Merge "smcinvoke: Port smcinvoke driver changes"

drivers/soc/qcom/smcinvoke.c

@@ -3,6 +3,8 @@
  * Copyright (c) 2016-2020, The Linux Foundation. All rights reserved.
  */
 
+#define pr_fmt(fmt) "smcinvoke: %s: " fmt, __func__
+
 #include <linux/module.h>
 #include <linux/mod_devicetable.h>
 #include <linux/device.h>
@@ -17,6 +19,7 @@
 #include <linux/uaccess.h>
 #include <linux/dma-buf.h>
 #include <linux/kref.h>
+#include <linux/signal.h>
 
 #include <linux/qcom_scm.h>
 #include <asm/cacheflush.h>
@@ -138,11 +141,12 @@ static LIST_HEAD(g_mem_objs);
 static uint16_t g_last_cb_server_id = CBOBJ_SERVER_ID_START;
 static uint16_t g_last_mem_rgn_id, g_last_mem_map_obj_id;
 static size_t g_max_cb_buf_size = SMCINVOKE_TZ_MIN_BUF_SIZE;
+static unsigned int cb_reqs_inflight;
 
 static long smcinvoke_ioctl(struct file *, unsigned int, unsigned long);
 static int smcinvoke_open(struct inode *, struct file *);
 static int smcinvoke_release(struct inode *, struct file *);
-static int destroy_cb_server(uint16_t);
+static int release_cb_server(uint16_t);
 
 static const struct file_operations g_smcinvoke_fops = {
 	.owner		= THIS_MODULE,
@@ -211,6 +215,7 @@ struct smcinvoke_server_info {
 	uint16_t server_id;
 	uint16_t state;
 	uint32_t txn_id;
+	struct kref ref_cnt;
 	wait_queue_head_t req_wait_q;
 	wait_queue_head_t rsp_wait_q;
 	size_t cb_buf_size;
@@ -246,6 +251,23 @@ struct smcinvoke_mem_obj {
 	struct list_head list;
 };
 
+static void destroy_cb_server(struct kref *kref)
+{
+	struct smcinvoke_server_info *server = container_of(kref,
+					struct smcinvoke_server_info, ref_cnt);
+	if (server) {
+		hash_del(&server->hash);
+		kfree(server);
+	}
+}
+
+/*
+ *  A separate find func is reqd mainly for couple of cases:
+ *  next_cb_server_id_locked which checks if server id had been utilized or not.
+ *      - It would be overhead if we do ref_cnt for this case
+ *  smcinvoke_release: which is called when server is closed from userspace.
+ *      - During server creation we init ref count, now put it back
+ */
 static struct smcinvoke_server_info *find_cb_server_locked(uint16_t server_id)
 {
 	struct smcinvoke_server_info *data = NULL;
@@ -257,6 +279,16 @@ static struct smcinvoke_server_info *find_cb_server_locked(uint16_t server_id)
 	return  NULL;
 }
 
+static struct smcinvoke_server_info *get_cb_server_locked(uint16_t server_id)
+{
+	struct smcinvoke_server_info *server = find_cb_server_locked(server_id);
+
+	if (server)
+		kref_get(&server->ref_cnt);
+
+	return server;
+}
+
 static uint16_t next_cb_server_id_locked(void)
 {
 	if (g_last_cb_server_id == CBOBJ_SERVER_ID_END)
@@ -370,8 +402,10 @@ static int release_mem_obj_locked(int32_t tzhandle)
 	struct smcinvoke_mem_obj *mem_obj = find_mem_obj_locked(
 			TZHANDLE_GET_OBJID(tzhandle), is_mem_regn_obj);
 
-	if (!mem_obj)
+	if (!mem_obj) {
+		pr_err("memory object not found\n");
 		return OBJECT_ERROR_BADOBJ;
+	}
 
 	if (is_mem_regn_obj)
 		kref_put(&mem_obj->mem_regn_ref_cnt, del_mem_regn_obj_locked);
@@ -389,59 +423,74 @@ static void free_pending_cbobj_locked(struct kref *kref)
 	list_del(&obj->list);
 	server = obj->server;
 	kfree(obj);
-	if ((server->state == SMCINVOKE_SERVER_STATE_DEFUNCT) &&
-				list_empty(&server->pending_cbobjs)) {
-		hash_del(&server->hash);
-		kfree(server);
-	}
+	if (server)
+		kref_put(&server->ref_cnt, destroy_cb_server);
 }
 
 static int get_pending_cbobj_locked(uint16_t srvr_id, int16_t obj_id)
 {
+	int ret = 0;
+	bool release_server = true;
 	struct list_head *head = NULL;
 	struct smcinvoke_cbobj *cbobj = NULL;
 	struct smcinvoke_cbobj *obj = NULL;
-	struct smcinvoke_server_info *server = find_cb_server_locked(srvr_id);
+	struct smcinvoke_server_info *server = get_cb_server_locked(srvr_id);
 
-	if (!server)
+	if (!server) {
+		pr_err("%s, server id : %u not found\n", __func__, srvr_id);
 		return OBJECT_ERROR_BADOBJ;
+	}
 
 	head = &server->pending_cbobjs;
 	list_for_each_entry(cbobj, head, list)
 		if (cbobj->cbobj_id == obj_id)  {
 			kref_get(&cbobj->ref_cnt);
-			return 0;
+			goto out;
 		}
 
 	obj = kzalloc(sizeof(*obj), GFP_KERNEL);
-	if (!obj)
-		return OBJECT_ERROR_KMEM;
+	if (!obj) {
+		ret = OBJECT_ERROR_KMEM;
+		goto out;
+	}
 
 	obj->cbobj_id = obj_id;
 	kref_init(&obj->ref_cnt);
 	obj->server = server;
+	/*
+	 * we are holding server ref in cbobj; we will
+	 * release server ref when cbobj is destroyed
+	 */
+	release_server = false;
 	list_add_tail(&obj->list, head);
-
-	return 0;
+out:
+	if (release_server)
+		kref_put(&server->ref_cnt, destroy_cb_server);
+	return ret;
 }
 
 static int put_pending_cbobj_locked(uint16_t srvr_id, int16_t obj_id)
 {
+	int ret = -EINVAL;
 	struct smcinvoke_server_info *srvr_info =
-					find_cb_server_locked(srvr_id);
+					get_cb_server_locked(srvr_id);
 	struct list_head *head = NULL;
 	struct smcinvoke_cbobj *cbobj = NULL;
 
-	if (!srvr_info)
-		return -EINVAL;
+	if (!srvr_info) {
+		pr_err("%s, server id : %u not found\n", __func__, srvr_id);
+		return ret;
+	}
 
 	head = &srvr_info->pending_cbobjs;
 	list_for_each_entry(cbobj, head, list)
 		if (cbobj->cbobj_id == obj_id)  {
 			kref_put(&cbobj->ref_cnt, free_pending_cbobj_locked);
-			return 0;
+			ret = 0;
+			break;
 		}
-	return -EINVAL;
+	kref_put(&srvr_info->ref_cnt, destroy_cb_server);
+	return ret;
 }
 
 static int release_tzhandle_locked(int32_t tzhandle)
@@ -743,8 +792,10 @@ static int32_t smcinvoke_release_mem_obj_locked(void *buf, size_t buf_len)
 {
 	struct smcinvoke_tzcb_req *msg = buf;
 
-	if (msg->hdr.counts != OBJECT_COUNTS_PACK(0, 0, 0, 0))
+	if (msg->hdr.counts != OBJECT_COUNTS_PACK(0, 0, 0, 0)) {
+		pr_err("Invalid object count in %s\n", __func__);
 		return OBJECT_ERROR_INVALID;
+	}
 
 	return release_tzhandle_locked(msg->hdr.tzhandle);
 }
@@ -764,9 +815,10 @@ static int32_t smcinvoke_map_mem_region(void *buf, size_t buf_len)
 	struct sg_table *sgt = NULL;
 
 	if (msg->hdr.counts != OBJECT_COUNTS_PACK(0, 1, 1, 1) ||
-		(buf_len - msg->args[0].b.offset <  msg->args[0].b.size))
+		(buf_len - msg->args[0].b.offset <  msg->args[0].b.size)) {
+		pr_err("Invalid counts received for mapping mem obj\n");
 		return OBJECT_ERROR_INVALID;
-
+	}
 	/* args[0] = BO, args[1] = OI, args[2] = OO */
 	ob = buf + msg->args[0].b.offset;
 	oo =  &msg->args[2].handle;
@@ -776,6 +828,7 @@ static int32_t smcinvoke_map_mem_region(void *buf, size_t buf_len)
 						SMCINVOKE_MEM_RGN_OBJ);
 	if (!mem_obj) {
 		mutex_unlock(&g_smcinvoke_lock);
+		pr_err("Memory object not found\n");
 		return OBJECT_ERROR_BADOBJ;
 	}
 
@@ -785,6 +838,7 @@ static int32_t smcinvoke_map_mem_region(void *buf, size_t buf_len)
 					&smcinvoke_pdev->dev);
 		if (IS_ERR(buf_attach)) {
 			ret = OBJECT_ERROR_KMEM;
+			pr_err("dma buf attach failed, ret: %d\n", ret);
 			goto out;
 		}
 		mem_obj->buf_attach = buf_attach;
@@ -792,6 +846,7 @@ static int32_t smcinvoke_map_mem_region(void *buf, size_t buf_len)
 		sgt = dma_buf_map_attachment(buf_attach, DMA_BIDIRECTIONAL);
 		if (IS_ERR(sgt)) {
 			ret = OBJECT_ERROR_KMEM;
+			pr_err("mapping dma buffers failed, ret: %d\n", ret);
 			goto out;
 		}
 		mem_obj->sgt = sgt;
@@ -799,12 +854,14 @@ static int32_t smcinvoke_map_mem_region(void *buf, size_t buf_len)
 		/* contiguous only => nents=1 */
 		if (sgt->nents != 1) {
 			ret = OBJECT_ERROR_INVALID;
+			pr_err("sg enries are not contigous, ret: %d\n", ret);
 			goto out;
 		}
 		mem_obj->p_addr = sg_dma_address(sgt->sgl);
 		mem_obj->p_addr_len = sgt->sgl->length;
 		if (!mem_obj->p_addr) {
 			ret = OBJECT_ERROR_INVALID;
+			pr_err("invalid physical address, ret: %d\n", ret);
 			goto out;
 		}
 		mem_obj->mem_map_obj_id = next_mem_map_obj_id_locked();
@@ -826,9 +883,18 @@ static void process_kernel_obj(void *buf, size_t buf_len)
 {
 	struct smcinvoke_tzcb_req *cb_req = buf;
 
-	cb_req->result = (cb_req->hdr.op == OBJECT_OP_MAP_REGION) ?
-			smcinvoke_map_mem_region(buf, buf_len) :
-			OBJECT_ERROR_INVALID;
+	switch (cb_req->hdr.op) {
+	case OBJECT_OP_MAP_REGION:
+		cb_req->result = smcinvoke_map_mem_region(buf, buf_len);
+		break;
+	case OBJECT_OP_YIELD:
+		cb_req->result = OBJECT_OK;
+		break;
+	default:
+		pr_err(" invalid operation for tz kernel object\n");
+		cb_req->result = OBJECT_ERROR_INVALID;
+		break;
+	}
 }
 
 static void process_mem_obj(void *buf, size_t buf_len)
@@ -853,8 +919,10 @@ static void process_tzcb_req(void *buf, size_t buf_len, struct file **arr_filp)
 	struct smcinvoke_tzcb_req *cb_req = NULL, *tmp_cb_req = NULL;
 	struct smcinvoke_server_info *srvr_info = NULL;
 
-	if (buf_len < sizeof(struct smcinvoke_tzcb_req))
+	if (buf_len < sizeof(struct smcinvoke_tzcb_req)) {
+		pr_err("smaller buffer length : %u\n", buf_len);
 		return;
+	}
 
 	cb_req = buf;
 
@@ -864,6 +932,7 @@ static void process_tzcb_req(void *buf, size_t buf_len, struct file **arr_filp)
 	} else if (TZHANDLE_IS_MEM_OBJ(cb_req->hdr.tzhandle)) {
 		return process_mem_obj(buf, buf_len);
 	} else if (!TZHANDLE_IS_CB_OBJ(cb_req->hdr.tzhandle)) {
+		pr_err("Request object is not a callback object\n");
 		cb_req->result = OBJECT_ERROR_INVALID;
 		return;
 	}
@@ -877,12 +946,16 @@ static void process_tzcb_req(void *buf, size_t buf_len, struct file **arr_filp)
 	if (!tmp_cb_req) {
 		/* we need to return error to caller so fill up result */
 		cb_req->result = OBJECT_ERROR_KMEM;
+		pr_err("failed to create copy of request, set result: %d\n",
+							cb_req->result);
 		return;
 	}
 
 	cb_txn = kzalloc(sizeof(*cb_txn), GFP_KERNEL);
 	if (!cb_txn) {
 		cb_req->result = OBJECT_ERROR_KMEM;
+		pr_err("failed to allocate memory for request, result: %d\n",
+							cb_req->result);
 		kfree(tmp_cb_req);
 		return;
 	}
@@ -896,10 +969,12 @@ static void process_tzcb_req(void *buf, size_t buf_len, struct file **arr_filp)
 	kref_init(&cb_txn->ref_cnt);
 
 	mutex_lock(&g_smcinvoke_lock);
-	srvr_info = find_cb_server_locked(
+	++cb_reqs_inflight;
+	srvr_info = get_cb_server_locked(
 				TZHANDLE_GET_SERVER(cb_req->hdr.tzhandle));
 	if (!srvr_info || srvr_info->state == SMCINVOKE_SERVER_STATE_DEFUNCT) {
 		/* ret equals Object_ERROR_DEFUNCT, at this point go to out */
+		pr_err("sever is either invalid or defunct\n");
 		mutex_unlock(&g_smcinvoke_lock);
 		goto out;
 	}
@@ -911,10 +986,11 @@ static void process_tzcb_req(void *buf, size_t buf_len, struct file **arr_filp)
 	 * we need not worry that server_info will be deleted because as long
 	 * as this CBObj is served by this server, srvr_info will be valid.
 	 */
-	wake_up_interruptible(&srvr_info->req_wait_q);
+	wake_up_interruptible_all(&srvr_info->req_wait_q);
 	ret = wait_event_interruptible(srvr_info->rsp_wait_q,
-			(cb_txn->state == SMCINVOKE_REQ_PROCESSED) ||
-			(srvr_info->state == SMCINVOKE_SERVER_STATE_DEFUNCT));
+		(cb_txn->state == SMCINVOKE_REQ_PROCESSED) ||
+		(srvr_info->state == SMCINVOKE_SERVER_STATE_DEFUNCT));
+
 out:
 	/*
 	 * we could be here because of either: a. Req is PROCESSED
@@ -931,12 +1007,16 @@ out:
 	} else if (!srvr_info ||
 		srvr_info->state == SMCINVOKE_SERVER_STATE_DEFUNCT) {
 		cb_req->result = OBJECT_ERROR_DEFUNCT;
+		pr_err("server invalid, res: %d\n", cb_req->result);
 	} else {
 		pr_debug("%s wait_event interrupted ret = %d\n", __func__, ret);
 		cb_req->result = OBJECT_ERROR_ABORT;
 	}
+	--cb_reqs_inflight;
 	memcpy(buf, cb_req, buf_len);
 	kref_put(&cb_txn->ref_cnt, delete_cb_txn);
+	if (srvr_info)
+		kref_put(&srvr_info->ref_cnt, destroy_cb_server);
 	mutex_unlock(&g_smcinvoke_lock);
 }
 
@@ -1383,18 +1463,21 @@ static long process_server_req(struct file *filp, unsigned int cmd,
 	struct smcinvoke_server server_req = {0};
 	struct smcinvoke_server_info *server_info = NULL;
 
-	if (_IOC_SIZE(cmd) != sizeof(server_req))
+	if (_IOC_SIZE(cmd) != sizeof(server_req)) {
+		pr_err("invalid command size received for server request\n");
 		return -EINVAL;
-
+	}
 	ret = copy_from_user(&server_req, (void __user *)(uintptr_t)arg,
 					sizeof(server_req));
-	if (ret)
+	if (ret) {
+		pr_err("copying server request from user failed\n");
 		return -EFAULT;
-
+	}
 	server_info = kzalloc(sizeof(*server_info), GFP_KERNEL);
 	if (!server_info)
 		return -ENOMEM;
 
+	kref_init(&server_info->ref_cnt);
 	init_waitqueue_head(&server_info->req_wait_q);
 	init_waitqueue_head(&server_info->rsp_wait_q);
 	server_info->cb_buf_size = server_req.cb_buf_size;
@@ -1415,7 +1498,7 @@ static long process_server_req(struct file *filp, unsigned int cmd,
 				server_info->server_id, &server_fd);
 
 	if (ret)
-		destroy_cb_server(server_info->server_id);
+		release_cb_server(server_info->server_id);
 
 	return server_fd;
 }
@@ -1429,25 +1512,42 @@ static long process_accept_req(struct file *filp, unsigned int cmd,
 	struct smcinvoke_cb_txn *cb_txn = NULL;
 	struct smcinvoke_server_info *server_info = NULL;
 
-	if (_IOC_SIZE(cmd) != sizeof(struct smcinvoke_accept))
+	if (_IOC_SIZE(cmd) != sizeof(struct smcinvoke_accept)) {
+		pr_err("command size invalid for accept request\n");
 		return -EINVAL;
+	}
 
 	if (copy_from_user(&user_args, (void __user *)arg,
-					sizeof(struct smcinvoke_accept)))
+					sizeof(struct smcinvoke_accept))) {
+		pr_err("copying accept request from user failed\n");
 		return -EFAULT;
+	}
 
-	if (user_args.argsize != sizeof(union smcinvoke_arg))
+	if (user_args.argsize != sizeof(union smcinvoke_arg)) {
+		pr_err("arguments size is invalid for accept thread\n");
 		return -EINVAL;
+	}
 
 	/* ACCEPT is available only on server obj */
-	if (server_obj->context_type != SMCINVOKE_OBJ_TYPE_SERVER)
+	if (server_obj->context_type != SMCINVOKE_OBJ_TYPE_SERVER) {
+		pr_err("invalid object type received for accept req\n");
 		return -EPERM;
+	}
 
 	mutex_lock(&g_smcinvoke_lock);
-	server_info = find_cb_server_locked(server_obj->server_id);
-	mutex_unlock(&g_smcinvoke_lock);
-	if (!server_info)
+	server_info = get_cb_server_locked(server_obj->server_id);
+
+	if (!server_info) {
+		pr_err("No matching server with server id : %u found\n",
+					server_obj->server_id);
+		mutex_unlock(&g_smcinvoke_lock);
 		return -EINVAL;
+	}
+
+	if (server_info->state == SMCINVOKE_SERVER_STATE_DEFUNCT)
+		server_info->state = 0;
+
+	mutex_unlock(&g_smcinvoke_lock);
 
 	/* First check if it has response otherwise wait for req */
 	if (user_args.has_resp) {
@@ -1498,9 +1598,19 @@ static long process_accept_req(struct file *filp, unsigned int cmd,
 		if (ret) {
 			pr_debug("%s wait_event interrupted: ret = %d\n",
 							__func__, ret);
+			/*
+			 * Ideally, we should destroy server if accept threads
+			 * are returning due to client being killed or device
+			 * going down (Shutdown/Reboot) but that would make
+			 * server_info invalid. Other accept/invoke threads are
+			 * using server_info and would crash. So dont do that.
+			 */
+			mutex_lock(&g_smcinvoke_lock);
+			server_info->state = SMCINVOKE_SERVER_STATE_DEFUNCT;
+			mutex_unlock(&g_smcinvoke_lock);
+			wake_up_interruptible(&server_info->rsp_wait_q);
 			goto out;
 		}
-
 		mutex_lock(&g_smcinvoke_lock);
 		cb_txn = find_cbtxn_locked(server_info,
 						SMCINVOKE_NEXT_AVAILABLE_TXN,
@@ -1511,6 +1621,7 @@ static long process_accept_req(struct file *filp, unsigned int cmd,
 			ret = marshal_in_tzcb_req(cb_txn, &user_args,
 							server_obj->server_id);
 			if (ret) {
+				pr_err("failed to marshal in the callback request\n");
 				cb_txn->cb_req->result = OBJECT_ERROR_UNAVAIL;
 				cb_txn->state = SMCINVOKE_REQ_PROCESSED;
 				kref_put(&cb_txn->ref_cnt, delete_cb_txn);
@@ -1527,6 +1638,12 @@ static long process_accept_req(struct file *filp, unsigned int cmd,
 		}
 	} while (!cb_txn);
 out:
+	if (server_info)
+		kref_put(&server_info->ref_cnt, destroy_cb_server);
+
+	if (ret && ret != -ERESTARTSYS)
+		pr_err("accept thread returning with ret: %d\n", ret);
+
 	return ret;
 }
 
@@ -1553,18 +1670,26 @@ static long process_invoke_req(struct file *filp, unsigned int cmd,
 	int32_t tzhandles_to_release[OBJECT_COUNTS_MAX_OO] = {0};
 	bool tz_acked = false;
 
-	if (_IOC_SIZE(cmd) != sizeof(req))
+	if (_IOC_SIZE(cmd) != sizeof(req)) {
+		pr_err("command size for invoke req is invalid\n");
 		return -EINVAL;
+	}
 
-	if (tzobj->context_type != SMCINVOKE_OBJ_TYPE_TZ_OBJ)
+	if (tzobj->context_type != SMCINVOKE_OBJ_TYPE_TZ_OBJ) {
+		pr_err("object type for invoke req is invalid\n");
 		return -EPERM;
+	}
 
 	ret = copy_from_user(&req, (void __user *)arg, sizeof(req));
-	if (ret)
+	if (ret) {
+		pr_err("copying invoke req failed\n");
 		return -EFAULT;
+	}
 
-	if (req.argsize != sizeof(union smcinvoke_arg))
+	if (req.argsize != sizeof(union smcinvoke_arg)) {
+		pr_err("arguments size for invoke req is invalid\n");
 		return -EINVAL;
+	}
 
 	nr_args = OBJECT_COUNTS_NUM_buffers(req.counts) +
 			OBJECT_COUNTS_NUM_objects(req.counts);
@@ -1587,6 +1712,7 @@ static long process_invoke_req(struct file *filp, unsigned int cmd,
 	ret = qtee_shmbridge_allocate_shm(inmsg_size, &in_shm);
 	if (ret) {
 		ret = -ENOMEM;
+		pr_err("shmbridge alloc failed for in msg in invoke req\n");
 		goto out;
 	}
 	in_msg = in_shm.vaddr;
@@ -1597,14 +1723,17 @@ static long process_invoke_req(struct file *filp, unsigned int cmd,
 	ret = qtee_shmbridge_allocate_shm(outmsg_size, &out_shm);
 	if (ret) {
 		ret = -ENOMEM;
+		pr_err("shmbridge alloc failed for out msg in invoke req\n");
 		goto out;
 	}
 	out_msg = out_shm.vaddr;
 
 	ret = marshal_in_invoke_req(&req, args_buf, tzobj->tzhandle, in_msg,
 			inmsg_size, filp_to_release, tzhandles_to_release);
-	if (ret)
+	if (ret) {
+		pr_err("failed to marshal in invoke req, ret :%d\n", ret);
 		goto out;
+	}
 
 	ret = prepare_send_scm_msg(in_msg, in_shm.paddr, inmsg_size,
 					out_msg, out_shm.paddr, outmsg_size,
@@ -1614,8 +1743,10 @@ static long process_invoke_req(struct file *filp, unsigned int cmd,
 	 * If scm_call is success, TZ owns responsibility to release
 	 * refs for local objs.
 	 */
-	if (!tz_acked)
+	if (!tz_acked) {
+		pr_debug("scm call successful\n");
 		goto out;
+	}
 	memset(tzhandles_to_release, 0, sizeof(tzhandles_to_release));
 
 	/*
@@ -1646,6 +1777,10 @@ out:
 	qtee_shmbridge_free_shm(&in_shm);
 	qtee_shmbridge_free_shm(&out_shm);
 	kfree(args_buf);
+
+	if (ret)
+		pr_err("invoke thread returning with ret = %d\n", ret);
+
 	return ret;
 }
 
@@ -1689,26 +1824,14 @@ static int smcinvoke_open(struct inode *nodp, struct file *filp)
 	return 0;
 }
 
-static int destroy_cb_server(uint16_t server_id)
+static int release_cb_server(uint16_t server_id)
 {
 	struct smcinvoke_server_info *server = NULL;
 
 	mutex_lock(&g_smcinvoke_lock);
 	server = find_cb_server_locked(server_id);
-	if (server) {
-		if (!list_empty(&server->pending_cbobjs)) {
-			server->state = SMCINVOKE_SERVER_STATE_DEFUNCT;
-			wake_up_interruptible(&server->rsp_wait_q);
-			/*
-			 * we dont worry about threads waiting on req_wait_q
-			 * because server can't be closed as long as there is
-			 * atleast one accept thread active
-			 */
-		} else {
-			hash_del(&server->hash);
-			kfree(server);
-		}
-	}
+	if (server)
+		kref_put(&server->ref_cnt, destroy_cb_server);
 	mutex_unlock(&g_smcinvoke_lock);
 	return 0;
 }
@@ -1726,7 +1849,7 @@ static int smcinvoke_release(struct inode *nodp, struct file *filp)
 	struct qtee_shm in_shm = {0}, out_shm = {0};
 
 	if (file_data->context_type == SMCINVOKE_OBJ_TYPE_SERVER) {
-		ret = destroy_cb_server(file_data->server_id);
+		ret = release_cb_server(file_data->server_id);
 		goto out;
 	}
 
@@ -1738,12 +1861,14 @@ static int smcinvoke_release(struct inode *nodp, struct file *filp)
 	ret = qtee_shmbridge_allocate_shm(SMCINVOKE_TZ_MIN_BUF_SIZE, &in_shm);
 	if (ret) {
 		ret = -ENOMEM;
+		pr_err("shmbridge alloc failed for in msg in release\n");
 		goto out;
 	}
 
 	ret = qtee_shmbridge_allocate_shm(SMCINVOKE_TZ_MIN_BUF_SIZE, &out_shm);
 	if (ret) {
 		ret = -ENOMEM;
+		pr_err("shmbridge alloc failed for out msg in release\n");
 		goto out;
 	}
 
@@ -1826,6 +1951,25 @@ static int smcinvoke_remove(struct platform_device *pdev)
 	return 0;
 }
 
+static int __maybe_unused smcinvoke_suspend(struct platform_device *pdev,
+					pm_message_t state)
+{
+	int ret = 0;
+
+	mutex_lock(&g_smcinvoke_lock);
+	if (cb_reqs_inflight) {
+		pr_err("Failed to suspend smcinvoke driver\n");
+		ret = -EIO;
+	}
+	mutex_unlock(&g_smcinvoke_lock);
+	return ret;
+}
+
+static int __maybe_unused smcinvoke_resume(struct platform_device *pdev)
+{
+	return 0;
+}
+
 static const struct of_device_id smcinvoke_match[] = {
 	{
 		.compatible = "qcom,smcinvoke",
@@ -1836,6 +1980,8 @@ static const struct of_device_id smcinvoke_match[] = {
 static struct platform_driver smcinvoke_plat_driver = {
 	.probe = smcinvoke_probe,
 	.remove = smcinvoke_remove,
+	.suspend = smcinvoke_suspend,
+	.resume = smcinvoke_resume,
 	.driver = {
 		.name = "smcinvoke",
 		.of_match_table = smcinvoke_match,

drivers/soc/qcom/smcinvoke_object.h

@@ -16,6 +16,7 @@
 #define OBJECT_OP_RELEASE       (OBJECT_OP_METHOD_MASK - 0)
 #define OBJECT_OP_RETAIN        (OBJECT_OP_METHOD_MASK - 1)
 #define OBJECT_OP_MAP_REGION    0
+#define OBJECT_OP_YIELD 1
 
 #define OBJECT_COUNTS_MAX_BI   0xF
 #define OBJECT_COUNTS_MAX_BO   0xF