TBS-6922 - Support for? #15

jonathanmbradshaw · 2014-02-25T11:54:49Z

Guys, a short note of thanks for the OpenSource TBS drivers!

I have a 6922, can you tell me if this device is supported in the current code base, if not is practical to support the TBS 6922 in the future?

Once again my thanks for your work and of the O/S TBS Drivers! - jmb

[ 13.894585] DVB: registering new adapter (SAA716x dvb adapter)
[ 14.644669] TurboSight TBS6922 DVB-S2 card MAC=00:22:ab:e0:3b:fb

ljalves · 2014-02-25T12:36:14Z

Can you please post the reference of the 'big' chip on the card?

jonathanmbradshaw · 2014-02-25T13:57:52Z

AV2011 TAS2100 SAA7160ET

The big chip is TSA...

This info is from tbsdtv at http://www.tbsdtv.com/blog/comparison-of-tbs6920-tbs6921-tbs6922.html, I will pull the cover this evening and let you know if I find any different when I inspect the card.

As expected the Big Chip is TAS 2100-CL100

ljalves · 2014-02-25T15:16:41Z

Then it should be easy do add.
Please paste here the output of 'lspci -v | grep -i saa'

jonathanmbradshaw · 2014-02-25T15:51:35Z

lspci -v | grep -i saa

02:00.0 Multimedia controller: Philips Semiconductors SAA7160 (rev 03)
Kernel driver in use: SAA716x TBS

ljalves · 2014-02-25T17:46:08Z

Hi,
Just added the TBS6922 card.
Please test and report if it works.

Regards

jonathanmbradshaw · 2014-02-25T18:07:03Z

I'll load and test this evening..

On Tue, Feb 25, 2014 at 5:46 PM, Luis Alves notifications@github.comwrote:

Hi,
Just added the TBS6922 card.
Please test and report if it works.

Regards

Reply to this email directly or view it on GitHubhttps://github.com//issues/15#issuecomment-36036236
.

crazycat69 · 2014-02-25T20:05:59Z

I check with Technotrend S2-4100 (ODM TBS6922).
Fixed I2Cbus num and LNB pwr ctl.
crazycat69@99cfa63

Tuner/demod attached ok, LNB power and 22KHz ctl is ok, but no lock.

jonathanmbradshaw · 2014-02-25T20:17:00Z

Following is the output from the test (DMESG), it looks like the card did not start.. if you need further info/actions etc.. please let me know, happy to do what I can to help.. jmb

sudo modprobe saa716x_budget int_type=1

modprobe: ERROR: could not insert 'saa716x_budget': Unknown symbol in module,
or unknown parameter (see dmesg)

dmesg

: 
:

[ 181.536331] WARNING: You are using an experimental version of the media stack.
As the driver is backported to an older kernel, it doesn't offer
enough quality for its usage in production.
Use it with care.
Latest git patches (needed if you report a bug to linux-media@vger.kernel.org):
c6d9865 TBS6922: Added card - needs testing. Register init sequence is different in original drivers so it might need to be changed if it doesn't work.
[ 181.544044] tas2101: Unknown symbol i2c_del_mux_adapter (err 0)
[ 181.544079] tas2101: Unknown symbol i2c_add_mux_adapter (err 0)
:
:

jonathanmbradshaw · 2014-02-25T20:18:19Z

Sorry, issue should be open, closed in err

ljalves · 2014-02-25T21:38:56Z

jonathanmbradshaw,
What kernel version are you using?
That issue is easy to solve, but since CrazyCat added the auto kernel dependency for the i2c_mux it should be working...

Can you update to a 'recent' kernel? What linux distro are you using?

ljalves · 2014-02-25T21:45:30Z

CrazyCat,

You're saying that the Technotrend S2-4100 is equal to the TBS6922?

The chips are a bit different from the TBS6982 (demod TAS2100 vs TAS2101 and tuner AV2011 vs AV2012)

Please try to change this:
https://github.com/ljalves/linux_media/blob/latest/drivers/media/pci/saa716x/saa716x_budget.c#L940

The tuner ID should be AV2011 (and not AV2012).

Edit:
Just commited the change: e8507dc
Test and report.

If it still doesn't work, I can code the init reg table for the TAS2100 (which I already confirm that is different from the TAS2101).

crazycat69 · 2014-02-26T00:06:25Z

TT S2-4100 = TBS 6922. Tuner AV2011, Demod TAS 2100.
Now available TBS 6922SE with AV2012/TAS2101 (same price).
Windows and Linux drivers for 6922 and 6922SE is same.

jonathanmbradshaw · 2014-02-27T16:53:50Z

Guy's thanks for all the help so far..

Following a Kernel update to 3.13.4-200.fc20.x86_64 (Fedora 20) things do not seem to have improved. Happy to provide any additional info that might help..

dmesg (following an install and reboot)
:
[ 12.497520] dvb_core: module verification failed: signature and/or required key missing - tainting kernel
[ 12.498533] WARNING: You are using an experimental version of the media stack.
As the driver is backported to an older kernel, it doesn't offer
enough quality for its usage in production.
Use it with care.
Latest git patches (needed if you report a bug to linux-media@vger.kernel.org):
5c665e0 tas2101: Extend modcodes with 16/32APS.
:
[ 12.930586] tas2101: Unknown symbol i2c_del_mux_adapter (err 0)
[ 12.930599] tas2101: Unknown symbol i2c_add_mux_adapter (err 0)
:
[ 13.361774] WARNING: You are using an experimental version of the media stack.
As the driver is backported to an older kernel, it doesn't offer
enough quality for its usage in production.
Use it with care.
Latest git patches (needed if you report a bug to linux-media@vger.kernel.org):
5c665e0 tas2101: Extend modcodes with 16/32APS.
:

crazycat69 · 2014-02-27T18:29:08Z

compiled with media_build ? look like kernel compiled without I2C mux bus support.

jonathanmbradshaw · 2014-02-27T18:56:06Z

As far as I can tell the build has been done following the instructions at https://github.com/ljalves/linux_media/wiki/Installating,-Upgrading-and-Tvheadend

I did observe the following during the most recent build.. perhaps it is relevant

Building modules, stage 2.
MODPOST 582 modules
WARNING: "i2c_add_mux_adapter" [/home/jmb/TVdriver/Pass-3/media_build/v4l/tas2101.ko] undefined!
WARNING: "i2c_del_mux_adapter" [/home/jmb/TVdriver/Pass-3/media_build/v4l/tas2101.ko] undefined!

ljalves · 2014-02-27T19:20:46Z

Did you made a "make distclean" before compiling, after upgrading your kernel?

Try removing the media_build and start from scratch...

jonathanmbradshaw · 2014-02-27T20:08:46Z

git clone git://linuxtv.org/media_build.git
git clone --depth=1 https://github.com/ljalves/linux_media.git -b latest ./media
cd media_build
make dir DIR=../media
make distclean
make
sudo make install
sudo make rmmod
sudo modprobe saa716x_budget int_type=1

As requested, started from scratch but the same result..

jonathanmbradshaw · 2014-03-03T12:08:34Z

Just keeping the LiteOn here,,

Over the weekend I ran the new media_build/media repo's into a 'from DVD' Fedora-20 build with the same result. The original platform (Fedora-18 upgraded [FEDUP] to Fedora-20 @ Linux version 3.13.5-200.fc20.x86_64.) is just the same - no change.

B/R jmb

megavega · 2014-03-14T11:52:21Z

Hi! I got TBS 6922SE with AV2012/TAS2101 chips and i can't make it work in any program in Linux with tbs driver. In Windows board works fine with last driver from tbs. In Linux tuner can show signal level but can't receive any data like in this post #12 . Your driver can't detect any device. I try Ubuntu 12.04 and 13.10. Guys from TBS ignore problem, says what In Windows it works then all is ok. Please add this board to your driver i can't use windows.

Alfredo- · 2014-03-20T16:03:08Z

Hi

There is a way to activate a debug?.
Not working on my pc these drivers. OpenSuse 13.1 64bit

Regards

sveba · 2014-05-09T17:04:00Z

Compiled today with kernel 3.13.0-24-generic on Ubuntu 14.04.
TBS 6922 cannot find any channels:

w_scan -fs -s S19E2 -c DE -X > channels.conf
w_scan version 20130331 (compiled for DVB API 5.10)
using settings for 19.2 east Astra 1F/1G/1H/1KR/1L
scan type SATELLITE, channellist 67
output format czap/tzap/szap/xine
output charset 'UTF-8', use -C <charset> to override
Info: using DVB adapter auto detection.
        /dev/dvb/adapter0/frontend0 -> SATELLITE "Tmax TAS2101": very good :-))

Using SATELLITE frontend (adapter /dev/dvb/adapter0/frontend0)
-_-_-_-_ Getting frontend capabilities-_-_-_-_
Using DVB API 5.a
frontend 'Tmax TAS2101' supports
INVERSION_AUTO
DVB-S
DVB-S2
FREQ (0.95GHz ... 2.15GHz)
SRATE (1.000MSym/s ... 45.000MSym/s)
using LNB "UNIVERSAL"

... at the end

trying 'S  f = 12722 kHz H SR = 22000  5/6 0,35  QPSK'
(time: 04:50)
trying 'S  f = 12729 kHz V SR = 22000  5/6 0,35  QPSK'
(time: 04:53)

ERROR: Sorry - i couldn't get any working frequency/transponder
 Nothing to scan!!

Closed source driver is working :(

megavega · 2014-05-27T21:23:27Z

sveba! How do you compile TBS drivers in U14.04 ? Can u share a list of commands? I have some errors all time. Thanks!

Alfredo- · 2014-06-13T02:41:34Z

Hi
I did the following:
alfredo@linux-lfzk:~> scan -a 0 -n Arsat > sat.conf
scanning Arsat
using '/dev/dvb/adapter0/frontend0' and '/dev/dvb/adapter0/demux0'
initial transponder 11955000 V 2149000 3
initial transponder 12020000 V 30000000 5
>>> tune to: 11955:v:0:2149
DVB-S IF freq is 1355000
WARNING: >>> tuning failed!!!
>>> tune to: 11955:v:0:2149 (tuning failed)
DVB-S IF freq is 1355000
WARNING: >>> tuning failed!!!
>>> tune to: 12020:v:0:30000
DVB-S IF freq is 1420000
WARNING: filter timeout pid 0x0011
WARNING: filter timeout pid 0x0010
WARNING: filter timeout pid 0x0010
dumping lists (27 services)
Done.
Arsat:
# AMC 6 @ 72W
# freq pol sr fec
# Canal 9 Litoral
S 11955000 V 02149000 3/4
# C7, Acua, Tecnópolis, Encuentro, INCA
S 12020000 V 30000000 5/6

And I get:
sat.conf:

{0001}:12020:v:0:30000:272:52:1
{0002}:12020:v:0:30000:288:34:2
{0003}:12020:v:0:30000:304:40:3
{0004}:12020:v:0:30000:320:53:4
{0005}:12020:v:0:30000:43:45:5
{0007}:12020:v:0:30000:368:56:7
{0008}:12020:v:0:30000:384:57:8
{0009}:12020:v:0:30000:400:58:9
{000a}:12020:v:0:30000:416:59:10
{000c}:12020:v:0:30000:448:449:12
{000d}:12020:v:0:30000:464:465:13
{000e}:12020:v:0:30000:480:481:14
{000f}:12020:v:0:30000:496:497:15
{0010}:12020:v:0:30000:77:68:16
{0011}:12020:v:0:30000:144:145:17
{0012}:12020:v:0:30000:81:37:18
{0016}:12020:v:0:30000:70:71:22
{0017}:12020:v:0:30000:72:73:23
{0018}:12020:v:0:30000:74:75:24
{0019}:12020:v:0:30000:49:35:25
{001e}:12020:v:0:30000:1872:1873:30
{0033}:12020:v:0:30000:1296:60:51
{0035}:12020:v:0:30000:85:83:53
{007f}:12020:v:0:30000:1792:1817:127
{03d5}:12020:v:0:30000:0:387:981
{0ffd}:12020:v:0:30000:0:0:4093
{0ffe}:12020:v:0:30000:0:0:4094

{ is [ and } is ]
channel list TP12020: http://www.portaleds.com/espanol/tps.php?sat=2880&fre=12020V

Channels with other frequencies not detected

but I can't see any channel with VLC

crazycat69 · 2014-06-13T02:44:02Z

Look like TBS 6922 and TT S2-4100 noT work. Maybe 6922SE work.

TBS6982 work ok.

Alfredo- · 2014-06-13T02:48:24Z

Hello

What program do you use to watch TV and like you do?

Kaffeine shows occasionally a picture or sound. Usually the screen is gray or green and with some pixelation. But find the channels on this TP.

I have TBS6922 (the old card)

thanks

Alfredo- · 2014-06-13T17:37:31Z

Hi
In the photo you can see a screenshot of a television channel.
At the top is the logo of the channel that is in blue and white.

Regards

ljalves · 2014-06-13T23:12:17Z

Hi Alfredo,
That looks that you might have a weak signal or wrong TP settings (like wrong symbol rate).

Alfredo- · 2014-06-14T01:08:44Z

Thanks for your answer and work.

The TP and SR are correct.

Arrived at this result by chance (accident).
I tested with 2 satellites and their TP; just tuned this TP.

I have no experience, but it could be that this getting bad intermediate frequency or some initialization parameter.
Or when I compiling it gave many lines of warning. Perhaps failure is here

Some of them:

/home/alfredo/TBS6922/git-11-06-2014/media_build/v4l/saa716x_pci.c:20:20: warning: 'saa716x_msi_handler' defined but not used [-Wunused-function]
static irqreturn_t saa716x_msi_handler(int irq, void *dev_id)
^
In file included from /home/alfredo/TBS6922/git-11-06-2014/media_build/v4l/saa716x_rom.c:7:0:
/home/alfredo/TBS6922/git-11-06-2014/media_build/v4l/saa716x_rom.c: In function 'saa716x_eeprom_header':
/home/alfredo/TBS6922/git-11-06-2014/media_build/v4l/saa716x_rom.c:117:19: warning: format '%d' expects argument of type 'int', but argument 4 has type 'long unsigned int' [-Wformat=]
sizeof (struct saa716x_romhdr),
^
/home/alfredo/TBS6922/git-11-06-2014/media_build/v4l/saa716x_priv.h:39:72: note: in definition of macro 'dprintk'
printk(KERN_ERR "%s (%d): " fmt "\n" , __func , SAA716x_DEV , ##arg);
^
/home/alfredo/TBS6922/git-11-06-2014/media_build/v4l/saa716x_rom.c:117:19: warning: format '%d' expects argument of type 'int', but argument 4 has type 'long unsigned int' [-Wformat=]
sizeof (struct saa716x_romhdr),
^
/home/alfredo/TBS6922/git-11-06-2014/media_build/v4l/saa716x_priv.h:41:75: note: in definition of macro 'dprintk'
printk(KERN_NOTICE "%s (%d): " __fmt "\n" , __func , SAA716x_DEV , ##__arg);
^
/home/alfredo/TBS6922/git-11-06-2014/media_build/v4l/saa716x_rom.c:117:19: warning: format '%d' expects argument of type 'int', but argument 4 has type 'long unsigned int' [-Wformat=]
sizeof (struct saa716x_romhdr), ...

Thanks, again

Alfredo- · 2014-06-14T23:14:32Z

Hi Luis

I expand a bit: I've tried other satellites and some can "tune" some TP, but not all.
In all cases the image is like the one I presented. In some cases he could find the provider and programming.
All I have used TP, I watch perfectly with the proprietary driver.

How you get initialization of integrated circuit TAS2101? Which card?
I ask because I spend with another TV card, the one I had was a little different initialization which had used the developer and this was the problem, and this case is very similar.

VLC gives the following:

ts debug: transport_error_indicator set (pid=593)
ts warning: first packet for pid=594 cc=0x2
ts debug: transport_error_indicator set (pid=593)
ts warning: discontinuity received 0x9 instead of 0x8 (pid=593)
ts debug: transport_error_indicator set (pid=593)
ts warning: discontinuity received 0xb instead of 0xa (pid=593)
ts warning: discontinuity received 0xe instead of 0xd (pid=593)
ts debug: transport_error_indicator set (pid=594)
ts debug: transport_error_indicator set (pid=593)
ts warning: discontinuity received 0x6 instead of 0xf (pid=593)
ts warning: scrambled state changed on pid 593 (0->1)
ts warning: discontinuity received 0x5 instead of 0x7 (pid=593)
ts warning: scrambled state changed on pid 593 (1->0)
ts warning: discontinuity received 0x7 instead of 0x6 (pid=593)

Gracias, obrigado, thanks.

Alfredo- · 2014-06-19T22:19:30Z

Hi all

I think that what follows shows the problem with the driver to work.
The TP's 11528000, 11560000, 11600000, 11640000 and 11670000 channel takes TP 11520.
It's like failing to recognize the frequency that has to work.

Regards

alfredo@linux-lfzk:~> scan -a 0 -n TupacKatari > tupac.conf
scanning TupacKatari
using '/dev/dvb/adapter0/frontend0' and '/dev/dvb/adapter0/demux0'
initial transponder 11480000 H 15000000 3
initial transponder 11480000 V 15000000 3
initial transponder 11520000 V 30000000 3
initial transponder 11528000 V 30000000 3
initial transponder 11560000 V 30000000 3
initial transponder 11600000 V 30000000 3
initial transponder 11640000 V 30000000 3
initial transponder 11670000 V 30000000 3

tune to: 11480:h:0:15000
DVB-S IF freq is 1730000
WARNING: >>> tuning failed!!!
tune to: 11480:h:0:15000 (tuning failed)
DVB-S IF freq is 1730000
WARNING: >>> tuning failed!!!
tune to: 11480:v:0:15000
DVB-S IF freq is 1730000
WARNING: >>> tuning failed!!!
tune to: 11480:v:0:15000 (tuning failed)
DVB-S IF freq is 1730000
WARNING: >>> tuning failed!!!
tune to: 11520:v:0:30000
DVB-S IF freq is 1770000
Network Name 'Site - 1'
0x0000 0x0013: pmt_pid 0x005b Harmonic -- NICK JR (running)
0x0000 0x0014: pmt_pid 0x0043 Harmonic -- De Pelicula (running)
0x0000 0x0020: pmt_pid 0x0044 Harmonic -- Golden (running)
0x0000 0x0021: pmt_pid 0x0023 Harmonic -- GoldenEdge (running)
0x0000 0x0022: pmt_pid 0x0052 Harmonic -- Film Arts (running)
0x0000 0x0027: pmt_pid 0x0061 Harmonic -- Comedy Central (running)
0x0000 0x0032: pmt_pid 0x0027 Harmonic -- Gourmet (running)
0x0000 0x0034: pmt_pid 0x004b Harmonic -- Casa Club (running)
0x0000 0x0036: pmt_pid 0x0020 Harmonic -- Canal De Las Estrellas (running)
0x0000 0x0037: pmt_pid 0x003e Harmonic -- Tv Novelas (running)
0x0000 0x0047: pmt_pid 0x0053 Harmonic -- MTV (running)
0x0000 0x0049: pmt_pid 0x005c Harmonic -- VH-1 (running)
0x0000 0x004b: pmt_pid 0x0036 Harmonic -- RitmoSon (running)
0x0000 0x004c: pmt_pid 0x003a Harmonic -- Telehit (running)
0x0000 0x0051: pmt_pid 0x006d Harmonic -- History HD (running)
0x0000 0x005d: pmt_pid 0x0031 Harmonic -- Distrio Comedia (running)
0x0000 0x0069: pmt_pid 0x0072 Harmonic -- WB HD (running)
0x0000 0x006f: pmt_pid 0x0051 Harmonic -- Cosmo LA (running)
0x0000 0x0070: pmt_pid 0x005a Harmonic -- Reality TV (running)
WARNING: filter timeout pid 0x0010
tune to: 11528:v:0:30000
DVB-S IF freq is 1778000
Network Name 'Site - 1'
0x0000 0x0013: pmt_pid 0x005b Harmonic -- NICK JR (running)
0x0000 0x0014: pmt_pid 0x0043 Harmonic -- De Pelicula (running)
0x0000 0x0020: pmt_pid 0x0044 Harmonic -- Golden (running)
0x0000 0x0021: pmt_pid 0x0023 Harmonic -- GoldenEdge (running)
0x0000 0x0022: pmt_pid 0x0052 Harmonic -- Film Arts (running)
0x0000 0x0027: pmt_pid 0x0061 Harmonic -- Comedy Central (running)
0x0000 0x0032: pmt_pid 0x0027 Harmonic -- Gourmet (running)
0x0000 0x0034: pmt_pid 0x004b Harmonic -- Casa Club (running)
0x0000 0x0036: pmt_pid 0x0020 Harmonic -- Canal De Las Estrellas (running)
0x0000 0x0037: pmt_pid 0x003e Harmonic -- Tv Novelas (running)
0x0000 0x0047: pmt_pid 0x0053 Harmonic -- MTV (running)
0x0000 0x0049: pmt_pid 0x005c Harmonic -- VH-1 (running)
0x0000 0x004b: pmt_pid 0x0036 Harmonic -- RitmoSon (running)
0x0000 0x004c: pmt_pid 0x003a Harmonic -- Telehit (running)
0x0000 0x0051: pmt_pid 0x006d Harmonic -- History HD (running)
0x0000 0x005d: pmt_pid 0x0031 Harmonic -- Distrio Comedia (running)
0x0000 0x0069: pmt_pid 0x0072 Harmonic -- WB HD (running)
0x0000 0x006f: pmt_pid 0x0051 Harmonic -- Cosmo LA (running)
0x0000 0x0070: pmt_pid 0x005a Harmonic -- Reality TV (running)
WARNING: filter timeout pid 0x0010
tune to: 11560:v:0:30000
DVB-S IF freq is 1810000
0x0000 0x0013: pmt_pid 0x0000 Harmonic -- NICK JR (running)
0x0000 0x0014: pmt_pid 0x0000 Harmonic -- De Pelicula (running)
0x0000 0x0020: pmt_pid 0x0000 Harmonic -- Golden (running)
0x0000 0x0021: pmt_pid 0x0000 Harmonic -- GoldenEdge (running)
0x0000 0x0022: pmt_pid 0x0000 Harmonic -- Film Arts (running)
0x0000 0x0027: pmt_pid 0x0000 Harmonic -- Comedy Central (running)
0x0000 0x0032: pmt_pid 0x0000 Harmonic -- Gourmet (running)
0x0000 0x0034: pmt_pid 0x0000 Harmonic -- Casa Club (running)
0x0000 0x0036: pmt_pid 0x0000 Harmonic -- Canal De Las Estrellas (running)
0x0000 0x0037: pmt_pid 0x0000 Harmonic -- Tv Novelas (running)
0x0000 0x0047: pmt_pid 0x0000 Harmonic -- MTV (running)
0x0000 0x0049: pmt_pid 0x0000 Harmonic -- VH-1 (running)
0x0000 0x004b: pmt_pid 0x0000 Harmonic -- RitmoSon (running)
0x0000 0x004c: pmt_pid 0x0000 Harmonic -- Telehit (running)
0x0000 0x0051: pmt_pid 0x0000 Harmonic -- History HD (running)
0x0000 0x005d: pmt_pid 0x0000 Harmonic -- Distrio Comedia (running)
0x0000 0x0069: pmt_pid 0x0000 Harmonic -- WB HD (running)
0x0000 0x006f: pmt_pid 0x0000 Harmonic -- Cosmo LA (running)
0x0000 0x0070: pmt_pid 0x0000 Harmonic -- Reality TV (running)
Network Name 'Site - 1'
WARNING: filter timeout pid 0x0010
tune to: 11600:v:0:30000
DVB-S IF freq is 1850000
Network Name 'Site - 1'
0x0000 0x0013: pmt_pid 0x005b Harmonic -- NICK JR (running)
0x0000 0x0014: pmt_pid 0x0043 Harmonic -- De Pelicula (running)
0x0000 0x0020: pmt_pid 0x0044 Harmonic -- Golden (running)
0x0000 0x0021: pmt_pid 0x0023 Harmonic -- GoldenEdge (running)
0x0000 0x0022: pmt_pid 0x0052 Harmonic -- Film Arts (running)
0x0000 0x0027: pmt_pid 0x0061 Harmonic -- Comedy Central (running)
0x0000 0x0032: pmt_pid 0x0027 Harmonic -- Gourmet (running)
0x0000 0x0034: pmt_pid 0x004b Harmonic -- Casa Club (running)
0x0000 0x0036: pmt_pid 0x0020 Harmonic -- Canal De Las Estrellas (running)
0x0000 0x0037: pmt_pid 0x003e Harmonic -- Tv Novelas (running)
0x0000 0x0047: pmt_pid 0x0053 Harmonic -- MTV (running)
0x0000 0x0049: pmt_pid 0x005c Harmonic -- VH-1 (running)
0x0000 0x004b: pmt_pid 0x0036 Harmonic -- RitmoSon (running)
0x0000 0x004c: pmt_pid 0x003a Harmonic -- Telehit (running)
0x0000 0x0051: pmt_pid 0x006d Harmonic -- History HD (running)
0x0000 0x005d: pmt_pid 0x0031 Harmonic -- Distrio Comedia (running)
0x0000 0x0069: pmt_pid 0x0072 Harmonic -- WB HD (running)
0x0000 0x006f: pmt_pid 0x0051 Harmonic -- Cosmo LA (running)
0x0000 0x0070: pmt_pid 0x005a Harmonic -- Reality TV (running)
WARNING: filter timeout pid 0x0010
tune to: 11640:v:0:30000
DVB-S IF freq is 1890000
Network Name 'Site - 1'
0x0000 0x0013: pmt_pid 0x005b Harmonic -- NICK JR (running)
0x0000 0x0014: pmt_pid 0x0043 Harmonic -- De Pelicula (running)
0x0000 0x0020: pmt_pid 0x0044 Harmonic -- Golden (running)
0x0000 0x0021: pmt_pid 0x0023 Harmonic -- GoldenEdge (running)
0x0000 0x0022: pmt_pid 0x0052 Harmonic -- Film Arts (running)
0x0000 0x0027: pmt_pid 0x0061 Harmonic -- Comedy Central (running)
0x0000 0x0032: pmt_pid 0x0027 Harmonic -- Gourmet (running)
0x0000 0x0034: pmt_pid 0x004b Harmonic -- Casa Club (running)
0x0000 0x0036: pmt_pid 0x0020 Harmonic -- Canal De Las Estrellas (running)
0x0000 0x0037: pmt_pid 0x003e Harmonic -- Tv Novelas (running)
0x0000 0x0047: pmt_pid 0x0053 Harmonic -- MTV (running)
0x0000 0x0049: pmt_pid 0x005c Harmonic -- VH-1 (running)
0x0000 0x004b: pmt_pid 0x0036 Harmonic -- RitmoSon (running)
0x0000 0x004c: pmt_pid 0x003a Harmonic -- Telehit (running)
0x0000 0x0051: pmt_pid 0x006d Harmonic -- History HD (running)
0x0000 0x005d: pmt_pid 0x0031 Harmonic -- Distrio Comedia (running)
0x0000 0x0069: pmt_pid 0x0072 Harmonic -- WB HD (running)
0x0000 0x006f: pmt_pid 0x0051 Harmonic -- Cosmo LA (running)
0x0000 0x0070: pmt_pid 0x005a Harmonic -- Reality TV (running)
WARNING: filter timeout pid 0x0010
tune to: 11670:v:0:30000
DVB-S IF freq is 1920000
Network Name 'Site - 1'
0x0000 0x0013: pmt_pid 0x0000 Harmonic -- NICK JR (running)
0x0000 0x0014: pmt_pid 0x0000 Harmonic -- De Pelicula (running)
0x0000 0x0020: pmt_pid 0x0000 Harmonic -- Golden (running)
0x0000 0x0021: pmt_pid 0x0000 Harmonic -- GoldenEdge (running)
0x0000 0x0022: pmt_pid 0x0000 Harmonic -- Film Arts (running)
0x0000 0x0027: pmt_pid 0x0000 Harmonic -- Comedy Central (running)
0x0000 0x0032: pmt_pid 0x0000 Harmonic -- Gourmet (running)
0x0000 0x0034: pmt_pid 0x0000 Harmonic -- Casa Club (running)
0x0000 0x0036: pmt_pid 0x0000 Harmonic -- Canal De Las Estrellas (running)
0x0000 0x0037: pmt_pid 0x0000 Harmonic -- Tv Novelas (running)
0x0000 0x0047: pmt_pid 0x0000 Harmonic -- MTV (running)
0x0000 0x0049: pmt_pid 0x0000 Harmonic -- VH-1 (running)
0x0000 0x004b: pmt_pid 0x0000 Harmonic -- RitmoSon (running)
0x0000 0x004c: pmt_pid 0x0000 Harmonic -- Telehit (running)
0x0000 0x0051: pmt_pid 0x0000 Harmonic -- History HD (running)
0x0000 0x005d: pmt_pid 0x0000 Harmonic -- Distrio Comedia (running)
0x0000 0x0069: pmt_pid 0x0000 Harmonic -- WB HD (running)
0x0000 0x006f: pmt_pid 0x0000 Harmonic -- Cosmo LA (running)
0x0000 0x0070: pmt_pid 0x0000 Harmonic -- Reality TV (running)
WARNING: filter timeout pid 0x0010
tune to: 1160:v:0:30000
DVB-S IF freq is 8590000
__tune_to_transponder:1910: ERROR: Setting frontend parameters failed: 22 Invalid argument
tune to: 1160:v:0:30000
DVB-S IF freq is 8590000
__tune_to_transponder:1910: ERROR: Setting frontend parameters failed: 22 Invalid argument
tune to: 1130:v:0:60000
DVB-S IF freq is 8620000
__tune_to_transponder:1910: ERROR: Setting frontend parameters failed: 22 Invalid argument
tune to: 1130:v:0:60000
DVB-S IF freq is 8620000
__tune_to_transponder:1910: ERROR: Setting frontend parameters failed: 22 Invalid argument
tune to: 1010:v:0:60000
DVB-S IF freq is 8740000
__tune_to_transponder:1910: ERROR: Setting frontend parameters failed: 22 Invalid argument
tune to: 1010:v:0:60000
DVB-S IF freq is 8740000
__tune_to_transponder:1910: ERROR: Setting frontend parameters failed: 22 Invalid argument
tune to: 0:v:0:60000
DVB-S IF freq is 9750000
__tune_to_transponder:1910: ERROR: Setting frontend parameters failed: 22 Invalid argument
tune to: 0:v:0:60000
DVB-S IF freq is 9750000
__tune_to_transponder:1910: ERROR: Setting frontend parameters failed: 22 Invalid argument
tune to: 1050:v:0:60000
DVB-S IF freq is 8700000
__tune_to_transponder:1910: ERROR: Setting frontend parameters failed: 22 Invalid argument
tune to: 1050:v:0:60000
DVB-S IF freq is 8700000
__tune_to_transponder:1910: ERROR: Setting frontend parameters failed: 22 Invalid argument
dumping lists (114 services)
Done.

dmesg:

[ 4617.222542] SAA716x Budget 0000:02:00.0: DVB: adapter 0 frontend 0 frequency 8590000 out of range (950000..2150000)
[ 4617.484032] SAA716x Budget 0000:02:00.0: DVB: adapter 0 frontend 0 frequency 8590000 out of range (950000..2150000)
[ 4617.747067] SAA716x Budget 0000:02:00.0: DVB: adapter 0 frontend 0 frequency 8620000 out of range (950000..2150000)
[ 4618.009852] SAA716x Budget 0000:02:00.0: DVB: adapter 0 frontend 0 frequency 8620000 out of range (950000..2150000)
[ 4618.272646] SAA716x Budget 0000:02:00.0: DVB: adapter 0 frontend 0 frequency 8740000 out of range (950000..2150000)
[ 4618.535427] SAA716x Budget 0000:02:00.0: DVB: adapter 0 frontend 0 frequency 8740000 out of range (950000..2150000)
[ 4618.798213] SAA716x Budget 0000:02:00.0: DVB: adapter 0 frontend 0 frequency 9750000 out of range (950000..2150000)
[ 4619.061006] SAA716x Budget 0000:02:00.0: DVB: adapter 0 frontend 0 frequency 9750000 out of range (950000..2150000)
[ 4619.323651] SAA716x Budget 0000:02:00.0: DVB: adapter 0 frontend 0 frequency 8700000 out of range (950000..2150000)
[ 4619.586589] SAA716x Budget 0000:02:00.0: DVB: adapter 0 frontend 0 frequency 8700000 out of range (950000..2150000)

Commit 8aac627 "move exit_task_namespaces() outside of exit_notify" introduced the kernel opps since the kernel v3.10, which happens when Apparmor and IMA-appraisal are enabled at the same time. ---------------------------------------------------------------------- [ 106.750167] BUG: unable to handle kernel NULL pointer dereference at 0000000000000018 [ 106.750221] IP: [<ffffffff811ec7da>] our_mnt+0x1a/0x30 [ 106.750241] PGD 0 [ 106.750254] Oops: 0000 [#1] SMP [ 106.750272] Modules linked in: cuse parport_pc ppdev bnep rfcomm bluetooth rpcsec_gss_krb5 nfsd auth_rpcgss nfs_acl nfs lockd sunrpc fscache dm_crypt intel_rapl x86_pkg_temp_thermal intel_powerclamp kvm_intel snd_hda_codec_hdmi kvm crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel aes_x86_64 glue_helper lrw gf128mul ablk_helper cryptd snd_hda_codec_realtek dcdbas snd_hda_intel snd_hda_codec snd_hwdep snd_pcm snd_page_alloc snd_seq_midi snd_seq_midi_event snd_rawmidi psmouse snd_seq microcode serio_raw snd_timer snd_seq_device snd soundcore video lpc_ich coretemp mac_hid lp parport mei_me mei nbd hid_generic e1000e usbhid ahci ptp hid libahci pps_core [ 106.750658] CPU: 6 PID: 1394 Comm: mysqld Not tainted 3.13.0-rc7-kds+ #15 [ 106.750673] Hardware name: Dell Inc. OptiPlex 9010/0M9KCM, BIOS A08 09/19/2012 [ 106.750689] task: ffff8800de804920 ti: ffff880400fca000 task.ti: ffff880400fca000 [ 106.750704] RIP: 0010:[<ffffffff811ec7da>] [<ffffffff811ec7da>] our_mnt+0x1a/0x30 [ 106.750725] RSP: 0018:ffff880400fcba60 EFLAGS: 00010286 [ 106.750738] RAX: 0000000000000000 RBX: 0000000000000100 RCX: ffff8800d51523e7 [ 106.750764] RDX: ffffffffffffffea RSI: ffff880400fcba34 RDI: ffff880402d20020 [ 106.750791] RBP: ffff880400fcbae0 R08: 0000000000000000 R09: 0000000000000001 [ 106.750817] R10: 0000000000000000 R11: 0000000000000001 R12: ffff8800d5152300 [ 106.750844] R13: ffff8803eb8df510 R14: ffff880400fcbb28 R15: ffff8800d51523e7 [ 106.750871] FS: 0000000000000000(0000) GS:ffff88040d200000(0000) knlGS:0000000000000000 [ 106.750910] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 106.750935] CR2: 0000000000000018 CR3: 0000000001c0e000 CR4: 00000000001407e0 [ 106.750962] Stack: [ 106.750981] ffffffff813434eb ffff880400fcbb20 ffff880400fcbb18 0000000000000000 [ 106.751037] ffff8800de804920 ffffffff8101b9b9 0001800000000000 0000000000000100 [ 106.751093] 0000010000000000 0000000000000002 000000000000000e ffff8803eb8df500 [ 106.751149] Call Trace: [ 106.751172] [<ffffffff813434eb>] ? aa_path_name+0x2ab/0x430 [ 106.751199] [<ffffffff8101b9b9>] ? sched_clock+0x9/0x10 [ 106.751225] [<ffffffff8134a68d>] aa_path_perm+0x7d/0x170 [ 106.751250] [<ffffffff8101b945>] ? native_sched_clock+0x15/0x80 [ 106.751276] [<ffffffff8134aa73>] aa_file_perm+0x33/0x40 [ 106.751301] [<ffffffff81348c5e>] common_file_perm+0x8e/0xb0 [ 106.751327] [<ffffffff81348d78>] apparmor_file_permission+0x18/0x20 [ 106.751355] [<ffffffff8130c853>] security_file_permission+0x23/0xa0 [ 106.751382] [<ffffffff811c77a2>] rw_verify_area+0x52/0xe0 [ 106.751407] [<ffffffff811c789d>] vfs_read+0x6d/0x170 [ 106.751432] [<ffffffff811cda31>] kernel_read+0x41/0x60 [ 106.751457] [<ffffffff8134fd45>] ima_calc_file_hash+0x225/0x280 [ 106.751483] [<ffffffff8134fb52>] ? ima_calc_file_hash+0x32/0x280 [ 106.751509] [<ffffffff8135022d>] ima_collect_measurement+0x9d/0x160 [ 106.751536] [<ffffffff810b552d>] ? trace_hardirqs_on+0xd/0x10 [ 106.751562] [<ffffffff8134f07c>] ? ima_file_free+0x6c/0xd0 [ 106.751587] [<ffffffff81352824>] ima_update_xattr+0x34/0x60 [ 106.751612] [<ffffffff8134f0d0>] ima_file_free+0xc0/0xd0 [ 106.751637] [<ffffffff811c9635>] __fput+0xd5/0x300 [ 106.751662] [<ffffffff811c98ae>] ____fput+0xe/0x10 [ 106.751687] [<ffffffff81086774>] task_work_run+0xc4/0xe0 [ 106.751712] [<ffffffff81066fad>] do_exit+0x2bd/0xa90 [ 106.751738] [<ffffffff8173c958>] ? retint_swapgs+0x13/0x1b [ 106.751763] [<ffffffff8106780c>] do_group_exit+0x4c/0xc0 [ 106.751788] [<ffffffff81067894>] SyS_exit_group+0x14/0x20 [ 106.751814] [<ffffffff8174522d>] system_call_fastpath+0x1a/0x1f [ 106.751839] Code: c3 0f 1f 44 00 00 55 48 89 e5 e8 22 fe ff ff 5d c3 0f 1f 44 00 00 55 65 48 8b 04 25 c0 c9 00 00 48 8b 80 28 06 00 00 48 89 e5 5d <48> 8b 40 18 48 39 87 c0 00 00 00 0f 94 c0 c3 0f 1f 80 00 00 00 [ 106.752185] RIP [<ffffffff811ec7da>] our_mnt+0x1a/0x30 [ 106.752214] RSP <ffff880400fcba60> [ 106.752236] CR2: 0000000000000018 [ 106.752258] ---[ end trace 3c520748b4732721 ]--- ---------------------------------------------------------------------- The reason for the oops is that IMA-appraisal uses "kernel_read()" when file is closed. kernel_read() honors LSM security hook which calls Apparmor handler, which uses current->nsproxy->mnt_ns. The 'guilty' commit changed the order of cleanup code so that nsproxy->mnt_ns was not already available for Apparmor. Discussion about the issue with Al Viro and Eric W. Biederman suggested that kernel_read() is too high-level for IMA. Another issue, except security checking, that was identified is mandatory locking. kernel_read honors it as well and it might prevent IMA from calculating necessary hash. It was suggested to use simplified version of the function without security and locking checks. This patch introduces special version ima_kernel_read(), which skips security and mandatory locking checking. It prevents the kernel oops to happen. Signed-off-by: Dmitry Kasatkin <d.kasatkin@samsung.com> Suggested-by: Eric W. Biederman <ebiederm@xmission.com> Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com> Cc: <stable@vger.kernel.org>

ljalves · 2014-06-25T14:20:15Z

Hmmm, this may be related to the tuner settings.
You have the TBS6922 (non-SE) ?
Can you put here check the chips used in the card?
I mainly need to know the demod (should be something like TAS2101?) and tuner (AV2011?)

Alfredo- · 2014-06-25T22:08:19Z

Hi Luis

El 25/06/14 11:20, Luis Alves escribió:

Hmmm, this may be related to the tuner settings.

Yeah, that seems

You have the TBS6922 (non-SE) ?

Only TBS6922 (the old card).

Can you put here check the chips used in the card?
I mainly need to know the demod (should be something like TAS2101?)
and tuner (AV2011?)

Big chip:

Tmax
TAS2100
-CL100
T1110
T4H072F13

small chip

SAA7160ET
Q737NTV
02
2S10502
Trident

Sorry, I can't see the tuner. It is under shield.

Regards

This patch tries to fix this crash: #5 [ffff88003c1cd690] do_invalid_op at ffffffff810166d5 #6 [ffff88003c1cd730] invalid_op at ffffffff8159b2de [exception RIP: ocfs2_direct_IO_get_blocks+359] RIP: ffffffffa05dfa27 RSP: ffff88003c1cd7e8 RFLAGS: 00010202 RAX: 0000000000000000 RBX: ffff88003c1cdaa8 RCX: 0000000000000000 RDX: 000000000000000c RSI: ffff880027a95000 RDI: ffff88003c79b540 RBP: ffff88003c1cd858 R8: 0000000000000000 R9: ffffffff815f6ba0 R10: 00000000000001c9 R11: 00000000000001c9 R12: ffff88002d271500 R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000001000 ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018 #7 [ffff88003c1cd860] do_direct_IO at ffffffff811cd31b #8 [ffff88003c1cd950] direct_IO_iovec at ffffffff811cde9c #9 [ffff88003c1cd9b0] do_blockdev_direct_IO at ffffffff811ce764 #10 [ffff88003c1cdb80] __blockdev_direct_IO at ffffffff811ce7cc #11 [ffff88003c1cdbb0] ocfs2_direct_IO at ffffffffa05df756 [ocfs2] #12 [ffff88003c1cdbe0] generic_file_direct_write_iter at ffffffff8112f935 #13 [ffff88003c1cdc40] ocfs2_file_write_iter at ffffffffa0600ccc [ocfs2] #14 [ffff88003c1cdd50] do_aio_write at ffffffff8119126c #15 [ffff88003c1cddc0] aio_rw_vect_retry at ffffffff811d9bb4 #16 [ffff88003c1cddf0] aio_run_iocb at ffffffff811db880 #17 [ffff88003c1cde30] io_submit_one at ffffffff811dc238 #18 [ffff88003c1cde80] do_io_submit at ffffffff811dc437 #19 [ffff88003c1cdf70] sys_io_submit at ffffffff811dc530 #20 [ffff88003c1cdf80] system_call_fastpath at ffffffff8159a159 It crashes at BUG_ON(create && (ext_flags & OCFS2_EXT_REFCOUNTED)); in ocfs2_direct_IO_get_blocks. ocfs2_direct_IO_get_blocks is expecting the OCFS2_EXT_REFCOUNTED be removed in ocfs2_prepare_inode_for_write() if it was there. But no cluster lock is taken during the time before (or inside) ocfs2_prepare_inode_for_write() and after ocfs2_direct_IO_get_blocks(). It can happen in this case: Node A(which crashes) Node B ------------------------ --------------------------- ocfs2_file_aio_write ocfs2_prepare_inode_for_write ocfs2_inode_lock ... ocfs2_inode_unlock #no refcount found .... ocfs2_reflink ocfs2_inode_lock ... ocfs2_inode_unlock #now, refcount flag set on extent ... flush change to disk ocfs2_direct_IO_get_blocks ocfs2_get_clusters #extent map miss #buffer_head miss read extents from disk found refcount flag on extent crash.. Fix: Take rw_lock in ocfs2_reflink path Signed-off-by: Wengang Wang <wen.gang.wang@oracle.com> Reviewed-by: Mark Fasheh <mfasheh@suse.de> Cc: Joel Becker <jlbec@evilplan.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

ljalves · 2014-07-19T19:50:10Z

I've changed the tuner init for the tbs6922.
Please test using 'latest' branch.

Alfredo- · 2014-07-20T22:11:25Z

Hi
Without change.

Subjectively: perhaps a little better picture (see my previous posts) 10 or 15%.

Thanks,

Alfredo

ljalves · 2014-07-20T22:28:46Z

I think I found the issue.
Let me commit the changes (probably tomorrow) and them I'll ask you to re-test.

Alfredo- · 2014-07-20T22:54:09Z

OK, I wait for the patch

If you do not have the card TBS6922 --> (Thanks)²

ljalves · 2014-07-21T11:21:03Z

Hi @Alfredo-

Please update the tree to the 'latest' branch and retry.
Please report if it works now.

Alfredo- · 2014-07-21T19:33:12Z

Hi Luis

The Free driver is working, but I need more time for test.

Thank you very much,

Alfredo

ljalves · 2014-07-22T23:16:01Z

Great that it works. Closing this issue. Fell free to re-open it if you encounter any problem.

This patch wires up the new syscall sys_bpf() on powerpc. Passes the tests in samples/bpf: #0 add+sub+mul OK #1 unreachable OK #2 unreachable2 OK #3 out of range jump OK #4 out of range jump2 OK #5 test1 ld_imm64 OK #6 test2 ld_imm64 OK #7 test3 ld_imm64 OK #8 test4 ld_imm64 OK #9 test5 ld_imm64 OK #10 no bpf_exit OK #11 loop (back-edge) OK #12 loop2 (back-edge) OK #13 conditional loop OK #14 read uninitialized register OK #15 read invalid register OK #16 program doesn't init R0 before exit OK #17 stack out of bounds OK #18 invalid call insn1 OK #19 invalid call insn2 OK #20 invalid function call OK #21 uninitialized stack1 OK #22 uninitialized stack2 OK #23 check valid spill/fill OK #24 check corrupted spill/fill OK #25 invalid src register in STX OK #26 invalid dst register in STX OK #27 invalid dst register in ST OK #28 invalid src register in LDX OK #29 invalid dst register in LDX OK #30 junk insn OK #31 junk insn2 OK #32 junk insn3 OK #33 junk insn4 OK #34 junk insn5 OK #35 misaligned read from stack OK #36 invalid map_fd for function call OK #37 don't check return value before access OK #38 access memory with incorrect alignment OK #39 sometimes access memory with incorrect alignment OK #40 jump test 1 OK #41 jump test 2 OK #42 jump test 3 OK #43 jump test 4 OK Signed-off-by: Pranith Kumar <bobby.prani@gmail.com> [mpe: test using samples/bpf] Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>

Calling btrfs_qgroup_reserve_meta_prealloc from btrfs_delayed_inode_reserve_metadata can result in flushing delalloc while holding a transaction and delayed node locks. This is deadlock prone. In the past multiple commits: * ae5e070 ("btrfs: qgroup: don't try to wait flushing if we're already holding a transaction") * 6f23277 ("btrfs: qgroup: don't commit transaction when we already hold the handle") Tried to solve various aspects of this but this was always a whack-a-mole game. Unfortunately those 2 fixes don't solve a deadlock scenario involving btrfs_delayed_node::mutex. Namely, one thread can call btrfs_dirty_inode as a result of reading a file and modifying its atime: PID: 6963 TASK: ffff8c7f3f94c000 CPU: 2 COMMAND: "test" #0 __schedule at ffffffffa529e07d ljalves#1 schedule at ffffffffa529e4ff ljalves#2 schedule_timeout at ffffffffa52a1bdd ljalves#3 wait_for_completion at ffffffffa529eeea <-- sleeps with delayed node mutex held ljalves#4 start_delalloc_inodes at ffffffffc0380db5 ljalves#5 btrfs_start_delalloc_snapshot at ffffffffc0393836 ljalves#6 try_flush_qgroup at ffffffffc03f04b2 ljalves#7 __btrfs_qgroup_reserve_meta at ffffffffc03f5bb6 <-- tries to reserve space and starts delalloc inodes. ljalves#8 btrfs_delayed_update_inode at ffffffffc03e31aa <-- acquires delayed node mutex ljalves#9 btrfs_update_inode at ffffffffc0385ba8 ljalves#10 btrfs_dirty_inode at ffffffffc038627b <-- TRANSACTIION OPENED ljalves#11 touch_atime at ffffffffa4cf0000 ljalves#12 generic_file_read_iter at ffffffffa4c1f123 ljalves#13 new_sync_read at ffffffffa4ccdc8a ljalves#14 vfs_read at ffffffffa4cd0849 ljalves#15 ksys_read at ffffffffa4cd0bd1 ljalves#16 do_syscall_64 at ffffffffa4a052eb ljalves#17 entry_SYSCALL_64_after_hwframe at ffffffffa540008c This will cause an asynchronous work to flush the delalloc inodes to happen which can try to acquire the same delayed_node mutex: PID: 455 TASK: ffff8c8085fa4000 CPU: 5 COMMAND: "kworker/u16:30" #0 __schedule at ffffffffa529e07d ljalves#1 schedule at ffffffffa529e4ff ljalves#2 schedule_preempt_disabled at ffffffffa529e80a ljalves#3 __mutex_lock at ffffffffa529fdcb <-- goes to sleep, never wakes up. ljalves#4 btrfs_delayed_update_inode at ffffffffc03e3143 <-- tries to acquire the mutex ljalves#5 btrfs_update_inode at ffffffffc0385ba8 <-- this is the same inode that pid 6963 is holding ljalves#6 cow_file_range_inline.constprop.78 at ffffffffc0386be7 ljalves#7 cow_file_range at ffffffffc03879c1 ljalves#8 btrfs_run_delalloc_range at ffffffffc038894c ljalves#9 writepage_delalloc at ffffffffc03a3c8f ljalves#10 __extent_writepage at ffffffffc03a4c01 ljalves#11 extent_write_cache_pages at ffffffffc03a500b ljalves#12 extent_writepages at ffffffffc03a6de2 ljalves#13 do_writepages at ffffffffa4c277eb ljalves#14 __filemap_fdatawrite_range at ffffffffa4c1e5bb ljalves#15 btrfs_run_delalloc_work at ffffffffc0380987 <-- starts running delayed nodes ljalves#16 normal_work_helper at ffffffffc03b706c ljalves#17 process_one_work at ffffffffa4aba4e4 ljalves#18 worker_thread at ffffffffa4aba6fd ljalves#19 kthread at ffffffffa4ac0a3d ljalves#20 ret_from_fork at ffffffffa54001ff To fully address those cases the complete fix is to never issue any flushing while holding the transaction or the delayed node lock. This patch achieves it by calling qgroup_reserve_meta directly which will either succeed without flushing or will fail and return -EDQUOT. In the latter case that return value is going to be propagated to btrfs_dirty_inode which will fallback to start a new transaction. That's fine as the majority of time we expect the inode will have BTRFS_DELAYED_NODE_INODE_DIRTY flag set which will result in directly copying the in-memory state. Fixes: c53e965 ("btrfs: qgroup: try to flush qgroup space when we get -EDQUOT") CC: stable@vger.kernel.org # 5.10+ Reviewed-by: Qu Wenruo <wqu@suse.com> Signed-off-by: Nikolay Borisov <nborisov@suse.com> Signed-off-by: David Sterba <dsterba@suse.com>

Paul E. McKenney reported [1] that commit 1f0723a ("mm, slub: enable slub_debug static key when creating cache with explicit debug flags") results in the lockdep complaint: ====================================================== WARNING: possible circular locking dependency detected 5.12.0+ ljalves#15 Not tainted ------------------------------------------------------ rcu_torture_sta/109 is trying to acquire lock: ffffffff96063cd0 (cpu_hotplug_lock){++++}-{0:0}, at: static_key_enable+0x9/0x20 but task is already holding lock: ffffffff96173c28 (slab_mutex){+.+.}-{3:3}, at: kmem_cache_create_usercopy+0x2d/0x250 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> ljalves#1 (slab_mutex){+.+.}-{3:3}: lock_acquire+0xb9/0x3a0 __mutex_lock+0x8d/0x920 slub_cpu_dead+0x15/0xf0 cpuhp_invoke_callback+0x17a/0x7c0 cpuhp_invoke_callback_range+0x3b/0x80 _cpu_down+0xdf/0x2a0 cpu_down+0x2c/0x50 device_offline+0x82/0xb0 remove_cpu+0x1a/0x30 torture_offline+0x80/0x140 torture_onoff+0x147/0x260 kthread+0x10a/0x140 ret_from_fork+0x22/0x30 -> #0 (cpu_hotplug_lock){++++}-{0:0}: check_prev_add+0x8f/0xbf0 __lock_acquire+0x13f0/0x1d80 lock_acquire+0xb9/0x3a0 cpus_read_lock+0x21/0xa0 static_key_enable+0x9/0x20 __kmem_cache_create+0x38d/0x430 kmem_cache_create_usercopy+0x146/0x250 kmem_cache_create+0xd/0x10 rcu_torture_stats+0x79/0x280 kthread+0x10a/0x140 ret_from_fork+0x22/0x30 other info that might help us debug this: Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(slab_mutex); lock(cpu_hotplug_lock); lock(slab_mutex); lock(cpu_hotplug_lock); *** DEADLOCK *** 1 lock held by rcu_torture_sta/109: #0: ffffffff96173c28 (slab_mutex){+.+.}-{3:3}, at: kmem_cache_create_usercopy+0x2d/0x250 stack backtrace: CPU: 3 PID: 109 Comm: rcu_torture_sta Not tainted 5.12.0+ ljalves#15 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.13.0-1ubuntu1.1 04/01/2014 Call Trace: dump_stack+0x6d/0x89 check_noncircular+0xfe/0x110 ? lock_is_held_type+0x98/0x110 check_prev_add+0x8f/0xbf0 __lock_acquire+0x13f0/0x1d80 lock_acquire+0xb9/0x3a0 ? static_key_enable+0x9/0x20 ? mark_held_locks+0x49/0x70 cpus_read_lock+0x21/0xa0 ? static_key_enable+0x9/0x20 static_key_enable+0x9/0x20 __kmem_cache_create+0x38d/0x430 kmem_cache_create_usercopy+0x146/0x250 ? rcu_torture_stats_print+0xd0/0xd0 kmem_cache_create+0xd/0x10 rcu_torture_stats+0x79/0x280 ? rcu_torture_stats_print+0xd0/0xd0 kthread+0x10a/0x140 ? kthread_park+0x80/0x80 ret_from_fork+0x22/0x30 This is because there's one order of locking from the hotplug callbacks: lock(cpu_hotplug_lock); // from hotplug machinery itself lock(slab_mutex); // in e.g. slab_mem_going_offline_callback() And commit 1f0723a made the reverse sequence possible: lock(slab_mutex); // in kmem_cache_create_usercopy() lock(cpu_hotplug_lock); // kmem_cache_open() -> static_key_enable() The simplest fix is to move static_key_enable() to a place before slab_mutex is taken. That means kmem_cache_create_usercopy() in mm/slab_common.c which is not ideal for SLUB-specific code, but the #ifdef CONFIG_SLUB_DEBUG makes it at least self-contained and obvious. [1] https://lore.kernel.org/lkml/20210502171827.GA3670492@paulmck-ThinkPad-P17-Gen-1/ Link: https://lkml.kernel.org/r/20210504120019.26791-1-vbabka@suse.cz Fixes: 1f0723a ("mm, slub: enable slub_debug static key when creating cache with explicit debug flags") Signed-off-by: Vlastimil Babka <vbabka@suse.cz> Reported-by: Paul E. McKenney <paulmck@kernel.org> Tested-by: Paul E. McKenney <paulmck@kernel.org> Acked-by: David Rientjes <rientjes@google.com> Cc: Christoph Lameter <cl@linux.com> Cc: Pekka Enberg <penberg@kernel.org> Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

It's later supposed to be either a correct address or NULL. Without the initialization, it may contain an undefined value which results in the following segmentation fault: # perf top --sort comm -g --ignore-callees=do_idle terminates with: #0 0x00007ffff56b7685 in __strlen_avx2 () from /lib64/libc.so.6 ljalves#1 0x00007ffff55e3802 in strdup () from /lib64/libc.so.6 ljalves#2 0x00005555558cb139 in hist_entry__init (callchain_size=<optimized out>, sample_self=true, template=0x7fffde7fb110, he=0x7fffd801c250) at util/hist.c:489 ljalves#3 hist_entry__new (template=template@entry=0x7fffde7fb110, sample_self=sample_self@entry=true) at util/hist.c:564 ljalves#4 0x00005555558cb4ba in hists__findnew_entry (hists=hists@entry=0x5555561d9e38, entry=entry@entry=0x7fffde7fb110, al=al@entry=0x7fffde7fb420, sample_self=sample_self@entry=true) at util/hist.c:657 ljalves#5 0x00005555558cba1b in __hists__add_entry (hists=hists@entry=0x5555561d9e38, al=0x7fffde7fb420, sym_parent=<optimized out>, bi=bi@entry=0x0, mi=mi@entry=0x0, sample=sample@entry=0x7fffde7fb4b0, sample_self=true, ops=0x0, block_info=0x0) at util/hist.c:288 ljalves#6 0x00005555558cbb70 in hists__add_entry (sample_self=true, sample=0x7fffde7fb4b0, mi=0x0, bi=0x0, sym_parent=<optimized out>, al=<optimized out>, hists=0x5555561d9e38) at util/hist.c:1056 ljalves#7 iter_add_single_cumulative_entry (iter=0x7fffde7fb460, al=<optimized out>) at util/hist.c:1056 ljalves#8 0x00005555558cc8a4 in hist_entry_iter__add (iter=iter@entry=0x7fffde7fb460, al=al@entry=0x7fffde7fb420, max_stack_depth=<optimized out>, arg=arg@entry=0x7fffffff7db0) at util/hist.c:1231 ljalves#9 0x00005555557cdc9a in perf_event__process_sample (machine=<optimized out>, sample=0x7fffde7fb4b0, evsel=<optimized out>, event=<optimized out>, tool=0x7fffffff7db0) at builtin-top.c:842 ljalves#10 deliver_event (qe=<optimized out>, qevent=<optimized out>) at builtin-top.c:1202 ljalves#11 0x00005555558a9318 in do_flush (show_progress=false, oe=0x7fffffff80e0) at util/ordered-events.c:244 ljalves#12 __ordered_events__flush (oe=oe@entry=0x7fffffff80e0, how=how@entry=OE_FLUSH__TOP, timestamp=timestamp@entry=0) at util/ordered-events.c:323 ljalves#13 0x00005555558a9789 in __ordered_events__flush (timestamp=<optimized out>, how=<optimized out>, oe=<optimized out>) at util/ordered-events.c:339 ljalves#14 ordered_events__flush (how=OE_FLUSH__TOP, oe=0x7fffffff80e0) at util/ordered-events.c:341 ljalves#15 ordered_events__flush (oe=oe@entry=0x7fffffff80e0, how=how@entry=OE_FLUSH__TOP) at util/ordered-events.c:339 ljalves#16 0x00005555557cd631 in process_thread (arg=0x7fffffff7db0) at builtin-top.c:1114 ljalves#17 0x00007ffff7bb817a in start_thread () from /lib64/libpthread.so.0 ljalves#18 0x00007ffff5656dc3 in clone () from /lib64/libc.so.6 If you look at the frame ljalves#2, the code is: 488 if (he->srcline) { 489 he->srcline = strdup(he->srcline); 490 if (he->srcline == NULL) 491 goto err_rawdata; 492 } If he->srcline is not NULL (it is not NULL if it is uninitialized rubbish), it gets strdupped and strdupping a rubbish random string causes the problem. Also, if you look at the commit 1fb7d06, it adds the srcline property into the struct, but not initializing it everywhere needed. Committer notes: Now I see, when using --ignore-callees=do_idle we end up here at line 2189 in add_callchain_ip(): 2181 if (al.sym != NULL) { 2182 if (perf_hpp_list.parent && !*parent && 2183 symbol__match_regex(al.sym, &parent_regex)) 2184 *parent = al.sym; 2185 else if (have_ignore_callees && root_al && 2186 symbol__match_regex(al.sym, &ignore_callees_regex)) { 2187 /* Treat this symbol as the root, 2188 forgetting its callees. */ 2189 *root_al = al; 2190 callchain_cursor_reset(cursor); 2191 } 2192 } And the al that doesn't have the ->srcline field initialized will be copied to the root_al, so then, back to: 1211 int hist_entry_iter__add(struct hist_entry_iter *iter, struct addr_location *al, 1212 int max_stack_depth, void *arg) 1213 { 1214 int err, err2; 1215 struct map *alm = NULL; 1216 1217 if (al) 1218 alm = map__get(al->map); 1219 1220 err = sample__resolve_callchain(iter->sample, &callchain_cursor, &iter->parent, 1221 iter->evsel, al, max_stack_depth); 1222 if (err) { 1223 map__put(alm); 1224 return err; 1225 } 1226 1227 err = iter->ops->prepare_entry(iter, al); 1228 if (err) 1229 goto out; 1230 1231 err = iter->ops->add_single_entry(iter, al); 1232 if (err) 1233 goto out; 1234 That al at line 1221 is what hist_entry_iter__add() (called from sample__resolve_callchain()) saw as 'root_al', and then: iter->ops->add_single_entry(iter, al); will go on with al->srcline with a bogus value, I'll add the above sequence to the cset and apply, thanks! Signed-off-by: Michael Petlan <mpetlan@redhat.com> CC: Milian Wolff <milian.wolff@kdab.com> Cc: Jiri Olsa <jolsa@redhat.com> Fixes: 1fb7d06 ("perf report Use srcline from callchain for hist entries") Link: https //lore.kernel.org/r/20210719145332.29747-1-mpetlan@redhat.com Reported-by: Juri Lelli <jlelli@redhat.com> Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>

…elect() In resp_mode_select() sanity check the block descriptor len to avoid UAF. BUG: KASAN: use-after-free in resp_mode_select+0xa4c/0xb40 drivers/scsi/scsi_debug.c:2509 Read of size 1 at addr ffff888026670f50 by task scsicmd/15032 CPU: 1 PID: 15032 Comm: scsicmd Not tainted 5.15.0-01d0625 ljalves#15 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Call Trace: <TASK> dump_stack_lvl+0x89/0xb5 lib/dump_stack.c:107 print_address_description.constprop.9+0x28/0x160 mm/kasan/report.c:257 kasan_report.cold.14+0x7d/0x117 mm/kasan/report.c:443 __asan_report_load1_noabort+0x14/0x20 mm/kasan/report_generic.c:306 resp_mode_select+0xa4c/0xb40 drivers/scsi/scsi_debug.c:2509 schedule_resp+0x4af/0x1a10 drivers/scsi/scsi_debug.c:5483 scsi_debug_queuecommand+0x8c9/0x1e70 drivers/scsi/scsi_debug.c:7537 scsi_queue_rq+0x16b4/0x2d10 drivers/scsi/scsi_lib.c:1521 blk_mq_dispatch_rq_list+0xb9b/0x2700 block/blk-mq.c:1640 __blk_mq_sched_dispatch_requests+0x28f/0x590 block/blk-mq-sched.c:325 blk_mq_sched_dispatch_requests+0x105/0x190 block/blk-mq-sched.c:358 __blk_mq_run_hw_queue+0xe5/0x150 block/blk-mq.c:1762 __blk_mq_delay_run_hw_queue+0x4f8/0x5c0 block/blk-mq.c:1839 blk_mq_run_hw_queue+0x18d/0x350 block/blk-mq.c:1891 blk_mq_sched_insert_request+0x3db/0x4e0 block/blk-mq-sched.c:474 blk_execute_rq_nowait+0x16b/0x1c0 block/blk-exec.c:63 sg_common_write.isra.18+0xeb3/0x2000 drivers/scsi/sg.c:837 sg_new_write.isra.19+0x570/0x8c0 drivers/scsi/sg.c:775 sg_ioctl_common+0x14d6/0x2710 drivers/scsi/sg.c:941 sg_ioctl+0xa2/0x180 drivers/scsi/sg.c:1166 __x64_sys_ioctl+0x19d/0x220 fs/ioctl.c:52 do_syscall_64+0x3a/0x80 arch/x86/entry/common.c:50 entry_SYSCALL_64_after_hwframe+0x44/0xae arch/x86/entry/entry_64.S:113 Link: https://lore.kernel.org/r/1637262208-28850-1-git-send-email-george.kennedy@oracle.com Reported-by: syzkaller <syzkaller@googlegroups.com> Acked-by: Douglas Gilbert <dgilbert@interlog.com> Signed-off-by: George Kennedy <george.kennedy@oracle.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

The cited commit adds a compeletion to remove dependency on rtnl lock. But it causes a deadlock for multiple encapsulations: crash> bt ffff8aece8a64000 PID: 1514557 TASK: ffff8aece8a64000 CPU: 3 COMMAND: "tc" #0 [ffffa6d14183f368] __schedule at ffffffffb8ba7f45 ljalves#1 [ffffa6d14183f3f8] schedule at ffffffffb8ba8418 ljalves#2 [ffffa6d14183f418] schedule_preempt_disabled at ffffffffb8ba8898 ljalves#3 [ffffa6d14183f428] __mutex_lock at ffffffffb8baa7f8 ljalves#4 [ffffa6d14183f4d0] mutex_lock_nested at ffffffffb8baabeb ljalves#5 [ffffa6d14183f4e0] mlx5e_attach_encap at ffffffffc0f48c17 [mlx5_core] ljalves#6 [ffffa6d14183f628] mlx5e_tc_add_fdb_flow at ffffffffc0f39680 [mlx5_core] ljalves#7 [ffffa6d14183f688] __mlx5e_add_fdb_flow at ffffffffc0f3b636 [mlx5_core] ljalves#8 [ffffa6d14183f6f0] mlx5e_tc_add_flow at ffffffffc0f3bcdf [mlx5_core] ljalves#9 [ffffa6d14183f728] mlx5e_configure_flower at ffffffffc0f3c1d1 [mlx5_core] ljalves#10 [ffffa6d14183f790] mlx5e_rep_setup_tc_cls_flower at ffffffffc0f3d529 [mlx5_core] ljalves#11 [ffffa6d14183f7a0] mlx5e_rep_setup_tc_cb at ffffffffc0f3d714 [mlx5_core] ljalves#12 [ffffa6d14183f7b0] tc_setup_cb_add at ffffffffb8931bb8 ljalves#13 [ffffa6d14183f810] fl_hw_replace_filter at ffffffffc0dae901 [cls_flower] ljalves#14 [ffffa6d14183f8d8] fl_change at ffffffffc0db5c57 [cls_flower] ljalves#15 [ffffa6d14183f970] tc_new_tfilter at ffffffffb8936047 ljalves#16 [ffffa6d14183fac8] rtnetlink_rcv_msg at ffffffffb88c7c31 ljalves#17 [ffffa6d14183fb50] netlink_rcv_skb at ffffffffb8942853 ljalves#18 [ffffa6d14183fbc0] rtnetlink_rcv at ffffffffb88c1835 ljalves#19 [ffffa6d14183fbd0] netlink_unicast at ffffffffb8941f27 ljalves#20 [ffffa6d14183fc18] netlink_sendmsg at ffffffffb8942245 ljalves#21 [ffffa6d14183fc98] sock_sendmsg at ffffffffb887d482 ljalves#22 [ffffa6d14183fcb8] ____sys_sendmsg at ffffffffb887d81a ljalves#23 [ffffa6d14183fd38] ___sys_sendmsg at ffffffffb88806e2 ljalves#24 [ffffa6d14183fe90] __sys_sendmsg at ffffffffb88807a2 ljalves#25 [ffffa6d14183ff28] __x64_sys_sendmsg at ffffffffb888080f ljalves#26 [ffffa6d14183ff38] do_syscall_64 at ffffffffb8b9b6a8 ljalves#27 [ffffa6d14183ff50] entry_SYSCALL_64_after_hwframe at ffffffffb8c0007c crash> bt 0xffff8aeb07544000 PID: 1110766 TASK: ffff8aeb07544000 CPU: 0 COMMAND: "kworker/u20:9" #0 [ffffa6d14e6b7bd8] __schedule at ffffffffb8ba7f45 ljalves#1 [ffffa6d14e6b7c68] schedule at ffffffffb8ba8418 ljalves#2 [ffffa6d14e6b7c88] schedule_timeout at ffffffffb8baef88 ljalves#3 [ffffa6d14e6b7d10] wait_for_completion at ffffffffb8ba968b ljalves#4 [ffffa6d14e6b7d60] mlx5e_take_all_encap_flows at ffffffffc0f47ec4 [mlx5_core] ljalves#5 [ffffa6d14e6b7da0] mlx5e_rep_update_flows at ffffffffc0f3e734 [mlx5_core] ljalves#6 [ffffa6d14e6b7df8] mlx5e_rep_neigh_update at ffffffffc0f400bb [mlx5_core] ljalves#7 [ffffa6d14e6b7e50] process_one_work at ffffffffb80acc9c ljalves#8 [ffffa6d14e6b7ed0] worker_thread at ffffffffb80ad012 ljalves#9 [ffffa6d14e6b7f10] kthread at ffffffffb80b615d ljalves#10 [ffffa6d14e6b7f50] ret_from_fork at ffffffffb8001b2f After the first encap is attached, flow will be added to encap entry's flows list. If neigh update is running at this time, the following encaps of the flow can't hold the encap_tbl_lock and sleep. If neigh update thread is waiting for that flow's init_done, deadlock happens. Fix it by holding lock outside of the for loop. If neigh update is running, prevent encap flows from offloading. Since the lock is held outside of the for loop, concurrent creation of encap entries is not allowed. So remove unnecessary wait_for_completion call for res_ready. Fixes: 95435ad ("net/mlx5e: Only access fully initialized flows in neigh update") Signed-off-by: Chris Mi <cmi@nvidia.com> Reviewed-by: Roi Dayan <roid@nvidia.com> Reviewed-by: Vlad Buslov <vladbu@nvidia.com> Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>

jonathanmbradshaw closed this as completed Feb 25, 2014

jonathanmbradshaw reopened this Feb 25, 2014

FSSDawid mentioned this issue Apr 11, 2014

WARNING: "i2c_add_mux_adapter" [/mnt/cache/dvb_drivers/media_build/v4l/tas2101.ko] undefined! #21

Closed

ljalves added enhancement labels Jun 25, 2014

ljalves closed this as completed Jul 22, 2014

kapitanf mentioned this issue Oct 5, 2017

EVOLVEO SIGMA T2 #164

Open

TBS-6922 - Support for? #15

TBS-6922 - Support for? #15

Comments

jonathanmbradshaw commented Feb 25, 2014

ljalves commented Feb 25, 2014

jonathanmbradshaw commented Feb 25, 2014

ljalves commented Feb 25, 2014

jonathanmbradshaw commented Feb 25, 2014

lspci -v | grep -i saa

ljalves commented Feb 25, 2014

jonathanmbradshaw commented Feb 25, 2014

crazycat69 commented Feb 25, 2014

jonathanmbradshaw commented Feb 25, 2014

sudo modprobe saa716x_budget int_type=1

dmesg

jonathanmbradshaw commented Feb 25, 2014

ljalves commented Feb 25, 2014

ljalves commented Feb 25, 2014

crazycat69 commented Feb 26, 2014

jonathanmbradshaw commented Feb 27, 2014

crazycat69 commented Feb 27, 2014

jonathanmbradshaw commented Feb 27, 2014

ljalves commented Feb 27, 2014

jonathanmbradshaw commented Feb 27, 2014

jonathanmbradshaw commented Mar 3, 2014

megavega commented Mar 14, 2014

Alfredo- commented Mar 20, 2014

sveba commented May 9, 2014

megavega commented May 27, 2014

Alfredo- commented Jun 13, 2014

crazycat69 commented Jun 13, 2014

Alfredo- commented Jun 13, 2014

Alfredo- commented Jun 13, 2014

ljalves commented Jun 13, 2014

Alfredo- commented Jun 14, 2014

Alfredo- commented Jun 14, 2014

Alfredo- commented Jun 19, 2014

ljalves commented Jun 25, 2014

Alfredo- commented Jun 25, 2014

ljalves commented Jul 19, 2014

Alfredo- commented Jul 20, 2014

ljalves commented Jul 20, 2014

Alfredo- commented Jul 20, 2014

ljalves commented Jul 21, 2014

Alfredo- commented Jul 21, 2014

ljalves commented Jul 22, 2014