From 2bc6b218717b9d08f466f88209251d54bc09b207 Mon Sep 17 00:00:00 2001 From: Fuad Tabba Date: Tue, 22 Sep 2026 19:14:30 +0100 Subject: arm64/boot: Disable trapping of PMZR_EL0 writes to EL2 __init_el2_fgt2() writes one mask to both HDFGRTR2_EL2 and HDFGWTR2_EL2. PMZR_EL0 is write-only, so its trap bit, nPMZR_EL0, exists only in HDFGWTR2_EL2 and is therefore never set: a PMZR_EL0 write from the host traps to EL2, where the nVHE hypervisor has no handler and BUG()s. The kernel never writes PMZR_EL0, but kernel.perf_user_access=1 has the PMU driver set PMUSERENR_EL0.UEN for a task with a user-read event, so a write from EL0 reaches the trap and takes the host down without a panic message. Accumulate the HDFGWTR2_EL2 bits separately, as __init_el2_fgt() already does for HDFGWTR_EL2, and set nPMZR_EL0 with the other FEAT_PMUv3p9 bits. Fixes: 858c7bfcb35e1 ("arm64/boot: Enable EL2 requirements for FEAT_PMUv3p9") Cc: stable@vger.kernel.org Signed-off-by: Fuad Tabba Reviewed-by: Anshuman Khandual Reviewed-by: Oliver Upton Signed-off-by: Will Deacon --- drivers/accessibility/speakup/selection.c | 141 ++++++++++++++++++++++++++++++ 1 file changed, 141 insertions(+) create mode 100644 drivers/accessibility/speakup/selection.c (limited to 'drivers/accessibility/speakup/selection.c') diff --git a/drivers/accessibility/speakup/selection.c b/drivers/accessibility/speakup/selection.c new file mode 100644 index 000000000..1713ce4e0 --- /dev/null +++ b/drivers/accessibility/speakup/selection.c @@ -0,0 +1,141 @@ +// SPDX-License-Identifier: GPL-2.0 +#include /* for kmalloc */ +#include +#include +#include +#include /* for dev_warn */ +#include +#include +#include +#include +#include +#include + +#include "speakup.h" + +u16 spk_xs, spk_ys, spk_xe, spk_ye; /* our region points */ +struct vc_data *spk_sel_cons; + +struct speakup_selection_work { + struct work_struct work; + struct tiocl_selection sel; + struct tty_struct *tty; +}; + +static void __speakup_set_selection(struct work_struct *work) +{ + struct speakup_selection_work *ssw = + container_of(work, struct speakup_selection_work, work); + + struct tty_struct *tty; + struct tiocl_selection sel; + + sel = ssw->sel; + + /* this ensures we copy sel before releasing the lock below */ + rmb(); + + /* release the lock by setting tty of the struct to NULL */ + tty = xchg(&ssw->tty, NULL); + + if (spk_sel_cons != vc_cons[fg_console].d) { + spk_sel_cons = vc_cons[fg_console].d; + pr_warn("Selection: mark console not the same as cut\n"); + goto unref; + } + + console_lock(); + clear_selection(); + console_unlock(); + + set_selection_kernel(&sel, tty); + +unref: + tty_kref_put(tty); +} + +static struct speakup_selection_work speakup_sel_work = { + .work = __WORK_INITIALIZER(speakup_sel_work.work, + __speakup_set_selection) +}; + +int speakup_set_selection(struct tty_struct *tty) +{ + /* we get kref here first in order to avoid a subtle race when + * cancelling selection work. getting kref first establishes the + * invariant that if speakup_sel_work.tty is not NULL when + * speakup_cancel_selection() is called, it must be the case that a put + * kref is pending. + */ + tty_kref_get(tty); + if (cmpxchg(&speakup_sel_work.tty, NULL, tty)) { + tty_kref_put(tty); + return -EBUSY; + } + /* now we have the 'lock' by setting tty member of + * speakup_selection_work. wmb() ensures that writes to + * speakup_sel_work don't happen before cmpxchg() above. + */ + wmb(); + + speakup_sel_work.sel.xs = spk_xs + 1; + speakup_sel_work.sel.ys = spk_ys + 1; + speakup_sel_work.sel.xe = spk_xe + 1; + speakup_sel_work.sel.ye = spk_ye + 1; + speakup_sel_work.sel.sel_mode = TIOCL_SELCHAR; + + schedule_work_on(WORK_CPU_UNBOUND, &speakup_sel_work.work); + + return 0; +} + +void speakup_cancel_selection(void) +{ + struct tty_struct *tty; + + cancel_work_sync(&speakup_sel_work.work); + /* setting to null so that if work fails to run and we cancel it, + * we can run it again without getting EBUSY forever from there on. + * we need to use xchg here to avoid race with speakup_set_selection() + */ + tty = xchg(&speakup_sel_work.tty, NULL); + if (tty) + tty_kref_put(tty); +} + +static void __speakup_paste_selection(struct work_struct *work) +{ + struct speakup_selection_work *ssw = + container_of(work, struct speakup_selection_work, work); + struct tty_struct *tty = xchg(&ssw->tty, NULL); + + paste_selection(tty); + tty_kref_put(tty); +} + +static struct speakup_selection_work speakup_paste_work = { + .work = __WORK_INITIALIZER(speakup_paste_work.work, + __speakup_paste_selection) +}; + +int speakup_paste_selection(struct tty_struct *tty) +{ + tty_kref_get(tty); + if (cmpxchg(&speakup_paste_work.tty, NULL, tty)) { + tty_kref_put(tty); + return -EBUSY; + } + + schedule_work_on(WORK_CPU_UNBOUND, &speakup_paste_work.work); + return 0; +} + +void speakup_cancel_paste(void) +{ + struct tty_struct *tty; + + cancel_work_sync(&speakup_paste_work.work); + tty = xchg(&speakup_paste_work.tty, NULL); + if (tty) + tty_kref_put(tty); +} -- cgit v1.3.1