From 6668ed271eaefaa63e686bdfbedaeb7b8e492722 Mon Sep 17 00:00:00 2001 From: Kumar Kartikeya Dwivedi Date: Fri, 4 Sep 2026 10:43:19 +0200 Subject: selftests/bpf: Reject graph kptr use after RCU unlock Add a sleepable verifier test that loads a graph-node local kptr in an explicit RCU read-side critical section, then passes its node to bpf_rbtree_remove() after the section ends. Before the verifier fix, the stale NON_OWN_REF flag makes the node look like a live borrowed reference and the program is accepted. After the fix, the pointer is demoted without NON_OWN_REF and the graph kfunc argument is rejected. Also exercise a graph kptr loaded while a spin lock provides implicit RCU protection. The pointer must be invalidated when the lock is released, which guards the required ordering between non-owning-reference invalidation and RCU demotion. Update the existing fault-protected load test state description. The post-unlock pointer no longer carries NON_OWN_REF, but remains readable because the load is rewritten to use BPF_PROBE_MEM. Signed-off-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/r/20260904084325.52250-7-memxor@gmail.com Signed-off-by: Alexei Starovoitov --- drivers/clk/at91/clk-system.c | 144 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 144 insertions(+) create mode 100644 drivers/clk/at91/clk-system.c (limited to 'drivers/clk/at91/clk-system.c') diff --git a/drivers/clk/at91/clk-system.c b/drivers/clk/at91/clk-system.c new file mode 100644 index 000000000..93e1e8ceb --- /dev/null +++ b/drivers/clk/at91/clk-system.c @@ -0,0 +1,144 @@ +// SPDX-License-Identifier: GPL-2.0-or-later +/* + * Copyright (C) 2013 Boris BREZILLON + */ + +#include +#include +#include +#include +#include +#include + +#include "pmc.h" + +#define SYSTEM_MAX_ID 31 + +#define SYSTEM_MAX_NAME_SZ 32 + +#define to_clk_system(hw) container_of(hw, struct clk_system, hw) +struct clk_system { + struct clk_hw hw; + struct regmap *regmap; + struct at91_clk_pms pms; + u8 id; +}; + +static inline int is_pck(int id) +{ + return (id >= 8) && (id <= 15); +} + +static inline bool clk_system_ready(struct regmap *regmap, int id) +{ + unsigned int status; + + regmap_read(regmap, AT91_PMC_SR, &status); + + return !!(status & (1 << id)); +} + +static int clk_system_prepare(struct clk_hw *hw) +{ + struct clk_system *sys = to_clk_system(hw); + + regmap_write(sys->regmap, AT91_PMC_SCER, 1 << sys->id); + + if (!is_pck(sys->id)) + return 0; + + while (!clk_system_ready(sys->regmap, sys->id)) + cpu_relax(); + + return 0; +} + +static void clk_system_unprepare(struct clk_hw *hw) +{ + struct clk_system *sys = to_clk_system(hw); + + regmap_write(sys->regmap, AT91_PMC_SCDR, 1 << sys->id); +} + +static int clk_system_is_prepared(struct clk_hw *hw) +{ + struct clk_system *sys = to_clk_system(hw); + unsigned int status; + + regmap_read(sys->regmap, AT91_PMC_SCSR, &status); + + if (!(status & (1 << sys->id))) + return 0; + + if (!is_pck(sys->id)) + return 1; + + regmap_read(sys->regmap, AT91_PMC_SR, &status); + + return !!(status & (1 << sys->id)); +} + +static int clk_system_save_context(struct clk_hw *hw) +{ + struct clk_system *sys = to_clk_system(hw); + + sys->pms.status = clk_system_is_prepared(hw); + + return 0; +} + +static void clk_system_restore_context(struct clk_hw *hw) +{ + struct clk_system *sys = to_clk_system(hw); + + if (sys->pms.status) + clk_system_prepare(&sys->hw); +} + +static const struct clk_ops system_ops = { + .prepare = clk_system_prepare, + .unprepare = clk_system_unprepare, + .is_prepared = clk_system_is_prepared, + .save_context = clk_system_save_context, + .restore_context = clk_system_restore_context, +}; + +struct clk_hw * __init +at91_clk_register_system(struct regmap *regmap, const char *name, + const char *parent_name, struct clk_hw *parent_hw, u8 id, + unsigned long flags) +{ + struct clk_system *sys; + struct clk_hw *hw; + struct clk_init_data init = {}; + int ret; + + if (!(parent_name || parent_hw) || id > SYSTEM_MAX_ID) + return ERR_PTR(-EINVAL); + + sys = kzalloc_obj(*sys); + if (!sys) + return ERR_PTR(-ENOMEM); + + init.name = name; + init.ops = &system_ops; + if (parent_hw) + init.parent_hws = (const struct clk_hw **)&parent_hw; + else + init.parent_names = &parent_name; + init.num_parents = 1; + init.flags = CLK_SET_RATE_PARENT | flags; + + sys->id = id; + sys->hw.init = &init; + sys->regmap = regmap; + + hw = &sys->hw; + ret = clk_hw_register(NULL, &sys->hw); + if (ret) { + kfree(sys); + hw = ERR_PTR(ret); + } + + return hw; +} -- cgit v1.3.1