[#5072] RTC driver crashes when CONFIG_DEBUG_SHIRQ is set

Submitted By: Michael Hennerich

Open Date

2009-04-20 04:56:20 Close Date

2009-04-23 22:55:01

Priority:

Medium Assignee:

Michael Hennerich

Status:

Closed Fixed In Release:

N/A

Found In Release:

2010R1 Release:

Category:

RTC Board:

STAMP

Processor:

ALL Silicon Revision:

Is this bug repeatable?:

Yes Resolution:

Fixed

Uboot version or rev.:

Toolchain version or rev.:

svn trunk

App binary format:

N/A

Summary: RTC driver crashes when CONFIG_DEBUG_SHIRQ is set

Details:

The kernel may crash in bfin_rtc_interrupt in case CONFIG_DEBUG_SHIRQ is set.

Either make the bfin_rtc_interrupt, rtc_update_irq CONFIG_DEBUG_SHIRQ save, or

don't grab the irq IRQF_SHARED.

-Michael

U-Boot 2009.01-svn1738 (ADI-2009R1-pre) (Mar 26 2009 - 15:34:39)

CPU: ADSP bf537-0.2 (Detected Rev: 0.3) (bypass boot)

Board: ADI BF537 stamp board

Support: blackfin.uclinux.org/

Clock: VCO: 500 MHz, Core: 500 MHz, System: 125 MHz

RAM: 64 MB

Flash: 4 MB

In: serial

Out: serial

Err: serial

Net: Blackfin EMAC

MAC: 46:3f:19:57:b6:a6

Hit any key to stop autoboot: 0

Using Blackfin EMAC device

TFTP from server 10.44.2.88; our IP address is 10.44.2.37

Filename 'uImage'.

Load address: 0x1000000

Loading: #################################################################

#################################################################

###############

done

Bytes transferred = 4979761 (4bfc31 hex)

## Booting kernel from Legacy Image at 01000000 ...

Image Name: Linux-2.6.28.9-ADI-2009R1-pre-sv

Created: 2009-04-20 8:23:20 UTC

Image Type: Blackfin Linux Kernel Image (gzip compressed)

Data Size: 4979697 Bytes = 4.7 MB

Load Address: 00001000

Entry Point: 00184274

Verifying Checksum ... OK

Uncompressing Kernel Image ... OK

Starting Kernel at = 00184274

Linux version 2.6.28.9-ADI-2009R1-pre-svn6277 (michael@mhenneri-D02) (gcc version 4.1.2 (ADI svn)) #1564 Mon Apr 20 10:23:12 CEST 2009

console [early_BFuart0] enabled

early printk enabled on early_BFuart0

Warning: limiting memory to 56MB due to hardware anomaly 05000263

Board Memory: 64MB

Kernel Managed Memory: 64MB

Memory map:

fixedcode = 0x00000400-0x00000490

text = 0x00001000-0x00105500

rodata = 0x00105500-0x00157248

bss = 0x00157250-0x00164cd8

data = 0x00164cd8-0x00176000

stack = 0x00174000-0x00176000

init = 0x00176000-0x009bd000

available = 0x009bd000-0x037ff000

DMA Zone = 0x03f00000-0x04000000

Hardware Trace Active and Enabled

Boot Mode: 0

Compiled for ADSP-BF537 Rev 0.2

Warning: Compiled for Rev 2, but running on Rev 3

Blackfin Linux support by blackfin.uclinux.org/

Processor Speed: 500 MHz core clock and 125 MHz System Clock

NOMPU: setting up cplb tables

Instruction Cache Enabled for CPU0

Data Cache Enabled for CPU0 (write-back)

Built 1 zonelists in Zone order, mobility grouping off. Total pages: 14223

Kernel command line: root=/dev/mtdblock0 rw clkin_hz=25000000 earlyprintk=serial,uart0,57600 console=ttyBF0,57600 ip=10.44.2.37:10.44.2.88:19f

Configuring Blackfin Priority Driven Interrupts

PID hash table entries: 256 (order: 8, 1024 bytes)

console handover: boot [early_BFuart0] -> real [ttyBF0]

Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)

Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)

Memory available: 46788k/65536k RAM, (8476k init code, 1041k kernel code, 451k data, 1024k dma, 7756k reserved)

Calibrating delay loop... 997.37 BogoMIPS (lpj=1994752)

Security Framework initialized

Mount-cache hash table entries: 512

Blackfin Scratchpad data SRAM: 4 KB

Blackfin L1 Data A SRAM: 16 KB (15 KB free)

Blackfin L1 Data B SRAM: 16 KB (16 KB free)

Blackfin L1 Instruction SRAM: 48 KB (37 KB free)

PDA for CPU0 reserved at 00158338

net_namespace: 288 bytes

NET: Registered protocol family 16

Blackfin GPIO Controller

Blackfin DMA Controller

stamp_init(): registering device resources

NET: Registered protocol family 2

IP route cache hash table entries: 1024 (order: 0, 4096 bytes)

TCP established hash table entries: 2048 (order: 2, 16384 bytes)

TCP bind hash table entries: 2048 (order: 1, 8192 bytes)

TCP: Hash tables configured (established 2048 bind 2048)

TCP reno registered

NET: Registered protocol family 1

msgmni has been set to 91

io scheduler noop registered

io scheduler anticipatory registered (default)

io scheduler cfq registered

Serial: Blackfin serial driver

bfin-uart.1: ttyBF0 at MMIO 0xffc00400 (irq = 18) is a BFIN-UART

bfin-sport-uart.0: ttySS0 at MMIO 0xffc00800 (irq = 12) is a SPORT0

bfin-sport-uart.1: ttySS1 at MMIO 0xffc00900 (irq = 14) is a SPORT1

brd: module loaded

bfin_mii_bus: probed

bfin_mac: attached PHY driver [SMSC LAN83C185] (mii_bus:phy_addr=0:01, irq=-1, mdc_clk=2500000Hz(mdc_div=24)@sclk=125MHz)

bfin_mac bfin_mac.0: Blackfin on-chip Ethernet MAC driver, Version 1.1

bfin-spi bfin-spi.0: Blackfin on-chip SPI Controller Driver, Version 1.0, regs_base@ffc00500, dma channel@7

NULL pointer access

Kernel OOPS in progress

Deferred Exception context

CURRENT PROCESS:

COMM=swapper PID=1

CPU = 0

invalid mm

return address: [0x000ac41e]; contents of:

0x000ac3f0: 0801 1807 e14a 0016 e10a 622c 9110 0040

0x000ac400: 6c86 3041 0127 0010 3041 e3ff 6d8f 6801

0x000ac410: 2ff8 0000 04c5 3228 0167 4f41 6f86 [e52a]

0x000ac420: 006a e428 0066 5041 5651 0c42 e629 0066

SEQUENCER STATUS: Not tainted

SEQSTAT: 00060027 IPEND: 8030 SYSCFG: 0006

EXCAUSE : 0x27

interrupts disabled

physical IVG5 asserted : <0xffa00ba4> { _evt_ivhw + 0x0 }

physical IVG15 asserted : <0xffa00d00> { _evt_system_call + 0x0 }

logical irq 6 mapped : <0xffa0037c> { _timer_interrupt + 0x0 }

logical irq 10 mapped : <0x000ad5b8> { _bfin_rtc_interrupt + 0x0 }

logical irq 24 mapped : <0x000a274c> { _bfin_mac_interrupt + 0x0 }

RETE: <0x00000000> { _do_one_initcall + 0xfffff000 }

RETN: <0x037e9d04> /* kernel dynamic memory */

RETX: <0x00000480> /* Maybe fixed code section */

RETS: <0x000ad62e> { _bfin_rtc_interrupt + 0x76 }

PC : <0x000ac41e> { _rtc_update_irq + 0xa }

DCPLB_FAULT_ADDR: <0x000001a8> /* Maybe null pointer? */

ICPLB_FAULT_ADDR: <0x000ac41e> { _rtc_update_irq + 0xa }

PROCESSOR STATE:

R0 : 00000000 R1 : 00000100 R2 : 00000090 R3 : 0000001f

R4 : 001664d0 R5 : 00000000 R6 : 00000090 R7 : 0000003e

P0 : 00000000 P1 : ffc00308 P2 : ffc00308 P3 : 00000000

P4 : 000ad5b8 P5 : 00000000 FP : 00d04480 SP : 037e9c28

LB0: ffa01500 LT0: ffa01500 LC0: 00000000

LB1: 00017872 LT1: 0001785c LC1: 00000000

B0 : 00000000 L0 : 00000000 M0 : 00000000 I0 : 00000000

B1 : 00000000 L1 : 00000000 M1 : 00000000 I1 : 00cf5d48

B2 : 00000000 L2 : 00000000 M2 : 00000000 I2 : 00000000

B3 : 00000000 L3 : 00000000 M3 : 00000000 I3 : 00000000

A0.w: 00000000 A0.x: 00000000 A1.w: 00000000 A1.x: 00000000

USP : 00000000 ASTAT: 00002000

Hardware Trace:

0 Target : <0x00004a34> { _trap_c + 0x0 }

Source : <0xffa0062a> { _exception_to_level5 + 0x9e } CALL pcrel

1 Target : <0xffa0058c> { _exception_to_level5 + 0x0 }

Source : <0xffa0045a> { _bfin_return_from_exception + 0xe } RTX

2 Target : <0xffa0044c> { _bfin_return_from_exception + 0x0 }

Source : <0xffa004e2> { _ex_trap_c + 0x66 } JUMP.S

3 Target : <0xffa0047c> { _ex_trap_c + 0x0 }

Source : <0xffa003b2> { _ex_workaround_261 + 0x22 } JUMP.S

4 Target : <0xffa00390> { _ex_workaround_261 + 0x0 }

Source : <0xffa006c4> { _trap + 0x38 } JUMP (P4)

5 Target : <0xffa006aa> { _trap + 0x1e }

Source : <0xffa006a6> { _trap + 0x1a } IF !CC JUMP

6 Target : <0xffa0068c> { _trap + 0x0 }

Source : <0xffa0045a> { _bfin_return_from_exception + 0xe } RTX

7 Target : <0xffa0044c> { _bfin_return_from_exception + 0x0 }

Source : <0xffa003a2> { _ex_workaround_261 + 0x12 } IF !CC JUMP

8 Target : <0xffa00390> { _ex_workaround_261 + 0x0 }

Source : <0xffa006c4> { _trap + 0x38 } JUMP (P4)

9 Target : <0xffa006aa> { _trap + 0x1e }

Source : <0xffa006a6> { _trap + 0x1a } IF !CC JUMP

10 Target : <0xffa0068c> { _trap + 0x0 }

Source : <0x000ac41c> { _rtc_update_irq + 0x8 } 0x6f86

11 Target : <0x000ac414> { _rtc_update_irq + 0x0 }

Source : <0x000ad62a> { _bfin_rtc_interrupt + 0x72 } CALL pcrel

12 Target : <0x000ad612> { _bfin_rtc_interrupt + 0x5a }

Source : <0x000ad5fe> { _bfin_rtc_interrupt + 0x46 } IF CC JUMP

13 Target : <0x000ad5f2> { _bfin_rtc_interrupt + 0x3a }

Source : <0x000ad5ea> { _bfin_rtc_interrupt + 0x32 } IF CC JUMP

14 Target : <0x000ad5b8> { _bfin_rtc_interrupt + 0x0 }

Source : <0x0002c288> { _request_irq + 0xa8 } CALL (P4)

15 Target : <0x0002c282> { _request_irq + 0xa2 }

Source : <0x0002bede> { _disable_irq + 0x3e } RTS

Kernel Stack

Stack info:

SP: [0x037e9cb0] <0x037e9cb0> /* kernel dynamic memory */

FP: (0x037e9d68)

Memory from 0x037e9cb0 to 037ea000

037e9cb0:[00cf5d48] 00000000 00000000 00d04480 00000000 000ad5b8 00000000 ffc00308

037e9cd0: ffc00308 00000000 0000003e 00000090 00000000 001664d0 0000001f 00000090

037e9cf0: 00000100 00000000 00000000 00000000 00000006 001695e4 001695fc 00d04480

037e9d10: 001626a8 <000ad62e> 00cfbce0 037e9d40 <0002bed2> 00000080 <0002c28a> 001695e4

037e9d30: 0000ffff 00000000 0000000a 037e016c 037e0954 0016e660 0016e660 <001051cc>

037e9d50: 001664d0 00cfbce0 001664c8 0016657c 000000ac 0016e660 (00000000)<0006e9be>

037e9d70: 00000001 <0009c480> 001366dc 001664d0 <0009c588> 001664d0 0016e660 001626a8

037e9d90: 0016657c 00000000 <00103ba0><00103bc8> 001663dc <0009c6e0> 001664d0 0016e660

037e9db0: 00192328 0016657c 0016d908 00192328 00000000 <0009bd9e> 0009c674 0016d908

037e9dd0: 00000000 037e9de4 03036840 <000853c0> 00157274 037fb5d8 00166518 <0009c436>

037e9df0: 00157274 00000000 03036840 00000000 037e9e24 037e9e24 <0009c150> 0009c674

037e9e10:<0009c16e> 00000000 <0009c830> 0016e154 0012f49c 001366dc 00000000 <0009c830>

037e9e30: 00157274 0016e660 00192328 00000000 00000000 0018a85c 00000000 00000000

037e9e50:<00001028> 00157274 0018af38 00000000 00000000 00000000 037e7bc0 00172d50

037e9e70: 00000010 037e8000 000040d0 00000000 00000001 000240d0 00000000 00000000

037e9e90: 00172d50 00000001 00000044 037e8000 037e8000 037e8000 000240d0 037e8000

037e9eb0: 00000010 00a318a0 00000000 00000000 00000000 00000000 00000000 00000000

037e9ed0: 00000000 00000000 ffffffff 037e9f0c <00084678> 037c54a0 037c4300 0016082c

037e9ef0:<000846ec> 037fb6a4 00000000 000000d2 0016082c 000000d0 037e9f0c 037e6e10

037e9f10: 00000000 00000000 <001397e4><00084852> 0016082c 037c4300 00000000 <00069b10>

037e9f30: 037c54a0 037c4300 00192328 037e9f60 00004000 00000000 00000000 00000000

037e9f50: 0016082c 037e9f60 <00069d34> 0016aa48 000000d2 <00069d42> 0016aa48 0015fd38

037e9f70: 037c54a0 037c4300 037e9f9c 7fffff00 00000001 <0002d622> 037e9f9c 00000061

037e9f90: 0000000e <00069e06> 037c4300 00003739 00000000 00180000 <0002d67e> 00169388

037e9fb0: 001920f8 00000061 0016aa48 <001763b0> 001922c4 001920f8 00000000 00000000

037e9fd0: 00000000 00000000 00000000 00000000 00000000 <0000145e> 00000000 00000000

037e9ff0: 00000000 00000000 ffffffff 00000006 037f73a8

Return addresses in stack:

address : <0x000ad62e> { _bfin_rtc_interrupt + 0x76 }

address : <0x0002bed2> { _disable_irq + 0x32 }

address : <0x0002c28a> { _request_irq + 0xaa }

address : <0x001051cc> { _bfin_rtc_probe + 0x4c }

frame 1 : <0x0006e9be> { _create_dir + 0x3a }

address : <0x0009c480> { _driver_sysfs_add + 0x44 }

address : <0x0009c588> { _driver_probe_device + 0x80 }

address : <0x00103ba0> { _klist_next + 0x20 }

address : <0x00103bc8> { _klist_next + 0x48 }

address : <0x0009c6e0> { ___driver_attach + 0x6c }

address : <0x0009bd9e> { _bus_for_each_dev + 0x3a }

address : <0x000853c0> { _kobject_init_and_add + 0x24 }

address : <0x0009c436> { _driver_attach + 0x1a }

address : <0x0009c150> { _bus_add_driver + 0x64 }

address : <0x0009c16e> { _bus_add_driver + 0x82 }

address : <0x0009c830> { _driver_register + 0x40 }

address : <0x00001028> { _do_one_initcall + 0x28 }

address : <0x00084678> { _ida_get_new_above + 0x94 }

address : <0x000846ec> { _ida_get_new_above + 0x108 }

address : <0x001397e4> /* kernel dynamic memory */

address : <0x00084852> { _ida_pre_get + 0xe }

address : <0x00069b10> { _proc_register + 0x30 }

address : <0x00069d34> { _create_proc_entry + 0x3c }

address : <0x00069d42> { _create_proc_entry + 0x4a }

address : <0x0002d622> { _register_irq_proc + 0x76 }

address : <0x00069e06> { _proc_mkdir_mode + 0x2e }

address : <0x0002d67e> { _init_irq_proc + 0x42 }

address : <0x001763b0> { _kernel_init + 0x84 }

address : <0x0000145e> { _kernel_thread_helper + 0x6 }

Modules linked in:

Kernel panic - not syncing: Kernel exception

Follow-ups

--- Mike Frysinger 2009-04-20 10:27:48

i'm thinking we should always enable CONFIG_DEBUG_SHIRQ in our defconfigs ... is

there a downside to it ?

--- Michael Hennerich 2009-04-20 10:41:36

>is there a downside to it

Just like every other DEBUG option...

It adds extra code and involves some runtime overhead.

CONFIG_DEBUG_SHIRQ invokes the ISR handlerfunction during request_irq.

This can cause problems in case some of the data structures are not fully

initialized or allocated. I guess that is what CONFIG_DEBUG_SHIRQ should

trigger.

On Blackfin we typically don't use SHARED IRQs.

-Michael

--- Mike Frysinger 2009-04-20 14:12:32

some DEBUG options cause constant overhead. if this only causes overhead at

request_irq() time, then it sounds like a good option to enable in all of our

defconfigs.

--- Michael Hennerich 2009-04-22 03:30:28

Mike,

I checked in a temp fix - please review and close.

/**

* bfin_rtc_interrupt - handle interrupt from RTC

* Since we handle all RTC events here, we have to make sure the requested

* interrupt is enabled (in RTC_ICTL) as the event status register (RTC_ISTAT)

* always gets updated regardless of the interrupt being enabled. So when one

* even we care about (e.g. stopwatch) goes off, we don't want to turn around

* and say that other events have happened as well (e.g. second). We do not

* have to worry about pending writes to the RTC_ICTL register as interrupts

* only fire if they are enabled in the RTC_ICTL register.

The last line in above comment block isn't true in case CONFIG_DEBUG_SHIRQ is

enabled and the IRQ is requested IRQF_SHARED. CONFIG_DEBUG_SHIRQ causes a

spurious interrupt, as soon as the IRQ is requested, by design.

As far as I can tell there is no need to request the RTC IRQ, IRQF_SHARED.

I removed the IRQF_SHARED flag.

Michael

--- Mike Frysinger 2009-04-22 17:13:22

yes, i dont think the irq should be marked shared, but i still think this driver

(and many others) are still broken. the irq cant be requested until the

interrupt handler is safe to run. spurious irqs or unexpected edge cases can

still trigger.

--- Mike Frysinger 2009-04-23 22:55:01

ive committed a final fix so that the irq handler is not registered until

everything is ready ... so it should work now w/out crashing even if the handler

is registered with shared, but no point in adding that back

Files

Changes

Commits

Dependencies

Duplicates

Associations