Re: ath driver panics on 6-STABLE (LOR)

Dario Freni wrote:
> I bought two atheros based card: a dlink DWL-G520 pci for my home
> router (via c3) and a DWL-G650 pccard for my laptop. I use it with my
> Netgear 802.11g Access Point.
> 
> I'm having repeatedly panics, which I can't reproduce (if not waiting
> a few minutes or some hours of activity), especially on the
> router. I've upgraded to the latest RELENG_6 yesterday from 6-BETA
> without success. Finally built kernel with debug symbols. Here's the
> backtrace:
> 
> sberta:/home/satu/debug> kgdb -d crash/ -n 0 kernel.debug
> [GDB will not be able to debug user-mode threads: /usr/lib/libthread_db.so: Undefined symbol "ps_pglobal_lookup"]
> GNU gdb 6.1.1 [FreeBSD]
> Copyright 2004 Free Software Foundation, Inc.
> GDB is free software, covered by the GNU General Public License, and you are
> welcome to change it and/or distribute copies of it under certain conditions.
> Type "show copying" to see the conditions.
> There is absolutely no warranty for GDB.  Type "show warranty" for details.
> This GDB was configured as "i386-marcel-freebsd".
> 
> Unread portion of the kernel message buffer:
> lock order reversal: (sleepable after non-sleepable)
>  1st 0xc11cf188 ath0 (xmit q) _at_ /usr/src/sys/modules/ath/../../dev/ath/if_ath.c:3537
>  2nd 0xc072ea24 user map (user map) _at_ /usr/src/sys/vm/vm_map.c:2997
> KDB: stack backtrace:
> kdb_backtrace(0,ffffffff,c073e260,c073f2c8,c070a14c) at kdb_backtrace+0x29
> witness_checkorder(c072ea24,9,c06e2a28,bb5) at witness_checkorder+0x5b0
> _sx_xlock(c072ea24,c06e2a28,bb5) at _sx_xlock+0x50
> _vm_map_lock_read(c072e9e0,c06e2a28,bb5,1000016,c10d368c) at _vm_map_lock_read+0x37
> vm_map_lookup(d83db930,0,1,d83db934,d83db924) at vm_map_lookup+0x28
> vm_fault(c072e9e0,0,1,0,c10d4600) at vm_fault+0x65
> trap_pfault(d83db9f8,0,10) at trap_pfault+0xce
> trap(8,28,28,0,e04bdcdc) at trap+0x319
> calltrap() at calltrap+0x5
> --- trap 0xc, eip = 0xc088bf08, esp = 0xd83dba38, ebp = 0 ---
> zz0e373a4d() at zz0e373a4d+0x68
> 
> 
> Fatal trap 12: page fault while in kernel mode
> fault virtual address   = 0x10
> fault code              = supervisor read, page not present
> instruction pointer     = 0x20:0xc088bf08
> stack pointer           = 0x28:0xd83dba38
> frame pointer           = 0x28:0x0
> code segment            = base 0x0, limit 0xfffff, type 0x1b
>                         = DPL 0, pres 1, def32 1, gran 1
> processor eflags        = interrupt enabled, resume, IOPL = 0
> current process         = 28 (swi4: clock sio)
> trap number             = 12
> panic: page fault
> Uptime: 3m3s
> Dumping 223 MB (2 chunks)
>   chunk 0: 1MB (160 pages) ... ok
>   chunk 1: 223MB (57072 pages) 207 191 175 159 143 127 111 95 79 63 47 31 15
> 
> #0  doadump () at pcpu.h:165
> 165     pcpu.h: No such file or directory.
>         in pcpu.h
> (kgdb) backtrace
> #0  doadump () at pcpu.h:165
> #1  0xc0519ed4 in boot (howto=260) at /usr/src/sys/kern/kern_shutdown.c:399
> #2  0xc051a17f in panic (fmt=0xc06b50d4 "%s")
>     at /usr/src/sys/kern/kern_shutdown.c:555
> #3  0xc068d9a2 in trap_fatal (frame=0xd83db9f8, eva=16)
>     at /usr/src/sys/i386/i386/trap.c:831
> #4  0xc068d6d7 in trap_pfault (frame=0xd83db9f8, usermode=0, eva=16)
>     at /usr/src/sys/i386/i386/trap.c:742
> #5  0xc068d341 in trap (frame=
>       {tf_fs = 8, tf_es = 40, tf_ds = 40, tf_edi = 0, tf_esi = -531899172, tf_ebp = 0, tf_isp = -667043292, tf_ebx = -531895256, tf_edx = 787639, tf_ecx = -1073479567, tf_eax = 1, tf_trapno = 12, tf_err = 0, tf_eip = -1064780024, tf_cs = 32, tf_eflags = 66050, tf_esp = 16824924, tf_ss = 0})
>     at /usr/src/sys/i386/i386/trap.c:432
> #6  0xc067d60a in calltrap () at /usr/src/sys/i386/i386/exception.s:139
> #7  0xc088bf08 in ?? ()
> (kgdb) 
> 
> 
> Let me know what further information I may provide.

Disable protection or nuke the code in ath_tx_start that updates CTS 
when bursting.  The latter is what I've done in my tree and in the next 
hal rev the api is removed.

	Sam