Skip to content
Snippets Groups Projects
  1. Mar 01, 2019
  2. Feb 18, 2019
  3. Feb 07, 2019
  4. Jan 31, 2019
  5. Jan 21, 2019
  6. Jan 16, 2019
  7. Jan 07, 2019
  8. Dec 14, 2018
  9. Dec 07, 2018
  10. Dec 05, 2018
  11. Dec 03, 2018
    • Hans Verkuil's avatar
      media: vb2: keep a reference to the request until dqbuf · 6093d300
      Hans Verkuil authored
      
      When vb2_buffer_done is called the buffer is unbound from the
      request and put. The media_request_object_put also 'put's the
      request reference. If the application has already closed the
      request fd, then that means that the request reference at that
      point goes to 0 and the whole request is released.
      
      This means that the control handler associated with the request is
      also freed and that causes this kernel oops:
      
      [174705.995401] BUG: sleeping function called from invalid context at kernel/locking/mutex.c:908
      [174705.995411] in_atomic(): 1, irqs_disabled(): 1, pid: 28071, name: vivid-000-vid-o
      [174705.995416] 2 locks held by vivid-000-vid-o/28071:
      [174705.995420]  #0: 000000001ea3a232 (&dev->mutex#3){....}, at: vivid_thread_vid_out+0x3f5/0x550 [vivid]
      [174705.995447]  #1: 00000000e30a0d1e (&(&q->done_lock)->rlock){....}, at: vb2_buffer_done+0x92/0x1d0 [videobuf2_common]
      [174705.995460] Preemption disabled at:
      [174705.995461] [<0000000000000000>]           (null)
      [174705.995472] CPU: 11 PID: 28071 Comm: vivid-000-vid-o Tainted: G        W         4.20.0-rc1-test-no #88
      [174705.995476] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 05/19/2017
      [174705.995481] Call Trace:
      [174705.995500]  dump_stack+0x46/0x60
      [174705.995512]  ___might_sleep.cold.79+0xe1/0xf1
      [174705.995523]  __mutex_lock+0x50/0x8f0
      [174705.995531]  ? find_held_lock+0x2d/0x90
      [174705.995536]  ? find_held_lock+0x2d/0x90
      [174705.995542]  ? find_held_lock+0x2d/0x90
      [174705.995564]  ? v4l2_ctrl_handler_free.part.13+0x44/0x1d0 [videodev]
      [174705.995576]  v4l2_ctrl_handler_free.part.13+0x44/0x1d0 [videodev]
      [174705.995590]  v4l2_ctrl_request_release+0x1c/0x30 [videodev]
      [174705.995600]  media_request_clean+0x64/0xe0 [media]
      [174705.995609]  media_request_release+0x19/0x40 [media]
      [174705.995617]  vb2_buffer_done+0xef/0x1d0 [videobuf2_common]
      [174705.995630]  vivid_thread_vid_out+0x2c1/0x550 [vivid]
      [174705.995645]  ? vivid_stop_generating_vid_cap+0x1c0/0x1c0 [vivid]
      [174705.995653]  kthread+0x113/0x130
      [174705.995659]  ? kthread_park+0x80/0x80
      [174705.995667]  ret_from_fork+0x35/0x40
      
      The vb2_buffer_done function can be called from interrupt context, so
      anything that sleeps is not allowed.
      
      The solution is to increment the request refcount when the buffer is
      queued and decrement it when the buffer is dequeued. Releasing the
      request is fine if that happens from VIDIOC_DQBUF.
      
      Signed-off-by: default avatarHans Verkuil <hverkuil-cisco@xs4all.nl>
      Acked-by: default avatarSakari Ailus <sakari.ailus@linux.intel.com>
      Signed-off-by: default avatarHans Verkuil <hverkuil-cisco@xs4all.nl>
      Signed-off-by: default avatarMauro Carvalho Chehab <mchehab+samsung@kernel.org>
      6093d300
  12. Nov 23, 2018
    • Hans Verkuil's avatar
      media: cec: keep track of outstanding transmits · 32804fcb
      Hans Verkuil authored
      
      I noticed that repeatedly running 'cec-ctl --playback' would occasionally
      select 'Playback Device 2' instead of 'Playback Device 1', even though there
      were no other Playback devices in the HDMI topology. This happened both with
      'real' hardware and with the vivid CEC emulation, suggesting that this was an
      issue in the core code that claims a logical address.
      
      What 'cec-ctl --playback' does is to first clear all existing logical addresses,
      and immediately after that configure the new desired device type.
      
      The core code will poll the logical addresses trying to find a free address.
      When found it will issue a few standard messages as per the CEC spec and return.
      Those messages are queued up and will be transmitted asynchronously.
      
      What happens is that if you run two 'cec-ctl --playback' commands in quick
      succession, there is still a message of the first cec-ctl command being transmitted
      when you reconfigure the adapter again in the second cec-ctl command.
      
      When the logical addresses are cleared, then all information about outstanding
      transmits inside the CEC core is also cleared, and the core is no longer aware
      that there is still a transmit in flight.
      
      When the hardware finishes the transmit it calls transmit_done and the CEC core
      thinks it is actually in response of a POLL messages that is trying to find a
      free logical address. The result of all this is that the core thinks that the
      logical address for Playback Device 1 is in use, when it is really an earlier
      transmit that ended.
      
      The main transmit thread looks at adap->transmitting to check if a transmit
      is in progress, but that is set to NULL when the adapter is unconfigured.
      adap->transmitting represents the view of userspace, not that of the hardware.
      So when unconfiguring the adapter the message is marked aborted from the point
      of view of userspace, but seen from the PoV of the hardware it is still ongoing.
      
      So introduce a new bool transmit_in_progress that represents the hardware state
      and use that instead of adap->transmitting. Now the CEC core waits until the
      hardware finishes the transmit before starting a new transmit.
      
      Signed-off-by: default avatarHans Verkuil <hverkuil-cisco@xs4all.nl>
      Cc: <stable@vger.kernel.org>      # for v4.18 and up
      Signed-off-by: default avatarMauro Carvalho Chehab <mchehab+samsung@kernel.org>
      32804fcb
    • Akinobu Mita's avatar
      media: v4l2-common: add V4L2_FRACT_COMPARE · 85de5e06
      Akinobu Mita authored
      
      Add macro to compare two v4l2_fract values in v4l2 common internal API.
      The same macro FRACT_CMP() is used by vivid and bcm2835-camera.  This just
      renames it to V4L2_FRACT_COMPARE in order to avoid namespace collision.
      
      Cc: Matt Ranostay <matt.ranostay@konsulko.com>
      Acked-by: default avatarSakari Ailus <sakari.ailus@linux.intel.com>
      Signed-off-by: default avatarAkinobu Mita <akinobu.mita@gmail.com>
      Signed-off-by: default avatarHans Verkuil <hverkuil@xs4all.nl>
      Signed-off-by: default avatarMauro Carvalho Chehab <mchehab+samsung@kernel.org>
      85de5e06
  13. Nov 22, 2018
  14. Nov 20, 2018
  15. Nov 06, 2018
  16. Oct 05, 2018
  17. Oct 04, 2018
Loading