Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a37bf934 authored by Peter Liu's avatar Peter Liu Committed by Shubhraprakash Das
Browse files

msm: camera: isp: limit list length 



When one VFE stop and the other one has not,
share list could grow infinitely.
If list goes over limit, drop the request.
Also add debug info if loop start growing.

Change-Id: Ib7e8a91a97598bb3267de0a83c0c1959e87fda1f
Signed-off-by: default avatarPeter Liu <pingchie@codeaurora.org>
parent 6e960ded

drivers/media/platform/msm/camera_v2/isp/msm_buf_mgr.c

+16 −1
Original line number Diff line number Diff line
@@ -37,6 +37,7 @@ 
#define CDBG(fmt, args...) pr_debug(fmt, ##args)



#define BUF_DEBUG_FULL 0

#define MAX_LIST_COUNT 100



struct msm_isp_bufq *msm_isp_get_bufq(

	struct msm_isp_buf_mgr *buf_mgr,
@@ -402,6 +403,7 @@ static int msm_isp_get_buf(struct msm_isp_buf_mgr *buf_mgr, uint32_t id, 
{

	int rc = -1;

	unsigned long flags;

	unsigned int list_count = 0;

	struct msm_isp_buffer *temp_buf_info;

	struct msm_isp_bufq *bufq = NULL;

	struct vb2_buffer *vb2_buf = NULL;
@@ -422,6 +424,7 @@ static int msm_isp_get_buf(struct msm_isp_buf_mgr *buf_mgr, uint32_t id, 
	*buf_cnt = 0;

	spin_lock_irqsave(&bufq->bufq_lock, flags);

	if (bufq->buf_type == ISP_SHARE_BUF) {

		list_count = 0;

		list_for_each_entry(temp_buf_info,

			&bufq->share_head, share_list) {

			if (!temp_buf_info->buf_used[id]) {
@@ -441,6 +444,19 @@ static int msm_isp_get_buf(struct msm_isp_buf_mgr *buf_mgr, uint32_t id, 
				spin_unlock_irqrestore(

					&bufq->bufq_lock, flags);

				return rc;

			} else if (temp_buf_info->buf_used[id] &&

				temp_buf_info->buf_reuse_flag) {

				spin_unlock_irqrestore(

					&bufq->bufq_lock, flags);

				return rc;

			}

			list_count++;

			if (list_count > MAX_LIST_COUNT) {

				pr_err_ratelimited("%s: %d share_list corruption, list corrupt! count = %d\n",

					__func__, __LINE__,  list_count);

				spin_unlock_irqrestore(

					&bufq->bufq_lock, flags);

				return -EINVAL;

			}

		}

	}
@@ -481,7 +497,6 @@ static int msm_isp_get_buf(struct msm_isp_buf_mgr *buf_mgr, uint32_t id, 
			bufq->session_id, bufq->stream_id);

		if (vb2_buf) {

			if (vb2_buf->v4l2_buf.index < bufq->num_bufs) {



				list_for_each_entry(buf_pending,

						&buf_mgr->buffer_q, list) {

					if (!buf_pending)

drivers/media/platform/msm/camera_v2/isp/msm_isp_util.c

+2 −2
Original line number Diff line number Diff line
@@ -1908,12 +1908,12 @@ void msm_isp_do_tasklet(unsigned long data) 
		iommu_page_fault = queue_cmd->iommu_page_fault;

		queue_cmd->iommu_page_fault = 0;

		spin_unlock_irqrestore(&vfe_dev->tasklet_lock, flags);

		ISP_DBG("%s: vfe_id %d status0: 0x%x status1: 0x%x\n",

			__func__, vfe_dev->pdev->id, irq_status0, irq_status1);

		if (iommu_page_fault > 0) {

			ms_isp_process_iommu_page_fault(vfe_dev);

			continue;

		}

		ISP_DBG("%s: vfe_id %d status0: 0x%x status1: 0x%x\n",

			__func__, vfe_dev->pdev->id, irq_status0, irq_status1);

		irq_ops->process_reset_irq(vfe_dev,

			irq_status0, irq_status1);

		irq_ops->process_halt_irq(vfe_dev,