kern/89918: Kernel panic with if_iwi Intel 2200bg

[Evgeny Zislis]

>Number:         89918
>Category:       kern
>Synopsis:       Kernel panic with if_iwi Intel 2200bg
>Confidential:   no
>Severity:       critical
>Priority:       high
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Sun Dec 04 04:00:18 GMT 2005
>Closed-Date:
>Last-Modified:
>Originator:     Evgeny Zislis
>Release:        FreeBSD 6.0-STABLE i386
>Organization:
None
>Environment:
System: FreeBSD thinky5e.kesor.net 6.0-STABLE FreeBSD 6.0-STABLE #: Sun Dec 4 05:09:00 IST 2005 root at thinky5e.kesor.net:/usr/obj/usr/src/sys/THINKY5E.debug i386

>Description:
	On a Lenovo ThinkPad R50e with build-in Intel 2200BG wifi,
	the if_iwi driver panics the kernel on a 6.0-STABLE system.

>How-To-Repeat:
	run a script with something like :

	ifconfig iwi0 down
	ifconfig iwi0 ssid "blabla" bssid 00:C0:02:FA:49:2E channel 5
	ifconfig iwi0 wepmode on wepkey 0xB9F6F7EB7C4A10E702AA989BFB
	ifconfig iwi0 roaming manual
	iwicontrol iwi0 -d /usr/local/share/iwi-firmware
	ifconfig iwi0 up
	(the bssid and wepkey are fictive)

	Then try to :
	1) run kismet_server on this card
	or
	2) run `ifconfig mode 11g`
	or
	3) random requests to iwi0 with your fav. software
	

>Fix:

	Dont know how to fix it, but here is useful information :

	Kernel backtrace after panic,

(kgdb) backtrace
#0  doadump () at pcpu.h:165
During symbol reading, Incomplete CFI data; unspecified registers at 0xc05ae853.

#1  0xc05aede2 in boot (howto=0x104) at /usr/src/sys/kern/kern_shutdown.c:399
#2  0xc05af158 in panic (fmt=0xc07c6e41 "mutex %s recursed at %s:%d") at /usr/src/sys/kern/kern_shutdown.c:555
#3  0xc05a4262 in _mtx_assert (m=0xc3632b6c, what=0x0, file=0xc07c8412 "/usr/src/sys/kern/kern_synch.c", line=0xbc) at /usr/src/sys/kern/kern_mutex.c:748
#4  0xc05b65f9 in msleep (ident=0xc3632000, mtx=0xc3632b6c, priority=0x0, wmesg=0xc3bc0661 "iwiinit", timo=0x3e8) at /usr/src/sys/kern/kern_synch.c:188
#5  0xc3bbdb93 in iwi_load_firmware (sc=0xc3632000, fw=0x1, size=0x27050) at cpu func.h:210
#6  0xc3bbdecf in iwi_load_firmware (sc=0x34, fw=0xc3632000, size=0xc3632b6c) at bus.h:542
#7  0xc3bbecd9 in iwi_init (priv=0xc3400c00) at /usr/src/sys/modules/iwi/../../dev/iwi/if_iwi.c:2265
#8  0xc0636dd9 in ifmedia_ioctl (ifp=0xc3400c00, ifr=0xc3902060, ifm=0xc3632904, cmd=0x0) at /usr/src/sys/net/if_media.c:258
#9  0xc065793b in ieee80211_ioctl (ic=0xc3632004, cmd=0xc0206937, data=0xc34cc040 "iwi0") at /usr/src/sys/net80211/ieee80211_ioctl.c:2403
#10 0xc3bbed58 in iwi_init (priv=0xc3632000) at /usr/src/sys/modules/iwi/../../dev/iwi/if_iwi.c:2534
#11 0xc06325c7 in ifhwioctl (cmd=0xc0206937, ifp=0xc3400c00, data=0xc34cc040 "iwi0", td=0x0) at /usr/src/sys/net/if.c:1441
#12 0xc06327e1 in ifioctl (so=0xc35ab2c8, cmd=0xc0206937, data=0xc34cc040 "iwi0", td=0xc3896480) at /usr/src/sys/net/if.c:1513
#13 0xc05e1daf in soo_ioctl (fp=0x0, cmd=0xc0206937, data=0xc34cc040, active_cred=0xc38cbd00, td=0xc3896480) at /usr/src/sys/kern/sys_socket.c:214
#14 0xc05dab2d in ioctl (td=0xc3896480, uap=0xde687d04) at file.h:258
#15 0xc0774720 in syscall (frame= {tf_fs = 0xc076003b, tf_es = 0x3b, tf_ds = 0x3b, tf_edi = 0x8058100, tf_esi = 0xbfbfedae, tf_ebp = 0xbfbfe418, tf_isp = 0xde687d64, tf_ebx = 0x805d000, tf_edx = 0x3, tf_ecx = 0x805a400, tf_eax = 0x36, tf_trapno = 0xc, tf_err = 0x2, tf_eip = 0x2814e1b7, tf_cs = 0x33, tf_eflags = 0x246, tf_esp = 0xbfbfe3fc, tf_ss = 0x3b}) at /usr/src/sys/i386/i386/trap.c:981
#16 0xc07610cf in Xint0x80_syscall () at /usr/src/sys/i386/i386/exception.s:200
#17 0x00000033 in ?? ()
Previous frame inner to this frame (corrupt stack?)


	Note: Backtrace is same when if_iwi is in kernel, or as a kernel module.
>Release-Note:
>Audit-Trail:
>Unformatted: