Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d8681082 authored by Meng Wang's avatar Meng Wang Committed by Gerrit - the friendly Code Review server
Browse files

ASoC: msm: qdspv2: add spin lock to protect ac 



ac could get freed during the execution of q6asm_callback.
And kernel panic happens. Add spinlock to protect ac to avoid
kernel panic.

Change-Id: Ie49c8a3979231552ba7d5f207aab0d95ffdc2a72
Signed-off-by: default avatarMeng Wang <mwang@codeaurora.org>
parent f38ea00b

sound/soc/msm/qdsp6v2/q6asm.c

+111 −31
Original line number Diff line number Diff line 
/*

 * Copyright (c) 2012-2017, The Linux Foundation. All rights reserved.

 * Copyright (c) 2012-2018, The Linux Foundation. All rights reserved.

 * Author: Brian Swetland <swetland@google.com>

 *

 * This software is licensed under the terms of the GNU General Public
@@ -60,8 +60,13 @@ struct asm_mmap { 
};



static struct asm_mmap this_mmap;



struct audio_session {

	struct audio_client *ac;

	spinlock_t session_lock;

};

/* session id: 0 reserved */

static struct audio_client *session[SESSION_MAX+1];

static struct audio_session session[SESSION_MAX + 1];



struct asm_no_wait_node {

	struct list_head	list;
@@ -417,9 +422,10 @@ int q6asm_mmap_apr_dereg(void) 
static int q6asm_session_alloc(struct audio_client *ac)

{

	int n;



	for (n = 1; n <= SESSION_MAX; n++) {

		if (!session[n]) {

			session[n] = ac;

		if (!session[n].ac) {

			session[n].ac = ac;

			return n;

		}

	}
@@ -427,28 +433,40 @@ static int q6asm_session_alloc(struct audio_client *ac) 
	return -ENOMEM;

}



static bool q6asm_is_valid_audio_client(struct audio_client *ac)

static unsigned int q6asm_get_session_id_from_audio_client(

			struct audio_client *ac)

{

	int n;

	unsigned int n;



	for (n = 1; n <= SESSION_MAX; n++) {

		if (session[n] == ac)

			return 1;

		if (session[n].ac == ac)

			return n;

	}

	return 0;

}



static bool q6asm_is_valid_audio_client(struct audio_client *ac)

{

	return q6asm_get_session_id_from_audio_client(ac) ? 1 : 0;

}



static void q6asm_session_free(struct audio_client *ac)

{

	struct list_head		*ptr, *next;

	struct asm_no_wait_node		*node;

	unsigned long			flags;

	int session_id;



	pr_debug("%s: sessionid[%d]\n", __func__, ac->session);

	session_id = ac->session;

	rtac_remove_popp_from_adm_devices(ac->session);

	session[ac->session] = 0;

	spin_lock_irqsave(&(session[session_id].session_lock), flags);

	session[ac->session].ac = NULL;

	ac->session = 0;

	ac->perf_mode = LEGACY_PCM_MODE;

	ac->fptr_cache_ops = NULL;

	ac->cb = NULL;

	ac->priv = NULL;



	spin_lock_irqsave(&ac->no_wait_que_spinlock, flags);

	list_for_each_safe(ptr, next, &ac->no_wait_que) {
@@ -457,6 +475,9 @@ static void q6asm_session_free(struct audio_client *ac) 
		kfree(node);

	}

	spin_unlock_irqrestore(&ac->no_wait_que_spinlock, flags);



	kfree(ac);

	spin_unlock_irqrestore(&(session[session_id].session_lock), flags);

	return;

}
@@ -1015,8 +1036,6 @@ void q6asm_audio_client_free(struct audio_client *ac) 
	pr_debug("%s: APR De-Register\n", __func__);



/*done:*/

	kfree(ac);

	ac = NULL;

	mutex_unlock(&session_lock);



	return;
@@ -1085,6 +1104,7 @@ struct audio_client *q6asm_audio_client_alloc(app_cb cb, void *priv) 
	if (n <= 0) {

		pr_err("%s: ASM Session alloc fail n=%d\n", __func__, n);

		mutex_unlock(&session_lock);

		kfree(ac);

		goto fail_session;

	}

	ac->session = n;
@@ -1164,7 +1184,6 @@ fail_apr2: 
fail_apr1:

	q6asm_session_free(ac);

fail_session:

	kfree(ac);

	return NULL;

}
@@ -1179,11 +1198,11 @@ struct audio_client *q6asm_get_audio_client(int session_id) 
		goto err;

	}



	if (!session[session_id]) {

	if (!(session[session_id].ac)) {

		pr_err("%s: session not active: %d\n", __func__, session_id);

		goto err;

	}

	return session[session_id];

	return session[session_id].ac;

err:

	return NULL;

}
@@ -1388,6 +1407,7 @@ static int32_t q6asm_srvc_callback(struct apr_client_data *data, void *priv) 
	uint32_t i = IN;

	uint32_t *payload;

	unsigned long dsp_flags;

	unsigned long flags;

	struct asm_buffer_node *buf_node = NULL;

	struct list_head *ptr, *next;
@@ -1436,9 +1456,16 @@ static int32_t q6asm_srvc_callback(struct apr_client_data *data, void *priv) 
		return 0;

	}

	sid = (data->token >> 8) & 0x0F;

	if ((sid > 0 && sid <= SESSION_MAX))

		spin_lock_irqsave(&(session[sid].session_lock), flags);



	ac = q6asm_get_audio_client(sid);

	if (!ac) {

		pr_debug("%s: session[%d] already freed\n", __func__, sid);

		if ((sid > 0 &&

			sid <= SESSION_MAX))

			spin_unlock_irqrestore(

				&(session[sid].session_lock), flags);

		return 0;

	}
@@ -1488,6 +1515,10 @@ static int32_t q6asm_srvc_callback(struct apr_client_data *data, void *priv) 
						__func__, payload[0]);

			break;

		}

		if ((sid > 0 &&

			sid <= SESSION_MAX))

			spin_unlock_irqrestore(

				&(session[sid].session_lock), flags);

		return 0;

	}
@@ -1523,6 +1554,10 @@ static int32_t q6asm_srvc_callback(struct apr_client_data *data, void *priv) 
	if (ac->cb)

		ac->cb(data->opcode, data->token,

			data->payload, ac->priv);

	if ((sid > 0 && sid <= SESSION_MAX))

		spin_unlock_irqrestore(

			&(session[sid].session_lock), flags);



	return 0;

}
@@ -1601,7 +1636,8 @@ static int32_t q6asm_callback(struct apr_client_data *data, void *priv) 
	uint32_t *payload;

	uint32_t wakeup_flag = 1;

	int32_t  ret = 0;



	unsigned long flags;

	int session_id;



	if (ac == NULL) {

		pr_err("%s: ac NULL\n", __func__);
@@ -1611,15 +1647,21 @@ static int32_t q6asm_callback(struct apr_client_data *data, void *priv) 
		pr_err("%s: data NULL\n", __func__);

		return -EINVAL;

	}

	if (!q6asm_is_valid_audio_client(ac)) {

		pr_err("%s: audio client pointer is invalid, ac = %pK\n",

				__func__, ac);



	session_id = q6asm_get_session_id_from_audio_client(ac);

	if (session_id <= 0) {

		pr_err("%s: Session ID is invalid, session = %d\n", __func__,

			session_id);

		return -EINVAL;

	}



	if (ac->session <= 0 || ac->session > 8) {

		pr_err("%s: Session ID is invalid, session = %d\n", __func__,

			ac->session);

	spin_lock_irqsave(&(session[session_id].session_lock), flags);



	if (!q6asm_is_valid_audio_client(ac)) {

		pr_err("%s: audio client pointer is invalid, ac = %pK\n",

				__func__, ac);

		spin_unlock_irqrestore(

			&(session[session_id].session_lock), flags);

		return -EINVAL;

	}
@@ -1634,7 +1676,6 @@ static int32_t q6asm_callback(struct apr_client_data *data, void *priv) 
	}



	if (data->opcode == RESET_EVENTS) {

		mutex_lock(&ac->cmd_lock);

		atomic_set(&ac->reset, 1);

		if (ac->apr == NULL)

			ac->apr = ac->apr2;
@@ -1651,7 +1692,8 @@ static int32_t q6asm_callback(struct apr_client_data *data, void *priv) 
		atomic_set(&ac->cmd_state_pp, 0);

		wake_up(&ac->time_wait);

		wake_up(&ac->cmd_wait);

		mutex_unlock(&ac->cmd_lock);

		spin_unlock_irqrestore(

			&(session[session_id].session_lock), flags);

		return 0;

	}
@@ -1662,9 +1704,16 @@ static int32_t q6asm_callback(struct apr_client_data *data, void *priv) 
		data->dest_port);

	if ((data->opcode != ASM_DATA_EVENT_RENDERED_EOS) &&

	    (data->opcode != ASM_DATA_EVENT_EOS) &&

	    (data->opcode != ASM_SESSION_EVENT_RX_UNDERFLOW))

	    (data->opcode != ASM_SESSION_EVENT_RX_UNDERFLOW)) {

		if (payload == NULL) {

			pr_err("%s: payload is null\n", __func__);

			spin_unlock_irqrestore(

				&(session[session_id].session_lock), flags);

			return -EINVAL;

		}

		dev_vdbg(ac->dev, "%s: Payload = [0x%x] status[0x%x] opcode 0x%x\n",

			__func__, payload[0], payload[1], data->opcode);

	}

	if (data->opcode == APR_BASIC_RSP_RESULT) {

		token = data->token;

		switch (payload[0]) {
@@ -1686,6 +1735,8 @@ static int32_t q6asm_callback(struct apr_client_data *data, void *priv) 
		ret = q6asm_is_valid_session(data, priv);

		if (ret != 0) {

			pr_err("%s: session invalid %d\n", __func__, ret);

			spin_unlock_irqrestore(

				&(session[session_id].session_lock), flags);

			return ret;

		}

		case ASM_SESSION_CMD_SET_MTMX_STRTR_PARAMS_V2:
@@ -1720,6 +1771,9 @@ static int32_t q6asm_callback(struct apr_client_data *data, void *priv) 
								payload[1]);

					wake_up(&ac->cmd_wait);

				}

				spin_unlock_irqrestore(

					&(session[session_id].session_lock),

					flags);

				return 0;

			}

			if (payload[0] == ASM_STREAM_CMD_SET_PP_PARAMS_V2) {
@@ -1749,6 +1803,9 @@ static int32_t q6asm_callback(struct apr_client_data *data, void *priv) 
					atomic_set(&ac->mem_state, payload[1]);

					wake_up(&ac->mem_wait);

				}

				spin_unlock_irqrestore(

					&(session[session_id].session_lock),

					flags);

				return 0;

			}

			if (atomic_read(&ac->mem_state) && wakeup_flag) {
@@ -1785,6 +1842,9 @@ static int32_t q6asm_callback(struct apr_client_data *data, void *priv) 
							__func__, payload[0]);

			break;

		}



		spin_unlock_irqrestore(

			&(session[session_id].session_lock), flags);

		return 0;

	}
@@ -1798,6 +1858,9 @@ static int32_t q6asm_callback(struct apr_client_data *data, void *priv) 
			if (port->buf == NULL) {

				pr_err("%s: Unexpected Write Done\n",

								__func__);

				spin_unlock_irqrestore(

					&(session[session_id].session_lock),

					flags);

				return -EINVAL;

			}

			spin_lock_irqsave(&port->dsp_lock, dsp_flags);
@@ -1811,6 +1874,9 @@ static int32_t q6asm_callback(struct apr_client_data *data, void *priv) 
					__func__, payload[0], payload[1]);

				spin_unlock_irqrestore(&port->dsp_lock,

								dsp_flags);

				spin_unlock_irqrestore(

					&(session[session_id].session_lock),

					flags);

				return -EINVAL;

			}

			token = data->token;
@@ -1882,6 +1948,9 @@ static int32_t q6asm_callback(struct apr_client_data *data, void *priv) 
		if (ac->io_mode & SYNC_IO_MODE) {

			if (port->buf == NULL) {

				pr_err("%s: Unexpected Write Done\n", __func__);

				spin_unlock_irqrestore(

					&(session[session_id].session_lock),

					flags);

				return -EINVAL;

			}

			spin_lock_irqsave(&port->dsp_lock, dsp_flags);
@@ -1968,7 +2037,8 @@ static int32_t q6asm_callback(struct apr_client_data *data, void *priv) 
	if (ac->cb)

		ac->cb(data->opcode, data->token,

			data->payload, ac->priv);



	spin_unlock_irqrestore(

		&(session[session_id].session_lock), flags);

	return 0;

}
@@ -2144,11 +2214,16 @@ int q6asm_is_dsp_buf_avail(int dir, struct audio_client *ac) 
static void __q6asm_add_hdr(struct audio_client *ac, struct apr_hdr *hdr,

			uint32_t pkt_size, uint32_t cmd_flg, uint32_t stream_id)

{

	unsigned long flags;



	dev_vdbg(ac->dev, "%s: pkt_size=%d cmd_flg=%d session=%d stream_id=%d\n",

			__func__, pkt_size, cmd_flg, ac->session, stream_id);

	mutex_lock(&ac->cmd_lock);

	spin_lock_irqsave(&(session[ac->session].session_lock), flags);

	if (ac->apr == NULL) {

		pr_err("%s: AC APR handle NULL", __func__);

		spin_unlock_irqrestore(

			&(session[ac->session].session_lock), flags);

		mutex_unlock(&ac->cmd_lock);

		return;

	}
@@ -2166,6 +2241,8 @@ static void __q6asm_add_hdr(struct audio_client *ac, struct apr_hdr *hdr, 
		hdr->token = ac->session;

	}

	hdr->pkt_size  = pkt_size;

	spin_unlock_irqrestore(

		&(session[ac->session].session_lock), flags);

	mutex_unlock(&ac->cmd_lock);

	return;

}
@@ -7975,7 +8052,7 @@ int q6asm_get_apr_service_id(int session_id) 
		return -EINVAL;

	}



	return ((struct apr_svc *)session[session_id]->apr)->id;

	return ((struct apr_svc *)(session[session_id].ac)->apr)->id;

}



int q6asm_get_asm_topology(int session_id)
@@ -7986,12 +8063,12 @@ int q6asm_get_asm_topology(int session_id) 
		pr_err("%s: invalid session_id = %d\n", __func__, session_id);

		goto done;

	}

	if (session[session_id] == NULL) {

	if (session[session_id].ac == NULL) {

		pr_err("%s: session not created for session id = %d\n",

		       __func__, session_id);

		goto done;

	}

	topology = session[session_id]->topology;

	topology = (session[session_id].ac)->topology;

done:

	return topology;

}
@@ -8004,12 +8081,12 @@ int q6asm_get_asm_app_type(int session_id) 
		pr_err("%s: invalid session_id = %d\n", __func__, session_id);

		goto done;

	}

	if (session[session_id] == NULL) {

	if (session[session_id].ac == NULL) {

		pr_err("%s: session not created for session id = %d\n",

		       __func__, session_id);

		goto done;

	}

	app_type = session[session_id]->app_type;

	app_type = (session[session_id].ac)->app_type;

done:

	return app_type;

}
@@ -8366,7 +8443,10 @@ static int __init q6asm_init(void) 
	int lcnt, ret;

	pr_debug("%s:\n", __func__);



	memset(session, 0, sizeof(session));

	memset(session, 0, sizeof(struct audio_session) *

		(SESSION_MAX + 1));

	for (lcnt = 0; lcnt <= SESSION_MAX; lcnt++)

		spin_lock_init(&(session[lcnt].session_lock));

	set_custom_topology = 1;



	/*setup common client used for cal mem map */