From 33a154a96e71a34a1bcca9f40da343dbbf7b38b4 Mon Sep 17 00:00:00 2001 From: Alexei Starovoitov Date: Thu, 1 Oct 2026 14:52:55 +0000 Subject: selftests/bpf: Test packet range of pointers sharing an id Add tests where two packet pointers share an id and tightening one pointer's umax from its var_off would put it less than their constant distance from the other's umax: with an index & 0x38 capped at 50, the base pointer keeps umax 50, so the pointer 8 bytes further on must keep umax 58, even though its known bits allow at most 56. These refused a valid program or accepted an out-of-bounds access before the fix: - check the advanced copy, load through the base: valid, was refused; - check the base, load the byte at base + 1 through a copy advanced by 8: was accepted; - check base + 4, load 4 bytes at base + 2 through base + 8: reads two bytes past the checked range, was accepted; - the same as the second with data_meta pointers checked against data: was accepted. These pass with and without the fix and cover nearby paths: - subtract an unknown scalar from a checked pointer and load below it (the range is kept across a new id); - reach a load through two paths whose checks cover 8 and 7 bytes after the loaded pointer; the second path must not be pruned by the first; - spill a copy of a pointer, check the pointer, fill the copy and load one byte past the checked range: the load is refused, and the copy has the range of the check. Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/20261001145255.855630-2-alexei.starovoitov@gmail.com Signed-off-by: Kumar Kartikeya Dwivedi --- include/sound/sof/trace.h | 107 ++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 107 insertions(+) create mode 100644 include/sound/sof/trace.h (limited to 'include/sound/sof/trace.h') diff --git a/include/sound/sof/trace.h b/include/sound/sof/trace.h new file mode 100644 index 000000000..ac2ebb6fb --- /dev/null +++ b/include/sound/sof/trace.h @@ -0,0 +1,107 @@ +/* SPDX-License-Identifier: (GPL-2.0-only OR BSD-3-Clause) */ +/* + * This file is provided under a dual BSD/GPLv2 license. When using or + * redistributing this file, you may do so under either license. + * + * Copyright(c) 2018 Intel Corporation + */ + +#ifndef __INCLUDE_SOUND_SOF_TRACE_H__ +#define __INCLUDE_SOUND_SOF_TRACE_H__ + +#include +#include + +/* + * DMA for Trace + */ + +#define SOF_TRACE_FILENAME_SIZE 32 + +/* DMA for Trace params info - SOF_IPC_DEBUG_DMA_PARAMS */ +/* Deprecated - use sof_ipc_dma_trace_params_ext */ +struct sof_ipc_dma_trace_params { + struct sof_ipc_cmd_hdr hdr; + struct sof_ipc_host_buffer buffer; + uint32_t stream_tag; +} __packed; + +/* DMA for Trace params info - SOF_IPC_DEBUG_DMA_PARAMS_EXT */ +struct sof_ipc_dma_trace_params_ext { + struct sof_ipc_cmd_hdr hdr; + struct sof_ipc_host_buffer buffer; + uint32_t stream_tag; + uint64_t timestamp_ns; /* in nanosecond */ + uint32_t reserved[8]; +} __packed; + +/* DMA for Trace params info - SOF_IPC_DEBUG_DMA_PARAMS */ +struct sof_ipc_dma_trace_posn { + struct sof_ipc_reply rhdr; + uint32_t host_offset; /* Offset of DMA host buffer */ + uint32_t overflow; /* overflow bytes if any */ + uint32_t messages; /* total trace messages */ +} __packed; + +/* Values used in sof_ipc_trace_filter_elem: */ + +/* bits 6..0 */ +#define SOF_IPC_TRACE_FILTER_ELEM_SET_LEVEL 0x01 /**< trace level for selected components */ +#define SOF_IPC_TRACE_FILTER_ELEM_BY_UUID 0x02 /**< filter by uuid key */ +#define SOF_IPC_TRACE_FILTER_ELEM_BY_PIPE 0x03 /**< filter by pipeline */ +#define SOF_IPC_TRACE_FILTER_ELEM_BY_COMP 0x04 /**< filter by component id */ + +/* bit 7 */ +#define SOF_IPC_TRACE_FILTER_ELEM_FIN 0x80 /**< mark last filter in set */ + +/* bits 31..8: Unused */ + +/** part of sof_ipc_trace_filter, ABI3.17 */ +struct sof_ipc_trace_filter_elem { + uint32_t key; /**< SOF_IPC_TRACE_FILTER_ELEM_ {LEVEL, UUID, COMP, PIPE} */ + uint32_t value; /**< element value */ +} __packed; + +/** Runtime tracing filtration data - SOF_IPC_TRACE_FILTER_UPDATE, ABI3.17 */ +struct sof_ipc_trace_filter { + struct sof_ipc_cmd_hdr hdr; /**< IPC command header */ + uint32_t elem_cnt; /**< number of entries in elems[] array */ + uint32_t reserved[8]; /**< reserved for future usage */ + /** variable size array with new filtering settings */ + struct sof_ipc_trace_filter_elem elems[]; +} __packed; + +/* + * Commom debug + */ + +/* + * SOF panic codes + */ +#define SOF_IPC_PANIC_MAGIC 0x0dead000 +#define SOF_IPC_PANIC_MAGIC_MASK 0x0ffff000 +#define SOF_IPC_PANIC_CODE_MASK 0x00000fff +#define SOF_IPC_PANIC_MEM (SOF_IPC_PANIC_MAGIC | 0x0) +#define SOF_IPC_PANIC_WORK (SOF_IPC_PANIC_MAGIC | 0x1) +#define SOF_IPC_PANIC_IPC (SOF_IPC_PANIC_MAGIC | 0x2) +#define SOF_IPC_PANIC_ARCH (SOF_IPC_PANIC_MAGIC | 0x3) +#define SOF_IPC_PANIC_PLATFORM (SOF_IPC_PANIC_MAGIC | 0x4) +#define SOF_IPC_PANIC_TASK (SOF_IPC_PANIC_MAGIC | 0x5) +#define SOF_IPC_PANIC_EXCEPTION (SOF_IPC_PANIC_MAGIC | 0x6) +#define SOF_IPC_PANIC_DEADLOCK (SOF_IPC_PANIC_MAGIC | 0x7) +#define SOF_IPC_PANIC_STACK (SOF_IPC_PANIC_MAGIC | 0x8) +#define SOF_IPC_PANIC_IDLE (SOF_IPC_PANIC_MAGIC | 0x9) +#define SOF_IPC_PANIC_WFI (SOF_IPC_PANIC_MAGIC | 0xa) +#define SOF_IPC_PANIC_ASSERT (SOF_IPC_PANIC_MAGIC | 0xb) + +/* panic info include filename and line number + * filename array will not include null terminator if fully filled + */ +struct sof_ipc_panic_info { + struct sof_ipc_hdr hdr; + uint32_t code; /* SOF_IPC_PANIC_ */ + uint8_t filename[SOF_TRACE_FILENAME_SIZE]; + uint32_t linenum; +} __packed; + +#endif -- cgit v1.3.1