kernel.git/drivers/hwtracing/intel_th, branch linux-4.20.y

intel_th: msu: Fix an off-by-one in attribute store

2019-01-13T08:24:09Z

commit ec5b5ad6e272d8d6b92d1007f79574919862a2d2 upstream. The 'nr_pages' attribute of the 'msc' subdevices parses a comma-separated list of window sizes, passed from userspace. However, there is a bug in the string parsing logic wherein it doesn't exclude the comma character from the range of characters as it consumes them. This leads to an out-of-bounds access given a sufficiently long list. For example: > # echo 8,8,8,8 > /sys/bus/intel_th/devices/0-msc0/nr_pages > ================================================================== > BUG: KASAN: slab-out-of-bounds in memchr+0x1e/0x40 > Read of size 1 at addr ffff8803ffcebcd1 by task sh/825 > > CPU: 3 PID: 825 Comm: npktest.sh Tainted: G W 4.20.0-rc1+ > Call Trace: > dump_stack+0x7c/0xc0 > print_address_description+0x6c/0x23c > ? memchr+0x1e/0x40 > kasan_report.cold.5+0x241/0x308 > memchr+0x1e/0x40 > nr_pages_store+0x203/0xd00 [intel_th_msu] Fix this by accounting for the comma character. Signed-off-by: Alexander Shishkin Fixes: ba82664c134ef ("intel_th: Add Memory Storage Unit driver") Cc: stable@vger.kernel.org # v4.4+ Signed-off-by: Greg Kroah-Hartman

intel_th: pci: Add Ice Lake PCH support

2018-09-18T14:08:38Z

This adds Intel(R) Trace Hub PCI ID for Ice Lake PCH. Signed-off-by: Alexander Shishkin Signed-off-by: Greg Kroah-Hartman

intel_th: Fix resource handling for ACPI glue layer

2018-09-18T14:08:38Z

The core of the driver expects the resource array from the glue layer to be indexed by even numbers, as is the case for 64-bit PCI resources. This doesn't hold true for others, ACPI in this instance, which leads to an out-of-bounds access and an ioremap() on whatever address that access fetches. This patch fixes the problem by reading resource array differently based on whether the 64-bit flag is set, which would indicate PCI glue layer. Signed-off-by: Alexander Shishkin Fixes: ebc57e399b8e ("intel_th: Add ACPI glue layer") CC: stable@vger.kernel.org # v4.17+ Signed-off-by: Greg Kroah-Hartman

intel_th: Fix device removal logic

2018-09-18T14:08:38Z

Commit a753bfcfdb1f ("intel_th: Make the switch allocate its subdevices") brings in new subdevice addition/removal logic that's broken for "host mode": the SWITCH device has no children to begin with, which is not handled in the code. This results in a null dereference bug later down the path. This patch fixes the subdevice removal code to handle host mode correctly. Signed-off-by: Alexander Shishkin Fixes: a753bfcfdb1f ("intel_th: Make the switch allocate its subdevices") CC: stable@vger.kernel.org # v4.14+ Signed-off-by: Greg Kroah-Hartman

drivers/hwtracing/intel_th/msu.c: change return type to vm_fault_t

2018-08-24T01:48:43Z

Use new return type vm_fault_t for fault handler. For now, this is just documenting that the function returns a VM_FAULT value rather than an errno. Once all instances are converted, vm_fault_t will become a distinct type. See 1c8f422059ae ("mm: change return type to vm_fault_t") for reference. Link: http://lkml.kernel.org/r/20180702155801.GA4010@jordon-HP-15-Notebook-PC Signed-off-by: Souptick Joarder Cc: Alexander Shishkin Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds

intel_th: Use correct device when freeing buffers

2018-05-25T16:09:17Z

Commit d5c435df4a890 ("intel_th: msu: Use the real device in case of IOMMU domain allocation") changes dma buffer allocation to use the actual underlying device, but forgets to change the deallocation path, which leads to (if you've got CAP_SYS_RAWIO): > # echo 0,0 > /sys/bus/intel_th/devices/0-msc0/nr_pages > ------------[ cut here ]------------ > kernel BUG at ../linux/drivers/iommu/intel-iommu.c:3670! > CPU: 3 PID: 231 Comm: sh Not tainted 4.17.0-rc1+ #2729 > RIP: 0010:intel_unmap+0x11e/0x130 ... > Call Trace: > intel_free_coherent+0x3e/0x60 > msc_buffer_win_free+0x100/0x160 [intel_th_msu] This patch fixes the buffer deallocation code to use the correct device. Signed-off-by: Alexander Shishkin Fixes: d5c435df4a890 ("intel_th: msu: Use the real device in case of IOMMU domain allocation") Reported-by: Baofeng Tian CC: stable@vger.kernel.org # v4.14+ Signed-off-by: Greg Kroah-Hartman

intel_th: Add ACPI glue layer

2018-03-28T15:47:23Z

The Trace Hub devices now can be enumerated as ACPI devices, which translates into "Host Debugger mode". There are two IDs: one for PCH Trace Hub, and one for the uncore Trace Hub. These are expected to stay the same across all platforms. Signed-off-by: Alexander Shishkin

intel_th: Allow forcing host mode through drvdata

2018-03-28T15:47:21Z

Some devices can only operate in host mode, so we need means of communicating this to the core driver on per-device basis. This adds a flag to drvdata to signal host-only capability to the core. Signed-off-by: Alexander Shishkin

intel_th: Pick up irq number from resources

2018-03-28T15:47:21Z

Platform devices pass their IRQs around as resources, so as a convenience for the glue layer code, allow them pass the IRQ to the core driver in the resources array. Signed-off-by: Alexander Shishkin

intel_th: Don't touch switch routing in host mode

2018-03-28T15:47:20Z

When the Trace Hub is operating in Host Debugger mode, it is up to the debugger to configure master routing even for the software sources. Do not do this in the driver in this case. Signed-off-by: Alexander Shishkin