OOPS when powering off after 4 seconds. #1
Comments
|
The driver can be unloaded just fine with the latest version, so I'll close this for now. |
Miouyouyou
added a commit
that referenced
this issue
Sep 10, 2017
Not entirely sure though...
Still, the current issue with the IOMMU DMA API is due to an off-by-32
error... Basically the iova domain pointer is offseted by 32 bits...
Strange...
[ 82.253308] [init_iova_domain]
iovad : eb00e004
iovad->rb_root = (null)
iovad->cached32_node = (null)
iovad->granule = 4096
iovad->start_pfn = 65536
iovad->dma_32bit_pfn = 589823
[ 82.283533] iommu_dma_init_domain -> 0
[ 82.287728] rk-vcodec ff9a0000.vpu-service: allocator is drm
[ 82.294087] rk-vcodec ff9a0000.vpu-service: checking hw id 4831
[ 82.301062] rk-vcodec ff9a0000.vpu-service: init success
[ 104.157451] rk-vcodec ff9a0000.vpu-service: dev opened
[ 104.208467] rk-vcodec ff9a0000.vpu-service: ( Myy ) reg->reg[tbl[0]] → 21 (15)
[ 104.216743] ( Myy ) kzalloc(76, GFP_KERNEL) → ebe46480
[ 104.222688] ( Myy ) Still alive ♪
[ 104.226592] rk-vcodec ff9a0000.vpu-service: kzalloc(64, GFP_KERNEL) → eb146380
[ 104.235595] rk-vcodec ff9a0000.vpu-service: kzalloc(12, GFP_KERNEL) → eb146200
[ 104.243865] __alloc_and_insert_iova_range called !
[ 104.249233] [__alloc_and_insert_iova_range]
iovad : eb00e000
iovad->rb_root = ffffffff
iovad->cached32_node = (null)
iovad->granule = 0
iovad->start_pfn = 4096
iovad->dma_32bit_pfn = 65536
You can clearly see how everything gets offseted.
Since rb_root gets overwritten by a non NULL value, all the rb_*
functions flip the fuck out and the kernel crashes with
[ 104.478038] Unable to handle kernel NULL pointer dereference at virtual address 00000003
[ 104.487066] pgd = eb12c000
[ 104.490081] [00000003] *pgd=2bfc4835, *pte=00000000, *ppte=00000000
[ 104.497084] Internal error: Oops: 17 [#1] PREEMPT SMP ARM
[ 104.503110] Modules linked in: rk_vcodec(O) mali_kbase rk_crypto dw_hdmi_i2s_audio
[ 104.511574] CPU: 2 PID: 1726 Comm: mpp_dec_parser Tainted: G O 4.13.0-RockMyy-XIII #19
[ 104.521669] Hardware name: Rockchip (Device Tree)
[ 104.526918] task: ebdbe400 task.stack: ebf0c000
[ 104.531975] PC is at rb_last+0x10/0x24
[ 104.536148] LR is at alloc_iova+0xa0/0x1f4
[ 104.540718] pc : [<c0c202f4>] lr : [<c06c3cdc>] psr: a00f0093
[ 104.547715] sp : ebf0dcf0 ip : 00000007 fp : 00000001
[ 104.553547] r10: 00000000 r9 : 00000000 r8 : ffffffff
[ 104.559379] r7 : 00000000 r6 : ebd10c40 r5 : 00000000 r4 : eb00e000
[ 104.566667] r3 : 00010000 r2 : 00000000 r1 : 00000007 r0 : ffffffff
[ 104.573957] Flags: NzCv IRQs off FIQs on Mode SVC_32 ISA ARM Segment none
[ 104.582023] Control: 10c5387d Table: 2b12c06a DAC: 00000051
[ 104.588438] Process mpp_dec_parser (pid: 1726, stack limit = 0xebf0c218)
[ 104.595921] Stack: (0xebf0dcf0 to 0xebf0e000)
[ 104.600782] dce0: ffffffff 00000000 000000cc 600f0013
[ 104.609918] dd00: eb146200 ebe46480 ec927800 00000000 00000000 eb146380 eb146c00 ebe46480
[ 104.619045] dd20: 00000000 ffffffff eb00e000 00000000 00000000 bf0b5190 00000015 00000000
[ 104.628180] dd40: 00000000 bf0b97c0 eb146980 eb146280 00000003 ebe46490 eea89210 ebec6bcc
[ 104.637315] dd60: ebec6028 ebe58c40 00000000 bf0b4198 bf0b7e23 ecb3f400 ebd91718 ec99d600
[ 104.646450] dd80: bf0b6927 00000051 00000000 bf0b97c0 bf0b6928 bf0b0fa0 00000015 00000000
[ 104.655577] dda0: 00000000 00000000 00000194 00000000 ed919a18 ed919a18 00000015 00000000
[ 104.664712] ddc0: bf0b9464 00000000 0010fff0 ecb3f418 ecb3f420 ecb3f42c c12e1c48 00000000
[ 104.673846] dde0: 014bd3c0 00000002 00000010 00000014 c0f42847 bf0b6927 c12e14c0 00000002
[ 104.682981] de00: c12e14c0 c11a824d c11a8220 c01f8868 200f0013 ebea6400 ebea6434 ebea6400
[ 104.692116] de20: af300000 c0c2e6b8 c0f42847 c0f34b21 2de19000 00000002 c12e14c0 c11a8296
[ 104.701251] de40: c11a8288 c01f7b88 efd2da40 00000707 af300000 c0c2e6b8 69a52e37 c0204994
[ 104.710387] de60: eb13e580 ed823fb0 ee36133c eb13e580 ee361348 ed3db48c ed3db478 c0206e30
[ 104.719514] de80: 00000000 eb13e580 eb13e580 00000707 140440fb c0208070 eb13e580 140440fb
[ 104.728640] dea0: ebdf1000 b10acb64 ec99d600 ed919a18 bf0b97c0 ebd91718 00000051 00000000
[ 104.737775] dec0: 00000000 bf0b3074 c12fc5d8 00000000 00000000 ed3db478 ed3db48c 014bd3c0
[ 104.746910] dee0: 00000194 af16b000 000000fb ebdf1000 00195000 eb074be8 b10acb64 ed9ba000
[ 104.756045] df00: b10acb64 40046c03 00000011 00000000 00000000 c02345e0 00002000 c0234e40
[ 104.765180] df20: ebea6444 00000003 00000001 00195000 00000000 ebdf1000 00000000 c01f7254
[ 104.774307] df40: 00000001 00000000 000111db ebf0df5c ebf0df60 00000001 00000001 00000000
[ 104.783442] df60: ed9ba000 00000000 ed9ba000 ed9ba001 b10acb64 40046c03 00000011 00000000
[ 104.792569] df80: 00000000 c0234f98 b10acb64 b6976000 beaa40b8 beaa4052 00000036 c0107064
[ 104.801705] dfa0: ebf0c000 c0106ea0 b6976000 beaa40b8 00000011 40046c03 b10acb64 b10acb64
[ 104.810831] dfc0: b6976000 beaa40b8 beaa4052 00000036 00000000 beaa40b8 b58d6120 00000000
[ 104.819966] dfe0: b697640c b10acb3c b6932485 b6409a86 000f0030 00000011 00000000 00000000
[ 104.829102] [<c0c202f4>] (rb_last) from [<c06c3cdc>] (alloc_iova+0xa0/0x1f4)
[ 104.836980] [<c06c3cdc>] (alloc_iova) from [<bf0b5190>] (vcodec_drm_import+0x32c/0x73c [rk_vcodec])
[ 104.847093] [<bf0b5190>] (vcodec_drm_import [rk_vcodec]) from [<bf0b0fa0>] (reg_init+0x490/0xa2c [rk_vcodec])
[ 104.858176] [<bf0b0fa0>] (reg_init [rk_vcodec]) from [<bf0b3074>] (vpu_service_ioctl+0x408/0x720 [rk_vcodec])
[ 104.869258] [<bf0b3074>] (vpu_service_ioctl [rk_vcodec]) from [<c02345e0>] (vfs_ioctl+0x20/0x34)
[ 104.879074] [<c02345e0>] (vfs_ioctl) from [<c0234e40>] (do_vfs_ioctl+0x72c/0x838)
[ 104.887433] [<c0234e40>] (do_vfs_ioctl) from [<c0234f98>] (SyS_ioctl+0x4c/0x74)
[ 104.895598] [<c0234f98>] (SyS_ioctl) from [<c0106ea0>] (ret_fast_syscall+0x0/0x3c)
[ 104.904045] Code: e5900000 e3500000 1a000000 e12fff1e (e5903004)
[ 104.910849] ---[ end trace 8d80f6ca54c89263 ]---
So... Let's see why this get offseted. May be we'll enjoy a
nice movie tonight !
Signed-off-by: Myy <myy@miouyouyou.fr>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
When trying the IOCTL tests, the VPU will power off after 4 seconds, through a kernel thread, and generate a OOPS. Subsequent tests will result in zombies processes.
The dmesg trace:
The text was updated successfully, but these errors were encountered: