You've already forked linux-rockchip
mirror of
https://github.com/armbian/linux-rockchip.git
synced 2026-01-06 11:08:10 -08:00
Merge 5.10.192 into android12-5.10-lts
Changes in 5.10.192 mmc: sdhci-f-sdh30: Replace with sdhci_pltfm macsec: Fix traffic counters/statistics macsec: use DEV_STATS_INC() net/mlx5: Refactor init clock function net/mlx5: Move all internal timer metadata into a dedicated struct net/mlx5: Skip clock update work when device is in error state drm/radeon: Fix integer overflow in radeon_cs_parser_init ALSA: emu10k1: roll up loops in DSP setup code for Audigy ASoC: Intel: sof_sdw: add quirk for MTL RVP ASoC: Intel: sof_sdw: add quirk for LNL RVP PCI: tegra194: Fix possible array out of bounds access ARM: dts: imx6dl: prtrvt, prtvt7, prti6q, prtwd2: fix USB related warnings ASoC: Intel: sof_sdw: Add support for Rex soundwire iopoll: Call cpu_relax() in busy loops quota: Properly disable quotas when add_dquot_ref() fails quota: fix warning in dqgrab() dma-remap: use kvmalloc_array/kvfree for larger dma memory remap drm/amdgpu: install stub fence into potential unused fence pointers HID: add quirk for 03f0:464a HP Elite Presenter Mouse RDMA/mlx5: Return the firmware result upon destroying QP/RQ ovl: check type and offset of struct vfsmount in ovl_entry udf: Fix uninitialized array access for some pathnames fs: jfs: Fix UBSAN: array-index-out-of-bounds in dbAllocDmapLev MIPS: dec: prom: Address -Warray-bounds warning FS: JFS: Fix null-ptr-deref Read in txBegin FS: JFS: Check for read-only mounted filesystem in txBegin media: v4l2-mem2mem: add lock to protect parameter num_rdy usb: gadget: u_serial: Avoid spinlock recursion in __gs_console_push media: platform: mediatek: vpu: fix NULL ptr dereference usb: chipidea: imx: don't request QoS for imx8ulp usb: chipidea: imx: add missing USB PHY DPDM wakeup setting gfs2: Fix possible data races in gfs2_show_options() pcmcia: rsrc_nonstatic: Fix memory leak in nonstatic_release_resource_db() Bluetooth: L2CAP: Fix use-after-free Bluetooth: btusb: Add MT7922 bluetooth ID for the Asus Ally drm/amdgpu: Fix potential fence use-after-free v2 ALSA: hda/realtek: Add quirks for Unis H3C Desktop B760 & Q760 ALSA: hda: fix a possible null-pointer dereference due to data race in snd_hdac_regmap_sync() powerpc/kasan: Disable KCOV in KASAN code ring-buffer: Do not swap cpu_buffer during resize process IMA: allow/fix UML builds iio: add addac subdirectory dt-bindings: iio: add AD74413R iio: adc: stx104: Utilize iomap interface iio: adc: stx104: Implement and utilize register structures iio: addac: stx104: Fix race condition for stx104_write_raw() iio: addac: stx104: Fix race condition when converting analog-to-digital bus: mhi: Add MHI PCI support for WWAN modems bus: mhi: Add MMIO region length to controller structure bus: mhi: Move host MHI code to "host" directory bus: mhi: host: Range check CHDBOFF and ERDBOFF irqchip/mips-gic: Get rid of the reliance on irq_cpu_online() irqchip/mips-gic: Use raw spinlock for gic_lock usb: gadget: udc: core: Introduce check_config to verify USB configuration usb: cdns3: allocate TX FIFO size according to composite EP number usb: cdns3: fix NCM gadget RX speed 20x slow than expection at iMX8QM USB: dwc3: qcom: fix NULL-deref on suspend mmc: bcm2835: fix deferred probing mmc: sunxi: fix deferred probing mmc: core: add devm_mmc_alloc_host mmc: meson-gx: use devm_mmc_alloc_host mmc: meson-gx: fix deferred probing tracing/probes: Have process_fetch_insn() take a void * instead of pt_regs tracing/probes: Fix to update dynamic data counter if fetcharg uses it virtio-mmio: Use to_virtio_mmio_device() to simply code virtio-mmio: don't break lifecycle of vm_dev i2c: bcm-iproc: Fix bcm_iproc_i2c_isr deadlock issue fbdev: mmp: fix value check in mmphw_probe() powerpc/rtas_flash: allow user copy to flash block cache objects tty: n_gsm: fix the UAF caused by race condition in gsm_cleanup_mux tty: serial: fsl_lpuart: Clear the error flags by writing 1 for lpuart32 platforms btrfs: fix BUG_ON condition in btrfs_cancel_balance i2c: designware: Handle invalid SMBus block data response length value net: xfrm: Fix xfrm_address_filter OOB read net: af_key: fix sadb_x_filter validation net: xfrm: Amend XFRMA_SEC_CTX nla_policy structure xfrm: fix slab-use-after-free in decode_session6 ip6_vti: fix slab-use-after-free in decode_session6 ip_vti: fix potential slab-use-after-free in decode_session6 xfrm: add NULL check in xfrm_update_ae_params xfrm: add forgotten nla_policy for XFRMA_MTIMER_THRESH selftests: mirror_gre_changes: Tighten up the TTL test match drm/panel: simple: Fix AUO G121EAN01 panel timings according to the docs ipvs: fix racy memcpy in proc_do_sync_threshold netfilter: nft_dynset: disallow object maps net: phy: broadcom: stub c45 read/write for 54810 team: Fix incorrect deletion of ETH_P_8021AD protocol vid from slaves i40e: fix misleading debug logs net: dsa: mv88e6xxx: Wait for EEPROM done before HW reset sock: Fix misuse of sk_under_memory_pressure() net: do not allow gso_size to be set to GSO_BY_FRAGS bus: ti-sysc: Flush posted write on enable before reset arm64: dts: rockchip: fix supplies on rk3399-rock-pi-4 arm64: dts: rockchip: use USB host by default on rk3399-rock-pi-4 arm64: dts: rockchip: add ES8316 codec for ROCK Pi 4 arm64: dts: rockchip: add SPDIF node for ROCK Pi 4 arm64: dts: rockchip: fix regulator name on rk3399-rock-4 arm64: dts: rockchip: sort nodes/properties on rk3399-rock-4 arm64: dts: rockchip: Disable HS400 for eMMC on ROCK Pi 4 ASoC: rt5665: add missed regulator_bulk_disable ASoC: meson: axg-tdm-formatter: fix channel slot allocation ALSA: hda/realtek - Remodified 3k pull low procedure serial: 8250: Fix oops for port->pm on uart_change_pm() ALSA: usb-audio: Add support for Mythware XA001AU capture and playback interfaces. cifs: Release folio lock on fscache read hit. mmc: wbsd: fix double mmc_free_host() in wbsd_init() mmc: block: Fix in_flight[issue_type] value error netfilter: set default timeout to 3 secs for sctp shutdown send and recv state af_unix: Fix null-ptr-deref in unix_stream_sendpage(). virtio-net: set queues after driver_ok net: fix the RTO timer retransmitting skb every 1ms if linear option is enabled mmc: f-sdh30: fix order of function calls in sdhci_f_sdh30_remove x86/cpu: Fix __x86_return_thunk symbol type x86/cpu: Fix up srso_safe_ret() and __x86_return_thunk() x86/alternative: Make custom return thunk unconditional objtool: Add frame-pointer-specific function ignore x86/ibt: Add ANNOTATE_NOENDBR x86/cpu: Clean up SRSO return thunk mess x86/cpu: Rename original retbleed methods x86/cpu: Rename srso_(.*)_alias to srso_alias_\1 x86/cpu: Cleanup the untrain mess x86/srso: Explain the untraining sequences a bit more x86/static_call: Fix __static_call_fixup() x86/retpoline: Don't clobber RFLAGS during srso_safe_ret() x86/CPU/AMD: Fix the DIV(0) initial fix attempt x86/srso: Disable the mitigation on unaffected configurations x86/retpoline,kprobes: Fix position of thunk sections with CONFIG_LTO_CLANG objtool/x86: Fixup frame-pointer vs rethunk x86/srso: Correct the mitigation status when SMT is disabled Linux 5.10.192 Change-Id: Id6dcc6748bce39baa640b8f0c3764d1d95643016 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
This commit is contained in:
Greg Kroah-Hartman
@@ -124,8 +124,8 @@ sequence.
|
||||
To ensure the safety of this mitigation, the kernel must ensure that the
|
||||
safe return sequence is itself free from attacker interference. In Zen3
|
||||
and Zen4, this is accomplished by creating a BTB alias between the
|
||||
untraining function srso_untrain_ret_alias() and the safe return
|
||||
function srso_safe_ret_alias() which results in evicting a potentially
|
||||
untraining function srso_alias_untrain_ret() and the safe return
|
||||
function srso_alias_safe_ret() which results in evicting a potentially
|
||||
poisoned BTB entry and using that safe one for all function returns.
|
||||
|
||||
In older Zen1 and Zen2, this is accomplished using a reinterpretation
|
||||
|
||||
158
Documentation/devicetree/bindings/iio/addac/adi,ad74413r.yaml
Normal file
158
Documentation/devicetree/bindings/iio/addac/adi,ad74413r.yaml
Normal file
@@ -0,0 +1,158 @@
|
||||
# SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
|
||||
%YAML 1.2
|
||||
---
|
||||
$id: http://devicetree.org/schemas/iio/addac/adi,ad74413r.yaml#
|
||||
$schema: http://devicetree.org/meta-schemas/core.yaml#
|
||||
|
||||
title: Analog Devices AD74412R/AD74413R device
|
||||
|
||||
maintainers:
|
||||
- Cosmin Tanislav <cosmin.tanislav@analog.com>
|
||||
|
||||
description: |
|
||||
The AD74412R and AD74413R are quad-channel software configurable input/output
|
||||
solutions for building and process control applications. They contain
|
||||
functionality for analog output, analog input, digital input, resistance
|
||||
temperature detector, and thermocouple measurements integrated
|
||||
into a single chip solution with an SPI interface.
|
||||
The devices feature a 16-bit ADC and four configurable 13-bit DACs to provide
|
||||
four configurable input/output channels and a suite of diagnostic functions.
|
||||
The AD74413R differentiates itself from the AD74412R by being HART-compatible.
|
||||
https://www.analog.com/en/products/ad74412r.html
|
||||
https://www.analog.com/en/products/ad74413r.html
|
||||
|
||||
properties:
|
||||
compatible:
|
||||
enum:
|
||||
- adi,ad74412r
|
||||
- adi,ad74413r
|
||||
|
||||
reg:
|
||||
maxItems: 1
|
||||
|
||||
'#address-cells':
|
||||
const: 1
|
||||
|
||||
'#size-cells':
|
||||
const: 0
|
||||
|
||||
spi-max-frequency:
|
||||
maximum: 1000000
|
||||
|
||||
spi-cpol: true
|
||||
|
||||
interrupts:
|
||||
maxItems: 1
|
||||
|
||||
refin-supply: true
|
||||
|
||||
shunt-resistor-micro-ohms:
|
||||
description:
|
||||
Shunt (sense) resistor value in micro-Ohms.
|
||||
default: 100000000
|
||||
|
||||
required:
|
||||
- compatible
|
||||
- reg
|
||||
- spi-max-frequency
|
||||
- spi-cpol
|
||||
- refin-supply
|
||||
|
||||
additionalProperties: false
|
||||
|
||||
patternProperties:
|
||||
"^channel@[0-3]$":
|
||||
type: object
|
||||
description: Represents the external channels which are connected to the device.
|
||||
|
||||
properties:
|
||||
reg:
|
||||
description: |
|
||||
The channel number. It can have up to 4 channels numbered from 0 to 3.
|
||||
minimum: 0
|
||||
maximum: 3
|
||||
|
||||
adi,ch-func:
|
||||
$ref: /schemas/types.yaml#/definitions/uint32
|
||||
description: |
|
||||
Channel function.
|
||||
HART functions are not supported on AD74412R.
|
||||
0 - CH_FUNC_HIGH_IMPEDANCE
|
||||
1 - CH_FUNC_VOLTAGE_OUTPUT
|
||||
2 - CH_FUNC_CURRENT_OUTPUT
|
||||
3 - CH_FUNC_VOLTAGE_INPUT
|
||||
4 - CH_FUNC_CURRENT_INPUT_EXT_POWER
|
||||
5 - CH_FUNC_CURRENT_INPUT_LOOP_POWER
|
||||
6 - CH_FUNC_RESISTANCE_INPUT
|
||||
7 - CH_FUNC_DIGITAL_INPUT_LOGIC
|
||||
8 - CH_FUNC_DIGITAL_INPUT_LOOP_POWER
|
||||
9 - CH_FUNC_CURRENT_INPUT_EXT_POWER_HART
|
||||
10 - CH_FUNC_CURRENT_INPUT_LOOP_POWER_HART
|
||||
minimum: 0
|
||||
maximum: 10
|
||||
default: 0
|
||||
|
||||
adi,gpo-comparator:
|
||||
type: boolean
|
||||
description: |
|
||||
Whether to configure GPO as a comparator or not.
|
||||
When not configured as a comparator, the GPO will be treated as an
|
||||
output-only GPIO.
|
||||
|
||||
required:
|
||||
- reg
|
||||
|
||||
examples:
|
||||
- |
|
||||
#include <dt-bindings/gpio/gpio.h>
|
||||
#include <dt-bindings/interrupt-controller/irq.h>
|
||||
#include <dt-bindings/iio/addac/adi,ad74413r.h>
|
||||
|
||||
spi {
|
||||
#address-cells = <1>;
|
||||
#size-cells = <0>;
|
||||
|
||||
cs-gpios = <&gpio 17 GPIO_ACTIVE_LOW>;
|
||||
status = "okay";
|
||||
|
||||
ad74413r@0 {
|
||||
compatible = "adi,ad74413r";
|
||||
reg = <0>;
|
||||
spi-max-frequency = <1000000>;
|
||||
spi-cpol;
|
||||
|
||||
#address-cells = <1>;
|
||||
#size-cells = <0>;
|
||||
|
||||
interrupt-parent = <&gpio>;
|
||||
interrupts = <26 IRQ_TYPE_EDGE_FALLING>;
|
||||
|
||||
refin-supply = <&ad74413r_refin>;
|
||||
|
||||
channel@0 {
|
||||
reg = <0>;
|
||||
|
||||
adi,ch-func = <CH_FUNC_VOLTAGE_OUTPUT>;
|
||||
};
|
||||
|
||||
channel@1 {
|
||||
reg = <1>;
|
||||
|
||||
adi,ch-func = <CH_FUNC_CURRENT_OUTPUT>;
|
||||
};
|
||||
|
||||
channel@2 {
|
||||
reg = <2>;
|
||||
|
||||
adi,ch-func = <CH_FUNC_DIGITAL_INPUT_LOGIC>;
|
||||
adi,gpo-comparator;
|
||||
};
|
||||
|
||||
channel@3 {
|
||||
reg = <3>;
|
||||
|
||||
adi,ch-func = <CH_FUNC_CURRENT_INPUT_EXT_POWER>;
|
||||
};
|
||||
};
|
||||
};
|
||||
...
|
||||
2
Makefile
2
Makefile
@@ -1,7 +1,7 @@
|
||||
# SPDX-License-Identifier: GPL-2.0
|
||||
VERSION = 5
|
||||
PATCHLEVEL = 10
|
||||
SUBLEVEL = 191
|
||||
SUBLEVEL = 192
|
||||
EXTRAVERSION =
|
||||
NAME = Dare mighty things
|
||||
|
||||
|
||||
@@ -126,6 +126,10 @@
|
||||
status = "disabled";
|
||||
};
|
||||
|
||||
&usbotg {
|
||||
disable-over-current;
|
||||
};
|
||||
|
||||
&vpu {
|
||||
status = "disabled";
|
||||
};
|
||||
|
||||
@@ -69,6 +69,7 @@
|
||||
vbus-supply = <®_usb_h1_vbus>;
|
||||
phy_type = "utmi";
|
||||
dr_mode = "host";
|
||||
disable-over-current;
|
||||
status = "okay";
|
||||
};
|
||||
|
||||
@@ -78,10 +79,18 @@
|
||||
pinctrl-0 = <&pinctrl_usbotg>;
|
||||
phy_type = "utmi";
|
||||
dr_mode = "host";
|
||||
disable-over-current;
|
||||
over-current-active-low;
|
||||
status = "okay";
|
||||
};
|
||||
|
||||
&usbphynop1 {
|
||||
status = "disabled";
|
||||
};
|
||||
|
||||
&usbphynop2 {
|
||||
status = "disabled";
|
||||
};
|
||||
|
||||
&usdhc1 {
|
||||
pinctrl-names = "default";
|
||||
pinctrl-0 = <&pinctrl_usdhc1>;
|
||||
|
||||
@@ -31,6 +31,40 @@
|
||||
reset-gpios = <&gpio0 RK_PB2 GPIO_ACTIVE_LOW>;
|
||||
};
|
||||
|
||||
sound {
|
||||
compatible = "audio-graph-card";
|
||||
label = "Analog";
|
||||
dais = <&i2s0_p0>;
|
||||
};
|
||||
|
||||
sound-dit {
|
||||
compatible = "audio-graph-card";
|
||||
label = "SPDIF";
|
||||
dais = <&spdif_p0>;
|
||||
};
|
||||
|
||||
spdif-dit {
|
||||
compatible = "linux,spdif-dit";
|
||||
#sound-dai-cells = <0>;
|
||||
|
||||
port {
|
||||
dit_p0_0: endpoint {
|
||||
remote-endpoint = <&spdif_p0_0>;
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
vbus_typec: vbus-typec-regulator {
|
||||
compatible = "regulator-fixed";
|
||||
enable-active-high;
|
||||
gpio = <&gpio1 RK_PA3 GPIO_ACTIVE_HIGH>;
|
||||
pinctrl-names = "default";
|
||||
pinctrl-0 = <&vcc5v0_typec_en>;
|
||||
regulator-name = "vbus_typec";
|
||||
regulator-always-on;
|
||||
vin-supply = <&vcc5v0_sys>;
|
||||
};
|
||||
|
||||
vcc12v_dcin: dc-12v {
|
||||
compatible = "regulator-fixed";
|
||||
regulator-name = "vcc12v_dcin";
|
||||
@@ -40,23 +74,13 @@
|
||||
regulator-max-microvolt = <12000000>;
|
||||
};
|
||||
|
||||
vcc5v0_sys: vcc-sys {
|
||||
vcc3v3_lan: vcc3v3-lan-regulator {
|
||||
compatible = "regulator-fixed";
|
||||
regulator-name = "vcc5v0_sys";
|
||||
regulator-name = "vcc3v3_lan";
|
||||
regulator-always-on;
|
||||
regulator-boot-on;
|
||||
regulator-min-microvolt = <5000000>;
|
||||
regulator-max-microvolt = <5000000>;
|
||||
vin-supply = <&vcc12v_dcin>;
|
||||
};
|
||||
|
||||
vcc_0v9: vcc-0v9 {
|
||||
compatible = "regulator-fixed";
|
||||
regulator-name = "vcc_0v9";
|
||||
regulator-always-on;
|
||||
regulator-boot-on;
|
||||
regulator-min-microvolt = <900000>;
|
||||
regulator-max-microvolt = <900000>;
|
||||
regulator-min-microvolt = <3300000>;
|
||||
regulator-max-microvolt = <3300000>;
|
||||
vin-supply = <&vcc3v3_sys>;
|
||||
};
|
||||
|
||||
@@ -93,28 +117,24 @@
|
||||
vin-supply = <&vcc5v0_sys>;
|
||||
};
|
||||
|
||||
vcc5v0_typec: vcc5v0-typec-regulator {
|
||||
vcc5v0_sys: vcc-sys {
|
||||
compatible = "regulator-fixed";
|
||||
enable-active-high;
|
||||
gpio = <&gpio1 RK_PA3 GPIO_ACTIVE_HIGH>;
|
||||
pinctrl-names = "default";
|
||||
pinctrl-0 = <&vcc5v0_typec_en>;
|
||||
regulator-name = "vcc5v0_typec";
|
||||
regulator-always-on;
|
||||
vin-supply = <&vcc5v0_sys>;
|
||||
};
|
||||
|
||||
vcc_lan: vcc3v3-phy-regulator {
|
||||
compatible = "regulator-fixed";
|
||||
regulator-name = "vcc_lan";
|
||||
regulator-name = "vcc5v0_sys";
|
||||
regulator-always-on;
|
||||
regulator-boot-on;
|
||||
regulator-min-microvolt = <3300000>;
|
||||
regulator-max-microvolt = <3300000>;
|
||||
regulator-min-microvolt = <5000000>;
|
||||
regulator-max-microvolt = <5000000>;
|
||||
vin-supply = <&vcc12v_dcin>;
|
||||
};
|
||||
|
||||
regulator-state-mem {
|
||||
regulator-off-in-suspend;
|
||||
};
|
||||
vcc_0v9: vcc-0v9 {
|
||||
compatible = "regulator-fixed";
|
||||
regulator-name = "vcc_0v9";
|
||||
regulator-always-on;
|
||||
regulator-boot-on;
|
||||
regulator-min-microvolt = <900000>;
|
||||
regulator-max-microvolt = <900000>;
|
||||
vin-supply = <&vcc3v3_sys>;
|
||||
};
|
||||
|
||||
vdd_log: vdd-log {
|
||||
@@ -161,7 +181,7 @@
|
||||
assigned-clocks = <&cru SCLK_RMII_SRC>;
|
||||
assigned-clock-parents = <&clkin_gmac>;
|
||||
clock_in_out = "input";
|
||||
phy-supply = <&vcc_lan>;
|
||||
phy-supply = <&vcc3v3_lan>;
|
||||
phy-mode = "rgmii";
|
||||
pinctrl-names = "default";
|
||||
pinctrl-0 = <&rgmii_pins>;
|
||||
@@ -266,8 +286,8 @@
|
||||
};
|
||||
};
|
||||
|
||||
vcc1v8_codec: LDO_REG1 {
|
||||
regulator-name = "vcc1v8_codec";
|
||||
vcca1v8_codec: LDO_REG1 {
|
||||
regulator-name = "vcca1v8_codec";
|
||||
regulator-always-on;
|
||||
regulator-boot-on;
|
||||
regulator-min-microvolt = <1800000>;
|
||||
@@ -277,8 +297,8 @@
|
||||
};
|
||||
};
|
||||
|
||||
vcc1v8_hdmi: LDO_REG2 {
|
||||
regulator-name = "vcc1v8_hdmi";
|
||||
vcca1v8_hdmi: LDO_REG2 {
|
||||
regulator-name = "vcca1v8_hdmi";
|
||||
regulator-always-on;
|
||||
regulator-boot-on;
|
||||
regulator-min-microvolt = <1800000>;
|
||||
@@ -335,8 +355,8 @@
|
||||
};
|
||||
};
|
||||
|
||||
vcc0v9_hdmi: LDO_REG7 {
|
||||
regulator-name = "vcc0v9_hdmi";
|
||||
vcca0v9_hdmi: LDO_REG7 {
|
||||
regulator-name = "vcca0v9_hdmi";
|
||||
regulator-always-on;
|
||||
regulator-boot-on;
|
||||
regulator-min-microvolt = <900000>;
|
||||
@@ -362,8 +382,6 @@
|
||||
regulator-name = "vcc_cam";
|
||||
regulator-always-on;
|
||||
regulator-boot-on;
|
||||
regulator-min-microvolt = <3300000>;
|
||||
regulator-max-microvolt = <3300000>;
|
||||
regulator-state-mem {
|
||||
regulator-off-in-suspend;
|
||||
};
|
||||
@@ -373,8 +391,6 @@
|
||||
regulator-name = "vcc_mipi";
|
||||
regulator-always-on;
|
||||
regulator-boot-on;
|
||||
regulator-min-microvolt = <3300000>;
|
||||
regulator-max-microvolt = <3300000>;
|
||||
regulator-state-mem {
|
||||
regulator-off-in-suspend;
|
||||
};
|
||||
@@ -425,6 +441,20 @@
|
||||
i2c-scl-rising-time-ns = <300>;
|
||||
i2c-scl-falling-time-ns = <15>;
|
||||
status = "okay";
|
||||
|
||||
es8316: codec@11 {
|
||||
compatible = "everest,es8316";
|
||||
reg = <0x11>;
|
||||
clocks = <&cru SCLK_I2S_8CH_OUT>;
|
||||
clock-names = "mclk";
|
||||
#sound-dai-cells = <0>;
|
||||
|
||||
port {
|
||||
es8316_p0_0: endpoint {
|
||||
remote-endpoint = <&i2s0_p0_0>;
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
&i2c3 {
|
||||
@@ -443,6 +473,14 @@
|
||||
rockchip,playback-channels = <8>;
|
||||
rockchip,capture-channels = <8>;
|
||||
status = "okay";
|
||||
|
||||
i2s0_p0: port {
|
||||
i2s0_p0_0: endpoint {
|
||||
dai-format = "i2s";
|
||||
mclk-fs = <256>;
|
||||
remote-endpoint = <&es8316_p0_0>;
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
&i2s1 {
|
||||
@@ -455,21 +493,10 @@
|
||||
};
|
||||
|
||||
&io_domains {
|
||||
status = "okay";
|
||||
|
||||
audio-supply = <&vcca1v8_codec>;
|
||||
bt656-supply = <&vcc_3v0>;
|
||||
audio-supply = <&vcc1v8_codec>;
|
||||
sdmmc-supply = <&vcc_sdio>;
|
||||
gpio1830-supply = <&vcc_3v0>;
|
||||
};
|
||||
|
||||
&pmu_io_domains {
|
||||
status = "okay";
|
||||
|
||||
pmu1830-supply = <&vcc_3v0>;
|
||||
};
|
||||
|
||||
&pcie_phy {
|
||||
sdmmc-supply = <&vcc_sdio>;
|
||||
status = "okay";
|
||||
};
|
||||
|
||||
@@ -485,6 +512,10 @@
|
||||
status = "okay";
|
||||
};
|
||||
|
||||
&pcie_phy {
|
||||
status = "okay";
|
||||
};
|
||||
|
||||
&pinctrl {
|
||||
bt {
|
||||
bt_enable_h: bt-enable-h {
|
||||
@@ -506,6 +537,20 @@
|
||||
};
|
||||
};
|
||||
|
||||
pmic {
|
||||
pmic_int_l: pmic-int-l {
|
||||
rockchip,pins = <1 RK_PC5 RK_FUNC_GPIO &pcfg_pull_up>;
|
||||
};
|
||||
|
||||
vsel1_pin: vsel1-pin {
|
||||
rockchip,pins = <1 RK_PC1 RK_FUNC_GPIO &pcfg_pull_down>;
|
||||
};
|
||||
|
||||
vsel2_pin: vsel2-pin {
|
||||
rockchip,pins = <1 RK_PB6 RK_FUNC_GPIO &pcfg_pull_down>;
|
||||
};
|
||||
};
|
||||
|
||||
sdio0 {
|
||||
sdio0_bus4: sdio0-bus4 {
|
||||
rockchip,pins = <2 RK_PC4 1 &pcfg_pull_up_20ma>,
|
||||
@@ -523,20 +568,6 @@
|
||||
};
|
||||
};
|
||||
|
||||
pmic {
|
||||
pmic_int_l: pmic-int-l {
|
||||
rockchip,pins = <1 RK_PC5 RK_FUNC_GPIO &pcfg_pull_up>;
|
||||
};
|
||||
|
||||
vsel1_pin: vsel1-pin {
|
||||
rockchip,pins = <1 RK_PC1 RK_FUNC_GPIO &pcfg_pull_down>;
|
||||
};
|
||||
|
||||
vsel2_pin: vsel2-pin {
|
||||
rockchip,pins = <1 RK_PB6 RK_FUNC_GPIO &pcfg_pull_down>;
|
||||
};
|
||||
};
|
||||
|
||||
usb-typec {
|
||||
vcc5v0_typec_en: vcc5v0-typec-en {
|
||||
rockchip,pins = <1 RK_PA3 RK_FUNC_GPIO &pcfg_pull_up>;
|
||||
@@ -560,6 +591,11 @@
|
||||
};
|
||||
};
|
||||
|
||||
&pmu_io_domains {
|
||||
pmu1830-supply = <&vcc_3v0>;
|
||||
status = "okay";
|
||||
};
|
||||
|
||||
&pwm2 {
|
||||
status = "okay";
|
||||
};
|
||||
@@ -570,6 +606,14 @@
|
||||
vref-supply = <&vcc_1v8>;
|
||||
};
|
||||
|
||||
&sdhci {
|
||||
max-frequency = <150000000>;
|
||||
bus-width = <8>;
|
||||
mmc-hs200-1_8v;
|
||||
non-removable;
|
||||
status = "okay";
|
||||
};
|
||||
|
||||
&sdio0 {
|
||||
#address-cells = <1>;
|
||||
#size-cells = <0>;
|
||||
@@ -597,12 +641,13 @@
|
||||
status = "okay";
|
||||
};
|
||||
|
||||
&sdhci {
|
||||
bus-width = <8>;
|
||||
mmc-hs400-1_8v;
|
||||
mmc-hs400-enhanced-strobe;
|
||||
non-removable;
|
||||
status = "okay";
|
||||
&spdif {
|
||||
|
||||
spdif_p0: port {
|
||||
spdif_p0_0: endpoint {
|
||||
remote-endpoint = <&dit_p0_0>;
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
&tcphy0 {
|
||||
@@ -677,15 +722,15 @@
|
||||
status = "okay";
|
||||
};
|
||||
|
||||
&usbdrd_dwc3_0 {
|
||||
status = "okay";
|
||||
dr_mode = "otg";
|
||||
};
|
||||
|
||||
&usbdrd3_1 {
|
||||
status = "okay";
|
||||
};
|
||||
|
||||
&usbdrd_dwc3_0 {
|
||||
status = "okay";
|
||||
dr_mode = "host";
|
||||
};
|
||||
|
||||
&usbdrd_dwc3_1 {
|
||||
status = "okay";
|
||||
dr_mode = "host";
|
||||
|
||||
@@ -70,7 +70,7 @@ static inline bool prom_is_rex(u32 magic)
|
||||
*/
|
||||
typedef struct {
|
||||
int pagesize;
|
||||
unsigned char bitmap[0];
|
||||
unsigned char bitmap[];
|
||||
} memmap;
|
||||
|
||||
|
||||
|
||||
@@ -710,9 +710,9 @@ static int __init rtas_flash_init(void)
|
||||
if (!rtas_validate_flash_data.buf)
|
||||
return -ENOMEM;
|
||||
|
||||
flash_block_cache = kmem_cache_create("rtas_flash_cache",
|
||||
RTAS_BLK_SIZE, RTAS_BLK_SIZE, 0,
|
||||
NULL);
|
||||
flash_block_cache = kmem_cache_create_usercopy("rtas_flash_cache",
|
||||
RTAS_BLK_SIZE, RTAS_BLK_SIZE,
|
||||
0, 0, RTAS_BLK_SIZE, NULL);
|
||||
if (!flash_block_cache) {
|
||||
printk(KERN_ERR "%s: failed to create block cache\n",
|
||||
__func__);
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
# SPDX-License-Identifier: GPL-2.0
|
||||
|
||||
KASAN_SANITIZE := n
|
||||
KCOV_INSTRUMENT := n
|
||||
|
||||
obj-$(CONFIG_PPC32) += kasan_init_32.o
|
||||
obj-$(CONFIG_PPC_8xx) += 8xx.o
|
||||
|
||||
@@ -78,6 +78,7 @@ static inline void arch_exit_to_user_mode_prepare(struct pt_regs *regs,
|
||||
static __always_inline void arch_exit_to_user_mode(void)
|
||||
{
|
||||
mds_user_clear_cpu_buffers();
|
||||
amd_clear_divider();
|
||||
}
|
||||
#define arch_exit_to_user_mode arch_exit_to_user_mode
|
||||
|
||||
|
||||
@@ -156,9 +156,9 @@
|
||||
.endm
|
||||
|
||||
#ifdef CONFIG_CPU_UNRET_ENTRY
|
||||
#define CALL_ZEN_UNTRAIN_RET "call zen_untrain_ret"
|
||||
#define CALL_UNTRAIN_RET "call entry_untrain_ret"
|
||||
#else
|
||||
#define CALL_ZEN_UNTRAIN_RET ""
|
||||
#define CALL_UNTRAIN_RET ""
|
||||
#endif
|
||||
|
||||
/*
|
||||
@@ -166,7 +166,7 @@
|
||||
* return thunk isn't mapped into the userspace tables (then again, AMD
|
||||
* typically has NO_MELTDOWN).
|
||||
*
|
||||
* While zen_untrain_ret() doesn't clobber anything but requires stack,
|
||||
* While retbleed_untrain_ret() doesn't clobber anything but requires stack,
|
||||
* entry_ibpb() will clobber AX, CX, DX.
|
||||
*
|
||||
* As such, this must be placed after every *SWITCH_TO_KERNEL_CR3 at a point
|
||||
@@ -177,14 +177,9 @@
|
||||
defined(CONFIG_CPU_SRSO)
|
||||
ANNOTATE_UNRET_END
|
||||
ALTERNATIVE_2 "", \
|
||||
CALL_ZEN_UNTRAIN_RET, X86_FEATURE_UNRET, \
|
||||
CALL_UNTRAIN_RET, X86_FEATURE_UNRET, \
|
||||
"call entry_ibpb", X86_FEATURE_ENTRY_IBPB
|
||||
#endif
|
||||
|
||||
#ifdef CONFIG_CPU_SRSO
|
||||
ALTERNATIVE_2 "", "call srso_untrain_ret", X86_FEATURE_SRSO, \
|
||||
"call srso_untrain_ret_alias", X86_FEATURE_SRSO_ALIAS
|
||||
#endif
|
||||
.endm
|
||||
|
||||
#else /* __ASSEMBLY__ */
|
||||
@@ -195,10 +190,21 @@
|
||||
_ASM_PTR " 999b\n\t" \
|
||||
".popsection\n\t"
|
||||
|
||||
#ifdef CONFIG_RETHUNK
|
||||
extern void __x86_return_thunk(void);
|
||||
extern void zen_untrain_ret(void);
|
||||
#else
|
||||
static inline void __x86_return_thunk(void) {}
|
||||
#endif
|
||||
|
||||
extern void retbleed_return_thunk(void);
|
||||
extern void srso_return_thunk(void);
|
||||
extern void srso_alias_return_thunk(void);
|
||||
|
||||
extern void retbleed_untrain_ret(void);
|
||||
extern void srso_untrain_ret(void);
|
||||
extern void srso_untrain_ret_alias(void);
|
||||
extern void srso_alias_untrain_ret(void);
|
||||
|
||||
extern void entry_untrain_ret(void);
|
||||
extern void entry_ibpb(void);
|
||||
|
||||
#ifdef CONFIG_RETPOLINE
|
||||
|
||||
@@ -1332,3 +1332,4 @@ void noinstr amd_clear_divider(void)
|
||||
asm volatile(ALTERNATIVE("", "div %2\n\t", X86_BUG_DIV0)
|
||||
:: "a" (0), "d" (0), "r" (1));
|
||||
}
|
||||
EXPORT_SYMBOL_GPL(amd_clear_divider);
|
||||
|
||||
@@ -61,6 +61,8 @@ EXPORT_SYMBOL_GPL(x86_pred_cmd);
|
||||
|
||||
static DEFINE_MUTEX(spec_ctrl_mutex);
|
||||
|
||||
void (*x86_return_thunk)(void) __ro_after_init = &__x86_return_thunk;
|
||||
|
||||
/* Update SPEC_CTRL MSR and its cached copy unconditionally */
|
||||
static void update_spec_ctrl(u64 val)
|
||||
{
|
||||
@@ -155,8 +157,13 @@ void __init cpu_select_mitigations(void)
|
||||
l1tf_select_mitigation();
|
||||
md_clear_select_mitigation();
|
||||
srbds_select_mitigation();
|
||||
gds_select_mitigation();
|
||||
|
||||
/*
|
||||
* srso_select_mitigation() depends and must run after
|
||||
* retbleed_select_mitigation().
|
||||
*/
|
||||
srso_select_mitigation();
|
||||
gds_select_mitigation();
|
||||
}
|
||||
|
||||
/*
|
||||
@@ -976,6 +983,9 @@ do_cmd_auto:
|
||||
setup_force_cpu_cap(X86_FEATURE_RETHUNK);
|
||||
setup_force_cpu_cap(X86_FEATURE_UNRET);
|
||||
|
||||
if (IS_ENABLED(CONFIG_RETHUNK))
|
||||
x86_return_thunk = retbleed_return_thunk;
|
||||
|
||||
if (boot_cpu_data.x86_vendor != X86_VENDOR_AMD &&
|
||||
boot_cpu_data.x86_vendor != X86_VENDOR_HYGON)
|
||||
pr_err(RETBLEED_UNTRAIN_MSG);
|
||||
@@ -2318,9 +2328,10 @@ static void __init srso_select_mitigation(void)
|
||||
* Zen1/2 with SMT off aren't vulnerable after the right
|
||||
* IBPB microcode has been applied.
|
||||
*/
|
||||
if ((boot_cpu_data.x86 < 0x19) &&
|
||||
(!cpu_smt_possible() || (cpu_smt_control == CPU_SMT_DISABLED)))
|
||||
if (boot_cpu_data.x86 < 0x19 && !cpu_smt_possible()) {
|
||||
setup_force_cpu_cap(X86_FEATURE_SRSO_NO);
|
||||
return;
|
||||
}
|
||||
}
|
||||
|
||||
if (retbleed_mitigation == RETBLEED_MITIGATION_IBPB) {
|
||||
@@ -2349,11 +2360,15 @@ static void __init srso_select_mitigation(void)
|
||||
* like ftrace, static_call, etc.
|
||||
*/
|
||||
setup_force_cpu_cap(X86_FEATURE_RETHUNK);
|
||||
setup_force_cpu_cap(X86_FEATURE_UNRET);
|
||||
|
||||
if (boot_cpu_data.x86 == 0x19)
|
||||
if (boot_cpu_data.x86 == 0x19) {
|
||||
setup_force_cpu_cap(X86_FEATURE_SRSO_ALIAS);
|
||||
else
|
||||
x86_return_thunk = srso_alias_return_thunk;
|
||||
} else {
|
||||
setup_force_cpu_cap(X86_FEATURE_SRSO);
|
||||
x86_return_thunk = srso_return_thunk;
|
||||
}
|
||||
srso_mitigation = SRSO_MITIGATION_SAFE_RET;
|
||||
} else {
|
||||
pr_err("WARNING: kernel not compiled with CPU_SRSO.\n");
|
||||
@@ -2602,6 +2617,9 @@ static ssize_t gds_show_state(char *buf)
|
||||
|
||||
static ssize_t srso_show_state(char *buf)
|
||||
{
|
||||
if (boot_cpu_has(X86_FEATURE_SRSO_NO))
|
||||
return sysfs_emit(buf, "Mitigation: SMT disabled\n");
|
||||
|
||||
return sysfs_emit(buf, "%s%s\n",
|
||||
srso_strings[srso_mitigation],
|
||||
(cpu_has_ibpb_brtype_microcode() ? "" : ", no microcode"));
|
||||
|
||||
@@ -123,6 +123,19 @@ EXPORT_SYMBOL_GPL(arch_static_call_transform);
|
||||
*/
|
||||
bool __static_call_fixup(void *tramp, u8 op, void *dest)
|
||||
{
|
||||
unsigned long addr = (unsigned long)tramp;
|
||||
/*
|
||||
* Not all .return_sites are a static_call trampoline (most are not).
|
||||
* Check if the 3 bytes after the return are still kernel text, if not,
|
||||
* then this definitely is not a trampoline and we need not worry
|
||||
* further.
|
||||
*
|
||||
* This avoids the memcmp() below tripping over pagefaults etc..
|
||||
*/
|
||||
if (((addr >> PAGE_SHIFT) != ((addr + 7) >> PAGE_SHIFT)) &&
|
||||
!kernel_text_address(addr + 7))
|
||||
return false;
|
||||
|
||||
if (memcmp(tramp+5, tramp_ud, 3)) {
|
||||
/* Not a trampoline site, not our problem. */
|
||||
return false;
|
||||
|
||||
@@ -198,8 +198,6 @@ DEFINE_IDTENTRY(exc_divide_error)
|
||||
{
|
||||
do_error_trap(regs, 0, "divide error", X86_TRAP_DE, SIGFPE,
|
||||
FPE_INTDIV, error_get_trap_addr(regs));
|
||||
|
||||
amd_clear_divider();
|
||||
}
|
||||
|
||||
DEFINE_IDTENTRY(exc_overflow)
|
||||
|
||||
@@ -134,18 +134,18 @@ SECTIONS
|
||||
KPROBES_TEXT
|
||||
ALIGN_ENTRY_TEXT_BEGIN
|
||||
#ifdef CONFIG_CPU_SRSO
|
||||
*(.text.__x86.rethunk_untrain)
|
||||
*(.text..__x86.rethunk_untrain)
|
||||
#endif
|
||||
|
||||
ENTRY_TEXT
|
||||
|
||||
#ifdef CONFIG_CPU_SRSO
|
||||
/*
|
||||
* See the comment above srso_untrain_ret_alias()'s
|
||||
* See the comment above srso_alias_untrain_ret()'s
|
||||
* definition.
|
||||
*/
|
||||
. = srso_untrain_ret_alias | (1 << 2) | (1 << 8) | (1 << 14) | (1 << 20);
|
||||
*(.text.__x86.rethunk_safe)
|
||||
. = srso_alias_untrain_ret | (1 << 2) | (1 << 8) | (1 << 14) | (1 << 20);
|
||||
*(.text..__x86.rethunk_safe)
|
||||
#endif
|
||||
ALIGN_ENTRY_TEXT_END
|
||||
SOFTIRQENTRY_TEXT
|
||||
@@ -155,8 +155,8 @@ SECTIONS
|
||||
|
||||
#ifdef CONFIG_RETPOLINE
|
||||
__indirect_thunk_start = .;
|
||||
*(.text.__x86.indirect_thunk)
|
||||
*(.text.__x86.return_thunk)
|
||||
*(.text..__x86.indirect_thunk)
|
||||
*(.text..__x86.return_thunk)
|
||||
__indirect_thunk_end = .;
|
||||
#endif
|
||||
} :text =0xcccc
|
||||
@@ -518,7 +518,7 @@ INIT_PER_CPU(irq_stack_backing_store);
|
||||
#endif
|
||||
|
||||
#ifdef CONFIG_RETHUNK
|
||||
. = ASSERT((__ret & 0x3f) == 0, "__ret not cacheline-aligned");
|
||||
. = ASSERT((retbleed_return_thunk & 0x3f) == 0, "retbleed_return_thunk not cacheline-aligned");
|
||||
. = ASSERT((srso_safe_ret & 0x3f) == 0, "srso_safe_ret not cacheline-aligned");
|
||||
#endif
|
||||
|
||||
@@ -533,8 +533,8 @@ INIT_PER_CPU(irq_stack_backing_store);
|
||||
* Instead do: (A | B) - (A & B) in order to compute the XOR
|
||||
* of the two function addresses:
|
||||
*/
|
||||
. = ASSERT(((ABSOLUTE(srso_untrain_ret_alias) | srso_safe_ret_alias) -
|
||||
(ABSOLUTE(srso_untrain_ret_alias) & srso_safe_ret_alias)) == ((1 << 2) | (1 << 8) | (1 << 14) | (1 << 20)),
|
||||
. = ASSERT(((ABSOLUTE(srso_alias_untrain_ret) | srso_alias_safe_ret) -
|
||||
(ABSOLUTE(srso_alias_untrain_ret) & srso_alias_safe_ret)) == ((1 << 2) | (1 << 8) | (1 << 14) | (1 << 20)),
|
||||
"SRSO function pair won't alias");
|
||||
#endif
|
||||
|
||||
|
||||
@@ -3376,6 +3376,7 @@ static void svm_flush_tlb_gva(struct kvm_vcpu *vcpu, gva_t gva)
|
||||
|
||||
static void svm_prepare_guest_switch(struct kvm_vcpu *vcpu)
|
||||
{
|
||||
amd_clear_divider();
|
||||
}
|
||||
|
||||
static inline void sync_cr8_to_lapic(struct kvm_vcpu *vcpu)
|
||||
|
||||
@@ -11,7 +11,7 @@
|
||||
#include <asm/frame.h>
|
||||
#include <asm/nops.h>
|
||||
|
||||
.section .text.__x86.indirect_thunk
|
||||
.section .text..__x86.indirect_thunk
|
||||
|
||||
.macro RETPOLINE reg
|
||||
ANNOTATE_INTRA_FUNCTION_CALL
|
||||
@@ -75,74 +75,105 @@ SYM_CODE_END(__x86_indirect_thunk_array)
|
||||
#ifdef CONFIG_RETHUNK
|
||||
|
||||
/*
|
||||
* srso_untrain_ret_alias() and srso_safe_ret_alias() are placed at
|
||||
* srso_alias_untrain_ret() and srso_alias_safe_ret() are placed at
|
||||
* special addresses:
|
||||
*
|
||||
* - srso_untrain_ret_alias() is 2M aligned
|
||||
* - srso_safe_ret_alias() is also in the same 2M page but bits 2, 8, 14
|
||||
* - srso_alias_untrain_ret() is 2M aligned
|
||||
* - srso_alias_safe_ret() is also in the same 2M page but bits 2, 8, 14
|
||||
* and 20 in its virtual address are set (while those bits in the
|
||||
* srso_untrain_ret_alias() function are cleared).
|
||||
* srso_alias_untrain_ret() function are cleared).
|
||||
*
|
||||
* This guarantees that those two addresses will alias in the branch
|
||||
* target buffer of Zen3/4 generations, leading to any potential
|
||||
* poisoned entries at that BTB slot to get evicted.
|
||||
*
|
||||
* As a result, srso_safe_ret_alias() becomes a safe return.
|
||||
* As a result, srso_alias_safe_ret() becomes a safe return.
|
||||
*/
|
||||
#ifdef CONFIG_CPU_SRSO
|
||||
.section .text.__x86.rethunk_untrain
|
||||
.section .text..__x86.rethunk_untrain
|
||||
|
||||
SYM_START(srso_untrain_ret_alias, SYM_L_GLOBAL, SYM_A_NONE)
|
||||
SYM_START(srso_alias_untrain_ret, SYM_L_GLOBAL, SYM_A_NONE)
|
||||
UNWIND_HINT_FUNC
|
||||
ASM_NOP2
|
||||
lfence
|
||||
jmp __x86_return_thunk
|
||||
SYM_FUNC_END(srso_untrain_ret_alias)
|
||||
__EXPORT_THUNK(srso_untrain_ret_alias)
|
||||
jmp srso_alias_return_thunk
|
||||
SYM_FUNC_END(srso_alias_untrain_ret)
|
||||
__EXPORT_THUNK(srso_alias_untrain_ret)
|
||||
|
||||
.section .text.__x86.rethunk_safe
|
||||
#endif
|
||||
|
||||
/* Needs a definition for the __x86_return_thunk alternative below. */
|
||||
SYM_START(srso_safe_ret_alias, SYM_L_GLOBAL, SYM_A_NONE)
|
||||
#ifdef CONFIG_CPU_SRSO
|
||||
add $8, %_ASM_SP
|
||||
UNWIND_HINT_FUNC
|
||||
#endif
|
||||
.section .text..__x86.rethunk_safe
|
||||
#else
|
||||
/* dummy definition for alternatives */
|
||||
SYM_START(srso_alias_untrain_ret, SYM_L_GLOBAL, SYM_A_NONE)
|
||||
ANNOTATE_UNRET_SAFE
|
||||
ret
|
||||
int3
|
||||
SYM_FUNC_END(srso_safe_ret_alias)
|
||||
SYM_FUNC_END(srso_alias_untrain_ret)
|
||||
#endif
|
||||
|
||||
.section .text.__x86.return_thunk
|
||||
SYM_START(srso_alias_safe_ret, SYM_L_GLOBAL, SYM_A_NONE)
|
||||
lea 8(%_ASM_SP), %_ASM_SP
|
||||
UNWIND_HINT_FUNC
|
||||
ANNOTATE_UNRET_SAFE
|
||||
ret
|
||||
int3
|
||||
SYM_FUNC_END(srso_alias_safe_ret)
|
||||
|
||||
.section .text..__x86.return_thunk
|
||||
|
||||
SYM_CODE_START(srso_alias_return_thunk)
|
||||
UNWIND_HINT_FUNC
|
||||
ANNOTATE_NOENDBR
|
||||
call srso_alias_safe_ret
|
||||
ud2
|
||||
SYM_CODE_END(srso_alias_return_thunk)
|
||||
|
||||
/*
|
||||
* Some generic notes on the untraining sequences:
|
||||
*
|
||||
* They are interchangeable when it comes to flushing potentially wrong
|
||||
* RET predictions from the BTB.
|
||||
*
|
||||
* The SRSO Zen1/2 (MOVABS) untraining sequence is longer than the
|
||||
* Retbleed sequence because the return sequence done there
|
||||
* (srso_safe_ret()) is longer and the return sequence must fully nest
|
||||
* (end before) the untraining sequence. Therefore, the untraining
|
||||
* sequence must fully overlap the return sequence.
|
||||
*
|
||||
* Regarding alignment - the instructions which need to be untrained,
|
||||
* must all start at a cacheline boundary for Zen1/2 generations. That
|
||||
* is, instruction sequences starting at srso_safe_ret() and
|
||||
* the respective instruction sequences at retbleed_return_thunk()
|
||||
* must start at a cacheline boundary.
|
||||
*/
|
||||
|
||||
/*
|
||||
* Safety details here pertain to the AMD Zen{1,2} microarchitecture:
|
||||
* 1) The RET at __x86_return_thunk must be on a 64 byte boundary, for
|
||||
* 1) The RET at retbleed_return_thunk must be on a 64 byte boundary, for
|
||||
* alignment within the BTB.
|
||||
* 2) The instruction at zen_untrain_ret must contain, and not
|
||||
* 2) The instruction at retbleed_untrain_ret must contain, and not
|
||||
* end with, the 0xc3 byte of the RET.
|
||||
* 3) STIBP must be enabled, or SMT disabled, to prevent the sibling thread
|
||||
* from re-poisioning the BTB prediction.
|
||||
*/
|
||||
.align 64
|
||||
.skip 64 - (__ret - zen_untrain_ret), 0xcc
|
||||
SYM_FUNC_START_NOALIGN(zen_untrain_ret);
|
||||
.skip 64 - (retbleed_return_thunk - retbleed_untrain_ret), 0xcc
|
||||
SYM_FUNC_START_NOALIGN(retbleed_untrain_ret);
|
||||
|
||||
/*
|
||||
* As executed from zen_untrain_ret, this is:
|
||||
* As executed from retbleed_untrain_ret, this is:
|
||||
*
|
||||
* TEST $0xcc, %bl
|
||||
* LFENCE
|
||||
* JMP __x86_return_thunk
|
||||
* JMP retbleed_return_thunk
|
||||
*
|
||||
* Executing the TEST instruction has a side effect of evicting any BTB
|
||||
* prediction (potentially attacker controlled) attached to the RET, as
|
||||
* __x86_return_thunk + 1 isn't an instruction boundary at the moment.
|
||||
* retbleed_return_thunk + 1 isn't an instruction boundary at the moment.
|
||||
*/
|
||||
.byte 0xf6
|
||||
|
||||
/*
|
||||
* As executed from __x86_return_thunk, this is a plain RET.
|
||||
* As executed from retbleed_return_thunk, this is a plain RET.
|
||||
*
|
||||
* As part of the TEST above, RET is the ModRM byte, and INT3 the imm8.
|
||||
*
|
||||
@@ -154,13 +185,13 @@ SYM_FUNC_START_NOALIGN(zen_untrain_ret);
|
||||
* With SMT enabled and STIBP active, a sibling thread cannot poison
|
||||
* RET's prediction to a type of its choice, but can evict the
|
||||
* prediction due to competitive sharing. If the prediction is
|
||||
* evicted, __x86_return_thunk will suffer Straight Line Speculation
|
||||
* evicted, retbleed_return_thunk will suffer Straight Line Speculation
|
||||
* which will be contained safely by the INT3.
|
||||
*/
|
||||
SYM_INNER_LABEL(__ret, SYM_L_GLOBAL)
|
||||
SYM_INNER_LABEL(retbleed_return_thunk, SYM_L_GLOBAL)
|
||||
ret
|
||||
int3
|
||||
SYM_CODE_END(__ret)
|
||||
SYM_CODE_END(retbleed_return_thunk)
|
||||
|
||||
/*
|
||||
* Ensure the TEST decoding / BTB invalidation is complete.
|
||||
@@ -171,16 +202,16 @@ SYM_CODE_END(__ret)
|
||||
* Jump back and execute the RET in the middle of the TEST instruction.
|
||||
* INT3 is for SLS protection.
|
||||
*/
|
||||
jmp __ret
|
||||
jmp retbleed_return_thunk
|
||||
int3
|
||||
SYM_FUNC_END(zen_untrain_ret)
|
||||
__EXPORT_THUNK(zen_untrain_ret)
|
||||
SYM_FUNC_END(retbleed_untrain_ret)
|
||||
__EXPORT_THUNK(retbleed_untrain_ret)
|
||||
|
||||
/*
|
||||
* SRSO untraining sequence for Zen1/2, similar to zen_untrain_ret()
|
||||
* SRSO untraining sequence for Zen1/2, similar to retbleed_untrain_ret()
|
||||
* above. On kernel entry, srso_untrain_ret() is executed which is a
|
||||
*
|
||||
* movabs $0xccccccc308c48348,%rax
|
||||
* movabs $0xccccc30824648d48,%rax
|
||||
*
|
||||
* and when the return thunk executes the inner label srso_safe_ret()
|
||||
* later, it is a stack manipulation and a RET which is mispredicted and
|
||||
@@ -191,22 +222,44 @@ __EXPORT_THUNK(zen_untrain_ret)
|
||||
SYM_START(srso_untrain_ret, SYM_L_GLOBAL, SYM_A_NONE)
|
||||
.byte 0x48, 0xb8
|
||||
|
||||
/*
|
||||
* This forces the function return instruction to speculate into a trap
|
||||
* (UD2 in srso_return_thunk() below). This RET will then mispredict
|
||||
* and execution will continue at the return site read from the top of
|
||||
* the stack.
|
||||
*/
|
||||
SYM_INNER_LABEL(srso_safe_ret, SYM_L_GLOBAL)
|
||||
add $8, %_ASM_SP
|
||||
lea 8(%_ASM_SP), %_ASM_SP
|
||||
ret
|
||||
int3
|
||||
int3
|
||||
int3
|
||||
/* end of movabs */
|
||||
lfence
|
||||
call srso_safe_ret
|
||||
int3
|
||||
ud2
|
||||
SYM_CODE_END(srso_safe_ret)
|
||||
SYM_FUNC_END(srso_untrain_ret)
|
||||
__EXPORT_THUNK(srso_untrain_ret)
|
||||
|
||||
SYM_FUNC_START(__x86_return_thunk)
|
||||
ALTERNATIVE_2 "jmp __ret", "call srso_safe_ret", X86_FEATURE_SRSO, \
|
||||
"call srso_safe_ret_alias", X86_FEATURE_SRSO_ALIAS
|
||||
SYM_CODE_START(srso_return_thunk)
|
||||
UNWIND_HINT_FUNC
|
||||
ANNOTATE_NOENDBR
|
||||
call srso_safe_ret
|
||||
ud2
|
||||
SYM_CODE_END(srso_return_thunk)
|
||||
|
||||
SYM_FUNC_START(entry_untrain_ret)
|
||||
ALTERNATIVE_2 "jmp retbleed_untrain_ret", \
|
||||
"jmp srso_untrain_ret", X86_FEATURE_SRSO, \
|
||||
"jmp srso_alias_untrain_ret", X86_FEATURE_SRSO_ALIAS
|
||||
SYM_FUNC_END(entry_untrain_ret)
|
||||
__EXPORT_THUNK(entry_untrain_ret)
|
||||
|
||||
SYM_CODE_START(__x86_return_thunk)
|
||||
UNWIND_HINT_FUNC
|
||||
ANNOTATE_NOENDBR
|
||||
ANNOTATE_UNRET_SAFE
|
||||
ret
|
||||
int3
|
||||
SYM_CODE_END(__x86_return_thunk)
|
||||
EXPORT_SYMBOL(__x86_return_thunk)
|
||||
|
||||
@@ -432,6 +432,9 @@ static const struct usb_device_id blacklist_table[] = {
|
||||
{ USB_DEVICE(0x0489, 0xe0d9), .driver_info = BTUSB_MEDIATEK |
|
||||
BTUSB_WIDEBAND_SPEECH |
|
||||
BTUSB_VALID_LE_STATES },
|
||||
{ USB_DEVICE(0x0489, 0xe0f5), .driver_info = BTUSB_MEDIATEK |
|
||||
BTUSB_WIDEBAND_SPEECH |
|
||||
BTUSB_VALID_LE_STATES },
|
||||
{ USB_DEVICE(0x13d3, 0x3568), .driver_info = BTUSB_MEDIATEK |
|
||||
BTUSB_WIDEBAND_SPEECH |
|
||||
BTUSB_VALID_LE_STATES },
|
||||
|
||||
@@ -38,4 +38,4 @@ obj-$(CONFIG_VEXPRESS_CONFIG) += vexpress-config.o
|
||||
obj-$(CONFIG_DA8XX_MSTPRI) += da8xx-mstpri.o
|
||||
|
||||
# MHI
|
||||
obj-$(CONFIG_MHI_BUS) += mhi/
|
||||
obj-y += mhi/
|
||||
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user