From patchwork Mon Sep 4 08:33:59 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: =?utf-8?b?UmFmYcWCIE1pxYJlY2tp?= X-Patchwork-Id: 13373592 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 511C9C83F33 for ; Mon, 4 Sep 2023 08:34:38 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender:Content-Type: Content-Transfer-Encoding:List-Subscribe:List-Help:List-Post:List-Archive: List-Unsubscribe:List-Id:Subject:From:Cc:To:MIME-Version:Date:Message-ID: Reply-To:Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender :Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Owner; bh=TCbDnB9j/YYvBOgVIV4fUHLH3LmzOlNjOr23WAJX6PY=; b=Gy4xauBQl3EdwQVRvgJ3DMvTKo AtRJcVjl7Qq7a98GJEeuzIWytzupMCsbV8i/w0CTn2qy0aofdj+4WyqsebxB7Xi36+pjNRi4aCsTa yady0oATRp+GjJ1QLWITGshdpsX+1JGffSFp//CnNxvknklQ83+9BvwUDKqJW9ag0cyRGXNitOJz5 trRf6A+JdL/ICqApFIKsfaSuc8QY3pFuKapFb6pDGcx6jifhQMe9rfE8G0/bA3ZpaRlcmqHoC6jyB bDEKlY9C1/DC1638OyEy72g7kdj+2jPqu7xrrx293pwHkOWIsfdRIjj8iW+XRBTJoOyyDYPelIM5C KjIvfmbw==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.96 #2 (Red Hat Linux)) id 1qd529-003Zq2-0v; Mon, 04 Sep 2023 08:34:09 +0000 Received: from mail-lf1-x12d.google.com ([2a00:1450:4864:20::12d]) by bombadil.infradead.org with esmtps (Exim 4.96 #2 (Red Hat Linux)) id 1qd523-003Zp4-33 for linux-arm-kernel@lists.infradead.org; Mon, 04 Sep 2023 08:34:08 +0000 Received: by mail-lf1-x12d.google.com with SMTP id 2adb3069b0e04-50087d47d4dso1996821e87.1 for ; Mon, 04 Sep 2023 01:34:02 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20221208; t=1693816441; x=1694421241; darn=lists.infradead.org; h=content-transfer-encoding:subject:from:cc:to:content-language :user-agent:mime-version:date:message-id:from:to:cc:subject:date :message-id:reply-to; bh=0pHfPHsRS32lQzAyn/aCgRZs7D/3MVytHhFMqFPkbks=; b=sdRkPtepGESnkCZVO14NQ/RF++3asofvvBqT/AkyY+hsVt+UVMK9pueIDsmqjULcaq 1eA8bI0Je6+RZs+fFGtEMO2SqktxsoqTbStn6X3QUuRNLInpxicwHoX/w9r7SRqyrrnk /Z5Zs3li1R7/PKiWUEvgwiaFM8DKKhtnGSw7MNqWD/C5OyHSnBRrLtHx0M0QA6VPTDX9 ubsT7/mee3r2k7dfYkhz/ab56E9dM59mCF6ItUh96EPa2dQ6zEogcDddSlMO92gtS0t+ 2h5gbdr/TTFovAOiqfdIk823HZfYvgBAeU8XJhDQ1A73exjAQUK4+uAWhW0iDE/TGrJh hfBw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1693816441; x=1694421241; h=content-transfer-encoding:subject:from:cc:to:content-language :user-agent:mime-version:date:message-id:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=0pHfPHsRS32lQzAyn/aCgRZs7D/3MVytHhFMqFPkbks=; b=AELXP5gDLyCwZDFmWSjRWB/fCPJnUstH0xQR4fBqXjjSLb+hf+L7P6gWG27G9GghvM bZri090Qpi2rQj+3t4PLAwIkF2Tds3NBlKaJpg9lGlBHMGOyMDLDKjfFiovOKpGqWGac 1kFOpKk8eAWZL/IyI9+7dcChQ5Y0gI9XNZxldldLZKVJsWke8RxcQBr08UI8BclV+s6Z GowpRjoW4o/EZriMZA+0BVYGj9NRRMRpb6E/vjnf/y5rM6zmJsr6ORgI7cgpJwCoRZMT Lpz3RUQRK/+8J6eqbsr/FLZPbFd1Tl2attfvN3/hf1fquCszCEErcIWckd3G6QHpJZo6 x5ww== X-Gm-Message-State: AOJu0Yx3z5exljD0C5b2PZ/Bh90nkGXy9VA8FInqgrtkx3x+zjALI3eT ab/jh0AkVoGbo9OH65CSVWc= X-Google-Smtp-Source: AGHT+IHtr6DV3rG/CtK+M6vhF1zbxFhnQjZ9kLSqp2je76cD/XZSMMFxTb4+Sq3uaqR44G5Jp5TLUg== X-Received: by 2002:a05:6512:536:b0:500:a69a:1c4 with SMTP id o22-20020a056512053600b00500a69a01c4mr5910615lfc.58.1693816440971; Mon, 04 Sep 2023 01:34:00 -0700 (PDT) Received: from [192.168.26.149] (031011218106.poznan.vectranet.pl. [31.11.218.106]) by smtp.googlemail.com with ESMTPSA id t11-20020a05640203cb00b0052a1d98618bsm5571217edw.54.2023.09.04.01.33.59 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Mon, 04 Sep 2023 01:34:00 -0700 (PDT) Message-ID: Date: Mon, 4 Sep 2023 10:33:59 +0200 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Content-Language: en-US To: Peter Zijlstra , Ingo Molnar , Will Deacon , Waiman Long , Boqun Feng , Russell King , Daniel Lezcano , Thomas Gleixner , Florian Fainelli , linux-clk@vger.kernel.org, linux-arm-kernel@lists.infradead.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org Cc: openwrt-devel@lists.openwrt.org, bcm-kernel-feedback-list@broadcom.com From: =?utf-8?b?UmFmYcWCIE1pxYJlY2tp?= Subject: ARM BCM53573 SoC hangs/lockups caused by locks/clock/random changes X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20230904_013404_007755_F959C723 X-CRM114-Status: GOOD ( 17.87 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org I made a second attempt on debugging some longstanding stability issues affecting BCM53753 SoCs. Those are single CPU core ARM Cortex-A7 boards with a pretty slow arch timer running at 36,8 kHz. After 0 to 20 minutes of close to zero activity I experience hangs and I need to wait a minute for watchdog to kick in and reboot device. First debugging attempt: https://lore.kernel.org/netdev/0f9d0cd6-d344-7915-7bc1-7a090b8305d2@gmail.com/T/ ("ARM board lockups/hangs triggered by locks and mutexes") After a lot of bisecting, testing & hacking I believe there are 3 types of kernel aspects that affect BCM53573 stability. I'd like to describe them below to document my debugging work. I'm clueless at this point. Maybe someone can come up with an idea of actual issue & ideally a solution. ##### 1. Locking During my first bisecting attempts I found multiple locking-related commit that regressed stability. Bisected commits: 131287ff833d ("once: add DO_ONCE_SLOW() for sleepable contexts"). and a following group: d0d583484d2e ("locking/refcount: Consolidate implementations of refcount_t") dab787c73f6e ("locking/refcount: Consolidate REFCOUNT_{MAX,SATURATED} definitions") 0d3182fbe689 ("locking/refcount: Move saturation warnings out of line") 809554147d60 ("locking/refcount: Improve performance of generic REFCOUNT_FULL code") 9c9269977f03 ("locking/refcount: Move the bulk of the REFCOUNT_FULL implementation into the header") 04bff7d7b808 ("locking/refcount: Remove unused refcount_*_checked() variants") 513b19a43bec ("locking/refcount: Ensure integer operands are treated as signed") 68b4ee68e8c8 ("locking/refcount: Define constants for saturation and max refcount values") I don't believe there is actually anything wrong about above changes. Maybe it's some tiny timing thing that my board just doesn't like? ##### 2. Clock (arm,armv7-timer) While comparing main clock in Broadcom's SDK with upstream one I noticed a tiny difference: mask value. I don't know it it makes any sense but switching from CLOCKSOURCE_MASK(56) to CLOCKSOURCE_MASK(64) in arm_arch_timer.c (to match SDK) increases average uptime (time before a hang/lockup happens) from 4 minutes to 36 minutes. ##### 3. Random code changes During my bisecting attempts I found one commit that regressed kernel stability but actual changes were meaningless in context of locking. It was commit ad9b10d1eaad ("mtd: core: introduce of support for dynamic partitions"): https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=ad9b10d1eaada169bd764abcab58f08538877e26 I thought that maybe it was all about making add_mtd_device() bigger and changing addresses of a lot of symbols (looking at System.map). So I reverted that mtd commit and developed a dummy change relocating as few symbols (System.map) as possible while still breaking stability: ### As those hangs/lockups are related to so many different changes it's really hard to debug them. This bug seems to be specific to the slow arch clock that affects stability only when kernel locking code and symbols layout trigger some very specific timing. Enabling CONFIG_PROVE_LOCKING seems to make issue go away but it affects so much code it's hard to tell why it actually matters. Same for disabling CONFIG_SMP. I noticed Broadcom's SDK keeps it disabled. I tried it and it improves stability (I had 3 devices with 6 days of uptime and counting) indeed. Again it affects a lot of kernel parts so it's hard to tell why it helps. Unless someone comes up with some magic solution I'll probably try building BCM53573 images without CONFIG_SMP for my personal needs. --- a/kernel/sched/idle.c +++ b/kernel/sched/idle.c @@ -94,6 +94,21 @@ void __cpuidle default_idle_call(void) arch_cpu_idle(); start_critical_timings(); } + + if (cpu_idle_force_poll == 1234) + arch_cpu_idle(); + if (cpu_idle_force_poll == 5678) + arch_cpu_idle(); + if (cpu_idle_force_poll == 1234) + arch_cpu_idle(); + if (cpu_idle_force_poll == 5678) + arch_cpu_idle(); + if (cpu_idle_force_poll == 1234) + arch_cpu_idle(); + if (cpu_idle_force_poll == 5678) + arch_cpu_idle(); + if (cpu_idle_force_poll == 1234) + arch_cpu_idle(); } static int call_cpuidle(struct cpuidle_driver *drv, struct cpuidle_device *dev, Above dummy change didn't relocate thousands of symbols but only about 20 of them. They happened to be lock symbols however. Does it make any sense for above diff to regress kernel stability for me and cause hangs/lockups? --- System.map.good +++ System.map.bad @@ -22214,36 +22214,36 @@ c062e7e0 T __cpuidle_text_start c062e7e0 t cpu_idle_poll c062e860 T default_idle_call -c062e884 T __cpuidle_text_end -c062e888 T __lock_text_start -c062e8a0 T _raw_spin_unlock_irqrestore -c062e8c0 T _raw_spin_trylock -c062e900 T _raw_write_unlock_irqrestore -c062e920 T _raw_read_trylock -c062e960 T _raw_write_trylock -c062e9a0 T _raw_spin_lock_bh -c062ea00 T _raw_read_lock_bh -c062ea40 T _raw_write_lock_bh -c062ea80 T _raw_spin_trylock_bh -c062eb00 T _raw_spin_unlock_bh -c062eb40 T _raw_write_unlock_bh -c062eb80 T _raw_read_unlock_bh -c062ebc0 T _raw_read_unlock_irqrestore -c062ec00 T _raw_write_lock -c062ec40 T _raw_write_lock_irq -c062ec80 T _raw_write_lock_irqsave -c062ecc0 T _raw_read_lock -c062ed00 T _raw_spin_lock -c062ed40 T _raw_read_lock_irq -c062ed80 T _raw_spin_lock_irq -c062ede0 T _raw_spin_lock_irqsave -c062ee40 T _raw_read_lock_irqsave -c062ee70 T __hyp_text_end -c062ee70 T __hyp_text_start -c062ee70 T __kprobes_text_end -c062ee70 T __kprobes_text_start -c062ee70 T __lock_text_end -c062ee70 T _etext +c062e954 T __cpuidle_text_end +c062e958 T __lock_text_start +c062e960 T _raw_spin_unlock_irqrestore +c062e980 T _raw_spin_trylock +c062e9c0 T _raw_write_unlock_irqrestore +c062e9e0 T _raw_read_trylock +c062ea20 T _raw_write_trylock +c062ea60 T _raw_spin_lock_bh +c062eac0 T _raw_read_lock_bh +c062eb00 T _raw_write_lock_bh +c062eb40 T _raw_spin_trylock_bh +c062ebc0 T _raw_spin_unlock_bh +c062ec00 T _raw_write_unlock_bh +c062ec40 T _raw_read_unlock_bh +c062ec80 T _raw_read_unlock_irqrestore +c062ecc0 T _raw_write_lock +c062ed00 T _raw_write_lock_irq +c062ed40 T _raw_write_lock_irqsave +c062ed80 T _raw_read_lock +c062edc0 T _raw_spin_lock +c062ee00 T _raw_read_lock_irq +c062ee40 T _raw_spin_lock_irq +c062eea0 T _raw_spin_lock_irqsave +c062ef00 T _raw_read_lock_irqsave +c062ef30 T __hyp_text_end +c062ef30 T __hyp_text_start +c062ef30 T __kprobes_text_end +c062ef30 T __kprobes_text_start +c062ef30 T __lock_text_end +c062ef30 T _etext c062f000 D __start_rodata c062f000 D sigreturn_codes c062f044 d cpu_arch_name