[PATCH v2 14/23] coresight: trbe: Treat access not allowed stops as fatal

[Leo Yan]

Arm ARM (ARM DDI 0487 M.b), the rule R_RRCNN in "D6.11 UNPREDICTABLE
behavior" permits a buffer management event when the effective SCR_EL3
security state does not match the owning Security state. This can stop
collection with IRQ=1, S=1, EC=0 and BSC=0 while leaving the other
status fields unchanged.

With EA and WRAP clear, trbe_get_fault_act() currently returns SPURIOUS
for this status. The spurious handler re-enables TRBE without clearing
S, so collection can remain stopped. A retained WRAP indication can
instead cause the status to be treated as a normal buffer wrap.

Recognize this architecturally permitted stopped status as an access
not allowed error and return FATAL so the fatal handling reports
truncated trace. Check the syndrome before WRAP and do not exclude
TRG, since both fields are left unchanged by this stop. Check the saved
IRQ bit to preserve updates without a pending interrupt.

Signed-off-by: Leo Yan <leo.yan@xxxxxxx>
---
 drivers/hwtracing/coresight/coresight-trbe.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/hwtracing/coresight/coresight-trbe.c b/drivers/hwtracing/coresight/coresight-trbe.c
index 4aeed1a17c4bf1653fb41731ac15f31feec7ed2e..1c585b6123df2f20d08747678d836742ce9564cc 100644
--- a/drivers/hwtracing/coresight/coresight-trbe.c
+++ b/drivers/hwtracing/coresight/coresight-trbe.c
@@ -708,6 +708,14 @@ static enum trbe_fault_action trbe_get_fault_act(struct perf_output_handle *hand
 		goto out_fatal;
 	}
 
+	/* An access not allowed stop can leave WRAP and TRG unchanged. */
+	if (is_trbe_irq(trbsr) && !is_trbe_running(trbsr) &&
+	    ec == TRBSR_EL1_EC_OTHER &&
+	    bsc == TRBSR_EL1_BSC_NOT_STOPPED) {
+		err_str = "Trace buffer access not allowed";
+		goto out_fatal;
+	}
+
 	if (is_trbe_wrap(trbsr))
 		return TRBE_FAULT_ACT_WRAP;
 

-- 
2.34.1