Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 1f37105b authored by Tharun Kumar Merugu's avatar Tharun Kumar Merugu
Browse files

msm: ADSPRPC: Use ID in response to get context pointer 



Send context ID in rpc header instead of context pointer.
Validate context ID received in response and get context pointer.

Change-Id: I9cfd10d0c1b25c3085b8e15c7ca1c8ff214bf10d
Acked-by: default avatarViswanatham Paduchuri <vpaduchu@qti.qualcomm.com>
Signed-off-by: default avatarTharun Kumar Merugu <mtharu@codeaurora.org>
parent 353582cf

drivers/char/adsprpc.c

+50 −6
Original line number Diff line number Diff line
@@ -67,6 +67,8 @@ 
#define M_CRCLIST	(64)

#define SESSION_ID_INDEX (30)

#define FASTRPC_CTX_MAGIC (0xbeeddeed)

#define FASTRPC_CTX_MAX (256)

#define FASTRPC_CTXID_MASK (0xFF0)



#define IS_CACHE_ALIGNED(x) (((x) & ((L1_CACHE_BYTES)-1)) == 0)

#ifndef ION_FLAG_CACHED
@@ -199,6 +201,7 @@ struct smq_invoke_ctx { 
	struct smq_msg msg;

	uint32_t *crc;

	unsigned int magic;

	uint64_t ctxid;

};



struct fastrpc_ctx_lst {
@@ -258,6 +261,8 @@ struct fastrpc_apps { 
	struct device *dev;

	unsigned int latency;

	int rpmsg_register;

	spinlock_t ctxlock;

	struct smq_invoke_ctx *ctxtable[FASTRPC_CTX_MAX];

};



struct fastrpc_mmap {
@@ -961,7 +966,8 @@ static int context_alloc(struct fastrpc_file *fl, uint32_t kernel, 
			 struct fastrpc_ioctl_invoke_crc *invokefd,

			 struct smq_invoke_ctx **po)

{

	int err = 0, bufs, size = 0;

	struct fastrpc_apps *me = &gfa;

	int err = 0, bufs, ii, size = 0;

	struct smq_invoke_ctx *ctx = NULL;

	struct fastrpc_ctx_lst *clst = &fl->clst;

	struct fastrpc_ioctl_invoke *invoke = &invokefd->inv;
@@ -1021,6 +1027,21 @@ static int context_alloc(struct fastrpc_file *fl, uint32_t kernel, 
	hlist_add_head(&ctx->hn, &clst->pending);

	spin_unlock(&fl->hlock);



	spin_lock(&me->ctxlock);

	for (ii = 0; ii < FASTRPC_CTX_MAX; ii++) {

		if (!me->ctxtable[ii]) {

			me->ctxtable[ii] = ctx;

			ctx->ctxid = (ptr_to_uint64(ctx) & ~0xFFF)|(ii << 4);

			break;

		}

	}

	spin_unlock(&me->ctxlock);

	VERIFY(err, ii < FASTRPC_CTX_MAX);

	if (err) {

		pr_err("adsprpc: out of context memory\n");

		goto bail;

	}



	*po = ctx;

bail:

	if (ctx && err)
@@ -1043,6 +1064,7 @@ static void context_save_interrupted(struct smq_invoke_ctx *ctx) 
static void context_free(struct smq_invoke_ctx *ctx)

{

	int i;

	struct fastrpc_apps *me = &gfa;

	int nbufs = REMOTE_SCALARS_INBUFS(ctx->sc) +

		    REMOTE_SCALARS_OUTBUFS(ctx->sc);

	spin_lock(&ctx->fl->hlock);
@@ -1052,6 +1074,17 @@ static void context_free(struct smq_invoke_ctx *ctx) 
		fastrpc_mmap_free(ctx->maps[i], 0);

	fastrpc_buf_free(ctx->buf, 1);

	ctx->magic = 0;

	ctx->ctxid = 0;



	spin_lock(&me->ctxlock);

	for (i = 0; i < FASTRPC_CTX_MAX; i++) {

		if (me->ctxtable[i] == ctx) {

			me->ctxtable[i] = NULL;

			break;

		}

	}

	spin_unlock(&me->ctxlock);



	kfree(ctx);

}
@@ -1516,7 +1549,7 @@ static int fastrpc_invoke_send(struct smq_invoke_ctx *ctx, 
		msg->tid |= (1 << SESSION_ID_INDEX);

	if (kernel)

		msg->pid = 0;

	msg->invoke.header.ctx = ptr_to_uint64(ctx) | fl->pd;

	msg->invoke.header.ctx = ctx->ctxid | fl->pd;

	msg->invoke.header.handle = handle;

	msg->invoke.header.sc = ctx->sc;

	msg->invoke.page.addr = ctx->buf ? ctx->buf->phys : 0;
@@ -1543,6 +1576,7 @@ static void fastrpc_init(struct fastrpc_apps *me) 
	INIT_HLIST_HEAD(&me->drivers);

	INIT_HLIST_HEAD(&me->maps);

	spin_lock_init(&me->hlock);

	spin_lock_init(&me->ctxlock);

	mutex_init(&me->smd_mutex);

	me->channel = &gcinfo[0];

	for (i = 0; i < NUM_CHANNELS; i++) {
@@ -2288,19 +2322,29 @@ static int fastrpc_rpmsg_callback(struct rpmsg_device *rpdev, void *data, 
	int len, void *priv, u32 addr)

{

	struct smq_invoke_rsp *rsp = (struct smq_invoke_rsp *)data;

	struct smq_invoke_ctx *ctx;

	struct fastrpc_apps *me = &gfa;

	uint32_t index;

	int err = 0;



	VERIFY(err, (rsp && len >= sizeof(*rsp)));

	if (err)

		goto bail;



	ctx = (struct smq_invoke_ctx *)(uint64_to_ptr(rsp->ctx & ~1));

	VERIFY(err, (ctx && ctx->magic == FASTRPC_CTX_MAGIC));

	index = (uint32_t)((rsp->ctx & FASTRPC_CTXID_MASK) >> 4);

	VERIFY(err, index < FASTRPC_CTX_MAX);

	if (err)

		goto bail;



	VERIFY(err, !IS_ERR_OR_NULL(me->ctxtable[index]));

	if (err)

		goto bail;



	VERIFY(err, ((me->ctxtable[index]->ctxid == (rsp->ctx & ~1)) &&

		me->ctxtable[index]->magic == FASTRPC_CTX_MAGIC));

	if (err)

		goto bail;



	context_notify_user(ctx, rsp->retval);

	context_notify_user(me->ctxtable[index], rsp->retval);

bail:

	if (err)

		pr_err("adsprpc: invalid response or context\n");