From 6668ed271eaefaa63e686bdfbedaeb7b8e492722 Mon Sep 17 00:00:00 2001 From: Kumar Kartikeya Dwivedi Date: Fri, 4 Sep 2026 10:43:19 +0200 Subject: selftests/bpf: Reject graph kptr use after RCU unlock Add a sleepable verifier test that loads a graph-node local kptr in an explicit RCU read-side critical section, then passes its node to bpf_rbtree_remove() after the section ends. Before the verifier fix, the stale NON_OWN_REF flag makes the node look like a live borrowed reference and the program is accepted. After the fix, the pointer is demoted without NON_OWN_REF and the graph kfunc argument is rejected. Also exercise a graph kptr loaded while a spin lock provides implicit RCU protection. The pointer must be invalidated when the lock is released, which guards the required ordering between non-owning-reference invalidation and RCU demotion. Update the existing fault-protected load test state description. The post-unlock pointer no longer carries NON_OWN_REF, but remains readable because the load is rewritten to use BPF_PROBE_MEM. Signed-off-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/r/20260904084325.52250-7-memxor@gmail.com Signed-off-by: Alexei Starovoitov --- arch/arm/mach-aspeed/Kconfig | 45 +++++++++++++++++++++++++++++++ arch/arm/mach-aspeed/Makefile | 5 ++++ arch/arm/mach-aspeed/platsmp.c | 61 ++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 111 insertions(+) create mode 100644 arch/arm/mach-aspeed/Kconfig create mode 100644 arch/arm/mach-aspeed/Makefile create mode 100644 arch/arm/mach-aspeed/platsmp.c (limited to 'arch/arm/mach-aspeed') diff --git a/arch/arm/mach-aspeed/Kconfig b/arch/arm/mach-aspeed/Kconfig new file mode 100644 index 000000000..fcf287edd --- /dev/null +++ b/arch/arm/mach-aspeed/Kconfig @@ -0,0 +1,45 @@ +# SPDX-License-Identifier: GPL-2.0-only +menuconfig ARCH_ASPEED + bool "Aspeed BMC architectures" + depends on (CPU_LITTLE_ENDIAN && ARCH_MULTI_V5) || ARCH_MULTI_V6 || ARCH_MULTI_V7 + select WATCHDOG + select ASPEED_WATCHDOG + select MFD_SYSCON + select PINCTRL + help + Say Y here if you want to run your kernel on an ASpeed BMC SoC. + +if ARCH_ASPEED + +config MACH_ASPEED_G4 + bool "Aspeed SoC 4th Generation" + depends on ARCH_MULTI_V5 + select CPU_ARM926T + select PINCTRL_ASPEED_G4 + select FTTMR010_TIMER + help + Say yes if you intend to run on an Aspeed ast2400 or similar + fourth generation BMCs, such as those used by OpenPower Power8 + systems. + +config MACH_ASPEED_G5 + bool "Aspeed SoC 5th Generation" + depends on ARCH_MULTI_V6 + select PINCTRL_ASPEED_G5 + select FTTMR010_TIMER + help + Say yes if you intend to run on an Aspeed ast2500 or similar + fifth generation Aspeed BMCs. + +config MACH_ASPEED_G6 + bool "Aspeed SoC 6th Generation" + depends on ARCH_MULTI_V7 + select CPU_V7 + select PINCTRL_ASPEED_G6 + select ARM_GIC + select HAVE_ARM_ARCH_TIMER + help + Say yes if you intend to run on an Aspeed ast2600 or similar + sixth generation Aspeed BMCs. + +endif diff --git a/arch/arm/mach-aspeed/Makefile b/arch/arm/mach-aspeed/Makefile new file mode 100644 index 000000000..1951b3317 --- /dev/null +++ b/arch/arm/mach-aspeed/Makefile @@ -0,0 +1,5 @@ +# SPDX-License-Identifier: GPL-2.0-or-later +# Copyright (C) ASPEED Technology Inc. +# Copyright IBM Corp. + +obj-$(CONFIG_SMP) += platsmp.o diff --git a/arch/arm/mach-aspeed/platsmp.c b/arch/arm/mach-aspeed/platsmp.c new file mode 100644 index 000000000..2324becf7 --- /dev/null +++ b/arch/arm/mach-aspeed/platsmp.c @@ -0,0 +1,61 @@ +// SPDX-License-Identifier: GPL-2.0-or-later +// Copyright (C) ASPEED Technology Inc. +// Copyright IBM Corp. + +#include +#include +#include +#include + +#define BOOT_ADDR 0x00 +#define BOOT_SIG 0x04 + +static struct device_node *secboot_node; + +static int aspeed_g6_boot_secondary(unsigned int cpu, struct task_struct *idle) +{ + void __iomem *base; + + base = of_iomap(secboot_node, 0); + if (!base) { + pr_err("could not map the secondary boot base!"); + return -ENODEV; + } + + writel_relaxed(0, base + BOOT_ADDR); + writel_relaxed(__pa_symbol(secondary_startup_arm), base + BOOT_ADDR); + writel_relaxed((0xABBAAB00 | (cpu & 0xff)), base + BOOT_SIG); + + dsb_sev(); + + iounmap(base); + + return 0; +} + +static void __init aspeed_g6_smp_prepare_cpus(unsigned int max_cpus) +{ + void __iomem *base; + + secboot_node = of_find_compatible_node(NULL, NULL, "aspeed,ast2600-smpmem"); + if (!secboot_node) { + pr_err("secboot device node found!!\n"); + return; + } + + base = of_iomap(secboot_node, 0); + if (!base) { + pr_err("could not map the secondary boot base!"); + return; + } + __raw_writel(0xBADABABA, base + BOOT_SIG); + + iounmap(base); +} + +static const struct smp_operations aspeed_smp_ops __initconst = { + .smp_prepare_cpus = aspeed_g6_smp_prepare_cpus, + .smp_boot_secondary = aspeed_g6_boot_secondary, +}; + +CPU_METHOD_OF_DECLARE(aspeed_smp, "aspeed,ast2600-smp", &aspeed_smp_ops); -- cgit v1.3.1