kernel:ram overwritten by TZ logs to cause random panics

cherry-pick: (CR) kernel:ram overwritten by TZ logs to cause random panics

in panic RAMDump file, we can see the memory in kernel was overwritten by TZ logs
the tzlog strings corrupted the memory address to cause abort on VM to PHY-M
similar panic issue was frequently reported in User build which disable
DebugFS along with tzlog driver which depends on DebugFS. Add the tzlog driver
back, but remove the dependency of DebugFS, instead, use ProcFS for output

Change-Id: If6f9f0bf0fe3ce08c868582a457b207cee07923d
Signed-off-by: wangwang1 <wangwang1@lenovo.com>
Reviewed-on: https://gerrit.mot.com/1836697
SLTApproved: Slta Waiver
SME-Granted: SME Approvals Granted
Tested-by: Jira Key
Reviewed-by: Xiangpo Zhao <zhaoxp3@motorola.com>
Submit-Approved: Jira Key
Reviewed-on: https://gerrit.mot.com/1836767
This commit is contained in:
wangwang1 authored and Gilberto Gambugge committed 2023-06-01 00:47:14 -03:00
1 parent 9679534c60
commit f12accb185
2 files changed
+68 -1

No files matched your search

-1
View File
@@ -1,7 +1,6 @@
# SPDX-License-Identifier: GPL-2.0-only
config MSM_TZ_LOG
tristate "MSM Trust Zone (TZ) Log Driver"
depends on DEBUG_FS
help
This option enables a driver with a debugfs interface for messages
produced by the Secure code (Trust zone). These messages provide
+68
View File
@@ -23,6 +23,13 @@
#include <soc/qcom/qseecomi.h>
#include <soc/qcom/qtee_shmbridge.h>
#ifndef CONFIG_DEBUG_FS
#include <linux/proc_fs.h>
static struct proc_dir_entry *tzdbg_root;
#define TZDBG_ROOT_DIR "tzdbg"
#endif
/* QSEE_LOG_BUF_SIZE = 32K */
#define QSEE_LOG_BUF_SIZE 0x8000
@@ -1131,7 +1138,11 @@ static ssize_t tzdbgfs_read_unencrypted(struct file *file, char __user *buf,
size_t count, loff_t *offp)
{
int len = 0;
#ifdef CONFIG_DEBUG_FS
int tz_id = *(int *)(file->private_data);
#else
int *tz_id = ((struct seq_file *)file->private_data)->private;
#endif
if (tz_id == TZDBG_BOOT || tz_id == TZDBG_RESET ||
tz_id == TZDBG_INTERRUPT || tz_id == TZDBG_GENERAL ||
@@ -1253,10 +1264,22 @@ static ssize_t tzdbgfs_read(struct file *file, char __user *buf,
return tzdbgfs_read_encrypted(file, buf, count, offp);
}
#ifndef CONFIG_DEBUG_FS
static int tzdbg_proc_open(struct inode *inode, struct file *file)
{
return single_open(file, NULL, PDE_DATA(inode));
}
#endif
static const struct file_operations tzdbg_fops = {
.owner = THIS_MODULE,
.read = tzdbgfs_read,
#ifdef CONFIG_DEBUG_FS
.open = simple_open,
#else
.open = tzdbg_proc_open,
#endif
};
@@ -1412,6 +1435,7 @@ static void tzdbg_free_encrypted_log_buf(struct platform_device *pdev)
static int tzdbgfs_init(struct platform_device *pdev)
{
#ifdef CONFIG_DEBUG_FS
int rc = 0;
int i;
struct dentry *dent_dir;
@@ -1441,13 +1465,57 @@ err:
debugfs_remove_recursive(dent_dir);
return rc;
#else
int rc = 0;
int i;
struct proc_dir_entry *proc_d_entry = NULL;
tzdbg_root = proc_mkdir(TZDBG_ROOT_DIR, NULL);
if (NULL == tzdbg_root) {
dev_err(&pdev->dev, "Created dir /proc/%s error!\n", TZDBG_ROOT_DIR);
return -1;
}
dev_info(&pdev->dev, "Created dir /proc/%s \n", TZDBG_ROOT_DIR);
for (i = 0; i < TZDBG_STATS_MAX; i++) {
tzdbg.debug_tz[i] = i;
proc_d_entry = proc_create_data(tzdbg.stat[i].name, 0666, tzdbg_root, &tzdbg_fops, &tzdbg.debug_tz[i]);
if (proc_d_entry == NULL) {
dev_err(&pdev->dev, "TZ proc_create_data %s failed\n", tzdbg.stat[i].name);
rc = -ENOMEM;
goto err;
}
}
tzdbg.disp_buf = kzalloc(max(debug_rw_buf_size,
tzdbg.hyp_debug_rw_buf_size), GFP_KERNEL);
if (tzdbg.disp_buf == NULL)
goto err;
platform_set_drvdata(pdev, tzdbg_root);
return 0;
err:
remove_proc_subtree(TZDBG_ROOT_DIR, NULL);
return -1;
#endif
}
static void tzdbgfs_exit(struct platform_device *pdev)
{
#ifdef CONFIG_DEBUG_FS
struct dentry *dent_dir;
dent_dir = platform_get_drvdata(pdev);
debugfs_remove_recursive(dent_dir);
#else
kzfree(tzdbg.disp_buf);
remove_proc_subtree(TZDBG_ROOT_DIR, NULL);
if (g_qsee_log)
dma_free_coherent(&pdev->dev, QSEE_LOG_BUF_SIZE,
(void *)g_qsee_log, coh_pmem);
#endif
}
static int __update_hypdbg_base(struct platform_device *pdev,