Bug 187084

Summary: kernel 2.6.15-1.1884 Oops on Dell Inspiron 8600.
Product: [Fedora] Fedora Reporter: Steven Haigh <netwiz>
Component: kernelAssignee: John W. Linville <linville>
Status: CLOSED CURRENTRELEASE QA Contact: Brian Brock <bbrock>
Severity: high Docs Contact:
Priority: medium    
Version: rawhideCC: davej, linville, smooge, tmraz, wtogami
Target Milestone: ---   
Target Release: ---   
Hardware: i686   
OS: Linux   
Whiteboard:
Fixed In Version: 2.6.17-1.2548.fc6 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2006-08-20 21:29:37 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Steven Haigh 2006-03-28 11:55:48 UTC 
This bug is back on kernel-2.6.16-1.2088_FC6.

Original notes preserved for reference.

+++ This bug was initially created as a clone of Bug #179714 +++

When booting off kernel-2.6.15-1.1884_FC5 the system sets the clock, tries to
start udev, then dies.

The crash output states:
Unable to handle kernel paging request at virtual address f8000022 printing eip:
*pde = 00000000
Oops: 0000 [#1]
last sysfs file: /devices/pci0000:00/0000:00:1f.1/ide0/0.0/modalias
-- snipped a heap of modules to do with sound, network and wifi --
CPU: 0
EIP: 0060:[<f8000022>] Not tainted VLI
EFLAGS: 00010282 (2.6.15-1.1884_FC5)
EIP is at 0xf8000022
eax: 00000000 ebx: 00000020 ecx: 0000000 edx: f88875fa
esi: 0000142d edi: 12000021 ebp: 00001432 esp: f74ebd30
ds: 007b es: 007b ss: 0068
Process modprobe (pid: 688, threadinfo=f75b1000 task=f750a000)
Stack: <0>00001437 12000023 0000143c 00000024 00001441 F7000025 00001446 00000026
0000144b 00000027 00001450 00000028 00001455 f7000029 0000145a f700002a
0000145f ff00002b 00001464 0000002c 00001469 0000002d 0000146e 0000002e
Call Trace:
Code:  00 00 00 00 00 00 00 00 Bad EIP value.

The system then attempts to boot after 120 seconds, but doesn't get very far
before falling in a heap.

I've booted successfully into a previous kernel version (2.6.14-1.1656_FC4)
however I can't find any information that seems to be dumped to any files to get
more details. Are there any other details you require, and how can I gather them?

-- Additional comment from netwiz.au on 2006-02-03 06:21 EST --
This error also occurs on the latest 2.6.15-1.1895_FC5 kernel for i686.

-- Additional comment from davej on 2006-02-03 15:27 EST --
There was no text between the call trace & Code: line ?
(If there was, and you don't want to transcribe it all, a digital camera photo
of the screen is adequate if you have one -- though boot with vga=791 or vga=1
to get more lines of text onscreen).


-- Additional comment from netwiz.au on 2006-02-03 21:59 EST --
Created an attachment (id=124146)
First crash screen with 120 second pause


-- Additional comment from netwiz.au on 2006-02-03 22:00 EST --
Created an attachment (id=124147)
Final death screen. Nothing happens after this point.


-- Additional comment from netwiz.au on 2006-02-03 22:03 EST --
The two above pics of the screen at the crash shows what's going on. I've
updated today to kernel 2.6.15-1.1898_FC5. The crash has changed from the
original one (that didn't have anything between the call trace and code lines) -
however the machine is still unbootable with this kernel.

-- Additional comment from netwiz.au on 2006-02-05 02:52 EST --
This also happens with kernel-2.6.15-1.1907_FC5

-- Additional comment from netwiz.au on 2006-02-06 09:59 EST --
Just updated & confirmed same issue in kernel-2.6.15-1.1909_FC5

-- Additional comment from netwiz.au on 2006-02-08 09:12 EST --
Created an attachment (id=124381)
Initial kernel oops.


-- Additional comment from netwiz.au on 2006-02-08 09:13 EST --
Created an attachment (id=124382)
After the 120 second pause, system stops here (after 3-4 minutes)


-- Additional comment from netwiz.au on 2006-02-08 09:15 EST --
Todays update to kernel-2.6.15-1.1914_FC5 saw a change in the Oops message.
updated images to reflect changes with this build of the kernel.

-- Additional comment from netwiz.au on 2006-02-10 00:40 EST --
Updated today to current rawhide kernel 2.6.15-1.1917_FC5. Booting using vga=791
doesn't reset the font size anymore to the font on the pics... transcript of the
crash follows:

Unable to handle kernel paging request at virtual address 00001621
 printing eip:
*pde = 3f6e0067
Oops: 0000 [#1]
last sysfs file: /devices/pci0000:00/0000:00:1d.2/modalias
Modules linked in: bcm43xx ieee80211softmac ieee80211 joydev ieee80211_crypt b44
mii snd_intel8x0 dns_ac97_codec snd_ac97_bus snd_seq_dummy snd_seq_oss
snd_seq_midi_event snd_seq snd_seq_device snd_pcm_oss snd_mixer_oss snd_pcm
snd_timer snd soundcore snd_page_alloc ext3 jbd
CPU: 0
EIP: 0060:[<00001621>] Not tainted VLI
EFLAGS: 00010282 (2.6.15-1.1917_FC5)
EIP is at 0x1621
eax: 00000000 ebx: 00001617 ecx: 00000000 edx: 00000000
esi: c18f2c83 edi: 0000161c ebp: 12060184 esp: c1951d68
ds: 007b es: 007b ss: 0068
Process modprobe (pid: 657, threadinfo=c1951000 task=f7f6c550)
Stack: <0>00001085 00001626 c1947986 0000162b 00000087 00001630 c18f2d88 00001635
00000289 0000163a 0000008a 0000163f 0000008b 00001644 c18f208c 00001649
c18f208d 0000164e 0000008e 00001653 0000008f 00001658 c18f2c90 0000165d
Call Trace:
 [<c01cca95>] pci_device_probe+0x34/0x57    [<c0228097>] device_attach+0x10/0x65
 [<c0228199>] device_release_driver+0x22/0x38   [<c0227b9b>] bus_unregister+0xf/0x45
 [<c0227f9f>] device_bind_driver+0x0/0x58    [<c02278a0>] bus_add_driver+0xae/0xfd
 [<c0130da7>] sys_init_module+0x1342/0x152d    [<c0129abf>]
wake_bit_function+0x7/0x3c
 [<c0153bc7>] do_sync_write+0xdb/0xf3    [<c0154565>] vfs_read+0x9f/0x13e
 [<c01548cc>] sys_read+0x3c/0x63    [<c0102ba9>] syscall_call+0x7/0xb
Code: Bad EIP value.

Hope this helps a bit more now :)

-- Additional comment from netwiz.au on 2006-02-15 07:34 EST --
Same crash for kernel-2.6.15-1.1939_FC5.

-- Additional comment from davej on 2006-02-18 22:21 EST --
can you attach output of lspci please ? I'm curious what is at 0000:00:1d.2

-- Additional comment from netwiz.au on 2006-02-18 23:01 EST --
# lspci
00:00.0 Host bridge: Intel Corporation 82855PM Processor to I/O Controller (rev 03)
00:01.0 PCI bridge: Intel Corporation 82855PM Processor to AGP Controller (rev 03)
00:1d.0 USB Controller: Intel Corporation 82801DB/DBL/DBM (ICH4/ICH4-L/ICH4-M)
USB UHCI Controller #1 (rev 01)
00:1d.1 USB Controller: Intel Corporation 82801DB/DBL/DBM (ICH4/ICH4-L/ICH4-M)
USB UHCI Controller #2 (rev 01)
00:1d.2 USB Controller: Intel Corporation 82801DB/DBL/DBM (ICH4/ICH4-L/ICH4-M)
USB UHCI Controller #3 (rev 01)
00:1d.7 USB Controller: Intel Corporation 82801DB/DBM (ICH4/ICH4-M) USB2 EHCI
Controller (rev 01)
00:1e.0 PCI bridge: Intel Corporation 82801 Mobile PCI Bridge (rev 81)
00:1f.0 ISA bridge: Intel Corporation 82801DBM (ICH4-M) LPC Interface Bridge
(rev 01)
00:1f.1 IDE interface: Intel Corporation 82801DBM (ICH4-M) IDE Controller (rev 01)
00:1f.5 Multimedia audio controller: Intel Corporation 82801DB/DBL/DBM
(ICH4/ICH4-L/ICH4-M) AC'97 Audio Controller (rev 01)
00:1f.6 Modem: Intel Corporation 82801DB/DBL/DBM (ICH4/ICH4-L/ICH4-M) AC'97
Modem Controller (rev 01)
01:00.0 VGA compatible controller: ATI Technologies Inc RV350 [Mobility Radeon
9600 M10]
02:00.0 Ethernet controller: Broadcom Corporation BCM4401 100Base-T (rev 01)
02:01.0 CardBus bridge: Texas Instruments PCI4510 PC card Cardbus Controller
(rev 02)
02:01.1 FireWire (IEEE 1394): Texas Instruments PCI4510 IEEE-1394 Controller
02:03.0 Network controller: Broadcom Corporation BCM4309 802.11a/b/g (rev 02)


-- Additional comment from i.nousias.uk on 2006-02-21 20:50 EST --
Created an attachment (id=124998)
appiarence of first error message


-- Additional comment from i.nousias.uk on 2006-02-21 20:53 EST --
(From update of attachment 124998 [details])
first error message


-- Additional comment from i.nousias.uk on 2006-02-21 20:57 EST --
as the new attachment shows this error appears in Fedora Core 5 Test 3 on a dell
Latitude D800 laptop as well. I've tested FC5 Test2 on two identical D800
laptops and came up with the same results.

-- Additional comment from redhat.de on 2006-02-22 03:36 EST --
I can confirm this bug on a Dell Inspiron 510m and FC5test3.

-- Additional comment from netwiz.au on 2006-02-23 23:42 EST --
I can confirm this still happens with kernel-2.6.15-1.1975_FC5

The latest bootable kernel I have found is kernel-2.6.15-1.1824_FC4

-- Additional comment from i.nousias.uk on 2006-02-24 18:18 EST --
kernel-2.6.15-1.1824_FC4 (i686) is bootable on my D800 as well under FC5 test3.
Thanks for the tip.

-- Additional comment from netwiz.au on 2006-02-27 06:10 EST --
I believe this may have something to do with the 802.11a/b/g wireless mini PCI
card. I have ndiswrapper installed, and I'm wondering out loud if ndis wrapper
and the experimental broadcom wifi drivers could cause this issue (if in fact
drivers are present!). I might be way off base here - as I'm only thinking out loud.

Do any of the other people having this issue have the same 802.11a/b/g card?

-- Additional comment from smooge on 2006-02-28 14:28 EST --
The problem seems to be with the broadcom minipci card and the current unstable
driver. Not sure if the problem is with the miniPCI controller unit or the card
itself. I think the driver needs a refresh with the upstream?

-- Additional comment from i.nousias.uk on 2006-02-28 19:11 EST --
I was leading to the same conclusion. I don't have any hard evidence though, it
is more like a hunch. My latitude D800 has the exact same wifi card as Steven's
laptop(inspiron 8600). This is my (D800) pci setup:

00:00.0 Host bridge: Intel Corporation 82855PM Processor to I/O Controller (rev 03)
00:01.0 PCI bridge: Intel Corporation 82855PM Processor to AGP Controller (rev 03)
00:1d.0 USB Controller: Intel Corporation 82801DB/DBL/DBM (ICH4/ICH4-L/ICH4-M)
USB UHCI Controller #1 (rev 01)
00:1d.1 USB Controller: Intel Corporation 82801DB/DBL/DBM (ICH4/ICH4-L/ICH4-M)
USB UHCI Controller #2 (rev 01)
00:1d.2 USB Controller: Intel Corporation 82801DB/DBL/DBM (ICH4/ICH4-L/ICH4-M)
USB UHCI Controller #3 (rev 01)
00:1d.7 USB Controller: Intel Corporation 82801DB/DBM (ICH4/ICH4-M) USB2 EHCI
Controller (rev 01)
00:1e.0 PCI bridge: Intel Corporation 82801 Mobile PCI Bridge (rev 81)
00:1f.0 ISA bridge: Intel Corporation 82801DBM (ICH4-M) LPC Interface Bridge
(rev 01)
00:1f.1 IDE interface: Intel Corporation 82801DBM (ICH4-M) IDE Controller (rev 01)
00:1f.5 Multimedia audio controller: Intel Corporation 82801DB/DBL/DBM
(ICH4/ICH4-L/ICH4-M) AC'97 Audio Controller (rev 01)
00:1f.6 Modem: Intel Corporation 82801DB/DBL/DBM (ICH4/ICH4-L/ICH4-M) AC'97
Modem Controller (rev 01)
01:00.0 VGA compatible controller: nVidia Corporation NV28 [GeForce4 Ti 4200 Go
AGP 8x] (rev a1)
02:00.0 Ethernet controller: Broadcom Corporation NetXtreme BCM5705M Gigabit
Ethernet (rev 01)
02:01.0 CardBus bridge: Texas Instruments PCI7510 PC card Cardbus Controller
(rev 01)
02:01.1 CardBus bridge: Texas Instruments PCI7510,7610 PC card Cardbus
Controller (rev 01)
02:01.2 FireWire (IEEE 1394): Texas Instruments PCI7410,7510,7610 OHCI-Lynx
Controller
02:01.3 System peripheral: Texas Instruments PCI7410,7510,7610 PCI Firmware
Loading Function
02:03.0 Network controller: Broadcom Corporation BCM4309 802.11a/b/g (rev 02)

bear in mind that the vanila linux kernel 2.6.15-4 does boot on my D800 (though
produces some error messages related with the dbus). Also I installed
ndiswrapper as well and the broadcom card seems to be working fine (though I
have some issues with non-broadcasted sid and the wpa-supplicant doesn't seem to
work well, but that's another story).




-- Additional comment from netwiz.au on 2006-03-02 09:17 EST --
ok - this is definatly the bcm43xx kernel module. Booting under a different
kernel version, if you rename bcm43xx.ko to bcm43xx.ko.disabled and reboot into
the latest installed kernel, all works perfectly.

Rename the file back, and the oops occurs every single time.

I leave it now to the kernel hackers among us to decide what do to on this one -
as I'm out of ideas and don't have enough knowledge to fix it.

-- Additional comment from redhat.de on 2006-03-02 09:28 EST --
I have renamed the file using the rescue system, and now I can boot the Dell
Inspiron 510m with FC5test3. Thanks!

-- Additional comment from i.nousias.uk on 2006-03-02 13:43 EST --
indeed! that works for me as well (latitude D800 and FC5 Test3 with
2.6.15-1.1996 kernel)

thanks for the tip!

-- Additional comment from smooge on 2006-03-03 18:39 EST --
*** Bug 183064 has been marked as a duplicate of this bug. ***

-- Additional comment from smooge on 2006-03-04 17:19 EST --
On several Dell systems you can get around this bug by turning off the MiniPCI
in the BIOS. 

-- Additional comment from netwiz.au on 2006-03-04 17:24 EST --
Although then you lose functionality of what's in the miniPCI slot - usually a
wifi card. I wouldn't call it a workaround - more a 'disabling the affected
hardware'

-- Additional comment from smooge on 2006-03-04 20:33 EST --
Well the wifi card will be the one that is crashing the system. It as much a
work-around as removing the bcm43xx.ko module. 

-- Additional comment from netwiz.au on 2006-03-04 20:41 EST --
The difference being is that with only the module removed, you can still use
ndiswrapper or similar to use the functionality of the wifi card. Disabling the
hardware makes the card unusable.

-- Additional comment from smooge on 2006-03-04 21:40 EST --
That is correct.. but if this problem comes up for the person who cant get a
rescue disk going for some reason.. turning off the minipci temporarily is a fix
for them to get into the system, remove the offending module if they needed to
or just get the laptop to work. 

-- Additional comment from davej on 2006-03-06 11:45 EST --
does this happen even if you haven't installed the firmware?

If so, we'll probably have to chop out the pci module table that makes it
autoload for FC5, and make people who want to test with it modprobe it by hand.


-- Additional comment from netwiz.au on 2006-03-06 11:53 EST --
I don't understand what you mean here Dave. I have never installed any firmware
for the wifi card. The best I have done is to get the card working with
ndiswrapper by copying across the 2 files from the windows driver.

Are you able to clarify what you mean?

-- Additional comment from linville on 2006-03-06 13:13 EST --
What is the latest kernel version which you have tried?  There was a bcm43xx  
update that went into rawhide on Friday.  
 
Regarding comment 34, the bcm43xx driver requires you to use the fwcutter 
routine to retrieve the firmware from a working windows (or other) driver. 
 
   http://bcm43xx.berlios.de/ 

-- Additional comment from netwiz.au on 2006-03-06 13:56 EST --
The latest kernel I have tried is kernel-2.6.15-1.2009.4.2_FC5.

I haven't done anything with fwcutter, and it doesn't look like there is an RPM
with it in there - so it looks like I'll have to get it from source and see what
I can do.

Before finishing this post, I've now extracted the firmware from bcmw15.sys
driver I was using with ndiswrapper. I've placed the files in /lib/firmware,
however the Oops on booting any new kernel still occurs.

Latest Oops photo to follow (too late to copy out the text at 6am!)


-- Additional comment from netwiz.au on 2006-03-06 14:00 EST --
Created an attachment (id=125715)
Latest kernel oops on kernel-2.6.15-1.2009.4.2_FC5.


-- Additional comment from smooge on 2006-03-07 09:51 EST --
Dave,

The problem occurs with a clean install and updates to the latest modules. I
never got to the point of getting firmware for the system. I was wondering which
version of the kernel module you were using.. one seemed to require the firmware
and one seemed not to (or uses it in a different way).

-- Additional comment from netwiz.au on 2006-03-09 13:17 EST --
I can confirm that the latest kernel update (kernel-2.6.15-1.2032_FC5) boots
correctly with the bcm43xx driver removed.

I suggest that support for this continues to be disabled until related tools
such as the firmware cutter is available as a package and worked into the boot
sequence somehow. At this stage, it's probably not a good idea to re-enable this
on the default kernels until the bcm43xx driver is fully stable and can be fully
operational (or at least not crash the system) on a new RPM install of the kernel.

-- Additional comment from linville on 2006-03-09 14:11 EST --
I don't see a good reason to leave this hanging around until then.  I'm going 
to close this now under the (hopefuly) presumption that when the bcm43xx 
driver comes back, it won't be causing these problems.
Comment 1 John W. Linville 2006-08-01 18:51:44 UTC 
Well, a lot of time has passed and bcm43xx has come a long way...is this still 
an issue with current Fedora kernels?  If so, could you try the Fedora-netdev 
kernels as well?

   http://people.redhat.com/linville/kernels/fedora-netdev/

Please give those a try and report the results here...thanks!
Comment 2 Steven Haigh 2006-08-11 04:09:23 UTC 
I haven't had FC (or linux in general) installed on my 8600 for quite some time
due to general instability I found and I needed the machine to be stable for
work at the time.

As this is no longer the case, I'll download the FC5 DVD image later today and
update it to the latest FC-devel stream and I'll post back with my findings.
Give me a day or two to get all this done.
Comment 3 Steven Haigh 2006-08-11 10:41:39 UTC 
Ok, I managed to get FC Updated to rawhide. Kernel-2.6.17-1.2543.fc6 does not
Oops' on boot, however I cannot get the broadcom adapter to function at all. I
used the fwcutter as such:

# bcm43xx-fwcutter -w /lib/firmware bcmwl5.sys
bcm43xx-fwcutter can cut the firmware out of bcmwl5.sys

  filename :  bcmwl5.sys
  version  :  4.10.40.0
  MD5      :  30d20fc98bcfd52e1da778cf19b223d4

extracting bcm43xx_microcode2.fw ...
extracting bcm43xx_microcode4.fw ...
extracting bcm43xx_microcode5.fw ...
*****: Sorry, it's not posible to extract "bcm43xx_microcode11.fw".
*****: Extracting firmware from an old driver is bad. Choose a more recent one.
*****: Luckily bcm43xx driver doesn't include microcode11 uploads at the moment.
*****: But this can be added in the future...
extracting bcm43xx_pcm4.fw ...
extracting bcm43xx_pcm5.fw ...
extracting bcm43xx_initval01.fw ...
extracting bcm43xx_initval02.fw ...
extracting bcm43xx_initval03.fw ...
extracting bcm43xx_initval04.fw ...
extracting bcm43xx_initval05.fw ...
extracting bcm43xx_initval06.fw ...
extracting bcm43xx_initval07.fw ...
extracting bcm43xx_initval08.fw ...
extracting bcm43xx_initval09.fw ...
extracting bcm43xx_initval10.fw ...

However, in /var/log/messages, I notice the following:
Aug 11 20:32:49 localhost kernel: bcm43xx: Card IRQ register not responding.
Giving up.
Aug 11 20:32:51 localhost NetworkManager: <WARNING>     
nm_device_802_11_wireless_scan (): could not trigger wireless scan on device
eth1: No such device

Looking at /proc/interrupts, I don't see anything showing the bcm43xx module. As
you can see, it also causes NetworkManager some issues due to the card not
responding.

I also show similar things in dmesg:
# dmesg | grep bcm
bcm43xx driver
bcm43xx: Chip ID 0x4306, rev 0x2
bcm43xx: Number of cores: 6
bcm43xx: Core 0: ID 0x800, rev 0x2, vendor 0x4243, enabled
bcm43xx: Core 1: ID 0x812, rev 0x4, vendor 0x4243, disabled
bcm43xx: Core 2: ID 0x80d, rev 0x1, vendor 0x4243, enabled
bcm43xx: Core 3: ID 0x807, rev 0x1, vendor 0x4243, disabled
bcm43xx: Core 4: ID 0x804, rev 0x7, vendor 0x4243, enabled
bcm43xx: Core 5: ID 0x812, rev 0x4, vendor 0x4243, disabled
bcm43xx: PHY connected
bcm43xx: Detected PHY: Version: 1, Type 2, Revision 1
bcm43xx: Detected Radio: ID: 2205017f (Manuf: 17f Ver: 2050 Rev: 2)
bcm43xx: Radio turned off
bcm43xx: Radio turned off
bcm43xx: PHY disconnected
bcm43xx: Detected PHY: Version: 1, Type 0, Revision 2
bcm43xx: Detected Radio: ID: 1206017f (Manuf: 17f Ver: 2060 Rev: 1)
bcm43xx: Radio turned off
bcm43xx: Radio turned off
bcm43xx: PHY connected
bcm43xx: PHY disconnected
bcm43xx: PHY connected
bcm43xx: Card IRQ register not responding. Giving up.
bcm43xx: Card IRQ register not responding. Giving up.
bcm43xx: set security called, .level = 0, .enabled = 0, .encrypt = 0
bcm43xx: Card IRQ register not responding. Giving up.
bcm43xx: Card IRQ register not responding. Giving up.
bcm43xx: Card IRQ register not responding. Giving up.
Comment 4 Steven Haigh 2006-08-11 11:07:10 UTC 
Researching further into this... it looks like the driver version 4.10.4.0 does
not work with this card (and maybe all of them?).

I downloaded a different firmware from a different source (WLI2-PCI-G54S.zip),
and exctracted the firmware as follows. I now don't see any errors about
interrupt timeouts in dmesg.

# bcm43xx-fwcutter -i BCMWL5.SYS
bcm43xx-fwcutter can cut the firmware out of BCMWL5.SYS

  filename :  bcmwl5.sys
  version  :  3.104.64.50
  MD5      :  12554a8f91c5d565b96b6ebcfeb6a91a

Now I get:
bcm43xx driver
bcm43xx: Chip ID 0x4306, rev 0x2
bcm43xx: Number of cores: 6
bcm43xx: Core 0: ID 0x800, rev 0x2, vendor 0x4243, enabled
bcm43xx: Core 1: ID 0x812, rev 0x4, vendor 0x4243, disabled
bcm43xx: Core 2: ID 0x80d, rev 0x1, vendor 0x4243, enabled
bcm43xx: Core 3: ID 0x807, rev 0x1, vendor 0x4243, disabled
bcm43xx: Core 4: ID 0x804, rev 0x7, vendor 0x4243, enabled
bcm43xx: Core 5: ID 0x812, rev 0x4, vendor 0x4243, disabled
bcm43xx: PHY connected
bcm43xx: Detected PHY: Version: 1, Type 2, Revision 1
bcm43xx: Detected Radio: ID: 2205017f (Manuf: 17f Ver: 2050 Rev: 2)
bcm43xx: Radio turned off
bcm43xx: Radio turned off
bcm43xx: PHY disconnected
bcm43xx: Detected PHY: Version: 1, Type 0, Revision 2
bcm43xx: Detected Radio: ID: 1206017f (Manuf: 17f Ver: 2060 Rev: 1)
bcm43xx: Radio turned off
bcm43xx: Radio turned off
bcm43xx: PHY connected
bcm43xx: PHY disconnected
bcm43xx: PHY connected
bcm43xx: Radio turned on
bcm43xx: Chip initialized
bcm43xx: DMA initialized
bcm43xx: PHY disconnected
bcm43xx: Radio turned off
bcm43xx: TODO: Incomplete code in bcm43xx_radio_selectchannel() at
drivers/net/wireless/bcm43xx/bcm43xx_radio.c:1608
bcm43xx: TODO: Incomplete code in bcm43xx_radio_selectchannel() at
drivers/net/wireless/bcm43xx/bcm43xx_radio.c:1611
bcm43xx: TODO: Incomplete code in bcm43xx_radio_selectchannel() at
drivers/net/wireless/bcm43xx/bcm43xx_radio.c:1651
bcm43xx: Radio turned on
bcm43xx: TODO: Incomplete code in bcm43xx_phy_inita() at
drivers/net/wireless/bcm43xx/bcm43xx_phy.c:577
bcm43xx: TODO: Incomplete code in bcm43xx_radio_selectchannel() at
drivers/net/wireless/bcm43xx/bcm43xx_radio.c:1608
bcm43xx: TODO: Incomplete code in bcm43xx_radio_selectchannel() at
drivers/net/wireless/bcm43xx/bcm43xx_radio.c:1611
bcm43xx: TODO: Incomplete code in bcm43xx_radio_selectchannel() at
drivers/net/wireless/bcm43xx/bcm43xx_radio.c:1651
bcm43xx: TODO: Incomplete code in bcm43xx_radio_set_txpower_a() at
drivers/net/wireless/bcm43xx/bcm43xx_radio.c:1799
bcm43xx: Chip initialized
bcm43xx: DMA initialized
bcm43xx: Radio turned off
bcm43xx: 80211 cores initialized
bcm43xx: TODO: Incomplete code in keymac_write() at
drivers/net/wireless/bcm43xx/bcm43xx_main.c:1141
bcm43xx: TODO: Incomplete code in keymac_write() at
drivers/net/wireless/bcm43xx/bcm43xx_main.c:1141
bcm43xx: TODO: Incomplete code in keymac_write() at
drivers/net/wireless/bcm43xx/bcm43xx_main.c:1141
bcm43xx: TODO: Incomplete code in keymac_write() at
drivers/net/wireless/bcm43xx/bcm43xx_main.c:1141
bcm43xx: TODO: Incomplete code in keymac_write() at
drivers/net/wireless/bcm43xx/bcm43xx_main.c:1141
bcm43xx: TODO: Incomplete code in keymac_write() at
drivers/net/wireless/bcm43xx/bcm43xx_main.c:1141
bcm43xx: TODO: Incomplete code in keymac_write() at
drivers/net/wireless/bcm43xx/bcm43xx_main.c:1141
bcm43xx: TODO: Incomplete code in keymac_write() at
drivers/net/wireless/bcm43xx/bcm43xx_main.c:1141
bcm43xx: TODO: Incomplete code in keymac_write() at
drivers/net/wireless/bcm43xx/bcm43xx_main.c:1143
bcm43xx: TODO: Incomplete code in keymac_write() at
drivers/net/wireless/bcm43xx/bcm43xx_main.c:1143
bcm43xx: TODO: Incomplete code in keymac_write() at
drivers/net/wireless/bcm43xx/bcm43xx_main.c:1143
bcm43xx: TODO: Incomplete code in keymac_write() at
drivers/net/wireless/bcm43xx/bcm43xx_main.c:1143
bcm43xx: Keys cleared
bcm43xx: set security called, .level = 0, .enabled = 0, .encrypt = 0

It still doesn't look like I can use the card. For some reason, NetworkManager
seems to have issues showing it's applet in gnome unless I manually drop to a
root shell and restart the the Network Manager process via:

# /etc/init.d/NetworkManager restart
Stopping NetworkManager daemon:                            [  OK  ]
Setting network parameters...
Starting NetworkManager daemon:                            [  OK  ]

The NetworkManager icon then appears in Gnome, however when trying to log into a
plain unencrypted AP, it fails. /var/log/messages shows there is lots of
scanning channels happening, and lots of "ToDO: Incomplete code in
bcm43xx_radio_selectchannel() at drivers/net/wireless/bcm43xx/bcm43xx_phy.c:160"
. This includes like 160, 161 and 165.

Looks like this card may still be a no go? Or am I missing something?
Comment 5 Steven Haigh 2006-08-11 13:34:24 UTC 
Updated to kernel version 2.6.17-1.2548.fc6.

Getting further with this. NetworkManager no longer takes forever to respond,
and the list of wireless networks available shows up straight away. When trying
to associate with an AP however, The following occurs:

NetworkManager: <information> User Switch:
/org/freedesktop/NetworkManager/Devices/eth1 / Node_AAC 
NetworkManager: <information> Deactivating device eth1. 
dhcdbd: message_handler: message handler not found under /com/redhat/dhcp/eth1
for sub-path eth1.dbus.get.reason
NetworkManager: <information> Device eth1 activation scheduled... 
NetworkManager: <information> Deactivating device eth0. 
dhclient: DHCPRELEASE on eth0 to 10.1.1.1 port 67
named[1859]: D-BUS: dhclient for interface eth0 released lease - removing
forwarders.
avahi-daemon[1780]: Withdrawing address record for 10.1.1.122 on eth0.
avahi-daemon[1780]: Leaving mDNS multicast group on interface eth0.IPv4 with
address 10.1.1.122.
avahi-daemon[1780]: Leaving mDNS multicast group on interface eth0.IPv4 with
address 10.1.1.122.
avahi-daemon[1780]: IP_DROP_MEMBERSHIP failed: No such device
avahi-daemon[1780]: iface.c: interface_mdns_mcast_join() called but no local
address available.
avahi-daemon[1780]: Interface eth0.IPv4 no longer relevant for mDNS.
avahi-daemon[1780]: Withdrawing address record for fe80::20f:1fff:fe0e:cf70 on eth0.
avahi-daemon[1780]: Leaving mDNS multicast group on interface eth0.IPv6 with
address fe80::20f:1fff:fe0e:cf70.
avahi-daemon[1780]: iface.c: interface_mdns_mcast_join() called but no local
address available.
avahi-daemon[1780]: Interface eth0.IPv6 no longer relevant for mDNS.
NetworkManager: <information> Activation (eth1) started... 
NetworkManager: <information> Activation (eth1) Stage 1 of 5 (Device Prepare)
scheduled... 
NetworkManager: <information> Activation (eth1) Stage 1 of 5 (Device Prepare)
started... 
NetworkManager: <information> Activation (eth1) Stage 2 of 5 (Device Configure)
scheduled... 
NetworkManager: <information> Activation (eth1) Stage 1 of 5 (Device Prepare)
complete. 
NetworkManager: <information> Activation (eth1) Stage 2 of 5 (Device Configure)
starting... 
NetworkManager: <information> Activation (eth1/wireless): access point
'Node_AAC' is unencrypted, no key needed. 
NetworkManager: <information> Old device 'eth1' activating, won't change. 
NetworkManager: <information> SUP: sending command 'INTERFACE_ADD eth1         
      wext    /var/run/wpa_supplicant ' 
NetworkManager: <information> SUP: response was 'OK' 
NetworkManager: <information> SUP: sending command 'AP_SCAN 1' 
NetworkManager: <information> SUP: response was 'OK' 
NetworkManager: <information> SUP: sending command 'ADD_NETWORK' 
NetworkManager: <information> SUP: response was '0' 
NetworkManager: <information> SUP: sending command 'SET_NETWORK 0 ssid
4e6f64655f414143' 
NetworkManager: <information> SUP: response was 'OK' 
NetworkManager: <information> SUP: sending command 'SET_NETWORK 0 key_mgmt NONE' 
NetworkManager: <information> SUP: response was 'OK' 
NetworkManager: <information> SUP: sending command 'ENABLE_NETWORK 0' 
NetworkManager: <information> SUP: response was 'OK' 
NetworkManager: <information> Activation (eth1) Stage 2 of 5 (Device Configure)
complete. 
NetworkManager: <information> wpa_supplicant(2400): Global control interface
'/var/run/wpa_supplicant-global' 
NetworkManager: <information> wpa_supplicant(2400): RX global ctrl_iface -
hexdump_ascii(len=49): 
NetworkManager: <information> wpa_supplicant(2400):      49 4e 54 45 52 46 41 43
45 5f 41 44 44 20 65 74   INTERFACE_ADD et 
NetworkManager: <information> wpa_supplicant(2400):      68 31 09 09 77 65 78 74
09 2f 76 61 72 2f 72 75   h1__wext_/var/ru 
NetworkManager: <information> wpa_supplicant(2400):      6e 2f 77 70 61 5f 73 75
70 70 6c 69 63 61 6e 74   n/wpa_supplicant 
NetworkManager: <information> wpa_supplicant(2400):      09                    
                           _                
NetworkManager: <information> wpa_supplicant(2400): CTRL_IFACE GLOBAL
INTERFACE_ADD 'eth1             wext   /var/run/wpa_supplicant  ' 
NetworkManager: <information> wpa_supplicant(2400): Initializing interface
'eth1' conf 'N/A' driver 'wext' ctrl_interface '/var/run/wpa_supplicant' 
NetworkManager: <information> wpa_supplicant(2400): Initializing interface (2)
'eth1' 
NetworkManager: <information> wpa_supplicant(2400): EAPOL: SUPP_PAE entering
state DISCONNECTED 
NetworkManager: <information> wpa_supplicant(2400): EAPOL: KEY_RX entering state
NO_KEY_RECEIVE 
NetworkManager: <information> wpa_supplicant(2400): EAPOL: SUPP_BE entering
state INITIALIZE 
NetworkManager: <information> wpa_supplicant(2400): EAP: EAP entering state
DISABLED 
NetworkManager: <information> wpa_supplicant(2400): EAPOL: External notification
- portEnabled=0 
NetworkManager: <information> wpa_supplicant(2400): EAPOL: External notification
- portValid=0 
NetworkManager: <information> wpa_supplicant(2400): SIOCGIWRANGE:
WE(compiled)=20 WE(source)=18 enc_capa=0xf 
NetworkManager: <information> Old device 'eth1' activating, won't change. 
NetworkManager: <information> wpa_supplicant(2400):   capabilities: key_mgmt 0xf
enc 0xf 
NetworkManager: <information> wpa_supplicant(2400): Own MAC address:
00:90:4b:74:1f:e3 
NetworkManager: <information> wpa_supplicant(2400): wpa_driver_wext_set_wpa 
NetworkManager: <WARNING>      request_and_convert_scan_results (): card took
too much time scanning.  Get a better one. 
NetworkManager: <information> Old device 'eth1' activating, won't change. 
NetworkManager: <information> wpa_supplicant(2400): =0 key_idx=0 set_tx=0
seq_len=0 key_len=0 
NetworkManager: <information> wpa_supplicant(2400): wpa_driver_wext_set_key:
alg=0 key_idx=1 set_tx=0 seq_len=0 key_len=0 
NetworkManager: <information> wpa_supplicant(2400): wpa_driver_wext_set_key:
alg=0 key_idx=2 set_tx=0 seq_len=0 key_len=0 
NetworkManager: <information> wpa_supplicant(2400): wpa_driver_wext_set_key:
alg=0 key_idx=3 set_tx=0 seq_len=0 key_len=0 
NetworkManager: <information> wpa_supplicant(2400): wpa_driver_wext_set_key:
alg=0 key_idx=1 set_tx=0 seq_len=0 key_len=0 
NetworkManager: <information> wpa_supplicant(2400): wpa_driver_wext_set_key:
alg=0 key_idx=2 set_tx=0 seq_len=0 key_len=0 
NetworkManager: <information> wpa_supplicant(2400): wpa_driver_wext_set_key:
alg=0 key_idx=3 set_tx=0 seq_len=0 key_len=0 
NetworkManager: <information> wpa_supplicant(2400):
wpa_driver_wext_set_countermeasures 
NetworkManager: <information> wpa_supplicant(2400):
wpa_driver_wext_set_drop_unencrypted 
NetworkManager: <information> wpa_supplicant(2400): Setting scan request: 0 sec
100000 usec 
NetworkManager: <information> wpa_supplicant(2400): Added interface eth1 
NetworkManager: <information> wpa_supplicant(2400): Wireless event: cmd=0x8b06
len=8 
NetworkManager: <information> wpa_supplicant(2400): RX ctrl_iface -
hexdump_ascii(len=9): 
NetworkManager: <information> wpa_supplicant(2400):      41 50 5f 53 43 41 4e 20
31                        AP_SCAN 1        
NetworkManager: <information> wpa_supplicant(2400): RX ctrl_iface -
hexdump_ascii(len=11): 
NetworkManager: <information> wpa_supplicant(2400):      41 44 44 5f 4e 45 54 57
4f 52 4b                  ADD_NETWORK      
NetworkManager: <information> wpa_supplicant(2400): CTRL_IFACE: ADD_NETWORK 
NetworkManager: <information> wpa_supplicant(2400): RX ctrl_iface -
hexdump_ascii(len=35): 
NetworkManager: <information> wpa_supplicant(2400):      53 45 54 5f 4e 45 54 57
4f 52 4b 20 30 20 73 73   SET_NETWORK 0 ss 
NetworkManager: <information> wpa_supplicant(2400):      69 64 20 34 65 36 66 36
34 36 35 35 66 34 31 34   id 4e6f64655f414 
NetworkManager: <information> wpa_supplicant(2400):      31 34 33              
                           143              
NetworkManager: <information> wpa_supplicant(2400): CTRL_IFACE: SET_NETWORK id=0
name='ssid' value='4e6f64655f414143' 
NetworkManager: <information> wpa_supplicant(2400): ssid - hexdump_ascii(len=8): 
NetworkManager: <information> Old device 'eth1' activating, won't change. 
NetworkManager: <WARNING>      request_and_convert_scan_results (): card took
too much time scanning.  Get a better one. 
NetworkManager: <information> wpa_supplicant(2400): f 64 65 5f 41 41 43        
                  Node_AAC         
NetworkManager: <information> wpa_supplicant(2400): RX ctrl_iface -
hexdump_ascii(len=27): 
NetworkManager: <information> wpa_supplicant(2400):      53 45 54 5f 4e 45 54 57
4f 52 4b 20 30 20 6b 65   SET_NETWORK 0 ke 
NetworkManager: <information> wpa_supplicant(2400):      79 5f 6d 67 6d 74 20 4e
4f 4e 45                  y_mgmt NONE      
NetworkManager: <information> wpa_supplicant(2400): CTRL_IFACE: SET_NETWORK id=0
name='key_mgmt' value='NONE' 
NetworkManager: <information> wpa_supplicant(2400): key_mgmt: 0x4 
NetworkManager: <information> wpa_supplicant(2400): RX ctrl_iface -
hexdump_ascii(len=16): 
NetworkManager: <information> wpa_supplicant(2400):      45 4e 41 42 4c 45 5f 4e
45 54 57 4f 52 4b 20 30   ENABLE_NETWORK 0 
NetworkManager: <information> wpa_supplicant(2400): CTRL_IFACE: ENABLE_NETWORK id=0 
NetworkManager: <information> wpa_supplicant(2400): Setting scan request: 0 sec
0 usec 
NetworkManager: <information> wpa_supplicant(2400): State: DISCONNECTED -> SCANNING 
NetworkManager: <information> wpa_supplicant(2400): Starting AP scan (broadcast
SSID) 
NetworkManager: <information> wpa_supplicant(2400): RX ctrl_iface -
hexdump_ascii(len=6): 
NetworkManager: <information> Old device 'eth1' activating, won't change. 
NetworkManager: <information> wpa_supplicant(2400):      41 54 54 41 43 48     
                           ATTACH           
NetworkManager: <information> wpa_supplicant(2400): CTRL_IFACE monitor attached
- hexdump(len=42): 2f 76 61 72 2f 72 75 6e 2f 4e 65 74 77 6f 72 6b 4d 61 6e 61
67 65 72 2f 77 70 61 5f 63 74 72 6c 5f 31 38 36 39 2d 31 00 00 00 
NetworkManager: <information> wpa_supplicant(2400): Wireless event: cmd=0x8b19
len=8 
NetworkManager: <information> wpa_supplicant(2400): Received 222 bytes of scan
results (1 BSSes) 
NetworkManager: <information> wpa_supplicant(2400): Scan results: 1 
NetworkManager: <information> wpa_supplicant(2400): Selecting BSS from priority
group 0 
NetworkManager: <WARNING>      request_and_convert_scan_results (): card took
too much time scanning.  Get a better one. 
kernel: SoftMAC: Associate: Scanning for networks first.
kernel: SoftMAC: Start scanning with channel: 1
kernel: SoftMAC: Scanning 14 channels
kernel: SoftMAC: Scanning finished
kernel: SoftMAC: Associate: Scanning for networks first.
kernel: SoftMAC: Start scanning with channel: 1
kernel: SoftMAC: Scanning 14 channels
kernel: SoftMAC: Scanning finished
kernel: SoftMAC: Associate: Scanning for networks first.
kernel: SoftMAC: Start scanning with channel: 1
kernel: SoftMAC: Scanning 14 channels
kernel: SoftMAC: Scanning finished
kernel: SoftMAC: Unable to find matching network after scan!
kernel: bcm43xx: set security called, .level = 0, .enabled = 0, .encrypt = 0
last message repeated 4 times
kernel: SoftMAC: Start scanning with channel: 1
kernel: SoftMAC: Scanning 14 channels
kernel: SoftMAC: Scanning finished

What it looks like happening is the SSID may not acted on correctly. I joined
the network "Node_AAC" however, the command issued to configure the wireless
card shows 'SET_NETWORK 0 ssid 4e6f64655f414143'. I would assume this should be
'SET_NETWORK 0 ssid Node_AAC'.

This could also be why later on wpa_supplicant reports "State: DISCONNECTED ->
SCANNING" - as the system was configured for a non-existant SSID thus triggering
an eternal scan until NetworkManager timesout and re-enables eth0.
Comment 6 Steven Haigh 2006-08-11 13:40:50 UTC 
I've also tried the netdev kernel, and when trying to check the repo for
updates, I get:

# yum check-update
Loading "installonlyn" plugin
Setting up repositories
http://people.redhat.com/linville/kernels/fedora-netdev/5.91.1/repodata/repomd.xml:
[Errno 14] HTTP Error 404: Date: Fri, 11 Aug 2006 13:48:46 GMT
Server: Apache/1.3.27 (Unix)  (Red-Hat/Linux) mod_python/2.7.8 Python/1.5.2
mod_ssl/2.8.12 OpenSSL/0.9.6b
Last-Modified: Mon, 19 May 2003 01:22:43 GMT
ETag: "18a4002-1b9-3ec831e3;44d0c420"
Accept-Ranges: bytes
Content-Length: 441
Content-Type: text/html
Age: 13
X-Cache: HIT from zeus.crc.id.au
X-Cache-Lookup: HIT from zeus.crc.id.au:8080
Via: 1.0 zeus.crc.id.au:8080 (squid/2.6.STABLE2)
Proxy-Connection: close

Trying other mirror.
Error: Cannot open/read repomd.xml file for repository: fedora-netdev
Comment 7 John W. Linville 2006-08-11 15:03:35 UTC 
fedora-netdev does not have any FC6 kernels at the moment, fwiw...
Comment 8 Steven Haigh 2006-08-20 21:29:37 UTC 
This can probably be closed now... The bcm43xx module still doesn't work with
the specified card, however this may well be due to other issues.

The core problem of the kernel dying on boot has been resolved, which is what
this report was all about.

I'm preparing a BZ report on the bcm43xx module and that should replace this.