Merge "msm: camera: isp: Buffer size validation at IFE" into dev/msm-4.14-camx (dd759285) · Commits · e / devices / android_kernel_oneplus_sm8150

drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/hw_utils/cam_isp_packet_parser.c

+19 −0

Original line number	Diff line number	Diff line
		@@ -473,6 +473,7 @@ int cam_isp_add_io_buffers(
		int32_t hdl;
		int mmu_hdl;
		bool mode, is_buf_secure;
		uint64_t req_id;

		io_cfg = (struct cam_buf_io_cfg ) ((uint8_t )
		&prepare->packet->payload +
		@@ -481,6 +482,7 @@ int cam_isp_add_io_buffers(
		num_in_buf = 0;
		io_cfg_used_bytes = 0;
		prepare->pf_data->packet = prepare->packet;
		req_id = prepare->packet->header.request_id;

		/* Max one hw entries required for each base */
		if (prepare->num_hw_update_entries + 1 >=
		@@ -628,6 +630,23 @@ int cam_isp_add_io_buffers(
		return rc;
		}

		if (j == 0) {
		rc = cam_packet_validate_plane_size(
		&io_cfg[i],
		plane_id,
		size);
		if (rc) {
		CAM_ERR(CAM_ISP,
		"Invalid buffer size, port 0x%x plane %d req_id %llu format %d memh 0x%x",
		io_cfg[i].resource_type,
		plane_id,
		req_id,
		io_cfg[i].format,
		io_cfg[i].mem_handle[plane_id]);
		return -EINVAL;
		}
		}

		/* need to update with offset */
		io_addr[plane_id] +=
		io_cfg[i].offsets[plane_id];

drivers/media/platform/msm/camera/cam_utils/cam_packet_util.c

+118 −0

Original line number	Diff line number	Diff line
		@@ -353,3 +353,121 @@ int cam_packet_util_process_generic_cmd_buffer(

		return rc;
		}

		int32_t cam_packet_validate_plane_size(
		struct cam_buf_io_cfg *io_cfg,
		int plane_index,
		size_t size)
		{
		int rc = 0;
		uint32_t kmd_plane_size = 0;
		uint32_t bpp = io_cfg->bpp;
		uint32_t plane_stride = 0;
		uint32_t slice_height = 0;
		uint32_t metadata_size = 0;
		uint32_t format = io_cfg->format;
		uint32_t plane_pixel_size = 0;

		if (plane_index < CAM_PACKET_MAX_PLANES) {
		plane_stride = io_cfg->planes[plane_index].plane_stride;
		slice_height = io_cfg->planes[plane_index].slice_height;
		}

		if (!(plane_stride && slice_height)) {
		CAM_ERR(CAM_ISP,
		"Invalid values from UMD stride %d, slice height %d",
		plane_stride,
		slice_height);
		return -EINVAL;
		}

		switch (format) {
		case CAM_FORMAT_MIPI_RAW_6:
		case CAM_FORMAT_MIPI_RAW_8:
		kmd_plane_size = ((plane_stride * slice_height) + 16 - 1)
		/ 16 * 16;
		break;
		case CAM_FORMAT_MIPI_RAW_10:
		if (plane_stride % 4 == 0)
		kmd_plane_size = ((plane_stride * slice_height)
		+ 16 - 1) / 16 * 16;
		break;
		case CAM_FORMAT_MIPI_RAW_12:
		if (plane_stride % 2 == 0)
		kmd_plane_size = ((plane_stride * slice_height)
		+ 16 - 1) / 16 * 16;
		break;
		case CAM_FORMAT_MIPI_RAW_14:
		if (plane_stride % 4 == 0)
		kmd_plane_size = plane_stride * slice_height * 7 / 4;
		break;
		case CAM_FORMAT_PLAIN16_8:
		case CAM_FORMAT_PLAIN16_10:
		case CAM_FORMAT_PLAIN16_12:
		case CAM_FORMAT_PLAIN16_14:
		case CAM_FORMAT_PLAIN16_16:
		if (bpp == 8 \|\| bpp == 10 \|\| bpp == 12
		\|\| bpp == 14 \|\| bpp == 16)
		kmd_plane_size = plane_stride * slice_height;
		break;
		case CAM_FORMAT_PLAIN64:
		if (bpp == 64)
		kmd_plane_size = plane_stride * slice_height;
		break;
		case CAM_FORMAT_NV21:
		case CAM_FORMAT_NV12:
		if (plane_index < CAM_PACKET_MAX_PLANES)
		kmd_plane_size = plane_stride * slice_height;
		break;
		case CAM_FORMAT_PD10:
		if (plane_index < CAM_PACKET_MAX_PLANES)
		kmd_plane_size = plane_stride * slice_height;
		break;
		case CAM_FORMAT_UBWC_NV12:
		case CAM_FORMAT_UBWC_NV12_4R:
		case CAM_FORMAT_UBWC_TP10:
		metadata_size = io_cfg->planes[plane_index].meta_size;
		plane_pixel_size = ((plane_stride * slice_height) +
		(4096 - 1)) & ~((uint32_t) 4096 - 1);
		kmd_plane_size = metadata_size + plane_pixel_size;
		break;
		case CAM_FORMAT_UBWC_P010:
		case CAM_FORMAT_PLAIN32_20:
		case CAM_FORMAT_TP10:
		case CAM_FORMAT_YUV422:
		case CAM_FORMAT_PD8:
		case CAM_FORMAT_PLAIN128:
		case CAM_FORMAT_ARGB:
		case CAM_FORMAT_ARGB_10:
		case CAM_FORMAT_ARGB_12:
		case CAM_FORMAT_ARGB_14:
		case CAM_FORMAT_MIPI_RAW_16:
		case CAM_FORMAT_MIPI_RAW_20:
		case CAM_FORMAT_QTI_RAW_8:
		case CAM_FORMAT_QTI_RAW_10:
		case CAM_FORMAT_QTI_RAW_12:
		case CAM_FORMAT_QTI_RAW_14:
		case CAM_FORMAT_PLAIN8:
		case CAM_FORMAT_PLAIN8_SWAP:
		case CAM_FORMAT_PLAIN8_10:
		case CAM_FORMAT_PLAIN8_10_SWAP:
		kmd_plane_size = plane_stride * slice_height;
		break;
		default:
		kmd_plane_size = plane_stride * slice_height;
		break;
		}
		if (!kmd_plane_size \|\|
		kmd_plane_size > (size - io_cfg->offsets[plane_index])) {
		CAM_ERR(CAM_ISP,
		"kmd size: %d umd size: %d width: %d height: %d stride: %d sliceheight: %d ",
		kmd_plane_size,
		size,
		io_cfg->planes[plane_index].width,
		io_cfg->planes[plane_index].height,
		plane_stride,
		slice_height);
		return -EINVAL;
		}
		return rc;
		}

drivers/media/platform/msm/camera/cam_utils/cam_packet_util.h

+16 −0

Original line number	Diff line number	Diff line
		@@ -135,4 +135,20 @@ int cam_packet_util_process_generic_cmd_buffer(
		struct cam_cmd_buf_desc *cmd_buf,
		cam_packet_generic_blob_handler blob_handler_cb, void *user_data);

		/**
		* cam_packet_validate_plane_size()
		*
		* @brief: Utility function to calculate and validate size of buffer
		* required for a format.
		* @io_cfg: Contains IO config info
		* @plane_index Plane index for which size is to be calculated
		*
		* @return: Size of buffer
		*
		*/
		int32_t cam_packet_validate_plane_size(
		struct cam_buf_io_cfg *io_cfg,
		int plane_index,
		size_t size);

		#endif /* _CAM_PACKET_UTIL_H_ */