Skip to content

[linux-nvidia-6.17] NVIDIA: SAUCE: mediatek 8250 UART change#349

Open
abhsahu wants to merge 516 commits intoNVIDIA:24.04_linux-nvidia-6.17-nextfrom
abhsahu:mtk_8250_uart_24_Mar_2026
Open

[linux-nvidia-6.17] NVIDIA: SAUCE: mediatek 8250 UART change#349
abhsahu wants to merge 516 commits intoNVIDIA:24.04_linux-nvidia-6.17-nextfrom
abhsahu:mtk_8250_uart_24_Mar_2026

Conversation

@abhsahu
Copy link
Copy Markdown

@abhsahu abhsahu commented Mar 24, 2026

We have applied SAUCE patch for adding serial port support for GB10.
Mediatek has sent the changes in mailing list https://patchwork.kernel.org/project/linux-mediatek/patch/20260105024103.2027085-2-zhiyong.tao@mediatek.com/ which is under review.

This PR reverts the previous SAUCE patch and applies the latest version from the mailing list.
The only functional difference is the addition of the NVDA0240 ACPI ID apart from MTKI0511.

James Morse and others added 30 commits February 13, 2026 16:49
…object

BugLink: https://bugs.launchpad.net/bugs/2122432

ARM SMMU with MPAM support are able to mark streams of traffic with
the QoS labels MPAM uses. The user-space interface for MPAM is the
resctrl filesystem, which allows threads to be moved between groups,
its natural to do the same for iommu_groups.
The resctrl interface lists threads, so will also need to list
iommu_groups, it will be necessary to walk the list of iommu_groups.
To ensure this matches what user-space sees via sysfs, it is best
to walk the kobjects.
When making a change, resctrl will only have the id of a group.
To avoid walking the list of kobjects in this case, add
iommu_group_get_by_id().

Signed-off-by: James Morse <james.morse@arm.com>
(cherry picked from commit 43349f9d05cdd700ffe08a4d5ee2dbcaa9a86f84 https://git.kernel.org/pub/scm/linux/kernel/git/morse/linux.git)
Signed-off-by: Fenghua Yu <fenghuay@nvidia.com>
Acked-by: Jamie Nguyen <jamien@nvidia.com>
Acked-by: Matthew R. Ochs <mochs@nvidia.com>
Acked-by: Noah Wager <noah.wager@canonical.com>
BugLink: https://bugs.launchpad.net/bugs/2122432

To walk the list of iommu groups visible in sysfs, resctrl needs access
to iommu_group_kset. Expose it.

Signed-off-by: James Morse <james.morse@arm.com>
(cherry picked from commit d133049deda711d40675b0fd3e93677d81046b01 https://git.kernel.org/pub/scm/linux/kernel/git/morse/linux.git)
Signed-off-by: Fenghua Yu <fenghuay@nvidia.com>
Acked-by: Jamie Nguyen <jamien@nvidia.com>
Acked-by: Matthew R. Ochs <mochs@nvidia.com>
Acked-by: Noah Wager <noah.wager@canonical.com>
… walked

BugLink: https://bugs.launchpad.net/bugs/2122432

To expose iommu_groups via the resctrl filesystem, the resctrl driver
needs to be able to walk the list of iommu_groups. These are exposed
via sysfs as a kset.
Add kset_get_next_obj() to allow resctrl to walk the kobjects in the
kset.

Signed-off-by: James Morse <james.morse@arm.com>
(cherry picked from commit ac5ef3495532d2cc9994a2fa8750b7b1b591cff1 https://git.kernel.org/pub/scm/linux/kernel/git/morse/linux.git)
Signed-off-by: Fenghua Yu <fenghuay@nvidia.com>
Acked-by: Jamie Nguyen <jamien@nvidia.com>
Acked-by: Matthew R. Ochs <mochs@nvidia.com>
Acked-by: Noah Wager <noah.wager@canonical.com>
…rtid and pmg

BugLink: https://bugs.launchpad.net/bugs/2122432

SMMU that support MPAM can be configured to use a particular partid
and pmg for a stream. The assignment of an iommu_group and its
corresponding streams should be done via resctrl.
Add helpers similar to setting a closid/rmid on a task. We need
the same shifting if the CPUs are using CDP. The SMMU only takes
one partid, conceptually its always making data accesses.

Signed-off-by: James Morse <james.morse@arm.com>
(cherry picked from commit 2393c3cf73cf642b67533ade39094fb9dd9d053c https://git.kernel.org/pub/scm/linux/kernel/git/morse/linux.git)
Signed-off-by: Fenghua Yu <fenghuay@nvidia.com>
Acked-by: Jamie Nguyen <jamien@nvidia.com>
Acked-by: Matthew R. Ochs <mochs@nvidia.com>
Acked-by: Noah Wager <noah.wager@canonical.com>
…resctrl groups

BugLink: https://bugs.launchpad.net/bugs/2122432

Arm's MPAM has support for assigning devices behind an IOMMU to a
control or monitor group. This can be used for device-passthrough
for a VM, or user-space drivers using VFIO to ensure the device
is either in the same control group as the CPU threads.
Alternatively, the iommu_group may be assigned to a different
control group with preferential schema values.
Extend the resctrl tasks file to include iommu_groups. These
appear as 'iommu_group:0', where 0 is the group number that
can be found from /sys/kernel/iommu_groups/. iommu_groups
can be moved between resctrl groups by writing this string
in the same way as tasks are moved.
No state is preserved by resctrl, an iommu_group that disappears
will no longer be listed as being part of a resctrl group. A new
iommu_group will appear in the default group.
Add helpers to list and move iommu_groups. Architecture specific
helpers are used to apply the closid/rmid to the iommu_group due
to the way MPAM emulates CDP.
Tested-by: Amit Singh Tomar <amitsinght@marvell.com>

Signed-off-by: James Morse <james.morse@arm.com>
(cherry picked from commit 98b622c413ee64b8e05f93f0ff5f8cf85776afba https://git.kernel.org/pub/scm/linux/kernel/git/morse/linux.git)
Signed-off-by: Fenghua Yu <fenghuay@nvidia.com>
Acked-by: Jamie Nguyen <jamien@nvidia.com>
Acked-by: Matthew R. Ochs <mochs@nvidia.com>
Acked-by: Noah Wager <noah.wager@canonical.com>
BugLink: https://bugs.launchpad.net/bugs/2122432

The Arm MPAM Firmware-backed (Fb) Profile describes an SCMI based
protocol to access "Memory System Components" (MSCs) in an "Memory System
Resource Partitioning And Monitoring" (MPAM) enabled system.
Although this SCMI protocol follows the usual protocol properties, it
will not be described in the SCMI specifications. Also since ACPI based
systems will need to use this MPAM-fb profile, we do not follow the
usual way of describing each protocol function as a function in the SCMI
framework system.
Instead there is one generic transport function, that takes a
preformatted buffer and transfers this to the MSC agent.

Signed-off-by: Andre Przywara <andre.przywara@arm.com>
Signed-off-by: James Morse <james.morse@arm.com>
(cherry picked from commit 0f353a5efef50bf98ca01fc9900edb1c68576439 https://git.kernel.org/pub/scm/linux/kernel/git/morse/linux.git)
Signed-off-by: Fenghua Yu <fenghuay@nvidia.com>
Acked-by: Jamie Nguyen <jamien@nvidia.com>
Acked-by: Matthew R. Ochs <mochs@nvidia.com>
Acked-by: Noah Wager <noah.wager@canonical.com>
BugLink: https://bugs.launchpad.net/bugs/2122432

The Arm MPAM Firmware-backed (Fb) Profile document[1] describes an
alternative way of accessing the "Memory System Components" (MSC) in an
MPAM enabled system.
Normally the MSCs are MMIO mapped, but in some implementations this
might not be possible (MSC located outside of the local socket, MSC
mapped secure-only) or desirable (direct MMIO access too slow or needs
to be mediated through a control processor). MPAM-fb standardises a
protocol to abstract MSC accesses, building on the SCMI protocol.
Add functions that do an MSC read or write access by redirecting the
request through a firmware interface. This can either be through any
supported SCMI transport, described via devicetree nodes, or via an ACPI
PCC shared memory and mailbox combination.

Signed-off-by: Andre Przywara <andre.przywara@arm.com>
Signed-off-by: James Morse <james.morse@arm.com>
(cherry picked from commit 2813c2c356c721ffe6b36529d336f8ea561f2753 https://git.kernel.org/pub/scm/linux/kernel/git/morse/linux.git)
Signed-off-by: Fenghua Yu <fenghuay@nvidia.com>
Acked-by: Jamie Nguyen <jamien@nvidia.com>
Acked-by: Matthew R. Ochs <mochs@nvidia.com>
Acked-by: Noah Wager <noah.wager@canonical.com>
BugLink: https://bugs.launchpad.net/bugs/2122432

Carl reports that some platforms use the same PCC channel for multiple
MSCs, which leads to the driver not probing.
Add a list that is searched each time a new channel is allocated.
CC: Carl Worth <carl@os.amperecomputing.com>

Signed-off-by: James Morse <james.morse@arm.com>
(cherry picked from commit 12faf26e0cf2547819ff5bbb47779c634a7de1ab https://git.kernel.org/pub/scm/linux/kernel/git/morse/linux.git)
Signed-off-by: Fenghua Yu <fenghuay@nvidia.com>
Acked-by: Jamie Nguyen <jamien@nvidia.com>
Acked-by: Matthew R. Ochs <mochs@nvidia.com>
Acked-by: Noah Wager <noah.wager@canonical.com>
…d cleanup

BugLink: https://bugs.launchpad.net/bugs/2122432

Squash this into the previous patch once it has been tested...
... does anyone have a PCC platform that can take this for a spin?

Signed-off-by: James Morse <james.morse@arm.com>
(cherry picked from commit 4edb3917c0bacddf62fcd54ab0b5cdba6c2cedf3 https://git.kernel.org/pub/scm/linux/kernel/git/morse/linux.git)
Signed-off-by: Fenghua Yu <fenghuay@nvidia.com>
Acked-by: Jamie Nguyen <jamien@nvidia.com>
Acked-by: Matthew R. Ochs <mochs@nvidia.com>
Acked-by: Noah Wager <noah.wager@canonical.com>
…isable monitor overflow

BugLink: https://bugs.launchpad.net/bugs/2122432

Resctrl has an overflow handler that runs on each domain every second
to ensure that any overflow of the hardware counter is accounted for.
MPAM can have counters as large as 63 bits, in which case there is no
need to check for overflow.
To allow other architectures to disable this, add a helper that reports
whether counters can overflow.

Signed-off-by: James Morse <james.morse@arm.com>
(cherry picked from commit 935ddfc61145dc5d12df9487676a60341376c0f0 https://git.kernel.org/pub/scm/linux/kernel/git/morse/linux.git)
Signed-off-by: Fenghua Yu <fenghuay@nvidia.com>
Acked-by: Jamie Nguyen <jamien@nvidia.com>
Acked-by: Matthew R. Ochs <mochs@nvidia.com>
Acked-by: Noah Wager <noah.wager@canonical.com>
…n overflow

BugLink: https://bugs.launchpad.net/bugs/2122432

Resctrl has an overflow handler that runs on each domain every second
to ensure that any overflow of the hardware counter is accounted for.
MPAM can have counters as large as 63 bits, in which case there is no
need to check for overflow.
To allow the overflow handler to be disabled, determine if an overflow
can happen. If a class is not implemented, or has the 63bit counter,
it can't overflow.

Signed-off-by: James Morse <james.morse@arm.com>
(cherry picked from commit 5cbe15bd6c1d393cf1ffe2b259a3be54a5345e1e https://git.kernel.org/pub/scm/linux/kernel/git/morse/linux.git)
Signed-off-by: Fenghua Yu <fenghuay@nvidia.com>
Acked-by: Jamie Nguyen <jamien@nvidia.com>
Acked-by: Matthew R. Ochs <mochs@nvidia.com>
Acked-by: Noah Wager <noah.wager@canonical.com>
BugLink: https://bugs.launchpad.net/bugs/2122432

Resctrl has an overflow handler that runs on each domain every second
to ensure that any overflow of the hardware counter is accounted for.
MPAM can have counters as large as 63 bits, in which case there is no
need to check for overflow.
Call the new arch helpers to determine this.

Signed-off-by: James Morse <james.morse@arm.com>
(cherry picked from commit 7120f602ee83c2fb75517b137efd41b83777ba76 https://git.kernel.org/pub/scm/linux/kernel/git/morse/linux.git)
Signed-off-by: Fenghua Yu <fenghuay@nvidia.com>
Acked-by: Jamie Nguyen <jamien@nvidia.com>
Acked-by: Matthew R. Ochs <mochs@nvidia.com>
Acked-by: Noah Wager <noah.wager@canonical.com>
…/cache_id

BugLink: https://bugs.launchpad.net/bugs/2122432

This patch uniform data type of component_id/domid/id/cache_id to
u32 to avoid type confusion. According to ACPI for mpam, cache id
is used as locator for cache MSC. Reference to RD_PPTT_CACHE_ID
definition from edk2-platforms, u32 is enough for cache_id.
	(                                                              \
	  (((PackageId) & 0xF) << 20) | (((ClusterId) & 0xFF) << 12) | \
	  (((CoreId) & 0xFF) << 4) | ((CacheType) & 0xF)               \
	)
refs:
1. ACPI for mpam: https://developer.arm.com/documentation/den0065/latest/
2. RD_PPTT_CACHE_ID from edk2-platforms: https://github.com/tianocore/edk2-platforms/blob/master/Platform/ARM/SgiPkg/Include/SgiAcpiHeader.h#L202

Signed-off-by: Rex Nie <rex.nie@jaguarmicro.com>
Signed-off-by: James Morse <james.morse@arm.com>
(cherry picked from commit fb0bcda86e18dded432e3dbe684ea494f9ea71ab https://git.kernel.org/pub/scm/linux/kernel/git/morse/linux.git)
Signed-off-by: Fenghua Yu <fenghuay@nvidia.com>
Acked-by: Jamie Nguyen <jamien@nvidia.com>
Acked-by: Matthew R. Ochs <mochs@nvidia.com>
Acked-by: Noah Wager <noah.wager@canonical.com>
BugLink: https://bugs.launchpad.net/bugs/2122432

mpam_reprogram_ris_partid() always resets the CMAX/CMIN controls to their
'unrestricted' value.
This prevents the controls from being configured.
Add fields in struct mpam_config, and program these values when they
are set in the features bitmask.

Signed-off-by: James Morse <james.morse@arm.com>
(cherry picked from commit 72fd49e3e0392832f9840f83769c38e4ab61e23f https://git.kernel.org/pub/scm/linux/kernel/git/morse/linux.git)
Signed-off-by: Fenghua Yu <fenghuay@nvidia.com>
Acked-by: Jamie Nguyen <jamien@nvidia.com>
Acked-by: Matthew R. Ochs <mochs@nvidia.com>
Acked-by: Noah Wager <noah.wager@canonical.com>
…re-use

BugLink: https://bugs.launchpad.net/bugs/2122432

Functions like mbw_max_to_percent() convert a value into MPAMs 16 bit
fixed point fraction format. These are not only used for memory
bandwidth, but cache capcity controls too.
Rename these functions to convert to/from a 'fract16', and add
helpers for the specific mbw_max/cmax controls.

Signed-off-by: James Morse <james.morse@arm.com>
(cherry picked from commit a852dfa8ee9ed70c8397a9d89206eebcdd2f368e https://git.kernel.org/pub/scm/linux/kernel/git/morse/linux.git)
Signed-off-by: Fenghua Yu <fenghuay@nvidia.com>
Acked-by: Jamie Nguyen <jamien@nvidia.com>
Acked-by: Matthew R. Ochs <mochs@nvidia.com>
Acked-by: Noah Wager <noah.wager@canonical.com>
… separate struct

BugLink: https://bugs.launchpad.net/bugs/2122432

struct resctrl_membw combines parameters that are related to the control
value, and parameters that are specific to the MBA resource.
To allow the control value parsing and management code to be re-used for
other resources, it needs to be separated from the MBA resource.
Add struct resctrl_mba that holds all the parameters that are specific
to the MBA resource.

Signed-off-by: James Morse <james.morse@arm.com>
(cherry picked from commit 2187592a6e6508e2a342cfd18a472304c70e4538 https://git.kernel.org/pub/scm/linux/kernel/git/morse/linux.git)
Signed-off-by: Fenghua Yu <fenghuay@nvidia.com>
Acked-by: Jamie Nguyen <jamien@nvidia.com>
Acked-by: Matthew R. Ochs <mochs@nvidia.com>
Acked-by: Noah Wager <noah.wager@canonical.com>
BugLink: https://bugs.launchpad.net/bugs/2122432

parse_cbm() and parse_bw() both test the staged config for an existing
entry. These would indicate user-space has provided a schema with a
duplicate domain entry. e.g:
| L3:0=ffff;1=f00f;0=f00f
If new parsers are added this duplicate domain test has to be duplicated.
Move it to the caller.

Signed-off-by: James Morse <james.morse@arm.com>
(cherry picked from commit ef00c0fb556566630ade5166b6f7cff772e5e977 https://git.kernel.org/pub/scm/linux/kernel/git/morse/linux.git)
Signed-off-by: Fenghua Yu <fenghuay@nvidia.com>
Acked-by: Jamie Nguyen <jamien@nvidia.com>
Acked-by: Matthew R. Ochs <mochs@nvidia.com>
Acked-by: Noah Wager <noah.wager@canonical.com>
…nstead of parse_bw()

BugLink: https://bugs.launchpad.net/bugs/2122432

MBA is only supported on platforms where the delay inserted by the control
is linear. Resctrl checks the two properties provided by the arch code
match each time it parses part of a new control value.
This doesn't need to be done so frequently, and obscures changes to
parse_bw() to abstract it for use with other control types.
Move this check to the parse_line() caller so it only happens once.

Signed-off-by: James Morse <james.morse@arm.com>
(cherry picked from commit 24f77499324e859031b686ae592465eb459e41b1 https://git.kernel.org/pub/scm/linux/kernel/git/morse/linux.git)
Signed-off-by: Fenghua Yu <fenghuay@nvidia.com>
Acked-by: Jamie Nguyen <jamien@nvidia.com>
Acked-by: Matthew R. Ochs <mochs@nvidia.com>
Acked-by: Noah Wager <noah.wager@canonical.com>
…de resource

BugLink: https://bugs.launchpad.net/bugs/2122432

resctrl_get_default_ctrl() is called by both the architecture code and
filesystem code to return the default value for a control. This depends
on the schema format.
parse_bw() doesn't bother checking the bounds it is given if the
resource is in use by mba_sc. This is because the values parsed from
user-space are not the same as those the control should take.
To make this disparity easier to work with, a second different copy
of the schema format is needed, which would need a version of
resctrl_get_default_ctrl(). This would let the resctrl change the
schema format presented to user-space, provided it converts it to match
what the architecture code expects.
Rename resctrl_get_default_ctrl() to make it clear it returns the
resource default.

Signed-off-by: James Morse <james.morse@arm.com>
(cherry picked from commit 55030f526cf5a4d204bf017d26339bb59a9cab7c https://git.kernel.org/pub/scm/linux/kernel/git/morse/linux.git)
Signed-off-by: Fenghua Yu <fenghuay@nvidia.com>
Acked-by: Jamie Nguyen <jamien@nvidia.com>
Acked-by: Matthew R. Ochs <mochs@nvidia.com>
Acked-by: Noah Wager <noah.wager@canonical.com>
…g it to be different

BugLink: https://bugs.launchpad.net/bugs/2122432

parse_bw() doesn't bother checking the bounds it is given if the
resource is in use by mba_sc. This is because the values parsed from
user-space are not the same as those the control should take.
To make this disparity easier to work with, a second different copy
of the schema format is needed, which would need a version of
resctrl_get_default_ctrl(). This would let the resctrl change the
schema format presented to user-space, provided it converts it to match
what the architecture code expects.
Add a second schema format for use with mba_sc. The membw properties
are copied and the schema version is used. When mba_sc is enabled
the schema copy of these properties is modified.

Signed-off-by: James Morse <james.morse@arm.com>
(cherry picked from commit 3e066eaa16feb66603fef0add0fdbc2af5bea63e https://git.kernel.org/pub/scm/linux/kernel/git/morse/linux.git)
Signed-off-by: Fenghua Yu <fenghuay@nvidia.com>
Acked-by: Jamie Nguyen <jamien@nvidia.com>
Acked-by: Matthew R. Ochs <mochs@nvidia.com>
Acked-by: Noah Wager <noah.wager@canonical.com>
… a bitmap

BugLink: https://bugs.launchpad.net/bugs/2122432

rdtgroup_cbm_to_size() uses a WARN_ON_ONCE() to assert that the resource
it has been passed is one of the L2 or L3 cache. This is to avoid using
uninitialised bitmap properties.
Updating this list for every resource that is configured by a bitmap
doesn't scale. Instead change the WARN_ON_ONCE() to use the schema
format the arch code requested for the resource.

Signed-off-by: James Morse <james.morse@arm.com>
(cherry picked from commit b17ce95b490d79604112587139d854fba384d34f https://git.kernel.org/pub/scm/linux/kernel/git/morse/linux.git)
Signed-off-by: Fenghua Yu <fenghuay@nvidia.com>
Acked-by: Jamie Nguyen <jamien@nvidia.com>
Acked-by: Matthew R. Ochs <mochs@nvidia.com>
Acked-by: Noah Wager <noah.wager@canonical.com>
BugLink: https://bugs.launchpad.net/bugs/2122432

Resctrl allows the architecture code to specify the schema format for a
control. Controls can either take a bitmap, or some kind of number.
If user-space doesn't know what a control is by its name, it could be
told the schema format. 'Some kind of number' isn't useful as the
difference between a percentage and a value in MB/s affects how these
would be programmed, even if resctrl's parsing code doesn't need to
care.
Add the types resctrl already has in addition to 'range'. This
allows architectures to move over before 'range' is removed. These
new schema formats are parsed the same, but will additionally affect
which files are visible.
Schema formats with a double underscore should not be considered
portable between architectures, and are likely to be described to
user-space as 'platform defined'. AMDs MBA resource is configured
with an absolute bandwidth measured in multiples of one eighth of
a GB per second. resctrl needs to be aware of this platform
defined format to ensure the existing 'MB' files continue to be
shown.

Signed-off-by: James Morse <james.morse@arm.com>
(cherry picked from commit 50eed7f84b62a3a4f539c579035ab72ec150cf19 https://git.kernel.org/pub/scm/linux/kernel/git/morse/linux.git)
Signed-off-by: Fenghua Yu <fenghuay@nvidia.com>
Acked-by: Jamie Nguyen <jamien@nvidia.com>
Acked-by: Matthew R. Ochs <mochs@nvidia.com>
Acked-by: Noah Wager <noah.wager@canonical.com>
BugLink: https://bugs.launchpad.net/bugs/2122432

Resctrl specifies the schema format for MB and SMBA in rdt_resources_all[].
Intel platforms take a percentage for MB, AMD platforms take an absolute
value which isn't MB/s. Currently these are both treated as a 'range'.
Adding support for additional types of control shows that user-space
needs to be told what the control formats are. Today users of resctrl
must already know if their platform is Intel or AMD to know how the
MB resource will behave.
The MPAM support exposes new control types that take a 'percentage'.
The Intel MB resource is also configured by a percentage, so should be
able to expose this to user-space.
Remove the static configuration for schema_fmt in rdt_resources_all[]
and specify it with the other control properties in
__get_mem_config_intel() or __get_mem_config_amd().

Signed-off-by: James Morse <james.morse@arm.com>
(cherry picked from commit 20f0c13f4ffd01cb6fc239248afa05d602f9e8d4 https://git.kernel.org/pub/scm/linux/kernel/git/morse/linux.git)
Signed-off-by: Fenghua Yu <fenghuay@nvidia.com>
Acked-by: Jamie Nguyen <jamien@nvidia.com>
Acked-by: Matthew R. Ochs <mochs@nvidia.com>
Acked-by: Noah Wager <noah.wager@canonical.com>
BugLink: https://bugs.launchpad.net/bugs/2122432

MPAMs bandwidth controls are both exposed to resctrl as if they take a
percentage. Update the schema format so that user-space can be told this
is a perentage, and files that describe this control format are exposed.
(e.g. min_percent)
Existing variation in this area is covered by requiring user-space to
know if it is running on an Intel or AMD platform. Exposing the schema
format directly will avoid modifying user-space to know it is running
on an MPAM or RISCV platform.
MPAM can also expose bitmap controls for memory bandwidth, which may
become important for use-cases in the future. These are currently converted
to a percentage to fit the existing definition of the MB resource.

Signed-off-by: James Morse <james.morse@arm.com>
(cherry picked from commit ea03ef359eb04c8c0f557f589578bb4777b8e2b5 https://git.kernel.org/pub/scm/linux/kernel/git/morse/linux.git)
Signed-off-by: Fenghua Yu <fenghuay@nvidia.com>
Acked-by: Jamie Nguyen <jamien@nvidia.com>
Acked-by: Matthew R. Ochs <mochs@nvidia.com>
Acked-by: Noah Wager <noah.wager@canonical.com>
BugLink: https://bugs.launchpad.net/bugs/2122432

Resctrl previously had a 'range' schema format that took some kind of
number. This has since been split into percentage, MB/s and an AMD
platform specific scheme.
As range is no longer used, remove it.
The last user is mba_sc which should be described as taking MB/s.

Signed-off-by: James Morse <james.morse@arm.com>
(cherry picked from commit 93fda1d6632174fefddfe5e712110dd1e2947c95 https://git.kernel.org/pub/scm/linux/kernel/git/morse/linux.git)
Signed-off-by: Fenghua Yu <fenghuay@nvidia.com>
Acked-by: Jamie Nguyen <jamien@nvidia.com>
Acked-by: Matthew R. Ochs <mochs@nvidia.com>
Acked-by: Noah Wager <noah.wager@canonical.com>
…tmap controls

BugLink: https://bugs.launchpad.net/bugs/2122432

MPAM has cache capacity controls that effectively take a percentage.
Resctrl supports percentages, but the collection of files that are
exposed to describe this control belong to the MB resource.
To find the minimum granularity of the percentage cache capacity controls,
user-space is expected to rad the banwdidth_gran file, and know this has
nothing to do with bandwidth.
The only problem here is the name of the file. Add duplicates of these
properties with percentage and bitmap in the name. These will be exposed
based on the schema format.
The existing files must remain tied to the specific resources so that
they remain visible to user-space. Using the same helpers ensures the
values will always be the same regardless of the file used.
These files are not exposed until the new RFTYPE schema flags are
set on a resource 'fflags'.

Signed-off-by: James Morse <james.morse@arm.com>
(cherry picked from commit 673bcb00d2371a2876e164da55d642fdf7657b8d https://git.kernel.org/pub/scm/linux/kernel/git/morse/linux.git)
Signed-off-by: Fenghua Yu <fenghuay@nvidia.com>
Acked-by: Jamie Nguyen <jamien@nvidia.com>
Acked-by: Matthew R. Ochs <mochs@nvidia.com>
Acked-by: Noah Wager <noah.wager@canonical.com>
…n schema format

BugLink: https://bugs.launchpad.net/bugs/2122432

MPAM has cache capacity controls that effectively take a percentage.
Resctrl supports percentages, but the collection of files that are
exposed to describe this control belong to the MB resource. New files
have been added that are selected based on the schema format.
Apply the flags to enable these files based on the schema format.
Add a new fflags_from_schema() that is used for controls.

Signed-off-by: James Morse <james.morse@arm.com>
(cherry picked from commit a837ccc258380d6aeef86df709cc0484b60a4acf https://git.kernel.org/pub/scm/linux/kernel/git/morse/linux.git)
Signed-off-by: Fenghua Yu <fenghuay@nvidia.com>
Acked-by: Jamie Nguyen <jamien@nvidia.com>
Acked-by: Matthew R. Ochs <mochs@nvidia.com>
Acked-by: Noah Wager <noah.wager@canonical.com>
BugLink: https://bugs.launchpad.net/bugs/2122432

If more schemas are added to resctrl, user-space needs to know how to
configure them. To allow user-space to configure schema it doesn't know
about, it would be helpful to tell user-space the format, e.g. percentage.
Add a file under info that describes the schema format.
Percentages and 'mbps' are implicitly decimal, bitmaps are expected to be
in hex.

Signed-off-by: James Morse <james.morse@arm.com>
(cherry picked from commit b457019d995b2849e683aef0fd89066e64c679a4 https://git.kernel.org/pub/scm/linux/kernel/git/morse/linux.git)
Signed-off-by: Fenghua Yu <fenghuay@nvidia.com>
Acked-by: Jamie Nguyen <jamien@nvidia.com>
Acked-by: Matthew R. Ochs <mochs@nvidia.com>
Acked-by: Noah Wager <noah.wager@canonical.com>
BugLink: https://bugs.launchpad.net/bugs/2122432

MPAM can have both cache portion and cache capacity controls on any cache
that supports MPAM. Cache portion bitmaps can be exposed via resctrl if
they are implemented on L2 or L3.
The cache capacity controls can not be used to isolate portions, which is
in implicit in the L2 or L3 bitmap provided by user-space. These controls
need to be configured with something more like a percentage.
Add the resource enum entries for these two resources. No additional
resctrl code is needed because the architecture code will specify this
resource takes a 'percentage', re-using the support previously used only
for the MB resource.

Signed-off-by: James Morse <james.morse@arm.com>
(cherry picked from commit b601bbf375b016c417db4ec0e8bd6ae58b9057aa https://git.kernel.org/pub/scm/linux/kernel/git/morse/linux.git)
Signed-off-by: Fenghua Yu <fenghuay@nvidia.com>
Acked-by: Jamie Nguyen <jamien@nvidia.com>
Acked-by: Matthew R. Ochs <mochs@nvidia.com>
Acked-by: Noah Wager <noah.wager@canonical.com>
…m cmax

BugLink: https://bugs.launchpad.net/bugs/2122432

MPAM's maximum cache-capacity controls take a fixed point fraction format.
Instead of dumping this on user-space, convert it to a percentage.
User-space using resctrl already knows how to handle percentages.

Signed-off-by: James Morse <james.morse@arm.com>
(cherry picked from commit 183d4c43260089e6b51518e50427d0f04a6af875 https://git.kernel.org/pub/scm/linux/kernel/git/morse/linux.git)
Signed-off-by: Fenghua Yu <fenghuay@nvidia.com>
Acked-by: Jamie Nguyen <jamien@nvidia.com>
Acked-by: Matthew R. Ochs <mochs@nvidia.com>
Acked-by: Noah Wager <noah.wager@canonical.com>
jacobmartin0 and others added 16 commits February 27, 2026 17:33
Signed-off-by: Jacob Martin <jacob.martin@canonical.com>
Start states are read from untrusted data and used as indexes into the
DFA state tables. The aa_dfa_next() function call in unpack_pdb() will
access dfa->tables[YYTD_ID_BASE][start], and if the start state exceeds
the number of states in the DFA, this results in an out-of-bound read.

==================================================================
 BUG: KASAN: slab-out-of-bounds in aa_dfa_next+0x2a1/0x360
 Read of size 4 at addr ffff88811956fb90 by task su/1097
 ...

Reject policies with out-of-bounds start states during unpacking
to prevent the issue.

Fixes: ad5ff3d ("AppArmor: Add ability to load extended policy")
Reported-by: Qualys Security Advisory <qsa@qualys.com>
Tested-by: Salvatore Bonaccorso <carnil@debian.org>
Reviewed-by: Georgia Garcia <georgia.garcia@canonical.com>
Reviewed-by: Cengiz Can <cengiz.can@canonical.com>
Signed-off-by: Massimiliano Pellizzer <massimiliano.pellizzer@canonical.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Cengiz Can <cengiz.can@canonical.com>
Signed-off-by: Mehmet Basaran <mehmet.basaran@canonical.com>
(cherry picked from commit 1b408cd questing:linux)
Signed-off-by: Jacob Martin <jacob.martin@canonical.com>
The function sets `*ns = NULL` on every call, leaking the namespace
string allocated in previous iterations when multiple profiles are
unpacked. This also breaks namespace consistency checking since *ns
is always NULL when the comparison is made.

Remove the incorrect assignment.
The caller (aa_unpack) initializes *ns to NULL once before the loop,
which is sufficient.

Fixes: dd51c84 ("apparmor: provide base for multiple profiles to be replaced at once")
Reported-by: Qualys Security Advisory <qsa@qualys.com>
Tested-by: Salvatore Bonaccorso <carnil@debian.org>
Reviewed-by: Georgia Garcia <georgia.garcia@canonical.com>
Reviewed-by: Cengiz Can <cengiz.can@canonical.com>
Signed-off-by: Massimiliano Pellizzer <massimiliano.pellizzer@canonical.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Cengiz Can <cengiz.can@canonical.com>
Signed-off-by: Mehmet Basaran <mehmet.basaran@canonical.com>
(cherry picked from commit 6b50470 questing:linux)
Signed-off-by: Jacob Martin <jacob.martin@canonical.com>
The profile removal code uses recursion when removing nested profiles,
which can lead to kernel stack exhaustion and system crashes.

Reproducer:
  $ pf='a'; for ((i=0; i<1024; i++)); do
      echo -e "profile $pf { \n }" | apparmor_parser -K -a;
      pf="$pf//x";
  done
  $ echo -n a > /sys/kernel/security/apparmor/.remove

Replace the recursive __aa_profile_list_release() approach with an
iterative approach in __remove_profile(). The function repeatedly
finds and removes leaf profiles until the entire subtree is removed,
maintaining the same removal semantic without recursion.

Fixes: c88d4c7 ("AppArmor: core policy routines")
Reported-by: Qualys Security Advisory <qsa@qualys.com>
Tested-by: Salvatore Bonaccorso <carnil@debian.org>
Reviewed-by: Georgia Garcia <georgia.garcia@canonical.com>
Reviewed-by: Cengiz Can <cengiz.can@canonical.com>
Signed-off-by: Massimiliano Pellizzer <massimiliano.pellizzer@canonical.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Cengiz Can <cengiz.can@canonical.com>
Signed-off-by: Mehmet Basaran <mehmet.basaran@canonical.com>
(cherry picked from commit 8f48dd1 questing:linux)
Signed-off-by: Jacob Martin <jacob.martin@canonical.com>
Currently the number of policy namespaces is not bounded relying on
the user namespace limit. However policy namespaces aren't strictly
tied to user namespaces and it is possible to create them and nest
them arbitrarily deep which can be used to exhaust system resource.

Hard cap policy namespaces to the same depth as user namespaces.

Fixes: c88d4c7 ("AppArmor: core policy routines")
Reported-by: Qualys Security Advisory <qsa@qualys.com>
Reviewed-by: Ryan Lee <ryan.lee@canonical.com>
Reviewed-by: Cengiz Can <cengiz.can@canonical.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Cengiz Can <cengiz.can@canonical.com>
Signed-off-by: Mehmet Basaran <mehmet.basaran@canonical.com>
(cherry picked from commit 943464c questing:linux)
Signed-off-by: Jacob Martin <jacob.martin@canonical.com>
The match_char() macro evaluates its character parameter multiple
times when traversing differential encoding chains. When invoked
with *str++, the string pointer advances on each iteration of the
inner do-while loop, causing the DFA to check different characters
at each iteration and therefore skip input characters.
This results in out-of-bounds reads when the pointer advances past
the input buffer boundary.

[   94.984676] ==================================================================
[   94.985301] BUG: KASAN: slab-out-of-bounds in aa_dfa_match+0x5ae/0x760
[   94.985655] Read of size 1 at addr ffff888100342000 by task file/976

[   94.986319] CPU: 7 UID: 1000 PID: 976 Comm: file Not tainted 6.19.0-rc7-next-20260127 NVIDIA#1 PREEMPT(lazy)
[   94.986322] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   94.986329] Call Trace:
[   94.986341]  <TASK>
[   94.986347]  dump_stack_lvl+0x5e/0x80
[   94.986374]  print_report+0xc8/0x270
[   94.986384]  ? aa_dfa_match+0x5ae/0x760
[   94.986388]  kasan_report+0x118/0x150
[   94.986401]  ? aa_dfa_match+0x5ae/0x760
[   94.986405]  aa_dfa_match+0x5ae/0x760
[   94.986408]  __aa_path_perm+0x131/0x400
[   94.986418]  aa_path_perm+0x219/0x2f0
[   94.986424]  apparmor_file_open+0x345/0x570
[   94.986431]  security_file_open+0x5c/0x140
[   94.986442]  do_dentry_open+0x2f6/0x1120
[   94.986450]  vfs_open+0x38/0x2b0
[   94.986453]  ? may_open+0x1e2/0x2b0
[   94.986466]  path_openat+0x231b/0x2b30
[   94.986469]  ? __x64_sys_openat+0xf8/0x130
[   94.986477]  do_file_open+0x19d/0x360
[   94.986487]  do_sys_openat2+0x98/0x100
[   94.986491]  __x64_sys_openat+0xf8/0x130
[   94.986499]  do_syscall_64+0x8e/0x660
[   94.986515]  ? count_memcg_events+0x15f/0x3c0
[   94.986526]  ? srso_alias_return_thunk+0x5/0xfbef5
[   94.986540]  ? handle_mm_fault+0x1639/0x1ef0
[   94.986551]  ? vma_start_read+0xf0/0x320
[   94.986558]  ? srso_alias_return_thunk+0x5/0xfbef5
[   94.986561]  ? srso_alias_return_thunk+0x5/0xfbef5
[   94.986563]  ? fpregs_assert_state_consistent+0x50/0xe0
[   94.986572]  ? srso_alias_return_thunk+0x5/0xfbef5
[   94.986574]  ? arch_exit_to_user_mode_prepare+0x9/0xb0
[   94.986587]  ? srso_alias_return_thunk+0x5/0xfbef5
[   94.986588]  ? irqentry_exit+0x3c/0x590
[   94.986595]  entry_SYSCALL_64_after_hwframe+0x76/0x7e
[   94.986597] RIP: 0033:0x7fda4a79c3ea

Fix by extracting the character value before invoking match_char,
ensuring single evaluation per outer loop.

Fixes: 074c1cd ("apparmor: dfa move character match into a macro")
Reported-by: Qualys Security Advisory <qsa@qualys.com>
Tested-by: Salvatore Bonaccorso <carnil@debian.org>
Reviewed-by: Georgia Garcia <georgia.garcia@canonical.com>
Reviewed-by: Cengiz Can <cengiz.can@canonical.com>
Signed-off-by: Massimiliano Pellizzer <massimiliano.pellizzer@canonical.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Cengiz Can <cengiz.can@canonical.com>
Signed-off-by: Mehmet Basaran <mehmet.basaran@canonical.com>
(cherry picked from commit 2b61194 questing:linux)
Signed-off-by: Jacob Martin <jacob.martin@canonical.com>
The verify_dfa() function only checks DEFAULT_TABLE bounds when the state
is not differentially encoded.

When the verification loop traverses the differential encoding chain,
it reads k = DEFAULT_TABLE[j] and uses k as an array index without
validation. A malformed DFA with DEFAULT_TABLE[j] >= state_count,
therefore, causes both out-of-bounds reads and writes.

[   57.179855] ==================================================================
[   57.180549] BUG: KASAN: slab-out-of-bounds in verify_dfa+0x59a/0x660
[   57.180904] Read of size 4 at addr ffff888100eadec4 by task su/993

[   57.181554] CPU: 1 UID: 0 PID: 993 Comm: su Not tainted 6.19.0-rc7-next-20260127 NVIDIA#1 PREEMPT(lazy)
[   57.181558] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   57.181563] Call Trace:
[   57.181572]  <TASK>
[   57.181577]  dump_stack_lvl+0x5e/0x80
[   57.181596]  print_report+0xc8/0x270
[   57.181605]  ? verify_dfa+0x59a/0x660
[   57.181608]  kasan_report+0x118/0x150
[   57.181620]  ? verify_dfa+0x59a/0x660
[   57.181623]  verify_dfa+0x59a/0x660
[   57.181627]  aa_dfa_unpack+0x1610/0x1740
[   57.181629]  ? __kmalloc_cache_noprof+0x1d0/0x470
[   57.181640]  unpack_pdb+0x86d/0x46b0
[   57.181647]  ? srso_alias_return_thunk+0x5/0xfbef5
[   57.181653]  ? srso_alias_return_thunk+0x5/0xfbef5
[   57.181656]  ? aa_unpack_nameX+0x1a8/0x300
[   57.181659]  aa_unpack+0x20b0/0x4c30
[   57.181662]  ? srso_alias_return_thunk+0x5/0xfbef5
[   57.181664]  ? stack_depot_save_flags+0x33/0x700
[   57.181681]  ? kasan_save_track+0x4f/0x80
[   57.181683]  ? kasan_save_track+0x3e/0x80
[   57.181686]  ? __kasan_kmalloc+0x93/0xb0
[   57.181688]  ? __kvmalloc_node_noprof+0x44a/0x780
[   57.181693]  ? aa_simple_write_to_buffer+0x54/0x130
[   57.181697]  ? policy_update+0x154/0x330
[   57.181704]  aa_replace_profiles+0x15a/0x1dd0
[   57.181707]  ? srso_alias_return_thunk+0x5/0xfbef5
[   57.181710]  ? __kvmalloc_node_noprof+0x44a/0x780
[   57.181712]  ? aa_loaddata_alloc+0x77/0x140
[   57.181715]  ? srso_alias_return_thunk+0x5/0xfbef5
[   57.181717]  ? _copy_from_user+0x2a/0x70
[   57.181730]  policy_update+0x17a/0x330
[   57.181733]  profile_replace+0x153/0x1a0
[   57.181735]  ? rw_verify_area+0x93/0x2d0
[   57.181740]  vfs_write+0x235/0xab0
[   57.181745]  ksys_write+0xb0/0x170
[   57.181748]  do_syscall_64+0x8e/0x660
[   57.181762]  entry_SYSCALL_64_after_hwframe+0x76/0x7e
[   57.181765] RIP: 0033:0x7f6192792eb2

Remove the MATCH_FLAG_DIFF_ENCODE condition to validate all DEFAULT_TABLE
entries unconditionally.

Fixes: 031dcc8 ("apparmor: dfa add support for state differential encoding")
Reported-by: Qualys Security Advisory <qsa@qualys.com>
Tested-by: Salvatore Bonaccorso <carnil@debian.org>
Reviewed-by: Georgia Garcia <georgia.garcia@canonical.com>
Reviewed-by: Cengiz Can <cengiz.can@canonical.com>
Signed-off-by: Massimiliano Pellizzer <massimiliano.pellizzer@canonical.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Cengiz Can <cengiz.can@canonical.com>
Signed-off-by: Mehmet Basaran <mehmet.basaran@canonical.com>
(cherry picked from commit f59e976 questing:linux)
Signed-off-by: Jacob Martin <jacob.martin@canonical.com>
if ns_name is NULL after
1071         error = aa_unpack(udata, &lh, &ns_name);

and if ent->ns_name contains an ns_name in
1089                 } else if (ent->ns_name) {

then ns_name is assigned the ent->ns_name
1095                         ns_name = ent->ns_name;

however ent->ns_name is freed at
1262                 aa_load_ent_free(ent);

and then again when freeing ns_name at
1270         kfree(ns_name);

Fix this by NULLing out ent->ns_name after it is transferred to ns_name

Fixes: 04dc715 ("apparmor: audit policy ns specified in policy load")
Reported-by: Qualys Security Advisory <qsa@qualys.com>
Tested-by: Salvatore Bonaccorso <carnil@debian.org>
Reviewed-by: Georgia Garcia <georgia.garcia@canonical.com>
Reviewed-by: Cengiz Can <cengiz.can@canonical.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Cengiz Can <cengiz.can@canonical.com>
Signed-off-by: Mehmet Basaran <mehmet.basaran@canonical.com>
(cherry picked from commit 3a7dc9b questing:linux)
Signed-off-by: Jacob Martin <jacob.martin@canonical.com>
…ment

An unprivileged local user can load, replace, and remove profiles by
opening the apparmorfs interfaces, via a confused deputy attack, by
passing the opened fd to a privileged process, and getting the
privileged process to write to the interface.

This does require a privileged target that can be manipulated to do
the write for the unprivileged process, but once such access is
achieved full policy management is possible and all the possible
implications that implies: removing confinement, DoS of system or
target applications by denying all execution, by-passing the
unprivileged user namespace restriction, to exploiting kernel bugs for
a local privilege escalation.

The policy management interface can not have its permissions simply
changed from 0666 to 0600 because non-root processes need to be able
to load policy to different policy namespaces.

Instead ensure the task writing the interface has privileges that
are a subset of the task that opened the interface. This is already
done via policy for confined processes, but unconfined can delegate
access to the opened fd, by-passing the usual policy check.

Fixes: c88d4c7 ("AppArmor: core policy routines")
Reported-by: Qualys Security Advisory <qsa@qualys.com>
Tested-by: Salvatore Bonaccorso <carnil@debian.org>
Reviewed-by: Georgia Garcia <georgia.garcia@canonical.com>
Reviewed-by: Cengiz Can <cengiz.can@canonical.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Cengiz Can <cengiz.can@canonical.com>
Signed-off-by: Mehmet Basaran <mehmet.basaran@canonical.com>
(cherry picked from commit 9c6712e questing:linux)
Signed-off-by: Jacob Martin <jacob.martin@canonical.com>
Differential encoding allows loops to be created if it is abused. To
prevent this the unpack should verify that a diff-encode chain
terminates.

Unfortunately the differential encode verification had two bugs.

1. it conflated states that had gone through check and already been
   marked, with states that were currently being checked and marked.
   This means that loops in the current chain being verified are treated
   as a chain that has already been verified.

2. the order bailout on already checked states compared current chain
   check iterators j,k instead of using the outer loop iterator i.
   Meaning a step backwards in states in the current chain verification
   was being mistaken for moving to an already verified state.

Move to a double mark scheme where already verified states get a
different mark, than the current chain being kept. This enables us
to also drop the backwards verification check that was the cause of
the second error as any already verified state is already marked.

Fixes: 031dcc8 ("apparmor: dfa add support for state differential encoding")
Reported-by: Qualys Security Advisory <qsa@qualys.com>
Tested-by: Salvatore Bonaccorso <carnil@debian.org>
Reviewed-by: Georgia Garcia <georgia.garcia@canonical.com>
Reviewed-by: Cengiz Can <cengiz.can@canonical.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Cengiz Can <cengiz.can@canonical.com>
Signed-off-by: Mehmet Basaran <mehmet.basaran@canonical.com>
(cherry picked from commit 36b4187 questing:linux)
Signed-off-by: Jacob Martin <jacob.martin@canonical.com>
There is a race condition that leads to a use-after-free situation:
because the rawdata inodes are not refcounted, an attacker can start
open()ing one of the rawdata files, and at the same time remove the
last reference to this rawdata (by removing the corresponding profile,
for example), which frees its struct aa_loaddata; as a result, when
seq_rawdata_open() is reached, i_private is a dangling pointer and
freed memory is accessed.

The rawdata inodes weren't refcounted to avoid a circular refcount and
were supposed to be held by the profile rawdata reference.  However
during profile removal there is a window where the vfs and profile
destruction race, resulting in the use after free.

Fix this by moving to a double refcount scheme. Where the profile
refcount on rawdata is used to break the circular dependency. Allowing
for freeing of the rawdata once all inode references to the rawdata
are put.

Fixes: 5d5182c ("apparmor: move to per loaddata files, instead of replicating in profiles")
Reported-by: Qualys Security Advisory <qsa@qualys.com>
Reviewed-by: Georgia Garcia <georgia.garcia@canonical.com>
Reviewed-by: Maxime Bélair <maxime.belair@canonical.com>
Reviewed-by: Cengiz Can <cengiz.can@canonical.com>
Tested-by: Salvatore Bonaccorso <carnil@debian.org>
Signed-off-by: John Johansen <john.johansen@canonical.com>
[cengizcan: adjusted context in policy.c aa_free_profile because
 aa_audit_cache_destroy exists after aa_label_destroy, shifting the
 hunk context]
Signed-off-by: Cengiz Can <cengiz.can@canonical.com>
Signed-off-by: Mehmet Basaran <mehmet.basaran@canonical.com>
(cherry picked from commit 1d18980 questing:linux)
Signed-off-by: Jacob Martin <jacob.martin@canonical.com>
AppArmor was putting the reference to i_private data on its end after
removing the original entry from the file system. However the inode
can aand does live beyond that point and it is possible that some of
the fs call back functions will be invoked after the reference has
been put, which results in a race between freeing the data and
accessing it through the fs.

While the rawdata/loaddata is the most likely candidate to fail the
race, as it has the fewest references. If properly crafted it might be
possible to trigger a race for the other types stored in i_private.

Fix this by moving the put of i_private referenced data to the correct
place which is during inode eviction.

Fixes: c961ee5 ("apparmor: convert from securityfs to apparmorfs for policy ns files")
Reported-by: Qualys Security Advisory <qsa@qualys.com>
Reviewed-by: Georgia Garcia <georgia.garcia@canonical.com>
Reviewed-by: Maxime Bélair <maxime.belair@canonical.com>
Reviewed-by: Cengiz Can <cengiz.can@canonical.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
[cengizcan: adjusted context in label.c aa_alloc_proxy because
 kzalloc_obj is not available, used kzalloc(sizeof(...)) instead]
Signed-off-by: Cengiz Can <cengiz.can@canonical.com>
Signed-off-by: Mehmet Basaran <mehmet.basaran@canonical.com>
(cherry picked from commit 7467180 questing:linux)
Signed-off-by: Jacob Martin <jacob.martin@canonical.com>
Ignore: yes
Signed-off-by: Jacob Martin <jacob.martin@canonical.com>
BugLink: https://bugs.launchpad.net/bugs/2144672
Properties: no-test-build
Signed-off-by: Jacob Martin <jacob.martin@canonical.com>
Ignore: yes
Signed-off-by: Jacob Martin <jacob.martin@canonical.com>
Signed-off-by: Jacob Martin <jacob.martin@canonical.com>
@abhsahu abhsahu changed the title Mtk 8250 uart 24 mar 2026 mediatek 8250 UART change Mar 24, 2026
@abhsahu abhsahu changed the title mediatek 8250 UART change [linux-nvidia-6.17] NVIDIA: SAUCE: mediatek 8250 UART change Mar 24, 2026
@nirmoy
Copy link
Copy Markdown
Collaborator

nirmoy commented Mar 24, 2026

@abhsahu Do we need this NVDA0240 change ? I would wait till the mailing list patch is merged if the NVDA0240 change is not needed.

@nvmochs
Copy link
Copy Markdown
Collaborator

nvmochs commented Mar 24, 2026

@abhsahu

I have no issues with the backport but do have a couple of comments...

  • Would it make sense to wait until this is accepted upstream? As it is now we are replacing a SAUCE patch with a SAUCE patch and there is little functional difference? Do we need "NVDA0240" at this time?
  • In the revert patch, please include a brief comment explaining why this is being reverted (i.e. it is being replaced by the upstream candidate).
  • Instead of "This patch is applied from https://patchwork.kernel.org/project/linux-mediatek/patch/20260105024103.2027085-2-zhiyong.tao@mediatek.com/", please add a "backported from" tag after the original patch signoffs but before your signoff.

e.g.

NVIDIA: SAUCE: MEDIATEK: serial: 8250_mtk: Add ACPI support

Add ACPI support to 8250_mtk driver. This makes it possible to
use UART on ARM-based desktops with EDK2 UEFI firmware.
    
Signed-off-by: Yenchia Chen <yenchia.chen@mediatek.com>
Signed-off-by: Zhiyong.Tao <zhiyong.tao@mediatek.com>
(backported from https://lore.kernel.org/all/20260105024103.2027085-2-zhiyong.tao@mediatek.com/)
Signed-off-by: Abhishek Sahu <abhsahu@nvidia.com>

@abhsahu
Copy link
Copy Markdown
Author

abhsahu commented Mar 25, 2026

Thanks @nirmoy and @nvmochs for your feedback.
I am following up with Mediatek internally to see if we can get this change accepted.

We don't have NVDA0240 for the existing DGX Spark BSP, but this may be needed in the future if we plan to change the BSP codebase branch.
We are using NVDA0240 in the latest internal code for the main branch. This is needed to boot the same BaseOS image with those BSPs.

@nirmoy
Copy link
Copy Markdown
Collaborator

nirmoy commented Mar 25, 2026

@abhsahu I see if we need NVDA0240 ref in the future then let's work on getting this merge. Please update the PR with Matt's comment and also don't forget to add your signoff for the revert patch.

abhsahu and others added 2 commits March 30, 2026 11:08
This reverts commit 072848c.

The latest patch from mailing list
(https://lore.kernel.org/all/20260105024103.2027085-2-zhiyong.tao@mediatek.com/)
will be applied in the subsequent commit

Signed-off-by: Abhishek Sahu <abhsahu@nvidia.com>
Add ACPI support to 8250_mtk driver. This makes it possible to
use UART on ARM-based desktops with EDK2 UEFI firmware.

Signed-off-by: Yenchia Chen <yenchia.chen@mediatek.com>
Signed-off-by: Zhiyong.Tao <zhiyong.tao@mediatek.com>
(backported from https://lore.kernel.org/all/20260105024103.2027085-2-zhiyong.tao@mediatek.com/)
Signed-off-by: Abhishek Sahu <abhsahu@nvidia.com>
@abhsahu abhsahu force-pushed the mtk_8250_uart_24_Mar_2026 branch from 0140ba8 to 9994a0a Compare March 30, 2026 11:09
@abhsahu
Copy link
Copy Markdown
Author

abhsahu commented Mar 30, 2026

Thanks, @nirmoy. I have updated with @nvmochs comments.

@nvmochs nvmochs self-requested a review March 30, 2026 14:17
Copy link
Copy Markdown
Collaborator

@nvmochs nvmochs left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No further issues from me.

Acked-by: Matthew R. Ochs <mochs@nvidia.com>

@jamieNguyenNVIDIA
Copy link
Copy Markdown
Collaborator

LP: https://bugs.launchpad.net/bugs/2096888

Acked-by: Jamie Nguyen <jamien@nvidia.com>

@nvidia-bfigg nvidia-bfigg force-pushed the 24.04_linux-nvidia-6.17-next branch from 9364d8b to 8dab82a Compare April 2, 2026 12:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.