8f9e91ad03
These patches were generated from: https://github.com/raspberrypi/linux/commits/rpi-6.12.y With the following command: git format-patch -N v6.12.27..HEAD (HEAD -> 8d3206ee456a5ecdf9ddbfd8e5e231e4f0cd716e) Exceptions: - (def)configs patches - github workflows patches - applied & reverted patches - readme patches - wireless patches Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
55 lines
2.2 KiB
Diff
55 lines
2.2 KiB
Diff
From 302c4ad8d6225360cc1f7ba4416edf03945f6807 Mon Sep 17 00:00:00 2001
|
|
From: Naushir Patuck <naush@raspberrypi.com>
|
|
Date: Fri, 2 Sep 2022 08:35:35 +0100
|
|
Subject: [PATCH] media: bcm2835-unicam: Fix for possible dummy buffer overrun
|
|
|
|
The Unicam hardware has been observed to cause a buffer overrun when using the
|
|
dummy buffer as a circular buffer. The conditions that cause the overrun are not
|
|
fully known, but it seems to occur when the memory bus is heavily loaded.
|
|
|
|
To avoid the overrun, program the hardware with a buffer size of 0 when using
|
|
the dummy buffer. This will cause overrun into the allocated dummy buffer, but
|
|
avoid out of bounds writes.
|
|
|
|
Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
|
|
---
|
|
drivers/media/platform/bcm2835/bcm2835-unicam.c | 14 ++++++++------
|
|
1 file changed, 8 insertions(+), 6 deletions(-)
|
|
|
|
--- a/drivers/media/platform/bcm2835/bcm2835-unicam.c
|
|
+++ b/drivers/media/platform/bcm2835/bcm2835-unicam.c
|
|
@@ -126,8 +126,11 @@ MODULE_PARM_DESC(media_controller, "Use
|
|
#define UNICAM_EMBEDDED_SIZE 16384
|
|
|
|
/*
|
|
- * Size of the dummy buffer. Can be any size really, but the DMA
|
|
- * allocation works in units of page sizes.
|
|
+ * Size of the dummy buffer allocation.
|
|
+ *
|
|
+ * Due to a HW bug causing buffer overruns in circular buffer mode under certain
|
|
+ * (not yet fully known) conditions, the dummy buffer allocation is set to a
|
|
+ * a single page size, but the hardware gets programmed with a buffer size of 0.
|
|
*/
|
|
#define DUMMY_BUF_SIZE (PAGE_SIZE)
|
|
|
|
@@ -832,8 +835,7 @@ static void unicam_schedule_dummy_buffer
|
|
unicam_dbg(3, dev, "Scheduling dummy buffer for node %d\n",
|
|
node->pad_id);
|
|
|
|
- unicam_wr_dma_addr(dev, node->dummy_buf_dma_addr, DUMMY_BUF_SIZE,
|
|
- node->pad_id);
|
|
+ unicam_wr_dma_addr(dev, node->dummy_buf_dma_addr, 0, node->pad_id);
|
|
node->next_frm = NULL;
|
|
}
|
|
|
|
@@ -2651,8 +2653,8 @@ static void unicam_stop_streaming(struct
|
|
* This is only really needed if the embedded data pad is
|
|
* disabled before the image pad.
|
|
*/
|
|
- unicam_wr_dma_addr(dev, node->dummy_buf_dma_addr,
|
|
- DUMMY_BUF_SIZE, METADATA_PAD);
|
|
+ unicam_wr_dma_addr(dev, node->dummy_buf_dma_addr, 0,
|
|
+ METADATA_PAD);
|
|
}
|
|
|
|
/* Clear all queued buffers for the node */
|