linux/drivers
Mike Isely 66349b4e7a V4L/DVB (13169): bttv: Fix potential out-of-order field processing
There is a subtle interaction in the bttv driver which can result in
fields being repeatedly processed out of order.  This is a problem
specifically when running in V4L2_FIELD_ALTERNATE mode (probably the
most common case).

1. The determination of which fields are associated with which buffers
happens in videobuf, before the bttv driver gets a chance to queue the
corresponding DMA.  Thus by the point when the DMA is queued for a
given buffer, the algorithm has to do the queuing based on the
buffer's already assigned field type - not based on which field is
"next" in the video stream.

2. The driver normally tries to queue both the top and bottom fields
at the same time (see bttv_irq_next_video()).  It tries to sort out
top vs bottom by looking at the field type for the next 2 available
buffers and assigning them appropriately.

3. However the bttv driver *always* actually processes the top field
first.  There's even an interrupt set aside for specifically
recognizing when the top field has been processed so that it can be
marked done even while the bottom field is still being DMAed.

Given all of the above, if one gets into a situation where
bttv_irq_next_video() gets entered when the first available buffer has
been pre-associated as a bottom field, then the function is going to
process the buffers out of order.  That first available buffer will be
put into the bottom field slot and the buffer after that will be put
into the top field slot.  Problem is, since the top field is always
processed first by the driver, then that second buffer (the one after
the first available buffer) will be the first one to be finished.
Because of the strict fifo handling of all video buffers, then that
top field won't be seen by the app until after the bottom field is
also processed.  Worse still, the app will get back the
chronologically later bottom field first, *before* the top field is
received.  The buffer's timestamps will even be backwards.

While not fatal to most TV apps, this behavior can subtlely degrade
userspace deinterlacing (probably will cause jitter).  That's probably
why it has gone unnoticed.  But it will also cause serious problems if
the app in question discards all but the latest received buffer (a
latency minimizing tactic) - causing one field to only ever be
displayed since the other is now always late.  Unfortunately once you
get into this state, you're stuck this way - because having consumed
two buffers, now the next time around the "first" available buffer
will again be a bottom field and the same thing happens.

How can we get into this state?  In a perfect world, where there's
always a few free buffers queued to the driver, it should be
impossible.  However if something disrupts streaming, e.g. if the
userspace app can't queue free buffers fast enough for a moment due
perhaps to a CPU scheduling glitch, then the driver can get
momentarily starved and some number of fields will be dropped.  That's
OK.  But if an odd number of fields get dropped, then that "first"
available buffer might be the bottom field and now we're stuck...

This patch fixes that problem by deliberately only setting up a single
field for one frame if we don't get a top field as the first available
buffer.  By purposely skipping the other field, then we only handle a
single buffer thus bringing things back into proper sync (i.e. top
field first) for the next frame.  To do this we just drop the few
lines in bttv_irq_next_video() that attempt to set up the second
buffer when that second buffer isn't for the bottom field.

This is definitely a problem in when in V4L2_FIELD_ALTERNATE mode.  In
the other modes this change either has no effect or doesn't harm
things any further anyway.

Signed-off-by: Mike Isely <isely@pobox.com>
CC: stable@kernel.org
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2009-11-07 12:55:07 -02:00
..
accessibility
acpi Merge branch 'misc' into release 2009-10-15 00:47:13 -04:00
amba
ata sata_via: Remove redundant device ID for VIA VT8261 2009-11-03 14:27:06 -05:00
atm net: Make setsockopt() optlen be unsigned. 2009-09-30 16:12:20 -07:00
auxdisplay
base PM: Remove some debug messages producing too much noise 2009-11-03 11:18:18 +01:00
block loop: fix NULL dereference if mount fails 2009-10-29 07:39:27 -07:00
bluetooth
cdrom sysctl: remove "struct file *" argument of ->proc_handler 2009-09-24 07:21:04 -07:00
char Merge branch 'bugfix' of git://git.kernel.org/pub/scm/linux/kernel/git/jeremy/xen 2009-11-05 10:58:07 -08:00
clocksource
connector connector: Fix incompatible pointer type warning 2009-10-06 01:39:51 -07:00
cpufreq
cpuidle cpuidle: always return with interrupts enabled 2009-10-29 07:39:31 -07:00
crypto crypto: padlock-sha - Fix stack alignment 2009-09-21 23:21:53 -07:00
dca
dio
dma Merge branch 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/djbw/async_tx into for-linus 2009-09-23 18:31:11 +10:00
edac amd64_edac: fix CECCs reporting 2009-11-04 14:04:06 +01:00
eisa
firewire Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394-2.6 2009-10-14 15:36:19 -07:00
firmware iSCSI/iBFT: use proper address translation 2009-10-05 12:05:40 -07:00
gpio twl4030-gpio: remove __devexit markings from remove func 2009-10-29 07:39:30 -07:00
gpu Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/anholt/drm-intel 2009-11-04 07:05:43 -08:00
hid Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid 2009-10-13 10:10:33 -07:00
hwmon Merge branch 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jdelvare/staging 2009-10-29 08:14:58 -07:00
i2c i2c-mpc: Do not generate STOP after read. 2009-11-02 23:28:47 +00:00
ide Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/ide-2.6 2009-10-29 09:22:34 -07:00
idle
ieee1394 headers: remove sched.h from interrupt.h 2009-10-11 11:20:58 -07:00
ieee802154
infiniband headers: remove sched.h from interrupt.h 2009-10-11 11:20:58 -07:00
input Input: gpio-keys - use IRQF_SHARED 2009-11-02 22:12:37 -08:00
isdn Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6 2009-10-29 09:22:08 -07:00
leds leds: leds-pca9532 - Drop unused module parameters 2009-10-04 22:53:43 +02:00
lguest headers: remove sched.h from interrupt.h 2009-10-11 11:20:58 -07:00
macintosh powerpc/pmac: Fix issues with sleep on some powerbooks 2009-10-14 16:58:35 +11:00
mca
md Merge branch 'for-linus' of git://neil.brown.name/md 2009-10-31 12:12:19 -07:00
media V4L/DVB (13169): bttv: Fix potential out-of-order field processing 2009-11-07 12:55:07 -02:00
memstick memstick: move dev_dbg 2009-09-24 07:21:05 -07:00
message headers: remove sched.h from interrupt.h 2009-10-11 11:20:58 -07:00
mfd mfd: Do not dereference null pointer in twl4030 error path 2009-10-27 00:20:33 +01:00
misc sgi-gru: decrapfiy options_write() function 2009-11-05 10:48:30 -08:00
mmc omap_hsmmc: add missing probe handler hook 2009-10-29 07:39:25 -07:00
mtd Merge git://git.infradead.org/users/dwmw2/mtd-2.6.32 2009-11-05 13:23:16 -08:00
net Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6 2009-11-03 07:44:01 -08:00
nubus
of of: Remove nested function 2009-10-15 09:58:27 -06:00
oprofile oprofile: warn on freeing event buffer too early 2009-10-09 21:32:05 +02:00
parisc mm: replace various uses of num_physpages by totalram_pages 2009-09-22 07:17:38 -07:00
parport sysctl: remove "struct file *" argument of ->proc_handler 2009-09-24 07:21:04 -07:00
pci Revert "PCI: get larger bridge ranges when space is available" 2009-10-27 09:39:18 -07:00
pcmcia PM / yenta: Split resume into early and late parts (rev. 4) 2009-11-03 10:54:58 +01:00
platform Merge branch 'misc' into release 2009-10-15 00:47:13 -04:00
pnp ACPI: remove acpi_device.flags.hardware_id 2009-09-25 15:09:48 -04:00
power Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux-2.6 2009-09-23 03:49:27 +04:00
pps
ps3
rapidio
regulator regulator: fix voltage range in da9034 ldo12 2009-09-22 13:58:23 +01:00
rtc headers: remove sched.h from interrupt.h 2009-10-11 11:20:58 -07:00
s390 Merge branch 'for-linus' of git://git390.marist.edu/pub/scm/linux-2.6 2009-10-31 12:14:56 -07:00
sbus const: make block_device_operations const 2009-09-22 07:17:25 -07:00
scsi dpt_i2o: Fix typo of EINVAL 2009-10-31 12:11:38 -07:00
serial Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6 2009-11-03 07:44:01 -08:00
sfi SFI: remove __init from sfi_verify_table 2009-10-03 01:16:12 -04:00
sh
sn
spi ARM: 5741/1: pl022: fix peripheral id for ST vendor 2009-10-05 17:55:55 +01:00
ssb ssb/sdio: fix printk format warnings 2009-09-23 11:35:41 -04:00
staging Staging: fix wireless drivers depends 2009-10-30 14:47:44 -07:00
tc
telephony
thermal
uio headers: remove sched.h from interrupt.h 2009-10-11 11:20:58 -07:00
usb USB: fsl_udc_core: Fix kernel oops on module removal 2009-10-30 14:57:33 -07:00
uwb headers: remove sched.h from interrupt.h 2009-10-11 11:20:58 -07:00
video Merge branch 'omap-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap-2.6 2009-10-08 12:01:01 -07:00
virtio virtio: order used ring after used index read 2009-10-29 08:50:37 +10:30
vlynq drivers/vlynq/vlynq.c: fix resource size off by 1 error 2009-09-24 07:21:05 -07:00
w1 ds2482: Discard obsolete detect method 2009-10-04 22:53:41 +02:00
watchdog watchdog: Fix rio watchdog probe function 2009-10-14 01:18:26 -07:00
xen headers: remove sched.h from poll.h 2009-10-04 15:05:10 -07:00
zorro
Kconfig
Makefile Merge git://git.infradead.org/mtd-2.6 2009-09-23 10:07:49 -07:00