Francesco and Lorenzo, I now know a little more about my firmware crash. This time I captured the tx_status from each call just before the callback into mac80211. When the routine was called with the deleted/poisoned skb, I dumped the current status and the saved one. The results were:
b43_dma_handle_txstatus called for deleted cookie 0x2004 Parameter saved_status status cookie 0x2022 0x2004 seq 0x151 0x142 phy_stat 0x0 0x0 frame_count 0x1 0x1 rts_count 0x0 0x0 supp_reason 0x0 0x0 pm_indicat 0x0 0x0 for_ampdu 0x0 0x0 acked 0x1 0x1 Clearly quite a few transaction took place between the time that the skb with cookie 0x2004 was deleted and the erroring callback. The cookie count increased by 30 and the sequence by 15. I'm pretty sure that this means 15 total packets were handled in the interim. Unless this report results in an immediate "light bulb" moment, I plan to buffer at least 32 status values so that we can see the details of all transactions between the first and second calls with the cookie associated with the deleted skb. Are there any other parameters I should also buffer? Larry _______________________________________________ Bcm43xx-dev mailing list Bcm43xx-dev@lists.berlios.de https://lists.berlios.de/mailman/listinfo/bcm43xx-dev
