From 5cd93510201e833b8491d1a3ea273b45eff57ab0 Mon Sep 17 00:00:00 2001 From: Zhi Zhou Date: Tue, 23 Jan 2018 12:32:38 +0800 Subject: [PATCH] media: fix unsupport 12bit may crashed bug. PD#159195 PD#159359 1. unspport 12 bit depth, set fatal_error,when >=10bit; 2. doublewtite 0x100 crash bug. Change-Id: I6366b769c3be75b3cc44e606d3317272053b6723 --- .../frame_provider/decoder/h265/vh265.c | 34 ++++++++++++++++++- .../frame_provider/decoder/vp9/vvp9.c | 21 ++++++++---- 2 files changed, 48 insertions(+), 7 deletions(-) diff --git a/drivers/amlogic/media_modules/frame_provider/decoder/h265/vh265.c b/drivers/amlogic/media_modules/frame_provider/decoder/h265/vh265.c index e3592a61f179..1ec8b1dd6579 100644 --- a/drivers/amlogic/media_modules/frame_provider/decoder/h265/vh265.c +++ b/drivers/amlogic/media_modules/frame_provider/decoder/h265/vh265.c @@ -5076,6 +5076,17 @@ static int hevc_slice_segment_header_process(struct hevc_state_s *hevc, hevc->fatal_error |= DECODER_FATAL_ERROR_SIZE_OVERFLOW; return 3; } + if (hevc->bit_depth_chroma > 10 || + hevc->bit_depth_luma > 10) { + pr_info("unsupport bitdepth : %u,%u\n", + hevc->bit_depth_chroma, + hevc->bit_depth_luma); + if (!hevc->m_ins_flag) + debug |= (H265_DEBUG_DIS_LOC_ERROR_PROC | + H265_DEBUG_DIS_SYS_ERROR_PROC); + hevc->fatal_error |= DECODER_FATAL_ERROR_SIZE_OVERFLOW; + return 4; + } /* it will cause divide 0 error */ if (hevc->pic_w == 0 || hevc->pic_h == 0) { @@ -5592,6 +5603,13 @@ static int H265_alloc_mmu(struct hevc_state_s *hevc, struct PIC_s *new_pic, decoder_mmu_box_free_idx(hevc->mmu_box, new_pic->index); new_pic->scatter_alloc = 0; } + if (cur_mmu_4k_number > MAX_FRAME_4K_NUM) { + pr_err("over max !! 0x%x width %d height %d\n", + cur_mmu_4k_number, + new_pic->width, + new_pic->height); + return -1; + } ret = decoder_mmu_box_alloc_idx( hevc->mmu_box, cur_buf_idx, @@ -8468,7 +8486,12 @@ int vh265_dec_status(struct vdec_s *vdec, struct vdec_info *vstatus) int vh265_dec_status(struct vdec_info *vstatus) #endif { +#ifdef MULTI_INSTANCE_SUPPORT + struct hevc_state_s *hevc = + (struct hevc_state_s *)vdec->private; +#else struct hevc_state_s *hevc = &gHevc; +#endif vstatus->frame_width = hevc->frame_width; vstatus->frame_height = hevc->frame_height; if (hevc->frame_dur != 0) @@ -8491,9 +8514,10 @@ int vh265_dec_status(struct vdec_info *vstatus) vstatus->samp_cnt = gvs->samp_cnt; vstatus->offset = gvs->offset; } +#endif snprintf(vstatus->vdec_name, sizeof(vstatus->vdec_name), "%s", DRIVER_NAME); -#endif + return 0; } @@ -9499,6 +9523,14 @@ static bool run_ready(struct vdec_s *vdec) if (hevc->eos) return 0; + if ((hevc->fatal_error & + DECODER_FATAL_ERROR_SIZE_OVERFLOW) || + (hevc->fatal_error & DECODER_FATAL_ERROR_UNKNOWN)) { + /*decoder fatal error, + *disable run. + */ + return 0; + } if (disp_vframe_valve_level && kfifo_len(&hevc->display_q) >= diff --git a/drivers/amlogic/media_modules/frame_provider/decoder/vp9/vvp9.c b/drivers/amlogic/media_modules/frame_provider/decoder/vp9/vvp9.c index edd42d640bb8..306f7ab3eb3a 100644 --- a/drivers/amlogic/media_modules/frame_provider/decoder/vp9/vvp9.c +++ b/drivers/amlogic/media_modules/frame_provider/decoder/vp9/vvp9.c @@ -1451,10 +1451,14 @@ static int get_double_write_mode(struct VP9Decoder_s *pbi) u32 dw; if (valid_dw_mode == 0x100) { struct VP9_Common_s *cm = &pbi->common; - struct PIC_BUFFER_CONFIG_s *cur_pic_config - = &cm->cur_frame->buf; - int w = cur_pic_config->y_crop_width; - int h = cur_pic_config->y_crop_width; + struct PIC_BUFFER_CONFIG_s *cur_pic_config; + int w, h; + + if (!cm->cur_frame) + return 1;/*no valid frame,*/ + cur_pic_config = &cm->cur_frame->buf; + w = cur_pic_config->y_crop_width; + h = cur_pic_config->y_crop_width; if (w > 1920 && h > 1088) dw = 0x4; /*1:2*/ else @@ -1514,6 +1518,11 @@ int vp9_alloc_mmu( pr_err("error no mmu box!\n"); return -1; } + if (bit_depth >= VPX_BITS_12) { + pbi->fatal_error = DECODER_FATAL_ERROR_SIZE_OVERFLOW; + pr_err("fatal_error, un support bit depth 12!\n\n"); + return -1; + } picture_size = compute_losless_comp_body_size(pic_width, pic_height, bit_depth_10); cur_mmu_4k_number = ((picture_size + (1 << 12) - 1) >> 12); @@ -7435,7 +7444,7 @@ static int amvdec_vp9_probe(struct platform_device *pdev) platform_set_drvdata(pdev, pdata); #endif pbi->double_write_mode = double_write_mode; - pbi->mmu_enable = !(get_double_write_mode(pbi) == 0x10); + pbi->mmu_enable = !(pbi->double_write_mode == 0x10); if (amvdec_vp9_mmu_init(pbi) < 0) { mutex_unlock(&vvp9_mutex); pr_err("vp9 alloc bmmu box failed!!\n"); @@ -8172,7 +8181,7 @@ static int ammvdec_vp9_probe(struct platform_device *pdev) pbi->vvp9_amstream_dec_info.rate = 30;*/ pbi->double_write_mode = double_write_mode; } - pbi->mmu_enable = !(get_double_write_mode(pbi) == 0x10); + pbi->mmu_enable = !(pbi->double_write_mode == 0x10); video_signal_type = pbi->video_signal_type; #if 0 pbi->buf_start = pdata->mem_start;