queue-5.1/media-s5p-mfc-fix-reading-min-scratch-buffer-size-on.patch

   1 From fea2c4b59149f935c1e498108f520cadad0b2de5 Mon Sep 17 00:00:00 2001
   2 From: Marek Szyprowski <m.szyprowski@samsung.com>
   3 Date: Wed, 12 Jun 2019 09:57:57 -0400
   4 Subject: media: s5p-mfc: fix reading min scratch buffer size on MFC v6/v7
   5
   6 [ Upstream commit be22203aec440c1761ce8542c2636ac6c8951e3a ]
   7
   8 MFC v6 and v7 has no register to read min scratch buffer size, so it has
   9 to be read conditionally only if hardware supports it. This fixes following
  10 NULL pointer exception on SoCs with MFC v6/v7:
  11
  12 8<--- cut here ---
  13 Unable to handle kernel NULL pointer dereference at virtual address 00000000
  14 pgd = f25837f9
  15 [00000000] *pgd=bd93d835
  16 Internal error: Oops: 17 [#1] PREEMPT SMP ARM
  17 Modules linked in: btmrvl_sdio btmrvl bluetooth mwifiex_sdio mwifiex ecdh_generic ecc
  18 Hardware name: SAMSUNG EXYNOS (Flattened Device Tree)
  19 PC is at s5p_mfc_get_min_scratch_buf_size+0x30/0x3c
  20 LR is at s5p_mfc_get_min_scratch_buf_size+0x28/0x3c
  21 ...
  22 [<c074f998>] (s5p_mfc_get_min_scratch_buf_size) from [<c0745bc0>] (s5p_mfc_irq+0x814/0xa5c)
  23 [<c0745bc0>] (s5p_mfc_irq) from [<c019a218>] (__handle_irq_event_percpu+0x64/0x3f8)
  24 [<c019a218>] (__handle_irq_event_percpu) from [<c019a5d8>] (handle_irq_event_percpu+0x2c/0x7c)
  25 [<c019a5d8>] (handle_irq_event_percpu) from [<c019a660>] (handle_irq_event+0x38/0x5c)
  26 [<c019a660>] (handle_irq_event) from [<c019ebc4>] (handle_fasteoi_irq+0xc4/0x180)
  27 [<c019ebc4>] (handle_fasteoi_irq) from [<c0199270>] (generic_handle_irq+0x24/0x34)
  28 [<c0199270>] (generic_handle_irq) from [<c0199888>] (__handle_domain_irq+0x7c/0xec)
  29 [<c0199888>] (__handle_domain_irq) from [<c04ac298>] (gic_handle_irq+0x58/0x9c)
  30 [<c04ac298>] (gic_handle_irq) from [<c0101ab0>] (__irq_svc+0x70/0xb0)
  31 Exception stack(0xe73ddc60 to 0xe73ddca8)
  32 ...
  33 [<c0101ab0>] (__irq_svc) from [<c01967d8>] (console_unlock+0x5a8/0x6a8)
  34 [<c01967d8>] (console_unlock) from [<c01981d0>] (vprintk_emit+0x118/0x2d8)
  35 [<c01981d0>] (vprintk_emit) from [<c01983b0>] (vprintk_default+0x20/0x28)
  36 [<c01983b0>] (vprintk_default) from [<c01989b4>] (printk+0x30/0x54)
  37 [<c01989b4>] (printk) from [<c07500b8>] (s5p_mfc_init_decode_v6+0x1d4/0x284)
  38 [<c07500b8>] (s5p_mfc_init_decode_v6) from [<c07230d0>] (vb2_start_streaming+0x24/0x150)
  39 [<c07230d0>] (vb2_start_streaming) from [<c0724e4c>] (vb2_core_streamon+0x11c/0x15c)
  40 [<c0724e4c>] (vb2_core_streamon) from [<c07478b8>] (vidioc_streamon+0x64/0xa0)
  41 [<c07478b8>] (vidioc_streamon) from [<c0709640>] (__video_do_ioctl+0x28c/0x45c)
  42 [<c0709640>] (__video_do_ioctl) from [<c0709bc8>] (video_usercopy+0x260/0x8a4)
  43 [<c0709bc8>] (video_usercopy) from [<c02b3820>] (do_vfs_ioctl+0xb0/0x9fc)
  44 [<c02b3820>] (do_vfs_ioctl) from [<c02b41a0>] (ksys_ioctl+0x34/0x58)
  45 [<c02b41a0>] (ksys_ioctl) from [<c0101000>] (ret_fast_syscall+0x0/0x28)
  46 Exception stack(0xe73ddfa8 to 0xe73ddff0)
  47 ...
  48 ---[ end trace 376cf5ba6e0bee93 ]---
  49
  50 Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
  51 Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
  52 Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
  53 Signed-off-by: Sasha Levin <sashal@kernel.org>
  54 ---
  55  drivers/media/platform/s5p-mfc/s5p_mfc.c | 3 ++-
  56  1 file changed, 2 insertions(+), 1 deletion(-)
  57
  58 diff --git a/drivers/media/platform/s5p-mfc/s5p_mfc.c b/drivers/media/platform/s5p-mfc/s5p_mfc.c
  59 index 9a53d3908b52..2504fe9761bf 100644
  60 --- a/drivers/media/platform/s5p-mfc/s5p_mfc.c
  61 +++ b/drivers/media/platform/s5p-mfc/s5p_mfc.c
  62 @@ -527,7 +527,8 @@ static void s5p_mfc_handle_seq_done(struct s5p_mfc_ctx *ctx,
  63                                 dev);
  64                 ctx->mv_count = s5p_mfc_hw_call(dev->mfc_ops, get_mv_count,
  65                                 dev);
  66 -               ctx->scratch_buf_size = s5p_mfc_hw_call(dev->mfc_ops,
  67 +               if (FW_HAS_E_MIN_SCRATCH_BUF(dev))
  68 +                       ctx->scratch_buf_size = s5p_mfc_hw_call(dev->mfc_ops,
  69                                                 get_min_scratch_buf_size, dev);
  70                 if (ctx->img_width == 0 || ctx->img_height == 0)
  71                         ctx->state = MFCINST_ERROR;
  72 --
  73 2.20.1
  74