| Message ID | 20210504113714.30612-1-andrzej.p@collabora.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | media: rkvdec: Fix .buf_prepare | expand |
Hi Andrzej, Thanks a lot for picking this up. On Tue, 2021-05-04 at 13:37 +0200, Andrzej Pietrasiewicz wrote: > From: Ezequiel Garcia <ezequiel@collabora.com> > > The driver should only set the payload on .buf_prepare if the > buffer is CAPTURE type. If an OUTPUT buffer has a zero bytesused > set by userspace then v4l2-core will set it to buffer length. > > Fixes: cd33c830448ba ("media: rkvdec: Add the rkvdec driver") > Signed-off-by: Ezequiel Garcia <ezequiel@collabora.com> > Signed-off-by: Adrian Ratiu <adrian.ratiu@collabora.com> > Signed-off-by: Andrzej Pietrasiewicz <andrzej.p@collabora.com> > > --- > @Hans: I haven't had anyone complain about the issue. The fix is needed for > the rkvdec vp9 work, so I think 5.14 is fine. > > drivers/staging/media/rkvdec/rkvdec.c | 10 +++++++++- > 1 file changed, 9 insertions(+), 1 deletion(-) > > diff --git a/drivers/staging/media/rkvdec/rkvdec.c b/drivers/staging/media/rkvdec/rkvdec.c > index d821661d30f3..ef2166043127 100644 > --- a/drivers/staging/media/rkvdec/rkvdec.c > +++ b/drivers/staging/media/rkvdec/rkvdec.c > @@ -481,7 +481,15 @@ static int rkvdec_buf_prepare(struct vb2_buffer *vb) > if (vb2_plane_size(vb, i) < sizeimage) > return -EINVAL; > } > - vb2_set_plane_payload(vb, 0, f->fmt.pix_mp.plane_fmt[0].sizeimage); > + > + /* > + * Buffer bytesused is written by driver for CAPTURE buffers. > + * (if userspace passes 0 bytesused for OUTPUT buffers, v4l2-core sets > + * it to buffer length). > + */ > + if (!V4L2_TYPE_IS_OUTPUT(vq->type)) Please use V4L2_TYPE_IS_CAPTURE here. Also, why is this change needed in rkvdec, but not in cedrus or hantro? Thanks! Ezequiel
Hi Ezequiel, W dniu 04.05.2021 o 13:56, Ezequiel Garcia pisze: > Hi Andrzej, > > Thanks a lot for picking this up. > > On Tue, 2021-05-04 at 13:37 +0200, Andrzej Pietrasiewicz wrote: >> From: Ezequiel Garcia <ezequiel@collabora.com> >> >> The driver should only set the payload on .buf_prepare if the >> buffer is CAPTURE type. If an OUTPUT buffer has a zero bytesused >> set by userspace then v4l2-core will set it to buffer length. >> >> Fixes: cd33c830448ba ("media: rkvdec: Add the rkvdec driver") >> Signed-off-by: Ezequiel Garcia <ezequiel@collabora.com> >> Signed-off-by: Adrian Ratiu <adrian.ratiu@collabora.com> >> Signed-off-by: Andrzej Pietrasiewicz <andrzej.p@collabora.com> >> >> --- >> @Hans: I haven't had anyone complain about the issue. The fix is needed for >> the rkvdec vp9 work, so I think 5.14 is fine. >> >> drivers/staging/media/rkvdec/rkvdec.c | 10 +++++++++- >> 1 file changed, 9 insertions(+), 1 deletion(-) >> >> diff --git a/drivers/staging/media/rkvdec/rkvdec.c b/drivers/staging/media/rkvdec/rkvdec.c >> index d821661d30f3..ef2166043127 100644 >> --- a/drivers/staging/media/rkvdec/rkvdec.c >> +++ b/drivers/staging/media/rkvdec/rkvdec.c >> @@ -481,7 +481,15 @@ static int rkvdec_buf_prepare(struct vb2_buffer *vb) >> if (vb2_plane_size(vb, i) < sizeimage) >> return -EINVAL; >> } >> - vb2_set_plane_payload(vb, 0, f->fmt.pix_mp.plane_fmt[0].sizeimage); >> + >> + /* >> + * Buffer bytesused is written by driver for CAPTURE buffers. >> + * (if userspace passes 0 bytesused for OUTPUT buffers, v4l2-core sets >> + * it to buffer length). >> + */ >> + if (!V4L2_TYPE_IS_OUTPUT(vq->type)) > > Please use V4L2_TYPE_IS_CAPTURE here. > > Also, why is this change needed in rkvdec, but not in cedrus > or hantro? > As a matter of fact I think it is needed in all three, because later on, whenever a driver uses vb2_get_plane_payload(), without such a patch it will get an invalid number and write that to a hardware register, causing incorrect behavior. I will respond with a v2 series. Regards, Andrzej
Drivers should only set the payload on .buf_prepare if the buffer is CAPTURE type. If an OUTPUT buffer has a zero bytesused set by userspace then v4l2-core will set it to buffer length. If we overwrite bytesused for OUTPUT buffers, too, then vb2_get_plane_payload() will return incorrect value which might be then written to hw registers by the driver. Andrzej Pietrasiewicz (2): media: hantro: Fix .buf_prepare media: cedrus: Fix .buf_prepare Ezequiel Garcia (1): media: rkvdec: Fix .buf_prepare drivers/staging/media/hantro/hantro_v4l2.c | 9 ++++++++- drivers/staging/media/rkvdec/rkvdec.c | 10 +++++++++- drivers/staging/media/sunxi/cedrus/cedrus_video.c | 8 +++++++- 3 files changed, 24 insertions(+), 3 deletions(-) base-commit: 0b276e470a4d43e1365d3eb53c608a3d208cabd4
diff --git a/drivers/staging/media/rkvdec/rkvdec.c b/drivers/staging/media/rkvdec/rkvdec.c index d821661d30f3..ef2166043127 100644 --- a/drivers/staging/media/rkvdec/rkvdec.c +++ b/drivers/staging/media/rkvdec/rkvdec.c @@ -481,7 +481,15 @@ static int rkvdec_buf_prepare(struct vb2_buffer *vb) if (vb2_plane_size(vb, i) < sizeimage) return -EINVAL; } - vb2_set_plane_payload(vb, 0, f->fmt.pix_mp.plane_fmt[0].sizeimage); + + /* + * Buffer bytesused is written by driver for CAPTURE buffers. + * (if userspace passes 0 bytesused for OUTPUT buffers, v4l2-core sets + * it to buffer length). + */ + if (!V4L2_TYPE_IS_OUTPUT(vq->type)) + vb2_set_plane_payload(vb, 0, f->fmt.pix_mp.plane_fmt[0].sizeimage); + return 0; }