From 1a7c68833dcf8353eb7cfcab647baccde89a324e Mon Sep 17 00:00:00 2001 From: Raihan Haider Date: Mon, 6 Mar 2023 15:48:44 +0530 Subject: [PATCH 01/16] defconfig: sdxlemur: Realtek r8168 IOSS glue driver config Realtek r8168 IOSS glue driver config set to m Change-Id: I0a7ef825155f928212cc2979a73482874471004e Signed-off-by: Raihan Haider --- arch/arm/configs/vendor/sdxlemur.config | 1 + 1 file changed, 1 insertion(+) diff --git a/arch/arm/configs/vendor/sdxlemur.config b/arch/arm/configs/vendor/sdxlemur.config index 6f909a87bf87..bb8a79c004d9 100644 --- a/arch/arm/configs/vendor/sdxlemur.config +++ b/arch/arm/configs/vendor/sdxlemur.config @@ -364,6 +364,7 @@ CONFIG_AQFWD_IOSS=m CONFIG_R8125=y CONFIG_R8125_IOSS=m CONFIG_R8168=y +CONFIG_R8168_IOSS=m CONFIG_QCOM_SHOW_RESUME_IRQ=y CONFIG_HARDENED_USERCOPY=y # CONFIG_HARDENED_USERCOPY_FALLBACK is not set From fe41aca1e4a3a755843887a64d80256cd532d288 Mon Sep 17 00:00:00 2001 From: Pratham Pratap Date: Wed, 19 Jul 2023 11:56:18 +0530 Subject: [PATCH 02/16] usb: gadget: cdev: Fix spinlock recursion Commit c99a841d40aa8 ("usb: gadget: cdev: Add spinlock to synchronize ports->cbits_updated")added spinlock to synchronize ports->cbits_updated which is causing a spinlock recursion in usb_cser_notify_modem. Fix this by unlocking the spinlock before it calls send_modem_ctrl_bits which in turn tries to acquire the same spinlock. Change-Id: I744ea93d7da60aaf27044400cf457cc81dab151d Signed-off-by: Pratham Pratap --- drivers/usb/gadget/function/f_cdev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/usb/gadget/function/f_cdev.c b/drivers/usb/gadget/function/f_cdev.c index 481783ea6968..f1044c29027a 100644 --- a/drivers/usb/gadget/function/f_cdev.c +++ b/drivers/usb/gadget/function/f_cdev.c @@ -1679,6 +1679,7 @@ static void usb_cser_notify_modem(void *fport, int ctrl_bits) spin_lock_irqsave(&port->port_lock, flags); port->cbits_to_modem = temp; port->cbits_updated = true; + spin_unlock_irqrestore(&port->port_lock, flags); /* if DTR is high, update latest modem info to laptop */ if (port->cbits_to_modem & TIOCM_DTR) { @@ -1691,7 +1692,6 @@ static void usb_cser_notify_modem(void *fport, int ctrl_bits) cser->send_modem_ctrl_bits(cser, cbits_to_laptop); } - spin_unlock_irqrestore(&port->port_lock, flags); wake_up(&port->read_wq); } From 24dbadc7e8301cedb7913f6f804c34353ea5c4b7 Mon Sep 17 00:00:00 2001 From: Khaja Hussain Shaik Khaji Date: Mon, 10 Jul 2023 13:00:34 +0530 Subject: [PATCH 03/16] drivers: qcom: pil: Add KPI boot markers for modem Add modem crash and stop, dump start and complete boot markers. Change-Id: I2e3304aa5d6bb2e578d89444cbd33cd1b8fe6f12 Signed-off-by: Khaja Hussain Shaik Khaji --- drivers/soc/qcom/msm_subsystem_restart.c | 5 +++++ drivers/soc/qcom/peripheral-loader.c | 5 ++++- drivers/soc/qcom/subsys-pil-tz.c | 8 ++++++++ 3 files changed, 17 insertions(+), 1 deletion(-) diff --git a/drivers/soc/qcom/msm_subsystem_restart.c b/drivers/soc/qcom/msm_subsystem_restart.c index 69ab25363295..f115e25fa5cd 100644 --- a/drivers/soc/qcom/msm_subsystem_restart.c +++ b/drivers/soc/qcom/msm_subsystem_restart.c @@ -652,6 +652,11 @@ static int subsystem_shutdown(struct subsys_device *dev, void *data) dev->crash_count++; subsys_set_state(dev, SUBSYS_OFFLINE); +#ifdef CONFIG_QGKI_MSM_BOOT_TIME_MARKER + if (!strcmp(dev->desc->name, "modem")) + place_marker("M - Modem Stop"); +#endif + return 0; } diff --git a/drivers/soc/qcom/peripheral-loader.c b/drivers/soc/qcom/peripheral-loader.c index 55b2e0bad42e..95125c88f2c1 100644 --- a/drivers/soc/qcom/peripheral-loader.c +++ b/drivers/soc/qcom/peripheral-loader.c @@ -472,7 +472,10 @@ int pil_do_ramdump(struct pil_desc *desc, if (ret) pil_err(desc, "%s: Ramdump collection failed for subsys %s rc:%d\n", __func__, desc->name, ret); - +#ifdef CONFIG_QGKI_MSM_BOOT_TIME_MARKER + if (!strcmp(desc->name, "modem")) + place_marker("M - Modem Dump completed"); +#endif if (desc->subsys_vmid > 0) ret = pil_assign_mem_to_subsys(desc, priv->region_start, (priv->region_end - priv->region_start)); diff --git a/drivers/soc/qcom/subsys-pil-tz.c b/drivers/soc/qcom/subsys-pil-tz.c index 61762f4f68d7..03e7b8fcccf8 100644 --- a/drivers/soc/qcom/subsys-pil-tz.c +++ b/drivers/soc/qcom/subsys-pil-tz.c @@ -871,6 +871,10 @@ static int subsys_ramdump(int enable, const struct subsys_desc *subsys) if (!enable) return 0; +#ifdef CONFIG_QGKI_MSM_BOOT_TIME_MARKER + if (!strcmp(subsys->name, "modem")) + place_marker("M - Modem Dump start"); +#endif return pil_do_ramdump(&d->desc, d->ramdump_dev, d->minidump_dev); } @@ -915,6 +919,10 @@ static irqreturn_t subsys_err_fatal_intr_handler (int irq, void *drv_data) d->subsys_desc.name); return IRQ_HANDLED; } +#ifdef CONFIG_QGKI_MSM_BOOT_TIME_MARKER + if (!strcmp(d->subsys_desc.name, "modem")) + place_marker("M - Modem crash"); +#endif subsys_set_crash_status(d->subsys, CRASH_STATUS_ERR_FATAL); log_failure_reason(d); subsystem_restart_dev(d->subsys); From 30e8ee90cb692f337777e71b086bd20120115c19 Mon Sep 17 00:00:00 2001 From: Srinivasarao Pathipati Date: Tue, 4 Jul 2023 11:48:50 +0530 Subject: [PATCH 04/16] soc: qcom: minidump: check the size parameter passed to qcom_smem_get() The size parameter passed to qcom_smem_get() can become less than global toc size, add check to avoid out of bound accessing. Change-Id: I068b4d5e27e94ce23c26856dad106a3970fb56d6 Signed-off-by: Srinivasarao Pathipati --- drivers/soc/qcom/msm_minidump.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/soc/qcom/msm_minidump.c b/drivers/soc/qcom/msm_minidump.c index ac4c3b08e5b5..4b4b81647688 100644 --- a/drivers/soc/qcom/msm_minidump.c +++ b/drivers/soc/qcom/msm_minidump.c @@ -561,7 +561,7 @@ static int __init msm_minidump_init(void) } /*Check global minidump support initialization */ - if (!md_global_toc->md_toc_init) { + if (size < sizeof(*md_global_toc) || !md_global_toc->md_toc_init) { pr_err("System Minidump TOC not initialized\n"); return -ENODEV; } From 0401e9d8c26e6da2f6290bbe0bf920d1d409a291 Mon Sep 17 00:00:00 2001 From: Swetha Chikkaboraiah Date: Tue, 4 Jul 2023 16:06:27 +0530 Subject: [PATCH 05/16] soc: qcom: socinfo: Add soc information for Blair APQ Add SOC ID to support socinfo for Blair APQ and Blair APQ-XR soc. Change-Id: Ica80b43f1eab94d95bf38726571b36b7fc8a2e35 Signed-off-by: Swetha Chikkaboraiah --- drivers/soc/qcom/socinfo.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/soc/qcom/socinfo.c b/drivers/soc/qcom/socinfo.c index 89b16a71793f..562f35ce68a4 100644 --- a/drivers/soc/qcom/socinfo.c +++ b/drivers/soc/qcom/socinfo.c @@ -680,6 +680,8 @@ static const struct soc_id soc_id[] = { { 450, "SHIMA" }, { 454, "HOLI" }, { 507, "BLAIR" }, + { 565, "BLAIRP" }, + { 628, "BLAIRP-XR" }, { 486, "MONACO" }, { 458, "SDXLEMUR" }, { 483, "SDXLEMUR-SD"}, From 61c6111f74e841739de0bc0ff2f9e49d803dce31 Mon Sep 17 00:00:00 2001 From: Lee Jones Date: Mon, 19 Jun 2023 14:41:36 +0100 Subject: [PATCH 06/16] ANDROID: HID: Only utilise UHID provided exports if UHID is enabled Commit "ANDROID: HID; Over-ride default maximum buffer size when using UHID" provided a means for the UHID driver to offer an alternative (smaller) report buffer size when dealing with user-space. The method used was an Android-only solution designed to prevent the KMI ABI from being broken (nb: the upstream solution was cleaner, but broke the ABI). Since this solution involved consuming resources exported by a subordinate driver, that driver would have to be enabled for the export to take place. Since all of our default configs enable UHID, an issue was not detected. However, for more specific kernel configs, where HID is enabled, but UHID is not, this leads to compile-time undefined symbol errors: ld.lld: error: undefined symbol: uhid_hid_driver This patch relies on the compiler to leave out unutilised sections of the code if the associated resources are not available. Bug: 260007429 Reported-by: Paul Lawrence Reported-by: Nathan Chancellor Signed-off-by: Lee Jones Change-Id: I80b1aa7454c89d5c5e21f0268252ffb666efab97 Signed-off-by: Lee Jones --- drivers/hid/hid-core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c index 961b60120295..917b61931d07 100644 --- a/drivers/hid/hid-core.c +++ b/drivers/hid/hid-core.c @@ -290,7 +290,7 @@ static int hid_add_field(struct hid_parser *parser, unsigned report_type, unsign offset = report->size; report->size += parser->global.report_size * parser->global.report_count; - if (parser->device->ll_driver == &uhid_hid_driver) + if (IS_ENABLED(CONFIG_UHID) && parser->device->ll_driver == &uhid_hid_driver) max_buffer_size = UHID_DATA_MAX; /* Total size check: Allow for possible report index byte */ @@ -1767,7 +1767,7 @@ int hid_report_raw_event(struct hid_device *hid, int type, u8 *data, u32 size, rsize = hid_compute_report_size(report); - if (hid->ll_driver == &uhid_hid_driver) + if (IS_ENABLED(CONFIG_UHID) && hid->ll_driver == &uhid_hid_driver) max_buffer_size = UHID_DATA_MAX; if (report_enum->numbered && rsize >= max_buffer_size) From afe20da34be7cd24ef3bff5b1ff042402958a4d5 Mon Sep 17 00:00:00 2001 From: Manoj Prabhu B Date: Tue, 11 Jul 2023 16:47:18 +0530 Subject: [PATCH 07/16] memshare: Avoid accessing uninitialized nodes Prevent iterating over uninitialized memshare child nodes while handling client alloc and free requests. Change-Id: I421cd239bb999176e587ab0c06757d83485fad6e Signed-off-by: Manoj Prabhu B Signed-off-by: Meenu Raja Sundaram --- drivers/soc/qcom/memshare/msm_memshare.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/soc/qcom/memshare/msm_memshare.c b/drivers/soc/qcom/memshare/msm_memshare.c index 6d1badcf1afd..43ca69072932 100644 --- a/drivers/soc/qcom/memshare/msm_memshare.c +++ b/drivers/soc/qcom/memshare/msm_memshare.c @@ -1,6 +1,6 @@ // SPDX-License-Identifier: GPL-2.0-only /* Copyright (c) 2013-2020, The Linux Foundation. All rights reserved. - * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved. + * Copyright (c) 2022-2023, Qualcomm Innovation Center, Inc. All rights reserved. */ #include @@ -104,7 +104,7 @@ static int check_client(int client_id, int proc, int request) int i = 0, rc; int found = DHMS_MEM_CLIENT_INVALID; - for (i = 0; i < MAX_CLIENTS; i++) { + for (i = 0; i < num_clients; i++) { if (memblock[i].client_id == client_id && memblock[i].peripheral == proc) { found = i; @@ -484,7 +484,7 @@ static void handle_alloc_generic_req(struct qmi_handle *handle, return; } - for (i = 0; i < MAX_CLIENTS; i++) { + for (i = 0; i < num_clients; i++) { if (memsh_child[i]->client_id == alloc_req->client_id) { client_node = memsh_child[i]; dev_info(memsh_drv->dev, @@ -577,7 +577,7 @@ static void handle_free_generic_req(struct qmi_handle *handle, flag = 1; } - for (i = 0; i < MAX_CLIENTS; i++) { + for (i = 0; i < num_clients; i++) { if (memsh_child[i]->client_id == free_req->client_id) { client_node = memsh_child[i]; dev_info(memsh_drv->dev, From dc674586ed5336472c27edf2e1bb081bbed87b24 Mon Sep 17 00:00:00 2001 From: Lynus Vaz Date: Thu, 15 Jun 2023 14:12:21 -0700 Subject: [PATCH 08/16] msm: kgsl: Defer drawobj_sync_timeline_fence_work() to a workqueue drawobj_sync_timeline_fence_work() does a cleanup of fence and syncobj allocations. Doing this cleanup in irq context requires the irq_work struct to remain valid after the function executes. Avoid this constraint by deferring this work to the memory workqueue. Change-Id: Icf648a61686c1ef3fd84467a2376b11a9a4bb803 Signed-off-by: Lynus Vaz --- drivers/gpu/msm/kgsl_drawobj.c | 7 ++++--- drivers/gpu/msm/kgsl_drawobj.h | 5 +++-- 2 files changed, 7 insertions(+), 5 deletions(-) diff --git a/drivers/gpu/msm/kgsl_drawobj.c b/drivers/gpu/msm/kgsl_drawobj.c index af0054bcd95e..9e00d2c08234 100644 --- a/drivers/gpu/msm/kgsl_drawobj.c +++ b/drivers/gpu/msm/kgsl_drawobj.c @@ -1,6 +1,7 @@ // SPDX-License-Identifier: GPL-2.0-only /* * Copyright (c) 2016-2021, The Linux Foundation. All rights reserved. + * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved. */ /* @@ -253,7 +254,7 @@ static void drawobj_sync_func(struct kgsl_device *device, kgsl_drawobj_put(&event->syncobj->base); } -static void drawobj_sync_timeline_fence_work(struct irq_work *work) +static void drawobj_sync_timeline_fence_work(struct work_struct *work) { struct kgsl_drawobj_sync_event *event = container_of(work, struct kgsl_drawobj_sync_event, work); @@ -301,7 +302,7 @@ static void drawobj_sync_timeline_fence_callback(struct dma_fence *f, * removing the fence */ if (drawobj_sync_expire(event->device, event)) - irq_work_queue(&event->work); + queue_work(kgsl_driver.mem_workqueue, &event->work); } static void syncobj_destroy(struct kgsl_drawobj *drawobj) @@ -498,7 +499,7 @@ static int drawobj_add_sync_timeline(struct kgsl_device *device, event->device = device; event->context = NULL; event->fence = fence; - init_irq_work(&event->work, drawobj_sync_timeline_fence_work); + INIT_WORK(&event->work, drawobj_sync_timeline_fence_work); INIT_LIST_HEAD(&event->cb.node); diff --git a/drivers/gpu/msm/kgsl_drawobj.h b/drivers/gpu/msm/kgsl_drawobj.h index 3719dc171e1d..a1e160a220fb 100644 --- a/drivers/gpu/msm/kgsl_drawobj.h +++ b/drivers/gpu/msm/kgsl_drawobj.h @@ -1,6 +1,7 @@ /* SPDX-License-Identifier: GPL-2.0-only */ /* * Copyright (c) 2016-2020, The Linux Foundation. All rights reserved. + * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved. */ #ifndef __KGSL_DRAWOBJ_H @@ -170,8 +171,8 @@ struct kgsl_drawobj_sync_event { struct dma_fence *fence; /** @cb: Callback struct for KGSL_CMD_SYNCPOINT_TYPE_TIMELINE */ struct dma_fence_cb cb; - /** @work : irq worker for KGSL_CMD_SYNCPOINT_TYPE_TIMELINE */ - struct irq_work work; + /** @work : work_struct for KGSL_CMD_SYNCPOINT_TYPE_TIMELINE */ + struct work_struct work; }; #define KGSL_DRAWOBJ_FLAGS \ From 98c03480eca635a0af8701cfbaf0d07e6a865347 Mon Sep 17 00:00:00 2001 From: Naveen S Nair Date: Wed, 2 Aug 2023 14:51:32 +0530 Subject: [PATCH 09/16] soc: qcom: add buffer overflow check on AON rx_buffer Add buffer overflow check while accessing data buffer received from AON. Change-Id: I0472a0ad1e6edc3fe8102850fddacd89ceea4959 Signed-off-by: Naveen S Nair --- drivers/soc/qcom/slate_events_bridge.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/soc/qcom/slate_events_bridge.c b/drivers/soc/qcom/slate_events_bridge.c index ebddd7c04b80..261be187ff50 100644 --- a/drivers/soc/qcom/slate_events_bridge.c +++ b/drivers/soc/qcom/slate_events_bridge.c @@ -1,6 +1,7 @@ // SPDX-License-Identifier: GPL-2.0-only /* * Copyright (c) 2021, The Linux Foundation. All rights reserved. + * Copyright (c) 2023, Qualcomm Innovation Center, Inc. All rights reserved. */ #include @@ -439,6 +440,10 @@ void seb_rx_msg(void *data, int len) dev->seb_resp_cmplt = true; wake_up(&dev->link_state_wait); if (dev->wait_for_resp) { + if (len > SEB_GLINK_INTENT_SIZE) { + pr_err("Invalid seb rx buffer length\n"); + return; + } memcpy(dev->rx_buf, data, len); } else { /* Handle the event received from Slate */ From dc03cfa27f784edbd497e28ef67762a28073bce9 Mon Sep 17 00:00:00 2001 From: Khaja Hussain Shaik Khaji Date: Wed, 2 Aug 2023 12:29:07 +0530 Subject: [PATCH 10/16] drivers: qcom: pil: Use update_marker for modem book kpi Use update_marker instead of place_marker to avoid OOM issue if boot kpi file keeps growing. Add update_marker() declaration in boot_stats header file. Change-Id: I9b842c10670b2adb918e246174fdac45fb53de40 Signed-off-by: Khaja Hussain Shaik Khaji --- drivers/soc/qcom/boot_stats.c | 9 ++++++++- drivers/soc/qcom/msm_subsystem_restart.c | 2 +- drivers/soc/qcom/peripheral-loader.c | 6 +++--- drivers/soc/qcom/subsys-pil-tz.c | 4 ++-- include/soc/qcom/boot_stats.h | 2 ++ 5 files changed, 16 insertions(+), 7 deletions(-) diff --git a/drivers/soc/qcom/boot_stats.c b/drivers/soc/qcom/boot_stats.c index b94493faa7af..af4315625102 100644 --- a/drivers/soc/qcom/boot_stats.c +++ b/drivers/soc/qcom/boot_stats.c @@ -150,6 +150,13 @@ void place_marker(const char *name) } EXPORT_SYMBOL(place_marker); +void update_marker(const char *name) +{ + destroy_marker(name); + place_marker(name); +} +EXPORT_SYMBOL(update_marker); + void destroy_marker(const char *name) { _destroy_boot_marker((char *) name); @@ -217,7 +224,7 @@ static ssize_t bootkpi_writer(struct kobject *obj, struct kobj_attribute *attr, return rc; buf[rc] = '\0'; - place_marker(buf); + update_marker(buf); return rc; } diff --git a/drivers/soc/qcom/msm_subsystem_restart.c b/drivers/soc/qcom/msm_subsystem_restart.c index f115e25fa5cd..707a882b9cf6 100644 --- a/drivers/soc/qcom/msm_subsystem_restart.c +++ b/drivers/soc/qcom/msm_subsystem_restart.c @@ -654,7 +654,7 @@ static int subsystem_shutdown(struct subsys_device *dev, void *data) #ifdef CONFIG_QGKI_MSM_BOOT_TIME_MARKER if (!strcmp(dev->desc->name, "modem")) - place_marker("M - Modem Stop"); + update_marker("M - Modem Stop"); #endif return 0; diff --git a/drivers/soc/qcom/peripheral-loader.c b/drivers/soc/qcom/peripheral-loader.c index 95125c88f2c1..b7f17cc80d22 100644 --- a/drivers/soc/qcom/peripheral-loader.c +++ b/drivers/soc/qcom/peripheral-loader.c @@ -474,7 +474,7 @@ int pil_do_ramdump(struct pil_desc *desc, __func__, desc->name, ret); #ifdef CONFIG_QGKI_MSM_BOOT_TIME_MARKER if (!strcmp(desc->name, "modem")) - place_marker("M - Modem Dump completed"); + update_marker("M - Modem Dump completed"); #endif if (desc->subsys_vmid > 0) ret = pil_assign_mem_to_subsys(desc, priv->region_start, @@ -873,7 +873,7 @@ static int pil_init_mmap(struct pil_desc *desc, const struct pil_mdt *mdt) #ifdef CONFIG_QGKI_MSM_BOOT_TIME_MARKER if (!strcmp(desc->name, "modem")) - place_marker("M - Modem Image Start Loading"); + update_marker("M - Modem Image Start Loading"); #endif pil_info(desc, "loading from %pa to %pa\n", &priv->region_start, @@ -1339,7 +1339,7 @@ int pil_boot(struct pil_desc *desc) #ifdef CONFIG_QGKI_MSM_BOOT_TIME_MARKER if (!strcmp(desc->name, "modem")) - place_marker("M - Modem out of reset"); + update_marker("M - Modem out of reset"); #endif pil_info(desc, "Brought out of reset\n"); diff --git a/drivers/soc/qcom/subsys-pil-tz.c b/drivers/soc/qcom/subsys-pil-tz.c index 03e7b8fcccf8..ddd30f512b0d 100644 --- a/drivers/soc/qcom/subsys-pil-tz.c +++ b/drivers/soc/qcom/subsys-pil-tz.c @@ -873,7 +873,7 @@ static int subsys_ramdump(int enable, const struct subsys_desc *subsys) return 0; #ifdef CONFIG_QGKI_MSM_BOOT_TIME_MARKER if (!strcmp(subsys->name, "modem")) - place_marker("M - Modem Dump start"); + update_marker("M - Modem Dump start"); #endif return pil_do_ramdump(&d->desc, d->ramdump_dev, d->minidump_dev); @@ -921,7 +921,7 @@ static irqreturn_t subsys_err_fatal_intr_handler (int irq, void *drv_data) } #ifdef CONFIG_QGKI_MSM_BOOT_TIME_MARKER if (!strcmp(d->subsys_desc.name, "modem")) - place_marker("M - Modem crash"); + update_marker("M - Modem crash"); #endif subsys_set_crash_status(d->subsys, CRASH_STATUS_ERR_FATAL); log_failure_reason(d); diff --git a/include/soc/qcom/boot_stats.h b/include/soc/qcom/boot_stats.h index 4d34eace03d4..ba8b8e7de981 100644 --- a/include/soc/qcom/boot_stats.h +++ b/include/soc/qcom/boot_stats.h @@ -6,6 +6,7 @@ #ifdef CONFIG_QGKI_MSM_BOOT_TIME_MARKER void place_marker(const char *name); +void update_marker(const char *name); void destroy_marker(const char *name); unsigned long long msm_timer_get_sclk_ticks(void); static inline int boot_marker_enabled(void) { return 1; } @@ -13,6 +14,7 @@ static inline int boot_marker_enabled(void) { return 1; } static inline int init_bootkpi(void) { return 0; } static inline void exit_bootkpi(void) { }; static inline void place_marker(char *name) { }; +static inline void update_marker(char *name) { }; static inline void destroy_marker(const char *name) { }; static inline int boot_marker_enabled(void) { return 0; } static inline unsigned long long msm_timer_get_sclk_ticks(void) { return -EINVAL; } From f4a90045e0debd718232768bfe33e2842af99d32 Mon Sep 17 00:00:00 2001 From: Krishna chaitanya chundru Date: Wed, 5 Jul 2023 14:48:10 +0530 Subject: [PATCH 11/16] bus: mhi: misc: Add check for dev_rp if it is iommu range or not er_ctxt->rp pointer is updated by MDM which is untrusted to HLOS, it could be arbitrary value. If there is security issue on MDM, and updated pointer which is not align then driver will never come out of loop where checking against dev_rp != rp. So added check to make sure it is in the buffer range & aligned to 128bit. Change-Id: Ib484e07f2c75fcd657a4ccc648a3a20de3edeebc Signed-off-by: Krishna chaitanya chundru --- drivers/bus/mhi/core/mhi_internal.h | 6 ++++++ drivers/bus/mhi/core/mhi_main.c | 14 +++++++++++++- 2 files changed, 19 insertions(+), 1 deletion(-) diff --git a/drivers/bus/mhi/core/mhi_internal.h b/drivers/bus/mhi/core/mhi_internal.h index c02eee9886c7..ea2f5bfda1b5 100644 --- a/drivers/bus/mhi/core/mhi_internal.h +++ b/drivers/bus/mhi/core/mhi_internal.h @@ -809,6 +809,12 @@ static inline void mhi_trigger_resume(struct mhi_controller *mhi_cntrl) pm_wakeup_hard_event(&mhi_cntrl->mhi_dev->dev); } +static inline bool is_valid_ring_ptr(struct mhi_ring *ring, dma_addr_t addr) +{ + return ((addr >= ring->iommu_base && + addr < ring->iommu_base + ring->len) && (addr % 16 == 0)); +} + /* queue transfer buffer */ int mhi_gen_tre(struct mhi_controller *mhi_cntrl, struct mhi_chan *mhi_chan, void *buf, void *cb, size_t buf_len, enum MHI_FLAGS flags); diff --git a/drivers/bus/mhi/core/mhi_main.c b/drivers/bus/mhi/core/mhi_main.c index 0ddbbeec7b8d..532bbd6151a4 100644 --- a/drivers/bus/mhi/core/mhi_main.c +++ b/drivers/bus/mhi/core/mhi_main.c @@ -1403,6 +1403,12 @@ int mhi_process_tsync_ev_ring(struct mhi_controller *mhi_cntrl, int ret = 0; spin_lock_bh(&mhi_event->lock); + if (!is_valid_ring_ptr(ev_ring, er_ctxt->rp)) { + MHI_ERR("Event ring rp points outside of the event ring or unalign rp %llx\n", + er_ctxt->rp); + spin_unlock_bh(&mhi_event->lock); + return 0; + } dev_rp = mhi_to_virtual(ev_ring, er_ctxt->rp); if (ev_ring->rp == dev_rp) { spin_unlock_bh(&mhi_event->lock); @@ -1496,8 +1502,14 @@ int mhi_process_bw_scale_ev_ring(struct mhi_controller *mhi_cntrl, int ret = 0; spin_lock_bh(&mhi_event->lock); - dev_rp = mhi_to_virtual(ev_ring, er_ctxt->rp); + if (!is_valid_ring_ptr(ev_ring, er_ctxt->rp)) { + MHI_ERR("Event ring rp points outside of the event ring or unalign rp %llx\n", + er_ctxt->rp); + spin_unlock_bh(&mhi_event->lock); + return 0; + } + dev_rp = mhi_to_virtual(ev_ring, er_ctxt->rp); if (ev_ring->rp == dev_rp) { spin_unlock_bh(&mhi_event->lock); goto exit_bw_scale_process; From eaecb5470660c1a2ca5c970d2945bd448eaf672e Mon Sep 17 00:00:00 2001 From: Subramanian Ananthanarayanan Date: Tue, 25 Jul 2023 03:32:15 -0700 Subject: [PATCH 12/16] PCI: Configure RC MPS to 128 for Realtek 8168 attach Change is to configure QC RC MPS 128 bytes as 8168 device only supports 128 bytes. Without this quirk, since RC is using pcie_bus_perf flag MPS is configured to 256 bytes, when EP MRRS is changed to 4096 bytes RC is responding with packets of 256 bytes causing functionality break. Since pcie_bus_perf is used for many products, this change provies a provision to configure RC to 128 bytes for realtek 8168 attach alone. Change-Id: I4a82293e4f71bf188d4f0f2be8fa194c5ab007c2 Signed-off-by: Subramanian Ananthanarayanan --- drivers/pci/quirks.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c index f8f37f09ab4d..974a6be26fbd 100644 --- a/drivers/pci/quirks.c +++ b/drivers/pci/quirks.c @@ -2415,6 +2415,20 @@ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_CK804_PCIE, DECLARE_PCI_FIXUP_RESUME_EARLY(PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_CK804_PCIE, quirk_nvidia_ck804_pcie_aer_ext_cap); +/* + * Quirk to limit QCOM RC MPS to 128 in case of Realtek 8168 + * attaches. + */ +static void quirk_realtek_rc_mpss_limit(struct pci_dev *pdev) +{ + struct pci_dev *root_port = pcie_find_root_port(pdev); + + if (root_port->vendor == PCI_VENDOR_ID_QCOM) + pcie_set_mps(root_port, 128); +} +DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_REALTEK, 0x8168, + quirk_realtek_rc_mpss_limit); + static void quirk_via_cx700_pci_parking_caching(struct pci_dev *dev) { /* From bb3bc96f354eda355b1606b360e77580eabb3129 Mon Sep 17 00:00:00 2001 From: Suren Baghdasaryan Date: Wed, 24 Nov 2021 15:59:05 -0800 Subject: [PATCH 13/16] BACKPORT: FROMLIST: mm: protect free_pgtables with mmap_lock write lock in exit_mmap oom-reaper and process_mrelease system call should protect against races with exit_mmap which can destroy page tables while they walk the VMA tree. oom-reaper protects from that race by setting MMF_OOM_VICTIM and by relying on exit_mmap to set MMF_OOM_SKIP before taking and releasing mmap_write_lock. process_mrelease has to elevate mm->mm_users to prevent such race. Both oom-reaper and process_mrelease hold mmap_read_lock when walking the VMA tree. The locking rules and mechanisms could be simpler if exit_mmap takes mmap_write_lock while executing destructive operations such as free_pgtables. Change exit_mmap to hold the mmap_write_lock when calling free_pgtables. Operations like unmap_vmas() and unlock_range() are not destructive and could run under mmap_read_lock but for simplicity we take one mmap_write_lock during almost the entire operation. Note also that because oom-reaper checks VM_LOCKED flag, unlock_range() should not be allowed to race with it. In most cases this lock should be uncontended. Previously, Kirill reported ~4% regression caused by a similar change [1]. We reran the same test and although the individual results are quite noisy, the percentiles show lower regression with 1.6% being the worst case [2]. The change allows oom-reaper and process_mrelease to execute safely under mmap_read_lock without worries that exit_mmap might destroy page tables from under them. [1] https://lore.kernel.org/all/20170725141723.ivukwhddk2voyhuc@node.shutemov.name/ [2] https://lore.kernel.org/all/CAJuCfpGC9-c9P40x7oy=jy5SphMcd0o0G_6U1-+JAziGKG6dGA@mail.gmail.com/ Signed-off-by: Suren Baghdasaryan Link: https://lore.kernel.org/all/20211124235906.14437-1-surenb@google.com/ Bug: 130172058 Bug: 189803002 Change-Id: Ic87272d09a0b68a1b0e968e8f1a1510fd6fc776a Git-commit: 28358ebf2adb31117893813992fefcfd359a6a16 Git-repo: https://android.googlesource.com/kernel/common/ [quic_gkohli@quicinc.com: Resolved cherry-pick conflict in mm/mmap.c due to mmap lock was implemented differently in older kernel, and Although process_mrelease is not applicable in older kernel, but this patch is required to take exclusive lock in exit_mmap path so that SPF knows an isolated vma was freed from this path] Signed-off-by: Gaurav Kohli Signed-off-by: Srinivasarao Pathipati --- mm/mmap.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/mm/mmap.c b/mm/mmap.c index 56ba432e7f1f..23698963a8ab 100644 --- a/mm/mmap.c +++ b/mm/mmap.c @@ -3254,10 +3254,9 @@ void exit_mmap(struct mm_struct *mm) (void)__oom_reap_task_mm(mm); set_bit(MMF_OOM_SKIP, &mm->flags); - down_write(&mm->mmap_sem); - up_write(&mm->mmap_sem); } + down_write(&mm->mmap_sem); if (mm->locked_vm) { vma = mm->mmap; while (vma) { @@ -3270,8 +3269,11 @@ void exit_mmap(struct mm_struct *mm) arch_exit_mmap(mm); vma = mm->mmap; - if (!vma) /* Can happen if dup_mmap() received an OOM */ + if (!vma) { + /* Can happen if dup_mmap() received an OOM */ + up_write(&mm->mmap_sem);; return; + } lru_add_drain(); flush_cache_mm(mm); @@ -3282,16 +3284,14 @@ void exit_mmap(struct mm_struct *mm) free_pgtables(&tlb, vma, FIRST_USER_ADDRESS, USER_PGTABLES_CEILING); tlb_finish_mmu(&tlb, 0, -1); - /* - * Walk the list again, actually closing and freeing it, - * with preemption enabled, without holding any MM locks. - */ + /* Walk the list again, actually closing and freeing it. */ while (vma) { if (vma->vm_flags & VM_ACCOUNT) nr_accounted += vma_pages(vma); vma = remove_vma(vma); cond_resched(); } + up_write(&mm->mmap_sem); vm_unacct_memory(nr_accounted); } From aa7c391a5dfd4efc97796c665ab2eb3a07faac34 Mon Sep 17 00:00:00 2001 From: Yogesh Lal Date: Wed, 26 Jul 2023 10:29:33 +0530 Subject: [PATCH 14/16] defconfig: sdxlemur: Enable binder configs Enable android binder configs on sdxlemur. Change-Id: Ibe29fdbe0cee7fc33c0bd5dd3c6fcbf6d330617e Signed-off-by: Yogesh Lal Signed-off-by: Sayan Dey --- arch/arm/configs/vendor/sdxlemur.config | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/arch/arm/configs/vendor/sdxlemur.config b/arch/arm/configs/vendor/sdxlemur.config index 6f909a87bf87..356e95bb0904 100644 --- a/arch/arm/configs/vendor/sdxlemur.config +++ b/arch/arm/configs/vendor/sdxlemur.config @@ -505,3 +505,7 @@ CONFIG_DM_VERITY=y # CONFIG_DEVMEM is not set CONFIG_DAX=y CONFIG_LSM_MMAP_MIN_ADDR=32768 +CONFIG_ANDROID_BINDER_IPC=y +CONFIG_ANDROID_BINDERFS=y +CONFIG_ANDROID_BINDER_DEVICES="binder,hwbinder,vndbinder" +# CONFIG_ANDROID_BINDER_IPC_SELFTEST is not set From 5708c1073029e11dece5d42451da84087ce69cd7 Mon Sep 17 00:00:00 2001 From: Pradeep P V K Date: Tue, 22 Aug 2023 10:43:54 +0530 Subject: [PATCH 15/16] mtd: msm_qpic_nand: Add runtime status check in notifiers During panic, all cores and irq's will gets disable. So, it is not recommended to request for a new resource during this time. So, add a check to return from notifier call based on the device runtime status. Change-Id: Ie4fd526ad2d107008b4af13997534fb614ca507a Signed-off-by: Pradeep P V K --- drivers/mtd/devices/msm_qpic_nand.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/drivers/mtd/devices/msm_qpic_nand.c b/drivers/mtd/devices/msm_qpic_nand.c index fda89bf0cba8..41fadf756ac3 100644 --- a/drivers/mtd/devices/msm_qpic_nand.c +++ b/drivers/mtd/devices/msm_qpic_nand.c @@ -4371,6 +4371,15 @@ static int msm_nand_bam_panic_notifier(struct notifier_block *this, struct msm_nand_chip *chip = &info->nand_chip; int err; + /* We shouldn't request for a new resource during panic + * as the cores and irq's were already in disabled state. + * So, check device runtime status before request for a + * resource (clock and bus). + */ + + if (pm_runtime_suspended(chip->dev)) + return NOTIFY_DONE; + err = msm_nand_get_device(chip->dev); if (err) goto out; From 39a454741195466ed6add9436fde985f7c193fd5 Mon Sep 17 00:00:00 2001 From: Elliot Berman Date: Fri, 7 Jul 2023 15:38:32 -0700 Subject: [PATCH 16/16] virt: haven: Correct max_buf_size for a connection Continuation messages can carry a maximum payload of HH_RM_MAX_MSG_SIZE_BYTES. When initializing a connection buffer for reply sequences, the hdr_size is 4 bytes larger than the HH_RM_MAX_MSG_SIZE_BYTES: see the difference between struct hh_rm_rpc_hdr and struct hh_rm_rpc_reply_hdr. Fix the calculation. Change-Id: If7a1124f581c9d1da8f7749d0296e064e6499cdf [eberman: Make change in hh_rm_core.c] Signed-off-by: Elliot Berman (cherry picked from commit 01031bbb3b415928b07408243643b447c06afe5e) --- drivers/virt/haven/hh_rm_core.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/virt/haven/hh_rm_core.c b/drivers/virt/haven/hh_rm_core.c index cb45cd65aad4..a473513ae678 100644 --- a/drivers/virt/haven/hh_rm_core.c +++ b/drivers/virt/haven/hh_rm_core.c @@ -1,6 +1,7 @@ // SPDX-License-Identifier: GPL-2.0-only /* * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved. + * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved. * */ @@ -114,8 +115,8 @@ hh_rm_init_connection_buff(struct hh_rm_connection *connection, if (!payload_size) return 0; - max_buf_size = (HH_MSGQ_MAX_MSG_SIZE_BYTES - hdr_size) * - (hdr->fragments + 1); + max_buf_size = payload_size + + (hdr->fragments * HH_RM_MAX_MSG_SIZE_BYTES); if (payload_size > max_buf_size) { pr_err("%s: Payload size exceeds max buff size\n", __func__);