Larry Finger wrote: > @@ -224,6 +236,7 @@ static void p54_tx_qos_accounting_free(s > struct p54_tx_data *data = (void *) hdr->data; > > priv->tx_stats[data->hw_queue].len--; > + WARN_ON(priv->tx_stats[data->hw_queue].len < 0); > } > p54_wake_queues(priv); > } > The new WARN_ON did _NOT_ trigger when the len went negative. The only other place where len could be decremented is through txhdr->backlog. I noticed that the p54common.c had txhdr->backlog = current_queue->len; This was replaced in txrx.c by txhdr->backlog = priv->tx_stats[queue].len - 1; Was this intentional? To test if this is the problem, I added the following hunk: @@ -840,6 +853,7 @@ int p54_tx_80211(struct ieee80211_hw *de txhdr->crypt_offset = crypt_offset; txhdr->hw_queue = queue; txhdr->backlog = priv->tx_stats[queue].len - 1; + WARN_ON(!priv->tx_stats[queue].len); memset(txhdr->durations, 0, sizeof(txhdr->durations)); txhdr->tx_antenna = ((info->antenna_sel_tx == 0) ? 2 : info->antenna_sel_tx - 1) & priv->tx_diversity_mask; This WARN_ON did trigger just before txq[6].len went negative. I'm now testing with that changed as follows: @@ -839,7 +852,8 @@ int p54_tx_80211(struct ieee80211_hw *de } txhdr->crypt_offset = crypt_offset; txhdr->hw_queue = queue; - txhdr->backlog = priv->tx_stats[queue].len - 1; + txhdr->backlog = priv->tx_stats[queue].len; + WARN_ON(priv->tx_stats[queue].len < 0); memset(txhdr->durations, 0, sizeof(txhdr->durations)); txhdr->tx_antenna = ((info->antenna_sel_tx == 0) ? 2 : info->antenna_sel_tx - 1) & priv->tx_diversity_mask; This WARN_ON did not trigger, but I still had the queue len go negative. One other question: struct p54_burst is defined in lmac.h, but it doesn't seem to be used anywhere. Will it be needed later? Larry -- To unsubscribe from this list: send the line "unsubscribe linux-wireless" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html