From patchwork Fri Sep 27 08:59:23 2013 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Lothar_Wa=C3=9Fmann?= X-Patchwork-Id: 278498 Return-Path: X-Original-To: incoming-imx@patchwork.ozlabs.org Delivered-To: patchwork-incoming-imx@bilbo.ozlabs.org Received: from casper.infradead.org (unknown [IPv6:2001:770:15f::2]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by ozlabs.org (Postfix) with ESMTPS id 78B762C0099 for ; Fri, 27 Sep 2013 19:00:13 +1000 (EST) Received: from merlin.infradead.org ([2001:4978:20e::2]) by casper.infradead.org with esmtps (Exim 4.80.1 #2 (Red Hat Linux)) id 1VPTu6-0003ex-I3; Fri, 27 Sep 2013 09:00:02 +0000 Received: from localhost ([::1] helo=merlin.infradead.org) by merlin.infradead.org with esmtp (Exim 4.80.1 #2 (Red Hat Linux)) id 1VPTu3-0003r6-NY; Fri, 27 Sep 2013 08:59:59 +0000 Received: from mail.karo-electronics.de ([81.173.242.67]) by merlin.infradead.org with esmtps (Exim 4.80.1 #2 (Red Hat Linux)) id 1VPTtz-0003pz-K8 for linux-arm-kernel@lists.infradead.org; Fri, 27 Sep 2013 08:59:57 +0000 Message-ID: <21061.18667.822159.317689@ipc1.ka-ro> Date: Fri, 27 Sep 2013 10:59:23 +0200 From: =?utf-8?Q?Lothar_Wa=C3=9Fmann?= To: Marc Kleine-Budde Mime-Version: 1.0 Subject: Re: imprecise external abort using the flexcan driver on i.MX6Q In-Reply-To: <524455FD.7070808@pengutronix.de> References: <21060.15934.600859.167074@ipc1.ka-ro> <524455FD.7070808@pengutronix.de> X-Mailer: VM 8.1.0 under 23.2.1 (x86_64-pc-linux-gnu) X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20130927_045955_958548_7606AEDC X-CRM114-Status: GOOD ( 19.13 ) X-Spam-Score: -5.0 (-----) X-Spam-Report: SpamAssassin version 3.3.2 on merlin.infradead.org summary: Content analysis details: (-5.0 points) pts rule name description ---- ---------------------- -------------------------------------------------- -0.7 RCVD_IN_DNSWL_LOW RBL: Sender listed at http://www.dnswl.org/, low trust [81.173.242.67 listed in list.dnswl.org] -2.4 RP_MATCHES_RCVD Envelope sender domain matches handover relay domain -1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1% [score: 0.0000] Cc: linux-arm-kernel@lists.infradead.org, "linux-can@vger.kernel.org" X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.15 Precedence: list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+incoming-imx=patchwork.ozlabs.org@lists.infradead.org List-Id: linux-imx-kernel.lists.patchwork.ozlabs.org Marc Kleine-Budde writes: > On 09/26/2013 04:01 PM, Lothar Waßmann wrote: > > Hi, > > > > when enabling the can interface with 'ifconfig can0 up' (after > > configuring the bitrate with canconfig) on an i.MX6Q board (TX6) I'm > > getting the following kernel dump: > > > > |flexcan 2094000.flexcan can0: writing ctrl=0x0a212003 > > |flexcan 2094000.flexcan can0: flexcan_set_bittiming: mcr=0x5980000f ctrl=0x0a212003 > > |flexcan 2094000.flexcan can0: flexcan_chip_start: writing mcr=0x79a2020f > > |flexcan 2094000.flexcan can0: flexcan_chip_start: writing ctrl=0x0a21ac53 > > |Unhandled fault: imprecise external abort (0x1c06) at 0x00057adc > > Looks like a NULL pointer deref to me. But it doesn't make any sense, > because the offset is way beyond the length of the struct flexcan_regs. > Since it is an 'imprecise' external abort the access is obviously not directly related to a CPU write, but rather caused by DMA access (by the flexcan controller). But I cannot imagine why the flexcan controller would want to access memory when clearing the control word of the second mailbox. > > The same kernel/driver works perfectly well on an i.MX53 based board. > > Just to be sure, can you boot with one CPU only. > same result. > > The data abort happens upon writing to can_ctrl in the second run of > > this loop in flexcan_chip_start(): > > | for (i = 0; i < ARRAY_SIZE(regs->cantxfg); i++) { > > | flexcan_write(0, ®s->cantxfg[i].can_ctrl); > > ----------------^ crashes here with i = 1 > > Can you instrument flexcan_write(). > I applied the following patch: This now leads to a hang or a: "BUG: recent printk recursion!" (obviously because the data abort is induced while the printk() is being executed). The line numbers printed are adjusted to match the original kernel source: |CAN device driver interface |flexcan_chip_disable@286: read 5980000f from c0ae8000 |flexcan_chip_disable@288: writing d980000f to c0ae8000 |register_flexcandev@952: read 00000000 from c0ae8004 |register_flexcandev@954: writing 00002000 to c0ae8004 |flexcan_chip_enable@274: read d890000f from c0ae8000 |flexcan_chip_enable@276: writing 5890000f to c0ae8000 |register_flexcandev@959: read 5980000f from c0ae8000 |register_flexcandev@962: writing 7980000f to c0ae8000 |register_flexcandev@969: read 7980000f from c0ae8000 |flexcan_get_berr_counter@296: read 00000000 from c0ae801c |flexcan_chip_disable@286: read 7980000f from c0ae8000 |flexcan_chip_disable@288: writing f980000f to c0ae8000 |flexcan 2090000.flexcan: device registered (reg_base=c0ae8000, irq=142) |flexcan_chip_disable@286: read 5980000f from c0af0000 |flexcan_chip_disable@288: writing d980000f to c0af0000 |register_flexcandev@952: read 00000000 from c0af0004 |register_flexcandev@954: writing 00002000 to c0af0004 |flexcan_chip_enable@274: read d890000f from c0af0000 |flexcan_chip_enable@276: writing 5890000f to c0af0000 |register_flexcandev@959: read 5980000f from c0af0000 |register_flexcandev@962: writing 7980000f to c0af0000 |register_flexcandev@969: read 7980000f from c0af0000 |flexcan_get_berr_counter@296: read 00000000 from c0af001c |flexcan_chip_disable@286: read 7980000f from c0af0000 |flexcan_chip_disable@288: writing f980000f to c0af0000 |flexcan 2094000.flexcan: device registered (reg_base=c0af0000, irq=143) |flexcan_get_berr_counter@296: read 00000000 from c0ae801c |flexcan_get_berr_counter@296: read 00000000 from c0af001c |flexcan_get_berr_counter@296: read 00000000 from c0ae801c |flexcan_get_berr_counter@296: read 00000000 from c0af001c |flexcan_chip_enable@274: read f890000f from c0ae8000 |flexcan_chip_enable@276: writing 7890000f to c0ae8000 |flexcan_chip_start@713: writing 02000000 to c0ae8000 |flexcan_chip_start@716: read 5980000f from c0ae8000 |flexcan_set_bittiming@664: read 00002000 from c0ae8004 |flexcan 2090000.flexcan can0: writing ctrl=0x0a212003 |flexcan_set_bittiming@688: writing 0a212003 to c0ae8004 |flexcan_set_bittiming@692: read 5980000f from c0ae8000 |flexcan_set_bittiming@692: read 0a212003 from c0ae8004 |flexcan 2090000.flexcan can0: flexcan_set_bittiming: mcr=0x5980000f ctrl=0x0a212003 |flexcan_chip_start@738: read 5980000f from c0ae8000 |flexcan 2090000.flexcan can0: flexcan_chip_start: writing mcr=0x79a2020f |flexcan_chip_start@743: writing 79a2020f to c0ae8000 |flexcan_chip_start@757: read 0a212003 from c0ae8004 |flexcan 2090000.flexcan can0: flexcan_chip_start: writing ctrl=0x0a21ac53 |flexcan_chip_start@773: writing 0a21ac53 to c0ae8004 |flexcan_chip_start@776: writing 00000000 to c0ae8080 |flexcan_chip_start@777: writing 00000000 to c0ae8084 |flexcan_chip_start@778: writing 00000000 to c0ae8088 |flexcan_chip_start@779: writing 00000000 to c0ae808c |flexcan_chip_start@783: writing 04000000 to c0ae8080 |flexcan_chip_start@776: writing 00000000 to c0ae8090 here the CPU either hangs or continues with: |BUG: recent printk recursion! |Internal error: : 1c06 [#1] SMP ARM |Modules linked in: flexcan can_dev snd_soc_imx_sgtl5000 snd_soc_fsl_ssi imx_pcm_dma snd_soc_imx_audmux snd_soc_s |gtl5000 snd_soc_core regmap_spi snd_pcm_dmaengine snd_pcm snd_timer snd_page_alloc evdev snd_compress snd regmap |_i2c edt_ft5x06 |CPU: 0 PID: 1271 Comm: ifconfig Not tainted 3.12.0-rc1-next-20130919-karo+ #95 |task: beb83500 ti: be178000 task.ti: be178000 |PC is at vprintk_emit+0x11c/0x4c4 |LR is at vprintk_emit+0x108/0x4c4 |pc : [<8004f908>] lr : [<8004f8f4>] psr: 60000093 |sp : be179db8 ip : 00000000 fp : 00000000 |r10: c0ae8004 r9 : 00000000 r8 : 00000000 |r7 : 00000000 r6 : ffffffff r5 : 8061b930 r4 : 00000000 |r3 : 805f47a4 r2 : 000010ab r1 : 00000000 r0 : 00000000 |Flags: nZCv IRQs off FIQs on Mode SVC_32 ISA ARM Segment user |Control: 10c5387d Table: 4e1a404a DAC: 00000015 |Process ifconfig (pid: 1271, stack limit = 0xbe178240) |Stack: (0xbe179db8 to 0xbe17a000) |9da0: 00000000 00000000 |9dc0: 00000000 00000000 8061c230 00000034 7f0c1158 be179dcc 60000013 00000000 |9de0: 8051f255 c0ae8000 bebef800 00000000 c0ae8090 00000001 c0ae808c c0ae8004 |9e00: c0ae8088 803f4360 7f0c103e be179e24 00000309 be179e24 c0ae8000 7f0bf82c |9e20: 7f0c103e 7f0c0b23 00000309 00000000 c0ae8094 0a212003 be8c1400 bebef800 |9e40: 00000000 be81e480 bebef82c 7eb89c08 00008914 00000000 00000001 7f0c08fc |9e60: bebef800 bebef800 bebef800 000000c1 7f0c0e68 8036f358 8036f2dc bebef800 |9e80: 000000c1 00000001 00040080 8036f590 beb83500 bebef800 00040080 beb37600 |9ea0: bebef800 8036f690 00000000 beb3760c beb37600 803b9658 00000000 01b89c08 |9ec0: 306e6163 00000000 00000000 00000000 000000c1 76fa44d0 7eb89ed5 000566ce |9ee0: 00000080 00008914 be047b40 7eb89c08 00008914 00000003 be178000 7eb89c08 |9f00: bd844920 8035ae40 7eb89c08 be047b40 00000003 800bb464 7eb89c08 800bbfa8 |9f20: be166a80 00000003 804379c0 800add4c 00000020 00000003 805eeff8 be179f60 |9f40: 00000003 800ade08 805e7bb8 805eeff8 bd844900 00000000 00000002 8035a5fc |9f60: be8ce3d0 7eb89c08 be047b40 00000000 00008914 00000003 be178000 00000000 |9f80: 00000000 800bc030 00000003 00000000 0005868f 00000004 00054f14 00000036 |9fa0: 8000e7e4 8000e660 0005868f 00000004 00000003 00008914 7eb89c08 0005868f |9fc0: 0005868f 00000004 00054f14 00000036 00000000 00000000 7eb89ee3 00000000 |9fe0: 00000000 7eb89bf0 0000cad4 76e6f87c 20000010 00000003 4eff1811 4eff1c11 |[<8004f908>] (vprintk_emit+0x11c/0x4c4) from [<803f4360>] (printk+0x2c/0x3c) |[<803f4360>] (printk+0x2c/0x3c) from [<7f0bf82c>] (flexcan_chip_start+0x358/0x620 [flexcan]) |[<7f0bf82c>] (flexcan_chip_start+0x358/0x620 [flexcan]) from [<7f0c08fc>] (flexcan_open+0x74/0x118 [flexcan]) |[<7f0c08fc>] (flexcan_open+0x74/0x118 [flexcan]) from [<8036f358>] (__dev_open+0x7c/0xfc) |[<8036f358>] (__dev_open+0x7c/0xfc) from [<8036f590>] (__dev_change_flags+0x8c/0x118) |[<8036f590>] (__dev_change_flags+0x8c/0x118) from [<8036f690>] (dev_change_flags+0x10/0x44) |[<8036f690>] (dev_change_flags+0x10/0x44) from [<803b9658>] (devinet_ioctl+0x2a4/0x62c) |[<803b9658>] (devinet_ioctl+0x2a4/0x62c) from [<8035ae40>] (sock_ioctl+0x220/0x274) |[<8035ae40>] (sock_ioctl+0x220/0x274) from [<800bb464>] (vfs_ioctl+0x28/0x3c) |[<800bb464>] (vfs_ioctl+0x28/0x3c) from [<800bbfa8>] (do_vfs_ioctl+0x53c/0x590) |[<800bbfa8>] (do_vfs_ioctl+0x53c/0x590) from [<800bc030>] (SyS_ioctl+0x34/0x58) |[<800bc030>] (SyS_ioctl+0x34/0x58) from [<8000e660>] (ret_fast_syscall+0x0/0x30) |Code: e59f338c e3a00000 e3540000 e583705c (0a00000c) |---[ end trace 16ce38ae8b7c1165 ]--- |Kernel panic - not syncing: Fatal exception Lothar Waßmann --- .pc/flexcan-debug2/drivers/net/can/flexcan.c 2013-09-27 10:48:23.940490850 +0200 +++ drivers/net/can/flexcan.c 2013-09-27 10:56:17.108489543 +0200 @@ -248,8 +248,28 @@ static inline void flexcan_write(u32 val out_be32(addr, val); } #else -static inline u32 flexcan_read(void __iomem *addr) +#ifdef DEBUG +#define LINE_OFFS 21 +#define flexcan_read(a) flexcan_dbg_read(a, __func__, __LINE__) +static inline u32 flexcan_dbg_read(void __iomem *addr, + const char *fn, int ln) { + u32 val = readl(addr); + printk("%s@%d: read %08x from %p\n", fn, ln - LINE_OFFS, val, addr); + return val; +} + +#define flexcan_write(v, a) flexcan_dbg_write(v, a, __func__, __LINE__) +static inline void flexcan_dbg_write(u32 val, void __iomem *addr, + const char *fn, int ln) +{ + printk("%s@%d: writing %08x to %p\n", fn, ln - LINE_OFFS, val, addr); + writel(val, addr); +} +#else +static inline u32 flexcan_dbg_read(void __iomem *addr) +{ + u32 val = readl(addr); return readl(addr); } @@ -257,6 +277,7 @@ static inline void flexcan_write(u32 val { writel(val, addr); } +#endif /* DEBUG */ #endif static inline int flexcan_has_and_handle_berr(const struct flexcan_priv *priv,