linux-kernel - Re: [PATCH 4/5] coresight: trbe: Move irq

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <c6f23f94-3ee1-c9ff-819c-18092c8cd660@arm.com>
Date:   Thu, 15 Jul 2021 09:33:49 +0100
From:   Suzuki K Poulose <suzuki.poulose@....com>
To:     Anshuman Khandual <anshuman.khandual@....com>,
        linux-arm-kernel@...ts.infradead.org
Cc:     coresight@...ts.linaro.org, linux-kernel@...r.kernel.org,
        al.grant@....com, leo.yan@...aro.org, mathieu.poirier@...aro.org,
        mike.leach@...aro.org, peterz@...radead.org, Tamas.Zsoldos@....com,
        will@...nel.org
Subject: Re: [PATCH 4/5] coresight: trbe: Move irq_work queue processing

On 15/07/2021 04:23, Anshuman Khandual wrote:
> 
> 
> On 7/12/21 5:08 PM, Suzuki K Poulose wrote:
>> The TRBE driver issues the irq_work_run() to ensure that
>> any pending disable event callback has been processed. But this
>> is done before we mark the AUX buffer as TRUNCATED, making
>> the call pointless. Move the call after the current handle
>> has been closed.
> 
> So there is a possibility that a disable event gets missed before
> the buffer is marked TRUNCATED ? But even then would not another

No, it is the other way around. A disable event is triggered
in response to the TRUNCATED flag.

> disable event be triggered again subsequently ? Just trying to
> understand what is the actual problem because of the current
> placement of irq_work_run() ?

That begs the question, What is the purpose of irq_work_run() ?
See below.

> 
>>
>> Fixes: 3fbf7f011f24 ("coresight: sink: Add TRBE driver")
>> Reported-by: Tamas Zsoldos <Tamas.Zsoldos@....com>
>> Cc: Anshuman Khandual <anshuman.khandual@....com>
>> Cc: Mathieu Poirier <mathieu.poirier@...aro.org>
>> Cc: Mike Leach <mike.leach@...aro.org>
>> Cc: Peter Zijlstra (Intel) <peterz@...radead.org>
>> Cc: Leo Yan <leo.yan@...aro.org>
>> Cc: Will Deacon <will@...nel.org>
>> Signed-off-by: Suzuki K Poulose <suzuki.poulose@....com>
>> ---
>>   drivers/hwtracing/coresight/coresight-trbe.c | 14 ++++++++------
>>   1 file changed, 8 insertions(+), 6 deletions(-)
>>
>> diff --git a/drivers/hwtracing/coresight/coresight-trbe.c b/drivers/hwtracing/coresight/coresight-trbe.c
>> index ec38cf17b693..c0c264264427 100644
>> --- a/drivers/hwtracing/coresight/coresight-trbe.c
>> +++ b/drivers/hwtracing/coresight/coresight-trbe.c
>> @@ -723,6 +723,14 @@ static void trbe_handle_overflow(struct perf_output_handle *handle)
>>   	perf_aux_output_flag(handle, PERF_AUX_FLAG_CORESIGHT_FORMAT_RAW |
>>   				     PERF_AUX_FLAG_TRUNCATED);
>>   	perf_aux_output_end(handle, size);
>> +
>> +	/*
>> +	 * Ensure perf callbacks have completed. Since we
>> +	 * always TRUNCATE the buffer on IRQ, the event
>> +	 * is scheduled to be disabled. Make sure that happens
>> +	 * as soon as possible.
>> +	 */
>> +	irq_work_run();
>>   }
>>   
>>   static bool is_perf_trbe(struct perf_output_handle *handle)
>> @@ -777,12 +785,6 @@ static irqreturn_t arm_trbe_irq_handler(int irq, void *dev)
>>   	if (!is_perf_trbe(handle))
>>   		return IRQ_NONE;
>>   
>> -	/*
>> -	 * Ensure perf callbacks have completed, which may disable
>> -	 * the trace buffer in response to a TRUNCATION flag.
>> -	 */

This comment here explains what the irq_work_run() is supposed to do.
This clearly indicates that the event will be disabled in response
to TRUNCATION. Now, we haven't updated the buffer flags yet here.
It happens *after* this call, in handle_overflow(). So, this is placed
incorrectly. The purpose of this patch is to make sure that we actually
complete the callbacks in response to the TRUNCATED flag we set with
this IRQ.

>> -	irq_work_run();
>> -
>>   	act = trbe_get_fault_act(status);
>>   	switch (act) {
>>   	case TRBE_FAULT_ACT_WRAP:
>>

Suzuki