Ticket #12466 (closed defect: fixed)

Opened 19 months ago

Last modified 18 months ago

SKU295 one-off hang in Open Firmware after Linux reboot

Reported by: Quozl Owned by: Quozl
Priority: normal Milestone: 4-firmware
Component: ofw - open firmware Version: Development firmware
Keywords: Cc:
Action Needed: no action Verified: no
Deployments affected: Blocked By:
Blocking:

Description (last modified by Quozl) (diff)

An SKU295 hung in Open Firmware after Linux reboot, just after printing releasing.

On pressing the keyboard interrupt key, a Data Abort was shown. The Data Abort was not shown until that.

Serial log:

http://dev.laptop.org/~quozl/z/1TtVYE.txt

Possibly related to #12183

Registers:

ok .registers
       r0       r1       r2       r3       r4       r5       r6       r7
       e0        1       1c ffffffff fdac2f86 fdac2810        0 fda00080

       r8    r9/up  r10/tos r11/rp/fp  r12/ip   r13/sp   r14/lr       pc
 fdb3aea0 fda000a0 fb3fa9f0 fd9ff308 fdac264c fd9ff148 fdac23d0 fda05088

       PSR = NzCvIFt_IRQ32
ok select /keyboard q . head @ . tail @ .
fd9fd280 63 63
ok 

Change History

Changed 19 months ago by Quozl

  • description modified (diff)

(edit description, dereferencing head and tail variables)

Changed 18 months ago by Quozl

  • owner changed from wmb@… to Quozl
  • status changed from new to assigned
  • next_action changed from diagnose to test in build

The cause was corruption of heap when an allocation occurs, and the allocator is interrupted by an alarm handler which also makes an allocation. The allocator is apparently not re-entrant, and the results are either the same address returned to both callers, or corruption of the linked list.

http://dev.laptop.org/~quozl/q7b14ja.rom has a potential fix, which:

  • allocates from heap during driver open rather than during an alarm handler, for the /ap-sp, /keyboard, and /usb/keyboard drivers,
  • turns on the storage LED during the keyboard alarm handler,
  • enters the debugger if a key is pressed on the serial port while the SDHCI driver is waiting for a command to complete.

Changed 18 months ago by Quozl

  • next_action changed from test in build to add to release

Tested on four units over several days. Fixed in svn 3533.

Changed 18 months ago by Quozl

  • status changed from assigned to closed
  • next_action changed from add to release to no action
  • resolution set to fixed

Is in Q7B15.

Note: See TracTickets for help on using tickets.