Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 65652c2a authored by qctecmdr's avatar qctecmdr Committed by Gerrit - the friendly Code Review server
Browse files

Merge "msm: npu: Fix OOB issue in IPC between driver and firmware"

parents 17bda50f 8cc17628

drivers/media/platform/msm/npu/npu_common.h

+0 −6
Original line number Diff line number Diff line
@@ -109,12 +109,6 @@ struct npu_debugfs_ctx { 
	struct dentry *root;

	uint32_t reg_off;

	uint32_t reg_cnt;

	uint8_t *log_buf;

	struct mutex log_lock;

	uint32_t log_num_bytes_buffered;

	uint32_t log_read_index;

	uint32_t log_write_index;

	uint32_t log_buf_size;

};



struct npu_debugfs_reg_ctx {

drivers/media/platform/msm/npu/npu_debugfs.c

+0 −78
Original line number Diff line number Diff line
@@ -13,12 +13,6 @@ 
#include "npu_hw_access.h"

#include "npu_common.h"



/* -------------------------------------------------------------------------

 * Defines

 * -------------------------------------------------------------------------

 */

#define NPU_LOG_BUF_SIZE 4096



/* -------------------------------------------------------------------------

 * Function Prototypes

 * -------------------------------------------------------------------------
@@ -33,8 +27,6 @@ static ssize_t npu_debug_off_write(struct file *file, 
		const char __user *user_buf, size_t count, loff_t *ppos);

static ssize_t npu_debug_off_read(struct file *file,

		char __user *user_buf, size_t count, loff_t *ppos);

static ssize_t npu_debug_log_read(struct file *file,

		char __user *user_buf, size_t count, loff_t *ppos);

static ssize_t npu_debug_ctrl_write(struct file *file,

		const char __user *user_buf, size_t count, loff_t *ppos);
@@ -57,13 +49,6 @@ static const struct file_operations npu_off_fops = { 
	.write = npu_debug_off_write,

};



static const struct file_operations npu_log_fops = {

	.open = npu_debug_open,

	.release = npu_debug_release,

	.read = npu_debug_log_read,

	.write = NULL,

};



static const struct file_operations npu_ctrl_fops = {

	.open = npu_debug_open,

	.release = npu_debug_release,
@@ -248,48 +233,6 @@ static ssize_t npu_debug_off_read(struct file *file, 
	return len;

}



/* -------------------------------------------------------------------------

 * Function Implementations - DebugFS Log

 * -------------------------------------------------------------------------

 */

static ssize_t npu_debug_log_read(struct file *file,

			char __user *user_buf, size_t count, loff_t *ppos)

{

	size_t len = 0;

	struct npu_device *npu_dev = file->private_data;

	struct npu_debugfs_ctx *debugfs;



	NPU_DBG("npu_dev %pK %pK\n", npu_dev, g_npu_dev);

	npu_dev = g_npu_dev;

	debugfs = &npu_dev->debugfs_ctx;



	/* mutex log lock */

	mutex_lock(&debugfs->log_lock);



	if (debugfs->log_num_bytes_buffered != 0) {

		len = min(debugfs->log_num_bytes_buffered,

			debugfs->log_buf_size - debugfs->log_read_index);

		len = min(count, len);

		if (copy_to_user(user_buf, (debugfs->log_buf +

			debugfs->log_read_index), len)) {

			NPU_ERR("failed to copy to user\n");

			mutex_unlock(&debugfs->log_lock);

			return -EFAULT;

		}

		debugfs->log_read_index += len;

		if (debugfs->log_read_index == debugfs->log_buf_size)

			debugfs->log_read_index = 0;



		debugfs->log_num_bytes_buffered -= len;

		*ppos += len;

	}



	/* mutex log unlock */

	mutex_unlock(&debugfs->log_lock);



	return len;

}



/* -------------------------------------------------------------------------

 * Function Implementations - DebugFS Control

 * -------------------------------------------------------------------------
@@ -373,12 +316,6 @@ int npu_debugfs_init(struct npu_device *npu_dev) 
		goto err;

	}



	if (!debugfs_create_file("log", 0644, debugfs->root,

		npu_dev, &npu_log_fops)) {

		NPU_ERR("debugfs_create_file log fail\n");

		goto err;

	}



	if (!debugfs_create_file("ctrl", 0644, debugfs->root,

		npu_dev, &npu_ctrl_fops)) {

		NPU_ERR("debugfs_create_file ctrl fail\n");
@@ -421,15 +358,6 @@ int npu_debugfs_init(struct npu_device *npu_dev) 
		goto err;

	}



	debugfs->log_num_bytes_buffered = 0;

	debugfs->log_read_index = 0;

	debugfs->log_write_index = 0;

	debugfs->log_buf_size = NPU_LOG_BUF_SIZE;

	debugfs->log_buf = kzalloc(debugfs->log_buf_size, GFP_KERNEL);

	if (!debugfs->log_buf)

		goto err;

	mutex_init(&debugfs->log_lock);



	return 0;



err:
@@ -441,12 +369,6 @@ void npu_debugfs_deinit(struct npu_device *npu_dev) 
{

	struct npu_debugfs_ctx *debugfs = &npu_dev->debugfs_ctx;



	debugfs->log_num_bytes_buffered = 0;

	debugfs->log_read_index = 0;

	debugfs->log_write_index = 0;

	debugfs->log_buf_size = 0;

	kfree(debugfs->log_buf);



	if (!IS_ERR_OR_NULL(debugfs->root)) {

		debugfs_remove_recursive(debugfs->root);

		debugfs->root = NULL;

drivers/media/platform/msm/npu/npu_host_ipc.c

+33 −7
Original line number Diff line number Diff line
@@ -31,15 +31,16 @@ 
struct npu_queue_tuple {

	uint32_t size;

	uint32_t hdr;

	uint32_t start_offset;

};



static const struct npu_queue_tuple npu_q_setup[6] = {

	{ 1024, IPC_QUEUE_CMD_HIGH_PRIORITY | TX_HDR_TYPE | RX_HDR_TYPE },

	{ 4096, IPC_QUEUE_APPS_EXEC         | TX_HDR_TYPE | RX_HDR_TYPE },

	{ 4096, IPC_QUEUE_DSP_EXEC          | TX_HDR_TYPE | RX_HDR_TYPE },

	{ 4096, IPC_QUEUE_APPS_RSP          | TX_HDR_TYPE | RX_HDR_TYPE },

	{ 4096, IPC_QUEUE_DSP_RSP           | TX_HDR_TYPE | RX_HDR_TYPE },

	{ 1024, IPC_QUEUE_LOG               | TX_HDR_TYPE | RX_HDR_TYPE },

static struct npu_queue_tuple npu_q_setup[6] = {

	{ 1024, IPC_QUEUE_CMD_HIGH_PRIORITY | TX_HDR_TYPE | RX_HDR_TYPE, 0},

	{ 4096, IPC_QUEUE_APPS_EXEC         | TX_HDR_TYPE | RX_HDR_TYPE, 0},

	{ 4096, IPC_QUEUE_DSP_EXEC          | TX_HDR_TYPE | RX_HDR_TYPE, 0},

	{ 4096, IPC_QUEUE_APPS_RSP          | TX_HDR_TYPE | RX_HDR_TYPE, 0},

	{ 4096, IPC_QUEUE_DSP_RSP           | TX_HDR_TYPE | RX_HDR_TYPE, 0},

	{ 1024, IPC_QUEUE_LOG               | TX_HDR_TYPE | RX_HDR_TYPE, 0},

};



/* -------------------------------------------------------------------------
@@ -111,6 +112,7 @@ static int npu_host_ipc_init_hfi(struct npu_device *npu_dev) 
		/* queue is active */

		q_hdr->qhdr_status = 0x01;

		q_hdr->qhdr_start_offset = cur_start_offset;

		npu_q_setup[q_idx].start_offset = cur_start_offset;

		q_size = npu_q_setup[q_idx].size;

		q_hdr->qhdr_type = npu_q_setup[q_idx].hdr;

		/* in bytes */
@@ -217,6 +219,18 @@ static int ipc_queue_read(struct npu_device *npu_dev, 
	/* Read the queue */

	MEMR(npu_dev, (void *)((size_t)offset), (uint8_t *)&queue,

		HFI_QUEUE_HEADER_SIZE);



	if (queue.qhdr_type != npu_q_setup[target_que].hdr ||

		queue.qhdr_q_size != npu_q_setup[target_que].size ||

		queue.qhdr_read_idx >= queue.qhdr_q_size ||

		queue.qhdr_write_idx >= queue.qhdr_q_size ||

		queue.qhdr_start_offset !=

			npu_q_setup[target_que].start_offset) {

		NPU_ERR("Invalid Queue header\n");

		status = -EIO;

		goto exit;

	}



	/* check if queue is empty */

	if (queue.qhdr_read_idx == queue.qhdr_write_idx) {

		/*
@@ -314,6 +328,18 @@ static int ipc_queue_write(struct npu_device *npu_dev, 


	MEMR(npu_dev, (void *)((size_t)offset), (uint8_t *)&queue,

		HFI_QUEUE_HEADER_SIZE);



	if (queue.qhdr_type != npu_q_setup[target_que].hdr ||

		queue.qhdr_q_size != npu_q_setup[target_que].size ||

		queue.qhdr_read_idx >= queue.qhdr_q_size ||

		queue.qhdr_write_idx >= queue.qhdr_q_size ||

		queue.qhdr_start_offset !=

			npu_q_setup[target_que].start_offset) {

		NPU_ERR("Invalid Queue header\n");

		status = -EIO;

		goto exit;

	}



	packet_size = (*(uint32_t *)packet);

	if (packet_size == 0) {

		/* assign failed status and return */

drivers/media/platform/msm/npu/npu_hw_access.c

+0 −47
Original line number Diff line number Diff line
@@ -430,50 +430,3 @@ void subsystem_put_local(void *sub_system_handle) 
{

	return subsystem_put(sub_system_handle);

}
 


/* -------------------------------------------------------------------------

 * Functions - Log

 * -------------------------------------------------------------------------

 */

void npu_process_log_message(struct npu_device *npu_dev, uint32_t *message,

	uint32_t size)

{

	struct npu_debugfs_ctx *debugfs = &npu_dev->debugfs_ctx;



	/* mutex log lock */

	mutex_lock(&debugfs->log_lock);



	if ((debugfs->log_num_bytes_buffered + size) >

		debugfs->log_buf_size) {

		/* No more space, invalidate it all and start over */

		debugfs->log_read_index = 0;

		debugfs->log_write_index = size;

		debugfs->log_num_bytes_buffered = size;

		memcpy(debugfs->log_buf, message, size);

	} else {

		if ((debugfs->log_write_index + size) >

			debugfs->log_buf_size) {

			/* Wrap around case */

			uint8_t *src_addr = (uint8_t *)message;

			uint8_t *dst_addr = 0;

			uint32_t remaining_to_end = debugfs->log_buf_size -

				debugfs->log_write_index + 1;

			dst_addr = debugfs->log_buf + debugfs->log_write_index;

			memcpy(dst_addr, src_addr, remaining_to_end);

			src_addr = &(src_addr[remaining_to_end]);

			dst_addr = debugfs->log_buf;

			memcpy(dst_addr, src_addr, size-remaining_to_end);

			debugfs->log_write_index = size-remaining_to_end;

		} else {

			memcpy((debugfs->log_buf + debugfs->log_write_index),

				message, size);

			debugfs->log_write_index += size;

			if (debugfs->log_write_index == debugfs->log_buf_size)

				debugfs->log_write_index = 0;

		}

		debugfs->log_num_bytes_buffered += size;

	}



	/* mutex log unlock */

	mutex_unlock(&debugfs->log_lock);

}

drivers/media/platform/msm/npu/npu_hw_access.h

+0 −3
Original line number Diff line number Diff line
@@ -86,7 +86,4 @@ void npu_disable_sys_cache(struct npu_device *npu_dev); 
void *subsystem_get_local(char *sub_system);

void subsystem_put_local(void *sub_system_handle);



void npu_process_log_message(struct npu_device *npu_dev, uint32_t *msg,

	uint32_t size);



#endif /* _NPU_HW_ACCESS_H*/