| Message ID | 20180509170159.29682-9-ilina@codeaurora.org (mailing list archive) |
|---|---|
| State | Not Applicable, archived |
| Delegated to: | Andy Gross |
| Headers | show |
On Wed, May 09, 2018 at 11:01:57AM -0600, Lina Iyer wrote: > Platform drivers that want to send a request but do not want to block > until the RPMH request completes have now a new API - > rpmh_write_async(). > > The API allocates memory and send the requests and returns the control > back to the platform driver. The tx_done callback from the controller is > handled in the context of the controller's thread and frees the > allocated memory. This API allows RPMH requests from atomic contexts as > well. > > Signed-off-by: Lina Iyer <ilina@codeaurora.org> Reviewed-by: Matthias Kaehlcke <mka@chromium.org> -- To unsubscribe from this list: send the line "unsubscribe linux-arm-msm" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Hi, On Wed, May 9, 2018 at 10:01 AM, Lina Iyer <ilina@codeaurora.org> wrote: > /** > @@ -137,6 +140,8 @@ void rpmh_tx_done(const struct tcs_request *msg, int r) > dev_err(rpm_msg->dev, "RPMH TX fail in msg addr=%#x, err=%d\n", > rpm_msg->msg.cmds[0].addr, r); > > + kfree(rpm_msg->free); > + The way the code is written makes it seem like you could free memory _and_ have a completion but you can't. Specifically: * The only plausible thing that "rpm_msg->free" could point to is "rpm_msg". * The complete(compl) would then be accessing freed memory. I believe the kfree() should be at the end of the function. Personally I'd make it more obvious that this is just a boolean value and change to: if (rpm_msg->needs_free) kgree(rpm_msg) ...then the reader of the code doesn't need to go figure out what you're trying to free. -Doug -- To unsubscribe from this list: send the line "unsubscribe linux-arm-msm" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Hi, On 5/12/2018 1:46 AM, Doug Anderson wrote: > Hi, > > On Wed, May 9, 2018 at 10:01 AM, Lina Iyer <ilina@codeaurora.org> wrote: >> /** >> @@ -137,6 +140,8 @@ void rpmh_tx_done(const struct tcs_request *msg, int r) >> dev_err(rpm_msg->dev, "RPMH TX fail in msg addr=%#x, err=%d\n", >> rpm_msg->msg.cmds[0].addr, r); >> >> + kfree(rpm_msg->free); >> + > > The way the code is written makes it seem like you could free memory > _and_ have a completion but you can't. Specifically: > > * The only plausible thing that "rpm_msg->free" could point to is "rpm_msg". > > * The complete(compl) would then be accessing freed memory. As the completions are declared on stack, it will not access freed memory. > > I believe the kfree() should be at the end of the function. > Personally I'd make it more obvious that this is just a boolean value > and change to: > > if (rpm_msg->needs_free) > kgree(rpm_msg) > > ...then the reader of the code doesn't need to go figure out what > you're trying to free. > > > -Doug > Yes. Will change it this way in next patch set. Thanks, Raju -- To unsubscribe from this list: send the line "unsubscribe linux-arm-msm" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/drivers/soc/qcom/rpmh.c b/drivers/soc/qcom/rpmh.c index 23fcbd9487cd..1bb62876795c 100644 --- a/drivers/soc/qcom/rpmh.c +++ b/drivers/soc/qcom/rpmh.c @@ -33,6 +33,7 @@ .cmd = { { 0 } }, \ .completion = q, \ .dev = dev, \ + .free = NULL, \ } /** @@ -58,6 +59,7 @@ struct cache_req { * @completion: triggered when request is done * @dev: the device making the request * @err: err return from the controller + * @free: the request object to be freed at tx_done */ struct rpmh_request { struct tcs_request msg; @@ -65,6 +67,7 @@ struct rpmh_request { struct completion *completion; const struct device *dev; int err; + struct rpmh_request *free; }; /** @@ -137,6 +140,8 @@ void rpmh_tx_done(const struct tcs_request *msg, int r) dev_err(rpm_msg->dev, "RPMH TX fail in msg addr=%#x, err=%d\n", rpm_msg->msg.cmds[0].addr, r); + kfree(rpm_msg->free); + /* Signal the blocking thread we are done */ if (compl) complete(compl); @@ -248,6 +253,53 @@ static int __rpmh_write(const struct device *dev, enum rpmh_state state, return ret; } +static struct rpmh_request *__get_rpmh_msg_async(enum rpmh_state state, + const struct tcs_cmd *cmd, + u32 n) +{ + struct rpmh_request *req; + + if (!cmd || !n || n > MAX_RPMH_PAYLOAD) + return ERR_PTR(-EINVAL); + + req = kzalloc(sizeof(*req), GFP_ATOMIC); + if (!req) + return ERR_PTR(-ENOMEM); + + memcpy(req->cmd, cmd, n * sizeof(*cmd)); + + req->msg.state = state; + req->msg.cmds = req->cmd; + req->msg.num_cmds = n; + req->free = req; + + return req; +} + +/** + * rpmh_write_async: Write a set of RPMH commands + * + * @dev: The device making the request + * @state: Active/sleep set + * @cmd: The payload data + * @n: The number of elements in payload + * + * Write a set of RPMH commands, the order of commands is maintained + * and will be sent as a single shot. + */ +int rpmh_write_async(const struct device *dev, enum rpmh_state state, + const struct tcs_cmd *cmd, u32 n) +{ + struct rpmh_request *rpm_msg; + + rpm_msg = __get_rpmh_msg_async(state, cmd, n); + if (IS_ERR(rpm_msg)) + return PTR_ERR(rpm_msg); + + return __rpmh_write(dev, state, rpm_msg); +} +EXPORT_SYMBOL(rpmh_write_async); + /** * rpmh_write: Write a set of RPMH commands and block until response * diff --git a/include/soc/qcom/rpmh.h b/include/soc/qcom/rpmh.h index 42e62a0d26d8..1161a5c77e75 100644 --- a/include/soc/qcom/rpmh.h +++ b/include/soc/qcom/rpmh.h @@ -14,6 +14,9 @@ int rpmh_write(const struct device *dev, enum rpmh_state state, const struct tcs_cmd *cmd, u32 n); +int rpmh_write_async(const struct device *dev, enum rpmh_state state, + const struct tcs_cmd *cmd, u32 n); + int rpmh_flush(const struct device *dev); int rpmh_invalidate(const struct device *dev); @@ -24,6 +27,10 @@ static inline int rpmh_write(const struct device *dev, enum rpmh_state state, const struct tcs_cmd *cmd, u32 n) { return -ENODEV; } +static inline int rpmh_write_async(const struct device *dev, + enum rpmh_state state, + const struct tcs_cmd *cmd, u32 n) +{ return -ENODEV; } static inline int rpmh_flush(const struct device *dev) { return -ENODEV; }
Platform drivers that want to send a request but do not want to block until the RPMH request completes have now a new API - rpmh_write_async(). The API allocates memory and send the requests and returns the control back to the platform driver. The tx_done callback from the controller is handled in the context of the controller's thread and frees the allocated memory. This API allows RPMH requests from atomic contexts as well. Signed-off-by: Lina Iyer <ilina@codeaurora.org> --- Changes in v6: - replace rpmh_client with device * --- drivers/soc/qcom/rpmh.c | 52 +++++++++++++++++++++++++++++++++++++++++ include/soc/qcom/rpmh.h | 7 ++++++ 2 files changed, 59 insertions(+)