kernel/linux.git/drivers/hwtracing, branch linux-4.20.y

coresight: tmc: Fix bad register address for CLAIM

2019-01-26T08:20:44+00:00

[ Upstream commit 323ed1e0f60b35df55763356d4973a18d5eaea15 ] Commit 4d3ebd3658d8 ("coreisght: tmc: Claim device before use") uses CLAIM tag to validate if the device is available, it needs to pass the device base address to access related registers. In the function tmc_etb_disable_hw() it wrongly passes the driver data pointer as register base address, thus it's easily to produce the kernel warning info like below: [ 83.579898] WARNING: CPU: 4 PID: 2970 at drivers/hwtracing/coresight/coresight.c:207 coresight_disclaim_device_unlocked+0x44/0x80 [ 83.591448] Modules linked in: [ 83.594485] CPU: 4 PID: 2970 Comm: uname Not tainted 4.19.0-rc6-00417-g721b509 #110 [ 83.602067] Hardware name: ARM Juno development board (r2) (DT) [ 83.607932] pstate: 80000085 (Nzcv daIf -PAN -UAO) [ 83.612681] pc : coresight_disclaim_device_unlocked+0x44/0x80 [ 83.618375] lr : coresight_disclaim_device_unlocked+0x44/0x80 [ 83.624064] sp : ffff00000fe3ba20 [ 83.627347] x29: ffff00000fe3ba20 x28: ffff80002d430dc0 [ 83.632618] x27: ffff800033177c00 x26: ffff80002eb44480 [ 83.637889] x25: 0000000000000001 x24: ffff800033c72600 [ 83.643160] x23: ffff0000099b11f8 x22: ffff0000099b11c8 [ 83.648430] x21: 0000000000000002 x20: ffff800033a90418 [ 83.653701] x19: ffff0000099b11c8 x18: 0000000000000000 [ 83.658971] x17: 0000000000000000 x16: 0000000000000000 [ 83.664241] x15: 0000000000000000 x14: 0000000000000000 [ 83.669511] x13: 0000000000000000 x12: 0000000000000000 [ 83.674782] x11: 0000000000000000 x10: 0000000000000000 [ 83.680052] x9 : 0000000000000000 x8 : 0000000000000001 [ 83.685322] x7 : 0000000000010000 x6 : ffff800033ebab18 [ 83.690593] x5 : ffff800033ebab18 x4 : ffff800033e6c698 [ 83.695862] x3 : 0000000000000001 x2 : 0000000000000000 [ 83.701133] x1 : 0000000000000000 x0 : 0000000000000001 [ 83.706404] Call trace: [ 83.708830] coresight_disclaim_device_unlocked+0x44/0x80 [ 83.714180] coresight_disclaim_device+0x34/0x48 [ 83.718756] tmc_disable_etf_sink+0xc4/0xf0 [ 83.722902] coresight_disable_path_from+0xc8/0x240 [ 83.727735] coresight_disable_path+0x24/0x30 [ 83.732053] etm_event_stop+0x130/0x170 [ 83.735854] etm_event_del+0x24/0x30 [ 83.739399] event_sched_out.isra.51+0xcc/0x1e8 [ 83.743887] group_sched_out.part.53+0x44/0xb0 [ 83.748291] ctx_sched_out+0x298/0x2b8 [ 83.752005] task_ctx_sched_out+0x74/0xa8 [ 83.755980] perf_event_exit_task+0x140/0x418 [ 83.760298] do_exit+0x3f4/0xcf0 [ 83.763497] do_group_exit+0x5c/0xc0 [ 83.767041] __arm64_sys_exit_group+0x24/0x28 [ 83.771359] el0_svc_common+0x110/0x178 [ 83.775160] el0_svc_handler+0x94/0xe8 [ 83.778875] el0_svc+0x8/0xc [ 83.781728] ---[ end trace 02d8d8eac46db9e5 ]--- This patch is to fix this bug by using 'drvdata->base' as the register base address for CLAIM related operation. Fixes: 4d3ebd3658d8 ("coreisght: tmc: Claim device before use") Cc: Suzuki Poulose Cc: Mathieu Poirier Cc: Mike Leach Cc: Robert Walker Signed-off-by: Leo Yan Reviewed-by: Suzuki K Poulose Signed-off-by: Mathieu Poirier Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin

intel_th: msu: Fix an off-by-one in attribute store

2019-01-13T08:24:09+00:00

commit ec5b5ad6e272d8d6b92d1007f79574919862a2d2 upstream. The 'nr_pages' attribute of the 'msc' subdevices parses a comma-separated list of window sizes, passed from userspace. However, there is a bug in the string parsing logic wherein it doesn't exclude the comma character from the range of characters as it consumes them. This leads to an out-of-bounds access given a sufficiently long list. For example: > # echo 8,8,8,8 > /sys/bus/intel_th/devices/0-msc0/nr_pages > ================================================================== > BUG: KASAN: slab-out-of-bounds in memchr+0x1e/0x40 > Read of size 1 at addr ffff8803ffcebcd1 by task sh/825 > > CPU: 3 PID: 825 Comm: npktest.sh Tainted: G W 4.20.0-rc1+ > Call Trace: > dump_stack+0x7c/0xc0 > print_address_description+0x6c/0x23c > ? memchr+0x1e/0x40 > kasan_report.cold.5+0x241/0x308 > memchr+0x1e/0x40 > nr_pages_store+0x203/0xd00 [intel_th_msu] Fix this by accounting for the comma character. Signed-off-by: Alexander Shishkin Fixes: ba82664c134ef ("intel_th: Add Memory Storage Unit driver") Cc: stable@vger.kernel.org # v4.4+ Signed-off-by: Greg Kroah-Hartman

stm class: Fix a module refcount leak in policy creation error path

2019-01-13T08:24:08+00:00

commit c18614a1a11276837bdd44403d84d207c9951538 upstream. Commit c7fd62bc69d0 ("stm class: Introduce framing protocol drivers") adds a bug into the error path of policy creation, that would do a module_put() on a wrong module, if one tried to create a policy for an stm device which already has a policy, using a different protocol. IOW, | mkdir /config/stp-policy/dummy_stm.0:p_basic.test | mkdir /config/stp-policy/dummy_stm.0:p_sys-t.test # puts "p_basic" | mkdir /config/stp-policy/dummy_stm.0:p_sys-t.test # "p_basic" -> -1 throws: | general protection fault: 0000 [#1] SMP PTI | CPU: 3 PID: 2887 Comm: mkdir | RIP: 0010:module_put.part.31+0xe/0x90 | Call Trace: | module_put+0x13/0x20 | stm_put_protocol+0x11/0x20 [stm_core] | stp_policy_make+0xf1/0x210 [stm_core] | ? __kmalloc+0x183/0x220 | ? configfs_mkdir+0x10d/0x4c0 | configfs_mkdir+0x169/0x4c0 | vfs_mkdir+0x108/0x1c0 | do_mkdirat+0xe8/0x110 | __x64_sys_mkdir+0x1b/0x20 | do_syscall_64+0x5a/0x140 | entry_SYSCALL_64_after_hwframe+0x44/0xa9 Correct this sad mistake by calling calling 'put' on the correct reference, which happens to match another error path in the same function, so we consolidate the two at the same time. Signed-off-by: Alexander Shishkin Fixes: c7fd62bc69d0 ("stm class: Introduce framing protocol drivers") Reported-by: Ammy Yi Cc: stable Signed-off-by: Greg Kroah-Hartman

stm class: Use memcat_p()

2018-10-11T10:12:55+00:00

Instead of a local copy, use the memcat_p() helper to merge policy node attributes. Signed-off-by: Alexander Shishkin Tested-by: Mathieu Poirier Signed-off-by: Greg Kroah-Hartman

stm class: heartbeat: Fix whitespace

2018-10-11T10:12:55+00:00

Fix whitespace in the code for better readability, no functional changes. Signed-off-by: Alexander Shishkin Tested-by: Mathieu Poirier Signed-off-by: Greg Kroah-Hartman

stm class: p_sys-t: Add support for CLOCKSYNC packets

2018-10-11T10:12:54+00:00

This adds support for CLOCKSYNC SyS-T packets, that establish correlation between the transport clock (STP timestamps) and SyS-T timestamps. These packets are sent periodically to allow the decoder to keep both time sources in sync. Signed-off-by: Alexander Shishkin Tested-by: Mathieu Poirier Signed-off-by: Greg Kroah-Hartman

stm class: Add MIPI SyS-T protocol support

2018-10-11T10:12:54+00:00

This adds support for MIPI SyS-T protocol as specified in an open standard [1]. In addition to marking message boundaries, it also supports tagging messages with the source UUID, to provide better distinction between trace sources, including payload length and timestamp in the message's metadata. This driver adds attributes to STP policy nodes to control/configure these metadata features. [1] https://www.mipi.org/specifications/sys-t Signed-off-by: Alexander Shishkin Tested-by: Mathieu Poirier Signed-off-by: Greg Kroah-Hartman

stm class: Switch over to the protocol driver

2018-10-11T10:12:54+00:00

Now that the default framing protocol is factored out into its own driver, switch over to using the driver for writing data. To that end, make the policy code require a valid protocol name (or absence thereof, which is equivalent to "p_basic"). Also, to make transition easier, make stm class request "p_basic" module at initialization time. Signed-off-by: Alexander Shishkin Tested-by: Mathieu Poirier Signed-off-by: Greg Kroah-Hartman

stm class: Factor out default framing protocol

2018-10-11T10:12:54+00:00

The STP framing pattern that the stm class implicitly applies to the data payload is, in fact, a protocol. This patch moves the relevant code out of the stm core into its own driver module. Signed-off-by: Alexander Shishkin Tested-by: Mathieu Poirier Signed-off-by: Greg Kroah-Hartman

stm class: Add a helper for writing data packets

2018-10-11T10:12:54+00:00

Add a helper to write a sequence of bytes as STP data packets. This is used by protocol drivers to output their metadata, as well as the actual data payload. Signed-off-by: Alexander Shishkin Tested-by: Mathieu Poirier Signed-off-by: Greg Kroah-Hartman