From 217ebc5e61a9968a7596c16cdd3dfcb26f2a6b56 Mon Sep 17 00:00:00 2001 From: Karthik Dillibabu Date: Tue, 9 May 2023 15:55:25 +0530 Subject: [PATCH 1/4] msm: camera: core: validation of session/device/link handle This change is to validate session, device and link handle. Also, checks whether the device handle belongs to correct session handle or not. CRs-Fixed: 3496553 Change-Id: I6b86bf7d0908a280e90e085a3b3e1727facdf8c6 Signed-off-by: Karthik Dillibabu --- drivers/cam_req_mgr/cam_req_mgr_core.c | 70 ++++++--------- drivers/cam_req_mgr/cam_req_mgr_util.c | 115 +++++++++++++++++++++---- drivers/cam_req_mgr/cam_req_mgr_util.h | 55 ++++++++++-- 3 files changed, 177 insertions(+), 63 deletions(-) diff --git a/drivers/cam_req_mgr/cam_req_mgr_core.c b/drivers/cam_req_mgr/cam_req_mgr_core.c index 5f6f3ae3e8b0..887bdce34744 100644 --- a/drivers/cam_req_mgr/cam_req_mgr_core.c +++ b/drivers/cam_req_mgr/cam_req_mgr_core.c @@ -1,7 +1,7 @@ // SPDX-License-Identifier: GPL-2.0-only /* * Copyright (c) 2016-2021, The Linux Foundation. All rights reserved. - * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved. + * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved. */ #include @@ -3164,9 +3164,7 @@ static int cam_req_mgr_cb_add_req(struct cam_req_mgr_add_request *add_req) return -EINVAL; } - link = (struct cam_req_mgr_core_link *) - cam_get_device_priv(add_req->link_hdl); - + link = cam_get_link_priv(add_req->link_hdl); if (!link) { CAM_DBG(CAM_CRM, "link ptr NULL %x", add_req->link_hdl); return -EINVAL; @@ -3253,8 +3251,7 @@ static int cam_req_mgr_cb_notify_err( goto end; } - link = (struct cam_req_mgr_core_link *) - cam_get_device_priv(err_info->link_hdl); + link = cam_get_link_priv(err_info->link_hdl); if (!link) { CAM_DBG(CAM_CRM, "link ptr NULL %x", err_info->link_hdl); rc = -EINVAL; @@ -3351,8 +3348,7 @@ static int cam_req_mgr_cb_notify_timer( goto end; } - link = (struct cam_req_mgr_core_link *) - cam_get_device_priv(timer_data->link_hdl); + link = cam_get_link_priv(timer_data->link_hdl); if (!link) { CAM_DBG(CAM_CRM, "link ptr NULL %x", timer_data->link_hdl); rc = -EINVAL; @@ -3406,8 +3402,7 @@ static int cam_req_mgr_cb_notify_stop( goto end; } - link = (struct cam_req_mgr_core_link *) - cam_get_device_priv(stop_info->link_hdl); + link = cam_get_link_priv(stop_info->link_hdl); if (!link) { CAM_DBG(CAM_CRM, "link ptr NULL %x", stop_info->link_hdl); rc = -EINVAL; @@ -3470,8 +3465,7 @@ static int cam_req_mgr_cb_notify_trigger( goto end; } - link = (struct cam_req_mgr_core_link *) - cam_get_device_priv(trigger_data->link_hdl); + link = cam_get_link_priv(trigger_data->link_hdl); if (!link) { CAM_DBG(CAM_CRM, "link ptr NULL %x", trigger_data->link_hdl); rc = -EINVAL; @@ -3851,7 +3845,7 @@ static int __cam_req_mgr_unlink( __cam_req_mgr_destroy_subdev(&link->l_dev); /* Destroy the link handle */ - rc = cam_destroy_device_hdl(link->link_hdl); + rc = cam_destroy_link_hdl(link->link_hdl); if (rc < 0) { CAM_ERR(CAM_CRM, "error destroying link hdl %x rc %d", link->link_hdl, rc); @@ -3877,8 +3871,7 @@ int cam_req_mgr_destroy_session( } mutex_lock(&g_crm_core_dev->crm_lock); - cam_session = (struct cam_req_mgr_core_session *) - cam_get_device_priv(ses_info->session_hdl); + cam_session = cam_get_session_priv(ses_info->session_hdl); if (!cam_session || (cam_session->session_hdl != ses_info->session_hdl)) { CAM_ERR(CAM_CRM, "session: %s, ses_info->ses_hdl:%x, session->ses_hdl:%x", CAM_IS_NULL_TO_STR(cam_session), ses_info->session_hdl, @@ -3950,8 +3943,7 @@ int cam_req_mgr_link(struct cam_req_mgr_ver_info *link_info) mutex_lock(&g_crm_core_dev->crm_lock); /* session hdl's priv data is cam session struct */ - cam_session = (struct cam_req_mgr_core_session *) - cam_get_device_priv(link_info->u.link_info_v1.session_hdl); + cam_session = cam_get_session_priv(link_info->u.link_info_v1.session_hdl); if (!cam_session || (cam_session->session_hdl != link_info->u.link_info_v1.session_hdl)) { CAM_ERR(CAM_CRM, "session: %s, link_info->ses_hdl:%x, session->ses_hdl:%x", CAM_IS_NULL_TO_STR(cam_session), link_info->u.link_info_v1.session_hdl, @@ -3974,8 +3966,8 @@ int cam_req_mgr_link(struct cam_req_mgr_ver_info *link_info) root_dev.priv = (void *)link; root_dev.dev_id = CAM_CRM; mutex_lock(&link->lock); - /* Create unique dev handle for link */ - link->link_hdl = cam_create_device_hdl(&root_dev); + /* Create unique handle for link */ + link->link_hdl = cam_create_link_hdl(&root_dev); if (link->link_hdl < 0) { CAM_ERR(CAM_CRM, "Insufficient memory to create new device handle"); @@ -4030,7 +4022,7 @@ int cam_req_mgr_link(struct cam_req_mgr_ver_info *link_info) setup_failed: __cam_req_mgr_destroy_subdev(&link->l_dev); create_subdev_failed: - cam_destroy_device_hdl(link->link_hdl); + cam_destroy_link_hdl(link->link_hdl); link_info->u.link_info_v1.link_hdl = -1; link_hdl_fail: mutex_unlock(&link->lock); @@ -4062,8 +4054,7 @@ int cam_req_mgr_link_v2(struct cam_req_mgr_ver_info *link_info) mutex_lock(&g_crm_core_dev->crm_lock); /* session hdl's priv data is cam session struct */ - cam_session = (struct cam_req_mgr_core_session *) - cam_get_device_priv(link_info->u.link_info_v2.session_hdl); + cam_session = cam_get_session_priv(link_info->u.link_info_v2.session_hdl); if (!cam_session || (cam_session->session_hdl != link_info->u.link_info_v2.session_hdl)) { CAM_ERR(CAM_CRM, "session: %s, link_info->ses_hdl:%x, session->ses_hdl:%x", CAM_IS_NULL_TO_STR(cam_session), link_info->u.link_info_v2.session_hdl, @@ -4087,8 +4078,8 @@ int cam_req_mgr_link_v2(struct cam_req_mgr_ver_info *link_info) root_dev.dev_id = CAM_CRM; mutex_lock(&link->lock); - /* Create unique dev handle for link */ - link->link_hdl = cam_create_device_hdl(&root_dev); + /* Create unique handle for link */ + link->link_hdl = cam_create_link_hdl(&root_dev); if (link->link_hdl < 0) { CAM_ERR(CAM_CRM, "Insufficient memory to create new device handle"); @@ -4148,7 +4139,7 @@ int cam_req_mgr_link_v2(struct cam_req_mgr_ver_info *link_info) setup_failed: __cam_req_mgr_destroy_subdev(&link->l_dev); create_subdev_failed: - cam_destroy_device_hdl(link->link_hdl); + cam_destroy_link_hdl(link->link_hdl); link_info->u.link_info_v2.link_hdl = -1; link_hdl_fail: mutex_unlock(&link->lock); @@ -4173,8 +4164,7 @@ int cam_req_mgr_unlink(struct cam_req_mgr_unlink_info *unlink_info) CAM_DBG(CAM_CRM, "link_hdl %x", unlink_info->link_hdl); /* session hdl's priv data is cam session struct */ - cam_session = (struct cam_req_mgr_core_session *) - cam_get_device_priv(unlink_info->session_hdl); + cam_session = cam_get_session_priv(unlink_info->session_hdl); if (!cam_session || (cam_session->session_hdl != unlink_info->session_hdl)) { CAM_ERR(CAM_CRM, "session: %s, unlink_info->ses_hdl:%x, cam_session->ses_hdl:%x", CAM_IS_NULL_TO_STR(cam_session), unlink_info->session_hdl, @@ -4184,7 +4174,7 @@ int cam_req_mgr_unlink(struct cam_req_mgr_unlink_info *unlink_info) } /* link hdl's priv data is core_link struct */ - link = cam_get_device_priv(unlink_info->link_hdl); + link = cam_get_link_priv(unlink_info->link_hdl); if (!link || (link->link_hdl != unlink_info->link_hdl)) { CAM_ERR(CAM_CRM, "link: %s, unlink_info->link_hdl:%x, link->link_hdl:%x", CAM_IS_NULL_TO_STR(link), unlink_info->link_hdl, @@ -4219,8 +4209,7 @@ int cam_req_mgr_schedule_request( } mutex_lock(&g_crm_core_dev->crm_lock); - link = (struct cam_req_mgr_core_link *) - cam_get_device_priv(sched_req->link_hdl); + link = cam_get_link_priv(sched_req->link_hdl); if (!link || (link->link_hdl != sched_req->link_hdl)) { CAM_ERR(CAM_CRM, "link: %s, sched_req->link_hdl:%x, link->link_hdl:%x", CAM_IS_NULL_TO_STR(link), sched_req->link_hdl, @@ -4306,8 +4295,7 @@ int cam_req_mgr_sync_config( mutex_lock(&g_crm_core_dev->crm_lock); /* session hdl's priv data is cam session struct */ - cam_session = (struct cam_req_mgr_core_session *) - cam_get_device_priv(sync_info->session_hdl); + cam_session = cam_get_session_priv(sync_info->session_hdl); if (!cam_session || (cam_session->session_hdl != sync_info->session_hdl)) { CAM_ERR(CAM_CRM, "session: %s, sync_info->session_hdl:%x, session->ses_hdl:%x", CAM_IS_NULL_TO_STR(cam_session), sync_info->session_hdl, @@ -4326,7 +4314,7 @@ int cam_req_mgr_sync_config( goto done; } - link[i] = cam_get_device_priv(sync_info->link_hdls[i]); + link[i] = cam_get_link_priv(sync_info->link_hdls[i]); if (!link[i] || (link[i]->link_hdl != sync_info->link_hdls[i])) { CAM_ERR(CAM_CRM, "link: %s, sync_info->link_hdl:%x, link->link_hdl:%x", CAM_IS_NULL_TO_STR(link), sync_info->link_hdls[i], @@ -4403,9 +4391,9 @@ int cam_req_mgr_flush_requests( } mutex_lock(&g_crm_core_dev->crm_lock); + /* session hdl's priv data is cam session struct */ - session = (struct cam_req_mgr_core_session *) - cam_get_device_priv(flush_info->session_hdl); + session = cam_get_session_priv(flush_info->session_hdl); if (!session || (session->session_hdl != flush_info->session_hdl)) { CAM_ERR(CAM_CRM, "session: %s, flush_info->ses_hdl:%x, session->ses_hdl:%x", CAM_IS_NULL_TO_STR(session), flush_info->session_hdl, @@ -4419,8 +4407,7 @@ int cam_req_mgr_flush_requests( goto end; } - link = (struct cam_req_mgr_core_link *) - cam_get_device_priv(flush_info->link_hdl); + link = cam_get_link_priv(flush_info->link_hdl); if (!link || (link->link_hdl != flush_info->link_hdl)) { CAM_ERR(CAM_CRM, "link: %s, flush_info->link_hdl:%x, link->link_hdl:%x", CAM_IS_NULL_TO_STR(link), flush_info->link_hdl, @@ -4480,8 +4467,7 @@ int cam_req_mgr_link_control(struct cam_req_mgr_link_control *control) mutex_lock(&g_crm_core_dev->crm_lock); for (i = 0; i < control->num_links; i++) { - link = (struct cam_req_mgr_core_link *) - cam_get_device_priv(control->link_hdls[i]); + link = cam_get_link_priv(control->link_hdls[i]); if (!link || (link->link_hdl != control->link_hdls[i])) { CAM_ERR(CAM_CRM, "link: %s, control->link_hdl:%x, link->link_hdl:%x", CAM_IS_NULL_TO_STR(link), control->link_hdls[i], @@ -4569,8 +4555,7 @@ int cam_req_mgr_dump_request(struct cam_dump_req_cmd *dump_req) mutex_lock(&g_crm_core_dev->crm_lock); /* session hdl's priv data is cam session struct */ - session = (struct cam_req_mgr_core_session *) - cam_get_device_priv(dump_req->session_handle); + session = cam_get_session_priv(dump_req->session_handle); if (!session || (session->session_hdl != dump_req->session_handle)) { CAM_ERR(CAM_CRM, "session: %s, dump_req->ses_hdl:%x, session->ses_hdl:%x", CAM_IS_NULL_TO_STR(session), dump_req->session_handle, @@ -4584,8 +4569,7 @@ int cam_req_mgr_dump_request(struct cam_dump_req_cmd *dump_req) goto end; } - link = (struct cam_req_mgr_core_link *) - cam_get_device_priv(dump_req->link_hdl); + link = cam_get_link_priv(dump_req->link_hdl); if (!link || (link->link_hdl != dump_req->link_hdl)) { CAM_ERR(CAM_CRM, "link: %s, dump_req->link_hdl:%x, link->link_hdl:%x", CAM_IS_NULL_TO_STR(link), dump_req->link_hdl, diff --git a/drivers/cam_req_mgr/cam_req_mgr_util.c b/drivers/cam_req_mgr/cam_req_mgr_util.c index 3c44058d2813..2be1ce7cfec2 100644 --- a/drivers/cam_req_mgr/cam_req_mgr_util.c +++ b/drivers/cam_req_mgr/cam_req_mgr_util.c @@ -1,6 +1,7 @@ // SPDX-License-Identifier: GPL-2.0-only /* * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved. + * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved. */ #define pr_fmt(fmt) "CAM-REQ-MGR_UTIL %s:%d " fmt, __func__, __LINE__ @@ -37,28 +38,29 @@ int cam_req_mgr_util_init(void) rc = -ENOMEM; goto hdl_tbl_alloc_failed; } + bitmap_size = BITS_TO_LONGS(CAM_REQ_MGR_MAX_HANDLES_V2) * sizeof(long); + hdl_tbl_local->bitmap = kzalloc(bitmap_size, GFP_KERNEL); + if (!hdl_tbl_local->bitmap) { + rc = -ENOMEM; + goto bitmap_alloc_fail; + } + hdl_tbl_local->bits = bitmap_size * BITS_PER_BYTE; + spin_lock_bh(&hdl_tbl_lock); if (hdl_tbl) { spin_unlock_bh(&hdl_tbl_lock); rc = -EEXIST; + kfree(hdl_tbl_local->bitmap); kfree(hdl_tbl_local); goto hdl_tbl_check_failed; } hdl_tbl = hdl_tbl_local; spin_unlock_bh(&hdl_tbl_lock); - bitmap_size = BITS_TO_LONGS(CAM_REQ_MGR_MAX_HANDLES_V2) * sizeof(long); - hdl_tbl->bitmap = kzalloc(bitmap_size, GFP_KERNEL); - if (!hdl_tbl->bitmap) { - rc = -ENOMEM; - goto bitmap_alloc_fail; - } - hdl_tbl->bits = bitmap_size * BITS_PER_BYTE; - return rc; bitmap_alloc_fail: - kfree(hdl_tbl); + kfree(hdl_tbl_local); hdl_tbl = NULL; hdl_tbl_alloc_failed: hdl_tbl_check_failed: @@ -125,6 +127,18 @@ static int32_t cam_get_free_handle_index(void) return idx; } +static void cam_dump_tbl_info(void) +{ + int i; + + for (i = 0; i < CAM_REQ_MGR_MAX_HANDLES_V2; i++) + CAM_INFO_RATE_LIMIT_CUSTOM(CAM_CRM, CAM_RATE_LIMIT_INTERVAL_5SEC, + CAM_REQ_MGR_MAX_HANDLES_V2, + "session_hdl=%x hdl_value=%x type=%d state=%d dev_id=%lld", + hdl_tbl->hdl[i].session_hdl, hdl_tbl->hdl[i].hdl_value, + hdl_tbl->hdl[i].type, hdl_tbl->hdl[i].state, hdl_tbl->hdl[i].dev_id); +} + int32_t cam_create_session_hdl(void *priv) { int idx; @@ -140,7 +154,8 @@ int32_t cam_create_session_hdl(void *priv) idx = cam_get_free_handle_index(); if (idx < 0) { - CAM_ERR(CAM_CRM, "Unable to create session handle"); + CAM_ERR(CAM_CRM, "Unable to create session handle(idx = %d)", idx); + cam_dump_tbl_info(); spin_unlock_bh(&hdl_tbl_lock); return idx; } @@ -182,8 +197,8 @@ int32_t cam_create_device_hdl(struct cam_create_dev_hdl *hdl_data) idx = cam_get_free_handle_index(); if (idx < 0) { - CAM_ERR(CAM_CRM, - "Unable to create device handle(idx= %d)", idx); + CAM_ERR(CAM_CRM, "Unable to create device handle(idx= %d)", idx); + cam_dump_tbl_info(); spin_unlock_bh(&hdl_tbl_lock); return idx; } @@ -233,7 +248,43 @@ uint64_t cam_get_dev_handle_status(void) return active_dev_hdls; } -void *cam_get_device_priv(int32_t dev_hdl) +int32_t cam_create_link_hdl(struct cam_create_dev_hdl *hdl_data) +{ + int idx; + int rand = 0; + int32_t handle; + + spin_lock_bh(&hdl_tbl_lock); + if (!hdl_tbl) { + CAM_ERR(CAM_CRM, "Hdl tbl is NULL"); + spin_unlock_bh(&hdl_tbl_lock); + return -EINVAL; + } + + idx = cam_get_free_handle_index(); + if (idx < 0) { + CAM_ERR(CAM_CRM, "Unable to create link handle(idx = %d)", idx); + cam_dump_tbl_info(); + spin_unlock_bh(&hdl_tbl_lock); + return idx; + } + + get_random_bytes(&rand, CAM_REQ_MGR_RND1_BYTES); + handle = GET_DEV_HANDLE(rand, HDL_TYPE_LINK, idx); + hdl_tbl->hdl[idx].session_hdl = hdl_data->session_hdl; + hdl_tbl->hdl[idx].hdl_value = handle; + hdl_tbl->hdl[idx].type = HDL_TYPE_LINK; + hdl_tbl->hdl[idx].state = HDL_ACTIVE; + hdl_tbl->hdl[idx].priv = hdl_data->priv; + hdl_tbl->hdl[idx].ops = NULL; + hdl_tbl->hdl[idx].dev_id = hdl_data->dev_id; + spin_unlock_bh(&hdl_tbl_lock); + + CAM_DBG(CAM_CRM, "handle = %x", handle); + return handle; +} + +void *cam_get_priv(int32_t dev_hdl, int handle_type) { int idx; int type; @@ -264,7 +315,7 @@ void *cam_get_device_priv(int32_t dev_hdl) } type = CAM_REQ_MGR_GET_HDL_TYPE(dev_hdl); - if (HDL_TYPE_DEV != type && HDL_TYPE_SESSION != type) { + if (type != handle_type) { CAM_ERR_RATE_LIMIT(CAM_CRM, "Invalid type:%d", type); goto device_priv_fail; } @@ -279,6 +330,34 @@ device_priv_fail: return NULL; } +void *cam_get_device_priv(int32_t dev_hdl) +{ + void *priv; + + priv = cam_get_priv(dev_hdl, HDL_TYPE_DEV); + return priv; +} + +struct cam_req_mgr_core_session *cam_get_session_priv(int32_t dev_hdl) +{ + struct cam_req_mgr_core_session *priv; + + priv = (struct cam_req_mgr_core_session *) + cam_get_priv(dev_hdl, HDL_TYPE_SESSION); + + return priv; +} + +struct cam_req_mgr_core_link *cam_get_link_priv(int32_t dev_hdl) +{ + struct cam_req_mgr_core_link *priv; + + priv = (struct cam_req_mgr_core_link *) + cam_get_priv(dev_hdl, HDL_TYPE_LINK); + + return priv; +} + void *cam_get_device_ops(int32_t dev_hdl) { int idx; @@ -303,7 +382,7 @@ void *cam_get_device_ops(int32_t dev_hdl) } type = CAM_REQ_MGR_GET_HDL_TYPE(dev_hdl); - if (HDL_TYPE_DEV != type && HDL_TYPE_SESSION != type) { + if (HDL_TYPE_DEV != type && HDL_TYPE_SESSION != type && HDL_TYPE_LINK != type) { CAM_ERR(CAM_CRM, "Invalid type"); goto device_ops_fail; } @@ -374,6 +453,12 @@ int cam_destroy_device_hdl(int32_t dev_hdl) return cam_destroy_hdl(dev_hdl, HDL_TYPE_DEV); } +int cam_destroy_link_hdl(int32_t dev_hdl) +{ + CAM_DBG(CAM_CRM, "handle = %x", dev_hdl); + return cam_destroy_hdl(dev_hdl, HDL_TYPE_LINK); +} + int cam_destroy_session_hdl(int32_t dev_hdl) { return cam_destroy_hdl(dev_hdl, HDL_TYPE_SESSION); diff --git a/drivers/cam_req_mgr/cam_req_mgr_util.h b/drivers/cam_req_mgr/cam_req_mgr_util.h index fb70401306d9..68671b7cf7bc 100644 --- a/drivers/cam_req_mgr/cam_req_mgr_util.h +++ b/drivers/cam_req_mgr/cam_req_mgr_util.h @@ -1,6 +1,7 @@ /* SPDX-License-Identifier: GPL-2.0-only */ /* * Copyright (c) 2016-2021, The Linux Foundation. All rights reserved. + * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved. */ #ifndef _CAM_REQ_MGR_UTIL_API_H_ @@ -9,6 +10,9 @@ #include #include "cam_req_mgr_util_priv.h" +/* Interval for cam_info_rate_limit_custom() */ +#define CAM_RATE_LIMIT_INTERVAL_5SEC 5 + /** * state of a handle(session/device) * @HDL_FREE: free handle @@ -21,12 +25,14 @@ enum hdl_state { /** * handle type - * @HDL_TYPE_DEV: for device and link + * @HDL_TYPE_DEV: for device * @HDL_TYPE_SESSION: for session + * @HDL_TYPE_LINK: for link */ enum hdl_type { HDL_TYPE_DEV = 1, - HDL_TYPE_SESSION + HDL_TYPE_SESSION, + HDL_TYPE_LINK }; /** @@ -103,8 +109,19 @@ int32_t cam_create_session_hdl(void *priv); int32_t cam_create_device_hdl(struct cam_create_dev_hdl *hdl_data); /** - * cam_get_device_priv() - get private data of a handle - * @dev_hdl: handle for a session/link/device + * cam_create_link_hdl() - create a link handle + * @hdl_data: session hdl, flags, ops and priv dara as input + * + * cam_req_mgr_core calls this function to get + * session and link handles + * KMD drivers calls this function to create + * a link handle. Returns a unique link handle + */ +int32_t cam_create_link_hdl(struct cam_create_dev_hdl *hdl_data); + +/** + * cam_get_device_priv() - get private data of a device handle + * @dev_hdl: handle for a device * * cam_req_mgr_core and KMD drivers use this function to * get private data of a handle. Returns a private data @@ -112,6 +129,26 @@ int32_t cam_create_device_hdl(struct cam_create_dev_hdl *hdl_data); */ void *cam_get_device_priv(int32_t dev_hdl); +/** + * cam_get_session_priv() - get private data of a session handle + * @dev_hdl: handle for a session + * + * cam_req_mgr_core and KMD drivers use this function to + * get private data of a handle. Returns a private data + * structure pointer. + */ +struct cam_req_mgr_core_session *cam_get_session_priv(int32_t dev_hdl); + +/** + * cam_get_link_priv() - get private data of a link handle + * @dev_hdl: handle for a link + * + * cam_req_mgr_core and KMD drivers use this function to + * get private data of a handle. Returns a private data + * structure pointer. + */ +struct cam_req_mgr_core_link *cam_get_link_priv(int32_t dev_hdl); + /** * cam_get_device_ops() - get ops of a handle * @dev_hdl: handle for a session/link/device @@ -123,12 +160,20 @@ void *cam_get_device_ops(int32_t dev_hdl); /** * cam_destroy_device_hdl() - destroy device handle - * @dev_hdl: handle for a link/device. + * @dev_hdl: handle for a device. * * Returns success/failure */ int32_t cam_destroy_device_hdl(int32_t dev_hdl); +/** + * cam_destroy_link_hdl() - destroy link handle + * @dev_hdl: handle for a link. + * + * Returns success/failure + */ +int32_t cam_destroy_link_hdl(int32_t dev_hdl); + /** * cam_destroy_session_hdl() - destroy device handle * @dev_hdl: handle for a session From 575f20ea96c0492a660bdd9d9ca631c6574f95e7 Mon Sep 17 00:00:00 2001 From: Shivakumar Malke Date: Fri, 19 May 2023 11:52:42 +0530 Subject: [PATCH 2/4] msm: camera: mem_mgr: Add refcount to track in use buffers The function cam_mem_mgr_release can unmap the buffers when in use. This change prevents unmapping the buffers when in use. CRs-Fixed: 3489559 Change-Id: I2e72e795d39ac15abfa56c19043c419a03686966 Signed-off-by: Shivakumar Malke Signed-off-by: Gaurav Jindal --- drivers/cam_cdm/cam_cdm_virtual_core.c | 20 +++- drivers/cam_core/cam_context_utils.c | 7 +- .../cam_custom_hw_mgr/cam_custom_hw_mgr.c | 2 + drivers/cam_fd/fd_hw_mgr/cam_fd_hw_mgr.c | 43 +++++++- drivers/cam_icp/cam_icp_context.c | 4 + .../icp_hw/icp_hw_mgr/cam_icp_hw_mgr.c | 19 +++- drivers/cam_isp/cam_isp_context.c | 25 +++-- drivers/cam_isp/isp_hw_mgr/cam_ife_hw_mgr.c | 2 + drivers/cam_isp/isp_hw_mgr/cam_tfe_hw_mgr.c | 6 +- .../hw_utils/cam_isp_packet_parser.c | 4 + drivers/cam_jpeg/jpeg_hw/cam_jpeg_hw_mgr.c | 10 +- .../cam_lrme/lrme_hw_mgr/cam_lrme_hw_mgr.c | 3 +- drivers/cam_ope/cam_ope_context.c | 1 + drivers/cam_ope/ope_hw_mgr/cam_ope_hw_mgr.c | 29 ++++- drivers/cam_ope/ope_hw_mgr/ope_hw/ope_core.c | 11 ++ drivers/cam_req_mgr/cam_mem_mgr.c | 104 +++++++++++++++--- drivers/cam_req_mgr/cam_mem_mgr.h | 36 +++--- drivers/cam_req_mgr/cam_mem_mgr_api.h | 9 ++ drivers/cam_utils/cam_packet_util.c | 21 +++- drivers/cam_utils/cam_packet_util.h | 1 + drivers/cam_utils/cam_soc_util.c | 20 ++-- 21 files changed, 312 insertions(+), 65 deletions(-) diff --git a/drivers/cam_cdm/cam_cdm_virtual_core.c b/drivers/cam_cdm/cam_cdm_virtual_core.c index 3f5a9a3e90f3..3492b43cfcd5 100644 --- a/drivers/cam_cdm/cam_cdm_virtual_core.c +++ b/drivers/cam_cdm/cam_cdm_virtual_core.c @@ -1,6 +1,7 @@ // SPDX-License-Identifier: GPL-2.0-only /* * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved. + * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved. */ #include @@ -123,7 +124,7 @@ int cam_virtual_cdm_submit_bl(struct cam_hw_info *cdm_hw, cdm_cmd->cmd[i].len) { CAM_ERR(CAM_CDM, "Not enough buffer"); rc = -EINVAL; - break; + goto end; } CAM_DBG(CAM_CDM, "hdl=%x vaddr=%pK offset=%d cmdlen=%d:%zu", @@ -141,7 +142,7 @@ int cam_virtual_cdm_submit_bl(struct cam_hw_info *cdm_hw, "write failed for cnt=%d:%d len %u", i, req->data->cmd_arrary_count, cdm_cmd->cmd[i].len); - break; + goto end; } } else { CAM_ERR(CAM_CDM, @@ -152,7 +153,7 @@ int cam_virtual_cdm_submit_bl(struct cam_hw_info *cdm_hw, "Sanity check failed for cmd_count=%d cnt=%d", i, req->data->cmd_arrary_count); rc = -EINVAL; - break; + goto end; } if (!rc) { struct cam_cdm_work_payload *payload; @@ -169,7 +170,7 @@ int cam_virtual_cdm_submit_bl(struct cam_hw_info *cdm_hw, GFP_KERNEL); if (!node) { rc = -ENOMEM; - break; + goto end; } node->request_type = CAM_HW_CDM_BL_CB_CLIENT; node->client_hdl = req->handle; @@ -203,9 +204,20 @@ int cam_virtual_cdm_submit_bl(struct cam_hw_info *cdm_hw, if (!rc && (core->bl_tag == 63)) core->bl_tag = 0; } + + if (req->data->type == CAM_CDM_BL_CMD_TYPE_MEM_HANDLE) + cam_mem_put_cpu_buf(cdm_cmd->cmd[i].bl_addr.mem_handle); } mutex_unlock(&client->lock); return rc; + +end: + if (req->data->type == CAM_CDM_BL_CMD_TYPE_MEM_HANDLE) + cam_mem_put_cpu_buf(cdm_cmd->cmd[i].bl_addr.mem_handle); + + mutex_unlock(&client->lock); + return rc; + } int cam_virtual_cdm_probe(struct platform_device *pdev) diff --git a/drivers/cam_core/cam_context_utils.c b/drivers/cam_core/cam_context_utils.c index eb1cfc581bb7..523d742f024d 100644 --- a/drivers/cam_core/cam_context_utils.c +++ b/drivers/cam_core/cam_context_utils.c @@ -1,6 +1,7 @@ // SPDX-License-Identifier: GPL-2.0-only /* * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved. + * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved. */ #include @@ -316,6 +317,7 @@ int32_t cam_context_config_dev_to_hw( rc = -EFAULT; } + cam_mem_put_cpu_buf((int32_t) cmd->packet_handle); return rc; } @@ -1109,6 +1111,7 @@ static int cam_context_dump_context(struct cam_context *ctx, if (dump_args->offset >= buf_len) { CAM_WARN(CAM_CTXT, "dump buffer overshoot offset %zu len %zu", dump_args->offset, buf_len); + cam_mem_put_cpu_buf(dump_args->buf_handle); return -ENOSPC; } @@ -1120,6 +1123,7 @@ static int cam_context_dump_context(struct cam_context *ctx, if (remain_len < min_len) { CAM_WARN(CAM_CTXT, "dump buffer exhaust remain %zu min %u", remain_len, min_len); + cam_mem_put_cpu_buf(dump_args->buf_handle); return -ENOSPC; } dst = (uint8_t *)cpu_addr + dump_args->offset; @@ -1144,7 +1148,8 @@ static int cam_context_dump_context(struct cam_context *ctx, hdr->size = hdr->word_size * (addr - start); dump_args->offset += hdr->size + sizeof(struct cam_context_dump_header); - return rc; + cam_mem_put_cpu_buf(dump_args->buf_handle); + return 0; } int32_t cam_context_dump_dev_to_hw(struct cam_context *ctx, diff --git a/drivers/cam_cust/cam_custom_hw_mgr/cam_custom_hw_mgr.c b/drivers/cam_cust/cam_custom_hw_mgr/cam_custom_hw_mgr.c index 91a4e2ef26b6..04c6a0267d09 100644 --- a/drivers/cam_cust/cam_custom_hw_mgr/cam_custom_hw_mgr.c +++ b/drivers/cam_cust/cam_custom_hw_mgr/cam_custom_hw_mgr.c @@ -1,6 +1,7 @@ // SPDX-License-Identifier: GPL-2.0-only /* * Copyright (c) 2019-2020, The Linux Foundation. All rights reserved. + * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved. */ #include @@ -1275,6 +1276,7 @@ static int cam_custom_mgr_prepare_hw_update(void *hw_mgr_priv, ctx->scratch_buffer_addr = 0x0; prepare_hw_data->num_cfg = 0; cam_custom_add_io_buffers(hw_mgr->img_iommu_hdl, prepare); + cam_mem_put_cpu_buf(cmd_desc->mem_handle); return 0; } diff --git a/drivers/cam_fd/fd_hw_mgr/cam_fd_hw_mgr.c b/drivers/cam_fd/fd_hw_mgr/cam_fd_hw_mgr.c index 33566f8fb403..8ce17c3500f1 100644 --- a/drivers/cam_fd/fd_hw_mgr/cam_fd_hw_mgr.c +++ b/drivers/cam_fd/fd_hw_mgr/cam_fd_hw_mgr.c @@ -1,7 +1,7 @@ // SPDX-License-Identifier: GPL-2.0-only /* * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved. - * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved. + * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved. */ #include @@ -542,6 +542,33 @@ static int cam_fd_mgr_util_get_buf_map_requirement(uint32_t direction, return 0; } +static int cam_fd_mgr_put_cpu_buf(struct cam_hw_prepare_update_args *prepare) +{ + int i, rc; + uint32_t plane; + bool need_io_map, need_cpu_map; + struct cam_buf_io_cfg *io_cfg; + + io_cfg = (struct cam_buf_io_cfg *) ((uint8_t *) + &prepare->packet->payload + prepare->packet->io_configs_offset); + + if (!io_cfg) + return -EINVAL; + + for (i = 0; i < prepare->packet->num_io_configs; i++) { + rc = cam_fd_mgr_util_get_buf_map_requirement( + io_cfg[i].direction, io_cfg[i].resource_type, + &need_io_map, &need_cpu_map); + + if (rc || !need_cpu_map) + continue; + + for (plane = 0; plane < CAM_PACKET_MAX_PLANES; plane++) + cam_mem_put_cpu_buf(io_cfg[i].mem_handle[plane]); + } + return 0; +} + static int cam_fd_mgr_util_prepare_io_buf_info(int32_t iommu_hdl, struct cam_hw_prepare_update_args *prepare, struct cam_fd_hw_io_buffer *input_buf, @@ -638,6 +665,7 @@ static int cam_fd_mgr_util_prepare_io_buf_info(int32_t iommu_hdl, "Invalid cpu buf %d %d %d", io_cfg[i].direction, io_cfg[i].resource_type, plane); + cam_mem_put_cpu_buf(io_cfg[i].mem_handle[plane]; rc = -EINVAL; return rc; } @@ -1619,6 +1647,7 @@ hw_dump: if (fd_dump_args.buf_len <= dump_args->offset) { CAM_WARN(CAM_FD, "dump offset overshoot len %zu offset %zu", fd_dump_args.buf_len, dump_args->offset); + cam_mem_put_cpu_buf(dump_args->buf_handle); return -ENOSPC; } remain_len = fd_dump_args.buf_len - dump_args->offset; @@ -1628,6 +1657,7 @@ hw_dump: if (remain_len < min_len) { CAM_WARN(CAM_FD, "dump buffer exhaust remain %zu min %u", remain_len, min_len); + cam_mem_put_cpu_buf(dump_args->buf_handle); return -ENOSPC; } @@ -1659,12 +1689,14 @@ hw_dump: if (rc) { CAM_ERR(CAM_FD, "Hw Dump cmd fails req %lld rc %d", frame_req->request_id, rc); + cam_mem_put_cpu_buf(dump_args->buf_handle); return rc; } } CAM_DBG(CAM_FD, "Offset before %zu after %zu", dump_args->offset, fd_dump_args.offset); dump_args->offset = fd_dump_args.offset; + cam_mem_put_cpu_buf(dump_args->buf_handle); return rc; } @@ -1798,7 +1830,7 @@ static int cam_fd_mgr_hw_prepare_update(void *hw_mgr_priv, &prestart_args, &kmd_buf); if (rc) { CAM_ERR(CAM_FD, "Error in hw update entries %d", rc); - goto error; + goto put_cpu_buf; } /* get a free frame req from free list */ @@ -1807,7 +1839,8 @@ static int cam_fd_mgr_hw_prepare_update(void *hw_mgr_priv, if (rc || !frame_req) { CAM_ERR(CAM_FD, "Get frame_req failed, rc=%d, hw_ctx=%pK", rc, hw_ctx); - return -ENOMEM; + rc = -ENOMEM; + goto put_cpu_buf; } /* Setup frame request info and queue to pending list */ @@ -1822,9 +1855,13 @@ static int cam_fd_mgr_hw_prepare_update(void *hw_mgr_priv, */ prepare->priv = frame_req; + cam_fd_mgr_put_cpu_buf(prepare); CAM_DBG(CAM_FD, "FramePrepare : Frame[%lld]", frame_req->request_id); return 0; + +put_cpu_buf: + cam_fd_mgr_put_cpu_buf(prepare); error: return rc; } diff --git a/drivers/cam_icp/cam_icp_context.c b/drivers/cam_icp/cam_icp_context.c index 03ead2c3b693..903b364ec189 100644 --- a/drivers/cam_icp/cam_icp_context.c +++ b/drivers/cam_icp/cam_icp_context.c @@ -1,6 +1,7 @@ // SPDX-License-Identifier: GPL-2.0-only /* * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved. + * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved. */ #include @@ -157,6 +158,7 @@ static int __cam_icp_config_dev_in_ready(struct cam_context *ctx, CAM_ERR(CAM_CTXT, "Invalid offset, len: %zu cmd offset: %llu sizeof packet: %zu", len, cmd->offset, sizeof(struct cam_packet)); + cam_mem_put_cpu_buf((int32_t) cmd->packet_handle); return -EINVAL; } @@ -168,6 +170,7 @@ static int __cam_icp_config_dev_in_ready(struct cam_context *ctx, if (rc) { CAM_ERR(CAM_CTXT, "Invalid packet params, remain length: %zu", remain_len); + cam_mem_put_cpu_buf((int32_t) cmd->packet_handle); return rc; } @@ -182,6 +185,7 @@ static int __cam_icp_config_dev_in_ready(struct cam_context *ctx, if (rc) CAM_ERR(CAM_ICP, "Failed to prepare device"); + cam_mem_put_cpu_buf((int32_t) cmd->packet_handle); return rc; } diff --git a/drivers/cam_icp/icp_hw/icp_hw_mgr/cam_icp_hw_mgr.c b/drivers/cam_icp/icp_hw/icp_hw_mgr/cam_icp_hw_mgr.c index a6ef5560594e..1e1358fb850a 100644 --- a/drivers/cam_icp/icp_hw/icp_hw_mgr/cam_icp_hw_mgr.c +++ b/drivers/cam_icp/icp_hw/icp_hw_mgr/cam_icp_hw_mgr.c @@ -1,6 +1,7 @@ // SPDX-License-Identifier: GPL-2.0-only /* * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved. + * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved. */ #include @@ -91,7 +92,7 @@ static int cam_icp_dump_io_cfg(struct cam_icp_hw_ctx_data *ctx_data, used = 0; } } - + cam_mem_put_cpu_buf(buf_handle); return rc; } @@ -4258,6 +4259,7 @@ static int cam_icp_mgr_process_cmd_desc(struct cam_icp_hw_mgr *hw_mgr, *fw_cmd_buf_iova_addr = (*fw_cmd_buf_iova_addr + cmd_desc[i].offset); + rc = cam_mem_get_cpu_buf(cmd_desc[i].mem_handle, &cpu_addr, &len); if (rc || !cpu_addr) { @@ -4274,9 +4276,12 @@ static int cam_icp_mgr_process_cmd_desc(struct cam_icp_hw_mgr *hw_mgr, ((len - cmd_desc[i].offset) < cmd_desc[i].length)) { CAM_ERR(CAM_ICP, "Invalid offset or length"); + cam_mem_put_cpu_buf(cmd_desc[i].mem_handle); return -EINVAL; } cpu_addr = cpu_addr + cmd_desc[i].offset; + + cam_mem_put_cpu_buf(cmd_desc[i].mem_handle); } } @@ -5233,6 +5238,7 @@ hw_dump: req_ts.tv_nsec/NSEC_PER_USEC, cur_ts.tv_sec, cur_ts.tv_nsec/NSEC_PER_USEC); + rc = cam_mem_get_cpu_buf(dump_args->buf_handle, &icp_dump_args.cpu_addr, &icp_dump_args.buf_len); if (rc) { @@ -5243,6 +5249,7 @@ hw_dump: if (icp_dump_args.buf_len <= dump_args->offset) { CAM_WARN(CAM_ICP, "dump buffer overshoot len %zu offset %zu", icp_dump_args.buf_len, dump_args->offset); + cam_mem_put_cpu_buf(dump_args->buf_handle); return -ENOSPC; } @@ -5253,6 +5260,7 @@ hw_dump: if (remain_len < min_len) { CAM_WARN(CAM_ICP, "dump buffer exhaust remain %zu min %u", remain_len, min_len); + cam_mem_put_cpu_buf(dump_args->buf_handle); return -ENOSPC; } @@ -5272,6 +5280,13 @@ hw_dump: /* Dumping the fw image*/ icp_dump_args.offset = dump_args->offset; icp_dev_intf = hw_mgr->icp_dev_intf; + + if (!icp_dev_intf) { + CAM_ERR(CAM_ICP, "ICP device interface is NULL"); + cam_mem_put_cpu_buf(dump_args->buf_handle); + return -EINVAL; + } + rc = icp_dev_intf->hw_ops.process_cmd( icp_dev_intf->hw_priv, CAM_ICP_CMD_HW_DUMP, &icp_dump_args, @@ -5279,6 +5294,8 @@ hw_dump: CAM_DBG(CAM_ICP, "Offset before %zu after %zu", dump_args->offset, icp_dump_args.offset); dump_args->offset = icp_dump_args.offset; + + cam_mem_put_cpu_buf(dump_args->buf_handle); return rc; } diff --git a/drivers/cam_isp/cam_isp_context.c b/drivers/cam_isp/cam_isp_context.c index dcb3570340a4..6b781819767c 100644 --- a/drivers/cam_isp/cam_isp_context.c +++ b/drivers/cam_isp/cam_isp_context.c @@ -1,6 +1,7 @@ // SPDX-License-Identifier: GPL-2.0-only /* * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved. + * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved. */ #include @@ -339,6 +340,7 @@ static int cam_isp_ctx_dump_req( CAM_ERR(CAM_ISP, "Invalid offset exp %u actual %u", req_isp->cfg[i].offset, (uint32_t)len); + cam_mem_put_cpu_buf(req_isp->cfg[i].handle); return -EINVAL; } remain_len = len - req_isp->cfg[i].offset; @@ -349,6 +351,7 @@ static int cam_isp_ctx_dump_req( "Invalid len exp %u remain_len %u", req_isp->cfg[i].len, (uint32_t)remain_len); + cam_mem_put_cpu_buf(req_isp->cfg[i].handle); return -EINVAL; } @@ -374,6 +377,7 @@ static int cam_isp_ctx_dump_req( return rc; } else cam_cdm_util_dump_cmd_buf(buf_start, buf_end); + cam_mem_put_cpu_buf(req_isp->cfg[i].handle); } } return rc; @@ -3560,6 +3564,7 @@ hw_dump: spin_unlock_bh(&ctx->lock); CAM_WARN(CAM_ISP, "Dump buffer overshoot len %zu offset %zu", buf_len, dump_info->offset); + cam_mem_put_cpu_buf(dump_info->buf_handle); return -ENOSPC; } @@ -3571,6 +3576,7 @@ hw_dump: spin_unlock_bh(&ctx->lock); CAM_WARN(CAM_ISP, "Dump buffer exhaust remain %zu min %u", remain_len, min_len); + cam_mem_put_cpu_buf(dump_info->buf_handle); return -ENOSPC; } @@ -3610,20 +3616,17 @@ hw_dump: if (rc) { CAM_ERR(CAM_ISP, "Dump event fail %lld", req->request_id); - spin_unlock_bh(&ctx->lock); - return rc; - } - if (dump_only_event_record) { - spin_unlock_bh(&ctx->lock); - return rc; + goto end; } + if (dump_only_event_record) + goto end; + rc = __cam_isp_ctx_dump_req_info(ctx, req, cpu_addr, buf_len, &dump_info->offset); if (rc) { CAM_ERR(CAM_ISP, "Dump Req info fail %lld", req->request_id); - spin_unlock_bh(&ctx->lock); - return rc; + goto end; } spin_unlock_bh(&ctx->lock); @@ -3637,6 +3640,12 @@ hw_dump: &dump_args); dump_info->offset = dump_args.offset; } + cam_mem_put_cpu_buf(dump_info->buf_handle); + return rc; + +end: + spin_unlock_bh(&ctx->lock); + cam_mem_put_cpu_buf(dump_info->buf_handle); return rc; } diff --git a/drivers/cam_isp/isp_hw_mgr/cam_ife_hw_mgr.c b/drivers/cam_isp/isp_hw_mgr/cam_ife_hw_mgr.c index 8af790e2d3b2..646a4e90e474 100644 --- a/drivers/cam_isp/isp_hw_mgr/cam_ife_hw_mgr.c +++ b/drivers/cam_isp/isp_hw_mgr/cam_ife_hw_mgr.c @@ -1,6 +1,7 @@ // SPDX-License-Identifier: GPL-2.0-only /* * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved. + * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved. */ #include @@ -7293,6 +7294,7 @@ static int cam_ife_mgr_dump(void *hw_mgr_priv, void *args) } } dump_args->offset = isp_hw_dump_args.offset; + cam_mem_put_cpu_buf(dump_args->buf_handle); end: CAM_DBG(CAM_ISP, "offset %u", dump_args->offset); return rc; diff --git a/drivers/cam_isp/isp_hw_mgr/cam_tfe_hw_mgr.c b/drivers/cam_isp/isp_hw_mgr/cam_tfe_hw_mgr.c index 6f25c913b352..aef2c1ca73d0 100644 --- a/drivers/cam_isp/isp_hw_mgr/cam_tfe_hw_mgr.c +++ b/drivers/cam_isp/isp_hw_mgr/cam_tfe_hw_mgr.c @@ -1893,6 +1893,7 @@ void cam_tfe_cam_cdm_callback(uint32_t handle, void *userdata, ctx->last_submit_bl_cmd.cmd[i].input_len - 1); cam_cdm_util_dump_cmd_buf(buf_start, buf_end); + cam_mem_put_cpu_buf(ctx->last_submit_bl_cmd.cmd[i].mem_handle); } if (ctx->packet != NULL) cam_packet_dump_patch_info(ctx->packet, @@ -3585,6 +3586,7 @@ static int cam_tfe_mgr_dump(void *hw_mgr_priv, void *args) } dump_args->offset = isp_hw_dump_args.offset; CAM_DBG(CAM_ISP, "offset %u", dump_args->offset); + cam_mem_put_cpu_buf(dump_args->buf_handle); return rc; } @@ -4183,6 +4185,7 @@ static int cam_tfe_update_dual_config( (cmd_desc->offset >= (len - sizeof(struct cam_isp_tfe_dual_config)))) { CAM_ERR(CAM_ISP, "not enough buffer provided"); + cam_mem_put_cpu_buf(cmd_desc->mem_handle); return -EINVAL; } @@ -4195,6 +4198,7 @@ static int cam_tfe_update_dual_config( (remain_len - offsetof(struct cam_isp_tfe_dual_config, stripes))) { CAM_ERR(CAM_ISP, "not enough buffer for all the dual configs"); + cam_mem_put_cpu_buf(cmd_desc->mem_handle); return -EINVAL; } @@ -4256,6 +4260,7 @@ static int cam_tfe_update_dual_config( } end: + cam_mem_put_cpu_buf(cmd_desc->mem_handle); return rc; } @@ -4910,7 +4915,6 @@ outportlog: cam_tfe_mgr_print_io_bufs(hw_mgr, *resource_type, packet, ctx_found, ctx); - } static int cam_tfe_mgr_cmd(void *hw_mgr_priv, void *cmd_args) diff --git a/drivers/cam_isp/isp_hw_mgr/hw_utils/cam_isp_packet_parser.c b/drivers/cam_isp/isp_hw_mgr/hw_utils/cam_isp_packet_parser.c index 7357cfd9f77b..d0d5c827159a 100644 --- a/drivers/cam_isp/isp_hw_mgr/hw_utils/cam_isp_packet_parser.c +++ b/drivers/cam_isp/isp_hw_mgr/hw_utils/cam_isp_packet_parser.c @@ -1,6 +1,7 @@ // SPDX-License-Identifier: GPL-2.0-only /* * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved. + * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved. */ #include @@ -118,6 +119,7 @@ static int cam_isp_update_dual_config( (cmd_desc->offset >= (len - sizeof(struct cam_isp_dual_config)))) { CAM_ERR(CAM_ISP, "not enough buffer provided"); + cam_mem_put_cpu_buf(cmd_desc->mem_handle); return -EINVAL; } remain_len = len - cmd_desc->offset; @@ -134,6 +136,7 @@ static int cam_isp_update_dual_config( sizeof(struct cam_isp_dual_stripe_config)) > (remain_len - offsetof(struct cam_isp_dual_config, stripes))) { CAM_ERR(CAM_ISP, "not enough buffer for all the dual configs"); + cam_mem_put_cpu_buf(cmd_desc->mem_handle); return -EINVAL; } for (i = 0; i < dual_config->num_ports; i++) { @@ -184,6 +187,7 @@ static int cam_isp_update_dual_config( } end: + cam_mem_put_cpu_buf(cmd_desc->mem_handle); return rc; } diff --git a/drivers/cam_jpeg/jpeg_hw/cam_jpeg_hw_mgr.c b/drivers/cam_jpeg/jpeg_hw/cam_jpeg_hw_mgr.c index a7580fc0a205..f9c4d94f679b 100644 --- a/drivers/cam_jpeg/jpeg_hw/cam_jpeg_hw_mgr.c +++ b/drivers/cam_jpeg/jpeg_hw/cam_jpeg_hw_mgr.c @@ -1,7 +1,7 @@ // SPDX-License-Identifier: GPL-2.0-only /* * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved. - * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved. + * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved. */ #include @@ -444,6 +444,8 @@ static int cam_jpeg_insert_cdm_change_base( CAM_ERR(CAM_JPEG, "Not enough buf offset %d len %d", config_args->hw_update_entries[CAM_JPEG_CHBASE].offset, ch_base_len); + cam_mem_put_cpu_buf( + config_args->hw_update_entries[CAM_JPEG_CHBASE].handle); return -EINVAL; } CAM_DBG(CAM_JPEG, "iova %pK len %zu offset %d", @@ -475,6 +477,9 @@ static int cam_jpeg_insert_cdm_change_base( ch_base_iova_addr += size; *ch_base_iova_addr = 0; + cam_mem_put_cpu_buf( + config_args->hw_update_entries[CAM_JPEG_CHBASE].handle); + return rc; } @@ -1649,6 +1654,7 @@ hw_dump: CAM_WARN(CAM_JPEG, "dump offset overshoot len %zu offset %zu", jpeg_dump_args.buf_len, dump_args->offset); mutex_unlock(&hw_mgr->hw_mgr_mutex); + cam_mem_put_cpu_buf(dump_args->buf_handle); return -ENOSPC; } @@ -1659,6 +1665,7 @@ hw_dump: CAM_WARN(CAM_JPEG, "dump buffer exhaust remain %zu min %u", remain_len, min_len); mutex_unlock(&hw_mgr->hw_mgr_mutex); + cam_mem_put_cpu_buf(dump_args->buf_handle); return -ENOSPC; } @@ -1691,6 +1698,7 @@ hw_dump: CAM_DBG(CAM_JPEG, "Offset before %u after %u", dump_args->offset, jpeg_dump_args.offset); dump_args->offset = jpeg_dump_args.offset; + cam_mem_put_cpu_buf(dump_args->buf_handle); return rc; } diff --git a/drivers/cam_lrme/lrme_hw_mgr/cam_lrme_hw_mgr.c b/drivers/cam_lrme/lrme_hw_mgr/cam_lrme_hw_mgr.c index 38feacabb941..75dcc68d7532 100644 --- a/drivers/cam_lrme/lrme_hw_mgr/cam_lrme_hw_mgr.c +++ b/drivers/cam_lrme/lrme_hw_mgr/cam_lrme_hw_mgr.c @@ -1,7 +1,7 @@ // SPDX-License-Identifier: GPL-2.0-only /* * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved. - * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved. + * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved. */ #include @@ -704,6 +704,7 @@ static int cam_lrme_mgr_hw_dump(void *hw_mgr_priv, void *hw_dump_args) CAM_DBG(CAM_LRME, "Offset before %zu after %zu", dump_args->offset, lrme_dump_args.offset); dump_args->offset = lrme_dump_args.offset; + cam_mem_put_cpu_buf(dump_args->buf_handle); return rc; } diff --git a/drivers/cam_ope/cam_ope_context.c b/drivers/cam_ope/cam_ope_context.c index de93c02a0eab..7fafc6b9037b 100644 --- a/drivers/cam_ope/cam_ope_context.c +++ b/drivers/cam_ope/cam_ope_context.c @@ -155,6 +155,7 @@ static int __cam_ope_config_dev_in_ready(struct cam_context *ctx, if (rc) CAM_ERR(CAM_OPE, "Failed to prepare device"); + cam_mem_put_cpu_buf((int32_t) cmd->packet_handle); return rc; } diff --git a/drivers/cam_ope/ope_hw_mgr/cam_ope_hw_mgr.c b/drivers/cam_ope/ope_hw_mgr/cam_ope_hw_mgr.c index 9f16f0f48084..0ac015fc9da6 100644 --- a/drivers/cam_ope/ope_hw_mgr/cam_ope_hw_mgr.c +++ b/drivers/cam_ope/ope_hw_mgr/cam_ope_hw_mgr.c @@ -1,6 +1,7 @@ // SPDX-License-Identifier: GPL-2.0-only /* * Copyright (c) 2017-2022, The Linux Foundation. All rights reserved. + * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved. */ #include @@ -427,6 +428,25 @@ end: return; } +static int cam_ope_mgr_put_cmd_buf(struct cam_packet *packet) +{ + int i = 0; + struct cam_cmd_buf_desc *cmd_desc = NULL; + + cmd_desc = (struct cam_cmd_buf_desc *) + ((uint32_t *) &packet->payload + packet->cmd_buf_offset/4); + + for (i = 0; i < packet->num_cmd_buf; i++) { + if (cmd_desc[i].type != CAM_CMD_BUF_GENERIC || + cmd_desc[i].meta_data == OPE_CMD_META_GENERIC_BLOB) + continue; + + cam_mem_put_cpu_buf(cmd_desc[i].mem_handle); + } + + return 0; +} + static int cam_ope_dump_indirect(struct ope_cmd_buf_info *cmd_buf_info, struct cam_ope_hang_dump *dump) { @@ -456,6 +476,7 @@ static int cam_ope_dump_indirect(struct ope_cmd_buf_info *cmd_buf_info, print_ptr += sizeof(struct cdm_dmi_cmd) / sizeof(uint32_t); } + cam_mem_put_cpu_buf((int32_t) cmd_buf_info->mem_handle); return rc; } @@ -558,6 +579,7 @@ static int cam_ope_dump_frame_process(struct cam_packet *packet, cam_ope_mgr_dump_cmd_buf(cpu_addr, dump); cam_ope_mgr_dump_frame_set(cpu_addr, dump); + cam_ope_mgr_put_cmd_buf(packet); return rc; } @@ -2187,6 +2209,7 @@ static int cam_ope_mgr_process_cmd_buf_req(struct cam_ope_hw_mgr *hw_mgr, ope_request->ope_kmd_buf.cpu_addr, ope_request->ope_kmd_buf.iova_addr, ope_request->ope_kmd_buf.iova_cdm_addr); + cam_mem_put_cpu_buf(cmd_buf->mem_handle); break; } else if (cmd_buf->cmd_buf_usage == OPE_CMD_BUF_DEBUG) { @@ -2202,8 +2225,10 @@ static int cam_ope_mgr_process_cmd_buf_req(struct cam_ope_hw_mgr *hw_mgr, cmd_buf->offset; CAM_DBG(CAM_OPE, "dbg buf = %x", ope_request->ope_debug_buf.cpu_addr); + cam_mem_put_cpu_buf(cmd_buf->mem_handle); break; } + cam_mem_put_cpu_buf(cmd_buf->mem_handle); break; } case OPE_CMD_BUF_SCOPE_STRIPE: { @@ -3050,6 +3075,7 @@ static int cam_ope_mgr_release_hw(void *hw_priv, void *hw_release_args) return rc; } + static int cam_ope_packet_generic_blob_handler(void *user_data, uint32_t blob_type, uint32_t blob_size, uint8_t *blob_data) { @@ -3309,14 +3335,15 @@ static int cam_ope_mgr_prepare_hw_update(void *hw_priv, ctx_data->last_req_time); cam_ope_req_timer_modify(ctx_data, ctx_data->req_timer_timeout); set_bit(request_idx, ctx_data->bitmap); + cam_ope_mgr_put_cmd_buf(packet); mutex_unlock(&ctx_data->ctx_mutex); - CAM_DBG(CAM_REQ, "Prepare Hw update Successful request_id: %d ctx: %d", packet->header.request_id, ctx_data->ctx_id); return rc; end: kzfree(ctx_data->req_list[request_idx]->cdm_cmd); + cam_ope_mgr_put_cmd_buf(packet); ctx_data->req_list[request_idx]->cdm_cmd = NULL; req_cdm_mem_alloc_failed: kzfree(ctx_data->req_list[request_idx]); diff --git a/drivers/cam_ope/ope_hw_mgr/ope_hw/ope_core.c b/drivers/cam_ope/ope_hw_mgr/ope_hw/ope_core.c index 164706b6a5d9..a87cf7b28d0d 100644 --- a/drivers/cam_ope/ope_hw_mgr/ope_hw/ope_core.c +++ b/drivers/cam_ope/ope_hw_mgr/ope_hw/ope_core.c @@ -1,6 +1,7 @@ // SPDX-License-Identifier: GPL-2.0-only /* * Copyright (c) 2019-2021, The Linux Foundation. All rights reserved. + * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved. */ #include @@ -584,6 +585,7 @@ static uint32_t *ope_create_frame_cmd_batch(struct cam_ope_hw_mgr *hw_mgr, dmi_cmd = (struct cdm_dmi_cmd *)temp; if (!dmi_cmd->addr) { CAM_ERR(CAM_OPE, "Null dmi cmd addr"); + cam_mem_put_cpu_buf(frm_proc->cmd_buf[i][j].mem_handle); return NULL; } @@ -604,6 +606,8 @@ static uint32_t *ope_create_frame_cmd_batch(struct cam_ope_hw_mgr *hw_mgr, if (hw_mgr->frame_dump_enable) dump_frame_cmd(frm_proc, i, j, iova_addr, kmd_buf, buf_len); + + cam_mem_put_cpu_buf(frm_proc->cmd_buf[i][j].mem_handle); } return kmd_buf; @@ -743,6 +747,8 @@ static uint32_t *ope_create_frame_cmd(struct cam_ope_hw_mgr *hw_mgr, if (!dmi_cmd->addr) { CAM_ERR(CAM_OPE, "Null dmi cmd addr"); + cam_mem_put_cpu_buf( + frm_proc->cmd_buf[i][j].mem_handle); return NULL; } @@ -764,6 +770,8 @@ static uint32_t *ope_create_frame_cmd(struct cam_ope_hw_mgr *hw_mgr, if (hw_mgr->frame_dump_enable) dump_frame_cmd(frm_proc, i, j, iova_addr, kmd_buf, buf_len); + + cam_mem_put_cpu_buf(frm_proc->cmd_buf[i][j].mem_handle); } } return kmd_buf; @@ -859,6 +867,7 @@ static uint32_t *ope_create_stripe_cmd(struct cam_ope_hw_mgr *hw_mgr, dmi_cmd = (struct cdm_dmi_cmd *)temp; if (!dmi_cmd->addr) { CAM_ERR(CAM_OPE, "Null dmi cmd addr"); + cam_mem_put_cpu_buf(frm_proc->cmd_buf[i][k].mem_handle); return NULL; } @@ -877,6 +886,8 @@ static uint32_t *ope_create_stripe_cmd(struct cam_ope_hw_mgr *hw_mgr, if (hw_mgr->frame_dump_enable) dump_stripe_cmd(frm_proc, stripe_idx, i, k, iova_addr, kmd_buf, buf_len); + + cam_mem_put_cpu_buf(frm_proc->cmd_buf[i][k].mem_handle); } ope_dev = hw_mgr->ope_dev_intf[0]->hw_priv; diff --git a/drivers/cam_req_mgr/cam_mem_mgr.c b/drivers/cam_req_mgr/cam_mem_mgr.c index 2cf85ed77136..7b7acba371d1 100644 --- a/drivers/cam_req_mgr/cam_mem_mgr.c +++ b/drivers/cam_req_mgr/cam_mem_mgr.c @@ -300,6 +300,7 @@ int cam_mem_get_cpu_buf(int32_t buf_handle, uintptr_t *vaddr_ptr, size_t *len) return -EINVAL; idx = CAM_MEM_MGR_GET_HDL_IDX(buf_handle); + if (idx >= CAM_MEM_BUFQ_MAX || idx <= 0) return -EINVAL; @@ -309,18 +310,24 @@ int cam_mem_get_cpu_buf(int32_t buf_handle, uintptr_t *vaddr_ptr, size_t *len) return -EPERM; } - if (buf_handle != tbl.bufq[idx].buf_handle) + if (buf_handle != tbl.bufq[idx].buf_handle) { + CAM_ERR(CAM_MEM, "idx: %d Invalid buf handle %d", + idx, buf_handle); return -EINVAL; + } - if (!(tbl.bufq[idx].flags & CAM_MEM_FLAG_KMD_ACCESS)) + if (!(tbl.bufq[idx].flags & CAM_MEM_FLAG_KMD_ACCESS)) { + CAM_ERR(CAM_MEM, "idx: %d Invalid flag 0x%x", + idx, tbl.bufq[idx].flags); return -EINVAL; + } - if (tbl.bufq[idx].kmdvaddr) { + if (tbl.bufq[idx].kmdvaddr && kref_get_unless_zero(&tbl.bufq[idx].krefcount)) { *vaddr_ptr = tbl.bufq[idx].kmdvaddr; *len = tbl.bufq[idx].len; } else { - CAM_ERR(CAM_MEM, "No KMD access was requested for 0x%x handle", - buf_handle); + CAM_ERR(CAM_MEM, "No KMD access requested, kmdvddr= %p, idx= %d, buf_handle= %d", + tbl.bufq[idx].kmdvaddr, idx, buf_handle); return -EINVAL; } @@ -761,6 +768,8 @@ int cam_mem_mgr_alloc_and_map(struct cam_mem_mgr_alloc_cmd *cmd) memcpy(tbl.bufq[idx].hdls, cmd->mmu_hdls, sizeof(int32_t) * cmd->num_hdl); tbl.bufq[idx].is_imported = false; + kref_init(&tbl.bufq[idx].krefcount); + tbl.bufq[idx].smmu_mapping_client = CAM_SMMU_MAPPING_USER; mutex_unlock(&tbl.bufq[idx].q_lock); cmd->out.buf_handle = tbl.bufq[idx].buf_handle; @@ -894,6 +903,8 @@ int cam_mem_mgr_map(struct cam_mem_mgr_map_cmd *cmd) sizeof(int32_t) * cmd->num_hdl); tbl.bufq[idx].is_imported = true; tbl.bufq[idx].is_internal = is_internal; + kref_init(&tbl.bufq[idx].krefcount); + tbl.bufq[idx].smmu_mapping_client = CAM_SMMU_MAPPING_USER; mutex_unlock(&tbl.bufq[idx].q_lock); cmd->out.buf_handle = tbl.bufq[idx].buf_handle; @@ -1052,17 +1063,23 @@ void cam_mem_mgr_deinit(void) mutex_destroy(&tbl.m_lock); } -static int cam_mem_util_unmap(int32_t idx, - enum cam_smmu_mapping_client client) +static void cam_mem_util_unmap(struct kref *kref) { int rc = 0; + int32_t idx; enum cam_smmu_region_id region = CAM_SMMU_REGION_SHARED; + enum cam_smmu_mapping_client client; + struct cam_mem_buf_queue *bufq = + container_of(kref, typeof(*bufq), krefcount); + idx = CAM_MEM_MGR_GET_HDL_IDX(bufq->buf_handle); if (idx >= CAM_MEM_BUFQ_MAX || idx <= 0) { CAM_ERR(CAM_MEM, "Incorrect index"); - return -EINVAL; + return; } + client = tbl.bufq[idx].smmu_mapping_client; + CAM_DBG(CAM_MEM, "Flags = %X idx %d", tbl.bufq[idx].flags, idx); mutex_lock(&tbl.m_lock); @@ -1071,7 +1088,7 @@ static int cam_mem_util_unmap(int32_t idx, CAM_WARN(CAM_MEM, "Buffer at idx=%d is already unmapped,", idx); mutex_unlock(&tbl.m_lock); - return 0; + return; } /* Deactivate the buffer queue to prevent multiple unmap */ @@ -1136,13 +1153,50 @@ static int cam_mem_util_unmap(int32_t idx, clear_bit(idx, tbl.bitmap); mutex_unlock(&tbl.m_lock); - return rc; } +void cam_mem_put_cpu_buf(int32_t buf_handle) +{ + int rc = 0; + int idx; + + if (!buf_handle) { + CAM_ERR(CAM_MEM, "Invalid buf_handle"); + return; + } + + idx = CAM_MEM_MGR_GET_HDL_IDX(buf_handle); + if (idx >= CAM_MEM_BUFQ_MAX || idx <= 0) { + CAM_ERR(CAM_MEM, "idx: %d not valid", idx); + return; + } + + if (!tbl.bufq[idx].active) { + CAM_ERR(CAM_MEM, "idx: %d not active", idx); + rc = -EPERM; + return; + } + + if (buf_handle != tbl.bufq[idx].buf_handle) { + CAM_ERR(CAM_MEM, "idx: %d Invalid buf handle %d", + idx, buf_handle); + rc = -EINVAL; + return; + } + + if (kref_put(&tbl.bufq[idx].krefcount, cam_mem_util_unmap)) + CAM_DBG(CAM_MEM, + "Called unmap from here, buf_handle: %u, idx: %d", + buf_handle, idx); + +} +EXPORT_SYMBOL(cam_mem_put_cpu_buf); + + int cam_mem_mgr_release(struct cam_mem_mgr_release_cmd *cmd) { int idx; - int rc; + int rc = 0; if (!atomic_read(&cam_mem_mgr_state)) { CAM_ERR(CAM_MEM, "failed. mem_mgr not initialized"); @@ -1174,7 +1228,11 @@ int cam_mem_mgr_release(struct cam_mem_mgr_release_cmd *cmd) } CAM_DBG(CAM_MEM, "Releasing hdl = %x, idx = %d", cmd->buf_handle, idx); - rc = cam_mem_util_unmap(idx, CAM_SMMU_MAPPING_USER); + + if (kref_put(&tbl.bufq[idx].krefcount, cam_mem_util_unmap)) + CAM_DBG(CAM_MEM, + "Called unmap from here, buf_handle: %u, idx: %d", + cmd->buf_handle, idx); return rc; } @@ -1296,6 +1354,8 @@ int cam_mem_mgr_request_mem(struct cam_mem_mgr_request_desc *inp, memcpy(tbl.bufq[idx].hdls, &smmu_hdl, sizeof(int32_t)); tbl.bufq[idx].is_imported = false; + kref_init(&tbl.bufq[idx].krefcount); + tbl.bufq[idx].smmu_mapping_client = CAM_SMMU_MAPPING_KERNEL; mutex_unlock(&tbl.bufq[idx].q_lock); out->kva = kvaddr; @@ -1321,7 +1381,7 @@ EXPORT_SYMBOL(cam_mem_mgr_request_mem); int cam_mem_mgr_release_mem(struct cam_mem_mgr_memory_desc *inp) { int32_t idx; - int rc; + int rc = 0; if (!atomic_read(&cam_mem_mgr_state)) { CAM_ERR(CAM_MEM, "failed. mem_mgr not initialized"); @@ -1355,7 +1415,12 @@ int cam_mem_mgr_release_mem(struct cam_mem_mgr_memory_desc *inp) } CAM_DBG(CAM_MEM, "Releasing hdl = %X", inp->mem_handle); - rc = cam_mem_util_unmap(idx, CAM_SMMU_MAPPING_KERNEL); + if (kref_put(&tbl.bufq[idx].krefcount, cam_mem_util_unmap)) + CAM_DBG(CAM_MEM, + "Called unmap from here, buf_handle: %u, idx: %d", + tbl.bufq[idx].buf_handle, idx); + else + rc = -EINVAL; return rc; } @@ -1445,6 +1510,8 @@ int cam_mem_mgr_reserve_memory_region(struct cam_mem_mgr_request_desc *inp, memcpy(tbl.bufq[idx].hdls, &smmu_hdl, sizeof(int32_t)); tbl.bufq[idx].is_imported = false; + kref_init(&tbl.bufq[idx].krefcount); + tbl.bufq[idx].smmu_mapping_client = CAM_SMMU_MAPPING_KERNEL; mutex_unlock(&tbl.bufq[idx].q_lock); out->kva = 0; @@ -1529,9 +1596,12 @@ int cam_mem_mgr_free_memory_region(struct cam_mem_mgr_memory_desc *inp) } CAM_DBG(CAM_MEM, "Releasing hdl = %X", inp->mem_handle); - rc = cam_mem_util_unmap(idx, CAM_SMMU_MAPPING_KERNEL); - if (rc) - CAM_ERR(CAM_MEM, "unmapping secondary heap failed"); + if (kref_put(&tbl.bufq[idx].krefcount, cam_mem_util_unmap)) + CAM_DBG(CAM_MEM, + "Called unmap from here, buf_handle: %u, idx: %d", + inp->mem_handle, idx); + else + rc = -EINVAL; return rc; } diff --git a/drivers/cam_req_mgr/cam_mem_mgr.h b/drivers/cam_req_mgr/cam_mem_mgr.h index 26ab9cb75319..74c7c9280768 100644 --- a/drivers/cam_req_mgr/cam_mem_mgr.h +++ b/drivers/cam_req_mgr/cam_mem_mgr.h @@ -1,6 +1,7 @@ /* SPDX-License-Identifier: GPL-2.0-only */ /* * Copyright (c) 2016-2021, The Linux Foundation. All rights reserved. + * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved. */ #ifndef _CAM_MEM_MGR_H_ @@ -26,21 +27,24 @@ enum cam_smmu_mapping_client { /** * struct cam_mem_buf_queue * - * @dma_buf: pointer to the allocated dma_buf in the table - * @q_lock: mutex lock for buffer - * @hdls: list of mapped handles - * @num_hdl: number of handles - * @fd: file descriptor of buffer - * @buf_handle: unique handle for buffer - * @align: alignment for allocation - * @len: size of buffer - * @flags: attributes of buffer - * @vaddr: IOVA of buffer - * @kmdvaddr: Kernel virtual address - * @active: state of the buffer - * @is_imported: Flag indicating if buffer is imported from an FD in user space - * @is_internal: Flag indicating kernel allocated buffer - * @timestamp: Timestamp at which this entry in tbl was made + * @dma_buf: pointer to the allocated dma_buf in the table + * @q_lock: mutex lock for buffer + * @hdls: list of mapped handles + * @num_hdl: number of handles + * @fd: file descriptor of buffer + * @buf_handle: unique handle for buffer + * @align: alignment for allocation + * @len: size of buffer + * @flags: attributes of buffer + * @vaddr: IOVA of buffer + * @kmdvaddr: Kernel virtual address + * @active: state of the buffer + * @is_imported: Flag indicating if buffer is imported from an FD in user space + * @is_internal: Flag indicating kernel allocated buffer + * @timestamp: Timestamp at which this entry in tbl was made + * @krefcount: Reference counter to track whether the buffer is + * mapped and in use + * @smmu_mapping_client: Client buffer (User or kernel) */ struct cam_mem_buf_queue { struct dma_buf *dma_buf; @@ -58,6 +62,8 @@ struct cam_mem_buf_queue { bool is_imported; bool is_internal; struct timespec64 timestamp; + struct kref krefcount; + enum cam_smmu_mapping_client smmu_mapping_client; }; /** diff --git a/drivers/cam_req_mgr/cam_mem_mgr_api.h b/drivers/cam_req_mgr/cam_mem_mgr_api.h index e3f741e80828..bfb1f571c65e 100644 --- a/drivers/cam_req_mgr/cam_mem_mgr_api.h +++ b/drivers/cam_req_mgr/cam_mem_mgr_api.h @@ -1,6 +1,7 @@ /* SPDX-License-Identifier: GPL-2.0-only */ /* * Copyright (c) 2016-2020, The Linux Foundation. All rights reserved. + * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved. */ #ifndef _CAM_MEM_MGR_API_H_ @@ -89,6 +90,14 @@ int cam_mem_get_io_buf(int32_t buf_handle, int32_t mmu_handle, int cam_mem_get_cpu_buf(int32_t buf_handle, uintptr_t *vaddr_ptr, size_t *len); +/** + * @brief: This indicates end of CPU access + * + * @buf_handle: Handle for the buffer + * + */ +void cam_mem_put_cpu_buf(int32_t buf_handle); + static inline bool cam_mem_is_secure_buf(int32_t buf_handle) { return CAM_MEM_MGR_IS_SECURE_HDL(buf_handle); diff --git a/drivers/cam_utils/cam_packet_util.c b/drivers/cam_utils/cam_packet_util.c index ba0c93086c55..790956ad92f9 100644 --- a/drivers/cam_utils/cam_packet_util.c +++ b/drivers/cam_utils/cam_packet_util.c @@ -1,7 +1,7 @@ // SPDX-License-Identifier: GPL-2.0-only /* * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved. - * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved. + * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved. */ #include @@ -148,14 +148,16 @@ int cam_packet_util_get_kmd_buffer(struct cam_packet *packet, ((size_t)cmd_desc->size > (len - (size_t)cmd_desc->offset))) { CAM_ERR(CAM_UTIL, "invalid memory len:%zd and cmd desc size:%d", len, cmd_desc->size); - return -EINVAL; + rc = -EINVAL; + goto rel_kmd_buf; } remain_len -= (size_t)cmd_desc->offset; if ((size_t)packet->kmd_cmd_buf_offset >= remain_len) { CAM_ERR(CAM_UTIL, "Invalid kmd cmd buf offset: %zu", (size_t)packet->kmd_cmd_buf_offset); - return -EINVAL; + rc = -EINVAL; + goto rel_kmd_buf; } cpu_addr += (cmd_desc->offset / 4) + (packet->kmd_cmd_buf_offset / 4); @@ -172,6 +174,8 @@ int cam_packet_util_get_kmd_buffer(struct cam_packet *packet, kmd_buf->size = cmd_desc->size - cmd_desc->length; kmd_buf->used_bytes = 0; +rel_kmd_buf: + cam_mem_put_cpu_buf(cmd_desc->mem_handle); return rc; } @@ -228,6 +232,8 @@ void cam_packet_dump_patch_info(struct cam_packet *packet, if (!(*dst_cpu_addr)) CAM_ERR(CAM_ICP, "Null at dst addr %p", dst_cpu_addr); + + cam_mem_put_cpu_buf(patch_desc[i].dst_buf_hdl); } } @@ -356,6 +362,7 @@ int cam_packet_util_process_patches(struct cam_packet *packet, (size_t)patch_desc[i].dst_offset)) { CAM_ERR(CAM_UTIL, "Invalid dst buf patch offset"); + cam_mem_put_cpu_buf((int32_t)patch_desc[i].dst_buf_hdl); return -EINVAL; } @@ -369,6 +376,7 @@ int cam_packet_util_process_patches(struct cam_packet *packet, "patch is done for dst %pK with src %pK value %llx", dst_cpu_addr, src_buf_iova_addr, *((uint64_t *)dst_cpu_addr)); + cam_mem_put_cpu_buf((int32_t)patch_desc[i].dst_buf_hdl); } return rc; @@ -409,14 +417,16 @@ int cam_packet_util_process_generic_cmd_buffer( ((size_t)cmd_buf->offset > (buf_size - sizeof(uint32_t)))) { CAM_ERR(CAM_UTIL, "Invalid offset for cmd buf: %zu", (size_t)cmd_buf->offset); - return -EINVAL; + rc = -EINVAL; + goto end; } remain_len -= (size_t)cmd_buf->offset; if (remain_len < (size_t)cmd_buf->length) { CAM_ERR(CAM_UTIL, "Invalid length for cmd buf: %zu", (size_t)cmd_buf->length); - return -EINVAL; + rc = -EINVAL; + goto end; } blob_ptr = (uint32_t *)(((uint8_t *)cpu_addr) + @@ -466,5 +476,6 @@ int cam_packet_util_process_generic_cmd_buffer( } end: + cam_mem_put_cpu_buf(cmd_buf->mem_handle); return rc; } diff --git a/drivers/cam_utils/cam_packet_util.h b/drivers/cam_utils/cam_packet_util.h index 62866a962cc6..94e8fd5529ee 100644 --- a/drivers/cam_utils/cam_packet_util.h +++ b/drivers/cam_utils/cam_packet_util.h @@ -1,6 +1,7 @@ /* SPDX-License-Identifier: GPL-2.0-only */ /* * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved. + * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved. */ #ifndef _CAM_PACKET_UTIL_H_ diff --git a/drivers/cam_utils/cam_soc_util.c b/drivers/cam_utils/cam_soc_util.c index 93ff740d22aa..c7cb0524f2de 100644 --- a/drivers/cam_utils/cam_soc_util.c +++ b/drivers/cam_utils/cam_soc_util.c @@ -1,6 +1,7 @@ // SPDX-License-Identifier: GPL-2.0-only /* * Copyright (c) 2015-2021, The Linux Foundation. All rights reserved. + * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved. */ #include @@ -2082,8 +2083,7 @@ static int cam_soc_util_dump_dmi_reg_range_user_buf( CAM_ERR(CAM_UTIL, "Invalid input args soc_info: %pK, dump_args: %pK", soc_info, dump_args); - rc = -EINVAL; - goto end; + return -EINVAL; } if (dmi_read->num_pre_writes > CAM_REG_DUMP_DMI_CONFIG_MAX || @@ -2091,15 +2091,14 @@ static int cam_soc_util_dump_dmi_reg_range_user_buf( CAM_ERR(CAM_UTIL, "Invalid number of requested writes, pre: %d post: %d", dmi_read->num_pre_writes, dmi_read->num_post_writes); - rc = -EINVAL; - goto end; + return -EINVAL; } rc = cam_mem_get_cpu_buf(dump_args->buf_handle, &cpu_addr, &buf_len); if (rc) { CAM_ERR(CAM_UTIL, "Invalid handle %u rc %d", dump_args->buf_handle, rc); - goto end; + return -EINVAL; } if (buf_len <= dump_args->offset) { @@ -2185,6 +2184,8 @@ static int cam_soc_util_dump_dmi_reg_range_user_buf( sizeof(struct cam_hw_soc_dump_header); end: + if (dump_args) + cam_mem_put_cpu_buf(dump_args->buf_handle); return rc; } @@ -2209,13 +2210,13 @@ static int cam_soc_util_dump_cont_reg_range_user_buf( "Invalid input args soc_info: %pK, dump_out_buffer: %pK reg_read: %pK", soc_info, dump_args, reg_read); rc = -EINVAL; - goto end; + return rc; } rc = cam_mem_get_cpu_buf(dump_args->buf_handle, &cpu_addr, &buf_len); if (rc) { CAM_ERR(CAM_UTIL, "Invalid handle %u rc %d", dump_args->buf_handle, rc); - goto end; + return rc; } if (buf_len <= dump_args->offset) { CAM_WARN(CAM_UTIL, "Dump offset overshoot %zu %zu", @@ -2265,6 +2266,8 @@ static int cam_soc_util_dump_cont_reg_range_user_buf( dump_args->offset += hdr->size + sizeof(struct cam_hw_soc_dump_header); end: + if (dump_args) + cam_mem_put_cpu_buf(dump_args->buf_handle); return rc; } @@ -2356,6 +2359,8 @@ int cam_soc_util_reg_dump_to_cmd_buf(void *ctx, if (rc || !cpu_addr || (buf_size == 0)) { CAM_ERR(CAM_UTIL, "Failed in Get cpu addr, rc=%d, cpu_addr=%pK", rc, (void *)cpu_addr); + if (rc) + return rc; goto end; } @@ -2557,6 +2562,7 @@ int cam_soc_util_reg_dump_to_cmd_buf(void *ctx, } end: + cam_mem_put_cpu_buf(cmd_desc->mem_handle); return rc; } From 0724e6884885b9e97a6a0222cd53e03fe5d34211 Mon Sep 17 00:00:00 2001 From: illa lakshmi soujanya Date: Mon, 12 Jun 2023 15:09:32 +0530 Subject: [PATCH 3/4] msm: camera: sensor: Add changes to prevent unmap buffers The function cam_mem_mgr_release can unmap buffers when in use. This change with cam_mem_put_cpu_buf prevents unmaping the buffers in use. CRs-Fixed: 3489559 Change-Id: I9c4e284c5961a2eb4ff0df362c93d6cea7d77cab Signed-off-by: illa lakshmi soujanya --- .../cam_sensor_module/cam_actuator/cam_actuator_core.c | 3 +++ drivers/cam_sensor_module/cam_csiphy/cam_csiphy_core.c | 6 +++++- drivers/cam_sensor_module/cam_eeprom/cam_eeprom_core.c | 10 +++++++++- drivers/cam_sensor_module/cam_flash/cam_flash_core.c | 9 +++++++++ drivers/cam_sensor_module/cam_ois/cam_ois_core.c | 3 +++ drivers/cam_sensor_module/cam_sensor/cam_sensor_core.c | 4 ++++ .../cam_sensor_utils/cam_sensor_util.c | 6 ++++++ 7 files changed, 39 insertions(+), 2 deletions(-) diff --git a/drivers/cam_sensor_module/cam_actuator/cam_actuator_core.c b/drivers/cam_sensor_module/cam_actuator/cam_actuator_core.c index 722f91e334b3..aac6ecdafc3b 100644 --- a/drivers/cam_sensor_module/cam_actuator/cam_actuator_core.c +++ b/drivers/cam_sensor_module/cam_actuator/cam_actuator_core.c @@ -1,6 +1,7 @@ // SPDX-License-Identifier: GPL-2.0-only /* * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved. + * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved. */ #include @@ -580,6 +581,7 @@ int32_t cam_actuator_i2c_pkt_parse(struct cam_actuator_ctrl_t *a_ctrl, } break; } + cam_mem_put_cpu_buf(cmd_desc[i].mem_handle); } if (a_ctrl->cam_act_state == CAM_ACTUATOR_ACQUIRE) { @@ -764,6 +766,7 @@ int32_t cam_actuator_i2c_pkt_parse(struct cam_actuator_ctrl_t *a_ctrl, } end: + cam_mem_put_cpu_buf(config.packet_handle); return rc; } diff --git a/drivers/cam_sensor_module/cam_csiphy/cam_csiphy_core.c b/drivers/cam_sensor_module/cam_csiphy/cam_csiphy_core.c index c1a2a53c9d10..8f1e55a8791c 100644 --- a/drivers/cam_sensor_module/cam_csiphy/cam_csiphy_core.c +++ b/drivers/cam_sensor_module/cam_csiphy/cam_csiphy_core.c @@ -1,6 +1,7 @@ // SPDX-License-Identifier: GPL-2.0-only /* * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved. + * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved. */ #include @@ -501,11 +502,14 @@ int32_t cam_cmd_buf_parser(struct csiphy_device *csiphy_dev, csiphy_dev->csiphy_info[index].settle_time, csiphy_dev->csiphy_info[index].data_rate); + cam_mem_put_cpu_buf(cmd_desc->mem_handle); + cam_mem_put_cpu_buf(cfg_dev->packet_handle); return rc; reset_settings: cam_csiphy_reset_phyconfig_param(csiphy_dev, index); - + cam_mem_put_cpu_buf(cfg_dev->packet_handle); + cam_mem_put_cpu_buf(cmd_desc->mem_handle); return rc; } diff --git a/drivers/cam_sensor_module/cam_eeprom/cam_eeprom_core.c b/drivers/cam_sensor_module/cam_eeprom/cam_eeprom_core.c index 61f40ff3c04c..45160c5705e5 100644 --- a/drivers/cam_sensor_module/cam_eeprom/cam_eeprom_core.c +++ b/drivers/cam_sensor_module/cam_eeprom/cam_eeprom_core.c @@ -1,7 +1,7 @@ // SPDX-License-Identifier: GPL-2.0-only /* * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved. - * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved. + * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved. */ #include @@ -897,9 +897,12 @@ static int32_t cam_eeprom_parse_write_memory_packet( break; } } + cam_mem_put_cpu_buf(cmd_desc[i].mem_handle); } + return rc; end: + cam_mem_put_cpu_buf(cmd_desc[i].mem_handle); return rc; } @@ -1055,9 +1058,12 @@ static int32_t cam_eeprom_init_pkt_parser(struct cam_eeprom_ctrl_t *e_ctrl, } } e_ctrl->cal_data.num_map = num_map + 1; + cam_mem_put_cpu_buf(cmd_desc[i].mem_handle); } + return rc; end: + cam_mem_put_cpu_buf(cmd_desc[i].mem_handle); return rc; } @@ -1127,6 +1133,7 @@ static int32_t cam_eeprom_get_cal_data(struct cam_eeprom_ctrl_t *e_ctrl, e_ctrl->cal_data.num_data); memcpy(read_buffer, e_ctrl->cal_data.mapdata, e_ctrl->cal_data.num_data); + cam_mem_put_cpu_buf(io_cfg->mem_handle[0]); } else { CAM_ERR(CAM_EEPROM, "Invalid direction"); rc = -EINVAL; @@ -1375,6 +1382,7 @@ static int32_t cam_eeprom_pkt_parse(struct cam_eeprom_ctrl_t *e_ctrl, void *arg) break; } + cam_mem_put_cpu_buf(dev_config.packet_handle); return rc; power_down: cam_eeprom_power_down(e_ctrl); diff --git a/drivers/cam_sensor_module/cam_flash/cam_flash_core.c b/drivers/cam_sensor_module/cam_flash/cam_flash_core.c index 8c747c0cae8e..c18135c9be62 100644 --- a/drivers/cam_sensor_module/cam_flash/cam_flash_core.c +++ b/drivers/cam_sensor_module/cam_flash/cam_flash_core.c @@ -1,6 +1,7 @@ // SPDX-License-Identifier: GPL-2.0-only /* * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved. + * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved. */ #include @@ -1172,6 +1173,7 @@ int cam_flash_i2c_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg) break; } + cam_mem_put_cpu_buf(cmd_desc[i].mem_handle); } power_info = &fctrl->power_info; if (!power_info) { @@ -1369,6 +1371,7 @@ update_req_mgr: add_req.req_id, add_req.trigger_eof); } } + cam_mem_put_cpu_buf(config.packet_handle); return rc; } @@ -1545,6 +1548,8 @@ int cam_flash_pmic_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg) rc = -EINVAL; return rc; } + + cam_mem_put_cpu_buf(cmd_desc->mem_handle); break; } case CAM_FLASH_PACKET_OPCODE_SET_OPS: { @@ -1652,6 +1657,8 @@ int cam_flash_pmic_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg) rc = -EINVAL; return rc; } + + cam_mem_put_cpu_buf(cmd_desc->mem_handle); break; } case CAM_FLASH_PACKET_OPCODE_NON_REALTIME_SET_OPS: { @@ -1794,6 +1801,7 @@ int cam_flash_pmic_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg) return rc; } + cam_mem_put_cpu_buf(cmd_desc->mem_handle); break; } case CAM_PKT_NOP_OPCODE: { @@ -1856,6 +1864,7 @@ int cam_flash_pmic_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg) } } + cam_mem_put_cpu_buf(config.packet_handle); return rc; } diff --git a/drivers/cam_sensor_module/cam_ois/cam_ois_core.c b/drivers/cam_sensor_module/cam_ois/cam_ois_core.c index b8cc002edb91..10ea398e290b 100644 --- a/drivers/cam_sensor_module/cam_ois/cam_ois_core.c +++ b/drivers/cam_sensor_module/cam_ois/cam_ois_core.c @@ -1,6 +1,7 @@ // SPDX-License-Identifier: GPL-2.0-only /* * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved. + * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved. */ #include @@ -629,6 +630,7 @@ static int cam_ois_pkt_parse(struct cam_ois_ctrl_t *o_ctrl, void *arg) } break; } + cam_mem_put_cpu_buf(cmd_desc[i].mem_handle); } if (o_ctrl->cam_ois_state != CAM_OIS_CONFIG) { @@ -841,6 +843,7 @@ static int cam_ois_pkt_parse(struct cam_ois_ctrl_t *o_ctrl, void *arg) (csl_packet->header.op_code & 0xFFFFFF)); return -EINVAL; } + cam_mem_put_cpu_buf(dev_config.packet_handle); if (!rc) return rc; diff --git a/drivers/cam_sensor_module/cam_sensor/cam_sensor_core.c b/drivers/cam_sensor_module/cam_sensor/cam_sensor_core.c index 8298f9f81bc6..3d5e3896c9d9 100644 --- a/drivers/cam_sensor_module/cam_sensor/cam_sensor_core.c +++ b/drivers/cam_sensor_module/cam_sensor/cam_sensor_core.c @@ -1,6 +1,7 @@ // SPDX-License-Identifier: GPL-2.0-only /* * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved. + * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved. */ #include @@ -336,6 +337,7 @@ static int32_t cam_sensor_i2c_pkt_parse(struct cam_sensor_ctrl_t *s_ctrl, } end: + cam_mem_put_cpu_buf(config.packet_handle); return rc; } @@ -586,9 +588,11 @@ int32_t cam_handle_mem_ptr(uint64_t handle, struct cam_sensor_ctrl_t *s_ctrl) "Failed to parse the command Buffer Header"); goto end; } + cam_mem_put_cpu_buf(cmd_desc[i].mem_handle); } end: + cam_mem_put_cpu_buf(handle); return rc; } diff --git a/drivers/cam_sensor_module/cam_sensor_utils/cam_sensor_util.c b/drivers/cam_sensor_module/cam_sensor_utils/cam_sensor_util.c index a8bad02a0247..c90510e954d6 100644 --- a/drivers/cam_sensor_module/cam_sensor_utils/cam_sensor_util.c +++ b/drivers/cam_sensor_module/cam_sensor_utils/cam_sensor_util.c @@ -1,6 +1,7 @@ // SPDX-License-Identifier: GPL-2.0-only /* * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved. + * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved. */ #include @@ -319,6 +320,7 @@ static int32_t cam_sensor_get_io_buffer( io_cfg->direction); rc = -EINVAL; } + cam_mem_put_cpu_buf(io_cfg->mem_handle[0]); return rc; } @@ -377,6 +379,7 @@ int32_t cam_sensor_util_write_qtimer_to_io_buffer( io_cfg->direction); rc = -EINVAL; } + cam_mem_put_cpu_buf(io_cfg->mem_handle[0]); return rc; } @@ -824,9 +827,12 @@ int cam_sensor_i2c_command_parser( } } i2c_reg_settings->is_settings_valid = 1; + cam_mem_put_cpu_buf(cmd_desc[i].mem_handle); } + return rc; end: + cam_mem_put_cpu_buf(cmd_desc[i].mem_handle); return rc; } From f81db8138213af2474a48391c23745efc90a3b68 Mon Sep 17 00:00:00 2001 From: Gaurav Jindal Date: Tue, 4 Jul 2023 16:52:37 +0530 Subject: [PATCH 4/4] msm: camera: fd: Fix compilation issue This commit fixes compilation issue. CRs-Fixed: 3549085 Change-Id: Ia98fbbf67736c372fea4788b8e445c534126da21 Signed-off-by: Gaurag Jindal --- drivers/cam_fd/fd_hw_mgr/cam_fd_hw_mgr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/cam_fd/fd_hw_mgr/cam_fd_hw_mgr.c b/drivers/cam_fd/fd_hw_mgr/cam_fd_hw_mgr.c index 8ce17c3500f1..971b189654f6 100644 --- a/drivers/cam_fd/fd_hw_mgr/cam_fd_hw_mgr.c +++ b/drivers/cam_fd/fd_hw_mgr/cam_fd_hw_mgr.c @@ -665,7 +665,7 @@ static int cam_fd_mgr_util_prepare_io_buf_info(int32_t iommu_hdl, "Invalid cpu buf %d %d %d", io_cfg[i].direction, io_cfg[i].resource_type, plane); - cam_mem_put_cpu_buf(io_cfg[i].mem_handle[plane]; + cam_mem_put_cpu_buf(io_cfg[i].mem_handle[plane]); rc = -EINVAL; return rc; }