We need to check if the packet is valid before using it.
CRs-Fixed: 3605421
Change-Id: Ide4e005ba46690c1cac02cb77a2d9aaa497b15df
Signed-off-by: mingpan <quic_mingpan@quicinc.com>
(cherry picked from commit 0156c0475a4c6c042eb84fcfbc14b3e837e0cb4c)
This change add missing calls to put cpu buf in few scenarios.
CRs-Fixed: 3578162
Change-Id: Iab6aa0324b5072390b38df296c7acee00f5102a1
Signed-off-by: Vikram Sharma <quic_vikramsa@quicinc.com>
The function cam_mem_mgr_release can unmap the buffers when in use.
This change prevents unmapping the buffers when in use.
CRs-Fixed: 3489559
Change-Id: I2e72e795d39ac15abfa56c19043c419a03686966
Signed-off-by: Shivakumar Malke <quic_smalke@quicinc.com>
This change adds support to detect early
unmapping of buffers from UMD, and signal
when the error occurs by sending an error
code to UMD.
At present, buffers are allocated and/or mapped
by UMD, and the following sequence occurs.
KMD prepares packets sent during a config ioctl,
and these packets reside in the mapped buffers;
HW blocks then access these buffers, and may
write output to other mapped buffers(io buffers);
Once HW is done(upon a buf done), KMD signals
this event to UMD;
UMD may free/unmap these relevant buffers.
This change adds support to detect cases where a
free/unmap happens before/while HW is accessing
these buffers.
This feature is enabled by default, but a debugfs
variable disable_buf_tracking is added under smmu
which will enable the user to disable the feature.
Camera server needs to be restarted whenever this
variable is set/unset for changes to take place.
CRs-Fixed: 3382609
Change-Id: I39c3f0c373743c10bc2e6304ffbdc820e3c95970
Signed-off-by: Li Sha Lim <quic_lishlim@quicinc.com>
Instead of caching packet address pointer, store packet handle
in page fault req info structutre to obtain packet address through
mem manager to avoid potential access to dangling packet pointer which
resulted from UMD called to free the packet buffer before kernel finishes
handling page fault. If the packet was freed, then querying to get packet
address from memory manager will fail since the mem handle is invalid.
If it is invalid, the page fault handler will return before accessing
the dangling packet.
CRs-Fixed: 3287554
Change-Id: I02bc0c706b64f1dc0d098d8189f2f129a91efba7
Signed-off-by: Sokchetra Eung <quic_eung@quicinc.com>
Upon Page Fault, smmu driver invokes faulted client's callback
which looks for faulted buffer and context. The client driver
can be ISP, ICP, JPEG, IFE CDM and CPAS CDM. The driver then
fills PF msg struct, logs related info, and notify PF msg to
userspace. Userspace is expected to abort and calls to shut
down kernel drivers. When Titan powers on next session, CAMSS
undergoes async reset.
This change also ensures the page fault related changes added
to TFE, OPE, CRE do not break the drivers compilation.
CRs-Fixed: 3156671
Change-Id: Icd6c8c9a38cac206fe8260d374d03964fb280879
Signed-off-by: sokchetra eung <quic_eung@quicinc.com>
When set, buffers will be mapped within 32-bit region
address space and in patching, if Shared or CmdBUffer is
not set for such buffers - patch the value with right shift
by 8. kmd does as below.
Map:
Shared or CmdBuffer : Mapped within 32bit.
HwAndCDMOrShared : Mapped within 32bit
others(HwAccess) : Mapped within 40bit
Patching:
Shared or CmdBuffer : as is
HwAndCDMOrShared : iova >> 8
others (HwAccess) : iova >> 8
Shared/CmdBuffer takes precedence over HwAndCDMOrShared.
CRs-Fixed: 3128094
Change-Id: Ifd9f5beaf2659f77544cd0722ef7f60d6c0684a7
Signed-off-by: Pavan Kumar Chilamkurthi <quic_pchilamk@quicinc.com>
Force callers to say if they are using 36 bit address patching or not.
CRs-fixed: 3121782
Change-Id: I4dee25e3f73104a1be043fe18a295cd4f8447821
Signed-off-by: Karthik Jayakumar <quic_kjayakum@quicinc.com>
msm: camera: cdm: Fix dangling pointer issue
msm: camera: cdm: change work record to atomic variable
msm: camera: utils: Adding device type to track device handles
msm: camera: tfe: Reduce stack footprint during bw vote
msm: camera: req_mgr: Thread switch delay detection mechanisms
msm: camera: cdm: Avoid submitting BL if FIFO is full
msm: camera: tfe: check cdm hang in the tfe config timeout
msm: camera: req_mgr: Delay detection mechanism
msm: camera: cdm: Debug info in case of cdm page fault
msm: camera: isp: Max context reduction for TFE in isp driver
msm: camera: ope: Maintain current clock value during acquire
msm: camera: req_mgr: Limit CAM_ERR log in case of no empty task
msm: camera: cdm: Decrement write-count only after Bl commit
msm: camera: isp: Added CSID recovery mechanism.
CRs-Fixed: 2792394
Change-Id: I1c7a903ae15b572acf3f6318cda7394cb6549c8d
Signed-off-by: Tejas Prajapati <tpraja@codeaurora.org>
Currently smmu_get_iova is called for every patch, regardless of the same
source handle. This change avoids this by checking if io virtual address
is already being quried with earlier patch. This can reduce the call and
mutex operation from smmu prospective.
CRs-Fixed: 2711810
Change-Id: I681589cd1328389e0828a3318edad1a2a91d8547
Signed-off-by: Jigarkumar Zala <jzala@codeaurora.org>
Currently as part of the page fault handler we only dump the
io_bufs. This change dumps all the patched addresses for
this request as well.
CRs-Fixed: 2579908
Change-Id: If5deec0ad3a8aec82824ef55366084c31a037515
Signed-off-by: Karthik Anantha Ram <kartanan@codeaurora.org>
Bring over camera driver changes as of msm-4.19
commit 5a5551a7 (Merge "msm: camera: reqmgr: Fix CRM
shift one req issue").
Change-Id: Ic0c2b2d74d1b3470c1c51d98228e312fb13c501a
Signed-off-by: Jigarkumar Zala <jzala@codeaurora.org>
