From 719233800c2595c103d92f7d1f444037e363e9e0 Mon Sep 17 00:00:00 2001 From: Ashok Vuyyuru Date: Thu, 10 Jun 2021 23:38:33 +0530 Subject: [PATCH 1/5] msm: ipa3: Disable HOLB for ODL pipe during suspend 1. Disable HOLB for ODL pipe during suspend to avoid dropping the packet 2. Enable HOLB while unsuspend the pipes. 3. Enable drop stats for ODL pipe. Change-Id: Id0a5871ebe4a0925c60dea39f197af9e1892d05e Signed-off-by: Ashok Vuyyuru ep[odl_ep_idx].valid) { + memset(&holb_cfg, 0, sizeof(holb_cfg)); + if (suspend) + holb_cfg.en = 0; + else + holb_cfg.en = 1; + + ipahal_write_reg_n_fields(IPA_ENDP_INIT_HOL_BLOCK_EN_n, + odl_ep_idx, &holb_cfg); + /* IPA4.5 issue requires HOLB_EN to be written twice */ + if (ipa3_ctx->ipa_hw_type >= IPA_HW_v4_5 && holb_cfg.en) + ipahal_write_reg_n_fields( + IPA_ENDP_INIT_HOL_BLOCK_EN_n, + odl_ep_idx, &holb_cfg); + + } + res = _ipa_suspend_resume_pipe(IPA_CLIENT_APPS_WAN_LOW_LAT_CONS, suspend); if (res == -EAGAIN) From bf9c2b116819c754ebf0ce308fbdcccc528bb16a Mon Sep 17 00:00:00 2001 From: Goutam Bose Date: Wed, 30 Jun 2021 11:43:45 +0530 Subject: [PATCH 2/5] msm: ipa: fix use-after-free of rt_tbl Fix use-after-free of rt_tbl in __ipa_del_flt_rule by checking if the rt_tbl is already freed. Change-Id: I09541f65f474dc42f262c603d99f6bbcbb0ce8ec Signed-off-by: Goutam Bose --- drivers/platform/msm/ipa/ipa_v3/ipa_flt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/platform/msm/ipa/ipa_v3/ipa_flt.c b/drivers/platform/msm/ipa/ipa_v3/ipa_flt.c index 4aeab4968f2a..f71b4346b186 100644 --- a/drivers/platform/msm/ipa/ipa_v3/ipa_flt.c +++ b/drivers/platform/msm/ipa/ipa_v3/ipa_flt.c @@ -1078,7 +1078,7 @@ static int __ipa_del_flt_rule(u32 rule_hdl) list_del(&entry->link); entry->tbl->rule_cnt--; - if (entry->rt_tbl) + if (entry->rt_tbl && !ipa3_check_idr_if_freed(entry->rt_tbl)) entry->rt_tbl->ref_cnt--; IPADBG("del flt rule rule_cnt=%d rule_id=%d\n", entry->tbl->rule_cnt, entry->rule_id); From 76d313e0f73581f8018c3e3c778d4f1318983b50 Mon Sep 17 00:00:00 2001 From: Chaitanya Pratapa Date: Thu, 24 Jun 2021 18:34:37 -0700 Subject: [PATCH 3/5] msm: ipa: fix IPA_COALESCE_DISABLE handling Make changes to populate qmap_id when disabling coalescing. Change-Id: Iaf0981bd22948b87bb8f9c548fe74e789eaf689c Signed-off-by: Chaitanya Pratapa --- drivers/platform/msm/ipa/ipa_v3/rmnet_ipa.c | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-) diff --git a/drivers/platform/msm/ipa/ipa_v3/rmnet_ipa.c b/drivers/platform/msm/ipa/ipa_v3/rmnet_ipa.c index 3eb145ba5162..3916ecc9b469 100644 --- a/drivers/platform/msm/ipa/ipa_v3/rmnet_ipa.c +++ b/drivers/platform/msm/ipa/ipa_v3/rmnet_ipa.c @@ -2232,16 +2232,14 @@ static int rmnet_ipa_send_coalesce_notification(uint8_t qmap_id, if (!coalesce_info) return -ENOMEM; - if (enable) { - coalesce_info->qmap_id = qmap_id; - coalesce_info->tcp_enable = tcp; - coalesce_info->udp_enable = udp; + coalesce_info->qmap_id = qmap_id; + coalesce_info->tcp_enable = tcp; + coalesce_info->udp_enable = udp; + msg_meta.msg_len = sizeof(struct ipa_coalesce_info); + if (enable) msg_meta.msg_type = IPA_COALESCE_ENABLE; - msg_meta.msg_len = sizeof(struct ipa_coalesce_info); - } else { + else msg_meta.msg_type = IPA_COALESCE_DISABLE; - msg_meta.msg_len = sizeof(struct ipa_coalesce_info); - } rc = ipa_send_msg(&msg_meta, coalesce_info, ipa3_wwan_msg_free_cb); if (rc) { IPAWANERR("ipa_send_msg failed: %d\n", rc); From 842d33d296a48a0fd02f501cd24b6b2691fce018 Mon Sep 17 00:00:00 2001 From: Pooja Kumari Date: Thu, 8 Jul 2021 11:48:56 +0530 Subject: [PATCH 4/5] msm: ipa3: ignore multiple crash Ignore recursive panic and multiple crash instances. Change-Id: If76d8bb095fa68979bf6a98929fd4629cc3a9c75 Signed-off-by: Pooja Kumari --- drivers/platform/msm/ipa/ipa_v3/ipa.c | 8 ++++++++ drivers/platform/msm/ipa/ipa_v3/ipa_i.h | 1 + 2 files changed, 9 insertions(+) diff --git a/drivers/platform/msm/ipa/ipa_v3/ipa.c b/drivers/platform/msm/ipa/ipa_v3/ipa.c index 07c2d2f61964..7d6b5802dfb0 100644 --- a/drivers/platform/msm/ipa/ipa_v3/ipa.c +++ b/drivers/platform/msm/ipa/ipa_v3/ipa.c @@ -6025,6 +6025,13 @@ static int ipa3_panic_notifier(struct notifier_block *this, int res; struct ipa_active_client_logging_info log_info; + if (ipa3_ctx != NULL) + { + if (ipa3_ctx->is_device_crashed) + return NOTIFY_DONE; + ipa3_ctx->is_device_crashed = true; + } + ipa3_freeze_clock_vote_and_notify_modem(); IPADBG("Calling uC panic handler\n"); @@ -7126,6 +7133,7 @@ static int ipa3_pre_init(const struct ipa3_plat_drv_res *resource_p, ipa3_ctx->gsi_ch20_wa = resource_p->gsi_ch20_wa; ipa3_ctx->wdi_over_pcie = resource_p->wdi_over_pcie; ipa3_ctx->ipa3_active_clients_logging.log_rdy = false; + ipa3_ctx->is_device_crashed = false; ipa3_ctx->mhi_evid_limits[0] = resource_p->mhi_evid_limits[0]; ipa3_ctx->mhi_evid_limits[1] = resource_p->mhi_evid_limits[1]; ipa3_ctx->entire_ipa_block_size = resource_p->entire_ipa_block_size; diff --git a/drivers/platform/msm/ipa/ipa_v3/ipa_i.h b/drivers/platform/msm/ipa/ipa_v3/ipa_i.h index 2bc0d82040b3..a6a742fee493 100644 --- a/drivers/platform/msm/ipa/ipa_v3/ipa_i.h +++ b/drivers/platform/msm/ipa/ipa_v3/ipa_i.h @@ -2154,6 +2154,7 @@ struct ipa3_context { bool is_bw_monitor_supported; bool modem_load_ipa_fw; bool fnr_stats_not_supported; + bool is_device_crashed; }; struct ipa3_plat_drv_res { From b6e679fd858748c4497298867c23dfbdc3e4e0a9 Mon Sep 17 00:00:00 2001 From: Piyush Dhyani Date: Tue, 29 Jun 2021 02:27:54 +0530 Subject: [PATCH 5/5] msm: ipa3: Fix to prevent Integer Overflow The value of `req->filter_spec_ex2_list_len` is user input via ioctl and it's type is uint32, so an integer overflow may occur. Which can result in out of bound access in the following loop. Now add changes to prevent Integer overflow. Change-Id: Ia29b9ddc674e5dd3d5baf6623cf0a464c156d8f7 Signed-off-by: Piyush Dhyani --- drivers/platform/msm/ipa/ipa_v3/ipa_qmi_service.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/drivers/platform/msm/ipa/ipa_v3/ipa_qmi_service.c b/drivers/platform/msm/ipa/ipa_v3/ipa_qmi_service.c index e011fdcae27a..ae02f21d11de 100644 --- a/drivers/platform/msm/ipa/ipa_v3/ipa_qmi_service.c +++ b/drivers/platform/msm/ipa/ipa_v3/ipa_qmi_service.c @@ -893,7 +893,10 @@ int ipa3_qmi_add_offload_request_send( } /* check if the filter rules from IPACM is valid */ - if (req->filter_spec_ex2_list_len == 0) { + if (req->filter_spec_ex2_list_len < 0) { + IPAWANERR("IPACM pass invalid num of rules\n"); + return -EINVAL; + } else if (req->filter_spec_ex2_list_len == 0) { IPAWANDBG("IPACM pass zero rules to Q6\n"); } else { IPAWANDBG("IPACM pass %u rules to Q6\n", @@ -901,9 +904,10 @@ int ipa3_qmi_add_offload_request_send( } /* currently set total max to 64 */ - if (req->filter_spec_ex2_list_len + - ipa3_qmi_ctx->num_ipa_offload_connection - >= QMI_IPA_MAX_FILTERS_V01) { + if ((ipa3_qmi_ctx->num_ipa_offload_connection < 0) || + (req->filter_spec_ex2_list_len >= + (QMI_IPA_MAX_FILTERS_V01 - + ipa3_qmi_ctx->num_ipa_offload_connection))) { IPAWANDBG( "cur(%d), req(%d), exceed limit (%d)\n", ipa3_qmi_ctx->num_ipa_offload_connection,