Subject: Re: [vserver] A bug about system call on ARM
From: Herbert Poetzl <herbert@13thfloor.at>
Date: Sat, 1 Jun 2013 13:00:51 +0200

On Sat, Jun 01, 2013 at 06:09:51PM +0800, Wang, Yalin wrote:
> Hi  Herert

> Thanks for yout reply .

> Will Deacon [will.deacon@arm.com]  has give 
> A patch to me for test .

I'm glad you got a patch :)

> You can see it here :

> https://git.kernel.org/cgit/linux/kernel/git/will/linux.git/commit/?h=misc-patches

Still no relation to Linux-VServer AFAICT

So IMHO wrong mailing list.

best,
Herbert

> Thanks 

> -----Original Message-----
> From: Herbert Poetzl [mailto:herbert@13thfloor.at] 
> Sent: Saturday, June 01, 2013 8:40 AM
> To: Wang, Yalin
> Cc: 'vserver@list.linux-vserver.org'
> Subject: Re: [vserver] A bug about system call on ARM

> On Wed, May 29, 2013 at 01:28:42PM +0800, Wang, Yalin wrote:
>> Hi  all,

>> I am a new comer to this mailing list , I am happy to join this 
>> community .

>> I have a bug reported from our android phones which is caused by the 
>> system call .
>> It seems like kernel bugs from my view .

> Hmm, how is that Linux-VServer related?
> What kernel and Linux-VServer patch do you use?

> Thanks,
> Herbert

>> Crash in  file  arch\arm\kernel\ entry-common.S

>> #if defined(CONFIG_OABI_COMPAT)

>>                         /*
>>                         * If we have CONFIG_OABI_COMPAT then we need to look at the
swi
>>                         * value to determine if it is an EABI or an old ABI call.
>>                         */
>> #ifdef CONFIG_ARM_THUMB
>>                         tst                  r8, #PSR_T_BIT
>>                         movne        r10, #0                                    
                                           @ no thumb OABI emulation
>>                         ldreq            r10, [lr, #-4]                         
                                            @ get SWI instruction              // crash
at this instruction, when get SWI instruction
>> #else
>>                         ldr                  r10, [lr, #-4]                     
                                                @ get SWI instruction
>>   A710(         and               ip, r10, #0x0f000000                          
                      @ check for SWI                                   )
>>   A710(         teq                ip, #0x0f000000                              
                                                                                   
                )
>>   A710(         bne               .Larm710bug                                   
                                                                                   
                 )
>> #endif
>> #ifdef CONFIG_CPU_ENDIAN_BE8
>>                         rev                 r10, r10                            
                         @ little endian instruction
>> #endif



>> Then reason why it will crash when get SWI instruction is maybe This 
>> page is clear to aged by kernel, But this MMU fault happpened in 
>> kernel, So the kernel do_page_fault function will not clear this page 
>> to young, So that  will crash .

>> It should poll this page to make it present or the fault should be 
>> handled by fixup section , Anyway, this place should not crash by kernel .

>> The kernel version I used  is  3.4.0
>> I have add the kernel log and the call stack recoverd by trace32 tools 
>> Pls have a look at it .


>> Thanks .


>> Yalin.Wang
>> Software Engineer
>> OS Kernel&Graphics

>> Sony Mobile Communications
>> Tel: +86 10 5966 9819
>> Phone: 18610323092
>> Address: No.16 Guangshun South Street, Chaoyang, Beijing, P.R.C.

>> sonymobile.com<http://sonymobile.com/>

>> [cid:image001.jpg@01CE5C5F.6BD2AAE0]





> Content-Description: stack.txt
>> 	crash_notes_save_this_cpu(type = CRASH_NOTE_CRASHING, cpu = 1)
>> 	update_crash_notes(?, ?, ?)
>> 	notifier_call_chain(?, val = 0, v = 0xC0ECBE9C, nr_to_call = 5, nr_calls = 0x0)
>> 	__atomic_notifier_call_chain(nh = 0xC0ECC29C, val = 0, v = 0xC0ECBE9C, nr_to_call
= -1, nr_calls = 0x0)
>> 	atomic_notifier_call_chain(?, ?, ?)
>> 	panic(fmt = 0xC098BC02)
>> 	die(?, regs = 0xE0601F68, err = 23)
>> 	__do_kernel_fault.part.8(mm = 0xC73E7DC0, addr = 1075872796, fsr = 23, regs = 0xE0601F68)
>> 	do_page_fault(addr = 3342761408, fsr = 23, regs = 0x4020841C)
>> 	do_DataAbort(addr = 1075872796, fsr = 23, regs = 0xE0601F68)
>> 	__dabt_svc(asm)
>> 	exception
>> 	vector_swi(asm)
>> 	ret_fast_syscall(asm)
>> 	exception
>> 	NUR:0xFFFF:0x40208420(asm)
>> 	end of frame