Re: [PATCH] DSPBRIDGE:Fix Kernel memory poison overwritten after DSP_MMUFAULT

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Fri, May 14, 2010 at 12:15 AM, Guzman Lugo, Fernando
<fernando.lugo@xxxxxx> wrote:
>> But the DSP is not dumping the stack there, from what I can see
>> bridge_brd_read() is used to read DSP internal memory.
>
> DSP is dumping the stack after the MMUFault and mmu let DSP to continue.
>
> Let's see what happens in successful case, so that the mmu fault
> Mechanics can be understood better:
>
> 1.- DSP wants to write some virtual address which is not found by the
>        Mmu.
>
> 2.- MMU module does not allow to the DSP continue executing and
>        Generates MMUfault interrupt which is attached to MPU side.
>
> 3.- MPU side allocates a dummy address, so that it can be mapped to
>        The DSP fault address.
>
> dummy_va_addr = kzalloc(sizeof(char) * 0x1000, GFP_ATOMIC);
>
>
> 3.- MPU dumps the DLL loaded
>        At the moment of the crash, at this point we don't need anything from
>        DSP because MPU has the information of DLL's loaded.
>
>
>                print_dsp_trace_buffer(dev_context);
>                dump_dl_modules(dev_context);
>
>
> 4.- MPU maps the physical address of the dummy address to the fault address
>        So that, if the DSP want to write into the fault address it will
>        Be writing into the dummy buffer revered previously.
>
>                                hw_mmu_tlb_add(resources->dw_dmmu_base,
>                                                mem_physical, fault_addr,
>                                                HW_PAGE_SIZE4KB, 1,
>                                                &map_attrs, HW_SET, HW_SET);
>
> 5.- MPU generates a GPT8 overflow interrupt.
>
>                        while (!(omap_dm_timer_read_status(timer) &
>                                GPTIMER_IRQ_OVERFLOW)) {
>                                if (cnt++ >= GPTIMER_IRQ_WAIT_MAX_CNT) {
>                                        pr_err("%s: GPTimer interrupt failed\n",
>                                                                __func__);
>                                        break;
>                                }
>                        }
>
>
> 6.- MPU acked mmufault interrupt.
>
>
> hw_mmu_event_ack(resources->dw_dmmu_base,
>                                HW_MMU_TRANSLATION_FAULT);
>
>
> 7.- MMU module tries to get the physical address of the DSP fault address
>        A now it can, the address is the page of the dummy address + the
>        Offset of the fault address.
>
> 8.- MMU module lets DSP to continue. But at that moment DSP has to attend
>        The GPT8 hw interrupt so that it change the context to the GTP8
>        overflow ISR and then dumps all the stack information in the same
>        shared memory area which is use for SYS_printf traces.
>
> 9.- After doing the acked of the MMUfault interrupt MPU call
>        dump_dsp_stack function
>
>                /* Clear MMU interrupt */
>                hw_mmu_event_ack(resources->dw_dmmu_base,
>                                HW_MMU_TRANSLATION_FAULT);
>                dump_dsp_stack(deh_mgr->hwmd_context);
>
> 10. Inside dump_dsp_stack we wait until DSP writes the special value
>        MMU_FAULT_HEAD1 and MMU_FAULT_HEAD2 into tracing area, which
>        States the DSP completed the stack dump.
>
>                while ((mmu_fault_dbg_info.head[0] != MMU_FAULT_HEAD1 ||
>                        mmu_fault_dbg_info.head[1] != MMU_FAULT_HEAD2) &&
>                        poll_cnt < POLL_MAX) {
>
>                        /* Read DSP dump size from the DSP trace buffer... */
>                        status = (*intf_fxns->pfn_brd_read)(wmd_context,
>                                (u8 *)&mmu_fault_dbg_info, (u32)trace_begin,
>                                sizeof(mmu_fault_dbg_info), 0);
>
>                        if (DSP_FAILED(status))
>                                break;
>
>                        poll_cnt++;
>                }
>
>
> 11 .- After writing the heads values, DSP just does an infinite while
>
> 12.- MPU then prints the information sent by DSP.
>
>
> Please let me know if you have any doubt.

You repeated step 3 twice. So let's assume the first one is 3.1.

1) What happens if you skip step 3.1 and 4?

You are assuming that the MMU unit would not let the DSP continue
running, but I fail to see why. Then the stack information would not
be available.

First of all, I don't see any stack information anyway:
dump_dsp_stack:No DSP MMU-Fault information available. Now Deepak has
used 0 in hw_mmu_tlb_add() and he is able to see the stack just fine.

>> If I'm understanding things correctly, then we shouldn't map the
>> faulty address again (through hw_mmu_tlb_add), and we shouldn't clear
>> the interrupt either (HW_MMU_TRANSLATION_FAULT). (I haven't tested
>> this yet).
>
> If we do that, DSP would be able to dump the DSP stack.

You mean we _woudn't_? First, I'm not really worried about loosing a
feature that doesn't seem to be working anyway. And second, we assume
we actually want that feature. For development purposes, sure, but in
a production device, no... we actually don't want all that debugging
code which seems to be quite big.

> Also I am not sure
> if after reloading the base image and resetting DSP MMU module, the
> HW_MMU_TRANSLATION_FAULT flag is reset too, maybe that whould have to take
> care about that.

Seems to be working fine here. Probably all interrupts are cleared
when reloading.

-- 
Felipe Contreras
--
To unsubscribe from this list: send the line "unsubscribe linux-omap" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html

[Index of Archives]     [Linux Arm (vger)]     [ARM Kernel]     [ARM MSM]     [Linux Tegra]     [Linux WPAN Networking]     [Linux Wireless Networking]     [Maemo Users]     [Linux USB Devel]     [Video for Linux]     [Linux Audio Users]     [Yosemite Trails]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux