Decoder may decode timeout or error when PLT test, fix some error
condition not reasonable.
patch 1 fix getting dst buffer NULL.
patch 2 fix inner racing mode fail condition.
patch 3 fix h264 crash.
patch 4 fix vp9 crash.
patch 5 fix core thread empty list.
---
changed with v1:
- add Fix tag for patch 1.
- fix comments for patch 3.
---
Yunfei Dong (5):
media: mediatek: vcodec: Fix getting NULL pointer for dst buffer
media: mediatek: vcodec: Can't set dst buffer to done when lat decode
error
media: mediatek: vcodec: Fix h264 set lat buffer error
media: mediatek: vcodec: Setting lat buf to lat_list when lat decode
error
media: mediatek: vcodec: Core thread depends on core_list
.../vcodec/mtk_vcodec_dec_stateless.c | 13 +++++----
.../vcodec/vdec/vdec_h264_req_multi_if.c | 28 +++++++++++--------
.../vcodec/vdec/vdec_vp9_req_lat_if.c | 15 ++++++----
.../platform/mediatek/vcodec/vdec_msg_queue.c | 2 +-
4 files changed, 36 insertions(+), 22 deletions(-)
--
2.18.0
Will set lat buffer to lat_list two times when lat decode timeout for
inner racing mode.
If core thread can't get frame buffer, need to return error value.
Fixes: 59fba9eed5a7 ("media: mediatek: vcodec: support stateless H.264 decoding for mt8192")
Signed-off-by: Yunfei Dong <[email protected]>
---
- fix comments according to AngeloGioacchino's suggestion.
---
.../vcodec/vdec/vdec_h264_req_multi_if.c | 28 +++++++++++--------
1 file changed, 17 insertions(+), 11 deletions(-)
diff --git a/drivers/media/platform/mediatek/vcodec/vdec/vdec_h264_req_multi_if.c b/drivers/media/platform/mediatek/vcodec/vdec/vdec_h264_req_multi_if.c
index 4cc92700692b..8f262e86bb05 100644
--- a/drivers/media/platform/mediatek/vcodec/vdec/vdec_h264_req_multi_if.c
+++ b/drivers/media/platform/mediatek/vcodec/vdec/vdec_h264_req_multi_if.c
@@ -471,14 +471,19 @@ static int vdec_h264_slice_core_decode(struct vdec_lat_buf *lat_buf)
sizeof(share_info->h264_slice_params));
fb = ctx->dev->vdec_pdata->get_cap_buffer(ctx);
- y_fb_dma = fb ? (u64)fb->base_y.dma_addr : 0;
- vdec_fb_va = (unsigned long)fb;
+ if (!fb) {
+ err = -EBUSY;
+ mtk_vcodec_err(inst, "fb buffer is NULL");
+ goto vdec_dec_end;
+ }
+ vdec_fb_va = (unsigned long)fb;
+ y_fb_dma = (u64)fb->base_y.dma_addr;
if (ctx->q_data[MTK_Q_DATA_DST].fmt->num_planes == 1)
c_fb_dma =
y_fb_dma + inst->ctx->picinfo.buf_w * inst->ctx->picinfo.buf_h;
else
- c_fb_dma = fb ? (u64)fb->base_c.dma_addr : 0;
+ c_fb_dma = (u64)fb->base_c.dma_addr;
mtk_vcodec_debug(inst, "[h264-core] y/c addr = 0x%llx 0x%llx", y_fb_dma,
c_fb_dma);
@@ -630,7 +635,7 @@ static int vdec_h264_slice_lat_decode(void *h_vdec, struct mtk_vcodec_mem *bs,
err = vpu_dec_start(vpu, data, 2);
if (err) {
mtk_vcodec_debug(inst, "lat decode err: %d", err);
- goto err_scp_decode;
+ goto err_free_fb_out;
}
share_info->trans_end = inst->ctx->msg_queue.wdma_addr.dma_addr +
@@ -647,12 +652,17 @@ static int vdec_h264_slice_lat_decode(void *h_vdec, struct mtk_vcodec_mem *bs,
/* wait decoder done interrupt */
timeout = mtk_vcodec_wait_for_done_ctx(inst->ctx, MTK_INST_IRQ_RECEIVED,
WAIT_INTR_TIMEOUT_MS, MTK_VDEC_LAT0);
+ if (timeout)
+ mtk_vcodec_err(inst, "lat decode timeout: pic_%d", inst->slice_dec_num);
inst->vsi->dec.timeout = !!timeout;
err = vpu_dec_end(vpu);
- if (err == SLICE_HEADER_FULL || timeout || err == TRANS_BUFFER_FULL) {
- err = -EINVAL;
- goto err_scp_decode;
+ if (err == SLICE_HEADER_FULL || err == TRANS_BUFFER_FULL) {
+ if (!IS_VDEC_INNER_RACING(inst->ctx->dev->dec_capability))
+ vdec_msg_queue_qbuf(&inst->ctx->msg_queue.lat_ctx, lat_buf);
+ inst->slice_dec_num++;
+ mtk_vcodec_err(inst, "lat dec fail: pic_%d err:%d", inst->slice_dec_num, err);
+ return -EINVAL;
}
share_info->trans_end = inst->ctx->msg_queue.wdma_addr.dma_addr +
@@ -669,10 +679,6 @@ static int vdec_h264_slice_lat_decode(void *h_vdec, struct mtk_vcodec_mem *bs,
inst->slice_dec_num++;
return 0;
-
-err_scp_decode:
- if (!IS_VDEC_INNER_RACING(inst->ctx->dev->dec_capability))
- vdec_msg_queue_qbuf(&inst->ctx->msg_queue.lat_ctx, lat_buf);
err_free_fb_out:
vdec_msg_queue_qbuf(&inst->ctx->msg_queue.lat_ctx, lat_buf);
mtk_vcodec_err(inst, "slice dec number: %d err: %d", inst->slice_dec_num, err);
--
2.18.0
Core thread will call v4l2_m2m_buf_done to set dst buffer done for
lat architecture. If lat call v4l2_m2m_buf_done_and_job_finish to
free dst buffer when lat decode error, core thread will access kernel
NULL pointer dereference, then crash.
Signed-off-by: Yunfei Dong <[email protected]>
---
.../media/platform/mediatek/vcodec/mtk_vcodec_dec_stateless.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/platform/mediatek/vcodec/mtk_vcodec_dec_stateless.c b/drivers/media/platform/mediatek/vcodec/mtk_vcodec_dec_stateless.c
index e86809052a9f..ffbcee04dc26 100644
--- a/drivers/media/platform/mediatek/vcodec/mtk_vcodec_dec_stateless.c
+++ b/drivers/media/platform/mediatek/vcodec/mtk_vcodec_dec_stateless.c
@@ -253,7 +253,7 @@ static void mtk_vdec_worker(struct work_struct *work)
state = ret ? VB2_BUF_STATE_ERROR : VB2_BUF_STATE_DONE;
if (!IS_VDEC_LAT_ARCH(dev->vdec_pdata->hw_arch) ||
- ctx->current_codec == V4L2_PIX_FMT_VP8_FRAME || ret) {
+ ctx->current_codec == V4L2_PIX_FMT_VP8_FRAME) {
v4l2_m2m_buf_done_and_job_finish(dev->m2m_dev_dec, ctx->m2m_ctx, state);
if (src_buf_req)
v4l2_ctrl_request_complete(src_buf_req, &ctx->ctrl_hdl);
--
2.18.0
Core thread will continue to work when core_list is not empty, not
depends on lat_list.
Fixes: 365e4ba01df4 ("media: mtk-vcodec: Add work queue for core hardware decode")
Signed-off-by: Yunfei Dong <[email protected]>
Reviewed-by: AngeloGioacchino Del Regno <[email protected]>
---
drivers/media/platform/mediatek/vcodec/vdec_msg_queue.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.c b/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.c
index ae500980ad45..dc2004790a47 100644
--- a/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.c
+++ b/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.c
@@ -221,7 +221,7 @@ static void vdec_msg_queue_core_work(struct work_struct *work)
mtk_vcodec_dec_disable_hardware(ctx, MTK_VDEC_CORE);
vdec_msg_queue_qbuf(&ctx->msg_queue.lat_ctx, lat_buf);
- if (!list_empty(&ctx->msg_queue.lat_ctx.ready_queue)) {
+ if (!list_empty(&dev->msg_queue_core_ctx.ready_queue)) {
mtk_v4l2_debug(3, "re-schedule to decode for core: %d",
dev->msg_queue_core_ctx.ready_num);
queue_work(dev->core_workqueue, &msg_queue->core_work);
--
2.18.0
Need to set lat buf to lat_list when lat decode error, or lat buffer will lost.
Fixes: 5d418351ca8f ("media: mediatek: vcodec: support stateless VP9 decoding")
Signed-off-by: Yunfei Dong <[email protected]>
---
.../mediatek/vcodec/vdec/vdec_vp9_req_lat_if.c | 15 ++++++++++-----
1 file changed, 10 insertions(+), 5 deletions(-)
diff --git a/drivers/media/platform/mediatek/vcodec/vdec/vdec_vp9_req_lat_if.c b/drivers/media/platform/mediatek/vcodec/vdec/vdec_vp9_req_lat_if.c
index fb1c36a3592d..cbb6728b8a40 100644
--- a/drivers/media/platform/mediatek/vcodec/vdec/vdec_vp9_req_lat_if.c
+++ b/drivers/media/platform/mediatek/vcodec/vdec/vdec_vp9_req_lat_if.c
@@ -2073,21 +2073,23 @@ static int vdec_vp9_slice_lat_decode(void *h_vdec, struct mtk_vcodec_mem *bs,
return -EBUSY;
}
pfc = (struct vdec_vp9_slice_pfc *)lat_buf->private_data;
- if (!pfc)
- return -EINVAL;
+ if (!pfc) {
+ ret = -EINVAL;
+ goto err_free_fb_out;
+ }
vsi = &pfc->vsi;
ret = vdec_vp9_slice_setup_lat(instance, bs, lat_buf, pfc);
if (ret) {
mtk_vcodec_err(instance, "Failed to setup VP9 lat ret %d\n", ret);
- return ret;
+ goto err_free_fb_out;
}
vdec_vp9_slice_vsi_to_remote(vsi, instance->vsi);
ret = vpu_dec_start(&instance->vpu, NULL, 0);
if (ret) {
mtk_vcodec_err(instance, "Failed to dec VP9 ret %d\n", ret);
- return ret;
+ goto err_free_fb_out;
}
if (instance->irq) {
@@ -2107,7 +2109,7 @@ static int vdec_vp9_slice_lat_decode(void *h_vdec, struct mtk_vcodec_mem *bs,
/* LAT trans full, no more UBE or decode timeout */
if (ret) {
mtk_vcodec_err(instance, "VP9 decode error: %d\n", ret);
- return ret;
+ goto err_free_fb_out;
}
mtk_vcodec_debug(instance, "lat dma addr: 0x%lx 0x%lx\n",
@@ -2120,6 +2122,9 @@ static int vdec_vp9_slice_lat_decode(void *h_vdec, struct mtk_vcodec_mem *bs,
vdec_msg_queue_qbuf(&ctx->dev->msg_queue_core_ctx, lat_buf);
return 0;
+err_free_fb_out:
+ vdec_msg_queue_qbuf(&ctx->msg_queue.lat_ctx, lat_buf);
+ return ret;
}
static int vdec_vp9_slice_decode(void *h_vdec, struct mtk_vcodec_mem *bs,
--
2.18.0
Il 17/11/22 10:24, Yunfei Dong ha scritto:
> Will set lat buffer to lat_list two times when lat decode timeout for
> inner racing mode.
>
> If core thread can't get frame buffer, need to return error value.
>
> Fixes: 59fba9eed5a7 ("media: mediatek: vcodec: support stateless H.264 decoding for mt8192")
> Signed-off-by: Yunfei Dong <[email protected]>
Reviewed-by: AngeloGioacchino Del Regno <[email protected]>
Il 17/11/22 10:24, Yunfei Dong ha scritto:
> Need to set lat buf to lat_list when lat decode error, or lat buffer will lost.
>
> Fixes: 5d418351ca8f ("media: mediatek: vcodec: support stateless VP9 decoding")
> Signed-off-by: Yunfei Dong <[email protected]>
Reviewed-by: AngeloGioacchino Del Regno <[email protected]>