STM32MP135-DK:brcmf_sdio exception at boot time

[OPetr.2]

We have an exception at boot time, I think it is due to the brcmf_sdio module (wifi).Do you confirm?

Could you explain me what is the cause from the following lines of dmesg?  

After rebooting the board, the problem disappear, but we discovered that the modules related to wifi and bluetooth are no more loaded. How it can be possible? The image is created from the distribution package and activating PWM timer and LSM6DSOX on I2C, both not related to Wifi.

[ 94.207699] ------------[ cut here ]------------
[ 94.210967] WARNING: CPU: 0 PID: 54 at lib/refcount.c:25 kthread_stop+0x178/0x1c8
[ 94.280542] refcount_t: addition on 0; use-after-free.
[ 94.284308] Modules linked in: snd_soc_audio_graph_card snd_soc_simple_card_utils brcmfmac stm32_dcmipp cfg80211 st_lsm6dsx_spi brcmutil stm32_crc32 gc2145 st_mipid02 v4l2_fwnode v4l2_async stm32_cryp libdes crypto_engine videodev snd[** ] (1 of 2) A start job is running for…ilable disk space (10s / no limit)
[ 94.635785] CPU: 0 PID: 54 Comm: kworker/0:3 Not tainted 5.15.67 #1
[ 94.667593] Hardware name: STM32 (Device Tree Support)
[ 94.671366] Workqueue: events request_firmware_work_func
[ 94.676641] [<c010e8ec>] (unwind_backtrace) from [<c010c158>] (show_stack+0x10/0x14)
[ 94.780409] [<c010c158>] (show_stack) from [<c0122404>] (__warn+0xec/0x148)
[ 94.786010] [<c0122404>] (__warn) from [<c0c32db4>] (warn_slowpath_fmt+0x78/0xac)
[ 94.855183] [<c0c32db4>] (warn_slowpath_fmt) from [<c01465bc>] (kthread_stop+0x178/0x1c8)
[ 94.906787] [<c01465bc>] (kthread_stop) from [<bf3b1568>] (brcmf_sdio_remove+0x2c/0x178 [brcmfmac])
[ 94.977618] [<bf3b1568>] (brcmf_sdio_remove [brcmfmac]) from [<bf3b2fcc>] (brcmf_sdiod_remove+0x20/0xc0 [brcmfmac])
[ 94.986851] [<bf3b2fcc>] (brcmf_sdiod_remove [brcmfmac]) from [<bf3b326c>] (brcmf_ops_sdio_remove+0x34/0x5c [brcmfmac])
[ 95.147652] [<bf3b326c>] (brcmf_ops_sdio_remove [brcmfmac]) from [<c09f3da8>] (sdio_bus_remove+0x30/0x11c)
[ 95.156107] [<c09f3da8>] (sdio_bus_remove) from [<c07518d8>] (__device_release_driver+0x154/0x228)
[*** ] (1 of 2) A start job is running for…ilable disk space (10s / no limit)
[ 95.263774] dcmipp 5a000000.dcmipp: bound dcmipp-byteproc.1.auto (ops dcmipp_byteproc_pdrv_exit [dcmipp_byteproc])
[ 95.290505] [<c07518d8>] (__device_release_driver) from [<c07519cc>] (device_release_driver+0x20/0x2c)
[ 95.332128] dcmipp 5a000000.dcmipp: bound dcmipp-bytecap.2.auto (ops dcmipp_bytecap_comp_ops [dcmipp_bytecap])
[ 95.347732] [<c07519cc>] (device_release_driver) from [<bf3b05c4>] (brcmf_sdio_firmware_callback+0x3c/0x514 [brcmfmac])
[ 95.392682] [<bf3b05c4>] (brcmf_sdio_firmware_callback [brcmfmac]) from [<bf3a6358>] (brcmf_fw_request_done+0xd0/0x16c [brcmfmac])
[ 95.466197] [<bf3a6358>] (brcmf_fw_request_done [brcmfmac]) from [<c077013c>] (request_firmware_work_func+0x50/0x98)
[ 95.514409] [<c077013c>] (request_firmware_work_func) from [<c01401b8>] (process_one_work+0x1cc/0x558)
[ 95.558952] [<c01401b8>] (process_one_work) from [<c01409b4>] (worker_thread+0x44/0x5d4)
[ 95.582402] [<c01409b4>] (worker_thread) from [<c0146aec>] (kthread+0x14c/0x168)
[ 95.602717] [<c0146aec>] (kthread) from [<c0100130>] (ret_from_fork+0x14/0x24)
[ 95.622739] Exception stack(0xc1a75fb0 to 0xc1a75ff8)
[ 95.636476] 5fa0: 00000000 00000000 00000000 00000000
[ 95.657998] 5fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[ 95.688444] 5fe0: 00000000 00000000 00000000 00000000 00000013 00000000
[ 95.706598] ---[ end trace cf133433f4b601b4 ]---
[ 95.717595] ------------[ cut here ]------------
[ 95.729391] WARNING: CPU: 0 PID: 54 at kernel/kthread.c:73 kthread_stop+0x10c/0x1c8
[ 95.757133] Modules linked in: dcmipp_bytecap videobuf2_dma_contig videobuf2_memops videobuf2_v4l2 dcmipp_byteproc videobuf2_common dcmipp_parallel stm32_adc(+) stm32_timer_trigger stm32_lptimer_trigger snd_soc_stm32_sai_sub pwm_stm32 snd_soc_audio_graph_card snd_soc_simple_card_utils brcmfmac stm32_dcmipp cfg80211 st_lsm6dsx_spi brcmutil stm32_crc32 gc2145 st_mipid02 v4l2_fwnode v4l2_async stm32_cryp libdes crypto_engine videodev snd_soc_tlv320aic31xx mc snd_soc_cor[ *** ] (2 of 2) A start job is running for…ice Initialization (11s / 3min 5s)
[ 95.930114] CPU: 0 PID: 54 Comm: kworker/0:3 Tainted: G W 5.15.67 #1
[ 95.951216] Hardware name: STM32 (Device Tree Support)
[ 95.965655] Workqueue: events request_firmware_work_func
[ 95.977648] [<c010e8ec>] (unwind_backtrace) from [<c010c158>] (show_stack+0x10/0x14)
[ 96.000016] [<c010c158>] (show_stack) from [<c0122404>] (__warn+0xec/0x148)
[ 96.023431] [<c0122404>] (__warn) from [<c0c32db4>] (warn_slowpath_fmt+0x78/0xac)
[ 96.056454] [<c0c32db4>] (warn_slowpath_fmt) from [<c0146550>] (kthread_stop+0x10c/0x1c8)
[ 96.077693] [<c0146550>] (kthread_stop) from [<bf3b1568>] (brcmf_sdio_remove+0x2c/0x178 [brcmfmac])
[ 96.113986] [<bf3b1568>] (brcmf_sdio_remove [brcmfmac]) from [<bf3b2fcc>] (brcmf_sdiod_remove+0x20/0xc0 [brcmfmac])
[ 96.147342] [<bf3b2fcc>] (brcmf_sdiod_remove [brcmfmac]) from [<bf3b326c>] (brcmf_ops_sdio_remove+0x34/0x5c [brcmfmac])
[ 96.182626] [<bf3b326c>] (brcmf_ops_sdio_remove [brcmfmac]) from [<c09f3da8>] (sdio_bus_remove+0x30/0x11c)
[ *** ] (2 of 2) A start job is run[ 96.238667] [<c07518d8>] (__device_release_driver) from [<c07519cc>] (device_release_driver+0x20/0x2c)
ning for…ice Initialization (11s / 3min 5s)
[ 96.258960] [<c07519cc>] (device_release_driver) from [<bf3b05c4>] (brcmf_sdio_firmware_callback+0x3c/0x514 [brcmfmac])
[ 96.273167] [<bf3b05c4>] (brcmf_sdio_firmware_callback [brcmfmac]) from [<bf3a6358>] (brcmf_fw_request_done+0xd0/0x16c [brcmfmac])
[ 96.285892] [<bf3a6358>] (brcmf_fw_request_done [brcmfmac]) from [<c077013c>] (request_firmware_work_func+0x50/0x98)
[ 96.296411] [<c077013c>] (request_firmware_work_func) from [<c01401b8>] (process_one_work+0x1cc/0x558)
[ 96.318654] [<c01401b8>] (process_one_work) from [<c01409b4>] (worker_thread+0x44/0x5d4)
[ 96.334130] using random self ethernet address
[ 96.337690] using random host ethernet address
[ 96.342979] [<c01409b4>] (worker_thread) from [<c0146aec>] (kthread+0x14c/0x168)
[ 96.361373] [<c0146aec>] (kthread) from [<c0100130>] (ret_from_fork+0x14/0x24)
[ 96.380616] Exception stack(0xc1a75fb0 to 0xc1a75ff8)
[ 96.397038] 5fa0: 00000000 00000000 00000000 00000000
[ 96.437056] 5fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[ 96.461280] 5fe0: 00000000 00000000 00000000 00000000 00000013 00000000
[ 96.479356] usb0: HOST MAC 28:35:09:fe:50:30
[ 96.482222] usb0: MAC 8e:89:2f:b1:4a:2f
[ 96.486106] dwc2 49000000.usb-otg: bound driver configfs-gadget
[ 96.495888] ---[ end trace cf133433f4b601b5 ]---
[ 96.502568] 8<--- cut here ---
[ 96.504222] Unable to handle kernel paging request at virtual address b6f9e2a8
[ 96.511477] pgd = 98be8cfe
[ 96.514108] [b6f9e2a8] *pgd=00000000
[ 96.517649] Internal error: Oops: 17 [#1] PREEMPT ARM
[ 96.522692] Modules linked in: usb_f_rndis u_ether libcomposite dcmipp_bytecap videobuf2_dma_contig videobuf2_memops videobuf2_v4l2 dcmipp_byteproc videobuf2_common dcmipp_parallel stm32_adc(+) stm32_timer_trigger stm32_lptimer_trigger snd_soc_stm32_sai_sub pwm_stm32 snd_soc_audio_graph_card snd_soc_simple_card_utils brcmfmac stm32_dcmipp cfg80211 st_lsm6dsx_spi brcmutil stm32_crc32 gc2145 st_mipid02 v4l2_fwnode v4l2_async stm32_cryp libdes crypto_engine videodev snd_soc_tlv320aic31xx mc snd_soc_core snd_pcm_dmaengine snd_pcm stm32_adc_core snd_timer ucsi_stm32g0 snd st_lsm6dsx_i2c typec_ucsi st_lsm6dsx soundcore typec snd_soc_stm32_sai stm32_timers sch_fq_codel ip_tables x_tables ipv6
[ 96.583462] CPU: 0 PID: 54 Comm: kworker/0:3 Tainted: G W 5.15.67 #1
[ 96.591124] Hardware name: STM32 (Device Tree Support)
[ 96.596264] Workqueue: events request_firmware_work_func
[ 96.601519] PC is at kthread_stop+0x64/0x1c8
[ 96.605761] LR is at kthread_stop+0x10c/0x1c8
[ 96.610097] pc : [<c01464a8>] lr : [<c0146550>] psr: 60010093
[ 96.616343] sp : c1a75e50 ip : 00000000 fp : c120d95c
[ 96.621582] r10: c1d6ac00 r9 : 00000238 r8 : 00000044
[ 96.626821] r7 : bf3bde9c r6 : b6f9e2a8 r5 : c2dd1f40 r4 : c2dd1f48
[ 96.633369] r3 : 00000000 r2 : 60010013 r1 : c133a328 r0 : 00000000
[ 96.639818] Flags: nZCv IRQs off FIQs on Mode SVC_32 ISA ARM Segment none
[ 96.647072] Control: 10c5387d Table: c1d70059 DAC: 00000051
[ 96.652812] Register r0 information: NULL pointer
[ 96.657454] Register r1 information: non-slab/vmalloc memory
[ 96.663101] Register r2 information: non-paged memory
[ 96.668142] Register r3 information: NULL pointer
[ 96.672880] Register r4 information: slab task_struct start c2dd1f40 pointer offset 8
[ 96.680653] Register r5 information: slab task_struct start c2dd1f40 pointer offset 0
[ 96.688521] Register r6 information: non-paged memory
[ 96.693561] Register r7 information: 55-page vmalloc region starting at 0xbf390000 allocated at layout_and_allocate+0x100/0x2ac
[ 96.704952] Register r8 information: non-paged memory
[ 96.709992] Register r9 information: non-paged memory
[ 96.715032] Register r10 information: slab kmalloc-1k start c1d6ac00 pointer offset 0 size 1024
[ 96.723709] Register r11 information: non-slab/vmalloc memory
[ 96.729454] Register r12 information: NULL pointer
[ 96.734292] Process kworker/0:3 (pid: 54, stack limit = 0x57bff613)
[ 96.740540] Stack: (0xc1a75e50 to 0xc1a76000)
[ 96.744878] 5e40: c1d66800 00000000 c1d67800 bf3b1568
[ 96.753040] 5e60: c1d67800 00000000 c1d67800 bf3b2fcc c30fde00 c3dd9540 c1d67800 bf3b326c
[ 96.761202] 5e80: c30fde08 c30fde00 bf3bde9c c09f3da8 c30fde08 bf3bde9c 00000000 c07518d8
[ 96.769363] 5ea0: c30fde08 c30fde4c c1d67800 c3dd9680 00000000 c07519cc c1d66800 c30fde08
[ 96.777525] 5ec0: c1d67800 bf3b05c4 00000000 00000000 00000002 00000014 00000000 c3dd9ec0
[ 96.785687] 5ee0: c3dd9a40 c2bdf480 fffffffe bf3a6358 c1210480 c3aed300 c2d0c280 c1cc3e80
[ 96.793848] 5f00: c130d740 dc91a300 00000000 c2d0c284 dc91a305 c077013c 00000000 00000000
[ 96.802010] 5f20: 00000003 c1cc3e80 c2d0c300 b481cddb c2d0c280 c01401b8 c12457a0 c120d930
[ 96.810172] 5f40: c1cc3e80 c120d91c c1cc3e98 c12457a0 c120d930 c1a74000 c120da98 c01409b4
[ 96.818332] 5f60: 00000000 c1cc0ac0 c1cc0480 c1a74000 00000000 c0140970 c1cc3e80 c1a73ed8
[ 96.826494] 5f80: c1cc0adc c0146aec 00000000 c1cc0480 c01469a0 00000000 00000000 00000000
[ 96.834655] 5fa0: 00000000 00000000 00000000 c0100130 00000000 00000000 00000000 00000000
[ 96.842815] 5fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[ 96.850975] 5fe0: 00000000 00000000 00000000 00000000 00000013 00000000 00000000 00000000
[ 96.859141] [<c01464a8>] (kthread_stop) from [<bf3b1568>] (brcmf_sdio_remove+0x2c/0x178 [brcmfmac])
[ 96.868254] [<bf3b1568>] (brcmf_sdio_remove [brcmfmac]) from [<bf3b2fcc>] (brcmf_sdiod_remove+0x20/0xc0 [brcmfmac])
[ 96.878599] [<bf3b2fcc>] (brcmf_sdiod_remove [brcmfmac]) from [<bf3b326c>] (brcmf_ops_sdio_remove+0x34/0x5c [brcmfmac])
[ 96.889442] [<bf3b326c>] (brcmf_ops_sdio_remove [brcmfmac]) from [<c09f3da8>] (sdio_bus_remove+0x30/0x11c)
[ 96.899005] [<c09f3da8>] (sdio_bus_remove) from [<c07518d8>] (__device_release_driver+0x154/0x228)
[ 96.907983] [<c07518d8>] (__device_release_driver) from [<c07519cc>] (device_release_driver+0x20/0x2c)
[ 96.917259] [<c07519cc>] (device_release_driver) from [<bf3b05c4>] (brcmf_sdio_firmware_callback+0x3c/0x514 [brcmfmac])
[ 96.928027] [<bf3b05c4>] (brcmf_sdio_firmware_callback [brcmfmac]) from [<bf3a6358>] (brcmf_fw_request_done+0xd0/0x16c [brcmfmac])
[ 96.939774] [<bf3a6358>] (brcmf_fw_request_done [brcmfmac]) from [<c077013c>] (request_firmware_work_func+0x50/0x98)
[ 96.950339] [<c077013c>] (request_firmware_work_func) from [<c01401b8>] (process_one_work+0x1cc/0x558)
[ 96.959618] [<c01401b8>] (process_one_work) from [<c01409b4>] (worker_thread+0x44/0x5d4)
[ 96.967689] [<c01409b4>] (worker_thread) from [<c0146aec>] (kthread+0x14c/0x168)
[ 96.975053] [<c0146aec>] (kthread) from [<c0100130>] (ret_from_fork+0x14/0x24)
[ 96.982314] Exception stack(0xc1a75fb0 to 0xc1a75ff8)
[ 96.987356] 5fa0: 00000000 00000000 00000000 00000000
[ 96.995518] 5fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[ 97.003678] 5fe0: 00000000 00000000 00000000 00000000 00000013 00000000
[ 97.010233] Code: 0a000027 e59562d0 e10f2000 f10c0080 (e5963000)
[ OK ] Listening on Load/Save RF …itch Status /dev/rfkill Watch.
[ 97.180176] dwc2 49000000.usb-otg: new device is high-speed
[ 97.221032] dwc2 49000000.usb-otg: new address 58
[ OK ] Reached target Hardware activated USB gadget.