kernel.git/drivers/media/platform/qcom, branch linux-4.13.y

media: venus: fix copy/paste error in return_buf_error

2017-09-27T12:43:20Z

commit 0de0ef6c3f2dd7e9965270683445917e10384ab0 upstream. Call function v4l2_m2m_dst_buf_remove_by_buf() instead of v4l2_m2m_src_buf_remove_by_buf() Addresses-Coverity-ID: 1415317 Signed-off-by: Gustavo A. R. Silva Acked-by: Stanimir Varbanov Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Greg Kroah-Hartman

media: venus: don't abuse dma_alloc for non-DMA allocations

2017-07-26T10:14:32Z

In venus_boot(), we pass a pointer to a phys_addr_t into dmam_alloc_coherent, which the compiler warns about: platform/qcom/venus/firmware.c: In function 'venus_boot': platform/qcom/venus/firmware.c:63:49: error: passing argument 3 of 'dmam_alloc_coherent' from incompatible pointer type [-Werror=incompatible-pointer-types] To avoid the error refactor venus_boot function by discard dma_alloc_coherent invocation because we don't want to map the memory for the device. Something more, the usage of DMA mapping API is actually wrong and the current implementation relies on several bugs in DMA mapping code. When these bugs are fixed that will break firmware loading, so fix this now to avoid future troubles. The meaning of venus_boot is to copy the content of the firmware buffer into reserved (and memblock removed) block of memory and pass that physical address to the trusted zone for authentication and mapping through iommu form the secure world. After iommu mapping is done the iova is passed as ane entry point to the remote processor. After this change memory-region property is parsed manually and the physical address is memremap to CPU, call mdt_load to load firmware segments into proper places and unmap reserved memory. Fixes: af2c3834c8ca ("[media] media: venus: adding core part and helper functions") Signed-off-by: Stanimir Varbanov Reviewed-by: Arnd Bergmann Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab

media: venus: hfi: fix error handling in hfi_sys_init_done()

2017-07-26T10:14:32Z

Not entirely sure what triggers it, but with venus build as kernel module and in initrd, we hit this crash: Unable to handle kernel paging request at virtual address ffff80003c039000 pgd = ffff00000a14f000 [ffff80003c039000] *pgd=00000000bd9f7003, *pud=00000000bd9f6003, *pmd=00000000bd9f0003, *pte=0000000000000000 Internal error: Oops: 96000007 [#1] SMP Modules linked in: qcom_wcnss_pil(E+) crc32_ce(E) qcom_common(E) venus_core(E+) remoteproc(E) snd_soc_msm8916_digital(E) virtio_ring(E) cdc_ether(E) snd_soc_lpass_apq8016(E) snd_soc_lpass_cpu(E) snd_soc_apq8016_sbc(E) snd_soc_lpass_platform(E) v4l2_mem2mem(E) virtio(E) snd_soc_core(E) ac97_bus(E) snd_pcm_dmaengine(E) snd_seq(E) leds_gpio(E) videobuf2_v4l2(E) videobuf2_core(E) snd_seq_device(E) snd_pcm(E) videodev(E) media(E) nvmem_qfprom(E) msm(E) snd_timer(E) snd(E) soundcore(E) spi_qup(E) mdt_loader(E) qcom_tsens(E) qcom_spmi_temp_alarm(E) nvmem_core(E) msm_rng(E) uas(E) usb_storage(E) dm9601(E) usbnet(E) mii(E) mmc_block(E) adv7511(E) drm_kms_helper(E) syscopyarea(E) sysfillrect(E) sysimgblt(E) fb_sys_fops(E) qcom_spmi_vadc(E) qcom_vadc_common(PE) industrialio(E) pinctrl_spmi_mpp(E) pinctrl_spmi_gpio(E) rtc_pm8xxx(E) clk_smd_rpm(E) sdhci_msm(E) sdhci_pltfm(E) qcom_smd_regulator(E) drm(E) smd_rpm(E) qcom_spmi_pmic(E) regmap_spmi(E) ci_hdrc_msm(E) ci_hdrc(E) usb3503(E) extcon_usb_gpio(E) phy_msm_usb(E) udc_core(E) qcom_hwspinlock(E) extcon_core(E) ehci_msm(E) i2c_qup(E) sdhci(E) mmc_core(E) spmi_pmic_arb(E) spmi(E) qcom_smd(E) smsm(E) rpmsg_core(E) smp2p(E) smem(E) hwspinlock_core(E) gpio_keys(E) CPU: 2 PID: 551 Comm: irq/150-venus Tainted: P E 4.12.0+ #1625 Hardware name: qualcomm dragonboard410c/dragonboard410c, BIOS 2017.07-rc2-00144-ga97bdbdf72-dirty 07/08/2017 task: ffff800037338000 task.stack: ffff800038e00000 PC is at hfi_sys_init_done+0x64/0x140 [venus_core] LR is at hfi_process_msg_packet+0xcc/0x1e8 [venus_core] pc : [] lr : [] pstate: 20400145 sp : ffff800038e03c60 x29: ffff800038e03c60 x28: 0000000000000000 x27: 00000000000df018 x26: ffff00000118f4d0 x25: 0000000000020003 x24: ffff80003a8d3010 x23: ffff00000118f760 x22: ffff800037b40028 x21: ffff8000382981f0 x20: ffff800037b40028 x19: ffff80003c039000 x18: 0000000000000020 x17: 0000000000000000 x16: ffff800037338000 x15: ffffffffffffffff x14: 0000001000000014 x13: 0000000100001007 x12: 0000000100000020 x11: 0000100e00000000 x10: 0000000000000001 x9 : 0000000200000000 x8 : 0000001400000001 x7 : 0000000000001010 x6 : 0000000000000148 x5 : 0000000000001009 x4 : ffff80003c039000 x3 : 00000000cd770abb x2 : 0000000000000042 x1 : 0000000000000788 x0 : 0000000000000002 Process irq/150-venus (pid: 551, stack limit = 0xffff800038e00000) Call trace: [] hfi_sys_init_done+0x64/0x140 [venus_core] [] hfi_process_msg_packet+0xcc/0x1e8 [venus_core] [] venus_isr_thread+0x1b4/0x208 [venus_core] [] hfi_isr_thread+0x28/0x38 [venus_core] [] irq_thread_fn+0x30/0x70 [] irq_thread+0x14c/0x1c8 [] kthread+0x138/0x140 [] ret_from_fork+0x10/0x40 Code: 52820125 52820207 7a431820 54000249 (b9400263) ---[ end trace c963460f20a984b6 ]--- The problem is that in the error case, we've incremented the data ptr but not decremented rem_bytes, and keep reading (presumably garbage) until eventually we go beyond the end of the buffer. Instead, on first error, we should probably just bail out. Other option is to increment read_bytes by sizeof(u32) before the switch, rather than only accounting for the ptype header in the non-error case. Note that in this case it is HFI_ERR_SYS_INVALID_PARAMETER, ie. an unrecognized/unsupported parameter, so interpreting the next word as a property type would be bogus. The other error cases are due to truncated buffer, so there isn't likely to be anything valid to interpret in the remainder of the buffer. So just bailing seems like a reasonable solution. Signed-off-by: Rob Clark Reviewed-by: Stanimir Varbanov Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab

media: venus: fix compile-test build on non-qcom ARM platform

2017-07-26T10:14:31Z

If QCOM_MDT_LOADER is enabled, but ARCH_QCOM is not, we run into a build error: ERROR: "qcom_mdt_load" [drivers/media/platform/qcom/venus/venus-core.ko] undefined! ERROR: "qcom_mdt_get_size" [drivers/media/platform/qcom/venus/venus-core.ko] undefined! This changes the 'select' statement again, so we only try to enable those symbols when the drivers will actually get built, and explicitly test for QCOM_MDT_LOADER to be enabled before calling into it. Fixes: 76724b30f222 ("[media] media: venus: enable building with COMPILE_TEST") Signed-off-by: Arnd Bergmann Reviewed-by: Stanimir Varbanov Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab

media: venus: mark PM functions as __maybe_unused

2017-07-26T10:14:31Z

Without PM support, gcc warns about two unused functions: platform/qcom/venus/core.c:146:13: error: 'venus_clks_disable' defined but not used [-Werror=unused-function] platform/qcom/venus/core.c:126:12: error: 'venus_clks_enable' defined but not used [-Werror=unused-function] The problem as usual are incorrect #ifdefs, so the easiest fix is to do away with the #ifdef completely and mark the suspend/resume handlers as __maybe_unused, which they are. Fixes: af2c3834c8ca ("[media] media: venus: adding core part and helper functions") Signed-off-by: Arnd Bergmann Reviewed-by: Stanimir Varbanov Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab

media: venus: fix loop wrap in cleanup of clks

2017-06-24T12:38:53Z

The current pre-decrement is incorrect and should be replaced with a post-decrement. Consider the case where the very first clk_prepare_enable fails when i is 0; in this case the error clean up will decrement the unsigned int which wraps to the largest unsigned int value causing an array out of bounds read on core->clks[i]. Detected by CoverityScan, CID#1446590 ("Out-of-bounds read") Signed-off-by: Colin Ian King Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab

[media] media: venus: update firmware path with linux-firmware place

2017-06-20T11:53:41Z

This makes firmware name and path part of venus_resources structure and initialize it properly depending on the SoC and firmware version. Signed-off-by: Stanimir Varbanov Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab

[media] media: venus: vdec: add support for min buffers for capture

2017-06-20T11:53:41Z

This adds support for V4L2_CID_MIN_BUFFERS_FOR_CAPTURE get control in venus decoder, it is usable in case when the userspace wants to know minimum capture buffers before calling request_buf for capture queue in mem2mem drivers. Also this will fix an issue found gstreamer v4l2videodec element, i.e. the video decoder element cannot continue because the buffers are insufficient. Signed-off-by: Stanimir Varbanov Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab

[media] media: venus: venc: fix compile error in venc_close

2017-06-20T11:53:41Z

This fixes the following compile error ocured when building with gcc7: drivers/media/platform/qcom/venus/venc.c:1150 venc_close() error: dereferencing freed memory 'inst' by moving kfree as a last call. Signed-off-by: Stanimir Varbanov Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab

[media] media: venus: vdec: fix compile error in vdec_close

2017-06-20T11:53:41Z

This fixes the following compile error ocured when building with gcc7: drivers/media/platform/qcom/venus/vdec.c:1022 vdec_close() error: dereferencing freed memory 'inst' by moving kfree as a last call. Signed-off-by: Stanimir Varbanov Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab