1. 12 Feb, 2024 4 commits
  2. 04 Aug, 2023 1 commit
  3. 05 Jun, 2023 2 commits
  4. 30 Jan, 2023 1 commit
  5. 27 Oct, 2021 2 commits
  6. 15 Jun, 2021 1 commit
    • Sai Prakash Ranjan's avatar
      coresight: tmc-etf: Fix global-out-of-bounds in tmc_update_etf_buffer() · 5fae8a94
      Sai Prakash Ranjan authored
      commit 6f755e85 ("coresight: Add helper for inserting synchronization
      packets") removed trailing '\0' from barrier_pkt array and updated the
      call sites like etb_update_buffer() to have proper checks for barrier_pkt
      size before read but missed updating tmc_update_etf_buffer() which still
      reads barrier_pkt past the array size resulting in KASAN out-of-bounds
      bug. Fix this by adding a check for barrier_pkt size before accessing
      like it is done in etb_update_buffer().
      
       BUG: KASAN: global-out-of-bounds in tmc_update_etf_buffer+0x4b8/0x698
       Read of size 4 at addr ffffffd05b7d1030 by task perf/2629
      
       Call trace:
        dump_backtrace+0x0/0x27c
        show_stack+0x20/0x2c
        dump_stack+0x11c/0x188
        print_address_description+0x3c/0x4a4
        __kasan_report+0x140/0x164
        kasan_report+0x10/0x18
        __asan_report_load4_noabort+0x1c/0x24
        tmc_update_etf_buffer+0x4b8/0x698
        etm_event_stop+0x248/0x2d8
        etm_event_del+0x20/0x2c
        event_sched_out+0x214/0x6f0
        group_sched_out+0xd0/0x270
        ctx_sched_out+0x2ec/0x518
        __perf_event_task_sched_out+0x4fc/0xe6c
        __schedule+0x1094/0x16a0
        preempt_schedule_irq+0x88/0x170
        arm64_preempt_schedule_irq+0xf0/0x18c
        el1_irq+0xe8/0x180
        perf_event_exec+0x4d8/0x56c
        setup_new_exec+0x204/0x400
        load_elf_binary+0x72c/0x18c0
        search_binary_handler+0x13c/0x420
        load_script+0x500/0x6c4
        search_binary_handler+0x13c/0x420
        exec_binprm+0x118/0x654
        __do_execve_file+0x77c/0xba4
        __arm64_compat_sys_execve+0x98/0xac
        el0_svc_common+0x1f8/0x5e0
        el0_svc_compat_handler+0x84/0xb0
        el0_svc_compat+0x10/0x50
      
       The buggy address belongs to the variable:
        barrier_pkt+0x10/0x40
      
       Memory state around the buggy address:
        ffffffd05b7d0f00: fa fa fa fa 04 fa fa fa fa fa fa fa 00 00 00 00
        ffffffd05b7d0f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
       >ffffffd05b7d1000: 00 00 00 00 00 00 fa fa fa fa fa fa 00 00 00 03
                                            ^
        ffffffd05b7d1080: fa fa fa fa 00 02 fa fa fa fa fa fa 03 fa fa fa
        ffffffd05b7d1100: fa fa fa fa 00 00 00 00 05 fa fa fa fa fa fa fa
       ==================================================================
      
      Link: https://lore.kernel.org/r/20210505093430.18445-1-saiprakash.ranjan@codeaurora.org
      Fixes: 0c3fc4d5
      
       ("coresight: Add barrier packet for synchronisation")
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarSai Prakash Ranjan <saiprakash.ranjan@codeaurora.org>
      Signed-off-by: default avatarSuzuki K Poulose <suzuki.poulose@arm.com>
      Signed-off-by: default avatarMathieu Poirier <mathieu.poirier@linaro.org>
      Link: https://lore.kernel.org/r/20210614175901.532683-6-mathieu.poirier@linaro.org
      
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      5fae8a94
  7. 04 Feb, 2021 1 commit
  8. 27 Nov, 2020 1 commit
    • Sai Prakash Ranjan's avatar
      coresight: tmc-etf: Fix NULL ptr dereference in tmc_enable_etf_sink_perf() · 868663dd
      Sai Prakash Ranjan authored
      There was a report of NULL pointer dereference in ETF enable
      path for perf CS mode with PID monitoring. It is almost 100%
      reproducible when the process to monitor is something very
      active such as chrome and with ETF as the sink and not ETR.
      Currently in a bid to find the pid, the owner is dereferenced
      via task_pid_nr() call in tmc_enable_etf_sink_perf() and with
      owner being NULL, we get a NULL pointer dereference.
      
      Looking at the ETR and other places in the kernel, ETF and the
      ETB are the only places trying to dereference the task(owner)
      in tmc_enable_etf_sink_perf() which is also called from the
      sched_in path as in the call trace. Owner(task) is NULL even
      in the case of ETR in tmc_enable_etr_sink_perf(), but since we
      cache the PID in alloc_buffer() callback and it is done as part
      of etm_setup_aux() when allocating buffer for ETR sink, we never
      dereference this NULL pointer and we are safe. So lets do the
      same thing with ETF and cache the PID to which the cs_buffer
      belongs in tmc_alloc_etf_buffer() as done for ETR. This will
      also remove the unnecessary function calls(task_pid_nr()) since
      we are caching the PID.
      
      Easily reproducible running below:
      
       perf record -e cs_etm/@tmc_etf0/ -N -p <pid>
      
      Unable to handle kernel NULL pointer dereference at virtual address 0000000000000548
      Mem abort info:
        ESR = 0x96000006
        EC = 0x25: DABT (current EL), IL = 32 bits
        SET = 0, FnV = 0
        EA = 0, S1PTW = 0
      Data abort info:
        ISV = 0, ISS = 0x00000006
        CM = 0, WnR = 0
      <snip>...
      Call trace:
       tmc_enable_etf_sink+0xe4/0x280
       coresight_enable_path+0x168/0x1fc
       etm_event_start+0x8c/0xf8
       etm_event_add+0x38/0x54
       event_sched_in+0x194/0x2ac
       group_sched_in+0x54/0x12c
       flexible_sched_in+0xd8/0x120
       visit_groups_merge+0x100/0x16c
       ctx_flexible_sched_in+0x50/0x74
       ctx_sched_in+0xa4/0xa8
       perf_event_sched_in+0x60/0x6c
       perf_event_context_sched_in+0x98/0xe0
       __perf_event_task_sched_in+0x5c/0xd8
       finish_task_switch+0x184/0x1cc
       schedule_tail+0x20/0xec
       ret_from_fork+0x4/0x18
      
      Fixes: 880af782
      
       ("coresight: tmc-etf: Add support for CPU-wide trace scenarios")
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarSai Prakash Ranjan <saiprakash.ranjan@codeaurora.org>
      Signed-off-by: default avatarMathieu Poirier <mathieu.poirier@linaro.org>
      Link: https://lore.kernel.org/r/20201127175256.1092685-10-mathieu.poirier@linaro.org
      
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      868663dd
  9. 28 Sep, 2020 1 commit
  10. 21 Jul, 2020 1 commit
    • Sai Prakash Ranjan's avatar
      coresight: tmc: Fix TMC mode read in tmc_read_unprepare_etb() · d021f5c5
      Sai Prakash Ranjan authored
      Reading TMC mode register without proper coresight power
      management can lead to exceptions like the one in the call
      trace below in tmc_read_unprepare_etb() when the trace data
      is read after the sink is disabled. So fix this by having
      a check for coresight sysfs mode before reading TMC mode
      management register in tmc_read_unprepare_etb() similar to
      tmc_read_prepare_etb().
      
        SError Interrupt on CPU6, code 0xbe000411 -- SError
        pstate: 80400089 (Nzcv daIf +PAN -UAO)
        pc : tmc_read_unprepare_etb+0x74/0x108
        lr : tmc_read_unprepare_etb+0x54/0x108
        sp : ffffff80d9507c30
        x29: ffffff80d9507c30 x28: ffffff80b3569a0c
        x27: 0000000000000000 x26: 00000000000a0001
        x25: ffffff80cbae9550 x24: 0000000000000010
        x23: ffffffd07296b0f0 x22: ffffffd0109ee028
        x21: 0000000000000000 x20: ffffff80d19e70e0
        x19: ffffff80d19e7080 x18: 0000000000000000
        x17: 0000000000000000 x16: 0000000000000000
        x15: 0000000000000000 x14: 0000000000000000
        x13: 0000000000000000 x12: 0000000000000000
        x11: 0000000000000000 x10: dfffffd000000001
        x9 : 0000000000000000 x8 : 0000000000000002
        x7 : ffffffd071d0fe78 x6 : 0000000000000000
        x5 : 0000000000000080 x4 : 0000000000000001
        x3 : ffffffd071d0fe98 x2 : 0000000000000000
        x1 : 0000000000000004 x0 : 0000000000000001
        Kernel panic - not syncing: Asynchronous SError Interrupt
      
      Fixes: 4525412a
      
       ("coresight: tmc: making prepare/unprepare functions generic")
      Reported-by: default avatarMike Leach <mike.leach@linaro.org>
      Signed-off-by: default avatarSai Prakash Ranjan <saiprakash.ranjan@codeaurora.org>
      Tested-by: default avatarMike Leach <mike.leach@linaro.org>
      Signed-off-by: default avatarMathieu Poirier <mathieu.poirier@linaro.org>
      Link: https://lore.kernel.org/r/20200716175746.3338735-14-mathieu.poirier@linaro.org
      
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      d021f5c5
  11. 19 May, 2020 1 commit
  12. 04 Nov, 2019 1 commit
    • Yabin Cui's avatar
      coresight: Serialize enabling/disabling a link device. · edda32da
      Yabin Cui authored
      When tracing etm data of multiple threads on multiple cpus through perf
      interface, some link devices are shared between paths of different cpus.
      It creates race conditions when different cpus wants to enable/disable
      the same link device at the same time.
      
      Example 1:
      Two cpus want to enable different ports of a coresight funnel, thus
      calling the funnel enable operation at the same time. But the funnel
      enable operation isn't reentrantable.
      
      Example 2:
      For an enabled coresight dynamic replicator with refcnt=1, one cpu wants
      to disable it, while another cpu wants to enable it. Ideally we still have
      an enabled replicator with refcnt=1 at the end. But in reality the result
      is uncertain.
      
      Since coresight devices claim themselves when enabled for self-hosted
      usage, the race conditions above usually make the link devices not usable
      after many cycles.
      
      To fix the race conditions, this patch uses spinlocks to serialize
      enabling/disabling link devices.
      
      Fixes: a06ae860
      
       ("coresight: add CoreSight core layer framework")
      Signed-off-by: default avatarYabin Cui <yabinc@google.com>
      Signed-off-by: default avatarMathieu Poirier <mathieu.poirier@linaro.org>
      Cc: stable <stable@vger.kernel.org> # 5.3
      Link: https://lore.kernel.org/r/20191104181251.26732-14-mathieu.poirier@linaro.org
      
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      edda32da
  13. 03 Sep, 2019 1 commit
  14. 03 Jul, 2019 1 commit
    • Suzuki K Poulose's avatar
      coresight: tmc-etf: Do not call smp_processor_id from preemptible · 024c1fd9
      Suzuki K Poulose authored
      During a perf session we try to allocate buffers on the "node" associated
      with the CPU the event is bound to. If it is not bound to a CPU, we
      use the current CPU node, using smp_processor_id(). However this is unsafe
      in a pre-emptible context and could generate the splats as below :
      
       BUG: using smp_processor_id() in preemptible [00000000] code: perf/2544
       caller is tmc_alloc_etf_buffer+0x5c/0x60
       CPU: 2 PID: 2544 Comm: perf Not tainted 5.1.0-rc6-147786-g116841e #344
       Hardware name: ARM LTD ARM Juno Development Platform/ARM Juno Development Platform, BIOS EDK II Feb  1 2019
       Call trace:
        dump_backtrace+0x0/0x150
        show_stack+0x14/0x20
        dump_stack+0x9c/0xc4
        debug_smp_processor_id+0x10c/0x110
        tmc_alloc_etf_buffer+0x5c/0x60
        etm_setup_aux+0x1c4/0x230
        rb_alloc_aux+0x1b8/0x2b8
        perf_mmap+0x35c/0x478
        mmap_region+0x34c/0x4f0
        do_mmap+0x2d8/0x418
        vm_mmap_pgoff+0xd0/0xf8
        ksys_mmap_pgoff+0x88/0xf8
        __arm64_sys_mmap+0x28/0x38
        el0_svc_handler+0xd8/0x138
        el0_svc+0x8/0xc
      
      Use NUMA_NO_NODE hint instead of using the current node for events
      not bound to CPUs.
      
      Fixes: 2e499bbc
      
       ("coresight: tmc: implementing TMC-ETF AUX space API")
      Cc: Mathieu Poirier <mathieu.poirier@linaro.org>
      Signed-off-by: default avatarSuzuki K Poulose <suzuki.poulose@arm.com>
      Cc: stable <stable@vger.kernel.org> # 4.7+
      Signed-off-by: default avatarMathieu Poirier <mathieu.poirier@linaro.org>
      Link: https://lore.kernel.org/r/20190620221237.3536-4-mathieu.poirier@linaro.org
      
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      024c1fd9
  15. 19 Jun, 2019 4 commits
  16. 25 Apr, 2019 6 commits
  17. 06 Dec, 2018 2 commits
    • Mathieu Poirier's avatar
      coresight: etf: Release CLAIM tag after disabling the HW · 32c58c4d
      Mathieu Poirier authored
      
      This patch rectifies the sequence of events in function
      tmc_etb_disable_hw() by disabling the HW first and then releasing the
      CLAIM tag.  Otherwise we could be corrupting the configuration done by an
      external agent that would have claimed the device after we have released
      it.
      Signed-off-by: default avatarMathieu Poirier <mathieu.poirier@linaro.org>
      Reviewed-by: default avatarSuzuki K Poulose <suzuki.poulose@arm.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      32c58c4d
    • Leo Yan's avatar
      coresight: tmc: Fix bad register address for CLAIM · 323ed1e0
      Leo Yan authored
      Commit 4d3ebd36 ("coreisght: tmc: Claim device before use") uses
      CLAIM tag to validate if the device is available, it needs to pass
      the device base address to access related registers.
      
      In the function tmc_etb_disable_hw() it wrongly passes the driver data
      pointer as register base address, thus it's easily to produce the kernel
      warning info like below:
      
      [   83.579898] WARNING: CPU: 4 PID: 2970 at drivers/hwtracing/coresight/coresight.c:207 coresight_disclaim_device_unlocked+0x44/0x80
      [   83.591448] Modules linked in:
      [   83.594485] CPU: 4 PID: 2970 Comm: uname Not tainted 4.19.0-rc6-00417-g721b509 #110
      [   83.602067] Hardware name: ARM Juno development board (r2) (DT)
      [   83.607932] pstate: 80000085 (Nzcv daIf -PAN -UAO)
      [   83.612681] pc : coresight_disclaim_device_unlocked+0x44/0x80
      [   83.618375] lr : coresight_disclaim_device_unlocked+0x44/0x80
      [   83.624064] sp : ffff00000fe3ba20
      [   83.627347] x29: ffff00000fe3ba20 x28: ffff80002d430dc0
      [   83.632618] x27: ffff800033177c00 x26: ffff80002eb44480
      [   83.637889] x25: 0000000000000001 x24: ffff800033c72600
      [   83.643160] x23: ffff0000099b11f8 x22: ffff0000099b11c8
      [   83.648430] x21: 0000000000000002 x20: ffff800033a90418
      [   83.653701] x19: ffff0000099b11c8 x18: 0000000000000000
      [   83.658971] x17: 0000000000000000 x16: 0000000000000000
      [   83.664241] x15: 0000000000000000 x14: 0000000000000000
      [   83.669511] x13: 0000000000000000 x12: 0000000000000000
      [   83.674782] x11: 0000000000000000 x10: 0000000000000000
      [   83.680052] x9 : 0000000000000000 x8 : 0000000000000001
      [   83.685322] x7 : 0000000000010000 x6 : ffff800033ebab18
      [   83.690593] x5 : ffff800033ebab18 x4 : ffff800033e6c698
      [   83.695862] x3 : 0000000000000001 x2 : 0000000000000000
      [   83.701133] x1 : 0000000000000000 x0 : 0000000000000001
      [   83.706404] Call trace:
      [   83.708830]  coresight_disclaim_device_unlocked+0x44/0x80
      [   83.714180]  coresight_disclaim_device+0x34/0x48
      [   83.718756]  tmc_disable_etf_sink+0xc4/0xf0
      [   83.722902]  coresight_disable_path_from+0xc8/0x240
      [   83.727735]  coresight_disable_path+0x24/0x30
      [   83.732053]  etm_event_stop+0x130/0x170
      [   83.735854]  etm_event_del+0x24/0x30
      [   83.739399]  event_sched_out.isra.51+0xcc/0x1e8
      [   83.743887]  group_sched_out.part.53+0x44/0xb0
      [   83.748291]  ctx_sched_out+0x298/0x2b8
      [   83.752005]  task_ctx_sched_out+0x74/0xa8
      [   83.755980]  perf_event_exit_task+0x140/0x418
      [   83.760298]  do_exit+0x3f4/0xcf0
      [   83.763497]  do_group_exit+0x5c/0xc0
      [   83.767041]  __arm64_sys_exit_group+0x24/0x28
      [   83.771359]  el0_svc_common+0x110/0x178
      [   83.775160]  el0_svc_handler+0x94/0xe8
      [   83.778875]  el0_svc+0x8/0xc
      [   83.781728] ---[ end trace 02d8d8eac46db9e5 ]---
      
      This patch is to fix this bug by using 'drvdata->base' as the
      register base address for CLAIM related operation.
      
      Fixes: 4d3ebd36
      
       ("coreisght: tmc: Claim device before use")
      Cc: Suzuki Poulose <suzuki.poulose@arm.com>
      Cc: Mathieu Poirier <mathieu.poirier@linaro.org>
      Cc: Mike Leach <mike.leach@linaro.org>
      Cc: Robert Walker <robert.walker@arm.com>
      Signed-off-by: default avatarLeo Yan <leo.yan@linaro.org>
      Reviewed-by: default avatarSuzuki K Poulose <suzuki.poulose@arm.com>
      Signed-off-by: default avatarMathieu Poirier <mathieu.poirier@linaro.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      323ed1e0
  18. 25 Sep, 2018 7 commits
  19. 15 Jul, 2018 2 commits