[FS#330] Bt Home Hub 5 (xrx200): kernel panic at boot when LAN port is plugged

[LEDE Bugs]

For full information about what has changed in this task, visit the URL below and click the History tab.

FS#330 - Bt Home Hub 5 (xrx200): kernel panic at boot when LAN port is plugged
User who did this: Baptiste Jonglez (bjonglez)
Summary: xrx200-net: kenrel panic -> Bt Home Hub 5 (xrx200): kernel panic at boot when LAN port is plugged
Task details edited:
-------
When a LAN port of the Bt Home Hub 5 is plugged to a gigabit network, upon booting, the Bt Home Hub 5 goes into a kernel panic boot loop.  The kernel panic is either about unaligned access or unhandled paging request.

//Original report://

Bt Home Hub 5 is connected to the internet via ADSL and acquires a subnet.
The 4 ports Switch is on the fixed public IP Internet subnet, 1 port connected to WNDR3700v4 WAN port and the others to servers on fixed public IP subnet.
The red Ethernet is not connected.
Masquerading is not configured, used as proper router.
WiFi Disabled

WNDR3700v4 WAN port connected to BT Home Hub 5 Switch and assigned 1 IP in the public subnet
WNDR3700v4 4 port switch connected to local switch and other devices on local private lan.
Configured for Masquerading from LAN and WiFi to WAN.

Bt Home Hub 5 panics at boot only if:
1) the 4 port switch is connected to the WNDR3700v4 WAN port
2) WNDR3700v4 runs LEDE > r2393. I have no releases between r2393 and r2443, thus it begins to happen if I upgrade WNDR3700v4 to 2443.

It is really peculiar because a firmware upgrade on one router, WNDR3700v4, causes a panic on a Home Hub 5 type!

If I downgrade WNDR3700v4 to r2393, I can reboot the Home Hub as many times as I want and there is no panic.

Attached is the boot console log from Home Hub 5


[    3.877651] init: - preinit -
[    4.072951] Reserved instruction in kernel code[#1]:
[    4.076461] CPU: 0 PID: 391 Comm: ip Not tainted 4.4.36 #0
[    4.081940] task: 87d20f00 ti: 87f9c000 task.ti: 87f9c000
[    4.087330] $ 0   : 00000000 00000000 97ff97ff 00000000
[    4.092552] $ 4   : afffffdf 87c0f6c0 00000020 00000000
[    4.097774] $ 8   : 00000040 87e17962 00000000 00000000
[    4.102996] $12   : 10032094 7737d2b0 00000000 00400bd4
[    4.108219] $16   : 87c0f6c0 afffffdf 87c0f6c0 afffffdf
[    4.113441] $20   : 00000000 c0000000 00000020 87d14800
[    4.118664] $24   : 00000000 800285d0                  
[    4.123886] $28   : 87f9c000 87f9db68 8066c878 802e76bc
[    4.129109] Hi    : 000001cb
[    4.131981] Lo    : 00001e75
[    4.134861] epc   : 97ff97ff 0x97ff97ff
[    4.138708] ra    : 802e76bc eth_type_trans+0x30/0x210
[    4.143819] Status: 1100fc03	KERNEL EXL IE 
[    4.147999] Cause : 10800028 (ExcCode 0a)
[    4.152002] PrId  : 00019556 (MIPS 34Kc)
[    4.155916] Modules linked in: usb_storage dwc2 ledtrig_transient ehci_platform ehci_hcd sd_mod scsi_mod gpio_button_hotplug xfs libcrc32c ext4 jbd2 mbcache exportfs cryptomgr aead crypto_null crc32c_generic
[    4.174377] Process ip (pid: 391, threadinfo=87f9c000, task=87d20f00, tls=7737ee50)
[    4.182028] Stack : 87f9c000 87f9db90 8066c878 802c8904 8066cca8 71000040 87c0f6c0 8066cca8
	  00000040 80277ad8 87f380a7 00000b0e 00000000 00000000 8000003f 8049d0ac
	  8066cca8 00000020 00000008 0000012c 804e8960 87f9dbf0 fffedee6 804e0000
	  804f0000 802c8904 00001000 00000003 00000001 8048944c 804f0000 804b350c
	  804e0000 804b3898 87f9dbf0 87f9dbf0 87f9dbf8 87f9dbf8 80643f24 00000004
	  ...
[    4.217542] Call Trace:
[    4.220013] [] net_rx_action+0x118/0x2e0
[    4.224781] [] xrx200_poll_rx+0x134/0x1d8
[    4.229653] [] net_rx_action+0x118/0x2e0
[    4.234456] [] __do_softirq+0x2a0/0x2b8
[    4.239135] [] handle_level_irq+0x100/0x170
[    4.244185] [] xrx200_open+0x128/0x1e8
[    4.248808] [] ltq_hw_irqdispatch+0xa8/0xe4
[    4.253854] [] do_readpage+0x438/0x6a0
[    4.258458] [] ret_from_irq+0x0/0x4
[    4.262815] [] xrx200_open+0x128/0x1e8
[    4.267427] [] xrx200_open+0x128/0x1e8
[    4.272039] [] xrx200_open+0x144/0x1e8
[    4.276649] [] xrx200_open+0x54/0x1e8
[    4.281189] [] __dev_open+0xf0/0x1ac
[    4.285633] [] filemap_map_pages+0x250/0x2f4
[    4.290755] [] __dev_change_flags+0xc0/0x17c
[    4.295901] [] do_set_pte+0x180/0x1d4
[    4.300416] [] dev_change_flags+0x28/0x70
[    4.305286] [] dev_load+0x18/0x8c
[    4.309475] [] devinet_ioctl+0x2b4/0x8a8
[    4.314273] [] sock_ioctl+0x294/0x2f0
[    4.318788] [] do_vfs_ioctl+0x584/0x5ec
[    4.323480] [] d_instantiate+0x24/0x38
[    4.328093] [] sock_alloc_file+0xb8/0x118
[    4.332970] [] __alloc_fd+0xb0/0x208
[    4.337411] [] SyS_ioctl+0x50/0x94
[    4.341676] [] syscall_common+0x30/0x54
[    4.346373] [] __bzero+0xc4/0x164
[    4.350543] 
[    4.352017] 
Code: ffff  ffff  ffff  ffff  ffff  ffff  ffff  ffff 
[    4.358872] ---[ end trace 248345993f4ae135 ]---
[    4.365919] Kernel panic - not syncing: Fatal exception in interrupt
[    4.372104] Rebooting in 1 seconds..

 
-------
Reported Version: Trunk -> All
Status: Unconfirmed -> Researching
Priority: Very Low -> Medium

More information can be found at the following URL:
https://bugs.lede-project.org/index.php?do=details&task_id=330