13 Jan, 2019
1 commit
-
commit ec5b5ad6e272d8d6b92d1007f79574919862a2d2 upstream.
The 'nr_pages' attribute of the 'msc' subdevices parses a comma-separated
list of window sizes, passed from userspace. However, there is a bug in
the string parsing logic wherein it doesn't exclude the comma character
from the range of characters as it consumes them. This leads to an
out-of-bounds access given a sufficiently long list. For example:> # echo 8,8,8,8 > /sys/bus/intel_th/devices/0-msc0/nr_pages
> ==================================================================
> BUG: KASAN: slab-out-of-bounds in memchr+0x1e/0x40
> Read of size 1 at addr ffff8803ffcebcd1 by task sh/825
>
> CPU: 3 PID: 825 Comm: npktest.sh Tainted: G W 4.20.0-rc1+
> Call Trace:
> dump_stack+0x7c/0xc0
> print_address_description+0x6c/0x23c
> ? memchr+0x1e/0x40
> kasan_report.cold.5+0x241/0x308
> memchr+0x1e/0x40
> nr_pages_store+0x203/0xd00 [intel_th_msu]Fix this by accounting for the comma character.
Signed-off-by: Alexander Shishkin
Fixes: ba82664c134ef ("intel_th: Add Memory Storage Unit driver")
Cc: stable@vger.kernel.org # v4.4+
Signed-off-by: Greg Kroah-Hartman
14 Nov, 2018
1 commit
-
[ Upstream commit 987d1e8dcd370d96029a3d76a0031b043c4a69ae ]
If the ETB is already enabled in sysfs mode, the ETB reports
success even if a perf mode is requested. Fix this by checking
the requested mode.Cc: Mathieu Poirier
Signed-off-by: Suzuki K Poulose
Signed-off-by: Mathieu Poirier
Signed-off-by: Greg Kroah-Hartman
Signed-off-by: Sasha Levin
Signed-off-by: Greg Kroah-Hartman
20 Oct, 2018
1 commit
-
[ Upstream commit 59d08d00d43c644ee2011d7ff1807bdd69f31fe0 ]
This adds Intel(R) Trace Hub PCI ID for Ice Lake PCH.
Signed-off-by: Alexander Shishkin
Signed-off-by: Greg Kroah-Hartman
Signed-off-by: Sasha Levin
Signed-off-by: Greg Kroah-Hartman
04 Oct, 2018
1 commit
-
commit 8801922cd94c918e4dc3a108ecaa500c4d40583f upstream.
Commit a753bfcfdb1f ("intel_th: Make the switch allocate its subdevices")
brings in new subdevice addition/removal logic that's broken for "host
mode": the SWITCH device has no children to begin with, which is not
handled in the code. This results in a null dereference bug later down
the path.This patch fixes the subdevice removal code to handle host mode correctly.
Signed-off-by: Alexander Shishkin
Fixes: a753bfcfdb1f ("intel_th: Make the switch allocate its subdevices")
CC: stable@vger.kernel.org # v4.14+
Signed-off-by: Greg Kroah-Hartman
26 Sep, 2018
3 commits
-
[ Upstream commit 5cedd22370a0a460b663c06de1fc10b4ba3c5d0b ]
Add ETM PIDs of the Arm cortex-A CPUs to the white list of ETMs.
While at it add a helper macro to make it easier to add the new
entries.Cc: Mathieu Poirier
Signed-off-by: Suzuki K Poulose
Signed-off-by: Mathieu Poirier
Signed-off-by: Greg Kroah-Hartman
Signed-off-by: Sasha Levin
Signed-off-by: Greg Kroah-Hartman -
[ Upstream commit ccff2dfaceaca4517432f5c149594215fe9098cc ]
Probing the TPIU driver under UBSan triggers an out-of-bounds shift
warning in coresight_timeout():...
[ 5.677530] UBSAN: Undefined behaviour in drivers/hwtracing/coresight/coresight.c:929:16
[ 5.685542] shift exponent 64 is too large for 64-bit type 'long unsigned int'
...On closer inspection things are exponentially out of whack because we're
passing a bitmask where a bit number should be. Amusingly, it seems that
both calls will find their expected values by sheer luck and appear to
succeed: 1 << FFCR_FON_MAN ends up at bit 64 which whilst undefined
evaluates as zero in practice, while 1 << FFSR_FT_STOPPED finds bit 2
(TCPresent) which apparently is usually tied high.Following the examples of other drivers, define separate FOO and FOO_BIT
macros for masks vs. indices, and put things right.CC: Robert Walker
CC: Mike Leach
CC: Mathieu Poirier
Fixes: 11595db8e17f ("coresight: Fix disabling of CoreSight TPIU")
Signed-off-by: Robin Murphy
Signed-off-by: Mathieu Poirier
Signed-off-by: Greg Kroah-Hartman
Signed-off-by: Sasha Levin
Signed-off-by: Greg Kroah-Hartman -
[ Upstream commit fe470f5f7f684ed15bc49b6183a64237547910ff ]
If we fail to find the input / output port for a LINK component
while enabling a path, we should fail gracefully rather than
assuming port "0".Cc: Mathieu Poirier
Signed-off-by: Suzuki K Poulose
Signed-off-by: Mathieu Poirier
Signed-off-by: Greg Kroah-Hartman
Signed-off-by: Sasha Levin
Signed-off-by: Greg Kroah-Hartman
05 Jun, 2018
3 commits
-
commit 0ed2424b911f3a058dfea01b78817abed767433d upstream.
Commit d5c435df4a890 ("intel_th: msu: Use the real device in case of IOMMU
domain allocation") changes dma buffer allocation to use the actual
underlying device, but forgets to change the deallocation path, which leads
to (if you've got CAP_SYS_RAWIO):> # echo 0,0 > /sys/bus/intel_th/devices/0-msc0/nr_pages
> ------------[ cut here ]------------
> kernel BUG at ../linux/drivers/iommu/intel-iommu.c:3670!
> CPU: 3 PID: 231 Comm: sh Not tainted 4.17.0-rc1+ #2729
> RIP: 0010:intel_unmap+0x11e/0x130
...
> Call Trace:
> intel_free_coherent+0x3e/0x60
> msc_buffer_win_free+0x100/0x160 [intel_th_msu]This patch fixes the buffer deallocation code to use the correct device.
Signed-off-by: Alexander Shishkin
Fixes: d5c435df4a890 ("intel_th: msu: Use the real device in case of IOMMU domain allocation")
Reported-by: Baofeng Tian
CC: stable@vger.kernel.org # v4.14+
Signed-off-by: Greg Kroah-Hartman -
commit 806e30873f0e74d9d41b0ef761bd4d3e55c7d510 upstream.
Commit b5e2ced9bf81 ("stm class: Use vmalloc for the master map") caused
a build error on some arches as vmalloc.h was not explicitly included.Fix that by adding it to the list of includes.
Fixes: b5e2ced9bf81 ("stm class: Use vmalloc for the master map")
Reported-by: kbuild test robot
Cc: Alexander Shishkin
Signed-off-by: Greg Kroah-Hartman -
commit b5e2ced9bf81393034072dd4d372f6b430bc1f0a upstream.
Fengguang is running into a warning from the buddy allocator:
> swapper/0: page allocation failure: order:9, mode:0x14040c0(GFP_KERNEL|__GFP_COMP), nodemask=(null)
> CPU: 1 PID: 1 Comm: swapper/0 Not tainted 4.17.0-rc1 #262
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1 04/01/2014
> Call Trace:
...
> __kmalloc+0x14b/0x180: ____cache_alloc at mm/slab.c:3127
> stm_register_device+0xf3/0x5c0: stm_register_device at drivers/hwtracing/stm/core.c:695
...Which is basically a result of the stm class trying to allocate ~512kB
for the dummy_stm with its default parameters. There's no reason, however,
for it not to be vmalloc()ed instead, which is what this patch does.Reported-by: Fengguang Wu
Signed-off-by: Alexander Shishkin
CC: stable@vger.kernel.org # v4.4+
Signed-off-by: Greg Kroah-Hartman
30 May, 2018
2 commits
-
[ Upstream commit 831c326fcd0e8e2a6ece952f898a1ec9b1dc1004 ]
Commit ad67b74d2469 ("printk: hash addresses printed with %p") lets
printk specifier %p to hash all addresses before printing, this was
resulting in the high 32 bits of pcsr can only output zeros. So
module cannot completely print pc value and it's pointless for debugging
purpose.This patch fixes this by using %px to print pcsr instead.
Cc: Mathieu Poirier
Signed-off-by: Leo Yan
Signed-off-by: Mathieu Poirier
Signed-off-by: Sasha Levin
Signed-off-by: Greg Kroah-Hartman -
[ Upstream commit 9ad577087165478c9d9be82b15ed9bf2db5835f5 ]
Since commit 8edc514b01e9 ("intel_th: Make SOURCE devices children of the
root device") the hub is not the parent of SOURCE devices any more, so the
new helper function should be used for that instead of always using the
parent. The intel_th_set_output() path, however, still uses the old
logic, leading to the hub driver structure being aliased with something
else, like struct pci_driver or struct acpi_driver, and an incorrect call
to an address inferred from that, potentially resulting in a crash.Fixes: 8edc514b01e9 ("intel_th: Make SOURCE devices children of the root device")
Signed-off-by: Alexander Shishkin
Signed-off-by: Sasha Levin
Signed-off-by: Greg Kroah-Hartman
24 Mar, 2018
1 commit
-
[ Upstream commit 11595db8e17faaa05fadc25746c870e31276962f ]
The CoreSight TPIU should be disabled when tracing to other sinks to allow
them to operate at full bandwidth.This patch fixes tpiu_disable_hw() to correctly disable the TPIU by
configuring the TPIU to stop on flush, initiating a manual flush, waiting
for the flush to complete and then waits for the TPIU to indicate it has
stopped.Signed-off-by: Robert Walker
Tested-by: Mike Leach
Signed-off-by: Mathieu Poirier
Signed-off-by: Greg Kroah-Hartman
Signed-off-by: Sasha Levin
Signed-off-by: Greg Kroah-Hartman
02 Nov, 2017
1 commit
-
Many source files in the tree are missing licensing information, which
makes it harder for compliance tools to determine the correct license.By default all files without license information are under the default
license of the kernel, which is GPL version 2.Update the files which contain no license information with the 'GPL-2.0'
SPDX license identifier. The SPDX identifier is a legally binding
shorthand, which can be used instead of the full boiler plate text.This patch is based on work done by Thomas Gleixner and Kate Stewart and
Philippe Ombredanne.How this work was done:
Patches were generated and checked against linux-4.14-rc6 for a subset of
the use cases:
- file had no licensing information it it.
- file was a */uapi/* one with no licensing information in it,
- file was a */uapi/* one with existing licensing information,Further patches will be generated in subsequent months to fix up cases
where non-standard license headers were used, and references to license
had to be inferred by heuristics based on keywords.The analysis to determine which SPDX License Identifier to be applied to
a file was done in a spreadsheet of side by side results from of the
output of two independent scanners (ScanCode & Windriver) producing SPDX
tag:value files created by Philippe Ombredanne. Philippe prepared the
base worksheet, and did an initial spot review of a few 1000 files.The 4.13 kernel was the starting point of the analysis with 60,537 files
assessed. Kate Stewart did a file by file comparison of the scanner
results in the spreadsheet to determine which SPDX license identifier(s)
to be applied to the file. She confirmed any determination that was not
immediately clear with lawyers working with the Linux Foundation.Criteria used to select files for SPDX license identifier tagging was:
- Files considered eligible had to be source code files.
- Make and config files were included as candidates if they contained >5
lines of source
- File already had some variant of a license header in it (even if
Reviewed-by: Philippe Ombredanne
Reviewed-by: Thomas Gleixner
Signed-off-by: Greg Kroah-Hartman
22 Sep, 2017
3 commits
-
This adds Intel(R) Trace Hub PCI ID for Lewisburg PCH.
Signed-off-by: Alexander Shishkin
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman -
This adds Intel(R) Trace Hub PCI ID for Cedar Fork PCH.
Signed-off-by: Alexander Shishkin
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman -
For reasons unknown, the stm_source removal path uses device_destroy()
to kill the underlying device object. Because device_destroy() uses
devt to look for the device to destroy and the fact that stm_source
devices don't have one (or all have the same one), it just picks the
first device in the class, which may well be the wrong one.That is, loading stm_console and stm_heartbeat and then removing both
will die in dereferencing a freed object.Since this should have been device_unregister() in the first place,
use it instead of device_destroy().Signed-off-by: Alexander Shishkin
Fixes: 7bd1d4093c2 ("stm class: Introduce an abstraction for System Trace Module devices")
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman
28 Aug, 2017
23 commits
-
…it/ash/stm into char-misc-next
Alexander writes:
stm class / intel_th: Updates for 4.14
Intel TH:
* Updated subdevice management code to better fit host mode
* Added support for Low Power Path (LPP) output type
* Fixed memory allocation with IOMMU enabled (DMAR tables)
* Added Cannon Lake PCH PCI IDs
* Added a quirk to force time sync on devices that need itSTM:
* Fixed potential read overflow in ioctl()
* Documented stm_ftrace source. -
amba_id are not supposed to change at runtime. All functions
working with const amba_id. So mark the non-const structs as const.Signed-off-by: Arvind Yadav
Signed-off-by: Greg Kroah-Hartman -
amba_id are not supposed to change at runtime. All functions
working with const amba_id. So mark the non-const structs as const.Signed-off-by: Arvind Yadav
Signed-off-by: Greg Kroah-Hartman -
amba_id are not supposed to change at runtime. All functions
working with const amba_id. So mark the non-const structs as const.Signed-off-by: Arvind Yadav
Signed-off-by: Greg Kroah-Hartman -
amba_id are not supposed to change at runtime. All functions
working with const amba_id. So mark the non-const structs as const.Signed-off-by: Arvind Yadav
Signed-off-by: Greg Kroah-Hartman -
amba_id are not supposed to change at runtime. All functions
working with const amba_id. So mark the non-const structs as const.Signed-off-by: Arvind Yadav
Signed-off-by: Greg Kroah-Hartman -
amba_id are not supposed to change at runtime. All functions
working with const amba_id. So mark the non-const structs as const.Signed-off-by: Arvind Yadav
Signed-off-by: Greg Kroah-Hartman -
amba_id are not supposed to change at runtime. All functions
working with const amba_id. So mark the non-const structs as const.Signed-off-by: Arvind Yadav
Signed-off-by: Greg Kroah-Hartman -
amba_id are not supposed to change at runtime. All functions
working with const amba_id. So mark the non-const structs as const.Signed-off-by: Arvind Yadav
Signed-off-by: Greg Kroah-Hartman -
amba_id are not supposed to change at runtime. All functions
working with const amba_id. So mark the non-const structs as const.Signed-off-by: Arvind Yadav
Signed-off-by: Greg Kroah-Hartman -
The casting and other things here is odd, and causes sparse to
complain:drivers/hwtracing/coresight/coresight-stm.c:279:35: warning: incorrect type in argument 1 (different address spaces)
drivers/hwtracing/coresight/coresight-stm.c:279:35: expected void [noderef] *addr
drivers/hwtracing/coresight/coresight-stm.c:279:35: got struct stm_drvdata *drvdata
drivers/hwtracing/coresight/coresight-stm.c:327:17: warning: incorrect type in argument 2 (different address spaces)
drivers/hwtracing/coresight/coresight-stm.c:327:17: expected void volatile [noderef] *addr
drivers/hwtracing/coresight/coresight-stm.c:327:17: got void *addr
drivers/hwtracing/coresight/coresight-stm.c:330:17: warning: incorrect type in argument 2 (different address spaces)
drivers/hwtracing/coresight/coresight-stm.c:330:17: expected void volatile [noderef] *addr
drivers/hwtracing/coresight/coresight-stm.c:330:17: got void *addr
drivers/hwtracing/coresight/coresight-stm.c:333:17: warning: incorrect type in argument 2 (different address spaces)
drivers/hwtracing/coresight/coresight-stm.c:333:17: expected void volatile [noderef] *addr
drivers/hwtracing/coresight/coresight-stm.c:333:17: got void *addr>From what I can tell, we don't really need to treat ch_addr as
anything besides a pointer, and we can just do pointer math
instead of ORing in the bits of the offset and achieve the same
thing.Also, we were passing a drvdata pointer to the
coresight_timeout() function, but we really wanted to pass the
address of the register base. Luckily the base is the first
member of the structure, so everything works out, but this is
quite unsafe if we ever change the structure layout. Clean this
all up so sparse stops complaining on this code.Reported-by: Satyajit Desai
Signed-off-by: Stephen Boyd
Signed-off-by: Mathieu Poirier
Signed-off-by: Greg Kroah-Hartman -
Add the peripheral ids for the Coresight SoC 600 TPIU, replicator
and funnel.Cc: Mathieu Poirier
Signed-off-by: Suzuki K Poulose
Signed-off-by: Mathieu Poirier
Signed-off-by: Greg Kroah-Hartman -
The coresight SoC 600 supports ETR save-restore which allows us
to restore a trace session by retaining the RRP/RWP/STS.Full values
when the TMC leaves the Disabled state. However, the TMC doesn't
have a scatter-gather unit in built.Also, TMCs have different PIDs in different configurations (ETF,
ETB & ETR), unlike the previous generation.While the DEVID exposes some of the features/changes in the TMC,
it doesn't explicitly advertises the new save-restore feature
as described above.Cc: Mathieu Poirier
Signed-off-by: Suzuki K Poulose
Signed-off-by: Mathieu Poirier
Signed-off-by: Greg Kroah-Hartman -
The Coresight SoC 600 TMC ETR supports save-restore feature,
where the values of the RRP/RWP and STS.Full are retained
when it leaves the Disabled state. Hence, we must program the
RRP/RWP and STS.Full to a proper value. For now, set the RRP/RWP
to the base address of the buffer and clear the STS.Full register.
This can be later exploited for proper save-restore of ETR
trace contexts (e.g, perf).Cc: Mathieu Poirier
Signed-off-by: Suzuki K Poulose
Signed-off-by: Greg Kroah-Hartman -
If the ETR supports split cache encoding (i.e, separate bits for
read and write transfers) unlike the older version (where read
and write transfers use the same encoding in AXICTL[2-5]).
This feature is not advertised and has to be described by the
static mask associated with the device id.Cc: Mathieu Poirier
Signed-off-by: Suzuki K Poulose
Signed-off-by: Mathieu Poirier
Signed-off-by: Greg Kroah-Hartman -
This patch cleans up how we setup the AXICTL register on
TMC ETR. At the moment we don't set the CacheCtrl bits, which
drives the arcache and awcache bits on AXI bus specifying the
cacheablitiy. Set this to Write-back Read and Write-allocate.Cc: Mathieu Poirier
Signed-off-by: Suzuki K Poulose
Signed-off-by: Mathieu Poirier
Signed-off-by: Greg Kroah-Hartman -
TMC in Coresight SoC-600 advertises the AXI address width
in the device configuration register.Bit 16 - AXIAW_VALID
0 - AXI Address Width not valid
1 - Valid AXI Address width in Bits[23-17]Bits [23-17] - AXIAW. If AXIAW_VALID = b01 then
0x20 - 32bit AXI address bus
0x28 - 40bit AXI address bus
0x2c - 44bit AXI address bus
0x30 - 48bit AXI address bus
0x34 - 52bit AXI address busUse the address bits from the device configuration register, if
available. Otherwise, default to 40bit.Cc: Mathieu Poirier
Cc: Robin Murphy
Signed-off-by: Suzuki K Poulose
Signed-off-by: Mathieu Poirier
Signed-off-by: Greg Kroah-Hartman -
The SG unit in the TMC has been removed in Coresight SoC-600.
This is however advertised by DEVID:Bit 24 = 0b1. On the
previous generation, the bit is RES0, hence we can rely on the
DEVID to detect the support.Cc: Mathieu Poirier
Cc: Mike Leach
Signed-off-by: Suzuki K Poulose
Signed-off-by: Mathieu Poirier
Signed-off-by: Greg Kroah-Hartman -
With new version of TMC ETR, there are differing set of
features supported by the TMC. Add the capability of a
given TMC ETR for making safer decisions at runtime.The device configuration register of the TMC (DEVID) lists
some of the capabilities. So, we can detect some of them at
probe. However, some of the features (or changes in behavior)
are not advertised and we have to depend on the PID to infer
the features. So we use a static description of the "unadvertised"
capabilities attached to the PID. Combining both, the static
and the dynamic capabilities, we maintain a bitmask of the
available features which can be later checked to take
appropriate actions.Cc: Mathieu Poirier
Signed-off-by: Suzuki K Poulose
Signed-off-by: Mathieu Poirier
Signed-off-by: Greg Kroah-Hartman -
Coresight SoC 600 defines a new configuration for TMC, Embedded Trace
Streamer (ETS), indicated by 0x3 in MODE:CONFIG_TYPE. This would break
the existing driver which will treat anything other than ETR/ETB as an
ETF. Fix the driver to check the configuration type properly and also
add a warning if we encounter an unsupported configuration (ETS).Cc: Mathieu Poirier
Signed-off-by: Suzuki K Poulose
Signed-off-by: Mathieu Poirier
Signed-off-by: Greg Kroah-Hartman -
Expose the idfilter* registers of the programmable replicator.
Cc: Mathieu Poirier
Signed-off-by: Suzuki K Poulose
Signed-off-by: Mathieu Poirier
Signed-off-by: Greg Kroah-Hartman -
Expose DBALO,DBAHI and AXICTL registers
Cc: Mathieu Poirier
Signed-off-by: Suzuki K Poulose
Signed-off-by: Mathieu Poirier
Signed-off-by: Greg Kroah-Hartman -
Coresight TMC splits 64bit registers into a pair of 32bit registers
(e.g DBA, RRP, RWP). Provide helpers to read/write to these registers.Cc: Mathieu Poirier
Signed-off-by: Suzuki K Poulose
Signed-off-by: Mathieu Poirier
Signed-off-by: Greg Kroah-Hartman
