Kernel Crash Around Device Tree Access

Hi,

I use 2.6.28 kernel for a board using processor MPC866T. The kernel
startup occationally (1 out of 5 times) crashes at various init of
device drivers. Sometimes, it happens on the init of cpm_uart driver,
sometimes on other drivers. It always happens at of access of device
tree like "of_find_node_by_name", "of_get_property", etc. A bad pointer
to property name crashes the kernel. It appears the device tree got
corrupted when it happens. I am having difficulty identifying the
problem. Any insight will be helpful.

Note, once the kernel starts, it works fine. I tried to pull in fixes
from 2.6.30 around prom and of area, and they don't help.

Following is a dump showing the problem:

Filename 'eclipse/cuImage.eclipse_idu_8xx'.
Load address: 0x200000
Loading:
#################################################################
 
#################################################################
 
#################################################################
 
#################################################################
         ############
done
Bytes transferred = 1389443 (153383 hex)
## Booting image at 00200000 ...
   Image Name:   Linux-2.6.28-00015-g324a40e-dirt
   Image Type:   PowerPC Linux Kernel Image (gzip compressed)
   Data Size:    1389379 Bytes =  1.3 MB
   Load Address: 00400000
   Entry Point:  00400598
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK
Using Eclipse IDU 8xx machine description
Linux version 2.6.28-00015-g324a40e-dirty (lyao01@lyao01-desktop) (gcc
version 4
.2.2) #12 Wed Jun 10 17:59:17 EDT 2009
Zone PFN ranges:
  DMA      0x00000000 -> 0x00004000
  Normal   0x00004000 -> 0x00004000
Movable zone start PFN for each node
early_node_map[1] active PFN ranges
    0: 0x00000000 -> 0x00004000
Built 1 zonelists in Zone order, mobility grouping on.  Total pages:
16256
Kernel command line: console=ttyCPM0,38400 root=/dev/nfs rw
nfsroot=10.15.34.196
:/home/lyao01/work/target_idu_xxx_2.6
ip=172.20.16.151:10.15.34.196:172.20.16.1:
255.255.255.0:nccv2:eth0:off eclipse=nccv2 RSR=0xc0
PID hash table entries: 256 (order: 8, 1024 bytes)
Decrementer Frequency = 0x5f5e10
clocksource: timebase mult[28000000] shift[22] registered
STXN: drivers/serial/cpm_uart/cpm_uart_core.c, cpm_uart_console_init
START
console [ttyCPM0] enabled
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Memory: 61892k/65536k available (2688k kernel code, 3576k reserved, 96k
data, 11
2k bss, 116k init)
SLUB: Genslabs=11, HWalign=16, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
Calibrating delay loop... 11.93 BogoMIPS (lpj=5968)
Mount-cache hash table entries: 512
net_namespace: 288 bytes
NET: Registered protocol family 16
Unable to handle kernel paging request for data at address 0x08000604
Faulting instruction address: 0xc0129ab0
Oops: Kernel access of bad area, sig: 11 [#1]
Eclipse IDU 8xx
Modules linked in:
NIP: c0129ab0 LR: c018c6b4 CTR: c0287648
REGS: c3817d50 TRAP: 0300   Not tainted  (2.6.28-00015-g324a40e-dirty)
MSR: 00009032 <EE,ME,IR,DR>  CR: 22004044  XER: 0000005f
DAR: 08000604, DSISR: c0000000
TASK = c3818000[1] 'swapper' THREAD: c3816000
GPR00: 08000604 c3817e00 c3818000 08000604 c024cfbc c3800648 00000002
c02e2780
GPR08: 00000000 c02b0000 c02b003c 08000604 84004048 02000000 03ffb200
03ffaf20
GPR16: 00000000 ffffffff 03fb2b80 00000001 03fff814 007ffeb0 007fff00
00800000
GPR24: 00000ef9 00000000 00000000 c024cfbc c02bf324 00000000 c024cfbc
c3ffeb10
NIP [c0129ab0] strcasecmp+0xc/0x64
LR [c018c6b4] of_find_node_by_name+0x40/0x98
Call Trace:
[c3817e00] [0000005f] 0x5f (unreliable)
[c3817e20] [c02876a4] of_add_fixed_phys+0x5c/0x118
[c3817e60] [c00021ec] do_one_initcall+0x38/0x1a4
[c3817fd0] [c0283168] kernel_init+0x88/0xf4
[c3817ff0] [c000da9c] kernel_thread+0x4c/0x68
Instruction dump:
4200ffa8 7c635850 4e800020 7c635850 4e800020 7c6300d0 4e800020 7d635b78
4e800020 3d20c02b 7c6b1b78 3949003c <880b0000> 396b0001 7c030378
7d2a18ae
---[ end trace 31fd0ba7d8756001 ]---
Kernel panic - not syncing: Attempted to kill init!



Thanks.

Lixin Yao
Harris Stratex Networks Inc.
RTP, NC, USA