You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@nuttx.apache.org by xi...@apache.org on 2023/11/22 16:08:19 UTC
(nuttx) branch master updated (57de6484e9 -> ea0be3b490)
This is an automated email from the ASF dual-hosted git repository.
xiaoxiang pushed a change to branch master
in repository https://gitbox.apache.org/repos/asf/nuttx.git
from 57de6484e9 task/pthread_cancelpt: Fix task_delete from another task group
new 27f672d55a rpmsgblk: bind block inode to ept when create ept
new 12d66da892 rpmsgblk: do not actually unlink blockdevice in rpmsgblk client
new 4b25a0dfa5 rpmsgblk: check if the block device has been removed before calling its ops
new cf27a8484f rpmsgblk: use a fixed length struct to transfer between two cpus
new ea0be3b490 rpmsgblk: split mmc_ioc_multi_cmd to mmc_ioc_cmd for less share memory allocation
The 5 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
drivers/misc/Make.defs | 1 +
drivers/misc/rpmsgblk.c | 277 +++++++++++++++++++----------------------
drivers/misc/rpmsgblk.h | 16 ++-
drivers/misc/rpmsgblk_server.c | 156 +++++++++++++----------
fs/driver/driver.h | 27 ----
include/nuttx/fs/fs.h | 25 ++++
6 files changed, 252 insertions(+), 250 deletions(-)
(nuttx) 02/05: rpmsgblk: do not actually unlink blockdevice in rpmsgblk client
Posted by xi...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
xiaoxiang pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/nuttx.git
commit 12d66da8922e4e6ef316c59d1c2bbdc696e47bfa
Author: liaoao <li...@xiaomi.com>
AuthorDate: Wed Nov 1 15:01:02 2023 +0800
rpmsgblk: do not actually unlink blockdevice in rpmsgblk client
rpmsgblk client should not affect the server's use of blockdevice.
Signed-off-by: liaoao <li...@xiaomi.com>
---
drivers/misc/rpmsgblk.c | 17 +++--------------
drivers/misc/rpmsgblk.h | 1 -
drivers/misc/rpmsgblk_server.c | 24 ------------------------
3 files changed, 3 insertions(+), 39 deletions(-)
diff --git a/drivers/misc/rpmsgblk.c b/drivers/misc/rpmsgblk.c
index 2fc3dee4c3..586f5bad8c 100644
--- a/drivers/misc/rpmsgblk.c
+++ b/drivers/misc/rpmsgblk.c
@@ -143,7 +143,6 @@ static const rpmsg_ept_cb g_rpmsgblk_handler[] =
[RPMSGBLK_WRITE] = rpmsgblk_default_handler,
[RPMSGBLK_GEOMETRY] = rpmsgblk_geometry_handler,
[RPMSGBLK_IOCTL] = rpmsgblk_ioctl_handler,
- [RPMSGBLK_UNLINK] = rpmsgblk_default_handler,
};
/****************************************************************************
@@ -663,7 +662,8 @@ static int rpmsgblk_ioctl(FAR struct inode *inode, int cmd,
* Name: rpmsgblk_unlink
*
* Description:
- * Rpmsg-blk ioctl operation
+ * Rpmsg-blk unlink operation. Client can not delete the actual block
+ * device in server's side, so return success directly.
*
* Parameters:
* inode - the blk device inode
@@ -676,18 +676,7 @@ static int rpmsgblk_ioctl(FAR struct inode *inode, int cmd,
#ifndef CONFIG_DISABLE_PSEUDOFS_OPERATIONS
static int rpmsgblk_unlink(FAR struct inode *inode)
{
- FAR struct rpmsgblk_s *priv = inode->i_private;
- struct rpmsgblk_unlink_s msg;
- int ret;
-
- ret = rpmsgblk_send_recv(priv, RPMSGBLK_UNLINK, true, &msg.header,
- sizeof(msg), NULL);
- if (ret < 0)
- {
- ferr("unlink failed, ret=%d\n", ret);
- }
-
- return ret;
+ return OK;
}
#endif
diff --git a/drivers/misc/rpmsgblk.h b/drivers/misc/rpmsgblk.h
index ab5be5c24d..e486d657fa 100644
--- a/drivers/misc/rpmsgblk.h
+++ b/drivers/misc/rpmsgblk.h
@@ -42,7 +42,6 @@
#define RPMSGBLK_WRITE 4
#define RPMSGBLK_GEOMETRY 5
#define RPMSGBLK_IOCTL 6
-#define RPMSGBLK_UNLINK 7
/****************************************************************************
* Public Types
diff --git a/drivers/misc/rpmsgblk_server.c b/drivers/misc/rpmsgblk_server.c
index 908075f5fc..483f794865 100644
--- a/drivers/misc/rpmsgblk_server.c
+++ b/drivers/misc/rpmsgblk_server.c
@@ -73,9 +73,6 @@ static int rpmsgblk_geometry_handler(FAR struct rpmsg_endpoint *ept,
static int rpmsgblk_ioctl_handler(FAR struct rpmsg_endpoint *ept,
FAR void *data, size_t len,
uint32_t src, FAR void *priv);
-static int rpmsgblk_unlink_handler(FAR struct rpmsg_endpoint *ept,
- FAR void *data, size_t len,
- uint32_t src, FAR void *priv);
/* Functions for creating communication with client cpu */
@@ -102,7 +99,6 @@ static const rpmsg_ept_cb g_rpmsgblk_handler[] =
[RPMSGBLK_WRITE] = rpmsgblk_write_handler,
[RPMSGBLK_GEOMETRY] = rpmsgblk_geometry_handler,
[RPMSGBLK_IOCTL] = rpmsgblk_ioctl_handler,
- [RPMSGBLK_UNLINK] = rpmsgblk_unlink_handler,
};
/****************************************************************************
@@ -325,26 +321,6 @@ static int rpmsgblk_ioctl_handler(FAR struct rpmsg_endpoint *ept,
return rpmsg_send(ept, msg, len);
}
-/****************************************************************************
- * Name: rpmsgblk_unlink_handler
- ****************************************************************************/
-
-static int rpmsgblk_unlink_handler(FAR struct rpmsg_endpoint *ept,
- FAR void *data, size_t len,
- uint32_t src, FAR void *priv)
-{
- FAR struct rpmsgblk_unlink_s *msg = data;
-#ifndef CONFIG_DISABLE_PSEUDOFS_OPERATIONS
- FAR struct rpmsgblk_server_s *server = ept->priv;
-
- msg->header.result = server->bops->unlink(server->blknode);
-#else
- msg->header.result = -ENXIO;
-#endif
-
- return rpmsg_send(ept, msg, len);
-}
-
/****************************************************************************
* Name: rpmsgblk_ns_match
****************************************************************************/
(nuttx) 03/05: rpmsgblk: check if the block device has been removed before calling its ops
Posted by xi...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
xiaoxiang pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/nuttx.git
commit 4b25a0dfa54560b862c3f117c596dac4ca1eb2e9
Author: liaoao <li...@xiaomi.com>
AuthorDate: Thu Nov 2 15:19:27 2023 +0800
rpmsgblk: check if the block device has been removed before calling its ops
it may cause use after free if server has removed block device before calling
its operations,such as:
server: rm /dev/testrpmsgblk
client: ls /dev/testrpmsgblk
Signed-off-by: liaoao <li...@xiaomi.com>
---
drivers/misc/rpmsgblk_server.c | 50 ++++++++++++++++++++++++++++++++++++++++++
1 file changed, 50 insertions(+)
diff --git a/drivers/misc/rpmsgblk_server.c b/drivers/misc/rpmsgblk_server.c
index 483f794865..8d1cbe37d3 100644
--- a/drivers/misc/rpmsgblk_server.c
+++ b/drivers/misc/rpmsgblk_server.c
@@ -116,6 +116,16 @@ static int rpmsgblk_open_handler(FAR struct rpmsg_endpoint *ept,
FAR struct rpmsgblk_server_s *server = ept->priv;
FAR struct rpmsgblk_open_s *msg = data;
+ /* To check if the block device has been removed by unlink operation. */
+
+#ifndef CONFIG_DISABLE_PSEUDOFS_OPERATIONS
+ if (server->blknode->i_peer == NULL)
+ {
+ msg->header.result = -ENODEV;
+ return rpmsg_send(ept, msg, sizeof(*msg));
+ }
+#endif
+
if (server->bops->open != NULL)
{
msg->header.result = server->bops->open(server->blknode);
@@ -143,6 +153,14 @@ static int rpmsgblk_close_handler(FAR struct rpmsg_endpoint *ept,
FAR struct rpmsgblk_server_s *server = ept->priv;
FAR struct rpmsgblk_close_s *msg = data;
+#ifndef CONFIG_DISABLE_PSEUDOFS_OPERATIONS
+ if (server->blknode->i_peer == NULL)
+ {
+ msg->header.result = -ENODEV;
+ return rpmsg_send(ept, msg, sizeof(*msg));
+ }
+#endif
+
if (server->bops->close != NULL)
{
msg->header.result = server->bops->close(server->blknode);
@@ -175,6 +193,14 @@ static int rpmsgblk_read_handler(FAR struct rpmsg_endpoint *ept,
size_t nsectors;
uint32_t space;
+#ifndef CONFIG_DISABLE_PSEUDOFS_OPERATIONS
+ if (server->blknode->i_peer == NULL)
+ {
+ msg->header.result = -ENODEV;
+ return rpmsg_send(ept, msg, sizeof(*msg) - 1);
+ }
+#endif
+
while (read < msg->nsectors)
{
rsp = rpmsg_get_tx_payload_buffer(ept, &space, true);
@@ -223,6 +249,14 @@ static int rpmsgblk_write_handler(FAR struct rpmsg_endpoint *ept,
FAR struct rpmsgblk_write_s *msg = data;
int ret;
+#ifndef CONFIG_DISABLE_PSEUDOFS_OPERATIONS
+ if (server->blknode->i_peer == NULL)
+ {
+ msg->header.result = -ENODEV;
+ return rpmsg_send(ept, msg, sizeof(*msg) - 1);
+ }
+#endif
+
ret = server->bops->write(server->blknode, (FAR unsigned char *)msg->buf,
msg->startsector, msg->nsectors);
if (ret <= 0)
@@ -254,6 +288,14 @@ static int rpmsgblk_geometry_handler(FAR struct rpmsg_endpoint *ept,
FAR struct rpmsgblk_server_s *server = ept->priv;
FAR struct rpmsgblk_geometry_s *msg = data;
+#ifndef CONFIG_DISABLE_PSEUDOFS_OPERATIONS
+ if (server->blknode->i_peer == NULL)
+ {
+ msg->header.result = -ENODEV;
+ return rpmsg_send(ept, msg, len);
+ }
+#endif
+
DEBUGASSERT(msg->arglen == sizeof(struct geometry));
msg->header.result = server->bops->geometry(
@@ -273,6 +315,14 @@ static int rpmsgblk_ioctl_handler(FAR struct rpmsg_endpoint *ept,
FAR struct rpmsgblk_server_s *server = ept->priv;
FAR struct rpmsgblk_ioctl_s *msg = data;
+#ifndef CONFIG_DISABLE_PSEUDOFS_OPERATIONS
+ if (server->blknode->i_peer == NULL)
+ {
+ msg->header.result = -ENODEV;
+ return rpmsg_send(ept, msg, len);
+ }
+#endif
+
switch (msg->request)
{
case MMC_IOC_CMD:
(nuttx) 04/05: rpmsgblk: use a fixed length struct to transfer between two cpus
Posted by xi...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
xiaoxiang pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/nuttx.git
commit cf27a8484fa70218803d67f4072ae126d55aea87
Author: liaoao <li...@xiaomi.com>
AuthorDate: Wed Nov 8 21:14:07 2023 +0800
rpmsgblk: use a fixed length struct to transfer between two cpus
It may cause out_of_bounds when two side have different configuartion
on NAME_MAX and FS_LARGEFILE(affects size of blkcnt_t)
Signed-off-by: liaoao <li...@xiaomi.com>
---
drivers/misc/rpmsgblk.c | 44 ++++++++++++++++++------------------------
drivers/misc/rpmsgblk.h | 15 +++++++-------
drivers/misc/rpmsgblk_server.c | 13 ++++++++++---
3 files changed, 36 insertions(+), 36 deletions(-)
diff --git a/drivers/misc/rpmsgblk.c b/drivers/misc/rpmsgblk.c
index 586f5bad8c..be03f009c1 100644
--- a/drivers/misc/rpmsgblk.c
+++ b/drivers/misc/rpmsgblk.c
@@ -434,9 +434,7 @@ static int rpmsgblk_geometry(FAR struct inode *inode,
FAR struct geometry *geometry)
{
FAR struct rpmsgblk_s *priv = inode->i_private;
- struct rpmsgblk_geometry_s *msg;
- uint32_t space;
- int msglen;
+ struct rpmsgblk_geometry_s msg;
int ret;
/* Sanity checks */
@@ -457,25 +455,19 @@ static int rpmsgblk_geometry(FAR struct inode *inode,
goto out;
}
- msglen = sizeof(*msg) + sizeof(*geometry) - 1;
-
- msg = rpmsgblk_get_tx_payload_buffer(priv, &space);
- if (msg == NULL)
- {
- ret = -ENOMEM;
- goto out;
- }
-
- DEBUGASSERT(space > msglen);
-
- msg->arg = (uintptr_t)geometry;
- msg->arglen = sizeof(*geometry);
- memcpy(msg->buf, geometry, sizeof(*geometry));
-
- ret = rpmsgblk_send_recv(priv, RPMSGBLK_GEOMETRY, false, &msg->header,
- msglen, geometry);
+ ret = rpmsgblk_send_recv(priv, RPMSGBLK_GEOMETRY, true, &msg.header,
+ sizeof(msg), NULL);
if (ret >= 0)
{
+ DEBUGASSERT(msg.nsectors == (blkcnt_t)msg.nsectors);
+ DEBUGASSERT(strlen(msg.model) <= RPMSGBLK_NAME_MAX);
+
+ geometry->geo_available = msg.available;
+ geometry->geo_mediachanged = msg.mediachanged;
+ geometry->geo_writeenabled = msg.writeenabled;
+ geometry->geo_nsectors = msg.nsectors;
+ geometry->geo_sectorsize = msg.sectorsize;
+ strlcpy(geometry->geo_model, msg.model, sizeof(geometry->geo_model));
memcpy(&priv->geo, geometry, sizeof(priv->geo));
}
@@ -520,8 +512,6 @@ static ssize_t rpmsgblk_ioctl_arglen(int cmd, unsigned long arg)
return sizeof(struct mtd_smart_procfs_data_s);
case BIOC_DEBUGCMD:
return sizeof(struct mtd_smart_debug_data_s);
- case BIOC_GEOMETRY:
- return sizeof(struct geometry);
case BIOC_PARTINFO:
return sizeof(struct partition_info_s);
case BIOC_BLKSSZGET:
@@ -586,6 +576,11 @@ static int rpmsgblk_ioctl(FAR struct inode *inode, int cmd,
DEBUGASSERT(priv != NULL);
+ if (cmd == BIOC_GEOMETRY)
+ {
+ return rpmsgblk_geometry(inode, (FAR struct geometry *)arg);
+ }
+
/* Call our internal routine to perform the ioctl */
arglen = rpmsgblk_ioctl_arglen(cmd, arg);
@@ -895,12 +890,11 @@ static int rpmsgblk_geometry_handler(FAR struct rpmsg_endpoint *ept,
FAR struct rpmsgblk_header_s *header = data;
FAR struct rpmsgblk_cookie_s *cookie =
(FAR struct rpmsgblk_cookie_s *)(uintptr_t)header->cookie;
- FAR struct rpmsgblk_geometry_s *rsp = data;
cookie->result = header->result;
- if (cookie->result >= 0 && rsp->arglen > 0)
+ if (cookie->result >= 0)
{
- memcpy(cookie->data, rsp->buf, rsp->arglen);
+ memcpy(cookie->data, data, len);
}
return rpmsg_post(ept, &cookie->sem);
diff --git a/drivers/misc/rpmsgblk.h b/drivers/misc/rpmsgblk.h
index e486d657fa..d3d83f41e1 100644
--- a/drivers/misc/rpmsgblk.h
+++ b/drivers/misc/rpmsgblk.h
@@ -35,6 +35,7 @@
#define RPMSGBLK_NAME_PREFIX "rpmsgblk-"
#define RPMSGBLK_NAME_PREFIX_LEN 9
+#define RPMSGBLK_NAME_MAX 32
#define RPMSGBLK_OPEN 1
#define RPMSGBLK_CLOSE 2
@@ -76,9 +77,12 @@ begin_packed_struct struct rpmsgblk_read_s
begin_packed_struct struct rpmsgblk_geometry_s
{
struct rpmsgblk_header_s header;
- uint64_t arg;
- uint32_t arglen;
- char buf[1];
+ uint16_t available;
+ uint16_t mediachanged;
+ uint16_t writeenabled;
+ uint16_t sectorsize;
+ uint64_t nsectors;
+ char model[RPMSGBLK_NAME_MAX + 1];
} end_packed_struct;
begin_packed_struct struct rpmsgblk_ioctl_s
@@ -90,11 +94,6 @@ begin_packed_struct struct rpmsgblk_ioctl_s
char buf[1];
} end_packed_struct;
-begin_packed_struct struct rpmsgblk_unlink_s
-{
- struct rpmsgblk_header_s header;
-} end_packed_struct;
-
/****************************************************************************
* Internal function prototypes
****************************************************************************/
diff --git a/drivers/misc/rpmsgblk_server.c b/drivers/misc/rpmsgblk_server.c
index 8d1cbe37d3..b8a304df1d 100644
--- a/drivers/misc/rpmsgblk_server.c
+++ b/drivers/misc/rpmsgblk_server.c
@@ -287,6 +287,7 @@ static int rpmsgblk_geometry_handler(FAR struct rpmsg_endpoint *ept,
{
FAR struct rpmsgblk_server_s *server = ept->priv;
FAR struct rpmsgblk_geometry_s *msg = data;
+ struct geometry geo;
#ifndef CONFIG_DISABLE_PSEUDOFS_OPERATIONS
if (server->blknode->i_peer == NULL)
@@ -296,10 +297,16 @@ static int rpmsgblk_geometry_handler(FAR struct rpmsg_endpoint *ept,
}
#endif
- DEBUGASSERT(msg->arglen == sizeof(struct geometry));
+ msg->header.result = server->bops->geometry(server->blknode, &geo);
- msg->header.result = server->bops->geometry(
- server->blknode, (FAR struct geometry *)msg->buf);
+ DEBUGASSERT(strlen(geo.geo_model) <= RPMSGBLK_NAME_MAX);
+
+ msg->available = geo.geo_available;
+ msg->mediachanged = geo.geo_mediachanged;
+ msg->writeenabled = geo.geo_writeenabled;
+ msg->nsectors = geo.geo_nsectors;
+ msg->sectorsize = geo.geo_sectorsize;
+ strlcpy(msg->model, geo.geo_model, sizeof(msg->model));
return rpmsg_send(ept, msg, len);
}
(nuttx) 05/05: rpmsgblk: split mmc_ioc_multi_cmd to mmc_ioc_cmd for less share memory allocation
Posted by xi...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
xiaoxiang pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/nuttx.git
commit ea0be3b49066990e3a96133910cdb71156a8edf3
Author: liaoao <li...@xiaomi.com>
AuthorDate: Tue Nov 14 10:11:03 2023 +0800
rpmsgblk: split mmc_ioc_multi_cmd to mmc_ioc_cmd for less share memory allocation
Signed-off-by: liaoao <li...@xiaomi.com>
---
drivers/misc/rpmsgblk.c | 230 ++++++++++++++++++++---------------------
drivers/misc/rpmsgblk_server.c | 21 ----
2 files changed, 114 insertions(+), 137 deletions(-)
diff --git a/drivers/misc/rpmsgblk.c b/drivers/misc/rpmsgblk.c
index be03f009c1..5817994ae3 100644
--- a/drivers/misc/rpmsgblk.c
+++ b/drivers/misc/rpmsgblk.c
@@ -87,7 +87,7 @@ static ssize_t rpmsgblk_write(FAR struct inode *inode,
blkcnt_t start_sector, unsigned int nsectors);
static int rpmsgblk_geometry(FAR struct inode *inode,
FAR struct geometry *geometry);
-static ssize_t rpmsgblk_ioctl_arglen(int cmd, unsigned long arg);
+static ssize_t rpmsgblk_ioctl_arglen(int cmd);
static int rpmsgblk_ioctl(FAR struct inode *inode, int cmd,
unsigned long arg);
#ifndef CONFIG_DISABLE_PSEUDOFS_OPERATIONS
@@ -491,7 +491,7 @@ out:
*
****************************************************************************/
-static ssize_t rpmsgblk_ioctl_arglen(int cmd, unsigned long arg)
+static ssize_t rpmsgblk_ioctl_arglen(int cmd)
{
switch (cmd)
{
@@ -516,74 +516,102 @@ static ssize_t rpmsgblk_ioctl_arglen(int cmd, unsigned long arg)
return sizeof(struct partition_info_s);
case BIOC_BLKSSZGET:
return sizeof(blksize_t);
- case MMC_IOC_CMD:
- {
- FAR struct mmc_ioc_cmd *ioc =
- (FAR struct mmc_ioc_cmd *)(uintptr_t)arg;
-
- return sizeof(struct mmc_ioc_cmd) + ioc->blksz * ioc->blocks;
- }
-
- case MMC_IOC_MULTI_CMD:
- {
- FAR struct mmc_ioc_multi_cmd *mioc =
- (FAR struct mmc_ioc_multi_cmd *)(uintptr_t)arg;
- uint64_t num = mioc->num_of_cmds;
- uint64_t i;
- ssize_t arglen;
-
- arglen = sizeof(struct mmc_ioc_multi_cmd) +
- num * sizeof(struct mmc_ioc_cmd);
- for (i = 0; i < num; i++)
- {
- arglen += mioc->cmds[i].blksz * mioc->cmds[i].blocks;
- }
-
- return arglen;
- }
-
default:
return -ENOTTY;
}
}
/****************************************************************************
- * Name: rpmsgblk_ioctl
+ * Name: rpmsgblk_mmc_cmd_ioctl
*
* Description:
- * Rpmsg-blk ioctl operation
- *
- * Parameters:
- * inode - the blk device inode
- * cmd - the ioctl command
- * arg - the ioctl arguments
- *
- * Returned Values:
- * OK on success; A negated errno value is returned on any failure.
+ * If args include a usrspace buffer pointer, then the content of this
+ * pointer should also be copied into share memory and set after args.
*
****************************************************************************/
-static int rpmsgblk_ioctl(FAR struct inode *inode, int cmd,
- unsigned long arg)
+static int rpmsgblk_mmc_cmd_ioctl(FAR struct inode *inode, unsigned long arg)
{
FAR struct rpmsgblk_s *priv = inode->i_private;
+ FAR struct mmc_ioc_cmd *ioc = (FAR struct mmc_ioc_cmd *)(uintptr_t)arg;
FAR struct rpmsgblk_ioctl_s *msg;
uint32_t space;
- ssize_t arglen;
- size_t msglen;
+ ssize_t msglen;
- /* Sanity checks */
+ msglen = sizeof(*msg) + sizeof(struct mmc_ioc_cmd) +
+ ioc->blksz * ioc->blocks - 1;
- DEBUGASSERT(priv != NULL);
+ msg = rpmsgblk_get_tx_payload_buffer(priv, &space);
+ if (msg == NULL)
+ {
+ return -ENOMEM;
+ }
+
+ DEBUGASSERT(space > msglen);
+
+ msg->request = MMC_IOC_CMD;
+ msg->arg = arg;
+ msg->arglen = sizeof(struct mmc_ioc_cmd) + ioc->blksz * ioc->blocks;
+
+ memcpy(msg->buf, ioc, sizeof(*ioc));
+ if (ioc->data_ptr)
+ {
+ memcpy(msg->buf + sizeof(*ioc), (FAR void *)(uintptr_t)ioc->data_ptr,
+ ioc->blksz * ioc->blocks);
+ }
+
+ return rpmsgblk_send_recv(priv, RPMSGBLK_IOCTL, false, &msg->header,
+ msglen, ioc);
+}
+
+/****************************************************************************
+ * Name: rpmsgblk_mmc_multi_cmd_ioctl
+ *
+ * Description:
+ * The size of MMC_IOC_MILTI_CMD's memory occupation is likely to be
+ * larger than that allocated by rpmsgblk_get_tx_payload_buffer, which
+ * is not allowed by current implement. So split the mmc_ioc_multi_cmd
+ * into mmc_ioc_cmds to transfer.
+ *
+ ****************************************************************************/
+
+static int rpmsgblk_mmc_multi_cmd_ioctl(FAR struct inode *inode,
+ unsigned long arg)
+{
+ FAR struct mmc_ioc_multi_cmd *mioc =
+ (FAR struct mmc_ioc_multi_cmd *)(uintptr_t)arg;
+ int ret = 0;
+ uint64_t i;
- if (cmd == BIOC_GEOMETRY)
+ for (i = 0; i < mioc->num_of_cmds; i++)
{
- return rpmsgblk_geometry(inode, (FAR struct geometry *)arg);
+ ret = rpmsgblk_mmc_cmd_ioctl(inode,
+ (unsigned long)(uintptr_t)&mioc->cmds[i]);
+ if (ret < 0)
+ {
+ return ret;
+ }
}
+ return ret;
+}
+
+/****************************************************************************
+ * Name: rpmsgblk_default_ioctl
+ ****************************************************************************/
+
+static int rpmsgblk_default_ioctl(FAR struct inode *inode, int cmd,
+ unsigned long arg)
+{
+ FAR struct rpmsgblk_s *priv = inode->i_private;
+ FAR struct rpmsgblk_ioctl_s *msg;
+ uint32_t space;
+ ssize_t arglen;
+ size_t msglen;
+
/* Call our internal routine to perform the ioctl */
- arglen = rpmsgblk_ioctl_arglen(cmd, arg);
+ arglen = rpmsgblk_ioctl_arglen(cmd);
if (arglen < 0)
{
return arglen;
@@ -605,54 +633,51 @@ static int rpmsgblk_ioctl(FAR struct inode *inode, int cmd,
if (arglen > 0)
{
- /* If args include a usrspace buffer pointer, then the content of this
- * pointer should also be copied into share memory and set after args.
- */
-
- if (cmd == MMC_IOC_CMD)
- {
- FAR struct mmc_ioc_cmd *ioc =
- (FAR struct mmc_ioc_cmd *)(uintptr_t)arg;
-
- memcpy(msg->buf, (FAR void *)(uintptr_t)arg, sizeof(*ioc));
- if (ioc->data_ptr)
- {
- memcpy(msg->buf + sizeof(*ioc),
- (FAR void *)(uintptr_t)ioc->data_ptr,
- ioc->blksz * ioc->blocks);
- }
- }
- else if (cmd == MMC_IOC_MULTI_CMD)
- {
- FAR struct mmc_ioc_multi_cmd *mioc =
- (FAR struct mmc_ioc_multi_cmd *)(uintptr_t)arg;
- uint64_t num = mioc->num_of_cmds;
- ssize_t copy = sizeof(struct mmc_ioc_multi_cmd) +
- num * sizeof(struct mmc_ioc_cmd);
- uint64_t i;
-
- memcpy(msg->buf, (FAR void *)(uintptr_t)arg, copy);
- for (i = 0; i < num; i++)
- {
- if (mioc->cmds[i].data_ptr)
- {
- memcpy(msg->buf + copy,
- (FAR void *)(uintptr_t)mioc->cmds[i].data_ptr,
- mioc->cmds[i].blksz * mioc->cmds[i].blocks);
- copy += mioc->cmds[i].blksz * mioc->cmds[i].blocks;
- }
- }
- }
- else
- {
- memcpy(msg->buf, (FAR void *)(uintptr_t)arg, arglen);
- }
+ memcpy(msg->buf, (FAR void *)(uintptr_t)arg, arglen);
}
return rpmsgblk_send_recv(priv, RPMSGBLK_IOCTL, false, &msg->header,
msglen, arglen > 0 ? (FAR void *)arg : NULL);
}
+/****************************************************************************
+ * Name: rpmsgblk_ioctl
+ *
+ * Description:
+ * Rpmsg-blk ioctl operation
+ *
+ * Parameters:
+ * inode - the blk device inode
+ * cmd - the ioctl command
+ * arg - the ioctl arguments
+ *
+ * Returned Values:
+ * OK on success; A negated errno value is returned on any failure.
+ *
+ ****************************************************************************/
+
+static int rpmsgblk_ioctl(FAR struct inode *inode, int cmd,
+ unsigned long arg)
+{
+ FAR struct rpmsgblk_s *priv = inode->i_private;
+
+ /* Sanity checks */
+
+ DEBUGASSERT(priv != NULL);
+
+ switch (cmd)
+ {
+ case BIOC_GEOMETRY:
+ return rpmsgblk_geometry(inode, (FAR struct geometry *)arg);
+ case MMC_IOC_CMD:
+ return rpmsgblk_mmc_cmd_ioctl(inode, arg);
+ case MMC_IOC_MULTI_CMD:
+ return rpmsgblk_mmc_multi_cmd_ioctl(inode, arg);
+ default:
+ return rpmsgblk_default_ioctl(inode, cmd, arg);
+ }
+}
+
/****************************************************************************
* Name: rpmsgblk_unlink
*
@@ -952,33 +977,6 @@ static int rpmsgblk_ioctl_handler(FAR struct rpmsg_endpoint *ept,
}
break;
- case MMC_IOC_MULTI_CMD:
- {
- FAR struct mmc_ioc_multi_cmd *mioc =
- (FAR struct mmc_ioc_multi_cmd *)(uintptr_t)cookie->data;
- FAR struct mmc_ioc_multi_cmd *mioc_rsp =
- (FAR struct mmc_ioc_multi_cmd *)(uintptr_t)rsp->buf;
- uint64_t num = mioc->num_of_cmds;
- size_t off = sizeof(struct mmc_ioc_multi_cmd) +
- num * sizeof(struct mmc_ioc_cmd);
- uint64_t i;
-
- for (i = 0; i < num; i++)
- {
- memcpy(&mioc->cmds[i], &mioc_rsp->cmds[i],
- sizeof(struct mmc_ioc_cmd) -
- sizeof(mioc->cmds[i].data_ptr));
- if (mioc->cmds[i].data_ptr)
- {
- memcpy((FAR void *)(uintptr_t)mioc->cmds[i].data_ptr,
- rsp->buf + off,
- mioc->cmds[i].blksz * mioc->cmds[i].blocks);
- off += mioc->cmds[i].blksz * mioc->cmds[i].blocks;
- }
- }
- }
- break;
-
default:
memcpy(cookie->data, rsp->buf, rsp->arglen);
break;
diff --git a/drivers/misc/rpmsgblk_server.c b/drivers/misc/rpmsgblk_server.c
index b8a304df1d..b8c0f050a2 100644
--- a/drivers/misc/rpmsgblk_server.c
+++ b/drivers/misc/rpmsgblk_server.c
@@ -345,27 +345,6 @@ static int rpmsgblk_ioctl_handler(FAR struct rpmsg_endpoint *ept,
}
break;
- case MMC_IOC_MULTI_CMD:
- {
- FAR struct mmc_ioc_multi_cmd *mioc =
- (FAR struct mmc_ioc_multi_cmd *)(uintptr_t)msg->buf;
- uint64_t num = mioc->num_of_cmds;
- size_t off = sizeof(struct mmc_ioc_multi_cmd) +
- num * sizeof(struct mmc_ioc_cmd);
- uint64_t i;
-
- for (i = 0; i < num; i++)
- {
- if (mioc->cmds[i].data_ptr)
- {
- mioc->cmds[i].data_ptr = (uint64_t)(uintptr_t)
- ((FAR uint8_t *)mioc + off);
- off += mioc->cmds[i].blksz * mioc->cmds[i].blocks;
- }
- }
- }
- break;
-
default:
break;
}
(nuttx) 01/05: rpmsgblk: bind block inode to ept when create ept
Posted by xi...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
xiaoxiang pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/nuttx.git
commit 27f672d55aca005347ef8d0bd16bef71f5e22157
Author: liaoao <li...@xiaomi.com>
AuthorDate: Mon Oct 9 21:09:00 2023 +0800
rpmsgblk: bind block inode to ept when create ept
A segmentfault might happen when read/write/unlink ops called without an open
ops called because it bind ept's ops in rpmsgblk_open_handler.
proxy> rm /dev/ram1
segmentfault
proxy> ls /dev/ram1
segmentfault
Signed-off-by: liaoao <li...@xiaomi.com>
---
drivers/misc/Make.defs | 1 +
drivers/misc/rpmsgblk_server.c | 52 ++++++++++++++++++++++++++----------------
fs/driver/driver.h | 27 ----------------------
include/nuttx/fs/fs.h | 25 ++++++++++++++++++++
4 files changed, 58 insertions(+), 47 deletions(-)
diff --git a/drivers/misc/Make.defs b/drivers/misc/Make.defs
index 4a73220e80..83d2b86f03 100644
--- a/drivers/misc/Make.defs
+++ b/drivers/misc/Make.defs
@@ -65,6 +65,7 @@ endif
ifeq ($(CONFIG_BLK_RPMSG_SERVER),y)
CSRCS += rpmsgblk_server.c
+ CFLAGS += ${INCDIR_PREFIX}$(TOPDIR)$(DELIM)fs$(DELIM)inode
endif
# Include build support
diff --git a/drivers/misc/rpmsgblk_server.c b/drivers/misc/rpmsgblk_server.c
index 1482e1ad3d..908075f5fc 100644
--- a/drivers/misc/rpmsgblk_server.c
+++ b/drivers/misc/rpmsgblk_server.c
@@ -31,6 +31,7 @@
#include <nuttx/fs/fs.h>
#include <nuttx/rptun/openamp.h>
+#include "inode.h"
#include "rpmsgblk.h"
/****************************************************************************
@@ -119,23 +120,19 @@ static int rpmsgblk_open_handler(FAR struct rpmsg_endpoint *ept,
FAR struct rpmsgblk_server_s *server = ept->priv;
FAR struct rpmsgblk_open_s *msg = data;
- if (server->blknode != NULL)
+ if (server->bops->open != NULL)
{
- msg->header.result = -EBUSY;
- goto out;
+ msg->header.result = server->bops->open(server->blknode);
+ if (msg->header.result < 0)
+ {
+ ferr("block device open failed, ret=%d\n", msg->header.result);
+ }
}
-
- msg->header.result = open_blockdriver(&ept->name[RPMSGBLK_NAME_PREFIX_LEN],
- 0, &server->blknode);
- if (msg->header.result < 0)
+ else
{
- ferr("block device open failed, ret=%d\n", msg->header.result);
- goto out;
+ msg->header.result = 0;
}
- server->bops = server->blknode->u.i_bops;
-
-out:
return rpmsg_send(ept, msg, sizeof(*msg));
}
@@ -150,17 +147,19 @@ static int rpmsgblk_close_handler(FAR struct rpmsg_endpoint *ept,
FAR struct rpmsgblk_server_s *server = ept->priv;
FAR struct rpmsgblk_close_s *msg = data;
- msg->header.result = close_blockdriver(server->blknode);
- if (msg->header.result < 0)
+ if (server->bops->close != NULL)
{
- ferr("block device close failed, ret=%d\n", msg->header.result);
- goto out;
+ msg->header.result = server->bops->close(server->blknode);
+ if (msg->header.result < 0)
+ {
+ ferr("block device close failed, ret=%d\n", msg->header.result);
+ }
+ }
+ else
+ {
+ msg->header.result = 0;
}
- server->bops = NULL;
- server->blknode = NULL;
-
-out:
return rpmsg_send(ept, msg, sizeof(*msg));
}
@@ -375,7 +374,18 @@ static void rpmsgblk_ns_bind(FAR struct rpmsg_device *rdev,
return;
}
+ ret = find_blockdriver(&name[RPMSGBLK_NAME_PREFIX_LEN], 0,
+ &server->blknode);
+ if (ret < 0)
+ {
+ ferr("ERROR: Failed to find %s block driver\n",
+ &name[RPMSGBLK_NAME_PREFIX_LEN]);
+ kmm_free(server);
+ return;
+ }
+
server->ept.priv = server;
+ server->bops = server->blknode->u.i_bops;
ret = rpmsg_create_ept(&server->ept, rdev, name,
RPMSG_ADDR_ANY, dest,
@@ -383,6 +393,7 @@ static void rpmsgblk_ns_bind(FAR struct rpmsg_device *rdev,
if (ret < 0)
{
ferr("endpoint create failed, ret=%d\n", ret);
+ inode_release(server->blknode);
kmm_free(server);
}
}
@@ -396,6 +407,7 @@ static void rpmsgblk_ns_unbind(FAR struct rpmsg_endpoint *ept)
FAR struct rpmsgblk_server_s *server = ept->priv;
rpmsg_destroy_ept(&server->ept);
+ inode_release(server->blknode);
kmm_free(server);
}
diff --git a/fs/driver/driver.h b/fs/driver/driver.h
index b2154d9273..05d719821f 100644
--- a/fs/driver/driver.h
+++ b/fs/driver/driver.h
@@ -48,33 +48,6 @@ extern "C"
* Public Function Prototypes
****************************************************************************/
-/****************************************************************************
- * Name: find_blockdriver
- *
- * Description:
- * Return the inode of the block driver specified by 'pathname'
- *
- * Input Parameters:
- * pathname - The full path to the block driver to be located
- * mountflags - If MS_RDONLY is not set, then driver must support write
- * operations (see include/sys/mount.h)
- * ppinode - Address of the location to return the inode reference
- *
- * Returned Value:
- * Returns zero on success or a negated errno on failure:
- *
- * ENOENT - No block driver of this name is registered
- * ENOTBLK - The inode associated with the pathname is not a block driver
- * EACCESS - The MS_RDONLY option was not set but this driver does not
- * support write access
- *
- ****************************************************************************/
-
-#ifndef CONFIG_DISABLE_MOUNTPOINT
-int find_blockdriver(FAR const char *pathname, int mountflags,
- FAR struct inode **ppinode);
-#endif
-
/****************************************************************************
* Name: register_partition_with_inode
*
diff --git a/include/nuttx/fs/fs.h b/include/nuttx/fs/fs.h
index 0016b87b09..4211d36470 100644
--- a/include/nuttx/fs/fs.h
+++ b/include/nuttx/fs/fs.h
@@ -1199,6 +1199,31 @@ int open_blockdriver(FAR const char *pathname, int mountflags,
int close_blockdriver(FAR struct inode *inode);
+/****************************************************************************
+ * Name: find_blockdriver
+ *
+ * Description:
+ * Return the inode of the block driver specified by 'pathname'
+ *
+ * Input Parameters:
+ * pathname - The full path to the block driver to be located
+ * mountflags - If MS_RDONLY is not set, then driver must support write
+ * operations (see include/sys/mount.h)
+ * ppinode - Address of the location to return the inode reference
+ *
+ * Returned Value:
+ * Returns zero on success or a negated errno on failure:
+ *
+ * ENOENT - No block driver of this name is registered
+ * ENOTBLK - The inode associated with the pathname is not a block driver
+ * EACCESS - The MS_RDONLY option was not set but this driver does not
+ * support write access
+ *
+ ****************************************************************************/
+
+int find_blockdriver(FAR const char *pathname, int mountflags,
+ FAR struct inode **ppinode);
+
/****************************************************************************
* Name: find_mtddriver
*