Panic while using ural(4) with wpa_supplicant

From: Damian Gerow <dgerow_at_afflictions.org>
Date: Fri, 12 Dec 2008 00:41:38 -0500
Though I've got an iwn(4), it's a 5300, which isn't yet supported.  In the
meantime, I'm trying to use one of the Nintendo WiFi USB sticks to provide
cheap wireless network capabilities.  However, when I try to use it, I
invariably receive a panic.

Note that I've not yet tried just using ural(4) without wpa_supplicant, as I
don't have any open or WEP-protected networks against which to test.

OS is a CURRENT from the morning of Dec 12.  Kernel is GENERIC.  Host has
an established em(4) connection, and rc.conf contains the following
pertinent entries:

-----
#wlans_ural0="wlan0"
ifconfig_wlan0="WPA DHCP"
-----

Steps to Reproduce:

1) Plug in the ural(4) device:

-----
ural0: <Nintendo Nintendo Wi-Fi USB Connector, class 0/0, rev 2.00/0.01, addr 3> on uhub7
ural0: MAC/BBP RT2570 (rev 0x05), RF RT2526
ural0: WARNING: using obsoleted IFF_NEEDSGIANT flag
-----

2) Prepare wlan0:

-----
# ifconfig wlan0 create wlandev ural0
-----

3) Wait for network connection to establish.

wpa_supplicant will kick off, establish a connection, and dhclient will
negotiate an IP address.  At this point, triggering the panic can be done
in a few ways:

a) Sometimes it happens on its own, immediately.
b) Performing network activity.
c) Stopping wlan0 (/etc/rc.d/netif stop).
d) Physically removing ural0.

Most reliable is c (thus, by extension, d).

4) Observe the panic:

-----
panic: _rw_rlock (radix node head): wlock already held _at_ /repo/freebsd/8-CURRENT/src/sys/net/route.c: 291
-----

Here's the kgdb output:

-----
# cd /usr/obj/repo/freebsd/8-CURRENT/src/sys/GENERIC
# kgdb kernel.debug /var/crash/vmcore.1
GNU gdb 6.1.1 [FreeBSD]
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "amd64-marcel-freebsd"...

Unread portion of the kernel message buffer:


Fatal trap 12: page fault while in kernel mode
cpuid = 0; apic id = 00
fault virtual address	= 0x40
fault code		= supervisor read data, page not present
instruction pointer	= 0x8:0xffffffff80436da5
stack pointer	        = 0x10:0xfffffffeb3e62b10
frame pointer	        = 0x10:0xfffffffeb3e62b20
code segment		= base 0x0, limit 0xfffff, type 0x1b
			= DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags	= interrupt enabled, resume, IOPL = 0
current process		= 12 (irq19: ehci1)
panic: from debugger
cpuid = 0
Uptime: 1m58s
Physical memory: 3976 MB
Dumping 302 MB: 287 271 255 239 223 207 191 175 159 143 127 111 95 79 63 47 31 15

Reading symbols from /boot/kernel/geom_eli.ko...Reading symbols from /boot/kernel/geom_eli.ko.symbols...done.
done.
Loaded symbols for /boot/kernel/geom_eli.ko
Reading symbols from /boot/kernel/crypto.ko...Reading symbols from /boot/kernel/crypto.ko.symbols...done.
done.
Loaded symbols for /boot/kernel/crypto.ko
Reading symbols from /boot/kernel/zlib.ko...Reading symbols from /boot/kernel/zlib.ko.symbols...done.
done.
Loaded symbols for /boot/kernel/zlib.ko
Reading symbols from /boot/kernel/zfs.ko...Reading symbols from /boot/kernel/zfs.ko.symbols...done.
done.
Loaded symbols for /boot/kernel/zfs.ko
Reading symbols from /boot/kernel/opensolaris.ko...Reading symbols from /boot/kernel/opensolaris.ko.symbols...done.
done.
Loaded symbols for /boot/kernel/opensolaris.ko
Reading symbols from /boot/kernel/i915.ko...Reading symbols from /boot/kernel/i915.ko.symbols...done.
done.
Loaded symbols for /boot/kernel/i915.ko
Reading symbols from /boot/kernel/drm.ko...Reading symbols from /boot/kernel/drm.ko.symbols...done.
done.
Loaded symbols for /boot/kernel/drm.ko
#0  doadump () at pcpu.h:196
196		__asm __volatile("movq %%gs:0,%0" : "=r" (td));
(kgdb) list *0xffffffff80436da5
0xffffffff80436da5 is in ehci_idone (/repo/freebsd/8-CURRENT/src/sys/dev/usb/ehci.c:914).
909		nextphys = EHCI_LINK_ADDR(le32toh(epipe->sqh->qh.qh_qtd.qtd_next));
910		altnextphys =
911		    EHCI_LINK_ADDR(le32toh(epipe->sqh->qh.qh_qtd.qtd_altnext));
912		for (sqtd = ex->sqtdstart; sqtd != ex->sqtdend->nextqtd;
913		     sqtd = sqtd->nextqtd) {
914			if (sqtd->physaddr == nextphys) {
915				epipe->sqh->qh.qh_qtd.qtd_next =
916				    htole32(ex->sqtdend->nextqtd->physaddr);
917				DPRINTFN(4, ("ehci_idone: updated overlay next ptr\n"));
918	
(kgdb) backtrace
#0  doadump () at pcpu.h:196
#1  0xffffffff804fc3f0 in boot (howto=260) at /repo/freebsd/8-CURRENT/src/sys/kern/kern_shutdown.c:420
#2  0xffffffff804fc756 in panic (fmt=Variable "fmt" is not available.
) at /repo/freebsd/8-CURRENT/src/sys/kern/kern_shutdown.c:576
#3  0xffffffff801c38aa in db_panic (addr=Variable "addr" is not available.
) at /repo/freebsd/8-CURRENT/src/sys/ddb/db_command.c:478
#4  0xffffffff801c3e53 in db_command (last_cmdp=0xffffffff80b00d20, cmd_table=Variable "cmd_table" is not available.
) at /repo/freebsd/8-CURRENT/src/sys/ddb/db_command.c:445
#5  0xffffffff801c3f9d in db_command_loop () at /repo/freebsd/8-CURRENT/src/sys/ddb/db_command.c:498
#6  0xffffffff801c5de6 in db_trap (type=Variable "type" is not available.
) at /repo/freebsd/8-CURRENT/src/sys/ddb/db_main.c:229
#7  0xffffffff80529c13 in kdb_trap (type=12, code=0, tf=0xfffffffeb3e62a60) at /repo/freebsd/8-CURRENT/src/sys/kern/subr_kdb.c:534
#8  0xffffffff807a820d in trap_fatal (frame=0xfffffffeb3e62a60, eva=64) at /repo/freebsd/8-CURRENT/src/sys/amd64/amd64/trap.c:754
#9  0xffffffff807a8437 in trap_pfault (frame=0xfffffffeb3e62a60, usermode=0) at /repo/freebsd/8-CURRENT/src/sys/amd64/amd64/trap.c:675
#10 0xffffffff807a8e26 in trap (frame=0xfffffffeb3e62a60) at /repo/freebsd/8-CURRENT/src/sys/amd64/amd64/trap.c:444
#11 0xffffffff8078bbae in calltrap () at /repo/freebsd/8-CURRENT/src/sys/amd64/amd64/exception.S:217
#12 0xffffffff80436da5 in ehci_idone (ex=0xffffff0003ab5c00) at /repo/freebsd/8-CURRENT/src/sys/dev/usb/ehci.c:912
#13 0xffffffff804376b0 in ehci_softintr (v=0xffffff0003ab5c00) at /repo/freebsd/8-CURRENT/src/sys/dev/usb/ehci.c:802
#14 0xffffffff80465505 in usb_schedsoftintr (bus=Variable "bus" is not available.
) at /repo/freebsd/8-CURRENT/src/sys/dev/usb/usb.c:848
#15 0xffffffff8043923d in ehci_intr1 (sc=0xffffff000355a000) at /repo/freebsd/8-CURRENT/src/sys/dev/usb/ehci.c:631
#16 0xffffffff80439d52 in ehci_intr (v=Variable "v" is not available.
) at /repo/freebsd/8-CURRENT/src/sys/dev/usb/ehci.c:590
#17 0xffffffff804ddd5a in intr_event_execute_handlers (p=Variable "p" is not available.
) at /repo/freebsd/8-CURRENT/src/sys/kern/kern_intr.c:1134
#18 0xffffffff804de91d in ithread_loop (arg=Variable "arg" is not available.
) at /repo/freebsd/8-CURRENT/src/sys/kern/kern_intr.c:1147
#19 0xffffffff804dbd76 in fork_exit (callout=0xffffffff804de85f <ithread_loop>, arg=0xffffff000360ea60, frame=0xfffffffeb3e62c90)
    at /repo/freebsd/8-CURRENT/src/sys/kern/kern_fork.c:821
#20 0xffffffff8078bfbe in fork_trampoline () at /repo/freebsd/8-CURRENT/src/sys/amd64/amd64/exception.S:521
#21 0x0000000000000000 in ?? ()
#22 0x0000000000000000 in ?? ()
#23 0x0000000000000001 in ?? ()
#24 0x0000000000000000 in ?? ()
#25 0x0000000000000000 in ?? ()
#26 0x0000000000000000 in ?? ()
#27 0x0000000000000000 in ?? ()
#28 0x0000000000000000 in ?? ()
#29 0x0000000000000000 in ?? ()
#30 0x0000000000000000 in ?? ()
#31 0x0000000000000000 in ?? ()
#32 0x0000000000000000 in ?? ()
#33 0x0000000000000000 in ?? ()
#34 0x0000000000000000 in ?? ()
#35 0x0000000000000000 in ?? ()
#36 0x0000000000000000 in ?? ()
#37 0x0000000000000000 in ?? ()
#38 0x0000000000000000 in ?? ()
#39 0x0000000000000000 in ?? ()
#40 0x0000000000000000 in ?? ()
#41 0x0000000000000000 in ?? ()
#42 0x0000000000000000 in ?? ()
#43 0x0000000000000000 in ?? ()
#44 0x0000000000000000 in ?? ()
#45 0x0000000000ee3000 in ?? ()
#46 0x0000000000000000 in ?? ()
#47 0xffffffff80b3dac0 in affinity ()
#48 0xffffffff80b3dac0 in affinity ()
#49 0xffffff00014d3390 in ?? ()
#50 0xfffffffeb3e62b90 in ?? ()
#51 0xfffffffeb3e62b48 in ?? ()
#52 0xffffff00035b4720 in ?? ()
#53 0xffffffff8051dec6 in sched_switch (td=0xffffff000360ea60, newtd=0xffffffff804de85f, flags=Cannot access memory at address 0xffffffffffffffc0
) at /repo/freebsd/8-CURRENT/src/sys/kern/sched_ule.c:1848
Previous frame inner to this frame (corrupt stack?)
(kgdb)
-----
Received on Fri Dec 12 2008 - 04:57:09 UTC

This archive was generated by hypermail 2.4.0 : Wed May 19 2021 - 11:39:38 UTC