleared even after an application reads past the out-of-band data. Resolution: The variable that provides the value for the flag parameter in the SIOCATMARK ioctl is set and cleared correctly. ( SR number: 8606237266 ; Defect: JAGae06311 ) Defect Description: connect() does not disconnect a socket when an already connected datagram socket is passed to it. Resolution: Code has been modified to disconnect the socket when invalid arguments are passed to connect() on a already connected datagram socket. ( SR number: 8606238197 ; Defect: JAGae07224 ) Defect Description: An application calling recv() with the MSG_OOB flag loses part of the normal data, when only normal data is available to be read in the stream head. Resolution: Appropriate code change was made to prevent the data loss. ( SR number: 8606250322 ; Defect: JAGae16697 ) Defect Description: There is an unnecessary compression of header and data mblks for protocols which split their header and data into separate mblks. This causes recv() to fail. Resolution: Code has been changed to limit the fix of JAGad58231 to AF_UNIX domain and stream oriented sockets, thus avoiding unnecessary compression of datagram type sockets data. PHNE_26445: ( SR number: 8606213513 ; Defect: JAGad82705 ) Symptom: Systems relying on random increments for choosing less predictable TCP ISN values, are still vulnerable to statistical attacks. Defect Description: The RFC 1948 ("Defending against sequence number attacks") is not supported. Resolution: The RFC 1948 is now implemented for computing TCP ISN values. By default, the support for RFC 1948 is turned off. It can be turned on by using the ndd variable, tcp_isn_passphrase . The secret passphrase can be of any length, but only the first 32 characters will be retained. The passphrase, once set, should not be changed, except possibly at reboot. For example: ndd -set /dev/tcp tcp_isn_passphrase "rfc 1948" will turn on the support for RFC 1948. ( SR number: 8606218753 ; Defect: JAGad87901 ) Symptom: System runs out of memory when it is under heavy inbound TCP traffic. Defect Description: The inbound buffer for a socket is allowed to grow without bounds if the stream head is in use while data is being appended to the buffer. Resolution: Code has been modified to check if the synchronization queue is getting too long (~1000) on the stream head. If so, the tcp window is closed just as if the data queue on the stream head were getting too full. This fix is dependent on the streams tunable, streams_sqmax being set in the next streams patch. ( SR number: 8606223127 ; Defect: JAGad92230 ) System seems to hang due to a memory leak in the 2k bucket when sanmgr hostagent is running. Defect Description: When a socket joins a multicast group, the kernel allocates memory to hold the group information. This memory is not freed when the socket is closed. Resolution: Memory assigned to hold the group information when a socket joins a multicast group, is now freed when the socket is closed. ( SR number: 8606224045 ; Defect: JAGad93141 ) Symptom: System runs out of memory and seems to hang. Defect Description: A RST signal is sent by TCP on receiving a segment, which does not appear correct for the referenced connection. The problem is exacerbated if there is no valid route entry for the sender which causes the system to invoke arp to resolve the sender's address. If the segments continue to arrive, and the inbound traffic is extremely high, the arp requests and/or the RSTs will never be transmitted. Resolution: The number of outstanding arp requests is now limited. ( SR number: 8606224560 ; Defect: JAGad93648 ) Symptom: FTP hangs when transfering files from PC DOS to HP-UX. Defect Description: TCP ignores a FIN that arrives with the old data (during retransmission). This causes the TCP connection to hang when FTP is copying files from PC DOS (NetManage PCTCP stack) to HP-UX. Resolution: TCP no longer ignores a FIN which arrives with retransmitted data. ( SR number: 8606225324 ; Defect: JAGad94412 ) Symptom: "Communication stops" occur due to incorrect host route in the routing table. Defect Description: An alternate indirect route entry was created for the default route during interface switching. This was due to an unintended side-effect of route lookups. Resolution: As indirect routes were never intended to be supported, they are not created anymore. ( SR number: 8606228310 ; Defect: JAGad97367 ) Symptom: read() done on a socket returned by accept() returns the EWOULDBLOCK error. Defect Description: A race condition exists in accept() that is exposed when multiple accepts are performed on the same socket. Resolution: The code responsible for the race condition in accept() has now been removed. ( SR number: 8606229279 ; Defect: JAGad98332 ) Symptom: System panics with the following stack trace: tcp_icmp_error+0x38 tcp_rput_other+0x518 tcp_rput+0x58 csq_turnover_with_lock+0x84 str_spu_sw_isr+0x654 sw_service+0xb0 mp_ext_interrupt+0x150 ivti_patch_to_nop3+0x0 idle+0x104 Defect Description: A pointer associated with a packet which has been enqueued for delayed processing may become invalid before the delayed processing can commence. Resolution: TCP now checks if the tcp instance associated with the packet is NULL before processing it in tcp_icmp_error(). ( SR number: 8606229650 ; Defect: JAGad98702 ) Symptom: System panics with the following stack trace: igmp_timeout_handler+0x160 ip_rtimer+0x100 ip_rput+0x408 puthere+0x148 mi_timeout_exec+0x288 sw_service+0xb0 mp_ext_interrupt+0x150 ihandler+0x904 idle+0xe24 swidle+0x20 Defect Description: A race condition exists when a data structure used in the processing of multicast packets is freed prematurely. This occurs when one thread is trying to free the structure and another thread is trying to handle igmp timeout on the same structure. A DPF (Data Page Fault) panic occurs while trying to handle timeout for the structure which is on the igmp timeout list. Resolution: Code has been modified to replace the deferred free callback routine with a new routine which makes sure that the bogus(freed) structure is not there on the igmp timeout list. ( SR number: 8606230164 ; Defect: JAGad99215 ) Symptom: Performance degradation after installing PHNE_23456. Defect Description: A change in the zero window probing mechanism causes performance degradation. Resolution: Modified zero window probing mechanism now avoids performance degradation. ( SR number: 8606231247 ; Defect: JAGae00485 ) Symptom: System panics with the following stack trace: panic+0x14 report_trap_or_int_and_panic+0x80 trap+0xdb8 nokgdb+0x8 tcp_get_ucred+0x1d4 tcp_wput_ioctl+0x160 tcp_wput+0x918 putnext+0xcc wait_iocack+0x68 str_istr_ioctl+0x72c hpstreams_ioctl_int+0x370 hpstreams_ioctl+0x50 spec_ioctl+0xac vno_ioctl+0x90 ioctl+0x78 syscall+0x6f8 $syscallrtn+0x0 Defect Description: Sendmail (or identd) probably caused this panic within a small window of race condition. Resolution: The window of race condition in tcp_get_ucred() that caused the system panic has now been removed. ( SR number: 8606231526 ; Defect: JAGae00764 ) Symptom: System panics with the following stacks: tcp_wput+0x58 csq_turnover_with_lock+0x84 str_spu_sw_isr+0x654 or tcp_wput+0x58 putnext+0xcc sth_wsrv+0x204 sq_wrapper+0x94 str_sched_up_daemon+0x1c4 str_sched_daemon+0x1a4 main+0x854 Defect Description: There is a race between the closing of a stream and data being put onto the stream's synchronization queue. Resolution: A test for a null pointer is performed on entering the function tcp_wput(). ( SR number: 8606231951 ; Defect: JAGae01187 ) Symptom: System panics with the following stack trace: tcp_rsrv_comm+0x18 tcp_rput+0x3620 csq_turnover_with_lock+0x7c str_spu_sw_isr+0x5f8 sw_service+0x8c Defect Description: An incorrect goto statement is executed in an error path. Resolution: Changed error path code to exit the routine using the correct goto statement. ( SR number: 8606232185 ; Defect: JAGae01421 ) Symptom: System panics with the following stack trace: tcp_rsrv_comm+0x18 tcp_rsrv+0x10 sq_wrapper+0x90 str_sched_mp_daemon+0x130 str_sched_daemon+0x2dc main+0xa9c $vstart+0x34 $locore+0x90 Defect Description: Service routine is allowed to run on an closing queue. Resolution: A test for a null pointer is performed as the service routine is entered. ( SR number: 8606232612 ; Defect: JAGae01847 ) Symptom: If the primary route for an interface is deleted, then a host on the same subnet is not reachable through the secondary route, though the secondary network route exists. Defect Description: For the local interface, a check is performed to ascertain if the primary network route exists. If not, a check is performed again to see if a host specific route to the destination exists. Although a secondary network route exists, the same is not returned if there is no host route. Resolution: Code has been modified such that a route entry associated with the secondary route is returned, even if the primary route is deleted and if the host specific route does not exist. ( SR number: 8606233090 ; Defect: JAGae02314 ) Symptom: In some cases urgent data gets retransmitted unnecessarily impairing performance. Defect Description: Packet validation inside tcp incorrectly drops a valid packet containing urgent data. Resolution: Packet validation logic has been modified to recognize valid urgent data packets. PHNE_26412: ( SR number: 8606221602 ; Defect: JAGad90736 ) Symptom: read() sometimes loses data and returns 0 on system with PHNE_23456. Defect Description: Under certain circumstances T_ORDREL_IND message is being passed upstream by TCP before sending any pending eager data. Resolution: The fix takes care of eager data to be sent upstream. PHNE_25423: ( SR number: 8606146239 ; Defect: JAGad15575 ) Symptom: Intermittent hangs exhibited in close() when using so_linger. Defect Description: There exists a corner case to the solution resolved by JAGad09415 where the symptom can still persist. Resolution: The window for the delay to manifest itself has been fully closed. ( SR number: 8606160572 ; Defect: JAGad29893 ) Symptom: When both ts option and socket cache are used, tcp conection gets timed out. Defect Description: ACK WAR when using tcp_conn_strategy and TCP RFC 1323 timestamp option Resolution: have tcp_t reinitialzed at the end of the connection. ( SR number: 8606189015 ; Defect: JAGad58231 ) Symptom: UNIX domain socket programme uses a large amount of CPU. This can be observed in some cases of fast producer and a slow consumer type of client server programmes. Defect Description: When a slow consumer creates a small receive window, a fast producer peer will create a mblk of size equal to the window size, and append that to message list. Since there is no low-water mark concept implementation, we will be dividing the user requeset writes into smaller sizes, depending upon window created by the consumer. This may lead to a long linked list of small mblk's at the socket buffer. As this list grows, appending routine takes lots of CPU time while traversing the list for finding the end of the list. Resolution: Code has been changed to pre-allocate buffer depending upon the user requested size to write. Now instead of creating the mblk of size equal to the receive window and appending it to the message list we will pre-allocate the buffer equal to the size of user request. And in subsequent writes we will try to compress the data if we have free buffer in the previous mblk. This reduces the number of nodes in the socket buffer list. ( SR number: 8606211448 ; Defect: JAGad80636 ) Symptom: When IPSEC is active, nettl can turn on layer 4 tracing Defect Description: /dev/stcpmap does not return an error to nettl's ioctl() requesting layer 4 traces when IPSEC is running. Resolution: /dev/stcpmap returns an error to SS_START_TRACE ioctl() if a trace is requested for layer 4 and IPSEC is active. ( SR number: 8606217657 ; Defect: JAGad86809 ) Symptom: ifconfig lan10000 fails, but ifconfig lan9999 succeeds. Defect Description: The transport code limits the ppa number to less than 10000. Resolution: Remove the limit checking of the ppa number in transport code. ( SR number: 8606219937 ; Defect: JAGad89079 ) Symptom: On UP boxes when 2 (or more) aio_reads are pending on the same socket and ioctl(SIOCAIOABORT) is used, a close on that socket will result in an unkillable hung process. Defect Description: On UP boxes when 2 aio_reads are pending on the same socket, the ioctl(SIOCAIOABORT) only completes one of the pending aio_reads. So, a close on that socket results in a hang. Resolution: The ioctl(SIOCAIOABORT) has been modified so that the other aio_read cannot be left sleeping. ( SR number: 8606220568 ; Defect: JAGad89705 ) Symptom: Sometimes telnet session initiated by W2K to HP-UX 11.00 machine hangs. Defect Description: Fragmented IPSec packets may not work with W2K's SP1. Problem is on W2K side with SP1 and SP2 installed. Resolution: TCP eliminates the first hop fragmentation due to IPSec but this does not help if there is subsequent fragmentation. ( SR number: 8606220677 ; Defect: JAGad89814 ) Symptom: Data retransmission sometimes takes a long time. Defect Description: When packets get lost in a network, it takes a long time (60 seconds or longer) to retransmit. Resolution: Correct the Round Trip Time initialization so that the estimated RTO won't become too large. ( SR number: 8606221602 ; Defect: JAGad90736 ) Symptom: read() sometimes lose data and return 0 on system with PHNE_23456. Defect Description: Under certain circumstances T_ORDREL_IND message is being passed upstream by TCP before sending any pending eager data. Resolution: The fix takes care of eager data to be sent upstream. ( SR number: 8606221777 ; Defect: JAGad90911 ) Symptom: When setting ip_pmtu_strategy to 0 any non-local networks have a maximum MTU of 576. Defect Description: The code assumes that a non-local route cannot handle large MTU's. Resolution: A new value has been added to allow for no PMTU and yet use the MAX MTU for a link. To implement this change do the following; ndd -set /dev/ip ip_pmtu_strategy 3 If a smaller MTU is needed for a given route then use the above strategy and use the route command with the pmtu option "-p". ( SR number: 8606222508 ; Defect: JAGad91621 ) Symptom: When system memory use is very high the accept system call returns ENOBUFS. Defect Description: Incorrect handling of listen backlog when a SYN-RST pair arrives. Resolution: The listen backlog is now correctly updated when a SYN-RST pair arrives. The backlog is not decremented until the accept executes. ( SR number: 8606223947 ; Defect: JAGad93042 ) Symptom: When loopback address, 127.n.n.n (where n can 0 to 255) is pinged and ping succeeds, netstat -rn displays entries for each pinged address other than 127.0.0.1 Defect Description: Temporary loopback routes were sent from kernel as part of netstat -rn output. Resolution: PHNE_25381: ( SR number: 8606215148 ; Defect: JAGad84339 ) Symptom: System panics on sbflush panic 2: trace event 0 stack trace for event 0 crash event was a panic panic+0x14 sbflush+0x68 sbrelease+0x14 sorflush+0xa4 sofree+0x15c soclose+0x23c soo_close+0xc8 closef+0x64 close+0x90 syscall+0x6f8 $syscallrtn+0x0 Defect Description: AF_UNIX receive socket buffer count does not match to the real buffer size. Resolution: Save socket receive buffer counter before unlock the socket and restore them back after the socket relock. PHNE_25135: ( SR number: 8606193755 ; Defect: JAGab72514 ) Symptom: When using shutdown() and stack-caching the mss value could be set to one (1) byte. Defect Description: New socket gets previously set variables from an "old" socket. Resolution: Socket code now resets the initial socket values correctly. ( SR number: 8606137536 ; Defect: JAGad06654 ) Symptom: Tcpdump trace showed that sendfile sends trailer buffers as a swparate "send". Defect Description: Socket sendfile() alway separates trailer buffer from header and file "send". Resolution: If the total size of file data buffer and trailer buffer is smaller than MSS, send them together as one send. ( SR number: 8606203612 ; Defect: JAGad72784 ) Symptom: Examination of code found a problem. Defect Description: Incorrect parameter being used when calling soo_select(). Resolution: Corrected the thrid parameter going to the select call. Changed it from an int to a pointer. ( SR number: 8606215148 ; Defect: JAGad84339 ) Symptom: System panics on sbflush panic 2: trace event 0 stack trace for event 0 crash event was a panic panic+0x14 sbflush+0x68 sbrelease+0x14 sorflush+0xa4 sofree+0x15c soclose+0x23c soo_close+0xc8 closef+0x64 close+0x90 syscall+0x6f8 $syscallrtn+0x0 Defect Description: AF_UNIX receive socket buffer count does not match to the real buffer size. Resolution: Save socket receive buffer counter before unlock the socket and restore them back after the relock the socket. PHNE_24715: ( SR number: 8606193754 ; Defect: JAGad62965 ) Symptom: Customer noted that performance of ftp over hyper-fabric was very slow when putting a file after installing PHNE_22397. Defect Description: tcp has a variable, tcp_rack_abs_max, to set the high-water-mark of the recevied ACK. If the amount of the received ACK (tcp_rack_cnt) is greater than this high-water-mark, an immediately ACK will be generated. Otherwise, the ACK will be deferred. With PHNE_22397, tcp_rack_abs_max was set to 4*tcp_mss, which is very high with the large MTU interface like hyper-fabric. (4*32K) Then it is more likely for receiver to defer ACK since tcp_rack_cnt is less likely to exceed the high-water-mark. Resolution: tcp_rack_abs_max should not be greater than half of receive window. (rwnd/2) tcp_rack_abs_max should be kept as MIN(tcp_deferred_ack_max *tcp_mss, rwnd/2) With the fix, small transfer (sub-MSS) with large MTU link (32K like hyper-fabric) can get immediate ACK without delay. ( SR number: 8606206542 ; Defect: JAGad75715 ) Symptom: Some packets are dropped intermittently and not retransmitted for a long time. Defect Description: Retransmit timer is restarted based on deferred ack timer in certain conditions. These conditions were not properly handled which lead to long delays in the retransmission of lost packets. Resolution: On certain conditions the retransmit timer is not restarted based on deferred ack timer when there is outbound data to be retransmitted. ( SR number: 8606206806 ; Defect: JAGad75979 ) Symptom: Since PHNE_21767, all outbound datagrams have the "Don't Fragment" bit set for Path MTU Discovery. Defect Description: The default value of ip_pmtu_strategy has been changed to 1. This always sets the DF bit. Resolution: Option 2 of ip_pmtu_strategy is obsolete. An EINVAL is returned when attempting to set ip_pmtu_strategy to 2 with ndd. ( SR number: 8606139436 ; Defect: JAGad08735 ) Symptom: system panic on X.25 socket. The panic stack is as follows: A possible deadlock situation stack trace for event 0 crash event was a panic panic+0x10 spin_deadlock_failure+0x38 deadlock_check+0x9c sl_pre_check+0x54 spinlock+0x14 mp_socket_lock+0x34 mp_socket_lock2+0x38 XLS_F_handler+0x6c4 XSO_F_handler+0x958 XLS_F0_a_connect_ind+0x188 XLS_F_handler+0x6a4 XST_F_read_put+0x398 putnext+0x1f4 CI_touser+0x268 Rx_CALL+0x384 L2_datind+0x4ac dlpi_rxll+0xb4 x25lrsrv+0x60 sq_wrapper+0xc8 str_sched_mp_daemon+0x33c str_sched_daemon+0x29c im_mpnetstr+0x28 DoCalllist+0x38 main+0x24 $vstart+0x34 $locore+0x90 Defect Description: X.25 socket inserts a cloned socket on to the listen socket's queue for inbound connection causes deadlock situation Resolution: Remove deadlock assertion for X.25 socket, when X.25 process insters it cloned socket on to the listion socket's queue. ( SR number: 8606140093 ; Defect: JAGad09415 ) Symptom: TCP connections where both ends close at the same time may experience an unnecessary delay of 1.5 seconds or more. This problem has an especially high probability of being seen on loopback connections where one end of the connection has the SO_LINGER option turned on. Defect Description: During connection shutdown, if a FIN packet is received while TCP is performing its "close" operation, the FIN packet can be discarded, causing the remote end to time out (awaiting acknowledgement of the FIN) and retransmit the FIN packet. This timeout accounts for the 1.5 second (or longer) delay. Resolution: Processing of TCP packets arriving for closing connections has been modified so that they are no longer discarded. ( SR number: 8606167654 ; Defect: JAGad36937 ) Symptom: Sometimes nettl is unable to capture reply packets. Defect Description: Nettl is unable to trace outbound IP packets. This happens when drivers do not support FAST PATH. Resolution: The tracing subsystem always assumed drivers to be FASTPATH and used to skip tracing messages for NON-FASTPATH drivers. Now the tracing subsytem recognizes messages for both FASTPATH and NON-FASTPATH drives which eventually leads nettl to trace outbound packets. ( SR number: 8606198667 ; Defect: JAGad67856 ) Symptom: Closing a socket with socket caching turned on and SO_LINGER set will cause a loop in the kernel. The connection will be left in an IDLE state. Defect Description: While closing a socket for which a linger option has been set we need to check for TS_UNBND tpi state( corresponding TCP state is T_IDLE), failing which may lead to the tcp module getting polled for infinite time. Resolution: Now we check for TS_UNBND state also while processing linger option in soclose(). ( SR number: 8606202518 ; Defect: JAGad71692 ) Synptom: System panic on X.25 socket. Panic stack is : panic+0x14 report_trap_or_int_and_panic+0x80 trap+0xdb8 nokgdb+0x8 XIQ_F_handler+0xc0 XSO_F0_cleanup_pcb+0xa4 XSO_F_handler+0x12dc XPR_F_pr_usrreq+0x298 soclose+0x250 soo_close+0x90 closef+0x64 close+0x90 syscall+0x200 $syscallrtn+0x0 Defect Description: X.25 socket close goes thought an AF_UNIX close path. Resolution: Use AF_UNIX condition for AF_UNIX close path. ( SR number: 8606202738 ; Defect: JAGad71912 ) Symptom: PHNE_23456 shows duplicate uipc_socket.c what strings. Defect Description: Both uipc_socket.c and sys_socket.c have same what strings. Resolution: Change sys_socket.c what string from uipc_socket.c to sys_socket.c ( SR number: 8606203039 ; Defect: JAGad72213 ) Symptom: A UDP broadcast is sent once for each IP address configured on the interface. Defect Description: This feature is currently used to get broadcasts sent to multiple interfaces, when the broadcast address being used applies to multiple interfaces. A whole net broadcast is replicated on every connected subnet of the target net. Resolution: Add ip_duplicate_broadcasts tunable for eliminating duplicate physical broadcasts. The default setting of zero suppresses the duplicates. ( SR number: 8606203900 ; Defect: JAGad73078 ) Symptom: TCP connection hangs in an ESTABLISHED state. Defect Decription: Out of Order FIN with no data is not remembered. Resolution: Out-of-order inbound FIN handling was improved to work in the case where the FIN arrives without any data. ( SR number: 8606204354 ; Defect: JAGad73536 ) Symptom: UDP datagrams are silently dropped. Defect Description: A UDP packet size greater than the allowable IP limit is dropped with no errno. Resolution: Added logic in sosend() function to return EMSGSIZE errno when data size exceeding IP limit. ( SR number: 8606204948 ; Defect: JAGad74124 ) Symptom: System hang while ftping and concurrent file truncation. Defect Description: System hang because buffer caches were used up by sosendfile. Sosendfile used up almost all buffer caches because it's looping in a while loop inside which the buffer caches were allocated for sosendfile. Sosendfile could not exit the while loop because the condition to exit the loop became forever-false due to file truncation. The assumption that sosendfile holds that file size does not change during the while (transmission) loop is not valid, it should be adjusted. Sosendfile needs to take care of the case that file sent could be changed (truncated) during transmission. Resolution: Sosendfile will check if file size is changed during the while (transmission) loop. If it is, exit the loop appropriately. ( SR number: 8606205538 ; Defect: JAGad74714 ) Symptom: System panics while executing accept call. The panic stack is as follows: panic+0x6c report_trap_or_int_and_panic+0x94 interrupt+0x208 ihandler+0x930 x_mi_timer+0xc tcp_accept+0x510 tcp_wput_proto+0x18c tcp_wput+0xa0 csq_turnover_with_lock+0x8c puthere+0x260 tcp_icmp_error+0x270 tcp_rput_other+0x600 tcp_rput+0x60 putnext+0xcc icmp_inbound_error+0xa74 icmp_inbound+0x38c ip_rput_local+0xd58 ip_rput+0x188 putnext+0xcc hp_dlpi_mblk_fast_in+0xa0 hp_dlpi_mblk_intr_put+0xb8 streams_put+0xdc streams_put_release+0x4c hp_dlpi_mblk_intr+0x5c lanc_ether_ics+0x11c btlan_receive_frame+0x5e4 btlan_isr+0xfc sapic_interrupt+0x2c mp_ext_interrupt+0x2ec ihandler+0x90c Defect Description: An ICMP error message is received for a stream that is in the middle of the accept state. The function that processes the message cleans up the data structure related to the accept stream. When accept stream tries to access this data structure it panics. Resolution: If TCP receives an ICMP error message for a stream that is in the middle of accept state, it ignores that message. ( SR number: 8606206366 ; Defect: JAGad75539 ) Symptom: System panics with the following stack trace: panic report_trap_or_int_and_panic trap nokgdb ipif_up ip_sioctl_copyin_done ip_wput_nondata ip_wput csq_turnover_with_lock putnext udp_wput_other udp_wput putnext wait_iocack str_trans_ioctl hpstreams_ioctl_int streams_ioctl ifioctl soo_ioctl ioctl syscall Defect Description: While bringing up a virtual interface we could not identify that this is a virtual interface. So we are accidentally trying to bind and attach which results in panic because this is a virtual address and there is no physical interface that exists to which we can bind and attach. Resolution: The fix is added to correctly identify the virtual address and avoid trying to bind and attach to a physical interface and thus avoid a panic while bringing up a virtual interface. ( SR number: 8606207797 ; Defect: JAGad76974 ) Symptom: Performance degradation in IPSEC. Defect Description: Improve IPSec perf for cleartext traffic. Resolution: When TRUST is set we will not make a policy check on any incoming clear text packet but will still decrypt/authenticate any incoming IPsec packet that arrives via that interface. For outbound or forwarded traffic the IPsec policy code will not be consulted if TRUST is set on the outbound/forwarded -to interface. ( SR number: 8606209138 ; Defect: JAGad78325 ) Symptom: With ATM on system and IP traffic, system panics with forllowing panic stack: panic+0x6c report_trap_or_int_and_panic+0x94 interrupt+0x208 ihandler+0x930 bcopy_pcxu_method+0x0 LDI_F_set_fastpath+0x100 LEC_F0_uwioctl+0x1d8 LEC_F0_uwput+0xac csq_turnover_with_lock+0x84 putnext+0x258 CAM_F0_sp_dataind+0x70 streams_put+0xe4 CAM_F_data_ind+0x404 alx_receive_it+0x13fc alx_isr+0x25c wsio_interrupt+0x54 mp_ext_interrupt+0x34c ivti_patch_to_nop3+0x0 sounlock+0x90 mp_socket_unlock+0x10 soo_select2+0x1c4 soo_select+0x14 select+0xac4 syscall+0x480 Defect Description: A badly formatted request message is sent to ATM by IP while doing a fastpath probe. This happens on a multiprocessor system. One processor is formatting the message while the other sends this incomplete message to the driver as a fastpath probe. This lead ATM driver to panic. Resolution: A fastpath probe message is only sent to the driver if it is properly formatted. ( SR number: 8606209264 ; Defect: JAGad78451 ) Symptom: When 2 (or more) aio_read are pending on the same socket and ioctl(SIOCAIOABORT) is used, a close on that socket will cause to process to hang and the process is not killable. Defect Description: When 2 aio_read are pending on the same socket, ioctl(SIOCAIOABORT) only wake up one. So a close on that socket will hang. Resolution: Correct the ioctl(SIOCAIOABORT) in the socket so that other aio_read won't sleep forever. PHNE_24289: ( SR number: 8606131836 ; Defect: JAGad00986 ) Symptom: RAW socket behaviour for HP-UX 11.0 is inconsistent with HP-UX 10.20 and HP-UX 11.11. Non-root user is allowed to open a RAW socket. Defect Description: The Networking kernel code did not make the appropriate check when opening a RAW socket. Resolution: RAW socket behaviour for HP-UX 11.0 was modified to be consistent with HP-UX 10.20 and HP-UX 11.11. ( SR number: 8606162623 ; Defect: JAGad31939 ) Symptom: Service Guard system TOC with the following trace: x_mi_mpprintf_putc+0x1c x_mi_iprintf+0x280 x_mi_mpprintf+0x64 tcp_status_report+0x188 x_nd_getset+0x148 tcp_wput_ioctl+0x9c tcp_wput+0x82c putnext+0xcc wait_iocack+0x68 s tr_istr_ioctl+0x738 hpstreams_ioctl_int+0x6a8 hpstreams_ioctl+0x50 spec_ioctl+0xac vno_ioctl+0x90 ioctl+0x7c syscall+0x480 $syscallrtn+0x0 Defect Description: TCP takes a long time to complete the request from identd. That causes SG to lose heartbeat, thus TOC. Resolution: Correct TCP to use a faster method to complete the request from identd. ( SR number: 8606187409 ; Defect: JAGad56616 ) Symptom: An AF_UNIX socket application hangs on MP system. Defect Discription: On MP system, if an application uses AF_UNIX socket, select() could hang the application, because of the socket buffer flag is not correct for multi-thread collision case. Resolution: Check kernel thread for multi-thread collision situation and sign the socket buffer flag to be SB_COLL. ( SR number: 1653284372 ; Defect: JAGaa44209 ) Symptom: STCP recv() with MSG_PEEK is different from BSD. Defect Description: STCP did not walk through all messages for MSG_PEEK. Resolution: Walk through entire queue list to get user requests length of data. ( SR number: 5003411751 ; Defect: JAGaa27047 ) Symptom: A connection in FIN_WAIT_2 can stay forever. Defect Description: No timer exists to limit the amount of time a connection can remain in FIN_WAIT_2. If the other side of the connection fails to send a FIN, the connection will remain forever. Resolution: A new ndd variable, tcp_fin_wait_2_timeout, controls this feature. It specifies an interval, in milliseconds, after which the TCP will be unconditionally killed. An appropriate reset segment will be sent when the connection is killed. The default for tcp_fin_wait_2_timeout is 0, which allows the connection to live forever, as long as the far side continues to answer keepalives. Setting with "ndd -set" and determining the current value with "ndd -get" works just fine. But the tunable is not visible with "ndd -h supported" command. ( SR number: 8606198555 ; Defect: JAGad67744 ) Symptom: Problems compiling recent versions of transport source code within ClearCase. These compilation failures are not visible to customers Defect Description: After "event port" enabling support was added to the kernel source, there are conflicting function declarations between socket and non-socket source which prevents successful compilation of socket source code. Resolution: Corrections have been made to function declarations so that socket code no longer conflicts with event port definitions. ( SR number: 8606198614 ; Defect: JAGad67803 ) Symptom: System hangs and free memory is zero. System TOC with the following trace: putnext+0x188 ip_wput_ire+0x398 ip_wput+0x470 putnext+0xcc tcp_rput+0x1088 csq_turnover_with_lock+0x84 str_spu_sw_isr+0x200 sw_service+0xb0 mp_ext_interrupt+0x150 ivti_patch_to_nop3+0x0 ki_accum_push_TOS+0xa0 syscall+0x808 $syscallrtn+0x0 Defect Description: TCP floods ACKs to the driver. Resolution: Fix TCP urgent data processing. PHNE_24075: ( SR number: 8606197851 ; Defect: JAGad67042 ) Symptom: T_ALLOPT option in XTI/TLI will fail with TBADOPT. Also the tcp initial congestion window is too large possibly causing performance problems at connect time. Defect: TCP_CWND_INITIAL was defined in tcp.h as 0x16. It should have been TCP_CWND_INIT. Resolution: Changed the name of TCP_CWND_INITIAL to TCP_CWND_INIT in tcp.h. ( SR number: 8606154818 ; Defect: JAGad24135 ) Symptom: The system with IPSEC installed can panic with the following trace: panic+0x14 report_trap_or_int_and_panic+0x80 trap+0xdb8 nokgdb+0x8 ip_flush_readers+0x1a8 ip_close+0x238 close_wrapper+0x38 csq_protect+0x120 osr_pop_subr+0x1fc osr_close_subr+0x324 hpstreams_close_int+0xd40 streams_close+0x14 soclose+0x670 soaccept+0x2d8 sodequeue+0x224 accept+0x23c syscall+0x480 $syscallrtn+0x0 Defect Description: The IPSEC module can corrupt entries in the list that ip_flush_readers() parses. Resolution: Close out any pending policies before flushing the list. ( SR number: 8606160792 ; Defect: JAGad30111 ) Symptom: A server program listening for incoming connection requests with select() or accept() can receive notification of a connection's existence before it is fully established. Defect Description: As an optimization, incoming connection requests are checked to see if they originate from an address kept in a cache of machines with previously established connections. If the remote system's address is found in the cache then the TCP code does not wait for the full connection handshake protocol to complete before notifying the application. In some cases an application can be falsely notified of the existence of connections which never complete. Resolution: A new tunable variable "tcp_early_conn_ind" has been added, whose state can be modified with the "ndd" command. The default value of this parameter is 1, which leaves connection establishment behavior alone; that is, it remains the same as without this change. With the variable set to 0, applications will not be given early notification of incoming connection requests, prior the full connection establishment. ( SR number: 8606164046 ; Defect: JAGad33347 ) Symptom: Some customers using the Raptor Firewall product found the daemon processes (tcp_gspd) spinning and eating CPU time (70-80% of a cpu on UP systems). Defect Description: The symptom is because the daemon process was looping in a select/recv loop on a send-side-shutdown socket where select returned one socket FD as readable, but recv always returned EWOULDBLOCK. What happened was, prior to the daemon process's shutdown call, the remote client had already reset the connection which generated a T_DISCON_IND that went up to the stream head and set TCP state to TCPS_IDLE. If the daemon process then called shutdown, the M_ERROR message block sent up by tcp_wput_proto (it does this because it finds the TCP is in the TCPS_IDLE state) caused the T_DISCON_IND to get flushed by stream. Then recv looped because there was nothing to read on the queue. The whole thing is due to the race at stream head between processing of T_DISCON_IND coming toward stream head from TCP and generation of T_ORDREL_REQ going down- stream towards TCP from socket's shutdown code. Resolution: In socket's shutdown code, check if the connection still exists before sending T_ORDREL_REQ downstream towards TCP, if the connection is lost, set errno to EINVAL and exit. ( SR number: 8606166814 ; Defect: JAGad36101 ) Symptom: Remsh hangs. Defect Description: Remsh hangs due to incorrect behavior in shutdown during write flow control situation. Resolution: Transport calls a version of streams_putmsg() which unconditionally does the putnext(). ( SR number: 8606176180 ; Defect: JAGad45420 ) Symptom: UDP socket bound to local IP address cannot receive broadcast packet. Defect Description: A UDP socket bound to local IP address does not receive broadcast packet while this was possible on HPUX 10.20. Resolution: A new ndd tunable "ip_enable_udp_bcastrecv" is provided to fix the problem. This tunable when set to 1 will enable UDP sockets bound to local IP address to receive broadcast packets while when set to 0 disables UDP sockets bound to local IP address to receive broadcast packets. The tunable is associated with /dev/ip network device. ( SR number: 8606178029 ; Defect: JAGad47256 ) Symptom: gettcpstate() is not available in 11.0. Defect Description: Need to support gettcpstate() in 11.0. Resolution: The function gettcpstate () is back ported to 11.0 from 11.i. ( SR number: 8606178097 ; Defect: JAGad47324 ) Symptom: The system has a Data Page Fault panic with either of the following two traces: Trace 1: panic+0x14 report_trap_or_int_and_panic+0x4c interrupt+0x1e8 $ihndlr_rtn+0x0 puthere+0x44 mi_timeout_exec+0x224 sw_service+0x8c mp_ext_interrupt+0x108 ivti_patch_to_nop3+0x0 idle+0x1e8 swidle_exit+0x0 Trace 2: panic+0x14 report_trap_or_int_and_panic+0x4c interrupt+0x1e8 $ihndlr_rtn+0x0 puthere+0x44 tcp_rput_context_check+0x4a4 tcp_rput+0x784 putnext+0x16c ip_rput_local+0x524 ip_rput+0x648 putnext+0x16c hp_dlpi_mbuf_fast_in+0x70 hp_dlpi_intr_put+0x154 streams_put+0x134 hp_dlpi_intr+0x84 lan2_process_packet+0xcc lan2_int_fr_rnr+0x19c lan2_isr+0x184 eisa_int+0x134 lasi_interrupt+0x5c mp_ext_interrupt+0x300 ivti_patch_to_nop3+0x0 idle+0x1b8 swidle_exit+0x0 Defect Description: The LISTEN socket is closed while the SYN_RCVD socket is still open. Resolution: An unbind request will trigger the cleaning up of all oustanding connections. ( SR number: 8606183744 ; Defect: JAGad52955 ) Symptom: Individual host route on local interface does not work if the subnet route for the subnet containing that host is removed. Defect Description: Deleting the "network route" for a locally-attached subnet stops any packets from being transmitted on that interface. Resolution: The routing table update algorithm was modified so that when a "network route" for a local interface is deleted, the corresponding "resolver" entry is preserved, so that the host routes referring to that interface will still work. ( SR number: 8606187509 ; Defect: JAGad56716 ) Symptom: When a program uses the ICMP TIMESTAMP request message to query an HP-UX system for the current time, the reply generated provides less precise information than was available from a 10.20 system. Defect Description: The code which constructs the reply to the ICMP timestamp request calculates its time value based on the kernel's timer interrupt counter variable ("lbolt") which updates once every 10ms and is not precise enough to give a time value with a higher resolution. Resolution: The code which constructs the ICMP timestamp reply packet was modified to obtain its time information from the same high-resolution timer used to provide the microsecond-granularity tv_usec value in the "struct timeval" returned from the "gettimeofday" system call. ( SR number: 8606194889 ; Defect: JAGad64095 ) Symptom: Partially-completed incoming connection requests can occupy excessive system memory. Defect Description: The tcp_syn_rcvd_max" tunable parameter does not work correctly to limit storage of state for partially-initiated incoming TCP connections. Resolution: The code which limits the storage space occupied by partially-completed connections was corrected by re-ordering some boundary condition tests which caused the observed symptoms. PHNE_23456: ( SR number: 8606147348 ; Defect: JAGad16691 ) Symptom: Data is received with garbage bytes appended to it. The length of the received data will have a size which is a multiple of STRMSGSZ (where STRMSGSZ is the value of the kernel parameter STRMSGSZ on the system sending the data). For this to occur, the kernel parameter STRMSGSZ must have been changed to a value smaller than the default on the system which sends the data. Defect Description: Sockets fails to update a variable used to compute the size of an outgoing message. If STRMSGSZ has been set to a value smaller than the default, and the size of the data being sent is larger than STRMSGSZ, sockets will compute a length which is too long. This results in the sending of bytes that happen to follow the real data in the outgoing buffer. Resolution: The value of the variable resid is kept up to date allowing sockets to compute the correct send length. ( SR number: 8606151945 ; Defect: JAGad21284 ) Symptom: The system experiences extensive memory consumption when processing large numbers of routes. Defect Description: An internet routing entry (IRE) is allocated for each route, whether or not the route is valid. Resolution: Introduce two new ndd tunables, ip_ire_route_limit and ip_ire_route_limit_interval. The implementation will start flushing idle IRE_ROUTEs when the count has reached half of the limit. The count is checked based on the interval, measured in milliseconds. ( SR number: 8606155790 ; Defect: JAGad25103 ) Symptom: X-terminals are not able to boot from a server operating in a Service Guard environment. Defect Description: Client machines such as X-terminals are not able to get a boot file from the server in a Service Guard environment because the server is unable receive the remote IP address. Resolution: The socket options IP_RECVDSTADDR and IP_RECVIFADDR have been modified to be XOPEN conformant. Both the local and remote IP addresses are returned by RECVMSG when these options have been specified. This fix requires a TFTP fix (see JAGad25107/PHNE_23457) to completely solve the BOOTP problem. ( SR number: 8606169570 ; Defect: JAGad38845 ) Symptom: panic: Data memory protection fault gelan_if_resolved_output+0x106c hp_dlpi_mblk_CKO_fast_out+0x60 hp_dlpi_wput+0x64 putnext+0xcc ip_wput_ire+0x454 ip_wput+0x470 csq_turnover_with_lock+0x84 putnext+0x258 hp_dlpi_mblk_fast_in+0x98 hp_dlpi_mblk_intr_put+0xc8 streams_put_release+0x1cc hp_dlpi_mblk_intr+0x4c lanc_ether_ics+0x240 Defect Description: When processing a "port unreachable" error IP sends an ICMP message which has the checksum offload flag turned on. The flag was set originally to defer the checksum computation of the inbound message until later. IP appends the inbound message to the ICMP message and fails to reset the checksum offload flag if the inbound message arrived on an interface that doesn't support checksum offload. Resolution: The IP module has been corrected to clear the checksum offload flag in the ICMP message before it is shipped to an interface which supports checksum offload. ( SR number: 8606170531 ; Defect: JAGad39795 ) Symptom: Large numbers of connections on WWW servers fail to close completely. They are left stranded forever in the the CLOSE_WAIT state. Defect Description: A client has terminated while its receive window is closed and the server is attempting to send data. The server continues to send zero window probes forever waiting for the client to open its receive window so that the remaining data can be sent. Resolution: TCP has been corrected to treat unacked zero window probes like timed out retransmissions. This forces the connection to timeout and terminate. ( SR number: 8606175299 ; Defect: JAGad44542 ) Symptom: The system panics with a Data Page Fault. A possible stack looks like this: panic+0x14 report_trap_or_int_and_panic+0x84 trap+0xd9c nokgdb+0x8 ipc_hash_insert+0x84 ip_bind+0xc28 ip_wput_nondata+0x38 . . . Defect Description: The ip fanout table was corrupted when accessed in an unlocked state. Resolution: Always ensure that locks are acquired before accessing the ip fanout table. ( SR number: 8606175531 ; Defect: JAGad44771 ) Symptom: An IGMP_HOST_MEMBERSHIP_QUERY can cause a divide by zero panic. igmp_input+0x7e4 ip_rput_local+0xc00 ip_rput+0x238 putnext+0xcc hp_dlpi_unitdata_in+0x1108 hp_dlpi_mblk_intr_put+0x7bc streams_put_release+0x1cc hp_dlpi_mblk_intr+0x4c lanc_ether_ics+0x240 _btlan3_receive_pkts+0x3a0 _btlan3_isr+0x178 sapic_interrupt+0x2c mp_ext_interrupt+0x34c ivti_patch_to_nop3+0x0 idle+0x814 swidle_exit+0x0 Defect Description: IGMP does inadequate validation of IGMP_HOST_MEMBERSHIP_QUERY messages. Resolution: IGMP has been modified to prevent division by zero. ( SR number: 8606177050 ; Defect: JAGad46285 ) Symptom: If inbound UDP packets are dropped because of socket receive buffer overflow, it is difficult to discern which UDP connection is getting overflowed and how many times it has happened. Defect Description: The only way to find out how many udp socket overflows a system has is "netstat -p udp." However, this reports the number of overflows for all connections, not on a per connection basis. Resolution: Overflow counters are added in the input path. They can be viewed through the ndd tunable "ip_udp_status." ( SR number: 8606178227 ; Defect: JAGad47454 ) Symptom: Keepalive probes exceed the desired length of time set by the ndd tunable tcp_keepalive_interval. Defect Description: Time calculation incurs a small error on an active connection. On connections that have been active for a long time, this error can become quite significant. When the connection becomes idle, the error enters into the calculation for scheduling a keepalive probe. Resolution: Eliminate the cumulative skew from the TCP keepalive timer by subtracting the error margin. ( SR number: 8606181319 ; Defect: JAGad50536 ) Symptom: An ENOTCONN is intermittently returned when a read is done on a non-blocking socket. Defect Description: There exists a window where select() can return without properly setting the correct socket flag. Resolution: Set the socket into the connected state at the appropriate time. ( SR number: 8606184465 ; Defect: JAGad53672 ) Symptom: Event_port not supported by sockets. Defect Description: event_port is not supported by networking sockets. Resolution: Stub functions have been added to allow for future enablement of event_port. ( SR number: 8606184470 ; Defect: JAGad53677 ) Symptom: System panics whenever a "poll" is done via "event_port" on an AF_UNIX socket that was created by socketpair(). Here is the panic; soo_select2+0x8 soo_select+0x14 unp_poll_handler+0x40 so_poll_switch+0x74 evp_dp_poll+0x20c evp_ioctl+0x104 spec_ioctl+0xac vno_ioctl+0x90 ioctl+0x1f4 syscall+0x480 $syscallrtn+0x0 Defect Description: In the socketpair() call the value of so->so_fp is not set to the value of the file pointer. Resolution: Added the code needed to initialize so->so_fp to the correct file pointer when in the function socketpair() ( SR number: 8606185191 ; Defect: JAGad54393 ) Symptom: System panic's with the following stack; unp_eventreg+0x4 so_eventreg+0x6c evp_dereg_objhdr+0xa0 evp_close+0x15c call_open_close+0x1f8 closed+0xb0 spec_close+0x54 vn_close+0x48 vno_close+0x20 closef+0x64 exit+0x324 rexit+0x28 syscall+0x200 $syscallrtn+0x0 Defect Description: When the close routine was called on the AF_UNIX socket it would clear the function pointer to the callback function before the pointer is used. Resolution: Clearing of the function pointer is delayed until after the callback has been made. PHNE_22869: ( SR number: 4701419036 ; Defect: JAGaa93907 ) Symptom: If one urgent byte is on a socket, and a recv() is done without MSG_OOB on that socket, the urgent byte will disappear. Subsequent recvmsg() calls with the MSG_OOB flag on will return EINVAL, instead of returning the urgent byte. Defect Description: Socket state relating to urgent data is not maintained correctly allowing urgent data to be lost. Resolution: Sockets code has been modified to ensure that the OOB state is maintained correctly. ( SR number: 8606160311 ; Defect: JAGad29635 ) Symptom: Bringing up an interface with ifconfig may fail occasionally. This is also visible in errors from the ServiceGuard daemon "cmcld" if a network cable is rapidly and repeatedly unplugged and plugged back in. Defect description: An internal race condition in IP can cause control messages between IP and the lan driver to be delivered out-of-order, causing an error to be reported. The specific messages are not data packets but rather DLPI messages DL_ATTACH_REQ and DL_BIND_REQ. Resolution: IP code processing the queue of deferred work has been modified to eliminate the window where multiple threads could process elements from the queue and get them out of order. ( SR number: 8606162823 ; Defect: JAGad32139 ) Symptom:: The sytem panics with a stack overflow. panic+0x14 report_trap_or_int_and_panic+0x94 trap+0x9f4 nokgdb+0x8 lanc_media_control+0x10e0 hp_dlpi_ioctl+0x658 hp_dlpi_control+0x184 hp_dlpi_wput+0xb24 putnext+0xcc ip_wput_ctl+0x13c ip_wput_nondata+0x41c ip_wput+0xa0 puthere+0x148 ar_entry_squery+0x140 ar_cmd_dispatch+0xb0 ar_rput+0x58 puthere+0x148 ip_newroute_ipif+0x348 ip_wput_multicast+0x218 igmp_sendpkt_defrd+0x44 ip_newroute_ipif+0x378 ip_wput_multicast+0x218 igmp_sendpkt_defrd+0x44 ip_newroute_ipif+0x378 ip_wput_multicast+0x218 igmp_sendpkt_defrd+0x44 . . . ip_newroute_ipif+0x378 ip_wput_multicast+0x218 igmp_sendpkt_defrd+0x44 ip_close+0x5a0 close_wrapper+0x38 csq_protect+0x120 osr_pop_subr+0x22c osr_close_subr+0x2f8 hpstreams_close_int+0x2f8 streams_close+0x14 soclose+0x214 soo_close+0x90 closef+0x178 exit+0x944 rexit+0x24 syscall+0x610 $syscallrtn+0x0 Defect Description: The system needs to wait for a routing table entry (IRE) to be created if it does not exist when attempting to send a packet to that route. This packet is deferred until later. In this case, when the packet is processed, the IRE has not yet been created, so it is deferred again and again. Resolution: The fix is to avoid recursive processing of deferred packets. ( SR number: 8606165984 ; Defect: JAGad35271 ) Symptom: Panic during FIN processing on a system experiencing memory pressure. 0x000e4450 (set_protid_registers+0x1bfc) 0x004e6ff4 (tcp_hash_insert_port+0x2c) 0x004ee800 (tcp_reinit+0x4d0) 0x004e31c8 (tcp_clean_death+0x280) 0x004f00e0 (tcp_rput+0x1838) 0x0057ea68 (csq_turnover_with_lock+0xb0) 0x0056ede0 (putnext+0x2b0) 0x0059f75c (streams_write_uio+0x204) 0x003832b0 (sosend+0x1230) 0x003783a4 (sendit+0x41c) 0x00377eac (send+0x74) 0x0031b304 (syscall+0x754) Defect Description: When processing a FIN, TCP does not always check to see if an orderly release indication message has been allocated. Resolution: TCP has been modified to ensure that an orderly release indication message is allocated. ( SR number: 8606170482 ; Defect: JAGad39746 ) Symptom: Data transfer accross TCP connections which involve PMTU is extremely slow. Defect Description: When TCP has to do fragmentation due to the reception of ICMP_FRAGMENTATION_NEEDED messages, it fails to handle retransmissions correctly. Resolution: The handling of retransmissions after receiving ICMP_FRAGMENTATION_NEEDED messages has been changed to work correctly. ( SR number: 8606167240 ; Defect: JAGad36526 ) Symptom: System panic's with; 4) putnext+0x18 5) ip_wput_local+0x528 6) ip_wput_ire+0x43c 7) ip_wput+0x458 8) csq_turnover_with_lock+0x88 9) osr_pop_subr+0x98c 10) osr_close_subr+0xb00 11) hpstreams_close_int+0xd40 12) hpstreams_close+0x2c 13) call_open_close+0x1f8 14) closed+0xb0 15) spec_close+0x54 16) vn_close+0x48 17) vno_close+0x20 18) closef+0x68 19) close+0x48 20) syscall+0x200 When using XTI programs over loopback. Defect Description: There is a race when an XTI uses t_unbind() followed immediately by a t_close() on a connection that is over loopback. This race causes a lookup in the ipc table to become stale resulting in a panic. Resolution: The code was changed to make sure that ip_flush_readers() is called unconditionally when t_close() is called after a t_unbind() has been called. PHNE_22527: ( SR number: 8606152595 ; Defect: JAGad21925 ) Symptom: The following type of message fills up too much space in the syslog file. vmunix: tunioctl(0): Unknown ioctl Defect Description: PPP doesn't support some of the ioctls sent by transport to DLPI in an effort to determine how to communicate. Resolution: Added appropriate cases in ioctl-handling procedure to handle spurious messages in the syslog. ( SR number: 8606157385 ; Defect: JAGad26717 ) Symptom: Data Page Fault Panic when memory allocation has had to be delayed. trap+0x10f0 nokgdb+0x8 qenable+0x10 mi_ibc_qenable+0x6c csq_protect+0x1c0 bufcall_rsrv+0xf4 str_mem_daemon+0x214 im_strmem+0x1c DoCalllist+0xc0 Defect Description: When processing an incoming FIN, TCP must notify the application that the recv side of the connection has been closed. This is done by allocating and sending an orderly release indication message. If no memory is available, TCP delays the sending of this message until memory is available. If this delay is long enough, the memory resources associated with the connection may no longer exist and this results in a data page fault. Resolution: The memory for this message is preallocated when the resources for the connection are acquired, eliminating the need for delayed memory allocation. ( SR number: 8606158668 ; Defect: JAGad27998 ) Symptom: A shutdown() called on a LISTEN socket returns EINVAL. Defect Description: Validation checking is incorrect and causes shutdown() to return an error. Resolution: The validation checking for shutdown() has been modified to accept LISTEN sockets. ( SR number: 8606159910 ; Defect: JAGad29236 ) Symptom: Connections getting ETIMEDOUT errors after a connection is established. Defect Description: PMTU updates are getting dropped. This is due to using the wrong counter to track PMTU ip identifier updates. Resolution: The system was keeping two counters for ip identifiers. This was changed so that we now only have one. ( SR number: 8606161281 ; Defect: JAGad30597 ) Symptom: The following message repeatedly appears in the system logfile. "T_ERROR_ACK, ERROR_prim==1" Defect Description: IP is logging a message indicating that an application has tried to bind to an address that does not exist. Resolution: The SL_ERROR status of this message has been reduced to SL_INFO so that this message will only be logged if the system administrator requests it. ( SR number: 8606164864 ; Defect: JAGad34161 ) Symptom: A MSG_OOB recv() on a socket which has been set to non-blocking and for which there is no OOB data blocks rather than returning an error. Defect Description: The logic handling socket state variables associated with the processing of OOB data is flawed and allows a blocking read to occur when no OOB data is present. Resolution: The management of socket state variables has been corrected so that a MSG_OOB recv() no longer blocks when OOB data is not present on the socket. ( SR number: 8606165518 ; Defect: JAGad34812 ) Symptom: Need to pre-enable the select performance code. Defect Description: Needed to add enablement code for select performance increase to take advantage of changes in streams code that will be available in a future patch. Resolution: Support for the more performant select has been made to transport. This support is conditional on Streams changes. The presence or absence of the Streams changes is determined when the system boots. ( SR number: 8606165729 ; Defect: JAGad35020 ) Symptom: Customer is seeing RESET's during connects if the requested MSS is smaller than the tcp_mss_min set on the system. Defect Description: The lower limit of tcp_mss_min was set to 108. Any connection coming in with a requested MSS value below this would get RESET. Resolution: Lowered the value of tcp_mss_min back to one (1). Removed the RESET code when a requested mss comes in under tcp_mss_min. Instead just roll to tcp_mss_min. The default for tcp_mss_min is now 108. ( SR number: 8606159784 ; Defect: JAGad29110 ) Symptom: getsockname() hangs for a SOCK_RAW socket. Defect Description: The rawip module did not respond to T_ADDR_REQ messages. Resolution: The raw socket module was modified to respond to T_ADDR_REQ messages. PHNE_22397: ( SR number: 8606158528 ; Defect: JAGad27858 ) Symptom: Customer's cannot load latest patch (PHNE_22067) unresolved external streams_select3() Defect Description: A patch from the Streams team that the transport was dependent on has not been generally released. (PHNE_21676) Resolution: Removed the dependency on Streams until new streams patch is available. ( SR number: 8606140338 ; Defect: JAGad09705 ) Symptom: Applications that quickly reconnect to the same remote port (e.g. remsh) can experience 2-second delays in connection establishment. Defect Description: connect() takes 2+ seconds due to SYN retransmits to a connection waiting to close in time_wait Before a simple check was done to see if the new starting sequence number were greater than the last received sequence number of a connection in time wait. This failed quite often when randomized sequence numbers are used because often a valid new sequence number would still test less than the previous sequence number. Resolution: The fix is to save the starting sequence number of a connection and test that the new sequence number is not the same when connecting to a server in time wait. All other inflight data can be rejected because the client packet will be out of the exact range of the servers sequence space, that is, its ack will not match the server's sequence range. ( SR number: 8606160948 ; Defect: JAGad30266 ) Symptom: TCP connections exhibit poor performance over cellular-style wireless links. Defect Description: The bit-error rate and latency inherent in most cellular-style wireless links causes poor performance. Resolution: The TCP Selective Acknowledgment Option is a mechanism that can lessen the impact of such links. This functionality, specified in RFC 2018, is implemented in TCP. PHNE_22318: ( SR number: 8606158410 ; Defect: JAGad27740 ) Symptom: System or processor appears to be hung. Symptoms are not observed in patches PHNE_21767 or earlier. Defect Description: Infinite loop in tcp_options_check_est(). Resolution: Additional logic has been added to tcp_options_check_est() for the case in which an unknown TCP option is received. ( SR number: 8606147084 ; Defect: JAGad16427 ) Symptom: A client will continue to use a stale route for a virtual IP address when that address has been reassigned to a different server. Defect Description: Clients do not update their routing tables when a virtual IP address switchover occurs. Resolution: The ARP module notifies IP of the new mac address for the virtual IP. IP will then dutifully remove the stale entry and a new one will be created. ( SR number: 8606147559 ; Defect: JAGad16901 ) Symptom: The ACKs from the receiver machine are off by many windows. Unfortunately, the sender machine doesn't seem to notice, and it continues to increase the number of segments in the window with each send -- Until the ACKs *finally* fall outside the window gap. Then the sender drops back to begin slow-start all over again. Defect description: Unnecessarily dropping into slow-start after slow/late ACKs cause incorrect threshhold computation. Resolution: Modify the calculation of tcp_cwnd_ssthresh. ( SR number: 8606154650 ; Defect: JAGad23967 ) Symptom: Some clients can cause TCP connections to be set up which will cause excessive memory consumption by data buffers. Defect description: Clients which negotiate a TCP MSS size of 1 byte (or any very small value) will cause excessive memory consumption because of large buffers being allocated to hold only a single byte of data. Resolution: The default value of the tunable variable tcp_mss_min has been changed from 1 to 108 so that any clients will be refused if they attempt to establish connections which request an MSS (maximum segment size) value which is too small. ( SR number: 8606156407 ; Defect: JAGad25744 ) Symptom: An application listening on a server TCP socket can hang if many clients are initiating connections and then aborting them (resetting them) before the server can complete the connection accept operation. Defect Description: A coding error in the TCP code which handles aborted connections would cause internal streams messages to get dropped which are necessary for the accept processing to complete. The accept system call would thus hang indefinitely waiting for messages which have been deleted. Resolution: The erroneous line of code in tcp.c was deleted which caused internal streams messages to get flushed when handling aborted connections. ( SR number: 8606157574 ; Defect: JAGad26905 ) Symptom: Anomalous error returns may happen while executing the accept system call. Defect Description: An uninitialized variable in the kernel accept code causes a certain area of the associated code to take nondeterministic decisions paths when processing incoming connection requests. Usually a reasonable action is taken but sometimes an application may see an unexpected premature error return from accept. Resolution: The accept system call code was modified to ensure that the state variable causing the indeterminate behavior is always initialized to a known state. PHNE_22067: ( SR number: 8606134419 ; Defect: JAGad03554 ) Symptom: System panics with a data page fault. Two different stack traces are possible. Trace 1: crfree+0x3c closef+0x80 close+0x48 syscall+0x480 Trace 2: soo_select+0x10 pollscan+0xb0 poll+0x104 syscall+0x480 Defect Description: When accept creates a new socket and closes it immediately, it leaves a window where another thread can access the new socket. The panic depends on the system call that accesses the socket during the window of opportunity. Resolution: Accept was modified so that the new socket cannot be accessed until it is no longer subject to being closed by an error. ( SR number: 8606134761 ; Defect: JAGad03896 ) Symptom: When the SO_RCVBUF socket option is set with setsockopt() to a large value which exceeds the maximum allowed, no error is returned and the actual value set (which can be obtained with a subsequent getsockopt() call) is 65535 instead of the maximum allowed. Defect Description: When computing window scaling from the SO_RCVBUF value, the TCP code will map any SO_RCVBUF value which exceeds its maximum to the window size value 65535 with no window scaling. Resolution: TCP now checks the SO_RCVBUF value against the "ndd" tunable variable tcp_hiwat_max. If the SO_RCVBUF value exceeds this variable, the setsockopt() call will fail with an EINVAL error. ( SR number: 8606137889 ; Defect: JAGad07049 ) Symptom: HP-UX does not respond to unicast arp replies. Defect Description: HP-UX only responds to gratuitous and broadcast arps. Resolution: Arp was modified to recognize unicast replies. ( SR number: 8606141085 ; Defect: JAGad10446 ) Symptom: When an application sets up to do asyncronous I/O (signals) on a socket and calls connect(2), if it catches a signal during the connect(2) call, connect(2) returns EINTR. This is a correct return. However, if the program calls connect(2) again, connect(2) returns EINVAL. In this case, this is an incorrect return. Defect Description: When the program calls connect(2) again, connect(2) should return back either no error, or perhaps an EISCONN, but not an EINVAL. This problem was caused by an incorrect socket state set its connect path. Resolution: The checking and setting of the socket state in its connect path has been corrected. ( SR number: 8606144006 ; Defect: JAGad13339 ) Symptom: Non-privileged users cannot open a UDP socket with an ephemeral port. Defect Description: Updating of the next ephemeral port to use was done incorrectly. Resolution: Updating of the next ephemeral port to use has been changed so that it wraps correctly when the upper bound is reached. ( SR number: 8606145162 ; Defect: JAGad14500 ) Symptom: Application server hangs in recv. Defect Description: When an interface goes down during an accept, the accept can fail without notifying the application. Resolution: Code was modified to prevent the accept from failing when an interface goes down. ( SR number: 8606146766 ; Defect: JAGad16109 ) Symptom: The public domain ipfilter product cannot be installed on 11.x due to undefined symbols (if_lookup_on_name and ir_lookup). Defect Description: The new ipfilter interfaces are missing in the kernel. Resolution: Two new interfaces are added to the kernel for ipfilter: int if_lookup_on_name() int ir_lookup() PHNE_21890: ( SR number: 8606126852 ; Defect: JAGac59693 ) Symptom: Select based applications slow down when moving from 10.20 to 11.00. Defect Description: Locks were being obtained and held in situations where it was not needed. Also some loops ran longer than they needed. Resolution: The select path was rewritten to make more intelligent use of locks and loops. ( SR number: 8606134574 ; Defect: JAGad03709 ) Symptom: Inbound packet traffic is seen mostly on one processor. Need enhancement to make inbound packet schedualing better. better. Defect Description: Each network card interrupts only one CPU. The packet then goes to the top of the stack on this same CPU keeping the CPU from doing any other work. All of the other CPU's on the system could be idle. Resolution: The lower layers of the network now will send an inbound packet to the last "known" cpu that a thread ran on. This will distribute the inbound packet load on the system thereby increasing network link performance. To enable this feature type in the following echo" enable_tops/W1" | adb -w /stand/vmunix /dev/kmem To disable echo" enable_tops/W0" | adb -w /stand/vmunix /dev/kmem The global will be removed for 11.11 and it will be on permantly. PHNE_21767: ( SR number: 1653286641 ; Defect: JAGaa44778 ) Symptom: recvmsg() returns EMSGSIZE, when the message size is correct. defect Description: HP-UX is not returning the correct error when recvmsg runs out of file descriptors (when rights are received). Resolution: Return EMFILE when the file descriptors are exceeded for the process. PHNE_21606: ( SR number: 8606132568 ; Defect: JAGad01717 ) Symptom: The connection will hang when an out of order FIN arrives and is never retransmitted. Defect Description: HP-UX will drop an out of order FIN. As a result, if the sender doesn't retransmit FIN, the connection will hang as both sides are waiting for each other. Resolution: A flag will be set when an out of order FIN comes in. After the sender is done transmitting the data, the flag will be checked to see whether a FIN-ACK should be sent. ( SR number: 8606134441 ; Defect: JAGad03576 ) Symptom: Under special network load conditions in which a machine is frequently making ARP requests which do not succeed, a memory leak occurs which can eventually use up all system memory and cause a system to panic. Symptoms are not observed in patches prior to PHNE_20436, and certain details depend upon which patch is in place. In patches starting with PHNE_20436 but prior to PHNE_21038, the memory leak is in the 32-byte bucket. Starting with PHNE_21038, the leak is in the 64-byte bucket. Defect description: Code paths handling ARP requests which time out without reply would free routing table entries (IREs) without freeing their associated spinlock memory. Resolution: Memory allocation for spinlocks used in conjunction with IP identifier generation (See CR JAGab25258, JAGab84237) has been modified to avoid a memory leak. PHNE_21318: ( SR number: 8606127632 ; Defect: JAGac78434 ) Symptom: select() can hang when called following a connect() call that returned EINPROGRESS. Defect Description: connect() will return an EINPROGRESS when nonblocking I/O is enabled using O_NONBLOCK, O_NDELAY, or FIOSNBIO, and the connection cannot be completed immediately. Waiting for completion by calling select() for write allows a timing window where the T_CONN_CON can arrive after checking for it. Resolution: If the T_CONN_CON is missed, set up a callback so select will be notified when it does arrive. ( SR number: 8606129427 ; Defect: JAGac86974 ) Symptom: Double system panics occurred duing an X.25 test. stack trace for event 0 crash event was a panic panic+0x14 too_much_time+0x2d8 wait_for_lock+0x120 slu_retry+0x18 mp_socket_lock+0x2c XLS_F0_a_connect_ind+0x4c XLS_F_handler+0x6a4 XST_F_read_put+0x398 putnext+0x16c N2Z_F0_rserv+0x2b0 sq_wrapper+0x90 str_sched_mp_daemon+0x104 str_sched_daemon+0x2b8 main+0x538 $vstart+0x34 $locore+0x90 trace event 1 stack trace for event 1 crash event was a panic panic+0x14 wait_for_lock+0x2b4 slu_retry+0x18 mp_socket_lock+0x2c soaccept+0x28 sodequeue+0x19c accept+0x154 syscall+0x1c8 $syscallrtn+0x0 Defect Decription: A spinlock was not released correctly, it cause a spinlock deadlock. Resolution: Add a release lock for a return error case. ( SR number: 8606130980 ; Defect: JAGad00139 ) Symptom: "Lock not held" Panic stack: panic+0x14 sodequeue+0x530 accept+0x1b8 syscall+0x1c8 $syscallrtn+0x0 Defect Description: Allocating memory with wait can cause a thread to sleep. When awakened, the thread may be scheduled on a different processor, causing a "lock not held" panic when spinunlock is called. Resolution: Unlock the spinlock before allocating memory with wait. ( SR number: 8606131229 ; Defect: JAGad00380 ) Symptom: The HP-UX system does not respond to keepalive requests. Defect Description: The HP-UX system does not acknowledge a keepalive packet with a window size that is larger than expected. Resolution: Ignore the change in window size and send out an ACK in response. ( SR number: 8606125525 ; Defect: JAGac40915 ) Symptom: A system can hang when applications take away system resources by successfully allocating extremely large buffers. Defect Description: For TCP send and receive buffers, UDP and RAWIP receive buffers, the upper limit is 2G, and no tunables exist to lower these values. Resolution: Adding new ndd tunables, tcp_hiwater_max for TCP SEND/RECEIVE buffer udp_recv_hiwater_max for UDP RECEIVE buffer rawip_recv_hiwater_max for RAWIP RECEIVE buffer to control the upper limit of these buffers. PHNE_21038: ( SR number: 5003453233 ; Defect: JAGaa95389 ) Symptom: System panics when the opening of /dev/nuls races with the closing of /dev/nuls. This device is used by netstat. mi_close_comm1+0x44 x_mi_close_comm+0x14 nuls_close+0x14 close_wrapper+0x38 csq_protect+0xd0 osr_pop_subr+0x1b8 osr_close_subr+0x2b8 hpstreams_close_int+0x2a0 hpstreams_close+0x24 call_open_close+0x1bc closed+0xa0 Defect Description: Data structures manipulated by the nuls device were not sufficiently protected against race conditions. Resolution: The open and close routines associated with the nuls device now acquire a spinlock before accessing data structures. ( SR not found ; Defect: JAGab67537 ) Symptom: System panic when ifconfig is running on a X.25 interface. Defect Description: Ifconfig can hang while running on a X.25 interface. By doing "Ctrl-C" getting out of the hang, and execute another ifconfig will cause system panic. Resolution: When executing "Ctrl-C" to get out of ifconfig hang, some of the data structures don't get cleaned up properly. This is fixed by making sure complete cleanup when ifconfig exits abnormally. ( SR number: 8606112028 ; Defect: JAGab84237 ) Symptom: Panic during system startup ONLY on DEBUG KERNELS. Panic message and top of stack backtrace (output by kernel during panic) look like this: panic: assertion failed (alloc_spinlock: spinlocks held) at line 1844 in /ux/core/kern/sys/spinlock.c PC-Offset Stack Trace (read down, top of stack is 1st): 0x001cb4fc (panic+0x54) 0x001cbf5c (assfail+0x3c) 0x001cc118 (_assfail+0x30) 0x001d4f74 (alloc_spinlock+0x11c) 0x00539364 (ire_create+0xec) 0x00547400 (ipif_up_arp_and_ires+0x430) 0x00546d28 (ipif_up+0x308) 0x00545d08 (ipif_loopback_init+0x110) 0x00519394 (ip_open+0x364) Defect description: When starting up the transport code, a spinlock is allocated incorrectly. This doesn't hurt anything but a sanity check in debug kernels causes the system to panic. Resolution: Allocation of spinlocks during transport startup has been changed to avoid failing the sanity check. ( SR number: 8606114887 ; Defect: JAGac29660 ) Symptom: IP addresses assigned to loopback interfaces (lo0:) can not be reached from the network. Defect Description: HP-UX does not support virtual loopback interfaces. Resolution: Added support for virtual loopback interfaces. ( SR number: 8606124808 ; Defect: JAGac40200 ) Symptom: T_ORDREL_REQ out of state error messages appear in nettl.LOG file. Defect Description: Multiple calls to shutdown() on a bound socket with the argument 'how' set to SHUT_WR or SHUT_RDWR will send multiple T_ORDREL_REQs. Resolution: Make sure that one and only one T_ORDREL_REQ is sent. ( SR number: 8606125177 ; Defect: JAGac40568 ) Symptom: The command 'netstat -a' sometimes causes a panic with the following stack trace. udp_snmp_get+0x218 snmpcom_req+0x130 udp_wput_other+0x218 udp_wput+0x1c0 putnext+0x198 putmsg_subr+0x174 putmsg+0x190 syscall+0x200 $syscallrtn+0x0 Defect description: A race condition existed on a udp data structure which resulted in attempting to dereference a null pointer. Resolution: The race condition is avoided by making a local copy of the required field of the udp data structure. ( SR number: 8606125342 ; Defect: JAGac40733 ) Symptom: System panics with the following stack trace. ip_rput_local+0x21c ip_rput+0x894 putnext+0x1a4 hp_dlpi_unitdata_in+0x5a0 hp_dlpi_mblk_intr_put+0x2d8 streams_put_release+0x2c8 hp_dlpi_mblk_intr+0x80 --- --- Defect description: Under highly unlikely circumstances, an uninitialized variable is dereferenced. Resolution: The local variable always gets initialized, ( SR number: 8606126203 ; Defect: JAGac56768 ) Symptom: A RST is sent when a SYN is received. Defect Discription: If TCP initial sequence numbers are messed up, a RST packet is sent in response to a SYN received during TCP TIME_WAIT state. Resolution: Send an ACK rather than a RST in response to a bad initial sequence number. PHNE_20735: ( SR number: 8606110756 ; Defect: JAGab83504 ) Symptom: Accept() threads don't exist when their process is killed. Defect description: The accept thread is blocked in streams_getmsg() forever: _sleep+0xe78 read_sleep+0x57c streams_getmsg+0x1a4 soaccept+0x33c sodequeue+0x24c accept+0x168 syscall+0x480 $syscallrtn+0x0 If a signal is sent to the process, accept threads wakeup temporarily and then continue sleeping. Resolution: The routine soaccept() has been modified to correctly set and unset its socket state flag. ( SR number: 8606123969 ; Defect: JAGac39329 ) Symptom: System panics when closing AF_UNIX sockets with the following stack; b_owns_sema+0x8 unp_discard+0x60 unp_scan+0x88 unp_dispose+0x1c sorflush+0x90 sofree+0x8c soclose+0x7d0 soo_close+0x7c closef+0x64 exit+0x2f0 psig+0x220 syscall+0x914 $syscallrtn+0x0 Defect Description: Socket operations were done on a non-socket when closing down a AF_UNIX socket that still had unreceived file descriptors in the receive buffer. Resolution: Validated that a file descriptor pointed to a socket before performing socket operations on it. PHNE_20633: ( SR number: 8606107486 ; Defect: JAGab77719 ) Symptom: A temporary file /tmp/stcp.conf is left around unnecessarily. Defect Description: /sbin/init.d/net.init references an inappropriate file. Resolution: Changed /sbin/init.d/net.init to reference the correct file. ( SR number: 4701413963 ; Defect: INDaa30107 ) Symptom: Ifconfig may initialize network interfaces incorrectly during system startup. Defect Description: Netconf/nddconf related startup scripts run ifconfig before running "ndd -c". Some of the nddconf parameters can alter the behaviour of ifconfig. If ifconfig runs before "ndd -c", there is no opportunity for ndd to alter those parameters at startup time resulting in incorrectly initialized network interfaces. Resolution: Changed /sbin/init.d/net to reverse the calls to ndd and ifconfig. ( SR number: 4701430850 ; Defect: JAGab50646 ) Symptom: When using a sendfile related application, the system can panic. Stack trace with vmtrace on crash event was a panic panic+0x14 vmtrace_kfree+0x230 kfree_common+0x2d0 getnewbuf+0x828 ogetblk+0x110 getblk1+0x290 realloccg+0x2f8 bmap+0x710 rwip+0xecc ufs_rdwr+0x388 vno_rw+0x84 write+0x108 syscall+0x200 $syscallrtn+0x0 Defect Description: bc_checksum() which is called by sendfile() doesn't expect that the buffer cache for the file it's sending will get reallocated to a larger size during its holding period. When this happens, bc_checksum() can write into memory that it doesn't own. Resolution: Add defensive check inside bc_checksum() to ensure that writes to memory are within bounds. ( SR number: 8606110207 ; Defect: JAGab82910 ) Symptom: SNMP returns wrong tcpCurrEstab mib value Defect Description: Per-CPU base mib macro does not work for tcpCurrEstab. Resolution: Use local variable to get total tcpCurrEstab value. ( SR number: 8606110239 ; Defect: JAGab82942 ) Symptom: If a server receives a RESET on a socket and does not close it, all new connections for the SAME remote port will be dropped. Defect Description: The system does not do an IP unbind when a tcp stream is closing until it is in the TCPS_TIME_WAIT state. Resolution: If a SYN arrives on a stream that is in TCPS_BOUND, do a IP unbind. The SYN packet is also sent to the default global listen queue so that it can find its stream and be ACKed. ( SR number: 8606110349 ; Defect: JAGab83053 ) Symptom: System panic - Data page fault panic+0x14 report_trap_or_int_and_panic+0x80 trap+0xdb8 nokgdb+0x8 TPI_conn_conf+0x14 so_check_inb_conn_conf+0xc8 soo_select+0x328 select+0x12c4 syscall+0x480 $syscallrtn+0x0 Defect description: A race condition can occur when multiple threads access a socket which is processing a connect. Resolution: The routine TPI_conn_conf() has been modified to check the socket stream head using the correct read queue lock. ( SR number: 8606112290 ; Defect: JAGab84607 ) Symptom: SYNs sent to an XTI listen socket are sometimes dropped. Defect Description: A RST arriving on the XTI listen socket while it is processing an accept causes the state of the socket to disagree with the state of the underlying TCP connection. Resolution: The RST now causes TCP to rebind with IP. This allows SYNs to be handled correctly. PHNE_20436: ( SR not found ; Defect: JAGaa95395 ) Symptom: SO_LINGER does not work. Defect Description: The SO_LINGER socket option is effectively disabled when tcp_conn_strategy is in use. Resolution: The close path now takes this into consideration. ( SR number: 1653309039 ; Defect: JAGab25258 ) Symptom: Programs or subsystems (such as NFS) using large packet sizes could see data corruption when used on multiprocessor systems with multiple clients sending data to the same server. Defect description: IP code generating IP packet identifiers (used for re-assembling fragmented packets) did not use proper multiprocessor synchronization, so that sometimes different packets would receive the same identifier when being sent. This would cause the receiver to erroneously assemble parts of different packets into a single corrupted packet which could go undetected (especially though not necessarily with UDP checksums turned off). Resolution: IP packet identifier generation code was modified to use spinlocks to guarantee that unique identifiers would correctly be generated. ( SR not found ; Defect: JAGab32011 ) Symptom: Data page fault: stack trace for event 0 crash event was a panic panic+0x14 report_trap_or_int_and_panic+0x80 trap+0xe08 nokgdb+0x8 ip_rput_dlpi+0x1c4 ip_rput+0x6ec putnext+0x80 LDI_F0_send_error_ack+0x78 LDI_F_error_ack+0x8c LDI_F0_error_action+0x50 LDI_F_handler+0x2c8 LEC_F0_uwproto+0x158 LEC_F0_uwput+0x94 puthere+0x84 ip_wput_nondata+0x26c ip_wput+0x16c ... Defect Description: IP was executing a freed memory block. Resolution: Save the original memory block data in a local variable before freeing the memory block. ( SR number: 8606104338 ; Defect: JAGab71774 ) Symptom: T_ORDREL_REQ out of state error messages appear in nettl.LOG file. Defect Description: A shutdown() on an unbound tcp socket involves the tcp layer when it doesn't need to. Resolution: Check for an unconnected socket in soshutdown() and return EINVAL. ( SR number: 8606106267 ; Defect: JAGab75241 ) Symptom: For a connection between 10.20 and 11.00, when the 10.20 advertises 0 window for some period of time, 11.00 can get hung. Defect Description: For the connection between 10.20 and 11.00, if the window on 10.20 stays 0 for a while, due to the use of fix for silly window syndrome, 10.20 can advertise 0 even though there are some window openings. However, since 10.20 will still ack what 11.00 sends, 11.00 can get confused, and the system can be hung. Resolution: When detecting that the other side of the connection still ACKs the incoming packet even though it's advertising a 0 window, 11.00 will recognize that the other side implements the fix for silly window syndrome and moves ahead even though the other side has 0 window. ( SR number: 8606106481 ; Defect: JAGab75639 ) Symptom: Panic in kmalloc() called via sockname(). panic+0x14 trap+0xdb8 nokgdb+0x8 kmalloc+0x350 allocb_wait+0x290 sockname+0x54 Defect Description: The procedure sockname() does not check for a negative length parameter. Resolution: Procedure sockname() now checks for a negative length, and returns EINVAL. ( SR number: 8606113535 ; Defect: JAGab75825 ) Symptom: When the receive side of a socketpair (AF_UNIX) is "full" the system leaks memory and loses data. Defect Description: The calculation of how much room is left on the socket was incorrect. Resolution: The size of the receiving socket is now checked correctly. ( SR number: 8606113563 ; Defect: JAGab76769 ) Symptom: When the receive side of a socketpair (AF_UNIX) contains file descriptors and the socket is closed without reading the data the system loses those descriptors. Defect Description: The code responsible for cleaning up the file descriptors when a full socket was closed was not properly enabled. Resolution: The code that does the cleanup when a socket is closed was re-enabled. ( SR number: 8606113564 ; Defect: JAGab76776 ) Symptom: Blocking sendmsg() returns EMSGSIZE when receive side is close to being full. This can happen on blocking or non-blocking. Defect Description: Miscalculation of how much was going to be sent causes overflow of receive side resulting in the EMSGSIZE. Resolution: The calculation that is done before sending was corrected for the 64-bit case. ( SR number: 8606107144 ; Defect: JAGab76839 ) Symptom: A debug kernel panics when sleeping while holding a lock. Defect Description: A thread may sleep in TPI_exdata_ind() while holding a socket lock. Resolution: Release the socket lock prior to sleeping and then reacquire upon wakeup. ( SR number: 8606107729 ; Defect: JAGab78013 ) Symptom: Cose version of recvmsg does not get the file. Defect Description: Cose version of sendmsg and recvmsg did not correctly assign the file descriptor. Resolution: Set correct flag and memory length to handle the file description. ( SR number: 8606107946 ; Defect: JAGab78256 ) Symptom: q4> trace event 0 stack trace for event 0 crash event was a panic panic+0x14 report_trap_or_int_and_panic+0x80 trap+0xdb8 nokgdb+0x8 tcp_detach+0x5b0 tcp_close+0xec close_wrapper+0x38 csq_protect+0x120 osr_pop_subr+0x1f4 osr_close_subr+0xb00 hpstreams_close_int+0xc3c streams_close+0x14 soclose+0xe8 soo_close+0x90 closef+0x68 close+0x48 syscall+0x8f0 $syscallrtn+0x0 Defect Description: TCP structure is deallocated, when FIN_WAIT2 is timeout. Resolution: Release lock after FIN_WAIT2 timeout checking. ( SR number: 8606108899 ; Defect: JAGab81600 ) Symptom: By using a special scanner, TCP Initial sequence number exposes a small possibility of predictability. Defect Description: TCP Initial Sequence Number is not random enough. Resolution: Choose a more random formula for picking TCP initial sequence number. ( SR number: 8606109254 ; Defect: JAGab81953 ) Symptom: memory corruption. Defect Description: The streams queue could be changed during socket calls the expedite indication. Resolution: Look at the message block after streams synchronization protection. ( SR number: 8606109950 ; Defect: JAGab82651 ) Symptom: OOB data was not removed from data queue Defect Description: OOB data was not correctly handle by OOB data indication. Resolution: look into data queue, remove all the contiguous oob data block and save the last oob data is followed by regular data. PHNE_20041: ( SR number: 8606105057 ; Defect: JAGab72884 ) Symptom: Ping still sends packets when a lan cable is disconnected. Defect description: When a local host is configured as a default gateway, routing table management generates LOOPBACK routing entries for all the associated remote IPs. Resolution: Exclude IRE_LOOPBACK routing entries associated with addresses of down interfaces. ( SR number: 8606105583 ; Defect: JAGab73749 ) Symptom: When the receive side of a socketpair (AF_UNIX) is "full" the system leaks file descriptors and loses data. Defect Description: The return of an append operation was not tested to find out if it was successful. Resolution: The return value of the append is now checked. ( SR number: 8606106074 ; Defect: JAGab74913 ) Symptom: A non-blocking accept() call blocks in the kernel. Defect description: The socket code soaccept() was incorrectly checking if it was in blocking or non-blocking mode. Resolution: The routine soaccept() has been modified to correctly check whether the socket is in blocking or non_blocking mode. PHNE_19899: ( SR number: 8606104784 ; Defect: JAGab65709 ) Symptom: System panic in streams write queue. sth_putq_owned+0x124 sth_rput_slow+0x620 sth_rput+0x870 putnext+0x50 tcp_rput_other+0x4ac tcp_rput+0x1734 putnext+0x15c ip_rput_local+0x328 ip_rput+0x648 putnext+0x50 hp_dlpi_mblk_fast_in+0x50 hp_dlpi_mblk_intr_put+0x6d0 streams_put_release+0x154 hp_dlpi_mblk_intr+0x3clanc_ether_ics+0xf8 btlan4_process_packet+0xac btlan4_receive_pkts+0x944 btlan4_isr+0x110 dino_isr+0x128 mp_ext_interrupt+0x33c ivti_patch_to_nop3+0x0 lanc_ether_ics+0xf8 btlan4_process_packet+0xac Defect Description: There is no streams queue synchronization protection, when sockets try to remove an expedited data indication from the streams queue. Resolution: Added calls to streams queue synchronization protection functions to cover the process of removing the expedited data indication from the streams queue. ( SR number: 5003448498 ; Defect: JAGaa46666 ) Symptom: getsockname() doesn't return address family if socket is not bound. Defect Description: The address family is not set until bound in 11.0. This is not binary compatible with 10.20. Resolution: Initialize the Address Family field before socket is bound ( SR number: 8606102973 ; Defect: JAGab69105 ) Symptom: The system hangs due to a timing issue. Defect Description: tcp_accept() has assigned the 'accept queue' to the ESTABLISHED tcp_t, but it has not yet completed. An external interrupt occurs due to an incoming packet destined for this established tcp_t, causing an eventual hang. The stack of the problem processor will loop, looking for the correct tcp_t: csq_turnover+0x20 puthere+0xfc tcp_rput_context_check+0xa10 tcp_rput+0xc88 puthere+0x170 tcp_rput_context_check+0x504 tcp_rput+0xc88 csq_turnover+0xa8 puthere+0xfc tcp_rput_context_check+0xa10 tcp_rput+0xc88 putnext+0xcc ip_rput_local+0x354 ip_rput+0x1d0 putnext+0xcc Other processors may be stuck in ip_flush_readers(): ip_flush_readers+0x144 ip_ulp_unbind+0x114 tcp_close+0x5c close_wrapper+0x38 csq_protect+0x120 osr_pop_subr+0x220 osr_close_subr+0x324 hpstreams_close_int+0x314 streams_close+0x14 soclose+0xf4 soo_close+0x90 closef+0x68 exit+0x324 rexit+0x28 syscall+0x480 $syscallrtn+0x0 Resolution: A datagram arriving for a nascent tcp_t is now discarded. ( SR not found ; Defect: JAGab69620 ) Symptom: System panics when dereferencing a null pointer. Defect Description: Duplicate SYN packets are dropped. In this case, a SYN+data packet is delivered to an established tcp_t. However, a previous data packet was lost. The reassembly routine returns a null mp pointer, indicating there is nothing to reassemble. Because the SYN bit is set though, the packet is dropped and attempts to free the mp, resulting in a panic. Resolution: The mp pointer is checked before deallocation. ( SR not found ; Defect: JAGab71212 ) Symptom: When a heavily-loaded multiprocessor system is running a program with multiple threads or processes accessing the same non-blocking socket, and doing both 'connect' and 'select' operations simultaneously, the kernel can panic. (Seen with Netscape proxy server as application.) Defect description: Kernel socket code fails to provide proper multiprocessor protection on access to socket structure and associated stream head. Resolution: socket code in sys_socket.c and uipc_socket.c failed to use SOCKET_LOCK and SOCKET_UNLOCK in several places which were modifying the socket structure flags (so->so_flags) which protect the stream head during connect and select operations. Necessary calls to SOCKET_LOCK and SOCKET_UNLOCK were added to provide this protection. ( SR number: 8606104549 ; Defect: JAGab72160 ) Symptom: System TOCs due to three simultaneous MIB extractions. Defect Description: A huge old ire table and inefficient MIB extractions caused the extreme resource consumption. Resolution: Put only selected IRE_ROUTEs on the old ire table and make MIB extractions more efficient. PHNE_19375: ( SR not found ; Defect: JAGaa57204 ) Symptom: Transfer of data over loopback connections is slow. First data packet takes about one second to transfer. Defect Description: First data packet over a loopback connection is ignored by the server until it has been retransmitted by the client. Resolution: Handling of first data packet was altered so that the server no longer ignores the first data packet over a loopback connection. ( SR not found ; Defect: JAGab12875 ) Symptom: System panics in network interface drivers. Defect Description: Unplumbing a network interface with a large max fragment size results in IP sending oversized packets to the default network interface. This is known to happen when ATM or hyperfabric links are brought down on systems which have LAN default interfaces. This only happens if the ROUTE command has been used to create routes for the interface which has been unplumbed. Resolution: IP was modified to ensure that the max fragment size is set correctly when determining new routes after an interface goes down. ( SR number: 1653309237 ; Defect: JAGab25385 ) Symptom: Sometimes Service Guard switch does not work. Defect Description: SIOCSWITCHIFADDR does not switch the first interface of the interface list. Resolution: Set a right offset for ioctl return data pointer. ( SR number: 4701431221 ; Defect: JAGab53651 ) Symptom: ifconfig unplumb can leave behind stale routes. If IP attempts to use these stale routes, the system will panic. Defect Description: System may panic when using a stale route. Resolution: When an interace is unplumbed IRE_LOOPBACK routes are looked for and deleted. ( SR not found ; Defect: JAGab65705 ) Symptom: IP multicast local switch does not work properly. Defect Description: After an local switch, IP multicast addresses are copied instead of moved. Resolution: Delete multicast address from ipif table after IP local switch. PHNE_19110: ( SR not found ; DTS number: INDaa29785 ) When using setsockop() with IP_BROADCAST_IF, validation check for the address isn't available. Resolution: When using setsockopt and the IP_BROADCAST_IF option, the address is now validated at the time that the setsockopt is called. If not then EADDRNOTAVAIL is returned. ( SR number: 1653245829 ; DTS number: INDaa31082 ) When a new connect request arrives at the local TCP, and it is immediately followed by a RESET from the remote system, the server application is awakened twice to perform accept() calls. Each accept() call is returned with ENOBUFS. Resolution: ENOBUFS is the correct return value. The problem is the accepting server application should not be awakened twice. This was caused by mishandling the connection id in TPI messages. This problem is fixed by correctly tracking the connection id between the socket and TCP layers. ( SR number: 4701397927 ; DTS number: INDaa31339 ) During a Service Guard switchover if the names of the two interfaces are of different lengths but match the portion of the shorter name, (lan1 vs lan10) the switchover will fail. Resolution: Check the length of the names before checking if they are the same name. ( SR not found ; Defect: JAGaa43046 ) Getsockopt() can cause memory corruption when the socket option size is larger than four bytes. The following socket options are affected: SO_LINGER, KEEPALIVE_OPT, INET_IP, IPPROTO_IP, ADD_MEMBERSHIP_OPT, DROP_MEMBERSHIP_OPT, BROADCAST_IFNAME_OPT. Resolution: Pass opt as a array of "int" to TPI_optmgmt_ack(). ( SR number: 1653293993 ; Defect: JAGaa93498 ) Memory (512 bytes) is leaked when EAGAIN is returned from a non-blocking shutdown system call. Resolution: If an error occurs that would leave memory allocated free that memory. ( SR number: 1653297184 ; Defect: JAGaa94482 ) When passing descriptors via Unix Domain Sockets, dynamically allocated memory may be freed more than once resulting in a panic. freeb+0x4c freemsg+0x18 sendit2+0x2b0 sendmsg2+0x94 syscall+0x1c8 $syscallrtn+0x0 Resolution: Possible codepaths that contained double- deallocations of the same area of memory were eliminated. ( SR not found ; Defect: JAGab15907 ) The identified call to SOCKET_UNLOCK() does not have a matching call to SOCKET_LOCK(). The call to SOCKET_UNLOCK() needs to be removed. Resolution: Removed an un-matched unlock call from an error-path. ( SR not found ; Defect: JAGab20900 ) When several processes try to accept connections on a TCP port at the same time, one of the processes may get hung in accept(). This hung process can't be killed without a system reboot. Resolution: This problem was caused by missing socket protection around socket's file reference flag. This problem is fixed by adding SOCKET lock around the flag. ( SR number: 1653307850 ; Defect: JAGab20953 ) Routes disappear if interface is downed. Resolution: Leave a "loopback" route when taking down an interface either by the ifconfig command or from the device driver. This will "allow" processes to keep working in loopback even over an interface that is down. ( SR not found ; Defect: JAGab24408 ) System panic when calling mi_ibc_qenable after memory shortage: panic+0x14 report_trap_or_int_and_panic+0x80 trap+0xdb8 nokgdb+0x8 asm_spinlock_usav+0x14 qenable+0x40 mi_ibc_qenable+0x40 Resolution: Fix pointer arithmetic bug in mi_ibc_qenable. ( SR not found ; Defect: JAGab25437 ) getsockname()/getpeername() doesn't return EINVAL when the socket has been shutdown Resolution: Both getsockname() and getpeername() return EINVAL after shutdown() is called. ( SR number: 8606125171 ; Defect: JAGab30443 ) It is not possible to force an aio_read on a socket to complete. Resolution: Workaround added for specific customers using POSIX AIO on a TCP socket. PHNE_18708: ( SR not found ; Defect: JAGab15944 ) Install kernel panics during boot. panic: callout table overflow Resolution: Change in the method used by the network timer code to determine the existence of its patch dependencies. ( SR not found ; Defect: JAGab16252 ) The console may occasionally output the following STREAMS error message: "ip_rput: lan forced us to pullup pkt" (where is the PPA number of an interface) during bootup. Resolution: The resolution to this problem is to change the default for ip_rput_pullups in the kernel during bootup. This is done via ndd. ( SR not found ; Defect: JAGab16550 ) Possible memory leak and panic in soreceive() when using PR_ATOMIC sockets. Resolution: The memory is now freed and the character count is updated properly. ( SR not found ; Defect: JAGab17225 ) Panic in rawip_rput when closing a SOCK_RAW socket. Inbound packet is being processed after rawip structure has been freed and q_ptr == 0. Resolution: Unbind the raw socket from the protocol earlier to avoid the race condition during close(). PHNE_18611: ( SR not found ; Defect: JAGab15175 ) A program can become unkillable when using SO_LINGER and a remote system quits responding. Resolution: When a program is exiting we no longer allow "sleeping" on SO_LINGER sockets. Unless the linger would have resulted in a RESET being sent. In that case we do not change the behavior. ( SR not found ; Defect: JAGab16046 ) Performance enhancement in timer code. Resolution: Enable network timer performance enhancement. PHNE_18554: ( SR not found ; Defect: JAGab15829 ) Documentation inside source files needs to be clearer. Resolution: Documentation was improved where needed. PHNE_18553: ( SR number: 5003443846 ; Defect: JAGaa44800 ) Customer's application gets the wrong value from fstat(). Resolution: The value returned via st_blksize is now retrieved from the same info as in 10.20. ( SR not found ; DTS number: INDaa29778 ) read() will read past the Out of Band data pointer. Resolution: recv() will stop at the out of band pointer if one exists. ( SR number: 4701426817 ; Defect: JAGaa79750 ) Customer will see apparent hangs or extremely long transfer times when using any application that uses sendfile (I.E. ftp and rcp ) AND the file system does not have a default block size of 8k bytes. The enhanced version of sendfile() does not handle a filesystem with a block size GREATER than 8k. The reason for this is that when this happens it is assumed that there is a checksum provided by the file system. In that case the checksum would properly be computed. However in the error case there isn't a provided checksum AND the block size is greater than 8K so neither of the routines that would calculate the checksum are invoked. Resolution: The fix is to add in a computing of the checksum. ( SR not found ; Defect: JAGaa93103 ) Nettl tracing for transport generates the following errors. I_BACKENDTRACE_ACTIVE ioctl failure: Invalid argument Resolution: Removed IPSec code in stcpmap_copyin_done() for SS_START_TRACE action. This was causing incorrect values to be passed up to nettl thus causing nettl to not correctly setup IP or ICMP tracing. ( SR not found ; Defect: JAGaa93449 ) System panic's when allocating a new socket under heavy memory pressure. Resolution: The problem that was found here is that when the system is under memory pressure it may fail an allocation of memory while creating a socket. In the code there was a free to a socket buffer structure that would normally need to be done on AF_UNIX sockets but not on AF_INET. The free was done unconditionally not checking what the domain of the socket was. So by taking out the free when the socket is AF_INET the problem is solved. ( SR not found ; Defect: JAGaa93936 ) unp_externalize() does not work correctly on 64-bit kernels. As a result, file pointers that are passed may not be converted into file descriptors correctly. Resolution: Extra variables were used that could handle 64-bit pointer values. ( SR number: 1653297044 ; Defect: JAGaa94252 ) If a server receives a RESET on a socket but does not close it then any new connections for the SAME remote port will be dropped. To save on cpu cycles the system does not do an IP unbind when a tcp stream is closing until it is in the TCPS_TIME_WAIT state. This is because it is possible for the application to _reuse_ the same stream and would have to do a new IP bind. By waiting for the TCPS_TIME_WAIT state before doing the unbind if an application reuses the stream it is ready with many less instructions. Most applications close sockets that have been reset fairly quickly. When they do the tcp state transitions from TCPS_BOUND to TCPS_TIME_WAIT. This would close the window that we have of dropping packets because of a stream in TCPS_BOUND state. We may rarely drop the first SYN but normally would not drop the second. Resolution: The way that we have solved the problem is that if we DO get a SYN on a stream that is in TCPS_BOUND to send back down the stream to do a IP unbind. This way the next time a packet comes in the system will not find it in its list and therefore NOT send the packet up this stream. The system would then look at the listener list and find the correct listen queue and send up the packet. To solve the problem of maybe dropping the first SYN that came in we also send the packet to the default global listen queue so that it can find its stream and properly be acknowledged. ( SR not found ; Defect: JAGaa94273 ) When an application uses a protocol of type PR_ATOMIC, receives N bytes of a large message, and confirms that the first message size in the socket receive queue is larger than N bytes, the socket drops the first record without freeing the memory block. Resolution: The kernel frees the associated memory block when it drops a record. ( SR number: 5003455758 ; Defect: JAGaa94547 ) After receiving a remote shutdown, send() gets EPIPE/SIGPIPE error. Resolution: To solve this backwards compatibility issue, the SS_CANTSENDMORE flag is turned off after disconnecting the socket. ( SR not found ; Defect: JAGaa95836 ) Cannot use ifconfig X:0. ifconfig X works fine. Example: #ifconfig lan0:0 15.13.136.150 netmask 255.255.248.0 up #netstat -in Name Mtu Network Address lan0 1500 none none lan0* 1500 none none lan0* 1500 none none lan0* 1500 15.0.0.0 15.13.136.150 lan0* 1500 none none lan0* 1500 none none lo0 4136 127.0.0.0 127.0.0.1 Resolution: Check for a ":0" at the end of an interface name and treat it the same as a name without a suffix. ( SR not found ; Defect: JAGab03650 ) soaccept did not reset the a new socket SS_ACCEPT_PENDING state after returning from soclone. Resolution: Reset the SS_ACCEPT_PENDING flag after returning from soclone. ( SR number: 4701422667 ; Defect: JAGab11188 ) Server applications keep getting "Address already in Use". This has been particularly noticed in syslog.log coming from inetd. An application that did not notice that its socket had received a RST could potentially keep a new copy of the same program from starting. This would be the case even if the user specified SO_REUSEADDR. If both SO_REUSEADDR _and_ SO_REUSEPORT were used then the problem does not appear. Resolution: The reason for this problem is that this state was considered to be short lived so the chance of a race should be minimal. Also another part of the problem is that the assumption that an ACCEPTED tcp_t could go to TCPS_BOUND was incorrect. It should be going to TCPS_IDLE. The resolution is to go to TCPS_IDLE. ( SR not found ; Defect: JAGab13907 ) Application hangs while trying to close socket while using SO_LINGER and a RESET has been received. Resolution: The problem was solved by checking the state of the tcp connection for the idle state. PHNE_17662: ( SR number: 1653250993 ; DTS number: INDaa29881 ) If a listen socket is set to be nonblocking with fcntl() with either O_NONBLOCK or O_NDELAY, then the new socket created by accept() is also in nonblocking mode. However, this mode cannot be disabled in any way through fcntl(). ( SR number: 5003446658 ; Defect: JAGaa45906 ) send() when called non-blocking returns EWOULDBLOCK rather than EAGAIN. ( SR number: 5003451260 ; Defect: JAGaa72824 ) Various panics all related to timers. Stack trace varies, but generally appears as follows: ... (may be dupb+b8) tcp_wput+0x??? tcp_timer+0x310 tcp_wput+0x2ac puthere+0x138 mi_timeout_exec+0x2f8 ( SR number: 1653292912 ; Defect: JAGaa93194 ) A recv() with MSG_PEEK on a socket that 1. contains no data on it 2. has been set to non-blocking mode with an ioctl() with FIOSNBIO 3. has not been set to non-blocking mode with a fcntl() with O_NONBLOCK or a fcntl() with O_NDELAY will return ENODATA when it should return EWOULDBLOCK. ( SR number: 4701417675 ; Defect: JAGaa93344 ) For 100BT btlan6 interfaces, disconnecting and nd reconnecting the lan card results in the card state being marked UP. This causes ServiceGuard lan switchback to fail with EBUSY. ( SR not found ; Defect: JAGaa93448 ) System panic during memory shortage panic+0x14 report_trap_or_int_and_panic+0x80 interrupt+0x1d4 $ihndlr_rtn+0x0 mi_open_comm1+0x614 mi_open_detached_debug+0x38 tcp_open_detached+0x20 tcp_conn_ind+0xf0 tcp_rput+0xbc8 putnext+0xcc ip_rput_local+0x198c ip_rput+0x198 PHNE_17613: ( SR not found ; DTS number: INDaa30743 ) Some macros in led.h do not parenthesize properly, leading to possible unintended errors. ( SR not found ; Defect: JAGaa44077 ) Calling setsockopt() with an inappropriate optlen field may result in a panic. ( SR not found ; Defect: JAGaa48864 ) Calling sendmsg() with an inappropriate msg_accrightslen or msg_controllen field may result in a panic. ( SR number: 5003450247 ; Defect: JAGaa59074 ) Receiving an IP packet with zero length causes panic. The stack trace shows: panic+0x14 report_trap_or_int_and_panic+0x4c interrupt+0x1e8 $ihndlr_rtn+0x0 ip_rput_local+0x16c ip_rput+0x23c putnext+0x50 hp_dlpi_intr_put+0x1cc streams_put+0x74 hp_dlpi_intr+0x80 ... PHNE_17446: ( SR not found ; Defect: JAGaa43378 ) There was no method of obtaining the inbound TOS field from the IP header of the SYN packet. ( SR number: 4701409722 ; Defect: JAGaa44726 ) Memory leak in AF_UNIX/SOCK_STREAM sockets when using socketpair() system call. ( SR not found ; Defect: JAGaa44803 ) Defects in tcp retransmit timer may cause API hang. ( SR number: 4701410415 ; Defect: JAGaa45469 ) TCP RTO calculation causes a performance problem. ( SR number: 1653288514 ; Defect: JAGaa45800 ) inetd can hang when an excessive amount of RST packets are seen at one of its well-known ports. ( SR not found ; Defect: JAGaa45930 ) System panics if the ip fragment reassembly memory runs out. ( SR number: 5003438580 ; Defect: JAGaa46463 ) Strong ES mode does not work for multiple broadcast packets. PHNE_17227: ( SR number: 1653282012 ; Defect: JAGaa42953 ) Unlike 10.20 Transport, the 11.00 Transport does not provide an ioctl to tell ARP to rebroadcast IP address definitions. ( SR not found ; Defect: JAGaa44566 ) System panics while doing an sosleep on sockets other than AF_UNIX, or AF_INET. panic+0x14 wait_for_lock+0x1c8 sl_retry+0x18 get_sleep_lock+0x34 unselect+0x24 invoke_callouts_for_self+0xac sw_service+0x94 inttr_emulate_save_fpu+0x100 sosleep+0x14c sbwait+0x30 soreceive+0x944 recvit+0x138 recv+0x4c syscall+0x688 ( SR number: 1653249706 ; DTS number: INDaa29763 ) A panic may occur when trying to open a UNIX domain socket. ( SR not found ; Defect: JAGaa40511 ) Various panics in streams code on 32 processor V2500 boxes. ( SR not found ; Defect: JAGaa43478 ) OOB causes memory leak. PHNE_17117: ( SR not found ; Defect: JAGaa57274 ) Sockets code comments require clarification. PHNE_17018: ( SR not found ; DTS number: INDaa31704 ) IP dropped both duplicate fragments. ( SR not found ; Defect: JAGaa43135 ) TCP-generated segments sent to all-zeros broadcast address. ( SR not found ; Defect: JAGaa43864 ) TCP determined when to send a FIN based upon incorrect information, and this delayed the FIN for 500ms. ( SR number: 1653284844 ; Defect: JAGaa44015 ) TCP starts "discard with cksum error" after ICMP FRAG NEEDED received. PHNE_17017: ( SR not found ; DTS number: INDaa31672 ) traceroute may fail with the following error message: ttl not correct, ttl = 1, ttl2 = 0 ( SR not found ; Defect: JAGaa40492 ) Kernels containing this bug *might* see a hang soon after booting, or they might not hang at all. Machines that have seen the hang: D-class, 782, 887, 897 Machines that ran fine without seeing the hang: J210, K460 ( SR number: 4701404426 ; Defect: JAGaa40908 ) select() on a TCP socket was not returning true when out-of-band data was received. ( SR not found ; Defect: JAGaa43365 ) The value of a STATIC variable might be changed by another thread, thus causing the routine to look at the wrong item in a table. ( SR number: 8606333130 ; Defect: JAGaa43403 ) Doing an accept on an AF_INET socket under conditions of extreme memory pressure can result in a Data Page Fault panic. trap+0x808 kfree_common+0x200 soclone+0x5e8 soaccept+0x98 sodequeue+0xac accept+0x128 syscall+0x1cc $syscallrtn+0x0 PHNE_16645: ( SR number: 1653272674 ; DTS number: INDaa31588 ) The maximum size for socket send and receive buffers for AF_UNIX sockets was hardcoded to 32,767 bytes. ( SR not found ; DTS number: INDaa31592 ) System leaks memory when using AF_UNIX sockets. ( SR not found ; DTS number: JAGaa40308 ) Memory leak in soclone() and sonewconn(). ( SR number: 1653279430 ; DTS number: JAGaa40890 ) Customer may see the following panics; panic+0x14 report_trap_or_int_and_panic+0x4c trap+0xe8c $RDB_trap_patch+0x20 spinlock_usav+0x10 mp_socket_lock+0x30 soo_ioctl+0x28 ioctl+0x13c syscall+0x1c8 $syscallrtn+0x0 AND/OR panic+0x14 report_trap_or_int_and_panic+0x4c trap+0xe8c $RDB_trap_patch+0x20 spinlock_usav+0x10 mp_socket_lock+0x30 soo_stat+0x48 fstat+0x100 syscall+0x1c8 $syscallrtn+0x0 PHNE_16497: ( SR not found ; DTS number: INDaa28388 ) The setting of TCP_NODELAY was not inherited across an accept() call. ( SR number: 1653271866 ; DTS number: INDaa31445 ) Point-to-point connections do not remain after a switchover. ( SR not found ; DTS number: INDaa31446 ) When using the system call socketpair() with AF_UNIX the system will leak memory. ( SR number: 4701399261 ; DTS number: INDaa31505 ) Incorrect IP fragmentation may cause the system to panic. Stack trace: panic+0x14 report_trap_or_int_and_panic+0x7c interrupt+0x1d4 $ihndlr_rtn+0x0 ill_frag_timeout+0xa8 ip_rtimer+0xd8 ip_rput+0x300 puthere+0x84 mi_timeout_exec+0x330 invoke_callouts_for_self+0xc0 sw_service+0xb0 mp_ext_interrupt+0x12c ( SR number: 1653270728 ; DTS number: INDaa31563 ) When a ICMP_FRAGMENTATION_NEEDED message was received on a TCP connection, the portion of data that had not been acknowledged was re-sent endlessly. ( SR number: 5003432989 ; DTS number: INDaa31628 ) System may panic with the following stack; panic+0x14 unp_disconnect+0xdc uipc_usrreq+0x500 sodisconnect+0x4c soconnect+0x3c4 connect+0x310 syscall+0x6c0 $syscallrtn+0x0 PHNE_16283: ( SR not found ; DTS number: INDaa28344 ) The sendfile system call can trigger the Nagle algorithm, decreasing file transfer performance. ( SR number: 5003428474 ; DTS number: INDaa31304 ) Customer may see a 'hang' where all networking will hang. This would also include AF_UNIX connections. ( SR not found ; DTS number: INDaa31373 ) Calling getsockopt() with a large buffer length argument may result in a panic. ( SR not found ; DTS number: INDaa31444 ) Data page fault in socket_merged(), the panic stack trace looks like this: trap, crfree, socket_merged, socket, syscall ( SR number: 5003431122 ; DTS number: INDaa31504 ) AF_UNIX socket dupb() causes panic. The root cause is fixed in streams patch PHNE_16290. The stack trace shows: stack trace for event 0 crash event was a panic panic+0x14 report_trap_or_int_and_panic+0x7c trap+0xd58 $call_trap+0x28 freeb+0x54 unp_detach+0xec uipc_usrreq+0x580 soclose+0x1f8 soo_close+0x90 closef+0x64 close+0x48 syscall+0x6c0 $syscallrtn+0x0 ( SR number: 5003430355 ; DTS number: INDaa31542 ) A panic occurs when receiving a strange TCP/IP packet from MSDOS. Stack trace shows: panic+0x14 report_trap_or_int_and_panic+0x4c interrupt+0x1ec $ihndlr_rtn+0x0 tcp_rput+0x10a0 putnext+0x50 ip_rput_local+0x644 ip_rput+0x164 putnext+0x50 hp_dlpi_unitdata_in+0xddc hp_dlpi_intr_put+0x6e8 streams_put+0x74 hp_dlpi_intr+0x84 lan2_process_packet+0x7cc lan2_int_fr_rnr+0x198 lan2_isr+0x170 lasi_interrupt+0x5c mp_ext_interrupt+0x31c ivti_patch_to_nop3+0x0 idle+0x278 swidle_exit+0x0 ( SR not found ; DTS number: INDaa31552 ) Unable to add a second route for a host which using the local address as the gateway. PHNE_15995: ( SR number: 5003426320 ; DTS number: INDaa31147 ) A socket with many connections queued on it may panic the system. This may occur when a RST packet is sent by the other end or during an accept() call on the socket. ( SR number: 5003427336 ; DTS number: INDaa31214 ) After first urgent data packet, the second send fails with ENOBUFS. PHNE_15911: ( SR not found ; DTS number: INDaa29195 ) System crashes with the following stack while running AF_UNIX DGRAM sockets; sounlock mp_socket_unlock uipc_usrreq sosend sendit sendto syscall $syscallrtn ( SR number: 1653262717 ; DTS number: INDaa30786 ) TCP clients attempting to connect with a server time out (ETIMEDOUT error) even though 'netstat -a' shows that a LISTEN socket exists for the server. In general this problem will affect a single service. Other services will continue accepting connections normally. ( SR number: 5003418889 ; DTS number: INDaa30965 ) Some firewalls do not respond to ICMP ECHO Requests. Dead Gateway Detection assumes that the lack of response means that the gateway is dead, and valid route entries are incorrectly marked as invalid. ( SR number: 1653266171 ; DTS number: INDaa31078 ) When a connection is in the FIN_WAIT_1 state and an ICMP unreachable packet with NEEDFRAG arrives and forces a retransmission, the system to panics with a data page fault. The stack trace shows: panic+0x14 report_trap_or_int_and_panic+0x4c interrupt+0xec $ihndlr_rtn+0x0 dupb+0xd0 tcp_xmit_mp+0x2b8 tcp_wput+0x46c tcp_rput+0x378 putnext+0x50 ip_rput_local+0x430 ip_rput+0x160 putnext+0x50 hp_dlpi_fast_in+0xbc hp_dlpi_intr_put+0xf8 streams_put+0x74 ... ( SR number: 5003421818 ; DTS number: INDaa31117 ) Gated delete command for the default route does not work because the Internet Route Entry has the mask as 0xffffffff. netstat -rvn shows : default/255.255.255.255 ... ndd -get /dev/ip ip_ire_status shows: ... mask ... gateway ffffffff IRE_NET Route delete host default $(hostname) also fails when mask is 0xffffffff. PHNE_15692: ( SR not found ; DTS number: INDaa30948 ) Added per-CPU MIB functionality performance tuning. PHNE_15583: ( SR number: 5003411926 ; DTS number: INDaa30157 ) A panic can occur in sounlock because of a race between two processes trying to access the same AF_UNIX socket. Here is the panic string; sounlock unp_connect uipc_usrreq soconnect connect syscall ( SR number: 1653258848 ; DTS number: INDaa30372 ) Zero window probes were not being started when the window became zero octets and there was no data ready to be sent. ( SR number: 5003418822 ; DTS number: INDaa30467 ) TCP was ignoring inbound keepalive probes where the sequence number *and* the ack number were both decremented. Such keepalive probes are sent by machines running BSD-based code, although the 4.4BSD code contains a compile-time option for sending probes where only the sequence number is decremented. Keepalive probes from HP-UX 11.0 (or Solaris) boxes were not ignored. ( SR number: 1653258830 ; DTS number: INDaa30675 ) Half-open connections were not being reset when the disconnected side tried to reconnect with the same address and port. ( SR number: 1653262980 ; DTS number: INDaa30752 ) Data page fault caused by ip_csuma routine: go_again. Key panic stack trace looks like this: go_again+0x20 icmp_pkt+0x140 icmp_source_quench+0xa4 icmp_inbound+0x98c ip_rput_local+0xbcc ip_rput+0x180 ... ( SR number: 4701393090 ; DTS number: INDaa30787 ) System may panic with either a already freed mblk or a corrupted one. PHNE_15047: ( SR number: 5003410076 ; DTS number: INDaa30102 ) Connect to a connected UDP socket does not disconnect the original connection. If the resolv.conf file has multiple servers listed and the first nameserver is not running named, the secondary nameserver gets an ICMP_PORT_UNREACHABLE message. ( SR number: 5003413591 ; DTS number: INDaa30268 ) System may panic when using NON-BLOCKING connect() and select(). PHNE_14876: ( SR not found ; DTS number: INDaa30315 ) Transferring a file using FTP can cause a data page fault panic in sendfp_by_bread(). Stack Trace: sendfp_by_bread sendfp sendfile PHNE_14730: ( SR number: 1653250456 ; DTS number: INDaa29935 ) Copying a smaller file on top of a file being shipped via sendfile() (eg FTP) can result in a tight loop inside sendfp_by_rdwr() which grabs the CPU forever. PHNE_14702: ( SR not found ; DTS number: INDaa30079 ) sendmsg() does not send 65535-byte and larger msgs correctly ( SR number: 1653256222 ; DTS number: INDaa30182 ) When a new PMTU is discovered after the TCP FIN has been sent on a connection, a panic can occur during retransmission of the data. ( SR not found ; DTS number: INDaa30226 ) TCP SYN packets which have the PUSH flag set are dropped. ( SR number: 1653256388 ; DTS number: INDaa30230 ) Calling recv() with MSG_PEEK flag set when OOB data (TCP urgent data) has been received can result in the process hanging and eventually the system memory is used up. The exact circumstances to provoke the problem is to do a recv() with MSG_PEEK set on a socket without the SO_OOBINLINE option set when there is unread OOB data (TCP urgent data) available. PHNE_14575: ( SR not found ; DTS number: INDaa30030 ) During Service Guard local lan failover with Fibre Channel network interfaces, failover from primary to secondary works properly, but fail back from secondary to primary when the primary interface recovers fails to work. ioctl(SIOCSWITCHIFADDR) returns errno 16 "Device Busy". PHNE_14279: ( SR not found ; DTS number: INDaa29460 ) Panic - data page fault in ip_rput_dlpi_up PHNE_14274: ( SR number: 1653251702 ; DTS number: INDaa29894 ) When an IP address is added as a secondary interface -- e.g. when a ServiceGuard (SG) package runs -- one of two errors can result when certain conditions are met: 1. Using an r-command (e.g. rlogin, rcp) or an SG cm-command results in a "Permission denied" error if the secondary IP address is not in the .rhosts file on the remote system. This affects commands and applications that bind to INADDR_ANY. 2. SG loses its heartbeat and detects a spurious "failure" if the secondary IP address is a duplicate of one of the remote system's IP addresses, a configuration error. This happens when the system must send an ARP request to locate the remote system. PHNE_14260: ( SR not found ; DTS number: INDaa29680 ) ip_snmp_get race condition. ( SR not found ; DTS number: INDaa29726 ) On fast CPUs the command netstat -an can cause data page fault panics. On slower machines, this panic only occurs when numerous netstat commands are executed in parallel. PHNE_14017: ( SR not found ; DTS number: INDaa29579 ) shutdown blocks on a non-blocking socket ( SR not found ; DTS number: INDaa29598 ) paniced in ip_flush_readers(), already owns lock PHNE_13692: ( SR number: 1653239764 ; DTS number: INDaa29253 ) If the system is a single processor machine they may see it hang. It will still respond to "ping" but the console and all other activity will stop. If the system is a multiprocessor machine the customer may see that one processor is 100% busy running netisr. The rest of the system will be working OK with the exception of the one processor being out of the picture. Networking may be slow or not working at all. Netstat will show one of this systems IP addresses connected to itself along with the local and remote port being the same. The state of the socket will be SYN_RCVD. PHNE_13405: ( SR not found ; DTS number: INDaa27472 ) write() to a closed socket returns ECONNRESET instead of the expected EPIPE. ( SR not found ; DTS number: INDaa28544 ) HA switchover takes up to 7 seconds to complete. ( SR not found ; DTS number: INDaa28665 ) Calling recv(), recvmsg(), and recvfrom() with the MSG_PEEK flag set on UNIX domain datagram sockets may discard some data. ( SR not found ; DTS number: INDaa28833 ) data page fault when executing "ndd -get /dev/ip ip_ill_report" ( SR not found ; DTS number: INDaa28992 ) Multiprocessor systems may hang on an accept() call. ( SR not found ; DTS number: INDaa29086 ) These device files are not intended to be used as a general purpose input/output devices. Using /dev/tun* as the standard input or output device generates an ioctl command which is not supported by the device driver. Due to a lack of robustness in this driver, the format of this ioctl causes a panic. By adding additional sanity checks to the ioctl processing code, the correct action can be taken, which is to reject the ioctl call with an errno of EINVAL. ( SR not found ; DTS number: INDaa29102 ) Set initial transport kernel segment file basemode value to 0777. ( SR not found ; DTS number: INDaa29194 ) data page fault in tcp_linger_callback(). Enhancement: No SR: 1653239764 5003427336 8606130980 8606169570 8606222508 1653245829 5003428474 8606131229 8606170482 8606223127 1653249706 5003430355 8606131836 8606170531 8606223947 1653250456 5003431122 8606132568 8606175299 8606224045 1653250993 5003432989 8606134419 8606175531 8606224462 1653251702 5003438580 8606134441 8606176180 8606224560 1653256222 5003443846 8606134574 8606177050 8606225324 1653256388 5003446658 8606134761 8606178029 8606226976 1653258830 5003448498 8606137536 8606178097 8606228310 1653258848 5003450247 8606137889 8606178227 8606229279 1653262717 5003451260 8606139436 8606181319 8606229650 1653262980 5003453233 8606140093 8606183744 8606230164 1653266171 5003455758 8606140338 8606184465 8606231247 1653270728 8606102973 8606141085 8606184470 8606231526 1653271866 8606104338 8606144006 8606185191 8606231951 1653272674 8606104549 8606145162 8606187409 8606232185 1653279430 8606104784 8606146239 8606187509 8606232612 1653282012 8606105057 8606146766 8606189015 8606233090 1653284372 8606105583 8606147084 8606193754 8606233164 1653284844 8606106074 8606147348 8606193755 8606233305 1653286641 8606106267 8606147559 8606194889 8606236775 1653288514 8606106481 8606151945 8606197851 8606237266 1653292912 8606107144 8606152595 8606198555 8606238197 1653293993 8606107486 8606154650 8606198614 8606238262 1653297044 8606107729 8606154818 8606198667 8606241187 1653297184 8606107946 8606155790 8606202518 8606241192 1653307850 8606108899 8606156407 8606202738 8606242679 1653309039 8606109254 8606157385 8606203039 8606244252 1653309237 8606109950 8606157574 8606203612 8606247193 4701393090 8606110207 8606158410 8606203900 8606248331 4701397927 8606110239 8606158528 8606204354 8606248840 4701399261 8606110349 8606158668 8606204948 8606249571 4701404426 8606110756 8606159784 8606205538 8606250217 4701409722 8606112028 8606159910 8606206366 8606250322 4701410415 8606112290 8606160311 8606206542 8606257154 4701413963 8606113535 8606160572 8606206806 8606257697 4701417675 8606113563 8606160792 8606207797 8606259311 4701419036 8606113564 8606160948 8606209138 8606272841 4701422667 8606114887 8606161281 8606209264 8606272891 4701426817 8606123969 8606162623 8606211448 8606274495 4701430850 8606124808 8606162823 8606213513 8606277294 4701431221 8606125171 8606164046 8606215148 8606283209 5003410076 8606125177 8606164864 8606217657 8606283966 5003411751 8606125342 8606165518 8606218753 8606286419 5003411926 8606125525 8606165729 8606219937 8606292583 5003413591 8606126203 8606165984 8606220568 8606294788 5003418822 8606126852 8606166814 8606220677 8606294967 5003418889 8606127632 8606167240 8606221602 8606294977 5003421818 8606129427 8606167654 8606221777 8606295188 5003426320 8606333130 8606285107 8606328253 8606297439 8606304572 8606306857 8606312501 8606318794 8606331109 8606248122 8606317300 8606298990 8606322708 Patch Files: OS-Core.CORE2-KRN,fr=B.11.00,fa=HP-UX_B.11.00_32,v=HP: /usr/conf/lib/libhp-ux.a(dgram_aud.o) /usr/conf/lib/libhp-ux.a(uipc_mbuf.o) /usr/conf/lib/libhp-ux.a(xport_diag.o) /usr/conf/lib/libuipc.a(sys_socket.o) /usr/conf/lib/libuipc.a(uipc_domain.o) /usr/conf/lib/libuipc.a(uipc_init.o) /usr/conf/lib/libuipc.a(uipc_proto.o) /usr/conf/lib/libuipc.a(uipc_socket.o) /usr/conf/lib/libuipc.a(uipc_socket2.o) /usr/conf/lib/libuipc.a(uipc_syscall.o) /usr/conf/lib/libuipc.a(uipc_tpi.o) /usr/conf/lib/libuipc.a(uipc_usrreq.o) Networking.NET-KRN,fr=B.11.00,fa=HP-UX_B.11.00_32/64,v=HP: /usr/conf/netinet/ip_info.h Networking.NET-PRG,fr=B.11.00,fa=HP-UX_B.11.00_32/64,v=HP: /usr/include/netinet/ip_info.h /usr/include/netinet/tcp.h Networking.NET-RUN,fr=B.11.00,fa=HP-UX_B.11.00_32/64,v=HP: /sbin/init.d/net.init /sbin/init.d/net Networking.NET2-KRN,fr=B.11.00,fa=HP-UX_B.11.00_32,v=HP: /usr/conf/lib/libinet.a(arp.o) /usr/conf/lib/libinet.a(igmp.o) /usr/conf/lib/libinet.a(in.o) /usr/conf/lib/libinet.a(in_cksum.o) /usr/conf/lib/libinet.a(in_proto.o) /usr/conf/lib/libinet.a(inet_init.o) /usr/conf/lib/libinet.a(ip.o) /usr/conf/lib/libinet.a(ip_if.o) /usr/conf/lib/libinet.a(ip_ire.o) /usr/conf/lib/libinet.a(ip_mroute.o) /usr/conf/lib/libinet.a(ip_multi.o) /usr/conf/lib/libinet.a(ipcsum.o) /usr/conf/lib/libinet.a(rawip.o) /usr/conf/lib/libinet.a(snmpcom.o) /usr/conf/lib/libinet.a(tcp.o) /usr/conf/lib/libinet.a(udp.o) /usr/conf/lib/libipsectp.a /usr/conf/lib/libnet.a(af.o) /usr/conf/lib/libnet.a(if.o) /usr/conf/lib/libnet.a(ip_info.o) /usr/conf/lib/libnet.a(mialloc.o) /usr/conf/lib/libnet.a(mind.o) /usr/conf/lib/libnet.a(mioptcom.o) /usr/conf/lib/libnet.a(mitimer.o) /usr/conf/lib/libnet.a(miutil.o) /usr/conf/lib/libnet.a(net_init.o) /usr/conf/lib/libnet.a(nuls.o) /usr/conf/lib/libnet.a(pass.o) /usr/conf/lib/libnet.a(route.o) /usr/conf/lib/libnet.a(spass.o) /usr/conf/lib/libnet.a(stcpmap.o) /usr/conf/lib/libnet.a(tang.o) /usr/conf/lib/libtun.a(tun-stream.o) /usr/conf/master.d/net Networking.NMS2-KRN,fr=B.11.00,fa=HP-UX_B.11.00_32,v=HP: /usr/conf/lib/libnms.a(nms.o) OS-Core.CORE2-KRN,fr=B.11.00,fa=HP-UX_B.11.00_64,v=HP: /usr/conf/lib/libhp-ux.a(dgram_aud.o) /usr/conf/lib/libhp-ux.a(uipc_mbuf.o) /usr/conf/lib/libhp-ux.a(xport_diag.o) /usr/conf/lib/libuipc.a(sys_socket.o) /usr/conf/lib/libuipc.a(uipc_domain.o) /usr/conf/lib/libuipc.a(uipc_init.o) /usr/conf/lib/libuipc.a(uipc_proto.o) /usr/conf/lib/libuipc.a(uipc_socket.o) /usr/conf/lib/libuipc.a(uipc_socket2.o) /usr/conf/lib/libuipc.a(uipc_syscall.o) /usr/conf/lib/libuipc.a(uipc_tpi.o) /usr/conf/lib/libuipc.a(uipc_usrreq.o) Networking.NET2-KRN,fr=B.11.00,fa=HP-UX_B.11.00_64,v=HP: /usr/conf/lib/libinet.a(arp.o) /usr/conf/lib/libinet.a(igmp.o) /usr/conf/lib/libinet.a(in.o) /usr/conf/lib/libinet.a(in_cksum.o) /usr/conf/lib/libinet.a(in_proto.o) /usr/conf/lib/libinet.a(inet_init.o) /usr/conf/lib/libinet.a(ip.o) /usr/conf/lib/libinet.a(ip_if.o) /usr/conf/lib/libinet.a(ip_ire.o) /usr/conf/lib/libinet.a(ip_mroute.o) /usr/conf/lib/libinet.a(ip_multi.o) /usr/conf/lib/libinet.a(ipcsum.o) /usr/conf/lib/libinet.a(rawip.o) /usr/conf/lib/libinet.a(snmpcom.o) /usr/conf/lib/libinet.a(tcp.o) /usr/conf/lib/libinet.a(udp.o) /usr/conf/lib/libipsectp.a /usr/conf/lib/libnet.a(af.o) /usr/conf/lib/libnet.a(if.o) /usr/conf/lib/libnet.a(ip_info.o) /usr/conf/lib/libnet.a(mialloc.o) /usr/conf/lib/libnet.a(mind.o) /usr/conf/lib/libnet.a(mioptcom.o) /usr/conf/lib/libnet.a(mitimer.o) /usr/conf/lib/libnet.a(miutil.o) /usr/conf/lib/libnet.a(net_init.o) /usr/conf/lib/libnet.a(nuls.o) /usr/conf/lib/libnet.a(pass.o) /usr/conf/lib/libnet.a(route.o) /usr/conf/lib/libnet.a(spass.o) /usr/conf/lib/libnet.a(stcpmap.o) /usr/conf/lib/libnet.a(tang.o) /usr/conf/lib/libtun.a(tun-stream.o) /usr/conf/master.d/net Networking.NMS2-KRN,fr=B.11.00,fa=HP-UX_B.11.00_64,v=HP: /usr/conf/lib/libnms.a(nms.o) what(1) Output: OS-Core.CORE2-KRN,fr=B.11.00,fa=HP-UX_B.11.00_32,v=HP: /usr/conf/lib/libhp-ux.a(dgram_aud.o): PHNE_29473 32-bit dgram_aud.c $Revision: @@/main/r 11ros/0 $ /usr/conf/lib/libhp-ux.a(uipc_mbuf.o): PHNE_29473 32-bit uipc_mbuf.c $Revision: @@/main/r 11ros/0 $ $Date: $ /usr/conf/lib/libhp-ux.a(xport_diag.o): PHNE_29473 32-bit xport_diag.c $Revision: @@/main/ r11ros/0 $ /usr/conf/lib/libuipc.a(sys_socket.o): PHNE_29473 32-bit sys_socket.c $ $Date: $ $Revis ion: @@/main/r11ros/cup4_rar_r11ros_xport_pi b/2 $ /usr/conf/lib/libuipc.a(uipc_domain.o): PHNE_29473 32-bit uipc_domain.c $Revision: @@/main /r11ros/0 $ /usr/conf/lib/libuipc.a(uipc_init.o): NET: libuipc: Version: B.11.00 PHNE_29473 32-bit uipc_init.c $Date: $ $Revision : @@/main/r11ros/cup4_rar_r11ros_xport_pib/1 $ /usr/conf/lib/libuipc.a(uipc_proto.o): PHNE_29473 32-bit uipc_proto.c $Revision: @@/main/ r11ros/0 $ /usr/conf/lib/libuipc.a(uipc_socket.o): PHNE_29473 32-bit uipc_socket.c $ $Date: $ $Revi sion: @@/main/r11ros/cup4_rar_r11ros_xport_p ib/2 $ /usr/conf/lib/libuipc.a(uipc_socket2.o): PHNE_29473 32-bit uipc_socket2.c $Date: $ $Revis ion: @@/main/r11ros/cup4_rar_r11ros_xport_pi b/1 $ /usr/conf/lib/libuipc.a(uipc_syscall.o): PHNE_29473 32-bit uipc_syscall.c $Revision: @@/mai n/r11ros/cup4_rar_r11ros_xport_pib/1 $ /usr/conf/lib/libuipc.a(uipc_tpi.o): PHNE_29473 32-bit uipc_tpi.c $Revision: @@/main/r 11ros/cup4_rar_r11ros_xport_pib/2 $ /usr/conf/lib/libuipc.a(uipc_usrreq.o): PHNE_29473 32-bit uipc_usrreq.c $Revision: @@/main /r11ros/cup4_rar_r11ros_xport_pib/1 $ Networking.NET-KRN,fr=B.11.00,fa=HP-UX_B.11.00_32/64,v=HP: /usr/conf/netinet/ip_info.h: PHNE_29473 ip_info.h $ $Revision: @@/main/r11ros/c up_rar_r11ros_xport_pib/5 $ Networking.NET-PRG,fr=B.11.00,fa=HP-UX_B.11.00_32/64,v=HP: /usr/include/netinet/ip_info.h: PHNE_29473 ip_info.h $ $Revision: @@/main/r11ros/c up_rar_r11ros_xport_pib/5 $ /usr/include/netinet/tcp.h: tcp.h 7.5 (Berkeley) 6/29/88 Networking.NET-RUN,fr=B.11.00,fa=HP-UX_B.11.00_32/64,v=HP: /sbin/init.d/net.init: $Revision: 1.2.119.8 $ $Date: 97/09/13 17:00:57 $ /sbin/init.d/net: $Revision: 1.6.119.4 $ $Date: 97/09/13 16:58:40 $ Networking.NET2-KRN,fr=B.11.00,fa=HP-UX_B.11.00_32,v=HP: /usr/conf/lib/libinet.a(arp.o): PHNE_29473 32-bit arp.c $Revision: @@/main/r11ros/c up4_rar_r11ros_xport_pib/1 $ $Date: $ /usr/conf/lib/libinet.a(igmp.o): PHNE_29473 32-bit igmp.c $Revision: @@/main/r11ros/ cup4_rar_r11ros_xport_pib/1 $ $Date: $ /usr/conf/lib/libinet.a(in.o): PHNE_29473 32-bit in.c $Revision: @@/main/r11ros/0 $ /usr/conf/lib/libinet.a(in_cksum.o): PHNE_29473 32-bit in_cksum.s $Date: $ $Revision: @@/main/r11ros/5 $ /usr/conf/lib/libinet.a(in_proto.o): PHNE_29473 32-bit in_proto.c $Revision: @@/main/r1 1ros/5 $ /usr/conf/lib/libinet.a(inet_init.o): NET: libinet: Version: B.11.00 PHNE_29473 inet_init.c $Date: $ /usr/conf/lib/libinet.a(ip.o): PHNE_29473 32-bit ip.c $Revision: @@/main/r11ros/cu p4_rar_r11ros_xport_pib/2 $ $Date: $ /usr/conf/lib/libinet.a(ip_if.o): PHNE_29473 32-bit ip_if.c $Revision: @@/main/r11ros /cup4_rar_r11ros_xport_pib/2 $ $Date: $ /usr/conf/lib/libinet.a(ip_ire.o): PHNE_29473 32-bit ip_ire.c $Revision: @@/main/r11ro s/cup4_rar_r11ros_xport_pib/2 $ $Date: $ /usr/conf/lib/libinet.a(ip_mroute.o): PHNE_29473 32-bit ip_mroute.c $Revision: @@/main/r1 1ros/14 $ $Date: $ /usr/conf/lib/libinet.a(ip_multi.o): PHNE_29473 32-bit ip_multi.c $Revision: @@/main/r11 ros/cup4_rar_r11ros_xport_pib/1 $ $Date: $ /usr/conf/lib/libinet.a(ipcsum.o): PHNE_29473 32-bit ipcsum.c $Revision: @@/main/r11ro s/2 $ $Date: $ /usr/conf/lib/libinet.a(rawip.o): PHNE_29473 32-bit rawip.c $Revision: @@/main/r11ros /cup4_rar_r11ros_xport_pib/2 $ $Date: $ /usr/conf/lib/libinet.a(snmpcom.o): PHNE_29473 32-bit snmpcom.c $Revision: @@/main/r11r os/cup4_rar_r11ros_xport_pib/1 $ $Date: $ /usr/conf/lib/libinet.a(tcp.o): PHNE_29473 32-bit tcp.c $Revision: @@/main/r11ros/c up4_rar_r11ros_xport_pib/2 $ $Date: $ /usr/conf/lib/libinet.a(udp.o): PHNE_29473 32-bit udp.c $Revision: @@/main/r11ros/c up4_rar_r11ros_xport_pib/2 $ $Date: $ /usr/conf/lib/libipsectp.a: PHNE_29473 ipsec ipsec_hp.c $Revision: @@/main/r11 ros/1 $ /usr/conf/lib/libnet.a(af.o): PHNE_29473 32-bit af.c $Revision: @@/main/r11ros/0 $ $Date: $ /usr/conf/lib/libnet.a(if.o): PHNE_29473 32-bit if.c $Revision: @@/main/r11ros/7 $ /usr/conf/lib/libnet.a(ip_info.o): PHNE_29473 32-bit ip_info.c $Revision: @@/main/r11r os/cup4_rar_r11ros_xport_pib/1 $ $Date: $ /usr/conf/lib/libnet.a(mialloc.o): PHNE_29473 32-bit mialloc.c $Revision: @@/main/r11r os/2 $ $Date: $ /usr/conf/lib/libnet.a(mind.o): PHNE_29473 32-bit mind.c $Revision: @@/main/r11ros/ 7 $ $Date: $ /usr/conf/lib/libnet.a(mioptcom.o): PHNE_29473 32-bit mioptcom.c $Revision: @@/main/r11 ros/cup4_rar_r11ros_xport_pib/2 $ $Date: $ /usr/conf/lib/libnet.a(mitimer.o): PHNE_29473 32-bit mitimer.c $Revision: @@/main/r11r os/4 $ $Date: $ /usr/conf/lib/libnet.a(miutil.o): PHNE_29473 32-bit miutil.c $Revision: @@/main/r11ro s/cup4_rar_r11ros_xport_pib/1 $ $Date: $ /usr/conf/lib/libnet.a(net_init.o): NET: libnet: Version: B.11.00 PHNE_29473 32-bit net_init.c $Revision: @@/main/r11 ros/1 $ $Date: $ /usr/conf/lib/libnet.a(nuls.o): PHNE_29473 32-bit nuls.c $Revision: @@/main/r11ros/ 3 $ $Date: $ /usr/conf/lib/libnet.a(pass.o): PHNE_29473 32-bit pass.c $Revision: @@/main/r11ros/ 2 $ $Date: $ /usr/conf/lib/libnet.a(route.o): PHNE_29473 32-bit route.c $Revision: @@/main/r11ros /1 $ $Date: $ /usr/conf/lib/libnet.a(spass.o): PHNE_29473 32-bit spass.c $Revision: @@/main/r11ros /2 $ $Date: $ /usr/conf/lib/libnet.a(stcpmap.o): PHNE_29473 32-bit stcpmap.c $Revision: @@/main/r11 ros/cup4_rar_r11ros_xport_pib/1 $ /usr/conf/lib/libnet.a(tang.o): PHNE_29473 32-bit tang.c $Revision: @@/main/r11ros/ 1 $ $Date: $ /usr/conf/lib/libtun.a(tun-stream.o): PHNE_29473 32-bit tun-stream.c $Revision: @@/main/r 11ros/10 $ $Date: $ /usr/conf/master.d/net: $Revision: 1.7.106.2 $ Networking.NMS2-KRN,fr=B.11.00,fa=HP-UX_B.11.00_32,v=HP: /usr/conf/lib/libnms.a(nms.o): PHNE_29473 $Source: /usr/local/kcs/sys.I80_800/sys/ RCS/nms.c,v $ OS-Core.CORE2-KRN,fr=B.11.00,fa=HP-UX_B.11.00_64,v=HP: /usr/conf/lib/libhp-ux.a(dgram_aud.o): PHNE_29473 64-bit dgram_aud.c $Revision: @@/main/r 11ros/0 $ /usr/conf/lib/libhp-ux.a(uipc_mbuf.o): PHNE_29473 64-bit uipc_mbuf.c $Revision: @@/main/r 11ros/0 $ $Date: $ /usr/conf/lib/libhp-ux.a(xport_diag.o): PHNE_29473 64-bit xport_diag.c $Revision: @@/main/ r11ros/0 $ /usr/conf/lib/libuipc.a(sys_socket.o): PHNE_29473 64-bit sys_socket.c $ $Date: $ $Revis ion: @@/main/r11ros/cup4_rar_r11ros_xport_pi b/2 $ /usr/conf/lib/libuipc.a(uipc_domain.o): PHNE_29473 64-bit uipc_domain.c $Revision: @@/main /r11ros/0 $ /usr/conf/lib/libuipc.a(uipc_init.o): NET: libuipc: Version: B.11.00 PHNE_29473 64-bit uipc_init.c $Date: $ $Revision : @@/main/r11ros/cup4_rar_r11ros_xport_pib/1 $ /usr/conf/lib/libuipc.a(uipc_proto.o): PHNE_29473 64-bit uipc_proto.c $Revision: @@/main/ r11ros/0 $ /usr/conf/lib/libuipc.a(uipc_socket.o): PHNE_29473 64-bit uipc_socket.c $ $Date: $ $Revi sion: @@/main/r11ros/cup4_rar_r11ros_xport_p ib/2 $ /usr/conf/lib/libuipc.a(uipc_socket2.o): PHNE_29473 64-bit uipc_socket2.c $Date: $ $Revis ion: @@/main/r11ros/cup4_rar_r11ros_xport_pi b/1 $ /usr/conf/lib/libuipc.a(uipc_syscall.o): PHNE_29473 64-bit uipc_syscall.c $Revision: @@/mai n/r11ros/cup4_rar_r11ros_xport_pib/1 $ /usr/conf/lib/libuipc.a(uipc_tpi.o): PHNE_29473 64-bit uipc_tpi.c $Revision: @@/main/r 11ros/cup4_rar_r11ros_xport_pib/2 $ /usr/conf/lib/libuipc.a(uipc_usrreq.o): PHNE_29473 64-bit uipc_usrreq.c $Revision: @@/main /r11ros/cup4_rar_r11ros_xport_pib/1 $ Networking.NET2-KRN,fr=B.11.00,fa=HP-UX_B.11.00_64,v=HP: /usr/conf/lib/libinet.a(arp.o): PHNE_29473 64-bit arp.c $Revision: @@/main/r11ros/c up4_rar_r11ros_xport_pib/1 $ $Date: $ /usr/conf/lib/libinet.a(igmp.o): PHNE_29473 64-bit igmp.c $Revision: @@/main/r11ros/ cup4_rar_r11ros_xport_pib/1 $ $Date: $ /usr/conf/lib/libinet.a(in.o): PHNE_29473 64-bit in.c $Revision: @@/main/r11ros/0 $ /usr/conf/lib/libinet.a(in_cksum.o): PHNE_29473 64-bit in_cksum.s $Date: $ $Revision: @@/main/r11ros/5 $ /usr/conf/lib/libinet.a(in_proto.o): PHNE_29473 64-bit in_proto.c $Revision: @@/main/r1 1ros/5 $ /usr/conf/lib/libinet.a(inet_init.o): NET: libinet: Version: B.11.00 PHNE_29473 inet_init.c $Date: $ /usr/conf/lib/libinet.a(ip.o): PHNE_29473 64-bit ip.c $Revision: @@/main/r11ros/cu p4_rar_r11ros_xport_pib/2 $ $Date: $ /usr/conf/lib/libinet.a(ip_if.o): PHNE_29473 64-bit ip_if.c $Revision: @@/main/r11ros /cup4_rar_r11ros_xport_pib/2 $ $Date: $ /usr/conf/lib/libinet.a(ip_ire.o): PHNE_29473 64-bit ip_ire.c $Revision: @@/main/r11ro s/cup4_rar_r11ros_xport_pib/2 $ $Date: $ /usr/conf/lib/libinet.a(ip_mroute.o): PHNE_29473 64-bit ip_mroute.c $Revision: @@/main/r1 1ros/14 $ $Date: $ /usr/conf/lib/libinet.a(ip_multi.o): PHNE_29473 64-bit ip_multi.c $Revision: @@/main/r11 ros/cup4_rar_r11ros_xport_pib/1 $ $Date: $ /usr/conf/lib/libinet.a(ipcsum.o): PHNE_29473 64-bit ipcsum.c $Revision: @@/main/r11ro s/2 $ $Date: $ /usr/conf/lib/libinet.a(rawip.o): PHNE_29473 64-bit rawip.c $Revision: @@/main/r11ros /cup4_rar_r11ros_xport_pib/2 $ $Date: $ /usr/conf/lib/libinet.a(snmpcom.o): PHNE_29473 64-bit snmpcom.c $Revision: @@/main/r11r os/cup4_rar_r11ros_xport_pib/1 $ $Date: $ /usr/conf/lib/libinet.a(tcp.o): PHNE_29473 64-bit tcp.c $Revision: @@/main/r11ros/c up4_rar_r11ros_xport_pib/2 $ $Date: $ /usr/conf/lib/libinet.a(udp.o): PHNE_29473 64-bit udp.c $Revision: @@/main/r11ros/c up4_rar_r11ros_xport_pib/2 $ $Date: $ /usr/conf/lib/libipsectp.a: PHNE_29473 ipsec 64-bit ipsec_hp.c $Revision: @@/m ain/r11ros/1 $ /usr/conf/lib/libnet.a(af.o): PHNE_29473 64-bit af.c $Revision: @@/main/r11ros/0 $ $Date: $ /usr/conf/lib/libnet.a(if.o): PHNE_29473 64-bit if.c $Revision: @@/main/r11ros/7 $ /usr/conf/lib/libnet.a(ip_info.o): PHNE_29473 64-bit ip_info.c $Revision: @@/main/r11r os/cup4_rar_r11ros_xport_pib/1 $ $Date: $ /usr/conf/lib/libnet.a(mialloc.o): PHNE_29473 64-bit mialloc.c $Revision: @@/main/r11r os/2 $ $Date: $ /usr/conf/lib/libnet.a(mind.o): PHNE_29473 64-bit mind.c $Revision: @@/main/r11ros/ 7 $ $Date: $ /usr/conf/lib/libnet.a(mioptcom.o): PHNE_29473 64-bit mioptcom.c $Revision: @@/main/r11 ros/cup4_rar_r11ros_xport_pib/2 $ $Date: $ /usr/conf/lib/libnet.a(mitimer.o): PHNE_29473 64-bit mitimer.c $Revision: @@/main/r11r os/4 $ $Date: $ /usr/conf/lib/libnet.a(miutil.o): PHNE_29473 64-bit miutil.c $Revision: @@/main/r11ro s/cup4_rar_r11ros_xport_pib/1 $ $Date: $ /usr/conf/lib/libnet.a(net_init.o): NET: libnet: Version: B.11.00 PHNE_29473 64-bit net_init.c $Revision: @@/main/r11 ros/1 $ $Date: $ /usr/conf/lib/libnet.a(nuls.o): PHNE_29473 64-bit nuls.c $Revision: @@/main/r11ros/ 3 $ $Date: $ /usr/conf/lib/libnet.a(pass.o): PHNE_29473 64-bit pass.c $Revision: @@/main/r11ros/ 2 $ $Date: $ /usr/conf/lib/libnet.a(route.o): PHNE_29473 64-bit route.c $Revision: @@/main/r11ros /1 $ $Date: $ /usr/conf/lib/libnet.a(spass.o): PHNE_29473 64-bit spass.c $Revision: @@/main/r11ros /2 $ $Date: $ /usr/conf/lib/libnet.a(stcpmap.o): PHNE_29473 64-bit stcpmap.c $Revision: @@/main/r11 ros/cup4_rar_r11ros_xport_pib/1 $ /usr/conf/lib/libnet.a(tang.o): PHNE_29473 64-bit tang.c $Revision: @@/main/r11ros/ 1 $ $Date: $ /usr/conf/lib/libtun.a(tun-stream.o): PHNE_29473 64-bit tun-stream.c $Revision: @@/main/r 11ros/10 $ $Date: $ /usr/conf/master.d/net: $Revision: 1.1.106.2 $ Networking.NMS2-KRN,fr=B.11.00,fa=HP-UX_B.11.00_64,v=HP: /usr/conf/lib/libnms.a(nms.o): PHNE_29473 $Source: /usr/local/kcs/sys.I80_800/sys/ RCS/nms.c,v $ cksum(1) Output: OS-Core.CORE2-KRN,fr=B.11.00,fa=HP-UX_B.11.00_32,v=HP: 1062783862 2620 /usr/conf/lib/libhp-ux.a(dgram_aud.o) 744727934 12112 /usr/conf/lib/libhp-ux.a(uipc_mbuf.o) 4114313291 229088 /usr/conf/lib/libhp-ux.a(xport_diag.o) 3371454061 7888 /usr/conf/lib/libuipc.a(sys_socket.o) 340930642 6668 /usr/conf/lib/libuipc.a(uipc_domain.o) 3571642121 15488 /usr/conf/lib/libuipc.a(uipc_init.o) 1987140525 1372 /usr/conf/lib/libuipc.a(uipc_proto.o) 940742264 63280 /usr/conf/lib/libuipc.a(uipc_socket.o) 3684760599 21188 /usr/conf/lib/libuipc.a(uipc_socket2.o) 1348910672 28988 /usr/conf/lib/libuipc.a(uipc_syscall.o) 2414848510 23440 /usr/conf/lib/libuipc.a(uipc_tpi.o) 674974291 15780 /usr/conf/lib/libuipc.a(uipc_usrreq.o) Networking.NET-KRN,fr=B.11.00,fa=HP-UX_B.11.00_32/64,v=HP: 2253572954 4220 /usr/conf/netinet/ip_info.h Networking.NET-PRG,fr=B.11.00,fa=HP-UX_B.11.00_32/64,v=HP: 2253572954 4220 /usr/include/netinet/ip_info.h 1400363275 2601 /usr/include/netinet/tcp.h Networking.NET-RUN,fr=B.11.00,fa=HP-UX_B.11.00_32/64,v=HP: 1567166219 2091 /sbin/init.d/net.init 3227447513 7942 /sbin/init.d/net Networking.NET2-KRN,fr=B.11.00,fa=HP-UX_B.11.00_32,v=HP: 3249746026 32892 /usr/conf/lib/libinet.a(arp.o) 4147427346 12464 /usr/conf/lib/libinet.a(igmp.o) 3318714743 1128 /usr/conf/lib/libinet.a(in.o) 1073938689 2220 /usr/conf/lib/libinet.a(in_cksum.o) 3938038972 8476 /usr/conf/lib/libinet.a(in_proto.o) 367781966 2892 /usr/conf/lib/libinet.a(inet_init.o) 765741596 130216 /usr/conf/lib/libinet.a(ip.o) 1689371721 67076 /usr/conf/lib/libinet.a(ip_if.o) 548824648 22656 /usr/conf/lib/libinet.a(ip_ire.o) 3899540426 23944 /usr/conf/lib/libinet.a(ip_mroute.o) 2847529209 9920 /usr/conf/lib/libinet.a(ip_multi.o) 2698495254 1564 /usr/conf/lib/libinet.a(ipcsum.o) 2390798164 18220 /usr/conf/lib/libinet.a(rawip.o) 1306415741 3232 /usr/conf/lib/libinet.a(snmpcom.o) 2375271734 130796 /usr/conf/lib/libinet.a(tcp.o) 370835573 28204 /usr/conf/lib/libinet.a(udp.o) 108357276 9288 /usr/conf/lib/libipsectp.a 3937239849 1536 /usr/conf/lib/libnet.a(af.o) 2190939715 7836 /usr/conf/lib/libnet.a(if.o) 557305533 3136 /usr/conf/lib/libnet.a(ip_info.o) 4048941514 1716 /usr/conf/lib/libnet.a(mialloc.o) 760556957 4988 /usr/conf/lib/libnet.a(mind.o) 3688392290 6216 /usr/conf/lib/libnet.a(mioptcom.o) 2722239380 7804 /usr/conf/lib/libnet.a(mitimer.o) 3143051642 24492 /usr/conf/lib/libnet.a(miutil.o) 3907164226 1420 /usr/conf/lib/libnet.a(net_init.o) 3074086800 3496 /usr/conf/lib/libnet.a(nuls.o) 2421920661 1740 /usr/conf/lib/libnet.a(pass.o) 3149832669 1400 /usr/conf/lib/libnet.a(route.o) 3392649277 2312 /usr/conf/lib/libnet.a(spass.o) 1843431442 23508 /usr/conf/lib/libnet.a(stcpmap.o) 986210987 10256 /usr/conf/lib/libnet.a(tang.o) 1187498559 13828 /usr/conf/lib/libtun.a(tun-stream.o) 1947506110 4593 /usr/conf/master.d/net Networking.NMS2-KRN,fr=B.11.00,fa=HP-UX_B.11.00_32,v=HP: 3678762699 2568 /usr/conf/lib/libnms.a(nms.o) OS-Core.CORE2-KRN,fr=B.11.00,fa=HP-UX_B.11.00_64,v=HP: 3091237176 4696 /usr/conf/lib/libhp-ux.a(dgram_aud.o) 2314629172 27552 /usr/conf/lib/libhp-ux.a(uipc_mbuf.o) 1700661530 287112 /usr/conf/lib/libhp-ux.a(xport_diag.o) 3387674012 15928 /usr/conf/lib/libuipc.a(sys_socket.o) 1088163902 18208 /usr/conf/lib/libuipc.a(uipc_domain.o) 2776659862 59520 /usr/conf/lib/libuipc.a(uipc_init.o) 3763361301 2656 /usr/conf/lib/libuipc.a(uipc_proto.o) 1069684720 123968 /usr/conf/lib/libuipc.a(uipc_socket.o) 1328037674 51408 /usr/conf/lib/libuipc.a(uipc_socket2.o) 3948702452 73256 /usr/conf/lib/libuipc.a(uipc_syscall.o) 1714947545 49584 /usr/conf/lib/libuipc.a(uipc_tpi.o) 1422132866 35960 /usr/conf/lib/libuipc.a(uipc_usrreq.o) Networking.NET2-KRN,fr=B.11.00,fa=HP-UX_B.11.00_64,v=HP: 3895461802 79688 /usr/conf/lib/libinet.a(arp.o) 890666670 29480 /usr/conf/lib/libinet.a(igmp.o) 4091452614 2064 /usr/conf/lib/libinet.a(in.o) 398405707 4264 /usr/conf/lib/libinet.a(in_cksum.o) 1447973006 20864 /usr/conf/lib/libinet.a(in_proto.o) 517926363 6264 /usr/conf/lib/libinet.a(inet_init.o) 1292795691 291536 /usr/conf/lib/libinet.a(ip.o) 1193078461 148488 /usr/conf/lib/libinet.a(ip_if.o) 1389724771 50624 /usr/conf/lib/libinet.a(ip_ire.o) 3929814073 62800 /usr/conf/lib/libinet.a(ip_mroute.o) 3224472505 26800 /usr/conf/lib/libinet.a(ip_multi.o) 1555609317 2120 /usr/conf/lib/libinet.a(ipcsum.o) 3125111093 41552 /usr/conf/lib/libinet.a(rawip.o) 1989378353 6048 /usr/conf/lib/libinet.a(snmpcom.o) 2912536553 268496 /usr/conf/lib/libinet.a(tcp.o) 2513189799 60840 /usr/conf/lib/libinet.a(udp.o) 3444972708 22292 /usr/conf/lib/libipsectp.a 612276509 4128 /usr/conf/lib/libnet.a(af.o) 898435208 16608 /usr/conf/lib/libnet.a(if.o) 1576343057 5856 /usr/conf/lib/libnet.a(ip_info.o) 2038097726 4064 /usr/conf/lib/libnet.a(mialloc.o) 2117460376 12488 /usr/conf/lib/libnet.a(mind.o) 1737454384 9712 /usr/conf/lib/libnet.a(mioptcom.o) 2339559232 16960 /usr/conf/lib/libnet.a(mitimer.o) 631335346 65136 /usr/conf/lib/libnet.a(miutil.o) 809586890 2552 /usr/conf/lib/libnet.a(net_init.o) 48300861 7984 /usr/conf/lib/libnet.a(nuls.o) 812307784 4072 /usr/conf/lib/libnet.a(pass.o) 3383456750 6352 /usr/conf/lib/libnet.a(route.o) 2549436293 5408 /usr/conf/lib/libnet.a(spass.o) 1241005421 56168 /usr/conf/lib/libnet.a(stcpmap.o) 1372924283 23616 /usr/conf/lib/libnet.a(tang.o) 475603588 25976 /usr/conf/lib/libtun.a(tun-stream.o) 1526791736 4576 /usr/conf/master.d/net Networking.NMS2-KRN,fr=B.11.00,fa=HP-UX_B.11.00_64,v=HP: 48537004 5776 /usr/conf/lib/libnms.a(nms.o) Patch Conflicts: None Patch Dependencies: s700: 11.00: PHKL_21857 PHKL_22142 PHNE_27651 s800: 11.00: PHKL_21857 PHKL_22142 PHNE_27651 Hardware Dependencies: None Other Dependencies: None Supersedes: PHNE_13405 PHNE_13692 PHNE_14017 PHNE_14260 PHNE_14274 PHNE_14279 PHNE_14575 PHNE_14702 PHNE_14730 PHNE_14876 PHNE_15047 PHNE_15583 PHNE_15692 PHNE_15911 PHNE_15995 PHNE_16283 PHNE_16497 PHNE_16645 PHNE_17017 PHNE_17018 PHNE_17117 PHNE_17227 PHNE_17446 PHNE_17613 PHNE_17662 PHNE_18553 PHNE_18554 PHNE_18611 PHNE_18708 PHNE_19110 PHNE_19375 PHNE_19899 PHNE_20041 PHNE_20436 PHNE_20633 PHNE_20735 PHNE_21038 PHNE_21318 PHNE_21606 PHNE_21767 PHNE_21890 PHNE_22067 PHNE_22318 PHNE_22397 PHNE_22527 PHNE_22869 PHNE_23456 PHNE_24075 PHNE_24289 PHNE_24715 PHNE_25135 PHNE_25381 PHNE_25423 PHNE_26412 PHNE_26445 PHNE_26771 PHNE_27058 PHNE_27886 PHNE_28538 Equivalent Patches: None Patch Package Size: 1570 KBytes Installation Instructions: Please review all instructions and the Hewlett-Packard SupportLine User Guide or your Hewlett-Packard support terms and conditions for precautions, scope of license, restrictions, and, limitation of liability and warranties, before installing this patch. ------------------------------------------------------------ 1. Back up your system before installing a patch. 2. Login as root. 3. Copy the patch to the /tmp directory. 4. Move to the /tmp directory and unshar the patch: cd /tmp sh PHNE_29473 5. Run swinstall to install the patch: swinstall -x autoreboot=true -x patch_match_target=true \ -s /tmp/PHNE_29473.depot By default swinstall will archive the original software in /var/adm/sw/save/PHNE_29473. If you do not wish to retain a copy of the original software, include the patch_save_files option in the swinstall command above: -x patch_save_files=false WARNING: If patch_save_files is false when a patch is installed, the patch cannot be deinstalled. Please be careful when using this feature. For future reference, the contents of the PHNE_29473.text file is available in the product readme: swlist -l product -a readme -d @ /tmp/PHNE_29473.depot To put this patch on a magnetic tape and install from the tape drive, use the command: dd if=/tmp/PHNE_29473.depot of=/dev/rmt/0m bs=2k Special Installation Instructions: None