Bluetooth: hci_bcm: Unable to handle kernel NULL pointer dereference in Linux 4.15rc4

Fri Dec 22 11:57:22 PST 2017

Hi,

i'm working on Bluetooth support for Raspberry Pi Zero W (BCM43438) [1]. After enabling the driver and the DT stuff, i will get a NULL pointer dereference during boot of Linux 4.15-rc4:

[   14.934216] Bluetooth: HCI UART driver ver 2.3
[   14.934231] Bluetooth: HCI UART protocol H4 registered
[   14.934912] hci_uart_bcm serial0-0: BCM irq: -22
[   14.935147] uart-pl011 20201000.serial: no DMA platform data
[   14.948218] Unable to handle kernel NULL pointer dereference at virtual address 00000000
[   14.948238] pgd = a8969859
[   14.948247] [00000000] *pgd=00000000
[   14.948272] Internal error: Oops: 5 [#1] ARM
[   14.948279] Modules linked in: hci_uart(+) btbcm bcm2835_rng rng_core
[   14.948323] CPU: 0 PID: 149 Comm: kworker/u3:1 Tainted: G        W        4.15.0-rc4+ #4
[   14.948327] Hardware name: BCM2835
[   14.948363] Workqueue: hci0 hci_cmd_work
[   14.948499] PC is at hci_uart_tx_wakeup+0x20/0xfc [hci_uart]
[   14.948560] LR is at hci_uart_send_frame+0x64/0x78 [hci_uart]
[   14.948570] pc : [<bf018074>]    lr : [<bf019448>]    psr: 20000013
[   14.948579] sp : d8df9e90  ip : d8df9ea8  fp : d8df9ea4
[   14.948585] r10: 00000000  r9 : 00000000  r8 : d96e8700
[   14.948594] r7 : c0c14a40  r6 : d97d3000  r5 : d96e8c48  r4 : d96e8c10
[   14.948601] r3 : 00000000  r2 : 20000013  r1 : d97ae540  r0 : d96e8c10
[   14.948613] Flags: nzCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment none
[   14.948623] Control: 00c5387d  Table: 19748008  DAC: 00000051
[   14.948641] Process kworker/u3:1 (pid: 149, stack limit = 0x0b8b6dd4)
[   14.948654] Stack: (0xd8df9e90 to 0xd8dfa000)
[   14.948668] 9e80:                                     d97ae540 d96e8c10 d8df9ec4 d8df9ea8
[   14.948689] 9ea0: bf019448 bf018060 d97ae540 d97d3000 d97ae540 d97d3000 d8df9ee4 d8df9ec8
[   14.948707] 9ec0: c0687a6c bf0193f0 c0596408 c0592050 d97d3700 d97ae540 d8df9f0c d8df9ee8
[   14.948724] 9ee0: c0687b4c c06879d4 00000000 d8df9ef4 d8df9f44 d8e04a80 d97d3700 d8edb000
[   14.948742] 9f00: d8df9f44 d8df9f10 c0133e78 c0687acc d8edb000 c0c14a40 c0c14a40 d8e04a80
[   14.948760] 9f20: d8edb000 d8edb000 c0c14a40 c0c14a40 d8edb014 d8e04a98 d8df9f7c d8df9f48
[   14.948778] 9f40: c0134d0c c0133c80 d8ee05d8 d8e04a80 c0134a2c d8ee05c0 d8ee0540 d8defea4
[   14.948796] 9f60: d8ee05d8 d8e04a80 c0134a2c 00000000 d8df9fac d8df9f80 c0139768 c0134a38
[   14.948811] 9f80: d8df8000 d8ee0540 c013962c 00000000 00000000 00000000 00000000 00000000
[   14.948827] 9fa0: 00000000 d8df9fb0 c0107e88 c0139638 00000000 00000000 00000000 00000000
[   14.948841] 9fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[   14.948856] 9fe0: 00000000 00000000 00000000 00000000 00000013 00000000 912f0073 00001877
[   14.949017] [<bf018074>] (hci_uart_tx_wakeup [hci_uart]) from [<bf019448>] (hci_uart_send_frame+0x64/0x78 [hci_uart])
[   14.949103] [<bf019448>] (hci_uart_send_frame [hci_uart]) from [<c0687a6c>] (hci_send_frame+0xa4/0xf8)
[   14.949134] [<c0687a6c>] (hci_send_frame) from [<c0687b4c>] (hci_cmd_work+0x8c/0x120)
[   14.949166] [<c0687b4c>] (hci_cmd_work) from [<c0133e78>] (process_one_work+0x204/0x380)
[   14.949194] [<c0133e78>] (process_one_work) from [<c0134d0c>] (worker_thread+0x2e0/0x450)
[   14.949228] [<c0134d0c>] (worker_thread) from [<c0139768>] (kthread+0x13c/0x158)
[   14.949270] [<c0139768>] (kthread) from [<c0107e88>] (ret_from_fork+0x14/0x2c)
[   14.949290] Code: e8bd4000 e1a04000 e2805038 e5903058 (e5932000) 
[   14.949310] ---[ end trace e0ebe7d9031c01b2 ]---
[   15.155799] Bluetooth: HCI UART protocol Broadcom registered
[   16.435744] brcmfmac: brcmf_fw_map_chip_to_name: using brcm/brcmfmac43430-sdio.bin for chip 0x00a9a6(43430) rev 0x000001
[   16.649373] brcmfmac mmc1:0001:1: Direct firmware load for brcm/brcmfmac43430-sdio.clm_blob failed with error -2
[   16.651160] brcmfmac: brcmf_c_preinit_dcmds: Firmware version = wl0: Aug  7 2017 00:46:29 version 7.45.41.46 (r666254 CY) FWID 01-f8a78378
[   18.023283] EXT4-fs (mmcblk0p2): re-mounted. Opts: (null)
[   21.041766] systemd-journald[97]: Received request to flush runtime journal from PID 1
[   25.446589] Bluetooth: hci0: BCM: failed to write update baudrate (-110)
[   25.474412] Bluetooth: hci0: Failed to set baudrate
[   35.686592] Bluetooth: hci0: BCM: Reset failed (-110)

Here are the relevant config settings:

CONFIG_BT_BCM=m
CONFIG_BT_HCIUART=m
CONFIG_BT_HCIUART_SERDEV=y
CONFIG_BT_HCIUART_H4=y
CONFIG_BT_HCIUART_BCM=y
CONFIG_SERIAL_DEV_BUS=y
CONFIG_SERIAL_DEV_CTRL_TTYPORT=y
CONFIG_TTY_PRINTK=y

It looks like the issue exists on RPI3 too [2].

[1] - https://github.com/lategoodbye/rpi-zero/commits/bcm2835-rpi-zero-w-bt
[2] - https://bugzilla.redhat.com/show_bug.cgi?id=1520099