From kesor@kesor.net  Sun Dec  4 03:56:14 2005
Return-Path: <kesor@kesor.net>
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 1E0F716A420
	for <FreeBSD-gnats-submit@freebsd.org>; Sun,  4 Dec 2005 03:56:14 +0000 (GMT)
	(envelope-from kesor@kesor.net)
Received: from smtp1.actcom.co.il (smtp1.actcom.co.il [192.114.47.64])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 2464A43D4C
	for <FreeBSD-gnats-submit@freebsd.org>; Sun,  4 Dec 2005 03:56:12 +0000 (GMT)
	(envelope-from kesor@kesor.net)
Received: from mail.kesor.net (line133-201.adsl.actcom.co.il [192.115.133.201])
	by smtp1.actcom.co.il (8.13.3/8.13.3) with ESMTP id jB43u5bx007102
	for <FreeBSD-gnats-submit@freebsd.org>; Sun, 4 Dec 2005 05:56:09 +0200
Received: from localhost (localhost [127.0.0.1])
	by mail.kesor.net (Postfix) with ESMTP id 5E04C5D
	for <FreeBSD-gnats-submit@freebsd.org>; Sun,  4 Dec 2005 05:56:01 +0200 (IST)
Received: from mail.kesor.net ([127.0.0.1])
 by localhost (monster.kesor.net [127.0.0.1]) (amavisd-new, port 10024)
 with ESMTP id 21468-09 for <FreeBSD-gnats-submit@freebsd.org>;
 Sun,  4 Dec 2005 05:54:27 +0200 (IST)
Received: from thinky5e.kesor.net (thinky5e [192.168.1.45])
	by mail.kesor.net (Postfix) with ESMTP id 1D56559
	for <FreeBSD-gnats-submit@freebsd.org>; Sun,  4 Dec 2005 05:54:19 +0200 (IST)
Received: from thinky5e.kesor.net (localhost [127.0.0.1])
	by thinky5e.kesor.net (8.13.4/8.13.4) with ESMTP id jB43oSsK000830
	for <FreeBSD-gnats-submit@freebsd.org>; Sun, 4 Dec 2005 05:50:28 +0200 (IST)
	(envelope-from kesor@thinky5e.kesor.net)
Received: (from kesor@localhost)
	by thinky5e.kesor.net (8.13.4/8.13.4/Submit) id jB43oSaa000829;
	Sun, 4 Dec 2005 05:50:28 +0200 (IST)
	(envelope-from kesor)
Message-Id: <200512040350.jB43oSaa000829@thinky5e.kesor.net>
Date: Sun, 4 Dec 2005 05:50:28 +0200 (IST)
From: Evgeny Zislis <kesor@kesor.net>
Reply-To: Evgeny Zislis <kesor@kesor.net>
To: FreeBSD-gnats-submit@freebsd.org
Cc:
Subject: Kernel panic with if_iwi Intel 2200bg
X-Send-Pr-Version: 3.113
X-GNATS-Notify:

>Number:         89918
>Category:       kern
>Synopsis:       [iwi] [panic] Kernel panic with if_iwi Intel 2200bg
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    freebsd-bugs
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Sun Dec 04 04:00:18 GMT 2005
>Closed-Date:    Sat May 17 11:47:26 UTC 2008
>Last-Modified:  Sat May 17 11:47:26 UTC 2008
>Originator:     Evgeny Zislis
>Release:        FreeBSD 6.0-STABLE i386
>Organization:
None
>Environment:
System: FreeBSD thinky5e.kesor.net 6.0-STABLE FreeBSD 6.0-STABLE #: Sun Dec 4 05:09:00 IST 2005 root@thinky5e.kesor.net:/usr/obj/usr/src/sys/THINKY5E.debug i386

>Description:
	On a Lenovo ThinkPad R50e with build-in Intel 2200BG wifi,
	the if_iwi driver panics the kernel on a 6.0-STABLE system.

>How-To-Repeat:
	run a script with something like :

	ifconfig iwi0 down
	ifconfig iwi0 ssid "blabla" bssid 00:C0:02:FA:49:2E channel 5
	ifconfig iwi0 wepmode on wepkey 0xB9F6F7EB7C4A10E702AA989BFB
	ifconfig iwi0 roaming manual
	iwicontrol iwi0 -d /usr/local/share/iwi-firmware
	ifconfig iwi0 up
	(the bssid and wepkey are fictive)

	Then try to :
	1) run kismet_server on this card
	or
	2) run `ifconfig mode 11g`
	or
	3) random requests to iwi0 with your fav. software
	

>Fix:

	Dont know how to fix it, but here is useful information :

	Kernel backtrace after panic,

(kgdb) backtrace
#0  doadump () at pcpu.h:165
During symbol reading, Incomplete CFI data; unspecified registers at 0xc05ae853.

#1  0xc05aede2 in boot (howto=0x104) at /usr/src/sys/kern/kern_shutdown.c:399
#2  0xc05af158 in panic (fmt=0xc07c6e41 "mutex %s recursed at %s:%d") at /usr/src/sys/kern/kern_shutdown.c:555
#3  0xc05a4262 in _mtx_assert (m=0xc3632b6c, what=0x0, file=0xc07c8412 "/usr/src/sys/kern/kern_synch.c", line=0xbc) at /usr/src/sys/kern/kern_mutex.c:748
#4  0xc05b65f9 in msleep (ident=0xc3632000, mtx=0xc3632b6c, priority=0x0, wmesg=0xc3bc0661 "iwiinit", timo=0x3e8) at /usr/src/sys/kern/kern_synch.c:188
#5  0xc3bbdb93 in iwi_load_firmware (sc=0xc3632000, fw=0x1, size=0x27050) at cpu func.h:210
#6  0xc3bbdecf in iwi_load_firmware (sc=0x34, fw=0xc3632000, size=0xc3632b6c) at bus.h:542
#7  0xc3bbecd9 in iwi_init (priv=0xc3400c00) at /usr/src/sys/modules/iwi/../../dev/iwi/if_iwi.c:2265
#8  0xc0636dd9 in ifmedia_ioctl (ifp=0xc3400c00, ifr=0xc3902060, ifm=0xc3632904, cmd=0x0) at /usr/src/sys/net/if_media.c:258
#9  0xc065793b in ieee80211_ioctl (ic=0xc3632004, cmd=0xc0206937, data=0xc34cc040 "iwi0") at /usr/src/sys/net80211/ieee80211_ioctl.c:2403
#10 0xc3bbed58 in iwi_init (priv=0xc3632000) at /usr/src/sys/modules/iwi/../../dev/iwi/if_iwi.c:2534
#11 0xc06325c7 in ifhwioctl (cmd=0xc0206937, ifp=0xc3400c00, data=0xc34cc040 "iwi0", td=0x0) at /usr/src/sys/net/if.c:1441
#12 0xc06327e1 in ifioctl (so=0xc35ab2c8, cmd=0xc0206937, data=0xc34cc040 "iwi0", td=0xc3896480) at /usr/src/sys/net/if.c:1513
#13 0xc05e1daf in soo_ioctl (fp=0x0, cmd=0xc0206937, data=0xc34cc040, active_cred=0xc38cbd00, td=0xc3896480) at /usr/src/sys/kern/sys_socket.c:214
#14 0xc05dab2d in ioctl (td=0xc3896480, uap=0xde687d04) at file.h:258
#15 0xc0774720 in syscall (frame= {tf_fs = 0xc076003b, tf_es = 0x3b, tf_ds = 0x3b, tf_edi = 0x8058100, tf_esi = 0xbfbfedae, tf_ebp = 0xbfbfe418, tf_isp = 0xde687d64, tf_ebx = 0x805d000, tf_edx = 0x3, tf_ecx = 0x805a400, tf_eax = 0x36, tf_trapno = 0xc, tf_err = 0x2, tf_eip = 0x2814e1b7, tf_cs = 0x33, tf_eflags = 0x246, tf_esp = 0xbfbfe3fc, tf_ss = 0x3b}) at /usr/src/sys/i386/i386/trap.c:981
#16 0xc07610cf in Xint0x80_syscall () at /usr/src/sys/i386/i386/exception.s:200
#17 0x00000033 in ?? ()
Previous frame inner to this frame (corrupt stack?)


	Note: Backtrace is same when if_iwi is in kernel, or as a kernel module.
>Release-Note:
>Audit-Trail:
Responsible-Changed-From-To: freebsd-bugs->damien 
Responsible-Changed-By: philip 
Responsible-Changed-When: Sun Dec 4 10:43:11 GMT 2005 
Responsible-Changed-Why:  
Assign to if_iwi maintainer. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=89918 
Responsible-Changed-From-To: damien->freebsd-bugs 
Responsible-Changed-By: linimon 
Responsible-Changed-When: Thu Mar 30 08:34:21 UTC 2006 
Responsible-Changed-Why:  
Assignee is no longer working on FreeBSD drivers. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=89918 
State-Changed-From-To: open->feedback 
State-Changed-By: matteo 
State-Changed-When: Sab 17 Mag 2008 10:47:25 UTC 
State-Changed-Why:  
Can you experience this problem on newer FreeBSD versions too? 

http://www.freebsd.org/cgi/query-pr.cgi?pr=89918 
State-Changed-From-To: feedback->closed 
State-Changed-By: matteo 
State-Changed-When: Sab 17 Mag 2008 11:46:53 UTC 
State-Changed-Why:  
Submitter cannot reproduce this due to a broken card. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=89918 
>Unformatted:
