[PATCH] arm: mediatek: fix secondary CPU boot on Thumb-2 kernels with Clang

[PATCH] arm: mediatek: fix secondary CPU boot on Thumb-2 kernels with Clang

[Akari Tsuyukusa]

When building with CONFIG_THUMB2_KERNEL=y and Clang, secondary CPUs
fail to come online with "CPU1: failed to come online". The address
written to the jump register has bit 0 set, causing the secondary CPU
to start in Thumb mode.

secondary_startup_arm is ARM-mode code (.arm) and, on a Thumb-2 kernel,
expects to be entered in ARM mode in order to switch to Thumb via the
standard sequence at that label. Starting in Thumb mode causes the CPU
to execute ARM instructions as Thumb, resulting in an immediate crash.

Clear bit 0 of the entry address so the CPU always starts in ARM mode.

Tested on Lenovo YOGA Tablet 10 (Wi-Fi).

Fixes: 0cda07001a94 ("ARM: mediatek: add smp bringup code")
Assisted-by: DeepSeek:deepseek-v4-pro
Cc: stable@vger.kernel.org
Signed-off-by: Akari Tsuyukusa <akkun11.open@gmail.com>
---
 arch/arm/mach-mediatek/platsmp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm/mach-mediatek/platsmp.c b/arch/arm/mach-mediatek/platsmp.c
index 6b0943d95555..9a7c65fc3ae1 100644
--- a/arch/arm/mach-mediatek/platsmp.c
+++ b/arch/arm/mach-mediatek/platsmp.c
@@ -124,7 +124,7 @@ static void __init __mtk_smp_prepare_cpus(unsigned int max_cpus, int trustzone)
 	 * write the address of slave startup address into the system-wide
 	 * jump register
 	 */
-	writel_relaxed(__pa_symbol(secondary_startup_arm),
+	writel_relaxed(__pa_symbol(secondary_startup_arm) & ~1,
 			mtk_smp_base + mtk_smp_info->jump_reg);
 }
 
-- 
2.54.0

Re: [PATCH] arm: mediatek: fix secondary CPU boot on Thumb-2 kernels with Clang

[Nick Desaulniers]

On Wed, Jul 22, 2026 at 10:25 AM Akari Tsuyukusa <akkun11.open@gmail.com> wrote:
>
> When building with CONFIG_THUMB2_KERNEL=y and Clang, secondary CPUs

Specifically, was LLVM=1 or CC=clang or something else used?

> fail to come online with "CPU1: failed to come online". The address
> written to the jump register has bit 0 set, causing the secondary CPU
> to start in Thumb mode.

Ah, yeah missing those is going to be a noticeable perf hit!

>
> secondary_startup_arm is ARM-mode code (.arm) and, on a Thumb-2 kernel,
> expects to be entered in ARM mode in order to switch to Thumb via the
> standard sequence at that label. Starting in Thumb mode causes the CPU
> to execute ARM instructions as Thumb, resulting in an immediate crash.
>
> Clear bit 0 of the entry address so the CPU always starts in ARM mode.

Thanks for the patch. Any idea why this isn't an issue for
GCC+GAS+BFD? Perhaps there's a difference in the LLVM tools that we
need to address?

There's definitely some difference between clang and GAS here.
https://github.com/llvm/llvm-project/issues/211376

I wonder if perhaps a better machine-agnostic assembler-agnostic
assembler-version-agnostic patch would be something like:

```
diff --git a/arch/arm/kernel/head.S b/arch/arm/kernel/head.S
index f22c50d4bd41..687ee7063a73 100644
--- a/arch/arm/kernel/head.S
+++ b/arch/arm/kernel/head.S
@@ -383,6 +383,7 @@ ENDPROC(__create_page_tables)
 ENTRY(secondary_startup_arm)
  THUMB(        badr    r9, 1f          )       @ Kernel is entered in ARM.
  THUMB(        bx      r9              )       @ If this is a Thumb-2 kernel,
+ENDPROC(secondary_startup_arm)
  THUMB(        .thumb                  )       @ switch to Thumb now.
  THUMB(1:                      )
 ENTRY(secondary_startup)
@@ -429,7 +430,6 @@ ARM_BE8(eor r4, r4, r5)                     @
without using a temp reg.
                                                @ (return control reg)
        ret     r12
 ENDPROC(secondary_startup)
-ENDPROC(secondary_startup_arm)

 ENTRY(__secondary_switched)
 #if defined(CONFIG_VMAP_STACK) && !defined(CONFIG_ARM_LPAE)

```

Can you perhaps help test/verify that Akari?


>
> Tested on Lenovo YOGA Tablet 10 (Wi-Fi).
>
> Fixes: 0cda07001a94 ("ARM: mediatek: add smp bringup code")
> Assisted-by: DeepSeek:deepseek-v4-pro
> Cc: stable@vger.kernel.org
> Signed-off-by: Akari Tsuyukusa <akkun11.open@gmail.com>
> ---
>  arch/arm/mach-mediatek/platsmp.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/arch/arm/mach-mediatek/platsmp.c b/arch/arm/mach-mediatek/platsmp.c
> index 6b0943d95555..9a7c65fc3ae1 100644
> --- a/arch/arm/mach-mediatek/platsmp.c
> +++ b/arch/arm/mach-mediatek/platsmp.c
> @@ -124,7 +124,7 @@ static void __init __mtk_smp_prepare_cpus(unsigned int max_cpus, int trustzone)
>          * write the address of slave startup address into the system-wide
>          * jump register
>          */
> -       writel_relaxed(__pa_symbol(secondary_startup_arm),
> +       writel_relaxed(__pa_symbol(secondary_startup_arm) & ~1,
>                         mtk_smp_base + mtk_smp_info->jump_reg);
>  }
>
> --
> 2.54.0
>


-- 
Thanks,
~Nick Desaulniers

Re: [PATCH] arm: mediatek: fix secondary CPU boot on Thumb-2 kernels with Clang

[Roman Vivchar]

Hi Nick,

On Thursday, July 23rd, 2026 at 12:03 AM, Nick Desaulniers <ndesaulniers@google.com> wrote:

> On Wed, Jul 22, 2026 at 10:25 AM Akari Tsuyukusa <akkun11.open@gmail.com> wrote:

...

> There's definitely some difference between clang and GAS here.
> https://github.com/llvm/llvm-project/issues/211376
>
> I wonder if perhaps a better machine-agnostic assembler-agnostic
> assembler-version-agnostic patch would be something like:
>
> ```
> diff --git a/arch/arm/kernel/head.S b/arch/arm/kernel/head.S
> index f22c50d4bd41..687ee7063a73 100644
> --- a/arch/arm/kernel/head.S
> +++ b/arch/arm/kernel/head.S
> @@ -383,6 +383,7 @@ ENDPROC(__create_page_tables)
>  ENTRY(secondary_startup_arm)
>   THUMB(        badr    r9, 1f          )       @ Kernel is entered in ARM.
>   THUMB(        bx      r9              )       @ If this is a Thumb-2 kernel,
> +ENDPROC(secondary_startup_arm)
>   THUMB(        .thumb                  )       @ switch to Thumb now.
>   THUMB(1:                      )
>  ENTRY(secondary_startup)
> @@ -429,7 +430,6 @@ ARM_BE8(eor r4, r4, r5)                     @
> without using a temp reg.
>                                                 @ (return control reg)
>         ret     r12
>  ENDPROC(secondary_startup)
> -ENDPROC(secondary_startup_arm)
>
>  ENTRY(__secondary_switched)
>  #if defined(CONFIG_VMAP_STACK) && !defined(CONFIG_ARM_LPAE)
>
> ```

I'd like to join conversation because Thumb2 kernel with LLVM seems to
be quite buggy.

I can confirm the proposed fix works for clang, if you're going to send
this patch, feel free to add

Tested-by: Roman Vivchar <rva333@protonmail.com> # mt6572

Leftover from IOMMU debugging shows there's another bug with ftrace.
This probably needs separate thread though...

[    0.193285] Starting tracer 'function_graph'
[    0.210474] ------------[ cut here ]------------
[    0.211120] WARNING: kernel/trace/fgraph.c:761 at ftrace_return_to_handler+0x1c5/0x228, CPU#0: swapper/0/1
[    0.212437] Bad frame pointer: expected c6229ee0, received c132b33b
[    0.212437]   from func iommu_init return to c13011cd
[    0.213962] CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Tainted: G     U              7.2.0-rc4-next-20260721-00134-g49e0d56c7cde-dirty #939 VOLUNTARY
[    0.213980] Tainted: [U]=USER
[    0.213984] Hardware name: Mediatek Cortex-A7 (Device Tree)
[    0.213991] Call trace:
[    0.214000]  unwind_backtrace from show_stack+0x19/0x1a
[    0.214024]  show_stack from dump_stack_lvl+0x37/0x40
[    0.214044]  dump_stack_lvl from __warn+0xbb/0x1f0
[    0.214061]  __warn from warn_slowpath_fmt+0xd1/0x11e
[    0.214078]  warn_slowpath_fmt from ftrace_return_to_handler+0x1c5/0x228
[    0.214099]  ftrace_return_to_handler from return_to_handler+0x17/0x24
[    0.214121] ---[ end trace 0000000000000000 ]---
[    0.222449] ------------[ cut here ]------------
[    0.223075] WARNING: kernel/trace/fgraph.c:826 at ftrace_return_to_handler+0x1e5/0x228, CPU#0: swapper/0/1
[    0.224385] CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Tainted: G     U  W           7.2.0-rc4-next-20260721-00134-g49e0d56c7cde-dirty #939 VOLUNTARY
[    0.224401] Tainted: [U]=USER, [W]=WARN
[    0.224405] Hardware name: Mediatek Cortex-A7 (Device Tree)
[    0.224411] Call trace:
[    0.224417]  unwind_backtrace from show_stack+0x19/0x1a
[    0.224435]  show_stack from dump_stack_lvl+0x37/0x40
[    0.224452]  dump_stack_lvl from __warn+0xbb/0x1f0
[    0.224469]  __warn from warn_slowpath_fmt+0x83/0x11e
[    0.224485]  warn_slowpath_fmt from ftrace_return_to_handler+0x1e5/0x228
[    0.224505]  ftrace_return_to_handler from return_to_handler+0x17/0x24
[    0.224526] ---[ end trace 0000000000000000 ]---
[    0.232957] 8<--- cut here ---
[    0.233378] Unable to handle kernel NULL pointer dereference at virtual address 00000000 when read
[    0.234580] [00000000] *pgd=00000000
[    0.235082] Internal error: Oops: 5 [#1] SMP THUMB2
[    0.235748] CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Tainted: G     U  W           7.2.0-rc4-next-20260721-00134-g49e0d56c7cde-dirty #939 VOLUNTARY
[    0.237485] Tainted: [U]=USER, [W]=WARN
[    0.238006] Hardware name: Mediatek Cortex-A7 (Device Tree)
[    0.238756] PC is at vsnprintf+0x32/0x34e
[    0.239309] LR is at vscnprintf+0x11/0x18
[    0.239859] pc : [<c0bedbe6>]    lr : [<c0beec7f>]    psr: 800000b3
[    0.240703] sp : c6229e48  ip : 00000000  fp : 00000000
[    0.241409] r10: c6229ed4  r9 : 00000000  r8 : c30ecc24
[    0.242116] r7 : c6229eb8  r6 : c30ed024  r5 : c6250000  r4 : 00000400
[    0.242995] r3 : c6229ed4  r2 : 00000000  r1 : 00000400  r0 : c30ecc24
[    0.243875] Flags: Nzcv  IRQs off  FIQs on  Mode SVC_32  ISA Thumb  Segment none
[    0.244874] Control: 50c5387d  Table: 8000406a  DAC: 00000051
[    0.245649] Register r0 information: non-slab/vmalloc memory
[    0.246422] Register r1 information: non-paged memory
[    0.247111] Register r2 information: NULL pointer
[    0.247753] Register r3 information: non-slab/vmalloc memory
[    0.248522] Register r4 information: non-paged memory
[    0.249210] Register r5 information: slab task_struct start c6250000 pointer offset 0 size 2432
[    0.250412] Register r6 information: non-slab/vmalloc memory
[    0.251181] Register r7 information: non-slab/vmalloc memory
[    0.251949] Register r8 information: non-slab/vmalloc memory
[    0.252717] Register r9 information: NULL pointer
[    0.253360] Register r10 information: non-slab/vmalloc memory
[    0.254140] Register r11 information: NULL pointer
[    0.254794] Register r12 information: NULL pointer
[    0.255447] Process swapper/0 (pid: 1, stack limit = 0x(ptrval))
[    0.256259] Stack: (0xc6229e48 to 0xc622a000)
[    0.256857] 9e40:                   c132b340 c13011cd 00000400 00000008 c938c2cc 00000000
[    0.257961] 9e60: 00000000 00000000 429c4c89 00000400 c6250000 c30ecc24 c6229eb8 c2f0c8a4
[    0.259065] 9e80: 00000000 c6229ed4 c2f0c8a0 c0beec7f 00000000 c0101f63 00000000 c6250000
[    0.260168] 9ea0: 00000000 c132b33b 00000000 00000000 c1390844 c61d6800 c6229ecc c0101e45
[    0.261271] 9ec0: c6229ed4 c6229ee8 c61d6800 c6229f48 c0101e23 c3128eec 00000000 00000000
[    0.262374] 9ee0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[    0.263476] 9f00: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[    0.264579] 9f20: 00000000 00000000 429c4c89 00000000 00000000 00000000 00000000 c139088c
[    0.265683] 9f40: c1390844 c61d6800 c6229f70 c1301953 00000001 00000001 00000000 c13019e1
[    0.266786] 9f60: 00000000 c61d6800 00000001 c11e8fd0 c6229f88 c13018a1 00000000 c618cc00
[    0.267890] 9f80: c0bf5ee9 00000000 c6229f98 c1301725 00000000 00000000 c6229fa8 c0bf5f07
[    0.268993] 9fa0: 00000000 00000000 00000000 c0100151 00000000 00000000 00000000 00000000
[    0.270096] 9fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[    0.271198] 9fe0: 00000000 00000000 00000000 00000000 00000013 00000000 00000000 00000000
[    0.272296] Call trace:
[    0.272306]  vsnprintf from vscnprintf+0x11/0x18
[    0.273284]  vscnprintf from vpanic+0x11f/0x442
[    0.273911]  vpanic from vpanic+0x1/0x442
[    0.274472] Code: f04f 36ff 43c1 9102 (f89b) 1000
[    0.275129] ---[ end trace 0000000000000000 ]---
[    0.275755] note: swapper/0[1] exited with irqs disabled
[    0.276557] Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b
[    0.277644] ---[ end Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b ]---

Command line: ftrace=function_graph ftrace_filter=*iommu* trace_buf_size=40M trace_options=funcgraph-retval

Config:
$ grep -E "trac|thumb" .config -i
CONFIG_CONTEXT_TRACKING=y
CONFIG_CONTEXT_TRACKING_IDLE=y
CONFIG_TASKS_TRACE_RCU=y
CONFIG_TRACEPOINTS=y
CONFIG_STACKTRACE_SUPPORT=y
CONFIG_CPU_THUMB_CAPABLE=y
CONFIG_ARM_THUMB=y
CONFIG_ARM_THUMBEE=y
CONFIG_THUMB2_KERNEL=y
CONFIG_CMDLINE="..."
CONFIG_TRACE_IRQFLAGS_SUPPORT=y
CONFIG_HAVE_ARCH_TRACEHOOK=y
CONFIG_HAVE_CONTEXT_TRACKING_USER=y
# CONFIG_IDLE_PAGE_TRACKING is not set
# CONFIG_DMA_FENCE_TRACE is not set
CONFIG_MOUSE_PS2_TRACKPOINT=y
CONFIG_TRACE_GPU_MEM=y
# HW tracing support
# end of HW tracing support
CONFIG_PSTORE_FTRACE=y
# CONFIG_PROC_MEM_FORCE_PTRACE is not set
CONFIG_XZ_DEC_ARMTHUMB=y
# CONFIG_STACKTRACE_BUILD_ID is not set
# CONFIG_NET_DEV_REFCNT_TRACKER is not set
# CONFIG_NET_NS_REFCNT_TRACKER is not set
CONFIG_STACKTRACE=y
CONFIG_RCU_TRACE=y
CONFIG_NOP_TRACER=y
CONFIG_HAVE_FUNCTION_TRACER=y
CONFIG_HAVE_FUNCTION_GRAPH_TRACER=y
CONFIG_HAVE_DYNAMIC_FTRACE=y
CONFIG_HAVE_DYNAMIC_FTRACE_WITH_REGS=y
CONFIG_HAVE_EXTRA_IPI_TRACEPOINTS=y
CONFIG_HAVE_SYSCALL_TRACEPOINTS=y
CONFIG_TRACE_CLOCK=y
CONFIG_EVENT_TRACING=y
CONFIG_CONTEXT_SWITCH_TRACER=y
CONFIG_TRACING=y
CONFIG_GENERIC_TRACER=y
CONFIG_TRACING_SUPPORT=y
CONFIG_FTRACE=y
CONFIG_TRACEFS_AUTOMOUNT_DEPRECATED=y
CONFIG_BOOTTIME_TRACING=y
CONFIG_FUNCTION_TRACER=y
CONFIG_FUNCTION_GRAPH_TRACER=y
CONFIG_DYNAMIC_FTRACE=y
CONFIG_DYNAMIC_FTRACE_WITH_REGS=y
CONFIG_FUNCTION_SELF_TRACING=y
# CONFIG_STACK_TRACER is not set
# CONFIG_IRQSOFF_TRACER is not set
# CONFIG_SCHED_TRACER is not set
# CONFIG_HWLAT_TRACER is not set
# CONFIG_OSNOISE_TRACER is not set
# CONFIG_TIMERLAT_TRACER is not set
# CONFIG_FTRACE_SYSCALLS is not set
# CONFIG_TRACER_SNAPSHOT is not set
# CONFIG_BLK_DEV_IO_TRACE is not set
# CONFIG_KPROBE_EVENTS_ON_NOTRACE is not set
CONFIG_FTRACE_MCOUNT_USE_RECORDMCOUNT=y
# CONFIG_TRACE_EVENT_INJECT is not set
# CONFIG_TRACEPOINT_BENCHMARK is not set
# CONFIG_TRACE_EVAL_MAP_FILE is not set
CONFIG_FTRACE_RECORD_RECURSION=y
CONFIG_FTRACE_RECORD_RECURSION_SIZE=128
# CONFIG_FTRACE_STARTUP_TEST is not set
# CONFIG_FTRACE_SORT_STARTUP_TEST is not set
# CONFIG_TRACE_REMOTE_TEST is not set
# CONFIG_BACKTRACE_VERBOSE is not set
# CONFIG_BACKTRACE_SELF_TEST is not set
# CONFIG_TEST_REF_TRACKER is not set

Clang:
ClangBuiltLinux clang version 22.1.5 (https://github.com/llvm/llvm-project.git 5ea218a153f4d2f815b8244eab3e4b4ba5e00e6c)

Best regards,
Roman

Re: [PATCH] arm: mediatek: fix secondary CPU boot on Thumb-2 kernels with Clang

[Akari Tsuyukusa]

Hi Nick,

On Wed, Jul 22, 2026 at 02:03:31PM -0700, Nick Desaulniers wrote:
> On Wed, Jul 22, 2026 at 10:25 AM Akari Tsuyukusa <akkun11.open@gmail.com> wrote:
> >
> > When building with CONFIG_THUMB2_KERNEL=y and Clang, secondary CPUs
> 
> Specifically, was LLVM=1 or CC=clang or something else used?

I used ARCH=arm LLVM=1
config is here:
https://github.com/TeamYogaBlade2/linux/blob/d7633f01ec25209fc6cdde012128b19ac336ab18/arch/arm/configs/lenovo-blade_defconfig

> > secondary_startup_arm is ARM-mode code (.arm) and, on a Thumb-2 kernel,
> > expects to be entered in ARM mode in order to switch to Thumb via the
> > standard sequence at that label. Starting in Thumb mode causes the CPU
> > to execute ARM instructions as Thumb, resulting in an immediate crash.
> >
> > Clear bit 0 of the entry address so the CPU always starts in ARM mode.
> 
> Thanks for the patch. Any idea why this isn't an issue for
> GCC+GAS+BFD? Perhaps there's a difference in the LLVM tools that we
> need to address?
> 
> There's definitely some difference between clang and GAS here.
> https://github.com/llvm/llvm-project/issues/211376
> 
> I wonder if perhaps a better machine-agnostic assembler-agnostic
> assembler-version-agnostic patch would be something like:
> 
> ```
> diff --git a/arch/arm/kernel/head.S b/arch/arm/kernel/head.S
> index f22c50d4bd41..687ee7063a73 100644
> --- a/arch/arm/kernel/head.S
> +++ b/arch/arm/kernel/head.S
> @@ -383,6 +383,7 @@ ENDPROC(__create_page_tables)
>  ENTRY(secondary_startup_arm)
>   THUMB(        badr    r9, 1f          )       @ Kernel is entered in ARM.
>   THUMB(        bx      r9              )       @ If this is a Thumb-2 kernel,
> +ENDPROC(secondary_startup_arm)
>   THUMB(        .thumb                  )       @ switch to Thumb now.
>   THUMB(1:                      )
>  ENTRY(secondary_startup)
> @@ -429,7 +430,6 @@ ARM_BE8(eor r4, r4, r5)                     @
> without using a temp reg.
>                                                 @ (return control reg)
>         ret     r12
>  ENDPROC(secondary_startup)
> -ENDPROC(secondary_startup_arm)
> 
>  ENTRY(__secondary_switched)
>  #if defined(CONFIG_VMAP_STACK) && !defined(CONFIG_ARM_LPAE)
> 
> ```
> 
> Can you perhaps help test/verify that Akari?

I tested your suggested patch and confirmed that it fixes the issue.

Device: Lenovo YOGA Tablet 10 (Wi-Fi) (MT8125)
Toolchain: Clang/LLVM 22.1.8-2 (cachyos-v3)

Tested-by: Akari Tsuyukusa <akkun11.open@gmail.com>

Can you send your fix as PATCH?
I think your approach is better than mine.

Best Regards,
Akari