2007-10-23 16:11:49

by John Sigler

[permalink] [raw]
Subject: How to debug complete kernel lock-ups

Hello everyone,

I have an x86 system with two PCI slots, in which I inserted two
specialized output cards (Dektec DTA-105).

http://www.dektec.com/Products/DTA-105/
(They provide an open source driver.)

My problem is: when I write to the 4 ports (each card has 2 ports) "at
the same time" (not really "at the same time" because I have a
uni-processor system, so "within a short time frame" is more accurate)
the system *completely* locks up.

The manufacturer told me they had seen the problem in their lab. I'm
just trying to provide some helpful debug output to speed up the process
of fixing the problem :-)

I've built a debug 2.6.22.1-rt9 kernel, hoping to get the kernel to dump
something, anything.

+CONFIG_KALLSYMS_ALL=y
+CONFIG_PCI_DEBUG=y
+CONFIG_DEBUG_DRIVER=y
+CONFIG_PRINTK_TIME=y
+CONFIG_MAGIC_SYSRQ=y
+CONFIG_DEBUG_KERNEL=y
+CONFIG_DEBUG_SHIRQ=y
+CONFIG_DETECT_SOFTLOCKUP=y
+CONFIG_DEBUG_SLAB=y
+CONFIG_DEBUG_SLAB_LEAK=y
+CONFIG_DEBUG_PREEMPT=y
+CONFIG_DEBUG_RT_MUTEXES=y
+CONFIG_DEBUG_PI_LIST=y
+CONFIG_RT_MUTEX_TESTER=y
+CONFIG_DEBUG_SPINLOCK=y
+CONFIG_DEBUG_MUTEXES=y
+CONFIG_DEBUG_LOCK_ALLOC=y
+CONFIG_PROVE_LOCKING=y
+CONFIG_LOCKDEP=y
+CONFIG_TRACE_IRQFLAGS=y
+CONFIG_DEBUG_SPINLOCK_SLEEP=y
+CONFIG_DEBUG_LOCKING_API_SELFTESTS=y
+CONFIG_STACKTRACE=y
+CONFIG_PREEMPT_TRACE=y
+CONFIG_DEBUG_BUGVERBOSE=y
+CONFIG_DEBUG_INFO=y
+CONFIG_FRAME_POINTER=y
+CONFIG_FORCED_INLINING=y
+CONFIG_DEBUG_STACKOVERFLOW=y
+CONFIG_DEBUG_RODATA=y
+CONFIG_4KSTACKS=y

I've enabled the serial console, and used SysRq to bump the console
level to 9 (I want everything, even KERN_DEBUG output).

I've enabled the IO-APIC watchdog (nmi_watchdog=1).

Once the system locks up, I get no output, no panic, no oops.
The serial console is frozen, my ssh sessions are frozen.

Suppose the PCI bus "crashes" (whatever that means) or locks up.
Would that make the system completely unresponsive? The I/O does have to
get to/from the south bridge, through the PCI bus AFAIU. I can imagine
that a locked PCI bus would be slightly problematic.

Does this mean I need some kind of PCI bus analyzer (i.e. hardware) at
this point? Is there anything more I can try?

Regards.


2007-10-24 09:17:51

by John Sigler

[permalink] [raw]
Subject: Re: How to debug complete kernel lock-ups

John Sigler wrote:

> I have an x86 system with two PCI slots, in which I inserted two
> specialized output cards (Dektec DTA-105).
>
> http://www.dektec.com/Products/DTA-105/
> (They provide an open source driver.)
>
> My problem is: when I write to the 4 ports (each card has 2 ports) "at
> the same time" (not really "at the same time" because I have a
> uni-processor system, so "within a short time frame" is more accurate)
> the system *completely* locks up.
>
> The manufacturer told me they had seen the problem in their lab. I'm
> just trying to provide some helpful debug output to speed up the process
> of fixing the problem :-)
>
> I've built a debug 2.6.22.1-rt9 kernel, hoping to get the kernel to dump
> something, anything.
>
> +CONFIG_KALLSYMS_ALL=y
> +CONFIG_PCI_DEBUG=y
> +CONFIG_DEBUG_DRIVER=y
> +CONFIG_PRINTK_TIME=y
> +CONFIG_MAGIC_SYSRQ=y
> +CONFIG_DEBUG_KERNEL=y
> +CONFIG_DEBUG_SHIRQ=y
> +CONFIG_DETECT_SOFTLOCKUP=y
> +CONFIG_DEBUG_SLAB=y
> +CONFIG_DEBUG_SLAB_LEAK=y
> +CONFIG_DEBUG_PREEMPT=y
> +CONFIG_DEBUG_RT_MUTEXES=y
> +CONFIG_DEBUG_PI_LIST=y
> +CONFIG_RT_MUTEX_TESTER=y
> +CONFIG_DEBUG_SPINLOCK=y
> +CONFIG_DEBUG_MUTEXES=y
> +CONFIG_DEBUG_LOCK_ALLOC=y
> +CONFIG_PROVE_LOCKING=y
> +CONFIG_LOCKDEP=y
> +CONFIG_TRACE_IRQFLAGS=y
> +CONFIG_DEBUG_SPINLOCK_SLEEP=y
> +CONFIG_DEBUG_LOCKING_API_SELFTESTS=y
> +CONFIG_STACKTRACE=y
> +CONFIG_PREEMPT_TRACE=y
> +CONFIG_DEBUG_BUGVERBOSE=y
> +CONFIG_DEBUG_INFO=y
> +CONFIG_FRAME_POINTER=y
> +CONFIG_FORCED_INLINING=y
> +CONFIG_DEBUG_STACKOVERFLOW=y
> +CONFIG_DEBUG_RODATA=y
> +CONFIG_4KSTACKS=y
>
> I've enabled the serial console, and used SysRq to bump the console
> level to 9 (I want everything, even KERN_DEBUG output).
>
> I've enabled the IO-APIC watchdog (nmi_watchdog=1).
>
> Once the system locks up, I get no output, no panic, no oops.
> The serial console is frozen, my ssh sessions are frozen.
>
> Suppose the PCI bus "crashes" (whatever that means) or locks up.
> Would that make the system completely unresponsive? The I/O does have to
> get to/from the south bridge, through the PCI bus AFAIU. I can imagine
> that a locked PCI bus would be slightly problematic.
>
> Does this mean I need some kind of PCI bus analyzer (i.e. hardware) at
> this point? Is there anything more I can try?

I've tested with a vanilla 2.6.22.10 kernel (no PREEMPT_RT patch).
That system also locks up and remains completely unresponsive (I can't
open new ssh sessions, the system won't answer ICMP echo requests).

How do driver writers deal with complete kernel hangs?

Regards.

2007-10-24 15:56:55

by Greg KH

[permalink] [raw]
Subject: Re: How to debug complete kernel lock-ups

On Wed, Oct 24, 2007 at 11:17:40AM +0200, John Sigler wrote:
> John Sigler wrote:
>
>> I have an x86 system with two PCI slots, in which I inserted two
>> specialized output cards (Dektec DTA-105).
>> http://www.dektec.com/Products/DTA-105/
>> (They provide an open source driver.)
>> My problem is: when I write to the 4 ports (each card has 2 ports) "at the
>> same time" (not really "at the same time" because I have a uni-processor
>> system, so "within a short time frame" is more accurate) the system
>> *completely* locks up.
>> The manufacturer told me they had seen the problem in their lab. I'm just
>> trying to provide some helpful debug output to speed up the process of
>> fixing the problem :-)
>> I've built a debug 2.6.22.1-rt9 kernel, hoping to get the kernel to dump
>> something, anything.
>> +CONFIG_KALLSYMS_ALL=y
>> +CONFIG_PCI_DEBUG=y
>> +CONFIG_DEBUG_DRIVER=y
>> +CONFIG_PRINTK_TIME=y
>> +CONFIG_MAGIC_SYSRQ=y
>> +CONFIG_DEBUG_KERNEL=y
>> +CONFIG_DEBUG_SHIRQ=y
>> +CONFIG_DETECT_SOFTLOCKUP=y
>> +CONFIG_DEBUG_SLAB=y
>> +CONFIG_DEBUG_SLAB_LEAK=y
>> +CONFIG_DEBUG_PREEMPT=y
>> +CONFIG_DEBUG_RT_MUTEXES=y
>> +CONFIG_DEBUG_PI_LIST=y
>> +CONFIG_RT_MUTEX_TESTER=y
>> +CONFIG_DEBUG_SPINLOCK=y
>> +CONFIG_DEBUG_MUTEXES=y
>> +CONFIG_DEBUG_LOCK_ALLOC=y
>> +CONFIG_PROVE_LOCKING=y
>> +CONFIG_LOCKDEP=y
>> +CONFIG_TRACE_IRQFLAGS=y
>> +CONFIG_DEBUG_SPINLOCK_SLEEP=y
>> +CONFIG_DEBUG_LOCKING_API_SELFTESTS=y
>> +CONFIG_STACKTRACE=y
>> +CONFIG_PREEMPT_TRACE=y
>> +CONFIG_DEBUG_BUGVERBOSE=y
>> +CONFIG_DEBUG_INFO=y
>> +CONFIG_FRAME_POINTER=y
>> +CONFIG_FORCED_INLINING=y
>> +CONFIG_DEBUG_STACKOVERFLOW=y
>> +CONFIG_DEBUG_RODATA=y
>> +CONFIG_4KSTACKS=y
>> I've enabled the serial console, and used SysRq to bump the console level
>> to 9 (I want everything, even KERN_DEBUG output).
>> I've enabled the IO-APIC watchdog (nmi_watchdog=1).
>> Once the system locks up, I get no output, no panic, no oops.
>> The serial console is frozen, my ssh sessions are frozen.
>> Suppose the PCI bus "crashes" (whatever that means) or locks up.
>> Would that make the system completely unresponsive? The I/O does have to
>> get to/from the south bridge, through the PCI bus AFAIU. I can imagine
>> that a locked PCI bus would be slightly problematic.
>> Does this mean I need some kind of PCI bus analyzer (i.e. hardware) at
>> this point? Is there anything more I can try?
>
> I've tested with a vanilla 2.6.22.10 kernel (no PREEMPT_RT patch).
> That system also locks up and remains completely unresponsive (I can't open
> new ssh sessions, the system won't answer ICMP echo requests).
>
> How do driver writers deal with complete kernel hangs?

We slowly go crazy :)

Seriously, try to add debugging messages for where you think things
might be dying and slowly start working from there. It's not a quick
thing to do at times...

Oh, try using kdb, that sometimes will work for people, depending on
your hardware and problem.

good luck,

greg k-h

2007-10-24 16:19:33

by Ray Lee

[permalink] [raw]
Subject: Re: How to debug complete kernel lock-ups

On 10/24/07, John Sigler <[email protected]> wrote:
> > I have an x86 system with two PCI slots, in which I inserted two
> > specialized output cards (Dektec DTA-105).
> >
> > http://www.dektec.com/Products/DTA-105/
> > (They provide an open source driver.)
> >
> > My problem is: when I write to the 4 ports (each card has 2 ports) "at
> > the same time" (not really "at the same time" because I have a
> > uni-processor system, so "within a short time frame" is more accurate)
> > the system *completely* locks up.
> >
> > The manufacturer told me they had seen the problem in their lab. I'm
> > just trying to provide some helpful debug output to speed up the process
> > of fixing the problem :-)
[...]
> > Suppose the PCI bus "crashes" (whatever that means) or locks up.
> > Would that make the system completely unresponsive? The I/O does have to
> > get to/from the south bridge, through the PCI bus AFAIU. I can imagine
> > that a locked PCI bus would be slightly problematic.
> >
> > Does this mean I need some kind of PCI bus analyzer (i.e. hardware) at
> > this point? Is there anything more I can try?

You need visibility into the actual place where the issue is
happening, and by your description it's the two cards fighting each
other on the PCI bus. (I'm assuming that the problem doesn't occur
when there's only one card.)

I've worked on a platform where only a few things went through the PCI
bus, and via the firmware's debugger (completely outside the kernel),
I was able to do the setup of the PCI chip and mappings, and then
pound on the hardware directly to exhibit a lockup of the bus. That
provided pretty strong proof that it wasn't some other unrelated issue
in the kernel causing us grief.

At that point, it was pretty clear that was it, as there was no kernel
running, and the CPU was still responsive. Renting a logic analyzer
was the next step.

> How do driver writers deal with complete kernel hangs?

Lots of sleeps in between each and every write to the hardware, with
regular output. Of course, if it's a timing issue (which is what it
sounds like), you're screwed.

Other than that, I look at the hardware guys and say "Your turn," and
walk out of the room to get a cup of coffee.

Ray

2007-10-25 04:07:05

by Grant Grundler

[permalink] [raw]
Subject: Re: How to debug complete kernel lock-ups

On Wed, Oct 24, 2007 at 11:17:40AM +0200, John Sigler wrote:
...
> I've tested with a vanilla 2.6.22.10 kernel (no PREEMPT_RT patch).
> That system also locks up and remains completely unresponsive (I can't open
> new ssh sessions, the system won't answer ICMP echo requests).
>
> How do driver writers deal with complete kernel hangs?

Use different HW. Both IA64 and PARISC gives useful diagnostics
when the machine has a hard crash (MCA or HPMC respectively). I'll bet
PPC does too on the POWER machines.

Maybe a newer x86 machine can provide some MCE data as well?

Otherwise it's what gregkh said...not the "we slowly go crazy"
part. :) Well, sometimes. :)

BTW, getting PCI bus traces would be quite helpful in this case.
It'll give you clear data as to whether the devices are being programmed
as expected (also to rule out chipset/Host bus controller issues) and
whether they are responding as expected (maybe something else dies
when they do).

hth,
grant

hth,
grant

2007-10-31 09:26:09

by John Sigler

[permalink] [raw]
Subject: Re: How to debug complete kernel lock-ups

John Sigler wrote:

> John Sigler wrote:
>
>> I have an x86 system with two PCI slots, in which I inserted two
>> specialized output cards (Dektec DTA-105).
>>
>> http://www.dektec.com/Products/DTA-105/
>> (They provide an open source driver.)
>>
>> My problem is: when I write to the 4 ports (each card has 2 ports) "at
>> the same time" (not really "at the same time" because I have a
>> uni-processor system, so "within a short time frame" is more accurate)
>> the system *completely* locks up.
>>
>> The manufacturer told me they had seen the problem in their lab. I'm
>> just trying to provide some helpful debug output to speed up the
>> process of fixing the problem :-)
>>
>> I've built a debug 2.6.22.1-rt9 kernel, hoping to get the kernel to
>> dump something, anything.
>>
>> +CONFIG_KALLSYMS_ALL=y
>> +CONFIG_PCI_DEBUG=y
>> +CONFIG_DEBUG_DRIVER=y
>> +CONFIG_PRINTK_TIME=y
>> +CONFIG_MAGIC_SYSRQ=y
>> +CONFIG_DEBUG_KERNEL=y
>> +CONFIG_DEBUG_SHIRQ=y
>> +CONFIG_DETECT_SOFTLOCKUP=y
>> +CONFIG_DEBUG_SLAB=y
>> +CONFIG_DEBUG_SLAB_LEAK=y
>> +CONFIG_DEBUG_PREEMPT=y
>> +CONFIG_DEBUG_RT_MUTEXES=y
>> +CONFIG_DEBUG_PI_LIST=y
>> +CONFIG_RT_MUTEX_TESTER=y
>> +CONFIG_DEBUG_SPINLOCK=y
>> +CONFIG_DEBUG_MUTEXES=y
>> +CONFIG_DEBUG_LOCK_ALLOC=y
>> +CONFIG_PROVE_LOCKING=y
>> +CONFIG_LOCKDEP=y
>> +CONFIG_TRACE_IRQFLAGS=y
>> +CONFIG_DEBUG_SPINLOCK_SLEEP=y
>> +CONFIG_DEBUG_LOCKING_API_SELFTESTS=y
>> +CONFIG_STACKTRACE=y
>> +CONFIG_PREEMPT_TRACE=y
>> +CONFIG_DEBUG_BUGVERBOSE=y
>> +CONFIG_DEBUG_INFO=y
>> +CONFIG_FRAME_POINTER=y
>> +CONFIG_FORCED_INLINING=y
>> +CONFIG_DEBUG_STACKOVERFLOW=y
>> +CONFIG_DEBUG_RODATA=y
>> +CONFIG_4KSTACKS=y
>>
>> I've enabled the serial console, and used SysRq to bump the console
>> level to 9 (I want everything, even KERN_DEBUG output).
>>
>> I've enabled the IO-APIC watchdog (nmi_watchdog=1).
>>
>> Once the system locks up, I get no output, no panic, no oops.
>> The serial console is frozen, my ssh sessions are frozen.
>>
>> Suppose the PCI bus "crashes" (whatever that means) or locks up.
>> Would that make the system completely unresponsive? The I/O does have
>> to get to/from the south bridge, through the PCI bus AFAIU. I can
>> imagine that a locked PCI bus would be slightly problematic.
>>
>> Does this mean I need some kind of PCI bus analyzer (i.e. hardware) at
>> this point? Is there anything more I can try?
>
> I've tested with a vanilla 2.6.22.10 kernel (no PREEMPT_RT patch).
> That system also locks up and remains completely unresponsive (I can't
> open new ssh sessions, the system won't answer ICMP echo requests).
>
> How do driver writers deal with complete kernel hangs?

I sent the problematic system to the board manufacturer.
This is what their engineers told me:

"It seems that the PCI clock on this system has a rather large over- and
undershoot and we suspect that the undershoot (of ~1V) is causing a drop
in the core voltage of the on-board FPGA which results in lockup of the
firmware. Both the under- and overshoot are well outside the allowed
ranges (high=VCC+0.5V and low=-0.5V) of the PCI specification and a
premature conclusion might be that the system does not comply to the PCI
spec and that this is the cause of the lockup on this PC."

This is waaay out of my league, as my area is software.

Is it typical for voltage issues to hang hardware?

Is it typical for one PCI board locking up to nail the entire system?

I don't understand why the lockup would only happen when I write to the
4 ports within a small time frame, and not when I only write to 2 ports
(either one port on each card, or 2 ports on the same card). I suspected
some kind of concurrency issue...

I suppose the next logical step is to get the board's engineers
and the system's engineers duke it out? :-)

Regards.

2007-10-31 21:28:26

by Ray Lee

[permalink] [raw]
Subject: Re: How to debug complete kernel lock-ups

On 10/31/07, John Sigler <[email protected]> wrote:
> "It seems that the PCI clock on this system has a rather large over- and
> undershoot and we suspect that the undershoot (of ~1V) is causing a drop
> in the core voltage of the on-board FPGA which results in lockup of the
> firmware. Both the under- and overshoot are well outside the allowed
> ranges (high=VCC+0.5V and low=-0.5V) of the PCI specification and a
> premature conclusion might be that the system does not comply to the PCI
> spec and that this is the cause of the lockup on this PC."
>
> This is waaay out of my league, as my area is software.
>
> Is it typical for voltage issues to hang hardware?

Yes, if the voltage is applied (or lacking) at the right place.

> Is it typical for one PCI board locking up to nail the entire system?

This doesn't appear to be a case of the *board* crashing, but rather
the board taking the pci bus and related hardware on-motherboard down
with it. Once that's down, anything that you need that goes through
the bus (on a PC, that's pretty much everything), is inaccessible.

> I don't understand why the lockup would only happen when I write to the
> 4 ports within a small time frame, and not when I only write to 2 ports
> (either one port on each card, or 2 ports on the same card). I suspected
> some kind of concurrency issue...

No, given the hardware guy's description, it's a power issue. Perhaps
when you're writing to a port, you're using more power on the card?
Four ports = 4 * the power draw. When the current load increases,
voltage drops, and if you underpower a chip, it's going to lose its
little head.

> I suppose the next logical step is to get the board's engineers
> and the system's engineers duke it out? :-)

Yes, all signs point to it being a pure hardware issue. You may be
able to work around it in software by initializing a 'counting
semaphore' to 2 to manage the maximum concurrency, so that you'll
never write more than 2 ports at a time until the hardware guys figure
it out.

Ray