Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f637b371 authored by Ghanim Fodi's avatar Ghanim Fodi
Browse files

msm: ipa: fix IPA driver processing context delete logic 



During IPA driver processing context delete, a delete to
the referenced header is being done. The header deletion
will also commit the changes to H/W which includes the
processing context commit. This resulted into committing
an invalid process context as it is still in the processing
context list, but points to deleted header.
The fix is to not commit the changes when deleting the header
but only when deleting the processing context.

Change-Id: I9d3c5eec717da0b072144a1027e4582e73aaa6d9
CRs-fixed: 1044710
Signed-off-by: default avatarGhanim Fodi <gfodi@codeaurora.org>
parent 0fdb8c8e

drivers/platform/msm/ipa/ipa_v2/ipa_hdr.c

+15 −7
Original line number Diff line number Diff line
@@ -581,6 +581,7 @@ static int __ipa_add_hdr_proc_ctx(struct ipa_hdr_proc_ctx_add *proc_ctx, 
	return 0;



bad_len:

	if (add_ref_hdr)

		hdr_entry->ref_cnt--;

	entry->cookie = 0;

	kmem_cache_free(ipa_ctx->hdr_proc_ctx_cache, entry);
@@ -761,7 +762,7 @@ static int __ipa_del_hdr_proc_ctx(u32 proc_ctx_hdl, bool release_hdr) 
	}



	if (release_hdr)

		__ipa_release_hdr(entry->hdr->id);

		__ipa_del_hdr(entry->hdr->id);



	/* move the offset entry to appropriate free list */

	list_move(&entry->offset_entry->link,
@@ -1089,12 +1090,19 @@ int ipa2_reset_hdr(void) 
			&ipa_ctx->hdr_tbl.head_hdr_entry_list, link) {



		/* do not remove the default header */

		if (!strcmp(entry->name, IPA_LAN_RX_HDR_NAME))

		if (!strcmp(entry->name, IPA_LAN_RX_HDR_NAME)) {

			if (entry->is_hdr_proc_ctx) {

				mutex_unlock(&ipa_ctx->lock);

				WARN_ON(1);

				IPAERR("default header is proc ctx\n");

				return -EFAULT;

			}

			continue;

		}



		if (ipa_id_find(entry->id) == NULL) {

			WARN_ON(1);

			mutex_unlock(&ipa_ctx->lock);

			WARN_ON(1);

			return -EFAULT;

		}

		if (entry->is_hdr_proc_ctx) {
@@ -1147,8 +1155,8 @@ int ipa2_reset_hdr(void) 
		link) {



		if (ipa_id_find(ctx_entry->id) == NULL) {

			WARN_ON(1);

			mutex_unlock(&ipa_ctx->lock);

			WARN_ON(1);

			return -EFAULT;

		}

		list_del(&ctx_entry->link);
@@ -1311,8 +1319,8 @@ int ipa2_put_hdr(u32 hdr_hdl) 
		goto bail;

	}



	if (entry == NULL || entry->cookie != IPA_COOKIE) {

		IPAERR("bad params\n");

	if (entry->cookie != IPA_COOKIE) {

		IPAERR("invalid header entry\n");

		result = -EINVAL;

		goto bail;

	}

drivers/platform/msm/ipa/ipa_v2/ipa_i.h

+1 −1
Original line number Diff line number Diff line
@@ -242,7 +242,7 @@ struct ipa_rt_tbl { 
 * @is_partial: flag indicating if header table entry is partial

 * @is_hdr_proc_ctx: false - hdr entry resides in hdr table,

 * true - hdr entry resides in DDR and pointed to by proc ctx

 * @phys_base: physical address of entry in SRAM when is_hdr_proc_ctx is true,

 * @phys_base: physical address of entry in DDR when is_hdr_proc_ctx is true,

 * else 0

 * @proc_ctx: processing context header

 * @offset_entry: entry's offset

drivers/platform/msm/ipa/ipa_v2/ipa_rt.c

+4 −0
Original line number Diff line number Diff line
@@ -1008,6 +1008,10 @@ static int __ipa_add_rt_rule(enum ipa_ip_type ip, const char *name, 
	return 0;



ipa_insert_failed:

	if (entry->hdr)

		entry->hdr->ref_cnt--;

	else if (entry->proc_ctx)

		entry->proc_ctx->ref_cnt--;

	list_del(&entry->link);

	kmem_cache_free(ipa_ctx->rt_rule_cache, entry);

error:

drivers/platform/msm/ipa/ipa_v3/ipa_hdr.c

+15 −7
Original line number Diff line number Diff line
@@ -418,6 +418,7 @@ static int __ipa_add_hdr_proc_ctx(struct ipa_hdr_proc_ctx_add *proc_ctx, 
	return 0;



bad_len:

	if (add_ref_hdr)

		hdr_entry->ref_cnt--;

	entry->cookie = 0;

	kmem_cache_free(ipa3_ctx->hdr_proc_ctx_cache, entry);
@@ -589,7 +590,7 @@ static int __ipa3_del_hdr_proc_ctx(u32 proc_ctx_hdl, bool release_hdr) 
	}



	if (release_hdr)

		__ipa3_release_hdr(entry->hdr->id);

		__ipa3_del_hdr(entry->hdr->id);



	/* move the offset entry to appropriate free list */

	list_move(&entry->offset_entry->link,
@@ -893,12 +894,19 @@ int ipa3_reset_hdr(void) 
			&ipa3_ctx->hdr_tbl.head_hdr_entry_list, link) {



		/* do not remove the default header */

		if (!strcmp(entry->name, IPA_LAN_RX_HDR_NAME))

		if (!strcmp(entry->name, IPA_LAN_RX_HDR_NAME)) {

			if (entry->is_hdr_proc_ctx) {

				IPAERR("default header is proc ctx\n");

				mutex_unlock(&ipa3_ctx->lock);

				WARN_ON(1);

				return -EFAULT;

			}

			continue;

		}



		if (ipa3_id_find(entry->id) == NULL) {

			WARN_ON(1);

			mutex_unlock(&ipa3_ctx->lock);

			WARN_ON(1);

			return -EFAULT;

		}

		if (entry->is_hdr_proc_ctx) {
@@ -951,8 +959,8 @@ int ipa3_reset_hdr(void) 
		link) {



		if (ipa3_id_find(ctx_entry->id) == NULL) {

			WARN_ON(1);

			mutex_unlock(&ipa3_ctx->lock);

			WARN_ON(1);

			return -EFAULT;

		}

		list_del(&ctx_entry->link);
@@ -1115,8 +1123,8 @@ int ipa3_put_hdr(u32 hdr_hdl) 
		goto bail;

	}



	if (entry == NULL || entry->cookie != IPA_COOKIE) {

		IPAERR("bad params\n");

	if (entry->cookie != IPA_COOKIE) {

		IPAERR("invalid header entry\n");

		result = -EINVAL;

		goto bail;

	}

drivers/platform/msm/ipa/ipa_v3/ipa_i.h

+1 −1
Original line number Diff line number Diff line
@@ -271,7 +271,7 @@ struct ipa3_rt_tbl { 
 * @is_partial: flag indicating if header table entry is partial

 * @is_hdr_proc_ctx: false - hdr entry resides in hdr table,

 * true - hdr entry resides in DDR and pointed to by proc ctx

 * @phys_base: physical address of entry in SRAM when is_hdr_proc_ctx is true,

 * @phys_base: physical address of entry in DDR when is_hdr_proc_ctx is true,

 * else 0

 * @proc_ctx: processing context header

 * @offset_entry: entry's offset