mtk7663e的WiFi驱动异常导致内核崩溃

Question

方案：MTK7628+mtk7613b （2.4gWiFi和5.8gWiFi共存，双AP模式

sdk基于OPENWRT-19.07.10（内核版本linux-4.14.275）

问题：开启了sfe（shortcut-fe）软件加速的功能后，5.8gwifi会出现各种异常，导致内核崩溃；2.4gwifi正常

主要崩溃现象有两种：
         1. 执行ifconfig rai0 down     （rai0为5.8g网卡接口名）   内核直接崩溃，串口日志如下：

[  146.274573] wifi_sys_linkdown(), wdev idx = 0
[  146.279374] ExtEventBeaconLostHandler::FW LOG, Beacon lost (c0:ea:c3:e6:67:66), Reason 0x10
[  146.287900]   Beacon lost - AP disabled!!!
[  146.294749] bssUpdateBmcMngRate (BSS_INFO_BROADCAST_INFO), CmdBssInfoBmcRate.u2BcTransmit= 0, CmdBssInfoBmcRate.u2McTransmit = 0
[  146.308964] wifi_sys_close(), wdev idx = 0
[  146.313602] APStop(), oper(0) bssid(0)=c0:ea:c3:e6:67:66
[  146.319199] AsicSetPreTbtt(): NotSupportedFunc for this arch(HIF_MT)!
[  146.325804] MtAsicSetPiggyBack(592): Not support for HIF_MT yet!
[  146.331939] AsicDisableSync(): NotSupportedFunc for this arch(HIF_MT)!
[  146.338672] asic_bss_beacon_exit(): NotSupportedFunc for this arch(HIF_MT)!
[  146.345822] wifi_sys_close(), wdev idx = 0
[  146.350384] AsicDisableSync(): NotSupportedFunc for this arch(HIF_MT)!
[  146.367211] CmdReStartDLRsp: WiFI FW download Success
[  146.372874] RT28xxPciAsicRadioOff(): Not support for HIF_MT yet!
[  146.379049] RTMPDrvClose call RT28xxPciAsicRadioOff fail !!
[  146.384881] tx_kickout_fail_count = 0
[  146.388597] tx_timeout_fail_count = 0
[  146.392303] rx_receive_fail_count = 0
[  146.396047] alloc_cmd_msg = 1175
[  146.399316] free_cmd_msg = 1175
[  146.406649] Unhandled kernel unaligned access[#1]:
[  146.411517] CPU: 0 PID: 1729 Comm: ifconfig Not tainted 4.14.275 #0
[  146.417872] task: 851385a0 task.stack: 85bb0000
[  146.422460] $ 0   : 00000000 00000001 00000001 000f0000
[  146.427764] $ 4   : 00000001 00000001 00000001 00000002
[  146.433066] $ 8   : 00000000 8039eed0 00008514 00150011
[  146.438369] $12   : 00000001 80490000 000617d4 00000000
[  146.443671] $16   : c0b81000 c0c51000 ffffffff 00000200
[  146.448974] $20   : 85a10000 ffffffff ffffffd8 000000c0
[  146.454277] $24   : 00000002 85d82520                  
[  146.459580] $28   : 85bb0000 85bb1bb8 c0c449c0 85d7fc70
[  146.464885] Hi    : 00000000
[  146.467799] Lo    : ec4e4000
[  146.470747] epc   : 80273320 consume_skb+0x14/0x7c
[  146.476599] ra    : 85d7fc70 RTMPResetTxRxRingMemory+0x51c/0x550 [mt7663e]
[  146.483565] Status: 1100e403        KERNEL EXL IE
[  146.487813] Cause : 00800010 (ExcCode 04)
[  146.491873] BadVA : 000000ad
[  146.494788] PrId  : 00019655 (MIPS 24KEc)
[  146.498847] Modules linked in: pppoe ppp_async option l2tp_ppp usb_wwan rndis_host pppox ppp_mppe ppp_generic nf_flow_table_ipv6 nf_flow_table_ipv4 nf_flow_table_inet iptable_nat ipt_REJECT ipt_MASQUERADE cdc_ncm cdc_ether xt_time xt_tcpudp xt_state xt_nat xt_multiport xt_mark xt_mac xt_limit xt_conntrack xt_comment xt_TCPMSS xt_REDIRECT xt_LOG xt_FLOWOFFLOAD usbserial usbnet slhc nft_set_rbtree nft_set_hash nft_reject_ipv6 nft_reject_ipv4 nft_reject_inet nft_reject nft_redir_ipv4 nft_redir nft_quota nft_numgen nft_nat nft_meta nft_masq_ipv4 nft_masq nft_log nft_limit nft_flow_offload nft_exthdr nft_ct nft_counter nft_chain_route_ipv6 nft_chain_route_ipv4 nft_chain_nat_ipv4 nf_tables_ipv6 nf_tables_ipv4 nf_tables_inet nf_tables nf_reject_ipv4 nf_nat_redirect nf_nat_masquerade_ipv4 nf_conntrack_ipv4
[  146.570716]  nf_nat_ipv4 nf_log_ipv4 nf_flow_table_hw nf_flow_table nf_defrag_ipv4 nf_conntrack_rtcache nf_conntrack_netlink mt7663e MT7628 iptable_mangle iptable_filter ip_tables crc_ccitt tcp_bbr evdev ledtrig_usbport xt_set ip_set_list_set ip_set_hash_netportnet ip_set_hash_netport ip_set_hash_netnet ip_set_hash_netiface ip_set_hash_net ip_set_hash_mac ip_set_hash_ipportnet ip_set_hash_ipportip ip_set_hash_ipport ip_set_hash_ipmark ip_set_hash_ip ip_set_bitmap_port ip_set_bitmap_ipmac ip_set_bitmap_ip ip_set nfnetlink ip6table_nat nf_conntrack_ipv6 nf_defrag_ipv6 nf_nat_ipv6 ip6t_NPT ip6t_MASQUERADE nf_nat_masquerade_ipv6 nf_nat nf_conntrack nf_log_ipv6 nf_log_common ip6table_mangle ip6table_filter ip6_tables ip6t_REJECT x_tables nf_reject_ipv6 ip_gre gre l2tp_netlink l2tp_core udp_tunnel ip6_udp_tunnel
[  146.643264]  ip_tunnel nls_utf8 nls_iso8859_1 nls_cp437 shortcut_fe_ipv6 shortcut_fe sha1_generic ecb gpio_keys_polled input_polldev input_core leds_gpio ohci_platform ohci_hcd ehci_platform ehci_hcd usbcore nls_base usb_common crc16 mii aead crypto_null cryptomgr crc32c_generic crypto_hash
[  146.669419] Process ifconfig (pid: 1729, threadinfo=85bb0000, task=851385a0, tls=77fdbefc)
[  146.677790] Stack : 1100e403 00000000 00000001 c0b81000 c0b81000 85d7fc70 00000000 00000001
[  146.686275]         c0b81000 85bb1bec 006c0000 80610000 c1241000 00000007 00000002 00000200
[  146.694756]         00000200 0000a000 c0b81000 c1211000 c10c1000 85ef0000 85ef4d0c 00000007
[  146.703237]         85e43e54 859fb000 86fde800 85d24c30 859fb000 85cc37c0 85e65180 85cc62ac
[  146.711719]         c0b81000 85ca40e0 c10c1000 85ef0000 85ef4d0c c0b81000 c0b81000 85d28514
[  146.720201]         ...
[  146.722679] Call Trace:
[  146.725174] [<80273320>] consume_skb+0x14/0x7c
[  146.730625] [<85d7fc70>] RTMPResetTxRxRingMemory+0x51c/0x550 [mt7663e]
[  146.739118] [<85d24c30>] WfHifSysExit+0x14/0x48 [mt7663e]
[  146.746456] [<85ca40e0>] WfSysPosExit+0x24/0x38 [mt7663e]
[  146.753795] [<85d28514>] RTMPDrvClose+0x448/0x54c [mt7663e]
[  146.761318] [<85ddbc04>] mt_wifi_close+0x5c/0xa0 [mt7663e]
[  146.768742] [<85ddbc78>] virtual_if_deinit_handler+0x30/0x54 [mt7663e]
[  146.777219] [<85caa364>] RTMP_COM_IoctlHandle+0xb48/0x1678 [mt7663e]
[  146.785521] [<85ddbb74>] main_virtual_if_close+0x118/0x14c [mt7663e]
[  146.792907] [<80280c78>] __dev_close_many+0xb4/0xec
[  146.797858] [<80289138>] __dev_change_flags+0xc8/0x1ac
[  146.803069] [<80289244>] dev_change_flags+0x28/0x70
[  146.808018] [<80300068>] devinet_ioctl+0x2f8/0x890
[  146.812894] [<80267890>] sock_ioctl+0x300/0x35c
[  146.817506] [<800f7b9c>] do_vfs_ioctl+0x734/0x7d0
[  146.822277] [<800f7c88>] SyS_ioctl+0x50/0x98
[  146.826614] [<8001048c>] syscall_common+0x34/0x58
[  146.831384] Code: 27bdffe8  afbf0014  afb00010 <8c8300ac> 14620003  00000000  1000000a  00000000  248200ac
[  146.841288]
[  146.843140] ---[ end trace 220dbd739d5129c4 ]---
[  146.853784] Kernel panic - not syncing: FATal exception
[  146.863904] Rebooting in 3 seconds..
[04040C0B][04040C0F]
DDR Calibration DQS reg = 00008987



         2. 手机连接5.8gwifi，通过iperf打流，1到5分钟左右，内核崩溃，日志如下：

[  188.927907] CmdReStartDLRsp: WiFI FW Download Success
[  188.933108] CPU 0 Unable to handle kernel paging request at virtual address 00000004, epc == 8003bef4, ra == 8003c5e0
[  188.943859] Oops[#1]:
[  188.946168] CPU: 0 PID: 1275 Comm: kworker/0:2 Not tainted 4.14.275 #0
[  188.952795] task: 87c232a0 task.stack: 85bf0000
[  188.957383] $ 0   : 00000000 805e0000 00000000 c0c4edbc
[  188.962687] $ 4   : 85b7ff00 c0c4edb8 0b600000 00000001
[  188.967990] $ 8   : 00000001 0000f400 0000000b 00000000
[  188.973292] $12   : 00000000 80490000 000e1c16 00000000
[  188.978594] $16   : c0c4edb8 85b7ff00 8048f1c4 00000000
[  188.983897] $20   : 804a0000 8048f35c 804a0000 fffffffe
[  188.989200] $24   : 80487040 b19a8745                  
[  188.994504] $28   : 85bf0000 85bf1e70 80490000 8003c5e0
[  188.999809] Hi    : 000000a7
[  189.002724] Lo    : 3333335d
[  189.005667] epc   : 8003bef4 process_one_work+0x4c/0x418
[  189.011052] ra    : 8003c5e0 worker_thread+0x320/0x56c
[  189.016255] Status: 1100f402        KERNEL EXL
[  189.020237] Cause : 00800008 (ExcCode 02)
[  189.024295] BadVA : 00000004
[  189.027213] PrId  : 00019655 (MIPS 24KEc)
[  189.031271] Modules linked in: fast_classifier pppoe ppp_async option l2tp_ppp usb_wwan rndis_host pppox ppp_mppe ppp_generic nf_flow_table_ipv6 nf_flow_table_ipv4 nf_flow_table_inet iptable_nat ipt_REJECT ipt_MASQUERADE cdc_ncm cdc_ether xt_time xt_tcpudp xt_state xt_nat xt_multiport xt_mark xt_mac xt_limit xt_conntrack xt_comment xt_TCPMSS xt_REDIRECT xt_LOG xt_FLOWOFFLOAD usbserial usbnet slhc nft_set_rbtree nft_set_hash nft_reject_ipv6 nft_reject_ipv4 nft_reject_inet nft_reject nft_redir_ipv4 nft_redir nft_quota nft_numgen nft_nat nft_meta nft_masq_ipv4 nft_masq nft_log nft_limit nft_flow_offload nft_exthdr nft_ct nft_counter nft_chain_route_ipv6 nft_chain_route_ipv4 nft_chain_nat_ipv4 nf_tables_ipv6 nf_tables_ipv4 nf_tables_inet nf_tables nf_reject_ipv4 nf_nat_redirect nf_nat_masquerade_ipv4
[  189.102967]  nf_conntrack_ipv4 nf_nat_ipv4 nf_log_ipv4 nf_flow_table_hw nf_flow_table nf_defrag_ipv4 nf_conntrack_rtcache nf_conntrack_netlink mt7663e mt7628 iptable_mangle iptable_filter ip_tables crc_ccitt tcp_bbr evdev ledtrig_usbport xt_set ip_set_list_set ip_set_hash_netportnet ip_set_hash_netport ip_set_hash_netnet ip_set_hash_netiface ip_set_hash_net ip_set_hash_mac ip_set_hash_ipportnet ip_set_hash_ipportip ip_set_hash_ipport ip_set_hash_ipmark ip_set_hash_ip ip_set_bitmap_port ip_set_bitmap_ipmac ip_set_bitmap_ip ip_set nfnetlink ip6table_nat nf_conntrack_ipv6 nf_defrag_ipv6 nf_nat_ipv6 ip6t_NPT ip6t_MASQUERADE nf_nat_masquerade_ipv6 nf_nat nf_conntrack nf_log_ipv6 nf_log_common ip6table_mangle ip6table_filter ip6_tables ip6t_REJECT x_tables nf_reject_ipv6 ip_gre gre l2tp_netlink l2tp_core
[  189.174812]  udp_tunnel ip6_udp_tunnel ip_tunnel nls_utf8 nls_iso8859_1 nls_cp437 shortcut_fe_ipv6 shortcut_fe sha1_generic ecb gpio_keys_polled input_polldev input_core leds_gpio ohci_platform ohci_hcd ehci_platform ehci_hcd usbcore nls_base usb_common crc16 mii aead crypto_null cryptomgr crc32c_generic crypto_hash
[  189.203261] Process kworker/0:2 (pid: 1275, threadinfo=85bf0000, task=87c232a0, tls=00000000)
[  189.211896] Stack : 8048f35c 8048f1d8 804a0000 8048f35c 804a0000 fffffffe 85b7ff00 8048f1c4
[  189.220379]         85b7ff18 8048f1d8 804a0000 8048f35c 804a0000 8003c5e0 805e0000 87492A80
[  189.228860]         855fcd00 874b6100 87c2fdf0 80490000 8048f518 80434fb8 855fcd00 874b6100
[  189.237343]         87c2fdf0 85b7ff00 8003c2c0 80430000 805e0000 87492a80 00000000 800419b4
[  189.245826]         00000000 00000000 00000000 8004188c 855fcd00 87c2fdf0 8004188c 855fcd00
[  189.254307]         ...
[  189.256786] Call Trace:
[  189.259271] [<8003bef4>] process_one_work+0x4c/0x418
[  189.264308] [<8003c5e0>] worker_thread+0x320/0x56c
[  189.269171] [<800419b4>] kthread+0x128/0x13c
[  189.273507] [<80005a98>] ret_from_kernel_thread+0x14/0x1c
[  189.278982] Code: 02629824  00009825  8e320024 <8e630004> 8e42000c  8c740080  30420004  1440000e  32940020
[  189.288883]
[  189.291231] ---[ end trace 723d9cd3265cffbf ]---
[  189.302132] Kernel panic - not syncing: Fatal exception
[  189.312372] Rebooting in 3 seconds..

Answer 1

引用GPT4，您可以先参考下！
这种问题往往需要通过两个方面来排查：

1.驱动代码的问题：检查网络驱动代码中是否有内存泄露、越界访问等问题。要查找这类问题，首先需要对驱动代码有一定的熟悉程度，然后通过调试、日志输出等方式查找问题。像你描述的第一个问题，看起来就像是驱动在停止设备时，访问了已经被释放的内存。

2.硬件或者固件的问题：有可能是Wi-Fi芯片的固件不稳定导致的，也可能是硬件设计存在问题。可以查看一下硬件供应商是否有新的驱动版本或者固件版本，然后更新一下看看问题是否可以解决。

此外，如果你开启了sfe（shortcut-fe）软件加速后，发生了驱动异常和内核崩溃的问题，你可能需要关闭sfe来试试看。sfe是一种网络加速技术，但是它可能会对网络数据包进行一些处理，导致驱动程序无法正确地处理这些数据包。

最后，由于这种问题的定位可能变得复杂和耗时，如果你没有足够的经验进行排错，可能需要寻求专业人士的帮助。如果这个问题是出现在商业项目中，最好是直接联系硬件供应商的技术支持。