Perf AUX setup walks the CoreSight connections to select a sink, build paths and acquire references to the devices and their helpers. Unlike sysfs tracing, it does not hold coresight_mutex. Driver registration and removal can therefore change or free connections while setup walks them. Adding a CTI helper can also reallocate an existing device's output connection array even when the device is already referenced by a path.
Hold coresight_mutex from sink selection through buffer allocation. The allocation must also be protected because ETR buffers can look up a connected CATU. Release the mutex before calling etm_free_aux() on error.
AUX cleanup walks helper connections again when releasing paths. Add a locking coresight_release_path() wrapper and use coresight_release_path_locked() for sysfs and setup error paths which already hold the mutex. Leave sink buffer freeing and configuration deactivation outside the mutex. AUX cleanup runs in sleepable context following the preceding workqueue removal.
Add lockdep assertions to path construction and release to document the existing sysfs locking contract and enforce it for perf as well. This protects sleepable AUX topology walks; connection reads in atomic path enable/disable callbacks need a separate solution.
Fixes: 0bcbf2e30ff2 ("coresight: etm-perf: new PMU driver for ETM tracers") Signed-off-by: James Clark james.clark@linaro.org --- drivers/hwtracing/coresight/coresight-core.c | 20 ++++++++++++++++---- drivers/hwtracing/coresight/coresight-etm-perf.c | 11 +++++++---- drivers/hwtracing/coresight/coresight-priv.h | 1 + drivers/hwtracing/coresight/coresight-sysfs.c | 4 ++-- 4 files changed, 26 insertions(+), 10 deletions(-)
diff --git a/drivers/hwtracing/coresight/coresight-core.c b/drivers/hwtracing/coresight/coresight-core.c index d2f9c1fb77d9..c05d657cde73 100644 --- a/drivers/hwtracing/coresight/coresight-core.c +++ b/drivers/hwtracing/coresight/coresight-core.c @@ -30,8 +30,8 @@ #include "coresight-trace-id.h"
/* - * Mutex used to lock all sysfs enable and disable actions and loading and - * unloading devices by the Coresight core. + * Mutex used to serialize device registration and removal, sysfs enable and + * disable actions, and perf AUX setup and path release. */ DEFINE_MUTEX(coresight_mutex); static DEFINE_PER_CPU(struct coresight_device *, csdev_sink); @@ -910,6 +910,8 @@ static void coresight_drop_device(struct coresight_device *csdev) { int i;
+ lockdep_assert_held(&coresight_mutex); + coresight_put_ref(csdev); for (i = 0; i < csdev->pdata->nr_outconns; i++) { struct coresight_device *child; @@ -1046,6 +1048,8 @@ struct coresight_path *coresight_build_path(struct coresight_device *source, struct coresight_path *path; int rc;
+ lockdep_assert_held(&coresight_mutex); + if (!sink) return ERR_PTR(-EINVAL);
@@ -1065,17 +1069,19 @@ struct coresight_path *coresight_build_path(struct coresight_device *source, }
/** - * coresight_release_path - release a previously built path. + * coresight_release_path_locked - release a path with coresight_mutex held. * @path: the path to release. * * Go through all the elements of a path and 1) removed it from the list and * 2) free the memory allocated for each node. */ -void coresight_release_path(struct coresight_path *path) +void coresight_release_path_locked(struct coresight_path *path) { struct coresight_device *csdev; struct coresight_node *nd, *next;
+ lockdep_assert_held(&coresight_mutex); + list_for_each_entry_safe(nd, next, &path->path_list, link) { csdev = nd->csdev;
@@ -1087,6 +1093,12 @@ void coresight_release_path(struct coresight_path *path) kfree(path); }
+void coresight_release_path(struct coresight_path *path) +{ + guard(mutex)(&coresight_mutex); + coresight_release_path_locked(path); +} + /* return true if the device is a suitable type for a default sink */ static bool coresight_is_def_sink_type(struct coresight_device *csdev) { diff --git a/drivers/hwtracing/coresight/coresight-etm-perf.c b/drivers/hwtracing/coresight/coresight-etm-perf.c index 09b21a711a87..86ec4708b7e4 100644 --- a/drivers/hwtracing/coresight/coresight-etm-perf.c +++ b/drivers/hwtracing/coresight/coresight-etm-perf.c @@ -411,7 +411,7 @@ etm_event_build_path(struct perf_event *event, int cpu, /* ensure we can allocate a trace ID for this CPU */ ret = coresight_path_assign_trace_id(path, CS_MODE_PERF); if (ret) { - coresight_release_path(path); + coresight_release_path_locked(path); path = NULL; goto out; } @@ -438,6 +438,9 @@ static void *etm_setup_aux(struct perf_event *event, void **pages, return NULL; INIT_WORK(&event_data->work, free_event_data);
+ /* Protect sink selection, path construction and buffer allocation. */ + mutex_lock(&coresight_mutex); + /* First get the selected sink from user space. */ sink_hash = ATTR_CFG_GET_FLD(&event->attr, sinkid); if (sink_hash) @@ -508,13 +511,13 @@ static void *etm_setup_aux(struct perf_event *event, void **pages, if (!event_data->snk_config) goto err;
-out: + mutex_unlock(&coresight_mutex); return event_data;
err: + mutex_unlock(&coresight_mutex); etm_free_aux(event_data); - event_data = NULL; - goto out; + return NULL; }
static int etm_event_resume(struct coresight_path *path) diff --git a/drivers/hwtracing/coresight/coresight-priv.h b/drivers/hwtracing/coresight/coresight-priv.h index dddac946659f..edec5a7d2be3 100644 --- a/drivers/hwtracing/coresight/coresight-priv.h +++ b/drivers/hwtracing/coresight/coresight-priv.h @@ -143,6 +143,7 @@ coresight_find_default_sink(struct coresight_device *csdev); struct coresight_path *coresight_build_path(struct coresight_device *csdev, struct coresight_device *sink); void coresight_release_path(struct coresight_path *path); +void coresight_release_path_locked(struct coresight_path *path); int coresight_add_sysfs_link(struct coresight_sysfs_link *info); void coresight_remove_sysfs_link(struct coresight_sysfs_link *info); int coresight_create_conns_sysfs_group(struct coresight_device *csdev); diff --git a/drivers/hwtracing/coresight/coresight-sysfs.c b/drivers/hwtracing/coresight/coresight-sysfs.c index 75000fe64fda..5dd4e9b0426e 100644 --- a/drivers/hwtracing/coresight/coresight-sysfs.c +++ b/drivers/hwtracing/coresight/coresight-sysfs.c @@ -230,7 +230,7 @@ int coresight_enable_sysfs(struct coresight_device *csdev) coresight_disable_path(path);
err_path: - coresight_release_path(path); + coresight_release_path_locked(path); goto out; } EXPORT_SYMBOL_GPL(coresight_enable_sysfs); @@ -256,7 +256,7 @@ void coresight_disable_sysfs(struct coresight_device *csdev) goto out;
coresight_disable_path(path); - coresight_release_path(path); + coresight_release_path_locked(path);
out: mutex_unlock(&coresight_mutex);