Skip to content
Commit 249270c7 authored by Suzuki Poulose's avatar Suzuki Poulose Committed by Qais Yousef
Browse files

UPSTREAM: coresight: trbe: Work around write to out of range



TRBE implementations affected by Arm erratum (2253138 or 2224489), could
write to the next address after the TRBLIMITR.LIMIT, instead of wrapping
to the TRBBASER. This implies that the TRBE could potentially corrupt :

  - A page used by the rest of the kernel/user (if the LIMIT = end of
    perf ring buffer)
  - A page within the ring buffer, but outside the driver's range.
    [head, head + size]. This may contain some trace data, may be
    consumed by the userspace.

We workaround this erratum by :
  - Making sure that there is at least an extra PAGE space left in the
    TRBE's range than we normally assign. This will be additional to other
    restrictions (e.g, the TRBE alignment for working around
    TRBE_WORKAROUND_OVERWRITE_IN_FILL_MODE, where there is a minimum of
    PAGE_SIZE. Thus we would have 2 * PAGE_SIZE)

  - Adjust the LIMIT to leave the last PAGE_SIZE out of the TRBE's allowed
    range (i.e, TRBEBASER...TRBLIMITR.LIMIT), by :

        TRBLIMITR.LIMIT -= PAGE_SIZE

Cc: Anshuman Khandual <anshuman.khandual@arm.com>
Cc: Mathieu Poirier <mathieu.poirier@linaro.org>
Cc: Mike Leach <mike.leach@linaro.org>
Cc: Leo Yan <leo.yan@linaro.org>
Reviewed-by: Anshuman Khandual's avatarAnshuman Khandual <anshuman.khandual@arm.com>
Signed-off-by: Suzuki Poulose's avatarSuzuki K Poulose <suzuki.poulose@arm.com>
Link: https://lore.kernel.org/r/20211019163153.3692640-14-suzuki.poulose@arm.com


Signed-off-by: default avatarMathieu Poirier <mathieu.poirier@linaro.org>
(cherry picked from commit f9efc79d)
Signed-off-by: Qais Yousef's avatarQais Yousef <qais.yousef@arm.com>
Change-Id: I11b66705b6751831c71c219a9d79266afdec7552
parent e9892caf
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment