Bug 130525 - [ndis] [panic] 64 bit ar5008 ndisgen-erated driver causes kernel panic on kldload
Summary: [ndis] [panic] 64 bit ar5008 ndisgen-erated driver causes kernel panic on kld...
Status: Open
Alias: None
Product: Base System
Classification: Unclassified
Component: kern (show other bugs)
Version: Unspecified
Hardware: Any Any
: Normal Affects Only Me
Assignee: freebsd-bugs (Nobody)
URL:
Keywords: crash
Depends on:
Blocks:
 
Reported: 2009-01-14 00:40 UTC by John Henderson
Modified: 2022-10-17 12:19 UTC (History)
0 users

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description John Henderson 2009-01-14 00:40:01 UTC
I have a MacBook 2,1 with an Atheros AR5418 wireless NIC (AR5008 chipset).
I found a windows driver for the NIC and am trying to use ndisgen to get
a kernel module that can drive the NIC. Currently, it is just recognized
as (pciconf):

none3@pci0:2:0:0: class=0x028000 card=0x0087106b chip=0x0024168c rev=0x01
hdr=0x00
vendor='Atheros Communications Inc.'
device='AR5008 Atheros 802.11a/b/g/n (pre-N) radio
class=network

And seen on boot as (dmesg):
pci2:<network> at device 0.0 (no driver attached)

I tried this with amd64 once without success, then wondered if it was
due to running 64 bit, so I installed i386 with success. Since I have
core 2 duo processors, I want to try to do this with amd64 one more time
before I give up and commit to sticking with i386 and don't look back.
I used this process:

Downloaded drivers for ath 5xxx from:
http://www.station-drivers.com/page/atheros.htm. I used a Win machine to
open the .exe file and get the .inf and .sys files contained within.

The files I used can be found here:
- http://jw.hendy.googlepages.com/netathwx.inf
- http://jw.hendy.googlepages.com/athwx.sys

Next I did:
- ndisgen ./netathwx.inf ./athwx.sys #followed steps until module generated
- kldload ndis
- kldload if_ndis #always get 'cannot load; file already exists since it's
  loaded with ndis
- kldload ./athwx_sys.ko

When I do this I get a kernel panic due to a privileged instruction fault.
This was in the core dump vmcore.0 upon reboot:
---------------
no match for ZwCreateKey
no match for IoOpenDeviceRegistryKey
no match for ZwDeleteKey
no match for ZwOpenKey
no match for KeBugCheckEx
ndis0: <Atheros AR5008 Wireless Network Adapter> mem 0x90100000-0x9010ffff irq 17 at device 0.0 on pci2
ndis0: [ITHREAD]
ndis0: NDIS API version: 5.1
NDIS: open file /compat/ndis/AW1012d.ini failed: 2
NDIS: open file /compat/ndis/regAdd.txt failed: 2

Fatal trap 1: privileged instruction fault while in kernel mode
cpuid = 1; apic id = 01
instruction pointer = 0x8:0xffffffff813ed006
stack pointer = 0x10:0xffffffffaf7201e0
frame pointer = 0x10:0xffffffffaf720210
code segment = base rx0, limit 0xfffff, type 0x1b
= DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags = interrupt enabled, resume, IOPL = 0
current process = 1623 kldload
trap number = 1
panic: privileged instruction fault
cpuid = 1
----------------

What is hopeful to me is that when inspecting /var/log/messages, I see
this, which matches what I saw from dmesg when I was successful for the
32 bit version of this driver on i386:
-------------
ndis0: <Atheros AR5008 Wireless Network Adapter> mem 0x90100000-0x9010ffff irq 17 at device 0.0 on pci2
ndis0: [ITHREAD]
ndis0: NDIS API version: 5.1
-------------

It's finding the NIC and the driver is attaching...

So, from here I posted on FreeBSD forums in Hardware and was suggested
to upgrade to 7.1 (at the time I was running a fresh install of 7.0) and
to enable DDB and KDB in the kernel, recompile, reboot, and use
ddb/textdump to get the bt on the kernel panic. I'm very new to FreeBSD
so that doesn't mean a lot to me, but I managed to figure it out. I
enabled textdump and tried to load the module. At the resulting db> prompt
I did 'db>bt' and this is what it responded with:
------------------------
Tracing pid 1077 tid 100097 td 0xffffff0003f76000
_end() at 0xffffffff813f7000
NdisMSynchronizeWithInterrupt() at NdisMSynchronizeWithInterrupt+0xc
dmapbase() at 0xffffff0003cff1ce
athwx_sys_drv_data_start() at 0xffffffffaf7259d3
---------------

Then it was suggested to disable smp by
'echo "kern.smp.disabled=1">>/boot/loader.conf'. I did that, rebooted,
and tried to load the module again. Here's the bt from the panic (very
similar to above):
--------------------------
Tracing pid 923 tid 100070 td 0xffffff0003ad06e0
_end() at 0xffffffff813f7000
NDISMSynchronizeWithInterrupt() at NdisMSynchronizeWithInterrupt+0xc
dmapbase() at 0xffffff0003ae1c4e
athwx_sys_drv_data_start() at 0xffffffffaf6e09d3
--------------------

That's where things are left. I'm just looking to find out if it's even
possible for me to generate a module that will work with amd64 FreeBSD.
I can successfully load the 32bit modules that work in i386, but they
don't pick up the driver (nothing from dmesg, and no ndis0 from ifconfig).
So...

- 32bit driver works with i386 (ndis0 is created on kldload, dmesg reports
  the NIC found, and I can setup the interface and ping successfully)
- 32bit driver loads without complaints and is there with kldstat, but
  nothing from dmesg or ifconfig
- 64bit driver crashes both systems

Not sure where to go from here. It was recommended I post here since
developers will read this. Please request any other files that would help
(vmcore, /var/log/messages, dmesg, etc.) If anyone has insight into what's
going on and how I might fix it, that would be great!


Thanks,
John

How-To-Repeat: ndisgen ./file.inf ./file.sys
kldload ndis
kldload if_ndis
kldload ./generatedModule_sys.ko
Comment 1 Mark Linimon freebsd_committer freebsd_triage 2009-01-18 02:33:26 UTC
Responsible Changed
From-To: freebsd-bugs->freebsd-net

Over to maintainer(s).
Comment 2 Eitan Adler freebsd_committer freebsd_triage 2017-12-31 08:00:48 UTC
For bugs matching the following criteria:

Status: In Progress Changed: (is less than) 2014-06-01

Reset to default assignee and clear in-progress tags.

Mail being skipped
Comment 3 Graham Perrin freebsd_committer freebsd_triage 2022-10-17 12:19:27 UTC
Keyword: 

    crash

– in lieu of summary line prefix: 

    [panic]

* bulk change for the keyword
* summary lines may be edited manually (not in bulk). 

Keyword descriptions and search interface: 

    <https://bugs.freebsd.org/bugzilla/describekeywords.cgi>