Consider two threads. Thread 1 has an fd linked to an ion buffer
and Thread 2 has a handle to the same buffer. The two came from
the same client
Thread 1 Thread 2
-----------------------------------------
ion_import_fd
ion_import
mutex_lock(&client->lock)
ion_free
ion_handle_put
ion_handle_destroy
mutex_lock(&client->lock) <--- currently locked
ion_handle_lookup
<return reference to same handle>
mutex_unlock(&client->lock)
acquire client lock
free(handle)
Thread 1 is now holding a reference to an already freed handle.
The issue arises because thread 2 is attempting to destroy the
handle but the handle still exists on the clients list of handles.
This needs to be atomic. Fix this by taking the client lock
around ion_handle_put.
CRs-Fixed: 328348
Change-Id: I3ff5e6c50b5268fd42092bc1f2b99403e5fcd3cd
Signed-off-by: Laura Abbott <lauraa@codeaurora.org>
Several functions that should not be used outside of
the ion.c file does not have static keyword. In
addition two of the functions should not be exported.
Add static keyword to functions that are local to the
translation unit and remove EXPORT_SYMBOL declarations
that are not needed.
Change-Id: Ia1ef54e3670d361c9a6d684f789be2129facb04d
Signed-off-by: Olav Haugan <ohaugan@codeaurora.org>
These idles were necessary when the context switch code
preserved PM_OVERRIDE registers. That was removed some time
ago so now the idles are not needed.
CRs-Fixed: 331325
Change-Id: I90d4e1685f213a5720bf6da4e6d4a187d1eb0689
Signed-off-by: Jeremy Gebben <jgebben@codeaurora.org>
Use a #define constant instead of a bare constant for the flags
parameter of adreno_ringbuffer_issuecmds.
Change-Id: Ic0dedbadecabe396a51201859a444e68ba64c53d
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
Add support for snapshotting the state of the GPU in a binary format. The
snapshot can be pulled from sysfs and parsed off-target. The advantage is
that far more information can be encapsulated in a snapshot then can be
printed on the console during a hang. Snapshots are automatically created
during a hang, or can be manually triggered by writing 'trigger'
in /sys/class/kgsl/kgsl-<n>/snapshot where n is either the 2D or 3D device.
Snapshot data can be pulled from 'dump' in the same directory.
Change-Id: Ic0dedbad1c8473b3b109582b95a8771b0d341f05
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
Several functions in the ion interface is missing
EXPORT_SYMBOL. This is needed to allow clients to
use these functions from kernel modules.
Add EXPORT_SYMBOL to functions that are supposed
to be exposed.
Change-Id: Ieb2810d85205a7492b8fe28536fb20ea090e830f
Signed-off-by: Olav Haugan <ohaugan@codeaurora.org>
strncpy is unsafe because it does not guarantee
that the resultant string is NULL-terminated.
Replace strncpy with strlcpy and remove explicit
NULL-termination. Also correct allocation of
string buffer.
Change-Id: Id5075ef7b04f80e2bf828f52def329b926e9ec3f
Signed-off-by: Olav Haugan <ohaugan@codeaurora.org>
This reverts a87d51a96c
Patch causes increase in power consumption while playing a video.
CRs-fixed: 331854
Change-Id: Ic21f109ac730167539a78647d51a8051d5c9948f
Signed-off-by: Anoop Kumar Yerukala <ayeruk@codeaurora.org>
kmalloc allocates physically contiguous memory and
may fail for larger allocations due to fragmentation.
The large allocations are caused by the fact that the
scatterlist structure is 24 bytes and the array size
is proportional to the number of pages being mapped.
CRs-fixed: 327066
Change-Id: Ic7d15ca0399aa5c1fa01b7892cff736b3d1e4236
Signed-off-by: Jeff Boody <jboody@codeaurora.org>
The stop_work function releases the device mutex to flush
the workqueue. The requested state may change while the
mutex is held by a different thread. So set the requested
state after stop_work.
Change-Id: I3454e773fd670722ea5776d2c8d960190da24006
Signed-off-by: Lucille Sylvester <lsylvest@codeaurora.org>
Use the restore_slumber variable at as low a level as possible
to remove confusion from the state machine. Also do not let
restore_slumber impact the function of NAP state.
Change-Id: I1e01dc35c19b3568bad1e6ae4b2399d309147cbd
Signed-off-by: Lucille Sylvester <lsylvest@codeaurora.org>
If the core is in SUSPEND or INIT hw access should not be allowed.
Change-Id: I635a68044dc66be643eb73844b0a5a8b43f31b6c
Signed-off-by: Lucille Sylvester <lsylvest@codeaurora.org>
The refcount increment actually needs to happen in mmap.
Otherwise it doesn't actually happen.
Change-Id: I1043453c2c828b8658a28acea57181759b2b21f0
Signed-off-by: Laura Abbott <lauraa@codeaurora.org>
Printing to debugfs is done from a centralized location for
all the heaps managed by ion. This architecture is not
sustainable in the long run since different heaps have different
requirements for what should be printed.
Refactor the debugfs printing for ion so that each heap is
responsible for printing its information.
Change-Id: I1dbe13432a4ab07f27ea4756c3be7fa01ad1df92
Signed-off-by: Olav Haugan <ohaugan@codeaurora.org>
Add error message when allocation from ion fails.
Change-Id: If2efa95c563c9f076b85958a70ea66afa3983325
Signed-off-by: Olav Haugan <ohaugan@codeaurora.org>
The ion client name used for debugging were being
allocated on the stack for user space clients. This
causes the name to be garbled when later printed.
Instead, allocate the name from the heap.
Change-Id: Id299d224192f127197bef2eeb22d881b3a31795c
Signed-off-by: Olav Haugan <ohaugan@codeaurora.org>
Add decrement of mapping count when mapping fails
and corresponding SMI release region call.
Change-Id: I81fb7eeee9973c770a65f02236c5358ce313e3a0
Signed-off-by: Olav Haugan <ohaugan@codeaurora.org>
Remove duplicate logging message for failure to create
a heap. Add logging message with name, base address, and
size of each heap created.
Change-Id: Id3a3706d914ffa72b0ecd84eb98785a678ceda9a
Signed-off-by: Olav Haugan <ohaugan@codeaurora.org>
The SCM call message size used to protect and
unprotect memory is incorrect. The interface expects
13 bytes but 16 bytes is sent due to padding of the
message struct.
Pack the message structure to force the size of the
structure to 13 bytes.
Change-Id: Iecb7b40aa7e94454620c19cd70c3106392d2d311
Signed-off-by: Olav Haugan <ohaugan@codeaurora.org>
ION has to guarantee that two of the heaps are
adjacent to each other. This is due to a limitation
in the hardware. Add code to ensure these heaps
are adjacent.
Change-Id: Icc18437a50e1d872112468d02b61ab47fd70acc9
Signed-off-by: Olav Haugan <ohaugan@codeaurora.org>
MSM_SLEEP_STATS_DEVICE option is used to compile idle stats device
framework which is needed for GPU DCVS feature.
Change-Id: I9550c90054587aa4fcec40131761eeaf54da8a03
Signed-off-by: Lynus Vaz <lvaz@codeaurora.org>
Refactor platform data to allow for better
expansion in the future. Add void * for
elements unique to each heap type.
Change-Id: I435679819c67ce917b5798009eff7e71047fd2ea
Signed-off-by: Olav Haugan <ohaugan@codeaurora.org>
ION_IOC_ALLOC may incorrectly return an error pointer
which could be 0 when an allocation fails. The ioctl call from user
space expects that the function succeeded when ioctl returns 0.
Change ION_IOC_ALLOC return value to -ENOMEM when the requested
buffer could not be allocated.
Change-Id: Id9d49ffa0eb8af5defc9635f40b45351b9dd8999
Signed-off-by: Olav Haugan <ohaugan@codeaurora.org>
Add more debug information to ion_debug_heap_show:
-Get number of allocations from heap
-Get number of user space mappings.
-Get number of kernel space mappings.
-Get indicator whether heaps has been secured or not.
Change-Id: I05491b3dd8caccfc3bbe5a9e55642e5e2cd431c4
Signed-off-by: Olav Haugan <ohaugan@codeaurora.org>
When a heap is destroyed a heap type specific
function is called to release memory that the heap
structures used. A case statement handling destroying
the iommu heap is missing. Add missing case statement.
Change-Id: I1aa54209a55db06becc570f65ecf0f740d2e9545
Signed-off-by: Olav Haugan <ohaugan@codeaurora.org>
Secure buffers provides a way to allow premium encrypted
multimedia content to be decrypted in a secured
memory area that does not allow for interception of the
decrypted content.
Add support for heap type that allow heap to be
used for content protection. Introduce new content
protection heap type and id's.
Change-Id: Idd56aa8805b5b74d1b9ab3fe8964aacc218668c1
Signed-off-by: Olav Haugan <ohaugan@codeaurora.org>
* changes:
msm: kgsl: only poke once during adreno_idle
msm: kgsl: Modify only the pending idle timer in ISR.
msm: kgsl: flush device workqueue before stop
The RBBM_STATUS loop is extremely tight and calling
adreno_poke() each time through this loop appears
to cause watchdog bites on 8960.
CRs-Fixed: 324507
Change-Id: I65145ca96f63280179d76abd5320fd201beeeaa7
Signed-off-by: Jeremy Gebben <jgebben@codeaurora.org>
mod_timer reactivates the timer even when timer is deleted using
del_timer_sync. In the ISR we should be modifying only the pending
timer. We deleted the timer using del_timer_sync, if the interrupts
are still enabled, we could be re-enabling the timer in the ISR.
There is a code path in kgsl_suspend device where we delete the timer
but disable IRQ later.This code path seems to be fixed with another
commit.
Change-Id: I1253dd3c774427e725d302d9ba13d87fad10c463
Signed-off-by: Tarun Karra <tkarra@codeaurora.org>
Make sure the irq is off, the idle timer is
stopped and the workqueue is flushed before
stopping the device for early suspend, suspend,
last release or hang recovery. There is one case
where the workqueue cannot be flushed, which is from
kgsl_pwrctrl_sleep() when going into SLUMBER
state. This codepath can be called from the
workqueue itself so flushing would deadlock.
Change-Id: I19bcd192845401ac0d94aa60a9252970b634c1ea
Signed-off-by: Tarun Karra <tkarra@codeaurora.org>
Signed-off-by: Jeremy Gebben <jgebben@codeaurora.org>
The msm_idle_stats_update_event() function is now a public function.
In case of IDLE_TIMER expiry, kgsl calls this function to immediately
wake up waiting processes.
Change-Id: Ia259d10e08deea71db047d8091cc97066fba3c1c
Signed-off-by: Lynus Vaz <lvaz@codeaurora.org>
If the device is not in active state, collecting a sample is not
necessary and will cause frequent wake-ups, resulting in higher power
consumption.
Change-Id: Icb4f82b1300cab3b4cc4ed17117a92725a5a11d4
Signed-off-by: Lynus Vaz <lvaz@codeaurora.org>
If another state has been requested, there is no reason
to queue work.
Change-Id: Ifa8d57e523a047bd2021c00732c2fe6a67bd6790
Signed-off-by: Jeremy Gebben <jgebben@codeaurora.org>
These functions write registers and so if they are called
from kgsl_pwrctrl_irq() there is a chance that they
might be called when clocks are disabled.
Change-Id: I259d840d9996d424aba3e3481201d49f602637e8
Signed-off-by: Jeremy Gebben <jgebben@codeaurora.org>
If the carveout heap fails to be created the pool needs to
be destroyed.
Change-Id: I73f768d79a11aacd2161b079db9621264d14d2ad
Signed-off-by: Olav Haugan <ohaugan@codeaurora.org>
Since 7x25A supports two power levels, do not allow it to register
with the power scale policy.
Change-Id: I1a77f0aa8e7affa126d7c18cb2d73e8617602dcf
Signed-off-by: Lynus Vaz <lvaz@codeaurora.org>
Scenarios which check for idle and inadvertently turn
on the core when it was off happen fairly frequently.
Fixing this at the root rather than continuing to work
around each one.
Change-Id: Ibddd40bf69352733c8d4779272aa08757981d494
Signed-off-by: Lucille Sylvester <lsylvest@codeaurora.org>
Move the GPU register lists to a common location so they can be used
by multiple sub-systems. To avoid confusion, convert the lists from
byte offsets to dword offsets to match how we do register offsets
throughout the entire driver and in user space.
Change-Id: Ic0dedbad0f320242b77231a444939f9c6d852976
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
Callbacks to request_region, release_region,
setup_region is missing from ION platform data for
SMI heap.
Change-Id: Ida603d4ac7c3246c0deedb9b80dc0c1ea64638eb
Signed-off-by: Olav Haugan <ohaugan@codeaurora.org>
