From nobody Sun Oct 5 09:10:55 2025 Received: from mx0a-0031df01.pphosted.com (mx0a-0031df01.pphosted.com [205.220.168.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3DDEC231A21; Thu, 7 Aug 2025 10:05:02 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.168.131 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1754561103; cv=none; b=SeHJtBuyzQbYNg6qhr4P1LUnEbHSnVtT5xBD6Ydr2EoSpas/nHJLxEnC9YCiZJMkL+fhOIR9P/PVhvEtBxVCMJXQZ2P3r/abcUroEAwfExI4CtqCiqcHhn3Do5M1KdhR9J8RUb00xsuCTaXt3zSTRyfoAh+OlcQCRrt9bUEnYzg= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1754561103; c=relaxed/simple; bh=A/JowLnmSpCL9avh5YQTg3QdSoTKw5mpKJBs7LZye7E=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=Zq5shROPg3dfQmMDpvlIrA07UW3xLKp0QqTUbhHEUW7nZ8U//epzEDjQu/cj6iMRm6ABiMZ43cDK4S4N/fjlQj88oxvuon774wl9sECW87X6NngKvNVnPMgGzht8ZLKbFly8NQ9PZ2ZZ5a7gw7c8Ml1GmHWyyirMg+VGnKgDO9g= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=quicinc.com; spf=pass smtp.mailfrom=quicinc.com; dkim=pass (2048-bit key) header.d=quicinc.com header.i=@quicinc.com header.b=Lwc9EOJm; arc=none smtp.client-ip=205.220.168.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=quicinc.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=quicinc.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=quicinc.com header.i=@quicinc.com header.b="Lwc9EOJm" Received: from pps.filterd (m0279866.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.2/8.18.1.2) with ESMTP id 5779CwA2007847; Thu, 7 Aug 2025 10:04:54 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=quicinc.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=qcppdkim1; bh= Vyf0xwmhP92Mwo4PbTPRntr/zDdeoPQlWv/OuSA0+SI=; b=Lwc9EOJmx5GpIEun TWzn1WvRQI7CVd96ALm+QzPPxuVAZ8V4KGUXbc9eL9KrEtfwSUhVzd613ik90+za LuYs8rKjeUO6wgmtfMfb/sB+qWFQTpGIisJDy6L6XPywJcXD8dT44flPAf4yd41F HNtNMEYKvfdV30UgbXeNuDYqtVQbFzz7PSHqKj6vUTIihIJxHklzylUGrFAOLK6j MbEZ51zOtqGWqcx/L3bC80c+ycNF8kiChsNJcLTC8awOkKyZr82F+B0qtISDHP7c 8FdpMmR4H5m2MLEOKZUEFeVAdU9gq67Q/zDA1C5CcIq4bBG1ilqV8DXpXtk0Kg7z y8MyOA== Received: from nasanppmta05.qualcomm.com (i-global254.qualcomm.com [199.106.103.254]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 48bpy6wwed-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 07 Aug 2025 10:04:54 +0000 (GMT) Received: from nasanex01c.na.qualcomm.com (nasanex01c.na.qualcomm.com [10.45.79.139]) by NASANPPMTA05.qualcomm.com (8.18.1.2/8.18.1.2) with ESMTPS id 577A4rUV032620 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 7 Aug 2025 10:04:53 GMT Received: from hu-lxu5-sha.qualcomm.com (10.80.80.8) by nasanex01c.na.qualcomm.com (10.45.79.139) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1748.10; Thu, 7 Aug 2025 03:04:49 -0700 From: Ling Xu To: , , , , , , , CC: , , , , , , , Ling Xu , Subject: [PATCH v3 4/4] misc: fastrpc: Skip reference for DMA handles Date: Thu, 7 Aug 2025 15:34:20 +0530 Message-ID: <20250807100420.1163967-5-quic_lxu5@quicinc.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20250807100420.1163967-1-quic_lxu5@quicinc.com> References: <20250807100420.1163967-1-quic_lxu5@quicinc.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: nasanex01a.na.qualcomm.com (10.52.223.231) To nasanex01c.na.qualcomm.com (10.45.79.139) X-QCInternal: smtphost X-Proofpoint-Virus-Version: vendor=nai engine=6200 definitions=5800 signatures=585085 X-Proofpoint-ORIG-GUID: L2Oc6XP0gmO5b2gUcw5IW7s8wTzTA4Sb X-Proofpoint-GUID: L2Oc6XP0gmO5b2gUcw5IW7s8wTzTA4Sb X-Proofpoint-Spam-Details-Enc: AW1haW4tMjUwODA2MDAwOSBTYWx0ZWRfX/OuBuY/75TOg xGXG25jV1QUWPyVnvjQnaKEDPzD+SjRIiTQNRA84eh1dICaSJx+PGx0roI8Wwcs0OKn65FNq/A3 51Lf5iGjWdspLPB/zRV9ejUQNOAr3N8r4gbFanngcgcWdLvqVxwbjczxRY7i70+tTMpFryduGqI eZS+bSc/n+6ZrGJ7Wbl7vJc+hw0ni/pKuLNcJeXObeIiswAnkfzz/2ufdGpPWd0VwqBFo9hTwAX iXEafEZkfbuTsjkyEicxeT5889LVTCm9NQKoCdLLausC2csE1RXeBsRbhEjbTs+EAJCIkUsin4T lYnOrx0rpezM7d31QcCwkRF8Yq5kBpSFNDxtsd3KdDztp9TkcBRSBsDxeiKt/2sPxiNyKdm1eTy Df6uLVEn X-Authority-Analysis: v=2.4 cv=LNVmQIW9 c=1 sm=1 tr=0 ts=68947a46 cx=c_pps a=JYp8KDb2vCoCEuGobkYCKw==:117 a=JYp8KDb2vCoCEuGobkYCKw==:17 a=GEpy-HfZoHoA:10 a=2OwXVqhp2XgA:10 a=VwQbUJbxAAAA:8 a=EUspDBNiAAAA:8 a=COk6AnOGAAAA:8 a=65MDuzgJ9_6jycvYPFoA:9 a=TjNXssC_j7lpFel5tvFf:22 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1099,Hydra:6.1.9,FMLib:17.12.80.40 definitions=2025-08-07_01,2025-08-06_01,2025-03-28_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 bulkscore=0 clxscore=1015 malwarescore=0 adultscore=0 phishscore=0 priorityscore=1501 impostorscore=0 suspectscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.19.0-2507300000 definitions=main-2508060009 Content-Type: text/plain; charset="utf-8" If multiple dma handles are passed with same fd over a remote call the kernel driver takes a reference and expects that put for the map will be called as many times to free the map. But DSP only updates the fd one time in the fd list when the DSP refcount goes to zero and hence kernel make put call only once for the fd. This can cause SMMU fault issue as the same fd can be used in future for some other call. Fixes: 35a82b87135d ("misc: fastrpc: Add dma handle implementation") Cc: stable@kernel.org Co-developed-by: Ekansh Gupta Signed-off-by: Ekansh Gupta Signed-off-by: Ling Xu Reviewed-by: Dmitry Baryshkov --- drivers/misc/fastrpc.c | 45 +++++++++++++++++++++++++----------------- 1 file changed, 27 insertions(+), 18 deletions(-) diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c index d950a179bff8..7eec907ed454 100644 --- a/drivers/misc/fastrpc.c +++ b/drivers/misc/fastrpc.c @@ -363,9 +363,8 @@ static int fastrpc_map_get(struct fastrpc_map *map) =20 =20 static int fastrpc_map_lookup(struct fastrpc_user *fl, int fd, - struct fastrpc_map **ppmap, bool take_ref) + struct fastrpc_map **ppmap) { - struct fastrpc_session_ctx *sess =3D fl->sctx; struct fastrpc_map *map =3D NULL; struct dma_buf *buf; int ret =3D -ENOENT; @@ -379,15 +378,6 @@ static int fastrpc_map_lookup(struct fastrpc_user *fl,= int fd, if (map->fd !=3D fd || map->buf !=3D buf) continue; =20 - if (take_ref) { - ret =3D fastrpc_map_get(map); - if (ret) { - dev_dbg(sess->dev, "%s: Failed to get map fd=3D%d ret=3D%d\n", - __func__, fd, ret); - break; - } - } - *ppmap =3D map; ret =3D 0; break; @@ -757,7 +747,7 @@ static const struct dma_buf_ops fastrpc_dma_buf_ops =3D= { .release =3D fastrpc_release, }; =20 -static int fastrpc_map_create(struct fastrpc_user *fl, int fd, +static int fastrpc_map_attach(struct fastrpc_user *fl, int fd, u64 len, u32 attr, struct fastrpc_map **ppmap) { struct fastrpc_session_ctx *sess =3D fl->sctx; @@ -766,9 +756,6 @@ static int fastrpc_map_create(struct fastrpc_user *fl, = int fd, struct scatterlist *sgl =3D NULL; int err =3D 0, sgl_index =3D 0; =20 - if (!fastrpc_map_lookup(fl, fd, ppmap, true)) - return 0; - map =3D kzalloc(sizeof(*map), GFP_KERNEL); if (!map) return -ENOMEM; @@ -853,6 +840,24 @@ static int fastrpc_map_create(struct fastrpc_user *fl,= int fd, return err; } =20 +static int fastrpc_map_create(struct fastrpc_user *fl, int fd, + u64 len, u32 attr, struct fastrpc_map **ppmap) +{ + struct fastrpc_session_ctx *sess =3D fl->sctx; + int err =3D 0; + + if (!fastrpc_map_lookup(fl, fd, ppmap)) { + if (!fastrpc_map_get(*ppmap)) + return 0; + dev_dbg(sess->dev, "%s: Failed to get map fd=3D%d\n", + __func__, fd); + } + + err =3D fastrpc_map_attach(fl, fd, len, attr, ppmap); + + return err; +} + /* * Fastrpc payload buffer with metadata looks like: * @@ -925,8 +930,12 @@ static int fastrpc_create_maps(struct fastrpc_invoke_c= tx *ctx) ctx->args[i].length =3D=3D 0) continue; =20 - err =3D fastrpc_map_create(ctx->fl, ctx->args[i].fd, - ctx->args[i].length, ctx->args[i].attr, &ctx->maps[i]); + if (i < ctx->nbufs) + err =3D fastrpc_map_create(ctx->fl, ctx->args[i].fd, + ctx->args[i].length, ctx->args[i].attr, &ctx->maps[i]); + else + err =3D fastrpc_map_attach(ctx->fl, ctx->args[i].fd, + ctx->args[i].length, ctx->args[i].attr, &ctx->maps[i]); if (err) { dev_err(dev, "Error Creating map %d\n", err); return -EINVAL; @@ -1116,7 +1125,7 @@ static int fastrpc_put_args(struct fastrpc_invoke_ctx= *ctx, for (i =3D 0; i < FASTRPC_MAX_FDLIST; i++) { if (!fdlist[i]) break; - if (!fastrpc_map_lookup(fl, (int)fdlist[i], &mmap, false)) + if (!fastrpc_map_lookup(fl, (int)fdlist[i], &mmap)) fastrpc_map_put(mmap); } =20 --=20 2.34.1