linux-kernel - Re: [PATCH v2 08/10] misc: fastrpc: Safekeep mmaps on interrupted invoke

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <a9fe2f55-a175-26b4-2542-53ac87f7ec58@linaro.org>
Date:   Tue, 6 Sep 2022 15:10:51 +0100
From:   Srinivas Kandagatla <srinivas.kandagatla@...aro.org>
To:     Abel Vesa <abel.vesa@...aro.org>,
        Amol Maheshwari <amahesh@....qualcomm.com>,
        Andy Gross <agross@...nel.org>,
        Bjorn Andersson <andersson@...nel.org>,
        Konrad Dybcio <konrad.dybcio@...ainline.org>,
        Ekansh Gupta <quic_ekagupt@...cinc.com>
Cc:     Rob Herring <robh@...nel.org>,
        Krzysztof Kozlowski <krzysztof.kozlowski@...aro.org>,
        Arnd Bergmann <arnd@...db.de>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        linux-arm-msm@...r.kernel.org,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        devicetree@...r.kernel.org
Subject: Re: [PATCH v2 08/10] misc: fastrpc: Safekeep mmaps on interrupted
 invoke



On 02/09/2022 16:48, Abel Vesa wrote:
> If the userspace daemon is killed in the middle of an invoke (e.g.
> audiopd listerner invoke), we need to skip the unmapping on device
> release, otherwise the DSP will crash. So lets safekeep all the maps
> only if there is in invoke interrupted, by attaching them to the channel
> context (which is resident until RPMSG driver is removed), and restore
> them back to the fastrpc user on the next device open call.
>

Am bit confused with this patch.

Intention is to support interrupted invoke calls, but resorting the maps 
on next open is totally something different.

if we move maps from interrupted list to compute context list on open 
then these will be freed in the close.

AFAIU, to support interrupted invoke we need to check the fd and sc and 
restore.


> Signed-off-by: Abel Vesa <abel.vesa@...aro.org>
> ---


>   drivers/misc/fastrpc.c | 31 +++++++++++++++++++++++++++++++
>   1 file changed, 31 insertions(+)
> 
> diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c
> index 2c656da4ca5e..41eabdf0a256 100644
> --- a/drivers/misc/fastrpc.c
> +++ b/drivers/misc/fastrpc.c
> @@ -275,6 +275,7 @@ struct fastrpc_channel_ctx {
>   	struct fastrpc_device *secure_fdevice;
>   	struct fastrpc_device *fdevice;
>   	struct fastrpc_buf *remote_heap;
> +	struct list_head invoke_interrupted_mmaps;
>   	bool secure;
>   	bool unsigned_support;
>   };
> @@ -1114,6 +1115,26 @@ static int fastrpc_invoke_send(struct fastrpc_session_ctx *sctx,
>   
>   }
>   
> +static void fastrpc_invoke_interrupted_restore_mmaps(struct fastrpc_user *fl)
> +{
> +	struct fastrpc_buf *buf, *b;
> +
> +	list_for_each_entry_safe(buf, b, &fl->cctx->invoke_interrupted_mmaps, node) {
> +		list_del(&buf->node);
> +		list_add(&buf->node, &fl->mmaps);
> +	}
> +}
> +
> +static void fastrpc_invoke_interrupted_save_mmaps(struct fastrpc_user *fl)
> +{
> +	struct fastrpc_buf *buf, *b;
> +
> +	list_for_each_entry_safe(buf, b, &fl->mmaps, node) {
> +		list_del(&buf->node);
> +		list_add_tail(&buf->node, &fl->cctx->invoke_interrupted_mmaps);
> +	}
> +}
> +
>   static int fastrpc_internal_invoke(struct fastrpc_user *fl,  u32 kernel,
>   				   u32 handle, u32 sc,
>   				   struct fastrpc_invoke_args *args)
> @@ -1182,6 +1203,9 @@ static int fastrpc_internal_invoke(struct fastrpc_user *fl,  u32 kernel,
>   		fastrpc_context_put(ctx);
>   	}
>   
> +	if (err == -ERESTARTSYS)
> +		fastrpc_invoke_interrupted_save_mmaps(fl);
> +
>   	if (err)
>   		dev_dbg(fl->sctx->dev, "Error: Invoke Failed %d\n", err);
>   
> @@ -1551,6 +1575,8 @@ static int fastrpc_device_open(struct inode *inode, struct file *filp)
>   		return -EBUSY;
>   	}
>   
> +	fastrpc_invoke_interrupted_restore_mmaps(fl);
> +
>   	spin_lock_irqsave(&cctx->lock, flags);
>   	list_add_tail(&fl->user, &cctx->users);
>   	spin_unlock_irqrestore(&cctx->lock, flags);
> @@ -2268,6 +2294,7 @@ static int fastrpc_rpmsg_probe(struct rpmsg_device *rpdev)
>   	dev_set_drvdata(&rpdev->dev, data);
>   	dma_set_mask_and_coherent(rdev, DMA_BIT_MASK(32));
>   	INIT_LIST_HEAD(&data->users);
> +	INIT_LIST_HEAD(&data->invoke_interrupted_mmaps);
>   	spin_lock_init(&data->lock);
>   	idr_init(&data->ctx_idr);
>   	data->domain_id = domain_id;
> @@ -2292,6 +2319,7 @@ static void fastrpc_notify_users(struct fastrpc_user *user)
>   static void fastrpc_rpmsg_remove(struct rpmsg_device *rpdev)
>   {
>   	struct fastrpc_channel_ctx *cctx = dev_get_drvdata(&rpdev->dev);
> +	struct fastrpc_buf *buf, *b;
>   	struct fastrpc_user *user;
>   	unsigned long flags;
>   
> @@ -2306,6 +2334,9 @@ static void fastrpc_rpmsg_remove(struct rpmsg_device *rpdev)
>   	if (cctx->secure_fdevice)
>   		misc_deregister(&cctx->secure_fdevice->miscdev);
>   
> +	list_for_each_entry_safe(buf, b, &cctx->invoke_interrupted_mmaps, node)
> +		list_del(&buf->node);

AFAIU, This list will be empty all the time, as you are moving them to 
compute context list on open.

> +
>   	if (cctx->remote_heap)
>   		fastrpc_buf_free(cctx->remote_heap);
>