This thread has been locked.

If you have a related question, please click the "Ask a related question" button in the top right corner. The newly created question will be automatically linked to this question.

IMGDEC1_process SIGSEGV help!



we are using IMGDEC1_process on dm365 with JPEG codec 01.00.00.10 recently and it works fine but once i got the error from cmem:
Unable to handle kernel paging request at virtual address 9d6f9d8a
we are now using a loop-queue to index the buff info. the full log is as follow:
 
[0m[37;40m10:43:36|trace CMediaFileList::onTimerOnEventNotify::event notify
[mTime : Thu Apr 25 10:43:36 2013
=========================== TRACE START ===================================
Tid:413, Exception type : SIGSEGV
[0m[33;40m10:43:36|warn  Src/./RtspClient.cpp:685 rtsp connect exception!
[0m[33;40m10:43:36|warn  Src/./RtspClient.cpp:688 return -1
[0m[31;40m10:43:36|error send failed! Connection reset by peer
[0m[31;40m10:43:36|error CStreamSender socket exception! fd: 38
[0m[33;40m10:43:36|warn  Src/./StateMachine.cpp:181:execute exception occured!
[0m[33;40m10:43:36|warn  Src/./MachineKeeper.cpp:64 
[0m[33;40m10:43:36|warn  Src/./RtspClient.cpp:~CRtspClient client:0x1be2cc0 
PC:[0x00034e48] (0x00034dc0--0x00034e63) stack_sig_hook + [0x88]
Unable to handle kernel paging request at virtual address 9d6f9d8a
PC:[0x401a77c0] (0x00034dc0--0x00034e63) __defaupgd = c203c000
lt_rt_sa_restore[9d6f9d8a] *pgd=00000000r_v2 + [0x0]
PC:[0x00099428] (0
x00034dc0--0x000Internal error: Oops: 1 [#1]
Modules linked in: mmc_drv mmc_blk mmc_core davinci_fm2018 davinci_evm_tlv320 snd_soc_davinci davinci_i2s_mcbsp aout tlv320aic23 dm365_ad h3ak myvdec vpfek pwm vpbek touch_panel_ctrl i2ckey evdev getjif mymemcpy irqk edmak dm365mmap cmemk davinci_emac gpio
CPU: 0
PC is at HeapMem_free+0x40/0xb4 [cmemk]
LR is at 0x1000
pc : [<bf00f184>]    lr : [<00001000>]    Tainted: GF    
sp : c3477d5c  ip : 9d6f9d8a  fp : c3477d6c
r10: 00000000  r9 : 00000001  r8 : c2025828
r7 : bf013d60  r6 : 00000000  r5 : c2025828  r4 : bf013d40
r3 : 00000001  r2 : 00000128  r1 : c7a4b000  r0 : 9d6f9d8a
Flags: Nzcv  IRQs on  FIQs on  Mode SVC_32  Segment user
Control: 5317F
Table: 8203C000  DAC: 00000015
Process VideoDaemon (pid: 397, stack limit = 0xc3476258)
Stack: (0xc3477d5c to 0xc3478000)
7d40:                                                                c2025820 
7d60: c3477dbc c3477d70 bf00fca4 bf00f154 00000000 00000000 bf013d58 c0c7fb20 
7d80: bf013d60 c20257e0 00000000 00000000 c00b59a0 00000008 c0c7fb20 c098a120 
7da0: c0b62618 c04b4ea0 00000000 00000000 c3477dec c3477dc0 c0096738 bf00fb28 
7dc0: 00000000 c0dd2bc0 c0dd2bf4 c0c7fb20 00000000 c04aba40 c04aba48 00000000 
7de0: c3477dfc c3477df0 c0096a00 c0096694 c3477e1c c3477e00 c0092fa8 c00969dc 
7e00: c3476000 00001fff c04aba40 00000018 c3477e4c c3477e20 c004bb64 c0092f40 
7e20: c3477e4c c04aba40 c0527680 c0ab9070 00000000 0000000b 00000000 c3477f50 
7e40: c3477e6c c3477e50 c004d16c c004bae0 c3477e6c 001f24c8 c3477ea0 c3476000 
7e60: c3477e84 c3477e70 c004da04 c004cf2c 00000000 00000009 c3477ebc c3477e88 
7e80: c00588f0 c004d958 c3477fb0 c0527860 c0054d58 c3476000 00000000 c3477fb0 
7ea0: c0034208 c0034208 c3476000 00000000 c3477f9c c3477ec0 c0036dd8 c0058520 
7ec0: c3476000 00000001 c0527860 c3477ed8 00000009 00000000 00000000 00000000 
7ee0: 00000000 0000000a c3477f14 c3477ef8 c0064078 c3477f88 00000000 0000000a 
7f00: bee2ed08 bee2ed08 00000008 00000000 c3477f20 c0063b14 0fb21b40 000013f0 
7f20: c149df21 00000000 00000000 00000000 2215fe7d 000013f8 c0063c24 c034dc38 
7f40: 00000000 00000002 c3477f48 c3477f48 c0527680 c0059610 00000008 1263e33d 
7f60: c3477f88 bee2ed08 00000000 000000a2 c0034208 40024e00 00000000 00000000 
7f80: 000000a2 c0034208 c3476000 00000000 c3477fac c3477fa0 c0037258 c0036d90 
7fa0: 00000000 c3477fb0 c00340ac c003723c fffffdfc bee2ed08 4001f5a4 00000002 
7fc0: 40024e00 00000000 00000000 000000a2 00000000 00000000 40025000 bee2ed1c 
7fe0: 00000000 bee2ecf8 400664f4 40067634 80000010 bee2ed10 03f60001 03f70000 
Backtrace: 
[<bf00f144>] (HeapMem_free+0x0/0xb4 [cmemk]) from [<bf00fca4>] (release+0x18c/0x270 [cmemk])
 r4 = C2025820 
[<bf00fb18>] (release+0x0/0x270 [cmemk]) from [<c0096738>] (__fput+0xb4/0x214)
[<c0096684>] (__fput+0x0/0x214) from [<c0096a00>] (fput+0x34/0x38)
 r8 = 00000000  r7 = C04ABA48  r6 = C04ABA40  r5 = 00000000
 r4 = C0C7FB20 
[<c00969cc>] (fput+0x0/0x38) from [<c0092fa8>] (filp_close+0x78/0x84)
[<c0092f30>] (filp_close+0x0/0x84) from [<c004bb64>] (put_files_struct+0x94/0xe8)
 r6 = 00000018  r5 = C04ABA40  r4 = 00001FFF 
[<c004bad0>] (put_files_struct+0x0/0xe8) from [<c004d16c>] (do_exit+0x250/0xa2c)
[<c004cf1c>] (do_exit+0x0/0xa2c) from [<c004da04>] (sys_exit_group+0x0/0x1c)
[<c004d948>] (do_group_exit+0x0/0xbc) from [<c00588f0>] (get_signal_to_deliver+0x3e0/0x42c)
 r4 = 00000009 
[<c0058510>] (get_signal_to_deliver+0x0/0x42c) from [<c0036dd8>] (do_signal+0x58/0x4ac)
[<c0036d80>] (do_signal+0x0/0x4ac) from [<c0037258>] (do_notify_resume+0x2c/0x30)
[<c003722c>] (do_notify_resume+0x0/0x30) from [<c00340ac>] (work_pending+0x1c/0x20)
Code: 1062e003 e1a0c004 ea000001 e1a0c000 (e5900000) 
 34e63) JPEGDEC_TI_updateState + [0x18]
PC:[0x00084b5c] (0x00034e84--0x00130e0f) IMGDEC1_process + [0x23c]
PC:[0x0007f678] (0x00034e84--0x00130e0f) decode_jpeg + [0x1a4]
PC:[0x00000004] (0x00034e84--0x00130e0f) Unknown
<1>Fixing recursive fault but reboot is needed!
[0m[36;40m10:43:37|[libInfra] debug ThreadBody Enter name = [ringTimer], id = 551, prior = N64, stack = 0x473d6e24
 
any idea why it just failed once but all goes fine.
Thanks in advance. 
Regards, Mike.
 
 
  • Hello MIke,

    Can you please give more details on this. What  parameter values you are setting and what is input/output type. And please send input and out buffer pointers value.

    Thanks,

    Veeranna

  •       Hi, Veeranna.

    the parameters :

             ///////////////////////////// JPEG decode  ////////////////////////////////////////////

             ///////////////////////////////////////////////////////////////////////////////////////

            

             {

                       .engineName           = "encode",      /* Engine string name used by CE to find the engine */

                       .decoderName        = "jpegdec",              /* String name of codec for CE to locate it */

                       .streamid                  = 0,                              //todo!!!!!!!

                       .hDecoder                = NULL,

                       .fun_create     = create_jpegdecoder,

                       .fun_compress        = decode_jpeg,

                       .fun_reset                  = decode_jpeg_reset,

                       .jpegParams              =

                       {

                           sizeof(IMGDEC1_Params),         /* size */

                           800,                           /* maxHeight */

                           576,                           /* maxWidth */

                           15,                             /* maxScans */

                           XDM_BYTE,                       /* dataEndianess */

                XDM_YUV_422ILE,                                     /* forceChromaFormat XDM_YUV_422ILE  XDM_YUV_420SP  */

                       },

                      

                       .jpegdynParams       =

                       {

                           sizeof(IMGDEC1_DynamicParams),  /* size */

                           XDM_DEFAULT,                    /* numAu */   

                           XDM_DECODE_AU,                  /* decodeHeader */

                           XDM_DEFAULT,                              /* displayWidth */

                       },

                       .cashedBuffId = -1,

                       .colorSpace = ColorSpace_UYVY,//ColorSpace_YUV420PSEMI,//ColorSpace_UYVY

             },

     

     create jpeg decoder :

     

    int create_jpegdecoder(VideoDecodeChannel *pvideodec)

    {

             int err,  numAlgs, index;

        IMGDEC1_Status    decStatus;

        IMGDEC1_Handle   hId;

             Engine_AlgInfo algInfo;

     

        /* Create the image decoder */

        hId = IMGDEC1_create(pvideodec->hEngine, pvideodec->decoderName, &pvideodec->jpegParams);

     

        if (hId == NULL)

             {

                       err = Engine_getLastError(pvideodec->hEngine);

            OSA_ERROR("Failed to open image decode algorithm: %s (0x%x)\n", pvideodec->decoderName, err);

     

                       algInfo.algInfoSize = sizeof(Engine_AlgInfo);

                       if(Engine_EOK == Engine_getNumAlgs(pvideodec->engineName, &numAlgs))

                       {

                                OSA_INFO("available Alg=%d====>>>>\n", numAlgs);

                                for(index=0; index < numAlgs; index++)

                                {

                                         if(Engine_EOK == Engine_getAlgInfo(pvideodec->engineName, &algInfo, index))

                                                   OSA_INFO("alg[%d]: name = %s typeTab = %s Local = %d\n", index, algInfo.name, *(algInfo.typeTab), algInfo.isLocal);

                                         else

                                                   OSA_ERROR("AlgInfo:%d\n", (int)Engine_getLastError(pvideodec->hEngine));

                                }

                       }

                       else

                                OSA_INFO("Engine_getNumAlgs ERROR>>>>>\n");

                      

            return -1;

        }

            

             /* Set image decoder dynamic params */

        decStatus.data.buf = NULL;

        decStatus.size = sizeof(IMGDEC1_Status);

            

        err = IMGDEC1_control(hId, XDM_SETPARAMS, &pvideodec->jpegdynParams, &decStatus);

        if (err != IMGDEC1_EOK)

             {

            OSA_ERROR("XDM_SETPARAMS control failed\n");

            IMGDEC1_delete(hId);

            return -2;

        }

            

             /* Get buffer information from image decoder */

        err = IMGDEC1_control(hId, XDM_GETBUFINFO, &pvideodec->jpegdynParams, &decStatus);

        if (err != IMGDEC1_EOK)

             {

            OSA_ERROR("XDM_GETBUFINFO control failed\n");

            IMGDEC1_delete(hId);

            return -3;

        }

     

     

        memcpy(pvideodec->minInBufSize, decStatus.bufInfo.minInBufSize, sizeof(pvideodec->minInBufSize));

        pvideodec->minNumInBufs = decStatus.bufInfo.minNumInBufs;

            

        memcpy(pvideodec->minOutBufSize, decStatus.bufInfo.minOutBufSize, sizeof(pvideodec->minOutBufSize));

        pvideodec->minNumOutBufs = decStatus.bufInfo.minNumOutBufs;

     

             pvideodec->jpegDecoderHdl = hId;

             OSA_INFO("codec %s create successfully\n", pvideodec->decoderName);

             return 0;

    }

     

     

    do decode the jpeg buff :

             int status, i, rv, offset = 0;

             char * outPtr = dstBuf->virtAddr; // it's from cmem and it's length is 800 * 576 * 2

             XDM1_BufDesc  inBufDesc;

        XDM1_BufDesc  outBufDesc;

             IMGDEC1_Handle hId = pvideodec->jpegDecoderHdl;

        IMGDEC1_InArgs          inArgs;

        IMGDEC1_OutArgs         outArgs;

        IMGDEC1_Status          decStatus;

             int t = 0;

     

        inBufDesc.numBufs                            = 1;

        inBufDesc.descs[0].buf             = srcBuf->start;// it's from cmem and it's length is 1024*500

             inBufDesc.descs[0].bufSize     = srcBuf->size;

     

        inArgs.size                          = sizeof(IMGDEC1_InArgs);

        inArgs.numBytes              = srcBuf->length; // jpeg data length

            

             outBufDesc.numBufs  = pvideodec->minNumOutBufs;

        outArgs.size              = sizeof(IMGDEC1_OutArgs);

       

             for(i = 0; i < pvideodec->minNumOutBufs; i++)

        {

            outBufDesc.descs[i].buf = (XDAS_Int8 *)((unsigned int)outPtr + offset);

            offset +=  pvideodec->minOutBufSize[i];

            outBufDesc.descs[i].bufSize = pvideodec->minOutBufSize[i];

        } 

        status = IMGDEC1_process(hId, &inBufDesc, &outBufDesc, &inArgs, &outArgs);

     

    the actually pointer value of the buffer did not printout when it's released.

    any ideas?

    regards, Mike

  • The CMEM fault from HeapMem_free() appears to be happening during the auto-close() phase of signal handling.  It appears that your program is generating a segfault, and the application signal handling is closing all open file descriptors, of which one is the fd for /dev/cmem, and HeapMem_free() is faulting during this close() phase.

    The CMEM driver fault is secondary to your initial user-app segfault, so focus on that first.

    Regards,

    - Rob

     

  • Rob, appreciate!

    would you please tell me if it is from user-app or kernel driver.

    Regards, Mike.

     

  • zanget said:

    would you please tell me if it is from user-app or kernel driver.

    It appears to be a user-app exception causing a segment violation.  This output looks to be user-level output from a signal handler:
    [0m[37;40m10:43:36|trace CMediaFileList::onTimerOnEventNotify::event notify
    [mTime : Thu Apr 25 10:43:36 2013
    =========================== TRACE START ===================================
    Tid:413, Exception type : SIGSEGV
    [0m[33;40m10:43:36|warn  Src/./RtspClient.cpp:685 rtsp connect exception!
    [0m[33;40m10:43:36|warn  Src/./RtspClient.cpp:688 return -1
    [0m[31;40m10:43:36|error send failed! Connection reset by peer
    [0m[31;40m10:43:36|error CStreamSender socket exception! fd: 38
    [0m[33;40m10:43:36|warn  Src/./StateMachine.cpp:181:execute exception occured!
    [0m[33;40m10:43:36|warn  Src/./MachineKeeper.cpp:64
    [0m[33;40m10:43:36|warn  Src/./RtspClient.cpp:~CRtspClient client:0x1be2cc0

    This user-level signal handler probably ends up calling exit(), at which point all open files in the app are automatically closed.

    When CMEM's fd is closed, the CMEM driver checks for allocated buffers belonging to the closing processes and automatically frees them.  It is during this phase that the kernel fault is happening.  While that kernel fault may be a problem on its own, it can be avoided if the initial segfault doesn't happen.

    I don't see anything in the output that indicates what caused the initial segfault.

    Regards,

    - Rob