Unverified Commit ce76a362 authored by Mark Brown's avatar Mark Brown
Browse files

spi: fix explicit controller deregistration 

Johan Hovold <johan@kernel.org> says:

Turns out we have a few drivers that get the tear down ordering wrong
also when not using device managed registration (cf. [1] and [2]).

Fix this to avoid issues like system errors due to unclocked accesses,
NULL-pointer dereferences, hangs or failed I/O during during
deregistration (e.g. when powering down devices).

Johan

[1] https://lore.kernel.org/lkml/20260409120419.388546-2-johan@kernel.org/
[2] https://lore.kernel.org/lkml/20260410081757.503099-1-johan@kernel.org/
parents 51942b77 9d72732f

.mailmap

+2 −0
Original line number Diff line number Diff line
@@ -849,6 +849,8 @@ Tvrtko Ursulin <tursulin@ursulin.net> <tvrtko.ursulin@onelan.co.uk> 
Tvrtko Ursulin <tursulin@ursulin.net> <tvrtko@ursulin.net>

Tycho Andersen <tycho@tycho.pizza> <tycho@tycho.ws>

Tzung-Bi Shih <tzungbi@kernel.org> <tzungbi@google.com>

Ulf Hansson <ulfh@kernel.org> <ulf.hansson@linaro.org>

Ulf Hansson <ulfh@kernel.org> <ulf.hansson@stericsson.com>

Umang Jain <uajain@igalia.com> <umang.jain@ideasonboard.com>

Uwe Kleine-König <ukleinek@informatik.uni-freiburg.de>

Uwe Kleine-König <u.kleine-koenig@baylibre.com> <ukleinek@baylibre.com>

Documentation/arch/riscv/zicfilp.rst

+39 −24
Original line number Diff line number Diff line
@@ -76,34 +76,49 @@ the program. 
4. prctl() enabling

--------------------



:c:macro:`PR_SET_INDIR_BR_LP_STATUS` / :c:macro:`PR_GET_INDIR_BR_LP_STATUS` /

:c:macro:`PR_LOCK_INDIR_BR_LP_STATUS` are three prctls added to manage indirect

branch tracking.  These prctls are architecture-agnostic and return -EINVAL if

the underlying functionality is not supported.

Per-task indirect branch tracking state can be monitored and

controlled via the :c:macro:`PR_GET_CFI` and :c:macro:`PR_SET_CFI`

``prctl()` arguments (respectively), by supplying

:c:macro:`PR_CFI_BRANCH_LANDING_PADS` as the second argument.  These

are architecture-agnostic, and will return -EINVAL if the underlying

functionality is not supported.



* prctl(PR_SET_INDIR_BR_LP_STATUS, unsigned long arg)

* prctl(:c:macro:`PR_SET_CFI`, :c:macro:`PR_CFI_BRANCH_LANDING_PADS`, unsigned long arg)



If arg1 is :c:macro:`PR_INDIR_BR_LP_ENABLE` and if CPU supports

``zicfilp`` then the kernel will enable indirect branch tracking for the

task.  The dynamic loader can issue this :c:macro:`prctl` once it has

determined that all the objects loaded in the address space support

indirect branch tracking.  Additionally, if there is a `dlopen` to an

object which wasn't compiled with ``zicfilp``, the dynamic loader can

issue this prctl with arg1 set to 0 (i.e. :c:macro:`PR_INDIR_BR_LP_ENABLE`

cleared).



* prctl(PR_GET_INDIR_BR_LP_STATUS, unsigned long * arg)

arg is a bitmask.



Returns the current status of indirect branch tracking. If enabled

it'll return :c:macro:`PR_INDIR_BR_LP_ENABLE`



* prctl(PR_LOCK_INDIR_BR_LP_STATUS, unsigned long arg)

If :c:macro:`PR_CFI_ENABLE` is set in arg, and the CPU supports

``zicfilp``, then the kernel will enable indirect branch tracking for

the task.  The dynamic loader can issue this ``prctl()`` once it has

determined that all the objects loaded in the address space support

indirect branch tracking.



Indirect branch tracking state can also be locked once enabled.  This

prevents the task from subsequently disabling it.  This is done by

setting the bit :c:macro:`PR_CFI_LOCK` in arg.  Either indirect branch

tracking must already be enabled for the task, or the bit

:c:macro:`PR_CFI_ENABLE` must also be set in arg.  This is intended

for environments that wish to run with a strict security posture that

do not wish to load objects without ``zicfilp`` support.



Indirect branch tracking can also be disabled for the task, assuming

that it has not previously been enabled and locked.  If there is a

``dlopen()`` to an object which wasn't compiled with ``zicfilp``, the

dynamic loader can issue this ``prctl()`` with arg set to

:c:macro:`PR_CFI_DISABLE`.  Disabling indirect branch tracking for the

task is not possible if it has previously been enabled and locked.





* prctl(:c:macro:`PR_GET_CFI`, :c:macro:`PR_CFI_BRANCH_LANDING_PADS`, unsigned long * arg)



Returns the current status of indirect branch tracking into a bitmask

stored into the memory location pointed to by arg.  The bitmask will

have the :c:macro:`PR_CFI_ENABLE` bit set if indirect branch tracking

is currently enabled for the task, and if it is locked, will

additionally have the :c:macro:`PR_CFI_LOCK` bit set.  If indirect

branch tracking is currently disabled for the task, the

:c:macro:`PR_CFI_DISABLE` bit will be set.



Locks the current status of indirect branch tracking on the task. User

space may want to run with a strict security posture and wouldn't want

loading of objects without ``zicfilp`` support in them, to disallow

disabling of indirect branch tracking. In this case, user space can

use this prctl to lock the current settings.



5. violations related to indirect branch tracking

--------------------------------------------------

Documentation/devicetree/bindings/display/msm/qcom,qcm2290-mdss.yaml

+2 −3
Original line number Diff line number Diff line
@@ -33,7 +33,7 @@ properties: 
      - const: core



  iommus:

    maxItems: 2

    maxItems: 1



  interconnects:

    items:
@@ -107,8 +107,7 @@ examples: 
        interconnect-names = "mdp0-mem",

                             "cpu-cfg";



        iommus = <&apps_smmu 0x420 0x2>,

                 <&apps_smmu 0x421 0x0>;

        iommus = <&apps_smmu 0x420 0x2>;

        ranges;



        display-controller@5e01000 {

Documentation/devicetree/bindings/media/qcom,qcm2290-venus.yaml

+2 −5
Original line number Diff line number Diff line
@@ -42,7 +42,7 @@ properties: 
      - const: vcodec0_bus



  iommus:

    maxItems: 5

    maxItems: 2



  interconnects:

    maxItems: 2
@@ -102,10 +102,7 @@ examples: 
        memory-region = <&pil_video_mem>;



        iommus = <&apps_smmu 0x860 0x0>,

                 <&apps_smmu 0x880 0x0>,

                 <&apps_smmu 0x861 0x04>,

                 <&apps_smmu 0x863 0x0>,

                 <&apps_smmu 0x804 0xe0>;

                 <&apps_smmu 0x880 0x0>;



        interconnects = <&mmnrt_virt MASTER_VIDEO_P0 RPM_ALWAYS_TAG

                         &bimc SLAVE_EBI1 RPM_ALWAYS_TAG>,

Documentation/devicetree/bindings/net/nvidia,tegra234-mgbe.yaml

+2 −2
Original line number Diff line number Diff line
@@ -42,7 +42,7 @@ properties: 
      - const: mgbe

      - const: mac

      - const: mac-divider

      - const: ptp-ref

      - const: ptp_ref

      - const: rx-input-m

      - const: rx-input

      - const: tx
@@ -133,7 +133,7 @@ examples: 
                 <&bpmp TEGRA234_CLK_MGBE0_RX_PCS_M>,

                 <&bpmp TEGRA234_CLK_MGBE0_RX_PCS>,

                 <&bpmp TEGRA234_CLK_MGBE0_TX_PCS>;

        clock-names = "mgbe", "mac", "mac-divider", "ptp-ref", "rx-input-m",

        clock-names = "mgbe", "mac", "mac-divider", "ptp_ref", "rx-input-m",

                      "rx-input", "tx", "eee-pcs", "rx-pcs-input", "rx-pcs-m",

                      "rx-pcs", "tx-pcs";

        resets = <&bpmp TEGRA234_RESET_MGBE0_MAC>,