linux-arm-msm.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* Re: QSD8250 illegal instruction
@ 2010-06-06  2:53 Lukas-David Gorris
  2010-06-09 16:35 ` Daniel Walker
  0 siblings, 1 reply; 20+ messages in thread
From: Lukas-David Gorris @ 2010-06-06  2:53 UTC (permalink / raw)
  To: linux-arm-msm; +Cc: davidb

Hello,

Quoting lukas@htc-linux.org:

> Hello,
>
> Quoting David Brown <davidb@codeaurora.org>:
>>
>> To start with, can you share the .config you built your kernel
>> with?
>>
>> Thanks,
>> David
>
> We are using 'arch/arm/configs/htcleo_defconfig' from the
> htc-msm-2.6.32 branch in
> git://git.linuxtogo.org/home/groups/mobile-linux/kernel.git repository.
>
> Here is a direct link
> http://git.linuxtogo.org/?p=groups/mobile-linux/kernel.git;a=blob;f=arch/arm/configs/htcleo_defconfig;h=4d3141dae827c28a0cb46b04a3a075bf489cd842;hb=refs/heads/htc-msm-2.6.32
>
> Thanks a lot,
>
> Lukas

As I think this got under a bit due to the ARM defconfig discussion  
I'm just bumping it up. Also LeTama seems to have confirmed the  
problem with the failing push instruction in a different case:

http://lists.linuxtogo.org/pipermail/mobile-linux-discuss/2010-May/000095.html

I will just quote again for easier reference.


Le Tama letama at free.fr wrote on
Sun May 30 19:56:23 CEST 2010

Re All,

I did another experiment with the android binaries, this one native android
init with a cleaned init.rc.

This time, it results in segmentation fault, I added few traces to the
kernel:

[    9.520195] PL:kernel_execve(/init)
[    9.524717] PL:do_translation_fault
[    9.529754] PL:do_translation_fault
[    9.579853] init: cannot open '/initlogo.rle'
[    9.609789] lcdc_unblank: ()
[    9.676751] mdp irq already on 4000 4000
[    9.676762] mdp_dma: busy
[    9.725516] PL:do_translation_fault
[    9.734390] msm72k_udc: msm72k_udc: portchange USB_SPEED_HIGH
[    9.743216] msm72k_udc: msm72k_udc: reset
[    9.747724] PL:do_translation_fault
[    9.752509] PL:do_translation_fault
[    9.757389] PL:do_translation_fault
[    9.762623] PL:send_signal (sig=17, from_ancestor=0)
[    9.767116] PL: unlikely(vma->vm_start > addr)1
[    9.771485] PL:vma->vm_start = 8000
[    9.775757] PL:vma->vm_end   = 20000
[    9.780001] PL:vma->vm_flags = 8001875
[    9.784192] PL:addr          = 0
[    9.788386] PL:SIGSEGV/SEC_MAPERR
[    9.792554] pgd = c655c000
[    9.796654] [00000000] *pgd=26555031, *pte=00000000, *ppte=00000000
[    9.804887]
[    9.808952] Pid: 1, comm:                 init
[    9.813014] CPU: 0    Not tainted  (2.6.32.9-38056-gee54d02-dirty #146)
[    9.821087] PC is at 0x15a74
[    9.825101] LR is at 0xb2f9
[    9.829050] pc : [<00015a74>]    lr : [<0000b2f9>]    psr: 00000030
[    9.829060] sp : bea3bdd0  ip : ff0a0000  fp : 00000000
[    9.840921] r10: 00000000  r9 : 00000000  r8 : 00000000
[    9.844872] r7 : 0001c6fc  r6 : 0000068d  r5 : 00000006  r4 : 0002048c
[    9.852629] mdp irq already on 4000 4000
[    9.856538] mdp_dma: busy
[    9.860403] r3 : 00000000  r2 : 00000000  r1 : 00000000  r0 : 0000068f
[    9.868101] Flags: nzcv  IRQs on  FIQs on  Mode USER_32  ISA Thumb
Segment user
[    9.875816] PL: instruction=4c9eb5f0
[    9.879668] Control: 10c5787d  Table: 2655c019  DAC: 00000015
[    9.887370]
[    9.887374] IP: 0xff09ff80:


The init disassembly gives me this:
0000b2c4 <read_file>: (the caller as shown by LR, in thumb)
		....
     b2f0:       b9f8            cbnz    r0, b332 <read_file+0x6e>
     b2f2:       1cb0            adds    r0, r6, #2
     b2f4:       f00a fbbe       bl      15a74 <malloc>
     b2f8:       4604            mov     r4, r0
             ....

00015a74 <malloc>: (crash location, just at the beginning, in thumb too)
    15a74:       b5f0            push    {r4, r5, r6, r7, lr}

    15a76:       4c9e            ldr     r4, [pc, #632]  ; (15cf0
<malloc+0x27c>)

    15a78:       a200            add     r2, pc, #0      ; (adr r2, 15a7c
<malloc+0x8>)

    15a7a:       499e            ldr     r1, [pc, #632]  ; (15cf4
<malloc+0x280>)

    15a7c:       18a4            adds    r4, r4, r2

    15a7e:       4605            mov     r5, r0

    15a80:       1860            adds    r0, r4, r1
                   .....
    15cea:       4630            mov     r0, r6

    15cec:       b007            add     sp, #28

    15cee:       bdf0            pop     {r4, r5, r6, r7, pc}

    15cf0:       0000aa10        .word   0x0000aa10

    15cf4:       000012ec        .word   0x000012ec



00015cf8 <calloc>:



I don't know if it's a coincidence, but again, a push instruction.


Here:
[    9.767116] PL: unlikely(vma->vm_start > addr)1
[    9.771485] PL:vma->vm_start = 8000
[    9.775757] PL:vma->vm_end   = 20000
[    9.780001] PL:vma->vm_flags = 8001875
[    9.784192] PL:addr          = 0

And here:
[    9.796654] [00000000] *pgd=26555031, *pte=00000000, *ppte=00000000

, it shows that the instruction at PC tries to access address 0

Why, I have no clue.

In memory, the code at 00015a74 is really the push instruction like
displayed here (this is *(PC)):
[    9.875816] PL: instruction=4c9eb5f0


Nothing really new here, but it could give hints for the arm guys ?

By the way, Dcordes, you asked them for help, right ? The thread can be seen
somewhere ?

Best,

LeTama



On a side note, we tried to use different snapdragon kernel  
repositories like some 2.6.29 at codeaurora and the problem seems to  
be the same.

Also might be interesting that we ran into some timer problem with the  
kernel configurations of other qsd8250 machines. Nexus one is using GP  
timer. If we set that on htcleo machine, system will freeze soon as  
there is some 'waiting code'. E.g. setting rootwait=n or rootdelay in  
cmdline always caused a panic with GP.
setting
'CONFIG_MSM7X00A_USE_DG_TIMER=y'
instead fixed that. No idea if that is any relevant but it might ring  
a bell for somebody who knows this SoC well.

Thank,

Lukas


^ permalink raw reply	[flat|nested] 20+ messages in thread
* QSD8250 illegal instruction
@ 2010-05-29 19:46 lukas
  0 siblings, 0 replies; 20+ messages in thread
From: lukas @ 2010-05-29 19:46 UTC (permalink / raw)
  To: linux-arm-msm

Hello,

I'm not sure if this is the right place but I don't know who else to  
address with this problem. The users of this list seem to know much  
about the qsd8* platform.

We are porting linux to the qsd8250 based htc leo device.

The code can be found at
git://git.linuxtogo.org/home/groups/mobile-linux/kernel.git htc-msm-2.6.32
web:  
http://git.linuxtogo.org/?p=groups/mobile-linux/kernel.git;a=shortlog;h=refs/heads/htc-msm-2.6.32

It is based on the android-msm-2.6.32 branch from the google git at:  
http://android.git.kernel.org/?p=kernel/msm.git;a=shortlog;h=refs/heads/android-msm-2.6.32

General information on the device and on this subject can be found  
here: http://htc-linux.org/wiki/index.php?title=Leo


Our big problem is that we get illegal instructions on userspace  
binary execution. Some program work well, others will always crash  
with segfault / illegal instruction errors. For a while we thought  
that it is a question of using the correct toolchain and flags to  
compile. But it seems that the errors occur with various  
configurations. Also we tested rootfilesystems that worked perfectly  
well on the htc passion aka nexus one (same qsd8250) and they crashed  
in the same way. This makes it look like we rather have a problem with  
our kernel or that there are some hardware differences.

My understanding about these low-level things is bad so I can't go  
into great detail. I would like to take the liberty to refer to the  
mailing list where the problem is discussed:

http://lists.linuxtogo.org/pipermail/mobile-linux-discuss/2010-May/thread.html

It would be very nice if somebody could take a look at that. I will  
paste the mail with the latest finding for easier reference.

On Fri, May 28, 2010 at 3:09 PM, Le Tama <letama at free.fr> wrote:

> Hi Guys,
>
> I did a new experiment that yielded interesting results.
>
> Here is what I did: I compiled eclair qaesd for ffa to get android binaries
> with android toolchain.
>
> With these binaries, I did a init script using android sh binary, it
> reaches
> the prompt.
>
> I also launched static adbd from this script, that was terminated because
> of
> invalid instruction:
>
> [   11.376047] adbd (42): undefined instruction: pc=3D0000fc60
> [   11.380015] Code: e5843000 e8bd8010 e59f102c e1a0c000 (e52d4004)
> [   11.387759] PL:send_signal (sig=3D4, from_ancestor=3D0)
>
>
> I dumped the compiled adbd with objdump, here is the location:
>
> 0000fc58 <pthread_attr_init>:
>    fc58:       e59f102c        ldr     r1, [pc, #44]   ; fc8c
> <pthread_attr_init+0x34>
>    fc5c:       e1a0c000        mov     ip, r0
>    fc60:       e52d4004        push    {r4}            ; (str r4, [sp,
> #-4]!)
>    fc64:       e59f4024        ldr     r4, [pc, #36]   ; fc90
> <pthread_attr_init+0x38>
>    fc68:       e08f3001        add     r3, pc, r1
>    fc6c:       e0834004        add     r4, r3, r4
>    fc70:       e8b4000f        ldm     r4!, {r0, r1, r2, r3}
>    fc74:       e8ac000f        stmia   ip!, {r0, r1, r2, r3}
>    fc78:       e8940003        ldm     r4, {r0, r1}
>    fc7c:       e88c0003        stm     ip, {r0, r1}
>    fc80:       e3a00000        mov     r0, #0
>    fc84:       e8bd0010        pop     {r4}
>    fc88:       e12fff1e        bx      lr
>    fc8c:       0001890c        .word   0x0001890c
>    fc90:       ffffbe04        .word   0xffffbe04
>
> So, as you can see, the undefined instruction is the push {r4} line.
>
> If I interpret well what I see, the instruction is legit, memory is ok, but
> the cpu considers it invalid.
>
> Now, the question is why ? Invalid instruction cache ? Wrong processor
> state
> ?
>
> This is out of my league, if someone has an explanation ?
>
> Best,
>
> LeTama
>
>
>
> _______________________________________________
> Mobile-linux-discuss mailing list
> Mobile-linux-discuss at linuxtogo.org
> http://lists.linuxtogo.org/cgi-bin/mailman/listinfo/mobile-linux-discuss
>

We've been struggeling to get past this problem for quite a while now.  
Any hint is welcome.

Kind regards,

Lukas



^ permalink raw reply	[flat|nested] 20+ messages in thread
* QSD8250 illegal instruction
@ 2010-05-29 19:20 lukas
  2010-06-01 16:54 ` David Brown
  0 siblings, 1 reply; 20+ messages in thread
From: lukas @ 2010-05-29 19:20 UTC (permalink / raw)
  To: linux-arm-msm

Hello,

I'm not sure if this is the right place but I don't know who else to  
address with this problem. The users of this list seem to know much  
about the qsd8* platform.

We are porting linux to the qsd8250 based htc leo device.

The code can be found at  
git://git.linuxtogo.org/home/groups/mobile-linux/kernel.git  
htc-msm-2.6.32
web:  
http://git.linuxtogo.org/?p=groups/mobile-linux/kernel.git;a=shortlog;h=refs/heads/htc-msm-2.6.32

It is based on the android-msm-2.6.32 branch from the google git at:  
http://android.git.kernel.org/?p=kernel/msm.git;a=shortlog;h=refs/heads/android-msm-2.6.32

General information on the device and on this subject can be found  
here: http://htc-linux.org/wiki/index.php?title=Leo


A lot of stuff is working out of the box. Our big problem is that we  
get illegal instructions on userspace binary execution. Some program  
work well, others will always crash with segfault / illegal  
instruction errors. For a while we thought that it is a question of  
using the correct toolchain and flags to compile. But it seems that  
the errors occur with various configurations. Also we tested  
rootfilesystems that worked perfectly well on the htc passion aka  
nexus one (same qsd8250) and they crashed in the same way.
This makes it look like we have a problem with our kernel or that  
there are some hardware differences.

My understanding about these low-level things is bad so I can't go  
into great detail. I would like to to take the liberty to refer to the  
mailing list where the problem is discussed:

http://lists.linuxtogo.org/pipermail/mobile-linux-discuss/2010-May/thread.html

It would be very nice if somebody could take a look at that. We are  
stI will paste the mail with the latest finding for easier reference.

On Fri, May 28, 2010 at 3:09 PM, Le Tama <letama at free.fr> wrote:

> Hi Guys,
>
> I did a new experiment that yielded interesting results.
>
> Here is what I did: I compiled eclair qaesd for ffa to get android binaries
> with android toolchain.
>
> With these binaries, I did a init script using android sh binary, it
> reaches
> the prompt.
>
> I also launched static adbd from this script, that was terminated because
> of
> invalid instruction:
>
> [   11.376047] adbd (42): undefined instruction: pc=0000fc60
> [   11.380015] Code: e5843000 e8bd8010 e59f102c e1a0c000 (e52d4004)
> [   11.387759] PL:send_signal (sig=4, from_ancestor=0)
>
>
> I dumped the compiled adbd with objdump, here is the location:
>
> 0000fc58 <pthread_attr_init>:
>    fc58:       e59f102c        ldr     r1, [pc, #44]   ; fc8c
> <pthread_attr_init+0x34>
>    fc5c:       e1a0c000        mov     ip, r0
>    fc60:       e52d4004        push    {r4}            ; (str r4, [sp,
> #-4]!)
>    fc64:       e59f4024        ldr     r4, [pc, #36]   ; fc90
> <pthread_attr_init+0x38>
>    fc68:       e08f3001        add     r3, pc, r1
>    fc6c:       e0834004        add     r4, r3, r4
>    fc70:       e8b4000f        ldm     r4!, {r0, r1, r2, r3}
>    fc74:       e8ac000f        stmia   ip!, {r0, r1, r2, r3}
>    fc78:       e8940003        ldm     r4, {r0, r1}
>    fc7c:       e88c0003        stm     ip, {r0, r1}
>    fc80:       e3a00000        mov     r0, #0
>    fc84:       e8bd0010        pop     {r4}
>    fc88:       e12fff1e        bx      lr
>    fc8c:       0001890c        .word   0x0001890c
>    fc90:       ffffbe04        .word   0xffffbe04
>
> So, as you can see, the undefined instruction is the push {r4} line.
>
> If I interpret well what I see, the instruction is legit, memory is ok, but
> the cpu considers it invalid.
>
> Now, the question is why ? Invalid instruction cache ? Wrong processor
> state
> ?
>
> This is out of my league, if someone has an explanation ?
>
> Best,
>
> LeTama
>
>
>
> _______________________________________________
> Mobile-linux-discuss mailing list
> Mobile-linux-discuss at linuxtogo.org
> http://lists.linuxtogo.org/cgi-bin/mailman/listinfo/mobile-linux-discuss
>

We've been struggeling to get past this problem for quite a while now.  
Any hint is welcome!

Kind regards,

Lukas


^ permalink raw reply	[flat|nested] 20+ messages in thread
end of thread, other threads:[~2010-06-10 22:38 UTC | newest]

Thread overview: 20+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2010-06-06  2:53 QSD8250 illegal instruction Lukas-David Gorris
2010-06-09 16:35 ` Daniel Walker
2010-06-09 20:18   ` Le Tama
2010-06-10 16:49     ` Daniel Walker
2010-06-10 17:37       ` Lukas-David Gorris
2010-06-10 17:51         ` Daniel Walker
2010-06-10 18:24         ` Le Tama
2010-06-10 18:41           ` Daniel Walker
2010-06-10 19:23             ` Le Tama
2010-06-10 19:33             ` Lukas-David Gorris
2010-06-10 20:51               ` Daniel Walker
2010-06-10 21:52                 ` Lukas-David Gorris
2010-06-10 22:04                   ` Daniel Walker
2010-06-10 22:37                     ` Lukas-David Gorris
2010-06-10 18:52           ` Daniel Walker
  -- strict thread matches above, loose matches on Subject: below --
2010-05-29 19:46 lukas
2010-05-29 19:20 lukas
2010-06-01 16:54 ` David Brown
2010-06-03  1:13   ` lukas
2010-06-06  2:23     ` Lukas-David Gorris

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).