From nobody@FreeBSD.org  Fri Sep  7 00:14:13 2012
Return-Path: <nobody@FreeBSD.org>
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 25C241065674
	for <freebsd-gnats-submit@FreeBSD.org>; Fri,  7 Sep 2012 00:14:13 +0000 (UTC)
	(envelope-from nobody@FreeBSD.org)
Received: from red.freebsd.org (red.freebsd.org [IPv6:2001:4f8:fff6::22])
	by mx1.freebsd.org (Postfix) with ESMTP id 111DA8FC19
	for <freebsd-gnats-submit@FreeBSD.org>; Fri,  7 Sep 2012 00:14:13 +0000 (UTC)
Received: from red.freebsd.org (localhost [127.0.0.1])
	by red.freebsd.org (8.14.5/8.14.5) with ESMTP id q870ECgd011301
	for <freebsd-gnats-submit@FreeBSD.org>; Fri, 7 Sep 2012 00:14:12 GMT
	(envelope-from nobody@red.freebsd.org)
Received: (from nobody@localhost)
	by red.freebsd.org (8.14.5/8.14.5/Submit) id q870ECSV011300;
	Fri, 7 Sep 2012 00:14:12 GMT
	(envelope-from nobody)
Message-Id: <201209070014.q870ECSV011300@red.freebsd.org>
Date: Fri, 7 Sep 2012 00:14:12 GMT
From: Adrian Chadd <adrian@FreeBSD.org>
To: freebsd-gnats-submit@FreeBSD.org
Subject: [ath] ath0: ath_tx_aggr_comp_aggr: num frames seen=1; bf nframes=4
X-Send-Pr-Version: www-3.1
X-GNATS-Notify:

>Number:         171394
>Category:       kern
>Synopsis:       [ath] ath0: ath_tx_aggr_comp_aggr: num frames seen=1; bf nframes=4
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    freebsd-wireless
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Fri Sep 07 00:20:01 UTC 2012
>Closed-Date:    Thu Nov 29 20:25:36 UTC 2012
>Last-Modified:  Thu Nov 29 20:25:36 UTC 2012
>Originator:     Adrian Chadd
>Release:        -HEAD
>Organization:
>Environment:
>Description:

Kim has reported this appearing during normal use:


Sep  4 16:42:53 foo kernel: ath0: ath_tx_aggr_comp_aggr: num frames seen=1; bf nframes=4
Sep  4 16:42:56 foo kernel: ath0: ath_tx_aggr_comp_aggr: AR5416 bug: hasba=0; txok=1, isaggr=1, seq_st=3889
Sep  4 16:42:56 foo kernel: Q1[  0] (DS.V:0xffffff811b49a0c0 DS.P:0x1469a0c0) L:1469a120 D:17e95b5e F:0004
Sep  4 16:42:56 foo kernel: Seq: 62976 swtry: 2 ADDBAW?: 1 DOBAW?: 1
Sep  4 16:42:56 foo kernel: 407f0612 0000902c 24348000 888b8c8d 814580fd 86cc81d1
Sep  4 16:42:56 foo kernel: 08000000 0097bdef 00000000 3f000000 3f000000 3f000000 00000000 00000000
Sep  4 16:42:56 foo kernel: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
Sep  4 16:42:56 foo kernel: (DS.V:0xffffff811b49a120 DS.P:0x1469a120) L:1469a180 D:2f0b9e80 F:0004
Sep  4 16:42:56 foo kernel: Seq: 62976 swtry: 2 ADDBAW?: 1 DOBAW?: 1
Sep  4 16:42:56 foo kernel: 00000000 00001028 00000000 00000000 00000000 00000000
Sep  4 16:42:56 foo kernel: 08280000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
Sep  4 16:42:56 foo kernel: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
Sep  4 16:42:56 foo kernel: (DS.V:0xffffff811b49a180 DS.P:0x1469a180) L:1468b780 D:ab29e344 F:0004
Sep  4 16:42:56 foo kernel: Seq: 62976 swtry: 2 ADDBAW?: 1 DOBAW?: 1
Sep  4 16:42:56 foo kernel: 00000000 000005b4 24348000 888b8c8d 00000000 00000000
Sep  4 16:42:56 foo kernel: 08280000 00000000 00000000 00000000 00000000 00000000 00803736 00000101
Sep  4 16:42:56 foo kernel: 007c69f9 ffffffff ffff7fff 3a803839 80808080 80808080 80808080 00001e63
Sep  4 16:42:56 foo kernel: [end]
Sep  4 16:42:56 foo kernel: ath0: ath_tx_aggr_comp_aggr: num frames seen=1; bf nframes=4
Sep  4 16:42:59 foo kernel: ath0: stuck beacon; resetting (bmiss count 4)
Sep  4 16:43:00 foo kernel: ath0: ath_tx_aggr_comp_aggr: AR5416 bug: hasba=0; txok=1, isaggr=1, seq_st=1591
Sep  4 16:43:00 foo kernel: Q1[  0] (DS.V:0xffffff811b4f1940 DS.P:0x146f1940) L:146f19a0 D:2f0f045e F:0004
Sep  4 16:43:00 foo kernel: Seq: 26112 swtry: 2 ADDBAW?: 1 DOBAW?: 1
Sep  4 16:43:00 foo kernel: 407f0612 0000902c 24348000 888b8c8d 814580fd 86cc81d1
Sep  4 16:43:00 foo kernel: 08000000 0097bdef 00000000 3f000000 3f000000 3f000000 00000000 00000000
Sep  4 16:43:00 foo kernel: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
Sep  4 16:43:00 foo kernel: (DS.V:0xffffff811b4f19a0 DS.P:0x146f19a0) L:146f1a00 D:2f830d80 F:0004
Sep  4 16:43:00 foo kernel: Seq: 26112 swtry: 2 ADDBAW?: 1 DOBAW?: 1
Sep  4 16:43:00 foo kernel: 00000000 00001028 00000000 00000000 00000000 00000000
Sep  4 16:43:00 foo kernel: 08280000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
Sep  4 16:43:00 foo kernel: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
Sep  4 16:43:00 foo kernel: (DS.V:0xffffff811b4f1a00 DS.P:0x146f1a00) L:146da0c0 D:ad74e29c F:0004
Sep  4 16:43:00 foo kernel: Seq: 26112 swtry: 2 ADDBAW?: 1 DOBAW?: 1
Sep  4 16:43:00 foo kernel: 00000000 000005b4 24348000 888b8c8d 00000000 00000000
Sep  4 16:43:00 foo kernel: 08280000 00000000 00000000 00000000 00000000 00000000 00803737 00000001
Sep  4 16:43:00 foo kernel: 00161ae8 ffffffff fffffdff 3b80383a 80808080 80808080 80808080 00000c6f
Sep  4 16:43:00 foo kernel: [end]
Sep  4 16:43:00 foo kernel: ath0: ath_tx_aggr_comp_aggr: num frames seen=1; bf nframes=4

>How-To-Repeat:
Use 11n in a noisy/congested environment
>Fix:
The problem is that the bfs_nframes and bfs_aggr frames aren't being reset after a software transmit failure.

SO:

* an aggregate is formed; the head ath_buf has bfs_nframes=X and bfs_aggr=1;
* it fails;
* the hwq is empty;
* the first frame is retried via ath_tx_xmit_aggr() as a single frame;
* it gets TXed successfully or not;
* .. but bfs_aggr=1, so the aggr completion function is called, rather than the single-frame aggr completion function
* .. and bfs_nframes != the number of buffers in that list, so things complain.

>Release-Note:
>Audit-Trail:
Responsible-Changed-From-To: freebsd-bugs->freebsd-wireless 
Responsible-Changed-By: adrian 
Responsible-Changed-When: Fri Sep 7 00:23:40 UTC 2012 
Responsible-Changed-Why:  
Reassign 


http://www.freebsd.org/cgi/query-pr.cgi?pr=171394 

From: dfilter@FreeBSD.ORG (dfilter service)
To: bug-followup@FreeBSD.org
Cc:  
Subject: Re: kern/171394: commit references a PR
Date: Fri,  7 Sep 2012 00:24:41 +0000 (UTC)

 Author: adrian
 Date: Fri Sep  7 00:24:27 2012
 New Revision: 240180
 URL: http://svn.freebsd.org/changeset/base/240180
 
 Log:
   Ensure that single-frame aggregate session frames are retransmitted
   with the correct configuration.
   
   Occasionally an aggregate TX would fail and the first frame would be
   retransmitted as a non-AMPDU frame.  Since bfs_aggr=1 and bfs_nframes > 1
   (from the previous AMPDU attempt), the aggr completion function would be
   called and be very confused about what's going on.
   
   Noticed by:	Kim <w8hdkim@gmail.com>
   PR:		kern/171394
 
 Modified:
   head/sys/dev/ath/if_ath_tx.c
 
 Modified: head/sys/dev/ath/if_ath_tx.c
 ==============================================================================
 --- head/sys/dev/ath/if_ath_tx.c	Fri Sep  7 00:20:46 2012	(r240179)
 +++ head/sys/dev/ath/if_ath_tx.c	Fri Sep  7 00:24:27 2012	(r240180)
 @@ -2528,6 +2528,25 @@ ath_tx_xmit_aggr(struct ath_softc *sc, s
  		return;
  	}
  
 +	/*
 +	 * This is a temporary check and should be removed once
 +	 * all the relevant code paths have been fixed.
 +	 *
 +	 * During aggregate retries, it's possible that the head
 +	 * frame will fail (which has the bfs_aggr and bfs_nframes
 +	 * fields set for said aggregate) and will be retried as
 +	 * a single frame.  In this instance, the values should
 +	 * be reset or the completion code will get upset with you.
 +	 */
 +	if (bf->bf_state.bfs_aggr != 0 || bf->bf_state.bfs_nframes > 1) {
 +		device_printf(sc->sc_dev, "%s: bfs_aggr=%d, bfs_nframes=%d\n",
 +		    __func__,
 +		    bf->bf_state.bfs_aggr,
 +		    bf->bf_state.bfs_nframes);
 +		bf->bf_state.bfs_aggr = 0;
 +		bf->bf_state.bfs_nframes = 1;
 +	}
 +
  	/* Direct dispatch to hardware */
  	ath_tx_do_ratelookup(sc, bf);
  	ath_tx_calc_duration(sc, bf);
 @@ -2624,6 +2643,16 @@ ath_tx_swq(struct ath_softc *sc, struct 
  		if (txq->axq_depth < sc->sc_hwq_limit) {
  			bf = TAILQ_FIRST(&atid->axq_q);
  			ATH_TXQ_REMOVE(atid, bf, bf_list);
 +
 +			/*
 +			 * Ensure it's definitely treated as a non-AMPDU
 +			 * frame - this information may have been left
 +			 * over from a previous attempt.
 +			 */
 +			bf->bf_state.bfs_aggr = 0;
 +			bf->bf_state.bfs_nframes = 1;
 +
 +			/* Queue to the hardware */
  			ath_tx_xmit_aggr(sc, an, txq, bf);
  			DPRINTF(sc, ATH_DEBUG_SW_TX,
  			    "%s: xmit_aggr\n",
 @@ -4018,7 +4047,23 @@ ath_tx_tid_hw_queue_aggr(struct ath_soft
  			    "%s: non-baw packet\n",
  			    __func__);
  			ATH_TXQ_REMOVE(tid, bf, bf_list);
 +
 +			if (bf->bf_state.bfs_nframes > 1)
 +				device_printf(sc->sc_dev,
 +				    "%s: aggr=%d, nframes=%d\n",
 +				    __func__,
 +				    bf->bf_state.bfs_aggr,
 +				    bf->bf_state.bfs_nframes);
 +
 +			/*
 +			 * This shouldn't happen - such frames shouldn't
 +			 * ever have been queued as an aggregate in the
 +			 * first place.  However, make sure the fields
 +			 * are correctly setup just to be totally sure.
 +			 */
  			bf->bf_state.bfs_aggr = 0;
 +			bf->bf_state.bfs_nframes = 1;
 +
  			ath_tx_do_ratelookup(sc, bf);
  			ath_tx_calc_duration(sc, bf);
  			ath_tx_calc_protection(sc, bf);
 _______________________________________________
 svn-src-all@freebsd.org mailing list
 http://lists.freebsd.org/mailman/listinfo/svn-src-all
 To unsubscribe, send any mail to "svn-src-all-unsubscribe@freebsd.org"
 
State-Changed-From-To: open->closed 
State-Changed-By: adrian 
State-Changed-When: Thu Nov 29 20:25:17 UTC 2012 
State-Changed-Why:  
This was fixed and verified; it hasn't shown up since. 


http://www.freebsd.org/cgi/query-pr.cgi?pr=171394 
>Unformatted:
