2.6.25-rc[12] Video4Linux Bttv Regression

The bttv driver seems to be experiencing problems in the 2.6.25-rcX kernels. I have the divided by error that Robert Fitzsimons has already reported (I'll test his patch and see if it fixes it for me) and I have the following Oops when I try to use the radio:

BUG: unable to handle kernel NULL pointer dereference at 0000000000000000
IP: [<ffffffff8045723d>] __mutex_lock_slowpath+0x3b/0xb2
PGD 67671067 PUD 63f47067 PMD 0
Oops: 0002 [1] PREEMPT SMP
CPU 0
Modules linked in: snd_seq_dummy snd_seq_oss snd_seq_midi_event snd_seq 

binfmt_misc loop nls_cp437 vfat fat nls_iso8859_1 ntfs dm_mod thermal processor fan container button pcspkr snd_pcm_oss snd_mixer_oss tuner tea5767 tda8290 tuner_xc2028 tda9887 tuner_simple mt20xx tea5761 snd_emu10k1 snd_rawmidi bttv snd_ac97_codec videodev ac97_bus v4l1_compat snd_pcm ir_common firewire_ohci firewire_core snd_seq_device compat_ioctl32 snd_timer uhci_hcd ehci_hcd v4l2_common ide_cd_mod crc_itu_t snd_page_alloc usbcore videobuf_dma_sg snd_util_mem videobuf_core ohci1394 btcx_risc i2c_viapro sr_mod snd_hwdep ieee1394 emu10k1_gp snd tg3 cdrom tveeprom gameport sg evdev soundcore
Pid: 7197, comm: radio Tainted: G M 2.6.25-rc1 #20

RIP: 0010:[<ffffffff8045723d>]  [<ffffffff8045723d>] 
__mutex_lock_slowpath+0x3b/0xb2
RSP: 0018:ffff81007df515e8  EFLAGS: 00010246
RAX: ffff81007f13ef10 RBX: ffff81007f13ef08 RCX: 0000000000000000
RDX: ffff81007df515e8 RSI: ffffffff88184050 RDI: ffff81007f13ef0c
RBP: ffff81007df51628 R08: 0000000000000004 R09: ffff81007df51aa8
R10: ffff81007e680a40 R11: 0000000000000202 R12: ffff81007f13ef0c
R13: ffff81007f13ef08 R14: ffff810063cfc040 R15: ffffffff88184050
FS:  00007fa8d92ba6f0(0000) GS:ffffffff805b2000(0000) knlGS:00000000f61fb980
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 00000000676dc000 CR4: 00000000000006e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Process radio (pid: 7197, threadinfo ffff81007df50000, task ffff810063cfc040)
Stack:  ffff81007f13ef10 0005049900000000 018060f7018060fa 0000000000000024
 ffff81007df51aa8 ffff81007f13e800 ffff81007f13ef08 ffff81007e0e5800
 ffff81007df51638 ffffffff80457083 ffff81007df51668 ffffffff88162f2f
Call Trace:
 [<ffffffff80457083>] mutex_lock+0xe/0x10
 [<ffffffff88162f2f>] :bttv:radio_g_tuner+0x40/0xa6
 [<ffffffff8813df7d>] :videodev:__video_do_ioctl+0x2a6e/0x2e25
 [<ffffffff8813503c>] :v4l1_compat:v4l_compat_translate_ioctl+0xea9/0x1af5
 [<ffffffff8813b50f>] ? :videodev:__video_do_ioctl+0x0/0x2e25
 [<ffffffff80301f4b>] ? blk_recount_segments+0x3e/0x62
 [<ffffffff80260f7b>] ? mempool_alloc_slab+0x11/0x13
 [<ffffffff80261085>] ? mempool_alloc+0x48/0xf9
 [<ffffffff802e3369>] ? ext3_get_acl+0x87/0x332
 [<ffffffff80296c65>] ? __d_lookup+0x125/0x137
 [<ffffffff8028d54f>] ? do_lookup+0x63/0x1b1
 [<ffffffff802961c3>] ? dput+0x22/0x120
 [<ffffffff8028f6a6>] ? __link_path_walk+0xbbd/0xd1b
 [<ffffffff802e3369>] ? ext3_get_acl+0x87/0x332
 [<ffffffff802115d1>] ? native_read_tsc+0x11/0x22
 [<ffffffff80310e1b>] ? __delay+0x27/0x59

last message repeated 2 times
[<ffffffff80310ecf>] ? __udelay+0x40/0x42 [<ffffffff803c0950>] ? i2c_stop+0x47/0x4b [<ffffffff803c1117>] ? bit_xfer+0x412/0x423 [<ffffffff803bef99>] ? i2c_transfer+0x79/0x85 [<ffffffff881cc31c>] ? :tuner_simple:simple_set_params+0x2bd/0xc1c [<ffffffff80284607>] ? get_unused_fd_flags+0x10d/0x11c [<ffffffff8029965b>] ? touch_atime+0xe3/0xec [<ffffffff8029b113>] ? mntput_no_expire+0x20/0x8f [<ffffffff881e3447>] ? :tuner:fe_set_params+0x46/0x48 [<ffffffff881e285c>] ? :tuner:set_radio_freq+0x159/0x162 [<ffffffff80449dfb>] ? klist_dec_and_del+0x14/0x16 [<ffffffff80449e68>] ? klist_next+0x6b/0x8a [<ffffffff803c075a>] ? i2c_cmd+0x0/0x3e [<ffffffff8037c62f>] ? device_for_each_child+0x4c/0x5c [<ffffffff8813b648>] :videodev:__video_do_ioctl+0x139/0x2e25 [<ffffffff88168b56>] ? :bttv:bttv_call_i2c_clients+0x16/0x18 [<ffffffff88161ed2>] ? :bttv:audio_mux+0x105/0x1b5 [<ffffffff80260d39>] ? filemap_fault+0x1fe/0x371 [<ffffffff8813e6d4>] :videodev:video_ioctl2+0x1b8/0x259 [<ffffffff8026dc63>] ? handle_mm_fault+0x341/0x697

 [<ffffffff80291c36>] vfs_ioctl+0x5e/0x77
 [<ffffffff80291e9c>] do_vfs_ioctl+0x24d/0x262
 [<ffffffff8045a9d7>] ? do_page_fault+0x434/0x7aa
 [<ffffffff80291ef3>] sys_ioctl+0x42/0x67
 [<ffffffff8020b36b>] system_call_after_swapgs+0x7b/0x80
Feb 15 08:42:03 bongani64 kernel:
Feb 15 08:42:03 bongani64 kernel:
Code: 89 fb 4c 89 e7 48 83 ec 20 65 4c 8b 34 25 00 00 00 00 e8 19 12 00 00 48 

8d 43 08 48 8d 55 c0 48 8b 48 08 48 89 45 c0 48 89 50 08 <48> 89 11 48 83 ca ff 48 89 4d c8 4c 89 75 d0 48 89 d0 87 03 ff
RIP [<ffffffff8045723d>] __mutex_lock_slowpath+0x3b/0xb2
RSP <ffff81007df515e8>
CR2: 0000000000000000

---[ end trace fdf145f4fc51dccd ]---

note: radio[7197] exited with preempt_count 1

Have you tested Robert's patch?

I can't see anything wrong on bttv_g_tuner lock. I suspect that the divide error caused some bad effects at some data on bttv.

I've already applied his fix to my -git tree:

http://git.kernel.org/?p=linux/kernel/git/mchehab/v4l-dvb.git

Hopefully, Linus will pull soon the fixes there.

Cheers,
Mauro

--
video4linux-list mailing list
Unsubscribe mailto:[email protected]?subject=unsubscribe
https://www.redhat.com/mailman/listinfo/video4linux-list

Sorry almost forgot, I have and it fixes the TV but not the radio.

The problems don't seem related because one is caused by opening the "radio"
application, the divide error is caused by using a TV viewing application (I tried fbtv)

Thanx, I'll try to bisect

I tried to bisect but the V4L/DVB changes are not bisect friendly, on two occursions I just selected "git bisect bad" because the bttv driver wouldn't compile, so I couldn't pin-point what causes the oops and hang.

Here are some few observations I made though (I started bisecting between 2.6.24 and 2.6.25-rc1, saved me ~1000 commits):
1. On the third bisect, there's no oops my PC just hangs a I can't use any open terminals
2. When I reached the V4L/DVB changes, my PC did not hag or oops, the radio just didn't work (something about invalid VID**AUD**). This made it harder to bisect, because it is not working and not breaking so is it good or bad...

Cheers

Bisecting this won't be that easy. The support for the depreciated V4L1 API were removed from bttv driver. Now, it uses v4l1-compat module, that translates a V4L1 call into a V4L2 one. I'll try to seek for troubles at the current code.

Cheers,
Mauro

--
video4linux-list mailing list
Unsubscribe mailto:[email protected]?subject=unsubscribe
https://www.redhat.com/mailman/listinfo/video4linux-list

More info add Ingo to CC, maybe he can explain what might cause such failure in the mutex code (sorry Ingo, I need to bother you once more)

Ingo:

I got the oops bellow whilst using the radio functionality of the bttv-drivers, nothing seems obvious except that I dies while calling __mutex_lock_slowpath. I've been trying to follow Linus' and Al's advise on oops tracing and I got as far as the _spin_lock code:

BUG: unable to handle kernel NULL pointer dereference at 0000000000000000
IP: [<ffffffff8045723d>] __mutex_lock_slowpath+0x3b/0xb2
PGD 67671067 PUD 63f47067 PMD 0
Oops: 0002 [1] PREEMPT SMP
CPU 0
Modules linked in: snd_seq_dummy snd_seq_oss snd_seq_midi_event snd_seq 

binfmt_misc loop nls_cp437 vfat fat nls_iso8859_1 ntfs dm_mod thermal processor fan container button pcspkr snd_pcm_oss snd_mixer_oss tuner tea5767 tda8290 tuner_xc2028 tda9887 tuner_simple mt20xx tea5761 snd_emu10k1 snd_rawmidi bttv snd_ac97_codec videodev ac97_bus v4l1_compat snd_pcm ir_common firewire_ohci firewire_core snd_seq_device compat_ioctl32 snd_timer uhci_hcd ehci_hcd v4l2_common ide_cd_mod crc_itu_t snd_page_alloc usbcore videobuf_dma_sg snd_util_mem videobuf_core ohci1394 btcx_risc i2c_viapro sr_mod snd_hwdep ieee1394 emu10k1_gp snd tg3 cdrom tveeprom gameport sg evdev soundcore
Pid: 7197, comm: radio Tainted: G M 2.6.25-rc1 #20

RIP: 0010:[<ffffffff8045723d>]  [<ffffffff8045723d>] 
__mutex_lock_slowpath+0x3b/0xb2
RSP: 0018:ffff81007df515e8  EFLAGS: 00010246
RAX: ffff81007f13ef10 RBX: ffff81007f13ef08 RCX: 0000000000000000
RDX: ffff81007df515e8 RSI: ffffffff88184050 RDI: ffff81007f13ef0c
RBP: ffff81007df51628 R08: 0000000000000004 R09: ffff81007df51aa8
R10: ffff81007e680a40 R11: 0000000000000202 R12: ffff81007f13ef0c
R13: ffff81007f13ef08 R14: ffff810063cfc040 R15: ffffffff88184050
FS:  00007fa8d92ba6f0(0000) GS:ffffffff805b2000(0000) knlGS:00000000f61fb980
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 00000000676dc000 CR4: 00000000000006e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Process radio (pid: 7197, threadinfo ffff81007df50000, task ffff810063cfc040)
Stack:  ffff81007f13ef10 0005049900000000 018060f7018060fa 0000000000000024
 ffff81007df51aa8 ffff81007f13e800 ffff81007f13ef08 ffff81007e0e5800
 ffff81007df51638 ffffffff80457083 ffff81007df51668 ffffffff88162f2f
Call Trace:
 [<ffffffff80457083>] 
 [<ffffffff88162f2f>] :bttv:radio_g_tuner+0x40/0xa6
 [<ffffffff8813df7d>] :videodev:__video_do_ioctl+0x2a6e/0x2e25
 [<ffffffff8813503c>] :v4l1_compat:v4l_compat_translate_ioctl+0xea9/0x1af5
 [<ffffffff8813b50f>] ? :videodev:__video_do_ioctl+0x0/0x2e25
 [<ffffffff80301f4b>] ? blk_recount_segments+0x3e/0x62
 [<ffffffff80260f7b>] ? mempool_alloc_slab+0x11/0x13
 [<ffffffff80261085>] ? mempool_alloc+0x48/0xf9
 [<ffffffff802e3369>] ? ext3_get_acl+0x87/0x332
 [<ffffffff80296c65>] ? __d_lookup+0x125/0x137
 [<ffffffff8028d54f>] ? do_lookup+0x63/0x1b1
 [<ffffffff802961c3>] ? dput+0x22/0x120
 [<ffffffff8028f6a6>] ? __link_path_walk+0xbbd/0xd1b
 [<ffffffff802e3369>] ? ext3_get_acl+0x87/0x332
 [<ffffffff802115d1>] ? native_read_tsc+0x11/0x22
 [<ffffffff80310e1b>] ? __delay+0x27/0x59

last message repeated 2 times
[<ffffffff80310ecf>] ? __udelay+0x40/0x42 [<ffffffff803c0950>] ? i2c_stop+0x47/0x4b [<ffffffff803c1117>] ? bit_xfer+0x412/0x423 [<ffffffff803bef99>] ? i2c_transfer+0x79/0x85 [<ffffffff881cc31c>] ? :tuner_simple:simple_set_params+0x2bd/0xc1c [<ffffffff80284607>] ? get_unused_fd_flags+0x10d/0x11c [<ffffffff8029965b>] ? touch_atime+0xe3/0xec [<ffffffff8029b113>] ? mntput_no_expire+0x20/0x8f [<ffffffff881e3447>] ? :tuner:fe_set_params+0x46/0x48 [<ffffffff881e285c>] ? :tuner:set_radio_freq+0x159/0x162 [<ffffffff80449dfb>] ? klist_dec_and_del+0x14/0x16 [<ffffffff80449e68>] ? klist_next+0x6b/0x8a [<ffffffff803c075a>] ? i2c_cmd+0x0/0x3e [<ffffffff8037c62f>] ? device_for_each_child+0x4c/0x5c [<ffffffff8813b648>] :videodev:__video_do_ioctl+0x139/0x2e25 [<ffffffff88168b56>] ? :bttv:bttv_call_i2c_clients+0x16/0x18 [<ffffffff88161ed2>] ? :bttv:audio_mux+0x105/0x1b5 [<ffffffff80260d39>] ? filemap_fault+0x1fe/0x371 [<ffffffff8813e6d4>] :videodev:video_ioctl2+0x1b8/0x259 [<ffffffff8026dc63>] ? handle_mm_fault+0x341/0x697

 [<ffffffff80291c36>] vfs_ioctl+0x5e/0x77
 [<ffffffff80291e9c>] do_vfs_ioctl+0x24d/0x262
 [<ffffffff8045a9d7>] ? do_page_fault+0x434/0x7aa
 [<ffffffff80291ef3>] sys_ioctl+0x42/0x67
 [<ffffffff8020b36b>] system_call_after_swapgs+0x7b/0x80
Feb 15 08:42:03 bongani64 kernel:
Feb 15 08:42:03 bongani64 kernel:
Code: 89 fb 4c 89 e7 48 83 ec 20 65 4c 8b 34 25 00 00 00 00 e8 19 12 00 00 48 

8d 43 08 48 8d 55 c0 48 8b 48 08 48 89 45 c0 48 89 50 08 <48> 89 11 48 83 ca ff 48 89 4d c8 4c 89 75 d0 48 89 d0 87 03 ff
RIP [<ffffffff8045723d>] __mutex_lock_slowpath+0x3b/0xb2
RSP <ffff81007df515e8>
CR2: 0000000000000000

---[ end trace fdf145f4fc51dccd ]---

note: radio[7197] exited with preempt_count 1

Code dissamble:

0x4005c0 <array>:       mov    %edi,%ebx
0x4005c2 <array+2>:     mov    %r12,%rdi
0x4005c5 <array+5>:     sub    $0x20,%rsp
0x4005c9 <array+9>:     mov    %gs:0x0,%r14
0x4005d2 <array+18>:    callq  0x4017f0
0x4005d7 <array+23>:    lea    0x8(%rbx),%rax
0x4005db <array+27>:    lea    0xffffffffffffffc0(%rbp),%rdx
0x4005df <array+31>:    mov    0x8(%rax),%rcx
0x4005e3 <array+35>:    mov    %rax,0xffffffffffffffc0(%rbp)
0x4005e7 <array+39>:    mov    %rdx,0x8(%rax)
0x4005eb <array+43>:    mov    %rdx,(%rcx) 	<============= Here
0x4005ee <array+46>:    or     $0xffffffffffffffff,%rdx
0x4005f2 <array+50>:    mov    %rcx,0xffffffffffffffc8(%rbp)
0x4005f6 <array+54>:    mov    %r14,0xffffffffffffffd0(%rbp)
0x4005fa <array+58>:    mov    %rdx,%rax
0x4005fd <array+61>:    xchg   %eax,(%rbx)
0x4005ff <array+63>:    incl   (%rax)
0x400601:       and    $0xa70,%eax
0x400606:       add    %al,(%rax)
0x400608:       add    %ebx,(%rbx)

kernel/mutext.c dissamble:

__mutex_lock_slowpath:

        pushq   %rbp    #
        movq    %rsp, %rbp      #,
        pushq   %r14    #
        pushq   %r13    #
        pushq   %r12    #
        leaq    4(%rdi), %r12   #, D.13845
        pushq   %rbx    #
        movq    %rdi, %rbx      # lock_count, lock
        movq    %r12, %rdi      # D.13845, D.13845
        subq    $32, %rsp       #,
#APP
        movq %gs:0,%r14 #, tsk
#NO_APP
        call    _spin_lock      #
        leaq    8(%rbx), %rax   #, next
        leaq    -64(%rbp), %rdx #, tmp81
        movq    8(%rax), %rcx   # <variable>.prev, prev
        movq    %rax, -64(%rbp) # next, waiter.list.next
        movq    %rdx, 8(%rax)   # tmp81, <variable>.prev
        movq    %rdx, (%rcx)    # tmp81, <variable>.next <========= Here
        orq     $-1, %rdx       #, tmp83
        movq    %rcx, -56(%rbp) # prev, waiter.list.prev
        movq    %r14, -48(%rbp) # tsk, waiter.task
        movq    %rdx, %rax      # tmp83, x

Hope this helps

I've enabled MUTEX and SPINLOCK DEBUG, this is what I get

------------[ cut here ]------------
WARNING: at /home/bongani/kernel/git/linux-2.6/kernel/mutex.c:134 
mutex_lock_nested+0xc0/0x2a3()
Modules linked in: snd_seq_dummy snd_seq_oss snd_seq_midi_event snd_seq 

binfmt_misc loop nls_cp437 vfat fat nls_iso8859_1 ntfs dm_mod thermal processor fan container button pcspkr snd_pcm_oss snd_mixer_oss tuner snd_emu10k1 tea5767 tda8290 tuner_xc2028 tda9887 tuner_simple snd_rawmidi mt20xx snd_ac97_codec tea5761 ac97_bus snd_pcm bttv snd_seq_device snd_timer firewire_ohci videodev snd_page_alloc firewire_core v4l1_compat snd_util_mem uhci_hcd ehci_hcd ir_common snd_hwdep ide_cd_mod compat_ioctl32 crc_itu_t usbcore snd sr_mod v4l2_common ohci1394 videobuf_dma_sg cdrom ieee1394 i2c_viapro videobuf_core emu10k1_gp tg3 btcx_risc gameport soundcore tveeprom sg evdev
Pid: 4563, comm: radio Not tainted 2.6.25-rc2-00015-g1309d4e #36 kernel:

Call Trace:
 [<ffffffff802324a3>] warn_on_slowpath+0x58/0x6b
 [<ffffffff80211799>] ? native_sched_clock+0x4d/0x6c
 [<ffffffff8024eb31>] ? get_lock_stats+0x16/0x49
 [<ffffffff8024eb72>] ? put_lock_stats+0xe/0x27
 [<ffffffff8024ebe1>] ? lock_release_holdtime+0x56/0x5e
 [<ffffffff8039a269>] ? ide_dma_intr+0x0/0x8f
 [<ffffffff80211799>] ? native_sched_clock+0x4d/0x6c
 [<ffffffff8046482e>] mutex_lock_nested+0xc0/0x2a3
 [<ffffffff88133f3f>] ? :bttv:radio_g_tuner+0x42/0xa8
 [<ffffffff802203de>] ? virt_to_highmap+0x9/0x18
 [<ffffffff80220566>] ? __change_page_attr+0x179/0x697
 [<ffffffff88133f3f>] :bttv:radio_g_tuner+0x42/0xa8
 [<ffffffff88118f83>] :videodev:__video_do_ioctl+0x2a6e/0x2e25
 [<ffffffff80220af0>] ? __change_page_attr_set_clr+0x6c/0xc0
 [<ffffffff80220d2d>] ? kernel_map_pages+0x130/0x13b
 [<ffffffff8810103c>] :v4l1_compat:v4l_compat_translate_ioctl+0xea9/0x1af5
 [<ffffffff88116515>] ? :videodev:__video_do_ioctl+0x0/0x2e25
 [<ffffffff802203de>] ? virt_to_highmap+0x9/0x18
 [<ffffffff80220566>] ? __change_page_attr+0x179/0x697
 [<ffffffff802afb2e>] ? __find_get_block+0x171/0x183
 [<ffffffff802203de>] ? virt_to_highmap+0x9/0x18
 [<ffffffff80220566>] ? __change_page_attr+0x179/0x697
 [<ffffffff80220af0>] ? __change_page_attr_set_clr+0x6c/0xc0
 [<ffffffff8026895f>] ? mempool_alloc_slab+0x11/0x13
 [<ffffffff80211799>] ? native_sched_clock+0x4d/0x6c
 [<ffffffff80250dfb>] ? mark_held_locks+0x59/0x75
 [<ffffffff804659dd>] ? trace_hardirqs_on_thunk+0x35/0x3a
 [<ffffffff80250fa5>] ? trace_hardirqs_on+0xf9/0x124
 [<ffffffff804659dd>] ? trace_hardirqs_on_thunk+0x35/0x3a
 [<ffffffff80211799>] ? native_sched_clock+0x4d/0x6c
 [<ffffffff8020b9c3>] ? restore_args+0x0/0x3d
 [<ffffffff8031bbe7>] ? __delay+0x33/0x4f

last message repeated 2 times
[<ffffffff80211799>] ? native_sched_clock+0x4d/0x6c [<ffffffff8024eb31>] ? get_lock_stats+0x16/0x49 [<ffffffff8024eb72>] ? put_lock_stats+0xe/0x27 [<ffffffff80250dfb>] ? mark_held_locks+0x59/0x75 [<ffffffff80464740>] ? __mutex_unlock_slowpath+0xf9/0x11c [<ffffffff80250fa5>] ? trace_hardirqs_on+0xf9/0x124 [<ffffffff80211799>] ? native_sched_clock+0x4d/0x6c [<ffffffff802520d7>] ? __lock_acquire+0xc93/0xcb4 [<ffffffff80211799>] ? native_sched_clock+0x4d/0x6c [<ffffffff8024eb31>] ? get_lock_stats+0x16/0x49 [<ffffffff8024eb72>] ? put_lock_stats+0xe/0x27 [<ffffffff8024ebe1>] ? lock_release_holdtime+0x56/0x5e [<ffffffff80211799>] ? native_sched_clock+0x4d/0x6c [<ffffffff802520d7>] ? __lock_acquire+0xc93/0xcb4 [<ffffffff80211799>] ? native_sched_clock+0x4d/0x6c [<ffffffff8024eb31>] ? get_lock_stats+0x16/0x49 [<ffffffff8024eb72>] ? put_lock_stats+0xe/0x27 [<ffffffff8811664e>] :videodev:__video_do_ioctl+0x139/0x2e25 [<ffffffff802520d7>] ? __lock_acquire+0xc93/0xcb4 [<ffffffff80211799>] ? native_sched_clock+0x4d/0x6c [<ffffffff8024eb72>] ? put_lock_stats+0xe/0x27 [<ffffffff8024ebe1>] ? lock_release_holdtime+0x56/0x5e [<ffffffff80211799>] ? native_sched_clock+0x4d/0x6c [<ffffffff881196b1>] :videodev:video_ioctl2+0x1b8/0x259 [<ffffffff8046668b>] ? _spin_unlock_irqrestore+0x3f/0x68 [<ffffffff80250fa5>] ? trace_hardirqs_on+0xf9/0x124

 [<ffffffff8029b22e>] vfs_ioctl+0x5e/0x77
 [<ffffffff8029b4a2>] do_vfs_ioctl+0x25b/0x270
 [<ffffffff804659dd>] ? trace_hardirqs_on_thunk+0x35/0x3a
 [<ffffffff8029b4f9>] sys_ioctl+0x42/0x65
 [<ffffffff8020b36b>] system_call_after_swapgs+0x7b/0x80
kernel:
---[ end trace bb0fc13470ac3add ]---
BUG: unable to handle kernel NULL pointer dereference at 0000000000000000
IP: [<ffffffff8031f5d4>] __list_add+0x2e/0x5b
PGD 68e90067 PUD 6833a067 PMD 0
Oops: 0000 [1] PREEMPT SMP DEBUG_PAGEALLOC
CPU 1
Modules linked in: snd_seq_dummy snd_seq_oss snd_seq_midi_event snd_seq 

binfmt_misc loop nls_cp437 vfat fat nls_iso8859_1 ntfs dm_mod thermal processor fan container button pcspkr snd_pcm_oss snd_mixer_oss tuner snd_emu10k1 tea5767 tda8290 tuner_xc2028 tda9887 tuner_simple snd_rawmidi mt20xx snd_ac97_codec tea5761 ac97_bus snd_pcm bttv snd_seq_device snd_timer firewire_ohci videodev snd_page_alloc firewire_core v4l1_compat snd_util_mem uhci_hcd ehci_hcd ir_common snd_hwdep ide_cd_mod compat_ioctl32 crc_itu_t usbcore snd sr_mod v4l2_common ohci1394 videobuf_dma_sg cdrom ieee1394 i2c_viapro videobuf_core emu10k1_gp tg3 btcx_risc gameport soundcore tveeprom sg evdev
Pid: 4563, comm: radio Not tainted 2.6.25-rc2-00015-g1309d4e #36

RIP: 0010:[<ffffffff8031f5d4>]  [<ffffffff8031f5d4>] __list_add+0x2e/0x5b
RSP: 0018:ffff81005231d5b8  EFLAGS: 00010046
RAX: 0000000000000000 RBX: ffffffffffffffff RCX: 0000000000000000
RDX: ffff81007f2bc378 RSI: ffff81007f2bc378 RDI: ffff81005231d5d8
RBP: ffff81005231d5b8 R08: 0000000000000000 R09: 0000000000000001
R10: ffff81005231d2d8 R11: 0000000000007420 R12: ffff81007f2bc338
R13: 0000000000000246 R14: ffff81007f2bc3a0 R15: ffff81005da847c0
FS:  00007f3c348aa6f0(0000) GS:ffff81007f0554c8(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 0000000075c6e000 CR4: 00000000000006e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Process radio (pid: 4563, threadinfo ffff81005231c000, task ffff81005da847c0)
Stack:  ffff81005231d638 ffffffff8046487f ffffffff88133f3f 000000005da84808
 ffff81005231d5d8 ffff81005231d5d8 1111111111111111 ffff81007f2bc338
 ffff81005231d5d8 ffff81006002d000 ffff81005231d6e8 ffff81005231daa8
Call Trace:
 [<ffffffff8046487f>] mutex_lock_nested+0x111/0x2a3
 [<ffffffff88133f3f>] ? :bttv:radio_g_tuner+0x42/0xa8
 [<ffffffff88133f3f>] :bttv:radio_g_tuner+0x42/0xa8
 [<ffffffff88118f83>] :videodev:__video_do_ioctl+0x2a6e/0x2e25
 [<ffffffff80220af0>] ? __change_page_attr_set_clr+0x6c/0xc0
 [<ffffffff80220d2d>] ? kernel_map_pages+0x130/0x13b
 [<ffffffff8810103c>] :v4l1_compat:v4l_compat_translate_ioctl+0xea9/0x1af5
 [<ffffffff88116515>] ? :videodev:__video_do_ioctl+0x0/0x2e25
 [<ffffffff802203de>] ? virt_to_highmap+0x9/0x18
 [<ffffffff80220566>] ? __change_page_attr+0x179/0x697
 [<ffffffff802afb2e>] ? __find_get_block+0x171/0x183
 [<ffffffff802203de>] ? virt_to_highmap+0x9/0x18
 [<ffffffff80220566>] ? __change_page_attr+0x179/0x697
 [<ffffffff80220af0>] ? __change_page_attr_set_clr+0x6c/0xc0
 [<ffffffff8026895f>] ? mempool_alloc_slab+0x11/0x13
 [<ffffffff80211799>] ? native_sched_clock+0x4d/0x6c
 [<ffffffff80250dfb>] ? mark_held_locks+0x59/0x75
 [<ffffffff804659dd>] ? trace_hardirqs_on_thunk+0x35/0x3a
 [<ffffffff80250fa5>] ? trace_hardirqs_on+0xf9/0x124
 [<ffffffff804659dd>] ? trace_hardirqs_on_thunk+0x35/0x3a
 [<ffffffff80211799>] ? native_sched_clock+0x4d/0x6c
 [<ffffffff8020b9c3>] ? restore_args+0x0/0x3d
 [<ffffffff8031bbe7>] ? __delay+0x33/0x4f

last message repeated 2 times
[<ffffffff80211799>] ? native_sched_clock+0x4d/0x6c [<ffffffff8024eb31>] ? get_lock_stats+0x16/0x49 [<ffffffff8024eb72>] ? put_lock_stats+0xe/0x27 [<ffffffff80250dfb>] ? mark_held_locks+0x59/0x75 [<ffffffff80464740>] ? __mutex_unlock_slowpath+0xf9/0x11c [<ffffffff80250fa5>] ? trace_hardirqs_on+0xf9/0x124 [<ffffffff80211799>] ? native_sched_clock+0x4d/0x6c [<ffffffff802520d7>] ? __lock_acquire+0xc93/0xcb4 [<ffffffff80211799>] ? native_sched_clock+0x4d/0x6c [<ffffffff8024eb31>] ? get_lock_stats+0x16/0x49 [<ffffffff8024eb72>] ? put_lock_stats+0xe/0x27 [<ffffffff8024ebe1>] ? lock_release_holdtime+0x56/0x5e [<ffffffff80211799>] ? native_sched_clock+0x4d/0x6c [<ffffffff802520d7>] ? __lock_acquire+0xc93/0xcb4 [<ffffffff80211799>] ? native_sched_clock+0x4d/0x6c [<ffffffff8024eb31>] ? get_lock_stats+0x16/0x49 [<ffffffff8024eb72>] ? put_lock_stats+0xe/0x27 [<ffffffff8811664e>] :videodev:__video_do_ioctl+0x139/0x2e25 [<ffffffff802520d7>] ? __lock_acquire+0xc93/0xcb4 [<ffffffff80211799>] ? native_sched_clock+0x4d/0x6c [<ffffffff8024eb72>] ? put_lock_stats+0xe/0x27 [<ffffffff8024ebe1>] ? lock_release_holdtime+0x56/0x5e [<ffffffff80211799>] ? native_sched_clock+0x4d/0x6c [<ffffffff881196b1>] :videodev:video_ioctl2+0x1b8/0x259 [<ffffffff8046668b>] ? _spin_unlock_irqrestore+0x3f/0x68 [<ffffffff80250fa5>] ? trace_hardirqs_on+0xf9/0x124

 [<ffffffff8029b22e>] vfs_ioctl+0x5e/0x77
 [<ffffffff8029b4a2>] do_vfs_ioctl+0x25b/0x270
 [<ffffffff804659dd>] ? trace_hardirqs_on_thunk+0x35/0x3a
 [<ffffffff8029b4f9>] sys_ioctl+0x42/0x65
 [<ffffffff8020b36b>] system_call_after_swapgs+0x7b/0x80
kernel:
kernel:
Code: 42 08 49 89 f0 48 89 d6 48 89 e5 4c 39 c0 74 1b 48 89 d1 4c 89 c6 48 89 

c2 48 c7 c7 b4 ed 54 80 31 c0 e8 6d 3d f1 ff 0f 0b eb fe <48> 8b 10 48 39 f2 74 15 48 89 c1 48 c7 c7 04 ee 54 80 31 c0 e8
RIP [<ffffffff8031f5d4>] __list_add+0x2e/0x5b
RSP <ffff81005231d5b8>
CR2: 0000000000000000

---[ end trace bb0fc13470ac3add ]---

BUG: sleeping function called from invalid context 
at /home/bongani/kernel/git/linux-2.6/kernel/rwsem.c:21
in_atomic():0, irqs_disabled():1
INFO: lockdep is turned off.
irq event stamp: 7544
hardirqs last  enabled at (7543): [<ffffffff804659dd>] 
trace_hardirqs_on_thunk+0x35/0x3a
hardirqs last disabled at (7544): [<ffffffff804647ea>] 
mutex_lock_nested+0x7c/0x2a3
softirqs last  enabled at (7516): [<ffffffff802377c7>] __do_softirq+0xbf/0xc8
softirqs last disabled at (7511): [<ffffffff8020c65c>] call_softirq+0x1c/0x28
Pid: 4563, comm: radio Tainted: G      D  2.6.25-rc2-00015-g1309d4e #36
kernel:
Call Trace:
 [<ffffffff8024e6bf>] ? print_irqtrace_events+0x110/0x114
 [<ffffffff80229c52>] __might_sleep+0xda/0xdc
 [<ffffffff80464ecf>] down_read+0x20/0x68
 [<ffffffff802604ed>] acct_collect+0x42/0x1a9
 [<ffffffff80235bfe>] do_exit+0x20a/0x6f3
 [<ffffffff8036be33>] ? do_unblank_screen+0x29/0x125
 [<ffffffff80466eae>] oops_begin+0x0/0x95
 [<ffffffff80468d15>] do_page_fault+0x708/0x7bf
 [<ffffffff804669ad>] error_exit+0x0/0xa9
 [<ffffffff8031f5d4>] ? __list_add+0x2e/0x5b
 [<ffffffff8046487f>] ? mutex_lock_nested+0x111/0x2a3
 [<ffffffff88133f3f>] ? :bttv:radio_g_tuner+0x42/0xa8
 [<ffffffff88133f3f>] ? :bttv:radio_g_tuner+0x42/0xa8
 [<ffffffff88118f83>] ? :videodev:__video_do_ioctl+0x2a6e/0x2e25
 [<ffffffff80220af0>] ? __change_page_attr_set_clr+0x6c/0xc0
 [<ffffffff80220d2d>] ? kernel_map_pages+0x130/0x13b
 [<ffffffff8810103c>] ? :v4l1_compat:v4l_compat_translate_ioctl+0xea9/0x1af5
 [<ffffffff88116515>] ? :videodev:__video_do_ioctl+0x0/0x2e25
 [<ffffffff802203de>] ? virt_to_highmap+0x9/0x18
 [<ffffffff80220566>] ? __change_page_attr+0x179/0x697
 [<ffffffff802afb2e>] ? __find_get_block+0x171/0x183
 [<ffffffff802203de>] ? virt_to_highmap+0x9/0x18
 [<ffffffff80220566>] ? __change_page_attr+0x179/0x697
 [<ffffffff80220af0>] ? __change_page_attr_set_clr+0x6c/0xc0
 [<ffffffff8026895f>] ? mempool_alloc_slab+0x11/0x13
 [<ffffffff80211799>] ? native_sched_clock+0x4d/0x6c
 [<ffffffff80250dfb>] ? mark_held_locks+0x59/0x75
 [<ffffffff804659dd>] ? trace_hardirqs_on_thunk+0x35/0x3a
 [<ffffffff80250fa5>] ? trace_hardirqs_on+0xf9/0x124
 [<ffffffff804659dd>] ? trace_hardirqs_on_thunk+0x35/0x3a
 [<ffffffff80211799>] ? native_sched_clock+0x4d/0x6c
 [<ffffffff8020b9c3>] ? restore_args+0x0/0x3d
 [<ffffffff8031bbe7>] ? __delay+0x33/0x4f

last message repeated 2 times
[<ffffffff80211799>] ? native_sched_clock+0x4d/0x6c [<ffffffff8024eb31>] ? get_lock_stats+0x16/0x49 [<ffffffff8024eb72>] ? put_lock_stats+0xe/0x27 [<ffffffff80250dfb>] ? mark_held_locks+0x59/0x75 [<ffffffff80464740>] ? __mutex_unlock_slowpath+0xf9/0x11c [<ffffffff80250fa5>] ? trace_hardirqs_on+0xf9/0x124 [<ffffffff80211799>] ? native_sched_clock+0x4d/0x6c [<ffffffff802520d7>] ? __lock_acquire+0xc93/0xcb4 [<ffffffff80211799>] ? native_sched_clock+0x4d/0x6c [<ffffffff8024eb31>] ? get_lock_stats+0x16/0x49 [<ffffffff8024eb72>] ? put_lock_stats+0xe/0x27 [<ffffffff8024ebe1>] ? lock_release_holdtime+0x56/0x5e [<ffffffff80211799>] ? native_sched_clock+0x4d/0x6c [<ffffffff802520d7>] ? __lock_acquire+0xc93/0xcb4 [<ffffffff80211799>] ? native_sched_clock+0x4d/0x6c [<ffffffff8024eb31>] ? get_lock_stats+0x16/0x49 [<ffffffff8024eb72>] ? put_lock_stats+0xe/0x27 [<ffffffff8811664e>] ? :videodev:__video_do_ioctl+0x139/0x2e25 [<ffffffff802520d7>] ? __lock_acquire+0xc93/0xcb4 [<ffffffff80211799>] ? native_sched_clock+0x4d/0x6c [<ffffffff8024eb72>] ? put_lock_stats+0xe/0x27 [<ffffffff8024ebe1>] ? lock_release_holdtime+0x56/0x5e [<ffffffff80211799>] ? native_sched_clock+0x4d/0x6c [<ffffffff881196b1>] ? :videodev:video_ioctl2+0x1b8/0x259 [<ffffffff8046668b>] ? _spin_unlock_irqrestore+0x3f/0x68 [<ffffffff80250fa5>] ? trace_hardirqs_on+0xf9/0x124 [<ffffffff8029b22e>] ? vfs_ioctl+0x5e/0x77 [<ffffffff8029b4a2>] ? do_vfs_ioctl+0x25b/0x270 [<ffffffff804659dd>] ? trace_hardirqs_on_thunk+0x35/0x3a [<ffffffff8029b4f9>] ? sys_ioctl+0x42/0x65 [<ffffffff8020b36b>] ? system_call_after_swapgs+0x7b/0x80

I think I might have seen this problem but it didn't cause a oops for me, just that the radio program would hang waiting for the ioctl syscall to return. I did tried looking for a new radio program that used the V4L2 API but couldn't find one. I'll have a more in-depth look at the bttv driver when I get home tonight.

Robert

Ok, I found the cause of the oops. Some of radio tuner code was expecting a struct bttv_fh to be allocated but this wasn't done in radio_open. So it would dereference an invalid data structure, causing a hang for me and an oops for Bongani. I also had to add support for the radio tuner to some shared functions. Patches to follow.

Robert

---
 drivers/media/video/bt8xx/bttv-driver.c |    5 +++--
 1 files changed, 3 insertions(+), 2 deletions(-)

index 5404fcc..817a961 100644
@@ -1990,7 +1990,7 @@ static int bttv_g_frequency(struct file *file, void *priv,
 	if (0 != err)
 		return err;
 
-	f->type = V4L2_TUNER_ANALOG_TV;
+	f->type = btv->radio_user ? V4L2_TUNER_RADIO : V4L2_TUNER_ANALOG_TV;
 	f->frequency = btv->freq;
 
 	return 0;

@@ -2009,7 +2009,8 @@ static int bttv_s_frequency(struct file *file, void *priv,
 
 	if (unlikely(f->tuner != 0))
 		return -EINVAL;
-	if (unlikely(f->type != V4L2_TUNER_ANALOG_TV))
+	if (unlikely(f->type != (btv->radio_user
+		? V4L2_TUNER_RADIO : V4L2_TUNER_ANALOG_TV)))
 		return -EINVAL;
 	mutex_lock(&btv->lock);
 	btv->freq = f->frequency;

1.5.4.34.g053d9

A number of the radio tuner ioctl functions are shared with the TV tuner, these functions require a struct bttv_fh data structure to be allocated and initialized.

---
 drivers/media/video/bt8xx/bttv-driver.c |   21 ++++++++++++++++-----
 1 files changed, 16 insertions(+), 5 deletions(-)

Mauro, the radio_open function may want to do more initialisation then the amount I copied from bttv_open.

index 817a961..04a8263 100644
@@ -3417,6 +3417,7 @@ static int radio_open(struct inode *inode, struct file *file)
 {
 	int minor = iminor(inode);
 	struct bttv *btv = NULL;
+	struct bttv_fh *fh;
 	unsigned int i;
 
 	dprintk("bttv: open minor=%d\n",minor);

@@ -3431,12 +3432,19 @@ static int radio_open(struct inode *inode, struct file *file)
 		return -ENODEV;
 
 	dprintk("bttv%d: open called (radio)\n",btv->c.nr);
+
+	/* allocate per filehandle data */
+	fh = kmalloc(sizeof(*fh),GFP_KERNEL);
+	if (NULL == fh)
+		return -ENOMEM;
+	file->private_data = fh;
+	*fh = btv->init;
+	v4l2_prio_open(&btv->prio,&fh->prio);
+
 	mutex_lock(&btv->lock);
 
 	btv->radio_user++;
 
-	file->private_data = btv;
-
 	bttv_call_i2c_clients(btv,AUDC_SET_RADIO,NULL);
 	audio_input(btv,TVAUDIO_INPUT_RADIO);
 

@@ -3446,7 +3454,8 @@ static int radio_open(struct inode *inode, struct file *file)
 
 static int radio_release(struct inode *inode, struct file *file)
 {
-	struct bttv *btv = file->private_data;
+	struct bttv_fh *fh = file->private_data;
+	struct bttv *btv = fh->btv;
 	struct rds_command cmd;
 
 	btv->radio_user--;

@@ -3571,7 +3580,8 @@ static int radio_g_input(struct file *filp, void *priv, unsigned int *i)
 static ssize_t radio_read(struct file *file, char __user *data,
 			 size_t count, loff_t *ppos)
 {
-	struct bttv    *btv = file->private_data;
+	struct bttv_fh *fh = file->private_data;
+	struct bttv *btv = fh->btv;
 	struct rds_command cmd;
 	cmd.block_count = count/3;
 	cmd.buffer = data;

@@ -3585,7 +3595,8 @@ static ssize_t radio_read(struct file *file, char __user *data,
 
 static unsigned int radio_poll(struct file *file, poll_table *wait)
 {
-	struct bttv    *btv = file->private_data;
+	struct bttv_fh *fh = file->private_data;
+	struct bttv *btv = fh->btv;
 	struct rds_command cmd;
 	cmd.instance = file;
 	cmd.event_list = wait;

1.5.4.34.g053d9

Maybe, but the proper way would be to use just one open for both radio and video, like cx88. This driver violates V4L2 API, since the spec says that opening /dev/radio will select radio, by default, but it is possible to listen video also on that interface (the opposite is valid also for /dev/video).

I'll apply the fixes, for now. The better would be if you could try to use the same approach present on cx88.

Cheers,
Mauro

Thanx Robert

I have applied both your patches and my radio works, but my TV doesn't work anymore (no picture or sound). But when I exit the radio program I get this oops:

BUG: unable to handle kernel NULL pointer dereference at 0000000000000010
IP: [<ffffffff8030cd72>] kref_get+0xc/0x29
PGD 72230067 PUD 6dbd1067 PMD 0
Oops: 0000 [1] PREEMPT SMP
CPU 1
Modules linked in: snd_seq_dummy snd_seq_oss snd_seq_midi_event snd_seq 

binfmt_misc loop nls_cp437 vfat fat nls_iso8859_1 ntfs thermal processor fan container button pcspkr snd_pcm_oss snd_mixer_oss snd_emu10k1 tuner tea5767 tda8290 tuner_xc2028 tda9887 tuner_simple snd_rawmidi mt20xx snd_ac97_codec tea5761 bttv ac97_bus snd_pcm ir_common snd_seq_device firewire_ohci compat_ioctl32 snd_timer firewire_core videodev snd_page_alloc v4l1_compat uhci_hcd snd_util_mem ehci_hcd crc_itu_t v4l2_common snd_hwdep videobuf_dma_sg ohci1394 usbcore sr_mod ide_cd_mod snd videobuf_core ieee1394 emu10k1_gp tg3 cdrom btcx_risc sg i2c_viapro gameport tveeprom evdev soundcore
Pid: 4319, comm: radio Not tainted 2.6.25-rc3-dirty #42

RIP: 0010:[<ffffffff8030cd72>]  [<ffffffff8030cd72>] kref_get+0xc/0x29
RSP: 0018:ffff810065211db8  EFLAGS: 00010296
RAX: ffff81006d815880 RBX: 0000000000000010 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffff810065211e28 RDI: 0000000000000010
RBP: ffff810065211dc8 R08: 0000000000000000 R09: 0000001000000000
R10: 0000000000000000 R11: 0000000000000246 R12: ffff810065211e28
R13: 0000000000000000 R14: 0000000000000000 R15: fffffffffffffff8
FS:  00007fe0f915f6f0(0000) GS:ffff81007fb89dc0(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
CR2: 0000000000000010 CR3: 0000000063e8f000 CR4: 00000000000006e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Process radio (pid: 4319, threadinfo ffff810065210000, task ffff810068e534e0)
Stack:  ffff810065211ea8 0000000000000000 ffff810065211e08 ffffffff8044b362
 ffff810063dc0440 ffff810065211e28 0000000000000000 ffffffff803c0b75
 ffff810065211e78 ffff81007fb55580 ffff810065211e18 ffffffff8037be03
Call Trace:
 [<ffffffff8044b362>] klist_next+0x5d/0x8a
 [<ffffffff803c0b75>] ? i2c_cmd+0x0/0x3b
 [<ffffffff8037be03>] next_device+0x9/0x19
 [<ffffffff8037be4a>] device_for_each_child+0x37/0x5c
 [<ffffffff803bf371>] i2c_clients_command+0x23/0x25
 [<ffffffff88149b2a>] :bttv:bttv_call_i2c_clients+0x16/0x18
 [<ffffffff88142bf3>] :bttv:radio_release+0x23/0x27
 [<ffffffff802862dd>] __fput+0xac/0x16c
 [<ffffffff80286547>] fput+0x14/0x16
 [<ffffffff802838e7>] filp_close+0x66/0x71
 [<ffffffff80284d1c>] sys_close+0x8e/0xd1
 [<ffffffff8020b34b>] system_call_after_swapgs+0x7b/0x80


Code: ff f0 ff 0b 0f 94 c0 31 d2 84 c0 74 0b 48 89 df 41 ff d4 ba 01 00 00 00 

5b 41 5c c9 89 d0 c3 55 48 89 e5 53 48 89 fb 48 83 ec 08 <83> 3f 00 75 11 be 2b 00 00 00 48 c7 c7 46 b9 53 80 e8 d7 33 f2
RIP [<ffffffff8030cd72>] kref_get+0xc/0x29
RSP <ffff810065211db8>
CR2: 0000000000000010

---[ end trace 7ada9aa1e484b38f ]---

I've had a quick look and nothing stands out as the cause of the oops, but I did notice that I introduced a small memory leak. Over the next day or so I'll have a look at Mauro's suggestion of combining the opens like the cx88 driver.

Robert

More info...

The Oops seems to be caused by a size mismatch that causes memset to write over other variables in the stack... The following debug hack moved oops to another point in the v4l1-compact code..

So memset(&tun2,0,sizeof(tun2)) seems to be overwriting btv->lock->wait_list:

@@ -688,7 +688,7 @@
        {
                struct video_tuner      *tun = arg;
 
-               memset(&tun2,0,sizeof(tun2));
+               memset(&tun2,-1,sizeof(tun2));
                err = drv(inode, file, VIDIOC_G_TUNER, &tun2);
                if (err < 0) {
                        dprintk("VIDIOCGTUNER / VIDIOC_G_TUNER: %d\n",err);

The new oops, where there's another memset(&tun2,0,sizeof(tun2)):

BUG: unable to handle kernel NULL pointer dereference at 0000000000000000
IP: [<ffffffff8045a329>] __mutex_lock_slowpath+0x3b/0xb2
PGD 699d9067 PUD 65837067 PMD 0
Oops: 0002 [1] PREEMPT SMP
CPU 1
Modules linked in: snd_seq_dummy snd_seq_oss snd_seq_midi_event snd_seq 

binfmt_misc loop nls_cp437 vfat fat nls_iso8859_1 ntfs thermal processor fan container button pcspkr snd_pcm_oss snd_mixer_oss snd_emu10k1 tuner tea5767 tda8290 tuner_xc2028 tda9887 tuner_simple snd_rawmidi mt20xx snd_ac97_codec tea5761 bttv ac97_bus snd_pcm ir_common firewire_ohci snd_seq_device compat_ioctl32 firewire_core snd_timer uhci_hcd videodev ehci_hcd snd_page_alloc v4l1_compat crc_itu_t snd_util_mem usbcore v4l2_common snd_hwdep videobuf_dma_sg ohci1394 ide_cd_mod snd videobuf_core emu10k1_gp ieee1394 sr_mod btcx_risc evdev gameport i2c_viapro tveeprom cdrom sg tg3 soundcore
Pid: 4230, comm: radio Not tainted 2.6.25-rc5-dirty #46

RIP: 0010:[<ffffffff8045a329>]  [<ffffffff8045a329>] 
__mutex_lock_slowpath+0x3b/0xb2
RSP: 0018:ffff8100658455e8  EFLAGS: 00010246
RAX: ffff81007fbeff10 RBX: ffff81007fbeff08 RCX: 0000000000000000
RDX: ffff8100658455e8 RSI: ffffffff8816711c RDI: ffff81007fbeff0c
RBP: ffff810065845628 R08: ffffffff880e98df R09: 0000000000000002
R10: ffff810065845f38 R11: 0000000000000246 R12: ffff81007fbeff0c
R13: 0000000000000000 R14: ffff8100699d0d10 R15: ffffffff88167110
FS:  00007f0c740e46f0(0000) GS:ffff81007fb6adc0(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 0000000065835000 CR4: 00000000000006e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Process radio (pid: 4230, threadinfo ffff810065844000, task ffff8100699d0d10)
Stack:  ffff81007fbeff10 ffff810065845774 0000000265845688 ffff810065845768
 ffff81007fbef800 ffff810065845c68 0000000000000000 ffff81007fbeff08
 ffff810065845638 ffffffff8045a16f ffff810065845668 ffffffff8814692f
Call Trace:
 [<ffffffff8045a16f>] mutex_lock+0xe/0x10
 [<ffffffff8814692f>] :bttv:bttv_s_frequency+0x46/0x9f
 [<ffffffff880ec583>] :videodev:__video_do_ioctl+0x2ca4/0x2e16
 [<ffffffff8022b6fe>] ? hrtick_set+0xdf/0xe8
 [<ffffffff8020a003>] ? default_idle+0x0/0x5f
 [<ffffffff80459c51>] ? thread_return+0x6c/0xbf
 [<ffffffff880d52a9>] :v4l1_compat:v4l_compat_translate_ioctl+0x1116/0x1b01
 [<ffffffff802ff5bb>] ? generic_unplug_device+0x2c/0x30
 [<ffffffff880e98df>] ? :videodev:__video_do_ioctl+0x0/0x2e16
 [<ffffffff80266946>] ? mark_page_accessed+0x20/0x36
 [<ffffffff802a57af>] ? __find_get_block+0x153/0x165
 [<ffffffff802a57e1>] ? __getblk+0x20/0x22b
 [<ffffffff803021ff>] ? blk_recount_segments+0x3e/0x68
 [<ffffffff80260795>] ? mempool_alloc+0x48/0xf9
 [<ffffffff8028073b>] ? cache_alloc_refill+0x1cc/0x233
 [<ffffffff80302a5a>] ? blk_rq_map_sg+0x12b/0x24b
 [<ffffffff80238971>] ? lock_timer_base+0x26/0x4a
 [<ffffffff8038df34>] ? dma_timer_expiry+0x0/0x6d
 [<ffffffff80238b1c>] ? __mod_timer+0xc4/0xd6
 [<ffffffff80311a3b>] ? __delay+0x27/0x59
 [<ffffffff80311a3b>] ? __delay+0x27/0x59
 [<ffffffff80311a3b>] ? __delay+0x27/0x59
 [<ffffffff80311a3b>] ? __delay+0x27/0x59
 [<ffffffff80311a3b>] ? __delay+0x27/0x59
 [<ffffffff80311aef>] ? __udelay+0x40/0x42
 [<ffffffff803c1ba4>] ? i2c_stop+0x47/0x4b
 [<ffffffff803c236b>] ? bit_xfer+0x412/0x423
 [<ffffffff803c01ed>] ? i2c_transfer+0x79/0x85
 [<ffffffff881a3318>] ? :tuner_simple:simple_set_params+0x2b9/0xc18
 [<ffffffff8022589b>] ? enqueue_task_fair+0x179/0x186
 [<ffffffff80227ff2>] ? task_rq_lock+0x3d/0x73
 [<ffffffff802284b9>] ? try_to_wake_up+0x1ae/0x1bf
 [<ffffffff8021a49d>] ? smp_send_reschedule+0x1d/0x1f
 [<ffffffff802284d7>] ? default_wake_function+0xd/0xf
 [<ffffffff802246cc>] ? __wake_up_common+0x46/0x75
 [<ffffffff880e9a18>] :videodev:__video_do_ioctl+0x139/0x2e16
 [<ffffffff80357b8c>] ? n_tty_receive_buf+0xf18/0xf77
 [<ffffffff80260449>] ? filemap_fault+0x1fe/0x371
 [<ffffffff880eca95>] :videodev:video_ioctl2+0x1b8/0x259
 [<ffffffff802426de>] ? remove_wait_queue+0x3c/0x41
 [<ffffffff80226ea2>] ? __wake_up+0x43/0x4f
 [<ffffffff80291252>] vfs_ioctl+0x5e/0x77
 [<ffffffff802914b8>] do_vfs_ioctl+0x24d/0x262
 [<ffffffff8029150f>] sys_ioctl+0x42/0x67
 [<ffffffff802862af>] ? sys_write+0x47/0x70
 [<ffffffff8020b32b>] system_call_after_swapgs+0x7b/0x80


Code: 89 fb 4c 89 e7 48 83 ec 20 65 4c 8b 34 25 00 00 00 00 e8 e5 0f 00 00 48 

8d 43 08 48 8d 55 c0 48 8b 48 08 48 89 45 c0 48 89 50 08 <48> 89 11 48 83 ca ff 48 89 4d c8 4c 89 75 d0 48 89 d0 87 03 ff
RIP [<ffffffff8045a329>] __mutex_lock_slowpath+0x3b/0xb2
RSP <ffff8100658455e8>
CR2: 0000000000000000

---[ end trace 821f8e64b81db17b ]---

Could you please test this small patch?

diff -r 134d43b48b4a linux/drivers/media/video/bt8xx/bttv-driver.c
@@ -3288,6 +3288,7 @@ static int bttv_open(struct inode *inode
 		return -ENOMEM;
 	file->private_data = fh;
 	*fh = btv->init;
+	fh->btv = btv;
 	fh->type = type;
 	fh->ov.setup_ok = 0;
 	v4l2_prio_open(&btv->prio,&fh->prio);

Cheers,
Mauro

8<

Latest git with or without your patch still causes the oops..

The call trace that seems to be causing this oops is

radio
|-> ioctl(

       |->videodev.c:__video_do_ioctl
          |->v4l1-compat.c:v4l_compat_translate_ioctl
          |  case VIDIOCGTUNER: /*  get tuner information  */
          | {
          |      struct video_tuner      *tun = arg;
          |
          |      memset(&tun2,0,sizeof(tun2));
          |__ err = drv(inode, file, VIDIOC_G_TUNER, &tun2);
               |->videodev.c:__video_do_ioctl
               |   case VIDIOC_G_TUNER:
               |   {
               |      struct v4l2_tuner *p=arg;
               |     __u32 index=p->index;
               |
               |      if (!vfd->vidioc_g_tuner)
               |          break;
               |
               |     memset(p,0,sizeof(*p));
               |     p->index=index;
               |
               |     ret=vfd->vidioc_g_tuner(file, fh, p);
               |_
                  |-> bttv_driver.c:radio_g_tuner
                  |  struct bttv_fh *fh = priv;
                  |  struct bttv *btv = fh->btv;
                  |  
                  |  if (UNSET == bttv_tvcards[btv->c.type].tuner)
                  |      return -EINVAL;
                  |  if (0 != t->index)
                  |    return -EINVAL;
                  |  mutex_lock(&btv->lock); 
                  |__
                       |-> mutex.c:__mutex_lock_common 
                       |  struct task_struct *task = current;
                       |  struct mutex_waiter waiter;
                       |  unsigned int old_val;
                       |  unsigned long flags;
                       |
                       |  spin_lock_mutex(&lock->wait_lock, flags);
                       |
                       |  debug_mutex_lock_common(lock, &waiter);
                       |  mutex_acquire(&lock->dep_map, subclass, 0, ip);
                       |  debug_mutex_add_waiter(lock, &waiter, 

task_thread_info(task));
|
| /* add waiting tasks to the end of the
waitqueue (FIFO): */

                       | list_add_tail(&waiter.list, &lock->wait_list); 
                         ^^^^

This is where it oops because lock->wait_list->next is NULL.

BUT, changing:
memset(&tun2,0,sizeof(tun2));
to
memset(&tun2,-1,sizeof(tun2));
in
v4l1-compat.c:v4l_compat_translate_ioctl
...
case VIDIOCGTUNER:

changes
lock->wait_list->next from being NULL to something else, and the oops move to the next case statement i.e. VIDIOCGFREQ

---
 drivers/media/video/bt8xx/bttv-driver.c |    1 +
 1 files changed, 1 insertions(+), 0 deletions(-)

Hi Bongani

I only noticed that you might be using a 32 bit userspace, so the radio compat_ioctl needs to be implmented.

Robert

index 5404fcc..1bdb726 100644
@@ -3601,6 +3601,7 @@ static const struct file_operations radio_fops =
 	.read     = radio_read,
 	.release  = radio_release,
 	.ioctl	  = video_ioctl2,
+	.compat_ioctl	= v4l_compat_ioctl32,
 	.llseek	  = no_llseek,
 	.poll     = radio_poll,
 };

1.5.4.3.484.g60e3

Unfortunately, I coudn't reproduce your bug here.

I tested with a bttv board, plus two radio applications - radio and kradio
(radio-3.95-7mdv2008.0 and kradio-1.0-0.r497.3mdv2008.0 packages). None of them used V4L1 API. I also tested reading frequency, using
v4l-info /dev/radio0

I also used ioctl-test, running all V4L1 API calls, with this result (I've enabled debug on v4l1-compat, and added a small patch to bttv to use video_ioctl2 debug):

Linux video capture interface: v2.00
bttv: driver version 0.9.17 loaded
bttv: using 8 buffers with 2080k (520 pages) each for capture
bttv: Bt8xx card found (0).
bttv0: Bt848 (rev 17) at 0000:05:06.0, irq: 16, latency: 32, mmio: 0xce000000
bttv0: using: STB, Gateway P/N 6000699 (bt848) [card=3,insmod option]
bttv0: gpio: en=00000000, out=00000000 in=00fbffff [init]
bttv0: tuner type=2
bttv0: i2c: checking for TDA9875 @ 0xb0... not found
bttv0: i2c: checking for TDA7432 @ 0x8a... not found
bttv0: registered device video0
bttv0: registered device vbi0
bttv0: registered device radio0
BT848 radio (STB, Gateway P/N 6: err:
BT848 radio (STB, Gateway P/N 6: v4l2 ioctl VIDIOC_STREAMOFF, dir=-w (0x40045613)
BT848 radio (STB, Gateway P/N 6: err:
BT848 radio (STB, Gateway P/N 6: v4l2 ioctl VIDIOC_OVERLAY, dir=-w (0x4004560e)
v4l1-compat: VIDIOCCAPTURE / VIDIOC_PREVIEW: -22
BT848 radio (STB, Gateway P/N 6: v4l2 ioctl VIDIOC_G_AUDIO, dir=r- (0x80345621)
BT848 radio (STB, Gateway P/N 6: Get for index=0
BT848 radio (STB, Gateway P/N 6: index=0, name=Radio, capability=0, mode=0
BT848 radio (STB, Gateway P/N 6: v4l2 ioctl VIDIOC_QUERYCTRL, dir=rw (0xc0445624)
BT848 radio (STB, Gateway P/N 6: id=0, type=0, name=42, min/max=0/0, step=0, default=0, flags=0x00000001
BT848 radio (STB, Gateway P/N 6: v4l2 ioctl VIDIOC_QUERYCTRL, dir=rw (0xc0445624)
BT848 radio (STB, Gateway P/N 6: id=0, type=0, name=42, min/max=0/0, step=0, default=0, flags=0x00000001
BT848 radio (STB, Gateway P/N 6: v4l2 ioctl VIDIOC_QUERYCTRL, dir=rw (0xc0445624)
BT848 radio (STB, Gateway P/N 6: id=0, type=0, name=42, min/max=0/0, step=0, default=0, flags=0x00000001
BT848 radio (STB, Gateway P/N 6: v4l2 ioctl VIDIOC_QUERYCTRL, dir=rw (0xc0445624)
BT848 radio (STB, Gateway P/N 6: id=0, type=0, name=42, min/max=0/0, step=0, default=0, flags=0x00000001
BT848 radio (STB, Gateway P/N 6: v4l2 ioctl VIDIOC_QUERYCTRL, dir=rw (0xc0445624)
BT848 radio (STB, Gateway P/N 6: id=9963785, type=2, name=Mute, min/max=0/1, step=0, default=0, flags=0x00000000
BT848 radio (STB, Gateway P/N 6: v4l2 ioctl VIDIOC_G_CTRL, dir=rw (0xc008561b)
BT848 radio (STB, Gateway P/N 6: Enum for index=9963785
BT848 radio (STB, Gateway P/N 6: id=9963785, value=-32512
BT848 radio (STB, Gateway P/N 6: v4l2 ioctl VIDIOC_QUERYCTRL, dir=rw (0xc0445624)
BT848 radio (STB, Gateway P/N 6: id=0, type=0, name=42, min/max=0/0, step=0, default=0, flags=0x00000001
BT848 radio (STB, Gateway P/N 6: v4l2 ioctl VIDIOC_G_TUNER, dir=rw (0xc054561d)
BT848 radio (STB, Gateway P/N 6: index=0, name=Radio, type=1, capability=0, rangelow=0, rangehigh=0, signal=0, afc=0, rxsubchans=0, audmode=0 BT848 radio (STB, Gateway P/N 6: v4l2 ioctl VIDIOC_QUERYCAP, dir=r- (0x80685600)
BT848 radio (STB, Gateway P/N 6: driver=bttv, card=BT848 radio (STB, Gateway P/N 6, bus=PCI:0000:05:06.0, version=0x00000911, capabilities=0x00010000 BT848 radio (STB, Gateway P/N 6: v4l2 ioctl VIDIOC_ENUMINPUT, dir=rw (0xc050561a)
BT848 radio (STB, Gateway P/N 6: index=0, name=Radio, type=1, audioset=0, tuner=0, std=00000000, status=0
BT848 radio (STB, Gateway P/N 6: err:
BT848 radio (STB, Gateway P/N 6: v4l2 ioctl VIDIOC_ENUMINPUT, dir=rw (0xc050561a)
BT848 radio (STB, Gateway P/N 6: err:
BT848 radio (STB, Gateway P/N 6: v4l2 ioctl VIDIOC_ENUM_FMT, dir=rw (0xc0405602)
BT848 radio (STB, Gateway P/N 6: v4l2 ioctl VIDIOC_ENUMINPUT, dir=rw (0xc050561a)
BT848 radio (STB, Gateway P/N 6: index=0, name=Radio, type=1, audioset=0, tuner=0, std=00000000, status=0
BT848 radio (STB, Gateway P/N 6: v4l2 ioctl VIDIOC_G_STD, dir=r- (0x80085617)
BT848 radio (STB, Gateway P/N 6: value=00000000
BT848 radio (STB, Gateway P/N 6: err:
BT848 radio (STB, Gateway P/N 6: v4l2 ioctl VIDIOC_G_FBUF, dir=r- (0x8030560a)
v4l1-compat: VIDIOCGFBUF / VIDIOC_G_FBUF: -22
BT848 radio (STB, Gateway P/N 6: v4l2 ioctl VIDIOC_G_FREQUENCY, dir=rw (0xc02c5638)
BT848 radio (STB, Gateway P/N 6: tuner=0, type=1, frequency=0
BT848 radio (STB, Gateway P/N 6: v4l2 ioctl VIDIOC_QUERYCTRL, dir=rw (0xc0445624)
BT848 radio (STB, Gateway P/N 6: id=0, type=0, name=42, min/max=0/0, step=0, default=0, flags=0x00000001
BT848 radio (STB, Gateway P/N 6: v4l2 ioctl VIDIOC_QUERYCTRL, dir=rw (0xc0445624)
BT848 radio (STB, Gateway P/N 6: id=0, type=0, name=42, min/max=0/0, step=0, default=0, flags=0x00000001
BT848 radio (STB, Gateway P/N 6: v4l2 ioctl VIDIOC_QUERYCTRL, dir=rw (0xc0445624)
BT848 radio (STB, Gateway P/N 6: id=0, type=0, name=42, min/max=0/0, step=0, default=0, flags=0x00000001
BT848 radio (STB, Gateway P/N 6: v4l2 ioctl VIDIOC_QUERYCTRL, dir=rw (0xc0445624)
BT848 radio (STB, Gateway P/N 6: id=0, type=0, name=42, min/max=0/0, step=0, default=0, flags=0x00000001
BT848 radio (STB, Gateway P/N 6: v4l2 ioctl VIDIOC_QUERYCTRL, dir=rw (0xc0445624)
BT848 radio (STB, Gateway P/N 6: id=0, type=0, name=42, min/max=0/0, step=0, default=0, flags=0x00000001
BT848 radio (STB, Gateway P/N 6: v4l2 ioctl VIDIOC_G_FMT, dir=rw (0xc0d05604)
BT848 radio (STB, Gateway P/N 6: type=video-cap
BT848 radio (STB, Gateway P/N 6: err:
BT848 radio (STB, Gateway P/N 6: v4l2 ioctl VIDIOC_G_FMT, dir=rw (0xc0d05604)
v4l1-compat: VIDIOCGPICT / VIDIOC_G_FMT: -22
BT848 radio (STB, Gateway P/N 6: v4l2 ioctl VIDIOC_G_TUNER, dir=rw (0xc054561d)
BT848 radio (STB, Gateway P/N 6: index=0, name=Radio, type=1, capability=0, rangelow=0, rangehigh=0, signal=0, afc=0, rxsubchans=0, audmode=0 BT848 radio (STB, Gateway P/N 6: v4l2 ioctl VIDIOC_G_STD, dir=r- (0x80085617)
BT848 radio (STB, Gateway P/N 6: value=00000000
BT848 radio (STB, Gateway P/N 6: v4l2 ioctl VIDIOC_G_FMT, dir=rw (0xc0d05604)
BT848 radio (STB, Gateway P/N 6: type=vbi-cap
BT848 radio (STB, Gateway P/N 6: err:
BT848 radio (STB, Gateway P/N 6: v4l2 ioctl VIDIOC_G_FMT, dir=rw (0xc0d05604)
v4l1-compat: VIDIOCGVBIFMT / VIDIOC_G_FMT: -22
BT848 radio (STB, Gateway P/N 6: v4l2 ioctl VIDIOC_G_FMT, dir=rw (0xc0d05604)
BT848 radio (STB, Gateway P/N 6: type=video-over
BT848 radio (STB, Gateway P/N 6: err:
BT848 radio (STB, Gateway P/N 6: v4l2 ioctl VIDIOC_G_FMT, dir=rw (0xc0d05604)
v4l1-compat: VIDIOCGWIN / VIDIOC_G_WIN: -22
BT848 radio (STB, Gateway P/N 6: v4l2 ioctl VIDIOC_G_FMT, dir=rw (0xc0d05604)
BT848 radio (STB, Gateway P/N 6: type=video-cap
BT848 radio (STB, Gateway P/N 6: err:
BT848 radio (STB, Gateway P/N 6: v4l2 ioctl VIDIOC_G_FMT, dir=rw (0xc0d05604)
v4l1-compat: VIDIOCGWIN / VIDIOC_G_FMT: -22
BT848 radio (STB, Gateway P/N 6: v4l2 ioctl VIDIOC_G_FMT, dir=rw (0xc0d05604)
BT848 radio (STB, Gateway P/N 6: type=video-cap
BT848 radio (STB, Gateway P/N 6: err:
BT848 radio (STB, Gateway P/N 6: v4l2 ioctl VIDIOC_G_FMT, dir=rw (0xc0d05604)
v4l1-compat: VIDIOCMCAPTURE / VIDIOC_G_FMT: -22
BT848 radio (STB, Gateway P/N 6: v4l2 ioctl VIDIOC_S_AUDIO, dir=-w (0x40345622)
BT848 radio (STB, Gateway P/N 6: index=0, name=, capability=0, mode=0
BT848 radio (STB, Gateway P/N 6: v4l2 ioctl VIDIOC_QUERYCTRL, dir=rw (0xc0445624)
BT848 radio (STB, Gateway P/N 6: id=0, type=0, name=42, min/max=0/0, step=0, default=0, flags=0x00000001
BT848 radio (STB, Gateway P/N 6: v4l2 ioctl VIDIOC_QUERYCTRL, dir=rw (0xc0445624)
BT848 radio (STB, Gateway P/N 6: id=0, type=0, name=42, min/max=0/0, step=0, default=0, flags=0x00000001
BT848 radio (STB, Gateway P/N 6: v4l2 ioctl VIDIOC_QUERYCTRL, dir=rw (0xc0445624)
BT848 radio (STB, Gateway P/N 6: id=0, type=0, name=42, min/max=0/0, step=0, default=0, flags=0x00000001
BT848 radio (STB, Gateway P/N 6: v4l2 ioctl VIDIOC_QUERYCTRL, dir=rw (0xc0445624)
BT848 radio (STB, Gateway P/N 6: id=0, type=0, name=42, min/max=0/0, step=0, default=0, flags=0x00000001
BT848 radio (STB, Gateway P/N 6: v4l2 ioctl VIDIOC_QUERYCTRL, dir=rw (0xc0445624)
BT848 radio (STB, Gateway P/N 6: id=9963785, type=2, name=Mute, min/max=0/1, step=0, default=0, flags=0x00000000
BT848 radio (STB, Gateway P/N 6: v4l2 ioctl VIDIOC_S_CTRL, dir=rw (0xc008561c)
BT848 radio (STB, Gateway P/N 6: id=9963785, value=0
BT848 radio (STB, Gateway P/N 6: v4l2 ioctl VIDIOC_G_TUNER, dir=rw (0xc054561d)
BT848 radio (STB, Gateway P/N 6: index=0, name=Radio, type=1, capability=0, rangelow=0, rangehigh=0, signal=0, afc=0, rxsubchans=0, audmode=0 BT848 radio (STB, Gateway P/N 6: v4l2 ioctl VIDIOC_S_TUNER, dir=-w (0x4054561e)
BT848 radio (STB, Gateway P/N 6: index=0, name=Radio, type=1, capability=0, rangelow=0, rangehigh=0, signal=0, afc=0, rxsubchans=0, audmode=0 BT848 radio (STB, Gateway P/N 6: v4l2 ioctl VIDIOC_S_INPUT, dir=rw (0xc0045627)
BT848 radio (STB, Gateway P/N 6: value=0
BT848 radio (STB, Gateway P/N 6: v4l2 ioctl VIDIOC_S_STD, dir=-w (0x40085618)
BT848 radio (STB, Gateway P/N 6: value=000000ff
BT848 radio (STB, Gateway P/N 6: err:
BT848 radio (STB, Gateway P/N 6: v4l2 ioctl VIDIOC_S_FBUF, dir=-w (0x4030560b)
v4l1-compat: VIDIOCSFBUF / VIDIOC_S_FBUF: -22
BT848 radio (STB, Gateway P/N 6: v4l2 ioctl VIDIOC_G_FREQUENCY, dir=rw (0xc02c5638)
BT848 radio (STB, Gateway P/N 6: tuner=0, type=1, frequency=0
BT848 radio (STB, Gateway P/N 6: v4l2 ioctl VIDIOC_S_FREQUENCY, dir=-w (0x402c5639)
BT848 radio (STB, Gateway P/N 6: tuner=0, type=1, frequency=0
BT848 radio (STB, Gateway P/N 6: v4l2 ioctl VIDIOC_QUERYCTRL, dir=rw (0xc0445624)
BT848 radio (STB, Gateway P/N 6: id=0, type=0, name=42, min/max=0/0, step=0, default=0, flags=0x00000001
BT848 radio (STB, Gateway P/N 6: v4l2 ioctl VIDIOC_QUERYCTRL, dir=rw (0xc0445624)
BT848 radio (STB, Gateway P/N 6: id=0, type=0, name=42, min/max=0/0, step=0, default=0, flags=0x00000001
BT848 radio (STB, Gateway P/N 6: v4l2 ioctl VIDIOC_QUERYCTRL, dir=rw (0xc0445624)
BT848 radio (STB, Gateway P/N 6: id=0, type=0, name=42, min/max=0/0, step=0, default=0, flags=0x00000001
BT848 radio (STB, Gateway P/N 6: v4l2 ioctl VIDIOC_QUERYCTRL, dir=rw (0xc0445624)
BT848 radio (STB, Gateway P/N 6: id=0, type=0, name=42, min/max=0/0, step=0, default=0, flags=0x00000001
BT848 radio (STB, Gateway P/N 6: v4l2 ioctl VIDIOC_QUERYCTRL, dir=rw (0xc0445624)
BT848 radio (STB, Gateway P/N 6: id=0, type=0, name=42, min/max=0/0, step=0, default=0, flags=0x00000001
BT848 radio (STB, Gateway P/N 6: v4l2 ioctl VIDIOC_G_FMT, dir=rw (0xc0d05604)
BT848 radio (STB, Gateway P/N 6: type=video-cap
BT848 radio (STB, Gateway P/N 6: err:
BT848 radio (STB, Gateway P/N 6: v4l2 ioctl VIDIOC_G_FMT, dir=rw (0xc0d05604)
v4l1-compat: VIDIOCSPICT / VIDIOC_G_FMT: -22
BT848 radio (STB, Gateway P/N 6: err:
BT848 radio (STB, Gateway P/N 6: v4l2 ioctl VIDIOC_G_FBUF, dir=r- (0x8030560a)
v4l1-compat: VIDIOCSPICT / VIDIOC_G_FBUF: -22
BT848 radio (STB, Gateway P/N 6: v4l2 ioctl VIDIOC_S_INPUT, dir=rw (0xc0045627)
BT848 radio (STB, Gateway P/N 6: value=0
BT848 radio (STB, Gateway P/N 6: err:
BT848 radio (STB, Gateway P/N 6: v4l2 ioctl VIDIOC_STREAMOFF, dir=-w (0x40045613)
BT848 radio (STB, Gateway P/N 6: v4l2 ioctl VIDIOC_G_FMT, dir=rw (0xc0d05604)
BT848 radio (STB, Gateway P/N 6: type=video-cap
BT848 radio (STB, Gateway P/N 6: err:
BT848 radio (STB, Gateway P/N 6: v4l2 ioctl VIDIOC_G_FMT, dir=rw (0xc0d05604)
v4l1-compat: VIDIOCSWIN / VIDIOC_G_FMT: -22
BT848 radio (STB, Gateway P/N 6: v4l2 ioctl VIDIOC_S_FMT, dir=rw (0xc0d05605)
BT848 radio (STB, Gateway P/N 6: type=video-over
BT848 radio (STB, Gateway P/N 6: err:
BT848 radio (STB, Gateway P/N 6: v4l2 ioctl VIDIOC_S_FMT, dir=rw (0xc0d05605)
v4l1-compat: VIDIOCSWIN / VIDIOC_S_FMT #2: -22
BT848 radio (STB, Gateway P/N 6: err:
BT848 radio (STB, Gateway P/N 6: v4l2 ioctl VIDIOC_QUERYBUF, dir=rw (0xc0585609)
v4l1-compat: VIDIOCSYNC / VIDIOC_QUERYBUF: -22

I got no oops. The tests were done also on a 64bit kernel, on a dual-core machine.

Cheers,
Mauro

---

I've patched the ioctl-test program (at v4l2-apps/test dir, on v4l/dvb development environment, available at http://linuxtv.org/hg/v4l-dvb) with this diff:

diff -r f24051885fe9 v4l2-apps/test/ioctl-test.c
@@ -47,6 +47,8 @@ typedef __u32 u32;
 #else
 typedef u_int32_t u32;
 #endif
+
+#define CONFIG_VIDEO_V4L1_COMPAT
 
 /* All possible parameters used on v4l ioctls */
 union v4l_parms {

@@ -142,7 +144,7 @@ int ioctls[] = {
 	VIDIOCSYNC,/* int */
 #endif
 	/* V4L2 ioctls */
-
+#if 0
 	VIDIOC_CROPCAP,/* struct v4l2_cropcap */
 	VIDIOC_DQBUF,/* struct v4l2_buffer */
 	VIDIOC_ENUMAUDIO,/* struct v4l2_audio */

@@ -173,7 +175,7 @@ int ioctls[] = {
 	VIDIOC_S_OUTPUT,/* int */
 	VIDIOC_S_PARM,/* struct v4l2_streamparm */
 	VIDIOC_TRY_FMT,/* struct v4l2_format */
-
+#endif
 #if 0
 	VIDIOC_G_AUDIO_OLD,/* struct v4l2_audio */
 	VIDIOC_G_AUDOUT_OLD,/* struct v4l2_audioout */

@@ -214,7 +216,7 @@ int main (void)
 {
 	int fd=0, ret=0;
 	unsigned i;
-	char *device="/dev/video0";
+	char *device="/dev/radio0";
 	union v4l_parms p;
 
 	if ((fd = open(device, O_RDONLY)) < 0) {

--
video4linux-list mailing list
Unsubscribe mailto:[email protected]?subject=unsubscribe
https://www.redhat.com/mailman/listinfo/video4linux-list

rpm -qa | grep radio
radio-3.95-7mdv2008.0

strace of radio
...
munmap(0x7f9796ebc000, 168278) = 0
open("/dev/radio", O_RDONLY) = 3
ioctl(3, SONYPI_IOCGBAT2CAP or VIDIOCGTUNER <unfinished ...>

                                                                       ^^^^
								v4l1 API

+++ killed by SIGKILL +++
Process 5164 detached

My machine is a 2 x Opteron 244, 2GB RAM, MSI K Master 2FAR Board

bttv: driver version 0.9.17 loaded
bttv: using 8 buffers with 2080k (520 pages) each for capture
bttv: Bt8xx card found (0).
bttv0: Bt878 (rev 17) at 0000:00:05.0, irq: 16, latency: 32, mmio: 0xfa015000
bttv0: using: Lifeview FlyVideo 98FM LR50 [card=56,insmod option]
bttv0: gpio: en=00000000, out=00000000 in=00e8ff00 [init]
bttv0: FlyVideo_gpio: unknown tuner type.
bttv0: FlyVideo Radio=yes RemoteControl=yes Tuner=-1 gpio=0xe8ff00
bttv0: FlyVideo LR90=no tda9821/tda9820=no capture_only=no
bttv0: tuner type=1
bttv0: i2c: checking for MSP34xx @ 0x80... not found
bttv0: i2c: checking for TDA9875 @ 0xb0... not found
bttv0: i2c: checking for TDA7432 @ 0x8a... not found
bttv0: registered device video0
bttv0: registered device vbi0
bttv0: registered device radio0
bttv0: PLL: 28636363 => 35468950 .. ok

lspci
00:00.0 Host bridge: VIA Technologies, Inc. VT8385 [K8T800 AGP] Host Bridge (rev 01)
00:01.0 PCI bridge: VIA Technologies, Inc. VT8237 PCI bridge [K8T800/K8T890 South]
00:05.0 Multimedia video controller: Brooktree Corporation Bt878 Video Capture (rev 11)
00:05.1 Multimedia controller: Brooktree Corporation Bt878 Audio Capture (rev
11)
00:08.0 Multimedia audio controller: Creative Labs SB Audigy (rev 04) 00:08.1 Input device controller: Creative Labs SB Audigy Game Port (rev 04) 00:08.2 FireWire (IEEE 1394): Creative Labs SB Audigy FireWire Port (rev 04) 00:0b.0 Ethernet controller: Broadcom Corporation NetXtreme BCM5705 Gigabit Ethernet (rev 03)
00:0f.0 RAID bus controller: VIA Technologies, Inc. VIA VT6420 SATA RAID Controller (rev 80)
00:0f.1 IDE interface: VIA Technologies, Inc. VT82C586A/B/VT82C686/A/B/VT823x/A/C PIPC Bus Master IDE (rev 06) 00:10.0 USB Controller: VIA Technologies, Inc. VT82xxxxx UHCI USB 1.1 Controller (rev 81)
00:10.1 USB Controller: VIA Technologies, Inc. VT82xxxxx UHCI USB 1.1 Controller (rev 81)
00:10.2 USB Controller: VIA Technologies, Inc. VT82xxxxx UHCI USB 1.1 Controller (rev 81)
00:10.4 USB Controller: VIA Technologies, Inc. USB 2.0 (rev 86) 00:11.0 ISA bridge: VIA Technologies, Inc. VT8237 ISA bridge [KT600/K8T800/K8T890 South]
00:18.0 Host bridge: Advanced Micro Devices [AMD] K8 [Athlon64/Opteron] HyperTransport Technology Configuration
00:18.1 Host bridge: Advanced Micro Devices [AMD] K8 [Athlon64/Opteron] Address Map
00:18.2 Host bridge: Advanced Micro Devices [AMD] K8 [Athlon64/Opteron] DRAM Controller
00:18.3 Host bridge: Advanced Micro Devices [AMD] K8 [Athlon64/Opteron] Miscellaneous Control
00:19.0 Host bridge: Advanced Micro Devices [AMD] K8 [Athlon64/Opteron] HyperTransport Technology Configuration
00:19.1 Host bridge: Advanced Micro Devices [AMD] K8 [Athlon64/Opteron] Address Map
00:19.2 Host bridge: Advanced Micro Devices [AMD] K8 [Athlon64/Opteron] DRAM Controller
00:19.3 Host bridge: Advanced Micro Devices [AMD] K8 [Athlon64/Opteron] Miscellaneous Control
01:00.0 VGA compatible controller: nVidia Corporation NV36 [GeForce FX 5700LE] (rev a1)

Hmm... exactly the same version I have here.

It used to have some issues with VIA and PCI, if you're using overlay mode (this is the default, for xawtv).

This is due to some issues on buggy VIA bridges, when handling PCI2PCI data transfers, used in overlay mode. If a PCI2PCI conflicts with a PCI2MEM transfer (or a MEM2PCI), you may suffer data loss.

Are you trying to use radio just after a clean reboot, or are you experiencing those troubles after running a video application that might be using overlay mode?

Could you please send me your .config? I'll try to run the same config as you, with the latest -rc.

Cheers,
Mauro

xawtv works fine, it's only radio that has a problem since 2.6.25-rc?

I'm trying to use radio after a clean reboot, as I said above; xatwv and tvtime don't seem to have a problem.

attached

Oh...

v4l-info /dev/radio

causes this oops (clean reboot)

BUG: unable to handle kernel NULL pointer dereference at 0000000000000250
IP: [<ffffffff8030fe54>] strlcpy+0x11/0x36
PGD 68650067 PUD 7526f067 PMD 0
Oops: 0000 [1] PREEMPT SMP
CPU 1
Modules linked in: snd_seq_dummy snd_seq_oss snd_seq_midi_event snd_seq 

binfmt_misc loop nls_cp437 vfat fat nls_iso8859_1 ntfs thermal processor fan container button pcspkr snd_pcm_oss snd_mixer_oss tuner snd_emu10k1 tea5767 tda8290 tuner_xc2028 tda9887 tuner_simple snd_rawmidi mt20xx snd_ac97_codec tea5761 bttv ac97_bus snd_pcm ir_common snd_seq_device compat_ioctl32 snd_timer firewire_ohci videodev snd_page_alloc uhci_hcd firewire_core ehci_hcd snd_util_mem v4l1_compat v4l2_common snd_hwdep usbcore crc_itu_t ide_cd_mod videobuf_dma_sg snd sr_mod ohci1394 videobuf_core btcx_risc emu10k1_gp ieee1394 cdrom i2c_viapro tg3 gameport soundcore sg tveeprom evdev
Pid: 4756, comm: v4l-info Tainted: G M 2.6.25-rc5 #44

RIP: 0010:[<ffffffff8030fe54>]  [<ffffffff8030fe54>] strlcpy+0x11/0x36
RSP: 0018:ffff81006414fcb8  EFLAGS: 00010286
RAX: 0000000000000000 RBX: ffff81006414fdf8 RCX: ffffffffffffffff
RDX: 0000000000000020 RSI: 0000000000000250 RDI: 0000000000000250
RBP: ffff81006414fcb8 R08: ffff81006414fe08 R09: ffff81006414fdf8
R10: ffff81007d885788 R11: 0000000000000202 R12: ffff81007fbe7800
R13: 0000000080685600 R14: ffff81007e76d800 R15: ffffffff88165110
FS:  00007f00eb5666f0(0000) GS:ffff81007fb6adc0(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
CR2: 0000000000000250 CR3: 000000007686f000 CR4: 00000000000006e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Process v4l-info (pid: 4756, threadinfo ffff81006414e000, task 
ffff81007e8da180)
Stack:  ffff81006414fcd8 ffffffff88145d33 ffff81007d885788 ffff81006414fdf8
 ffff81006414fdb8 ffffffff88100e58 ffffffffc008561c ffff81006414fd28
 ffff81006414fd08 ffffffff88149b72 ffff81006414fd58 ffffffff88142ed2
Call Trace:
 [<ffffffff88145d33>] :bttv:radio_querycap+0x39/0x6b
 [<ffffffff88100e58>] :videodev:__video_do_ioctl+0x579/0x2e16
 [<ffffffff88149b72>] ? :bttv:bttv_call_i2c_clients+0x16/0x18
 [<ffffffff88142ed2>] ? :bttv:audio_mux+0x105/0x1b5
 [<ffffffff80260449>] ? filemap_fault+0x1fe/0x371
 [<ffffffff88103a95>] :videodev:video_ioctl2+0x1b8/0x259
 [<ffffffff8026d36b>] ? handle_mm_fault+0x341/0x69b
 [<ffffffff80291252>] vfs_ioctl+0x5e/0x77
 [<ffffffff802914b8>] do_vfs_ioctl+0x24d/0x262
 [<ffffffff8045d881>] ? do_page_fault+0x434/0x7aa
 [<ffffffff8029150f>] sys_ioctl+0x42/0x67
 [<ffffffff8020b32b>] system_call_after_swapgs+0x7b/0x80


Code: 4c 29 c2 48 39 d0 72 04 48 8d 4a ff fc 4c 89 cf 4c 01 c0 f3 a4 c6 07 00 

c9 c3 55 31 c0 48 83 c9 ff fc 49 89 f8 48 89 f7 48 89 e5 <f2> ae 48 85 d2 48 f7 d1 48 8d 41 ff 74 15 48 39 d0 48 89 c1 72
RIP [<ffffffff8030fe54>] strlcpy+0x11/0x36
RSP <ffff81006414fcb8>
CR2: 0000000000000250

---[ end trace 7e58c9e343c88870 ]---

but

v4l-info /dev/video works fine

### v4l2 device info [/dev/video] ###
general info
VIDIOC_QUERYCAP
driver : "bttv"
card : "BT878 video (Lifeview FlyVideo "
bus_info : "PCI:0000:00:05.0"
version : 0.9.17
capabilities : 0x5010015
[VIDEO_CAPTURE,VIDEO_OVERLAY,VBI_CAPTURE,TUNER,READWRITE,STREAMING]

standards
VIDIOC_ENUMSTD(0)
index : 0
id : 0xff
[PAL_B,PAL_B1,PAL_G,PAL_H,PAL_I,PAL_D,PAL_D1,PAL_K]
name : "PAL"
frameperiod.numerator : 1
frameperiod.denominator : 25
framelines : 625
VIDIOC_ENUMSTD(1)
index : 1
id : 0x100 [PAL_M]
name : "PAL-M"
frameperiod.numerator : 1001
frameperiod.denominator : 30000
framelines : 525
VIDIOC_ENUMSTD(2)
index : 2
id : 0x200 [PAL_N]
name : "PAL-N"
frameperiod.numerator : 1
frameperiod.denominator : 25
framelines : 625
VIDIOC_ENUMSTD(3)
index : 3
id : 0x400 [PAL_Nc]
name : "PAL-Nc"
frameperiod.numerator : 1
frameperiod.denominator : 25
framelines : 625
VIDIOC_ENUMSTD(4)
index : 4
id : 0x800 [PAL_60]
name : "PAL-60"
frameperiod.numerator : 1001
frameperiod.denominator : 30000
framelines : 525
VIDIOC_ENUMSTD(5)
index : 5
id : 0xb000 [NTSC_M,NTSC_M_JP,?]
name : "NTSC"
frameperiod.numerator : 1001
frameperiod.denominator : 30000
framelines : 525
VIDIOC_ENUMSTD(6)
index : 6
id : 0xff0000
[SECAM_B,SECAM_D,SECAM_G,SECAM_H,SECAM_K,SECAM_K1,SECAM_L,?ATSC_8_VSB]
name : "SECAM"
frameperiod.numerator : 1
frameperiod.denominator : 25
framelines : 625

inputs
VIDIOC_ENUMINPUT(0)
index : 0
name : "Television"
type : TUNER
audioset : 1
tuner : 0
std : 0xffbfff
[PAL_B,PAL_B1,PAL_G,PAL_H,PAL_I,PAL_D,PAL_D1,PAL_K,PAL_M,PAL_N,PAL_Nc,PAL_60,NTSC_M,NTSC_M_JP,?,SECAM_B,SECAM_D,SECAM_G,SECAM_H,SECAM_K,SECAM_K1,SECAM_L,?ATSC_8_VSB]
status : 0x102 [NO_SIGNAL,NO_H_LOCK]
VIDIOC_ENUMINPUT(1)
index : 1
name : "Composite1"
type : CAMERA
audioset : 1
tuner : 0
std : 0xffbfff
[PAL_B,PAL_B1,PAL_G,PAL_H,PAL_I,PAL_D,PAL_D1,PAL_K,PAL_M,PAL_N,PAL_Nc,PAL_60,NTSC_M,NTSC_M_JP,?,SECAM_B,SECAM_D,SECAM_G,SECAM_H,SECAM_K,SECAM_K1,SECAM_L,?ATSC_8_VSB]
status : 0x0 []
VIDIOC_ENUMINPUT(2)
index : 2
name : "S-Video"
type : CAMERA
audioset : 1
tuner : 0
std : 0xffbfff
[PAL_B,PAL_B1,PAL_G,PAL_H,PAL_I,PAL_D,PAL_D1,PAL_K,PAL_M,PAL_N,PAL_Nc,PAL_60,NTSC_M,NTSC_M_JP,?,SECAM_B,SECAM_D,SECAM_G,SECAM_H,SECAM_K,SECAM_K1,SECAM_L,?ATSC_8_VSB]
status : 0x0 []
VIDIOC_ENUMINPUT(3)
index : 3
name : "Composite3"
type : CAMERA
audioset : 1
tuner : 0
std : 0xffbfff
[PAL_B,PAL_B1,PAL_G,PAL_H,PAL_I,PAL_D,PAL_D1,PAL_K,PAL_M,PAL_N,PAL_Nc,PAL_60,NTSC_M,NTSC_M_JP,?,SECAM_B,SECAM_D,SECAM_G,SECAM_H,SECAM_K,SECAM_K1,SECAM_L,?ATSC_8_VSB]

        status                  : 0x0 []

tuners
VIDIOC_G_TUNER(0)
index : 0
name : "Television"
type : ANALOG_TV
capability : 0x2 [NORM]
rangelow : 704
rangehigh : 15328
rxsubchans : 0x1 [MONO]
audmode : MONO
signal : 0
afc : 0

video capture
VIDIOC_ENUM_FMT(0,VIDEO_CAPTURE)
index : 0
type : VIDEO_CAPTURE
flags : 0
description : "8 bpp, gray"
pixelformat : 0x59455247 [GREY]
VIDIOC_ENUM_FMT(1,VIDEO_CAPTURE)
index : 1
type : VIDEO_CAPTURE
flags : 0
description : "8 bpp, dithered color"
pixelformat : 0x34324948 [HI24]
VIDIOC_ENUM_FMT(2,VIDEO_CAPTURE)
index : 2
type : VIDEO_CAPTURE
flags : 0
description : "15 bpp RGB, le"
pixelformat : 0x4f424752 [RGBO]
VIDIOC_ENUM_FMT(3,VIDEO_CAPTURE)
index : 3
type : VIDEO_CAPTURE
flags : 0
description : "15 bpp RGB, be"
pixelformat : 0x51424752 [RGBQ]
VIDIOC_ENUM_FMT(4,VIDEO_CAPTURE)
index : 4
type : VIDEO_CAPTURE
flags : 0
description : "16 bpp RGB, le"
pixelformat : 0x50424752 [RGBP]
VIDIOC_ENUM_FMT(5,VIDEO_CAPTURE)
index : 5
type : VIDEO_CAPTURE
flags : 0
description : "16 bpp RGB, be"
pixelformat : 0x52424752 [RGBR]
VIDIOC_ENUM_FMT(6,VIDEO_CAPTURE)
index : 6
type : VIDEO_CAPTURE
flags : 0
description : "24 bpp RGB, le"
pixelformat : 0x33524742 [BGR3]
VIDIOC_ENUM_FMT(7,VIDEO_CAPTURE)
index : 7
type : VIDEO_CAPTURE
flags : 0
description : "32 bpp RGB, le"
pixelformat : 0x34524742 [BGR4]
VIDIOC_ENUM_FMT(8,VIDEO_CAPTURE)
index : 8
type : VIDEO_CAPTURE
flags : 0
description : "32 bpp RGB, be"
pixelformat : 0x34424752 [RGB4]
VIDIOC_ENUM_FMT(9,VIDEO_CAPTURE)
index : 9
type : VIDEO_CAPTURE
flags : 0
description : "4:2:2, packed, YUYV"
pixelformat : 0x56595559 [YUYV]
VIDIOC_ENUM_FMT(10,VIDEO_CAPTURE)
index : 10
type : VIDEO_CAPTURE
flags : 0
description : "4:2:2, packed, YUYV"
pixelformat : 0x56595559 [YUYV]
VIDIOC_ENUM_FMT(11,VIDEO_CAPTURE)
index : 11
type : VIDEO_CAPTURE
flags : 0
description : "4:2:2, packed, UYVY"
pixelformat : 0x59565955 [UYVY]
VIDIOC_ENUM_FMT(12,VIDEO_CAPTURE)
index : 12
type : VIDEO_CAPTURE
flags : 0
description : "4:2:2, planar, Y-Cb-Cr"
pixelformat : 0x50323234 [422P]
VIDIOC_ENUM_FMT(13,VIDEO_CAPTURE)
index : 13
type : VIDEO_CAPTURE
flags : 0
description : "4:2:0, planar, Y-Cb-Cr"
pixelformat : 0x32315559 [YU12]
VIDIOC_ENUM_FMT(14,VIDEO_CAPTURE)
index : 14
type : VIDEO_CAPTURE
flags : 0
description : "4:2:0, planar, Y-Cr-Cb"
pixelformat : 0x32315659 [YV12]
VIDIOC_ENUM_FMT(15,VIDEO_CAPTURE)
index : 15
type : VIDEO_CAPTURE
flags : 0
description : "4:1:1, planar, Y-Cb-Cr"
pixelformat : 0x50313134 [411P]
VIDIOC_ENUM_FMT(16,VIDEO_CAPTURE)
index : 16
type : VIDEO_CAPTURE
flags : 0
description : "4:1:0, planar, Y-Cb-Cr"
pixelformat : 0x39565559 [YUV9]
VIDIOC_ENUM_FMT(17,VIDEO_CAPTURE)
index : 17
type : VIDEO_CAPTURE
flags : 0
description : "4:1:0, planar, Y-Cr-Cb"
pixelformat : 0x39555659 [YVU9]
VIDIOC_G_FMT(VIDEO_CAPTURE)
type : VIDEO_CAPTURE
fmt.pix.width : 320
fmt.pix.height : 240
fmt.pix.pixelformat : 0x59565955 [UYVY]
fmt.pix.field : INTERLACED
fmt.pix.bytesperline : 640
fmt.pix.sizeimage : 153600
fmt.pix.colorspace : unknown
fmt.pix.priv : 0

video overlay
VIDIOC_ENUM_FMT(0,VIDEO_OVERLAY)
index : 0
type : VIDEO_OVERLAY
flags : 0
description : "8 bpp, gray"
pixelformat : 0x59455247 [GREY]
VIDIOC_ENUM_FMT(1,VIDEO_OVERLAY)
index : 1
type : VIDEO_OVERLAY
flags : 0
description : "8 bpp, dithered color"
pixelformat : 0x34324948 [HI24]
VIDIOC_ENUM_FMT(2,VIDEO_OVERLAY)
index : 2
type : VIDEO_OVERLAY
flags : 0
description : "15 bpp RGB, le"
pixelformat : 0x4f424752 [RGBO]
VIDIOC_ENUM_FMT(3,VIDEO_OVERLAY)
index : 3
type : VIDEO_OVERLAY
flags : 0
description : "15 bpp RGB, be"
pixelformat : 0x51424752 [RGBQ]
VIDIOC_ENUM_FMT(4,VIDEO_OVERLAY)
index : 4
type : VIDEO_OVERLAY
flags : 0
description : "16 bpp RGB, le"
pixelformat : 0x50424752 [RGBP]
VIDIOC_ENUM_FMT(5,VIDEO_OVERLAY)
index : 5
type : VIDEO_OVERLAY
flags : 0
description : "16 bpp RGB, be"
pixelformat : 0x52424752 [RGBR]
VIDIOC_ENUM_FMT(6,VIDEO_OVERLAY)
index : 6
type : VIDEO_OVERLAY
flags : 0
description : "24 bpp RGB, le"
pixelformat : 0x33524742 [BGR3]
VIDIOC_ENUM_FMT(7,VIDEO_OVERLAY)
index : 7
type : VIDEO_OVERLAY
flags : 0
description : "32 bpp RGB, le"
pixelformat : 0x34524742 [BGR4]
VIDIOC_ENUM_FMT(8,VIDEO_OVERLAY)
index : 8
type : VIDEO_OVERLAY
flags : 0
description : "32 bpp RGB, be"
pixelformat : 0x34424752 [RGB4]
VIDIOC_ENUM_FMT(9,VIDEO_OVERLAY)
index : 9
type : VIDEO_OVERLAY
flags : 0
description : "4:2:2, packed, YUYV"
pixelformat : 0x56595559 [YUYV]
VIDIOC_ENUM_FMT(10,VIDEO_OVERLAY)
index : 10
type : VIDEO_OVERLAY
flags : 0
description : "4:2:2, packed, YUYV"
pixelformat : 0x56595559 [YUYV]
VIDIOC_ENUM_FMT(11,VIDEO_OVERLAY)
index : 11
type : VIDEO_OVERLAY
flags : 0
description : "4:2:2, packed, UYVY"
pixelformat : 0x59565955 [UYVY]
VIDIOC_G_FMT(VIDEO_OVERLAY)
type : VIDEO_OVERLAY
fmt.win.w.left : 0
fmt.win.w.top : 0
fmt.win.w.width : 320
fmt.win.w.height : 240
fmt.win.field : ANY
fmt.win.chromakey : 0
fmt.win.clips : (nil)
fmt.win.clipcount : 0
fmt.win.bitmap : (nil)
VIDIOC_G_FBUF
capability : 0x4 [LIST_CLIPPING]
flags : 0x0 []
base : (nil)
fmt.width : 0
fmt.height : 0
fmt.pixelformat : 0x59565955 [UYVY]
fmt.field : ANY
fmt.bytesperline : 0
fmt.sizeimage : 0
fmt.colorspace : unknown
fmt.priv : 0

vbi capture

    VIDIOC_ENUM_FMT(0,VBI_CAPTURE)
        index                   : 0
        type                    : VBI_CAPTURE
        flags                   : 0
        description             : "vbi data"
        pixelformat             : 0x59455247 [GREY]
    VIDIOC_G_FMT(VBI_CAPTURE)
        type                    : VBI_CAPTURE
        fmt.vbi.sampling_rate   : 35468950
        fmt.vbi.offset          : 244
        fmt.vbi.samples_per_line: 2048
        fmt.vbi.sample_format   : 0x59455247 [GREY]
        fmt.vbi.start[0]        : 7
        fmt.vbi.start[1]        : 320
        fmt.vbi.count[0]        : 16
        fmt.vbi.count[1]        : 16
        fmt.vbi.flags           : 0

controls
VIDIOC_QUERYCTRL(BASE+0)
id : 9963776
type : INTEGER
name : "Brightness"
minimum : 0
maximum : 65535
step : 256
default_value : 32768
flags : 0
VIDIOC_QUERYCTRL(BASE+1)
id : 9963777
type : INTEGER
name : "Contrast"
minimum : 0
maximum : 65535
step : 128
default_value : 32768
flags : 0
VIDIOC_QUERYCTRL(BASE+2)
id : 9963778
type : INTEGER
name : "Saturation"
minimum : 0
maximum : 65535
step : 128
default_value : 32768
flags : 0
VIDIOC_QUERYCTRL(BASE+3)
id : 9963779
type : INTEGER
name : "Hue"
minimum : 0
maximum : 65535
step : 256
default_value : 32768
flags : 0
VIDIOC_QUERYCTRL(BASE+6)
id : 9963782
type : INTEGER
name : "Balance"
minimum : 0
maximum : 65535
step : 655
default_value : 32768
flags : 0
VIDIOC_QUERYCTRL(BASE+7)
id : 9963783
type : INTEGER
name : "Bass"
minimum : 0
maximum : 65535
step : 655
default_value : 32768
flags : 0
VIDIOC_QUERYCTRL(BASE+8)
id : 9963784
type : INTEGER
name : "Treble"
minimum : 0
maximum : 65535
step : 655
default_value : 32768
flags : 0
VIDIOC_QUERYCTRL(BASE+9)
id : 9963785
type : BOOLEAN
name : "Mute"
minimum : 0
maximum : 1
step : 0
default_value : 0
flags : 0
VIDIOC_QUERYCTRL(PRIVATE_BASE+0)
id : 134217728
type : BOOLEAN
name : "chroma agc"
minimum : 0
maximum : 1
step : 0
default_value : 0
flags : 0
VIDIOC_QUERYCTRL(PRIVATE_BASE+1)
id : 134217729
type : BOOLEAN
name : "combfilter"
minimum : 0
maximum : 1
step : 0
default_value : 0
flags : 0
VIDIOC_QUERYCTRL(PRIVATE_BASE+2)
id : 134217730
type : BOOLEAN
name : "automute"
minimum : 0
maximum : 1
step : 0
default_value : 0
flags : 0
VIDIOC_QUERYCTRL(PRIVATE_BASE+3)
id : 134217731
type : BOOLEAN
name : "luma decimation filter"
minimum : 0
maximum : 1
step : 0
default_value : 0
flags : 0
VIDIOC_QUERYCTRL(PRIVATE_BASE+4)
id : 134217732
type : BOOLEAN
name : "agc crush"
minimum : 0
maximum : 1
step : 0
default_value : 0
flags : 0
VIDIOC_QUERYCTRL(PRIVATE_BASE+5)
id : 134217733
type : BOOLEAN
name : "vcr hack"
minimum : 0
maximum : 1
step : 0
default_value : 0
flags : 0
VIDIOC_QUERYCTRL(PRIVATE_BASE+6)
id : 134217734
type : INTEGER
name : "whitecrush upper"
minimum : 0
maximum : 255
step : 1
default_value : 207
flags : 0
VIDIOC_QUERYCTRL(PRIVATE_BASE+7)
id : 134217735
type : INTEGER
name : "whitecrush lower"
minimum : 0
maximum : 255
step : 1
default_value : 127
flags : 0
VIDIOC_QUERYCTRL(PRIVATE_BASE+8)
id : 134217736
type : INTEGER
name : "uv ratio"
minimum : 0
maximum : 100
step : 1
default_value : 50
flags : 0
VIDIOC_QUERYCTRL(PRIVATE_BASE+9)
id : 134217737
type : BOOLEAN
name : "full luma range"
minimum : 0
maximum : 1
step : 0
default_value : 0
flags : 0
VIDIOC_QUERYCTRL(PRIVATE_BASE+10)
id : 134217738
type : INTEGER
name : "coring"
minimum : 0
maximum : 3
step : 1
default_value : 0
flags : 0

### video4linux device info [/dev/video] ###
general info
VIDIOCGCAP
name : "BT878 video (Lifeview FlyVideo "
type : 0x2f
[CAPTURE,TUNER,TELETEXT,OVERLAY,CLIPPING]

        channels                : 4
        audios                  : 0
        maxwidth                : 924
        maxheight               : 576
        minwidth                : 48
        minheight               : 32

channels
VIDIOCGCHAN(0)
channel : 0
name : "Television"
tuners : 1
flags : 0x1 [TUNER]
type : TV
norm : 0
VIDIOCGCHAN(1)
channel : 1
name : "Composite1"
tuners : 0
flags : 0x0 []
type : CAMERA
norm : 0
VIDIOCGCHAN(2)
channel : 2
name : "S-Video"
tuners : 0
flags : 0x0 []
type : CAMERA
norm : 0
VIDIOCGCHAN(3)
channel : 3
name : "Composite3"
tuners : 0
flags : 0x0 []
type : CAMERA
norm : 0

tuner
VIDIOCGTUNER
tuner : 0
name : "Television"
rangelow : 0
rangehigh : 704
flags : 0x0 []
mode : unknown
signal : 0

audio
VIDIOCGAUDIO
audio : 0
volume : 0
bass : 0
treble : 0

picture
VIDIOCGPICT
brightness : 32768
hue : 32768
colour : 32768
contrast : 32768
whiteness : 0
depth : 16
palette : UYVY

buffer
VIDIOCGFBUF
base : (nil)
height : 0
width : 0
depth : 0
bytesperline : 0

window
VIDIOCGWIN
x : 0
y : 0
width : 320
height : 240
chromakey : 0
flags : 0