Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge tag 'char-misc-6.18-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc
Pull char/misc fixes from Greg KH:
"Here are some small nvmem and fastrpc fixes that missed the cut-off to
get into 6.17-final, due to me being slow in getting them out, my
fault, not the maintainers of these subsystems :(
Anyway, better late than never. Changes included in here are:
- nvmem fix for automatic module loading
- fastrpc driver fixes for reported issues
All of these have been in linux-next for weeks (4?) with no reported
issues"
* tag 'char-misc-6.18-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc:
misc: fastrpc: Skip reference for DMA handles
misc: fastrpc: fix possible map leak in fastrpc_put_args
misc: fastrpc: Fix fastrpc_map_lookup operation
misc: fastrpc: Save actual DMA size in fastrpc_map structure
nvmem: layouts: fix automatic module loading
+71
-31
+58
-31
drivers/misc/fastrpc.c
+58
-31
drivers/misc/fastrpc.c
···
320
320
321
321
perm.vmid = QCOM_SCM_VMID_HLOS;
322
322
perm.perm = QCOM_SCM_PERM_RWX;
323
-
err = qcom_scm_assign_mem(map->phys, map->size,
323
+
err = qcom_scm_assign_mem(map->phys, map->len,
324
324
&src_perms, &perm, 1);
325
325
if (err) {
326
326
dev_err(map->fl->sctx->dev, "Failed to assign memory phys 0x%llx size 0x%llx err %d\n",
327
-
map->phys, map->size, err);
327
+
map->phys, map->len, err);
328
328
return;
329
329
}
330
330
}
···
360
360
361
361
362
362
static int fastrpc_map_lookup(struct fastrpc_user *fl, int fd,
363
-
struct fastrpc_map **ppmap, bool take_ref)
363
+
struct fastrpc_map **ppmap)
364
364
{
365
-
struct fastrpc_session_ctx *sess = fl->sctx;
366
365
struct fastrpc_map *map = NULL;
366
+
struct dma_buf *buf;
367
367
int ret = -ENOENT;
368
+
369
+
buf = dma_buf_get(fd);
370
+
if (IS_ERR(buf))
371
+
return PTR_ERR(buf);
368
372
369
373
spin_lock(&fl->lock);
370
374
list_for_each_entry(map, &fl->maps, node) {
371
-
if (map->fd != fd)
375
+
if (map->fd != fd || map->buf != buf)
372
376
continue;
373
-
374
-
if (take_ref) {
375
-
ret = fastrpc_map_get(map);
376
-
if (ret) {
377
-
dev_dbg(sess->dev, "%s: Failed to get map fd=%d ret=%d\n",
378
-
__func__, fd, ret);
379
-
break;
380
-
}
381
-
}
382
377
383
378
*ppmap = map;
384
379
ret = 0;
···
744
749
.release = fastrpc_release,
745
750
};
746
751
747
-
static int fastrpc_map_create(struct fastrpc_user *fl, int fd,
752
+
static int fastrpc_map_attach(struct fastrpc_user *fl, int fd,
748
753
u64 len, u32 attr, struct fastrpc_map **ppmap)
749
754
{
750
755
struct fastrpc_session_ctx *sess = fl->sctx;
751
756
struct fastrpc_map *map = NULL;
752
757
struct sg_table *table;
753
-
int err = 0;
754
-
755
-
if (!fastrpc_map_lookup(fl, fd, ppmap, true))
756
-
return 0;
758
+
struct scatterlist *sgl = NULL;
759
+
int err = 0, sgl_index = 0;
757
760
758
761
map = kzalloc(sizeof(*map), GFP_KERNEL);
759
762
if (!map)
···
788
795
map->phys = sg_dma_address(map->table->sgl);
789
796
map->phys += ((u64)fl->sctx->sid << 32);
790
797
}
791
-
map->size = len;
798
+
for_each_sg(map->table->sgl, sgl, map->table->nents,
799
+
sgl_index)
800
+
map->size += sg_dma_len(sgl);
801
+
if (len > map->size) {
802
+
dev_dbg(sess->dev, "Bad size passed len 0x%llx map size 0x%llx\n",
803
+
len, map->size);
804
+
err = -EINVAL;
805
+
goto map_err;
806
+
}
792
807
map->va = sg_virt(map->table->sgl);
793
808
map->len = len;
794
809
···
813
812
dst_perms[1].vmid = fl->cctx->vmperms[0].vmid;
814
813
dst_perms[1].perm = QCOM_SCM_PERM_RWX;
815
814
map->attr = attr;
816
-
err = qcom_scm_assign_mem(map->phys, (u64)map->size, &src_perms, dst_perms, 2);
815
+
err = qcom_scm_assign_mem(map->phys, (u64)map->len, &src_perms, dst_perms, 2);
817
816
if (err) {
818
817
dev_err(sess->dev, "Failed to assign memory with phys 0x%llx size 0x%llx err %d\n",
819
-
map->phys, map->size, err);
818
+
map->phys, map->len, err);
820
819
goto map_err;
821
820
}
822
821
}
···
833
832
dma_buf_put(map->buf);
834
833
get_err:
835
834
fastrpc_map_put(map);
835
+
836
+
return err;
837
+
}
838
+
839
+
static int fastrpc_map_create(struct fastrpc_user *fl, int fd,
840
+
u64 len, u32 attr, struct fastrpc_map **ppmap)
841
+
{
842
+
struct fastrpc_session_ctx *sess = fl->sctx;
843
+
int err = 0;
844
+
845
+
if (!fastrpc_map_lookup(fl, fd, ppmap)) {
846
+
if (!fastrpc_map_get(*ppmap))
847
+
return 0;
848
+
dev_dbg(sess->dev, "%s: Failed to get map fd=%d\n",
849
+
__func__, fd);
850
+
}
851
+
852
+
err = fastrpc_map_attach(fl, fd, len, attr, ppmap);
836
853
837
854
return err;
838
855
}
···
927
908
ctx->args[i].length == 0)
928
909
continue;
929
910
930
-
err = fastrpc_map_create(ctx->fl, ctx->args[i].fd,
931
-
ctx->args[i].length, ctx->args[i].attr, &ctx->maps[i]);
911
+
if (i < ctx->nbufs)
912
+
err = fastrpc_map_create(ctx->fl, ctx->args[i].fd,
913
+
ctx->args[i].length, ctx->args[i].attr, &ctx->maps[i]);
914
+
else
915
+
err = fastrpc_map_attach(ctx->fl, ctx->args[i].fd,
916
+
ctx->args[i].length, ctx->args[i].attr, &ctx->maps[i]);
932
917
if (err) {
933
918
dev_err(dev, "Error Creating map %d\n", err);
934
919
return -EINVAL;
···
1091
1068
struct fastrpc_phy_page *pages;
1092
1069
u64 *fdlist;
1093
1070
int i, inbufs, outbufs, handles;
1071
+
int ret = 0;
1094
1072
1095
1073
inbufs = REMOTE_SCALARS_INBUFS(ctx->sc);
1096
1074
outbufs = REMOTE_SCALARS_OUTBUFS(ctx->sc);
···
1107
1083
u64 len = rpra[i].buf.len;
1108
1084
1109
1085
if (!kernel) {
1110
-
if (copy_to_user((void __user *)dst, src, len))
1111
-
return -EFAULT;
1086
+
if (copy_to_user((void __user *)dst, src, len)) {
1087
+
ret = -EFAULT;
1088
+
goto cleanup_fdlist;
1089
+
}
1112
1090
} else {
1113
1091
memcpy(dst, src, len);
1114
1092
}
1115
1093
}
1116
1094
}
1117
1095
1096
+
cleanup_fdlist:
1118
1097
/* Clean up fdlist which is updated by DSP */
1119
1098
for (i = 0; i < FASTRPC_MAX_FDLIST; i++) {
1120
1099
if (!fdlist[i])
1121
1100
break;
1122
-
if (!fastrpc_map_lookup(fl, (int)fdlist[i], &mmap, false))
1101
+
if (!fastrpc_map_lookup(fl, (int)fdlist[i], &mmap))
1123
1102
fastrpc_map_put(mmap);
1124
1103
}
1125
1104
1126
-
return 0;
1105
+
return ret;
1127
1106
}
1128
1107
1129
1108
static int fastrpc_invoke_send(struct fastrpc_session_ctx *sctx,
···
2058
2031
args[0].length = sizeof(req_msg);
2059
2032
2060
2033
pages.addr = map->phys;
2061
-
pages.size = map->size;
2034
+
pages.size = map->len;
2062
2035
2063
2036
args[1].ptr = (u64) (uintptr_t) &pages;
2064
2037
args[1].length = sizeof(pages);
···
2073
2046
err = fastrpc_internal_invoke(fl, true, FASTRPC_INIT_HANDLE, sc, &args[0]);
2074
2047
if (err) {
2075
2048
dev_err(dev, "mem mmap error, fd %d, vaddr %llx, size %lld\n",
2076
-
req.fd, req.vaddrin, map->size);
2049
+
req.fd, req.vaddrin, map->len);
2077
2050
goto err_invoke;
2078
2051
}
2079
2052
···
2086
2059
if (copy_to_user((void __user *)argp, &req, sizeof(req))) {
2087
2060
/* unmap the memory and release the buffer */
2088
2061
req_unmap.vaddr = (uintptr_t) rsp_msg.vaddr;
2089
-
req_unmap.length = map->size;
2062
+
req_unmap.length = map->len;
2090
2063
fastrpc_req_mem_unmap_impl(fl, &req_unmap);
2091
2064
return -EFAULT;
2092
2065
}
+13
drivers/nvmem/layouts.c
+13
drivers/nvmem/layouts.c
···
45
45
return drv->remove(layout);
46
46
}
47
47
48
+
static int nvmem_layout_bus_uevent(const struct device *dev,
49
+
struct kobj_uevent_env *env)
50
+
{
51
+
int ret;
52
+
53
+
ret = of_device_uevent_modalias(dev, env);
54
+
if (ret != ENODEV)
55
+
return ret;
56
+
57
+
return 0;
58
+
}
59
+
48
60
static const struct bus_type nvmem_layout_bus_type = {
49
61
.name = "nvmem-layout",
50
62
.match = nvmem_layout_bus_match,
51
63
.probe = nvmem_layout_bus_probe,
52
64
.remove = nvmem_layout_bus_remove,
65
+
.uevent = nvmem_layout_bus_uevent,
53
66
};
54
67
55
68
int __nvmem_layout_driver_register(struct nvmem_layout_driver *drv,