i.MX233/i.MX28: kernel oops when insert this SD card

[PeterChan]

Hello All,

Recently, I got one 2GB SD card from market which always causes kernel oops when it is inserted to i.MX233 and i.MX28 EVK board. The error log from the i.MX28 is like this:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

mmc1: new high speed SD card at address b368

mmcblk1: mmc1:b368 SMI   1.87 GiB

mmcblk1:

kernel BUG at drivers/mmc/host/mxs-mmc.c:465!

Unable to handle kernel NULL pointer dereference at virtual address 00000000

pgd = c0004000

[00000000] *pgd=00000000

Internal error: Oops: 817 [#1] PREEMPT

last sysfs file: /sys/kernel/uevent_seqnum

Modules linked in:

CPU: 0    Not tainted  (2.6.35.3-571-gcca29a0-g4792be1-dirty #321)

PC is at __bug+0x20/0x2c

LR is at release_console_sem+0x1b4/0x230

pc : [<c0031138>]    lr : [<c004a07c>]    psr: 60000013

sp : c75f7da8  ip : c75f7cd0  fp : c75f7db4

r10: 00000000  r9 : 01230000  r8 : 00000000

r7 : 00000001  r6 : 00001000  r5 : c75f7e84  r4 : c756d600

r3 : 00000000  r2 : 00000000  r1 : c0469b48  r0 : 00000034

Flags: nZCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment kernel

Control: 0005317f  Table: 47d28000  DAC: 00000017

Process mmcqd (pid: 2169, stack limit = 0xc75f6270)

Stack: (0xc75f7da8 to 0xc75f8000)

7da0:                   c75f7e04 c75f7db8 c0281ba0 c0031128 00000000 00000000

7dc0: 00000000 00000000 00000000 00000000 00000000 00000001 00000000 c756d600

7de0: c75f7e70 c756d400 00000001 c752e3c4 00000000 c75f7e70 c75f7e24 c75f7e08

7e00: c0282380 c0281974 c75f7e70 c756d400 c75f7e30 00000001 c75f7e54 c75f7e28

7e20: c0278fd8 c0282350 c75f7e54 00000000 c75f7e30 c75f7e30 c74a6340 c74a6340

7e40: c7cd6600 c75f6000 c75f7f8c c75f7e58 c028051c c0278ed0 00000000 00000000

7e60: 00000000 c75f7e84 00000000 00000000 c75f7e84 c75f7edc c75f7eb0 c75f7e2c

7e80: c027906c 00000012 00000000 00000000 00000000 00000000 00000000 000000b5

7ea0: 00000000 00000000 c75f7edc c75f7e70 0000000c 00000000 00000000 00000000

7ec0: 00000000 00000000 0000049d 00000000 00000000 00000000 c75f7e70 00000000

7ee0: 00000000 00000200 00000008 00000000 00000200 00000000 c75f7eb0 c75f7e70

7f00: 00000001 c7d20800 c01c9a18 c01c8d4c c75f7f3c c7797458 00000000 c7797498

7f20: c7c25cc0 c75f6000 c7564030 00000000 c75f6000 c7564030 c74a6340 c7564030

7f40: c75f7f74 c75f7f50 c74a6340 c752e3c4 c75f7f74 c75f7f60 c01ba694 c01c0160

7f60: c74a6340 c75f6000 c752e3c4 c752e3cc c7564030 00000001 00000000 c75641a0

7f80: c75f7fc4 c75f7f90 c02810bc c0280330 00000013 00000000 c75f7fc4 c7ca9d80

7fa0: c75f7fcc c0280f88 c752e3c4 00000000 00000000 00000000 c75f7ff4 c75f7fc8

7fc0: c0061688 c0280f98 00000000 00000000 c75f7fd0 c75f7fd0 c7ca9d80 c0061604

7fe0: c004d134 00000013 00000000 c75f7ff8 c004d134 c0061614 00000000 00000000

Backtrace:

[<c0031118>] (__bug+0x0/0x2c) from [<c0281ba0>] (mxs_mmc_start_cmd+0x23c/0x9dc)

[<c0281964>] (mxs_mmc_start_cmd+0x0/0x9dc) from [<c0282380>] (mxs_mmc_request+0x40/0x80)

[<c0282340>] (mxs_mmc_request+0x0/0x80) from [<c0278fd8>] (mmc_wait_for_req+0x118/0x130)

r7:00000001 r6:c75f7e30 r5:c756d400 r4:c75f7e70

[<c0278ec0>] (mmc_wait_for_req+0x0/0x130) from [<c028051c>] (mmc_blk_issue_rq+0x1fc/0x60c)

r6:c75f6000 r5:c7cd6600 r4:c74a6340

[<c0280320>] (mmc_blk_issue_rq+0x0/0x60c) from [<c02810bc>] (mmc_queue_thread+0x134/0x138)

[<c0280f88>] (mmc_queue_thread+0x0/0x138) from [<c0061688>] (kthread+0x84/0x8c)

[<c0061604>] (kthread+0x0/0x8c) from [<c004d134>] (do_exit+0x0/0x6dc)

r7:00000013 r6:c004d134 r5:c0061604 r4:c7ca9d80

Code: e1a01000 e59f000c eb0c803e e3a03000 (e5833000)

---[ end trace e8886db44828e727 ]---

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

The error is due to an invalid field in CSD register of this 2GB SD card. The CSD version of this card is 1.0 but the TAAC field is an invalid value 0. Since the kernel is making use of this TAAC field to calculate the SD card timeout, an invalid value 0 can lead to a oops error at mxs_ns_to_ssp_ticks().

This error is only found on this <=2GB SD card. >2GB SDHC cards will not see this error because these cards are CSD version 2.0. For these cards, kernel always use a fix timeout and calculation that causes the oops error is skipped. Of course, <=2GB SD card that fully complying to SD card physical layer specification will not see this error neither.

To solve this issue, please assign the TAAC field to its maximum value likes this attachment whenever the TAAC field is invalid.

Regards,

Peter

Original Attachment has been moved to: SD_card_invalid_TAAC.patch.zip

[fabio_estevam]

Do you see the crash if you insert this SD card into a PC?

Does it happen with mx28 running kernel 3.8?

[PeterChan]

Hello Fabio,

No, I didn't see any crash if this SD card is inserted by PC via card reader.

I don't have kernel 3.8 to test mx28. FYI, the kernel oops comes from the function mxs_ns_to_ssp_ticks(unsigned clock_rate, unsigned ns) when ns=0. So, if mxs_ns_to_ssp_ticks() does not change, this issue may still persist.

[fabio_estevam]

So it seems that the proper fix would not be in the core mmc code then.

[OtavioSalvador]

I have prepared a commit with the change but as I cannot reproduce the problem (as my SD card works) I didn't submit it.

[PeterChan]

I think we can simulate the problem by edit the function
mmc_decode_csd() at linux/drivers/mmc/core/sd.c. When csd_struct is 0, assign 0 to both csd->tacc_ns and csd->tacc_clks. Try this on the kernel without this patch, you should see the error. Then apply the patch to validate the fix.

Please be informed that the error is caused by an SD card which does not complying to SD physical specification. When CSD register is CSD version 1.0, its field TAAC must not be 0.

Please also be informed that this error is found on i.MX233 and i.MX28 only. For all other platforms, if they impose a minimum data read access time in their SD card drivers, I believe this error will not occur.

[lategoodbye]

Hi,

i've hit the same problem. I'm using a custom MX28 board and Kernel 3.14-rc5. If i insert a specific 2 GB micro sd card then i get a kernel warning.

Is this mxs specific patch still available?

[fabio_estevam]

Stefan,

Please report this issue at the linux-mmc list.

Thanks,

Fabio Estevam

[OtavioSalvador]

Please try:

privatepaste.com :: Paste ID f5c4a0d1d3

[lategoodbye]

Hello Otavio,

i think your patch edit the wrong function mmc_start_request() instead of mmc_set_data_timeout(). Here is my version against Kernel 3.14-rc5 which works:

diff -uNr a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c
--- a/drivers/mmc/core/core.c    2014-03-17 02:51:24.000000000 +0100
+++ b/drivers/mmc/core/core.c    2014-03-23 19:19:15.000000000 +0100
@@ -815,6 +815,10 @@
             data->timeout_ns = limit_us * 1000;
             data->timeout_clks = 0;
         }
+
+        /* assign limit value if invalid */
+        if (data->timeout_ns == 0)
+            data->timeout_ns = limit_us * 1000;
     }

     /*

and here is the warning before i applied the patch:

[    1.674187] WARNING: CPU: 0 PID: 30 at drivers/mmc/host/mxs-mmc.c:342 mxs_mmc_start_cmd+0x34c/0x378()
[    1.683612] Modules linked in:
[    1.686908] CPU: 0 PID: 30 Comm: kworker/u2:1 Not tainted 3.14.0-rc5 #8
[    1.693579] Workqueue: kmmcd mmc_rescan
[    1.698202] [<c0015420>] (unwind_backtrace) from [<c0012cb0>] (show_stack+0x10/0x14)
[    1.706206] [<c0012cb0>] (show_stack) from [<c001daf8>] (warn_slowpath_common+0x6c/0x8c)
[    1.714366] [<c001daf8>] (warn_slowpath_common) from [<c001db34>] (warn_slowpath_null+0x1c/0x24)
[    1.723381] [<c001db34>] (warn_slowpath_null) from [<c0349478>] (mxs_mmc_start_cmd+0x34c/0x378)
[    1.732307] [<c0349478>] (mxs_mmc_start_cmd) from [<c0338fa0>] (mmc_start_request+0xc4/0xf4)
[    1.740967] [<c0338fa0>] (mmc_start_request) from [<c03390b4>] (mmc_wait_for_req+0x50/0x164)
[    1.749635] [<c03390b4>] (mmc_wait_for_req) from [<c03405b8>] (mmc_app_send_scr+0x158/0x1c8)
[    1.758299] [<c03405b8>] (mmc_app_send_scr) from [<c033ee1c>] (mmc_sd_setup_card+0x80/0x3c8)
[    1.766961] [<c033ee1c>] (mmc_sd_setup_card) from [<c033f788>] (mmc_sd_init_card+0x124/0x66c)
[    1.775708] [<c033f788>] (mmc_sd_init_card) from [<c033fd7c>] (mmc_attach_sd+0xac/0x174)
[    1.783871] [<c033fd7c>] (mmc_attach_sd) from [<c033a658>] (mmc_rescan+0x25c/0x2d8)
[    1.791745] [<c033a658>] (mmc_rescan) from [<c003597c>] (process_one_work+0x1b4/0x4ec)
[    1.799888] [<c003597c>] (process_one_work) from [<c0035de4>] (worker_thread+0x130/0x464)
[    1.808300] [<c0035de4>] (worker_thread) from [<c003c824>] (kthread+0xb4/0xd0)
[    1.815757] [<c003c824>] (kthread) from [<c000f420>] (ret_from_fork+0x14/0x34)

[fabio_estevam]

Great, Stefan

Care to submit this patch to the linux-mmc list so that it can be reviewed there?

Thanks,

Fabio Estevam

[lategoodbye]

Hello Fabio,

it's only a matter of time until i submit the patch.

BR Stefan Wahren

[OtavioSalvador]

Is it possible for you to give it a try? mxs_defconfig in 3.8 kernel should just work for you and would allow us to know if this needs to be submitted upstream or not.

[OtavioSalvador]

Hello,

Your patch works and it is even need in current mainline kernel; can you please submit it to LKML?