evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

msm: mdss: fix secure buffer ref counting

Browse source 
Fix ref counting of the secure buffers. This change releases
the ref count on the secure buffers during the free operation.
This allows the buffers to be ref counted until hw has done
fetching from the buffers.

CRs-Fixed: 2012323
Change-Id: Ic24c39e75d502ed73453d0c6d78fd76448737697
Signed-off-by: Abhijit Kulkarni <kabhijit@codeaurora.org>
This commit is contained in:
Abhijit Kulkarni 2017-02-21 21:58:50 -08:00
parent 3bf75ddd22
commit 06b20b52e8
4 changed files with 36 additions and 19 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
drivers/media/platform/msm/sde/rotator/sde_rotator_dev.c
View file

@ -535,6 +535,7 @@ static void *sde_rotator_get_userptr(void *alloc_ctx,
buf->ctx = ctx;
buf->rot_dev = rot_dev;
if (ctx->secure_camera) {
buf->buffer = NULL;
buf->handle = ion_import_dma_buf(iclient,
buf->fd);
if (IS_ERR_OR_NULL(buf->handle)) {
@ -548,6 +549,7 @@ static void *sde_rotator_get_userptr(void *alloc_ctx,
buf->ctx->session_id,
buf->fd, &buf->handle);
} else {
buf->handle = NULL;
buf->buffer = dma_buf_get(buf->fd);
if (IS_ERR_OR_NULL(buf->buffer)) {
SDEDEV_ERR(rot_dev->dev,
@ -574,6 +576,8 @@ error_buf_get:
static void sde_rotator_put_userptr(void *buf_priv)
{
struct sde_rotator_buf_handle *buf = buf_priv;
struct ion_client *iclient;
struct sde_rotator_device *rot_dev;
if (IS_ERR_OR_NULL(buf))
return;
@ -584,6 +588,9 @@ static void sde_rotator_put_userptr(void *buf_priv)
return;
}
rot_dev = buf->ctx->rot_dev;
iclient = buf->rot_dev->mdata->iclient;
SDEDEV_DBG(buf->rot_dev->dev, "put dmabuf s:%d fd:%d buf:%pad\n",
buf->ctx->session_id,
buf->fd, &buf->buffer);
@ -593,6 +600,11 @@ static void sde_rotator_put_userptr(void *buf_priv)
buf->buffer = NULL;
}
if (buf->handle) {
ion_free(iclient, buf->handle);
buf->handle = NULL;
}
kfree(buf_priv);
}

15
drivers/media/platform/msm/sde/rotator/sde_rotator_util.c
View file

@ -768,10 +768,17 @@ static int sde_mdp_get_img(struct sde_fb_data *img,
len = &data->len;
data->flags |= img->flags;
data->offset = img->offset;
if (data->flags & SDE_ROT_EXT_DMA_BUF)
if ((data->flags & SDE_SECURE_CAMERA_SESSION) &&
IS_ERR_OR_NULL(img->handle)) {
SDEROT_ERR("error on ion_import_fb\n");
ret = PTR_ERR(img->handle);
img->handle = NULL;
return ret;
} else if (data->flags & SDE_ROT_EXT_DMA_BUF) {
data->srcp_dma_buf = img->buffer;
else if (IS_ERR(data->srcp_dma_buf)) {
SDEROT_ERR("error on ion_import_fd\n");
} else if (IS_ERR(data->srcp_dma_buf)) {
SDEROT_ERR("error on dma_buf\n");
ret = PTR_ERR(data->srcp_dma_buf);
data->srcp_dma_buf = NULL;
return ret;
@ -845,8 +852,6 @@ static int sde_mdp_get_img(struct sde_fb_data *img,
ret = 0;
} while (0);
if (!IS_ERR_OR_NULL(ihandle))
ion_free(iclient, ihandle);
return ret;
}

1
drivers/video/fbdev/msm/mdss_mdp.h
View file

@ -650,6 +650,7 @@ struct mdss_mdp_img_data {
struct dma_buf *srcp_dma_buf;
struct dma_buf_attachment *srcp_attachment;
struct sg_table *srcp_table;
struct ion_handle *ihandle;
};
enum mdss_mdp_data_state {

27
drivers/video/fbdev/msm/mdss_mdp_util.c
View file

@ -1,4 +1,4 @@
/* Copyright (c) 2012-2016, The Linux Foundation. All rights reserved.
/* Copyright (c) 2012-2017, The Linux Foundation. All rights reserved.
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License version 2 and
@ -974,7 +974,9 @@ static int mdss_mdp_put_img(struct mdss_mdp_img_data *data, bool rotator,
* be filled due to map call which will be unmapped above.
*
*/
pr_debug("skip memory unmapping for secure display/camera content\n");
if (data->ihandle)
ion_free(iclient, data->ihandle);
pr_debug("free memory handle for secure display/camera content\n");
} else {
return -ENOMEM;
}
@ -1053,19 +1055,18 @@ static int mdss_mdp_get_img(struct msmfb_data *img,
ret = 0;
goto done;
} else {
struct ion_handle *ihandle = NULL;
struct sg_table *sg_ptr = NULL;
data->ihandle = ion_import_dma_buf(iclient,
img->memory_id);
if (IS_ERR_OR_NULL(data->ihandle)) {
ret = -EINVAL;
pr_err("ion import buffer failed\n");
data->ihandle = NULL;
goto done;
}
do {
ihandle = ion_import_dma_buf(iclient,
img->memory_id);
if (IS_ERR_OR_NULL(ihandle)) {
ret = -EINVAL;
pr_err("ion import buffer failed\n");
break;
}
sg_ptr = ion_sg_table(iclient, ihandle);
sg_ptr = ion_sg_table(iclient, data->ihandle);
if (sg_ptr == NULL) {
pr_err("ion sg table get failed\n");
ret = -EINVAL;
@ -1091,8 +1092,6 @@ static int mdss_mdp_get_img(struct msmfb_data *img,
ret = 0;
} while (0);
if (!IS_ERR_OR_NULL(ihandle))
ion_free(iclient, ihandle);
return ret;
}
}