Subject: To all gurus out there...

From: Nicolas Pitre <[email-masked]>
Date: Sat, 14 Nov 1998 15:02:04 -0500 (EST)

I'm stuck with a problem wich I can't figure out...

I get the following:

Unable to handle kernel paging request at virtual address 00019038
current->tss.memmap = C0388000
*pgd = c00b6c01, *pmd = c00b6c01, *pte = 00000000
Internal error: Oops: 0
CPU: 0
pc : [<c002f014>]
lr : [<00000003>]
sp : c038ece0  ip : 0000ffff  fp : c038ecf8
r10: 00000000  r9 : c038ee68  r8 : c038ee68
r7 : 00000000  r6 : c038ee68  r5 : 00000000  r4 : c00b4550
r3 : 00000000  r2 : 00019000  r1 : 00000000  r0 : c00b4550
Flags: nzCv  IRQs on  FIQs on  Mode SVC_32
Process cat (pid: 6, stackpage=c038e000)
Stack:
Backtrace:
Function entered at [<c002eeb8>] from [<c002f2ec>]
  r6 = c038ee68
  r5 = 00000000
  r4 = c00b4550
Function entered at [<c002f2b8>] from [<c0033724>]
  r4 = 00000000
Function entered at [<c0033348>] from [<c002b4cc>]
  r9 = c038efb8
  r8 = 03fffefc
  r7 = c02f4a00
  r6 = 00000000
  r5 = c02ce908
  r4 = 00000001
Function entered at [<c002b39c>] from [<c0009f48>]
  r8 = c038eff4
  r7 = 00000000
  r6 = 00000003
  r5 = c038f018
  r4 = 03ffff20
Code: e3520000 15943038 15823038 e5942038 e3520000

>From System.map:

c002eeb8 T _refile_buffer
c002f2b8 T ___brelse
c0033348 T _block_read
c002b39c T _sys_read

The disassembly of the _refile_buffer function gives this around actual
PC:

...
   2eff4:       e5941028        ldr     r1, [r4, #40]
   2eff8:       e51f2160        ldr     r2, 0x2eea0
   2effc:       e7923101        ldr     r3, [r2, r1, lsl #2]
   2f000:       e2433001        sub     r3, r3, #1
   2f004:       e7823101        str     r3, [r2, r1, lsl #2]
   2f008:       e594200c        ldr     r2, [r4, #12]
   2f00c:       e3520000        cmp     r2, #0
   2f010:       15943038        ldrne   r3, [r4, #56]
   2f014:       15823038        strne   r3, [r2, #56]
   2f018:       e5942038        ldr     r2, [r4, #56]
   2f01c:       e3520000        cmp     r2, #0
   2f020:       1594300c        ldrne   r3, [r4, #12]
   2f024:       1582300c        strne   r3, [r2, #12]
   2f028:       e5943004        ldr     r3, [r4, #4]
   2f02c:       e5942000        ldr     r2, [r4]
   2f030:       e0233002        eor     r3, r3, r2
   2f034:       e1a01a03        mov     r1, r3, lsl #20

I'm really confused.  What could lead to a virtual kernel paging request
at virtual address 00019038 ???

It happens every time I try to cat from my flash block driver device and
the cat process get killed.  The kernel still goes on and the shell is
still running.

If anyone out there can enlighten me please don't hesitate!

Thanks!

Nicolas Pitre, B. ing.
[email-masked]

unsubscribe: body of `unsubscribe linux-arm' to [email-masked]

---

From: Nicolas Pitre <[email-masked]>
Date: Sat, 14 Nov 1998 16:52:25 -0500 (EST)

Just in case it may be pertinent to someone...  I forgot to tell that all
the above is based on the latest 2.0.35 ARM kernel source compiled with
gcc-2.7.2.2 (egcs gives the same results).  My request_fn is never
called... so at this point the relation with a possible bug in my driver
is hard to establish...

Nicolas Pitre, B. ing.
[email-masked]

---

From: Philip Blundell <[email-masked]>
Date: Sun, 15 Nov 1998 18:59:22 +0100

>at virtual address 00019038 ???

It looks like R2 is supposed to be a pointer to a structure and you've done an 
element access through it.  You need to chase the code through from the start 
of the function (or look at the source) to find out where that value comes
from.

p.

---

From: Philip Blundell <[email-masked]>
Date: Sun, 15 Nov 1998 21:08:48 +0100

>> Function entered at [<c002f2b8>] from [<c0033724>]

BTW, if anybody out there has too much time on their hands, a worthwhile thing 
to do might be to make a patch to egcs to add an option that forces it to save 
a1-a4 in the function prologue.  This would make these backtraces somewhat 
more useful.

p.