From patchwork Wed Mar 8 03:40:58 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Wu-Cheng Li X-Patchwork-Id: 9610301 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 9DAA5604DD for ; Wed, 8 Mar 2017 03:42:01 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 7BBCB2041F for ; Wed, 8 Mar 2017 03:42:01 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 6F74C25D99; Wed, 8 Mar 2017 03:42:01 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-1.9 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID autolearn=unavailable version=3.3.1 Received: from bombadil.infradead.org (bombadil.infradead.org [65.50.211.133]) (using TLSv1.2 with cipher AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id A8E472041F for ; Wed, 8 Mar 2017 03:42:00 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20170209; h=Sender: Content-Transfer-Encoding:Content-Type:MIME-Version:Cc:List-Subscribe: List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id:References: In-Reply-To:Message-Id:Date:Subject:To:From:Reply-To:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Owner; bh=VVfB6HUbGvSsFxv23392XYUvcTxDIPi8EzXV4aeysFs=; b=KnpbXOhPjB6U0zMl/haR6acZTu tw63LPt0sfjyLUmUt1c0pZD3fXeMaDrtA7vCDWfhH3+hMtMKU1SwS/nrXCz9g5d7baKhcdlEGk3Y4 mDFAsBpcDo/C5Qi6fFsEok/dFWEenQjqEINmw0gBYNJ2nJlQN1vHdj/anucDvXA9erEEgFD7EpzuU b1wmIcOdbM19GoHpAKAuQqVOa0tkLtjsyF9lJa5dvowlJ8srHYGCR/ogpddCaS8oS9xggIFh4gdjM 1tRp/HVYEGjGyoHDEY2LaVWsw+ox6/WDJam9OtzAc1MfUp7BPJZTw192NtjhmDk7DcDfG3Lxb5h2T zWFE0t9g==; Received: from localhost ([127.0.0.1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.87 #1 (Red Hat Linux)) id 1clSUC-0000xr-AN; Wed, 08 Mar 2017 03:42:00 +0000 Received: from merlin.infradead.org ([2001:4978:20e::2]) by bombadil.infradead.org with esmtps (Exim 4.87 #1 (Red Hat Linux)) id 1clSTk-0000jf-3P for linux-mediatek@bombadil.infradead.org; Wed, 08 Mar 2017 03:41:32 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=infradead.org; s=merlin.20170209; h=References:In-Reply-To:Message-Id:Date: Subject:Cc:To:From:Sender:Reply-To:MIME-Version:Content-Type: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=V32QkuMmd0xUNtU5tGYkiZQTdjgbfsWK+FZ5QkJTJtM=; b=Pgq/tvIy5J0Az777trV/duEFi FXSFm7Kff2zDCBJG7+XJ5nW50OdbNEsBVqdx9Ir9Qq7fbF173QL/+J6Dp4MT9ClOSuuv/9BuFcIBG vdA/1ETzJ+iYVnb8QIexqbNy9rLyFcH2/V8wxTuotiOrP+xgwmJcJENOlzB29RUbp/eyLfCTHcELX 2fXmGrLUx/b/HqcOAdl4wa/o1ZlhZ2HiK8EBgRB5hK/DxJ6NScMRiuVPO+JWXwdyL1CcIEBoP4SoE Yi3AlEde4Z6I44vFwGKbuCwrofLwxbNbcQHM8NSTIXPt82QaG1lA/pwk1mXFBoqNT7ddEq4fX4I/X wPpiPtBgg==; Received: from mail-pf0-x236.google.com ([2607:f8b0:400e:c00::236]) by merlin.infradead.org with esmtps (Exim 4.87 #1 (Red Hat Linux)) id 1clSTh-0000UJ-Ug for linux-mediatek@lists.infradead.org; Wed, 08 Mar 2017 03:41:31 +0000 Received: by mail-pf0-x236.google.com with SMTP id v190so8927452pfb.1 for ; Tue, 07 Mar 2017 19:41:08 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=V32QkuMmd0xUNtU5tGYkiZQTdjgbfsWK+FZ5QkJTJtM=; b=PvMUqDTyWEch8sxTxnqhSrTqC8Y92Tnv2BG4tRNBcS8p9EqFwe0M4et3bwflICB0Rk xPd42jXcdy+qV+ZMixRzBnbP5/TlOKo2kubPdt3p5HwNQa+RGiZS2MZmUhHqyJyvrz4o HW0yoPoUsj6cpxFDoQBSQGu8+qsqprNGMZQ1k= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=V32QkuMmd0xUNtU5tGYkiZQTdjgbfsWK+FZ5QkJTJtM=; b=KfhZbogbJKJxAdVHJ/OXHzapiOItj5au1ZvbVwjH7IsavyVVMuP6eAon3XvG3jQcgG v/Zvw2UfXO6ucOW5ayUIlYn2zh5RBdV1BNLxWjUIDLyRFLnaQRYKptcgEx8ZKC8qZ1P+ RFUaHKn3KKAcpir5LTnb9hztYccUH240WVzGkbwzQVYx5RARpg9UpFSPnmNbso1snBI5 o60xt7pFveZbrJ04EMySPDawJqNKzLuOYi1osrmUlrgpUB2l9N2R7x90GL6ooguBbKKR 896QsUEgpgc1EXz3jd4S2UuYDWwo4saip+FLrxOXvNEuhckAaqDvtAWIWQ0z+fBM29F0 2H4w== X-Gm-Message-State: AMke39nwoJdFga/NUdP/gG1OlM51izZc7fCHORbJHakfXKeNAbP5IzVt1SHNgjB9Te1MFxO4 X-Received: by 10.84.241.10 with SMTP id a10mr5428012pll.47.1488944467493; Tue, 07 Mar 2017 19:41:07 -0800 (PST) Received: from wuchengli-z840.tpe.corp.google.com ([172.30.210.26]) by smtp.gmail.com with ESMTPSA id s26sm2406193pge.33.2017.03.07.19.41.04 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Tue, 07 Mar 2017 19:41:06 -0800 (PST) From: Wu-Cheng Li To: pawel@osciak.com, tiffany.lin@mediatek.com, andrew-ct.chen@mediatek.com, mchehab@kernel.org, matthias.bgg@gmail.com, hans.verkuil@cisco.com, wuchengli@google.com Subject: [PATCH v3 1/1] mtk-vcodec: check the vp9 decoder buffer index from VPU. Date: Wed, 8 Mar 2017 11:40:58 +0800 Message-Id: <20170308034058.99886-2-wuchengli@chromium.org> X-Mailer: git-send-email 2.12.0.246.ga2ecc84866-goog In-Reply-To: <20170308034058.99886-1-wuchengli@chromium.org> References: <20170308034058.99886-1-wuchengli@chromium.org> X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20170307_224130_118763_0DEC091B X-CRM114-Status: GOOD ( 15.56 ) X-BeenThere: linux-mediatek@lists.infradead.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: linux-kernel@vger.kernel.org, Wu-Cheng Li , linux-mediatek@lists.infradead.org, linux-arm-kernel@lists.infradead.org, linux-media@vger.kernel.org MIME-Version: 1.0 Sender: "Linux-mediatek" Errors-To: linux-mediatek-bounces+patchwork-linux-mediatek=patchwork.kernel.org@lists.infradead.org X-Virus-Scanned: ClamAV using ClamSMTP From: Wu-Cheng Li VPU firmware has a bug and may return invalid buffer index for some vp9 videos. Check the buffer indexes before accessing the buffer. Signed-off-by: Wu-Cheng Li Acked-by: Tiffany Lin --- drivers/media/platform/mtk-vcodec/mtk_vcodec_dec.c | 33 +++++++++++++++++----- drivers/media/platform/mtk-vcodec/mtk_vcodec_dec.h | 2 ++ .../media/platform/mtk-vcodec/vdec/vdec_vp9_if.c | 26 +++++++++++++++++ drivers/media/platform/mtk-vcodec/vdec_drv_if.h | 2 ++ 4 files changed, 56 insertions(+), 7 deletions(-) diff --git a/drivers/media/platform/mtk-vcodec/mtk_vcodec_dec.c b/drivers/media/platform/mtk-vcodec/mtk_vcodec_dec.c index 502877a4b1df..a60b538686ea 100644 --- a/drivers/media/platform/mtk-vcodec/mtk_vcodec_dec.c +++ b/drivers/media/platform/mtk-vcodec/mtk_vcodec_dec.c @@ -420,6 +420,11 @@ static void mtk_vdec_worker(struct work_struct *work) dst_buf->index, ret, res_chg); src_buf = v4l2_m2m_src_buf_remove(ctx->m2m_ctx); + if (ret == -EIO) { + mutex_lock(&ctx->lock); + src_buf_info->error = true; + mutex_unlock(&ctx->lock); + } v4l2_m2m_buf_done(&src_buf_info->vb, VB2_BUF_STATE_ERROR); } else if (res_chg == false) { /* @@ -1170,8 +1175,16 @@ static void vb2ops_vdec_buf_queue(struct vb2_buffer *vb) */ src_buf = v4l2_m2m_src_buf_remove(ctx->m2m_ctx); - v4l2_m2m_buf_done(to_vb2_v4l2_buffer(src_buf), - VB2_BUF_STATE_DONE); + if (ret == -EIO) { + mtk_v4l2_err("[%d] Unrecoverable error in vdec_if_decode.", + ctx->id); + ctx->state = MTK_STATE_ABORT; + v4l2_m2m_buf_done(to_vb2_v4l2_buffer(src_buf), + VB2_BUF_STATE_ERROR); + } else { + v4l2_m2m_buf_done(to_vb2_v4l2_buffer(src_buf), + VB2_BUF_STATE_DONE); + } mtk_v4l2_debug(ret ? 0 : 1, "[%d] vdec_if_decode() src_buf=%d, size=%zu, fail=%d, res_chg=%d", ctx->id, src_buf->index, @@ -1216,16 +1229,22 @@ static void vb2ops_vdec_buf_finish(struct vb2_buffer *vb) struct mtk_vcodec_ctx *ctx = vb2_get_drv_priv(vb->vb2_queue); struct vb2_v4l2_buffer *vb2_v4l2; struct mtk_video_dec_buf *buf; - - if (vb->vb2_queue->type != V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE) - return; + bool buf_error; vb2_v4l2 = container_of(vb, struct vb2_v4l2_buffer, vb2_buf); buf = container_of(vb2_v4l2, struct mtk_video_dec_buf, vb); mutex_lock(&ctx->lock); - buf->queued_in_v4l2 = false; - buf->queued_in_vb2 = false; + if (vb->vb2_queue->type == V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE) { + buf->queued_in_v4l2 = false; + buf->queued_in_vb2 = false; + } + buf_error = buf->error; mutex_unlock(&ctx->lock); + + if (buf_error) { + mtk_v4l2_err("Unrecoverable error on buffer."); + ctx->state = MTK_STATE_ABORT; + } } static int vb2ops_vdec_buf_init(struct vb2_buffer *vb) diff --git a/drivers/media/platform/mtk-vcodec/mtk_vcodec_dec.h b/drivers/media/platform/mtk-vcodec/mtk_vcodec_dec.h index 362f5a85762e..dc4fc1df63c5 100644 --- a/drivers/media/platform/mtk-vcodec/mtk_vcodec_dec.h +++ b/drivers/media/platform/mtk-vcodec/mtk_vcodec_dec.h @@ -50,6 +50,7 @@ struct vdec_fb { * @queued_in_v4l2: Capture buffer is in v4l2 driver, but not in vb2 * queue yet * @lastframe: Intput buffer is last buffer - EOS + * @error: An unrecoverable error occurs on this buffer. * @frame_buffer: Decode status, and buffer information of Capture buffer * * Note : These status information help us track and debug buffer state @@ -63,6 +64,7 @@ struct mtk_video_dec_buf { bool queued_in_vb2; bool queued_in_v4l2; bool lastframe; + bool error; struct vdec_fb frame_buffer; }; diff --git a/drivers/media/platform/mtk-vcodec/vdec/vdec_vp9_if.c b/drivers/media/platform/mtk-vcodec/vdec/vdec_vp9_if.c index e91a3b425b0c..5539b1853f16 100644 --- a/drivers/media/platform/mtk-vcodec/vdec/vdec_vp9_if.c +++ b/drivers/media/platform/mtk-vcodec/vdec/vdec_vp9_if.c @@ -718,6 +718,26 @@ static void get_free_fb(struct vdec_vp9_inst *inst, struct vdec_fb **out_fb) *out_fb = fb; } +static int validate_vsi_array_indexes(struct vdec_vp9_inst *inst, + struct vdec_vp9_vsi *vsi) { + if (vsi->sf_frm_idx >= VP9_MAX_FRM_BUF_NUM - 1) { + mtk_vcodec_err(inst, "Invalid vsi->sf_frm_idx=%u.", + vsi->sf_frm_idx); + return -EIO; + } + if (vsi->frm_to_show_idx >= VP9_MAX_FRM_BUF_NUM) { + mtk_vcodec_err(inst, "Invalid vsi->frm_to_show_idx=%u.", + vsi->frm_to_show_idx); + return -EIO; + } + if (vsi->new_fb_idx >= VP9_MAX_FRM_BUF_NUM) { + mtk_vcodec_err(inst, "Invalid vsi->new_fb_idx=%u.", + vsi->new_fb_idx); + return -EIO; + } + return 0; +} + static void vdec_vp9_deinit(unsigned long h_vdec) { struct vdec_vp9_inst *inst = (struct vdec_vp9_inst *)h_vdec; @@ -834,6 +854,12 @@ static int vdec_vp9_decode(unsigned long h_vdec, struct mtk_vcodec_mem *bs, goto DECODE_ERROR; } + ret = validate_vsi_array_indexes(inst, vsi); + if (ret) { + mtk_vcodec_err(inst, "Invalid values from VPU."); + goto DECODE_ERROR; + } + if (vsi->resolution_changed) { if (!vp9_alloc_work_buf(inst)) { ret = -EINVAL; diff --git a/drivers/media/platform/mtk-vcodec/vdec_drv_if.h b/drivers/media/platform/mtk-vcodec/vdec_drv_if.h index db6b5205ffb1..ded1154481cd 100644 --- a/drivers/media/platform/mtk-vcodec/vdec_drv_if.h +++ b/drivers/media/platform/mtk-vcodec/vdec_drv_if.h @@ -85,6 +85,8 @@ void vdec_if_deinit(struct mtk_vcodec_ctx *ctx); * @res_chg : [out] resolution change happens if current bs have different * picture width/height * Note: To flush the decoder when reaching EOF, set input bitstream as NULL. + * + * Return: 0 on success. -EIO on unrecoverable error. */ int vdec_if_decode(struct mtk_vcodec_ctx *ctx, struct mtk_vcodec_mem *bs, struct vdec_fb *fb, bool *res_chg);