From 956816cb492cfbfa41ffa249b0d3613d3628c687 Mon Sep 17 00:00:00 2001 From: Naushir Patuck Date: Fri, 2 Sep 2022 08:35:35 +0100 Subject: [PATCH] media: bcm2835-unicam: Fix for possible dummy buffer overrun The Unicam hardware has been observed to cause a buffer overrun when using the dummy buffer as a circular buffer. The conditions that cause the overrun are not fully known, but it seems to occur when the memory bus is heavily loaded. To avoid the overrun, program the hardware with a buffer size of 0 when using the dummy buffer. This will cause overrun into the allocated dummy buffer, but avoid out of bounds writes. Signed-off-by: Naushir Patuck --- drivers/media/platform/bcm2835/bcm2835-unicam.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/drivers/media/platform/bcm2835/bcm2835-unicam.c b/drivers/media/platform/bcm2835/bcm2835-unicam.c index 2fd9608..2cc4c2e 100644 --- a/drivers/media/platform/bcm2835/bcm2835-unicam.c +++ b/drivers/media/platform/bcm2835/bcm2835-unicam.c @@ -126,8 +126,11 @@ MODULE_PARM_DESC(media_controller, "Use media controller API"); #define UNICAM_EMBEDDED_SIZE 16384 /* - * Size of the dummy buffer. Can be any size really, but the DMA - * allocation works in units of page sizes. + * Size of the dummy buffer allocation. + * + * Due to a HW bug causing buffer overruns in circular buffer mode under certain + * (not yet fully known) conditions, the dummy buffer allocation is set to a + * a single page size, but the hardware gets programmed with a buffer size of 0. */ #define DUMMY_BUF_SIZE (PAGE_SIZE) @@ -843,8 +846,7 @@ static void unicam_schedule_dummy_buffer(struct unicam_node *node) unicam_dbg(3, dev, "Scheduling dummy buffer for node %d\n", node->pad_id); - unicam_wr_dma_addr(dev, node->dummy_buf_dma_addr, DUMMY_BUF_SIZE, - node->pad_id); + unicam_wr_dma_addr(dev, node->dummy_buf_dma_addr, 0, node->pad_id); node->next_frm = NULL; } @@ -2662,8 +2664,8 @@ static void unicam_stop_streaming(struct vb2_queue *vq) * This is only really needed if the embedded data pad is * disabled before the image pad. */ - unicam_wr_dma_addr(dev, node->dummy_buf_dma_addr, - DUMMY_BUF_SIZE, METADATA_PAD); + unicam_wr_dma_addr(dev, node->dummy_buf_dma_addr, 0, + METADATA_PAD); } /* Clear all queued buffers for the node */ -- 2.7.4