We have a similar problem with fw 2.6.1 - AP is rebooting several times a day:
Crashlog:
Time: 1457644524.766470
Modules: tdd_umac@c0cda000+11d473 tdd_link_test@c0b38000+eeb t dd_dev@c0ae6000+3d456 tdd_spectral@c0a7a000+9d13 tdd_dfs@c09bd000+a2064 t dd_hal@c08fc000+9ba11 tdd_acm@c0874000+1e06 tdd_unblockSA@c0865000+2b5 t dd_pps@c0857000+29ff gpslic@c0847000+46f tdd_cdf@c083b000+ff4 tdd_adf@ c082c000+26c5 tdd_asf@c081c000+1b93 athrs_gmac@c07d4000+b7ee nf_nat_s ip@c076b000+1470 nf_conntrack_sip@c075a000+313d nf_nat_snmp_basic@c07420 00+1b10 nf_nat_pptp@c0733000+540 nf_conntrack_pptp@c0727000+c90 nf_nat_h 323@c0719000+11c0 nf_conntrack_h323@c0703000+849f nf_nat_proto_gre@c06ee00 0+3c0 nf_conntrack_proto_gre@c06e2000+a55 nf_nat_amanda@c06d5000+2e0 n f_conntrack_amanda@c06c9000+6b0 tdd_netlink_socket@c0444000+20b macvlan@c0437000 +1140 nf_conntrack_netlink@c0427000+2820 ebt_ulog@c0416000+1080 ebt_ip@c 0409000+520 ebt_arp@c03fd000+650 ebt_vlan@c03f1000+650 ebt_pkttype@c03e 4000+260 ebt_limit@c03d8000+400 ebt_802_3@c03cc000+2f0 ebtable_filter@c 03ba000+3b0 ebtable_broute@c03a8000+300 ebtables@c0399000+3ac5 nfnetlin k@c0388000+7df nf_nat_tftp@c037b000+210 nf_conntrack_tftp@c036f000+9b0 x t_HL@c0355000+560 xt_hl@c0349000+3e0 ipt_ECN@c033d000+580 xt_CLASS IFY@c0331000+240 xt_tcpmss@c0325000+430 xt_statistic@c0319000+380 x t_DSCP@c030d000+5d0 xt_dscp@c0301000+440 xt_quota@c02f5000+340 xt_pktty pe@c02e9000+2a0 xt_physdev@c02dd000+590 xt_owner@c02d1000+300 ipt_REDIRECT@c02 c5000+2f0 ipt_NETMAP@c02b9000+2f0 ipt_MASQUERADE@c02ad000+440 iptable_ nat@c02a1000+9b8 nf_nat@c0292000+2db0 xt_CONNMARK@c0282000+360 x t_recent@c0275000+1600 xt_helper@c0266000+390 xt_conntrack@c025a000+830 x t_connmark@c024d000+2e0 xt_connbytes@c0241000+530 xt_NOTRACK@c0235000+270i ptable_raw@c0229000+2e0 xt_state@c021d000+350 nf_conntrack_ipv4@c0210000+1fb2n f_defrag_ipv4@c0200000+306 nf_conntrack@c01e9000+a219 pppoe@c01cc000+2 0c0 pppox@c01bd000+59a ipt_REJECT@c01b0000+710 xt_TCPMSS@c01a3000+7a0 i pt_LOG@c0195000+1110 xt_multiport@c0187000+750 xt_mac@c017b000+2a0 x t_limit@c016f000+440 iptable_mangle@c0163000+430 iptable_filter@c0156000+ 350 ip_tables@c0147000+2255 xt_tcpudp@c0138000+730 x_tables@c012a000+279e p pp_async@c0119000+1960 ppp_generic@c0106000+4b55 slhc@c00f1000+112b t s_fsm@c00e4000+a80 ts_bm@c00d7000+600 ts_kmp@c00cb000+590 crc_ccit t@c00bb000+42b cambium_iprst@c00a8000+bf0 leds_gpio@c0097000+5c0 button_h otplug@c008a000+a70 gpio_buttons@c007d000+880 input_polldev@c0070000+6 43 input_core@c005e000+469e
obility grouping on. Total pages: 16256
<5>Kernel command line: console=ttyS0,115200 root=31:02 noinitrd mtdparts=ath-no r0:256k(u-boot),64k(u-boot-env),384K(config),7360K(uImage),64K(uImageI),64k(ART) mem=64M
<6>PID hash table entries: 256 (order: -2, 1024 bytes)
<6>Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
<6>Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
<4>Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
<4>Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
<6>Writing ErrCtl register=00000000
<6>Readback ErrCtl register=00000000
<6>Memory: 38304k/65536k available (1970k kernel code, 27164k reserved, 486k dat a, 23644k init, 0k highmem)
<6>SLUB: Genslabs=13, HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
<6>Hierarchical RCU implementation.
<6>NR_IRQS:128
<4>plat_time_init: plat time init done
<6>Calibrating delay loop... 279.34 BogoMIPS (lpj=1396736)
<4>Mount-cache hash table entries: 512
<6>NET: Registered protocol family 16
<4>bio: create slab <bio-0> at 0
<6>Switching to clocksource MIPS
<6>NET: Registered protocol family 2
<6>IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
<6>TCP established hash table entries: 2048 (order: 2, 16384 bytes)
<6>TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
<6>TCP: Hash tables configured (established 2048 bind 2048)
<6>TCP reno registered
<6>NET: Registered protocol family 1
<4>ATH GPIOC major 0
<6>squashfs: version 4.0 (2009/01/31) Phillip Lougher
<4>Registering mini_fo version $Id$
<6>JFFS2 version 2.2 (NAND) (SUMMARY) (ZLIB) (RTIME) (CMODE_PRIORITY) (c) 2001- 2006 Red Hat, Inc.
<4>yaffs Feb 24 2016 20:13:31 Installing.
<6>msgmni has been set to 74
<6>io scheduler noop registered
<6>io scheduler deadline registered (default)
<6>Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled
<6>serial8250.0: ttyS0 at MMIO 0xb8020000 (irq = 19) is a 16550A
<6>console [ttyS0] enabled
<4>Flash Manuf Id 0xc2, DeviceId0 0x20, DeviceId1 0x17
<4>8MB Flash Detected
<5>6 cmdlinepart partitions found on MTD device ath-nor0
<5>Creating 6 MTD partitions on "ath-nor0":
<5>0x000000000000-0x000000040000 : "u-boot"
<5>0x000000040000-0x000000050000 : "u-boot-env"
<5>0x000000050000-0x0000000b0000 : "config"
<5>0x0000000b0000-0x0000007e0000 : "uImage"
<5>0x0000007e0000-0x0000007f0000 : "uImageI"
<5>0x0000007f0000-0x000000800000 : "ART"
<6>TCP westwood registered
<6>NET: Registered protocol family 17
<5>Bridge firewalling registered
<6>802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
<6>All bugs added by David S. Miller <davem@redhat.com>
<4>athwdt_init: Registering WDT success
<4>ath_otp_init: Registering OTP success
<4>ath_clksw_init: Registering Clock Switch Interface success
<4>apPx_spi_init: initialize Cambium New SPI Driver....
<4>Board SKU .... 0x1
<4>Entering ath_934x_config_init()
<4>Initialize GPIO PINs
<4>GPIO 18 and 21 set for XLNA0 and XLNA1
<4>apPx_rst_button_init: platform_device_regsiter: avenger_keys_device status = 0
<6>Freeing unused kernel memory: 23644k freed
<6>Button Hotplug driver version 0.3.1
<4>
<4>gpio_keys_probe: Initialize RST_BUTTON Driver....GPIO(16)
<4>gpio_keys_probe:gpio_keys_isr registered to IRQ = 48
<6>input: gpio-keys as /devices/platform/gpio-keys/input/input0
<6>PPP generic driver version 2.4.2
<6>ip_tables: (C) 2000-2006 Netfilter Core Team
<6>NET: Registered protocol family 24
<4>nf_conntrack version 0.5.0 (969 buckets, 3876 max)
<4>CONFIG_NF_CT_ACCT is deprecated and will be removed soon. Please use
<4>nf_conntrack.acct=1 kernel parameter, acct=1 nf_conntrack module option or
<4>sysctl net.netfilter.nf_conntrack_acct=1 to enable it.
<4>nf_nat_ftp: Unknown symbol nf_nat_ftp_hook
<4>Netfilter messages via NETLINK v0.30.
<6>Ebtables v2.0 registered
<4>ctnetlink v0.93: registering with nfnetlink.
<4>tdd_netlink_socket: module license 'Proprietary' taints kernel.
<4>Disabling lock debugging due to kernel taint
<4>ATHR_GMAC: Length per segment 1722
<4>ATHR_GMAC: fifo cfg 3 01f00140
<4>ATHR_GMAC: RX TASKLET - Pkts per Intr:64
<4>ATHR_GMAC: Mac address for unit 1:bfff0000
<4>ATHR_GMAC: 00:04:56:cd:fe:66
<4>mac:1 Registering S27...
<4>ATHR_GMAC: Max segments per packet : 1
<4>ATHR_GMAC: Max tx descriptor count : 128
<4>ATHR_GMAC: Max rx descriptor count : 128
<4>ATHR_GMAC: Mac capability flags : 2D88
<4>athr_gmac_ring_alloc Allocated 2048 at 0x814ac000
<4>athr_gmac_ring_alloc Allocated 2048 at 0x814ac800
<4>WASP ----> S27 PHY MDIO
<4>Setting Drop CRC Errors, Pause Frames and Length Error frames
<4>ATHRS27: resetting s27
<4>ATHRS27: s27 reset done
<4>Setting PHY...1
<4>TXFCTL enabled in Mac:1
<4>enet1 port4 up 100Mbps Full duplex
<4>ATHR_GMAC: Enet Unit:1 PHY:4 is UP RGMii 1000Mbps full duplex
<4>ATHR_GMAC: done cfg2 0x7215 ifctl 0x0 miictrl
<4>WASP ----> S27 PHY MDIO
<4>Setting Drop CRC Errors, Pause Frames and Length Error frames
<6>tdd_hal: 0.9.17.1 (AR9380, DEBUG, WRITE_EEPROM, 11D)
<6>device eth0 entered promiscuous mode
<6>tdd_dfs: Version 2.0.0
<6>Copyright (c) 2005-2006 Atheros Communications, Inc. All Rights Reserved
<6>br-lan: port 1(eth0) entering forwarding state
<6>tdd_spectral: Version 2.0.0
<6>Copyright (c) 2005-2009 Atheros Communications, Inc. All Rights Reserved
<6>SPECTRAL module built on Feb 24 2016 20:06:06
<6>tdd_dev: Copyright (c) 2001-2007 Atheros Communications, Inc, All Rights Rese rved
<6>ath_ahb: 9.2.0_U10.5.13 (Atheros/multi-bss)
<4>AH_CAL_IN_FLASH_AHB defined
<4>__ath_attach: Set global_scn[0]
<4>TxBuf flow control is disabled
<4>hal_conf_parm.calInFlash 1
<6>Bootstrap clock 40MHz
<6>Wasp Enterprise mode: 0x00000000
<6>ar9300RadioAttach: Need analog access recipe!!
<6>Restoring Cal data from Flash
<6>Restoring Cal data from Second Radio in Flash
<4>Allow 5.9 channels: cal peer[7]=5950
<7>dfs_attach: use DFS enhancements
<7>DFS min filter rssiThresh = 17
<7>DFS max pulse dur = 151 ticks
<4>ath_get_caps[5889] rx chainmask mismatch actual 3 sc_chainmak 0
<4>ath_get_caps[5864] tx chainmask mismatch actual 3 sc_chainmak 0
<4>tdd_classifier_init: ic=816402c0 classifier=81657340
<4>ath_descdma_setup: tx DMA: 1024 buffers 1 desc/buf 128 desc_len
<4>ath_descdma_setup: tx DMA map: 81040000 (135168) -> 1040000 (135168)
<4>ath_descdma_setup: success, name = tx, nbuf = 1024
<4>ath_descdma_setup: beacon DMA: 8 buffers 1 desc/buf 128 desc_len
<4>ath_descdma_setup: beacon DMA map: a1687000 (4096) -> 1687000 (4096)
<4>ath_descdma_setup: success, name = beacon, nbuf = 8
<6>wifi0: Atheros 9340: mem=0xb8100000, irq=2
<4>TXFCTL enabled in Mac:1
<7>dfs_init_radar_filters: Unknown dfs domain 0
<4>camb_debug_print_setup: type=63, counter=3
<4>wlan_vap_create : enter. devhandle=0x816402c0, opmode=IEEE80211_M_HOSTAP, fla gs=0x1
<4>tdd_control_init
<4>tdd_calc_cell_prop_delay: Cell_Radius_Size = 65500 m, prop_delay = 218484 ns
<4>tdd_calc_cell_prop_delay: Cell_Radius_Size = 96540 m, prop_delay = 322022 ns
<4>tdd_calc_frame_params: FrameD=5000 DL=2245 TTRG=474 UL=2245 RTTG=36 CW=523 ma x_inar_duration=76000 mcs=96540 STXOP_MUL=2
<4>latency control is ON, latency value is 150000000
<4>wlan_vap_create : exit. devhandle=0x816402c0, opmode=IEEE80211_M_HOSTAP, flag s=0x1.
<4>_register_mc_bypass_hndl: Register MultiCast bypass [eth0] -> [ath0]
<4>ATHR_GMAC:__set_mc_bypass_ath_dev: Setting MultiCast bypass [eth0] -> [ath0]
<4>SWB: CAC time = 67000 MILLIseconds
<4>SWB: NOP time = 1800000 MILLIseconds
<4>50, 30, 20
<4>SWB: validated channel = 72 (5360MHz)
<4>SWB: Primary channel = 72 (5360 MHz)
<4>Setting Max Stations:60
<4>unable to setup uplink factorization for GPS mode
<4>SSID lengh is ZERO do not start AP if no ssid is set
<6>device ath0 entered promiscuous mode
<6>br-lan: port 2(ath0) entering forwarding state
<4> ieee80211_ioctl_siwmode: imr.ifm_active=0x50280, new mode=0x3, valid=1
<4>
<4>Checking for node leak: OK
<6>br-lan: port 2(ath0) entering disabled state
<4>try to stop bss
<4>done
<4>Current channel: 72 (5360 MHz)
<4>try to start bss...
<4>Setting Max Stations:60
<4>Flags 0, Scheduler Mode 0
<7>dfs_re_init_radar_filters: Unknown dfs domain 0
<7>dfs_correction_4radar_filters: Unknown dfs domain 0
<4>done
<4>interface is UP
<6>br-lan: port 2(ath0) entering forwarding state
<4>Adding WDS entry for 64:66:b3:29:77:a1, through ni=00:04:56:c4:62:3e
<4>Adding WDS entry for 70:9e:29:72:f8:79, through ni=00:04:56:c4:62:3e
<4>Adding WDS entry for cc:5d:4e:42:96:82, through ni=00:04:56:c0:17:5d
<4>Adding WDS entry for fc:f5:28:f5:f7:cd, through ni=00:04:56:c8:48:15
<4>Adding WDS entry for 5c:f4:ab:fd:e6:5d, through ni=00:04:56:c8:0f:ea
<4>Adding WDS entry for cc:5d:4e:42:ba:a9, through ni=00:04:56:c8:0e:94
<4>Adding WDS entry for 10:7b:ef:da:6e:63, through ni=00:04:56:c4:61:60
<4>Adding WDS entry for 00:22:b0:a9:6d:69, through ni=00:04:56:c4:62:3e
<4>Adding WDS entry for cc:5d:4e:45:39:c1, through ni=00:04:56:c0:15:4a
<4>Adding WDS entry for a0:e4:cb:ff:1c:9e, through ni=00:04:56:c7:53:ed
<4>Adding WDS entry for 4c:9e:ff:a7:2c:d7, through ni=00:04:56:c8:51:42
<4>Adding WDS entry for fc:f5:28:f9:5c:33, through ni=00:04:56:c5:36:a0
<4>Adding WDS entry for cc:5d:4e:42:d0:21, through ni=00:04:56:c4:62:11
<4>Adding WDS entry for fc:f5:28:f9:31:19, through ni=00:04:56:c8:51:87
<4>Adding WDS entry for 10:7b:ef:fe:f6:a1, through ni=00:04:56:c8:51:8a
<4>Adding WDS entry for fc:f5:28:f8:f3:c6, through ni=00:04:56:c8:0d:b3
<4>Adding WDS entry for 38:2c:4a:c4:19:9c, through ni=00:04:56:c4:96:00
<4>Adding WDS entry for cc:5d:4e:42:ba:b8, through ni=00:04:56:c4:66:49
<4>Adding WDS entry for 64:70:02:c8:54:53, through ni=00:04:56:c4:96:00
<4>Adding WDS entry for fc:f5:28:f6:f1:fa, through ni=00:04:56:c4:a1:ca
<4>Adding WDS entry for f4:ec:38:bc:03:a3, through ni=00:04:56:c4:96:00
<4>Adding WDS entry for 02:04:56:c4:7f:96, through ni=00:04:56:c4:7f:96
<4>Adding WDS entry for cc:5d:4e:42:b9:e3, through ni=00:04:56:c8:11:5b
<4>Adding WDS entry for 00:1f:33:d3:83:2d, through ni=00:04:56:c8:58:1a
<4>Adding WDS entry for 5c:f4:ab:fe:4d:af, through ni=00:04:56:c4:5f:fb
<4>tdd_ratectrl_stat_add: suspicious ARQ statistic, ARQ fn = 33504, RA last FN = 0
<4>Adding WDS entry for 14:da:e9:e3:38:b4, through ni=00:04:56:c8:0e:16
<4>Adding WDS entry for 00:1d:60:23:ec:85, through ni=00:04:56:c4:96:00
<4>Adding WDS entry for 38:2c:4a:c4:19:9c, through ni=00:04:56:c4:96:00
<4>Adding WDS entry for 5c:f4:ab:fe:5a:16, through ni=00:04:56:ca:ef:b0
<4>Adding WDS entry for 00:15:58:cd:ad:db, through ni=00:04:56:c4:96:00
<4>SM[00:04:56:ca:ef:b0] aid=43 disassociated. Reason: COMMUNICATION LOST
<4>SM[00:04:56:c0:22:7c] aid=20 disassociated. Reason: COMMUNICATION LOST
<4>Adding WDS entry for 14:da:e9:e3:38:b4, through ni=00:04:56:c8:0e:16
<1>CPU 0 Unable to handle kernel paging request at virtual address 00000000, epc == c0d3911c, ra == c0d39250
<4>Oops[#1]:
<4>Cpu 0
<4>$ 0 : 00000000 00000001 00000000 00000000
<4>$ 4 : 00000000 838ce000 00000001 816402c0
<4>$ 8 : 00000008 00000040 00000000 8164e940
<4>$12 : 0000003d 00000003 51eb851f 0000c350
<4>$16 : 838ce000 838c8000 00000000 838c8000
<4>$20 : 838ce9bf 00000008 00000008 00000000
<4>$24 : 00000000 8007f5b0
<4>$28 : 802b2000 802b3b28 00000000 c0d39250
<4>Hi : 00000284
<4>Lo : 28f5c4c3
<4>epc : c0d3911c _ieee80211_free_node+0xcc/0x334 [tdd_umac]
<4> Tainted: P
<4>ra : c0d39250 _ieee80211_free_node+0x200/0x334 [tdd_umac]
<4>Status: 1100ff03 KERNEL EXL IE
<4>Cause : 0080000c
<4>BadVA : 00000000
<4>PrId : 0001974c (MIPS 74Kc)
<4>Modules linked in: tdd_umac tdd_link_test(P) tdd_dev(P) tdd_spectral(P) tdd_d fs(P) tdd_hal(P) tdd_acm(P) tdd_unblockSA(P) tdd_pps(P) gpslic tdd_cdf tdd_adf t dd_asf(P) athrs_gmac nf_nat_sip nf_conntrack_sip nf_nat_snmp_basic nf_nat_pptp n f_conntrack_pptp nf_nat_h323 nf_conntrack_h323 nf_nat_proto_gre nf_conntrack_pro to_gre nf_nat_amanda nf_conntrack_amanda tdd_netlink_socket(P) macvlan nf_conntr ack_netlink ebt_ulog ebt_ip ebt_arp ebt_vlan ebt_pkttype ebt_limit ebt_802_3 ebt able_filter ebtable_broute ebtables nfnetlink nf_nat_tftp nf_conntrack_tftp xt_H L xt_hl ipt_ECN xt_CLASSIFY xt_tcpmss xt_statistic xt_DSCP xt_dscp xt_quota xt_p kttype xt_physdev xt_owner ipt_REDIRECT ipt_NETMAP ipt_MASQUERADE iptable_nat nf _nat xt_CONNMARK xt_recent xt_helper xt_conntrack xt_connmark xt_connbytes xt_NO TRACK iptable_raw xt_state nf_conntrack_ipv4 nf_defrag_ipv4 nf_conntrack pppoe p ppox ipt_REJECT xt_TCPMSS ipt_LOG xt_multiport xt_mac xt_limit iptable_mangle ip table_filter ip_tables xt_tcpudp x_tables ppp_async ppp_generic slhc ts_fsm ts_b m ts_kmp crc_ccitt cambium_iprst leds_gpio button_hotplug gpio_buttons input_pol ldev input_core
<4>Process swapper (pid: 0, threadinfo=802b2000, task=802b4b40, tls=00000000)
<4>Stack : 838ce000 838ce000 816402c0 c0d3b4f0 802b3b48 838ce000 838ce000 c0d393 d8
<4> 00000040 00000001 00000030 838cf0cc 838ce000 838ce000 838c8000 c0d6b8 f0
<4> 838cf0cc c0d6b9dc ffffffff c0d956ec 00000000 00000000 838cf0cc 816502 c0
<4> 838ce000 816402c0 8164e50c 00000008 00000002 8164e480 8164e594 c0d09d 90
<4> 00000006 c083b060 802b3bc0 838c8000 0000cc47 00000000 8164e4b8 000000 01
<4> ...
<4>Call Trace:
<4>[<c0d3911c>] _ieee80211_free_node+0xcc/0x334 [tdd_umac]
<4>[<c0d6b8f0>] tdd_mlme_sta_disassoc_on_ap+0xcc/0x170 [tdd_umac]
<4>[<c0d09d90>] tdd_uq_timeout+0x154/0x34c [tdd_umac]
<4>[<c0d2922c>] tdd_uqt_alloc+0xac/0xc0c [tdd_umac]
<4>[<c0d2a2e4>] tdd_scheduler_uqt_node+0x3f0/0x604 [tdd_umac]
<4>[<c0d2a6bc>] tdd_scheduler_uqt_vhl+0x1c4/0x29c [tdd_umac]
<4>[<c0d2a984>] tdd_scheduler_ap_ul_qt_schedule_main_queues+0x11c/0x174 [tdd_uma c]
<4>[<c0d2aa20>] tdd_scheduler_ap_ul_qt+0x44/0xe4 [tdd_umac]
<4>[<c0cde3ec>] ath_tdd_scheduler_start_ap+0xf4c/0x1754 [tdd_umac]
<4>[<c0aef7a0>] ath_tdd_sta_ul_stop_timer_handler+0xd0/0x47c [tdd_dev]
<4>
<4>
<4>Code: 8e020014 ac620014 8e020014 <ac430000> ae000010 ae000014 40026000 3 0420001 54400018
<0>Kernel panic - not syncing: Fatal exception in interrupt