Subject: RE: [vserver] A bug about system call on ARM
From: "Wang, Yalin" <Yalin.Wang@sonymobile.com>
Date: Sat, 1 Jun 2013 18:09:51 +0800

 Sat, 1 Jun 2013 18:09:51 +0800
Hi  Herert

Thanks for yout reply .

Will Deacon [will.deacon@arm.com]  has give 
A patch to me for test .
You can see it here :

https://git.kernel.org/cgit/linux/kernel/git/will/linux.git/commit/?h=misc-patches


Thanks 

-----Original Message-----
From: Herbert Poetzl [mailto:herbert@13thfloor.at] 
Sent: Saturday, June 01, 2013 8:40 AM
To: Wang, Yalin
Cc: 'vserver@list.linux-vserver.org'
Subject: Re: [vserver] A bug about system call on ARM

On Wed, May 29, 2013 at 01:28:42PM +0800, Wang, Yalin wrote:
> Hi  all,

> I am a new comer to this mailing list , I am happy to join this 
> community .

> I have a bug reported from our android phones which is caused by the 
> system call .
> It seems like kernel bugs from my view .

Hmm, how is that Linux-VServer related?
What kernel and Linux-VServer patch do you use?

Thanks,
Herbert

> Crash in  file  arch\arm\kernel\ entry-common.S

> #if defined(CONFIG OABI COMPAT)

>                         /*
>                         * If we have CONFIG OABI COMPAT then we need to look at the
swi
>                         * value to determine if it is an EABI or an old ABI call.
>                         */
> #ifdef CONFIG ARM THUMB
>                         tst                  r8, #PSR T BIT
>                         movne        r10, #0                                     
                                          @ no thumb OABI emulation
>                         ldreq            r10, [lr, #-4]                          
                                           @ get SWI instruction              // crash
at this instruction, when get SWI instruction
> #else
>                         ldr                  r10, [lr, #-4]                      
                                               @ get SWI instruction
>   A710(         and               ip, r10, #0x0f000000                           
                     @ check for SWI                                   )
>   A710(         teq                ip, #0x0f000000                               
                                                                                   
               )
>   A710(         bne               .Larm710bug                                    
                                                                                   
                )
> #endif
> #ifdef CONFIG CPU ENDIAN BE8
>                         rev                 r10, r10                             
                        @ little endian instruction
> #endif



> Then reason why it will crash when get SWI instruction is maybe This 
> page is clear to aged by kernel, But this MMU fault happpened in 
> kernel, So the kernel do page fault function will not clear this page 
> to young, So that  will crash .

> It should poll this page to make it present or the fault should be 
> handled by fixup section , Anyway, this place should not crash by kernel .

> The kernel version I used  is  3.4.0
> I have add the kernel log and the call stack recoverd by trace32 tools 
> Pls have a look at it .


> Thanks .


> Yalin.Wang
> Software Engineer
> OS Kernel&Graphics

> Sony Mobile Communications
> Tel: +86 10 5966 9819
> Phone: 18610323092
> Address: No.16 Guangshun South Street, Chaoyang, Beijing, P.R.C.

> sonymobile.com<http://sonymobile.com/>

> [cid:image001.jpg@01CE5C5F.6BD2AAE0]





Content-Description: stack.txt
> 	crash notes save this cpu(type = CRASH NOTE CRASHING, cpu = 1)
> 	update crash notes(?, ?, ?)
> 	notifier call chain(?, val = 0, v = 0xC0ECBE9C, nr to call = 5, nr calls = 0x0)
> 	  atomic notifier call chain(nh = 0xC0ECC29C, val = 0, v = 0xC0ECBE9C, nr to call
= -1, nr calls = 0x0)
> 	atomic notifier call chain(?, ?, ?)
> 	panic(fmt = 0xC098BC02)
> 	die(?, regs = 0xE0601F68, err = 23)
> 	  do kernel fault.part.8(mm = 0xC73E7DC0, addr = 1075872796, fsr = 23, regs = 0xE0601F68)
> 	do page fault(addr = 3342761408, fsr = 23, regs = 0x4020841C)
> 	do DataAbort(addr = 1075872796, fsr = 23, regs = 0xE0601F68)
> 	  dabt svc(asm)
> 	exception
> 	vector swi(asm)
> 	ret fast syscall(asm)
> 	exception
> 	NUR:0xFFFF:0x40208420(asm)
> 	end of frame