linux/arch/arm/kernel
Russell King 68687c842c ARM: fix oops on initial entry to userspace with Thumb2 kernels
Daniel Mack reports an oops at boot with the latest kernels:

  Internal error: Oops - undefined instruction: 0 [#1] SMP THUMB2
  Modules linked in:
  CPU: 0    Not tainted  (3.6.0-11057-g584df1d #145)
  PC is at cpsw_probe+0x45a/0x9ac
  LR is at trace_hardirqs_on_caller+0x8f/0xfc
  pc : [<c03493de>]    lr : [<c005e81f>]    psr: 60000113
  sp : cf055fb0  ip : 00000000  fp : 00000000
  r10: 00000000  r9 : 00000000  r8 : 00000000
  r7 : 00000000  r6 : 00000000  r5 : c0344555  r4 : 00000000
  r3 : cf057a40  r2 : 00000000  r1 : 00000001  r0 : 00000000
  Flags: nZCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM Segment user
  Control: 50c5387d  Table: 8f3f4019  DAC: 00000015
  Process init (pid: 1, stack limit = 0xcf054240)
  Stack: (0xcf055fb0 to 0xcf056000)
  5fa0:                                     00000001 00000000 00000000 00000000
  5fc0: cf055fb0 c000d1a8 00000000 00000000 00000000 00000000 00000000 00000000
  5fe0: 00000000 be9b3f10 00000000 b6f6add0 00000010 00000000 aaaabfaf a8babbaa

The analysis of this is as follows.  In init/main.c, we issue:

	kernel_thread(kernel_init, NULL, CLONE_FS | CLONE_SIGHAND);

This creates a new thread, which falls through to the ret_from_fork
assembly, with r4 set NULL and r5 set to kernel_init.  You can see
this in your oops dump register set - r5 is 0xc0344555, which is the
address of kernel_init plus 1 which marks the function as Thumb code.

Now, let's look at this code a little closer - this is what the
disassembly looks like:

  c000d180 <ret_from_fork>:
  c000d180:       f03a fe08       bl      c0047d94 <schedule_tail>
  c000d184:       2d00            cmp     r5, #0
  c000d186:       bf1e            ittt    ne
  c000d188:       4620            movne   r0, r4
  c000d18a:       46fe            movne   lr, pc <-- XXXXXXX
  c000d18c:       46af            movne   pc, r5
  c000d18e:       46e9            mov     r9, sp
  c000d190:       ea4f 3959       mov.w   r9, r9, lsr #13
  c000d194:       ea4f 3949       mov.w   r9, r9, lsl #13
  c000d198:       e7c8            b.n     c000d12c <ret_to_user>
  c000d19a:       bf00            nop
  c000d19c:       f3af 8000       nop.w

This code was introduced in 9fff2fa0db (arm: switch to saner
kernel_execve() semantics).  I have marked one instruction, and it's
the significant one - I'll come back to that later.

Eventually, having had a successful call to kernel_execve(), kernel_init()
returns zero.

In returning, it uses the value in 'lr' which was set by the instruction
I marked above.  Unfortunately, this causes lr to contain 0xc000d18e -
an even address.  This switches the ISA to ARM on return but with a non
word aligned PC value.

So, what do we end up executing?  Well, not the instructions above - yes
the opcodes, but they don't mean the same thing in ARM mode.  In ARM mode,
it looks like this instead:

  c000d18c:       46e946af        strbtmi r4, [r9], pc, lsr #13
  c000d190:       3959ea4f        ldmdbcc r9, {r0, r1, r2, r3, r6, r9, fp, sp, lr, pc}^
  c000d194:       3949ea4f        stmdbcc r9, {r0, r1, r2, r3, r6, r9, fp, sp, lr, pc}^
  c000d198:       bf00e7c8        svclt   0x0000e7c8
  c000d19c:       8000f3af        andhi   pc, r0, pc, lsr #7
  c000d1a0:       e88db092        stm     sp, {r1, r4, r7, ip, sp, pc}
  c000d1a4:       46e81fff                        ; <UNDEFINED> instruction: 0x46e81fff
  c000d1a8:       8a00f3ef        bhi     0xc004a16c
  c000d1ac:       0a0cf08a        beq     0xc03493dc

I have included more above, because it's relevant.  The PSR flags which
we can see in the oops dump are nZCv, so Z and C are set.

All the above ARM instructions are not executed, except for two.
c000d1a0, which has no writeback, and writes below the current stack
pointer (and that data is lost when we take the next exception.) The
other instruction which is executed is c000d1ac, which takes us to...
0xc03493dc.  However, remember that bit 1 of the PC got set.  So that
makes the PC value 0xc03493de.

And that value is the value we find in the oops dump for PC.  What is
the instruction here when interpreted in ARM mode?

       0:       f71e150c                ; <UNDEFINED> instruction: 0xf71e150c

and there we have our undefined instruction (remember that the 'never'
condition code, 0xf, has been deprecated and is now always executed as
it is now being used for additional instructions.)

This path also nicely explains the state of the stack we see in the oops
dump too.

The above is a consistent and sane story for how we got to the oops
dump, which all stems from the instruction at 0xc000d18a being wrong.

Reported-by: Daniel Mack <zonque@gmail.com>
Tested-by: Daniel Mack <zonque@gmail.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2012-10-15 07:57:34 -07:00
..
.gitignore
arch_timer.c ARM: 7538/1: delay: add registration mechanism for delay timer sources 2012-09-26 22:57:52 +01:00
armksyms.c Merge branches 'audit', 'delay', 'fixes', 'misc' and 'sta2x11' into for-linus 2012-07-27 23:06:32 +01:00
arthur.c
asm-offsets.c ARM: Don't unconditionally bloat thread_info 2012-08-29 11:18:17 +01:00
atags_compat.c ARM: 7505/1: split out ATAGS parsing 2012-09-03 22:55:56 +01:00
atags_parse.c ARM: 7505/1: split out ATAGS parsing 2012-09-03 22:55:56 +01:00
atags_proc.c ARM: 7505/1: split out ATAGS parsing 2012-09-03 22:55:56 +01:00
atags.h ARM: 7506/1: allow for ATAGS to be configured out when DT support is selected 2012-09-03 22:56:15 +01:00
bios32.c ARM: soc: general cleanups 2012-10-01 18:19:05 -07:00
calls.S Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/signal 2012-10-10 12:02:25 +09:00
cpuidle.c cpuidle: Add common time keeping and irq enabling 2012-03-21 01:59:40 -04:00
crash_dump.c crash_dump: export is_kdump_kernel to modules, consolidate elfcorehdr_addr, setup_elfcorehdr and saved_max_pfn 2011-03-23 19:47:19 -07:00
debug.S ARM: move debug macros to common location 2012-09-14 09:22:00 -05:00
devtree.c arm: convert core files from module.h to export.h 2011-10-31 19:30:49 -04:00
dma-isa.c
dma.c locking, ARM: Annotate low level hw locks as raw 2011-09-13 11:12:14 +02:00
early_printk.c
elf.c Disintegrate asm/system.h for ARM 2012-03-28 18:30:01 +01:00
entry-armv.S ARM: Fix undefined instruction exception handling 2012-07-31 12:04:30 +01:00
entry-common.S ARM: fix oops on initial entry to userspace with Thumb2 kernels 2012-10-15 07:57:34 -07:00
entry-header.S Merge branch 'devel-stable' into for-next 2011-07-22 23:09:07 +01:00
etm.c arm: fix implicit module.h users by adding it to arch/arm as required. 2011-10-31 19:30:50 -04:00
fiq.c ARM: fiq: change FIQ_START to a variable 2012-07-01 21:59:19 +08:00
fiqasm.S ARM: 6938/1: fiq: Refactor {get,set}_fiq_regs() for Thumb-2 2011-05-26 10:31:06 +01:00
ftrace.c ARM: 7468/1: ftrace: Trace function entry before updating index 2012-07-31 10:30:42 +01:00
head-common.S arm/dt: Make __vet_atags also accept a dtb image 2011-05-11 15:12:32 +02:00
head-nommu.S ARM: move CP15 definitions to separate header file 2012-03-28 18:30:01 +01:00
head.S Merge branch 'fixes' into for-linus 2012-10-11 10:55:04 +01:00
hw_breakpoint.c ARM: 7497/1: hw_breakpoint: allow single-byte watchpoints on all addresses 2012-08-25 09:15:23 +01:00
hyp-stub.S ARM: virt: arch_timers: enable access to physical timers 2012-09-19 08:32:54 +01:00
insn.c ARM: fix missing bug.h include in arch/arm/kernel/insn.c 2012-03-30 11:51:46 +01:00
insn.h ARM: 7334/1: add jump label support 2012-03-24 09:38:56 +00:00
io.c arm: convert core files from module.h to export.h 2011-10-31 19:30:49 -04:00
irq.c ARM: at91: aic can use fast eoi handler type 2012-07-02 14:26:57 +02:00
isa.c
iwmmxt.S ARM: pxa: fix logic error in PJ4 iWMMXt handling 2011-08-11 10:10:26 +08:00
jump_label.c ARM: 7334/1: add jump label support 2012-03-24 09:38:56 +00:00
kgdb.c
kprobes-arm.c ARM: 7181/1: Restrict kprobes probing SWP instructions to ARMv5 and below 2011-11-30 23:54:54 +00:00
kprobes-common.c Disintegrate asm/system.h for ARM 2012-03-28 18:30:01 +01:00
kprobes-test-arm.c ARM: 7440/1: kprobes: only test 'sub pc, pc, #1b-2b+8-2' on ARMv6 2012-07-05 12:57:16 +01:00
kprobes-test-thumb.c ARM: 7174/1: Fix build error in kprobes test code on Thumb2 kernels 2011-11-26 21:58:53 +00:00
kprobes-test.c ARM: 7209/1: Use generic ARM instruction set condition code checks for kprobes. 2011-12-13 08:52:03 +00:00
kprobes-test.h ARM: 7174/1: Fix build error in kprobes test code on Thumb2 kernels 2011-11-26 21:58:53 +00:00
kprobes-thumb.c ARM: 7423/1: kprobes: run t32_simulate_ldr_literal() without insn slot 2012-06-14 15:11:44 +01:00
kprobes.c Autogenerated GPG tag for Rusty D1ADB8F1: 15EE 8D6C AB0E 7F0C F999 BFCB D920 0E6C D1AD B8F1 2012-04-02 08:53:24 -07:00
kprobes.h ARM: kprobes: Add exports for test code 2011-09-20 18:17:43 +00:00
machine_kexec.c ARM: 7540/1: kexec: Check segment memory addresses 2012-09-26 22:58:39 +01:00
Makefile Merge branch 'fixes' into for-linus 2012-10-11 10:55:04 +01:00
module.c ARM: 7059/1: LPAE: Use PMD_(SHIFT|SIZE|MASK) instead of PGDIR_* 2011-08-23 15:30:33 +01:00
opcodes.c ARM: 7206/1: Add generic ARM instruction set condition code checks. 2011-12-13 08:52:02 +00:00
patch.c ARM: 7332/1: extract out code patch function from kprobes 2012-03-24 09:38:55 +00:00
patch.h ARM: 7332/1: extract out code patch function from kprobes 2012-03-24 09:38:55 +00:00
perf_event_cpu.c ARM: perf: move irq registration into pmu implementation 2012-08-23 11:35:52 +01:00
perf_event_v6.c ARM: perf: prepare for moving CPU PMU code into separate file 2012-08-23 11:35:52 +01:00
perf_event_v7.c ARM: perf: prepare for moving CPU PMU code into separate file 2012-08-23 11:35:52 +01:00
perf_event_xscale.c ARM: perf: prepare for moving CPU PMU code into separate file 2012-08-23 11:35:52 +01:00
perf_event.c ARM: perf: move irq registration into pmu implementation 2012-08-23 11:35:52 +01:00
pj4-cp0.c arm: remove several unnecessary module.h include instances 2011-10-31 19:30:48 -04:00
process.c Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/signal 2012-10-13 10:05:52 +09:00
ptrace.c ARM: 7525/1: ptrace: use updated syscall number for syscall auditing 2012-09-19 21:50:50 +01:00
relocate_kernel.S ARM: 7065/1: kexec: ensure new kernel is entered in ARM state 2011-08-28 10:39:41 +01:00
return_address.c arm: convert core files from module.h to export.h 2011-10-31 19:30:49 -04:00
sched_clock.c Merge branches 'atags', 'cache-l2x0', 'clkdev', 'fixes', 'integrator', 'misc', 'opcodes' and 'syscall' into for-linus 2012-10-04 23:01:55 +01:00
setup.c Merge branch 'fixes' into for-linus 2012-10-11 10:55:04 +01:00
signal.c Uninclude linux/freezer.h 2012-10-01 09:58:18 -04:00
signal.h ARM: 7471/1: Revert "7442/1: Revert "remove unused restart trampoline"" 2012-07-28 11:11:51 +01:00
sleep.S Disintegrate asm/system.h for ARM 2012-03-28 18:30:01 +01:00
smp_scu.c ARM: 7347/1: SCU: use cpu_logical_map for per-CPU low power mode 2012-04-28 17:31:37 +01:00
smp_tlb.c smp: introduce a generic on_each_cpu_mask() function 2012-03-28 17:14:35 -07:00
smp_twd.c ARM: 7535/1: Reprogram smp_twd based on new common clk framework notifiers 2012-09-19 22:04:43 +01:00
smp.c Merge branch 'fixes' into for-linus 2012-10-11 10:55:04 +01:00
stacktrace.c arm: convert core files from module.h to export.h 2011-10-31 19:30:49 -04:00
suspend.c ARM: kernel: update cpu_suspend code to use cache LoUIS operations 2012-09-25 11:20:26 +01:00
swp_emulate.c ARM: 7208/1: Add condition code checking to SWP emulation handler. 2011-12-13 08:52:03 +00:00
sys_arm.c arm: get rid of execve wrapper, switch to generic execve() implementation 2012-09-30 22:21:37 -04:00
sys_oabi-compat.c userns: Convert stat to return values mapped from kuids and kgids 2012-05-15 14:08:35 -07:00
tcm.c Disintegrate asm/system.h for ARM 2012-03-28 18:30:01 +01:00
tcm.h
thumbee.c ARM: 7385/1: ThumbEE: Use cpuid macros to read ID_PFR0 for ThumbEE 2012-04-25 19:49:26 +01:00
time.c ARM: use new LEDS CPU trigger stub to replace old one 2012-08-01 11:22:14 +08:00
topology.c ARM: 7482/1: topology: fix section mismatch warning for init_cpu_topology 2012-08-11 09:15:56 +01:00
traps.c ARM: 7526/1: traps: send SIGILL if get_user fails on undef handling path 2012-09-07 20:40:44 +01:00
unwind.c ARM: unwinder: fix bisection to find origin in .idx section 2011-12-15 14:02:19 -08:00
vmlinux.lds.S ARM: 7428/1: Prevent KALLSYM size mismatch on ARM. 2012-06-22 22:54:18 +01:00
xscale-cp0.c arm: remove several unnecessary module.h include instances 2011-10-31 19:30:48 -04:00