AM620-Q1: High temperature 85 degrees Celsius WIFI/ETH iperf test, wifi/ETH driver crash issue

Tool/software:

Hi, Dear Expert

Current SDK version is Processor SDK 10.00.07.04.  This issue is normal in 25 degrees Celsius.

dump stack msg:

[32911.023469] Unable to handle kernel paging request at virtual address 000000000bff9634

[32911.031499] Mem abort info:

[32911.034400]   ESR = 0x0000000096000006

[32911.038183]   EC = 0x25: DABT (current EL), IL = 32 bits

[32911.043520]   SET = 0, FnV = 0

[32911.046595]   EA = 0, S1PTW = 0

[32911.046601]   FSC = 0x06: level 2 translation fault

[32911.046607] Data abort info:

[32911.046609]   ISV = 0, ISS = 0x00000006, ISS2 = 0x00000000

[32911.063002]   CM = 0, WnR = 0, TnD = 0, TagAccess = 0

[32911.063011]   GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0

[32911.063017] user pgtable: 4k pages, 48-bit VAs, pgdp=000000008bdde000

[32911.079846] [000000000bff9634] pgd=080000008a46a003, p4d=080000008a46a003, pud=080000008bfdc003, pmd=0000000000000000

[32911.090595] Internal error: Oops: 0000000096000006 [#1] PREEMPT SMP

[32911.096871] Modules linked in: iptable_filter iptable_nat xt_MASQUERADE nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 libcrc32c ip_tables x_tables wlan_mt7961_sdio rpmsg_ctrl rpmsg_char mtprealloc realtek ti_k3_r5_remoteproc rtc_ti_k3 ti_k3_m4_remoteproc rti_wdt tps65219_pwrbutton sa2ul authenc mcrc64 tps6598x typec cfg80211 cryptodev(O) fuse ipv6

[32911.128040] CPU: 1 PID: 1149 Comm: hif_thread Tainted: G           O       6.6.32-ti #1

[32911.128056] Hardware name: Texas Instruments AM62x LP SK (DT)

[32911.128062] pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)

[32911.128070] pc : halDeAggRxPktProc+0x2b8/0x720 [wlan_mt7961_sdio]

[32911.154842] lr : halDeAggRxPktProc+0x2a8/0x720 [wlan_mt7961_sdio]

[32911.161259] sp : ffff8000828b3b90

[32911.164581] x29: ffff8000828b3c20 x28: 0000000000000638 x27: ffff8000825dd060

[32911.164604] x26: 000000000000000c x25: 0000000000000010 x24: ffff800081c03950

[32911.164614] x23: ffff800084c21000 x22: ffff800079354d10 x21: 0000000000000634

[32911.164624] x20: ffff8000825e0580 x19: ffff00000b186380 x18: 0000000000000001

[32911.164634] x17: ffff7fff9b1af000 x16: 0000000000000111 x15: 4e06857876ae14f9

[32911.164644] x14: af70d649292f9a13 x13: c32132c689ea1588 x12: 4e06857876ae14f9

[32911.164654] x11: 000000505d047801 x10: 0c79dfffb5becdef x9 : 35e3daac95d4271d

[32911.164664] x8 : 5d790864c9988d80 x7 : 6e5ee65bf8ff220c x6 : c32132c689ea1588

[32911.221606] x5 : ffff00000bf196b8 x4 : 0000000000000637 x3 : ffff00000bf19640

[32911.221623] x2 : ffffffffffffffe8 x1 : 000000000000018d x0 : ff0000000bff9000

[32911.221634] Call trace:

[32911.221641]  halDeAggRxPktProc+0x2b8/0x720 [wlan_mt7961_sdio]

[32911.244130]  halDeAggRxPkt+0x20/0x90 [wlan_mt7961_sdio]

[32911.244444]  halRxSDIOAggReceiveRFBs+0x30c/0x540 [wlan_mt7961_sdio]

[32911.255926]  halProcessRxInterrupt+0x24/0x30 [wlan_mt7961_sdio]

[32911.262099]  nicProcessRxInterrupt+0x54/0x90 [wlan_mt7961_sdio]

[32911.268243]  nicProcessIST_impl+0x5c/0xe8 [wlan_mt7961_sdio]

[32911.274120]  nicProcessIST+0x5c/0x110 [wlan_mt7961_sdio]

[32911.279647]  wlanIST+0x50/0xac [wlan_mt7961_sdio]

[32911.284575]  hif_thread+0x31c/0x498 [wlan_mt7961_sdio]

[32911.284855]  kthread+0x110/0x114

[32911.293210]  ret_from_fork+0x10/0x20

[32911.296798] Code: 39020360 11000ea4 f9401760 d3424081 (b8617803)

[32911.302888] ---[ end trace 0000000000000000 ]---

a. The abnormal instruction viewed from the crash log is as follows（wlan_mt7961_sdio.S）:

211089 00000000000c9c78 <halDeAggRxPktProc>:

211262    c9f28:       f9401760        ldr     x0, [x27, #40]

211263    c9f2c:       d3424081        ubfx    x1, x4, #2, #15

211264    c9f30:       b8617803        ldr     w3, [x0, x1, lsl #2]

b、Corresponding to the issue with C code, line 2914 in hal_api.c：

void halDeAggRxPktProc(struct ADAPTER *prAdapter,

                                           struct SDIO_RX_COALESCING_BUF *prRxBuf)

…

                                          kalMemCopy(prSwRfb->pucRecvBuff, pucSrcAddr,

                                                     ALIGN_4(u2PktLength + HIF_RX_HW_APPENDED_LEN));

…

#if CFG_TCP_IP_CHKSUM_OFFLOAD

                                          pu4HwAppendDW = (uint32_t *) prSwRfb->prRxStatus;

                                          pu4HwAppendDW += (ALIGN_4(u2PktLength) >> 2);

                                          prSwRfb->u4TcpUdpIpCksStatus = *pu4HwAppendDW;

                                          DBGLOG(RX, TRACE, "u4TcpUdpIpCksStatus[0x%02x]\n",

                                                     prSwRfb->u4TcpUdpIpCksStatus);

#endif /* CFG_TCP_IP_CHKSUM_OFFLOAD */

d.ff0000000bff9000, VA BITS is 48, the top 16 bits of the kernel space address should be 0xffff, but now it has changed to 0xff00 under some circumstances. How should we locate it?

c. more logs see attachs.

Thanks,

Xiulin Liu