From 486580ffb5aae2b4e7b277ba2576ecd54d0076f7 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Wed, 24 Aug 2022 16:45:58 +0200 Subject: [PATCH 01/50] Revert "ANDROID: vendor_hooks: Add hooks for mutex" This reverts commit 8c3ac02bcaf8c2167ad5acd18e6a3c23de361763. The hook android_vh_mutex_start_check_new_owner is not used by any vendor, so remove it to help with merge issues with future LTS releases. If this is needed by any real user, it can easily be reverted to add it back and then the symbol should be added to the abi list at the same time to prevent it from being removed again later. Bug: 203756332 Bug: 231647361 Cc: Liujie Xie Signed-off-by: Greg Kroah-Hartman Change-Id: I8c3bf787525d684f64b8d0654d379df78eb7b69e --- drivers/android/vendor_hooks.c | 1 - include/trace/hooks/dtask.h | 4 +--- kernel/locking/mutex.c | 1 - 3 files changed, 1 insertion(+), 5 deletions(-) diff --git a/drivers/android/vendor_hooks.c b/drivers/android/vendor_hooks.c index 1a22772d64f1..5b48337b53a1 100644 --- a/drivers/android/vendor_hooks.c +++ b/drivers/android/vendor_hooks.c @@ -249,7 +249,6 @@ EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_build_sched_domains); EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_alter_mutex_list_add); EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_mutex_unlock_slowpath); EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_mutex_unlock_slowpath_end); -EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_mutex_start_check_new_owner); EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_rwsem_wake_finish); EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_do_undefinstr); EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_do_ptrauth_fault); diff --git a/include/trace/hooks/dtask.h b/include/trace/hooks/dtask.h index fcf0ea550455..208edf8ac265 100644 --- a/include/trace/hooks/dtask.h +++ b/include/trace/hooks/dtask.h @@ -68,9 +68,6 @@ DECLARE_HOOK(android_vh_mutex_unlock_slowpath, DECLARE_HOOK(android_vh_mutex_unlock_slowpath_end, TP_PROTO(struct mutex *lock, struct task_struct *next), TP_ARGS(lock, next)); -DECLARE_HOOK(android_vh_mutex_start_check_new_owner, - TP_PROTO(struct mutex *lock), - TP_ARGS(lock)); DECLARE_HOOK(android_vh_record_mutex_lock_starttime, TP_PROTO(struct task_struct *tsk, unsigned long settime_jiffies), TP_ARGS(tsk, settime_jiffies)); @@ -83,6 +80,7 @@ DECLARE_HOOK(android_vh_record_rwsem_lock_starttime, DECLARE_HOOK(android_vh_record_percpu_rwsem_lock_starttime, TP_PROTO(struct task_struct *tsk, unsigned long settime_jiffies), TP_ARGS(tsk, settime_jiffies)); + /* macro versions of hooks are no longer required */ #endif /* _TRACE_HOOK_DTASK_H */ diff --git a/kernel/locking/mutex.c b/kernel/locking/mutex.c index 4fa524e21420..93020a888b09 100644 --- a/kernel/locking/mutex.c +++ b/kernel/locking/mutex.c @@ -1053,7 +1053,6 @@ __mutex_lock_common(struct mutex *lock, long state, unsigned int subclass, goto err; } - trace_android_vh_mutex_start_check_new_owner(lock); spin_unlock(&lock->wait_lock); schedule_preempt_disabled(); From 98e5fb34d1137987cb2551d79082dc4c794795d4 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Wed, 24 Aug 2022 17:06:03 +0200 Subject: [PATCH 02/50] Revert "ANDROID: add for tuning readahead size" This reverts commit f06daa5a0bc6c8b524b53671fce40e0a14c4f9af. The hook android_vh_ra_tuning_max_page is not used by any vendor, so remove it to help with merge issues with future LTS releases. If this is needed by any real user, it can easily be reverted to add it back and then the symbol should be added to the abi list at the same time to prevent it from being removed again later. Bug: 203756332 Bug: 229839032 Cc: liang zhang Signed-off-by: Greg Kroah-Hartman Change-Id: Id9211dfd9e1fa19d2ccb14302c60f0d55579f59d --- drivers/android/vendor_hooks.c | 1 - include/trace/hooks/mm.h | 3 --- mm/readahead.c | 2 -- 3 files changed, 6 deletions(-) diff --git a/drivers/android/vendor_hooks.c b/drivers/android/vendor_hooks.c index 5b48337b53a1..a678c2fe440a 100644 --- a/drivers/android/vendor_hooks.c +++ b/drivers/android/vendor_hooks.c @@ -428,7 +428,6 @@ EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_binder_has_work_ilocked); EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_binder_read_done); EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_handle_tlb_conf); EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_shrink_node_memcgs); -EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_ra_tuning_max_page); EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_tune_memcg_scan_type); EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_handle_pte_fault_end); EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_cow_user_page); diff --git a/include/trace/hooks/mm.h b/include/trace/hooks/mm.h index 8b0225ce7ced..8a95d32a0706 100644 --- a/include/trace/hooks/mm.h +++ b/include/trace/hooks/mm.h @@ -189,9 +189,6 @@ DECLARE_HOOK(android_vh_pcplist_add_cma_pages_bypass, DECLARE_HOOK(android_vh_subpage_dma_contig_alloc, TP_PROTO(bool *allow_subpage_alloc, struct device *dev, size_t *size), TP_ARGS(allow_subpage_alloc, dev, size)); -DECLARE_HOOK(android_vh_ra_tuning_max_page, - TP_PROTO(struct readahead_control *ractl, unsigned long *max_page), - TP_ARGS(ractl, max_page)); DECLARE_HOOK(android_vh_handle_pte_fault_end, TP_PROTO(struct vm_fault *vmf, unsigned long highest_memmap_pfn), TP_ARGS(vmf, highest_memmap_pfn)); diff --git a/mm/readahead.c b/mm/readahead.c index a95364c99487..a6bfa987a04a 100644 --- a/mm/readahead.c +++ b/mm/readahead.c @@ -459,8 +459,6 @@ static void ondemand_readahead(struct readahead_control *ractl, if (req_size > max_pages && bdi->io_pages > max_pages) max_pages = min(req_size, bdi->io_pages); - trace_android_vh_ra_tuning_max_page(ractl, &max_pages); - /* * start of file */ From 84a0d243b608b3373ef701c20a64353269d69e46 Mon Sep 17 00:00:00 2001 From: Patrick Daly Date: Mon, 22 Aug 2022 18:00:51 -0700 Subject: [PATCH 03/50] ANDROID: mm/memory_hotplug: Fix error path handling Correct a resource leak if arch_add_memory() returns failure. Bug: 243477359 Change-Id: I1dce82a18c2242d7b6fd9fb1fe3a8b2ba67853de Fixes: 417ac617ea5e ("ANDROID: mm/memory_hotplug: implement {add/remove}_memory_subsection") Signed-off-by: Patrick Daly Signed-off-by: Chris Goldsworthy --- mm/memory_hotplug.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c index 6702c1114ced..9176bae95c9a 100644 --- a/mm/memory_hotplug.c +++ b/mm/memory_hotplug.c @@ -1156,14 +1156,22 @@ int add_memory_subsection(int nid, u64 start, u64 size) ret = arch_add_memory(nid, start, size, ¶ms); if (ret) { - if (IS_ENABLED(CONFIG_ARCH_KEEP_MEMBLOCK)) - memblock_remove(start, size); pr_err("%s failed to add subsection start 0x%llx size 0x%llx\n", __func__, start, size); + goto err_add_memory; } mem_hotplug_done(); return ret; + +err_add_memory: + if (IS_ENABLED(CONFIG_ARCH_KEEP_MEMBLOCK)) + memblock_remove(start, size); + + mem_hotplug_done(); + + release_memory_resource(res); + return ret; } EXPORT_SYMBOL_GPL(add_memory_subsection); From 425c0f18edf16231aa87cfdebbd9f03e0628533c Mon Sep 17 00:00:00 2001 From: Suren Baghdasaryan Date: Wed, 24 Aug 2022 08:51:27 -0700 Subject: [PATCH 04/50] ANDROID: Fix a build warning inside early_memblock_nomap Fix a warning caused by ignoring the return value of kstrtobool: mm/memblock.c: In function 'early_memblock_nomap': >> mm/memblock.c:1910:9: warning: ignoring return value of 'kstrtobool' declared with attribute 'warn_unused_result' [-Wunused-result] 1910 | kstrtobool(str, &memblock_nomap_remove); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Fixes: 3c2f107ad286 ("ANDROID: mm: memblock: avoid to create memmap for memblock nomap regions") Bug: 227974747 Reported-by: kernel test robot Signed-off-by: Suren Baghdasaryan Change-Id: I9cc1145492e47a6604b8204165058d8617c0aaaa --- mm/memblock.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/mm/memblock.c b/mm/memblock.c index 3b559ce0869b..961c596b0afd 100644 --- a/mm/memblock.c +++ b/mm/memblock.c @@ -1907,8 +1907,7 @@ early_param("memblock", early_memblock); static int __init early_memblock_nomap(char *str) { - kstrtobool(str, &memblock_nomap_remove); - return 0; + return kstrtobool(str, &memblock_nomap_remove); } early_param("android12_only.will_be_removed_soon.memblock_nomap_remove", early_memblock_nomap); From 7b0822a26142ade7be8629cfbe41f5ad206ffb64 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Wed, 24 Aug 2022 18:50:06 +0200 Subject: [PATCH 05/50] Revert "ANDROID: vendor_hooks: tune reclaim scan type for specified mem_cgroup" This reverts commit e5b4949bfc066d34876ce94725fe1355ce62d4c1. The hook android_vh_tune_memcg_scan_type is not used by any vendor, so remove it to help with merge issues with future LTS releases. If this is needed by any real user, it can easily be reverted to add it back and then the symbol should be added to the abi list at the same time to prevent it from being removed again later. Bug: 203756332 Bug: 230450931 Cc: xiaofeng Signed-off-by: Greg Kroah-Hartman Change-Id: I0e32c24d67a9ede087eca5005796512a9451c1e2 --- drivers/android/vendor_hooks.c | 1 - include/trace/hooks/vmscan.h | 3 --- mm/vmscan.c | 1 - 3 files changed, 5 deletions(-) diff --git a/drivers/android/vendor_hooks.c b/drivers/android/vendor_hooks.c index a678c2fe440a..c05568506b7b 100644 --- a/drivers/android/vendor_hooks.c +++ b/drivers/android/vendor_hooks.c @@ -428,7 +428,6 @@ EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_binder_has_work_ilocked); EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_binder_read_done); EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_handle_tlb_conf); EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_shrink_node_memcgs); -EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_tune_memcg_scan_type); EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_handle_pte_fault_end); EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_cow_user_page); EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_swapin_add_anon_rmap); diff --git a/include/trace/hooks/vmscan.h b/include/trace/hooks/vmscan.h index a175232c89f6..ab54c20fef62 100644 --- a/include/trace/hooks/vmscan.h +++ b/include/trace/hooks/vmscan.h @@ -43,9 +43,6 @@ DECLARE_HOOK(android_vh_page_trylock_clear, DECLARE_HOOK(android_vh_shrink_node_memcgs, TP_PROTO(struct mem_cgroup *memcg, bool *skip), TP_ARGS(memcg, skip)); -DECLARE_HOOK(android_vh_tune_memcg_scan_type, - TP_PROTO(struct mem_cgroup *memcg, char *scan_type), - TP_ARGS(memcg, scan_type)); DECLARE_HOOK(android_vh_inactive_is_low, TP_PROTO(unsigned long gb, unsigned long *inactive_ratio, enum lru_list inactive_lru, bool *skip), diff --git a/mm/vmscan.c b/mm/vmscan.c index e3a885f6a1b5..2979893b9cf5 100644 --- a/mm/vmscan.c +++ b/mm/vmscan.c @@ -2397,7 +2397,6 @@ static void get_scan_count(struct lruvec *lruvec, struct scan_control *sc, denominator = ap + fp; out: trace_android_vh_tune_scan_type((char *)(&scan_balance)); - trace_android_vh_tune_memcg_scan_type(memcg, (char *)(&scan_balance)); for_each_evictable_lru(lru) { int file = is_file_lru(lru); unsigned long lruvec_size; From 3f90d4f1f33a84e4cac2cee2603a868f25db6d4e Mon Sep 17 00:00:00 2001 From: Liujie Xie Date: Wed, 24 Aug 2022 10:05:21 +0800 Subject: [PATCH 06/50] ANDROID: GKI: Update symbol list Leaf changes summary: 12 artifacts changed Changed leaf types summary: 0 leaf type changed Removed/Changed/Added functions summary: 0 Removed, 0 Changed, 6 Added functions Removed/Changed/Added variables summary: 0 Removed, 0 Changed, 6 Added variables 6 Added functions: [A] 'function int __traceiter_android_vh_do_futex(void*, int, unsigned int*, u32*)' [A] 'function int __traceiter_android_vh_futex_wait_end(void*, unsigned int, u32)' [A] 'function int __traceiter_android_vh_futex_wait_start(void*, unsigned int, u32)' [A] 'function int __traceiter_android_vh_futex_wake_this(void*, int, int, int, task_struct*)' [A] 'function int __traceiter_android_vh_futex_wake_traverse_plist(void*, plist_head*, int*, futex_key, u32)' [A] 'function int __traceiter_android_vh_futex_wake_up_q_finish(void*, int, int)' 6 Added variables: [A] 'tracepoint __tracepoint_android_vh_do_futex' [A] 'tracepoint __tracepoint_android_vh_futex_wait_end' [A] 'tracepoint __tracepoint_android_vh_futex_wait_start' [A] 'tracepoint __tracepoint_android_vh_futex_wake_this' [A] 'tracepoint __tracepoint_android_vh_futex_wake_traverse_plist' [A] 'tracepoint __tracepoint_android_vh_futex_wake_up_q_finish' Bug: 193384408 Signed-off-by: Liujie Xie Change-Id: I959da586aa55da589be60aa219f6adbd959930e5 --- android/abi_gki_aarch64.xml | 180 ++++++++++++++++++++++++---------- android/abi_gki_aarch64_oplus | 12 +++ 2 files changed, 138 insertions(+), 54 deletions(-) diff --git a/android/abi_gki_aarch64.xml b/android/abi_gki_aarch64.xml index be4ae4669da6..9c7f28bd1838 100644 --- a/android/abi_gki_aarch64.xml +++ b/android/abi_gki_aarch64.xml @@ -457,6 +457,7 @@ + @@ -487,6 +488,11 @@ + + + + + @@ -6363,6 +6369,7 @@ + @@ -6394,6 +6401,11 @@ + + + + + @@ -11255,6 +11267,17 @@ + + + + + + + + + + + @@ -22679,6 +22702,17 @@ + + + + + + + + + + + @@ -44025,23 +44059,7 @@ - - - - - - - - - - - - - - - - - + @@ -48332,7 +48350,6 @@ - @@ -53216,13 +53233,6 @@ - - - - - - - @@ -57417,6 +57427,14 @@ + + + + + + + + @@ -65789,13 +65807,6 @@ - - - - - - - @@ -77035,6 +77046,17 @@ + + + + + + + + + + + @@ -90313,7 +90335,6 @@ - @@ -91986,6 +92007,17 @@ + + + + + + + + + + + @@ -101955,12 +101987,6 @@ - - - - - - @@ -110197,7 +110223,6 @@ - @@ -117652,11 +117677,11 @@ - - - - - + + + + + @@ -118016,6 +118041,13 @@ + + + + + + + @@ -118204,9 +118236,43 @@ - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -119636,7 +119702,7 @@ - + @@ -119692,6 +119758,7 @@ + @@ -119722,7 +119789,12 @@ - + + + + + + @@ -134313,12 +134385,12 @@ - + - - - + + + diff --git a/android/abi_gki_aarch64_oplus b/android/abi_gki_aarch64_oplus index c34ab7b965e0..a8d958385dfc 100644 --- a/android/abi_gki_aarch64_oplus +++ b/android/abi_gki_aarch64_oplus @@ -2783,6 +2783,7 @@ __traceiter_android_vh_cpu_idle_enter __traceiter_android_vh_cpu_idle_exit __traceiter_android_vh_cpu_up + __traceiter_android_vh_do_futex __traceiter_android_vh_do_send_sig_info __traceiter_android_vh_drain_all_pages_bypass __traceiter_android_vh_em_cpu_energy @@ -2797,6 +2798,11 @@ __traceiter_android_vh_ftrace_oops_exit __traceiter_android_vh_ftrace_size_check __traceiter_android_vh_futex_sleep_start + __traceiter_android_vh_futex_wait_end + __traceiter_android_vh_futex_wait_start + __traceiter_android_vh_futex_wake_this + __traceiter_android_vh_futex_wake_traverse_plist + __traceiter_android_vh_futex_wake_up_q_finish __traceiter_android_vh_get_from_fragment_pool __traceiter_android_vh_gpio_block_read __traceiter_android_vh_handle_failed_page_trylock @@ -3016,6 +3022,7 @@ __tracepoint_android_vh_cpu_idle_enter __tracepoint_android_vh_cpu_idle_exit __tracepoint_android_vh_cpu_up + __tracepoint_android_vh_do_futex __tracepoint_android_vh_do_send_sig_info __tracepoint_android_vh_drain_all_pages_bypass __tracepoint_android_vh_em_cpu_energy @@ -3030,6 +3037,11 @@ __tracepoint_android_vh_ftrace_oops_exit __tracepoint_android_vh_ftrace_size_check __tracepoint_android_vh_futex_sleep_start + __tracepoint_android_vh_futex_wait_end + __tracepoint_android_vh_futex_wait_start + __tracepoint_android_vh_futex_wake_this + __tracepoint_android_vh_futex_wake_traverse_plist + __tracepoint_android_vh_futex_wake_up_q_finish __tracepoint_android_vh_get_from_fragment_pool __tracepoint_android_vh_gpio_block_read __tracepoint_android_vh_handle_failed_page_trylock From bc08447eb7bd3f98c5847c37a154045657b8a623 Mon Sep 17 00:00:00 2001 From: Kever Yang Date: Wed, 24 Aug 2022 15:37:22 +0800 Subject: [PATCH 07/50] ANDROID: GKI: rockchip: add symbol netif_set_xps_queue Leaf changes summary: 1 artifact changed Changed leaf types summary: 0 leaf type changed Removed/Changed/Added functions summary: 0 Removed, 0 Changed, 1 Added function Removed/Changed/Added variables summary: 0 Removed, 0 Changed, 0 Added variable 1 Added function: [A] 'function int netif_set_xps_queue(net_device*, const cpumask*, u16)' Bug: 239396464 Signed-off-by: Kever Yang Change-Id: I964f408c1780ad8aeaa7333dc1aa29f5f23adce8 --- android/abi_gki_aarch64.xml | 7 +++++++ android/abi_gki_aarch64_rockchip | 3 +++ 2 files changed, 10 insertions(+) diff --git a/android/abi_gki_aarch64.xml b/android/abi_gki_aarch64.xml index 9c7f28bd1838..098fda915835 100644 --- a/android/abi_gki_aarch64.xml +++ b/android/abi_gki_aarch64.xml @@ -3657,6 +3657,7 @@ + @@ -135429,6 +135430,12 @@ + + + + + + diff --git a/android/abi_gki_aarch64_rockchip b/android/abi_gki_aarch64_rockchip index 3cf7478b5d90..5f59918af934 100644 --- a/android/abi_gki_aarch64_rockchip +++ b/android/abi_gki_aarch64_rockchip @@ -1400,6 +1400,9 @@ mmc_sw_reset mmc_wait_for_req netdev_update_features + netif_napi_add + __netif_napi_del + netif_set_xps_queue __netlink_kernel_create netlink_kernel_release nla_append From dec2f52d08d2d5b36fffafd489457ce4ac1c530e Mon Sep 17 00:00:00 2001 From: xiaofeng Date: Wed, 24 Aug 2022 19:34:06 +0800 Subject: [PATCH 08/50] ANDROID: vendor_hooks:vendor hook for __alloc_pages_slowpath. add vendor hook in __alloc_pages_slowpath ahead of __alloc_pages_direct_reclaim and warn_alloc. Bug: 243629905 Change-Id: Ieacc6cf79823c0bfacfdeec9afb55ed66f40d0b0 Signed-off-by: xiaofeng (cherry picked from commit 0312e9cd22b100a088ff64ab36b2db2eb9f28b7c) --- drivers/android/vendor_hooks.c | 2 ++ include/trace/hooks/mm.h | 8 ++++++++ mm/page_alloc.c | 11 +++++++++++ 3 files changed, 21 insertions(+) diff --git a/drivers/android/vendor_hooks.c b/drivers/android/vendor_hooks.c index c05568506b7b..7a1ffec55caf 100644 --- a/drivers/android/vendor_hooks.c +++ b/drivers/android/vendor_hooks.c @@ -453,3 +453,5 @@ EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_alloc_si); EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_free_pages); EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_set_shmem_page_flag); EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_sched_pelt_multiplier); +EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_alloc_pages_reclaim_bypass); +EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_alloc_pages_failure_bypass); diff --git a/include/trace/hooks/mm.h b/include/trace/hooks/mm.h index 8a95d32a0706..19a04b1aa4ff 100644 --- a/include/trace/hooks/mm.h +++ b/include/trace/hooks/mm.h @@ -260,6 +260,14 @@ DECLARE_HOOK(android_vh_set_shmem_page_flag, DECLARE_HOOK(android_vh_remove_vmalloc_stack, TP_PROTO(struct vm_struct *vm), TP_ARGS(vm)); +DECLARE_HOOK(android_vh_alloc_pages_reclaim_bypass, + TP_PROTO(gfp_t gfp_mask, int order, int alloc_flags, + int migratetype, struct page **page), + TP_ARGS(gfp_mask, order, alloc_flags, migratetype, page)); +DECLARE_HOOK(android_vh_alloc_pages_failure_bypass, + TP_PROTO(gfp_t gfp_mask, int order, int alloc_flags, + int migratetype, struct page **page), + TP_ARGS(gfp_mask, order, alloc_flags, migratetype, page)); /* macro versions of hooks are no longer required */ #endif /* _TRACE_HOOK_MM_H */ diff --git a/mm/page_alloc.c b/mm/page_alloc.c index d2b7eca3a2bf..4696696a9b19 100644 --- a/mm/page_alloc.c +++ b/mm/page_alloc.c @@ -4924,6 +4924,12 @@ __alloc_pages_slowpath(gfp_t gfp_mask, unsigned int order, if (current->flags & PF_MEMALLOC) goto nopage; + trace_android_vh_alloc_pages_reclaim_bypass(gfp_mask, order, + alloc_flags, ac->migratetype, &page); + + if (page) + goto got_pg; + /* Try direct reclaim and then allocating */ page = __alloc_pages_direct_reclaim(gfp_mask, order, alloc_flags, ac, &did_some_progress); @@ -5031,6 +5037,11 @@ __alloc_pages_slowpath(gfp_t gfp_mask, unsigned int order, goto retry; } fail: + trace_android_vh_alloc_pages_failure_bypass(gfp_mask, order, + alloc_flags, ac->migratetype, &page); + if (page) + goto got_pg; + warn_alloc(gfp_mask, ac->nodemask, "page allocation failure: order:%u", order); got_pg: From 2b3f9b8187de1603b5f5a23856ea7799a862e82f Mon Sep 17 00:00:00 2001 From: Charan Teja Kalla Date: Thu, 18 Aug 2022 19:20:00 +0530 Subject: [PATCH 09/50] FROMLIST: mm: fix use-after free of page_ext after race with memory-offline The below is one path where race between page_ext and offline of the respective memory blocks will cause use-after-free on the access of page_ext structure. process1 process2 --------- --------- a)doing /proc/page_owner doing memory offline through offline_pages. b)PageBuddy check is failed thus proceed to get the page_owner information through page_ext access. page_ext = lookup_page_ext(page); migrate_pages(); ................. Since all pages are successfully migrated as part of the offline operation,send MEM_OFFLINE notification where for page_ext it calls: offline_page_ext()--> __free_page_ext()--> free_page_ext()--> vfree(ms->page_ext) mem_section->page_ext = NULL c) Check for the PAGE_EXT flags in the page_ext->flags access results into the use-after-free(leading to the translation faults). As mentioned above, there is really no synchronization between page_ext access and its freeing in the memory_offline. The memory offline steps(roughly) on a memory block is as below: 1) Isolate all the pages 2) while(1) try free the pages to buddy.(->free_list[MIGRATE_ISOLATE]) 3) delete the pages from this buddy list. 4) Then free page_ext.(Note: The struct page is still alive as it is freed only during hot remove of the memory which frees the memmap, which steps the user might not perform). This design leads to the state where struct page is alive but the struct page_ext is freed, where the later is ideally part of the former which just representing the page_flags (check [3] for why this design is chosen). The above mentioned race is just one example __but the problem persists in the other paths too involving page_ext->flags access(eg: page_is_idle())__. Fix all the paths where offline races with page_ext access by maintaining synchronization with rcu lock and is achieved in 3 steps: 1) Invalidate all the page_ext's of the sections of a memory block by storing a flag in the LSB of mem_section->page_ext. 2) Wait till all the existing readers to finish working with the ->page_ext's with synchronize_rcu(). Any parallel process that starts after this call will not get page_ext, through lookup_page_ext(), for the block parallel offline operation is being performed. 3) Now safely free all sections ->page_ext's of the block on which offline operation is being performed. Note: If synchronize_rcu() takes time then optimizations can be done in this path through call_rcu()[2]. Thanks to David Hildenbrand for his views/suggestions on the initial discussion[1] and Pavan kondeti for various inputs on this patch. [1] https://lore.kernel.org/linux-mm/59edde13-4167-8550-86f0-11fc67882107@quicinc.com/ [2] https://lore.kernel.org/all/a26ce299-aed1-b8ad-711e-a49e82bdd180@quicinc.com/T/#u [3] https://lore.kernel.org/all/6fa6b7aa-731e-891c-3efb-a03d6a700efa@redhat.com/ Bug: 236222283 Link: https://lore.kernel.org/all/1661496993-11473-1-git-send-email-quic_charante@quicinc.com/ Change-Id: Ib439ae19c61a557a5c70ea90e3c4b35a5583ba0d Suggested-by: David Hildenbrand Suggested-by: Michal Hocko Signed-off-by: Charan Teja Kalla (fixed merge conflicts and still exported lookup_page_ext) --- include/linux/page_ext.h | 17 ++++--- include/linux/page_idle.h | 33 +++++++++---- mm/page_ext.c | 100 ++++++++++++++++++++++++++++++++++++-- mm/page_owner.c | 73 ++++++++++++++++++++-------- 4 files changed, 183 insertions(+), 40 deletions(-) diff --git a/include/linux/page_ext.h b/include/linux/page_ext.h index 8e58a1b73771..67df1c51a84c 100644 --- a/include/linux/page_ext.h +++ b/include/linux/page_ext.h @@ -56,8 +56,9 @@ static inline void page_ext_init(void) { } #endif - struct page_ext *lookup_page_ext(const struct page *page); +extern struct page_ext *page_ext_get(struct page *page); +extern void page_ext_put(struct page_ext *page_ext); static inline struct page_ext *page_ext_next(struct page_ext *curr) { @@ -73,11 +74,6 @@ static inline void pgdat_page_ext_init(struct pglist_data *pgdat) { } -static inline struct page_ext *lookup_page_ext(const struct page *page) -{ - return NULL; -} - static inline void page_ext_init(void) { } @@ -85,5 +81,14 @@ static inline void page_ext_init(void) static inline void page_ext_init_flatmem(void) { } + +static inline struct page_ext *page_ext_get(struct page *page) +{ + return NULL; +} + +static inline void page_ext_put(struct page_ext *page_ext) +{ +} #endif /* CONFIG_PAGE_EXTENSION */ #endif /* __LINUX_PAGE_EXT_H */ diff --git a/include/linux/page_idle.h b/include/linux/page_idle.h index d8a6aecf99cb..2a21c793d815 100644 --- a/include/linux/page_idle.h +++ b/include/linux/page_idle.h @@ -47,62 +47,77 @@ extern struct page_ext_operations page_idle_ops; static inline bool page_is_young(struct page *page) { - struct page_ext *page_ext = lookup_page_ext(page); + struct page_ext *page_ext = page_ext_get(page); + bool page_young; if (unlikely(!page_ext)) return false; - return test_bit(PAGE_EXT_YOUNG, &page_ext->flags); + page_young = test_bit(PAGE_EXT_YOUNG, &page_ext->flags); + page_ext_put(page_ext); + + return page_young; } static inline void set_page_young(struct page *page) { - struct page_ext *page_ext = lookup_page_ext(page); + struct page_ext *page_ext = page_ext_get(page); if (unlikely(!page_ext)) return; set_bit(PAGE_EXT_YOUNG, &page_ext->flags); + page_ext_put(page_ext); } static inline bool test_and_clear_page_young(struct page *page) { - struct page_ext *page_ext = lookup_page_ext(page); + struct page_ext *page_ext = page_ext_get(page); + bool page_young; if (unlikely(!page_ext)) return false; - return test_and_clear_bit(PAGE_EXT_YOUNG, &page_ext->flags); + page_young = test_and_clear_bit(PAGE_EXT_YOUNG, &page_ext->flags); + page_ext_put(page_ext); + + return page_young; } static inline bool page_is_idle(struct page *page) { - struct page_ext *page_ext = lookup_page_ext(page); + struct page_ext *page_ext = page_ext_get(page); + bool page_idle; if (unlikely(!page_ext)) return false; - return test_bit(PAGE_EXT_IDLE, &page_ext->flags); + page_idle = test_bit(PAGE_EXT_IDLE, &page_ext->flags); + page_ext_put(page_ext); + + return page_idle; } static inline void set_page_idle(struct page *page) { - struct page_ext *page_ext = lookup_page_ext(page); + struct page_ext *page_ext = page_ext_get(page); if (unlikely(!page_ext)) return; set_bit(PAGE_EXT_IDLE, &page_ext->flags); + page_ext_put(page_ext); } static inline void clear_page_idle(struct page *page) { - struct page_ext *page_ext = lookup_page_ext(page); + struct page_ext *page_ext = page_ext_get(page); if (unlikely(!page_ext)) return; clear_bit(PAGE_EXT_IDLE, &page_ext->flags); + page_ext_put(page_ext); } #endif /* CONFIG_64BIT */ diff --git a/mm/page_ext.c b/mm/page_ext.c index e5e31ff1adba..e5b56394e2b4 100644 --- a/mm/page_ext.c +++ b/mm/page_ext.c @@ -8,7 +8,7 @@ #include #include #include - +#include /* * struct page extension * @@ -58,6 +58,10 @@ * can utilize this callback to initialize the state of it correctly. */ +#ifdef CONFIG_SPARSEMEM +#define PAGE_EXT_INVALID (0x1) +#endif + #if defined(CONFIG_PAGE_IDLE_FLAG) && !defined(CONFIG_64BIT) static bool need_page_idle(void) { @@ -117,6 +121,49 @@ static inline struct page_ext *get_entry(void *base, unsigned long index) return base + page_ext_size * index; } +/** + * page_ext_get() - Get the extended information for a page. + * @page: The page we're interested in. + * + * Ensures that the page_ext will remain valid until page_ext_put() + * is called. + * + * Return: NULL if no page_ext exists for this page. + * Context: Any context. Caller may not sleep until they have called + * page_ext_put(). + */ +struct page_ext *page_ext_get(struct page *page) +{ + struct page_ext *page_ext; + + rcu_read_lock(); + page_ext = lookup_page_ext(page); + if (!page_ext) { + rcu_read_unlock(); + return NULL; + } + + return page_ext; +} + +/** + * page_ext_put() - Working with page extended information is done. + * @page_ext - Page extended information received from page_ext_get(). + * + * The page extended information of the page may not be valid after this + * function is called. + * + * Return: None. + * Context: Any context with corresponding page_ext_get() is called. + */ +void page_ext_put(struct page_ext *page_ext) +{ + if (unlikely(!page_ext)) + return; + + rcu_read_unlock(); +} + #if !defined(CONFIG_SPARSEMEM) @@ -131,6 +178,7 @@ struct page_ext *lookup_page_ext(const struct page *page) unsigned long index; struct page_ext *base; + WARN_ON_ONCE(!rcu_read_lock_held()); base = NODE_DATA(page_to_nid(page))->node_page_ext; /* * The sanity checks the page allocator does upon freeing a @@ -200,20 +248,27 @@ void __init page_ext_init_flatmem(void) } #else /* CONFIG_FLAT_NODE_MEM_MAP */ +static bool page_ext_invalid(struct page_ext *page_ext) +{ + return !page_ext || (((unsigned long)page_ext & PAGE_EXT_INVALID) == PAGE_EXT_INVALID); +} struct page_ext *lookup_page_ext(const struct page *page) { unsigned long pfn = page_to_pfn(page); struct mem_section *section = __pfn_to_section(pfn); + struct page_ext *page_ext = READ_ONCE(section->page_ext); + + WARN_ON_ONCE(!rcu_read_lock_held()); /* * The sanity checks the page allocator does upon freeing a * page can reach here before the page_ext arrays are * allocated when feeding a range of pages to the allocator * for the first time during bootup or memory hotplug. */ - if (!section->page_ext) + if (page_ext_invalid(page_ext)) return NULL; - return get_entry(section->page_ext, pfn); + return get_entry(page_ext, pfn); } EXPORT_SYMBOL_GPL(lookup_page_ext); @@ -293,9 +348,30 @@ static void __free_page_ext(unsigned long pfn) ms = __pfn_to_section(pfn); if (!ms || !ms->page_ext) return; - base = get_entry(ms->page_ext, pfn); + + base = READ_ONCE(ms->page_ext); + /* + * page_ext here can be valid while doing the roll back + * operation in online_page_ext(). + */ + if (page_ext_invalid(base)) + base = (void *)base - PAGE_EXT_INVALID; + WRITE_ONCE(ms->page_ext, NULL); + + base = get_entry(base, pfn); free_page_ext(base); - ms->page_ext = NULL; +} + +static void __invalidate_page_ext(unsigned long pfn) +{ + struct mem_section *ms; + void *val; + + ms = __pfn_to_section(pfn); + if (!ms || !ms->page_ext) + return; + val = (void *)ms->page_ext + PAGE_EXT_INVALID; + WRITE_ONCE(ms->page_ext, val); } static int __meminit online_page_ext(unsigned long start_pfn, @@ -338,6 +414,20 @@ static int __meminit offline_page_ext(unsigned long start_pfn, start = SECTION_ALIGN_DOWN(start_pfn); end = SECTION_ALIGN_UP(start_pfn + nr_pages); + /* + * Freeing of page_ext is done in 3 steps to avoid + * use-after-free of it: + * 1) Traverse all the sections and mark their page_ext + * as invalid. + * 2) Wait for all the existing users of page_ext who + * started before invalidation to finish. + * 3) Free the page_ext. + */ + for (pfn = start; pfn < end; pfn += PAGES_PER_SECTION) + __invalidate_page_ext(pfn); + + synchronize_rcu(); + for (pfn = start; pfn < end; pfn += PAGES_PER_SECTION) __free_page_ext(pfn); return 0; diff --git a/mm/page_owner.c b/mm/page_owner.c index 9501940a3ccd..8dd3f27db21a 100644 --- a/mm/page_owner.c +++ b/mm/page_owner.c @@ -173,7 +173,7 @@ void __reset_page_owner(struct page *page, unsigned int order) handle = save_stack(GFP_NOWAIT | __GFP_NOWARN); - page_ext = lookup_page_ext(page); + page_ext = page_ext_get(page); if (unlikely(!page_ext)) return; for (i = 0; i < (1 << order); i++) { @@ -183,6 +183,7 @@ void __reset_page_owner(struct page *page, unsigned int order) page_owner->free_ts_nsec = free_ts_nsec; page_ext = page_ext_next(page_ext); } + page_ext_put(page_ext); } static inline void __set_page_owner_handle(struct page *page, @@ -210,19 +211,21 @@ static inline void __set_page_owner_handle(struct page *page, noinline void __set_page_owner(struct page *page, unsigned int order, gfp_t gfp_mask) { - struct page_ext *page_ext = lookup_page_ext(page); + struct page_ext *page_ext; depot_stack_handle_t handle; + handle = save_stack(gfp_mask); + + page_ext = page_ext_get(page); if (unlikely(!page_ext)) return; - - handle = save_stack(gfp_mask); __set_page_owner_handle(page, page_ext, handle, order, gfp_mask); + page_ext_put(page_ext); } void __set_page_owner_migrate_reason(struct page *page, int reason) { - struct page_ext *page_ext = lookup_page_ext(page); + struct page_ext *page_ext = page_ext_get(page); struct page_owner *page_owner; if (unlikely(!page_ext)) @@ -230,12 +233,13 @@ void __set_page_owner_migrate_reason(struct page *page, int reason) page_owner = get_page_owner(page_ext); page_owner->last_migrate_reason = reason; + page_ext_put(page_ext); } void __split_page_owner(struct page *page, unsigned int nr) { int i; - struct page_ext *page_ext = lookup_page_ext(page); + struct page_ext *page_ext = page_ext_get(page); struct page_owner *page_owner; if (unlikely(!page_ext)) @@ -246,17 +250,25 @@ void __split_page_owner(struct page *page, unsigned int nr) page_owner->order = 0; page_ext = page_ext_next(page_ext); } + page_ext_put(page_ext); } void __copy_page_owner(struct page *oldpage, struct page *newpage) { - struct page_ext *old_ext = lookup_page_ext(oldpage); - struct page_ext *new_ext = lookup_page_ext(newpage); + struct page_ext *old_ext; + struct page_ext *new_ext; struct page_owner *old_page_owner, *new_page_owner; - if (unlikely(!old_ext || !new_ext)) + old_ext = page_ext_get(oldpage); + if (unlikely(!old_ext)) return; + new_ext = page_ext_get(newpage); + if (unlikely(!new_ext)) { + page_ext_put(old_ext); + return; + } + old_page_owner = get_page_owner(old_ext); new_page_owner = get_page_owner(new_ext); new_page_owner->order = old_page_owner->order; @@ -279,6 +291,8 @@ void __copy_page_owner(struct page *oldpage, struct page *newpage) */ __set_bit(PAGE_EXT_OWNER, &new_ext->flags); __set_bit(PAGE_EXT_OWNER_ALLOCATED, &new_ext->flags); + page_ext_put(new_ext); + page_ext_put(old_ext); } void pagetypeinfo_showmixedcount_print(struct seq_file *m, @@ -335,12 +349,12 @@ void pagetypeinfo_showmixedcount_print(struct seq_file *m, if (PageReserved(page)) continue; - page_ext = lookup_page_ext(page); + page_ext = page_ext_get(page); if (unlikely(!page_ext)) continue; if (!test_bit(PAGE_EXT_OWNER_ALLOCATED, &page_ext->flags)) - continue; + goto ext_put_continue; page_owner = get_page_owner(page_ext); page_mt = gfp_migratetype(page_owner->gfp_mask); @@ -351,9 +365,12 @@ void pagetypeinfo_showmixedcount_print(struct seq_file *m, count[pageblock_mt]++; pfn = block_end_pfn; + page_ext_put(page_ext); break; } pfn += (1UL << page_owner->order) - 1; +ext_put_continue: + page_ext_put(page_ext); } } @@ -432,7 +449,7 @@ print_page_owner(char __user *buf, size_t count, unsigned long pfn, void __dump_page_owner(struct page *page) { - struct page_ext *page_ext = lookup_page_ext(page); + struct page_ext *page_ext = page_ext_get((void *)page); struct page_owner *page_owner; depot_stack_handle_t handle; unsigned long *entries; @@ -451,6 +468,7 @@ void __dump_page_owner(struct page *page) if (!test_bit(PAGE_EXT_OWNER, &page_ext->flags)) { pr_alert("page_owner info is not present (never set?)\n"); + page_ext_put(page_ext); return; } @@ -483,6 +501,7 @@ void __dump_page_owner(struct page *page) if (page_owner->last_migrate_reason != -1) pr_alert("page has been migrated, last migrate reason: %s\n", migrate_reason_names[page_owner->last_migrate_reason]); + page_ext_put(page_ext); } static ssize_t @@ -508,6 +527,14 @@ read_page_owner(struct file *file, char __user *buf, size_t count, loff_t *ppos) /* Find an allocated page */ for (; pfn < max_pfn; pfn++) { + /* + * This temporary page_owner is required so + * that we can avoid the context switches while holding + * the rcu lock and copying the page owner information to + * user through copy_to_user() or GFP_KERNEL allocations. + */ + struct page_owner page_owner_tmp; + /* * If the new page is in a new MAX_ORDER_NR_PAGES area, * validate the area as existing, skip it if not @@ -530,7 +557,7 @@ read_page_owner(struct file *file, char __user *buf, size_t count, loff_t *ppos) continue; } - page_ext = lookup_page_ext(page); + page_ext = page_ext_get(page); if (unlikely(!page_ext)) continue; @@ -539,14 +566,14 @@ read_page_owner(struct file *file, char __user *buf, size_t count, loff_t *ppos) * because we don't hold the zone lock. */ if (!test_bit(PAGE_EXT_OWNER, &page_ext->flags)) - continue; + goto ext_put_continue; /* * Although we do have the info about past allocation of free * pages, it's not relevant for current memory usage. */ if (!test_bit(PAGE_EXT_OWNER_ALLOCATED, &page_ext->flags)) - continue; + goto ext_put_continue; page_owner = get_page_owner(page_ext); @@ -555,7 +582,7 @@ read_page_owner(struct file *file, char __user *buf, size_t count, loff_t *ppos) * would inflate the stats. */ if (!IS_ALIGNED(pfn, 1 << page_owner->order)) - continue; + goto ext_put_continue; /* * Access to page_ext->handle isn't synchronous so we should @@ -563,13 +590,17 @@ read_page_owner(struct file *file, char __user *buf, size_t count, loff_t *ppos) */ handle = READ_ONCE(page_owner->handle); if (!handle) - continue; + goto ext_put_continue; /* Record the next PFN to read in the file offset */ *ppos = (pfn - min_low_pfn) + 1; + page_owner_tmp = *page_owner; + page_ext_put(page_ext); return print_page_owner(buf, count, pfn, page, - page_owner, handle); + &page_owner_tmp, handle); +ext_put_continue: + page_ext_put(page_ext); } return 0; @@ -627,18 +658,20 @@ static void init_pages_in_zone(pg_data_t *pgdat, struct zone *zone) if (PageReserved(page)) continue; - page_ext = lookup_page_ext(page); + page_ext = page_ext_get(page); if (unlikely(!page_ext)) continue; /* Maybe overlapping zone */ if (test_bit(PAGE_EXT_OWNER, &page_ext->flags)) - continue; + goto ext_put_continue; /* Found early allocated page */ __set_page_owner_handle(page, page_ext, early_handle, 0, 0); count++; +ext_put_continue: + page_ext_put(page_ext); } cond_resched(); } From 99f01600227a1aa314913a92734677d99826c365 Mon Sep 17 00:00:00 2001 From: Charan Teja Kalla Date: Fri, 19 Aug 2022 20:52:40 +0530 Subject: [PATCH 10/50] ANDROID: mm: page_pinner: use page_ext_get/put() to work with page_ext Use page_ext_get/put() to work with the page extended information without which the page extended information may not be valid. Bug: 2129036 Change-Id: Ibfe036b9ecef0e2551b5d0da1011cacbb0a5c3e6 Signed-off-by: Charan Teja Kalla --- mm/page_pinner.c | 25 +++++++++++++++++-------- 1 file changed, 17 insertions(+), 8 deletions(-) diff --git a/mm/page_pinner.c b/mm/page_pinner.c index 8bccb54fbbd3..6a825777afac 100644 --- a/mm/page_pinner.c +++ b/mm/page_pinner.c @@ -162,7 +162,7 @@ void __reset_page_pinner(struct page *page, unsigned int order, bool free) struct page_ext *page_ext; int i; - page_ext = lookup_page_ext(page); + page_ext = page_ext_get(page); if (unlikely(!page_ext)) return; @@ -184,6 +184,7 @@ void __reset_page_pinner(struct page *page, unsigned int order, bool free) clear_bit(PAGE_EXT_GET, &page_ext->flags); page_ext = page_ext_next(page_ext); } + page_ext_put(page_ext); } static inline void __set_page_pinner_handle(struct page *page, @@ -206,14 +207,16 @@ static inline void __set_page_pinner_handle(struct page *page, noinline void __set_page_pinner(struct page *page, unsigned int order) { - struct page_ext *page_ext = lookup_page_ext(page); + struct page_ext *page_ext; depot_stack_handle_t handle; + handle = save_stack(GFP_NOWAIT|__GFP_NOWARN); + + page_ext = page_ext_get(page); if (unlikely(!page_ext)) return; - - handle = save_stack(GFP_NOWAIT|__GFP_NOWARN); __set_page_pinner_handle(page, page_ext, handle, order); + page_ext_put(page_ext); } static ssize_t @@ -279,7 +282,7 @@ print_page_pinner(bool longterm, char __user *buf, size_t count, struct captured void __dump_page_pinner(struct page *page) { - struct page_ext *page_ext = lookup_page_ext(page); + struct page_ext *page_ext = page_ext_get(page); struct page_pinner *page_pinner; depot_stack_handle_t handle; unsigned long *entries; @@ -300,6 +303,7 @@ void __dump_page_pinner(struct page *page) count = atomic_read(&page_pinner->count); if (!count) { pr_alert("page_pinner info is not present (never set?)\n"); + page_ext_put(page_ext); return; } @@ -323,11 +327,12 @@ void __dump_page_pinner(struct page *page) nr_entries = stack_depot_fetch(handle, &entries); stack_trace_print(entries, nr_entries, 0); } + page_ext_put(page_ext); } void __page_pinner_migration_failed(struct page *page) { - struct page_ext *page_ext = lookup_page_ext(page); + struct page_ext *page_ext = page_ext_get(page); struct captured_pinner record; unsigned long flags; unsigned int idx; @@ -335,9 +340,12 @@ void __page_pinner_migration_failed(struct page *page) if (unlikely(!page_ext)) return; - if (!test_bit(PAGE_EXT_PINNER_MIGRATION_FAILED, &page_ext->flags)) + if (!test_bit(PAGE_EXT_PINNER_MIGRATION_FAILED, &page_ext->flags)) { + page_ext_put(page_ext); return; + } + page_ext_put(page_ext); record.handle = save_stack(GFP_NOWAIT|__GFP_NOWARN); record.ts_usec = ktime_to_us(ktime_get_boottime()); capture_page_state(page, &record); @@ -359,10 +367,11 @@ void __page_pinner_mark_migration_failed_pages(struct list_head *page_list) /* The page will be freed by putback_movable_pages soon */ if (page_count(page) == 1) continue; - page_ext = lookup_page_ext(page); + page_ext = page_ext_get(page); if (unlikely(!page_ext)) continue; __set_bit(PAGE_EXT_PINNER_MIGRATION_FAILED, &page_ext->flags); + page_ext_put(page_ext); __page_pinner_migration_failed(page); } } From 2301307412708aaf86c64e048d57529b70f6e9c0 Mon Sep 17 00:00:00 2001 From: Chao Yu Date: Wed, 31 Aug 2022 14:08:56 +0800 Subject: [PATCH 11/50] BACKPORT: f2fs: invalidate META_MAPPING before IPU/DIO write Encrypted pages during GC are read and cached in META_MAPPING. However, due to cached pages in META_MAPPING, there is an issue where newly written pages are lost by IPU or DIO writes. Thread A - f2fs_gc() Thread B /* phase 3 */ down_write(i_gc_rwsem) ra_data_block() ---- (a) up_write(i_gc_rwsem) f2fs_direct_IO() : - down_read(i_gc_rwsem) - __blockdev_direct_io() - get_data_block_dio_write() - f2fs_dio_submit_bio() ---- (b) - up_read(i_gc_rwsem) /* phase 4 */ down_write(i_gc_rwsem) move_data_block() ---- (c) up_write(i_gc_rwsem) (a) In phase 3 of f2fs_gc(), up-to-date page is read from storage and cached in META_MAPPING. (b) In thread B, writing new data by IPU or DIO write on same blkaddr as read in (a). cached page in META_MAPPING become out-dated. (c) In phase 4 of f2fs_gc(), out-dated page in META_MAPPING is copied to new blkaddr. In conclusion, the newly written data in (b) is lost. To address this issue, invalidating pages in META_MAPPING before IPU or DIO write. Bug: 243874214 Fixes: 6aa58d8ad20a ("f2fs: readahead encrypted block during GC") Signed-off-by: Hyeong-Jun Kim Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim Signed-off-by: Chao Yu (cherry picked from commit e3b49ea36802053f312013fd4ccb6e59920a9f76) Change-Id: I1c0af14c2d63c115b882bf38ba61ea7924a70bb1 --- fs/f2fs/data.c | 5 ++++- fs/f2fs/segment.c | 3 +++ 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c index 653ab9564c56..3b61d6ff608d 100644 --- a/fs/f2fs/data.c +++ b/fs/f2fs/data.c @@ -1669,9 +1669,12 @@ int f2fs_map_blocks(struct inode *inode, struct f2fs_map_blocks *map, sync_out: /* for hardware encryption, but to avoid potential issue in future */ - if (flag == F2FS_GET_BLOCK_DIO && map->m_flags & F2FS_MAP_MAPPED) + if (flag == F2FS_GET_BLOCK_DIO && map->m_flags & F2FS_MAP_MAPPED) { f2fs_wait_on_block_writeback_range(inode, map->m_pblk, map->m_len); + invalidate_mapping_pages(META_MAPPING(sbi), + map->m_pblk, map->m_pblk); + } if (flag == F2FS_GET_BLOCK_PRECACHE) { if (map->m_flags & F2FS_MAP_MAPPED) { diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c index dfd418c97666..ba40a41986ff 100644 --- a/fs/f2fs/segment.c +++ b/fs/f2fs/segment.c @@ -3568,6 +3568,9 @@ int f2fs_inplace_write_data(struct f2fs_io_info *fio) goto drop_bio; } + invalidate_mapping_pages(META_MAPPING(sbi), + fio->new_blkaddr, fio->new_blkaddr); + stat_inc_inplace_blocks(fio->sbi); if (fio->bio && !(SM_I(sbi)->ipu_policy & (1 << F2FS_IPU_NOCACHE))) From fa0cdb5b9d01e512f569dafdb9548eea043d9b41 Mon Sep 17 00:00:00 2001 From: Chao Yu Date: Wed, 31 Aug 2022 14:13:36 +0800 Subject: [PATCH 12/50] BACKPORT: f2fs: fix to invalidate META_MAPPING before DIO write Quoted from commit e3b49ea36802 ("f2fs: invalidate META_MAPPING before IPU/DIO write") " Encrypted pages during GC are read and cached in META_MAPPING. However, due to cached pages in META_MAPPING, there is an issue where newly written pages are lost by IPU or DIO writes. Thread A - f2fs_gc() Thread B /* phase 3 */ down_write(i_gc_rwsem) ra_data_block() ---- (a) up_write(i_gc_rwsem) f2fs_direct_IO() : - down_read(i_gc_rwsem) - __blockdev_direct_io() - get_data_block_dio_write() - f2fs_dio_submit_bio() ---- (b) - up_read(i_gc_rwsem) /* phase 4 */ down_write(i_gc_rwsem) move_data_block() ---- (c) up_write(i_gc_rwsem) (a) In phase 3 of f2fs_gc(), up-to-date page is read from storage and cached in META_MAPPING. (b) In thread B, writing new data by IPU or DIO write on same blkaddr as read in (a). cached page in META_MAPPING become out-dated. (c) In phase 4 of f2fs_gc(), out-dated page in META_MAPPING is copied to new blkaddr. In conclusion, the newly written data in (b) is lost. To address this issue, invalidating pages in META_MAPPING before IPU or DIO write. " In previous commit, we missed to cover extent cache hit case, and passed wrong value for parameter @end of invalidate_mapping_pages(), fix both issues. Bug: 243874214 Fixes: 6aa58d8ad20a ("f2fs: readahead encrypted block during GC") Fixes: e3b49ea36802 ("f2fs: invalidate META_MAPPING before IPU/DIO write") Cc: Hyeong-Jun Kim Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim Signed-off-by: Chao Yu (cherry picked from commit 67ca06872eb02944b4c6f92cffa9242e92c63109) Change-Id: Icbfb0a0004172a0af9ab59ffabf92ee7c5f16791 --- fs/f2fs/data.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c index 3b61d6ff608d..38346b3a4800 100644 --- a/fs/f2fs/data.c +++ b/fs/f2fs/data.c @@ -1490,9 +1490,12 @@ int f2fs_map_blocks(struct inode *inode, struct f2fs_map_blocks *map, *map->m_next_extent = pgofs + map->m_len; /* for hardware encryption, but to avoid potential issue in future */ - if (flag == F2FS_GET_BLOCK_DIO) + if (flag == F2FS_GET_BLOCK_DIO) { f2fs_wait_on_block_writeback_range(inode, map->m_pblk, map->m_len); + invalidate_mapping_pages(META_MAPPING(sbi), + map->m_pblk, map->m_pblk + map->m_len - 1); + } goto out; } @@ -1673,7 +1676,7 @@ int f2fs_map_blocks(struct inode *inode, struct f2fs_map_blocks *map, f2fs_wait_on_block_writeback_range(inode, map->m_pblk, map->m_len); invalidate_mapping_pages(META_MAPPING(sbi), - map->m_pblk, map->m_pblk); + map->m_pblk, map->m_pblk + map->m_len - 1); } if (flag == F2FS_GET_BLOCK_PRECACHE) { From 22b447e9bdb357e62fa1bfd85a2e8072e489b68a Mon Sep 17 00:00:00 2001 From: Chao Yu Date: Wed, 31 Aug 2022 14:18:54 +0800 Subject: [PATCH 13/50] BACKPORT: f2fs: invalidate meta pages only for post_read required inode After commit e3b49ea36802 ("f2fs: invalidate META_MAPPING before IPU/DIO write"), invalidate_mapping_pages() will be called to avoid race condition in between IPU/DIO and readahead for GC. However, readahead flow is only used for post_read required inode, so this patch adds check condition to avoids unnecessary page cache invalidating for non-post_read inode. Bug: 243874214 Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim Signed-off-by: Chao Yu (cherry picked from commit 0d5b9d8156396bbe1c982708b38ab9e188c45ec9) Change-Id: I39a8da4183b59b34522f445d25d8ab9fd2d6319c --- fs/f2fs/data.c | 11 +++-------- fs/f2fs/f2fs.h | 1 + fs/f2fs/segment.c | 9 ++++++++- 3 files changed, 12 insertions(+), 9 deletions(-) diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c index 38346b3a4800..267ad87fd1d8 100644 --- a/fs/f2fs/data.c +++ b/fs/f2fs/data.c @@ -1490,12 +1490,9 @@ int f2fs_map_blocks(struct inode *inode, struct f2fs_map_blocks *map, *map->m_next_extent = pgofs + map->m_len; /* for hardware encryption, but to avoid potential issue in future */ - if (flag == F2FS_GET_BLOCK_DIO) { + if (flag == F2FS_GET_BLOCK_DIO) f2fs_wait_on_block_writeback_range(inode, map->m_pblk, map->m_len); - invalidate_mapping_pages(META_MAPPING(sbi), - map->m_pblk, map->m_pblk + map->m_len - 1); - } goto out; } @@ -1672,12 +1669,9 @@ int f2fs_map_blocks(struct inode *inode, struct f2fs_map_blocks *map, sync_out: /* for hardware encryption, but to avoid potential issue in future */ - if (flag == F2FS_GET_BLOCK_DIO && map->m_flags & F2FS_MAP_MAPPED) { + if (flag == F2FS_GET_BLOCK_DIO && map->m_flags & F2FS_MAP_MAPPED) f2fs_wait_on_block_writeback_range(inode, map->m_pblk, map->m_len); - invalidate_mapping_pages(META_MAPPING(sbi), - map->m_pblk, map->m_pblk + map->m_len - 1); - } if (flag == F2FS_GET_BLOCK_PRECACHE) { if (map->m_flags & F2FS_MAP_MAPPED) { @@ -2720,6 +2714,7 @@ int f2fs_write_single_data_page(struct page *page, int *submitted, .submitted = false, .compr_blocks = compr_blocks, .need_lock = LOCK_RETRY, + .post_read = f2fs_post_read_required(inode), .io_type = io_type, .io_wbc = wbc, .bio = bio, diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h index 88520c7c3a13..0d6923b009ba 100644 --- a/fs/f2fs/f2fs.h +++ b/fs/f2fs/f2fs.h @@ -1161,6 +1161,7 @@ struct f2fs_io_info { bool retry; /* need to reallocate block address */ int compr_blocks; /* # of compressed block addresses */ bool encrypted; /* indicate file is encrypted */ + bool post_read; /* require post read */ enum iostat_type io_type; /* io type */ struct writeback_control *io_wbc; /* writeback control */ struct bio **bio; /* bio for ipu */ diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c index ba40a41986ff..8fe7ea4489d3 100644 --- a/fs/f2fs/segment.c +++ b/fs/f2fs/segment.c @@ -3568,7 +3568,8 @@ int f2fs_inplace_write_data(struct f2fs_io_info *fio) goto drop_bio; } - invalidate_mapping_pages(META_MAPPING(sbi), + if (fio->post_read) + invalidate_mapping_pages(META_MAPPING(sbi), fio->new_blkaddr, fio->new_blkaddr); stat_inc_inplace_blocks(fio->sbi); @@ -3750,10 +3751,16 @@ void f2fs_wait_on_block_writeback(struct inode *inode, block_t blkaddr) void f2fs_wait_on_block_writeback_range(struct inode *inode, block_t blkaddr, block_t len) { + struct f2fs_sb_info *sbi = F2FS_I_SB(inode); block_t i; + if (!f2fs_post_read_required(inode)) + return; + for (i = 0; i < len; i++) f2fs_wait_on_block_writeback(inode, blkaddr + i); + + invalidate_mapping_pages(META_MAPPING(sbi), blkaddr, blkaddr + len - 1); } static int read_compacted_summaries(struct f2fs_sb_info *sbi) From 85aff723298470f06985cc2075f9b176da3a2aaa Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Wed, 31 Aug 2022 18:59:49 +0200 Subject: [PATCH 14/50] Revert "ANDROID: GKI: signal: Export for __lock_task_sighand" This reverts commit a719abf03114cfc0b9f68937d9cd900d74d65cae. The symbol was never used by any external module, so remove the unneeded export. Bug: 158067689 Bug: 203756332 Cc: Abhilasha Rao Signed-off-by: Greg Kroah-Hartman Change-Id: I13b65fd0620faf08784dabc7130f199dfa5cf053 --- kernel/signal.c | 1 - 1 file changed, 1 deletion(-) diff --git a/kernel/signal.c b/kernel/signal.c index 6fff4a9788ac..71a550524bd7 100644 --- a/kernel/signal.c +++ b/kernel/signal.c @@ -1400,7 +1400,6 @@ struct sighand_struct *__lock_task_sighand(struct task_struct *tsk, return sighand; } -EXPORT_SYMBOL_GPL(__lock_task_sighand); /* * send signal info to all the members of a group From 594835143a7065dd474688640c06b4179a647826 Mon Sep 17 00:00:00 2001 From: Chao Yu Date: Fri, 4 Feb 2022 15:19:46 +0800 Subject: [PATCH 15/50] BACKPORT: f2fs: introduce F2FS_IPU_HONOR_OPU_WRITE ipu policy Once F2FS_IPU_FORCE policy is enabled in some cases: a) f2fs forces to use F2FS_IPU_FORCE in a small-sized volume b) user sets F2FS_IPU_FORCE policy via sysfs Then we may fail to defragment file due to IPU policy check, it doesn't make sense, let's introduce a new IPU policy to allow OPU during file defragmentation. In small-sized volume, let's enable F2FS_IPU_HONOR_OPU_WRITE policy by default. Bug: 244657983 Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim (cherry picked from commit 1018a5463a063715365784704c4e8cdf2eec4b04) Change-Id: I05dfa5a07a6a17dcda68f50a8f4a8260c2612dcc --- Documentation/ABI/testing/sysfs-fs-f2fs | 3 ++- fs/f2fs/data.c | 18 +++++++++++++----- fs/f2fs/f2fs.h | 3 ++- fs/f2fs/file.c | 18 +++++++++++------- fs/f2fs/segment.h | 5 ++++- fs/f2fs/super.c | 3 ++- 6 files changed, 34 insertions(+), 16 deletions(-) diff --git a/Documentation/ABI/testing/sysfs-fs-f2fs b/Documentation/ABI/testing/sysfs-fs-f2fs index 759a8291ff4a..cd503f42eda1 100644 --- a/Documentation/ABI/testing/sysfs-fs-f2fs +++ b/Documentation/ABI/testing/sysfs-fs-f2fs @@ -56,8 +56,9 @@ Description: Controls the in-place-update policy. 0x04 F2FS_IPU_UTIL 0x08 F2FS_IPU_SSR_UTIL 0x10 F2FS_IPU_FSYNC - 0x20 F2FS_IPU_ASYNC, + 0x20 F2FS_IPU_ASYNC 0x40 F2FS_IPU_NOCACHE + 0x80 F2FS_IPU_HONOR_OPU_WRITE ==== ================= Refer segment.h for details. diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c index 267ad87fd1d8..b0ad5f156619 100644 --- a/fs/f2fs/data.c +++ b/fs/f2fs/data.c @@ -2479,6 +2479,9 @@ static inline bool check_inplace_update_policy(struct inode *inode, struct f2fs_sb_info *sbi = F2FS_I_SB(inode); unsigned int policy = SM_I(sbi)->ipu_policy; + if (policy & (0x1 << F2FS_IPU_HONOR_OPU_WRITE) && + is_inode_flag_set(inode, FI_OPU_WRITE)) + return false; if (policy & (0x1 << F2FS_IPU_FORCE)) return true; if (policy & (0x1 << F2FS_IPU_SSR) && f2fs_need_SSR(sbi)) @@ -2549,6 +2552,9 @@ bool f2fs_should_update_outplace(struct inode *inode, struct f2fs_io_info *fio) if (is_inode_flag_set(inode, FI_ALIGNED_WRITE)) return true; + if (is_inode_flag_set(inode, FI_OPU_WRITE)) + return true; + if (fio) { if (page_private_gcing(fio->page)) return true; @@ -3173,8 +3179,8 @@ static int __f2fs_write_data_pages(struct address_space *mapping, f2fs_available_free_memory(sbi, DIRTY_DENTS)) goto skip_write; - /* skip writing during file defragment */ - if (is_inode_flag_set(inode, FI_DO_DEFRAG)) + /* skip writing in file defragment preparing stage */ + if (is_inode_flag_set(inode, FI_SKIP_WRITES)) goto skip_write; trace_f2fs_writepages(mapping->host, wbc, DATA); @@ -3956,6 +3962,7 @@ static int f2fs_migrate_blocks(struct inode *inode, block_t start_blk, f2fs_down_write(&F2FS_I(inode)->i_mmap_sem); set_inode_flag(inode, FI_ALIGNED_WRITE); + set_inode_flag(inode, FI_OPU_WRITE); for (; secidx < end_sec; secidx++) { f2fs_down_write(&sbi->pin_sem); @@ -3964,7 +3971,7 @@ static int f2fs_migrate_blocks(struct inode *inode, block_t start_blk, f2fs_allocate_new_section(sbi, CURSEG_COLD_DATA_PINNED, false); f2fs_unlock_op(sbi); - set_inode_flag(inode, FI_DO_DEFRAG); + set_inode_flag(inode, FI_SKIP_WRITES); for (blkofs = 0; blkofs < blk_per_sec; blkofs++) { struct page *page; @@ -3981,7 +3988,7 @@ static int f2fs_migrate_blocks(struct inode *inode, block_t start_blk, f2fs_put_page(page, 1); } - clear_inode_flag(inode, FI_DO_DEFRAG); + clear_inode_flag(inode, FI_SKIP_WRITES); ret = filemap_fdatawrite(inode->i_mapping); @@ -3992,7 +3999,8 @@ static int f2fs_migrate_blocks(struct inode *inode, block_t start_blk, } done: - clear_inode_flag(inode, FI_DO_DEFRAG); + clear_inode_flag(inode, FI_SKIP_WRITES); + clear_inode_flag(inode, FI_OPU_WRITE); clear_inode_flag(inode, FI_ALIGNED_WRITE); f2fs_up_write(&F2FS_I(inode)->i_mmap_sem); diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h index 0d6923b009ba..12f5b7e6a347 100644 --- a/fs/f2fs/f2fs.h +++ b/fs/f2fs/f2fs.h @@ -707,7 +707,8 @@ enum { FI_DROP_CACHE, /* drop dirty page cache */ FI_DATA_EXIST, /* indicate data exists */ FI_INLINE_DOTS, /* indicate inline dot dentries */ - FI_DO_DEFRAG, /* indicate defragment is running */ + FI_SKIP_WRITES, /* should skip data page writeback */ + FI_OPU_WRITE, /* used for opu per file */ FI_DIRTY_FILE, /* indicate regular/symlink has dirty pages */ FI_NO_PREALLOC, /* indicate skipped preallocated blocks */ FI_HOT_DATA, /* indicate file is hot */ diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c index 016a84ae1ec5..0d4820afca16 100644 --- a/fs/f2fs/file.c +++ b/fs/f2fs/file.c @@ -2592,10 +2592,6 @@ static int f2fs_defragment_range(struct f2fs_sb_info *sbi, bool fragmented = false; int err; - /* if in-place-update policy is enabled, don't waste time here */ - if (f2fs_should_update_inplace(inode, NULL)) - return -EINVAL; - pg_start = range->start >> PAGE_SHIFT; pg_end = (range->start + range->len) >> PAGE_SHIFT; @@ -2603,6 +2599,13 @@ static int f2fs_defragment_range(struct f2fs_sb_info *sbi, inode_lock(inode); + /* if in-place-update policy is enabled, don't waste time here */ + set_inode_flag(inode, FI_OPU_WRITE); + if (f2fs_should_update_inplace(inode, NULL)) { + err = -EINVAL; + goto out; + } + /* writeback all dirty pages in the range */ err = filemap_write_and_wait_range(inode->i_mapping, range->start, range->start + range->len - 1); @@ -2684,7 +2687,7 @@ static int f2fs_defragment_range(struct f2fs_sb_info *sbi, goto check; } - set_inode_flag(inode, FI_DO_DEFRAG); + set_inode_flag(inode, FI_SKIP_WRITES); idx = map.m_lblk; while (idx < map.m_lblk + map.m_len && cnt < blk_per_seg) { @@ -2709,15 +2712,16 @@ static int f2fs_defragment_range(struct f2fs_sb_info *sbi, if (map.m_lblk < pg_end && cnt < blk_per_seg) goto do_map; - clear_inode_flag(inode, FI_DO_DEFRAG); + clear_inode_flag(inode, FI_SKIP_WRITES); err = filemap_fdatawrite(inode->i_mapping); if (err) goto out; } clear_out: - clear_inode_flag(inode, FI_DO_DEFRAG); + clear_inode_flag(inode, FI_SKIP_WRITES); out: + clear_inode_flag(inode, FI_OPU_WRITE); inode_unlock(inode); if (!err) range->len = (u64)total << PAGE_SHIFT; diff --git a/fs/f2fs/segment.h b/fs/f2fs/segment.h index 7d9166a2ff41..10ddc2803ed0 100644 --- a/fs/f2fs/segment.h +++ b/fs/f2fs/segment.h @@ -650,7 +650,9 @@ static inline int utilization(struct f2fs_sb_info *sbi) * pages over min_fsync_blocks. (=default option) * F2FS_IPU_ASYNC - do IPU given by asynchronous write requests. * F2FS_IPU_NOCACHE - disable IPU bio cache. - * F2FS_IPUT_DISABLE - disable IPU. (=default option in LFS mode) + * F2FS_IPU_HONOR_OPU_WRITE - use OPU write prior to IPU write if inode has + * FI_OPU_WRITE flag. + * F2FS_IPU_DISABLE - disable IPU. (=default option in LFS mode) */ #define DEF_MIN_IPU_UTIL 70 #define DEF_MIN_FSYNC_BLOCKS 8 @@ -666,6 +668,7 @@ enum { F2FS_IPU_FSYNC, F2FS_IPU_ASYNC, F2FS_IPU_NOCACHE, + F2FS_IPU_HONOR_OPU_WRITE, }; static inline unsigned int curseg_segno(struct f2fs_sb_info *sbi, diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c index 532d2546b0a3..6dcdd007a3ec 100644 --- a/fs/f2fs/super.c +++ b/fs/f2fs/super.c @@ -3771,7 +3771,8 @@ static void f2fs_tuning_parameters(struct f2fs_sb_info *sbi) if (sm_i->main_segments <= SMALL_VOLUME_SEGMENTS) { F2FS_OPTION(sbi).alloc_mode = ALLOC_MODE_REUSE; sm_i->dcc_info->discard_granularity = 1; - sm_i->ipu_policy = 1 << F2FS_IPU_FORCE; + sm_i->ipu_policy = 1 << F2FS_IPU_FORCE | + 1 << F2FS_IPU_HONOR_OPU_WRITE; } sbi->readdir_ra = 1; From 604f2f5656f16b555284b486134a30d70b6a1d01 Mon Sep 17 00:00:00 2001 From: Jaegeuk Kim Date: Fri, 4 Mar 2022 09:40:05 -0800 Subject: [PATCH 16/50] BACKPORT: f2fs: don't get FREEZE lock in f2fs_evict_inode in frozen fs Let's purge inode cache in order to avoid the below deadlock. [freeze test] shrinkder freeze_super - pwercpu_down_write(SB_FREEZE_FS) - super_cache_scan - down_read(&sb->s_umount) - prune_icache_sb - dispose_list - evict - f2fs_evict_inode thaw_super - down_write(&sb->s_umount); - __percpu_down_read(SB_FREEZE_FS) Bug: 242127451 Signed-off-by: Jaegeuk Kim Change-Id: Ifa01aca90eab6968c5e511fb3819854121aa9b7c (cherry picked from commit e3d44a0028f58cd1dcba053120652e1a1ea6ce12) --- Documentation/ABI/testing/sysfs-fs-f2fs | 1 + fs/f2fs/f2fs.h | 1 + fs/f2fs/inode.c | 6 ++++-- fs/f2fs/super.c | 4 ++++ 4 files changed, 10 insertions(+), 2 deletions(-) diff --git a/Documentation/ABI/testing/sysfs-fs-f2fs b/Documentation/ABI/testing/sysfs-fs-f2fs index cd503f42eda1..163d38c0ba64 100644 --- a/Documentation/ABI/testing/sysfs-fs-f2fs +++ b/Documentation/ABI/testing/sysfs-fs-f2fs @@ -432,6 +432,7 @@ Description: Show status of f2fs superblock in real time. 0x800 SBI_QUOTA_SKIP_FLUSH skip flushing quota in current CP 0x1000 SBI_QUOTA_NEED_REPAIR quota file may be corrupted 0x2000 SBI_IS_RESIZEFS resizefs is in process + 0x4000 SBI_IS_FREEZING freefs is in process ====== ===================== ================================= What: /sys/fs/f2fs//ckpt_thread_ioprio diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h index 12f5b7e6a347..9241c2423bf5 100644 --- a/fs/f2fs/f2fs.h +++ b/fs/f2fs/f2fs.h @@ -1247,6 +1247,7 @@ enum { SBI_QUOTA_SKIP_FLUSH, /* skip flushing quota in current CP */ SBI_QUOTA_NEED_REPAIR, /* quota file may be corrupted */ SBI_IS_RESIZEFS, /* resizefs is in process */ + SBI_IS_FREEZING, /* freezefs is in process */ }; enum { diff --git a/fs/f2fs/inode.c b/fs/f2fs/inode.c index f93fee11977b..30278af1cdd7 100644 --- a/fs/f2fs/inode.c +++ b/fs/f2fs/inode.c @@ -764,7 +764,8 @@ void f2fs_evict_inode(struct inode *inode) f2fs_remove_ino_entry(sbi, inode->i_ino, UPDATE_INO); f2fs_remove_ino_entry(sbi, inode->i_ino, FLUSH_INO); - sb_start_intwrite(inode->i_sb); + if (!is_sbi_flag_set(sbi, SBI_IS_FREEZING)) + sb_start_intwrite(inode->i_sb); set_inode_flag(inode, FI_NO_ALLOC); i_size_write(inode, 0); retry: @@ -795,7 +796,8 @@ void f2fs_evict_inode(struct inode *inode) if (dquot_initialize_needed(inode)) set_sbi_flag(sbi, SBI_QUOTA_NEED_REPAIR); } - sb_end_intwrite(inode->i_sb); + if (!is_sbi_flag_set(sbi, SBI_IS_FREEZING)) + sb_end_intwrite(inode->i_sb); no_delete: dquot_drop(inode); diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c index 6dcdd007a3ec..90f8be1175e6 100644 --- a/fs/f2fs/super.c +++ b/fs/f2fs/super.c @@ -1558,11 +1558,15 @@ static int f2fs_freeze(struct super_block *sb) /* ensure no checkpoint required */ if (!llist_empty(&F2FS_SB(sb)->cprc_info.issue_list)) return -EINVAL; + + /* to avoid deadlock on f2fs_evict_inode->SB_FREEZE_FS */ + set_sbi_flag(F2FS_SB(sb), SBI_IS_FREEZING); return 0; } static int f2fs_unfreeze(struct super_block *sb) { + clear_sbi_flag(F2FS_SB(sb), SBI_IS_FREEZING); return 0; } From 1c5313a9f76fc707a59610841323fc3304e7d3eb Mon Sep 17 00:00:00 2001 From: Jaegeuk Kim Date: Fri, 19 Aug 2022 15:52:02 -0700 Subject: [PATCH 17/50] FROMGIT: f2fs: flush pending checkpoints when freezing super This avoids -EINVAL when trying to freeze f2fs. Bug: 242127451 Cc: stable@vger.kernel.org Signed-off-by: Jaegeuk Kim Change-Id: Id2939642e3b93b42cf1ca03831d6c5e4e54d57fd (cherry picked from commit a36fe7301268524ffa56ff8a9ad0edec6bd5b85a https://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs.git dev) --- fs/f2fs/checkpoint.c | 24 ++++++++++++++++++------ fs/f2fs/f2fs.h | 1 + fs/f2fs/super.c | 5 ++--- 3 files changed, 21 insertions(+), 9 deletions(-) diff --git a/fs/f2fs/checkpoint.c b/fs/f2fs/checkpoint.c index 7bc120937874..2d4323218cb0 100644 --- a/fs/f2fs/checkpoint.c +++ b/fs/f2fs/checkpoint.c @@ -1863,15 +1863,27 @@ int f2fs_start_ckpt_thread(struct f2fs_sb_info *sbi) void f2fs_stop_ckpt_thread(struct f2fs_sb_info *sbi) { struct ckpt_req_control *cprc = &sbi->cprc_info; + struct task_struct *ckpt_task; - if (cprc->f2fs_issue_ckpt) { - struct task_struct *ckpt_task = cprc->f2fs_issue_ckpt; + if (!cprc->f2fs_issue_ckpt) + return; - cprc->f2fs_issue_ckpt = NULL; - kthread_stop(ckpt_task); + ckpt_task = cprc->f2fs_issue_ckpt; + cprc->f2fs_issue_ckpt = NULL; + kthread_stop(ckpt_task); - flush_remained_ckpt_reqs(sbi, NULL); - } + f2fs_flush_ckpt_thread(sbi); +} + +void f2fs_flush_ckpt_thread(struct f2fs_sb_info *sbi) +{ + struct ckpt_req_control *cprc = &sbi->cprc_info; + + flush_remained_ckpt_reqs(sbi, NULL); + + /* Let's wait for the previous dispatched checkpoint. */ + while (atomic_read(&cprc->queued_ckpt)) + io_schedule_timeout(DEFAULT_IO_TIMEOUT); } void f2fs_init_ckpt_req_control(struct f2fs_sb_info *sbi) diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h index 9241c2423bf5..42134a532de9 100644 --- a/fs/f2fs/f2fs.h +++ b/fs/f2fs/f2fs.h @@ -3626,6 +3626,7 @@ unsigned int f2fs_usable_blks_in_seg(struct f2fs_sb_info *sbi, * checkpoint.c */ void f2fs_stop_checkpoint(struct f2fs_sb_info *sbi, bool end_io); +void f2fs_flush_ckpt_thread(struct f2fs_sb_info *sbi); struct page *f2fs_grab_meta_page(struct f2fs_sb_info *sbi, pgoff_t index); struct page *f2fs_get_meta_page(struct f2fs_sb_info *sbi, pgoff_t index); struct page *f2fs_get_meta_page_retry(struct f2fs_sb_info *sbi, pgoff_t index); diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c index 90f8be1175e6..dff6f5afdb27 100644 --- a/fs/f2fs/super.c +++ b/fs/f2fs/super.c @@ -1555,9 +1555,8 @@ static int f2fs_freeze(struct super_block *sb) if (is_sbi_flag_set(F2FS_SB(sb), SBI_IS_DIRTY)) return -EINVAL; - /* ensure no checkpoint required */ - if (!llist_empty(&F2FS_SB(sb)->cprc_info.issue_list)) - return -EINVAL; + /* Let's flush checkpoints and stop the thread. */ + f2fs_flush_ckpt_thread(F2FS_SB(sb)); /* to avoid deadlock on f2fs_evict_inode->SB_FREEZE_FS */ set_sbi_flag(F2FS_SB(sb), SBI_IS_FREEZING); From 42aa1955c2787306032418c3aee6959d192ea571 Mon Sep 17 00:00:00 2001 From: Jaegeuk Kim Date: Thu, 18 Aug 2022 22:40:09 -0700 Subject: [PATCH 18/50] FROMGIT: f2fs: complete checkpoints during remount Otherwise, pending checkpoints can contribute a race condition to give a quota warning. - Thread - checkpoint thread add checkpoints to the list do_remount() down_write(&sb->s_umount); f2fs_remount() block_operations() down_read_trylock(&sb->s_umount) = 0 up_write(&sb->s_umount); f2fs_quota_sync() dquot_writeback_dquots() WARN_ON_ONCE(!rwsem_is_locked(&sb->s_umount)); Or, do_remount() down_write(&sb->s_umount); f2fs_remount() create a ckpt thread f2fs_enable_checkpoint() adds checkpoints wait for f2fs_sync_fs() trigger another pending checkpoint block_operations() down_read_trylock(&sb->s_umount) = 0 up_write(&sb->s_umount); f2fs_quota_sync() dquot_writeback_dquots() WARN_ON_ONCE(!rwsem_is_locked(&sb->s_umount)); Bug: 242127451 Bug: 215554521 Cc: stable@vger.kernel.org Signed-off-by: Jaegeuk Kim Change-Id: I85926fe14245058e48bac5699a7b760d7700c653 (cherry picked from commit d14393c5bff2f0c163e6bb384618300e30d19754 https://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs.git dev) --- fs/f2fs/super.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c index dff6f5afdb27..454ceb6155d4 100644 --- a/fs/f2fs/super.c +++ b/fs/f2fs/super.c @@ -2028,6 +2028,9 @@ static void f2fs_enable_checkpoint(struct f2fs_sb_info *sbi) f2fs_up_write(&sbi->gc_lock); f2fs_sync_fs(sbi->sb, 1); + + /* Let's ensure there's no pending checkpoint anymore */ + f2fs_flush_ckpt_thread(sbi); } static int f2fs_remount(struct super_block *sb, int *flags, char *data) @@ -2187,6 +2190,9 @@ static int f2fs_remount(struct super_block *sb, int *flags, char *data) f2fs_stop_ckpt_thread(sbi); need_restart_ckpt = true; } else { + /* Flush if the prevous checkpoint, if exists. */ + f2fs_flush_ckpt_thread(sbi); + err = f2fs_start_ckpt_thread(sbi); if (err) { f2fs_err(sbi, From eaa7364bf7f86ce8f20810a1e806c4e48f0ca0b4 Mon Sep 17 00:00:00 2001 From: Jaegeuk Kim Date: Tue, 23 Aug 2022 10:18:42 -0700 Subject: [PATCH 19/50] FROMGIT: f2fs: increase the limit for reserve_root This patch increases the threshold that limits the reserved root space from 0.2% to 12.5% by using simple shift operation. Typically Android sets 128MB, but if the storage capacity is 32GB, 0.2% which is around 64MB becomes too small. Let's relax it. Bug: 243493735 Cc: stable@vger.kernel.org Reported-by: Aran Dalton Signed-off-by: Jaegeuk Kim Change-Id: Ia76ae8f9dd1c7a5f123a561f081bf5a4a29ac186 (cherry picked from commit cf42f1d7ab33ea2637f3c6b786a76302f719726b https://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs.git dev) --- fs/f2fs/super.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c index 454ceb6155d4..98f585000aa2 100644 --- a/fs/f2fs/super.c +++ b/fs/f2fs/super.c @@ -299,10 +299,10 @@ static void f2fs_destroy_casefold_cache(void) { } static inline void limit_reserve_root(struct f2fs_sb_info *sbi) { - block_t limit = min((sbi->user_block_count << 1) / 1000, + block_t limit = min((sbi->user_block_count >> 3), sbi->user_block_count - sbi->reserved_blocks); - /* limit is 0.2% */ + /* limit is 12.5% */ if (test_opt(sbi, RESERVE_ROOT) && F2FS_OPTION(sbi).root_reserved_blocks > limit) { F2FS_OPTION(sbi).root_reserved_blocks = limit; From eef3b6ff4179ff0b940a4afe693e25759a39dd13 Mon Sep 17 00:00:00 2001 From: Konstantin Vyshetsky Date: Wed, 20 Apr 2022 17:24:29 -0700 Subject: [PATCH 20/50] BACKPORT: scsi: ufs: core: Increase fDeviceInit poll frequency UFS devices are expected to clear fDeviceInit flag in single digit milliseconds. Current values of 5 to 10 millisecond sleep add to increased latency during the initialization and resume path. This CL lowers the sleep range to 500 to 1000 microseconds. Bug: 236993021 Link: https://lore.kernel.org/r/20220421002429.3136933-1-bvanassche@acm.org Acked-by: Avri Altman Signed-off-by: Konstantin Vyshetsky Signed-off-by: Bart Van Assche Signed-off-by: Martin K. Petersen (cherry picked from commit a4e6496fca3f32e997e8a3b5c44e2a1ae09d018e) Change-Id: I3a9a01853e89ea73ff5e355007db4730fa853ea0 --- drivers/scsi/ufs/ufshcd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c index 55cf3301de66..e83fbb4f0593 100644 --- a/drivers/scsi/ufs/ufshcd.c +++ b/drivers/scsi/ufs/ufshcd.c @@ -4380,7 +4380,7 @@ static int ufshcd_complete_dev_init(struct ufs_hba *hba) QUERY_FLAG_IDN_FDEVICEINIT, 0, &flag_res); if (!flag_res) break; - usleep_range(5000, 10000); + usleep_range(500, 1000); } while (ktime_before(ktime_get(), timeout)); if (err) { From bda2986f13b290a6c8132839a0a90a8a1cee2434 Mon Sep 17 00:00:00 2001 From: Linyu Yuan Date: Tue, 26 Jul 2022 14:45:49 +0800 Subject: [PATCH 21/50] UPSTREAM: usb: typec: ucsi: Acknowledge the GET_ERROR_STATUS command completion We found PPM will not send any notification after it report error status and OPM issue GET_ERROR_STATUS command to read the details about error. According UCSI spec, PPM may clear the Error Status Data after the OPM has acknowledged the command completion. This change add operation to acknowledge the command completion from PPM. Fixes: bdc62f2bae8f (usb: typec: ucsi: Simplified registration and I/O API) Cc: # 5.10 Signed-off-by: Jack Pham Signed-off-by: Linyu Yuan Link: https://lore.kernel.org/r/1658817949-4632-1-git-send-email-quic_linyyuan@quicinc.com Signed-off-by: Greg Kroah-Hartman Bug: 241140735 Change-Id: I8447d618200163c6819f93f8d8b5b7f2bece5e13 (cherry picked from commit a7dc438b5e446afcd1b3b6651da28271400722f2) Signed-off-by: Mayank Rana Signed-off-by: Prashanth K --- drivers/usb/typec/ucsi/ucsi.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/usb/typec/ucsi/ucsi.c b/drivers/usb/typec/ucsi/ucsi.c index 53a51a2602b1..18be14d51e02 100644 --- a/drivers/usb/typec/ucsi/ucsi.c +++ b/drivers/usb/typec/ucsi/ucsi.c @@ -76,6 +76,10 @@ static int ucsi_read_error(struct ucsi *ucsi) if (ret) return ret; + ret = ucsi_acknowledge_command(ucsi); + if (ret) + return ret; + switch (error) { case UCSI_ERROR_INCOMPATIBLE_PARTNER: return -EOPNOTSUPP; From 95279078149abf6684fadbc7bb6a2ab49efeea18 Mon Sep 17 00:00:00 2001 From: Wesley Cheng Date: Fri, 12 Aug 2022 11:19:56 -0700 Subject: [PATCH 22/50] UPSTREAM: usb: dwc3: gadget: Avoid duplicate requests to enable Run/Stop Relocate the pullups_connected check until after it is ensured that there are no runtime PM transitions. If another context triggered the DWC3 core's runtime resume, it may have already enabled the Run/Stop. Do not re-run the entire pullup sequence again, as it may issue a core soft reset while Run/Stop is already set. This patch depends on commit 69e131d1ac4e ("usb: dwc3: gadget: Prevent repeat pullup()") Fixes: 77adb8bdf422 ("usb: dwc3: gadget: Allow runtime suspend if UDC unbinded") Cc: stable Signed-off-by: Wesley Cheng Link: https://lore.kernel.org/r/20220728020647.9377-1-quic_wcheng@quicinc.com Signed-off-by: Greg Kroah-Hartman Bug: 245440430 Change-Id: I8b819b4773420fbca3bd7a284d715401dcdd00c3 (cherry picked from commit 040f2dbd2010c43f33ad27249e6dac48456f4d99) Signed-off-by: Prashanth K --- drivers/usb/dwc3/gadget.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c index d988ba9b192e..016050adf800 100644 --- a/drivers/usb/dwc3/gadget.c +++ b/drivers/usb/dwc3/gadget.c @@ -2472,9 +2472,6 @@ static int dwc3_gadget_pullup(struct usb_gadget *g, int is_on) is_on = !!is_on; - if (dwc->pullups_connected == is_on) - return 0; - vdwc->softconnect = is_on; /* @@ -2512,6 +2509,11 @@ static int dwc3_gadget_pullup(struct usb_gadget *g, int is_on) return 0; } + if (dwc->pullups_connected == is_on) { + pm_runtime_put(dwc->dev); + return 0; + } + /* * Synchronize and disable any further event handling while controller * is being enabled/disabled. From 7351343bc8d38d25d082f7eb157fa965e8eec3ee Mon Sep 17 00:00:00 2001 From: Jiyoung Jeong Date: Wed, 7 Sep 2022 07:36:35 +0900 Subject: [PATCH 23/50] ANDROID: GKI: Update symbol list for Exynos SoC Leaf changes summary: 3 artifacts changed Changed leaf types summary: 0 leaf type changed Removed/Changed/Added functions summary: 0 Removed, 0 Changed, 3 Added functions Removed/Changed/Added variables summary: 0 Removed, 0 Changed, 0 Added variable 3 Added functions: [A] 'function void __page_frag_cache_drain(page*, unsigned int)' [A] 'function void* page_frag_alloc(page_frag_cache*, unsigned int, gfp_t)' [A] 'function void page_frag_free(void*)' Bug: 245485515 Signed-off-by: Jiyoung Jeong Change-Id: Idd4f42a38c3b36d7e59d5cbc59cfd996891e2530 --- android/abi_gki_aarch64.xml | 486 ++++++++++++++++++--------------- android/abi_gki_aarch64_exynos | 64 +++++ 2 files changed, 325 insertions(+), 225 deletions(-) diff --git a/android/abi_gki_aarch64.xml b/android/abi_gki_aarch64.xml index 098fda915835..8584a30036bd 100644 --- a/android/abi_gki_aarch64.xml +++ b/android/abi_gki_aarch64.xml @@ -209,6 +209,7 @@ + @@ -3873,6 +3874,8 @@ + + @@ -26819,6 +26822,7 @@ + @@ -97536,6 +97540,23 @@ + + + + + + + + + + + + + + + + + @@ -115298,11 +115319,11 @@ - - - - - + + + + + @@ -115932,9 +115953,9 @@ - - - + + + @@ -115987,9 +116008,9 @@ - - - + + + @@ -116500,12 +116521,17 @@ + + + + + - - + + @@ -117600,10 +117626,10 @@ - - - - + + + + @@ -117658,17 +117684,17 @@ - - - - + + + + - - - - - + + + + + @@ -117955,27 +117981,27 @@ - + + + + + + - + + + - - - - - - - - - - - + + + + @@ -118085,12 +118111,12 @@ - - - - - - + + + + + + @@ -118165,17 +118191,17 @@ - - - - + + + + - - - - - + + + + + @@ -118283,12 +118309,12 @@ - - - - - - + + + + + + @@ -118307,18 +118333,18 @@ - - - - + + + + - - - - - - + + + + + + @@ -118328,10 +118354,10 @@ - - - - + + + + @@ -118476,10 +118502,10 @@ - - - - + + + + @@ -118556,10 +118582,10 @@ - - - - + + + + @@ -118570,11 +118596,11 @@ - - - - - + + + + + @@ -118637,33 +118663,33 @@ - - - - + + + + - - - - - - - - - - - - - + - - - + + + + + + + + + + + + + + + @@ -118854,9 +118880,9 @@ - - - + + + @@ -118929,15 +118955,15 @@ - - - - + + + + - - - + + + @@ -118958,15 +118984,15 @@ - - - + + + - - - - + + + + @@ -119126,10 +119152,10 @@ - - - - + + + + @@ -119183,9 +119209,9 @@ - - - + + + @@ -119692,7 +119718,7 @@ - + @@ -119700,8 +119726,8 @@ - - + + @@ -119744,10 +119770,10 @@ - - - - + + + + @@ -119765,7 +119791,7 @@ - + @@ -119778,8 +119804,8 @@ - - + + @@ -119797,15 +119823,15 @@ - + - + - + - + @@ -119830,7 +119856,7 @@ - + @@ -119844,9 +119870,9 @@ - + - + @@ -119859,11 +119885,11 @@ - - - - - + + + + + @@ -119904,7 +119930,7 @@ - + @@ -119917,14 +119943,14 @@ - - + + - - + + @@ -119951,7 +119977,7 @@ - + @@ -119960,7 +119986,7 @@ - + @@ -120527,9 +120553,9 @@ - - - + + + @@ -120653,9 +120679,9 @@ - - - + + + @@ -129807,14 +129833,14 @@ - - - + + + - - - + + + @@ -130762,8 +130788,8 @@ - - + + @@ -133303,9 +133329,9 @@ - - - + + + @@ -133400,10 +133426,10 @@ - - - - + + + + @@ -134079,8 +134105,8 @@ - - + + @@ -135190,16 +135216,16 @@ - - + + - - + + - - + + @@ -136557,10 +136583,10 @@ - - - - + + + + @@ -136569,6 +136595,16 @@ + + + + + + + + + + @@ -139034,8 +139070,8 @@ - - + + @@ -139666,10 +139702,10 @@ - - - - + + + + @@ -140988,16 +141024,16 @@ - - - - + + + + - - - - + + + + @@ -141524,21 +141560,21 @@ - + - - + + - - - - + + + + @@ -144478,11 +144514,11 @@ - - - - - + + + + + @@ -148143,14 +148179,14 @@ - - - + + + - - - + + + diff --git a/android/abi_gki_aarch64_exynos b/android/abi_gki_aarch64_exynos index 777a6434355e..0b37ab51884c 100644 --- a/android/abi_gki_aarch64_exynos +++ b/android/abi_gki_aarch64_exynos @@ -144,6 +144,7 @@ clk_set_rate clk_unprepare clockevents_config_and_register + clocks_calc_mult_shift __clocksource_register_scale __close_fd cma_alloc @@ -198,6 +199,8 @@ cpufreq_table_index_unsorted cpufreq_this_cpu_can_update cpufreq_unregister_notifier + cpu_hotplug_disable + cpu_hotplug_enable __cpuhp_remove_state __cpuhp_setup_state __cpuhp_setup_state_cpuslocked @@ -235,6 +238,7 @@ crypto_shash_update crypto_unregister_alg crypto_unregister_scomp + csum_ipv6_magic csum_partial csum_tcpudp_nofold _ctype @@ -385,6 +389,7 @@ dev_pm_opp_add dev_pm_opp_disable dev_pm_opp_find_freq_ceil + dev_pm_opp_find_freq_ceil_by_volt dev_pm_opp_find_freq_exact dev_pm_opp_find_freq_floor dev_pm_opp_get_freq @@ -428,6 +433,7 @@ dma_buf_export dma_buf_fd dma_buf_get + dma_buf_get_flags dma_buf_map_attachment dma_buf_mmap dma_buf_move_notify @@ -509,6 +515,7 @@ drm_atomic_add_affected_connectors drm_atomic_add_affected_planes drm_atomic_commit + drm_atomic_get_connector_state drm_atomic_get_crtc_state drm_atomic_get_plane_state drm_atomic_get_private_obj_state @@ -552,6 +559,7 @@ drm_atomic_set_fb_for_plane drm_atomic_set_mode_for_crtc drm_atomic_state_alloc + drm_atomic_state_clear __drm_atomic_state_free drm_bridge_add drm_bridge_attach @@ -584,6 +592,7 @@ drm_crtc_vblank_off drm_crtc_vblank_on drm_crtc_vblank_put + drm_crtc_wait_one_vblank drm_cvt_mode __drm_dbg __drm_debug @@ -745,6 +754,7 @@ drm_vma_node_allow drm_vma_node_is_allowed drm_vma_node_revoke + drm_wait_one_vblank drm_writeback_connector_init drm_writeback_queue_job drm_writeback_signal_completion @@ -824,6 +834,7 @@ __get_free_pages get_net_ns_by_fd get_net_ns_by_pid + get_options get_random_bytes get_random_u32 __get_task_comm @@ -966,6 +977,7 @@ input_set_capability input_unregister_device input_unregister_handle + int_pow int_sqrt iomem_resource iommu_alloc_resv_region @@ -975,6 +987,7 @@ iommu_device_sysfs_remove iommu_device_unlink iommu_device_unregister + iommu_dma_enable_best_fit_algo iommu_dma_reserve_iova iommu_domain_alloc iommu_fwspec_add_ids @@ -1009,6 +1022,7 @@ irq_domain_set_info irq_domain_xlate_onetwocell irq_domain_xlate_twocell + irq_do_set_affinity irq_find_mapping irq_get_irqchip_state irq_get_irq_data @@ -1038,6 +1052,7 @@ kasan_flag_enabled kasprintf kernel_kobj + kernfs_path_from_node kern_mount kern_unmount key_create_or_update @@ -1074,6 +1089,8 @@ kobject_uevent kobject_uevent_env krealloc + kset_create_and_add + kset_unregister kstat kstrdup kstrndup @@ -1091,6 +1108,7 @@ kstrtoull_from_user ksys_sync_helper kthread_bind + kthread_bind_mask kthread_cancel_delayed_work_sync kthread_cancel_work_sync kthread_create_on_node @@ -1120,6 +1138,8 @@ kvfree kvfree_call_rcu kvmalloc_node + led_classdev_register_ext + led_classdev_unregister __list_add_valid __list_del_entry_valid list_sort @@ -1144,6 +1164,7 @@ __memcpy_toio memdup_user memmove + memory_read_from_buffer memparse memremap memset @@ -1159,6 +1180,7 @@ mii_nway_restart mipi_dsi_attach mipi_dsi_compression_mode + mipi_dsi_dcs_get_display_brightness mipi_dsi_dcs_read mipi_dsi_dcs_set_column_address mipi_dsi_dcs_set_display_brightness @@ -1316,6 +1338,7 @@ of_property_read_string_helper of_property_read_u32_index of_property_read_u64 + of_property_read_u64_index of_property_read_variable_u16_array of_property_read_variable_u32_array of_property_read_variable_u8_array @@ -1331,6 +1354,9 @@ oops_in_progress orderly_poweroff page_endio + page_frag_alloc + __page_frag_cache_drain + page_frag_free page_mapping __page_pinner_migration_failed panic @@ -1378,9 +1404,11 @@ pci_read_config_dword pci_read_config_word __pci_register_driver + pci_release_regions pci_release_resource pci_rescan_bus pci_resize_resource + pci_restore_msi_state pci_restore_state pci_save_state pci_set_master @@ -1388,6 +1416,7 @@ pci_store_saved_state pci_unmap_rom pci_unregister_driver + pci_wake_from_d3 pci_write_config_dword pci_write_config_word PDE_DATA @@ -1418,6 +1447,7 @@ pinctrl_utils_free_map pin_get_name pin_user_pages + pin_user_pages_fast pin_user_pages_remote platform_bus_type platform_device_add @@ -1506,6 +1536,8 @@ pwm_set_chip_data queue_delayed_work_on queue_work_on + radix_tree_delete + radix_tree_lookup radix_tree_tagged ___ratelimit raw_notifier_call_chain @@ -1647,11 +1679,13 @@ sched_set_normal sched_setscheduler sched_setscheduler_nocheck + sched_uclamp_used schedule schedule_timeout schedule_timeout_interruptible scnprintf scsi_block_when_processing_errors + scsi_dma_unmap scsi_eh_ready_devs __scsi_execute scsi_print_sense_hdr @@ -1712,6 +1746,7 @@ skb_realloc_headroom skb_trim smp_call_function + smp_call_function_any smp_call_function_many smp_call_function_single smp_call_on_cpu @@ -1783,6 +1818,7 @@ snd_soc_info_volsw_range snd_soc_info_volsw_sx snd_soc_info_xr_sx + snd_soc_lookup_component snd_soc_new_compress snd_soc_of_get_dai_link_codecs snd_soc_of_get_dai_name @@ -1832,6 +1868,7 @@ __stack_chk_guard static_key_slow_dec static_key_slow_inc + stop_machine stop_one_cpu_nowait stpcpy strcasecmp @@ -1903,7 +1940,15 @@ tasklet_init tasklet_kill __tasklet_schedule + tasklet_setup task_rq_lock + tcp_register_congestion_control + tcp_reno_cong_avoid + tcp_reno_ssthresh + tcp_reno_undo_cwnd + tcp_slow_start + tcp_unregister_congestion_control + thermal_cdev_update thermal_cooling_device_unregister thermal_of_cooling_device_register thermal_zone_device_disable @@ -1925,11 +1970,13 @@ trace_event_reg trace_handle_return __traceiter_android_rvh_can_migrate_task + __traceiter_android_rvh_cpu_cgroup_attach __traceiter_android_rvh_cpu_cgroup_can_attach __traceiter_android_rvh_dequeue_task __traceiter_android_rvh_enqueue_task __traceiter_android_rvh_find_lowest_rq __traceiter_android_rvh_find_new_ilb + __traceiter_android_rvh_flush_task __traceiter_android_rvh_gic_v3_set_affinity __traceiter_android_rvh_post_init_entity_util_avg __traceiter_android_rvh_replace_next_task_fair @@ -1937,18 +1984,24 @@ __traceiter_android_rvh_sched_newidle_balance __traceiter_android_rvh_sched_nohz_balancer_kick __traceiter_android_rvh_sched_rebalance_domains + __traceiter_android_rvh_schedule __traceiter_android_rvh_select_fallback_rq __traceiter_android_rvh_select_task_rq_fair __traceiter_android_rvh_select_task_rq_rt + __traceiter_android_rvh_wake_up_new_task + __traceiter_android_vh_cgroup_attach __traceiter_android_vh_cpu_idle_enter __traceiter_android_vh_cpu_idle_exit __traceiter_android_vh_do_wake_up_sync __traceiter_android_vh_ipi_stop + __traceiter_android_vh_is_fpsimd_save __traceiter_android_vh_scheduler_tick __traceiter_android_vh_set_wake_flags __traceiter_android_vh_show_mem + __traceiter_android_vh_ufs_check_int_errors __traceiter_android_vh_ufs_compl_command __traceiter_android_vh_ufs_prepare_command + __traceiter_android_vh_ufs_send_tm_command __traceiter_cpu_idle __traceiter_device_pm_callback_end __traceiter_device_pm_callback_start @@ -1976,11 +2029,13 @@ __traceiter_workqueue_execute_start trace_output_call __tracepoint_android_rvh_can_migrate_task + __tracepoint_android_rvh_cpu_cgroup_attach __tracepoint_android_rvh_cpu_cgroup_can_attach __tracepoint_android_rvh_dequeue_task __tracepoint_android_rvh_enqueue_task __tracepoint_android_rvh_find_lowest_rq __tracepoint_android_rvh_find_new_ilb + __tracepoint_android_rvh_flush_task __tracepoint_android_rvh_gic_v3_set_affinity __tracepoint_android_rvh_post_init_entity_util_avg __tracepoint_android_rvh_replace_next_task_fair @@ -1988,18 +2043,24 @@ __tracepoint_android_rvh_sched_newidle_balance __tracepoint_android_rvh_sched_nohz_balancer_kick __tracepoint_android_rvh_sched_rebalance_domains + __tracepoint_android_rvh_schedule __tracepoint_android_rvh_select_fallback_rq __tracepoint_android_rvh_select_task_rq_fair __tracepoint_android_rvh_select_task_rq_rt + __tracepoint_android_rvh_wake_up_new_task + __tracepoint_android_vh_cgroup_attach __tracepoint_android_vh_cpu_idle_enter __tracepoint_android_vh_cpu_idle_exit __tracepoint_android_vh_do_wake_up_sync __tracepoint_android_vh_ipi_stop + __tracepoint_android_vh_is_fpsimd_save __tracepoint_android_vh_scheduler_tick __tracepoint_android_vh_set_wake_flags __tracepoint_android_vh_show_mem + __tracepoint_android_vh_ufs_check_int_errors __tracepoint_android_vh_ufs_compl_command __tracepoint_android_vh_ufs_prepare_command + __tracepoint_android_vh_ufs_send_tm_command __tracepoint_cpu_idle __tracepoint_device_pm_callback_end __tracepoint_device_pm_callback_start @@ -2129,6 +2190,7 @@ unregister_shrinker up update_devfreq + update_rq_clock up_read up_write usb_add_function @@ -2301,6 +2363,7 @@ wakeup_source_add wakeup_source_destroy wakeup_source_register + wakeup_source_remove wakeup_source_unregister __wake_up_sync __wake_up_sync_key @@ -2322,6 +2385,7 @@ xhci_gen_setup xhci_get_endpoint_index xhci_get_ep_ctx + xhci_get_slot_ctx xhci_init_driver xhci_initialize_ring_info xhci_link_segments From 8aaba3c5a1d2445f690c87f0b73ae15f7ffb14d2 Mon Sep 17 00:00:00 2001 From: Linus Torvalds Date: Tue, 19 Jul 2022 11:09:01 -0700 Subject: [PATCH 24/50] BACKPORT: watchqueue: make sure to serialize 'wqueue->defunct' properly commit 353f7988dd8413c47718f7ca79c030b6fb62cfe5 upstream. When the pipe is closed, we mark the associated watchqueue defunct by calling watch_queue_clear(). However, while that is protected by the watchqueue lock, new watchqueue entries aren't actually added under that lock at all: they use the pipe->rd_wait.lock instead, and looking up that pipe happens without any locking. The watchqueue code uses the RCU read-side section to make sure that the wqueue entry itself hasn't disappeared, but that does not protect the pipe_info in any way. So make sure to actually hold the wqueue lock when posting watch events, properly serializing against the pipe being torn down. Bug: 235277737 Reported-by: Noam Rathaus Cc: Greg KH Cc: David Howells Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman Signed-off-by: Lee Jones Change-Id: I42b0d56021be1d8950c3642ae0acc5cdccadb394 --- kernel/watch_queue.c | 53 +++++++++++++++++++++++++++++++------------- 1 file changed, 37 insertions(+), 16 deletions(-) diff --git a/kernel/watch_queue.c b/kernel/watch_queue.c index 249ed3259144..dcf1e676797d 100644 --- a/kernel/watch_queue.c +++ b/kernel/watch_queue.c @@ -34,6 +34,27 @@ MODULE_LICENSE("GPL"); #define WATCH_QUEUE_NOTE_SIZE 128 #define WATCH_QUEUE_NOTES_PER_PAGE (PAGE_SIZE / WATCH_QUEUE_NOTE_SIZE) +/* + * This must be called under the RCU read-lock, which makes + * sure that the wqueue still exists. It can then take the lock, + * and check that the wqueue hasn't been destroyed, which in + * turn makes sure that the notification pipe still exists. + */ +static inline bool lock_wqueue(struct watch_queue *wqueue) +{ + spin_lock_bh(&wqueue->lock); + if (unlikely(wqueue->defunct)) { + spin_unlock_bh(&wqueue->lock); + return false; + } + return true; +} + +static inline void unlock_wqueue(struct watch_queue *wqueue) +{ + spin_unlock_bh(&wqueue->lock); +} + static void watch_queue_pipe_buf_release(struct pipe_inode_info *pipe, struct pipe_buffer *buf) { @@ -69,6 +90,10 @@ static const struct pipe_buf_operations watch_queue_pipe_buf_ops = { /* * Post a notification to a watch queue. + * + * Must be called with the RCU lock for reading, and the + * watch_queue lock held, which guarantees that the pipe + * hasn't been released. */ static bool post_one_notification(struct watch_queue *wqueue, struct watch_notification *n) @@ -85,9 +110,6 @@ static bool post_one_notification(struct watch_queue *wqueue, spin_lock_irq(&pipe->rd_wait.lock); - if (wqueue->defunct) - goto out; - mask = pipe->ring_size - 1; head = pipe->head; tail = pipe->tail; @@ -203,7 +225,10 @@ void __post_watch_notification(struct watch_list *wlist, if (security_post_notification(watch->cred, cred, n) < 0) continue; - post_one_notification(wqueue, n); + if (lock_wqueue(wqueue)) { + post_one_notification(wqueue, n); + unlock_wqueue(wqueue);; + } } rcu_read_unlock(); @@ -465,11 +490,12 @@ int add_watch_to_object(struct watch *watch, struct watch_list *wlist) return -EAGAIN; } - spin_lock_bh(&wqueue->lock); - kref_get(&wqueue->usage); - kref_get(&watch->usage); - hlist_add_head(&watch->queue_node, &wqueue->watches); - spin_unlock_bh(&wqueue->lock); + if (lock_wqueue(wqueue)) { + kref_get(&wqueue->usage); + kref_get(&watch->usage); + hlist_add_head(&watch->queue_node, &wqueue->watches); + unlock_wqueue(wqueue); + } hlist_add_head(&watch->list_node, &wlist->watchers); return 0; @@ -523,20 +549,15 @@ int remove_watch_from_object(struct watch_list *wlist, struct watch_queue *wq, wqueue = rcu_dereference(watch->queue); - /* We don't need the watch list lock for the next bit as RCU is - * protecting *wqueue from deallocation. - */ - if (wqueue) { + if (lock_wqueue(wqueue)) { post_one_notification(wqueue, &n.watch); - spin_lock_bh(&wqueue->lock); - if (!hlist_unhashed(&watch->queue_node)) { hlist_del_init_rcu(&watch->queue_node); put_watch(watch); } - spin_unlock_bh(&wqueue->lock); + unlock_wqueue(wqueue); } if (wlist->release_watch) { From cee231f83ba2858cee9bf37c06d07cc4cecc6624 Mon Sep 17 00:00:00 2001 From: Peifeng Li Date: Sat, 10 Sep 2022 10:16:31 +0800 Subject: [PATCH 25/50] ANDROID: GKI: add symbols in android/abi_gki_aarch64_oplus - __traceiter_android_rvh_check_preempt_tick - __tracepoint_android_rvh_check_preempt_tick Bug: 241191475 Signed-off-by: Peifeng Li Change-Id: Iafc8f210047aa82f56fc90e45678c25d80d4e548 --- android/abi_gki_aarch64_oplus | 2 ++ 1 file changed, 2 insertions(+) diff --git a/android/abi_gki_aarch64_oplus b/android/abi_gki_aarch64_oplus index a8d958385dfc..fc17ce17fc3a 100644 --- a/android/abi_gki_aarch64_oplus +++ b/android/abi_gki_aarch64_oplus @@ -2684,6 +2684,7 @@ __traceiter_android_rvh_build_perf_domains __traceiter_android_rvh_can_migrate_task __traceiter_android_rvh_check_preempt_wakeup + __traceiter_android_rvh_check_preempt_tick __traceiter_android_rvh_cpu_cgroup_attach __traceiter_android_rvh_cpu_cgroup_online __traceiter_android_rvh_cpu_overutilized @@ -2923,6 +2924,7 @@ __tracepoint_android_rvh_build_perf_domains __tracepoint_android_rvh_can_migrate_task __tracepoint_android_rvh_check_preempt_wakeup + __tracepoint_android_rvh_check_preempt_tick __tracepoint_android_rvh_cpu_cgroup_attach __tracepoint_android_rvh_cpu_cgroup_online __tracepoint_android_rvh_cpu_overutilized From d7586fa2096466951b12adf157d1305310eb5bb7 Mon Sep 17 00:00:00 2001 From: Sean Christopherson Date: Fri, 11 Mar 2022 03:27:41 +0000 Subject: [PATCH 26/50] BACKPORT: KVM: x86: avoid calling x86 emulator without a decoded instruction commit fee060cd52d69c114b62d1a2948ea9648b5131f9 upstream. Whenever x86_decode_emulated_instruction() detects a breakpoint, it returns the value that kvm_vcpu_check_breakpoint() writes into its pass-by-reference second argument. Unfortunately this is completely bogus because the expected outcome of x86_decode_emulated_instruction is an EMULATION_* value. Then, if kvm_vcpu_check_breakpoint() does "*r = 0" (corresponding to a KVM_EXIT_DEBUG userspace exit), it is misunderstood as EMULATION_OK and x86_emulate_instruction() is called without having decoded the instruction. This causes various havoc from running with a stale emulation context. The fix is to move the call to kvm_vcpu_check_breakpoint() where it was before commit 4aa2691dcbd3 ("KVM: x86: Factor out x86 instruction emulation with decoding") introduced x86_decode_emulated_instruction(). The other caller of the function does not need breakpoint checks, because it is invoked as part of a vmexit and the processor has already checked those before executing the instruction that #GP'd. This fixes CVE-2022-1852. Bug: 235183128 Reported-by: Qiuhao Li Reported-by: Gaoning Pan Reported-by: Yongkang Jia Fixes: 4aa2691dcbd3 ("KVM: x86: Factor out x86 instruction emulation with decoding") Cc: stable@vger.kernel.org Signed-off-by: Sean Christopherson Message-Id: <20220311032801.3467418-2-seanjc@google.com> [Rewrote commit message according to Qiuhao's report, since a patch already existed to fix the bug. - Paolo] Signed-off-by: Paolo Bonzini Signed-off-by: Greg Kroah-Hartman Signed-off-by: Lee Jones Change-Id: I3acbb7fc23566c4108f15960c420384af52c2703 --- arch/x86/kvm/x86.c | 31 +++++++++++++++++++------------ 1 file changed, 19 insertions(+), 12 deletions(-) diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c index 4588f73bf59a..1a7c3405773e 100644 --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c @@ -7295,7 +7295,7 @@ int kvm_skip_emulated_instruction(struct kvm_vcpu *vcpu) } EXPORT_SYMBOL_GPL(kvm_skip_emulated_instruction); -static bool kvm_vcpu_check_breakpoint(struct kvm_vcpu *vcpu, int *r) +static bool kvm_vcpu_check_code_breakpoint(struct kvm_vcpu *vcpu, int *r) { if (unlikely(vcpu->guest_debug & KVM_GUESTDBG_USE_HW_BP) && (vcpu->arch.guest_debug_dr7 & DR7_BP_EN_MASK)) { @@ -7364,25 +7364,23 @@ static bool is_vmware_backdoor_opcode(struct x86_emulate_ctxt *ctxt) } /* - * Decode to be emulated instruction. Return EMULATION_OK if success. + * Decode an instruction for emulation. The caller is responsible for handling + * code breakpoints. Note, manually detecting code breakpoints is unnecessary + * (and wrong) when emulating on an intercepted fault-like exception[*], as + * code breakpoints have higher priority and thus have already been done by + * hardware. + * + * [*] Except #MC, which is higher priority, but KVM should never emulate in + * response to a machine check. */ int x86_decode_emulated_instruction(struct kvm_vcpu *vcpu, int emulation_type, void *insn, int insn_len) { - int r = EMULATION_OK; struct x86_emulate_ctxt *ctxt = vcpu->arch.emulate_ctxt; + int r; init_emulate_ctxt(vcpu); - /* - * We will reenter on the same instruction since we do not set - * complete_userspace_io. This does not handle watchpoints yet, - * those would be handled in the emulate_ops. - */ - if (!(emulation_type & EMULTYPE_SKIP) && - kvm_vcpu_check_breakpoint(vcpu, &r)) - return r; - ctxt->ud = emulation_type & EMULTYPE_TRAP_UD; r = x86_decode_insn(ctxt, insn, insn_len); @@ -7417,6 +7415,15 @@ int x86_emulate_instruction(struct kvm_vcpu *vcpu, gpa_t cr2_or_gpa, if (!(emulation_type & EMULTYPE_NO_DECODE)) { kvm_clear_exception_queue(vcpu); + /* + * Return immediately if RIP hits a code breakpoint, such #DBs + * are fault-like and are higher priority than any faults on + * the code fetch itself. + */ + if (!(emulation_type & EMULTYPE_SKIP) && + kvm_vcpu_check_code_breakpoint(vcpu, &r)) + return r; + r = x86_decode_emulated_instruction(vcpu, emulation_type, insn, insn_len); if (r != EMULATION_OK) { From 2bd9e6cddc51da4da03cfe65ef239919c019c2f1 Mon Sep 17 00:00:00 2001 From: David Howells Date: Thu, 26 May 2022 07:34:52 +0100 Subject: [PATCH 27/50] BACKPORT: pipe: Fix missing lock in pipe_resize_ring() commit 189b0ddc245139af81198d1a3637cac74f96e13a upstream. pipe_resize_ring() needs to take the pipe->rd_wait.lock spinlock to prevent post_one_notification() from trying to insert into the ring whilst the ring is being replaced. The occupancy check must be done after the lock is taken, and the lock must be taken after the new ring is allocated. The bug can lead to an oops looking something like: BUG: KASAN: use-after-free in post_one_notification.isra.0+0x62e/0x840 Read of size 4 at addr ffff88801cc72a70 by task poc/27196 ... Call Trace: post_one_notification.isra.0+0x62e/0x840 __post_watch_notification+0x3b7/0x650 key_create_or_update+0xb8b/0xd20 __do_sys_add_key+0x175/0x340 __x64_sys_add_key+0xbe/0x140 do_syscall_64+0x5c/0xc0 entry_SYSCALL_64_after_hwframe+0x44/0xae Reported by Selim Enes Karaduman @Enesdex working with Trend Micro Zero Day Initiative. Bug: 244395411 Fixes: c73be61cede5 ("pipe: Add general notification queue support") Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-17291 Signed-off-by: David Howells Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman Signed-off-by: Lee Jones Change-Id: I129164eb9dba557d5a4370f4eca124b9916774a6 --- fs/pipe.c | 31 ++++++++++++++++++------------- 1 file changed, 18 insertions(+), 13 deletions(-) diff --git a/fs/pipe.c b/fs/pipe.c index ea77cf5b519f..ea680351ea8d 100644 --- a/fs/pipe.c +++ b/fs/pipe.c @@ -1245,30 +1245,33 @@ unsigned int round_pipe_size(unsigned long size) /* * Resize the pipe ring to a number of slots. + * + * Note the pipe can be reduced in capacity, but only if the current + * occupancy doesn't exceed nr_slots; if it does, EBUSY will be + * returned instead. */ int pipe_resize_ring(struct pipe_inode_info *pipe, unsigned int nr_slots) { struct pipe_buffer *bufs; unsigned int head, tail, mask, n; - /* - * We can shrink the pipe, if arg is greater than the ring occupancy. - * Since we don't expect a lot of shrink+grow operations, just free and - * allocate again like we would do for growing. If the pipe currently - * contains more buffers than arg, then return busy. - */ - mask = pipe->ring_size - 1; - head = pipe->head; - tail = pipe->tail; - n = pipe_occupancy(pipe->head, pipe->tail); - if (nr_slots < n) - return -EBUSY; - bufs = kcalloc(nr_slots, sizeof(*bufs), GFP_KERNEL_ACCOUNT | __GFP_NOWARN); if (unlikely(!bufs)) return -ENOMEM; + spin_lock_irq(&pipe->rd_wait.lock); + mask = pipe->ring_size - 1; + head = pipe->head; + tail = pipe->tail; + + n = pipe_occupancy(head, tail); + if (nr_slots < n) { + spin_unlock_irq(&pipe->rd_wait.lock); + kfree(bufs); + return -EBUSY; + } + /* * The pipe array wraps around, so just start the new one at zero * and adjust the indices. @@ -1300,6 +1303,8 @@ int pipe_resize_ring(struct pipe_inode_info *pipe, unsigned int nr_slots) pipe->tail = tail; pipe->head = head; + spin_unlock_irq(&pipe->rd_wait.lock); + /* This might have made more room for writers */ wake_up_interruptible(&pipe->wr_wait); return 0; From c762f435c0e0c62bbfae478a55c89826f6a312cb Mon Sep 17 00:00:00 2001 From: Sarthak Kukreti Date: Tue, 31 May 2022 15:56:40 -0400 Subject: [PATCH 28/50] BACKPORT: dm verity: set DM_TARGET_IMMUTABLE feature flag commit 4caae58406f8ceb741603eee460d79bacca9b1b5 upstream. The device-mapper framework provides a mechanism to mark targets as immutable (and hence fail table reloads that try to change the target type). Add the DM_TARGET_IMMUTABLE flag to the dm-verity target's feature flags to prevent switching the verity target with a different target type. Bug: 234475629 Fixes: a4ffc152198e ("dm: add verity target") Cc: stable@vger.kernel.org Signed-off-by: Sarthak Kukreti Reviewed-by: Kees Cook Signed-off-by: Mike Snitzer Signed-off-by: Greg Kroah-Hartman Signed-off-by: Lee Jones Change-Id: Iaeec7fa3be98a646062439e4551f84242dacfb45 --- drivers/md/dm-verity-target.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/md/dm-verity-target.c b/drivers/md/dm-verity-target.c index 9d5c6dd5b756..2c355b58d078 100644 --- a/drivers/md/dm-verity-target.c +++ b/drivers/md/dm-verity-target.c @@ -1252,6 +1252,7 @@ static int verity_ctr(struct dm_target *ti, unsigned argc, char **argv) static struct target_type verity_target = { .name = "verity", .version = {1, 7, 0}, + .features = DM_TARGET_IMMUTABLE, .module = THIS_MODULE, .ctr = verity_ctr, .dtr = verity_dtr, From f50f24e781738c8e5aa9f285d8726202f33107d6 Mon Sep 17 00:00:00 2001 From: Peifeng Li Date: Tue, 13 Sep 2022 19:07:41 +0800 Subject: [PATCH 29/50] ANDROID: vendor_hooks: Add hooks for lookaround Add hooks for support lookaround in memory reclamation. - android_vh_test_clear_look_around_ref - android_vh_check_page_look_around_ref - android_vh_look_around_migrate_page - android_vh_look_around Bug: 241079328 Signed-off-by: Peifeng Li Change-Id: I9a606ae71d2f1303df3b02403b30bc8fdc9d06dd --- include/trace/hooks/mm.h | 11 +++++++++++ include/trace/hooks/vmscan.h | 3 +++ mm/migrate.c | 2 ++ mm/page_alloc.c | 2 ++ mm/rmap.c | 1 + mm/vmscan.c | 4 ++++ 6 files changed, 23 insertions(+) diff --git a/include/trace/hooks/mm.h b/include/trace/hooks/mm.h index 19a04b1aa4ff..dff62c101ba5 100644 --- a/include/trace/hooks/mm.h +++ b/include/trace/hooks/mm.h @@ -44,6 +44,7 @@ struct readahead_control; #endif /* __GENKSYMS__ */ struct cma; struct swap_slots_cache; +struct page_vma_mapped_walk; DECLARE_RESTRICTED_HOOK(android_rvh_set_skip_swapcache_flags, TP_PROTO(gfp_t *flags), @@ -268,6 +269,16 @@ DECLARE_HOOK(android_vh_alloc_pages_failure_bypass, TP_PROTO(gfp_t gfp_mask, int order, int alloc_flags, int migratetype, struct page **page), TP_ARGS(gfp_mask, order, alloc_flags, migratetype, page)); +DECLARE_HOOK(android_vh_test_clear_look_around_ref, + TP_PROTO(struct page *page), + TP_ARGS(page)); +DECLARE_HOOK(android_vh_look_around_migrate_page, + TP_PROTO(struct page *old_page, struct page *new_page), + TP_ARGS(old_page, new_page)); +DECLARE_HOOK(android_vh_look_around, + TP_PROTO(struct page_vma_mapped_walk *pvmw, struct page *page, + struct vm_area_struct *vma, int *referenced), + TP_ARGS(pvmw, page, vma, referenced)); /* macro versions of hooks are no longer required */ #endif /* _TRACE_HOOK_MM_H */ diff --git a/include/trace/hooks/vmscan.h b/include/trace/hooks/vmscan.h index ab54c20fef62..4bdb18c36ac6 100644 --- a/include/trace/hooks/vmscan.h +++ b/include/trace/hooks/vmscan.h @@ -50,6 +50,9 @@ DECLARE_HOOK(android_vh_inactive_is_low, DECLARE_HOOK(android_vh_snapshot_refaults, TP_PROTO(struct lruvec *target_lruvec), TP_ARGS(target_lruvec)); +DECLARE_HOOK(android_vh_check_page_look_around_ref, + TP_PROTO(struct page *page, int *skip), + TP_ARGS(page, skip)); #endif /* _TRACE_HOOK_VMSCAN_H */ /* This part must be outside protection */ #include diff --git a/mm/migrate.c b/mm/migrate.c index c4d9931d11c4..415dbbfae71b 100644 --- a/mm/migrate.c +++ b/mm/migrate.c @@ -56,6 +56,7 @@ #include #undef CREATE_TRACE_POINTS #include +#include #include "internal.h" @@ -606,6 +607,7 @@ void migrate_page_states(struct page *newpage, struct page *page) SetPageChecked(newpage); if (PageMappedToDisk(page)) SetPageMappedToDisk(newpage); + trace_android_vh_look_around_migrate_page(page, newpage); /* Move dirty on pages not done by migrate_page_move_mapping() */ if (PageDirty(page)) diff --git a/mm/page_alloc.c b/mm/page_alloc.c index 4696696a9b19..a493ea72dcda 100644 --- a/mm/page_alloc.c +++ b/mm/page_alloc.c @@ -72,6 +72,7 @@ #include #include #include +#include #include #include @@ -2403,6 +2404,7 @@ static void prep_new_page(struct page *page, unsigned int order, gfp_t gfp_flags set_page_pfmemalloc(page); else clear_page_pfmemalloc(page); + trace_android_vh_test_clear_look_around_ref(page); } /* diff --git a/mm/rmap.c b/mm/rmap.c index 2e62c1aa5139..d48141f90360 100644 --- a/mm/rmap.c +++ b/mm/rmap.c @@ -789,6 +789,7 @@ static bool page_referenced_one(struct page *page, struct vm_area_struct *vma, } if (pvmw.pte) { + trace_android_vh_look_around(&pvmw, page, vma, &referenced); if (ptep_clear_flush_young_notify(vma, address, pvmw.pte)) { /* diff --git a/mm/vmscan.c b/mm/vmscan.c index 2979893b9cf5..701595410992 100644 --- a/mm/vmscan.c +++ b/mm/vmscan.c @@ -1022,12 +1022,16 @@ static enum page_references page_check_references(struct page *page, unsigned long vm_flags; bool should_protect = false; bool trylock_fail = false; + int ret = 0; trace_android_vh_page_should_be_protected(page, &should_protect); if (unlikely(should_protect)) return PAGEREF_ACTIVATE; trace_android_vh_page_trylock_set(page); + trace_android_vh_check_page_look_around_ref(page, &ret); + if (ret) + return ret; referenced_ptes = page_referenced(page, 1, sc->target_mem_cgroup, &vm_flags); referenced_page = TestClearPageReferenced(page); From 9252f4d58ba8ae8633fed25b4ee2da401aa69086 Mon Sep 17 00:00:00 2001 From: liang zhang Date: Wed, 14 Sep 2022 15:31:32 +0800 Subject: [PATCH 30/50] ANDROID: transsion: Update the ABI xml and symbol list Leaf changes summary: 2 artifacts changed Changed leaf types summary: 0 leaf type changed Removed/Changed/Added functions summary: 0 Removed, 0 Changed, 1 Added functions Removed/Changed/Added variables summary: 0 Removed, 0 Changed, 1 Added variables 1 Added functions: [A] 'function int __traceiter_android_vh_ra_tuning_max_page(struct readahead_control *, unsigned long *)' 1 Added variables: [A] 'tracepoint __tracepoint_android_vh_ra_tuning_max_page' Bug: 246685233 Change-Id: I9f53bf1e2188f4626c92c2acf90f60a2c20ef3ca Signed-off-by: liang zhang --- android/abi_gki_aarch64.xml | 1129 +++++++++++++++++------------ android/abi_gki_aarch64_transsion | 4 +- 2 files changed, 665 insertions(+), 468 deletions(-) diff --git a/android/abi_gki_aarch64.xml b/android/abi_gki_aarch64.xml index 8584a30036bd..a1f2fe1b47b2 100644 --- a/android/abi_gki_aarch64.xml +++ b/android/abi_gki_aarch64.xml @@ -552,6 +552,7 @@ + @@ -6473,6 +6474,7 @@ + @@ -15127,6 +15129,89 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -21192,6 +21277,14 @@ + + + + + + + + @@ -40483,6 +40576,17 @@ + + + + + + + + + + + @@ -42282,6 +42386,7 @@ + @@ -54647,6 +54752,7 @@ + @@ -62539,7 +62645,65 @@ - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -67262,6 +67426,11 @@ + + + + + @@ -67746,7 +67915,14 @@ - + + + + + + + + @@ -83000,6 +83176,7 @@ + @@ -83536,6 +83713,14 @@ + + + + + + + + @@ -92848,6 +93033,7 @@ + @@ -95093,6 +95279,7 @@ + @@ -115084,6 +115271,7 @@ + @@ -115319,11 +115507,11 @@ - - - - - + + + + + @@ -115953,9 +116141,9 @@ - - - + + + @@ -116008,9 +116196,9 @@ - - - + + + @@ -116521,9 +116709,9 @@ - - - + + + @@ -117469,9 +117657,9 @@ - - - + + + @@ -117480,14 +117668,14 @@ - - - + + + - - - + + + @@ -117626,10 +117814,10 @@ - - - - + + + + @@ -117639,11 +117827,11 @@ - - - - - + + + + + @@ -117670,31 +117858,31 @@ - - - - - + + + + + - - - - - + + + + + - - - - + + + + - - - - - + + + + + @@ -117954,25 +118142,25 @@ - - - - - - - - + + + + + + + + - - - + + + - - - - + + + + @@ -117981,27 +118169,27 @@ - - - + + + - - - + + + - - - - - + + + + + - - - - + + + + @@ -118061,11 +118249,11 @@ - - - - - + + + + + @@ -118075,12 +118263,12 @@ - - - - - - + + + + + + @@ -118090,9 +118278,9 @@ - - - + + + @@ -118101,22 +118289,22 @@ - - - - - - - - + + + + + + + + - - - - - - + + + + + + @@ -118149,10 +118337,10 @@ - - - - + + + + @@ -118161,22 +118349,22 @@ - - - + + + - - - - + + + + - - - - - + + + + + @@ -118191,17 +118379,17 @@ - - - - + + + + - - - - - + + + + + @@ -118302,19 +118490,19 @@ - - - - - + + + + + - - - - - - + + + + + + @@ -118333,10 +118521,10 @@ - - - - + + + + @@ -118347,17 +118535,17 @@ - - - - - + + + + + - - - - + + + + @@ -118429,11 +118617,11 @@ - - - - - + + + + + @@ -118458,9 +118646,9 @@ - - - + + + @@ -118470,58 +118658,58 @@ - - - + + + - - - - + + + + - - - - + + + + - - - + + + - - - + + + - - - + + + - - - - + + + + - - - - - - - - + + + + + + + + - - - - + + + + @@ -118582,10 +118770,10 @@ - - - - + + + + @@ -118596,17 +118784,17 @@ - - - - - + + + + + - - - - + + + + @@ -118625,19 +118813,19 @@ - - - - - - - + + + + + + + - - - - + + + + @@ -118663,6 +118851,12 @@ + + + + + + @@ -118687,9 +118881,9 @@ - - - + + + @@ -118698,14 +118892,14 @@ - - - - - - - - + + + + + + + + @@ -118764,16 +118958,16 @@ - - - - + + + + - - - - + + + + @@ -118880,9 +119074,9 @@ - - - + + + @@ -118906,9 +119100,9 @@ - - - + + + @@ -118917,10 +119111,10 @@ - - - - + + + + @@ -118928,10 +119122,10 @@ - - - - + + + + @@ -118955,10 +119149,10 @@ - - - - + + + + @@ -118984,15 +119178,15 @@ - - - + + + - - - - + + + + @@ -119025,12 +119219,12 @@ - - - - - - + + + + + + @@ -119152,19 +119346,19 @@ - - - - + + + + - - - - - - - + + + + + + + @@ -119209,9 +119403,9 @@ - - - + + + @@ -119688,10 +119882,10 @@ - + - - + + @@ -119718,16 +119912,16 @@ - + - + - - - - + + + + @@ -119766,14 +119960,14 @@ - - - + + + - - - - + + + + @@ -119783,29 +119977,29 @@ - + - + - + - - + + - + - - - + + + - - + + @@ -119822,16 +120016,16 @@ - - + + - + - - + + @@ -119844,21 +120038,21 @@ - + - + - - - - - - - - - + + + + + + + + + @@ -119868,30 +120062,31 @@ - + - + - - + + - - + + + - + - + @@ -119909,8 +120104,8 @@ - - + + @@ -119930,27 +120125,27 @@ - + - + - + - + - + - - - + + + @@ -119958,7 +120153,7 @@ - + @@ -119977,16 +120172,16 @@ - - + + - - + + @@ -120457,7 +120652,7 @@ - + @@ -120553,9 +120748,9 @@ - - - + + + @@ -120679,9 +120874,9 @@ - - - + + + @@ -121934,11 +122129,11 @@ - - - - - + + + + + @@ -129187,10 +129382,10 @@ - - - - + + + + @@ -129833,14 +130028,14 @@ - - - + + + - - - + + + @@ -130676,10 +130871,10 @@ - - - - + + + + @@ -130788,8 +130983,8 @@ - - + + @@ -132190,7 +132385,7 @@ - + @@ -133156,8 +133351,8 @@ - - + + @@ -134563,30 +134758,30 @@ - - - + + + - - - - - + + + + + - - - + + + - - - - - - - + + + + + + + @@ -136583,10 +136778,10 @@ - - - - + + + + @@ -136595,14 +136790,14 @@ - - - - + + + + - - + + @@ -136619,8 +136814,8 @@ - - + + @@ -138763,8 +138958,8 @@ - - + + @@ -139070,8 +139265,8 @@ - - + + @@ -141560,11 +141755,11 @@ - + - - + + @@ -143352,9 +143547,9 @@ - - - + + + @@ -144514,11 +144709,11 @@ - - - - - + + + + + @@ -145161,42 +145356,42 @@ - - - + + + - - - + + + - - + + - - + + - - + + - - - - - + + + + + - - - + + + - - + + @@ -148498,19 +148693,19 @@ - - - - - - + + + + + + - - - - - + + + + + diff --git a/android/abi_gki_aarch64_transsion b/android/abi_gki_aarch64_transsion index 648b5a445e8b..c38d29451ee4 100644 --- a/android/abi_gki_aarch64_transsion +++ b/android/abi_gki_aarch64_transsion @@ -34,6 +34,7 @@ __traceiter_android_vh_alloc_si __traceiter_android_vh_free_pages __traceiter_android_vh_set_shmem_page_flag + __traceiter_android_vh_ra_tuning_max_page __tracepoint_android_vh_handle_pte_fault_end __tracepoint_android_vh_cow_user_page __tracepoint_android_vh_swapin_add_anon_rmap @@ -57,4 +58,5 @@ __tracepoint_android_vh_si_swapinfo __tracepoint_android_vh_alloc_si __tracepoint_android_vh_free_pages - __tracepoint_android_vh_set_shmem_page_flag \ No newline at end of file + __tracepoint_android_vh_set_shmem_page_flag + __tracepoint_android_vh_ra_tuning_max_page From feedd14d1450f63ff39eda2b4c1482283e489c31 Mon Sep 17 00:00:00 2001 From: liang zhang Date: Wed, 14 Sep 2022 10:17:41 +0000 Subject: [PATCH 31/50] Revert "Revert "ANDROID: add for tuning readahead size"" This reverts commit 98e5fb34d1137987cb2551d79082dc4c794795d4. Reason for revert: Bug: 246685233 Change-Id: Ic18a59bd77040fe58cc1e09678a707d3802f2bb4 Signed-off-by: liang zhang --- drivers/android/vendor_hooks.c | 1 + include/trace/hooks/mm.h | 3 +++ mm/readahead.c | 2 ++ 3 files changed, 6 insertions(+) diff --git a/drivers/android/vendor_hooks.c b/drivers/android/vendor_hooks.c index 7a1ffec55caf..ccc2c869d5d0 100644 --- a/drivers/android/vendor_hooks.c +++ b/drivers/android/vendor_hooks.c @@ -428,6 +428,7 @@ EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_binder_has_work_ilocked); EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_binder_read_done); EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_handle_tlb_conf); EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_shrink_node_memcgs); +EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_ra_tuning_max_page); EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_handle_pte_fault_end); EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_cow_user_page); EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_swapin_add_anon_rmap); diff --git a/include/trace/hooks/mm.h b/include/trace/hooks/mm.h index dff62c101ba5..b1c0f440f8ff 100644 --- a/include/trace/hooks/mm.h +++ b/include/trace/hooks/mm.h @@ -190,6 +190,9 @@ DECLARE_HOOK(android_vh_pcplist_add_cma_pages_bypass, DECLARE_HOOK(android_vh_subpage_dma_contig_alloc, TP_PROTO(bool *allow_subpage_alloc, struct device *dev, size_t *size), TP_ARGS(allow_subpage_alloc, dev, size)); +DECLARE_HOOK(android_vh_ra_tuning_max_page, + TP_PROTO(struct readahead_control *ractl, unsigned long *max_page), + TP_ARGS(ractl, max_page)); DECLARE_HOOK(android_vh_handle_pte_fault_end, TP_PROTO(struct vm_fault *vmf, unsigned long highest_memmap_pfn), TP_ARGS(vmf, highest_memmap_pfn)); diff --git a/mm/readahead.c b/mm/readahead.c index a6bfa987a04a..a95364c99487 100644 --- a/mm/readahead.c +++ b/mm/readahead.c @@ -459,6 +459,8 @@ static void ondemand_readahead(struct readahead_control *ractl, if (req_size > max_pages && bdi->io_pages > max_pages) max_pages = min(req_size, bdi->io_pages); + trace_android_vh_ra_tuning_max_page(ractl, &max_pages); + /* * start of file */ From db2516ff46e29d44068514a666c41aa3959e9bcb Mon Sep 17 00:00:00 2001 From: Peifeng Li Date: Thu, 15 Sep 2022 17:47:49 +0800 Subject: [PATCH 32/50] ANDROID: vendor_hooks: Add hooks for lookaround Add hooks for support lookaround in memory reclamation. add drivers/android/vendor_hooks.c for export tracepoint symbol Bug: 241079328 Signed-off-by: Peifeng Li Change-Id: Ia6e9fa0ae5708e88fa498c63cf63aad7c55e5f98 --- drivers/android/vendor_hooks.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/android/vendor_hooks.c b/drivers/android/vendor_hooks.c index ccc2c869d5d0..9224b7bab3bd 100644 --- a/drivers/android/vendor_hooks.c +++ b/drivers/android/vendor_hooks.c @@ -456,3 +456,7 @@ EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_set_shmem_page_flag); EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_sched_pelt_multiplier); EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_alloc_pages_reclaim_bypass); EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_alloc_pages_failure_bypass); +EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_check_page_look_around_ref); +EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_look_around); +EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_look_around_migrate_page); +EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_test_clear_look_around_ref); From d915364e92446d1b9dbd51fa274f1698d9906cba Mon Sep 17 00:00:00 2001 From: Peifeng Li Date: Fri, 16 Sep 2022 09:45:43 +0800 Subject: [PATCH 33/50] ANDROID: GKI: Update symbols to symbol list Update symbols to symbol list externed by oem modules. Leaf changes summary: 8 artifacts changed Changed leaf types summary: 0 leaf type changed Removed/Changed/Added functions summary: 0 Removed, 0 Changed, 4 Added functions Removed/Changed/Added variables summary: 0 Removed, 0 Changed, 4 Added variables 4 Added functions: [A] 'function int __traceiter_android_vh_check_page_look_around_ref(void*, page*, int*)' [A] 'function int __traceiter_android_vh_look_around(void*, page_vma_mapped_walk*, page*, vm_area_struct*, int*)' [A] 'function int __traceiter_android_vh_look_around_migrate_page(void*, page*, page*)' [A] 'function int __traceiter_android_vh_test_clear_look_around_ref(void*, page*)' 4 Added variables: [A] 'tracepoint __tracepoint_android_vh_check_page_look_around_ref' [A] 'tracepoint __tracepoint_android_vh_look_around' [A] 'tracepoint __tracepoint_android_vh_look_around_migrate_page' [A] 'tracepoint __tracepoint_android_vh_test_clear_look_around_ref' Bug: 193384408 Signed-off-by: Peifeng Li Change-Id: I81225e1a5ab6d1495983ac1df1d43e2dbdfc0600 --- android/abi_gki_aarch64.xml | 510 ++++++++++++++-------------------- android/abi_gki_aarch64_oplus | 9 + 2 files changed, 210 insertions(+), 309 deletions(-) diff --git a/android/abi_gki_aarch64.xml b/android/abi_gki_aarch64.xml index a1f2fe1b47b2..c70a270b833a 100644 --- a/android/abi_gki_aarch64.xml +++ b/android/abi_gki_aarch64.xml @@ -436,6 +436,7 @@ + @@ -517,6 +518,8 @@ + + @@ -612,6 +615,7 @@ + @@ -6351,6 +6355,7 @@ + @@ -6436,6 +6441,8 @@ + + @@ -6543,6 +6550,7 @@ + @@ -15129,89 +15137,6 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - @@ -21277,14 +21202,6 @@ - - - - - - - - @@ -40576,17 +40493,6 @@ - - - - - - - - - - - @@ -42386,7 +42292,6 @@ - @@ -44169,7 +44074,23 @@ - + + + + + + + + + + + + + + + + + @@ -48460,6 +48381,7 @@ + @@ -53343,6 +53265,13 @@ + + + + + + + @@ -54752,7 +54681,6 @@ - @@ -62645,65 +62573,7 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + @@ -65976,6 +65846,13 @@ + + + + + + + @@ -67426,11 +67303,6 @@ - - - - - @@ -67915,14 +67787,7 @@ - - - - - - - - + @@ -83176,7 +83041,6 @@ - @@ -83713,14 +83577,6 @@ - - - - - - - - @@ -90525,6 +90381,7 @@ + @@ -93033,7 +92890,6 @@ - @@ -94310,6 +94166,7 @@ + @@ -95279,7 +95136,6 @@ - @@ -98322,6 +98178,7 @@ + @@ -102196,6 +102053,12 @@ + + + + + + @@ -110432,6 +110295,7 @@ + @@ -115271,7 +115135,6 @@ - @@ -117814,10 +117677,10 @@ - - - - + + + + @@ -117872,17 +117735,17 @@ - - - - + + + + - - - - - + + + + + @@ -118118,6 +117981,12 @@ + + + + + + @@ -118169,27 +118038,27 @@ - - - - - - + - + - - - - - - + + + + + + + + + + + @@ -118299,12 +118168,12 @@ - - - - - - + + + + + + @@ -118379,17 +118248,17 @@ - - - - + + + + - - - - - + + + + + @@ -118497,12 +118366,12 @@ - - - - - - + + + + + + @@ -118521,10 +118390,10 @@ - - - - + + + + @@ -118542,10 +118411,10 @@ - - - - + + + + @@ -118636,6 +118505,20 @@ + + + + + + + + + + + + + + @@ -118690,10 +118573,10 @@ - - - - + + + + @@ -118770,10 +118653,10 @@ - - - - + + + + @@ -118784,11 +118667,11 @@ - - - - - + + + + + @@ -118851,10 +118734,10 @@ - - - - + + + + @@ -118881,9 +118764,9 @@ - - - + + + @@ -119074,9 +118957,9 @@ - - - + + + @@ -119149,10 +119032,10 @@ - - - - + + + + @@ -119178,15 +119061,15 @@ - - - + + + - - - - + + + + @@ -119201,6 +119084,11 @@ + + + + + @@ -119346,10 +119234,10 @@ - - - - + + + + @@ -119403,9 +119291,9 @@ - - - + + + @@ -119912,7 +119800,7 @@ - + @@ -119920,8 +119808,8 @@ - - + + @@ -119956,6 +119844,7 @@ + @@ -119964,10 +119853,10 @@ - - - - + + + + @@ -119985,7 +119874,7 @@ - + @@ -119998,8 +119887,8 @@ - - + + @@ -120017,15 +119906,15 @@ - + - + - + @@ -120041,6 +119930,8 @@ + + @@ -120050,7 +119941,7 @@ - + @@ -120064,9 +119955,9 @@ - + - + @@ -120079,12 +119970,12 @@ - + - + @@ -120125,7 +120016,7 @@ - + @@ -120138,16 +120029,17 @@ - + - - + + + @@ -120172,7 +120064,7 @@ - + @@ -120181,7 +120073,7 @@ - + diff --git a/android/abi_gki_aarch64_oplus b/android/abi_gki_aarch64_oplus index fc17ce17fc3a..a117542bfc3a 100644 --- a/android/abi_gki_aarch64_oplus +++ b/android/abi_gki_aarch64_oplus @@ -2784,6 +2784,7 @@ __traceiter_android_vh_cpu_idle_enter __traceiter_android_vh_cpu_idle_exit __traceiter_android_vh_cpu_up + __traceiter_android_vh_check_page_look_around_ref __traceiter_android_vh_do_futex __traceiter_android_vh_do_send_sig_info __traceiter_android_vh_drain_all_pages_bypass @@ -2817,6 +2818,8 @@ __traceiter_android_vh_killed_process __traceiter_android_vh_kmalloc_slab __traceiter_android_vh_logbuf + __traceiter_android_vh_look_around + __traceiter_android_vh_look_around_migrate_page __traceiter_android_vh_mem_cgroup_alloc __traceiter_android_vh_mem_cgroup_css_offline __traceiter_android_vh_mem_cgroup_css_online @@ -2918,6 +2921,7 @@ __traceiter_suspend_resume __traceiter_task_newtask __traceiter_task_rename + __traceiter_android_vh_test_clear_look_around_ref __traceiter_xhci_urb_giveback __tracepoint_android_rvh_account_irq __tracepoint_android_rvh_after_enqueue_task @@ -3024,6 +3028,7 @@ __tracepoint_android_vh_cpu_idle_enter __tracepoint_android_vh_cpu_idle_exit __tracepoint_android_vh_cpu_up + __tracepoint_android_vh_check_page_look_around_ref __tracepoint_android_vh_do_futex __tracepoint_android_vh_do_send_sig_info __tracepoint_android_vh_drain_all_pages_bypass @@ -3057,6 +3062,8 @@ __tracepoint_android_vh_killed_process __tracepoint_android_vh_kmalloc_slab __tracepoint_android_vh_logbuf + __tracepoint_android_vh_look_around + __tracepoint_android_vh_look_around_migrate_page __tracepoint_android_vh_mem_cgroup_alloc __tracepoint_android_vh_mem_cgroup_css_offline __tracepoint_android_vh_mem_cgroup_css_online @@ -3130,6 +3137,7 @@ __tracepoint_android_vh_tune_inactive_ratio __tracepoint_android_vh_tune_scan_type __tracepoint_android_vh_tune_swappiness + __tracepoint_android_vh_test_clear_look_around_ref __tracepoint_android_vh_ufs_compl_command __tracepoint_android_vh_ufs_send_command __tracepoint_android_vh_ufs_send_tm_command @@ -3624,3 +3632,4 @@ xhci_ring_cmd_db xhci_ring_free xhci_trb_virt_to_dma + zero_pfn From bcf6dddd9746bc5ea3a4af2d9dee6977f3d2d318 Mon Sep 17 00:00:00 2001 From: Tadeusz Struk Date: Tue, 13 Sep 2022 10:56:54 -0700 Subject: [PATCH 34/50] ANDROID: incfs: Add check for ATTR_KILL_SUID and ATTR_MODE in incfs_setattr Add an explicite check for ATTR_KILL_SUID and ATTR_MODE in incfs_setattr. Both of these attributes can not be set at the same time, otherwise notify_change() function will check it and invoke BUG(), crashing the system. Bug: 243394930 Signed-off-by: Tadeusz Struk Change-Id: I91080d68efbd62f1441e20a5c02feef3d1b06e4e --- fs/incfs/vfs.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/fs/incfs/vfs.c b/fs/incfs/vfs.c index 776640451f6f..342998f24090 100644 --- a/fs/incfs/vfs.c +++ b/fs/incfs/vfs.c @@ -1592,6 +1592,10 @@ static int incfs_setattr(struct dentry *dentry, struct iattr *ia) if (ia->ia_valid & ATTR_SIZE) return -EINVAL; + if ((ia->ia_valid & (ATTR_KILL_SUID|ATTR_KILL_SGID)) && + (ia->ia_valid & ATTR_MODE)) + return -EINVAL; + if (!di) return -EINVAL; backing_dentry = di->backing_path.dentry; From 06b301069fde6f28b458bb5b95e7863a5387710c Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Tue, 20 Sep 2022 16:57:30 +0200 Subject: [PATCH 35/50] ANDROID: remove unused xhci_get_endpoint_address export In commit 731d2da95e41 ("ANDROID: usb: host: export xhci symbols for ring management"), many xhci symbols were exported, but xhci_get_endpoint_address was never actually used by any external modules, so remove the export as it is unneeded. Bug: 183761108 Bug: 203756332 Cc: Daehwan Jung Fixes: 731d2da95e41 ("ANDROID: usb: host: export xhci symbols for ring management") Signed-off-by: Greg Kroah-Hartman Change-Id: I08aab7192297c832f5a9dd559a016e6ff1140b86 --- drivers/usb/host/xhci.c | 1 - 1 file changed, 1 deletion(-) diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c index 07017eb4727a..f17d9dce4593 100644 --- a/drivers/usb/host/xhci.c +++ b/drivers/usb/host/xhci.c @@ -1334,7 +1334,6 @@ unsigned int xhci_get_endpoint_address(unsigned int ep_index) unsigned int direction = ep_index % 2 ? USB_DIR_OUT : USB_DIR_IN; return direction | number; } -EXPORT_SYMBOL_GPL(xhci_get_endpoint_address); /* Find the flag for this endpoint (for use in the control context). Use the * endpoint index to create a bitmask. The slot context is bit 0, endpoint 0 is From 2fc96f32ee7bbd8437e9ab002c0f51174187ef39 Mon Sep 17 00:00:00 2001 From: Weichao Guo Date: Wed, 7 Sep 2022 10:38:48 +0800 Subject: [PATCH 36/50] FROMLIST: f2fs: let FI_OPU_WRITE override FADVISE_COLD_BIT Cold files may be fragmented due to SSR, defragment is needed as sequential reads are dominant scenarios of these files. FI_OPU_WRITE should override FADVISE_COLD_BIT to avoid defragment fails. Bug: 246903585 Signed-off-by: Weichao Guo Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim Signed-off-by: Weichao Guo Link: https://lore.kernel.org/all/YxlTQ3H+PPKcvpyc@google.com/T/ Change-Id: I52ab86a15ec275772c5356bfc985803bbdde4408 --- fs/f2fs/data.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c index b0ad5f156619..3bac45d7a94c 100644 --- a/fs/f2fs/data.c +++ b/fs/f2fs/data.c @@ -2524,7 +2524,7 @@ bool f2fs_should_update_inplace(struct inode *inode, struct f2fs_io_info *fio) return true; /* if this is cold file, we should overwrite to avoid fragmentation */ - if (file_is_cold(inode)) + if (file_is_cold(inode) && !is_inode_flag_set(inode, FI_OPU_WRITE)) return true; return check_inplace_update_policy(inode, fio); From 9072e986bd823530949f0100a2032f42e89cdd8d Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Tue, 20 Sep 2022 17:02:42 +0200 Subject: [PATCH 37/50] Revert "ANDROID: Export functions to be used with dma_map_ops in modules" The symbols exported by this commit were never used by external modules, so just remove them as the exports are not needed (and cause merge problems at times.) Bug: 151050914 Bug: 203756332 Cc: Suren Baghdasaryan Signed-off-by: Greg Kroah-Hartman Change-Id: I926ad3cc732ec1db97fc4711962bc3902105dd25 --- kernel/dma/direct.c | 3 --- kernel/dma/ops_helpers.c | 2 -- 2 files changed, 5 deletions(-) diff --git a/kernel/dma/direct.c b/kernel/dma/direct.c index 8ca84610d4d4..73a03f8628be 100644 --- a/kernel/dma/direct.c +++ b/kernel/dma/direct.c @@ -43,7 +43,6 @@ u64 dma_direct_get_required_mask(struct device *dev) return (1ULL << (fls64(max_dma) - 1)) * 2 - 1; } -EXPORT_SYMBOL_GPL(dma_direct_get_required_mask); static gfp_t dma_direct_optimal_gfp_mask(struct device *dev, u64 dma_mask, u64 *phys_limit) @@ -316,7 +315,6 @@ struct page *dma_direct_alloc_pages(struct device *dev, size_t size, dma_free_contiguous(dev, page, size); return NULL; } -EXPORT_SYMBOL_GPL(dma_direct_alloc); void dma_direct_free_pages(struct device *dev, size_t size, struct page *page, dma_addr_t dma_addr, @@ -335,7 +333,6 @@ void dma_direct_free_pages(struct device *dev, size_t size, dma_free_contiguous(dev, page, size); } -EXPORT_SYMBOL_GPL(dma_direct_free); #if defined(CONFIG_ARCH_HAS_SYNC_DMA_FOR_DEVICE) || \ defined(CONFIG_SWIOTLB) diff --git a/kernel/dma/ops_helpers.c b/kernel/dma/ops_helpers.c index e28e1e17eaf5..af4a6ef48ce0 100644 --- a/kernel/dma/ops_helpers.c +++ b/kernel/dma/ops_helpers.c @@ -27,7 +27,6 @@ int dma_common_get_sgtable(struct device *dev, struct sg_table *sgt, sg_set_page(sgt->sgl, page, PAGE_ALIGN(size), 0); return ret; } -EXPORT_SYMBOL_GPL(dma_common_get_sgtable); /* * Create userspace mapping for the DMA-coherent memory. @@ -58,7 +57,6 @@ int dma_common_mmap(struct device *dev, struct vm_area_struct *vma, return -ENXIO; #endif /* CONFIG_MMU */ } -EXPORT_SYMBOL_GPL(dma_common_mmap); struct page *dma_common_alloc_pages(struct device *dev, size_t size, dma_addr_t *dma_handle, enum dma_data_direction dir, gfp_t gfp) From cc51dcbc60c4492d68e3b075ff4d8bd61729dae4 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Wed, 21 Sep 2022 16:35:26 +0200 Subject: [PATCH 38/50] Revert "ANDROID: vendor_hooks:vendor hook for __alloc_pages_slowpath." This reverts commit dec2f52d08d2d5b36fffafd489457ce4ac1c530e. The hooks android_vh_alloc_pages_reclaim_bypass and android_vh_alloc_pages_failure_bypass are not used by any vendor, so remove it to help with merge issues with future LTS releases. If this is needed by any real user, it can easily be reverted to add it back and then the symbol should be added to the abi list at the same time to prevent it from being removed again later. Bug: 203756332 Bug: 243629905 Cc: xiaofeng Signed-off-by: Greg Kroah-Hartman Change-Id: Id313f6971e0b5437fcfc1ed3f8d4c56706217133 --- drivers/android/vendor_hooks.c | 2 -- include/trace/hooks/mm.h | 8 -------- mm/page_alloc.c | 11 ----------- 3 files changed, 21 deletions(-) diff --git a/drivers/android/vendor_hooks.c b/drivers/android/vendor_hooks.c index 9224b7bab3bd..ea1b1cf1468e 100644 --- a/drivers/android/vendor_hooks.c +++ b/drivers/android/vendor_hooks.c @@ -454,8 +454,6 @@ EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_alloc_si); EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_free_pages); EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_set_shmem_page_flag); EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_sched_pelt_multiplier); -EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_alloc_pages_reclaim_bypass); -EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_alloc_pages_failure_bypass); EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_check_page_look_around_ref); EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_look_around); EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_look_around_migrate_page); diff --git a/include/trace/hooks/mm.h b/include/trace/hooks/mm.h index b1c0f440f8ff..37ce86164bc8 100644 --- a/include/trace/hooks/mm.h +++ b/include/trace/hooks/mm.h @@ -264,14 +264,6 @@ DECLARE_HOOK(android_vh_set_shmem_page_flag, DECLARE_HOOK(android_vh_remove_vmalloc_stack, TP_PROTO(struct vm_struct *vm), TP_ARGS(vm)); -DECLARE_HOOK(android_vh_alloc_pages_reclaim_bypass, - TP_PROTO(gfp_t gfp_mask, int order, int alloc_flags, - int migratetype, struct page **page), - TP_ARGS(gfp_mask, order, alloc_flags, migratetype, page)); -DECLARE_HOOK(android_vh_alloc_pages_failure_bypass, - TP_PROTO(gfp_t gfp_mask, int order, int alloc_flags, - int migratetype, struct page **page), - TP_ARGS(gfp_mask, order, alloc_flags, migratetype, page)); DECLARE_HOOK(android_vh_test_clear_look_around_ref, TP_PROTO(struct page *page), TP_ARGS(page)); diff --git a/mm/page_alloc.c b/mm/page_alloc.c index a493ea72dcda..9bb27db5be15 100644 --- a/mm/page_alloc.c +++ b/mm/page_alloc.c @@ -4926,12 +4926,6 @@ __alloc_pages_slowpath(gfp_t gfp_mask, unsigned int order, if (current->flags & PF_MEMALLOC) goto nopage; - trace_android_vh_alloc_pages_reclaim_bypass(gfp_mask, order, - alloc_flags, ac->migratetype, &page); - - if (page) - goto got_pg; - /* Try direct reclaim and then allocating */ page = __alloc_pages_direct_reclaim(gfp_mask, order, alloc_flags, ac, &did_some_progress); @@ -5039,11 +5033,6 @@ __alloc_pages_slowpath(gfp_t gfp_mask, unsigned int order, goto retry; } fail: - trace_android_vh_alloc_pages_failure_bypass(gfp_mask, order, - alloc_flags, ac->migratetype, &page); - if (page) - goto got_pg; - warn_alloc(gfp_mask, ac->nodemask, "page allocation failure: order:%u", order); got_pg: From 72b1f9fd160533f90001244e2bcd853d418f2a9e Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Wed, 21 Sep 2022 18:10:03 +0200 Subject: [PATCH 39/50] Revert "ANDROID: arm64: debug-monitors: export break hook APIs" This reverts commit 210d9157b60b708fbb1bb094e70e367eec19c1e9. Well, most of that commit, all except the register_kernel_break_hook export, as that was actually being used. All of the other symbol exports were not being used at all, so they did not need to be exported. Bug: 169899018 Bug: 157965270 Cc: Jonglin Lee Signed-off-by: Greg Kroah-Hartman Change-Id: Ib00df5822901ed81f4ec5147e63e37589eeee793 --- arch/arm64/kernel/debug-monitors.c | 3 --- 1 file changed, 3 deletions(-) diff --git a/arch/arm64/kernel/debug-monitors.c b/arch/arm64/kernel/debug-monitors.c index 852abc57c2ce..d7f904cd005b 100644 --- a/arch/arm64/kernel/debug-monitors.c +++ b/arch/arm64/kernel/debug-monitors.c @@ -283,13 +283,11 @@ void register_user_break_hook(struct break_hook *hook) { register_debug_hook(&hook->node, &user_break_hook); } -EXPORT_SYMBOL_GPL(register_user_break_hook); void unregister_user_break_hook(struct break_hook *hook) { unregister_debug_hook(&hook->node); } -EXPORT_SYMBOL_GPL(unregister_user_break_hook); void register_kernel_break_hook(struct break_hook *hook) { @@ -301,7 +299,6 @@ void unregister_kernel_break_hook(struct break_hook *hook) { unregister_debug_hook(&hook->node); } -EXPORT_SYMBOL_GPL(unregister_kernel_break_hook); static int call_break_hook(struct pt_regs *regs, unsigned int esr) { From 2c625a20c068978580a89fca1c3c7909ecddf5df Mon Sep 17 00:00:00 2001 From: Udipto Goswami Date: Tue, 20 Sep 2022 10:10:18 +0530 Subject: [PATCH 40/50] ANDROID: ABI: Add extcon_get_property_capability symbol Leaf changes summary: 1 artifact changed Changed leaf types summary: 0 leaf type changed Removed/Changed/Added functions summary: 0 Removed, 0 Changed, 1 Added function Removed/Changed/Added variables summary: 0 Removed, 0 Changed, 0 Added variable 1 Added function: [A] 'function int extcon_get_property_capability(extcon_dev*, unsigned int, unsigned int)' Bug: 247757521 Change-Id: Ic62fe3dfb3b1f88bbe4196c43dd32e1dbbebf92d Signed-off-by: Udipto Goswami --- android/abi_gki_aarch64.xml | 100 ++++++++++++++++++++++++++++++++++- android/abi_gki_aarch64_qcom | 1 + 2 files changed, 100 insertions(+), 1 deletion(-) diff --git a/android/abi_gki_aarch64.xml b/android/abi_gki_aarch64.xml index c70a270b833a..b45d6bcb2096 100644 --- a/android/abi_gki_aarch64.xml +++ b/android/abi_gki_aarch64.xml @@ -2495,6 +2495,7 @@ + @@ -15137,6 +15138,89 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -67787,7 +67871,14 @@ - + + + + + + + + @@ -92890,6 +92981,7 @@ + @@ -129591,6 +129683,12 @@ + + + + + + diff --git a/android/abi_gki_aarch64_qcom b/android/abi_gki_aarch64_qcom index a73748d1b9e4..7941c74c90a7 100644 --- a/android/abi_gki_aarch64_qcom +++ b/android/abi_gki_aarch64_qcom @@ -881,6 +881,7 @@ extcon_get_edev_name extcon_get_extcon_dev extcon_get_property + extcon_get_property_capability extcon_get_state extcon_register_notifier extcon_set_state_sync From 5c5b7a4da67ca427d09d4225d798d7b83f6498f8 Mon Sep 17 00:00:00 2001 From: Peifeng Li Date: Thu, 22 Sep 2022 11:36:30 +0800 Subject: [PATCH 41/50] ANDROID: vendor_hook: rename the the name of hooks Renamed trace_android_vh_record_percpu_rwsem_lock_starttime to trace_android_vh_record_pcpu_rwsem_starttime. Because the orignal name is too long, which results to the compile-err of .ko that uses the symbol: ERROR: modpost: too long symbol "__tracepoint_android_vh_record_percpu_rwsem_lock_starttime" There is not any users of the the orignal hooks so that it is safe to rename it. Bug: 241191475 Signed-off-by: Peifeng Li Change-Id: Ie246a933414db5e9e28a65a4c280fae3a1cbefe3 --- drivers/android/vendor_hooks.c | 2 +- include/linux/percpu-rwsem.h | 8 ++++---- include/trace/hooks/dtask.h | 2 +- kernel/locking/percpu-rwsem.c | 14 +++++++------- 4 files changed, 13 insertions(+), 13 deletions(-) diff --git a/drivers/android/vendor_hooks.c b/drivers/android/vendor_hooks.c index ea1b1cf1468e..0790c299d2be 100644 --- a/drivers/android/vendor_hooks.c +++ b/drivers/android/vendor_hooks.c @@ -267,7 +267,7 @@ EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_revert_creds); EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_record_mutex_lock_starttime); EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_record_rtmutex_lock_starttime); EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_record_rwsem_lock_starttime); -EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_record_percpu_rwsem_lock_starttime); +EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_record_pcpu_rwsem_starttime); EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_set_memory_x); EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_set_memory_nx); EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_set_memory_ro); diff --git a/include/linux/percpu-rwsem.h b/include/linux/percpu-rwsem.h index 2f33e0a6e1a9..92d172cfce06 100644 --- a/include/linux/percpu-rwsem.h +++ b/include/linux/percpu-rwsem.h @@ -9,7 +9,7 @@ #include #include -void _trace_android_vh_record_percpu_rwsem_lock_starttime( +void _trace_android_vh_record_pcpu_rwsem_starttime( struct task_struct *tsk, unsigned long settime); struct percpu_rw_semaphore { @@ -76,7 +76,7 @@ static inline void percpu_down_read(struct percpu_rw_semaphore *sem) * bleeding the critical section out. */ preempt_enable(); - _trace_android_vh_record_percpu_rwsem_lock_starttime(current, jiffies); + _trace_android_vh_record_pcpu_rwsem_starttime(current, jiffies); } static inline bool percpu_down_read_trylock(struct percpu_rw_semaphore *sem) @@ -98,7 +98,7 @@ static inline bool percpu_down_read_trylock(struct percpu_rw_semaphore *sem) */ if (ret) { - _trace_android_vh_record_percpu_rwsem_lock_starttime(current, jiffies); + _trace_android_vh_record_pcpu_rwsem_starttime(current, jiffies); rwsem_acquire_read(&sem->dep_map, 0, 1, _RET_IP_); } @@ -107,7 +107,7 @@ static inline bool percpu_down_read_trylock(struct percpu_rw_semaphore *sem) static inline void percpu_up_read(struct percpu_rw_semaphore *sem) { - _trace_android_vh_record_percpu_rwsem_lock_starttime(current, 0); + _trace_android_vh_record_pcpu_rwsem_starttime(current, 0); rwsem_release(&sem->dep_map, _RET_IP_); preempt_disable(); diff --git a/include/trace/hooks/dtask.h b/include/trace/hooks/dtask.h index 208edf8ac265..956e8421755c 100644 --- a/include/trace/hooks/dtask.h +++ b/include/trace/hooks/dtask.h @@ -77,7 +77,7 @@ DECLARE_HOOK(android_vh_record_rtmutex_lock_starttime, DECLARE_HOOK(android_vh_record_rwsem_lock_starttime, TP_PROTO(struct task_struct *tsk, unsigned long settime_jiffies), TP_ARGS(tsk, settime_jiffies)); -DECLARE_HOOK(android_vh_record_percpu_rwsem_lock_starttime, +DECLARE_HOOK(android_vh_record_pcpu_rwsem_starttime, TP_PROTO(struct task_struct *tsk, unsigned long settime_jiffies), TP_ARGS(tsk, settime_jiffies)); diff --git a/kernel/locking/percpu-rwsem.c b/kernel/locking/percpu-rwsem.c index 4a9e7aafd7f4..c8a474aa1b3b 100644 --- a/kernel/locking/percpu-rwsem.c +++ b/kernel/locking/percpu-rwsem.c @@ -13,17 +13,17 @@ #include /* - * trace_android_vh_record_percpu_rwsem_lock_starttime is called in + * trace_android_vh_record_pcpu_rwsem_starttime is called in * include/linux/percpu-rwsem.h by including include/hooks/dtask.h, which * will result to build-err. So we create - * func:_trace_android_vh_record_percpu_rwsem_lock_starttime for percpu-rwsem.h to call. + * func:_trace_android_vh_record_pcpu_rwsem_starttime for percpu-rwsem.h to call. */ -void _trace_android_vh_record_percpu_rwsem_lock_starttime(struct task_struct *tsk, +void _trace_android_vh_record_pcpu_rwsem_starttime(struct task_struct *tsk, unsigned long settime) { - trace_android_vh_record_percpu_rwsem_lock_starttime(tsk, settime); + trace_android_vh_record_pcpu_rwsem_starttime(tsk, settime); } -EXPORT_SYMBOL_GPL(_trace_android_vh_record_percpu_rwsem_lock_starttime); +EXPORT_SYMBOL_GPL(_trace_android_vh_record_pcpu_rwsem_starttime); int __percpu_init_rwsem(struct percpu_rw_semaphore *sem, const char *name, struct lock_class_key *key) @@ -252,13 +252,13 @@ void percpu_down_write(struct percpu_rw_semaphore *sem) /* Wait for all active readers to complete. */ rcuwait_wait_event(&sem->writer, readers_active_check(sem), TASK_UNINTERRUPTIBLE); - trace_android_vh_record_percpu_rwsem_lock_starttime(current, jiffies); + trace_android_vh_record_pcpu_rwsem_starttime(current, jiffies); } EXPORT_SYMBOL_GPL(percpu_down_write); void percpu_up_write(struct percpu_rw_semaphore *sem) { - trace_android_vh_record_percpu_rwsem_lock_starttime(current, 0); + trace_android_vh_record_pcpu_rwsem_starttime(current, 0); rwsem_release(&sem->dep_map, _RET_IP_); /* From ecf5583fc791e5ce03d90f3ca81b829b5a637f17 Mon Sep 17 00:00:00 2001 From: Peifeng Li Date: Thu, 22 Sep 2022 12:01:53 +0800 Subject: [PATCH 42/50] ANDROID: GKI: Update symbols to symbol list Update symbols to symbol list externed by oem modules. Leaf changes summary: 4 artifacts changed Changed leaf types summary: 0 leaf type changed Removed/Changed/Added functions summary: 1 Removed, 0 Changed, 1 Added function Removed/Changed/Added variables summary: 1 Removed, 0 Changed, 1 Added variable 1 Removed function: [D] 'function int __traceiter_android_vh_record_percpu_rwsem_lock_starttime(void*, task_struct*, unsigned long int)' 1 Added function: [A] 'function int __traceiter_android_vh_record_pcpu_rwsem_starttime(void*, task_struct*, unsigned long int)' 1 Removed variable: [D] 'tracepoint __tracepoint_android_vh_record_percpu_rwsem_lock_starttime' 1 Added variable: [A] 'tracepoint __tracepoint_android_vh_record_pcpu_rwsem_starttime' Bug: 193384408 Signed-off-by: Peifeng Li Change-Id: Ie70a216e9815198f82b00c7a960123737e0b45de --- android/abi_gki_aarch64.xml | 99 +++++++++++------------------------ android/abi_gki_aarch64_oplus | 4 +- 2 files changed, 32 insertions(+), 71 deletions(-) diff --git a/android/abi_gki_aarch64.xml b/android/abi_gki_aarch64.xml index b45d6bcb2096..52fedee14385 100644 --- a/android/abi_gki_aarch64.xml +++ b/android/abi_gki_aarch64.xml @@ -557,7 +557,7 @@ - + @@ -6484,7 +6484,7 @@ - + @@ -44158,23 +44158,7 @@ - - - - - - - - - - - - - - - - - + @@ -48465,7 +48449,6 @@ - @@ -53349,13 +53332,6 @@ - - - - - - - @@ -65930,13 +65906,6 @@ - - - - - - - @@ -90472,7 +90441,6 @@ - @@ -102145,12 +102113,6 @@ - - - - - - @@ -110387,7 +110349,6 @@ - @@ -118838,7 +118799,7 @@ - + @@ -120064,7 +120025,7 @@ - + @@ -148493,15 +148454,15 @@ - - - - + + + + - - - + + + @@ -148525,19 +148486,19 @@ - - - + + + - - - - + + + + @@ -148550,9 +148511,9 @@ - - - + + + @@ -148574,9 +148535,9 @@ - - - + + + @@ -148599,9 +148560,9 @@ - - - + + + @@ -148651,8 +148612,8 @@ - - + + diff --git a/android/abi_gki_aarch64_oplus b/android/abi_gki_aarch64_oplus index a117542bfc3a..92b08a855be8 100644 --- a/android/abi_gki_aarch64_oplus +++ b/android/abi_gki_aarch64_oplus @@ -2853,7 +2853,7 @@ __traceiter_android_vh_record_mutex_lock_starttime __traceiter_android_vh_record_rtmutex_lock_starttime __traceiter_android_vh_record_rwsem_lock_starttime - __traceiter_android_vh_record_percpu_rwsem_lock_starttime + __traceiter_android_vh_record_pcpu_rwsem_starttime __traceiter_android_vh_rmqueue __traceiter_android_vh_rwsem_init __traceiter_android_vh_rwsem_mark_wake_readers @@ -3097,7 +3097,7 @@ __tracepoint_android_vh_record_mutex_lock_starttime __tracepoint_android_vh_record_rtmutex_lock_starttime __tracepoint_android_vh_record_rwsem_lock_starttime - __tracepoint_android_vh_record_percpu_rwsem_lock_starttime + __tracepoint_android_vh_record_pcpu_rwsem_starttime __tracepoint_android_vh_rmqueue __tracepoint_android_vh_rwsem_init __tracepoint_android_vh_rwsem_mark_wake_readers From b71060e6eb512d7ec56f00f0597d083a00c55c80 Mon Sep 17 00:00:00 2001 From: Hongyu Jin Date: Fri, 1 Apr 2022 19:55:27 +0800 Subject: [PATCH 43/50] BACKPORT: erofs: fix use-after-free of on-stack io[] The root cause is the race as follows: Thread #1 Thread #2(irq ctx) z_erofs_runqueue() struct z_erofs_decompressqueue io_A[]; submit bio A z_erofs_decompress_kickoff(,,1) z_erofs_decompressqueue_endio(bio A) z_erofs_decompress_kickoff(,,-1) spin_lock_irqsave() atomic_add_return() io_wait_event() -> pending_bios is already 0 [end of function] wake_up_locked(io_A[]) // crash Referenced backtrace in kernel 5.4: [ 10.129422] Unable to handle kernel paging request at virtual address eb0454a4 [ 10.364157] CPU: 0 PID: 709 Comm: getprop Tainted: G WC O 5.4.147-ab09225 #1 [ 11.556325] [] (__wake_up_common) from [] (__wake_up_locked+0x40/0x48) [ 11.565487] [] (__wake_up_locked) from [] (z_erofs_vle_unzip_kickoff+0x6c/0xc0) [ 11.575438] [] (z_erofs_vle_unzip_kickoff) from [] (z_erofs_vle_read_endio+0x16c/0x17c) [ 11.586082] [] (z_erofs_vle_read_endio) from [] (clone_endio+0xb4/0x1d0) [ 11.595428] [] (clone_endio) from [] (blk_update_request+0x150/0x4dc) [ 11.604516] [] (blk_update_request) from [] (mmc_blk_cqe_complete_rq+0x144/0x15c) [ 11.614640] [] (mmc_blk_cqe_complete_rq) from [] (blk_done_softirq+0xb0/0xcc) [ 11.624419] [] (blk_done_softirq) from [] (__do_softirq+0x184/0x56c) [ 11.633419] [] (__do_softirq) from [] (irq_exit+0xd4/0x138) [ 11.641640] [] (irq_exit) from [] (__handle_domain_irq+0x94/0xd0) [ 11.650381] [] (__handle_domain_irq) from [] (gic_handle_irq+0x50/0xd4) [ 11.659641] [] (gic_handle_irq) from [] (__irq_svc+0x70/0xb0) Bug: 246657836 Change-Id: Ieebf1c5abb48723538d05a5e65b5179a382dab3f (cherry picked from commit 60b30050116c0351b90154044345c1b53ae1f323) [Hongyu: Resolved minor conflict in fs/erofs/zdata.c ] Signed-off-by: Hongyu Jin Reviewed-by: Gao Xiang Reviewed-by: Chao Yu Link: https://lore.kernel.org/r/20220401115527.4935-1-hongyu.jin.cn@gmail.com Signed-off-by: Gao Xiang --- fs/erofs/zdata.c | 12 ++++-------- fs/erofs/zdata.h | 2 +- 2 files changed, 5 insertions(+), 9 deletions(-) diff --git a/fs/erofs/zdata.c b/fs/erofs/zdata.c index 7fc79c47798a..7596db389201 100644 --- a/fs/erofs/zdata.c +++ b/fs/erofs/zdata.c @@ -789,12 +789,9 @@ static void z_erofs_decompress_kickoff(struct z_erofs_decompressqueue *io, /* wake up the caller thread for sync decompression */ if (sync) { - unsigned long flags; - - spin_lock_irqsave(&io->u.wait.lock, flags); if (!atomic_add_return(bios, &io->pending_bios)) - wake_up_locked(&io->u.wait); - spin_unlock_irqrestore(&io->u.wait.lock, flags); + complete(&io->u.done); + return; } @@ -1214,7 +1211,7 @@ jobqueue_init(struct super_block *sb, } else { fg_out: q = fgq; - init_waitqueue_head(&fgq->u.wait); + init_completion(&fgq->u.done); atomic_set(&fgq->pending_bios, 0); } q->sb = sb; @@ -1377,8 +1374,7 @@ static void z_erofs_runqueue(struct super_block *sb, return; /* wait until all bios are completed */ - io_wait_event(io[JQ_SUBMIT].u.wait, - !atomic_read(&io[JQ_SUBMIT].pending_bios)); + wait_for_completion_io(&io[JQ_SUBMIT].u.done); /* handle synchronous decompress queue in the caller context */ z_erofs_decompress_queue(&io[JQ_SUBMIT], pagepool); diff --git a/fs/erofs/zdata.h b/fs/erofs/zdata.h index 942ee69dff6a..60bf396164ec 100644 --- a/fs/erofs/zdata.h +++ b/fs/erofs/zdata.h @@ -90,7 +90,7 @@ struct z_erofs_decompressqueue { z_erofs_next_pcluster_t head; union { - wait_queue_head_t wait; + struct completion done; struct work_struct work; } u; }; From b9ac329a8390d5446611fb4b9b2bdd5a7cd7c0ca Mon Sep 17 00:00:00 2001 From: Todd Kjos Date: Wed, 21 Sep 2022 21:36:04 +0000 Subject: [PATCH 44/50] ANDROID: force struct selinux_state to be defined in KMI struct selinux_state is defined in security/selinux/include/security.h, however libabigail is not finding its definition based on the instantiation of the hooks, so force it to be defined by defining a dummy exported symbol. Since blk_mq_alloc_data is defined in a subsystem-private header, create a new vendor_hooks.c file in security/selinux to define the dummy symbol. Bug: 233047575 Signed-off-by: Todd Kjos Change-Id: Ia505c76db2eed339b3815073f847b500535cc954 --- android/abi_gki_aarch64_type_visibility | 4 ++++ build.config.gki.aarch64 | 1 + drivers/android/vendor_hooks.c | 2 -- security/selinux/Makefile | 2 ++ security/selinux/vendor_hooks.c | 22 ++++++++++++++++++++++ 5 files changed, 29 insertions(+), 2 deletions(-) create mode 100644 android/abi_gki_aarch64_type_visibility create mode 100644 security/selinux/vendor_hooks.c diff --git a/android/abi_gki_aarch64_type_visibility b/android/abi_gki_aarch64_type_visibility new file mode 100644 index 000000000000..88a3c8813346 --- /dev/null +++ b/android/abi_gki_aarch64_type_visibility @@ -0,0 +1,4 @@ +[abi_symbol_list] + +# for type visibility + GKI_struct_selinux_state diff --git a/build.config.gki.aarch64 b/build.config.gki.aarch64 index 9e70748400a1..70f439aacafe 100644 --- a/build.config.gki.aarch64 +++ b/build.config.gki.aarch64 @@ -10,6 +10,7 @@ ABI_DEFINITION=android/abi_gki_aarch64.xml TIDY_ABI=1 KMI_SYMBOL_LIST=android/abi_gki_aarch64 ADDITIONAL_KMI_SYMBOL_LISTS=" +android/abi_gki_aarch64_type_visibility android/abi_gki_aarch64_core android/abi_gki_aarch64_db845c android/abi_gki_aarch64_exynos diff --git a/drivers/android/vendor_hooks.c b/drivers/android/vendor_hooks.c index 0790c299d2be..1ea002e1f230 100644 --- a/drivers/android/vendor_hooks.c +++ b/drivers/android/vendor_hooks.c @@ -53,7 +53,6 @@ #include #include #include -#include #include #include #include @@ -336,7 +335,6 @@ EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_dequeue_task_fair); EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_sched_stat_runtime_rt); EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_prepare_update_load_avg_se); EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_finish_update_load_avg_se); -EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_selinux_is_initialized); EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_tune_inactive_ratio); EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_update_topology_flags_workfn); EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_of_i2c_get_board_info); diff --git a/security/selinux/Makefile b/security/selinux/Makefile index 4d8e0e8adf0b..8e8102b558b4 100644 --- a/security/selinux/Makefile +++ b/security/selinux/Makefile @@ -10,6 +10,8 @@ selinux-y := avc.o hooks.o selinuxfs.o netlink.o nlmsgtab.o netif.o \ ss/ebitmap.o ss/hashtab.o ss/symtab.o ss/sidtab.o ss/avtab.o \ ss/policydb.o ss/services.o ss/conditional.o ss/mls.o ss/context.o +selinux-$(CONFIG_ANDROID_VENDOR_HOOKS) += vendor_hooks.o + selinux-$(CONFIG_SECURITY_NETWORK_XFRM) += xfrm.o selinux-$(CONFIG_NETLABEL) += netlabel.o diff --git a/security/selinux/vendor_hooks.c b/security/selinux/vendor_hooks.c new file mode 100644 index 000000000000..3802e8233289 --- /dev/null +++ b/security/selinux/vendor_hooks.c @@ -0,0 +1,22 @@ +// SPDX-License-Identifier: GPL-2.0-only +/* vendor_hook.c + * + * Copyright 2022 Google LLC + */ + +#ifndef __GENKSYMS__ +#include "security.h" +#endif + +#define CREATE_TRACE_POINTS +#include +#include +#include + +EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_selinux_is_initialized); + +/* + * For type visibility + */ +struct selinux_state *GKI_struct_selinux_state; +EXPORT_SYMBOL_GPL(GKI_struct_selinux_state); From c6f7a0ebd8fc4ba7ded80a9cb69dd1015e1075ee Mon Sep 17 00:00:00 2001 From: Todd Kjos Date: Wed, 21 Sep 2022 21:48:21 +0000 Subject: [PATCH 45/50] ANDROID: make sure all types for hooks are defined in KMI There are 2 remaining types directly referenced by vendor hooks that were not fully-defined in the KMI: struct gic_chip_data : defined in include/linux/irqchip/arm-gic-v3.h struct swap_slots_cache : defined include/linux/swap_slots.h libabigail is not finding definitions based on the instantiation of the hooks, so force them to be defined by defining dummy exported symbols. Update XML with the now visible definitions Bug: 233047575 Signed-off-by: Todd Kjos Change-Id: I521b2a596e1d7361d0f44a87ffe330186896b9f8 --- android/abi_gki_aarch64.xml | 609 +++++++++++------------- android/abi_gki_aarch64_type_visibility | 2 + drivers/android/vendor_hooks.c | 13 + 3 files changed, 287 insertions(+), 337 deletions(-) diff --git a/android/abi_gki_aarch64.xml b/android/abi_gki_aarch64.xml index 52fedee14385..5fe18ac581fc 100644 --- a/android/abi_gki_aarch64.xml +++ b/android/abi_gki_aarch64.xml @@ -6198,6 +6198,9 @@ + + + @@ -7344,17 +7347,7 @@ - - - - - - - - - - - + @@ -9471,14 +9464,6 @@ - - - - - - - - @@ -10765,11 +10750,6 @@ - - - - - @@ -15138,89 +15118,6 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - @@ -15329,11 +15226,6 @@ - - - - - @@ -15757,7 +15649,6 @@ - @@ -17043,14 +16934,6 @@ - - - - - - - - @@ -18598,7 +18481,6 @@ - @@ -18913,7 +18795,6 @@ - @@ -19766,6 +19647,29 @@ + + + + + + + + + + + + + + + + + + + + + + + @@ -21274,10 +21178,6 @@ - - - - @@ -21769,11 +21669,6 @@ - - - - - @@ -24738,14 +24633,6 @@ - - - - - - - - @@ -25018,10 +24905,6 @@ - - - - @@ -25299,11 +25182,6 @@ - - - - - @@ -25553,6 +25431,7 @@ + @@ -25963,7 +25842,6 @@ - @@ -31960,7 +31838,6 @@ - @@ -32340,7 +32217,6 @@ - @@ -32645,7 +32521,41 @@ - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -35157,10 +35067,14 @@ + + + + @@ -40420,26 +40334,6 @@ - - - - - - - - - - - - - - - - - - - - @@ -43997,6 +43891,7 @@ + @@ -44156,9 +44051,59 @@ - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - + + + + + + + + + + + + + + + + + @@ -45519,6 +45464,7 @@ + @@ -48449,6 +48395,7 @@ + @@ -50722,7 +50669,6 @@ - @@ -53189,7 +53135,6 @@ - @@ -53332,6 +53277,13 @@ + + + + + + + @@ -53954,6 +53906,7 @@ + @@ -54119,17 +54072,6 @@ - - - - - - - - - - - @@ -56656,6 +56598,7 @@ + @@ -60176,6 +60119,7 @@ + @@ -61725,11 +61669,6 @@ - - - - - @@ -61804,20 +61743,6 @@ - - - - - - - - - - - - - - @@ -65906,6 +65831,13 @@ + + + + + + + @@ -67840,14 +67772,7 @@ - - - - - - - - + @@ -70848,7 +70773,6 @@ - @@ -72710,12 +72634,6 @@ - - - - - - @@ -73432,6 +73350,7 @@ + @@ -73843,7 +73762,32 @@ - + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -78497,6 +78441,7 @@ + @@ -78881,17 +78826,6 @@ - - - - - - - - - - - @@ -79368,6 +79302,7 @@ + @@ -83637,6 +83572,38 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -85385,26 +85352,6 @@ - - - - - - - - - - - - - - - - - - - - @@ -90350,7 +90297,6 @@ - @@ -90441,6 +90387,7 @@ + @@ -91046,6 +90993,7 @@ + @@ -92526,6 +92474,7 @@ + @@ -92949,7 +92898,6 @@ - @@ -94454,6 +94402,7 @@ + @@ -94910,6 +94859,7 @@ + @@ -101851,26 +101801,6 @@ - - - - - - - - - - - - - - - - - - - - @@ -102113,6 +102043,12 @@ + + + + + + @@ -103128,7 +103064,6 @@ - @@ -105040,6 +104975,7 @@ + @@ -109026,11 +108962,6 @@ - - - - - @@ -110349,6 +110280,7 @@ + @@ -115395,6 +115327,9 @@ + + + @@ -115423,11 +115358,11 @@ - - - - - + + + + + @@ -116057,9 +115992,9 @@ - - - + + + @@ -116112,9 +116047,9 @@ - - - + + + @@ -116625,9 +116560,9 @@ - - - + + + @@ -118558,18 +118493,18 @@ - - - - - - + + + + + + - - - - + + + + @@ -119137,9 +119072,9 @@ - - - + + + @@ -119983,8 +119918,8 @@ - - + + @@ -120092,7 +120027,7 @@ - + @@ -120693,9 +120628,9 @@ - - - + + + @@ -120819,9 +120754,9 @@ - - - + + + @@ -129979,14 +129914,14 @@ - - - + + + - - - + + + @@ -130934,8 +130869,8 @@ - - + + @@ -136741,14 +136676,14 @@ - - - - + + + + - - + + @@ -139321,8 +139256,8 @@ - - + + @@ -141706,11 +141641,11 @@ - + - - + + diff --git a/android/abi_gki_aarch64_type_visibility b/android/abi_gki_aarch64_type_visibility index 88a3c8813346..705bf5574222 100644 --- a/android/abi_gki_aarch64_type_visibility +++ b/android/abi_gki_aarch64_type_visibility @@ -2,3 +2,5 @@ # for type visibility GKI_struct_selinux_state + GKI_struct_gic_chip_data + GKI_struct_swap_slots_cache diff --git a/drivers/android/vendor_hooks.c b/drivers/android/vendor_hooks.c index 1ea002e1f230..c9b54b2fa509 100644 --- a/drivers/android/vendor_hooks.c +++ b/drivers/android/vendor_hooks.c @@ -456,3 +456,16 @@ EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_check_page_look_around_ref); EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_look_around); EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_look_around_migrate_page); EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_test_clear_look_around_ref); + +/* + * For type visibility + */ +#ifdef CONFIG_ARM64 +#include +const struct gic_chip_data *GKI_struct_gic_chip_data; +EXPORT_SYMBOL_GPL(GKI_struct_gic_chip_data); +#endif + +#include +const struct swap_slots_cache *GKI_struct_swap_slots_cache; +EXPORT_SYMBOL_GPL(GKI_struct_swap_slots_cache); From 4135365b5d883c52f7aab9762d7a2aa6b5ec1945 Mon Sep 17 00:00:00 2001 From: Wei Liu Date: Fri, 23 Sep 2022 15:38:06 +0800 Subject: [PATCH 46/50] ANDROID: GKI: Update symbols to symbol list Update symbols to symbol list externed by oppo network group. Leaf changes summary: 4 artifacts changed Changed leaf types summary: 0 leaf type changed Removed/Changed/Added functions summary: 0 Removed, 0 Changed, 0 Added function Removed/Changed/Added variables summary: 0 Removed, 0 Changed, 4 Added variables 4 Added variables: [A] 'tracepoint __tracepoint_net_dev_queue' [A] 'tracepoint __tracepoint_net_dev_xmit' [A] 'tracepoint __tracepoint_netif_receive_skb' [A] 'tracepoint __tracepoint_netif_rx' Bug: 193384408 Signed-off-by: Wei Liu Change-Id: I11fce7b80fd50f6c01b488f2a660f80179485d93 --- android/abi_gki_aarch64.xml | 8 ++++++++ android/abi_gki_aarch64_oplus | 4 ++++ net/core/net-traces.c | 6 ++++++ 3 files changed, 18 insertions(+) diff --git a/android/abi_gki_aarch64.xml b/android/abi_gki_aarch64.xml index 5fe18ac581fc..dee2bfb4bd31 100644 --- a/android/abi_gki_aarch64.xml +++ b/android/abi_gki_aarch64.xml @@ -6627,6 +6627,10 @@ + + + + @@ -120100,6 +120104,10 @@ + + + + diff --git a/android/abi_gki_aarch64_oplus b/android/abi_gki_aarch64_oplus index 92b08a855be8..384bdbfa612b 100644 --- a/android/abi_gki_aarch64_oplus +++ b/android/abi_gki_aarch64_oplus @@ -3150,6 +3150,10 @@ __tracepoint_ipi_entry __tracepoint_ipi_raise __tracepoint_irq_handler_entry + __tracepoint_net_dev_queue + __tracepoint_net_dev_xmit + __tracepoint_netif_receive_skb + __tracepoint_netif_rx __tracepoint_pelt_se_tp tracepoint_probe_register tracepoint_probe_register_prio diff --git a/net/core/net-traces.c b/net/core/net-traces.c index 465362a9b55d..ffeb3a682859 100644 --- a/net/core/net-traces.c +++ b/net/core/net-traces.c @@ -58,3 +58,9 @@ EXPORT_TRACEPOINT_SYMBOL_GPL(kfree_skb); EXPORT_TRACEPOINT_SYMBOL_GPL(napi_poll); EXPORT_TRACEPOINT_SYMBOL_GPL(tcp_send_reset); + +EXPORT_TRACEPOINT_SYMBOL_GPL(net_dev_queue); +EXPORT_TRACEPOINT_SYMBOL_GPL(net_dev_xmit); +EXPORT_TRACEPOINT_SYMBOL_GPL(netif_receive_skb); +EXPORT_TRACEPOINT_SYMBOL_GPL(netif_rx); + From 2d8afda40e31b23d2981fe273d32b01b9c87b6d9 Mon Sep 17 00:00:00 2001 From: Krishna Kurapati Date: Sat, 27 Aug 2022 08:45:10 +0530 Subject: [PATCH 47/50] UPSTREAM: usb: gadget: mass_storage: Fix cdrom data transfers on MAC-OS During cdrom emulation, the response to read_toc command must contain the cdrom address as the number of sectors (2048 byte sized blocks) represented either as an absolute value (when MSF bit is '0') or in terms of PMin/PSec/PFrame (when MSF bit is set to '1'). Incase of cdrom, the fsg_lun_open call sets the sector size to 2048 bytes. When MAC OS sends a read_toc request with MSF set to '1', the store_cdrom_address assumes that the address being provided is the LUN size represented in 512 byte sized blocks instead of 2048. It tries to modify the address further to convert it to 2048 byte sized blocks and store it in MSF format. This results in data transfer failures as the cdrom address being provided in the read_toc response is incorrect. Fixes: 3f565a363cee ("usb: gadget: storage: adapt logic block size to bound block devices") Cc: stable@vger.kernel.org Acked-by: Alan Stern Signed-off-by: Krishna Kurapati Link: https://lore.kernel.org/r/1661570110-19127-1-git-send-email-quic_kriskura@quicinc.com Signed-off-by: Greg Kroah-Hartman (cherry picked from commit 9d4dc16ec71bd6368548e9743223e449b4377fc7) Bug: 245221519 Change-Id: I50687e4dfc2b26d35adce50e51b54d28fb85967e Signed-off-by: Krishna Kurapati --- drivers/usb/gadget/function/storage_common.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/usb/gadget/function/storage_common.c b/drivers/usb/gadget/function/storage_common.c index 2451e45ada6e..87bfe87daa86 100644 --- a/drivers/usb/gadget/function/storage_common.c +++ b/drivers/usb/gadget/function/storage_common.c @@ -294,8 +294,10 @@ EXPORT_SYMBOL_GPL(fsg_lun_fsync_sub); void store_cdrom_address(u8 *dest, int msf, u32 addr) { if (msf) { - /* Convert to Minutes-Seconds-Frames */ - addr >>= 2; /* Convert to 2048-byte frames */ + /* + * Convert to Minutes-Seconds-Frames. + * Sector size is already set to 2048 bytes. + */ addr += 2*75; /* Lead-in occupies 2 seconds */ dest[3] = addr % 75; /* Frames */ addr /= 75; From 6d04d8ce9083ea681202f4dc679f8dc4975b6f69 Mon Sep 17 00:00:00 2001 From: Pavankumar Kondeti Date: Mon, 26 Sep 2022 18:36:10 +0530 Subject: [PATCH 48/50] ANDROID: vendor_hooks: Allow shared pages reclaim via MADV_PAGEOUT Add a hook in madvise_cold_or_pageout_pte_range() to allow vendor modules to influence the shared pages reclaim. Bug: 242678506 Change-Id: I269a385b59f7291c2e96478674bb3d05f94584cb Signed-off-by: Pavankumar Kondeti --- drivers/android/vendor_hooks.c | 1 + include/trace/hooks/mm.h | 3 +++ mm/madvise.c | 4 +++- 3 files changed, 7 insertions(+), 1 deletion(-) diff --git a/drivers/android/vendor_hooks.c b/drivers/android/vendor_hooks.c index c9b54b2fa509..ff62cc7c921b 100644 --- a/drivers/android/vendor_hooks.c +++ b/drivers/android/vendor_hooks.c @@ -441,6 +441,7 @@ EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_drain_slots_cache_cpu); EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_alloc_swap_slot_cache); EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_free_swap_slot); EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_get_swap_page); +EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_madvise_cold_or_pageout); EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_page_isolated_for_reclaim); EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_inactive_is_low); EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_snapshot_refaults); diff --git a/include/trace/hooks/mm.h b/include/trace/hooks/mm.h index 37ce86164bc8..358a89380982 100644 --- a/include/trace/hooks/mm.h +++ b/include/trace/hooks/mm.h @@ -237,6 +237,9 @@ DECLARE_HOOK(android_vh_get_swap_page, TP_PROTO(struct page *page, swp_entry_t *entry, struct swap_slots_cache *cache, bool *found), TP_ARGS(page, entry, cache, found)); +DECLARE_HOOK(android_vh_madvise_cold_or_pageout, + TP_PROTO(struct vm_area_struct *vma, bool *allow_shared), + TP_ARGS(vma, allow_shared)); DECLARE_HOOK(android_vh_page_isolated_for_reclaim, TP_PROTO(struct mm_struct *mm, struct page *page), TP_ARGS(mm, page)); diff --git a/mm/madvise.c b/mm/madvise.c index db54a747d6f3..2758648a60f6 100644 --- a/mm/madvise.c +++ b/mm/madvise.c @@ -319,10 +319,12 @@ static int madvise_cold_or_pageout_pte_range(pmd_t *pmd, spinlock_t *ptl; struct page *page = NULL; LIST_HEAD(page_list); + bool allow_shared = false; if (fatal_signal_pending(current)) return -EINTR; + trace_android_vh_madvise_cold_or_pageout(vma, &allow_shared); #ifdef CONFIG_TRANSPARENT_HUGEPAGE if (pmd_trans_huge(*pmd)) { pmd_t orig_pmd; @@ -438,7 +440,7 @@ static int madvise_cold_or_pageout_pte_range(pmd_t *pmd, } /* Do not interfere with other mappings of this page */ - if (page_mapcount(page) != 1) + if (!allow_shared && page_mapcount(page) != 1) continue; VM_BUG_ON_PAGE(PageTransCompound(page), page); From d195c9f2bbc28f560b04a37b82f9893a771e4ade Mon Sep 17 00:00:00 2001 From: Todd Kjos Date: Wed, 28 Sep 2022 16:59:24 +0000 Subject: [PATCH 49/50] ANDROID: force struct page_vma_mapped_walk to be defined in KMI A vendor hook was recently defined that references struct page_vma_mapped_walk, but it is only forward-declared and therefore not fully defined in the KMI. Add inclusion of linux/rmap.h to vender_hooks.c to add the full definition. Bug: 233047575 Signed-off-by: Todd Kjos Change-Id: I3bbaca92a70e4464e370e987ae4154de19c4fee2 --- android/abi_gki_aarch64.xml | 167 ++++++++++++++++++++------------- drivers/android/vendor_hooks.c | 4 + 2 files changed, 108 insertions(+), 63 deletions(-) diff --git a/android/abi_gki_aarch64.xml b/android/abi_gki_aarch64.xml index 9df93bbe19c7..b69cd3d6656d 100644 --- a/android/abi_gki_aarch64.xml +++ b/android/abi_gki_aarch64.xml @@ -83107,6 +83107,9 @@ + + + @@ -92067,6 +92070,9 @@ + + + @@ -98314,7 +98320,29 @@ - + + + + + + + + + + + + + + + + + + + + + + + @@ -105303,7 +105331,20 @@ - + + + + + + + + + + + + + + @@ -115459,9 +115500,9 @@ - + - + @@ -117797,10 +117838,10 @@ - - - - + + + + @@ -117855,10 +117896,10 @@ - - - - + + + + @@ -118368,10 +118409,10 @@ - - - - + + + + @@ -118531,10 +118572,10 @@ - - - - + + + + @@ -118625,18 +118666,18 @@ - - - - - - + + + + + + - - - - + + + + @@ -118773,10 +118814,10 @@ - - - - + + + + @@ -118884,9 +118925,9 @@ - - - + + + @@ -119077,9 +119118,9 @@ - - - + + + @@ -119152,10 +119193,10 @@ - - - - + + + + @@ -119204,9 +119245,9 @@ - - - + + + @@ -119354,10 +119395,10 @@ - - - - + + + + @@ -119920,7 +119961,7 @@ - + @@ -119928,7 +119969,7 @@ - + @@ -120007,7 +120048,7 @@ - + @@ -120034,7 +120075,7 @@ - + @@ -120050,8 +120091,8 @@ - - + + @@ -120075,7 +120116,7 @@ - + @@ -120095,7 +120136,7 @@ - + @@ -120136,7 +120177,7 @@ - + @@ -120149,7 +120190,7 @@ - + @@ -120159,7 +120200,7 @@ - + @@ -120184,7 +120225,7 @@ - + diff --git a/drivers/android/vendor_hooks.c b/drivers/android/vendor_hooks.c index ff62cc7c921b..d4352dfeb34d 100644 --- a/drivers/android/vendor_hooks.c +++ b/drivers/android/vendor_hooks.c @@ -6,6 +6,10 @@ * Copyright 2020 Google LLC */ +#ifndef __GENKSYMS__ +#include +#endif + #define CREATE_TRACE_POINTS #include #include From 5545801f5c8307aabe2c7153ca35dc85879f13a1 Mon Sep 17 00:00:00 2001 From: Pavankumar Kondeti Date: Wed, 28 Sep 2022 10:08:15 +0530 Subject: [PATCH 50/50] ANDROID: abi_gki_aarch64_qcom: Add android_vh_madvise_cold_or_pageout Add android_vh_madvise_cold_or_pageout symbol so that vendor modules can influence the shared pages reclaim behavior. Leaf changes summary: 1 artifact changed Changed leaf types summary: 0 leaf type changed Removed/Changed/Added functions summary: 0 Removed, 0 Changed, 0 Added function Removed/Changed/Added variables summary: 0 Removed, 0 Changed, 1 Added variable 1 Added variable: [A] 'tracepoint __tracepoint_android_vh_madvise_cold_or_pageout' Bug: 242678506 Change-Id: I6180578876858543eb3b71da45b6f75d40dfc008 Signed-off-by: Pavankumar Kondeti --- android/abi_gki_aarch64.xml | 2 ++ android/abi_gki_aarch64_qcom | 1 + 2 files changed, 3 insertions(+) diff --git a/android/abi_gki_aarch64.xml b/android/abi_gki_aarch64.xml index b69cd3d6656d..203534259b30 100644 --- a/android/abi_gki_aarch64.xml +++ b/android/abi_gki_aarch64.xml @@ -6448,6 +6448,7 @@ + @@ -120093,6 +120094,7 @@ + diff --git a/android/abi_gki_aarch64_qcom b/android/abi_gki_aarch64_qcom index 7941c74c90a7..dc16110241bc 100644 --- a/android/abi_gki_aarch64_qcom +++ b/android/abi_gki_aarch64_qcom @@ -2581,6 +2581,7 @@ __traceiter_android_vh_jiffies_update __traceiter_android_vh_logbuf __traceiter_android_vh_logbuf_pr_cont + __tracepoint_android_vh_madvise_cold_or_pageout __traceiter_android_vh_printk_hotplug __traceiter_android_vh_rproc_recovery __traceiter_android_vh_rproc_recovery_set