# Kernel crash on interface: run0



## joseche (May 14, 2012)

It is a fresh install of F*ree*BSD 9.0-RELEASE.

It happens every time I try to run airodump-ng, the NIC is:

```
ugen4.2: <Ralink> at usbus4
run0: <1.0> on usbus4
run0: MAC/BBP RT3070 (rev 0x0201), RF RT2020 (MIMO 1T1R), address 68:7f:74:63:c8:fc
run0: firmware RT2870 loaded
```


```
FreeBSD fbsd 9.0-RELEASE FreeBSD 9.0-RELEASE #0: Tue Jan  3 07:15:25 UTC 2012     
[email]root@obrian.cse.buffalo.edu[/email]:/usr/obj/usr/src/sys/GENERIC  i386
```


```
panic: page fault

GNU gdb 6.1.1 [FreeBSD]
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i386-marcel-freebsd"...

Unread portion of the kernel message buffer:


Fatal trap 12: page fault while in kernel mode
cpuid = 1; apic id = 01
fault virtual address   = 0x10003
fault code              = supervisor read, page not present
instruction pointer     = 0x20:0xc08d3c22
stack pointer           = 0x28:0xc52d6bf8
frame pointer           = 0x28:0xc52d6c38
code segment            = base 0x0, limit 0xfffff, type 0x1b
                        = DPL 0, pres 1, def32 1, gran 1
processor eflags        = interrupt enabled, resume, IOPL = 0
current process         = 15 (usbus4)
trap number             = 12
panic: page fault
cpuid = 1
KDB: stack backtrace:
#0 0xc0a4b157 at kdb_backtrace+0x47
#1 0xc0a186b7 at panic+0x117
#2 0xc0d48cf3 at trap_fatal+0x323
#3 0xc0d48dad at trap_pfault+0xad
#4 0xc0d49b35 at trap+0x465
#5 0xc0d32a8c at calltrap+0x6
#6 0xc08d3f63 at run_bulk_tx_callback0+0x13
#7 0xc08c14b2 at usbd_callback_wrapper+0x722
#8 0xc08bd7ec at usb_command_wrapper+0xdc
#9 0xc08c0374 at usb_callback_proc+0x104
#10 0xc08ba399 at usb_process+0xf9
#11 0xc09ea997 at fork_exit+0x97
#12 0xc0d32b04 at fork_trampoline+0x8
Uptime: 3m8s
Physical memory: 2029 MB
Dumping 211 MB: 196panic: bufwrite: buffer is not busy???
cpuid = 1
 180 164 148 132 116 100 84 68 52 36 20 4
```

Since I don't have the obj files I don't know what else to provide.

Thanks.


----------



## PseudoCylon (May 15, 2012)

Try this patch.

```
diff --git a/dev/usb/wlan/if_run.c b/dev/usb/wlan/if_run.c
index 4def4bd..e52e1fd 100644
--- a/dev/usb/wlan/if_run.c
+++ b/dev/usb/wlan/if_run.c
[color="Blue"]@@ -2526,8 +2526,8 @@[/color] run_rx_frame(struct run_softc *sc, struct mbuf *m, uint32_t dmalen)
                struct run_rx_radiotap_header *tap = &sc->sc_rxtap;
 
                tap->wr_flags = 0;
[color="Red"]-               tap->wr_chan_freq = htole16(ic->ic_bsschan->ic_freq);
-               tap->wr_chan_flags = htole16(ic->ic_bsschan->ic_flags);[/color]
[color="Green"]+               tap->wr_chan_freq = htole16(ic->ic_curchan->ic_freq);
+               tap->wr_chan_flags = htole16(ic->ic_curchan->ic_flags);[/color]
                tap->wr_antsignal = rssi;
                tap->wr_antenna = ant;
                tap->wr_dbm_antsignal = run_rssi2dbm(sc, rssi, ant);
[color="Blue"]@@ -2772,8 +2772,8 @@[/color] tr_setup:
 
                        tap->wt_flags = 0;
                        tap->wt_rate = rt2860_rates[data->ridx].rate;
[color="Red"]-                       tap->wt_chan_freq = htole16(vap->iv_bss->ni_chan->ic_freq);
-                       tap->wt_chan_flags = htole16(vap->iv_bss->ni_chan->ic_flags);[/color]
[color="Green"]+                       tap->wt_chan_freq = htole16(ic->ic_curchan->ic_freq);
+                       tap->wt_chan_flags = htole16(ic->ic_curchan->ic_flags);[/color]
                        tap->wt_hwqueue = index;
                        if (le16toh(txwi->phy) & RT2860_PHY_SHPRE)
                                tap->wt_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
```
--update June 2, 2012--
committed to the HEAD
http://svn.freebsd.org/changeset/base/236439


----------



## joseche (May 16, 2012)

It completely works, please submit it! I built it and now airodump-ng works like a charm.

Now, I have something else to add to this driver, the device is not registered if it is plugged when the machine boots. I have to wait until the boot process completes and _then_ plug the card. Also Kismet doesn't work having ncsource=wlan0, it says the NIC is in error state.

Both problems existed before your patch, but the patch itself fixes the panic problem.

Thanks


----------



## joseche (May 16, 2012)

The problem at boot time is that the driver can't load the firmware. Is there any way to fix this?


----------



## PseudoCylon (May 16, 2012)

joseche said:
			
		

> The problem at boot time is that the driver can't load the firmware. Is there any way to fix this?



All you need to do is to add a following line to /boot/loader.conf.
	
	



```
runfw_load="YES"
```
This patch is already in stable branch, and should be included in next release.


----------



## joseche (May 17, 2012)

Thanks, it works!


----------

