In low memory condition, cam_mem_mgr_init can fail after
cam_mem_mgr_state is set to initialize. Since the state is
initialized, subsequent init call return success without
initializing the mem table. So, when cam_mem_mgr_deinit is
called, writing to tbl.bitmap will cause a null ptr derefernce.
This change fixes this issue by setting cam_mem_state to
uninitialize when cam_mem_mgr_init fails.
CRs-Fixed: 3671639
Change-Id: Ie3554bcbbfe10320e5278650c4dd912edd568a10
Signed-off-by: Shivakumar Malke <quic_smalke@quicinc.com>
(cherry picked from commit c655b11b9c6d413748d339ad735837d868b85976)
This change add missing calls to put cpu buf in few scenarios.
CRs-Fixed: 3578162
Change-Id: Iab6aa0324b5072390b38df296c7acee00f5102a1
Signed-off-by: Vikram Sharma <quic_vikramsa@quicinc.com>
Currently, userland can only choose whether to allocate memory as
cached/uncached if it's a protected buffer, ubwc_p buffer, etc.
This change provides some more granularity in terms of heap selection.
One could now force an allocation from the system heap or
try a dedicated heap. The change also provides heap capability info
to userland as part of the query caps call.
CRs-Fixed: 3584481
Change-Id: Id4c92fd64d975f761e7dd4cecca8453dd09b039f
Signed-off-by: Karthik Anantha Ram <quic_kartanan@quicinc.com>
This change removes some dead code and fixes memory leak
issues and mismatched labels.
CRs-Fixed: 3394193
Change-Id: Ieb6f0d56cddc58be4caea6f0aece63a793a08c07
Signed-off-by: Atiya Kailany <quic_akailany@quicinc.com>
If a buffer is already mapped to a device or a context bank,
do not try to map it again. This causes inconsistency between
the number of times it is attached and detached.
CRs-Fixed: 3510467
Change-Id: I1cfa5bc68edae1147562c3bbf3609c278d837bcd
Signed-off-by: Vijay Kumar Tumati <quic_vtumati@quicinc.com>
The function cam_mem_mgr_release can unmap the buffers when in use.
This change prevents unmapping the buffers when in use.
CRs-Fixed: 3489559
Change-Id: I2e72e795d39ac15abfa56c19043c419a03686966
Signed-off-by: Shivakumar Malke <quic_smalke@quicinc.com>
This change adds support to detect early
unmapping of buffers from UMD, and signal
when the error occurs by sending an error
code to UMD.
At present, buffers are allocated and/or mapped
by UMD, and the following sequence occurs.
KMD prepares packets sent during a config ioctl,
and these packets reside in the mapped buffers;
HW blocks then access these buffers, and may
write output to other mapped buffers(io buffers);
Once HW is done(upon a buf done), KMD signals
this event to UMD;
UMD may free/unmap these relevant buffers.
This change adds support to detect cases where a
free/unmap happens before/while HW is accessing
these buffers.
This feature is enabled by default, but a debugfs
variable disable_buf_tracking is added under smmu
which will enable the user to disable the feature.
Camera server needs to be restarted whenever this
variable is set/unset for changes to take place.
CRs-Fixed: 3382609
Change-Id: I39c3f0c373743c10bc2e6304ffbdc820e3c95970
Signed-off-by: Li Sha Lim <quic_lishlim@quicinc.com>
When a client driver tries to obtain the HW iova for a given buffer,
the call is directed to SMMU layer. In mem_mgr each buffer entry
has it's own lock, but in SMMU it is a singleton lock for the
entire context bank. If there are multiple clients trying to
obtain iova for buffers from the same bank, it leads to waiting
on the same singleton mutex. To avoid this, when allocating
or mapping a buffer, save the iova addr of the buffer for a given
device in the mem_mgr bufq entry. When a client requests, check
the bufq entry for iova, redirect the call to SMMU only if the
address is not found in the mem_mgr. The change attempts to
reduce the number of CPU cycles in trying to obtain a buffer
iova.
CRs-Fixed: 3466755
Change-Id: I19b983ee59704eccf421ab808cbe885725571f5b
Signed-off-by: Karthik Anantha Ram <quic_kartanan@quicinc.com>
To provide more peak memory space for camera usecase, utilize
system-movable heap. This will first check in standard system
heap for allocation, if memory is not available, allocation will
happen from system-movable heap. As we can not keep memory from
system-movable heap to stay forever (which will regress memory
power features), need to be careful when allocating from this
heap. All camera userspace allocations' lifetime is at the
usecase boundary, so allocate userspace allocations from
system-movable heap if available, fallback to standard system
heap if not available. kmd internal allocations will most likely
stay forever, so allocate them only from standard system heap.
CRs-Fixed: 3450854
Change-Id: Ic6644dea04cb44bf963b6277205de8502bc34bd9
Signed-off-by: Pavan Kumar Chilamkurthi <quic_pchilamk@quicinc.com>
Query the CSF version in use from SMMU proxy driver and
use noncontiguous system heap in case of CSF 2.5
instead of the contiguous secure display heap.
In addition, do not lend the buffer in CSF 2.5.
CRs-Fixed: 3424427
Change-Id: I3d5f2402034dd455c304d5726eb9aa8ee2080dcc
Signed-off-by: Vijay Kumar Tumati <quic_vtumati@quicinc.com>
Dump mem mgr bufq to user buffer.
CRs-Fixed: 3377820
Change-Id: I5be4e245857ccb0602e54546f127793d9f6b03f6
Signed-off-by: Petar Ivanov <quic_pivanov@quicinc.com>
Each driver can pass private data in mini dump callback register, so
when mini dump is invoked, the mini dump handler will pass the private
data to the callback associated with the driver. With the private data,
ICP driver can determine which mini dump callback corresponds to which
ICP device/hw mgr.
CRs-Fixed: 3353541
Change-Id: I85171aa7ba31f92c5620ddbd8de8a9c168398856
Signed-off-by: Sokchetra Eung <quic_eung@quicinc.com>
Removes logically dead code from various locations.
CRs-Fixed: 3325322
Change-Id: I2bfebbeb50cb6179bea8f02292027dab1d7f6e9b
Signed-off-by: Joshua Florez <quic_jflorez@quicinc.com>
Remove unnecessary memsets of the structure variables
whose fields are assigned prior to their usage or they
are dynamically allocated with calls that set the memory
to 0. This memset usage optimization is to improve
performance.
CRs-Fixed: 3228092
Change-Id: Iec68c6d072863627959ce603cff28afd26a1c408
Signed-off-by: Sokchetra Eung <quic_eung@quicinc.com>
we can't set dma buffer name when it has been attached to hardware.
As usually UMD allocate one buffer then map it at KMD side. So most of time,
set mapped dma buffer name failed. But it's not a fault error. So
we move log to debug level.
CRs-Fixed: 3219506
Change-Id: If635f9fbeb26b96f45c83b1d03cbba97576c92b2
Signed-off-by: Fengjie Chen <quic_fengjiec@quicinc.com>
Add memmgr interface and support to allocate buffers from
ubwcp heap.
CRs-Fixed: 3197463
Change-Id: Ic3368e5ff81710dba795c9625f9a461833f915e3
Signed-off-by: Pavan Kumar Chilamkurthi <quic_pchilamk@quicinc.com>
Add ioctl interfaces to support dma begin and end cpu access
operations for camera buffers.
CRs-Fixed: 3197463
Change-Id: Ibeb31e8f425489abfdd47df6f92271ac40ace407
Signed-off-by: Pavan Kumar Chilamkurthi <quic_pchilamk@quicinc.com>
For dma buffer profiling,we don't konw the owner of one dma
buffer. So we add it's name to show it's owner.
If you use v1 struct to alloc/map dma buffer it will use
default buffer name "UNKNOWN". For v2 struct you can set dma
buffer name at UMD side.
CRs-Fixed: 3131442
Change-Id: I24ce6aa1d97cd9fc26d9bd8796ab2367607008f6
Signed-off-by: Fengjie Chen <quic_fengjiec@quicinc.com>
Fd is a user-accessible value, referring it multiple times
leads to TOCTOU issues. Dma_buf can be freed after the 1st
use of fd and userspace can create another dma_buf but with
same fd. In such scenario, during 2nd use of fd, we may get
a different dma_buf with different length. To avoid this, we
can use same dma_buf instead of retrieving it twice using same
fd. In this change FD is accessed only once in syscall.
CRs-Fixed: 3159446
Change-Id: I00eb6dd3d798165f5c6c0bd59feabe80a68592b1
Signed-off-by: Yash Upadhyay <quic_yupadhya@quicinc.com>
Optimize the names of some functions and add declaration
for them in head file.
CRs-Fixed: 3164829
Change-Id: Ia10ab83e0b6164a82fdd21b351477294bf4bbe4b
Signed-off-by: mingpan <quic_mingpan@quicinc.com>
In rare scenarios, FD is getting released by userspace
before incrementing the ref count. We see failure in
dma_buf_get API as FD is released but we are still
tying to decrement ref count in case of dma
buf get failure.
We are seeing use-after-free as the buffer is released.
This fix includes get_file API to increment ref count
before dma_buf_fd.
CRs-Fixed: 3156174
Change-Id: Ie9588ec10e65cbb8fa155badda4f3e5fb81c0525
Signed-off-by: Chandan Kumar Jha <quic_cjha@quicinc.com>
bufq mutex can be destroyed at unmap, if other thread
is trying to lock the bufq mutex it can result in
bad magic number. To avoid such race condition
check bitmap with protection of global mutex lock.
CRs-Fixed: 3120472
Change-Id: Id95be0faa5b0d921c4a0370ea5d2f3b23c229280
Signed-off-by: Tejas Prajapati <quic_tpraja@quicinc.com>
When set, buffers will be mapped within 32-bit region
address space and in patching, if Shared or CmdBUffer is
not set for such buffers - patch the value with right shift
by 8. kmd does as below.
Map:
Shared or CmdBuffer : Mapped within 32bit.
HwAndCDMOrShared : Mapped within 32bit
others(HwAccess) : Mapped within 40bit
Patching:
Shared or CmdBuffer : as is
HwAndCDMOrShared : iova >> 8
others (HwAccess) : iova >> 8
Shared/CmdBuffer takes precedence over HwAndCDMOrShared.
CRs-Fixed: 3128094
Change-Id: Ifd9f5beaf2659f77544cd0722ef7f60d6c0684a7
Signed-off-by: Pavan Kumar Chilamkurthi <quic_pchilamk@quicinc.com>
Create common root folder under debugfs root named camera at probe. Add
utility functions to create subdirectories under the common camera root.
CRs-Fixed: 3093049
Change-Id: Ia4cefb5d2263ecabf1b9d70deefa1ee624b04f07
Signed-off-by: Anand Ravi <quic_ananravi@quicinc.com>
Based on compilation flag CONFIG_CAM_TEST_ICP_FW_DOWNLOAD, ICP
FW load/unload sequence can be verified. This change initializes
memory manager for load and de-initializes memmgr during unload.
To trigger FW download-
adb shell "echo "load" > /sys/kernel/debug/camera_icp/icp_fw_load_unload"
FW unload -
adb shell "echo "unload" > /sys/kernel/debug/camera_icp/icp_fw_load_unload"
CONFIG_CAM_TEST_FW_DOWNLOAD needs to be set only for testing
FW loading when camera server is not enabled.
The change also adds protection for repeated memmgr init/deinit calls.
CRs-Fixed: 3097781
Change-Id: Iceb5089793313b086b9d4fc3770a87860237e741
Signed-off-by: Karthik Anantha Ram <quic_kartanan@quicinc.com>
dma_buf_vunmap function signature changed between kernel version
5.10 and 5.15.
CRs-Fixed: 3088126
Change-Id: If6ef72aa7839e358bc6d7a384e628b760ecaf265
Signed-off-by: zhuo <quic_zhuo@quicinc.com>
Remove return checks from debugfs_create_bool, as the API changed in
kernel 5.15+.
CRs-Fixed: 3048249
Change-Id: I2351776615a5fb17db1c54d285be2bf8e55443ab
Signed-off-by: Karthik Jayakumar <kjayakum@codeaurora.org>
dma_buf_vmap function signature changed between kernel version
5.10 and 5.15.
CRs-Fixed: 3048249
Change-Id: I4c8dc951cc383c3dc888fca1d0b1becf92f4662c
Signed-off-by: Karthik Jayakumar <kjayakum@codeaurora.org>
Add correct way to check if buffer can be sent to hw in below cases.
1. buffer handle mapped twice, resulting into two entries in buf_q.
One entry without smmu mapping and one with smmu mapping.
fixed by checking if another entry with smmu map exists for i_no.
2. blob cmd buffer, packet buffer are shared only between umd and kmd.
send_buffer_to_presil expected to be called and return success.
CRs-Fixed: 2932495
Change-Id: I2dd884b7dd16c5c45d3dfc25380d039b92199319
Signed-off-by: Suraj Dongre <sdongre@codeaurora.org>
Based on targets, in case of device crash, in place
of complete memory dump, mini dump can be extracted.
This commit adds changes for basic framework
to interact with base kernel for mini dump.
This commit also adds changes for ISP, CRM, SMMU and
Memory Manager.
CRs-Fixed: 2993116
Change-Id: I02620bd79ee2f84847381509a5eb030ffb1ca9d4
Signed-off-by: Gaurav Jindal <gjindal@codeaurora.org>
Fixes expanded memory allocations to only happen for ICP context banks.
Re-maps the command buffers to shared region of ICP context bank.
CRs-Fixed: 2985358
Change-Id: I3c2d5866b0041489577f6c5c0ec113c886437107
Signed-off-by: Karthik Jayakumar <kjayakum@codeaurora.org>
Use Kernel time to obtain the current time when IFE is acquired
/released and when sensor is streamed on/off. Convert the Ktime
to a timestamp format and log it in existing info prints. This
will help to co-relate timestamp between user-space and kernel
logs. The change also replaces the current usage of direct calls
to ktime_get_real_ts64 with macro across all drivers.
CRs-Fixed: 2987320
Change-Id: I87c4790164d222fc1ed6ff41ad00eeb1ed8c8867
Signed-off-by: Sokchetra Eung <eung@codeaurora.org>
'fd' can be closed in user mode driver, though corresponding
dmabuf is still not freed if someone still holding a refCount
on that dmabuf, say camera smmu driver holding a refCOunt and
has that in its mapping info table. Then the same 'fd' can be
allotted for a different buffer in a new allocation. In such
cases, if we use 'fd' as identifier in camera smmu driver to
check if the buffer is already mapped based on mapping info
table, we mistakenly think the new buffer is already mapped
which is not the case. DMA buf's inode num is an unique
identifier that represents a buffer. Use this along with 'fd'
in camera smmu driver to see if the given buffer is already mapped.
CRs-Fixed: 2961136
Change-Id: I5baac99e3badaca3a376ecd724a7a7aa6da112a4
Signed-off-by: Pavan Kumar Chilamkurthi <pchilamk@codeaurora.org>
Add support to allocate such buffers which need to accessed
by non-pix VM.
CRs-Fixed: 2981372
Change-Id: Iac965a479e05d638c6323bfacd7c6a4d89f2a223
Signed-off-by: Rishabh Jain <risjai@codeaurora.org>
Added declarations for apis used for memory copy to and from presil hw.
CRs-Fixed: 2932495
Change-Id: I19cd272fd4993c68278b3d8cceabe5d9b5d9a5f6
Signed-off-by: Suraj Dongre <sdongre@codeaurora.org>
Use fw_uncached region instead of secondary heap region. Pass
this region information to FW through CSR registers.
Allocate Qtlb, cmd_q, msg_q, dbg_q from fw_uncached region
instead of shared mem region. Allocate Sec heap also from
fw uncached region instead of its own dedicated region.
CRs-Fixed: 2722486
Change-Id: Ib88b2202ca1b610946c712fcca936b72d4eecd15
Signed-off-by: Pavan Kumar Chilamkurthi <pchilamk@codeaurora.org>
Signed-off-by: Karthik Anantha Ram <kartanan@codeaurora.org>
Due LX7 cache requirement, buffers need 4K padding at the
end. Allocate accordingly, this is hidden from user mode
driver and umd never uses this extra 4K memory.
CRs-Fixed: 2722486
Change-Id: I3b327ab3615eee30d17c95e23703024ff7446648
Signed-off-by: Pavan Kumar Chilamkurthi <pchilamk@codeaurora.org>
Signed-off-by: Karthik Anantha Ram <kartanan@codeaurora.org>
Use dma-buf-heaps for allocating buffers. Keep ion usage
to support kernels without dma-buf-heaps support.
CRs-Fixed: 2852327
Change-Id: I3ebcb591827d9b8e5366f716efd08e4cd6f1070a
Signed-off-by: Pavan Kumar Chilamkurthi <pchilamk@codeaurora.org>
Consolidate ion usage functions and bring all ion related
usage into one single function. This helps to easily
write a different allocation wrapper in case a new allocator
need to be used in future.
CRs-Fixed: 2852327
Change-Id: I717ee5a976ae0f148dcdd5a050204514566c823d
Signed-off-by: Pavan Kumar Chilamkurthi <pchilamk@codeaurora.org>
