perf stat: Fix out of bounds CPU map access when handling armv8_pmu events
[linux-2.6-microblaze.git] / drivers / xen / xen-acpi-processor.c
1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3  * Copyright 2012 by Oracle Inc
4  * Author: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
5  *
6  * This code borrows ideas from https://lkml.org/lkml/2011/11/30/249
7  * so many thanks go to Kevin Tian <kevin.tian@intel.com>
8  * and Yu Ke <ke.yu@intel.com>.
9  */
10
11 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
12
13 #include <linux/cpumask.h>
14 #include <linux/cpufreq.h>
15 #include <linux/freezer.h>
16 #include <linux/kernel.h>
17 #include <linux/kthread.h>
18 #include <linux/init.h>
19 #include <linux/module.h>
20 #include <linux/types.h>
21 #include <linux/syscore_ops.h>
22 #include <linux/acpi.h>
23 #include <acpi/processor.h>
24 #include <xen/xen.h>
25 #include <xen/interface/platform.h>
26 #include <asm/xen/hypercall.h>
27
28 static int no_hypercall;
29 MODULE_PARM_DESC(off, "Inhibit the hypercall.");
30 module_param_named(off, no_hypercall, int, 0400);
31
32 /*
33  * Note: Do not convert the acpi_id* below to cpumask_var_t or use cpumask_bit
34  * - as those shrink to nr_cpu_bits (which is dependent on possible_cpu), which
35  * can be less than what we want to put in. Instead use the 'nr_acpi_bits'
36  * which is dynamically computed based on the MADT or x2APIC table.
37  */
38 static unsigned int nr_acpi_bits;
39 /* Mutex to protect the acpi_ids_done - for CPU hotplug use. */
40 static DEFINE_MUTEX(acpi_ids_mutex);
41 /* Which ACPI ID we have processed from 'struct acpi_processor'. */
42 static unsigned long *acpi_ids_done;
43 /* Which ACPI ID exist in the SSDT/DSDT processor definitions. */
44 static unsigned long *acpi_id_present;
45 /* And if there is an _CST definition (or a PBLK) for the ACPI IDs */
46 static unsigned long *acpi_id_cst_present;
47 /* Which ACPI P-State dependencies for a enumerated processor */
48 static struct acpi_psd_package *acpi_psd;
49
50 static int push_cxx_to_hypervisor(struct acpi_processor *_pr)
51 {
52         struct xen_platform_op op = {
53                 .cmd                    = XENPF_set_processor_pminfo,
54                 .interface_version      = XENPF_INTERFACE_VERSION,
55                 .u.set_pminfo.id        = _pr->acpi_id,
56                 .u.set_pminfo.type      = XEN_PM_CX,
57         };
58         struct xen_processor_cx *dst_cx, *dst_cx_states = NULL;
59         struct acpi_processor_cx *cx;
60         unsigned int i, ok;
61         int ret = 0;
62
63         dst_cx_states = kcalloc(_pr->power.count,
64                                 sizeof(struct xen_processor_cx), GFP_KERNEL);
65         if (!dst_cx_states)
66                 return -ENOMEM;
67
68         for (ok = 0, i = 1; i <= _pr->power.count; i++) {
69                 cx = &_pr->power.states[i];
70                 if (!cx->valid)
71                         continue;
72
73                 dst_cx = &(dst_cx_states[ok++]);
74
75                 dst_cx->reg.space_id = ACPI_ADR_SPACE_SYSTEM_IO;
76                 if (cx->entry_method == ACPI_CSTATE_SYSTEMIO) {
77                         dst_cx->reg.bit_width = 8;
78                         dst_cx->reg.bit_offset = 0;
79                         dst_cx->reg.access_size = 1;
80                 } else {
81                         dst_cx->reg.space_id = ACPI_ADR_SPACE_FIXED_HARDWARE;
82                         if (cx->entry_method == ACPI_CSTATE_FFH) {
83                                 /* NATIVE_CSTATE_BEYOND_HALT */
84                                 dst_cx->reg.bit_offset = 2;
85                                 dst_cx->reg.bit_width = 1; /* VENDOR_INTEL */
86                         }
87                         dst_cx->reg.access_size = 0;
88                 }
89                 dst_cx->reg.address = cx->address;
90
91                 dst_cx->type = cx->type;
92                 dst_cx->latency = cx->latency;
93
94                 dst_cx->dpcnt = 0;
95                 set_xen_guest_handle(dst_cx->dp, NULL);
96         }
97         if (!ok) {
98                 pr_debug("No _Cx for ACPI CPU %u\n", _pr->acpi_id);
99                 kfree(dst_cx_states);
100                 return -EINVAL;
101         }
102         op.u.set_pminfo.power.count = ok;
103         op.u.set_pminfo.power.flags.bm_control = _pr->flags.bm_control;
104         op.u.set_pminfo.power.flags.bm_check = _pr->flags.bm_check;
105         op.u.set_pminfo.power.flags.has_cst = _pr->flags.has_cst;
106         op.u.set_pminfo.power.flags.power_setup_done =
107                 _pr->flags.power_setup_done;
108
109         set_xen_guest_handle(op.u.set_pminfo.power.states, dst_cx_states);
110
111         if (!no_hypercall)
112                 ret = HYPERVISOR_platform_op(&op);
113
114         if (!ret) {
115                 pr_debug("ACPI CPU%u - C-states uploaded.\n", _pr->acpi_id);
116                 for (i = 1; i <= _pr->power.count; i++) {
117                         cx = &_pr->power.states[i];
118                         if (!cx->valid)
119                                 continue;
120                         pr_debug("     C%d: %s %d uS\n",
121                                  cx->type, cx->desc, (u32)cx->latency);
122                 }
123         } else if ((ret != -EINVAL) && (ret != -ENOSYS))
124                 /* EINVAL means the ACPI ID is incorrect - meaning the ACPI
125                  * table is referencing a non-existing CPU - which can happen
126                  * with broken ACPI tables. */
127                 pr_err("(CX): Hypervisor error (%d) for ACPI CPU%u\n",
128                        ret, _pr->acpi_id);
129
130         kfree(dst_cx_states);
131
132         return ret;
133 }
134 static struct xen_processor_px *
135 xen_copy_pss_data(struct acpi_processor *_pr,
136                   struct xen_processor_performance *dst_perf)
137 {
138         struct xen_processor_px *dst_states = NULL;
139         unsigned int i;
140
141         BUILD_BUG_ON(sizeof(struct xen_processor_px) !=
142                      sizeof(struct acpi_processor_px));
143
144         dst_states = kcalloc(_pr->performance->state_count,
145                              sizeof(struct xen_processor_px), GFP_KERNEL);
146         if (!dst_states)
147                 return ERR_PTR(-ENOMEM);
148
149         dst_perf->state_count = _pr->performance->state_count;
150         for (i = 0; i < _pr->performance->state_count; i++) {
151                 /* Fortunatly for us, they are both the same size */
152                 memcpy(&(dst_states[i]), &(_pr->performance->states[i]),
153                        sizeof(struct acpi_processor_px));
154         }
155         return dst_states;
156 }
157 static int xen_copy_psd_data(struct acpi_processor *_pr,
158                              struct xen_processor_performance *dst)
159 {
160         struct acpi_psd_package *pdomain;
161
162         BUILD_BUG_ON(sizeof(struct xen_psd_package) !=
163                      sizeof(struct acpi_psd_package));
164
165         /* This information is enumerated only if acpi_processor_preregister_performance
166          * has been called.
167          */
168         dst->shared_type = _pr->performance->shared_type;
169
170         pdomain = &(_pr->performance->domain_info);
171
172         /* 'acpi_processor_preregister_performance' does not parse if the
173          * num_processors <= 1, but Xen still requires it. Do it manually here.
174          */
175         if (pdomain->num_processors <= 1) {
176                 if (pdomain->coord_type == DOMAIN_COORD_TYPE_SW_ALL)
177                         dst->shared_type = CPUFREQ_SHARED_TYPE_ALL;
178                 else if (pdomain->coord_type == DOMAIN_COORD_TYPE_HW_ALL)
179                         dst->shared_type = CPUFREQ_SHARED_TYPE_HW;
180                 else if (pdomain->coord_type == DOMAIN_COORD_TYPE_SW_ANY)
181                         dst->shared_type = CPUFREQ_SHARED_TYPE_ANY;
182
183         }
184         memcpy(&(dst->domain_info), pdomain, sizeof(struct acpi_psd_package));
185         return 0;
186 }
187 static int xen_copy_pct_data(struct acpi_pct_register *pct,
188                              struct xen_pct_register *dst_pct)
189 {
190         /* It would be nice if you could just do 'memcpy(pct, dst_pct') but
191          * sadly the Xen structure did not have the proper padding so the
192          * descriptor field takes two (dst_pct) bytes instead of one (pct).
193          */
194         dst_pct->descriptor = pct->descriptor;
195         dst_pct->length = pct->length;
196         dst_pct->space_id = pct->space_id;
197         dst_pct->bit_width = pct->bit_width;
198         dst_pct->bit_offset = pct->bit_offset;
199         dst_pct->reserved = pct->reserved;
200         dst_pct->address = pct->address;
201         return 0;
202 }
203 static int push_pxx_to_hypervisor(struct acpi_processor *_pr)
204 {
205         int ret = 0;
206         struct xen_platform_op op = {
207                 .cmd                    = XENPF_set_processor_pminfo,
208                 .interface_version      = XENPF_INTERFACE_VERSION,
209                 .u.set_pminfo.id        = _pr->acpi_id,
210                 .u.set_pminfo.type      = XEN_PM_PX,
211         };
212         struct xen_processor_performance *dst_perf;
213         struct xen_processor_px *dst_states = NULL;
214
215         dst_perf = &op.u.set_pminfo.perf;
216
217         dst_perf->platform_limit = _pr->performance_platform_limit;
218         dst_perf->flags |= XEN_PX_PPC;
219         xen_copy_pct_data(&(_pr->performance->control_register),
220                           &dst_perf->control_register);
221         xen_copy_pct_data(&(_pr->performance->status_register),
222                           &dst_perf->status_register);
223         dst_perf->flags |= XEN_PX_PCT;
224         dst_states = xen_copy_pss_data(_pr, dst_perf);
225         if (!IS_ERR_OR_NULL(dst_states)) {
226                 set_xen_guest_handle(dst_perf->states, dst_states);
227                 dst_perf->flags |= XEN_PX_PSS;
228         }
229         if (!xen_copy_psd_data(_pr, dst_perf))
230                 dst_perf->flags |= XEN_PX_PSD;
231
232         if (dst_perf->flags != (XEN_PX_PSD | XEN_PX_PSS | XEN_PX_PCT | XEN_PX_PPC)) {
233                 pr_warn("ACPI CPU%u missing some P-state data (%x), skipping\n",
234                         _pr->acpi_id, dst_perf->flags);
235                 ret = -ENODEV;
236                 goto err_free;
237         }
238
239         if (!no_hypercall)
240                 ret = HYPERVISOR_platform_op(&op);
241
242         if (!ret) {
243                 struct acpi_processor_performance *perf;
244                 unsigned int i;
245
246                 perf = _pr->performance;
247                 pr_debug("ACPI CPU%u - P-states uploaded.\n", _pr->acpi_id);
248                 for (i = 0; i < perf->state_count; i++) {
249                         pr_debug("     %cP%d: %d MHz, %d mW, %d uS\n",
250                         (i == perf->state ? '*' : ' '), i,
251                         (u32) perf->states[i].core_frequency,
252                         (u32) perf->states[i].power,
253                         (u32) perf->states[i].transition_latency);
254                 }
255         } else if ((ret != -EINVAL) && (ret != -ENOSYS))
256                 /* EINVAL means the ACPI ID is incorrect - meaning the ACPI
257                  * table is referencing a non-existing CPU - which can happen
258                  * with broken ACPI tables. */
259                 pr_warn("(_PXX): Hypervisor error (%d) for ACPI CPU%u\n",
260                         ret, _pr->acpi_id);
261 err_free:
262         if (!IS_ERR_OR_NULL(dst_states))
263                 kfree(dst_states);
264
265         return ret;
266 }
267 static int upload_pm_data(struct acpi_processor *_pr)
268 {
269         int err = 0;
270
271         mutex_lock(&acpi_ids_mutex);
272         if (__test_and_set_bit(_pr->acpi_id, acpi_ids_done)) {
273                 mutex_unlock(&acpi_ids_mutex);
274                 return -EBUSY;
275         }
276         if (_pr->flags.power)
277                 err = push_cxx_to_hypervisor(_pr);
278
279         if (_pr->performance && _pr->performance->states)
280                 err |= push_pxx_to_hypervisor(_pr);
281
282         mutex_unlock(&acpi_ids_mutex);
283         return err;
284 }
285 static unsigned int __init get_max_acpi_id(void)
286 {
287         struct xenpf_pcpuinfo *info;
288         struct xen_platform_op op = {
289                 .cmd = XENPF_get_cpuinfo,
290                 .interface_version = XENPF_INTERFACE_VERSION,
291         };
292         int ret = 0;
293         unsigned int i, last_cpu, max_acpi_id = 0;
294
295         info = &op.u.pcpu_info;
296         info->xen_cpuid = 0;
297
298         ret = HYPERVISOR_platform_op(&op);
299         if (ret)
300                 return NR_CPUS;
301
302         /* The max_present is the same irregardless of the xen_cpuid */
303         last_cpu = op.u.pcpu_info.max_present;
304         for (i = 0; i <= last_cpu; i++) {
305                 info->xen_cpuid = i;
306                 ret = HYPERVISOR_platform_op(&op);
307                 if (ret)
308                         continue;
309                 max_acpi_id = max(info->acpi_id, max_acpi_id);
310         }
311         max_acpi_id *= 2; /* Slack for CPU hotplug support. */
312         pr_debug("Max ACPI ID: %u\n", max_acpi_id);
313         return max_acpi_id;
314 }
315 /*
316  * The read_acpi_id and check_acpi_ids are there to support the Xen
317  * oddity of virtual CPUs != physical CPUs in the initial domain.
318  * The user can supply 'xen_max_vcpus=X' on the Xen hypervisor line
319  * which will band the amount of CPUs the initial domain can see.
320  * In general that is OK, except it plays havoc with any of the
321  * for_each_[present|online]_cpu macros which are banded to the virtual
322  * CPU amount.
323  */
324 static acpi_status
325 read_acpi_id(acpi_handle handle, u32 lvl, void *context, void **rv)
326 {
327         u32 acpi_id;
328         acpi_status status;
329         acpi_object_type acpi_type;
330         unsigned long long tmp;
331         union acpi_object object = { 0 };
332         struct acpi_buffer buffer = { sizeof(union acpi_object), &object };
333         acpi_io_address pblk = 0;
334
335         status = acpi_get_type(handle, &acpi_type);
336         if (ACPI_FAILURE(status))
337                 return AE_OK;
338
339         switch (acpi_type) {
340         case ACPI_TYPE_PROCESSOR:
341                 status = acpi_evaluate_object(handle, NULL, NULL, &buffer);
342                 if (ACPI_FAILURE(status))
343                         return AE_OK;
344                 acpi_id = object.processor.proc_id;
345                 pblk = object.processor.pblk_address;
346                 break;
347         case ACPI_TYPE_DEVICE:
348                 status = acpi_evaluate_integer(handle, "_UID", NULL, &tmp);
349                 if (ACPI_FAILURE(status))
350                         return AE_OK;
351                 acpi_id = tmp;
352                 break;
353         default:
354                 return AE_OK;
355         }
356         if (invalid_phys_cpuid(acpi_get_phys_id(handle,
357                                                 acpi_type == ACPI_TYPE_DEVICE,
358                                                 acpi_id))) {
359                 pr_debug("CPU with ACPI ID %u is unavailable\n", acpi_id);
360                 return AE_OK;
361         }
362         /* There are more ACPI Processor objects than in x2APIC or MADT.
363          * This can happen with incorrect ACPI SSDT declerations. */
364         if (acpi_id >= nr_acpi_bits) {
365                 pr_debug("max acpi id %u, trying to set %u\n",
366                          nr_acpi_bits - 1, acpi_id);
367                 return AE_OK;
368         }
369         /* OK, There is a ACPI Processor object */
370         __set_bit(acpi_id, acpi_id_present);
371
372         pr_debug("ACPI CPU%u w/ PBLK:0x%lx\n", acpi_id, (unsigned long)pblk);
373
374         /* It has P-state dependencies */
375         if (!acpi_processor_get_psd(handle, &acpi_psd[acpi_id])) {
376                 pr_debug("ACPI CPU%u w/ PST:coord_type = %llu domain = %llu\n",
377                          acpi_id, acpi_psd[acpi_id].coord_type,
378                          acpi_psd[acpi_id].domain);
379         }
380
381         status = acpi_evaluate_object(handle, "_CST", NULL, &buffer);
382         if (ACPI_FAILURE(status)) {
383                 if (!pblk)
384                         return AE_OK;
385         }
386         /* .. and it has a C-state */
387         __set_bit(acpi_id, acpi_id_cst_present);
388
389         return AE_OK;
390 }
391 static int check_acpi_ids(struct acpi_processor *pr_backup)
392 {
393
394         if (!pr_backup)
395                 return -ENODEV;
396
397         if (acpi_id_present && acpi_id_cst_present)
398                 /* OK, done this once .. skip to uploading */
399                 goto upload;
400
401         /* All online CPUs have been processed at this stage. Now verify
402          * whether in fact "online CPUs" == physical CPUs.
403          */
404         acpi_id_present = bitmap_zalloc(nr_acpi_bits, GFP_KERNEL);
405         if (!acpi_id_present)
406                 return -ENOMEM;
407
408         acpi_id_cst_present = bitmap_zalloc(nr_acpi_bits, GFP_KERNEL);
409         if (!acpi_id_cst_present) {
410                 bitmap_free(acpi_id_present);
411                 return -ENOMEM;
412         }
413
414         acpi_psd = kcalloc(nr_acpi_bits, sizeof(struct acpi_psd_package),
415                            GFP_KERNEL);
416         if (!acpi_psd) {
417                 bitmap_free(acpi_id_present);
418                 bitmap_free(acpi_id_cst_present);
419                 return -ENOMEM;
420         }
421
422         acpi_walk_namespace(ACPI_TYPE_PROCESSOR, ACPI_ROOT_OBJECT,
423                             ACPI_UINT32_MAX,
424                             read_acpi_id, NULL, NULL, NULL);
425         acpi_get_devices(ACPI_PROCESSOR_DEVICE_HID, read_acpi_id, NULL, NULL);
426
427 upload:
428         if (!bitmap_equal(acpi_id_present, acpi_ids_done, nr_acpi_bits)) {
429                 unsigned int i;
430                 for_each_set_bit(i, acpi_id_present, nr_acpi_bits) {
431                         pr_backup->acpi_id = i;
432                         /* Mask out C-states if there are no _CST or PBLK */
433                         pr_backup->flags.power = test_bit(i, acpi_id_cst_present);
434                         /* num_entries is non-zero if we evaluated _PSD */
435                         if (acpi_psd[i].num_entries) {
436                                 memcpy(&pr_backup->performance->domain_info,
437                                        &acpi_psd[i],
438                                        sizeof(struct acpi_psd_package));
439                         }
440                         (void)upload_pm_data(pr_backup);
441                 }
442         }
443
444         return 0;
445 }
446
447 /* acpi_perf_data is a pointer to percpu data. */
448 static struct acpi_processor_performance __percpu *acpi_perf_data;
449
450 static void free_acpi_perf_data(void)
451 {
452         unsigned int i;
453
454         /* Freeing a NULL pointer is OK, and alloc_percpu zeroes. */
455         for_each_possible_cpu(i)
456                 free_cpumask_var(per_cpu_ptr(acpi_perf_data, i)
457                                  ->shared_cpu_map);
458         free_percpu(acpi_perf_data);
459 }
460
461 static int xen_upload_processor_pm_data(void)
462 {
463         struct acpi_processor *pr_backup = NULL;
464         unsigned int i;
465         int rc = 0;
466
467         pr_info("Uploading Xen processor PM info\n");
468
469         for_each_possible_cpu(i) {
470                 struct acpi_processor *_pr;
471                 _pr = per_cpu(processors, i /* APIC ID */);
472                 if (!_pr)
473                         continue;
474
475                 if (!pr_backup) {
476                         pr_backup = kzalloc(sizeof(struct acpi_processor), GFP_KERNEL);
477                         if (pr_backup)
478                                 memcpy(pr_backup, _pr, sizeof(struct acpi_processor));
479                 }
480                 (void)upload_pm_data(_pr);
481         }
482
483         rc = check_acpi_ids(pr_backup);
484         kfree(pr_backup);
485
486         return rc;
487 }
488
489 static void xen_acpi_processor_resume_worker(struct work_struct *dummy)
490 {
491         int rc;
492
493         bitmap_zero(acpi_ids_done, nr_acpi_bits);
494
495         rc = xen_upload_processor_pm_data();
496         if (rc != 0)
497                 pr_info("ACPI data upload failed, error = %d\n", rc);
498 }
499
500 static void xen_acpi_processor_resume(void)
501 {
502         static DECLARE_WORK(wq, xen_acpi_processor_resume_worker);
503
504         /*
505          * xen_upload_processor_pm_data() calls non-atomic code.
506          * However, the context for xen_acpi_processor_resume is syscore
507          * with only the boot CPU online and in an atomic context.
508          *
509          * So defer the upload for some point safer.
510          */
511         schedule_work(&wq);
512 }
513
514 static struct syscore_ops xap_syscore_ops = {
515         .resume = xen_acpi_processor_resume,
516 };
517
518 static int __init xen_acpi_processor_init(void)
519 {
520         unsigned int i;
521         int rc;
522
523         if (!xen_initial_domain())
524                 return -ENODEV;
525
526         nr_acpi_bits = get_max_acpi_id() + 1;
527         acpi_ids_done = bitmap_zalloc(nr_acpi_bits, GFP_KERNEL);
528         if (!acpi_ids_done)
529                 return -ENOMEM;
530
531         acpi_perf_data = alloc_percpu(struct acpi_processor_performance);
532         if (!acpi_perf_data) {
533                 pr_debug("Memory allocation error for acpi_perf_data\n");
534                 bitmap_free(acpi_ids_done);
535                 return -ENOMEM;
536         }
537         for_each_possible_cpu(i) {
538                 if (!zalloc_cpumask_var_node(
539                         &per_cpu_ptr(acpi_perf_data, i)->shared_cpu_map,
540                         GFP_KERNEL, cpu_to_node(i))) {
541                         rc = -ENOMEM;
542                         goto err_out;
543                 }
544         }
545
546         /* Do initialization in ACPI core. It is OK to fail here. */
547         (void)acpi_processor_preregister_performance(acpi_perf_data);
548
549         for_each_possible_cpu(i) {
550                 struct acpi_processor *pr;
551                 struct acpi_processor_performance *perf;
552
553                 pr = per_cpu(processors, i);
554                 perf = per_cpu_ptr(acpi_perf_data, i);
555                 if (!pr)
556                         continue;
557
558                 pr->performance = perf;
559                 rc = acpi_processor_get_performance_info(pr);
560                 if (rc)
561                         goto err_out;
562         }
563
564         rc = xen_upload_processor_pm_data();
565         if (rc)
566                 goto err_unregister;
567
568         register_syscore_ops(&xap_syscore_ops);
569
570         return 0;
571 err_unregister:
572         for_each_possible_cpu(i)
573                 acpi_processor_unregister_performance(i);
574
575 err_out:
576         /* Freeing a NULL pointer is OK: alloc_percpu zeroes. */
577         free_acpi_perf_data();
578         bitmap_free(acpi_ids_done);
579         return rc;
580 }
581 static void __exit xen_acpi_processor_exit(void)
582 {
583         int i;
584
585         unregister_syscore_ops(&xap_syscore_ops);
586         bitmap_free(acpi_ids_done);
587         bitmap_free(acpi_id_present);
588         bitmap_free(acpi_id_cst_present);
589         kfree(acpi_psd);
590         for_each_possible_cpu(i)
591                 acpi_processor_unregister_performance(i);
592
593         free_acpi_perf_data();
594 }
595
596 MODULE_AUTHOR("Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>");
597 MODULE_DESCRIPTION("Xen ACPI Processor P-states (and Cx) driver which uploads PM data to Xen hypervisor");
598 MODULE_LICENSE("GPL");
599
600 /* We want to be loaded before the CPU freq scaling drivers are loaded.
601  * They are loaded in late_initcall. */
602 device_initcall(xen_acpi_processor_init);
603 module_exit(xen_acpi_processor_exit);