linux-kernel - [PATCH 2/2] media: verisilicon: Avoid G2 bus error while decoding H.264 and HEVC

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20251121081911.1682-2-ming.qian@oss.nxp.com>
Date: Fri, 21 Nov 2025 16:19:09 +0800
From: ming.qian@....nxp.com
To: linux-media@...r.kernel.org
Cc: mchehab@...nel.org,
	hverkuil-cisco@...all.nl,
	nicolas@...fresne.ca,
	benjamin.gaignard@...labora.com,
	p.zabel@...gutronix.de,
	sebastian.fricke@...labora.com,
	shawnguo@...nel.org,
	ulf.hansson@...aro.org,
	s.hauer@...gutronix.de,
	kernel@...gutronix.de,
	festevam@...il.com,
	linux-imx@....com,
	l.stach@...gutronix.de,
	peng.fan@....com,
	eagle.zhou@....com,
	imx@...ts.linux.dev,
	linux-pm@...r.kernel.org,
	linux-kernel@...r.kernel.org,
	linux-arm-kernel@...ts.infradead.org
Subject: [PATCH 2/2] media: verisilicon: Avoid G2 bus error while decoding H.264 and HEVC

From: Ming Qian <ming.qian@....nxp.com>

For the i.MX8MQ platform, there is a hardware limitation: the g1 VPU and
g2 VPU cannot decode simultaneously; otherwise, it will cause below bus
error and produce corrupted pictures, even led to system hang.

[  110.527986] hantro-vpu 38310000.video-codec: frame decode timed out.
[  110.583517] hantro-vpu 38310000.video-codec: bus error detected.

Therefore, it is necessary to ensure that g1 and g2 operate alternately.
Then this allows for successful multi-instance decoding of H.264 and HEVC.

Fixes: cb5dd5a0fa518 ("media: hantro: Introduce G2/HEVC decoder")
Signed-off-by: Ming Qian <ming.qian@....nxp.com>
---
 drivers/media/platform/verisilicon/hantro.h   |  1 +
 .../media/platform/verisilicon/hantro_drv.c   | 26 +++++++++++++++++++
 .../media/platform/verisilicon/imx8m_vpu_hw.c |  4 +++
 3 files changed, 31 insertions(+)

diff --git a/drivers/media/platform/verisilicon/hantro.h b/drivers/media/platform/verisilicon/hantro.h
index e0fdc4535b2d..8baebf767d26 100644
--- a/drivers/media/platform/verisilicon/hantro.h
+++ b/drivers/media/platform/verisilicon/hantro.h
@@ -101,6 +101,7 @@ struct hantro_variant {
 	unsigned int double_buffer : 1;
 	unsigned int legacy_regs : 1;
 	unsigned int late_postproc : 1;
+	atomic_t *shared_resource;
 };
 
 /**
diff --git a/drivers/media/platform/verisilicon/hantro_drv.c b/drivers/media/platform/verisilicon/hantro_drv.c
index 60b95b5d8565..036ce43c9359 100644
--- a/drivers/media/platform/verisilicon/hantro_drv.c
+++ b/drivers/media/platform/verisilicon/hantro_drv.c
@@ -19,6 +19,7 @@
 #include <linux/slab.h>
 #include <linux/videodev2.h>
 #include <linux/workqueue.h>
+#include <linux/iopoll.h>
 #include <media/v4l2-event.h>
 #include <media/v4l2-mem2mem.h>
 #include <media/videobuf2-core.h>
@@ -93,6 +94,9 @@ static void hantro_job_finish(struct hantro_dev *vpu,
 
 	clk_bulk_disable(vpu->variant->num_clocks, vpu->clocks);
 
+	if (vpu->variant->shared_resource)
+		atomic_cmpxchg(vpu->variant->shared_resource, 0, 1);
+
 	hantro_job_finish_no_pm(vpu, ctx, result);
 }
 
@@ -166,12 +170,34 @@ void hantro_end_prepare_run(struct hantro_ctx *ctx)
 			      msecs_to_jiffies(2000));
 }
 
+static int hantro_wait_shared_resource(struct hantro_dev *vpu)
+{
+	u32 data;
+	int ret;
+
+	if (!vpu->variant->shared_resource)
+		return 0;
+
+	ret = read_poll_timeout(atomic_cmpxchg, data, data, 10, 300 * NSEC_PER_MSEC, false,
+				vpu->variant->shared_resource, 1, 0);
+	if (ret) {
+		dev_err(vpu->dev, "Failed to wait shared resource\n");
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
 static void device_run(void *priv)
 {
 	struct hantro_ctx *ctx = priv;
 	struct vb2_v4l2_buffer *src, *dst;
 	int ret;
 
+	ret = hantro_wait_shared_resource(ctx->dev);
+	if (ret < 0)
+		goto err_cancel_job;
+
 	src = hantro_get_src_buf(ctx);
 	dst = hantro_get_dst_buf(ctx);
 
diff --git a/drivers/media/platform/verisilicon/imx8m_vpu_hw.c b/drivers/media/platform/verisilicon/imx8m_vpu_hw.c
index 5be0e2e76882..1b3a0bfbf890 100644
--- a/drivers/media/platform/verisilicon/imx8m_vpu_hw.c
+++ b/drivers/media/platform/verisilicon/imx8m_vpu_hw.c
@@ -324,6 +324,8 @@ static const char * const imx8mq_reg_names[] = { "g1", "g2", "ctrl" };
 static const char * const imx8mq_g1_clk_names[] = { "g1" };
 static const char * const imx8mq_g2_clk_names[] = { "g2" };
 
+static atomic_t imx8mq_shared_resource = ATOMIC_INIT(1);
+
 const struct hantro_variant imx8mq_vpu_variant = {
 	.dec_fmts = imx8m_vpu_dec_fmts,
 	.num_dec_fmts = ARRAY_SIZE(imx8m_vpu_dec_fmts),
@@ -356,6 +358,7 @@ const struct hantro_variant imx8mq_vpu_g1_variant = {
 	.num_irqs = ARRAY_SIZE(imx8mq_irqs),
 	.clk_names = imx8mq_g1_clk_names,
 	.num_clocks = ARRAY_SIZE(imx8mq_g1_clk_names),
+	.shared_resource = &imx8mq_shared_resource,
 };
 
 const struct hantro_variant imx8mq_vpu_g2_variant = {
@@ -371,6 +374,7 @@ const struct hantro_variant imx8mq_vpu_g2_variant = {
 	.num_irqs = ARRAY_SIZE(imx8mq_g2_irqs),
 	.clk_names = imx8mq_g2_clk_names,
 	.num_clocks = ARRAY_SIZE(imx8mq_g2_clk_names),
+	.shared_resource = &imx8mq_shared_resource,
 };
 
 const struct hantro_variant imx8mm_vpu_g1_variant = {
-- 
2.34.1