Bug 434932 - rt61pci wireless driver crashes in 2.6.24.2-10.fc8
rt61pci wireless driver crashes in 2.6.24.2-10.fc8
Status: CLOSED CURRENTRELEASE
Product: Fedora
Classification: Fedora
Component: kernel (Show other bugs)
8
i686 Linux
low Severity medium
: ---
: ---
Assigned To: John W. Linville
Fedora Extras Quality Assurance
: Reopened
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2008-02-26 07:47 EST by Clive Malcolm
Modified: 2008-04-05 12:50 EDT (History)
6 users (show)

See Also:
Fixed In Version: 2.6.24.4-64.fc8
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2008-04-04 15:07:07 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
logs for problems with rt61pci driver and kernel 2.6.24.2-10.fc8 (15.40 KB, text/plain)
2008-02-26 10:08 EST, Clive Malcolm
no flags Details

  None (edit)
Description Clive Malcolm 2008-02-26 07:47:12 EST
From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1.12) Gecko/20080208 Fedora/2.0.0.12-1.fc8 Firefox/2.0.0.12

Description of problem:
the last kernel to work on my notebook with the rt61pci driver is 2.6.23.9-85.fc8.  I installed 2.6.24.2-10.fc8 as I read about improvements and hoped my wireless connection would just work. Sadly the link light was out after booting up.  Checking dmesg it was full of errors, tried to ping www.bbc.co.uk, machine locked up :(

Version-Release number of selected component (if applicable):
kernel 2.6.24.2-10.fc8 - rt61pci driver 2.1.0

How reproducible:
Always


Steps to Reproduce:
1. boot with kernel 2.6.24.2-10.fc8
2. check dmesg for errors
3. ping www.bbc.co.uk

Actual Results:
machine locked up.

Expected Results:
wireless card should have been working using rt61pci driver.

Additional info:
from dmesg

udevd[2189]: segfault at 002e74e4 eip 002e74e4 esp bf8e24dc error 7
swap_free: Bad swap offset entry 00decf96
swap_free: Bad swap offset entry 001ecf96
BUG: unable to handle kernel paging request at virtual address 1ecf3c80
printing eip: c047830f *pde = 00000000 
Oops: 0000 [#1] SMP 
Modules linked in: rfcomm l2cap bluetooth autofs4 sunrpc 8139too mii xircom_cb nf_conntrack_ipv4 ipt_REJECT iptable_filter ip_tables nf_conntrack_ipv6 xt_state nf_conntrack xt_tcpudp ip6t_ipv6header ip6t_REJECT ip6table_filter ip6_tables x_tables loop dm_multipath ipv6 snd_maestro3 snd_ac97_codec ac97_bus snd_seq_dummy parport_pc parport dcdbas arc4 snd_seq_oss ecb snd_seq_midi_event snd_seq blkcipher snd_seq_device pcspkr floppy video output snd_pcm_oss snd_mixer_oss snd_pcm rt61pci rt2x00pci rt2x00lib snd_timer snd crc_itu_t soundcore rfkill button battery crc_ccitt ac i2c_piix4 snd_page_alloc i2c_core input_polldev mac80211 cfg80211 eeprom_93cx6 sr_mod sg cdrom usb_storage dm_snapshot dm_zero dm_mirror dm_mod ata_piix pata_acpi ata_generic libata sd_mod scsi_mod ext3 jbd mbcache uhci_hcd ohci_hcd ehci_hcd

Pid: 2189, comm: udevd Not tainted (2.6.24.2-10.fc8 #1)
EIP: 0060:[<c047830f>] EFLAGS: 00210206 CPU: 0
EIP is at unlink_file_vma+0xc/0x2e
EAX: dfbf3f20 EBX: dfbf3cb8 ECX: c1407690 EDX: c13da5e0
ESI: 1ecf3c00 EDI: dfbf3f20 EBP: 00110000 ESP: dfbcee18
 DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068
Process udevd (pid: 2189, ti=dfbce000 task=decce690 task.ti=dfbce000)
Stack: dfbf3cb8 dfbf3f20 dfbf3cb8 c0476f60 1e2e3045 0021ce78 00000000 dfbcee5c 
       dfbcee5c dfbca700 dfbf2738 dfbcefb8 c0478056 00000000 dfbcee58 00000000 
       00000185 c14062a0 dfbca700 dfbca74c 0000000b c042cfde 00000001 decce690 
Call Trace:
 [<c0476f60>] free_pgtables+0x5c/0xa0
 [<c0478056>] exit_mmap+0x92/0xf0
 [<c042cfde>] mmput+0x34/0x78
 [<c0431a81>] do_exit+0x213/0x695
 [<c0431f79>] sys_exit_group+0x0/0xd
 [<c062d8db>] do_page_fault+0x0/0x614
 [<c0438a2b>] get_signal_to_deliver+0x39b/0x3c8
 [<c062d8db>] do_page_fault+0x0/0x614
 [<c040474a>] do_notify_resume+0x8c/0x6c8
 [<c0404256>] __switch_to+0x111/0x147
 [<c062af4f>] schedule+0x624/0x663
 [<c062dee7>] do_page_fault+0x60c/0x614
 [<c0408050>] do_syscall_trace+0x4b/0xde
 [<c062d8db>] do_page_fault+0x0/0x614
 [<c04052ae>] work_notifysig+0x13/0x19
 [<c0620000>] xfrm_add_pol_expire+0xa9/0x1da
 =======================
Code: 24 8b 4b 24 8b 50 04 89 51 04 89 0a 89 40 04 89 43 24 5b c3 89 d8 5b 8d 51 18 e9 52 a0 ff ff 57 89 c7 56 53 8b 70 48 85 f6 74 1e <8b> 9e 80 00 00 00 8d 43 28 e8 01 3f 1b 00 89 f8 89 d9 89 f2 e8 
EIP: [<c047830f>] unlink_file_vma+0xc/0x2e SS:ESP 0068:dfbcee18
---[ end trace b27f0f5562d38a81 ]---
Fixing recursive fault but reboot is needed!
ADDRCONF(NETDEV_UP): wlan0: link is not ready
------------[ cut here ]------------
kernel BUG at mm/mmap.c:2146!
invalid opcode: 0000 [#2] SMP 
Modules linked in: rfcomm l2cap bluetooth autofs4 sunrpc 8139too mii xircom_cb nf_conntrack_ipv4 ipt_REJECT iptable_filter ip_tables nf_conntrack_ipv6 xt_state nf_conntrack xt_tcpudp ip6t_ipv6header ip6t_REJECT ip6table_filter ip6_tables x_tables loop dm_multipath ipv6 snd_maestro3 snd_ac97_codec ac97_bus snd_seq_dummy parport_pc parport dcdbas arc4 snd_seq_oss ecb snd_seq_midi_event snd_seq blkcipher snd_seq_device pcspkr floppy video output snd_pcm_oss snd_mixer_oss snd_pcm rt61pci rt2x00pci rt2x00lib snd_timer snd crc_itu_t soundcore rfkill button battery crc_ccitt ac i2c_piix4 snd_page_alloc i2c_core input_polldev mac80211 cfg80211 eeprom_93cx6 sr_mod sg cdrom usb_storage dm_snapshot dm_zero dm_mirror dm_mod ata_piix pata_acpi ata_generic libata sd_mod scsi_mod ext3 jbd mbcache uhci_hcd ohci_hcd ehci_hcd

Pid: 2195, comm: NetworkManager Tainted: G      D (2.6.24.2-10.fc8 #1)
EIP: 0060:[<c04780a9>] EFLAGS: 00210202 CPU: 0
EIP is at exit_mmap+0xe5/0xf0
EAX: 00000000 EBX: c14062a0 ECX: c14076f4 EDX: c13da0c0
ESI: dfbca540 EDI: 00000000 EBP: dfbd2fb8 ESP: dfbd2e4c
 DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068
Process NetworkManager (pid: 2195, ti=dfbd2000 task=dfb9ad20 task.ti=dfbd2000)
Stack: 00000000 dfbd2e58 00000000 00000064 c14062a0 dfbca540 dfbca58c 0000000b 
       c042cfde 00000001 dfb9ad20 c0431a81 00000000 0000000a 00000000 dfb9b284 
       00000000 00000001 0000000b ded3d02c dfbc51e0 0000000b dfbd2fb8 c0431f79 
Call Trace:
 [<c042cfde>] mmput+0x34/0x78
 [<c0431a81>] do_exit+0x213/0x695
 [<c0431f79>] sys_exit_group+0x0/0xd
 [<c062d8db>] do_page_fault+0x0/0x614
 [<c0438a2b>] get_signal_to_deliver+0x39b/0x3c8
 [<c062d8db>] do_page_fault+0x0/0x614
 [<c040474a>] do_notify_resume+0x8c/0x6c8
 [<c062dee7>] do_page_fault+0x60c/0x614
 [<c045df7a>] audit_syscall_exit+0x2c7/0x2e3
 [<c05be6db>] sys_socketcall+0x14a/0x261
 [<c0408050>] do_syscall_trace+0x4b/0xde
 [<c062d8db>] do_page_fault+0x0/0x614
 [<c04052ae>] work_notifysig+0x13/0x19
 [<c0620000>] xfrm_add_pol_expire+0xa9/0x1da
 =======================
Code: c7 43 04 00 00 00 00 e8 ce a9 fa ff 89 f0 e8 96 b0 f8 ff eb 09 89 f8 e8 e0 fe ff ff 89 c7 85 ff 75 f3 83 be 80 00 00 00 00 74 04 <0f> 0b eb fe 83 c4 14 5b 5e 5f c3 55 89 d5 57 89 c7 56 89 ca 53 
EIP: [<c04780a9>] exit_mmap+0xe5/0xf0 SS:ESP 0068:dfbd2e4c
---[ end trace b27f0f5562d38a81 ]---
Fixing recursive fault but reboot is needed!
phy0 -> rt2x00pci_write_tx_data: Error - Arrived at non-free entry in the non-full queue 0.
Please file bug report to http://rt2x00.serialmonkey.com.


$ modinfo rt61pci
filename:       /lib/modules/2.6.24.2-10.fc8/kernel/drivers/net/wireless/rt2x00/rt61pci.ko
license:        GPL
firmware:       rt2661.bin
firmware:       rt2561s.bin
firmware:       rt2561.bin
description:    Ralink RT61 PCI & PCMCIA Wireless LAN driver.
version:        2.1.0
author:         http://rt2x00.serialmonkey.com
srcversion:     F0D9EA0960DEE79B1B719C4
alias:          pci:v00001814d00000401sv*sd*bc*sc*i*
alias:          pci:v00001814d00000302sv*sd*bc*sc*i*
alias:          pci:v00001814d00000301sv*sd*bc*sc*i*
depends:        rt2x00lib,rt2x00pci,eeprom_93cx6
vermagic:       2.6.24.2-10.fc8 SMP mod_unload 686 4KSTACKS
Comment 1 John W. Linville 2008-02-26 08:42:15 EST
Other than the fact that the immediately subsequent messages relate to the 
wireless driver, I don't see anything to clearly indicate that these messages 
are related to it.  What other things might be happening on your computer when 
these messages pop-up?
Comment 2 John W. Linville 2008-02-26 08:44:51 EST
Herbert, can you suggest a plausible link between xfrm and the wireless 
driver?
Comment 3 Clive Malcolm 2008-02-26 10:08:41 EST
Created attachment 295928 [details]
logs for problems with rt61pci driver and kernel 2.6.24.2-10.fc8
Comment 4 John W. Linville 2008-02-26 10:48:38 EST
OK, those logs show a more direct link to rt61pci...will investigate...
Comment 5 Ivo van Doorn 2008-02-26 10:54:05 EST
No need to investigate much further, since it is a duplicate of #432267, that
report was for rt2500pci, but I can safely say that this is caused by exactly
the same issue.

That bug was fixed with 2.6.25-0.64.rc2.git5.fc9, so the same would go for this
bug. Additionally I would like to say that this kernel will not have a
functioning TX/RX, but that should be fixed with th rt2x00 2.1.3 release of
yesterday.
Comment 6 John W. Linville 2008-02-26 11:10:36 EST
Ah, thanks Ivo...perhaps my time is better spent merging patches today... :-)
Comment 7 Clive Malcolm 2008-02-26 11:16:10 EST
hmm, just had a midair collision.

Anyway, just saying I would be happy to test a kernel with rt2x00 2.1.3 when one
comes along.
Comment 8 Chuck Ebbert 2008-03-05 23:17:44 EST
Please test 2.6.24.3-18:

http://koji.fedoraproject.org/koji/buildinfo?buildID=41351
Comment 9 Clive Malcolm 2008-03-06 12:16:00 EST
Hi

I have a pcmcia card and am using the 2.6.24.3-18 kernel to write this :)

I can ping fine, Check Evolution fine, browse web sites fine.

The problem occurs when I try and download a file e.g. 

ftp://ftp.virginmedia.com/mirrors/fedoraproject.org/8/Live/i686/Fedora-8-Live-i686.iso

or ftp file up to my homepage.

The network connection dies, cannot ping etc.

Now for the good news, previously my machine would lock up and have flash codes.

I can eject the card and push it back in, after a period of time network manager
dectects the access point and I can connect again.  So it's more stable, but
still unable to ftp large files. e.g. tried to download a previous kernel and
the network connection dies again.

hope that helps, please let me know if you would like me to do any specific tests.
Comment 10 John W. Linville 2008-03-06 12:32:14 EST
Clive,

That sounds like a new problem -- I'll probably need you to open a bug 
specific to that issue.

In the meantime, could you add a line like this to /etc/modprobe.conf?

   options mac80211 ieee80211_default_rc_algo="simple"

After that, please reboot.  Does that improve (or change) your network 
performance?
Comment 11 Clive Malcolm 2008-03-06 13:10:56 EST
Hi

Added 

options mac80211 ieee80211_default_rc_algo="simple"

to /etc/modprobe.conf 

Rebooted and shortly after trying to ftp a file, the machine locked up with the
flash codes again and I had to power off to bring it back to life.
Comment 12 Clive Malcolm 2008-03-07 11:17:49 EST
Hi

I am happy for this bug to be closed, since the driver no longer crashes.

I have logged a new bug for the network connectivity being lost after trying to
download a large file. 

Bugzilla Bug 436496: rt61pci wireless driver loses network connectivity in
2.6.24.3-18.fc8
Comment 13 Milan Kerslager 2008-03-07 11:59:39 EST
I'm confirming that 2.6.24.3-18.fc8 kernel does not oops on boot.
I was not able to boot 2.6.24.3-12.fc8 sice it oopses when loading rt61pci.
Comment 14 Milan Kerslager 2008-03-07 13:06:19 EST
Sorry for reopening, but 2.6.24.3-18.fc8 dies completly after a while with no
trace in the logs. This is headless router so I don't know what is going on yet. 

This may be unrelated to this issue but 2.6.23.15-137.fc8 is last stable kernel
here.
Comment 15 John W. Linville 2008-03-07 13:22:18 EST
Hmmm...well, I suppose we can leave this open a little longer if you can 
provide documentation that the bug you have is the same as the one here.  You 
may want to try netconsole to capture that information, although it will need 
to be done on a wired interface.  Using a serial console would be a more 
reliable alternative.

So I'll leave this open for a little while, and close it if no logs show-up.
Comment 16 Milan Kerslager 2008-03-07 13:30:54 EST
I tryed kexec and Grub set on older kernel. So I'm able to do some tests now.

The wlan connection died first (I tryed to download a bunch of data) with few
"wlan0: RX too short data frame payload".
Then I did: rmmod rt61pci rt2x00pci rt2x00lib mac80211 eeprom_93cx6
phy0 -> rt61pci_mcu_request: Error - mcu request error. Request 0x50 failed for
token 0xff.
modprobe rt61pci -> hang

I have wired line on my side so I may be able to try netconsole.
Comment 17 John W. Linville 2008-03-13 11:13:26 EDT
The kernels here contain an update to rt2x00 version 2.1.4:

   http://koji.fedoraproject.org/koji/buildinfo?buildID=42735

Could you give those kernels a try to see if they resolve this issue for you?
Comment 18 Milan Kerslager 2008-04-04 10:06:33 EDT
Latest offical kernels works Ok. No problem so far. Please close this as resolved.
Comment 19 John W. Linville 2008-04-04 15:07:07 EDT
Thanks for the report!
Comment 20 michael cluck 2008-04-05 12:50:05 EDT
Latest official kernel ( 2.6.24.4-64.fc8 ) still hangs when I try to issue:

ifconfig wlan0 up

Nothing at all is left in syslog to explain why.

Wired networking works fine though.

modinfo says rt61pci is version 2.1.4

Cheers,
Michael

Note You need to log in before you can comment on or make changes to this bug.