Symptom:
  Internal error: synchronous external abort: 0000000096000010 [#1] PREEMPT SMP
  Modules linked in: wave5 rpmsg_ctrl rpmsg_char ...
  CPU: 0 UID: 0 PID: 1520 Comm: vpu_irq_thread Tainted: G   M    W
  pc : wave5_vdi_read_register+0x10/0x38 [wave5]
  lr : wave5_vpu_irq_work_fn+0x28/0x60 [wave5]

  Call trace:
   wave5_vdi_read_register+0x10/0x38 [wave5]
   kthread_worker_fn+0xd8/0x238
   kthread+0x104/0x120
   ret_from_fork+0x10/0x20
  Code: aa1e03e9 d503201f f9416800 8b214000 (b9400000)
  ---[ end trace 0000000000000000 ]---
  Kernel panic - not syncing: synchronous external abort: Fatal exception

Root cause:
  In polling mode, the hrtimer periodically triggers wave5_vpu_timer_callback()
  which queues work to the kthread worker. The worker executes
  wave5_vpu_irq_work_fn() which reads hardware registers via
  wave5_vdi_read_register().

  The original cleanup order was:
  1) Disable PM runtime and power down hardware
  2) Unregister video devices

  When autosuspend triggered after 5 seconds of inactivity, the hardware
  was powered off. However, video devices were still registered and the
  worker thread could still be triggered by the hrtimer, causing it to
  attempt reading registers from powered-off hardware. This results in
  a bus error (synchronous external abort) and kernel panic.

Fix:
  Move video device unregistration (wave5_vpu_enc_unregister_device,
  wave5_vpu_dec_unregister_device, v4l2_device_unregister) to the beginning
  of wave5_vpu_remove(), before worker cleanup and PM runtime disable.

  This ensures video operations stop before any hardware access mechanisms
  are cleaned up, following the pattern used by other V4L2 drivers (pisp_be, 
rga).

Signed-off-by: Xulin Sun <[email protected]>
---
 drivers/media/platform/chips-media/wave5/wave5-vpu.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/media/platform/chips-media/wave5/wave5-vpu.c 
b/drivers/media/platform/chips-media/wave5/wave5-vpu.c
index 17d36edba51f..131a1c7a3e97 100644
--- a/drivers/media/platform/chips-media/wave5/wave5-vpu.c
+++ b/drivers/media/platform/chips-media/wave5/wave5-vpu.c
@@ -355,6 +355,10 @@ static void wave5_vpu_remove(struct platform_device *pdev)
 {
        struct vpu_device *dev = dev_get_drvdata(&pdev->dev);
 
+       wave5_vpu_enc_unregister_device(dev);
+       wave5_vpu_dec_unregister_device(dev);
+       v4l2_device_unregister(&dev->v4l2_dev);
+
        if (dev->irq < 0) {
                hrtimer_cancel(&dev->hrtimer);
                kthread_cancel_work_sync(&dev->work);
@@ -368,9 +372,6 @@ static void wave5_vpu_remove(struct platform_device *pdev)
        mutex_destroy(&dev->hw_lock);
        reset_control_assert(dev->resets);
        clk_bulk_disable_unprepare(dev->num_clks, dev->clks);
-       wave5_vpu_enc_unregister_device(dev);
-       wave5_vpu_dec_unregister_device(dev);
-       v4l2_device_unregister(&dev->v4l2_dev);
        wave5_vdi_release(&pdev->dev);
        ida_destroy(&dev->inst_ida);
 }
-- 
2.49.1

-=-=-=-=-=-=-=-=-=-=-=-
Links: You receive all messages sent to this group.
View/Reply Online (#16021): 
https://lists.yoctoproject.org/g/linux-yocto/message/16021
Mute This Topic: https://lists.yoctoproject.org/mt/116495601/21656
Group Owner: [email protected]
Unsubscribe: https://lists.yoctoproject.org/g/linux-yocto/unsub 
[[email protected]]
-=-=-=-=-=-=-=-=-=-=-=-

Reply via email to