How to debug complete kernel lock-ups

How to debug complete kernel lock-ups

[John Sigler]

Hello everyone,

I have an x86 system with two PCI slots, in which I inserted two
specialized output cards (Dektec DTA-105).

http://www.dektec.com/Products/DTA-105/
(They provide an open source driver.)

My problem is: when I write to the 4 ports (each card has 2 ports) "at 
the same time" (not really "at the same time" because I have a 
uni-processor system, so "within a short time frame" is more accurate) 
the system *completely* locks up.

The manufacturer told me they had seen the problem in their lab. I'm 
just trying to provide some helpful debug output to speed up the process 
of fixing the problem :-)

I've built a debug 2.6.22.1-rt9 kernel, hoping to get the kernel to dump 
something, anything.

+CONFIG_KALLSYMS_ALL=y
+CONFIG_PCI_DEBUG=y
+CONFIG_DEBUG_DRIVER=y
+CONFIG_PRINTK_TIME=y
+CONFIG_MAGIC_SYSRQ=y
+CONFIG_DEBUG_KERNEL=y
+CONFIG_DEBUG_SHIRQ=y
+CONFIG_DETECT_SOFTLOCKUP=y
+CONFIG_DEBUG_SLAB=y
+CONFIG_DEBUG_SLAB_LEAK=y
+CONFIG_DEBUG_PREEMPT=y
+CONFIG_DEBUG_RT_MUTEXES=y
+CONFIG_DEBUG_PI_LIST=y
+CONFIG_RT_MUTEX_TESTER=y
+CONFIG_DEBUG_SPINLOCK=y
+CONFIG_DEBUG_MUTEXES=y
+CONFIG_DEBUG_LOCK_ALLOC=y
+CONFIG_PROVE_LOCKING=y
+CONFIG_LOCKDEP=y
+CONFIG_TRACE_IRQFLAGS=y
+CONFIG_DEBUG_SPINLOCK_SLEEP=y
+CONFIG_DEBUG_LOCKING_API_SELFTESTS=y
+CONFIG_STACKTRACE=y
+CONFIG_PREEMPT_TRACE=y
+CONFIG_DEBUG_BUGVERBOSE=y
+CONFIG_DEBUG_INFO=y
+CONFIG_FRAME_POINTER=y
+CONFIG_FORCED_INLINING=y
+CONFIG_DEBUG_STACKOVERFLOW=y
+CONFIG_DEBUG_RODATA=y
+CONFIG_4KSTACKS=y

I've enabled the serial console, and used SysRq to bump the console 
level to 9 (I want everything, even KERN_DEBUG output).

I've enabled the IO-APIC watchdog (nmi_watchdog=1).

Once the system locks up, I get no output, no panic, no oops.
The serial console is frozen, my ssh sessions are frozen.

Suppose the PCI bus "crashes" (whatever that means) or locks up.
Would that make the system completely unresponsive? The I/O does have to 
get to/from the south bridge, through the PCI bus AFAIU. I can imagine 
that a locked PCI bus would be slightly problematic.

Does this mean I need some kind of PCI bus analyzer (i.e. hardware) at 
this point? Is there anything more I can try?

Regards.

Re: How to debug complete kernel lock-ups

[John Sigler]

John Sigler wrote:

> I have an x86 system with two PCI slots, in which I inserted two
> specialized output cards (Dektec DTA-105).
> 
> http://www.dektec.com/Products/DTA-105/
> (They provide an open source driver.)
> 
> My problem is: when I write to the 4 ports (each card has 2 ports) "at 
> the same time" (not really "at the same time" because I have a 
> uni-processor system, so "within a short time frame" is more accurate) 
> the system *completely* locks up.
> 
> The manufacturer told me they had seen the problem in their lab. I'm 
> just trying to provide some helpful debug output to speed up the process 
> of fixing the problem :-)
> 
> I've built a debug 2.6.22.1-rt9 kernel, hoping to get the kernel to dump 
> something, anything.
> 
> +CONFIG_KALLSYMS_ALL=y
> +CONFIG_PCI_DEBUG=y
> +CONFIG_DEBUG_DRIVER=y
> +CONFIG_PRINTK_TIME=y
> +CONFIG_MAGIC_SYSRQ=y
> +CONFIG_DEBUG_KERNEL=y
> +CONFIG_DEBUG_SHIRQ=y
> +CONFIG_DETECT_SOFTLOCKUP=y
> +CONFIG_DEBUG_SLAB=y
> +CONFIG_DEBUG_SLAB_LEAK=y
> +CONFIG_DEBUG_PREEMPT=y
> +CONFIG_DEBUG_RT_MUTEXES=y
> +CONFIG_DEBUG_PI_LIST=y
> +CONFIG_RT_MUTEX_TESTER=y
> +CONFIG_DEBUG_SPINLOCK=y
> +CONFIG_DEBUG_MUTEXES=y
> +CONFIG_DEBUG_LOCK_ALLOC=y
> +CONFIG_PROVE_LOCKING=y
> +CONFIG_LOCKDEP=y
> +CONFIG_TRACE_IRQFLAGS=y
> +CONFIG_DEBUG_SPINLOCK_SLEEP=y
> +CONFIG_DEBUG_LOCKING_API_SELFTESTS=y
> +CONFIG_STACKTRACE=y
> +CONFIG_PREEMPT_TRACE=y
> +CONFIG_DEBUG_BUGVERBOSE=y
> +CONFIG_DEBUG_INFO=y
> +CONFIG_FRAME_POINTER=y
> +CONFIG_FORCED_INLINING=y
> +CONFIG_DEBUG_STACKOVERFLOW=y
> +CONFIG_DEBUG_RODATA=y
> +CONFIG_4KSTACKS=y
> 
> I've enabled the serial console, and used SysRq to bump the console 
> level to 9 (I want everything, even KERN_DEBUG output).
> 
> I've enabled the IO-APIC watchdog (nmi_watchdog=1).
> 
> Once the system locks up, I get no output, no panic, no oops.
> The serial console is frozen, my ssh sessions are frozen.
> 
> Suppose the PCI bus "crashes" (whatever that means) or locks up.
> Would that make the system completely unresponsive? The I/O does have to 
> get to/from the south bridge, through the PCI bus AFAIU. I can imagine 
> that a locked PCI bus would be slightly problematic.
> 
> Does this mean I need some kind of PCI bus analyzer (i.e. hardware) at 
> this point? Is there anything more I can try?

I've tested with a vanilla 2.6.22.10 kernel (no PREEMPT_RT patch).
That system also locks up and remains completely unresponsive (I can't 
open new ssh sessions, the system won't answer ICMP echo requests).

How do driver writers deal with complete kernel hangs?

Regards.

Re: How to debug complete kernel lock-ups

[Greg KH]

On Wed, Oct 24, 2007 at 11:17:40AM +0200, John Sigler wrote:
> John Sigler wrote:
>
>> I have an x86 system with two PCI slots, in which I inserted two
>> specialized output cards (Dektec DTA-105).
>> http://www.dektec.com/Products/DTA-105/
>> (They provide an open source driver.)
>> My problem is: when I write to the 4 ports (each card has 2 ports) "at the 
>> same time" (not really "at the same time" because I have a uni-processor 
>> system, so "within a short time frame" is more accurate) the system 
>> *completely* locks up.
>> The manufacturer told me they had seen the problem in their lab. I'm just 
>> trying to provide some helpful debug output to speed up the process of 
>> fixing the problem :-)
>> I've built a debug 2.6.22.1-rt9 kernel, hoping to get the kernel to dump 
>> something, anything.
>> +CONFIG_KALLSYMS_ALL=y
>> +CONFIG_PCI_DEBUG=y
>> +CONFIG_DEBUG_DRIVER=y
>> +CONFIG_PRINTK_TIME=y
>> +CONFIG_MAGIC_SYSRQ=y
>> +CONFIG_DEBUG_KERNEL=y
>> +CONFIG_DEBUG_SHIRQ=y
>> +CONFIG_DETECT_SOFTLOCKUP=y
>> +CONFIG_DEBUG_SLAB=y
>> +CONFIG_DEBUG_SLAB_LEAK=y
>> +CONFIG_DEBUG_PREEMPT=y
>> +CONFIG_DEBUG_RT_MUTEXES=y
>> +CONFIG_DEBUG_PI_LIST=y
>> +CONFIG_RT_MUTEX_TESTER=y
>> +CONFIG_DEBUG_SPINLOCK=y
>> +CONFIG_DEBUG_MUTEXES=y
>> +CONFIG_DEBUG_LOCK_ALLOC=y
>> +CONFIG_PROVE_LOCKING=y
>> +CONFIG_LOCKDEP=y
>> +CONFIG_TRACE_IRQFLAGS=y
>> +CONFIG_DEBUG_SPINLOCK_SLEEP=y
>> +CONFIG_DEBUG_LOCKING_API_SELFTESTS=y
>> +CONFIG_STACKTRACE=y
>> +CONFIG_PREEMPT_TRACE=y
>> +CONFIG_DEBUG_BUGVERBOSE=y
>> +CONFIG_DEBUG_INFO=y
>> +CONFIG_FRAME_POINTER=y
>> +CONFIG_FORCED_INLINING=y
>> +CONFIG_DEBUG_STACKOVERFLOW=y
>> +CONFIG_DEBUG_RODATA=y
>> +CONFIG_4KSTACKS=y
>> I've enabled the serial console, and used SysRq to bump the console level 
>> to 9 (I want everything, even KERN_DEBUG output).
>> I've enabled the IO-APIC watchdog (nmi_watchdog=1).
>> Once the system locks up, I get no output, no panic, no oops.
>> The serial console is frozen, my ssh sessions are frozen.
>> Suppose the PCI bus "crashes" (whatever that means) or locks up.
>> Would that make the system completely unresponsive? The I/O does have to 
>> get to/from the south bridge, through the PCI bus AFAIU. I can imagine 
>> that a locked PCI bus would be slightly problematic.
>> Does this mean I need some kind of PCI bus analyzer (i.e. hardware) at 
>> this point? Is there anything more I can try?
>
> I've tested with a vanilla 2.6.22.10 kernel (no PREEMPT_RT patch).
> That system also locks up and remains completely unresponsive (I can't open 
> new ssh sessions, the system won't answer ICMP echo requests).
>
> How do driver writers deal with complete kernel hangs?

We slowly go crazy :)

Seriously, try to add debugging messages for where you think things
might be dying and slowly start working from there.  It's not a quick
thing to do at times...

Oh, try using kdb, that sometimes will work for people, depending on
your hardware and problem.

good luck,

greg k-h

Re: How to debug complete kernel lock-ups

[Ray Lee]

On 10/24/07, John Sigler <linux.kernel@free.fr> wrote:
> > I have an x86 system with two PCI slots, in which I inserted two
> > specialized output cards (Dektec DTA-105).
> >
> > http://www.dektec.com/Products/DTA-105/
> > (They provide an open source driver.)
> >
> > My problem is: when I write to the 4 ports (each card has 2 ports) "at
> > the same time" (not really "at the same time" because I have a
> > uni-processor system, so "within a short time frame" is more accurate)
> > the system *completely* locks up.
> >
> > The manufacturer told me they had seen the problem in their lab. I'm
> > just trying to provide some helpful debug output to speed up the process
> > of fixing the problem :-)
[...]
> > Suppose the PCI bus "crashes" (whatever that means) or locks up.
> > Would that make the system completely unresponsive? The I/O does have to
> > get to/from the south bridge, through the PCI bus AFAIU. I can imagine
> > that a locked PCI bus would be slightly problematic.
> >
> > Does this mean I need some kind of PCI bus analyzer (i.e. hardware) at
> > this point? Is there anything more I can try?

You need visibility into the actual place where the issue is
happening, and by your description it's the two cards fighting each
other on the PCI bus. (I'm assuming that the problem doesn't occur
when there's only one card.)

I've worked on a platform where only a few things went through the PCI
bus, and via the firmware's debugger (completely outside the kernel),
I was able to do the setup of the PCI chip and mappings, and then
pound on the hardware directly to exhibit a lockup of the bus. That
provided pretty strong proof that it wasn't some other unrelated issue
in the kernel causing us grief.

At that point, it was pretty clear that was it, as there was no kernel
running, and the CPU was still responsive. Renting a logic analyzer
was the next step.

> How do driver writers deal with complete kernel hangs?

Lots of sleeps in between each and every write to the hardware, with
regular output. Of course, if it's a timing issue (which is what it
sounds like), you're screwed.

Other than that, I look at the hardware guys and say "Your turn," and
walk out of the room to get a cup of coffee.

Ray

Re: How to debug complete kernel lock-ups

[Grant Grundler]

On Wed, Oct 24, 2007 at 11:17:40AM +0200, John Sigler wrote:
...
> I've tested with a vanilla 2.6.22.10 kernel (no PREEMPT_RT patch).
> That system also locks up and remains completely unresponsive (I can't open 
> new ssh sessions, the system won't answer ICMP echo requests).
>
> How do driver writers deal with complete kernel hangs?

Use different HW. Both IA64 and PARISC gives useful diagnostics
when the machine has a hard crash (MCA or HPMC respectively). I'll bet
PPC does too on the POWER machines.

Maybe a newer x86 machine can provide some MCE data as well?

Otherwise it's what gregkh said...not the "we slowly go crazy"
part. :) Well, sometimes. :)

BTW, getting PCI bus traces would be quite helpful in this case.
It'll give you clear data as to whether the devices are being programmed
as expected (also to rule out chipset/Host bus controller issues) and
whether they are responding as expected (maybe something else dies
when they do).

hth,
grant

hth,
grant

Re: How to debug complete kernel lock-ups

[John Sigler]

John Sigler wrote:

> John Sigler wrote:
> 
>> I have an x86 system with two PCI slots, in which I inserted two
>> specialized output cards (Dektec DTA-105).
>>
>> http://www.dektec.com/Products/DTA-105/
>> (They provide an open source driver.)
>>
>> My problem is: when I write to the 4 ports (each card has 2 ports) "at 
>> the same time" (not really "at the same time" because I have a 
>> uni-processor system, so "within a short time frame" is more accurate) 
>> the system *completely* locks up.
>>
>> The manufacturer told me they had seen the problem in their lab. I'm 
>> just trying to provide some helpful debug output to speed up the 
>> process of fixing the problem :-)
>>
>> I've built a debug 2.6.22.1-rt9 kernel, hoping to get the kernel to 
>> dump something, anything.
>>
>> +CONFIG_KALLSYMS_ALL=y
>> +CONFIG_PCI_DEBUG=y
>> +CONFIG_DEBUG_DRIVER=y
>> +CONFIG_PRINTK_TIME=y
>> +CONFIG_MAGIC_SYSRQ=y
>> +CONFIG_DEBUG_KERNEL=y
>> +CONFIG_DEBUG_SHIRQ=y
>> +CONFIG_DETECT_SOFTLOCKUP=y
>> +CONFIG_DEBUG_SLAB=y
>> +CONFIG_DEBUG_SLAB_LEAK=y
>> +CONFIG_DEBUG_PREEMPT=y
>> +CONFIG_DEBUG_RT_MUTEXES=y
>> +CONFIG_DEBUG_PI_LIST=y
>> +CONFIG_RT_MUTEX_TESTER=y
>> +CONFIG_DEBUG_SPINLOCK=y
>> +CONFIG_DEBUG_MUTEXES=y
>> +CONFIG_DEBUG_LOCK_ALLOC=y
>> +CONFIG_PROVE_LOCKING=y
>> +CONFIG_LOCKDEP=y
>> +CONFIG_TRACE_IRQFLAGS=y
>> +CONFIG_DEBUG_SPINLOCK_SLEEP=y
>> +CONFIG_DEBUG_LOCKING_API_SELFTESTS=y
>> +CONFIG_STACKTRACE=y
>> +CONFIG_PREEMPT_TRACE=y
>> +CONFIG_DEBUG_BUGVERBOSE=y
>> +CONFIG_DEBUG_INFO=y
>> +CONFIG_FRAME_POINTER=y
>> +CONFIG_FORCED_INLINING=y
>> +CONFIG_DEBUG_STACKOVERFLOW=y
>> +CONFIG_DEBUG_RODATA=y
>> +CONFIG_4KSTACKS=y
>>
>> I've enabled the serial console, and used SysRq to bump the console 
>> level to 9 (I want everything, even KERN_DEBUG output).
>>
>> I've enabled the IO-APIC watchdog (nmi_watchdog=1).
>>
>> Once the system locks up, I get no output, no panic, no oops.
>> The serial console is frozen, my ssh sessions are frozen.
>>
>> Suppose the PCI bus "crashes" (whatever that means) or locks up.
>> Would that make the system completely unresponsive? The I/O does have 
>> to get to/from the south bridge, through the PCI bus AFAIU. I can 
>> imagine that a locked PCI bus would be slightly problematic.
>>
>> Does this mean I need some kind of PCI bus analyzer (i.e. hardware) at 
>> this point? Is there anything more I can try?
> 
> I've tested with a vanilla 2.6.22.10 kernel (no PREEMPT_RT patch).
> That system also locks up and remains completely unresponsive (I can't 
> open new ssh sessions, the system won't answer ICMP echo requests).
> 
> How do driver writers deal with complete kernel hangs?

I sent the problematic system to the board manufacturer.
This is what their engineers told me:

"It seems that the PCI clock on this system has a rather large over- and 
undershoot and we suspect that the undershoot (of ~1V) is causing a drop 
in the core voltage of the on-board FPGA which results in lockup of the 
firmware. Both the under- and overshoot are well outside the allowed 
ranges (high=VCC+0.5V and low=-0.5V) of the PCI specification and a 
premature conclusion might be that the system does not comply to the PCI 
spec and that this is the cause of the lockup on this PC."

This is waaay out of my league, as my area is software.

Is it typical for voltage issues to hang hardware?

Is it typical for one PCI board locking up to nail the entire system?

I don't understand why the lockup would only happen when I write to the 
4 ports within a small time frame, and not when I only write to 2 ports 
(either one port on each card, or 2 ports on the same card). I suspected 
some kind of concurrency issue...

I suppose the next logical step is to get the board's engineers
and the system's engineers duke it out? :-)

Regards.

Re: How to debug complete kernel lock-ups

[Ray Lee]

On 10/31/07, John Sigler <linux.kernel@free.fr> wrote:
> "It seems that the PCI clock on this system has a rather large over- and
> undershoot and we suspect that the undershoot (of ~1V) is causing a drop
> in the core voltage of the on-board FPGA which results in lockup of the
> firmware. Both the under- and overshoot are well outside the allowed
> ranges (high=VCC+0.5V and low=-0.5V) of the PCI specification and a
> premature conclusion might be that the system does not comply to the PCI
> spec and that this is the cause of the lockup on this PC."
>
> This is waaay out of my league, as my area is software.
>
> Is it typical for voltage issues to hang hardware?

Yes, if the voltage is applied (or lacking) at the right place.

> Is it typical for one PCI board locking up to nail the entire system?

This doesn't appear to be a case of the *board* crashing, but rather
the board taking the pci bus and related hardware on-motherboard down
with it. Once that's down, anything that you need that goes through
the bus (on a PC, that's pretty much everything), is inaccessible.

> I don't understand why the lockup would only happen when I write to the
> 4 ports within a small time frame, and not when I only write to 2 ports
> (either one port on each card, or 2 ports on the same card). I suspected
> some kind of concurrency issue...

No, given the hardware guy's description, it's a power issue. Perhaps
when you're writing to a port, you're using more power on the card?
Four ports = 4 * the power draw. When the current load increases,
voltage drops, and if you underpower a chip, it's going to lose its
little head.

> I suppose the next logical step is to get the board's engineers
> and the system's engineers duke it out? :-)

Yes, all signs point to it being a pure hardware issue. You may be
able to work around it in software by initializing a 'counting
semaphore' to 2 to manage the maximum concurrency, so that you'll
never write more than 2 ports at a time until the hardware guys figure
it out.

Ray