April 2020 - kernelnewbies@kernelnewbies.org - Kernelnewbies Mailing Lists

RE: Page Fault
by 양원혁 April 23, 2020

April 23, 2020

I'm sorry I said the wrong thing. First of all, page fault isn't blocked by cli instuction. Page fault is a type of fulat(not a interrupt) This log is printed from the page fault handler. > [ 4024.792614] #PF: supervisor write access in kernel mode > [ 4024.793944] #PF: error_code(0x0002) - not-present page > [ 4024.794920] PGD 0 P4D 0 But, the strange thing is that the address where the page fault occurred is a strange address(0x000000008004020b). This address looks similar to the value of cr0. Adding 8*59 to this cr0 value immediately results in the address where the page fault occurred. cr0 = 0x0000000080040033 cr2 = 0x000000008004020B cr2 == cr0[59] This is because the rax register was missing from the clobber field of the inline assembly.

2 1

Re: Page Fault
by Enzo Desiage April 23, 2020

April 23, 2020

Thanks for the answer! I set the clear interrupt flag from this article: http://vulnfactory.org/blog/2011/08/12/wp-safe-or-not/ As apparently if not done it could lead to a scheduling problem on SMP systems? Thanks, Enzo On Thu, Apr 23, 2020 at 2:05 AM 양원혁 <kjhg4321(a)naver.com> wrote: > According to the log, the page frame of sys_call_table is not currently > present. > > So it should be handled by page fault handler. > But. disable_write_protection blocks the interrupt via the cli > instruction. > So the page fault handler cannot be performed. > > > > > [ 4024.772066] Module loading > > [ 4024.790716] + sys_call_table address = 00000000055df43d > > [ 4024.790718] Execve syscall # 59 > > [ 4024.791116] BUG: unable to handle page fault for address: > 000000008004020b > > [ 4024.792614] #PF: supervisor write access in kernel mode > > [ 4024.793944] #PF: error_code(0x0002) - not-present page > >

1 0

RE: Page Fault
by 양원혁 April 23, 2020

April 23, 2020

According to the log, the page frame of sys_call_table is not currently present. So it should be handled by page fault handler. But. disable_write_protection blocks the interrupt via the cli instruction. So the page fault handler cannot be performed. > [ 4024.772066] Module loading > [ 4024.790716] + sys_call_table address = 00000000055df43d > [ 4024.790718] Execve syscall # 59 > [ 4024.791116] BUG: unable to handle page fault for address: 000000008004020b > [ 4024.792614] #PF: supervisor write access in kernel mode > [ 4024.793944] #PF: error_code(0x0002) - not-present page

1 0

Page Fault
by Enzo Desiage April 23, 2020

April 23, 2020

Hi, I am trying to write a proof of concept where the execve system call gets replaced by a new one, that would print a message if ls is launched. However, this is giving me a page fault everytime I try to insmod it, and I cannot figure out why. Thanks, Enzo here is the code: +++++ #include <linux/init.h> #include <linux/module.h> #include <linux/kallsyms.h> #include <asm/paravirt.h> #include <linux/dirent.h> #include <linux/fs.h> #include <linux/proc_ns.h> #include <linux/slab.h> #include <linux/version.h> #include <linux/fdtable.h> #include <linux/uaccess.h> #include <asm/unistd_64.h> MODULE_LICENSE("Dual BSD/GPL"); /* sys call table */ static void **sct = 0; static asmlinkage long (*orig_execve) (const char __user *filename, const char __user *const __user *argv, const char __user *const __user *envp); inline void disable_write_protection(void) { asm volatile("cli\n\t" "mov %%cr0,%%eax\n\t" "and $0xfffeffff,%%eax\n\t" "mov %%eax,%%cr0" :"+m"(__force_order) : :); } inline void enable_write_protection(void) { asm volatile("mov %%cr0,%%eax\n\t" "or $0x10000,%%eax\n\t" "mov %%eax,%%cr0\n\t" "sti" :"+m"(__force_order) : :); } /* Custom execve */ static asmlinkage long my_execve(const char __user *filename, const char __user *const __user *argv, const char __user *const __user *envp); { int ret; if(strstr(filename, "/bin/ls") != NULL) { printk(KERN_ALERT "Executing /bin/ls detected\n"); } ret = (*orig_execve) (filename, argv, envp); return ret; } static int sys_init(void) { printk(KERN_ALERT "Module loading\n"); sct = (void **)kallsyms_lookup_name("sys_call_table"); printk( "+ sys_call_table address = %p\n", sct ); printk("Execve syscall # %d\n", __NR_execve); // record the original getdents handler orig_execve = sct[__NR_execve]; disable_write_protection(); sct[__NR_execve] = my_execve; enable_write_protection(); return 0; } static void sys_exit(void) { disable_write_protection(); sct[__NR_execve] = orig_execve; enable_write_protection(); printk(KERN_ALERT "Goodbye, cruel world\n"); } module_init(sys_init); module_exit(sys_exit); ++++++ [ 4024.772066] Module loading [ 4024.790716] + sys_call_table address = 00000000055df43d [ 4024.790718] Execve syscall # 59 [ 4024.791116] BUG: unable to handle page fault for address: 000000008004020b [ 4024.792614] #PF: supervisor write access in kernel mode [ 4024.793944] #PF: error_code(0x0002) - not-present page [ 4024.794920] PGD 0 P4D 0 [ 4024.795411] Oops: 0002 [#1] SMP PTI [ 4024.796072] CPU: 1 PID: 3475 Comm: insmod Tainted: G OE 5.6.0-rc2+ #1 [ 4024.797378] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 4024.798977] RIP: 0010:sys_init+0x69/0x90 [mvee] [ 4024.799724] Code: 6b 60 9d c0 e8 ab 97 d3 d1 48 8b 05 99 22 00 00 48 8b 90 d8 01 00 00 48 89 15 83 22 00 00 fa 0f 20 c0 25 ff ff fe ff 0f 22 c0 <48> c7 80 d8 01 00 00 00 50 9d c0 0f 20 c0 0d 00 00 01 00 0f 22 c0 [ 4024.802782] RSP: 0018:ffffac860111fc60 EFLAGS: 00010086 [ 4024.803896] RAX: 0000000080040033 RBX: 0000000000000000 RCX: 0000000000000007 [ 4024.805017] RDX: ffffffff928e9180 RSI: 0000000000000086 RDI: ffff98c27dd19900 [ 4024.806147] RBP: ffffac860111fc60 R08: 0000000000000242 R09: 0000000000000004 [ 4024.807220] R10: ffffffff93d827e0 R11: 0000000000000001 R12: ffffffffc09d50a0 [ 4024.808285] R13: ffff98c27a8bf280 R14: ffffac860111fe68 R15: ffffffffc09d7000 [ 4024.809390] FS: 00007fec8368f540(0000) GS:ffff98c27dd00000(0000) knlGS:0000000000000000 [ 4024.810855] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080040033 [ 4024.811922] CR2: 000000008004020b CR3: 00000000336e4005 CR4: 0000000000360ee0 [ 4024.813231] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 4024.814610] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 4024.815651] Call Trace: [ 4024.816155] do_one_initcall+0x4a/0x200 [ 4024.816778] ? _cond_resched+0x19/0x40 [ 4024.817363] ? kmem_cache_alloc_trace+0x15c/0x210 [ 4024.818096] ? __vunmap+0x1bd/0x210 [ 4024.818671] do_init_module+0x5f/0x22a [ 4024.819317] load_module+0x26f8/0x2cd0 [ 4024.820077] __do_sys_finit_module+0xfc/0x120 [ 4024.820796] ? __do_sys_finit_module+0xfc/0x120 [ 4024.821538] __x64_sys_finit_module+0x1a/0x20 [ 4024.822583] do_syscall_64+0x57/0x1d0 [ 4024.823195] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 4024.823972] RIP: 0033:0x7fec831a0839 [ 4024.824552] Code: 00 f3 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 1f f6 2c 00 f7 d8 64 89 01 48 [ 4024.828363] RSP: 002b:00007ffd0cb40468 EFLAGS: 00000246 ORIG_RAX: 0000000000000139 [ 4024.829995] RAX: ffffffffffffffda RBX: 0000563be9d597a0 RCX: 00007fec831a0839 [ 4024.831531] RDX: 0000000000000000 RSI: 0000563be900cd2e RDI: 0000000000000003 [ 4024.832626] RBP: 0000563be900cd2e R08: 0000000000000000 R09: 00007fec83473000 [ 4024.833730] R10: 0000000000000003 R11: 0000000000000246 R12: 0000000000000000 [ 4024.835553] R13: 0000563be9d59770 R14: 0000000000000000 R15: 0000000000000000 [ 4024.837111] Modules linked in: mvee(OE+) kvm_intel kvm irqbypass input_leds joydev serio_raw qemu_fw_cfg mac_hid sch_fq_codel ib_iser rdma_cm iw_cm ib_cm ib_core iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi ip_tables x_tables btrfs blake2b_generic zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq raid1 raid0 multipath linear crct10dif_pclmul crc32_pclmul ghash_clmulni_intel cirrus drm_kms_helper aesni_intel glue_helper crypto_simd syscopyarea sysfillrect virtio_blk sysimgblt fb_sys_fops cec i2c_piix4 psmouse sym53c8xx pata_acpi cryptd drm virtio_net [last unloaded: mvee] [ 4024.847494] CR2: 000000008004020b [ 4024.848404] ---[ end trace 0988ed522895329e ]--- [ 4024.849514] RIP: 0010:sys_init+0x69/0x90 [mvee] [ 4024.850610] Code: 6b 60 9d c0 e8 ab 97 d3 d1 48 8b 05 99 22 00 00 48 8b 90 d8 01 00 00 48 89 15 83 22 00 00 fa 0f 20 c0 25 ff ff fe ff 0f 22 c0 <48> c7 80 d8 01 00 00 00 50 9d c0 0f 20 c0 0d 00 00 01 00 0f 22 c0 [ 4024.854386] RSP: 0018:ffffac860111fc60 EFLAGS: 00010086 [ 4024.855612] RAX: 0000000080040033 RBX: 0000000000000000 RCX: 0000000000000007 [ 4024.857080] RDX: ffffffff928e9180 RSI: 0000000000000086 RDI: ffff98c27dd19900 [ 4024.858549] RBP: ffffac860111fc60 R08: 0000000000000242 R09: 0000000000000004 [ 4024.860335] R10: ffffffff93d827e0 R11: 0000000000000001 R12: ffffffffc09d50a0 [ 4024.862180] R13: ffff98c27a8bf280 R14: ffffac860111fe68 R15: ffffffffc09d7000 [ 4024.863667] FS: 00007fec8368f540(0000) GS:ffff98c27dd00000(0000) knlGS:0000000000000000 [ 4024.865500] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080040033 [ 4024.866775] CR2: 000000008004020b CR3: 00000000336e4005 CR4: 0000000000360ee0 [ 4024.868352] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 4024.869850] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

1 0

Email being rejected by vger.kernel.org
by Bijan Tabatabai April 22, 2020

April 22, 2020

Hello, I tried to send a patch to the linux-trace-devel mailing list using git-send-email, and the email got bounced back to me with the message > 553: 5.7.1 Hello [98.137.68.147], for your MAIL FROM address <bijan311(a)yahoo.com> policy analysis reported: Your address is not liked source for email After some googling, it seems like the problem is my email address has been banned from sending emails to the mailing list. I can't imagine I've been banned specifically because that was my first time sending an email to a kernel list. Is the problem due to the mail server banning yahoo email addresses in general? If so, would switching to gmail or my university email solve the problem? As an additional etiquette question: I also CC'd the maintainer in the patch, and I believe the email got through to him. When I get this problem resolved, should I CC him again when I resend the patch, or just send the patch to the mailing list? Thank you. Bijan

3 2

local_irq_enable in restart handler
by Tomek The Messenger April 22, 2020

April 22, 2020

Hi The background: Interrupts are disabled just before stopping other cores during handling restart: See example from: /arch/arm/kernel/reboot.c: /* * Restart requires that the secondary CPUs stop performing any activity * while the primary CPU resets the system. */ void machine_restart(char *cmd) { local_irq_disable(); smp_send_stop(); do_kernel_restart(cmd); /* Give a grace period for failure to restart of 1s */ mdelay(1000); /* Whoops - the platform was unable to reboot. Tell the user! */ printk("Reboot failed -- System halted\n"); while (1); } where function do_kernel_restart() invoke restart handlers: void do_kernel_restart(char *cmd) { atomic_notifier_call_chain(&restart_handler_list, reboot_mode, cmd); } One and the only one! restart handler is mine where I do i2c transaction in order to reset the board. i2c transaction requires interrupts to be enabled. Can I safely do: local_irq_enable on my handler entry and local_irq_disable just before exit? In the meantime I will do i2c_smbus transaction and add some 500ms delay before disable back irq just to make sure transaction is succeed. I know that it is strange question, but in company in which I work I received subtask to get to know. The other alternative is to get response by execute test with for example loop of 10 thousands of restarts.

1 0

Was there a way to bind a shared memory object onto a fixed physical memory address?
by kipade April 20, 2020

April 20, 2020

As the topic, I want to specify a fixed physical memory space to a shared memory object, which can use shm_XXX api to access the memory. Of course I do not want to use mmap api to map /dev/mem device memory into user program. Thanks all.

3 3

Trouble with allocating memory on platform driver
by s.achterop＠rug.nl April 17, 2020

April 17, 2020

Hello list, Trying to create a device driver for a raspberry pi zero (BCM2835) to control a gpio and an spi device. This eventually will be done in a FIQ interrupt handler. A simplified version of this batradio-driver can be found at: https://github.com/SietseAchterop/Batradio/blob/master/batradio_module/allo… The problem is that modprobe-ing this driver directly yields the following in dmesg. Apr 4 16:50:23 raspberrypi kernel: [ 139.636850] batradio: loading out-of-tree module taints kernel. Apr 4 16:50:23 raspberrypi kernel: [ 139.653580] ------------[ cut here ]------------ Apr 4 16:50:23 raspberrypi kernel: [ 139.653650] WARNING: CPU: 0 PID: 1208 at include/linux/dma-mapping.h:516 init_module+0x164/0x1e0 [batradio] Apr 4 16:50:23 raspberrypi kernel: [ 139.653664] Modules linked in: batradio(O+) fuse rfcomm cmac bnep hci_uart btbcm serdev bluetooth ecdh_generic 8021q garp stp llc sg uas brcmfmac brcmutil sha256_generic cfg80211 rfkill snd_bcm2835(C) raspberrypi_hwmon snd_pcm hwmon snd_timer snd bcm2835_v4l2(C) bcm2835_codec(C) v4l2_mem2mem bcm2835_mmal_vchiq(C) v4l2_common videobuf2_vmalloc videobuf2_dma_contig videobuf2_memops videobuf2_v4l2 videobuf2_common videodev media vc_sm_cma(C) fixed uio_pdrv_genirq uio i2c_dev ip_tables x_tables ipv6 Apr 4 16:50:23 raspberrypi kernel: [ 139.653835] CPU: 0 PID: 1208 Comm: modprobe Tainted: G C O 4.19.108+ #1 Apr 4 16:50:23 raspberrypi kernel: [ 139.653844] Hardware name: BCM2835 Apr 4 16:50:23 raspberrypi kernel: [ 139.653897] [<c00184f8>] (unwind_backtrace) from [<c0015064>] (show_stack+0x20/0x24) Apr 4 16:50:23 raspberrypi kernel: [ 139.653931] [<c0015064>] (show_stack) from [<c0753394>] (dump_stack+0x20/0x28) Apr 4 16:50:23 raspberrypi kernel: [ 139.653970] [<c0753394>] (dump_stack) from [<c0025b58>] (__warn.part.3+0xb8/0xe0) Apr 4 16:50:23 raspberrypi kernel: [ 139.653998] [<c0025b58>] (__warn.part.3) from [<c0025cf8>] (warn_slowpath_null+0x50/0x5c) Apr 4 16:50:23 raspberrypi kernel: [ 139.654037] [<c0025cf8>] (warn_slowpath_null) from [<bf698164>] (init_module+0x164/0x1e0 [batradio]) Apr 4 16:50:23 raspberrypi kernel: [ 139.654110] [<bf698164>] (init_module [batradio]) from [<c000ae8c>] (do_one_initcall+0x4c/0x234) Apr 4 16:50:23 raspberrypi kernel: [ 139.654151] [<c000ae8c>] (do_one_initcall) from [<c00a7898>] (do_init_module+0x6c/0x1f8) Apr 4 16:50:23 raspberrypi kernel: [ 139.654181] [<c00a7898>] (do_init_module) from [<c00a9cdc>] (load_module+0x21ec/0x24cc) Apr 4 16:50:23 raspberrypi kernel: [ 139.654209] [<c00a9cdc>] (load_module) from [<c00aa1f8>] (sys_finit_module+0xcc/0xec) Apr 4 16:50:23 raspberrypi kernel: [ 139.654232] [<c00aa1f8>] (sys_finit_module) from [<c0009000>] (ret_fast_syscall+0x0/0x28) Apr 4 16:50:23 raspberrypi kernel: [ 139.654244] Exception stack(0xcc037fa8 to 0xcc037ff0) Apr 4 16:50:23 raspberrypi kernel: [ 139.654261] 7fa0: 93da3c00 00401760 00000003 0002d064 00000000 0002ec3c Apr 4 16:50:23 raspberrypi kernel: [ 139.654279] 7fc0: 93da3c00 00401760 00000000 0000017b 00402f10 00000000 00402e68 00000000 Apr 4 16:50:23 raspberrypi kernel: [ 139.654294] 7fe0: bed56338 bed56328 00022cb8 b6c26af0 Apr 4 16:50:23 raspberrypi kernel: [ 139.654307] ---[ end trace deb280ac68ce7734 ]--- Apr 4 16:50:23 raspberrypi kernel: [ 139.654330] platform batradio__.0: coherent DMA mask is unset Apr 4 16:50:23 raspberrypi kernel: [ 139.654344] platform batradio__.0: Couldn't allocate memory! The crash is at the very beginning of the init function of the module, here is the first part of that function: pdev = platform_device_register_simple("batradio__", 0, NULL, 0); if (IS_ERR(pdev)) return PTR_ERR(pdev); batradio_data = devm_kzalloc(&pdev->dev, sizeof(*batradio_data), GFP_KERNEL); if (!batradio_data) return -ENOMEM; batradio_data->fiq_base = dma_zalloc_coherent(&pdev->dev, FIQ_BUFFER_SIZE, &batradio_data->dma_handle, GFP_KERNEL); if (!batradio_data->fiq_base) { dev_err(&pdev->dev, "Couldn't allocate memory!\n"); return -ENOMEM; } Note that the crash seems to occur because of the call to dma_zalloc_coherent. The allocation does not work, FIQ_BUFFER_SIZE is 256*1024. and this is directly after reboot. Also note that I start the rpizero only with the console, so no X. And login with ssh. Why is this happening? What does "coherent DMA mask is unset" means. I do not intend to use dma, but I understood that allocating in this way is what I should do if I want to use this data also from my FIQ handler. Does it has to do with the use of platform_device_register_simple? Maybe the device structure isn't initialized properly for this? I actually use this function because I don't know which compatible value I have to use when using the devicetree, everything I tried failed. I also read the following in platform_device.h about platform_device_register_simple: In particular, when such drivers are built as modules, they can't be "hotplugged". Is this relevant. is using modprobe meant by this? Thanks in advance, Sietse

2 3

Fixes tag confusion
by Nicholas Mc Guire April 14, 2020

April 14, 2020

Hi ! Looking at some of the fixes tags in linux-stable e.g. commit 27d231c0c63b -> :pnfs_alloc_ds_commits_list:fs/nfs/pnfs_nfs.c Fixes: a9901899b649 inspecting the history of this function shows linux-stable$ git log -L:pnfs_alloc_ds_commits_list:fs/nfs/pnfs_nfs.c | grep "^commit " commit 27d231c0c63bb619997a24bab85d54d90ca71110 commit a9901899b649dc80ef75c14d6d78059cae14def7 commit 0cb1f6df8a63b51f276f94d94957d7a7ca757667 commit f54bcf2ecee982da47c2baf8bd87fd9ad9984651 or: commit 9b8b17541f13 Fixes: e26733e0d0ec gives me: linux-stable$ git log -L:calculate_high_delay:mm/memcontrol.c | grep "^commit " commit 9b8b17541f13809d06f6f873325305ddbb760e3e commit e26733e0d0ec6798eca93daa300bc3f43616127f commit d397a45fc741c80c32a14e2de008441e9976f50c commit 0e4b01df865935007bd712cbc8e7299005b28894 commit f7e1cb6ec51b041335b5ad4dd7aefb37a56d79a6 commit b23afb93d317c65cef553b804f08dec8a7a0f7e1 the initial bug introducing commit and the fix commit are visible But then there are other cases like: commit 26c5d78c976c which fixed up get_fs_type in fs/filesystems.c Fixes: 41124db869b7 commit 26c5d78c976c <snip> - WARN_ONCE(!fs, "request_module fs-%.*s succeeded, but still no fs?\n", len, name); + if (!fs) + pr_warn_once("request_module fs-%.*s succeeded, but still no fs?\n", + len, name); <snip> Fixes: 41124db869b7 <snip> - if (!fs && (request_module("fs-%.*s", len, name) == 0)) + if (!fs && (request_module("fs-%.*s", len, name) == 0)) { fs = __get_fs_type(name, len); + WARN_ONCE(!fs, "request_module fs-%.*s succeeded, but still no fs?\n", len, name); + } <snip> which seem to be correct - but git log does not display them ? linux-stable$ git log -L:get_fs_type:fs/filesystems.c | grep "^commit " commit d8e9650dff48055057253ca30933605bd7d0733b commit 79c0b2df79eb56fc71e54c75cd7fb3acf84370f9 commit 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 I see neither of the fix nor the fixed commit ? This is on a Debian 10.3 with git version 2.20.1 It does not seem to be a rename issue - so I'm a bit lost on this one Is this a wrong expectation on my side - or am I using git in some wrong way here ? thx! hofrat

2 2

How to use enable the FIQ with the ARM timer on rpi zero in my driver?
by s.achterop＠rug.nl April 13, 2020

April 13, 2020

Hello List, I am on a raspberry pi zero, chipset BCM2835, and try to use the ARM timer to get FIQ interrupts. I compiled the kernel from source to be able to create my out-of-tree module. Uname -a gives: Linux raspberrypi 4.19.108+ #1 PREEMPT Tue Mar 31 10:00:18 CEST 2020 armv6l GNU/Linux (i only set it to be a low-latency-kernel) I try to create an fiq interrupt in a number of ways, but nothing works. The driver I created can be found at https://github.com/SietseAchterop/Batradio/blob/master/batradio_module/fiqt… The ARM timer is configured by directly writing to the registers. It is running fine and sets it's interrupt bit at some point. So I assume that linux does not use the ARM timer in a base configuration. When using: ret = claim_fiq(&bat_fh); set_fiq_handler(&batradio_handler, &batradio_handler_end - &batradio_handler); set_fiq_regs(&regs); enable_fiq(x); There are no fiq interrupts, i tried several values of x. My main question is, which irq number should I use. Note that I use pdev = platform_device_register_simple("batradio__", 0, NULL, 0); to register this platform device. I did find a complete example in https://bootlin.com/blog/fiq-handlers-in-the-arm-linux-kernel/ But there they used a device tree and got the fiq-irq number via the probe function argument. Maybe that is a way to get it working, but I don't know with compatible value to use. I also tried, instead of enable_fiq, to directly connect the ARM timer to FIQ by writing 0xC0, 0x80 + 0x40, to the FIQ Control register 0x20C. But then Linux freezes immediately, so that's probably the wrong way. What could I do to get FIQ interrupts working? Or where can I find which irq number to use in enable_fiq? Hopefully someone can point me in a direction. Thanks in advance, Sietse PS. I forced dwc_otg to not use fiq by adding the following to /boot/cmdline.txt dwc_otg.fiq_fsm_enable=0 dwc_otg.fiq_enable=0 dwc_otg.nak_holdoff=0 I also make it boot up with console, so no X stuff, and access via ssh.

1 1