pl011 (Raspberry Pi) crash

pl011 (Raspberry Pi) crash

[Nuno Gonçalves]

I started to use the mainline recently for the Raspberry Pi and get
often this crash. I get it rarely and also don't have a history with
previous versions, so it's hard to bisect this.

Got this with 5.18.0-rc4 also.

Port is pl011, with hardware flow control and baud at 2Mbps.

# [ 2742.199002] Unable to handle kernel NULL pointer dereference at
virtual address 0000000000000000
[ 2742.207997] Mem abort info:
[ 2742.210880] ESR = 0x86000005
[ 2742.214024] EC = 0x21: IABT (current EL), IL = 32 bits
[ 2742.219456] SET = 0, FnV = 0
[ 2742.222583] EA = 0, S1PTW = 0
[ 2742.225802] FSC = 0x05: level 1 translation fault
[ 2742.230803] user pgtable: 4k pages, 39-bit VAs, pgdp=00000000045d0000
[ 2742.237429] [0000000000000000] pgd=0000000000000000,
p4d=0000000000000000, pud=0000000000000000
[ 2742.246339] Internal error: Oops: 86000005 [#1] PREEMPT SMP
[ 2742.252016] CPU: 3 PID: 192 Comm: kworker/u8:3 Not tainted 5.18.0-rc3 #1
[ 2742.258828] Hardware name: Raspberry Pi Compute Module 3 IO board V3.0 (DT)
[ 2742.265896] Workqueue: events_unbound flush_to_ldisc
[ 2742.270959] pstate: 00000005 (nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[ 2742.278032] pc : 0x0
[ 2742.280253] lr : uart_throttle+0x94/0x160
[ 2742.284331] sp : ffffffc0095abbd0
[ 2742.287692] x29: ffffffc0095abbd0 x28: 0000000000000000 x27: 0000000000000077
[ 2742.294953] x26: ffffff800261d400 x25: ffffffc009241000 x24: 0000000000000000
[ 2742.302214] x23: 0000000000000008 x22: ffffff8002635610 x21: ffffff8001fb9080
[ 2742.309476] x20: ffffff800261d400 x19: 0000000000000024 x18: 000000457a869a76
[ 2742.316736] x17: 0000000000000001 x16: 0000000000000001 x15: 0014070c74d6ecfa
[ 2742.323994] x14: 00140abfb6d3354a x13: ffffffc00892c468 x12: 00000000fa83b2da
[ 2742.331256] x11: 00000000000002b6 x10: 0000000000001a40 x9 : ffffffc00854b374
[ 2742.338517] x8 : fefefefefefefeff x7 : 0000000000000000 x6 : 0000000000000000
[ 2742.345775] x5 : 0000000000000001 x4 : ffffff80025b0000 x3 : 000000000000000d
[ 2742.353034] x2 : 0000000000000004 x1 : 0000000000000000 x0 : ffffff8001fb9080
[ 2742.360294] Call trace:
[ 2742.362773] 0x0
[ 2742.364642] tty_throttle_safe+0xb4/0xe0
[ 2742.368636] n_tty_receive_buf_common+0x760/0x1350
[ 2742.373509] n_tty_receive_buf2+0x20/0x30
[ 2742.377582] tty_ldisc_receive_buf+0x2c/0x80
[ 2742.381921] tty_port_default_receive_buf+0x50/0x90
[ 2742.386879] flush_to_ldisc+0xfc/0x140
[ 2742.390689] process_one_work+0x1dc/0x450
[ 2742.394768] worker_thread+0x154/0x450
[ 2742.398579] kthread+0x100/0x110
[ 2742.401859] ret_from_fork+0x10/0x20
[ 2742.405504] Code: bad PC value
[ 2742.408607] ---[ end trace 0000000000000000 ]---

Thanks,
Nuno

Re: pl011 (Raspberry Pi) crash

[Ilpo Järvinen]

[-- Attachment #1: Type: text/plain, Size: 3024 bytes --]

On Thu, 28 Apr 2022, Nuno Gonçalves wrote:

> I started to use the mainline recently for the Raspberry Pi and get
> often this crash. I get it rarely and also don't have a history with
> previous versions, so it's hard to bisect this.
> 
> Got this with 5.18.0-rc4 also.
> 
> Port is pl011, with hardware flow control and baud at 2Mbps.
> 
> # [ 2742.199002] Unable to handle kernel NULL pointer dereference at
> virtual address 0000000000000000
> [ 2742.207997] Mem abort info:
> [ 2742.210880] ESR = 0x86000005
> [ 2742.214024] EC = 0x21: IABT (current EL), IL = 32 bits
> [ 2742.219456] SET = 0, FnV = 0
> [ 2742.222583] EA = 0, S1PTW = 0
> [ 2742.225802] FSC = 0x05: level 1 translation fault
> [ 2742.230803] user pgtable: 4k pages, 39-bit VAs, pgdp=00000000045d0000
> [ 2742.237429] [0000000000000000] pgd=0000000000000000,
> p4d=0000000000000000, pud=0000000000000000
> [ 2742.246339] Internal error: Oops: 86000005 [#1] PREEMPT SMP
> [ 2742.252016] CPU: 3 PID: 192 Comm: kworker/u8:3 Not tainted 5.18.0-rc3 #1
> [ 2742.258828] Hardware name: Raspberry Pi Compute Module 3 IO board V3.0 (DT)
> [ 2742.265896] Workqueue: events_unbound flush_to_ldisc
> [ 2742.270959] pstate: 00000005 (nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
> [ 2742.278032] pc : 0x0
> [ 2742.280253] lr : uart_throttle+0x94/0x160
> [ 2742.284331] sp : ffffffc0095abbd0
> [ 2742.287692] x29: ffffffc0095abbd0 x28: 0000000000000000 x27: 0000000000000077
> [ 2742.294953] x26: ffffff800261d400 x25: ffffffc009241000 x24: 0000000000000000
> [ 2742.302214] x23: 0000000000000008 x22: ffffff8002635610 x21: ffffff8001fb9080
> [ 2742.309476] x20: ffffff800261d400 x19: 0000000000000024 x18: 000000457a869a76
> [ 2742.316736] x17: 0000000000000001 x16: 0000000000000001 x15: 0014070c74d6ecfa
> [ 2742.323994] x14: 00140abfb6d3354a x13: ffffffc00892c468 x12: 00000000fa83b2da
> [ 2742.331256] x11: 00000000000002b6 x10: 0000000000001a40 x9 : ffffffc00854b374
> [ 2742.338517] x8 : fefefefefefefeff x7 : 0000000000000000 x6 : 0000000000000000
> [ 2742.345775] x5 : 0000000000000001 x4 : ffffff80025b0000 x3 : 000000000000000d
> [ 2742.353034] x2 : 0000000000000004 x1 : 0000000000000000 x0 : ffffff8001fb9080
> [ 2742.360294] Call trace:
> [ 2742.362773] 0x0
> [ 2742.364642] tty_throttle_safe+0xb4/0xe0
> [ 2742.368636] n_tty_receive_buf_common+0x760/0x1350
> [ 2742.373509] n_tty_receive_buf2+0x20/0x30
> [ 2742.377582] tty_ldisc_receive_buf+0x2c/0x80
> [ 2742.381921] tty_port_default_receive_buf+0x50/0x90
> [ 2742.386879] flush_to_ldisc+0xfc/0x140
> [ 2742.390689] process_one_work+0x1dc/0x450
> [ 2742.394768] worker_thread+0x154/0x450
> [ 2742.398579] kthread+0x100/0x110
> [ 2742.401859] ret_from_fork+0x10/0x20
> [ 2742.405504] Code: bad PC value
> [ 2742.408607] ---[ end trace 0000000000000000 ]---

I wonder on what basis uart_throttle() assumes that .throttle is non-NULL 
in uart_ops? ...Perhaps I'm missing something but I cannot find anything 
that would guarantee it (and pl011 is among the drivers that don't seem 
to set it).

-- 
 i.