"peer-unmap-event: unknown peer id 2" and kernel panic

Tue May 6 23:41:57 PDT 2014

On 2 May 2014 02:53, Avery Pennarun <apenwarr at gmail.com> wrote:
> This is with 3.2.26 kernel, mindspeed c2000 (armv7l) processor, and
> backports built using kvalo's ath-next branch, with commit
> v3.15-rc1-237-gd9bc4b9, firmware 10.1.467.2-1.
>
> Anybody else seeing errors like this?  Anything I should check for?
>
> This one happened during boot.  The driver was already loaded at the
> time; this crash happened instantly upon loading hostapd.  It doesn't
> happen every time.  I don't know how we'd have a peer already
> registered at the time (or what peer-unmap-event is).

The unknown peer id 2 is a firmware bug. Firmware sends out a
self-peer unmap event when deleting sta vdev even though the self-peer
wasn't announced to the host. This should be harmless, at least as far
as host system is concerned.

>
> [   23.939344] ath10k: peer-unmap-event: unknown peer id 2
> [   24.202125] Internal error: Oops - undefined instruction: 0 [#1] SMP
> [   24.208510] Modules linked in: ctr ccm nf_conntrack_netlink
> auto_bridge(O) fci(O) nfnetlink ath9k_htc(O) mwifiex_usb(O) mwifiex(O)
> ath10k_pci(O) ath10k_core(O) arc4 ath9k(O) mac80211(O) ath9k_common(O)
> ath9k_hw(O) ath(O) cfg80211(O) compat(O) bmoca(O) xt_connmark
> ip6table_mangle xt_CLASSIFY iptable_mangle xt_helper ip6t_REJECT
> ip6t_LOG nf_conntrack_ipv6 nf_defrag_ipv6 ip6table_filter ip6_tables
> nf_nat_rtsp nf_conntrack_rtsp nf_nat_h323 nf_conntrack_h323 nf_nat_irc
> nf_conntrack_irc nf_nat_pptp nf_conntrack_pptp nf_conntrack_proto_gre
> nf_nat_proto_gre nf_nat_sip nf_conntrack_sip nf_nat_tftp
> nf_conntrack_tftp nf_nat_ftp nf_conntrack_ftp ipt_MASQUERADE
> ipt_REJECT ipt_LOG xt_limit xt_pkttype xt_conntrack xt_tcpudp
> iptable_nat nf_nat nf_conntrack_ipv4 nf_conntrack nf_defrag_ipv4
> iptable_filter ip_tables x_tables pfe(O)
> [   24.281595] CPU: 1    Tainted: G           O  (3.2.26 #1)
> [   24.287033] PC is at 0xbc797ee4
> [   24.290194] LR is at skb_release_head_state+0x70/0xf8
> [   24.295267] pc : [<bc797ee4>]    lr : [<843114f0>]    psr: 40000013
> [   24.295272] sp : bc6f7c58  ip : bc6f7c70  fp : bc6f7c6c
> [   24.306791] r10: 00000000  r9 : bc655d5c  r8 : 8454da48
> [   24.312033] r7 : 845a53bc  r6 : 00000000  r5 : bc790e40  r4 : bc790e40
> [   24.318581] r3 : bc797d60  r2 : 00000000  r1 : 00000000  r0 : 00000000
> [   24.325131] Flags: nZcv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment user
> [   24.332288] Control: 10c53c7d  Table: 3bae404a  DAC: 00000015
> [   24.338054] Process hostapd (pid: 1788, stack limit = 0xbc6f62f0)
> [   24.344167] Stack: (0xbc6f7c58 to 0xbc6f8000)
> [   24.348538] 7c40:
>     bc790e40 bc790e40
> [   24.356745] 7c60: bc6f7c84 bc6f7c70 843111d4 8431148c 84577ca4
> bc655be0 bc6f7c9c bc6f7c88
> [   24.364952] 7c80: 84311384 843111cc bc655be0 0000002e bc6f7cac
> bc6f7ca0 8431c138 843112f4
> [   24.373158] 7ca0: bc6f7cd4 bc6f7cb0 8332b7f0 8431c100 bc655be0
> bc655500 00100100 00200200
> [   24.381365] 7cc0: bc655f18 bc655f10 bc6f7cec bc6f7cd8 8332a284
> 8332b740 00000000 bc655500
> [   24.389572] 7ce0: bc6f7d04 bc6f7cf0 83328834 8332a27c 00000000
> 00000000 bc6f7d3c bc6f7d08
> [   24.397778] 7d00: 8332520c 83328804 00000001 bc655f0c bc6f7d10
> bc655500 bc655ef8 bd06eab8
> [   24.405985] 7d20: bc654c00 00000100 bd06e3a0 bc654b00 bc6f7d54
> bc6f7d40 8332531c 83325138
> [   24.414192] 7d40: bc654b00 bc65519c bc6f7d74 bc6f7d58 832ab9a4
> 833252e8 00000000 bc65519c
> [   24.422399] 7d60: bc65519c bd06eab8 bc6f7dd4 bc6f7d78 832958ac
> 832ab92c bc6f7d94 bc6f7d88
> [   24.430605] 7d80: bd06e000 00000000 bd06e3a0 60000013 00000001
> bc654bb8 bc6f7de4 bc6f7da8
> [   24.438811] 7da0: 843343ec 843f65bc bc6f7e00 bd06e000 bc6f7e00
> 00000001 00001003 00000001
> [   24.447017] 7dc0: 00000000 00000001 bc6f7de4 bc6f7dd8 83295960
> 83295160 bc6f7dfc bc6f7de8
> [   24.455224] 7de0: 8431c68c 83295954 bd06e000 00001002 bc6f7e14
> bc6f7e00 8431c6f0 8431c604
> [   24.463430] 7e00: bd06e058 bd06e058 bc6f7e34 bc6f7e18 8431ea90
> 8431c6cc bd06e000 00001003
> [   24.471637] 7e20: 7eba9a98 bc6f7e78 bc6f7e54 bc6f7e38 8431eba0
> 8431e9ec 00008914 bd2628ac
> [   24.479844] 7e40: bc6f6000 7eba9a98 bc6f7ed4 bc6f7e58 843720ec
> 8431eb94 00000020 bd2628ac
> [   24.488049] 7e60: bd06e000 00000000 bc6f7e88 bd2628a0 00000014
> 00000000 6e616c77 00000031
> [   24.496255] 7e80: 00000000 00000000 00001002 00000000 00000000
> 00000000 00001002 00000000
> [   24.504461] 7ea0: 00000000 00000000 00000000 00008914 bf6b2bc0
> 7eba9a98 bbaf5700 8400e504
> [   24.512667] 7ec0: bc6f6000 00000000 bc6f7ee4 bc6f7ed8 84373438
> 84371dc4 bc6f7f04 bc6f7ee8
> [   24.520873] 7ee0: 843087f8 843732a8 843085ec bbaf5700 bf6b2bc0
> 7eba9a98 bc6f7f7c bc6f7f08
> [   24.529080] 7f00: 840ec364 843085f8 bf6b0558 00000008 bc6f7f2c
> bc6f7f20 fffffff7 bc6f7f80
> [   24.537286] 7f20: bc6f7f84 7eba99a4 00000129 7eba99a4 00000000
> bf4e14a0 00000129 8400e504
> [   24.545493] 7f40: bc6f6000 00000000 bc6f7fa4 bc6f7f58 8430a8b4
> 84308914 00000007 00008914
> [   24.553699] 7f60: 7eba9a98 bbaf5700 8400e504 00000000 bc6f7fa4
> bc6f7f80 840ec404 840ebdf4
> [   24.561904] 7f80: 00000024 00000000 00000001 7eba9a98 00000007
> 00000036 00000000 bc6f7fa8
> [   24.570110] 7fa0: 8400e380 840ec3d0 00000001 7eba9a98 00000007
> 00008914 7eba9a98 00001002
> [   24.578315] 7fc0: 00000001 7eba9a98 00000007 00000036 00000000
> 0000000a ffffffff 00000000
> [   24.586522] 7fe0: 0138a430 7eba9a90 00045dbc 2ae2adcc 20000010
> 00000007 00000000 00000000
> [   24.594722] Backtrace:
> [   24.597199] [<84311480>] (skb_release_head_state+0x0/0xf8) from
> [<843111d4>] (__kfree_skb+0x14/0x128)
> [   24.606447]  r5:bc790e40 r4:bc790e40
> [   24.610064] [<843111c0>] (__kfree_skb+0x0/0x128) from [<84311384>]
> (consume_skb+0x9c/0xc8)
> [   24.618353]  r4:bc655be0 r3:84577ca4
> [   24.621971] [<843112e8>] (consume_skb+0x0/0xc8) from [<8431c138>]
> (dev_kfree_skb_any+0x44/0x48)
> [   24.630697]  r5:0000002e r4:bc655be0
> [   24.634336] [<8431c0f4>] (dev_kfree_skb_any+0x0/0x48) from
> [<8332b7f0>] (ath10k_htt_rx_detach+0xbc/0x124 [ath10k_core])
> [   24.645170] [<8332b734>] (ath10k_htt_rx_detach+0x0/0x124
> [ath10k_core]) from [<8332a284>] (ath10k_htt_detach+0x14/0x8b8
> [ath10k_core])
> [   24.657308] [<8332a270>] (ath10k_htt_detach+0x0/0x8b8
> [ath10k_core]) from [<83328834>] (ath10k_core_stop+0x3c/0x48
> [ath10k_core])

I think Ben reported something similar. I have a suspicion what goes
wrong here now. The msdu_payId is read before txrx tasklet is killed
so there's a chance the clean up loop accesses an already processes
skbuff. I'll send a patch later.

Michał