Hi,

The following codes work well in SDP600, but there are random crash happen in io-pkt in SDP700. 
so is there any interface change between io-pkt and wlan driver in SDP700?

struct do_rtmsg_s {
    int     dr_what;
    struct ifnet *dr_ifp;
    void   *dr_ptr;
    size_t  dr_len;
    struct stk_callback dr_cb;
};

static void reset_mtu_to_default_on_disassociate(int what, struct ifnet *ifp)
{
    if ((RTM_IEEE80211_DISASSOC == what) && (NULL != ifp)) {
        ifp->if_mtu = ETHERMTU;
    }
}

static void do_rtmsg(void *arg)
{
    struct do_rtmsg_s *dr;

    dr = arg;
    reset_mtu_to_default_on_disassociate(dr->dr_what, dr->dr_ifp);
    rt_ieee80211msg(dr->dr_ifp, dr->dr_what, dr->dr_ptr, dr->dr_len);
    if (dr->dr_ptr)
        free(dr->dr_ptr, M_TEMP);
    free(dr, M_TEMP);
}

void do_rtfromstack(struct ifnet *ifp, int what, void *data, size_t data_len)
{
    /**
     * Dirty little hack for PR 347908.
     *
     * Currently there is an implicit assumption that data pointer is not NULL
     * within rt_ieee80211msg() due to an assertion deep within m_copyback0().
     *
     * Using a temporary buffer to workaround this issue for now while a better
     * solution is proposed.
     */
    int temp;

    if (NULL == data) {
        data = &temp;
        data_len = sizeof(temp);
    }

    if (!ISIRUPT) {
        reset_mtu_to_default_on_disassociate(what, ifp);
        rt_ieee80211msg(ifp, what, data, data_len);
    } else {
        struct do_rtmsg_s *dr;
        hddLog(VOS_TRACE_LEVEL_INFO, "%s: RTM Event:%d for ifname:%s",
               __func__, what, ifp->if_xname);
        dr = malloc(sizeof(*dr), M_TEMP, M_NOWAIT);
        if (dr == NULL) {
            hddLog(VOS_TRACE_LEVEL_ERROR, "%s: No Memory",
                   __func__);
            return;
        }
        dr->dr_what = what;
        dr->dr_ifp = ifp;
        dr->dr_ptr = NULL;
        dr->dr_len = 0;
        if (data) {
            dr->dr_ptr = malloc(data_len, M_TEMP, M_NOWAIT);
            if (dr->dr_ptr == NULL) {
                free(dr, M_TEMP);
                hddLog(VOS_TRACE_LEVEL_ERROR, "%s: No Memory for dr_ptr",
                       __func__);
                return;
            }
            memcpy(dr->dr_ptr, data, data_len);
            dr->dr_len = data_len;
        }
        dr->dr_cb.func = do_rtmsg;
        dr->dr_cb.arg = dr;
        MsgSendPulse(stk_ctl.coid, -1, NW_DEF_PULSE_CODE_CALLBACK,
                     (intptr_t)&dr->dr_cb);
    }
}

thanks
- wenbin