I've been debugging a kernel crash while working on a 60fps VGA CMOS
sensor video application. For some reason I only see the problem when I
crank up the frame rate, when the sensor is running at 30fps I never see
the crash.
The issue is that for a progressive input the VPFE uses vdint1_isr
callback. This isr basically just manages dma queue lists - and it makes
an assumption that it is ok to delete one of the lists without checking
to make sure that it exists. This causes a big bad crash because an
empty list pointer is set to an unmapped constant.
The fix is to check for the POISON values in the list before it deletes
it. Here is the new routine (Happy Thanksgiving!):
dm355_vpfe.c
static irqreturn_t vdint1_isr(int irq, void *dev_id, struct pt_regs *regs)
{
vpfe_obj *vpfe = &vpfe_device;
dev_dbg(vpfe_dev, "\nInside vdint1_isr...");
if (frm_format == CCDC_FRMFMT_PROGRESSIVE) {
if (!list_empty(&vpfe->dma_queue)
&& vpfe->curFrm == vpfe->nextFrm) {
vpfe->nextFrm =
list_entry(vpfe->dma_queue.next,
struct videobuf_buffer, queue);
/* there is a bug somewhere that deletes the queue
* but this interrupt is called afterwards
* deleting a list twice is very very bad - and the
* kernel crashes with a bad pointer exception
*/
if (vpfe->nextFrm->queue.prev == LIST_POISON2) {
printk("VPFE - bad queue.prev entry!\n");
return IRQ_RETVAL(0);
}
if (vpfe->nextFrm->queue.next == LIST_POISON1){
printk("VPFE - bad queue.next entry!\n");
return IRQ_RETVAL(0);
}
list_del(&vpfe->nextFrm->queue);
vpfe->nextFrm->state = STATE_ACTIVE;
ccdc_setfbaddr((unsigned long)vpfe->nextFrm->boff);
}
}
return IRQ_RETVAL(1);
}
_______________________________________________
Davinci-linux-open-source mailing list
[email protected]
http://linux.davincidsp.com/mailman/listinfo/davinci-linux-open-source
