linux-stable.git/drivers/hwtracing, branch v4.7.2

coresight: Handle build path error

2016-06-16T07:13:06+00:00

Enabling a component via sysfs (echo 1 > enable_source), would
trigger building a path from the enabled sources to the sink.
If there is an error in the process (e.g, sink not enabled or
the device (CPU corresponding to ETM) is not online), we never report
failure, except for leaving a message in the dmesg.

Do proper error checking for the build path and return the error.

Before:
 $ echo 0 > /sys/devices/system/cpu/cpu2/online
 $ echo 1 > /sys/devices/cs_etm/cpu2/enable_source
 $ echo $?
 0

After:
 $ echo 0 > /sys/devices/system/cpu/cpu2/online
 $ echo 1 > /sys/devices/cs_etm/cpu2/enable_source
 -bash: echo: write error: No such device or address

Signed-off-by: Suzuki K Poulose 
Acked-by: Mathieu Poirier 
Signed-off-by: Greg Kroah-Hartman

coresight: Fix erroneous memset in tmc_read_unprepare_etr

2016-06-16T07:13:06+00:00

At the end of a trace collection, we try to clear the entire buffer
and enable the ETR back if it was already enabled. But, we would have
adjusted the drvdata->buf to point to the beginning of the trace data
in the trace buffer @drvdata->vaddr. So, the following code which
clears the buffer is dangerous and can cause crashes, like below :

	memset(drvdata->buf, 0, drvdata->size);

 Unable to handle kernel paging request at virtual address ffffff800a145000
 pgd = ffffffc974726000
 *pgd=00000009f3e91003, *pud=00000009f3e91003, *pmd=0000000000000000
 PREEMPT SMP
 Modules linked in:
 CPU: 4 PID: 1692 Comm: dd Not tainted 4.7.0-rc2+ #1721
 Hardware name: ARM Juno development board (r0) (DT)
 task: ffffffc9734a0080 ti: ffffffc974460000 task.ti: ffffffc974460000
 PC is at __memset+0x1ac/0x200
 LR is at tmc_read_unprepare_etr+0x144/0x1bc
 pc : [] lr : [] pstate: 200001c5
 ...
 [] __memset+0x1ac/0x200
 [] tmc_release+0x90/0x94
 [] __fput+0xa8/0x1ec
 [] ____fput+0xc/0x14
 [] task_work_run+0xb0/0xe4
 [] do_notify_resume+0x64/0x6c
 [] work_pending+0x10/0x14
 Code: 91010108 54ffff4a 8b040108 cb050042 (d50b7428)

Since we clear the buffer anyway in the following call to
tmc_etr_enable_hw(), remove the erroneous memset().

Fixes: commit de5461970b3e9e1 ("coresight: tmc: allocating memory when needed")
Cc: Mathieu Poirier 
Signed-off-by: Suzuki K Poulose 
Signed-off-by: Mathieu Poirier 
Signed-off-by: Greg Kroah-Hartman

coresight: Fix tmc_read_unprepare_etr

2016-06-16T07:13:06+00:00

At the end of the trace capture, we free the allocated memory,
resetting the drvdata->buf to NULL, to indicate that trace data
was collected and the next trace session should allocate the
memory in tmc_enable_etr_sink_sysfs.

The tmc_enable_etr_sink_sysfs, we only allocate memory if drvdata->vaddr
is not NULL (which is not performed at the end of previous session).
This can cause, drvdata->vaddr getting assigned NULL and later we do
memset() which causes a crash as below :

Unable to handle kernel NULL pointer dereference at virtual
 address  00000000
pgd = ffffffc9747f0000
[00000000] *pgd=00000009f402e003, *pud=00000009f402e003,
 *pmd=0000000000000000
Internal error: Oops: 96000046 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 1592 Comm: bash Not tainted 4.7.0-rc1+ #1712
Hardware name: ARM Juno development board (r0) (DT)
task: ffffffc078fe0080 ti: ffffffc974178000 task.ti: ffffffc974178000
PC is at __memset+0x1ac/0x200
LR is at tmc_enable_etr_sink+0xf8/0x304
pc : [] lr : [] pstate: 400001c5
sp : ffffffc97417bc00
x29: ffffffc97417bc00 x28: ffffffc974178000

Call trace:
Exception stack(0xffffffc97417ba40 to 0xffffffc97417bb60)
ba40: 0000000000000001 ffffffc974a5d098 ffffffc97417bc00 ffffff80083a002c
ba60: ffffffc974a5d118 0000000000000000 0000000000000000 0000000000000000
ba80: 0000000000000001 0000000000000000 ffffff800859bdec 0000000000000040
baa0: ffffff8008b45b58 00000000000001c0 ffffffc97417baf0 ffffff80080eddb4
bac0: 0000000000000003 ffffffc078fe0080 ffffffc078fe0960 ffffffc078fe0940
bae0: 0000000000000000 0000000000000000 00000000007fffc0 0000000000000004
bb00: 0000000000000000 0000000000000040 000000000000003f 0000000000000000
bb20: 0000000000000000 0000000000000000 0000000000000000 0000000000000001
bb40: ffffffc078fe0960 0000000000000018 ffffffffffffffff 0008669628000000
[] __memset+0x1ac/0x200
[] coresight_enable_path+0xa8/0x1dc
[] coresight_enable+0x88/0x1b8
[] enable_source_store+0x3c/0x6c
[] dev_attr_store+0x18/0x28
[] sysfs_kf_write+0x54/0x64
[] kernfs_fop_write+0x148/0x1d8
[] __vfs_write+0x28/0x110
[] vfs_write+0xa0/0x198
[] SyS_write+0x44/0xa0
[] el0_svc_naked+0x24/0x28
Code: 91010108 54ffff4a 8b040108 cb050042 (d50b7428)

This patch fixes the issue by clearing the drvdata->vaddr while we free
the allocated buffer at the end of a session, so that we allocate the
memory again.

Cc: mathieu.poirier@linaro.org
Signed-off-by: Suzuki K Poulose 
Signed-off-by: Mathieu Poirier 
Signed-off-by: Greg Kroah-Hartman

coresight: Fix NULL pointer dereference in _coresight_build_path

2016-06-16T07:13:06+00:00

_coresight_build_path assumes that all the connections of a csdev
has the child_dev initialised. This may not be true if the particular
component is not supported by the kernel config(e.g TPIU) but is
present in the DT. In which case, building a path can cause a crash like this :

  Unable to handle kernel NULL pointer dereference at virtual address 00000010
  pgd = ffffffc9750dd000
  [00000010] *pgd=00000009f5e90003, *pud=00000009f5e90003, *pmd=0000000000000000
  Internal error: Oops: 96000006 [#1] PREEMPT SMP
  Modules linked in:
  CPU: 4 PID: 1348 Comm: bash Not tainted 4.6.0-next-20160517 #1646
  Hardware name: ARM Juno development board (r0) (DT)
  task: ffffffc97517a280 ti: ffffffc9762c4000 task.ti: ffffffc9762c4000
  PC is at _coresight_build_path+0x18/0xe4
  LR is at _coresight_build_path+0xc0/0xe4
  pc : [] lr : [] pstate: 20000145
  sp : ffffffc9762c7ba0

  [] _coresight_build_path+0x18/0xe4
  [] _coresight_build_path+0xc0/0xe4
  [] _coresight_build_path+0xc0/0xe4
  [] _coresight_build_path+0xc0/0xe4
  [] _coresight_build_path+0xc0/0xe4
  [] _coresight_build_path+0xc0/0xe4
  [] coresight_build_path+0x40/0x68
  [] coresight_enable+0x74/0x1bc
  [] enable_source_store+0x3c/0x6c
  [] dev_attr_store+0x18/0x28
  [] sysfs_kf_write+0x40/0x50
  [] kernfs_fop_write+0x140/0x1cc
  [] __vfs_write+0x28/0x110
  [] vfs_write+0xa0/0x174
  [] SyS_write+0x44/0xa0
  [] el0_svc_naked+0x24/0x28

Cc: Mathieu Poirier 
Signed-off-by: Suzuki K Poulose 
Signed-off-by: Mathieu Poirier 
Signed-off-by: Greg Kroah-Hartman

Merge tag 'char-misc-4.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc

2016-05-21T04:20:31+00:00

Pull char / misc driver updates from Greg KH:
 "Here's the big char and misc driver update for 4.7-rc1.

  Lots of different tiny driver subsystems have updates here with new
  drivers and functionality.  Details in the shortlog.

  All have been in linux-next with no reported issues for a while"

* tag 'char-misc-4.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (125 commits)
  mcb: Delete num_cells variable which is not required
  mcb: Fixed bar number assignment for the gdd
  mcb: Replace ioremap and request_region with the devm version
  mcb: Implement bus->dev.release callback
  mcb: export bus information via sysfs
  mcb: Correctly initialize the bus's device
  mei: bus: call mei_cl_read_start under device lock
  coresight: etb10: adjust read pointer only when needed
  coresight: configuring ETF in FIFO mode when acting as link
  coresight: tmc: implementing TMC-ETF AUX space API
  coresight: moving struct cs_buffers to header file
  coresight: tmc: keep track of memory width
  coresight: tmc: make sysFS and Perf mode mutually exclusive
  coresight: tmc: dump system memory content only when needed
  coresight: tmc: adding mode of operation for link/sinks
  coresight: tmc: getting rid of multiple read access
  coresight: tmc: allocating memory when needed
  coresight: tmc: making prepare/unprepare functions generic
  coresight: tmc: splitting driver in ETB/ETF and ETR components
  coresight: tmc: cleaning up header file
  ...

mm: rename _count, field of the struct page, to _refcount

2016-05-20T02:12:14+00:00

Many developers already know that field for reference count of the
struct page is _count and atomic type.  They would try to handle it
directly and this could break the purpose of page reference count
tracepoint.  To prevent direct _count modification, this patch rename it
to _refcount and add warning message on the code.  After that, developer
who need to handle reference count will find that field should not be
accessed directly.

[akpm@linux-foundation.org: fix comments, per Vlastimil]
[akpm@linux-foundation.org: Documentation/vm/transhuge.txt too]
[sfr@canb.auug.org.au: sync ethernet driver changes]
Signed-off-by: Joonsoo Kim 
Signed-off-by: Stephen Rothwell 
Cc: Vlastimil Babka 
Cc: Hugh Dickins 
Cc: Johannes Berg 
Cc: "David S. Miller" 
Cc: Sunil Goutham 
Cc: Chris Metcalf 
Cc: Manish Chopra 
Cc: Yuval Mintz 
Cc: Tariq Toukan 
Cc: Saeed Mahameed 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

coresight: etb10: adjust read pointer only when needed

2016-05-03T21:59:30+00:00

The read pointer (read_ptr) needs to be adjusted only if its value
has gone beyond the length of the memory buffer.

Reported-by: Suzuki K Poulose 
Signed-off-by: Mathieu Poirier 
Signed-off-by: Greg Kroah-Hartman

coresight: configuring ETF in FIFO mode when acting as link

2016-05-03T21:59:30+00:00

When part of a path but not identified as a sink, the EFT has to
be configured as a link and placed in HW FIFO mode.  As such when
enabling a path, call the right configuration function based on
the role the ETF if playing in this trace run.

Signed-off-by: Mathieu Poirier 
Reviewed-by: Suzuki K Poulose 
Signed-off-by: Greg Kroah-Hartman

coresight: tmc: implementing TMC-ETF AUX space API

2016-05-03T21:59:30+00:00

This patch implement the AUX area interfaces required to
use the TMC (configured as an ETF) from the Perf sub-system.

The heuristic is heavily borrowed from the ETB10 implementation.

Signed-off-by: Mathieu Poirier 
Reviewed-by: Suzuki K Poulose 
Signed-off-by: Greg Kroah-Hartman

coresight: moving struct cs_buffers to header file

2016-05-03T21:59:30+00:00

That way we can re-use the structure in other drivers.

Signed-off-by: Mathieu Poirier 
Reviewed-by: Suzuki K Poulose 
Signed-off-by: Greg Kroah-Hartman