Boot hangs on rocket during broadcom43xx "media change"

[umccullough]

On my Dell Inspiron B130, the boot started hanging on the rocket icon starting with hrev46236. When I enable debug output, I see that it's during a broadcom43xx "media change" event.

I have tested on the latest rev and it's still broken.

I can get a syslog and listdev output from hrev46235 if desired. Laptop has no serial port.

[umccullough]

Oops, I guess i wasn't paying attention, it was actually broadcom43xx.

Which means this is actually a wifi chip.

Disabling it with the bootloader blacklist feature allows the boot to proceed.

[pulkomandy]

Hardware-specific issue with known and documented workaround, moving out of alpha5 milestone.

[mmu_man]

I also have this issue on my old ASUS laptop. It currently has hrev44295 which boots without any problem. We tried to upgrade it at RMLL last week and it hanged as documented here.

[mmu_man]

You said your laptop doesn't have a serial port. Does it have a parallel port? If so it should be possible to use a laplink cable to debug it. I'm not sure if it's still available by default though.

[mmu_man]

Ok, I've been checking some revisions according to the git log of both broadcom43xx and the freebsd_wlan stuff...

hrev45433 boots hrev45453 boots as well hrev46104 boots also hrev46271 doesn't boot

The only broadcom43xx-related change in this interval is a trivial looking renaming of allocation flags... so I suppose it's probably in the freebsd_wlan or freebsd_network stuff.

[korli]

Reading again the summary I suppose the problem appeared in hrev46236, or I misunderstood?

Please try with TRACE_DRIVER enabled at ​http://cgit.haiku-os.org/haiku/tree/src/libs/compat/freebsd_network/driver.c?id=fc3b9496eb2a64bf81d3abfbd551caa2e6866a2f#n31

[jstressman]

I've enabled trace in driver.c as directed, recompiled the broadcom43xx driver, placed it in system/non-packaged/add-ons/... bin/ and the link to it in ...dev/net/

Blacklisted the system copy... and the syslog shows that it's booting from the non-packaged copy. So I would think I should be seeing the trace enabled driver output?

This is the debug log output I see when booting from that copy of the driver and seeing the lock-up.

(See attached image)

[jstressman]

trace enabled broadcom43xx driver system lock up during boot

[korli]

Please try a current nightly.

[mmu_man]

I just updated my old asus to the nightly and unblacklisted the driver, but it seems it doesn't find its firmware so it doesn't go as far as checking for media change:

KERN: [broadcom43xx] (bwi) bus_alloc_resource(3, [16], 0x0, 0xffffffff, 0x1,0x2)
KERN: [broadcom43xx] (bwi) bus_alloc_resource(1, [0], 0x0, 0xffffffff, 0x1,0x6)
KERN: [broadcom43xx] (bwi) BBP: id 0x4301, rev 0x2, pkg 0
KERN: [broadcom43xx] (bwi) MAC: rev 2
KERN: [broadcom43xx] (bwi) PHY: type 1, rev 4, ver 0
KERN: [broadcom43xx] (bwi) RF: manu 0x17f, type 0x2053, rev 2
KERN: [broadcom43xx] (bwi) invalid antenna gain in sprom
KERN: [broadcom43xx] (bwi) request firmware bwi_v3_ucode failed

[mmu_man]

Ok, after running install-wifi-firmwares.sh and rebooting…

pagefault in bwi_getradiocaps(). :-(

[mmu_man]

Ok, it seems that bwi_attach calls bwi_getradiocaps before the ic_softc field is set (it's reset just after in the code, but I suppose the BSD kernel does it beforehand at some point), causing a NULL dereference.

[mmu_man]

Fixing it seems to get us back to the original behaviour: hanging at loading the driver. I'll have a look.

[mmu_man]

So, after managing to use my antique laplink cable to get seri… hmmm… parallel debug output, I get this from the driver:

driver "broadcom43xx" added
[broadcom43xx] (bwi) bus_alloc_resource(3, [16], 0x0, 0xffffffff, 0x1,0x2)
add_memory_type_range(7496, 0xfde00000, 0x20000, 0)
set MTRRs to:
  mtrr:  0: base: 0x27f40000, size:    0x40000, type: 0
  mtrr:  1: base: 0x27f80000, size:    0x80000, type: 0
  mtrr:  2: base: 0xe0000000, size: 0x20000000, type: 0
  mtrr:  3: base: 0x80000000, size: 0x80000000, type: 1
[broadcom43xx] (bwi) bus_alloc_resource(1, [0], 0x0, 0xffffffff, 0x1,0x6)
[broadcom43xx] (bwi) regwin: type 0x812, rev 2, vendor 0x4243
[broadcom43xx] (bwi) BBP: id 0x4301, rev 0x2, pkg 0
[broadcom43xx] (bwi) nregwin 5, cap 0x00000000
[broadcom43xx] (bwi) regwin: type 0x812, rev 2, vendor 0x4243
[broadcom43xx] (bwi) has TX stats
[broadcom43xx] (bwi) MAC: rev 2
[broadcom43xx] (bwi) regwin: type 0x80d, rev 0, vendor 0x4243
[broadcom43xx] (bwi) regwin: type 0x806, rev 2, vendor 0x4243
[broadcom43xx] (bwi) regwin: type 0x807, rev 1, vendor 0x4243
[broadcom43xx] (bwi) regwin: type 0x804, rev 3, vendor 0x4243
[broadcom43xx] (bwi) bus rev 0
[broadcom43xx] (bwi) PCI is enabled
[broadcom43xx] (bwi) card flags 0x0000
[broadcom43xx] (bwi) 0th led, act 0, lowact 0
[broadcom43xx] (bwi) 1th led, act 0, lowact 0
[broadcom43xx] (bwi) 2th led, act 0, lowact 0
[broadcom43xx] (bwi) 3th led, act 0, lowact 0
[broadcom43xx] (bwi) MAC was already disabled
[broadcom43xx] (bwi) PHY is linked
[broadcom43xx] (bwi) PHY: type 1, rev 4, ver 0
[broadcom43xx] (bwi) RF: manu 0x17f, type 0x2053, rev 2
[broadcom43xx] (bwi) bus rev 0
[broadcom43xx] (bwi) PHY is linked
[broadcom43xx] (bwi) 30bit bus space
[broadcom43xx] (bwi) max txpower from sprom: 66 dBm
[broadcom43xx] (bwi) invalid antenna gain in sprom
[broadcom43xx] (bwi) ant gain 8 dBm
[broadcom43xx] (bwi) region/domain max txpower 76 dBm
[broadcom43xx] (bwi) max txpower 66 dBm
[broadcom43xx] (bwi) idle tssi0: 52
[broadcom43xx] (bwi) bus rev 0
[broadcom43xx] (bwi) locale: 0
ieee80211_sysctl_attach not implemented, yet.
: [broadcom43xx] 11b rates: 1Mbps 2Mbps 5.5Mbps 11Mbps
if_initname(0x828b1000, wlan, 30)
[broadcom43xx] broadcom43xx: /dev/net/broadcom43xx/0
[net/broadcom43xx/0] ieee80211_node_vattach: init 2 auth 12 run 20 probe 2
[net/broadcom43xx/0] ieee80211_vap_attach: STA parent  flags 0x40044000 flags_ext 0x402
[net/broadcom43xx/0] ieee80211_alloc_node 0xcf70c000<00:0e:a6:a8:be:86> in station table
[net/broadcom43xx/0] [00:0e:a6:a8:be:86] ieee80211_alloc_node: inact_reload 2
[net/broadcom43xx/0] [00:0e:a6:a8:be:86] amrr_node_init: non-11n node
[net/broadcom43xx/0] [00:0e:a6:a8:be:86] AMRR: nrates=0, initial rate 0
ifmedia_add: Adding Entry...
  Type: IEEE 802.11 Wireless Ethernet
  Mode: autoselect
  SubType: autoselect
ifmedia_add: Adding Entry...
  Type: IEEE 802.11 Wireless Ethernet
  Mode: 11b
  SubType: autoselect
ifmedia_add: Adding Entry...
  Type: IEEE 802.11 Wireless Ethernet
  Mode: 11b
  SubType: DS/1Mbps
ifmedia_add: Adding Entry...
  Type: IEEE 802.11 Wireless Ethernet
  Mode: 11b
  SubType: DS/2Mbps
ifmedia_add: Adding Entry...
  Type: IEEE 802.11 Wireless Ethernet
  Mode: 11b
  SubType: DS/5.5Mbps
ifmedia_add: Adding Entry...
  Type: IEEE 802.11 Wireless Ethernet
  Mode: 11b
  SubType: DS/11Mbps
ifmedia_add: Adding Entry...
  Type: IEEE 802.11 Wireless Ethernet
  Mode: autoselect
  SubType: DS/1Mbps
ifmedia_add: Adding Entry...
  Type: IEEE 802.11 Wireless Ethernet
  Mode: autoselect
  SubType: DS/2Mbps
ifmedia_add: Adding Entry...
  Type: IEEE 802.11 Wireless Ethernet
  Mode: autoselect
  SubType: DS/5.5Mbps
ifmedia_add: Adding Entry...
  Type: IEEE 802.11 Wireless Ethernet
  Mode: autoselect
  SubType: DS/11Mbps
ifmedia_set: target   Type: IEEE 802.11 Wireless Ethernet
  Mode: autoselect
  SubType: autoselect
ifmedia_set: setting to   Type: IEEE 802.11 Wireless Ethernet
  Mode: autoselect
  SubType: autoselect
if_attach 0x8281dad4
start_wlan: wlan started.
broadcom43xx: init_driver(0xcde19794) at 13
[net/broadcom43xx/0] compat_open(0x2)
[net/broadcom43xx/0] ieee80211_init
[net/broadcom43xx/0] start running, 0 vaps running
[net/broadcom43xx/0] ieee80211_start_locked: up parent
[net/broadcom43xx/0] start running, 1 vaps running
[net/broadcom43xx/0] ieee80211_new_state_locked: INIT -> SCAN (nrunning 0 nscanning 0)
[broadcom43xx] (bwi) bbp atten: 2, rf atten: 5, ctrl1: 0, ctrl2: 65535

Before it hangs.

[mmu_man]

Ok, found a nasty bug in our compat layer… >:-) Fixed in hrev52204. Now it panics but much later, after I open the network prefs.

[waddlesplash]

Well, that's a separate issue; please open another ticket and I can take a look at that. :)

[nielx]

Assign tickets with status=closed and resolution=fixed within the R1/beta2 development window to the R1/beta2 Milestone