From 0ae8d798c82777c30aa48ab310fe21cbb8f2be4c Mon Sep 17 00:00:00 2001 From: Andy Shevchenko Date: Mon, 14 Jun 2021 11:58:56 -0600 Subject: coresight: core: Switch to krealloc_array() Let the krealloc_array() check for multiplication overflow. Link: https://lore.kernel.org/r/20210520135041.56163-1-andriy.shevchenko@linux.intel.com Signed-off-by: Andy Shevchenko Signed-off-by: Mathieu Poirier Link: https://lore.kernel.org/r/20210614175901.532683-2-mathieu.poirier@linaro.org Signed-off-by: Greg Kroah-Hartman --- drivers/hwtracing/coresight/coresight-core.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'drivers/hwtracing') diff --git a/drivers/hwtracing/coresight/coresight-core.c b/drivers/hwtracing/coresight/coresight-core.c index 6c68d34d956e..a7971c68b0be 100644 --- a/drivers/hwtracing/coresight/coresight-core.c +++ b/drivers/hwtracing/coresight/coresight-core.c @@ -1730,9 +1730,9 @@ char *coresight_alloc_device_name(struct coresight_dev_list *dict, if (idx < 0) { /* Make space for the new entry */ idx = dict->nr_idx; - list = krealloc(dict->fwnode_list, - (idx + 1) * sizeof(*dict->fwnode_list), - GFP_KERNEL); + list = krealloc_array(dict->fwnode_list, + idx + 1, sizeof(*dict->fwnode_list), + GFP_KERNEL); if (ZERO_OR_NULL_PTR(list)) { idx = -ENOMEM; goto done; -- cgit v1.2.3 From d777a8991847729ec4e2a13fcad58c2b00bb19dc Mon Sep 17 00:00:00 2001 From: Junhao He Date: Mon, 14 Jun 2021 11:58:57 -0600 Subject: coresight: core: Fix use of uninitialized pointer Currently the pointer "sink" might be checked before initialized. Fix this by initializing this pointer. Link: https://lore.kernel.org/r/1620912469-52222-2-git-send-email-liuqi115@huawei.com Fixes: 6d578258b955 ("coresight: Make sysfs functional on topologies with per core sink") Signed-off-by: Junhao He Signed-off-by: Qi Liu Signed-off-by: Suzuki K Poulose Signed-off-by: Mathieu Poirier Link: https://lore.kernel.org/r/20210614175901.532683-3-mathieu.poirier@linaro.org Signed-off-by: Greg Kroah-Hartman --- drivers/hwtracing/coresight/coresight-core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'drivers/hwtracing') diff --git a/drivers/hwtracing/coresight/coresight-core.c b/drivers/hwtracing/coresight/coresight-core.c index a7971c68b0be..20ea4aa619f0 100644 --- a/drivers/hwtracing/coresight/coresight-core.c +++ b/drivers/hwtracing/coresight/coresight-core.c @@ -608,7 +608,7 @@ static struct coresight_device * coresight_find_enabled_sink(struct coresight_device *csdev) { int i; - struct coresight_device *sink; + struct coresight_device *sink = NULL; if ((csdev->type == CORESIGHT_DEV_TYPE_SINK || csdev->type == CORESIGHT_DEV_TYPE_LINKSINK) && -- cgit v1.2.3 From e12f6b5593e48065347a4213ad8ec3981c248fba Mon Sep 17 00:00:00 2001 From: Junhao He Date: Mon, 14 Jun 2021 11:58:58 -0600 Subject: coresight: core: Remove unnecessary assignment Remove unnecessary assignment of "path" in coresight_release_path(). Link: https://lore.kernel.org/r/1620912469-52222-3-git-send-email-liuqi115@huawei.com Signed-off-by: Junhao He Signed-off-by: Qi Liu Signed-off-by: Suzuki K Poulose Signed-off-by: Mathieu Poirier Link: https://lore.kernel.org/r/20210614175901.532683-4-mathieu.poirier@linaro.org Signed-off-by: Greg Kroah-Hartman --- drivers/hwtracing/coresight/coresight-core.c | 1 - 1 file changed, 1 deletion(-) (limited to 'drivers/hwtracing') diff --git a/drivers/hwtracing/coresight/coresight-core.c b/drivers/hwtracing/coresight/coresight-core.c index 20ea4aa619f0..3cb8680c5828 100644 --- a/drivers/hwtracing/coresight/coresight-core.c +++ b/drivers/hwtracing/coresight/coresight-core.c @@ -886,7 +886,6 @@ void coresight_release_path(struct list_head *path) } kfree(path); - path = NULL; } /* return true if the device is a suitable type for a default sink */ -- cgit v1.2.3 From af36b6859a2ef0af516c5b9118580d1598070942 Mon Sep 17 00:00:00 2001 From: Junhao He Date: Mon, 14 Jun 2021 11:58:59 -0600 Subject: coresight: etm4x: core: Remove redundant check of attr "attr" is checked by perf framework, so remove the redundant check in etm4_parse_event_config(). Link: https://lore.kernel.org/r/1620912469-52222-4-git-send-email-liuqi115@huawei.com Signed-off-by: Junhao He Signed-off-by: Qi Liu Signed-off-by: Suzuki K Poulose Signed-off-by: Mathieu Poirier Link: https://lore.kernel.org/r/20210614175901.532683-5-mathieu.poirier@linaro.org Signed-off-by: Greg Kroah-Hartman --- drivers/hwtracing/coresight/coresight-etm4x-core.c | 5 ----- 1 file changed, 5 deletions(-) (limited to 'drivers/hwtracing') diff --git a/drivers/hwtracing/coresight/coresight-etm4x-core.c b/drivers/hwtracing/coresight/coresight-etm4x-core.c index db881993c211..da27cd4a3c38 100644 --- a/drivers/hwtracing/coresight/coresight-etm4x-core.c +++ b/drivers/hwtracing/coresight/coresight-etm4x-core.c @@ -568,11 +568,6 @@ static int etm4_parse_event_config(struct etmv4_drvdata *drvdata, struct etmv4_config *config = &drvdata->config; struct perf_event_attr *attr = &event->attr; - if (!attr) { - ret = -EINVAL; - goto out; - } - /* Clear configuration from previous run */ memset(config, 0, sizeof(struct etmv4_config)); -- cgit v1.2.3 From 5fae8a946ac2df879caf3f79a193d4766d00239b Mon Sep 17 00:00:00 2001 From: Sai Prakash Ranjan Date: Mon, 14 Jun 2021 11:59:00 -0600 Subject: coresight: tmc-etf: Fix global-out-of-bounds in tmc_update_etf_buffer() commit 6f755e85c332 ("coresight: Add helper for inserting synchronization packets") removed trailing '\0' from barrier_pkt array and updated the call sites like etb_update_buffer() to have proper checks for barrier_pkt size before read but missed updating tmc_update_etf_buffer() which still reads barrier_pkt past the array size resulting in KASAN out-of-bounds bug. Fix this by adding a check for barrier_pkt size before accessing like it is done in etb_update_buffer(). BUG: KASAN: global-out-of-bounds in tmc_update_etf_buffer+0x4b8/0x698 Read of size 4 at addr ffffffd05b7d1030 by task perf/2629 Call trace: dump_backtrace+0x0/0x27c show_stack+0x20/0x2c dump_stack+0x11c/0x188 print_address_description+0x3c/0x4a4 __kasan_report+0x140/0x164 kasan_report+0x10/0x18 __asan_report_load4_noabort+0x1c/0x24 tmc_update_etf_buffer+0x4b8/0x698 etm_event_stop+0x248/0x2d8 etm_event_del+0x20/0x2c event_sched_out+0x214/0x6f0 group_sched_out+0xd0/0x270 ctx_sched_out+0x2ec/0x518 __perf_event_task_sched_out+0x4fc/0xe6c __schedule+0x1094/0x16a0 preempt_schedule_irq+0x88/0x170 arm64_preempt_schedule_irq+0xf0/0x18c el1_irq+0xe8/0x180 perf_event_exec+0x4d8/0x56c setup_new_exec+0x204/0x400 load_elf_binary+0x72c/0x18c0 search_binary_handler+0x13c/0x420 load_script+0x500/0x6c4 search_binary_handler+0x13c/0x420 exec_binprm+0x118/0x654 __do_execve_file+0x77c/0xba4 __arm64_compat_sys_execve+0x98/0xac el0_svc_common+0x1f8/0x5e0 el0_svc_compat_handler+0x84/0xb0 el0_svc_compat+0x10/0x50 The buggy address belongs to the variable: barrier_pkt+0x10/0x40 Memory state around the buggy address: ffffffd05b7d0f00: fa fa fa fa 04 fa fa fa fa fa fa fa 00 00 00 00 ffffffd05b7d0f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffffffd05b7d1000: 00 00 00 00 00 00 fa fa fa fa fa fa 00 00 00 03 ^ ffffffd05b7d1080: fa fa fa fa 00 02 fa fa fa fa fa fa 03 fa fa fa ffffffd05b7d1100: fa fa fa fa 00 00 00 00 05 fa fa fa fa fa fa fa ================================================================== Link: https://lore.kernel.org/r/20210505093430.18445-1-saiprakash.ranjan@codeaurora.org Fixes: 0c3fc4d5fa26 ("coresight: Add barrier packet for synchronisation") Cc: stable@vger.kernel.org Signed-off-by: Sai Prakash Ranjan Signed-off-by: Suzuki K Poulose Signed-off-by: Mathieu Poirier Link: https://lore.kernel.org/r/20210614175901.532683-6-mathieu.poirier@linaro.org Signed-off-by: Greg Kroah-Hartman --- drivers/hwtracing/coresight/coresight-tmc-etf.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'drivers/hwtracing') diff --git a/drivers/hwtracing/coresight/coresight-tmc-etf.c b/drivers/hwtracing/coresight/coresight-tmc-etf.c index 45b85edfc690..cd0fb7bfba68 100644 --- a/drivers/hwtracing/coresight/coresight-tmc-etf.c +++ b/drivers/hwtracing/coresight/coresight-tmc-etf.c @@ -530,7 +530,7 @@ static unsigned long tmc_update_etf_buffer(struct coresight_device *csdev, buf_ptr = buf->data_pages[cur] + offset; *buf_ptr = readl_relaxed(drvdata->base + TMC_RRD); - if (lost && *barrier) { + if (lost && i < CORESIGHT_BARRIER_PKT_SIZE) { *buf_ptr = *barrier; barrier++; } -- cgit v1.2.3 From 51dd19a7e9f8fbbb7cd92b8a357091911eae7f78 Mon Sep 17 00:00:00 2001 From: Jeremy Linton Date: Mon, 14 Jun 2021 11:59:01 -0600 Subject: coresight: Propagate symlink failure If the symlink is unable to be created, the driver goes ahead and continues device creation. Instead lets propagate the failure, and fail the probe. Link: https://lore.kernel.org/r/20210526204042.2681700-1-jeremy.linton@arm.com Fixes: 8a7365c2d418 ("coresight: Expose device connections via sysfs") Cc: stable@vger.kernel.org Signed-off-by: Jeremy Linton Signed-off-by: Mathieu Poirier Link: https://lore.kernel.org/r/20210614175901.532683-7-mathieu.poirier@linaro.org Signed-off-by: Greg Kroah-Hartman --- drivers/hwtracing/coresight/coresight-core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'drivers/hwtracing') diff --git a/drivers/hwtracing/coresight/coresight-core.c b/drivers/hwtracing/coresight/coresight-core.c index 3cb8680c5828..1002605db8ba 100644 --- a/drivers/hwtracing/coresight/coresight-core.c +++ b/drivers/hwtracing/coresight/coresight-core.c @@ -1391,7 +1391,7 @@ static int coresight_fixup_device_conns(struct coresight_device *csdev) } } - return 0; + return ret; } static int coresight_remove_match(struct device *dev, void *data) -- cgit v1.2.3 From ae128916fb87a91ae41bec0461330e8a81500d84 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Uwe=20Kleine-K=C3=B6nig?= Date: Mon, 21 Jun 2021 18:12:44 +0300 Subject: intel_th: Remove an unused exit point from intel_th_remove() MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit As described in the added comment device_for_each_child() never returns a non-zero value. So remove the corresponding error check. This simplifies the quest to make struct bus_type::remove() return void. Reviewed-by: Andy Shevchenko Signed-off-by: Uwe Kleine-König Signed-off-by: Alexander Shishkin Link: https://lore.kernel.org/r/20210621151246.31891-3-alexander.shishkin@linux.intel.com Signed-off-by: Greg Kroah-Hartman --- drivers/hwtracing/intel_th/core.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) (limited to 'drivers/hwtracing') diff --git a/drivers/hwtracing/intel_th/core.c b/drivers/hwtracing/intel_th/core.c index 24d0c974bfd5..4bf025ef2031 100644 --- a/drivers/hwtracing/intel_th/core.c +++ b/drivers/hwtracing/intel_th/core.c @@ -100,16 +100,18 @@ static int intel_th_remove(struct device *dev) struct intel_th_driver *thdrv = to_intel_th_driver(dev->driver); struct intel_th_device *thdev = to_intel_th_device(dev); struct intel_th_device *hub = to_intel_th_hub(thdev); - int err; if (thdev->type == INTEL_TH_SWITCH) { struct intel_th *th = to_intel_th(hub); int i, lowest; - /* disconnect outputs */ - err = device_for_each_child(dev, thdev, intel_th_child_remove); - if (err) - return err; + /* + * disconnect outputs + * + * intel_th_child_remove returns 0 unconditionally, so there is + * no need to check the return value of device_for_each_child. + */ + device_for_each_child(dev, thdev, intel_th_child_remove); /* * Remove outputs, that is, hub's children: they are created -- cgit v1.2.3 From 02ca71effb96595fb7e0a17df1aaedc5d2e30747 Mon Sep 17 00:00:00 2001 From: Alexander Shishkin Date: Mon, 21 Jun 2021 18:12:45 +0300 Subject: intel_th: msu: Make contiguous buffers uncached We already keep the multiblock mode buffers uncached, but forget the single mode. Address this. Reviewed-by: Andy Shevchenko Signed-off-by: Alexander Shishkin Link: https://lore.kernel.org/r/20210621151246.31891-4-alexander.shishkin@linux.intel.com Signed-off-by: Greg Kroah-Hartman --- drivers/hwtracing/intel_th/msu.c | 48 ++++++++++++++++++++++++++-------------- 1 file changed, 32 insertions(+), 16 deletions(-) (limited to 'drivers/hwtracing') diff --git a/drivers/hwtracing/intel_th/msu.c b/drivers/hwtracing/intel_th/msu.c index 2edc4666633d..432ade0842f6 100644 --- a/drivers/hwtracing/intel_th/msu.c +++ b/drivers/hwtracing/intel_th/msu.c @@ -1024,33 +1024,49 @@ err_nomem: } #ifdef CONFIG_X86 -static void msc_buffer_set_uc(struct msc_window *win, unsigned int nr_segs) +static void msc_buffer_set_uc(struct msc *msc) { struct scatterlist *sg_ptr; + struct msc_window *win; int i; - for_each_sg(win->sgt->sgl, sg_ptr, nr_segs, i) { - /* Set the page as uncached */ - set_memory_uc((unsigned long)sg_virt(sg_ptr), - PFN_DOWN(sg_ptr->length)); + if (msc->mode == MSC_MODE_SINGLE) { + set_memory_uc((unsigned long)msc->base, msc->nr_pages); + return; + } + + list_for_each_entry(win, &msc->win_list, entry) { + for_each_sg(win->sgt->sgl, sg_ptr, win->nr_segs, i) { + /* Set the page as uncached */ + set_memory_uc((unsigned long)sg_virt(sg_ptr), + PFN_DOWN(sg_ptr->length)); + } } } -static void msc_buffer_set_wb(struct msc_window *win) +static void msc_buffer_set_wb(struct msc *msc) { struct scatterlist *sg_ptr; + struct msc_window *win; int i; - for_each_sg(win->sgt->sgl, sg_ptr, win->nr_segs, i) { - /* Reset the page to write-back */ - set_memory_wb((unsigned long)sg_virt(sg_ptr), - PFN_DOWN(sg_ptr->length)); + if (msc->mode == MSC_MODE_SINGLE) { + set_memory_wb((unsigned long)msc->base, msc->nr_pages); + return; + } + + list_for_each_entry(win, &msc->win_list, entry) { + for_each_sg(win->sgt->sgl, sg_ptr, win->nr_segs, i) { + /* Reset the page to write-back */ + set_memory_wb((unsigned long)sg_virt(sg_ptr), + PFN_DOWN(sg_ptr->length)); + } } } #else /* !X86 */ static inline void -msc_buffer_set_uc(struct msc_window *win, unsigned int nr_segs) {} -static inline void msc_buffer_set_wb(struct msc_window *win) {} +msc_buffer_set_uc(struct msc *msc) {} +static inline void msc_buffer_set_wb(struct msc *msc) {} #endif /* CONFIG_X86 */ /** @@ -1097,8 +1113,6 @@ static int msc_buffer_win_alloc(struct msc *msc, unsigned int nr_blocks) if (ret <= 0) goto err_nomem; - msc_buffer_set_uc(win, ret); - win->nr_segs = ret; win->nr_blocks = nr_blocks; @@ -1152,8 +1166,6 @@ static void msc_buffer_win_free(struct msc *msc, struct msc_window *win) msc->base_addr = 0; } - msc_buffer_set_wb(win); - if (msc->mbuf && msc->mbuf->free_window) msc->mbuf->free_window(msc->mbuf_priv, win->sgt); else @@ -1260,6 +1272,8 @@ static int msc_buffer_multi_alloc(struct msc *msc, unsigned long *nr_pages, */ static void msc_buffer_free(struct msc *msc) { + msc_buffer_set_wb(msc); + if (msc->mode == MSC_MODE_SINGLE) msc_buffer_contig_free(msc); else if (msc->mode == MSC_MODE_MULTI) @@ -1303,6 +1317,8 @@ static int msc_buffer_alloc(struct msc *msc, unsigned long *nr_pages, } if (!ret) { + msc_buffer_set_uc(msc); + /* allocation should be visible before the counter goes to 0 */ smp_mb__before_atomic(); -- cgit v1.2.3 From ab1afed701d2db7eb35c1a2526a29067a38e93d1 Mon Sep 17 00:00:00 2001 From: Alexander Shishkin Date: Mon, 21 Jun 2021 18:12:46 +0300 Subject: intel_th: Wait until port is in reset before programming it Some devices don't drain their pipelines if we don't make sure that the corresponding output port is in reset before programming it for a new trace capture, resulting in bits of old trace appearing in the new trace capture. Fix that by explicitly making sure the reset is asserted before programming new trace capture. Reviewed-by: Andy Shevchenko Signed-off-by: Alexander Shishkin Link: https://lore.kernel.org/r/20210621151246.31891-5-alexander.shishkin@linux.intel.com Signed-off-by: Greg Kroah-Hartman --- drivers/hwtracing/intel_th/core.c | 17 +++++++++++++++++ drivers/hwtracing/intel_th/gth.c | 16 ++++++++++++++++ drivers/hwtracing/intel_th/intel_th.h | 3 +++ 3 files changed, 36 insertions(+) (limited to 'drivers/hwtracing') diff --git a/drivers/hwtracing/intel_th/core.c b/drivers/hwtracing/intel_th/core.c index 4bf025ef2031..66eed2dff818 100644 --- a/drivers/hwtracing/intel_th/core.c +++ b/drivers/hwtracing/intel_th/core.c @@ -217,6 +217,22 @@ static ssize_t port_show(struct device *dev, struct device_attribute *attr, static DEVICE_ATTR_RO(port); +static void intel_th_trace_prepare(struct intel_th_device *thdev) +{ + struct intel_th_device *hub = to_intel_th_hub(thdev); + struct intel_th_driver *hubdrv = to_intel_th_driver(hub->dev.driver); + + if (hub->type != INTEL_TH_SWITCH) + return; + + if (thdev->type != INTEL_TH_OUTPUT) + return; + + pm_runtime_get_sync(&thdev->dev); + hubdrv->prepare(hub, &thdev->output); + pm_runtime_put(&thdev->dev); +} + static int intel_th_output_activate(struct intel_th_device *thdev) { struct intel_th_driver *thdrv = @@ -237,6 +253,7 @@ static int intel_th_output_activate(struct intel_th_device *thdev) if (ret) goto fail_put; + intel_th_trace_prepare(thdev); if (thdrv->activate) ret = thdrv->activate(thdev); else diff --git a/drivers/hwtracing/intel_th/gth.c b/drivers/hwtracing/intel_th/gth.c index 28509b02a0b5..b3308934a687 100644 --- a/drivers/hwtracing/intel_th/gth.c +++ b/drivers/hwtracing/intel_th/gth.c @@ -564,6 +564,21 @@ static void gth_tscu_resync(struct gth_device *gth) iowrite32(reg, gth->base + REG_TSCU_TSUCTRL); } +static void intel_th_gth_prepare(struct intel_th_device *thdev, + struct intel_th_output *output) +{ + struct gth_device *gth = dev_get_drvdata(&thdev->dev); + int count; + + /* + * Wait until the output port is in reset before we start + * programming it. + */ + for (count = GTH_PLE_WAITLOOP_DEPTH; + count && !(gth_output_get(gth, output->port) & BIT(5)); count--) + cpu_relax(); +} + /** * intel_th_gth_enable() - enable tracing to an output device * @thdev: GTH device @@ -815,6 +830,7 @@ static struct intel_th_driver intel_th_gth_driver = { .assign = intel_th_gth_assign, .unassign = intel_th_gth_unassign, .set_output = intel_th_gth_set_output, + .prepare = intel_th_gth_prepare, .enable = intel_th_gth_enable, .trig_switch = intel_th_gth_switch, .disable = intel_th_gth_disable, diff --git a/drivers/hwtracing/intel_th/intel_th.h b/drivers/hwtracing/intel_th/intel_th.h index 89c67e0e1d34..0ffb42990175 100644 --- a/drivers/hwtracing/intel_th/intel_th.h +++ b/drivers/hwtracing/intel_th/intel_th.h @@ -143,6 +143,7 @@ intel_th_output_assigned(struct intel_th_device *thdev) * @remove: remove method * @assign: match a given output type device against available outputs * @unassign: deassociate an output type device from an output port + * @prepare: prepare output port for tracing * @enable: enable tracing for a given output device * @disable: disable tracing for a given output device * @irq: interrupt callback @@ -164,6 +165,8 @@ struct intel_th_driver { struct intel_th_device *othdev); void (*unassign)(struct intel_th_device *thdev, struct intel_th_device *othdev); + void (*prepare)(struct intel_th_device *thdev, + struct intel_th_output *output); void (*enable)(struct intel_th_device *thdev, struct intel_th_output *output); void (*trig_switch)(struct intel_th_device *thdev, -- cgit v1.2.3