• Suzuki K Poulose's avatar
    coresight: trbe: Work around write to out of range · f9efc79d
    Suzuki K Poulose authored
    TRBE implementations affected by Arm erratum (2253138 or 2224489), could
    write to the next address after the TRBLIMITR.LIMIT, instead of wrapping
    to the TRBBASER. This implies that the TRBE could potentially corrupt :
    
      - A page used by the rest of the kernel/user (if the LIMIT = end of
        perf ring buffer)
      - A page within the ring buffer, but outside the driver's range.
        [head, head + size]. This may contain some trace data, may be
        consumed by the userspace.
    
    We workaround this erratum by :
      - Making sure that there is at least an extra PAGE space left in the
        TRBE's range than we normally assign. This will be additional to other
        restrictions (e.g, the TRBE alignment for working around
        TRBE_WORKAROUND_OVERWRITE_IN_FILL_MODE, where there is a minimum of
        PAGE_SIZE. Thus we would have 2 * PAGE_SIZE)
    
      - Adjust the LIMIT to leave the last PAGE_SIZE out of the TRBE's allowed
        range (i.e, TRBEBASER...TRBLIMITR.LIMIT), by :
    
            TRBLIMITR.LIMIT -= PAGE_SIZE
    
    Cc: Anshuman Khandual <anshuman.khandual@arm.com>
    Cc: Mathieu Poirier <mathieu.poirier@linaro.org>
    Cc: Mike Leach <mike.leach@linaro.org>
    Cc: Leo Yan <leo.yan@linaro.org>
    Reviewed-by: default avatarAnshuman Khandual <anshuman.khandual@arm.com>
    Signed-off-by: default avatarSuzuki K Poulose <suzuki.poulose@arm.com>
    Link: https://lore.kernel.org/r/20211019163153.3692640-14-suzuki.poulose@arm.comSigned-off-by: default avatarMathieu Poirier <mathieu.poirier@linaro.org>
    f9efc79d
coresight-trbe.c 44.5 KB