Skip to content

Fix potential vulnerability in cloned code#33

Open
manh-td wants to merge 587 commits intoaltera-fpga:socfpga-6.12.43-ltsfrom
manh-td:ath9k_htc
Open

Fix potential vulnerability in cloned code#33
manh-td wants to merge 587 commits intoaltera-fpga:socfpga-6.12.43-ltsfrom
manh-td:ath9k_htc

Conversation

@manh-td
Copy link

@manh-td manh-td commented Jan 17, 2026

This PR fixes a potential security vulnerability that was cloned from torvalds/linux but did not receive the security patch.

Vulnerability Details:

What this PR does: This PR applies the same security patch that was applied to the original repository to eliminate the potential vulnerability in the cloned code.

References:

Please review and merge this PR to ensure your repository is protected against this vulnerability.


This change is Reviewable

rabara and others added 30 commits July 10, 2025 11:13
… Agilex5

Add interrupt-parent property and VGIC maintenance interrupt to
Agilex5 device tree.

Signed-off-by: Niravkumar L Rabara <niravkumar.l.rabara@intel.com>
…to 0

With the recent change in SDM FW now request on channel 1 results in
error response 0x8000002. So need to use Channel 0 in mailbox command to
ATF to issue temperature read command correctly to SDM.

Signed-off-by: Niravkumar L Rabara <niravkumar.l.rabara@intel.com>
Add DMA channel ids for spi0 and spi1 in Agilex7 device tree.

Signed-off-by: Niravkumar L Rabara <niravkumar.l.rabara@intel.com>
dma-coherent propery is required for DMA with SMMU enabled.

Signed-off-by: Niravkumar L Rabara <niravkumar.l.rabara@intel.com>
Delete flash@0 node from socfpga_agilex_socdk.dts
to get a clean slate for Multi-QSPi board.

Signed-off-by: Mahesh Rao <mahesh.rao@intel.com>
Enabled SMMU and include dma-coherent property for NAND device.
Without SMMU enabled, random data bytes are missing for NAND
device for read operation with CDMA work mode.

Enabled back dma-coherent property for Ethernet since the SMMU is
enabled for nand device tree

Signed-off-by: Niravkumar L Rabara <niravkumar.l.rabara@intel.com>
Added probe defer until able to obtain svc channel from svc driver.
Update error printout to correct service channel name.

Signed-off-by: Adrian Ng Ho Yin <adrian.ho.yin.ng@intel.com>
Enabled the dma-coherent property in the SDMMC node to ensure
hardware coherence between the SMMU and CPU caches. This change
addresses the SMMU translation fault and ADMA errors during DMA
operations in the SDMMC driver.

Signed-off-by: Tanmay Kathpalia <tanmay.kathpalia@intel.com>
…it not set

Stratix10_soc driver refactored to allow buffers for reconfiguration to
be persistent until driver is removed. Hence the conditional checking
for svc_data_mem list is empty no longer applicable for reconfig
commands.

Updated condition to check only if the svc_data_mem list is not empty.

Signed-off-by: Adrian Ng Ho Yin <adrian.ho.yin.ng@intel.com>
Removed duplicates properties and simplified usb31 node for Agilex5.

Removed agilex5 swvp dts as it's no longer required.

Signed-off-by: Niravkumar L Rabara <niravkumar.l.rabara@intel.com>
Signed-off-by: Fong, Yan Kei <yan.kei.fong@altera.com>
Added quirk to configure gfp flags to allocate buffers within 32bit
addressable range.

Signed-off-by: Adrian Ng Ho Yin <adrian.ho.yin.ng@intel.com>
Add dma_32bit_quirk in ITS for agilex5 due to addressing limitation in
hardware.

Signed-off-by: Adrian Ng Ho Yin <adrian.ho.yin.ng@intel.com>
…upts

Enabling RX FIFO Overflow interrupts is counter-productive
and causes an interrupt storm when RX FIFO overflows.
Disabling this interrupt has no side effect and eliminates
interrupt storms when the RX FIFO overflows.

Commit 8a7cb24 ("net: stmmac: Do not enable RX FIFO
overflow interrupts") is disabling RX FIFO overflow
interrupts for dwmac4 ip and removes the corresponding
handling of this interrupt.

Signed-off-by: Rohan G Thomas <rohan.g.thomas@intel.com>
… during driver probe

If SDM address remapper is enabled by default and will interfere with SMMU
operations.
Add SDM address remapper configuration to enable bypass for SDM address
remapper during svc driver probe.

Signed-off-by: Adrian Ng Ho Yin <adrian.ho.yin.ng@intel.com>
lock and unlock in stratix10_svc_allocate_memory and
stratix10_svc_free_memory functions.

This commit adds mutex lock and unlock in the
and stratix10_svc_free_memory functions to ensure
thread safety when allocating and freeing memory.
This prevents potential race conditions and ensures
synchronization.

Signed-off-by: Mahesh Rao <mahesh.rao@intel.com>
ID pool management for asynchronous operations

Implement ID pool management API's which will be
used for Stratix10 Asynchronous communication with
Secure Device Manager.

Signed-off-by: Mahesh Rao <mahesh.rao@intel.com>
for asynchronous communication with Stratix 10 service channel

This commit adds support for asynchronous
with the Stratix 10 service channel. It introduces
new functions and definitions to enable asynchronous
messaging and handling of callbacks. The changes
include the addition of asynchronous client registration,
sending asynchronous messages, polling the status of
asynchronous requests, and completing
transactions.

The new functions added are:
- stratix10_svc_add_async_client: Adds an client
        to the service channel.
- stratix10_svc_remove_async_client: Removes an
        asynchronous client from the service channel.
- stratix10_svc_async_send: Sends an asynchronous
        message to the SDM mailbox in EL3 secure firmware.
- stratix10_svc_async_poll: Polls the status of an
        asynchronous service request.
- stratix10_svc_async_done: Completes an
        asynchronous transaction.

These changes enhance the functionality of the
Stratix 10 service channel by allowing for more
efficient and flexible communication with the firmware.

Signed-off-by: Mahesh Rao <mahesh.rao@intel.com>
…n for Intel Stratix 10 Service Layer.

Add interrupt specification for Intel Stratix10 Service layer
for asynchronous communication.

Signed-off-by: Mahesh Rao <mahesh.rao@intel.com>
for SDM mailbox doorbell interrupt

Add support for SDM mailbox doorbell interrupt
async transactions. On interrupt , a workqueue is
triggered which polls the ATF for pending responses
and retrieves the bitmap of all transaction ids of
the retrieved responses from SDM mailbox. It then
triggers the corresponding registered callbacks.

Signed-off-by: Mahesh Rao <mahesh.rao@intel.com>
SDM mailbox interrupt for agilex5 SoC

Add support for SDM mailbox doorbell interrupt to agilex5 SoC.

Signed-off-by: Mahesh Rao <mahesh.rao@intel.com>
support for HWMON temperature and voltage read commands

Add support for HWMON commands in stratix10
Asynchronous communication

Signed-off-by: Mahesh Rao <mahesh.rao@intel.com>
use asynchronous communication.

Migrate hwmon to use startix10 asynchronous communication
to retrieve temperature and voltage values.

Signed-off-by: Mahesh Rao <mahesh.rao@intel.com>
…g for duration measurement

Change measurement logging to debug log.

Signed-off-by: Mahesh Rao <mahesh.rao@intel.com>
Perform the required configurations if major version is greater than
reference or if it is equal, make sure the minor version is within
the desired range.

Signed-off-by: Girisha Dengi <girisha.dengi@intel.com>
…e under EST

When EST enabled, credit is accumulated only when the gate is open.
Hence, the effective data rate of the idleSlope must be increased to
reflect the duty cycle of the transmission gate associated with the
queue. The new idleSlope is calculated using the equation below:

idleSlope = (operIdleSlope(N) * OperCycle/GateOpenTime)

operIdleSlope = Calculated idle slope before EST enabled
N             = Queue number
OperCycle     = Cycle time for queue N
GateOpenTime  = Total gate open time for queue N

Signed-off-by: Voon Weifeng <weifeng.voon@intel.com>
Signed-off-by: Ong Boon Leong <boon.leong.ong@intel.com>
Co-developed-by: Mohammad Athari Bin Ismail <mohammad.athari.ismail@intel.com>
Signed-off-by: Mohammad Athari Bin Ismail <mohammad.athari.ismail@intel.com>
Signed-off-by: Michael Sit Wei Hong <michael.wei.hong.sit@intel.com>
Signed-off-by: Rohan G Thomas <rohan.g.thomas@intel.com>
…ffload

On txvlan offload supported hardware, add vlan tag length
to skb length before checking Qbv maxSDU length. For 802.1Q
add 4-bytes and for 802.1AD add 8-bytes to the skb length.

Fixes: c5c3e1b ("net: stmmac: Offload queueMaxSDU from tc-taprio").

Signed-off-by: Rohan G Thomas <rohan.g.thomas@intel.com>
Drop those frames causing HLBS error to avoid HLBS interrupt
flooding and netdev watchdog error due to transmit packet
timeout. Also add HLBS frame drops to taprio stats.

Signed-off-by: Rohan G Thomas <rohan.g.thomas@intel.com>
V1
Obtain the correlated clocksource to be validated during cross timestamping.

V2
refactor the function get_clocksource to
get_ptp_clocksource_id and also changes the data
element from clocksource to clocksource_id.

Signed-off-by: Tham, Mun Yew <mun.yew.tham@intel.com>
Synchronized Multidrop Timestamp Gathering is supported on Agilex5.
The hardware multidrop timestamp result is made available to applications
through the PTP_SYS_OFFSET_PRECISE iotcl which calls
stmmac_getcrosststamp() and subsequently calls smtg_crosststamp().

Signed-off-by: Tham, Mun Yew <mun.yew.tham@intel.com>
…erated VLAN Stripping

Currently, VLAN tag stripping is done by driver in stmmac_rx_vlan().
Add support for VLAN tag stripping by the MAC hardware for MAC drivers
that support it. set_hw_vlan_mode() callbacks at stmmac_ops struct
which are called if registered by the MAC driver.

Signed-off-by: Boon Khai Ng <boon.khai.ng@intel.com>
Signed-off-by: Khairul Anuar Romli <khairul.anuar.romli@altera.com>
==
v2: update the way how to enable vlan by default using
    the has_xgmac variable.
v1: Initial HW VLAN Strippping support
rabara and others added 30 commits September 4, 2025 17:23
…njection

When ECC RAM is in use by the device controller, injecting errors by
directly writing/reading ECC RAM can sometimes trigger a false
double-bit error.

Switch Ethernet and USB EDAC devices to use the INTTEST register
(altr_edac_a10_device_inject_fops) for single-bit error injection
instead of flipping bits in ECC RAM directly.

Signed-off-by: Niravkumar L Rabara <niravkumarlaxmidas.rabara@altera.com>
This reverts commit 3e98881.

Signed-off-by: Tanmay Kathpalia <tanmay.kathpalia@altera.com>
…c bootup issue"

This reverts commit 5ef94b6.

Signed-off-by: Tanmay Kathpalia <tanmay.kathpalia@altera.com>
…e for SD divider"

This reverts commit f73c47a.

Signed-off-by: Tanmay Kathpalia <tanmay.kathpalia@altera.com>
…nd quirk for Agilex5"

This reverts commit 0eac3d4.

Signed-off-by: Tanmay Kathpalia <tanmay.kathpalia@altera.com>
…om device tree"

This reverts commit eaa07be.

Signed-off-by: Tanmay Kathpalia <tanmay.kathpalia@altera.com>
…compatible string"

This reverts commit 4f89c5a.

Signed-off-by: Tanmay Kathpalia <tanmay.kathpalia@altera.com>
…tings in sdhci yaml"

This reverts commit 1886e88.

Signed-off-by: Tanmay Kathpalia <tanmay.kathpalia@altera.com>
…rk for V6 controller support

Rename functions and data structures to explicitly indicate they are
specific to SD Host Controller V4 implementation, in preparation for
adding V6 support.

Signed-off-by: Tanmay Kathpalia <tanmay.kathpalia@altera.com>
…6 controller support

Restructure the sdhci-cadence driver to support multiple controller
versions in preparation for adding SD Host Controller V6 support:

Structural changes:
- Introduce enable_clocks() helper for version-specific clock handling
- Add sdhci_cdns4_phy_probe() to consolidate V4 PHY initialization

Signed-off-by: Tanmay Kathpalia <tanmay.kathpalia@altera.com>
…r V6 support

Add device tree binding support for Cadence SD Host Controller V6
alongside existing V4 controller bindings:

- Restructure compatible property to use oneOf schema to support
  both V4 and V6 controller variants
- Add "cdns,sd6hc" as the generic V6 controller compatible string
- Add "altr,agilex5-sd6hc" for Altera Agilex5 SoCFPGA implementation

Signed-off-by: Tanmay Kathpalia <tanmay.kathpalia@altera.com>
Add comprehensive support for Cadence SD Host Controller V6 by splitting
the driver into separate modules for V4 and V6 implementations:

Driver structure changes:
- Split driver into sdhci-cadence.c (common/V4) and
  sdhci-cadence6.c (V6-specific)
- Create shared sdhci-cadence.h header for common definitions and
  function declarations
- Update Makefile to build combined sdhci-cadence-driver module

V6-specific features:
- Add V6 PHY register definitions and timing control structures
- Implement V6 PHY adjustment with configurable timing parameters for
  all MMC/SD modes
- Add device tree property parsing for V6 timing configuration
- Support hardware reset functionality specific to V6 controllers
- Implement V6-specific tuning mechanism with DLL slave control

Enhanced functionality:
- Add version-specific branching in common functions (tuning,
  UHS signaling)
- Include support for both generic V6 controllers and
  Altera Agilex5 variant

Signed-off-by: Tanmay Kathpalia <tanmay.kathpalia@altera.com>
Add COMBOPHY_RESET definition required for Altera Agilex5 SoCFPGA,
re-use altr,rst-mgr-s10.h as common header file similar to S10 & Agilex.

The COMBOPHY reset ID is assigned to the previously unused slot 38 in
the PER0MODRST register block to support combo PHY reset control on
Agilex5 platforms.

Signed-off-by: Tanmay Kathpalia <tanmay.kathpalia@altera.com>
…HC to SD6HC

Update Altera Agilex5 SoCFPGA device tree to use the newer Cadence
SD Host Controller V6 (SD6HC) instead of V4 (SD4HC):

Device tree changes:
- Add fixed voltage regulators for 3.3V card power and 1.8V I/O power
- Update compatible strings from "intel,agilex5-sd4hc" to
  "altr,agilex5-sd6hc"
- Expand reset configuration to include combo PHY, SDMMC OCP, and SDHC
  resets
- Add proper power supply references for vmmc and vqmmc

Signed-off-by: Tanmay Kathpalia <tanmay.kathpalia@altera.com>
…D card support

Update Altera Agilex5 SoCFPGA device tree to configure the MMC controller
specifically for SD card operation:

Regulator configuration:
- Add GPIO-controlled voltage regulator for SD I/O power switching
- Support both 1.8V and 3.3V signaling levels required for UHS modes
- Enable automatic voltage switching based on GPIO state

Signed-off-by: Tanmay Kathpalia <tanmay.kathpalia@altera.com>
Add retry handling for CCC transfers that fail with M0 or M2 errors:
Map RESPONSE_ERROR_FRAME to I3C_ERROR_M0
Add RESPONSE_ERROR_ADDRESS_NACK to I3C_ERROR_M2

Update i3c_master_send_ccc_cmd_locked() to retry the CCC command when
these errors are detected

This improves robustness of CCC operations by allowing recovery from
transient bus frame errors (M0) or address/NACK errors (M2).

Signed-off-by: Adrian Ng Ho Yin <adrianhoyin.ng@altera.com>
…errors"

This reverts commit e0ed1bc.

Signed-off-by: Adrian Ng Ho Yin <adrianhoyin.ng@altera.com>
Add retry handling for CCC transfers that fail with M0 or M2 errors:
Map RESPONSE_ERROR_FRAME to I3C_ERROR_M0
Add RESPONSE_ERROR_ADDRESS_NACK to I3C_ERROR_M2

update dw_i3c_master_send_ccc_cmd to retry ccc cmd when M0 or M2 errors
are detected.

This improves robustness of CCC operations by allowing recovery from
transient bus frame errors (M0) or address/NACK errors (M2).

Signed-off-by: Adrian Ng Ho Yin <adrianhoyin.ng@altera.com>
Update simic regtest and onboard regtest checks to use lapwing runners.

Signed-off-by: Adrian Ng Ho Yin <adrianhoyin.ng@altera.com>
…D max frequency

Update SDHCI caps-mask in Agilex3 and Agilex5 device tree files to mask
out DDR50 and SDR104 modes. These modes are unstable and fail on some
boards, so they are disabled for improved compatibility.

Additional changes:
- Enable UHS SDR50 mode for SD cards
- Increase max-frequency from 100MHz to 200MHz
- Remove no-1-8-v property to allow 1.8V signaling

Signed-off-by: Tanmay Kathpalia <tanmay.kathpalia@altera.com>
…timing for Agilex5

These changes improve SD card performance and compatibility across
Agilex5 boards.
- Enable UHS SDR104 mode for SD cards in the Agilex5 SoCFPGA device tree.
- Adjust sdhci-caps-mask to mask out DDR50 while allowing SDR104
  and SDR50.
- Update SDHCI Cadence V6 driver timing parameters for SDR104 mode to
  improve reliability and compatibility.
- Add DLL reset toggling during tuning value programming for better PHY
  initialization.

Signed-off-by: Tanmay Kathpalia <tanmay.kathpalia@altera.com>
…ask for Agilex3 SoCDK

Enable UHS SDR104 mode for SD cards on the Agilex3 SoCFPGA SoCDK board
by adding the sd-uhs-sdr104 property and increasing the max-frequency
to 200MHz.

Signed-off-by: Tanmay Kathpalia <tanmay.kathpalia@altera.com>
Enhance error handling for Common Command Code (CCC) operations in the
DesignWare I3C master driver:

* Define GET_MRL_MIN_LEN (2) for validating GETMRL responses.
* In dw_i3c_ccc_get(), treat an RX length smaller than the expected
  payload length or smaller than GET_MRL_MIN_LEN for GETMRL as an
  M0 (frame) error and return -EIO.
* In dw_i3c_ccc_set(), similarly map RX length mismatches to I3C_ERROR_M0.

These changes improve robustness by flagging incomplete or malformed
responses during CCC transfers rather than silently accepting truncated
data.

Signed-off-by: Adrian Ng Ho Yin <adrianhoyin.ng@altera.com>
100Mhz is the correct clock-freq for Agilex5 timers.

Signed-off-by: Murugasen Krishnan, Kuhanh <kuhanh.murugasen.krishnan@altera.com>
…optimize timing parameters

Enable high-speed eMMC modes and improve Cadence V6 controller
compatibility for Agilex5 platforms:

Device tree changes:
- Enable mmc-hs200-1_8v and mmc-hs400-1_8v support for eMMC
- Increase max-frequency from 100MHz to 200MHz
- Clear sdhci-caps-mask bit 13 to allow HS200/HS400 capabilities

Driver improvements:
- Add SDHCI_QUIRK_MULTIBLOCK_READ_ACMD12 for multiblock operations
- Add SDHCI_QUIRK2_ACMD23_BROKEN to disable ACMD23
- Skip CMD13 status check after HS200 switch as Cadence IP times out
  instead of returning expected -EBADMSG error

Signed-off-by: Tanmay Kathpalia <tanmay.kathpalia@altera.com>
…Agilex boards

Remove sd-uhs-sdr50 and sd-uhs-sdr104 properties from MMC controller
configuration on Altera SoCFPGA Agilex3 and Agilex5 development boards.
Update the sdhci-caps-mask values accordingly to disable these UHS modes
in hardware.

This change affects the following boards:
- socfpga_agilex3_socdk.dts
- socfpga_agilex5_socdk.dts
- socfpga_agilex5_socdk_013b.dts
- socfpga_agilex5_socdk_a0.dts

Signed-off-by: Tanmay Kathpalia <tanmay.kathpalia@altera.com>
… Agilex5 eMMC

Disable 1.8V signaling and high-speed eMMC modes (HS200/HS400) for the
eMMC controller on Intel SoCFPGA Agilex5 SOCDK.

Changes:
- Add no-1-8-v property to disable 1.8V signaling capability
- Remove mmc-hs200-1_8v property (HS200 mode at 1.8V)
- Remove mmc-hs400-1_8v property (HS400 mode at 1.8V)

This forces the eMMC to operate with 3.3V signaling only and disables
the high-speed modes that require 1.8V operation, ensuring better
hardware compatibility.

Signed-off-by: Tanmay Kathpalia <tanmay.kathpalia@altera.com>
Added a SECURITY.md file to outline how users can responsibly report
security vulnerabilities and to define the project's security policy.

Signed-off-by: drosdi <danish.ahmad.rosdi@altera.com>
Add additional check for on-board and simic regtest staging.
Add simic version query in comments to configure which simic version to
use for the simic regression test.

Signed-off-by: Adrian Ng Ho Yin <adrianhoyin.ng@altera.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.