Skip to content

Commit d497c54

Browse files
lumaglumag
authored
linux-yocto-dev: import patches fixing venus probe crashes (#932)
Backport and add fromlist patches required to fix venus probe crashes on rb3gen2, which happens quite often on boot and locks up the kernel completely on reboots.
2 parents acdedcf + 751520d commit d497c54

File tree

4 files changed

+163
-0
lines changed

4 files changed

+163
-0
lines changed

‎recipes-kernel/linux/linux-yocto-dev.bbappend‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,9 @@ SRC_URI:append:qcom = " \
2525
file://workarounds/0001-scsi-ufs-qcom-Check-gear-against-max-gear-in-vop-fre.patch \
2626
file://workarounds/0002-scsi-ufs-qcom-Map-devfreq-OPP-freq-to-UniPro-Core-Cl.patch \
2727
file://workarounds/0003-scsi-ufs-qcom-Call-ufs_qcom_cfg_timers-in-clock-scal.patch \
28+
file://workarounds/0001-media-venus-protect-against-spurious-interrupts-duri.patch \
29+
file://workarounds/0001-media-venus-hfi-explicitly-release-IRQ-during-teardo.patch \
30+
file://workarounds/0001-media-venus-Fix-probe-error-handling.patch \
2831
file://drivers/0003-PCI-Add-new-start_link-stop_link-function-ops.patch \
2932
file://drivers/0004-PCI-dwc-Add-host_start_link-host_start_link-hooks-fo.patch \
3033
file://drivers/0005-PCI-dwc-Implement-.start_link-.stop_link-hooks.patch \

‎recipes-kernel/linux/linux-yocto-dev/workarounds/0001-media-venus-Fix-probe-error-handling.patch‎

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
From 31f91817a35ddbc2f57327ec8ab9ac0039bf50a7 Mon Sep 17 00:00:00 2001
2+
From: Loic Poulain <[email protected]>
3+
Date: Thu, 27 Mar 2025 13:53:04 +0100
4+
Subject: [PATCH] media: venus: Fix probe error handling
5+
6+
Video device registering has been moved earlier in the probe function,
7+
but the new order has not been propagated to error handling. This means
8+
we can end with unreleased resources on error (e.g dangling video device
9+
on missing firmware probe aborting).
10+
11+
Fixes: 08b1cf474b7f7 ("media: venus: core, venc, vdec: Fix probe dependency error")
12+
Cc: [email protected]
13+
Signed-off-by: Loic Poulain <[email protected]>
14+
Reviewed-by: Dikshita Agarwal <[email protected]>
15+
Reviewed-by: Bryan O'Donoghue <[email protected]>
16+
Signed-off-by: Bryan O'Donoghue <[email protected]>
17+
Signed-off-by: Hans Verkuil <[email protected]>
18+
Upstream-Status: Backport [https://git.kernel.org/torvalds/linux/c/523cea3a19f0]
19+
---
20+
drivers/media/platform/qcom/venus/core.c | 16 ++++++++--------
21+
1 file changed, 8 insertions(+), 8 deletions(-)
22+
23+
diff --git a/drivers/media/platform/qcom/venus/core.c b/drivers/media/platform/qcom/venus/core.c
24+
index 04641a7dcc9832..5bd99d0aafe4d7 100644
25+
--- a/drivers/media/platform/qcom/venus/core.c
26+
+++ b/drivers/media/platform/qcom/venus/core.c
27+
@@ -438,7 +438,7 @@ static int venus_probe(struct platform_device *pdev)
28+
29+
ret = v4l2_device_register(dev, &core->v4l2_dev);
30+
if (ret)
31+
- goto err_core_deinit;
32+
+ goto err_hfi_destroy;
33+
34+
platform_set_drvdata(pdev, core);
35+
36+
@@ -476,24 +476,24 @@ static int venus_probe(struct platform_device *pdev)
37+
38+
ret = venus_enumerate_codecs(core, VIDC_SESSION_TYPE_DEC);
39+
if (ret)
40+
- goto err_venus_shutdown;
41+
+ goto err_core_deinit;
42+
43+
ret = venus_enumerate_codecs(core, VIDC_SESSION_TYPE_ENC);
44+
if (ret)
45+
- goto err_venus_shutdown;
46+
+ goto err_core_deinit;
47+
48+
ret = pm_runtime_put_sync(dev);
49+
if (ret) {
50+
pm_runtime_get_noresume(dev);
51+
- goto err_dev_unregister;
52+
+ goto err_core_deinit;
53+
}
54+
55+
venus_dbgfs_init(core);
56+
57+
return 0;
58+
59+
-err_dev_unregister:
60+
- v4l2_device_unregister(&core->v4l2_dev);
61+
+err_core_deinit:
62+
+ hfi_core_deinit(core, false);
63+
err_venus_shutdown:
64+
venus_shutdown(core);
65+
err_firmware_deinit:
66+
@@ -506,9 +506,9 @@ static int venus_probe(struct platform_device *pdev)
67+
pm_runtime_put_noidle(dev);
68+
pm_runtime_disable(dev);
69+
pm_runtime_set_suspended(dev);
70+
+ v4l2_device_unregister(&core->v4l2_dev);
71+
+err_hfi_destroy:
72+
hfi_destroy(core);
73+
-err_core_deinit:
74+
- hfi_core_deinit(core, false);
75+
err_core_put:
76+
if (core->pm_ops->core_put)
77+
core->pm_ops->core_put(core);
78+
--
79+
2.49.0
80+

‎recipes-kernel/linux/linux-yocto-dev/workarounds/0001-media-venus-hfi-explicitly-release-IRQ-during-teardo.patch‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
From 88872ed483b2d0578623320d99e78e7c360f1d8e Mon Sep 17 00:00:00 2001
2+
From: Jorge Ramirez-Ortiz <[email protected]>
3+
Date: Thu, 12 Jun 2025 10:29:43 +0200
4+
Subject: [PATCH] media: venus: hfi: explicitly release IRQ during teardown
5+
6+
Ensure the IRQ is released before dismantling the ISR handler and
7+
clearing related pointers.
8+
9+
This prevents any possibility of the interrupt triggering after the
10+
handler context has been invalidated.
11+
12+
Fixes: d96d3f30c0f2 ("[media] media: venus: hfi: add Venus HFI files")
13+
Signed-off-by: Jorge Ramirez-Ortiz <[email protected]>
14+
Upstream-Status: Submitted [https://lore.kernel.org/linux-media/[email protected]/]
15+
---
16+
drivers/media/platform/qcom/venus/hfi_venus.c | 1 +
17+
1 file changed, 1 insertion(+)
18+
19+
diff --git a/drivers/media/platform/qcom/venus/hfi_venus.c b/drivers/media/platform/qcom/venus/hfi_venus.c
20+
index b5f2ea8799507f..d9d62d965bcf02 100644
21+
--- a/drivers/media/platform/qcom/venus/hfi_venus.c
22+
+++ b/drivers/media/platform/qcom/venus/hfi_venus.c
23+
@@ -1678,6 +1678,7 @@ void venus_hfi_destroy(struct venus_core *core)
24+
venus_interface_queues_release(hdev);
25+
mutex_destroy(&hdev->lock);
26+
kfree(hdev);
27+
+ devm_free_irq(core->dev, core->irq, core);
28+
core->ops = NULL;
29+
}
30+
31+
--
32+
2.49.0
33+

‎recipes-kernel/linux/linux-yocto-dev/workarounds/0001-media-venus-protect-against-spurious-interrupts-duri.patch‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
From 9c5677b7e2ccae47ba3b588556fe6099cff9223a Mon Sep 17 00:00:00 2001
2+
From: Jorge Ramirez-Ortiz <[email protected]>
3+
Date: Fri, 6 Jun 2025 17:25:22 +0200
4+
Subject: [PATCH] media: venus: protect against spurious interrupts during
5+
probe
6+
7+
Make sure the interrupt handler is initialized before the interrupt is
8+
registered.
9+
10+
If the IRQ is registered before hfi_create(), it's possible that an
11+
interrupt fires before the handler setup is complete, leading to a NULL
12+
dereference.
13+
14+
This error condition has been observed during system boot on Rb3Gen2.
15+
16+
Fixes: af2c3834c8ca ("[media] media: venus: adding core part and helper functions")
17+
Signed-off-by: Jorge Ramirez-Ortiz <[email protected]>
18+
Upstream-Status: Submitted [https://lore.kernel.org/all/[email protected]/]
19+
---
20+
drivers/media/platform/qcom/venus/core.c | 8 ++++----
21+
1 file changed, 4 insertions(+), 4 deletions(-)
22+
23+
diff --git a/drivers/media/platform/qcom/venus/core.c b/drivers/media/platform/qcom/venus/core.c
24+
index 77d48578ecd288..04641a7dcc9832 100644
25+
--- a/drivers/media/platform/qcom/venus/core.c
26+
+++ b/drivers/media/platform/qcom/venus/core.c
27+
@@ -424,13 +424,13 @@ static int venus_probe(struct platform_device *pdev)
28+
INIT_DELAYED_WORK(&core->work, venus_sys_error_handler);
29+
init_waitqueue_head(&core->sys_err_done);
30+
31+
- ret = devm_request_threaded_irq(dev, core->irq, hfi_isr, venus_isr_thread,
32+
- IRQF_TRIGGER_HIGH | IRQF_ONESHOT,
33+
- "venus", core);
34+
+ ret = hfi_create(core, &venus_core_ops);
35+
if (ret)
36+
goto err_core_put;
37+
38+
- ret = hfi_create(core, &venus_core_ops);
39+
+ ret = devm_request_threaded_irq(dev, core->irq, hfi_isr, venus_isr_thread,
40+
+ IRQF_TRIGGER_HIGH | IRQF_ONESHOT,
41+
+ "venus", core);
42+
if (ret)
43+
goto err_core_put;
44+
45+
--
46+
2.49.0
47+

0 commit comments

Comments
 (0)