coresight: replicator: Fix panic for clearing claim tag

[PATCH] coresight: replicator: Fix panic for clearing claim tag

Posted by Leo Yan 9 months, 1 week ago

On platforms with a static replicator, a kernel panic occurs during boot:

  [    4.999406]  replicator_probe+0x1f8/0x360
  [    5.003455]  replicator_platform_probe+0x64/0xd8
  [    5.008115]  platform_probe+0x70/0xf0
  [    5.011812]  really_probe+0xc4/0x2a8
  [    5.015417]  __driver_probe_device+0x80/0x140
  [    5.019813]  driver_probe_device+0xe4/0x170
  [    5.024032]  __driver_attach+0x9c/0x1b0
  [    5.027900]  bus_for_each_dev+0x7c/0xe8
  [    5.031769]  driver_attach+0x2c/0x40
  [    5.035373]  bus_add_driver+0xec/0x218
  [    5.039154]  driver_register+0x68/0x138
  [    5.043023]  __platform_driver_register+0x2c/0x40
  [    5.047771]  coresight_init_driver+0x4c/0xe0
  [    5.052079]  replicator_init+0x30/0x48
  [    5.055865]  do_one_initcall+0x4c/0x280
  [    5.059736]  kernel_init_freeable+0x1ec/0x3c8
  [    5.064134]  kernel_init+0x28/0x1f0
  [    5.067655]  ret_from_fork+0x10/0x20

A static replicator doesn't have registers, so accessing the claim
register results in a NULL pointer deference.  Fixes the issue by
accessing the claim registers only after the I/O resource has been
successfully mapped.

Fixes: 6f4c6f70575f ("coresight: Clear self hosted claim tag on probe")
Signed-off-by: Leo Yan <leo.yan@arm.com>
---
 drivers/hwtracing/coresight/coresight-replicator.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/hwtracing/coresight/coresight-replicator.c b/drivers/hwtracing/coresight/coresight-replicator.c
index f1d2f764e898..06efd2b01a0f 100644
--- a/drivers/hwtracing/coresight/coresight-replicator.c
+++ b/drivers/hwtracing/coresight/coresight-replicator.c
@@ -262,6 +262,7 @@ static int replicator_probe(struct device *dev, struct resource *res)
 		drvdata->base = base;
 		desc.groups = replicator_groups;
 		desc.access = CSDEV_ACCESS_IOMEM(base);
+		coresight_clear_self_claim_tag(&desc.access);
 	}
 
 	if (fwnode_property_present(dev_fwnode(dev),
@@ -284,7 +285,6 @@ static int replicator_probe(struct device *dev, struct resource *res)
 	desc.pdata = dev->platform_data;
 	desc.dev = dev;
 
-	coresight_clear_self_claim_tag(&desc.access);
 	drvdata->csdev = coresight_register(&desc);
 	if (IS_ERR(drvdata->csdev)) {
 		ret = PTR_ERR(drvdata->csdev);
-- 
2.34.1

Re: [PATCH] coresight: replicator: Fix panic for clearing claim tag

Posted by Suzuki K Poulose 9 months ago

On Fri, 02 May 2025 12:11:08 +0100, Leo Yan wrote:
> On platforms with a static replicator, a kernel panic occurs during boot:
> 
>   [    4.999406]  replicator_probe+0x1f8/0x360
>   [    5.003455]  replicator_platform_probe+0x64/0xd8
>   [    5.008115]  platform_probe+0x70/0xf0
>   [    5.011812]  really_probe+0xc4/0x2a8
>   [    5.015417]  __driver_probe_device+0x80/0x140
>   [    5.019813]  driver_probe_device+0xe4/0x170
>   [    5.024032]  __driver_attach+0x9c/0x1b0
>   [    5.027900]  bus_for_each_dev+0x7c/0xe8
>   [    5.031769]  driver_attach+0x2c/0x40
>   [    5.035373]  bus_add_driver+0xec/0x218
>   [    5.039154]  driver_register+0x68/0x138
>   [    5.043023]  __platform_driver_register+0x2c/0x40
>   [    5.047771]  coresight_init_driver+0x4c/0xe0
>   [    5.052079]  replicator_init+0x30/0x48
>   [    5.055865]  do_one_initcall+0x4c/0x280
>   [    5.059736]  kernel_init_freeable+0x1ec/0x3c8
>   [    5.064134]  kernel_init+0x28/0x1f0
>   [    5.067655]  ret_from_fork+0x10/0x20
> 
> [...]

Applied, thanks!

[1/1] coresight: replicator: Fix panic for clearing claim tag
      https://git.kernel.org/coresight/c/f42df204

Best regards,
-- 
Suzuki K Poulose <suzuki.poulose@arm.com>

Re: [PATCH] coresight: replicator: Fix panic for clearing claim tag

Posted by James Clark 9 months ago


On 02/05/2025 12:11 pm, Leo Yan wrote:
> On platforms with a static replicator, a kernel panic occurs during boot:
> 
>    [    4.999406]  replicator_probe+0x1f8/0x360
>    [    5.003455]  replicator_platform_probe+0x64/0xd8
>    [    5.008115]  platform_probe+0x70/0xf0
>    [    5.011812]  really_probe+0xc4/0x2a8
>    [    5.015417]  __driver_probe_device+0x80/0x140
>    [    5.019813]  driver_probe_device+0xe4/0x170
>    [    5.024032]  __driver_attach+0x9c/0x1b0
>    [    5.027900]  bus_for_each_dev+0x7c/0xe8
>    [    5.031769]  driver_attach+0x2c/0x40
>    [    5.035373]  bus_add_driver+0xec/0x218
>    [    5.039154]  driver_register+0x68/0x138
>    [    5.043023]  __platform_driver_register+0x2c/0x40
>    [    5.047771]  coresight_init_driver+0x4c/0xe0
>    [    5.052079]  replicator_init+0x30/0x48
>    [    5.055865]  do_one_initcall+0x4c/0x280
>    [    5.059736]  kernel_init_freeable+0x1ec/0x3c8
>    [    5.064134]  kernel_init+0x28/0x1f0
>    [    5.067655]  ret_from_fork+0x10/0x20
> 
> A static replicator doesn't have registers, so accessing the claim
> register results in a NULL pointer deference.  Fixes the issue by
> accessing the claim registers only after the I/O resource has been
> successfully mapped.
> 
> Fixes: 6f4c6f70575f ("coresight: Clear self hosted claim tag on probe")
> Signed-off-by: Leo Yan <leo.yan@arm.com>
> ---
>   drivers/hwtracing/coresight/coresight-replicator.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/hwtracing/coresight/coresight-replicator.c b/drivers/hwtracing/coresight/coresight-replicator.c
> index f1d2f764e898..06efd2b01a0f 100644
> --- a/drivers/hwtracing/coresight/coresight-replicator.c
> +++ b/drivers/hwtracing/coresight/coresight-replicator.c
> @@ -262,6 +262,7 @@ static int replicator_probe(struct device *dev, struct resource *res)
>   		drvdata->base = base;
>   		desc.groups = replicator_groups;
>   		desc.access = CSDEV_ACCESS_IOMEM(base);
> +		coresight_clear_self_claim_tag(&desc.access);
>   	}
>   
>   	if (fwnode_property_present(dev_fwnode(dev),
> @@ -284,7 +285,6 @@ static int replicator_probe(struct device *dev, struct resource *res)
>   	desc.pdata = dev->platform_data;
>   	desc.dev = dev;
>   
> -	coresight_clear_self_claim_tag(&desc.access);
>   	drvdata->csdev = coresight_register(&desc);
>   	if (IS_ERR(drvdata->csdev)) {
>   		ret = PTR_ERR(drvdata->csdev);

Oops. The other occurrence of this is the funnel, but I got that one right.

Reviewed-by: James Clark <james.clark@linaro.org>

Re: [PATCH] coresight: replicator: Fix panic for clearing claim tag

Posted by Leo Yan 9 months ago

On Tue, May 06, 2025 at 10:27:37AM +0100, James Clark wrote:

[...]

> > @@ -262,6 +262,7 @@ static int replicator_probe(struct device *dev, struct resource *res)
> >   		drvdata->base = base;
> >   		desc.groups = replicator_groups;
> >   		desc.access = CSDEV_ACCESS_IOMEM(base);
> > +		coresight_clear_self_claim_tag(&desc.access);
> >   	}
> >   	if (fwnode_property_present(dev_fwnode(dev),
> > @@ -284,7 +285,6 @@ static int replicator_probe(struct device *dev, struct resource *res)
> >   	desc.pdata = dev->platform_data;
> >   	desc.dev = dev;
> > -	coresight_clear_self_claim_tag(&desc.access);
> >   	drvdata->csdev = coresight_register(&desc);
> >   	if (IS_ERR(drvdata->csdev)) {
> >   		ret = PTR_ERR(drvdata->csdev);
> 
> Oops. The other occurrence of this is the funnel, but I got that one right.
> 
> Reviewed-by: James Clark <james.clark@linaro.org>

Thanks for review.  Yes, the funnel driver is fine as it accesses claim
tag for only MMIO mode.

Leo