RE: [ipw3945-devel] Panic in iwl3945 driver

[Abhijeet Kolekar <abhijeet.kolekar@intel.com>]

On Wed, 2009-12-02 at 11:18 -0800, Cahill, Ben M wrote:
> 
> >-----Original Message-----
> >From: Zhu Yi [mailto:yi.zhu@intel.com] 
> >Sent: Wednesday, December 02, 2009 12:43 AM
> >To: Maxim Levitsky
> >Cc: Chatre, Reinette; linux-wireless; iwlwifi maling list
> >Subject: Re: [ipw3945-devel] Panic in iwl3945 driver
> >
> >On Tue, 2009-12-01 at 17:28 +0800, Zhu Yi wrote:
> >> On Tue, 2009-12-01 at 06:35 +0800, Maxim Levitsky wrote:
> >> > 0x000000000001668e <iwl3945_rx_reply_tx+302>:	lea    
> >0x38(%r8),%rdi
> >> > 0x0000000000016692 <iwl3945_rx_reply_tx+306>:	lea    
> >0x4f(%r8),%rax
> >> 
> >> When this happened, from your previous post, r8 is 0x0 and 
> >rdi is 0x38.
> >> Since "info" is %rdi (see below), this means
> >> txq->txb[txq->q.read_ptr].skb[0], aka. r8 is 0.
> >> 
> >> > 	rate_idx = iwl3945_hwrate_to_plcp_idx(tx_resp->rate);
> >> > 
> >> > 0x0000000000016696 <iwl3945_rx_reply_tx+310>:	movb   
> >$0x0,0x9(%rdi)        <---------- RIP
> >> > 0x000000000001669a <iwl3945_rx_reply_tx+314>:	movb   
> >$0x0,0xc(%rdi)
> >> > 0x000000000001669e <iwl3945_rx_reply_tx+318>:	movb   
> >$0x0,0xf(%rdi)
> >> > 0x00000000000166a2 <iwl3945_rx_reply_tx+322>:	movb   
> >$0x0,0x12(%rdi)
> >> > 0x00000000000166a6 <iwl3945_rx_reply_tx+326>:	movb   
> >$0x0,0x15(%rdi)
> >> 
> >> This equals to below code in 
> >ieee80211_tx_info_clear_status(). "info" is
> >> %rdi, which is 0x38. That matches NULL pointer dereference at 0x41 in
> >> your oops header.
> >> 
> >> 	for (i = 0; i < IEEE80211_TX_MAX_RATES; i++)
> >>                 info->status.rates[i].count = 0;
> >> 
> >> I guess there is a race for txq->q.read_ptr somewhere. 
> >Haven't checked
> >> though.
> >
> >OK. 3945 updated write_ptr without regard to read_ptr on the Tx path.
> >This messes up our TFD on high load. The patch should fix your problem.
> 
> Wow.  Could this be happening with other devices as well?
> 

We do check this on other devices.

Abhijeet

> -- Ben --
> 
> 
> >
> >Signed-off-by: Zhu Yi <yi.zhu@intel.com>
> >
> >diff --git a/drivers/net/wireless/iwlwifi/iwl3945-base.c 
> >b/drivers/net/wireless/iwlwifi/iwl3945-base.c
> >index 994db4a..b31b34c 100644
> >--- a/drivers/net/wireless/iwlwifi/iwl3945-base.c
> >+++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c
> >@@ -548,6 +548,9 @@ static int iwl3945_tx_skb(struct iwl_priv 
> >*priv, struct sk_buff *skb)
> > 	txq = &priv->txq[txq_id];
> > 	q = &txq->q;
> > 
> >+	if ((iwl_queue_space(q) < q->high_mark))
> >+		goto drop;
> >+
> > 	spin_lock_irqsave(&priv->lock, flags);
> > 
> > 	idx = get_cmd_index(q, q->write_ptr, 0);
> > 
> >
> >
> >---------------------------------------------------------------
> >---------------
> >Join us December 9, 2009 for the Red Hat Virtual Experience,
> >a free event focused on virtualization and cloud computing. 
> >Attend in-depth sessions from your desk. Your couch. Anywhere.
> >http://p.sf.net/sfu/redhat-sfdev2dev
> >_______________________________________________
> >Ipw3945-devel mailing list
> >Ipw3945-devel@lists.sourceforge.net
> >https://lists.sourceforge.net/lists/listinfo/ipw3945-devel
> >--
> To unsubscribe from this list: send the line "unsubscribe linux-wireless" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html