something is wrong with console_bh: matroxfb debugging driver

Petr Vandrovec Ing. VTEI (VANDROVE@vc.cvut.cz)
Tue, 8 Jun 1999 18:07:02 MET-1


Hi,
I added some reentrancy checks to matroxfb and guess what:

Reentering #0 (ksymoops)
CPU: 0
EIP: 0010:[printstate+9/48]
EFLAGS: 00000202
eax: 00000001 ebx: c025cdc0 ecx: 00000007 edx: 00000010
esi: 000000d0 edi: c000e000 ebp: 00000000 esp: c6fe3c1c
ds: 0018 es: 0018 ss: 0018
Process t2 (pid: 290, process nr: 55, stackpage=c6fe3000)
Stack: c01c44d1 c01c5521 c025cdc0 00aaaaaa c7fe8000 c000e000 00002c74 000000d0
c019d600 00000080 c01c5ac3 00aaaaaa 00000000 c025cdc0 c7fe8000 00000007
0000000d 00000000 00000007 c7fe800e c025cdc0 c000e8b4 c01b4d37 c0424c78
Call Trace: [guard_start+33/48] [matrox_cfbX_fastputcs+65/400]
[sd_devname+32/96] [matrox_cfb32_putcs+99/112]
[fbcon_redraw_softback+503/720] [fbcon_scrolldelta+355/704]
[do_edge_ioapic_IRQ+113/160] [console_bh+246/272]
[do_bottom_half+153/192] [do_IRQ+82/96] [ret_from_intr+0/32]
[ipx:ipx_remove_socket+-17035744/6416]
[matrox_cfbX_fastputcs+363/400]
[ipx:ipx_remove_socket+-17035744/6416]
[matrox_cfb32_putcs+99/112]
[fbcon_redraw_softback+503/720] [fbcon_scrolldelta+355/704]
[fbcon_set_origin+29/48] [fbcon_cursor+101/496]
[set_cursor+110/128] [con_flush_chars+18/32]
[opost_block+378/416] [write_chan+604/880]
[tty_write+550/752] [write_chan+0/880]
[sys_write+313/432] [tty_write+0/752] [system_call+52/64]
vana kernel: Code: 50 1e 06 50 55 57 56 52 51 53 89 e0 50 e8 65 fd ff ff 83 c4

Reentering #1 (binary)
CPU: 0
EIP: 0010:[<c010a739>]
EFLAGS: 00000202
eax: 00000001 ebx: 00000001 ecx: 00000008 edx: 0000007f
esi: 00000000 edi: 00000010 ebp: 00000010 esp: c3fabbec
ds: 0018 es: 0018 ss: 0018
Process t2 (pid: 381, process nr: 54, stackpage=c3fab000)
Stack: c01c44d1 c01c5739 c025cdc0 00aaaaaa c7fe8000 c000c000 00000010 00000040
00000008 c000c000 00000001 c903ac46 0000007f 00000010 00400010 00000001
c01c5ac3 00aaaaaa 00000000 c025cdc0 c7fe8000 00000007 00000004 00000000
Call Trace: [<c01c44d1>] [<c01c5739>] [<c01c5ac3>] [<c01b4d37>] [<c01b7493>]
[<c0111741>] [<c0184366>] [<c011d069>] [<c010c932>] [<c010a2d0>]
[<c0100018>] [<c01c5927>] [<c01c5ac3>] [<c01b4ce2>] [<c01b7493>]
[<c01b760d>] [<c01b4925>] [<c018108e>] [<c0184992>] [<c018aa6a>]
[<c018108e>] [<c018cdfc>] [<c0188216>] [<c018cba0>] [<c012b309>]
[<c0187ff0>] [<c010a214>]
Code: 50 1e 06 50 55 57 56 52 51 53 89 e0 50 e8 65 fd ff ff 83 c4

Reentering #1 (ksymoops)
CPU: 0
EIP: 0010:[printstate+9/48]
EFLAGS: 00000202
eax: 00000001 ebx: 00000001 ecx: 00000008 edx: 0000007f
esi: 00000000 edi: 00000010 ebp: 00000010 esp: c3fabbec
ds: 0018 es: 0018 ss: 0018
Process t2 (pid: 381, process nr: 54, stackpage=c3fab000)
Stack: c01c44d1 c01c5739 c025cdc0 00aaaaaa c7fe8000 c000c000 00000010 00000040
00000008 c000c000 00000001 c903ac46 0000007f 00000010 00400010 00000001
c01c5ac3 00aaaaaa 00000000 c025cdc0 c7fe8000 00000007 00000004 00000000
Call Trace: [guard_start+33/48] [matrox_cfbX_putcs+201/720]
[matrox_cfb32_putcs+99/112] [fbcon_redraw_softback+503/720]
[fbcon_scrolldelta+355/704] [do_edge_ioapic_IRQ+113/160]
[console_bh+246/272] [do_bottom_half+153/192] [do_IRQ+82/96]
[ret_from_intr+0/32] [startup_32+24/164] [matrox_cfbX_putcs+695/720]
[matrox_cfb32_putcs+99/112] [fbcon_redraw_softback+418/720]
[fbcon_scrolldelta+355/704] [fbcon_set_origin+29/48]
[fbcon_cursor+101/496] [set_cursor+110/128] [con_flush_chars+18/32]
[opost_block+378/416] [set_cursor+110/128] [write_chan+604/880]
[tty_write+550/752] [write_chan+0/880] [sys_write+313/432]
[tty_write+0/752] [system_call+52/64]
Code: 50 1e 06 50 55 57 56 52 51 53 89 e0 50 e8 65 fd ff ff 83 c4

'printstate' is new function, which prints register values and stack
trace (I did not find any in kernel sources...) and continues in code path.
'guard_start' is

--
atomic_t guard_counter = ATOMIC_INIT(1);
atomic_t guard_printing = ATOMIC_INIT(1);
void guard_start(void) {
  if (atomic_dec_and_test(&guard_counter)) return;
  if (!atomic_dec_and_test(&guard_printing)) return;
  printstate();
  atomic_inc(&guard_printing);
}
void guard_end(void) {
  atomic_inc(&guard_counter);
}
--
and I added calls to these functions around hardware accesses...

I do not know, why there is 'do_edge_ioapic_IRQ' below 'console_bh' in calltrace - probably someone (scrolldelta) simply pushed some registers to stack... But it is clear to me that my putcs was reentered :-( Ideas?

Oopses above was generated on patched matroxfb - if you are interested, patch for 2.3.5 is available at ftp://platan.vc.cvut.cz/pub/linux/matrox-latest/matrox-2.3.5-debug.gz 't2' is my ncurses teletext grabbing application based on AleVT (sources/binary available on request, but it is not nice reading). Machine has i386 SMP kernel, SMP (io-apic) board, but only one CPU PII/350 is plugged into. Thanks, Petr Vandrovec vandrove@vc.cvut.cz

P.S.: If you are going to test it, boot with video=matrox:fastfont:40000, otherwise you have to redirect kernel oopses from screen to somewhere else (preferrably serial line), because of your kernel dies when reentering happens due to printk() (you have 90% chance without fastfont, about 3% with fastfont due to principle of their work).

- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.tux.org/lkml/