[PATCH V2 0/7] brcmfmac: nvram loading and code rework

[PATCH V2 0/7] brcmfmac: nvram loading and code rework

[Arend van Spriel]

This series comprises of following changes:
- support NVRAM loading for bcm47xx platform.
- revise announced interface combinations and validate against it.
- new debugfs entry for msgbuf protocol layer used with PCIe devices.
- couple of PCIe fixes.
- support more firmware events (for bcm4339 firmware).

The series is intended for v4.3 kernel and applies to the master branch
of the wireless-drivers-next repository.

Arend van Spriel (3):
  brcmfmac: correct interface combination info
  brcmfmac: make use of cfg80211_check_combinations()
  brcmfmac: bump highest event number for 4339 firmware

Franky Lin (2):
  brcmfmac: add debugfs entry for msgbuf statistics
  brcmfmac: block the correct flowring when backup queue overflow

Hante Meuleman (2):
  brcmfmac: Add support for host platform NVRAM loading.
  brcmfmac: Increase nr of supported flowrings.

 drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c | 195 ++++++++++++++++-----
 drivers/net/wireless/brcm80211/brcmfmac/firmware.c |  40 +++--
 drivers/net/wireless/brcm80211/brcmfmac/flowring.c |  48 ++---
 drivers/net/wireless/brcm80211/brcmfmac/flowring.h |  20 +--
 drivers/net/wireless/brcm80211/brcmfmac/fweh.h     |  10 +-
 drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c   |  67 ++++++-
 drivers/net/wireless/brcm80211/brcmfmac/msgbuf.h   |   2 +-
 7 files changed, 289 insertions(+), 93 deletions(-)

-- 
1.9.1

[PATCH V2 1/7] brcmfmac: Add support for host platform NVRAM loading.

[Arend van Spriel]

From: Hante Meuleman <meuleman@broadcom.com>

Host platforms such as routers supported by OpenWRT can
support NVRAM reading directly from internal NVRAM store.
With this patch the nvram load routines will fall back to
this method when there is no nvram file and support is
available in the kernel.

Cc: Rafał Miłecki <zajec5@gmail.com>
Reviewed-by: Arend Van Spriel <arend@broadcom.com>
Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
Reviewed-by: Daniel (Deognyoun) Kim <dekim@broadcom.com>
Signed-off-by: Hante Meuleman <meuleman@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
---
V2:
- addressed comments from Rafał.
---
 drivers/net/wireless/brcm80211/brcmfmac/firmware.c | 40 ++++++++++++++--------
 1 file changed, 25 insertions(+), 15 deletions(-)

diff --git a/drivers/net/wireless/brcm80211/brcmfmac/firmware.c b/drivers/net/wireless/brcm80211/brcmfmac/firmware.c
index 743f16b..1296bb1 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/firmware.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/firmware.c
@@ -19,6 +19,7 @@
 #include <linux/device.h>
 #include <linux/firmware.h>
 #include <linux/module.h>
+#include <linux/bcm47xx_nvram.h>
 
 #include "debug.h"
 #include "firmware.h"
@@ -426,19 +427,34 @@ static void brcmf_fw_request_nvram_done(const struct firmware *fw, void *ctx)
 	struct brcmf_fw *fwctx = ctx;
 	u32 nvram_length = 0;
 	void *nvram = NULL;
+	u8 *data = NULL;
+	size_t data_len;
+	bool raw_nvram;
 
 	brcmf_dbg(TRACE, "enter: dev=%s\n", dev_name(fwctx->dev));
-	if (!fw && !(fwctx->flags & BRCMF_FW_REQ_NV_OPTIONAL))
-		goto fail;
+	if ((fw) && (fw->data)) {
+		data = (u8 *)fw->data;
+		data_len = fw->size;
+		raw_nvram = false;
+	} else {
+		data = bcm47xx_nvram_get_contents(&data_len);
+		if (!data && !(fwctx->flags & BRCMF_FW_REQ_NV_OPTIONAL))
+			goto fail;
+		raw_nvram = true;
+	}
 
-	if (fw) {
-		nvram = brcmf_fw_nvram_strip(fw->data, fw->size, &nvram_length,
+	if (data) {
+		nvram = brcmf_fw_nvram_strip(data, data_len, &nvram_length,
 					     fwctx->domain_nr, fwctx->bus_nr);
-		release_firmware(fw);
-		if (!nvram && !(fwctx->flags & BRCMF_FW_REQ_NV_OPTIONAL))
-			goto fail;
+		if (raw_nvram)
+			bcm47xx_nvram_release_contents(data);
 	}
 
+	if (fw)
+		release_firmware(fw);
+	if (!nvram && !(fwctx->flags & BRCMF_FW_REQ_NV_OPTIONAL))
+		goto fail;
+
 	fwctx->done(fwctx->dev, fwctx->code, nvram, nvram_length);
 	kfree(fwctx);
 	return;
@@ -473,15 +489,9 @@ static void brcmf_fw_request_code_done(const struct firmware *fw, void *ctx)
 	if (!ret)
 		return;
 
-	/* when nvram is optional call .done() callback here */
-	if (fwctx->flags & BRCMF_FW_REQ_NV_OPTIONAL) {
-		fwctx->done(fwctx->dev, fw, NULL, 0);
-		kfree(fwctx);
-		return;
-	}
+	brcmf_fw_request_nvram_done(NULL, fwctx);
+	return;
 
-	/* failed nvram request */
-	release_firmware(fw);
 fail:
 	brcmf_dbg(TRACE, "failed: dev=%s\n", dev_name(fwctx->dev));
 	device_release_driver(fwctx->dev);
-- 
1.9.1

Re: [PATCH V2 1/7] brcmfmac: Add support for host platform NVRAM loading.

[Rafał Miłecki]

On 16 August 2015 at 08:55, Arend van Spriel <arend@broadcom.com> wrote:
> From: Hante Meuleman <meuleman@broadcom.com>
>
> Host platforms such as routers supported by OpenWRT can
> support NVRAM reading directly from internal NVRAM store.
> With this patch the nvram load routines will fall back to
> this method when there is no nvram file and support is
> available in the kernel.
>
> Cc: Rafał Miłecki <zajec5@gmail.com>
> Reviewed-by: Arend Van Spriel <arend@broadcom.com>
> Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
> Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
> Reviewed-by: Daniel (Deognyoun) Kim <dekim@broadcom.com>
> Signed-off-by: Hante Meuleman <meuleman@broadcom.com>
> Signed-off-by: Arend van Spriel <arend@broadcom.com>
> ---
> V2:
> - addressed comments from Rafał.

Well, you dropped unneeded change to the brcmf_nvram_handle_value
function, but you ignored the rest of my comments. Take a look at them
again please:
https://patchwork.kernel.org/patch/6767961/

Re: [PATCH V2 1/7] brcmfmac: Add support for host platform NVRAM loading.

[Arend van Spriel]

On 08/19/2015 06:38 PM, Rafał Miłecki wrote:
> On 16 August 2015 at 08:55, Arend van Spriel <arend@broadcom.com> wrote:
>> From: Hante Meuleman <meuleman@broadcom.com>
>>
>> Host platforms such as routers supported by OpenWRT can
>> support NVRAM reading directly from internal NVRAM store.
>> With this patch the nvram load routines will fall back to
>> this method when there is no nvram file and support is
>> available in the kernel.
>>
>> Cc: Rafał Miłecki <zajec5@gmail.com>
>> Reviewed-by: Arend Van Spriel <arend@broadcom.com>
>> Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
>> Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
>> Reviewed-by: Daniel (Deognyoun) Kim <dekim@broadcom.com>
>> Signed-off-by: Hante Meuleman <meuleman@broadcom.com>
>> Signed-off-by: Arend van Spriel <arend@broadcom.com>
>> ---
>> V2:
>> - addressed comments from Rafał.
>
> Well, you dropped unneeded change to the brcmf_nvram_handle_value
> function, but you ignored the rest of my comments. Take a look at them
> again please:
> https://patchwork.kernel.org/patch/6767961/

Kalle,

Can you remove this patch from the series and apply the rest. Just 
verified over here the remaining patches apply cleanly on 
wireless-drivers-next.

Regards,
Arend

Re: [PATCH V2 1/7] brcmfmac: Add support for host platform NVRAM loading.

[Arend van Spriel]

On 08/19/2015 10:55 PM, Arend van Spriel wrote:
> On 08/19/2015 06:38 PM, Rafał Miłecki wrote:
>> On 16 August 2015 at 08:55, Arend van Spriel <arend@broadcom.com> wrote:
>>> From: Hante Meuleman <meuleman@broadcom.com>
>>>
>>> Host platforms such as routers supported by OpenWRT can
>>> support NVRAM reading directly from internal NVRAM store.
>>> With this patch the nvram load routines will fall back to
>>> this method when there is no nvram file and support is
>>> available in the kernel.
>>>
>>> Cc: Rafał Miłecki <zajec5@gmail.com>
>>> Reviewed-by: Arend Van Spriel <arend@broadcom.com>
>>> Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
>>> Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
>>> Reviewed-by: Daniel (Deognyoun) Kim <dekim@broadcom.com>
>>> Signed-off-by: Hante Meuleman <meuleman@broadcom.com>
>>> Signed-off-by: Arend van Spriel <arend@broadcom.com>
>>> ---
>>> V2:
>>> - addressed comments from Rafał.
>>
>> Well, you dropped unneeded change to the brcmf_nvram_handle_value
>> function, but you ignored the rest of my comments. Take a look at them
>> again please:
>> https://patchwork.kernel.org/patch/6767961/
>
> Kalle,
>
> Can you remove this patch from the series and apply the rest. Just
> verified over here the remaining patches apply cleanly on
> wireless-drivers-next.

Hi Kalle,

Just drop this series. I will send a V3 shortly.

Regards,
Arend

Re: [PATCH V2 1/7] brcmfmac: Add support for host platform NVRAM loading.

[Kalle Valo]

Arend van Spriel <arend@broadcom.com> writes:

>> Can you remove this patch from the series and apply the rest. Just
>> verified over here the remaining patches apply cleanly on
>> wireless-drivers-next.
>
> Hi Kalle,
>
> Just drop this series. I will send a V3 shortly.

Ok, v2 dropped.

-- 
Kalle Valo

[PATCH V2 2/7] brcmfmac: correct interface combination info

[Arend van Spriel]

The interface combination provided by brcmfmac did not truly reflect
the combinations supported by driver and/or firmware.

Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
Reviewed-by: Pontus Fuchs <pontusf@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
---
 drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c | 151 +++++++++++++++------
 1 file changed, 112 insertions(+), 39 deletions(-)

diff --git a/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
index ffe5260..17cf1bc 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
@@ -5695,63 +5695,132 @@ brcmf_txrx_stypes[NUM_NL80211_IFTYPES] = {
 	}
 };
 
+/**
+ * brcmf_setup_ifmodes() - determine interface modes and combinations.
+ *
+ * @wiphy: wiphy object.
+ * @ifp: interface object needed for feat module api.
+ *
+ * The interface modes and combinations are determined dynamically here
+ * based on firmware functionality.
+ *
+ * no p2p and no mbss:
+ *
+ *	#STA <= 1, #AP <= 1, channels = 1, 2 total
+ *
+ * no p2p and mbss:
+ *
+ *	#STA <= 1, #AP <= 1, channels = 1, 2 total
+ *	#AP <= 4, matching BI, channels = 1, 4 total
+ *
+ * p2p, no mchan, and mbss:
+ *
+ *	#STA <= 1, #P2P-DEV <= 1, #{P2P-CL, P2P-GO} <= 1, channels = 1, 3 total
+ *	#STA <= 1, #P2P-DEV <= 1, #AP <= 1, #P2P-CL <= 1, channels = 1, 4 total
+ *	#AP <= 4, matching BI, channels = 1, 4 total
+ *
+ * p2p, mchan, and mbss:
+ *
+ *	#STA <= 1, #P2P-DEV <= 1, #{P2P-CL, P2P-GO} <= 1, channels = 2, 3 total
+ *	#STA <= 1, #P2P-DEV <= 1, #AP <= 1, #P2P-CL <= 1, channels = 1, 4 total
+ *	#AP <= 4, matching BI, channels = 1, 4 total
+ */
 static int brcmf_setup_ifmodes(struct wiphy *wiphy, struct brcmf_if *ifp)
 {
 	struct ieee80211_iface_combination *combo = NULL;
-	struct ieee80211_iface_limit *limits = NULL;
-	int i = 0, max_iface_cnt;
+	struct ieee80211_iface_limit *c0_limits = NULL;
+	struct ieee80211_iface_limit *p2p_limits = NULL;
+	struct ieee80211_iface_limit *mbss_limits = NULL;
+	bool mbss, p2p;
+	int i, c, n_combos;
+
+	mbss = brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MBSS);
+	p2p = brcmf_feat_is_enabled(ifp, BRCMF_FEAT_P2P);
 
-	combo = kzalloc(sizeof(*combo), GFP_KERNEL);
+	n_combos = 1 + !!p2p + !!mbss;
+	combo = kcalloc(n_combos, sizeof(*combo), GFP_KERNEL);
 	if (!combo)
 		goto err;
 
-	limits = kzalloc(sizeof(*limits) * 4, GFP_KERNEL);
-	if (!limits)
+	c0_limits = kcalloc(p2p ? 3 : 2, sizeof(*c0_limits), GFP_KERNEL);
+	if (!c0_limits)
 		goto err;
 
+	if (p2p) {
+		p2p_limits = kcalloc(4, sizeof(*p2p_limits), GFP_KERNEL);
+		if (!p2p_limits)
+			goto err;
+	}
+
+	if (mbss) {
+		mbss_limits = kcalloc(1, sizeof(*mbss_limits), GFP_KERNEL);
+		if (!mbss_limits)
+			goto err;
+	}
+
 	wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION) |
 				 BIT(NL80211_IFTYPE_ADHOC) |
 				 BIT(NL80211_IFTYPE_AP);
 
-	if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MCHAN))
-		combo->num_different_channels = 2;
-	else
-		combo->num_different_channels = 1;
-
-	if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MBSS)) {
-		limits[i].max = 1;
-		limits[i++].types = BIT(NL80211_IFTYPE_STATION);
-		limits[i].max = 4;
-		limits[i++].types = BIT(NL80211_IFTYPE_AP);
-		max_iface_cnt = 5;
-	} else {
-		limits[i].max = 2;
-		limits[i++].types = BIT(NL80211_IFTYPE_STATION) |
-				    BIT(NL80211_IFTYPE_AP);
-		max_iface_cnt = 2;
-	}
-
-	if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_P2P)) {
+	c = 0;
+	i = 0;
+	combo[c].num_different_channels = 1;
+	c0_limits[i].max = 1;
+	c0_limits[i++].types = BIT(NL80211_IFTYPE_STATION);
+	if (p2p) {
+		if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MCHAN))
+			combo[c].num_different_channels = 2;
 		wiphy->interface_modes |= BIT(NL80211_IFTYPE_P2P_CLIENT) |
 					  BIT(NL80211_IFTYPE_P2P_GO) |
 					  BIT(NL80211_IFTYPE_P2P_DEVICE);
-		limits[i].max = 1;
-		limits[i++].types = BIT(NL80211_IFTYPE_P2P_CLIENT) |
-				    BIT(NL80211_IFTYPE_P2P_GO);
-		limits[i].max = 1;
-		limits[i++].types = BIT(NL80211_IFTYPE_P2P_DEVICE);
-		max_iface_cnt += 2;
-	}
-	combo->max_interfaces = max_iface_cnt;
-	combo->limits = limits;
-	combo->n_limits = i;
-
+		c0_limits[i].max = 1;
+		c0_limits[i++].types = BIT(NL80211_IFTYPE_P2P_DEVICE);
+		c0_limits[i].max = 1;
+		c0_limits[i++].types = BIT(NL80211_IFTYPE_P2P_CLIENT) |
+				       BIT(NL80211_IFTYPE_P2P_GO);
+	} else {
+		c0_limits[i].max = 1;
+		c0_limits[i++].types = BIT(NL80211_IFTYPE_AP);
+	}
+	combo[c].max_interfaces = i;
+	combo[c].n_limits = i;
+	combo[c].limits = c0_limits;
+
+	if (p2p) {
+		c++;
+		i = 0;
+		combo[c].num_different_channels = 1;
+		p2p_limits[i].max = 1;
+		p2p_limits[i++].types = BIT(NL80211_IFTYPE_STATION);
+		p2p_limits[i].max = 1;
+		p2p_limits[i++].types = BIT(NL80211_IFTYPE_AP);
+		p2p_limits[i].max = 1;
+		p2p_limits[i++].types = BIT(NL80211_IFTYPE_P2P_CLIENT);
+		p2p_limits[i].max = 1;
+		p2p_limits[i++].types = BIT(NL80211_IFTYPE_P2P_DEVICE);
+		combo[c].max_interfaces = i;
+		combo[c].n_limits = i;
+		combo[c].limits = p2p_limits;
+	}
+
+	if (mbss) {
+		c++;
+		combo[c].beacon_int_infra_match = true;
+		combo[c].num_different_channels = 1;
+		mbss_limits[0].max = 4;
+		mbss_limits[0].types = BIT(NL80211_IFTYPE_AP);
+		combo[c].max_interfaces = 4;
+		combo[c].n_limits = 1;
+		combo[c].limits = mbss_limits;
+	}
+	wiphy->n_iface_combinations = n_combos;
 	wiphy->iface_combinations = combo;
-	wiphy->n_iface_combinations = 1;
 	return 0;
 
 err:
-	kfree(limits);
+	kfree(c0_limits);
+	kfree(p2p_limits);
+	kfree(mbss_limits);
 	kfree(combo);
 	return -ENOMEM;
 }
@@ -6073,11 +6142,15 @@ static void brcmf_cfg80211_reg_notifier(struct wiphy *wiphy,
 
 static void brcmf_free_wiphy(struct wiphy *wiphy)
 {
+	int i;
+
 	if (!wiphy)
 		return;
 
-	if (wiphy->iface_combinations)
-		kfree(wiphy->iface_combinations->limits);
+	if (wiphy->iface_combinations) {
+		for (i = 0; i < wiphy->n_iface_combinations; i++)
+			kfree(wiphy->iface_combinations[i].limits);
+	}
 	kfree(wiphy->iface_combinations);
 	if (wiphy->bands[IEEE80211_BAND_2GHZ]) {
 		kfree(wiphy->bands[IEEE80211_BAND_2GHZ]->channels);
-- 
1.9.1

Re: [PATCH V2 2/7] brcmfmac: correct interface combination info

[Rafał Miłecki]

On 16 August 2015 at 08:55, Arend van Spriel <arend@broadcom.com> wrote:
> The interface combination provided by brcmfmac did not truly reflect
> the combinations supported by driver and/or firmware.

This is OK in general but may conflict a bit with my recent:
brcmfmac: set wiphy's addresses to provide valid MACs

My implementation was designed for a one combo only, I'll submit a fix for that.

Re: [PATCH V2 2/7] brcmfmac: correct interface combination info

[Arend van Spriel]

On 08/19/2015 11:49 PM, Rafał Miłecki wrote:
> On 16 August 2015 at 08:55, Arend van Spriel <arend@broadcom.com> wrote:
>> The interface combination provided by brcmfmac did not truly reflect
>> the combinations supported by driver and/or firmware.
>
> This is OK in general but may conflict a bit with my recent:
> brcmfmac: set wiphy's addresses to provide valid MACs

Actually had to dive into firmware and the mask on ea[5] is determined 
by allowed number of AP interfaces by MBSS.

Regards,
Arend

> My implementation was designed for a one combo only, I'll submit a fix for that.
>

[PATCH V2 3/7] brcmfmac: Increase nr of supported flowrings.

[Arend van Spriel]

From: Hante Meuleman <meuleman@broadcom.com>

Next generation devices will have firmware which will have more
than 256 flowrings. This patch increases the maximum number of
supported flowrings to 512.

Reviewed-by: Arend Van Spriel <arend@broadcom.com>
Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
Signed-off-by: Hante Meuleman <meuleman@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
---
 drivers/net/wireless/brcm80211/brcmfmac/flowring.c | 38 ++++++++++++----------
 drivers/net/wireless/brcm80211/brcmfmac/flowring.h | 20 ++++++------
 drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c   | 11 +++++--
 drivers/net/wireless/brcm80211/brcmfmac/msgbuf.h   |  2 +-
 4 files changed, 41 insertions(+), 30 deletions(-)

diff --git a/drivers/net/wireless/brcm80211/brcmfmac/flowring.c b/drivers/net/wireless/brcm80211/brcmfmac/flowring.c
index 5944063..e30f8fa 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/flowring.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/flowring.c
@@ -32,7 +32,7 @@
 #define BRCMF_FLOWRING_LOW		(BRCMF_FLOWRING_HIGH - 256)
 #define BRCMF_FLOWRING_INVALID_IFIDX	0xff
 
-#define BRCMF_FLOWRING_HASH_AP(da, fifo, ifidx) (da[5] + fifo + ifidx * 16)
+#define BRCMF_FLOWRING_HASH_AP(da, fifo, ifidx) (da[5] * 2 + fifo + ifidx * 16)
 #define BRCMF_FLOWRING_HASH_STA(fifo, ifidx) (fifo + ifidx * 16)
 
 static const u8 brcmf_flowring_prio2fifo[] = {
@@ -68,7 +68,7 @@ u32 brcmf_flowring_lookup(struct brcmf_flowring *flow, u8 da[ETH_ALEN],
 			  u8 prio, u8 ifidx)
 {
 	struct brcmf_flowring_hash *hash;
-	u8 hash_idx;
+	u16 hash_idx;
 	u32 i;
 	bool found;
 	bool sta;
@@ -88,6 +88,7 @@ u32 brcmf_flowring_lookup(struct brcmf_flowring *flow, u8 da[ETH_ALEN],
 	}
 	hash_idx =  sta ? BRCMF_FLOWRING_HASH_STA(fifo, ifidx) :
 			  BRCMF_FLOWRING_HASH_AP(mac, fifo, ifidx);
+	hash_idx &= (BRCMF_FLOWRING_HASHSIZE - 1);
 	found = false;
 	hash = flow->hash;
 	for (i = 0; i < BRCMF_FLOWRING_HASHSIZE; i++) {
@@ -98,6 +99,7 @@ u32 brcmf_flowring_lookup(struct brcmf_flowring *flow, u8 da[ETH_ALEN],
 			break;
 		}
 		hash_idx++;
+		hash_idx &= (BRCMF_FLOWRING_HASHSIZE - 1);
 	}
 	if (found)
 		return hash[hash_idx].flowid;
@@ -111,7 +113,7 @@ u32 brcmf_flowring_create(struct brcmf_flowring *flow, u8 da[ETH_ALEN],
 {
 	struct brcmf_flowring_ring *ring;
 	struct brcmf_flowring_hash *hash;
-	u8 hash_idx;
+	u16 hash_idx;
 	u32 i;
 	bool found;
 	u8 fifo;
@@ -131,6 +133,7 @@ u32 brcmf_flowring_create(struct brcmf_flowring *flow, u8 da[ETH_ALEN],
 	}
 	hash_idx =  sta ? BRCMF_FLOWRING_HASH_STA(fifo, ifidx) :
 			  BRCMF_FLOWRING_HASH_AP(mac, fifo, ifidx);
+	hash_idx &= (BRCMF_FLOWRING_HASHSIZE - 1);
 	found = false;
 	hash = flow->hash;
 	for (i = 0; i < BRCMF_FLOWRING_HASHSIZE; i++) {
@@ -140,6 +143,7 @@ u32 brcmf_flowring_create(struct brcmf_flowring *flow, u8 da[ETH_ALEN],
 			break;
 		}
 		hash_idx++;
+		hash_idx &= (BRCMF_FLOWRING_HASHSIZE - 1);
 	}
 	if (found) {
 		for (i = 0; i < flow->nrofrings; i++) {
@@ -169,7 +173,7 @@ u32 brcmf_flowring_create(struct brcmf_flowring *flow, u8 da[ETH_ALEN],
 }
 
 
-u8 brcmf_flowring_tid(struct brcmf_flowring *flow, u8 flowid)
+u8 brcmf_flowring_tid(struct brcmf_flowring *flow, u16 flowid)
 {
 	struct brcmf_flowring_ring *ring;
 
@@ -179,7 +183,7 @@ u8 brcmf_flowring_tid(struct brcmf_flowring *flow, u8 flowid)
 }
 
 
-static void brcmf_flowring_block(struct brcmf_flowring *flow, u8 flowid,
+static void brcmf_flowring_block(struct brcmf_flowring *flow, u16 flowid,
 				 bool blocked)
 {
 	struct brcmf_flowring_ring *ring;
@@ -224,10 +228,10 @@ static void brcmf_flowring_block(struct brcmf_flowring *flow, u8 flowid,
 }
 
 
-void brcmf_flowring_delete(struct brcmf_flowring *flow, u8 flowid)
+void brcmf_flowring_delete(struct brcmf_flowring *flow, u16 flowid)
 {
 	struct brcmf_flowring_ring *ring;
-	u8 hash_idx;
+	u16 hash_idx;
 	struct sk_buff *skb;
 
 	ring = flow->rings[flowid];
@@ -249,7 +253,7 @@ void brcmf_flowring_delete(struct brcmf_flowring *flow, u8 flowid)
 }
 
 
-u32 brcmf_flowring_enqueue(struct brcmf_flowring *flow, u8 flowid,
+u32 brcmf_flowring_enqueue(struct brcmf_flowring *flow, u16 flowid,
 			   struct sk_buff *skb)
 {
 	struct brcmf_flowring_ring *ring;
@@ -275,7 +279,7 @@ u32 brcmf_flowring_enqueue(struct brcmf_flowring *flow, u8 flowid,
 }
 
 
-struct sk_buff *brcmf_flowring_dequeue(struct brcmf_flowring *flow, u8 flowid)
+struct sk_buff *brcmf_flowring_dequeue(struct brcmf_flowring *flow, u16 flowid)
 {
 	struct brcmf_flowring_ring *ring;
 	struct sk_buff *skb;
@@ -296,7 +300,7 @@ struct sk_buff *brcmf_flowring_dequeue(struct brcmf_flowring *flow, u8 flowid)
 }
 
 
-void brcmf_flowring_reinsert(struct brcmf_flowring *flow, u8 flowid,
+void brcmf_flowring_reinsert(struct brcmf_flowring *flow, u16 flowid,
 			     struct sk_buff *skb)
 {
 	struct brcmf_flowring_ring *ring;
@@ -307,7 +311,7 @@ void brcmf_flowring_reinsert(struct brcmf_flowring *flow, u8 flowid,
 }
 
 
-u32 brcmf_flowring_qlen(struct brcmf_flowring *flow, u8 flowid)
+u32 brcmf_flowring_qlen(struct brcmf_flowring *flow, u16 flowid)
 {
 	struct brcmf_flowring_ring *ring;
 
@@ -322,7 +326,7 @@ u32 brcmf_flowring_qlen(struct brcmf_flowring *flow, u8 flowid)
 }
 
 
-void brcmf_flowring_open(struct brcmf_flowring *flow, u8 flowid)
+void brcmf_flowring_open(struct brcmf_flowring *flow, u16 flowid)
 {
 	struct brcmf_flowring_ring *ring;
 
@@ -336,10 +340,10 @@ void brcmf_flowring_open(struct brcmf_flowring *flow, u8 flowid)
 }
 
 
-u8 brcmf_flowring_ifidx_get(struct brcmf_flowring *flow, u8 flowid)
+u8 brcmf_flowring_ifidx_get(struct brcmf_flowring *flow, u16 flowid)
 {
 	struct brcmf_flowring_ring *ring;
-	u8 hash_idx;
+	u16 hash_idx;
 
 	ring = flow->rings[flowid];
 	hash_idx = ring->hash_id;
@@ -380,7 +384,7 @@ void brcmf_flowring_detach(struct brcmf_flowring *flow)
 	struct brcmf_pub *drvr = bus_if->drvr;
 	struct brcmf_flowring_tdls_entry *search;
 	struct brcmf_flowring_tdls_entry *remove;
-	u8 flowid;
+	u16 flowid;
 
 	for (flowid = 0; flowid < flow->nrofrings; flowid++) {
 		if (flow->rings[flowid])
@@ -404,7 +408,7 @@ void brcmf_flowring_configure_addr_mode(struct brcmf_flowring *flow, int ifidx,
 	struct brcmf_bus *bus_if = dev_get_drvdata(flow->dev);
 	struct brcmf_pub *drvr = bus_if->drvr;
 	u32 i;
-	u8 flowid;
+	u16 flowid;
 
 	if (flow->addr_mode[ifidx] != addr_mode) {
 		for (i = 0; i < ARRAY_SIZE(flow->hash); i++) {
@@ -430,7 +434,7 @@ void brcmf_flowring_delete_peer(struct brcmf_flowring *flow, int ifidx,
 	struct brcmf_flowring_tdls_entry *prev;
 	struct brcmf_flowring_tdls_entry *search;
 	u32 i;
-	u8 flowid;
+	u16 flowid;
 	bool sta;
 
 	sta = (flow->addr_mode[ifidx] == ADDR_INDIRECT);
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/flowring.h b/drivers/net/wireless/brcm80211/brcmfmac/flowring.h
index 5551861..3a7d9c2 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/flowring.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/flowring.h
@@ -16,7 +16,7 @@
 #define BRCMFMAC_FLOWRING_H
 
 
-#define BRCMF_FLOWRING_HASHSIZE		256
+#define BRCMF_FLOWRING_HASHSIZE		512		/* has to be 2^x */
 #define BRCMF_FLOWRING_INVALID_ID	0xFFFFFFFF
 
 
@@ -24,7 +24,7 @@ struct brcmf_flowring_hash {
 	u8 mac[ETH_ALEN];
 	u8 fifo;
 	u8 ifidx;
-	u8 flowid;
+	u16 flowid;
 };
 
 enum ring_status {
@@ -61,16 +61,16 @@ u32 brcmf_flowring_lookup(struct brcmf_flowring *flow, u8 da[ETH_ALEN],
 			  u8 prio, u8 ifidx);
 u32 brcmf_flowring_create(struct brcmf_flowring *flow, u8 da[ETH_ALEN],
 			  u8 prio, u8 ifidx);
-void brcmf_flowring_delete(struct brcmf_flowring *flow, u8 flowid);
-void brcmf_flowring_open(struct brcmf_flowring *flow, u8 flowid);
-u8 brcmf_flowring_tid(struct brcmf_flowring *flow, u8 flowid);
-u32 brcmf_flowring_enqueue(struct brcmf_flowring *flow, u8 flowid,
+void brcmf_flowring_delete(struct brcmf_flowring *flow, u16 flowid);
+void brcmf_flowring_open(struct brcmf_flowring *flow, u16 flowid);
+u8 brcmf_flowring_tid(struct brcmf_flowring *flow, u16 flowid);
+u32 brcmf_flowring_enqueue(struct brcmf_flowring *flow, u16 flowid,
 			   struct sk_buff *skb);
-struct sk_buff *brcmf_flowring_dequeue(struct brcmf_flowring *flow, u8 flowid);
-void brcmf_flowring_reinsert(struct brcmf_flowring *flow, u8 flowid,
+struct sk_buff *brcmf_flowring_dequeue(struct brcmf_flowring *flow, u16 flowid);
+void brcmf_flowring_reinsert(struct brcmf_flowring *flow, u16 flowid,
 			     struct sk_buff *skb);
-u32 brcmf_flowring_qlen(struct brcmf_flowring *flow, u8 flowid);
-u8 brcmf_flowring_ifidx_get(struct brcmf_flowring *flow, u8 flowid);
+u32 brcmf_flowring_qlen(struct brcmf_flowring *flow, u16 flowid);
+u8 brcmf_flowring_ifidx_get(struct brcmf_flowring *flow, u16 flowid);
 struct brcmf_flowring *brcmf_flowring_attach(struct device *dev, u16 nrofrings);
 void brcmf_flowring_detach(struct brcmf_flowring *flow);
 void brcmf_flowring_configure_addr_mode(struct brcmf_flowring *flow, int ifidx,
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c b/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c
index 898c380..363a31e 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c
@@ -678,7 +678,7 @@ static u32 brcmf_msgbuf_flowring_create(struct brcmf_msgbuf *msgbuf, int ifidx,
 }
 
 
-static void brcmf_msgbuf_txflow(struct brcmf_msgbuf *msgbuf, u8 flowid)
+static void brcmf_msgbuf_txflow(struct brcmf_msgbuf *msgbuf, u16 flowid)
 {
 	struct brcmf_flowring *flow = msgbuf->flow;
 	struct brcmf_commonring *commonring;
@@ -1318,7 +1318,7 @@ int brcmf_proto_msgbuf_rx_trigger(struct device *dev)
 }
 
 
-void brcmf_msgbuf_delete_flowring(struct brcmf_pub *drvr, u8 flowid)
+void brcmf_msgbuf_delete_flowring(struct brcmf_pub *drvr, u16 flowid)
 {
 	struct brcmf_msgbuf *msgbuf = (struct brcmf_msgbuf *)drvr->proto->pd;
 	struct msgbuf_tx_flowring_delete_req *delete;
@@ -1369,6 +1369,13 @@ int brcmf_proto_msgbuf_attach(struct brcmf_pub *drvr)
 	u32 count;
 
 	if_msgbuf = drvr->bus_if->msgbuf;
+
+	if (if_msgbuf->nrof_flowrings >= BRCMF_FLOWRING_HASHSIZE) {
+		brcmf_err("driver not configured for this many flowrings %d\n",
+			  if_msgbuf->nrof_flowrings);
+		if_msgbuf->nrof_flowrings = BRCMF_FLOWRING_HASHSIZE - 1;
+	}
+
 	msgbuf = kzalloc(sizeof(*msgbuf), GFP_KERNEL);
 	if (!msgbuf)
 		goto fail;
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.h b/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.h
index 3d513e4..ee6906a 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.h
@@ -33,7 +33,7 @@
 
 
 int brcmf_proto_msgbuf_rx_trigger(struct device *dev);
-void brcmf_msgbuf_delete_flowring(struct brcmf_pub *drvr, u8 flowid);
+void brcmf_msgbuf_delete_flowring(struct brcmf_pub *drvr, u16 flowid);
 int brcmf_proto_msgbuf_attach(struct brcmf_pub *drvr);
 void brcmf_proto_msgbuf_detach(struct brcmf_pub *drvr);
 #else
-- 
1.9.1

Re: [PATCH V2 3/7] brcmfmac: Increase nr of supported flowrings.

[Rafał Miłecki]

[-- Attachment #1: Type: text/plain, Size: 749 bytes --]

On 16 August 2015 at 08:55, Arend van Spriel <arend@broadcom.com> wrote:
> From: Hante Meuleman <meuleman@broadcom.com>
>
> Next generation devices will have firmware which will have more
> than 256 flowrings. This patch increases the maximum number of
> supported flowrings to 512.
>
> Reviewed-by: Arend Van Spriel <arend@broadcom.com>
> Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
> Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
> Signed-off-by: Hante Meuleman <meuleman@broadcom.com>
> Signed-off-by: Arend van Spriel <arend@broadcom.com>

This is a patch that for my device triggers:
Unable to handle kernel NULL pointer dereference at virtual address 00000014

It seems to happen even when using only 1 AP interface.

[-- Attachment #2: null-pointer-dereference.txt --]
[-- Type: text/plain, Size: 30139 bytes --]

[   87.010649] ------------[ cut here ]------------
[   87.015303] WARNING: CPU: 1 PID: 1026 at /home/zajec/openwrt/openwrt-arm.git/build_dir/target-arm_cortex-a9_musl-1.1.10_eabi/linux-bcm53xx/compat-wireless-2015-07-21/drivers/net/wireless/brcm80211/brcmfmac/core.c:1144 brcmf_netdev_wait_pend8021x+0xf0/0x100 [brcmfmac])
[   87.039039] Modules linked in: pppoe ppp_async iptable_nat brcmfmac b43 pppox ppp_generic nf_nat_ipv4 nf_conntrack_ipv6 nf_conntrack_ipv4 mac80211 ipt_REJECT ipt_MASQUERADE cfg80211 xt_time xt_tcpudp xt_state xt_nat xt_multiport xt_mark xt_mac xt_limit xt_id xt_conntn
[   87.105219] CPU: 1 PID: 1026 Comm: hostapd Not tainted 3.18.20 #16
[   87.111382] Backtrace: 
[   87.113853] [<c0015490>] (dump_backtrace) from [<c001569c>] (show_stack+0x18/0x1c)
[   87.121395]  r6:bf285f6d r5:00000009 r4:00000000 r3:dc8cb014
[   87.127072] [<c0015684>] (show_stack) from [<c01638d0>] (dump_stack+0x7c/0x98)
[   87.134289] [<c0163854>] (dump_stack) from [<c001fe3c>] (warn_slowpath_common+0x70/0x94)
[   87.142357]  r4:00000000 r3:dc8cb014
[   87.145942] [<c001fdcc>] (warn_slowpath_common) from [<c001ff04>] (warn_slowpath_null+0x24/0x2c)
[   87.154690]  r8:00000000 r7:c68c0000 r6:c721dd24 r5:c721dc80 r4:00000001
[   87.161437] [<c001fee0>] (warn_slowpath_null) from [<bf279958>] (brcmf_netdev_wait_pend8021x+0xf0/0x100 [brcmfmac])
[   87.171858] [<bf279868>] (brcmf_netdev_wait_pend8021x [brcmfmac]) from [<bf26a210>] (brcmf_cfg80211_get_key+0x1dc/0x3e0 [brcmfmac])
[   87.183634]  r6:c6493b88 r5:c03a7008 r4:c721dc80
[   87.188278] [<bf26a170>] (brcmf_cfg80211_get_key [brcmfmac]) from [<bf26a47c>] (brcmf_cfg80211_del_key+0x68/0x98 [brcmfmac])
[   87.199445]  r6:c721dc80 r5:c03a7008 r4:00000000
[   87.204127] [<bf26a414>] (brcmf_cfg80211_del_key [brcmfmac]) from [<bf168360>] (nl80211_del_key+0xe4/0x144 [cfg80211])
[   87.214782]  r6:00000000 r5:c6ab9920 r4:c721d800
[   87.219435] [<bf16827c>] (nl80211_del_key [cfg80211]) from [<c024e550>] (genl_rcv_msg+0x25c/0x2f4)
[   87.228355]  r7:c6af1040 r6:c6ab9914 r5:bf17d134 r4:bf185c78
[   87.234041] [<c024e2f4>] (genl_rcv_msg) from [<c024da20>] (netlink_rcv_skb+0x60/0xb4)
[   87.241841]  r10:c6493dd0 r9:00000000 r8:c6493d0c r7:00000030 r6:c024e2f4 r5:c6af1040
[   87.249669]  r4:c6ab9900
[   87.252209] [<c024d9c0>] (netlink_rcv_skb) from [<c024e2e0>] (genl_rcv+0x28/0x3c)
[   87.259656]  r6:c6921000 r5:c6af1040 r4:c03baf78 r3:00000001
[   87.265333] [<c024e2b8>] (genl_rcv) from [<c024d394>] (netlink_unicast+0x138/0x22c)
[   87.272966]  r5:c6af1040 r4:c79fbc00
[   87.276548] [<c024d25c>] (netlink_unicast) from [<c024d85c>] (netlink_sendmsg+0x32c/0x394)
[   87.284787]  r9:00000030 r8:c6493f5c r7:c6921000 r6:00000000 r5:00000000 r4:c6af1040
[   87.292562] [<c024d530>] (netlink_sendmsg) from [<c0215234>] (sock_sendmsg+0x78/0x8c)
[   87.300352]  r10:c6493e3c r9:c74de340 r8:00000000 r7:c78fd0c0 r6:c6493f5c r5:00000030
[   87.308196]  r4:c74de340
[   87.310739] [<c02151bc>] (sock_sendmsg) from [<c0216a6c>] (___sys_sendmsg.part.30+0x198/0x238)
[   87.319308]  r7:c6493e7c r6:00000000 r5:00000030 r4:c6493f5c
[   87.324986] [<c02168d4>] (___sys_sendmsg.part.30) from [<c0217ba4>] (__sys_sendmsg+0x54/0x78)
[   87.333477]  r10:00000000 r9:c6492000 r8:c0008aa4 r7:00000128 r6:be9a2b90 r5:00000000
[   87.341312]  r4:c74de340
[   87.343846] [<c0217b50>] (__sys_sendmsg) from [<c0217bd8>] (SyS_sendmsg+0x10/0x14)
[   87.351387]  r6:b6fded70 r5:00000000 r4:00000000
[   87.356013] [<c0217bc8>] (SyS_sendmsg) from [<c0008900>] (ret_fast_syscall+0x0/0x38)
[   87.363727] ---[ end trace 1cbe7afa5aa428d1 ]---
[   87.420645] ------------[ cut here ]------------
[   87.425294] WARNING: CPU: 1 PID: 1026 at /home/zajec/openwrt/openwrt-arm.git/build_dir/target-arm_cortex-a9_musl-1.1.10_eabi/linux-bcm53xx/compat-wireless-2015-07-21/drivers/net/wireless/brcm80211/brcmfmac/core.c:1144 brcmf_netdev_wait_pend8021x+0xf0/0x100 [brcmfmac])
[   87.449004] Modules linked in: pppoe ppp_async iptable_nat brcmfmac b43 pppox ppp_generic nf_nat_ipv4 nf_conntrack_ipv6 nf_conntrack_ipv4 mac80211 ipt_REJECT ipt_MASQUERADE cfg80211 xt_time xt_tcpudp xt_state xt_nat xt_multiport xt_mark xt_mac xt_limit xt_id xt_conntn
[   87.515056] CPU: 1 PID: 1026 Comm: hostapd Tainted: G        W      3.18.20 #16
[   87.522342] Backtrace: 
[   87.524809] [<c0015490>] (dump_backtrace) from [<c001569c>] (show_stack+0x18/0x1c)
[   87.532356]  r6:bf285f6d r5:00000009 r4:00000000 r3:dc8cb014
[   87.538033] [<c0015684>] (show_stack) from [<c01638d0>] (dump_stack+0x7c/0x98)
[   87.545247] [<c0163854>] (dump_stack) from [<c001fe3c>] (warn_slowpath_common+0x70/0x94)
[   87.553311]  r4:00000000 r3:dc8cb014
[   87.556895] [<c001fdcc>] (warn_slowpath_common) from [<c001ff04>] (warn_slowpath_null+0x24/0x2c)
[   87.565643]  r8:00000000 r7:c68c0000 r6:c721dd24 r5:c721dc80 r4:00000001
[   87.572391] [<c001fee0>] (warn_slowpath_null) from [<bf279958>] (brcmf_netdev_wait_pend8021x+0xf0/0x100 [brcmfmac])
[   87.582810] [<bf279868>] (brcmf_netdev_wait_pend8021x [brcmfmac]) from [<bf26a210>] (brcmf_cfg80211_get_key+0x1dc/0x3e0 [brcmfmac])
[   87.594587]  r6:c6493b88 r5:c03a7008 r4:c721dc80
[   87.599230] [<bf26a170>] (brcmf_cfg80211_get_key [brcmfmac]) from [<bf26a47c>] (brcmf_cfg80211_del_key+0x68/0x98 [brcmfmac])
[   87.610399]  r6:c721dc80 r5:c03a7008 r4:00000000
[   87.615078] [<bf26a414>] (brcmf_cfg80211_del_key [brcmfmac]) from [<bf168360>] (nl80211_del_key+0xe4/0x144 [cfg80211])
[   87.625728]  r6:00000000 r5:c72c6520 r4:c721d800
[   87.630377] [<bf16827c>] (nl80211_del_key [cfg80211]) from [<c024e550>] (genl_rcv_msg+0x25c/0x2f4)
[   87.639300]  r7:c6af1040 r6:c72c6514 r5:bf17d134 r4:bf185c78
[   87.644984] [<c024e2f4>] (genl_rcv_msg) from [<c024da20>] (netlink_rcv_skb+0x60/0xb4)
[   87.652785]  r10:c6493dd0 r9:00000000 r8:c6493d0c r7:00000030 r6:c024e2f4 r5:c6af1040
[   87.660613]  r4:c72c6500
[   87.663154] [<c024d9c0>] (netlink_rcv_skb) from [<c024e2e0>] (genl_rcv+0x28/0x3c)
[   87.670601]  r6:c6921000 r5:c6af1040 r4:c03baf78 r3:00000001
[   87.676279] [<c024e2b8>] (genl_rcv) from [<c024d394>] (netlink_unicast+0x138/0x22c)
[   87.683911]  r5:c6af1040 r4:c79fbc00
[   87.687502] [<c024d25c>] (netlink_unicast) from [<c024d85c>] (netlink_sendmsg+0x32c/0x394)
[   87.695734]  r9:00000030 r8:c6493f5c r7:c6921000 r6:00000000 r5:00000000 r4:c6af1040
[   87.703502] [<c024d530>] (netlink_sendmsg) from [<c0215234>] (sock_sendmsg+0x78/0x8c)
[   87.711306]  r10:c6493e3c r9:c74de340 r8:00000000 r7:c78fd0c0 r6:c6493f5c r5:00000030
[   87.719140]  r4:c74de340
[   87.721684] [<c02151bc>] (sock_sendmsg) from [<c0216a6c>] (___sys_sendmsg.part.30+0x198/0x238)
[   87.730252]  r7:c6493e7c r6:00000000 r5:00000030 r4:c6493f5c
[   87.735930] [<c02168d4>] (___sys_sendmsg.part.30) from [<c0217ba4>] (__sys_sendmsg+0x54/0x78)
[   87.744422]  r10:00000000 r9:c6492000 r8:c0008aa4 r7:00000128 r6:be9a2bc0 r5:00000000
[   87.752266]  r4:c74de340
[   87.754797] [<c0217b50>] (__sys_sendmsg) from [<c0217bd8>] (SyS_sendmsg+0x10/0x14)
[   87.762341]  r6:b6fded70 r5:00000000 r4:00000000
[   87.766965] [<c0217bc8>] (SyS_sendmsg) from [<c0008900>] (ret_fast_syscall+0x0/0x38)
[   87.774681] ---[ end trace 1cbe7afa5aa428d2 ]---
[   87.830647] ------------[ cut here ]------------
[   87.835295] WARNING: CPU: 1 PID: 1026 at /home/zajec/openwrt/openwrt-arm.git/build_dir/target-arm_cortex-a9_musl-1.1.10_eabi/linux-bcm53xx/compat-wireless-2015-07-21/drivers/net/wireless/brcm80211/brcmfmac/core.c:1144 brcmf_netdev_wait_pend8021x+0xf0/0x100 [brcmfmac])
[   87.859006] Modules linked in: pppoe ppp_async iptable_nat brcmfmac b43 pppox ppp_generic nf_nat_ipv4 nf_conntrack_ipv6 nf_conntrack_ipv4 mac80211 ipt_REJECT ipt_MASQUERADE cfg80211 xt_time xt_tcpudp xt_state xt_nat xt_multiport xt_mark xt_mac xt_limit xt_id xt_conntn
[   87.925067] CPU: 1 PID: 1026 Comm: hostapd Tainted: G        W      3.18.20 #16
[   87.932352] Backtrace: 
[   87.934821] [<c0015490>] (dump_backtrace) from [<c001569c>] (show_stack+0x18/0x1c)
[   87.942366]  r6:bf285f6d r5:00000009 r4:00000000 r3:dc8cb014
[   87.948046] [<c0015684>] (show_stack) from [<c01638d0>] (dump_stack+0x7c/0x98)
[   87.955259] [<c0163854>] (dump_stack) from [<c001fe3c>] (warn_slowpath_common+0x70/0x94)
[   87.963321]  r4:00000000 r3:dc8cb014
[   87.966905] [<c001fdcc>] (warn_slowpath_common) from [<c001ff04>] (warn_slowpath_null+0x24/0x2c)
[   87.975654]  r8:00000000 r7:c68c0000 r6:c721dd24 r5:c721dc80 r4:00000001
[   87.982396] [<c001fee0>] (warn_slowpath_null) from [<bf279958>] (brcmf_netdev_wait_pend8021x+0xf0/0x100 [brcmfmac])
[   87.992815] [<bf279868>] (brcmf_netdev_wait_pend8021x [brcmfmac]) from [<bf26a210>] (brcmf_cfg80211_get_key+0x1dc/0x3e0 [brcmfmac])
[   88.004590]  r6:c6493b88 r5:c03a7008 r4:c721dc80
[   88.009232] [<bf26a170>] (brcmf_cfg80211_get_key [brcmfmac]) from [<bf26a47c>] (brcmf_cfg80211_del_key+0x68/0x98 [brcmfmac])
[   88.020408]  r6:c721dc80 r5:c03a7008 r4:00000000
[   88.025078] [<bf26a414>] (brcmf_cfg80211_del_key [brcmfmac]) from [<bf168360>] (nl80211_del_key+0xe4/0x144 [cfg80211])
[   88.035748]  r6:00000000 r5:c72c6520 r4:c721d800
[   88.040400] [<bf16827c>] (nl80211_del_key [cfg80211]) from [<c024e550>] (genl_rcv_msg+0x25c/0x2f4)
[   88.049322]  r7:c7028dc0 r6:c72c6514 r5:bf17d134 r4:bf185c78
[   88.055004] [<c024e2f4>] (genl_rcv_msg) from [<c024da20>] (netlink_rcv_skb+0x60/0xb4)
[   88.062810]  r10:c6493dd0 r9:00000000 r8:c6493d0c r7:00000030 r6:c024e2f4 r5:c7028dc0
[   88.070659]  r4:c72c6500
[   88.073192] [<c024d9c0>] (netlink_rcv_skb) from [<c024e2e0>] (genl_rcv+0x28/0x3c)
[   88.080646]  r6:c6921000 r5:c7028dc0 r4:c03baf78 r3:00000001
[   88.086315] [<c024e2b8>] (genl_rcv) from [<c024d394>] (netlink_unicast+0x138/0x22c)
[   88.093948]  r5:c7028dc0 r4:c79fbc00
[   88.097531] [<c024d25c>] (netlink_unicast) from [<c024d85c>] (netlink_sendmsg+0x32c/0x394)
[   88.105764]  r9:00000030 r8:c6493f5c r7:c6921000 r6:00000000 r5:00000000 r4:c7028dc0
[   88.113542] [<c024d530>] (netlink_sendmsg) from [<c0215234>] (sock_sendmsg+0x78/0x8c)
[   88.121342]  r10:c6493e3c r9:c74de340 r8:00000000 r7:c78fd0c0 r6:c6493f5c r5:00000030
[   88.129177]  r4:c74de340
[   88.131721] [<c02151bc>] (sock_sendmsg) from [<c0216a6c>] (___sys_sendmsg.part.30+0x198/0x238)
[   88.140289]  r7:c6493e7c r6:00000000 r5:00000030 r4:c6493f5c
[   88.145966] [<c02168d4>] (___sys_sendmsg.part.30) from [<c0217ba4>] (__sys_sendmsg+0x54/0x78)
[   88.154458]  r10:00000000 r9:c6492000 r8:c0008aa4 r7:00000128 r6:be9a1f08 r5:00000000
[   88.162323]  r4:c74de340
[   88.164864] [<c0217b50>] (__sys_sendmsg) from [<c0217bd8>] (SyS_sendmsg+0x10/0x14)
[   88.172410]  r6:b6fdedc0 r5:00000000 r4:00000000
[   88.177047] [<c0217bc8>] (SyS_sendmsg) from [<c0008900>] (ret_fast_syscall+0x0/0x38)
[   88.184765] ---[ end trace 1cbe7afa5aa428d3 ]---
[   88.240646] ------------[ cut here ]------------
[   88.245290] WARNING: CPU: 1 PID: 1026 at /home/zajec/openwrt/openwrt-arm.git/build_dir/target-arm_cortex-a9_musl-1.1.10_eabi/linux-bcm53xx/compat-wireless-2015-07-21/drivers/net/wireless/brcm80211/brcmfmac/core.c:1144 brcmf_netdev_wait_pend8021x+0xf0/0x100 [brcmfmac])
[   88.268999] Modules linked in: pppoe ppp_async iptable_nat brcmfmac b43 pppox ppp_generic nf_nat_ipv4 nf_conntrack_ipv6 nf_conntrack_ipv4 mac80211 ipt_REJECT ipt_MASQUERADE cfg80211 xt_time xt_tcpudp xt_state xt_nat xt_multiport xt_mark xt_mac xt_limit xt_id xt_conntn
[   88.335062] CPU: 1 PID: 1026 Comm: hostapd Tainted: G        W      3.18.20 #16
[   88.342347] Backtrace: 
[   88.344816] [<c0015490>] (dump_backtrace) from [<c001569c>] (show_stack+0x18/0x1c)
[   88.352361]  r6:bf285f6d r5:00000009 r4:00000000 r3:dc8cb014
[   88.358039] [<c0015684>] (show_stack) from [<c01638d0>] (dump_stack+0x7c/0x98)
[   88.365254] [<c0163854>] (dump_stack) from [<c001fe3c>] (warn_slowpath_common+0x70/0x94)
[   88.373316]  r4:00000000 r3:dc8cb014
[   88.376900] [<c001fdcc>] (warn_slowpath_common) from [<c001ff04>] (warn_slowpath_null+0x24/0x2c)
[   88.385648]  r8:00000000 r7:c68c0000 r6:c721dd24 r5:c721dc80 r4:00000001
[   88.392398] [<c001fee0>] (warn_slowpath_null) from [<bf279958>] (brcmf_netdev_wait_pend8021x+0xf0/0x100 [brcmfmac])
[   88.402816] [<bf279868>] (brcmf_netdev_wait_pend8021x [brcmfmac]) from [<bf26a210>] (brcmf_cfg80211_get_key+0x1dc/0x3e0 [brcmfmac])
[   88.414592]  r6:c6493b88 r5:c03a7008 r4:c721dc80
[   88.419227] [<bf26a170>] (brcmf_cfg80211_get_key [brcmfmac]) from [<bf26a47c>] (brcmf_cfg80211_del_key+0x68/0x98 [brcmfmac])
[   88.430395]  r6:c721dc80 r5:c03a7008 r4:00000000
[   88.435076] [<bf26a414>] (brcmf_cfg80211_del_key [brcmfmac]) from [<bf168360>] (nl80211_del_key+0xe4/0x144 [cfg80211])
[   88.445733]  r6:00000000 r5:c6ab9920 r4:c721d800
[   88.450381] [<bf16827c>] (nl80211_del_key [cfg80211]) from [<c024e550>] (genl_rcv_msg+0x25c/0x2f4)
[   88.459308]  r7:c7028dc0 r6:c6ab9914 r5:bf17d134 r4:bf185c78
[   88.464991] [<c024e2f4>] (genl_rcv_msg) from [<c024da20>] (netlink_rcv_skb+0x60/0xb4)
[   88.472790]  r10:c6493dd0 r9:00000000 r8:c6493d0c r7:00000030 r6:c024e2f4 r5:c7028dc0
[   88.480618]  r4:c6ab9900
[   88.483159] [<c024d9c0>] (netlink_rcv_skb) from [<c024e2e0>] (genl_rcv+0x28/0x3c)
[   88.490606]  r6:c6921000 r5:c7028dc0 r4:c03baf78 r3:00000001
[   88.496283] [<c024e2b8>] (genl_rcv) from [<c024d394>] (netlink_unicast+0x138/0x22c)
[   88.503915]  r5:c7028dc0 r4:c79fbc00
[   88.507498] [<c024d25c>] (netlink_unicast) from [<c024d85c>] (netlink_sendmsg+0x32c/0x394)
[   88.515732]  r9:00000030 r8:c6493f5c r7:c6921000 r6:00000000 r5:00000000 r4:c7028dc0
[   88.523500] [<c024d530>] (netlink_sendmsg) from [<c0215234>] (sock_sendmsg+0x78/0x8c)
[   88.531301]  r10:c6493e3c r9:c74de340 r8:00000000 r7:c78fd0c0 r6:c6493f5c r5:00000030
[   88.539128]  r4:c74de340
[   88.541673] [<c02151bc>] (sock_sendmsg) from [<c0216a6c>] (___sys_sendmsg.part.30+0x198/0x238)
[   88.550240]  r7:c6493e7c r6:00000000 r5:00000030 r4:c6493f5c
[   88.555919] [<c02168d4>] (___sys_sendmsg.part.30) from [<c0217ba4>] (__sys_sendmsg+0x54/0x78)
[   88.564410]  r10:00000000 r9:c6492000 r8:c0008aa4 r7:00000128 r6:be9a1ea0 r5:00000000
[   88.572254]  r4:c74de340
[   88.574785] [<c0217b50>] (__sys_sendmsg) from [<c0217bd8>] (SyS_sendmsg+0x10/0x14)
[   88.582320]  r6:b6fdedc0 r5:00000000 r4:00000000
[   88.586944] [<c0217bc8>] (SyS_sendmsg) from [<c0008900>] (ret_fast_syscall+0x0/0x38)
[   88.594661] ---[ end trace 1cbe7afa5aa428d4 ]---
[   91.090649] ------------[ cut here ]------------
[   91.095300] WARNING: CPU: 1 PID: 1026 at /home/zajec/openwrt/openwrt-arm.git/build_dir/target-arm_cortex-a9_musl-1.1.10_eabi/linux-bcm53xx/compat-wireless-2015-07-21/drivers/net/wireless/brcm80211/brcmfmac/core.c:1144 brcmf_netdev_wait_pend8021x+0xf0/0x100 [brcmfmac])
[   91.119011] Modules linked in: pppoe ppp_async iptable_nat brcmfmac b43 pppox ppp_generic nf_nat_ipv4 nf_conntrack_ipv6 nf_conntrack_ipv4 mac80211 ipt_REJECT ipt_MASQUERADE cfg80211 xt_time xt_tcpudp xt_state xt_nat xt_multiport xt_mark xt_mac xt_limit xt_id xt_conntn
[   91.185069] CPU: 1 PID: 1026 Comm: hostapd Tainted: G        W      3.18.20 #16
[   91.192353] Backtrace: 
[   91.194824] [<c0015490>] (dump_backtrace) from [<c001569c>] (show_stack+0x18/0x1c)
[   91.202367]  r6:bf285f6d r5:00000009 r4:00000000 r3:dc8cb014
[   91.208046] [<c0015684>] (show_stack) from [<c01638d0>] (dump_stack+0x7c/0x98)
[   91.215260] [<c0163854>] (dump_stack) from [<c001fe3c>] (warn_slowpath_common+0x70/0x94)
[   91.223324]  r4:00000000 r3:dc8cb014
[   91.226908] [<c001fdcc>] (warn_slowpath_common) from [<c001ff04>] (warn_slowpath_null+0x24/0x2c)
[   91.235656]  r8:00000000 r7:c68c0000 r6:c721dd24 r5:c721dc80 r4:00000001
[   91.242405] [<c001fee0>] (warn_slowpath_null) from [<bf279958>] (brcmf_netdev_wait_pend8021x+0xf0/0x100 [brcmfmac])
[   91.252823] [<bf279868>] (brcmf_netdev_wait_pend8021x [brcmfmac]) from [<bf26a210>] (brcmf_cfg80211_get_key+0x1dc/0x3e0 [brcmfmac])
[   91.264599]  r6:c6493b88 r5:c03a7008 r4:c721dc80
[   91.269244] [<bf26a170>] (brcmf_cfg80211_get_key [brcmfmac]) from [<bf26a47c>] (brcmf_cfg80211_del_key+0x68/0x98 [brcmfmac])
[   91.280412]  r6:c721dc80 r5:c03a7008 r4:00000000
[   91.285092] [<bf26a414>] (brcmf_cfg80211_del_key [brcmfmac]) from [<bf168360>] (nl80211_del_key+0xe4/0x144 [cfg80211])
[   91.295749]  r6:00000000 r5:c6ab9920 r4:c721d800
[   91.300400] [<bf16827c>] (nl80211_del_key [cfg80211]) from [<c024e550>] (genl_rcv_msg+0x25c/0x2f4)
[   91.309321]  r7:c6af1700 r6:c6ab9914 r5:bf17d134 r4:bf185c78
[   91.315006] [<c024e2f4>] (genl_rcv_msg) from [<c024da20>] (netlink_rcv_skb+0x60/0xb4)
[   91.322814]  r10:c6493dd0 r9:00000000 r8:c6493d0c r7:00000030 r6:c024e2f4 r5:c6af1700
[   91.330661]  r4:c6ab9900
[   91.333194] [<c024d9c0>] (netlink_rcv_skb) from [<c024e2e0>] (genl_rcv+0x28/0x3c)
[   91.340649]  r6:c6921000 r5:c6af1700 r4:c03baf78 r3:00000001
[   91.346326] [<c024e2b8>] (genl_rcv) from [<c024d394>] (netlink_unicast+0x138/0x22c)
[   91.353959]  r5:c6af1700 r4:c79fbc00
[   91.357540] [<c024d25c>] (netlink_unicast) from [<c024d85c>] (netlink_sendmsg+0x32c/0x394)
[   91.365774]  r9:00000030 r8:c6493f5c r7:c6921000 r6:00000000 r5:00000000 r4:c6af1700
[   91.373543] [<c024d530>] (netlink_sendmsg) from [<c0215234>] (sock_sendmsg+0x78/0x8c)
[   91.381344]  r10:c6493e3c r9:c74de340 r8:00000000 r7:c78fd0c0 r6:c6493f5c r5:00000030
[   91.389178]  r4:c74de340
[   91.391723] [<c02151bc>] (sock_sendmsg) from [<c0216a6c>] (___sys_sendmsg.part.30+0x198/0x238)
[   91.400291]  r7:c6493e7c r6:00000000 r5:00000030 r4:c6493f5c
[   91.405971] [<c02168d4>] (___sys_sendmsg.part.30) from [<c0217ba4>] (__sys_sendmsg+0x54/0x78)
[   91.414460]  r10:00000000 r9:c6492000 r8:c0008aa4 r7:00000128 r6:be9a1e48 r5:00000000
[   91.422297]  r4:c74de340
[   91.424827] [<c0217b50>] (__sys_sendmsg) from [<c0217bd8>] (SyS_sendmsg+0x10/0x14)
[   91.432371]  r6:b6fdedc0 r5:00000000 r4:00000000
[   91.436996] [<c0217bc8>] (SyS_sendmsg) from [<c0008900>] (ret_fast_syscall+0x0/0x38)
[   91.444712] ---[ end trace 1cbe7afa5aa428d5 ]---
[   91.500647] ------------[ cut here ]------------
[   91.505289] WARNING: CPU: 1 PID: 1026 at /home/zajec/openwrt/openwrt-arm.git/build_dir/target-arm_cortex-a9_musl-1.1.10_eabi/linux-bcm53xx/compat-wireless-2015-07-21/drivers/net/wireless/brcm80211/brcmfmac/core.c:1144 brcmf_netdev_wait_pend8021x+0xf0/0x100 [brcmfmac])
[   91.529009] Modules linked in: pppoe ppp_async iptable_nat brcmfmac b43 pppox ppp_generic nf_nat_ipv4 nf_conntrack_ipv6 nf_conntrack_ipv4 mac80211 ipt_REJECT ipt_MASQUERADE cfg80211 xt_time xt_tcpudp xt_state xt_nat xt_multiport xt_mark xt_mac xt_limit xt_id xt_conntn
[   91.595072] CPU: 1 PID: 1026 Comm: hostapd Tainted: G        W      3.18.20 #16
[   91.602357] Backtrace: 
[   91.604828] [<c0015490>] (dump_backtrace) from [<c001569c>] (show_stack+0x18/0x1c)
[   91.612373]  r6:bf285f6d r5:00000009 r4:00000000 r3:dc8cb014
[   91.618048] [<c0015684>] (show_stack) from [<c01638d0>] (dump_stack+0x7c/0x98)
[   91.625262] [<c0163854>] (dump_stack) from [<c001fe3c>] (warn_slowpath_common+0x70/0x94)
[   91.633325]  r4:00000000 r3:dc8cb014
[   91.636911] [<c001fdcc>] (warn_slowpath_common) from [<c001ff04>] (warn_slowpath_null+0x24/0x2c)
[   91.645657]  r8:00000000 r7:c68c0000 r6:c721dd24 r5:c721dc80 r4:00000001
[   91.652403] [<c001fee0>] (warn_slowpath_null) from [<bf279958>] (brcmf_netdev_wait_pend8021x+0xf0/0x100 [brcmfmac])
[   91.662816] [<bf279868>] (brcmf_netdev_wait_pend8021x [brcmfmac]) from [<bf26a210>] (brcmf_cfg80211_get_key+0x1dc/0x3e0 [brcmfmac])
[   91.674593]  r6:c6493b88 r5:c03a7008 r4:c721dc80
[   91.679228] [<bf26a170>] (brcmf_cfg80211_get_key [brcmfmac]) from [<bf26a47c>] (brcmf_cfg80211_del_key+0x68/0x98 [brcmfmac])
[   91.690396]  r6:c721dc80 r5:c03a7008 r4:00000000
[   91.695079] [<bf26a414>] (brcmf_cfg80211_del_key [brcmfmac]) from [<bf168360>] (nl80211_del_key+0xe4/0x144 [cfg80211])
[   91.705733]  r6:00000000 r5:c72c6520 r4:c721d800
[   91.710384] [<bf16827c>] (nl80211_del_key [cfg80211]) from [<c024e550>] (genl_rcv_msg+0x25c/0x2f4)
[   91.719307]  r7:c6af1700 r6:c72c6514 r5:bf17d134 r4:bf185c78
[   91.724992] [<c024e2f4>] (genl_rcv_msg) from [<c024da20>] (netlink_rcv_skb+0x60/0xb4)
[   91.732791]  r10:c6493dd0 r9:00000000 r8:c6493d0c r7:00000030 r6:c024e2f4 r5:c6af1700
[   91.740619]  r4:c72c6500
[   91.743161] [<c024d9c0>] (netlink_rcv_skb) from [<c024e2e0>] (genl_rcv+0x28/0x3c)
[   91.750608]  r6:c6921000 r5:c6af1700 r4:c03baf78 r3:00000001
[   91.756285] [<c024e2b8>] (genl_rcv) from [<c024d394>] (netlink_unicast+0x138/0x22c)
[   91.763917]  r5:c6af1700 r4:c79fbc00
[   91.767500] [<c024d25c>] (netlink_unicast) from [<c024d85c>] (netlink_sendmsg+0x32c/0x394)
[   91.775733]  r9:00000030 r8:c6493f5c r7:c6921000 r6:00000000 r5:00000000 r4:c6af1700
[   91.783501] [<c024d530>] (netlink_sendmsg) from [<c0215234>] (sock_sendmsg+0x78/0x8c)
[   91.791302]  r10:c6493e3c r9:c74de340 r8:00000000 r7:c78fd0c0 r6:c6493f5c r5:00000030
[   91.799130]  r4:c74de340
[   91.801674] [<c02151bc>] (sock_sendmsg) from [<c0216a6c>] (___sys_sendmsg.part.30+0x198/0x238)
[   91.810241]  r7:c6493e7c r6:00000000 r5:00000030 r4:c6493f5c
[   91.815920] [<c02168d4>] (___sys_sendmsg.part.30) from [<c0217ba4>] (__sys_sendmsg+0x54/0x78)
[   91.824410]  r10:00000000 r9:c6492000 r8:c0008aa4 r7:00000128 r6:be9a1db0 r5:00000000
[   91.832247]  r4:c74de340
[   91.834778] [<c0217b50>] (__sys_sendmsg) from [<c0217bd8>] (SyS_sendmsg+0x10/0x14)
[   91.842320]  r6:b6fdedc0 r5:00000000 r4:00000000
[   91.846945] [<c0217bc8>] (SyS_sendmsg) from [<c0008900>] (ret_fast_syscall+0x0/0x38)
[   91.854661] ---[ end trace 1cbe7afa5aa428d6 ]---
[   91.860425] Unable to handle kernel NULL pointer dereference at virtual address 00000014
[   91.868485] pgd = c68e8000
[   91.871179] [00000014] *pgd=0651f831, *pte=00000000, *ppte=00000000
[   91.877440] Internal error: Oops: 17 [#1] SMP ARM
[   91.882117] Modules linked in: pppoe ppp_async iptable_nat brcmfmac b43 pppox ppp_generic nf_nat_ipv4 nf_conntrack_ipv6 nf_conntrack_ipv4 mac80211 ipt_REJECT ipt_MASQUERADE cfg80211 xt_time xt_tcpudp xt_state xt_nat xt_multiport xt_mark xt_mac xt_limit xt_id xt_conntn
[   91.948099] CPU: 1 PID: 1026 Comm: hostapd Tainted: G        W      3.18.20 #16
[   91.955371] task: c78fd0c0 ti: c6492000 task.ti: c6492000
[   91.960754] PC is at _raw_spin_lock_irqsave+0x1c/0x58
[   91.965791] LR is at skb_queue_tail+0x20/0x50
[   91.970129] pc : [<c0011228>]    lr : [<c021dbe8>]    psr: 00000093
[   91.970129] sp : c6493bf8  ip : c6493c08  fp : c6493c04
[   91.981547] r10: 00000000  r9 : c72c2000  r8 : 00000000
[   91.986749] r7 : c6af1400  r6 : 00000014  r5 : c6af1400  r4 : 00000008
[   91.993247] r3 : 00000014  r2 : c6af1400  r1 : c6af1400  r0 : 00000013
[   91.999746] Flags: nzcv  IRQs off  FIQs on  Mode SVC_32  ISA ARM  Segment user
[   92.006933] Control: 10c5387d  Table: 068e804a  DAC: 00000015
[   92.012652] Process hostapd (pid: 1026, stack limit = 0xc64921b8)
[   92.018718] Stack: (0xc6493bf8 to 0xc6494000)
[   92.023057] 3be0:                                                       c6493c24 c6493c08
[   92.031199] 3c00: c021dbe8 c0011218 c734c400 00000000 00000006 c72c2000 c6493c44 c6493c28
[   92.039338] 3c20: bf27bf0c c021dbd4 c6af1400 c7211a00 00000006 c6af1400 c6493c7c c6493c48
[   92.047476] 3c40: bf27cefc bf27beec c6493c6c 00000000 c024d21c c6af1400 c7370000 c7380000
[   92.055615] 3c60: c721dc80 00000000 c6b0b402 c721d800 c6493ca4 c6493c80 bf2751e8 bf27cdf8
[   92.063755] 3c80: c721d800 c7380000 c6af1400 c6af1400 c6b0b402 c71a2c00 c6493ccc c6493ca8
[   92.071893] 3ca0: bf278af8 bf275178 bf278988 00000001 c6af1400 c72c7200 c71a2c00 00000000
[   92.080032] 3cc0: c6493d1c c6493cd0 c022cf54 bf278994 000004d0 c6493d24 00000000 00000000
[   92.088170] 3ce0: 00000000 00000000 c6af1400 c721d800 c6493d1c 00000001 c6af1400 c72c7200
[   92.096310] 3d00: c71a2c00 c6af1400 c721d800 c72c7268 c6493d54 c6493d20 c0244f14 c022cd10
[   92.104449] 3d20: c6492000 00000010 00000063 c72c7200 c6af1400 c721d800 c71a2c00 00000000
[   92.112587] 3d40: 00000000 c72c7268 c6493d94 c6493d58 c022d250 c0244e6c c72c7268 00000001
[   92.120726] 3d60: 00000000 fffffff4 00000001 c7111c00 c6af1400 c721d800 00000063 00000000
[   92.128866] 3d80: c6b0b540 00000002 c6493da4 c6493d98 c022d508 c022cff8 c6493e2c c6493da8
[   92.137004] 3da0: c02a55b8 c022d500 00000000 00000000 c6493dcc 0000000e 00000013 c6493f00
[   92.145142] 3dc0: c7518940 00000000 00008e88 00000010 00000000 00000000 00000400 00000000
[   92.153281] 3de0: 00000000 00000000 c01b0000 00000000 00000000 00000000 00000000 00000000
[   92.161421] 3e00: 00000000 c7518940 00000063 c6493ed8 c78fd0c0 c03a7008 00000000 c6493ef4
[   92.169559] 3e20: c6493ec4 c6493e30 c0215234 c02a49f4 00000000 00000000 00000000 c6493e68
[   92.177697] 3e40: c78fd0c0 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[   92.185837] 3e60: 00000000 00000000 c01b1a50 c01693e4 00003e84 00000063 c7518940 00000001
[   92.193976] 3e80: 00000000 c6493ed8 000ce598 00000000 c6493eac 00000063 00000014 be9a1d70
[   92.202115] 3ea0: c03a7008 c6493ef4 c7518940 00000063 00000014 be9a1d70 c6493fa4 c6493ec8
[   92.210253] 3ec0: c0217808 c02151c8 00000000 00000000 000ce500 00000063 c6493ef4 00000014
[   92.218393] 3ee0: c6493ed0 00000001 00000000 00000000 00000000 8e880011 00000005 06000000
[   92.226532] 3f00: 9bf0d678 0000bcba c6493f24 c6493f18 c00c3e8c c00c3cb0 c6493f5c c6493f28
[   92.234671] 3f20: c00a99e8 c00c3e6c 00000020 00000000 c6493f54 c78fd0c0 00000000 c03be4e4
[   92.242809] 3f40: 00000006 c0008aa4 c6492000 00000000 c6493f6c c6493f60 c00a9a60 c00a9854
[   92.250949] 3f60: c6493f8c c6493f70 c0034b24 c000e3ec c6926e80 dc8cb014 c6493fb0 be9a1d70
[   92.259087] 3f80: 00000014 00000000 00000122 c0008aa4 c6492000 00000000 00000000 c6493fa8
[   92.267226] 3fa0: c0008900 c0217744 be9a1d70 00000014 00000008 000ce500 00000063 00000000
[   92.275365] 3fc0: be9a1d70 00000014 00000000 00000122 00000063 00000000 000ce44c 00094ea0
[   92.283504] 3fe0: be9a1d10 be9a1cfc b6fb7e10 b6fbad88 60000010 00000008 ffffffff ffffffff
[   92.291635] Backtrace: 
[   92.294088] [<c001120c>] (_raw_spin_lock_irqsave) from [<c021dbe8>] (skb_queue_tail+0x20/0x50)
[   92.302686] [<c021dbc8>] (skb_queue_tail) from [<bf27bf0c>] (brcmf_flowring_enqueue+0x2c/0x78 [brcmfmac])
[   92.312208]  r6:c72c2000 r5:00000006 r4:00000000 r3:c734c400
[   92.317892] [<bf27bee0>] (brcmf_flowring_enqueue [brcmfmac]) from [<bf27cefc>] (brcmf_msgbuf_txdata+0x110/0x1c0 [brcmfmac])
[   92.328970]  r7:c6af1400 r6:00000006 r5:c7211a00 r4:c6af1400
[   92.334653] [<bf27cdec>] (brcmf_msgbuf_txdata [brcmfmac]) from [<bf2751e8>] (brcmf_fws_process_skb+0x7c/0x2dc [brcmfmac])
[   92.345549]  r10:c721d800 r9:c6b0b402 r8:00000000 r7:c721dc80 r6:c7380000 r5:c7370000
[   92.353376]  r4:c6af1400
[   92.355924] [<bf27516c>] (brcmf_fws_process_skb [brcmfmac]) from [<bf278af8>] (brcmf_netdev_start_xmit+0x170/0x1d8 [brcmfmac])
[   92.367253]  r9:c71a2c00 r8:c6b0b402 r7:c6af1400 r6:c6af1400 r5:c7380000 r4:c721d800
[   92.375023] [<bf278988>] (brcmf_netdev_start_xmit [brcmfmac]) from [<c022cf54>] (dev_hard_start_xmit+0x250/0x2e8)
[   92.385232]  r8:00000000 r7:c71a2c00 r6:c72c7200 r5:c6af1400 r4:00000001 r3:bf278988
[   92.392994] [<c022cd04>] (dev_hard_start_xmit) from [<c0244f14>] (sch_direct_xmit+0xb4/0x1ec)
[   92.401476]  r10:c72c7268 r9:c721d800 r8:c6af1400 r7:c71a2c00 r6:c72c7200 r5:c6af1400
[   92.409304]  r4:00000001
[   92.411838] [<c0244e60>] (sch_direct_xmit) from [<c022d250>] (__dev_queue_xmit+0x264/0x508)
[   92.420146]  r10:c72c7268 r9:00000000 r8:00000000 r7:c71a2c00 r6:c721d800 r5:c6af1400
[   92.427975]  r4:c72c7200
[   92.430508] [<c022cfec>] (__dev_queue_xmit) from [<c022d508>] (dev_queue_xmit+0x14/0x18)
[   92.438559]  r10:00000002 r9:c6b0b540 r8:00000000 r7:00000063 r6:c721d800 r5:c6af1400
[   92.446386]  r4:c7111c00
[   92.448930] [<c022d4f4>] (dev_queue_xmit) from [<c02a55b8>] (packet_sendmsg+0xbd0/0xcac)
[   92.456996] [<c02a49e8>] (packet_sendmsg) from [<c0215234>] (sock_sendmsg+0x78/0x8c)
[   92.464695]  r10:c6493ef4 r9:00000000 r8:c03a7008 r7:c78fd0c0 r6:c6493ed8 r5:00000063
[   92.472522]  r4:c7518940
[   92.475057] [<c02151bc>] (sock_sendmsg) from [<c0217808>] (SyS_sendto+0xd0/0x10c)
[   92.482502]  r7:be9a1d70 r6:00000014 r5:00000063 r4:c7518940
[   92.488171] [<c0217738>] (SyS_sendto) from [<c0008900>] (ret_fast_syscall+0x0/0x38)
[   92.495790]  r10:00000000 r9:c6492000 r8:c0008aa4 r7:00000122 r6:00000000 r5:00000014
[   92.503618]  r4:be9a1d70
[   92.506147] Code: e1a03000 e10f0000 f10c0080 f593f000 (e1931f9f) 
[   92.512212] ---[ end trace 1cbe7afa5aa428d7 ]---
[   92.516806] Kernel panic - not syncing: Fatal exception in interrupt
[   92.523136] CPU0: stopping
[   92.525841] CPU: 0 PID: 0 Comm: swapper/0 Tainted: G      D W      3.18.20 #16
[   92.533030] Backtrace: 
[   92.535488] [<c0015490>] (dump_backtrace) from [<c001569c>] (show_stack+0x18/0x1c)
[   92.543018]  r6:c03a2894 r5:00000000 r4:00000000 r3:dc8cb014
[   92.548688] [<c0015684>] (show_stack) from [<c01638d0>] (dump_stack+0x7c/0x98)
[   92.555881] [<c0163854>] (dump_stack) from [<c00172e0>] (handle_IPI+0xcc/0x168)
[   92.563156]  r4:00000000 r3:00000000
[   92.566732] [<c0017214>] (handle_IPI) from [<c000869c>] (gic_handle_irq+0x5c/0x64)
[   92.574258]  r6:c03a7480 r5:c03a5f38 r4:c8802100 r3:00000405
[   92.579926] [<c0008640>] (gic_handle_irq) from [<c0009220>] (__irq_svc+0x40/0x54)
[   92.587368] Exception stack(0xc03a5f38 to 0xc03a5f80)
[   92.592397] 5f20:                                                       c6dd41f8 00000000
[   92.600541] 5f40: 00ef1874 c0009d40 c03a4010 c03a4000 c03a4000 c03bd794 c039b9c8 c7ffc700
[   92.608680] 5f60: c03bd790 c03a5f8c c03a5f90 c03a5f80 c00131ac c00131b0 60000013 ffffffff
[   92.616811]  r6:ffffffff r5:60000013 r4:c00131b0 r3:c00131ac
[   92.622481] [<c001317c>] (arch_cpu_idle) from [<c004860c>] (cpu_startup_entry+0xf0/0x14c)
[   92.630632] [<c004851c>] (cpu_startup_entry) from [<c000ca90>] (rest_init+0x68/0x80)
[   92.638350] [<c000ca28>] (rest_init) from [<c0379cc8>] (start_kernel+0x388/0x408)
[   92.645818] [<c0379940>] (start_kernel) from [<00008074>] (0x8074)
[   92.651972] Rebooting in 3 seconds..

Re: [PATCH V2 3/7] brcmfmac: Increase nr of supported flowrings.

[Arend van Spriel]

On 08/19/2015 11:56 PM, Rafał Miłecki wrote:
> On 16 August 2015 at 08:55, Arend van Spriel <arend@broadcom.com> wrote:
>> From: Hante Meuleman <meuleman@broadcom.com>
>>
>> Next generation devices will have firmware which will have more
>> than 256 flowrings. This patch increases the maximum number of
>> supported flowrings to 512.
>>
>> Reviewed-by: Arend Van Spriel <arend@broadcom.com>
>> Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
>> Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
>> Signed-off-by: Hante Meuleman <meuleman@broadcom.com>
>> Signed-off-by: Arend van Spriel <arend@broadcom.com>
>
> This is a patch that for my device triggers:
> Unable to handle kernel NULL pointer dereference at virtual address 00000014
>
> It seems to happen even when using only 1 AP interface.

Hi Rafał,

What happens is that your platform has no memory to allocate a flowring 
for tx and there is a bug in handling the returned error. Can you try it 
with following applied. You will still have memory issue so for OpenWrt 
you may need to limit to 256 anyway. Hante found another issue with 
hash_id in struct brcmf_flowring so we are not entirely sure which issue 
caused the null pointer deref so your feedback is appreciated.

Regards,
Arend
---
  drivers/net/wireless/brcm80211/brcmfmac/flowring.c | 4 ++--
  1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/brcm80211/brcmfmac/flowring.c 
b/drivers/net/wi
index 5b7a8ee..9fb50b3 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/flowring.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/flowring.c
@@ -151,11 +151,11 @@ u32 brcmf_flowring_create(struct brcmf_flowring 
*flow, u8
                                 break;
                 }
                 if (i == flow->nrofrings)
-                       return -ENOMEM;
+                       return BRCMF_FLOWRING_INVALID_ID;

                 ring = kzalloc(sizeof(*ring), GFP_ATOMIC);
                 if (!ring)
-                       return -ENOMEM;
+                       return BRCMF_FLOWRING_INVALID_ID;

                 memcpy(hash[hash_idx].mac, mac, ETH_ALEN);
                 hash[hash_idx].fifo = fifo;
-- 
1.9.1

Re: [PATCH V2 3/7] brcmfmac: Increase nr of supported flowrings.

[Rafał Miłecki]

[-- Attachment #1: Type: text/plain, Size: 2694 bytes --]

On 24 August 2015 at 16:15, Arend van Spriel <arend@broadcom.com> wrote:
> On 08/19/2015 11:56 PM, Rafał Miłecki wrote:
>>
>> On 16 August 2015 at 08:55, Arend van Spriel <arend@broadcom.com> wrote:
>>>
>>> From: Hante Meuleman <meuleman@broadcom.com>
>>>
>>> Next generation devices will have firmware which will have more
>>> than 256 flowrings. This patch increases the maximum number of
>>> supported flowrings to 512.
>>>
>>> Reviewed-by: Arend Van Spriel <arend@broadcom.com>
>>> Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
>>> Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
>>> Signed-off-by: Hante Meuleman <meuleman@broadcom.com>
>>> Signed-off-by: Arend van Spriel <arend@broadcom.com>
>>
>>
>> This is a patch that for my device triggers:
>> Unable to handle kernel NULL pointer dereference at virtual address
>> 00000014
>>
>> It seems to happen even when using only 1 AP interface.
>
>
> Hi Rafał,
>
> What happens is that your platform has no memory to allocate a flowring for
> tx and there is a bug in handling the returned error. Can you try it with
> following applied. You will still have memory issue so for OpenWrt you may
> need to limit to 256 anyway. Hante found another issue with hash_id in
> struct brcmf_flowring so we are not entirely sure which issue caused the
> null pointer deref so your feedback is appreciated.
>
> Regards,
> Arend
> ---
>  drivers/net/wireless/brcm80211/brcmfmac/flowring.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/net/wireless/brcm80211/brcmfmac/flowring.c
> b/drivers/net/wi
> index 5b7a8ee..9fb50b3 100644
> --- a/drivers/net/wireless/brcm80211/brcmfmac/flowring.c
> +++ b/drivers/net/wireless/brcm80211/brcmfmac/flowring.c
> @@ -151,11 +151,11 @@ u32 brcmf_flowring_create(struct brcmf_flowring *flow,
> u8
>                                 break;
>                 }
>                 if (i == flow->nrofrings)
> -                       return -ENOMEM;
> +                       return BRCMF_FLOWRING_INVALID_ID;
>
>                 ring = kzalloc(sizeof(*ring), GFP_ATOMIC);
>                 if (!ring)
> -                       return -ENOMEM;
> +                       return BRCMF_FLOWRING_INVALID_ID;
>
>                 memcpy(hash[hash_idx].mac, mac, ETH_ALEN);
>                 hash[hash_idx].fifo = fifo;

Unfortunately this patch didn't help. I tied it on top of V3 of your
last series plus "brcmfmac: Increase nr of supported flowrings.".

I tried it 3 times, once I even got early NULL pointer dereference,
when starting AP interface (before any STA connecting to it).

-- 
Rafał

[-- Attachment #2: null-pointer-dereference.txt --]
[-- Type: text/plain, Size: 30139 bytes --]

[   49.230694] ------------[ cut here ]------------
[   49.235351] WARNING: CPU: 1 PID: 1025 at /home/zajec/openwrt/openwrt-arm.git/build_dir/target-arm_cortex-a9_musl-1.1.10_eabi/linux-bcm53xx/compat-wireless-2015-07-21/drivers/net/wireless/brcm80211/brcmfmac/core.c:1144 brcmf_netdev_wait_pend8021x+0xf0/0x100 [brcmfmac])
[   49.259060] Modules linked in: pppoe ppp_async iptable_nat brcmfmac b43 pppox ppp_generic nf_nat_ipv4 nf_conntrack_ipv6 nf_conntrack_ipv4 mac80211 ipt_REJECT ipt_MASQUERADE cfg80211 xt_time xt_tcpudp xt_state xt_nat xt_multiport xt_mark xt_mac xt_limit xt_id xt_conntn
[   49.325109] CPU: 1 PID: 1025 Comm: hostapd Not tainted 3.18.20 #20
[   49.331273] Backtrace: 
[   49.333744] [<c0015490>] (dump_backtrace) from [<c001569c>] (show_stack+0x18/0x1c)
[   49.341286]  r6:bf2860ce r5:00000009 r4:00000000 r3:dc8cb014
[   49.346965] [<c0015684>] (show_stack) from [<c01638d0>] (dump_stack+0x7c/0x98)
[   49.354178] [<c0163854>] (dump_stack) from [<c001fe3c>] (warn_slowpath_common+0x70/0x94)
[   49.362241]  r4:00000000 r3:dc8cb014
[   49.365826] [<c001fdcc>] (warn_slowpath_common) from [<c001ff04>] (warn_slowpath_null+0x24/0x2c)
[   49.374572]  r8:00000000 r7:c68e0000 r6:c7028524 r5:c7028480 r4:00000001
[   49.381316] [<c001fee0>] (warn_slowpath_null) from [<bf279ab0>] (brcmf_netdev_wait_pend8021x+0xf0/0x100 [brcmfmac])
[   49.391732] [<bf2799c0>] (brcmf_netdev_wait_pend8021x [brcmfmac]) from [<bf26a2c0>] (brcmf_cfg80211_get_key+0x1dc/0x3e0 [brcmfmac])
[   49.403509]  r6:c644bb88 r5:c03a7008 r4:c7028480
[   49.408152] [<bf26a220>] (brcmf_cfg80211_get_key [brcmfmac]) from [<bf26a52c>] (brcmf_cfg80211_del_key+0x68/0x98 [brcmfmac])
[   49.419320]  r6:c7028480 r5:c03a7008 r4:00000000
[   49.423994] [<bf26a4c4>] (brcmf_cfg80211_del_key [brcmfmac]) from [<bf168360>] (nl80211_del_key+0xe4/0x144 [cfg80211])
[   49.434647]  r6:00000000 r5:c708e620 r4:c7028000
[   49.439290] [<bf16827c>] (nl80211_del_key [cfg80211]) from [<c024e550>] (genl_rcv_msg+0x25c/0x2f4)
[   49.448211]  r7:c68d8d00 r6:c708e614 r5:bf17d134 r4:bf185c78
[   49.453889] [<c024e2f4>] (genl_rcv_msg) from [<c024da20>] (netlink_rcv_skb+0x60/0xb4)
[   49.461689]  r10:c644bdd0 r9:00000000 r8:c644bd0c r7:00000030 r6:c024e2f4 r5:c68d8d00
[   49.469518]  r4:c708e600
[   49.472059] [<c024d9c0>] (netlink_rcv_skb) from [<c024e2e0>] (genl_rcv+0x28/0x3c)
[   49.479506]  r6:c70e4000 r5:c68d8d00 r4:c03baf78 r3:00000001
[   49.485184] [<c024e2b8>] (genl_rcv) from [<c024d394>] (netlink_unicast+0x138/0x22c)
[   49.492816]  r5:c68d8d00 r4:c79fdc00
[   49.496398] [<c024d25c>] (netlink_unicast) from [<c024d85c>] (netlink_sendmsg+0x32c/0x394)
[   49.504630]  r9:00000030 r8:c644bf5c r7:c70e4000 r6:00000000 r5:00000000 r4:c68d8d00
[   49.512402] [<c024d530>] (netlink_sendmsg) from [<c0215234>] (sock_sendmsg+0x78/0x8c)
[   49.520192]  r10:c644be3c r9:c7517dc0 r8:00000000 r7:c79ba040 r6:c644bf5c r5:00000030
[   49.528028]  r4:c7517dc0
[   49.530562] [<c02151bc>] (sock_sendmsg) from [<c0216a6c>] (___sys_sendmsg.part.30+0x198/0x238)
[   49.539139]  r7:c644be7c r6:00000000 r5:00000030 r4:c644bf5c
[   49.544817] [<c02168d4>] (___sys_sendmsg.part.30) from [<c0217ba4>] (__sys_sendmsg+0x54/0x78)
[   49.553307]  r10:00000000 r9:c644a000 r8:c0008aa4 r7:00000128 r6:bed1cb90 r5:00000000
[   49.561143]  r4:c7517dc0
[   49.563677] [<c0217b50>] (__sys_sendmsg) from [<c0217bd8>] (SyS_sendmsg+0x10/0x14)
[   49.571218]  r6:b6f99d70 r5:00000000 r4:00000000
[   49.575843] [<c0217bc8>] (SyS_sendmsg) from [<c0008900>] (ret_fast_syscall+0x0/0x38)
[   49.583559] ---[ end trace 1ca11846ccbbf31d ]---
[   49.640690] ------------[ cut here ]------------
[   49.645329] WARNING: CPU: 1 PID: 1025 at /home/zajec/openwrt/openwrt-arm.git/build_dir/target-arm_cortex-a9_musl-1.1.10_eabi/linux-bcm53xx/compat-wireless-2015-07-21/drivers/net/wireless/brcm80211/brcmfmac/core.c:1144 brcmf_netdev_wait_pend8021x+0xf0/0x100 [brcmfmac])
[   49.669031] Modules linked in: pppoe ppp_async iptable_nat brcmfmac b43 pppox ppp_generic nf_nat_ipv4 nf_conntrack_ipv6 nf_conntrack_ipv4 mac80211 ipt_REJECT ipt_MASQUERADE cfg80211 xt_time xt_tcpudp xt_state xt_nat xt_multiport xt_mark xt_mac xt_limit xt_id xt_conntn
[   49.735076] CPU: 1 PID: 1025 Comm: hostapd Tainted: G        W      3.18.20 #20
[   49.742362] Backtrace: 
[   49.744830] [<c0015490>] (dump_backtrace) from [<c001569c>] (show_stack+0x18/0x1c)
[   49.752367]  r6:bf2860ce r5:00000009 r4:00000000 r3:dc8cb014
[   49.758047] [<c0015684>] (show_stack) from [<c01638d0>] (dump_stack+0x7c/0x98)
[   49.765260] [<c0163854>] (dump_stack) from [<c001fe3c>] (warn_slowpath_common+0x70/0x94)
[   49.773322]  r4:00000000 r3:dc8cb014
[   49.776907] [<c001fdcc>] (warn_slowpath_common) from [<c001ff04>] (warn_slowpath_null+0x24/0x2c)
[   49.785656]  r8:00000000 r7:c68e0000 r6:c7028524 r5:c7028480 r4:00000001
[   49.792404] [<c001fee0>] (warn_slowpath_null) from [<bf279ab0>] (brcmf_netdev_wait_pend8021x+0xf0/0x100 [brcmfmac])
[   49.802823] [<bf2799c0>] (brcmf_netdev_wait_pend8021x [brcmfmac]) from [<bf26a2c0>] (brcmf_cfg80211_get_key+0x1dc/0x3e0 [brcmfmac])
[   49.814600]  r6:c644bb88 r5:c03a7008 r4:c7028480
[   49.819243] [<bf26a220>] (brcmf_cfg80211_get_key [brcmfmac]) from [<bf26a52c>] (brcmf_cfg80211_del_key+0x68/0x98 [brcmfmac])
[   49.830412]  r6:c7028480 r5:c03a7008 r4:00000000
[   49.835088] [<bf26a4c4>] (brcmf_cfg80211_del_key [brcmfmac]) from [<bf168360>] (nl80211_del_key+0xe4/0x144 [cfg80211])
[   49.845739]  r6:00000000 r5:c708e520 r4:c7028000
[   49.850387] [<bf16827c>] (nl80211_del_key [cfg80211]) from [<c024e550>] (genl_rcv_msg+0x25c/0x2f4)
[   49.859313]  r7:c68d8d00 r6:c708e514 r5:bf17d134 r4:bf185c78
[   49.864998] [<c024e2f4>] (genl_rcv_msg) from [<c024da20>] (netlink_rcv_skb+0x60/0xb4)
[   49.872798]  r10:c644bdd0 r9:00000000 r8:c644bd0c r7:00000030 r6:c024e2f4 r5:c68d8d00
[   49.880626]  r4:c708e500
[   49.883167] [<c024d9c0>] (netlink_rcv_skb) from [<c024e2e0>] (genl_rcv+0x28/0x3c)
[   49.890614]  r6:c70e4000 r5:c68d8d00 r4:c03baf78 r3:00000001
[   49.896291] [<c024e2b8>] (genl_rcv) from [<c024d394>] (netlink_unicast+0x138/0x22c)
[   49.903935]  r5:c68d8d00 r4:c79fdc00
[   49.907528] [<c024d25c>] (netlink_unicast) from [<c024d85c>] (netlink_sendmsg+0x32c/0x394)
[   49.915765]  r9:00000030 r8:c644bf5c r7:c70e4000 r6:00000000 r5:00000000 r4:c68d8d00
[   49.923544] [<c024d530>] (netlink_sendmsg) from [<c0215234>] (sock_sendmsg+0x78/0x8c)
[   49.931343]  r10:c644be3c r9:c7517dc0 r8:00000000 r7:c79ba040 r6:c644bf5c r5:00000030
[   49.939180]  r4:c7517dc0
[   49.941733] [<c02151bc>] (sock_sendmsg) from [<c0216a6c>] (___sys_sendmsg.part.30+0x198/0x238)
[   49.950299]  r7:c644be7c r6:00000000 r5:00000030 r4:c644bf5c
[   49.955977] [<c02168d4>] (___sys_sendmsg.part.30) from [<c0217ba4>] (__sys_sendmsg+0x54/0x78)
[   49.964469]  r10:00000000 r9:c644a000 r8:c0008aa4 r7:00000128 r6:bed1cbc0 r5:00000000
[   49.972305]  r4:c7517dc0
[   49.974836] [<c0217b50>] (__sys_sendmsg) from [<c0217bd8>] (SyS_sendmsg+0x10/0x14)
[   49.982381]  r6:b6f99d70 r5:00000000 r4:00000000
[   49.987012] [<c0217bc8>] (SyS_sendmsg) from [<c0008900>] (ret_fast_syscall+0x0/0x38)
[   49.994730] ---[ end trace 1ca11846ccbbf31e ]---
[   50.050697] ------------[ cut here ]------------
[   50.055347] WARNING: CPU: 1 PID: 1025 at /home/zajec/openwrt/openwrt-arm.git/build_dir/target-arm_cortex-a9_musl-1.1.10_eabi/linux-bcm53xx/compat-wireless-2015-07-21/drivers/net/wireless/brcm80211/brcmfmac/core.c:1144 brcmf_netdev_wait_pend8021x+0xf0/0x100 [brcmfmac])
[   50.079057] Modules linked in: pppoe ppp_async iptable_nat brcmfmac b43 pppox ppp_generic nf_nat_ipv4 nf_conntrack_ipv6 nf_conntrack_ipv4 mac80211 ipt_REJECT ipt_MASQUERADE cfg80211 xt_time xt_tcpudp xt_state xt_nat xt_multiport xt_mark xt_mac xt_limit xt_id xt_conntn
[   50.145115] CPU: 1 PID: 1025 Comm: hostapd Tainted: G        W      3.18.20 #20
[   50.152400] Backtrace: 
[   50.154871] [<c0015490>] (dump_backtrace) from [<c001569c>] (show_stack+0x18/0x1c)
[   50.162414]  r6:bf2860ce r5:00000009 r4:00000000 r3:dc8cb014
[   50.168092] [<c0015684>] (show_stack) from [<c01638d0>] (dump_stack+0x7c/0x98)
[   50.175307] [<c0163854>] (dump_stack) from [<c001fe3c>] (warn_slowpath_common+0x70/0x94)
[   50.183369]  r4:00000000 r3:dc8cb014
[   50.186954] [<c001fdcc>] (warn_slowpath_common) from [<c001ff04>] (warn_slowpath_null+0x24/0x2c)
[   50.195703]  r8:00000000 r7:c68e0000 r6:c7028524 r5:c7028480 r4:00000001
[   50.202452] [<c001fee0>] (warn_slowpath_null) from [<bf279ab0>] (brcmf_netdev_wait_pend8021x+0xf0/0x100 [brcmfmac])
[   50.212871] [<bf2799c0>] (brcmf_netdev_wait_pend8021x [brcmfmac]) from [<bf26a2c0>] (brcmf_cfg80211_get_key+0x1dc/0x3e0 [brcmfmac])
[   50.224646]  r6:c644bb88 r5:c03a7008 r4:c7028480
[   50.229281] [<bf26a220>] (brcmf_cfg80211_get_key [brcmfmac]) from [<bf26a52c>] (brcmf_cfg80211_del_key+0x68/0x98 [brcmfmac])
[   50.240460]  r6:c7028480 r5:c03a7008 r4:00000000
[   50.245140] [<bf26a4c4>] (brcmf_cfg80211_del_key [brcmfmac]) from [<bf168360>] (nl80211_del_key+0xe4/0x144 [cfg80211])
[   50.255796]  r6:00000000 r5:c708e520 r4:c7028000
[   50.260446] [<bf16827c>] (nl80211_del_key [cfg80211]) from [<c024e550>] (genl_rcv_msg+0x25c/0x2f4)
[   50.269368]  r7:c6482e80 r6:c708e514 r5:bf17d134 r4:bf185c78
[   50.275054] [<c024e2f4>] (genl_rcv_msg) from [<c024da20>] (netlink_rcv_skb+0x60/0xb4)
[   50.282852]  r10:c644bdd0 r9:00000000 r8:c644bd0c r7:00000030 r6:c024e2f4 r5:c6482e80
[   50.290689]  r4:c708e500
[   50.293221] [<c024d9c0>] (netlink_rcv_skb) from [<c024e2e0>] (genl_rcv+0x28/0x3c)
[   50.300668]  r6:c70e4000 r5:c6482e80 r4:c03baf78 r3:00000001
[   50.306346] [<c024e2b8>] (genl_rcv) from [<c024d394>] (netlink_unicast+0x138/0x22c)
[   50.313979]  r5:c6482e80 r4:c79fdc00
[   50.317561] [<c024d25c>] (netlink_unicast) from [<c024d85c>] (netlink_sendmsg+0x32c/0x394)
[   50.325794]  r9:00000030 r8:c644bf5c r7:c70e4000 r6:00000000 r5:00000000 r4:c6482e80
[   50.333563] [<c024d530>] (netlink_sendmsg) from [<c0215234>] (sock_sendmsg+0x78/0x8c)
[   50.341363]  r10:c644be3c r9:c7517dc0 r8:00000000 r7:c79ba040 r6:c644bf5c r5:00000030
[   50.349199]  r4:c7517dc0
[   50.351743] [<c02151bc>] (sock_sendmsg) from [<c0216a6c>] (___sys_sendmsg.part.30+0x198/0x238)
[   50.360310]  r7:c644be7c r6:00000000 r5:00000030 r4:c644bf5c
[   50.365990] [<c02168d4>] (___sys_sendmsg.part.30) from [<c0217ba4>] (__sys_sendmsg+0x54/0x78)
[   50.374479]  r10:00000000 r9:c644a000 r8:c0008aa4 r7:00000128 r6:bed1bf08 r5:00000000
[   50.382317]  r4:c7517dc0
[   50.384847] [<c0217b50>] (__sys_sendmsg) from [<c0217bd8>] (SyS_sendmsg+0x10/0x14)
[   50.392390]  r6:b6f99dc0 r5:00000000 r4:00000000
[   50.397015] [<c0217bc8>] (SyS_sendmsg) from [<c0008900>] (ret_fast_syscall+0x0/0x38)
[   50.404731] ---[ end trace 1ca11846ccbbf31f ]---
[   50.460690] ------------[ cut here ]------------
[   50.465334] WARNING: CPU: 1 PID: 1025 at /home/zajec/openwrt/openwrt-arm.git/build_dir/target-arm_cortex-a9_musl-1.1.10_eabi/linux-bcm53xx/compat-wireless-2015-07-21/drivers/net/wireless/brcm80211/brcmfmac/core.c:1144 brcmf_netdev_wait_pend8021x+0xf0/0x100 [brcmfmac])
[   50.489038] Modules linked in: pppoe ppp_async iptable_nat brcmfmac b43 pppox ppp_generic nf_nat_ipv4 nf_conntrack_ipv6 nf_conntrack_ipv4 mac80211 ipt_REJECT ipt_MASQUERADE cfg80211 xt_time xt_tcpudp xt_state xt_nat xt_multiport xt_mark xt_mac xt_limit xt_id xt_conntn
[   50.555089] CPU: 1 PID: 1025 Comm: hostapd Tainted: G        W      3.18.20 #20
[   50.562367] Backtrace: 
[   50.564835] [<c0015490>] (dump_backtrace) from [<c001569c>] (show_stack+0x18/0x1c)
[   50.572374]  r6:bf2860ce r5:00000009 r4:00000000 r3:dc8cb014
[   50.578051] [<c0015684>] (show_stack) from [<c01638d0>] (dump_stack+0x7c/0x98)
[   50.585265] [<c0163854>] (dump_stack) from [<c001fe3c>] (warn_slowpath_common+0x70/0x94)
[   50.593328]  r4:00000000 r3:dc8cb014
[   50.596913] [<c001fdcc>] (warn_slowpath_common) from [<c001ff04>] (warn_slowpath_null+0x24/0x2c)
[   50.605661]  r8:00000000 r7:c68e0000 r6:c7028524 r5:c7028480 r4:00000001
[   50.612403] [<c001fee0>] (warn_slowpath_null) from [<bf279ab0>] (brcmf_netdev_wait_pend8021x+0xf0/0x100 [brcmfmac])
[   50.622820] [<bf2799c0>] (brcmf_netdev_wait_pend8021x [brcmfmac]) from [<bf26a2c0>] (brcmf_cfg80211_get_key+0x1dc/0x3e0 [brcmfmac])
[   50.634597]  r6:c644bb88 r5:c03a7008 r4:c7028480
[   50.639240] [<bf26a220>] (brcmf_cfg80211_get_key [brcmfmac]) from [<bf26a52c>] (brcmf_cfg80211_del_key+0x68/0x98 [brcmfmac])
[   50.650408]  r6:c7028480 r5:c03a7008 r4:00000000
[   50.655084] [<bf26a4c4>] (brcmf_cfg80211_del_key [brcmfmac]) from [<bf168360>] (nl80211_del_key+0xe4/0x144 [cfg80211])
[   50.665737]  r6:00000000 r5:c708e620 r4:c7028000
[   50.670386] [<bf16827c>] (nl80211_del_key [cfg80211]) from [<c024e550>] (genl_rcv_msg+0x25c/0x2f4)
[   50.679310]  r7:c6482e80 r6:c708e614 r5:bf17d134 r4:bf185c78
[   50.684995] [<c024e2f4>] (genl_rcv_msg) from [<c024da20>] (netlink_rcv_skb+0x60/0xb4)
[   50.692795]  r10:c644bdd0 r9:00000000 r8:c644bd0c r7:00000030 r6:c024e2f4 r5:c6482e80
[   50.700622]  r4:c708e600
[   50.703163] [<c024d9c0>] (netlink_rcv_skb) from [<c024e2e0>] (genl_rcv+0x28/0x3c)
[   50.710610]  r6:c70e4000 r5:c6482e80 r4:c03baf78 r3:00000001
[   50.716287] [<c024e2b8>] (genl_rcv) from [<c024d394>] (netlink_unicast+0x138/0x22c)
[   50.723921]  r5:c6482e80 r4:c79fdc00
[   50.727503] [<c024d25c>] (netlink_unicast) from [<c024d85c>] (netlink_sendmsg+0x32c/0x394)
[   50.735736]  r9:00000030 r8:c644bf5c r7:c70e4000 r6:00000000 r5:00000000 r4:c6482e80
[   50.743503] [<c024d530>] (netlink_sendmsg) from [<c0215234>] (sock_sendmsg+0x78/0x8c)
[   50.751306]  r10:c644be3c r9:c7517dc0 r8:00000000 r7:c79ba040 r6:c644bf5c r5:00000030
[   50.759141]  r4:c7517dc0
[   50.761685] [<c02151bc>] (sock_sendmsg) from [<c0216a6c>] (___sys_sendmsg.part.30+0x198/0x238)
[   50.770253]  r7:c644be7c r6:00000000 r5:00000030 r4:c644bf5c
[   50.775930] [<c02168d4>] (___sys_sendmsg.part.30) from [<c0217ba4>] (__sys_sendmsg+0x54/0x78)
[   50.784423]  r10:00000000 r9:c644a000 r8:c0008aa4 r7:00000128 r6:bed1bea0 r5:00000000
[   50.792268]  r4:c7517dc0
[   50.794799] [<c0217b50>] (__sys_sendmsg) from [<c0217bd8>] (SyS_sendmsg+0x10/0x14)
[   50.802341]  r6:b6f99dc0 r5:00000000 r4:00000000
[   50.806964] [<c0217bc8>] (SyS_sendmsg) from [<c0008900>] (ret_fast_syscall+0x0/0x38)
[   50.814683] ---[ end trace 1ca11846ccbbf320 ]---
[   53.660694] ------------[ cut here ]------------
[   53.665346] WARNING: CPU: 1 PID: 1025 at /home/zajec/openwrt/openwrt-arm.git/build_dir/target-arm_cortex-a9_musl-1.1.10_eabi/linux-bcm53xx/compat-wireless-2015-07-21/drivers/net/wireless/brcm80211/brcmfmac/core.c:1144 brcmf_netdev_wait_pend8021x+0xf0/0x100 [brcmfmac])
[   53.689056] Modules linked in: pppoe ppp_async iptable_nat brcmfmac b43 pppox ppp_generic nf_nat_ipv4 nf_conntrack_ipv6 nf_conntrack_ipv4 mac80211 ipt_REJECT ipt_MASQUERADE cfg80211 xt_time xt_tcpudp xt_state xt_nat xt_multiport xt_mark xt_mac xt_limit xt_id xt_conntn
[   53.755114] CPU: 1 PID: 1025 Comm: hostapd Tainted: G        W      3.18.20 #20
[   53.762399] Backtrace: 
[   53.764872] [<c0015490>] (dump_backtrace) from [<c001569c>] (show_stack+0x18/0x1c)
[   53.772415]  r6:bf2860ce r5:00000009 r4:00000000 r3:dc8cb014
[   53.778093] [<c0015684>] (show_stack) from [<c01638d0>] (dump_stack+0x7c/0x98)
[   53.785306] [<c0163854>] (dump_stack) from [<c001fe3c>] (warn_slowpath_common+0x70/0x94)
[   53.793367]  r4:00000000 r3:dc8cb014
[   53.796953] [<c001fdcc>] (warn_slowpath_common) from [<c001ff04>] (warn_slowpath_null+0x24/0x2c)
[   53.805702]  r8:00000000 r7:c68e0000 r6:c7028524 r5:c7028480 r4:00000001
[   53.812450] [<c001fee0>] (warn_slowpath_null) from [<bf279ab0>] (brcmf_netdev_wait_pend8021x+0xf0/0x100 [brcmfmac])
[   53.822869] [<bf2799c0>] (brcmf_netdev_wait_pend8021x [brcmfmac]) from [<bf26a2c0>] (brcmf_cfg80211_get_key+0x1dc/0x3e0 [brcmfmac])
[   53.834645]  r6:c644bb88 r5:c03a7008 r4:c7028480
[   53.839281] [<bf26a220>] (brcmf_cfg80211_get_key [brcmfmac]) from [<bf26a52c>] (brcmf_cfg80211_del_key+0x68/0x98 [brcmfmac])
[   53.850447]  r6:c7028480 r5:c03a7008 r4:00000000
[   53.855119] [<bf26a4c4>] (brcmf_cfg80211_del_key [brcmfmac]) from [<bf168360>] (nl80211_del_key+0xe4/0x144 [cfg80211])
[   53.865768]  r6:00000000 r5:c708e620 r4:c7028000
[   53.870419] [<bf16827c>] (nl80211_del_key [cfg80211]) from [<c024e550>] (genl_rcv_msg+0x25c/0x2f4)
[   53.879342]  r7:c7374940 r6:c708e614 r5:bf17d134 r4:bf185c78
[   53.885026] [<c024e2f4>] (genl_rcv_msg) from [<c024da20>] (netlink_rcv_skb+0x60/0xb4)
[   53.892826]  r10:c644bdd0 r9:00000000 r8:c644bd0c r7:00000030 r6:c024e2f4 r5:c7374940
[   53.900653]  r4:c708e600
[   53.903195] [<c024d9c0>] (netlink_rcv_skb) from [<c024e2e0>] (genl_rcv+0x28/0x3c)
[   53.910642]  r6:c70e4000 r5:c7374940 r4:c03baf78 r3:00000001
[   53.916319] [<c024e2b8>] (genl_rcv) from [<c024d394>] (netlink_unicast+0x138/0x22c)
[   53.923952]  r5:c7374940 r4:c79fdc00
[   53.927534] [<c024d25c>] (netlink_unicast) from [<c024d85c>] (netlink_sendmsg+0x32c/0x394)
[   53.935767]  r9:00000030 r8:c644bf5c r7:c70e4000 r6:00000000 r5:00000000 r4:c7374940
[   53.943537] [<c024d530>] (netlink_sendmsg) from [<c0215234>] (sock_sendmsg+0x78/0x8c)
[   53.951338]  r10:c644be3c r9:c7517dc0 r8:00000000 r7:c79ba040 r6:c644bf5c r5:00000030
[   53.959173]  r4:c7517dc0
[   53.961716] [<c02151bc>] (sock_sendmsg) from [<c0216a6c>] (___sys_sendmsg.part.30+0x198/0x238)
[   53.970283]  r7:c644be7c r6:00000000 r5:00000030 r4:c644bf5c
[   53.975963] [<c02168d4>] (___sys_sendmsg.part.30) from [<c0217ba4>] (__sys_sendmsg+0x54/0x78)
[   53.984455]  r10:00000000 r9:c644a000 r8:c0008aa4 r7:00000128 r6:bed1be48 r5:00000000
[   53.992299]  r4:c7517dc0
[   53.994830] [<c0217b50>] (__sys_sendmsg) from [<c0217bd8>] (SyS_sendmsg+0x10/0x14)
[   54.002373]  r6:b6f99dc0 r5:00000000 r4:00000000
[   54.006998] [<c0217bc8>] (SyS_sendmsg) from [<c0008900>] (ret_fast_syscall+0x0/0x38)
[   54.014713] ---[ end trace 1ca11846ccbbf321 ]---
[   54.070696] ------------[ cut here ]------------
[   54.075343] WARNING: CPU: 1 PID: 1025 at /home/zajec/openwrt/openwrt-arm.git/build_dir/target-arm_cortex-a9_musl-1.1.10_eabi/linux-bcm53xx/compat-wireless-2015-07-21/drivers/net/wireless/brcm80211/brcmfmac/core.c:1144 brcmf_netdev_wait_pend8021x+0xf0/0x100 [brcmfmac])
[   54.099046] Modules linked in: pppoe ppp_async iptable_nat brcmfmac b43 pppox ppp_generic nf_nat_ipv4 nf_conntrack_ipv6 nf_conntrack_ipv4 mac80211 ipt_REJECT ipt_MASQUERADE cfg80211 xt_time xt_tcpudp xt_state xt_nat xt_multiport xt_mark xt_mac xt_limit xt_id xt_conntn
[   54.165108] CPU: 1 PID: 1025 Comm: hostapd Tainted: G        W      3.18.20 #20
[   54.172392] Backtrace: 
[   54.174860] [<c0015490>] (dump_backtrace) from [<c001569c>] (show_stack+0x18/0x1c)
[   54.182407]  r6:bf2860ce r5:00000009 r4:00000000 r3:dc8cb014
[   54.188086] [<c0015684>] (show_stack) from [<c01638d0>] (dump_stack+0x7c/0x98)
[   54.195299] [<c0163854>] (dump_stack) from [<c001fe3c>] (warn_slowpath_common+0x70/0x94)
[   54.203362]  r4:00000000 r3:dc8cb014
[   54.206946] [<c001fdcc>] (warn_slowpath_common) from [<c001ff04>] (warn_slowpath_null+0x24/0x2c)
[   54.215697]  r8:00000000 r7:c68e0000 r6:c7028524 r5:c7028480 r4:00000001
[   54.222445] [<c001fee0>] (warn_slowpath_null) from [<bf279ab0>] (brcmf_netdev_wait_pend8021x+0xf0/0x100 [brcmfmac])
[   54.232861] [<bf2799c0>] (brcmf_netdev_wait_pend8021x [brcmfmac]) from [<bf26a2c0>] (brcmf_cfg80211_get_key+0x1dc/0x3e0 [brcmfmac])
[   54.244641]  r6:c644bb88 r5:c03a7008 r4:c7028480
[   54.249284] [<bf26a220>] (brcmf_cfg80211_get_key [brcmfmac]) from [<bf26a52c>] (brcmf_cfg80211_del_key+0x68/0x98 [brcmfmac])
[   54.260454]  r6:c7028480 r5:c03a7008 r4:00000000
[   54.265132] [<bf26a4c4>] (brcmf_cfg80211_del_key [brcmfmac]) from [<bf168360>] (nl80211_del_key+0xe4/0x144 [cfg80211])
[   54.275788]  r6:00000000 r5:c708e520 r4:c7028000
[   54.280437] [<bf16827c>] (nl80211_del_key [cfg80211]) from [<c024e550>] (genl_rcv_msg+0x25c/0x2f4)
[   54.289363]  r7:c7374940 r6:c708e514 r5:bf17d134 r4:bf185c78
[   54.295046] [<c024e2f4>] (genl_rcv_msg) from [<c024da20>] (netlink_rcv_skb+0x60/0xb4)
[   54.302846]  r10:c644bdd0 r9:00000000 r8:c644bd0c r7:00000030 r6:c024e2f4 r5:c7374940
[   54.310684]  r4:c708e500
[   54.313224] [<c024d9c0>] (netlink_rcv_skb) from [<c024e2e0>] (genl_rcv+0x28/0x3c)
[   54.320670]  r6:c70e4000 r5:c7374940 r4:c03baf78 r3:00000001
[   54.326348] [<c024e2b8>] (genl_rcv) from [<c024d394>] (netlink_unicast+0x138/0x22c)
[   54.333982]  r5:c7374940 r4:c79fdc00
[   54.337562] [<c024d25c>] (netlink_unicast) from [<c024d85c>] (netlink_sendmsg+0x32c/0x394)
[   54.345796]  r9:00000030 r8:c644bf5c r7:c70e4000 r6:00000000 r5:00000000 r4:c7374940
[   54.353565] [<c024d530>] (netlink_sendmsg) from [<c0215234>] (sock_sendmsg+0x78/0x8c)
[   54.361366]  r10:c644be3c r9:c7517dc0 r8:00000000 r7:c79ba040 r6:c644bf5c r5:00000030
[   54.369201]  r4:c7517dc0
[   54.371745] [<c02151bc>] (sock_sendmsg) from [<c0216a6c>] (___sys_sendmsg.part.30+0x198/0x238)
[   54.380312]  r7:c644be7c r6:00000000 r5:00000030 r4:c644bf5c
[   54.385991] [<c02168d4>] (___sys_sendmsg.part.30) from [<c0217ba4>] (__sys_sendmsg+0x54/0x78)
[   54.394482]  r10:00000000 r9:c644a000 r8:c0008aa4 r7:00000128 r6:bed1bdb0 r5:00000000
[   54.402318]  r4:c7517dc0
[   54.404850] [<c0217b50>] (__sys_sendmsg) from [<c0217bd8>] (SyS_sendmsg+0x10/0x14)
[   54.412392]  r6:b6f99dc0 r5:00000000 r4:00000000
[   54.417016] [<c0217bc8>] (SyS_sendmsg) from [<c0008900>] (ret_fast_syscall+0x0/0x38)
[   54.424733] ---[ end trace 1ca11846ccbbf322 ]---
[   54.430510] Unable to handle kernel NULL pointer dereference at virtual address 00000014
[   54.438565] pgd = c6490000
[   54.441260] [00000014] *pgd=064ef831, *pte=00000000, *ppte=00000000
[   54.447529] Internal error: Oops: 17 [#1] SMP ARM
[   54.452206] Modules linked in: pppoe ppp_async iptable_nat brcmfmac b43 pppox ppp_generic nf_nat_ipv4 nf_conntrack_ipv6 nf_conntrack_ipv4 mac80211 ipt_REJECT ipt_MASQUERADE cfg80211 xt_time xt_tcpudp xt_state xt_nat xt_multiport xt_mark xt_mac xt_limit xt_id xt_conntn
[   54.518189] CPU: 1 PID: 1025 Comm: hostapd Tainted: G        W      3.18.20 #20
[   54.525468] task: c79ba040 ti: c644a000 task.ti: c644a000
[   54.530851] PC is at _raw_spin_lock_irqsave+0x1c/0x58
[   54.535888] LR is at skb_queue_tail+0x20/0x50
[   54.540226] pc : [<c0011228>]    lr : [<c021dbe8>]    psr: 00000093
[   54.540226] sp : c644bbf8  ip : c644bc08  fp : c644bc04
[   54.551645] r10: 00000000  r9 : c73a4000  r8 : 00000000
[   54.556847] r7 : c68dff40  r6 : 00000014  r5 : c68dff40  r4 : 00000008
[   54.563344] r3 : 00000014  r2 : c68dff40  r1 : c68dff40  r0 : 00000013
[   54.569843] Flags: nzcv  IRQs off  FIQs on  Mode SVC_32  ISA ARM  Segment user
[   54.577030] Control: 10c5387d  Table: 0649004a  DAC: 00000015
[   54.582750] Process hostapd (pid: 1025, stack limit = 0xc644a1b8)
[   54.588815] Stack: (0xc644bbf8 to 0xc644c000)
[   54.593154] bbe0:                                                       c644bc24 c644bc08
[   54.601297] bc00: c021dbe8 c0011218 c72a9000 00000000 00000006 c73a4000 c644bc44 c644bc28
[   54.609435] bc20: bf27c03c c021dbd4 c68dff40 c7032dc0 00000006 c68dff40 c644bc7c c644bc48
[   54.617574] bc40: bf27d02c bf27c01c c644bc6c 00000000 c024d21c c68dff40 c7388000 c7394000
[   54.625713] bc60: c7028480 00000000 c6908202 c7028000 c644bca4 c644bc80 bf275344 bf27cf28
[   54.633852] bc80: c7028000 c7394000 c68dff40 c68dff40 c6908202 c708ef00 c644bccc c644bca8
[   54.641992] bca0: bf278c54 bf2752d4 bf278ae4 00000001 c68dff40 c7214000 c708ef00 00000000
[   54.650129] bcc0: c644bd1c c644bcd0 c022cf54 bf278af0 000004d0 c644bd24 00000000 00000000
[   54.658269] bce0: 00000000 00000000 c68dff40 c7028000 c644bd1c 00000001 c68dff40 c7214000
[   54.666407] bd00: c708ef00 c68dff40 c7028000 c7214068 c644bd54 c644bd20 c0244f14 c022cd10
[   54.674546] bd20: c644a000 00000010 00000063 c7214000 c68dff40 c7028000 c708ef00 00000000
[   54.682684] bd40: 00000000 c7214068 c644bd94 c644bd58 c022d250 c0244e6c c7214068 00000001
[   54.690824] bd60: 00000000 fffffff4 00000001 c72a4400 c68dff40 c7028000 00000063 00000000
[   54.698962] bd80: c6908340 00000002 c644bda4 c644bd98 c022d508 c022cff8 c644be2c c644bda8
[   54.707102] bda0: c02a55b8 c022d500 00000000 00000000 c644bdcc 0000000e 00000013 c644bf00
[   54.715240] bdc0: c750a380 00000000 00008e88 00000010 00000000 00000000 00000400 00000000
[   54.723377] bde0: 00000000 00000000 c01b0000 00000000 00000000 00000000 00000000 00000000
[   54.731518] be00: 00000000 c750a380 00000063 c644bed8 c79ba040 c03a7008 00000000 c644bef4
[   54.739657] be20: c644bec4 c644be30 c0215234 c02a49f4 00000000 00000000 00000000 c644be68
[   54.747795] be40: c79ba040 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[   54.755934] be60: 00000000 00000000 c01b1a50 c01693e4 0000be84 00000063 c750a380 00000001
[   54.764073] be80: 00000000 c644bed8 00be1598 00000000 c644beac 00000063 00000014 bed1bd70
[   54.772213] bea0: c03a7008 c644bef4 c750a380 00000063 00000014 bed1bd70 c644bfa4 c644bec8
[   54.780351] bec0: c0217808 c02151c8 00000000 00000000 00be1500 00000063 c644bef4 00000014
[   54.788489] bee0: c644bed0 00000001 00000000 00000000 00000000 8e880011 00000005 06000000
[   54.796629] bf00: 9bf0d678 0000bcba c644bf24 c644bf18 c00c3e8c c00c3cb0 c644bf5c c644bf28
[   54.804767] bf20: c00a99e8 c00c3e6c 00000020 00000000 c644bf54 c79ba040 00000000 c03be4e4
[   54.812907] bf40: 00000006 c0008aa4 c644a000 00000000 c644bf6c c644bf60 c00a9a60 c00a9854
[   54.821046] bf60: c644bf8c c644bf70 c0034b24 c000e3ec c6b1a4c0 dc8cb014 c644bfb0 bed1bd70
[   54.829184] bf80: 00000014 00000000 00000122 c0008aa4 c644a000 00000000 00000000 c644bfa8
[   54.837324] bfa0: c0008900 c0217744 bed1bd70 00000014 00000008 00be1500 00000063 00000000
[   54.845461] bfc0: bed1bd70 00000014 00000000 00000122 00000063 00000000 00be144c 00094ea0
[   54.853602] bfe0: bed1bd10 bed1bcfc b6f72e10 b6f75d88 60000010 00000008 ffffffff ffffffff
[   54.861732] Backtrace: 
[   54.864183] [<c001120c>] (_raw_spin_lock_irqsave) from [<c021dbe8>] (skb_queue_tail+0x20/0x50)
[   54.872784] [<c021dbc8>] (skb_queue_tail) from [<bf27c03c>] (brcmf_flowring_enqueue+0x2c/0x78 [brcmfmac])
[   54.882305]  r6:c73a4000 r5:00000006 r4:00000000 r3:c72a9000
[   54.887989] [<bf27c010>] (brcmf_flowring_enqueue [brcmfmac]) from [<bf27d02c>] (brcmf_msgbuf_txdata+0x110/0x1c0 [brcmfmac])
[   54.899057]  r7:c68dff40 r6:00000006 r5:c7032dc0 r4:c68dff40
[   54.904741] [<bf27cf1c>] (brcmf_msgbuf_txdata [brcmfmac]) from [<bf275344>] (brcmf_fws_process_skb+0x7c/0x2dc [brcmfmac])
[   54.915638]  r10:c7028000 r9:c6908202 r8:00000000 r7:c7028480 r6:c7394000 r5:c7388000
[   54.923465]  r4:c68dff40
[   54.926013] [<bf2752c8>] (brcmf_fws_process_skb [brcmfmac]) from [<bf278c54>] (brcmf_netdev_start_xmit+0x170/0x1d8 [brcmfmac])
[   54.937342]  r9:c708ef00 r8:c6908202 r7:c68dff40 r6:c68dff40 r5:c7394000 r4:c7028000
[   54.945112] [<bf278ae4>] (brcmf_netdev_start_xmit [brcmfmac]) from [<c022cf54>] (dev_hard_start_xmit+0x250/0x2e8)
[   54.955322]  r8:00000000 r7:c708ef00 r6:c7214000 r5:c68dff40 r4:00000001 r3:bf278ae4
[   54.963082] [<c022cd04>] (dev_hard_start_xmit) from [<c0244f14>] (sch_direct_xmit+0xb4/0x1ec)
[   54.971565]  r10:c7214068 r9:c7028000 r8:c68dff40 r7:c708ef00 r6:c7214000 r5:c68dff40
[   54.979392]  r4:00000001
[   54.981926] [<c0244e60>] (sch_direct_xmit) from [<c022d250>] (__dev_queue_xmit+0x264/0x508)
[   54.990236]  r10:c7214068 r9:00000000 r8:00000000 r7:c708ef00 r6:c7028000 r5:c68dff40
[   54.998064]  r4:c7214000
[   55.000596] [<c022cfec>] (__dev_queue_xmit) from [<c022d508>] (dev_queue_xmit+0x14/0x18)
[   55.008647]  r10:00000002 r9:c6908340 r8:00000000 r7:00000063 r6:c7028000 r5:c68dff40
[   55.016475]  r4:c72a4400
[   55.019018] [<c022d4f4>] (dev_queue_xmit) from [<c02a55b8>] (packet_sendmsg+0xbd0/0xcac)
[   55.027086] [<c02a49e8>] (packet_sendmsg) from [<c0215234>] (sock_sendmsg+0x78/0x8c)
[   55.034792]  r10:c644bef4 r9:00000000 r8:c03a7008 r7:c79ba040 r6:c644bed8 r5:00000063
[   55.042619]  r4:c750a380
[   55.045153] [<c02151bc>] (sock_sendmsg) from [<c0217808>] (SyS_sendto+0xd0/0x10c)
[   55.052600]  r7:bed1bd70 r6:00000014 r5:00000063 r4:c750a380
[   55.058268] [<c0217738>] (SyS_sendto) from [<c0008900>] (ret_fast_syscall+0x0/0x38)
[   55.065887]  r10:00000000 r9:c644a000 r8:c0008aa4 r7:00000122 r6:00000000 r5:00000014
[   55.073716]  r4:bed1bd70
[   55.076246] Code: e1a03000 e10f0000 f10c0080 f593f000 (e1931f9f) 
[   55.082309] ---[ end trace 1ca11846ccbbf323 ]---
[   55.086903] Kernel panic - not syncing: Fatal exception in interrupt
[   55.093232] CPU0: stopping
[   55.095938] CPU: 0 PID: 0 Comm: swapper/0 Tainted: G      D W      3.18.20 #20
[   55.103126] Backtrace: 
[   55.105583] [<c0015490>] (dump_backtrace) from [<c001569c>] (show_stack+0x18/0x1c)
[   55.113114]  r6:c03a2894 r5:00000000 r4:00000000 r3:dc8cb014
[   55.118785] [<c0015684>] (show_stack) from [<c01638d0>] (dump_stack+0x7c/0x98)
[   55.125977] [<c0163854>] (dump_stack) from [<c00172e0>] (handle_IPI+0xcc/0x168)
[   55.133246]  r4:00000000 r3:00000000
[   55.136820] [<c0017214>] (handle_IPI) from [<c000869c>] (gic_handle_irq+0x5c/0x64)
[   55.144347]  r6:c03a7480 r5:c03a5f38 r4:c8802100 r3:00000405
[   55.150016] [<c0008640>] (gic_handle_irq) from [<c0009220>] (__irq_svc+0x40/0x54)
[   55.157465] Exception stack(0xc03a5f38 to 0xc03a5f80)
[   55.162495] 5f20:                                                       c6dd41f8 00000000
[   55.170638] 5f40: 00e79eb2 c0009d40 c03a4010 c03a4000 c03a4000 c03bd794 c039b9c8 c7ffc700
[   55.178777] 5f60: c03bd790 c03a5f8c c03a5f90 c03a5f80 c00131ac c00131b0 60000013 ffffffff
[   55.186908]  r6:ffffffff r5:60000013 r4:c00131b0 r3:c00131ac
[   55.192578] [<c001317c>] (arch_cpu_idle) from [<c004860c>] (cpu_startup_entry+0xf0/0x14c)
[   55.200730] [<c004851c>] (cpu_startup_entry) from [<c000ca90>] (rest_init+0x68/0x80)
[   55.208448] [<c000ca28>] (rest_init) from [<c0379cc8>] (start_kernel+0x388/0x408)
[   55.215925] [<c0379940>] (start_kernel) from [<00008074>] (0x8074)
[   55.222076] Rebooting in 3 seconds..

[-- Attachment #3: early.txt --]
[-- Type: text/plain, Size: 7731 bytes --]

[  234.068642] Unable to handle kernel NULL pointer dereference at virtual address 00000004
[  234.076741] pgd = c6aa0000
[  234.079436] [00000004] *pgd=064d1831, *pte=00000000, *ppte=00000000
[  234.085757] Internal error: Oops: 17 [#1] SMP ARM
[  234.090442] Modules linked in: pppoe ppp_async iptable_nat brcmfmac b43 pppox ppp_generic nf_nat_ipv4 nf_conntrack_ipv6 nf_conntrack_ipv4 mac80211 ipt_REJECT ipt_MASQUERADE cfg80211 xt_time xt_tcpudp xt_state xt_nat xt_multiport xt_mark xt_mac xt_limit xt_id xt_conntn
[  234.156425] CPU: 1 PID: 1303 Comm: hostapd Not tainted 3.18.20 #21
[  234.162581] task: c7962800 ti: c6ae6000 task.ti: c6ae6000
[  234.167984] PC is at brcmf_flowring_configure_addr_mode+0x6c/0xa4 [brcmfmac]
[  234.175004] LR is at brcmf_msgbuf_configure_addr_mode+0x1c/0x20 [brcmfmac]
[  234.181849] pc : [<bf27c2b0>]    lr : [<bf27cc78>]    psr: 60000013
[  234.181849] sp : c6ae7b40  ip : c6ae7b78  fp : c6ae7b74
[  234.193267] r10: 00000001  r9 : 00001404  r8 : 00000000
[  234.198470] r7 : 00000001  r6 : c7262000  r5 : c7262000  r4 : c72633ec
[  234.204966] r3 : 00000000  r2 : 00000001  r1 : 00000000  r0 : c7262000
[  234.211467] Flags: nZCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment user
[  234.218567] Control: 10c5387d  Table: 06aa004a  DAC: 00000015
[  234.224286] Process hostapd (pid: 1303, stack limit = 0xc6ae61b8)
[  234.230352] Stack: (0xc6ae7b40 to 0xc6ae8000)
[  234.234695] 7b40: c7263400 c7374000 00400100 00000000 00000003 c792f000 c7298800 c68c0b40
[  234.242841] 7b60: c68c0160 00000000 c6ae7b84 c6ae7b78 bf27cc78 bf27c250 c6ae7b94 c6ae7b88
[  234.250980] 7b80: bf26906c bf27cc68 c6ae7bec c6ae7b98 bf269de0 bf269024 00000000 00000000
[  234.259117] 7ba0: 00000000 00000001 00000000 00000000 00000000 00000000 00000000 00000000
[  234.267257] 7bc0: 00000000 00000000 c6ae7bec c7298800 c68c0000 00000003 00000002 00000000
[  234.275396] 7be0: c6ae7c24 c6ae7bf0 bf15c1cc bf269c44 c6ae7c34 c000f9cc c6ae7c44 00000003
[  234.283536] 7c00: c7298800 c711bc00 00000001 c792f004 c68c0000 00000014 c6ae7c6c c6ae7c28
[  234.291674] 7c20: bf16738c bf15c038 c6ae7c34 c6ae7c7c 00000001 ffffffff 00000000 00000000
[  234.299814] 7c40: c6ae7c6c bf185c78 bf17d0bc c70c1814 c70dd7c0 00000000 c711bc00 00000014
[  234.307961] 7c60: c6ae7ccc c6ae7c70 c024e550 bf1671f8 bf17cc36 c7973a40 c6aab880 55d3166e
[  234.316100] 7c80: 00000517 c70c1800 c70c1810 c70c1814 c711bc00 c68c0000 c7298800 c79fbc00
[  234.324239] 7ca0: c01729ac c70c1800 c70dd7c0 c024e2f4 00000024 c6ae7d0c 00000000 c6ae7dd0
[  234.332377] 7cc0: c6ae7cec c6ae7cd0 c024da20 c024e300 00000001 c03baf78 c70dd7c0 c70fc400
[  234.340604] 7ce0: c6ae7d04 c6ae7cf0 c024e2e0 c024d9cc c79fbc00 c70dd7c0 c6ae7d34 c6ae7d08
[  234.348993] 7d00: c024d394 c024e2c4 c6ae7e44 7fffffff c70dd7c0 00000000 00000000 c70fc400
[  234.357381] 7d20: c6ae7f5c 00000024 c6ae7d94 c6ae7d38 c024d85c c024d268 c024bb88 c0047e2c
[  234.365770] 7d40: bf055180 00000000 00000008 00000000 00000000 c7118dc0 00000000 00000517
[  234.374159] 7d60: 00000000 00000000 00000000 c7499940 00000024 c6ae7f5c c7962800 00000000
[  234.382549] 7d80: c7499940 c6ae7e3c c6ae7e2c c6ae7d98 c0215234 c024d53c 00000000 00000000
[  234.390852] 7da0: 00000000 c6ae7dd0 c7962800 00000000 00000000 00000000 00000000 00000000
[  234.398990] 7dc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000024
[  234.407130] 7de0: c7499940 00000128 c6ae7d54 c6ae7f5c c6ae7e9c 00000128 00000000 c6ae7e3c
[  234.415268] 7e00: 00000008 00000000 c6ae7f5c c0221d5c c6ae7f5c 00000024 00000000 c6ae7e7c
[  234.423409] 7e20: c6ae7f4c c6ae7e30 c0216a6c c02151c8 c6ae7e54 00000000 c6ae7f44 01862034
[  234.431548] 7e40: 00000000 c0215ef4 c6ae7e48 00000000 c6ae7e8c 01863044 00003fdc c6ae6010
[  234.439687] 7e60: c6ae7e8c c6ae7e70 c004031c c016852c c7962800 c6dde040 c7962800 c6dde040
[  234.447824] 7e80: c6ae7eec c6ae7e90 c00409d4 c003f248 efe4b99a 00000010 00000000 00000010
[  234.455964] 7ea0: 00000000 00000000 c7962848 00000001 97334000 00001dfc 00000002 00000000
[  234.464103] 7ec0: c6dde078 c79d1450 c6ae7eec c6ae7ed8 c003fad4 c0168660 c79d1448 c6dde078
[  234.472241] 7ee0: c6ae7f3c c6ae7ef0 c00436b8 c003faa8 c0216edc c023f8b8 c0216c98 c6454b80
[  234.480381] 7f00: ffffffff c704a01c c7962800 bee2cb64 00000000 00000000 bee2cb78 dc8cb014
[  234.488519] 7f20: c0008aa4 c7499940 00000000 bee2cb78 00000128 c0008aa4 c6ae6000 00000000
[  234.496658] 7f40: c6ae7f94 c6ae7f50 c0217ba4 c02168e0 c6ae7f6c 00000000 fffffff7 c6ae7e9c
[  234.504796] 7f60: 0000000c c6ae7e3c 00000001 00000000 00000000 00000000 c000e134 00000000
[  234.512936] 7f80: 00000000 b6f89a9f c6ae7fa4 c6ae7f98 c0217bd8 c0217b5c 00000000 c6ae7fa8
[  234.521073] 7fa0: c0008900 c0217bd4 00000000 00000000 00000004 bee2cb78 00000000 00000000
[  234.529213] 7fc0: 00000000 00000000 b6f89a9f 00000128 00000000 b6eecfa0 00000000 00000001
[  234.537352] 7fe0: bee2cb20 bee2cb0c b6f76e10 b6f79d88 60000010 00000004 00000000 00000000
[  234.545484] Backtrace: 
[  234.547954] [<bf27c244>] (brcmf_flowring_configure_addr_mode [brcmfmac]) from [<bf27cc78>] (brcmf_msgbuf_configure_addr_mode+0x1c/0x20 [brcmfmac])
[  234.561020]  r10:00000000 r9:c68c0160 r8:c68c0b40 r7:c7298800 r6:c792f000 r5:00000003
[  234.570410]  r4:00000000
[  234.572955] [<bf27cc5c>] (brcmf_msgbuf_configure_addr_mode [brcmfmac]) from [<bf26906c>] (0xbf26906c)
[  234.582147] [<bf269018>] (0xbf269018) from [<bf269de0>] (brcmf_cfg80211_change_iface+0x1a8/0x1ec [brcmfmac])
[  234.591974] [<bf269c38>] (brcmf_cfg80211_change_iface [brcmfmac]) from [<bf15c1cc>] (cfg80211_change_iface+0x1a0/0x2dc [cfg80211])
[  234.603648]  r8:00000000 r7:00000002 r6:00000003 r5:c68c0000 r4:c7298800
[  234.610389] [<bf15c02c>] (cfg80211_change_iface [cfg80211]) from [<bf16738c>] (nl80211_set_interface+0x1a0/0x72c [cfg80211])
[  234.621699]  r10:00000014 r9:c68c0000r r8:c792f004 r7:00000001o r6:c711bc00o r5:c7298800
[  234.629784]  r4:00000003p
[  234.632684] [<bf1671ec>] (nl80211_set_interface [cfg80211]) from [<c024e550>] (genl_rcv_msg+0x25c/0x2f4)
]  r10:00000014rt r9:c711bc00:/# r8:00000000 r7:c70dd7c0  r6:c70c1814 r5:bf17d0bc9
[  234.650772]  r4:bf185c78o
[  234.653651] [<c024e2f4>] (genl_rcv_msg) from [<c024da20>] (netlink_rcv_skb+0x60/0xb4)
[  234.661685]  r10:c6ae7dd0W r9:00000000t r8:c6ae7d0c:/# r7:00000024  r6:c024e2f4 r5:c70dd7c0
[  234.670289]  r4:c70c1800
[  234.672821] [<c024d9c0>] (netlink_rcv_skb) from [<c024e2e0>] (genl_rcv+0x28/0x3c)
[  234.680268]  r6:c70fc400 r5:c70dd7c0 r4:c03baf78 r3:00000001
[  234.687493] [<c024e2b8>] (genl_rcv) from [<c024d394>] (netlink_unicast+0x138/0x22c)
[  234.695112]  r5:c70dd7c0 r4:c79fbc00
[  234.698688] [<c024d25c>] (netlink_unicast) from [<c024d85c>] (netlink_sendmsg+0x32c/0x394)
[  234.706906]  r9:00000024 r8:c6ae7f5c r7:c70fc400 r6:00000000 r5:00000000 r4:c70dd7c0
[  234.714667] [<c024d530>] (netlink_sendmsg) from [<c0215234>] (sock_sendmsg+0x78/0x8c)
[  234.722458]  r10:c6ae7e3c r9:c7499940 r8:00000000 r7:c7962800 r6:c6ae7f5c r5:00000024
[  234.730285]  r4:c7499940
[  234.732819] [<c02151bc>] (sock_sendmsg) from [<c0216a6c>] (___sys_sendmsg.part.30+0x198/0x238)
[  234.741388]  r7:c6ae7e7c r6:00000000 r5:00000024 r4:c6ae7f5c
[  234.747057] [<c02168d4>] (___sys_sendmsg.part.30) from [<c0217ba4>] (__sys_sendmsg+0x54/0x78)
[  234.755540]  r10:00000000 r9:c6ae6000 r8:c0008aa4 r7:00000128 r6:bee2cb78 r5:00000000
[  234.764922]  r4:c7499940
[  234.767454] [<c0217b50>] (__sys_sendmsg) from [<c0217bd8>] (SyS_sendmsg+0x10/0x14)
[  234.774979]  r6:b6f89a9f r5:00000000 r4:00000000
[  234.781162] [<c0217bc8>] (SyS_sendmsg) from [<c0008900>] (ret_fast_syscall+0x0/0x38)
[  234.788872] Code: 1a000008 e1d410bc e7953009 e7933101 (e5932004) 
[  234.795003] ---[ end trace 351f776c4d71576b ]---

Re: [PATCH V2 3/7] brcmfmac: Increase nr of supported flowrings.

[Arend van Spriel]

On 08/24/2015 10:02 PM, Rafał Miłecki wrote:
> On 24 August 2015 at 16:15, Arend van Spriel <arend@broadcom.com> wrote:
>> On 08/19/2015 11:56 PM, Rafał Miłecki wrote:
>>>
>>> On 16 August 2015 at 08:55, Arend van Spriel <arend@broadcom.com> wrote:
>>>>
>>>> From: Hante Meuleman <meuleman@broadcom.com>
>>>>
>>>> Next generation devices will have firmware which will have more
>>>> than 256 flowrings. This patch increases the maximum number of
>>>> supported flowrings to 512.
>>>>
>>>> Reviewed-by: Arend Van Spriel <arend@broadcom.com>
>>>> Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
>>>> Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
>>>> Signed-off-by: Hante Meuleman <meuleman@broadcom.com>
>>>> Signed-off-by: Arend van Spriel <arend@broadcom.com>
>>>
>>>
>>> This is a patch that for my device triggers:
>>> Unable to handle kernel NULL pointer dereference at virtual address
>>> 00000014
>>>
>>> It seems to happen even when using only 1 AP interface.
>>
>>
>> Hi Rafał,
>>
>> What happens is that your platform has no memory to allocate a flowring for
>> tx and there is a bug in handling the returned error. Can you try it with
>> following applied. You will still have memory issue so for OpenWrt you may
>> need to limit to 256 anyway. Hante found another issue with hash_id in
>> struct brcmf_flowring so we are not entirely sure which issue caused the
>> null pointer deref so your feedback is appreciated.
>>
>> Regards,
>> Arend
>> ---
>>   drivers/net/wireless/brcm80211/brcmfmac/flowring.c | 4 ++--
>>   1 file changed, 2 insertions(+), 2 deletions(-)
>>
>> diff --git a/drivers/net/wireless/brcm80211/brcmfmac/flowring.c
>> b/drivers/net/wi
>> index 5b7a8ee..9fb50b3 100644
>> --- a/drivers/net/wireless/brcm80211/brcmfmac/flowring.c
>> +++ b/drivers/net/wireless/brcm80211/brcmfmac/flowring.c
>> @@ -151,11 +151,11 @@ u32 brcmf_flowring_create(struct brcmf_flowring *flow,
>> u8
>>                                  break;
>>                  }
>>                  if (i == flow->nrofrings)
>> -                       return -ENOMEM;
>> +                       return BRCMF_FLOWRING_INVALID_ID;
>>
>>                  ring = kzalloc(sizeof(*ring), GFP_ATOMIC);
>>                  if (!ring)
>> -                       return -ENOMEM;
>> +                       return BRCMF_FLOWRING_INVALID_ID;
>>
>>                  memcpy(hash[hash_idx].mac, mac, ETH_ALEN);
>>                  hash[hash_idx].fifo = fifo;
>
> Unfortunately this patch didn't help. I tied it on top of V3 of your
> last series plus "brcmfmac: Increase nr of supported flowrings.".

First about the warnings in core.c:1144. I believe they are fixed by one 
of the patches submitted last week [1].

Now about the problem upon start_xmit. The theory was that you had 
allocation failure leading to the null pointer deref. If you don't see 
any allocation failure on your setup that theory seems invalid. So there 
is another root cause that we need to find.

> I tried it 3 times, once I even got early NULL pointer dereference,
> when starting AP interface (before any STA connecting to it).

This seems like a different issue. Thanks for reporting. We will look 
into this.

Regards,
Arend

[1] https://patchwork.kernel.org/patch/7079891/

Re: [PATCH V2 3/7] brcmfmac: Increase nr of supported flowrings.

[Rafał Miłecki]

On 29 August 2015 at 10:13, Arend van Spriel <arend@broadcom.com> wrote:
> First about the warnings in core.c:1144. I believe they are fixed by one of
> the patches submitted last week [1].

This is correct :)


> Now about the problem upon start_xmit. The theory was that you had
> allocation failure leading to the null pointer deref. If you don't see any
> allocation failure on your setup that theory seems invalid. So there is
> another root cause that we need to find.

Let me know if you have any patches (fixing or debugging) you want me
to test. I'll be happy to help.

-- 
Rafał

Re: [PATCH V2 3/7] brcmfmac: Increase nr of supported flowrings.

[Arend van Spriel]

On 08/29/2015 11:38 AM, Rafał Miłecki wrote:
> On 29 August 2015 at 10:13, Arend van Spriel <arend@broadcom.com> wrote:
>> First about the warnings in core.c:1144. I believe they are fixed by one of
>> the patches submitted last week [1].
>
> This is correct :)
>
>
>> Now about the problem upon start_xmit. The theory was that you had
>> allocation failure leading to the null pointer deref. If you don't see any
>> allocation failure on your setup that theory seems invalid. So there is
>> another root cause that we need to find.
>
> Let me know if you have any patches (fixing or debugging) you want me
> to test. I'll be happy to help.

So can you indicate whether you have seen allocation failures or not.

Regards,
Arend

Re: [PATCH V2 3/7] brcmfmac: Increase nr of supported flowrings.

[Rafał Miłecki]

On 16 August 2015 at 08:55, Arend van Spriel <arend@broadcom.com> wrote:
> diff --git a/drivers/net/wireless/brcm80211/brcmfmac/flowring.h b/drivers/net/wireless/brcm80211/brcmfmac/flowring.h
> index 5551861..3a7d9c2 100644
> --- a/drivers/net/wireless/brcm80211/brcmfmac/flowring.h
> +++ b/drivers/net/wireless/brcm80211/brcmfmac/flowring.h
> @@ -16,7 +16,7 @@
>  #define BRCMFMAC_FLOWRING_H
>
>
> -#define BRCMF_FLOWRING_HASHSIZE                256
> +#define BRCMF_FLOWRING_HASHSIZE                512             /* has to be 2^x */
>  #define BRCMF_FLOWRING_INVALID_ID      0xFFFFFFFF

Applying patch *and* switching back to 256 let brcmfmac work again
with my BCM43602. Not sure if it helps to understand the problem much.

Re: [PATCH V2 3/7] brcmfmac: Increase nr of supported flowrings.

[Arend van Spriel]

On 08/20/2015 06:16 PM, Rafał Miłecki wrote:
> On 16 August 2015 at 08:55, Arend van Spriel <arend@broadcom.com> wrote:
>> diff --git a/drivers/net/wireless/brcm80211/brcmfmac/flowring.h b/drivers/net/wireless/brcm80211/brcmfmac/flowring.h
>> index 5551861..3a7d9c2 100644
>> --- a/drivers/net/wireless/brcm80211/brcmfmac/flowring.h
>> +++ b/drivers/net/wireless/brcm80211/brcmfmac/flowring.h
>> @@ -16,7 +16,7 @@
>>   #define BRCMFMAC_FLOWRING_H
>>
>>
>> -#define BRCMF_FLOWRING_HASHSIZE                256
>> +#define BRCMF_FLOWRING_HASHSIZE                512             /* has to be 2^x */
>>   #define BRCMF_FLOWRING_INVALID_ID      0xFFFFFFFF
>
> Applying patch *and* switching back to 256 let brcmfmac work again
> with my BCM43602. Not sure if it helps to understand the problem much.

Not to me. Maybe Hante gets some ideas, but he is ooo till monday.

Regards,
Arend

[PATCH V2 4/7] brcmfmac: add debugfs entry for msgbuf statistics

[Arend van Spriel]

From: Franky Lin <frankyl@broadcom.com>

Expose ring buffer read/write pointers and other useful statistics
through debugfs.

Reviewed-by: Arend Van Spriel <arend@broadcom.com>
Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
Signed-off-by: Franky Lin <frankyl@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
---
 drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c | 56 ++++++++++++++++++++++++
 1 file changed, 56 insertions(+)

diff --git a/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c b/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c
index 363a31e..d0e1ce5 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c
@@ -1360,6 +1360,60 @@ void brcmf_msgbuf_delete_flowring(struct brcmf_pub *drvr, u16 flowid)
 	}
 }
 
+#ifdef DEBUG
+static int brcmf_msgbuf_stats_read(struct seq_file *seq, void *data)
+{
+	struct brcmf_bus *bus_if = dev_get_drvdata(seq->private);
+	struct brcmf_pub *drvr = bus_if->drvr;
+	struct brcmf_msgbuf *msgbuf = (struct brcmf_msgbuf *)drvr->proto->pd;
+	struct brcmf_commonring *commonring;
+	u16 i;
+	struct brcmf_flowring_ring *ring;
+	struct brcmf_flowring_hash *hash;
+
+	commonring = msgbuf->commonrings[BRCMF_H2D_MSGRING_CONTROL_SUBMIT];
+	seq_printf(seq, "h2d_ctl_submit: rp %4u, wp %4u, depth %4u\n",
+		   commonring->r_ptr, commonring->w_ptr, commonring->depth);
+	commonring = msgbuf->commonrings[BRCMF_H2D_MSGRING_RXPOST_SUBMIT];
+	seq_printf(seq, "h2d_rx_submit:  rp %4u, wp %4u, depth %4u\n",
+		   commonring->r_ptr, commonring->w_ptr, commonring->depth);
+	commonring = msgbuf->commonrings[BRCMF_D2H_MSGRING_CONTROL_COMPLETE];
+	seq_printf(seq, "d2h_ctl_cmplt:  rp %4u, wp %4u, depth %4u\n",
+		   commonring->r_ptr, commonring->w_ptr, commonring->depth);
+	commonring = msgbuf->commonrings[BRCMF_D2H_MSGRING_TX_COMPLETE];
+	seq_printf(seq, "d2h_tx_cmplt:   rp %4u, wp %4u, depth %4u\n",
+		   commonring->r_ptr, commonring->w_ptr, commonring->depth);
+	commonring = msgbuf->commonrings[BRCMF_D2H_MSGRING_RX_COMPLETE];
+	seq_printf(seq, "d2h_rx_cmplt:   rp %4u, wp %4u, depth %4u\n",
+		   commonring->r_ptr, commonring->w_ptr, commonring->depth);
+
+	seq_printf(seq, "\nh2d_flowrings: depth %u\n",
+		   BRCMF_H2D_TXFLOWRING_MAX_ITEM);
+	seq_puts(seq, "Active flowrings:\n");
+	hash = msgbuf->flow->hash;
+	for (i = 0; i < msgbuf->flow->nrofrings; i++) {
+		if (!msgbuf->flow->rings[i])
+			continue;
+		ring = msgbuf->flow->rings[i];
+		if (ring->status != RING_OPEN)
+			continue;
+		commonring = msgbuf->flowrings[i];
+		hash = &msgbuf->flow->hash[ring->hash_id];
+		seq_printf(seq, "id %3u: rp %4u, wp %4u, qlen %4u, blocked %u\n"
+				"        ifidx %u, fifo %u, da %pM\n",
+				i, commonring->r_ptr, commonring->w_ptr,
+				skb_queue_len(&ring->skblist), ring->blocked,
+				hash->ifidx, hash->fifo, hash->mac);
+	}
+
+	return 0;
+}
+#else
+static int brcmf_msgbuf_stats_read(struct seq_file *seq, void *data)
+{
+	return 0;
+}
+#endif
 
 int brcmf_proto_msgbuf_attach(struct brcmf_pub *drvr)
 {
@@ -1467,6 +1521,8 @@ int brcmf_proto_msgbuf_attach(struct brcmf_pub *drvr)
 	spin_lock_init(&msgbuf->flowring_work_lock);
 	INIT_LIST_HEAD(&msgbuf->work_queue);
 
+	brcmf_debugfs_add_entry(drvr, "msgbuf_stats", brcmf_msgbuf_stats_read);
+
 	return 0;
 
 fail:
-- 
1.9.1

[PATCH V2 5/7] brcmfmac: make use of cfg80211_check_combinations()

[Arend van Spriel]

Use cfg80211_check_combinations() so we can bail out early when an
interface add or change results in an invalid combination.

Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
---
 drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c | 44 +++++++++++++++++++++-
 1 file changed, 42 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
index 17cf1bc..9c7c061 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
@@ -469,6 +469,36 @@ brcmf_find_wpsie(const u8 *parse, u32 len)
 	return NULL;
 }
 
+static int brcmf_vif_change_validate(struct brcmf_cfg80211_info *cfg,
+				     struct brcmf_cfg80211_vif *vif,
+				     enum nl80211_iftype new_type)
+{
+	int iftype_num[NUM_NL80211_IFTYPES];
+	struct brcmf_cfg80211_vif *pos;
+
+	memset(&iftype_num[0], 0, sizeof(iftype_num));
+	list_for_each_entry(pos, &cfg->vif_list, list)
+		if (pos == vif)
+			iftype_num[new_type]++;
+		else
+			iftype_num[pos->wdev.iftype]++;
+
+	return cfg80211_check_combinations(cfg->wiphy, 1, 0, iftype_num);
+}
+
+static int brcmf_vif_add_validate(struct brcmf_cfg80211_info *cfg,
+				  enum nl80211_iftype new_type)
+{
+	int iftype_num[NUM_NL80211_IFTYPES];
+	struct brcmf_cfg80211_vif *pos;
+
+	memset(&iftype_num[0], 0, sizeof(iftype_num));
+	list_for_each_entry(pos, &cfg->vif_list, list)
+		iftype_num[pos->wdev.iftype]++;
+
+	iftype_num[new_type]++;
+	return cfg80211_check_combinations(cfg->wiphy, 1, 0, iftype_num);
+}
 
 static void convert_key_from_CPU(struct brcmf_wsec_key *key,
 				 struct brcmf_wsec_key_le *key_le)
@@ -663,8 +693,14 @@ static struct wireless_dev *brcmf_cfg80211_add_iface(struct wiphy *wiphy,
 						     struct vif_params *params)
 {
 	struct wireless_dev *wdev;
+	int err;
 
 	brcmf_dbg(TRACE, "enter: %s type %d\n", name, type);
+	err = brcmf_vif_add_validate(wiphy_to_cfg(wiphy), type);
+	if (err) {
+		brcmf_err("iface validation failed: err=%d\n", err);
+		return ERR_PTR(err);
+	}
 	switch (type) {
 	case NL80211_IFTYPE_ADHOC:
 	case NL80211_IFTYPE_STATION:
@@ -823,8 +859,12 @@ brcmf_cfg80211_change_iface(struct wiphy *wiphy, struct net_device *ndev,
 	s32 ap = 0;
 	s32 err = 0;
 
-	brcmf_dbg(TRACE, "Enter, ndev=%p, type=%d\n", ndev, type);
-
+	brcmf_dbg(TRACE, "Enter, idx=%d, type=%d\n", ifp->bssidx, type);
+	err = brcmf_vif_change_validate(wiphy_to_cfg(wiphy), vif, type);
+	if (err) {
+		brcmf_err("iface validation failed: err=%d\n", err);
+		return err;
+	}
 	switch (type) {
 	case NL80211_IFTYPE_MONITOR:
 	case NL80211_IFTYPE_WDS:
-- 
1.9.1

[PATCH V2 6/7] brcmfmac: block the correct flowring when backup queue overflow

[Arend van Spriel]

From: Franky Lin <frankyl@broadcom.com>

brcmf_flowring_block blocks the last active flowring under the same
interface instead of the one provided by caller. This could lead to a
dead lock of netif stop if there are more than one flowring under the
interface and the traffic is high enough so brcmf_flowring_enqueue can
not unblock the ring right away.

Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
Signed-off-by: Franky Lin <frankyl@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
---
 drivers/net/wireless/brcm80211/brcmfmac/flowring.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/drivers/net/wireless/brcm80211/brcmfmac/flowring.c b/drivers/net/wireless/brcm80211/brcmfmac/flowring.c
index e30f8fa..5b7a8ee 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/flowring.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/flowring.c
@@ -198,11 +198,15 @@ static void brcmf_flowring_block(struct brcmf_flowring *flow, u16 flowid,
 	spin_lock_irqsave(&flow->block_lock, flags);
 
 	ring = flow->rings[flowid];
+	if (ring->blocked == blocked) {
+		spin_unlock_irqrestore(&flow->block_lock, flags);
+		return;
+	}
 	ifidx = brcmf_flowring_ifidx_get(flow, flowid);
 
 	currently_blocked = false;
 	for (i = 0; i < flow->nrofrings; i++) {
-		if (flow->rings[i]) {
+		if ((flow->rings[i]) && (i != flowid)) {
 			ring = flow->rings[i];
 			if ((ring->status == RING_OPEN) &&
 			    (brcmf_flowring_ifidx_get(flow, i) == ifidx)) {
@@ -213,8 +217,8 @@ static void brcmf_flowring_block(struct brcmf_flowring *flow, u16 flowid,
 			}
 		}
 	}
-	ring->blocked = blocked;
-	if (currently_blocked == blocked) {
+	flow->rings[flowid]->blocked = blocked;
+	if (currently_blocked) {
 		spin_unlock_irqrestore(&flow->block_lock, flags);
 		return;
 	}
-- 
1.9.1

[PATCH V2 7/7] brcmfmac: bump highest event number for 4339 firmware

[Arend van Spriel]

The event mask length is determined by the highest event number
that is specified in the driver. When this length is shorter than
firmware expects setting event mask will fail and device becomes
pretty useless. This issue was reported with bcm4339 firmware that
was recently released.

Reported-by: Pontus Fuchs <pontusf@broadcom.com>
Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
Reviewed-by: Pontus Fuchs <pontusf@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
---
 drivers/net/wireless/brcm80211/brcmfmac/fweh.h | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/drivers/net/wireless/brcm80211/brcmfmac/fweh.h b/drivers/net/wireless/brcm80211/brcmfmac/fweh.h
index cbf033f..1326898 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/fweh.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/fweh.h
@@ -85,7 +85,6 @@ struct brcmf_event;
 	BRCMF_ENUM_DEF(IF, 54) \
 	BRCMF_ENUM_DEF(P2P_DISC_LISTEN_COMPLETE, 55) \
 	BRCMF_ENUM_DEF(RSSI, 56) \
-	BRCMF_ENUM_DEF(PFN_SCAN_COMPLETE, 57) \
 	BRCMF_ENUM_DEF(EXTLOG_MSG, 58) \
 	BRCMF_ENUM_DEF(ACTION_FRAME, 59) \
 	BRCMF_ENUM_DEF(ACTION_FRAME_COMPLETE, 60) \
@@ -103,8 +102,7 @@ struct brcmf_event;
 	BRCMF_ENUM_DEF(FIFO_CREDIT_MAP, 74) \
 	BRCMF_ENUM_DEF(ACTION_FRAME_RX, 75) \
 	BRCMF_ENUM_DEF(TDLS_PEER_EVENT, 92) \
-	BRCMF_ENUM_DEF(BCMC_CREDIT_SUPPORT, 127) \
-	BRCMF_ENUM_DEF(PSTA_PRIMARY_INTF_IND, 128)
+	BRCMF_ENUM_DEF(BCMC_CREDIT_SUPPORT, 127)
 
 #define BRCMF_ENUM_DEF(id, val) \
 	BRCMF_E_##id = (val),
@@ -112,7 +110,11 @@ struct brcmf_event;
 /* firmware event codes sent by the dongle */
 enum brcmf_fweh_event_code {
 	BRCMF_FWEH_EVENT_ENUM_DEFLIST
-	BRCMF_E_LAST
+	/* this determines event mask length which must match
+	 * minimum length check in device firmware so it is
+	 * hard-coded here.
+	 */
+	BRCMF_E_LAST = 139
 };
 #undef BRCMF_ENUM_DEF
 
-- 
1.9.1

Re: [PATCH V2 0/7] brcmfmac: nvram loading and code rework

[Rafał Miłecki]

On 16 August 2015 at 08:55, Arend van Spriel <arend@broadcom.com> wrote:
> This series comprises of following changes:
> - support NVRAM loading for bcm47xx platform.
> - revise announced interface combinations and validate against it.
> - new debugfs entry for msgbuf protocol layer used with PCIe devices.
> - couple of PCIe fixes.
> - support more firmware events (for bcm4339 firmware).
>
> The series is intended for v4.3 kernel and applies to the master branch
> of the wireless-drivers-next repository.

Thanks! I'll be happy to test it with BCM43602 for regressions in 3-4
days if you can wait that much.

Re: [PATCH V2 0/7] brcmfmac: nvram loading and code rework

[Arend van Spriel]

On 08/16/2015 05:10 PM, Rafał Miłecki wrote:
> On 16 August 2015 at 08:55, Arend van Spriel <arend@broadcom.com> wrote:
>> This series comprises of following changes:
>> - support NVRAM loading for bcm47xx platform.
>> - revise announced interface combinations and validate against it.
>> - new debugfs entry for msgbuf protocol layer used with PCIe devices.
>> - couple of PCIe fixes.
>> - support more firmware events (for bcm4339 firmware).
>>
>> The series is intended for v4.3 kernel and applies to the master branch
>> of the wireless-drivers-next repository.
>
> Thanks! I'll be happy to test it with BCM43602 for regressions in 3-4
> days if you can wait that much.

You can still expect issues with multiple AP interfaces. I left one 
patch out of this series, because I am still investigating it.

Regards,
Arend

Re: [PATCH V2 0/7] brcmfmac: nvram loading and code rework

[Rafał Miłecki]

On 17 August 2015 at 10:01, Arend van Spriel <arend@broadcom.com> wrote:
> On 08/16/2015 05:10 PM, Rafał Miłecki wrote:
>>
>> On 16 August 2015 at 08:55, Arend van Spriel <arend@broadcom.com> wrote:
>>>
>>> This series comprises of following changes:
>>> - support NVRAM loading for bcm47xx platform.
>>> - revise announced interface combinations and validate against it.
>>> - new debugfs entry for msgbuf protocol layer used with PCIe devices.
>>> - couple of PCIe fixes.
>>> - support more firmware events (for bcm4339 firmware).
>>>
>>> The series is intended for v4.3 kernel and applies to the master branch
>>> of the wireless-drivers-next repository.
>>
>>
>> Thanks! I'll be happy to test it with BCM43602 for regressions in 3-4
>> days if you can wait that much.
>
>
> You can still expect issues with multiple AP interfaces. I left one patch
> out of this series, because I am still investigating it.

Thanks for info. If it's an old issue, that's fine. If it's going to
be a regression, then we shouldn't push these changes.
As I said, I just want to check for regressions :)

-- 
Rafał