[linux-dvb] Re: OOPS with budget card + cam (in dvb_ca_en50221_io_write)

["Carlo E. Prelz" <fluido@fluido.as>]

	Subject: [linux-dvb] Re: OOPS with budget card + cam (in dvb_ca_en50221_io_write)
	Date: Thu, Nov 11, 2004 at 11:04:29PM +0000

Quoting Andrew de Quincey (adq_dvb@lidskialf.net):

> Hmm, there was a fix to budget-ci a while back involving spinlocks, but I'm 
> not sure if that is the problem here.

With CVS from this morning, worked OK for ~ 10 hours. Then, these two
OOPSes happened:

--8<----8<----8<----8<----8<----8<----8<----8<----8<----8<----8<----8<--

Unable to handle kernel NULL pointer dereference at virtual address 0000000c
 printing eip:
e1a5a583
*pde = 00000000
Oops: 0000 [#1]
Modules linked in: budget_ci tda1004x firmware_class budget_core dvb_core saa7146 ttpci_eeprom stv0299 b44 8139too
CPU:    0
EIP:    0060:[<e1a5a583>]    Not tainted
EFLAGS: 00010292   (2.6.7) 
EIP is at dvb_ca_en50221_io_read_condition+0x23/0x160 [dvb_core]
eax: ffffffea   ebx: 00000000   ecx: e1a5a6c0   edx: 00000000
esi: db667f3c   edi: 00000000   ebp: db667f40   esp: db667ec4
ds: 007b   es: 007b   ss: 0068
Process harvest_periods (pid: 1204, threadinfo=db666000 task=dbe80150)
Stack: dbe80664 dbe80150 c011edc8 dc057f28 dbe80664 db667f28 00000000 ffffffff 
       00000000 ffffe000 c012032c 00000000 db667f3c 00000000 db667f40 e1a5a727 
       00000000 db667f3c db667f40 db667f28 c0103ce0 db667f28 db667fc4 00000000 
Call Trace:
 [<c011edc8>] dequeue_signal+0x88/0x90
 [<c012032c>] get_signal_to_deliver+0x5c/0x2f0
 [<e1a5a727>] dvb_ca_en50221_io_read+0x67/0x380 [dvb_core]
 [<c0103ce0>] do_signal+0x90/0x120
 [<c01142b0>] default_wake_function+0x0/0x20
 [<c014787c>] vfs_read+0xdc/0x140
 [<c0147b22>] sys_read+0x42/0x70
 [<c0103efb>] syscall_call+0x7/0xb

Code: 8b 4f 0c 8b 6f 30 39 4c 24 18 73 2a 90 8b 47 10 89 ee c1 e6 
 <1>Unable to handle kernel NULL pointer dereference at virtual address 00000010
 printing eip:
e1a5a42c
*pde = 00000000
Oops: 0000 [#2]
Modules linked in: budget_ci tda1004x firmware_class budget_core dvb_core saa7146 ttpci_eeprom stv0299 b44 8139too
CPU:    0
EIP:    0060:[<e1a5a42c>]    Not tainted
EFLAGS: 00010202   (2.6.7) 
EIP is at dvb_ca_en50221_io_write+0xac/0x1e0 [dvb_core]
eax: 00000000   ebx: 00000000   ecx: 00000000   edx: fffffff2
esi: 00000000   edi: da7b3d04   ebp: 00000003   esp: da275d44
ds: 007b   es: 007b   ss: 0068
Process harvest_periods (pid: 1205, threadinfo=da274000 task=dbe806d0)
Stack: da275d5e 41d5e101 00000001 00000005 00000003 00000000 00013920 dfc32a34 
       01a00001 00039601 0b881000 c0010001 dbe61820 ddaa3920 c03ccccb de78b540 
       00000003 de78b5e0 00000001 00004000 00008001 80011600 c1781210 00000003 
Call Trace:
 [<c03ccccb>] ip_nat_fn+0x8b/0x210
 [<c03922f0>] ip_local_deliver_finish+0x0/0x1b0
 [<c03923ac>] ip_local_deliver_finish+0xbc/0x1b0
 [<c03922f0>] ip_local_deliver_finish+0x0/0x1b0
 [<c0389f09>] nf_hook_slow+0xc9/0x100
 [<c03922f0>] ip_local_deliver_finish+0x0/0x1b0
 [<c03924a0>] ip_rcv_finish+0x0/0x220
 [<c0114023>] scheduler_tick+0x163/0x3f0
 [<c011de86>] update_process_times+0x46/0x60
 [<c011dceb>] update_wall_time+0xb/0x40
 [<c011e11f>] do_timer+0xdf/0xf0
 [<c011a4bd>] __do_softirq+0x7d/0x80
 [<c0114023>] scheduler_tick+0x163/0x3f0
 [<c012cf63>] wake_up_page+0x13/0x40
 [<c012d08f>] unlock_page+0x1f/0x30
 [<c013a3b1>] do_wp_page+0x1d1/0x230
 [<c011de86>] update_process_times+0x46/0x60
 [<c013aed9>] handle_mm_fault+0x159/0x170
 [<c011388f>] recalc_task_prio+0x8f/0x190
 [<c03efa72>] schedule+0x272/0x430
 [<c03effad>] schedule_timeout+0x6d/0xc0
 [<e1a5a380>] dvb_ca_en50221_io_write+0x0/0x1e0 [dvb_core]
 [<c0147a7c>] vfs_write+0xdc/0x140
 [<c011e30e>] sys_nanosleep+0xde/0x170
 [<c0147b92>] sys_write+0x42/0x70
 [<c0103efb>] syscall_call+0x7/0xb

Code: 8b 53 10 0f b6 c1 c1 e0 06 83 3c 02 02 0f 85 f4 00 00 00 39 

--8<----8<----8<----8<----8<----8<----8<----8<----8<----8<----8<----8<--

In this case, killing the process did not result in a zombie, the
DVB modules could be reloaded and the process restarted without
reboot.

It starts to look like I am reading the CA i/face with one thread and
writing to it with another. Could have the mutexes wrongly set. Could
this justify the behaviour? Any specific insight from these OOPSes? 

Carlo

-- 
  *         Se la Strada e la sua Virtu' non fossero state messe da parte,
* K * Carlo E. Prelz - fluido@fluido.as             che bisogno ci sarebbe
  *               di parlare tanto di amore e di rettitudine? (Chuang-Tzu)