lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:   Fri, 12 Apr 2019 12:13:46 +0000
From:   <Eugen.Hristev@...rochip.com>
To:     <hverkuil@...all.nl>, <linux-media@...r.kernel.org>,
        <linux-arm-kernel@...ts.infradead.org>,
        <linux-kernel@...r.kernel.org>
CC:     <ksloat@...pglobal.com>, <mchehab@...nel.org>
Subject: Re: [PATCH 1/3] media: atmel: atmel-isc: limit incoming pixels per
 frame



On 12.04.2019 15:06, Hans Verkuil wrote:
> External E-Mail
> 
> 
> On 4/12/19 2:02 PM, Eugen.Hristev@...rochip.com wrote:
>>
>>
>> On 12.04.2019 14:50, Hans Verkuil wrote:
>>
>>>
>>> On 4/12/19 12:19 PM, Eugen.Hristev@...rochip.com wrote:
>>>> From: Eugen Hristev <eugen.hristev@...rochip.com>
>>>>
>>>> This will limit the incoming pixels per frame from the sensor.
>>>> Currently, the ISC will stop sampling the frame only when the vsync/hsync
>>>> are detected.
>>>> If we misconfigure the resolution in the sensor w.r.t. resolution in the ISC,
>>>> the buffer used for DMA in the ISC will be smaller than the number of pixels
>>>> that the ISC DMA engine will copy.
>>>> In this case it happens that the DMA will overwrite parts of the memory which
>>>> should not be written, leading to memory corruption.
>>>> To avoid this situation, use the PFE CFG1 and PFE CFG2 registers, which crop
>>>> the incoming frame to the resolution that we configure.
>>>> This way the DMA engine will never write more data than we expect it to.
>>>>
>>>> Signed-off-by: Eugen Hristev <eugen.hristev@...rochip.com>
>>>> ---
>>>>    drivers/media/platform/atmel/atmel-isc-regs.h | 19 +++++++++++++++
>>>>    drivers/media/platform/atmel/atmel-isc.c      | 34 +++++++++++++++++++++++++++
>>>>    2 files changed, 53 insertions(+)
>>>>
>>>> diff --git a/drivers/media/platform/atmel/atmel-isc-regs.h b/drivers/media/platform/atmel/atmel-isc-regs.h
>>>> index 2aadc19..768a5ad 100644
>>>> --- a/drivers/media/platform/atmel/atmel-isc-regs.h
>>>> +++ b/drivers/media/platform/atmel/atmel-isc-regs.h
>>>> @@ -35,6 +35,25 @@
>>>>    #define ISC_PFG_CFG0_BPS_TWELVE (0x0 << 28)
>>>>    #define ISC_PFE_CFG0_BPS_MASK   GENMASK(30, 28)
>>>>    
>>>> +#define ISC_PFE_CFG0_COLEN	BIT(12)
>>>> +#define ISC_PFE_CFG0_ROWEN	BIT(13)
>>>> +
>>>> +/* ISC Parallel Front End Configuration 1 Register */
>>>> +#define ISC_PFE_CFG1    0x00000010
>>>> +
>>>> +#define ISC_PFE_CFG1_COLMIN(v)		((v))
>>>> +#define ISC_PFE_CFG1_COLMIN_MASK	GENMASK(15, 0)
>>>> +#define ISC_PFE_CFG1_COLMAX(v)		((v) << 16)
>>>> +#define ISC_PFE_CFG1_COLMAX_MASK	GENMASK(31, 16)
>>>> +
>>>> +/* ISC Parallel Front End Configuration 2 Register */
>>>> +#define ISC_PFE_CFG2    0x00000014
>>>> +
>>>> +#define ISC_PFE_CFG2_ROWMIN(v)		((v))
>>>> +#define ISC_PFE_CFG2_ROWMIN_MASK	GENMASK(15, 0)
>>>> +#define ISC_PFE_CFG2_ROWMAX(v)		((v) << 16)
>>>> +#define ISC_PFE_CFG2_ROWMAX_MASK	GENMASK(31, 16)
>>>> +
>>>>    /* ISC Clock Enable Register */
>>>>    #define ISC_CLKEN               0x00000018
>>>>    
>>>> diff --git a/drivers/media/platform/atmel/atmel-isc.c b/drivers/media/platform/atmel/atmel-isc.c
>>>> index a10db16..ea7520a 100644
>>>> --- a/drivers/media/platform/atmel/atmel-isc.c
>>>> +++ b/drivers/media/platform/atmel/atmel-isc.c
>>>> @@ -721,6 +721,40 @@ static void isc_start_dma(struct isc_device *isc)
>>>>    	u32 sizeimage = isc->fmt.fmt.pix.sizeimage;
>>>>    	u32 dctrl_dview;
>>>>    	dma_addr_t addr0;
>>>> +	u32 h, w;
>>>> +
>>>> +	h = isc->fmt.fmt.pix.height;
>>>> +	w = isc->fmt.fmt.pix.width;
>>>> +
>>>> +	/*
>>>> +	 * In case the sensor is not RAW, it will output a pixel (12-16 bits)
>>>> +	 * with two samples on the ISC Data bus (which is 8-12)
>>>> +	 * ISC will count each sample, so, we need to multiply these values
>>>> +	 * by two, to get the real number of samples for the required pixels.
>>>> +	 */
>>>> +	if (!ISC_IS_FORMAT_RAW(isc->config.sd_format->mbus_code)) {
>>>
>>> The ISC_IS_FORMAT_RAW define doesn't exist?!
>>>
>>> Something clearly went wrong...
>>>
>>> Regards,
>>>
>>> 	Hans
>>
>> Hello Hans,
>>
>> Sorry , I forgot to copy this from the previous series
>> (https://www.spinics.net/lists/linux-media/msg149501.html for reference):
>>
>> It applies only on top of my previous patchset:
>> media: atmel: atmel-isc: removed ARGB32 added ABGR32 and XBGR32
>> media: atmel: atmel-isc: reworked driver and formats
>> available at:
>> https://git.linuxtv.org/hverkuil/media_tree.git/commit/?h=for-v5.2b&id=03ef1b56cba6ad17f6ead13c85a81e0e80fbc9d1
>>
>> So it should work on top of those patches...
> 
> Ah, now I see. I'll park this patch series until the pull request containing
> those two patches is merged. Feel free to remind me of this series once Mauro
> merged that pull request.

Thank you.

I mostly sent this series to get your early review. It would be 
important to get the new feature set integrated, so, thank you for that, 
and I will send the v2 on the new feature set, so I can work on it until 
the first patches are merged.

Eugen

> 
> Regards,
> 
> 	Hans
> 
>>
>> Eugen
>>
>>
>>>
>>>
>>>> +		h <<= 1;
>>>> +		w <<= 1;
>>>> +	}
>>>> +
>>>> +	/*
>>>> +	 * We limit the column/row count that the ISC will output according
>>>> +	 * to the configured resolution that we want.
>>>> +	 * This will avoid the situation where the sensor is misconfigured,
>>>> +	 * sending more data, and the ISC will just take it and DMA to memory,
>>>> +	 * causing corruption.
>>>> +	 */
>>>> +	regmap_write(regmap, ISC_PFE_CFG1,
>>>> +		     (ISC_PFE_CFG1_COLMIN(0) & ISC_PFE_CFG1_COLMIN_MASK) |
>>>> +		     (ISC_PFE_CFG1_COLMAX(w - 1) & ISC_PFE_CFG1_COLMAX_MASK));
>>>> +
>>>> +	regmap_write(regmap, ISC_PFE_CFG2,
>>>> +		     (ISC_PFE_CFG2_ROWMIN(0) & ISC_PFE_CFG2_ROWMIN_MASK) |
>>>> +		     (ISC_PFE_CFG2_ROWMAX(h - 1) & ISC_PFE_CFG2_ROWMAX_MASK));
>>>> +
>>>> +	regmap_update_bits(regmap, ISC_PFE_CFG0,
>>>> +			   ISC_PFE_CFG0_COLEN | ISC_PFE_CFG0_ROWEN,
>>>> +			   ISC_PFE_CFG0_COLEN | ISC_PFE_CFG0_ROWEN);
>>>>    
>>>>    	addr0 = vb2_dma_contig_plane_dma_addr(&isc->cur_frm->vb.vb2_buf, 0);
>>>>    	regmap_write(regmap, ISC_DAD0, addr0);
>>>>
>>>
>>>
>>> _______________________________________________
>>> linux-arm-kernel mailing list
>>> linux-arm-kernel@...ts.infradead.org
>>> http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
>>>
>>>
> 

Powered by blists - more mailing lists