From owner-freebsd-net@FreeBSD.ORG Fri Dec 5 00:05:06 2014 Return-Path: Delivered-To: freebsd-net@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 7C5FCC4C; Fri, 5 Dec 2014 00:05:06 +0000 (UTC) Received: from anubis.delphij.net (anubis.delphij.net [IPv6:2001:470:1:117::25]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "anubis.delphij.net", Issuer "StartCom Class 1 Primary Intermediate Server CA" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 65D6CC60; Fri, 5 Dec 2014 00:05:06 +0000 (UTC) Received: from zeta.ixsystems.com (unknown [12.229.62.2]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (Client did not present a certificate) by anubis.delphij.net (Postfix) with ESMTPSA id 16D611A1EC; Thu, 4 Dec 2014 16:05:06 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=delphij.net; s=anubis; t=1417737906; x=1417752306; bh=KaxfFvjS7sO3yOlmaggSMEObK2o5pdp5C4VoB2PP258=; h=Date:From:Reply-To:To:Subject; b=ODZnKGJGoI4+IePn/891MEjxpe8l+726xNfqN6QFpLF8Boilz5ni7jZOG2P2z6Cl6 b98MG8TyudDbyCvtIR/3ohiC+b7qUUZCasFw7AwgcJaXo3TmyNJ1htwwDguuJKCxXy sC9QC7FMmQNJV9IJgCQh7vUeJI58V9h3u/EIhW2Q= Message-ID: <5480F6B1.8070802@delphij.net> Date: Thu, 04 Dec 2014 16:05:05 -0800 From: Xin Li Reply-To: d@delphij.net Organization: The FreeBSD Project MIME-Version: 1.0 To: "freebsd-net@freebsd.org" , Adrian Chadd Subject: Panic after iwn0 controller panic Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.18-1 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 05 Dec 2014 00:05:06 -0000 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hi, I have seen this in the morning when I had an overnight replication from my laptop to my storage system which transfers a lot of data. Before the panic there was some message like: iwn0: iwn_panicked: controller panicked, iv_state = 5; resetting... iwn0: iwn_read_firmware: ucode rev=0x12a80601 iwn0: iwn_tx_data: m=0xfffff8001d780300: seqno (61735) (39) != ring index (0) ! Then the panic with fault virtual address (0x1f, which seems to be mbuf->mflags). Call trace was: ithread_loop -> intr_event_execute_handlers -> iwn_intr -> iwn_notif_intr -> iwn_ampdu_tx_done@3717 -> ieee80211_tx_complete@3417 So looks like 'm' was NULL in ieee80211_tx_complete. I don't have INVARIANTS enabled or the panic should be earlier as there is an assertion in iwn(4) right before calling ieee80211_tx_complete: KASSERT(m != NULL, ("no mbuf")); I haven't looked at the issue further yet as I haven't idea how to provoke the issue again. Cheers, - -- Xin LI https://www.delphij.net/ FreeBSD - The Power to Serve! Live free or die -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.1.0 (FreeBSD) iQIcBAEBCgAGBQJUgPauAAoJEJW2GBstM+nsYHcP/187em+bzP6QW7jw6H+cGwI/ NMi2862SL2NfV+0eQt2zPtUd2MmQZzraT13KumAW5uZ3jOBvRxzjnxJq5Ljv6xP/ T+IwLJ/Tu1Yc+oEcWB0CucDU3Xmsbln1iOo5Wwez/Hs0nllvg+jiwMlUgd6zanxN rxldI9xRgEKKLplCWhhIRODC7JFD4kyftPPMafxEVPXVBtgTtr5Yt0uk/1Nr5aii Quct6QbdpT2epa9wpb2Z5VUgLfafOJ43XWpTdI0xXPxkjqQcBf6E4SoVsxoNQ6IM 33BRye/G0RBkSvWSGaSw6DlqYtSU/NG8Wx4JeEjH71Bm6wE2kk9AU3mvcE/cYGdh INKNw4gpP4EDM1v8mhJjRQIOHON2WEaRH535+zJ16v+KERRKmA9BjDPZh/TSC8CF zBRsHrO1SiS0A1tjccOBBOhSKBBvWwH+fVGtsYLRlmkVF/qzGZqYDnvdDskMKPF9 hAJr3ZU8lC6aja44+qKR3z6m5XxnTGqO1kgIrisQHNBydH3HW5MZLbv9Muf/PWqo caJ04rtC1AQfE9N50l3fYsqvAyAncraCaEiaeQQ2oSNO5ruAm0OjjUQBcAq9xGw8 qEjkFHAbxrOV15y5qXSKkSV80rE5/ve1JEbQqGxhhplMc8DPrc4ZS5AIuujOeJvd oaIMRMYo83HUraRy54SN =0TDK -----END PGP SIGNATURE-----