msm: eva: Releasing DSP buffers based on ref count

Added fixes to release DSP buffers only if the ref count
is zero and checking the fd is also matching or not while
freeing the DSP buffers.

Change-Id: I8d3475a0c50c7240142420d02a0444f718f883c2
Signed-off-by: Gopireddy Arunteja Reddy <[email protected]>

msm/eva/msm_cvp_buf.c

@@ -2394,9 +2394,10 @@ int cvp_release_dsp_buffers(struct msm_cvp_inst *inst,
 			"%s: %x : fd %x %s size %d",
 			__func__, hash32_ptr(inst->session), buf->fd,
 			smem->dma_buf->name, buf->size);
-		atomic_dec(&smem->refcount);
-		msm_cvp_smem_free(smem);
-		cvp_kmem_cache_free(&cvp_driver->smem_cache, smem);
+		if (atomic_dec_and_test(&smem->refcount)) {
+			msm_cvp_smem_free(smem);
+			cvp_kmem_cache_free(&cvp_driver->smem_cache, smem);
+		}
 	} else {
 		dprintk(CVP_ERR,
 			"%s: wrong owner %d %x : fd %x %s size %d",

msm/eva/msm_cvp_core.c

@@ -453,6 +453,7 @@ int msm_cvp_destroy(struct msm_cvp_inst *inst)
 		core->smem_leak_count += atomic_read(&inst->smem_count);
 	}
 	kfree(inst);
+	inst = NULL;
 	dprintk(CVP_SESS,
 		"sys-stat: nr_insts %d msgs %d, frames %d, bufs %d, smems %d\n",
 		atomic_read(&nr_insts),

msm/eva/msm_cvp_dsp.c

@@ -1485,9 +1485,9 @@ void __dsp_cvp_sess_create(struct cvp_dsp_cmd_msg *cmd)
 
 	inst->task = task;
 	dprintk(CVP_DSP,
-		"%s CREATE_SESS id 0x%x, cpu_low 0x%x, cpu_high 0x%x\n",
+		"%s CREATE_SESS id 0x%x, cpu_low 0x%x, cpu_high 0x%x, inst %pK, inst->session %pK\n",
 		__func__, cmd->session_id, cmd->session_cpu_low,
-		cmd->session_cpu_high);
+		cmd->session_cpu_high, inst, inst->session);
 
 	spin_lock(&inst->core->resources.pm_qos.lock);
 	inst->core->resources.pm_qos.off_vote_cnt++;
@@ -1811,8 +1811,9 @@ void __dsp_cvp_mem_alloc(struct cvp_dsp_cmd_msg *cmd)
 	cmd->sbuf.iova = buf->smem->device_addr;
 	cmd->sbuf.v_dsp_addr = v_dsp_addr;
 	dprintk(CVP_DSP, "%s: size %d, iova 0x%x, v_dsp_addr 0x%llx\n",
-		__func__, cmd->sbuf.size, cmd->sbuf.iova,
-		cmd->sbuf.v_dsp_addr);
+		__func__, cmd->sbuf.size, cmd->sbuf.iova, cmd->sbuf.v_dsp_addr);
+	dprintk(CVP_DSP, "%s: DSP2CPU_session_id 0x%x, smem_fd 0x%x, smem_refcount %d\n",
+		__func__, dsp2cpu_cmd->session_id, buf->smem->fd, buf->smem->refcount);
 
 	cvp_put_fastrpc_node(frpc_node);
 	return;
@@ -1883,7 +1884,8 @@ void __dsp_cvp_mem_free(struct cvp_dsp_cmd_msg *cmd)
 		}
 
 		/* Verify with device addr */
-		if (buf->smem->device_addr == dsp2cpu_cmd->sbuf.iova) {
+		if ((buf->smem->device_addr == dsp2cpu_cmd->sbuf.iova) &&
+			(buf->fd == dsp2cpu_cmd->sbuf.fd)) {
 			dprintk(CVP_DSP, "%s find device addr 0x%x\n",
 				__func__, buf->smem->device_addr);
 			dprintk(CVP_DSP, "fd in list 0x%x, fd from dsp 0x%x\n",