2007-10-11 23:29:20

by Frank de Lange

[permalink] [raw]
Subject: [Oops] EIP is at ath5k_hw_reset+0x391/0xc82 [ath5k] (2.6.23, latest wireless git)

Just got an Atheros-based card from eBay, stuffed it into my Thinkpad
T23 (ignoring the complaints about two ethernet cards being installed)
and got myself this Oops:

BUG: unable to handle kernel NULL pointer dereference at virtual address
00000000
printing eip:
f0a3322d
*pde = 00000000
Oops: 0000 [#1]
PREEMPT
Modules linked in: autofs4 ipv6 speedstep_ich speedstep_lib
cpufreq_stats cpufreq_conservative cpufreq_userspace cpufreq_powersave
cpufreq_ondemand freq_table sbs bay dock nfs lockd sunrpc lp arc4 ecb
blkcipher rc80211_simple snd_intel8x0 snd_ac97_codec ac97_bus
snd_pcm_oss snd_mixer_oss snd_pcm battery ac pcmcia firmware_class video
backlight output snd_seq_dummy irtty_sir sir_dev nsc_ircc irda
snd_seq_oss crc_ccitt ath5k parport_pc parport snd_seq_midi mac80211
yenta_socket rsrc_nonstatic snd_rawmidi snd_seq_midi_event cfg80211
button pcmcia_core snd_seq psmouse snd_timer snd_seq_device iTCO_wdt
serio_raw snd intel_agp agpgart soundcore snd_page_alloc pcspkr evdev
ext3 jbd mbcache sg sr_mod cdrom sd_mod piix ide_core ata_generic
ata_piix floppy libata scsi_mod uhci_hcd e100 mii usbcore thermal
processor fan fuse
CPU: 0
Not tainted VLI
EFLAGS: 00010246 (2.6.23-t23-01 #3)
EIP is at ath5k_hw_reset+0x391/0xc82 [ath5k]
eax: 00000000 ebx: ed6d4f74 ecx: 485683ff edx: 00000005
esi: 00000000 edi: 00000000 ebp: edbe4800 esp: eccf6b44
ds: 007b es: 007b fs: 0000 gs: 0033 ss: 0068
Process NetworkManager (pid: 4593, ti=eccf6000 task=edfbf500
task.ti=eccf6000)
Stack: ed6d4e00 c01abccd f0a2d4bf ed6d4e00 ed6d4f74 ed6d6cec 00000000
00000001
00000241 00000003 00000001 00000002 00000014 ed6d4e00 00000000
00000000
00000000 f0a2d683 00000be6 ed6d4e00 edb26000 00001002 ed6d4e08
f0a2d9c1
Call Trace:
__delay+0x6/0x7
ath_stoprecv+0x2f/0x143 [ath5k]
ath_stop_locked+0xb0/0xc4 [ath5k]
ath_init+0x6e/0xf5 [ath5k]
ieee80211_open+0x1d5/0x3ab [mac80211]
dev_open+0x2d/0x66
dev_change_flags+0x9d/0x150
rtnl_setlink+0x0/0xea
do_setlink+0x1b7/0x281
rtnl_setlink+0x0/0xea
rtnl_setlink+0xd0/0xea
netlink_dump_start+0x104/0x126
rtnetlink_rcv_msg+0x18f/0x1a9
rtnl_dump_ifinfo+0x0/0x7d
netlink_run_queue+0x5c/0xd2
rtnetlink_rcv_msg+0x0/0x1a9
rtnetlink_rcv+0x25/0x3d
netlink_data_ready+0x12/0x4b
netlink_sendskb+0x19/0x2f
netlink_sendmsg+0x236/0x242
sock_sendmsg+0xbb/0xd3
autoremove_wake_function+0x0/0x35
autoremove_wake_function+0x0/0x35
__kfree_skb+0xa1/0xf6
unix_stream_recvmsg+0x3ef/0x49f
verify_iovec+0x3e/0x70
sys_sendmsg+0x194/0x1f9
sys_recvmsg+0x1be/0x1d2
netlink_insert+0x110/0x11a
move_addr_to_user+0x39/0x50
sys_getsockname+0x91/0xa2
sock_init_data+0x51/0x145
sock_setsockopt+0x4d4/0x4ec
d_alloc+0x1b/0x170
d_instantiate+0x40/0x5b
sock_attach_fd+0x53/0xae
sys_socketcall+0x223/0x242
sysenter_past_esp+0x5f/0x85
=======================
Code: fc ff 00 00 03 5d 08 c7 44 24 04 00 00 00 00 0f b6 46 1c 89 04 24
89 e8 e8 65 cf ff ff 89 da 0f b7 c0 e8 b0 a3 77 cf ff 44 24 40 <0f> b7
07 83 c6 14 39 44 24 40 72 b4 83 7d 48 01 76 4f 66 83 7d
SS:ESP 0068:eccf6b44

This Oopsed within NetworkManager but it also crashes/burns when
activated manually. Setting parameters with iwconfig does not bring it
down but ifconfig'ing it up does...

Card is known as 02:02.0 Ethernet controller: Atheros Communications,
Inc. AR2413 802.11bg NIC (rev 01), it is an Askey AR2413A (802.11b/g)
FCC ID:PPD-AR5BMB5 IC:4104A-AR5BMB5

Madwifi (with evil closed HAL code) works on the same card (with
somewhat weak reception which is annoying as I got an Atheros-based card
to get a better radio than the Broadcom-based ones I have lying
around...)

More info available on request...

Cheers//Frank
--
WWWWW ________________________
## o o\ / Frank de Lange \
}# \| / \
\ `--| _/ <Hacker for Hire> \
`---' \ +46-734352015 /
\ [email protected] /
`------------------------'
[ "Omnis enim res, quae dando non deficit, dum habetur
et non datur, nondum habetur, quomodo habenda est." ]


2007-10-12 06:59:58

by Patrick McHardy

[permalink] [raw]
Subject: Re: [Oops] EIP is at ath5k_hw_reset+0x391/0xc82 [ath5k] (2.6.23, latest wireless git)

Nick Kossifidis wrote:
> Can you plz run ath_info tool found in madwifi/tools directory and
> post here the output ??
>
# ./ath_info 0xc0210000
-==Device Information==-
MAC Version: 5212 (0x50)
MAC Revision: 5213A(0x59)
PHY Revision: 5110 (0x0)
PHY Revision: 5110 (0x0)
-==EEPROM Information==-
EEPROM Version: 4.8
EEPROM Size: 16K
Regulatory Domain: 0x60
-==== Capabilities ====-
| 802.11a Support: no |
| 802.11b Support: yes |
| 802.11g Support: yes |
| RFKill Support: yes |
| 32KHz Crystal: yes |
========================
GPIO registers: CR 00000000 DO 00000000 DI 00000005


2007-10-12 09:07:38

by Frank de Lange

[permalink] [raw]
Subject: Re: [Oops] EIP is at ath5k_hw_reset+0x391/0xc82 [ath5k] (2.6.23, latest wireless git)

On Fri, Oct 12, 2007 at 06:48:17AM +0000, Nick Kossifidis wrote:
> Can you plz run ath_info tool found in madwifi/tools directory and
> post here the output ???

#lspci -v

02:02.0 Ethernet controller: Atheros Communications, Inc. AR2413
802.11bg NIC (rev 01)
Subsystem: Askey Computer Corp. Unknown device 7094
Flags: bus master, medium devsel, latency 96, IRQ 11
Memory at c0200000 (32-bit, non-prefetchable) [size=64K]
Capabilities: [44] Power Management version 2

#ath_info 0xc0200000
-==Device Information==-
MAC Version: 5213A(0x70)
MAC Revision: 5213A(0x78)
PHY Revision: 2112a(0x56)
-==EEPROM Information==-
EEPROM Version: 5.2
EEPROM Size: 16K
Regulatory Domain: 0x64
-==== Capabilities ====-
| 802.11a Support: no |
| 802.11b Support: yes |
| 802.11g Support: yes |
| RFKill Support: yes |
| 32KHz Crystal: no |
========================
GPIO registers: CR 00000000 DO 00000000 DI 00000017


Cheers//Frank

--
WWWWW ________________________
## o o\ / Frank de Lange \
}# \| / \
\ `--| _/ <Hacker for Hire> \
`---' \ +46-734352015 /
\ [email protected] /
`------------------------'
[ "Omnis enim res, quae dando non deficit, dum habetur
et non datur, nondum habetur, quomodo habenda est." ]

2007-10-12 09:26:15

by Frank de Lange

[permalink] [raw]
Subject: Re: [Oops] EIP is at ath5k_hw_reset+0x391/0xc82 [ath5k] (2.6.23, latest wireless git)

On Fri, Oct 12, 2007 at 06:48:17AM +0000, Nick Kossifidis wrote:
> Can you plz run ath_info tool found in madwifi/tools directory and
> post here the output ???

#lspci -v

02:02.0 Ethernet controller: Atheros Communications, Inc. AR2413
802.11bg NIC (rev 01)
Subsystem: Askey Computer Corp. Unknown device 7094
Flags: bus master, medium devsel, latency 96, IRQ 11
Memory at c0200000 (32-bit, non-prefetchable) [size=64K]
Capabilities: [44] Power Management version 2

#ath_info 0xc0200000
-==Device Information==-
MAC Version: 5213A(0x70)
MAC Revision: 5213A(0x78)
PHY Revision: 2112a(0x56)
-==EEPROM Information==-
EEPROM Version: 5.2
EEPROM Size: 16K
Regulatory Domain: 0x64
-==== Capabilities ====-
| 802.11a Support: no |
| 802.11b Support: yes |
| 802.11g Support: yes |
| RFKill Support: yes |
| 32KHz Crystal: no |
========================
GPIO registers: CR 00000000 DO 00000000 DI 00000017


Cheers//Frank
--
WWWWW ________________________
## o o\ / Frank de Lange \
}# \| / \
\ `--| _/ <Hacker for Hire> \
`---' \ +46-734352015 /
\ [email protected] /
`------------------------'
[ "Omnis enim res, quae dando non deficit, dum habetur
et non datur, nondum habetur, quomodo habenda est." ]

2007-10-12 04:51:12

by Patrick McHardy

[permalink] [raw]
Subject: Re: [Oops] EIP is at ath5k_hw_reset+0x391/0xc82 [ath5k] (2.6.23, latest wireless git)

diff --git a/drivers/net/wireless/ath5k/hw.c b/drivers/net/wireless/ath5k/hw.c
index ae4c5b5..8018af5 100644
--- a/drivers/net/wireless/ath5k/hw.c
+++ b/drivers/net/wireless/ath5k/hw.c
@@ -499,9 +499,10 @@ const struct ath5k_rate_table *ath5k_hw_get_rate_table(struct ath_hw *hal,
{
AR5K_TRACE;

+#if 0
if (!test_bit(mode, hal->ah_capabilities.cap_mode))
return NULL;
-
+#endif
/* Get rate tables */
switch (mode) {
case MODE_IEEE80211A:


Attachments:
x (453.00 B)

2007-10-12 06:48:20

by Nick Kossifidis

[permalink] [raw]
Subject: Re: [Oops] EIP is at ath5k_hw_reset+0x391/0xc82 [ath5k] (2.6.23, latest wireless git)

Can you plz run ath_info tool found in madwifi/tools directory and
post here the output ???

2007/10/12, Patrick McHardy <[email protected]>:
> Frank de Lange wrote:
> > Just got an Atheros-based card from eBay, stuffed it into my Thinkpad
> > T23 (ignoring the complaints about two ethernet cards being installed)
> > and got myself this Oops:
> >
> > BUG: unable to handle kernel NULL pointer dereference at virtual address
> > 00000000
> > [...]
> > CPU: 0
> > Not tainted VLI
> > EFLAGS: 00010246 (2.6.23-t23-01 #3)
> > EIP is at ath5k_hw_reset+0x391/0xc82 [ath5k]
>
>
> I had the same Oops with the internal card of a Thinkpad T42.
> The reason is that the rate table lookup for MODE_ATHEROS_TURBOG
> returns NULL because the capability bit is not set. I haven't
> tracked down the cause yet, but this patch fixes the Oops for me.
>
> On a related issue, the same card can receive packets fine,
> but all packets sent are received with the first 16 bytes of
> ethernet and IP header missing (the remaining data is fine).
> I didn't find the cause for this either, the packet appears
> to be fine up to the tx function. Anyone have a hint where to
> continue looking? Could this be related to the missing
> capability bit and an incorrect rate table being used?
>
> lspci -vvv:
>
> 02:02.0 Ethernet controller: Atheros Communications, Inc. AR5212
> 802.11abg NIC (rev 01)
> Subsystem: AMBIT Microsystem Corp. Unknown device 0408
> Control: I/O- Mem+ BusMaster- SpecCycle- MemWINV+ VGASnoop-
> ParErr- Stepping- SERR+ FastB2B-
> Status: Cap+ 66MHz- UDF- FastB2B+ ParErr- DEVSEL=medium >TAbort-
> <TAbort- <MAbort- >SERR- <PERR-
> Interrupt: pin A routed to IRQ 11
> Region 0: Memory at c0210000 (32-bit, non-prefetchable) [size=64K]
> Capabilities: [44] Power Management version 2
> Flags: PMEClk- DSI- D1- D2- AuxCurrent=375mA
> PME(D0-,D1-,D2-,D3hot-,D3cold-)
> Status: D0 PME-Enable- DSel=0 DScale=2 PME-
>
> iwconfig output:
>
> ath0 IEEE 802.11b ESSID:"wlan"
> Mode:Managed Frequency:2.412 GHz Access Point: Not-Associated
> Tx-Power=27 dBm
> Retry min limit:7 RTS thr:off Fragment thr=2346 B
> Encryption key:[...]
> Link Quality:0 Signal level:0 Noise level:0
> Rx invalid nwid:0 Rx invalid crypt:0 Rx invalid frag:0
> Tx excessive retries:0 Invalid misc:0 Missed beacon:0
>
> diff --git a/drivers/net/wireless/ath5k/hw.c b/drivers/net/wireless/ath5k/hw.c
> index ae4c5b5..8018af5 100644
> --- a/drivers/net/wireless/ath5k/hw.c
> +++ b/drivers/net/wireless/ath5k/hw.c
> @@ -499,9 +499,10 @@ const struct ath5k_rate_table *ath5k_hw_get_rate_table(struct ath_hw *hal,
> {
> AR5K_TRACE;
>
> +#if 0
> if (!test_bit(mode, hal->ah_capabilities.cap_mode))
> return NULL;
> -
> +#endif
> /* Get rate tables */
> switch (mode) {
> case MODE_IEEE80211A:
>
>


--
GPG ID: 0xD21DB2DB
As you read this post global entropy rises. Have Fun ;-)
Nick