From 6668ed271eaefaa63e686bdfbedaeb7b8e492722 Mon Sep 17 00:00:00 2001 From: Kumar Kartikeya Dwivedi Date: Fri, 4 Sep 2026 10:43:19 +0200 Subject: selftests/bpf: Reject graph kptr use after RCU unlock Add a sleepable verifier test that loads a graph-node local kptr in an explicit RCU read-side critical section, then passes its node to bpf_rbtree_remove() after the section ends. Before the verifier fix, the stale NON_OWN_REF flag makes the node look like a live borrowed reference and the program is accepted. After the fix, the pointer is demoted without NON_OWN_REF and the graph kfunc argument is rejected. Also exercise a graph kptr loaded while a spin lock provides implicit RCU protection. The pointer must be invalidated when the lock is released, which guards the required ordering between non-owning-reference invalidation and RCU demotion. Update the existing fault-protected load test state description. The post-unlock pointer no longer carries NON_OWN_REF, but remains readable because the load is rewritten to use BPF_PROBE_MEM. Signed-off-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/r/20260904084325.52250-7-memxor@gmail.com Signed-off-by: Alexei Starovoitov --- arch/m68k/coldfire/intc.c | 150 ++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 150 insertions(+) create mode 100644 arch/m68k/coldfire/intc.c (limited to 'arch/m68k/coldfire/intc.c') diff --git a/arch/m68k/coldfire/intc.c b/arch/m68k/coldfire/intc.c new file mode 100644 index 000000000..f441ecf7c --- /dev/null +++ b/arch/m68k/coldfire/intc.c @@ -0,0 +1,150 @@ +/* + * intc.c -- support for the old ColdFire interrupt controller + * + * (C) Copyright 2009, Greg Ungerer + * + * This file is subject to the terms and conditions of the GNU General Public + * License. See the file COPYING in the main directory of this archive + * for more details. + */ + +#include +#include +#include +#include +#include +#include +#include +#include +#include + +/* + * The mapping of irq number to a mask register bit is not one-to-one. + * The irq numbers are either based on "level" of interrupt or fixed + * for an autovector-able interrupt. So we keep a local data structure + * that maps from irq to mask register. Not all interrupts will have + * an IMR bit. + */ +unsigned char mcf_irq2imr[NR_IRQS]; + +/* + * Define the minimum and maximum external interrupt numbers. + * This is also used as the "level" interrupt numbers. + */ +#define EIRQ1 25 +#define EIRQ7 31 + +/* + * In the early version 2 core ColdFire parts the IMR register was 16 bits + * in size. Version 3 (and later version 2) core parts have a 32 bit + * sized IMR register. Provide some size independent methods to access the + * IMR register. + */ +#ifdef MCFSIM_IMR_IS_16BITS + +void mcf_setimr(int index) +{ + u16 imr; + imr = mcf_read16(MCFSIM_IMR); + mcf_write16(imr | (0x1 << index), MCFSIM_IMR); +} + +void mcf_clrimr(int index) +{ + u16 imr; + imr = mcf_read16(MCFSIM_IMR); + mcf_write16(imr & ~(0x1 << index), MCFSIM_IMR); +} + +static void mcf_maskimr(unsigned int mask) +{ + u16 imr; + imr = mcf_read16(MCFSIM_IMR); + imr |= mask; + mcf_write16(imr, MCFSIM_IMR); +} + +#else + +void mcf_setimr(int index) +{ + u32 imr; + imr = mcf_read32(MCFSIM_IMR); + mcf_write32(imr | (0x1 << index), MCFSIM_IMR); +} + +void mcf_clrimr(int index) +{ + u32 imr; + imr = mcf_read32(MCFSIM_IMR); + mcf_write32(imr & ~(0x1 << index), MCFSIM_IMR); +} + +static void mcf_maskimr(unsigned int mask) +{ + u32 imr; + imr = mcf_read32(MCFSIM_IMR); + imr |= mask; + mcf_write32(imr, MCFSIM_IMR); +} + +#endif + +/* + * Interrupts can be "vectored" on the ColdFire cores that support this old + * interrupt controller. That is, the device raising the interrupt can also + * supply the vector number to interrupt through. The AVR register of the + * interrupt controller enables or disables this for each external interrupt, + * so provide generic support for this. Setting this up is out-of-band for + * the interrupt system API's, and needs to be done by the driver that + * supports this device. Very few devices actually use this. + */ +void mcf_autovector(int irq) +{ +#ifdef MCFSIM_AVR + if ((irq >= EIRQ1) && (irq <= EIRQ7)) { + u8 avec; + avec = mcf_read8(MCFSIM_AVR); + avec |= (0x1 << (irq - EIRQ1 + 1)); + mcf_write8(avec, MCFSIM_AVR); + } +#endif +} + +static void intc_irq_mask(struct irq_data *d) +{ + if (mcf_irq2imr[d->irq]) + mcf_setimr(mcf_irq2imr[d->irq]); +} + +static void intc_irq_unmask(struct irq_data *d) +{ + if (mcf_irq2imr[d->irq]) + mcf_clrimr(mcf_irq2imr[d->irq]); +} + +static int intc_irq_set_type(struct irq_data *d, unsigned int type) +{ + return 0; +} + +static struct irq_chip intc_irq_chip = { + .name = "CF-INTC", + .irq_mask = intc_irq_mask, + .irq_unmask = intc_irq_unmask, + .irq_set_type = intc_irq_set_type, +}; + +void __init init_IRQ(void) +{ + int irq; + + mcf_maskimr(0xffffffff); + + for (irq = 0; (irq < NR_IRQS); irq++) { + irq_set_chip(irq, &intc_irq_chip); + irq_set_irq_type(irq, IRQ_TYPE_LEVEL_HIGH); + irq_set_handler(irq, handle_level_irq); + } +} + -- cgit v1.3.1