Merge "msm: camera: Add protection for buffer queue" (12368685) · Commits · e / devices / android_kernel_sony_msm8994

drivers/media/platform/msm/camera_v2/isp/msm_buf_mgr.c

+25 −7

Original line number	Diff line number	Diff line
		@@ -133,6 +133,7 @@ static int msm_isp_prepare_isp_buf(struct msm_isp_buf_mgr *buf_mgr,
		struct buffer_cmd *buf_pending = NULL;
		int domain_num;
		uint32_t accu_length = 0;
		unsigned long flags;

		if (buf_mgr->secure_enable == NON_SECURE_MODE)
		domain_num = buf_mgr->iommu_domain_num;
		@@ -170,7 +171,9 @@ static int msm_isp_prepare_isp_buf(struct msm_isp_buf_mgr *buf_mgr,
		}

		buf_pending->mapped_info = mapped_info;
		spin_lock_irqsave(&buf_mgr->bufq_list_lock, flags);
		list_add_tail(&buf_pending->list, &buf_mgr->buffer_q);
		spin_unlock_irqrestore(&buf_mgr->bufq_list_lock, flags);
		}
		buf_info->num_planes = qbuf_buf->num_planes;
		return 0;
		@@ -192,6 +195,7 @@ static void msm_isp_unprepare_v4l2_buf(
		struct msm_isp_buffer_mapped_info *mapped_info;
		struct buffer_cmd *buf_pending = NULL;
		int domain_num;
		unsigned long flags;

		if (buf_mgr->secure_enable == NON_SECURE_MODE)
		domain_num = buf_mgr->iommu_domain_num;
		@@ -200,22 +204,26 @@ static void msm_isp_unprepare_v4l2_buf(

		for (i = 0; i < buf_info->num_planes; i++) {
		mapped_info = &buf_info->mapped_info[i];

		spin_lock_irqsave(&buf_mgr->bufq_list_lock, flags);
		list_for_each_entry(buf_pending, &buf_mgr->buffer_q, list) {
		if (!buf_pending)
		break;

		if (buf_pending->mapped_info == mapped_info) {
		list_del_init(&buf_pending->list);
		kfree(buf_pending);
		spin_unlock_irqrestore(
		&buf_mgr->bufq_list_lock, flags);
		ion_unmap_iommu(buf_mgr->client,
		mapped_info->handle,
		domain_num, 0);
		ion_free(buf_mgr->client, mapped_info->handle);

		list_del_init(&buf_pending->list);
		kfree(buf_pending);
		spin_lock_irqsave(
		&buf_mgr->bufq_list_lock, flags);
		break;
		}
		}
		spin_unlock_irqrestore(&buf_mgr->bufq_list_lock, flags);
		}
		return;
		}
		@@ -356,7 +364,7 @@ static int msm_isp_get_buf(struct msm_isp_buf_mgr *buf_mgr, uint32_t id,
		uint32_t bufq_handle, struct msm_isp_buffer **buf_info)
		{
		int rc = -1;
		unsigned long flags;
		unsigned long flags, irq_state;
		struct msm_isp_buffer *temp_buf_info;
		struct msm_isp_bufq *bufq = NULL;
		struct vb2_buffer *vb2_buf = NULL;
		@@ -403,7 +411,9 @@ static int msm_isp_get_buf(struct msm_isp_buf_mgr *buf_mgr, uint32_t id,
		list_for_each_entry(temp_buf_info, &bufq->head, list) {
		if (temp_buf_info->state ==
		MSM_ISP_BUFFER_STATE_QUEUED) {

		spin_lock_irqsave(
		&buf_mgr->bufq_list_lock,
		irq_state);
		list_for_each_entry(buf_pending,
		&buf_mgr->buffer_q, list) {
		if (!buf_pending)
		@@ -425,6 +435,8 @@ static int msm_isp_get_buf(struct msm_isp_buf_mgr *buf_mgr, uint32_t id,
		break;
		}
		}
		spin_unlock_irqrestore(
		&buf_mgr->bufq_list_lock, irq_state);
		break;
		}
		}
		@@ -434,7 +446,8 @@ static int msm_isp_get_buf(struct msm_isp_buf_mgr *buf_mgr, uint32_t id,
		bufq->session_id, bufq->stream_id);
		if (vb2_buf) {
		if (vb2_buf->v4l2_buf.index < bufq->num_bufs) {

		spin_lock_irqsave(
		&buf_mgr->bufq_list_lock, irq_state);
		list_for_each_entry(buf_pending,
		&buf_mgr->buffer_q, list) {
		if (!buf_pending)
		@@ -456,6 +469,8 @@ static int msm_isp_get_buf(struct msm_isp_buf_mgr *buf_mgr, uint32_t id,
		break;
		}
		}
		spin_unlock_irqrestore(
		&buf_mgr->bufq_list_lock, irq_state);
		} else {
		pr_err("%s: Incorrect buf index %d\n",
		__func__, vb2_buf->v4l2_buf.index);
		@@ -943,6 +958,7 @@ static int msm_isp_release_bufq(struct msm_isp_buf_mgr *buf_mgr,
		{
		struct msm_isp_bufq *bufq = NULL;
		int rc = -1;
		mutex_lock(&buf_mgr->lock);
		bufq = msm_isp_get_bufq(buf_mgr, bufq_handle);
		if (!bufq) {
		pr_err("Invalid bufq release\n");
		@@ -953,6 +969,7 @@ static int msm_isp_release_bufq(struct msm_isp_buf_mgr *buf_mgr,

		kfree(bufq->bufs);
		msm_isp_free_buf_handle(buf_mgr, bufq_handle);
		mutex_unlock(&buf_mgr->lock);
		return 0;
		}

		@@ -1270,6 +1287,7 @@ int msm_isp_create_isp_buf_mgr(
		buf_mgr->secure_enable = NON_SECURE_MODE;
		buf_mgr->attach_state = MSM_ISP_BUF_MGR_DETACH;
		mutex_init(&buf_mgr->lock);
		spin_lock_init(&buf_mgr->bufq_list_lock);

		for (i = 0; i < MAX_PROTECTION_MODE; i++)
		for (j = 0; j < MAX_IOMMU_CTX; j++)

drivers/media/platform/msm/camera_v2/isp/msm_buf_mgr.h

+1 −0

Original line number	Diff line number	Diff line
		@@ -183,6 +183,7 @@ struct msm_isp_buf_mgr {
		int num_iommu_ctx;
		struct device *iommu_ctx[2];
		struct list_head buffer_q;
		spinlock_t bufq_list_lock;
		int num_iommu_secure_ctx;
		struct device *iommu_secure_ctx[2];
		int attach_ref_cnt[MAX_PROTECTION_MODE][MAX_IOMMU_CTX];