# Wireless Access Point Panics



## poobert (Jan 17, 2011)

I am trying to set up 

```
FreeBSD anzu.stoc 8.2-PRERELEASE FreeBSD 8.2-PRERELEASE #0: Tue Dec 21 21:35:25 PST 2010     emel@anzu.stoc:/usr/obj/usr/src/sys/ANZU  i386
```
as a wireless access point and gateway for the house.

It took some wrangling and trying to start back from basics to get the wireless card in AP mode, (which may seemed to have worked? rc.conf below)
I am also assuming i should be using ral in lieu of ath as the handbook uses for example.

```
$ ifconfig wlan0
wlan0: flags=8802<BROADCAST,SIMPLEX,MULTICAST> metric 0 mtu 1500
	ether 00:18:f8:2e:4c:e2
	media: IEEE 802.11 Wireless Ethernet autoselect <hostap> (autoselect <hostap>)
	status: no carrier
	ssid "" channel 1 (2412 MHz 11b)
	country US authmode OPEN privacy OFF txpower 0 scanvalid 60
	dtimperiod 1 -dfs bintval 0
```

If i then  

```
$ sudo ifconfig wlan0 inet 192.168.0.1 netmask 0xffffff00 ssid fbsd mode 11b channel 9
```
I can see the SSID being broadcast, but the machine seems to panic and not shut down, (on a sidenote, how should I get this panic info?)

I am using a Linksys WMP54g, with the ral driver, which apparently as far as I can tell should support host AP mode.
I have tried various permutations in loader.conf

My rc.conf and loader.conf are starting to get confusing here.
rc.conf:

```
sshd_enable="YES"

wlans_ral0="wlan0"
create_args_wlan0="wlanmode hostap"  #also tried wlanmode ap
gateway_enable="YES"
#ifirewall_enable="YES"
#firewall_type="OPEN"
#natd_enable="YES"
#natd_interface="xl1"
#natd_flags=""

# xl1 is the ethernet card
ifconfig_xl1="DHCP"

hostname="anzu.stoc"

#Try to get X working
hald_enable="YES"
dbus_enable="YES"
```

loader.conf:

```
linux_load="yes"
if_xl_load="yes"  # xl and ral are* NOT* compiled into kernel ANZU anymore
if_ral_load="yes"     

# Let's get some sound 
snd_ich_load="YES"

# here we go with gateway fw stuff:
#ipfw_load="YES"
#ipdivert_load="YES"
#net.inet.ip.fw.default_to_accept="1"

wlan_wep_load="YES"    
wlan_ccmp_load="YES"
wlan_tkip_load="YES"
```

Not sure if the last 3 wlan entries there are required anymore(actually i suppose they're not, wep module loaded, and wlan_ccmp and wlan_tkip are compiled in kernel.)
Am I missing other parts?


```
$ kldstat
Id Refs Address    Size     Name
 1   36 0xc0400000 6339e8   kernel
 2    3 0xc0a34000 2d998    linux.ko
 3    1 0xc0a62000 13adc    if_ral.ko
 4    1 0xc0a76000 b574     if_xl.ko
 5    1 0xc0a82000 7120     snd_ich.ko
 6    2 0xc0a8a000 566f4    sound.ko
 7    1 0xc0ae1000 3288     wlan_wep.ko
 8    1 0xc40b5000 8000     linprocfs.ko
 9    1 0xc40bd000 3000     linsysfs.ko
```


----------



## bschmidt (Jan 17, 2011)

Wanna try this patch?

```
Index: sys/net80211/ieee80211_node.c
===================================================================
--- sys/net80211/ieee80211_node.c	(revision 217018)
+++ sys/net80211/ieee80211_node.c	(working copy)
@@ -1137,6 +1137,8 @@ ieee80211_alloc_node(struct ieee80211_node_table *
 	IEEE80211_NOTE(vap, IEEE80211_MSG_INACT, ni,
 	    "%s: inact_reload %u", __func__, ni->ni_inact_reload);
 
+	ieee80211_ratectl_node_init(ni);
+
 	return ni;
 }
```


----------



## poobert (Jan 17, 2011)

bschmidt said:
			
		

> Wanna try this patch?
> 
> ```
> Index: sys/net80211/ieee80211_node.c
> ...



I tried it.  Seemingly the same problem. What is the best way to go about debugging this further?


----------



## bschmidt (Jan 17, 2011)

Hmm, I just saw my test box hanging also.. can you try instead of
`# ifconfig wlan0 ssid foo channel bla ip up`
splitting up the commands, like
`# ifconfig wlan0 ssid foo`
`# ifconfig wlan0 channel bla`
`# ifconfig wlan0 ip up`
?


----------



## poobert (Jan 17, 2011)

Entering the commands singly seems to set wlan0's ssid and channel properly.  ip up returns bad value.

I also cannot see the ssid being broadcast after this.

The status on ral0 and wlan0 is "no carrier".


----------



## bschmidt (Jan 18, 2011)

poobert said:
			
		

> Entering the commands singly seems to set wlan0's ssid and channel properly.  ip up returns bad value.
> 
> I also cannot see the ssid being broadcast after this.
> 
> The status on ral0 and wlan0 is "no carrier".



Uh, yeah, ip should be replaced with a real ip, something like 192.168.0.1
`# ifconfig wlan0 192.168.0.1 up`
for testing though, just up should also do
`# ifconfig wlan0 up`


----------



## poobert (Jan 18, 2011)

> Uh, yeah, ip should be replaced with a real ip, something like 192.168.0.1


I kinda figured that after typing it. 

Anyway, after `$ ifconfig wlan0 up` 
I at least see:

```
$ ifconfig wlan0
wlan0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
	ether 00:18:f8:2e:4c:e2
	media: IEEE 802.11 Wireless Ethernet autoselect mode 11g <hostap>
	status: running
	ssid fbsd channel 9 (2452 MHz 11g) bssid 00:18:f8:2e:4c:e2
	country US authmode OPEN privacy OFF txpower 0 scanvalid 60
	protmode CTS dtimperiod 1 -dfs
```

Attempting `$ ifconfig wlan0 ip up` or `$ ifconfig wlan0  inet ip netmask ip`hangs it up again though.

Where can I get this panic information?


----------



## bschmidt (Jan 18, 2011)

poobert said:
			
		

> Attempting `$ ifconfig wlan0 ip up` or `$ ifconfig wlan0  inet ip netmask ip`hangs it up again though.
> 
> Where can I get this panic information?



Hm.. so, setting the IP seems to be the culprit. Are you doing this on X or console? If you switch to console you should see what's going on.


----------



## poobert (Jan 18, 2011)

I am doing this on the console but it hangs and won't reboot.  It says something about not being able to write error info or dump or something.  I am at work right now and will crash it when I get home.

Just writing the error info down by hand seems unnecessary. 
Was looking through dumpon(8) and [url=http://www.freebsd.org/cgi/man.cgi?query=savecore&sektion=8&apropos=0&manpath=FreeBSD+8.1-RELEASE]savecore(8)[/URL] but from what I read it seems like something should go to /var/crash (which I created) by default but nothing does. Maybe that's what the error was referring to?

Well I guess that should be another topic though x(


----------



## bschmidt (Jan 19, 2011)

poobert said:
			
		

> I am doing this on the console but it hangs and won't reboot.  It says something about not being able to write error info or dump or something.  I am at work right now and will crash it when I get home.
> 
> Just writing the error info down by hand seems unnecessary.
> Was looking through dumpon(8) and [url=http://www.freebsd.org/cgi/man.cgi?query=savecore&sektion=8&apropos=0&manpath=FreeBSD+8.1-RELEASE]savecore(8)[/URL] but from what I read it seems like something should go to /var/crash (which I created) by default but nothing does. Maybe that's what the error was referring to?
> ...



Do you have swap space configured? dump* tries to use this to save the core to. You might also simply take a photo of screen or something..


----------



## poobert (Jan 21, 2011)

So here is a picture of what is going on when it crashes...


----------



## bschmidt (Jan 21, 2011)

poobert said:
			
		

> So here is a picture of what is going on when it crashes...



Thanks.

Please do

```
# kgdb /boot/kernel/if_ral.ko.symbols
[some output]
(kgdb) list *(rt2661_intr+0x334)
[interesting stuff]
```
and post the interesting stuff.


----------



## poobert (Jan 21, 2011)

bschmidt said:
			
		

> Please do
> 
> ```
> # kgdb /boot/kernel/if_ral.ko.symbols
> ...



Here's the interesting bits:

```
(kgdb) list *(rt2661_intr+0x334)
0xd7f4 is in rt2661_intr (/usr/src/sys/modules/ral/../../dev/ral/rt2661.c:920).
915				    "%d retries\n", retrycnt);
916				if (data->rix != IEEE80211_FIXED_RATE_NONE)
917					ieee80211_ratectl_tx_complete(vap, ni,
918					    IEEE80211_RATECTL_TX_SUCCESS,
919					    &retrycnt, NULL);
920				ifp->if_opackets++;
921				break;
922	
923			case RT2661_TX_RETRY_FAIL:
924	                        retrycnt = RT2661_TX_RETRYCNT(val);
```


----------



## bschmidt (Jan 22, 2011)

So.. looks like it is crashing while trying to do

```
920				ifp->if_opackets++;
```

I have not clue why that might happen, ifp should be allocated at that point and if_opackets is just an int. Hmm.. Wanna try this?


```
Index: sys/dev/ral/rt2661.c
===================================================================
--- sys/dev/ral/rt2661.c	(revision 217159)
+++ sys/dev/ral/rt2661.c	(working copy)
@@ -882,6 +882,9 @@ rt2661_tx_intr(struct rt2661_softc *sc)
 	int qid, retrycnt;
 	struct ieee80211vap *vap;
 
+	if (ifp == NULL)
+		return;
+
 	for (;;) {
 		struct ieee80211_node *ni;
 		struct mbuf *m;
@@ -917,7 +920,6 @@ rt2661_tx_intr(struct rt2661_softc *sc)
 				ieee80211_ratectl_tx_complete(vap, ni,
 				    IEEE80211_RATECTL_TX_SUCCESS,
 				    &retrycnt, NULL);
-			ifp->if_opackets++;
 			break;
 
 		case RT2661_TX_RETRY_FAIL:
@@ -929,14 +931,12 @@ rt2661_tx_intr(struct rt2661_softc *sc)
 				ieee80211_ratectl_tx_complete(vap, ni,
 				    IEEE80211_RATECTL_TX_FAILURE,
 				    &retrycnt, NULL);
-			ifp->if_oerrors++;
 			break;
 
 		default:
 			/* other failure */
 			device_printf(sc->sc_dev,
 			    "sending data frame failed 0x%08x\n", val);
-			ifp->if_oerrors++;
 		}
 
 		DPRINTFN(sc, 15, "tx done q=%d idx=%u\n", qid, txq->stat);
```


----------



## poobert (Jan 25, 2011)

I feel like a turd.

On a whim, loaded the old GENERIC kernel and guess what... no panic.  and  

So I am _fairly_ certain I had all the correct parts in the custom kernel. So the only thing I can fathom the problem being is that I was loading ral(4) as a kernel module and that was screwing something up.

So I guess I will roll with GENERIC for the time being as school started today and I won't have time to fool around with troubleshooting a custom kernel.

Don't think I can officially call this "solved" though.
Thanks for your help, sorry I wasted whatever time you spent reading my posts :r


----------

