diff mbox

[2/2] media: venus: venc: fix bytesused v4l2_plane field

Message ID 20171009122458.3053-2-stanimir.varbanov@linaro.org (mailing list archive)
State New, archived
Headers show

Commit Message

Stanimir Varbanov Oct. 9, 2017, 12:24 p.m. UTC
This fixes wrongly filled bytesused field of v4l2_plane structure
by include data_offset in the plane, Also fill data_offset and
bytesused for capture type of buffers only.

Signed-off-by: Stanimir Varbanov <stanimir.varbanov@linaro.org>
---
 drivers/media/platform/qcom/venus/venc.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

Comments

Hans Verkuil Oct. 9, 2017, 12:31 p.m. UTC | #1
On 09/10/17 14:24, Stanimir Varbanov wrote:
> This fixes wrongly filled bytesused field of v4l2_plane structure
> by include data_offset in the plane, Also fill data_offset and
> bytesused for capture type of buffers only.
> 
> Signed-off-by: Stanimir Varbanov <stanimir.varbanov@linaro.org>
> ---
>  drivers/media/platform/qcom/venus/venc.c | 9 +++++----
>  1 file changed, 5 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/media/platform/qcom/venus/venc.c b/drivers/media/platform/qcom/venus/venc.c
> index 6f123a387cf9..9445ad492966 100644
> --- a/drivers/media/platform/qcom/venus/venc.c
> +++ b/drivers/media/platform/qcom/venus/venc.c
> @@ -963,15 +963,16 @@ static void venc_buf_done(struct venus_inst *inst, unsigned int buf_type,
>  	if (!vbuf)
>  		return;
>  
> -	vb = &vbuf->vb2_buf;
> -	vb->planes[0].bytesused = bytesused;
> -	vb->planes[0].data_offset = data_offset;
> -
>  	vbuf->flags = flags;
>  
>  	if (type == V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE) {
> +		vb = &vbuf->vb2_buf;
> +		vb2_set_plane_payload(vb, 0, bytesused + data_offset);
> +		vb->planes[0].data_offset = data_offset;
>  		vb->timestamp = timestamp_us * NSEC_PER_USEC;
>  		vbuf->sequence = inst->sequence_cap++;
> +
> +		WARN_ON(vb2_get_plane_payload(vb, 0) > vb2_plane_size(vb, 0));

It's good to have this, but this really should never happen. Because if it is,
then you'll have a memory overwrite. I hope the DMA engine will prevent this?

Just wondering how this works.

The patch looks good otherwise, but that WARN_ON is a bit scary.

Regards,

	Hans

>  	} else {
>  		vbuf->sequence = inst->sequence_out++;
>  	}
>
Stanimir Varbanov Oct. 9, 2017, 10:17 p.m. UTC | #2
Hans,

On  9.10.2017 15:31, Hans Verkuil wrote:
> On 09/10/17 14:24, Stanimir Varbanov wrote:
>> This fixes wrongly filled bytesused field of v4l2_plane structure
>> by include data_offset in the plane, Also fill data_offset and
>> bytesused for capture type of buffers only.
>>
>> Signed-off-by: Stanimir Varbanov <stanimir.varbanov@linaro.org>
>> ---
>>   drivers/media/platform/qcom/venus/venc.c | 9 +++++----
>>   1 file changed, 5 insertions(+), 4 deletions(-)
>>
>> diff --git a/drivers/media/platform/qcom/venus/venc.c b/drivers/media/platform/qcom/venus/venc.c
>> index 6f123a387cf9..9445ad492966 100644
>> --- a/drivers/media/platform/qcom/venus/venc.c
>> +++ b/drivers/media/platform/qcom/venus/venc.c
>> @@ -963,15 +963,16 @@ static void venc_buf_done(struct venus_inst *inst, unsigned int buf_type,
>>   	if (!vbuf)
>>   		return;
>>   
>> -	vb = &vbuf->vb2_buf;
>> -	vb->planes[0].bytesused = bytesused;
>> -	vb->planes[0].data_offset = data_offset;
>> -
>>   	vbuf->flags = flags;
>>   
>>   	if (type == V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE) {
>> +		vb = &vbuf->vb2_buf;
>> +		vb2_set_plane_payload(vb, 0, bytesused + data_offset);
>> +		vb->planes[0].data_offset = data_offset;
>>   		vb->timestamp = timestamp_us * NSEC_PER_USEC;
>>   		vbuf->sequence = inst->sequence_cap++;
>> +
>> +		WARN_ON(vb2_get_plane_payload(vb, 0) > vb2_plane_size(vb, 0));
> 
> It's good to have this, but this really should never happen. Because if it is,
> then you'll have a memory overwrite. I hope the DMA engine will prevent this? >
> Just wondering how this works.
> 
> The patch looks good otherwise, but that WARN_ON is a bit scary.

Infact it is not so scary as it looks like, the IOMMU will catch this 
and generate a fault. So most probably we will never come to the WARN, 
thus the warning is pointless so will delete it.

regards,
Stan
Nicolas Dufresne Oct. 9, 2017, 11:41 p.m. UTC | #3
I confirm this works properly now. This was tested with GStreamer with
the following command:

  gst-launch-1.0 videotestsrc ! v4l2vp8enc ! v4l2vp8dec ! kmssink

And the following patch, which is work in progress to implement
data_offset.

  https://gitlab.collabora.com/nicolas/gst-plugins-good/commit/aaedee9a37e396657568a70fc0110375e14fb4fa

Le lundi 09 octobre 2017 à 15:24 +0300, Stanimir Varbanov a écrit :
> This fixes wrongly filled bytesused field of v4l2_plane structure
> by include data_offset in the plane, Also fill data_offset and
> bytesused for capture type of buffers only.
> 
> Signed-off-by: Stanimir Varbanov <stanimir.varbanov@linaro.org>

Tested-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>

> ---
>  drivers/media/platform/qcom/venus/venc.c | 9 +++++----
>  1 file changed, 5 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/media/platform/qcom/venus/venc.c b/drivers/media/platform/qcom/venus/venc.c
> index 6f123a387cf9..9445ad492966 100644
> --- a/drivers/media/platform/qcom/venus/venc.c
> +++ b/drivers/media/platform/qcom/venus/venc.c
> @@ -963,15 +963,16 @@ static void venc_buf_done(struct venus_inst *inst, unsigned int buf_type,
>  	if (!vbuf)
>  		return;
>  
> -	vb = &vbuf->vb2_buf;
> -	vb->planes[0].bytesused = bytesused;
> -	vb->planes[0].data_offset = data_offset;
> -
>  	vbuf->flags = flags;
>  
>  	if (type == V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE) {
> +		vb = &vbuf->vb2_buf;
> +		vb2_set_plane_payload(vb, 0, bytesused + data_offset);
> +		vb->planes[0].data_offset = data_offset;
>  		vb->timestamp = timestamp_us * NSEC_PER_USEC;
>  		vbuf->sequence = inst->sequence_cap++;
> +
> +		WARN_ON(vb2_get_plane_payload(vb, 0) > vb2_plane_size(vb, 0));
>  	} else {
>  		vbuf->sequence = inst->sequence_out++;
>  	}
diff mbox

Patch

diff --git a/drivers/media/platform/qcom/venus/venc.c b/drivers/media/platform/qcom/venus/venc.c
index 6f123a387cf9..9445ad492966 100644
--- a/drivers/media/platform/qcom/venus/venc.c
+++ b/drivers/media/platform/qcom/venus/venc.c
@@ -963,15 +963,16 @@  static void venc_buf_done(struct venus_inst *inst, unsigned int buf_type,
 	if (!vbuf)
 		return;
 
-	vb = &vbuf->vb2_buf;
-	vb->planes[0].bytesused = bytesused;
-	vb->planes[0].data_offset = data_offset;
-
 	vbuf->flags = flags;
 
 	if (type == V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE) {
+		vb = &vbuf->vb2_buf;
+		vb2_set_plane_payload(vb, 0, bytesused + data_offset);
+		vb->planes[0].data_offset = data_offset;
 		vb->timestamp = timestamp_us * NSEC_PER_USEC;
 		vbuf->sequence = inst->sequence_cap++;
+
+		WARN_ON(vb2_get_plane_payload(vb, 0) > vb2_plane_size(vb, 0));
 	} else {
 		vbuf->sequence = inst->sequence_out++;
 	}