From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from phobos.denx.de (phobos.denx.de [85.214.62.61]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 9DA39C4332F for ; Wed, 23 Mar 2022 10:07:43 +0000 (UTC) Received: from h2850616.stratoserver.net (localhost [IPv6:::1]) by phobos.denx.de (Postfix) with ESMTP id 735C083C91; Wed, 23 Mar 2022 11:07:41 +0100 (CET) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=163.com Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de Authentication-Results: phobos.denx.de; dkim=pass (1024-bit key; unprotected) header.d=163.com header.i=@163.com header.b="HSQ2Pcg5"; dkim-atps=neutral Received: by phobos.denx.de (Postfix, from userid 109) id 3F11883C97; Wed, 23 Mar 2022 11:07:39 +0100 (CET) Received: from m12-12.163.com (m12-12.163.com [220.181.12.12]) by phobos.denx.de (Postfix) with ESMTP id B393583C0F for ; Wed, 23 Mar 2022 11:07:35 +0100 (CET) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=163.com Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=qianfanguijin@163.com DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=163.com; s=s110527; h=Message-ID:Date:MIME-Version:Subject:From; bh=Yw8+O E9x/a/6oe+ySHxV6w9Yyy7+MrSlUk+rKeeUpGU=; b=HSQ2Pcg5XHBVfVxXPJRzR IqaoIWI644wBip1WKVVscvTkx3F/YE4kwY5k3b7VYBkYwzH5yZXwsM1BDhyGXeQt t/BUl6ewEJmaeQcaoqYHhfyOoHR4iBLX8/Q7dmjJRjJ1sQLREow4SU2c4nNGsvC5 naD9RmWoOFuEq2zjFjE4N0= Received: from [192.168.3.109] (unknown [218.201.129.19]) by smtp8 (Coremail) with SMTP id DMCowAAnd49f8Tpi+0CXBg--.18466S2; Wed, 23 Mar 2022 18:07:28 +0800 (CST) Message-ID: Date: Wed, 23 Mar 2022 18:07:24 +0800 MIME-Version: 1.0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Thunderbird/91.7.0 Subject: Re: data abort when run 'dhcp' Content-Language: en-US To: Heinrich Schuchardt Cc: u-boot@lists.denx.de References: <7536b9e1-de7a-a492-6951-485d4eb75df1@163.com> <2fe3a2a4-ec68-b18f-3446-ae6cb4de6d32@163.com> <23003c48-f525-f886-a241-e7bac7a68643@163.com> <7884d265-3c73-a695-104f-0b34d3e8bc18@163.com> From: qianfan In-Reply-To: Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit X-CM-TRANSID: DMCowAAnd49f8Tpi+0CXBg--.18466S2 X-Coremail-Antispam: 1Uf129KBjvJXoWxKF1DKFyDWrWUKr1DWw45KFg_yoWxuw1xpF WUJa1Ygr4kJr1Dtw4ktr90qF12yrs7GF1UWry8G348uF1qvF1xtr4Ut3WUCryUZr48Jr1j yr1UtwnxZr1Utw7anT9S1TB71UUUUUUqnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDUYxBIdaVFxhVjvjDU0xZFpf9x07U3GYJUUUUU= X-Originating-IP: [218.201.129.19] X-CM-SenderInfo: htld0w5dqj3xxmlqqiywtou0bp/1tbiygDM7VQHOco4tQAAsG X-BeenThere: u-boot@lists.denx.de X-Mailman-Version: 2.1.39 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.denx.de Sender: "U-Boot" X-Virus-Scanned: clamav-milter 0.103.5 at phobos.denx.de X-Virus-Status: Clean 在 2022/3/23 17:51, Heinrich Schuchardt 写道: > On 3/23/22 10:13, qianfan wrote: >> >> 在 2022/3/23 16:02, qianfan 写道: >>> >>> >>> 在 2022/3/23 15:45, qianfan 写道: >>>> >>>> >>>> 在 2022/3/23 10:28, qianfan 写道: >>>>> >>>>> Hi: >>>>> >>>>> I had a custom AM335X board connected my computer by usbnet. It >>>>> always report data abort when 'dhcp': >>>>> >>>>> Next it the log: >>>>> >>>>> U-Boot 2022.01-rc1-00183-gfa5b4e2d19-dirty (Feb 25 2022 - 15:45:02 >>>>> +0800) >>>>> >>>>> CPU  : AM335X-GP rev 2.1 >>>>> Model: WISDOM AM335X CCT >>>>> DRAM:  512 MiB >>>>> NAND:  256 MiB >>>>> MMC:   OMAP SD/MMC: 0 >>>>> Loading Environment from NAND... *** Warning - bad CRC, using >>>>> default environment >>>>> >>>>> Net:   Could not get PHY for ethernet@4a100000: addr 0 >>>>> eth2: ethernet@4a100000, eth3: usb_ether >>>>> Hit any key to stop autoboot:  0 >>>>> => setenv autoload no >>>>> => dhcp >>>>> using musb-hdrc, OUT ep1out IN ep1in STATUS ep2in >>>>> MAC de:ad:be:ef:00:01 >>>>> HOST MAC de:ad:be:ef:00:00 >>>>> RNDIS ready >>>>> musb-hdrc: peripheral reset irq lost! >>>>> high speed config #2: 2 mA, Ethernet Gadget, using RNDIS >>>>> USB RNDIS network up! >>>>> BOOTP broadcast 1 >>>>> BOOTP broadcast 2 >>>>> BOOTP broadcast 3 >>>>> DHCP client bound to address 192.168.200.4 (757 ms) >>>>> data abort >>>>> pc : [<9fe9b0a2>]          lr : [<9febbc3f>] >>>>> reloc pc : [<808130a2>]    lr : [<80833c3f>] >>>>> sp : 9de53410  ip : 9de53578     fp : 00000001 >>>>> r10: 9de5345c  r9 : 9de67e80     r8 : 9febbae5 >>>>> r7 : 9de72c30  r6 : 9feec710     r5 : 0000000d  r4 : 00000018 >>>>> r3 : 3fdd8e04  r2 : 00000002     r1 : 9feec728  r0 : 9feec700 >>>>> Flags: Nzcv  IRQs off  FIQs on  Mode SVC_32 (T) >>>>> Code: f023 0303 60ca 4403 (6091) 685a >>>>> Resetting CPU ... >>>>> >>>>> resetting ... >>>>> >>>>> >>>>> It's there has any doc about how to debug data abort? Or is the bug >>>>> is already fixed? >>>>> >>>>> Thanks >>>>> >>>> This bug doesn't fixed on master code. I found v2021.01 is good and >>>> v2021.04-rc2 is bad. >>>> >>>> Also I had tested this on beaglebone black with am335x_evm_defconfig, >>>> has the simliar problem. >>>> >>>> find the first bug commit via 'git bisect': it told me that commit >>>> e97eb638de0dc8f6e989e20eaeb0342f103cb917 broke it. But it is very >>>> strange due to this commit doesn't touch any dhcp or network code. >>>> >>>> ➜  u-boot-main git:(e97eb638de) ✗ git bisect bug >>>> e97eb638de0dc8f6e989e20eaeb0342f103cb917 is the first bug commit >>>> commit e97eb638de0dc8f6e989e20eaeb0342f103cb917 >>>> Author: Heinrich Schuchardt >>>> Date:   Wed Jan 20 22:21:53 2021 +0100 >>>> >>>>     fs: fat: consistent error handling for flush_dir() >>>> >>>>     Provide function description for flush_dir(). >>>>     Move all error messages for flush_dir() from the callers to the >>>> function. >>>>     Move mapping of errors to -EIO to the function. >>>>     Always check return value of flush_dir() (Coverity CID 316362). >>>> >>>>     In fat_unlink() return -EIO if flush_dirty_fat_buffer() fails. >>>> >>>>     Signed-off-by: Heinrich Schuchardt >>>> >>>> :040000 040000 2281a449f2d134078d7faa1ee735a367b55aad7e >>>> 77d188b1c99181fd71f2167fdeee3434a09db209 M      fs >>>> >>>> >>>> 184aa6504143b452132e28cd3ebecc7b941cdfa1 is the first commit before >>>> e97eb638de0dc8f6e989e20eaeb0342f103cb917: >>>> >>>> * e97eb638de0dc8f6e989e20eaeb0342f103cb917 fs: fat: consistent error >>>> handling for flush_dir() >>>> *   184aa6504143b452132e28cd3ebecc7b941cdfa1 Merge tag >>>> 'u-boot-rockchip-20210121' of >>>> https://gitlab.denx.de/u-boot/custodians/u-boot-rockchip >>>> |\ >>>> | * 9ddc0787bd660214366e386ce689dd78299ac9d0 pci: Add Rockchip dwc >>>> based PCIe controller driver >>>> >>>> I checked 184aa6504143b452132e28cd3ebecc7b941cdfa1 can work fine. >>>> >>>> U-Boot 2021.01-00688-g184aa65041-dirty (Mar 23 2022 - 15:07:56 +0800) >>>> >>>> CPU  : AM335X-GP rev 2.1 >>>> Model: TI AM335x BeagleBone Black >>>> DRAM:  512 MiB >>>> WDT:   Started with servicing (60s timeout) >>>> NAND:  0 MiB >>>> MMC:   OMAP SD/MMC: 0, OMAP SD/MMC: 1 >>>> Loading Environment from FAT... not set. Validating first >>>> E-fuse MAC >>>> Net:   eth2: ethernet@4a100000, eth3: usb_ether >>>> Hit any key to stop autoboot:  0 >>>> => dhcp >>>> ethernet@4a100000 Waiting for PHY auto negotiation to >>>> complete......... TIMEOUT ! >>>> using musb-hdrc, OUT ep1out IN ep1in STATUS ep2in >>>> MAC de:ad:be:ef:00:01 >>>> HOST MAC de:ad:be:ef:00:00 >>>> RNDIS ready >>>> musb-hdrc: peripheral reset irq lost! >>>> high speed config #2: 2 mA, Ethernet Gadget, using RNDIS >>>> USB RNDIS network up! >>>> BOOTP broadcast 1 >>>> BOOTP broadcast 2 >>>> BOOTP broadcast 3 >>>> DHCP client bound to address 192.168.200.157 (757 ms) >>>> Using usb_ether device >>>> TFTP from server 192.168.200.1; our IP address is 192.168.200.157 >>>> Filename 'u-boot.img'. >>>> Load address: 0x82000000 >>>> Loading: >>>> ################################################################# >>>> ################################################################# >>>> ################################################################# >>>>          ######################### >>>>          2.5 MiB/s >>>> done >>>> Bytes transferred = 1123888 (112630 hex) >>>> => >>>> >> "data abort" messages: >> >> data abort >> pc : [<9ff8196c>]          lr : [<9ffa1cd7>] >> reloc pc : [<8081496c>]    lr : [<80834cd7>] >> sp : 9df38e60  ip : 9df38fc8     fp : 00000001 >> r10: 9df38eac  r9 : 9df4ceb0     r8 : 9ffa1b7d >> r7 : 9df52fd0  r6 : 9ffdbba8     r5 : 0000000d  r4 : 00000018 >> r3 : 3ff589e0  r2 : 9ffafa11     r1 : 9ffdbbc0  r0 : 9ffdbb00 >> Flags: Nzcv  IRQs off  FIQs on  Mode SVC_32 (T) >> Code: 0303 60ca 4403 6091 (685a) f042 >> Resetting CPU ... >> >> objdump u-boot:pc is in malloc and lr is in env_attr_walk >> >>        unlink(victim, bck, fwd); >> 80814966:    60ca          str    r2, [r1, #12] >>        set_inuse_bit_at_offset(victim, victim_size); >> 80814968:    4403          add    r3, r0 >>        unlink(victim, bck, fwd); >> 8081496a:    6091          str    r1, [r2, #8] >>      set_inuse_bit_at_offset(victim, victim_size); >> 8081496c:    685a          ldr    r2, [r3, #4] >> 8081496e:    f042 0201     orr.w    r2, r2, #1 >> 80814972:    605a          str    r2, [r3, #4] >> >> r3 is 3ff589e0 and it's not a valid ram address on am335x. >> >> > > I have seen crashes in common/dlmalloc.c before after double free() or > free() with an incorrect pointer. > > The assert() statements in do_check_inuse_chunk() are meant to catch > this but assert() as defined in include/log.h does not stop the code and > even does not print without _DEBUG=1. > > You should be able to get the assert output with > > #include > #define _DEBUG 1 > #include > > at the top of common/dlmalloc.c. > > You should get full malloc debug output with Hi: I had try add DEBUG marco before and no other malloc message printed. > > #define DEBUG 1 > #include > #include > > Best regards > > Heinrich