When the skb is greater than 16kb and needs to by padded, qrtr attempts
to manually pad the trailing bytes to be zeroed out and word aligned.
The padding of the page was happening correctly, but the bookkeeping on
the skb was not accurate. When skb->len was updated to account for the
new padding but skb->data_len was not, this made all skb functions
think the linear portion (skb->len - skb_data_len) was longer than it
actually was. This caused a pattern where skb_copy_bits() would copy
out of bounds on the linear section and shift the trailing bits into
the padded section.
Before padding without updating data_len.
[ 104.825620] qrtr: 00003e80: 66 d3 a0 e1 b6 04 e4 43 b7 aa f0 40 fb eb 38 dc
[ 104.825622] qrtr: 00003e90: f1 91 85 e5 17 26 2a a2 11 49 bc cc bd f3 d3 23
[ 104.825624] qrtr: 00003ea0: c6.
Adter padding without updating data_len.
[ 104.860041] qrtr: 00003e80: 66 d3 a0 e1 b6 04 e4 43 b7 aa f0 40 fb eb 38 dc
[ 104.860042] qrtr: 00003e90: f1 91 85 e5 17 26 2a a2 11 49 bc cc bd 00 00 00
[ 104.860043] qrtr: 00003ea0: f3 d3 23 c6.
Change-Id: I6c1c944ecf696360ada263046b0e0af1bfdeb505
Signed-off-by: Chris Lew <quic_clew@quicinc.com>
In qrtr_get_service_id, use xa_load instead of node_get to check
if the node exists or not. Calling node_get from interrupt context
can cause potential deadlock since it calls into xa_store to
allocate the node if it does not exist.
Change-Id: Ida9f7a113417f0d184c0903004d94dd2eca6c472
Signed-off-by: Sarannya S <quic_sarannya@quicinc.com>
Add support to handle paged skbs from the qrtr code layer. Neither the
pskb or the sg APIs support copying into io memory. Add a helper in
qrtr gunyah to copy from scatterlists into the fifo io memory.
Not all skbs coming from qrtr core will be paged skbs, keep support for
linear buffer copies in the tx path.
Change-Id: Ifccab77e45ec70fd4c7bad92b06497c65403461e
Signed-off-by: Chris Lew <quic_clew@quicinc.com>
Large linear allocations are prone to failure. Add support in qrtr to
allocate used paged/fragmented skb's if the data is larger than
"SKB_MAX_ALLOC" to improve chances that large packet sends will
succeed.
This change is mostly useless until transports add support for handling
fragmented skb's. Otherwise the large transfers will be linearized in
the transport itself.
Change-Id: If6411292311db51890f0641464c1565051244378
Signed-off-by: Chris Lew <quic_clew@quicinc.com>
Add skb_copy_datagram_from_iter used by qrtr in the fragmented skb
feature to handle large transmission requests.
Change-Id: I4d9ca8295b8df42667723b5b2b8e9b946eeddbe9
Signed-off-by: Chris Lew <quic_clew@quicinc.com>
If a static carveout is not available for VMs they should be able to
fallback to a dynamic allocation from the CMA. Add support to dma alloc
contigous memory and share that memory to the VM.
Change-Id: Ie8c5b961b530102d9046818a6e0b31a70e05b896
Signed-off-by: Chris Lew <quic_clew@quicinc.com>
Current VM configurations share the defconfig across VMs. This will
cause conflict if multiple VMs are running. Add the ability to set an
override node id from device tree.
Change-Id: I96c4998e3e3976219724dc938775746e181c9f72
Signed-off-by: Chris Lew <quic_clew@quicinc.com>
ns service was notifying only local node ID services after
a pci disconnect and reconnect. Fix it to iterate over all
nodes and announce services of all nodes.
Change-Id: I4f91a71ad847b815318a7de47134f6b9c57dff53
Signed-off-by: Manoharan Vijaya Raghavan <mraghava@codeaurora.org>
Signed-off-by: Chris Lew <quic_clew@quicinc.com>
The xa_alloc_cyclic function cannot be called with GFP_ATOMIC if the
context does not have preemption disabled. There was a change to make
the port allocation structure synchronize with rcu and therefore was no
longer protected with spinlocks. Using RCUs lead to a performance
degredation so spinlock synchronization was reinstated. Now that port
allocation happens within a spinlock, GFP_KERNEL cannot be used.
Change-Id: I2178e190a73a949423d7c7ece1af92ab173e176d
Signed-off-by: Chris Lew <quic_clew@quicinc.com>
QRTR should support asynchronous sends even with the tx flow control
enabled. Add a timeout to the tx_wait and send a zero size packet to
nonblocking sockets after the remote port is no longer flow controlled.
This zero size packet will act as a notification for clients to start
sending again.
Change-Id: I5040b98fe666a1a9c27994dc66b321328c2e4c66
Signed-off-by: Chris Lew <quic_clew@quicinc.com>
In qrtr_endpoint_post, getting svc_id based on sk_buff->cb after sk_buff
has been queued to the endpoint leads to a potential use-after-free
scenario. To avoid this race condition, get the service ID via
sk_buff->cb before queueing the sk_buff.
Change-Id: I53205fdffc08fd6dc48fd158c7fe5966f38aa978
Signed-off-by: Tony Truong <quic_truong@quicinc.com>
The return value for of_property_count_u32_elems can be negative in the
case of an error or the property is not found. It is incorrect to use
size_t, unsigned type, as this can cause an overflow. Switch size from
type size_t to int.
Change-Id: Ica0425abd034b82994ab32087f04d602ce3dd9e9
Signed-off-by: Tony Truong <quic_truong@quicinc.com>
Instead of filtering pm_wakeup_event() call via node ID, add support to
do it based on the service ID. This provides more fine control over
which incoming packet can wakeup APPS.
Change-Id: I1e4a7f6d04a2e37104191bedc5d87070aabc002b
Signed-off-by: Tony Truong <quic_truong@quicinc.com>
Log qrtr rx packet in kernel logs which caused system wakeup.
This will help to easily identify wakeup packet.
The qrtr module is required to be in first stage init to support
the creation of qrtr sockets. The transport layers are often in second
stage init. The current wakeup prints depend on some information from
the second stage init. Rework the logic so the dependency is only
between the qrtr transport and transport drivers.
Change-Id: I4a6a35dd4d5449a671464c00f90712a79d6044fe
Signed-off-by: Deepak Kumar Singh <deesin@codeaurora.org>
Signed-off-by: Chris Lew <quic_clew@quicinc.com>
Add the DEL_PROC control message for forwarding usecases. If this proc
acts as a gateway between two procs then they need a notification to
clean up servers and client ports when either goes down. This message
acts as notification to clean up all resources associated with the node
in the message.
Change-Id: I3514f54aa0221e104196e2120e929cc9f351847d
Signed-off-by: Chris Lew <quic_clew@quicinc.com>
skb_put_padto() will free the skb if it fails to add the requested
padding to the skb. Drop the packet if we are unable to allocate a new
skb with the requested padding.
Change-Id: I5503c99679c7e6ecf767d3f632d72da5315988f1
Signed-off-by: Jay Jayanna <jayanna@codeaurora.org>
Signed-off-by: Chris Lew <quic_clew@quicinc.com>
Print error logs in the callback by using pr_err_ratelimited
so that watchdog bark will not occur due to excessive logging
when the callback is triggered before probe is completed.
Change-Id: I82bb84b7812cef5cb8a37e99c5cf1a54411cbdb8
Signed-off-by: Sarannya S <sarannya@codeaurora.org>
Signed-off-by: Chris Lew <quic_clew@quicinc.com>
Allow isr context to get service details.
Change-Id: I782a2c80883252ce614a0a05df6d4fc1a1304b32
Signed-off-by: Arun Prakash <app@codeaurora.org>
Signed-off-by: Chris Lew <quic_clew@quicinc.com>
The qrtr driver can guarantee that the packet gets queued to the socket
but cannot guarantee the client process will get time to run if auto
sleep is enabled. This config will help mitigate missed packets on
systems where auto sleep is too aggressive.
Use the pm_wakeup_ws_event() api so a hard wakeup can be specified.
This will ensure a resume occurs if the data coming in happens while
the device is going into suspend.
Change-Id: Ic596e06e585b3479a6faa1d0210c016fc9138c6e
Signed-off-by: Chris Lew <quic_clew@quicinc.com>
In some cases system enters into suspend state before handling
incoming packets and cause delay in communication.
Add pm_wakup_event() to abort the suspend when a packet is received.
Force a wakeup when queueing packets to a socket. This is needed to
give userspace clients a chance to run if the device is going into
system suspend. The wakeup event should force the device to abort
suspend.
The only node that should not behave this way is the SLPI node because
sensor stream race conditions cause suspend issues and power drain
issues.
There was an update to add a device parameter into
wakeup_source_register().
Change-Id: Ie69be3a46309f6a05cfbff0642b95194c2d6e955
Signed-off-by: Chris Lew <quic_clew@quicinc.com>
Add a pool of SKBs that can be used when the system is in low memory
conditions. This pool will be shared between all nodes and replenished
by a worker function.
Change-Id: I639a9ac76db726dc8ad46b12d3b3d560c674939c
Signed-off-by: Jay Jayanna <jayanna@codeaurora.org>
Signed-off-by: Chris Lew <quic_clew@quicinc.com>
Add support to configure the node id through defconfig. This is useful
for targets that are unable to configure the node id through qrtr-ns
because of security reasons. The local node id can still be overridden
by the ns if it is capable.
Change-Id: Ie9fec2ae276948340f4f5a7e0374d554502a0ee1
Signed-off-by: Chris Lew <quic_clew@quicinc.com>
Node ref count decrement and test is performed inside ept
sem lock while node lookup is done inside node spin lock.
This can sometime cause node lookup to succeed while parallely
node can be freed in node release function. This will further
use of node and will result in use after free.
Additionally hold ept smem lock before performing node lookup.
Change-Id: Iaa5781c56ebee51611dfea9fddcde50f1367dfea
Signed-off-by: Deepak Kumar Singh <deesin@codeaurora.org>
Signed-off-by: Jay Jayanna <jayanna@codeaurora.org>
Signed-off-by: Chris Lew <quic_clew@quicinc.com>
