The process-context fault path always has a valid user CBR pointer. Inline
the one-use status helper and remove its obsolete NULL check.
No functional change.
Signed-off-by: Muhammad Usama Anjum <usama.anjum@arm.com>
Link: https://patch.msgid.link/20260730111316.3672672-4-usama.anjum@arm.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
After interrupt faults are sent directly to user polling mode, only the
process-context call path remains. Remove the atomic flag passed through
the fault-handling interfaces and the related dead code.
No functional change.
Signed-off-by: Muhammad Usama Anjum <usama.anjum@arm.com>
Link: https://patch.msgid.link/20260730111316.3672672-3-usama.anjum@arm.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
The GRU TLB miss handler walks a process's page tables without holding
page-table locks or a reference to the mapped page. It also uses a kernel
page-table accessor on user page tables and supports only PMD-level large
mappings on x86-64.
Remove the direct walker. Send interrupt faults directly to user polling
mode so the existing call-OS fallback retries them in process context.
Remove the mmap-lock failure statistic that can no longer be incremented.
Fixes: 142586409c ("GRU Driver: page faults & exceptions")
Signed-off-by: Muhammad Usama Anjum <usama.anjum@arm.com>
Link: https://patch.msgid.link/20260730111316.3672672-2-usama.anjum@arm.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
setup_wait() already validates pad and flags but not owner, while
Documentation/userspace-api/ntsync.rst requires EINVAL when owner is
zero. Reject early before queueing waiters.
Signed-off-by: Iván Ezequiel Rodriguez <ivanrwcm25@gmail.com>
Signed-off-by: Griffin Kroah-Hartman <griffin@kroah.com>
Reviewed-by: Elizabeth Figura <zfigura@codeweavers.com>
Signed-off-by: Elizabeth Figura <zfigura@codeweavers.com>
Link: https://patch.msgid.link/20260723201301.11826-4-zfigura@codeweavers.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
The memory allocated for struct vmci_subscription (sub) is not freed
in the error path when have_new_id is false. Fix that by adding a
kfree() call, and moving the read of sub->id to a point before freeing.
Fixes: 1d990201f9 ("VMCI: event handling implementation.")
Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
Acked-by: Vishnu Dasa <vishnu.dasa@broadcom.com>
Link: https://patch.msgid.link/20260722101215.76680-1-nihaal@cse.iitm.ac.in
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
For historical reasons EEPROM drivers have lived under
drivers/misc/eeprom/. Also for historical reasons changes to most of
them would go through the char-misc tree while some would be queued
through the I2C tree. Over the years some of them have also been
converted to using nvmem - the dedicated subsystem for non-volatile
memory - while get_maintainer.pl does not Cc the maintainer of nvmem on
patches changing them.
Move the EEPROM drivers using nvmem under drivers/nvmem/ for
consistency of the review process and path upstream.
Reviewed-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Acked-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Signed-off-by: Srinivas Kandagatla <srini@kernel.org>
Link: https://patch.msgid.link/20260729094647.111468-11-srini@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Newer DSP firmware implements a PD (Protection Domain) notification
framework that sends PD state notifications upon request. The PD exit
notification is unconditionally sent by the DSP with a fixed sentinel
0xABCDABCD in the context field.
fastrpc_rpmsg_callback() treats every inbound message as an invoke
response, so the sentinel is masked and shifted like any real response
((0xABCDABCD & 0xFF0) >> 4 == 188) and looked up in the channel's
context idr.
This is not merely cosmetic. In the common case idr slot 188 is empty,
the lookup fails, and the driver only logs a spurious "No context ID
matches response" error on every teardown. But the context idr is shared
by every protection domain and the listener thread on the channel and is
filled cyclically over [1, FASTRPC_CTX_MAX]. If slot 188 holds a live
context when the sentinel arrives, the sentinel's return value is written
into that unrelated in-flight invocation and it is completed early.
Since neither the fastrpc library nor the driver supports the DSP PD
notification framework, it is safe to drop the PD exit notification
before it is ever turned into a context lookup. This removes both the
log spam and the mis-completion race. A genuine response can never be
masked: a real context is (idr_index << 4) | pd (at most 0xFF3) and
can never equal the sentinel.
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Ekansh Gupta <ekansh.gupta@oss.qualcomm.com>
Signed-off-by: Shawn Guo <shengchao.guo@oss.qualcomm.com>
Signed-off-by: Srinivas Kandagatla <srini@kernel.org>
Link: https://patch.msgid.link/20260729094352.111065-11-srini@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
For any remote call to DSP, after sending an invocation message,
the fastRPC driver waits for a glink response, during which the CPU
can enter low power modes. This adds latency to the fastRPC call
due to CPU wakeup and scheduling overhead. Add polling mode support
where the fastRPC driver polls a shared memory location for
completion after sending the invocation, avoiding CPU wakeup and
scheduling latency and reducing fastRPC overhead. If the poll times
out, the call falls back to the normal interrupt/glink-based
completion path.
Poll mode is only applied to dynamic modules running in a user PD
(handle > FASTRPC_MAX_STATIC_HANDLE), since static/root-PD handles
are not expected to benefit from, or require, this optimization.
Support is advertised per SoC via fastrpc_soc_data, with a closed
exception list for older platforms whose DSP firmware is known to
support polling but which otherwise use the default soc_data.
Poll mode can be enabled by userspace via the FASTRPC_IOCTL_SET_OPTION
ioctl with the FASTRPC_POLL_MODE request id.
Since context IDs (ctxid) are allocated from a fixed-size, per-channel
cyclic IDR shared by all processes on a DSP, a context ID can be
recycled for a new request soon after it is freed. In poll mode the
context can be considered complete (and released) as soon as the poll
memory is updated, while the corresponding glink COMPLETE response
from the DSP may still be in flight. If that response arrives after
the ctxid has been reused, it would otherwise match the new context
and incorrectly signal completion for it while the DSP may still be
operating on the new context's buffers. To prevent this, embed a
monotonically increasing per-channel sequence number in the unused
upper bits of the ctxid/message context and validate it in the
rpmsg callback, dropping any response whose sequence number does not
match the current owner of that ctxid slot.
Signed-off-by: Ekansh Gupta <ekansh.gupta@oss.qualcomm.com>
Signed-off-by: Srinivas Kandagatla <srini@kernel.org>
Link: https://patch.msgid.link/20260729094352.111065-8-srini@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Current FastRPC context uses a 12-bit mask:
[ID(8 bits)][PD type(4 bits)] = GENMASK(11, 4)
This works for normal calls but fails for DSP polling mode.
Polling mode expects a 16-bit layout:
[15:8] = context ID (8 bits)
[7:5] = reserved
[4] = async mode bit
[3:0] = PD type (4 bits)
If async bit (bit 4) is set, DSP disables polling. With current
mask, odd IDs can set this bit, causing DSP to skip poll updates.
Update FASTRPC_CTXID_MASK to GENMASK(15, 8) so IDs occupy upper
byte and lower byte is left for DSP flags and PD type.
Reserved bits remain unused. This change is compatible with
polling mode and does not break non-polling behavior.
Bit layout:
[15:8] = CCCCCCCC (context ID)
[7:5] = xxx (reserved)
[4] = A (async mode)
[3:0] = PPPP (PD type)
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Signed-off-by: Ekansh Gupta <ekansh.gupta@oss.qualcomm.com>
Signed-off-by: Srinivas Kandagatla <srini@kernel.org>
Link: https://patch.msgid.link/20260729094352.111065-7-srini@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Replace the hardcoded context ID mask (0xFF0) with GENMASK(11, 4) to
improve readability and follow kernel bitfield conventions. Use
FIELD_PREP and FIELD_GET instead of manual shifts for setting and
extracting ctxid values.
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Signed-off-by: Ekansh Gupta <ekansh.gupta@oss.qualcomm.com>
Signed-off-by: Srinivas Kandagatla <srini@kernel.org>
Link: https://patch.msgid.link/20260729094352.111065-6-srini@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
The fdlist is currently part of the meta buffer which is set during
fastrpc_get_args(), this fdlist is getting recalculated during
fastrpc_put_args().
Move fdlist to the invoke context structure to improve maintainability
and reduce redundancy. This centralizes its handling and simplifies
meta buffer preparation and reading logic.
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Signed-off-by: Ekansh Gupta <ekansh.gupta@oss.qualcomm.com>
Signed-off-by: Srinivas Kandagatla <srini@kernel.org>
Link: https://patch.msgid.link/20260729094352.111065-5-srini@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
dev_err() and dev_info() were called while holding a spinlock with
IRQs disabled, which is incorrect as printk can be slow and should
not be called in atomic context.
Move the dev_err() for the FASTRPC_MAX_SESSIONS check to after the
spinlock is released, and save the return value of of_property_read_u32()
to print dev_info() after the lock is dropped. Minor variable style
correction in probe function.
Signed-off-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
Reviewed-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Srinivas Kandagatla <srini@kernel.org>
Link: https://patch.msgid.link/20260729094352.111065-2-srini@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
We need the char/misc fixes AND this resolves two merge conflicts in:
drivers/android/binder/thread.rs
drivers/misc/nsm.c
Reported-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
irq_domain_add_linear() is going away as being obsolete now. Switch to
the preferred irq_domain_create_linear(). That differs in the first
parameter: It takes more generic struct fwnode_handle instead of struct
device_node. Therefore, of_fwnode_handle() is added around the
parameter.
Note some of the users can likely use dev->fwnode directly instead of
indirect of_fwnode_handle(dev->of_node). But dev->fwnode is not
guaranteed to be set for all, so this has to be investigated on case to
case basis (by people who can actually test with the HW).
Signed-off-by: Jiri Slaby (SUSE) <jirislaby@kernel.org>
Cc: Thomas Gleixner <tglx@kernel.org>
Cc: Andrea della Porta <andrea.porta@suse.com>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Tested-by: Andrea della Porta <andrea.porta@suse.com>
Link: https://patch.msgid.link/20260708095733.385396-1-jirislaby@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
OpenDICE can also used on x86 platforms for attestation, one of the
usecase is Android's protected VM.
The OpenDICE device driver only supports device tree, adding ACPI
support so it can also be used on x86 environments easily.
The patch is verified using crosvm, with the following ACPI table passed
using --acpi-table, with --file-backed-mapping for the corresponding
memory region.
DefinitionBlock (
"opendice.aml", "SSDT", 2, "GOOGLE", "OpenDICE", 0x00000001
)
{
Scope (\_SB)
{
Device (DICE)
{
Name (_HID, "PRP0001")
Name (_DSD, Package () {
ToUUID ("daffd814-6eba-4d8c-8a91-bc9bbf4aa301"),
Package () {
Package () {
"compatible",
Package () { "google,open-dice" }
}
}
})
Name (_CRS, ResourceTemplate () {
Memory32Fixed (ReadOnly, 0x9D1C3000, 0x00001000)
})
}
}
}
Signed-off-by: Song Guo <songguo@google.com>
Link: https://patch.msgid.link/20260715122146.4069884-4-songguo@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
The reserved_mem only works on device tree systems.
This commit replaced it by phys_addr_t and resource_size_t to make it
possible to use open dice on non-DT platforms.
Signed-off-by: Song Guo <songguo@google.com>
Link: https://patch.msgid.link/20260715122146.4069884-3-songguo@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
dev->of_node is not null only when the device is configured via device
tree. When the matching device is configured by other means (like ACPI),
the current code will cause null pointer dereference.
Signed-off-by: Song Guo <songguo@google.com>
Link: https://patch.msgid.link/20260715122146.4069884-2-songguo@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Implement IOCTL interface for SB-TSI driver to enable userspace access
to TSI register read/write operations through the AMD Advanced Platform
Management Link (APML) protocol.
Add an ioctl command (SBTSI_IOCTL_REG_XFER_CMD) that accepts a register
address, data byte, and direction flag.
The mutex is taken on the ioctl path here; the hwmon path is placed
under the same lock in the next patch, which completes serialization between
the hwmon and ioctl paths.
Reviewed-by: Akshay Gupta <Akshay.Gupta@amd.com>
Signed-off-by: Prathima <Prathima.Lk@amd.com>
Link: https://patch.msgid.link/20260710111642.850022-7-Akshay.Gupta@amd.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
AMD SB-TSI temperature sensors can be accessed over both
I2C and I3C buses depending on the platform configuration.
Extend the SB-TSI driver to support both I2C and I3C bus interfaces
by selecting the appropriate transport based on the probed bus type.
The driver maintains backward compatibility with existing I2C
deployments while enabling support for systems using the I3C bus.
Register both I2C and I3C drivers using module_i3c_i2c_driver() and
update the Kconfig dependency from I2C to I3C_OR_I2C.
Reviewed-by: Akshay Gupta <Akshay.Gupta@amd.com>
Signed-off-by: Prathima <Prathima.Lk@amd.com>
Link: https://patch.msgid.link/20260710111642.850022-6-Akshay.Gupta@amd.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Refactor shared probe procedures into sbtsi_probe_common() to ensure
that I2C and I3C probes focus solely on bus-specific allocation and
device configuration.
The utility function reads the configuration register via sbtsi_xfer(),
initializes ext_range_mode and read_order, assigns the driver data,
and registers the hwmon auxiliary device.
Routing register access through sbtsi_xfer() keeps the probe path
bus-agnostic, so no transfer logic has to be duplicated when SB-TSI over
I3C support is added in a later patch.
Reviewed-by: Akshay Gupta <Akshay.Gupta@amd.com>
Signed-off-by: Prathima <Prathima.Lk@amd.com>
Link: https://patch.msgid.link/20260710111642.850022-5-Akshay.Gupta@amd.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Move the I2C read/write byte operations from the sbtsi hwmon driver into
a common sbtsi_xfer() function in tsi-core.c.
This decouples the hwmon sensor driver from the underlying bus transport,
preparing for I3C support in a subsequent patch.
This patch does not introduce any functional changes. The updates are
limited to code organization/cleanup and should not affect the runtime
behavior of the driver
Reviewed-by: Akshay Gupta <Akshay.Gupta@amd.com>
Signed-off-by: Prathima <Prathima.Lk@amd.com>
Acked-by: Guenter Roeck <linux@roeck-us.net>
Link: https://patch.msgid.link/20260710111642.850022-4-Akshay.Gupta@amd.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Move SBTSI(Side-Band Temperature Sensor Interface) core functionality out
of the hwmon-only path and into drivers/misc/amd-sbi so it can be reused
by non-hwmon consumers.
I2C probe parsing is moved from drivers/hwmon/sbtsi_temp.c
into drivers/misc/amd-sbi/tsi.c under CONFIG_AMD_SBTSI. The core driver
stores struct sbtsi_data on the bus device and registers an auxiliary
device amd-sbtsi.temp-sensor.<addr> per target.
The current hwmon temp sensor will now require the CONFIG_AMD_SBTSI
configuration as a new dependency.
This split prepares the driver for additional interfaces while keeping
hwmon support in hwmon subsystem on top of common SBTSI core logic.
Add platform dependencies to clarify this driver is intended to run on
the BMC and not on the managed node.
Reviewed-by: Akshay Gupta <Akshay.Gupta@amd.com>
Signed-off-by: Prathima <Prathima.Lk@amd.com>
Acked-by: Guenter Roeck <linux@roeck-us.net>
Link: https://patch.msgid.link/20260710111642.850022-2-Akshay.Gupta@amd.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Switch from pci_enable_device() to pcim_enable_device() so the PCI device
is automatically disabled on probe error and driver removal. Drop the now
redundant manual pci_disable_device() and pci_clear_master() calls, since
pcim's release path clears bus mastering and disables the device.
Assisted-by: opencode:hy3-free
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://patch.msgid.link/20260714025025.2055506-1-rosenp@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
gru_retry_exception() tests cbrexecstatus after asking
gru_get_cb_exception_detail() to fill the detail structure. The helper
leaves that field uninitialized, so retry decisions depend on stale
stack data.
Populate the address, CBR state, and execution status alongside the
other exception fields, matching the user exception-detail path.
Signed-off-by: Yousef Alhouseen <alhouseenyousef@gmail.com>
Link: https://patch.msgid.link/20260630104941.53862-1-alhouseenyousef@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
genwqe_setup_sgl() uses zero as the initial previous DMA address. DMA
address zero is valid, so a first entry at that address enters the
merge path before last_s has been assigned and dereferences NULL.
Only merge adjacent mappings after an SGL data entry has been created.
Signed-off-by: Yousef Alhouseen <alhouseenyousef@gmail.com>
Link: https://patch.msgid.link/20260630104923.53827-1-alhouseenyousef@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
The LDPC code register helpers check the target MMIO address after
adding code_id * XSDFEC_LDPC_REG_JUMP to the register base. code_id is
supplied through the ioctl path, so the multiplication and addition can
wrap before the bounds check.
Validate the code_id against the register window size before computing
the final address, then write using the checked address.
Signed-off-by: Yousef Alhouseen <alhouseenyousef@gmail.com>
Reviewed-by: Cvetic, Dragan <dragan.cvetic@amd.com>
Link: https://patch.msgid.link/20260629152857.13553-1-alhouseenyousef@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
lan966x_pci_probe() applies a device-tree overlay and then populates
platform children from the overlaid node. If
of_platform_default_populate() creates some children and then fails, the
current error path only unloads the overlay.
Depopulate the children before unloading the overlay on that failure
path, matching the remove path order.
Fixes: 185686beb4 ("misc: Add support for LAN966x PCI device")
Reviewed-by: Herve Codina <herve.codina@bootlin.com>
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Link: https://patch.msgid.link/20260623015248.22721-1-pengpeng@iscas.ac.cn
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
ad_dpot_probe() creates per-RDAC sysfs files manually and then
optionally creates the command sysfs group. This leaves probe responsible
for rolling back partial sysfs state and makes remove responsible for
matching every file that probe created.
Move the device attributes into driver core dev_groups for the I2C and
SPI drivers and use an is_visible() callback to expose only the
attributes supported by the probed device. With this shape, the driver
core creates the sysfs files only after probe succeeds and removes them
before the remove callback frees the driver data.
Fixes: 4eb174bee6 ("ad525x_dpot: new driver for AD525x digital potentiometers")
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Link: https://patch.msgid.link/20260623015643.36508-1-pengpeng@iscas.ac.cn
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
dev_of_node() returns the device's OF node without taking a new
reference. rp1_probe() stores that borrowed pointer in rp1_node, but
drops it with of_node_put() on both success and failure paths.
Dropping a reference that was never acquired can underflow the node's
refcount and leave later users with a stale OF node. Remove the
of_node_put() calls and keep rp1_node as a borrowed pointer.
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Reviewed-by: Andrea della Porta <andrea.porta@suse.com>
Link: https://patch.msgid.link/20260616150802.52050-1-pengpeng@iscas.ac.cn
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
rp1_probe() installs a chained handler for each parent MSI-X vector and
stores the rp1 device pointer as handler data. rp1_unregister_interrupts()
then disposes the child IRQ mappings, removes the IRQ domain, and frees
the PCI IRQ vectors without first removing those chained handlers.
If a teardown path runs after the handlers have been installed, a later
parent IRQ can still call rp1_chained_handle_irq() with stale handler
data and a removed IRQ domain. Clear the chained handlers before
disposing mappings and freeing the vectors.
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Reviewed-by: Andrea della Porta <andrea.porta@suse.com>
Link: https://patch.msgid.link/20260616151028.69890-1-pengpeng@iscas.ac.cn
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
ibmvmc_recv_msg() trusts the message length from the CRQ.
It passes that length directly to h_copy_rdma().
The destination buffer is only max_mtu bytes.
A larger length can overrun it before userspace reads the message.
Validate the CRQ length before issuing the RDMA copy.
Signed-off-by: Yousef Alhouseen <alhouseenyousef@gmail.com>
Link: https://patch.msgid.link/20260624175139.7981-1-alhouseenyousef@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
ibmvmc_get_valid_hmc_buffer() marks the selected send buffer busy before
ibmvmc_write() validates the backing storage or copies data from user
space. Error exits after that point leave the buffer permanently busy.
Keep the buffer pointer until ownership is handed to the hypervisor, and
mark it free again on local write failures. Also report an RDMA send
failure instead of returning a successful byte count.
Signed-off-by: Yousef Alhouseen <alhouseenyousef@gmail.com>
Link: https://patch.msgid.link/20260624185925.2133-1-alhouseenyousef@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
ilo_pkt_dequeue() trusts descriptor IDs and lengths read from the shared
FIFO entry. A bad entry can select a descriptor outside the allocated
queue memory or report a packet length larger than one descriptor.
Reject entries whose descriptor index or packet length exceeds the queue
layout before deriving the packet pointer returned to read and write
paths.
Signed-off-by: Yousef Alhouseen <alhouseenyousef@gmail.com>
Link: https://patch.msgid.link/20260624190919.3432-1-alhouseenyousef@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
If an error occurs at the stage of working with registers in conjunction
with MCU_Block, it will not be processed.
The occurrence of errors at this stage may signal an impact on writes to
the device's PCI registers and is a more global problem than a
driver-level security problem, but adding a handler would be a good
practice.
Add a missing error handling.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixes: c0e5f4e73a ("misc: rtsx: Add support for RTS5261")
Signed-off-by: Gleb Markov <markov.gi@npc-ksb.ru>
Link: https://patch.msgid.link/20260629130920.1260-1-markov.gi@npc-ksb.ru
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
bcm_vk_write() uses the user-supplied write count to size a
flexible-array work entry and then copies count bytes into that array.
The allocation expression is evaluated before any overflow check, so a
very large count can wrap the allocation smaller than the subsequent
copy.
Reject empty writes, check the allocation arithmetic before kzalloc(),
and initialize the __counted_by field before copying into to_v_msg[].
Signed-off-by: Yousef Alhouseen <alhouseenyousef@gmail.com>
Link: https://patch.msgid.link/20260629160605.29412-1-alhouseenyousef@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
nsm_sendrecv_msg_locked() stores the virtqueue used-ring length reported
by the NSM device into msg->resp.len without bounding it to the response
buffer. A malicious or buggy backend can report a length larger than the
response buffer; parse_resp_raw() then copies that many bytes out of the
fixed buffer to user space, disclosing adjacent kernel heap (an
out-of-bounds read). The request path already floors its length in
fill_req_raw(); the response path lacks the symmetric check.
Clamp the stored length to the size of the response buffer. Well-behaved
devices report no more than the posted buffer size, so conforming traffic
is unaffected.
Fixes: b9873755a6 ("misc: Add Nitro Secure Module driver")
Cc: stable@vger.kernel.org
Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
Reviewed-by: Alexander Graf <graf@amazon.com>
Link: https://patch.msgid.link/20260620-b4-disp-a54b7dd6-v1-1-79d1f236a854@proton.me
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
sizeof used without parentheses around its operand on two
occasions in r_heartbeat.c. Add them to comply with the
kernel coding style.
Signed-off-by: Batu Ada Tutkun <batuadatutkun@gmail.com>
Link: https://patch.msgid.link/20260622201633.2577-1-batuadatutkun@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
nsm_dev_ioctl() jumps to the common out label when the initial
copy_from_user() fails. That failure path runs before
mutex_lock(&nsm->lock), but the out label unconditionally calls
mutex_unlock(&nsm->lock).
Return -EFAULT directly for the pre-lock copy_from_user() failure so
only paths that acquired the mutex release it.
Signed-off-by: Vu Nguyen Anh Khoa <khoavna.tin.2225@gmail.com>
Reviewed-by: Alexander Graf <graf@amazon.com>
Reviewed-by: Arnd Bergmann <arnd@arndb.de>
Link: https://patch.msgid.link/20260621085743.76329-2-khoavna.tin.2225@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
While the sizeof the target buffer is (should be) ENCLOSURE_NAME_SIZE
and the copies should not overrrun this stops any static analysis objecting
to the unbounded strcpy() and strcat() calls
Signed-off-by: David Laight <david.laight.linux@gmail.com>
Link: https://patch.msgid.link/20260608095523.2606-18-david.laight.linux@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
bcm_vk_sync_msgq() fills the message queue information and then sets
msgq_inited. Readers call bcm_vk_drv_access_ok() before accessing the
message queues and their cached queue information.
atomic_set()/atomic_read() do not order those accesses. A reader can see
msgq_inited set while still seeing stale queue information. Use release
when publishing the initialized queues and acquire when checking the gate.
Keep the clear in bcm_vk_blk_drv_access() as atomic_set(). It closes the
gate and does not publish queue state to readers.
Fixes: 111d746bb4 ("misc: bcm-vk: add VK messaging support")
Signed-off-by: Gui-Dong Han <hanguidong02@gmail.com>
Link: https://patch.msgid.link/20260603021127.3285057-1-hanguidong02@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
The comment in pch_phub_write_gbe_mac_addr() suggests that only EG20T,
ML7831 and ML7223 are handled. Replace the code construct using an if
with a switch that has the same semantics but issues a warning if a new
device type is added to the driver without adapting this function.
Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com>
Link: https://patch.msgid.link/796b3667ea49d9156ecc03d1ce9668972316d90b.1779785111.git.u.kleine-koenig@baylibre.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Recently an enum was introduced to identify the different hardware
variants instead of magic constants. The respective commit however
missed to adapt one code location that still checks the old values.
As the values shifted by one this is a relevant fix.
Fixes: 7b1d4ad96e ("misc: pch_phub: Introduce an enum for device indentification")
Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com>
Link: https://patch.msgid.link/8a97d9d5fb0a4abf7032324643e3e2337b1347bd.1779785111.git.u.kleine-koenig@baylibre.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Add support for the ISSEI (Intel Silicon Security Engine Interface)
HECI PCI devices.
Add the necessary PCI handling routines, hardware definitions,
register mappings and hardware access routines.
This enables the communication via HECI PCI device advertized by BIOS.
Reviewed-by: Karol Wachowski <karol.wachowski@linux.intel.com>
Co-developed-by: Vitaly Lubart <lubvital@gmail.com>
Signed-off-by: Vitaly Lubart <lubvital@gmail.com>
Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
Link: https://patch.msgid.link/20260513-issei-for-upstream-v1-4-f590038678f9@intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Introduce the main thread and HECI Active Management (HAM)
message handling for the ISSEI (Intel Silicon Security Engine
Interface) subsystem.
The main thread is responsible for managing the reset flow and
processing messages, while the HAM message handling is crucial
for initializing communication with the firmware and managing
clients.
With this implementation, the ISSEI driver is capable of performing
the required initialization and management of communication between
the host and the firmware.
Reviewed-by: Karol Wachowski <karol.wachowski@linux.intel.com>
Co-developed-by: Vitaly Lubart <lubvital@gmail.com>
Signed-off-by: Vitaly Lubart <lubvital@gmail.com>
Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
Link: https://patch.msgid.link/20260513-issei-for-upstream-v1-3-f590038678f9@intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Add the core implementation for firmware and host client
management within the ISSEI (Intel Silicon Security Engine Interface)
subsystem support for a character device to expose the ISSEI
HECI interface to user space.
The firmware client (fw_client) and host client (host_client) modules
are responsible for managing communication between the host software
and the firmware.
The character device provides a communication channel for user-space
applications to interact with the firmware on the platform.
The client modules enable the ISSEI driver to manage multiple
host clients communicating with corresponding firmware
clients, facilitating data transfers and control operations
over the HECI interface.
The character device allows user-space applications to establish
connections to firmware clients using UUIDs, exchange messages,
and control the communication flow using standard
file operation calls.
Reviewed-by: Karol Wachowski <karol.wachowski@linux.intel.com>
Co-developed-by: Vitaly Lubart <lubvital@gmail.com>
Signed-off-by: Vitaly Lubart <lubvital@gmail.com>
Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
Link: https://patch.msgid.link/20260513-issei-for-upstream-v1-2-f590038678f9@intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
The ISSEI (Intel Silicon Security Engine Interface)
subsystem provides a communication channel between the host and the
Silicon Security Engine.
Prepare basic driver functions and character device
for user-space communication.
Add DMA access routines for ISSEI HECI devices.
Add of DMA-related structures and implementation of routines for
setting up DMA, as well as reading and writing DMA buffers.
Reviewed-by: Karol Wachowski <karol.wachowski@linux.intel.com>
Co-developed-by: Vitaly Lubart <lubvital@gmail.com>
Signed-off-by: Vitaly Lubart <lubvital@gmail.com>
Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
Link: https://patch.msgid.link/20260513-issei-for-upstream-v1-1-f590038678f9@intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
