linux-kernel - Re: [PATCH] media: imx: Round line size to 4 bytes

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 14 Oct 2021 13:26:26 +0200
From:   Philipp Zabel <p.zabel@...gutronix.de>
To:     Dorota Czaplejewicz <dorota.czaplejewicz@...i.sm>
Cc:     Steve Longerbeam <slongerbeam@...il.com>,
        Mauro Carvalho Chehab <mchehab@...nel.org>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        Shawn Guo <shawnguo@...nel.org>,
        Sascha Hauer <s.hauer@...gutronix.de>,
        Pengutronix Kernel Team <kernel@...gutronix.de>,
        Fabio Estevam <festevam@...il.com>,
        NXP Linux Team <linux-imx@....com>,
        linux-media@...r.kernel.org, linux-staging@...ts.linux.dev,
        linux-arm-kernel@...ts.infradead.org, linux-kernel@...r.kernel.org,
        kernel@...i.sm, phone-devel@...r.kernel.org
Subject: Re: [PATCH] media: imx: Round line size to 4 bytes

Hi Dorota,

On Wed, 2021-10-13 at 11:26 +0200, Dorota Czaplejewicz wrote:
> On Fri, 08 Oct 2021 14:19:41 +0200 Philipp Zabel <p.zabel@...gutronix.de> wrote:
[...]
> > I wonder: if you use 4-byte aligned width and odd height, does the CSI
> > write over the end of the buffer?
> 
> I tested this case, and found a glitch which suggests the last 4 bytes are ignored:
> 
> https://source.puri.sm/Librem5/linux-next/uploads/cfb59e3832431aaa3a69549455502568/image.png

Thank you for testing, so it appears that at least without FBUF_STRIDE
the only requirement is that the whole image size must be a multiple of
8 bytes.

> That would be taken care of rounding up towards a number decided at runtime, like:
> 
> divisor = 8 >> (mbus->height % 2);

Which would then cause the CSI to write past the end of the buffer?

I'd rather make sure that either the number of lines is even or the
width is a multiple of 8 bytes.

> > > Signed-off-by: Dorota Czaplejewicz <dorota.czaplejewicz@...i.sm>
> > > ---
> > > 
> > > Hello,
> > > 
> > > my previous patch identified something that was not a problem,
> > > so I'm sending a different one.
> > > 
> > > This has been tested on the Librem 5.
> > > 
> > > Cheers,
> > > Dorota
> > > 
> > >  drivers/staging/media/imx/imx-media-utils.c | 4 ++--
> > >  1 file changed, 2 insertions(+), 2 deletions(-)
> > > 
> > > diff --git a/drivers/staging/media/imx/imx-media-utils.c b/drivers/staging/media/imx/imx-media-utils.c
> > > index 5128915a5d6f..a303003929e3 100644
> > > --- a/drivers/staging/media/imx/imx-media-utils.c
> > > +++ b/drivers/staging/media/imx/imx-media-utils.c
> > > @@ -545,13 +545,13 @@ int imx_media_mbus_fmt_to_pix_fmt(struct v4l2_pix_format *pix,
> > >  	}
> > >  
> > >  	/* Round up width for minimum burst size */
> > > -	width = round_up(mbus->width, 8);
> > > +	width = round_up(mbus->width, 4);
> > >  
> > >  	/* Round up stride for IDMAC line start address alignment */
> > >  	if (cc->planar)
> > >  		stride = round_up(width, 16);
> > >  	else
> > > -		stride = round_up((width * cc->bpp) >> 3, 8);
> > > +		stride = round_up((width * cc->bpp) >> 3, 4);  
> > 
> > Second, even if this works fine on the i.MX7/8M CSI, the alignment is
> > still required for the i.MX5/6 IPU, for which this code and the comments
> > were written. So we need a way to differentiate the two cases here.
> > 
> > regards
> > Philipp
> 
> How best to go about this? I can see in the file imx-media-capture.c
> that there the video device lives in struct capture_priv.vdev.vfd.
> Would that be the right place to query about the underlying hardware?
> 
> Then the following functions would gain a new "small_divisor" parameter:
> - imx_media_mbus_fmt_to_pix_fmt (a GPL symbol)
> - imx_media_mbus_fmt_to_ipu_image (a GPL symbol)
> - __capture_try_fmt

That sounds like it would work around the current code when it (at least
part of imx_media_mbus_fmt_to_pix_fmt()) should be split between i.MX5/6
and i.MX7/8 implementations. For example rounding up the stride is not
useful on i.MX7/8, it just doesn't currently hurt because imx7-media-csi 
is not using bytesperline to set up FBUF_STRIDE. And certainly the
comments don't apply.

imx_media_mbus_fmt_to_ipu_image() is unused and should probably be
dropped, same as imx_media_ipu_image_to_mbus_fmt().

> Those would have to extract the device type from struct capture_priv:
> - __capture_legacy_try_fmt
> - capture_try_fmt_vid_cap
> - capture_s_fmt_vid_cap
> - capture_init_format

Maybe imx_media_mbus_fmt_to_pix_fmt should be moved into imx-media-
capture.c be passed struct capture_priv to avoid duplicating the device
type check?

imx_media_capture_device_init() could gain a new parameter (or maybe
replace legacy_api) to set the device type.

regards
Philipp