2009-06-28 19:50:08

by Bjarke Istrup Pedersen

[permalink] [raw]
Subject: [2.6.31-rc1] oops in __ieee80211_stop_queue

Oops happens when pcmcia p54 card is inserted.
Works with 2.6.30, broken in 2.6.31-rc1.

Output of relevant dmesg part:

pcmcia_socket pcmcia_socket1: pccard: CardBus card inserted into slot 1
pci 0000:04:00.0: reg 10 32bit mmio: [0x000000-0x001fff]
pci 0000:04:00.0: supports D1 D2
pci 0000:04:00.0: PME# supported from D0 D1 D2 D3hot D3cold
pci 0000:04:00.0: PME# disabled
yenta_cardbus 0000:02:04.1: EnE: chaning testregister 0xC9, 04 -> 04
p54pci 0000:04:00.0: enabling device (0000 -> 0002)
p54pci 0000:04:00.0: PCI INT A -> GSI 17 (level, low) -> IRQ 17
p54pci 0000:04:00.0: setting latency timer to 64
p54pci 0000:04:00.0: firmware: using built-in firmware isl3886pci
phy2: p54 detected a LM86 firmware
p54: rx_mtu reduced from 3240 to 2376
phy2: FW rev 2.13.12.0 - Softmac protocol 5.9
phy2: cryptographic accelerator WEP:YES, TKIP:YES, CCMP:YES
BUG: unable to handle kernel NULL pointer dereference at 00000280
IP: [<c1288e61>] __ieee80211_stop_queue+0x2b/0x43
*pde = 00000000
Oops: 0000 [#1] SMP
last sysfs file:
/sys/devices/pci0000:00/0000:00:14.4/0000:02:04.1/0000:04:00.0/class

Pid: 535, comm: pccardd Not tainted (2.6.31-rc1 #2) TravelMate 540
EIP: 0060:[<c1288e61>] EFLAGS: 00010046 CPU: 0
EIP is at __ieee80211_stop_queue+0x2b/0x43
EAX: dedd41a0 EBX: 00000000 ECX: 00000000 EDX: 00000000
ESI: 00000000 EDI: dedd4204 EBP: 00000000 ESP: df8abdcc
DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068
Process pccardd (pid: 535, ti=df8aa000 task=df9c7000 task.ti=df8aa000)
Stack:
dedd41a0 00000000 c1288ea0 00000286 dedd4920 ded2a300 00003ff0 00000470
<0> c11a83b1 00020200 00020200 dedd41a0 dedd4940 00000286 00004460 dedd4934
<0> dedd4934 c11f6f64 dfa5a020 ded2a300 dedd4920 00000408 000003fc c11a84ae
Call Trace:
[<c1288ea0>] ? ieee80211_stop_queues_by_reason+0x27/0x3f
[<c11a83b1>] ? p54_assign_address+0x16b/0x1cd
[<c11f6f64>] ? __alloc_skb+0x48/0x105
[<c11a84ae>] ? p54_alloc_skb+0x9b/0xb3
[<c11aaefd>] ? p54_read_eeprom+0x3b/0x1b6
[<c11ab652>] ? p54p_open+0x2e1/0x3c0
[<c12941b6>] ? p54p_probe+0x2eb/0x362
[<c113430b>] ? local_pci_probe+0xb/0xc
[<c1134485>] ? pci_device_probe+0x41/0x63
[<c117cde1>] ? driver_probe_device+0x76/0xe6
[<c117c4db>] ? bus_for_each_drv+0x37/0x5f
[<c117cf33>] ? device_attach+0x44/0x54
[<c117ceac>] ? __device_attach+0x0/0x28
[<c117c397>] ? bus_attach_device+0x1b/0x46
[<c117b5ac>] ? device_add+0x2ee/0x428
[<c11f04b0>] ? pci_write+0x1c/0x21
[<c11308ae>] ? pci_bus_add_device+0xc/0x2c
[<c11308ec>] ? pci_bus_add_devices+0x1e/0xd2
[<c1290599>] ? cb_alloc+0x97/0xa9
[<c11ac12c>] ? socket_insert+0x8a/0xb0
[<c11ac877>] ? pccardd+0x158/0x1d6
[<c11ac71f>] ? pccardd+0x0/0x1d6
[<c103130a>] ? kthread+0x66/0x6b
[<c10312a4>] ? kthread+0x0/0x6b
[<c10031ff>] ? kernel_thread_helper+0x7/0x10
Code: 56 53 0f b7 58 48 39 da 7c 11 ba 38 01 00 00 b8 69 72 37 c1 5b
5e e9 97 9d d9 ff 83 7c 90 54 00 75 17 8b 70 68 0f b7 da c1 e3 08 <03>
9e 80 02 00 00 8d 73 08 3e 80 4b 08 01 8d 44 90 54 0f ab 08
EIP: [<c1288e61>] __ieee80211_stop_queue+0x2b/0x43 SS:ESP 0068:df8abdcc
CR2: 0000000000000280
---[ end trace 1227e32b55188f72 ]---


2009-06-28 20:45:56

by Bjarke Istrup Pedersen

[permalink] [raw]
Subject: Re: [2.6.31-rc1] oops in __ieee80211_stop_queue

2009/6/28 Bjarke Istrup Pedersen <[email protected]>:
> Oops happens when pcmcia p54 card is inserted.
> Works with 2.6.30, broken in 2.6.31-rc1.
>
> Output of relevant dmesg part:
>
> pcmcia_socket pcmcia_socket1: pccard: CardBus card inserted into slot 1
> pci 0000:04:00.0: reg 10 32bit mmio: [0x000000-0x001fff]
> pci 0000:04:00.0: supports D1 D2
> pci 0000:04:00.0: PME# supported from D0 D1 D2 D3hot D3cold
> pci 0000:04:00.0: PME# disabled
> yenta_cardbus 0000:02:04.1: EnE: chaning testregister 0xC9, 04 -> 04
> p54pci 0000:04:00.0: enabling device (0000 -> 0002)
> p54pci 0000:04:00.0: PCI INT A -> GSI 17 (level, low) -> IRQ 17
> p54pci 0000:04:00.0: setting latency timer to 64
> p54pci 0000:04:00.0: firmware: using built-in firmware isl3886pci
> phy2: p54 detected a LM86 firmware
> p54: rx_mtu reduced from 3240 to 2376
> phy2: FW rev 2.13.12.0 - Softmac protocol 5.9
> phy2: cryptographic accelerator WEP:YES, TKIP:YES, CCMP:YES
> BUG: unable to handle kernel NULL pointer dereference at 00000280
> IP: [<c1288e61>] __ieee80211_stop_queue+0x2b/0x43
> *pde = 00000000
> Oops: 0000 [#1] SMP
> last sysfs file:
> /sys/devices/pci0000:00/0000:00:14.4/0000:02:04.1/0000:04:00.0/class
>
> Pid: 535, comm: pccardd Not tainted (2.6.31-rc1 #2) TravelMate 540
> EIP: 0060:[<c1288e61>] EFLAGS: 00010046 CPU: 0
> EIP is at __ieee80211_stop_queue+0x2b/0x43
> EAX: dedd41a0 EBX: 00000000 ECX: 00000000 EDX: 00000000
> ESI: 00000000 EDI: dedd4204 EBP: 00000000 ESP: df8abdcc
> ?DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068
> Process pccardd (pid: 535, ti=df8aa000 task=df9c7000 task.ti=df8aa000)
> Stack:
> ?dedd41a0 00000000 c1288ea0 00000286 dedd4920 ded2a300 00003ff0 00000470
> <0> c11a83b1 00020200 00020200 dedd41a0 dedd4940 00000286 00004460 dedd4934
> <0> dedd4934 c11f6f64 dfa5a020 ded2a300 dedd4920 00000408 000003fc c11a84ae
> Call Trace:
> ?[<c1288ea0>] ? ieee80211_stop_queues_by_reason+0x27/0x3f
> ?[<c11a83b1>] ? p54_assign_address+0x16b/0x1cd
> ?[<c11f6f64>] ? __alloc_skb+0x48/0x105
> ?[<c11a84ae>] ? p54_alloc_skb+0x9b/0xb3
> ?[<c11aaefd>] ? p54_read_eeprom+0x3b/0x1b6
> ?[<c11ab652>] ? p54p_open+0x2e1/0x3c0
> ?[<c12941b6>] ? p54p_probe+0x2eb/0x362
> ?[<c113430b>] ? local_pci_probe+0xb/0xc
> ?[<c1134485>] ? pci_device_probe+0x41/0x63
> ?[<c117cde1>] ? driver_probe_device+0x76/0xe6
> ?[<c117c4db>] ? bus_for_each_drv+0x37/0x5f
> ?[<c117cf33>] ? device_attach+0x44/0x54
> ?[<c117ceac>] ? __device_attach+0x0/0x28
> ?[<c117c397>] ? bus_attach_device+0x1b/0x46
> ?[<c117b5ac>] ? device_add+0x2ee/0x428
> ?[<c11f04b0>] ? pci_write+0x1c/0x21
> ?[<c11308ae>] ? pci_bus_add_device+0xc/0x2c
> ?[<c11308ec>] ? pci_bus_add_devices+0x1e/0xd2
> ?[<c1290599>] ? cb_alloc+0x97/0xa9
> ?[<c11ac12c>] ? socket_insert+0x8a/0xb0
> ?[<c11ac877>] ? pccardd+0x158/0x1d6
> ?[<c11ac71f>] ? pccardd+0x0/0x1d6
> ?[<c103130a>] ? kthread+0x66/0x6b
> ?[<c10312a4>] ? kthread+0x0/0x6b
> ?[<c10031ff>] ? kernel_thread_helper+0x7/0x10
> Code: 56 53 0f b7 58 48 39 da 7c 11 ba 38 01 00 00 b8 69 72 37 c1 5b
> 5e e9 97 9d d9 ff 83 7c 90 54 00 75 17 8b 70 68 0f b7 da c1 e3 08 <03>
> 9e 80 02 00 00 8d 73 08 3e 80 4b 08 01 8d 44 90 54 0f ab 08
> EIP: [<c1288e61>] __ieee80211_stop_queue+0x2b/0x43 SS:ESP 0068:df8abdcc
> CR2: 0000000000000280
> ---[ end trace 1227e32b55188f72 ]---
>

GDB points to this code:

0xc128b619 is in __ieee80211_stop_queue
(/usr/src/linux-2.6.31-rc1/arch/x86/include/asm/bitops.h:64).
59 static __always_inline void
60 set_bit(unsigned int nr, volatile unsigned long *addr)
61 {
62 if (IS_IMMEDIATE(nr)) {
63 asm volatile(LOCK_PREFIX "orb %1,%0"
64 : CONST_MASK_ADDR(nr, addr)
65 : "iq" ((u8)CONST_MASK(nr))
66 : "memory");
67 } else {
68 asm volatile(LOCK_PREFIX "bts %1,%0"

Don't know if that is of any help.

2009-07-04 16:46:40

by Christian Lamparter

[permalink] [raw]
Subject: Re: [2.6.31-rc1] oops in __ieee80211_stop_queue

On Sunday 28 June 2009 22:38:33 Bjarke Istrup Pedersen wrote:
> 2009/6/28 Bjarke Istrup Pedersen <[email protected]>:
> > Oops happens when pcmcia p54 card is inserted.
> > Works with 2.6.30, broken in 2.6.31-rc1.
> >
> > Output of relevant dmesg part:
> >
> > pcmcia_socket pcmcia_socket1: pccard: CardBus card inserted into slot 1
> > pci 0000:04:00.0: reg 10 32bit mmio: [0x000000-0x001fff]
> > pci 0000:04:00.0: supports D1 D2
> > pci 0000:04:00.0: PME# supported from D0 D1 D2 D3hot D3cold
> > pci 0000:04:00.0: PME# disabled
> > yenta_cardbus 0000:02:04.1: EnE: chaning testregister 0xC9, 04 -> 04
> > p54pci 0000:04:00.0: enabling device (0000 -> 0002)
> > p54pci 0000:04:00.0: PCI INT A -> GSI 17 (level, low) -> IRQ 17
> > p54pci 0000:04:00.0: setting latency timer to 64
> > p54pci 0000:04:00.0: firmware: using built-in firmware isl3886pci
> > phy2: p54 detected a LM86 firmware
> > p54: rx_mtu reduced from 3240 to 2376
> > phy2: FW rev 2.13.12.0 - Softmac protocol 5.9
> > phy2: cryptographic accelerator WEP:YES, TKIP:YES, CCMP:YES
> > BUG: unable to handle kernel NULL pointer dereference at 00000280
> > IP: [<c1288e61>] __ieee80211_stop_queue+0x2b/0x43
> > *pde = 00000000
> > Oops: 0000 [#1] SMP
> > last sysfs file:
> > /sys/devices/pci0000:00/0000:00:14.4/0000:02:04.1/0000:04:00.0/class
> >
> > Pid: 535, comm: pccardd Not tainted (2.6.31-rc1 #2) TravelMate 540
> > EIP: 0060:[<c1288e61>] EFLAGS: 00010046 CPU: 0
> > EIP is at __ieee80211_stop_queue+0x2b/0x43
> > EAX: dedd41a0 EBX: 00000000 ECX: 00000000 EDX: 00000000
> > ESI: 00000000 EDI: dedd4204 EBP: 00000000 ESP: df8abdcc
> > DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068
> > Process pccardd (pid: 535, ti=df8aa000 task=df9c7000 task.ti=df8aa000)
> > Stack:
> > dedd41a0 00000000 c1288ea0 00000286 dedd4920 ded2a300 00003ff0 00000470
> > <0> c11a83b1 00020200 00020200 dedd41a0 dedd4940 00000286 00004460 dedd4934
> > <0> dedd4934 c11f6f64 dfa5a020 ded2a300 dedd4920 00000408 000003fc c11a84ae
> > Call Trace:
> > [<c1288ea0>] ? ieee80211_stop_queues_by_reason+0x27/0x3f
> > [<c11a83b1>] ? p54_assign_address+0x16b/0x1cd
> > [<c11f6f64>] ? __alloc_skb+0x48/0x105
> > [<c11a84ae>] ? p54_alloc_skb+0x9b/0xb3
> > [<c11aaefd>] ? p54_read_eeprom+0x3b/0x1b6
> > [<c11ab652>] ? p54p_open+0x2e1/0x3c0
> > [<c12941b6>] ? p54p_probe+0x2eb/0x362
> > [<c113430b>] ? local_pci_probe+0xb/0xc
> > [<c1134485>] ? pci_device_probe+0x41/0x63
> > [<c117cde1>] ? driver_probe_device+0x76/0xe6
> > [<c117c4db>] ? bus_for_each_drv+0x37/0x5f
> > [<c117cf33>] ? device_attach+0x44/0x54
> > [<c117ceac>] ? __device_attach+0x0/0x28
> > [<c117c397>] ? bus_attach_device+0x1b/0x46
> > [<c117b5ac>] ? device_add+0x2ee/0x428
> > [<c11f04b0>] ? pci_write+0x1c/0x21
> > [<c11308ae>] ? pci_bus_add_device+0xc/0x2c
> > [<c11308ec>] ? pci_bus_add_devices+0x1e/0xd2
> > [<c1290599>] ? cb_alloc+0x97/0xa9
> > [<c11ac12c>] ? socket_insert+0x8a/0xb0
> > [<c11ac877>] ? pccardd+0x158/0x1d6
> > [<c11ac71f>] ? pccardd+0x0/0x1d6
> > [<c103130a>] ? kthread+0x66/0x6b
> > [<c10312a4>] ? kthread+0x0/0x6b
> > [<c10031ff>] ? kernel_thread_helper+0x7/0x10
> > Code: 56 53 0f b7 58 48 39 da 7c 11 ba 38 01 00 00 b8 69 72 37 c1 5b
> > 5e e9 97 9d d9 ff 83 7c 90 54 00 75 17 8b 70 68 0f b7 da c1 e3 08 <03>
> > 9e 80 02 00 00 8d 73 08 3e 80 4b 08 01 8d 44 90 54 0f ab 08
> > EIP: [<c1288e61>] __ieee80211_stop_queue+0x2b/0x43 SS:ESP 0068:df8abdcc
> > CR2: 0000000000000280
> > ---[ end trace 1227e32b55188f72 ]---
> >
>
> GDB points to this code:
>
> 0xc128b619 is in __ieee80211_stop_queue
> (/usr/src/linux-2.6.31-rc1/arch/x86/include/asm/bitops.h:64).
> 59 static __always_inline void
> 60 set_bit(unsigned int nr, volatile unsigned long *addr)
> 61 {
> 62 if (IS_IMMEDIATE(nr)) {
> 63 asm volatile(LOCK_PREFIX "orb %1,%0"
> 64 : CONST_MASK_ADDR(nr, addr)
> 65 : "iq" ((u8)CONST_MASK(nr))
> 66 : "memory");
> 67 } else {
> 68 asm volatile(LOCK_PREFIX "bts %1,%0"
>
> Don't know if that is of any help.

"[PATCH 2.6.31] p54: band-aid to restore driver functionality"
http://www.spinics.net/lists/netdev/msg100347.html

dunno when, how or who merges it (Dave where are you?)...
as the development in wireless-testing will go a different route.

Regards,
Chr