Consider two threads. Thread 1 has an fd linked to an ion buffer
and Thread 2 has a handle to the same buffer. The two came from
the same client
Thread 1 Thread 2
-----------------------------------------
ion_import_fd
ion_import
mutex_lock(&client->lock)
ion_free
ion_handle_put
ion_handle_destroy
mutex_lock(&client->lock) <--- currently locked
ion_handle_lookup
<return reference to same handle>
mutex_unlock(&client->lock)
acquire client lock
free(handle)
Thread 1 is now holding a reference to an already freed handle.
The issue arises because thread 2 is attempting to destroy the
handle but the handle still exists on the clients list of handles.
This needs to be atomic. Fix this by taking the client lock
around ion_handle_put.
CRs-Fixed: 328348
Change-Id: I3ff5e6c50b5268fd42092bc1f2b99403e5fcd3cd
Signed-off-by: Laura Abbott <lauraa@codeaurora.org>
Several functions that should not be used outside of
the ion.c file does not have static keyword. In
addition two of the functions should not be exported.
Add static keyword to functions that are local to the
translation unit and remove EXPORT_SYMBOL declarations
that are not needed.
Change-Id: Ia1ef54e3670d361c9a6d684f789be2129facb04d
Signed-off-by: Olav Haugan <ohaugan@codeaurora.org>
Several functions in the ion interface is missing
EXPORT_SYMBOL. This is needed to allow clients to
use these functions from kernel modules.
Add EXPORT_SYMBOL to functions that are supposed
to be exposed.
Change-Id: Ieb2810d85205a7492b8fe28536fb20ea090e830f
Signed-off-by: Olav Haugan <ohaugan@codeaurora.org>
strncpy is unsafe because it does not guarantee
that the resultant string is NULL-terminated.
Replace strncpy with strlcpy and remove explicit
NULL-termination. Also correct allocation of
string buffer.
Change-Id: Id5075ef7b04f80e2bf828f52def329b926e9ec3f
Signed-off-by: Olav Haugan <ohaugan@codeaurora.org>
The refcount increment actually needs to happen in mmap.
Otherwise it doesn't actually happen.
Change-Id: I1043453c2c828b8658a28acea57181759b2b21f0
Signed-off-by: Laura Abbott <lauraa@codeaurora.org>
Printing to debugfs is done from a centralized location for
all the heaps managed by ion. This architecture is not
sustainable in the long run since different heaps have different
requirements for what should be printed.
Refactor the debugfs printing for ion so that each heap is
responsible for printing its information.
Change-Id: I1dbe13432a4ab07f27ea4756c3be7fa01ad1df92
Signed-off-by: Olav Haugan <ohaugan@codeaurora.org>
Add error message when allocation from ion fails.
Change-Id: If2efa95c563c9f076b85958a70ea66afa3983325
Signed-off-by: Olav Haugan <ohaugan@codeaurora.org>
The ion client name used for debugging were being
allocated on the stack for user space clients. This
causes the name to be garbled when later printed.
Instead, allocate the name from the heap.
Change-Id: Id299d224192f127197bef2eeb22d881b3a31795c
Signed-off-by: Olav Haugan <ohaugan@codeaurora.org>
Add decrement of mapping count when mapping fails
and corresponding SMI release region call.
Change-Id: I81fb7eeee9973c770a65f02236c5358ce313e3a0
Signed-off-by: Olav Haugan <ohaugan@codeaurora.org>
Remove duplicate logging message for failure to create
a heap. Add logging message with name, base address, and
size of each heap created.
Change-Id: Id3a3706d914ffa72b0ecd84eb98785a678ceda9a
Signed-off-by: Olav Haugan <ohaugan@codeaurora.org>
The SCM call message size used to protect and
unprotect memory is incorrect. The interface expects
13 bytes but 16 bytes is sent due to padding of the
message struct.
Pack the message structure to force the size of the
structure to 13 bytes.
Change-Id: Iecb7b40aa7e94454620c19cd70c3106392d2d311
Signed-off-by: Olav Haugan <ohaugan@codeaurora.org>
ION has to guarantee that two of the heaps are
adjacent to each other. This is due to a limitation
in the hardware. Add code to ensure these heaps
are adjacent.
Change-Id: Icc18437a50e1d872112468d02b61ab47fd70acc9
Signed-off-by: Olav Haugan <ohaugan@codeaurora.org>
Refactor platform data to allow for better
expansion in the future. Add void * for
elements unique to each heap type.
Change-Id: I435679819c67ce917b5798009eff7e71047fd2ea
Signed-off-by: Olav Haugan <ohaugan@codeaurora.org>
ION_IOC_ALLOC may incorrectly return an error pointer
which could be 0 when an allocation fails. The ioctl call from user
space expects that the function succeeded when ioctl returns 0.
Change ION_IOC_ALLOC return value to -ENOMEM when the requested
buffer could not be allocated.
Change-Id: Id9d49ffa0eb8af5defc9635f40b45351b9dd8999
Signed-off-by: Olav Haugan <ohaugan@codeaurora.org>
Add more debug information to ion_debug_heap_show:
-Get number of allocations from heap
-Get number of user space mappings.
-Get number of kernel space mappings.
-Get indicator whether heaps has been secured or not.
Change-Id: I05491b3dd8caccfc3bbe5a9e55642e5e2cd431c4
Signed-off-by: Olav Haugan <ohaugan@codeaurora.org>
When a heap is destroyed a heap type specific
function is called to release memory that the heap
structures used. A case statement handling destroying
the iommu heap is missing. Add missing case statement.
Change-Id: I1aa54209a55db06becc570f65ecf0f740d2e9545
Signed-off-by: Olav Haugan <ohaugan@codeaurora.org>
Secure buffers provides a way to allow premium encrypted
multimedia content to be decrypted in a secured
memory area that does not allow for interception of the
decrypted content.
Add support for heap type that allow heap to be
used for content protection. Introduce new content
protection heap type and id's.
Change-Id: Idd56aa8805b5b74d1b9ab3fe8964aacc218668c1
Signed-off-by: Olav Haugan <ohaugan@codeaurora.org>
If the carveout heap fails to be created the pool needs to
be destroyed.
Change-Id: I73f768d79a11aacd2161b079db9621264d14d2ad
Signed-off-by: Olav Haugan <ohaugan@codeaurora.org>
Callbacks to request_region, release_region,
setup_region is missing from ION platform data for
SMI heap.
Change-Id: Ida603d4ac7c3246c0deedb9b80dc0c1ea64638eb
Signed-off-by: Olav Haugan <ohaugan@codeaurora.org>
When ion_vma_open is called, a reference to the handle in
the vma must be taken. Otherwise, if forking occurs,
ion_vma_close will be called twice which will leave one of
the calls with an invalid reference.
Change-Id: I9ab6e68ab6b1d2ac4bed4f45045b4b2ee39995e8
Signed-off-by: Laura Abbott <lauraa@codeaurora.org>
Currently, Ion registers all debugfs entries for clients
via pid. If there are multiple kernel clients, this means
the debugfs entry only gets created for the first one. Fix
this by creating debugfs entries by name always. When
creating user clients, specify the name via the pid.
Change-Id: I00cbb284d1c53b3362bb7be9c0275620a9fac167
Signed-off-by: Laura Abbott <lauraa@codeaurora.org>
When mmap is called to remove a mapping, the mmap code
takes care of removing all the entries so it isn't
necessary to call unmap versions. However, there may be
cases where heaps need to do other buffer clean up when
a userspace buffer is unmapped. Add an unmap_user function
to the ion heap ops. This callback needs to happen in
vma_close, so move the decrementing of the overall user map
call back as well.
Change-Id: I8e5716774dd973828f76e03ec43e8e8ecf8c7936
Signed-off-by: Laura Abbott <lauraa@codeaurora.org>
Ion allows multiple mmaps of the same buffers. This means that
incrementing the usermap count in mmap and decrementing it in
release is not sufficient as release will only ever be called
once. Fix this by only doing the reference count change in the
vma_open and close which are called whenever mmap is called.
Change-Id: I6d17c0f563d0b90481d8e092c1e206f2b33c8e00
Signed-off-by: Laura Abbott <lauraa@codeaurora.org>
Not all heaps will implement the release/request callbacks. Check those
function pointers are valid before calling.
Change-Id: I848e31495e45c7eaa4497b82be590d291d77980a
Signed-off-by: Laura Abbott <lauraa@codeaurora.org>
Add infrastructure to support mapping allocations
into iommus.
Change-Id: Ia5eafebee408e297013bf55284abf67d9eb8d78b
Signed-off-by: Laura Abbott <lauraa@codeaurora.org>
When mapping carveout buffers into userspace, only map
the size of the vma given, not the full size of the buffer
since clients may map less than the buffer size.
Change-Id: Idf1d1ee5850c0f7045c0f78bfd5841a76db90a34
Signed-off-by: Laura Abbott <lauraa@codeaurora.org>
This change is part of the move from PMEM to ION. ION needs an SMI
voting interface smiliar to PMEM's.
Change-Id: I18888f46198848694fb7e1e0d2671074bf51d7c9
Signed-off-by: Alex Bird <alexbird@codeaurora.org>
Userspace clients pass fds around, not handles. Support flushing
via fd.
Change-Id: Ic22d9327e9fa72cb604c3010a2a6f798be8dfdb1
Signed-off-by: Laura Abbott <lauraa@codeaurora.org>
If the ion allocation fails, return a negative value to the
ioctl. This is easier for userspace to deal with than
checking if the handle is valid.
Change-Id: I1c785b1b1e71d2bd45c6f7be78ea15e4a08cd6e5
Signed-off-by: Laura Abbott <lauraa@codeaurora.org>
Cache flushing takes the mmap semaphore to validate the
address range. This can cause a deadlock in the following
scenario with two threads in the same client:
Thread 1 Thread 2
(cache operation) (mmap)
-----------------------------------------
lock(client_lock)
down_write(mmap_semaphore)
down_read(mmap_semaphore)
lock(client_lock)
Fix this by doing the check for the address range before
taking the client lock. This is independent of Ion so there
is no need to have this lock locked.
Change-Id: Ibe372cf232fbad7e031ab2d38cf3a34823f43bf9
Signed-off-by: Laura Abbott <lauraa@codeaurora.org>
If an error occurs during heap creation the behavior is different
depending on the error condition. If memory cannot be allocated
for the heap the rest of the heaps will be created. However, if
the ion heap cannot be created heap creation stops and all the heaps
are destroyed. Make the error handling consistent for both error
conditions by logging an error message and continuing creation
of the rest of the heaps.
General cleanup: Change global variables to be local to this
translation unit.
Change-Id: Ia8d2fb2f3257b91d6423b6722e12e9b3d7792e86
Signed-off-by: Olav Haugan <ohaugan@codeaurora.org>
The ION_IOC_MAP/ION_IOC_SHARE ioctls take a reference to
an ion buffer. If the fd generated by the ioctl is never
closed, the buffer will never be freed. This is a pain to
track down in userspace. Add a debugfs entry to do a scan
of all the buffers and check which ones have no handle
associated with them. If a buffer has no handle associated
with it, that means the last reference is an fd. There
isn't a good way to directly associate an fd with a buffer,
but this can at least be a starting point for tracking down
leaks.
Change-Id: I64eedd6a30d8298b2aa75532c7fad506542910f6
Signed-off-by: Laura Abbott <lauraa@codeaurora.org>
For consistency sake, print out debug information in hex.
Change-Id: Iccf27eca1b994bff547c812387ed756a07e9cd7b
Signed-off-by: Laura Abbott <lauraa@codeaurora.org>
Currently, the debugfs information provides aggregated data
for all carveout heaps. This isn't particularly helpful for
determining allocation problems with individual carveout heaps.
Fix this to give data for individual carveout heaps.
Change-Id: I60a10851052412e20c40f1862d6dcc22093fd982
Signed-off-by: Laura Abbott <lauraa@codeaurora.org>
If memory is fragmented, an allocation may fail even if
there is sufficient memory. Detect this state if it occurs
and note it in the logs.
Change-Id: Ia0471ba3f231c8538449f3f842f157a1128ebd38
Signed-off-by: Laura Abbott <lauraa@codeaurora.org>
If an fd import fails because the fd is not an Ion fd,
print out the name of the file. This way, it can be possible
to deduce where the fd came from.
Change-Id: I8464517ac011d62ebbd7e472f3e5734b0faacb0d
Signed-off-by: Laura Abbott <lauraa@codeaurora.org>
Silently check for a null pointer in ion_client_destroy
Change-Id: Ic0dedbada03496faf2eb024c40f9cfaf8d08c98f
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
Clients may want to know what the existing flags are on a
handle for mapping, cache flushing or other purposes. Add
an API to get those flags.
Change-Id: I2d8c93194d1fc940042529b8851ebecf35d6e3de
Signed-off-by: Laura Abbott <lauraa@codeaurora.org>
Add warning when freeing client with buffers that are currently
mappped.
Change-Id: Ib8e17786daa7c890245c3d3e37143137cae7d078
Signed-off-by: Laura Abbott <lauraa@codeaurora.org>
In debugfs, clients now show individual allocations.
Carveout heaps now give the number of bytes currently
allocated out of total possible bytes. The system heaps
just show the number of bytes currently allocated.
Change-Id: I4acfcdc1089c73c28041e09cb6b5a03b956e936a
Signed-off-by: Laura Abbott <lauraa@codeaurora.org>
Only do the cache operation when the buffer is cached.
If the buffer is uncached, just return. Fixes a bug
where the cache was only being flushed when the buffer
was uncached instead of cached.
Change-Id: Ib1fa01168de79d5627b11d07c5313d19b3049145
Signed-off-by: Laura Abbott <lauraa@codeaurora.org>
Currently, the ion allocation API takes an alignment
argument. This alignment argument is currently ignored
everywhere. The system heaps cannot support the alignment
argument, but carveout heaps can. Add support for carveout
heaps to give back aligned memory.
Change-Id: Ic4cff37a7de51e1c85e273c2589958f7f13c33c9
Signed-off-by: Laura Abbott <lauraa@codeaurora.org>
Ion needs to be initialized before most other subsystems.
Move the call to be earlier to ensure drivers that need to
allocate memory at bootup can.
Signed-off-by: Laura Abbott <lauraa@codeaurora.org>
Ion uses the O_DSYNC flag of a file to indicate an uncached mapping.
When generating a file for mmaping, the new file needs to have the
same O_DSYNC flag as the parent (the file of the ioctl open call)
to indicate if the mapping should be cached or uncached.
Signed-off-by: Laura Abbott <lauraa@codeaurora.org>
When the cached flag is set, ioremap_cached should be called.
When the cache flag is not set, ioremap should be called.
Signed-off-by: Laura Abbott <lauraa@codeaurora.org>
Add explicit support for cached and uncached mappings. Functions
now describe whether mappings will be cached or uncached.
Signed-off-by: Laura Abbott <lauraa@codeaurora.org>
