media: mtk-vpu: avoid unaligned access to DTCM buffer.
authorHsin-Yi Wang <hsinyi@chromium.org>
Wed, 4 Mar 2020 02:58:51 +0000 (03:58 +0100)
committerMauro Carvalho Chehab <mchehab+huawei@kernel.org>
Thu, 12 Mar 2020 15:25:33 +0000 (16:25 +0100)
commite6599adfad30c340d06574e49a86afa7015c5c60
tree0c7104d009ed723ec48def0e3d44d8101e6037fa
parent6f704b2fbbde0c9893ea59d54d76195d72ac63a1
media: mtk-vpu: avoid unaligned access to DTCM buffer.

Previously, vpu->recv_buf and send_buf are forced cast from
void __iomem *tcm. vpu->recv_buf->share_buf is passed to
vpu_ipi_desc.handler(). It's not able to do unaligned access. Otherwise
kernel would crash due to unable to handle kernel paging request.

struct vpu_run {
u32 signaled;
char fw_ver[VPU_FW_VER_LEN];
unsigned int dec_capability;
unsigned int enc_capability;
wait_queue_head_t wq;
};

fw_ver starts at 4 byte boundary. If system enables
CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS, strscpy() will do
read_word_at_a_time(), which tries to read 8-byte: *(unsigned long *)addr

vpu_init_ipi_handler() calls strscpy(), which would lead to crash.

vpu_init_ipi_handler() and several other handlers (eg.
vpu_dec_ipi_handler) only do read access to this data, so they can be
const, and we can use memcpy_fromio() to copy the buf to another non iomem
buffer then pass to handler.

Fixes: 85709cbf1524 ("media: replace strncpy() by strscpy()")
Signed-off-by: Hsin-Yi Wang <hsinyi@chromium.org>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
drivers/media/platform/mtk-mdp/mtk_mdp_vpu.c
drivers/media/platform/mtk-vcodec/vdec_vpu_if.c
drivers/media/platform/mtk-vcodec/venc_vpu_if.c
drivers/media/platform/mtk-vpu/mtk_vpu.c
drivers/media/platform/mtk-vpu/mtk_vpu.h