2018-11-01 02:21:09 +08:00
|
|
|
// SPDX-License-Identifier: GPL-2.0+
|
2013-05-22 13:32:14 +08:00
|
|
|
/*
|
|
|
|
* debugfs file to track time spent in suspend
|
|
|
|
*
|
|
|
|
* Copyright (c) 2011, Google, Inc.
|
|
|
|
*/
|
|
|
|
|
|
|
|
#include <linux/debugfs.h>
|
|
|
|
#include <linux/err.h>
|
|
|
|
#include <linux/init.h>
|
|
|
|
#include <linux/kernel.h>
|
|
|
|
#include <linux/seq_file.h>
|
2017-07-23 06:03:43 +08:00
|
|
|
#include <linux/suspend.h>
|
2013-05-22 13:32:14 +08:00
|
|
|
#include <linux/time.h>
|
|
|
|
|
2014-02-27 19:55:54 +08:00
|
|
|
#include "timekeeping_internal.h"
|
|
|
|
|
timekeeping: Cap array access in timekeeping_debug
It was reported that hibernation could fail on the 2nd attempt, where the
system hangs at hibernate() -> syscore_resume() -> i8237A_resume() ->
claim_dma_lock(), because the lock has already been taken.
However there is actually no other process would like to grab this lock on
that problematic platform.
Further investigation showed that the problem is triggered by setting
/sys/power/pm_trace to 1 before the 1st hibernation.
Since once pm_trace is enabled, the rtc becomes unmeaningful after suspend,
and meanwhile some BIOSes would like to adjust the 'invalid' RTC (e.g, smaller
than 1970) to the release date of that motherboard during POST stage, thus
after resumed, it may seem that the system had a significant long sleep time
which is a completely meaningless value.
Then in timekeeping_resume -> tk_debug_account_sleep_time, if the bit31 of the
sleep time happened to be set to 1, fls() returns 32 and we add 1 to
sleep_time_bin[32], which causes an out of bounds array access and therefor
memory being overwritten.
As depicted by System.map:
0xffffffff81c9d080 b sleep_time_bin
0xffffffff81c9d100 B dma_spin_lock
the dma_spin_lock.val is set to 1, which caused this problem.
This patch adds a sanity check in tk_debug_account_sleep_time()
to ensure we don't index past the sleep_time_bin array.
[jstultz: Problem diagnosed and original patch by Chen Yu, I've solved the
issue slightly differently, but borrowed his excelent explanation of the
issue here.]
Fixes: 5c83545f24ab "power: Add option to log time spent in suspend"
Reported-by: Janek Kozicki <cosurgi@gmail.com>
Reported-by: Chen Yu <yu.c.chen@intel.com>
Signed-off-by: John Stultz <john.stultz@linaro.org>
Cc: linux-pm@vger.kernel.org
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Xunlei Pang <xpang@redhat.com>
Cc: "Rafael J. Wysocki" <rjw@rjwysocki.net>
Cc: stable <stable@vger.kernel.org>
Cc: Zhang Rui <rui.zhang@intel.com>
Link: http://lkml.kernel.org/r/1471993702-29148-3-git-send-email-john.stultz@linaro.org
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
2016-08-24 07:08:22 +08:00
|
|
|
#define NUM_BINS 32
|
|
|
|
|
|
|
|
static unsigned int sleep_time_bin[NUM_BINS] = {0};
|
2013-05-22 13:32:14 +08:00
|
|
|
|
2018-12-12 00:37:44 +08:00
|
|
|
static int tk_debug_sleep_time_show(struct seq_file *s, void *data)
|
2013-05-22 13:32:14 +08:00
|
|
|
{
|
|
|
|
unsigned int bin;
|
|
|
|
seq_puts(s, " time (secs) count\n");
|
|
|
|
seq_puts(s, "------------------------------\n");
|
|
|
|
for (bin = 0; bin < 32; bin++) {
|
|
|
|
if (sleep_time_bin[bin] == 0)
|
|
|
|
continue;
|
|
|
|
seq_printf(s, "%10u - %-10u %4u\n",
|
|
|
|
bin ? 1 << (bin - 1) : 0, 1 << bin,
|
|
|
|
sleep_time_bin[bin]);
|
|
|
|
}
|
|
|
|
return 0;
|
|
|
|
}
|
2018-12-12 00:37:44 +08:00
|
|
|
DEFINE_SHOW_ATTRIBUTE(tk_debug_sleep_time);
|
2013-05-22 13:32:14 +08:00
|
|
|
|
|
|
|
static int __init tk_debug_sleep_time_init(void)
|
|
|
|
{
|
2019-01-22 23:21:42 +08:00
|
|
|
debugfs_create_file("sleep_time", 0444, NULL, NULL,
|
|
|
|
&tk_debug_sleep_time_fops);
|
2013-05-22 13:32:14 +08:00
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
late_initcall(tk_debug_sleep_time_init);
|
|
|
|
|
2018-07-13 20:06:42 +08:00
|
|
|
void tk_debug_account_sleep_time(const struct timespec64 *t)
|
2013-05-22 13:32:14 +08:00
|
|
|
{
|
timekeeping: Cap array access in timekeeping_debug
It was reported that hibernation could fail on the 2nd attempt, where the
system hangs at hibernate() -> syscore_resume() -> i8237A_resume() ->
claim_dma_lock(), because the lock has already been taken.
However there is actually no other process would like to grab this lock on
that problematic platform.
Further investigation showed that the problem is triggered by setting
/sys/power/pm_trace to 1 before the 1st hibernation.
Since once pm_trace is enabled, the rtc becomes unmeaningful after suspend,
and meanwhile some BIOSes would like to adjust the 'invalid' RTC (e.g, smaller
than 1970) to the release date of that motherboard during POST stage, thus
after resumed, it may seem that the system had a significant long sleep time
which is a completely meaningless value.
Then in timekeeping_resume -> tk_debug_account_sleep_time, if the bit31 of the
sleep time happened to be set to 1, fls() returns 32 and we add 1 to
sleep_time_bin[32], which causes an out of bounds array access and therefor
memory being overwritten.
As depicted by System.map:
0xffffffff81c9d080 b sleep_time_bin
0xffffffff81c9d100 B dma_spin_lock
the dma_spin_lock.val is set to 1, which caused this problem.
This patch adds a sanity check in tk_debug_account_sleep_time()
to ensure we don't index past the sleep_time_bin array.
[jstultz: Problem diagnosed and original patch by Chen Yu, I've solved the
issue slightly differently, but borrowed his excelent explanation of the
issue here.]
Fixes: 5c83545f24ab "power: Add option to log time spent in suspend"
Reported-by: Janek Kozicki <cosurgi@gmail.com>
Reported-by: Chen Yu <yu.c.chen@intel.com>
Signed-off-by: John Stultz <john.stultz@linaro.org>
Cc: linux-pm@vger.kernel.org
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Xunlei Pang <xpang@redhat.com>
Cc: "Rafael J. Wysocki" <rjw@rjwysocki.net>
Cc: stable <stable@vger.kernel.org>
Cc: Zhang Rui <rui.zhang@intel.com>
Link: http://lkml.kernel.org/r/1471993702-29148-3-git-send-email-john.stultz@linaro.org
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
2016-08-24 07:08:22 +08:00
|
|
|
/* Cap bin index so we don't overflow the array */
|
|
|
|
int bin = min(fls(t->tv_sec), NUM_BINS-1);
|
|
|
|
|
|
|
|
sleep_time_bin[bin]++;
|
2017-07-23 06:03:43 +08:00
|
|
|
pm_deferred_pr_dbg("Timekeeping suspended for %lld.%03lu seconds\n",
|
|
|
|
(s64)t->tv_sec, t->tv_nsec / NSEC_PER_MSEC);
|
2013-05-22 13:32:14 +08:00
|
|
|
}
|
|
|
|
|