Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 83f8f704 authored by Dinesh K Garg's avatar Dinesh K Garg
Browse files

msm: mink: fixing issues in local obj handling 



There were several issues found in handling of local objects.
Fixing those issues.

Change-Id: I1e3413f6b75df4495cadc990470bc926f139fb16
Signed-off-by: default avatarDinesh K Garg <dineshg@codeaurora.org>
parent 67c680c0

drivers/soc/qcom/smcinvoke.c

+34 −41
Original line number Diff line number Diff line 
/*

 * SMC Invoke driver

 *

 * Copyright (c) 2016-2018, The Linux Foundation. All rights reserved.

 * Copyright (c) 2016-2019, The Linux Foundation. All rights reserved.

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License version 2 and
@@ -134,6 +134,10 @@ 
#define FILE_IS_REMOTE_OBJ(f) ((f)->f_op && (f)->f_op == &g_smcinvoke_fops)



static DEFINE_MUTEX(g_smcinvoke_lock);

#define NO_LOCK 0

#define TAKE_LOCK 1

#define MUTEX_LOCK(x) { if (x) mutex_lock(&g_smcinvoke_lock); }

#define MUTEX_UNLOCK(x) { if (x) mutex_unlock(&g_smcinvoke_lock); }

static DEFINE_HASHTABLE(g_cb_servers, 8);

static LIST_HEAD(g_mem_objs);

static uint16_t g_last_cb_server_id = CBOBJ_SERVER_ID_START;
@@ -143,6 +147,7 @@ static size_t g_max_cb_buf_size = SMCINVOKE_TZ_MIN_BUF_SIZE; 
static long smcinvoke_ioctl(struct file *, unsigned int, unsigned long);

static int smcinvoke_open(struct inode *, struct file *);

static int smcinvoke_release(struct inode *, struct file *);

static int destroy_cb_server(uint16_t);



static const struct file_operations g_smcinvoke_fops = {

	.owner		= THIS_MODULE,
@@ -280,10 +285,8 @@ static struct smcinvoke_mem_obj *find_mem_obj_locked(uint16_t mem_obj_id, 
{

	struct smcinvoke_mem_obj *mem_obj = NULL;



	if (list_empty(&g_mem_objs)) {

		pr_err("%s: mem obj %d not found\n", __func__, mem_obj_id);

	if (list_empty(&g_mem_objs))

		return NULL;

	}



	list_for_each_entry(mem_obj, &g_mem_objs, list) {

		if ((is_mem_rgn_obj &&
@@ -379,9 +382,11 @@ static void free_pending_cbobj_locked(struct kref *kref) 
	server = obj->server;

	kfree(obj);

	if ((server->state == SMCINVOKE_SERVER_STATE_DEFUNCT) &&

				list_empty(&server->pending_cbobjs))

				list_empty(&server->pending_cbobjs)) {

		hash_del(&server->hash);

		kfree(server);

	}

}



static int get_pending_cbobj_locked(uint16_t srvr_id, int16_t obj_id)

{
@@ -618,10 +623,6 @@ static int get_tzhandle_from_uhandle(int32_t uhandle, int32_t server_fd, 
		}

	}

out:

	if (ret && *filp) {

		fput(*filp);

		*filp = NULL;

	}

	return ret;

}
@@ -669,7 +670,7 @@ static int get_fd_for_obj(uint32_t obj_type, uint32_t obj, int64_t *fd) 
}



static int get_uhandle_from_tzhandle(int32_t tzhandle, int32_t srvr_id,

						int64_t *uhandle)

				int64_t *uhandle, bool lock)

{

	int ret = -1;
@@ -680,14 +681,14 @@ static int get_uhandle_from_tzhandle(int32_t tzhandle, int32_t srvr_id, 
		if (srvr_id != TZHANDLE_GET_SERVER(tzhandle))

			goto out;

		*uhandle = UHANDLE_MAKE_CB_OBJ(TZHANDLE_GET_OBJID(tzhandle));

		mutex_lock(&g_smcinvoke_lock);

		ret = get_pending_cbobj_locked(srvr_id,

		MUTEX_LOCK(lock)

		ret = get_pending_cbobj_locked(TZHANDLE_GET_SERVER(tzhandle),

						TZHANDLE_GET_OBJID(tzhandle));

		mutex_unlock(&g_smcinvoke_lock);

		MUTEX_UNLOCK(lock)

	} else if (TZHANDLE_IS_MEM_RGN_OBJ(tzhandle)) {

		struct smcinvoke_mem_obj *mem_obj =  NULL;



		mutex_lock(&g_smcinvoke_lock);

		MUTEX_LOCK(lock)

		mem_obj = find_mem_obj_locked(TZHANDLE_GET_OBJID(tzhandle),

						SMCINVOKE_MEM_RGN_OBJ);
@@ -705,7 +706,7 @@ static int get_uhandle_from_tzhandle(int32_t tzhandle, int32_t srvr_id, 
			ret = 0;

		}

exit_lock:

		mutex_unlock(&g_smcinvoke_lock);

		MUTEX_UNLOCK(lock)

	} else if (TZHANDLE_IS_REMOTE(tzhandle)) {

		/* if execution comes here => tzhandle is an unsigned int */

		ret = get_fd_for_obj(SMCINVOKE_OBJ_TYPE_TZ_OBJ,
@@ -882,9 +883,7 @@ static void process_tzcb_req(void *buf, size_t buf_len, struct file **arr_filp) 
		    srvr_info->state == SMCINVOKE_SERVER_STATE_DEFUNCT &&

		    OBJECT_OP_METHODID(cb_req->hdr.op) == OBJECT_OP_RELEASE) {

			mutex_lock(&g_smcinvoke_lock);

			put_pending_cbobj_locked(

				TZHANDLE_GET_SERVER(cb_req->hdr.tzhandle),

				TZHANDLE_GET_OBJID(cb_req->hdr.tzhandle));

			release_tzhandle_locked(cb_req->hdr.tzhandle);

			mutex_unlock(&g_smcinvoke_lock);

		}

	}
@@ -937,7 +936,8 @@ static int marshal_out_invoke_req(const uint8_t *buf, uint32_t buf_size, 
		 * to server who serves it and that info comes from USpace.

		 */

		ret = get_uhandle_from_tzhandle(tz_args->handle,

			args_buf[i].o.cb_server_fd, &(args_buf[i].o.fd));

					TZHANDLE_GET_SERVER(tz_args->handle),

					&(args_buf[i].o.fd), NO_LOCK);

		if (ret)

			goto out;

		tz_args++;
@@ -1152,7 +1152,7 @@ static int marshal_in_tzcb_req(const struct smcinvoke_cb_txn *cb_txn, 


	user_req->txn_id = cb_txn->txn_id;

	if (get_uhandle_from_tzhandle(tzcb_req->hdr.tzhandle, srvr_id,

					(int64_t *)&user_req->cbobj_id)) {

				(int64_t *)&user_req->cbobj_id, TAKE_LOCK)) {

		ret = -EINVAL;

		goto out;

	}
@@ -1214,7 +1214,7 @@ static int marshal_in_tzcb_req(const struct smcinvoke_cb_txn *cb_txn, 
		 * context

		 */

		ret = get_uhandle_from_tzhandle(tz_args[i].handle, srvr_id,

							&(tmp_arg.o.fd));

						&(tmp_arg.o.fd), TAKE_LOCK);

		if (ret) {

			ret = -EINVAL;

			goto out;
@@ -1238,10 +1238,8 @@ static int marshal_out_tzcb_req(const struct smcinvoke_accept *user_req, 
	int32_t tzhandles_to_release[OBJECT_COUNTS_MAX_OO] = {0};

	struct smcinvoke_tzcb_req *tzcb_req = cb_txn->cb_req;

	union smcinvoke_tz_args *tz_args = tzcb_req->args;

	put_pending_cbobj_locked(

			TZHANDLE_GET_SERVER(cb_txn->cb_req->hdr.tzhandle),

			TZHANDLE_GET_OBJID(cb_txn->cb_req->hdr.tzhandle));



	release_tzhandles(&cb_txn->cb_req->hdr.tzhandle, 1);

	tzcb_req->result = user_req->result;

	FOR_ARGS(i, tzcb_req->hdr.counts, BO) {

		union smcinvoke_arg tmp_arg;
@@ -1271,18 +1269,16 @@ static int marshal_out_tzcb_req(const struct smcinvoke_accept *user_req, 
			ret = -EFAULT;

			goto out;

		}

		ret = get_tzhandle_from_uhandle(tmp_arg.o.fd, 0, &arr_filp[i],

		ret = get_tzhandle_from_uhandle(tmp_arg.o.fd,

				tmp_arg.o.cb_server_fd, &arr_filp[i],

						&(tz_args[i].handle));

		if (ret)

			goto out;

		tzhandles_to_release[i] = tz_args[i].handle;

	}

	FOR_ARGS(i, tzcb_req->hdr.counts, OI) {

		if (TZHANDLE_IS_CB_OBJ(tz_args[i].handle)) {

			put_pending_cbobj_locked(

				TZHANDLE_GET_SERVER(tz_args[i].handle),

				TZHANDLE_GET_OBJID(tz_args[i].handle));

		}

		if (TZHANDLE_IS_CB_OBJ(tz_args[i].handle))

			release_tzhandles(&tz_args[i].handle, 1);

	}

	ret = 0;

out:
@@ -1375,12 +1371,9 @@ static long process_server_req(struct file *filp, unsigned int cmd, 
	ret = get_fd_for_obj(SMCINVOKE_OBJ_TYPE_SERVER,

				server_info->server_id, &server_fd);



	if (ret) {

		mutex_lock(&g_smcinvoke_lock);

		hash_del(&server_info->hash);

		mutex_unlock(&g_smcinvoke_lock);

		kfree(server_info);

	}

	if (ret)

		destroy_cb_server(server_info->server_id);



	return server_fd;

}
@@ -1435,9 +1428,7 @@ static long process_accept_req(struct file *filp, unsigned int cmd, 
			cb_txn->cb_req->result = OBJECT_ERROR_UNAVAIL;



		if (OBJECT_OP_METHODID(user_args.op) == OBJECT_OP_RELEASE)

			put_pending_cbobj_locked(

			    TZHANDLE_GET_SERVER(cb_txn->cb_req->hdr.tzhandle),

			    TZHANDLE_GET_OBJID(cb_txn->cb_req->hdr.tzhandle));

			release_tzhandles(&cb_txn->cb_req->hdr.tzhandle, 1);



		cb_txn->state = SMCINVOKE_REQ_PROCESSED;

		wake_up(&server_info->rsp_wait_q);
@@ -1455,8 +1446,10 @@ static long process_accept_req(struct file *filp, unsigned int cmd, 
	do {

		ret = wait_event_interruptible(server_info->req_wait_q,

				!hash_empty(server_info->reqs_table));

		if (ret)

		if (ret) {

			destroy_cb_server(server_obj->server_id);

			goto out;

		}



		mutex_lock(&g_smcinvoke_lock);

		cb_txn = find_cbtxn_locked(server_info,