[ Upstream commit abe13e9a56 ]
There is no mutex protection for rpmsg_eptdev_open(),
especially for eptdev->ept read and write operation.
It may cause issues when multiple instances call
rpmsg_eptdev_open() in parallel,the return state
may be success or EBUSY.
Fixes: 964e8bedd5 ("rpmsg: char: Return an error if device already open")
Signed-off-by: Shengjiu Wang <shengjiu.wang@nxp.com>
Link: https://lore.kernel.org/r/1653104105-16779-1-git-send-email-shengjiu.wang@nxp.com
Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
commit 7a534ae89e upstream.
struct rpmsg_eptdev contains a struct cdev. The current code frees
the rpmsg_eptdev struct in rpmsg_eptdev_destroy(), but the cdev is
a managed object, therefore its release is not predictable and the
rpmsg_eptdev could be freed before the cdev is entirely released.
The cdev_device_add/del() API was created to address this issue
(see commit '233ed09d7fda ("chardev: add helper function to register
char devs with a struct device")'), use it instead of cdev add/del().
Fixes: c0cdc19f84 ("rpmsg: Driver for user space endpoint interface")
Suggested-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Matthias Kaehlcke <mka@chromium.org>
Reviewed-by: Mathieu Poirier <mathieu.poirier@linaro.org>
Reviewed-by: Stephen Boyd <swboyd@chromium.org>
Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Link: https://lore.kernel.org/r/20220110104706.v6.2.Idde68b05b88d4a2e6e54766c653f3a6d9e419ce6@changeid
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
The rpmsg_create_ept function is invoked when the device is opened.
As only one endpoint must be created per device. It is not possible to
open the same device twice. But there is nothing to prevent multi open.
Return -EBUSY when device is already opened to have a generic error
instead of relying on the back-end to potentially detect the error.
Without this patch for instance the GLINK driver return -EBUSY while
the virtio bus return -ENOSPC.
Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Reviewed-by: Mathieu Poirier <mathieu.poirier@linaro.org>
Signed-off-by: Arnaud Pouliquen <arnaud.pouliquen@foss.st.com>
Link: https://lore.kernel.org/r/20210311140413.31725-7-arnaud.pouliquen@foss.st.com
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
When the endpoint device is created by the application, a destination
address is specified in the rpmsg_channel_info structure. Since the
rpmsg_endpoint structure does not store the destination address,
this destination address must be specified when sending a message.
Replaces rpmsg_send with rpmsg_sendto to allow to specify the
destination address. This implementation is requested for compatibly with
some rpmsg backends like the virtio backend.
For this, the GLINK an SMD drivers have been updated to support the
rpmsg_sendto, even if the destination address is ignored for these
backends. For these drivers, the rpmsg_send and rpmsg_trysend ops are
preserved to avoid breaking the legacy.
Signed-off-by: Arnaud Pouliquen <arnaud.pouliquen@foss.st.com>
Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Reviewed-by: Mathieu Poirier <mathieu.poirier@linaro.org>
Link: https://lore.kernel.org/r/20210311140413.31725-5-arnaud.pouliquen@foss.st.com
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
To be coherent with the other functions which are prefixed by
rpmsg_chrdev, rename the rpmsg_char_init function.
Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Reviewed-by: Mathieu Poirier <mathieu.poirier@linaro.org>
Signed-off-by: Arnaud Pouliquen <arnaud.pouliquen@foss.st.com>
Link: https://lore.kernel.org/r/20210311140413.31725-2-arnaud.pouliquen@foss.st.com
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
This contains a number of bug fixes to the GLINK transport driver, an
off-by-one in the GLINK smem driver and a memory leak fix in the rpmsg
char driver.
-----BEGIN PGP SIGNATURE-----
iQJPBAABCAA5FiEEBd4DzF816k8JZtUlCx85Pw2ZrcUFAl3ivUUbHGJqb3JuLmFu
ZGVyc3NvbkBsaW5hcm8ub3JnAAoJEAsfOT8Nma3FiR8QAMPgnnBEYn+DTl2PnTrG
AGbac4cvyyCqSR3KoclXfosFEDBLO4O6ph3UiYTF0Kn5R5Tapd8pymDJXoinOb+h
YhDxsfg8ddcaHpHQHhxlLCRP1jtXfTVekSZqJ20wDkEqFiIvVx5tBjd2muPlLDYP
qpiF9hUGSQfWUf/M/Ci5s2UEs533ANL1WKmxK4VrXW9ePOIAK+OS3aQpXdOIWKhb
/CGYn9+njEsa50SNUjlgKYB0225Fn04wCycIbB8fHavB0nJ7J+Cyr0fnrj89ICbn
9F3uGItO9Fk4xoDZ5v6znYoT2ch+LSbcoZ2YVJaqrLWjMM2XzattvH11rX1wuro0
tRqOGO6X5ztK3q+n5w4Sg2hecHobjZlL+j7gNuAT5r0cyIjyCrSzaJeQij6bgtRA
cTp/LlqWck2qVGeXbfFHvyfrZQrGD72lg0vxoE+dqwX55PQ15C25v40LULVR0YeS
oRI8o5Qv6fv9aKSf5SRJIRdXg0rWdmLU7q9pzrdlF4hw++RCvVdvKUTqCLvQQxLw
TZi6YkEjsZEOpXM5KmqRAjJ+KsRp2lJsyW0wLU0b/8zzuZmRiTIHZ6PMk8ThTCGM
ka8Y3YGOAR+ShaK5z0u56fktaqQSYhVRyS/WmIiQZ/zvlpQRCtwPnQptcIxjlVbL
FK9IU1ARADI8CqXTz1j0V/tt
=qkoA
-----END PGP SIGNATURE-----
Merge tag 'rpmsg-v5.5' of git://git.kernel.org/pub/scm/linux/kernel/git/andersson/remoteproc
Pull rpmsg updates from Bjorn Andersson:
"This contains a number of bug fixes to the GLINK transport driver, an
off-by-one in the GLINK smem driver and a memory leak fix in the rpmsg
char driver"
* tag 'rpmsg-v5.5' of git://git.kernel.org/pub/scm/linux/kernel/git/andersson/remoteproc:
rpmsg: Fix Kconfig indentation
rpmsg: char: Simplify 'rpmsg_eptdev_release()'
rpmsg: glink: Free pending deferred work on remove
rpmsg: glink: Don't send pending rx_done during remove
rpmsg: glink: Fix rpmsg_register_device err handling
rpmsg: glink: Put an extra reference during cleanup
rpmsg: glink: Fix use after free in open_ack TIMEOUT case
rpmsg: glink: Fix reuse intents memory leak issue
rpmsg: glink: Set tail pointer to 0 at end of FIFO
rpmsg: char: release allocated memory
Use 'skb_queue_purge()' instead of re-implementing it.
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
The .ioctl and .compat_ioctl file operations have the same prototype so
they can both point to the same function, which works great almost all
the time when all the commands are compatible.
One exception is the s390 architecture, where a compat pointer is only
31 bit wide, and converting it into a 64-bit pointer requires calling
compat_ptr(). Most drivers here will never run in s390, but since we now
have a generic helper for it, it's easy enough to use it consistently.
I double-checked all these drivers to ensure that all ioctl arguments
are used as pointers or are ignored, but are not interpreted as integer
values.
Acked-by: Jason Gunthorpe <jgg@mellanox.com>
Acked-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Acked-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Acked-by: David Sterba <dsterba@suse.com>
Acked-by: Darren Hart (VMware) <dvhart@infradead.org>
Acked-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Acked-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Acked-by: Dan Williams <dan.j.williams@intel.com>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
In rpmsg_eptdev_write_iter, if copy_from_iter_full fails the allocated
buffer needs to be released.
Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
In order to be able to use the aio interface for writing to a rpmsg_char
the write_iter function must be implemented, so migrate to iter version
for read and write functions.
Regular read and write uses the iter methods if present and is as such
unaffected.
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Add compat ioctl callback to support 32bit user space applications.
Signed-off-by: Arun Kumar Neelakantam <aneela@codeaurora.org>
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Use the appropriate SPDX license identifier in the rpmsg char driver
source file and drop the previous boilerplate license text. The uapi
header file already had the SPDX license identifier added as part of
a mass update but the license text removal was deferred for later,
and this patch drops the same.
Signed-off-by: Suman Anna <s-anna@ti.com>
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
This is the mindless scripted replacement of kernel use of POLL*
variables as described by Al, done by this script:
for V in IN OUT PRI ERR RDNORM RDBAND WRNORM WRBAND HUP RDHUP NVAL MSG; do
L=`git grep -l -w POLL$V | grep -v '^t' | grep -v /um/ | grep -v '^sa' | grep -v '/poll.h$'|grep -v '^D'`
for f in $L; do sed -i "-es/^\([^\"]*\)\(\<POLL$V\>\)/\\1E\\2/" $f; done
done
with de-mangling cleanups yet to come.
NOTE! On almost all architectures, the EPOLL* constants have the same
values as the POLL* constants do. But they keyword here is "almost".
For various bad reasons they aren't the same, and epoll() doesn't
actually work quite correctly in some cases due to this on Sparc et al.
The next patch from Al will sort out the final differences, and we
should be all done.
Scripted-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
This introduces the Qualcomm GLINK protocol driver and DeviceTree-based
modalias support, as well as a number of smaller fixes.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIcBAABAgAGBQJZXXVMAAoJEAsfOT8Nma3FQQgP/3J8RiSyURi5EUKs59LBHQ6Z
hpQgsxa0idTY4AbS6phUiBMxyxSSJltGn/8hjlddixp/iiaqSv3z+d5zHRiyOsHt
TiOYkE5z8HvG/i/fA9+ZFCeTakqeq9qWhyYEJ0r1j49le4iWRPwQ0NGHxNhyTZJZ
dTPIC4C5FJPl5LEyeU5ZTzLTtPWZKu2+Ll5xB8vZz6qmU2aQMdX4XL30sbgdXB9y
Xg04AYTYrphoTLT7y7wKJ3/acZyJDZp+6kfr1mMvZttZiGZJLbaAN3+jlLvAqO25
NMZzTsBW6sCfWhh/v/IP7AVIYde6yzTfvcj7z9Z0RFb/QdFA691Y6dxLbJtSmVGR
FRCq739NKmvbe3l3xWdMSXOcSMZng534u/Ws/p6orUNzCrBHAcc0f9Qz5URIXo8R
tw5/IZwUurBDlAIJeBJM/AKWj75C7Wxuy1SUcG7ks3NyKejCM2Pl+Y2gwWOSXvJj
0slS1EnUmiypT5dR4IJXYni34eP0yfXtwfxHuUPZvcaLCpdbSMRULAubGpgcOOT0
d/lFv29UDudh7vxEqV2tEcEk5NVvcAuwsGytZddxFOGU1tCsrLa/BMBiiA3aKn5S
sS5puLXPwl3ndwQV8Kr+48LjepQ44UoVvlh9edZUKVcaeDUDRM7WOvPyVUE9Rc+C
UMPkHyvD/sYPaDRhXyTD
=rhfx
-----END PGP SIGNATURE-----
Merge tag 'rpmsg-v4.13' of git://github.com/andersson/remoteproc
Pull rpmsg updates from Bjorn Andersson:
"This introduces the Qualcomm GLINK protocol driver and
DeviceTree-based modalias support, as well as a number of smaller
fixes"
* tag 'rpmsg-v4.13' of git://github.com/andersson/remoteproc:
rpmsg: Make modalias work for DeviceTree based devices
rpmsg: Drop VIRTUALIZATION dependency from RPMSG_VIRTIO
rpmsg: Don't overwrite release op of rpdev
rpmsg: virtio_rpmsg_bus: cleanup multiple assignment to ops
rpmsg: virtio_rpmsg_bus: fix nameservice address
rpmsg: cleanup incorrect function in dev_err message
rpmsg: virtio_rpmsg_bus: fix announce for devices without endpoint
rpmsg: Introduce Qualcomm RPM glink driver
soc: qcom: Add device tree binding for GLINK RPM
rpmsg: Release rpmsg devices in backends
Trivial cleanup for incorrect function in dev_err message
Signed-off-by: Henri Roosen <henri.roosen@ginzinger.com>
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
A common pattern with skb_put() is to just want to memcpy()
some data into the new space, introduce skb_put_data() for
this.
An spatch similar to the one for skb_put_zero() converts many
of the places using it:
@@
identifier p, p2;
expression len, skb, data;
type t, t2;
@@
(
-p = skb_put(skb, len);
+p = skb_put_data(skb, data, len);
|
-p = (t)skb_put(skb, len);
+p = skb_put_data(skb, data, len);
)
(
p2 = (t2)p;
-memcpy(p2, data, len);
|
-memcpy(p, data, len);
)
@@
type t, t2;
identifier p, p2;
expression skb, data;
@@
t *p;
...
(
-p = skb_put(skb, sizeof(t));
+p = skb_put_data(skb, data, sizeof(t));
|
-p = (t *)skb_put(skb, sizeof(t));
+p = skb_put_data(skb, data, sizeof(t));
)
(
p2 = (t2)p;
-memcpy(p2, data, sizeof(*p));
|
-memcpy(p, data, sizeof(*p));
)
@@
expression skb, len, data;
@@
-memcpy(skb_put(skb, len), data, len);
+skb_put_data(skb, data, len);
(again, manually post-processed to retain some comments)
Reviewed-by: Stephen Hemminger <stephen@networkplumber.org>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
We should unlock before returning if skb_dequeue() returns a NULL.
Fixes: c0cdc19f84 ("rpmsg: Driver for user space endpoint interface")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
This driver allows rpmsg instances to expose access to rpmsg endpoints
to user space processes. It provides a control interface, allowing
userspace to export endpoints and an endpoint interface for each exposed
endpoint.
The implementation is based on prior art by Texas Instrument, Google,
PetaLogix and was derived from a FreeRTOS performance statistics driver
written by Michal Simek.
The control interface provides a "create endpoint" ioctl, which is fed a
name, source and destination address. The three values are used to
create the endpoint, in a backend-specific way, and a rpmsg endpoint
device is created - with the three parameters are available in sysfs for
udev usage.
E.g. to create an endpoint device for one of the Qualcomm SMD channel
related to DIAG one would issue:
struct rpmsg_endpoint_info info = { "DIAG_CNTL", 0, 0 };
int fd = open("/dev/rpmsg_ctrl0", O_RDWR);
ioctl(fd, RPMSG_CREATE_EPT_IOCTL, &info);
Each created endpoint device shows up as an individual character device
in /dev, allowing permission to be controlled on a per-endpoint basis.
The rpmsg endpoint will be created and destroyed following the opening
and closing of the endpoint device, allowing rpmsg backends to open and
close the physical channel, if supported by the wire protocol.
Cc: Marek Novak <marek.novak@nxp.com>
Cc: Matteo Sartori <matteo.sartori@t3lab.it>
Cc: Michal Simek <monstr@monstr.eu>
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Shengjiu Wang