[PATCH v2 0/6] misc: Add support to Qualcomm FastRPC driver

[PATCH v2 0/6] misc: Add support to Qualcomm FastRPC driver

[Srinivas Kandagatla]

Thanks for reviewing the RFC, here is new version addressing the
comments from RFC.
This patchset adds support to Qualcomm FastRPC driver which implements
an IPC (Inter-Processor Communication) mechanism that allows for clients
to transparently make remote method invocations across processor boundaries.

The below diagram depicts invocation of a single method where the client
and objects reside on different processors. An object could expose
multiple methods which can be grouped together and referred to as an
interface.

: ,--------,        ,------,  ,-----------,  ,------,        ,--------,
: |        | method |      |  |           |  |      | method |        |
: | Client |------->| Stub |->| Transport |->| Skel |------->| Object |
: |        |        |      |  |           |  |      |        |        |
: `--------`        `------`  `-----------`  `------`        `--------`

Client:    Linux user mode process that initiates the remote invocation
Stub:      Auto generated code linked in with the user mode process that
           takes care of marshaling parameters

Transport: Involved in carrying an invocation from a client to an
           object. This involves two portions: 1) FastRPC Linux
           kernel driver that receives the remote invocation, queues
           them up and then waits for the response after signaling the
           remote side. 2) Service running on the remote side that
           dequeues the messages from the queue and dispatches them for
           processing.
Skel:      Auto generated code that takes care of un-marshaling
           parameters
Object:    Method implementation

Most of the work is derived from various downstream Qualcomm kernels.
Credits to various Qualcomm authors who have contributed to this code.
Specially Tharun Kumar Merugu <mtharu@codeaurora.org>

TODO:
 - Support INIT_STATIC process
 - Support remote mmap/unmap methods.
 - Handling secure compute context banks.
 - Add secure buffer support

This patchset has been tested on DB410c(msm8916), DB820c (msm8996), SDM845
Qualcomm SoCs with sample apps like matrix multiply, calculator
from Hexagon SDK. You can find more info on how to test this at:
https://github.com/96boards/documentation/wiki/Dragonboard-Hexagon-DSP

Changes since RFC:
- moved from char to misc driver as suggested by Greg KH
- updated ioctl data structures as suggested by Arnd.
- cleaned up and reorganized most of the code from RFC review comments.


Srinivas Kandagatla (6):
  misc: dt-bindings: Add Qualcomm Fastrpc bindings
  misc: fastrpc: Add Qualcomm fastrpc basic driver model
  misc: fastrpc: Add support for context Invoke method
  misc: fastrpc: Add support for create remote init process
  misc: fastrpc: Add support for dmabuf exporter
  misc: fastrpc: Add support for compat ioctls

 .../devicetree/bindings/misc/qcom,fastrpc.txt |   73 +
 drivers/misc/Kconfig                          |   10 +
 drivers/misc/Makefile                         |    1 +
 drivers/misc/fastrpc.c                        | 1422 +++++++++++++++++
 include/uapi/misc/fastrpc.h                   |   42 +
 5 files changed, 1548 insertions(+)
 create mode 100644 Documentation/devicetree/bindings/misc/qcom,fastrpc.txt
 create mode 100644 drivers/misc/fastrpc.c
 create mode 100644 include/uapi/misc/fastrpc.h

-- 
2.19.2

[PATCH v2 1/6] misc: dt-bindings: Add Qualcomm Fastrpc bindings

[Srinivas Kandagatla]

The FastRPC driver implements an IPC (Inter-Processor Communication)
mechanism that allows for clients to transparently make remote method
invocations across DSP and APPS boundaries. This enables developers
to offload tasks to the DSP and free up the application processor for
other tasks.

Co-developed-by: Thierry Escande <thierry.escande@linaro.org>
Signed-off-by: Thierry Escande <thierry.escande@linaro.org>
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
---
 .../devicetree/bindings/misc/qcom,fastrpc.txt | 73 +++++++++++++++++++
 1 file changed, 73 insertions(+)
 create mode 100644 Documentation/devicetree/bindings/misc/qcom,fastrpc.txt

diff --git a/Documentation/devicetree/bindings/misc/qcom,fastrpc.txt b/Documentation/devicetree/bindings/misc/qcom,fastrpc.txt
new file mode 100644
index 000000000000..06e8c25839d5
--- /dev/null
+++ b/Documentation/devicetree/bindings/misc/qcom,fastrpc.txt
@@ -0,0 +1,73 @@
+Qualcomm Technologies, Inc. FastRPC Driver
+
+The FastRPC driver implements an IPC (Inter-Processor Communication)
+mechanism that allows for clients to transparently make remote method
+invocations across DSP and APPS boundaries. This enables developers
+to offload tasks to the DSP and free up the application processor for
+other tasks.
+
+- compatible:
+	Usage: required
+	Value type: <stringlist>
+	Definition: must be "qcom,fastrpc"
+
+- reg
+	Usage: required
+	Value type: <u32>
+	Definition: DSP Processor ID.
+	Possible values are :
+			0 - ADSP
+			1 - MDSP
+			2 - SDSP
+			3 - CDSP
+
+= COMPUTE BANKS
+Each subnode of the Fastrpc node represents compute context banks available
+on the dsp. The name of the nodes are not important. The properties of these
+nodes are defined by the individual bindings for the specific service
+- All Compute context banks MUST contain the following property:
+
+- compatible:
+	Usage: required
+	Value type: <stringlist>
+	Definition: must be "qcom,fastrpc-compute-cb"
+
+- reg
+	Usage: required
+	Value type: <u32>
+	Definition: Context Bank ID.
+
+- secured:
+	Usage: Optional
+	Value type: <boolean>
+	Defination: Indicating context bank is secured
+
+- nsessions:
+	Usage: Optional
+	Value type: <u32>
+	Defination: A value indicating how many sessions can share this
+		    context bank. Defaults to 'One' when this property
+		    is not specified.
+
+Example:
+
+fastrpc {
+	compatible = "qcom,fastrpc";
+	qcom,smd-channels = "fastrpcsmd-apps-dsp";
+	reg = <0>; /* DOMAIN_ADSP */
+	#address-cells = <1>;
+	#size-cells = <0>;
+
+	cb@1 {
+		compatible = "qcom,fastrpc-compute-cb";
+		reg = <1>;
+		iommus = <&lpass_q6_smmu 1>;
+	};
+
+	cb@2 {
+		compatible = "qcom,fastrpc-compute-cb";
+		reg = <2>;
+		iommus = <&lpass_q6_smmu 2>;
+	};
+	...
+};
-- 
2.19.2

[PATCH v2 2/6] misc: fastrpc: Add Qualcomm fastrpc basic driver model

[Srinivas Kandagatla]

This patch adds basic driver model for qualcomm fastrpc.
Each DSP rpmsg channel is represented as fastrpc channel context and
is exposed as a character driver for userspace interface.
Each compute context bank is represented as fastrpc-session-context,
which are dynamically managed by the channel context char device.

Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Co-developed-by: Thierry Escande <thierry.escande@linaro.org>
Signed-off-by: Thierry Escande <thierry.escande@linaro.org>
---
 drivers/misc/Kconfig   |  10 ++
 drivers/misc/Makefile  |   1 +
 drivers/misc/fastrpc.c | 319 +++++++++++++++++++++++++++++++++++++++++
 3 files changed, 330 insertions(+)
 create mode 100644 drivers/misc/fastrpc.c

diff --git a/drivers/misc/Kconfig b/drivers/misc/Kconfig
index 3726eacdf65d..ad1f8f93a413 100644
--- a/drivers/misc/Kconfig
+++ b/drivers/misc/Kconfig
@@ -295,6 +295,16 @@ config QCOM_COINCELL
 	  to maintain PMIC register and RTC state in the absence of
 	  external power.
 
+config QCOM_FASTRPC
+	tristate "Qualcomm FastRPC"
+	depends on ARCH_QCOM || COMPILE_TEST
+	depends on RPMSG
+	help
+	  Provides a communication mechanism that allows for clients to
+	  make remote method invocations across processor boundary to
+	  applications DSP processor. Say M if you want to enable this
+	  module.
+
 config SGI_GRU
 	tristate "SGI GRU driver"
 	depends on X86_UV && SMP
diff --git a/drivers/misc/Makefile b/drivers/misc/Makefile
index af22bbc3d00c..6f9a79d86c7d 100644
--- a/drivers/misc/Makefile
+++ b/drivers/misc/Makefile
@@ -18,6 +18,7 @@ obj-$(CONFIG_TIFM_CORE)       	+= tifm_core.o
 obj-$(CONFIG_TIFM_7XX1)       	+= tifm_7xx1.o
 obj-$(CONFIG_PHANTOM)		+= phantom.o
 obj-$(CONFIG_QCOM_COINCELL)	+= qcom-coincell.o
+obj-$(CONFIG_QCOM_FASTRPC)	+= fastrpc.o
 obj-$(CONFIG_SENSORS_BH1770)	+= bh1770glc.o
 obj-$(CONFIG_SENSORS_APDS990X)	+= apds990x.o
 obj-$(CONFIG_SGI_IOC4)		+= ioc4.o
diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c
new file mode 100644
index 000000000000..7fc2b381074d
--- /dev/null
+++ b/drivers/misc/fastrpc.c
@@ -0,0 +1,319 @@
+// SPDX-License-Identifier: GPL-2.0
+// Copyright (c) 2011-2018, The Linux Foundation. All rights reserved.
+// Copyright (c) 2018, Linaro Limited
+
+#include <linux/device.h>
+#include <linux/dma-mapping.h>
+#include <linux/idr.h>
+#include <linux/list.h>
+#include <linux/miscdevice.h>
+#include <linux/module.h>
+#include <linux/of_address.h>
+#include <linux/of.h>
+#include <linux/of_platform.h>
+#include <linux/rpmsg.h>
+#include <linux/scatterlist.h>
+#include <linux/slab.h>
+
+#define ADSP_DOMAIN_ID (0)
+#define MDSP_DOMAIN_ID (1)
+#define SDSP_DOMAIN_ID (2)
+#define CDSP_DOMAIN_ID (3)
+#define FASTRPC_DEV_MAX		4 /* adsp, mdsp, slpi, cdsp*/
+#define FASTRPC_MAX_SESSIONS	9 /*8 compute, 1 cpz*/
+#define FASTRPC_CTX_MAX (256)
+#define FASTRPC_CTXID_MASK (0xFF0)
+#define FASTRPC_DEVICE_NAME	"fastrpc"
+
+#define miscdev_to_cctx(d) container_of(d, struct fastrpc_channel_ctx, miscdev)
+
+static const char *domains[FASTRPC_DEV_MAX] = { "adsp", "mdsp",
+						"sdsp", "cdsp"};
+
+struct fastrpc_session_ctx {
+	struct device *dev;
+	int sid;
+	bool used;
+	bool valid;
+	bool secure;
+};
+
+struct fastrpc_channel_ctx {
+	int domain_id;
+	int sesscount;
+	struct rpmsg_device *rpdev;
+	struct fastrpc_session_ctx session[FASTRPC_MAX_SESSIONS];
+	spinlock_t lock;
+	struct idr ctx_idr;
+	struct list_head users;
+	struct miscdevice miscdev;
+};
+
+struct fastrpc_user {
+	struct list_head user;
+	struct list_head maps;
+	struct list_head pending;
+
+	struct fastrpc_channel_ctx *cctx;
+	struct fastrpc_session_ctx *sctx;
+
+	int tgid;
+	int pd;
+	/* Lock for lists */
+	spinlock_t lock;
+	/* lock for allocations */
+	struct mutex mutex;
+};
+
+static struct fastrpc_session_ctx *fastrpc_session_alloc(
+					struct fastrpc_channel_ctx *cctx,
+					int secure)
+{
+	struct fastrpc_session_ctx *session = NULL;
+	int i;
+
+	spin_lock(&cctx->lock);
+	for (i = 0; i < cctx->sesscount; i++) {
+		if (!cctx->session[i].used && cctx->session[i].valid &&
+		    cctx->session[i].secure == secure) {
+			cctx->session[i].used = true;
+			session = &cctx->session[i];
+			break;
+		}
+	}
+	spin_unlock(&cctx->lock);
+
+	return session;
+}
+
+static void fastrpc_session_free(struct fastrpc_channel_ctx *cctx,
+				 struct fastrpc_session_ctx *session)
+{
+	spin_lock(&cctx->lock);
+	session->used = false;
+	spin_unlock(&cctx->lock);
+}
+
+static int fastrpc_device_release(struct inode *inode, struct file *file)
+{
+	struct fastrpc_user *fl = (struct fastrpc_user *)file->private_data;
+	struct fastrpc_channel_ctx *cctx = fl->cctx;
+
+	spin_lock(&cctx->lock);
+	list_del(&fl->user);
+	spin_unlock(&cctx->lock);
+
+	fastrpc_session_free(fl->cctx, fl->sctx);
+
+	mutex_destroy(&fl->mutex);
+	kfree(fl);
+	file->private_data = NULL;
+
+	return 0;
+}
+
+static int fastrpc_device_open(struct inode *inode, struct file *filp)
+{
+	struct fastrpc_channel_ctx *cctx = miscdev_to_cctx(filp->private_data);
+	struct fastrpc_user *fl = NULL;
+
+	fl = kzalloc(sizeof(*fl), GFP_KERNEL);
+	if (!fl)
+		return -ENOMEM;
+
+	filp->private_data = fl;
+	spin_lock_init(&fl->lock);
+	mutex_init(&fl->mutex);
+	INIT_LIST_HEAD(&fl->pending);
+	INIT_LIST_HEAD(&fl->maps);
+	INIT_LIST_HEAD(&fl->user);
+	fl->tgid = current->tgid;
+	fl->cctx = cctx;
+	spin_lock(&cctx->lock);
+	list_add_tail(&fl->user, &cctx->users);
+	spin_unlock(&cctx->lock);
+	fl->sctx = fastrpc_session_alloc(cctx, 0);
+
+	return 0;
+}
+
+static const struct file_operations fastrpc_fops = {
+	.open = fastrpc_device_open,
+	.release = fastrpc_device_release,
+};
+
+static int fastrpc_cb_probe(struct platform_device *pdev)
+{
+	struct fastrpc_channel_ctx *cctx;
+	struct fastrpc_session_ctx *sess;
+	struct device *dev = &pdev->dev;
+	int i, sessions = 0;
+
+	cctx = dev_get_drvdata(dev->parent);
+	if (!cctx)
+		return -EINVAL;
+
+	of_property_read_u32(dev->of_node, "nsessions", &sessions);
+
+	spin_lock(&cctx->lock);
+	sess = &cctx->session[cctx->sesscount];
+	sess->used = false;
+	sess->valid = true;
+	sess->dev = dev;
+	dev_set_drvdata(dev, sess);
+	sess->secure = of_property_read_bool(dev->of_node, "secured");
+
+	if (of_property_read_u32(dev->of_node, "reg", &sess->sid))
+		dev_err(dev, "FastRPC Session ID not specified in DT\n");
+
+	if (sessions > 0) {
+		struct fastrpc_session_ctx *dup_sess;
+
+		for (i = 1; i < sessions; i++) {
+			if (cctx->sesscount++ >= FASTRPC_MAX_SESSIONS)
+				break;
+			dup_sess = &cctx->session[cctx->sesscount];
+			memcpy(dup_sess, sess, sizeof(*dup_sess));
+		}
+	}
+	cctx->sesscount++;
+	spin_unlock(&cctx->lock);
+	dma_set_mask(dev, DMA_BIT_MASK(32));
+
+	return 0;
+}
+
+static int fastrpc_cb_remove(struct platform_device *pdev)
+{
+	struct fastrpc_channel_ctx *cctx = dev_get_drvdata(pdev->dev.parent);
+	struct fastrpc_session_ctx *sess = dev_get_drvdata(&pdev->dev);
+	int i;
+
+	spin_lock(&cctx->lock);
+	for (i = 1; i < FASTRPC_MAX_SESSIONS; i++) {
+		if (cctx->session[i].sid == sess->sid) {
+			cctx->session[i].valid = false;
+			cctx->sesscount--;
+		}
+	}
+	spin_unlock(&cctx->lock);
+
+	return 0;
+}
+
+static const struct of_device_id fastrpc_match_table[] = {
+	{ .compatible = "qcom,fastrpc-compute-cb", },
+	{}
+};
+
+static struct platform_driver fastrpc_cb_driver = {
+	.probe = fastrpc_cb_probe,
+	.remove = fastrpc_cb_remove,
+	.driver = {
+		.name = "qcom,fastrpc-cb",
+		.of_match_table = fastrpc_match_table,
+		.suppress_bind_attrs = true,
+	},
+};
+
+static int fastrpc_rpmsg_probe(struct rpmsg_device *rpdev)
+{
+	struct device *rdev = &rpdev->dev;
+	struct fastrpc_channel_ctx *data;
+	int err, domain_id;
+
+	data = devm_kzalloc(rdev, sizeof(*data), GFP_KERNEL);
+	if (!data)
+		return -ENOMEM;
+
+	err = of_property_read_u32(rdev->of_node, "reg", &domain_id);
+	if (err) {
+		dev_err(rdev, "FastRPC Domain ID not specified in DT\n");
+		return err;
+	}
+
+	if (domain_id > CDSP_DOMAIN_ID) {
+		dev_err(rdev, "FastRPC Invalid Domain ID %d\n", domain_id);
+		return -EINVAL;
+	}
+
+	data->miscdev.minor = MISC_DYNAMIC_MINOR;
+	data->miscdev.name = kasprintf(GFP_KERNEL, "fastrpc-%s",
+				domains[domain_id]);
+	data->miscdev.fops = &fastrpc_fops;
+	err = misc_register(&data->miscdev);
+	if (err)
+		return err;
+
+	dev_set_drvdata(&rpdev->dev, data);
+	dma_set_mask_and_coherent(rdev, DMA_BIT_MASK(32));
+	INIT_LIST_HEAD(&data->users);
+	spin_lock_init(&data->lock);
+	idr_init(&data->ctx_idr);
+	data->domain_id = domain_id;
+	data->rpdev = rpdev;
+
+	return of_platform_populate(rdev->of_node, NULL, NULL, rdev);
+}
+
+static void fastrpc_rpmsg_remove(struct rpmsg_device *rpdev)
+{
+	struct fastrpc_channel_ctx *cctx = dev_get_drvdata(&rpdev->dev);
+
+	misc_deregister(&cctx->miscdev);
+	of_platform_depopulate(&rpdev->dev);
+	kfree(cctx);
+}
+
+static int fastrpc_rpmsg_callback(struct rpmsg_device *rpdev, void *data,
+				  int len, void *priv, u32 addr)
+{
+	return 0;
+}
+
+static const struct of_device_id fastrpc_rpmsg_of_match[] = {
+	{ .compatible = "qcom,fastrpc" },
+	{ },
+};
+MODULE_DEVICE_TABLE(of, fastrpc_rpmsg_of_match);
+
+static struct rpmsg_driver fastrpc_driver = {
+	.probe = fastrpc_rpmsg_probe,
+	.remove = fastrpc_rpmsg_remove,
+	.callback = fastrpc_rpmsg_callback,
+	.drv = {
+		.name = "qcom,fastrpc",
+		.of_match_table = fastrpc_rpmsg_of_match,
+	},
+};
+
+static int fastrpc_init(void)
+{
+	int ret;
+
+	ret = platform_driver_register(&fastrpc_cb_driver);
+	if (ret < 0) {
+		pr_err("fastrpc: failed to register cb driver\n");
+		return ret;
+	}
+
+	ret = register_rpmsg_driver(&fastrpc_driver);
+	if (ret < 0) {
+		pr_err("fastrpc: failed to register rpmsg driver\n");
+		platform_driver_unregister(&fastrpc_cb_driver);
+		return ret;
+	}
+
+	return 0;
+}
+module_init(fastrpc_init);
+
+static void fastrpc_exit(void)
+{
+	platform_driver_unregister(&fastrpc_cb_driver);
+	unregister_rpmsg_driver(&fastrpc_driver);
+}
+module_exit(fastrpc_exit);
+
+MODULE_ALIAS("fastrpc:fastrpc");
+MODULE_LICENSE("GPL v2");
-- 
2.19.2

[PATCH v2 3/6] misc: fastrpc: Add support for context Invoke method

[Srinivas Kandagatla]

This patch adds support to compute context invoke method
on the remote processor (DSP).
This involves setting up the functions input and output arguments,
input and output handles and mapping the dmabuf fd for the
argument/handle buffers.

Most of the work is derived from various downstream Qualcomm kernels.
Credits to various Qualcomm authors who have contributed to this code.
Specially Tharun Kumar Merugu <mtharu@codeaurora.org>

Co-developed-by: Thierry Escande <thierry.escande@linaro.org>
Signed-off-by: Thierry Escande <thierry.escande@linaro.org>
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
---
 drivers/misc/fastrpc.c      | 716 ++++++++++++++++++++++++++++++++++++
 include/uapi/misc/fastrpc.h |  22 ++
 2 files changed, 738 insertions(+)
 create mode 100644 include/uapi/misc/fastrpc.h

diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c
index 7fc2b381074d..46435813785d 100644
--- a/drivers/misc/fastrpc.c
+++ b/drivers/misc/fastrpc.c
@@ -2,7 +2,9 @@
 // Copyright (c) 2011-2018, The Linux Foundation. All rights reserved.
 // Copyright (c) 2018, Linaro Limited
 
+#include <linux/completion.h>
 #include <linux/device.h>
+#include <linux/dma-buf.h>
 #include <linux/dma-mapping.h>
 #include <linux/idr.h>
 #include <linux/list.h>
@@ -14,6 +16,7 @@
 #include <linux/rpmsg.h>
 #include <linux/scatterlist.h>
 #include <linux/slab.h>
+#include <uapi/misc/fastrpc.h>
 
 #define ADSP_DOMAIN_ID (0)
 #define MDSP_DOMAIN_ID (1)
@@ -21,14 +24,119 @@
 #define CDSP_DOMAIN_ID (3)
 #define FASTRPC_DEV_MAX		4 /* adsp, mdsp, slpi, cdsp*/
 #define FASTRPC_MAX_SESSIONS	9 /*8 compute, 1 cpz*/
+#define FASTRPC_ALIGN		128
+#define FASTRPC_MAX_FDLIST	16
+#define FASTRPC_MAX_CRCLIST	64
+#define FASTRPC_PHYS(p)	((p) & 0xffffffff)
 #define FASTRPC_CTX_MAX (256)
 #define FASTRPC_CTXID_MASK (0xFF0)
 #define FASTRPC_DEVICE_NAME	"fastrpc"
 
+/* Retrives number of input buffers from the scalars parameter */
+#define REMOTE_SCALARS_INBUFS(sc)	(((sc) >> 16) & 0x0ff)
+
+/* Retrives number of output buffers from the scalars parameter */
+#define REMOTE_SCALARS_OUTBUFS(sc)	(((sc) >> 8) & 0x0ff)
+
+/* Retrives number of input handles from the scalars parameter */
+#define REMOTE_SCALARS_INHANDLES(sc)	(((sc) >> 4) & 0x0f)
+
+/* Retrives number of output handles from the scalars parameter */
+#define REMOTE_SCALARS_OUTHANDLES(sc)	((sc) & 0x0f)
+
+#define REMOTE_SCALARS_LENGTH(sc)	(REMOTE_SCALARS_INBUFS(sc) +   \
+					 REMOTE_SCALARS_OUTBUFS(sc) +  \
+					 REMOTE_SCALARS_INHANDLES(sc)+ \
+					 REMOTE_SCALARS_OUTHANDLES(sc))
+
+#define FASTRPC_BUILD_SCALARS(attr, method, in, out, oin, oout) \
+		((((uint32_t)  (attr) & 0x07) << 29) | \
+		(((uint32_t) (method) & 0x1f) << 24) | \
+		(((uint32_t)     (in) & 0xff) << 16) | \
+		(((uint32_t)    (out) & 0xff) <<  8) | \
+		(((uint32_t)    (oin) & 0x0f) <<  4) | \
+		((uint32_t)    (oout) & 0x0f))
+
+#define FASTRPC_SCALARS(method, in, out) \
+		FASTRPC_BUILD_SCALARS(0, method, in, out, 0, 0)
+
 #define miscdev_to_cctx(d) container_of(d, struct fastrpc_channel_ctx, miscdev)
 
 static const char *domains[FASTRPC_DEV_MAX] = { "adsp", "mdsp",
 						"sdsp", "cdsp"};
+struct fastrpc_phy_page {
+	uint64_t addr;		/* physical address */
+	uint64_t size;		/* size of contiguous region */
+};
+
+struct fastrpc_invoke_buf {
+	int num;		/* number of contiguous regions */
+	int pgidx;		/* index to start of contiguous region */
+};
+
+struct fastrpc_remote_arg {
+	uint64_t pv;
+	uint64_t len;
+};
+
+struct fastrpc_msg {
+	uint32_t pid;		/* process group id */
+	uint32_t tid;		/* thread id */
+	uint64_t ctx;		/* invoke caller context */
+	uint32_t handle;	/* handle to invoke */
+	uint32_t sc;		/* scalars structure describing the data */
+	uint64_t addr;		/* physical address */
+	uint64_t size;		/* size of contiguous region */
+};
+
+struct fastrpc_invoke_rsp {
+	uint64_t ctx;		/* invoke caller context */
+	int retval;		/* invoke return value */
+};
+
+struct fastrpc_buf {
+	struct fastrpc_user *fl;
+	struct device *dev;
+	void *virt;
+	uint64_t phys;
+	size_t size;
+};
+
+struct fastrpc_map {
+	struct list_head node;
+	struct fastrpc_user *fl;
+	int fd;
+	struct dma_buf *buf;
+	struct sg_table *table;
+	struct dma_buf_attachment *attach;
+	uint64_t phys;
+	size_t size;
+	void *va;
+	size_t len;
+	struct kref refcount;
+};
+
+struct fastrpc_invoke_ctx {
+	struct fastrpc_user *fl;
+	struct list_head node; /* list of ctxs */
+	struct completion work;
+	int retval;
+	int pid;
+	int tgid;
+	uint32_t sc;
+	struct fastrpc_msg msg;
+	uint64_t ctxid;
+	size_t used_sz;
+
+	int nscalars;
+	int nbufs;
+	uint32_t *crc;
+
+	struct fastrpc_remote_arg *rpra;
+	struct fastrpc_map **maps;
+	struct fastrpc_buf *buf;
+	struct fastrpc_invoke_args *args;
+};
 
 struct fastrpc_session_ctx {
 	struct device *dev;
@@ -56,6 +164,7 @@ struct fastrpc_user {
 
 	struct fastrpc_channel_ctx *cctx;
 	struct fastrpc_session_ctx *sctx;
+	struct fastrpc_buf *init_mem;
 
 	int tgid;
 	int pd;
@@ -65,6 +174,508 @@ struct fastrpc_user {
 	struct mutex mutex;
 };
 
+static void fastrpc_free_map(struct kref *ref)
+{
+	struct fastrpc_map *map;
+
+	map = container_of(ref, struct fastrpc_map, refcount);
+
+	list_del(&map->node);
+
+	if (map->table) {
+		dma_buf_unmap_attachment(map->attach, map->table,
+					 DMA_BIDIRECTIONAL);
+		dma_buf_detach(map->buf, map->attach);
+		dma_buf_put(map->buf);
+	}
+
+	kfree(map);
+}
+
+static void fastrpc_map_put(struct fastrpc_map *map)
+{
+	struct fastrpc_user *fl;
+
+	if (map) {
+		fl = map->fl;
+		mutex_lock(&fl->mutex);
+		kref_put(&map->refcount, fastrpc_free_map);
+		mutex_unlock(&fl->mutex);
+	}
+}
+
+static int fastrpc_map_get(struct fastrpc_user *fl, int fd, size_t len,
+			   struct fastrpc_map **ppmap)
+{
+	struct fastrpc_map *map = NULL, *n;
+
+	mutex_lock(&fl->mutex);
+	list_for_each_entry_safe(map, n, &fl->maps, node) {
+		if (map->fd == fd) {
+			kref_get(&map->refcount);
+			*ppmap = map;
+			mutex_unlock(&fl->mutex);
+			return 0;
+		}
+	}
+	mutex_unlock(&fl->mutex);
+
+	return -ENOENT;
+}
+
+static void fastrpc_buf_free(struct fastrpc_buf *buf)
+{
+	dma_free_coherent(buf->dev, buf->size, buf->virt,
+			  FASTRPC_PHYS(buf->phys));
+	kfree(buf);
+}
+
+static int fastrpc_buf_alloc(struct fastrpc_user *fl, struct device *dev,
+			     size_t size, struct fastrpc_buf **obuf)
+{
+	struct fastrpc_buf *buf;
+
+	buf = kzalloc(sizeof(*buf), GFP_KERNEL);
+	if (!buf)
+		return -ENOMEM;
+
+	buf->fl = fl;
+	buf->virt = NULL;
+	buf->phys = 0;
+	buf->size = size;
+	buf->dev = dev;
+
+	buf->virt = dma_alloc_coherent(dev, buf->size, (dma_addr_t *)&buf->phys,
+				       GFP_KERNEL);
+	if (!buf->virt)
+		return -ENOMEM;
+
+	if (fl->sctx && fl->sctx->sid)
+		buf->phys += ((uint64_t)fl->sctx->sid << 32);
+
+	*obuf = buf;
+
+	return 0;
+}
+
+static void fastrpc_context_free(struct fastrpc_invoke_ctx *ctx)
+{
+	struct fastrpc_channel_ctx *cctx = ctx->fl->cctx;
+	struct fastrpc_user *user = ctx->fl;
+	int scalars = REMOTE_SCALARS_LENGTH(ctx->sc);
+	int i;
+
+	spin_lock(&user->lock);
+	list_del(&ctx->node);
+	spin_unlock(&user->lock);
+
+	for (i = 0; i < scalars; i++) {
+		if (ctx->maps[i])
+			fastrpc_map_put(ctx->maps[i]);
+	}
+
+	if (ctx->buf)
+		fastrpc_buf_free(ctx->buf);
+
+	spin_lock(&cctx->lock);
+	idr_remove(&cctx->ctx_idr, ctx->ctxid >> 4);
+	spin_unlock(&cctx->lock);
+
+	kfree(ctx->maps);
+	kfree(ctx);
+}
+
+static struct fastrpc_invoke_ctx *
+fastrpc_context_alloc(struct fastrpc_user *user, uint32_t kernel,
+		      struct fastrpc_invoke *inv)
+{
+	struct fastrpc_channel_ctx *cctx = user->cctx;
+	struct fastrpc_invoke_ctx *ctx = NULL;
+	int bufs, ret;
+	int err = 0;
+
+	bufs = REMOTE_SCALARS_LENGTH(inv->sc);
+	ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
+	if (!ctx)
+		return ERR_PTR(-ENOMEM);
+
+	INIT_LIST_HEAD(&ctx->node);
+	ctx->fl = user;
+	ctx->nscalars = bufs;
+	ctx->nbufs = REMOTE_SCALARS_INBUFS(inv->sc) +
+		     REMOTE_SCALARS_OUTBUFS(inv->sc);
+
+	if (ctx->nscalars) {
+		ctx->maps = kcalloc(ctx->nscalars,
+				    sizeof(*ctx->maps), GFP_KERNEL);
+		if (!ctx->maps) {
+			kfree(ctx);
+			return ERR_PTR(-ENOMEM);
+		}
+		ctx->args = inv->args;
+	}
+
+	ctx->sc = inv->sc;
+	ctx->retval = -1;
+	ctx->pid = current->pid;
+	ctx->tgid = user->tgid;
+	init_completion(&ctx->work);
+
+	spin_lock(&user->lock);
+	list_add_tail(&ctx->node, &user->pending);
+	spin_unlock(&user->lock);
+
+	spin_lock(&cctx->lock);
+	ret = idr_alloc_cyclic(&cctx->ctx_idr, ctx, 1,
+			       FASTRPC_CTX_MAX, GFP_ATOMIC);
+	if (ret < 0) {
+		spin_unlock(&cctx->lock);
+		err = ret;
+		goto err_idr;
+	}
+	ctx->ctxid = ret << 4;
+	spin_unlock(&cctx->lock);
+
+	return ctx;
+err_idr:
+	spin_lock(&user->lock);
+	list_del(&ctx->node);
+	spin_unlock(&user->lock);
+	kfree(ctx->maps);
+	kfree(ctx);
+
+	return ERR_PTR(err);
+}
+
+static int fastrpc_map_create(struct fastrpc_user *fl, int fd,
+			      size_t len, struct fastrpc_map **ppmap)
+{
+	struct fastrpc_session_ctx *sess = fl->sctx;
+	struct fastrpc_map *map = NULL;
+	int err = 0;
+
+	if (!fastrpc_map_get(fl, fd, len, ppmap))
+		return 0;
+
+	map = kzalloc(sizeof(*map), GFP_KERNEL);
+	if (!map)
+		return -ENOMEM;
+
+	INIT_LIST_HEAD(&map->node);
+	map->fl = fl;
+	map->fd = fd;
+	map->buf = dma_buf_get(fd);
+	if (!map->buf) {
+		err = -EINVAL;
+		goto get_err;
+	}
+
+	map->attach = dma_buf_attach(map->buf, sess->dev);
+	if (IS_ERR(map->attach)) {
+		dev_err(sess->dev, "Failed to attach dmabuf\n");
+		err = PTR_ERR(map->attach);
+		goto attach_err;
+	}
+
+	map->table = dma_buf_map_attachment(map->attach, DMA_BIDIRECTIONAL);
+	if (IS_ERR(map->table)) {
+		err = PTR_ERR(map->table);
+		goto map_err;
+	}
+
+	map->phys = sg_dma_address(map->table->sgl);
+	map->phys += ((uint64_t)fl->sctx->sid << 32);
+	map->size = len;
+	map->va = sg_virt(map->table->sgl);
+	map->len = len;
+	kref_init(&map->refcount);
+
+	spin_lock(&fl->lock);
+	list_add_tail(&map->node, &fl->maps);
+	spin_unlock(&fl->lock);
+	*ppmap = map;
+
+	return 0;
+
+map_err:
+	dma_buf_detach(map->buf, map->attach);
+attach_err:
+	dma_buf_put(map->buf);
+get_err:
+	kfree(map);
+
+	return err;
+}
+
+/*
+ * Fastrpc payload buffer with metadata looks like:
+ *
+ * >>>>>>  START of METADATA <<<<<<<<<
+ * +---------------------------------+
+ * |           Arguments             |
+ * | type:(struct fastrpc_remote_arg)|
+ * |             (0 - N)             |
+ * +---------------------------------+
+ * |         Invoke Buffer list      |
+ * | type:(struct fastrpc_invoke_buf)|
+ * |           (0 - N)               |
+ * +---------------------------------+
+ * |         Page info list          |
+ * | type:(struct fastrpc_phy_page)  |
+ * |             (0 - N)             |
+ * +---------------------------------+
+ * |         Optional info           |
+ * |(can be specific to SoC/Firmware)|
+ * +---------------------------------+
+ * >>>>>>>>  END of METADATA <<<<<<<<<
+ * +---------------------------------+
+ * |         Inline ARGS             |
+ * |            (0-N)                |
+ * +---------------------------------+
+ */
+
+static int fastrpc_get_meta_size(struct fastrpc_invoke_ctx *ctx)
+{
+	int size = 0;
+
+	size = (sizeof(struct fastrpc_remote_arg) +
+		sizeof(struct fastrpc_invoke_buf) +
+		sizeof(struct fastrpc_phy_page)) * ctx->nscalars +
+		sizeof(uint64_t) * FASTRPC_MAX_FDLIST +
+		sizeof(uint32_t) * FASTRPC_MAX_CRCLIST;
+
+	return size;
+}
+
+static int fastrpc_get_payload_size(struct fastrpc_invoke_ctx *ctx, int metalen)
+{
+	int i, size = 0;
+
+	size = ALIGN(metalen, FASTRPC_ALIGN);
+	for (i = 0; i < ctx->nscalars; i++) {
+		if (ctx->args[i].fd == 0 || ctx->args[i].fd == -1) {
+			size = ALIGN(size, FASTRPC_ALIGN);
+			size += ctx->args[i].length;
+		}
+	}
+
+	return size;
+}
+
+static int fastrpc_create_maps(struct fastrpc_invoke_ctx *ctx)
+{
+	struct device *dev = ctx->fl->sctx->dev;
+	int i, err;
+
+	for (i = 0; i < ctx->nscalars; ++i) {
+		if (ctx->args[i].fd == 0 || ctx->args[i].fd == -1 ||
+		    ctx->args[i].length == 0)
+			continue;
+
+		err = fastrpc_map_create(ctx->fl, ctx->args[i].fd,
+					 ctx->args[i].length, &ctx->maps[i]);
+		if (err) {
+			dev_err(dev, "Error Creating map %d\n", err);
+			return -EINVAL;
+		}
+
+	}
+	return 0;
+}
+
+static int fastrpc_get_args(uint32_t kernel, struct fastrpc_invoke_ctx *ctx)
+{
+	struct device *dev = ctx->fl->sctx->dev;
+	struct fastrpc_remote_arg *rpra;
+	struct fastrpc_invoke_buf *list;
+	struct fastrpc_phy_page *pages;
+	uintptr_t args;
+	size_t rlen = 0, pkt_size = 0, metalen = 0;
+	int inbufs, i, err = 0;
+
+	inbufs = REMOTE_SCALARS_INBUFS(ctx->sc);
+	metalen = fastrpc_get_meta_size(ctx);
+	pkt_size = fastrpc_get_payload_size(ctx, metalen);
+	fastrpc_create_maps(ctx);
+	ctx->used_sz = pkt_size;
+
+	err = fastrpc_buf_alloc(ctx->fl, dev, pkt_size, &ctx->buf);
+	if (err)
+		goto bail;
+
+	rpra = ctx->buf->virt;
+	list = ctx->buf->virt + ctx->nscalars * sizeof(*rpra);
+	pages = ctx->buf->virt + ctx->nscalars * (sizeof(*list) +
+		sizeof(*rpra));
+	args = (uintptr_t)ctx->buf->virt + metalen;
+	rlen = pkt_size - metalen;
+	ctx->rpra = rpra;
+
+	for (i = 0; i < ctx->nbufs; ++i) {
+		size_t len = ctx->args[i].length;
+
+		rpra[i].pv = 0;
+		rpra[i].len = len;
+		list[i].num = len ? 1 : 0;
+		list[i].pgidx = i;
+
+		if (!len)
+			continue;
+
+		pages[i].size = roundup(len, PAGE_SIZE);
+
+		if (ctx->maps[i]) {
+			rpra[i].pv = (uint64_t) ctx->args[i].ptr;
+			pages[i].addr = ctx->maps[i]->phys;
+		} else {
+			rlen -= ALIGN(args, FASTRPC_ALIGN) - args;
+			args = ALIGN(args, FASTRPC_ALIGN);
+			if (rlen < len)
+				goto bail;
+
+			rpra[i].pv = (args);
+			pages[i].addr = ctx->buf->phys + (pkt_size - rlen);
+			pages[i].addr = pages[i].addr &	PAGE_MASK;
+			args = args + len;
+			rlen -= len;
+		}
+
+		if (i < inbufs && !ctx->maps[i]) {
+			if (!kernel) {
+				err = copy_from_user((void *)rpra[i].pv,
+					     (void __user *)ctx->args[i].ptr,
+					     ctx->args[i].length);
+				if (err)
+					goto bail;
+			} else {
+				memcpy((void *)rpra[i].pv, ctx->args[i].ptr,
+				       ctx->args[i].length);
+			}
+		}
+	}
+
+	for (i = ctx->nbufs; i < ctx->nscalars; ++i) {
+		rpra[i].pv = (uint64_t) ctx->args[i].ptr;
+		rpra[i].len = ctx->args[i].length;
+		list[i].num = ctx->args[i].length ? 1 : 0;
+		list[i].pgidx = i;
+		pages[i].addr = ctx->maps[i]->phys;
+		pages[i].size = ctx->maps[i]->size;
+	}
+
+bail:
+	if (err)
+		dev_err(dev, "Error: get invoke args failed:%d\n", err);
+
+	return err;
+}
+
+static int fastrpc_put_args(struct fastrpc_invoke_ctx *ctx,
+			    uint32_t kernel)
+{
+	struct fastrpc_remote_arg *rpra = ctx->rpra;
+	struct device *dev = ctx->fl->sctx->dev;
+	int i, inbufs, err;
+
+	inbufs = REMOTE_SCALARS_INBUFS(ctx->sc);
+
+	for (i = inbufs; i < ctx->nbufs; ++i) {
+		if (ctx->maps[i]) {
+			fastrpc_map_put(ctx->maps[i]);
+			ctx->maps[i] = NULL;
+			continue;
+		}
+
+		if (!kernel) {
+			err = copy_to_user((void __user *)ctx->args[i].ptr,
+					  (void  *)rpra[i].pv, rpra[i].len);
+			if (err) {
+				dev_err(dev, "Error: copy buffer %d\n", err);
+				return err;
+			}
+		} else {
+			memcpy(ctx->args[i].ptr, (void *)rpra[i].pv,
+			       rpra[i].len);
+		}
+	}
+
+	return 0;
+}
+
+static int fastrpc_invoke_send(struct fastrpc_session_ctx *sctx,
+			       struct fastrpc_invoke_ctx *ctx,
+			       uint32_t kernel, uint32_t handle)
+{
+	struct fastrpc_channel_ctx *cctx;
+	struct fastrpc_user *fl = ctx->fl;
+	struct fastrpc_msg *msg = &ctx->msg;
+
+	cctx = fl->cctx;
+	msg->pid = fl->tgid;
+	msg->tid = current->pid;
+
+	if (kernel)
+		msg->pid = 0;
+
+	msg->ctx = ctx->ctxid | fl->pd;
+	msg->handle = handle;
+	msg->sc = ctx->sc;
+	msg->addr = ctx->buf ? ctx->buf->phys : 0;
+	msg->size = roundup(ctx->used_sz, PAGE_SIZE);
+
+	return rpmsg_send(cctx->rpdev->ept, (void *)msg, sizeof(*msg));
+}
+
+static int fastrpc_internal_invoke(struct fastrpc_user *fl,
+				   uint32_t kernel,
+				   struct fastrpc_invoke *inv)
+{
+	struct fastrpc_invoke_ctx *ctx = NULL;
+	int err = 0;
+
+	if (!fl->sctx)
+		return -EINVAL;
+
+	ctx = fastrpc_context_alloc(fl, kernel, inv);
+	if (IS_ERR(ctx))
+		return PTR_ERR(ctx);
+
+	if (ctx->nscalars) {
+		err = fastrpc_get_args(kernel, ctx);
+		if (err)
+			goto bail;
+	}
+	/* Send invoke buffer to remote dsp */
+	err = fastrpc_invoke_send(fl->sctx, ctx, kernel, inv->handle);
+	if (err)
+		goto bail;
+
+	/* Wait for remote dsp to respond or time out */
+	err = wait_for_completion_interruptible(&ctx->work);
+	if (err)
+		goto bail;
+
+	/* Check the response from remote dsp */
+	err = ctx->retval;
+	if (err)
+		goto bail;
+
+	/* populate all the output buffers with results */
+	err = fastrpc_put_args(ctx, kernel);
+	if (err)
+		goto bail;
+
+	/* We are done with this compute, release it now! */
+bail:
+	if (ctx)
+		fastrpc_context_free(ctx);
+
+	if (err)
+		dev_err(fl->sctx->dev, "Error: Invoke Failed %d\n", err);
+
+	return err;
+}
+
 static struct fastrpc_session_ctx *fastrpc_session_alloc(
 					struct fastrpc_channel_ctx *cctx,
 					int secure)
@@ -98,11 +709,22 @@ static int fastrpc_device_release(struct inode *inode, struct file *file)
 {
 	struct fastrpc_user *fl = (struct fastrpc_user *)file->private_data;
 	struct fastrpc_channel_ctx *cctx = fl->cctx;
+	struct fastrpc_invoke_ctx *ctx, *n;
+	struct fastrpc_map *map, *m;
 
 	spin_lock(&cctx->lock);
 	list_del(&fl->user);
 	spin_unlock(&cctx->lock);
 
+	if (fl->init_mem)
+		fastrpc_buf_free(fl->init_mem);
+
+	list_for_each_entry_safe(ctx, n, &fl->pending, node)
+		fastrpc_context_free(ctx);
+
+	list_for_each_entry_safe(map, m, &fl->maps, node)
+		fastrpc_map_put(map);
+
 	fastrpc_session_free(fl->cctx, fl->sctx);
 
 	mutex_destroy(&fl->mutex);
@@ -137,9 +759,62 @@ static int fastrpc_device_open(struct inode *inode, struct file *filp)
 	return 0;
 }
 
+static long fastrpc_invoke(struct fastrpc_user *fl, char __user *argp)
+{
+	struct fastrpc_invoke_args *args = NULL;
+	struct fastrpc_invoke inv;
+	int nscalars, err;
+
+	if (copy_from_user(&inv, argp, sizeof(inv)))
+		return -EFAULT;
+
+	nscalars = REMOTE_SCALARS_LENGTH(inv.sc);
+	if (nscalars) {
+		args = kcalloc(nscalars, sizeof(*args), GFP_KERNEL);
+		if (!args)
+			return -ENOMEM;
+
+		if (copy_from_user(args, (void __user *)inv.args,
+				   nscalars * sizeof(*args))) {
+			kfree(args);
+			return -EFAULT;
+		}
+	}
+
+	inv.args = args;
+	err = fastrpc_internal_invoke(fl, 0, &inv);
+	kfree(args);
+
+	return err;
+}
+
+static long fastrpc_device_ioctl(struct file *file, unsigned int cmd,
+				 unsigned long arg)
+{
+	struct fastrpc_user *fl = (struct fastrpc_user *)file->private_data;
+	char __user *argp = (char __user *)arg;
+	int err;
+
+	switch (cmd) {
+	case FASTRPC_IOCTL_INVOKE:
+		err = fastrpc_invoke(fl, argp);
+		break;
+	default:
+		err = -ENOTTY;
+		dev_err(fl->sctx->dev, "bad ioctl: %d\n", cmd);
+		break;
+	}
+
+	if (err)
+		dev_err(fl->sctx->dev, "Error: IOCTL Failed with %d\n", err);
+
+	return err;
+}
+
 static const struct file_operations fastrpc_fops = {
 	.open = fastrpc_device_open,
 	.release = fastrpc_device_release,
+	.unlocked_ioctl = fastrpc_device_ioctl,
 };
 
 static int fastrpc_cb_probe(struct platform_device *pdev)
@@ -256,9 +931,25 @@ static int fastrpc_rpmsg_probe(struct rpmsg_device *rpdev)
 	return of_platform_populate(rdev->of_node, NULL, NULL, rdev);
 }
 
+static void fastrpc_notify_users(struct fastrpc_user *user)
+{
+	struct fastrpc_invoke_ctx *ctx, *n;
+
+	spin_lock(&user->lock);
+	list_for_each_entry_safe(ctx, n, &user->pending, node)
+		complete(&ctx->work);
+	spin_unlock(&user->lock);
+}
+
 static void fastrpc_rpmsg_remove(struct rpmsg_device *rpdev)
 {
 	struct fastrpc_channel_ctx *cctx = dev_get_drvdata(&rpdev->dev);
+	struct fastrpc_user *user, *n;
+
+	spin_lock(&cctx->lock);
+	list_for_each_entry_safe(user, n, &cctx->users, user)
+		fastrpc_notify_users(user);
+	spin_unlock(&cctx->lock);
 
 	misc_deregister(&cctx->miscdev);
 	of_platform_depopulate(&rpdev->dev);
@@ -268,6 +959,31 @@ static void fastrpc_rpmsg_remove(struct rpmsg_device *rpdev)
 static int fastrpc_rpmsg_callback(struct rpmsg_device *rpdev, void *data,
 				  int len, void *priv, u32 addr)
 {
+	struct fastrpc_channel_ctx *cctx = dev_get_drvdata(&rpdev->dev);
+	struct fastrpc_invoke_rsp *rsp = data;
+	struct fastrpc_invoke_ctx *ctx;
+	unsigned long flags;
+	int ctxid;
+
+	if (rsp && len < sizeof(*rsp)) {
+		dev_err(&rpdev->dev, "invalid response or context\n");
+		return -EINVAL;
+	}
+
+	ctxid = (uint32_t)((rsp->ctx & FASTRPC_CTXID_MASK) >> 4);
+
+	spin_lock_irqsave(&cctx->lock, flags);
+	ctx = idr_find(&cctx->ctx_idr, ctxid);
+	spin_unlock_irqrestore(&cctx->lock, flags);
+
+	if (!ctx) {
+		dev_err(&rpdev->dev, "No context ID matches response\n");
+		return -ENOENT;
+	}
+
+	ctx->retval = rsp->retval;
+	complete(&ctx->work);
+
 	return 0;
 }
 
diff --git a/include/uapi/misc/fastrpc.h b/include/uapi/misc/fastrpc.h
new file mode 100644
index 000000000000..0b408ba62482
--- /dev/null
+++ b/include/uapi/misc/fastrpc.h
@@ -0,0 +1,22 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+
+#ifndef __QCOM_FASTRPC_H__
+#define __QCOM_FASTRPC_H__
+
+#include <linux/types.h>
+
+#define FASTRPC_IOCTL_INVOKE		_IOWR('R', 3, struct fastrpc_invoke)
+
+struct fastrpc_invoke_args {
+	__s32 fd;
+	size_t length;
+	void *ptr;
+};
+
+struct fastrpc_invoke {
+	__u32 handle;
+	__u32 sc;
+	struct fastrpc_invoke_args *args;
+};
+
+#endif /* __QCOM_FASTRPC_H__ */
-- 
2.19.2

[PATCH v2 4/6] misc: fastrpc: Add support for create remote init process

[Srinivas Kandagatla]

This patch adds support to create or attach remote shell process.
The shell process called fastrpc_shell_0 is usually loaded on the DSP
when a user process is spawned.

Most of the work is derived from various downstream Qualcomm kernels.
Credits to various Qualcomm authors who have contributed to this code.
Specially Tharun Kumar Merugu <mtharu@codeaurora.org>

Co-developed-by: Thierry Escande <thierry.escande@linaro.org>
Signed-off-by: Thierry Escande <thierry.escande@linaro.org>
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
---
 drivers/misc/fastrpc.c      | 140 ++++++++++++++++++++++++++++++++++++
 include/uapi/misc/fastrpc.h |  12 ++++
 2 files changed, 152 insertions(+)

diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c
index 46435813785d..fda674e9efe2 100644
--- a/drivers/misc/fastrpc.c
+++ b/drivers/misc/fastrpc.c
@@ -29,7 +29,10 @@
 #define FASTRPC_MAX_CRCLIST	64
 #define FASTRPC_PHYS(p)	((p) & 0xffffffff)
 #define FASTRPC_CTX_MAX (256)
+#define FASTRPC_INIT_HANDLE	1
 #define FASTRPC_CTXID_MASK (0xFF0)
+#define INIT_FILELEN_MAX (2 * 1024 * 1024)
+#define INIT_MEMLEN_MAX  (8 * 1024 * 1024)
 #define FASTRPC_DEVICE_NAME	"fastrpc"
 
 /* Retrives number of input buffers from the scalars parameter */
@@ -60,6 +63,13 @@
 #define FASTRPC_SCALARS(method, in, out) \
 		FASTRPC_BUILD_SCALARS(0, method, in, out, 0, 0)
 
+/* Remote Method id table */
+#define FASTRPC_RMID_INIT_ATTACH	0
+#define FASTRPC_RMID_INIT_RELEASE	1
+#define FASTRPC_RMID_INIT_CREATE	6
+#define FASTRPC_RMID_INIT_CREATE_ATTR	7
+#define FASTRPC_RMID_INIT_CREATE_STATIC	8
+
 #define miscdev_to_cctx(d) container_of(d, struct fastrpc_channel_ctx, miscdev)
 
 static const char *domains[FASTRPC_DEV_MAX] = { "adsp", "mdsp",
@@ -676,6 +686,94 @@ static int fastrpc_internal_invoke(struct fastrpc_user *fl,
 	return err;
 }
 
+static long fastrpc_init_create_process(struct fastrpc_user *fl,
+					char __user *argp)
+{
+	struct fastrpc_init_create init;
+	struct fastrpc_invoke_args args[6];
+	struct fastrpc_phy_page pages[1];
+	struct fastrpc_invoke inv;
+	struct fastrpc_map *map = NULL;
+	struct fastrpc_buf *imem = NULL;
+	int err, memlen;
+	struct {
+		int pgid;
+		unsigned int namelen;
+		unsigned int filelen;
+		unsigned int pageslen;
+		int attrs;
+		int siglen;
+	} inbuf;
+
+	err = copy_from_user(&init, argp, sizeof(init));
+	if (err)
+		goto bail;
+
+	if (init.filelen > INIT_FILELEN_MAX ||
+	    init.memlen > INIT_MEMLEN_MAX)
+		goto bail;
+
+	inbuf.pgid = fl->tgid;
+	inbuf.namelen = strlen(current->comm) + 1;
+	inbuf.filelen = init.filelen;
+	inbuf.pageslen = 1;
+	inbuf.attrs = init.attrs;
+	inbuf.siglen = init.siglen;
+	fl->pd = 1;
+
+	if (init.filelen && init.filefd) {
+		err = fastrpc_map_create(fl, init.filefd, init.filelen, &map);
+		if (err)
+			goto bail;
+	}
+	memlen = ALIGN(max(INIT_FILELEN_MAX, (int)init.filelen * 4),
+		       1024 * 1024);
+	err = fastrpc_buf_alloc(fl, fl->sctx->dev, memlen,
+				&imem);
+	if (err)
+		goto bail;
+
+	fl->init_mem = imem;
+	args[0].ptr = &inbuf;
+	args[0].length = sizeof(inbuf);
+	args[0].fd = -1;
+
+	args[1].ptr = current->comm;
+	args[1].length = inbuf.namelen;
+	args[1].fd = -1;
+
+	args[2].ptr = (void *)init.file;
+	args[2].length = inbuf.filelen;
+	args[2].fd = init.filefd;
+
+	pages[0].addr = imem->phys;
+	pages[0].size = imem->size;
+
+	args[3].ptr = pages;
+	args[3].length = 1 * sizeof(*pages);
+	args[3].fd = -1;
+
+	args[4].ptr = &inbuf.attrs;
+	args[4].length = sizeof(inbuf.attrs);
+	args[4].fd = -1;
+
+	args[5].ptr = &inbuf.siglen;
+	args[5].length = sizeof(inbuf.siglen);
+	args[5].fd = -1;
+
+	inv.handle = 1;
+	inv.sc = FASTRPC_SCALARS(FASTRPC_RMID_INIT_CREATE, 4, 0);
+	if (init.attrs)
+		inv.sc = FASTRPC_SCALARS(FASTRPC_RMID_INIT_CREATE_ATTR, 6, 0);
+	inv.args = &args[0];
+	err = fastrpc_internal_invoke(fl, 1, &inv);
+bail:
+	if (map)
+		fastrpc_map_put(map);
+
+	return err;
+}
+
 static struct fastrpc_session_ctx *fastrpc_session_alloc(
 					struct fastrpc_channel_ctx *cctx,
 					int secure)
@@ -705,6 +803,23 @@ static void fastrpc_session_free(struct fastrpc_channel_ctx *cctx,
 	spin_unlock(&cctx->lock);
 }
 
+static int fastrpc_release_current_dsp_process(struct fastrpc_user *fl)
+{
+	struct fastrpc_invoke inv;
+	struct fastrpc_invoke_args args[1];
+	int tgid = 0;
+
+	tgid = fl->tgid;
+	args[0].ptr = &tgid;
+	args[0].length = sizeof(tgid);
+	args[0].fd = -1;
+	inv.handle = 1;
+	inv.sc = FASTRPC_SCALARS(FASTRPC_RMID_INIT_RELEASE, 1, 0);
+	inv.args = &args[0];
+
+	return fastrpc_internal_invoke(fl, 1, &inv);
+}
+
 static int fastrpc_device_release(struct inode *inode, struct file *file)
 {
 	struct fastrpc_user *fl = (struct fastrpc_user *)file->private_data;
@@ -712,6 +827,8 @@ static int fastrpc_device_release(struct inode *inode, struct file *file)
 	struct fastrpc_invoke_ctx *ctx, *n;
 	struct fastrpc_map *map, *m;
 
+	fastrpc_release_current_dsp_process(fl);
+
 	spin_lock(&cctx->lock);
 	list_del(&fl->user);
 	spin_unlock(&cctx->lock);
@@ -759,6 +876,23 @@ static int fastrpc_device_open(struct inode *inode, struct file *filp)
 	return 0;
 }
 
+static long fastrpc_init_attach(struct fastrpc_user *fl)
+{
+	struct fastrpc_invoke_args args[1];
+	struct fastrpc_invoke inv;
+	int tgid = fl->tgid;
+
+	args[0].ptr = &tgid;
+	args[0].length = sizeof(tgid);
+	args[0].fd = -1;
+	inv.handle = FASTRPC_INIT_HANDLE;
+	inv.sc = FASTRPC_SCALARS(FASTRPC_RMID_INIT_ATTACH, 1, 0);
+	inv.args = &args[0];
+	fl->pd = 0;
+
+	return fastrpc_internal_invoke(fl, 1, &inv);
+}
+
 static long fastrpc_invoke(struct fastrpc_user *fl, char __user *argp)
 {
 	struct fastrpc_invoke_args *args = NULL;
@@ -799,6 +933,12 @@ static long fastrpc_device_ioctl(struct file *file, unsigned int cmd,
 	case FASTRPC_IOCTL_INVOKE:
 		err = fastrpc_invoke(fl, argp);
 		break;
+	case FASTRPC_IOCTL_INIT_ATTACH:
+		err = fastrpc_init_attach(fl);
+		break;
+	case FASTRPC_IOCTL_INIT_CREATE:
+		err = fastrpc_init_create_process(fl, argp);
+		break;
 	default:
 		err = -ENOTTY;
 		dev_err(fl->sctx->dev, "bad ioctl: %d\n", cmd);
diff --git a/include/uapi/misc/fastrpc.h b/include/uapi/misc/fastrpc.h
index 0b408ba62482..2f0afa5dab1f 100644
--- a/include/uapi/misc/fastrpc.h
+++ b/include/uapi/misc/fastrpc.h
@@ -6,6 +6,8 @@
 #include <linux/types.h>
 
 #define FASTRPC_IOCTL_INVOKE		_IOWR('R', 3, struct fastrpc_invoke)
+#define FASTRPC_IOCTL_INIT_ATTACH	_IO('R', 4)
+#define FASTRPC_IOCTL_INIT_CREATE	_IOWR('R', 5, struct fastrpc_init_create)
 
 struct fastrpc_invoke_args {
 	__s32 fd;
@@ -19,4 +21,14 @@ struct fastrpc_invoke {
 	struct fastrpc_invoke_args *args;
 };
 
+struct fastrpc_init_create {
+	__u32 filelen;	/* elf file length */
+	__u32 filefd;	/* fd for the file */
+	__u32 memlen;	/* mem length */
+	__u32 memfd;	/* fd for the mem */
+	__u32 attrs;
+	__u32 siglen;
+	__u64 file;	/* pointer to elf file */
+};
+
 #endif /* __QCOM_FASTRPC_H__ */
-- 
2.19.2

[PATCH v2 5/6] misc: fastrpc: Add support for dmabuf exporter

[Srinivas Kandagatla]

User process can involve dealing with big buffer sizes, and also passing
buffers from one compute context bank to other compute context bank for
complex dsp algorithms.

This patch adds support to fastrpc to make it a proper dmabuf exporter
to avoid making copies of buffers.

Co-developed-by: Thierry Escande <thierry.escande@linaro.org>
Signed-off-by: Thierry Escande <thierry.escande@linaro.org>
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
---
 drivers/misc/fastrpc.c      | 176 ++++++++++++++++++++++++++++++++++++
 include/uapi/misc/fastrpc.h |   8 ++
 2 files changed, 184 insertions(+)

diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c
index fda674e9efe2..5ea2bba1e4bd 100644
--- a/drivers/misc/fastrpc.c
+++ b/drivers/misc/fastrpc.c
@@ -106,10 +106,20 @@ struct fastrpc_invoke_rsp {
 
 struct fastrpc_buf {
 	struct fastrpc_user *fl;
+	struct dma_buf *dmabuf;
 	struct device *dev;
 	void *virt;
 	uint64_t phys;
 	size_t size;
+	/* Lock for dma buf attachments */
+	struct mutex lock;
+	struct list_head attachments;
+};
+
+struct fastrpc_dma_buf_attachment {
+	struct device *dev;
+	struct sg_table sgt;
+	struct list_head node;
 };
 
 struct fastrpc_map {
@@ -249,6 +259,9 @@ static int fastrpc_buf_alloc(struct fastrpc_user *fl, struct device *dev,
 	if (!buf)
 		return -ENOMEM;
 
+	INIT_LIST_HEAD(&buf->attachments);
+	mutex_init(&buf->lock);
+
 	buf->fl = fl;
 	buf->virt = NULL;
 	buf->phys = 0;
@@ -357,6 +370,110 @@ fastrpc_context_alloc(struct fastrpc_user *user, uint32_t kernel,
 	return ERR_PTR(err);
 }
 
+static struct sg_table *
+fastrpc_map_dma_buf(struct dma_buf_attachment *attachment,
+		    enum dma_data_direction dir)
+{
+	struct fastrpc_dma_buf_attachment *a = attachment->priv;
+	struct sg_table *table;
+
+	table = &a->sgt;
+
+	if (!dma_map_sg(attachment->dev, table->sgl, table->nents, dir))
+		return ERR_PTR(-ENOMEM);
+
+	return table;
+}
+
+static void fastrpc_unmap_dma_buf(struct dma_buf_attachment *attach,
+				  struct sg_table *table,
+				  enum dma_data_direction dir)
+{
+}
+
+static void fastrpc_release(struct dma_buf *dmabuf)
+{
+	struct fastrpc_buf *buffer = dmabuf->priv;
+
+	fastrpc_buf_free(buffer);
+}
+
+static int fastrpc_dma_buf_attach(struct dma_buf *dmabuf,
+				  struct dma_buf_attachment *attachment)
+{
+	struct fastrpc_dma_buf_attachment *a;
+	struct fastrpc_buf *buffer = dmabuf->priv;
+	int ret;
+
+	a = kzalloc(sizeof(*a), GFP_KERNEL);
+	if (!a)
+		return -ENOMEM;
+
+	ret = dma_get_sgtable(buffer->dev, &a->sgt, buffer->virt,
+			      FASTRPC_PHYS(buffer->phys), buffer->size);
+	if (ret < 0) {
+		dev_err(buffer->dev, "failed to get scatterlist from DMA API\n");
+		return -EINVAL;
+	}
+
+	a->dev = attachment->dev;
+	INIT_LIST_HEAD(&a->node);
+	attachment->priv = a;
+
+	mutex_lock(&buffer->lock);
+	list_add(&a->node, &buffer->attachments);
+	mutex_unlock(&buffer->lock);
+
+	return 0;
+}
+
+static void fastrpc_dma_buf_detatch(struct dma_buf *dmabuf,
+				    struct dma_buf_attachment *attachment)
+{
+	struct fastrpc_dma_buf_attachment *a = attachment->priv;
+	struct fastrpc_buf *buffer = dmabuf->priv;
+
+	mutex_lock(&buffer->lock);
+	list_del(&a->node);
+	mutex_unlock(&buffer->lock);
+	kfree(a);
+}
+
+static void *fastrpc_kmap(struct dma_buf *dmabuf, unsigned long pgnum)
+{
+	struct fastrpc_buf *buf = dmabuf->priv;
+
+	return buf->virt ? buf->virt + pgnum * PAGE_SIZE : NULL;
+}
+
+static void *fastrpc_vmap(struct dma_buf *dmabuf)
+{
+	struct fastrpc_buf *buf = dmabuf->priv;
+
+	return buf->virt;
+}
+
+static int fastrpc_mmap(struct dma_buf *dmabuf,
+			struct vm_area_struct *vma)
+{
+	struct fastrpc_buf *buf = dmabuf->priv;
+	size_t size = vma->vm_end - vma->vm_start;
+
+	return dma_mmap_coherent(buf->dev, vma, buf->virt,
+				 FASTRPC_PHYS(buf->phys), size);
+}
+
+static const struct dma_buf_ops fastrpc_dma_buf_ops = {
+	.attach = fastrpc_dma_buf_attach,
+	.detach = fastrpc_dma_buf_detatch,
+	.map_dma_buf = fastrpc_map_dma_buf,
+	.unmap_dma_buf = fastrpc_unmap_dma_buf,
+	.mmap = fastrpc_mmap,
+	.map = fastrpc_kmap,
+	.vmap = fastrpc_vmap,
+	.release = fastrpc_release,
+};
+
 static int fastrpc_map_create(struct fastrpc_user *fl, int fd,
 			      size_t len, struct fastrpc_map **ppmap)
 {
@@ -876,6 +993,59 @@ static int fastrpc_device_open(struct inode *inode, struct file *filp)
 	return 0;
 }
 
+static long fastrpc_dmabuf_free(struct fastrpc_user *fl, char __user *argp)
+{
+	struct dma_buf *buf;
+	uint32_t info;
+
+	if (copy_from_user(&info, argp, sizeof(info)))
+		return -EFAULT;
+
+	buf = dma_buf_get(info);
+	if (IS_ERR_OR_NULL(buf))
+		return -EINVAL;
+	/*
+	 * one for the last get and other for the ALLOC_DMA_BUFF ioctl
+	 */
+	dma_buf_put(buf);
+	dma_buf_put(buf);
+
+	return 0;
+}
+static long fastrpc_dmabuf_alloc(struct fastrpc_user *fl, char __user *argp)
+{
+	struct fastrpc_alloc_dma_buf bp;
+	DEFINE_DMA_BUF_EXPORT_INFO(exp_info);
+	struct fastrpc_buf *buf = NULL;
+	int err;
+
+	err = copy_from_user(&bp, argp, sizeof(bp));
+	if (err)
+		return err;
+
+	err = fastrpc_buf_alloc(fl, fl->sctx->dev, bp.size, &buf);
+	if (err)
+		return err;
+	exp_info.ops = &fastrpc_dma_buf_ops;
+	exp_info.size = bp.size;
+	exp_info.flags = O_RDWR;
+	exp_info.priv = buf;
+	buf->dmabuf = dma_buf_export(&exp_info);
+	if (IS_ERR(buf->dmabuf)) {
+		err = PTR_ERR(buf->dmabuf);
+		return err;
+	}
+
+	get_dma_buf(buf->dmabuf);
+	bp.fd = dma_buf_fd(buf->dmabuf, O_ACCMODE);
+	if (bp.fd < 0) {
+		dma_buf_put(buf->dmabuf);
+		return -EINVAL;
+	}
+
+	return copy_to_user(argp, &bp, sizeof(bp));
+}
+
 static long fastrpc_init_attach(struct fastrpc_user *fl)
 {
 	struct fastrpc_invoke_args args[1];
@@ -939,6 +1109,12 @@ static long fastrpc_device_ioctl(struct file *file, unsigned int cmd,
 	case FASTRPC_IOCTL_INIT_CREATE:
 		err = fastrpc_init_create_process(fl, argp);
 		break;
+	case FASTRPC_IOCTL_FREE_DMA_BUFF:
+		err = fastrpc_dmabuf_free(fl, argp);
+		break;
+	case FASTRPC_IOCTL_ALLOC_DMA_BUFF:
+		err = fastrpc_dmabuf_alloc(fl, argp);
+		break;
 	default:
 		err = -ENOTTY;
 		dev_err(fl->sctx->dev, "bad ioctl: %d\n", cmd);
diff --git a/include/uapi/misc/fastrpc.h b/include/uapi/misc/fastrpc.h
index 2f0afa5dab1f..e2eeec1f78d3 100644
--- a/include/uapi/misc/fastrpc.h
+++ b/include/uapi/misc/fastrpc.h
@@ -5,6 +5,8 @@
 
 #include <linux/types.h>
 
+#define FASTRPC_IOCTL_ALLOC_DMA_BUFF	_IOWR('R', 1, struct fastrpc_alloc_dma_buf)
+#define FASTRPC_IOCTL_FREE_DMA_BUFF	_IOWR('R', 2, __u32)
 #define FASTRPC_IOCTL_INVOKE		_IOWR('R', 3, struct fastrpc_invoke)
 #define FASTRPC_IOCTL_INIT_ATTACH	_IO('R', 4)
 #define FASTRPC_IOCTL_INIT_CREATE	_IOWR('R', 5, struct fastrpc_init_create)
@@ -31,4 +33,10 @@ struct fastrpc_init_create {
 	__u64 file;	/* pointer to elf file */
 };
 
+struct fastrpc_alloc_dma_buf {
+	__s32 fd;	/* fd */
+	__u32 flags;	/* flags to map with */
+	__u64 size;	/* size */
+};
+
 #endif /* __QCOM_FASTRPC_H__ */
-- 
2.19.2

[PATCH v2 6/6] misc: fastrpc: Add support for compat ioctls

[Srinivas Kandagatla]

This patch adds support for compat ioctl from 32 bits userland to
Qualcomm fastrpc driver.

Supported ioctls in this change are INIT, INVOKE, and ALLOC/FREE_DMA.

Most of the work is derived from various downstream Qualcomm kernels.
Credits to various Qualcomm authors who have contributed to this code.
Specially Tharun Kumar Merugu <mtharu@codeaurora.org>

Co-developed-by: Thierry Escande <thierry.escande@linaro.org>
Signed-off-by: Thierry Escande <thierry.escande@linaro.org>
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
---
 drivers/misc/fastrpc.c | 71 ++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 71 insertions(+)

diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c
index 5ea2bba1e4bd..f36657263183 100644
--- a/drivers/misc/fastrpc.c
+++ b/drivers/misc/fastrpc.c
@@ -2,6 +2,7 @@
 // Copyright (c) 2011-2018, The Linux Foundation. All rights reserved.
 // Copyright (c) 2018, Linaro Limited
 
+#include <linux/compat.h>
 #include <linux/completion.h>
 #include <linux/device.h>
 #include <linux/dma-buf.h>
@@ -194,6 +195,22 @@ struct fastrpc_user {
 	struct mutex mutex;
 };
 
+#ifdef CONFIG_COMPAT
+
+#define FASTRPC_IOCTL_INVOKE32		_IOWR('R', 3, struct fastrpc_invoke32)
+struct fastrpc_invoke_args32 {
+	__s32 fd;
+	compat_size_t length;
+	compat_caddr_t ptr;
+};
+
+struct fastrpc_invoke32 {
+	__u32 handle;
+	__u32 sc;
+	compat_uptr_t args;
+};
+#endif
+
 static void fastrpc_free_map(struct kref *ref)
 {
 	struct fastrpc_map *map;
@@ -1092,6 +1109,52 @@ static long fastrpc_invoke(struct fastrpc_user *fl, char __user *argp)
 	return err;
 }
 
+#ifdef CONFIG_COMPAT
+static long fastrpc_invoke32(struct fastrpc_user *fl, compat_uptr_t arg)
+{
+	struct fastrpc_invoke_args32 *args32 = NULL;
+	struct fastrpc_invoke_args *args = NULL;
+	struct fastrpc_invoke32 inv32;
+	struct fastrpc_invoke inv;
+	int i, ret, nscalars;
+
+	if (copy_from_user(&inv32, compat_ptr(arg), sizeof(inv32)))
+		return -EFAULT;
+
+	inv.handle = inv32.handle;
+	inv.sc = inv32.sc;
+	inv.args = NULL;
+	nscalars = REMOTE_SCALARS_LENGTH(inv.sc);
+
+	if (nscalars) {
+		args32 = kcalloc(nscalars, sizeof(*args32), GFP_KERNEL);
+		if (!args32)
+			return -ENOMEM;
+
+		if (copy_from_user(args32, compat_ptr(inv32.args),
+				   nscalars * sizeof(*args32)))
+			return -EFAULT;
+
+		args = kcalloc(nscalars, sizeof(*args), GFP_KERNEL);
+		if (!args)
+			return -ENOMEM;
+
+		for (i = 0; i < nscalars; i++) {
+			args[i].length = args32[i].length;
+			args[i].ptr = (void *)(unsigned long)args32[i].ptr;
+			args[i].fd = args32[i].fd;
+		}
+		inv.args = &args[0];
+	}
+
+	ret = fastrpc_internal_invoke(fl, 0, &inv);
+	kfree(args32);
+	kfree(args);
+
+	return ret;
+}
+#endif
+
 static long fastrpc_device_ioctl(struct file *file, unsigned int cmd,
 				 unsigned long arg)
 {
@@ -1103,6 +1166,11 @@ static long fastrpc_device_ioctl(struct file *file, unsigned int cmd,
 	case FASTRPC_IOCTL_INVOKE:
 		err = fastrpc_invoke(fl, argp);
 		break;
+#ifdef CONFIG_COMPAT
+	case FASTRPC_IOCTL_INVOKE32:
+		err = fastrpc_invoke32(fl, ptr_to_compat(argp));
+		break;
+#endif
 	case FASTRPC_IOCTL_INIT_ATTACH:
 		err = fastrpc_init_attach(fl);
 		break;
@@ -1131,6 +1199,9 @@ static const struct file_operations fastrpc_fops = {
 	.open = fastrpc_device_open,
 	.release = fastrpc_device_release,
 	.unlocked_ioctl = fastrpc_device_ioctl,
+#ifdef CONFIG_COMPAT
+	.compat_ioctl = fastrpc_device_ioctl,
+#endif
 };
 
 static int fastrpc_cb_probe(struct platform_device *pdev)
-- 
2.19.2

Re: [PATCH v2 1/6] misc: dt-bindings: Add Qualcomm Fastrpc bindings

[Mark Rutland]

On Fri, Dec 07, 2018 at 04:35:08PM +0000, Srinivas Kandagatla wrote:
> The FastRPC driver implements an IPC (Inter-Processor Communication)
> mechanism that allows for clients to transparently make remote method
> invocations across DSP and APPS boundaries. This enables developers
> to offload tasks to the DSP and free up the application processor for
> other tasks.
> 
> Co-developed-by: Thierry Escande <thierry.escande@linaro.org>
> Signed-off-by: Thierry Escande <thierry.escande@linaro.org>
> Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
> ---
>  .../devicetree/bindings/misc/qcom,fastrpc.txt | 73 +++++++++++++++++++
>  1 file changed, 73 insertions(+)
>  create mode 100644 Documentation/devicetree/bindings/misc/qcom,fastrpc.txt
> 
> diff --git a/Documentation/devicetree/bindings/misc/qcom,fastrpc.txt b/Documentation/devicetree/bindings/misc/qcom,fastrpc.txt
> new file mode 100644
> index 000000000000..06e8c25839d5
> --- /dev/null
> +++ b/Documentation/devicetree/bindings/misc/qcom,fastrpc.txt
> @@ -0,0 +1,73 @@
> +Qualcomm Technologies, Inc. FastRPC Driver
> +
> +The FastRPC driver implements an IPC (Inter-Processor Communication)
> +mechanism that allows for clients to transparently make remote method
> +invocations across DSP and APPS boundaries. This enables developers
> +to offload tasks to the DSP and free up the application processor for
> +other tasks.

Which hardware does this node represent?

If this is functionality provided by another block of hardware (i.e. the
DSPs themselves), it would be better to have nodes for them.

> +
> +- compatible:
> +	Usage: required
> +	Value type: <stringlist>
> +	Definition: must be "qcom,fastrpc"
> +
> +- reg
> +	Usage: required
> +	Value type: <u32>
> +	Definition: DSP Processor ID.
> +	Possible values are :
> +			0 - ADSP
> +			1 - MDSP
> +			2 - SDSP
> +			3 - CDSP

Why is this in a reg?

To be, a phandle to the relevant DSP would seem better.

> +
> += COMPUTE BANKS
> +Each subnode of the Fastrpc node represents compute context banks available
> +on the dsp. The name of the nodes are not important. The properties of these
> +nodes are defined by the individual bindings for the specific service
> +- All Compute context banks MUST contain the following property:
> +
> +- compatible:
> +	Usage: required
> +	Value type: <stringlist>
> +	Definition: must be "qcom,fastrpc-compute-cb"
> +
> +- reg
> +	Usage: required
> +	Value type: <u32>
> +	Definition: Context Bank ID.
> +
> +- secured:
> +	Usage: Optional
> +	Value type: <boolean>
> +	Defination: Indicating context bank is secured

In what sense?

Does this mean Secure / Non-secure in the TrustZone sense?

> +
> +- nsessions:
> +	Usage: Optional
> +	Value type: <u32>
> +	Defination: A value indicating how many sessions can share this
> +		    context bank. Defaults to 'One' when this property
> +		    is not specified.

Presumably the default is 1, rather than 'One'.

What is a session? How do there share a context bank?

> +
> +Example:
> +
> +fastrpc {
> +	compatible = "qcom,fastrpc";
> +	qcom,smd-channels = "fastrpcsmd-apps-dsp";
> +	reg = <0>; /* DOMAIN_ADSP */
> +	#address-cells = <1>;
> +	#size-cells = <0>;
> +
> +	cb@1 {
> +		compatible = "qcom,fastrpc-compute-cb";
> +		reg = <1>;
> +		iommus = <&lpass_q6_smmu 1>;

These iommus should be associated with the device (i.e. the DSP itself).

Thanks,
Mark.

> +	};
> +
> +	cb@2 {
> +		compatible = "qcom,fastrpc-compute-cb";
> +		reg = <2>;
> +		iommus = <&lpass_q6_smmu 2>;
> +	};
> +	...
> +};
> -- 
> 2.19.2
> 

Re: [PATCH v2 1/6] misc: dt-bindings: Add Qualcomm Fastrpc bindings

[Srinivas Kandagatla]

Thanks for the review,

On 07/12/18 18:23, Mark Rutland wrote:
> On Fri, Dec 07, 2018 at 04:35:08PM +0000, Srinivas Kandagatla wrote:
>> The FastRPC driver implements an IPC (Inter-Processor Communication)
>> mechanism that allows for clients to transparently make remote method
>> invocations across DSP and APPS boundaries. This enables developers
>> to offload tasks to the DSP and free up the application processor for
>> other tasks.
>>
>> Co-developed-by: Thierry Escande <thierry.escande@linaro.org>
>> Signed-off-by: Thierry Escande <thierry.escande@linaro.org>
>> Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
>> ---
>>   .../devicetree/bindings/misc/qcom,fastrpc.txt | 73 +++++++++++++++++++
>>   1 file changed, 73 insertions(+)
>>   create mode 100644 Documentation/devicetree/bindings/misc/qcom,fastrpc.txt
>>
>> diff --git a/Documentation/devicetree/bindings/misc/qcom,fastrpc.txt b/Documentation/devicetree/bindings/misc/qcom,fastrpc.txt
>> new file mode 100644
>> index 000000000000..06e8c25839d5
>> --- /dev/null
>> +++ b/Documentation/devicetree/bindings/misc/qcom,fastrpc.txt
>> @@ -0,0 +1,73 @@
>> +Qualcomm Technologies, Inc. FastRPC Driver
>> +
>> +The FastRPC driver implements an IPC (Inter-Processor Communication)
>> +mechanism that allows for clients to transparently make remote method
>> +invocations across DSP and APPS boundaries. This enables developers
>> +to offload tasks to the DSP and free up the application processor for
>> +other tasks.
> 
> Which hardware does this node represent?
> 
This is hexagon dsp, remoteproc node represents this.

> If this is functionality provided by another block of hardware (i.e. the
> DSPs themselves), it would be better to have nodes for them.
Currently the dsp nodes are remoteproc nodes itself, all the services 
that dsp provides are child nodes of this.

Ex: Audio DSP nodes looks like this:

adsp-pil { /* remoteproc device */
	compatible = "qcom,msm8996-adsp-pil";
	...
	smd-edge { /* rpmsg device */
		...
		fastrpc { /* platform device */
			compatible = "qcom,fastrpc";
		};
	};
};


> 
>> +
>> +- compatible:
>> +	Usage: required
>> +	Value type: <stringlist>
>> +	Definition: must be "qcom,fastrpc"
>> +
>> +- reg
>> +	Usage: required
>> +	Value type: <u32>
>> +	Definition: DSP Processor ID.
>> +	Possible values are :
>> +			0 - ADSP
>> +			1 - MDSP
>> +			2 - SDSP
>> +			3 - CDSP
> 
> Why is this in a reg?

This is to identify which type of dsp(Audio/Modem/Sensor/Compute) it is, 
This information is used to create device nodes for user-space access.

> 
> To be, a phandle to the relevant DSP would seem better.
> 
>> +
>> += COMPUTE BANKS
>> +Each subnode of the Fastrpc node represents compute context banks available
>> +on the dsp. The name of the nodes are not important. The properties of these
>> +nodes are defined by the individual bindings for the specific service
>> +- All Compute context banks MUST contain the following property:
>> +
>> +- compatible:
>> +	Usage: required
>> +	Value type: <stringlist>
>> +	Definition: must be "qcom,fastrpc-compute-cb"
>> +
>> +- reg
>> +	Usage: required
>> +	Value type: <u32>
>> +	Definition: Context Bank ID.
>> +
>> +- secured:
>> +	Usage: Optional
>> +	Value type: <boolean>
>> +	Defination: Indicating context bank is secured
> 
> In what sense?
> 
> Does this mean Secure / Non-secure in the TrustZone sense?

Yes, its secured in TZ sense, this context requires secure buffers to 
work with.

> 
>> +
>> +- nsessions:
>> +	Usage: Optional
>> +	Value type: <u32>
>> +	Defination: A value indicating how many sessions can share this
>> +		    context bank. Defaults to 'One' when this property
>> +		    is not specified.
> 
> Presumably the default is 1, rather than 'One'.
Yes!
> 
> What is a session? How do there share a context bank?

A Session is a running instance on a compute context bank.

The value here indicates how many sessions can run simultaneously on 
that compute context bank.

> 
>> +
>> +Example:
>> +
>> +fastrpc {
>> +	compatible = "qcom,fastrpc";
>> +	qcom,smd-channels = "fastrpcsmd-apps-dsp";
>> +	reg = <0>; /* DOMAIN_ADSP */
>> +	#address-cells = <1>;
>> +	#size-cells = <0>;
>> +
>> +	cb@1 {
>> +		compatible = "qcom,fastrpc-compute-cb";
>> +		reg = <1>;
>> +		iommus = <&lpass_q6_smmu 1>;
> 
> These iommus should be associated with the device (i.e. the DSP itself).

Currently the device model is via remoteproc bus followed by rpmsg bus 
(communication channel) and then each compute context banks instance is 
a platform device as children of the rpmsg channel device.


There are few practical issues though,

1> None of the parent buses (remoteproc/rpmsg) have ability to do a dma 
allocations or associate there child devices with iommus.

2> Each compute bank has its own iommu stream id associated with it. How 
can the parent bus associate this with each compute context bank 
instance? Given that we have more than one compute context banks in each 
dsp.
Are there any examples which already do this?

3> Are there already dt bindings which describe this parent bus handling 
all the iommu stream ids of child devices?



Thanks,
srini


> 
> Thanks,
> Mark.
> 
>> +	};
>> +
>> +	cb@2 {
>> +		compatible = "qcom,fastrpc-compute-cb";
>> +		reg = <2>;
>> +		iommus = <&lpass_q6_smmu 2>;
>> +	};
>> +	...
>> +};
>> -- 
>> 2.19.2
>>

Re: [PATCH v2 3/6] misc: fastrpc: Add support for context Invoke method

[kbuild test robot]

[-- Attachment #1: Type: text/plain, Size: 5006 bytes --]

Hi Srinivas,

I love your patch! Perhaps something to improve:

[auto build test WARNING on char-misc/char-misc-testing]
[also build test WARNING on v4.20-rc6 next-20181207]
[if your patch is applied to the wrong git tree, please drop us a note to help improve the system]

url:    https://github.com/0day-ci/linux/commits/Srinivas-Kandagatla/misc-Add-support-to-Qualcomm-FastRPC-driver/20181210-093054
config: arm-allmodconfig (attached as .config)
compiler: arm-linux-gnueabi-gcc (Debian 7.2.0-11) 7.2.0
reproduce:
        wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross
        chmod +x ~/bin/make.cross
        # save the attached .config to linux build tree
        GCC_VERSION=7.2.0 make.cross ARCH=arm 

All warnings (new ones prefixed by >>):

   drivers//misc/fastrpc.c: In function 'fastrpc_get_args':
>> drivers//misc/fastrpc.c:528:17: warning: cast from pointer to integer of different size [-Wpointer-to-int-cast]
       rpra[i].pv = (uint64_t) ctx->args[i].ptr;
                    ^
>> drivers//misc/fastrpc.c:545:26: warning: cast to pointer from integer of different size [-Wint-to-pointer-cast]
        err = copy_from_user((void *)rpra[i].pv,
                             ^
   drivers//misc/fastrpc.c:551:12: warning: cast to pointer from integer of different size [-Wint-to-pointer-cast]
        memcpy((void *)rpra[i].pv, ctx->args[i].ptr,
               ^
   drivers//misc/fastrpc.c:558:16: warning: cast from pointer to integer of different size [-Wpointer-to-int-cast]
      rpra[i].pv = (uint64_t) ctx->args[i].ptr;
                   ^
   drivers//misc/fastrpc.c: In function 'fastrpc_put_args':
   drivers//misc/fastrpc.c:591:8: warning: cast to pointer from integer of different size [-Wint-to-pointer-cast]
           (void  *)rpra[i].pv, rpra[i].len);
           ^
   drivers//misc/fastrpc.c:597:29: warning: cast to pointer from integer of different size [-Wint-to-pointer-cast]
       memcpy(ctx->args[i].ptr, (void *)rpra[i].pv,
                                ^

vim +528 drivers//misc/fastrpc.c

   485	
   486	static int fastrpc_get_args(uint32_t kernel, struct fastrpc_invoke_ctx *ctx)
   487	{
   488		struct device *dev = ctx->fl->sctx->dev;
   489		struct fastrpc_remote_arg *rpra;
   490		struct fastrpc_invoke_buf *list;
   491		struct fastrpc_phy_page *pages;
   492		uintptr_t args;
   493		size_t rlen = 0, pkt_size = 0, metalen = 0;
   494		int inbufs, i, err = 0;
   495	
   496		inbufs = REMOTE_SCALARS_INBUFS(ctx->sc);
   497		metalen = fastrpc_get_meta_size(ctx);
   498		pkt_size = fastrpc_get_payload_size(ctx, metalen);
   499		fastrpc_create_maps(ctx);
   500		ctx->used_sz = pkt_size;
   501	
   502		err = fastrpc_buf_alloc(ctx->fl, dev, pkt_size, &ctx->buf);
   503		if (err)
   504			goto bail;
   505	
   506		rpra = ctx->buf->virt;
   507		list = ctx->buf->virt + ctx->nscalars * sizeof(*rpra);
   508		pages = ctx->buf->virt + ctx->nscalars * (sizeof(*list) +
   509			sizeof(*rpra));
   510		args = (uintptr_t)ctx->buf->virt + metalen;
   511		rlen = pkt_size - metalen;
   512		ctx->rpra = rpra;
   513	
   514		for (i = 0; i < ctx->nbufs; ++i) {
   515			size_t len = ctx->args[i].length;
   516	
   517			rpra[i].pv = 0;
   518			rpra[i].len = len;
   519			list[i].num = len ? 1 : 0;
   520			list[i].pgidx = i;
   521	
   522			if (!len)
   523				continue;
   524	
   525			pages[i].size = roundup(len, PAGE_SIZE);
   526	
   527			if (ctx->maps[i]) {
 > 528				rpra[i].pv = (uint64_t) ctx->args[i].ptr;
   529				pages[i].addr = ctx->maps[i]->phys;
   530			} else {
   531				rlen -= ALIGN(args, FASTRPC_ALIGN) - args;
   532				args = ALIGN(args, FASTRPC_ALIGN);
   533				if (rlen < len)
   534					goto bail;
   535	
   536				rpra[i].pv = (args);
   537				pages[i].addr = ctx->buf->phys + (pkt_size - rlen);
   538				pages[i].addr = pages[i].addr &	PAGE_MASK;
   539				args = args + len;
   540				rlen -= len;
   541			}
   542	
   543			if (i < inbufs && !ctx->maps[i]) {
   544				if (!kernel) {
 > 545					err = copy_from_user((void *)rpra[i].pv,
   546						     (void __user *)ctx->args[i].ptr,
   547						     ctx->args[i].length);
   548					if (err)
   549						goto bail;
   550				} else {
   551					memcpy((void *)rpra[i].pv, ctx->args[i].ptr,
   552					       ctx->args[i].length);
   553				}
   554			}
   555		}
   556	
   557		for (i = ctx->nbufs; i < ctx->nscalars; ++i) {
   558			rpra[i].pv = (uint64_t) ctx->args[i].ptr;
   559			rpra[i].len = ctx->args[i].length;
   560			list[i].num = ctx->args[i].length ? 1 : 0;
   561			list[i].pgidx = i;
   562			pages[i].addr = ctx->maps[i]->phys;
   563			pages[i].size = ctx->maps[i]->size;
   564		}
   565	
   566	bail:
   567		if (err)
   568			dev_err(dev, "Error: get invoke args failed:%d\n", err);
   569	
   570		return err;
   571	}
   572	

---
0-DAY kernel test infrastructure                Open Source Technology Center
https://lists.01.org/pipermail/kbuild-all                   Intel Corporation

[-- Attachment #2: .config.gz --]
[-- Type: application/gzip, Size: 67837 bytes --]

Re: [PATCH v2 1/6] misc: dt-bindings: Add Qualcomm Fastrpc bindings

[Bjorn Andersson]

On Mon 10 Dec 03:17 PST 2018, Srinivas Kandagatla wrote:
> On 07/12/18 18:23, Mark Rutland wrote:
> > On Fri, Dec 07, 2018 at 04:35:08PM +0000, Srinivas Kandagatla wrote:
> > > diff --git a/Documentation/devicetree/bindings/misc/qcom,fastrpc.txt b/Documentation/devicetree/bindings/misc/qcom,fastrpc.txt
[..]
> > > +- reg
> > > +	Usage: required
> > > +	Value type: <u32>
> > > +	Definition: DSP Processor ID.
> > > +	Possible values are :
> > > +			0 - ADSP
> > > +			1 - MDSP
> > > +			2 - SDSP
> > > +			3 - CDSP
> > 
> > Why is this in a reg?
> 
> This is to identify which type of dsp(Audio/Modem/Sensor/Compute) it is,
> This information is used to create device nodes for user-space access.
> 

But it does not represent FastRPC's address on the rpmsg bus. How about
replacing it with a "label" (or "qcom,domain" perhaps?) of type string?

Regards,
Bjorn

Re: [PATCH v2 1/6] misc: dt-bindings: Add Qualcomm Fastrpc bindings

[Srinivas Kandagatla]

On 11/12/18 00:10, Bjorn Andersson wrote:
> [..]
>>>> +- reg
>>>> +	Usage: required
>>>> +	Value type: <u32>
>>>> +	Definition: DSP Processor ID.
>>>> +	Possible values are :
>>>> +			0 - ADSP
>>>> +			1 - MDSP
>>>> +			2 - SDSP
>>>> +			3 - CDSP
>>> Why is this in a reg?
>> This is to identify which type of dsp(Audio/Modem/Sensor/Compute) it is,
>> This information is used to create device nodes for user-space access.
>>
> But it does not represent FastRPC's address on the rpmsg bus. How about
> replacing it with a "label" (or "qcom,domain" perhaps?) of type string?

Yes, we could replace reg with label in this case. I don't have any 
particular preference TBH.

I did try to something similar to "qcom,domain" for apr and Rob H 
suggested to use reg instead during review!

thanks,
srini

Re: [PATCH v2 1/6] misc: dt-bindings: Add Qualcomm Fastrpc bindings

[Srinivas Kandagatla]

On 07/12/18 18:23, Mark Rutland wrote:
>> +	cb@1 {
>> +		compatible = "qcom,fastrpc-compute-cb";
>> +		reg = <1>;
>> +		iommus = <&lpass_q6_smmu 1>;
> These iommus should be associated with the device (i.e. the DSP itself).

Are you referring to implement this using "iommu-map" and 
"iommu-map-mask" bindings on remoteproc/rpmsg bus?

--srini

Re: [PATCH v2 6/6] misc: fastrpc: Add support for compat ioctls

[Greg KH]

On Fri, Dec 07, 2018 at 04:35:13PM +0000, Srinivas Kandagatla wrote:
> This patch adds support for compat ioctl from 32 bits userland to
> Qualcomm fastrpc driver.

Ick, why?

Why not just fix up your ioctl structures to not need that at all?  For
new code being added to the kernel, there's no excuse to have to have
compat structures anymore, just make your api sane and all should be
fine.

What prevents you from doing that and requiring compat support?

thanks,

greg k-h

Re: [PATCH v2 3/6] misc: fastrpc: Add support for context Invoke method

[Greg KH]

On Fri, Dec 07, 2018 at 04:35:10PM +0000, Srinivas Kandagatla wrote:
> +#define FASTRPC_BUILD_SCALARS(attr, method, in, out, oin, oout) \
> +		((((uint32_t)  (attr) & 0x07) << 29) | \
> +		(((uint32_t) (method) & 0x1f) << 24) | \

Why all of the uint32_t and uint64_t types in this patch, but not the
previous one?

Please just stick with u32 and u64, those are the correct kernel types
to be using everywhere.  uint32_t and friends are userspace things that
make no sense in kernel space.

Yes, I know people use them, but we should not be adding to the problem
by creating new instances of them for no good reason.

thanks,

greg k-h

Re: [PATCH v2 3/6] misc: fastrpc: Add support for context Invoke method

[Srinivas Kandagatla]

On 12/12/18 11:02, Greg KH wrote:
> On Fri, Dec 07, 2018 at 04:35:10PM +0000, Srinivas Kandagatla wrote:
>> +#define FASTRPC_BUILD_SCALARS(attr, method, in, out, oin, oout) \
>> +		((((uint32_t)  (attr) & 0x07) << 29) | \
>> +		(((uint32_t) (method) & 0x1f) << 24) | \
> 
> Why all of the uint32_t and uint64_t types in this patch, but not the
> previous one?
> 
> Please just stick with u32 and u64, those are the correct kernel types
> to be using everywhere.  uint32_t and friends are userspace things that
> make no sense in kernel space.
> 
> Yes, I know people use them, but we should not be adding to the problem
> by creating new instances of them for no good reason.

Thanks for the feedback, Sure I will revisit and cleanup such instances!

--srini
> 
> thanks,
> 
> greg k-h
> 

Re: [PATCH v2 6/6] misc: fastrpc: Add support for compat ioctls

[Srinivas Kandagatla]

Thanks for the comments,

On 12/12/18 10:59, Greg KH wrote:
>> This patch adds support for compat ioctl from 32 bits userland to
>> Qualcomm fastrpc driver.
> Ick, why?
> 
> Why not just fix up your ioctl structures to not need that at all?  For
> new code being added to the kernel, there's no excuse to have to have
> compat structures anymore, just make your api sane and all should be
> fine.

Yes, I did try that after comments from Arnd,


> 
> What prevents you from doing that and requiring compat support?
> 
I removed most of the compat IOCTLS except this one.
The reason is that this ioctl takes arguments which can vary in number 
for each call. So args are passed as pointer to structure, rather than 
fixed size. I could not find better way to rearrange this to give a 
fixed size data structure. In theory number of arguments can vary from 
0-255 for both in & out.

current data structure looks like this:

struct fastrpc_invoke_args {
	__s32 fd;
	size_t length;
	void *ptr;
};

struct fastrpc_invoke {
	__u32 handle;
	__u32 sc;
	struct fastrpc_invoke_args *args;
};

Other option is to split this IOCTL into 3 parts
SET_INVOKE_METHOD, SET_INVOKE_ARGS and INVOKE
with some kinda handle to bind these three.

with below structures:
struct fastrpc_invoke {
	__u32 handle;
	__u32 sc;
};

struct fastrpc_invoke_arg {
	__s32 fd;
	__u64 length;
	__u64 ptr;
};
I can try this and see how this works before I send next version of patch!


--srini
> thanks,
> 
> greg k-h

Re: [PATCH v2 6/6] misc: fastrpc: Add support for compat ioctls

[Greg KH]

On Wed, Dec 12, 2018 at 11:44:05AM +0000, Srinivas Kandagatla wrote:
> Thanks for the comments,
> 
> On 12/12/18 10:59, Greg KH wrote:
> > > This patch adds support for compat ioctl from 32 bits userland to
> > > Qualcomm fastrpc driver.
> > Ick, why?
> > 
> > Why not just fix up your ioctl structures to not need that at all?  For
> > new code being added to the kernel, there's no excuse to have to have
> > compat structures anymore, just make your api sane and all should be
> > fine.
> 
> Yes, I did try that after comments from Arnd,
> 
> 
> > 
> > What prevents you from doing that and requiring compat support?
> > 
> I removed most of the compat IOCTLS except this one.
> The reason is that this ioctl takes arguments which can vary in number for
> each call.

Then do not do that :)

Remember, you get to design the api, fix the structure size to work
properly everywhere.

> So args are passed as pointer to structure, rather than fixed
> size. I could not find better way to rearrange this to give a fixed size
> data structure. In theory number of arguments can vary from 0-255 for both
> in & out.
> 
> current data structure looks like this:
> 
> struct fastrpc_invoke_args {
> 	__s32 fd;
> 	size_t length;
> 	void *ptr;
> };

Make length and ptr both __u64 and you should be fine, right?  If you do
that, might as well make fd __u64 as well to align things better.

> struct fastrpc_invoke {
> 	__u32 handle;
> 	__u32 sc;
> 	struct fastrpc_invoke_args *args;
> };
> 
> Other option is to split this IOCTL into 3 parts
> SET_INVOKE_METHOD, SET_INVOKE_ARGS and INVOKE
> with some kinda handle to bind these three.
> 
> with below structures:
> struct fastrpc_invoke {
> 	__u32 handle;
> 	__u32 sc;
> };
> 
> struct fastrpc_invoke_arg {
> 	__s32 fd;
> 	__u64 length;
> 	__u64 ptr;
> };
> I can try this and see how this works before I send next version of patch!

No need to have 3 calls, just change your one structure and you should
be fine.

thanks,

greg k-h

Re: [PATCH v2 6/6] misc: fastrpc: Add support for compat ioctls

[Srinivas Kandagatla]

>>>
>>> What prevents you from doing that and requiring compat support?
>>>
>> I removed most of the compat IOCTLS except this one.
>> The reason is that this ioctl takes arguments which can vary in number for
>> each call.
> 
> Then do not do that :)
> 
> Remember, you get to design the api, fix the structure size to work
> properly everywhere.
> 
>> So args are passed as pointer to structure, rather than fixed
>> size. I could not find better way to rearrange this to give a fixed size
>> data structure. In theory number of arguments can vary from 0-255 for both
>> in & out.
>>
>> current data structure looks like this:
>>
>> struct fastrpc_invoke_args {
>> 	__s32 fd;
>> 	size_t length;
>> 	void *ptr;
>> };
> 
> Make length and ptr both __u64 and you should be fine, right?  If you do
> that, might as well make fd __u64 as well to align things better.
> 

That is fine for the args structure, but below "args" pointer in "struct 
fastrpc_invoke" is still not fixed size, unless we change that to __u64 
pointing to array of struct fastrpc_invoke_args. I have seen such usages 
in i915_drm.h.
Is that the preferred?

>> struct fastrpc_invoke {
>> 	__u32 handle;
>> 	__u32 sc;
>> 	struct fastrpc_invoke_args *args;
>> };
>>--srini

Re: [PATCH v2 6/6] misc: fastrpc: Add support for compat ioctls

[Greg KH]

On Wed, Dec 12, 2018 at 12:26:26PM +0000, Srinivas Kandagatla wrote:
> 
> 
> > > > 
> > > > What prevents you from doing that and requiring compat support?
> > > > 
> > > I removed most of the compat IOCTLS except this one.
> > > The reason is that this ioctl takes arguments which can vary in number for
> > > each call.
> > 
> > Then do not do that :)
> > 
> > Remember, you get to design the api, fix the structure size to work
> > properly everywhere.
> > 
> > > So args are passed as pointer to structure, rather than fixed
> > > size. I could not find better way to rearrange this to give a fixed size
> > > data structure. In theory number of arguments can vary from 0-255 for both
> > > in & out.
> > > 
> > > current data structure looks like this:
> > > 
> > > struct fastrpc_invoke_args {
> > > 	__s32 fd;
> > > 	size_t length;
> > > 	void *ptr;
> > > };
> > 
> > Make length and ptr both __u64 and you should be fine, right?  If you do
> > that, might as well make fd __u64 as well to align things better.
> > 
> 
> That is fine for the args structure, but below "args" pointer in "struct
> fastrpc_invoke" is still not fixed size, unless we change that to __u64
> pointing to array of struct fastrpc_invoke_args. I have seen such usages in
> i915_drm.h.
> Is that the preferred?

Yes, force all pointers to be __u64 and you should be fine.

thanks,

greg k-h