Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

armv7/Aarch32: crash in stack unwind (DPRINT_STACK()) #1069

Closed
prime-zeng opened this issue Sep 23, 2016 · 9 comments
Closed

armv7/Aarch32: crash in stack unwind (DPRINT_STACK()) #1069

prime-zeng opened this issue Sep 23, 2016 · 9 comments
Labels
bug

Comments

@prime-zeng
Copy link
Contributor

DEBUG: [0x0] TEE-CORE:print_stack:376: SP :7e2b2618
ERROR: TEE-CORE: pc 0x7e007d06
DEBUG: [0x0] TEE-CORE:unwind_exec_insn:176: 0x7e2b2618
DEBUG: [0x0] TEE-CORE:unwind_exec_insn:176: 0x0
DEBUG: [0x0] TEE-CORE:unwind_exec_insn:176: 0x68
ERROR: TEE-CORE:
ERROR: TEE-CORE: core data-abort at address 0x68 (translation fault)
ERROR: TEE-CORE: fsr 0x00000005 ttbr0 0x7e29806a ttbr1 0x7e29806a cidr 0x0
ERROR: TEE-CORE: cpu #0 cpsr 0x00000133
ERROR: TEE-CORE: r0 0x00000008 r4 0x7e20069c r8 0x00000000 r12 0x7e2b25f4
ERROR: TEE-CORE: r1 0x80400000 r5 0x00000000 r9 0x00000000 sp 0x7e2b2598
ERROR: TEE-CORE: r2 0x0000006c r6 0x00000000 r10 0x00000000 lr 0x7e007949
ERROR: TEE-CORE: r3 0x00000068 r7 0x7e2b25a0 r11 0x00000000 pc 0x7e00797e
ERROR: TEE-CORE: Call stack:
ERROR: TEE-CORE: pc 0x7e00797e
DEBUG: [0x0] TEE-CORE:unwind_exec_insn:176: 0x7e2b2598
DEBUG: [0x0] TEE-CORE:unwind_exec_insn:176: 0x7e2b25a0
DEBUG: [0x0] TEE-CORE:unwind_exec_insn:176: 0x7e2b25d0
DEBUG: [0x0] TEE-CORE:unwind_exec_insn:176: 0x7e2b25d8
ERROR: TEE-CORE: pc 0x7e007be3
DEBUG: [0x0] TEE-CORE:unwind_exec_insn:176: 0x7e2b25d8
DEBUG: [0x0] TEE-CORE:unwind_exec_insn:176: 0x7e2b25e0
DEBUG: [0x0] TEE-CORE:unwind_exec_insn:176: 0x7e2b25f0
DEBUG: [0x0] TEE-CORE:unwind_exec_insn:176: 0x7e2b25f8
ERROR: TEE-CORE: pc 0x7e007c9b
DEBUG: [0x0] TEE-CORE:unwind_exec_insn:176: 0x7e2b25f8
DEBUG: [0x0] TEE-CORE:unwind_exec_insn:176: 0x7e2b25f8
DEBUG: [0x0] TEE-CORE:unwind_exec_insn:176: 0x7e2b260c
DEBUG: [0x0] TEE-CORE:unwind_exec_insn:176: 0x7e2b2618
ERROR: TEE-CORE: pc 0x7e007dcd
DEBUG: [0x0] TEE-CORE:unwind_exec_insn:176: 0x7e2b2618
DEBUG: [0x0] TEE-CORE:unwind_exec_insn:176: 0x7e2b2620
DEBUG: [0x0] TEE-CORE:unwind_exec_insn:176: 0x7e2b2688
DEBUG: [0x0] TEE-CORE:unwind_exec_insn:176: 0x7e2b2690
ERROR: TEE-CORE: pc 0x7e00d7d9
DEBUG: [0x0] TEE-CORE:unwind_exec_insn:176: 0x7e2b2690
DEBUG: [0x0] TEE-CORE:unwind_exec_insn:176: 0x7e2b2690
DEBUG: [0x0] TEE-CORE:unwind_exec_insn:176: 0x7e2b2728
DEBUG: [0x0] TEE-CORE:unwind_exec_insn:176: 0x7e2b2828
DEBUG: [0x0] TEE-CORE:unwind_exec_insn:176: 0x7e2b2830
ERROR: TEE-CORE: pc 0x7e00d81b
DEBUG: [0x0] TEE-CORE:unwind_exec_insn:176: 0x7e2b2830
DEBUG: [0x0] TEE-CORE:unwind_exec_insn:176: 0x7e2b2830
DEBUG: [0x0] TEE-CORE:unwind_exec_insn:176: 0x7e2b2840
DEBUG: [0x0] TEE-CORE:unwind_exec_insn:176: 0x7e2b2848
ERROR: TEE-CORE: pc 0x7e00d879
DEBUG: [0x0] TEE-CORE:unwind_exec_insn:176: 0x7e2b2848
DEBUG: [0x0] TEE-CORE:unwind_exec_insn:176: 0x7e2b2850
DEBUG: [0x0] TEE-CORE:unwind_exec_insn:176: 0x7e2b2860
DEBUG: [0x0] TEE-CORE:unwind_exec_insn:176: 0x7e2b2868
ERROR: TEE-CORE: pc 0x7e002c1b
DEBUG: [0x0] TEE-CORE:unwind_exec_insn:176: 0x7e2b2868
DEBUG: [0x0] TEE-CORE:unwind_exec_insn:176: 0x7e2b2868
DEBUG: [0x0] TEE-CORE:unwind_exec_insn:176: 0x7e2b2884
DEBUG: [0x0] TEE-CORE:unwind_exec_insn:176: 0x7e2b2890
ERROR: TEE-CORE: pc 0x7e00f281
DEBUG: [0x0] TEE-CORE:unwind_exec_insn:176: 0x7e2b2890
DEBUG: [0x0] TEE-CORE:unwind_exec_insn:176: 0x7e2b28a0
DEBUG: [0x0] TEE-CORE:unwind_exec_insn:176: 0x7e2b28bc
DEBUG: [0x0] TEE-CORE:unwind_exec_insn:176: 0x7e2b28c8
ERROR: TEE-CORE: pc 0x7e00e497
DEBUG: [0x0] TEE-CORE:unwind_exec_insn:176: 0x7e2b28c8
DEBUG: [0x0] TEE-CORE:unwind_exec_insn:176: 0x7e2b28d0
DEBUG: [0x0] TEE-CORE:unwind_exec_insn:176: 0x7e2b2918
DEBUG: [0x0] TEE-CORE:unwind_exec_insn:176: 0x7e2b2920
ERROR: TEE-CORE: pc 0x7e00c111
DEBUG: [0x0] TEE-CORE:unwind_exec_insn:176: 0x7e2b2920
DEBUG: [0x0] TEE-CORE:unwind_exec_insn:176: 0x7e2b2928
DEBUG: [0x0] TEE-CORE:unwind_exec_insn:176: 0x7e2b29a8
DEBUG: [0x0] TEE-CORE:unwind_exec_insn:176: 0x7e2b29b0
ERROR: TEE-CORE: pc 0x7e00c2f7
DEBUG: [0x0] TEE-CORE:unwind_exec_insn:176: 0x7e2b29b0
DEBUG: [0x0] TEE-CORE:unwind_exec_insn:176: 0x7e2b29c0
DEBUG: [0x0] TEE-CORE:unwind_exec_insn:176: 0x7e2b29dc
DEBUG: [0x0] TEE-CORE:unwind_exec_insn:176: 0x7e2b29e8
ERROR: TEE-CORE: pc 0x7e0049fd
DEBUG: [0x0] TEE-CORE:unwind_exec_insn:176: 0x7e2b29e8
DEBUG: [0x0] TEE-CORE:unwind_exec_insn:176: 0x7e2b29e8
DEBUG: [0x0] TEE-CORE:unwind_exec_insn:176: 0x7e2b2a0c
DEBUG: [0x0] TEE-CORE:unwind_exec_insn:176: 0x7e2b2a18
ERROR: TEE-CORE: pc 0x7e0010b8
ERROR: TEE-CORE: Panic 'unhandled pageable abort' at core/arch/arm/kernel/abort.c:573 <abort_handler>
@prime-zeng
Copy link
Contributor Author

I think maybe more register need to be passed to unwind_stack?

@jenswi-linaro
Copy link
Contributor

Yes I think so too. Is the function called due an abort/panic or something else?

@prime-zeng
Copy link
Contributor Author

No, i just call the EPRINT_STACK directly in the normal flow(in a static TA), and the EPRINT_STACK itself cause a abort.

@jenswi-linaro
Copy link
Contributor

This seems to be a bug.

@jforissier
Copy link
Contributor

@prime-zeng could you please try this?

diff --git a/core/arch/arm/kernel/unwind_arm32.c b/core/arch/arm/kernel/unwind_arm32.c
index fa75e96..b8b53c8 100644
--- a/core/arch/arm/kernel/unwind_arm32.c
+++ b/core/arch/arm/kernel/unwind_arm32.c
@@ -248,7 +248,7 @@ static bool unwind_exec_insn(struct unwind_state *state)

                mask = unwind_exec_read_byte(state);
                if (mask == 0 || (mask & 0xf0) != 0)
-                       return 1;
+                       return false;

                /* Update SP */
                update_vsp = 1;

@prime-zeng
Copy link
Contributor Author

@jforissier it doesn't work. Maybe i can try to build a full unwind_state, and pass it to the unwind_stack?

@jforissier
Copy link
Contributor

@prime-zeng yes, maybe that's required. Please try and let me know if that works, then I can test on HiKey (I can reproduce an issue where the unwind would dump correct information then loop forever on PC=0x00000004. Hopefully it is the same root cause).

@jforissier jforissier added the bug label Oct 1, 2016
@jforissier jforissier changed the title coredump for the unwind_stack armv7/Aarch32: crash in stack unwind (DPRINT_STACK()) Oct 1, 2016
@prime-zeng
Copy link
Contributor Author

@jforissier : try add
asm volatile(
"stmia %0, {r0 - r12}\n\t"
:
: "r" (state.registers)
: "memory"
);
I can solve the crash problem.

jforissier added a commit to jforissier/optee_os that referenced this issue Oct 10, 2016
@jforissier
arm32: unwind: print_stack() should create a more complete state
091faf8 
Save general purpose registers and the frame pointer before starting
the unwind operation. Also, set PC to the begining of the print_stack
function since there's no point in going further.

Fixes: OP-TEE#1069
Signed-off-by: Jerome Forissier <[email protected]>
@jforissier
Copy link
Contributor

Hi @prime-zeng,

Could you please check if #1102 works for you? In addition to the code you've given above, I had to prevent unwinding past tee_svc_do_call() otherwise I would run into infinite loops. Thanks.

jforissier added a commit to jforissier/optee_os that referenced this issue Oct 12, 2016
@jforissier
arm32: unwind: print_stack(): fix unwind_state
30dd01e 
print_stack() must save r7 and r11 in the unwind_state structure. Not
doing so will likely result in a crash dunring unwind.
Register r7 is typically used as a frame pointer by GCC in Thumb2 mode,
while r11 (a.k.a. fp) is the frame pointer in ARM mode.

Also, set PC to the begining of print_stack() since there's no point in
going further inside the function.

Fixes: OP-TEE#1069
Signed-off-by: Jerome Forissier <[email protected]>
Tested-by: Jerome Forissier <[email protected]> (HiKey)
Tested-by: Jerome Forissier <[email protected]> (QEMU)
Reviewed-by: Etienne Carriere <[email protected]>
Reviewed-by: Jens Wiklander <[email protected]>
takuya-sakata pushed a commit to renesas-rcar/optee_os that referenced this issue Dec 22, 2017
@jforissier @takuya-sakata
arm32: unwind: print_stack(): fix unwind_state
0d46ead 
print_stack() must save r7 and r11 in the unwind_state structure. Not
doing so will likely result in a crash dunring unwind.
Register r7 is typically used as a frame pointer by GCC in Thumb2 mode,
while r11 (a.k.a. fp) is the frame pointer in ARM mode.

Also, set PC to the beginning of print_stack() since there's no point
in going further inside the function.

Fixes: OP-TEE/optee_os#1069
Signed-off-by: Jerome Forissier <[email protected]>
Tested-by: Jerome Forissier <[email protected]> (HiKey)
Tested-by: Jerome Forissier <[email protected]> (QEMU)
Reviewed-by: Etienne Carriere <[email protected]>
Reviewed-by: Jens Wiklander <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
bug
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@jenswi-linaro @jforissier @prime-zeng