libertas (sd8385/8686) and iMX51 (again)

[William To]

Dear All,

Last time I asked whether anybody here has used libertas driver (sd8385/86860 with the iMX51. Thanks very much for all your help on this issue. I was caught up with something else for the past 2 weeks and I didn't have time to look into this problem further. I think I have found the location of the kernel panic, but I don't know how to solve it. 

Here is the debug log:

# insmod /system/lib/modules/libertas.ko
# insmod /system/lib/modules/libertas_sdio.ko
libertas_sdio: Libertas SDIO driver
libertas_sdio: Copyright Pierre Ossman
Build at Jun  9 2010 11:42:25
libertas_sdio mmc1:0001:1: firmware: requesting sd8385_helper.bin
init: untracked pid 2235 exited
libertas_sdio mmc1:0001:1: firmware: requesting sd8385.bin
init: untracked pid 2238 exited
libertas: command 0x0003 timed out
libertas: requeueing command 0x0003 due to timeout (#1)
===if_sdio_interrupt():784, func=da2cfc00
===if_sdio_interrupt():787, card=dab80000
===if_sdio_interrupt():794, ret=0
===if_sdio_interrupt():802
===if_sdio_interrupt():808
===if_sdio_interrupt():810
===if_sdio_interrupt():815
===if_sdio_card_to_host():257
===if_sdio_card_to_host():261
===if_sdio_card_to_host():268
===if_sdio_card_to_host():282
===if_sdio_card_to_host():289
===if_sdio_card_to_host():293
===if_sdio_card_to_host():296
===if_sdio_card_to_host():299
===if_sdio_card_to_host():306
===if_sdio_card_to_host():312, type=1, card=dab80000, card->buffer=dab80018
if_sdio_handle_cmd():140, card->priv=dab7c380, buffer=dab8001c
if_sdio_handle_cmd():149, priv->driver_lock=dab7e0f0
if_sdio_handle_cmd():152
if_sdio_handle_cmd():154, i=1, priv->resp_len=dab7e0d4, priv->resp_len[i]=00000000
if_sdio_handle_cmd():156
if_sdio_handle_cmd():158
if_sdio_handle_cmd():160
if_sdio_handle_cmd():162
if_sdio_handle_cmd()164
===if_sdio_interrupt():817
libertas: Received result 0 to command 3 after 1 retries
===if_sdio_interrupt():784, func=da2cfc00
===if_sdio_interrupt():787, card=dab80000
===if_sdio_interrupt():794, ret=0
===if_sdio_interrupt():802
===if_sdio_interrupt():815
===if_sdio_card_to_host():257
===if_sdio_card_to_host():261
===if_sdio_card_to_host():268
libertas: 00:12:cf:2b:98:72, fw 5.0.11p0, cap 0x00000303
===if_sdio_card_to_host():282
===if_sdio_card_to_host():289
===if_sdio_card_to_host():293
===if_sdio_card_to_host():296
===if_sdio_card_to_host():299
===if_sdio_card_to_host():306
===if_sdio_card_to_host():312, type=1, card=dab80000, card->buffer=dab80018
if_sdio_handle_cmd():140, card->priv=dab7c380, buffer=dab8001c
if_sdio_handle_cmd():149, priv->driver_lock=dab7e0f0
if_sdio_handle_cmd():152
if_sdio_handle_cmd():154, i=0, priv->resp_len=dab7e0d4, priv->resp_len[i]=00000000
if_sdio_handle_cmd():156
if_sdio_handle_cmd():158
if_sdio_handle_cmd():160
if_sdio_handle_cmd():162
if_sdio_handle_cmd()164
===if_sdio_interrupt():817
===if_sdio_interrupt():784, func=da2cfc00
===if_sdio_interrupt():787, card=dab80000
===if_sdio_interrupt():794, ret=0
===if_sdio_interrupt():802
===if_sdio_interrupt():808
===if_sdio_interrupt():810
===if_sdio_interrupt():815
===if_sdio_card_to_host():257
===if_sdio_card_to_host():261
===if_sdio_card_to_host():268
===if_sdio_card_to_host():282
===if_sdio_card_to_host():289
===if_sdio_card_to_host():293
===if_sdio_card_to_host():296
===if_sdio_card_to_host():299
===if_sdio_card_to_host():306
===if_sdio_card_to_host():312, type=1, card=dab80000, card->buffer=dab80018
if_sdio_handle_cmd():140, card->priv=dab7c380, buffer=dab8001c
if_sdio_handle_cmd():149, priv->driver_lock=dab7e0f0
if_sdio_handle_cmd():152
if_sdio_handle_cmd():154, i=1, priv->resp_len=dab7e0d4, priv->resp_len[i]=00000000
if_sdio_handle_cmd():156
if_sdio_handle_cmd():158
if_sdio_handle_cmd():160
if_sdio_handle_cmd():162
if_sdio_handle_cmd()164
===if_sdio_interrupt():817
===if_sdio_interrupt():784, func=da2cfc00
===if_sdio_interrupt():787, card=dab80000
===if_sdio_interrupt():794, ret=0
===if_sdio_interrupt():802
===if_sdio_interrupt():808
===if_sdio_interrupt():810
===if_sdio_interrupt():815
===if_sdio_card_to_host():257
===if_sdio_card_to_host():261
===if_sdio_card_to_host():268
===if_sdio_card_to_host():282
===if_sdio_card_to_host():289
===if_sdio_card_to_host():293
===if_sdio_card_to_host():296
===if_sdio_card_to_host():299
===if_sdio_card_to_host():306
===if_sdio_card_to_host():312, type=1, card=dab80000, card->buffer=dab80018
if_sdio_handle_cmd():140, card->priv=dab7c380, buffer=dab8001c
if_sdio_handle_cmd():149, priv->driver_lock=dab7e0f0
if_sdio_handle_cmd():152
if_sdio_handle_cmd():154, i=0, priv->resp_len=dab7e0d4, priv->resp_len[i]=0000002e
Unable to handle kernel NULL pointer dereference at virtual address 00000000
pgd = c0004000
[00000000] *pgd=00000000
Internal error: Oops: 817 [#1] PREEMPT
Modules linked in: libertas_sdio(+) libertas gpu_z430(P)
CPU: 0    Tainted: P            (2.6.28-00580-g87cd054-dirty #24)
PC is at if_sdio_interrupt+0x5e0/0xbc4 [libertas_sdio]
LR is at release_console_sem+0x210/0x240
pc : [<bf04e78c>]    lr : [<c0051aa0>]    psr: 20000193
sp : daafff48  ip : daaffe78  fp : daafff8c
r10: 0000000c  r9 : dab8001c  r8 : dab7c380
r7 : 00001d54  r6 : 60000113  r5 : 00000000  r4 : dab7c380
r3 : 00000000  r2 : 00000001  r1 : 000041d0  r0 : 00000056
Flags: nzCv  IRQs off  FIQs on  Mode SVC_32  ISA ARM  Segment kernel
Control: 10c5387d  Table: aa2dc018  DAC: 00000017
Process ksdioirqd/mmc1 (pid: 2234, stack limit = 0xdaafe2e0)
Stack: (0xdaafff48 to 0xdab00000)
ff40:                   dab7e0d4 0000002e 00000000 00000195 00000000 00000000
ff60: 00000000 00000000 da21dc00 da376000 da376000 00000001 7fffffff 00000000
ff80: daafffd4 daafff90 c027965c bf04e1b8 00000000 daafffa7 00000001 daafe000
ffa0: 00000001 02afffb0 c0357928 daafe000 da21dc00 c0279564 00000000 00000000
ffc0: 00000000 00000000 daaffff4 daafffd8 c0066fbc c0279570 00000000 00000000
ffe0: 00000000 00000000 00000000 daaffff8 c00541f8 c0066f6c 90881021 90881421
Backtrace:
[<bf04e1ac>] (if_sdio_interrupt+0x0/0xbc4 [libertas_sdio]) from [<c027965c>] (sd
io_irq_thread+0xf8/0x224)
[<c0279564>] (sdio_irq_thread+0x0/0x224) from [<c0066fbc>] (kthread+0x5c/0x94)
[<c0066f60>] (kthread+0x0/0x94) from [<c00541f8>] (do_exit+0x0/0x7a4)
 r6:00000000 r5:00000000 r4:00000000
Code: e7943007 e3530000 0a000002 e3a03000 (e5833000)
Kernel panic - not syncing: Fatal exception
libertas: command 0x0028 timed out

I think the driver does have some form of checking so that it make sures priv->resp_len[i]==0x00000000, but the length received is 0x2e. 

Thanks very much and Best Regards

William To