'rmmod pmt_telemetry' panics with: BUG: kernel NULL pointer dereference, address: 0000000000000040 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 4 PID: 1697 Comm: rmmod Tainted: G S W -------- --- 5.18.0-rc4 #3 Hardware name: Intel Corporation Alder Lake Client Platform/AlderLake-P DDR5 RVP, BIOS ADLPFWI1.R00.3056.B00.2201310233 01/31/2022 RIP: 0010:device_del+0x1b/0x3d0 Code: e8 1a d9 e9 ff e9 58 ff ff ff 48 8b 08 eb dc 0f 1f 44 00 00 41 56 41 55 41 54 55 48 8d af 80 00 00 00 53 48 89 fb 48 83 ec 18 <4c> 8b 67 40 48 89 ef 65 48 8b 04 25 28 00 00 00 48 89 44 24 10 31 RSP: 0018:ffffb520415cfd60 EFLAGS: 00010286 RAX: 0000000000000070 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000080 R08: ffffffffffffffff R09: ffffb520415cfd78 R10: 0000000000000002 R11: ffffb520415cfd78 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 FS: 00007f7e198e5740(0000) GS:ffff905c9f700000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000040 CR3: 000000010782a005 CR4: 0000000000770ee0 PKRU: 55555554 Call Trace: <TASK> ? __xa_erase+0x53/0xb0 device_unregister+0x13/0x50 intel_pmt_dev_destroy+0x34/0x60 [pmt_class] pmt_telem_remove+0x40/0x50 [pmt_telemetry] auxiliary_bus_remove+0x18/0x30 device_release_driver_internal+0xc1/0x150 driver_detach+0x44/0x90 bus_remove_driver+0x74/0xd0 auxiliary_driver_unregister+0x12/0x20 pmt_telem_exit+0xc/0xe4a [pmt_telemetry] __x64_sys_delete_module+0x13a/0x250 ? syscall_trace_enter.isra.19+0x11e/0x1a0 do_syscall_64+0x58/0x80 ? syscall_exit_to_user_mode+0x12/0x30 ? do_syscall_64+0x67/0x80 ? syscall_exit_to_user_mode+0x12/0x30 ? do_syscall_64+0x67/0x80 ? syscall_exit_to_user_mode+0x12/0x30 ? do_syscall_64+0x67/0x80 ? exc_page_fault+0x64/0x140 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7f7e1803a05b Code: 73 01 c3 48 8b 0d 2d 4e 38 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa b8 b0 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d fd 4d 38 00 f7 d8 64 89 01 48 The probe function, pmt_telem_probe(), adds an entry for devices even if they have not been initialized. This results in the array of initialized devices containing both initialized and uninitialized entries. This causes a panic in the remove function, pmt_telem_remove() which expects the array to only contain initialized entries. Only use an entry when a device is initialized. Cc: "David E. Box" <david.e.box@linux.intel.com> Cc: Hans de Goede <hdegoede@redhat.com> Cc: Mark Gross <markgross@kernel.org> Cc: platform-driver-x86@vger.kernel.org Signed-off-by: David Arcari <darcari@redhat.com> Signed-off-by: Prarit Bhargava <prarit@redhat.com> Reviewed-by: David E. Box <david.e.box@linux.intel.com> Link: https://lore.kernel.org/r/20220429122322.2550003-1-prarit@redhat.com Reviewed-by: Hans de Goede <hdegoede@redhat.com> Signed-off-by: Hans de Goede <hdegoede@redhat.com>
150 lines
3.7 KiB
C
150 lines
3.7 KiB
C
// SPDX-License-Identifier: GPL-2.0
|
|
/*
|
|
* Intel Platform Monitory Technology Telemetry driver
|
|
*
|
|
* Copyright (c) 2020, Intel Corporation.
|
|
* All Rights Reserved.
|
|
*
|
|
* Author: "David E. Box" <david.e.box@linux.intel.com>
|
|
*/
|
|
|
|
#include <linux/auxiliary_bus.h>
|
|
#include <linux/kernel.h>
|
|
#include <linux/module.h>
|
|
#include <linux/pci.h>
|
|
#include <linux/slab.h>
|
|
#include <linux/uaccess.h>
|
|
#include <linux/overflow.h>
|
|
|
|
#include "../vsec.h"
|
|
#include "class.h"
|
|
|
|
#define TELEM_SIZE_OFFSET 0x0
|
|
#define TELEM_GUID_OFFSET 0x4
|
|
#define TELEM_BASE_OFFSET 0x8
|
|
#define TELEM_ACCESS(v) ((v) & GENMASK(3, 0))
|
|
/* size is in bytes */
|
|
#define TELEM_SIZE(v) (((v) & GENMASK(27, 12)) >> 10)
|
|
|
|
/* Used by client hardware to identify a fixed telemetry entry*/
|
|
#define TELEM_CLIENT_FIXED_BLOCK_GUID 0x10000000
|
|
|
|
struct pmt_telem_priv {
|
|
int num_entries;
|
|
struct intel_pmt_entry entry[];
|
|
};
|
|
|
|
static bool pmt_telem_region_overlaps(struct intel_pmt_entry *entry,
|
|
struct device *dev)
|
|
{
|
|
u32 guid = readl(entry->disc_table + TELEM_GUID_OFFSET);
|
|
|
|
if (guid != TELEM_CLIENT_FIXED_BLOCK_GUID)
|
|
return false;
|
|
|
|
return intel_pmt_is_early_client_hw(dev);
|
|
}
|
|
|
|
static int pmt_telem_header_decode(struct intel_pmt_entry *entry,
|
|
struct intel_pmt_header *header,
|
|
struct device *dev)
|
|
{
|
|
void __iomem *disc_table = entry->disc_table;
|
|
|
|
if (pmt_telem_region_overlaps(entry, dev))
|
|
return 1;
|
|
|
|
header->access_type = TELEM_ACCESS(readl(disc_table));
|
|
header->guid = readl(disc_table + TELEM_GUID_OFFSET);
|
|
header->base_offset = readl(disc_table + TELEM_BASE_OFFSET);
|
|
|
|
/* Size is measured in DWORDS, but accessor returns bytes */
|
|
header->size = TELEM_SIZE(readl(disc_table));
|
|
|
|
/*
|
|
* Some devices may expose non-functioning entries that are
|
|
* reserved for future use. They have zero size. Do not fail
|
|
* probe for these. Just ignore them.
|
|
*/
|
|
if (header->size == 0)
|
|
return 1;
|
|
|
|
return 0;
|
|
}
|
|
|
|
static DEFINE_XARRAY_ALLOC(telem_array);
|
|
static struct intel_pmt_namespace pmt_telem_ns = {
|
|
.name = "telem",
|
|
.xa = &telem_array,
|
|
.pmt_header_decode = pmt_telem_header_decode,
|
|
};
|
|
|
|
static void pmt_telem_remove(struct auxiliary_device *auxdev)
|
|
{
|
|
struct pmt_telem_priv *priv = auxiliary_get_drvdata(auxdev);
|
|
int i;
|
|
|
|
for (i = 0; i < priv->num_entries; i++)
|
|
intel_pmt_dev_destroy(&priv->entry[i], &pmt_telem_ns);
|
|
}
|
|
|
|
static int pmt_telem_probe(struct auxiliary_device *auxdev, const struct auxiliary_device_id *id)
|
|
{
|
|
struct intel_vsec_device *intel_vsec_dev = auxdev_to_ivdev(auxdev);
|
|
struct pmt_telem_priv *priv;
|
|
size_t size;
|
|
int i, ret;
|
|
|
|
size = struct_size(priv, entry, intel_vsec_dev->num_resources);
|
|
priv = devm_kzalloc(&auxdev->dev, size, GFP_KERNEL);
|
|
if (!priv)
|
|
return -ENOMEM;
|
|
|
|
auxiliary_set_drvdata(auxdev, priv);
|
|
|
|
for (i = 0; i < intel_vsec_dev->num_resources; i++) {
|
|
struct intel_pmt_entry *entry = &priv->entry[priv->num_entries];
|
|
|
|
ret = intel_pmt_dev_create(entry, &pmt_telem_ns, intel_vsec_dev, i);
|
|
if (ret < 0)
|
|
goto abort_probe;
|
|
if (ret)
|
|
continue;
|
|
|
|
priv->num_entries++;
|
|
}
|
|
|
|
return 0;
|
|
abort_probe:
|
|
pmt_telem_remove(auxdev);
|
|
return ret;
|
|
}
|
|
|
|
static const struct auxiliary_device_id pmt_telem_id_table[] = {
|
|
{ .name = "intel_vsec.telemetry" },
|
|
{}
|
|
};
|
|
MODULE_DEVICE_TABLE(auxiliary, pmt_telem_id_table);
|
|
|
|
static struct auxiliary_driver pmt_telem_aux_driver = {
|
|
.id_table = pmt_telem_id_table,
|
|
.remove = pmt_telem_remove,
|
|
.probe = pmt_telem_probe,
|
|
};
|
|
|
|
static int __init pmt_telem_init(void)
|
|
{
|
|
return auxiliary_driver_register(&pmt_telem_aux_driver);
|
|
}
|
|
module_init(pmt_telem_init);
|
|
|
|
static void __exit pmt_telem_exit(void)
|
|
{
|
|
auxiliary_driver_unregister(&pmt_telem_aux_driver);
|
|
xa_destroy(&telem_array);
|
|
}
|
|
module_exit(pmt_telem_exit);
|
|
|
|
MODULE_AUTHOR("David E. Box <david.e.box@linux.intel.com>");
|
|
MODULE_DESCRIPTION("Intel PMT Telemetry driver");
|
|
MODULE_LICENSE("GPL v2");
|