[Xenomai-help] Kernel crash caused by t_delete

["Gao" <gwysu@domain.hid>]

[-- Attachment #1.1.1: Type: text/plain, Size: 2342 bytes --]

Hello again:
 
 
 I an experiencing a rough issue about pSoS+ skin. I am using linux kernel
2.6.33.4, xenomai 2.5.4 and  adeos-ipipe-2.6.33.4-powerpc-2.9-01.patch on
MPC870.  The pSoS+  emulator is built as module. Attached is the demo.c used
to test.
 
When I run the demo at first time as follow step:
insmod xeno_psos.ko
./demo
It can run normally. 
But when I run it again with the following steps
rmmod xeno_psos 
insmod xeno_psos.ko
./demo
 
the kernel will crash with below information:
 
kernel BUG at fs/buffer.c:1271!
 
Oops: Exception in kernel mode, sig: 5 [#1]
 
RxT-Carrier
 
Modules linked in: module_mem xeno_psos 
 
NIP: c00d6608 LR: c00d682c CTR: c010ff78
 
REGS: c1a15ba0 TRAP: 0700   Not tainted  (2.6.33.4)
 
MSR: 00029032 <EE,ME,CE,IR,DR>  CR: 44820442  XER: 20000000
 
TASK = c190ed60[348] 'MAIN' THREAD: c1a14000
 
GPR00: 00000001 c1a15c50 c190ed60 c14021a0 00040002 00001000 00000080
00004000 
 
GPR08: 00000fff c0390000 00000000 02000400 44820442 109eb2a0 01ffe800
01ff50a0 
 
GPR16: 01fd05d8 01ff507c ffffff9c c1a15e64 fffffff4 c03b0000 c1a15d98
c1a15da0 
 
GPR24: c14a72c0 c1942d80 00040002 c14021a0 c14a7cd0 00001000 c0394ae0
c193ec00 
 
NIP [c00d6608] __find_get_block+0x28/0x22c
 
LR [c00d682c] __getblk+0x20/0x220
 
Call Trace:
 
[c1a15c50] [20000000] 0x20000000 (unreliable)
 
[c1a15ca0] [c00d682c] __getblk+0x20/0x220
 
[c1a15cd0] [c0105e90] __ext3_get_inode_loc+0xe4/0x364
 
[c1a15d00] [c0109d08] ext3_iget+0x60/0x56c
 
[c1a15d30] [c010dbd0] ext3_lookup+0xf8/0x164
 
[c1a15d60] [c00bb270] do_lookup+0x1b4/0x210
 
[c1a15d90] [c00bccfc] link_path_walk+0x564/0xbfc
 
[c1a15df0] [c00bd3dc] path_walk+0x48/0xcc
 
[c1a15e20] [c00bd550] do_path_lookup+0x64/0x6c
 
[c1a15e40] [c00be370] do_filp_open+0xd8/0x9a8
 
[c1a15f10] [c00afff4] do_sys_open+0x64/0x130
 
[c1a15f40] [c000f8a0] ret_from_syscall+0x0/0x38
 
Instruction dump:
 
813f000c 4bffffac 7c0802a6 9421ffb0 7d800026 bf210034 90010054 91810030 
 
3d20c039 80094ae0 3bc94ae0 540007fe <0f000000> 38000008 7c0903a6 3d20c039 
 
---[ end trace f21c6826c169a5b9 ]---
 
 
The problem seemed to caused by t_delete(0). 
Sometimes, once the issue happens, after I power off the target and power on
again, and do nothing, the kerenl will still crach with above information.
 
Do anyone have an idea about the issues. Thanks in advance.
 
 
Best regards,
Wenyi Gao

 


[-- Attachment #1.1.2: Type: text/html, Size: 10031 bytes --]

[-- Attachment #1.2: Blank Bkgrd.gif --]
[-- Type: image/gif, Size: 145 bytes --]

[-- Attachment #2: demo.c --]
[-- Type: application/octet-stream, Size: 5334 bytes --]

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <errno.h>
#include <sys/mman.h>
#include <psos.h>

#define EVENT1 1
#define EVENT2 2

#define ERR_NO_ERROR	SUCCESS


/*****************************************************************************
**  demo program global data structures
*****************************************************************************/
char partition_task2_part[1024];
char partition_task3_part[2048];


ULONG part2_numblks;
ULONG part3_numblks;

ULONG task1_id;
ULONG task2_id;
ULONG task3_id;
ULONG task4_id;
ULONG task5_id;

ULONG queue2_id;
ULONG queue3_id;

ULONG timer_id;

ULONG part2_id;
ULONG part3_id;

ULONG sema41_id;


#if 1
void task1( ULONG dummy0, ULONG dummy1, ULONG dummy2, ULONG dummy3 )
{
ULONG err, event, i;
char buffer[20];

tm_wkafter( 50 );

for (;;) {
    printf( "\r\ntask1 waiting on event mask %lx\n",
            (unsigned long)(EVENT1 | EVENT2) );
    err = ev_receive( EVENT1 | EVENT2, EV_ALL, 0, &event );

    if (event & EVENT1) {
    
    printf("received event 1\n");
        
      {
          for (i = 0; i < 10; i++)
              buffer[i] = 'A' + i;
          buffer[i] = 0;

          printf("\r\ntask1's message for task2: %s\n", buffer );

          err = q_vsend( queue2_id, buffer, 11 );
         // err = pt_retbuf( part2_id, buffer );
      }
      
    }
    
    if (event & EVENT2) {
    
    printf("received event 2\n");
    
    
      {
          for (i = 0; i < 10; i++)
              buffer[i] = 'Z' - i;
          buffer[i] = 0;

          printf("\r\ntask1's message for task3: %s\n", buffer );
          err = q_send( queue3_id, buffer );
          //err = pt_retbuf( part3_id, buffer );
      }
      

          
    }
    
  }
 
}
#endif
/*-----------------------------------------------------------------------*/
/*
 *  task2  - First consumer task. It tells the producer that it is ready to
 *           receive a message by posting an event on which producer is pending.
 *           Then it pends on the queue where producer posts the message.
 */

void task2( ULONG dummy0, ULONG dummy1, ULONG dummy2, ULONG dummy3 )
{
ULONG err, i;
char foo;
char msg[128];
ULONG msglen;
	 printf( "task2 is running\n");


  for (;;) {
  
  tm_wkafter( 200 );
  
    err = ev_send( task1_id, EVENT1 );
	
	#if 1	
    printf( "\r\ntask2 waiting on vqueue %ld", queue2_id );
    err = q_vreceive( queue2_id, Q_WAIT, 0L, msg, 128, &msglen );
    if ( err != ERR_NO_ERROR )
        printf( "\r\nq_vreceive returned error %lx", err );
    else
    {
        printf("\r\ntask2 received message from task1: %s\n", msg);

        for (i = 0; msg[i]; i++)
            foo ^= msg[i];
    }
   #endif 
  }
}

void task3( ULONG dummy0, ULONG dummy1, ULONG dummy2, ULONG dummy3 )
{
    ULONG err;
    int i;
    char foo, *msg;

  for (;;) {
  tm_wkafter( 200 );
    err = ev_send( task1_id, EVENT2 );
	#if 1
    printf( "\r\ntask3 waiting on queue %ld", queue3_id );
    err = q_receive( queue3_id, Q_WAIT, 0L, msg );
    if ( err != ERR_NO_ERROR )
        printf( "\r\nq_receive returned error %lx", err );
    else
    {
        printf("\r\ntask3 received message from task1: %s\n", msg);

        for (i = 0; msg[i]; i++)
            foo += msg[i];
    }
    #endif 
  }
}



void task5( ULONG dummy0, ULONG dummy1, ULONG dummy2, ULONG dummy3 )
{
  
  printf("\r\nTask5 start running");
  
  for (;;)
  {
  	tm_wkafter( 200 );
  	printf("\r\nTask5 is running");
 	  
  }
}

void task4( ULONG dummy0, ULONG dummy1, ULONG dummy2, ULONG dummy3 )
{
	ULONG err,index;
	
	printf("\r\nTask4 start running");
	
		 printf( "\r\nCreating Queue 2" );
    err = q_vcreate( "QUE2", /*Q_PRIOR*/Q_FIFO, 1, 128, &queue2_id );
    if ( err != ERR_NO_ERROR )
        printf( "task4... returned error %lx", err );
 	

    index = 0;	
  for (;;)
  {
  	tm_wkafter( 1000);
	index++;
	
  	printf("\r\nTask4 is running");
	if (index >= 10)
	{
		index = 0;
		break;
	}
  }
  printf("\r\nTask4 is breaking\n");
  t_delete(0);
  tm_wkafter(1000);
}





/*-----------------------------------------------------------------------*/

/*****************************************************************************
**  user system initialization, shutdown, and resource cleanup
*****************************************************************************/
void
    user_sysroot( void )
{
    ULONG err;
	
	mlockall(MCL_CURRENT|MCL_FUTURE);

  	#if 1
     printf( "\r\nCreating Task 4" );
    err = t_create( "TSK4", 10, 4096, 4096, T_LOCAL, &task4_id );
    if(err != ERR_NO_ERROR)
    	printf("\r\nCreating Task 4 error %x", err);
    err = t_start( task4_id, T_TSLICE, task4, (ULONG *)NULL );
	if(err != ERR_NO_ERROR)
    	printf("\r\nStart Task 4 error %x", err);
    #endif

    printf( "\r\n" );
}
\rint main(void)
{
	user_sysroot();
	int index = 0;
	int flag = 0;

	for(;;)
	{
		printf("\n\rmain thread is running\n\r");
		 tm_wkafter(1000);

		 index++;
	
		if (index >= 10)
		{
			if (!flag)
			{
				//t_delete(task4_id);
				flag = 1;
			}
		}
		if(index >= 20)
			break;
		 
	}
	t_delete(0);

	return 0;
}