[Cbe-oss-dev] Hard crash on fb write past 17MB

Tue Dec 19 23:39:42 EST 2006

	Hi Mike,

On Tue, 19 Dec 2006, Mike Acton wrote:
> Having a problem which causes a hard crash of the OS:
> 
> I can mmap 18MB from /dev/fb0 (whatever configuration: 1MB x 18, 18MB
> x 1, etc.) without errors. (Trying to map more than 18MB is rejected
> by mmap)
> 
> Writing in the range 0-17MB causes no problems.
> Writing to the range 17-18MB causes the system to stop without any
> apparent feedback.
> Reading the range 0-18MB cases no problems.
> 
> I have a small test program which demonstrates the problem:
> http://www.cellperformance.com/public/attachments/test_fb_alloc.c
> 
> To compile: gcc -std=c99 test_fb_alloc.c -o test_fb_alloc
> 
> [It will prompt before the offending bit to give you a chance to skip it.]
> 
> This is on YDL5 for PS3 with kernel 2.6.16
> 
> Anyone have an idea?

I tried it on mine. Unfortunately I don't have YDL5.
But it does not crash, on both 2.6.16 from Fedora Core 5 and on my own
2.6.20-rc1:

| ps3:~/test_fb_alloc# ./test_fb_alloc
| Status: FB address mapped to 0xf7ed0000
| Status: mem_pos:  0xf7ed0000
| Status: mem_dist: 135462911B (132287KB) (129MB)
| Status: FB address mapped to 0xf7dc0000
| Status: mem_pos:  0xf7dc0000
| Status: mem_dist: 136577023B (133375KB) (130MB)
| Status: FB address mapped to 0xf7cc0000
| Status: mem_pos:  0xf7cc0000
| Status: mem_dist: 137625599B (134399KB) (131MB)
| Status: FB address mapped to 0xf7bc0000
| Status: mem_pos:  0xf7bc0000
| Status: mem_dist: 138674175B (135423KB) (132MB)
| Status: FB address mapped to 0xf7ac0000
| Status: mem_pos:  0xf7ac0000
| Status: mem_dist: 139722751B (136447KB) (133MB)
| Status: FB address mapped to 0xf79c0000
| Status: mem_pos:  0xf79c0000
| Status: mem_dist: 140771327B (137471KB) (134MB)
| Status: FB address mapped to 0xf78c0000
| Status: mem_pos:  0xf78c0000
| Status: mem_dist: 141819903B (138495KB) (135MB)
| Status: FB address mapped to 0xf77c0000
| Status: mem_pos:  0xf77c0000
| Status: mem_dist: 142868479B (139519KB) (136MB)
| Status: FB address mapped to 0xf76c0000
| Status: mem_pos:  0xf76c0000
| Status: mem_dist: 143917055B (140543KB) (137MB)
| Status: FB address mapped to 0xf75c0000
| Status: mem_pos:  0xf75c0000
| Status: mem_dist: 144965631B (141567KB) (138MB)
| Status: FB address mapped to 0xf74c0000
| Status: mem_pos:  0xf74c0000
| Status: mem_dist: 146014207B (142591KB) (139MB)
| Status: FB address mapped to 0xf73c0000
| Status: mem_pos:  0xf73c0000
| Status: mem_dist: 147062783B (143615KB) (140MB)
| Status: FB address mapped to 0xf72c0000
| Status: mem_pos:  0xf72c0000
| Status: mem_dist: 148111359B (144639KB) (141MB)
| Status: FB address mapped to 0xf71c0000
| Status: mem_pos:  0xf71c0000
| Status: mem_dist: 149159935B (145663KB) (142MB)
| Status: FB address mapped to 0xf70c0000
| Status: mem_pos:  0xf70c0000
| Status: mem_dist: 150208511B (146687KB) (143MB)
| Status: FB address mapped to 0xf6fc0000
| Status: mem_pos:  0xf6fc0000
| Status: mem_dist: 151257087B (147711KB) (144MB)
| Status: FB address mapped to 0xf6ec0000
| Status: mem_pos:  0xf6ec0000
| Status: mem_dist: 152305663B (148735KB) (145MB)
| Status: FB address mapped to 0xf6dc0000
| Status: mem_pos:  0xf6dc0000
| Status: mem_dist: 153354239B (149759KB) (146MB)
| Writing fb[0] memory...
| Writing fb[1] memory...
| Writing fb[2] memory...
| Writing fb[3] memory...
| Writing fb[4] memory...
| Writing fb[5] memory...
| Writing fb[6] memory...
| Writing fb[7] memory...
| Writing fb[8] memory...
| Writing fb[9] memory...
| Writing fb[10] memory...
| Writing fb[11] memory...
| Writing fb[12] memory...
| Writing fb[13] memory...
| Writing fb[14] memory...
| Writing fb[15] memory...
| Writing fb[16] memory...
| Continue with test? Y/n [WARNING: MAY CRASH OS]
| y
| Testing fb[0] memory... PASSED.
| Testing fb[1] memory... FAILED.
                          ^^^^^^
This is caused by the cursor. If I disable it with `setterm -cursor off', it
passes.

| Testing fb[2] memory... PASSED.
| Testing fb[3] memory... PASSED.
| Testing fb[4] memory... PASSED.
| Testing fb[5] memory... PASSED.
| Testing fb[6] memory... PASSED.
| Testing fb[7] memory... PASSED.
| Testing fb[8] memory... PASSED.
| Testing fb[9] memory... PASSED.
| Testing fb[10] memory... PASSED.
| Testing fb[11] memory... PASSED.
| Testing fb[12] memory... PASSED.
| Testing fb[13] memory... PASSED.
| Testing fb[14] memory... PASSED.
| Testing fb[15] memory... PASSED.
| Testing fb[16] memory... PASSED.
| Testing fb[17] memory... FAILED.
                           ^^^^^^
It always returns zero when reading from the last MiB, though. So there is
something strange going on with the last MiB.

| ps3:~/test_fb_alloc#

Which videomode are you using? I'm using 1 (as reported by ps3videomode).

> PS: Did anyone notice that in Sony's vsync sample, mmap is being
> checked for NULL instead of MAP_FAILED? mmap does seem to properly
> return MAP_FAILED, so I expect this is just a typo in the sample.

You're right, it should check for MAP_FAILED.

Gr{oetje,eeting}s,

						Geert

--
Geert Uytterhoeven -- Sony Network and Software Technology Center Europe (NSCE)
Geert.Uytterhoeven at sonycom.com ------- The Corporate Village, Da Vincilaan 7-D1
Voice +32-2-7008453 Fax +32-2-7008622 ---------------- B-1935 Zaventem, Belgium