Subject: A bug about system call on ARM
From: "Wang, Yalin" <Yalin.Wang@sonymobile.com>
Date: Wed, 29 May 2013 13:28:42 +0800
Wed, 29 May 2013 13:28:42 +0800
["multipart/related" not shown]
Hi  all,

I am a new comer to this mailing list ,
I am happy to join this community .

I have a bug reported from our android phones which is caused by  the system call .
It seems like kernel bugs from my view .

Crash in  file  arch\arm\kernel\ entry-common.S

#if defined(CONFIG OABI COMPAT)

                        /*
                        * If we have CONFIG OABI COMPAT then we need to look at the
swi
                        * value to determine if it is an EABI or an old ABI call.
                        */
#ifdef CONFIG ARM THUMB
                        tst                  r8, #PSR T BIT
                        movne        r10, #0                                       
                                        @ no thumb OABI emulation
                        ldreq            r10, [lr, #-4]                            
                                         @ get SWI instruction              // crash
at this instruction, when get SWI instruction
#else
                        ldr                  r10, [lr, #-4]                        
                                             @ get SWI instruction
  A710(         and               ip, r10, #0x0f000000                             
                   @ check for SWI                                   )
  A710(         teq                ip, #0x0f000000                                 
                                                                                   
             )
  A710(         bne               .Larm710bug                                      
                                                                                   
              )
#endif
#ifdef CONFIG CPU ENDIAN BE8
                        rev                 r10, r10                               
                      @ little endian instruction
#endif



Then reason why it will crash when get SWI instruction is maybe
This page is clear to aged by kernel,
But this MMU fault happpened in kernel,
So the kernel do page fault function will not clear this page to young,
So that  will crash .

It should poll this page to make it present or the fault should be handled by fixup
section ,
Anyway, this place should not crash by kernel .

The kernel version I used  is  3.4.0
I have add the kernel log and the call stack recoverd by trace32 tools
Pls have a look at it .


Thanks .


Yalin.Wang
Software Engineer
OS Kernel&Graphics

Sony Mobile Communications
Tel: +86 10 5966 9819
Phone: 18610323092
Address: No.16 Guangshun South Street, Chaoyang, Beijing, P.R.C.

sonymobile.com<http://sonymobile.com/>

[cid:image001.jpg@01CE5C5F.6BD2AAE0]



Hi  all,

 

I am a new comer to this mailing list ,

I am happy to join this community .

 

I have a bug reported from our android phones which is caused by  the system call .

It seems like kernel bugs from my view .

 

Crash in  file  arch\arm\kernel\ entry-common.S

 

#if defined(CONFIG OABI COMPAT)

 

                        /*

                        * If we have CONFIG OABI COMPAT then we need to look at the swi

                        * value to determine if it is an EABI or an old ABI call.

                        */

#ifdef CONFIG ARM THUMB

                        tst                  r8, #PSR T BIT

                        movne        r10, #0                                                                                @ no thumb OABI emulation

                        ldreq            r10, [lr, #-4]                                                                      @ get SWI instruction              // crash at this instruction, when get SWI instruction

#else

                        ldr                  r10, [lr, #-4]                                                                      @ get SWI instruction

  A710(         and               ip, r10, #0x0f000000                                                 @ check for SWI                                   )

  A710(         teq                ip, #0x0f000000                                                                                                                                   )

  A710(         bne               .Larm710bug                                                                                                                                         )

#endif

#ifdef CONFIG CPU ENDIAN BE8

                        rev                 r10, r10                                                      @ little endian instruction

#endif

 

 

 

Then reason why it will crash when get SWI instruction is maybe

This page is clear to aged by kernel,

But this MMU fault happpened in kernel,

So the kernel do page fault function will not clear this page to young,

So that  will crash .

 

It should poll this page to make it present or the fault should be handled by fixup section ,

Anyway, this place should not crash by kernel .

 

The kernel version I used  is  3.4.0

I have add the kernel log and the call stack recoverd by trace32 tools

Pls have a look at it .

 

 

Thanks .

 

 

Yalin.Wang

Software Engineer

OS Kernel&Graphics

 

Sony Mobile Communications

Tel: +86 10 5966 9819

Phone: 18610323092

Address: No.16 Guangshun South Street, Chaoyang, Beijing, P.R.C.

 

sonymobile.com

  

SONY make.believe

 


["image/jpeg" not shown]
["application/octet-stream" not shown]
	crash_notes_save_this_cpu(type = CRASH_NOTE_CRASHING, cpu = 1)
	update_crash_notes(?, ?, ?)
	notifier_call_chain(?, val = 0, v = 0xC0ECBE9C, nr_to_call = 5, nr_calls = 0x0)
	__atomic_notifier_call_chain(nh = 0xC0ECC29C, val = 0, v = 0xC0ECBE9C, nr_to_call =
-1, nr_calls = 0x0)
	atomic_notifier_call_chain(?, ?, ?)
	panic(fmt = 0xC098BC02)
	die(?, regs = 0xE0601F68, err = 23)
	__do_kernel_fault.part.8(mm = 0xC73E7DC0, addr = 1075872796, fsr = 23, regs = 0xE0601F68)
	do_page_fault(addr = 3342761408, fsr = 23, regs = 0x4020841C)
	do_DataAbort(addr = 1075872796, fsr = 23, regs = 0xE0601F68)
	__dabt_svc(asm)
	exception
	vector_swi(asm)
	ret_fast_syscall(asm)
	exception
	NUR:0xFFFF:0x40208420(asm)
	end of frame