brcmsmac bugs

Right now, by far the most commonly reported bugs we seem to be getting are against brcmsmac. Stretching all the way back to February 2012, we have tons of reports of where the driver gets stuck waiting for tx completion. It’s consistently at the top of the retrace server ‘hot problems’ reports.

The top of the traces always looks like this..

WARNING: at drivers/net/wireless/brcm80211/brcmsmac/main.c:7998 brcms_c_wait_for_tx_completion+0x99/0xb0 [brcmsmac]()
: warn_slowpath_common+0x7f/0xc0
: warn_slowpath_null+0x1a/0x20
: brcms_c_wait_for_tx_completion+0x99/0xb0 [brcmsmac]

What happens beneath that seems to vary. After digging through a lot of reports, we’ve closed out all the obvious dupes, so this is the list of currently open brcmsmac bugs, and their traces.

787649 F16 [abrt] kernel: WARNING: at /builddir/build/BUILD/kernel-3.2.fc16/compat-wireless-3.3-rc1-2/drivers/net/wireless/brcm80211/brcmsmac/main.c:7998 brcms_c_wait_for_tx_completion+0x99/0xb0 [brcmsmac]()
: warn_slowpath_common+0x7f/0xc0
: warn_slowpath_null+0x1a/0x20
: brcms_c_wait_for_tx_completion+0x99/0xb0 [brcmsmac]
: brcms_ops_flush+0x3b/0x60 [brcmsmac]
: ieee80211_scan_work+0x370/0x610 [mac80211]
: ? __switch_to+0xca/0x310
: ? ieee80211_scan_rx+0x1a0/0x1a0 [mac80211]
: process_one_work+0x11d/0x470
: worker_thread+0x15f/0x350
: ? manage_workers+0x230/0x230
: kthread+0x8c/0xa0
: kernel_thread_helper+0x4/0x10
: ? kthread_worker_fn+0x190/0x190
: ? gs_change+0x13/0x13

869449 F16 [abrt]: WARNING: at drivers/net/wireless/brcm80211/brcmsmac/main.c:7998 brcms_c_wait_for_tx_completion+0x99/0xb0 [brcmsmac]()
: warn_slowpath_common+0x7f/0xc0
: ? ieee80211_mgd_probe_ap.part.9+0x150/0x150 [mac80211]
: warn_slowpath_null+0x1a/0x20
: brcms_c_wait_for_tx_completion+0x99/0xb0 [brcmsmac]
: brcms_ops_flush+0x3b/0x60 [brcmsmac]
: ieee80211_mgd_probe_ap_send+0x131/0x210 [mac80211]
: ? ieee80211_cqm_rssi_notify+0x50/0xc0 [mac80211]
: ieee80211_mgd_probe_ap.part.9+0x12c/0x150 [mac80211]
: ieee80211_sta_monitor_work+0x2e/0x30 [mac80211]
: process_one_work+0x13a/0x530
: worker_thread+0x18e/0x510
: ? manage_workers+0x310/0x310
: kthread+0x93/0xa0
: kernel_thread_helper+0x4/0x10
: ? flush_kthread_worker+0xb0/0xb0
: ? gs_change+0x13/0x13

873324 F16 [abrt]: [105141.594738] WARNING: at drivers/net/wireless/brcm80211/brcmsmac/main.c:7998 brcms_c_wait_for_tx_completion+0x8a/0xa0 [brcmsmac]()
: warn_slowpath_common+0x72/0xa0
: ? brcms_c_wait_for_tx_completion+0x8a/0xa0 [brcmsmac]
: ? brcms_c_wait_for_tx_completion+0x8a/0xa0 [brcmsmac]
: warn_slowpath_null+0x22/0x30
: brcms_c_wait_for_tx_completion+0x8a/0xa0 [brcmsmac]
: brcms_ops_flush+0x30/0x50 [brcmsmac]
: ieee80211_mgd_probe_ap_send+0x11d/0x1e0 [mac80211]
: ? ieee80211_cqm_rssi_notify+0x38/0x80 [mac80211]
: ? __switch_to+0xd2/0x2a0
: ieee80211_mgd_probe_ap.part.9+0x104/0x120 [mac80211]
: ieee80211_beacon_connection_loss_work+0x84/0x130 [mac80211]
: process_one_work+0x110/0x400
: ? mod_timer+0xe2/0x1e0
: ? manage_workers+0x220/0x2d0
: ? ieee80211_sta_monitor_work+0x30/0x30 [mac80211]
: worker_thread+0x11b/0x3f0
: ? complete+0x4e/0x60
: ? manage_workers+0x2d0/0x2d0
: kthread+0x72/0x80
: ? flush_kthread_worker+0x90/0x90
: kernel_thread_helper+0x6/0x10

799168 F17 [abrt] kernel: WARNING: at drivers/net/wireless/brcm80211/brcmsmac/main.c:7998 brcms_c_wait_for_tx_completion+0x99/0xb0 [brcmsmac]()
– F17 variant of 787649

861022 F17 [abrt]: WARNING: at drivers/net/wireless/brcm80211/brcmsmac/main.c:7968 brcms_c_wait_for_tx_completion+0x8a/0xa0 [brcmsmac]()
– F17 variant of 873324
This one seems to be the most commonly reported right now.

873914 F17 [abrt]: WARNING: at drivers/net/wireless/brcm80211/brcmsmac/main.c:7998 brcms_c_wait_for_tx_completion+0x99/0xb0 [brcmsmac]()
: warn_slowpath_common+0x7f/0xc0
: warn_slowpath_null+0x1a/0x20
: brcms_c_wait_for_tx_completion+0x99/0xb0 [brcmsmac]
: brcms_ops_flush+0x3b/0x60 [brcmsmac]
: ieee80211_set_disassoc+0x2d2/0x4c0 [mac80211]
: ieee80211_mgd_deauth+0x174/0x180 [mac80211]
: ieee80211_deauth+0x18/0x20 [mac80211]
: cfg80211_mlme_deauth+0x84/0xb0 [cfg80211]
: nl80211_deauthenticate+0xb3/0xf0 [cfg80211]
: genl_rcv_msg+0x250/0x2d0
: ? genl_rcv+0x40/0x40
: netlink_rcv_skb+0xa1/0xb0
: genl_rcv+0x25/0x40
: netlink_unicast+0x19d/0x220
: netlink_sendmsg+0x2d8/0x390
: sock_sendmsg+0xbc/0xf0
: ? filemap_fault+0x113/0x480
: ? __pollwait+0xf0/0xf0
: ? mem_cgroup_update_page_stat+0x1f/0x60
: __sys_sendmsg+0x3ac/0x3c0
: ? handle_mm_fault+0x259/0x320
: ? do_page_fault+0x1bc/0x4b0
: ? __audit_syscall_exit+0x3ec/0x450
: sys_sendmsg+0x49/0x90
: system_call_fastpath+0x16/0x1b

874652 F17 [abrt]: WARNING: at drivers/net/wireless/brcm80211/brcmsmac/main.c:7998 brcms_c_wait_for_tx_completion+0x8a/0xa0 [brcmsmac]()
– F17 variant of 869449

862180 F18 WARNING: at drivers/net/wireless/brcm80211/brcmsmac/main.c:7998 brcms_c_wait_for_tx_completion+0x99/0xb0
– F18 variant of 787649

863745 F18 [abrt]: WARNING: at drivers/net/wireless/brcm80211/brcmsmac/main.c:7998 brcms_c_wait_for_tx_completion+0x99/0xb0 [brcmsmac]()
– F18 variant of 869449

So it appears that there are four unique bugs here.

I’m now curious if perhaps the timeout needs to be increased on specific chips, or even in certain circumstances (like when signal is lost).