[PATCH v1 04/10] media: platform: mediatek: add isp_7x cam-raw unit

[CK Hu (胡俊光)]

Hi, Shu-hsiang:

On Wed, 2024-10-09 at 19:15 +0800, Shu-hsiang Yang wrote:
> Introduces the ISP pipeline driver for the MediaTek ISP raw and yuv
> modules. Key functionalities include data processing, V4L2 integration,
> resource management, debug support, and various control operations.
> Additionally, IRQ handling, platform device management, and MediaTek
> ISP DMA format support are also included.
> 
> Signed-off-by: Shu-hsiang Yang <Shu-hsiang.Yang at mediatek.com>
> ---

[snip]

> +static bool mtk_raw_fmt_get_res(struct v4l2_subdev *sd,
> +				struct v4l2_subdev_format *fmt,
> +				struct mtk_cam_resource *res)
> +{
> +	void *user_ptr;
> +	u64 addr;
> +
> +	addr = ((u64)fmt->reserved[1] << 32) | fmt->reserved[2];

The callstack to this function is:

subdev_do_ioctl() -> mtk_raw_set_fmt() -> mtk_raw_try_pad_fmt() -> mtk_raw_set_src_pad_fmt() -> mtk_raw_fmt_get_res()

In subdev_do_ioctl() [1], fmt->reserved[] would be cleared to zero.
I don't know why you could get a non-zero addr value?

[1] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/drivers/media/v4l2-core/v4l2-subdev.c?h=v6.12-rc6#n753

Regards,
CK

> +	user_ptr = (void *)addr;
> +	if (!user_ptr) {
> +		dev_info(sd->v4l2_dev->dev, "%s: mtk_cam_resource is null\n",
> +			 __func__);
> +		return false;
> +	}
> +
> +	if (copy_from_user(res, (void __user *)user_ptr, sizeof(*res))) {
> +		dev_info(sd->v4l2_dev->dev,
> +			 "%s: copy_from_user failedm user_ptr:%p\n",
> +			 __func__, user_ptr);
> +		return false;
> +	}
> +
> +	dev_dbg(sd->v4l2_dev->dev,
> +		"%s:sensor:%d/%d/%lld/%d/%d, raw:%lld/%d/%d/%d/%d/%d/%d/%d/%lld\n",
> +		__func__,
> +		res->sensor_res.hblank, res->sensor_res.vblank,
> +		res->sensor_res.pixel_rate, res->sensor_res.interval.denominator,
> +		res->sensor_res.interval.numerator,
> +		res->raw_res.feature, res->raw_res.bin, res->raw_res.path_sel,
> +		res->raw_res.raw_max, res->raw_res.raw_min, res->raw_res.raw_used,
> +		res->raw_res.strategy, res->raw_res.pixel_mode,
> +		res->raw_res.throughput);
> +
> +	return res;
> +}
> +

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.freedesktop.org/archives/dri-devel/attachments/20241104/dd511a2f/attachment-0001.htm>