--- /dev/null
+From stable+bounces-180859-greg=kroah.com@vger.kernel.org Mon Sep 22 02:07:46 2025
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 21 Sep 2025 20:07:39 -0400
+Subject: KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is active
+To: stable@vger.kernel.org
+Cc: "Maciej S. Szmigiero" <maciej.szmigiero@oracle.com>, "Naveen N Rao (AMD)" <naveen@kernel.org>, Sean Christopherson <seanjc@google.com>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20250922000739.3096059-1-sashal@kernel.org>
+
+From: "Maciej S. Szmigiero" <maciej.szmigiero@oracle.com>
+
+[ Upstream commit d02e48830e3fce9701265f6c5a58d9bdaf906a76 ]
+
+Commit 3bbf3565f48c ("svm: Do not intercept CR8 when enable AVIC")
+inhibited pre-VMRUN sync of TPR from LAPIC into VMCB::V_TPR in
+sync_lapic_to_cr8() when AVIC is active.
+
+AVIC does automatically sync between these two fields, however it does
+so only on explicit guest writes to one of these fields, not on a bare
+VMRUN.
+
+This meant that when AVIC is enabled host changes to TPR in the LAPIC
+state might not get automatically copied into the V_TPR field of VMCB.
+
+This is especially true when it is the userspace setting LAPIC state via
+KVM_SET_LAPIC ioctl() since userspace does not have access to the guest
+VMCB.
+
+Practice shows that it is the V_TPR that is actually used by the AVIC to
+decide whether to issue pending interrupts to the CPU (not TPR in TASKPRI),
+so any leftover value in V_TPR will cause serious interrupt delivery issues
+in the guest when AVIC is enabled.
+
+Fix this issue by doing pre-VMRUN TPR sync from LAPIC into VMCB::V_TPR
+even when AVIC is enabled.
+
+Fixes: 3bbf3565f48c ("svm: Do not intercept CR8 when enable AVIC")
+Cc: stable@vger.kernel.org
+Signed-off-by: Maciej S. Szmigiero <maciej.szmigiero@oracle.com>
+Reviewed-by: Naveen N Rao (AMD) <naveen@kernel.org>
+Link: https://lore.kernel.org/r/c231be64280b1461e854e1ce3595d70cde3a2e9d.1756139678.git.maciej.szmigiero@oracle.com
+[sean: tag for stable@]
+Signed-off-by: Sean Christopherson <seanjc@google.com>
+[ Adjust context ]
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/kvm/svm.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/arch/x86/kvm/svm.c
++++ b/arch/x86/kvm/svm.c
+@@ -5580,8 +5580,7 @@ static inline void sync_lapic_to_cr8(str
+ struct vcpu_svm *svm = to_svm(vcpu);
+ u64 cr8;
+
+- if (svm_nested_virtualize_tpr(vcpu) ||
+- kvm_vcpu_apicv_active(vcpu))
++ if (svm_nested_virtualize_tpr(vcpu))
+ return;
+
+ cr8 = kvm_get_cr8(vcpu);
--- /dev/null
+From stable+bounces-180857-greg=kroah.com@vger.kernel.org Mon Sep 22 02:06:48 2025
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 21 Sep 2025 20:06:36 -0400
+Subject: net: rfkill: gpio: add DT support
+To: stable@vger.kernel.org
+Cc: Philipp Zabel <p.zabel@pengutronix.de>, Johannes Berg <johannes.berg@intel.com>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20250922000637.3095532-1-sashal@kernel.org>
+
+From: Philipp Zabel <p.zabel@pengutronix.de>
+
+[ Upstream commit d64c732dfc9edcd57feb693c23162117737e426b ]
+
+Allow probing rfkill-gpio via device tree. This hooks up the already
+existing support that was started in commit 262c91ee5e52 ("net:
+rfkill: gpio: prepare for DT and ACPI support") via the "rfkill-gpio"
+compatible, with the "name" and "type" properties renamed to "label"
+and "radio-type", respectively, in the device tree case.
+
+Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
+Link: https://lore.kernel.org/r/20230102-rfkill-gpio-dt-v2-2-d1b83758c16d@pengutronix.de
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Stable-dep-of: b6f56a44e4c1 ("net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/rfkill/rfkill-gpio.c | 20 ++++++++++++++++++--
+ 1 file changed, 18 insertions(+), 2 deletions(-)
+
+--- a/net/rfkill/rfkill-gpio.c
++++ b/net/rfkill/rfkill-gpio.c
+@@ -79,6 +79,8 @@ static int rfkill_gpio_probe(struct plat
+ {
+ struct rfkill_gpio_data *rfkill;
+ struct gpio_desc *gpio;
++ const char *name_property;
++ const char *type_property;
+ const char *type_name;
+ int ret;
+
+@@ -86,8 +88,15 @@ static int rfkill_gpio_probe(struct plat
+ if (!rfkill)
+ return -ENOMEM;
+
+- device_property_read_string(&pdev->dev, "name", &rfkill->name);
+- device_property_read_string(&pdev->dev, "type", &type_name);
++ if (dev_of_node(&pdev->dev)) {
++ name_property = "label";
++ type_property = "radio-type";
++ } else {
++ name_property = "name";
++ type_property = "type";
++ }
++ device_property_read_string(&pdev->dev, name_property, &rfkill->name);
++ device_property_read_string(&pdev->dev, type_property, &type_name);
+
+ if (!rfkill->name)
+ rfkill->name = dev_name(&pdev->dev);
+@@ -169,12 +178,19 @@ static const struct acpi_device_id rfkil
+ MODULE_DEVICE_TABLE(acpi, rfkill_acpi_match);
+ #endif
+
++static const struct of_device_id rfkill_of_match[] __maybe_unused = {
++ { .compatible = "rfkill-gpio", },
++ { },
++};
++MODULE_DEVICE_TABLE(of, rfkill_of_match);
++
+ static struct platform_driver rfkill_gpio_driver = {
+ .probe = rfkill_gpio_probe,
+ .remove = rfkill_gpio_remove,
+ .driver = {
+ .name = "rfkill_gpio",
+ .acpi_match_table = ACPI_PTR(rfkill_acpi_match),
++ .of_match_table = of_match_ptr(rfkill_of_match),
+ },
+ };
+
--- /dev/null
+From stable+bounces-180858-greg=kroah.com@vger.kernel.org Mon Sep 22 02:06:48 2025
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 21 Sep 2025 20:06:37 -0400
+Subject: net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer
+To: stable@vger.kernel.org
+Cc: Hans de Goede <hansg@kernel.org>, Heikki Krogerus <heikki.krogerus@linux.intel.com>, Johannes Berg <johannes.berg@intel.com>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20250922000637.3095532-2-sashal@kernel.org>
+
+From: Hans de Goede <hansg@kernel.org>
+
+[ Upstream commit b6f56a44e4c1014b08859dcf04ed246500e310e5 ]
+
+Since commit 7d5e9737efda ("net: rfkill: gpio: get the name and type from
+device property") rfkill_find_type() gets called with the possibly
+uninitialized "const char *type_name;" local variable.
+
+On x86 systems when rfkill-gpio binds to a "BCM4752" or "LNV4752"
+acpi_device, the rfkill->type is set based on the ACPI acpi_device_id:
+
+ rfkill->type = (unsigned)id->driver_data;
+
+and there is no "type" property so device_property_read_string() will fail
+and leave type_name uninitialized, leading to a potential crash.
+
+rfkill_find_type() does accept a NULL pointer, fix the potential crash
+by initializing type_name to NULL.
+
+Note likely sofar this has not been caught because:
+
+1. Not many x86 machines actually have a "BCM4752"/"LNV4752" acpi_device
+2. The stack happened to contain NULL where type_name is stored
+
+Fixes: 7d5e9737efda ("net: rfkill: gpio: get the name and type from device property")
+Cc: stable@vger.kernel.org
+Cc: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Signed-off-by: Hans de Goede <hansg@kernel.org>
+Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Link: https://patch.msgid.link/20250913113515.21698-1-hansg@kernel.org
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/rfkill/rfkill-gpio.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/net/rfkill/rfkill-gpio.c
++++ b/net/rfkill/rfkill-gpio.c
+@@ -78,10 +78,10 @@ static int rfkill_gpio_acpi_probe(struct
+ static int rfkill_gpio_probe(struct platform_device *pdev)
+ {
+ struct rfkill_gpio_data *rfkill;
+- struct gpio_desc *gpio;
++ const char *type_name = NULL;
+ const char *name_property;
+ const char *type_property;
+- const char *type_name;
++ struct gpio_desc *gpio;
+ int ret;
+
+ rfkill = devm_kzalloc(&pdev->dev, sizeof(*rfkill), GFP_KERNEL);
usb-gadget-dummy_hcd-remove-usage-of-list-iterator-past-the-loop-body.patch
usb-gadget-dummy-hcd-fix-locking-bug-in-rt-enabled-kernels.patch
serial-sc16is7xx-fix-bug-in-flow-control-levels-init.patch
+net-rfkill-gpio-add-dt-support.patch
+net-rfkill-gpio-fix-crash-due-to-dereferencering-uninitialized-pointer.patch
+kvm-svm-sync-tpr-from-lapic-into-vmcb-v_tpr-even-if-avic-is-active.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
