media: bcm2835-unicam: Fix for possible dummy buffer overrun

The Unicam hardware has been observed to cause a buffer overrun when using the
dummy buffer as a circular buffer. The conditions that cause the overrun are not
fully known, but it seems to occur when the memory bus is heavily loaded.

To avoid the overrun, program the hardware with a buffer size of 0 when using
the dummy buffer. This will cause overrun into the allocated dummy buffer, but
avoid out of bounds writes.

Signed-off-by: Naushir Patuck <naush@raspberrypi.com>

diff --git a/drivers/media/platform/bcm2835/bcm2835-unicam.c b/drivers/media/platform/bcm2835/bcm2835-unicam.c
index cad7f01..506a3b3 100644 (file)
--- a/drivers/media/platform/bcm2835/bcm2835-unicam.c
+++ b/drivers/media/platform/bcm2835/bcm2835-unicam.c
@@ -127,8 +127,11 @@ MODULE_PARM_DESC(media_controller, "Use media controller API");
 #define UNICAM_EMBEDDED_SIZE   16384
 
 /*
- * Size of the dummy buffer. Can be any size really, but the DMA
- * allocation works in units of page sizes.
+ * Size of the dummy buffer allocation.
+ *
+ * Due to a HW bug causing buffer overruns in circular buffer mode under certain
+ * (not yet fully known) conditions, the dummy buffer allocation is set to a
+ * a single page size, but the hardware gets programmed with a buffer size of 0.
  */
 #define DUMMY_BUF_SIZE         (PAGE_SIZE)
 
@@ -844,8 +847,7 @@ static void unicam_schedule_dummy_buffer(struct unicam_node *node)
        unicam_dbg(3, dev, "Scheduling dummy buffer for node %d\n",
                   node->pad_id);
 
-       unicam_wr_dma_addr(dev, node->dummy_buf_dma_addr, DUMMY_BUF_SIZE,
-                          node->pad_id);
+       unicam_wr_dma_addr(dev, node->dummy_buf_dma_addr, 0, node->pad_id);
        node->next_frm = NULL;
 }
 
@@ -2665,8 +2667,8 @@ static void unicam_stop_streaming(struct vb2_queue *vq)
                 * This is only really needed if the embedded data pad is
                 * disabled before the image pad.
                 */
-               unicam_wr_dma_addr(dev, node->dummy_buf_dma_addr,
-                                  DUMMY_BUF_SIZE, METADATA_PAD);
+               unicam_wr_dma_addr(dev, node->dummy_buf_dma_addr, 0,
+                                  METADATA_PAD);
        }
 
        /* Clear all queued buffers for the node */