[mpeg2] got kfir going!

[Kees Cook <cook@cpoint.net>]

But it's kind of strange news.  Short version:

If I load kfir *before* the USB modules, everything is fine.  If I load
kfir AFTER the USB modules, it locks up.

I discovered this while playing with IRQs in my BIOS, and at one point I
turned off USB, and kfir worked.  So then I tried not loading the
USB modules, with USB on in the BIOS and it worked.  Then I tried
loading the USB modules *after* kfir, and everything was fine.

Next question: once I've loaded the firmware, when do I have to do it
again?  Can I forever just insmod kfir with "loaded=1"?


So, now, after all this, I'm running happily, and I was going to change
the settings (I had loaded it only with debug=1).  When I tried to rmmod
the kfir driver, the kernel oops, and left kfir loaded:

kfir                  205248   0 (deleted)

Here is the oops, put through ksymoops:

ksymoops 2.3.7 on i686 2.4.1.  Options used
     -V (default)
     -k /proc/ksyms (default)
     -l /proc/modules (default)
     -o /lib/modules/2.4.1/ (default)
     -m /boot/System.map-2.4.1 (specified)

Warning (compare_ksyms_lsmod): module kfir is in lsmod but not in ksyms,
probably no symbols exported
Unable to handle kernel paging request at virtual address d9888100
d985839f
*pde = 17fbd063
Oops: 0000
CPU:    1
EIP:    0010:[<d985839f>]
Using defaults from ksymoops -t elf32-i386 -a i386
EFLAGS: 00010212
eax: d9888100   ebx: 00200000   ecx: 00000001   edx: d988c000
esi: d98808c0   edi: 00000000   ebp: ceaf2000   esp: ceaf3f5c
ds: 0018   es: 0018   ss: 0018
Process rmmod (pid: 1199, stackpage=ceaf3000)
Stack: d9888100 d9858839 00000a1f c17df000 d9880780 d985850d d98808c0 c019dfff
       c17df000 d9853000 d9853000 d9858566 d9880780 c0118e6b d9853000 fffffff0
       cea8e000 c01181aa d9853000 00000000 ceaf2000 0805666c 00000002 bfffe8dc
Call Trace: [<d9888100>] [<d9858839>] [<d9880780>] [<d985850d>] [<d98808c0>] [<c019dfff>] [<d9853000>]
       [<d9853000>] [<d9858566>] [<d9880780>] [<c0118e6b>] [<d9853000>] [<c01181aa>] [<d9853000>] [<c0108fab>]
Code: 8b 18 68 21 0a 00 00 80 e7 fb 68 39 88 85 d9 8b 86 88 00 00

>>EIP; d985839f <[saa711x].data.end+6728/27b3e9>   <=====
Trace; d9888100 <[saa711x].data.end+36489/27b3e9>
Trace; d9858839 <[saa711x].data.end+6bc2/27b3e9>
Trace; d9880780 <[saa711x].data.end+2eb09/27b3e9>
Trace; d985850d <[saa711x].data.end+6896/27b3e9>
Trace; d98808c0 <[saa711x].data.end+2ec49/27b3e9>
Trace; c019dfff <pci_unregister_driver+33/4c>
Trace; d9853000 <[saa711x].data.end+1389/27b3e9>
Trace; d9853000 <[saa711x].data.end+1389/27b3e9>
Trace; d9858566 <[saa711x].data.end+68ef/27b3e9>
Trace; d9880780 <[saa711x].data.end+2eb09/27b3e9>
Trace; c0118e6b <free_module+1b/9c>
Trace; d9853000 <[saa711x].data.end+1389/27b3e9>
Trace; c01181aa <sys_delete_module+136/25c>
Trace; d9853000 <[saa711x].data.end+1389/27b3e9>
Trace; c0108fab <system_call+33/38>
Code;  d985839f <[saa711x].data.end+6728/27b3e9>
00000000 <_EIP>:
Code;  d985839f <[saa711x].data.end+6728/27b3e9>   <=====
   0:   8b 18                     mov    (%eax),%ebx   <=====
Code;  d98583a1 <[saa711x].data.end+672a/27b3e9>
   2:   68 21 0a 00 00            push   $0xa21
Code;  d98583a6 <[saa711x].data.end+672f/27b3e9>
   7:   80 e7 fb                  and    $0xfb,%bh
Code;  d98583a9 <[saa711x].data.end+6732/27b3e9>
   a:   68 39 88 85 d9            push   $0xd9858839
Code;  d98583ae <[saa711x].data.end+6737/27b3e9>
   f:   8b 86 88 00 00 00         mov    0x88(%esi),%eax



--  
Kees Cook					@outflux.net