13 Jan, 2019

1 commit

  • commit ec5b5ad6e272d8d6b92d1007f79574919862a2d2 upstream.

    The 'nr_pages' attribute of the 'msc' subdevices parses a comma-separated
    list of window sizes, passed from userspace. However, there is a bug in
    the string parsing logic wherein it doesn't exclude the comma character
    from the range of characters as it consumes them. This leads to an
    out-of-bounds access given a sufficiently long list. For example:

    > # echo 8,8,8,8 > /sys/bus/intel_th/devices/0-msc0/nr_pages
    > ==================================================================
    > BUG: KASAN: slab-out-of-bounds in memchr+0x1e/0x40
    > Read of size 1 at addr ffff8803ffcebcd1 by task sh/825
    >
    > CPU: 3 PID: 825 Comm: npktest.sh Tainted: G W 4.20.0-rc1+
    > Call Trace:
    > dump_stack+0x7c/0xc0
    > print_address_description+0x6c/0x23c
    > ? memchr+0x1e/0x40
    > kasan_report.cold.5+0x241/0x308
    > memchr+0x1e/0x40
    > nr_pages_store+0x203/0xd00 [intel_th_msu]

    Fix this by accounting for the comma character.

    Signed-off-by: Alexander Shishkin
    Fixes: ba82664c134ef ("intel_th: Add Memory Storage Unit driver")
    Cc: stable@vger.kernel.org # v4.4+
    Signed-off-by: Greg Kroah-Hartman

    Alexander Shishkin
     

14 Nov, 2018

1 commit

  • [ Upstream commit 987d1e8dcd370d96029a3d76a0031b043c4a69ae ]

    If the ETB is already enabled in sysfs mode, the ETB reports
    success even if a perf mode is requested. Fix this by checking
    the requested mode.

    Cc: Mathieu Poirier
    Signed-off-by: Suzuki K Poulose
    Signed-off-by: Mathieu Poirier
    Signed-off-by: Greg Kroah-Hartman
    Signed-off-by: Sasha Levin
    Signed-off-by: Greg Kroah-Hartman

    Suzuki K Poulose
     

20 Oct, 2018

1 commit


04 Oct, 2018

1 commit

  • commit 8801922cd94c918e4dc3a108ecaa500c4d40583f upstream.

    Commit a753bfcfdb1f ("intel_th: Make the switch allocate its subdevices")
    brings in new subdevice addition/removal logic that's broken for "host
    mode": the SWITCH device has no children to begin with, which is not
    handled in the code. This results in a null dereference bug later down
    the path.

    This patch fixes the subdevice removal code to handle host mode correctly.

    Signed-off-by: Alexander Shishkin
    Fixes: a753bfcfdb1f ("intel_th: Make the switch allocate its subdevices")
    CC: stable@vger.kernel.org # v4.14+
    Signed-off-by: Greg Kroah-Hartman

    Alexander Shishkin
     

26 Sep, 2018

3 commits

  • [ Upstream commit 5cedd22370a0a460b663c06de1fc10b4ba3c5d0b ]

    Add ETM PIDs of the Arm cortex-A CPUs to the white list of ETMs.
    While at it add a helper macro to make it easier to add the new
    entries.

    Cc: Mathieu Poirier
    Signed-off-by: Suzuki K Poulose
    Signed-off-by: Mathieu Poirier
    Signed-off-by: Greg Kroah-Hartman
    Signed-off-by: Sasha Levin
    Signed-off-by: Greg Kroah-Hartman

    Suzuki K Poulose
     
  • [ Upstream commit ccff2dfaceaca4517432f5c149594215fe9098cc ]

    Probing the TPIU driver under UBSan triggers an out-of-bounds shift
    warning in coresight_timeout():

    ...
    [ 5.677530] UBSAN: Undefined behaviour in drivers/hwtracing/coresight/coresight.c:929:16
    [ 5.685542] shift exponent 64 is too large for 64-bit type 'long unsigned int'
    ...

    On closer inspection things are exponentially out of whack because we're
    passing a bitmask where a bit number should be. Amusingly, it seems that
    both calls will find their expected values by sheer luck and appear to
    succeed: 1 << FFCR_FON_MAN ends up at bit 64 which whilst undefined
    evaluates as zero in practice, while 1 << FFSR_FT_STOPPED finds bit 2
    (TCPresent) which apparently is usually tied high.

    Following the examples of other drivers, define separate FOO and FOO_BIT
    macros for masks vs. indices, and put things right.

    CC: Robert Walker
    CC: Mike Leach
    CC: Mathieu Poirier
    Fixes: 11595db8e17f ("coresight: Fix disabling of CoreSight TPIU")
    Signed-off-by: Robin Murphy
    Signed-off-by: Mathieu Poirier
    Signed-off-by: Greg Kroah-Hartman
    Signed-off-by: Sasha Levin
    Signed-off-by: Greg Kroah-Hartman

    Robin Murphy
     
  • [ Upstream commit fe470f5f7f684ed15bc49b6183a64237547910ff ]

    If we fail to find the input / output port for a LINK component
    while enabling a path, we should fail gracefully rather than
    assuming port "0".

    Cc: Mathieu Poirier
    Signed-off-by: Suzuki K Poulose
    Signed-off-by: Mathieu Poirier
    Signed-off-by: Greg Kroah-Hartman
    Signed-off-by: Sasha Levin
    Signed-off-by: Greg Kroah-Hartman

    Suzuki K Poulose
     

05 Jun, 2018

3 commits

  • commit 0ed2424b911f3a058dfea01b78817abed767433d upstream.

    Commit d5c435df4a890 ("intel_th: msu: Use the real device in case of IOMMU
    domain allocation") changes dma buffer allocation to use the actual
    underlying device, but forgets to change the deallocation path, which leads
    to (if you've got CAP_SYS_RAWIO):

    > # echo 0,0 > /sys/bus/intel_th/devices/0-msc0/nr_pages
    > ------------[ cut here ]------------
    > kernel BUG at ../linux/drivers/iommu/intel-iommu.c:3670!
    > CPU: 3 PID: 231 Comm: sh Not tainted 4.17.0-rc1+ #2729
    > RIP: 0010:intel_unmap+0x11e/0x130
    ...
    > Call Trace:
    > intel_free_coherent+0x3e/0x60
    > msc_buffer_win_free+0x100/0x160 [intel_th_msu]

    This patch fixes the buffer deallocation code to use the correct device.

    Signed-off-by: Alexander Shishkin
    Fixes: d5c435df4a890 ("intel_th: msu: Use the real device in case of IOMMU domain allocation")
    Reported-by: Baofeng Tian
    CC: stable@vger.kernel.org # v4.14+
    Signed-off-by: Greg Kroah-Hartman

    Alexander Shishkin
     
  • commit 806e30873f0e74d9d41b0ef761bd4d3e55c7d510 upstream.

    Commit b5e2ced9bf81 ("stm class: Use vmalloc for the master map") caused
    a build error on some arches as vmalloc.h was not explicitly included.

    Fix that by adding it to the list of includes.

    Fixes: b5e2ced9bf81 ("stm class: Use vmalloc for the master map")
    Reported-by: kbuild test robot
    Cc: Alexander Shishkin
    Signed-off-by: Greg Kroah-Hartman

    Greg Kroah-Hartman
     
  • commit b5e2ced9bf81393034072dd4d372f6b430bc1f0a upstream.

    Fengguang is running into a warning from the buddy allocator:

    > swapper/0: page allocation failure: order:9, mode:0x14040c0(GFP_KERNEL|__GFP_COMP), nodemask=(null)
    > CPU: 1 PID: 1 Comm: swapper/0 Not tainted 4.17.0-rc1 #262
    > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1 04/01/2014
    > Call Trace:
    ...
    > __kmalloc+0x14b/0x180: ____cache_alloc at mm/slab.c:3127
    > stm_register_device+0xf3/0x5c0: stm_register_device at drivers/hwtracing/stm/core.c:695
    ...

    Which is basically a result of the stm class trying to allocate ~512kB
    for the dummy_stm with its default parameters. There's no reason, however,
    for it not to be vmalloc()ed instead, which is what this patch does.

    Reported-by: Fengguang Wu
    Signed-off-by: Alexander Shishkin
    CC: stable@vger.kernel.org # v4.4+
    Signed-off-by: Greg Kroah-Hartman

    Alexander Shishkin
     

30 May, 2018

2 commits

  • [ Upstream commit 831c326fcd0e8e2a6ece952f898a1ec9b1dc1004 ]

    Commit ad67b74d2469 ("printk: hash addresses printed with %p") lets
    printk specifier %p to hash all addresses before printing, this was
    resulting in the high 32 bits of pcsr can only output zeros. So
    module cannot completely print pc value and it's pointless for debugging
    purpose.

    This patch fixes this by using %px to print pcsr instead.

    Cc: Mathieu Poirier
    Signed-off-by: Leo Yan
    Signed-off-by: Mathieu Poirier
    Signed-off-by: Sasha Levin
    Signed-off-by: Greg Kroah-Hartman

    Leo Yan
     
  • [ Upstream commit 9ad577087165478c9d9be82b15ed9bf2db5835f5 ]

    Since commit 8edc514b01e9 ("intel_th: Make SOURCE devices children of the
    root device") the hub is not the parent of SOURCE devices any more, so the
    new helper function should be used for that instead of always using the
    parent. The intel_th_set_output() path, however, still uses the old
    logic, leading to the hub driver structure being aliased with something
    else, like struct pci_driver or struct acpi_driver, and an incorrect call
    to an address inferred from that, potentially resulting in a crash.

    Fixes: 8edc514b01e9 ("intel_th: Make SOURCE devices children of the root device")
    Signed-off-by: Alexander Shishkin
    Signed-off-by: Sasha Levin
    Signed-off-by: Greg Kroah-Hartman

    Alexander Shishkin
     

24 Mar, 2018

1 commit

  • [ Upstream commit 11595db8e17faaa05fadc25746c870e31276962f ]

    The CoreSight TPIU should be disabled when tracing to other sinks to allow
    them to operate at full bandwidth.

    This patch fixes tpiu_disable_hw() to correctly disable the TPIU by
    configuring the TPIU to stop on flush, initiating a manual flush, waiting
    for the flush to complete and then waits for the TPIU to indicate it has
    stopped.

    Signed-off-by: Robert Walker
    Tested-by: Mike Leach
    Signed-off-by: Mathieu Poirier
    Signed-off-by: Greg Kroah-Hartman
    Signed-off-by: Sasha Levin
    Signed-off-by: Greg Kroah-Hartman

    Robert Walker
     

02 Nov, 2017

1 commit

  • Many source files in the tree are missing licensing information, which
    makes it harder for compliance tools to determine the correct license.

    By default all files without license information are under the default
    license of the kernel, which is GPL version 2.

    Update the files which contain no license information with the 'GPL-2.0'
    SPDX license identifier. The SPDX identifier is a legally binding
    shorthand, which can be used instead of the full boiler plate text.

    This patch is based on work done by Thomas Gleixner and Kate Stewart and
    Philippe Ombredanne.

    How this work was done:

    Patches were generated and checked against linux-4.14-rc6 for a subset of
    the use cases:
    - file had no licensing information it it.
    - file was a */uapi/* one with no licensing information in it,
    - file was a */uapi/* one with existing licensing information,

    Further patches will be generated in subsequent months to fix up cases
    where non-standard license headers were used, and references to license
    had to be inferred by heuristics based on keywords.

    The analysis to determine which SPDX License Identifier to be applied to
    a file was done in a spreadsheet of side by side results from of the
    output of two independent scanners (ScanCode & Windriver) producing SPDX
    tag:value files created by Philippe Ombredanne. Philippe prepared the
    base worksheet, and did an initial spot review of a few 1000 files.

    The 4.13 kernel was the starting point of the analysis with 60,537 files
    assessed. Kate Stewart did a file by file comparison of the scanner
    results in the spreadsheet to determine which SPDX license identifier(s)
    to be applied to the file. She confirmed any determination that was not
    immediately clear with lawyers working with the Linux Foundation.

    Criteria used to select files for SPDX license identifier tagging was:
    - Files considered eligible had to be source code files.
    - Make and config files were included as candidates if they contained >5
    lines of source
    - File already had some variant of a license header in it (even if
    Reviewed-by: Philippe Ombredanne
    Reviewed-by: Thomas Gleixner
    Signed-off-by: Greg Kroah-Hartman

    Greg Kroah-Hartman
     

22 Sep, 2017

3 commits

  • This adds Intel(R) Trace Hub PCI ID for Lewisburg PCH.

    Signed-off-by: Alexander Shishkin
    Cc: stable@vger.kernel.org
    Signed-off-by: Greg Kroah-Hartman

    Alexander Shishkin
     
  • This adds Intel(R) Trace Hub PCI ID for Cedar Fork PCH.

    Signed-off-by: Alexander Shishkin
    Cc: stable@vger.kernel.org
    Signed-off-by: Greg Kroah-Hartman

    Alexander Shishkin
     
  • For reasons unknown, the stm_source removal path uses device_destroy()
    to kill the underlying device object. Because device_destroy() uses
    devt to look for the device to destroy and the fact that stm_source
    devices don't have one (or all have the same one), it just picks the
    first device in the class, which may well be the wrong one.

    That is, loading stm_console and stm_heartbeat and then removing both
    will die in dereferencing a freed object.

    Since this should have been device_unregister() in the first place,
    use it instead of device_destroy().

    Signed-off-by: Alexander Shishkin
    Fixes: 7bd1d4093c2 ("stm class: Introduce an abstraction for System Trace Module devices")
    Cc: stable@vger.kernel.org
    Signed-off-by: Greg Kroah-Hartman

    Alexander Shishkin
     

28 Aug, 2017

23 commits

  • …it/ash/stm into char-misc-next

    Alexander writes:

    stm class / intel_th: Updates for 4.14

    Intel TH:
    * Updated subdevice management code to better fit host mode
    * Added support for Low Power Path (LPP) output type
    * Fixed memory allocation with IOMMU enabled (DMAR tables)
    * Added Cannon Lake PCH PCI IDs
    * Added a quirk to force time sync on devices that need it

    STM:
    * Fixed potential read overflow in ioctl()
    * Documented stm_ftrace source.

    Greg Kroah-Hartman
     
  • amba_id are not supposed to change at runtime. All functions
    working with const amba_id. So mark the non-const structs as const.

    Signed-off-by: Arvind Yadav
    Signed-off-by: Greg Kroah-Hartman

    Arvind Yadav
     
  • amba_id are not supposed to change at runtime. All functions
    working with const amba_id. So mark the non-const structs as const.

    Signed-off-by: Arvind Yadav
    Signed-off-by: Greg Kroah-Hartman

    Arvind Yadav
     
  • amba_id are not supposed to change at runtime. All functions
    working with const amba_id. So mark the non-const structs as const.

    Signed-off-by: Arvind Yadav
    Signed-off-by: Greg Kroah-Hartman

    Arvind Yadav
     
  • amba_id are not supposed to change at runtime. All functions
    working with const amba_id. So mark the non-const structs as const.

    Signed-off-by: Arvind Yadav
    Signed-off-by: Greg Kroah-Hartman

    Arvind Yadav
     
  • amba_id are not supposed to change at runtime. All functions
    working with const amba_id. So mark the non-const structs as const.

    Signed-off-by: Arvind Yadav
    Signed-off-by: Greg Kroah-Hartman

    Arvind Yadav
     
  • amba_id are not supposed to change at runtime. All functions
    working with const amba_id. So mark the non-const structs as const.

    Signed-off-by: Arvind Yadav
    Signed-off-by: Greg Kroah-Hartman

    Arvind Yadav
     
  • amba_id are not supposed to change at runtime. All functions
    working with const amba_id. So mark the non-const structs as const.

    Signed-off-by: Arvind Yadav
    Signed-off-by: Greg Kroah-Hartman

    Arvind Yadav
     
  • amba_id are not supposed to change at runtime. All functions
    working with const amba_id. So mark the non-const structs as const.

    Signed-off-by: Arvind Yadav
    Signed-off-by: Greg Kroah-Hartman

    Arvind Yadav
     
  • amba_id are not supposed to change at runtime. All functions
    working with const amba_id. So mark the non-const structs as const.

    Signed-off-by: Arvind Yadav
    Signed-off-by: Greg Kroah-Hartman

    Arvind Yadav
     
  • The casting and other things here is odd, and causes sparse to
    complain:

    drivers/hwtracing/coresight/coresight-stm.c:279:35: warning: incorrect type in argument 1 (different address spaces)
    drivers/hwtracing/coresight/coresight-stm.c:279:35: expected void [noderef] *addr
    drivers/hwtracing/coresight/coresight-stm.c:279:35: got struct stm_drvdata *drvdata
    drivers/hwtracing/coresight/coresight-stm.c:327:17: warning: incorrect type in argument 2 (different address spaces)
    drivers/hwtracing/coresight/coresight-stm.c:327:17: expected void volatile [noderef] *addr
    drivers/hwtracing/coresight/coresight-stm.c:327:17: got void *addr
    drivers/hwtracing/coresight/coresight-stm.c:330:17: warning: incorrect type in argument 2 (different address spaces)
    drivers/hwtracing/coresight/coresight-stm.c:330:17: expected void volatile [noderef] *addr
    drivers/hwtracing/coresight/coresight-stm.c:330:17: got void *addr
    drivers/hwtracing/coresight/coresight-stm.c:333:17: warning: incorrect type in argument 2 (different address spaces)
    drivers/hwtracing/coresight/coresight-stm.c:333:17: expected void volatile [noderef] *addr
    drivers/hwtracing/coresight/coresight-stm.c:333:17: got void *addr

    >From what I can tell, we don't really need to treat ch_addr as
    anything besides a pointer, and we can just do pointer math
    instead of ORing in the bits of the offset and achieve the same
    thing.

    Also, we were passing a drvdata pointer to the
    coresight_timeout() function, but we really wanted to pass the
    address of the register base. Luckily the base is the first
    member of the structure, so everything works out, but this is
    quite unsafe if we ever change the structure layout. Clean this
    all up so sparse stops complaining on this code.

    Reported-by: Satyajit Desai
    Signed-off-by: Stephen Boyd
    Signed-off-by: Mathieu Poirier
    Signed-off-by: Greg Kroah-Hartman

    Stephen Boyd
     
  • Add the peripheral ids for the Coresight SoC 600 TPIU, replicator
    and funnel.

    Cc: Mathieu Poirier
    Signed-off-by: Suzuki K Poulose
    Signed-off-by: Mathieu Poirier
    Signed-off-by: Greg Kroah-Hartman

    Suzuki K Poulose
     
  • The coresight SoC 600 supports ETR save-restore which allows us
    to restore a trace session by retaining the RRP/RWP/STS.Full values
    when the TMC leaves the Disabled state. However, the TMC doesn't
    have a scatter-gather unit in built.

    Also, TMCs have different PIDs in different configurations (ETF,
    ETB & ETR), unlike the previous generation.

    While the DEVID exposes some of the features/changes in the TMC,
    it doesn't explicitly advertises the new save-restore feature
    as described above.

    Cc: Mathieu Poirier
    Signed-off-by: Suzuki K Poulose
    Signed-off-by: Mathieu Poirier
    Signed-off-by: Greg Kroah-Hartman

    Suzuki K Poulose
     
  • The Coresight SoC 600 TMC ETR supports save-restore feature,
    where the values of the RRP/RWP and STS.Full are retained
    when it leaves the Disabled state. Hence, we must program the
    RRP/RWP and STS.Full to a proper value. For now, set the RRP/RWP
    to the base address of the buffer and clear the STS.Full register.
    This can be later exploited for proper save-restore of ETR
    trace contexts (e.g, perf).

    Cc: Mathieu Poirier
    Signed-off-by: Suzuki K Poulose
    Signed-off-by: Greg Kroah-Hartman

    Suzuki K Poulose
     
  • If the ETR supports split cache encoding (i.e, separate bits for
    read and write transfers) unlike the older version (where read
    and write transfers use the same encoding in AXICTL[2-5]).
    This feature is not advertised and has to be described by the
    static mask associated with the device id.

    Cc: Mathieu Poirier
    Signed-off-by: Suzuki K Poulose
    Signed-off-by: Mathieu Poirier
    Signed-off-by: Greg Kroah-Hartman

    Suzuki K Poulose
     
  • This patch cleans up how we setup the AXICTL register on
    TMC ETR. At the moment we don't set the CacheCtrl bits, which
    drives the arcache and awcache bits on AXI bus specifying the
    cacheablitiy. Set this to Write-back Read and Write-allocate.

    Cc: Mathieu Poirier
    Signed-off-by: Suzuki K Poulose
    Signed-off-by: Mathieu Poirier
    Signed-off-by: Greg Kroah-Hartman

    Suzuki K Poulose
     
  • TMC in Coresight SoC-600 advertises the AXI address width
    in the device configuration register.

    Bit 16 - AXIAW_VALID
    0 - AXI Address Width not valid
    1 - Valid AXI Address width in Bits[23-17]

    Bits [23-17] - AXIAW. If AXIAW_VALID = b01 then
    0x20 - 32bit AXI address bus
    0x28 - 40bit AXI address bus
    0x2c - 44bit AXI address bus
    0x30 - 48bit AXI address bus
    0x34 - 52bit AXI address bus

    Use the address bits from the device configuration register, if
    available. Otherwise, default to 40bit.

    Cc: Mathieu Poirier
    Cc: Robin Murphy
    Signed-off-by: Suzuki K Poulose
    Signed-off-by: Mathieu Poirier
    Signed-off-by: Greg Kroah-Hartman

    Suzuki K Poulose
     
  • The SG unit in the TMC has been removed in Coresight SoC-600.
    This is however advertised by DEVID:Bit 24 = 0b1. On the
    previous generation, the bit is RES0, hence we can rely on the
    DEVID to detect the support.

    Cc: Mathieu Poirier
    Cc: Mike Leach
    Signed-off-by: Suzuki K Poulose
    Signed-off-by: Mathieu Poirier
    Signed-off-by: Greg Kroah-Hartman

    Suzuki K Poulose
     
  • With new version of TMC ETR, there are differing set of
    features supported by the TMC. Add the capability of a
    given TMC ETR for making safer decisions at runtime.

    The device configuration register of the TMC (DEVID) lists
    some of the capabilities. So, we can detect some of them at
    probe. However, some of the features (or changes in behavior)
    are not advertised and we have to depend on the PID to infer
    the features. So we use a static description of the "unadvertised"
    capabilities attached to the PID. Combining both, the static
    and the dynamic capabilities, we maintain a bitmask of the
    available features which can be later checked to take
    appropriate actions.

    Cc: Mathieu Poirier
    Signed-off-by: Suzuki K Poulose
    Signed-off-by: Mathieu Poirier
    Signed-off-by: Greg Kroah-Hartman

    Suzuki K Poulose
     
  • Coresight SoC 600 defines a new configuration for TMC, Embedded Trace
    Streamer (ETS), indicated by 0x3 in MODE:CONFIG_TYPE. This would break
    the existing driver which will treat anything other than ETR/ETB as an
    ETF. Fix the driver to check the configuration type properly and also
    add a warning if we encounter an unsupported configuration (ETS).

    Cc: Mathieu Poirier
    Signed-off-by: Suzuki K Poulose
    Signed-off-by: Mathieu Poirier
    Signed-off-by: Greg Kroah-Hartman

    Suzuki K Poulose
     
  • Expose the idfilter* registers of the programmable replicator.

    Cc: Mathieu Poirier
    Signed-off-by: Suzuki K Poulose
    Signed-off-by: Mathieu Poirier
    Signed-off-by: Greg Kroah-Hartman

    Suzuki K Poulose
     
  • Expose DBALO,DBAHI and AXICTL registers

    Cc: Mathieu Poirier
    Signed-off-by: Suzuki K Poulose
    Signed-off-by: Mathieu Poirier
    Signed-off-by: Greg Kroah-Hartman

    Suzuki K Poulose
     
  • Coresight TMC splits 64bit registers into a pair of 32bit registers
    (e.g DBA, RRP, RWP). Provide helpers to read/write to these registers.

    Cc: Mathieu Poirier
    Signed-off-by: Suzuki K Poulose
    Signed-off-by: Mathieu Poirier
    Signed-off-by: Greg Kroah-Hartman

    Suzuki K Poulose