From owner-freebsd-bugs@FreeBSD.ORG Sun Dec 4 04:00:20 2005 Return-Path: X-Original-To: freebsd-bugs@hub.freebsd.org Delivered-To: freebsd-bugs@hub.freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 3AB8B16A420 for ; Sun, 4 Dec 2005 04:00:20 +0000 (GMT) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [216.136.204.21]) by mx1.FreeBSD.org (Postfix) with ESMTP id 3DA3D43D46 for ; Sun, 4 Dec 2005 04:00:19 +0000 (GMT) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1]) by freefall.freebsd.org (8.13.3/8.13.3) with ESMTP id jB440Jwa050053 for ; Sun, 4 Dec 2005 04:00:19 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.13.3/8.13.1/Submit) id jB440Jg3049895; Sun, 4 Dec 2005 04:00:19 GMT (envelope-from gnats) Resent-Date: Sun, 4 Dec 2005 04:00:19 GMT Resent-Message-Id: <200512040400.jB440Jg3049895@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-bugs@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, Evgeny Zislis Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 1E0F716A420 for ; Sun, 4 Dec 2005 03:56:14 +0000 (GMT) (envelope-from kesor@kesor.net) Received: from smtp1.actcom.co.il (smtp1.actcom.co.il [192.114.47.64]) by mx1.FreeBSD.org (Postfix) with ESMTP id 2464A43D4C for ; Sun, 4 Dec 2005 03:56:12 +0000 (GMT) (envelope-from kesor@kesor.net) Received: from mail.kesor.net (line133-201.adsl.actcom.co.il [192.115.133.201]) by smtp1.actcom.co.il (8.13.3/8.13.3) with ESMTP id jB43u5bx007102 for ; Sun, 4 Dec 2005 05:56:09 +0200 Received: from localhost (localhost [127.0.0.1]) by mail.kesor.net (Postfix) with ESMTP id 5E04C5D for ; Sun, 4 Dec 2005 05:56:01 +0200 (IST) Received: from mail.kesor.net ([127.0.0.1]) by localhost (monster.kesor.net [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 21468-09 for ; Sun, 4 Dec 2005 05:54:27 +0200 (IST) Received: from thinky5e.kesor.net (thinky5e [192.168.1.45]) by mail.kesor.net (Postfix) with ESMTP id 1D56559 for ; Sun, 4 Dec 2005 05:54:19 +0200 (IST) Received: from thinky5e.kesor.net (localhost [127.0.0.1]) by thinky5e.kesor.net (8.13.4/8.13.4) with ESMTP id jB43oSsK000830 for ; Sun, 4 Dec 2005 05:50:28 +0200 (IST) (envelope-from kesor@thinky5e.kesor.net) Received: (from kesor@localhost) by thinky5e.kesor.net (8.13.4/8.13.4/Submit) id jB43oSaa000829; Sun, 4 Dec 2005 05:50:28 +0200 (IST) (envelope-from kesor) Message-Id: <200512040350.jB43oSaa000829@thinky5e.kesor.net> Date: Sun, 4 Dec 2005 05:50:28 +0200 (IST) From: Evgeny Zislis To: FreeBSD-gnats-submit@FreeBSD.org X-Send-Pr-Version: 3.113 Cc: Subject: kern/89918: Kernel panic with if_iwi Intel 2200bg X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: Evgeny Zislis List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 04 Dec 2005 04:00:20 -0000 >Number: 89918 >Category: kern >Synopsis: Kernel panic with if_iwi Intel 2200bg >Confidential: no >Severity: critical >Priority: high >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Sun Dec 04 04:00:18 GMT 2005 >Closed-Date: >Last-Modified: >Originator: Evgeny Zislis >Release: FreeBSD 6.0-STABLE i386 >Organization: None >Environment: System: FreeBSD thinky5e.kesor.net 6.0-STABLE FreeBSD 6.0-STABLE #: Sun Dec 4 05:09:00 IST 2005 root@thinky5e.kesor.net:/usr/obj/usr/src/sys/THINKY5E.debug i386 >Description: On a Lenovo ThinkPad R50e with build-in Intel 2200BG wifi, the if_iwi driver panics the kernel on a 6.0-STABLE system. >How-To-Repeat: run a script with something like : ifconfig iwi0 down ifconfig iwi0 ssid "blabla" bssid 00:C0:02:FA:49:2E channel 5 ifconfig iwi0 wepmode on wepkey 0xB9F6F7EB7C4A10E702AA989BFB ifconfig iwi0 roaming manual iwicontrol iwi0 -d /usr/local/share/iwi-firmware ifconfig iwi0 up (the bssid and wepkey are fictive) Then try to : 1) run kismet_server on this card or 2) run `ifconfig mode 11g` or 3) random requests to iwi0 with your fav. software >Fix: Dont know how to fix it, but here is useful information : Kernel backtrace after panic, (kgdb) backtrace #0 doadump () at pcpu.h:165 During symbol reading, Incomplete CFI data; unspecified registers at 0xc05ae853. #1 0xc05aede2 in boot (howto=0x104) at /usr/src/sys/kern/kern_shutdown.c:399 #2 0xc05af158 in panic (fmt=0xc07c6e41 "mutex %s recursed at %s:%d") at /usr/src/sys/kern/kern_shutdown.c:555 #3 0xc05a4262 in _mtx_assert (m=0xc3632b6c, what=0x0, file=0xc07c8412 "/usr/src/sys/kern/kern_synch.c", line=0xbc) at /usr/src/sys/kern/kern_mutex.c:748 #4 0xc05b65f9 in msleep (ident=0xc3632000, mtx=0xc3632b6c, priority=0x0, wmesg=0xc3bc0661 "iwiinit", timo=0x3e8) at /usr/src/sys/kern/kern_synch.c:188 #5 0xc3bbdb93 in iwi_load_firmware (sc=0xc3632000, fw=0x1, size=0x27050) at cpu func.h:210 #6 0xc3bbdecf in iwi_load_firmware (sc=0x34, fw=0xc3632000, size=0xc3632b6c) at bus.h:542 #7 0xc3bbecd9 in iwi_init (priv=0xc3400c00) at /usr/src/sys/modules/iwi/../../dev/iwi/if_iwi.c:2265 #8 0xc0636dd9 in ifmedia_ioctl (ifp=0xc3400c00, ifr=0xc3902060, ifm=0xc3632904, cmd=0x0) at /usr/src/sys/net/if_media.c:258 #9 0xc065793b in ieee80211_ioctl (ic=0xc3632004, cmd=0xc0206937, data=0xc34cc040 "iwi0") at /usr/src/sys/net80211/ieee80211_ioctl.c:2403 #10 0xc3bbed58 in iwi_init (priv=0xc3632000) at /usr/src/sys/modules/iwi/../../dev/iwi/if_iwi.c:2534 #11 0xc06325c7 in ifhwioctl (cmd=0xc0206937, ifp=0xc3400c00, data=0xc34cc040 "iwi0", td=0x0) at /usr/src/sys/net/if.c:1441 #12 0xc06327e1 in ifioctl (so=0xc35ab2c8, cmd=0xc0206937, data=0xc34cc040 "iwi0", td=0xc3896480) at /usr/src/sys/net/if.c:1513 #13 0xc05e1daf in soo_ioctl (fp=0x0, cmd=0xc0206937, data=0xc34cc040, active_cred=0xc38cbd00, td=0xc3896480) at /usr/src/sys/kern/sys_socket.c:214 #14 0xc05dab2d in ioctl (td=0xc3896480, uap=0xde687d04) at file.h:258 #15 0xc0774720 in syscall (frame= {tf_fs = 0xc076003b, tf_es = 0x3b, tf_ds = 0x3b, tf_edi = 0x8058100, tf_esi = 0xbfbfedae, tf_ebp = 0xbfbfe418, tf_isp = 0xde687d64, tf_ebx = 0x805d000, tf_edx = 0x3, tf_ecx = 0x805a400, tf_eax = 0x36, tf_trapno = 0xc, tf_err = 0x2, tf_eip = 0x2814e1b7, tf_cs = 0x33, tf_eflags = 0x246, tf_esp = 0xbfbfe3fc, tf_ss = 0x3b}) at /usr/src/sys/i386/i386/trap.c:981 #16 0xc07610cf in Xint0x80_syscall () at /usr/src/sys/i386/i386/exception.s:200 #17 0x00000033 in ?? () Previous frame inner to this frame (corrupt stack?) Note: Backtrace is same when if_iwi is in kernel, or as a kernel module. >Release-Note: >Audit-Trail: >Unformatted: