From 47bc59c52b005f546343c373370a7eec6a2b0f84 Mon Sep 17 00:00:00 2001 From: Hans Verkuil Date: Fri, 1 Aug 2014 09:18:50 -0300 Subject: [PATCH 01/16] [media] videobuf2-dma-sg: fix for wrong GFP mask to sg_alloc_table_from_pages sg_alloc_table_from_pages() only allocates a sg_table, so it should just use GFP_KERNEL, not gfp_flags. If gfp_flags contains __GFP_DMA32 then mm/sl[au]b.c will call BUG_ON: [ 358.027515] ------------[ cut here ]------------ [ 358.027546] kernel BUG at mm/slub.c:1416! [ 358.027558] invalid opcode: 0000 [#1] PREEMPT SMP [ 358.027576] Modules linked in: mt2131 s5h1409 tda8290 tuner cx25840 cx23885 btcx_risc altera_ci tda18271 altera_stapl videobuf2_dvb tveeprom cx2341x videobuf2_dma_sg dvb_core rc_core videobuf2_memops videobuf2_core nouveau zr36067 videocodec v4l2_common videodev media x86_pkg_temp_thermal cfbfillrect cfbimgblt cfbcopyarea ttm drm_kms_helper processor button isci [ 358.027712] CPU: 19 PID: 3654 Comm: cat Not tainted 3.16.0-rc6-telek #167 [ 358.027723] Hardware name: ASUSTeK COMPUTER INC. Z9PE-D8 WS/Z9PE-D8 WS, BIOS 5404 02/10/2014 [ 358.027741] task: ffff880897c7d960 ti: ffff88089b4d4000 task.ti: ffff88089b4d4000 [ 358.027753] RIP: 0010:[] [] new_slab+0x280/0x320 [ 358.027776] RSP: 0018:ffff88089b4d7ae8 EFLAGS: 00010002 [ 358.027787] RAX: ffff880897c7d960 RBX: 0000000000000000 RCX: ffff88089b4d7b50 [ 358.027798] RDX: 00000000ffffffff RSI: 0000000000000004 RDI: ffff88089f803b00 [ 358.027809] RBP: ffff88089b4d7bb8 R08: 0000000000000000 R09: 0000000100400040 [ 358.027821] R10: 0000160000000000 R11: ffff88109bc02c40 R12: 0000000000000001 [ 358.027832] R13: ffff88089f8000c0 R14: ffff88089f803b00 R15: ffff8810bfcf4be0 [ 358.027845] FS: 00007f83fe5c0700(0000) GS:ffff8810bfce0000(0000) knlGS:0000000000000000 [ 358.027858] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 358.027868] CR2: 0000000001dfd568 CR3: 0000001097d5a000 CR4: 00000000000407e0 [ 358.027878] Stack: [ 358.027885] ffffffff81198860 ffff8810bfcf4be0 ffff880897c7d960 0000000000001b00 [ 358.027905] ffff880897c7d960 0000000000000000 ffff8810bfcf4bf0 0000000000000000 [ 358.027924] 0000000000000000 0000000100000100 ffffffff813ef84a 00000004ffffffff [ 358.027944] Call Trace: [ 358.027956] [] ? __slab_alloc+0x400/0x4e0 [ 358.027973] [] ? sg_kmalloc+0x1a/0x30 [ 358.027985] [] __kmalloc+0x127/0x150 [ 358.027997] [] ? sg_kmalloc+0x1a/0x30 [ 358.028009] [] sg_kmalloc+0x1a/0x30 [ 358.028023] [] __sg_alloc_table+0x74/0x180 [ 358.028035] [] ? sg_kfree+0x20/0x20 [ 358.028048] [] sg_alloc_table+0x1f/0x60 [ 358.028061] [] sg_alloc_table_from_pages+0x84/0x1f0 [ 358.028077] [] vb2_dma_sg_alloc+0x159/0x230 [videobuf2_dma_sg] [ 358.028095] [] __vb2_queue_alloc+0x10a/0x680 [videobuf2_core] [ 358.028113] [] __reqbufs.isra.14+0x220/0x3e0 [videobuf2_core] [ 358.028130] [] __vb2_init_fileio+0xbd/0x380 [videobuf2_core] [ 358.028147] [] __vb2_perform_fileio+0x5b3/0x6e0 [videobuf2_core] [ 358.028164] [] vb2_fop_read+0xb1/0x100 [videobuf2_core] [ 358.028184] [] v4l2_read+0x65/0xb0 [videodev] [ 358.028198] [] vfs_read+0x8f/0x170 [ 358.028210] [] SyS_read+0x41/0xb0 [ 358.028224] [] system_call_fastpath+0x16/0x1b [ 358.028234] Code: 66 90 e9 dc fd ff ff 0f 1f 40 00 41 8b 4d 68 e9 d5 fe ff ff 0f 1f 80 00 00 00 00 f0 41 80 4d 00 40 e9 03 ff ff ff 0f 1f 44 00 00 <0f> 0b 66 0f 1f 44 00 00 44 89 c6 4c 89 45 d0 e8 0c 82 ff ff 48 [ 358.028415] RIP [] new_slab+0x280/0x320 [ 358.028432] RSP [ 358.032208] ---[ end trace 6443240199c706e4 ]--- Signed-off-by: Hans Verkuil Cc: stable@vger.kernel.org # for v3.13 and up Acked-by: Marek Szyprowski Signed-off-by: Mauro Carvalho Chehab --- drivers/media/v4l2-core/videobuf2-dma-sg.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/media/v4l2-core/videobuf2-dma-sg.c b/drivers/media/v4l2-core/videobuf2-dma-sg.c index adefc31bb853..9b163a440f89 100644 --- a/drivers/media/v4l2-core/videobuf2-dma-sg.c +++ b/drivers/media/v4l2-core/videobuf2-dma-sg.c @@ -113,7 +113,7 @@ static void *vb2_dma_sg_alloc(void *alloc_ctx, unsigned long size, gfp_t gfp_fla goto fail_pages_alloc; ret = sg_alloc_table_from_pages(&buf->sg_table, buf->pages, - buf->num_pages, 0, size, gfp_flags); + buf->num_pages, 0, size, GFP_KERNEL); if (ret) goto fail_table_alloc; From 23cd08c8f72405359862aff2ad2a8be1c232198c Mon Sep 17 00:00:00 2001 From: Hans Verkuil Date: Mon, 4 Aug 2014 02:33:53 -0300 Subject: [PATCH 02/16] [media] videobuf2-core: add comments before the WARN_ON Recently WARN_ON() calls have been added to warn if the driver is not properly returning buffers to vb2 in start_streaming (if it fails) or stop_streaming(). Add comments before those WARN_ON calls that refer to the videobuf2-core.h header that explains what drivers are supposed to do in these situations. That should help point developers in the right direction if they see these warnings. Signed-off-by: Hans Verkuil Acked-by: Pawel Osciak Signed-off-by: Mauro Carvalho Chehab --- drivers/media/v4l2-core/videobuf2-core.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/drivers/media/v4l2-core/videobuf2-core.c b/drivers/media/v4l2-core/videobuf2-core.c index c359006074a8..d3f2a221db62 100644 --- a/drivers/media/v4l2-core/videobuf2-core.c +++ b/drivers/media/v4l2-core/videobuf2-core.c @@ -1762,6 +1762,12 @@ static int vb2_start_streaming(struct vb2_queue *q) q->start_streaming_called = 0; dprintk(1, "driver refused to start streaming\n"); + /* + * If you see this warning, then the driver isn't cleaning up properly + * after a failed start_streaming(). See the start_streaming() + * documentation in videobuf2-core.h for more information how buffers + * should be returned to vb2 in start_streaming(). + */ if (WARN_ON(atomic_read(&q->owned_by_drv_count))) { unsigned i; @@ -2123,6 +2129,12 @@ static void __vb2_queue_cancel(struct vb2_queue *q) if (q->start_streaming_called) call_void_qop(q, stop_streaming, q); + /* + * If you see this warning, then the driver isn't cleaning up properly + * in stop_streaming(). See the stop_streaming() documentation in + * videobuf2-core.h for more information how buffers should be returned + * to vb2 in stop_streaming(). + */ if (WARN_ON(atomic_read(&q->owned_by_drv_count))) { for (i = 0; i < q->num_buffers; ++i) if (q->bufs[i]->state == VB2_BUF_STATE_ACTIVE) From 44e8e69d46db9928cd3b81cbea4ca24257412286 Mon Sep 17 00:00:00 2001 From: Hans Verkuil Date: Mon, 4 Aug 2014 07:12:32 -0300 Subject: [PATCH 03/16] [media] videobuf2-core.h: fix comment The comment for start_streaming that tells the developer with which vb2 state buffers should be returned to vb2 gave the wrong state. Very confusing. Signed-off-by: Hans Verkuil Acked-by: Laurent Pinchart Signed-off-by: Mauro Carvalho Chehab --- include/media/videobuf2-core.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/include/media/videobuf2-core.h b/include/media/videobuf2-core.h index fc910a622451..80fa7253e483 100644 --- a/include/media/videobuf2-core.h +++ b/include/media/videobuf2-core.h @@ -295,7 +295,7 @@ struct vb2_buffer { * can return an error if hardware fails, in that case all * buffers that have been already given by the @buf_queue * callback are to be returned by the driver by calling - * @vb2_buffer_done(VB2_BUF_STATE_DEQUEUED). + * @vb2_buffer_done(VB2_BUF_STATE_QUEUED). * If you need a minimum number of buffers before you can * start streaming, then set @min_buffers_needed in the * vb2_queue structure. If that is non-zero then From bf3593d939520559774cbfee03ba5f314d909620 Mon Sep 17 00:00:00 2001 From: Hans Verkuil Date: Mon, 4 Aug 2014 07:14:14 -0300 Subject: [PATCH 04/16] [media] vb2: fix vb2 state check when start_streaming fails Commit bd994ddb2a12a3ff48cd549ec82cdceaea9614df (vb2: Fix stream start and buffer completion race) broke the buffer state check in vb2_buffer_done. So accept all three possible states there since I can no longer tell the difference between vb2_buffer_done called from start_streaming or from elsewhere. Instead add a WARN_ON at the end of start_streaming that will check whether any buffers were added to the done list, since that implies that the wrong state was used as well. Signed-off-by: Hans Verkuil Acked-by: Laurent Pinchart Cc: stable@vger.kernel.org # for v3.15 and up Signed-off-by: Mauro Carvalho Chehab --- drivers/media/v4l2-core/videobuf2-core.c | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-) diff --git a/drivers/media/v4l2-core/videobuf2-core.c b/drivers/media/v4l2-core/videobuf2-core.c index d3f2a221db62..7f70fd521ab1 100644 --- a/drivers/media/v4l2-core/videobuf2-core.c +++ b/drivers/media/v4l2-core/videobuf2-core.c @@ -1165,13 +1165,10 @@ void vb2_buffer_done(struct vb2_buffer *vb, enum vb2_buffer_state state) if (WARN_ON(vb->state != VB2_BUF_STATE_ACTIVE)) return; - if (!q->start_streaming_called) { - if (WARN_ON(state != VB2_BUF_STATE_QUEUED)) - state = VB2_BUF_STATE_QUEUED; - } else if (WARN_ON(state != VB2_BUF_STATE_DONE && - state != VB2_BUF_STATE_ERROR)) { - state = VB2_BUF_STATE_ERROR; - } + if (WARN_ON(state != VB2_BUF_STATE_DONE && + state != VB2_BUF_STATE_ERROR && + state != VB2_BUF_STATE_QUEUED)) + state = VB2_BUF_STATE_ERROR; #ifdef CONFIG_VIDEO_ADV_DEBUG /* @@ -1783,6 +1780,12 @@ static int vb2_start_streaming(struct vb2_queue *q) /* Must be zero now */ WARN_ON(atomic_read(&q->owned_by_drv_count)); } + /* + * If done_list is not empty, then start_streaming() didn't call + * vb2_buffer_done(vb, VB2_BUF_STATE_QUEUED) but STATE_ERROR or + * STATE_DONE. + */ + WARN_ON(!list_empty(&q->done_list)); return ret; } From 1b88db2f2bed287505e8decea512db5e3fe3929c Mon Sep 17 00:00:00 2001 From: Hans Verkuil Date: Mon, 4 Aug 2014 04:51:25 -0300 Subject: [PATCH 05/16] [media] DocBook media: fix fieldname in struct v4l2_subdev_selection Field 'rect' is really named 'r'. Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab --- Documentation/DocBook/media/v4l/vidioc-subdev-g-selection.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Documentation/DocBook/media/v4l/vidioc-subdev-g-selection.xml b/Documentation/DocBook/media/v4l/vidioc-subdev-g-selection.xml index 1ba9e999af3f..c62a7360719b 100644 --- a/Documentation/DocBook/media/v4l/vidioc-subdev-g-selection.xml +++ b/Documentation/DocBook/media/v4l/vidioc-subdev-g-selection.xml @@ -119,7 +119,7 @@ &v4l2-rect; - rect + r Selection rectangle, in pixels. From 983ed755641cfeac99716311f3d3b464d742f304 Mon Sep 17 00:00:00 2001 From: Hans Verkuil Date: Mon, 4 Aug 2014 06:16:37 -0300 Subject: [PATCH 06/16] [media] DocBook media: update version number and V4L2 changes Note: the revision text for the v4l2_pix_format change from Laurent erroneously mentioned 3.16 when it only got merged for 3.17. Fixed that as well. Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab --- Documentation/DocBook/media/v4l/compat.xml | 24 ++++++++++++++++++++++ Documentation/DocBook/media/v4l/v4l2.xml | 11 +++++----- 2 files changed, 30 insertions(+), 5 deletions(-) diff --git a/Documentation/DocBook/media/v4l/compat.xml b/Documentation/DocBook/media/v4l/compat.xml index eee6f0f4aa43..3a626d1b8f2e 100644 --- a/Documentation/DocBook/media/v4l/compat.xml +++ b/Documentation/DocBook/media/v4l/compat.xml @@ -2545,6 +2545,30 @@ fields changed from _s32 to _u32. +
+ V4L2 in Linux 3.16 + + + Added event V4L2_EVENT_SOURCE_CHANGE. + + + +
+ +
+ V4L2 in Linux 3.17 + + + Extended &v4l2-pix-format;. Added format flags. + + + + Added compound control types and &VIDIOC-QUERY-EXT-CTRL;. + + + +
+
Relation of V4L2 to other Linux multimedia APIs diff --git a/Documentation/DocBook/media/v4l/v4l2.xml b/Documentation/DocBook/media/v4l/v4l2.xml index f2f81f06a17b..7cfe618f754d 100644 --- a/Documentation/DocBook/media/v4l/v4l2.xml +++ b/Documentation/DocBook/media/v4l/v4l2.xml @@ -152,10 +152,11 @@ structs, ioctls) must be noted in more detail in the history chapter applications. --> - 3.16 - 2014-05-27 - lp - Extended &v4l2-pix-format;. Added format flags. + 3.17 + 2014-08-04 + lp, hv + Extended &v4l2-pix-format;. Added format flags. Added compound control types +and VIDIOC_QUERY_EXT_CTRL. @@ -538,7 +539,7 @@ and discussions on the V4L mailing list. Video for Linux Two API Specification - Revision 3.14 + Revision 3.17 &sub-common; From a9ae4692eda4b99f85757b15d60971ff78a0a0e2 Mon Sep 17 00:00:00 2001 From: Zhaowei Yuan Date: Thu, 21 Aug 2014 23:28:21 -0300 Subject: [PATCH 07/16] [media] vb2: fix plane index sanity check in vb2_plane_cookie() It's also invalid when plane_no is equal to vb->num_planes Signed-off-by: Zhaowei Yuan Cc: stable@vger.kernel.org # for v3.7 and up Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab --- drivers/media/v4l2-core/videobuf2-core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/media/v4l2-core/videobuf2-core.c b/drivers/media/v4l2-core/videobuf2-core.c index 7f70fd521ab1..c2126d874549 100644 --- a/drivers/media/v4l2-core/videobuf2-core.c +++ b/drivers/media/v4l2-core/videobuf2-core.c @@ -1130,7 +1130,7 @@ EXPORT_SYMBOL_GPL(vb2_plane_vaddr); */ void *vb2_plane_cookie(struct vb2_buffer *vb, unsigned int plane_no) { - if (plane_no > vb->num_planes || !vb->planes[plane_no].mem_priv) + if (plane_no >= vb->num_planes || !vb->planes[plane_no].mem_priv) return NULL; return call_ptr_memop(vb, cookie, vb->planes[plane_no].mem_priv); From 7102076c922e310f5a914a21fcd8d65fd8bd2417 Mon Sep 17 00:00:00 2001 From: Randy Dunlap Date: Thu, 28 Aug 2014 14:01:26 -0300 Subject: [PATCH 08/16] [media] media/radio: fix radio-miropcm20.c build with io.h header file Fix build errors in radio-miropcm20.c due to missing header file: drivers/media/radio/radio-miropcm20.c: In function 'rds_waitread': drivers/media/radio/radio-miropcm20.c:90:3: error: implicit declaration of function 'inb' [-Werror=implicit-function-declaration] drivers/media/radio/radio-miropcm20.c: In function 'rds_rawwrite': drivers/media/radio/radio-miropcm20.c:106:3: error: implicit declaration of function 'outb' [-Werror=implicit-function-declaration] Reported-by: Jim Davis Signed-off-by: Randy Dunlap Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab --- drivers/media/radio/radio-miropcm20.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/media/radio/radio-miropcm20.c b/drivers/media/radio/radio-miropcm20.c index 998919e97dfe..7b35e633118d 100644 --- a/drivers/media/radio/radio-miropcm20.c +++ b/drivers/media/radio/radio-miropcm20.c @@ -27,6 +27,7 @@ #include #include +#include #include #include #include From 77639ff2b3404a913b8037d230a384798b854bae Mon Sep 17 00:00:00 2001 From: Hans Verkuil Date: Fri, 12 Sep 2014 06:02:02 -0300 Subject: [PATCH 09/16] [media] adv7604: fix inverted condition The log_status function should show HDMI information, but the test checking for an HDMI input was inverted. Fix this. Signed-off-by: Hans Verkuil Cc: stable@vger.kernel.org # for v3.12 and up Signed-off-by: Mauro Carvalho Chehab --- drivers/media/i2c/adv7604.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/media/i2c/adv7604.c b/drivers/media/i2c/adv7604.c index d4fa213ba74a..de88b980a837 100644 --- a/drivers/media/i2c/adv7604.c +++ b/drivers/media/i2c/adv7604.c @@ -2325,7 +2325,7 @@ static int adv7604_log_status(struct v4l2_subdev *sd) v4l2_info(sd, "HDCP keys read: %s%s\n", (hdmi_read(sd, 0x04) & 0x20) ? "yes" : "no", (hdmi_read(sd, 0x04) & 0x10) ? "ERROR" : ""); - if (!is_hdmi(sd)) { + if (is_hdmi(sd)) { bool audio_pll_locked = hdmi_read(sd, 0x04) & 0x01; bool audio_sample_packet_detect = hdmi_read(sd, 0x18) & 0x01; bool audio_mute = io_read(sd, 0x65) & 0x40; From fdc6b388925e3d0a4b4773ab7d641947fe59ed46 Mon Sep 17 00:00:00 2001 From: Hans Verkuil Date: Sat, 20 Sep 2014 09:36:26 -0300 Subject: [PATCH 10/16] [media] cx24123: fix kernel oops due to missing parent pointer When I try to set the TV standard to e.g. PAL on my Hauppauge WinTV-HVR3000 I get the following oops: 9464.262345] CX24123: detected CX24123 [ 9464.262526] BUG: unable to handle kernel NULL pointer dereference at 0000000000000230 [ 9464.262555] IP: [] acpi_i2c_install_space_handler+0x15/0xc0 [ 9464.262576] PGD 0 [ 9464.262584] Oops: 0000 [#1] PREEMPT SMP [ 9464.262597] Modules linked in: cx24123 cx22702 cx88_dvb(+) videobuf_dvb cx88_vp3054_i2c cx88_blackbird cx8802 ir_lirc_codec ir_xmp_decoder ir_sanyo_decoder ir_jvc_decoder ir_mce_kbd_decoder ir_sharp_decoder lirc_dev ir_sony_decoder ir_rc6_decoder ir_nec_decoder ir_rc5_decoder rc_hauppauge wm8775 tuner_simple tuner_types tda9887 cx8800 cx88xx btcx_risc videobuf_dma_sg videobuf_core mt2131 s5h1409 tda8290 tuner cx25840 cx23885 altera_ci tda18271 altera_stapl videobuf2_dvb tveeprom cx2341x videobuf2_dma_sg dvb_core rc_core videobuf2_memops videobuf2_core v4l2_common videodev media nouveau x86_pkg_temp_thermal cfbfillrect cfbimgblt cfbcopyarea ttm drm_kms_helper processor button isci [ 9464.262786] CPU: 2 PID: 2417 Comm: modprobe Not tainted 3.17.0-rc1-telek #322 [ 9464.262796] Hardware name: ASUSTeK COMPUTER INC. Z9PE-D8 WS/Z9PE-D8 WS, BIOS 5404 02/10/2014 [ 9464.262807] task: ffff881097959ad0 ti: ffff88109967c000 task.ti: ffff88109967c000 [ 9464.262817] RIP: 0010:[] [] acpi_i2c_install_space_handler+0x15/0xc0 [ 9464.262834] RSP: 0018:ffff88109967fbd8 EFLAGS: 00010246 [ 9464.262843] RAX: 0000000000000000 RBX: ffff880892a89540 RCX: 0000000000000000 [ 9464.262853] RDX: 0000000080000001 RSI: ffff880892e75870 RDI: ffff880892a89540 [ 9464.262862] RBP: ffff88109967fbf8 R08: ffff881099b2ccc0 R09: ffff880891efa088 [ 9464.262872] R10: 0000000000000000 R11: 0000000000000022 R12: 0000000000000000 [ 9464.262883] R13: ffff880892a895b0 R14: 00000000ffffffed R15: ffff88089b48f800 [ 9464.262893] FS: 00007fe42b6d7700(0000) GS:ffff88089fc40000(0000) knlGS:0000000000000000 [ 9464.262904] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 9464.262912] CR2: 0000000000000230 CR3: 0000001094078000 CR4: 00000000000407e0 [ 9464.262922] Stack: [ 9464.262927] ffff880892a89540 0000000000000000 ffff880892a895b0 ffff88109a155a80 [ 9464.262944] ffff88109967fc20 ffffffff81666a36 0000000000000020 ffff880892a89540 [ 9464.262960] ffffffffa01c8d40 ffff88109967fc40 ffffffff81666c67 ffff880892a89000 [ 9464.262977] Call Trace: [ 9464.262987] [] i2c_register_adapter+0x166/0x340 [ 9464.262998] [] i2c_add_adapter+0x57/0x60 [ 9464.263011] [] cx24123_attach+0x108/0x1ba [cx24123] [ 9464.263025] [] dvb_register+0x404/0x245b [cx88_dvb] [ 9464.263039] [] ? videobuf_queue_core_init+0xe3/0x140 [videobuf_core] [ 9464.263052] [] cx8802_dvb_probe+0x1e1/0x261 [cx88_dvb] [ 9464.263066] [] cx8802_register_driver+0x190/0x20d [cx8802] [ 9464.263077] [] ? 0xffffffffa01cc000 [ 9464.263089] [] dvb_init+0x25/0x27 [cx88_dvb] [ 9464.263101] [] do_one_initcall+0x84/0x1c0 [ 9464.263113] [] ? __vunmap+0x9a/0x100 [ 9464.263125] [] load_module+0x1216/0x1790 [ 9464.263134] [] ? __symbol_put+0x70/0x70 [ 9464.263145] [] ? vfs_read+0x11c/0x170 [ 9464.263156] [] ? copy_module_from_fd.isra.53+0x119/0x170 [ 9464.263168] [] SyS_finit_module+0x76/0x80 [ 9464.263181] [] system_call_fastpath+0x16/0x1b [ 9464.263190] Code: 81 31 c0 e8 2e f6 e8 ff 48 83 c4 08 5b 5d eb de 66 0f 1f 44 00 00 55 48 89 e5 41 56 41 55 41 54 53 41 be ed ff ff ff 48 8b 47 70 <48> 8b 80 30 02 00 00 48 85 c0 74 58 4c 8b 68 08 4d 85 ed 74 4f [ 9464.263347] RIP [] acpi_i2c_install_space_handler+0x15/0xc0 [ 9464.263361] RSP [ 9464.263367] CR2: 0000000000000230 [ 9464.266919] ---[ end trace 57fd490bdb72e733 ]--- I traced this to a NULL i2c_adapter parent pointer when cx24123 creates its own i2c adapter. The acpi_i2c_install_space_handler function appeared in 3.17, so that's probably why this hasn't been seen before. Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab --- drivers/media/dvb-frontends/cx24123.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/media/dvb-frontends/cx24123.c b/drivers/media/dvb-frontends/cx24123.c index 72fb5838cae0..7975c6608e20 100644 --- a/drivers/media/dvb-frontends/cx24123.c +++ b/drivers/media/dvb-frontends/cx24123.c @@ -1095,6 +1095,7 @@ struct dvb_frontend *cx24123_attach(const struct cx24123_config *config, sizeof(state->tuner_i2c_adapter.name)); state->tuner_i2c_adapter.algo = &cx24123_tuner_i2c_algo; state->tuner_i2c_adapter.algo_data = NULL; + state->tuner_i2c_adapter.dev.parent = i2c->dev.parent; i2c_set_adapdata(&state->tuner_i2c_adapter, state); if (i2c_add_adapter(&state->tuner_i2c_adapter) < 0) { err("tuner i2c bus could not be initialized\n"); From 50394e7369d519ad0d732cb6913d2bbdf4213e2e Mon Sep 17 00:00:00 2001 From: Hans Verkuil Date: Sat, 20 Sep 2014 09:54:06 -0300 Subject: [PATCH 11/16] [media] cx2341x: fix kernel oops The v4l2_ctrl_config struct must be zeroed before passing it to v4l2_ctrl_new_custom(). This was always wrong, but with the recent v4l2-ctrls.c changes this is now much more likely to lead to a kernel bug. This is the only place where this struct wasn't initialized properly. Signed-off-by: Hans Verkuil Reported-by: Pridvorov Andrey Signed-off-by: Mauro Carvalho Chehab --- drivers/media/common/cx2341x.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/media/common/cx2341x.c b/drivers/media/common/cx2341x.c index 103ef6bad2e2..be763150b8aa 100644 --- a/drivers/media/common/cx2341x.c +++ b/drivers/media/common/cx2341x.c @@ -1490,6 +1490,7 @@ static struct v4l2_ctrl *cx2341x_ctrl_new_custom(struct v4l2_ctrl_handler *hdl, { struct v4l2_ctrl_config cfg; + memset(&cfg, 0, sizeof(cfg)); cx2341x_ctrl_fill(id, &cfg.name, &cfg.type, &min, &max, &step, &def, &cfg.flags); cfg.ops = &cx2341x_ops; cfg.id = id; From 58d75f4b1ce26324b4d809b18f94819843a98731 Mon Sep 17 00:00:00 2001 From: Hans Verkuil Date: Sat, 20 Sep 2014 16:16:35 -0300 Subject: [PATCH 12/16] [media] vb2: fix VBI/poll regression The recent conversion of saa7134 to vb2 unconvered a poll() bug that broke the teletext applications alevt and mtt. These applications expect that calling poll() without having called VIDIOC_STREAMON will cause poll() to return POLLERR. That did not happen in vb2. This patch fixes that behavior. It also fixes what should happen when poll() is called when STREAMON is called but no buffers have been queued. In that case poll() will also return POLLERR, but only for capture queues since output queues will always return POLLOUT anyway in that situation. This brings the vb2 behavior in line with the old videobuf behavior. Signed-off-by: Hans Verkuil Acked-by: Laurent Pinchart Signed-off-by: Mauro Carvalho Chehab --- drivers/media/v4l2-core/videobuf2-core.c | 17 ++++++++++++++--- include/media/videobuf2-core.h | 4 ++++ 2 files changed, 18 insertions(+), 3 deletions(-) diff --git a/drivers/media/v4l2-core/videobuf2-core.c b/drivers/media/v4l2-core/videobuf2-core.c index c2126d874549..25d3ae2188cb 100644 --- a/drivers/media/v4l2-core/videobuf2-core.c +++ b/drivers/media/v4l2-core/videobuf2-core.c @@ -971,6 +971,7 @@ static int __reqbufs(struct vb2_queue *q, struct v4l2_requestbuffers *req) * to the userspace. */ req->count = allocated_buffers; + q->waiting_for_buffers = !V4L2_TYPE_IS_OUTPUT(q->type); return 0; } @@ -1018,6 +1019,7 @@ static int __create_bufs(struct vb2_queue *q, struct v4l2_create_buffers *create memset(q->plane_sizes, 0, sizeof(q->plane_sizes)); memset(q->alloc_ctx, 0, sizeof(q->alloc_ctx)); q->memory = create->memory; + q->waiting_for_buffers = !V4L2_TYPE_IS_OUTPUT(q->type); } num_buffers = min(create->count, VIDEO_MAX_FRAME - q->num_buffers); @@ -1821,6 +1823,7 @@ static int vb2_internal_qbuf(struct vb2_queue *q, struct v4l2_buffer *b) */ list_add_tail(&vb->queued_entry, &q->queued_list); q->queued_count++; + q->waiting_for_buffers = false; vb->state = VB2_BUF_STATE_QUEUED; if (V4L2_TYPE_IS_OUTPUT(q->type)) { /* @@ -2287,6 +2290,7 @@ static int vb2_internal_streamoff(struct vb2_queue *q, enum v4l2_buf_type type) * their normal dequeued state. */ __vb2_queue_cancel(q); + q->waiting_for_buffers = !V4L2_TYPE_IS_OUTPUT(q->type); dprintk(3, "successful\n"); return 0; @@ -2605,10 +2609,17 @@ unsigned int vb2_poll(struct vb2_queue *q, struct file *file, poll_table *wait) } /* - * There is nothing to wait for if no buffer has been queued and the - * queue isn't streaming, or if the error flag is set. + * There is nothing to wait for if the queue isn't streaming, or if the + * error flag is set. */ - if ((list_empty(&q->queued_list) && !vb2_is_streaming(q)) || q->error) + if (!vb2_is_streaming(q) || q->error) + return res | POLLERR; + /* + * For compatibility with vb1: if QBUF hasn't been called yet, then + * return POLLERR as well. This only affects capture queues, output + * queues will always initialize waiting_for_buffers to false. + */ + if (q->waiting_for_buffers) return res | POLLERR; /* diff --git a/include/media/videobuf2-core.h b/include/media/videobuf2-core.h index 80fa7253e483..2fefcf491aa8 100644 --- a/include/media/videobuf2-core.h +++ b/include/media/videobuf2-core.h @@ -380,6 +380,9 @@ struct v4l2_fh; * @start_streaming_called: start_streaming() was called successfully and we * started streaming. * @error: a fatal error occurred on the queue + * @waiting_for_buffers: used in poll() to check if vb2 is still waiting for + * buffers. Only set for capture queues if qbuf has not yet been + * called since poll() needs to return POLLERR in that situation. * @fileio: file io emulator internal data, used only if emulator is active * @threadio: thread io internal data, used only if thread is active */ @@ -417,6 +420,7 @@ struct vb2_queue { unsigned int streaming:1; unsigned int start_streaming_called:1; unsigned int error:1; + unsigned int waiting_for_buffers:1; struct vb2_fileio_data *fileio; struct vb2_threadio_data *threadio; From acf92046a0a666051f9c6b4a53d874c618203173 Mon Sep 17 00:00:00 2001 From: Hans Verkuil Date: Sat, 20 Sep 2014 16:16:36 -0300 Subject: [PATCH 13/16] [media] DocBook media: fix the poll() 'no QBUF' documentation Clarify what poll() returns if STREAMON was called but not QBUF. Make explicit the different behavior for this scenario for capture and output devices. Signed-off-by: Hans Verkuil Acked-by: Laurent Pinchart Signed-off-by: Mauro Carvalho Chehab --- Documentation/DocBook/media/v4l/func-poll.xml | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/Documentation/DocBook/media/v4l/func-poll.xml b/Documentation/DocBook/media/v4l/func-poll.xml index 85cad8bff5ba..bd07104a35e9 100644 --- a/Documentation/DocBook/media/v4l/func-poll.xml +++ b/Documentation/DocBook/media/v4l/func-poll.xml @@ -44,10 +44,18 @@ Capture devices set the POLLIN and flags. When the function timed out it returns a value of zero, on failure it returns -1 and the errno variable is set appropriately. When the -application did not call &VIDIOC-QBUF; or &VIDIOC-STREAMON; yet the +application did not call &VIDIOC-STREAMON; the poll() function succeeds, but sets the POLLERR flag in the -revents field. +revents field. When the +application has called &VIDIOC-STREAMON; for a capture device but hasn't +yet called &VIDIOC-QBUF;, the poll() function +succeeds and sets the POLLERR flag in the +revents field. For output devices this +same situation will cause poll() to succeed +as well, but it sets the POLLOUT and +POLLWRNORM flags in the revents +field. When use of the read() function has been negotiated and the driver does not capture yet, the From 91235537bc4b53f0b6f953acf963bcbb6215c49c Mon Sep 17 00:00:00 2001 From: Hans Verkuil Date: Sat, 20 Sep 2014 16:16:37 -0300 Subject: [PATCH 14/16] [media] DocBook media: improve the poll() documentation The poll documentation was incomplete: document how events (POLLPRI) are handled and fix the documentation of what poll does for display devices and streaming I/O. Signed-off-by: Hans Verkuil Acked-by: Laurent Pinchart Signed-off-by: Mauro Carvalho Chehab --- Documentation/DocBook/media/v4l/func-poll.xml | 23 +++++++++++++++---- 1 file changed, 19 insertions(+), 4 deletions(-) diff --git a/Documentation/DocBook/media/v4l/func-poll.xml b/Documentation/DocBook/media/v4l/func-poll.xml index bd07104a35e9..4c73f115219b 100644 --- a/Documentation/DocBook/media/v4l/func-poll.xml +++ b/Documentation/DocBook/media/v4l/func-poll.xml @@ -29,9 +29,12 @@ can suspend execution until the driver has captured data or is ready to accept data for output. When streaming I/O has been negotiated this function waits -until a buffer has been filled or displayed and can be dequeued with -the &VIDIOC-DQBUF; ioctl. When buffers are already in the outgoing -queue of the driver the function returns immediately. +until a buffer has been filled by the capture device and can be dequeued +with the &VIDIOC-DQBUF; ioctl. For output devices this function waits +until the device is ready to accept a new buffer to be queued up with +the &VIDIOC-QBUF; ioctl for display. When buffers are already in the outgoing +queue of the driver (capture) or the incoming queue isn't full (display) +the function returns immediately. On success poll() returns the number of file descriptors that have been selected (that is, file descriptors @@ -57,6 +60,10 @@ as well, but it sets the POLLOUT and POLLWRNORM flags in the revents field. + If an event occurred (see &VIDIOC-DQEVENT;) then +POLLPRI will be set in the revents +field and poll() will return. + When use of the read() function has been negotiated and the driver does not capture yet, the poll function starts capturing. When that fails @@ -66,10 +73,18 @@ continuously (as opposed to, for example, still images) the function may return immediately. When use of the write() function has -been negotiated the poll function just waits +been negotiated and the driver does not stream yet, the +poll function starts streaming. When that fails +it returns a POLLERR as above. Otherwise it waits until the driver is ready for a non-blocking write() call. + If the caller is only interested in events (just +POLLPRI is set in the events +field), then poll() will not +start streaming if the driver does not stream yet. This makes it +possible to just poll for events and not for buffers. + All drivers implementing the read() or write() function or streaming I/O must also support the poll() function. From c7854c2c5d692a329b4d9a9a73bcf36ae137ee7c Mon Sep 17 00:00:00 2001 From: Mauro Carvalho Chehab Date: Fri, 19 Sep 2014 13:02:12 -0300 Subject: [PATCH 15/16] [media] em28xx: fix VBI handling logic When both VBI and video are streaming, and video stream is stopped, a subsequent trial to restart it will fail, because S_FMT will return -EBUSY. That prevents applications like zvbi to work properly. Please notice that, while this fix it fully for zvbi, the best is to get rid of streaming_users and res_get logic as a hole. However, this single-line patch is better to be merged at -stable. Cc: stable@vger.kernel.org Signed-off-by: Mauro Carvalho Chehab --- drivers/media/usb/em28xx/em28xx-video.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/media/usb/em28xx/em28xx-video.c b/drivers/media/usb/em28xx/em28xx-video.c index 90dec2955f1c..41339259f30c 100644 --- a/drivers/media/usb/em28xx/em28xx-video.c +++ b/drivers/media/usb/em28xx/em28xx-video.c @@ -1342,7 +1342,7 @@ static int vidioc_s_fmt_vid_cap(struct file *file, void *priv, struct em28xx *dev = video_drvdata(file); struct em28xx_v4l2 *v4l2 = dev->v4l2; - if (v4l2->streaming_users > 0) + if (vb2_is_busy(&v4l2->vb_vidq)) return -EBUSY; vidioc_try_fmt_vid_cap(file, priv, f); From 8e2c8717c1812628b5538c05250057b37c66fdbe Mon Sep 17 00:00:00 2001 From: Frank Schaefer Date: Thu, 18 Sep 2014 17:55:45 -0300 Subject: [PATCH 16/16] [media] em28xx-v4l: get rid of field "users" in struct em28xx_v4l2" MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This reverts commit 747dba7de2a51a3db58b665ed3bc8c07921546ec. It breaks concurrent vbi and video capturing: While v4l2->users is the number of users of the whole device (all device nodes), v4l2_fh_is_singular() only checks the number of users of a specific device node. As a result. if one device node is open and a second device node is opened (closed), the device is reinitialized (streaming is stopped). Reported-by: Hans Verkuil Tested-by: Mauro Carvalho Chehab Signed-off-by: Frank Schäfer Cc: stable@vger.kernel.org Signed-off-by: Mauro Carvalho Chehab --- drivers/media/usb/em28xx/em28xx-video.c | 23 ++++++++++------------- drivers/media/usb/em28xx/em28xx.h | 1 + 2 files changed, 11 insertions(+), 13 deletions(-) diff --git a/drivers/media/usb/em28xx/em28xx-video.c b/drivers/media/usb/em28xx/em28xx-video.c index 41339259f30c..29abc379551e 100644 --- a/drivers/media/usb/em28xx/em28xx-video.c +++ b/drivers/media/usb/em28xx/em28xx-video.c @@ -1883,8 +1883,9 @@ static int em28xx_v4l2_open(struct file *filp) return -EINVAL; } - em28xx_videodbg("open dev=%s type=%s\n", - video_device_node_name(vdev), v4l2_type_names[fh_type]); + em28xx_videodbg("open dev=%s type=%s users=%d\n", + video_device_node_name(vdev), v4l2_type_names[fh_type], + v4l2->users); if (mutex_lock_interruptible(&dev->lock)) return -ERESTARTSYS; @@ -1897,9 +1898,7 @@ static int em28xx_v4l2_open(struct file *filp) return ret; } - if (v4l2_fh_is_singular_file(filp)) { - em28xx_videodbg("first opened filehandle, initializing device\n"); - + if (v4l2->users == 0) { em28xx_set_mode(dev, EM28XX_ANALOG_MODE); if (vdev->vfl_type != VFL_TYPE_RADIO) @@ -1910,8 +1909,6 @@ static int em28xx_v4l2_open(struct file *filp) * of some i2c devices */ em28xx_wake_i2c(dev); - } else { - em28xx_videodbg("further filehandles are already opened\n"); } if (vdev->vfl_type == VFL_TYPE_RADIO) { @@ -1921,6 +1918,7 @@ static int em28xx_v4l2_open(struct file *filp) kref_get(&dev->ref); kref_get(&v4l2->ref); + v4l2->users++; mutex_unlock(&dev->lock); @@ -2027,11 +2025,12 @@ static int em28xx_v4l2_close(struct file *filp) struct em28xx_v4l2 *v4l2 = dev->v4l2; int errCode; + em28xx_videodbg("users=%d\n", v4l2->users); + + vb2_fop_release(filp); mutex_lock(&dev->lock); - if (v4l2_fh_is_singular_file(filp)) { - em28xx_videodbg("last opened filehandle, shutting down device\n"); - + if (v4l2->users == 1) { /* No sense to try to write to the device */ if (dev->disconnected) goto exit; @@ -2050,12 +2049,10 @@ static int em28xx_v4l2_close(struct file *filp) em28xx_errdev("cannot change alternate number to " "0 (error=%i)\n", errCode); } - } else { - em28xx_videodbg("further opened filehandles left\n"); } exit: - vb2_fop_release(filp); + v4l2->users--; kref_put(&v4l2->ref, em28xx_free_v4l2); mutex_unlock(&dev->lock); kref_put(&dev->ref, em28xx_free_device); diff --git a/drivers/media/usb/em28xx/em28xx.h b/drivers/media/usb/em28xx/em28xx.h index 84ef8efdb148..4360338e7b31 100644 --- a/drivers/media/usb/em28xx/em28xx.h +++ b/drivers/media/usb/em28xx/em28xx.h @@ -524,6 +524,7 @@ struct em28xx_v4l2 { int sensor_yres; int sensor_xtal; + int users; /* user count for exclusive use */ int streaming_users; /* number of actively streaming users */ u32 frequency; /* selected tuner frequency */