[Bug 192641] New: [iwn] panic in AMPDU tx code "ni: no node"

[b***@freebsd.org]

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=192641

Bug ID: 192641
Summary: [iwn] panic in AMPDU tx code "ni: no node"
Product: Base System
Version: 11.0-CURRENT
Hardware: Any
OS: Any
Status: Needs Triage
Severity: Affects Only Me
Priority: ---
Component: wireless
Assignee: freebsd-***@FreeBSD.org
Reporter: ***@freebsd.org

(kgdb) bt
#0 doadump (textdump=-1059352868) at pcpu.h:233
#1 0xc04f92cd in db_fncall (dummy1=-332454048, dummy2=0, dummy3=-951087536,
dummy4=0xec2f274c "�&R��\216��") at
/usr/home/adrian/work/freebsd/head/src/sys/ddb/db_command.c:578
#2 0xc04f8fab in db_command (cmd_table=<value optimized out>) at
/usr/home/adrian/work/freebsd/head/src/sys/ddb/db_command.c:449
#3 0xc04f8cf0 in db_command_loop () at
/usr/home/adrian/work/freebsd/head/src/sys/ddb/db_command.c:502
#4 0xc04fb640 in db_trap (type=<value optimized out>, code=<value optimized
out>) at /usr/home/adrian/work/freebsd/head/src/sys/ddb/db_main.c:231
#5 0xc06c2bf4 in kdb_trap (type=<value optimized out>, code=<value optimized
out>, tf=<value optimized out>) at
/usr/home/adrian/work/freebsd/head/src/sys/kern/subr_kdb.c:654
#6 0xc093df67 in trap (frame=<value optimized out>) at
/usr/home/adrian/work/freebsd/head/src/sys/i386/i386/trap.c:693
#7 0xc0926a7c in calltrap () at
/usr/home/adrian/work/freebsd/head/src/sys/i386/i386/exception.s:169
#8 0xc06c247d in kdb_enter (why=0xc09ba864 "panic", msg=<value optimized out>)
at cpufunc.h:71
#9 0xc0687f61 in vpanic (fmt=<value optimized out>, ap=<value optimized out>)
at /usr/home/adrian/work/freebsd/head/src/sys/kern/kern_shutdown.c:739
#10 0xc0687e13 in kassert_panic (fmt=<value optimized out>) at
/usr/home/adrian/work/freebsd/head/src/sys/kern/kern_shutdown.c:634
#11 0xc8f14751 in iwn_ampdu_tx_done (sc=0xc8f21000, qid=10, idx=<value
optimized out>, nframes=1, stat=<value optimized out>) at
/usr/home/adrian/work/freebsd/head/src/sys/modules/iwn/../../dev/iwn/if_iwn.c:3613
#12 0xc8f13eb5 in iwn5000_tx_done (sc=<value optimized out>, desc=<value
optimized out>, data=<value optimized out>) at
/usr/home/adrian/work/freebsd/head/src/sys/modules/iwn/../../dev/iwn/if_iwn.c:3411
#13 0xc8f0b9ff in iwn_notif_intr (sc=0xc8f21000) at
/usr/home/adrian/work/freebsd/head/src/sys/modules/iwn/../../dev/iwn/if_iwn.c:3696
#14 0xc8f0b2e0 in iwn_intr (arg=0xc8f21000) at
/usr/home/adrian/work/freebsd/head/src/sys/modules/iwn/../../dev/iwn/if_iwn.c:3995
#15 0xc0655913 in intr_event_execute_handlers (ie=<value optimized out>) at
/usr/home/adrian/work/freebsd/head/src/sys/kern/kern_intr.c:1252
#16 0xc0656213 in ithread_loop (arg=0xc85e6ee0) at
/usr/home/adrian/work/freebsd/head/src/sys/kern/kern_intr.c:1265
#17 0xc0652e2f in fork_exit (callout=0xc0656180 <ithread_loop>) at
/usr/home/adrian/work/freebsd/head/src/sys/kern/kern_fork.c:977
#18 0xc0926b24 in fork_trampoline () at
/usr/home/adrian/work/freebsd/head/src/sys/i386/i386/exception.s:278
Current language: auto; currently minimal
(kgdb) frame 11
#11 0xc8f14751 in iwn_ampdu_tx_done (sc=0xc8f21000, qid=10, idx=<value
optimized out>, nframes=1, stat=<value optimized out>) at
/usr/home/adrian/work/freebsd/head/src/sys/modules/iwn/../../dev/iwn/if_iwn.c:3613
3613 KASSERT(ni != NULL, ("no node"));
(kgdb) print ni
$1 = <value optimized out>
(kgdb)

.. and leading up to it:

Unread portion of the kernel message buffer:
iwn0: iwn_tx_data: m=0xc9572900: seqno (53004) (12) != ring index (0) !
iwn0: iwn_tx_data: m=0xc896f200: seqno (53005) (13) != ring index (1) !
panic: no node
cpuid = 1
KDB: stack backtrace:
db_trace_self_wrapper(c09bf552,ec2f29b8,fc,10000000,0,...) at
db_trace_self_wrapper+0x2d/frame 0xec2f29a0
kdb_backtrace(c09fc9a7,1,c8f18b78,ec2f2a8c,ec2f2a30,...) at
kdb_backtrace+0x30/frame 0xec2f2a08
vpanic(c0af9f18,100,c8f18b78,ec2f2a8c,4000ace,...) at vpanic+0x11d/frame
0xec2f2a44
kassert_panic(c8f18b78,5,cdd25c00,cdd25c00,c8d6dc00,...) at
kassert_panic+0x153/frame 0xec2f2a80
iwn_ampdu_tx_done(0,1,cae8f028,c0671aa1,c8f2100c,...) at
iwn_ampdu_tx_done+0x251/frame 0xec2f2adc
iwn5000_tx_done(c8f21000,cae8f000,c8f3a934,bd2,c8f0dea0,...) at
iwn5000_tx_done+0xe5/frame 0xec2f2b20
iwn_notif_intr(c8f2101c,0,c8f18029,f5a,c0b07b80,...) at
iwn_notif_intr+0x4bf/frame 0xec2f2bd0
iwn_intr(c8f21000,c09b3975,4e0,c09b3b43,c09b3b68,...) at iwn_intr+0x7c0/frame
0xec2f2c3c
intr_event_execute_handlers(c7492bc0,c86c6480,c09b3975,55a,3c9,...) at
intr_event_execute_handlers+0xe3/frame 0xec2f2c80
ithread_loop(c85e6ee0,ec2f2d08,c09b367a,3c9,0,...) at ithread_loop+0x93/frame
0xec2f2ccc
fork_exit(c0656180,c85e6ee0,ec2f2d08) at fork_exit+0x7f/frame 0xec2f2cf4
fork_trampoline() at fork_trampoline+0x8/frame 0xec2f2cf4
--- trap 0, eip = 0, esp = 0xec2f2d40, ebp = 0 ---
KDB: enter: panic

.. so something went a little pear shaped and we didn't handle it right.

[b***@freebsd.org]

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=192641

Tim Marinin <marinintim+***@gmail.com> changed:

What |Removed |Added
----------------------------------------------------------------------------
CC| |marinintim+***@gmail.co
| |m

--- Comment #1 from Tim Marinin <marinintim+***@gmail.com> ---
It seems like I'm having the same problem with N-2230 on CURRENT, it causes
panics once in a while (I have 9 core dumps since New Year). Not sure how to
debug it.

[b***@freebsd.org]

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=192641

***@mail.ru changed:

What |Removed |Added
----------------------------------------------------------------------------
CC| |***@mail.ru

--- Comment #2 from ***@mail.ru ---
Hello! While working with iwfi drivers in Haiku (those drivers are ported from
FreeBSD) i founded the bugs, that potentially is FreeBSD specific.

iprowifi4965 and iprowifi3945 are affected. May be others.

I will describe them on iprowifi4965 code.

iwn_tx_done has KASSERT(data->ni != NULL, ("no node")) at beginning that is
triggers in some situations.

The situation can be:

1) hw interrupt is scheduled

2) iwn_hw_stop is called (and it disables/enables interrupss) node is destroyed
here.

3) here we got scheduled (threaded) interrupt that is not actual anymore ->
panic

In fact, i was thinking it is Haiku specific bug, because of threaded inr
handlers. But i found this bug report and it seems the same for me.

To reproduce it on Haiku i run floodping to roater while reboot the system. But
on FreeBSD i am not sure, what can couse iwn_hw_stop while sending packets...

Hope it helps.