In Error Injection framework, for buf done event HW-done data
is explicitly intitalized to Null and caused explicit Null
pointer dereferencing.
By adding explcit buf-done data initialization which
prevents from Null dereferencing issue.
CRs-Fixed: 3731208
Change-Id: I6ff97a1af7560cdfa65812ac1cad40e397954af7
Signed-off-by: Sourabh Soni <quic_soursoni@quicinc.com>
This change add support to program dual tfe configurations in
SHDR to create sync between two TFEs. This change is required
if MUP bit is used in SHDR mode.
CRs-Fixed: 3508184
Change-Id: I270f7fd8e3cac1f1e50c5f16e7cba2c5e9c2b74f
Signed-off-by: Ayush Kumar <quic_ayushkr@quicinc.com>
Adds checks to confirm CSID frequency greater than
CSIPHY frequency, TFE frequency greater than CSID
frequency. Also TFE frequency should be such that
it can accommodate PHY data rate .
CRs-Fixed: 2847155
Change-Id: I5d3dcc53a6f27129f4b82cba1254445f58f6d0cf
Signed-off-by: Shravya Samala <quic_shravyas@quicinc.com>
Signed-off-by: Shardul Bankar <quic_sharbank@quicinc.com>
Signed-off-by: Gaurav Jindal <quic_gjindal@quicinc.com>
Signed-off-by: Alok Chauhan <quic_alokc@quicinc.com>
This change add missing calls to put cpu buf in few scenarios.
CRs-Fixed: 3578162
Change-Id: Iab6aa0324b5072390b38df296c7acee00f5102a1
Signed-off-by: Vikram Sharma <quic_vikramsa@quicinc.com>
In situations where there are multiple flush requests,
a double-free of buffer tracker occurs when the sync
callback which operates in a workqueue contexts interrupts
an ongoing flush request operation. This change provides
the fix to prevent it from happening.
CRs-Fixed: 3554278
Change-Id: I675b22b76c0f10fcf1808dc3fe0bc48ebd19a2e4
Signed-off-by: Li Sha Lim <quic_lishlim@quicinc.com>
Reinitialize active list only after the flush call to the
respective driver's HW layer.
CRs-Fixed: 3546603
Change-Id: Ib0a5cb208147d2c81717188e89acb5eba474b454
Signed-off-by: Karthik Anantha Ram <quic_kartanan@quicinc.com>
Add a goto label to fine-grain situations where
buffer tracker list is to be freed, and when it
doesn't, where the submitted packet request id
is less than or equal to request that was last
flushed, as this call will cause null pointer
access.
CRs-Fixed: 3507867
Change-Id: I1b909473baf7a227bbd649e4c883daa485602cd9
Signed-off-by: Li Sha Lim <quic_lishlim@quicinc.com>
The function cam_mem_mgr_release can unmap the buffers when in use.
This change prevents unmapping the buffers when in use.
CRs-Fixed: 3489559
Change-Id: I2e72e795d39ac15abfa56c19043c419a03686966
Signed-off-by: Shivakumar Malke <quic_smalke@quicinc.com>
IFE cpas state monitor enhancement by printing ctx id,
hw index, frame id, event id and request id.
CRs-Fixed: 3368290
Change-Id: I41a01382ec2bc6f0c7b9f89c8bb20da42774a65c
Signed-off-by: Wang Kan <quic_wkan@quicinc.com>
This change adds support to detect early
unmapping of buffers from UMD, and signal
when the error occurs by sending an error
code to UMD.
At present, buffers are allocated and/or mapped
by UMD, and the following sequence occurs.
KMD prepares packets sent during a config ioctl,
and these packets reside in the mapped buffers;
HW blocks then access these buffers, and may
write output to other mapped buffers(io buffers);
Once HW is done(upon a buf done), KMD signals
this event to UMD;
UMD may free/unmap these relevant buffers.
This change adds support to detect cases where a
free/unmap happens before/while HW is accessing
these buffers.
This feature is enabled by default, but a debugfs
variable disable_buf_tracking is added under smmu
which will enable the user to disable the feature.
Camera server needs to be restarted whenever this
variable is set/unset for changes to take place.
CRs-Fixed: 3382609
Change-Id: I39c3f0c373743c10bc2e6304ffbdc820e3c95970
Signed-off-by: Li Sha Lim <quic_lishlim@quicinc.com>
Add support to receive synx test cmds, and forward it to ICP FW.
Synx on ICP will process that cmd, and send a response. This
response is returned to the caller. The objective of this
infrastructure is to allow synx test app to validate synx
functionality on ICP without running any actual use-case.
CRs-Fixed: 3448052
Change-Id: I3785264f74c5c698146f4de1a82d25fe141cfc2a
Signed-off-by: Karthik Anantha Ram <quic_kartanan@quicinc.com>
Currently the maximum length of tag is 64, but in some
cases, the tag length we need is lager than 64, in
this case some information will be lost, which leads
to the failure to properly parse out the required
information. We need to make sure that all the tags
are the same length so that the parsing script can
parse them correctly. We also need to make sure that
the last character in tag is ":" in order for the
parsing script to get the full tag string correctly.
CRs-Fixed: 3467258
Change-Id: Ie8107ffd902d70d88026632a2c9fadaca0c276d8
Signed-off-by: mingpan <quic_mingpan@quicinc.com>
Get CDM callback done timestamp for LDAR to know
if CDM write delay. And enlarge event monitor
numbers to make sure dump 10+ frames info.
CRs-Fixed: 3430787
Change-Id: If5a1bd925d5d82d1856d880ccb1f4ed9effc5251
Signed-off-by: Wang Kan <quic_wkan@quicinc.com>
When UMD requests to flush specific request that was submitted
to HW/FW, return error code back to userspace and log the particular
active request id if the device does not flush active request.
Currently devices that do not support flushing a specific active
request are ICP, OPE, and CRE.
Return error if there is no request to flush upon UMD call to
flush specific request.
Print all ICP requests' id from all active streams when encountering
WD or ICP fatal errors.
CRs-Fixed: 3438283
Change-Id: I7921463250c6e5e45ec263ccdce9d60d2b0f1ed3
Signed-off-by: Sokchetra Eung <quic_eung@quicinc.com>
This change makes use of a variable after assignment.
CRs-Fixed: 3394193
Change-Id: I4e0df3646c71e8e3fc4219ba4b500a7ac6cc03d6
Signed-off-by: Atiya Kailany <quic_akailany@quicinc.com>
This change is to validate session and device handle.
Also, checks whether the device handle belongs to
correct session handle or not.
CRs-Fixed: 3350595
Change-Id: If1e06607ccaa99d3288ddca6a263d54315b14caa
Signed-off-by: Karthik Dillibabu <quic_kard@quicinc.com>
Add switch case to handle query cap v2 ioctl, and add query cap
v2 hw mgr intf function pointer to handle query cap v2.
CRs-Fixed: 3364267
Change-Id: I1f992982f8d06755c977839ee61ee450306d65a5
Signed-off-by: Petar Ivanov <quic_pivanov@quicinc.com>
Signed-off-by: Sokchetra Eung <quic_eung@quicinc.com>
Add infrastructure to allow multiple ICP subdevices to co-exist
with each subdevice exposed to UMD individually. All operations
including ioctl on each subdevice are discrete from another's. Add
a new private field in node structure to point to which subdev
the node belongs to. Add a new ICP1 device type and expose the type
associated with ICP1 to userspace for identifying the second ICP.
Each subdevice's unique name is derived from "cam-icp". The name is
then appended with a cell-index if it exists. If there are multiple
nodes in DTSI to be probed, each node must contain cell-index to
differentiate them.
For each subdevice, it is expected to have a unique node in DTSI
with unique compatible string to probe the sd during boottime.
CRs-Fixed: 3336505
Change-Id: I615f9489d5f22b0ec37f98be3fec4c67b06a52d0
Signed-off-by: Sokchetra Eung <quic_eung@quicinc.com>
It is possible for UMD to send synx handles directly to FW
for input or output. FW will signal these fences to CPU.
On such occasions, ICP HLOS driver can skip processing
input and output synx fences. Synx will signal CSL.
CRs-Fixed: 3351015
Change-Id: Ia2c36db3bdaf75e12e27484357350fb20f32fcbc
Signed-off-by: Karthik Anantha Ram <quic_kartanan@quicinc.com>
When LDAR dump is triggered check for any remaining buffers in all
possible buffer lists in the ICP, in case of found buffers add their
info to the LDAR Dump.
CRs-Fixed: 3298809
Change-Id: I55d3780c7d789e3a77e78c9ef3ecffc9a36419f3
Signed-off-by: Petar Ivanov <quic_pivanov@quicinc.com>
fix the compilation issue, of switch case where break statement was
missing.
Change-Id: Ibae74f966f13cea0e218c14caf9dafbb4bfb87cb
CRs-Fixed: 3306362
Signed-off-by: Soumen Ghosh <quic_soumeng@quicinc.com>
Update from error injection framework to event injection framework to
support PF event inducement and node event. Different set of user
input parameters are required dependent on which event to injection.
ICP and ISP support error event and page fault event injection. JPEG
supports node event and page fault event injection. However, buf done
error injection is only supported for JPEG and ICP.
Create a query API to check whether PF is fatal for a context bank.
Using the API, if PF is fatal, page fault event injection is not
supported for the device that owns the context bank.
Make change to JPEG context event callback handling to account for
various events including Event Injection event.
CRs-Fixed: 3210139
Change-Id: I582ee0bda8dbf631ece2522a5a8145f38ec71928
Signed-off-by: Sokchetra Eung <quic_eung@quicinc.com>
Instead of caching packet address pointer, store packet handle
in page fault req info structutre to obtain packet address through
mem manager to avoid potential access to dangling packet pointer which
resulted from UMD called to free the packet buffer before kernel finishes
handling page fault. If the packet was freed, then querying to get packet
address from memory manager will fail since the mem handle is invalid.
If it is invalid, the page fault handler will return before accessing
the dangling packet.
CRs-Fixed: 3287554
Change-Id: I02bc0c706b64f1dc0d098d8189f2f129a91efba7
Signed-off-by: Sokchetra Eung <quic_eung@quicinc.com>
Null pointer 'flush_args.flush_req_pending' may be dereferenced,
this change add check snippet before the dereference.
CRs-Fixed: 3250285
Change-Id: I1170a291e7d0d986abe2d5909e6c328e248e4d27
Signed-off-by: Stark Lin <quic_starlin@quicinc.com>
Signed-off-by: Depeng Shao <quic_depengs@quicinc.com>
Remove unnecessary memsets of the structure variables
whose fields are assigned prior to their usage or they
are dynamically allocated with calls that set the memory
to 0. This memset usage optimization is to improve
performance.
CRs-Fixed: 3228092
Change-Id: Iec68c6d072863627959ce603cff28afd26a1c408
Signed-off-by: Sokchetra Eung <quic_eung@quicinc.com>
Shared memory is initialized by CRM and used by
other drivers; with CRM not active other drivers
would fail to access the shared memory if
memory manager is deinit. Reader Writer locks can
prevent the open/close/ioctl calls from other drivers
if CRM open/close is already being processed.
Issue observed with the below sequence if drivers
are opened from UMD directly without this change.
CRM Open successful,ICP open successful,
CRM close in progress, ICP open successful,
mem mgr deinit and CRM close successful,
ICP tries to access HFI memory and result in crash.
This change helps to serialze the calls and prevents
issue.
CRs-Fixed: 3019488
Change-Id: I84d50918713686a067c0e3deb64c9c6ae9edfcb5
Signed-off-by: Tejas Prajapati <quic_tpraja@quicinc.com>
Upon Page Fault, smmu driver invokes faulted client's callback
which looks for faulted buffer and context. The client driver
can be ISP, ICP, JPEG, IFE CDM and CPAS CDM. The driver then
fills PF msg struct, logs related info, and notify PF msg to
userspace. Userspace is expected to abort and calls to shut
down kernel drivers. When Titan powers on next session, CAMSS
undergoes async reset.
This change also ensures the page fault related changes added
to TFE, OPE, CRE do not break the drivers compilation.
CRs-Fixed: 3156671
Change-Id: Icd6c8c9a38cac206fe8260d374d03964fb280879
Signed-off-by: sokchetra eung <quic_eung@quicinc.com>
Separated ISP register dump from LDAR dump, fixed issue where LDAR dump
would fail if no active requests found, removed excessive logging function
call in ISP state monitor dump, fixed pending request/applied request dump
order to match tags in context utils, added more info from ISP stream.
CRs-Fixed: 3142549
Change-Id: Iaf25c0313714b5a776e3db81c11e96c7762d0f6e
Signed-off-by: Joshua Florez <quic_jflorez@quicinc.com>
Add and implement sysfs parameters to inject errors to
camera HW on demand through UMD for IFE,ICP and JPEG.
CRs-Fixed: 3115857
Change-Id: I4376fe31016cd81ad7e6f04cbc55e8ce010a6154
Signed-off-by: Pranav Sanwal <quic_psanwal@quicinc.com>
Change flush request active and flush request pending arrays from
static of size 20 to dynamically allocated size based on current
pending and active request lists.
CRs-Fixed: 3046003
Change-Id: Iaa1179881d786359dbe9d37411a6ef3ae8038227
Signed-off-by: sokchetra eung <quic_eung@quicinc.com>
Extension of Let's do a reset (LDAR) for ICP to include more info.
CRs-Fixed: 3105929
Change-Id: I5fee181d009a8d69e8d3e673a552b289f72fb4aa
Signed-off-by: Joshua Florez <quic_jflorez@quicinc.com>
After flushed, KMD reports ERR including isp, actuator, sensor, flash.
However many CRs don't have fatal KMD error log, but participant is KMD.
Remove the non-fatal KMD error log.
CRs-Fixed: 3095401
Change-Id: I0e5e370c0c4d1daceb72d9eed8d0c45baad5179e
Signed-off-by: Wang Kan <quic_wkan@quicinc.com>
IRQ line verification can now be triggerred from IFE HW manager by
writing to a debugfs file as follows:
echo 1 > /d/camera/ife/test_irq_line
IRQ line verification can also be done at probe if
CONFIG_CAM_TEST_IRQ_LINE_AT_PROBE is set to true during compilation.
Both debugfs and probe-time verifications are only active if
CONFIG_CAM_TEST_IRQ_LINE is set to true during compilation.
CRs-Fixed: 3071027
Change-Id: I0f756ae76d366c254b4af64adf60fe6be7a1a2ef
Signed-off-by: Anand Ravi <quic_ananravi@quicinc.com>
Make the context memory request for hw update entries,
in_map entries and the out_map entries per request, instead
of requesting the memory for all the requests at once in a
large blob. This will prevent the memory requests getting
denied in the situations like memory fragmentation.
CRs-Fixed: 3059124
Change-Id: I829407a6053ddddfe4bc9a07d3ae5724a57eb602
Signed-off-by: Jigar Agrawal <jigar@codeaurora.org>
While preparing hw for request, there is a possiblity of receiving
invalid sync object. In this case, we need to return error. By this
time, the request is already in pending list. While returning error,
request is moved back to free list. But deleting from the pending list
was missed.
This commit deleted the request from the pending list if the sync object
received is invalid.
CRs-Fixed: 2660625
Change-Id: Id619452889476b0c2811c8560361205b0d89bcb9
Signed-off-by: Gaurav Jindal <gjindal@codeaurora.org>
Currently reapply field in config args signifies applying
only IO buffers. Update that field as an enum providing
the provision to reapply IQ or IO accordingly.
CRs-Fixed: 3045706
Change-Id: Id10ee846a6de093e5a79858689802e421628ce56
Signed-off-by: Karthik Anantha Ram <kartanan@codeaurora.org>
Presil IRQ handling requires running in a workqueue, with
wait for acknowledgement in io operations. This busy wait
should be done while holding a mutex lock as opposed to
spinlock in usual irq context. Add wrapper to switch from
spinlock to mutex for presil mode in irq controller and
cdm. Add the hw lock wrapper in hw interface header.
CRs-Fixed: 2932495
Change-Id: I7600eb1e6ae8746a39e76f6cb3a2652b255f2ddd
Signed-off-by: Suraj Dongre <sdongre@codeaurora.org>
Signed-off-by: Mukund Madhusudan Atre <matre@codeaurora.org>
Based on targets, in case of device crash, in place
of complete memory dump, mini dump can be extracted.
This commit adds changes in context utils for NRT devices
and in ICP, JPEG drivers.
CRs-Fixed: 2993116
Change-Id: I7c4af2cdf44713f741d3d772316080124e8a9a7f
Signed-off-by: Gaurav Jindal <gjindal@codeaurora.org>
Based on targets, in case of device crash, in place
of complete memory dump, mini dump can be extracted.
This commit adds changes for basic framework
to interact with base kernel for mini dump.
This commit also adds changes for ISP, CRM, SMMU and
Memory Manager.
CRs-Fixed: 2993116
Change-Id: I02620bd79ee2f84847381509a5eb030ffb1ca9d4
Signed-off-by: Gaurav Jindal <gjindal@codeaurora.org>
Add support for JPEG Thumbnail retry mechanism. Restructure
the command buffer arrangement, add JPEG generic blob functionality
and add support to notify user when the JPEG Thumbnail encoder
size increases than the threshold size received through blob.
CRs-Fixed: 2999106
Change-Id: Ica74f934939b562a3a88af551bfb5de79399e247
Signed-off-by: Jigar Agrawal <jigar@codeaurora.org>
Since recovery callback happens in workqueue context, it can run in
parallel with stop dev ioctl. This leads to many possible race
conditions. Instead, protect the recovery callback with the same context
mutex as ioctls to prevent parallel execution.
CRs-Fixed: 3003703
Change-Id: I92a635cfaeee4cf09047672a5cb925cf262cd816
Signed-off-by: Anand Ravi <ananravi@codeaurora.org>
