[Linux-fbdev-devel] Two Riva TNT2 cards: Oops

SourceForge Headquarters 1320 Columbia Street Suite 310 San Diego, CA 92101 +1 (858) 422-6466

Dear framebuffer friends,

intending to explore the possibilty of using two framebuffers handled
by two separate video cards, I equipped a machine with two Riva TNT2
cards, one PCI and the other AGP. They appear at lspci -v as:

01:00.0 VGA compatible controller: nVidia Corporation Vanta [NV6] (rev
15) (prog-if 00 [VGA])
        Flags: bus master, 66Mhz, medium devsel, latency 64, IRQ 10
        Memory at dc000000 (32-bit, non-prefetchable) [size=16M]
        Memory at d4000000 (32-bit, prefetchable) [size=32M]
        Expansion ROM at ddaf0000 [disabled] [size=64K]
        Capabilities: [60] Power Management version 1
        Capabilities: [44] AGP version 2.0

and 

00:05.0 VGA compatible controller: nVidia Corporation Vanta [NV6] (rev
15) (prog-if 00 [VGA])
        Subsystem: Palit Microsystems Inc.: Unknown device 002d
        Flags: 66Mhz, medium devsel, IRQ 10
        Memory at df000000 (32-bit, non-prefetchable) [disabled] [size=16M]
        Memory at d8000000 (32-bit, prefetchable) [disabled] [size=32M]
        Expansion ROM at deff0000 [disabled] [size=64K]
        Capabilities: [60] Power Management version 1

Loading the rivafb module gives no bad feelings. I get:

rivafb: RIVA MTRR set to ON
Console: switching to colour frame buffer device 100x37
rivafb: PCI nVidia NV4 framebuffer ver 0.9.2a (RIVA-VTNT2, 32MB @ 0xD4000000)
rivafb: RIVA MTRR set to ON
rivafb: PCI nVidia NV4 framebuffer ver 0.9.2a (RIVA-VTNT2, 32MB @ 0xD8000000)

and /proc/fb contains 

0 RIVA-VTNT2
1 RIVA-VTNT2

as expected. 

Then, if I run fbset -fb /dev/fb1 i get 

mode "800x600-60"
    # D: 40.000 MHz, H: 37.879 kHz, V: 60.317 Hz
    geometry 800 600 800 600 8
    timings 25000 88 40 23 1 128 4
    hsync high
    vsync high
    accel true
    rgba 6/0,6/0,6/0,0/0
endmode

(with /dev/fb0 the rgba line is 8/0,8/0,8/0,0/0).

If I try to run any kind of program that sets the characteristics of
the framebuffer, I get an OOPS of the kind:

--8<----8<----8<----8<----8<----8<----8<----8<----8<----8<----8<----8<--

CPU:    0
EIP:    0010:[<d09236a2>]
EFLAGS: 00010246
eax: 01d905c0   ebx: 0fffffff   ecx: 00000020   edx: 00000000
esi: 00000000   edi: 01d905c0   ebp: 00000000   esp: cd6cbb5c
ds: 0018   es: 0018   ss: 0018
Process fbset (pid: 524, stackpage=cd6cb000)
Stack: 0fffffff 0000000f 00000000 00000080 c0218c09 cc18e000 c91a1000 c0121b83
       001379a0 c0121b96 c0271b30 ceec9880 ced3b300 00000001 00000000 00009bcd
       00000003 c92c2880 00000000 00000020 00000000 00000002 00000010 d0923a5c
Call Trace: [<c0218c09>] [<c0121b83>] [<c0121b96>] [<d0923a5c>] [<d09241a6>]
   [<d0924263>] [<d0926b6c>] [<d0920b56>] [<d0921910>] [<d0927c40>] [<c01c2ba9>]
   [<d0927c40>] [<c011eb82>] [<c011ec6b>] [<c013acd7>] [<c0106c3b>]
Code: f7 fe b9 0a 00 00 00 69 c9 40 42 0f 00 89 44 24 2c 89 c8 99

>>EIP; d09236a2 <[rivafb]nv4CalcArbitration+92/350>   <=====
Trace; c0218c08 <mmx_copy_page+28/30>
Trace; c0121b82 <filemap_nopage+102/3e0>
Trace; c0121b96 <filemap_nopage+116/3e0>
Trace; d0923a5c <[rivafb]nv4UpdateArbitrationSettings+fc/140>
Trace; d09241a6 <[rivafb]CalcStateExt+66/2c0>
Trace; d0924262 <[rivafb]CalcStateExt+122/2c0>
Trace; d0926b6c <[rivafb]reg_template+cc/bc0>
Trace; d0920b56 <[rivafb]riva_load_video_mode+266/2c0>
Trace; d0921910 <[rivafb]rivafb_set_var+420/440>
Trace; d0927c40 <[rivafb]riva_fb_ops+0/40>
Trace; c01c2ba8 <fb_ioctl+168/5e0>
Trace; d0927c40 <[rivafb]riva_fb_ops+0/40>
Trace; c011eb82 <do_no_page+52/e0>
Trace; c011ec6a <handle_mm_fault+5a/c0>
Trace; c013acd6 <sys_ioctl+166/180>
Trace; c0106c3a <system_call+32/38>
Code;  d09236a2 <[rivafb]nv4CalcArbitration+92/350>
00000000 <_EIP>:
Code;  d09236a2 <[rivafb]nv4CalcArbitration+92/350>   <=====
   0:   f7 fe                     idiv   %esi   <=====
Code;  d09236a4 <[rivafb]nv4CalcArbitration+94/350>
   2:   b9 0a 00 00 00            mov    $0xa,%ecx
Code;  d09236a8 <[rivafb]nv4CalcArbitration+98/350>
   7:   69 c9 40 42 0f 00         imul   $0xf4240,%ecx,%ecx
Code;  d09236ae <[rivafb]nv4CalcArbitration+9e/350>
   d:   89 44 24 2c               mov    %eax,0x2c(%esp,1)
Code;  d09236b2 <[rivafb]nv4CalcArbitration+a2/350>
  11:   89 c8                     mov    %ecx,%eax
Code;  d09236b4 <[rivafb]nv4CalcArbitration+a4/350>
  13:   99                        cltd   

--8<----8<----8<----8<----8<----8<----8<----8<----8<----8<----8<----8<--

Well, what happens is that in
/usr/src/linux/drivers/video/riva/riva_hw.c, function
nv4CalcArbitration is called with structure arb containing (at least)
the field called pclk_freq set to 0. Since this value is used as a
dividend in multiple places, the obvious disaster happens. 

Now, I don't have the slightest idea about what this functons does. I
tried to add printk's to see values,  and the machine locked solid at
loading the module. I tried to return if the value was 0, and the
machine entered a strange catatonic status where the keyboard seemed
to be still alive (NumLock led turning on and off) but the keyboard's
stuff seemed not to reach the machine. 

Well, I am confident that you will immediately understand what's going
on. For me, it's a mistery... 

A couple of further informations: I can generate the above OOPS
infinite times and the machine itself does not crash. Only, if I run
again fbset -fb /dev/fb1 after at least one oops, the values of tne
rgba line return changed, to various values. Now:

    rgba 8/16,8/8,8/0,0/0

Is the list the right address for my request, or do I have to trace
the maintainer of the Riva module?

Thanks in advance...

Carlo

PS the PCI card has TV out. Is there some hope to have it working
(under framebuffer - I don't care about X)?

-- 
  *         Se la Strada e la sua Virtu' non fossero state messe da parte,
* K * Carlo E. Prelz - fl...@fl...             che bisogno ci sarebbe
  *               di parlare tanto di amore e di rettitudine? (Chuang-Tzu)