mirror of
https://mirrors.bfsu.edu.cn/git/linux.git
synced 2024-12-13 22:14:20 +08:00
1558b1a8dd
dsp_chan->name and chan_name points to same block of memory,
because dev_err still needs to be used it,so we need free
it's memory after use to avoid use_after_free.
Fixes: e527adfb9b
("firmware: imx-dsp: Fix an error handling path in imx_dsp_setup_channels()")
Signed-off-by: Hao Ge <gehao@kylinos.cn>
Reviewed-by: Daniel Baluta <daniel.baluta@nxp.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
192 lines
4.2 KiB
C
192 lines
4.2 KiB
C
// SPDX-License-Identifier: GPL-2.0+
|
|
/*
|
|
* Copyright 2019 NXP
|
|
* Author: Daniel Baluta <daniel.baluta@nxp.com>
|
|
*
|
|
* Implementation of the DSP IPC interface (host side)
|
|
*/
|
|
|
|
#include <linux/firmware/imx/dsp.h>
|
|
#include <linux/kernel.h>
|
|
#include <linux/mailbox_client.h>
|
|
#include <linux/module.h>
|
|
#include <linux/platform_device.h>
|
|
#include <linux/slab.h>
|
|
|
|
/*
|
|
* imx_dsp_ring_doorbell - triggers an interrupt on the other side (DSP)
|
|
*
|
|
* @dsp: DSP IPC handle
|
|
* @chan_idx: index of the channel where to trigger the interrupt
|
|
*
|
|
* Returns non-negative value for success, negative value for error
|
|
*/
|
|
int imx_dsp_ring_doorbell(struct imx_dsp_ipc *ipc, unsigned int idx)
|
|
{
|
|
int ret;
|
|
struct imx_dsp_chan *dsp_chan;
|
|
|
|
if (idx >= DSP_MU_CHAN_NUM)
|
|
return -EINVAL;
|
|
|
|
dsp_chan = &ipc->chans[idx];
|
|
ret = mbox_send_message(dsp_chan->ch, NULL);
|
|
if (ret < 0)
|
|
return ret;
|
|
|
|
return 0;
|
|
}
|
|
EXPORT_SYMBOL(imx_dsp_ring_doorbell);
|
|
|
|
/*
|
|
* imx_dsp_handle_rx - rx callback used by imx mailbox
|
|
*
|
|
* @c: mbox client
|
|
* @msg: message received
|
|
*
|
|
* Users of DSP IPC will need to privde handle_reply and handle_request
|
|
* callbacks.
|
|
*/
|
|
static void imx_dsp_handle_rx(struct mbox_client *c, void *msg)
|
|
{
|
|
struct imx_dsp_chan *chan = container_of(c, struct imx_dsp_chan, cl);
|
|
|
|
if (chan->idx == 0) {
|
|
chan->ipc->ops->handle_reply(chan->ipc);
|
|
} else {
|
|
chan->ipc->ops->handle_request(chan->ipc);
|
|
imx_dsp_ring_doorbell(chan->ipc, 1);
|
|
}
|
|
}
|
|
|
|
struct mbox_chan *imx_dsp_request_channel(struct imx_dsp_ipc *dsp_ipc, int idx)
|
|
{
|
|
struct imx_dsp_chan *dsp_chan;
|
|
|
|
if (idx >= DSP_MU_CHAN_NUM)
|
|
return ERR_PTR(-EINVAL);
|
|
|
|
dsp_chan = &dsp_ipc->chans[idx];
|
|
dsp_chan->ch = mbox_request_channel_byname(&dsp_chan->cl, dsp_chan->name);
|
|
return dsp_chan->ch;
|
|
}
|
|
EXPORT_SYMBOL(imx_dsp_request_channel);
|
|
|
|
void imx_dsp_free_channel(struct imx_dsp_ipc *dsp_ipc, int idx)
|
|
{
|
|
struct imx_dsp_chan *dsp_chan;
|
|
|
|
if (idx >= DSP_MU_CHAN_NUM)
|
|
return;
|
|
|
|
dsp_chan = &dsp_ipc->chans[idx];
|
|
mbox_free_channel(dsp_chan->ch);
|
|
}
|
|
EXPORT_SYMBOL(imx_dsp_free_channel);
|
|
|
|
static int imx_dsp_setup_channels(struct imx_dsp_ipc *dsp_ipc)
|
|
{
|
|
struct device *dev = dsp_ipc->dev;
|
|
struct imx_dsp_chan *dsp_chan;
|
|
struct mbox_client *cl;
|
|
char *chan_name;
|
|
int ret;
|
|
int i, j;
|
|
|
|
for (i = 0; i < DSP_MU_CHAN_NUM; i++) {
|
|
if (i < 2)
|
|
chan_name = kasprintf(GFP_KERNEL, "txdb%d", i);
|
|
else
|
|
chan_name = kasprintf(GFP_KERNEL, "rxdb%d", i - 2);
|
|
|
|
if (!chan_name)
|
|
return -ENOMEM;
|
|
|
|
dsp_chan = &dsp_ipc->chans[i];
|
|
dsp_chan->name = chan_name;
|
|
cl = &dsp_chan->cl;
|
|
cl->dev = dev;
|
|
cl->tx_block = false;
|
|
cl->knows_txdone = true;
|
|
cl->rx_callback = imx_dsp_handle_rx;
|
|
|
|
dsp_chan->ipc = dsp_ipc;
|
|
dsp_chan->idx = i % 2;
|
|
dsp_chan->ch = mbox_request_channel_byname(cl, chan_name);
|
|
if (IS_ERR(dsp_chan->ch)) {
|
|
ret = PTR_ERR(dsp_chan->ch);
|
|
if (ret != -EPROBE_DEFER)
|
|
dev_err(dev, "Failed to request mbox chan %s ret %d\n",
|
|
chan_name, ret);
|
|
kfree(dsp_chan->name);
|
|
goto out;
|
|
}
|
|
|
|
dev_dbg(dev, "request mbox chan %s\n", chan_name);
|
|
}
|
|
|
|
return 0;
|
|
out:
|
|
for (j = 0; j < i; j++) {
|
|
dsp_chan = &dsp_ipc->chans[j];
|
|
mbox_free_channel(dsp_chan->ch);
|
|
kfree(dsp_chan->name);
|
|
}
|
|
|
|
return ret;
|
|
}
|
|
|
|
static int imx_dsp_probe(struct platform_device *pdev)
|
|
{
|
|
struct device *dev = &pdev->dev;
|
|
struct imx_dsp_ipc *dsp_ipc;
|
|
int ret;
|
|
|
|
device_set_of_node_from_dev(&pdev->dev, pdev->dev.parent);
|
|
|
|
dsp_ipc = devm_kzalloc(dev, sizeof(*dsp_ipc), GFP_KERNEL);
|
|
if (!dsp_ipc)
|
|
return -ENOMEM;
|
|
|
|
dsp_ipc->dev = dev;
|
|
dev_set_drvdata(dev, dsp_ipc);
|
|
|
|
ret = imx_dsp_setup_channels(dsp_ipc);
|
|
if (ret < 0)
|
|
return ret;
|
|
|
|
dev_info(dev, "NXP i.MX DSP IPC initialized\n");
|
|
|
|
return 0;
|
|
}
|
|
|
|
static int imx_dsp_remove(struct platform_device *pdev)
|
|
{
|
|
struct imx_dsp_chan *dsp_chan;
|
|
struct imx_dsp_ipc *dsp_ipc;
|
|
int i;
|
|
|
|
dsp_ipc = dev_get_drvdata(&pdev->dev);
|
|
|
|
for (i = 0; i < DSP_MU_CHAN_NUM; i++) {
|
|
dsp_chan = &dsp_ipc->chans[i];
|
|
mbox_free_channel(dsp_chan->ch);
|
|
kfree(dsp_chan->name);
|
|
}
|
|
|
|
return 0;
|
|
}
|
|
|
|
static struct platform_driver imx_dsp_driver = {
|
|
.driver = {
|
|
.name = "imx-dsp",
|
|
},
|
|
.probe = imx_dsp_probe,
|
|
.remove = imx_dsp_remove,
|
|
};
|
|
builtin_platform_driver(imx_dsp_driver);
|
|
|
|
MODULE_AUTHOR("Daniel Baluta <daniel.baluta@nxp.com>");
|
|
MODULE_DESCRIPTION("IMX DSP IPC protocol driver");
|
|
MODULE_LICENSE("GPL v2");
|