From patchwork Thu Jul 10 12:33:27 2014 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Sebastian Hesselbarth X-Patchwork-Id: 4523441 Return-Path: X-Original-To: patchwork-linux-arm@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork1.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.19.201]) by patchwork1.web.kernel.org (Postfix) with ESMTP id 3B5E99F37C for ; Thu, 10 Jul 2014 12:35:50 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 4E678201D5 for ; Thu, 10 Jul 2014 12:35:49 +0000 (UTC) Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.9]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 56F88201C7 for ; Thu, 10 Jul 2014 12:35:48 +0000 (UTC) Received: from localhost ([127.0.0.1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.80.1 #2 (Red Hat Linux)) id 1X5DXx-0005HV-RF; Thu, 10 Jul 2014 12:33:57 +0000 Received: from mail-we0-x22d.google.com ([2a00:1450:400c:c03::22d]) by bombadil.infradead.org with esmtps (Exim 4.80.1 #2 (Red Hat Linux)) id 1X5DXu-0005BH-QU for linux-arm-kernel@lists.infradead.org; Thu, 10 Jul 2014 12:33:56 +0000 Received: by mail-we0-f173.google.com with SMTP id t60so8965427wes.32 for ; Thu, 10 Jul 2014 05:33:31 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=message-id:date:from:user-agent:to:cc:subject:references :in-reply-to:content-type; bh=eMwQ2r5PO4PzcvF+1bR6gN7OSk7ta1okEi7oIx/wCek=; b=YvyZ776VlZI4d0Lo3xcw5ipQLu8pOlm+21bbwneToe/jioR8yo+5M21dlG0dqldWay TceitwDFF1xbL59Bs/JQ/PsSEsVdQKiS47cviF1pDwp7oX11l1hQLLC9N/+0faqjHoyJ 8xS6X9nYmpN9hVPXy8T/1VJIAz8AQL3Hg0FdJA4Or27L+lt6YfLE4C6sgp6mw6upHd6V CyxjzbmeH796IzhU+3eAe0B5vEbrgsg5uMfN9jAsABe+k9SHDTMgJa2ns/8dRd1yOOI+ JBv+Jbuvq7bcgTiTj6HV/OTgFUtxLlwuSpV22RK1Op2amzbx+lwmTjAxv7kwWFC2wAQR vICQ== X-Received: by 10.180.208.13 with SMTP id ma13mr18903287wic.45.1404995611754; Thu, 10 Jul 2014 05:33:31 -0700 (PDT) Received: from topkick.lan (f053053228.adsl.alicedsl.de. [78.53.53.228]) by mx.google.com with ESMTPSA id jy8sm110130188wjc.7.2014.07.10.05.33.30 for (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 10 Jul 2014 05:33:30 -0700 (PDT) Message-ID: <53BE8817.10703@gmail.com> Date: Thu, 10 Jul 2014 14:33:27 +0200 From: Sebastian Hesselbarth User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:24.0) Gecko/20100101 Thunderbird/24.6.0 To: Jason Cooper , Jean-Francois Moine , Russell King - ARM Linux Subject: Re: dove (marvell A510) crash on boot with config_preempt References: <20140706080845.723e9787@armhf> <20140708151705.GE13433@titan.lakedaemon.net> In-Reply-To: <20140708151705.GE13433@titan.lakedaemon.net> X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20140710_053355_165586_14CECB97 X-CRM114-Status: GOOD ( 19.18 ) X-Spam-Score: 1.2 (+) Cc: Catalin Marinas , linux-arm-kernel@lists.infradead.org X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.18-1 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+patchwork-linux-arm=patchwork.kernel.org@lists.infradead.org X-Spam-Status: No, score=-1.7 required=5.0 tests=BAYES_00, DKIM_ADSP_CUSTOM_MED, DKIM_SIGNED,FREEMAIL_FROM,MIME_HEADER_CTYPE_ONLY,RP_MATCHES_RCVD, T_DKIM_INVALID,UNPARSEABLE_RELAY autolearn=no version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP On 07/08/2014 05:17 PM, Jason Cooper wrote: > On Sun, Jul 06, 2014 at 08:08:45AM +0200, Jean-Francois Moine wrote: >> Since the official 3.15.0 release, the kernel crashes at boot time >> when compiled with the option CONFIG_PREEMPT. >> >> Reverting the commit 431a84b1a4f7d1a0085d5b91330c5053cc8e8b12 >> >> ARM: 8034/1: Disable preemption in iwmmxt_task_enable() >> >> removes the problem. >> >> Linux version 3.16.0-rc3-00062-gd92a333-dirty (jef@armhf) (gcc version 4.8.3 (Debian 4.8.3-4) ) #5 PREEMPT Thu Jul 3 19:46:39 CEST 2014 [...] >> PJ4 iWMMXt v2 coprocessor enabled. [...] >> Unable to handle kernel paging request at virtual address fffffffe >> pgd = bb25c000 >> [fffffffe] *pgd=3bfde821, *pte=00000000, *ppte=00000000 >> Internal error: Oops: 80000007 [#1] PREEMPT ARM >> Modules linked in: >> CPU: 0 PID: 62 Comm: startpar Not tainted 3.16.0-rc3-00062-gd92a333-dirty #5 >> task: bb230b80 ti: bb256000 task.ti: bb256000 >> PC is at 0xfffffffe >> LR is at iwmmxt_task_copy+0x44/0x4c >> pc : [] lr : [<800130ac>] psr: 40000033 >> sp : bb257de8 ip : 00000013 fp : bb257ea4 >> r10: bb256000 r9 : fffffdfe r8 : 76e898e6 >> r7 : bb257ec8 r6 : bb256000 r5 : 7ea12760 r4 : 000000a0 >> r3 : ffffffff r2 : 00000003 r1 : bb257df8 r0 : 00000000 >> Flags: nZcv IRQs on FIQs on Mode SVC_32 ISA Thumb Segment user >> Control: 10c5387d Table: 3b25c019 DAC: 00000015 >> Process startpar (pid: 62, stack limit = 0xbb256248) Ok, I have been able to debug this despite my limited knowledge of iWMMXt and ARM asm. While the patch below fixes the issue, I have no clue if it is the right approach or if there should be a different solution. I'd like to leave that to either Russell or Catalin to decide. If anything in below explanation is wrong, please correct me immediately! Above mentioned commit basically added {inc,dec}_preempt_count macros to iwmmxt_task_enable to run it with preemption disabled: ENTRY(iwmmxt_task_enable) + inc_preempt_count r10, r3 [...] concan_save: [...] concan_dump: [...] concan_load: [...] +3: +#ifdef CONFIG_PREEMPT_COUNT + get_thread_info r10 +#endif +4: dec_preempt_count r10, r3 mov pc, lr Unfortunately, other procedures in iwmmxt.S, e.g. iwmmxt_task_copy, also branch to above concan_{save,dump,load} labels without disabling preemption first: ENTRY(iwmmxt_task_copy) [...] 1: @ this task owns Concan regs -- grab a copy from there mov r0, #0 @ nothing to load mov r2, #3 @ save all regs mov r3, lr @ preserve return address bl concan_dump msr cpsr_c, ip @ restore interrupt mode mov pc, r3 This causes two issues that finally lead to observed behavior: (a) introduced {inc,dec}_preempt_count use r3 as temporary register, while iwmmxt_task_copy uses it to store its return address (b) branching to concan_foo labels decrements preempt_count without incrementing it first The patch below addresses (a) by using r4 as temporary register for {inc,dec}_preempt_count macro and (b) by moving concan_foo into separate code sections and call them from iwmmxt_task_enable like the other procedures do. Sebastian diff --git a/arch/arm/kernel/iwmmxt.S b/arch/arm/kernel/iwmmxt.S index a5599cf..9fa671a 100644 --- a/arch/arm/kernel/iwmmxt.S +++ b/arch/arm/kernel/iwmmxt.S @@ -70,7 +70,7 @@ */ ENTRY(iwmmxt_task_enable) - inc_preempt_count r10, r3 + inc_preempt_count r10, r4 XSC(mrc p15, 0, r2, c15, c1, 0) PJ4(mrc p15, 0, r2, c1, c0, 2) @@ -95,10 +95,18 @@ ENTRY(iwmmxt_task_enable) mrc p15, 0, r2, c2, c0, 0 mov r2, r2 @ cpwait - teq r1, #0 @ test for last ownership - mov lr, r9 @ normal exit from exception - beq concan_load @ no owner, skip save - + mov r4, r1 + teq r4, #0 @ test for last ownership + bleq concan_load @ no owner, skip save + teq r4, #0 @ test for last ownership + blne concan_save + +#ifdef CONFIG_PREEMPT_COUNT + get_thread_info r10 +#endif +4: dec_preempt_count r10, r4 + mov pc, r9 @ normal exit from exception + concan_save: tmrc r2, wCon @@ -175,10 +183,6 @@ concan_load: tmcr wCon, r2 3: -#ifdef CONFIG_PREEMPT_COUNT - get_thread_info r10 -#endif -4: dec_preempt_count r10, r3 mov pc, lr /*