LinuxLists.cc - libertas: blows chunks on failed firmware load

[permalink] [raw]

Subject: Re: libertas: blows chunks on failed firmware load

On Wed, 2007-08-01 at 11:31 +0200, Holger Schurig wrote:
> > Sure I will try it tonight, where should I go to get it? The
> > only trees with "libertas" in the name on git.kernel.org don't
> > seem to be the ones.
>
> My driver is for sure in the libertas-dev tree from the OLPC
> people. The SVN project that contains the firmware cutter also
> contains code to checkout this tree and select the proper branch
> in this tree.
>
>
> Basically, you do
>
> git clone --reference XXXX git://git.infradead.org/libertas-2.6
> cd libertas-2.6
> git branch libertas-cf
> git checkout libertas-cf
> git pull origin libertas
>
>
>
> However, I've "Signed-Up" this driver and asked Dan to forward it
> into wireless-dev. He hasn't done this yet :-(

I'm sending Linville a pull request for current 'libertas' branch of
libertas-2.6 today; is that what you mean?

Dan

>
> If anyone want's to review the patch (in addition to what people
> did on the libertas-dev mailing list), here's an URL:
>
> http://git.infradead.org/?p=libertas-2.6.git;a=commitdiff;h=9e25bb4c6ed9430e166b69f9f91bfccd96f0869d
> -
> To unsubscribe from this list: send the line "unsubscribe linux-wireless" in
> the body of a message to [email protected]
> More majordomo info at http://vger.kernel.org/majordomo-info.html

2007-08-01 02:37:14

[permalink] [raw]

Subject: Re: libertas: blows chunks on failed firmware load

On Tue, 2007-07-31 at 20:45 +0100, Andy Green wrote:
> Hi folks -
>
> I realize I am slightly pushing my luck, but I added this el-cheapo
> 88W8338 -based "Compoint EVWL-GI-700S" USB stick's USB ID "0x1286,
> 0x1fab" to libertas/usb8xxx.c and chanced my arm.

If it's 8338, it's certainly not gonna work with this driver. Did you
add the USB ID yourself?

Dan

>
> I was rewarded with
>
> PM: Adding info for No Bus:msh0
> PM: Adding info for No Bus:5-4
> PM: Removing info for No Bus:5-4
> libertas: request_firmware() failed with 0xfffffffe
> libertas: firmware usb8388.bin not found
> libertas: firmware init failed
> PM: Removing info for No Bus:msh0
> kfree_debugcheck: out of range ptr 6b6b6b6bh.
> ------------[ cut here ]------------
> kernel BUG at mm/slab.c:2825!
> invalid opcode: 0000 [#1]
> SMP
> Modules linked in: usb8xxx libertas ieee80211 ieee80211_crypt iwl3945
> rt73usb rt2x00usb rt2x00lib rfkill input_polldev crc_itu_t mac80211
> cfg80211 vfat fat vmnet(P) vmmon(P) snd_rtctimer usb_storage autofs4 aes
> nf_conntrack_netbios_ns ipt_REJECT nf_conntrack_ipv4 xt_state
> nf_conntrack nfnetlink xt_tcpudp iptable_filter ip_tables x_tables
> cpufreq_ondemand acpi_cpufreq video output sbs button dock battery ac lp
> loop snd_hda_intel snd_seq_dummy arc4 snd_seq_oss ecb blkcipher
> snd_seq_midi_event snd_seq snd_seq_device snd_pcm_oss sr_mod
> snd_mixer_oss snd_pcm rtc_cmos cdrom snd_timer snd b44 ssb parport
> iTCO_wdt iTCO_vendor_support soundcore serio_raw ata_piix rtc_core
> rtc_lib ata_generic snd_page_alloc mii sg ahci libata sd_mod scsi_mod
> ext3 jbd mbcache ehci_hcd ohci_hcd uhci_hcd
> CPU: 1
> EIP: 0060:[<c047b122>] Tainted: P VLI
> EFLAGS: 00010086 (2.6.23-rc1 #1)
> EIP is at kfree_debugcheck+0x29/0x2f
> eax: 00000031 ebx: f48c2600 ecx: c0422e7d edx: c8ea9060
> esi: ea1d1338 edi: 6b6b6b6b ebp: e3a0ed6c esp: e3a0ed64
> ds: 007b es: 007b fs: 00d8 gs: 0033 ss: 0068
> Process modprobe (pid: 6761, ti=e3a0e000 task=c8ea9060 task.ti=e3a0e000)
> Stack: c06c7131 6b6b6b6b e3a0ed84 c047ba96 00000202 f48c2600 ea1d1338
> ea1d12e0
> e3a0edc0 f8dd4b28 f8dd00d8 ffffff10 c0447a00 f8dd6ec8 e3a0edb0
> c0579b2d
> f8dd6ec8 ee3602c0 d9a926b8 ed449e38 ee3602c0 f8dd6d40 f8dd6d90
> e3a0edd0
> Call Trace:
> [<c0405f35>] show_trace_log_lvl+0x1a/0x2f
> [<c0405fe5>] show_stack_log_lvl+0x9b/0xa3
> [<c04061a5>] show_registers+0x1b8/0x289
> [<c0406389>] die+0x113/0x246
> [<c0622f98>] do_trap+0x8a/0xa3
> [<c040677b>] do_invalid_op+0x88/0x92
> [<c0622d6a>] error_code+0x72/0x78
> [<c047ba96>] kfree+0x25/0xdb
> [<f8dd4b28>] if_usb_probe+0x412/0x427 [usb8xxx]
> [<c057a77f>] usb_probe_interface+0x6a/0xa0
> [<c0562bb8>] driver_probe_device+0xe9/0x16a
> [<c0562d62>] __driver_attach+0x76/0xaf
> [<c05620bb>] bus_for_each_dev+0x3a/0x5f
> [<c0562a03>] driver_attach+0x19/0x1b
> [<c05623d9>] bus_add_driver+0x79/0x181
> [<c0562f65>] driver_register+0x67/0x6c
> [<c057a2b9>] usb_register_driver+0x7e/0xe5
> [<f8dd3a4f>] if_usb_init_module+0x76/0xcc [usb8xxx]
> [<c044eb0d>] sys_init_module+0x13b5/0x1503
> [<c0404ed2>] sysenter_past_esp+0x5f/0x99
> =======================
> Code: 5d c3 55 89 c2 8d 80 00 00 00 40 89 e5 c1 e8 0c 83 ec 08 3b 05 04
> 33 a8 c0 72 14 89 54 24 04 c7 04 24 31 71 6c c0 e8 a8 ff fa ff <0f> 0b
> eb fe c9 c3 55 89 e5 57 31 ff 56 89 c6 53 89 d3 83 ec 10
> EIP: [<c047b122>] kfree_debugcheck+0x29/0x2f SS:ESP 0068:e3a0ed64
>
> Basically the error path for "can't load firmware" seems to double free?
>
> It seems that by the time we arrive at kfree(priv->adapter); at
> if_usb.c:234 in if_usb_probe(), priv has already been freed or crapped
> on to point to somewhere that has been freed.
>
> I had a quick look around, it looked to me like there might be a mistake
> in main.c:867, in int libertas_activate_card(wlan_private *priv, char
> *fw_name) where it might jump to the wrong level of error unpicking
> code, but it didn't fix it.
>
> if (priv->hw_register_dev(priv) < 0) {
> lbs_pr_err("failed to register WLAN device\n");
> goto err_registerdev;
> }
>
> /* init FW and HW */
> if (fw_name && libertas_init_fw(priv, fw_name)) {
> lbs_pr_err("firmware init failed\n");
> // goto err_registerdev; // !!! <--- seems wrong
> goto err_init_fw;
> }
>
> if (register_netdev(dev)) {
> lbs_pr_err("cannot register ethX device\n");
> goto err_init_fw;
> }
>
> lbs_pr_info("%s: Marvell WLAN 802.11 adapter\n", dev->name);
>
> libertas_debugfs_init_one(priv, dev);
>
> ret = 0;
> goto done;
>
> err_init_fw:
> priv->hw_unregister_dev(priv);
> err_registerdev:
> destroy_workqueue(priv->assoc_thread);
> /* Stop the thread servicing the interrupts */
>
>
> Even when I provided it with firmware, it dropped dead the same way just
> with this additional info before:
>
> PM: Adding info for No Bus:msh0
> PM: Adding info for No Bus:5-4
> PM: Removing info for No Bus:5-4
> usb8xxx: failed to load fw, resetting device!
> usb 5-4: reset high speed USB device using ehci_hcd and address 3
> usb 5-4: device descriptor read/64, error -71
> usb 5-4: device descriptor read/64, error -71
> usb 5-4: reset high speed USB device using ehci_hcd and address 3
> usb 5-4: device descriptor read/64, error -71
> usb 5-4: device descriptor read/64, error -71
> usb 5-4: reset high speed USB device using ehci_hcd and address 3
> usb 5-4: device descriptor read/8, error 0
> usb 5-4: device descriptor read/8, error 0
> usb 5-4: reset high speed USB device using ehci_hcd and address 3
> usb 5-4: device descriptor read/8, error 0
> usb 5-4: device descriptor read/8, error 0
> usb 5-4: USB disconnect, address 3
> libertas: firmware init failed
> PM: Removing info for No Bus:msh0
> kfree_debugcheck: out of range ptr 6b6b6b6bh.
> ------------[ cut here ]------------
> kernel BUG at mm/slab.c:2825!
> ...
>
> Of course this can be due to the luck-pushing, but it seemed it might
> also be a genuine problem with the error handling.
>
> -Andy
> -
> To unsubscribe from this list: send the line "unsubscribe linux-wireless" in
> the body of a message to [email protected]
> More majordomo info at http://vger.kernel.org/majordomo-info.html

2007-08-01 11:15:17

[permalink] [raw]

Subject: Re: libertas: blows chunks on failed firmware load

> Yeah, I'm wondering whether we should change that... I don't
> know what the policy on changing driver names is though, but
> given that the driver isn't extensively used yet, we may be
> able to.

I'd say

libertas_cs for card-services cards (CF Cards, PCMCIA etc)
libertas_usb for USB cards
libertas_sdio for SDIO based cards

That makes the names orthogonal :-)

2007-08-01 09:53:22

[permalink] [raw]

Subject: Re: libertas: blows chunks on failed firmware load

Somebody in the thread at some point said:
>> Sure I will try it tonight, where should I go to get it? The
>> only trees with "libertas" in the name on git.kernel.org don't
>> seem to be the ones.
>
> My driver is for sure in the libertas-dev tree from the OLPC
> people. The SVN project that contains the firmware cutter also
> contains code to checkout this tree and select the proper branch
> in this tree.
>
>
> Basically, you do
>
> git clone --reference XXXX git://git.infradead.org/libertas-2.6
> cd libertas-2.6
> git branch libertas-cf
> git checkout libertas-cf
> git pull origin libertas

OK I guess what I will try tonight is pulling that tree and then adding
the libertas dir into a copy of wireless-dev, since I want to stay close
to wireless-dev generally at the moment. That worked for the rt73usb
tree yesterday.

> However, I've "Signed-Up" this driver and asked Dan to forward it
> into wireless-dev. He hasn't done this yet :-(

I guess for patch providers patches are golden, valuable nuggets that
the world inexplicably hates on... for the upstream recipient it's
probably more like a terrifying unknown burden. FWIW periodic polite
nagging seems to be a mutually acceptable way forward... hey.. it looks
like you discovered it already ;-)

> If anyone want's to review the patch (in addition to what people
> did on the libertas-dev mailing list), here's an URL:
>
> http://git.infradead.org/?p=libertas-2.6.git;a=commitdiff;h=9e25bb4c6ed9430e166b69f9f91bfccd96f0869d

I found that checkpatch.pl is pretty cool in a dominatrix kind of way:

$ ./scripts/checkpatch.pl
/home/agreen/libertas-2.6.git-9e25bb4c6ed9430e166b69f9f91bfccd96f0869d.patch
ERROR: do not initialise statics to 0 or NULL
#135: FILE: drivers/net/wireless/libertas/if_cs.c:76:
+static int debug_output = 0;

WARNING: line over 80 characters
#206: FILE: drivers/net/wireless/libertas/if_cs.c:147:
+static int if_cs_poll_while_fw_download(struct if_cs_card *card, uint
addr, u8 reg)

WARNING: declaring multiple variables together should be avoided
#211: FILE: drivers/net/wireless/libertas/if_cs.c:152:
+ u8 val = if_cs_read8(card, addr);

WARNING: line over 80 characters
#324: FILE: drivers/net/wireless/libertas/if_cs.c:265:
+ if_cs_write16(card, IF_CS_C_INT_CAUSE, int_cause &
IF_CS_C_IC_MASK);

WARNING: declaring multiple variables together should be avoided
#353: FILE: drivers/net/wireless/libertas/if_cs.c:294:
+ u16 val = if_cs_read16(card, IF_CS_C_STATUS);

ERROR: "foo* bar" should be "foo *bar"
#411: FILE: drivers/net/wireless/libertas/if_cs.c:352:
+static int if_cs_receive_cmdres(wlan_private *priv, u8* data, u32 *len)

WARNING: line over 80 characters
#427: FILE: drivers/net/wireless/libertas/if_cs.c:368:
+ lbs_pr_err("card cmd buffer has invalid # of bytes
(%d)\n", *len);

WARNING: line over 80 characters
#453: FILE: drivers/net/wireless/libertas/if_cs.c:394:
+ lbs_pr_err("card data buffer has invalid # of bytes
(%d)\n", len);

WARNING: line over 80 characters
#459: FILE: drivers/net/wireless/libertas/if_cs.c:400:
+ //TODO: skb =
dev_alloc_skb(len+ETH_FRAME_LEN+MRVDRV_SNAP_HEADER_LEN+EXTRA_LEN);

ERROR: do not use C99 // comments
#459: FILE: drivers/net/wireless/libertas/if_cs.c:400:
+ //TODO: skb =
dev_alloc_skb(len+ETH_FRAME_LEN+MRVDRV_SNAP_HEADER_LEN+EXTRA_LEN);

WARNING: line over 80 characters
#599: FILE: drivers/net/wireless/libertas/if_cs.c:540:
+ ret = if_cs_poll_while_fw_download(card, IF_CS_C_SQ_READ_LOW,
IF_CS_C_SQ_HELPER_OK);

ERROR: braces {} are not necessary for single statement blocks
#616: FILE: drivers/net/wireless/libertas/if_cs.c:557:
+ } else {
+ retry = 0;
+ }

ERROR: braces {} are not necessary for single statement blocks
#625: FILE: drivers/net/wireless/libertas/if_cs.c:566:
+ if (retry) {
+ sent -= len;
+ }

ERROR: do not use C99 // comments
#743: FILE: drivers/net/wireless/libertas/if_cs.c:684:
+ //wlan_adapter *adapter = priv->adapter;

ERROR: braces {} are not necessary for single statement blocks
#772: FILE: drivers/net/wireless/libertas/if_cs.c:713:
+ if (*ireg & IF_CS_C_S_TX_DNLD_RDY) {
+ priv->dnld_sent = DNLD_RES_RECEIVED;
+ }

ERROR: braces {} are not necessary for single statement blocks
#782: FILE: drivers/net/wireless/libertas/if_cs.c:723:
+ } else {
+ cmdbuf = priv->adapter->cur_cmd->bufvirtualaddr;
+ }

WARNING: line over 80 characters
#793: FILE: drivers/net/wireless/libertas/if_cs.c:734:
+ lbs_deb_leave_args(LBS_DEB_CS, "ret %d, ireg 0x%x, hisregcpy
0x%x", ret, *ireg, priv->adapter->hisregcpy);

WARNING: line over 80 characters
#802: FILE: drivers/net/wireless/libertas/if_cs.c:743:
+ priv->adapter->eventcause = (if_cs_read16(priv->card,
IF_CS_C_STATUS) & IF_CS_C_S_STATUS_MASK) >> 5;

ERROR: That open brace { should be on the previous line
#878: FILE: drivers/net/wireless/libertas/if_cs.c:819:
+ if ((ret = pcmcia_get_first_tuple(p_dev, &tuple)) != 0 ||
+ (ret = pcmcia_get_tuple_data(p_dev, &tuple)) != 0 ||
+ (ret = pcmcia_parse_tuple(p_dev, &tuple, &parse)) != 0)
+ {
ERROR: do not use assignment in if condition
#878: FILE: drivers/net/wireless/libertas/if_cs.c:819:
+ if ((ret = pcmcia_get_first_tuple(p_dev, &tuple)) != 0 ||

ERROR: braces {} are not necessary for single statement blocks
#889: FILE: drivers/net/wireless/libertas/if_cs.c:830:
+ if (cfg->irq.IRQInfo1) {
+ p_dev->conf.Attributes |= CONF_ENABLE_IRQ;
+ }

-Andy

2007-08-01 11:37:49

[permalink] [raw]

Subject: Re: libertas: blows chunks on failed firmware load

On Wed, 2007-08-01 at 13:15 +0200, Holger Schurig wrote:
> > Yeah, I'm wondering whether we should change that... I don't
> > know what the policy on changing driver names is though, but
> > given that the driver isn't extensively used yet, we may be
> > able to.
>
> I'd say
>
> libertas_cs for card-services cards (CF Cards, PCMCIA etc)
> libertas_usb for USB cards
> libertas_sdio for SDIO based cards
>
> That makes the names orthogonal :-)

Right, but that doesn't solve the original issue that the driver is
named "usb8xxx" and doesn't work with the 833x series. Maybe we just
ignore that. The current driver will likely work with the libertas 86xx
chips (8682, 8686, 8688) too, so that just leaves the 833x, 831x, and
830x chips. Some of those are really, really old. Others (like 833x)
you can still find in a lot of places.

Dan

2007-08-01 07:21:03

[permalink] [raw]

Subject: Re: libertas: blows chunks on failed firmware load

On Wednesday 01 August 2007 07:52, Andy Green wrote:
> One of the other cheapo cards I randomly got was a Libertas
> 88W8335 PC Card, I assume I am SOL on that as well.

No, you aren't.

I published the driver into the libertas tree what handles PC
Cards. At least mine (a compact flash based 8388), the one from
Marcin and another guy. The driver is still extremely new, maybe
a little bit fragile, but having people test this beast would be
wonderful.

The error handling for firmware is a little bit better :-)
Because the firmware format for the CF card is different to the
one for the USB dongles, I can (actually must!) download the
firmware before calling libertas-code. So you shouldn't get a
kernel crash if you forgot to install the firmware
in /lib/firmware.

However, *IF* you need the firmware, you can use the firmware
cutter that is currently only in SVN, see
http://projects.linuxtogo.org/scm/?group_id=24

2007-08-01 09:31:31

[permalink] [raw]

Subject: Re: libertas: blows chunks on failed firmware load

> Sure I will try it tonight, where should I go to get it? The
> only trees with "libertas" in the name on git.kernel.org don't
> seem to be the ones.

My driver is for sure in the libertas-dev tree from the OLPC
people. The SVN project that contains the firmware cutter also
contains code to checkout this tree and select the proper branch
in this tree.

Basically, you do

git clone --reference XXXX git://git.infradead.org/libertas-2.6
cd libertas-2.6
git branch libertas-cf
git checkout libertas-cf
git pull origin libertas

However, I've "Signed-Up" this driver and asked Dan to forward it
into wireless-dev. He hasn't done this yet :-(

If anyone want's to review the patch (in addition to what people
did on the libertas-dev mailing list), here's an URL:

http://git.infradead.org/?p=libertas-2.6.git;a=commitdiff;h=9e25bb4c6ed9430e166b69f9f91bfccd96f0869d

2007-08-02 06:40:43

[permalink] [raw]

Subject: Re: libertas: blows chunks on failed firmware load

Somebody in the thread at some point said:

> On Thursday 02 August 2007 00:31, Andy Green wrote:
>> Well it seems the libertas_cs driver supports PCMCIA only?
>
> Right, like libertas_cs is --- like e.g. orinoco_cs --- just for
> for PCMCIA based designs, like CF CARD. If you have a PCI based
> device, you'll need to write your own libertas_pci driver

Well, thanks for trying to help.

/me shoves PC Card in junk drawer

-Andy

2007-08-01 11:05:58

[permalink] [raw]

Subject: Re: libertas: blows chunks on failed firmware load

On Wed, 2007-08-01 at 06:52 +0100, Andy Green wrote:
> Somebody in the thread at some point said:
>
> >> I realize I am slightly pushing my luck, but I added this el-cheapo
> >> 88W8338 -based "Compoint EVWL-GI-700S" USB stick's USB ID "0x1286,
> >> 0x1fab" to libertas/usb8xxx.c and chanced my arm.
>
> > If it's 8338, it's certainly not gonna work with this driver. Did you
> > add the USB ID yourself?
>
> Yes I do actually say in that rather obfuscated sentence above that I
> added the USB ID and accepted I was pushing my luck doing so. But...
> the driver took the bold step of calling itself usb8xxx...

Yeah, I'm wondering whether we should change that... I don't know what
the policy on changing driver names is though, but given that the driver
isn't extensively used yet, we may be able to.

Dan

>
> > Irregardless of my previous comment, the bug should get fixed of course.
>
> Right, that's why I reported it like this:
>
> >> Of course this can be due to the luck-pushing, but it seemed it might
> >> also be a genuine problem with the error handling.
>
> One of the other cheapo cards I randomly got was a Libertas 88W8335 PC
> Card, I assume I am SOL on that as well.
>
> -Andy

2007-08-01 05:52:09

[permalink] [raw]

Subject: Re: libertas: blows chunks on failed firmware load

Somebody in the thread at some point said:

>> I realize I am slightly pushing my luck, but I added this el-cheapo
>> 88W8338 -based "Compoint EVWL-GI-700S" USB stick's USB ID "0x1286,
>> 0x1fab" to libertas/usb8xxx.c and chanced my arm.

> If it's 8338, it's certainly not gonna work with this driver. Did you
> add the USB ID yourself?

Yes I do actually say in that rather obfuscated sentence above that I
added the USB ID and accepted I was pushing my luck doing so. But...
the driver took the bold step of calling itself usb8xxx...

> Irregardless of my previous comment, the bug should get fixed of course.

Right, that's why I reported it like this:

>> Of course this can be due to the luck-pushing, but it seemed it might
>> also be a genuine problem with the error handling.

One of the other cheapo cards I randomly got was a Libertas 88W8335 PC
Card, I assume I am SOL on that as well.

-Andy

2007-08-01 22:31:42

[permalink] [raw]

Subject: Re: libertas: blows chunks on failed firmware load

2007-08-01 02:37:40

[permalink] [raw]

Subject: Re: libertas: blows chunks on failed firmware load

On Tue, 2007-07-31 at 20:45 +0100, Andy Green wrote:
> Hi folks -
>
> I realize I am slightly pushing my luck, but I added this el-cheapo
> 88W8338 -based "Compoint EVWL-GI-700S" USB stick's USB ID "0x1286,
> 0x1fab" to libertas/usb8xxx.c and chanced my arm.

Irregardless of my previous comment, the bug should get fixed of course.

Thanks,
Dan

> I was rewarded with
>
> PM: Adding info for No Bus:msh0
> PM: Adding info for No Bus:5-4
> PM: Removing info for No Bus:5-4
> libertas: request_firmware() failed with 0xfffffffe
> libertas: firmware usb8388.bin not found
> libertas: firmware init failed
> PM: Removing info for No Bus:msh0
> kfree_debugcheck: out of range ptr 6b6b6b6bh.
> ------------[ cut here ]------------
> kernel BUG at mm/slab.c:2825!
> invalid opcode: 0000 [#1]
> SMP
> Modules linked in: usb8xxx libertas ieee80211 ieee80211_crypt iwl3945
> rt73usb rt2x00usb rt2x00lib rfkill input_polldev crc_itu_t mac80211
> cfg80211 vfat fat vmnet(P) vmmon(P) snd_rtctimer usb_storage autofs4 aes
> nf_conntrack_netbios_ns ipt_REJECT nf_conntrack_ipv4 xt_state
> nf_conntrack nfnetlink xt_tcpudp iptable_filter ip_tables x_tables
> cpufreq_ondemand acpi_cpufreq video output sbs button dock battery ac lp
> loop snd_hda_intel snd_seq_dummy arc4 snd_seq_oss ecb blkcipher
> snd_seq_midi_event snd_seq snd_seq_device snd_pcm_oss sr_mod
> snd_mixer_oss snd_pcm rtc_cmos cdrom snd_timer snd b44 ssb parport
> iTCO_wdt iTCO_vendor_support soundcore serio_raw ata_piix rtc_core
> rtc_lib ata_generic snd_page_alloc mii sg ahci libata sd_mod scsi_mod
> ext3 jbd mbcache ehci_hcd ohci_hcd uhci_hcd
> CPU: 1
> EIP: 0060:[<c047b122>] Tainted: P VLI
> EFLAGS: 00010086 (2.6.23-rc1 #1)
> EIP is at kfree_debugcheck+0x29/0x2f
> eax: 00000031 ebx: f48c2600 ecx: c0422e7d edx: c8ea9060
> esi: ea1d1338 edi: 6b6b6b6b ebp: e3a0ed6c esp: e3a0ed64
> ds: 007b es: 007b fs: 00d8 gs: 0033 ss: 0068
> Process modprobe (pid: 6761, ti=e3a0e000 task=c8ea9060 task.ti=e3a0e000)
> Stack: c06c7131 6b6b6b6b e3a0ed84 c047ba96 00000202 f48c2600 ea1d1338
> ea1d12e0
> e3a0edc0 f8dd4b28 f8dd00d8 ffffff10 c0447a00 f8dd6ec8 e3a0edb0
> c0579b2d
> f8dd6ec8 ee3602c0 d9a926b8 ed449e38 ee3602c0 f8dd6d40 f8dd6d90
> e3a0edd0
> Call Trace:
> [<c0405f35>] show_trace_log_lvl+0x1a/0x2f
> [<c0405fe5>] show_stack_log_lvl+0x9b/0xa3
> [<c04061a5>] show_registers+0x1b8/0x289
> [<c0406389>] die+0x113/0x246
> [<c0622f98>] do_trap+0x8a/0xa3
> [<c040677b>] do_invalid_op+0x88/0x92
> [<c0622d6a>] error_code+0x72/0x78
> [<c047ba96>] kfree+0x25/0xdb
> [<f8dd4b28>] if_usb_probe+0x412/0x427 [usb8xxx]
> [<c057a77f>] usb_probe_interface+0x6a/0xa0
> [<c0562bb8>] driver_probe_device+0xe9/0x16a
> [<c0562d62>] __driver_attach+0x76/0xaf
> [<c05620bb>] bus_for_each_dev+0x3a/0x5f
> [<c0562a03>] driver_attach+0x19/0x1b
> [<c05623d9>] bus_add_driver+0x79/0x181
> [<c0562f65>] driver_register+0x67/0x6c
> [<c057a2b9>] usb_register_driver+0x7e/0xe5
> [<f8dd3a4f>] if_usb_init_module+0x76/0xcc [usb8xxx]
> [<c044eb0d>] sys_init_module+0x13b5/0x1503
> [<c0404ed2>] sysenter_past_esp+0x5f/0x99
> =======================
> Code: 5d c3 55 89 c2 8d 80 00 00 00 40 89 e5 c1 e8 0c 83 ec 08 3b 05 04
> 33 a8 c0 72 14 89 54 24 04 c7 04 24 31 71 6c c0 e8 a8 ff fa ff <0f> 0b
> eb fe c9 c3 55 89 e5 57 31 ff 56 89 c6 53 89 d3 83 ec 10
> EIP: [<c047b122>] kfree_debugcheck+0x29/0x2f SS:ESP 0068:e3a0ed64
>
> Basically the error path for "can't load firmware" seems to double free?
>
> It seems that by the time we arrive at kfree(priv->adapter); at
> if_usb.c:234 in if_usb_probe(), priv has already been freed or crapped
> on to point to somewhere that has been freed.
>
> I had a quick look around, it looked to me like there might be a mistake
> in main.c:867, in int libertas_activate_card(wlan_private *priv, char
> *fw_name) where it might jump to the wrong level of error unpicking
> code, but it didn't fix it.
>
> if (priv->hw_register_dev(priv) < 0) {
> lbs_pr_err("failed to register WLAN device\n");
> goto err_registerdev;
> }
>
> /* init FW and HW */
> if (fw_name && libertas_init_fw(priv, fw_name)) {
> lbs_pr_err("firmware init failed\n");
> // goto err_registerdev; // !!! <--- seems wrong
> goto err_init_fw;
> }
>
> if (register_netdev(dev)) {
> lbs_pr_err("cannot register ethX device\n");
> goto err_init_fw;
> }
>
> lbs_pr_info("%s: Marvell WLAN 802.11 adapter\n", dev->name);
>
> libertas_debugfs_init_one(priv, dev);
>
> ret = 0;
> goto done;
>
> err_init_fw:
> priv->hw_unregister_dev(priv);
> err_registerdev:
> destroy_workqueue(priv->assoc_thread);
> /* Stop the thread servicing the interrupts */
>
>
> Even when I provided it with firmware, it dropped dead the same way just
> with this additional info before:
>
> PM: Adding info for No Bus:msh0
> PM: Adding info for No Bus:5-4
> PM: Removing info for No Bus:5-4
> usb8xxx: failed to load fw, resetting device!
> usb 5-4: reset high speed USB device using ehci_hcd and address 3
> usb 5-4: device descriptor read/64, error -71
> usb 5-4: device descriptor read/64, error -71
> usb 5-4: reset high speed USB device using ehci_hcd and address 3
> usb 5-4: device descriptor read/64, error -71
> usb 5-4: device descriptor read/64, error -71
> usb 5-4: reset high speed USB device using ehci_hcd and address 3
> usb 5-4: device descriptor read/8, error 0
> usb 5-4: device descriptor read/8, error 0
> usb 5-4: reset high speed USB device using ehci_hcd and address 3
> usb 5-4: device descriptor read/8, error 0
> usb 5-4: device descriptor read/8, error 0
> usb 5-4: USB disconnect, address 3
> libertas: firmware init failed
> PM: Removing info for No Bus:msh0
> kfree_debugcheck: out of range ptr 6b6b6b6bh.
> ------------[ cut here ]------------
> kernel BUG at mm/slab.c:2825!
> ...
>
> Of course this can be due to the luck-pushing, but it seemed it might
> also be a genuine problem with the error handling.
>
> -Andy
> -
> To unsubscribe from this list: send the line "unsubscribe linux-wireless" in
> the body of a message to [email protected]
> More majordomo info at http://vger.kernel.org/majordomo-info.html

2007-08-01 08:40:39

[permalink] [raw]

Subject: Re: libertas: blows chunks on failed firmware load

Hi Holger -

>> One of the other cheapo cards I randomly got was a Libertas
>> 88W8335 PC Card, I assume I am SOL on that as well.
>
> No, you aren't.
>
> I published the driver into the libertas tree what handles PC
> Cards. At least mine (a compact flash based 8388), the one from
> Marcin and another guy. The driver is still extremely new, maybe
> a little bit fragile, but having people test this beast would be
> wonderful.

Sure I will try it tonight, where should I go to get it? The only trees
with "libertas" in the name on git.kernel.org don't seem to be the ones.

My goal with this to to make a whitelist of cards and chipsets that are
known to inject and monitor (and so work with penumbra) perfectly.

-Andy

2007-08-02 06:26:54