timmlib: encoder: KW fixes for critical and error scenarios

This patch fixes KW critical and error issues from encoder
driver.

Signed-off-by: Sunita Nadampalli <sunitan@ti.com>

5 files changed, 49 insertions, 35 deletions

diff --git a/driver/encoder/mtx_fwif.c b/driver/encoder/mtx_fwif.c
index 9904519..24f11b6 100644
--- a/driver/encoder/mtx_fwif.c
+++ b/driver/encoder/mtx_fwif.c
@@ -819,6 +819,9 @@ int32 mtx_populate_fw_ctx(enum img_codec codec, struct img_fw_context * fw_ctx)
 
         IMG_DBG_ASSERT(fw_ctx->hw_num_pipes > 0 && fw_ctx->hw_num_pipes <= TOPAZHP_MAX_NUM_PIPES);
 
+        if (fw_ctx->hw_num_pipes <= 0 || fw_ctx->hw_num_pipes > TOPAZHP_MAX_NUM_PIPES)
+                return IMG_ERROR_INVALID_ID;
+
         for (i = 0; i < fw_ctx->hw_num_pipes; i++)
                 fw_ctx->topaz_reg_mem_space_addr[i] = (void *)topaz_mem_space[REG_TOPAZHP_CORE_0 + (4 * i)].cpu_addr;
 
diff --git a/driver/encoder/topaz_api.c b/driver/encoder/topaz_api.c
index 354e57e..09d3eb3 100644
--- a/driver/encoder/topaz_api.c
+++ b/driver/encoder/topaz_api.c
@@ -1512,6 +1512,9 @@ error_handling:
         }
 
         if (this_package->mtx_info.code_package_fw_buffer) {
+                if (this_package->mtx_info.code_package_fw_buffer->mem_info.dev_virt)
+                        topaz_mmu_stream_free(str_ctx->mmu_ctx, &this_package->mtx_info.code_package_fw_buffer->mem_info);
+
                 osa_free(this_package->mtx_info.code_package_fw_buffer);
                 this_package->mtx_info.code_package_fw_buffer = NULL;
         }
@@ -1521,9 +1524,6 @@ error_handling:
                 this_package->header_buffer = NULL;
         }
 
-        if (this_package->mtx_info.code_package_fw_buffer->mem_info.dev_virt)
-                topaz_mmu_stream_free(str_ctx->mmu_ctx, &this_package->mtx_info.code_package_fw_buffer->mem_info);
-
         return IMG_ERROR_OUT_OF_MEMORY;
 }
 
diff --git a/timmlib/encoder/mm_enc_create.c b/timmlib/encoder/mm_enc_create.c
index 6b9cf02..45af3ea 100644
--- a/timmlib/encoder/mm_enc_create.c
+++ b/timmlib/encoder/mm_enc_create.c
@@ -317,9 +317,8 @@ static int32 vxe_enc_s_fmt(struct mm_vxe_enc_fmt *pix_mp, uint32 chId)
 
 int32_t MM_ENC_BufPrepare(struct mm_buffer *buffer, uint32_t chId)
 {
-
-        struct vxe_enc_ctx *ctx = g_MM_ENC_Inst.ch_obj[chId].mm_ctx;
-        mm_vxe_buff *mm_buf = g_MM_ENC_Inst.ch_obj[chId].mm_buf;
+        struct vxe_enc_ctx *ctx;
+        mm_vxe_buff *mm_buf;
         struct vxe_enc_q_data *queue;
         int32 plane, num_planes, ret = 0;
         struct vxe_buffer *vxe_buf;
@@ -342,6 +341,9 @@ int32_t MM_ENC_BufPrepare(struct mm_buffer *buffer, uint32_t chId)
                 OSA_PR_ERR("%s buffer->chId is not set correctly, resetting here!!", __func__);
         }
 
+        ctx = g_MM_ENC_Inst.ch_obj[chId].mm_ctx;
+        mm_buf = g_MM_ENC_Inst.ch_obj[chId].mm_buf;
+
         vxe_buf = vxe_get_buf(buffer, chId);
 
         if (vxe_buf != NULL)
@@ -765,21 +767,22 @@ int32_t MM_ENC_Create(mm_vid_create_params *params, uint32_t *ch_Id)
 
 int32_t MM_ENC_Destroy(uint32_t chId)
 {
-
-        struct vxe_enc_ctx *ctx = g_MM_ENC_Inst.ch_obj[chId].mm_ctx;
-        struct vxe_dev *vxe = ctx->dev;
-        mm_vxe_buff *mm_buf = g_MM_ENC_Inst.ch_obj[chId].mm_buf;
+        struct vxe_enc_ctx *ctx;
+        struct vxe_dev *vxe;
+        mm_vxe_buff *mm_buf;
         int32 i;
 
-        osa_mutex_lock(vxe->mutex);
-
         if (chId >= MAX_NUM_CHANNELS)
         {
-                osa_mutex_unlock(vxe->mutex);
                 OSA_PR_ERR("%s Wrong chId passed by App.!!!", __func__);
                 return -OSA_EFAULT;
         }
 
+        ctx = g_MM_ENC_Inst.ch_obj[chId].mm_ctx;
+        vxe = ctx->dev;
+        mm_buf = g_MM_ENC_Inst.ch_obj[chId].mm_buf;
+
+        osa_mutex_lock(vxe->mutex);
         if (ctx->s_fmt_flags & S_FMT_FLAG_STREAM_CREATED)
                 topaz_stream_destroy(ctx->topaz_str_context);
         ctx->topaz_str_context = NULL;
@@ -810,7 +813,7 @@ int32_t MM_ENC_Destroy(uint32_t chId)
 
 int32_t MM_ENC_StartStreaming(uint32_t chId, mm_buffertype type)
 {
-        struct vxe_enc_ctx *ctx = g_MM_ENC_Inst.ch_obj[chId].mm_ctx;
+        struct vxe_enc_ctx *ctx;
         struct vxe_enc_q_data *queue;
 
         if (chId >= MAX_NUM_CHANNELS)
@@ -819,15 +822,18 @@ int32_t MM_ENC_StartStreaming(uint32_t chId, mm_buffertype type)
                 return -OSA_EFAULT;
         }
 
+        ctx = g_MM_ENC_Inst.ch_obj[chId].mm_ctx;
         queue = vxe_get_q_data(ctx, type);
-        queue->streaming = osa_true;
+
+        if (queue)
+                queue->streaming = osa_true;
 
         return 0;
 }
 
 int32_t MM_ENC_StopStreaming(uint32_t chId, mm_buffertype type)
 {
-        struct vxe_enc_ctx *ctx = g_MM_ENC_Inst.ch_obj[chId].mm_ctx;
+        struct vxe_enc_ctx *ctx;
         struct vxe_enc_q_data *queue;
 
         if (chId >= MAX_NUM_CHANNELS)
@@ -836,6 +842,8 @@ int32_t MM_ENC_StopStreaming(uint32_t chId, mm_buffertype type)
                 return -OSA_EFAULT;
         }
 
+        ctx = g_MM_ENC_Inst.ch_obj[chId].mm_ctx;
+
         osa_mutex_lock(ctx->mutex);
         if ((! ctx->out_queue.streaming) || (! ctx->cap_queue.streaming)) {
                 /* Buffers are still in queue for encode, set eos flag */
@@ -856,7 +864,8 @@ int32_t MM_ENC_StopStreaming(uint32_t chId, mm_buffertype type)
         }
 
         queue = vxe_get_q_data(ctx, type);
-        queue->streaming = osa_false;
+        if (queue)
+                queue->streaming = osa_false;
 
         return 0;
 }
diff --git a/timmlib/encoder/mm_enc_init.c b/timmlib/encoder/mm_enc_init.c
index b83d238..1e9fa59 100644
--- a/timmlib/encoder/mm_enc_init.c
+++ b/timmlib/encoder/mm_enc_init.c
@@ -221,7 +221,7 @@ int32 MM_ENC_Init(void) {
         ret = img_mem_init(vxe->dev);
         if (ret) {
                 OSA_DEV_ERR(vxe->dev, "Failed to initialize memory\n");
-                return -OSA_ENOMEM;
+                goto exit;
         }
 
         INIT_OSA_LIST_HEAD(&vxe->drv_ctx.heaps);
@@ -237,7 +237,7 @@ int32 MM_ENC_Init(void) {
                 heap = osa_zalloc(sizeof(*heap), OSA_GFP_KERNEL);
                 if (!heap) {
                         ret = -OSA_ENOMEM;
-                        goto heap_add_failed;
+                        goto out_heap_added;
                 }
 
                 ret = img_mem_add_heap(&heap_configs[i], &heap->id);
@@ -245,14 +245,14 @@ int32 MM_ENC_Init(void) {
                         OSA_DEV_ERR(vxe->dev, "%s: failed to init heap (type %d)!\n",
                                 __func__, heap_configs[i].type);
                         osa_free(heap);
-                        goto heap_add_failed;
+                        goto out_heap_added;
                 }
                 osa_list_add(&heap->list, &vxe->drv_ctx.heaps);
 
                 /* Implicitly, first heap is used for internal allocations */
                 if (vxe->drv_ctx.internal_heap_id < 0) {
                         vxe->drv_ctx.internal_heap_id = heap->id;
-                        OSA_DEV_ERR(vxe->dev, "%s: using heap %d for internal alloc\n",
+                        OSA_DEV_INFO(vxe->dev, "%s: using heap %d for internal alloc\n",
                                 __func__, vxe->drv_ctx.internal_heap_id);
                 }
         }
@@ -263,13 +263,13 @@ int32 MM_ENC_Init(void) {
                         __func__);
                 ret = -OSA_EINVAL;
                 /* Loop registered heaps just for sanity */
-                goto heap_add_failed;
+                goto out_heap_added;
         }
 
         ret = vxe_init_mem(vxe);
         if (ret) {
                 OSA_DEV_ERR(&ctx->dev, "Failed to initialize memory\n");
-                return -OSA_ENOMEM;
+                goto out_heap_added;
         }
 
         osa_mutex_create(&vxe->mutex);
@@ -282,7 +282,7 @@ int32 MM_ENC_Init(void) {
         ret = enc_reg_interrupt();
         if(OSA_STATUS_SOK != ret)
         {
-                goto exit;
+                goto out_free_irq;
         }
 
         ctx = osa_zalloc(sizeof(*ctx), OSA_GFP_KERNEL);
@@ -307,7 +307,7 @@ int32 MM_ENC_Init(void) {
         osa_idr_init(&vxe->streams);
         if (NULL == vxe->streams) {
                 ret = OSA_ENOMEM;
-                goto topazdd_deinit;
+                goto out_topazdd_deinit;
         }
 
         ret = init_topaz_core(vxe->topaz_dev_ctx, &vxe->num_pipes,
@@ -315,7 +315,7 @@ int32 MM_ENC_Init(void) {
                               vxe_return_resource);
         if (ret) {
                 OSA_DEV_ERR(&ctx->dev, "Failed to initialize topaz core\n");
-                goto topaz_core_deinit;
+                goto out_topaz_core_deinit;
         }
 
         g_MM_ENC_Inst.mm_dev = vxe;
@@ -327,19 +327,21 @@ int32 MM_ENC_Init(void) {
 
         return 0;
 
-topaz_core_deinit:
+out_topaz_core_deinit:
                 deinit_topaz_core();
 
-topazdd_deinit:
+out_topazdd_deinit:
                 topazdd_deinit(vxe->topaz_dev_ctx);
 
 out_free_irq:
                 osa_free(vxe->ctx);
+                osa_mutex_destroy(vxe->mutex);
+                enc_release_interrupt_resource();
 
 out_init:
                 vxe_deinit_mem(vxe);
 
-heap_add_failed:
+out_heap_added:
                 while (!osa_list_empty(&vxe->drv_ctx.heaps)) {
                         struct vxe_heap *heap;
 
@@ -351,11 +353,8 @@ heap_add_failed:
                 vxe->drv_ctx.internal_heap_id = VXE_INVALID_ID;
 
 exit:
-                osa_mutex_destroy(vxe->mutex);
-                enc_release_interrupt_resource();
-                osa_free(vxe);
                 osa_pm_set_module_state_encoder_off();
-                vxe_deinit_mem(vxe);
+                osa_free(vxe);
 
 return ret;
 }
diff --git a/timmlib/encoder/mm_enc_process.c b/timmlib/encoder/mm_enc_process.c
index 0855d4e..121c85c 100644
--- a/timmlib/encoder/mm_enc_process.c
+++ b/timmlib/encoder/mm_enc_process.c
@@ -28,7 +28,7 @@
 int32_t MM_ENC_Process(struct mm_buffer *in_buf,
                 struct mm_buffer *out_buf, uint32_t chId)
 {
-        struct vxe_enc_ctx *ctx = g_MM_ENC_Inst.ch_obj[chId].mm_ctx;
+        struct vxe_enc_ctx *ctx;
         struct vxe_buffer *src_vxeb;
         struct vxe_buffer *dst_vxeb;
         int ret = 0;
@@ -68,6 +68,8 @@ int32_t MM_ENC_Process(struct mm_buffer *in_buf,
                 return ret;
         }
 
+        ctx = g_MM_ENC_Inst.ch_obj[chId].mm_ctx;
+
         osa_mutex_lock(ctx->mutex);
 
 #ifdef ENABLE_PROFILING
@@ -147,7 +149,7 @@ int32_t MM_ENC_RegisterCb(
                 void (*mm_ret_resource)(struct mm_buffer *buf, mm_enc_process_cb cb_type),
                 uint32_t chId)
 {
-        struct vxe_enc_ctx *ctx = g_MM_ENC_Inst.ch_obj[chId].mm_ctx;
+        struct vxe_enc_ctx *ctx;
 
         if (chId >= MAX_NUM_CHANNELS)
         {
@@ -158,6 +160,7 @@ int32_t MM_ENC_RegisterCb(
         if(mm_ret_resource == NULL)
                 return -1;
 
+        ctx = g_MM_ENC_Inst.ch_obj[chId].mm_ctx;
         ctx->mm_return_resource = mm_ret_resource;
         return 0;