[linux-dvb] Oops in tda10023

[linux-dvb] Oops in tda10023

[Sigmund Augdal]

I just got this output when trying to load  budget-av with a satelco
easywatch dvb-c MK3 in the computer.
----
saa7146 (4) saa7146_i2c_writeout [irq]: timed out waiting for end of
xfer
BUG: unable to handle kernel NULL pointer dereference at virtual address
00000000
 printing eip:
f8fc011e
*pde = 00000000
Oops: 0000 [#1]
PREEMPT SMP 
Modules linked in: budget_av saa7146_vv videobuf_dma_sg videobuf_core
budget budget_core saa7146 dvb_usb_dibusb_mb dvb_usb_umt_010 ultracam
dvb_usb_nova_t_usb2 cpia_usb konicawc dvb_usb_a800 ibmcam quickcam_
messenger dvb_usb_dibusb_mc vicam dvb_usb_gl861 w9968cf ov511
dvb_usb_dtt200u cpia2 se401 dvb_usb_anysee pwc dvb_usb_digitv stv680
b2c2_flexcop_usb radio_si470x radio_maestro usbvideo cafe_ccic saa5249
dvb_u
sb_au6610 cx18 dvb_usb_m920x dvb_usb_dib0700 dvb_usb_vp702x et61x251
radio_maxiradio radio_gemtek_pci dsbr100 zc0301 dvb_usb_gp8psk
dvb_usb_cxusb dvb_usb_opera b2c2_flexcop_pci cpia dvb_usb_af9005 pvrusb2
us
bvision sn9c102 tuner ivtv zr364xx dvb_usb_vp7045 dvb_usb_ttusb2
saa5246a dvb_usb_dibusb_common wm8739 or51132 cx25840 videodev ttusb_dec
zr36060 ov7670 cinergyT2 cs5345 stv0299 upd64083 pluto2 au0828 dib300
0mc saa7115 vp27smpx dib7000m wm8775 dvb_usb upd64031a tvaudio
dvb_ttusb_budget dib7000p ir_kbd_i2c or51211 tlv320aic23b saa717x
b2c2_flexcop zr36050 cs53l32a tvp5150 saa7127 cx2341x lgdt330x zr36016
m52790 
ves1x93 adv7175 sp887x stv0297 bt856 compat_ioctl32 dib3000mb adv7170
tda8083 saa7185 s5h1409 lnbp21 ks0127 dibx000_common tea6415c tda10023
tua6100 saa7114 isl6421 tuner_3036 btcx_risc zl10353 tda10021 dvb_
usb_af9005_remote cx22702 cx22700 videocodec s5h1420 tda10086 mt352
mt312 v4l1_compat dvb_core isl6405 tda1004x tda9875 nxt200x mxl5005s
ves1820 bcm3510 vpx3220 v4l2_common dvb_pll au8522 v4l2_int_device sp8
870 tda9840 bt819 saa7110 ovcamchip l64781 tveeprom ir_common cx24110
saa7111 saa7191 bt866 dabusb tea6420 cx24123 ttpci_eeprom tda10048
tda826x dib0070 ttusbdecfe nxt6000 s5h1411 itd1000 ipv6 rtc button i2c
_algo_bit i2c_i801 i2c_core intel_agp agpgart shpchp pci_hotplug pcspkr
sg jfs pata_pcmcia pcmcia pcmcia_core sbp2 ohci1394 ieee1394 sl811_hcd
usbhid ff_memless ohci_hcd uhci_hcd usb_storage ehci_hcd usbcore
CPU:    0
EIP:    0060:[<f8fc011e>]    Not tainted VLI
EFLAGS: 00010286   (2.6.20-snaptv-r2489 #1)
EIP is at tda10023_writereg+0x73/0x91 [tda10023]
eax: 00000000   ebx: eac5dc00   ecx: e55ebd44   edx: 00000000
esi: f8f435bc   edi: f1b7a89c   ebp: 00000048   esp: e55ebd28
ds: 007b   es: 007b   ss: 0068
Process insmod (pid: 10503, ti=e55ea000 task=f2293570 task.ti=e55ea000)
Stack: f8e7a5e0 f1b7a8bc f8fc0cb0 00000000 00000033 fffffffb 0033f7c0
0000000c 
       00000002 e55ebd52 33000b01 eac5dc00 f8fc0b38 e55ebd6f f8fc0b01
f1b7a800 
       e8ae52c0 00000004 f8f404da f8f410e4 00000004 00000000 00000009
000000d6 
Call Trace:
 [<f8fc0b38>] tda10023_attach+0x37/0x117 [tda10023]
 [<f8fc0b01>] tda10023_attach+0x0/0x117 [tda10023]
 [<f8f404da>] budget_av_attach+0x7d4/0xabf [budget_av]
 [<f8e77464>] saa7146_init_one+0x445/0x566 [saa7146]
 [<c02a3bf9>] pci_device_probe+0x36/0x57
 [<c02f23ee>] really_probe+0x7f/0x103
 [<c02f24b6>] driver_probe_device+0x44/0xa5
 [<c02f258f>] __driver_attach+0x0/0x7f
 [<c02f25d8>] __driver_attach+0x49/0x7f
 [<c02f1adc>] bus_for_each_dev+0x33/0x55
 [<c02f22a8>] driver_attach+0x16/0x18
 [<c02f258f>] __driver_attach+0x0/0x7f
 [<c02f1d68>] bus_add_driver+0x5e/0x15f
 [<c02a3d5e>] __pci_register_driver+0x6e/0x9a
 [<c0138751>] sys_init_module+0x17ae/0x18f5
 [<c02558dd>] xfs_iunlock+0x51/0x6d
 [<c0102e16>] sysenter_past_esp+0x5f/0x85
 [<c0510033>] rt_mutex_slowlock+0x8e/0x446
 =======================
Code: 31 d2 83 f8 01 74 3b 89 44 24 14 0f b6 44 24 1a c7 44 24 08 b0 0c
fc f8 89 44 24 10 0f b6 44 24 1b 89 44 24 0c 8b 83 08 02 00 00 <8b> 00
c7 04 24 0d 0d fc f8 89 44 24 04 e8 23 f3 15 c7 ba 87 ff 
EIP: [<f8fc011e>] tda10023_writereg+0x73/0x91 [tda10023] SS:ESP
0068:e55ebd28
 
----
It seems the problem is that tda10023_writereg accesses
state.frontend.dvb->num in the error message. I guess tda10023_writereg
is called during initialization before state.frontend.dvb is properly
assigned.

Next question is of course if anyone have any idea why I get the i2c
timeout. I seem to get it quite often but not quite allways with this
card.

using latest hg v4l-dvb on a 2.6.20 kernel.

Best Regards

Sigmund Augdal


_______________________________________________
linux-dvb mailing list
linux-dvb@linuxtv.org
http://www.linuxtv.org/cgi-bin/mailman/listinfo/linux-dvb

Re: [linux-dvb] Oops in tda10023

[Antti Palosaari]

Sigmund Augdal wrote:
> using latest hg v4l-dvb on a 2.6.20 kernel.

I did some changes recently to tda10023 (needed for Anysee driver). I 
wonder if these errors start coming after that? Those changes are 
committed to master only few days ago, 05/26/2008.

regards
Antti
-- 
http://palosaari.fi/

_______________________________________________
linux-dvb mailing list
linux-dvb@linuxtv.org
http://www.linuxtv.org/cgi-bin/mailman/listinfo/linux-dvb

Re: [linux-dvb] Oops in tda10023

[Sigmund Augdal]

tor, 29.05.2008 kl. 20.52 +0300, skrev Antti Palosaari:
> Sigmund Augdal wrote:
> > using latest hg v4l-dvb on a 2.6.20 kernel.
> 
> I did some changes recently to tda10023 (needed for Anysee driver). I 
> wonder if these errors start coming after that? Those changes are 
> committed to master only few days ago, 05/26/2008.
When the crash happened I was using a module with these changes
included. This doesn't necessarily mean that these changes were the
cause of the problem. From reading the relevant diff I'd say it's quite
unlikely that your changes is causing the problem, as tda10023_writereg
was called from tda10023_attach before also, and you didn't change
anything in tda10023_writereg it self. I also know for a fact that the
i2c problems also did happen without your changes, so your changes isn't
the cause of that either.

About your changes to the tda10023 module, I tried these a while ago
(before they were merged into master, with a technotrend C-1501 board
that has a tda10023 demod with at tda8274a silicon tuner. I figured the
tuner had the same deltaf setting as the tuner used in anysee (based on
how this tuner is used in conjunction with tda10046), but I couldn't
figure out values for the pll_x parameters. I tried setting them to the
the same as the ones used in the anysee tree , but I couldn't get any
lock still, it may however be because my signal was bad at that point.
If I remember correctly your comments said something about an unknown
tuner used in the anysee device. Is there any chance it actually is the
tda827x? As this tuner-demod combo is sold as a refference design from
phillips.

Best Regards

Sigmund
> 
> regards
> Antti


_______________________________________________
linux-dvb mailing list
linux-dvb@linuxtv.org
http://www.linuxtv.org/cgi-bin/mailman/listinfo/linux-dvb

Re: [linux-dvb] Oops in tda10023

[Antti Palosaari]

Sigmund Augdal wrote:
> tor, 29.05.2008 kl. 20.52 +0300, skrev Antti Palosaari:
>> Sigmund Augdal wrote:
>>> using latest hg v4l-dvb on a 2.6.20 kernel.
>> I did some changes recently to tda10023 (needed for Anysee driver). I 
>> wonder if these errors start coming after that? Those changes are 
>> committed to master only few days ago, 05/26/2008.
> When the crash happened I was using a module with these changes
> included. This doesn't necessarily mean that these changes were the
> cause of the problem. From reading the relevant diff I'd say it's quite
> unlikely that your changes is causing the problem, as tda10023_writereg
> was called from tda10023_attach before also, and you didn't change
> anything in tda10023_writereg it self. I also know for a fact that the
> i2c problems also did happen without your changes, so your changes isn't
> the cause of that either.

Thanks for clarification.

> About your changes to the tda10023 module, I tried these a while ago
> (before they were merged into master, with a technotrend C-1501 board
> that has a tda10023 demod with at tda8274a silicon tuner. I figured the
> tuner had the same deltaf setting as the tuner used in anysee (based on
> how this tuner is used in conjunction with tda10046), but I couldn't
> figure out values for the pll_x parameters. I tried setting them to the
> the same as the ones used in the anysee tree , but I couldn't get any
> lock still, it may however be because my signal was bad at that point.
> If I remember correctly your comments said something about an unknown
> tuner used in the anysee device. Is there any chance it actually is the
> tda827x? As this tuner-demod combo is sold as a refference design from
> phillips.

It could be but I doubt it is not any Philips / NXP tuner PLL.

Every version of the Anysee has Samsung tuner module (or NIM which is 
module with demod inside). In NIMs there is MT532 or ZL10353 
demodulator. DVB-C version has Samsung tuner module + TDA10023 
demodulator on the board. So this is not tuner-demod combo (NIM) 
reference from NXP.

You can resolve correct PLL values looking from USB-sniffs. With a 
little lucky you discover those after some testing.

/* 012 */ 0x28, 0xff, (state->pll_m-1),
/* 015 */ 0x29, 0xff, ((state->pll_p-1)<<6)|(state->pll_n-1),
/* calc sysclk */
state->sysclk = (state->xtal * state->pll_m / \
		(state->pll_n * state->pll_p));

I can try to find those if you can provide usbsniff where those can seen.

regards
Antti
-- 
http://palosaari.fi/

_______________________________________________
linux-dvb mailing list
linux-dvb@linuxtv.org
http://www.linuxtv.org/cgi-bin/mailman/listinfo/linux-dvb

Re: [linux-dvb] Oops in tda10023

[e9hack]

Antti Palosaari schrieb:
> Sigmund Augdal wrote:
>> using latest hg v4l-dvb on a 2.6.20 kernel.
> 
> I did some changes recently to tda10023 (needed for Anysee driver). I 
> wonder if these errors start coming after that? Those changes are 
> committed to master only few days ago, 05/26/2008.

I think the oops occurs, because tda10023_writereg() fails in tda10023_attach(). If 
tda10023_writereg fails, an error message is printed. In this case, 
state->frontend.dvb->num is accessed, but it isn't initialized yet.

-Hartmut

_______________________________________________
linux-dvb mailing list
linux-dvb@linuxtv.org
http://www.linuxtv.org/cgi-bin/mailman/listinfo/linux-dvb

Re: [linux-dvb] Oops in tda10023

[Antti Palosaari]

e9hack wrote:
> Antti Palosaari schrieb:
>> Sigmund Augdal wrote:
>>> using latest hg v4l-dvb on a 2.6.20 kernel.
>> I did some changes recently to tda10023 (needed for Anysee driver). I 
>> wonder if these errors start coming after that? Those changes are 
>> committed to master only few days ago, 05/26/2008.
> 
> I think the oops occurs, because tda10023_writereg() fails in tda10023_attach(). If 
> tda10023_writereg fails, an error message is printed. In this case, 
> state->frontend.dvb->num is accessed, but it isn't initialized yet.

hmm, I see the problem now. Originally state was initialized before 
tda10023_writereg() was called but after I did some changes this is not 
done anymore. And when writereg() fails in attach some reason it oops.

Antti
-- 
http://palosaari.fi/

_______________________________________________
linux-dvb mailing list
linux-dvb@linuxtv.org
http://www.linuxtv.org/cgi-bin/mailman/listinfo/linux-dvb

Re: [linux-dvb] Oops in tda10023

[e9hack]

Antti Palosaari schrieb:
>> I think the oops occurs, because tda10023_writereg() fails in tda10023_attach(). If 
>> tda10023_writereg fails, an error message is printed. In this case, 
>> state->frontend.dvb->num is accessed, but it isn't initialized yet.
> 
> hmm, I see the problem now. Originally state was initialized before 
> tda10023_writereg() was called but after I did some changes this is not 
> done anymore. And when writereg() fails in attach some reason it oops.

It wasn't introduced with your modifications. The frontend.dvb part is initialized after 
the attach call. tda10023_writereg() must check, if state->frontend.dvb is initialized or 
not.

-Hartmut


_______________________________________________
linux-dvb mailing list
linux-dvb@linuxtv.org
http://www.linuxtv.org/cgi-bin/mailman/listinfo/linux-dvb

Re: [linux-dvb] Oops in tda10023

[Antti Palosaari]

e9hack wrote:
> Antti Palosaari schrieb:
>>> I think the oops occurs, because tda10023_writereg() fails in tda10023_attach(). If 
>>> tda10023_writereg fails, an error message is printed. In this case, 
>>> state->frontend.dvb->num is accessed, but it isn't initialized yet.
>> hmm, I see the problem now. Originally state was initialized before 
>> tda10023_writereg() was called but after I did some changes this is not 
>> done anymore. And when writereg() fails in attach some reason it oops.
> 
> It wasn't introduced with your modifications. The frontend.dvb part is initialized after 
> the attach call. tda10023_writereg() must check, if state->frontend.dvb is initialized or 
> not.

yeah, you are correct. I looked through all frontend drivers and only 
TDA10021 and TDA10023 was using dvb->num in writereg. Anyhow, TDA10021 
is not affected because it does not write in attach.

Antti

-- 
http://palosaari.fi/

_______________________________________________
linux-dvb mailing list
linux-dvb@linuxtv.org
http://www.linuxtv.org/cgi-bin/mailman/listinfo/linux-dvb

Re: [linux-dvb] Oops in tda10023

[Antti Palosaari]

Antti Palosaari wrote:
> e9hack wrote:
>> Antti Palosaari schrieb:
>>>> I think the oops occurs, because tda10023_writereg() fails in tda10023_attach(). If 
>>>> tda10023_writereg fails, an error message is printed. In this case, 
>>>> state->frontend.dvb->num is accessed, but it isn't initialized yet.
>>> hmm, I see the problem now. Originally state was initialized before 
>>> tda10023_writereg() was called but after I did some changes this is not 
>>> done anymore. And when writereg() fails in attach some reason it oops.
>> It wasn't introduced with your modifications. The frontend.dvb part is initialized after 
>> the attach call. tda10023_writereg() must check, if state->frontend.dvb is initialized or 
>> not.
> 
> yeah, you are correct. I looked through all frontend drivers and only 
> TDA10021 and TDA10023 was using dvb->num in writereg. Anyhow, TDA10021 
> is not affected because it does not write in attach.

TDA10023 uses writereg to wakeup from standby for reading chip id. I 
wonder if this is necessary at all. I will test that later.

Anyhow, I see there is two ways to fix that (only Oops from TDA10023, 
not issue why it actually fails):
1) remove state->frontend.dvb->num from tda10023_writereg()
2) remove wakeup if in standby from tda10023_attach()

Antti
-- 
http://palosaari.fi/

_______________________________________________
linux-dvb mailing list
linux-dvb@linuxtv.org
http://www.linuxtv.org/cgi-bin/mailman/listinfo/linux-dvb

Re: [linux-dvb] Oops in tda10023

[e9hack]

Antti Palosaari schrieb:
> Anyhow, I see there is two ways to fix that (only Oops from TDA10023, 
> not issue why it actually fails):
> 1) remove state->frontend.dvb->num from tda10023_writereg()
> 2) remove wakeup if in standby from tda10023_attach()

I wouldn't prefer #1, because it is very useful to know the adapter number, if one card 
sucks and it exist another one. Usually, it isn't necessary to wakeup the tda10023 for 
reading the id. A third option is the following patch:

diff -r 398b07fdfe79 linux/drivers/media/dvb/frontends/tda10023.c
--- a/linux/drivers/media/dvb/frontends/tda10023.c      Wed May 28 17:55:13 2008 -0300
+++ b/linux/drivers/media/dvb/frontends/tda10023.c      Fri May 30 23:02:55 2008 +0200
@@ -90,7 +90,7 @@ static int tda10023_writereg (struct tda
         if (ret != 1)
                 printk("DVB: TDA10023(%d): %s, writereg error "
                         "(reg == 0x%02x, val == 0x%02x, ret == %i)\n",
-                       state->frontend.dvb->num, __func__, reg, data, ret);
+                       state->frontend.dvb ? state->frontend.dvb->num : '?', __func__, 
reg, data, ret);

         return (ret != 1) ? -EREMOTEIO : 0;
  }
@@ -481,7 +481,7 @@ struct dvb_frontend *tda10023_attach(con
         struct tda10023_state* state = NULL;

         /* allocate memory for the internal state */
-       state = kmalloc(sizeof(struct tda10023_state), GFP_KERNEL);
+       state = kzalloc(sizeof(struct tda10023_state), GFP_KERNEL);
         if (state == NULL) goto error;

         /* setup the state */

-Hartmut

_______________________________________________
linux-dvb mailing list
linux-dvb@linuxtv.org
http://www.linuxtv.org/cgi-bin/mailman/listinfo/linux-dvb

Re: [linux-dvb] Oops in tda10023

[Oliver Endriss]

e9hack wrote:
> A third option is the following patch:

Ack for this one.

> diff -r 398b07fdfe79 linux/drivers/media/dvb/frontends/tda10023.c
> --- a/linux/drivers/media/dvb/frontends/tda10023.c      Wed May 28 17:55:13 2008 -0300
> +++ b/linux/drivers/media/dvb/frontends/tda10023.c      Fri May 30 23:02:55 2008 +0200
> @@ -90,7 +90,7 @@ static int tda10023_writereg (struct tda
>          if (ret != 1)
>                  printk("DVB: TDA10023(%d): %s, writereg error "
>                          "(reg == 0x%02x, val == 0x%02x, ret == %i)\n",
> -                       state->frontend.dvb->num, __func__, reg, data, ret);
> +                       state->frontend.dvb ? state->frontend.dvb->num : '?', __func__, 

Please replace '?' by -1.

Btw, the same code should be added to tda10023_readreg to print the
adapter number there.

CU
Oliver

-- 
----------------------------------------------------------------
VDR Remote Plugin 0.4.0: http://www.escape-edv.de/endriss/vdr/
----------------------------------------------------------------

_______________________________________________
linux-dvb mailing list
linux-dvb@linuxtv.org
http://www.linuxtv.org/cgi-bin/mailman/listinfo/linux-dvb