[#5375] using cs 6 with spidev causes kernel panic

Submitted By: Mike Frysinger

Open Date

2009-07-20 15:38:01 Close Date

2009-11-06 02:39:22

Priority:

Medium Assignee:

Yi Li

Status:

Closed Fixed In Release:

N/A

Found In Release:

2010R1 Release:

Category:

N/A Board:

EZKIT Lite

Processor:

BF548 Silicon Revision:

Is this bug repeatable?:

Yes Resolution:

Fixed

Uboot version or rev.:

Toolchain version or rev.:

trunk

App binary format:

N/A

Summary: using cs 6 with spidev causes kernel panic

Details:

take BF548-EZKIT_defconfig and enable the spidev driver. then edit the board file and set the spidev chip_select to 6.

## Booting kernel from Legacy Image at 01000000 ...

Image Name: bf548-2.6.30.2-ADI-2010R1-pre-00

Created: 2009-07-20 19:32:16 UTC

Image Type: Blackfin Linux Kernel Image (gzip compressed)

Data Size: 5292518 Bytes = 5 MB

Load Address: 00001000

Entry Point: 002869c4

Verifying Checksum ... OK

Uncompressing Kernel Image ... OK

Starting Kernel at = 002869c4

Linux version 2.6.30.2-ADI-2010R1-pre-00350-g32c3941-dirty (vapier@vapier-m) (gcc version 4.3.3 (ADI-trunk/git-80f22b9) ) #8 Mon Jul 20 15:31:55 EDT 2009

bootconsole [early_shadow0] enabled

bootconsole [early_BFuart0] enabled

early printk enabled on early_BFuart0

Board Memory: 64MB

Kernel Managed Memory: 64MB

Memory map:

fixedcode = 0x00000400-0x00000490

text = 0x00001000-0x001ab7b0

rodata = 0x001ab7b0-0x0023edec

bss = 0x0023f000-0x00255d90

data = 0x00255d90-0x00274000

stack = 0x00272000-0x00274000

init = 0x00274000-0x009c8000

available = 0x009c8000-0x03dff000

DMA Zone = 0x03e00000-0x04000000

Hardware Trace Active and Enabled

Boot Mode: 1

Compiled for ADSP-BF548 Rev 0.2

Blackfin Linux support by http://blackfin.uclinux.org/

Processor Speed: 525 MHz core clock and 131 MHz System Clock

NOMPU: setting up cplb tables

Instruction Cache Enabled for CPU0

External memory: cacheable in instruction cache

L2 SRAM : uncacheable in instruction cache

Data Cache Enabled for CPU0

External memory: cacheable (write-back) in data cache

L2 SRAM : uncacheable in data cache

Built 1 zonelists in Zone order, mobility grouping off. Total pages: 15747

Kernel command line: root=/dev/mtdblock0 rw clkin_hz=25000000 earlyprintk=serial,uart1,57600 console=tty0 console=ttyBF0,57600 ip=192.168.0.15:192.168.0.2:19

2.168.0.1:255.255.255.0:bf548-ezkit:eth0:off

NR_IRQS:263

Configuring Blackfin Priority Driven Interrupts

PID hash table entries: 256 (order: 8, 1024 bytes)

Console: colour dummy device 80x25

console [tty0] enabled

console handover:boot [early_BFuart0] boot [tty0] boot [early_shadow0] -> real [ttyBF0]

Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)

Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)

Memory available: 52896k/65536k RAM, (7504k init code, 1705k kernel code, 803k data, 2048k dma, 576k reserved)

Calibrating delay loop... 1046.52 BogoMIPS (lpj=2093056)

Security Framework initialized

Mount-cache hash table entries: 512

Blackfin Scratchpad data SRAM: 4 KB

Blackfin L1 Data A SRAM: 16 KB (16 KB free)

Blackfin L1 Data B SRAM: 16 KB (16 KB free)

Blackfin L1 Instruction SRAM: 48 KB (42 KB free)

Blackfin L2 SRAM: 128 KB (128 KB free)

net_namespace: 296 bytes

NET: Registered protocol family 16

Blackfin DMA Controller

ezkit_init(): registering device resources

bio: create slab <bio-0> at 0

SCSI subsystem initialized

usbcore: registered new interface driver usbfs

usbcore: registered new interface driver hub

usbcore: registered new device driver usb

musb_hdrc: version 6.0, musb-dma, host, debug=0

musb_hdrc: USB Host mode controller at ffc03c00 using DMA, IRQ 82

musb_hdrc musb_hdrc.0: MUSB HDRC host driver

musb_hdrc musb_hdrc.0: new USB bus registered, assigned bus number 1

usb usb1: configuration #1 chosen from 1 choice

hub 1-0:1.0: USB hub found

dma_alloc_init: dma_page @ 0x03db0000 - 512 pages at 0x03e00000

hub 1-0:1.0: 1 port detected

NET: Registered protocol family 2

IP route cache hash table entries: 1024 (order: 0, 4096 bytes)

TCP established hash table entries: 2048 (order: 2, 16384 bytes)

TCP bind hash table entries: 2048 (order: 1, 8192 bytes)

TCP: Hash tables configured (established 2048 bind 2048)

TCP reno registered

NET: Registered protocol family 1

msgmni has been set to 103

io scheduler noop registered

io scheduler anticipatory registered (default)

io scheduler cfq registered

bf54x-lq043: FrameBuffer initializing...

Console: switching to colour frame buffer device 80x24

bfin-otp: initialized

Serial: Blackfin serial driver

bfin-uart.1: ttyBF0 at MMIO 0xffc02000 (irq = 48) is a BFIN-UART

brd: module loaded

Driver 'sd' needs updating - please use bus_type methods

scsi0 : pata-bf54x

ata1: PATA max UDMA/66 irq 68

smsc911x: Driver version 2008-10-21.

smsc911x-mdio: probed

eth0: attached PHY driver [Generic PHY] (mii_bus:phy_addr=0:01, irq=-1)

net eth0: MAC Address: 00:e0:22:fe:bd:04

physmap platform flash device: 02000000 at 20000000

physmap-flash.0: Found 1 x16 devices at 0x0 in 16-bit bank

Intel/Sharp Extended Query Table at 0x010A

Using buffer write method

Using auto-unlock on power-up/resume

cfi_cmdset_0001: Erase suspend on write enabled

RedBoot partition parsing not available

Using physmap partition information

Creating 3 MTD partitions on "physmap-flash.0":

0x000000000000-0x000000040000 : "bootloader(nor)"

0x000000040000-0x000000440000 : "linux kernel(nor)"

0x000000440000-0x000001000000 : "file system(nor)"

bf5xx-nand bf5xx-nand.0: page_size=256, data_width=8, wr_dly=3, rd_dly=3

NAND device: Manufacturer ID: 0x20, Chip ID: 0xda (ST Micro NAND 256MiB 3,3V 8-bit)

Creating 2 MTD partitions on "NAND 256MiB 3,3V 8-bit":

0x000000000000-0x000000400000 : "linux kernel(nand)"

0x000000400000-0x000010000000 : "file system(nand)"

m25p80 spi0.1: m25p16 (2048 Kbytes)

Creating 2 MTD partitions on "m25p80":

0x000000000000-0x000000040000 : "bootloader(spi)"

ata1.00: ATA-7: FUJITSU MHW2040AT, 0000000B, max UDMA/100

ata1.00: 78140160 sectors, multi 16: LBA

0x000000040000-0x000000200000 : "linux kernel(spi)"

bfin-spi bfin-spi.0: can't setup spi0.6, status -19

bfin-spi bfin-spi.0: Blackfin on-chip SPI Controller Driver, Version 1.0, regs_base@ffc00500, dma channel@4

NULL pointer access

Kernel OOPS in progress

Deferred Exception context

CURRENT PROCESS:

COMM=swapper PID=1

CPU = 0

invalid mm

return address: [0x000ad5ba]; contents of:

0x000ad590: 1811 e142 0026 e102 26cc 2006 6c08 9941

0x000ad5a0: 4308 0c00 1807 4348 5002 3210 9910 4828

0x000ad5b0: 17f6 3040 0010 0000 3208 [9948] 0c00 180a

0x000ad5c0: 0000 3251 6c0a 9950 0c00 17fd 440a 3042

ADSP-BF548-0.2 525(MHz CCLK) 131(MHz SCLK) (mpu off)

Linux version 2.6.30.2-ADI-2010R1-pre-00350-g32c3941-dirty (vapier@vapier-m) (gcc version 4.3.3 (ADI-trunk/git-80f22b9) ) #8 Mon Jul 20 15:31:55 EDT 2009

SEQUENCER STATUS: Not tainted

SEQSTAT: 00060027 IPEND: 8008 IMASK: ffff SYSCFG: 0006

EXCAUSE : 0x27

physical IVG3 asserted : <0xffa006b0> { _trap + 0x0 }

physical IVG15 asserted : <0xffa00edc> { _evt_system_call + 0x0 }

logical irq 6 mapped : <0xffa00370> { _timer_interrupt + 0x0 }

logical irq 9 mapped : <0x000c014c> { _bfin_bf54x_irq_error + 0x0 }

logical irq 68 mapped : <0x000f90c8> { _bfin_ata_interrupt + 0x0 }

logical irq 74 mapped : <0x0010cc5c> { _bf5xx_nand_dma_irq + 0x0 }

logical irq 82 mapped : <0x001230b8> { _blackfin_interrupt + 0x0 }

logical irq 85 mapped : <0x00126354> { _dma_controller_irq + 0x0 }

logical irq 175 mapped : <0x000fe044> { _smsc911x_irqhandler + 0x0 }

RETE: <0x00000000> /* Maybe null pointer? */

RETN: <0x03de3d70> /* kernel dynamic memory */

RETX: <0x00000480> /* Maybe fixed code section */

RETS: <0x000aaaf8> { _kobject_get_path + 0x58 }

PC : <0x000ad5ba> { _strlen + 0x2 }

DCPLB_FAULT_ADDR: <0x00000000> /* Maybe null pointer? */

ICPLB_FAULT_ADDR: <0x000ad5ba> { _strlen + 0x2 }

PROCESSOR STATE:

R0 : 00000000 R1 : 00000031 R2 : 00000028 R3 : 00e85f60

R4 : 002159f4 R5 : 0000002f R6 : 00e85f20 R7 : 00000027

P0 : 00e85f60 P1 : 00000000 P2 : 00e85f47 P3 : 00e84a08

P4 : 00e85f20 P5 : 00000000 FP : 00000000 SP : 03de3c94

LB0: 000af420 LT0: 000af420 LC0: 00000000

LB1: 0003c048 LT1: 0003c042 LC1: 00000000

B0 : 00001680 L0 : 00000000 M0 : 00a71268 I0 : 03de3d2c

B1 : 00000000 L1 : 00000000 M1 : 00000000 I1 : 00000020

B2 : 00000000 L2 : 00000000 M2 : 00000000 I2 : 00000000

B3 : 00000000 L3 : 00000000 M3 : 00000000 I3 : 03e5dd00

A0.w: 00000000 A0.x: 00000000 A1.w: 00000000 A1.x: 00000000

USP : 00000000 ASTAT: 00002000

Hardware Trace:

0 Target : <0x0000506c> { _trap_c + 0x0 }

Source : <0xffa00642> { _exception_to_level5 + 0x9e } CALL pcrel

1 Target : <0xffa005a4> { _exception_to_level5 + 0x0 }

Source : <0xffa00474> { _bfin_return_from_exception + 0x18 } RTX

2 Target : <0xffa0045c> { _bfin_return_from_exception + 0x0 }

Source : <0xffa004f0> { _ex_trap_c + 0x4c } JUMP.S

3 Target : <0xffa004a4> { _ex_trap_c + 0x0 }

Source : <0xffa0070a> { _trap + 0x5a } JUMP (P4)

4 Target : <0xffa006b0> { _trap + 0x0 }

Source : <0x000ad5b8> { _strlen + 0x0 } 0x3208

5 Target : <0x000ad5b8> { _strlen + 0x0 }

Source : <0x000aaaf4> { _kobject_get_path + 0x54 } CALL pcrel

6 Target : <0x000aaaee> { _kobject_get_path + 0x4e }

Source : <0x000aab32> { _kobject_get_path + 0x92 } IF CC JUMP

7 Target : <0x000aab24> { _kobject_get_path + 0x84 }

Source : <0x000aab16> { _kobject_get_path + 0x76 } JUMP.S

8 Target : <0x000aab09> { _kobject_get_path + 0x69 }

Source : <0x000aab14> { _kobject_get_path + 0x74 } IF CC JUMP

9 Target : <0x000aaaf8> { _kobject_get_path + 0x58 }

Source : <0x000ad5d0> { _strlen + 0x18 } RTS

10 Target : <0x000ad5c5> { _strlen + 0xd }

Source : <0x000ad5ca> { _strlen + 0x12 } IF CC JUMP

11 Target : <0x000ad5b8> { _strlen + 0x0 }

Source : <0x000aaaf4> { _kobject_get_path + 0x54 } CALL pcrel

12 Target : <0x000aaade> { _kobject_get_path + 0x3e }

Source : <0x0003c2d8> { ___kmalloc + 0x94 } RTS

13 Target : <0x0003c2d0> { ___kmalloc + 0x8c }

Source : <0x000af426> { _memset + 0x2e } RTS

14 Target : <0x000af3f8> { _memset + 0x0 }

Source : <0x0003c2cc> { ___kmalloc + 0x88 } CALL pcrel

15 Target : <0x0003c28c> { ___kmalloc + 0x48 }

Source : <0x0003c2e4> { ___kmalloc + 0xa0 } JUMP.S

Follow-ups

--- Yi Li 2009-08-28 07:34:51

1. BF548 spi0/spi1 only provide 3 slave select signals. So cs 6 is invalid.

bfin_spi_setup() will fail at peripheral_request(). We need to add check.

2. For the NULL pointer error.

bfin_spi_setup()

{

struct chip_data *chip;

chip = kmalloc();

spi_set_ctldata(spi, chip);

error:

kfree(chip);

}

bfin_spi_cleanup()

{

struct chip_data *chip = spi_get_ctldata(spi);

if (!chip) return;

kfree(chip);

}

If something wrong in bfin_spi_setup(), kfree(chip) will be called twice. And

slab cannot detect the same object is freed twice - the local cache of free

objects in slab will contain wrong data. Following "kmalloc()" will

not work properly.

The clean up code in blackfin spi driver need some rewrite.

--- Yi Li 2009-09-02 03:19:18

fixed on trunk and 2009R1 branch.

--- Yi Li 2009-11-06 02:39:22

fixed and close it.

Files

Changes

Commits

Dependencies

Duplicates

Associations