* [PATCH] media: rkvdec: Fix .buf_prepare
@ 2021-05-04 11:37 Andrzej Pietrasiewicz
2021-05-04 11:56 ` Ezequiel Garcia
0 siblings, 1 reply; 7+ messages in thread
From: Andrzej Pietrasiewicz @ 2021-05-04 11:37 UTC (permalink / raw)
To: linux-media
Cc: devel, kernel, Greg Kroah-Hartman, Adrian Ratiu,
Andrzej Pietrasiewicz, linux-rockchip, Hans Verkuil,
Mauro Carvalho Chehab, Ezequiel Garcia
From: Ezequiel Garcia <ezequiel@collabora.com>
The driver should only set the payload on .buf_prepare if the
buffer is CAPTURE type. If an OUTPUT buffer has a zero bytesused
set by userspace then v4l2-core will set it to buffer length.
Fixes: cd33c830448ba ("media: rkvdec: Add the rkvdec driver")
Signed-off-by: Ezequiel Garcia <ezequiel@collabora.com>
Signed-off-by: Adrian Ratiu <adrian.ratiu@collabora.com>
Signed-off-by: Andrzej Pietrasiewicz <andrzej.p@collabora.com>
---
@Hans: I haven't had anyone complain about the issue. The fix is needed for
the rkvdec vp9 work, so I think 5.14 is fine.
drivers/staging/media/rkvdec/rkvdec.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
diff --git a/drivers/staging/media/rkvdec/rkvdec.c b/drivers/staging/media/rkvdec/rkvdec.c
index d821661d30f3..ef2166043127 100644
--- a/drivers/staging/media/rkvdec/rkvdec.c
+++ b/drivers/staging/media/rkvdec/rkvdec.c
@@ -481,7 +481,15 @@ static int rkvdec_buf_prepare(struct vb2_buffer *vb)
if (vb2_plane_size(vb, i) < sizeimage)
return -EINVAL;
}
- vb2_set_plane_payload(vb, 0, f->fmt.pix_mp.plane_fmt[0].sizeimage);
+
+ /*
+ * Buffer bytesused is written by driver for CAPTURE buffers.
+ * (if userspace passes 0 bytesused for OUTPUT buffers, v4l2-core sets
+ * it to buffer length).
+ */
+ if (!V4L2_TYPE_IS_OUTPUT(vq->type))
+ vb2_set_plane_payload(vb, 0, f->fmt.pix_mp.plane_fmt[0].sizeimage);
+
return 0;
}
base-commit: 0b276e470a4d43e1365d3eb53c608a3d208cabd4
--
2.17.1
_______________________________________________
devel mailing list
devel@linuxdriverproject.org
http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel
^ permalink raw reply related [flat|nested] 7+ messages in thread* Re: [PATCH] media: rkvdec: Fix .buf_prepare 2021-05-04 11:37 [PATCH] media: rkvdec: Fix .buf_prepare Andrzej Pietrasiewicz @ 2021-05-04 11:56 ` Ezequiel Garcia 2021-05-05 12:17 ` Andrzej Pietrasiewicz 0 siblings, 1 reply; 7+ messages in thread From: Ezequiel Garcia @ 2021-05-04 11:56 UTC (permalink / raw) To: Andrzej Pietrasiewicz, linux-media Cc: devel, kernel, Greg Kroah-Hartman, Adrian Ratiu, linux-rockchip, Hans Verkuil, Mauro Carvalho Chehab Hi Andrzej, Thanks a lot for picking this up. On Tue, 2021-05-04 at 13:37 +0200, Andrzej Pietrasiewicz wrote: > From: Ezequiel Garcia <ezequiel@collabora.com> > > The driver should only set the payload on .buf_prepare if the > buffer is CAPTURE type. If an OUTPUT buffer has a zero bytesused > set by userspace then v4l2-core will set it to buffer length. > > Fixes: cd33c830448ba ("media: rkvdec: Add the rkvdec driver") > Signed-off-by: Ezequiel Garcia <ezequiel@collabora.com> > Signed-off-by: Adrian Ratiu <adrian.ratiu@collabora.com> > Signed-off-by: Andrzej Pietrasiewicz <andrzej.p@collabora.com> > > --- > @Hans: I haven't had anyone complain about the issue. The fix is needed for > the rkvdec vp9 work, so I think 5.14 is fine. > > drivers/staging/media/rkvdec/rkvdec.c | 10 +++++++++- > 1 file changed, 9 insertions(+), 1 deletion(-) > > diff --git a/drivers/staging/media/rkvdec/rkvdec.c b/drivers/staging/media/rkvdec/rkvdec.c > index d821661d30f3..ef2166043127 100644 > --- a/drivers/staging/media/rkvdec/rkvdec.c > +++ b/drivers/staging/media/rkvdec/rkvdec.c > @@ -481,7 +481,15 @@ static int rkvdec_buf_prepare(struct vb2_buffer *vb) > if (vb2_plane_size(vb, i) < sizeimage) > return -EINVAL; > } > - vb2_set_plane_payload(vb, 0, f->fmt.pix_mp.plane_fmt[0].sizeimage); > + > + /* > + * Buffer bytesused is written by driver for CAPTURE buffers. > + * (if userspace passes 0 bytesused for OUTPUT buffers, v4l2-core sets > + * it to buffer length). > + */ > + if (!V4L2_TYPE_IS_OUTPUT(vq->type)) Please use V4L2_TYPE_IS_CAPTURE here. Also, why is this change needed in rkvdec, but not in cedrus or hantro? Thanks! Ezequiel _______________________________________________ devel mailing list devel@linuxdriverproject.org http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel ^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH] media: rkvdec: Fix .buf_prepare 2021-05-04 11:56 ` Ezequiel Garcia @ 2021-05-05 12:17 ` Andrzej Pietrasiewicz 2021-05-05 12:23 ` [PATCHv2 0/3] " Andrzej Pietrasiewicz 0 siblings, 1 reply; 7+ messages in thread From: Andrzej Pietrasiewicz @ 2021-05-05 12:17 UTC (permalink / raw) To: Ezequiel Garcia, linux-media Cc: devel, kernel, Greg Kroah-Hartman, Adrian Ratiu, linux-rockchip, Hans Verkuil, Mauro Carvalho Chehab Hi Ezequiel, W dniu 04.05.2021 o 13:56, Ezequiel Garcia pisze: > Hi Andrzej, > > Thanks a lot for picking this up. > > On Tue, 2021-05-04 at 13:37 +0200, Andrzej Pietrasiewicz wrote: >> From: Ezequiel Garcia <ezequiel@collabora.com> >> >> The driver should only set the payload on .buf_prepare if the >> buffer is CAPTURE type. If an OUTPUT buffer has a zero bytesused >> set by userspace then v4l2-core will set it to buffer length. >> >> Fixes: cd33c830448ba ("media: rkvdec: Add the rkvdec driver") >> Signed-off-by: Ezequiel Garcia <ezequiel@collabora.com> >> Signed-off-by: Adrian Ratiu <adrian.ratiu@collabora.com> >> Signed-off-by: Andrzej Pietrasiewicz <andrzej.p@collabora.com> >> >> --- >> @Hans: I haven't had anyone complain about the issue. The fix is needed for >> the rkvdec vp9 work, so I think 5.14 is fine. >> >> drivers/staging/media/rkvdec/rkvdec.c | 10 +++++++++- >> 1 file changed, 9 insertions(+), 1 deletion(-) >> >> diff --git a/drivers/staging/media/rkvdec/rkvdec.c b/drivers/staging/media/rkvdec/rkvdec.c >> index d821661d30f3..ef2166043127 100644 >> --- a/drivers/staging/media/rkvdec/rkvdec.c >> +++ b/drivers/staging/media/rkvdec/rkvdec.c >> @@ -481,7 +481,15 @@ static int rkvdec_buf_prepare(struct vb2_buffer *vb) >> if (vb2_plane_size(vb, i) < sizeimage) >> return -EINVAL; >> } >> - vb2_set_plane_payload(vb, 0, f->fmt.pix_mp.plane_fmt[0].sizeimage); >> + >> + /* >> + * Buffer bytesused is written by driver for CAPTURE buffers. >> + * (if userspace passes 0 bytesused for OUTPUT buffers, v4l2-core sets >> + * it to buffer length). >> + */ >> + if (!V4L2_TYPE_IS_OUTPUT(vq->type)) > > Please use V4L2_TYPE_IS_CAPTURE here. > > Also, why is this change needed in rkvdec, but not in cedrus > or hantro? > As a matter of fact I think it is needed in all three, because later on, whenever a driver uses vb2_get_plane_payload(), without such a patch it will get an invalid number and write that to a hardware register, causing incorrect behavior. I will respond with a v2 series. Regards, Andrzej _______________________________________________ devel mailing list devel@linuxdriverproject.org http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel ^ permalink raw reply [flat|nested] 7+ messages in thread
* [PATCHv2 0/3] Fix .buf_prepare 2021-05-05 12:17 ` Andrzej Pietrasiewicz @ 2021-05-05 12:23 ` Andrzej Pietrasiewicz 2021-05-05 12:23 ` [PATCHv2 1/3] media: rkvdec: " Andrzej Pietrasiewicz ` (2 more replies) 0 siblings, 3 replies; 7+ messages in thread From: Andrzej Pietrasiewicz @ 2021-05-05 12:23 UTC (permalink / raw) To: linux-media Cc: devel, Jernej Skrabec, kernel, Greg Kroah-Hartman, Maxime Ripard, Andrzej Pietrasiewicz, Paul Kocialkowski, linux-rockchip, Chen-Yu Tsai, Philipp Zabel, Hans Verkuil, Mauro Carvalho Chehab, Ezequiel Garcia, linux-arm-kernel Drivers should only set the payload on .buf_prepare if the buffer is CAPTURE type. If an OUTPUT buffer has a zero bytesused set by userspace then v4l2-core will set it to buffer length. If we overwrite bytesused for OUTPUT buffers, too, then vb2_get_plane_payload() will return incorrect value which might be then written to hw registers by the driver. Andrzej Pietrasiewicz (2): media: hantro: Fix .buf_prepare media: cedrus: Fix .buf_prepare Ezequiel Garcia (1): media: rkvdec: Fix .buf_prepare drivers/staging/media/hantro/hantro_v4l2.c | 9 ++++++++- drivers/staging/media/rkvdec/rkvdec.c | 10 +++++++++- drivers/staging/media/sunxi/cedrus/cedrus_video.c | 8 +++++++- 3 files changed, 24 insertions(+), 3 deletions(-) base-commit: 0b276e470a4d43e1365d3eb53c608a3d208cabd4 -- 2.17.1 _______________________________________________ devel mailing list devel@linuxdriverproject.org http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel ^ permalink raw reply [flat|nested] 7+ messages in thread
* [PATCHv2 1/3] media: rkvdec: Fix .buf_prepare 2021-05-05 12:23 ` [PATCHv2 0/3] " Andrzej Pietrasiewicz @ 2021-05-05 12:23 ` Andrzej Pietrasiewicz 2021-05-05 12:23 ` [PATCHv2 2/3] media: hantro: " Andrzej Pietrasiewicz 2021-05-05 12:23 ` [PATCHv2 3/3] media: cedrus: " Andrzej Pietrasiewicz 2 siblings, 0 replies; 7+ messages in thread From: Andrzej Pietrasiewicz @ 2021-05-05 12:23 UTC (permalink / raw) To: linux-media Cc: devel, Jernej Skrabec, kernel, Greg Kroah-Hartman, Adrian Ratiu, Maxime Ripard, Andrzej Pietrasiewicz, Paul Kocialkowski, linux-rockchip, Chen-Yu Tsai, Philipp Zabel, Hans Verkuil, Mauro Carvalho Chehab, Ezequiel Garcia, linux-arm-kernel From: Ezequiel Garcia <ezequiel@collabora.com> The driver should only set the payload on .buf_prepare if the buffer is CAPTURE type. If an OUTPUT buffer has a zero bytesused set by userspace then v4l2-core will set it to buffer length. If we overwrite bytesused for OUTPUT buffers, too, then vb2_get_plane_payload() will return incorrect value which might be then written to hw registers by the driver in rkvdec-h264.c. Fixes: cd33c830448ba ("media: rkvdec: Add the rkvdec driver") Signed-off-by: Ezequiel Garcia <ezequiel@collabora.com> Signed-off-by: Adrian Ratiu <adrian.ratiu@collabora.com> [Changed the comment and used V4L2_TYPE_IS_CAPTURE macro] Signed-off-by: Andrzej Pietrasiewicz <andrzej.p@collabora.com> --- drivers/staging/media/rkvdec/rkvdec.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/drivers/staging/media/rkvdec/rkvdec.c b/drivers/staging/media/rkvdec/rkvdec.c index d821661d30f3..cd65ad2af8d4 100644 --- a/drivers/staging/media/rkvdec/rkvdec.c +++ b/drivers/staging/media/rkvdec/rkvdec.c @@ -481,7 +481,15 @@ static int rkvdec_buf_prepare(struct vb2_buffer *vb) if (vb2_plane_size(vb, i) < sizeimage) return -EINVAL; } - vb2_set_plane_payload(vb, 0, f->fmt.pix_mp.plane_fmt[0].sizeimage); + + /* + * Buffer's bytesused must be written by driver for CAPTURE buffers. + * (for OUTPUT buffers, if userspace passes 0 bytesused, v4l2-core sets + * it to buffer length). + */ + if (V4L2_TYPE_IS_CAPTURE(vq->type)) + vb2_set_plane_payload(vb, 0, f->fmt.pix_mp.plane_fmt[0].sizeimage); + return 0; } -- 2.17.1 _______________________________________________ devel mailing list devel@linuxdriverproject.org http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel ^ permalink raw reply related [flat|nested] 7+ messages in thread
* [PATCHv2 2/3] media: hantro: Fix .buf_prepare 2021-05-05 12:23 ` [PATCHv2 0/3] " Andrzej Pietrasiewicz 2021-05-05 12:23 ` [PATCHv2 1/3] media: rkvdec: " Andrzej Pietrasiewicz @ 2021-05-05 12:23 ` Andrzej Pietrasiewicz 2021-05-05 12:23 ` [PATCHv2 3/3] media: cedrus: " Andrzej Pietrasiewicz 2 siblings, 0 replies; 7+ messages in thread From: Andrzej Pietrasiewicz @ 2021-05-05 12:23 UTC (permalink / raw) To: linux-media Cc: devel, Jernej Skrabec, kernel, Greg Kroah-Hartman, Maxime Ripard, Andrzej Pietrasiewicz, Paul Kocialkowski, linux-rockchip, Chen-Yu Tsai, Philipp Zabel, Hans Verkuil, Mauro Carvalho Chehab, Ezequiel Garcia, linux-arm-kernel The driver should only set the payload on .buf_prepare if the buffer is CAPTURE type. If an OUTPUT buffer has a zero bytesused set by userspace then v4l2-core will set it to buffer length. If we overwrite bytesused for OUTPUT buffers, too, then vb2_get_plane_payload() will return incorrect value which might be then written to hw registers by the driver in hantro_g1_h264_dec.c. Signed-off-by: Andrzej Pietrasiewicz <andrzej.p@collabora.com> --- drivers/staging/media/hantro/hantro_v4l2.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/drivers/staging/media/hantro/hantro_v4l2.c b/drivers/staging/media/hantro/hantro_v4l2.c index 1bc118e375a1..7ccc6405036a 100644 --- a/drivers/staging/media/hantro/hantro_v4l2.c +++ b/drivers/staging/media/hantro/hantro_v4l2.c @@ -639,7 +639,14 @@ static int hantro_buf_prepare(struct vb2_buffer *vb) ret = hantro_buf_plane_check(vb, pix_fmt); if (ret) return ret; - vb2_set_plane_payload(vb, 0, pix_fmt->plane_fmt[0].sizeimage); + /* + * Buffer's bytesused must be written by driver for CAPTURE buffers. + * (for OUTPUT buffers, if userspace passes 0 bytesused, v4l2-core sets + * it to buffer length). + */ + if (V4L2_TYPE_IS_CAPTURE(vq->type)) + vb2_set_plane_payload(vb, 0, pix_fmt->plane_fmt[0].sizeimage); + return 0; } -- 2.17.1 _______________________________________________ devel mailing list devel@linuxdriverproject.org http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel ^ permalink raw reply related [flat|nested] 7+ messages in thread
* [PATCHv2 3/3] media: cedrus: Fix .buf_prepare 2021-05-05 12:23 ` [PATCHv2 0/3] " Andrzej Pietrasiewicz 2021-05-05 12:23 ` [PATCHv2 1/3] media: rkvdec: " Andrzej Pietrasiewicz 2021-05-05 12:23 ` [PATCHv2 2/3] media: hantro: " Andrzej Pietrasiewicz @ 2021-05-05 12:23 ` Andrzej Pietrasiewicz 2 siblings, 0 replies; 7+ messages in thread From: Andrzej Pietrasiewicz @ 2021-05-05 12:23 UTC (permalink / raw) To: linux-media Cc: devel, Jernej Skrabec, kernel, Greg Kroah-Hartman, Maxime Ripard, Andrzej Pietrasiewicz, Paul Kocialkowski, linux-rockchip, Chen-Yu Tsai, Philipp Zabel, Hans Verkuil, Mauro Carvalho Chehab, Ezequiel Garcia, linux-arm-kernel The driver should only set the payload on .buf_prepare if the buffer is CAPTURE type. If an OUTPUT buffer has a zero bytesused set by userspace then v4l2-core will set it to buffer length. If we overwrite bytesused for OUTPUT buffers, too, then vb2_get_plane_payload() will return incorrect value which might be then written to hw registers by the driver in cedrus_h264.c or cedrus_vp8.c. Signed-off-by: Andrzej Pietrasiewicz <andrzej.p@collabora.com> --- drivers/staging/media/sunxi/cedrus/cedrus_video.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/drivers/staging/media/sunxi/cedrus/cedrus_video.c b/drivers/staging/media/sunxi/cedrus/cedrus_video.c index b62eb8e84057..bf731caf2ed5 100644 --- a/drivers/staging/media/sunxi/cedrus/cedrus_video.c +++ b/drivers/staging/media/sunxi/cedrus/cedrus_video.c @@ -457,7 +457,13 @@ static int cedrus_buf_prepare(struct vb2_buffer *vb) if (vb2_plane_size(vb, 0) < pix_fmt->sizeimage) return -EINVAL; - vb2_set_plane_payload(vb, 0, pix_fmt->sizeimage); + /* + * Buffer's bytesused must be written by driver for CAPTURE buffers. + * (for OUTPUT buffers, if userspace passes 0 bytesused, v4l2-core sets + * it to buffer length). + */ + if (V4L2_TYPE_IS_CAPTURE(vq->type)) + vb2_set_plane_payload(vb, 0, pix_fmt->sizeimage); return 0; } -- 2.17.1 _______________________________________________ devel mailing list devel@linuxdriverproject.org http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel ^ permalink raw reply related [flat|nested] 7+ messages in thread
end of thread, other threads:[~2021-05-05 12:24 UTC | newest] Thread overview: 7+ messages (download: mbox.gz / follow: Atom feed) -- links below jump to the message on this page -- 2021-05-04 11:37 [PATCH] media: rkvdec: Fix .buf_prepare Andrzej Pietrasiewicz 2021-05-04 11:56 ` Ezequiel Garcia 2021-05-05 12:17 ` Andrzej Pietrasiewicz 2021-05-05 12:23 ` [PATCHv2 0/3] " Andrzej Pietrasiewicz 2021-05-05 12:23 ` [PATCHv2 1/3] media: rkvdec: " Andrzej Pietrasiewicz 2021-05-05 12:23 ` [PATCHv2 2/3] media: hantro: " Andrzej Pietrasiewicz 2021-05-05 12:23 ` [PATCHv2 3/3] media: cedrus: " Andrzej Pietrasiewicz
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).