This is an old revision of the document!
Driver and 802.11 stack Locking issues
# lock order reversal: 1st 0xc6b116dc ath1_node_lock (ath1_node_lock) @ /usr/home/adrian/work/freebsd/ svn/src/sys/net80211/ieee80211_node.c:1948 2nd 0xc6b10014 ath1_com_lock (ath1_com_lock) @ /usr/home/adrian/work/freebsd/sv n/src/sys/net80211/ieee80211_power.c:295 KDB: stack backtrace: db_trace_thread+30 (?,?,?,?) ra c037da9800000018 sp 0 sz 0 db_trace_self+1c (?,?,?,?) ra c037dab000000018 sp 0 sz 0 8007b888+34 (?,?,?,?) ra c037dac8000001a0 sp 0 sz 0 kdb_backtrace+44 (?,?,?,?) ra c037dc6800000018 sp 0 sz 0 80203104+34 (?,?,?,?) ra c037dc8000000020 sp 0 sz 0 witness_checkorder+9cc (?,?,80440f58,127) ra c037dca000000050 sp 0 sz 1 _mtx_lock_flags+d0 (?,?,?,?) ra c037dcf000000030 sp 0 sz 0 802c87c8+88 (?,?,?,?) ra c037dd2000000028 sp 0 sz 0 802c0e74+64 (?,?,?,?) ra c037dd4800000020 sp 0 sz 0 ieee80211_node_timeout+1a4 (?,?,?,?) ra c037dd6800000040 sp 0 sz 0 softclock+298 (?,?,?,?) ra c037dda800000058 sp 0 sz 0 intr_event_execute_handlers+158 (?,?,?,?) ra c037de0000000028 sp 0 sz 0 8018a7c8+10c (?,?,?,?) ra c037de2800000030 sp 0 sz 0 fork_exit+a8 (?,?,?,?) ra c037de5800000028 sp 0 sz 0 fork_trampoline+10 (?,?,?,?) ra c037de8000000000 sp 0 sz 0 pid 11
# lock order reversal: 1st 0xc6b11794 ath1_scan_lock (ath1_scan_lock) @ /usr/home/adrian/work/freebsd/ svn/src/sys/net80211/ieee80211_node.c:1945 2nd 0xc6b10014 ath1_com_lock (ath1_com_lock) @ /usr/home/adrian/work/freebsd/sv n/src/sys/net80211/ieee80211_node.c:2611 KDB: stack backtrace: db_trace_thread+30 (?,?,?,?) ra c037dab000000018 sp 0 sz 0 db_trace_self+1c (?,?,?,?) ra c037dac800000018 sp 0 sz 0 8007b888+34 (?,?,?,?) ra c037dae0000001a0 sp 0 sz 0 kdb_backtrace+44 (?,?,?,?) ra c037dc8000000018 sp 0 sz 0 80203104+34 (?,?,?,?) ra c037dc9800000020 sp 0 sz 0 witness_checkorder+9cc (?,?,804401b0,a33) ra c037dcb800000050 sp 0 sz 1 _mtx_lock_flags+d0 (?,?,?,?) ra c037dd0800000030 sp 0 sz 0 ieee80211_node_leave+b8 (?,?,?,?) ra c037dd3800000030 sp 0 sz 0 ieee80211_node_timeout+2e4 (?,?,?,?) ra c037dd6800000040 sp 0 sz 0 softclock+298 (?,?,?,?) ra c037dda800000058 sp 0 sz 0 intr_event_execute_handlers+158 (?,?,?,?) ra c037de0000000028 sp 0 sz 0 8018a7c8+10c (?,?,?,?) ra c037de2800000030 sp 0 sz 0 fork_exit+a8 (?,?,?,?) ra c037de5800000028 sp 0 sz 0 fork_trampoline+10 (?,?,?,?) ra c037de8000000000 sp 0 sz 0 pid 11
# lock order reversal: 1st 0xc6be76dc ath0_node_lock (ath0_node_lock) @ /usr/home/adrian/work/freebsd/svn/src/sys/modules/wlan/../../net80211/ieee80211_ioctl.c:1341 2nd 0xc6be6014 ath0_com_lock (ath0_com_lock) @ /usr/home/adrian/work/freebsd/svn/src/sys/modules/wlan/../../net80211/ieee80211_node.c:2611 KDB: stack backtrace: db_trace_thread+30 (?,?,?,?) ra c02a381000000018 sp 0 sz 0 db_trace_self+1c (?,?,?,?) ra c02a382800000018 sp 0 sz 0 80077bb8+34 (?,?,?,?) ra c02a3840000001a0 sp 0 sz 0 kdb_backtrace+44 (?,?,?,?) ra c02a39e000000018 sp 0 sz 0 8015d564+34 (?,?,?,?) ra c02a39f800000020 sp 0 sz 0 witness_checkorder+9cc (?,?,c032d8bc,a33) ra c02a3a1800000050 sp 0 sz 1 _mtx_lock_flags+d0 (?,?,?,?) ra c02a3a6800000030 sp 0 sz 0 ieee80211_node_leave+d0 (?,?,?,?) ra c02a3a9800000030 sp 0 sz 0 domlme+9c (?,?,?,?) ra c02a3ac800000020 sp 0 sz 0 setmlme_common+164 (?,?,?,?) ra c02a3ae800000040 sp 0 sz 0 ieee80211_ioctl_setmlme+b8 (?,?,?,?) ra c02a3b2800000048 sp 0 sz 0 ieee80211_ioctl_set80211+5d4 (?,?,?,?) ra c02a3b7000000080 sp 0 sz 0 ieee80211_ioctl+344 (?,?,?,?) ra c02a3bf000000030 sp 0 sz 0 in_control+21c (?,?,?,?) ra c02a3c2000000078 sp 0 sz 0 ifioctl+13e0 (?,?,81e13280,80757c40) ra c02a3c9800000090 sp 0 sz 1 soo_ioctl+3b0 (?,?,?,?) ra c02a3d2800000028 sp 0 sz 0 kern_ioctl+248 (?,?,?,?) ra c02a3d5000000040 sp 0 sz 0 sys_ioctl+130 (?,?,?,?) ra c02a3d9000000038 sp 0 sz 0 trap+7f4 (?,?,?,?) ra c02a3dc8000000b8 sp 0 sz 0 MipsUserGenException+10c (?,?,?,4086a660) ra c02a3e8000000000 sp 0 sz 0 pid 410
This is a recent introduction - due to putting a big lock across the entire TX path. Because ieee80211_node_free is being called as part of the TX path. Somewhere, however, the TX lock is being grabbed whilst the node lock is held - that's going to be fun to figure out.
lock order reversal: 1st 0xc66016c4 ath1 TX lock (ath1 TX lock) @ /usr/home/adrian/work/freebsd/svn/src/sys/dev/ath/if_ath_misc.h:127 2nd 0xc66086dc ath1_node_lock (ath1_node_lock) @ /usr/home/adrian/work/freebsd/svn/src/sys/net80211/ieee80211_node.c:1710 KDB: stack backtrace: db_trace_thread+30 (?,?,?,?) ra c7ecb7b800000018 sp 0 sz 0 db_trace_self+1c (?,?,?,?) ra c7ecb7d000000018 sp 0 sz 0 8007bde8+34 (?,?,?,?) ra c7ecb7e8000001a0 sp 0 sz 0 kdb_backtrace+44 (?,?,?,?) ra c7ecb98800000018 sp 0 sz 0 80213f48+34 (?,?,?,?) ra c7ecb9a000000020 sp 0 sz 0 witness_checkorder+9e0 (?,?,8045fbfc,6ae) ra c7ecb9c000000050 sp 0 sz 1 __mtx_lock_flags+c8 (?,?,?,?) ra c7ecba1000000040 sp 0 sz 0 ieee80211_free_node+40 (?,?,?,?) ra c7ecba5000000030 sp 0 sz 0 ath_start+3a4 (?,?,?,?) ra c7ecba8000000060 sp 0 sz 0 80083c3c+84 (?,?,?,?) ra c7ecbae000000038 sp 0 sz 0 if_start+14 (?,?,?,?) ra c7ecbb1800000018 sp 0 sz 0 8027e978+14c (?,?,?,?) ra c7ecbb3000000028 sp 0 sz 0 ieee80211_start+7a4 (?,?,?,?) ra c7ecbb5800000048 sp 0 sz 0 if_start+14 (?,?,?,?) ra c7ecbba000000018 sp 0 sz 0 8027e978+14c (?,?,?,?) ra c7ecbbb800000028 sp 0 sz 0 80286b74+b0 (?,?,?,?) ra c7ecbbe000000030 sp 0 sz 0 802870dc+26c (?,?,821d5500,?) ra c7ecbc1000000040 sp 0 sz 1 8028959c+260 (?,?,821d5500,?) ra c7ecbc5000000038 sp 0 sz 1 80289908+228 (?,81c40300,?,?) ra c7ecbc8800000038 sp 1 sz 0 8028cb80+3bc (81c40300,?,?,?) ra c7ecbcc000000030 sp 100000000 sz 0 netisr_dispatch_src+134 (?,?,?,?) ra c7ecbcf000000040 sp 0 sz 0 netisr_dispatch+14 (?,?,?,?) ra c7ecbd3000000018 sp 0 sz 0 8028c748+34 (?,?,?,?) ra c7ecbd4800000018 sp 0 sz 0 803d4f90+28c (?,?,?,?) ra c7ecbd6000000048 sp 0 sz 0 intr_event_execute_handlers+1ac (?,?,?,?) ra c7ecbda800000048 sp 0 sz 0 801943b0+150 (?,?,?,?) ra c7ecbdf000000050 sp 0 sz 0 fork_exit+ec (?,?,?,?) ra c7ecbe4000000040 sp 0 sz 0 fork_trampoline+10 (?,?,?,?) ra c7ecbe8000000000 sp 0 sz 0 pid 11