From 6a1c52956f6886d02e99c7f92d87e3851f343b4c Mon Sep 17 00:00:00 2001 From: Ashok Vuyyuru Date: Mon, 26 Oct 2020 17:14:19 +0530 Subject: [PATCH 1/5] msm: ipa3: Enable hardbyte limit for WAN consumer pipe Enable hardbyte limit WAN consumer pipe. Change-Id: I27c5af71aeadfb40e6870da24c0b69f1cd60d806 Signed-off-by: Ashok Vuyyuru --- drivers/platform/msm/ipa/ipa_v3/ipa_dp.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/platform/msm/ipa/ipa_v3/ipa_dp.c b/drivers/platform/msm/ipa/ipa_v3/ipa_dp.c index 99fbd68e0e51..5e05e5d9f628 100644 --- a/drivers/platform/msm/ipa/ipa_v3/ipa_dp.c +++ b/drivers/platform/msm/ipa/ipa_v3/ipa_dp.c @@ -3922,7 +3922,9 @@ static void ipa3_set_aggr_limit(struct ipa_sys_connect_params *in, sys->ep->status.status_en = false; sys->rx_buff_sz = IPA_GENERIC_RX_BUFF_SZ(adjusted_sz); - if (in->client == IPA_CLIENT_APPS_WAN_COAL_CONS) + if (in->client == IPA_CLIENT_APPS_WAN_COAL_CONS || + (in->client == IPA_CLIENT_APPS_WAN_CONS && + ipa3_ctx->ipa_hw_type <= IPA_HW_v4_2)) in->ipa_ep_cfg.aggr.aggr_hard_byte_limit_en = 1; *aggr_byte_limit = sys->rx_buff_sz < *aggr_byte_limit ? From 579642679d56ac26f46d9791af12462331143c2a Mon Sep 17 00:00:00 2001 From: Praveen Kurapati Date: Thu, 3 Jun 2021 14:35:29 +0530 Subject: [PATCH 2/5] msm: ipa3: Add change to retry memory allocation on failure Adding changes to retry with GFP_KENREL flag when memory allocation fails with GFP_ATOMIC flag. Panic the device if after max retries also memory allocation fails. Change-Id: Ic9ad827757de92715be5acc5645b7e860b4bd0e4 Signed-off-by: Praveen Kurapati --- drivers/platform/msm/ipa/ipa_v3/ipa_dp.c | 45 ++++++++++++++++-------- 1 file changed, 31 insertions(+), 14 deletions(-) diff --git a/drivers/platform/msm/ipa/ipa_v3/ipa_dp.c b/drivers/platform/msm/ipa/ipa_v3/ipa_dp.c index 99fbd68e0e51..debb01d2f864 100644 --- a/drivers/platform/msm/ipa/ipa_v3/ipa_dp.c +++ b/drivers/platform/msm/ipa/ipa_v3/ipa_dp.c @@ -89,6 +89,8 @@ #define IPA_QMAP_ID_BYTE 0 +#define IPA_MEM_ALLOC_RETRY 5 + static struct sk_buff *ipa3_get_skb_ipa_rx(unsigned int len, gfp_t flags); static void ipa3_replenish_wlan_rx_cache(struct ipa3_sys_context *sys); static void ipa3_replenish_rx_cache(struct ipa3_sys_context *sys); @@ -4876,6 +4878,33 @@ fail_setup_event_ring: return result; } +static void *ipa3_ring_alloc(struct device *dev, size_t size, + dma_addr_t *dma_handle, gfp_t gfp) +{ + void *va_addr; + int retry_cnt = 0; + +alloc: + va_addr = dma_alloc_coherent(dev, size, dma_handle, gfp); + if (!va_addr) { + if (retry_cnt < IPA_MEM_ALLOC_RETRY) { + IPADBG("Fail to dma alloc retry cnt = %d\n", + retry_cnt); + retry_cnt++; + goto alloc; + } + + if (gfp == GFP_ATOMIC) { + gfp = GFP_KERNEL; + goto alloc; + } + IPAERR("fail to dma alloc %u bytes\n", size); + ipa_assert(); + } + + return va_addr; +} + static int ipa_gsi_setup_event_ring(struct ipa3_ep_context *ep, u32 ring_size, gfp_t mem_flag) { @@ -4892,13 +4921,8 @@ static int ipa_gsi_setup_event_ring(struct ipa3_ep_context *ep, gsi_evt_ring_props.re_size = GSI_EVT_RING_RE_SIZE_16B; gsi_evt_ring_props.ring_len = ring_size; gsi_evt_ring_props.ring_base_vaddr = - dma_alloc_coherent(ipa3_ctx->pdev, gsi_evt_ring_props.ring_len, + ipa3_ring_alloc(ipa3_ctx->pdev, gsi_evt_ring_props.ring_len, &evt_dma_addr, mem_flag); - if (!gsi_evt_ring_props.ring_base_vaddr) { - IPAERR("fail to dma alloc %u bytes\n", - gsi_evt_ring_props.ring_len); - return -ENOMEM; - } gsi_evt_ring_props.ring_base_addr = evt_dma_addr; /* copy mem info */ @@ -5006,14 +5030,8 @@ static int ipa_gsi_setup_transfer_ring(struct ipa3_ep_context *ep, gsi_channel_props.ring_len = ring_size; gsi_channel_props.ring_base_vaddr = - dma_alloc_coherent(ipa3_ctx->pdev, gsi_channel_props.ring_len, + ipa3_ring_alloc(ipa3_ctx->pdev, gsi_channel_props.ring_len, &dma_addr, mem_flag); - if (!gsi_channel_props.ring_base_vaddr) { - IPAERR("fail to dma alloc %u bytes\n", - gsi_channel_props.ring_len); - result = -ENOMEM; - goto fail_alloc_channel_ring; - } gsi_channel_props.ring_base_addr = dma_addr; /* copy mem info */ @@ -5091,7 +5109,6 @@ fail_alloc_channel: dma_free_coherent(ipa3_ctx->pdev, ep->gsi_mem_info.chan_ring_len, ep->gsi_mem_info.chan_ring_base_vaddr, ep->gsi_mem_info.chan_ring_base_addr); -fail_alloc_channel_ring: fail_get_gsi_ep_info: if (ep->gsi_evt_ring_hdl != ~0) { gsi_dealloc_evt_ring(ep->gsi_evt_ring_hdl); From 76d313e0f73581f8018c3e3c778d4f1318983b50 Mon Sep 17 00:00:00 2001 From: Chaitanya Pratapa Date: Thu, 24 Jun 2021 18:34:37 -0700 Subject: [PATCH 3/5] msm: ipa: fix IPA_COALESCE_DISABLE handling Make changes to populate qmap_id when disabling coalescing. Change-Id: Iaf0981bd22948b87bb8f9c548fe74e789eaf689c Signed-off-by: Chaitanya Pratapa --- drivers/platform/msm/ipa/ipa_v3/rmnet_ipa.c | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-) diff --git a/drivers/platform/msm/ipa/ipa_v3/rmnet_ipa.c b/drivers/platform/msm/ipa/ipa_v3/rmnet_ipa.c index 3eb145ba5162..3916ecc9b469 100644 --- a/drivers/platform/msm/ipa/ipa_v3/rmnet_ipa.c +++ b/drivers/platform/msm/ipa/ipa_v3/rmnet_ipa.c @@ -2232,16 +2232,14 @@ static int rmnet_ipa_send_coalesce_notification(uint8_t qmap_id, if (!coalesce_info) return -ENOMEM; - if (enable) { - coalesce_info->qmap_id = qmap_id; - coalesce_info->tcp_enable = tcp; - coalesce_info->udp_enable = udp; + coalesce_info->qmap_id = qmap_id; + coalesce_info->tcp_enable = tcp; + coalesce_info->udp_enable = udp; + msg_meta.msg_len = sizeof(struct ipa_coalesce_info); + if (enable) msg_meta.msg_type = IPA_COALESCE_ENABLE; - msg_meta.msg_len = sizeof(struct ipa_coalesce_info); - } else { + else msg_meta.msg_type = IPA_COALESCE_DISABLE; - msg_meta.msg_len = sizeof(struct ipa_coalesce_info); - } rc = ipa_send_msg(&msg_meta, coalesce_info, ipa3_wwan_msg_free_cb); if (rc) { IPAWANERR("ipa_send_msg failed: %d\n", rc); From 842d33d296a48a0fd02f501cd24b6b2691fce018 Mon Sep 17 00:00:00 2001 From: Pooja Kumari Date: Thu, 8 Jul 2021 11:48:56 +0530 Subject: [PATCH 4/5] msm: ipa3: ignore multiple crash Ignore recursive panic and multiple crash instances. Change-Id: If76d8bb095fa68979bf6a98929fd4629cc3a9c75 Signed-off-by: Pooja Kumari --- drivers/platform/msm/ipa/ipa_v3/ipa.c | 8 ++++++++ drivers/platform/msm/ipa/ipa_v3/ipa_i.h | 1 + 2 files changed, 9 insertions(+) diff --git a/drivers/platform/msm/ipa/ipa_v3/ipa.c b/drivers/platform/msm/ipa/ipa_v3/ipa.c index 07c2d2f61964..7d6b5802dfb0 100644 --- a/drivers/platform/msm/ipa/ipa_v3/ipa.c +++ b/drivers/platform/msm/ipa/ipa_v3/ipa.c @@ -6025,6 +6025,13 @@ static int ipa3_panic_notifier(struct notifier_block *this, int res; struct ipa_active_client_logging_info log_info; + if (ipa3_ctx != NULL) + { + if (ipa3_ctx->is_device_crashed) + return NOTIFY_DONE; + ipa3_ctx->is_device_crashed = true; + } + ipa3_freeze_clock_vote_and_notify_modem(); IPADBG("Calling uC panic handler\n"); @@ -7126,6 +7133,7 @@ static int ipa3_pre_init(const struct ipa3_plat_drv_res *resource_p, ipa3_ctx->gsi_ch20_wa = resource_p->gsi_ch20_wa; ipa3_ctx->wdi_over_pcie = resource_p->wdi_over_pcie; ipa3_ctx->ipa3_active_clients_logging.log_rdy = false; + ipa3_ctx->is_device_crashed = false; ipa3_ctx->mhi_evid_limits[0] = resource_p->mhi_evid_limits[0]; ipa3_ctx->mhi_evid_limits[1] = resource_p->mhi_evid_limits[1]; ipa3_ctx->entire_ipa_block_size = resource_p->entire_ipa_block_size; diff --git a/drivers/platform/msm/ipa/ipa_v3/ipa_i.h b/drivers/platform/msm/ipa/ipa_v3/ipa_i.h index 2bc0d82040b3..a6a742fee493 100644 --- a/drivers/platform/msm/ipa/ipa_v3/ipa_i.h +++ b/drivers/platform/msm/ipa/ipa_v3/ipa_i.h @@ -2154,6 +2154,7 @@ struct ipa3_context { bool is_bw_monitor_supported; bool modem_load_ipa_fw; bool fnr_stats_not_supported; + bool is_device_crashed; }; struct ipa3_plat_drv_res { From b6e679fd858748c4497298867c23dfbdc3e4e0a9 Mon Sep 17 00:00:00 2001 From: Piyush Dhyani Date: Tue, 29 Jun 2021 02:27:54 +0530 Subject: [PATCH 5/5] msm: ipa3: Fix to prevent Integer Overflow The value of `req->filter_spec_ex2_list_len` is user input via ioctl and it's type is uint32, so an integer overflow may occur. Which can result in out of bound access in the following loop. Now add changes to prevent Integer overflow. Change-Id: Ia29b9ddc674e5dd3d5baf6623cf0a464c156d8f7 Signed-off-by: Piyush Dhyani --- drivers/platform/msm/ipa/ipa_v3/ipa_qmi_service.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/drivers/platform/msm/ipa/ipa_v3/ipa_qmi_service.c b/drivers/platform/msm/ipa/ipa_v3/ipa_qmi_service.c index e011fdcae27a..ae02f21d11de 100644 --- a/drivers/platform/msm/ipa/ipa_v3/ipa_qmi_service.c +++ b/drivers/platform/msm/ipa/ipa_v3/ipa_qmi_service.c @@ -893,7 +893,10 @@ int ipa3_qmi_add_offload_request_send( } /* check if the filter rules from IPACM is valid */ - if (req->filter_spec_ex2_list_len == 0) { + if (req->filter_spec_ex2_list_len < 0) { + IPAWANERR("IPACM pass invalid num of rules\n"); + return -EINVAL; + } else if (req->filter_spec_ex2_list_len == 0) { IPAWANDBG("IPACM pass zero rules to Q6\n"); } else { IPAWANDBG("IPACM pass %u rules to Q6\n", @@ -901,9 +904,10 @@ int ipa3_qmi_add_offload_request_send( } /* currently set total max to 64 */ - if (req->filter_spec_ex2_list_len + - ipa3_qmi_ctx->num_ipa_offload_connection - >= QMI_IPA_MAX_FILTERS_V01) { + if ((ipa3_qmi_ctx->num_ipa_offload_connection < 0) || + (req->filter_spec_ex2_list_len >= + (QMI_IPA_MAX_FILTERS_V01 - + ipa3_qmi_ctx->num_ipa_offload_connection))) { IPAWANDBG( "cur(%d), req(%d), exceed limit (%d)\n", ipa3_qmi_ctx->num_ipa_offload_connection,