netvm crash: "kernel bug at iwl-agn.c:886!"

[rafal]

Happens raraly/nondeterministically. netvm console log attached.

Setting network parameters... [  OK  ]
Starting NetworkManager daemon: [  OK  ]
Executing Qubes Core scripts NetVM:[  OK  ]
Starting Qubes GUI agent:[  OK  ]
[   23.542240] ADDRCONF(NETDEV_UP): eth0: link is not ready
[   23.555058] u2mfn_mmap: entering, private=          (null)
[   23.555083] u2mfn_mmap: calling remap return 0
[   23.555099] u2mfn_release, priv=          (null)
[   25.182150] tg3 0000:00:00.0: eth0: Link is up at 100 Mbps, full duplex
[   25.182183] tg3 0000:00:00.0: eth0: Flow control is on for TX and on for RX

Fedora release 14 (Laughlin)
Kernel 2.6.38.3-7.xenlinux.qubes.x86_64 on an x86_64 (/dev/hvc0)

netvm login: [   28.218335] iwlagn 0000:00:01.0: START_ALIVE timeout after 4000ms.
[   28.246693] ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
[   28.717266] ------------[ cut here ]------------
[   28.717302] kernel BUG at /home/joanna/qubes/kernel/kernel-2.6.38.3/linux-2.6.38.3/drivers/net/wireless/iwlwifi/iwl-agn.c:886!
[   28.717322] invalid opcode: 0000 [#1] SMP 
[   28.717338] last sysfs file: /sys/devices/xen-backend/vif-2-0/uevent
[   28.717351] CPU 0 
[   28.717358] Modules linked in: netbk xenbus_be ipt_REJECT xt_state xt_tcpudp iptable_filter ipt_MASQUERADE iptable_nat nf_nat nf_conntrack_ipv4 nf_conntrack nf_defrag_ipv4 ip_tables x_tables binfmt_misc dm_mirror dm_region_hash dm_log u2mfn evtchn uinput arc4 ecb iwlagn iwlcore mac80211 cfg80211 tg3 rfkill usbcore ext4 jbd2 crc16 dm_snapshot xenblk cdrom [last unloaded: scsi_wait_scan]
[   28.717493] 
[   28.717504] Pid: 790, comm: wpa_supplicant Not tainted 2.6.38.3-7.xenlinux.qubes.x86_64 #1  
[   28.717527] RIP: e030:[<ffffffffa023693a>]  [<ffffffffa023693a>] iwl_rx_handle+0x54a/0x550 [iwlagn]
[   28.717572] RSP: e02b:ffff88000f5dad60  EFLAGS: 00010246
[   28.717586] RAX: 0000000000000000 RBX: ffff88000a411c20 RCX: 0000000000000000
[   28.717601] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff88000a411c20
[   28.717616] RBP: 0000000000000000 R08: 0000000000000000 R09: ffff88000f891280
[   28.717632] R10: ffff88000f89128c R11: 0000000000000246 R12: 0000000080000008
[   28.717647] R13: 0000000000000000 R14: 0000000000000000 R15: ffff880009a3bfd8
[   28.717674] FS:  00007ffad278f7e0(0000) GS:ffff88000f5d7000(0000) knlGS:0000000000000000
[   28.717693] CS:  e033 DS: 0000 ES: 0000 CR0: 0000000080050033
[   28.717707] CR2: 00007ffad1469990 CR3: 000000000a4ec000 CR4: 0000000000000660
[   28.717724] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[   28.717740] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
[   28.717754] Process wpa_supplicant (pid: 790, threadinfo ffff880009a3a000, task ffff880009f80400)
[   28.717769] Stack:
[   28.717777]  ffff88000a411c20 0000000000000246 ffff88000f89128c ffff88000f891280
[   28.717800]  0000000000000000 0000000000040001 ffffffff8000322a 0000000000000019
[   28.717822]  0000000000000000 0000000000000000 ffffffffffffffff ffffffff8000322a
[   28.717845] Call Trace:
[   28.717899]  [<ffffffffa023e35c>] iwl_irq_tasklet_legacy+0x61c/0x1aa0 [iwlagn]
[   28.717943]  [<ffffffff80049241>] tasklet_action+0xf1/0x140
[   28.717965]  [<ffffffff80048e92>] __do_softirq+0xd2/0x250
[   28.717985]  [<ffffffff80007dcc>] call_softirq+0x1c/0x30
[   28.718003]  [<ffffffff80009245>] do_softirq+0xa5/0xe0
[   28.718023]  [<ffffffff80048d4d>] irq_exit+0x8d/0xa0
[   28.718044]  [<ffffffff802b5c12>] evtchn_do_upcall+0x282/0x2a0
[   28.718064]  [<ffffffff8000791e>] do_hypervisor_callback+0x1e/0x30
[   28.718084]  [<ffffffff8000322a>] 0xffffffff8000322a
[   28.718106]  [<ffffffff802b53d9>] force_evtchn_callback+0x9/0x10
[   28.718139]  [<ffffffffa0256e5e>] iwlagn_hw_nic_init+0x10e/0x2b0 [iwlagn]
[   28.718205]  [<ffffffffa023d0cc>] __iwl_up+0x1ec/0x9d0 [iwlagn]
[   28.718246]  [<ffffffffa023d94b>] iwlagn_mac_start+0x9b/0x2c0 [iwlagn]
[   28.718301]  [<ffffffffa01a8303>] ieee80211_do_open+0x253/0x660 [mac80211]
[   28.718370]  [<ffffffff803234b6>] __dev_open+0xa6/0xf0
[   28.718392]  [<ffffffff803228ca>] __dev_change_flags+0x9a/0x180
[   28.718411]  [<ffffffff803233c0>] dev_change_flags+0x20/0x70
[   28.718431]  [<ffffffff803864a9>] devinet_ioctl+0x579/0x5d0
[   28.718453]  [<ffffffff8030f769>] sock_do_ioctl+0x29/0x60
[   28.718470]  [<ffffffff8030fb90>] sock_ioctl+0x70/0x2b0
[   28.718488]  [<ffffffff801290f3>] do_vfs_ioctl+0x83/0x3c0
[   28.718505]  [<ffffffff80129479>] sys_ioctl+0x49/0x80
[   28.718523]  [<ffffffff800072f8>] system_call_fastpath+0x16/0x1b
[   28.718542]  [<00007ffad1469997>] 0x7ffad1469997
[   28.718552] Code: 24 48 81 c6 a8 00 00 00 e8 a4 a5 06 e0 8b 44 24 38 2b 83 cc 3f 00 00 0f 89 08 fb ff ff 0f 1f 40 00 05 00 01 00 00 e9 fa fa ff ff <0f> 0b eb fe 66 90 41 55 41 54 55 48 89 f5 53 48 89 fb 48 83 ec 
[   28.718702] RIP  [<ffffffffa023693a>] iwl_rx_handle+0x54a/0x550 [iwlagn]
[   28.718730]  RSP <ffff88000f5dad60>
[   28.718750] ---[ end trace a1b20f1c8230de05 ]---
[   28.718762] Kernel panic - not syncing: Fatal exception in interrupt
[   28.718776] Pid: 790, comm: wpa_supplicant Tainted: G      D     2.6.38.3-7.xenlinux.qubes.x86_64 #1
[   28.718791] Call Trace:
[   28.718809]  [<ffffffff8000970a>] dump_trace+0x7a/0x1a0
[   28.718827]  [<ffffffff803f6b82>] dump_stack+0x67/0x6d
[   28.718843]  [<ffffffff803f6c1a>] panic+0x92/0x1bd
[   28.718861]  [<ffffffff803fb6be>] oops_end+0x12e/0x130
[   28.718879]  [<ffffffff800087ad>] do_invalid_op+0x9d/0xb0
[   28.718896]  [<ffffffff80007b45>] invalid_op+0x25/0x30
[   28.718923]  [<ffffffffa023693a>] iwl_rx_handle+0x54a/0x550 [iwlagn]
[   28.718963]  [<ffffffffa023e35c>] iwl_irq_tasklet_legacy+0x61c/0x1aa0 [iwlagn]
[   28.718998]  [<ffffffff80049241>] tasklet_action+0xf1/0x140
[   28.719015]  [<ffffffff80048e92>] __do_softirq+0xd2/0x250
[   28.719033]  [<ffffffff80007dcc>] call_softirq+0x1c/0x30
[   28.719049]  [<ffffffff80009245>] do_softirq+0xa5/0xe0
[   28.719068]  [<ffffffff80048d4d>] irq_exit+0x8d/0xa0
[   28.719086]  [<ffffffff802b5c12>] evtchn_do_upcall+0x282/0x2a0
[   28.719105]  [<ffffffff8000791e>] do_hypervisor_callback+0x1e/0x30
[   28.719123]  [<ffffffff8000322a>] 0xffffffff8000322a
[   28.719145]  [<ffffffff802b53d9>] force_evtchn_callback+0x9/0x10
[   28.719175]  [<ffffffffa0256e5e>] iwlagn_hw_nic_init+0x10e/0x2b0 [iwlagn]
[   28.719239]  [<ffffffffa023d0cc>] __iwl_up+0x1ec/0x9d0 [iwlagn]
[   28.719278]  [<ffffffffa023d94b>] iwlagn_mac_start+0x9b/0x2c0 [iwlagn]
[   28.719324]  [<ffffffffa01a8303>] ieee80211_do_open+0x253/0x660 [mac80211]
[   28.719389]  [<fffffff

[joanna]

This seems to be a dup of #325 (is solved by the same workaround).