Date: Thu, 24 Jun 2010 11:47:56 -0400 From: Boris Kochergin <spawk@acm.poly.edu> To: Sam Leffler <sam@freebsd.org> Cc: freebsd-net@freebsd.org, stef@memberwebs.com Subject: Re: kmem_map too small panics with Soekris/Atheros access point [ath rate control] Message-ID: <4C237E2C.3080103@acm.poly.edu> In-Reply-To: <4AB1D7C2.5010403@freebsd.org> References: <4A8C3557.20002@acm.poly.edu> <4AA03A41.1080200@acm.poly.edu> <4AB1A086.4090303@acm.poly.edu> <4AB1D7C2.5010403@freebsd.org>
next in thread | previous in thread | raw e-mail | index | archive | help
Sam Leffler wrote: > Boris Kochergin wrote: > >> Stef Walter wrote: >> >>> Boris Kochergin wrote: >>> >>> >> I, too, recall the days when you had multiple rate-control algorithms to >> choose from, but that doesn't appear to be the case anymore. As a >> workaround, I wrote a little script that checks if that part of the >> driver is using more than 200 KiB of memory and run it every minute via >> cron. It seems to be doing its job so far: >> > > You can still select the ath rate control module. Static kernel config > is unchanged; for modules you must export ATH_RATE=onoe or similar > (check modules/ath/Makefile). Please file a PR if this does not work. > > Sam > (I had to go do some other stuff, but better late than never?) Thanks. That does indeed work, but the problem persists with other rate-control algorithms (I've upgraded most of the access points to 8.0-R, where the problem does not appear to exist, and upgraded one to 7.3-R for continued testing--this is where it still happens). I've instrumented the memory-allocation bits in the ath and net80211 code where MALLOC/malloc was called with a type of M_80211_NODE. I've tracked the leak down to one of two allocations never being freed: Line 595 of /usr/src/sys/net80211/ieee80211_node.c: MALLOC(ni, struct ieee80211_node *, sizeof(struct ieee80211_node), M_80211_NODE, M_NOWAIT | M_ZERO); Line 3164 of /usr/src/sys/dev/ath/if_ath.c: an = malloc(space, M_80211_NODE, M_NOWAIT|M_ZERO); It looks like both are supposed to be freed by node_free() in /usr/src/sys/net80211/ieee80211_node.c, but there is some code path where that doesn't happen, and should. Hopefully, this helps someone familiar with the code track it down. I may try it at some point, but it intimidates me somewhat. -Boris
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?4C237E2C.3080103>