From owner-freebsd-bugs@freebsd.org Sun Aug 27 06:46:27 2017 Return-Path: Delivered-To: freebsd-bugs@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id B9C82DE8E79 for ; Sun, 27 Aug 2017 06:46:27 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from kenobi.freebsd.org (kenobi.freebsd.org [IPv6:2001:1900:2254:206a::16:76]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id A722767BDF for ; Sun, 27 Aug 2017 06:46:27 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from bugs.freebsd.org ([127.0.1.118]) by kenobi.freebsd.org (8.15.2/8.15.2) with ESMTP id v7R6kR0j064227 for ; Sun, 27 Aug 2017 06:46:27 GMT (envelope-from bugzilla-noreply@freebsd.org) From: bugzilla-noreply@freebsd.org To: freebsd-bugs@FreeBSD.org Subject: [Bug 221845] bridge0 causes kernel panic on BBB using usb wifi in hostap mode (RT3071) Date: Sun, 27 Aug 2017 06:46:27 +0000 X-Bugzilla-Reason: AssignedTo X-Bugzilla-Type: new X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: Base System X-Bugzilla-Component: kern X-Bugzilla-Version: CURRENT X-Bugzilla-Keywords: X-Bugzilla-Severity: Affects Only Me X-Bugzilla-Who: russ.haley@gmail.com X-Bugzilla-Status: New X-Bugzilla-Resolution: X-Bugzilla-Priority: --- X-Bugzilla-Assigned-To: freebsd-bugs@FreeBSD.org X-Bugzilla-Flags: X-Bugzilla-Changed-Fields: bug_id short_desc product version rep_platform op_sys bug_status bug_severity priority component assigned_to reporter attachments.created Message-ID: Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Bugzilla-URL: https://bugs.freebsd.org/bugzilla/ Auto-Submitted: auto-generated MIME-Version: 1.0 X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 27 Aug 2017 06:46:27 -0000 https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D221845 Bug ID: 221845 Summary: bridge0 causes kernel panic on BBB using usb wifi in hostap mode (RT3071) Product: Base System Version: CURRENT Hardware: arm OS: Any Status: New Severity: Affects Only Me Priority: --- Component: kern Assignee: freebsd-bugs@FreeBSD.org Reporter: russ.haley@gmail.com Created attachment 185799 --> https://bugs.freebsd.org/bugzilla/attachment.cgi?id=3D185799&action= =3Dedit Kernel panic caused by client request for web page. Running BBB through ftdi cable.=20 Asus WiFi Adapter, RT3071 chipset https://wikidevi.com/files/Ralink/RT307x%20product%20brief.pdf root@bbb:~ # uname -a FreeBSD bbb.highfell.local 12.0-CURRENT FreeBSD 12.0-CURRENT #7 r321601M: T= hu Aug 17 22:13:21 PDT 2017=20=20=20=20 russellh@prescott.highfell.local:/usr/home/russellh/FreeBSD/rh-armv6/obj/ar= m.armv6/usr/home/russellh/FreeBSD/rh-armv6/src/sys/BEAGLEBONE-MMCCAM arm root@bbb:~ # cat /boot/loader.conf=20 if_run0_load=3D"YES" wlan_mac_load=3D"YES" root@bbb:~ # cat /etc/rc.conf hostname=3D"bbb.highfell.local" ifconfig_cpsw0=3D"inet 192.168.2.101 netmask 255.255.255.0" defaultrouter=3D"192.168.2.1" hostapd_enable=3D"YES" wlans_run0=3D"wlan0" create_args_wlan0=3D"wlanmode hostap" ifconfig_wlan0=3D"up" #gateway_enable=3D"YES"=20 cloned_interfaces=3D"bridge0" ifconfig_bridge0=3D"addm cpsw0 addm wlan0 up" sshd_enable=3D"YES" sendmail_enable=3D"NONE" sendmail_submit_enable=3D"NO" sendmail_outbound_enable=3D"NO" sendmail_msp_queue_enable=3D"NO" growfs_enable=3D"YES" root@bbb:~ # cat /etc/hostapd.conf=20 interface=3Dwlan0 debug=3D1 ctrl_interface=3D/var/run/hostapd ctrl_interface_group=3Dwheel ssid=3Dfreebsd wpa=3D2 wpa_passphrase=3Dtesting wpa_key_mgmt=3DWPA-PSK wpa_pairwise=3DCCMP root@bbb:~ # cat /etc/resolv.conf=20 # Generated by resolvconf nameserver 192.168.2.1 Hi! So I'm only partially successful repeating your test so far, but I can caus= e a kernel panic! The following are my observations: 1) Before the kernel loads, loader give the following errors: can't find 'if_run' can't find 'wlan_mac' 2) It seems the run0 usb wi-fi interface only comes up after the bridge0 is already enabled. dmesg does NOT capture the output from the failed attempt = to add the non-existent wlan0 interface. However, I grabbed it from the boot output in the serial console: #From dmesg: ugen1.2: at usbus1 random: unblocking device. bridge0: Ethernet address: 02:94:dd:d7:a3:00 cpsw0: link state changed to DOWN cpsw0: promiscuous mode enabled bridge0: link state changed to DOWN cpsw0: link state changed to UP bridge0: link state changed to UP run0 on uhub1 run0: <1.0> on usbus1 run0: MAC/BBP RT3572 (rev 0x0223), RF RT3052 (MIMO 2T2R), address 60:a4:4c:ec:c9:a5 ieee80211_load_module: load the wlan_amrr module by hand for now. wlan0: Ethernet address: 60:a4:4c:ec:c9:a5 run0: firmware RT3071 ver. 0.33 loaded #From console grab: eeding entropy: . ifconfig: SIOCIFCREATE2: Invalid argument bridge0: Ethernet address: 02:94:dd:d7:a3:00 Created clone interfaces: bridge0. cpsw0: link state changed to DOWN cpsw0: promiscuous mode enabled bridge0: link state changed to DOWN ifconfig: BRDGADD wlan0: No such file or directory cpsw0: link state changed to UP bridge0: link state changed to UP Starting Network: lo0 cpsw0 bridge0. lo0: flags=3D8049 metric 0 mtu 16384 options=3D600003 inet6 ::1 prefixlen 128=20 inet6 fe80::1%lo0 prefixlen 64 scopeid 0x2=20 inet 127.0.0.1 netmask 0xff000000=20 groups: lo=20 nd6 options=3D21 cpsw0: flags=3D8943 metric = 0 mtu 1500 options=3D8000b ether a0:f6:fd:8a:c5:be hwaddr a0:f6:fd:8a:c5:be inet 192.168.2.101 netmask 0xffffff00 broadcast 192.168.2.255=20 media: Ethernet autoselect (100baseTX ) status: active nd6 options=3D29 bridge0: flags=3D8843 metric 0 mtu = 1500 ether 02:94:dd:d7:a3:00 id 00:00:00:00:00:00 priority 32768 hellotime 2 fwddelay 15 maxage 20 holdcnt 6 proto rstp maxaddr 2000 timeout 1200 root id 00:00:00:00:00:00 priority 32768 ifcost 0 port 0 member: cpsw0 flags=3D143 ifmaxaddr 0 port 1 priority 128 path cost 55 groups: bridge=20 nd6 options=3D9 Starting devd. run0 on uhub1 run0: <1.0> on usbus1 run0: MAC/BBP RT3572 (rev 0x0223), RF RT3052 (MIMO 2T2R), address 60:a4:4c:ec:c9:a5 ieee80211_load_module: load the wlan_amrr module by hand for now. wlan0: Ethernet address: 60:a4:4c:ec:c9:a5 Created wlan(4) interfaces: wlan0. run0: firmware RT3071 ver. 0.33 loaded Starting Network: wlan0. wlan0: flags=3D8843 metric 0 mtu 15= 00 ether 60:a4:4c:ec:c9:a5 hwaddr 60:a4:4c:ec:c9:a5 groups: wlan=20 ssid "" channel 11 (2462 MHz 11g) regdomain FCC country US authmode OPEN privacy OFF txpower 30 scanvalid 60 protmode CTS wme dtimperiod 1 -dfs bintval 0 media: IEEE 802.11 Wireless Ethernet autoselect (autoselect ) status: no carrier nd6 options=3D29 add host 127.0.0.1: gateway lo0 fib 0: route already in table add net default: gateway 192.168.2.1 add host ::1: gateway lo0 fib 0: route already in table *Something else to note about this setup output is that wlan0 did NOT get t= he ssid or the security setup from /etc/hostapd.conf After boot I manually add the wlan0 to the bridge and then set the ssid root@bbb:~ # ifconfig bridge0 addm wlan0 root@bbb:~ # ifconfig wlan0 ssid freebsd I brought the interface down and back up again which made the AP is availab= le to the clients. I open the ipod and get the system to associate with the ap= and enter the following information static IP address: 192.168.2.102 subnet: 255.255.255.0 router: 192.168.2.1 dns : 192.168.1 After numerous wrong attempts at configuring the client, I managed to get exactly ONE request through. The freebsd.org page came up. I then tried to search for the ookla page and my bbb kernel paniced! (yay!) https://pastebin.com/zB9AnWTv The next time I booted the entire board hung right after the usb wifi adapt= er loaded (chop of hung board output, full output here https://pastebin.com/M09C5NEP): cpsw0: link state changed to UP bridge0: link state changed to UP Starting Network: lo0 cpsw0 bridge0. lo0: flags=3D8049 metric 0 mtu 16384 options=3D600003 inet6 ::1 prefixlen 128=20 inet6 fe80::1%lo0 prefixlen 64 scopeid 0x2=20 inet 127.0.0.1 netmask 0xff000000=20 groups: lo=20 nd6 options=3D21 cpsw0: flags=3D8943 metric = 0 mtu 1500 options=3D8000b ether a0:f6:fd:8a:c5:be hwaddr a0:f6:fd:8a:c5:be inet 192.168.2.101 netmask 0xffffff00 broadcast 192.168.2.255=20 media: Ethernet autoselect (100baseTX ) status: active nd6 options=3D29 bridge0: flags=3D8843 metric 0 mtu = 1500 ether 02:94:dd:d7:a3:00 id 00:00:00:00:00:00 priority 32768 hellotime 2 fwddelay 15 maxage 20 holdcnt 6 proto rstp maxaddr 2000 timeout 1200 root id 00:00:00:00:00:00 priority 32768 ifcost 0 port 0 member: cpsw0 flags=3D143 ifmaxaddr 0 port 1 priority 128 path cost 55 groups: bridge=20 nd6 options=3D9 Starting devd. run0 on uhub1 run0: <1.0> on usbus1 U-Boot SPL 2015.10-00001-g143c9ee (Nov 06 2015 - 15:27:19) bad magic I can cause the entire OS to hang it seems. Sometimes it boots, sometimes it hangs. The lights on the cpsw0 interface still blink but the serial console= is dead. I'm trying to *avoid* triggering that so I don't know the sequence th= at's causing it. However, I can cause the kernel to panic relatively quickly aft= er a handful of pages. No more than three full page requests so far. It seems t= here is a bad memory happening in bridge_broadcast() at bridge_broadcast+0x1c4?= =20 https://www.freebsd.org/cgi/man.cgi?apropos=3D0&sektion=3D9&query=3Dm_dup Anyway, that's all the time I have for this weekend. --=20 You are receiving this mail because: You are the assignee for the bug.=