@@ -317,6 +317,8 @@ struct fastrpc_channel_ctx {
317317 /* Indicates, if channel is restricted to secure node only */
318318 int secure ;
319319 struct fastrpc_dsp_capabilities dsp_cap_kernel ;
320+ /* Indicates whether the channel supports unsigned PD */
321+ bool unsigned_support ;
320322};
321323
322324struct fastrpc_apps {
@@ -2040,9 +2042,12 @@ static void fastrpc_init(struct fastrpc_apps *me)
20402042 me -> channel [i ].sesscount = 0 ;
20412043 /* All channels are secure by default except CDSP */
20422044 me -> channel [i ].secure = SECURE_CHANNEL ;
2045+ me -> channel [i ].unsigned_support = false;
20432046 }
20442047 /* Set CDSP channel to non secure */
20452048 me -> channel [CDSP_DOMAIN_ID ].secure = NON_SECURE_CHANNEL ;
2049+ /* Set CDSP channel unsigned_support to true*/
2050+ me -> channel [CDSP_DOMAIN_ID ].unsigned_support = true;
20462051}
20472052
20482053static int fastrpc_release_current_dsp_process (struct fastrpc_file * fl );
@@ -2204,6 +2209,20 @@ static int fastrpc_init_process(struct fastrpc_file *fl,
22042209 struct fastrpc_buf * imem = NULL ;
22052210 unsigned long imem_dma_attr = 0 ;
22062211 char * proc_name = NULL ;
2212+ int unsigned_request = (uproc -> attrs & FASTRPC_MODE_UNSIGNED_MODULE );
2213+ int cid = fl -> cid ;
2214+ struct fastrpc_channel_ctx * chan = & me -> channel [cid ];
2215+
2216+ if (chan -> unsigned_support &&
2217+ fl -> dev_minor == MINOR_NUM_DEV ) {
2218+ /* Make sure third party applications */
2219+ /* can spawn only unsigned PD when */
2220+ /* channel configured as secure. */
2221+ if (chan -> secure && !unsigned_request ) {
2222+ err = - ECONNREFUSED ;
2223+ goto bail ;
2224+ }
2225+ }
22072226
22082227 VERIFY (err , 0 == (err = fastrpc_channel_open (fl )));
22092228 if (err )
@@ -3773,29 +3792,32 @@ static int fastrpc_get_info(struct fastrpc_file *fl, uint32_t *info)
37733792{
37743793 int err = 0 ;
37753794 uint32_t cid ;
3795+ struct fastrpc_apps * me = & gfa ;
37763796
37773797 VERIFY (err , fl != NULL );
37783798 if (err )
37793799 goto bail ;
37803800 err = fastrpc_set_process_info (fl );
37813801 if (err )
37823802 goto bail ;
3803+ cid = * info ;
37833804 if (fl -> cid == -1 ) {
3784- cid = * info ;
3805+ struct fastrpc_channel_ctx * chan = & me -> channel [cid ];
3806+
37853807 VERIFY (err , cid < NUM_CHANNELS );
37863808 if (err )
37873809 goto bail ;
37883810 /* Check to see if the device node is non-secure */
37893811 if (fl -> dev_minor == MINOR_NUM_DEV &&
37903812 fl -> apps -> secure_flag == true) {
37913813 /*
3792- * For non secure device node check and make sure that
3793- * the channel allows non-secure access
3794- * If not, bail. Session will not start.
3795- * cid will remain -1 and client will not be able to
3796- * invoke any other methods without failure
3814+ * If an app is trying to offload to a secure remote
3815+ * channel by opening the non-secure device node, allow
3816+ * the access if the subsystem supports unsigned
3817+ * offload. Untrusted apps will be restricted.
37973818 */
3798- if (fl -> apps -> channel [cid ].secure == SECURE_CHANNEL ) {
3819+ if (chan -> secure == SECURE_CHANNEL &&
3820+ !chan -> unsigned_support ) {
37993821 err = - EPERM ;
38003822 pr_err ("adsprpc: GetInfo failed dev %d, cid %d, secure %d\n" ,
38013823 fl -> dev_minor , cid ,
0 commit comments