26 Jan, 2017
1 commit
-
commit c0026c7bfb95c250c3e34fde59f96ad72fd730d6 upstream.
Clock control indirectly requires access to MFC device, so call it only
if we are sure that the device exists in s5p_mfc_release function.
s5p_mfc_remove() calls s5p_mfc_final_pm(), which releases all PM related
resources, including clocks, so any call to clocks related functions
is not valid after s5p_mfc_final_pm().Fixes: d695c12 ("[media] media: s5p-mfc fix invalid memory access from
s5p_mfc_release()")Signed-off-by: Marek Szyprowski
Signed-off-by: Sylwester Nawrocki
Signed-off-by: Mauro Carvalho Chehab
Signed-off-by: Greg Kroah-Hartman
09 Jan, 2017
1 commit
-
commit 3467c9a7e7f9209a9ecd8f9db65b04a323a13932 upstream.
s5p_mfc_alloc_memdev() function lacks proper releasing
of allocated device in case of reserved memory initialization
failure. This results in NULL pointer dereference:[ 2.828457] Unable to handle kernel NULL pointer dereference at virtual address 00000001
[ 2.835089] pgd = c0004000
[ 2.837752] [00000001] *pgd=00000000
[ 2.844696] Internal error: Oops: 5 [#1] PREEMPT SMP ARM
[ 2.848680] Modules linked in:
[ 2.851722] CPU: 1 PID: 1 Comm: swapper/0 Not tainted 4.8.0-rc6-00002-gafa1b97 #878
[ 2.859357] Hardware name: SAMSUNG EXYNOS (Flattened Device Tree)
[ 2.865433] task: ef080000 task.stack: ef06c000
[ 2.869952] PC is at strcmp+0x0/0x30
[ 2.873508] LR is at platform_match+0x84/0xac
[ 2.877847] pc : [] lr : [] psr: 20000013
[ 2.877847] sp : ef06dea0 ip : 00000000 fp : 00000000
[ 2.889303] r10: 00000000 r9 : c0b34848 r8 : c0b1e968
[ 2.894511] r7 : 00000000 r6 : 00000001 r5 : c086e7fc r4 : eeb8e010
[ 2.901021] r3 : 0000006d r2 : 00000000 r1 : c086e7fc r0 : 00000001
[ 2.907533] Flags: nzCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none
[ 2.914649] Control: 10c5387d Table: 4000404a DAC: 00000051
[ 2.920378] Process swapper/0 (pid: 1, stack limit = 0xef06c210)
[ 2.926367] Stack: (0xef06dea0 to 0xef06e000)
[ 2.930711] dea0: eeb8e010 c0c2d91c c03f4a6c c03f4a8c 00000000 c0c2d91c c03f4a6c c03f2fc8
[ 2.938870] dec0: ef003274 ef10c4c0 c0c2d91c ef10cc80 c0c21270 c03f3fa4 c09c1be8 c0c2d91c
[ 2.947028] dee0: 00000006 c0c2d91c 00000006 c0b3483c c0c47000 c03f5314 c0c2d908 c0b5fed8
[ 2.955188] df00: 00000006 c010178c 60000013 c0a4ef14 00000000 c06feaa0 ef080000 60000013
[ 2.963347] df20: 00000000 c0c095c8 efffca76 c0816b8c 000000d5 c0134098 c0b34848 c09d6cdc
[ 2.971506] df40: c0a4de70 00000000 00000006 00000006 c0c09568 efffca40 c0b5fed8 00000006
[ 2.979665] df60: c0b3483c c0c47000 000000d5 c0b34848 c0b005a4 c0b00d84 00000006 00000006
[ 2.987824] df80: 00000000 c0b005a4 00000000 c06fb4d8 00000000 00000000 00000000 00000000
[ 2.995983] dfa0: 00000000 c06fb4e0 00000000 c01079b8 00000000 00000000 00000000 00000000
[ 3.004142] dfc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[ 3.012302] dfe0: 00000000 00000000 00000000 00000000 00000013 00000000 ffffffff ffffffff
[ 3.020469] [] (strcmp) from [] (platform_match+0x84/0xac)
[ 3.027672] [] (platform_match) from [] (__driver_attach+0x20/0xb0)
[ 3.035654] [] (__driver_attach) from [] (bus_for_each_dev+0x54/0x88)
[ 3.043812] [] (bus_for_each_dev) from [] (bus_add_driver+0xe8/0x1f4)
[ 3.051971] [] (bus_add_driver) from [] (driver_register+0x78/0xf4)
[ 3.059958] [] (driver_register) from [] (do_one_initcall+0x3c/0x16c)
[ 3.068123] [] (do_one_initcall) from [] (kernel_init_freeable+0x120/0x1ec)
[ 3.076802] [] (kernel_init_freeable) from [] (kernel_init+0x8/0x118)
[ 3.084958] [] (kernel_init) from [] (ret_from_fork+0x14/0x3c)
[ 3.092506] Code: 1afffffb e12fff1e e1a03000 eafffff7 (e4d03001)
[ 3.098618] ---[ end trace 511bf9d750810709 ]---
[ 3.103207] Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000bThis patch fixes this issue.
Fixes: c79667dd93b084fe412bcfe7fbf0ba43f7dec520 ("media: s5p-mfc: replace custom
reserved memory handling code with generic one")Signed-off-by: Marek Szyprowski
Signed-off-by: Sylwester Nawrocki
Signed-off-by: Mauro Carvalho Chehab
Signed-off-by: Greg Kroah-Hartman
25 Aug, 2016
7 commits
-
alloc_workqueue replaces deprecated create_singlethread_workqueue().
The MFC device driver is a v4l2 driver which can encode/decode video
raw/elementary streams and has support for all popular video codecs.The driver's watchdog_workqueue has been replaced with system_wq since
it queues a single work item, &dev->watchdog_work, which calls for no
ordering requirement. The work item is involved in running the watchdog
timer and is not being used on a memory reclaim path.Work item has been flushed in s5p_mfc_remove() to ensure
that there are no pending tasks while disconnecting the driver.Signed-off-by: Bhaktipriya Shridhar
Acked-by: Tejun Heo
Signed-off-by: Sylwester Nawrocki
Signed-off-by: Mauro Carvalho Chehab -
Removed unnecessary error message as appropriate error code is returned.
Changed error message into a debug.Signed-off-by: Shuah Khan
Reviewed-by: Javier Martinez Canillas
Signed-off-by: Sylwester Nawrocki
Signed-off-by: Mauro Carvalho Chehab -
Fix misspelled error message and existing checkpatch errors in the
error message conditional.WARNING: suspect code indent for conditional statements (8, 24)
if (ctx->state != MFCINST_HEAD_PARSED &&
[...]
mfc_err("Can not get crop information\n");Signed-off-by: Shuah Khan
Reviewed-by: Javier Martinez Canillas
Signed-off-by: Sylwester Nawrocki
Signed-off-by: Mauro Carvalho Chehab -
Remove unneeded error handling on the result of a call
to platform_get_resource() when the value is passed to
devm_ioremap_resource().Signed-off-by: Wei Yongjun
Signed-off-by: Sylwester Nawrocki
Signed-off-by: Mauro Carvalho Chehab -
Remove void function return statement
Signed-off-by: Shuah Khan
Reviewed-by: Javier Martinez Canillas
Signed-off-by: Sylwester Nawrocki
Signed-off-by: Mauro Carvalho Chehab -
If s5p_mfc_release() runs after s5p_mfc_remove(), the former will access
invalid s5p_mfc_dev pointer saved in the s5p_mfc_ctx and runs into kernel
paging request errors.Clear ctx dev pointer in s5p_mfc_remove() and change s5p_mfc_release() to
avoid work that requires ctx->dev.odroid kernel: Unable to handle kernel paging request at virtual address
f17c1104
odroid kernel: pgd = ebca4000
odroid kernel: [f17c1104] *pgd=6e23d811, *pte=00000000, *ppte=00000000
odroid kernel: Internal error: Oops: 807 [#1] PREEMPT SMP ARM
odroid kernel: Modules linked in: cpufreq_userspace cpufreq_powersave
cpufreq_conservative s5p_mfc s5p_jpeg v4l2_mem2mem
videobuf2_dma_contig videobuf2_memops videobuf2_v4l2 videobuf2_core
v4l2_common videodev media
odroid kernel: Hardware name: SAMSUNG EXYNOS (Flattened Device Tree)
odroid kernel: task: c2241400 ti: e7018000 task.ti: e7018000
odroid kernel: PC is at s5p_mfc_reset+0x40/0x28c [s5p_mfc]
odroid kernel: LR is at s5p_mfc_reset+0x34/0x28c [s5p_mfc]
odroid kernel: pc : [] lr : [] psr: 60010013
odroid kernel: [] (s5p_mfc_reset [s5p_mfc]) from []
(s5p_mfc_deinit_hw+0x14/0x3c [s5p_mfc])
odroid kernel: [] (s5p_mfc_deinit_hw [s5p_mfc]) from []
(s5p_mfc_release+0xac/0x1c4 [s5p_mfc])
odroid kernel: [] (s5p_mfc_release [s5p_mfc]) from []
(v4l2_release+0x38/0x74 [videodev])
odroid kernel: [] (v4l2_release [videodev]) from []
(__fput+0x80/0x1c8)
odroid kernel: [] (__fput) from []
(task_work_run+0x94/0xc8)
odroid kernel: [] (task_work_run) from []
(do_work_pending+0x7c/0xa4)
odroid kernel: [] (do_work_pending) from []
(slow_work_pending+0xc/0x20)
odroid kernel: Code: eb3edacc e5953078 e3a06000 e2833c11 (e5836004)Signed-off-by: Shuah Khan
Tested-by: Luis de Bethencourt
Signed-off-by: Sylwester Nawrocki
Signed-off-by: Mauro Carvalho Chehab -
Add missing documentation for s5p_mfc_dev structure definition.
Signed-off-by: Shuah Khan
Reviewed-by: Javier Martinez Canillas
Signed-off-by: Sylwester Nawrocki
Signed-off-by: Mauro Carvalho Chehab
09 Jul, 2016
11 commits
-
Make this a proper typed array. Drop the old allocate context code since
that is no longer used.Note that the memops functions now get a struct device pointer instead of
the struct device ** that was there initially (actually a void pointer to
a struct containing only a struct device pointer).This code is now a lot cleaner.
Signed-off-by: Hans Verkuil
Reviewed-by: Laurent Pinchart
Cc: Sakari Ailus
Signed-off-by: Mauro Carvalho Chehab -
Stop using alloc_ctx and just fill in the device pointer.
Signed-off-by: Hans Verkuil
Cc: Kyungmin Park
Cc: Sylwester Nawrocki
Signed-off-by: Mauro Carvalho Chehab -
According to the V4L2 documentation the driver and card fields should be
used to identify the driver and the device but the s5p-mfc driver fills
those field using the platform device name, which in turn is the name of
the device DT node.So not only the filled information isn't correct but also the same values
are used in all the fields for both the encoder and decoder video devices.Before this patch:
Driver Info (not using libv4l2):
Driver name : 11000000.codec
Card type : 11000000.codec
Bus info : platform:11000000.codec
Driver version: 4.7.0Driver Info (not using libv4l2):
Driver name : 11000000.codec
Card type : 11000000.codec
Bus info : platform:11000000.codec
Driver version: 4.7.0After this patch:
Driver Info (not using libv4l2):
Driver name : s5p-mfc
Card type : s5p-mfc-dec
Bus info : platform:11000000.codec
Driver version: 4.7.0Driver Info (not using libv4l2):
Driver name : s5p-mfc
Card type : s5p-mfc-enc
Bus info : platform:11000000.codec
Driver version: 4.7.0Signed-off-by: Javier Martinez Canillas
Acked-by: Hans Verkuil
Signed-off-by: Kamil Debski
Signed-off-by: Mauro Carvalho Chehab -
The driver doesn't set the struct v4l2_capability bus_info field so the
v4l2-compliance tool reports the following errors for VIDIOC_QUERYCAP:Required ioctls:
VIDIOC_QUERYCAP returned 0 (Success)
fail: v4l2-compliance.cpp(304): string empty
fail: v4l2-compliance.cpp(528): check_ustring(vcap.bus_info, sizeof(vcap.bus_info))
test VIDIOC_QUERYCAP: FAILThis patch fixes by setting the field in VIDIOC_QUERYCAP ioctl handler:
Required ioctls:
VIDIOC_QUERYCAP returned 0 (Success)
test VIDIOC_QUERYCAP: OKSigned-off-by: Javier Martinez Canillas
Acked-by: Hans Verkuil
Signed-off-by: Kamil Debski
Signed-off-by: Mauro Carvalho Chehab -
The streaming field in struct vb2_queue is meant to be private and should
not be used by drivers directly, instead the vb2_is_streaming() function
should be used to check the videobuf2 queue streaming status.Signed-off-by: Javier Martinez Canillas
Signed-off-by: Kamil Debski
Signed-off-by: Mauro Carvalho Chehab -
The V4L2 documentation says that applications must call the VIDIOC_REQBUFS
ioctl to determine if a memory mapped, user pointer or DMABUF based I/O is
supported by the driver.For example GStreamer does this by first calling VIDIOC_REQBUFS with count
zero for all the possible streaming I/O methods and then finally doing the
real VIDIOC_REQBUFS with count N using a known to be supported memory type.But the driver prints an error on VIDIOC_REQBUFS if the memory type is not
supported which leads to the following errors that can confuse the users:[ 178.704390] vidioc_reqbufs:575: Only V4L2_MEMORY_MMAP is supported
[ 178.704666] vidioc_reqbufs:575: Only V4L2_MEMORY_MMAP is supported
[ 178.714956] vidioc_reqbufs:575: Only V4L2_MEMORY_MMAP is supported
[ 178.715229] vidioc_reqbufs:575: Only V4L2_MEMORY_MMAP is supportedSigned-off-by: Javier Martinez Canillas
Signed-off-by: Kamil Debski
Signed-off-by: Mauro Carvalho Chehab -
The function comment has an obvious typo error, so fix it.
Signed-off-by: Javier Martinez Canillas
Signed-off-by: Kamil Debski
Signed-off-by: Mauro Carvalho Chehab -
This patch fixes the error path in the driver probe, so in case of
any failure, the resources are not leaked.Reported-by: Liviu Dudau
Signed-off-by: Marek Szyprowski
Acked-by: Liviu Dudau
Signed-off-by: Kamil Debski
Signed-off-by: Mauro Carvalho Chehab -
Fix null pointer deference in clk_core_enable() when driver unbind is run
when there is an application has an active pipeline playing.s5p_mfc_release() gets called after s5p_mfc_final_pm() disables and does
clk_put() and s5p_mfc_release() attempts to enable clock and runs into
null pointer deference accessing invalid pointer.[ 4869.434709] Unable to handle kernel NULL pointer dereference at virtual addr0
[ 4869.441312] pgd = e91ac000
[ 4869.443996] [00000010] *pgd=ba4f7835
[ 4869.447552] Internal error: Oops: 17 [#1] PREEMPT SMP ARM
[ 4869.452921] Modules linked in: cpufreq_userspace cpufreq_powersave cpufreq_ca
[ 4869.471728] CPU: 4 PID: 2965 Comm: lt-gst-launch-1 Not tainted 4.7.0-rc2-nex0
[ 4869.481778] Hardware name: SAMSUNG EXYNOS (Flattened Device Tree)
[ 4869.487844] task: e91f1e00 ti: ed650000 task.ti: ed650000
[ 4869.493227] PC is at clk_core_enable+0x4c/0x98
[ 4869.497637] LR is at clk_core_enable+0x40/0x98
[ 4869.502056] pc : [] lr : [] psr: 60060093
[ 4869.502056] sp : ed651f18 ip : 00000000 fp : 002641b4
[ 4869.513493] r10: e9088c08 r9 : 00000008 r8 : ed676d68
[ 4869.518692] r7 : ee3ac000 r6 : bf16b3c0 r5 : a0060013 r4 : ee37a8c0
[ 4869.525191] r3 : 00000000 r2 : 00000001 r1 : 00000004 r0 : 00000000
[ 4869.531692] Flags: nZCv IRQs off FIQs on Mode SVC_32 ISA ARM Segment noe
[ 4869.538883] Control: 10c5387d Table: 691ac06a DAC: 00000051
[ 4869.544603] Process lt-gst-launch-1 (pid: 2965, stack limit = 0xed650210)
[ 4869.551361] Stack: (0xed651f18 to 0xed652000)
[ 4869.555694] 1f00: ee373
[ 4869.563841] 1f20: bf16b3c0 c055a0e0 ee3ac004 ed676c10 bf16b3c0 bf1558e0 e9080
[ 4869.571986] 1f40: 00000000 ee98a510 ee502e40 bf047344 e9088c00 ee986938 00004
[ 4869.580132] 1f60: 00000000 00000000 e91f2204 00000000 c0b4658c e91f1e00 c0100
[ 4869.588277] 1f80: 00000000 c0135c58 ed650000 c0107904 ed651fb0 00000006 c0104
[ 4869.596423] 1fa0: 00229500 b6581000 b6f7b544 c0107794 00000000 00000002 b6f90
[ 4869.604568] 1fc0: 00229500 b6581000 b6f7b544 00000006 0017b600 0002c038 00264
[ 4869.612714] 1fe0: 00000000 bee56ef0 00000000 b6d49612 00060030 00000006 00000
[ 4869.620865] [] (clk_core_enable) from [] (clk_enable+0x2)
[ 4869.628509] [] (clk_enable) from [] (s5p_mfc_release+0x3)
[ 4869.637111] [] (s5p_mfc_release [s5p_mfc]) from [] (v4l2)
[ 4869.646706] [] (v4l2_release [videodev]) from [] (__fput)
[ 4869.654745] [] (__fput) from [] (task_work_run+0x94/0xc8)
[ 4869.661852] [] (task_work_run) from [] (do_work_pending+)
[ 4869.669735] [] (do_work_pending) from [] (slow_work_pend)
[ 4869.677878] Code: ebffffef e3500000 18bd8070 e5943004 (e5933010)Signed-off-by: Shuah Khan
Signed-off-by: Kamil Debski
Signed-off-by: Mauro Carvalho Chehab -
s5p_mfc_remove() fails to release encoder and decoder video devices.
Signed-off-by: Shuah Khan
Reviewed-by: Javier Martinez Canillas
Signed-off-by: Kamil Debski
Signed-off-by: Mauro Carvalho Chehab -
Fix Decoder and encoder video device double release in probe error path.
video_device_release(dev->vfd_dec) get called twice if decoder register
fails. Also, video_device_release(dev->vfd_enc) get called twice if encoder
register fails.Signed-off-by: Shuah Khan
Signed-off-by: Kamil Debski
Signed-off-by: Mauro Carvalho Chehab
08 Jun, 2016
3 commits
-
It is a cosmetic commit.
Signed-off-by: ayaka
Signed-off-by: Kamil Debski
Signed-off-by: Mauro Carvalho Chehab -
We don't need to request the sizeimage or num_planes
in try_fmt.Signed-off-by: ayaka
Signed-off-by: Kamil Debski
Signed-off-by: Mauro Carvalho Chehab -
The encoder forget the work to call hardware to release its buffers.
This patch came from chromium project. I just change its code
style and make the API match with new kernel.Signed-off-by: ayaka
Signed-off-by: Kamil Debski
Signed-off-by: Mauro Carvalho Chehab
07 Jun, 2016
3 commits
-
User-space applications can use the VIDIOC_REQBUFS ioctl to determine if a
memory mapped, user pointer or DMABUF based I/O is supported by the driver.So a set of VIDIOC_REQBUFS ioctl calls will be made with count 0 and then
the real VIDIOC_REQBUFS call with count == n. But for count 0, the driver
not only frees the buffer but also closes the MFC instance and s5p_mfc_ctx
state is set to MFCINST_FREE.The VIDIOC_REQBUFS handler for the output device checks if the s5p_mfc_ctx
state is set to MFCINST_INIT (which happens on an VIDIOC_S_FMT) and fails
otherwise. So after a VIDIOC_REQBUFS(n), future VIDIOC_REQBUFS(n) calls
will fails unless a VIDIOC_S_FMT ioctl calls happens before the reqbufs.But applications may first set the format and then attempt to determine
the I/O methods supported by the driver (for example Gstramer does it) so
the state won't be set to MFCINST_INIT again and VIDIOC_REQBUFS will fail.To avoid this issue, only free the buffers on VIDIOC_REQBUFS(0) but don't
close the MFC instance to allow future VIDIOC_REQBUFS(n) calls to succeed.[javier: Rewrote changelog to explain the problem more detailed]
Signed-off-by: ayaka
Signed-off-by: Javier Martinez Canillas
Acked-by: Nicolas Dufresne
Tested-by: Marek Szyprowski
Acked-by: Sylwester Nawrocki
Signed-off-by: Mauro Carvalho Chehab -
Failing to get the struct s5p_mfc_pm .clock is a non-fatal error so the
clock field can have a errno pointer value. But s5p_mfc_final_pm() only
checks if .clock is not NULL before attempting to unprepare and put it.This leads to the following warning in clk_put() due s5p_mfc_final_pm():
WARNING: CPU: 3 PID: 1023 at drivers/clk/clk.c:2814 s5p_mfc_final_pm+0x48/0x74 [s5p_mfc]
CPU: 3 PID: 1023 Comm: rmmod Tainted: G W 4.6.0-rc6-next-20160502-00005-g5a15a49106bc #9
Hardware name: SAMSUNG EXYNOS (Flattened Device Tree)
[] (unwind_backtrace) from [] (show_stack+0x10/0x14)
[] (show_stack) from [] (dump_stack+0x88/0x9c)
[] (dump_stack) from [] (__warn+0xe8/0x100)
[] (__warn) from [] (warn_slowpath_null+0x20/0x28)
[] (warn_slowpath_null) from [] (s5p_mfc_final_pm+0x48/0x74 [s5p_mfc])
[] (s5p_mfc_final_pm [s5p_mfc]) from [] (s5p_mfc_remove+0x8c/0x94 [s5p_mfc])
[] (s5p_mfc_remove [s5p_mfc]) from [] (platform_drv_remove+0x24/0x3c)
[] (platform_drv_remove) from [] (__device_release_driver+0x84/0x110)
[] (__device_release_driver) from [] (driver_detach+0xac/0xb0)
[] (driver_detach) from [] (bus_remove_driver+0x4c/0xa0)
[] (bus_remove_driver) from [] (SyS_delete_module+0x174/0x1b8)
[] (SyS_delete_module) from [] (ret_fast_syscall+0x0/0x3c)Assign the pointer to NULL in case of a lookup failure to fix the issue.
Signed-off-by: Javier Martinez Canillas
Acked-by: Arnd Bergmann
Reviewed-by: Krzysztof Kozlowski
Acked-by: Sylwester Nawrocki
Signed-off-by: Mauro Carvalho Chehab -
This patch fixes build break caused by lack of dma-iommu API on ARM64
(this API is specific to ARM 32bit architecture).Signed-off-by: Marek Szyprowski
03 Jun, 2016
6 commits
-
This patch adds support for IOMMU to s5p-mfc device driver. MFC firmware
is limited and it cannot use the default configuration. If IOMMU is
available, the patch disables the default DMA address space
configuration and creates a new address space of size limited to 256M
and base address set to 0x20000000.For now the same address space is shared by both 'left' and 'right'
memory channels, because the DMA/IOMMU frameworks do not support
configuring them separately. This is not optimal, but besides limiting
total address space available has no other drawbacks (MFC firmware
supports 256M of address space per each channel).Signed-off-by: Marek Szyprowski
Reviewed-by: Javier Martinez Canillas
Tested-by: Javier Martinez Canillas
Signed-off-by: Sylwester Nawrocki -
This patch removes custom code for initialization and handling of
reserved memory regions in s5p-mfc driver and replaces it with generic
reserved memory regions api.s5p-mfc driver now handles two reserved memory regions defined by
generic reserved memory bindings. Support for non-dt platform has been
removed, because all supported platforms have been already converted to
device tree.Signed-off-by: Marek Szyprowski
Reviewed-by: Javier Martinez Canillas
Tested-by: Javier Martinez Canillas
Signed-off-by: Sylwester Nawrocki -
All multimedia devices found on Exynos SoCs support only contiguous
buffers, so set DMA max segment size to DMA_BIT_MASK(32) to let memory
allocator to correctly create contiguous memory mappings.Signed-off-by: Marek Szyprowski
Signed-off-by: Sylwester Nawrocki -
The s5p_mfc_probe() function registers the video devices before all the
resources needed by s5p_mfc_open() are correctly initalized.So if s5p_mfc_open() function is called before s5p_mfc_probe() finishes
(since the video dev is already registered), a NULL pointer dereference
will happen due s5p_mfc_open() accessing uninitialized vars such as the
struct s5p_mfc_dev .watchdog_timer and .mfc_ops fields.An example is following BUG caused by add_timer() getting a NULL pointer:
[ 45.765374] kernel BUG at kernel/time/timer.c:790!
[ 45.765381] Internal error: Oops - BUG: 0 [#1] PREEMPT SMP ARM
...
[ 45.766149] [] (mod_timer) from [] (s5p_mfc_open+0x274/0x4d4 [s5p_mfc])
[ 45.766416] [] (s5p_mfc_open [s5p_mfc]) from [] (v4l2_open+0x9c/0x100 [videodev])
[ 45.766547] [] (v4l2_open [videodev]) from [] (chrdev_open+0x9c/0x178)
[ 45.766575] [] (chrdev_open) from [] (do_dentry_open+0x1e0/0x300)
[ 45.766595] [] (do_dentry_open) from [] (path_openat+0x800/0x10d4)
[ 45.766610] [] (path_openat) from [] (do_filp_open+0x5c/0xc0)
[ 45.766624] [] (do_filp_open) from [] (do_sys_open+0x10c/0x1bc)
[ 45.766642] [] (do_sys_open) from [] (ret_fast_syscall+0x0/0x3c)
[ 45.766655] Code: eaffffe3 e3a00001 e28dd008 e8bd81f0 (e7f001f2)Fix it by registering the video devs as the last step in s5p_mfc_probe().
Signed-off-by: Javier Martinez Canillas
Tested-by: Marek Szyprowski
Signed-off-by: Sylwester Nawrocki -
When s5p_mfc_remove() calls put_device() for the reserved memory region
devs, the driver core warns that the dev doesn't have a release callback:WARNING: CPU: 0 PID: 591 at drivers/base/core.c:251 device_release+0x8c/0x90
Device 's5p-mfc-l' does not have a release() function, it is broken and must be fixed.Also, the declared DMA memory using dma_declare_coherent_memory() isn't
relased so add a dev .release that calls dma_release_declared_memory().Cc:
Fixes: 6e83e6e25eb4 ("[media] s5p-mfc: Fix kernel warning on memory init")
Signed-off-by: Javier Martinez Canillas
Tested-by: Marek Szyprowski
Signed-off-by: Sylwester Nawrocki -
The devices don't have a name set, so makes dev_name() returns NULL which
makes harder to identify the devices that are causing issues, for example:WARNING: CPU: 2 PID: 616 at drivers/base/core.c:251 device_release+0x8c/0x90
Device '(null)' does not have a release() function, it is broken and must be fixed.And after setting the device name:
WARNING: CPU: 0 PID: 591 at drivers/base/core.c:251 device_release+0x8c/0x90
Device 's5p-mfc-l' does not have a release() function, it is broken and must be fixed.Cc:
Fixes: 6e83e6e25eb4 ("[media] s5p-mfc: Fix kernel warning on memory init")
Signed-off-by: Javier Martinez Canillas
Tested-by: Marek Szyprowski
Signed-off-by: Sylwester Nawrocki
14 Apr, 2016
1 commit
-
Exynos and Samsung S5P platforms has been fully converted to device
tree, so old platform device based init data can be now removed.Signed-off-by: Marek Szyprowski
Signed-off-by: Sylwester Nawrocki
Signed-off-by: Mauro Carvalho Chehab
19 Feb, 2016
1 commit
-
There is a new control V4L2_CID_MPEG_VIDEO_FORCE_KEY_FRAME to
force an encoder key frame. It is the same as requesting
V4L2_MPEG_MFC51_VIDEO_FORCE_FRAME_TYPE_I_FRAME.Signed-off-by: Wu-Cheng Li
Acked-by: Sylwester Nawrocki
Signed-off-by: Hans Verkuil
Signed-off-by: Mauro Carvalho Chehab
24 Dec, 2015
1 commit
-
MFC register addresses are used only by writel/readl macros which already
takes care of proper register accessing.Signed-off-by: Andrzej Hajda
Signed-off-by: Kamil Debski
Signed-off-by: Mauro Carvalho Chehab
23 Dec, 2015
5 commits
-
Both macros can be merged into one.
Signed-off-by: Andrzej Hajda
Signed-off-by: Kamil Debski
Signed-off-by: Mauro Carvalho Chehab -
MFC driver uses dev->irqlock spinlock to protect queues only, but many context
fields require protection also - they can be accessed concurrently
from IOCTLs and IRQ handler. The patch increases protection range of irqlock
to those fields also.Signed-off-by: Andrzej Hajda
Signed-off-by: Kamil Debski
Signed-off-by: Mauro Carvalho Chehab -
Many version specific functions are not called by common code, so there
is no need to use callbacks. Additionally some of them are not used at all,
so they can be safely removed.Signed-off-by: Andrzej Hajda
Signed-off-by: Kamil Debski
Signed-off-by: Mauro Carvalho Chehab -
Code for queue cleanup has nothing specific to hardware version.
Signed-off-by: Andrzej Hajda
Signed-off-by: Kamil Debski
Signed-off-by: Mauro Carvalho Chehab -
Both version of MFC driver use functions with the same body and name.
The patch moves them to common location. It also simplifies it.Signed-off-by: Andrzej Hajda
Signed-off-by: Kamil Debski
Signed-off-by: Mauro Carvalho Chehab