[#5072] RTC driver crashes when CONFIG_DEBUG_SHIRQ is set

Document created by Aaronwu Employee on Sep 3, 2013
Version 1Show Document
  • View in full screen mode

[#5072] RTC driver crashes when CONFIG_DEBUG_SHIRQ is set

Submitted By: Michael Hennerich

Open Date

2009-04-20 04:56:20     Close Date

2009-04-23 22:55:01

Priority:

Medium     Assignee:

Michael Hennerich

Status:

Closed     Fixed In Release:

N/A

Found In Release:

2010R1     Release:

Category:

RTC     Board:

STAMP

Processor:

ALL     Silicon Revision:

Is this bug repeatable?:

Yes     Resolution:

Fixed

Uboot version or rev.:

    Toolchain version or rev.:

svn trunk

App binary format:

N/A     

Summary: RTC driver crashes when CONFIG_DEBUG_SHIRQ is set

Details:

 

The kernel may crash in bfin_rtc_interrupt in case CONFIG_DEBUG_SHIRQ is set.

Either make the bfin_rtc_interrupt,  rtc_update_irq CONFIG_DEBUG_SHIRQ save, or

don't grab the irq IRQF_SHARED.

 

-Michael

 

U-Boot 2009.01-svn1738 (ADI-2009R1-pre) (Mar 26 2009 - 15:34:39)

 

CPU:   ADSP bf537-0.2 (Detected Rev: 0.3) (bypass boot)

Board: ADI BF537 stamp board

       Support:   blackfin.uclinux.org/

Clock: VCO: 500 MHz, Core: 500 MHz, System: 125 MHz

RAM:   64 MB

Flash:  4 MB

In:    serial

Out:   serial

Err:   serial

Net:   Blackfin EMAC

MAC:   46:3f:19:57:b6:a6

Hit any key to stop autoboot:  0

Using Blackfin EMAC device

TFTP from server 10.44.2.88; our IP address is 10.44.2.37

Filename 'uImage'.

Load address: 0x1000000

Loading: #################################################################

         #################################################################

         #################################################################

         #################################################################

         #################################################################

         ###############

done

Bytes transferred = 4979761 (4bfc31 hex)

## Booting kernel from Legacy Image at 01000000 ...

   Image Name:   Linux-2.6.28.9-ADI-2009R1-pre-sv

   Created:      2009-04-20   8:23:20 UTC

   Image Type:   Blackfin Linux Kernel Image (gzip compressed)

   Data Size:    4979697 Bytes =  4.7 MB

   Load Address: 00001000

   Entry Point:  00184274

   Verifying Checksum ... OK

   Uncompressing Kernel Image ... OK

Starting Kernel at = 00184274

Linux version 2.6.28.9-ADI-2009R1-pre-svn6277 (michael@mhenneri-D02) (gcc version 4.1.2 (ADI svn)) #1564 Mon Apr 20 10:23:12 CEST 2009

console [early_BFuart0] enabled

early printk enabled on early_BFuart0

Warning: limiting memory to 56MB due to hardware anomaly 05000263

Board Memory: 64MB

Kernel Managed Memory: 64MB

Memory map:

  fixedcode = 0x00000400-0x00000490

  text      = 0x00001000-0x00105500

  rodata    = 0x00105500-0x00157248

  bss       = 0x00157250-0x00164cd8

  data      = 0x00164cd8-0x00176000

    stack   = 0x00174000-0x00176000

  init      = 0x00176000-0x009bd000

  available = 0x009bd000-0x037ff000

  DMA Zone  = 0x03f00000-0x04000000

Hardware Trace Active and Enabled

Boot Mode: 0

Blackfin support (C) 2004-2009 Analog Devices, Inc.

Compiled for ADSP-BF537 Rev 0.2

Warning: Compiled for Rev 2, but running on Rev 3

Blackfin Linux support by   blackfin.uclinux.org/

Processor Speed: 500 MHz core clock and 125 MHz System Clock

NOMPU: setting up cplb tables

Instruction Cache Enabled for CPU0

Data Cache Enabled for CPU0 (write-back)

Built 1 zonelists in Zone order, mobility grouping off.  Total pages: 14223

Kernel command line: root=/dev/mtdblock0 rw clkin_hz=25000000 earlyprintk=serial,uart0,57600 console=ttyBF0,57600 ip=10.44.2.37:10.44.2.88:19f

Configuring Blackfin Priority Driven Interrupts

PID hash table entries: 256 (order: 8, 1024 bytes)

console handover: boot [early_BFuart0] -> real [ttyBF0]

Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)

Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)

Memory available: 46788k/65536k RAM, (8476k init code, 1041k kernel code, 451k data, 1024k dma, 7756k reserved)

Calibrating delay loop... 997.37 BogoMIPS (lpj=1994752)

Security Framework initialized

Mount-cache hash table entries: 512

Blackfin Scratchpad data SRAM: 4 KB

Blackfin L1 Data A SRAM: 16 KB (15 KB free)

Blackfin L1 Data B SRAM: 16 KB (16 KB free)

Blackfin L1 Instruction SRAM: 48 KB (37 KB free)

PDA for CPU0 reserved at 00158338

net_namespace: 288 bytes

NET: Registered protocol family 16

Blackfin GPIO Controller

Blackfin DMA Controller

stamp_init(): registering device resources

NET: Registered protocol family 2

IP route cache hash table entries: 1024 (order: 0, 4096 bytes)

TCP established hash table entries: 2048 (order: 2, 16384 bytes)

TCP bind hash table entries: 2048 (order: 1, 8192 bytes)

TCP: Hash tables configured (established 2048 bind 2048)

TCP reno registered

NET: Registered protocol family 1

msgmni has been set to 91

io scheduler noop registered

io scheduler anticipatory registered (default)

io scheduler cfq registered

Serial: Blackfin serial driver

bfin-uart.1: ttyBF0 at MMIO 0xffc00400 (irq = 18) is a BFIN-UART

bfin-sport-uart.0: ttySS0 at MMIO 0xffc00800 (irq = 12) is a SPORT0

bfin-sport-uart.1: ttySS1 at MMIO 0xffc00900 (irq = 14) is a SPORT1

brd: module loaded

bfin_mii_bus: probed

bfin_mac: attached PHY driver [SMSC LAN83C185] (mii_bus:phy_addr=0:01, irq=-1, mdc_clk=2500000Hz(mdc_div=24)@sclk=125MHz)

bfin_mac bfin_mac.0: Blackfin on-chip Ethernet MAC driver, Version 1.1

bfin-spi bfin-spi.0: Blackfin on-chip SPI Controller Driver, Version 1.0, regs_base@ffc00500, dma channel@7

NULL pointer access

Kernel OOPS in progress

Deferred Exception context

CURRENT PROCESS:

COMM=swapper PID=1

CPU = 0

invalid mm

return address: [0x000ac41e]; contents of:

0x000ac3f0:  0801  1807  e14a  0016  e10a  622c  9110  0040

0x000ac400:  6c86  3041  0127  0010  3041  e3ff  6d8f  6801

0x000ac410:  2ff8  0000  04c5  3228  0167  4f41  6f86 [e52a]

0x000ac420:  006a  e428  0066  5041  5651  0c42  e629  0066

 

SEQUENCER STATUS:               Not tainted

SEQSTAT: 00060027  IPEND: 8030  SYSCFG: 0006

  EXCAUSE   : 0x27

  interrupts disabled

  physical IVG5 asserted : <0xffa00ba4> { _evt_ivhw + 0x0 }

  physical IVG15 asserted : <0xffa00d00> { _evt_system_call + 0x0 }

  logical irq   6 mapped  : <0xffa0037c> { _timer_interrupt + 0x0 }

  logical irq  10 mapped  : <0x000ad5b8> { _bfin_rtc_interrupt + 0x0 }

  logical irq  24 mapped  : <0x000a274c> { _bfin_mac_interrupt + 0x0 }

RETE: <0x00000000> { _do_one_initcall + 0xfffff000 }

RETN: <0x037e9d04> /* kernel dynamic memory */

RETX: <0x00000480> /* Maybe fixed code section */

RETS: <0x000ad62e> { _bfin_rtc_interrupt + 0x76 }

PC  : <0x000ac41e> { _rtc_update_irq + 0xa }

DCPLB_FAULT_ADDR: <0x000001a8> /* Maybe null pointer? */

ICPLB_FAULT_ADDR: <0x000ac41e> { _rtc_update_irq + 0xa }

 

PROCESSOR STATE:

R0 : 00000000    R1 : 00000100    R2 : 00000090    R3 : 0000001f

R4 : 001664d0    R5 : 00000000    R6 : 00000090    R7 : 0000003e

P0 : 00000000    P1 : ffc00308    P2 : ffc00308    P3 : 00000000

P4 : 000ad5b8    P5 : 00000000    FP : 00d04480    SP : 037e9c28

LB0: ffa01500    LT0: ffa01500    LC0: 00000000

LB1: 00017872    LT1: 0001785c    LC1: 00000000

B0 : 00000000    L0 : 00000000    M0 : 00000000    I0 : 00000000

B1 : 00000000    L1 : 00000000    M1 : 00000000    I1 : 00cf5d48

B2 : 00000000    L2 : 00000000    M2 : 00000000    I2 : 00000000

B3 : 00000000    L3 : 00000000    M3 : 00000000    I3 : 00000000

A0.w: 00000000   A0.x: 00000000   A1.w: 00000000   A1.x: 00000000

USP : 00000000  ASTAT: 00002000

 

Hardware Trace:

   0 Target : <0x00004a34> { _trap_c + 0x0 }

     Source : <0xffa0062a> { _exception_to_level5 + 0x9e } CALL pcrel

   1 Target : <0xffa0058c> { _exception_to_level5 + 0x0 }

     Source : <0xffa0045a> { _bfin_return_from_exception + 0xe } RTX

   2 Target : <0xffa0044c> { _bfin_return_from_exception + 0x0 }

     Source : <0xffa004e2> { _ex_trap_c + 0x66 } JUMP.S

   3 Target : <0xffa0047c> { _ex_trap_c + 0x0 }

     Source : <0xffa003b2> { _ex_workaround_261 + 0x22 } JUMP.S

   4 Target : <0xffa00390> { _ex_workaround_261 + 0x0 }

     Source : <0xffa006c4> { _trap + 0x38 } JUMP (P4)

   5 Target : <0xffa006aa> { _trap + 0x1e }

     Source : <0xffa006a6> { _trap + 0x1a } IF !CC JUMP

   6 Target : <0xffa0068c> { _trap + 0x0 }

     Source : <0xffa0045a> { _bfin_return_from_exception + 0xe } RTX

   7 Target : <0xffa0044c> { _bfin_return_from_exception + 0x0 }

     Source : <0xffa003a2> { _ex_workaround_261 + 0x12 } IF !CC JUMP

   8 Target : <0xffa00390> { _ex_workaround_261 + 0x0 }

     Source : <0xffa006c4> { _trap + 0x38 } JUMP (P4)

   9 Target : <0xffa006aa> { _trap + 0x1e }

     Source : <0xffa006a6> { _trap + 0x1a } IF !CC JUMP

  10 Target : <0xffa0068c> { _trap + 0x0 }

     Source : <0x000ac41c> { _rtc_update_irq + 0x8 } 0x6f86

  11 Target : <0x000ac414> { _rtc_update_irq + 0x0 }

     Source : <0x000ad62a> { _bfin_rtc_interrupt + 0x72 } CALL pcrel

  12 Target : <0x000ad612> { _bfin_rtc_interrupt + 0x5a }

     Source : <0x000ad5fe> { _bfin_rtc_interrupt + 0x46 } IF CC JUMP

  13 Target : <0x000ad5f2> { _bfin_rtc_interrupt + 0x3a }

     Source : <0x000ad5ea> { _bfin_rtc_interrupt + 0x32 } IF CC JUMP

  14 Target : <0x000ad5b8> { _bfin_rtc_interrupt + 0x0 }

     Source : <0x0002c288> { _request_irq + 0xa8 } CALL (P4)

  15 Target : <0x0002c282> { _request_irq + 0xa2 }

     Source : <0x0002bede> { _disable_irq + 0x3e } RTS

 

Kernel Stack

Stack info:

SP: [0x037e9cb0] <0x037e9cb0> /* kernel dynamic memory */

FP: (0x037e9d68)

Memory from 0x037e9cb0 to 037ea000

037e9cb0:[00cf5d48] 00000000  00000000  00d04480  00000000  000ad5b8  00000000  ffc00308

037e9cd0: ffc00308  00000000  0000003e  00000090  00000000  001664d0  0000001f  00000090

037e9cf0: 00000100  00000000  00000000  00000000  00000006  001695e4  001695fc  00d04480

037e9d10: 001626a8 <000ad62e> 00cfbce0  037e9d40 <0002bed2> 00000080 <0002c28a> 001695e4

037e9d30: 0000ffff  00000000  0000000a  037e016c  037e0954  0016e660  0016e660 <001051cc>

037e9d50: 001664d0  00cfbce0  001664c8  0016657c  000000ac  0016e660 (00000000)<0006e9be>

037e9d70: 00000001 <0009c480> 001366dc  001664d0 <0009c588> 001664d0  0016e660  001626a8

037e9d90: 0016657c  00000000 <00103ba0><00103bc8> 001663dc <0009c6e0> 001664d0  0016e660

037e9db0: 00192328  0016657c  0016d908  00192328  00000000 <0009bd9e> 0009c674  0016d908

037e9dd0: 00000000  037e9de4  03036840 <000853c0> 00157274  037fb5d8  00166518 <0009c436>

037e9df0: 00157274  00000000  03036840  00000000  037e9e24  037e9e24 <0009c150> 0009c674

037e9e10:<0009c16e> 00000000 <0009c830> 0016e154  0012f49c  001366dc  00000000 <0009c830>

037e9e30: 00157274  0016e660  00192328  00000000  00000000  0018a85c  00000000  00000000

037e9e50:<00001028> 00157274  0018af38  00000000  00000000  00000000  037e7bc0  00172d50

037e9e70: 00000010  037e8000  000040d0  00000000  00000001  000240d0  00000000  00000000

037e9e90: 00172d50  00000001  00000044  037e8000  037e8000  037e8000  000240d0  037e8000

037e9eb0: 00000010  00a318a0  00000000  00000000  00000000  00000000  00000000  00000000

037e9ed0: 00000000  00000000  ffffffff  037e9f0c <00084678> 037c54a0  037c4300  0016082c

037e9ef0:<000846ec> 037fb6a4  00000000  000000d2  0016082c  000000d0  037e9f0c  037e6e10

037e9f10: 00000000  00000000 <001397e4><00084852> 0016082c  037c4300  00000000 <00069b10>

037e9f30: 037c54a0  037c4300  00192328  037e9f60  00004000  00000000  00000000  00000000

037e9f50: 0016082c  037e9f60 <00069d34> 0016aa48  000000d2 <00069d42> 0016aa48  0015fd38

037e9f70: 037c54a0  037c4300  037e9f9c  7fffff00  00000001 <0002d622> 037e9f9c  00000061

037e9f90: 0000000e <00069e06> 037c4300  00003739  00000000  00180000 <0002d67e> 00169388

037e9fb0: 001920f8  00000061  0016aa48 <001763b0> 001922c4  001920f8  00000000  00000000

037e9fd0: 00000000  00000000  00000000  00000000  00000000 <0000145e> 00000000  00000000

037e9ff0: 00000000  00000000  ffffffff  00000006  037f73a8

Return addresses in stack:

    address : <0x000ad62e> { _bfin_rtc_interrupt + 0x76 }

    address : <0x0002bed2> { _disable_irq + 0x32 }

    address : <0x0002c28a> { _request_irq + 0xaa }

    address : <0x001051cc> { _bfin_rtc_probe + 0x4c }

   frame  1 : <0x0006e9be> { _create_dir + 0x3a }

    address : <0x0009c480> { _driver_sysfs_add + 0x44 }

    address : <0x0009c588> { _driver_probe_device + 0x80 }

    address : <0x00103ba0> { _klist_next + 0x20 }

    address : <0x00103bc8> { _klist_next + 0x48 }

    address : <0x0009c6e0> { ___driver_attach + 0x6c }

    address : <0x0009bd9e> { _bus_for_each_dev + 0x3a }

    address : <0x000853c0> { _kobject_init_and_add + 0x24 }

    address : <0x0009c436> { _driver_attach + 0x1a }

    address : <0x0009c150> { _bus_add_driver + 0x64 }

    address : <0x0009c16e> { _bus_add_driver + 0x82 }

    address : <0x0009c830> { _driver_register + 0x40 }

    address : <0x0009c830> { _driver_register + 0x40 }

    address : <0x00001028> { _do_one_initcall + 0x28 }

    address : <0x00084678> { _ida_get_new_above + 0x94 }

    address : <0x000846ec> { _ida_get_new_above + 0x108 }

    address : <0x001397e4> /* kernel dynamic memory */

    address : <0x00084852> { _ida_pre_get + 0xe }

    address : <0x00069b10> { _proc_register + 0x30 }

    address : <0x00069d34> { _create_proc_entry + 0x3c }

    address : <0x00069d42> { _create_proc_entry + 0x4a }

    address : <0x0002d622> { _register_irq_proc + 0x76 }

    address : <0x00069e06> { _proc_mkdir_mode + 0x2e }

    address : <0x0002d67e> { _init_irq_proc + 0x42 }

    address : <0x001763b0> { _kernel_init + 0x84 }

    address : <0x0000145e> { _kernel_thread_helper + 0x6 }

Modules linked in:

Kernel panic - not syncing: Kernel exception

 

Follow-ups

 

--- Mike Frysinger                                           2009-04-20 10:27:48

i'm thinking we should always enable CONFIG_DEBUG_SHIRQ in our defconfigs ... is

there a downside to it ?

 

--- Michael Hennerich                                        2009-04-20 10:41:36

>is there a downside to it

 

Just like every other DEBUG option...

It adds extra code and involves some runtime overhead.

 

CONFIG_DEBUG_SHIRQ invokes the ISR handlerfunction during request_irq.

This can cause problems in case some of the data structures are not fully

initialized or allocated. I guess that is what CONFIG_DEBUG_SHIRQ should

trigger.

 

On Blackfin we typically don't use SHARED IRQs.

-Michael

 

--- Mike Frysinger                                           2009-04-20 14:12:32

some DEBUG options cause constant overhead.  if this only causes overhead at

request_irq() time, then it sounds like a good option to enable in all of our

defconfigs.

 

--- Michael Hennerich                                        2009-04-22 03:30:28

Mike,

 

I checked in a temp fix - please review and close.

 

/**

*    bfin_rtc_interrupt - handle interrupt from RTC

*

* Since we handle all RTC events here, we have to make sure the requested

* interrupt is enabled (in RTC_ICTL) as the event status register (RTC_ISTAT)

* always gets updated regardless of the interrupt being enabled.  So when one

* even we care about (e.g. stopwatch) goes off, we don't want to turn around

* and say that other events have happened as well (e.g. second).  We do not

* have to worry about pending writes to the RTC_ICTL register as interrupts

* only fire if they are enabled in the RTC_ICTL register.

*/

 

The last line in above comment block isn't true in case CONFIG_DEBUG_SHIRQ is

enabled and the IRQ is requested IRQF_SHARED. CONFIG_DEBUG_SHIRQ causes a

spurious interrupt, as soon as the IRQ is requested, by design.

 

As far as I can tell there is no need to request the RTC IRQ, IRQF_SHARED.

 

I removed the IRQF_SHARED flag.

 

Michael

 

--- Mike Frysinger                                           2009-04-22 17:13:22

yes, i dont think the irq should be marked shared, but i still think this driver

(and many others) are still broken.  the irq cant be requested until the

interrupt handler is safe to run.  spurious irqs or unexpected edge cases can

still trigger.

 

--- Mike Frysinger                                           2009-04-23 22:55:01

ive committed a final fix so that the irq handler is not registered until

everything is ready ... so it should work now w/out crashing even if the handler

is registered with shared, but no point in adding that back

 

 

 

    Files

    Changes

    Commits

    Dependencies

    Duplicates

    Associations

    Tags

 

File Name     File Type     File Size     Posted By

No Files Were Found

Attachments

    Outcomes