Kernel panic and Bluetooth degradation on ConnectCore MP25 (DEY Yocto)

Embedded Devices Linux
, , ,
1

Hello,

I am working with the Digi Embedded Yocto distribution on a ConnectCore MP25 platform, following the official tutorial:
Install Digi Embedded Yocto | ConnectCore MP25

The system is based on the dey-image-webkit image.

Observed Behavior

  • Initially, Bluetooth communication works correctly.

  • After a few minutes:

    • The number of received packets progressively decreases.

    • Communication becomes unreliable.

  • Eventually:

    • The system triggers a kernel panic.

    • Bluetooth communication completely stops

Here’s the complete kernel log :

[ 690.252572] Unable to handle kernel paging request at virtual address dead000000000108
[ 690.254944] Mem abort info:
[ 690.257770] ESR = 0x0000000096000044
[ 690.261500] EC = 0x25: DABT (current EL), IL = 32 bits
[ 690.266838] SET = 0, FnV = 0
[ 690.269962] EA = 0, S1PTW = 0
[ 690.273085] FSC = 0x04: level 0 translation fault
[ 690.278016] Data abort info:
[ 690.280835] ISV = 0, ISS = 0x00000044, ISS2 = 0x00000000
[ 690.286368] CM = 0, WnR = 1, TnD = 0, TagAccess = 0
[ 690.291500] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
[ 690.296834] [dead000000000108] address between user and kernel address ranges
[ 690.303976] Internal error: Oops: 0000000096000044 [ 1] PREEMPT SMP
[ 690.310317] Modules linked in: hci_uart btbcm brcmfmac_cyw brcmfmac brcmutil galcore(O) stm32_dcmipp stm32_csi stm32_lptimer stm32_crc32 stm32_cryp crypto_engine spi_stm32 optee_rng nfnetlink
[ 690.327469] CPU: 0 PID: 10 Comm: kworker/0:1 Tainted: G O 6.6.78-dey-gf582bf40eaa4-dirty 1
[ 690.337328] Hardware name: Digi International ConnectCore MP25 Development Kit (DT)
[ 690.344973] Workqueue: pm pm_runtime_work
[ 690.349017] pstate: 200000c5 (nzCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=–)
[ 690.356063] pc : vchan_tx_submit+0x58/0x8c
[ 690.360201] lr : vchan_tx_submit+0x28/0x8c
[ 690.364235] sp : ffff800081b1bba0
[ 690.367657] x29: ffff800081b1bba0 x28: 0000000000000000 x27: 0000000000000000
[ 690.374809] x26: ffff000005ed34f4 x25: 0000000000000000 x24: 0000000000000000
[ 690.381960] x23: 0000000000000000 x22: ffff000006abfd80 x21: ffff000005ea46a0
[ 690.389212] x20: 00000000000001ba x19: ffff0000123880c0 x18: 0000000000000000
[ 690.396363] x17: 0000000000000000 x16: 0000000000000000 x15: 0000376c62d55142
[ 690.403515] x14: ffff000005edb010 x13: 0000000000000000 x12: 0000000000000001
[ 690.410766] x11: 0000000000000000 x10: 0000000000000001 x9 : 0000000000000002
[ 690.417917] x8 : ffff000005ea4748 x7 : 0000000000084000 x6 : 0000000000000800
[ 690.425068] x5 : ffff000005ea4758 x4 : dead000000000100 x3 : dead000000000122
[ 690.432320] x2 : ffff000012388138 x1 : 0000000000000000 x0 : ffff000005ea4740
[ 690.439473] Call trace:
[ 690.441893] vchan_tx_submit+0x58/0x8c
[ 690.445727] stm32_usart_rx_dma_start_or_resume+0xd8/0x234
[ 690.451271] stm32_usart_runtime_resume+0x78/0xe8
[ 690.455908] pm_generic_runtime_resume+0x2c/0x44
[ 690.460643] __genpd_runtime_resume+0x30/0x80
[ 690.464976] genpd_runtime_resume+0x110/0x244
[ 690.469410] __rpm_callback+0x48/0x1d8
[ 690.473142] rpm_callback+0x6c/0x78
[ 690.476671] rpm_resume+0x490/0x6b4
[ 690.480102] pm_runtime_work+0x84/0xc8
[ 690.483933] process_one_work+0x144/0x29c
[ 690.487970] worker_thread+0x31c/0x434
[ 690.491703] kthread+0x110/0x114
[ 690.494934] ret_from_fork+0x10/0x20
[ 690.498571] Code: 1a9fc694 b9001074 b8078454 a9478e64 (f9000483)
[ 690.504708] —[ end trace 0000000000000000 ]—
[ 690.509337] note: kworker/0:1[10] exited with irqs disabled
[ 690.515075] note: kworker/0:1[10] exited with preempt_count 1
[ 690.515217] Bluetooth: hci0: Frame reassembly failed (-90)
[ 703.508334] Bluetooth: hci0: command tx timeout
[ 718.516874] Bluetooth: hci0: command tx timeout
[ 733.525017] Bluetooth: hci0: command tx timeout
[ 748.533392] Bluetooth: hci0: command tx timeout
[ 763.545749] Bluetooth: hci0: command tx timeout
[ 778.551855] Bluetooth: hci0: command tx timeout
[ 793.559498] Bluetooth: hci0: command tx timeout
[ 808.567183] Bluetooth: hci0: command tx timeout
[ 810.743145] brcmfmac: brcmf_sdio_bus_rxctl: resumed on timeout
[ 810.743415] brcmfmac: brcmf_fil_cmd_data: cmd error -110, resend cmd count 1
[ 813.302925] brcmfmac: brcmf_sdio_bus_rxctl: resumed on timeout
[ 813.303181] brcmfmac: brcmf_fil_cmd_data: cmd error -110, resend cmd count 2
[ 815.863251] brcmfmac: brcmf_sdio_bus_rxctl: resumed on timeout
[ 815.863501] brcmfmac: brcmf_fil_cmd_data: cmd error -110, resend cmd count 3
[ 818.423315] brcmfmac: brcmf_sdio_bus_rxctl: resumed on timeout
[ 820.983369] brcmfmac: brcmf_sdio_bus_rxctl: resumed on timeout
[ 820.983624] brcmfmac: brcmf_fil_cmd_data: cmd error -110, resend cmd count 1
[ 823.543357] Bluetooth: hci0: command tx timeout
[ 823.543352] brcmfmac: brcmf_sdio_bus_rxctl: resumed on timeout
[ 823.548152] brcmfmac: brcmf_fil_cmd_data: cmd error -110, resend cmd count 2
[ 826.103381] brcmfmac: brcmf_sdio_bus_rxctl: resumed on timeout
[ 826.103636] brcmfmac: brcmf_fil_cmd_data: cmd error -110, resend cmd count 3
[ 828.663438] brcmfmac: brcmf_sdio_bus_rxctl: resumed on timeout
[ 828.663700] ieee80211 phy0: brcmf_run_escan: error (-110)
[ 828.669187] ieee80211 phy0: brcmf_cfg80211_scan: scan error (-110)
[ 838.551836] Bluetooth: hci0: command tx timeout
[ 853.559957] Bluetooth: hci0: command tx timeout
[ 868.568308] Bluetooth: hci0: command tx timeout
[ 883.576913] Bluetooth: hci0: command tx timeout
[ 898.589453] Bluetooth: hci0: command tx timeout
[ 913.593457] Bluetooth: hci0: command tx timeout
[ 928.601982] Bluetooth: hci0: command tx timeout
[ 931.577927] brcmfmac: brcmf_sdio_bus_rxctl: resumed on timeout
[ 931.578177] brcmfmac: brcmf_fil_cmd_data: cmd error -110, resend cmd count 1
[ 934.138033] brcmfmac: brcmf_sdio_bus_rxctl: resumed on timeout
[ 934.138287] brcmfmac: brcmf_fil_cmd_data: cmd error -110, resend cmd count 2
[ 936.698196] brcmfmac: brcmf_sdio_bus_rxctl: resumed on timeout
[ 936.698459] brcmfmac: brcmf_fil_cmd_data: cmd error -110, resend cmd count 3
[ 939.257954] brcmfmac: brcmf_sdio_bus_rxctl: resumed on timeout
[ 941.818288] brcmfmac: brcmf_sdio_bus_rxctl: resumed on timeout
[ 941.818541] brcmfmac: brcmf_fil_cmd_data: cmd error -110, resend cmd count 1
[ 943.610242] Bluetooth: hci0: command tx timeout
[ 944.378260] brcmfmac: brcmf_sdio_bus_rxctl: resumed on timeout
[ 944.378513] brcmfmac: brcmf_fil_cmd_data: cmd error -110, resend cmd count 2
[ 946.938330] brcmfmac: brcmf_sdio_bus_rxctl: resumed on timeout
[ 946.938584] brcmfmac: brcmf_fil_cmd_data: cmd error -110, resend cmd count 3
[ 949.498472] brcmfmac: brcmf_sdio_bus_rxctl: resumed on timeout
[ 949.498733] ieee80211 phy0: brcmf_run_escan: error (-110)
[ 949.504221] ieee80211 phy0: brcmf_cfg80211_scan: scan error (-110)

Questions

  • Is this a known issue with the DEY 6.6.78 kernel or ConnectCore MP25 platform?

  • Are there patches available for:

    • stm32_usart DMA handling?

    • Bluetooth HCI UART stability?

  • Would disabling runtime power management for the UART or Bluetooth device be a valid workaround?

Technical Context

  • Hardware: ConnectCore MP25 Development Kit

  • Kernel: 6.6.78-dey

Best Regards,

ASN

2

Hi,

This issue is currently under investigation.

We found that reverting the following commit:
https://github.com/digi-embedded/linux/commit/83771e186d2abeccc38b0a5e6841b068499622ca and disabling DMA support on the Bluetooth UART makes the issue much harder to reproduce. However, we are working on an additional fix related to runtime PM support in the stm32-usart driver.

We hope to finalize the investigation and provide a proper fix soon.

Best regards,

3

Hi,

Thank you for the update.

I will try to revert the mentioned commit and disable DMA support on the Bluetooth UART to see if it improves the situation on my side.

Regarding your findings, would you recommend a specific way to disable DMA for the Bluetooth UART (e.g. via device tree changes), or should I simply remove the DMA configuration entries?

I will also run additional tests to check whether the issue becomes harder to reproduce and will report back with my observations.

Please let me know if you would like me to test any specific patches or configurations related to the runtime PM changes in the stm32-usart driver.

Thanks for your reply!

Best regards,
ASN

4

Hi,

To disable UART DMA you need to remove the DMA properties from the DT overlay, for example:

--- a/arch/arm64/boot/dts/digi/ccmp25_bt.dtso
+++ b/arch/arm64/boot/dts/digi/ccmp25_bt.dtso
@@ -43,6 +43,9 @@ __overlay__ {
                        pinctrl-2 = <&ccmp25_usart1_sleep_pins>;
                        uart-has-rtscts;
                        status = "okay";
+                       /* Remove DMA */
+                       /delete-property/dmas;
+                       /delete-property/dma-names;

We are working together with ST to identify and fix the root cause of the issue, and we will provide a proper fix as soon as possible.

Best regards,

Arturo.