From a5e46b0f3c0509fd641f81be12082dcc98d22857 Mon Sep 17 00:00:00 2001 From: Jens Axboe Date: Sat, 17 Jun 2023 19:50:24 -0600 Subject: [PATCH 01/98] UPSTREAM: io_uring/poll: serialize poll linked timer start with poll removal Commit ef7dfac51d8ed961b742218f526bd589f3900a59 upstream. We selectively grab the ctx->uring_lock for poll update/removal, but we really should grab it from the start to fully synchronize with linked timeouts. Normally this is indeed the case, but if requests are forced async by the application, we don't fully cover removal and timer disarm within the uring_lock. Make this simpler by having consistent locking state for poll removal. Bug: 290270326 Cc: stable@vger.kernel.org # 6.1+ Reported-by: Querijn Voet Signed-off-by: Jens Axboe Signed-off-by: Greg Kroah-Hartman (cherry picked from commit 24f473769e7ecf35e2772469a063d5a8bbca6f63) Signed-off-by: Lee Jones Change-Id: I6632b7d78493b0dfc0fb26204d34823045c03f72 --- io_uring/poll.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/io_uring/poll.c b/io_uring/poll.c index 4788073ec45d..869e1d2a4413 100644 --- a/io_uring/poll.c +++ b/io_uring/poll.c @@ -993,8 +993,9 @@ int io_poll_remove(struct io_kiocb *req, unsigned int issue_flags) struct io_hash_bucket *bucket; struct io_kiocb *preq; int ret2, ret = 0; - bool locked; + bool locked = true; + io_ring_submit_lock(ctx, issue_flags); preq = io_poll_find(ctx, true, &cd, &ctx->cancel_table, &bucket); ret2 = io_poll_disarm(preq); if (bucket) @@ -1006,12 +1007,10 @@ int io_poll_remove(struct io_kiocb *req, unsigned int issue_flags) goto out; } - io_ring_submit_lock(ctx, issue_flags); preq = io_poll_find(ctx, true, &cd, &ctx->cancel_table_locked, &bucket); ret2 = io_poll_disarm(preq); if (bucket) spin_unlock(&bucket->lock); - io_ring_submit_unlock(ctx, issue_flags); if (ret2) { ret = ret2; goto out; @@ -1035,7 +1034,7 @@ found: if (poll_update->update_user_data) preq->cqe.user_data = poll_update->new_user_data; - ret2 = io_poll_add(preq, issue_flags); + ret2 = io_poll_add(preq, issue_flags & ~IO_URING_F_UNLOCKED); /* successfully updated, don't complete poll request */ if (!ret2 || ret2 == -EIOCBQUEUED) goto out; @@ -1043,9 +1042,9 @@ found: req_set_fail(preq); io_req_set_res(preq, -ECANCELED, 0); - locked = !(issue_flags & IO_URING_F_UNLOCKED); io_req_task_complete(preq, &locked); out: + io_ring_submit_unlock(ctx, issue_flags); if (ret < 0) { req_set_fail(req); return ret; From 77ae3e7bb8cef4b25cc0d8a9e75905001b55407f Mon Sep 17 00:00:00 2001 From: Suren Baghdasaryan Date: Fri, 30 Jun 2023 14:19:52 -0700 Subject: [PATCH 02/98] FROMGIT: swap: remove remnants of polling from read_swap_cache_async Patch series "Per-VMA lock support for swap and userfaults", v7. When per-VMA locks were introduced in [1] several types of page faults would still fall back to mmap_lock to keep the patchset simple. Among them are swap and userfault pages. The main reason for skipping those cases was the fact that mmap_lock could be dropped while handling these faults and that required additional logic to be implemented. Implement the mechanism to allow per-VMA locks to be dropped for these cases. First, change handle_mm_fault to drop per-VMA locks when returning VM_FAULT_RETRY or VM_FAULT_COMPLETED to be consistent with the way mmap_lock is handled. Then change folio_lock_or_retry to accept vm_fault and return vm_fault_t which simplifies later patches. Finally allow swap and uffd page faults to be handled under per-VMA locks by dropping per-VMA and retrying, the same way it's done under mmap_lock. Naturally, once VMA lock is dropped that VMA should be assumed unstable and can't be used. This patch (of 6): Commit [1] introduced IO polling support duding swapin to reduce swap read latency for block devices that can be polled. However later commit [2] removed polling support. Therefore it seems safe to remove do_poll parameter in read_swap_cache_async and always call swap_readpage with synchronous=false waiting for IO completion in folio_lock_or_retry. [1] commit 23955622ff8d ("swap: add block io poll in swapin path") [2] commit 9650b453a3d4 ("block: ignore RWF_HIPRI hint for sync dio") Link: https://lkml.kernel.org/r/20230630211957.1341547-1-surenb@google.com Link: https://lkml.kernel.org/r/20230630211957.1341547-2-surenb@google.com Signed-off-by: Suren Baghdasaryan Suggested-by: "Huang, Ying" Reviewed-by: "Huang, Ying" Reviewed-by: Christoph Hellwig Cc: Alistair Popple Cc: Al Viro Cc: Christian Brauner Cc: David Hildenbrand Cc: David Howells Cc: Davidlohr Bueso Cc: Hillf Danton Cc: Hugh Dickins Cc: Jan Kara Cc: Johannes Weiner Cc: Josef Bacik Cc: Laurent Dufour Cc: Liam R. Howlett Cc: Lorenzo Stoakes Cc: Matthew Wilcox Cc: Michal Hocko Cc: Michel Lespinasse Cc: Minchan Kim Cc: Pavel Tatashin Cc: Peter Xu Cc: Punit Agrawal Cc: Vlastimil Babka Cc: Yu Zhao Signed-off-by: Andrew Morton (cherry picked from commit 4296c6a817b421061d6e0b9c654c7d4d5a038a5b https: //git.kernel.org/pub/scm/linux/kernel/git/akpm/mm.git mm-unstable) Bug: 161210518 Change-Id: I3d647ba4d6093f4e3db2c4ff759e5ce59b45b0e1 Signed-off-by: Suren Baghdasaryan --- mm/madvise.c | 4 ++-- mm/swap.h | 1 - mm/swap_state.c | 12 +++++------- 3 files changed, 7 insertions(+), 10 deletions(-) diff --git a/mm/madvise.c b/mm/madvise.c index f49a62a35827..42c5a65e1c2d 100644 --- a/mm/madvise.c +++ b/mm/madvise.c @@ -223,7 +223,7 @@ static int swapin_walk_pmd_entry(pmd_t *pmd, unsigned long start, trace_android_vh_madvise_swapin_walk_pmd_entry(entry); page = read_swap_cache_async(entry, GFP_HIGHUSER_MOVABLE, - vma, index, false, &splug); + vma, index, &splug); if (page) put_page(page); } @@ -259,7 +259,7 @@ static void force_shm_swapin_readahead(struct vm_area_struct *vma, rcu_read_unlock(); page = read_swap_cache_async(swap, GFP_HIGHUSER_MOVABLE, - NULL, 0, false, &splug); + NULL, 0, &splug); if (page) put_page(page); diff --git a/mm/swap.h b/mm/swap.h index cc08c459c619..9ad061576192 100644 --- a/mm/swap.h +++ b/mm/swap.h @@ -46,7 +46,6 @@ struct page *find_get_incore_page(struct address_space *mapping, pgoff_t index); struct page *read_swap_cache_async(swp_entry_t entry, gfp_t gfp_mask, struct vm_area_struct *vma, unsigned long addr, - bool do_poll, struct swap_iocb **plug); struct page *__read_swap_cache_async(swp_entry_t entry, gfp_t gfp_mask, struct vm_area_struct *vma, diff --git a/mm/swap_state.c b/mm/swap_state.c index 438d0676c5be..3e7db8ea40f3 100644 --- a/mm/swap_state.c +++ b/mm/swap_state.c @@ -515,15 +515,14 @@ fail_unlock: */ struct page *read_swap_cache_async(swp_entry_t entry, gfp_t gfp_mask, struct vm_area_struct *vma, - unsigned long addr, bool do_poll, - struct swap_iocb **plug) + unsigned long addr, struct swap_iocb **plug) { bool page_was_allocated; struct page *retpage = __read_swap_cache_async(entry, gfp_mask, vma, addr, &page_was_allocated); if (page_was_allocated) - swap_readpage(retpage, do_poll, plug); + swap_readpage(retpage, false, plug); return retpage; } @@ -618,7 +617,7 @@ struct page *swap_cluster_readahead(swp_entry_t entry, gfp_t gfp_mask, struct swap_info_struct *si = swp_swap_info(entry); struct blk_plug plug; struct swap_iocb *splug = NULL; - bool do_poll = true, page_allocated; + bool page_allocated; struct vm_area_struct *vma = vmf->vma; unsigned long addr = vmf->address; @@ -626,7 +625,6 @@ struct page *swap_cluster_readahead(swp_entry_t entry, gfp_t gfp_mask, if (!mask) goto skip; - do_poll = false; /* Read a page_cluster sized and aligned cluster around offset. */ start_offset = offset & ~mask; end_offset = offset | mask; @@ -658,7 +656,7 @@ struct page *swap_cluster_readahead(swp_entry_t entry, gfp_t gfp_mask, lru_add_drain(); /* Push any new pages onto the LRU now */ skip: /* The page was likely read above, so no need for plugging here */ - return read_swap_cache_async(entry, gfp_mask, vma, addr, do_poll, NULL); + return read_swap_cache_async(entry, gfp_mask, vma, addr, NULL); } int init_swap_address_space(unsigned int type, unsigned long nr_pages) @@ -832,7 +830,7 @@ static struct page *swap_vma_readahead(swp_entry_t fentry, gfp_t gfp_mask, skip: /* The page was likely read above, so no need for plugging here */ return read_swap_cache_async(fentry, gfp_mask, vma, vmf->address, - ra_info.win == 1, NULL); + NULL); } /** From 4a207efbe0b5b01cee3aabd804916e1968eabafb Mon Sep 17 00:00:00 2001 From: Suren Baghdasaryan Date: Fri, 30 Jun 2023 14:19:53 -0700 Subject: [PATCH 03/98] FROMGIT: mm: add missing VM_FAULT_RESULT_TRACE name for VM_FAULT_COMPLETED VM_FAULT_RESULT_TRACE should contain an element for every vm_fault_reason to be used as flag_array inside trace_print_flags_seq(). The element for VM_FAULT_COMPLETED is missing, add it. Link: https://lkml.kernel.org/r/20230630211957.1341547-3-surenb@google.com Signed-off-by: Suren Baghdasaryan Reviewed-by: Peter Xu Cc: Alistair Popple Cc: Al Viro Cc: Christian Brauner Cc: Christoph Hellwig Cc: David Hildenbrand Cc: David Howells Cc: Davidlohr Bueso Cc: Hillf Danton Cc: "Huang, Ying" Cc: Hugh Dickins Cc: Jan Kara Cc: Johannes Weiner Cc: Josef Bacik Cc: Laurent Dufour Cc: Liam R. Howlett Cc: Lorenzo Stoakes Cc: Matthew Wilcox Cc: Michal Hocko Cc: Michel Lespinasse Cc: Minchan Kim Cc: Pavel Tatashin Cc: Punit Agrawal Cc: Vlastimil Babka Cc: Yu Zhao Signed-off-by: Andrew Morton (cherry picked from commit 4669552b64a6cf9ba2b48cf719879867efadcd8b https: //git.kernel.org/pub/scm/linux/kernel/git/akpm/mm.git mm-unstable) Bug: 161210518 Change-Id: Icef851c27ab1ea8e85c7fccc26b26480b9c42443 Signed-off-by: Suren Baghdasaryan --- include/linux/mm_types.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h index 248151aa6be9..00f5715a28c7 100644 --- a/include/linux/mm_types.h +++ b/include/linux/mm_types.h @@ -942,7 +942,8 @@ enum vm_fault_reason { { VM_FAULT_RETRY, "RETRY" }, \ { VM_FAULT_FALLBACK, "FALLBACK" }, \ { VM_FAULT_DONE_COW, "DONE_COW" }, \ - { VM_FAULT_NEEDDSYNC, "NEEDDSYNC" } + { VM_FAULT_NEEDDSYNC, "NEEDDSYNC" }, \ + { VM_FAULT_COMPLETED, "COMPLETED" } struct vm_special_mapping { const char *name; /* The name, e.g. "[vdso]". */ From 7bfd71d29806aec1473bfb1ece0e35780251dd79 Mon Sep 17 00:00:00 2001 From: Will McVicker Date: Wed, 19 Jul 2023 11:39:13 -0700 Subject: [PATCH 04/98] ANDROID: GKI: Update protected exports Run `bazel run @//common:kernel_aarch64_abi_update_protected_exports` on latest kernel to clean up the protected exports list. This is blocking updating the ABI since this list needs to be accurate before updating the ABI. Bug: 287170531 Change-Id: I8173060087cad060314ae0e494e30b71052e1d8f Signed-off-by: Will McVicker --- android/abi_gki_protected_exports_aarch64 | 2 -- android/abi_gki_protected_exports_x86_64 | 2 -- 2 files changed, 4 deletions(-) diff --git a/android/abi_gki_protected_exports_aarch64 b/android/abi_gki_protected_exports_aarch64 index e4792af0a0ef..7d97572e6175 100644 --- a/android/abi_gki_protected_exports_aarch64 +++ b/android/abi_gki_protected_exports_aarch64 @@ -336,12 +336,10 @@ wpan_phy_new wpan_phy_register wpan_phy_unregister wwan_create_port -wwan_get_debugfs_dir wwan_port_get_drvdata wwan_port_rx wwan_port_txoff wwan_port_txon -wwan_put_debugfs_dir wwan_register_ops wwan_remove_port wwan_unregister_ops \ No newline at end of file diff --git a/android/abi_gki_protected_exports_x86_64 b/android/abi_gki_protected_exports_x86_64 index e4792af0a0ef..7d97572e6175 100644 --- a/android/abi_gki_protected_exports_x86_64 +++ b/android/abi_gki_protected_exports_x86_64 @@ -336,12 +336,10 @@ wpan_phy_new wpan_phy_register wpan_phy_unregister wwan_create_port -wwan_get_debugfs_dir wwan_port_get_drvdata wwan_port_rx wwan_port_txoff wwan_port_txon -wwan_put_debugfs_dir wwan_register_ops wwan_remove_port wwan_unregister_ops \ No newline at end of file From 62ef90de0d67c6f068671850108dc98aa7238bdb Mon Sep 17 00:00:00 2001 From: Will McVicker Date: Wed, 19 Jul 2023 11:30:33 -0700 Subject: [PATCH 05/98] ANDROID: GKI: Update the pixel symbol list These symbols are part of supporting Pixel devices on GKI kernels. 1 function symbol(s) added 'struct gpio_desc* devm_gpiod_get_index_optional(struct device*, const char*, unsigned int, enum gpiod_flags)' Bug: 279090118 Change-Id: I1bb36d65f928fac53e0a3dbdc2c0559349d5fc42 Signed-off-by: Will McVicker --- android/abi_gki_aarch64.stg | 10 ++++++++++ android/abi_gki_aarch64_pixel | 24 ++++++++++++++++++++++++ 2 files changed, 34 insertions(+) diff --git a/android/abi_gki_aarch64.stg b/android/abi_gki_aarch64.stg index 41f0eecb2f04..0dcb7d98a33a 100644 --- a/android/abi_gki_aarch64.stg +++ b/android/abi_gki_aarch64.stg @@ -334772,6 +334772,15 @@ elf_symbol { type_id: 0x5f3cfa16 full_name: "devm_gpiod_get_index" } +elf_symbol { + id: 0x241e9d4d + name: "devm_gpiod_get_index_optional" + is_defined: true + symbol_type: FUNCTION + crc: 0xf71fb74b + type_id: 0x5f3cfa16 + full_name: "devm_gpiod_get_index_optional" +} elf_symbol { id: 0xf6b9516e name: "devm_gpiod_get_optional" @@ -379092,6 +379101,7 @@ interface { symbol_id: 0x097ab520 symbol_id: 0xccb2ecff symbol_id: 0xd0f2d980 + symbol_id: 0x241e9d4d symbol_id: 0xf6b9516e symbol_id: 0xa2b20c15 symbol_id: 0x0ea63f59 diff --git a/android/abi_gki_aarch64_pixel b/android/abi_gki_aarch64_pixel index 73ea56df4c25..ec1294998154 100644 --- a/android/abi_gki_aarch64_pixel +++ b/android/abi_gki_aarch64_pixel @@ -369,15 +369,19 @@ devm_clk_put devm_device_add_group devm_device_add_groups + devm_device_remove_group __devm_drm_dev_alloc devm_drm_panel_bridge_add_typed devm_extcon_dev_allocate devm_extcon_dev_register devm_free_irq + devm_fwnode_gpiod_get_index + devm_fwnode_pwm_get devm_gen_pool_create devm_gpiochip_add_data_with_key devm_gpiod_get devm_gpiod_get_array + devm_gpiod_get_index_optional devm_gpiod_get_optional devm_gpiod_put_array devm_gpio_request @@ -396,6 +400,7 @@ devm_kmemdup devm_kstrdup devm_kstrdup_const + devm_led_classdev_register_ext devm_mfd_add_devices devm_nvmem_register __devm_of_phy_provider_register @@ -410,6 +415,7 @@ devm_platform_ioremap_resource devm_platform_ioremap_resource_byname devm_power_supply_register + devm_pwm_get devm_regmap_add_irq_chip __devm_regmap_init __devm_regmap_init_i2c @@ -962,6 +968,7 @@ int_to_scsilun iomem_resource iommu_alloc_resv_region + iommu_attach_device iommu_attach_device_pasid iommu_attach_group iommu_detach_device_pasid @@ -1124,6 +1131,7 @@ kvmalloc_node led_classdev_register_ext led_classdev_unregister + led_init_default_state_get __list_add_valid __list_del_entry_valid list_sort @@ -1505,6 +1513,7 @@ __put_task_struct put_unused_fd put_vaddr_frames + pwm_apply_state queue_delayed_work_on queue_work_on radix_tree_delete_item @@ -1607,6 +1616,7 @@ regulator_map_voltage_linear regulator_notifier_call_chain regulator_put + regulator_set_active_discharge_regmap regulator_set_voltage regulator_set_voltage_sel_regmap regulator_unregister @@ -1997,10 +2007,17 @@ __traceiter_device_pm_callback_end __traceiter_device_pm_callback_start __traceiter_gpu_mem_total + __traceiter_hrtimer_expire_entry + __traceiter_hrtimer_expire_exit + __traceiter_irq_handler_entry + __traceiter_irq_handler_exit __traceiter_mmap_lock_acquire_returned __traceiter_mmap_lock_released __traceiter_mmap_lock_start_locking + __traceiter_sched_switch __traceiter_suspend_resume + __traceiter_workqueue_execute_end + __traceiter_workqueue_execute_start trace_output_call __tracepoint_android_rvh_typec_tcpci_get_vbus __tracepoint_android_vh_cpu_idle_enter @@ -2025,12 +2042,19 @@ __tracepoint_device_pm_callback_end __tracepoint_device_pm_callback_start __tracepoint_gpu_mem_total + __tracepoint_hrtimer_expire_entry + __tracepoint_hrtimer_expire_exit + __tracepoint_irq_handler_entry + __tracepoint_irq_handler_exit __tracepoint_mmap_lock_acquire_returned __tracepoint_mmap_lock_released __tracepoint_mmap_lock_start_locking tracepoint_probe_register tracepoint_probe_unregister + __tracepoint_sched_switch __tracepoint_suspend_resume + __tracepoint_workqueue_execute_end + __tracepoint_workqueue_execute_start trace_print_array_seq trace_print_bitmask_seq trace_print_flags_seq From 6ca2ff04a1b85c0145c965ab8562cd8072b4f3f5 Mon Sep 17 00:00:00 2001 From: davidchao Date: Mon, 1 Feb 2021 16:46:13 +0800 Subject: [PATCH 06/98] ANDROID: thermal: Add vendor thermal genl check Add vendor enable_thermal_genl_check logic. Filter on-die tz genl event. To avoid thermal-hal being woken up all the time by thermal genl events, only the selected thermal_zone and cooling_device can send events from kernel. Bug: 170682696 Bug: 291846209 Test: boot and thermal-hal can receive thermal genl events from kernel Change-Id: Idb3f4b07a2a2740c01d8785910878bfe6edc832d Signed-off-by: davidchao Signed-off-by: Will McVicker --- drivers/android/vendor_hooks.c | 1 + drivers/thermal/thermal_netlink.c | 6 ++++++ 2 files changed, 7 insertions(+) diff --git a/drivers/android/vendor_hooks.c b/drivers/android/vendor_hooks.c index 482830505f1b..0a30c8cbe7bd 100644 --- a/drivers/android/vendor_hooks.c +++ b/drivers/android/vendor_hooks.c @@ -312,3 +312,4 @@ EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_madvise_cold_pageout_skip); EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_rmqueue_smallest_bypass); EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_free_one_page_bypass); EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_regmap_update); +EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_enable_thermal_genl_check); diff --git a/drivers/thermal/thermal_netlink.c b/drivers/thermal/thermal_netlink.c index e2d78a996b5f..468eaae5ca82 100644 --- a/drivers/thermal/thermal_netlink.c +++ b/drivers/thermal/thermal_netlink.c @@ -9,6 +9,7 @@ #include #include #include +#include #include #include "thermal_core.h" @@ -274,6 +275,11 @@ static int thermal_genl_send_event(enum thermal_genl_event event, struct sk_buff *msg; int ret = -EMSGSIZE; void *hdr; + int enable_thermal_genl = 1; + + trace_android_vh_enable_thermal_genl_check(event, p->tz_id, &enable_thermal_genl); + if (!enable_thermal_genl) + return 0; msg = genlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL); if (!msg) From 3a8999c6830ef79a8d00301b633ae06899fc9b96 Mon Sep 17 00:00:00 2001 From: Will McVicker Date: Wed, 19 Jul 2023 15:22:06 -0700 Subject: [PATCH 07/98] ANDROID: GKI: Update pixel symbol list for thermal Add the following symbol to allow vendor module to filter on-die tz genl event. This helps avoid thermal-hal being woken up all the time by thermal genl events, only the selected thermal_zone and cooling_device can send events from kernel. 1 function symbol(s) added 'int __traceiter_android_vh_enable_thermal_genl_check(void*, int, int, int*)' 1 variable symbol(s) added 'struct tracepoint __tracepoint_android_vh_enable_thermal_genl_check' Bug: 291846209 Change-Id: I763595ff1366196c6a16ff57d608042743fbe9fd Signed-off-by: Will McVicker --- android/abi_gki_aarch64.stg | 28 ++++++++++++++++++++++++++++ android/abi_gki_aarch64_pixel | 2 ++ 2 files changed, 30 insertions(+) diff --git a/android/abi_gki_aarch64.stg b/android/abi_gki_aarch64.stg index 0dcb7d98a33a..2d8406a00dcd 100644 --- a/android/abi_gki_aarch64.stg +++ b/android/abi_gki_aarch64.stg @@ -301904,6 +301904,14 @@ function { parameter_id: 0x6720d32f parameter_id: 0x3c2755a3 } +function { + id: 0x9a2abc7b + return_type_id: 0x6720d32f + parameter_id: 0x18bd6530 + parameter_id: 0x6720d32f + parameter_id: 0x6720d32f + parameter_id: 0x13580d6c +} function { id: 0x9a2af11b return_type_id: 0x6720d32f @@ -321219,6 +321227,15 @@ elf_symbol { type_id: 0x9bdc9aae full_name: "__traceiter_android_vh_dup_task_struct" } +elf_symbol { + id: 0xdcaa59a3 + name: "__traceiter_android_vh_enable_thermal_genl_check" + is_defined: true + symbol_type: FUNCTION + crc: 0xc39a1e16 + type_id: 0x9a2abc7b + full_name: "__traceiter_android_vh_enable_thermal_genl_check" +} elf_symbol { id: 0x7ebac47a name: "__traceiter_android_vh_enable_thermal_power_throttle" @@ -324369,6 +324386,15 @@ elf_symbol { type_id: 0x18ccbd2c full_name: "__tracepoint_android_vh_dup_task_struct" } +elf_symbol { + id: 0x54b2cd01 + name: "__tracepoint_android_vh_enable_thermal_genl_check" + is_defined: true + symbol_type: OBJECT + crc: 0x29cc54bf + type_id: 0x18ccbd2c + full_name: "__tracepoint_android_vh_enable_thermal_genl_check" +} elf_symbol { id: 0x188eab44 name: "__tracepoint_android_vh_enable_thermal_power_throttle" @@ -377594,6 +377620,7 @@ interface { symbol_id: 0x9dbd7b92 symbol_id: 0x42312ccc symbol_id: 0xf432d1c9 + symbol_id: 0xdcaa59a3 symbol_id: 0x7ebac47a symbol_id: 0xf586d5b6 symbol_id: 0x1f554c2a @@ -377944,6 +377971,7 @@ interface { symbol_id: 0xe2d7542c symbol_id: 0x988719fa symbol_id: 0x732a182b + symbol_id: 0x54b2cd01 symbol_id: 0x188eab44 symbol_id: 0xe7584e1c symbol_id: 0x0d418d38 diff --git a/android/abi_gki_aarch64_pixel b/android/abi_gki_aarch64_pixel index ec1294998154..dbd893b4d26b 100644 --- a/android/abi_gki_aarch64_pixel +++ b/android/abi_gki_aarch64_pixel @@ -1987,6 +1987,7 @@ __traceiter_android_rvh_typec_tcpci_get_vbus __traceiter_android_vh_cpu_idle_enter __traceiter_android_vh_cpu_idle_exit + __traceiter_android_vh_enable_thermal_genl_check __traceiter_android_vh_ipi_stop __traceiter_android_vh_scheduler_tick __traceiter_android_vh_sysrq_crash @@ -2022,6 +2023,7 @@ __tracepoint_android_rvh_typec_tcpci_get_vbus __tracepoint_android_vh_cpu_idle_enter __tracepoint_android_vh_cpu_idle_exit + __tracepoint_android_vh_enable_thermal_genl_check __tracepoint_android_vh_ipi_stop __tracepoint_android_vh_scheduler_tick __tracepoint_android_vh_sysrq_crash From f930b82d1651fbd9e00d0a96d56c4ba3555b7b41 Mon Sep 17 00:00:00 2001 From: Miklos Szeredi Date: Tue, 18 Jul 2023 11:17:20 -0700 Subject: [PATCH 08/98] FROMLIST: fuse: revalidate: don't invalidate if interrupted If the LOOKUP request triggered from fuse_dentry_revalidate() is interrupted, then the dentry will be invalidated, possibly resulting in submounts being unmounted. Reported-by: Xu Rongbo Fixes: 9e6268db496a ("[PATCH] FUSE - read-write operations") Cc: Signed-off-by: Miklos Szeredi Bug: 282905757 Link: https://lore.kernel.org/all/CAJfpegswN_CJJ6C3RZiaK6rpFmNyWmXfaEpnQUJ42KCwNF5tWw@mail.gmail.com/ Signed-off-by: Paul Lawrence (cherry picked from https://android-review.googlesource.com/q/commit:ae5b9259d42efa1bbd42d807fd3b3a991ddb51be) Merged-In: I8c62f5aeeb450de78c6a38a6f8728c900a0fc9bd Change-Id: I8c62f5aeeb450de78c6a38a6f8728c900a0fc9bd --- fs/fuse/dir.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c index 933e4a727505..076a0bddef8f 100644 --- a/fs/fuse/dir.c +++ b/fs/fuse/dir.c @@ -321,7 +321,7 @@ static int fuse_dentry_revalidate(struct dentry *entry, unsigned int flags) spin_unlock(&fi->lock); } kfree(forget); - if (ret == -ENOMEM) + if (ret == -ENOMEM || ret == -EINTR) goto out; if (ret || fuse_invalid_attr(&outarg.attr) || fuse_stale_inode(inode, outarg.generation, &outarg.attr)) From 7dd60ce8046d1e791519c4128eff3018e3507ec6 Mon Sep 17 00:00:00 2001 From: lijun14 Date: Tue, 18 Jul 2023 20:09:31 +0800 Subject: [PATCH 09/98] ANDROID: vendor_hooks: add vendor hook to support SAGT Add vendor hook of android_rvh_before_do_sched_yield Bug: 291726037 Change-Id: I1f2d65739a297812f279b83085e3680e40d4cb6e Signed-off-by: lijun14 --- include/trace/hooks/sched.h | 4 ++++ kernel/sched/core.c | 5 +++++ kernel/sched/vendor_hooks.c | 1 + 3 files changed, 10 insertions(+) diff --git a/include/trace/hooks/sched.h b/include/trace/hooks/sched.h index 7b5ab104d7fe..811f07f7be61 100644 --- a/include/trace/hooks/sched.h +++ b/include/trace/hooks/sched.h @@ -255,6 +255,10 @@ DECLARE_RESTRICTED_HOOK(android_rvh_do_sched_yield, TP_PROTO(struct rq *rq), TP_ARGS(rq), 1); +DECLARE_RESTRICTED_HOOK(android_rvh_before_do_sched_yield, + TP_PROTO(long *unused), + TP_ARGS(unused), 1); + DECLARE_HOOK(android_vh_free_task, TP_PROTO(struct task_struct *p), TP_ARGS(p)); diff --git a/kernel/sched/core.c b/kernel/sched/core.c index c9d59630444a..53faabdb3950 100644 --- a/kernel/sched/core.c +++ b/kernel/sched/core.c @@ -8446,6 +8446,11 @@ static void do_sched_yield(void) { struct rq_flags rf; struct rq *rq; + long skip = 0; + + trace_android_rvh_before_do_sched_yield(&skip); + if (skip) + return; rq = this_rq_lock_irq(&rf); diff --git a/kernel/sched/vendor_hooks.c b/kernel/sched/vendor_hooks.c index e1e2601fd84f..d8d945fc20e3 100644 --- a/kernel/sched/vendor_hooks.c +++ b/kernel/sched/vendor_hooks.c @@ -75,6 +75,7 @@ EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_is_cpu_allowed); EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_get_nohz_timer_target); EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_sched_getaffinity); EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_do_sched_yield); +EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_before_do_sched_yield); EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_sched_fork_init); EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_ttwu_cond); EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_schedule_bug); From 25a11995fb3795bb2b4a559216a4336952ff7f4d Mon Sep 17 00:00:00 2001 From: lijun14 Date: Tue, 18 Jul 2023 20:02:25 +0800 Subject: [PATCH 10/98] ANDROID: GKI: add ABI symbol for xiaomi abi symbol(s) added : __traceiter_android_rvh_before_do_sched_yield __tracepoint_android_rvh_before_do_sched_yield Bug: 291726037 Change-Id: I16278b0ca8eac03976543e27f21d82c3cec92af8 Signed-off-by: lijun14 --- android/abi_gki_aarch64.stg | 26 ++++++++++++++++++++++++++ android/abi_gki_aarch64_xiaomi | 4 ++++ 2 files changed, 30 insertions(+) diff --git a/android/abi_gki_aarch64.stg b/android/abi_gki_aarch64.stg index 2d8406a00dcd..2f172f835e4e 100644 --- a/android/abi_gki_aarch64.stg +++ b/android/abi_gki_aarch64.stg @@ -304498,6 +304498,12 @@ function { parameter_id: 0x2e029f76 parameter_id: 0x13580d6c } +function { + id: 0x9b79f498 + return_type_id: 0x6720d32f + parameter_id: 0x18bd6530 + parameter_id: 0x3593bec8 +} function { id: 0x9b79f513 return_type_id: 0x6720d32f @@ -319751,6 +319757,15 @@ elf_symbol { type_id: 0x9b2ba01c full_name: "__traceiter_android_rvh_audio_usb_offload_disconnect" } +elf_symbol { + id: 0x144db0a1 + name: "__traceiter_android_rvh_before_do_sched_yield" + is_defined: true + symbol_type: FUNCTION + crc: 0xce266c8e + type_id: 0x9b79f498 + full_name: "__traceiter_android_rvh_before_do_sched_yield" +} elf_symbol { id: 0x192bbbd5 name: "__traceiter_android_rvh_build_perf_domains" @@ -322910,6 +322925,15 @@ elf_symbol { type_id: 0x18ccbd2c full_name: "__tracepoint_android_rvh_audio_usb_offload_disconnect" } +elf_symbol { + id: 0xd7757253 + name: "__tracepoint_android_rvh_before_do_sched_yield" + is_defined: true + symbol_type: OBJECT + crc: 0x94abc138 + type_id: 0x18ccbd2c + full_name: "__tracepoint_android_rvh_before_do_sched_yield" +} elf_symbol { id: 0x1e8a7e23 name: "__tracepoint_android_rvh_build_perf_domains" @@ -377456,6 +377480,7 @@ interface { symbol_id: 0xb3d70eab symbol_id: 0x0b48afa1 symbol_id: 0x48420da9 + symbol_id: 0x144db0a1 symbol_id: 0x192bbbd5 symbol_id: 0xadc13d20 symbol_id: 0xc93c7d6d @@ -377807,6 +377832,7 @@ interface { symbol_id: 0xcd36f539 symbol_id: 0x748c1fd7 symbol_id: 0xaf461bff + symbol_id: 0xd7757253 symbol_id: 0x1e8a7e23 symbol_id: 0xfe3875f6 symbol_id: 0x60b5a917 diff --git a/android/abi_gki_aarch64_xiaomi b/android/abi_gki_aarch64_xiaomi index b0e34e78b178..8209fb5955f2 100644 --- a/android/abi_gki_aarch64_xiaomi +++ b/android/abi_gki_aarch64_xiaomi @@ -306,3 +306,7 @@ __tracepoint_android_vh_rmqueue_smallest_bypass __traceiter_android_vh_free_one_page_bypass __tracepoint_android_vh_free_one_page_bypass + +# required by SAGT module + __traceiter_android_rvh_before_do_sched_yield + __tracepoint_android_rvh_before_do_sched_yield From d51e21b3941585c584f81edad7cd9818f6f86d5f Mon Sep 17 00:00:00 2001 From: John Scheible Date: Thu, 20 Jul 2023 12:24:34 -0700 Subject: [PATCH 11/98] ANDROID: ABI: Update pixel symbol list 1 function symbol(s) added 'void iommu_detach_device(struct iommu_domain *, struct device *)' Bug: 292121811 Change-Id: I7087f815af2a57d538484c66e0a4ab97e137c586 Signed-off-by: John Scheible --- android/abi_gki_aarch64_pixel | 1 + 1 file changed, 1 insertion(+) diff --git a/android/abi_gki_aarch64_pixel b/android/abi_gki_aarch64_pixel index dbd893b4d26b..b50236e61182 100644 --- a/android/abi_gki_aarch64_pixel +++ b/android/abi_gki_aarch64_pixel @@ -971,6 +971,7 @@ iommu_attach_device iommu_attach_device_pasid iommu_attach_group + iommu_detach_device iommu_detach_device_pasid iommu_device_register iommu_device_sysfs_add From 701f85c2a19d776f84469d34b4ade2ff95f34612 Mon Sep 17 00:00:00 2001 From: Lu Wang Date: Thu, 20 Jul 2023 08:49:13 +0800 Subject: [PATCH 12/98] ANDROID: abi_gki_aarch64_qcom: Update QCOM symbol list Update QCOM symbol list for walt vendor hook. Symbols added: __traceiter_android_rvh_before_do_sched_yield __tracepoint_android_rvh_before_do_sched_yield Bug: 291683326 Signed-off-by: Lu Wang Change-Id: I3fe2fb40f3da4ff6079e64d7badb4e9e63ee6248 --- android/abi_gki_aarch64_qcom | 2 ++ 1 file changed, 2 insertions(+) diff --git a/android/abi_gki_aarch64_qcom b/android/abi_gki_aarch64_qcom index df8f0db3cc5c..ec0a9c3f3bb3 100644 --- a/android/abi_gki_aarch64_qcom +++ b/android/abi_gki_aarch64_qcom @@ -3262,6 +3262,7 @@ __traceiter_android_rvh_after_dequeue_task __traceiter_android_rvh_after_enqueue_task __traceiter_android_rvh_audio_usb_offload_disconnect + __traceiter_android_rvh_before_do_sched_yield __traceiter_android_rvh_build_perf_domains __traceiter_android_rvh_can_migrate_task __traceiter_android_rvh_check_preempt_tick @@ -3405,6 +3406,7 @@ __tracepoint_android_rvh_after_dequeue_task __tracepoint_android_rvh_after_enqueue_task __tracepoint_android_rvh_audio_usb_offload_disconnect + __tracepoint_android_rvh_before_do_sched_yield __tracepoint_android_rvh_build_perf_domains __tracepoint_android_rvh_can_migrate_task __tracepoint_android_rvh_check_preempt_tick From 8bb470d6377f77b1b47ea1b130cee8a30755cfa8 Mon Sep 17 00:00:00 2001 From: Takashi Iwai Date: Fri, 12 May 2023 16:18:00 +0100 Subject: [PATCH 13/98] UPSTREAM: media: dvb-core: Fix kernel WARNING for blocking operation in wait_event*() [ Upstream commit b8c75e4a1b325ea0a9433fa8834be97b5836b946 ] Using a semaphore in the wait_event*() condition is no good idea. It hits a kernel WARN_ON() at prepare_to_wait_event() like: do not call blocking ops when !TASK_RUNNING; state=1 set at prepare_to_wait_event+0x6d/0x690 For avoiding the potential deadlock, rewrite to an open-coded loop instead. Unlike the loop in wait_event*(), this uses wait_woken() after the condition check, hence the task state stays consistent. CVE-2023-31084 was assigned to this bug. Link: https://lore.kernel.org/r/CA+UBctCu7fXn4q41O_3=id1+OdyQ85tZY1x+TkT-6OVBL6KAUw@mail.gmail.com/ Bug: 290204413 Link: https://lore.kernel.org/linux-media/20230512151800.1874-1-tiwai@suse.de Reported-by: Yu Hao Closes: https://nvd.nist.gov/vuln/detail/CVE-2023-31084 Signed-off-by: Takashi Iwai Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Sasha Levin (cherry picked from commit d0088ea444e676a0c75551efe183bee4a3d2cfc8) Signed-off-by: Lee Jones Change-Id: Id7cefa46b7d4189a0311e7e763b1c9be7ba9bdbd --- drivers/media/dvb-core/dvb_frontend.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/drivers/media/dvb-core/dvb_frontend.c b/drivers/media/dvb-core/dvb_frontend.c index c41a7e5c2b92..fce0e2094078 100644 --- a/drivers/media/dvb-core/dvb_frontend.c +++ b/drivers/media/dvb-core/dvb_frontend.c @@ -293,14 +293,22 @@ static int dvb_frontend_get_event(struct dvb_frontend *fe, } if (events->eventw == events->eventr) { - int ret; + struct wait_queue_entry wait; + int ret = 0; if (flags & O_NONBLOCK) return -EWOULDBLOCK; - ret = wait_event_interruptible(events->wait_queue, - dvb_frontend_test_event(fepriv, events)); - + init_waitqueue_entry(&wait, current); + add_wait_queue(&events->wait_queue, &wait); + while (!dvb_frontend_test_event(fepriv, events)) { + wait_woken(&wait, TASK_INTERRUPTIBLE, 0); + if (signal_pending(current)) { + ret = -ERESTARTSYS; + break; + } + } + remove_wait_queue(&events->wait_queue, &wait); if (ret < 0) return ret; } From ca372ba9e750c31045f366e262db01ef8663c7aa Mon Sep 17 00:00:00 2001 From: lambert wang Date: Fri, 21 Jul 2023 08:24:24 +0800 Subject: [PATCH 14/98] ANDROID: GKI: Update mtk ABI symbol list 6 function symbol(s) added 'struct device* device_find_child_by_name(struct device*, const char*)' 'void pci_free_irq(struct pci_dev*, unsigned int, void*)' 'int pci_request_irq(struct pci_dev*, unsigned int, irq_handler_t, irq_handler_t, void*, const char*, ...)' 'int pm_schedule_suspend(struct device*, unsigned int)' 'int rtnl_configure_link(struct net_device*, const struct ifinfomsg*)' 'struct net_device* rtnl_create_link(struct net*, const char*, unsigned char, const struct rtnl_link_ops*, struct nlattr**, struct netlink_ext_ack*)' in which: * device_find_child_by_name/rtnl_configure_link/rtnl_create_link are needed by wwan.ko. Bug: 291865296 Change-Id: I38b8a69313667318944387e1a19287b9c01cafee Signed-off-by: zhaoping shu Signed-off-by: xiayu zhang Signed-off-by: ivan yang Signed-off-by: lambert wang --- android/abi_gki_aarch64.stg | 153 ++++++++++++++++++++++++++++++++++++ android/abi_gki_aarch64_mtk | 24 ++++++ 2 files changed, 177 insertions(+) diff --git a/android/abi_gki_aarch64.stg b/android/abi_gki_aarch64.stg index 2f172f835e4e..291c26e645b8 100644 --- a/android/abi_gki_aarch64.stg +++ b/android/abi_gki_aarch64.stg @@ -27431,6 +27431,11 @@ pointer_reference { kind: POINTER pointee_type_id: 0xd06de2a9 } +pointer_reference { + id: 0x3e8d7c9a + kind: POINTER + pointee_type_id: 0xd07514f5 +} pointer_reference { id: 0x3e8e572f kind: POINTER @@ -30856,6 +30861,11 @@ qualified { qualifier: CONST qualified_type_id: 0x30a49fb4 } +qualified { + id: 0xd07514f5 + qualifier: CONST + qualified_type_id: 0x3193e55d +} qualified { id: 0xd08a0c68 qualifier: CONST @@ -39256,6 +39266,12 @@ member { name: "__i_nlink" type_id: 0x4585663f } +member { + id: 0xed0c7bc2 + name: "__ifi_pad" + type_id: 0x5d8155a5 + offset: 8 +} member { id: 0x1d90045d name: "__iter_idx" @@ -100711,6 +100727,35 @@ member { type_id: 0x0fa767da offset: 448 } +member { + id: 0x49aaa6b3 + name: "ifi_change" + type_id: 0x4585663f + offset: 96 +} +member { + id: 0xccfc5cc3 + name: "ifi_family" + type_id: 0x5d8155a5 +} +member { + id: 0xe5765ac4 + name: "ifi_flags" + type_id: 0x4585663f + offset: 64 +} +member { + id: 0x95c94564 + name: "ifi_index" + type_id: 0x6720d32f + offset: 32 +} +member { + id: 0x58fe8d2e + name: "ifi_type" + type_id: 0xc93e017b + offset: 16 +} member { id: 0x9056806a name: "ifindex" @@ -224281,6 +224326,20 @@ struct_union { member_id: 0x95dac005 } } +struct_union { + id: 0x3193e55d + kind: STRUCT + name: "ifinfomsg" + definition { + bytesize: 16 + member_id: 0xccfc5cc3 + member_id: 0xed0c7bc2 + member_id: 0x58fe8d2e + member_id: 0x95c94564 + member_id: 0xe5765ac4 + member_id: 0x49aaa6b3 + } +} struct_union { id: 0x41f1df67 kind: STRUCT @@ -280106,6 +280165,13 @@ function { return_type_id: 0x48b5725f parameter_id: 0x15a30023 } +function { + id: 0x15f1cac1 + return_type_id: 0x48b5725f + parameter_id: 0x11e6864c + parameter_id: 0x4585663f + parameter_id: 0x18bd6530 +} function { id: 0x15f330e3 return_type_id: 0x48b5725f @@ -294238,6 +294304,12 @@ function { parameter_id: 0x32a623d7 parameter_id: 0x3e10b518 } +function { + id: 0x91d35e28 + return_type_id: 0x6720d32f + parameter_id: 0x32a623d7 + parameter_id: 0x3e8d7c9a +} function { id: 0x91d5541c return_type_id: 0x6720d32f @@ -300498,6 +300570,17 @@ function { return_type_id: 0x6720d32f parameter_id: 0x156a41de } +function { + id: 0x98da7fb1 + return_type_id: 0x6720d32f + parameter_id: 0x11e6864c + parameter_id: 0x4585663f + parameter_id: 0xd92b1d75 + parameter_id: 0xd92b1d75 + parameter_id: 0x18bd6530 + parameter_id: 0x3e10b518 + parameter_id: 0xa52a0930 +} function { id: 0x98de7695 return_type_id: 0x6720d32f @@ -316675,6 +316758,16 @@ function { return_type_id: 0x6d7f5ff6 parameter_id: 0x040d1b01 } +function { + id: 0xffb4ff33 + return_type_id: 0x32a623d7 + parameter_id: 0x0ca27481 + parameter_id: 0x3e10b518 + parameter_id: 0x5d8155a5 + parameter_id: 0x337b7b81 + parameter_id: 0x0277bf8a + parameter_id: 0x07dcdbe1 +} function { id: 0xffbaa126 return_type_id: 0x32a623d7 @@ -334048,6 +334141,15 @@ elf_symbol { type_id: 0xadd088bd full_name: "device_find_child" } +elf_symbol { + id: 0x01805ccc + name: "device_find_child_by_name" + is_defined: true + symbol_type: FUNCTION + crc: 0xfe92284a + type_id: 0xad414cb1 + full_name: "device_find_child_by_name" +} elf_symbol { id: 0xd81e7ab3 name: "device_for_each_child" @@ -355516,6 +355618,15 @@ elf_symbol { type_id: 0x578fa618 full_name: "pci_find_next_capability" } +elf_symbol { + id: 0x08190210 + name: "pci_free_irq" + is_defined: true + symbol_type: FUNCTION + crc: 0xdaf171ab + type_id: 0x15f1cac1 + full_name: "pci_free_irq" +} elf_symbol { id: 0x8ffabaa9 name: "pci_free_irq_vectors" @@ -355813,6 +355924,15 @@ elf_symbol { type_id: 0x185a3adc full_name: "pci_remove_root_bus" } +elf_symbol { + id: 0xf6896e34 + name: "pci_request_irq" + is_defined: true + symbol_type: FUNCTION + crc: 0x17161b4b + type_id: 0x98da7fb1 + full_name: "pci_request_irq" +} elf_symbol { id: 0x324ff23b name: "pci_request_region" @@ -358108,6 +358228,15 @@ elf_symbol { type_id: 0x1192ec84 full_name: "pm_runtime_set_autosuspend_delay" } +elf_symbol { + id: 0xe263dcb4 + name: "pm_schedule_suspend" + is_defined: true + symbol_type: FUNCTION + crc: 0xe5c44150 + type_id: 0x9c00c8ec + full_name: "pm_schedule_suspend" +} elf_symbol { id: 0x59caaeac name: "pm_stay_awake" @@ -362014,6 +362143,24 @@ elf_symbol { type_id: 0x90657259 full_name: "rtc_valid_tm" } +elf_symbol { + id: 0x19b7aeab + name: "rtnl_configure_link" + is_defined: true + symbol_type: FUNCTION + crc: 0x85c289df + type_id: 0x91d35e28 + full_name: "rtnl_configure_link" +} +elf_symbol { + id: 0xfccc22f4 + name: "rtnl_create_link" + is_defined: true + symbol_type: FUNCTION + crc: 0x817f3567 + type_id: 0xffb4ff33 + full_name: "rtnl_create_link" +} elf_symbol { id: 0x50b92bc4 name: "rtnl_is_locked" @@ -379069,6 +379216,7 @@ interface { symbol_id: 0xe85fa1f1 symbol_id: 0xe6df6df5 symbol_id: 0x0b165427 + symbol_id: 0x01805ccc symbol_id: 0xd81e7ab3 symbol_id: 0x3b013a69 symbol_id: 0x0576df29 @@ -381452,6 +381600,7 @@ interface { symbol_id: 0x27f20808 symbol_id: 0x63876663 symbol_id: 0xdea420f5 + symbol_id: 0x08190210 symbol_id: 0x8ffabaa9 symbol_id: 0x50bce06e symbol_id: 0x133a7a3e @@ -381485,6 +381634,7 @@ interface { symbol_id: 0x5b0002a1 symbol_id: 0x2c8694e0 symbol_id: 0xa21a61f0 + symbol_id: 0xf6896e34 symbol_id: 0x324ff23b symbol_id: 0xde0961b5 symbol_id: 0x93ed1ac4 @@ -381740,6 +381890,7 @@ interface { symbol_id: 0x878b97bb symbol_id: 0x1f3f17bd symbol_id: 0x53f4166f + symbol_id: 0xe263dcb4 symbol_id: 0x59caaeac symbol_id: 0x64f92138 symbol_id: 0x2e13b831 @@ -382174,6 +382325,8 @@ interface { symbol_id: 0xa4ad8391 symbol_id: 0x5c1197ba symbol_id: 0x22e1072c + symbol_id: 0x19b7aeab + symbol_id: 0xfccc22f4 symbol_id: 0x50b92bc4 symbol_id: 0x8c0dd14a symbol_id: 0x3480e8df diff --git a/android/abi_gki_aarch64_mtk b/android/abi_gki_aarch64_mtk index e3872c033f45..9a933b3f74c6 100644 --- a/android/abi_gki_aarch64_mtk +++ b/android/abi_gki_aarch64_mtk @@ -395,6 +395,7 @@ device_del device_destroy device_find_child + device_find_child_by_name device_for_each_child device_get_child_node_count device_get_match_data @@ -1200,6 +1201,7 @@ ip_send_check __ipv6_addr_type ipv6_dev_find + ipv6_ext_hdr ipv6_skip_exthdr ipv6_stub __irq_apply_affinity_hint @@ -1337,10 +1339,14 @@ kthread_flush_work kthread_flush_worker __kthread_init_worker + kthread_park + kthread_parkme kthread_queue_delayed_work kthread_queue_work + kthread_should_park kthread_should_stop kthread_stop + kthread_unpark kthread_worker_fn ktime_get ktime_get_coarse_with_offset @@ -1692,6 +1698,7 @@ out_of_line_wait_on_bit_timeout overflowuid page_endio + page_frag_free page_pinner_inited __page_pinner_put_page page_pool_alloc_pages @@ -1715,6 +1722,7 @@ param_ops_uint param_ops_ullong param_ops_ulong + param_ops_ushort param_set_bool param_set_charp param_set_uint @@ -1722,18 +1730,25 @@ pci_alloc_irq_vectors_affinity pci_ats_supported pci_bus_type + pci_clear_master pci_device_group + pci_device_is_present pci_dev_put pci_disable_ats pci_disable_device + pcie_capability_clear_and_set_word + pcie_capability_read_word pci_enable_ats pci_find_ext_capability + pci_free_irq pci_free_irq_vectors pci_generic_config_read32 pci_generic_config_write32 pci_get_slot pci_host_probe pci_irq_vector + pci_load_and_free_saved_state + pci_load_saved_state pci_lock_rescan_remove pcim_enable_device pcim_iomap_regions @@ -1747,10 +1762,12 @@ pci_read_config_word __pci_register_driver pci_remove_root_bus + pci_request_irq pci_restore_state pci_save_state pci_set_master pci_stop_root_bus + pci_store_saved_state pci_unlock_rescan_remove pci_unregister_driver pci_write_config_dword @@ -1869,6 +1886,7 @@ __pm_runtime_set_status __pm_runtime_suspend __pm_runtime_use_autosuspend + pm_schedule_suspend __pm_stay_awake pm_stay_awake pm_suspend_default_s2idle @@ -1933,9 +1951,11 @@ queue_delayed_work_on queue_work_on radix_tree_delete + radix_tree_gang_lookup radix_tree_insert radix_tree_lookup radix_tree_maybe_preload + radix_tree_next_chunk radix_tree_tagged ___ratelimit raw_notifier_call_chain @@ -2123,6 +2143,8 @@ rtc_tm_to_time64 rtc_update_irq rtc_valid_tm + rtnl_configure_link + rtnl_create_link rtnl_is_locked rtnl_link_register rtnl_link_unregister @@ -2526,6 +2548,7 @@ timecounter_init timecounter_read timer_of_init + timer_reduce timer_unstable_counter_workaround topology_clear_scale_freq_source topology_update_thermal_pressure @@ -2733,6 +2756,7 @@ __tracepoint_task_newtask trace_print_array_seq trace_print_flags_seq + trace_print_hex_seq trace_print_symbols_seq __trace_puts trace_raw_output_prep From 13e8071ce0cf668209c94953c0148cf8f7d41d2a Mon Sep 17 00:00:00 2001 From: Xiaopeng Bai Date: Thu, 20 Jul 2023 17:15:11 +0800 Subject: [PATCH 15/98] ANDROID: update symbol list for unisoc regmap vendor hook 1 function symbol(s) added 'int __traceiter_android_vh_regmap_update(void*, const struct regmap_config*, struct regmap*)' 1 variable symbol(s) added 'struct tracepoint __tracepoint_android_vh_regmap_update' Bug: 232965613 Change-Id: I9b184315493eacc433b85cd36c3d1c34992b188b Signed-off-by: Xiaopeng Bai --- android/abi_gki_aarch64.stg | 27 +++++++++++++++++++++++++++ android/abi_gki_aarch64_unisoc | 2 ++ 2 files changed, 29 insertions(+) diff --git a/android/abi_gki_aarch64.stg b/android/abi_gki_aarch64.stg index 291c26e645b8..24f524b3e4c2 100644 --- a/android/abi_gki_aarch64.stg +++ b/android/abi_gki_aarch64.stg @@ -304086,6 +304086,13 @@ function { parameter_id: 0x188b9e81 parameter_id: 0x3ea31487 } +function { + id: 0x9b5a0fe0 + return_type_id: 0x6720d32f + parameter_id: 0x18bd6530 + parameter_id: 0x3df7e337 + parameter_id: 0x09a83f1c +} function { id: 0x9b5aa874 return_type_id: 0x6720d32f @@ -321965,6 +321972,15 @@ elf_symbol { type_id: 0x9bd7019d full_name: "__traceiter_android_vh_record_rwsem_lock_starttime" } +elf_symbol { + id: 0xe2d75052 + name: "__traceiter_android_vh_regmap_update" + is_defined: true + symbol_type: FUNCTION + crc: 0x70e6bb0c + type_id: 0x9b5a0fe0 + full_name: "__traceiter_android_vh_regmap_update" +} elf_symbol { id: 0x8d62858f name: "__traceiter_android_vh_rmqueue_smallest_bypass" @@ -325133,6 +325149,15 @@ elf_symbol { type_id: 0x18ccbd2c full_name: "__tracepoint_android_vh_record_rwsem_lock_starttime" } +elf_symbol { + id: 0x13b2fb38 + name: "__tracepoint_android_vh_regmap_update" + is_defined: true + symbol_type: OBJECT + crc: 0xcf37e88a + type_id: 0x18ccbd2c + full_name: "__tracepoint_android_vh_regmap_update" +} elf_symbol { id: 0x04365139 name: "__tracepoint_android_vh_rmqueue_smallest_bypass" @@ -377862,6 +377887,7 @@ interface { symbol_id: 0x0fa39b81 symbol_id: 0x92518ec5 symbol_id: 0x9792c22e + symbol_id: 0xe2d75052 symbol_id: 0x8d62858f symbol_id: 0xcef5d79f symbol_id: 0x91384eff @@ -378214,6 +378240,7 @@ interface { symbol_id: 0xef7ad117 symbol_id: 0x4568ff8f symbol_id: 0xe918e2ec + symbol_id: 0x13b2fb38 symbol_id: 0x04365139 symbol_id: 0xd94bc301 symbol_id: 0x3fc5ffc9 diff --git a/android/abi_gki_aarch64_unisoc b/android/abi_gki_aarch64_unisoc index bb8ad74d357d..867436314590 100644 --- a/android/abi_gki_aarch64_unisoc +++ b/android/abi_gki_aarch64_unisoc @@ -714,6 +714,7 @@ __traceiter_android_vh_get_thermal_zone_device __traceiter_android_vh_modify_thermal_request_freq __traceiter_android_vh_modify_thermal_target_freq + __traceiter_android_vh_regmap_update __traceiter_android_vh_scheduler_tick __traceiter_android_vh_thermal_power_cap __traceiter_android_vh_thermal_register @@ -792,6 +793,7 @@ __tracepoint_android_vh_get_thermal_zone_device __tracepoint_android_vh_modify_thermal_request_freq __tracepoint_android_vh_modify_thermal_target_freq + __tracepoint_android_vh_regmap_update __tracepoint_android_vh_scheduler_tick __tracepoint_android_vh_thermal_power_cap __tracepoint_android_vh_thermal_register From 7ed895f6b7924f1afebe4bf78f66342e694f8f6e Mon Sep 17 00:00:00 2001 From: Ramji Jiyani Date: Sun, 23 Jul 2023 08:28:40 +0000 Subject: [PATCH 16/98] ANDROID: GKI: Add Android ABI padding to wwan_ops Try to mitigate potential future api changes by adding a padding to struct wwan_ops. Fixes: 214e6f268b6a ("ANDROID: GKI: Add WWAN as GKI protected module") Bug: 287170531 Test: bazel run //common:kernel_aarch64_dist & TH Change-Id: I0a6f8a801503228af11dc227ce703b886a74f288 Signed-off-by: Ramji Jiyani --- include/linux/wwan.h | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/include/linux/wwan.h b/include/linux/wwan.h index 5ce2acf444fb..7c2d5db089a1 100644 --- a/include/linux/wwan.h +++ b/include/linux/wwan.h @@ -7,6 +7,7 @@ #include #include #include +#include /** * enum wwan_port_type - WWAN port types @@ -165,6 +166,9 @@ struct wwan_ops { u32 if_id, struct netlink_ext_ack *extack); void (*dellink)(void *ctxt, struct net_device *dev, struct list_head *head); + + ANDROID_KABI_RESERVE(1); + ANDROID_KABI_RESERVE(2); }; int wwan_register_ops(struct device *parent, const struct wwan_ops *ops, From dd567c60ff3525ce38d45b0f2c612c82a010a114 Mon Sep 17 00:00:00 2001 From: Ramji Jiyani Date: Mon, 24 Jul 2023 07:15:49 +0000 Subject: [PATCH 17/98] ANDROID: GKI: Add Android ABI padding to wwan_port_ops Try to mitigate potential future api changes by adding a padding to struct wwan_port_ops. Fixes: 214e6f268b6a ("ANDROID: GKI: Add WWAN as GKI protected module") Bug: 287170531 Test: bazel run //common:kernel_aarch64_dist & TH Change-Id: I5589d9739ee547a3eb66ded432284691cf962023 Signed-off-by: Ramji Jiyani --- include/linux/wwan.h | 3 +++ 1 file changed, 3 insertions(+) diff --git a/include/linux/wwan.h b/include/linux/wwan.h index 7c2d5db089a1..e3ea3c12c588 100644 --- a/include/linux/wwan.h +++ b/include/linux/wwan.h @@ -61,6 +61,9 @@ struct wwan_port_ops { int (*tx_blocking)(struct wwan_port *port, struct sk_buff *skb); __poll_t (*tx_poll)(struct wwan_port *port, struct file *filp, poll_table *wait); + + ANDROID_KABI_RESERVE(1); + ANDROID_KABI_RESERVE(2); }; /** From 15a4b0d726c4ccd7c8b09cb97a54e4bce59c7f1d Mon Sep 17 00:00:00 2001 From: Yifan Hong Date: Thu, 20 Jul 2023 16:50:01 -0700 Subject: [PATCH 18/98] ANDROID: set kmi_symbol_list_add_only for Kleaf builds. On KMI frozen branches, symbols may no longer be removed from KMI symbol lists. This change sets kmi_symbol_list_add_only=true for Kleaf builds. Test: Treehugger Bug: 292106238 Change-Id: I74cf98ebad2705b92468c996e9b3b472447e8203 Signed-off-by: Yifan Hong --- BUILD.bazel | 2 ++ 1 file changed, 2 insertions(+) diff --git a/BUILD.bazel b/BUILD.bazel index b148c002b107..2a95ec15d4d2 100644 --- a/BUILD.bazel +++ b/BUILD.bazel @@ -76,6 +76,7 @@ define_common_kernels(target_configs = { "kmi_symbol_list_strict_mode": True, "module_implicit_outs": COMMON_GKI_MODULES_LIST, "kmi_symbol_list": "android/abi_gki_aarch64", + "kmi_symbol_list_add_only": True, "additional_kmi_symbol_lists": [":aarch64_additional_kmi_symbol_lists"], "protected_exports_list": "android/abi_gki_protected_exports_aarch64", "protected_modules_list": "android/gki_aarch64_protected_modules", @@ -90,6 +91,7 @@ define_common_kernels(target_configs = { "kmi_symbol_list_strict_mode": False, "module_implicit_outs": COMMON_GKI_MODULES_LIST, "kmi_symbol_list": "android/abi_gki_aarch64", + "kmi_symbol_list_add_only": True, "additional_kmi_symbol_lists": [":aarch64_additional_kmi_symbol_lists"], "protected_exports_list": "android/abi_gki_protected_exports_aarch64", "protected_modules_list": "android/gki_aarch64_protected_modules", From 0abc74db1acf858c4baeeb648335ba2f3b8a231b Mon Sep 17 00:00:00 2001 From: Ramji Jiyani Date: Thu, 20 Jul 2023 18:15:27 -0700 Subject: [PATCH 19/98] ANDROID: GKI: Move GKI module headers to generated includes Change build time generated GKI module headers location From :- kernel/module/gki_module_*.h To :- include/generated/gki_module_*.h This prevents the kernel source from being contaminated. By placing the header files in a generated directory, the default filters that ignore certain files will work without any special handling required. Bug: 286529877 Test: Manual verification & TH Change-Id: Ie247d1c132ddae54906de2e2850e95d7ae9edd50 Signed-off-by: Ramji Jiyani (cherry picked from commit e9cba885543fc50a5b59ff7234d02b74a380573c) --- kernel/module/Makefile | 8 ++++---- kernel/module/gki_module.c | 4 ++-- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/kernel/module/Makefile b/kernel/module/Makefile index a23e93c6ef10..458cb6e44e85 100644 --- a/kernel/module/Makefile +++ b/kernel/module/Makefile @@ -25,12 +25,12 @@ obj-$(CONFIG_MODULE_UNLOAD_TAINT_TRACKING) += tracking.o # ANDROID: GKI: Generate headerfiles required for gki_module.o # # Dependencies on generated files need to be listed explicitly -$(obj)/gki_module.o: $(obj)/gki_module_protected_exports.h \ - $(obj)/gki_module_unprotected.h +$(obj)/gki_module.o: include/generated/gki_module_protected_exports.h \ + include/generated/gki_module_unprotected.h ALL_KMI_SYMBOLS := all_kmi_symbols -$(obj)/gki_module_unprotected.h: $(ALL_KMI_SYMBOLS) \ +include/generated/gki_module_unprotected.h: $(ALL_KMI_SYMBOLS) \ $(srctree)/scripts/gen_gki_modules_headers.sh $(Q)$(CONFIG_SHELL) $(srctree)/scripts/gen_gki_modules_headers.sh $@ \ "$(srctree)" \ @@ -48,7 +48,7 @@ else ABI_PROTECTED_EXPORTS_FILE := $(wildcard $(srctree)/android/abi_gki_protected_exports_$(ARCH)) endif -$(obj)/gki_module_protected_exports.h: $(ABI_PROTECTED_EXPORTS_FILE) \ +include/generated/gki_module_protected_exports.h: $(ABI_PROTECTED_EXPORTS_FILE) \ $(srctree)/scripts/gen_gki_modules_headers.sh $(Q)$(CONFIG_SHELL) $(srctree)/scripts/gen_gki_modules_headers.sh $@ \ "$(srctree)" \ diff --git a/kernel/module/gki_module.c b/kernel/module/gki_module.c index 4f124f9a14ec..65a2883b539e 100644 --- a/kernel/module/gki_module.c +++ b/kernel/module/gki_module.c @@ -16,8 +16,8 @@ * gki_module_protected_exports.h -- Symbols protected from _export_ by unsigned modules * gki_module_unprotected.h -- Symbols allowed to _access_ by unsigned modules */ -#include "gki_module_protected_exports.h" -#include "gki_module_unprotected.h" +#include +#include #define MAX_STRCMP_LEN (max(MAX_UNPROTECTED_NAME_LEN, MAX_PROTECTED_EXPORTS_NAME_LEN)) From 17a080d04ef4475fc1cbac904aac942ee808dbb3 Mon Sep 17 00:00:00 2001 From: Samuel Gosselin Date: Sat, 22 Jul 2023 20:05:10 +0000 Subject: [PATCH 20/98] ANDROID: ABI: Update pixel symbol list 1 function symbol(s) added 'int extcon_set_property_sync(struct extcon_dev *, unsigned int, unsigned int, union extcon_property_value)' Bug: 289529571 Change-Id: I93a0a0e10540147fa2f626c6b1e8aa62800f58cb Signed-off-by: Samuel Gosselin --- android/abi_gki_aarch64.stg | 10 ++++++++++ android/abi_gki_aarch64_pixel | 1 + 2 files changed, 11 insertions(+) diff --git a/android/abi_gki_aarch64.stg b/android/abi_gki_aarch64.stg index 24f524b3e4c2..6922b6bf54ba 100644 --- a/android/abi_gki_aarch64.stg +++ b/android/abi_gki_aarch64.stg @@ -341753,6 +341753,15 @@ elf_symbol { type_id: 0x98851295 full_name: "extcon_set_property_capability" } +elf_symbol { + id: 0xb1dfbb02 + name: "extcon_set_property_sync" + is_defined: true + symbol_type: FUNCTION + crc: 0x710595c3 + type_id: 0x98850898 + full_name: "extcon_set_property_sync" +} elf_symbol { id: 0xacc42253 name: "extcon_set_state" @@ -380084,6 +380093,7 @@ interface { symbol_id: 0x3f648037 symbol_id: 0xc75616d8 symbol_id: 0x467358e5 + symbol_id: 0xb1dfbb02 symbol_id: 0xacc42253 symbol_id: 0x0a446897 symbol_id: 0xb107d2cd diff --git a/android/abi_gki_aarch64_pixel b/android/abi_gki_aarch64_pixel index b50236e61182..4ae71b6faf29 100644 --- a/android/abi_gki_aarch64_pixel +++ b/android/abi_gki_aarch64_pixel @@ -748,6 +748,7 @@ extcon_register_notifier extcon_set_property extcon_set_property_capability + extcon_set_property_sync extcon_set_state_sync extcon_unregister_notifier fasync_helper From 6eb48b89a513f80885fee2bffda0780aba392b23 Mon Sep 17 00:00:00 2001 From: kamasali Satyanarayan Date: Wed, 19 Jul 2023 14:57:13 +0530 Subject: [PATCH 21/98] ANDROID: GKI: Update abi_gki_aarch64_qcom Update abi_gki_aarch64_qcom with symbols needed for GCM_AES feature. Leaf changes summary: 3 artifacts changed Changed leaf types summary: 0 leaf type changed Removed/Changed/Added functions summary: 0 Removed, 0 Changed, 2 Added functions Removed/Changed/Added variables summary: 0 Removed, 0 Changed, 0 Added variables 2 Added functions: [A] 'function void crypto_inc(u8*, unsigned int)' [A] 'function void gf128mul_lle(be128*, const be128*)' 1 Added function symbol not referenced by debug info: [A] copy_page Bug: 279879797 Change-Id: I4b735b3517a4cd41c94731577a2b5ba6febaceed Signed-off-by: kamasali Satyanarayan --- android/abi_gki_aarch64.stg | 80 ++++++++++++++++++++++++++++++++++++ android/abi_gki_aarch64_qcom | 3 ++ 2 files changed, 83 insertions(+) diff --git a/android/abi_gki_aarch64.stg b/android/abi_gki_aarch64.stg index 6922b6bf54ba..44579ad07a54 100644 --- a/android/abi_gki_aarch64.stg +++ b/android/abi_gki_aarch64.stg @@ -12896,6 +12896,11 @@ pointer_reference { kind: POINTER pointee_type_id: 0x83286178 } +pointer_reference { + id: 0x2a5e3596 + kind: POINTER + pointee_type_id: 0x833830c5 +} pointer_reference { id: 0x2a5ed1c1 kind: POINTER @@ -23786,6 +23791,11 @@ pointer_reference { kind: POINTER pointee_type_id: 0xfcc23ab7 } +pointer_reference { + id: 0x35a7c1c3 + kind: POINTER + pointee_type_id: 0xfcdfe193 +} pointer_reference { id: 0x35ab6b03 kind: POINTER @@ -28341,6 +28351,11 @@ typedef { name: "bdaddr_t" referred_type_id: 0x0b690cd3 } +typedef { + id: 0x833830c5 + name: "be128" + referred_type_id: 0x3857842d +} typedef { id: 0x117ba19a name: "bh_end_io_t" @@ -33166,6 +33181,11 @@ qualified { qualifier: CONST qualified_type_id: 0x834f5c57 } +qualified { + id: 0xfcdfe193 + qualifier: CONST + qualified_type_id: 0x833830c5 +} qualified { id: 0xfd03f127 qualifier: CONST @@ -40221,6 +40241,11 @@ member { name: "a" type_id: 0xb02b353a } +member { + id: 0x80a3e3d3 + name: "a" + type_id: 0x7877cd32 +} member { id: 0x80f2085f name: "a" @@ -49151,6 +49176,12 @@ member { name: "b" type_id: 0x38df449f } +member { + id: 0x4ce00bb0 + name: "b" + type_id: 0x7877cd32 + offset: 64 +} member { id: 0x4cf8b2b0 name: "b" @@ -202748,6 +202779,15 @@ struct_union { member_id: 0x80f2085f } } +struct_union { + id: 0x3857842d + kind: STRUCT + definition { + bytesize: 16 + member_id: 0x80a3e3d3 + member_id: 0x4ce00bb0 + } +} struct_union { id: 0x3876ab11 kind: STRUCT @@ -277470,6 +277510,12 @@ function { return_type_id: 0x48b5725f parameter_id: 0x049d4e97 } +function { + id: 0x11bf8d42 + return_type_id: 0x48b5725f + parameter_id: 0x00c72527 + parameter_id: 0x4585663f +} function { id: 0x11c013b1 return_type_id: 0x48b5725f @@ -282808,6 +282854,12 @@ function { return_type_id: 0x48b5725f parameter_id: 0x2936263d } +function { + id: 0x1ad943f1 + return_type_id: 0x48b5725f + parameter_id: 0x2a5e3596 + parameter_id: 0x35a7c1c3 +} function { id: 0x1ad9d0a2 return_type_id: 0x48b5725f @@ -331299,6 +331351,13 @@ elf_symbol { type_id: 0x11228b4e full_name: "copy_highpage" } +elf_symbol { + id: 0xc1167624 + name: "copy_page" + is_defined: true + symbol_type: FUNCTION + crc: 0x4d0d163d +} elf_symbol { id: 0xd89255c2 name: "cpu_all_bits" @@ -332240,6 +332299,15 @@ elf_symbol { type_id: 0x9112accf full_name: "crypto_has_alg" } +elf_symbol { + id: 0x80e1f666 + name: "crypto_inc" + is_defined: true + symbol_type: FUNCTION + crc: 0x3ef051c8 + type_id: 0x11bf8d42 + full_name: "crypto_inc" +} elf_symbol { id: 0x62173925 name: "crypto_init_queue" @@ -343601,6 +343669,15 @@ elf_symbol { type_id: 0x11a59ba3 full_name: "getboottime64" } +elf_symbol { + id: 0x112db471 + name: "gf128mul_lle" + is_defined: true + symbol_type: FUNCTION + crc: 0x9e13f6f6 + type_id: 0x1ad943f1 + full_name: "gf128mul_lle" +} elf_symbol { id: 0xfe79963a name: "gfn_to_pfn_memslot" @@ -378933,6 +379010,7 @@ interface { symbol_id: 0x9e7d8d76 symbol_id: 0x610edc84 symbol_id: 0xd71898b4 + symbol_id: 0xc1167624 symbol_id: 0xd89255c2 symbol_id: 0x962b6a68 symbol_id: 0x33bbeca6 @@ -379038,6 +379116,7 @@ interface { symbol_id: 0xbf39e9a5 symbol_id: 0x4d4a15b0 symbol_id: 0xfc625698 + symbol_id: 0x80e1f666 symbol_id: 0x62173925 symbol_id: 0x053cd2eb symbol_id: 0xd1471c13 @@ -380298,6 +380377,7 @@ interface { symbol_id: 0x4ba4e06f symbol_id: 0xbac82e84 symbol_id: 0xa8319a8c + symbol_id: 0x112db471 symbol_id: 0xfe79963a symbol_id: 0xbc19d975 symbol_id: 0x6dc59ee7 diff --git a/android/abi_gki_aarch64_qcom b/android/abi_gki_aarch64_qcom index ec0a9c3f3bb3..f1155a5fb2b8 100644 --- a/android/abi_gki_aarch64_qcom +++ b/android/abi_gki_aarch64_qcom @@ -340,6 +340,7 @@ contig_page_data _copy_from_iter copy_from_kernel_nofault + copy_page __copy_overflow _copy_to_iter __cpu_active_mask @@ -429,6 +430,7 @@ crypto_get_default_rng crypto_has_ahash crypto_has_alg + crypto_inc crypto_init_queue __crypto_memneq crypto_put_default_rng @@ -1232,6 +1234,7 @@ get_user_ifreq get_user_pages get_zeroed_page + gf128mul_lle gh_rm_call gh_rm_notifier_register gh_rm_notifier_unregister From 0ee75a672ca5043d1465ac017c2d70879fbbf8f0 Mon Sep 17 00:00:00 2001 From: Konstantin Komarov Date: Mon, 10 Oct 2022 13:15:33 +0300 Subject: [PATCH 22/98] UPSTREAM: fs/ntfs3: Check fields while reading commit 0e8235d28f3a0e9eda9f02ff67ee566d5f42b66b upstream. Added new functions index_hdr_check and index_buf_check. Now we check all stuff for correctness while reading from disk. Also fixed bug with stale nfs data. Bug: 286390611 Reported-by: van fantasy Signed-off-by: Konstantin Komarov Fixes: 82cae269cfa95 ("fs/ntfs3: Add initialization of super block") Signed-off-by: Lee Jones Signed-off-by: Greg Kroah-Hartman (cherry picked from commit 000a9a72efa4a9df289bab9c9e8ba1639c72e0d6) Signed-off-by: Lee Jones Change-Id: I2b17511acdef8617aea3fecb45d2f11e49145097 --- fs/ntfs3/index.c | 84 ++++++++++++++++++++++++++++++---- fs/ntfs3/inode.c | 18 ++++---- fs/ntfs3/ntfs_fs.h | 4 +- fs/ntfs3/run.c | 7 ++- fs/ntfs3/xattr.c | 109 +++++++++++++++++++++++++++++---------------- 5 files changed, 164 insertions(+), 58 deletions(-) diff --git a/fs/ntfs3/index.c b/fs/ntfs3/index.c index c27b4fe57513..24a26744a691 100644 --- a/fs/ntfs3/index.c +++ b/fs/ntfs3/index.c @@ -605,11 +605,58 @@ static const struct NTFS_DE *hdr_insert_head(struct INDEX_HDR *hdr, return e; } +/* + * index_hdr_check + * + * return true if INDEX_HDR is valid + */ +static bool index_hdr_check(const struct INDEX_HDR *hdr, u32 bytes) +{ + u32 end = le32_to_cpu(hdr->used); + u32 tot = le32_to_cpu(hdr->total); + u32 off = le32_to_cpu(hdr->de_off); + + if (!IS_ALIGNED(off, 8) || tot > bytes || end > tot || + off + sizeof(struct NTFS_DE) > end) { + /* incorrect index buffer. */ + return false; + } + + return true; +} + +/* + * index_buf_check + * + * return true if INDEX_BUFFER seems is valid + */ +static bool index_buf_check(const struct INDEX_BUFFER *ib, u32 bytes, + const CLST *vbn) +{ + const struct NTFS_RECORD_HEADER *rhdr = &ib->rhdr; + u16 fo = le16_to_cpu(rhdr->fix_off); + u16 fn = le16_to_cpu(rhdr->fix_num); + + if (bytes <= offsetof(struct INDEX_BUFFER, ihdr) || + rhdr->sign != NTFS_INDX_SIGNATURE || + fo < sizeof(struct INDEX_BUFFER) + /* Check index buffer vbn. */ + || (vbn && *vbn != le64_to_cpu(ib->vbn)) || (fo % sizeof(short)) || + fo + fn * sizeof(short) >= bytes || + fn != ((bytes >> SECTOR_SHIFT) + 1)) { + /* incorrect index buffer. */ + return false; + } + + return index_hdr_check(&ib->ihdr, + bytes - offsetof(struct INDEX_BUFFER, ihdr)); +} + void fnd_clear(struct ntfs_fnd *fnd) { int i; - for (i = 0; i < fnd->level; i++) { + for (i = fnd->level - 1; i >= 0; i--) { struct indx_node *n = fnd->nodes[i]; if (!n) @@ -820,9 +867,16 @@ int indx_init(struct ntfs_index *indx, struct ntfs_sb_info *sbi, u32 t32; const struct INDEX_ROOT *root = resident_data(attr); + t32 = le32_to_cpu(attr->res.data_size); + if (t32 <= offsetof(struct INDEX_ROOT, ihdr) || + !index_hdr_check(&root->ihdr, + t32 - offsetof(struct INDEX_ROOT, ihdr))) { + goto out; + } + /* Check root fields. */ if (!root->index_block_clst) - return -EINVAL; + goto out; indx->type = type; indx->idx2vbn_bits = __ffs(root->index_block_clst); @@ -834,19 +888,19 @@ int indx_init(struct ntfs_index *indx, struct ntfs_sb_info *sbi, if (t32 < sbi->cluster_size) { /* Index record is smaller than a cluster, use 512 blocks. */ if (t32 != root->index_block_clst * SECTOR_SIZE) - return -EINVAL; + goto out; /* Check alignment to a cluster. */ if ((sbi->cluster_size >> SECTOR_SHIFT) & (root->index_block_clst - 1)) { - return -EINVAL; + goto out; } indx->vbn2vbo_bits = SECTOR_SHIFT; } else { /* Index record must be a multiple of cluster size. */ if (t32 != root->index_block_clst << sbi->cluster_bits) - return -EINVAL; + goto out; indx->vbn2vbo_bits = sbi->cluster_bits; } @@ -854,7 +908,14 @@ int indx_init(struct ntfs_index *indx, struct ntfs_sb_info *sbi, init_rwsem(&indx->run_lock); indx->cmp = get_cmp_func(root); - return indx->cmp ? 0 : -EINVAL; + if (!indx->cmp) + goto out; + + return 0; + +out: + ntfs_set_state(sbi, NTFS_DIRTY_DIRTY); + return -EINVAL; } static struct indx_node *indx_new(struct ntfs_index *indx, @@ -1012,6 +1073,13 @@ int indx_read(struct ntfs_index *indx, struct ntfs_inode *ni, CLST vbn, goto out; ok: + if (!index_buf_check(ib, bytes, &vbn)) { + ntfs_inode_err(&ni->vfs_inode, "directory corrupted"); + ntfs_set_state(ni->mi.sbi, NTFS_DIRTY_ERROR); + err = -EINVAL; + goto out; + } + if (err == -E_NTFS_FIXUP) { ntfs_write_bh(ni->mi.sbi, &ib->rhdr, &in->nb, 0); err = 0; @@ -1599,9 +1667,9 @@ static int indx_insert_into_root(struct ntfs_index *indx, struct ntfs_inode *ni, if (err) { /* Restore root. */ - if (mi_resize_attr(mi, attr, -ds_root)) + if (mi_resize_attr(mi, attr, -ds_root)) { memcpy(attr, a_root, asize); - else { + } else { /* Bug? */ ntfs_set_state(sbi, NTFS_DIRTY_ERROR); } diff --git a/fs/ntfs3/inode.c b/fs/ntfs3/inode.c index 22152300e60c..ece7daa2266a 100644 --- a/fs/ntfs3/inode.c +++ b/fs/ntfs3/inode.c @@ -81,7 +81,7 @@ static struct inode *ntfs_read_mft(struct inode *inode, le16_to_cpu(ref->seq), le16_to_cpu(rec->seq)); goto out; } else if (!is_rec_inuse(rec)) { - err = -EINVAL; + err = -ESTALE; ntfs_err(sb, "Inode r=%x is not in use!", (u32)ino); goto out; } @@ -92,8 +92,10 @@ static struct inode *ntfs_read_mft(struct inode *inode, goto out; } - if (!is_rec_base(rec)) - goto Ok; + if (!is_rec_base(rec)) { + err = -EINVAL; + goto out; + } /* Record should contain $I30 root. */ is_dir = rec->flags & RECORD_FLAG_DIR; @@ -466,7 +468,6 @@ end_enum: inode->i_flags |= S_NOSEC; } -Ok: if (ino == MFT_REC_MFT && !sb->s_root) sbi->mft.ni = NULL; @@ -520,6 +521,9 @@ struct inode *ntfs_iget5(struct super_block *sb, const struct MFT_REF *ref, _ntfs_bad_inode(inode); } + if (IS_ERR(inode) && name) + ntfs_set_state(sb->s_fs_info, NTFS_DIRTY_ERROR); + return inode; } @@ -1635,10 +1639,8 @@ out6: ntfs_remove_reparse(sbi, IO_REPARSE_TAG_SYMLINK, &new_de->ref); out5: - if (S_ISDIR(mode) || run_is_empty(&ni->file.run)) - goto out4; - - run_deallocate(sbi, &ni->file.run, false); + if (!S_ISDIR(mode)) + run_deallocate(sbi, &ni->file.run, false); out4: clear_rec_inuse(rec); diff --git a/fs/ntfs3/ntfs_fs.h b/fs/ntfs3/ntfs_fs.h index ca8b4d273feb..60c944d2811d 100644 --- a/fs/ntfs3/ntfs_fs.h +++ b/fs/ntfs3/ntfs_fs.h @@ -794,12 +794,12 @@ int run_pack(const struct runs_tree *run, CLST svcn, CLST len, u8 *run_buf, u32 run_buf_size, CLST *packed_vcns); int run_unpack(struct runs_tree *run, struct ntfs_sb_info *sbi, CLST ino, CLST svcn, CLST evcn, CLST vcn, const u8 *run_buf, - u32 run_buf_size); + int run_buf_size); #ifdef NTFS3_CHECK_FREE_CLST int run_unpack_ex(struct runs_tree *run, struct ntfs_sb_info *sbi, CLST ino, CLST svcn, CLST evcn, CLST vcn, const u8 *run_buf, - u32 run_buf_size); + int run_buf_size); #else #define run_unpack_ex run_unpack #endif diff --git a/fs/ntfs3/run.c b/fs/ntfs3/run.c index aaaa0d3d35a2..12d8682f33b5 100644 --- a/fs/ntfs3/run.c +++ b/fs/ntfs3/run.c @@ -919,12 +919,15 @@ out: */ int run_unpack(struct runs_tree *run, struct ntfs_sb_info *sbi, CLST ino, CLST svcn, CLST evcn, CLST vcn, const u8 *run_buf, - u32 run_buf_size) + int run_buf_size) { u64 prev_lcn, vcn64, lcn, next_vcn; const u8 *run_last, *run_0; bool is_mft = ino == MFT_REC_MFT; + if (run_buf_size < 0) + return -EINVAL; + /* Check for empty. */ if (evcn + 1 == svcn) return 0; @@ -1046,7 +1049,7 @@ int run_unpack(struct runs_tree *run, struct ntfs_sb_info *sbi, CLST ino, */ int run_unpack_ex(struct runs_tree *run, struct ntfs_sb_info *sbi, CLST ino, CLST svcn, CLST evcn, CLST vcn, const u8 *run_buf, - u32 run_buf_size) + int run_buf_size) { int ret, err; CLST next_vcn, lcn, len; diff --git a/fs/ntfs3/xattr.c b/fs/ntfs3/xattr.c index ea582b4fe1d9..884781e423e1 100644 --- a/fs/ntfs3/xattr.c +++ b/fs/ntfs3/xattr.c @@ -42,28 +42,26 @@ static inline size_t packed_ea_size(const struct EA_FULL *ea) * Assume there is at least one xattr in the list. */ static inline bool find_ea(const struct EA_FULL *ea_all, u32 bytes, - const char *name, u8 name_len, u32 *off) + const char *name, u8 name_len, u32 *off, u32 *ea_sz) { - *off = 0; + u32 ea_size; - if (!ea_all || !bytes) + *off = 0; + if (!ea_all) return false; - for (;;) { + for (; *off < bytes; *off += ea_size) { const struct EA_FULL *ea = Add2Ptr(ea_all, *off); - u32 next_off = *off + unpacked_ea_size(ea); - - if (next_off > bytes) - return false; - + ea_size = unpacked_ea_size(ea); if (ea->name_len == name_len && - !memcmp(ea->name, name, name_len)) + !memcmp(ea->name, name, name_len)) { + if (ea_sz) + *ea_sz = ea_size; return true; - - *off = next_off; - if (next_off >= bytes) - return false; + } } + + return false; } /* @@ -74,12 +72,12 @@ static inline bool find_ea(const struct EA_FULL *ea_all, u32 bytes, static int ntfs_read_ea(struct ntfs_inode *ni, struct EA_FULL **ea, size_t add_bytes, const struct EA_INFO **info) { - int err; + int err = -EINVAL; struct ntfs_sb_info *sbi = ni->mi.sbi; struct ATTR_LIST_ENTRY *le = NULL; struct ATTRIB *attr_info, *attr_ea; void *ea_p; - u32 size; + u32 size, off, ea_size; static_assert(le32_to_cpu(ATTR_EA_INFO) < le32_to_cpu(ATTR_EA)); @@ -96,24 +94,31 @@ static int ntfs_read_ea(struct ntfs_inode *ni, struct EA_FULL **ea, *info = resident_data_ex(attr_info, sizeof(struct EA_INFO)); if (!*info) - return -EINVAL; + goto out; /* Check Ea limit. */ size = le32_to_cpu((*info)->size); - if (size > sbi->ea_max_size) - return -EFBIG; + if (size > sbi->ea_max_size) { + err = -EFBIG; + goto out; + } - if (attr_size(attr_ea) > sbi->ea_max_size) - return -EFBIG; + if (attr_size(attr_ea) > sbi->ea_max_size) { + err = -EFBIG; + goto out; + } + + if (!size) { + /* EA info persists, but xattr is empty. Looks like EA problem. */ + goto out; + } /* Allocate memory for packed Ea. */ ea_p = kmalloc(size_add(size, add_bytes), GFP_NOFS); if (!ea_p) return -ENOMEM; - if (!size) { - /* EA info persists, but xattr is empty. Looks like EA problem. */ - } else if (attr_ea->non_res) { + if (attr_ea->non_res) { struct runs_tree run; run_init(&run); @@ -124,24 +129,52 @@ static int ntfs_read_ea(struct ntfs_inode *ni, struct EA_FULL **ea, run_close(&run); if (err) - goto out; + goto out1; } else { void *p = resident_data_ex(attr_ea, size); - if (!p) { - err = -EINVAL; - goto out; - } + if (!p) + goto out1; memcpy(ea_p, p, size); } memset(Add2Ptr(ea_p, size), 0, add_bytes); + + /* Check all attributes for consistency. */ + for (off = 0; off < size; off += ea_size) { + const struct EA_FULL *ef = Add2Ptr(ea_p, off); + u32 bytes = size - off; + + /* Check if we can use field ea->size. */ + if (bytes < sizeof(ef->size)) + goto out1; + + if (ef->size) { + ea_size = le32_to_cpu(ef->size); + if (ea_size > bytes) + goto out1; + continue; + } + + /* Check if we can use fields ef->name_len and ef->elength. */ + if (bytes < offsetof(struct EA_FULL, name)) + goto out1; + + ea_size = ALIGN(struct_size(ef, name, + 1 + ef->name_len + + le16_to_cpu(ef->elength)), + 4); + if (ea_size > bytes) + goto out1; + } + *ea = ea_p; return 0; -out: +out1: kfree(ea_p); - *ea = NULL; +out: + ntfs_set_state(sbi, NTFS_DIRTY_DIRTY); return err; } @@ -163,6 +196,7 @@ static ssize_t ntfs_list_ea(struct ntfs_inode *ni, char *buffer, const struct EA_FULL *ea; u32 off, size; int err; + int ea_size; size_t ret; err = ntfs_read_ea(ni, &ea_all, 0, &info); @@ -175,8 +209,9 @@ static ssize_t ntfs_list_ea(struct ntfs_inode *ni, char *buffer, size = le32_to_cpu(info->size); /* Enumerate all xattrs. */ - for (ret = 0, off = 0; off < size; off += unpacked_ea_size(ea)) { + for (ret = 0, off = 0; off < size; off += ea_size) { ea = Add2Ptr(ea_all, off); + ea_size = unpacked_ea_size(ea); if (buffer) { if (ret + ea->name_len + 1 > bytes_per_buffer) { @@ -227,7 +262,8 @@ static int ntfs_get_ea(struct inode *inode, const char *name, size_t name_len, goto out; /* Enumerate all xattrs. */ - if (!find_ea(ea_all, le32_to_cpu(info->size), name, name_len, &off)) { + if (!find_ea(ea_all, le32_to_cpu(info->size), name, name_len, &off, + NULL)) { err = -ENODATA; goto out; } @@ -269,7 +305,7 @@ static noinline int ntfs_set_ea(struct inode *inode, const char *name, struct EA_FULL *new_ea; struct EA_FULL *ea_all = NULL; size_t add, new_pack; - u32 off, size; + u32 off, size, ea_sz; __le16 size_pack; struct ATTRIB *attr; struct ATTR_LIST_ENTRY *le; @@ -304,9 +340,8 @@ static noinline int ntfs_set_ea(struct inode *inode, const char *name, size_pack = ea_info.size_pack; } - if (info && find_ea(ea_all, size, name, name_len, &off)) { + if (info && find_ea(ea_all, size, name, name_len, &off, &ea_sz)) { struct EA_FULL *ea; - size_t ea_sz; if (flags & XATTR_CREATE) { err = -EEXIST; @@ -329,8 +364,6 @@ static noinline int ntfs_set_ea(struct inode *inode, const char *name, if (ea->flags & FILE_NEED_EA) le16_add_cpu(&ea_info.count, -1); - ea_sz = unpacked_ea_size(ea); - le16_add_cpu(&ea_info.size_pack, 0 - packed_ea_size(ea)); memmove(ea, Add2Ptr(ea, ea_sz), size - off - ea_sz); From 1bb5e7fb374bcc59a940f3eb3dab1a1195ddbbca Mon Sep 17 00:00:00 2001 From: Venkata Rao Kakani Date: Tue, 18 Jul 2023 09:51:21 +0530 Subject: [PATCH 23/98] ANDROID: abi_gki_aarch64_qcom: update abi Update the qcom symbol list for iommu_group_remove_device Symbols added: iommu_group_remove_device Bug: 291567032 Change-Id: Ie53809a8b22259db07cc43b008a7fe5b324e3e65 Signed-off-by: Venkata Rao Kakani --- android/abi_gki_aarch64.stg | 10 ++++++++++ android/abi_gki_aarch64_qcom | 1 + 2 files changed, 11 insertions(+) diff --git a/android/abi_gki_aarch64.stg b/android/abi_gki_aarch64.stg index 44579ad07a54..e30c34f73e88 100644 --- a/android/abi_gki_aarch64.stg +++ b/android/abi_gki_aarch64.stg @@ -347323,6 +347323,15 @@ elf_symbol { type_id: 0x7ceab5d7 full_name: "iommu_group_ref_get" } +elf_symbol { + id: 0x87342c78 + name: "iommu_group_remove_device" + is_defined: true + symbol_type: FUNCTION + crc: 0x65e2cdf3 + type_id: 0x100e6fc8 + full_name: "iommu_group_remove_device" +} elf_symbol { id: 0x1f9ceb72 name: "iommu_group_set_iommudata" @@ -380783,6 +380792,7 @@ interface { symbol_id: 0xadf1bba5 symbol_id: 0x1a299344 symbol_id: 0xe52a90e5 + symbol_id: 0x87342c78 symbol_id: 0x1f9ceb72 symbol_id: 0x119c23e5 symbol_id: 0x9aea043a diff --git a/android/abi_gki_aarch64_qcom b/android/abi_gki_aarch64_qcom index f1155a5fb2b8..b2ac2bce8d43 100644 --- a/android/abi_gki_aarch64_qcom +++ b/android/abi_gki_aarch64_qcom @@ -1544,6 +1544,7 @@ iommu_group_get_iommudata iommu_group_put iommu_group_ref_get + iommu_group_remove_device iommu_group_set_iommudata iommu_iova_to_phys iommu_map From f091cc74342604b2a2b0bb64114ccb5605e88737 Mon Sep 17 00:00:00 2001 From: Pablo Neira Ayuso Date: Fri, 16 Jun 2023 14:45:22 +0200 Subject: [PATCH 24/98] UPSTREAM: netfilter: nf_tables: fix chain binding transaction logic [ Upstream commit 4bedf9eee016286c835e3d8fa981ddece5338795 ] Add bound flag to rule and chain transactions as in 6a0a8d10a366 ("netfilter: nf_tables: use-after-free in failing rule with bound set") to skip them in case that the chain is already bound from the abort path. This patch fixes an imbalance in the chain use refcnt that triggers a WARN_ON on the table and chain destroy path. This patch also disallows nested chain bindings, which is not supported from userspace. The logic to deal with chain binding in nft_data_hold() and nft_data_release() is not correct. The NFT_TRANS_PREPARE state needs a special handling in case a chain is bound but next expressions in the same rule fail to initialize as described by 1240eb93f061 ("netfilter: nf_tables: incorrect error path handling with NFT_MSG_NEWRULE"). The chain is left bound if rule construction fails, so the objects stored in this chain (and the chain itself) are released by the transaction records from the abort path, follow up patch ("netfilter: nf_tables: add NFT_TRANS_PREPARE_ERROR to deal with bound set/chain") completes this error handling. When deleting an existing rule, chain bound flag is set off so the rule expression .destroy path releases the objects. Bug: 292097846 Fixes: d0e2c7de92c7 ("netfilter: nf_tables: add NFT_CHAIN_BINDING") Signed-off-by: Pablo Neira Ayuso Signed-off-by: Sasha Levin (cherry picked from commit 891cd2edddc76c58e842706ad27e2ff96000bd5d) Signed-off-by: Lee Jones Change-Id: I8a8cf012e9e6fd0d0081f3f7616c9cf31ea02989 --- include/net/netfilter/nf_tables.h | 21 +++++++- net/netfilter/nf_tables_api.c | 86 +++++++++++++++++++----------- net/netfilter/nft_immediate.c | 87 +++++++++++++++++++++++++++---- 3 files changed, 153 insertions(+), 41 deletions(-) diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h index a1ccf1276f3e..cfc9aa5c059f 100644 --- a/include/net/netfilter/nf_tables.h +++ b/include/net/netfilter/nf_tables.h @@ -1000,7 +1000,10 @@ static inline struct nft_userdata *nft_userdata(const struct nft_rule *rule) return (void *)&rule->data[rule->dlen]; } -void nf_tables_rule_release(const struct nft_ctx *ctx, struct nft_rule *rule); +void nft_rule_expr_activate(const struct nft_ctx *ctx, struct nft_rule *rule); +void nft_rule_expr_deactivate(const struct nft_ctx *ctx, struct nft_rule *rule, + enum nft_trans_phase phase); +void nf_tables_rule_destroy(const struct nft_ctx *ctx, struct nft_rule *rule); static inline void nft_set_elem_update_expr(const struct nft_set_ext *ext, struct nft_regs *regs, @@ -1083,6 +1086,7 @@ int nft_setelem_validate(const struct nft_ctx *ctx, struct nft_set *set, const struct nft_set_iter *iter, struct nft_set_elem *elem); int nft_set_catchall_validate(const struct nft_ctx *ctx, struct nft_set *set); +int nf_tables_bind_chain(const struct nft_ctx *ctx, struct nft_chain *chain); enum nft_chain_types { NFT_CHAIN_T_DEFAULT = 0, @@ -1119,11 +1123,17 @@ int nft_chain_validate_dependency(const struct nft_chain *chain, int nft_chain_validate_hooks(const struct nft_chain *chain, unsigned int hook_flags); +static inline bool nft_chain_binding(const struct nft_chain *chain) +{ + return chain->flags & NFT_CHAIN_BINDING; +} + static inline bool nft_chain_is_bound(struct nft_chain *chain) { return (chain->flags & NFT_CHAIN_BINDING) && chain->bound; } +int nft_chain_add(struct nft_table *table, struct nft_chain *chain); void nft_chain_del(struct nft_chain *chain); void nf_tables_chain_destroy(struct nft_ctx *ctx); @@ -1558,6 +1568,7 @@ struct nft_trans_rule { struct nft_rule *rule; struct nft_flow_rule *flow; u32 rule_id; + bool bound; }; #define nft_trans_rule(trans) \ @@ -1566,6 +1577,8 @@ struct nft_trans_rule { (((struct nft_trans_rule *)trans->data)->flow) #define nft_trans_rule_id(trans) \ (((struct nft_trans_rule *)trans->data)->rule_id) +#define nft_trans_rule_bound(trans) \ + (((struct nft_trans_rule *)trans->data)->bound) struct nft_trans_set { struct nft_set *set; @@ -1590,13 +1603,17 @@ struct nft_trans_set { (((struct nft_trans_set *)trans->data)->gc_int) struct nft_trans_chain { + struct nft_chain *chain; bool update; char *name; struct nft_stats __percpu *stats; u8 policy; + bool bound; u32 chain_id; }; +#define nft_trans_chain(trans) \ + (((struct nft_trans_chain *)trans->data)->chain) #define nft_trans_chain_update(trans) \ (((struct nft_trans_chain *)trans->data)->update) #define nft_trans_chain_name(trans) \ @@ -1605,6 +1622,8 @@ struct nft_trans_chain { (((struct nft_trans_chain *)trans->data)->stats) #define nft_trans_chain_policy(trans) \ (((struct nft_trans_chain *)trans->data)->policy) +#define nft_trans_chain_bound(trans) \ + (((struct nft_trans_chain *)trans->data)->bound) #define nft_trans_chain_id(trans) \ (((struct nft_trans_chain *)trans->data)->chain_id) diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index 7a2cc24e9a33..c8786b24ab42 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -195,6 +195,48 @@ static void nft_set_trans_bind(const struct nft_ctx *ctx, struct nft_set *set) } } +static void nft_chain_trans_bind(const struct nft_ctx *ctx, struct nft_chain *chain) +{ + struct nftables_pernet *nft_net; + struct net *net = ctx->net; + struct nft_trans *trans; + + if (!nft_chain_binding(chain)) + return; + + nft_net = nft_pernet(net); + list_for_each_entry_reverse(trans, &nft_net->commit_list, list) { + switch (trans->msg_type) { + case NFT_MSG_NEWCHAIN: + if (nft_trans_chain(trans) == chain) + nft_trans_chain_bound(trans) = true; + break; + case NFT_MSG_NEWRULE: + if (trans->ctx.chain == chain) + nft_trans_rule_bound(trans) = true; + break; + } + } +} + +int nf_tables_bind_chain(const struct nft_ctx *ctx, struct nft_chain *chain) +{ + if (!nft_chain_binding(chain)) + return 0; + + if (nft_chain_binding(ctx->chain)) + return -EOPNOTSUPP; + + if (chain->bound) + return -EBUSY; + + chain->bound = true; + chain->use++; + nft_chain_trans_bind(ctx, chain); + + return 0; +} + static int nft_netdev_register_hooks(struct net *net, struct list_head *hook_list) { @@ -340,8 +382,9 @@ static struct nft_trans *nft_trans_chain_add(struct nft_ctx *ctx, int msg_type) ntohl(nla_get_be32(ctx->nla[NFTA_CHAIN_ID])); } } - + nft_trans_chain(trans) = ctx->chain; nft_trans_commit_list_add_tail(ctx->net, trans); + return trans; } @@ -359,8 +402,7 @@ static int nft_delchain(struct nft_ctx *ctx) return 0; } -static void nft_rule_expr_activate(const struct nft_ctx *ctx, - struct nft_rule *rule) +void nft_rule_expr_activate(const struct nft_ctx *ctx, struct nft_rule *rule) { struct nft_expr *expr; @@ -373,9 +415,8 @@ static void nft_rule_expr_activate(const struct nft_ctx *ctx, } } -static void nft_rule_expr_deactivate(const struct nft_ctx *ctx, - struct nft_rule *rule, - enum nft_trans_phase phase) +void nft_rule_expr_deactivate(const struct nft_ctx *ctx, struct nft_rule *rule, + enum nft_trans_phase phase) { struct nft_expr *expr; @@ -2188,7 +2229,7 @@ static int nft_basechain_init(struct nft_base_chain *basechain, u8 family, return 0; } -static int nft_chain_add(struct nft_table *table, struct nft_chain *chain) +int nft_chain_add(struct nft_table *table, struct nft_chain *chain) { int err; @@ -3315,8 +3356,7 @@ err_fill_rule_info: return err; } -static void nf_tables_rule_destroy(const struct nft_ctx *ctx, - struct nft_rule *rule) +void nf_tables_rule_destroy(const struct nft_ctx *ctx, struct nft_rule *rule) { struct nft_expr *expr, *next; @@ -3333,7 +3373,7 @@ static void nf_tables_rule_destroy(const struct nft_ctx *ctx, kfree(rule); } -void nf_tables_rule_release(const struct nft_ctx *ctx, struct nft_rule *rule) +static void nf_tables_rule_release(const struct nft_ctx *ctx, struct nft_rule *rule) { nft_rule_expr_deactivate(ctx, rule, NFT_TRANS_RELEASE); nf_tables_rule_destroy(ctx, rule); @@ -6447,7 +6487,6 @@ static int nf_tables_newsetelem(struct sk_buff *skb, void nft_data_hold(const struct nft_data *data, enum nft_data_types type) { struct nft_chain *chain; - struct nft_rule *rule; if (type == NFT_DATA_VERDICT) { switch (data->verdict.code) { @@ -6455,15 +6494,6 @@ void nft_data_hold(const struct nft_data *data, enum nft_data_types type) case NFT_GOTO: chain = data->verdict.chain; chain->use++; - - if (!nft_chain_is_bound(chain)) - break; - - chain->table->use++; - list_for_each_entry(rule, &chain->rules, list) - chain->use++; - - nft_chain_add(chain->table, chain); break; } } @@ -9325,7 +9355,7 @@ static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action) kfree(nft_trans_chain_name(trans)); nft_trans_destroy(trans); } else { - if (nft_chain_is_bound(trans->ctx.chain)) { + if (nft_trans_chain_bound(trans)) { nft_trans_destroy(trans); break; } @@ -9342,6 +9372,10 @@ static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action) nft_trans_destroy(trans); break; case NFT_MSG_NEWRULE: + if (nft_trans_rule_bound(trans)) { + nft_trans_destroy(trans); + break; + } trans->ctx.chain->use--; list_del_rcu(&nft_trans_rule(trans)->list); nft_rule_expr_deactivate(&trans->ctx, @@ -9893,22 +9927,12 @@ static int nft_verdict_init(const struct nft_ctx *ctx, struct nft_data *data, static void nft_verdict_uninit(const struct nft_data *data) { struct nft_chain *chain; - struct nft_rule *rule; switch (data->verdict.code) { case NFT_JUMP: case NFT_GOTO: chain = data->verdict.chain; chain->use--; - - if (!nft_chain_is_bound(chain)) - break; - - chain->table->use--; - list_for_each_entry(rule, &chain->rules, list) - chain->use--; - - nft_chain_del(chain); break; } } diff --git a/net/netfilter/nft_immediate.c b/net/netfilter/nft_immediate.c index 5f28b21abc7d..457fc1e21841 100644 --- a/net/netfilter/nft_immediate.c +++ b/net/netfilter/nft_immediate.c @@ -76,11 +76,9 @@ static int nft_immediate_init(const struct nft_ctx *ctx, switch (priv->data.verdict.code) { case NFT_JUMP: case NFT_GOTO: - if (nft_chain_is_bound(chain)) { - err = -EBUSY; - goto err1; - } - chain->bound = true; + err = nf_tables_bind_chain(ctx, chain); + if (err < 0) + return err; break; default: break; @@ -98,6 +96,31 @@ static void nft_immediate_activate(const struct nft_ctx *ctx, const struct nft_expr *expr) { const struct nft_immediate_expr *priv = nft_expr_priv(expr); + const struct nft_data *data = &priv->data; + struct nft_ctx chain_ctx; + struct nft_chain *chain; + struct nft_rule *rule; + + if (priv->dreg == NFT_REG_VERDICT) { + switch (data->verdict.code) { + case NFT_JUMP: + case NFT_GOTO: + chain = data->verdict.chain; + if (!nft_chain_binding(chain)) + break; + + chain_ctx = *ctx; + chain_ctx.chain = chain; + + list_for_each_entry(rule, &chain->rules, list) + nft_rule_expr_activate(&chain_ctx, rule); + + nft_clear(ctx->net, chain); + break; + default: + break; + } + } return nft_data_hold(&priv->data, nft_dreg_to_type(priv->dreg)); } @@ -107,6 +130,40 @@ static void nft_immediate_deactivate(const struct nft_ctx *ctx, enum nft_trans_phase phase) { const struct nft_immediate_expr *priv = nft_expr_priv(expr); + const struct nft_data *data = &priv->data; + struct nft_ctx chain_ctx; + struct nft_chain *chain; + struct nft_rule *rule; + + if (priv->dreg == NFT_REG_VERDICT) { + switch (data->verdict.code) { + case NFT_JUMP: + case NFT_GOTO: + chain = data->verdict.chain; + if (!nft_chain_binding(chain)) + break; + + chain_ctx = *ctx; + chain_ctx.chain = chain; + + list_for_each_entry(rule, &chain->rules, list) + nft_rule_expr_deactivate(&chain_ctx, rule, phase); + + switch (phase) { + case NFT_TRANS_PREPARE: + nft_deactivate_next(ctx->net, chain); + break; + default: + nft_chain_del(chain); + chain->bound = false; + chain->table->use--; + break; + } + break; + default: + break; + } + } if (phase == NFT_TRANS_COMMIT) return; @@ -131,15 +188,27 @@ static void nft_immediate_destroy(const struct nft_ctx *ctx, case NFT_GOTO: chain = data->verdict.chain; - if (!nft_chain_is_bound(chain)) + if (!nft_chain_binding(chain)) break; + /* Rule construction failed, but chain is already bound: + * let the transaction records release this chain and its rules. + */ + if (chain->bound) { + chain->use--; + break; + } + + /* Rule has been deleted, release chain and its rules. */ chain_ctx = *ctx; chain_ctx.chain = chain; - list_for_each_entry_safe(rule, n, &chain->rules, list) - nf_tables_rule_release(&chain_ctx, rule); - + chain->use--; + list_for_each_entry_safe(rule, n, &chain->rules, list) { + chain->use--; + list_del(&rule->list); + nf_tables_rule_destroy(&chain_ctx, rule); + } nf_tables_chain_destroy(&chain_ctx); break; default: From fcdea346bb076b07d4b7a697311217bd8b12e21a Mon Sep 17 00:00:00 2001 From: M A Ramdhan Date: Wed, 5 Jul 2023 12:15:30 -0400 Subject: [PATCH 25/98] UPSTREAM: net/sched: cls_fw: Fix improper refcount update leads to use-after-free [ Upstream commit 0323bce598eea038714f941ce2b22541c46d488f ] In the event of a failure in tcf_change_indev(), fw_set_parms() will immediately return an error after incrementing or decrementing reference counter in tcf_bind_filter(). If attacker can control reference counter to zero and make reference freed, leading to use after free. In order to prevent this, move the point of possible failure above the point where the TC_FW_CLASSID is handled. Bug: 292252062 Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: M A Ramdhan Signed-off-by: M A Ramdhan Acked-by: Jamal Hadi Salim Reviewed-by: Pedro Tammela Message-ID: <20230705161530.52003-1-ramdhan@starlabs.sg> Signed-off-by: Jakub Kicinski Signed-off-by: Sasha Levin (cherry picked from commit c91fb29bb07ee4dd40aabd1e41f19c0f92ac3199) Signed-off-by: Lee Jones Change-Id: I9bf6f540b4eb23ea5641fb3efe6f3e621d7b6151 --- net/sched/cls_fw.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/net/sched/cls_fw.c b/net/sched/cls_fw.c index a32351da968c..1212b057b129 100644 --- a/net/sched/cls_fw.c +++ b/net/sched/cls_fw.c @@ -210,11 +210,6 @@ static int fw_set_parms(struct net *net, struct tcf_proto *tp, if (err < 0) return err; - if (tb[TCA_FW_CLASSID]) { - f->res.classid = nla_get_u32(tb[TCA_FW_CLASSID]); - tcf_bind_filter(tp, &f->res, base); - } - if (tb[TCA_FW_INDEV]) { int ret; ret = tcf_change_indev(net, tb[TCA_FW_INDEV], extack); @@ -231,6 +226,11 @@ static int fw_set_parms(struct net *net, struct tcf_proto *tp, } else if (head->mask != 0xFFFFFFFF) return err; + if (tb[TCA_FW_CLASSID]) { + f->res.classid = nla_get_u32(tb[TCA_FW_CLASSID]); + tcf_bind_filter(tp, &f->res, base); + } + return 0; } From 342aff08ae23fc8432a2e83887841ce0e83a623c Mon Sep 17 00:00:00 2001 From: Jacky Liu Date: Tue, 25 Jul 2023 17:45:12 +0800 Subject: [PATCH 26/98] ANDROID: cgroup: Cleanup android_rvh_cgroup_force_kthread_migration android_rvh_cgroup_force_kthread_migration was removed by commit b0ea1feeefe0 ("Revert "ANDROID: cgroup: Add android_rvh_cgroup_force_kthread_migration"") but was then accidentally added back by commit 5f657b04f4f2 ("ANDROID: subsystem-specific vendor_hooks.c for sched"). It's not working, remove it again. Fixes: 5f657b04f4f2 ("ANDROID: subsystem-specific vendor_hooks.c for sched") Change-Id: Ia2d39824df2340f6b83050b2805a052ffa57f171 Signed-off-by: Jacky Liu --- include/trace/hooks/cgroup.h | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/include/trace/hooks/cgroup.h b/include/trace/hooks/cgroup.h index dc6b47dcb21d..a50e6abc55ee 100644 --- a/include/trace/hooks/cgroup.h +++ b/include/trace/hooks/cgroup.h @@ -21,11 +21,7 @@ DECLARE_RESTRICTED_HOOK(android_rvh_refrigerator, DECLARE_HOOK(android_vh_cgroup_attach, TP_PROTO(struct cgroup_subsys *ss, struct cgroup_taskset *tset), - TP_ARGS(ss, tset)) -DECLARE_RESTRICTED_HOOK(android_rvh_cgroup_force_kthread_migration, - TP_PROTO(struct task_struct *tsk, struct cgroup *dst_cgrp, bool *force_migration), - TP_ARGS(tsk, dst_cgrp, force_migration), 1); - + TP_ARGS(ss, tset)); DECLARE_RESTRICTED_HOOK(android_rvh_cpuset_fork, TP_PROTO(struct task_struct *p, bool *inherit_cpus), From 6c48edb9c92dfe3bba35fe56622bb0c0ee6b2b76 Mon Sep 17 00:00:00 2001 From: Cixi Geng Date: Tue, 25 Jul 2023 14:55:05 +0800 Subject: [PATCH 27/98] ANDROID: GKI: add function symbols for unisoc INFO: 10 function symbol(s) added 'void drm_send_event_timestamp_locked(struct drm_device*, struct drm_pending_event*, ktime_t)' 'int mipi_dsi_set_maximum_return_packet_size(struct mipi_dsi_device*, u16)' 'int of_get_drm_display_mode(struct device_node*, struct drm_display_mode*, u32*, int)' 'int regmap_get_reg_stride(struct regmap*)' 'struct regulator_dev* regulator_register(struct device*, const struct regulator_desc*, const struct regulator_config*)' 'struct snd_kcontrol* snd_ctl_find_id(struct snd_card*, struct snd_ctl_elem_id*)' 'int snd_info_get_line(struct snd_info_buffer*, char*, int)' 'unsigned int snd_pcm_rate_bit_to_rate(unsigned int)' 'unsigned int snd_pcm_rate_to_rate_bit(unsigned int)' 'void tty_port_link_device(struct tty_port*, struct tty_driver*, unsigned int)' Bug: 292812341 Change-Id: Ibaed96732ac53f824d4d12fb6ecad7bd63fcea8f Signed-off-by: Cixi Geng --- android/abi_gki_aarch64.stg | 135 +++++++++++++++++++++++++++++++++ android/abi_gki_aarch64_unisoc | 14 ++++ 2 files changed, 149 insertions(+) diff --git a/android/abi_gki_aarch64.stg b/android/abi_gki_aarch64.stg index e30c34f73e88..a8fc00774738 100644 --- a/android/abi_gki_aarch64.stg +++ b/android/abi_gki_aarch64.stg @@ -280801,6 +280801,13 @@ function { parameter_id: 0x105c8027 parameter_id: 0x914dbfdc } +function { + id: 0x16cab29d + return_type_id: 0x48b5725f + parameter_id: 0x1a1051a0 + parameter_id: 0x31e58fe0 + parameter_id: 0x4585663f +} function { id: 0x16cc357f return_type_id: 0x48b5725f @@ -285186,6 +285193,13 @@ function { parameter_id: 0x4585663f parameter_id: 0x6720d32f } +function { + id: 0x1e4106e1 + return_type_id: 0x48b5725f + parameter_id: 0x3b04bead + parameter_id: 0x07027638 + parameter_id: 0x11c404ba +} function { id: 0x1e4577e0 return_type_id: 0x48b5725f @@ -286568,6 +286582,12 @@ function { parameter_id: 0x32fddfe5 parameter_id: 0xf641dd8a } +function { + id: 0x20151959 + return_type_id: 0x2b8f13b3 + parameter_id: 0x33f8b54b + parameter_id: 0x0bf1a65b +} function { id: 0x209ae488 return_type_id: 0x37f9fd94 @@ -292279,6 +292299,14 @@ function { parameter_id: 0x92233392 parameter_id: 0x2e0f9112 } +function { + id: 0x9038705c + return_type_id: 0x6720d32f + parameter_id: 0x347303b4 + parameter_id: 0x2afee447 + parameter_id: 0x38d23361 + parameter_id: 0x6720d32f +} function { id: 0x9038edd5 return_type_id: 0x6720d32f @@ -300673,6 +300701,13 @@ function { parameter_id: 0x17047654 parameter_id: 0x295c7202 } +function { + id: 0x98e6779b + return_type_id: 0x6720d32f + parameter_id: 0x15b54c6f + parameter_id: 0x0483e6f8 + parameter_id: 0x6720d32f +} function { id: 0x98e6a470 return_type_id: 0x6720d32f @@ -340822,6 +340857,15 @@ elf_symbol { type_id: 0x1e4577e0 full_name: "drm_send_event_locked" } +elf_symbol { + id: 0xb701b4b1 + name: "drm_send_event_timestamp_locked" + is_defined: true + symbol_type: FUNCTION + crc: 0x2e16a8ee + type_id: 0x1e4106e1 + full_name: "drm_send_event_timestamp_locked" +} elf_symbol { id: 0x19652f5f name: "drm_set_preferred_mode" @@ -351667,6 +351711,15 @@ elf_symbol { type_id: 0x165fcf63 full_name: "mipi_dsi_picture_parameter_set" } +elf_symbol { + id: 0x6d579aaf + name: "mipi_dsi_set_maximum_return_packet_size" + is_defined: true + symbol_type: FUNCTION + crc: 0x24bb881a + type_id: 0x9d9d4f0f + full_name: "mipi_dsi_set_maximum_return_packet_size" +} elf_symbol { id: 0xe4059d72 name: "misc_deregister" @@ -354187,6 +354240,15 @@ elf_symbol { type_id: 0x91f5fad8 full_name: "of_get_display_timing" } +elf_symbol { + id: 0x05a46d27 + name: "of_get_drm_display_mode" + is_defined: true + symbol_type: FUNCTION + crc: 0x884bdf07 + type_id: 0x9038705c + full_name: "of_get_drm_display_mode" +} elf_symbol { id: 0xe3de7018 name: "of_get_i2c_adapter_by_node" @@ -360580,6 +360642,15 @@ elf_symbol { type_id: 0xaf453ff9 full_name: "regmap_get_device" } +elf_symbol { + id: 0x700d1b28 + name: "regmap_get_reg_stride" + is_defined: true + symbol_type: FUNCTION + crc: 0xb435d7cf + type_id: 0x9feaece8 + full_name: "regmap_get_reg_stride" +} elf_symbol { id: 0x248856c2 name: "regmap_get_val_bytes" @@ -361039,6 +361110,15 @@ elf_symbol { type_id: 0x10f3d61f full_name: "regulator_put" } +elf_symbol { + id: 0xfd977d86 + name: "regulator_register" + is_defined: true + symbol_type: FUNCTION + crc: 0xa01989d0 + type_id: 0xf5978397 + full_name: "regulator_register" +} elf_symbol { id: 0xddb9ed35 name: "regulator_register_notifier" @@ -365126,6 +365206,15 @@ elf_symbol { type_id: 0x9bbebc0c full_name: "snd_ctl_enum_info" } +elf_symbol { + id: 0xfc7ac85d + name: "snd_ctl_find_id" + is_defined: true + symbol_type: FUNCTION + crc: 0x0f5523c6 + type_id: 0x20151959 + full_name: "snd_ctl_find_id" +} elf_symbol { id: 0x6aca9744 name: "snd_ctl_new1" @@ -365270,6 +365359,15 @@ elf_symbol { type_id: 0x1f50da89 full_name: "snd_info_free_entry" } +elf_symbol { + id: 0x257f1e06 + name: "snd_info_get_line" + is_defined: true + symbol_type: FUNCTION + crc: 0x24a94b26 + type_id: 0x98e6779b + full_name: "snd_info_get_line" +} elf_symbol { id: 0x5e6e4a8e name: "snd_info_register" @@ -365549,6 +365647,24 @@ elf_symbol { type_id: 0x15b600dd full_name: "snd_pcm_period_elapsed" } +elf_symbol { + id: 0x11b8b797 + name: "snd_pcm_rate_bit_to_rate" + is_defined: true + symbol_type: FUNCTION + crc: 0xff6104d0 + type_id: 0xdfba2774 + full_name: "snd_pcm_rate_bit_to_rate" +} +elf_symbol { + id: 0x19ea44b2 + name: "snd_pcm_rate_to_rate_bit" + is_defined: true + symbol_type: FUNCTION + crc: 0xb9638db4 + type_id: 0xdfba2774 + full_name: "snd_pcm_rate_to_rate_bit" +} elf_symbol { id: 0xba998ee2 name: "snd_pcm_set_managed_buffer" @@ -370169,6 +370285,15 @@ elf_symbol { type_id: 0x9bc8ded8 full_name: "tty_port_install" } +elf_symbol { + id: 0x3ed74db1 + name: "tty_port_link_device" + is_defined: true + symbol_type: FUNCTION + crc: 0xebd3061e + type_id: 0x16cab29d + full_name: "tty_port_link_device" +} elf_symbol { id: 0x8c3087ea name: "tty_port_lower_dtr_rts" @@ -380070,6 +380195,7 @@ interface { symbol_id: 0x879ed3f8 symbol_id: 0xd7bee2cf symbol_id: 0x7826a8f0 + symbol_id: 0xb701b4b1 symbol_id: 0x19652f5f symbol_id: 0x78ae9c1c symbol_id: 0x3e16ebdf @@ -381275,6 +381401,7 @@ interface { symbol_id: 0x596b8466 symbol_id: 0xd9f124cf symbol_id: 0xdca2a3c4 + symbol_id: 0x6d579aaf symbol_id: 0xe4059d72 symbol_id: 0x842903b7 symbol_id: 0x354e8904 @@ -381555,6 +381682,7 @@ interface { symbol_id: 0xe2b0e5a5 symbol_id: 0xb8036e9c symbol_id: 0xe36e392a + symbol_id: 0x05a46d27 symbol_id: 0xe3de7018 symbol_id: 0x26fb2401 symbol_id: 0xec79392b @@ -382265,6 +382393,7 @@ interface { symbol_id: 0x6cde79b4 symbol_id: 0xd68bae0f symbol_id: 0x2b688ec7 + symbol_id: 0x700d1b28 symbol_id: 0x248856c2 symbol_id: 0x6ff192fd symbol_id: 0x3deea824 @@ -382316,6 +382445,7 @@ interface { symbol_id: 0x2804801a symbol_id: 0x4893b166 symbol_id: 0xbf6a903f + symbol_id: 0xfd977d86 symbol_id: 0xddb9ed35 symbol_id: 0x21d8367b symbol_id: 0xce959ab5 @@ -382770,6 +382900,7 @@ interface { symbol_id: 0x83c5422c symbol_id: 0xff4bd5dc symbol_id: 0x1adae35c + symbol_id: 0xfc7ac85d symbol_id: 0x6aca9744 symbol_id: 0x6b08a95c symbol_id: 0x238c5442 @@ -382786,6 +382917,7 @@ interface { symbol_id: 0x8a143ba0 symbol_id: 0x47548cf4 symbol_id: 0xfa53e7be + symbol_id: 0x257f1e06 symbol_id: 0x5e6e4a8e symbol_id: 0x32ffb327 symbol_id: 0x3491ba62 @@ -382817,6 +382949,8 @@ interface { symbol_id: 0x2c61b358 symbol_id: 0x352feb2c symbol_id: 0xf21d6619 + symbol_id: 0x11b8b797 + symbol_id: 0x19ea44b2 symbol_id: 0xba998ee2 symbol_id: 0x74420600 symbol_id: 0x92edca7e @@ -383331,6 +383465,7 @@ interface { symbol_id: 0x604f0f0b symbol_id: 0x5b997ef3 symbol_id: 0x6a405f9b + symbol_id: 0x3ed74db1 symbol_id: 0x8c3087ea symbol_id: 0x4e9dfcab symbol_id: 0x4a92dfd1 diff --git a/android/abi_gki_aarch64_unisoc b/android/abi_gki_aarch64_unisoc index 867436314590..ac818f2e495f 100644 --- a/android/abi_gki_aarch64_unisoc +++ b/android/abi_gki_aarch64_unisoc @@ -574,6 +574,8 @@ skb_unlink sk_error_report sk_free + snd_ctl_find_id + snd_info_get_line snprintf sock_alloc_send_pskb sock_create_kern @@ -1578,6 +1580,11 @@ spi_controller_suspend spi_finalize_current_transfer +# required by sprd-audio-codec.ko + regulator_register + snd_pcm_rate_bit_to_rate + snd_pcm_rate_to_rate_bit + # required by sprd-bc1p2.ko kthread_flush_worker __kthread_init_worker @@ -1662,14 +1669,18 @@ drm_poll drm_read drm_release + drm_send_event_timestamp_locked drm_vblank_init mipi_dsi_host_register mipi_dsi_host_unregister + mipi_dsi_set_maximum_return_packet_size of_drm_find_bridge + of_get_drm_display_mode of_graph_get_port_by_id of_graph_get_remote_node __platform_register_drivers platform_unregister_drivers + regmap_get_reg_stride # required by sprd-iommu.ko iommu_device_register @@ -1761,6 +1772,9 @@ devm_watchdog_register_device watchdog_init_timeout +# required by sprdbt_tty.ko + tty_port_link_device + # required by sysdump.ko android_rvh_probe_register input_close_device From 58870404915576c071d6f2a8388a3daa97837df6 Mon Sep 17 00:00:00 2001 From: Zhang Shurong Date: Sun, 25 Jun 2023 00:16:49 +0800 Subject: [PATCH 28/98] UPSTREAM: fbdev: fix potential OOB read in fast_imageblit() commit c2d22806aecb24e2de55c30a06e5d6eb297d161d upstream. There is a potential OOB read at fast_imageblit, for "colortab[(*src >> 4)]" can become a negative value due to "const char *s = image->data, *src". This change makes sure the index for colortab always positive or zero. Similar commit: https://patchwork.kernel.org/patch/11746067 Potential bug report: https://groups.google.com/g/syzkaller-bugs/c/9ubBXKeKXf4/m/k-QXy4UgAAAJ Signed-off-by: Zhang Shurong Cc: stable@vger.kernel.org Signed-off-by: Helge Deller Signed-off-by: Greg Kroah-Hartman Change-Id: I8ae18dbee926cc8dcf5bac4dec584071e7bdb739 (cherry picked from commit c2d22806aecb24e2de55c30a06e5d6eb297d161d) Signed-off-by: Suren Baghdasaryan Signed-off-by: Greg Kroah-Hartman --- drivers/video/fbdev/core/sysimgblt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/video/fbdev/core/sysimgblt.c b/drivers/video/fbdev/core/sysimgblt.c index 335e92b813fc..665ef7a0a249 100644 --- a/drivers/video/fbdev/core/sysimgblt.c +++ b/drivers/video/fbdev/core/sysimgblt.c @@ -189,7 +189,7 @@ static void fast_imageblit(const struct fb_image *image, struct fb_info *p, u32 fgx = fgcolor, bgx = bgcolor, bpp = p->var.bits_per_pixel; u32 ppw = 32/bpp, spitch = (image->width + 7)/8; u32 bit_mask, eorx, shift; - const char *s = image->data, *src; + const u8 *s = image->data, *src; u32 *dst; const u32 *tab; size_t tablen; From af2d741bf3d9a11e28b2a7785199829039bdfc12 Mon Sep 17 00:00:00 2001 From: Oliver Hartkopp Date: Wed, 7 Jun 2023 09:27:08 +0200 Subject: [PATCH 29/98] UPSTREAM: can: isotp: isotp_sendmsg(): fix return error fix on TX path commit e38910c0072b541a91954682c8b074a93e57c09b upstream. With commit d674a8f123b4 ("can: isotp: isotp_sendmsg(): fix return error on FC timeout on TX path") the missing correct return value in the case of a protocol error was introduced. But the way the error value has been read and sent to the user space does not follow the common scheme to clear the error after reading which is provided by the sock_error() function. This leads to an error report at the following write() attempt although everything should be working. Fixes: d674a8f123b4 ("can: isotp: isotp_sendmsg(): fix return error on FC timeout on TX path") Reported-by: Carsten Schmidt Signed-off-by: Oliver Hartkopp Link: https://lore.kernel.org/all/20230607072708.38809-1-socketcan@hartkopp.net Cc: stable@vger.kernel.org Signed-off-by: Marc Kleine-Budde Signed-off-by: Greg Kroah-Hartman Change-Id: I6cb85ee1e6fdc609991c383e4f6fc71ea3c68c3a (cherry picked from commit e38910c0072b541a91954682c8b074a93e57c09b) Signed-off-by: Suren Baghdasaryan Signed-off-by: Greg Kroah-Hartman --- net/can/isotp.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/net/can/isotp.c b/net/can/isotp.c index 5761d4ab839d..82280ac70df9 100644 --- a/net/can/isotp.c +++ b/net/can/isotp.c @@ -1079,8 +1079,9 @@ wait_free_buffer: if (err) goto err_event_drop; - if (sk->sk_err) - return -sk->sk_err; + err = sock_error(sk); + if (err) + return err; } return size; From 0e477a82e6d9e013a7f26cba2a2012179d28ac74 Mon Sep 17 00:00:00 2001 From: Ludvig Michaelsson Date: Wed, 21 Jun 2023 13:17:43 +0200 Subject: [PATCH 30/98] UPSTREAM: HID: hidraw: fix data race on device refcount commit 944ee77dc6ec7b0afd8ec70ffc418b238c92f12b upstream. The hidraw_open() function increments the hidraw device reference counter. The counter has no dedicated synchronization mechanism, resulting in a potential data race when concurrently opening a device. The race is a regression introduced by commit 8590222e4b02 ("HID: hidraw: Replace hidraw device table mutex with a rwsem"). While minors_rwsem is intended to protect the hidraw_table itself, by instead acquiring the lock for writing, the reference counter is also protected. This is symmetrical to hidraw_release(). Link: https://github.com/systemd/systemd/issues/27947 Fixes: 8590222e4b02 ("HID: hidraw: Replace hidraw device table mutex with a rwsem") Cc: stable@vger.kernel.org Signed-off-by: Ludvig Michaelsson Link: https://lore.kernel.org/r/20230621-hidraw-race-v1-1-a58e6ac69bab@yubico.com Signed-off-by: Benjamin Tissoires Signed-off-by: Greg Kroah-Hartman Change-Id: I312349145e8f2d55ea2182b94a3b3293b839818d (cherry picked from commit 879e79c3aead41b8aa2e91164354b30bd1c4ef3b) Signed-off-by: Suren Baghdasaryan Signed-off-by: Greg Kroah-Hartman --- drivers/hid/hidraw.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/drivers/hid/hidraw.c b/drivers/hid/hidraw.c index 197b1e7bf029..b617aada50b0 100644 --- a/drivers/hid/hidraw.c +++ b/drivers/hid/hidraw.c @@ -272,7 +272,12 @@ static int hidraw_open(struct inode *inode, struct file *file) goto out; } - down_read(&minors_rwsem); + /* + * Technically not writing to the hidraw_table but a write lock is + * required to protect the device refcount. This is symmetrical to + * hidraw_release(). + */ + down_write(&minors_rwsem); if (!hidraw_table[minor] || !hidraw_table[minor]->exist) { err = -ENODEV; goto out_unlock; @@ -301,7 +306,7 @@ static int hidraw_open(struct inode *inode, struct file *file) spin_unlock_irqrestore(&hidraw_table[minor]->list_lock, flags); file->private_data = list; out_unlock: - up_read(&minors_rwsem); + up_write(&minors_rwsem); out: if (err < 0) kfree(list); From d45a054f9ced465b079ad95619f562d2894317e3 Mon Sep 17 00:00:00 2001 From: Mike Hommey Date: Sun, 18 Jun 2023 08:09:57 +0900 Subject: [PATCH 31/98] UPSTREAM: HID: logitech-hidpp: add HIDPP_QUIRK_DELAYED_INIT for the T651. commit 5fe251112646d8626818ea90f7af325bab243efa upstream. commit 498ba2069035 ("HID: logitech-hidpp: Don't restart communication if not necessary") put restarting communication behind that flag, and this was apparently necessary on the T651, but the flag was not set for it. Fixes: 498ba2069035 ("HID: logitech-hidpp: Don't restart communication if not necessary") Cc: stable@vger.kernel.org Signed-off-by: Mike Hommey Link: https://lore.kernel.org/r/20230617230957.6mx73th4blv7owqk@glandium.org Signed-off-by: Benjamin Tissoires Signed-off-by: Greg Kroah-Hartman (cherry picked from commit a536383ef030b15ace93b2ca865c4132a1fd8794) Signed-off-by: Suren Baghdasaryan Signed-off-by: Greg Kroah-Hartman Change-Id: Ic57d1d450ee4474cff51efca3d9b9607de6693d7 --- drivers/hid/hid-logitech-hidpp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c index e906ee375298..f1d5b7c38abb 100644 --- a/drivers/hid/hid-logitech-hidpp.c +++ b/drivers/hid/hid-logitech-hidpp.c @@ -4299,7 +4299,7 @@ static const struct hid_device_id hidpp_devices[] = { { /* wireless touchpad T651 */ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_T651), - .driver_data = HIDPP_QUIRK_CLASS_WTP }, + .driver_data = HIDPP_QUIRK_CLASS_WTP | HIDPP_QUIRK_DELAYED_INIT }, { /* Mouse Logitech Anywhere MX */ LDJ_DEVICE(0x1017), .driver_data = HIDPP_QUIRK_HI_RES_SCROLL_1P0 }, { /* Mouse logitech M560 */ From 41b30362e99114d4d7ef753c612322471813ae39 Mon Sep 17 00:00:00 2001 From: "Liam R. Howlett" Date: Sat, 17 Jun 2023 20:47:08 -0400 Subject: [PATCH 32/98] BACKPORT: mm/mmap: Fix error path in do_vmi_align_munmap() commit 606c812eb1d5b5fb0dd9e330ca94b52d7c227830 upstream The error unrolling was leaving the VMAs detached in many cases and leaving the locked_vm statistic altered, and skipping the unrolling entirely in the case of the vma tree write failing. Fix the error path by re-attaching the detached VMAs and adding the necessary goto for the failed vma tree write, and fix the locked_vm statistic by only updating after the vma tree write succeeds. Fixes: 763ecb035029 ("mm: remove the vma linked list") Reported-by: Vegard Nossum Signed-off-by: Liam R. Howlett Signed-off-by: Linus Torvalds [ dwmw2: Strictly, the original patch wasn't *re-attaching* the detached VMAs. They *were* still attached but just had the 'detached' flag set, which is an optimisation. Which doesn't exist in 6.3, so drop that. Also drop the call to vma_start_write() which came in with the per-VMA locking in 6.4. ] [ dwmw2 (6.1): It's do_mas_align_munmap() here. And has two call sites for the now-removed munmap_sidetree() function. Inline them both rather then trying to backport various dependencies with potentially subtle interactions. ] Signed-off-by: David Woodhouse Signed-off-by: Greg Kroah-Hartman [surenb: added needed vma_start_write and vma_vma_mark_detached calls] Signed-off-by: Suren Baghdasaryan Change-Id: I1e42347ecf9eb46077739a267ac00264f94fa59a --- mm/mmap.c | 38 +++++++++++++++++--------------------- 1 file changed, 17 insertions(+), 21 deletions(-) diff --git a/mm/mmap.c b/mm/mmap.c index 36f129f23dfb..a0af03d35e8c 100644 --- a/mm/mmap.c +++ b/mm/mmap.c @@ -2359,21 +2359,6 @@ int split_vma(struct mm_struct *mm, struct vm_area_struct *vma, return __split_vma(mm, vma, addr, new_below); } -static inline int munmap_sidetree(struct vm_area_struct *vma, int count, - struct ma_state *mas_detach) -{ - vma_start_write(vma); - mas_set(mas_detach, count); - if (mas_store_gfp(mas_detach, vma, GFP_KERNEL)) - return -ENOMEM; - - vma_mark_detached(vma, true); - if (vma->vm_flags & VM_LOCKED) - vma->vm_mm->locked_vm -= vma_pages(vma); - - return 0; -} - /* * do_mas_align_munmap() - munmap the aligned region from @start to @end. * @mas: The maple_state, ideally set up to alter the correct tree location. @@ -2395,6 +2380,7 @@ do_mas_align_munmap(struct ma_state *mas, struct vm_area_struct *vma, struct maple_tree mt_detach; int count = 0; int error = -ENOMEM; + unsigned long locked_vm = 0; MA_STATE(mas_detach, &mt_detach, 0, 0); mt_init_flags(&mt_detach, mas->tree->ma_flags & MT_FLAGS_LOCK_MASK); mt_set_external_lock(&mt_detach, &mm->mmap_lock); @@ -2450,18 +2436,27 @@ do_mas_align_munmap(struct ma_state *mas, struct vm_area_struct *vma, mas_set(mas, end); split = mas_prev(mas, 0); - error = munmap_sidetree(split, count, &mas_detach); + vma_start_write(split); + mas_set(&mas_detach, count); + error = mas_store_gfp(&mas_detach, split, GFP_KERNEL); if (error) - goto munmap_sidetree_failed; + goto munmap_gather_failed; + vma_mark_detached(split, true); + if (split->vm_flags & VM_LOCKED) + locked_vm += vma_pages(split); count++; if (vma == next) vma = split; break; } - error = munmap_sidetree(next, count, &mas_detach); - if (error) - goto munmap_sidetree_failed; + vma_start_write(next); + mas_set(&mas_detach, count); + if (mas_store_gfp(&mas_detach, next, GFP_KERNEL)) + goto munmap_gather_failed; + vma_mark_detached(next, true); + if (next->vm_flags & VM_LOCKED) + locked_vm += vma_pages(next); count++; if (unlikely(uf)) { @@ -2519,6 +2514,7 @@ do_mas_align_munmap(struct ma_state *mas, struct vm_area_struct *vma, if (mas_store_gfp(mas, NULL, GFP_KERNEL)) return -ENOMEM; + mm->locked_vm -= locked_vm; mm->map_count -= count; /* * Do not downgrade mmap_lock if we are next to VM_GROWSDOWN or @@ -2550,7 +2546,7 @@ do_mas_align_munmap(struct ma_state *mas, struct vm_area_struct *vma, return downgrade ? 1 : 0; userfaultfd_error: -munmap_sidetree_failed: +munmap_gather_failed: end_split_failed: __mt_destroy(&mt_detach); start_split_failed: From 466448f55f0b6e14b6b1ab874ebe9a704fb7b821 Mon Sep 17 00:00:00 2001 From: David Woodhouse Date: Wed, 28 Jun 2023 10:55:03 +0100 Subject: [PATCH 33/98] BACKPORT: mm/mmap: Fix error return in do_vmi_align_munmap() MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit commit 6c26bd4384da24841bac4f067741bbca18b0fb74 upstream, If mas_store_gfp() in the gather loop failed, the 'error' variable that ultimately gets returned was not being set. In many cases, its original value of -ENOMEM was still in place, and that was fine. But if VMAs had been split at the start or end of the range, then 'error' could be zero. Change to the 'error = foo(); if (error) goto …' idiom to fix the bug. Also clean up a later case which avoided the same bug by *explicitly* setting error = -ENOMEM right before calling the function that might return -ENOMEM. In a final cosmetic change, move the 'Point of no return' comment to *after* the goto. That's been in the wrong place since the preallocation was removed, and this new error path was added. Fixes: 606c812eb1d5 ("mm/mmap: Fix error path in do_vmi_align_munmap()") Signed-off-by: David Woodhouse Cc: stable@vger.kernel.org Reviewed-by: Greg Kroah-Hartman Reviewed-by: Liam R. Howlett Signed-off-by: David Woodhouse Signed-off-by: Greg Kroah-Hartman (cherry picked from commit 42a018a796d1eedb0d7c38b2778ef3dbf05aca36) Signed-off-by: Greg Kroah-Hartman Change-Id: I5da7b1e126968e174e733d45ff24439089de60af --- mm/mmap.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/mm/mmap.c b/mm/mmap.c index a0af03d35e8c..751fcf6037b3 100644 --- a/mm/mmap.c +++ b/mm/mmap.c @@ -2452,7 +2452,8 @@ do_mas_align_munmap(struct ma_state *mas, struct vm_area_struct *vma, } vma_start_write(next); mas_set(&mas_detach, count); - if (mas_store_gfp(&mas_detach, next, GFP_KERNEL)) + error = mas_store_gfp(&mas_detach, next, GFP_KERNEL); + if (error) goto munmap_gather_failed; vma_mark_detached(next, true); if (next->vm_flags & VM_LOCKED) From a2dff37b0c2e589d376dfb3a1a49dfb0b9326db0 Mon Sep 17 00:00:00 2001 From: Tony Luck Date: Fri, 21 Oct 2022 13:01:19 -0700 Subject: [PATCH 34/98] UPSTREAM: mm, hwpoison: try to recover from copy-on write faults commit a873dfe1032a132bf89f9e19a6ac44f5a0b78754 upstream. Patch series "Copy-on-write poison recovery", v3. Part 1 deals with the process that triggered the copy on write fault with a store to a shared read-only page. That process is send a SIGBUS with the usual machine check decoration to specify the virtual address of the lost page, together with the scope. Part 2 sets up to asynchronously take the page with the uncorrected error offline to prevent additional machine check faults. H/t to Miaohe Lin and Shuai Xue for pointing me to the existing function to queue a call to memory_failure(). On x86 there is some duplicate reporting (because the error is also signalled by the memory controller as well as by the core that triggered the machine check). Console logs look like this: This patch (of 2): If the kernel is copying a page as the result of a copy-on-write fault and runs into an uncorrectable error, Linux will crash because it does not have recovery code for this case where poison is consumed by the kernel. It is easy to set up a test case. Just inject an error into a private page, fork(2), and have the child process write to the page. I wrapped that neatly into a test at: git://git.kernel.org/pub/scm/linux/kernel/git/aegl/ras-tools.git just enable ACPI error injection and run: # ./einj_mem-uc -f copy-on-write Add a new copy_user_highpage_mc() function that uses copy_mc_to_kernel() on architectures where that is available (currently x86 and powerpc). When an error is detected during the page copy, return VM_FAULT_HWPOISON to caller of wp_page_copy(). This propagates up the call stack. Both x86 and powerpc have code in their fault handler to deal with this code by sending a SIGBUS to the application. Note that this patch avoids a system crash and signals the process that triggered the copy-on-write action. It does not take any action for the memory error that is still in the shared page. To handle that a call to memory_failure() is needed. But this cannot be done from wp_page_copy() because it holds mmap_lock(). Perhaps the architecture fault handlers can deal with this loose end in a subsequent patch? On Intel/x86 this loose end will often be handled automatically because the memory controller provides an additional notification of the h/w poison in memory, the handler for this will call memory_failure(). This isn't a 100% solution. If there are multiple errors, not all may be logged in this way. [tony.luck@intel.com: add call to kmsan_unpoison_memory(), per Miaohe Lin] Link: https://lkml.kernel.org/r/20221031201029.102123-2-tony.luck@intel.com Link: https://lkml.kernel.org/r/20221021200120.175753-1-tony.luck@intel.com Link: https://lkml.kernel.org/r/20221021200120.175753-2-tony.luck@intel.com Signed-off-by: Tony Luck Reviewed-by: Dan Williams Reviewed-by: Naoya Horiguchi Reviewed-by: Miaohe Lin Reviewed-by: Alexander Potapenko Tested-by: Shuai Xue Cc: Christophe Leroy Cc: Matthew Wilcox (Oracle) Cc: Michael Ellerman Cc: Nicholas Piggin Signed-off-by: Andrew Morton Igned-off-by: Jane Chu Signed-off-by: Greg Kroah-Hartman Change-Id: I7c35cd47de59611fcc0550b0a7fd4e3911bbb110 (cherry-picked from commit 4af5960d7cd46c3834f65b75577b775cbcd0f7b2) Signed-off-by: Suren Baghdasaryan Signed-off-by: Greg Kroah-Hartman --- include/linux/highmem.h | 26 ++++++++++++++++++++++++++ mm/memory.c | 30 ++++++++++++++++++++---------- 2 files changed, 46 insertions(+), 10 deletions(-) diff --git a/include/linux/highmem.h b/include/linux/highmem.h index 94b50dc0e131..a2d4e15464c3 100644 --- a/include/linux/highmem.h +++ b/include/linux/highmem.h @@ -319,6 +319,32 @@ static inline void copy_user_highpage(struct page *to, struct page *from, #endif +#ifdef copy_mc_to_kernel +static inline int copy_mc_user_highpage(struct page *to, struct page *from, + unsigned long vaddr, struct vm_area_struct *vma) +{ + unsigned long ret; + char *vfrom, *vto; + + vfrom = kmap_local_page(from); + vto = kmap_local_page(to); + ret = copy_mc_to_kernel(vto, vfrom, PAGE_SIZE); + if (!ret) + kmsan_unpoison_memory(page_address(to), PAGE_SIZE); + kunmap_local(vto); + kunmap_local(vfrom); + + return ret; +} +#else +static inline int copy_mc_user_highpage(struct page *to, struct page *from, + unsigned long vaddr, struct vm_area_struct *vma) +{ + copy_user_highpage(to, from, vaddr, vma); + return 0; +} +#endif + #ifndef __HAVE_ARCH_COPY_HIGHPAGE static inline void copy_highpage(struct page *to, struct page *from) diff --git a/mm/memory.c b/mm/memory.c index 16063c490b7f..b52469032045 100644 --- a/mm/memory.c +++ b/mm/memory.c @@ -2851,10 +2851,16 @@ static inline int pte_unmap_same(struct vm_fault *vmf) return same; } -static inline bool __wp_page_copy_user(struct page *dst, struct page *src, - struct vm_fault *vmf) +/* + * Return: + * 0: copied succeeded + * -EHWPOISON: copy failed due to hwpoison in source page + * -EAGAIN: copied failed (some other reason) + */ +static inline int __wp_page_copy_user(struct page *dst, struct page *src, + struct vm_fault *vmf) { - bool ret; + int ret; void *kaddr; void __user *uaddr; bool locked = false; @@ -2863,8 +2869,9 @@ static inline bool __wp_page_copy_user(struct page *dst, struct page *src, unsigned long addr = vmf->address; if (likely(src)) { - copy_user_highpage(dst, src, addr, vma); - return true; + if (copy_mc_user_highpage(dst, src, addr, vma)) + return -EHWPOISON; + return 0; } /* @@ -2891,7 +2898,7 @@ static inline bool __wp_page_copy_user(struct page *dst, struct page *src, * and update local tlb only */ update_mmu_tlb(vma, addr, vmf->pte); - ret = false; + ret = -EAGAIN; goto pte_unlock; } @@ -2916,7 +2923,7 @@ static inline bool __wp_page_copy_user(struct page *dst, struct page *src, if (!likely(pte_same(*vmf->pte, vmf->orig_pte))) { /* The PTE changed under us, update local tlb */ update_mmu_tlb(vma, addr, vmf->pte); - ret = false; + ret = -EAGAIN; goto pte_unlock; } @@ -2935,7 +2942,7 @@ warn: } } - ret = true; + ret = 0; pte_unlock: if (locked) @@ -3107,6 +3114,7 @@ static vm_fault_t wp_page_copy(struct vm_fault *vmf) pte_t entry; int page_copied = 0; struct mmu_notifier_range range; + int ret; delayacct_wpcopy_start(); @@ -3124,19 +3132,21 @@ static vm_fault_t wp_page_copy(struct vm_fault *vmf) if (!new_page) goto oom; - if (!__wp_page_copy_user(new_page, old_page, vmf)) { + ret = __wp_page_copy_user(new_page, old_page, vmf); + if (ret) { /* * COW failed, if the fault was solved by other, * it's fine. If not, userspace would re-fault on * the same address and we will handle the fault * from the second attempt. + * The -EHWPOISON case will not be retried. */ put_page(new_page); if (old_page) put_page(old_page); delayacct_wpcopy_end(); - return 0; + return ret == -EHWPOISON ? VM_FAULT_HWPOISON : 0; } kmsan_copy_page_meta(new_page, old_page); } From 53048f151cd72ef552a3c7e853f8e9726f46fc76 Mon Sep 17 00:00:00 2001 From: Tony Luck Date: Fri, 21 Oct 2022 13:01:20 -0700 Subject: [PATCH 35/98] BACKPORT: mm, hwpoison: when copy-on-write hits poison, take page offline commit d302c2398ba269e788a4f37ae57c07a7fcabaa42 upstream. Cannot call memory_failure() directly from the fault handler because mmap_lock (and others) are held. It is important, but not urgent, to mark the source page as h/w poisoned and unmap it from other tasks. Use memory_failure_queue() to request a call to memory_failure() for the page with the error. Also provide a stub version for CONFIG_MEMORY_FAILURE=n Link: https://lkml.kernel.org/r/20221021200120.175753-3-tony.luck@intel.com Signed-off-by: Tony Luck Reviewed-by: Miaohe Lin Cc: Christophe Leroy Cc: Dan Williams Cc: Matthew Wilcox (Oracle) Cc: Michael Ellerman Cc: Naoya Horiguchi Cc: Nicholas Piggin Cc: Shuai Xue Signed-off-by: Andrew Morton [ Due to missing commits e591ef7d96d6e ("mm,hwpoison,hugetlb,memory_hotplug: hotremove memory section with hwpoisoned hugepage") 5033091de814a ("mm/hwpoison: introduce per-memory_block hwpoison counter") The impact of e591ef7d96d6e is its introduction of an additional flag in __get_huge_page_for_hwpoison() that serves as an indication a hwpoisoned hugetlb page should have its migratable bit cleared. The impact of 5033091de814a is contexual. Resolve by ignoring both missing commits. - jane] Signed-off-by: Jane Chu Signed-off-by: Greg Kroah-Hartman Change-Id: Ica2c1970fe3cdfa9dc7d3f288e1e6a90378a9764 (cherry-picked from commit 84f077802e56ae43f4b6c6eb9ad59b19df9db374) Signed-off-by: Suren Baghdasaryan Signed-off-by: Greg Kroah-Hartman --- include/linux/mm.h | 5 ++++- mm/memory.c | 4 +++- 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/include/linux/mm.h b/include/linux/mm.h index ab2f33910d06..718bb0f8446c 100644 --- a/include/linux/mm.h +++ b/include/linux/mm.h @@ -3480,7 +3480,6 @@ enum mf_flags { int mf_dax_kill_procs(struct address_space *mapping, pgoff_t index, unsigned long count, int mf_flags); extern int memory_failure(unsigned long pfn, int flags); -extern void memory_failure_queue(unsigned long pfn, int flags); extern void memory_failure_queue_kick(int cpu); extern int unpoison_memory(unsigned long pfn); extern int sysctl_memory_failure_early_kill; @@ -3489,8 +3488,12 @@ extern void shake_page(struct page *p); extern atomic_long_t num_poisoned_pages __read_mostly; extern int soft_offline_page(unsigned long pfn, int flags); #ifdef CONFIG_MEMORY_FAILURE +extern void memory_failure_queue(unsigned long pfn, int flags); extern int __get_huge_page_for_hwpoison(unsigned long pfn, int flags); #else +static inline void memory_failure_queue(unsigned long pfn, int flags) +{ +} static inline int __get_huge_page_for_hwpoison(unsigned long pfn, int flags) { return 0; diff --git a/mm/memory.c b/mm/memory.c index b52469032045..d31c23419631 100644 --- a/mm/memory.c +++ b/mm/memory.c @@ -2869,8 +2869,10 @@ static inline int __wp_page_copy_user(struct page *dst, struct page *src, unsigned long addr = vmf->address; if (likely(src)) { - if (copy_mc_user_highpage(dst, src, addr, vma)) + if (copy_mc_user_highpage(dst, src, addr, vma)) { + memory_failure_queue(page_to_pfn(src), 0); return -EHWPOISON; + } return 0; } From 5c9836e66ddee801c4f7140f1081b1b517b40548 Mon Sep 17 00:00:00 2001 From: "Borislav Petkov (AMD)" Date: Tue, 2 May 2023 19:53:50 +0200 Subject: [PATCH 36/98] UPSTREAM: x86/microcode/AMD: Load late on both threads too commit a32b0f0db3f396f1c9be2fe621e77c09ec3d8e7d upstream. Do the same as early loading - load on both threads. Signed-off-by: Borislav Petkov (AMD) Cc: Link: https://lore.kernel.org/r/20230605141332.25948-1-bp@alien8.de Signed-off-by: Greg Kroah-Hartman Change-Id: I857794a1b78974200aad02098a31c41576aed562 (cherry-picked from commit 94a69d6999419cd21365111b4493070182712299) Signed-off-by: Suren Baghdasaryan --- arch/x86/kernel/cpu/microcode/amd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/x86/kernel/cpu/microcode/amd.c b/arch/x86/kernel/cpu/microcode/amd.c index 461e45d85add..9a3092ec9b27 100644 --- a/arch/x86/kernel/cpu/microcode/amd.c +++ b/arch/x86/kernel/cpu/microcode/amd.c @@ -705,7 +705,7 @@ static enum ucode_state apply_microcode_amd(int cpu) rdmsr(MSR_AMD64_PATCH_LEVEL, rev, dummy); /* need to apply patch? */ - if (rev >= mc_amd->hdr.patch_id) { + if (rev > mc_amd->hdr.patch_id) { ret = UCODE_OK; goto out; } From ba2ccba8634863235fbffa7350049de21c18eed5 Mon Sep 17 00:00:00 2001 From: Thomas Gleixner Date: Wed, 26 Apr 2023 18:37:00 +0200 Subject: [PATCH 37/98] UPSTREAM: x86/smp: Make stop_other_cpus() more robust commit 1f5e7eb7868e42227ac426c96d437117e6e06e8e upstream. Tony reported intermittent lockups on poweroff. His analysis identified the wbinvd() in stop_this_cpu() as the culprit. This was added to ensure that on SME enabled machines a kexec() does not leave any stale data in the caches when switching from encrypted to non-encrypted mode or vice versa. That wbinvd() is conditional on the SME feature bit which is read directly from CPUID. But that readout does not check whether the CPUID leaf is available or not. If it's not available the CPU will return the value of the highest supported leaf instead. Depending on the content the "SME" bit might be set or not. That's incorrect but harmless. Making the CPUID readout conditional makes the observed hangs go away, but it does not fix the underlying problem: CPU0 CPU1 stop_other_cpus() send_IPIs(REBOOT); stop_this_cpu() while (num_online_cpus() > 1); set_online(false); proceed... -> hang wbinvd() WBINVD is an expensive operation and if multiple CPUs issue it at the same time the resulting delays are even larger. But CPU0 already observed num_online_cpus() going down to 1 and proceeds which causes the system to hang. This issue exists independent of WBINVD, but the delays caused by WBINVD make it more prominent. Make this more robust by adding a cpumask which is initialized to the online CPU mask before sending the IPIs and CPUs clear their bit in stop_this_cpu() after the WBINVD completed. Check for that cpumask to become empty in stop_other_cpus() instead of watching num_online_cpus(). The cpumask cannot plug all holes either, but it's better than a raw counter and allows to restrict the NMI fallback IPI to be sent only the CPUs which have not reported within the timeout window. Fixes: 08f253ec3767 ("x86/cpu: Clear SME feature flag when not in use") Reported-by: Tony Battersby Signed-off-by: Thomas Gleixner Reviewed-by: Borislav Petkov (AMD) Reviewed-by: Ashok Raj Cc: stable@vger.kernel.org Link: https://lore.kernel.org/all/3817d810-e0f1-8ef8-0bbd-663b919ca49b@cybernetics.com Link: https://lore.kernel.org/r/87h6r770bv.ffs@tglx Signed-off-by: Greg Kroah-Hartman Change-Id: I7154624285f081ac2f54617fb7b9f9cdd6b4f2e0 (cherry-picked from commit edadebb349e89461109643dd92ee986e01a47aa1) Signed-off-by: Suren Baghdasaryan --- arch/x86/include/asm/cpu.h | 2 ++ arch/x86/kernel/process.c | 23 ++++++++++++-- arch/x86/kernel/smp.c | 62 +++++++++++++++++++++++++------------- 3 files changed, 64 insertions(+), 23 deletions(-) diff --git a/arch/x86/include/asm/cpu.h b/arch/x86/include/asm/cpu.h index b472ef76826a..37639a2d9c34 100644 --- a/arch/x86/include/asm/cpu.h +++ b/arch/x86/include/asm/cpu.h @@ -96,4 +96,6 @@ static inline bool intel_cpu_signatures_match(unsigned int s1, unsigned int p1, extern u64 x86_read_arch_cap_msr(void); +extern struct cpumask cpus_stop_mask; + #endif /* _ASM_X86_CPU_H */ diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c index e436c9c1ef3b..93df1f0feeb1 100644 --- a/arch/x86/kernel/process.c +++ b/arch/x86/kernel/process.c @@ -744,13 +744,23 @@ bool xen_set_default_idle(void) } #endif +struct cpumask cpus_stop_mask; + void __noreturn stop_this_cpu(void *dummy) { + unsigned int cpu = smp_processor_id(); + local_irq_disable(); + /* - * Remove this CPU: + * Remove this CPU from the online mask and disable it + * unconditionally. This might be redundant in case that the reboot + * vector was handled late and stop_other_cpus() sent an NMI. + * + * According to SDM and APM NMIs can be accepted even after soft + * disabling the local APIC. */ - set_cpu_online(smp_processor_id(), false); + set_cpu_online(cpu, false); disable_local_APIC(); mcheck_cpu_clear(this_cpu_ptr(&cpu_info)); @@ -768,6 +778,15 @@ void __noreturn stop_this_cpu(void *dummy) */ if (cpuid_eax(0x8000001f) & BIT(0)) native_wbinvd(); + + /* + * This brings a cache line back and dirties it, but + * native_stop_other_cpus() will overwrite cpus_stop_mask after it + * observed that all CPUs reported stop. This write will invalidate + * the related cache line on this CPU. + */ + cpumask_clear_cpu(cpu, &cpus_stop_mask); + for (;;) { /* * Use native_halt() so that memory contents don't change diff --git a/arch/x86/kernel/smp.c b/arch/x86/kernel/smp.c index 375b33ecafa2..935bc6562fa4 100644 --- a/arch/x86/kernel/smp.c +++ b/arch/x86/kernel/smp.c @@ -27,6 +27,7 @@ #include #include #include +#include #include #include #include @@ -146,31 +147,43 @@ static int register_stop_handler(void) static void native_stop_other_cpus(int wait) { - unsigned long flags; - unsigned long timeout; + unsigned int cpu = smp_processor_id(); + unsigned long flags, timeout; if (reboot_force) return; - /* - * Use an own vector here because smp_call_function - * does lots of things not suitable in a panic situation. - */ + /* Only proceed if this is the first CPU to reach this code */ + if (atomic_cmpxchg(&stopping_cpu, -1, cpu) != -1) + return; /* - * We start by using the REBOOT_VECTOR irq. - * The irq is treated as a sync point to allow critical - * regions of code on other cpus to release their spin locks - * and re-enable irqs. Jumping straight to an NMI might - * accidentally cause deadlocks with further shutdown/panic - * code. By syncing, we give the cpus up to one second to - * finish their work before we force them off with the NMI. + * 1) Send an IPI on the reboot vector to all other CPUs. + * + * The other CPUs should react on it after leaving critical + * sections and re-enabling interrupts. They might still hold + * locks, but there is nothing which can be done about that. + * + * 2) Wait for all other CPUs to report that they reached the + * HLT loop in stop_this_cpu() + * + * 3) If #2 timed out send an NMI to the CPUs which did not + * yet report + * + * 4) Wait for all other CPUs to report that they reached the + * HLT loop in stop_this_cpu() + * + * #3 can obviously race against a CPU reaching the HLT loop late. + * That CPU will have reported already and the "have all CPUs + * reached HLT" condition will be true despite the fact that the + * other CPU is still handling the NMI. Again, there is no + * protection against that as "disabled" APICs still respond to + * NMIs. */ - if (num_online_cpus() > 1) { - /* did someone beat us here? */ - if (atomic_cmpxchg(&stopping_cpu, -1, safe_smp_processor_id()) != -1) - return; + cpumask_copy(&cpus_stop_mask, cpu_online_mask); + cpumask_clear_cpu(cpu, &cpus_stop_mask); + if (!cpumask_empty(&cpus_stop_mask)) { /* sync above data before sending IRQ */ wmb(); @@ -183,12 +196,12 @@ static void native_stop_other_cpus(int wait) * CPUs reach shutdown state. */ timeout = USEC_PER_SEC; - while (num_online_cpus() > 1 && timeout--) + while (!cpumask_empty(&cpus_stop_mask) && timeout--) udelay(1); } /* if the REBOOT_VECTOR didn't work, try with the NMI */ - if (num_online_cpus() > 1) { + if (!cpumask_empty(&cpus_stop_mask)) { /* * If NMI IPI is enabled, try to register the stop handler * and send the IPI. In any case try to wait for the other @@ -200,7 +213,8 @@ static void native_stop_other_cpus(int wait) pr_emerg("Shutting down cpus with NMI\n"); - apic_send_IPI_allbutself(NMI_VECTOR); + for_each_cpu(cpu, &cpus_stop_mask) + apic->send_IPI(cpu, NMI_VECTOR); } /* * Don't wait longer than 10 ms if the caller didn't @@ -208,7 +222,7 @@ static void native_stop_other_cpus(int wait) * one or more CPUs do not reach shutdown state. */ timeout = USEC_PER_MSEC * 10; - while (num_online_cpus() > 1 && (wait || timeout--)) + while (!cpumask_empty(&cpus_stop_mask) && (wait || timeout--)) udelay(1); } @@ -216,6 +230,12 @@ static void native_stop_other_cpus(int wait) disable_local_APIC(); mcheck_cpu_clear(this_cpu_ptr(&cpu_info)); local_irq_restore(flags); + + /* + * Ensure that the cpus_stop_mask cache lines are invalidated on + * the other CPUs. See comment vs. SME in stop_this_cpu(). + */ + cpumask_clear(&cpus_stop_mask); } /* From 6744547e9534eda6a3c91923e1ff287af68380f0 Mon Sep 17 00:00:00 2001 From: Tony Battersby Date: Thu, 15 Jun 2023 22:33:52 +0200 Subject: [PATCH 38/98] UPSTREAM: x86/smp: Dont access non-existing CPUID leaf commit 9b040453d4440659f33dc6f0aa26af418ebfe70b upstream. stop_this_cpu() tests CPUID leaf 0x8000001f::EAX unconditionally. Intel CPUs return the content of the highest supported leaf when a non-existing leaf is read, while AMD CPUs return all zeros for unsupported leafs. So the result of the test on Intel CPUs is lottery. While harmless it's incorrect and causes the conditional wbinvd() to be issued where not required. Check whether the leaf is supported before reading it. [ tglx: Adjusted changelog ] Fixes: 08f253ec3767 ("x86/cpu: Clear SME feature flag when not in use") Signed-off-by: Tony Battersby Signed-off-by: Thomas Gleixner Reviewed-by: Mario Limonciello Reviewed-by: Borislav Petkov (AMD) Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/3817d810-e0f1-8ef8-0bbd-663b919ca49b@cybernetics.com Link: https://lore.kernel.org/r/20230615193330.322186388@linutronix.de Signed-off-by: Greg Kroah-Hartman Change-Id: Idc8aa8137c9044642f02ec157d18d035359f88ea (cherry-picked from commit e47037d28b7398d7a8f1a3e071087ea9dbfcebf5) Signed-off-by: Suren Baghdasaryan --- arch/x86/kernel/process.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c index 93df1f0feeb1..279b5e9be80f 100644 --- a/arch/x86/kernel/process.c +++ b/arch/x86/kernel/process.c @@ -748,6 +748,7 @@ struct cpumask cpus_stop_mask; void __noreturn stop_this_cpu(void *dummy) { + struct cpuinfo_x86 *c = this_cpu_ptr(&cpu_info); unsigned int cpu = smp_processor_id(); local_irq_disable(); @@ -762,7 +763,7 @@ void __noreturn stop_this_cpu(void *dummy) */ set_cpu_online(cpu, false); disable_local_APIC(); - mcheck_cpu_clear(this_cpu_ptr(&cpu_info)); + mcheck_cpu_clear(c); /* * Use wbinvd on processors that support SME. This provides support @@ -776,7 +777,7 @@ void __noreturn stop_this_cpu(void *dummy) * Test the CPUID bit directly because the machine might've cleared * X86_FEATURE_SME due to cmdline options. */ - if (cpuid_eax(0x8000001f) & BIT(0)) + if (c->extended_cpuid_level >= 0x8000001f && (cpuid_eax(0x8000001f) & BIT(0))) native_wbinvd(); /* From d8cb0365cbc724b76f680af68351aa15e20d1d3b Mon Sep 17 00:00:00 2001 From: Thomas Gleixner Date: Thu, 15 Jun 2023 22:33:54 +0200 Subject: [PATCH 39/98] UPSTREAM: x86/smp: Remove pointless wmb()s from native_stop_other_cpus() commit 2affa6d6db28855e6340b060b809c23477aa546e upstream. The wmb()s before sending the IPIs are not synchronizing anything. If at all then the apic IPI functions have to provide or act as appropriate barriers. Remove these cargo cult barriers which have no explanation of what they are synchronizing. Signed-off-by: Thomas Gleixner Reviewed-by: Borislav Petkov (AMD) Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20230615193330.378358382@linutronix.de Signed-off-by: Greg Kroah-Hartman Change-Id: I7541e4c7c65f9bed9b1f28d6c858473986dd50b4 (cherry-picked from commit 50a1abc67702f76968162402d8fb113dd6e22f31) Signed-off-by: Suren Baghdasaryan --- arch/x86/kernel/smp.c | 6 ------ 1 file changed, 6 deletions(-) diff --git a/arch/x86/kernel/smp.c b/arch/x86/kernel/smp.c index 935bc6562fa4..d842875f986f 100644 --- a/arch/x86/kernel/smp.c +++ b/arch/x86/kernel/smp.c @@ -184,9 +184,6 @@ static void native_stop_other_cpus(int wait) cpumask_clear_cpu(cpu, &cpus_stop_mask); if (!cpumask_empty(&cpus_stop_mask)) { - /* sync above data before sending IRQ */ - wmb(); - apic_send_IPI_allbutself(REBOOT_VECTOR); /* @@ -208,9 +205,6 @@ static void native_stop_other_cpus(int wait) * CPUs to stop. */ if (!smp_no_nmi_ipi && !register_stop_handler()) { - /* Sync above data before sending IRQ */ - wmb(); - pr_emerg("Shutting down cpus with NMI\n"); for_each_cpu(cpu, &cpus_stop_mask) From 26260c4bd1d03cf04c535f6bd9a5ed59ccd6b919 Mon Sep 17 00:00:00 2001 From: Thomas Gleixner Date: Thu, 15 Jun 2023 22:33:55 +0200 Subject: [PATCH 40/98] UPSTREAM: x86/smp: Use dedicated cache-line for mwait_play_dead() commit f9c9987bf52f4e42e940ae217333ebb5a4c3b506 upstream. Monitoring idletask::thread_info::flags in mwait_play_dead() has been an obvious choice as all what is needed is a cache line which is not written by other CPUs. But there is a use case where a "dead" CPU needs to be brought out of MWAIT: kexec(). This is required as kexec() can overwrite text, pagetables, stacks and the monitored cacheline of the original kernel. The latter causes MWAIT to resume execution which obviously causes havoc on the kexec kernel which results usually in triple faults. Use a dedicated per CPU storage to prepare for that. Signed-off-by: Thomas Gleixner Reviewed-by: Ashok Raj Reviewed-by: Borislav Petkov (AMD) Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20230615193330.434553750@linutronix.de Signed-off-by: Greg Kroah-Hartman Change-Id: I7cbfcec2d4e1bde18a9c45a7ccb7897ccaad7bd3 (cherry-picked from commit 6d3b2e0aef6c0118596928f697cb4471f6258a26) Signed-off-by: Suren Baghdasaryan --- arch/x86/kernel/smpboot.c | 24 ++++++++++++++---------- 1 file changed, 14 insertions(+), 10 deletions(-) diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c index 3f3ea0287f69..b96f983e64cc 100644 --- a/arch/x86/kernel/smpboot.c +++ b/arch/x86/kernel/smpboot.c @@ -99,6 +99,17 @@ EXPORT_PER_CPU_SYMBOL(cpu_die_map); DEFINE_PER_CPU_READ_MOSTLY(struct cpuinfo_x86, cpu_info); EXPORT_PER_CPU_SYMBOL(cpu_info); +struct mwait_cpu_dead { + unsigned int control; + unsigned int status; +}; + +/* + * Cache line aligned data for mwait_play_dead(). Separate on purpose so + * that it's unlikely to be touched by other CPUs. + */ +static DEFINE_PER_CPU_ALIGNED(struct mwait_cpu_dead, mwait_cpu_dead); + /* Logical package management. We might want to allocate that dynamically */ unsigned int __max_logical_packages __read_mostly; EXPORT_SYMBOL(__max_logical_packages); @@ -1746,10 +1757,10 @@ EXPORT_SYMBOL_GPL(cond_wakeup_cpu0); */ static inline void mwait_play_dead(void) { + struct mwait_cpu_dead *md = this_cpu_ptr(&mwait_cpu_dead); unsigned int eax, ebx, ecx, edx; unsigned int highest_cstate = 0; unsigned int highest_subcstate = 0; - void *mwait_ptr; int i; if (boot_cpu_data.x86_vendor == X86_VENDOR_AMD || @@ -1784,13 +1795,6 @@ static inline void mwait_play_dead(void) (highest_subcstate - 1); } - /* - * This should be a memory location in a cache line which is - * unlikely to be touched by other processors. The actual - * content is immaterial as it is not actually modified in any way. - */ - mwait_ptr = ¤t_thread_info()->flags; - wbinvd(); while (1) { @@ -1802,9 +1806,9 @@ static inline void mwait_play_dead(void) * case where we return around the loop. */ mb(); - clflush(mwait_ptr); + clflush(md); mb(); - __monitor(mwait_ptr, 0, 0); + __monitor(md, 0, 0); mb(); __mwait(eax, 0); From 19dd4101e0e419fe89d538abfb5c1fc3f65ca238 Mon Sep 17 00:00:00 2001 From: Thomas Gleixner Date: Thu, 15 Jun 2023 22:33:57 +0200 Subject: [PATCH 41/98] UPSTREAM: x86/smp: Cure kexec() vs. mwait_play_dead() breakage commit d7893093a7417527c0d73c9832244e65c9d0114f upstream. TLDR: It's a mess. When kexec() is executed on a system with offline CPUs, which are parked in mwait_play_dead() it can end up in a triple fault during the bootup of the kexec kernel or cause hard to diagnose data corruption. The reason is that kexec() eventually overwrites the previous kernel's text, page tables, data and stack. If it writes to the cache line which is monitored by a previously offlined CPU, MWAIT resumes execution and ends up executing the wrong text, dereferencing overwritten page tables or corrupting the kexec kernels data. Cure this by bringing the offlined CPUs out of MWAIT into HLT. Write to the monitored cache line of each offline CPU, which makes MWAIT resume execution. The written control word tells the offlined CPUs to issue HLT, which does not have the MWAIT problem. That does not help, if a stray NMI, MCE or SMI hits the offlined CPUs as those make it come out of HLT. A follow up change will put them into INIT, which protects at least against NMI and SMI. Fixes: ea53069231f9 ("x86, hotplug: Use mwait to offline a processor, fix the legacy case") Reported-by: Ashok Raj Signed-off-by: Thomas Gleixner Tested-by: Ashok Raj Reviewed-by: Ashok Raj Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20230615193330.492257119@linutronix.de Signed-off-by: Greg Kroah-Hartman Change-Id: I80035e671b55732ac3d56c71dc53364e82238fe2 (cherry-picked from commit 0af4750eaaeda20bc2ce8da414d85cc1653ae240) Signed-off-by: Suren Baghdasaryan --- arch/x86/include/asm/smp.h | 2 ++ arch/x86/kernel/smp.c | 5 ++++ arch/x86/kernel/smpboot.c | 59 ++++++++++++++++++++++++++++++++++++++ 3 files changed, 66 insertions(+) diff --git a/arch/x86/include/asm/smp.h b/arch/x86/include/asm/smp.h index a73bced40e24..b3b34032ef23 100644 --- a/arch/x86/include/asm/smp.h +++ b/arch/x86/include/asm/smp.h @@ -132,6 +132,8 @@ void wbinvd_on_cpu(int cpu); int wbinvd_on_all_cpus(void); void cond_wakeup_cpu0(void); +void smp_kick_mwait_play_dead(void); + void native_smp_send_reschedule(int cpu); void native_send_call_func_ipi(const struct cpumask *mask); void native_send_call_func_single_ipi(int cpu); diff --git a/arch/x86/kernel/smp.c b/arch/x86/kernel/smp.c index d842875f986f..174d6232b87f 100644 --- a/arch/x86/kernel/smp.c +++ b/arch/x86/kernel/smp.c @@ -21,6 +21,7 @@ #include #include #include +#include #include #include @@ -157,6 +158,10 @@ static void native_stop_other_cpus(int wait) if (atomic_cmpxchg(&stopping_cpu, -1, cpu) != -1) return; + /* For kexec, ensure that offline CPUs are out of MWAIT and in HLT */ + if (kexec_in_progress) + smp_kick_mwait_play_dead(); + /* * 1) Send an IPI on the reboot vector to all other CPUs. * diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c index b96f983e64cc..f32ee967414e 100644 --- a/arch/x86/kernel/smpboot.c +++ b/arch/x86/kernel/smpboot.c @@ -53,6 +53,7 @@ #include #include #include +#include #include #include #include @@ -104,6 +105,9 @@ struct mwait_cpu_dead { unsigned int status; }; +#define CPUDEAD_MWAIT_WAIT 0xDEADBEEF +#define CPUDEAD_MWAIT_KEXEC_HLT 0x4A17DEAD + /* * Cache line aligned data for mwait_play_dead(). Separate on purpose so * that it's unlikely to be touched by other CPUs. @@ -166,6 +170,10 @@ static void smp_callin(void) { int cpuid; + /* Mop up eventual mwait_play_dead() wreckage */ + this_cpu_write(mwait_cpu_dead.status, 0); + this_cpu_write(mwait_cpu_dead.control, 0); + /* * If waken up by an INIT in an 82489DX configuration * cpu_callout_mask guarantees we don't get here before @@ -1795,6 +1803,10 @@ static inline void mwait_play_dead(void) (highest_subcstate - 1); } + /* Set up state for the kexec() hack below */ + md->status = CPUDEAD_MWAIT_WAIT; + md->control = CPUDEAD_MWAIT_WAIT; + wbinvd(); while (1) { @@ -1812,10 +1824,57 @@ static inline void mwait_play_dead(void) mb(); __mwait(eax, 0); + if (READ_ONCE(md->control) == CPUDEAD_MWAIT_KEXEC_HLT) { + /* + * Kexec is about to happen. Don't go back into mwait() as + * the kexec kernel might overwrite text and data including + * page tables and stack. So mwait() would resume when the + * monitor cache line is written to and then the CPU goes + * south due to overwritten text, page tables and stack. + * + * Note: This does _NOT_ protect against a stray MCE, NMI, + * SMI. They will resume execution at the instruction + * following the HLT instruction and run into the problem + * which this is trying to prevent. + */ + WRITE_ONCE(md->status, CPUDEAD_MWAIT_KEXEC_HLT); + while(1) + native_halt(); + } + cond_wakeup_cpu0(); } } +/* + * Kick all "offline" CPUs out of mwait on kexec(). See comment in + * mwait_play_dead(). + */ +void smp_kick_mwait_play_dead(void) +{ + u32 newstate = CPUDEAD_MWAIT_KEXEC_HLT; + struct mwait_cpu_dead *md; + unsigned int cpu, i; + + for_each_cpu_andnot(cpu, cpu_present_mask, cpu_online_mask) { + md = per_cpu_ptr(&mwait_cpu_dead, cpu); + + /* Does it sit in mwait_play_dead() ? */ + if (READ_ONCE(md->status) != CPUDEAD_MWAIT_WAIT) + continue; + + /* Wait up to 5ms */ + for (i = 0; READ_ONCE(md->status) != newstate && i < 1000; i++) { + /* Bring it out of mwait */ + WRITE_ONCE(md->control, newstate); + udelay(5); + } + + if (READ_ONCE(md->status) != newstate) + pr_err_once("CPU%u is stuck in mwait_play_dead()\n", cpu); + } +} + void hlt_play_dead(void) { if (__this_cpu_read(cpu_info.x86) >= 4) From 66b5ad35078b3b86cc048755ab8bc109694d5740 Mon Sep 17 00:00:00 2001 From: Peng Zhang Date: Sat, 6 May 2023 10:47:52 +0800 Subject: [PATCH 42/98] BACKPORT: maple_tree: fix potential out-of-bounds access in mas_wr_end_piv() commit cd00dd2585c4158e81fdfac0bbcc0446afbad26d upstream. Check the write offset end bounds before using it as the offset into the pivot array. This avoids a possible out-of-bounds access on the pivot array if the write extends to the last slot in the node, in which case the node maximum should be used as the end pivot. akpm: this doesn't affect any current callers, but new users of mapletree may encounter this problem if backported into earlier kernels, so let's fix it in -stable kernels in case of this. Link: https://lkml.kernel.org/r/20230506024752.2550-1-zhangpeng.00@bytedance.com Fixes: 54a611b60590 ("Maple Tree: add new data structure") Signed-off-by: Peng Zhang Reviewed-by: Liam R. Howlett Cc: Signed-off-by: Andrew Morton Signed-off-by: Greg Kroah-Hartman Change-Id: I992549af25fa9c22f587893d004002d2e004d317 (cherry-picked from commit 4e2ad53ababeaac44d71162650984abfe783960c) Signed-off-by: Suren Baghdasaryan --- lib/maple_tree.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/lib/maple_tree.c b/lib/maple_tree.c index 24b31aee7880..b0a828f863c3 100644 --- a/lib/maple_tree.c +++ b/lib/maple_tree.c @@ -4322,11 +4322,13 @@ static inline void mas_wr_end_piv(struct ma_wr_state *wr_mas) { wr_mas->end_piv = wr_mas->r_max; - while ((wr_mas->mas->last > wr_mas->end_piv) && - (wr_mas->offset_end < wr_mas->node_end)) - wr_mas->end_piv = wr_mas->pivots[++wr_mas->offset_end]; + while ((wr_mas->offset_end < wr_mas->node_end) && + (wr_mas->mas->last > wr_mas->pivots[wr_mas->offset_end])) + wr_mas->offset_end++; - if (wr_mas->mas->last > wr_mas->end_piv) + if (wr_mas->offset_end < wr_mas->node_end) + wr_mas->end_piv = wr_mas->pivots[wr_mas->offset_end]; + else wr_mas->end_piv = wr_mas->mas->max; if (!wr_mas->entry) From 3803ae4a2832706860970b8a81591bd0c7798636 Mon Sep 17 00:00:00 2001 From: Linus Torvalds Date: Thu, 15 Jun 2023 15:17:36 -0700 Subject: [PATCH 43/98] BACKPORT: mm: introduce new 'lock_mm_and_find_vma()' page fault helper commit c2508ec5a58db67093f4fb8bf89a9a7c53a109e9 upstream. .. and make x86 use it. This basically extracts the existing x86 "find and expand faulting vma" code, but extends it to also take the mmap lock for writing in case we actually do need to expand the vma. We've historically short-circuited that case, and have some rather ugly special logic to serialize the stack segment expansion (since we only hold the mmap lock for reading) that doesn't match the normal VM locking. That slight violation of locking worked well, right up until it didn't: the maple tree code really does want proper locking even for simple extension of an existing vma. So extract the code for "look up the vma of the fault" from x86, fix it up to do the necessary write locking, and make it available as a helper function for other architectures that can use the common helper. Note: I say "common helper", but it really only handles the normal stack-grows-down case. Which is all architectures except for PA-RISC and IA64. So some rare architectures can't use the helper, but if they care they'll just need to open-code this logic. It's also worth pointing out that this code really would like to have an optimistic "mmap_upgrade_trylock()" to make it quicker to go from a read-lock (for the common case) to taking the write lock (for having to extend the vma) in the normal single-threaded situation where there is no other locking activity. But that _is_ all the very uncommon special case, so while it would be nice to have such an operation, it probably doesn't matter in reality. I did put in the skeleton code for such a possible future expansion, even if it only acts as pseudo-documentation for what we're doing. Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman [surenb: this one is taken from 6.4.y stable branch] Change-Id: I6e16e6751245ac24adcbe78114bc57c726463acb (cherry-picked from commit d6a5c7a1a6e52d4c46fe181237ca96cd46a42386) Signed-off-by: Suren Baghdasaryan --- arch/x86/Kconfig | 1 + arch/x86/mm/fault.c | 52 +------------------ include/linux/mm.h | 2 + mm/Kconfig | 4 ++ mm/memory.c | 121 ++++++++++++++++++++++++++++++++++++++++++++ 5 files changed, 130 insertions(+), 50 deletions(-) diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig index ab3ce4ea05d0..22cdc45031d4 100644 --- a/arch/x86/Kconfig +++ b/arch/x86/Kconfig @@ -272,6 +272,7 @@ config X86 select HAVE_GENERIC_VDSO select HOTPLUG_SMT if SMP select IRQ_FORCED_THREADING + select LOCK_MM_AND_FIND_VMA select NEED_PER_CPU_EMBED_FIRST_CHUNK select NEED_PER_CPU_PAGE_FIRST_CHUNK select NEED_SG_DMA_LENGTH diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c index 6551d6249f8a..8a74089d9f2e 100644 --- a/arch/x86/mm/fault.c +++ b/arch/x86/mm/fault.c @@ -901,12 +901,6 @@ __bad_area(struct pt_regs *regs, unsigned long error_code, __bad_area_nosemaphore(regs, error_code, address, pkey, si_code); } -static noinline void -bad_area(struct pt_regs *regs, unsigned long error_code, unsigned long address) -{ - __bad_area(regs, error_code, address, 0, SEGV_MAPERR); -} - static inline bool bad_area_access_from_pkeys(unsigned long error_code, struct vm_area_struct *vma) { @@ -1387,51 +1381,10 @@ void do_user_addr_fault(struct pt_regs *regs, lock_mmap: #endif /* CONFIG_PER_VMA_LOCK */ - /* - * Kernel-mode access to the user address space should only occur - * on well-defined single instructions listed in the exception - * tables. But, an erroneous kernel fault occurring outside one of - * those areas which also holds mmap_lock might deadlock attempting - * to validate the fault against the address space. - * - * Only do the expensive exception table search when we might be at - * risk of a deadlock. This happens if we - * 1. Failed to acquire mmap_lock, and - * 2. The access did not originate in userspace. - */ - if (unlikely(!mmap_read_trylock(mm))) { - if (!user_mode(regs) && !search_exception_tables(regs->ip)) { - /* - * Fault from code in kernel from - * which we do not expect faults. - */ - bad_area_nosemaphore(regs, error_code, address); - return; - } retry: - mmap_read_lock(mm); - } else { - /* - * The above down_read_trylock() might have succeeded in - * which case we'll have missed the might_sleep() from - * down_read(): - */ - might_sleep(); - } - - vma = find_vma(mm, address); + vma = lock_mm_and_find_vma(mm, address, regs); if (unlikely(!vma)) { - bad_area(regs, error_code, address); - return; - } - if (likely(vma->vm_start <= address)) - goto good_area; - if (unlikely(!(vma->vm_flags & VM_GROWSDOWN))) { - bad_area(regs, error_code, address); - return; - } - if (unlikely(expand_stack(vma, address))) { - bad_area(regs, error_code, address); + bad_area_nosemaphore(regs, error_code, address); return; } @@ -1439,7 +1392,6 @@ retry: * Ok, we have a good vm_area for this memory access, so * we can handle it.. */ -good_area: if (unlikely(access_error(error_code, vma))) { bad_area_access_error(regs, error_code, address, vma); return; diff --git a/include/linux/mm.h b/include/linux/mm.h index 718bb0f8446c..fa3de0b51a29 100644 --- a/include/linux/mm.h +++ b/include/linux/mm.h @@ -2117,6 +2117,8 @@ void unmap_mapping_pages(struct address_space *mapping, pgoff_t start, pgoff_t nr, bool even_cows); void unmap_mapping_range(struct address_space *mapping, loff_t const holebegin, loff_t const holelen, int even_cows); +struct vm_area_struct *lock_mm_and_find_vma(struct mm_struct *mm, + unsigned long address, struct pt_regs *regs); #else static inline vm_fault_t handle_mm_fault(struct vm_area_struct *vma, unsigned long address, unsigned int flags, diff --git a/mm/Kconfig b/mm/Kconfig index a58632a9fbd9..985ed3d2adbd 100644 --- a/mm/Kconfig +++ b/mm/Kconfig @@ -1196,6 +1196,10 @@ config PER_VMA_LOCK This feature allows locking each virtual memory area separately when handling page faults instead of taking mmap_lock. +config LOCK_MM_AND_FIND_VMA + bool + depends on !STACK_GROWSUP + source "mm/damon/Kconfig" endmenu diff --git a/mm/memory.c b/mm/memory.c index d31c23419631..78a9e3fb0e65 100644 --- a/mm/memory.c +++ b/mm/memory.c @@ -5287,6 +5287,127 @@ out: } EXPORT_SYMBOL_GPL(handle_mm_fault); +#ifdef CONFIG_LOCK_MM_AND_FIND_VMA +#include + +static inline bool get_mmap_lock_carefully(struct mm_struct *mm, struct pt_regs *regs) +{ + /* Even if this succeeds, make it clear we *might* have slept */ + if (likely(mmap_read_trylock(mm))) { + might_sleep(); + return true; + } + + if (regs && !user_mode(regs)) { + unsigned long ip = instruction_pointer(regs); + if (!search_exception_tables(ip)) + return false; + } + + mmap_read_lock(mm); + return true; +} + +static inline bool mmap_upgrade_trylock(struct mm_struct *mm) +{ + /* + * We don't have this operation yet. + * + * It should be easy enough to do: it's basically a + * atomic_long_try_cmpxchg_acquire() + * from RWSEM_READER_BIAS -> RWSEM_WRITER_LOCKED, but + * it also needs the proper lockdep magic etc. + */ + return false; +} + +static inline bool upgrade_mmap_lock_carefully(struct mm_struct *mm, struct pt_regs *regs) +{ + mmap_read_unlock(mm); + if (regs && !user_mode(regs)) { + unsigned long ip = instruction_pointer(regs); + if (!search_exception_tables(ip)) + return false; + } + mmap_write_lock(mm); + return true; +} + +/* + * Helper for page fault handling. + * + * This is kind of equivalend to "mmap_read_lock()" followed + * by "find_extend_vma()", except it's a lot more careful about + * the locking (and will drop the lock on failure). + * + * For example, if we have a kernel bug that causes a page + * fault, we don't want to just use mmap_read_lock() to get + * the mm lock, because that would deadlock if the bug were + * to happen while we're holding the mm lock for writing. + * + * So this checks the exception tables on kernel faults in + * order to only do this all for instructions that are actually + * expected to fault. + * + * We can also actually take the mm lock for writing if we + * need to extend the vma, which helps the VM layer a lot. + */ +struct vm_area_struct *lock_mm_and_find_vma(struct mm_struct *mm, + unsigned long addr, struct pt_regs *regs) +{ + struct vm_area_struct *vma; + + if (!get_mmap_lock_carefully(mm, regs)) + return NULL; + + vma = find_vma(mm, addr); + if (likely(vma && (vma->vm_start <= addr))) + return vma; + + /* + * Well, dang. We might still be successful, but only + * if we can extend a vma to do so. + */ + if (!vma || !(vma->vm_flags & VM_GROWSDOWN)) { + mmap_read_unlock(mm); + return NULL; + } + + /* + * We can try to upgrade the mmap lock atomically, + * in which case we can continue to use the vma + * we already looked up. + * + * Otherwise we'll have to drop the mmap lock and + * re-take it, and also look up the vma again, + * re-checking it. + */ + if (!mmap_upgrade_trylock(mm)) { + if (!upgrade_mmap_lock_carefully(mm, regs)) + return NULL; + + vma = find_vma(mm, addr); + if (!vma) + goto fail; + if (vma->vm_start <= addr) + goto success; + if (!(vma->vm_flags & VM_GROWSDOWN)) + goto fail; + } + + if (expand_stack(vma, addr)) + goto fail; + +success: + mmap_write_downgrade(mm); + return vma; + +fail: + mmap_write_unlock(mm); + return NULL; +} +#endif + #ifdef CONFIG_PER_VMA_LOCK /* * Lookup and lock a VMA under RCU protection. Returned VMA is guaranteed to be From 1e114e6efac1254b0a5c11c1a8f9b6d7bdec0d7f Mon Sep 17 00:00:00 2001 From: Vincent Donnefort Date: Fri, 21 Jul 2023 16:48:06 +0100 Subject: [PATCH 44/98] ANDROID: KVM: arm64: Fix memory ordering for pKVM module callbacks Registration of module callbacks for the pKVM hypervisor is lockless thanks to the use of a cmpxchg. Problem, a CPU can speculatively execute an indirect branch and speculatively read variables used in that branch. We then need to order the memory access between variables potentially set in the driver init (before the callback registration happen) and the call to that registered callback. e.g. in the case of the serial. CPU0: CPU1: driver_init(): hyp_serial_enabled() base_addr = 0xdeadbeef; enabled = __hyp_putc barrier(); barrier(); ops->register_serial_driver(putc); if (enabled) __hyp_putc(); /* read base_addr */ This is the same for the SMC and PSCI handler callbacks. The abort and fault callbacks are not impacted: the driver init can only happen before the kernel is deprivileged i.e. before the host stage-2 is in place and then before any of those callbacks can be triggered. Instead of a full barrier, we can use the acquire/release semantics: relaxing cmpxchg to cmpxchg_release in the registration path and use a load_acquire in hyp_serial_enabled(). Bug: 292470326 Change-Id: I4b5fe3713fe40cc5ab42ea0e9cdf54e8315dfb44 Signed-off-by: Vincent Donnefort --- arch/arm64/kvm/hyp/nvhe/hyp-main.c | 9 +++++++-- arch/arm64/kvm/hyp/nvhe/psci-relay.c | 9 +++++++-- arch/arm64/kvm/hyp/nvhe/serial.c | 10 ++++++++-- 3 files changed, 22 insertions(+), 6 deletions(-) diff --git a/arch/arm64/kvm/hyp/nvhe/hyp-main.c b/arch/arm64/kvm/hyp/nvhe/hyp-main.c index 16abb1e0de08..48e20ad5ff38 100644 --- a/arch/arm64/kvm/hyp/nvhe/hyp-main.c +++ b/arch/arm64/kvm/hyp/nvhe/hyp-main.c @@ -39,7 +39,12 @@ static bool (*default_trap_handler)(struct kvm_cpu_context *host_ctxt); int __pkvm_register_host_smc_handler(bool (*cb)(struct kvm_cpu_context *)) { - return cmpxchg(&default_host_smc_handler, NULL, cb) ? -EBUSY : 0; + /* + * Paired with smp_load_acquire(&default_host_smc_handler) in + * handle_host_smc(). Ensure memory stores happening during a pKVM module + * init are observed before executing the callback. + */ + return cmpxchg_release(&default_host_smc_handler, NULL, cb) ? -EBUSY : 0; } int __pkvm_register_default_trap_handler(bool (*cb)(struct kvm_cpu_context *)) @@ -1376,7 +1381,7 @@ static void handle_host_smc(struct kvm_cpu_context *host_ctxt) handled = kvm_host_psci_handler(host_ctxt); if (!handled) handled = kvm_host_ffa_handler(host_ctxt); - if (!handled && READ_ONCE(default_host_smc_handler)) + if (!handled && smp_load_acquire(&default_host_smc_handler)) handled = default_host_smc_handler(host_ctxt); if (!handled) __kvm_hyp_host_forward_smc(host_ctxt); diff --git a/arch/arm64/kvm/hyp/nvhe/psci-relay.c b/arch/arm64/kvm/hyp/nvhe/psci-relay.c index d4825b6140ba..f8db5445b530 100644 --- a/arch/arm64/kvm/hyp/nvhe/psci-relay.c +++ b/arch/arm64/kvm/hyp/nvhe/psci-relay.c @@ -28,14 +28,19 @@ struct kvm_host_psci_config __ro_after_init kvm_host_psci_config; static void (*pkvm_psci_notifier)(enum pkvm_psci_notification, struct kvm_cpu_context *); static void pkvm_psci_notify(enum pkvm_psci_notification notif, struct kvm_cpu_context *host_ctxt) { - if (READ_ONCE(pkvm_psci_notifier)) + if (smp_load_acquire(&pkvm_psci_notifier)) pkvm_psci_notifier(notif, host_ctxt); } #ifdef CONFIG_MODULES int __pkvm_register_psci_notifier(void (*cb)(enum pkvm_psci_notification, struct kvm_cpu_context *)) { - return cmpxchg(&pkvm_psci_notifier, NULL, cb) ? -EBUSY : 0; + /* + * Paired with smp_load_acquire(&pkvm_psci_notifier) in + * pkvm_psci_notify(). Ensure memory stores hapenning during a pKVM module + * init are observed before executing the callback. + */ + return cmpxchg_release(&pkvm_psci_notifier, NULL, cb) ? -EBUSY : 0; } #endif diff --git a/arch/arm64/kvm/hyp/nvhe/serial.c b/arch/arm64/kvm/hyp/nvhe/serial.c index 0b2cf3b6d6a5..475ebf4ba7de 100644 --- a/arch/arm64/kvm/hyp/nvhe/serial.c +++ b/arch/arm64/kvm/hyp/nvhe/serial.c @@ -35,7 +35,8 @@ static inline void __hyp_putx4n(unsigned long x, int n) static inline bool hyp_serial_enabled(void) { - return !!READ_ONCE(__hyp_putc); + /* Paired with __pkvm_register_serial_driver()'s cmpxchg */ + return !!smp_load_acquire(&__hyp_putc); } void hyp_puts(const char *s) @@ -64,5 +65,10 @@ void hyp_putc(char c) int __pkvm_register_serial_driver(void (*cb)(char)) { - return cmpxchg(&__hyp_putc, NULL, cb) ? -EBUSY : 0; + /* + * Paired with smp_load_acquire(&__hyp_putc) in + * hyp_serial_enabled(). Ensure memory stores hapenning during a pKVM + * module init are observed before executing the callback. + */ + return cmpxchg_release(&__hyp_putc, NULL, cb) ? -EBUSY : 0; } From ec419af28fddc79ed28fc81928b49d46679c623d Mon Sep 17 00:00:00 2001 From: lambert wang Date: Wed, 26 Jul 2023 16:28:48 +0800 Subject: [PATCH 45/98] ANDROID: devlink: Select CONFIG_NET_DEVLINK in Kconfig.gki Select hidden Kconfig: NET_DEVLINK. Required by device drivers to provide unified interface to expose device info, capture coredump and perform device flash. Bug: 283707518 Change-Id: I1cc5b7dce36c79549cd7f1d9b755f7bab3973f0e Signed-off-by: michael cai Signed-off-by: lambert wang --- init/Kconfig.gki | 1 + 1 file changed, 1 insertion(+) diff --git a/init/Kconfig.gki b/init/Kconfig.gki index 29eb1eefbd3d..081b1cdc9c7e 100644 --- a/init/Kconfig.gki +++ b/init/Kconfig.gki @@ -201,6 +201,7 @@ config GKI_HIDDEN_NET_CONFIGS bool "Hidden networking configuration needed for GKI" select PAGE_POOL select NET_PTP_CLASSIFY + select NET_DEVLINK help Dummy config option used to enable the networking hidden config, required by various SoC platforms. From b61f298c0d9acd229a3ad9d240dad78c6efbdce4 Mon Sep 17 00:00:00 2001 From: lambert wang Date: Wed, 26 Jul 2023 17:46:28 +0800 Subject: [PATCH 46/98] ANDROID: GKI: Add ABI symbol list(devlink) for MTK 17 function symbol(s) added 'bool device_remove_file_self(struct device*, const struct device_attribute*)' 'struct devlink* devlink_alloc_ns(const struct devlink_ops*, size_t, struct net*, struct device*)' 'void devlink_flash_update_status_notify(struct devlink*, const char*, const char*, unsigned long, unsigned long)' 'int devlink_fmsg_binary_pair_nest_end(struct devlink_fmsg*)' 'int devlink_fmsg_binary_pair_nest_start(struct devlink_fmsg*, const char*)' 'int devlink_fmsg_binary_put(struct devlink_fmsg*, const void*, u16)' 'void devlink_free(struct devlink*)' 'int devlink_health_report(struct devlink_health_reporter*, const char*, void*)' 'struct devlink_health_reporter* devlink_health_reporter_create(struct devlink*, const struct devlink_health_reporter_ops*, u64, void*)' 'void devlink_health_reporter_destroy(struct devlink_health_reporter*)' 'void* devlink_health_reporter_priv(struct devlink_health_reporter*)' 'void devlink_health_reporter_state_update(struct devlink_health_reporter*, enum devlink_health_reporter_state)' 'void* devlink_priv(struct devlink*)' 'struct devlink_region* devlink_region_create(struct devlink*, const struct devlink_region_ops*, u32, u64)' 'void devlink_region_destroy(struct devlink_region*)' 'void devlink_register(struct devlink*)' 'void devlink_unregister(struct devlink*)' type 'struct devlink' changed was only declared, is now fully defined type 'struct devlink_linecard' changed was only declared, is now fully defined Bug: 283707518 Change-Id: I686fd14c13863c27b3dfdb29cd7c6b6d5a0a3127 Signed-off-by: lambert wang Signed-off-by: iven yang Signed-off-by: michael cai --- android/abi_gki_aarch64.stg | 2838 ++++++++++++++++++++++++++++++++++- android/abi_gki_aarch64_mtk | 17 + 2 files changed, 2834 insertions(+), 21 deletions(-) diff --git a/android/abi_gki_aarch64.stg b/android/abi_gki_aarch64.stg index a8fc00774738..13de9dcc4631 100644 --- a/android/abi_gki_aarch64.stg +++ b/android/abi_gki_aarch64.stg @@ -1301,6 +1301,11 @@ pointer_reference { kind: POINTER pointee_type_id: 0x39185662 } +pointer_reference { + id: 0x04d7fcdd + kind: POINTER + pointee_type_id: 0x391f15ea +} pointer_reference { id: 0x04dad728 kind: POINTER @@ -2671,6 +2676,11 @@ pointer_reference { kind: POINTER pointee_type_id: 0x03f06751 } +pointer_reference { + id: 0x0a70ce1b + kind: POINTER + pointee_type_id: 0x0383def3 +} pointer_reference { id: 0x0a747547 kind: POINTER @@ -4046,6 +4056,11 @@ pointer_reference { kind: POINTER pointee_type_id: 0x19832066 } +pointer_reference { + id: 0x0cf3d8fe + kind: POINTER + pointee_type_id: 0x198f8565 +} pointer_reference { id: 0x0cf80951 kind: POINTER @@ -4241,6 +4256,11 @@ pointer_reference { kind: POINTER pointee_type_id: 0x1e3b8bac } +pointer_reference { + id: 0x0d1f55de + kind: POINTER + pointee_type_id: 0x1e3db1e5 +} pointer_reference { id: 0x0d20d38c kind: POINTER @@ -4276,6 +4296,11 @@ pointer_reference { kind: POINTER pointee_type_id: 0x1edfcb66 } +pointer_reference { + id: 0x0d27dc9d + kind: POINTER + pointee_type_id: 0x1edf94e9 +} pointer_reference { id: 0x0d2958f6 kind: POINTER @@ -5346,6 +5371,11 @@ pointer_reference { kind: POINTER pointee_type_id: 0x12725ea0 } +pointer_reference { + id: 0x0e0dc148 + kind: POINTER + pointee_type_id: 0x1277e3bd +} pointer_reference { id: 0x0e0dc9f3 kind: POINTER @@ -5511,6 +5541,11 @@ pointer_reference { kind: POINTER pointee_type_id: 0x129eb456 } +pointer_reference { + id: 0x0e38185b + kind: POINTER + pointee_type_id: 0x12a087f3 +} pointer_reference { id: 0x0e395200 kind: POINTER @@ -5571,6 +5606,11 @@ pointer_reference { kind: POINTER pointee_type_id: 0x13525403 } +pointer_reference { + id: 0x0e44c87b + kind: POINTER + pointee_type_id: 0x1353c771 +} pointer_reference { id: 0x0e44f9f8 kind: POINTER @@ -5641,6 +5681,11 @@ pointer_reference { kind: POINTER pointee_type_id: 0x13797fb7 } +pointer_reference { + id: 0x0e4e7ccb + kind: POINTER + pointee_type_id: 0x137915b0 +} pointer_reference { id: 0x0e4f7e58 kind: POINTER @@ -6921,6 +6966,11 @@ pointer_reference { kind: POINTER pointee_type_id: 0x17ce1ca0 } +pointer_reference { + id: 0x0f657fc1 + kind: POINTER + pointee_type_id: 0x17d51999 +} pointer_reference { id: 0x0f677ef9 kind: POINTER @@ -8091,6 +8141,11 @@ pointer_reference { kind: POINTER pointee_type_id: 0x664d9cb2 } +pointer_reference { + id: 0x130aa721 + kind: POINTER + pointee_type_id: 0x666a7a1b +} pointer_reference { id: 0x13185ce8 kind: POINTER @@ -8836,6 +8891,11 @@ pointer_reference { kind: POINTER pointee_type_id: 0x76e78cd9 } +pointer_reference { + id: 0x173696bc + kind: POINTER + pointee_type_id: 0x769abc6d +} pointer_reference { id: 0x1740e61d kind: POINTER @@ -8976,6 +9036,11 @@ pointer_reference { kind: POINTER pointee_type_id: 0x755b6647 } +pointer_reference { + id: 0x17d51999 + kind: POINTER + pointee_type_id: 0x751480f9 +} pointer_reference { id: 0x17dabdcd kind: POINTER @@ -9436,6 +9501,11 @@ pointer_reference { kind: POINTER pointee_type_id: 0x4d320115 } +pointer_reference { + id: 0x19df035f + kind: POINTER + pointee_type_id: 0x4d3cebe1 +} pointer_reference { id: 0x19e0c64c kind: POINTER @@ -9721,6 +9791,11 @@ pointer_reference { kind: POINTER pointee_type_id: 0x475137a2 } +pointer_reference { + id: 0x1b4a1f75 + kind: POINTER + pointee_type_id: 0x47689b48 +} pointer_reference { id: 0x1b4ce091 kind: POINTER @@ -10826,6 +10901,11 @@ pointer_reference { kind: POINTER pointee_type_id: 0x551d0131 } +pointer_reference { + id: 0x1fdf8df4 + kind: POINTER + pointee_type_id: 0x553ed14c +} pointer_reference { id: 0x1fe51930 kind: POINTER @@ -11616,6 +11696,11 @@ pointer_reference { kind: POINTER pointee_type_id: 0xa57d1db8 } +pointer_reference { + id: 0x23d822f9 + kind: POINTER + pointee_type_id: 0xa5206d7a +} pointer_reference { id: 0x23d902f6 kind: POINTER @@ -11936,11 +12021,6 @@ pointer_reference { kind: POINTER pointee_type_id: 0xbceec39a } -pointer_reference { - id: 0x25b57283 - kind: POINTER - pointee_type_id: 0xbc952c91 -} pointer_reference { id: 0x25b73daa kind: POINTER @@ -12371,6 +12451,11 @@ pointer_reference { kind: POINTER pointee_type_id: 0xb4a26738 } +pointer_reference { + id: 0x27c7b3cb + kind: POINTER + pointee_type_id: 0xb55e29b2 +} pointer_reference { id: 0x27cf73eb kind: POINTER @@ -12806,16 +12891,16 @@ pointer_reference { kind: POINTER pointee_type_id: 0x8de7c9fe } +pointer_reference { + id: 0x29ef8105 + kind: POINTER + pointee_type_id: 0x8dfee289 +} pointer_reference { id: 0x29f9c70b kind: POINTER pointee_type_id: 0x8da7fab2 } -pointer_reference { - id: 0x2a0586b2 - kind: POINTER - pointee_type_id: 0x8256fc56 -} pointer_reference { id: 0x2a0a605f kind: POINTER @@ -15771,6 +15856,26 @@ pointer_reference { kind: POINTER pointee_type_id: 0x99be88a0 } +pointer_reference { + id: 0x2d000b85 + kind: POINTER + pointee_type_id: 0x9e40c88b +} +pointer_reference { + id: 0x2d00157c + kind: POINTER + pointee_type_id: 0x9e40b36c +} +pointer_reference { + id: 0x2d004103 + kind: POINTER + pointee_type_id: 0x9e41e293 +} +pointer_reference { + id: 0x2d004a69 + kind: POINTER + pointee_type_id: 0x9e41cf39 +} pointer_reference { id: 0x2d008d0e kind: POINTER @@ -15781,21 +15886,61 @@ pointer_reference { kind: POINTER pointee_type_id: 0x9e448e2a } +pointer_reference { + id: 0x2d018e8d + kind: POINTER + pointee_type_id: 0x9e46dca9 +} +pointer_reference { + id: 0x2d01e009 + kind: POINTER + pointee_type_id: 0x9e4766bb +} pointer_reference { id: 0x2d0240fc kind: POINTER pointee_type_id: 0x9e49e56e } +pointer_reference { + id: 0x2d02e4d4 + kind: POINTER + pointee_type_id: 0x9e4b75cd +} +pointer_reference { + id: 0x2d033017 + kind: POINTER + pointee_type_id: 0x9e4c26c1 +} pointer_reference { id: 0x2d036f50 kind: POINTER pointee_type_id: 0x9e4d5bdd } +pointer_reference { + id: 0x2d0429c2 + kind: POINTER + pointee_type_id: 0x9e504197 +} +pointer_reference { + id: 0x2d044ee7 + kind: POINTER + pointee_type_id: 0x9e51dd03 +} +pointer_reference { + id: 0x2d046cf4 + kind: POINTER + pointee_type_id: 0x9e51554f +} pointer_reference { id: 0x2d04a781 kind: POINTER pointee_type_id: 0x9e52789b } +pointer_reference { + id: 0x2d0679a1 + kind: POINTER + pointee_type_id: 0x9e590019 +} pointer_reference { id: 0x2d06e5cd kind: POINTER @@ -15811,6 +15956,16 @@ pointer_reference { kind: POINTER pointee_type_id: 0x9e5ef2fc } +pointer_reference { + id: 0x2d081f17 + kind: POINTER + pointee_type_id: 0x9e609ac2 +} +pointer_reference { + id: 0x2d085064 + kind: POINTER + pointee_type_id: 0x9e61a70c +} pointer_reference { id: 0x2d08a576 kind: POINTER @@ -15826,6 +15981,16 @@ pointer_reference { kind: POINTER pointee_type_id: 0x9e663e24 } +pointer_reference { + id: 0x2d0a0361 + kind: POINTER + pointee_type_id: 0x9e68eb19 +} +pointer_reference { + id: 0x2d0ab1eb + kind: POINTER + pointee_type_id: 0x9e6a2131 +} pointer_reference { id: 0x2d0b7a8e kind: POINTER @@ -15851,6 +16016,11 @@ pointer_reference { kind: POINTER pointee_type_id: 0x9e792fe6 } +pointer_reference { + id: 0x2d0e9268 + kind: POINTER + pointee_type_id: 0x9e7aaf3f +} pointer_reference { id: 0x2d0fdd7c kind: POINTER @@ -15886,6 +16056,11 @@ pointer_reference { kind: POINTER pointee_type_id: 0x9e026d74 } +pointer_reference { + id: 0x2d11ffb5 + kind: POINTER + pointee_type_id: 0x9e071849 +} pointer_reference { id: 0x2d126960 kind: POINTER @@ -15901,6 +16076,16 @@ pointer_reference { kind: POINTER pointee_type_id: 0x9e11d049 } +pointer_reference { + id: 0x2d154530 + kind: POINTER + pointee_type_id: 0x9e15f25c +} +pointer_reference { + id: 0x2d161d5c + kind: POINTER + pointee_type_id: 0x9e1893ee +} pointer_reference { id: 0x2d164af6 kind: POINTER @@ -15911,6 +16096,11 @@ pointer_reference { kind: POINTER pointee_type_id: 0x9e19651e } +pointer_reference { + id: 0x2d16aeaf + kind: POINTER + pointee_type_id: 0x9e1a5c22 +} pointer_reference { id: 0x2d16b2fd kind: POINTER @@ -15971,6 +16161,11 @@ pointer_reference { kind: POINTER pointee_type_id: 0x9e2ef574 } +pointer_reference { + id: 0x2d1c1d12 + kind: POINTER + pointee_type_id: 0x9e3092d5 +} pointer_reference { id: 0x2d1c7478 kind: POINTER @@ -16301,6 +16496,11 @@ pointer_reference { kind: POINTER pointee_type_id: 0x9ebfed71 } +pointer_reference { + id: 0x2d3ffbc6 + kind: POINTER + pointee_type_id: 0x9ebf0984 +} pointer_reference { id: 0x2d4051be kind: POINTER @@ -16406,6 +16606,11 @@ pointer_reference { kind: POINTER pointee_type_id: 0x9f6f73ed } +pointer_reference { + id: 0x2d4c6881 + kind: POINTER + pointee_type_id: 0x9f71449b +} pointer_reference { id: 0x2d4eaa35 kind: POINTER @@ -16421,6 +16626,11 @@ pointer_reference { kind: POINTER pointee_type_id: 0x9f7fc723 } +pointer_reference { + id: 0x2d4fcd25 + kind: POINTER + pointee_type_id: 0x9f7fd20b +} pointer_reference { id: 0x2d50c295 kind: POINTER @@ -16461,6 +16671,11 @@ pointer_reference { kind: POINTER pointee_type_id: 0x9f1dcaea } +pointer_reference { + id: 0x2d594ead + kind: POINTER + pointee_type_id: 0x9f25dc29 +} pointer_reference { id: 0x2d59c606 kind: POINTER @@ -16691,6 +16906,16 @@ pointer_reference { kind: POINTER pointee_type_id: 0x9f87b817 } +pointer_reference { + id: 0x2d7368ed + kind: POINTER + pointee_type_id: 0x9f8d452b +} +pointer_reference { + id: 0x2d739f19 + kind: POINTER + pointee_type_id: 0x9f8e9af9 +} pointer_reference { id: 0x2d7549b3 kind: POINTER @@ -16731,6 +16956,16 @@ pointer_reference { kind: POINTER pointee_type_id: 0x9fa3b723 } +pointer_reference { + id: 0x2d7ab985 + kind: POINTER + pointee_type_id: 0x9faa0088 +} +pointer_reference { + id: 0x2d7ac448 + kind: POINTER + pointee_type_id: 0x9fabf7be +} pointer_reference { id: 0x2d7ae3a5 kind: POINTER @@ -16931,6 +17166,11 @@ pointer_reference { kind: POINTER pointee_type_id: 0x9c7d7af2 } +pointer_reference { + id: 0x2d8fd28a + kind: POINTER + pointee_type_id: 0x9c7facb4 +} pointer_reference { id: 0x2d8fdd2c kind: POINTER @@ -17216,6 +17456,11 @@ pointer_reference { kind: POINTER pointee_type_id: 0x9cf48276 } +pointer_reference { + id: 0x2dae0c91 + kind: POINTER + pointee_type_id: 0x9cf8d4d9 +} pointer_reference { id: 0x2dae560d kind: POINTER @@ -17951,6 +18196,11 @@ pointer_reference { kind: POINTER pointee_type_id: 0x9da05299 } +pointer_reference { + id: 0x2df84197 + kind: POINTER + pointee_type_id: 0x9da1e0c3 +} pointer_reference { id: 0x2df9d3a1 kind: POINTER @@ -18116,21 +18366,56 @@ pointer_reference { kind: POINTER pointee_type_id: 0x9266fead } +pointer_reference { + id: 0x2e0a2548 + kind: POINTER + pointee_type_id: 0x926873bc +} +pointer_reference { + id: 0x2e0a26c5 + kind: POINTER + pointee_type_id: 0x92687d88 +} pointer_reference { id: 0x2e0a4508 kind: POINTER pointee_type_id: 0x9269f2bc } +pointer_reference { + id: 0x2e0ab0cf + kind: POINTER + pointee_type_id: 0x926a25a2 +} +pointer_reference { + id: 0x2e0abaa7 + kind: POINTER + pointee_type_id: 0x926a0c03 +} +pointer_reference { + id: 0x2e0abbc6 + kind: POINTER + pointee_type_id: 0x926a0987 +} pointer_reference { id: 0x2e0ac0be kind: POINTER pointee_type_id: 0x926be467 } +pointer_reference { + id: 0x2e0ad762 + kind: POINTER + pointee_type_id: 0x926bbb17 +} pointer_reference { id: 0x2e0b4b4b kind: POINTER pointee_type_id: 0x926dcbb0 } +pointer_reference { + id: 0x2e0b7ad3 + kind: POINTER + pointee_type_id: 0x926d0dd0 +} pointer_reference { id: 0x2e0b807c kind: POINTER @@ -18186,6 +18471,11 @@ pointer_reference { kind: POINTER pointee_type_id: 0x920d4b76 } +pointer_reference { + id: 0x2e1466a0 + kind: POINTER + pointee_type_id: 0x92117c1d +} pointer_reference { id: 0x2e152fbb kind: POINTER @@ -18276,6 +18566,11 @@ pointer_reference { kind: POINTER pointee_type_id: 0x92c2d86d } +pointer_reference { + id: 0x2e20981d + kind: POINTER + pointee_type_id: 0x92c286e9 +} pointer_reference { id: 0x2e215a2d kind: POINTER @@ -18341,6 +18636,16 @@ pointer_reference { kind: POINTER pointee_type_id: 0x92f4a3cb } +pointer_reference { + id: 0x2e2ef220 + kind: POINTER + pointee_type_id: 0x92fb2e1e +} +pointer_reference { + id: 0x2e2f03e7 + kind: POINTER + pointee_type_id: 0x92fce902 +} pointer_reference { id: 0x2e2ff28a kind: POINTER @@ -18451,6 +18756,11 @@ pointer_reference { kind: POINTER pointee_type_id: 0x9352af9c } +pointer_reference { + id: 0x2e477ad3 + kind: POINTER + pointee_type_id: 0x935d0dd3 +} pointer_reference { id: 0x2e47a18c kind: POINTER @@ -18551,6 +18861,11 @@ pointer_reference { kind: POINTER pointee_type_id: 0x9313a933 } +pointer_reference { + id: 0x2e54f1b8 + kind: POINTER + pointee_type_id: 0x9313207d +} pointer_reference { id: 0x2e5535c9 kind: POINTER @@ -18581,6 +18896,11 @@ pointer_reference { kind: POINTER pointee_type_id: 0x931806a8 } +pointer_reference { + id: 0x2e5686ce + kind: POINTER + pointee_type_id: 0x931afda4 +} pointer_reference { id: 0x2e56b2c6 kind: POINTER @@ -18731,6 +19051,11 @@ pointer_reference { kind: POINTER pointee_type_id: 0x93907678 } +pointer_reference { + id: 0x2e7505e0 + kind: POINTER + pointee_type_id: 0x9394f11e +} pointer_reference { id: 0x2e76071a kind: POINTER @@ -18786,6 +19111,11 @@ pointer_reference { kind: POINTER pointee_type_id: 0x93b941f7 } +pointer_reference { + id: 0x2e7ffbfe + kind: POINTER + pointee_type_id: 0x93bf0967 +} pointer_reference { id: 0x2e804bb7 kind: POINTER @@ -21516,6 +21846,11 @@ pointer_reference { kind: POINTER pointee_type_id: 0xeba4823c } +pointer_reference { + id: 0x307eba5c + kind: POINTER + pointee_type_id: 0xebba0fee +} pointer_reference { id: 0x30887d17 kind: POINTER @@ -21781,6 +22116,11 @@ pointer_reference { kind: POINTER pointee_type_id: 0xeec4d3d8 } +pointer_reference { + id: 0x3121a074 + kind: POINTER + pointee_type_id: 0xeec6674e +} pointer_reference { id: 0x31287056 kind: POINTER @@ -22056,6 +22396,11 @@ pointer_reference { kind: POINTER pointee_type_id: 0xed225d89 } +pointer_reference { + id: 0x31d9e79a + kind: POINTER + pointee_type_id: 0xed2778f4 +} pointer_reference { id: 0x31da1e83 kind: POINTER @@ -22211,6 +22556,11 @@ pointer_reference { kind: POINTER pointee_type_id: 0xe3420903 } +pointer_reference { + id: 0x3247ae94 + kind: POINTER + pointee_type_id: 0xe35e5ccd +} pointer_reference { id: 0x324a2d7b kind: POINTER @@ -23006,6 +23356,11 @@ pointer_reference { kind: POINTER pointee_type_id: 0xe5ac437d } +pointer_reference { + id: 0x33fd261b + kind: POINTER + pointee_type_id: 0xe5b47ef3 +} pointer_reference { id: 0x34016e82 kind: POINTER @@ -23751,6 +24106,11 @@ pointer_reference { kind: POINTER pointee_type_id: 0xfc53e789 } +pointer_reference { + id: 0x358546f6 + kind: POINTER + pointee_type_id: 0xfc55fd47 +} pointer_reference { id: 0x358a1c52 kind: POINTER @@ -23836,6 +24196,11 @@ pointer_reference { kind: POINTER pointee_type_id: 0xfc8ba4d2 } +pointer_reference { + id: 0x35b3ea42 + kind: POINTER + pointee_type_id: 0xfc8f4f95 +} pointer_reference { id: 0x35bad1e5 kind: POINTER @@ -24631,6 +24996,11 @@ pointer_reference { kind: POINTER pointee_type_id: 0xf7e2e2fa } +pointer_reference { + id: 0x376c8705 + kind: POINTER + pointee_type_id: 0xf7f2fa8a +} pointer_reference { id: 0x376d0d4f kind: POINTER @@ -25431,6 +25801,11 @@ pointer_reference { kind: POINTER pointee_type_id: 0xce9dd989 } +pointer_reference { + id: 0x39388fd3 + kind: POINTER + pointee_type_id: 0xcea2d9d1 +} pointer_reference { id: 0x393f044a kind: POINTER @@ -25586,6 +25961,11 @@ pointer_reference { kind: POINTER pointee_type_id: 0xcc1251bf } +pointer_reference { + id: 0x3999579d + kind: POINTER + pointee_type_id: 0xcc25b8e9 +} pointer_reference { id: 0x399f63b7 kind: POINTER @@ -26131,6 +26511,11 @@ pointer_reference { kind: POINTER pointee_type_id: 0xc60bc51e } +pointer_reference { + id: 0x3b143836 + kind: POINTER + pointee_type_id: 0xc6100647 +} pointer_reference { id: 0x3b19594b kind: POINTER @@ -26261,6 +26646,11 @@ pointer_reference { kind: POINTER pointee_type_id: 0xc77aa47c } +pointer_reference { + id: 0x3b5017f2 + kind: POINTER + pointee_type_id: 0xc700b957 +} pointer_reference { id: 0x3b54fdd3 kind: POINTER @@ -26506,6 +26896,11 @@ pointer_reference { kind: POINTER pointee_type_id: 0xda6429b7 } +pointer_reference { + id: 0x3c0cf46a + kind: POINTER + pointee_type_id: 0xda733736 +} pointer_reference { id: 0x3c0e9e79 kind: POINTER @@ -26616,6 +27011,11 @@ pointer_reference { kind: POINTER pointee_type_id: 0xdb0ebdcd } +pointer_reference { + id: 0x3c53e119 + kind: POINTER + pointee_type_id: 0xdb0f62fb +} pointer_reference { id: 0x3c53eefd kind: POINTER @@ -26921,6 +27321,11 @@ pointer_reference { kind: POINTER pointee_type_id: 0xdf4d92db } +pointer_reference { + id: 0x3d46e073 + kind: POINTER + pointee_type_id: 0xdf5b6752 +} pointer_reference { id: 0x3d4bf55f kind: POINTER @@ -27941,6 +28346,11 @@ pointer_reference { kind: POINTER pointee_type_id: 0xd559247f } +pointer_reference { + id: 0x3fca7642 + kind: POINTER + pointee_type_id: 0xd5693f95 +} pointer_reference { id: 0x3fd0b78c kind: POINTER @@ -30331,6 +30741,11 @@ qualified { qualifier: CONST qualified_type_id: 0x6798ba36 } +qualified { + id: 0xc6100647 + qualifier: CONST + qualified_type_id: 0x6807af97 +} qualified { id: 0xc62583b0 qualifier: CONST @@ -31406,6 +31821,11 @@ qualified { qualifier: CONST qualified_type_id: 0x19d71054 } +qualified { + id: 0xda733736 + qualifier: CONST + qualified_type_id: 0x198b6a50 +} qualified { id: 0xda7a9f79 qualifier: CONST @@ -31431,6 +31851,11 @@ qualified { qualifier: CONST qualified_type_id: 0x1c7ac324 } +qualified { + id: 0xdb0f62fb + qualifier: CONST + qualified_type_id: 0x1c7a3d65 +} qualified { id: 0xdb10d97a qualifier: CONST @@ -31691,6 +32116,11 @@ qualified { qualifier: CONST qualified_type_id: 0x0d6c22fa } +qualified { + id: 0xdf5b6752 + qualifier: CONST + qualified_type_id: 0x0d2a2bc0 +} qualified { id: 0xdf6f33e0 qualifier: CONST @@ -32026,6 +32456,11 @@ qualified { qualifier: CONST qualified_type_id: 0xe6f6bb7d } +qualified { + id: 0xe5b47ef3 + qualifier: CONST + qualified_type_id: 0xe6964d46 +} qualified { id: 0xe5d16cd3 qualifier: CONST @@ -32326,6 +32761,11 @@ qualified { qualifier: CONST qualified_type_id: 0xded5be7b } +qualified { + id: 0xebba0fee + qualifier: CONST + qualified_type_id: 0xdeaf8933 +} qualified { id: 0xebc0e0d9 qualifier: CONST @@ -32431,6 +32871,11 @@ qualified { qualifier: CONST qualified_type_id: 0xc460028a } +qualified { + id: 0xed2778f4 + qualifier: CONST + qualified_type_id: 0xc4da5559 +} qualified { id: 0xed32e285 qualifier: CONST @@ -32531,6 +32976,11 @@ qualified { qualifier: CONST qualified_type_id: 0xcaab19b4 } +qualified { + id: 0xeec6674e + qualifier: CONST + qualified_type_id: 0xcb5e2bb0 +} qualified { id: 0xeee127c5 qualifier: CONST @@ -32906,6 +33356,11 @@ qualified { qualifier: CONST qualified_type_id: 0xae5a9933 } +qualified { + id: 0xf7f2fa8a + qualifier: CONST + qualified_type_id: 0xaf8c5ca0 +} qualified { id: 0xf824f490 qualifier: CONST @@ -38417,6 +38872,11 @@ member { type_id: 0x7edb75e7 offset: 96 } +member { + id: 0x3c8c9122 + type_id: 0x7d1c3635 + offset: 256 +} member { id: 0x3cac7aec type_id: 0x7d9f9ba1 @@ -39928,6 +40388,12 @@ member { name: "_msg" type_id: 0x3e10b518 } +member { + id: 0x3e75936d + name: "_net" + type_id: 0xb335d16f + offset: 3136 +} member { id: 0x3e759921 name: "_net" @@ -48600,12 +49066,24 @@ member { offset: 65 bitsize: 1 } +member { + id: 0x773b8f3f + name: "auto_dump" + type_id: 0x6d7f5ff6 + offset: 904 +} member { id: 0xaa0ea302 name: "auto_flowlabels" type_id: 0x295c7202 offset: 632 } +member { + id: 0xea4e825c + name: "auto_recover" + type_id: 0x6d7f5ff6 + offset: 896 +} member { id: 0xc5fa3041 name: "auto_runtime_pm" @@ -51712,6 +52190,12 @@ member { type_id: 0x326dfde1 offset: 256 } +member { + id: 0x4a47d75f + name: "bitwidth" + type_id: 0x4585663f + offset: 96 +} member { id: 0x9cc8208d name: "bkops" @@ -57175,6 +57659,12 @@ member { type_id: 0x208118b2 offset: 8640 } +member { + id: 0x08477548 + name: "cell_size" + type_id: 0xc9082b19 + offset: 96 +} member { id: 0xc909929f name: "cells" @@ -61334,6 +61824,12 @@ member { name: "common" type_id: 0xfb3bb098 } +member { + id: 0x999f46a7 + name: "comp" + type_id: 0x3fcbf304 + offset: 3648 +} member { id: 0x999f496f name: "comp" @@ -61927,6 +62423,12 @@ member { type_id: 0x35aebc23 offset: 64 } +member { + id: 0xe5d87fc5 + name: "component" + type_id: 0x3e10b518 + offset: 64 +} member { id: 0xe5eb95e0 name: "component" @@ -63226,6 +63728,12 @@ member { name: "controller" type_id: 0xc9082b19 } +member { + id: 0xd8dc9c99 + name: "controller" + type_id: 0xc9082b19 + offset: 64 +} member { id: 0x608f2d5b name: "controller_data" @@ -63238,6 +63746,13 @@ member { type_id: 0x18bd6530 offset: 7552 } +member { + id: 0x1db19505 + name: "controller_valid" + type_id: 0x295c7202 + offset: 145 + bitsize: 1 +} member { id: 0x474fe3e5 name: "controls" @@ -66368,6 +66883,12 @@ member { name: "cur_seq" type_id: 0x92233392 } +member { + id: 0x80fbe8a7 + name: "cur_snapshots" + type_id: 0xc9082b19 + offset: 864 +} member { id: 0x8b31830e name: "cur_stack" @@ -71057,6 +71578,12 @@ member { type_id: 0x0d27055d offset: 128 } +member { + id: 0xa4170b6e + name: "destructor" + type_id: 0x0d27dc9d + offset: 64 +} member { id: 0xa4b58e4f name: "destructor" @@ -71673,6 +72200,12 @@ member { type_id: 0x0258f96e offset: 2880 } +member { + id: 0xce3bb522 + name: "dev" + type_id: 0x0258f96e + offset: 3072 +} member { id: 0xce3bb837 name: "dev" @@ -73020,15 +73553,26 @@ member { offset: 6816 } member { - id: 0x5685a7bf + id: 0x56ace115 name: "devlink" - type_id: 0x25b57283 + type_id: 0x0cf3d8fe offset: 256 } member { - id: 0x5685afdd + id: 0x56ace1be name: "devlink" - type_id: 0x25b57283 + type_id: 0x0cf3d8fe +} +member { + id: 0x56ace87c + name: "devlink" + type_id: 0x0cf3d8fe + offset: 128 +} +member { + id: 0x56ace977 + name: "devlink" + type_id: 0x0cf3d8fe offset: 192 } member { @@ -73036,6 +73580,12 @@ member { name: "devlink_port" type_id: 0x3b68ec61 } +member { + id: 0xeb76e483 + name: "devlink_port" + type_id: 0x3b68ec61 + offset: 320 +} member { id: 0xf45f2394 name: "devlink_rate" @@ -73321,6 +73871,12 @@ member { type_id: 0x295c7202 offset: 224 } +member { + id: 0x30b83368 + name: "diagnose" + type_id: 0x2e2f03e7 + offset: 192 +} member { id: 0xc3552be5 name: "dialed_frequency" @@ -75684,6 +76240,18 @@ member { offset: 1034 bitsize: 1 } +member { + id: 0x32a55865 + name: "dpipe_headers" + type_id: 0x27c7b3cb + offset: 1472 +} +member { + id: 0x3d9266c0 + name: "dpipe_table_list" + type_id: 0xd3c80119 + offset: 448 +} member { id: 0x95152d3f name: "dplen" @@ -77276,6 +77844,12 @@ member { type_id: 0x2f1d9bf5 offset: 960 } +member { + id: 0x0a7d4966 + name: "dump" + type_id: 0x2e2ef220 + offset: 128 +} member { id: 0x0a7e5e7c name: "dump" @@ -77312,6 +77886,24 @@ member { type_id: 0x425c572c offset: 7808 } +member { + id: 0x210293e8 + name: "dump_fmsg" + type_id: 0x23d822f9 + offset: 384 +} +member { + id: 0x33fc8cf5 + name: "dump_lock" + type_id: 0xa7c362b0 + offset: 448 +} +member { + id: 0x352c4ca4 + name: "dump_real_ts" + type_id: 0x92233392 + offset: 1024 +} member { id: 0xc82958b0 name: "dump_segments" @@ -77336,6 +77928,12 @@ member { type_id: 0x2f288c5c offset: 832 } +member { + id: 0x1e719a84 + name: "dump_ts" + type_id: 0x92233392 + offset: 960 +} member { id: 0xa92e0890 name: "dump_vendor_regs" @@ -80470,6 +81068,12 @@ member { offset: 6530 bitsize: 1 } +member { + id: 0x0b6ea206 + name: "error_count" + type_id: 0x92233392 + offset: 1088 +} member { id: 0x0b9ba55b name: "error_count" @@ -80672,6 +81276,42 @@ member { type_id: 0x39470e64 offset: 256 } +member { + id: 0x2d2ca64a + name: "eswitch_encap_mode_get" + type_id: 0x2d046cf4 + offset: 1408 +} +member { + id: 0x0e5d040f + name: "eswitch_encap_mode_set" + type_id: 0x2df84197 + offset: 1472 +} +member { + id: 0xff091101 + name: "eswitch_inline_mode_get" + type_id: 0x2d3ffbc6 + offset: 1280 +} +member { + id: 0xf81283dc + name: "eswitch_inline_mode_set" + type_id: 0x2d161d5c + offset: 1344 +} +member { + id: 0x67ecafb3 + name: "eswitch_mode_get" + type_id: 0x2d11ffb5 + offset: 1152 +} +member { + id: 0x06f3214d + name: "eswitch_mode_set" + type_id: 0x2dae0c91 + offset: 1216 +} member { id: 0xca94b2d4 name: "eth_tp_mdix" @@ -84127,6 +84767,12 @@ member { type_id: 0x92233392 offset: 7744 } +member { + id: 0xc58a570e + name: "features" + type_id: 0x92233392 + offset: 2496 +} member { id: 0xc5a16345 name: "features" @@ -84946,6 +85592,12 @@ member { type_id: 0x7dbd382e offset: 352 } +member { + id: 0x784a4b9b + name: "fields" + type_id: 0x19df035f + offset: 128 +} member { id: 0x788054c9 name: "fields" @@ -84969,6 +85621,12 @@ member { type_id: 0x2db9a683 offset: 256 } +member { + id: 0x361d56de + name: "fields_count" + type_id: 0x4585663f + offset: 192 +} member { id: 0x53870b05 name: "fiemap" @@ -87515,6 +88173,12 @@ member { type_id: 0x0d9a8731 offset: 1600 } +member { + id: 0x5ef8d6d5 + name: "flash_update" + type_id: 0x2d16aeaf + offset: 1600 +} member { id: 0x4ad49fc7 name: "flat" @@ -87551,6 +88215,11 @@ member { type_id: 0x03e0374b offset: 64 } +member { + id: 0xdf2fd72b + name: "flavour" + type_id: 0x03e0374b +} member { id: 0x9a18c6a2 name: "flc_flock" @@ -90800,6 +91469,11 @@ member { type_id: 0x0faae5b1 offset: 96 } +member { + id: 0x91e86fed + name: "fw" + type_id: 0x33011141 +} member { id: 0x51f9c40d name: "fw_download" @@ -91410,6 +92084,18 @@ member { name: "generic" type_id: 0x09dc021e } +member { + id: 0x4257f83b + name: "generic" + type_id: 0x6d7f5ff6 + offset: 80 +} +member { + id: 0x4257f846 + name: "generic" + type_id: 0x6d7f5ff6 + offset: 64 +} member { id: 0x42d6db26 name: "generic" @@ -93283,6 +93969,12 @@ member { type_id: 0xe742397c offset: 576 } +member { + id: 0x55f132cc + name: "global" + type_id: 0x6d7f5ff6 + offset: 224 +} member { id: 0x9e65d647 name: "global" @@ -93614,6 +94306,12 @@ member { type_id: 0x1f3595db offset: 128 } +member { + id: 0x62d28eb5 + name: "graceful_period" + type_id: 0x92233392 + offset: 832 +} member { id: 0x0277381e name: "graft" @@ -96096,6 +96794,17 @@ member { name: "headers" type_id: 0x0524ca5a } +member { + id: 0x614c39f2 + name: "headers" + type_id: 0x0f657fc1 +} +member { + id: 0x958f08da + name: "headers_count" + type_id: 0x4585663f + offset: 64 +} member { id: 0x3e17b5ef name: "headroom" @@ -96143,6 +96852,12 @@ member { type_id: 0xc9082b19 offset: 896 } +member { + id: 0x768a691a + name: "health_state" + type_id: 0x295c7202 + offset: 912 +} member { id: 0x049198e2 name: "heap" @@ -99677,6 +100392,18 @@ member { name: "id" type_id: 0x914dbfdc } +member { + id: 0xccbe65b2 + name: "id" + type_id: 0x914dbfdc + offset: 80 +} +member { + id: 0xccbe65cf + name: "id" + type_id: 0x914dbfdc + offset: 64 +} member { id: 0xccc14505 name: "id" @@ -101945,6 +102672,11 @@ member { type_id: 0xe62ebf07 offset: 128 } +member { + id: 0xadf00094 + name: "index" + type_id: 0xc9082b19 +} member { id: 0xadf006ed name: "index" @@ -102232,6 +102964,12 @@ member { type_id: 0x4585663f offset: 224 } +member { + id: 0xe0c4d82e + name: "info_get" + type_id: 0x2d0679a1 + offset: 1536 +} member { id: 0x2f8cd3f3 name: "info_ident" @@ -102607,6 +103345,12 @@ member { offset: 608 bitsize: 1 } +member { + id: 0x3ecaad84 + name: "init_action" + type_id: 0x322b7a90 + offset: 32 +} member { id: 0xc9830a15 name: "init_addr" @@ -102637,6 +103381,12 @@ member { type_id: 0x0c7ce901 offset: 64 } +member { + id: 0xb36eb0c7 + name: "init_burst" + type_id: 0x92233392 + offset: 128 +} member { id: 0xed4a99de name: "init_callback" @@ -102697,6 +103447,12 @@ member { type_id: 0x2f05fd8b offset: 128 } +member { + id: 0xa4c7afe2 + name: "init_group_id" + type_id: 0x914dbfdc + offset: 192 +} member { id: 0xf587a1e9 name: "init_hctx" @@ -102751,12 +103507,24 @@ member { type_id: 0xc9082b19 offset: 864 } +member { + id: 0xf53cc107 + name: "init_policer_id" + type_id: 0xc9082b19 + offset: 96 +} member { id: 0x015559ae name: "init_qp_minus26" type_id: 0x901eaf6a offset: 32 } +member { + id: 0x2b41bb63 + name: "init_rate" + type_id: 0x92233392 + offset: 64 +} member { id: 0xf8fed40c name: "init_ready" @@ -107345,6 +108113,11 @@ member { name: "item" type_id: 0x3f8fe745 } +member { + id: 0x990317f0 + name: "item_list" + type_id: 0xd3c80119 +} member { id: 0xa70d7362 name: "item_ptr" @@ -109876,6 +110649,12 @@ member { type_id: 0x33756485 offset: 5504 } +member { + id: 0x41fdc1b3 + name: "last_recovery_ts" + type_id: 0x92233392 + offset: 1216 +} member { id: 0xc6b95840 name: "last_reset" @@ -111831,11 +112610,23 @@ member { offset: 576 } member { - id: 0xd1c402eb + id: 0xd1e477a3 name: "linecard" - type_id: 0x2a0586b2 + type_id: 0x0a70ce1b offset: 2688 } +member { + id: 0x2bafedce + name: "linecard_list" + type_id: 0xd3c80119 + offset: 1920 +} +member { + id: 0x66da3728 + name: "linecards_lock" + type_id: 0xa7c362b0 + offset: 2048 +} member { id: 0xc4fd637a name: "linedur_ns" @@ -113642,6 +114433,12 @@ member { type_id: 0xa7c362b0 offset: 1152 } +member { + id: 0x2d4b3330 + name: "lock" + type_id: 0xa7c362b0 + offset: 3200 +} member { id: 0x2d4b353f name: "lock" @@ -113891,6 +114688,12 @@ member { type_id: 0x1b44744f offset: 1280 } +member { + id: 0x5f5e621d + name: "lock_key" + type_id: 0x475137a2 + offset: 3584 +} member { id: 0x5f5e64df name: "lock_key" @@ -116469,6 +117272,12 @@ member { type_id: 0xc9082b19 offset: 3008 } +member { + id: 0x8b645ad4 + name: "mapping_type" + type_id: 0xe09c0936 + offset: 128 +} member { id: 0x4971df2a name: "mappings" @@ -117548,6 +118357,12 @@ member { type_id: 0x4585663f offset: 96 } +member { + id: 0x9c062023 + name: "max_burst" + type_id: 0x92233392 + offset: 320 +} member { id: 0x9c5d053e name: "max_burst" @@ -118494,6 +119309,12 @@ member { type_id: 0x33756485 offset: 320 } +member { + id: 0x5cea623b + name: "max_rate" + type_id: 0x92233392 + offset: 192 +} member { id: 0xf3d009b3 name: "max_ratio" @@ -118846,6 +119667,12 @@ member { type_id: 0x295c7202 offset: 672 } +member { + id: 0x2a2e382b + name: "max_snapshots" + type_id: 0xc9082b19 + offset: 832 +} member { id: 0x9213bcc2 name: "max_socks" @@ -120761,6 +121588,12 @@ member { type_id: 0x1e937ceb offset: 704 } +member { + id: 0xd492332a + name: "metadata_cap" + type_id: 0xc9082b19 + offset: 224 +} member { id: 0xf7b6b92a name: "metadata_ops" @@ -121220,6 +122053,12 @@ member { type_id: 0xc9082b19 offset: 96 } +member { + id: 0x7b580056 + name: "min_burst" + type_id: 0x92233392 + offset: 384 +} member { id: 0x603d49ac name: "min_capacity" @@ -121481,6 +122320,12 @@ member { type_id: 0x295c7202 offset: 8 } +member { + id: 0x7843c8a8 + name: "min_rate" + type_id: 0x92233392 + offset: 256 +} member { id: 0x78e29322 name: "min_rate" @@ -124049,6 +124894,11 @@ member { type_id: 0x0483e6f8 offset: 384 } +member { + id: 0xe2057d5b + name: "msg" + type_id: 0x054f691a +} member { id: 0xe260f8b5 name: "msg" @@ -127330,6 +128180,12 @@ member { type_id: 0x4585663f offset: 384 } +member { + id: 0xe3a3de7e + name: "nested_devlink" + type_id: 0x0cf3d8fe + offset: 1024 +} member { id: 0x5f6b4acf name: "nested_policy" @@ -135861,6 +136717,12 @@ member { type_id: 0x3d1ec847 offset: 64 } +member { + id: 0xafb646e8 + name: "ops" + type_id: 0x3d46e073 + offset: 256 +} member { id: 0xafb6613a name: "ops" @@ -136022,6 +136884,12 @@ member { type_id: 0x32e20efe offset: 17088 } +member { + id: 0xafba248b + name: "ops" + type_id: 0x3121a074 + offset: 2432 +} member { id: 0xafba3fb1 name: "ops" @@ -136056,6 +136924,11 @@ member { name: "ops" type_id: 0x31c93a7f } +member { + id: 0xafbad944 + name: "ops" + type_id: 0x31d9e79a +} member { id: 0xafbb0869 name: "ops" @@ -136086,6 +136959,12 @@ member { type_id: 0x3068cb56 offset: 64 } +member { + id: 0xafbb76d0 + name: "ops" + type_id: 0x307eba5c + offset: 192 +} member { id: 0xafbba914 name: "ops" @@ -137182,6 +138061,12 @@ member { type_id: 0x6720d32f offset: 224 } +member { + id: 0xc099cc3c + name: "overwrite_mask" + type_id: 0xc9082b19 + offset: 128 +} member { id: 0x9e1f254a name: "overwrite_state" @@ -138776,6 +139661,12 @@ member { type_id: 0x6720d32f offset: 640 } +member { + id: 0xb8b3f43c + name: "param_list" + type_id: 0xd3c80119 + offset: 704 +} member { id: 0xb8ba1efc name: "param_lock" @@ -141590,6 +142481,12 @@ member { type_id: 0x6e1fde8f offset: 64 } +member { + id: 0x6980d678 + name: "pfnum" + type_id: 0x914dbfdc + offset: 128 +} member { id: 0x88830a16 name: "pg" @@ -144369,6 +145266,11 @@ member { type_id: 0x4585663f offset: 64 } +member { + id: 0xe52eef97 + name: "pool_type" + type_id: 0xa7051d2f +} member { id: 0x6a296ea1 name: "pools" @@ -144468,6 +145370,12 @@ member { type_id: 0x44b60e20 offset: 384 } +member { + id: 0x48c075a0 + name: "port" + type_id: 0x3b68ec61 + offset: 64 +} member { id: 0x48cc7358 name: "port" @@ -144572,6 +145480,36 @@ member { name: "port_data" type_id: 0x18bd6530 } +member { + id: 0x9e84141c + name: "port_del" + type_id: 0x2d7ac448 + offset: 2560 +} +member { + id: 0xa5c2f472 + name: "port_fn_state_get" + type_id: 0x2e54f1b8 + offset: 2624 +} +member { + id: 0xeb46d6f6 + name: "port_fn_state_set" + type_id: 0x2e20981d + offset: 2688 +} +member { + id: 0x2e72e7e0 + name: "port_function_hw_addr_get" + type_id: 0x2e477ad3 + offset: 2368 +} +member { + id: 0x85af182d + name: "port_function_hw_addr_set" + type_id: 0x2e7ffbfe + offset: 2432 +} member { id: 0x97b320de name: "port_handed_over" @@ -144590,6 +145528,19 @@ member { type_id: 0xc9082b19 offset: 64 } +member { + id: 0xbf1e816a + name: "port_index" + type_id: 0x4585663f + offset: 32 +} +member { + id: 0x0317cd78 + name: "port_index_valid" + type_id: 0x295c7202 + offset: 144 + bitsize: 1 +} member { id: 0x1e504a04 name: "port_info" @@ -144620,6 +145571,12 @@ member { type_id: 0x0baa70a7 offset: 8256 } +member { + id: 0xcd6874e1 + name: "port_list" + type_id: 0xd3c80119 + offset: 64 +} member { id: 0x7daf8d82 name: "port_lock" @@ -144632,6 +145589,12 @@ member { type_id: 0x3e10b518 offset: 1216 } +member { + id: 0x90793300 + name: "port_new" + type_id: 0x2d044ee7 + offset: 2496 +} member { id: 0xe64fd4ef name: "port_num" @@ -144655,6 +145618,11 @@ member { name: "port_number" type_id: 0xc9082b19 } +member { + id: 0x217694f6 + name: "port_ops" + type_id: 0x33fd261b +} member { id: 0x2418a130 name: "port_power" @@ -144703,6 +145671,12 @@ member { type_id: 0x3bdc1cb2 offset: 8064 } +member { + id: 0xa22f8c42 + name: "port_split" + type_id: 0x2d000b85 + offset: 384 +} member { id: 0x2083fe73 name: "port_status" @@ -144750,6 +145724,18 @@ member { type_id: 0x2efc853f offset: 256 } +member { + id: 0xf43affcb + name: "port_type_set" + type_id: 0x2e5686ce + offset: 320 +} +member { + id: 0x5f87545a + name: "port_unsplit" + type_id: 0x2d0429c2 + offset: 448 +} member { id: 0x4b84c909 name: "port_usb" @@ -147057,6 +148043,12 @@ member { type_id: 0x18bd6530 offset: 448 } +member { + id: 0x59303e30 + name: "priv" + type_id: 0x391f15ea + offset: 64 +} member { id: 0x5935516c name: "priv" @@ -147105,6 +148097,12 @@ member { type_id: 0xc8e4d7d1 offset: 59520 } +member { + id: 0x59c303be + name: "priv" + type_id: 0xca2a51af + offset: 4096 +} member { id: 0x59c3092e name: "priv" @@ -149130,6 +150128,11 @@ member { type_id: 0x0483e6f8 offset: 320 } +member { + id: 0xd3c8aa61 + name: "provision" + type_id: 0x2d4c6881 +} member { id: 0x61ba1604 name: "proxy_ndp" @@ -149865,6 +150868,12 @@ member { type_id: 0x0d572692 offset: 256 } +member { + id: 0x82e1aed1 + name: "putting_binary" + type_id: 0x6d7f5ff6 + offset: 128 +} member { id: 0x26fa53f2 name: "putx64" @@ -151578,6 +152587,30 @@ member { type_id: 0x295c7202 offset: 104 } +member { + id: 0x7f7f584f + name: "rate_leaf_parent_set" + type_id: 0x2d0a0361 + offset: 3136 +} +member { + id: 0x54806d5b + name: "rate_leaf_tx_max_set" + type_id: 0x2d154530 + offset: 2816 +} +member { + id: 0x049c1f00 + name: "rate_leaf_tx_share_set" + type_id: 0x2d154530 + offset: 2752 +} +member { + id: 0x4134711d + name: "rate_list" + type_id: 0xd3c80119 + offset: 192 +} member { id: 0xd51bd1ef name: "rate_matching" @@ -151638,6 +152671,36 @@ member { type_id: 0x4585663f offset: 1472 } +member { + id: 0x3d9c68f5 + name: "rate_node_del" + type_id: 0x2d1c1d12 + offset: 3072 +} +member { + id: 0x573e57ed + name: "rate_node_new" + type_id: 0x2d081f17 + offset: 3008 +} +member { + id: 0x069fcabf + name: "rate_node_parent_set" + type_id: 0x2d0a0361 + offset: 3200 +} +member { + id: 0xeff7e2c9 + name: "rate_node_tx_max_set" + type_id: 0x2d154530 + offset: 2944 +} +member { + id: 0x7b7f9a93 + name: "rate_node_tx_share_set" + type_id: 0x2d154530 + offset: 2880 +} member { id: 0xbc979606 name: "rate_num" @@ -152513,6 +153576,12 @@ member { type_id: 0xe3222f5b offset: 1408 } +member { + id: 0x95dacba7 + name: "rcu" + type_id: 0xe3222f5b + offset: 3904 +} member { id: 0x95dacce8 name: "rcu" @@ -153799,6 +154868,12 @@ member { type_id: 0x74d29cf1 offset: 32 } +member { + id: 0x8a4b19d4 + name: "recover" + type_id: 0x2e1466a0 + offset: 64 +} member { id: 0x8a6b6b4e name: "recover" @@ -153816,6 +154891,12 @@ member { name: "recover_bus" type_id: 0x2fb994f1 } +member { + id: 0x629c6b33 + name: "recovery_count" + type_id: 0x92233392 + offset: 1152 +} member { id: 0xe75c7f73 name: "recovery_disabled" @@ -154514,17 +155595,35 @@ member { type_id: 0xa722c13e offset: 800 } +member { + id: 0x05243818 + name: "refcount" + type_id: 0xa722c13e + offset: 224 +} member { id: 0x05243b3c name: "refcount" type_id: 0xa722c13e } +member { + id: 0x05243b72 + name: "refcount" + type_id: 0xa722c13e + offset: 3616 +} member { id: 0x05243c4b name: "refcount" type_id: 0xa722c13e offset: 448 } +member { + id: 0x05243d41 + name: "refcount" + type_id: 0xa722c13e + offset: 1280 +} member { id: 0x053332c8 name: "refcount" @@ -155135,6 +156234,12 @@ member { type_id: 0x92233392 offset: 448 } +member { + id: 0x4fd311c5 + name: "region_list" + type_id: 0xd3c80119 + offset: 832 +} member { id: 0x4fd31bbd name: "region_list" @@ -155967,6 +157072,42 @@ member { type_id: 0x0c868f26 offset: 1536 } +member { + id: 0x83cb909a + name: "reload_actions" + type_id: 0x33756485 + offset: 64 +} +member { + id: 0xf8981c0e + name: "reload_down" + type_id: 0x2d594ead + offset: 192 +} +member { + id: 0xf5250b55 + name: "reload_failed" + type_id: 0x295c7202 + offset: 3584 + bitsize: 1 +} +member { + id: 0xb0509801 + name: "reload_limits" + type_id: 0x33756485 + offset: 128 +} +member { + id: 0x4492b926 + name: "reload_stats" + type_id: 0x93e3596e +} +member { + id: 0xa5ab7067 + name: "reload_up" + type_id: 0x2d8fd28a + offset: 256 +} member { id: 0x88c18b9a name: "relocs" @@ -156082,6 +157223,12 @@ member { type_id: 0xd3c80119 offset: 30080 } +member { + id: 0xadd03a27 + name: "remote_reload_stats" + type_id: 0x93e3596e + offset: 192 +} member { id: 0xa3daa863 name: "remote_sdu_itime" @@ -156760,12 +157907,24 @@ member { type_id: 0x384f7d7c offset: 1064 } +member { + id: 0x6ac681cd + name: "reporter_list" + type_id: 0xd3c80119 + offset: 960 +} member { id: 0x6ac6877c name: "reporter_list" type_id: 0xd3c80119 offset: 2112 } +member { + id: 0xefdb08b4 + name: "reporters_lock" + type_id: 0xa7c362b0 + offset: 1088 +} member { id: 0xefdb0c31 name: "reporters_lock" @@ -158801,6 +159960,12 @@ member { type_id: 0xb522cc16 offset: 9024 } +member { + id: 0x17c3228f + name: "resource_list" + type_id: 0xd3c80119 + offset: 576 +} member { id: 0x19740c14 name: "resources" @@ -163573,6 +164738,12 @@ member { type_id: 0x4aaca7b4 offset: 192 } +member { + id: 0xebfb4e21 + name: "same_provision" + type_id: 0x358546f6 + offset: 128 +} member { id: 0x9b9fa9a3 name: "same_root" @@ -163997,6 +165168,72 @@ member { type_id: 0xd3c80119 offset: 8448 } +member { + id: 0xe1b6bbe3 + name: "sb_list" + type_id: 0xd3c80119 + offset: 320 +} +member { + id: 0x1197fb66 + name: "sb_occ_max_clear" + type_id: 0x2d7ab985 + offset: 960 +} +member { + id: 0x80e35930 + name: "sb_occ_port_pool_get" + type_id: 0x2e0a2548 + offset: 1024 +} +member { + id: 0xa9d0bb48 + name: "sb_occ_snapshot" + type_id: 0x2d7ab985 + offset: 896 +} +member { + id: 0xde69b5bc + name: "sb_occ_tc_port_bind_get" + type_id: 0x2e0abaa7 + offset: 1088 +} +member { + id: 0x93cb2df4 + name: "sb_pool_get" + type_id: 0x2d739f19 + offset: 512 +} +member { + id: 0xeaf07952 + name: "sb_pool_set" + type_id: 0x2d7368ed + offset: 576 +} +member { + id: 0x78a8c4ae + name: "sb_port_pool_get" + type_id: 0x2e0a26c5 + offset: 640 +} +member { + id: 0x6f535872 + name: "sb_port_pool_set" + type_id: 0x2e0ad762 + offset: 704 +} +member { + id: 0x001ba0a6 + name: "sb_tc_pool_bind_get" + type_id: 0x2e0abbc6 + offset: 768 +} +member { + id: 0x07349e82 + name: "sb_tc_pool_bind_set" + type_id: 0x2e0ab0cf + offset: 832 +} member { id: 0x7ac264e0 name: "sbc" @@ -165842,6 +167079,18 @@ member { type_id: 0x0d9c47fd offset: 1408 } +member { + id: 0x561fd50f + name: "selftest_check" + type_id: 0x35b3ea42 + offset: 3264 +} +member { + id: 0xd95b0d92 + name: "selftest_run" + type_id: 0x1fdf8df4 + offset: 3328 +} member { id: 0xf53d14f9 name: "sem" @@ -168597,6 +169846,19 @@ member { type_id: 0x4585663f offset: 96 } +member { + id: 0x4c6b273e + name: "sfnum" + type_id: 0xc9082b19 + offset: 96 +} +member { + id: 0x38a7e1c1 + name: "sfnum_valid" + type_id: 0x295c7202 + offset: 146 + bitsize: 1 +} member { id: 0x65a2356f name: "sfp_bus" @@ -170358,6 +171620,12 @@ member { type_id: 0xc9082b19 offset: 224 } +member { + id: 0xd9b71962 + name: "size" + type_id: 0xc9082b19 + offset: 32 +} member { id: 0xd9b71c90 name: "size" @@ -170394,6 +171662,12 @@ member { type_id: 0x9565759f offset: 64 } +member { + id: 0xd9ec35e7 + name: "size" + type_id: 0x92233392 + offset: 896 +} member { id: 0xd9ec3683 name: "size" @@ -172229,6 +173503,18 @@ member { type_id: 0xe52a3418 offset: 416 } +member { + id: 0x0c805fde + name: "snapshot" + type_id: 0x2d0e9268 + offset: 128 +} +member { + id: 0x0c832449 + name: "snapshot" + type_id: 0x2e7505e0 + offset: 128 +} member { id: 0x0cc029ea name: "snapshot" @@ -172241,6 +173527,24 @@ member { type_id: 0x228d4605 offset: 1984 } +member { + id: 0xc24fadb5 + name: "snapshot_ids" + type_id: 0x80c20070 + offset: 2560 +} +member { + id: 0xcffde3b6 + name: "snapshot_list" + type_id: 0xd3c80119 + offset: 704 +} +member { + id: 0xcbc193d6 + name: "snapshot_lock" + type_id: 0xa7c362b0 + offset: 320 +} member { id: 0xae699d06 name: "snd" @@ -175182,6 +176486,12 @@ member { type_id: 0x4585663f offset: 7616 } +member { + id: 0x72b72416 + name: "state" + type_id: 0x44d985d5 + offset: 384 +} member { id: 0x72c0803e name: "state" @@ -175545,6 +176855,12 @@ member { type_id: 0x2360e10b offset: 2496 } +member { + id: 0x46ecc05d + name: "state_lock" + type_id: 0xa7c362b0 + offset: 448 +} member { id: 0xeccd8227 name: "state_machine" @@ -175876,6 +177192,12 @@ member { type_id: 0x2456537c offset: 256 } +member { + id: 0xb9583af1 + name: "stats" + type_id: 0x2d51c138 + offset: 2688 +} member { id: 0xb95cdf4e name: "stats" @@ -177885,6 +179207,11 @@ member { type_id: 0xb914bfab offset: 2944 } +member { + id: 0x9fc14365 + name: "supported_flash_update_params" + type_id: 0xc9082b19 +} member { id: 0x44116555 name: "supported_hw" @@ -181985,6 +183312,12 @@ member { name: "test" type_id: 0x2e3696f7 } +member { + id: 0x8db5ea4d + name: "test" + type_id: 0x2e0b7ad3 + offset: 256 +} member { id: 0x8db6a427 name: "test" @@ -182424,6 +183757,12 @@ member { type_id: 0x33756485 offset: 64 } +member { + id: 0x6ce0bb82 + name: "threshold_type" + type_id: 0xcbcc8512 + offset: 64 +} member { id: 0x3b00e790 name: "thresholds" @@ -184781,6 +186120,90 @@ member { type_id: 0x295c7202 offset: 1080 } +member { + id: 0x21a1a972 + name: "trap_action_set" + type_id: 0x2d004a69 + offset: 1792 +} +member { + id: 0x3c859cc4 + name: "trap_drop_counter_get" + type_id: 0x2d018e8d + offset: 2048 +} +member { + id: 0x24edb8c2 + name: "trap_fini" + type_id: 0x0e44c87b + offset: 1728 +} +member { + id: 0xb252ef85 + name: "trap_group_action_set" + type_id: 0x2d00157c + offset: 1984 +} +member { + id: 0x2b3b3947 + name: "trap_group_init" + type_id: 0x2d033017 + offset: 1856 +} +member { + id: 0x1877dc92 + name: "trap_group_list" + type_id: 0xd3c80119 + offset: 1664 +} +member { + id: 0x3a9bd5f4 + name: "trap_group_set" + type_id: 0x2d004103 + offset: 1920 +} +member { + id: 0x37b507df + name: "trap_init" + type_id: 0x2d02e4d4 + offset: 1664 +} +member { + id: 0x10281c82 + name: "trap_list" + type_id: 0xd3c80119 + offset: 1536 +} +member { + id: 0x5e35aa2e + name: "trap_policer_counter_get" + type_id: 0x2d0ab1eb + offset: 2304 +} +member { + id: 0x1ba59c6d + name: "trap_policer_fini" + type_id: 0x0e4e7ccb + offset: 2176 +} +member { + id: 0x950fbc14 + name: "trap_policer_init" + type_id: 0x2d085064 + offset: 2112 +} +member { + id: 0x9516c9d8 + name: "trap_policer_list" + type_id: 0xd3c80119 + offset: 1792 +} +member { + id: 0xc8b0c1d4 + name: "trap_policer_set" + type_id: 0x2d01e009 + offset: 2240 +} member { id: 0xc911730d name: "trb_address_map" @@ -187586,6 +189009,12 @@ member { name: "type" type_id: 0x3e10b518 } +member { + id: 0x5c68c671 + name: "type" + type_id: 0x3e10b518 + offset: 832 +} member { id: 0x5c68cd02 name: "type" @@ -187870,6 +189299,11 @@ member { type_id: 0xe62ebf07 offset: 64 } +member { + id: 0x5cbbb022 + name: "type" + type_id: 0xed655c73 +} member { id: 0x5cbbc962 name: "type" @@ -188340,12 +189774,36 @@ member { type_id: 0x86a931f9 offset: 192 } +member { + id: 0xf49ccf9e + name: "types" + type_id: 0x0e38185b + offset: 896 +} member { id: 0xf49ecb47 name: "types" type_id: 0x0c3286fb offset: 64 } +member { + id: 0x6e3b6a83 + name: "types_count" + type_id: 0x3999579d + offset: 192 +} +member { + id: 0x6e477688 + name: "types_count" + type_id: 0x4585663f + offset: 960 +} +member { + id: 0x88117783 + name: "types_get" + type_id: 0x0e0dc148 + offset: 256 +} member { id: 0x3f590b7c name: "types_mask" @@ -189937,6 +191395,12 @@ member { type_id: 0x33756485 offset: 2816 } +member { + id: 0x1f617d86 + name: "unprovision" + type_id: 0x2d4fcd25 + offset: 64 +} member { id: 0x8ea4f872 name: "unreg_list" @@ -193731,6 +195195,18 @@ member { name: "version" type_id: 0x914dbfdc } +member { + id: 0x8e9e82fd + name: "version_cb" + type_id: 0x0d1f55de + offset: 64 +} +member { + id: 0xca2aa534 + name: "version_cb_priv" + type_id: 0x18bd6530 + offset: 128 +} member { id: 0x88d1b3ba name: "version_get" @@ -206252,6 +207728,15 @@ struct_union { member_id: 0xe0feb68b } } +struct_union { + id: 0x7d1c3635 + kind: UNION + definition { + bytesize: 8 + member_id: 0xafbad944 + member_id: 0x217694f6 + } +} struct_union { id: 0x7d93a8c7 kind: UNION @@ -214144,14 +215629,260 @@ struct_union { } } struct_union { - id: 0xbc952c91 + id: 0x198f8565 kind: STRUCT name: "devlink" + definition { + bytesize: 512 + member_id: 0xadf00094 + member_id: 0xcd6874e1 + member_id: 0x4134711d + member_id: 0xe1b6bbe3 + member_id: 0x3d9266c0 + member_id: 0x17c3228f + member_id: 0xb8b3f43c + member_id: 0x4fd311c5 + member_id: 0x6ac681cd + member_id: 0xefdb08b4 + member_id: 0x32a55865 + member_id: 0x10281c82 + member_id: 0x1877dc92 + member_id: 0x9516c9d8 + member_id: 0x2bafedce + member_id: 0x66da3728 + member_id: 0xafba248b + member_id: 0xc58a570e + member_id: 0xc24fadb5 + member_id: 0xb9583af1 + member_id: 0xce3bb522 + member_id: 0x3e75936d + member_id: 0x2d4b3330 + member_id: 0x5f5e621d + member_id: 0xf5250b55 + member_id: 0x05243b72 + member_id: 0x999f46a7 + member_id: 0x95dacba7 + member_id: 0x59c303be + } } struct_union { - id: 0x8256fc56 + id: 0x2d51c138 + kind: STRUCT + name: "devlink_dev_stats" + definition { + bytesize: 48 + member_id: 0x4492b926 + member_id: 0xadd03a27 + } +} +struct_union { + id: 0x4d3cebe1 + kind: STRUCT + name: "devlink_dpipe_field" + definition { + bytesize: 24 + member_id: 0x0de57ce8 + member_id: 0xcc6aad16 + member_id: 0x4a47d75f + member_id: 0x8b645ad4 + } +} +struct_union { + id: 0x751480f9 + kind: STRUCT + name: "devlink_dpipe_header" + definition { + bytesize: 32 + member_id: 0x0de57ce8 + member_id: 0xcc6aad16 + member_id: 0x784a4b9b + member_id: 0x361d56de + member_id: 0x55f132cc + } +} +struct_union { + id: 0xb55e29b2 + kind: STRUCT + name: "devlink_dpipe_headers" + definition { + bytesize: 16 + member_id: 0x614c39f2 + member_id: 0x958f08da + } +} +struct_union { + id: 0x8dfee289 + kind: STRUCT + name: "devlink_flash_update_params" + definition { + bytesize: 24 + member_id: 0x91e86fed + member_id: 0xe5d87fc5 + member_id: 0xc099cc3c + } +} +struct_union { + id: 0xa5206d7a + kind: STRUCT + name: "devlink_fmsg" + definition { + bytesize: 24 + member_id: 0x990317f0 + member_id: 0x82e1aed1 + } +} +struct_union { + id: 0xd5693f95 + kind: STRUCT + name: "devlink_health_reporter" + definition { + bytesize: 168 + member_id: 0x7c00ef52 + member_id: 0x59119163 + member_id: 0xafbb76d0 + member_id: 0x56ace115 + member_id: 0xeb76e483 + member_id: 0x210293e8 + member_id: 0x33fc8cf5 + member_id: 0x62d28eb5 + member_id: 0xea4e825c + member_id: 0x773b8f3f + member_id: 0x768a691a + member_id: 0x1e719a84 + member_id: 0x352c4ca4 + member_id: 0x0b6ea206 + member_id: 0x629c6b33 + member_id: 0x41fdc1b3 + member_id: 0x05243d41 + } +} +struct_union { + id: 0xdeaf8933 + kind: STRUCT + name: "devlink_health_reporter_ops" + definition { + bytesize: 40 + member_id: 0x0ddfefbb + member_id: 0x8a4b19d4 + member_id: 0x0a7d4966 + member_id: 0x30b83368 + member_id: 0x8db5ea4d + } +} +struct_union { + id: 0xcea2d9d1 + kind: STRUCT + name: "devlink_info_req" + definition { + bytesize: 24 + member_id: 0xe2057d5b + member_id: 0x8e9e82fd + member_id: 0xca2aa534 + } +} +struct_union { + id: 0x0383def3 kind: STRUCT name: "devlink_linecard" + definition { + bytesize: 136 + member_id: 0x7c00ef52 + member_id: 0x56ace87c + member_id: 0xad7c8510 + member_id: 0x05243818 + member_id: 0xafb646e8 + member_id: 0x59119f66 + member_id: 0x72b72416 + member_id: 0x46ecc05d + member_id: 0x5c68c671 + member_id: 0xf49ccf9e + member_id: 0x6e477688 + member_id: 0xe3a3de7e + } +} +struct_union { + id: 0x0d2a2bc0 + kind: STRUCT + name: "devlink_linecard_ops" + definition { + bytesize: 40 + member_id: 0xd3c8aa61 + member_id: 0x1f617d86 + member_id: 0xebfb4e21 + member_id: 0x6e3b6a83 + member_id: 0x88117783 + } +} +struct_union { + id: 0x12a087f3 + kind: STRUCT + name: "devlink_linecard_type" + definition { + bytesize: 16 + member_id: 0x5c68c5cb + member_id: 0x59303e30 + } +} +struct_union { + id: 0xcb5e2bb0 + kind: STRUCT + name: "devlink_ops" + definition { + bytesize: 424 + member_id: 0x9fc14365 + member_id: 0x83cb909a + member_id: 0xb0509801 + member_id: 0xf8981c0e + member_id: 0xa5ab7067 + member_id: 0xf43affcb + member_id: 0xa22f8c42 + member_id: 0x5f87545a + member_id: 0x93cb2df4 + member_id: 0xeaf07952 + member_id: 0x78a8c4ae + member_id: 0x6f535872 + member_id: 0x001ba0a6 + member_id: 0x07349e82 + member_id: 0xa9d0bb48 + member_id: 0x1197fb66 + member_id: 0x80e35930 + member_id: 0xde69b5bc + member_id: 0x67ecafb3 + member_id: 0x06f3214d + member_id: 0xff091101 + member_id: 0xf81283dc + member_id: 0x2d2ca64a + member_id: 0x0e5d040f + member_id: 0xe0c4d82e + member_id: 0x5ef8d6d5 + member_id: 0x37b507df + member_id: 0x24edb8c2 + member_id: 0x21a1a972 + member_id: 0x2b3b3947 + member_id: 0x3a9bd5f4 + member_id: 0xb252ef85 + member_id: 0x3c859cc4 + member_id: 0x950fbc14 + member_id: 0x1ba59c6d + member_id: 0xc8b0c1d4 + member_id: 0x5e35aa2e + member_id: 0x2e72e7e0 + member_id: 0x85af182d + member_id: 0x90793300 + member_id: 0x9e84141c + member_id: 0xa5c2f472 + member_id: 0xeb46d6f6 + member_id: 0x049c1f00 + member_id: 0x54806d5b + member_id: 0x7b7f9a93 + member_id: 0xeff7e2c9 + member_id: 0x573e57ed + member_id: 0x3d9c68f5 + member_id: 0x7f7f584f + member_id: 0x069fcabf + member_id: 0x561fd50f + member_id: 0xd95b0d92 + } } struct_union { id: 0xc7e35718 @@ -214161,7 +215892,7 @@ struct_union { bytesize: 344 member_id: 0x7c00ef52 member_id: 0x4fd31bbd - member_id: 0x5685a7bf + member_id: 0x56ace115 member_id: 0xad7c8a1e member_id: 0xc5a12bbd member_id: 0x5c46dd88 @@ -214176,7 +215907,7 @@ struct_union { member_id: 0x6ac6877c member_id: 0xefdb0c31 member_id: 0xf45f2394 - member_id: 0xd1c402eb + member_id: 0xd1e477a3 } } struct_union { @@ -214193,6 +215924,22 @@ struct_union { member_id: 0x357170d2 } } +struct_union { + id: 0x6807af97 + kind: STRUCT + name: "devlink_port_new_attrs" + definition { + bytesize: 20 + member_id: 0xdf2fd72b + member_id: 0xbf1e816a + member_id: 0xd8dc9c99 + member_id: 0x4c6b273e + member_id: 0x6980d678 + member_id: 0x0317cd78 + member_id: 0x1db19505 + member_id: 0x38a7e1c1 + } +} struct_union { id: 0xf0f5f897 kind: STRUCT @@ -214238,6 +215985,18 @@ struct_union { member_id: 0xd69a643e } } +struct_union { + id: 0xe6964d46 + kind: STRUCT + name: "devlink_port_region_ops" + definition { + bytesize: 32 + member_id: 0x0de57ce8 + member_id: 0xa4170b6e + member_id: 0x0c832449 + member_id: 0x59119068 + } +} struct_union { id: 0x1777d31b kind: STRUCT @@ -214246,7 +216005,7 @@ struct_union { bytesize: 80 member_id: 0x7c00ef52 member_id: 0x5cf2824f - member_id: 0x5685afdd + member_id: 0x56ace977 member_id: 0x5911980a member_id: 0xd3866153 member_id: 0x6d8a9147 @@ -214254,6 +216013,89 @@ struct_union { member_id: 0x38c01e38 } } +struct_union { + id: 0x47689b48 + kind: STRUCT + name: "devlink_region" + definition { + bytesize: 120 + member_id: 0x56ace1be + member_id: 0x48c075a0 + member_id: 0x7c00e690 + member_id: 0x3c8c9122 + member_id: 0xcbc193d6 + member_id: 0xcffde3b6 + member_id: 0x2a2e382b + member_id: 0x80fbe8a7 + member_id: 0xd9ec35e7 + } +} +struct_union { + id: 0xc4da5559 + kind: STRUCT + name: "devlink_region_ops" + definition { + bytesize: 32 + member_id: 0x0de57ce8 + member_id: 0xa4170b6e + member_id: 0x0c805fde + member_id: 0x59119068 + } +} +struct_union { + id: 0xe35e5ccd + kind: STRUCT + name: "devlink_sb_pool_info" + definition { + bytesize: 16 + member_id: 0xe52eef97 + member_id: 0xd9b71962 + member_id: 0x6ce0bb82 + member_id: 0x08477548 + } +} +struct_union { + id: 0x1c7a3d65 + kind: STRUCT + name: "devlink_trap" + definition { + bytesize: 32 + member_id: 0x5cbbb022 + member_id: 0x3ecaad84 + member_id: 0x4257f846 + member_id: 0xccbe65b2 + member_id: 0x0de5752a + member_id: 0xa4c7afe2 + member_id: 0xd492332a + } +} +struct_union { + id: 0x198b6a50 + kind: STRUCT + name: "devlink_trap_group" + definition { + bytesize: 16 + member_id: 0x0de57ce8 + member_id: 0xccbe65cf + member_id: 0x4257f83b + member_id: 0xf53cc107 + } +} +struct_union { + id: 0xaf8c5ca0 + kind: STRUCT + name: "devlink_trap_policer" + definition { + bytesize: 56 + member_id: 0xcce624ba + member_id: 0x2b41bb63 + member_id: 0xb36eb0c7 + member_id: 0x5cea623b + member_id: 0x7843c8a8 + member_id: 0x9c062023 + member_id: 0x7b580056 + } +} struct_union { id: 0xd1d07704 kind: STRUCT @@ -263806,6 +265648,104 @@ enumeration { } } } +enumeration { + id: 0xe09c0936 + name: "devlink_dpipe_field_mapping_type" + definition { + underlying_type_id: 0x4585663f + enumerator { + name: "DEVLINK_DPIPE_FIELD_MAPPING_TYPE_NONE" + } + enumerator { + name: "DEVLINK_DPIPE_FIELD_MAPPING_TYPE_IFINDEX" + value: 1 + } + } +} +enumeration { + id: 0xc700b957 + name: "devlink_eswitch_encap_mode" + definition { + underlying_type_id: 0x4585663f + enumerator { + name: "DEVLINK_ESWITCH_ENCAP_MODE_NONE" + } + enumerator { + name: "DEVLINK_ESWITCH_ENCAP_MODE_BASIC" + value: 1 + } + } +} +enumeration { + id: 0x1afd1fe8 + name: "devlink_health_reporter_state" + definition { + underlying_type_id: 0x4585663f + enumerator { + name: "DEVLINK_HEALTH_REPORTER_STATE_HEALTHY" + } + enumerator { + name: "DEVLINK_HEALTH_REPORTER_STATE_ERROR" + value: 1 + } + } +} +enumeration { + id: 0x49f89a6d + name: "devlink_info_version_type" + definition { + underlying_type_id: 0x4585663f + enumerator { + name: "DEVLINK_INFO_VERSION_TYPE_NONE" + } + enumerator { + name: "DEVLINK_INFO_VERSION_TYPE_COMPONENT" + value: 1 + } + } +} +enumeration { + id: 0x44d985d5 + name: "devlink_linecard_state" + definition { + underlying_type_id: 0x4585663f + enumerator { + name: "DEVLINK_LINECARD_STATE_UNSPEC" + } + enumerator { + name: "DEVLINK_LINECARD_STATE_UNPROVISIONED" + value: 1 + } + enumerator { + name: "DEVLINK_LINECARD_STATE_UNPROVISIONING" + value: 2 + } + enumerator { + name: "DEVLINK_LINECARD_STATE_PROVISIONING" + value: 3 + } + enumerator { + name: "DEVLINK_LINECARD_STATE_PROVISIONING_FAILED" + value: 4 + } + enumerator { + name: "DEVLINK_LINECARD_STATE_PROVISIONED" + value: 5 + } + enumerator { + name: "DEVLINK_LINECARD_STATE_ACTIVE" + value: 6 + } + enumerator { + name: "__DEVLINK_LINECARD_STATE_MAX" + value: 7 + } + enumerator { + name: "DEVLINK_LINECARD_STATE_MAX" + value: 6 + } + } +} enumeration { id: 0x03e0374b name: "devlink_port_flavour" @@ -263844,6 +265784,34 @@ enumeration { } } } +enumeration { + id: 0x769abc6d + name: "devlink_port_fn_opstate" + definition { + underlying_type_id: 0x4585663f + enumerator { + name: "DEVLINK_PORT_FN_OPSTATE_DETACHED" + } + enumerator { + name: "DEVLINK_PORT_FN_OPSTATE_ATTACHED" + value: 1 + } + } +} +enumeration { + id: 0x666a7a1b + name: "devlink_port_fn_state" + definition { + underlying_type_id: 0x4585663f + enumerator { + name: "DEVLINK_PORT_FN_STATE_INACTIVE" + } + enumerator { + name: "DEVLINK_PORT_FN_STATE_ACTIVE" + value: 1 + } + } +} enumeration { id: 0x100964d4 name: "devlink_port_type" @@ -263880,6 +265848,136 @@ enumeration { } } } +enumeration { + id: 0xb38a8bec + name: "devlink_reload_action" + definition { + underlying_type_id: 0x4585663f + enumerator { + name: "DEVLINK_RELOAD_ACTION_UNSPEC" + } + enumerator { + name: "DEVLINK_RELOAD_ACTION_DRIVER_REINIT" + value: 1 + } + enumerator { + name: "DEVLINK_RELOAD_ACTION_FW_ACTIVATE" + value: 2 + } + enumerator { + name: "__DEVLINK_RELOAD_ACTION_MAX" + value: 3 + } + enumerator { + name: "DEVLINK_RELOAD_ACTION_MAX" + value: 2 + } + } +} +enumeration { + id: 0x35c4d162 + name: "devlink_reload_limit" + definition { + underlying_type_id: 0x4585663f + enumerator { + name: "DEVLINK_RELOAD_LIMIT_UNSPEC" + } + enumerator { + name: "DEVLINK_RELOAD_LIMIT_NO_RESET" + value: 1 + } + enumerator { + name: "__DEVLINK_RELOAD_LIMIT_MAX" + value: 2 + } + enumerator { + name: "DEVLINK_RELOAD_LIMIT_MAX" + value: 1 + } + } +} +enumeration { + id: 0xa7051d2f + name: "devlink_sb_pool_type" + definition { + underlying_type_id: 0x4585663f + enumerator { + name: "DEVLINK_SB_POOL_TYPE_INGRESS" + } + enumerator { + name: "DEVLINK_SB_POOL_TYPE_EGRESS" + value: 1 + } + } +} +enumeration { + id: 0xcbcc8512 + name: "devlink_sb_threshold_type" + definition { + underlying_type_id: 0x4585663f + enumerator { + name: "DEVLINK_SB_THRESHOLD_TYPE_STATIC" + } + enumerator { + name: "DEVLINK_SB_THRESHOLD_TYPE_DYNAMIC" + value: 1 + } + } +} +enumeration { + id: 0xba990d57 + name: "devlink_selftest_status" + definition { + underlying_type_id: 0x4585663f + enumerator { + name: "DEVLINK_SELFTEST_STATUS_SKIP" + } + enumerator { + name: "DEVLINK_SELFTEST_STATUS_PASS" + value: 1 + } + enumerator { + name: "DEVLINK_SELFTEST_STATUS_FAIL" + value: 2 + } + } +} +enumeration { + id: 0x322b7a90 + name: "devlink_trap_action" + definition { + underlying_type_id: 0x4585663f + enumerator { + name: "DEVLINK_TRAP_ACTION_DROP" + } + enumerator { + name: "DEVLINK_TRAP_ACTION_TRAP" + value: 1 + } + enumerator { + name: "DEVLINK_TRAP_ACTION_MIRROR" + value: 2 + } + } +} +enumeration { + id: 0xed655c73 + name: "devlink_trap_type" + definition { + underlying_type_id: 0x4585663f + enumerator { + name: "DEVLINK_TRAP_TYPE_DROP" + } + enumerator { + name: "DEVLINK_TRAP_TYPE_EXCEPTION" + value: 1 + } + enumerator { + name: "DEVLINK_TRAP_TYPE_CONTROL" + value: 2 + } + } +} enumeration { id: 0x69efc53e name: "df_reason" @@ -278005,6 +280103,15 @@ function { return_type_id: 0x48b5725f parameter_id: 0x0bbe1c3e } +function { + id: 0x1277e3bd + return_type_id: 0x48b5725f + parameter_id: 0x0a70ce1b + parameter_id: 0x18bd6530 + parameter_id: 0x4585663f + parameter_id: 0x051414e1 + parameter_id: 0x04d7fcdd +} function { id: 0x127987a5 return_type_id: 0x48b5725f @@ -278530,6 +280637,22 @@ function { parameter_id: 0x054f691a parameter_id: 0x391f15ea } +function { + id: 0x1353a05d + return_type_id: 0x48b5725f + parameter_id: 0x0cf3d8fe + parameter_id: 0x3e10b518 + parameter_id: 0x3e10b518 + parameter_id: 0x33756485 + parameter_id: 0x33756485 +} +function { + id: 0x1353c771 + return_type_id: 0x48b5725f + parameter_id: 0x0cf3d8fe + parameter_id: 0x3c53e119 + parameter_id: 0x18bd6530 +} function { id: 0x13544dcf return_type_id: 0x48b5725f @@ -278662,6 +280785,12 @@ function { parameter_id: 0x18bd6530 parameter_id: 0x6720d32f } +function { + id: 0x137915b0 + return_type_id: 0x48b5725f + parameter_id: 0x0cf3d8fe + parameter_id: 0x376c8705 +} function { id: 0x13797fb7 return_type_id: 0x48b5725f @@ -278767,6 +280896,11 @@ function { parameter_id: 0xe02e14d6 parameter_id: 0xf435685e } +function { + id: 0x13a4a7ac + return_type_id: 0x48b5725f + parameter_id: 0x0cf3d8fe +} function { id: 0x13a62397 return_type_id: 0x48b5725f @@ -280353,6 +282487,11 @@ function { return_type_id: 0x48b5725f parameter_id: 0x1b7b196f } +function { + id: 0x164ad64e + return_type_id: 0x48b5725f + parameter_id: 0x1b4a1f75 +} function { id: 0x164c5933 return_type_id: 0x48b5725f @@ -285186,6 +287325,13 @@ function { parameter_id: 0x3b04bead parameter_id: 0x18bd6530 } +function { + id: 0x1e3db1e5 + return_type_id: 0x48b5725f + parameter_id: 0x3e10b518 + parameter_id: 0x49f89a6d + parameter_id: 0x18bd6530 +} function { id: 0x1e3f491e return_type_id: 0x48b5725f @@ -285823,6 +287969,12 @@ function { return_type_id: 0x48b5725f parameter_id: 0x3e6239e1 } +function { + id: 0x1f01387c + return_type_id: 0x48b5725f + parameter_id: 0x3fca7642 + parameter_id: 0x1afd1fe8 +} function { id: 0x1f060fb8 return_type_id: 0x48b5725f @@ -286185,6 +288337,11 @@ function { return_type_id: 0x48b5725f parameter_id: 0x3fc475cd } +function { + id: 0x1f6acc03 + return_type_id: 0x48b5725f + parameter_id: 0x3fca7642 +} function { id: 0x1f729ba1 return_type_id: 0x48b5725f @@ -286791,6 +288948,14 @@ function { parameter_id: 0x6720d32f parameter_id: 0x6720d32f } +function { + id: 0x2720cd28 + return_type_id: 0x3fca7642 + parameter_id: 0x0cf3d8fe + parameter_id: 0x307eba5c + parameter_id: 0x92233392 + parameter_id: 0x18bd6530 +} function { id: 0x27d025a4 return_type_id: 0x40e51470 @@ -289032,6 +291197,13 @@ function { return_type_id: 0x08faf209 parameter_id: 0x11e6864c } +function { + id: 0x553ed14c + return_type_id: 0xba990d57 + parameter_id: 0x0cf3d8fe + parameter_id: 0x4585663f + parameter_id: 0x07dcdbe1 +} function { id: 0x55423178 return_type_id: 0x18bd6530 @@ -289057,6 +291229,11 @@ function { return_type_id: 0x18bd6530 parameter_id: 0x0c48c037 } +function { + id: 0x55aa47ce + return_type_id: 0x18bd6530 + parameter_id: 0x0cf3d8fe +} function { id: 0x55afd20f return_type_id: 0x2131312a @@ -289462,6 +291639,11 @@ function { parameter_id: 0x30cfc1c2 parameter_id: 0xf1a6dfed } +function { + id: 0x59642c61 + return_type_id: 0x18bd6530 + parameter_id: 0x3fca7642 +} function { id: 0x596454e5 return_type_id: 0x92233392 @@ -289710,6 +291892,14 @@ function { parameter_id: 0xf435685e parameter_id: 0x6720d32f } +function { + id: 0x5bbe2188 + return_type_id: 0x0cf3d8fe + parameter_id: 0x3121a074 + parameter_id: 0xf435685e + parameter_id: 0x0ca27481 + parameter_id: 0x0258f96e +} function { id: 0x5bd76b9c return_type_id: 0x18bd6530 @@ -294882,6 +297072,13 @@ function { return_type_id: 0x6720d32f parameter_id: 0x3e360385 } +function { + id: 0x92117c1d + return_type_id: 0x6720d32f + parameter_id: 0x3fca7642 + parameter_id: 0x18bd6530 + parameter_id: 0x07dcdbe1 +} function { id: 0x92121eb9 return_type_id: 0x6720d32f @@ -295278,6 +297475,23 @@ function { parameter_id: 0x3176a085 parameter_id: 0xeeed68e6 } +function { + id: 0x926873bc + return_type_id: 0x6720d32f + parameter_id: 0x3b68ec61 + parameter_id: 0x4585663f + parameter_id: 0x914dbfdc + parameter_id: 0x38d23361 + parameter_id: 0x38d23361 +} +function { + id: 0x92687d88 + return_type_id: 0x6720d32f + parameter_id: 0x3b68ec61 + parameter_id: 0x4585663f + parameter_id: 0x914dbfdc + parameter_id: 0x38d23361 +} function { id: 0x92697f90 return_type_id: 0x6720d32f @@ -295288,11 +297502,57 @@ function { return_type_id: 0x3e10b518 parameter_id: 0x00b7947f } +function { + id: 0x926a0987 + return_type_id: 0x6720d32f + parameter_id: 0x3b68ec61 + parameter_id: 0x4585663f + parameter_id: 0x914dbfdc + parameter_id: 0xa7051d2f + parameter_id: 0x2ec35650 + parameter_id: 0x38d23361 +} +function { + id: 0x926a0c03 + return_type_id: 0x6720d32f + parameter_id: 0x3b68ec61 + parameter_id: 0x4585663f + parameter_id: 0x914dbfdc + parameter_id: 0xa7051d2f + parameter_id: 0x38d23361 + parameter_id: 0x38d23361 +} +function { + id: 0x926a25a2 + return_type_id: 0x6720d32f + parameter_id: 0x3b68ec61 + parameter_id: 0x4585663f + parameter_id: 0x914dbfdc + parameter_id: 0xa7051d2f + parameter_id: 0x914dbfdc + parameter_id: 0xc9082b19 + parameter_id: 0x07dcdbe1 +} +function { + id: 0x926bbb17 + return_type_id: 0x6720d32f + parameter_id: 0x3b68ec61 + parameter_id: 0x4585663f + parameter_id: 0x914dbfdc + parameter_id: 0xc9082b19 + parameter_id: 0x07dcdbe1 +} function { id: 0x926be467 return_type_id: 0x6720d32f parameter_id: 0x3fac1d22 } +function { + id: 0x926d0dd0 + return_type_id: 0x6720d32f + parameter_id: 0x3fca7642 + parameter_id: 0x07dcdbe1 +} function { id: 0x926dcbb0 return_type_id: 0x6720d32f @@ -295448,6 +297708,13 @@ function { parameter_id: 0x3f37d9d5 parameter_id: 0x32a063f3 } +function { + id: 0x928c1332 + return_type_id: 0x6720d32f + parameter_id: 0x3fca7642 + parameter_id: 0x3e10b518 + parameter_id: 0x18bd6530 +} function { id: 0x928d6faf return_type_id: 0x6720d32f @@ -295665,6 +297932,13 @@ function { parameter_id: 0x3e10b518 parameter_id: 0x38040a6c } +function { + id: 0x92c286e9 + return_type_id: 0x6720d32f + parameter_id: 0x3b68ec61 + parameter_id: 0x666a7a1b + parameter_id: 0x07dcdbe1 +} function { id: 0x92c2d86d return_type_id: 0x6720d32f @@ -295931,6 +298205,14 @@ function { parameter_id: 0x3e6396e0 parameter_id: 0x386badcf } +function { + id: 0x92fb2e1e + return_type_id: 0x6720d32f + parameter_id: 0x3fca7642 + parameter_id: 0x23d822f9 + parameter_id: 0x18bd6530 + parameter_id: 0x07dcdbe1 +} function { id: 0x92fc5924 return_type_id: 0x6720d32f @@ -295944,6 +298226,13 @@ function { parameter_id: 0x3e10b518 parameter_id: 0x3e10b518 } +function { + id: 0x92fce902 + return_type_id: 0x6720d32f + parameter_id: 0x3fca7642 + parameter_id: 0x23d822f9 + parameter_id: 0x07dcdbe1 +} function { id: 0x92fcfc63 return_type_id: 0x6720d32f @@ -296059,6 +298348,14 @@ function { parameter_id: 0x4585663f parameter_id: 0x00c72527 } +function { + id: 0x9313207d + return_type_id: 0x6720d32f + parameter_id: 0x3b68ec61 + parameter_id: 0x130aa721 + parameter_id: 0x173696bc + parameter_id: 0x07dcdbe1 +} function { id: 0x9313a933 return_type_id: 0x6720d32f @@ -296154,6 +298451,12 @@ function { parameter_id: 0x6720d32f parameter_id: 0x3e6239e1 } +function { + id: 0x931afda4 + return_type_id: 0x6720d32f + parameter_id: 0x3b68ec61 + parameter_id: 0x100964d4 +} function { id: 0x931d2209 return_type_id: 0x6720d32f @@ -296345,6 +298648,14 @@ function { parameter_id: 0x3f37d9d5 parameter_id: 0x4585663f } +function { + id: 0x935d0dd3 + return_type_id: 0x6720d32f + parameter_id: 0x3b68ec61 + parameter_id: 0x00c72527 + parameter_id: 0x13580d6c + parameter_id: 0x07dcdbe1 +} function { id: 0x93627fe0 return_type_id: 0x6720d32f @@ -296537,6 +298848,14 @@ function { parameter_id: 0x39a8be0c parameter_id: 0x1e8e5a79 } +function { + id: 0x9394f11e + return_type_id: 0x6720d32f + parameter_id: 0x3b68ec61 + parameter_id: 0x33fd261b + parameter_id: 0x07dcdbe1 + parameter_id: 0x0aa1f0ee +} function { id: 0x93980968 return_type_id: 0x6720d32f @@ -296682,6 +299001,14 @@ function { parameter_id: 0x3b4ce03a parameter_id: 0x3b4ce03a } +function { + id: 0x93bf0967 + return_type_id: 0x6720d32f + parameter_id: 0x3b68ec61 + parameter_id: 0x3f0185ef + parameter_id: 0x6720d32f + parameter_id: 0x07dcdbe1 +} function { id: 0x93bf967f return_type_id: 0x6720d32f @@ -297955,6 +300282,11 @@ function { parameter_id: 0x508a987d parameter_id: 0x2ac2dd67 } +function { + id: 0x9576eb91 + return_type_id: 0x6720d32f + parameter_id: 0x23d822f9 +} function { id: 0x957964bc return_type_id: 0x6720d32f @@ -298030,6 +300362,12 @@ function { parameter_id: 0x3f44b979 parameter_id: 0x3e10b518 } +function { + id: 0x958ea945 + return_type_id: 0x6720d32f + parameter_id: 0x23d822f9 + parameter_id: 0x3e10b518 +} function { id: 0x958f9102 return_type_id: 0x6720d32f @@ -298227,6 +300565,13 @@ function { parameter_id: 0x23f09c34 parameter_id: 0x334c07d5 } +function { + id: 0x95b6c4a9 + return_type_id: 0x6720d32f + parameter_id: 0x23d822f9 + parameter_id: 0x391f15ea + parameter_id: 0x914dbfdc +} function { id: 0x95b74be6 return_type_id: 0x6720d32f @@ -307323,6 +309668,15 @@ function { parameter_id: 0x04ca9246 parameter_id: 0x33756485 } +function { + id: 0x9c7facb4 + return_type_id: 0x6720d32f + parameter_id: 0x0cf3d8fe + parameter_id: 0xb38a8bec + parameter_id: 0x35c4d162 + parameter_id: 0x38d23361 + parameter_id: 0x07dcdbe1 +} function { id: 0x9c814f78 return_type_id: 0x6720d32f @@ -308017,6 +310371,13 @@ function { parameter_id: 0x6d7f5ff6 parameter_id: 0x33d0e528 } +function { + id: 0x9cf8d4d9 + return_type_id: 0x6720d32f + parameter_id: 0x0cf3d8fe + parameter_id: 0x914dbfdc + parameter_id: 0x07dcdbe1 +} function { id: 0x9cf9beaa return_type_id: 0x6720d32f @@ -309202,6 +311563,13 @@ function { parameter_id: 0x2c982451 parameter_id: 0x13bdf349 } +function { + id: 0x9da1e0c3 + return_type_id: 0x6720d32f + parameter_id: 0x0cf3d8fe + parameter_id: 0xc700b957 + parameter_id: 0x07dcdbe1 +} function { id: 0x9da4bde5 return_type_id: 0x6720d32f @@ -310120,6 +312488,12 @@ function { parameter_id: 0x3e10b518 parameter_id: 0xf1a6dfed } +function { + id: 0x9e071849 + return_type_id: 0x6720d32f + parameter_id: 0x0cf3d8fe + parameter_id: 0x2ec35650 +} function { id: 0x9e08dfbb return_type_id: 0x6720d32f @@ -310155,6 +312529,21 @@ function { parameter_id: 0x36c97631 parameter_id: 0x6720d32f } +function { + id: 0x9e15f25c + return_type_id: 0x6720d32f + parameter_id: 0x0f4dcd61 + parameter_id: 0x18bd6530 + parameter_id: 0x92233392 + parameter_id: 0x07dcdbe1 +} +function { + id: 0x9e1893ee + return_type_id: 0x6720d32f + parameter_id: 0x0cf3d8fe + parameter_id: 0x295c7202 + parameter_id: 0x07dcdbe1 +} function { id: 0x9e19651e return_type_id: 0x6720d32f @@ -310177,6 +312566,13 @@ function { parameter_id: 0x0db3ac0f parameter_id: 0x3d8951f4 } +function { + id: 0x9e1a5c22 + return_type_id: 0x6720d32f + parameter_id: 0x0cf3d8fe + parameter_id: 0x29ef8105 + parameter_id: 0x07dcdbe1 +} function { id: 0x9e1dd697 return_type_id: 0x6720d32f @@ -310281,6 +312677,13 @@ function { parameter_id: 0xc9082b19 parameter_id: 0x07dcdbe1 } +function { + id: 0x9e3092d5 + return_type_id: 0x6720d32f + parameter_id: 0x0f4dcd61 + parameter_id: 0x18bd6530 + parameter_id: 0x07dcdbe1 +} function { id: 0x9e31377c return_type_id: 0x6720d32f @@ -310315,6 +312718,38 @@ function { return_type_id: 0x6720d32f parameter_id: 0x0effc5a1 } +function { + id: 0x9e40b36c + return_type_id: 0x6720d32f + parameter_id: 0x0cf3d8fe + parameter_id: 0x3c0cf46a + parameter_id: 0x322b7a90 + parameter_id: 0x07dcdbe1 +} +function { + id: 0x9e40c88b + return_type_id: 0x6720d32f + parameter_id: 0x0cf3d8fe + parameter_id: 0x3b68ec61 + parameter_id: 0x4585663f + parameter_id: 0x07dcdbe1 +} +function { + id: 0x9e41cf39 + return_type_id: 0x6720d32f + parameter_id: 0x0cf3d8fe + parameter_id: 0x3c53e119 + parameter_id: 0x322b7a90 + parameter_id: 0x07dcdbe1 +} +function { + id: 0x9e41e293 + return_type_id: 0x6720d32f + parameter_id: 0x0cf3d8fe + parameter_id: 0x3c0cf46a + parameter_id: 0x376c8705 + parameter_id: 0x07dcdbe1 +} function { id: 0x9e41ea47 return_type_id: 0x6720d32f @@ -310336,12 +312771,62 @@ function { parameter_id: 0x452ab998 parameter_id: 0x6720d32f } +function { + id: 0x9e46dca9 + return_type_id: 0x6720d32f + parameter_id: 0x0cf3d8fe + parameter_id: 0x3c53e119 + parameter_id: 0x2e18f543 +} +function { + id: 0x9e4766bb + return_type_id: 0x6720d32f + parameter_id: 0x0cf3d8fe + parameter_id: 0x376c8705 + parameter_id: 0x92233392 + parameter_id: 0x92233392 + parameter_id: 0x07dcdbe1 +} function { id: 0x9e49e56e return_type_id: 0x6720d32f parameter_id: 0x0b7c4f67 parameter_id: 0x4585663f } +function { + id: 0x9e4b75cd + return_type_id: 0x6720d32f + parameter_id: 0x0cf3d8fe + parameter_id: 0x3c53e119 + parameter_id: 0x18bd6530 +} +function { + id: 0x9e4c26c1 + return_type_id: 0x6720d32f + parameter_id: 0x0cf3d8fe + parameter_id: 0x3c0cf46a +} +function { + id: 0x9e504197 + return_type_id: 0x6720d32f + parameter_id: 0x0cf3d8fe + parameter_id: 0x3b68ec61 + parameter_id: 0x07dcdbe1 +} +function { + id: 0x9e51554f + return_type_id: 0x6720d32f + parameter_id: 0x0cf3d8fe + parameter_id: 0x3b5017f2 +} +function { + id: 0x9e51dd03 + return_type_id: 0x6720d32f + parameter_id: 0x0cf3d8fe + parameter_id: 0x3b143836 + parameter_id: 0x07dcdbe1 + parameter_id: 0x1bf16028 +} function { id: 0x9e52789b return_type_id: 0x6720d32f @@ -310363,6 +312848,13 @@ function { parameter_id: 0x1479c6e7 parameter_id: 0x2d8ee262 } +function { + id: 0x9e590019 + return_type_id: 0x6720d32f + parameter_id: 0x0cf3d8fe + parameter_id: 0x39388fd3 + parameter_id: 0x07dcdbe1 +} function { id: 0x9e5980cd return_type_id: 0x6720d32f @@ -310392,6 +312884,19 @@ function { return_type_id: 0x6720d32f parameter_id: 0x0f78474f } +function { + id: 0x9e609ac2 + return_type_id: 0x6720d32f + parameter_id: 0x0f4dcd61 + parameter_id: 0x0cbf60eb + parameter_id: 0x07dcdbe1 +} +function { + id: 0x9e61a70c + return_type_id: 0x6720d32f + parameter_id: 0x0cf3d8fe + parameter_id: 0x376c8705 +} function { id: 0x9e61ffc7 return_type_id: 0x6720d32f @@ -310423,6 +312928,15 @@ function { parameter_id: 0x33b77109 parameter_id: 0x0277bf8a } +function { + id: 0x9e68eb19 + return_type_id: 0x6720d32f + parameter_id: 0x0f4dcd61 + parameter_id: 0x0f4dcd61 + parameter_id: 0x18bd6530 + parameter_id: 0x18bd6530 + parameter_id: 0x07dcdbe1 +} function { id: 0x9e69dafa return_type_id: 0x6720d32f @@ -310432,6 +312946,13 @@ function { parameter_id: 0x4585663f parameter_id: 0x11d941b8 } +function { + id: 0x9e6a2131 + return_type_id: 0x6720d32f + parameter_id: 0x0cf3d8fe + parameter_id: 0x376c8705 + parameter_id: 0x2e18f543 +} function { id: 0x9e6bce91 return_type_id: 0x6720d32f @@ -310527,6 +313048,14 @@ function { parameter_id: 0x0db3ac0f parameter_id: 0x25653b02 } +function { + id: 0x9e7aaf3f + return_type_id: 0x6720d32f + parameter_id: 0x0cf3d8fe + parameter_id: 0x31d9e79a + parameter_id: 0x07dcdbe1 + parameter_id: 0x0aa1f0ee +} function { id: 0x9e7f936c return_type_id: 0x6720d32f @@ -310721,6 +313250,12 @@ function { parameter_id: 0x0effc5a1 parameter_id: 0x2060db23 } +function { + id: 0x9ebf0984 + return_type_id: 0x6720d32f + parameter_id: 0x0cf3d8fe + parameter_id: 0x00c72527 +} function { id: 0x9ebfed71 return_type_id: 0x6720d32f @@ -311222,6 +313757,15 @@ function { parameter_id: 0x097315c2 parameter_id: 0x3e10b518 } +function { + id: 0x9f25dc29 + return_type_id: 0x6720d32f + parameter_id: 0x0cf3d8fe + parameter_id: 0x6d7f5ff6 + parameter_id: 0xb38a8bec + parameter_id: 0x35c4d162 + parameter_id: 0x07dcdbe1 +} function { id: 0x9f25fe02 return_type_id: 0x6720d32f @@ -311556,6 +314100,15 @@ function { parameter_id: 0x0beab59b parameter_id: 0x054f691a } +function { + id: 0x9f71449b + return_type_id: 0x6720d32f + parameter_id: 0x0a70ce1b + parameter_id: 0x18bd6530 + parameter_id: 0x3e10b518 + parameter_id: 0x391f15ea + parameter_id: 0x07dcdbe1 +} function { id: 0x9f72f53e return_type_id: 0x6720d32f @@ -311606,6 +314159,13 @@ function { return_type_id: 0x6720d32f parameter_id: 0x0bfc9031 } +function { + id: 0x9f7fd20b + return_type_id: 0x6720d32f + parameter_id: 0x0a70ce1b + parameter_id: 0x18bd6530 + parameter_id: 0x07dcdbe1 +} function { id: 0x9f808c95 return_type_id: 0x6720d32f @@ -311678,6 +314238,24 @@ function { parameter_id: 0xf435685e parameter_id: 0x3e10b518 } +function { + id: 0x9f8d452b + return_type_id: 0x6720d32f + parameter_id: 0x0cf3d8fe + parameter_id: 0x4585663f + parameter_id: 0x914dbfdc + parameter_id: 0xc9082b19 + parameter_id: 0xcbcc8512 + parameter_id: 0x07dcdbe1 +} +function { + id: 0x9f8e9af9 + return_type_id: 0x6720d32f + parameter_id: 0x0cf3d8fe + parameter_id: 0x4585663f + parameter_id: 0x914dbfdc + parameter_id: 0x3247ae94 +} function { id: 0x9f93bc17 return_type_id: 0x6720d32f @@ -311769,6 +314347,12 @@ function { parameter_id: 0x08a8dfa4 parameter_id: 0x0258f96e } +function { + id: 0x9faa0088 + return_type_id: 0x6720d32f + parameter_id: 0x0cf3d8fe + parameter_id: 0x4585663f +} function { id: 0x9fab680a return_type_id: 0x6720d32f @@ -311776,6 +314360,13 @@ function { parameter_id: 0xc9082b19 parameter_id: 0xc9082b19 } +function { + id: 0x9fabf7be + return_type_id: 0x6720d32f + parameter_id: 0x0cf3d8fe + parameter_id: 0x4585663f + parameter_id: 0x07dcdbe1 +} function { id: 0x9fac2fbc return_type_id: 0x6720d32f @@ -314149,6 +316740,12 @@ function { parameter_id: 0x0a134144 parameter_id: 0x3360dff4 } +function { + id: 0xcc25b8e9 + return_type_id: 0x4585663f + parameter_id: 0x0a70ce1b + parameter_id: 0x18bd6530 +} function { id: 0xcc787cc3 return_type_id: 0x2efe8065 @@ -315143,6 +317740,14 @@ function { parameter_id: 0x10673339 parameter_id: 0x23e856d0 } +function { + id: 0xe97c10c0 + return_type_id: 0x1b4a1f75 + parameter_id: 0x0cf3d8fe + parameter_id: 0x31d9e79a + parameter_id: 0xc9082b19 + parameter_id: 0x92233392 +} function { id: 0xea3d26bb return_type_id: 0x2e8ed696 @@ -316463,6 +319068,14 @@ function { return_type_id: 0x368487be parameter_id: 0x368487be } +function { + id: 0xfc55fd47 + return_type_id: 0x6d7f5ff6 + parameter_id: 0x0a70ce1b + parameter_id: 0x18bd6530 + parameter_id: 0x3e10b518 + parameter_id: 0x391f15ea +} function { id: 0xfc59f36a return_type_id: 0x26e55184 @@ -316515,6 +319128,13 @@ function { parameter_id: 0x1e820193 parameter_id: 0x15a30023 } +function { + id: 0xfc8f4f95 + return_type_id: 0x6d7f5ff6 + parameter_id: 0x0cf3d8fe + parameter_id: 0x4585663f + parameter_id: 0x07dcdbe1 +} function { id: 0xfca015af return_type_id: 0x6d7f5ff6 @@ -316732,6 +319352,12 @@ function { parameter_id: 0x03942c7a parameter_id: 0x3fd547b8 } +function { + id: 0xfec047b0 + return_type_id: 0x6d7f5ff6 + parameter_id: 0x0258f96e + parameter_id: 0x3c88bbfa +} function { id: 0xfec3d248 return_type_id: 0x6d7f5ff6 @@ -334548,6 +337174,15 @@ elf_symbol { type_id: 0x10fc4d27 full_name: "device_remove_file" } +elf_symbol { + id: 0x22e51db4 + name: "device_remove_file_self" + is_defined: true + symbol_type: FUNCTION + crc: 0x7f6f4aa9 + type_id: 0xfec047b0 + full_name: "device_remove_file_self" +} elf_symbol { id: 0x5a62c5df name: "device_remove_groups" @@ -334656,6 +337291,150 @@ elf_symbol { type_id: 0x9d16dd74 full_name: "device_wakeup_enable" } +elf_symbol { + id: 0x884a3a76 + name: "devlink_alloc_ns" + is_defined: true + symbol_type: FUNCTION + crc: 0x81bd8c7b + type_id: 0x5bbe2188 + full_name: "devlink_alloc_ns" +} +elf_symbol { + id: 0xb54be30e + name: "devlink_flash_update_status_notify" + is_defined: true + symbol_type: FUNCTION + crc: 0x04c41c60 + type_id: 0x1353a05d + full_name: "devlink_flash_update_status_notify" +} +elf_symbol { + id: 0xead962b7 + name: "devlink_fmsg_binary_pair_nest_end" + is_defined: true + symbol_type: FUNCTION + crc: 0x5358864e + type_id: 0x9576eb91 + full_name: "devlink_fmsg_binary_pair_nest_end" +} +elf_symbol { + id: 0xfb50f564 + name: "devlink_fmsg_binary_pair_nest_start" + is_defined: true + symbol_type: FUNCTION + crc: 0x11df0e75 + type_id: 0x958ea945 + full_name: "devlink_fmsg_binary_pair_nest_start" +} +elf_symbol { + id: 0xff600ca5 + name: "devlink_fmsg_binary_put" + is_defined: true + symbol_type: FUNCTION + crc: 0x15510a89 + type_id: 0x95b6c4a9 + full_name: "devlink_fmsg_binary_put" +} +elf_symbol { + id: 0x266ac51c + name: "devlink_free" + is_defined: true + symbol_type: FUNCTION + crc: 0x660eb6bd + type_id: 0x13a4a7ac + full_name: "devlink_free" +} +elf_symbol { + id: 0xa8e06dd7 + name: "devlink_health_report" + is_defined: true + symbol_type: FUNCTION + crc: 0x93edef07 + type_id: 0x928c1332 + full_name: "devlink_health_report" +} +elf_symbol { + id: 0x52e65741 + name: "devlink_health_reporter_create" + is_defined: true + symbol_type: FUNCTION + crc: 0x0d26f5c4 + type_id: 0x2720cd28 + full_name: "devlink_health_reporter_create" +} +elf_symbol { + id: 0x2069fc41 + name: "devlink_health_reporter_destroy" + is_defined: true + symbol_type: FUNCTION + crc: 0x850bb6db + type_id: 0x1f6acc03 + full_name: "devlink_health_reporter_destroy" +} +elf_symbol { + id: 0x0abe7457 + name: "devlink_health_reporter_priv" + is_defined: true + symbol_type: FUNCTION + crc: 0xe40bb23e + type_id: 0x59642c61 + full_name: "devlink_health_reporter_priv" +} +elf_symbol { + id: 0x70ca4fad + name: "devlink_health_reporter_state_update" + is_defined: true + symbol_type: FUNCTION + crc: 0x2b4509dd + type_id: 0x1f01387c + full_name: "devlink_health_reporter_state_update" +} +elf_symbol { + id: 0xa164371a + name: "devlink_priv" + is_defined: true + symbol_type: FUNCTION + crc: 0x6e3347ec + type_id: 0x55aa47ce + full_name: "devlink_priv" +} +elf_symbol { + id: 0xb4634233 + name: "devlink_region_create" + is_defined: true + symbol_type: FUNCTION + crc: 0x6110ed39 + type_id: 0xe97c10c0 + full_name: "devlink_region_create" +} +elf_symbol { + id: 0x0a058c0b + name: "devlink_region_destroy" + is_defined: true + symbol_type: FUNCTION + crc: 0xa410a295 + type_id: 0x164ad64e + full_name: "devlink_region_destroy" +} +elf_symbol { + id: 0x5603c10b + name: "devlink_register" + is_defined: true + symbol_type: FUNCTION + crc: 0xc498bdc9 + type_id: 0x13a4a7ac + full_name: "devlink_register" +} +elf_symbol { + id: 0x7520d018 + name: "devlink_unregister" + is_defined: true + symbol_type: FUNCTION + crc: 0x946c0028 + type_id: 0x13a4a7ac + full_name: "devlink_unregister" +} elf_symbol { id: 0xde9ec7ca name: "devm_add_action" @@ -379496,6 +382275,7 @@ interface { symbol_id: 0x589e892d symbol_id: 0x25bf4477 symbol_id: 0x5b8e8574 + symbol_id: 0x22e51db4 symbol_id: 0x5a62c5df symbol_id: 0x20c43211 symbol_id: 0xcdcce9e8 @@ -379508,6 +382288,22 @@ interface { symbol_id: 0x440b32de symbol_id: 0x96ffcda6 symbol_id: 0x4b1a4683 + symbol_id: 0x884a3a76 + symbol_id: 0xb54be30e + symbol_id: 0xead962b7 + symbol_id: 0xfb50f564 + symbol_id: 0xff600ca5 + symbol_id: 0x266ac51c + symbol_id: 0xa8e06dd7 + symbol_id: 0x52e65741 + symbol_id: 0x2069fc41 + symbol_id: 0x0abe7457 + symbol_id: 0x70ca4fad + symbol_id: 0xa164371a + symbol_id: 0xb4634233 + symbol_id: 0x0a058c0b + symbol_id: 0x5603c10b + symbol_id: 0x7520d018 symbol_id: 0xde9ec7ca symbol_id: 0xa2a47944 symbol_id: 0x97ae66e9 diff --git a/android/abi_gki_aarch64_mtk b/android/abi_gki_aarch64_mtk index 9a933b3f74c6..bac4ddf87c67 100644 --- a/android/abi_gki_aarch64_mtk +++ b/android/abi_gki_aarch64_mtk @@ -416,6 +416,7 @@ device_release_driver device_remove_bin_file device_remove_file + device_remove_file_self device_rename __device_reset device_set_of_node_from_dev @@ -429,6 +430,22 @@ _dev_info __dev_kfree_skb_any __dev_kfree_skb_irq + devlink_alloc_ns + devlink_flash_update_status_notify + devlink_fmsg_binary_pair_nest_end + devlink_fmsg_binary_pair_nest_start + devlink_fmsg_binary_put + devlink_free + devlink_health_report + devlink_health_reporter_create + devlink_health_reporter_destroy + devlink_health_reporter_priv + devlink_health_reporter_state_update + devlink_priv + devlink_region_create + devlink_region_destroy + devlink_register + devlink_unregister dev_load devm_add_action __devm_alloc_percpu From 7edb035c79ac74397f9f09cf3775e6e751c3cd40 Mon Sep 17 00:00:00 2001 From: Kyongho Cho Date: Mon, 24 Jul 2023 13:17:51 -0700 Subject: [PATCH 47/98] ANDROID: drm/ttm: export ttm_tt_unpopulate() Xclipse GPU driver depends on TTM for graphics buffer allocation and management. It is required by customers to add graphics memory swap to improve overall memory efficiency. However TTM's swap feature can't be used since it selects victim buffer by LRU and we can't choose a specific buffer to swap. Xclipse GPU driver implements its own swap feature by means of APIs of TTM. But the problem is TTM's buffer allocations statistics in ttm_tt.c which are local to that file. Whenever a graphic buffer is swapped out, the size of total page allocation should be decreased but it is not possible from the outside of ttm_tt.c. If the statistics is not maintained well, TTM ends up swapping out TTM buffers globally which is unexpected. Bug: 291101811 Change-Id: I143c705834bcc196432c3ef59b49c9ec31f2e971 Signed-off-by: Kyongho Cho --- drivers/gpu/drm/ttm/ttm_tt.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/gpu/drm/ttm/ttm_tt.c b/drivers/gpu/drm/ttm/ttm_tt.c index d505603930a7..c9c297af53a7 100644 --- a/drivers/gpu/drm/ttm/ttm_tt.c +++ b/drivers/gpu/drm/ttm/ttm_tt.c @@ -370,6 +370,7 @@ void ttm_tt_unpopulate(struct ttm_device *bdev, struct ttm_tt *ttm) ttm->page_flags &= ~TTM_TT_FLAG_PRIV_POPULATED; } +EXPORT_SYMBOL_GPL(ttm_tt_unpopulate); #ifdef CONFIG_DEBUG_FS From db2c29e53dfe6a11d4565b5a462c6a640bf714ed Mon Sep 17 00:00:00 2001 From: Kyongho Cho Date: Thu, 13 Jul 2023 00:21:16 -0700 Subject: [PATCH 48/98] ANDROID: ABI: update symbol list for Xclipse GPU 1 function symbol(s) added 'void ttm_tt_unpopulate(struct ttm_device*, struct ttm_tt*)' Bug: 291101811 Change-Id: I0be29227b37734304f00fc7b8e2612a0fa6c3fff Signed-off-by: Kyongho Cho --- android/abi_gki_aarch64.stg | 10 ++++++++++ android/abi_gki_aarch64_exynos | 1 + 2 files changed, 11 insertions(+) diff --git a/android/abi_gki_aarch64.stg b/android/abi_gki_aarch64.stg index 13de9dcc4631..ec63c0c4c9fe 100644 --- a/android/abi_gki_aarch64.stg +++ b/android/abi_gki_aarch64.stg @@ -372812,6 +372812,15 @@ elf_symbol { type_id: 0x1210f89b full_name: "ttm_tt_fini" } +elf_symbol { + id: 0xcbabaff3 + name: "ttm_tt_unpopulate" + is_defined: true + symbol_type: FUNCTION + crc: 0xa5cacfb1 + type_id: 0x14b4088f + full_name: "ttm_tt_unpopulate" +} elf_symbol { id: 0x0b4dd20d name: "tty_chars_in_buffer" @@ -386233,6 +386242,7 @@ interface { symbol_id: 0x677985f3 symbol_id: 0x6c2259cd symbol_id: 0xacf009d6 + symbol_id: 0xcbabaff3 symbol_id: 0x0b4dd20d symbol_id: 0xae3ac3f6 symbol_id: 0xa7c71d5a diff --git a/android/abi_gki_aarch64_exynos b/android/abi_gki_aarch64_exynos index a3b16126c54e..e30927aa26b1 100644 --- a/android/abi_gki_aarch64_exynos +++ b/android/abi_gki_aarch64_exynos @@ -2304,6 +2304,7 @@ ttm_resource_manager_usage ttm_sg_tt_init ttm_tt_fini + ttm_tt_unpopulate vm_get_page_prot __wake_up_locked ww_mutex_lock_interruptible From 5e4a5dc82033d5b47e98b285906b366a864bb8a5 Mon Sep 17 00:00:00 2001 From: Eric Biggers Date: Fri, 9 Jun 2023 23:11:39 -0700 Subject: [PATCH 49/98] BACKPORT: blk-crypto: use dynamic lock class for blk_crypto_profile::lock When a device-mapper device is passing through the inline encryption support of an underlying device, calls to blk_crypto_evict_key() take the blk_crypto_profile::lock of the device-mapper device, then take the blk_crypto_profile::lock of the underlying device (nested). This isn't a real deadlock, but it causes a lockdep report because there is only one lock class for all instances of this lock. Lockdep subclasses don't really work here because the hierarchy of block devices is dynamic and could have more than 2 levels. Instead, register a dynamic lock class for each blk_crypto_profile, and associate that with the lock. This avoids false-positive lockdep reports like the following: ============================================ WARNING: possible recursive locking detected 6.4.0-rc5 #2 Not tainted -------------------------------------------- fscryptctl/1421 is trying to acquire lock: ffffff80829ca418 (&profile->lock){++++}-{3:3}, at: __blk_crypto_evict_key+0x44/0x1c0 but task is already holding lock: ffffff8086b68ca8 (&profile->lock){++++}-{3:3}, at: __blk_crypto_evict_key+0xc8/0x1c0 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(&profile->lock); lock(&profile->lock); *** DEADLOCK *** May be due to missing lock nesting notation Fixes: 1b2628397058 ("block: Keyslot Manager for Inline Encryption") Reported-by: Bart Van Assche Signed-off-by: Eric Biggers Reviewed-by: Bart Van Assche Link: https://lore.kernel.org/r/20230610061139.212085-1-ebiggers@kernel.org Signed-off-by: Jens Axboe Bug: 286427075 (cherry picked from commit 2fb48d88e77f29bf9d278f25bcfe82cf59a0e09b) (added '#ifdef CONFIG_LOCKDEP' to keep the KMI tooling happy) Change-Id: I21c0f941a36663c956a5c89324813bbaac0633ef Signed-off-by: Eric Biggers --- block/blk-crypto-profile.c | 16 +++++++++++++++- include/linux/blk-crypto-profile.h | 3 +++ 2 files changed, 18 insertions(+), 1 deletion(-) diff --git a/block/blk-crypto-profile.c b/block/blk-crypto-profile.c index fe550725c777..7cdef1bee6f7 100644 --- a/block/blk-crypto-profile.c +++ b/block/blk-crypto-profile.c @@ -79,7 +79,18 @@ int blk_crypto_profile_init(struct blk_crypto_profile *profile, unsigned int slot_hashtable_size; memset(profile, 0, sizeof(*profile)); + + /* + * profile->lock of an underlying device can nest inside profile->lock + * of a device-mapper device, so use a dynamic lock class to avoid + * false-positive lockdep reports. + */ +#ifdef CONFIG_LOCKDEP + lockdep_register_key(&profile->lockdep_key); + __init_rwsem(&profile->lock, "&profile->lock", &profile->lockdep_key); +#else init_rwsem(&profile->lock); +#endif if (num_slots == 0) return 0; @@ -89,7 +100,7 @@ int blk_crypto_profile_init(struct blk_crypto_profile *profile, profile->slots = kvcalloc(num_slots, sizeof(profile->slots[0]), GFP_KERNEL); if (!profile->slots) - return -ENOMEM; + goto err_destroy; profile->num_slots = num_slots; @@ -443,6 +454,9 @@ void blk_crypto_profile_destroy(struct blk_crypto_profile *profile) { if (!profile) return; +#ifdef CONFIG_LOCKDEP + lockdep_unregister_key(&profile->lockdep_key); +#endif kvfree(profile->slot_hashtable); kvfree_sensitive(profile->slots, sizeof(profile->slots[0]) * profile->num_slots); diff --git a/include/linux/blk-crypto-profile.h b/include/linux/blk-crypto-profile.h index 8b30d04ef008..794f608a8994 100644 --- a/include/linux/blk-crypto-profile.h +++ b/include/linux/blk-crypto-profile.h @@ -131,6 +131,9 @@ struct blk_crypto_profile { * keyslots while ensuring that they can't be changed concurrently. */ struct rw_semaphore lock; +#ifdef CONFIG_LOCKDEP + struct lock_class_key lockdep_key; +#endif /* List of idle slots, with least recently used slot at front */ wait_queue_head_t idle_slots_wait_queue; From 544ae28cf6b57bcc2050973c1ee4eeaad1f87a1b Mon Sep 17 00:00:00 2001 From: xieliujie Date: Mon, 10 Jul 2023 20:05:46 +0800 Subject: [PATCH 50/98] ANDROID: Inherit "user-aware property" across rtmutex. Since upstream commit 715f7f9ece46 ("locking/rtmutex: Squash !RT tasks to DEFAULT_PRIO"), non-rt tasks do not inherit the nice-priority values across rt_mutexes. This removes the minor (and indirect) priority-inheritance that rt-mutexes provided for CFS tasks. Though without priority inheritance, time-bounded priority inversion can occur between CFS tasks of different nice priorities / cgroup limitations. The proxy-execution efforts are a work-in-progress to resolve this upstream, but in the meantime it is left to vendor hooks to provide a near term solution to avoid priority inversion between CFS tasks. In our oem scheduler, if a CFS thread has an "user-aware property", we will always pick it even if it's vruntime is bigger than the smallest one in runqueue. That's why the trace_android_rvh_replace_next_task_fair vendorhook was added previously in commit 53e809978443 ("ANDROID: vendor_hooks: Add hooks for scheduler"). Thus for our oem scheduler, important CFS tasks(like RenderThread) are marked with the "user-aware property" in their struct task_struct. If those tasks are blocked on an rtmutex, we want to allow the "user-aware property" to be inherited to lock owner, so it will be selected to run immediately to release the lock. To support this, we need new hooks to map "user-aware property" into different rtmutex_waiter prio and update the owner's "user-aware property" if needed. Thus these additional vendor hooks are needed. In the future, once an generalized upstream solution for CFS priority inheritance is in place, this will no longer be needed. Bug: 290585456 Change-Id: I6521ed2086b147400a54da6b84a324baf16bc649 Signed-off-by: xieliujie --- drivers/android/vendor_hooks.c | 2 ++ include/trace/hooks/dtask.h | 11 ++++++++++- include/trace/hooks/sched.h | 4 ++++ kernel/locking/rtmutex.c | 6 ++++++ kernel/sched/core.c | 6 ++++-- kernel/sched/vendor_hooks.c | 1 + 6 files changed, 27 insertions(+), 3 deletions(-) diff --git a/drivers/android/vendor_hooks.c b/drivers/android/vendor_hooks.c index 0a30c8cbe7bd..35baee2a710d 100644 --- a/drivers/android/vendor_hooks.c +++ b/drivers/android/vendor_hooks.c @@ -88,6 +88,8 @@ EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_do_send_sig_info); EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_mutex_wait_start); EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_mutex_wait_finish); EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_mutex_init); +EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_task_blocks_on_rtmutex); +EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_rtmutex_waiter_prio); EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_rtmutex_wait_start); EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_rtmutex_wait_finish); EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_mutex_opt_spin_start); diff --git a/include/trace/hooks/dtask.h b/include/trace/hooks/dtask.h index cbf3dfd38d36..1552b71c1792 100644 --- a/include/trace/hooks/dtask.h +++ b/include/trace/hooks/dtask.h @@ -91,7 +91,16 @@ DECLARE_HOOK(android_vh_alter_mutex_list_add, DECLARE_HOOK(android_vh_mutex_unlock_slowpath, TP_PROTO(struct mutex *lock), TP_ARGS(lock)); - +struct rt_mutex_waiter; +struct ww_acquire_ctx; +DECLARE_HOOK(android_vh_task_blocks_on_rtmutex, + TP_PROTO(struct rt_mutex_base *lock, struct rt_mutex_waiter *waiter, + struct task_struct *task, struct ww_acquire_ctx *ww_ctx, + unsigned int *chwalk), + TP_ARGS(lock, waiter, task, ww_ctx, chwalk)); +DECLARE_HOOK(android_vh_rtmutex_waiter_prio, + TP_PROTO(struct task_struct *task, int *waiter_prio), + TP_ARGS(task, waiter_prio)); #endif /* _TRACE_HOOK_DTASK_H */ /* This part must be outside protection */ diff --git a/include/trace/hooks/sched.h b/include/trace/hooks/sched.h index 811f07f7be61..4cc3f0cded7b 100644 --- a/include/trace/hooks/sched.h +++ b/include/trace/hooks/sched.h @@ -52,6 +52,10 @@ DECLARE_RESTRICTED_HOOK(android_rvh_finish_prio_fork, TP_PROTO(struct task_struct *p), TP_ARGS(p), 1); +DECLARE_RESTRICTED_HOOK(android_rvh_rtmutex_force_update, + TP_PROTO(struct task_struct *p, struct task_struct *pi_task, int *update), + TP_ARGS(p, pi_task, update), 1); + DECLARE_RESTRICTED_HOOK(android_rvh_rtmutex_prepare_setprio, TP_PROTO(struct task_struct *p, struct task_struct *pi_task), TP_ARGS(p, pi_task), 1); diff --git a/kernel/locking/rtmutex.c b/kernel/locking/rtmutex.c index 229ce6bc7d62..351716fe9138 100644 --- a/kernel/locking/rtmutex.c +++ b/kernel/locking/rtmutex.c @@ -327,6 +327,11 @@ static __always_inline bool unlock_rt_mutex_safe(struct rt_mutex_base *lock, static __always_inline int __waiter_prio(struct task_struct *task) { int prio = task->prio; + int waiter_prio = 0; + + trace_android_vh_rtmutex_waiter_prio(task, &waiter_prio); + if (waiter_prio > 0) + return waiter_prio; if (!rt_prio(prio)) return DEFAULT_PRIO; @@ -1151,6 +1156,7 @@ static int __sched task_blocks_on_rt_mutex(struct rt_mutex_base *lock, if (owner == task && !(build_ww_mutex() && ww_ctx)) return -EDEADLK; + trace_android_vh_task_blocks_on_rtmutex(lock, waiter, task, ww_ctx, &chwalk); raw_spin_lock(&task->pi_lock); waiter->task = task; waiter->lock = lock; diff --git a/kernel/sched/core.c b/kernel/sched/core.c index 53faabdb3950..95843540088b 100644 --- a/kernel/sched/core.c +++ b/kernel/sched/core.c @@ -7043,15 +7043,17 @@ void rt_mutex_setprio(struct task_struct *p, struct task_struct *pi_task) const struct sched_class *prev_class; struct rq_flags rf; struct rq *rq; + int update = 0; trace_android_rvh_rtmutex_prepare_setprio(p, pi_task); /* XXX used to be waiter->prio, not waiter->task->prio */ prio = __rt_effective_prio(pi_task, p->normal_prio); + trace_android_rvh_rtmutex_force_update(p, pi_task, &update); /* * If nothing changed; bail early. */ - if (p->pi_top_task == pi_task && prio == p->prio && !dl_prio(prio)) + if (!update && p->pi_top_task == pi_task && prio == p->prio && !dl_prio(prio)) return; rq = __task_rq_lock(p, &rf); @@ -7071,7 +7073,7 @@ void rt_mutex_setprio(struct task_struct *p, struct task_struct *pi_task) /* * For FIFO/RR we only need to set prio, if that matches we're done. */ - if (prio == p->prio && !dl_prio(prio)) + if (!update && prio == p->prio && !dl_prio(prio)) goto out_unlock; /* diff --git a/kernel/sched/vendor_hooks.c b/kernel/sched/vendor_hooks.c index d8d945fc20e3..f528b1f6cbb9 100644 --- a/kernel/sched/vendor_hooks.c +++ b/kernel/sched/vendor_hooks.c @@ -22,6 +22,7 @@ EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_can_migrate_task); EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_find_lowest_rq); EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_prepare_prio_fork); EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_finish_prio_fork); +EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_rtmutex_force_update); EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_rtmutex_prepare_setprio); EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_set_user_nice); EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_setscheduler); From cf70cb4f1f14ec29fa153152a60b66b5e0e5049f Mon Sep 17 00:00:00 2001 From: Linus Torvalds Date: Thu, 15 Jun 2023 16:17:48 -0700 Subject: [PATCH 51/98] UPSTREAM: mm: make the page fault mmap locking killable commit eda0047296a16d65a7f2bc60a408f70d178b2014 upstream. This is done as a separate patch from introducing the new lock_mm_and_find_vma() helper, because while it's an obvious change, it's not what x86 used to do in this area. We already abort the page fault on fatal signals anyway, so why should we wait for the mmap lock only to then abort later? With the new helper function that returns without the lock held on failure anyway, this is particularly easy and straightforward. Signed-off-by: Linus Torvalds Signed-off-by: Samuel Mendoza-Jonas Signed-off-by: David Woodhouse Signed-off-by: Greg Kroah-Hartman Change-Id: I9730b4543265a20253cbfc02de135cc77927f821 (cherry picked from commit eda0047296a16d65a7f2bc60a408f70d178b2014) Signed-off-by: Suren Baghdasaryan Signed-off-by: Greg Kroah-Hartman --- mm/memory.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/mm/memory.c b/mm/memory.c index 78a9e3fb0e65..cd3cfc7753a9 100644 --- a/mm/memory.c +++ b/mm/memory.c @@ -5304,8 +5304,7 @@ static inline bool get_mmap_lock_carefully(struct mm_struct *mm, struct pt_regs return false; } - mmap_read_lock(mm); - return true; + return !mmap_read_lock_killable(mm); } static inline bool mmap_upgrade_trylock(struct mm_struct *mm) @@ -5329,8 +5328,7 @@ static inline bool upgrade_mmap_lock_carefully(struct mm_struct *mm, struct pt_r if (!search_exception_tables(ip)) return false; } - mmap_write_lock(mm); - return true; + return !mmap_write_lock_killable(mm); } /* From 89298b8b3ce6a5de2167929c07c7e00df7df0efa Mon Sep 17 00:00:00 2001 From: Linus Torvalds Date: Thu, 15 Jun 2023 17:11:44 -0700 Subject: [PATCH 52/98] BACKPORT: arm64/mm: Convert to using lock_mm_and_find_vma() commit ae870a68b5d13d67cf4f18d47bb01ee3fee40acb upstream. This converts arm64 to use the new page fault helper. It was very straightforward, but still needed a fix for the "obvious" conversion I initially did. Thanks to Suren for the fix and testing. Fixed-and-tested-by: Suren Baghdasaryan Unnecessary-code-removal-by: Liam R. Howlett Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman [surenb: this one is taken from 6.4.y stable branch] Change-Id: Ibda94ca9b3893b8961e1d6536c854c0aee559a6b (cherry picked from commit ae870a68b5d13d67cf4f18d47bb01ee3fee40acb) Signed-off-by: Suren Baghdasaryan Signed-off-by: Greg Kroah-Hartman --- arch/arm64/Kconfig | 1 + arch/arm64/mm/fault.c | 47 ++++++++----------------------------------- 2 files changed, 9 insertions(+), 39 deletions(-) diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig index bf11f89de29a..7dafeacab872 100644 --- a/arch/arm64/Kconfig +++ b/arch/arm64/Kconfig @@ -216,6 +216,7 @@ config ARM64 select IRQ_DOMAIN select IRQ_FORCED_THREADING select KASAN_VMALLOC if KASAN + select LOCK_MM_AND_FIND_VMA select MODULES_USE_ELF_RELA select NEED_DMA_MAP_STATE select NEED_SG_DMA_LENGTH diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c index 49e08cc145c0..16d8206e0470 100644 --- a/arch/arm64/mm/fault.c +++ b/arch/arm64/mm/fault.c @@ -502,27 +502,14 @@ static void do_bad_area(unsigned long far, unsigned long esr, #define VM_FAULT_BADMAP 0x010000 #define VM_FAULT_BADACCESS 0x020000 -static vm_fault_t __do_page_fault(struct mm_struct *mm, unsigned long addr, +static vm_fault_t __do_page_fault(struct mm_struct *mm, + struct vm_area_struct *vma, unsigned long addr, unsigned int mm_flags, unsigned long vm_flags, struct pt_regs *regs) { - struct vm_area_struct *vma = find_vma(mm, addr); - - if (unlikely(!vma)) - return VM_FAULT_BADMAP; - /* * Ok, we have a good vm_area for this memory access, so we can handle * it. - */ - if (unlikely(vma->vm_start > addr)) { - if (!(vma->vm_flags & VM_GROWSDOWN)) - return VM_FAULT_BADMAP; - if (expand_stack(vma, addr)) - return VM_FAULT_BADMAP; - } - - /* * Check that the permissions on the VMA allow for the fault which * occurred. */ @@ -643,31 +630,15 @@ static int __kprobes do_page_fault(unsigned long far, unsigned long esr, } lock_mmap: #endif /* CONFIG_PER_VMA_LOCK */ - /* - * As per x86, we may deadlock here. However, since the kernel only - * validly references user space from well defined areas of the code, - * we can bug out early if this is from code which shouldn't. - */ - if (!mmap_read_trylock(mm)) { - if (!user_mode(regs) && !search_exception_tables(regs->pc)) - goto no_context; + retry: - mmap_read_lock(mm); - } else { - /* - * The above mmap_read_trylock() might have succeeded in which - * case, we'll have missed the might_sleep() from down_read(). - */ - might_sleep(); -#ifdef CONFIG_DEBUG_VM - if (!user_mode(regs) && !search_exception_tables(regs->pc)) { - mmap_read_unlock(mm); - goto no_context; - } -#endif + vma = lock_mm_and_find_vma(mm, addr, regs); + if (unlikely(!vma)) { + fault = VM_FAULT_BADMAP; + goto done; } - fault = __do_page_fault(mm, addr, mm_flags, vm_flags, regs); + fault = __do_page_fault(mm, vma, addr, mm_flags, vm_flags, regs); /* Quick path to respond to signals */ if (fault_signal_pending(fault, regs)) { @@ -686,9 +657,7 @@ retry: } mmap_read_unlock(mm); -#ifdef CONFIG_PER_VMA_LOCK done: -#endif /* * Handle the "normal" (no error) case first. */ From 1016faf509997c4c280f12e762c1df10530d8548 Mon Sep 17 00:00:00 2001 From: SeongJae Park Date: Tue, 4 Jul 2023 01:00:03 +0000 Subject: [PATCH 53/98] BACKPORT: arch/arm64/mm/fault: Fix undeclared variable error in do_page_fault() commit 24be4d0b46bb0c3c1dc7bacd30957d6144a70dfc upstream. Commit ae870a68b5d1 ("arm64/mm: Convert to using lock_mm_and_find_vma()") made do_page_fault() to use 'vma' even if CONFIG_PER_VMA_LOCK is not defined, but the declaration is still in the ifdef. As a result, building kernel without the config fails with undeclared variable error as below: arch/arm64/mm/fault.c: In function 'do_page_fault': arch/arm64/mm/fault.c:624:2: error: 'vma' undeclared (first use in this function); did you mean 'vmap'? 624 | vma = lock_mm_and_find_vma(mm, addr, regs); | ^~~ | vmap Fix it by moving the declaration out of the ifdef. Fixes: ae870a68b5d1 ("arm64/mm: Convert to using lock_mm_and_find_vma()") Signed-off-by: SeongJae Park Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman [surenb: this one is taken from 6.4.y stable branch] Change-Id: Iba3153aa67f2dab347e4bc04a09c566b47cf4f63 (cherry picked from commit 24be4d0b46bb0c3c1dc7bacd30957d6144a70dfc) Signed-off-by: Suren Baghdasaryan Signed-off-by: Greg Kroah-Hartman --- arch/arm64/mm/fault.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c index 16d8206e0470..e34b46785150 100644 --- a/arch/arm64/mm/fault.c +++ b/arch/arm64/mm/fault.c @@ -541,9 +541,7 @@ static int __kprobes do_page_fault(unsigned long far, unsigned long esr, unsigned long vm_flags; unsigned int mm_flags = FAULT_FLAG_DEFAULT; unsigned long addr = untagged_addr(far); -#ifdef CONFIG_PER_VMA_LOCK struct vm_area_struct *vma; -#endif if (kprobe_page_fault(regs, esr)) return 0; From 9cdce804c05a3c377bb053720837f678802d5fc8 Mon Sep 17 00:00:00 2001 From: Michael Ellerman Date: Fri, 16 Jun 2023 15:51:29 +1000 Subject: [PATCH 54/98] UPSTREAM: powerpc/mm: Convert to using lock_mm_and_find_vma() commit e6fe228c4ffafdfc970cf6d46883a1f481baf7ea upstream. Signed-off-by: Michael Ellerman Signed-off-by: Linus Torvalds Signed-off-by: Samuel Mendoza-Jonas Signed-off-by: David Woodhouse Signed-off-by: Greg Kroah-Hartman Change-Id: Ifeaee70ad1bdb9e583aaba137526cc49e2ecf8be (cherry picked from commit e6fe228c4ffafdfc970cf6d46883a1f481baf7ea) Signed-off-by: Suren Baghdasaryan Signed-off-by: Greg Kroah-Hartman --- arch/powerpc/Kconfig | 1 + arch/powerpc/mm/fault.c | 39 +++------------------------------------ 2 files changed, 4 insertions(+), 36 deletions(-) diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig index 2b1141645d9e..6050e6e10d32 100644 --- a/arch/powerpc/Kconfig +++ b/arch/powerpc/Kconfig @@ -257,6 +257,7 @@ config PPC select IRQ_DOMAIN select IRQ_FORCED_THREADING select KASAN_VMALLOC if KASAN && MODULES + select LOCK_MM_AND_FIND_VMA select MMU_GATHER_PAGE_SIZE select MMU_GATHER_RCU_TABLE_FREE select MMU_GATHER_MERGE_VMAS diff --git a/arch/powerpc/mm/fault.c b/arch/powerpc/mm/fault.c index 531177a4ee08..5bfdf6ecfa96 100644 --- a/arch/powerpc/mm/fault.c +++ b/arch/powerpc/mm/fault.c @@ -84,11 +84,6 @@ static int __bad_area(struct pt_regs *regs, unsigned long address, int si_code) return __bad_area_nosemaphore(regs, address, si_code); } -static noinline int bad_area(struct pt_regs *regs, unsigned long address) -{ - return __bad_area(regs, address, SEGV_MAPERR); -} - static noinline int bad_access_pkey(struct pt_regs *regs, unsigned long address, struct vm_area_struct *vma) { @@ -515,40 +510,12 @@ lock_mmap: * we will deadlock attempting to validate the fault against the * address space. Luckily the kernel only validly references user * space from well defined areas of code, which are listed in the - * exceptions table. - * - * As the vast majority of faults will be valid we will only perform - * the source reference check when there is a possibility of a deadlock. - * Attempt to lock the address space, if we cannot we then validate the - * source. If this is invalid we can skip the address space check, - * thus avoiding the deadlock. + * exceptions table. lock_mm_and_find_vma() handles that logic. */ - if (unlikely(!mmap_read_trylock(mm))) { - if (!is_user && !search_exception_tables(regs->nip)) - return bad_area_nosemaphore(regs, address); - retry: - mmap_read_lock(mm); - } else { - /* - * The above down_read_trylock() might have succeeded in - * which case we'll have missed the might_sleep() from - * down_read(): - */ - might_sleep(); - } - - vma = find_vma(mm, address); + vma = lock_mm_and_find_vma(mm, address, regs); if (unlikely(!vma)) - return bad_area(regs, address); - - if (unlikely(vma->vm_start > address)) { - if (unlikely(!(vma->vm_flags & VM_GROWSDOWN))) - return bad_area(regs, address); - - if (unlikely(expand_stack(vma, address))) - return bad_area(regs, address); - } + return bad_area_nosemaphore(regs, address); if (unlikely(access_pkey_error(is_write, is_exec, (error_code & DSISR_KEYFAULT), vma))) From 053053fc68a49eda92d11b668acff2d41397b183 Mon Sep 17 00:00:00 2001 From: Ben Hutchings Date: Thu, 22 Jun 2023 18:47:40 +0200 Subject: [PATCH 55/98] UPSTREAM: mips/mm: Convert to using lock_mm_and_find_vma() commit 4bce37a68ff884e821a02a731897a8119e0c37b7 upstream. Signed-off-by: Ben Hutchings Signed-off-by: Linus Torvalds Signed-off-by: Samuel Mendoza-Jonas Signed-off-by: David Woodhouse Signed-off-by: Greg Kroah-Hartman Change-Id: Ie1ec8bd98c52086790adcd691370a76d135a333e (cherry picked from commit 4bce37a68ff884e821a02a731897a8119e0c37b7) Signed-off-by: Suren Baghdasaryan Signed-off-by: Greg Kroah-Hartman --- arch/mips/Kconfig | 1 + arch/mips/mm/fault.c | 12 ++---------- 2 files changed, 3 insertions(+), 10 deletions(-) diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig index b26b77673c2c..fecb681ff264 100644 --- a/arch/mips/Kconfig +++ b/arch/mips/Kconfig @@ -93,6 +93,7 @@ config MIPS select HAVE_VIRT_CPU_ACCOUNTING_GEN if 64BIT || !SMP select IRQ_FORCED_THREADING select ISA if EISA + select LOCK_MM_AND_FIND_VMA select MODULES_USE_ELF_REL if MODULES select MODULES_USE_ELF_RELA if MODULES && 64BIT select PERF_USE_VMALLOC diff --git a/arch/mips/mm/fault.c b/arch/mips/mm/fault.c index a27045f5a556..d7878208bd3f 100644 --- a/arch/mips/mm/fault.c +++ b/arch/mips/mm/fault.c @@ -99,21 +99,13 @@ static void __do_page_fault(struct pt_regs *regs, unsigned long write, perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS, 1, regs, address); retry: - mmap_read_lock(mm); - vma = find_vma(mm, address); + vma = lock_mm_and_find_vma(mm, address, regs); if (!vma) - goto bad_area; - if (vma->vm_start <= address) - goto good_area; - if (!(vma->vm_flags & VM_GROWSDOWN)) - goto bad_area; - if (expand_stack(vma, address)) - goto bad_area; + goto bad_area_nosemaphore; /* * Ok, we have a good vm_area for this memory access, so * we can handle it.. */ -good_area: si_code = SEGV_ACCERR; if (write) { From 9f136450af1aed45996d29cd333fbcd81fd104c8 Mon Sep 17 00:00:00 2001 From: Ben Hutchings Date: Thu, 22 Jun 2023 20:18:18 +0200 Subject: [PATCH 56/98] UPSTREAM: riscv/mm: Convert to using lock_mm_and_find_vma() commit 7267ef7b0b77f4ed23b7b3c87d8eca7bd9c2d007 upstream. Signed-off-by: Ben Hutchings Signed-off-by: Linus Torvalds [6.1: Kconfig context] Signed-off-by: Samuel Mendoza-Jonas Signed-off-by: David Woodhouse Signed-off-by: Greg Kroah-Hartman Change-Id: I601c5e4625e0357be7043026359aa85e5a63ade1 (cherry picked from commit 7267ef7b0b77f4ed23b7b3c87d8eca7bd9c2d007) Signed-off-by: Suren Baghdasaryan Signed-off-by: Greg Kroah-Hartman --- arch/riscv/Kconfig | 1 + arch/riscv/mm/fault.c | 31 +++++++++++++------------------ 2 files changed, 14 insertions(+), 18 deletions(-) diff --git a/arch/riscv/Kconfig b/arch/riscv/Kconfig index 06b9b2f60b9f..45d52d465e1d 100644 --- a/arch/riscv/Kconfig +++ b/arch/riscv/Kconfig @@ -113,6 +113,7 @@ config RISCV select HAVE_RSEQ select IRQ_DOMAIN select IRQ_FORCED_THREADING + select LOCK_MM_AND_FIND_VMA select MODULES_USE_ELF_RELA if MODULES select MODULE_SECTIONS if MODULES select OF diff --git a/arch/riscv/mm/fault.c b/arch/riscv/mm/fault.c index eb0774d9c03b..274bc6dd839f 100644 --- a/arch/riscv/mm/fault.c +++ b/arch/riscv/mm/fault.c @@ -83,13 +83,13 @@ static inline void mm_fault_error(struct pt_regs *regs, unsigned long addr, vm_f BUG(); } -static inline void bad_area(struct pt_regs *regs, struct mm_struct *mm, int code, unsigned long addr) +static inline void +bad_area_nosemaphore(struct pt_regs *regs, int code, unsigned long addr) { /* * Something tried to access memory that isn't in our memory map. * Fix it, but check if it's kernel or user first. */ - mmap_read_unlock(mm); /* User mode accesses just cause a SIGSEGV */ if (user_mode(regs)) { do_trap(regs, SIGSEGV, code, addr); @@ -99,6 +99,15 @@ static inline void bad_area(struct pt_regs *regs, struct mm_struct *mm, int code no_context(regs, addr); } +static inline void +bad_area(struct pt_regs *regs, struct mm_struct *mm, int code, + unsigned long addr) +{ + mmap_read_unlock(mm); + + bad_area_nosemaphore(regs, code, addr); +} + static inline void vmalloc_fault(struct pt_regs *regs, int code, unsigned long addr) { pgd_t *pgd, *pgd_k; @@ -281,23 +290,10 @@ asmlinkage void do_page_fault(struct pt_regs *regs) else if (cause == EXC_INST_PAGE_FAULT) flags |= FAULT_FLAG_INSTRUCTION; retry: - mmap_read_lock(mm); - vma = find_vma(mm, addr); + vma = lock_mm_and_find_vma(mm, addr, regs); if (unlikely(!vma)) { tsk->thread.bad_cause = cause; - bad_area(regs, mm, code, addr); - return; - } - if (likely(vma->vm_start <= addr)) - goto good_area; - if (unlikely(!(vma->vm_flags & VM_GROWSDOWN))) { - tsk->thread.bad_cause = cause; - bad_area(regs, mm, code, addr); - return; - } - if (unlikely(expand_stack(vma, addr))) { - tsk->thread.bad_cause = cause; - bad_area(regs, mm, code, addr); + bad_area_nosemaphore(regs, code, addr); return; } @@ -305,7 +301,6 @@ retry: * Ok, we have a good vm_area for this memory access, so * we can handle it. */ -good_area: code = SEGV_ACCERR; if (unlikely(access_error(cause, vma))) { From add0a1ea04ff78872b380fe9fd700b64114da678 Mon Sep 17 00:00:00 2001 From: Ben Hutchings Date: Thu, 22 Jun 2023 21:24:30 +0200 Subject: [PATCH 57/98] UPSTREAM: arm/mm: Convert to using lock_mm_and_find_vma() commit 8b35ca3e45e35a26a21427f35d4093606e93ad0a upstream. arm has an additional check for address < FIRST_USER_ADDRESS before expanding the stack. Since FIRST_USER_ADDRESS is defined everywhere (generally as 0), move that check to the generic expand_downwards(). Signed-off-by: Ben Hutchings Signed-off-by: Linus Torvalds Signed-off-by: Samuel Mendoza-Jonas Signed-off-by: David Woodhouse Signed-off-by: Greg Kroah-Hartman Change-Id: Ie1090f587090ef16de4bce224bbc52334bfe78fa (cherry picked from commit 8b35ca3e45e35a26a21427f35d4093606e93ad0a) Signed-off-by: Suren Baghdasaryan Signed-off-by: Greg Kroah-Hartman --- arch/arm/Kconfig | 1 + arch/arm/mm/fault.c | 63 ++++++++++----------------------------------- mm/mmap.c | 2 +- 3 files changed, 16 insertions(+), 50 deletions(-) diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig index a08c9d092a33..0202e48e7a20 100644 --- a/arch/arm/Kconfig +++ b/arch/arm/Kconfig @@ -122,6 +122,7 @@ config ARM select HAVE_UID16 select HAVE_VIRT_CPU_ACCOUNTING_GEN select IRQ_FORCED_THREADING + select LOCK_MM_AND_FIND_VMA select MODULES_USE_ELF_REL select NEED_DMA_MAP_STATE select OF_EARLY_FLATTREE if OF diff --git a/arch/arm/mm/fault.c b/arch/arm/mm/fault.c index de988cba9a4b..b0db85310331 100644 --- a/arch/arm/mm/fault.c +++ b/arch/arm/mm/fault.c @@ -231,37 +231,11 @@ static inline bool is_permission_fault(unsigned int fsr) return false; } -static vm_fault_t __kprobes -__do_page_fault(struct mm_struct *mm, unsigned long addr, unsigned int flags, - unsigned long vma_flags, struct pt_regs *regs) -{ - struct vm_area_struct *vma = find_vma(mm, addr); - if (unlikely(!vma)) - return VM_FAULT_BADMAP; - - if (unlikely(vma->vm_start > addr)) { - if (!(vma->vm_flags & VM_GROWSDOWN)) - return VM_FAULT_BADMAP; - if (addr < FIRST_USER_ADDRESS) - return VM_FAULT_BADMAP; - if (expand_stack(vma, addr)) - return VM_FAULT_BADMAP; - } - - /* - * ok, we have a good vm_area for this memory access, check the - * permissions on the VMA allow for the fault which occurred. - */ - if (!(vma->vm_flags & vma_flags)) - return VM_FAULT_BADACCESS; - - return handle_mm_fault(vma, addr & PAGE_MASK, flags, regs); -} - static int __kprobes do_page_fault(unsigned long addr, unsigned int fsr, struct pt_regs *regs) { struct mm_struct *mm = current->mm; + struct vm_area_struct *vma; int sig, code; vm_fault_t fault; unsigned int flags = FAULT_FLAG_DEFAULT; @@ -300,31 +274,21 @@ do_page_fault(unsigned long addr, unsigned int fsr, struct pt_regs *regs) perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS, 1, regs, addr); - /* - * As per x86, we may deadlock here. However, since the kernel only - * validly references user space from well defined areas of the code, - * we can bug out early if this is from code which shouldn't. - */ - if (!mmap_read_trylock(mm)) { - if (!user_mode(regs) && !search_exception_tables(regs->ARM_pc)) - goto no_context; retry: - mmap_read_lock(mm); - } else { - /* - * The above down_read_trylock() might have succeeded in - * which case, we'll have missed the might_sleep() from - * down_read() - */ - might_sleep(); -#ifdef CONFIG_DEBUG_VM - if (!user_mode(regs) && - !search_exception_tables(regs->ARM_pc)) - goto no_context; -#endif + vma = lock_mm_and_find_vma(mm, addr, regs); + if (unlikely(!vma)) { + fault = VM_FAULT_BADMAP; + goto bad_area; } - fault = __do_page_fault(mm, addr, flags, vm_flags, regs); + /* + * ok, we have a good vm_area for this memory access, check the + * permissions on the VMA allow for the fault which occurred. + */ + if (!(vma->vm_flags & vm_flags)) + fault = VM_FAULT_BADACCESS; + else + fault = handle_mm_fault(vma, addr & PAGE_MASK, flags, regs); /* If we need to retry but a fatal signal is pending, handle the * signal first. We do not need to release the mmap_lock because @@ -355,6 +319,7 @@ retry: if (likely(!(fault & (VM_FAULT_ERROR | VM_FAULT_BADMAP | VM_FAULT_BADACCESS)))) return 0; +bad_area: /* * If we are in kernel mode at this point, we * have no context to handle this fault with. diff --git a/mm/mmap.c b/mm/mmap.c index 751fcf6037b3..4eaf4762978c 100644 --- a/mm/mmap.c +++ b/mm/mmap.c @@ -2089,7 +2089,7 @@ int expand_downwards(struct vm_area_struct *vma, unsigned long address) int error = 0; address &= PAGE_MASK; - if (address < mmap_min_addr) + if (address < mmap_min_addr || address < FIRST_USER_ADDRESS) return -EPERM; /* Enforce stack_guard_gap */ From 6c33246824a5d258beaded8d7c98f932d76f928a Mon Sep 17 00:00:00 2001 From: Linus Torvalds Date: Sat, 24 Jun 2023 10:55:38 -0700 Subject: [PATCH 58/98] UPSTREAM: mm/fault: convert remaining simple cases to lock_mm_and_find_vma() commit a050ba1e7422f2cc60ff8bfde3f96d34d00cb585 upstream. This does the simple pattern conversion of alpha, arc, csky, hexagon, loongarch, nios2, sh, sparc32, and xtensa to the lock_mm_and_find_vma() helper. They all have the regular fault handling pattern without odd special cases. The remaining architectures all have something that keeps us from a straightforward conversion: ia64 and parisc have stacks that can grow both up as well as down (and ia64 has special address region checks). And m68k, microblaze, openrisc, sparc64, and um end up having extra rules about only expanding the stack down a limited amount below the user space stack pointer. That is something that x86 used to do too (long long ago), and it probably could just be skipped, but it still makes the conversion less than trivial. Note that this conversion was done manually and with the exception of alpha without any build testing, because I have a fairly limited cross- building environment. The cases are all simple, and I went through the changes several times, but... Signed-off-by: Linus Torvalds Signed-off-by: Samuel Mendoza-Jonas Signed-off-by: David Woodhouse Signed-off-by: Greg Kroah-Hartman Change-Id: I93e4ce3cb077329e202699a16db576be3a40285b (cherry picked from commit a050ba1e7422f2cc60ff8bfde3f96d34d00cb585) Signed-off-by: Suren Baghdasaryan Signed-off-by: Greg Kroah-Hartman --- arch/alpha/Kconfig | 1 + arch/alpha/mm/fault.c | 13 +++---------- arch/arc/Kconfig | 1 + arch/arc/mm/fault.c | 11 +++-------- arch/csky/Kconfig | 1 + arch/csky/mm/fault.c | 22 +++++----------------- arch/hexagon/Kconfig | 1 + arch/hexagon/mm/vm_fault.c | 18 ++++-------------- arch/loongarch/Kconfig | 1 + arch/loongarch/mm/fault.c | 16 ++++++---------- arch/nios2/Kconfig | 1 + arch/nios2/mm/fault.c | 17 ++--------------- arch/sh/Kconfig | 1 + arch/sh/mm/fault.c | 17 ++--------------- arch/sparc/Kconfig | 1 + arch/sparc/mm/fault_32.c | 32 ++++++++------------------------ arch/xtensa/Kconfig | 1 + arch/xtensa/mm/fault.c | 14 +++----------- 18 files changed, 45 insertions(+), 124 deletions(-) diff --git a/arch/alpha/Kconfig b/arch/alpha/Kconfig index 97fce7386b00..d95d82abdf29 100644 --- a/arch/alpha/Kconfig +++ b/arch/alpha/Kconfig @@ -28,6 +28,7 @@ config ALPHA select GENERIC_SMP_IDLE_THREAD select HAVE_ARCH_AUDITSYSCALL select HAVE_MOD_ARCH_SPECIFIC + select LOCK_MM_AND_FIND_VMA select MODULES_USE_ELF_RELA select ODD_RT_SIGACTION select OLD_SIGSUSPEND diff --git a/arch/alpha/mm/fault.c b/arch/alpha/mm/fault.c index ef427a6bdd1a..2b49aa94e4de 100644 --- a/arch/alpha/mm/fault.c +++ b/arch/alpha/mm/fault.c @@ -119,20 +119,12 @@ do_page_fault(unsigned long address, unsigned long mmcsr, flags |= FAULT_FLAG_USER; perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS, 1, regs, address); retry: - mmap_read_lock(mm); - vma = find_vma(mm, address); + vma = lock_mm_and_find_vma(mm, address, regs); if (!vma) - goto bad_area; - if (vma->vm_start <= address) - goto good_area; - if (!(vma->vm_flags & VM_GROWSDOWN)) - goto bad_area; - if (expand_stack(vma, address)) - goto bad_area; + goto bad_area_nosemaphore; /* Ok, we have a good vm_area for this memory access, so we can handle it. */ - good_area: si_code = SEGV_ACCERR; if (cause < 0) { if (!(vma->vm_flags & VM_EXEC)) @@ -189,6 +181,7 @@ retry: bad_area: mmap_read_unlock(mm); + bad_area_nosemaphore: if (user_mode(regs)) goto do_sigsegv; diff --git a/arch/arc/Kconfig b/arch/arc/Kconfig index d9a13ccf89a3..cb1074f74c3f 100644 --- a/arch/arc/Kconfig +++ b/arch/arc/Kconfig @@ -41,6 +41,7 @@ config ARC select HAVE_PERF_EVENTS select HAVE_SYSCALL_TRACEPOINTS select IRQ_DOMAIN + select LOCK_MM_AND_FIND_VMA select MODULES_USE_ELF_RELA select OF select OF_EARLY_FLATTREE diff --git a/arch/arc/mm/fault.c b/arch/arc/mm/fault.c index 5ca59a482632..f59e722d147f 100644 --- a/arch/arc/mm/fault.c +++ b/arch/arc/mm/fault.c @@ -113,15 +113,9 @@ void do_page_fault(unsigned long address, struct pt_regs *regs) perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS, 1, regs, address); retry: - mmap_read_lock(mm); - - vma = find_vma(mm, address); + vma = lock_mm_and_find_vma(mm, address, regs); if (!vma) - goto bad_area; - if (unlikely(address < vma->vm_start)) { - if (!(vma->vm_flags & VM_GROWSDOWN) || expand_stack(vma, address)) - goto bad_area; - } + goto bad_area_nosemaphore; /* * vm_area is good, now check permissions for this memory access @@ -161,6 +155,7 @@ retry: bad_area: mmap_read_unlock(mm); +bad_area_nosemaphore: /* * Major/minor page fault accounting * (in case of retry we only land here once) diff --git a/arch/csky/Kconfig b/arch/csky/Kconfig index adee6ab36862..742009123fd5 100644 --- a/arch/csky/Kconfig +++ b/arch/csky/Kconfig @@ -96,6 +96,7 @@ config CSKY select HAVE_RSEQ select HAVE_STACKPROTECTOR select HAVE_SYSCALL_TRACEPOINTS + select LOCK_MM_AND_FIND_VMA select MAY_HAVE_SPARSE_IRQ select MODULES_USE_ELF_RELA if MODULES select OF diff --git a/arch/csky/mm/fault.c b/arch/csky/mm/fault.c index e15f736cca4b..ae9781b7d92e 100644 --- a/arch/csky/mm/fault.c +++ b/arch/csky/mm/fault.c @@ -97,13 +97,12 @@ static inline void mm_fault_error(struct pt_regs *regs, unsigned long addr, vm_f BUG(); } -static inline void bad_area(struct pt_regs *regs, struct mm_struct *mm, int code, unsigned long addr) +static inline void bad_area_nosemaphore(struct pt_regs *regs, struct mm_struct *mm, int code, unsigned long addr) { /* * Something tried to access memory that isn't in our memory map. * Fix it, but check if it's kernel or user first. */ - mmap_read_unlock(mm); /* User mode accesses just cause a SIGSEGV */ if (user_mode(regs)) { do_trap(regs, SIGSEGV, code, addr); @@ -238,20 +237,9 @@ asmlinkage void do_page_fault(struct pt_regs *regs) if (is_write(regs)) flags |= FAULT_FLAG_WRITE; retry: - mmap_read_lock(mm); - vma = find_vma(mm, addr); + vma = lock_mm_and_find_vma(mm, address, regs); if (unlikely(!vma)) { - bad_area(regs, mm, code, addr); - return; - } - if (likely(vma->vm_start <= addr)) - goto good_area; - if (unlikely(!(vma->vm_flags & VM_GROWSDOWN))) { - bad_area(regs, mm, code, addr); - return; - } - if (unlikely(expand_stack(vma, addr))) { - bad_area(regs, mm, code, addr); + bad_area_nosemaphore(regs, mm, code, addr); return; } @@ -259,11 +247,11 @@ retry: * Ok, we have a good vm_area for this memory access, so * we can handle it. */ -good_area: code = SEGV_ACCERR; if (unlikely(access_error(regs, vma))) { - bad_area(regs, mm, code, addr); + mmap_read_unlock(mm); + bad_area_nosemaphore(regs, mm, code, addr); return; } diff --git a/arch/hexagon/Kconfig b/arch/hexagon/Kconfig index 54eadf265178..6726f4941015 100644 --- a/arch/hexagon/Kconfig +++ b/arch/hexagon/Kconfig @@ -28,6 +28,7 @@ config HEXAGON select GENERIC_SMP_IDLE_THREAD select STACKTRACE_SUPPORT select GENERIC_CLOCKEVENTS_BROADCAST + select LOCK_MM_AND_FIND_VMA select MODULES_USE_ELF_RELA select GENERIC_CPU_DEVICES select ARCH_WANT_LD_ORPHAN_WARN diff --git a/arch/hexagon/mm/vm_fault.c b/arch/hexagon/mm/vm_fault.c index f73c7cbfe326..583b08727166 100644 --- a/arch/hexagon/mm/vm_fault.c +++ b/arch/hexagon/mm/vm_fault.c @@ -57,21 +57,10 @@ void do_page_fault(unsigned long address, long cause, struct pt_regs *regs) perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS, 1, regs, address); retry: - mmap_read_lock(mm); - vma = find_vma(mm, address); - if (!vma) - goto bad_area; + vma = lock_mm_and_find_vma(mm, address, regs); + if (unlikely(!vma)) + goto bad_area_nosemaphore; - if (vma->vm_start <= address) - goto good_area; - - if (!(vma->vm_flags & VM_GROWSDOWN)) - goto bad_area; - - if (expand_stack(vma, address)) - goto bad_area; - -good_area: /* Address space is OK. Now check access rights. */ si_code = SEGV_ACCERR; @@ -140,6 +129,7 @@ good_area: bad_area: mmap_read_unlock(mm); +bad_area_nosemaphore: if (user_mode(regs)) { force_sig_fault(SIGSEGV, si_code, (void __user *)address); return; diff --git a/arch/loongarch/Kconfig b/arch/loongarch/Kconfig index 903096bd87f8..51d738ac12e5 100644 --- a/arch/loongarch/Kconfig +++ b/arch/loongarch/Kconfig @@ -107,6 +107,7 @@ config LOONGARCH select HAVE_VIRT_CPU_ACCOUNTING_GEN if !SMP select IRQ_FORCED_THREADING select IRQ_LOONGARCH_CPU + select LOCK_MM_AND_FIND_VMA select MMU_GATHER_MERGE_VMAS if MMU select MODULES_USE_ELF_RELA if MODULES select NEED_PER_CPU_EMBED_FIRST_CHUNK diff --git a/arch/loongarch/mm/fault.c b/arch/loongarch/mm/fault.c index 1ccd53655cab..b829ab911a17 100644 --- a/arch/loongarch/mm/fault.c +++ b/arch/loongarch/mm/fault.c @@ -166,22 +166,18 @@ static void __kprobes __do_page_fault(struct pt_regs *regs, perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS, 1, regs, address); retry: - mmap_read_lock(mm); - vma = find_vma(mm, address); - if (!vma) - goto bad_area; - if (vma->vm_start <= address) - goto good_area; - if (!(vma->vm_flags & VM_GROWSDOWN)) - goto bad_area; - if (!expand_stack(vma, address)) - goto good_area; + vma = lock_mm_and_find_vma(mm, address, regs); + if (unlikely(!vma)) + goto bad_area_nosemaphore; + goto good_area; + /* * Something tried to access memory that isn't in our memory map.. * Fix it, but check if it's kernel or user first.. */ bad_area: mmap_read_unlock(mm); +bad_area_nosemaphore: do_sigsegv(regs, write, address, si_code); return; diff --git a/arch/nios2/Kconfig b/arch/nios2/Kconfig index a582f72104f3..1fb78865a459 100644 --- a/arch/nios2/Kconfig +++ b/arch/nios2/Kconfig @@ -16,6 +16,7 @@ config NIOS2 select HAVE_ARCH_TRACEHOOK select HAVE_ARCH_KGDB select IRQ_DOMAIN + select LOCK_MM_AND_FIND_VMA select MODULES_USE_ELF_RELA select OF select OF_EARLY_FLATTREE diff --git a/arch/nios2/mm/fault.c b/arch/nios2/mm/fault.c index edaca0a6c1c1..71939fb28c2e 100644 --- a/arch/nios2/mm/fault.c +++ b/arch/nios2/mm/fault.c @@ -86,27 +86,14 @@ asmlinkage void do_page_fault(struct pt_regs *regs, unsigned long cause, perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS, 1, regs, address); - if (!mmap_read_trylock(mm)) { - if (!user_mode(regs) && !search_exception_tables(regs->ea)) - goto bad_area_nosemaphore; retry: - mmap_read_lock(mm); - } - - vma = find_vma(mm, address); + vma = lock_mm_and_find_vma(mm, address, regs); if (!vma) - goto bad_area; - if (vma->vm_start <= address) - goto good_area; - if (!(vma->vm_flags & VM_GROWSDOWN)) - goto bad_area; - if (expand_stack(vma, address)) - goto bad_area; + goto bad_area_nosemaphore; /* * Ok, we have a good vm_area for this memory access, so * we can handle it.. */ -good_area: code = SEGV_ACCERR; switch (cause) { diff --git a/arch/sh/Kconfig b/arch/sh/Kconfig index 5f220e903e5a..8e4d1f757bcc 100644 --- a/arch/sh/Kconfig +++ b/arch/sh/Kconfig @@ -56,6 +56,7 @@ config SUPERH select HAVE_STACKPROTECTOR select HAVE_SYSCALL_TRACEPOINTS select IRQ_FORCED_THREADING + select LOCK_MM_AND_FIND_VMA select MODULES_USE_ELF_RELA select NEED_SG_DMA_LENGTH select NO_DMA if !MMU && !DMA_COHERENT diff --git a/arch/sh/mm/fault.c b/arch/sh/mm/fault.c index acd2f5e50bfc..06e6b4952924 100644 --- a/arch/sh/mm/fault.c +++ b/arch/sh/mm/fault.c @@ -439,21 +439,9 @@ asmlinkage void __kprobes do_page_fault(struct pt_regs *regs, } retry: - mmap_read_lock(mm); - - vma = find_vma(mm, address); + vma = lock_mm_and_find_vma(mm, address, regs); if (unlikely(!vma)) { - bad_area(regs, error_code, address); - return; - } - if (likely(vma->vm_start <= address)) - goto good_area; - if (unlikely(!(vma->vm_flags & VM_GROWSDOWN))) { - bad_area(regs, error_code, address); - return; - } - if (unlikely(expand_stack(vma, address))) { - bad_area(regs, error_code, address); + bad_area_nosemaphore(regs, error_code, address); return; } @@ -461,7 +449,6 @@ retry: * Ok, we have a good vm_area for this memory access, so * we can handle it.. */ -good_area: if (unlikely(access_error(error_code, vma))) { bad_area_access_error(regs, error_code, address); return; diff --git a/arch/sparc/Kconfig b/arch/sparc/Kconfig index 84437a4c6545..dbb1760cbe8c 100644 --- a/arch/sparc/Kconfig +++ b/arch/sparc/Kconfig @@ -56,6 +56,7 @@ config SPARC32 select DMA_DIRECT_REMAP select GENERIC_ATOMIC64 select HAVE_UID16 + select LOCK_MM_AND_FIND_VMA select OLD_SIGACTION select ZONE_DMA diff --git a/arch/sparc/mm/fault_32.c b/arch/sparc/mm/fault_32.c index 91259f291c54..aef2aebe2379 100644 --- a/arch/sparc/mm/fault_32.c +++ b/arch/sparc/mm/fault_32.c @@ -143,28 +143,19 @@ asmlinkage void do_sparc_fault(struct pt_regs *regs, int text_fault, int write, if (pagefault_disabled() || !mm) goto no_context; + if (!from_user && address >= PAGE_OFFSET) + goto no_context; + perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS, 1, regs, address); retry: - mmap_read_lock(mm); - - if (!from_user && address >= PAGE_OFFSET) - goto bad_area; - - vma = find_vma(mm, address); + vma = lock_mm_and_find_vma(mm, address, regs); if (!vma) - goto bad_area; - if (vma->vm_start <= address) - goto good_area; - if (!(vma->vm_flags & VM_GROWSDOWN)) - goto bad_area; - if (expand_stack(vma, address)) - goto bad_area; + goto bad_area_nosemaphore; /* * Ok, we have a good vm_area for this memory access, so * we can handle it.. */ -good_area: code = SEGV_ACCERR; if (write) { if (!(vma->vm_flags & VM_WRITE)) @@ -318,17 +309,9 @@ static void force_user_fault(unsigned long address, int write) code = SEGV_MAPERR; - mmap_read_lock(mm); - vma = find_vma(mm, address); + vma = lock_mm_and_find_vma(mm, address, regs); if (!vma) - goto bad_area; - if (vma->vm_start <= address) - goto good_area; - if (!(vma->vm_flags & VM_GROWSDOWN)) - goto bad_area; - if (expand_stack(vma, address)) - goto bad_area; -good_area: + goto bad_area_nosemaphore; code = SEGV_ACCERR; if (write) { if (!(vma->vm_flags & VM_WRITE)) @@ -347,6 +330,7 @@ good_area: return; bad_area: mmap_read_unlock(mm); +bad_area_nosemaphore: __do_fault_siginfo(code, SIGSEGV, tsk->thread.kregs, address); return; diff --git a/arch/xtensa/Kconfig b/arch/xtensa/Kconfig index bcb0c5d2abc2..6d3c9257aa13 100644 --- a/arch/xtensa/Kconfig +++ b/arch/xtensa/Kconfig @@ -49,6 +49,7 @@ config XTENSA select HAVE_SYSCALL_TRACEPOINTS select HAVE_VIRT_CPU_ACCOUNTING_GEN select IRQ_DOMAIN + select LOCK_MM_AND_FIND_VMA select MODULES_USE_ELF_RELA select PERF_USE_VMALLOC select TRACE_IRQFLAGS_SUPPORT diff --git a/arch/xtensa/mm/fault.c b/arch/xtensa/mm/fault.c index 8c781b05c0bd..d89b193c779f 100644 --- a/arch/xtensa/mm/fault.c +++ b/arch/xtensa/mm/fault.c @@ -130,23 +130,14 @@ void do_page_fault(struct pt_regs *regs) perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS, 1, regs, address); retry: - mmap_read_lock(mm); - vma = find_vma(mm, address); - + vma = lock_mm_and_find_vma(mm, address, regs); if (!vma) - goto bad_area; - if (vma->vm_start <= address) - goto good_area; - if (!(vma->vm_flags & VM_GROWSDOWN)) - goto bad_area; - if (expand_stack(vma, address)) - goto bad_area; + goto bad_area_nosemaphore; /* Ok, we have a good vm_area for this memory access, so * we can handle it.. */ -good_area: code = SEGV_ACCERR; if (is_write) { @@ -205,6 +196,7 @@ good_area: */ bad_area: mmap_read_unlock(mm); +bad_area_nosemaphore: if (user_mode(regs)) { current->thread.bad_vaddr = address; current->thread.error_code = is_write; From 4087cac574fe843a1ad527fddb8a29ac854d669c Mon Sep 17 00:00:00 2001 From: Linus Torvalds Date: Sat, 24 Jun 2023 11:17:05 -0700 Subject: [PATCH 59/98] UPSTREAM: powerpc/mm: convert coprocessor fault to lock_mm_and_find_vma() commit 2cd76c50d0b41cec5c87abfcdf25b236a2793fb6 upstream. This is one of the simple cases, except there's no pt_regs pointer. Which is fine, as lock_mm_and_find_vma() is set up to work fine with a NULL pt_regs. Powerpc already enabled LOCK_MM_AND_FIND_VMA for the main CPU faulting, so we can just use the helper without any extra work. Signed-off-by: Linus Torvalds Signed-off-by: Samuel Mendoza-Jonas Signed-off-by: David Woodhouse Signed-off-by: Greg Kroah-Hartman Change-Id: I5736f498b2f45625e46554520d3aeb679e680907 (cherry picked from commit 2cd76c50d0b41cec5c87abfcdf25b236a2793fb6) Signed-off-by: Suren Baghdasaryan Signed-off-by: Greg Kroah-Hartman --- arch/powerpc/mm/copro_fault.c | 14 +++----------- 1 file changed, 3 insertions(+), 11 deletions(-) diff --git a/arch/powerpc/mm/copro_fault.c b/arch/powerpc/mm/copro_fault.c index 7c507fb48182..f49fd873df8d 100644 --- a/arch/powerpc/mm/copro_fault.c +++ b/arch/powerpc/mm/copro_fault.c @@ -33,19 +33,11 @@ int copro_handle_mm_fault(struct mm_struct *mm, unsigned long ea, if (mm->pgd == NULL) return -EFAULT; - mmap_read_lock(mm); - ret = -EFAULT; - vma = find_vma(mm, ea); + vma = lock_mm_and_find_vma(mm, ea, NULL); if (!vma) - goto out_unlock; - - if (ea < vma->vm_start) { - if (!(vma->vm_flags & VM_GROWSDOWN)) - goto out_unlock; - if (expand_stack(vma, ea)) - goto out_unlock; - } + return -EFAULT; + ret = -EFAULT; is_write = dsisr & DSISR_ISSTORE; if (is_write) { if (!(vma->vm_flags & VM_WRITE)) From 1afccd42559716b6872319d97fb86343c89fb107 Mon Sep 17 00:00:00 2001 From: "Liam R. Howlett" Date: Fri, 16 Jun 2023 15:58:54 -0700 Subject: [PATCH 60/98] UPSTREAM: mm: make find_extend_vma() fail if write lock not held commit f440fa1ac955e2898893f9301568435eb5cdfc4b upstream. Make calls to extend_vma() and find_extend_vma() fail if the write lock is required. To avoid making this a flag-day event, this still allows the old read-locking case for the trivial situations, and passes in a flag to say "is it write-locked". That way write-lockers can say "yes, I'm being careful", and legacy users will continue to work in all the common cases until they have been fully converted to the new world order. Co-Developed-by: Matthew Wilcox (Oracle) Signed-off-by: Matthew Wilcox (Oracle) Signed-off-by: Liam R. Howlett Signed-off-by: Linus Torvalds Signed-off-by: Samuel Mendoza-Jonas Signed-off-by: David Woodhouse Signed-off-by: Greg Kroah-Hartman Change-Id: If12d2d68429b6d71393f02d5ed7e6939c3cd5405 (cherry picked from commit f440fa1ac955e2898893f9301568435eb5cdfc4b) Signed-off-by: Suren Baghdasaryan Signed-off-by: Greg Kroah-Hartman --- fs/binfmt_elf.c | 6 +++--- fs/exec.c | 5 +++-- include/linux/mm.h | 10 +++++++--- mm/memory.c | 2 +- mm/mmap.c | 50 ++++++++++++++++++++++++++++++---------------- mm/nommu.c | 3 ++- 6 files changed, 49 insertions(+), 27 deletions(-) diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c index 444302afc673..5688c3e6adc1 100644 --- a/fs/binfmt_elf.c +++ b/fs/binfmt_elf.c @@ -315,10 +315,10 @@ create_elf_tables(struct linux_binprm *bprm, const struct elfhdr *exec, * Grow the stack manually; some architectures have a limit on how * far ahead a user-space access may be in order to grow the stack. */ - if (mmap_read_lock_killable(mm)) + if (mmap_write_lock_killable(mm)) return -EINTR; - vma = find_extend_vma(mm, bprm->p); - mmap_read_unlock(mm); + vma = find_extend_vma_locked(mm, bprm->p, true); + mmap_write_unlock(mm); if (!vma) return -EFAULT; diff --git a/fs/exec.c b/fs/exec.c index 2d6bca1cda6e..c495f0f636e1 100644 --- a/fs/exec.c +++ b/fs/exec.c @@ -203,7 +203,8 @@ static struct page *get_arg_page(struct linux_binprm *bprm, unsigned long pos, #ifdef CONFIG_STACK_GROWSUP if (write) { - ret = expand_downwards(bprm->vma, pos); + /* We claim to hold the lock - nobody to race with */ + ret = expand_downwards(bprm->vma, pos, true); if (ret < 0) return NULL; } @@ -854,7 +855,7 @@ int setup_arg_pages(struct linux_binprm *bprm, stack_base = vma->vm_start - stack_expand; #endif current->mm->start_stack = bprm->p; - ret = expand_stack(vma, stack_base); + ret = expand_stack_locked(vma, stack_base, true); if (ret) ret = -EFAULT; diff --git a/include/linux/mm.h b/include/linux/mm.h index fa3de0b51a29..0d1c8a97cffa 100644 --- a/include/linux/mm.h +++ b/include/linux/mm.h @@ -2995,11 +2995,13 @@ extern vm_fault_t filemap_page_mkwrite(struct vm_fault *vmf); extern unsigned long stack_guard_gap; /* Generic expand stack which grows the stack according to GROWS{UP,DOWN} */ -extern int expand_stack(struct vm_area_struct *vma, unsigned long address); +int expand_stack_locked(struct vm_area_struct *vma, unsigned long address, + bool write_locked); +#define expand_stack(vma,addr) expand_stack_locked(vma,addr,false) /* CONFIG_STACK_GROWSUP still needs to grow downwards at some places */ -extern int expand_downwards(struct vm_area_struct *vma, - unsigned long address); +int expand_downwards(struct vm_area_struct *vma, unsigned long address, + bool write_locked); #if VM_GROWSUP extern int expand_upwards(struct vm_area_struct *vma, unsigned long address); #else @@ -3100,6 +3102,8 @@ unsigned long change_prot_numa(struct vm_area_struct *vma, #endif struct vm_area_struct *find_extend_vma(struct mm_struct *, unsigned long addr); +struct vm_area_struct *find_extend_vma_locked(struct mm_struct *, + unsigned long addr, bool write_locked); int remap_pfn_range(struct vm_area_struct *, unsigned long addr, unsigned long pfn, unsigned long size, pgprot_t); int remap_pfn_range_notrack(struct vm_area_struct *vma, unsigned long addr, diff --git a/mm/memory.c b/mm/memory.c index cd3cfc7753a9..038f6bf49429 100644 --- a/mm/memory.c +++ b/mm/memory.c @@ -5393,7 +5393,7 @@ struct vm_area_struct *lock_mm_and_find_vma(struct mm_struct *mm, goto fail; } - if (expand_stack(vma, addr)) + if (expand_stack_locked(vma, addr, true)) goto fail; success: diff --git a/mm/mmap.c b/mm/mmap.c index 4eaf4762978c..e0de931f1d2c 100644 --- a/mm/mmap.c +++ b/mm/mmap.c @@ -1988,7 +1988,8 @@ static int acct_stack_growth(struct vm_area_struct *vma, * PA-RISC uses this for its stack; IA64 for its Register Backing Store. * vma is the last one with address > vma->vm_end. Have to extend vma. */ -int expand_upwards(struct vm_area_struct *vma, unsigned long address) +int expand_upwards(struct vm_area_struct *vma, unsigned long address, + bool write_locked) { struct mm_struct *mm = vma->vm_mm; struct vm_area_struct *next; @@ -2012,6 +2013,8 @@ int expand_upwards(struct vm_area_struct *vma, unsigned long address) if (gap_addr < address || gap_addr > TASK_SIZE) gap_addr = TASK_SIZE; + if (!write_locked) + return -EAGAIN; next = find_vma_intersection(mm, vma->vm_end, gap_addr); if (next && vma_is_accessible(next)) { if (!(next->vm_flags & VM_GROWSUP)) @@ -2081,7 +2084,8 @@ int expand_upwards(struct vm_area_struct *vma, unsigned long address) /* * vma is the first one with address < vma->vm_start. Have to extend vma. */ -int expand_downwards(struct vm_area_struct *vma, unsigned long address) +int expand_downwards(struct vm_area_struct *vma, unsigned long address, + bool write_locked) { struct mm_struct *mm = vma->vm_mm; MA_STATE(mas, &mm->mm_mt, vma->vm_start, vma->vm_start); @@ -2095,10 +2099,13 @@ int expand_downwards(struct vm_area_struct *vma, unsigned long address) /* Enforce stack_guard_gap */ prev = mas_prev(&mas, 0); /* Check that both stack segments have the same anon_vma? */ - if (prev && !(prev->vm_flags & VM_GROWSDOWN) && - vma_is_accessible(prev)) { - if (address - prev->vm_end < stack_guard_gap) + if (prev) { + if (!(prev->vm_flags & VM_GROWSDOWN) && + vma_is_accessible(prev) && + (address - prev->vm_end < stack_guard_gap)) return -ENOMEM; + if (!write_locked && (prev->vm_end == address)) + return -EAGAIN; } mas_set_range(&mas, address, vma->vm_end - 1); @@ -2177,13 +2184,14 @@ static int __init cmdline_parse_stack_guard_gap(char *p) __setup("stack_guard_gap=", cmdline_parse_stack_guard_gap); #ifdef CONFIG_STACK_GROWSUP -int expand_stack(struct vm_area_struct *vma, unsigned long address) +int expand_stack_locked(struct vm_area_struct *vma, unsigned long address, + bool write_locked) { - return expand_upwards(vma, address); + return expand_upwards(vma, address, write_locked); } -struct vm_area_struct * -find_extend_vma(struct mm_struct *mm, unsigned long addr) +struct vm_area_struct *find_extend_vma_locked(struct mm_struct *mm, + unsigned long addr, bool write_locked) { struct vm_area_struct *vma, *prev; @@ -2191,20 +2199,25 @@ find_extend_vma(struct mm_struct *mm, unsigned long addr) vma = find_vma_prev(mm, addr, &prev); if (vma && (vma->vm_start <= addr)) return vma; - if (!prev || expand_stack(prev, addr)) + if (!prev) + return NULL; + if (expand_stack_locked(prev, addr, write_locked)) return NULL; if (prev->vm_flags & VM_LOCKED) populate_vma_page_range(prev, addr, prev->vm_end, NULL); return prev; } #else -int expand_stack(struct vm_area_struct *vma, unsigned long address) +int expand_stack_locked(struct vm_area_struct *vma, unsigned long address, + bool write_locked) { - return expand_downwards(vma, address); + if (unlikely(!(vma->vm_flags & VM_GROWSDOWN))) + return -EINVAL; + return expand_downwards(vma, address, write_locked); } -struct vm_area_struct * -find_extend_vma(struct mm_struct *mm, unsigned long addr) +struct vm_area_struct *find_extend_vma_locked(struct mm_struct *mm, + unsigned long addr, bool write_locked) { struct vm_area_struct *vma; unsigned long start; @@ -2215,10 +2228,8 @@ find_extend_vma(struct mm_struct *mm, unsigned long addr) return NULL; if (vma->vm_start <= addr) return vma; - if (!(vma->vm_flags & VM_GROWSDOWN)) - return NULL; start = vma->vm_start; - if (expand_stack(vma, addr)) + if (expand_stack_locked(vma, addr, write_locked)) return NULL; if (vma->vm_flags & VM_LOCKED) populate_vma_page_range(vma, addr, start, NULL); @@ -2226,6 +2237,11 @@ find_extend_vma(struct mm_struct *mm, unsigned long addr) } #endif +struct vm_area_struct *find_extend_vma(struct mm_struct *mm, + unsigned long addr) +{ + return find_extend_vma_locked(mm, addr, false); +} EXPORT_SYMBOL_GPL(find_extend_vma); /* diff --git a/mm/nommu.c b/mm/nommu.c index 14ffd4c668fe..f92438102b1d 100644 --- a/mm/nommu.c +++ b/mm/nommu.c @@ -694,7 +694,8 @@ struct vm_area_struct *find_extend_vma(struct mm_struct *mm, unsigned long addr) * expand a stack to a given address * - not supported under NOMMU conditions */ -int expand_stack(struct vm_area_struct *vma, unsigned long address) +int expand_stack_locked(struct vm_area_struct *vma, unsigned long address, + bool write_locked) { return -ENOMEM; } From c8ad906849609399c347b2f35130315ef025d945 Mon Sep 17 00:00:00 2001 From: jianzhou Date: Mon, 24 Jul 2023 08:16:59 -0700 Subject: [PATCH 61/98] ANDROID: abi_gki_aarch64_qcom: ufshcd_mcq_poll_cqe_lock Symbols added: ufshcd_mcq_poll_cqe_lock Bug: 292490611 Change-Id: I0e26f360c56d302f9f980c9d43b7a3cc80d3a616 Signed-off-by: jianzhou --- android/abi_gki_aarch64_qcom | 1 + 1 file changed, 1 insertion(+) diff --git a/android/abi_gki_aarch64_qcom b/android/abi_gki_aarch64_qcom index b2ac2bce8d43..fcebe5582b85 100644 --- a/android/abi_gki_aarch64_qcom +++ b/android/abi_gki_aarch64_qcom @@ -3648,6 +3648,7 @@ ufshcd_hold ufshcd_mcq_config_esi ufshcd_mcq_enable_esi + ufshcd_mcq_poll_cqe_lock ufshcd_mcq_poll_cqe_nolock ufshcd_mcq_write_cqis ufshcd_pltfrm_init From 74efdc0966f53275bfb22ccda2e526c164b92790 Mon Sep 17 00:00:00 2001 From: Linus Torvalds Date: Mon, 19 Jun 2023 11:34:15 -0700 Subject: [PATCH 62/98] BACKPORT: execve: expand new process stack manually ahead of time commit f313c51d26aa87e69633c9b46efb37a930faca71 upstream. This is a small step towards a model where GUP itself would not expand the stack, and any user that needs GUP to not look up existing mappings, but actually expand on them, would have to do so manually before-hand, and with the mm lock held for writing. It turns out that execve() already did almost exactly that, except it didn't take the mm lock at all (it's single-threaded so no locking technically needed, but it could cause lockdep errors). And it only did it for the CONFIG_STACK_GROWSUP case, since in that case GUP has obviously never expanded the stack downwards. So just make that CONFIG_STACK_GROWSUP case do the right thing with locking, and enable it generally. This will eventually help GUP, and in the meantime avoids a special case and the lockdep issue. Signed-off-by: Linus Torvalds [6.1 Minor context from still having FOLL_FORCE flags set] Signed-off-by: Samuel Mendoza-Jonas Signed-off-by: David Woodhouse Signed-off-by: Greg Kroah-Hartman Change-Id: I24c652740dcfc674b0aef8e09ef72f09ad61254c (cherry picked from commit f313c51d26aa87e69633c9b46efb37a930faca71) Signed-off-by: Suren Baghdasaryan Signed-off-by: Greg Kroah-Hartman --- fs/exec.c | 37 +++++++++++++++++++++---------------- 1 file changed, 21 insertions(+), 16 deletions(-) diff --git a/fs/exec.c b/fs/exec.c index c495f0f636e1..763b03c89614 100644 --- a/fs/exec.c +++ b/fs/exec.c @@ -198,34 +198,39 @@ static struct page *get_arg_page(struct linux_binprm *bprm, unsigned long pos, int write) { struct page *page; + struct vm_area_struct *vma = bprm->vma; + struct mm_struct *mm = bprm->mm; int ret; - unsigned int gup_flags = FOLL_FORCE; -#ifdef CONFIG_STACK_GROWSUP - if (write) { - /* We claim to hold the lock - nobody to race with */ - ret = expand_downwards(bprm->vma, pos, true); - if (ret < 0) + /* + * Avoid relying on expanding the stack down in GUP (which + * does not work for STACK_GROWSUP anyway), and just do it + * by hand ahead of time. + */ + if (write && pos < vma->vm_start) { + mmap_write_lock(mm); + ret = expand_downwards(vma, pos, true); + if (unlikely(ret < 0)) { + mmap_write_unlock(mm); return NULL; - } -#endif - - if (write) - gup_flags |= FOLL_WRITE; + } + mmap_write_downgrade(mm); + } else + mmap_read_lock(mm); /* * We are doing an exec(). 'current' is the process - * doing the exec and bprm->mm is the new process's mm. + * doing the exec and 'mm' is the new process's mm. */ - mmap_read_lock(bprm->mm); - ret = get_user_pages_remote(bprm->mm, pos, 1, gup_flags, + ret = get_user_pages_remote(mm, pos, 1, + write ? FOLL_WRITE : 0, &page, NULL, NULL); - mmap_read_unlock(bprm->mm); + mmap_read_unlock(mm); if (ret <= 0) return NULL; if (write) - acct_arg_size(bprm, vma_pages(bprm->vma)); + acct_arg_size(bprm, vma_pages(vma)); return page; } From 188ce9572f119dd669d7408d154ffa6ad3029ad2 Mon Sep 17 00:00:00 2001 From: Linus Torvalds Date: Sat, 24 Jun 2023 13:45:51 -0700 Subject: [PATCH 63/98] BACKPORT: mm: always expand the stack with the mmap write lock held commit 8d7071af890768438c14db6172cc8f9f4d04e184 upstream This finishes the job of always holding the mmap write lock when extending the user stack vma, and removes the 'write_locked' argument from the vm helper functions again. For some cases, we just avoid expanding the stack at all: drivers and page pinning really shouldn't be extending any stacks. Let's see if any strange users really wanted that. It's worth noting that architectures that weren't converted to the new lock_mm_and_find_vma() helper function are left using the legacy "expand_stack()" function, but it has been changed to drop the mmap_lock and take it for writing while expanding the vma. This makes it fairly straightforward to convert the remaining architectures. As a result of dropping and re-taking the lock, the calling conventions for this function have also changed, since the old vma may no longer be valid. So it will now return the new vma if successful, and NULL - and the lock dropped - if the area could not be extended. Signed-off-by: Linus Torvalds [6.1: Patch drivers/iommu/io-pgfault.c instead] Signed-off-by: Samuel Mendoza-Jonas Signed-off-by: David Woodhouse Signed-off-by: Greg Kroah-Hartman [surenb: change in io-pgfault.c was done in iommu-sva.c] Change-Id: Icdcdded08d7ad4eda8fae1120a3c8b3d957516c1 (cherry picked from commit 8d7071af890768438c14db6172cc8f9f4d04e184) Signed-off-by: Suren Baghdasaryan Signed-off-by: Greg Kroah-Hartman --- arch/ia64/mm/fault.c | 36 ++--------- arch/m68k/mm/fault.c | 9 ++- arch/microblaze/mm/fault.c | 5 +- arch/openrisc/mm/fault.c | 5 +- arch/parisc/mm/fault.c | 23 ++++--- arch/s390/mm/fault.c | 5 +- arch/sparc/mm/fault_64.c | 8 ++- arch/um/kernel/trap.c | 11 ++-- drivers/iommu/amd/iommu_v2.c | 4 +- drivers/iommu/iommu-sva.c | 2 +- fs/binfmt_elf.c | 2 +- fs/exec.c | 4 +- include/linux/mm.h | 16 ++--- mm/gup.c | 6 +- mm/memory.c | 10 ++- mm/mmap.c | 121 ++++++++++++++++++++++++++++------- mm/nommu.c | 18 ++---- 17 files changed, 169 insertions(+), 116 deletions(-) diff --git a/arch/ia64/mm/fault.c b/arch/ia64/mm/fault.c index ef78c2d66cdd..99a09abe1d2c 100644 --- a/arch/ia64/mm/fault.c +++ b/arch/ia64/mm/fault.c @@ -110,10 +110,12 @@ retry: * register backing store that needs to expand upwards, in * this case vma will be null, but prev_vma will ne non-null */ - if (( !vma && prev_vma ) || (address < vma->vm_start) ) - goto check_expansion; + if (( !vma && prev_vma ) || (address < vma->vm_start) ) { + vma = expand_stack(mm, address); + if (!vma) + goto bad_area_nosemaphore; + } - good_area: code = SEGV_ACCERR; /* OK, we've got a good vm_area for this memory area. Check the access permissions: */ @@ -174,35 +176,9 @@ retry: mmap_read_unlock(mm); return; - check_expansion: - if (!(prev_vma && (prev_vma->vm_flags & VM_GROWSUP) && (address == prev_vma->vm_end))) { - if (!vma) - goto bad_area; - if (!(vma->vm_flags & VM_GROWSDOWN)) - goto bad_area; - if (REGION_NUMBER(address) != REGION_NUMBER(vma->vm_start) - || REGION_OFFSET(address) >= RGN_MAP_LIMIT) - goto bad_area; - if (expand_stack(vma, address)) - goto bad_area; - } else { - vma = prev_vma; - if (REGION_NUMBER(address) != REGION_NUMBER(vma->vm_start) - || REGION_OFFSET(address) >= RGN_MAP_LIMIT) - goto bad_area; - /* - * Since the register backing store is accessed sequentially, - * we disallow growing it by more than a page at a time. - */ - if (address > vma->vm_end + PAGE_SIZE - sizeof(long)) - goto bad_area; - if (expand_upwards(vma, address)) - goto bad_area; - } - goto good_area; - bad_area: mmap_read_unlock(mm); + bad_area_nosemaphore: if ((isr & IA64_ISR_SP) || ((isr & IA64_ISR_NA) && (isr & IA64_ISR_CODE_MASK) == IA64_ISR_CODE_LFETCH)) { diff --git a/arch/m68k/mm/fault.c b/arch/m68k/mm/fault.c index 4d2837eb3e2a..6f62af8e293a 100644 --- a/arch/m68k/mm/fault.c +++ b/arch/m68k/mm/fault.c @@ -105,8 +105,9 @@ retry: if (address + 256 < rdusp()) goto map_err; } - if (expand_stack(vma, address)) - goto map_err; + vma = expand_stack(mm, address); + if (!vma) + goto map_err_nosemaphore; /* * Ok, we have a good vm_area for this memory access, so @@ -193,10 +194,12 @@ bus_err: goto send_sig; map_err: + mmap_read_unlock(mm); +map_err_nosemaphore: current->thread.signo = SIGSEGV; current->thread.code = SEGV_MAPERR; current->thread.faddr = address; - goto send_sig; + return send_fault_sig(regs); acc_err: current->thread.signo = SIGSEGV; diff --git a/arch/microblaze/mm/fault.c b/arch/microblaze/mm/fault.c index 5c40c3ebe52f..a409bb3f09f7 100644 --- a/arch/microblaze/mm/fault.c +++ b/arch/microblaze/mm/fault.c @@ -192,8 +192,9 @@ retry: && (kernel_mode(regs) || !store_updates_sp(regs))) goto bad_area; } - if (expand_stack(vma, address)) - goto bad_area; + vma = expand_stack(mm, address); + if (!vma) + goto bad_area_nosemaphore; good_area: code = SEGV_ACCERR; diff --git a/arch/openrisc/mm/fault.c b/arch/openrisc/mm/fault.c index b4762d66e9ef..e3ad46d02fbd 100644 --- a/arch/openrisc/mm/fault.c +++ b/arch/openrisc/mm/fault.c @@ -127,8 +127,9 @@ retry: if (address + PAGE_SIZE < regs->sp) goto bad_area; } - if (expand_stack(vma, address)) - goto bad_area; + vma = expand_stack(mm, address); + if (!vma) + goto bad_area_nosemaphore; /* * Ok, we have a good vm_area for this memory access, so diff --git a/arch/parisc/mm/fault.c b/arch/parisc/mm/fault.c index 869204e97ec9..1843b493910c 100644 --- a/arch/parisc/mm/fault.c +++ b/arch/parisc/mm/fault.c @@ -288,15 +288,19 @@ void do_page_fault(struct pt_regs *regs, unsigned long code, retry: mmap_read_lock(mm); vma = find_vma_prev(mm, address, &prev_vma); - if (!vma || address < vma->vm_start) - goto check_expansion; + if (!vma || address < vma->vm_start) { + if (!prev || !(prev->vm_flags & VM_GROWSUP)) + goto bad_area; + vma = expand_stack(mm, address); + if (!vma) + goto bad_area_nosemaphore; + } + /* * Ok, we have a good vm_area for this memory access. We still need to * check the access permissions. */ -good_area: - if ((vma->vm_flags & acc_type) != acc_type) goto bad_area; @@ -342,17 +346,13 @@ good_area: mmap_read_unlock(mm); return; -check_expansion: - vma = prev_vma; - if (vma && (expand_stack(vma, address) == 0)) - goto good_area; - /* * Something tried to access memory that isn't in our memory map.. */ bad_area: mmap_read_unlock(mm); +bad_area_nosemaphore: if (user_mode(regs)) { int signo, si_code; @@ -444,7 +444,7 @@ handle_nadtlb_fault(struct pt_regs *regs) { unsigned long insn = regs->iir; int breg, treg, xreg, val = 0; - struct vm_area_struct *vma, *prev_vma; + struct vm_area_struct *vma; struct task_struct *tsk; struct mm_struct *mm; unsigned long address; @@ -480,7 +480,7 @@ handle_nadtlb_fault(struct pt_regs *regs) /* Search for VMA */ address = regs->ior; mmap_read_lock(mm); - vma = find_vma_prev(mm, address, &prev_vma); + vma = vma_lookup(mm, address); mmap_read_unlock(mm); /* @@ -489,7 +489,6 @@ handle_nadtlb_fault(struct pt_regs *regs) */ acc_type = (insn & 0x40) ? VM_WRITE : VM_READ; if (vma - && address >= vma->vm_start && (vma->vm_flags & acc_type) == acc_type) val = 1; } diff --git a/arch/s390/mm/fault.c b/arch/s390/mm/fault.c index 16223095045e..98a0091bb097 100644 --- a/arch/s390/mm/fault.c +++ b/arch/s390/mm/fault.c @@ -453,8 +453,9 @@ retry: if (unlikely(vma->vm_start > address)) { if (!(vma->vm_flags & VM_GROWSDOWN)) goto out_up; - if (expand_stack(vma, address)) - goto out_up; + vma = expand_stack(mm, address); + if (!vma) + goto out; } /* diff --git a/arch/sparc/mm/fault_64.c b/arch/sparc/mm/fault_64.c index 4acc12eafbf5..df685a241855 100644 --- a/arch/sparc/mm/fault_64.c +++ b/arch/sparc/mm/fault_64.c @@ -383,8 +383,9 @@ continue_fault: goto bad_area; } } - if (expand_stack(vma, address)) - goto bad_area; + vma = expand_stack(mm, address); + if (!vma) + goto bad_area_nosemaphore; /* * Ok, we have a good vm_area for this memory access, so * we can handle it.. @@ -482,8 +483,9 @@ exit_exception: * Fix it, but check if it's kernel or user first.. */ bad_area: - insn = get_fault_insn(regs, insn); mmap_read_unlock(mm); +bad_area_nosemaphore: + insn = get_fault_insn(regs, insn); handle_kernel_fault: do_kernel_fault(regs, si_code, fault_code, insn, address); diff --git a/arch/um/kernel/trap.c b/arch/um/kernel/trap.c index d3ce21c4ca32..6d8ae86ae978 100644 --- a/arch/um/kernel/trap.c +++ b/arch/um/kernel/trap.c @@ -47,14 +47,15 @@ retry: vma = find_vma(mm, address); if (!vma) goto out; - else if (vma->vm_start <= address) + if (vma->vm_start <= address) goto good_area; - else if (!(vma->vm_flags & VM_GROWSDOWN)) + if (!(vma->vm_flags & VM_GROWSDOWN)) goto out; - else if (is_user && !ARCH_IS_STACKGROW(address)) - goto out; - else if (expand_stack(vma, address)) + if (is_user && !ARCH_IS_STACKGROW(address)) goto out; + vma = expand_stack(mm, address); + if (!vma) + goto out_nosemaphore; good_area: *code_out = SEGV_ACCERR; diff --git a/drivers/iommu/amd/iommu_v2.c b/drivers/iommu/amd/iommu_v2.c index 9f7fab49a5a9..75355ddca657 100644 --- a/drivers/iommu/amd/iommu_v2.c +++ b/drivers/iommu/amd/iommu_v2.c @@ -485,8 +485,8 @@ static void do_fault(struct work_struct *work) flags |= FAULT_FLAG_REMOTE; mmap_read_lock(mm); - vma = find_extend_vma(mm, address); - if (!vma || address < vma->vm_start) + vma = vma_lookup(mm, address); + if (!vma) /* failed to get a vma in the right range */ goto out; diff --git a/drivers/iommu/iommu-sva.c b/drivers/iommu/iommu-sva.c index 24bf9b2b58aa..ed5f11eb92e5 100644 --- a/drivers/iommu/iommu-sva.c +++ b/drivers/iommu/iommu-sva.c @@ -203,7 +203,7 @@ iommu_sva_handle_iopf(struct iommu_fault *fault, void *data) mmap_read_lock(mm); - vma = find_extend_vma(mm, prm->addr); + vma = vma_lookup(mm, prm->addr); if (!vma) /* Unmapped area */ goto out_put_mm; diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c index 5688c3e6adc1..e6c9c0e08448 100644 --- a/fs/binfmt_elf.c +++ b/fs/binfmt_elf.c @@ -317,7 +317,7 @@ create_elf_tables(struct linux_binprm *bprm, const struct elfhdr *exec, */ if (mmap_write_lock_killable(mm)) return -EINTR; - vma = find_extend_vma_locked(mm, bprm->p, true); + vma = find_extend_vma_locked(mm, bprm->p); mmap_write_unlock(mm); if (!vma) return -EFAULT; diff --git a/fs/exec.c b/fs/exec.c index 763b03c89614..ef93a4d5911b 100644 --- a/fs/exec.c +++ b/fs/exec.c @@ -209,7 +209,7 @@ static struct page *get_arg_page(struct linux_binprm *bprm, unsigned long pos, */ if (write && pos < vma->vm_start) { mmap_write_lock(mm); - ret = expand_downwards(vma, pos, true); + ret = expand_downwards(vma, pos); if (unlikely(ret < 0)) { mmap_write_unlock(mm); return NULL; @@ -860,7 +860,7 @@ int setup_arg_pages(struct linux_binprm *bprm, stack_base = vma->vm_start - stack_expand; #endif current->mm->start_stack = bprm->p; - ret = expand_stack_locked(vma, stack_base, true); + ret = expand_stack_locked(vma, stack_base); if (ret) ret = -EFAULT; diff --git a/include/linux/mm.h b/include/linux/mm.h index 0d1c8a97cffa..a9a1b9f9f97c 100644 --- a/include/linux/mm.h +++ b/include/linux/mm.h @@ -2995,18 +2995,11 @@ extern vm_fault_t filemap_page_mkwrite(struct vm_fault *vmf); extern unsigned long stack_guard_gap; /* Generic expand stack which grows the stack according to GROWS{UP,DOWN} */ -int expand_stack_locked(struct vm_area_struct *vma, unsigned long address, - bool write_locked); -#define expand_stack(vma,addr) expand_stack_locked(vma,addr,false) +int expand_stack_locked(struct vm_area_struct *vma, unsigned long address); +struct vm_area_struct *expand_stack(struct mm_struct * mm, unsigned long addr); /* CONFIG_STACK_GROWSUP still needs to grow downwards at some places */ -int expand_downwards(struct vm_area_struct *vma, unsigned long address, - bool write_locked); -#if VM_GROWSUP -extern int expand_upwards(struct vm_area_struct *vma, unsigned long address); -#else - #define expand_upwards(vma, address) (0) -#endif +int expand_downwards(struct vm_area_struct *vma, unsigned long address); /* Look up the first VMA which satisfies addr < vm_end, NULL if none. */ extern struct vm_area_struct * find_vma(struct mm_struct * mm, unsigned long addr); @@ -3101,9 +3094,8 @@ unsigned long change_prot_numa(struct vm_area_struct *vma, unsigned long start, unsigned long end); #endif -struct vm_area_struct *find_extend_vma(struct mm_struct *, unsigned long addr); struct vm_area_struct *find_extend_vma_locked(struct mm_struct *, - unsigned long addr, bool write_locked); + unsigned long addr); int remap_pfn_range(struct vm_area_struct *, unsigned long addr, unsigned long pfn, unsigned long size, pgprot_t); int remap_pfn_range_notrack(struct vm_area_struct *vma, unsigned long addr, diff --git a/mm/gup.c b/mm/gup.c index 028f3b4e8c3f..f4911ddd3070 100644 --- a/mm/gup.c +++ b/mm/gup.c @@ -1182,7 +1182,7 @@ static long __get_user_pages(struct mm_struct *mm, /* first iteration or cross vma bound */ if (!vma || start >= vma->vm_end) { - vma = find_extend_vma(mm, start); + vma = vma_lookup(mm, start); if (!vma && in_gate_area(mm, start)) { ret = get_gate_page(mm, start & PAGE_MASK, gup_flags, &vma, @@ -1351,8 +1351,8 @@ int fixup_user_fault(struct mm_struct *mm, fault_flags |= FAULT_FLAG_ALLOW_RETRY | FAULT_FLAG_KILLABLE; retry: - vma = find_extend_vma(mm, address); - if (!vma || address < vma->vm_start) + vma = vma_lookup(mm, address); + if (!vma) return -EFAULT; if (!vma_permits_fault(vma, fault_flags)) diff --git a/mm/memory.c b/mm/memory.c index 038f6bf49429..8f225f33a85c 100644 --- a/mm/memory.c +++ b/mm/memory.c @@ -5393,7 +5393,7 @@ struct vm_area_struct *lock_mm_and_find_vma(struct mm_struct *mm, goto fail; } - if (expand_stack_locked(vma, addr, true)) + if (expand_stack_locked(vma, addr)) goto fail; success: @@ -5738,6 +5738,14 @@ int __access_remote_vm(struct mm_struct *mm, unsigned long addr, void *buf, if (mmap_read_lock_killable(mm)) return 0; + /* We might need to expand the stack to access it */ + vma = vma_lookup(mm, addr); + if (!vma) { + vma = expand_stack(mm, addr); + if (!vma) + return 0; + } + /* ignore errors, just check how much was successfully transferred */ while (len) { int bytes, ret, offset; diff --git a/mm/mmap.c b/mm/mmap.c index e0de931f1d2c..75703bcea8a7 100644 --- a/mm/mmap.c +++ b/mm/mmap.c @@ -1988,8 +1988,7 @@ static int acct_stack_growth(struct vm_area_struct *vma, * PA-RISC uses this for its stack; IA64 for its Register Backing Store. * vma is the last one with address > vma->vm_end. Have to extend vma. */ -int expand_upwards(struct vm_area_struct *vma, unsigned long address, - bool write_locked) +static int expand_upwards(struct vm_area_struct *vma, unsigned long address) { struct mm_struct *mm = vma->vm_mm; struct vm_area_struct *next; @@ -2013,8 +2012,6 @@ int expand_upwards(struct vm_area_struct *vma, unsigned long address, if (gap_addr < address || gap_addr > TASK_SIZE) gap_addr = TASK_SIZE; - if (!write_locked) - return -EAGAIN; next = find_vma_intersection(mm, vma->vm_end, gap_addr); if (next && vma_is_accessible(next)) { if (!(next->vm_flags & VM_GROWSUP)) @@ -2083,15 +2080,18 @@ int expand_upwards(struct vm_area_struct *vma, unsigned long address, /* * vma is the first one with address < vma->vm_start. Have to extend vma. + * mmap_lock held for writing. */ -int expand_downwards(struct vm_area_struct *vma, unsigned long address, - bool write_locked) +int expand_downwards(struct vm_area_struct *vma, unsigned long address) { struct mm_struct *mm = vma->vm_mm; MA_STATE(mas, &mm->mm_mt, vma->vm_start, vma->vm_start); struct vm_area_struct *prev; int error = 0; + if (!(vma->vm_flags & VM_GROWSDOWN)) + return -EFAULT; + address &= PAGE_MASK; if (address < mmap_min_addr || address < FIRST_USER_ADDRESS) return -EPERM; @@ -2104,8 +2104,6 @@ int expand_downwards(struct vm_area_struct *vma, unsigned long address, vma_is_accessible(prev) && (address - prev->vm_end < stack_guard_gap)) return -ENOMEM; - if (!write_locked && (prev->vm_end == address)) - return -EAGAIN; } mas_set_range(&mas, address, vma->vm_end - 1); @@ -2184,14 +2182,12 @@ static int __init cmdline_parse_stack_guard_gap(char *p) __setup("stack_guard_gap=", cmdline_parse_stack_guard_gap); #ifdef CONFIG_STACK_GROWSUP -int expand_stack_locked(struct vm_area_struct *vma, unsigned long address, - bool write_locked) +int expand_stack_locked(struct vm_area_struct *vma, unsigned long address) { - return expand_upwards(vma, address, write_locked); + return expand_upwards(vma, address); } -struct vm_area_struct *find_extend_vma_locked(struct mm_struct *mm, - unsigned long addr, bool write_locked) +struct vm_area_struct *find_extend_vma_locked(struct mm_struct *mm, unsigned long addr) { struct vm_area_struct *vma, *prev; @@ -2201,23 +2197,21 @@ struct vm_area_struct *find_extend_vma_locked(struct mm_struct *mm, return vma; if (!prev) return NULL; - if (expand_stack_locked(prev, addr, write_locked)) + if (expand_stack_locked(prev, addr)) return NULL; if (prev->vm_flags & VM_LOCKED) populate_vma_page_range(prev, addr, prev->vm_end, NULL); return prev; } #else -int expand_stack_locked(struct vm_area_struct *vma, unsigned long address, - bool write_locked) +int expand_stack_locked(struct vm_area_struct *vma, unsigned long address) { if (unlikely(!(vma->vm_flags & VM_GROWSDOWN))) return -EINVAL; - return expand_downwards(vma, address, write_locked); + return expand_downwards(vma, address); } -struct vm_area_struct *find_extend_vma_locked(struct mm_struct *mm, - unsigned long addr, bool write_locked) +struct vm_area_struct *find_extend_vma_locked(struct mm_struct *mm, unsigned long addr) { struct vm_area_struct *vma; unsigned long start; @@ -2229,7 +2223,7 @@ struct vm_area_struct *find_extend_vma_locked(struct mm_struct *mm, if (vma->vm_start <= addr) return vma; start = vma->vm_start; - if (expand_stack_locked(vma, addr, write_locked)) + if (expand_stack_locked(vma, addr)) return NULL; if (vma->vm_flags & VM_LOCKED) populate_vma_page_range(vma, addr, start, NULL); @@ -2237,12 +2231,91 @@ struct vm_area_struct *find_extend_vma_locked(struct mm_struct *mm, } #endif -struct vm_area_struct *find_extend_vma(struct mm_struct *mm, - unsigned long addr) +/* + * IA64 has some horrid mapping rules: it can expand both up and down, + * but with various special rules. + * + * We'll get rid of this architecture eventually, so the ugliness is + * temporary. + */ +#ifdef CONFIG_IA64 +static inline bool vma_expand_ok(struct vm_area_struct *vma, unsigned long addr) { - return find_extend_vma_locked(mm, addr, false); + return REGION_NUMBER(addr) == REGION_NUMBER(vma->vm_start) && + REGION_OFFSET(addr) < RGN_MAP_LIMIT; +} + +/* + * IA64 stacks grow down, but there's a special register backing store + * that can grow up. Only sequentially, though, so the new address must + * match vm_end. + */ +static inline int vma_expand_up(struct vm_area_struct *vma, unsigned long addr) +{ + if (!vma_expand_ok(vma, addr)) + return -EFAULT; + if (vma->vm_end != (addr & PAGE_MASK)) + return -EFAULT; + return expand_upwards(vma, addr); +} + +static inline bool vma_expand_down(struct vm_area_struct *vma, unsigned long addr) +{ + if (!vma_expand_ok(vma, addr)) + return -EFAULT; + return expand_downwards(vma, addr); +} + +#elif defined(CONFIG_STACK_GROWSUP) + +#define vma_expand_up(vma,addr) expand_upwards(vma, addr) +#define vma_expand_down(vma, addr) (-EFAULT) + +#else + +#define vma_expand_up(vma,addr) (-EFAULT) +#define vma_expand_down(vma, addr) expand_downwards(vma, addr) + +#endif + +/* + * expand_stack(): legacy interface for page faulting. Don't use unless + * you have to. + * + * This is called with the mm locked for reading, drops the lock, takes + * the lock for writing, tries to look up a vma again, expands it if + * necessary, and downgrades the lock to reading again. + * + * If no vma is found or it can't be expanded, it returns NULL and has + * dropped the lock. + */ +struct vm_area_struct *expand_stack(struct mm_struct *mm, unsigned long addr) +{ + struct vm_area_struct *vma, *prev; + + mmap_read_unlock(mm); + if (mmap_write_lock_killable(mm)) + return NULL; + + vma = find_vma_prev(mm, addr, &prev); + if (vma && vma->vm_start <= addr) + goto success; + + if (prev && !vma_expand_up(prev, addr)) { + vma = prev; + goto success; + } + + if (vma && !vma_expand_down(vma, addr)) + goto success; + + mmap_write_unlock(mm); + return NULL; + +success: + mmap_write_downgrade(mm); + return vma; } -EXPORT_SYMBOL_GPL(find_extend_vma); /* * Ok - we have the memory areas we should free on a maple tree so release them, diff --git a/mm/nommu.c b/mm/nommu.c index f92438102b1d..30cc1228bd06 100644 --- a/mm/nommu.c +++ b/mm/nommu.c @@ -681,25 +681,21 @@ struct vm_area_struct *find_vma(struct mm_struct *mm, unsigned long addr) } EXPORT_SYMBOL(find_vma); -/* - * find a VMA - * - we don't extend stack VMAs under NOMMU conditions - */ -struct vm_area_struct *find_extend_vma(struct mm_struct *mm, unsigned long addr) -{ - return find_vma(mm, addr); -} - /* * expand a stack to a given address * - not supported under NOMMU conditions */ -int expand_stack_locked(struct vm_area_struct *vma, unsigned long address, - bool write_locked) +int expand_stack_locked(struct vm_area_struct *vma, unsigned long addr) { return -ENOMEM; } +struct vm_area_struct *expand_stack(struct mm_struct *mm, unsigned long addr) +{ + mmap_read_unlock(mm); + return NULL; +} + /* * look up the first VMA exactly that exactly matches addr * - should be called with mm->mmap_lock at least held readlocked From c0ba567af11a6fdb7686fb43a60b9e0bd6c6a744 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Thu, 27 Jul 2023 09:49:15 +0000 Subject: [PATCH 64/98] ANDROID: GKI: bring back find_extend_vma() In commit 8d7071af8907 ("mm: always expand the stack with the mmap write lock held"), find_extend_vma() was no longer being used in the tree, so it was removed. Unfortunately some GKI external module is using this, so bring it back to allow things to continue to work. Bug: 161946584 Fixes: 8d7071af8907 ("mm: always expand the stack with the mmap write lock held") Change-Id: I6f1fb1fd8193625fe3dac0bbc5b0aff653b3d879 Cc: Suren Baghdasaryan Signed-off-by: Greg Kroah-Hartman --- include/linux/mm.h | 1 + mm/mmap.c | 14 ++++++++++++++ 2 files changed, 15 insertions(+) diff --git a/include/linux/mm.h b/include/linux/mm.h index a9a1b9f9f97c..62ce759bdcff 100644 --- a/include/linux/mm.h +++ b/include/linux/mm.h @@ -3094,6 +3094,7 @@ unsigned long change_prot_numa(struct vm_area_struct *vma, unsigned long start, unsigned long end); #endif +struct vm_area_struct *find_extend_vma(struct mm_struct *, unsigned long addr); struct vm_area_struct *find_extend_vma_locked(struct mm_struct *, unsigned long addr); int remap_pfn_range(struct vm_area_struct *, unsigned long addr, diff --git a/mm/mmap.c b/mm/mmap.c index 75703bcea8a7..a6857acce59f 100644 --- a/mm/mmap.c +++ b/mm/mmap.c @@ -2231,6 +2231,20 @@ struct vm_area_struct *find_extend_vma_locked(struct mm_struct *mm, unsigned lon } #endif +/* + * ANDROID: Reintroduce find_extend_vma() as it's still used by some external + * modules. It was removed in commit 8d7071af8907 ("mm: always expand the + * stack with the mmap write lock held") + * In the future, everyone should just move to use the correct function instead + * of this old, legacy one. + */ +struct vm_area_struct *find_extend_vma(struct mm_struct *mm, + unsigned long addr) +{ + return find_extend_vma_locked(mm, addr); +} +EXPORT_SYMBOL_GPL(find_extend_vma); + /* * IA64 has some horrid mapping rules: it can expand both up and down, * but with various special rules. From 05f7c7fe72fe3ac5b1cfdc3f4cfebf87f2f16442 Mon Sep 17 00:00:00 2001 From: Suren Baghdasaryan Date: Sat, 8 Jul 2023 12:12:10 -0700 Subject: [PATCH 65/98] UPSTREAM: mm: lock a vma before stack expansion With recent changes necessitating mmap_lock to be held for write while expanding a stack, per-VMA locks should follow the same rules and be write-locked to prevent page faults into the VMA being expanded. Add the necessary locking. Cc: stable@vger.kernel.org Signed-off-by: Suren Baghdasaryan Signed-off-by: Linus Torvalds (cherry picked from commit c137381f71aec755fbf47cd4e9bd4dce752c054c) Change-Id: I3e6a8c89c1fb7c0669e1232176bb04ea6b09bc0a Signed-off-by: Suren Baghdasaryan Signed-off-by: Greg Kroah-Hartman --- mm/mmap.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/mm/mmap.c b/mm/mmap.c index a6857acce59f..bf2298de8a0f 100644 --- a/mm/mmap.c +++ b/mm/mmap.c @@ -2029,6 +2029,8 @@ static int expand_upwards(struct vm_area_struct *vma, unsigned long address) return -ENOMEM; } + /* Lock the VMA before expanding to prevent concurrent page faults */ + vma_start_write(vma); /* * vma->vm_start/vm_end cannot change under us because the caller * is required to hold the mmap_lock in read mode. We need the @@ -2116,6 +2118,8 @@ int expand_downwards(struct vm_area_struct *vma, unsigned long address) return -ENOMEM; } + /* Lock the VMA before expanding to prevent concurrent page faults */ + vma_start_write(vma); /* * vma->vm_start/vm_end cannot change under us because the caller * is required to hold the mmap_lock in read mode. We need the From e3601b25aeaefac9529f4d965ca359b03c459ba9 Mon Sep 17 00:00:00 2001 From: Suren Baghdasaryan Date: Sat, 8 Jul 2023 12:12:11 -0700 Subject: [PATCH 66/98] UPSTREAM: mm: lock newly mapped VMA which can be modified after it becomes visible mmap_region adds a newly created VMA into VMA tree and might modify it afterwards before dropping the mmap_lock. This poses a problem for page faults handled under per-VMA locks because they don't take the mmap_lock and can stumble on this VMA while it's still being modified. Currently this does not pose a problem since post-addition modifications are done only for file-backed VMAs, which are not handled under per-VMA lock. However, once support for handling file-backed page faults with per-VMA locks is added, this will become a race. Fix this by write-locking the VMA before inserting it into the VMA tree. Other places where a new VMA is added into VMA tree do not modify it after the insertion, so do not need the same locking. Cc: stable@vger.kernel.org Signed-off-by: Suren Baghdasaryan Signed-off-by: Linus Torvalds (cherry picked from commit 33313a747e81af9f31d0d45de78c9397fa3655eb) Change-Id: I3bb6a7bc8dd579e11f9c18cbc8e4a6e7279bbfb2 Signed-off-by: Suren Baghdasaryan Signed-off-by: Greg Kroah-Hartman --- mm/mmap.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/mm/mmap.c b/mm/mmap.c index bf2298de8a0f..26cff775c25a 100644 --- a/mm/mmap.c +++ b/mm/mmap.c @@ -2902,6 +2902,8 @@ cannot_expand: if (vma->vm_file) i_mmap_lock_write(vma->vm_file->f_mapping); + /* Lock the VMA since it is modified after insertion into VMA tree */ + vma_start_write(vma); mas_store_prealloc(&mas, vma); mm->map_count++; if (vma->vm_file) { From 0d9960403cb0fa936ab8dc34462ec446f3699c2e Mon Sep 17 00:00:00 2001 From: Suren Baghdasaryan Date: Sat, 8 Jul 2023 12:12:12 -0700 Subject: [PATCH 67/98] UPSTREAM: fork: lock VMAs of the parent process when forking MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit When forking a child process, the parent write-protects anonymous pages and COW-shares them with the child being forked using copy_present_pte(). We must not take any concurrent page faults on the source vma's as they are being processed, as we expect both the vma and the pte's behind it to be stable. For example, the anon_vma_fork() expects the parents vma->anon_vma to not change during the vma copy. A concurrent page fault on a page newly marked read-only by the page copy might trigger wp_page_copy() and a anon_vma_prepare(vma) on the source vma, defeating the anon_vma_clone() that wasn't done because the parent vma originally didn't have an anon_vma, but we now might end up copying a pte entry for a page that has one. Before the per-vma lock based changes, the mmap_lock guaranteed exclusion with concurrent page faults. But now we need to do a vma_start_write() to make sure no concurrent faults happen on this vma while it is being processed. This fix can potentially regress some fork-heavy workloads. Kernel build time did not show noticeable regression on a 56-core machine while a stress test mapping 10000 VMAs and forking 5000 times in a tight loop shows ~5% regression. If such fork time regression is unacceptable, disabling CONFIG_PER_VMA_LOCK should restore its performance. Further optimizations are possible if this regression proves to be problematic. Suggested-by: David Hildenbrand Reported-by: Jiri Slaby Closes: https://lore.kernel.org/all/dbdef34c-3a07-5951-e1ae-e9c6e3cdf51b@kernel.org/ Reported-by: Holger Hoffstätte Closes: https://lore.kernel.org/all/b198d649-f4bf-b971-31d0-e8433ec2a34c@applied-asynchrony.com/ Reported-by: Jacob Young Closes: https://bugzilla.kernel.org/show_bug.cgi?id=217624 Fixes: 0bff0aaea03e ("x86/mm: try VMA lock-based page fault handling first") Cc: stable@vger.kernel.org Signed-off-by: Suren Baghdasaryan Signed-off-by: Linus Torvalds (cherry picked from commit fb49c455323ff8319a123dd312be9082c49a23a5) Change-Id: Ic5aa9dc51a888b5b0319ec4ec6d2941424573ca0 Signed-off-by: Suren Baghdasaryan Signed-off-by: Greg Kroah-Hartman --- kernel/fork.c | 1 + 1 file changed, 1 insertion(+) diff --git a/kernel/fork.c b/kernel/fork.c index 67d61842d6b8..b890209ae115 100644 --- a/kernel/fork.c +++ b/kernel/fork.c @@ -694,6 +694,7 @@ static __latent_entropy int dup_mmap(struct mm_struct *mm, mas_for_each(&old_mas, mpnt, ULONG_MAX) { struct file *file; + vma_start_write(mpnt); if (mpnt->vm_flags & VM_DONTCOPY) { vm_stat_account(mm, mpnt->vm_flags, -vma_pages(mpnt)); continue; From 371f8d901ab5b93cae16b0506121e8aa8bcc83ba Mon Sep 17 00:00:00 2001 From: Hugh Dickins Date: Sat, 8 Jul 2023 16:04:00 -0700 Subject: [PATCH 68/98] UPSTREAM: mm: lock newly mapped VMA with corrected ordering Lockdep is certainly right to complain about (&vma->vm_lock->lock){++++}-{3:3}, at: vma_start_write+0x2d/0x3f but task is already holding lock: (&mapping->i_mmap_rwsem){+.+.}-{3:3}, at: mmap_region+0x4dc/0x6db Invert those to the usual ordering. Fixes: 33313a747e81 ("mm: lock newly mapped VMA which can be modified after it becomes visible") Cc: stable@vger.kernel.org Signed-off-by: Hugh Dickins Tested-by: Suren Baghdasaryan Signed-off-by: Linus Torvalds (cherry picked from commit 1c7873e3364570ec89343ff4877e0f27a7b21a61) Change-Id: I85f9cfb6ee8f3d9fefda5518c5637a7dff64bac3 Signed-off-by: Suren Baghdasaryan Signed-off-by: Greg Kroah-Hartman --- mm/mmap.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/mm/mmap.c b/mm/mmap.c index 26cff775c25a..9a61b1ce8b76 100644 --- a/mm/mmap.c +++ b/mm/mmap.c @@ -2899,11 +2899,11 @@ cannot_expand: goto free_vma; } + /* Lock the VMA since it is modified after insertion into VMA tree */ + vma_start_write(vma); if (vma->vm_file) i_mmap_lock_write(vma->vm_file->f_mapping); - /* Lock the VMA since it is modified after insertion into VMA tree */ - vma_start_write(vma); mas_store_prealloc(&mas, vma); mm->map_count++; if (vma->vm_file) { From a89e2cbbc02613cbdfcc8b32efe499ecbd4bbabe Mon Sep 17 00:00:00 2001 From: wangshuai12 Date: Tue, 11 Jul 2023 16:08:29 +0800 Subject: [PATCH 69/98] ANDROID: GKI: update xiaomi symbol list 1 function symbol(s) added 'int __blk_mq_debugfs_rq_show(struct seq_file*, struct request*)' Bug: 290730657 Change-Id: Ib3711e9e875e3d6ccc809a87c607fae149159a58 Signed-off-by: wangshuai12 --- android/abi_gki_aarch64.stg | 16 ++++++++++++++++ android/abi_gki_aarch64_xiaomi | 6 ++++++ 2 files changed, 22 insertions(+) diff --git a/android/abi_gki_aarch64.stg b/android/abi_gki_aarch64.stg index ec63c0c4c9fe..1e43b6fb21c5 100644 --- a/android/abi_gki_aarch64.stg +++ b/android/abi_gki_aarch64.stg @@ -309488,6 +309488,12 @@ function { parameter_id: 0x3e10b518 parameter_id: 0xe5e56f65 } +function { + id: 0x9c639284 + return_type_id: 0x6720d32f + parameter_id: 0x0665e6b6 + parameter_id: 0x1e820193 +} function { id: 0x9c660c95 return_type_id: 0x6720d32f @@ -319797,6 +319803,15 @@ elf_symbol { type_id: 0x475eeec2 full_name: "__blk_mq_alloc_disk" } +elf_symbol { + id: 0xcc33f78c + name: "__blk_mq_debugfs_rq_show" + is_defined: true + symbol_type: FUNCTION + crc: 0xe3d3f445 + type_id: 0x9c639284 + full_name: "__blk_mq_debugfs_rq_show" +} elf_symbol { id: 0x01badff0 name: "__blk_mq_end_request" @@ -380352,6 +380367,7 @@ interface { symbol_id: 0xbceb9c07 symbol_id: 0xe70766b6 symbol_id: 0xb339c336 + symbol_id: 0xcc33f78c symbol_id: 0x01badff0 symbol_id: 0x4df0b385 symbol_id: 0x35aa1afd diff --git a/android/abi_gki_aarch64_xiaomi b/android/abi_gki_aarch64_xiaomi index 8209fb5955f2..f89ba44c4afe 100644 --- a/android/abi_gki_aarch64_xiaomi +++ b/android/abi_gki_aarch64_xiaomi @@ -218,6 +218,12 @@ kernfs_path_from_node blkcg_activate_policy +#required by mq-deadline module + blk_mq_debugfs_rq_show + seq_list_start + seq_list_next + __blk_mq_debugfs_rq_show + #required by metis.ko module __traceiter_android_vh_rwsem_read_wait_start __traceiter_android_vh_rwsem_write_wait_start From d3b37a712ab7a5d73a2c66156debe2e3d48df007 Mon Sep 17 00:00:00 2001 From: Lorenzo Pieralisi Date: Tue, 4 Jul 2023 17:50:34 +0200 Subject: [PATCH 70/98] BACKPORT: FROMGIT: irqchip/gic-v3: Workaround for GIC-700 erratum 2941627 GIC700 erratum 2941627 may cause GIC-700 missing SPIs wake requests when SPIs are deactivated while targeting a sleeping CPU - ie a CPU for which the redistributor: GICR_WAKER.ProcessorSleep == 1 This runtime situation can happen if an SPI that has been activated on a core is retargeted to a different core, it becomes pending and the target core subsequently enters a power state quiescing the respective redistributor. When this situation is hit, the de-activation carried out on the core that activated the SPI (through either ICC_EOIR1_EL1 or ICC_DIR_EL1 register writes) does not trigger a wake requests for the sleeping GIC redistributor even if the SPI is pending. Work around the erratum by de-activating the SPI using the redistributor GICD_ICACTIVER register if the runtime conditions require it (ie the IRQ was retargeted between activation and de-activation). Bug: 292459437 Change-Id: Ide915b8c925a631a7fc9ccebca19d9175def162e Signed-off-by: Lorenzo Pieralisi Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20230704155034.148262-1-lpieralisi@kernel.org (cherry picked from commit 6fe5c68ee6a1aae0ef291a56001e7888de547fa2 https://git.kernel.org/pub/scm/linux/kernel/git/maz/arm-platforms.git irq/irqchip-fixes) Signed-off-by: Carlos Galo --- Documentation/arm64/silicon-errata.rst | 3 ++ drivers/irqchip/irq-gic-v3.c | 62 +++++++++++++++++++++++++- 2 files changed, 64 insertions(+), 1 deletion(-) diff --git a/Documentation/arm64/silicon-errata.rst b/Documentation/arm64/silicon-errata.rst index 808ade4cc008..3283f49006d6 100644 --- a/Documentation/arm64/silicon-errata.rst +++ b/Documentation/arm64/silicon-errata.rst @@ -139,6 +139,9 @@ stable kernels. | ARM | MMU-500 | #841119,826419 | N/A | +----------------+-----------------+-----------------+-----------------------------+ +----------------+-----------------+-----------------+-----------------------------+ +| ARM | GIC-700 | #2941627 | ARM64_ERRATUM_2941627 | ++----------------+-----------------+-----------------+-----------------------------+ ++----------------+-----------------+-----------------+-----------------------------+ | Broadcom | Brahma-B53 | N/A | ARM64_ERRATUM_845719 | +----------------+-----------------+-----------------+-----------------------------+ | Broadcom | Brahma-B53 | N/A | ARM64_ERRATUM_843419 | diff --git a/drivers/irqchip/irq-gic-v3.c b/drivers/irqchip/irq-gic-v3.c index 1684d19d46fb..a9d3d0e45d28 100644 --- a/drivers/irqchip/irq-gic-v3.c +++ b/drivers/irqchip/irq-gic-v3.c @@ -50,6 +50,8 @@ struct redist_region { static struct gic_chip_data_v3 gic_data __read_mostly; static DEFINE_STATIC_KEY_TRUE(supports_deactivate_key); +static DEFINE_STATIC_KEY_FALSE(gic_arm64_2941627_erratum); + #define GIC_ID_NR (1U << GICD_TYPER_ID_BITS(gic_data.rdists.gicd_typer)) #define GIC_LINE_NR min(GICD_TYPER_SPIS(gic_data.rdists.gicd_typer), 1020U) #define GIC_ESPI_NR GICD_TYPER_ESPIS(gic_data.rdists.gicd_typer) @@ -547,10 +549,39 @@ static void gic_irq_nmi_teardown(struct irq_data *d) gic_irq_set_prio(d, GICD_INT_DEF_PRI); } +static bool gic_arm64_erratum_2941627_needed(struct irq_data *d) +{ + enum gic_intid_range range; + + if (!static_branch_unlikely(&gic_arm64_2941627_erratum)) + return false; + + range = get_intid_range(d); + + /* + * The workaround is needed if the IRQ is an SPI and + * the target cpu is different from the one we are + * executing on. + */ + return (range == SPI_RANGE || range == ESPI_RANGE) && + !cpumask_test_cpu(raw_smp_processor_id(), + irq_data_get_effective_affinity_mask(d)); +} + static void gic_eoi_irq(struct irq_data *d) { write_gicreg(gic_irq(d), ICC_EOIR1_EL1); isb(); + + if (gic_arm64_erratum_2941627_needed(d)) { + /* + * Make sure the GIC stream deactivate packet + * issued by ICC_EOIR1_EL1 has completed before + * deactivating through GICD_IACTIVER. + */ + dsb(sy); + gic_poke_irq(d, GICD_ICACTIVER); + } } static void gic_eoimode1_eoi_irq(struct irq_data *d) @@ -561,7 +592,11 @@ static void gic_eoimode1_eoi_irq(struct irq_data *d) */ if (gic_irq(d) >= 8192 || irqd_is_forwarded_to_vcpu(d)) return; - gic_write_dir(gic_irq(d)); + + if (!gic_arm64_erratum_2941627_needed(d)) + gic_write_dir(gic_irq(d)); + else + gic_poke_irq(d, GICD_ICACTIVER); } static int gic_set_type(struct irq_data *d, unsigned int type) @@ -1747,6 +1782,12 @@ static bool gic_enable_quirk_hip06_07(void *data) return false; } +static bool gic_enable_quirk_arm64_2941627(void *data) +{ + static_branch_enable(&gic_arm64_2941627_erratum); + return true; +} + static const struct gic_quirk gic_quirks[] = { { .desc = "GICv3: Qualcomm MSM8996 broken firmware", @@ -1778,6 +1819,25 @@ static const struct gic_quirk gic_quirks[] = { .mask = 0xe8f00fff, .init = gic_enable_quirk_cavium_38539, }, + { + /* + * GIC-700: 2941627 workaround - IP variant [0,1] + * + */ + .desc = "GICv3: ARM64 erratum 2941627", + .iidr = 0x0400043b, + .mask = 0xff0e0fff, + .init = gic_enable_quirk_arm64_2941627, + }, + { + /* + * GIC-700: 2941627 workaround - IP variant [2] + */ + .desc = "GICv3: ARM64 erratum 2941627", + .iidr = 0x0402043b, + .mask = 0xff0f0fff, + .init = gic_enable_quirk_arm64_2941627, + }, { } }; From 890b1aabb1f6796da62141334728b8f5e9faac2a Mon Sep 17 00:00:00 2001 From: Jann Horn Date: Wed, 26 Jul 2023 23:41:03 +0200 Subject: [PATCH 71/98] BACKPORT: mm: lock_vma_under_rcu() must check vma->anon_vma under vma lock lock_vma_under_rcu() tries to guarantee that __anon_vma_prepare() can't be called in the VMA-locked page fault path by ensuring that vma->anon_vma is set. However, this check happens before the VMA is locked, which means a concurrent move_vma() can concurrently call unlink_anon_vmas(), which disassociates the VMA's anon_vma. This means we can get UAF in the following scenario: THREAD 1 THREAD 2 ======== ======== lock_vma_under_rcu() rcu_read_lock() mas_walk() check vma->anon_vma mremap() syscall move_vma() vma_start_write() unlink_anon_vmas() handle_mm_fault() __handle_mm_fault() handle_pte_fault() do_pte_missing() do_anonymous_page() anon_vma_prepare() __anon_vma_prepare() find_mergeable_anon_vma() mas_walk() [looks up VMA X] munmap() syscall (deletes VMA X) reusable_anon_vma() [called on freed VMA X] This is a security bug if you can hit it, although an attacker would have to win two races at once where the first race window is only a few instructions wide. This patch is based on some previous discussion with Linus Torvalds on the security list. Cc: stable@vger.kernel.org Fixes: 5e31275cc997 ("mm: add per-VMA lock and helper functions to control it") Signed-off-by: Jann Horn Signed-off-by: Linus Torvalds Bug: 293665307 (cherry picked from commit 657b5146955eba331e01b9a6ae89ce2e716ba306) [surenb: removed vma_is_tcp() call not present in 6.1] Change-Id: I4bd91e1db337ff35eb7c1d436f4372944556dd7d Signed-off-by: Suren Baghdasaryan --- mm/memory.c | 28 ++++++++++++++++------------ 1 file changed, 16 insertions(+), 12 deletions(-) diff --git a/mm/memory.c b/mm/memory.c index 8f225f33a85c..e9b7cd28ae02 100644 --- a/mm/memory.c +++ b/mm/memory.c @@ -5428,27 +5428,28 @@ retry: if (!vma_is_anonymous(vma)) goto inval; - /* find_mergeable_anon_vma uses adjacent vmas which are not locked */ - if (!vma->anon_vma) - goto inval; - if (!vma_start_read(vma)) goto inval; + /* + * find_mergeable_anon_vma uses adjacent vmas which are not locked. + * This check must happen after vma_start_read(); otherwise, a + * concurrent mremap() with MREMAP_DONTUNMAP could dissociate the VMA + * from its anon_vma. + */ + if (unlikely(!vma->anon_vma)) + goto inval_end_read; + /* * Due to the possibility of userfault handler dropping mmap_lock, avoid * it for now and fall back to page fault handling under mmap_lock. */ - if (userfaultfd_armed(vma)) { - vma_end_read(vma); - goto inval; - } + if (userfaultfd_armed(vma)) + goto inval_end_read; /* Check since vm_start/vm_end might change before we lock the VMA */ - if (unlikely(address < vma->vm_start || address >= vma->vm_end)) { - vma_end_read(vma); - goto inval; - } + if (unlikely(address < vma->vm_start || address >= vma->vm_end)) + goto inval_end_read; /* Check if the VMA got isolated after we found it */ if (vma->detached) { @@ -5460,6 +5461,9 @@ retry: rcu_read_unlock(); return vma; + +inval_end_read: + vma_end_read(vma); inval: rcu_read_unlock(); count_vm_vma_lock_event(VMA_LOCK_ABORT); From f5c707dc65dfa366e13c2edf25e44378d6e302eb Mon Sep 17 00:00:00 2001 From: Jann Horn Date: Fri, 28 Jul 2023 06:13:21 +0200 Subject: [PATCH 72/98] UPSTREAM: mm/mempolicy: Take VMA lock before replacing policy mbind() calls down into vma_replace_policy() without taking the per-VMA locks, replaces the VMA's vma->vm_policy pointer, and frees the old policy. That's bad; a concurrent page fault might still be using the old policy (in vma_alloc_folio()), resulting in use-after-free. Normally this will manifest as a use-after-free read first, but it can result in memory corruption, including because vma_alloc_folio() can call mpol_cond_put() on the freed policy, which conditionally changes the policy's refcount member. This bug is specific to CONFIG_NUMA, but it does also affect non-NUMA systems as long as the kernel was built with CONFIG_NUMA. Signed-off-by: Jann Horn Reviewed-by: Suren Baghdasaryan Fixes: 5e31275cc997 ("mm: add per-VMA lock and helper functions to control it") Cc: stable@kernel.org Signed-off-by: Linus Torvalds Bug: 293665307 (cherry picked from commit 6c21e066f9256ea1df6f88768f6ae1080b7cf509) Change-Id: I2e3a4ee8bad97457ee3e127694f0609e7a240a2f Signed-off-by: Suren Baghdasaryan --- mm/mempolicy.c | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) diff --git a/mm/mempolicy.c b/mm/mempolicy.c index f940395667c8..cd2fc238c24d 100644 --- a/mm/mempolicy.c +++ b/mm/mempolicy.c @@ -384,8 +384,10 @@ void mpol_rebind_mm(struct mm_struct *mm, nodemask_t *new) VMA_ITERATOR(vmi, mm, 0); mmap_write_lock(mm); - for_each_vma(vmi, vma) + for_each_vma(vmi, vma) { + vma_start_write(vma); mpol_rebind_policy(vma->vm_policy, new); + } mmap_write_unlock(mm); } @@ -759,6 +761,8 @@ static int vma_replace_policy(struct vm_area_struct *vma, struct mempolicy *old; struct mempolicy *new; + vma_assert_write_locked(vma); + pr_debug("vma %lx-%lx/%lx vm_ops %p vm_file %p set_policy %p\n", vma->vm_start, vma->vm_end, vma->vm_pgoff, vma->vm_ops, vma->vm_file, @@ -1259,6 +1263,8 @@ static long do_mbind(unsigned long start, unsigned long len, nodemask_t *nmask, unsigned long flags) { struct mm_struct *mm = current->mm; + struct vm_area_struct *vma; + struct vma_iterator vmi; struct mempolicy *new; unsigned long end; int err; @@ -1320,6 +1326,14 @@ static long do_mbind(unsigned long start, unsigned long len, if (err) goto mpol_out; + /* + * Lock the VMAs before scanning for pages to migrate, to ensure we don't + * miss a concurrently inserted page. + */ + vma_iter_init(&vmi, mm, start); + for_each_vma_range(vmi, vma, end) + vma_start_write(vma); + ret = queue_pages_range(mm, start, end, nmask, flags | MPOL_MF_INVERT, &pagelist); @@ -1546,6 +1560,7 @@ SYSCALL_DEFINE4(set_mempolicy_home_node, unsigned long, start, unsigned long, le break; } + vma_start_write(vma); new->home_node = home_node; err = mbind_range(mm, vmstart, vmend, new); mpol_put(new); From e341d2312c5faec4b5652650a87f2c2e8ef8e818 Mon Sep 17 00:00:00 2001 From: xieliujie Date: Mon, 31 Jul 2023 09:49:44 +0800 Subject: [PATCH 73/98] ANDROID: ABI: Update oplus symbol list 3 function symbol(s) added 'int __traceiter_android_rvh_rtmutex_force_update(void*, struct task_struct*, struct task_struct*, int*)' 'int __traceiter_android_vh_rtmutex_waiter_prio(void*, struct task_struct*, int*)' 'int __traceiter_android_vh_task_blocks_on_rtmutex(void*, struct rt_mutex_base*, struct rt_mutex_waiter*, struct task_struct*, struct ww_acquire_ctx*, unsigned int*)' 3 variable symbol(s) added 'struct tracepoint __tracepoint_android_rvh_rtmutex_force_update' 'struct tracepoint __tracepoint_android_vh_rtmutex_waiter_prio' 'struct tracepoint __tracepoint_android_vh_task_blocks_on_rtmutex' Bug: 290585456 Change-Id: I4af3d1c8df44822b7f5fd5d5682e65d7c6c4dcc3 Signed-off-by: xieliujie --- android/abi_gki_aarch64.stg | 85 +++++++++++++++++++++++++++++++++++ android/abi_gki_aarch64_oplus | 16 ++++--- 2 files changed, 96 insertions(+), 5 deletions(-) diff --git a/android/abi_gki_aarch64.stg b/android/abi_gki_aarch64.stg index 1e43b6fb21c5..8e0c51ae4146 100644 --- a/android/abi_gki_aarch64.stg +++ b/android/abi_gki_aarch64.stg @@ -308677,6 +308677,14 @@ function { parameter_id: 0x1d19a9d5 parameter_id: 0x1c3dbe5a } +function { + id: 0x9bdcd7ce + return_type_id: 0x6720d32f + parameter_id: 0x18bd6530 + parameter_id: 0x1d19a9d5 + parameter_id: 0x1d19a9d5 + parameter_id: 0x13580d6c +} function { id: 0x9bdcf60d return_type_id: 0x6720d32f @@ -308783,6 +308791,13 @@ function { parameter_id: 0x1d5bae2a parameter_id: 0x11cfee5a } +function { + id: 0x9bdf0ac7 + return_type_id: 0x6720d32f + parameter_id: 0x18bd6530 + parameter_id: 0x1d19a9d5 + parameter_id: 0x13580d6c +} function { id: 0x9bdfa419 return_type_id: 0x6720d32f @@ -308877,6 +308892,16 @@ function { parameter_id: 0x2a670b41 parameter_id: 0x1c898f28 } +function { + id: 0x9be67f35 + return_type_id: 0x6720d32f + parameter_id: 0x18bd6530 + parameter_id: 0x1013df15 + parameter_id: 0x27d4bd81 + parameter_id: 0x1d19a9d5 + parameter_id: 0x2c32dd96 + parameter_id: 0x1bf16028 +} function { id: 0x9be6a9ad return_type_id: 0x6720d32f @@ -323116,6 +323141,15 @@ elf_symbol { type_id: 0x9b427bba full_name: "__traceiter_android_rvh_revert_creds" } +elf_symbol { + id: 0xf0ffb4d4 + name: "__traceiter_android_rvh_rtmutex_force_update" + is_defined: true + symbol_type: FUNCTION + crc: 0xe3eba434 + type_id: 0x9bdcd7ce + full_name: "__traceiter_android_rvh_rtmutex_force_update" +} elf_symbol { id: 0xd90a9a58 name: "__traceiter_android_rvh_rtmutex_prepare_setprio" @@ -324754,6 +324788,15 @@ elf_symbol { type_id: 0x9beff51f full_name: "__traceiter_android_vh_rtmutex_wait_start" } +elf_symbol { + id: 0xc56d7179 + name: "__traceiter_android_vh_rtmutex_waiter_prio" + is_defined: true + symbol_type: FUNCTION + crc: 0x40a0002c + type_id: 0x9bdf0ac7 + full_name: "__traceiter_android_vh_rtmutex_waiter_prio" +} elf_symbol { id: 0x5858f827 name: "__traceiter_android_vh_rwsem_can_spin_on_owner" @@ -325060,6 +325103,15 @@ elf_symbol { type_id: 0x9bcd4ff7 full_name: "__traceiter_android_vh_sysrq_crash" } +elf_symbol { + id: 0xdd9dd67b + name: "__traceiter_android_vh_task_blocks_on_rtmutex" + is_defined: true + symbol_type: FUNCTION + crc: 0x698af67b + type_id: 0x9be67f35 + full_name: "__traceiter_android_vh_task_blocks_on_rtmutex" +} elf_symbol { id: 0x6befbf23 name: "__traceiter_android_vh_thermal_power_cap" @@ -326293,6 +326345,15 @@ elf_symbol { type_id: 0x18ccbd2c full_name: "__tracepoint_android_rvh_revert_creds" } +elf_symbol { + id: 0xf2fd13ea + name: "__tracepoint_android_rvh_rtmutex_force_update" + is_defined: true + symbol_type: OBJECT + crc: 0xa86a5262 + type_id: 0x18ccbd2c + full_name: "__tracepoint_android_rvh_rtmutex_force_update" +} elf_symbol { id: 0x69e37d02 name: "__tracepoint_android_rvh_rtmutex_prepare_setprio" @@ -327931,6 +327992,15 @@ elf_symbol { type_id: 0x18ccbd2c full_name: "__tracepoint_android_vh_rtmutex_wait_start" } +elf_symbol { + id: 0xeaebbadf + name: "__tracepoint_android_vh_rtmutex_waiter_prio" + is_defined: true + symbol_type: OBJECT + crc: 0x0fbb21e2 + type_id: 0x18ccbd2c + full_name: "__tracepoint_android_vh_rtmutex_waiter_prio" +} elf_symbol { id: 0xe471b8d5 name: "__tracepoint_android_vh_rwsem_can_spin_on_owner" @@ -328237,6 +328307,15 @@ elf_symbol { type_id: 0x18ccbd2c full_name: "__tracepoint_android_vh_sysrq_crash" } +elf_symbol { + id: 0xe5bf742d + name: "__tracepoint_android_vh_task_blocks_on_rtmutex" + is_defined: true + symbol_type: OBJECT + crc: 0x5494b8bf + type_id: 0x18ccbd2c + full_name: "__tracepoint_android_vh_task_blocks_on_rtmutex" +} elf_symbol { id: 0x6f25dd05 name: "__tracepoint_android_vh_thermal_power_cap" @@ -380735,6 +380814,7 @@ interface { symbol_id: 0xe3e24295 symbol_id: 0xaedef3a2 symbol_id: 0xde725472 + symbol_id: 0xf0ffb4d4 symbol_id: 0xd90a9a58 symbol_id: 0xbf64b0b6 symbol_id: 0xb25ca194 @@ -380917,6 +380997,7 @@ interface { symbol_id: 0x91384eff symbol_id: 0x3ef508a2 symbol_id: 0xfb1b8d64 + symbol_id: 0xc56d7179 symbol_id: 0x5858f827 symbol_id: 0xb1847a6f symbol_id: 0x958d8cdb @@ -380951,6 +381032,7 @@ interface { symbol_id: 0x58e7556b symbol_id: 0x2ecf85e9 symbol_id: 0x34a01a22 + symbol_id: 0xdd9dd67b symbol_id: 0x6befbf23 symbol_id: 0x226cc38b symbol_id: 0xeecc1529 @@ -381088,6 +381170,7 @@ interface { symbol_id: 0x18bac297 symbol_id: 0x1a849f34 symbol_id: 0x3f328d3c + symbol_id: 0xf2fd13ea symbol_id: 0x69e37d02 symbol_id: 0xeda5c5b0 symbol_id: 0x3cd58ada @@ -381270,6 +381353,7 @@ interface { symbol_id: 0x3fc5ffc9 symbol_id: 0xa3915d70 symbol_id: 0xf01f02ea + symbol_id: 0xeaebbadf symbol_id: 0xe471b8d5 symbol_id: 0x84628825 symbol_id: 0x8d0ce77d @@ -381304,6 +381388,7 @@ interface { symbol_id: 0x39e68fed symbol_id: 0xefb9e5a3 symbol_id: 0x3fe0157c + symbol_id: 0xe5bf742d symbol_id: 0x6f25dd05 symbol_id: 0xa5c71571 symbol_id: 0xfa3284c7 diff --git a/android/abi_gki_aarch64_oplus b/android/abi_gki_aarch64_oplus index e06e98d72020..ea61781c1543 100644 --- a/android/abi_gki_aarch64_oplus +++ b/android/abi_gki_aarch64_oplus @@ -86,6 +86,7 @@ tcf_exts_validate tcf_queue_work __traceiter_android_rvh_post_init_entity_util_avg + __traceiter_android_rvh_rtmutex_force_update __traceiter_android_vh_account_process_tick_gran __traceiter_android_vh_account_task_time __traceiter_android_vh_do_futex @@ -99,11 +100,6 @@ __traceiter_android_vh_record_pcpu_rwsem_starttime __traceiter_android_vh_record_rtmutex_lock_starttime __traceiter_android_vh_record_rwsem_lock_starttime - __tracepoint_android_vh_record_mutex_lock_starttime - __tracepoint_android_vh_record_pcpu_rwsem_starttime - __tracepoint_android_vh_record_rtmutex_lock_starttime - __tracepoint_android_vh_record_rwsem_lock_starttime - __trace_puts __traceiter_android_vh_alter_mutex_list_add __traceiter_android_vh_binder_free_proc __traceiter_android_vh_binder_has_work_ilocked @@ -136,6 +132,7 @@ __traceiter_android_vh_cleanup_old_buffers_bypass __traceiter_android_vh_dm_bufio_shrink_scan_bypass __traceiter_android_vh_mutex_unlock_slowpath + __traceiter_android_vh_rtmutex_waiter_prio __traceiter_android_vh_rwsem_can_spin_on_owner __traceiter_android_vh_rwsem_opt_spin_finish __traceiter_android_vh_rwsem_opt_spin_start @@ -143,6 +140,7 @@ __traceiter_android_vh_sched_stat_runtime_rt __traceiter_android_vh_shrink_node_memcgs __traceiter_android_vh_sync_txn_recvd + __traceiter_android_vh_task_blocks_on_rtmutex __traceiter_block_bio_queue __traceiter_block_getrq __traceiter_block_rq_complete @@ -157,6 +155,7 @@ __traceiter_sched_waking __traceiter_task_rename __tracepoint_android_rvh_post_init_entity_util_avg + __tracepoint_android_rvh_rtmutex_force_update __tracepoint_android_vh_account_process_tick_gran __tracepoint_android_vh_account_task_time __tracepoint_android_vh_alter_mutex_list_add @@ -198,6 +197,11 @@ __tracepoint_android_vh_cleanup_old_buffers_bypass __tracepoint_android_vh_dm_bufio_shrink_scan_bypass __tracepoint_android_vh_mutex_unlock_slowpath + __tracepoint_android_vh_record_mutex_lock_starttime + __tracepoint_android_vh_record_pcpu_rwsem_starttime + __tracepoint_android_vh_record_rtmutex_lock_starttime + __tracepoint_android_vh_record_rwsem_lock_starttime + __tracepoint_android_vh_rtmutex_waiter_prio __tracepoint_android_vh_rwsem_can_spin_on_owner __tracepoint_android_vh_rwsem_opt_spin_finish __tracepoint_android_vh_rwsem_opt_spin_start @@ -205,6 +209,7 @@ __tracepoint_android_vh_sched_stat_runtime_rt __tracepoint_android_vh_shrink_node_memcgs __tracepoint_android_vh_sync_txn_recvd + __tracepoint_android_vh_task_blocks_on_rtmutex __tracepoint_block_bio_queue __tracepoint_block_getrq __tracepoint_block_rq_complete @@ -218,6 +223,7 @@ __tracepoint_sched_stat_wait __tracepoint_sched_waking __tracepoint_task_rename + __trace_puts try_to_free_mem_cgroup_pages typec_mux_get_drvdata unregister_memory_notifier From 84ac22a0d31aec44cc2bc7d9e5bd94bf95c4c32d Mon Sep 17 00:00:00 2001 From: Daniel Rosenberg Date: Thu, 4 May 2023 15:43:42 -0700 Subject: [PATCH 74/98] ANDROID: fuse-bpf: Add partial ioctl support This adds passthrough only support for ioctls with fuse-bpf. compat_ioctls will return -ENOTTY. Bug: 279519292 Test: F2fsMiscTest#testAtomicWrite Change-Id: Ia3052e465d87dc1d15ae13955fba8a7f93bc387b Signed-off-by: Daniel Rosenberg --- fs/fuse/backing.c | 13 +++++++++++++ fs/fuse/fuse_i.h | 2 ++ fs/fuse/ioctl.c | 9 +++++++++ 3 files changed, 24 insertions(+) diff --git a/fs/fuse/backing.c b/fs/fuse/backing.c index 931c3397133c..1e403a090581 100644 --- a/fs/fuse/backing.c +++ b/fs/fuse/backing.c @@ -966,6 +966,19 @@ void *fuse_file_write_iter_finalize(struct fuse_bpf_args *fa, return ERR_PTR(fwio->ret); } +long fuse_backing_ioctl(struct file *file, unsigned int command, unsigned long arg, int flags) +{ + struct fuse_file *ff = file->private_data; + long ret; + + if (flags & FUSE_IOCTL_COMPAT) + ret = -ENOTTY; + else + ret = vfs_ioctl(ff->backing_file, command, arg); + + return ret; +} + int fuse_file_flock_backing(struct file *file, int cmd, struct file_lock *fl) { struct fuse_file *ff = file->private_data; diff --git a/fs/fuse/fuse_i.h b/fs/fuse/fuse_i.h index 475442c9ad7e..90d38da7f4f6 100644 --- a/fs/fuse/fuse_i.h +++ b/fs/fuse/fuse_i.h @@ -1664,6 +1664,8 @@ int fuse_file_write_iter_backing(struct fuse_bpf_args *fa, void *fuse_file_write_iter_finalize(struct fuse_bpf_args *fa, struct kiocb *iocb, struct iov_iter *from); +long fuse_backing_ioctl(struct file *file, unsigned int command, unsigned long arg, int flags); + int fuse_file_flock_backing(struct file *file, int cmd, struct file_lock *fl); ssize_t fuse_backing_mmap(struct file *file, struct vm_area_struct *vma); diff --git a/fs/fuse/ioctl.c b/fs/fuse/ioctl.c index 8ba1545e01f9..d266f640266f 100644 --- a/fs/fuse/ioctl.c +++ b/fs/fuse/ioctl.c @@ -353,6 +353,15 @@ long fuse_ioctl_common(struct file *file, unsigned int cmd, if (fuse_is_bad(inode)) return -EIO; +#ifdef CONFIG_FUSE_BPF + { + struct fuse_file *ff = file->private_data; + + /* TODO - this is simply passthrough, not a proper BPF filter */ + if (ff->backing_file) + return fuse_backing_ioctl(file, cmd, arg, flags); + } +#endif return fuse_do_ioctl(file, cmd, arg, flags); } From 4bbda90bd8754e4bed1a5e4f5acb1212e8275fb1 Mon Sep 17 00:00:00 2001 From: Paul Lawrence Date: Mon, 24 Jul 2023 13:45:45 -0700 Subject: [PATCH 75/98] ANDROID: fuse-bpf: Fix flock test compile error Bug: 293161755 Test: fuse_test compiles Signed-off-by: Paul Lawrence Change-Id: I249672bab85966e20a26018f65f135fe15c6eff5 --- tools/testing/selftests/filesystems/fuse/fuse_test.c | 1 - 1 file changed, 1 deletion(-) diff --git a/tools/testing/selftests/filesystems/fuse/fuse_test.c b/tools/testing/selftests/filesystems/fuse/fuse_test.c index bdb70e23b349..fc0d83cd1332 100644 --- a/tools/testing/selftests/filesystems/fuse/fuse_test.c +++ b/tools/testing/selftests/filesystems/fuse/fuse_test.c @@ -1345,7 +1345,6 @@ static int flock_test(const char *mount_dir) int fuse_dev = -1; int fd = -1, fd2 = -1; int backing_fd = -1; - char *addr = NULL; TEST(src_fd = open(ft_src, O_DIRECTORY | O_RDONLY | O_CLOEXEC), src_fd != -1); From 6aef06abbad42c3d1b4588ac31e042f967304be7 Mon Sep 17 00:00:00 2001 From: Paul Lawrence Date: Wed, 26 Jul 2023 15:03:41 -0700 Subject: [PATCH 76/98] ANDROID: fuse-bpf: Check inode not null fuse_iget_backing returns an inode or null, not a ERR_PTR. So check it's not NULL Also make sure we put the inode if d_splice_alias fails Bug: 293349757 Test: fuse_test runs Signed_off_by: Paul Lawrence Change-Id: I1eadad32f80bab6730e461412b4b7ab4d6c56bf2 --- fs/fuse/backing.c | 17 ++++++++++------- fs/fuse/dir.c | 26 ++++++++++++-------------- 2 files changed, 22 insertions(+), 21 deletions(-) diff --git a/fs/fuse/backing.c b/fs/fuse/backing.c index 1e403a090581..652c5f3560f4 100644 --- a/fs/fuse/backing.c +++ b/fs/fuse/backing.c @@ -252,8 +252,8 @@ int fuse_create_open_backing( inode = fuse_iget_backing(dir->i_sb, target_nodeid, get_fuse_dentry(entry)->backing_path.dentry->d_inode); - if (IS_ERR(inode)) { - err = PTR_ERR(inode); + if (!inode) { + err = -EIO; goto out; } @@ -269,10 +269,12 @@ int fuse_create_open_backing( goto out; } + inode = NULL; entry = newent ? newent : entry; err = finish_open(file, entry, fuse_open_file_backing); out: + iput(inode); dput(backing_dentry); return err; } @@ -1240,7 +1242,7 @@ struct dentry *fuse_lookup_finalize(struct fuse_bpf_args *fa, struct inode *dir, { struct fuse_dentry *fd; struct dentry *bd; - struct inode *inode, *backing_inode; + struct inode *inode = NULL, *backing_inode; struct inode *d_inode = entry->d_inode; struct fuse_entry_out *feo = fa->out_args[0].value; struct fuse_entry_bpf_out *febo = fa->out_args[1].value; @@ -1271,9 +1273,8 @@ struct dentry *fuse_lookup_finalize(struct fuse_bpf_args *fa, struct inode *dir, target_nodeid = get_fuse_inode(d_inode)->nodeid; inode = fuse_iget_backing(dir->i_sb, target_nodeid, backing_inode); - - if (IS_ERR(inode)) { - ret = ERR_PTR(PTR_ERR(inode)); + if (!inode) { + ret = ERR_PTR(-EIO); goto out; } @@ -1290,9 +1291,11 @@ struct dentry *fuse_lookup_finalize(struct fuse_bpf_args *fa, struct inode *dir, } get_fuse_inode(inode)->nodeid = feo->nodeid; - ret = d_splice_alias(inode, entry); + if (!IS_ERR(ret)) + inode = NULL; out: + iput(inode); if (feb->backing_file) fput(feb->backing_file); return ret; diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c index 076a0bddef8f..c70a9f722074 100644 --- a/fs/fuse/dir.c +++ b/fs/fuse/dir.c @@ -504,7 +504,6 @@ int fuse_lookup_name(struct super_block *sb, u64 nodeid, const struct qstr *name if (name->len > FUSE_NAME_MAX) goto out; - forget = fuse_alloc_forget(); err = -ENOMEM; if (!forget) @@ -523,32 +522,34 @@ int fuse_lookup_name(struct super_block *sb, u64 nodeid, const struct qstr *name err = -ENOENT; if (!entry) - goto out_queue_forget; + goto out_put_forget; err = -EINVAL; backing_file = bpf_arg.backing_file; if (!backing_file) - goto out_queue_forget; + goto out_put_forget; if (IS_ERR(backing_file)) { err = PTR_ERR(backing_file); - goto out_queue_forget; + goto out_put_forget; } backing_inode = backing_file->f_inode; *inode = fuse_iget_backing(sb, outarg->nodeid, backing_inode); if (!*inode) - goto out; + goto out_put_forget; err = fuse_handle_backing(&bpf_arg, &get_fuse_inode(*inode)->backing_inode, &get_fuse_dentry(entry)->backing_path); - if (err) - goto out; - - err = fuse_handle_bpf_prog(&bpf_arg, NULL, &get_fuse_inode(*inode)->bpf); - if (err) - goto out; + if (!err) + err = fuse_handle_bpf_prog(&bpf_arg, NULL, + &get_fuse_inode(*inode)->bpf); + if (err) { + iput(*inode); + *inode = NULL; + goto out_put_forget; + } } else #endif { @@ -568,9 +569,6 @@ int fuse_lookup_name(struct super_block *sb, u64 nodeid, const struct qstr *name } err = -ENOMEM; -#ifdef CONFIG_FUSE_BPF -out_queue_forget: -#endif if (!*inode && outarg->nodeid) { fuse_queue_forget(fm->fc, forget, outarg->nodeid, 1); goto out; From 74d9daa59a1e6a1207f7a198cfb8bbc49fd98872 Mon Sep 17 00:00:00 2001 From: Paul Lawrence Date: Tue, 25 Jul 2023 11:18:38 -0700 Subject: [PATCH 77/98] ANDROID: fuse-bpf: Add bpf to negative fuse_dentry Store the results of a negative lookup in the fuse_dentry so later opcodes can use them to create files Bug: 291705489 Test: fuse_test passes Signed-off-by: Paul Lawrence Change-Id: I725e714a1d6ce43f24431d07c24e96349ef1a55c --- fs/fuse/backing.c | 64 +++++++++++++++++++++++------------------------ fs/fuse/dir.c | 5 ++++ fs/fuse/fuse_i.h | 6 +++++ 3 files changed, 43 insertions(+), 32 deletions(-) diff --git a/fs/fuse/backing.c b/fs/fuse/backing.c index 652c5f3560f4..fa3d8ef72974 100644 --- a/fs/fuse/backing.c +++ b/fs/fuse/backing.c @@ -1240,60 +1240,60 @@ int fuse_handle_bpf_prog(struct fuse_entry_bpf *feb, struct inode *parent, struct dentry *fuse_lookup_finalize(struct fuse_bpf_args *fa, struct inode *dir, struct dentry *entry, unsigned int flags) { - struct fuse_dentry *fd; - struct dentry *bd; + struct fuse_dentry *fuse_entry; + struct dentry *backing_entry; struct inode *inode = NULL, *backing_inode; - struct inode *d_inode = entry->d_inode; + struct inode *entry_inode = entry->d_inode; struct fuse_entry_out *feo = fa->out_args[0].value; struct fuse_entry_bpf_out *febo = fa->out_args[1].value; - struct fuse_entry_bpf *feb = container_of(febo, struct fuse_entry_bpf, out); + struct fuse_entry_bpf *feb = container_of(febo, struct fuse_entry_bpf, + out); int error = -1; u64 target_nodeid = 0; - struct dentry *ret; + struct dentry *ret = NULL; - fd = get_fuse_dentry(entry); - if (!fd) { + fuse_entry = get_fuse_dentry(entry); + if (!fuse_entry) { ret = ERR_PTR(-EIO); goto out; } - bd = fd->backing_path.dentry; - if (!bd) { + backing_entry = fuse_entry->backing_path.dentry; + if (!backing_entry) { ret = ERR_PTR(-ENOENT); goto out; } - backing_inode = bd->d_inode; - if (!backing_inode) { - ret = 0; - goto out; - } + if (entry_inode) + target_nodeid = get_fuse_inode(entry_inode)->nodeid; - if (d_inode) - target_nodeid = get_fuse_inode(d_inode)->nodeid; + backing_inode = backing_entry->d_inode; + if (backing_inode) + inode = fuse_iget_backing(dir->i_sb, target_nodeid, + backing_inode); - inode = fuse_iget_backing(dir->i_sb, target_nodeid, backing_inode); - if (!inode) { - ret = ERR_PTR(-EIO); - goto out; - } - - error = fuse_handle_bpf_prog(feb, dir, &get_fuse_inode(inode)->bpf); + error = inode ? + fuse_handle_bpf_prog(feb, dir, &get_fuse_inode(inode)->bpf) : + fuse_handle_bpf_prog(feb, dir, &fuse_entry->bpf); if (error) { ret = ERR_PTR(error); goto out; } - error = fuse_handle_backing(feb, &get_fuse_inode(inode)->backing_inode, &fd->backing_path); - if (error) { - ret = ERR_PTR(error); - goto out; - } + if (inode) { + error = fuse_handle_backing(feb, + &get_fuse_inode(inode)->backing_inode, + &fuse_entry->backing_path); + if (error) { + ret = ERR_PTR(error); + goto out; + } - get_fuse_inode(inode)->nodeid = feo->nodeid; - ret = d_splice_alias(inode, entry); - if (!IS_ERR(ret)) - inode = NULL; + get_fuse_inode(inode)->nodeid = feo->nodeid; + ret = d_splice_alias(inode, entry); + if (!IS_ERR(ret)) + inode = NULL; + } out: iput(inode); if (feb->backing_file) diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c index c70a9f722074..59dee8d5b578 100644 --- a/fs/fuse/dir.c +++ b/fs/fuse/dir.c @@ -364,9 +364,14 @@ static void fuse_dentry_release(struct dentry *dentry) { struct fuse_dentry *fd = dentry->d_fsdata; +#ifdef CONFIG_FUSE_BPF if (fd && fd->backing_path.dentry) path_put(&fd->backing_path); + if (fd && fd->bpf) + bpf_prog_put(fd->bpf); +#endif + kfree_rcu(fd, rcu); } #endif diff --git a/fs/fuse/fuse_i.h b/fs/fuse/fuse_i.h index 90d38da7f4f6..723d462a54eb 100644 --- a/fs/fuse/fuse_i.h +++ b/fs/fuse/fuse_i.h @@ -76,7 +76,13 @@ struct fuse_dentry { u64 time; struct rcu_head rcu; }; + +#ifdef CONFIG_FUSE_BPF struct path backing_path; + + /* bpf program *only* set for negative dentries */ + struct bpf_prog *bpf; +#endif }; static inline struct fuse_dentry *get_fuse_dentry(const struct dentry *entry) From 295e779e8f896de94df662a2c0e20d60ad69f6b2 Mon Sep 17 00:00:00 2001 From: Paul Lawrence Date: Tue, 25 Jul 2023 11:20:11 -0700 Subject: [PATCH 78/98] ANDROID: fuse-bpf: Use stored bpf for create_open create_open would always take its parent directory's bpf for the created object. Modify to use the bpf stored in fuse_dentry which is set by lookup. Bug: 291705489 Test: fuse_test passes, adb push file /sdcard/Android/data works Signed-off-by: Paul Lawrence Change-Id: I0a1ea2a291a8fdf67923f1827176b2ea96bd4c2d --- fs/fuse/backing.c | 16 ++++---- .../selftests/filesystems/fuse/fuse_test.c | 39 +++++++++++++++++++ .../selftests/filesystems/fuse/test_bpf.c | 26 +++++++++++++ 3 files changed, 73 insertions(+), 8 deletions(-) diff --git a/fs/fuse/backing.c b/fs/fuse/backing.c index fa3d8ef72974..9df0535ad20f 100644 --- a/fs/fuse/backing.c +++ b/fs/fuse/backing.c @@ -208,6 +208,7 @@ int fuse_create_open_backing( struct file *file, unsigned int flags, umode_t mode) { struct fuse_inode *dir_fuse_inode = get_fuse_inode(dir); + struct fuse_dentry *fuse_entry = get_fuse_dentry(entry); struct fuse_dentry *dir_fuse_dentry = get_fuse_dentry(entry->d_parent); struct dentry *backing_dentry = NULL; struct inode *inode = NULL; @@ -239,19 +240,19 @@ int fuse_create_open_backing( if (err) goto out; - if (get_fuse_dentry(entry)->backing_path.dentry) - path_put(&get_fuse_dentry(entry)->backing_path); - get_fuse_dentry(entry)->backing_path = (struct path) { + if (fuse_entry->backing_path.dentry) + path_put(&fuse_entry->backing_path); + fuse_entry->backing_path = (struct path) { .mnt = dir_fuse_dentry->backing_path.mnt, .dentry = backing_dentry, }; - path_get(&get_fuse_dentry(entry)->backing_path); + path_get(&fuse_entry->backing_path); if (d_inode) target_nodeid = get_fuse_inode(d_inode)->nodeid; inode = fuse_iget_backing(dir->i_sb, target_nodeid, - get_fuse_dentry(entry)->backing_path.dentry->d_inode); + fuse_entry->backing_path.dentry->d_inode); if (!inode) { err = -EIO; goto out; @@ -259,9 +260,8 @@ int fuse_create_open_backing( if (get_fuse_inode(inode)->bpf) bpf_prog_put(get_fuse_inode(inode)->bpf); - get_fuse_inode(inode)->bpf = dir_fuse_inode->bpf; - if (get_fuse_inode(inode)->bpf) - bpf_prog_inc(dir_fuse_inode->bpf); + get_fuse_inode(inode)->bpf = fuse_entry->bpf; + fuse_entry->bpf = NULL; newent = d_splice_alias(inode, entry); if (IS_ERR(newent)) { diff --git a/tools/testing/selftests/filesystems/fuse/fuse_test.c b/tools/testing/selftests/filesystems/fuse/fuse_test.c index fc0d83cd1332..0bf1f030cbcd 100644 --- a/tools/testing/selftests/filesystems/fuse/fuse_test.c +++ b/tools/testing/selftests/filesystems/fuse/fuse_test.c @@ -2009,6 +2009,44 @@ static int bpf_test_lookup_postfilter(const char *mount_dir) return result; } +/** + * Test that a file made via create_and_open correctly gets the bpf assigned + * from the negative lookup + * bpf blocks file open, but also removes itself from children + * This test will fail if the 'remove' is unsuccessful + */ +static int bpf_test_create_and_remove_bpf(const char *mount_dir) +{ + const char *file = "file"; + + int result = TEST_FAILURE; + int src_fd = -1; + int bpf_fd = -1; + int fuse_dev = -1; + int fd = -1; + int fd2 = -1; + + TEST(src_fd = open(ft_src, O_DIRECTORY | O_RDONLY | O_CLOEXEC), + src_fd != -1); + TESTEQUAL(install_elf_bpf("test_bpf.bpf", "test_create_remove", &bpf_fd, + NULL, NULL), 0); + TESTEQUAL(mount_fuse_no_init(mount_dir, bpf_fd, src_fd, &fuse_dev), 0); + TEST(fd = s_creat(s_path(s(mount_dir), s(file)), 0777), + fd != -1); + TEST(fd2 = s_open(s_path(s(mount_dir), s(file)), O_RDONLY), + fd2 != -1); + + result = TEST_SUCCESS; +out: + close(fd2); + close(fd); + close(fuse_dev); + close(bpf_fd); + close(src_fd); + umount(mount_dir); + return result; +} + static void parse_range(const char *ranges, bool *run_test, size_t tests) { size_t i; @@ -2136,6 +2174,7 @@ int main(int argc, char *argv[]) MAKE_TEST(bpf_test_revalidate_handle_backing_fd), MAKE_TEST(bpf_test_lookup_postfilter), MAKE_TEST(flock_test), + MAKE_TEST(bpf_test_create_and_remove_bpf), }; #undef MAKE_TEST diff --git a/tools/testing/selftests/filesystems/fuse/test_bpf.c b/tools/testing/selftests/filesystems/fuse/test_bpf.c index 032cb1178f9f..e02bdb4a9380 100644 --- a/tools/testing/selftests/filesystems/fuse/test_bpf.c +++ b/tools/testing/selftests/filesystems/fuse/test_bpf.c @@ -505,3 +505,29 @@ int lookuppostfilter_test(struct fuse_bpf_args *fa) return FUSE_BPF_BACKING; } } + +SEC("test_create_remove") +int createremovebpf_test(struct fuse_bpf_args *fa) +{ + switch (fa->opcode) { + case FUSE_LOOKUP | FUSE_PREFILTER: { + return FUSE_BPF_BACKING | FUSE_BPF_POST_FILTER; + } + + case FUSE_LOOKUP | FUSE_POSTFILTER: { + struct fuse_entry_bpf_out *febo = fa->out_args[1].value; + + febo->bpf_action = FUSE_ACTION_REMOVE; + return 0; + } + + case FUSE_OPEN | FUSE_PREFILTER: { + return -EIO; + } + + default: + return FUSE_BPF_BACKING; + } +} + + From 7beed73af0664057745502e2af1b48edcc4ef834 Mon Sep 17 00:00:00 2001 From: Ramji Jiyani Date: Thu, 27 Jul 2023 17:57:09 +0000 Subject: [PATCH 79/98] ANDROID: GKI: Create symbol files in include/config Create input symbol files to generate GKI modules header under include/config. By placing files in this generated directory, the default filters that ignore certain files will work without any special handling required, and they will also be available to inspect after the build to inspect for the debugging purposes. abi_gki_protected_exports: Input for gki_module_protected_exports.h From :- ${objtree}/abi_gki_protected_exports To :- include/config/abi_gki_protected_exports all_kmi_symbols: Input for gki_module_unprotected.h - Rename to abi_gki_kmi_symbols From :- all_kmi_symbols To :- include/config/abi_gki_kmi_symbols Bug: 286529877 Test: TH Test: Manual verification of the generated files Change-Id: Iafa10631e7712a8e1e87a2f56cfd614de6b1053a Signed-off-by: Ramji Jiyani --- kernel/module/Makefile | 2 +- scripts/gen_gki_modules_headers.sh | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/kernel/module/Makefile b/kernel/module/Makefile index 458cb6e44e85..5d9035643b9a 100644 --- a/kernel/module/Makefile +++ b/kernel/module/Makefile @@ -28,7 +28,7 @@ obj-$(CONFIG_MODULE_UNLOAD_TAINT_TRACKING) += tracking.o $(obj)/gki_module.o: include/generated/gki_module_protected_exports.h \ include/generated/gki_module_unprotected.h -ALL_KMI_SYMBOLS := all_kmi_symbols +ALL_KMI_SYMBOLS := include/config/abi_gki_kmi_symbols include/generated/gki_module_unprotected.h: $(ALL_KMI_SYMBOLS) \ $(srctree)/scripts/gen_gki_modules_headers.sh diff --git a/scripts/gen_gki_modules_headers.sh b/scripts/gen_gki_modules_headers.sh index 3aa221a058f4..ca435f49b62f 100755 --- a/scripts/gen_gki_modules_headers.sh +++ b/scripts/gen_gki_modules_headers.sh @@ -108,7 +108,7 @@ if [ "$(basename "${TARGET}")" = "gki_module_unprotected.h" ]; then generate_header "${TARGET}" "${GKI_VENDOR_SYMBOLS}" "unprotected" else # Sorted list of exported symbols - GKI_EXPORTED_SYMBOLS="${objtree}/abi_gki_protected_exports" + GKI_EXPORTED_SYMBOLS="include/config/abi_gki_protected_exports" if [ -z "${SYMBOL_LIST}" ]; then # Create empty list if ARCH doesn't have protected exports From 343b85ecadc2dae0780b1c7a76fa3dcb38468fbb Mon Sep 17 00:00:00 2001 From: Ming Qian Date: Wed, 22 Mar 2023 05:13:04 +0000 Subject: [PATCH 80/98] UPSTREAM: media: Add P012 and P012M video format P012 is a YUV format with 12-bits per component with interleaved UV, like NV12, expanded to 16 bits. Data in the 12 high bits, zeros in the 4 low bits, arranged in little endian order. And P012M has two non contiguous planes. Bug: 293213303 Change-Id: I1fbfa7c445bc682766f479cca07eb8cb16cbb44f (cherry picked from commit aa1080404200694aace5989f99664ca75e73b03d) Signed-off-by: Ming Qian Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jindong Yue --- .../media/v4l/pixfmt-yuv-planar.rst | 94 +++++++++++++++++++ drivers/media/v4l2-core/v4l2-common.c | 2 + drivers/media/v4l2-core/v4l2-ioctl.c | 2 + include/uapi/linux/videodev2.h | 2 + 4 files changed, 100 insertions(+) diff --git a/Documentation/userspace-api/media/v4l/pixfmt-yuv-planar.rst b/Documentation/userspace-api/media/v4l/pixfmt-yuv-planar.rst index f1d5bb7b806d..72324274f20c 100644 --- a/Documentation/userspace-api/media/v4l/pixfmt-yuv-planar.rst +++ b/Documentation/userspace-api/media/v4l/pixfmt-yuv-planar.rst @@ -123,6 +123,20 @@ All components are stored with the same number of bits per component. - Cb, Cr - Yes - 4x4 tiles + * - V4L2_PIX_FMT_P012 + - 'P012' + - 12 + - 4:2:0 + - Cb, Cr + - Yes + - Linear + * - V4L2_PIX_FMT_P012M + - 'PM12' + - 12 + - 4:2:0 + - Cb, Cr + - No + - Linear * - V4L2_PIX_FMT_NV16 - 'NV16' - 8 @@ -586,6 +600,86 @@ Data in the 10 high bits, zeros in the 6 low bits, arranged in little endian ord - Cb\ :sub:`11` - Cr\ :sub:`11` +.. _V4L2-PIX-FMT-P012: +.. _V4L2-PIX-FMT-P012M: + +P012 and P012M +-------------- + +P012 is like NV12 with 12 bits per component, expanded to 16 bits. +Data in the 12 high bits, zeros in the 4 low bits, arranged in little endian order. + +.. flat-table:: Sample 4x4 P012 Image + :header-rows: 0 + :stub-columns: 0 + + * - start + 0: + - Y'\ :sub:`00` + - Y'\ :sub:`01` + - Y'\ :sub:`02` + - Y'\ :sub:`03` + * - start + 8: + - Y'\ :sub:`10` + - Y'\ :sub:`11` + - Y'\ :sub:`12` + - Y'\ :sub:`13` + * - start + 16: + - Y'\ :sub:`20` + - Y'\ :sub:`21` + - Y'\ :sub:`22` + - Y'\ :sub:`23` + * - start + 24: + - Y'\ :sub:`30` + - Y'\ :sub:`31` + - Y'\ :sub:`32` + - Y'\ :sub:`33` + * - start + 32: + - Cb\ :sub:`00` + - Cr\ :sub:`00` + - Cb\ :sub:`01` + - Cr\ :sub:`01` + * - start + 40: + - Cb\ :sub:`10` + - Cr\ :sub:`10` + - Cb\ :sub:`11` + - Cr\ :sub:`11` + +.. flat-table:: Sample 4x4 P012M Image + :header-rows: 0 + :stub-columns: 0 + + * - start0 + 0: + - Y'\ :sub:`00` + - Y'\ :sub:`01` + - Y'\ :sub:`02` + - Y'\ :sub:`03` + * - start0 + 8: + - Y'\ :sub:`10` + - Y'\ :sub:`11` + - Y'\ :sub:`12` + - Y'\ :sub:`13` + * - start0 + 16: + - Y'\ :sub:`20` + - Y'\ :sub:`21` + - Y'\ :sub:`22` + - Y'\ :sub:`23` + * - start0 + 24: + - Y'\ :sub:`30` + - Y'\ :sub:`31` + - Y'\ :sub:`32` + - Y'\ :sub:`33` + * - + * - start1 + 0: + - Cb\ :sub:`00` + - Cr\ :sub:`00` + - Cb\ :sub:`01` + - Cr\ :sub:`01` + * - start1 + 8: + - Cb\ :sub:`10` + - Cr\ :sub:`10` + - Cb\ :sub:`11` + - Cr\ :sub:`11` + Fully Planar YUV Formats ======================== diff --git a/drivers/media/v4l2-core/v4l2-common.c b/drivers/media/v4l2-core/v4l2-common.c index 40f56e044640..a5e8ba370d33 100644 --- a/drivers/media/v4l2-core/v4l2-common.c +++ b/drivers/media/v4l2-core/v4l2-common.c @@ -267,6 +267,7 @@ const struct v4l2_format_info *v4l2_format_info(u32 format) { .format = V4L2_PIX_FMT_NV24, .pixel_enc = V4L2_PIXEL_ENC_YUV, .mem_planes = 1, .comp_planes = 2, .bpp = { 1, 2, 0, 0 }, .hdiv = 1, .vdiv = 1 }, { .format = V4L2_PIX_FMT_NV42, .pixel_enc = V4L2_PIXEL_ENC_YUV, .mem_planes = 1, .comp_planes = 2, .bpp = { 1, 2, 0, 0 }, .hdiv = 1, .vdiv = 1 }, { .format = V4L2_PIX_FMT_P010, .pixel_enc = V4L2_PIXEL_ENC_YUV, .mem_planes = 1, .comp_planes = 2, .bpp = { 2, 2, 0, 0 }, .hdiv = 2, .vdiv = 1 }, + { .format = V4L2_PIX_FMT_P012, .pixel_enc = V4L2_PIXEL_ENC_YUV, .mem_planes = 1, .comp_planes = 2, .bpp = { 2, 4, 0, 0 }, .hdiv = 2, .vdiv = 2 }, { .format = V4L2_PIX_FMT_YUV410, .pixel_enc = V4L2_PIXEL_ENC_YUV, .mem_planes = 1, .comp_planes = 3, .bpp = { 1, 1, 1, 0 }, .hdiv = 4, .vdiv = 4 }, { .format = V4L2_PIX_FMT_YVU410, .pixel_enc = V4L2_PIXEL_ENC_YUV, .mem_planes = 1, .comp_planes = 3, .bpp = { 1, 1, 1, 0 }, .hdiv = 4, .vdiv = 4 }, @@ -292,6 +293,7 @@ const struct v4l2_format_info *v4l2_format_info(u32 format) { .format = V4L2_PIX_FMT_NV21M, .pixel_enc = V4L2_PIXEL_ENC_YUV, .mem_planes = 2, .comp_planes = 2, .bpp = { 1, 2, 0, 0 }, .hdiv = 2, .vdiv = 2 }, { .format = V4L2_PIX_FMT_NV16M, .pixel_enc = V4L2_PIXEL_ENC_YUV, .mem_planes = 2, .comp_planes = 2, .bpp = { 1, 2, 0, 0 }, .hdiv = 2, .vdiv = 1 }, { .format = V4L2_PIX_FMT_NV61M, .pixel_enc = V4L2_PIXEL_ENC_YUV, .mem_planes = 2, .comp_planes = 2, .bpp = { 1, 2, 0, 0 }, .hdiv = 2, .vdiv = 1 }, + { .format = V4L2_PIX_FMT_P012M, .pixel_enc = V4L2_PIXEL_ENC_YUV, .mem_planes = 2, .comp_planes = 2, .bpp = { 2, 4, 0, 0 }, .hdiv = 2, .vdiv = 2 }, /* Bayer RGB formats */ { .format = V4L2_PIX_FMT_SBGGR8, .pixel_enc = V4L2_PIXEL_ENC_BAYER, .mem_planes = 1, .comp_planes = 1, .bpp = { 1, 0, 0, 0 }, .hdiv = 1, .vdiv = 1 }, diff --git a/drivers/media/v4l2-core/v4l2-ioctl.c b/drivers/media/v4l2-core/v4l2-ioctl.c index 91ae25e092e2..15fba2e074f4 100644 --- a/drivers/media/v4l2-core/v4l2-ioctl.c +++ b/drivers/media/v4l2-core/v4l2-ioctl.c @@ -1354,6 +1354,7 @@ static void v4l_fill_fmtdesc(struct v4l2_fmtdesc *fmt) case V4L2_PIX_FMT_NV24: descr = "Y/UV 4:4:4"; break; case V4L2_PIX_FMT_NV42: descr = "Y/VU 4:4:4"; break; case V4L2_PIX_FMT_P010: descr = "10-bit Y/UV 4:2:0"; break; + case V4L2_PIX_FMT_P012: descr = "12-bit Y/UV 4:2:0"; break; case V4L2_PIX_FMT_NV12_4L4: descr = "Y/UV 4:2:0 (4x4 Linear)"; break; case V4L2_PIX_FMT_NV12_16L16: descr = "Y/UV 4:2:0 (16x16 Linear)"; break; case V4L2_PIX_FMT_NV12_32L32: descr = "Y/UV 4:2:0 (32x32 Linear)"; break; @@ -1364,6 +1365,7 @@ static void v4l_fill_fmtdesc(struct v4l2_fmtdesc *fmt) case V4L2_PIX_FMT_NV61M: descr = "Y/VU 4:2:2 (N-C)"; break; case V4L2_PIX_FMT_NV12MT: descr = "Y/UV 4:2:0 (64x32 MB, N-C)"; break; case V4L2_PIX_FMT_NV12MT_16X16: descr = "Y/UV 4:2:0 (16x16 MB, N-C)"; break; + case V4L2_PIX_FMT_P012M: descr = "12-bit Y/UV 4:2:0 (N-C)"; break; case V4L2_PIX_FMT_YUV420M: descr = "Planar YUV 4:2:0 (N-C)"; break; case V4L2_PIX_FMT_YVU420M: descr = "Planar YVU 4:2:0 (N-C)"; break; case V4L2_PIX_FMT_YUV422M: descr = "Planar YUV 4:2:2 (N-C)"; break; diff --git a/include/uapi/linux/videodev2.h b/include/uapi/linux/videodev2.h index d67a7ff0da9a..2f121ada6c31 100644 --- a/include/uapi/linux/videodev2.h +++ b/include/uapi/linux/videodev2.h @@ -626,12 +626,14 @@ struct v4l2_pix_format { #define V4L2_PIX_FMT_NV24 v4l2_fourcc('N', 'V', '2', '4') /* 24 Y/CbCr 4:4:4 */ #define V4L2_PIX_FMT_NV42 v4l2_fourcc('N', 'V', '4', '2') /* 24 Y/CrCb 4:4:4 */ #define V4L2_PIX_FMT_P010 v4l2_fourcc('P', '0', '1', '0') /* 24 Y/CbCr 4:2:0 10-bit per component */ +#define V4L2_PIX_FMT_P012 v4l2_fourcc('P', '0', '1', '2') /* 24 Y/CbCr 4:2:0 12-bit per component */ /* two non contiguous planes - one Y, one Cr + Cb interleaved */ #define V4L2_PIX_FMT_NV12M v4l2_fourcc('N', 'M', '1', '2') /* 12 Y/CbCr 4:2:0 */ #define V4L2_PIX_FMT_NV21M v4l2_fourcc('N', 'M', '2', '1') /* 21 Y/CrCb 4:2:0 */ #define V4L2_PIX_FMT_NV16M v4l2_fourcc('N', 'M', '1', '6') /* 16 Y/CbCr 4:2:2 */ #define V4L2_PIX_FMT_NV61M v4l2_fourcc('N', 'M', '6', '1') /* 16 Y/CrCb 4:2:2 */ +#define V4L2_PIX_FMT_P012M v4l2_fourcc('P', 'M', '1', '2') /* 24 Y/CbCr 4:2:0 12-bit per component */ /* three planes - Y Cb, Cr */ #define V4L2_PIX_FMT_YUV410 v4l2_fourcc('Y', 'U', 'V', '9') /* 9 YUV 4:1:0 */ From ca7b45b12894126ffa637c5ebf57153348831f55 Mon Sep 17 00:00:00 2001 From: Ming Qian Date: Wed, 22 Mar 2023 05:13:05 +0000 Subject: [PATCH 81/98] UPSTREAM: media: Add Y012 video format Y012 is a luma-only formats with 12-bits per pixel, expanded to 16bits. Data in the 12 high bits, zeros in the 4 low bits, arranged in little endian order. Bug: 293213303 Change-Id: I1a8f73162932e0760aabbe44525d7c74ace9f7bd (cherry picked from commit a490ea68444084ec0368c019e11ee4a7e5c8bb13) Signed-off-by: Ming Qian Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jindong Yue --- .../userspace-api/media/v4l/pixfmt-yuv-luma.rst | 15 +++++++++++++++ drivers/media/v4l2-core/v4l2-ioctl.c | 1 + include/uapi/linux/videodev2.h | 1 + 3 files changed, 17 insertions(+) diff --git a/Documentation/userspace-api/media/v4l/pixfmt-yuv-luma.rst b/Documentation/userspace-api/media/v4l/pixfmt-yuv-luma.rst index 6a387f9df3ba..26fd46fa4971 100644 --- a/Documentation/userspace-api/media/v4l/pixfmt-yuv-luma.rst +++ b/Documentation/userspace-api/media/v4l/pixfmt-yuv-luma.rst @@ -103,6 +103,17 @@ are often referred to as greyscale formats. - ... - ... + * .. _V4L2-PIX-FMT-Y012: + + - ``V4L2_PIX_FMT_Y012`` + - 'Y012' + + - Y'\ :sub:`0`\ [3:0] `0000` + - Y'\ :sub:`0`\ [11:4] + - ... + - ... + - ... + * .. _V4L2-PIX-FMT-Y14: - ``V4L2_PIX_FMT_Y14`` @@ -146,3 +157,7 @@ are often referred to as greyscale formats. than 16 bits. For example, 10 bits per pixel uses values in the range 0 to 1023. For the IPU3_Y10 format 25 pixels are packed into 32 bytes, which leaves the 6 most significant bits of the last byte padded with 0. + + For Y012 and Y12 formats, Y012 places its data in the 12 high bits, with + padding zeros in the 4 low bits, in contrast to the Y12 format, which has + its padding located in the most significant bits of the 16 bit word. diff --git a/drivers/media/v4l2-core/v4l2-ioctl.c b/drivers/media/v4l2-core/v4l2-ioctl.c index 15fba2e074f4..5393e07fdfba 100644 --- a/drivers/media/v4l2-core/v4l2-ioctl.c +++ b/drivers/media/v4l2-core/v4l2-ioctl.c @@ -1309,6 +1309,7 @@ static void v4l_fill_fmtdesc(struct v4l2_fmtdesc *fmt) case V4L2_PIX_FMT_Y6: descr = "6-bit Greyscale"; break; case V4L2_PIX_FMT_Y10: descr = "10-bit Greyscale"; break; case V4L2_PIX_FMT_Y12: descr = "12-bit Greyscale"; break; + case V4L2_PIX_FMT_Y012: descr = "12-bit Greyscale (bits 15-4)"; break; case V4L2_PIX_FMT_Y14: descr = "14-bit Greyscale"; break; case V4L2_PIX_FMT_Y16: descr = "16-bit Greyscale"; break; case V4L2_PIX_FMT_Y16_BE: descr = "16-bit Greyscale BE"; break; diff --git a/include/uapi/linux/videodev2.h b/include/uapi/linux/videodev2.h index 2f121ada6c31..4a78d1bec619 100644 --- a/include/uapi/linux/videodev2.h +++ b/include/uapi/linux/videodev2.h @@ -583,6 +583,7 @@ struct v4l2_pix_format { #define V4L2_PIX_FMT_Y6 v4l2_fourcc('Y', '0', '6', ' ') /* 6 Greyscale */ #define V4L2_PIX_FMT_Y10 v4l2_fourcc('Y', '1', '0', ' ') /* 10 Greyscale */ #define V4L2_PIX_FMT_Y12 v4l2_fourcc('Y', '1', '2', ' ') /* 12 Greyscale */ +#define V4L2_PIX_FMT_Y012 v4l2_fourcc('Y', '0', '1', '2') /* 12 Greyscale */ #define V4L2_PIX_FMT_Y14 v4l2_fourcc('Y', '1', '4', ' ') /* 14 Greyscale */ #define V4L2_PIX_FMT_Y16 v4l2_fourcc('Y', '1', '6', ' ') /* 16 Greyscale */ #define V4L2_PIX_FMT_Y16_BE v4l2_fourcc_be('Y', '1', '6', ' ') /* 16 Greyscale BE */ From 0f3f7a21aff380830d4b1c1224a8a3b55ef64524 Mon Sep 17 00:00:00 2001 From: Tomi Valkeinen Date: Wed, 21 Dec 2022 11:24:43 +0200 Subject: [PATCH 82/98] UPSTREAM: media: Add Y210, Y212 and Y216 formats Add Y210, Y212 and Y216 formats. Bug: 293213303 Change-Id: I2d580dd82481f6a1364dfcedfd918e82d25ac211 (cherry picked from commit 0dc1d7a79a8d13e316d3b168e9fc57e376099c7a) Signed-off-by: Tomi Valkeinen Reviewed-by: Laurent Pinchart Acked-by: Mauro Carvalho Chehab Acked-by: Hans Verkuil Signed-off-by: Laurent Pinchart Signed-off-by: Jindong Yue --- .../media/v4l/pixfmt-packed-yuv.rst | 49 ++++++++++++++++++- drivers/media/v4l2-core/v4l2-ioctl.c | 3 ++ include/uapi/linux/videodev2.h | 8 +++ 3 files changed, 58 insertions(+), 2 deletions(-) diff --git a/Documentation/userspace-api/media/v4l/pixfmt-packed-yuv.rst b/Documentation/userspace-api/media/v4l/pixfmt-packed-yuv.rst index bf283a1b5581..24a771542059 100644 --- a/Documentation/userspace-api/media/v4l/pixfmt-packed-yuv.rst +++ b/Documentation/userspace-api/media/v4l/pixfmt-packed-yuv.rst @@ -262,7 +262,12 @@ the second byte and Y'\ :sub:`7-0` in the third byte. ================= These formats, commonly referred to as YUYV or YUY2, subsample the chroma -components horizontally by 2, storing 2 pixels in 4 bytes. +components horizontally by 2, storing 2 pixels in a container. The container +is 32-bits for 8-bit formats, and 64-bits for 10+-bit formats. + +The packed YUYV formats with more than 8 bits per component are stored as four +16-bit little-endian words. Each word's most significant bits contain one +component, and the least significant bits are zero padding. .. raw:: latex @@ -270,7 +275,7 @@ components horizontally by 2, storing 2 pixels in 4 bytes. .. tabularcolumns:: |p{3.4cm}|p{1.2cm}|p{0.8cm}|p{0.8cm}|p{0.8cm}|p{0.8cm}|p{0.8cm}|p{0.8cm}|p{0.8cm}|p{0.8cm}| -.. flat-table:: Packed YUV 4:2:2 Formats +.. flat-table:: Packed YUV 4:2:2 Formats in 32-bit container :header-rows: 1 :stub-columns: 0 @@ -337,6 +342,46 @@ components horizontally by 2, storing 2 pixels in 4 bytes. - Y'\ :sub:`3` - Cb\ :sub:`2` +.. tabularcolumns:: |p{3.4cm}|p{1.2cm}|p{0.8cm}|p{0.8cm}|p{0.8cm}|p{0.8cm}|p{0.8cm}|p{0.8cm}|p{0.8cm}|p{0.8cm}| + +.. flat-table:: Packed YUV 4:2:2 Formats in 64-bit container + :header-rows: 1 + :stub-columns: 0 + + * - Identifier + - Code + - Word 0 + - Word 1 + - Word 2 + - Word 3 + * .. _V4L2-PIX-FMT-Y210: + + - ``V4L2_PIX_FMT_Y210`` + - 'Y210' + + - Y'\ :sub:`0` (bits 15-6) + - Cb\ :sub:`0` (bits 15-6) + - Y'\ :sub:`1` (bits 15-6) + - Cr\ :sub:`0` (bits 15-6) + * .. _V4L2-PIX-FMT-Y212: + + - ``V4L2_PIX_FMT_Y212`` + - 'Y212' + + - Y'\ :sub:`0` (bits 15-4) + - Cb\ :sub:`0` (bits 15-4) + - Y'\ :sub:`1` (bits 15-4) + - Cr\ :sub:`0` (bits 15-4) + * .. _V4L2-PIX-FMT-Y216: + + - ``V4L2_PIX_FMT_Y216`` + - 'Y216' + + - Y'\ :sub:`0` (bits 15-0) + - Cb\ :sub:`0` (bits 15-0) + - Y'\ :sub:`1` (bits 15-0) + - Cr\ :sub:`0` (bits 15-0) + .. raw:: latex \normalsize diff --git a/drivers/media/v4l2-core/v4l2-ioctl.c b/drivers/media/v4l2-core/v4l2-ioctl.c index 5393e07fdfba..69a7afcb59da 100644 --- a/drivers/media/v4l2-core/v4l2-ioctl.c +++ b/drivers/media/v4l2-core/v4l2-ioctl.c @@ -1451,6 +1451,9 @@ static void v4l_fill_fmtdesc(struct v4l2_fmtdesc *fmt) case V4L2_PIX_FMT_NV12M_8L128: descr = "NV12M (8x128 Linear)"; break; case V4L2_PIX_FMT_NV12_10BE_8L128: descr = "10-bit NV12 (8x128 Linear, BE)"; break; case V4L2_PIX_FMT_NV12M_10BE_8L128: descr = "10-bit NV12M (8x128 Linear, BE)"; break; + case V4L2_PIX_FMT_Y210: descr = "10-bit YUYV Packed"; break; + case V4L2_PIX_FMT_Y212: descr = "12-bit YUYV Packed"; break; + case V4L2_PIX_FMT_Y216: descr = "16-bit YUYV Packed"; break; default: /* Compressed formats */ diff --git a/include/uapi/linux/videodev2.h b/include/uapi/linux/videodev2.h index 4a78d1bec619..1b5a20bb54bf 100644 --- a/include/uapi/linux/videodev2.h +++ b/include/uapi/linux/videodev2.h @@ -619,6 +619,14 @@ struct v4l2_pix_format { #define V4L2_PIX_FMT_YUVX32 v4l2_fourcc('Y', 'U', 'V', 'X') /* 32 YUVX-8-8-8-8 */ #define V4L2_PIX_FMT_M420 v4l2_fourcc('M', '4', '2', '0') /* 12 YUV 4:2:0 2 lines y, 1 line uv interleaved */ +/* + * YCbCr packed format. For each Y2xx format, xx bits of valid data occupy the MSBs + * of the 16 bit components, and 16-xx bits of zero padding occupy the LSBs. + */ +#define V4L2_PIX_FMT_Y210 v4l2_fourcc('Y', '2', '1', '0') /* 32 YUYV 4:2:2 */ +#define V4L2_PIX_FMT_Y212 v4l2_fourcc('Y', '2', '1', '2') /* 32 YUYV 4:2:2 */ +#define V4L2_PIX_FMT_Y216 v4l2_fourcc('Y', '2', '1', '6') /* 32 YUYV 4:2:2 */ + /* two planes -- one Y, one Cr + Cb interleaved */ #define V4L2_PIX_FMT_NV12 v4l2_fourcc('N', 'V', '1', '2') /* 12 Y/CbCr 4:2:0 */ #define V4L2_PIX_FMT_NV21 v4l2_fourcc('N', 'V', '2', '1') /* 12 Y/CrCb 4:2:0 */ From b2cf7e426877526a9b58741261e529c8689b6dd1 Mon Sep 17 00:00:00 2001 From: Ming Qian Date: Wed, 22 Mar 2023 05:13:06 +0000 Subject: [PATCH 83/98] UPSTREAM: media: Add Y212 v4l2 format info Y212 is a YUV format with 12-bits per component like YUYV, expanded to 16bits. Data in the 12 high bits, zeros in the 4 low bits, arranged in little endian order. Add the missing v4l2 foramt info of Y212 Bug: 293213303 Change-Id: Ibdf9bb3a3f1eb895da9eca52d115e08b656b5153 (cherry picked from commit a178dd3bbecc3e26dfc2c72b6fe64d9bf7749de2) Signed-off-by: Ming Qian Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jindong Yue --- drivers/media/v4l2-core/v4l2-common.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/media/v4l2-core/v4l2-common.c b/drivers/media/v4l2-core/v4l2-common.c index a5e8ba370d33..21ace56fac04 100644 --- a/drivers/media/v4l2-core/v4l2-common.c +++ b/drivers/media/v4l2-core/v4l2-common.c @@ -258,6 +258,7 @@ const struct v4l2_format_info *v4l2_format_info(u32 format) { .format = V4L2_PIX_FMT_YVYU, .pixel_enc = V4L2_PIXEL_ENC_YUV, .mem_planes = 1, .comp_planes = 1, .bpp = { 2, 0, 0, 0 }, .hdiv = 2, .vdiv = 1 }, { .format = V4L2_PIX_FMT_UYVY, .pixel_enc = V4L2_PIXEL_ENC_YUV, .mem_planes = 1, .comp_planes = 1, .bpp = { 2, 0, 0, 0 }, .hdiv = 2, .vdiv = 1 }, { .format = V4L2_PIX_FMT_VYUY, .pixel_enc = V4L2_PIXEL_ENC_YUV, .mem_planes = 1, .comp_planes = 1, .bpp = { 2, 0, 0, 0 }, .hdiv = 2, .vdiv = 1 }, + { .format = V4L2_PIX_FMT_Y212, .pixel_enc = V4L2_PIXEL_ENC_YUV, .mem_planes = 1, .comp_planes = 1, .bpp = { 4, 0, 0, 0 }, .hdiv = 2, .vdiv = 1 }, /* YUV planar formats */ { .format = V4L2_PIX_FMT_NV12, .pixel_enc = V4L2_PIXEL_ENC_YUV, .mem_planes = 1, .comp_planes = 2, .bpp = { 1, 2, 0, 0 }, .hdiv = 2, .vdiv = 2 }, From 892293272c10c65024c6c8bb50d18ade089f75f4 Mon Sep 17 00:00:00 2001 From: Ming Qian Date: Wed, 22 Mar 2023 05:13:07 +0000 Subject: [PATCH 84/98] UPSTREAM: media: Add YUV48_12 video format YUV48_12 is a YUV format with 12-bits per component like YUV24, expanded to 16bits. Data in the 12 high bits, zeros in the 4 low bits, arranged in little endian order. [hverkuil: replaced a . by ,] Bug: 293213303 Change-Id: I12e6f02b99918a429224320da2127d6b4d777584 (cherry picked from commit 99c954967762976b15265ea383354095e1ed1efa) Signed-off-by: Ming Qian Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jindong Yue --- .../media/v4l/pixfmt-packed-yuv.rst | 28 +++++++++++++++++++ drivers/media/v4l2-core/v4l2-common.c | 1 + drivers/media/v4l2-core/v4l2-ioctl.c | 1 + include/uapi/linux/videodev2.h | 1 + 4 files changed, 31 insertions(+) diff --git a/Documentation/userspace-api/media/v4l/pixfmt-packed-yuv.rst b/Documentation/userspace-api/media/v4l/pixfmt-packed-yuv.rst index 24a771542059..9f111ed594d2 100644 --- a/Documentation/userspace-api/media/v4l/pixfmt-packed-yuv.rst +++ b/Documentation/userspace-api/media/v4l/pixfmt-packed-yuv.rst @@ -257,6 +257,34 @@ the second byte and Y'\ :sub:`7-0` in the third byte. - The padding bits contain undefined values that must be ignored by all applications and drivers. +The next table lists the packed YUV 4:4:4 formats with 12 bits per component. +Expand the bits per component to 16 bits, data in the high bits, zeros in the low bits, +arranged in little endian order, storing 1 pixel in 6 bytes. + +.. flat-table:: Packed YUV 4:4:4 Image Formats (12bpc) + :header-rows: 1 + :stub-columns: 0 + + * - Identifier + - Code + - Byte 1-0 + - Byte 3-2 + - Byte 5-4 + - Byte 7-6 + - Byte 9-8 + - Byte 11-10 + + * .. _V4L2-PIX-FMT-YUV48-12: + + - ``V4L2_PIX_FMT_YUV48_12`` + - 'Y312' + + - Y'\ :sub:`0` + - Cb\ :sub:`0` + - Cr\ :sub:`0` + - Y'\ :sub:`1` + - Cb\ :sub:`1` + - Cr\ :sub:`1` 4:2:2 Subsampling ================= diff --git a/drivers/media/v4l2-core/v4l2-common.c b/drivers/media/v4l2-core/v4l2-common.c index 21ace56fac04..da313a0637de 100644 --- a/drivers/media/v4l2-core/v4l2-common.c +++ b/drivers/media/v4l2-core/v4l2-common.c @@ -259,6 +259,7 @@ const struct v4l2_format_info *v4l2_format_info(u32 format) { .format = V4L2_PIX_FMT_UYVY, .pixel_enc = V4L2_PIXEL_ENC_YUV, .mem_planes = 1, .comp_planes = 1, .bpp = { 2, 0, 0, 0 }, .hdiv = 2, .vdiv = 1 }, { .format = V4L2_PIX_FMT_VYUY, .pixel_enc = V4L2_PIXEL_ENC_YUV, .mem_planes = 1, .comp_planes = 1, .bpp = { 2, 0, 0, 0 }, .hdiv = 2, .vdiv = 1 }, { .format = V4L2_PIX_FMT_Y212, .pixel_enc = V4L2_PIXEL_ENC_YUV, .mem_planes = 1, .comp_planes = 1, .bpp = { 4, 0, 0, 0 }, .hdiv = 2, .vdiv = 1 }, + { .format = V4L2_PIX_FMT_YUV48_12, .pixel_enc = V4L2_PIXEL_ENC_YUV, .mem_planes = 1, .comp_planes = 1, .bpp = { 6, 0, 0, 0 }, .hdiv = 1, .vdiv = 1 }, /* YUV planar formats */ { .format = V4L2_PIX_FMT_NV12, .pixel_enc = V4L2_PIXEL_ENC_YUV, .mem_planes = 1, .comp_planes = 2, .bpp = { 1, 2, 0, 0 }, .hdiv = 2, .vdiv = 2 }, diff --git a/drivers/media/v4l2-core/v4l2-ioctl.c b/drivers/media/v4l2-core/v4l2-ioctl.c index 69a7afcb59da..508854959135 100644 --- a/drivers/media/v4l2-core/v4l2-ioctl.c +++ b/drivers/media/v4l2-core/v4l2-ioctl.c @@ -1348,6 +1348,7 @@ static void v4l_fill_fmtdesc(struct v4l2_fmtdesc *fmt) case V4L2_PIX_FMT_YUV420: descr = "Planar YUV 4:2:0"; break; case V4L2_PIX_FMT_HI240: descr = "8-bit Dithered RGB (BTTV)"; break; case V4L2_PIX_FMT_M420: descr = "YUV 4:2:0 (M420)"; break; + case V4L2_PIX_FMT_YUV48_12: descr = "12-bit YUV 4:4:4 Packed"; break; case V4L2_PIX_FMT_NV12: descr = "Y/UV 4:2:0"; break; case V4L2_PIX_FMT_NV21: descr = "Y/VU 4:2:0"; break; case V4L2_PIX_FMT_NV16: descr = "Y/UV 4:2:2"; break; diff --git a/include/uapi/linux/videodev2.h b/include/uapi/linux/videodev2.h index 1b5a20bb54bf..f3ee34d37e75 100644 --- a/include/uapi/linux/videodev2.h +++ b/include/uapi/linux/videodev2.h @@ -618,6 +618,7 @@ struct v4l2_pix_format { #define V4L2_PIX_FMT_YUVA32 v4l2_fourcc('Y', 'U', 'V', 'A') /* 32 YUVA-8-8-8-8 */ #define V4L2_PIX_FMT_YUVX32 v4l2_fourcc('Y', 'U', 'V', 'X') /* 32 YUVX-8-8-8-8 */ #define V4L2_PIX_FMT_M420 v4l2_fourcc('M', '4', '2', '0') /* 12 YUV 4:2:0 2 lines y, 1 line uv interleaved */ +#define V4L2_PIX_FMT_YUV48_12 v4l2_fourcc('Y', '3', '1', '2') /* 48 YUV 4:4:4 12-bit per component */ /* * YCbCr packed format. For each Y2xx format, xx bits of valid data occupy the MSBs From 86e2e8fd053e50693a7c3f1b1230dded1b322381 Mon Sep 17 00:00:00 2001 From: Ming Qian Date: Wed, 22 Mar 2023 05:13:08 +0000 Subject: [PATCH 85/98] BACKPORT: media: Add BGR48_12 video format BGR48_12 is a reversed RGB format with 12 bits per component like BGR24, expanded to 16bits. Data in the 12 high bits, zeros in the 4 low bits, arranged in little endian order. Bug: 293213303 Change-Id: I27d14a33c8e2b4847a63ea05b285786766949ebf (cherry picked from commit da0b7a400e4f39726c3c383f377fb51dbd8b0c71) [Jindong: Fixed conflicts in .rst file and v4l2-ioctl.c] Signed-off-by: Ming Qian Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jindong Yue --- .../userspace-api/media/v4l/pixfmt-rgb.rst | 33 +++++++++++++++++++ drivers/media/v4l2-core/v4l2-common.c | 1 + drivers/media/v4l2-core/v4l2-ioctl.c | 1 + include/uapi/linux/videodev2.h | 3 ++ 4 files changed, 38 insertions(+) diff --git a/Documentation/userspace-api/media/v4l/pixfmt-rgb.rst b/Documentation/userspace-api/media/v4l/pixfmt-rgb.rst index 30f51cd33f99..aadcfeea8b06 100644 --- a/Documentation/userspace-api/media/v4l/pixfmt-rgb.rst +++ b/Documentation/userspace-api/media/v4l/pixfmt-rgb.rst @@ -762,6 +762,39 @@ nomenclature that instead use the order of components as seen in a 24- or \normalsize +12 Bits Per Component +============================== + +These formats store an RGB triplet in six or eight bytes, with 12 bits per component. +Expand the bits per component to 16 bits, data in the high bits, zeros in the low bits, +arranged in little endian order. + +.. raw:: latex + + \small + +.. flat-table:: RGB Formats With 12 Bits Per Component + :header-rows: 1 + + * - Identifier + - Code + - Byte 1-0 + - Byte 3-2 + - Byte 5-4 + - Byte 7-6 + * .. _V4L2-PIX-FMT-BGR48-12: + + - ``V4L2_PIX_FMT_BGR48_12`` + - 'B312' + + - B\ :sub:`15-4` + - G\ :sub:`15-4` + - R\ :sub:`15-4` + - + +.. raw:: latex + + \normalsize Deprecated RGB Formats ====================== diff --git a/drivers/media/v4l2-core/v4l2-common.c b/drivers/media/v4l2-core/v4l2-common.c index da313a0637de..16d3c91c7da2 100644 --- a/drivers/media/v4l2-core/v4l2-common.c +++ b/drivers/media/v4l2-core/v4l2-common.c @@ -252,6 +252,7 @@ const struct v4l2_format_info *v4l2_format_info(u32 format) { .format = V4L2_PIX_FMT_RGB565, .pixel_enc = V4L2_PIXEL_ENC_RGB, .mem_planes = 1, .comp_planes = 1, .bpp = { 2, 0, 0, 0 }, .hdiv = 1, .vdiv = 1 }, { .format = V4L2_PIX_FMT_RGB555, .pixel_enc = V4L2_PIXEL_ENC_RGB, .mem_planes = 1, .comp_planes = 1, .bpp = { 2, 0, 0, 0 }, .hdiv = 1, .vdiv = 1 }, { .format = V4L2_PIX_FMT_BGR666, .pixel_enc = V4L2_PIXEL_ENC_RGB, .mem_planes = 1, .comp_planes = 1, .bpp = { 4, 0, 0, 0 }, .hdiv = 1, .vdiv = 1 }, + { .format = V4L2_PIX_FMT_BGR48_12, .pixel_enc = V4L2_PIXEL_ENC_RGB, .mem_planes = 1, .comp_planes = 1, .bpp = { 6, 0, 0, 0 }, .hdiv = 1, .vdiv = 1 }, /* YUV packed formats */ { .format = V4L2_PIX_FMT_YUYV, .pixel_enc = V4L2_PIXEL_ENC_YUV, .mem_planes = 1, .comp_planes = 1, .bpp = { 2, 0, 0, 0 }, .hdiv = 2, .vdiv = 1 }, diff --git a/drivers/media/v4l2-core/v4l2-ioctl.c b/drivers/media/v4l2-core/v4l2-ioctl.c index 508854959135..0b00530a29ac 100644 --- a/drivers/media/v4l2-core/v4l2-ioctl.c +++ b/drivers/media/v4l2-core/v4l2-ioctl.c @@ -1304,6 +1304,7 @@ static void v4l_fill_fmtdesc(struct v4l2_fmtdesc *fmt) case V4L2_PIX_FMT_BGRX32: descr = "32-bit XBGR 8-8-8-8"; break; case V4L2_PIX_FMT_RGBA32: descr = "32-bit RGBA 8-8-8-8"; break; case V4L2_PIX_FMT_RGBX32: descr = "32-bit RGBX 8-8-8-8"; break; + case V4L2_PIX_FMT_BGR48_12: descr = "12-bit Depth BGR"; break; case V4L2_PIX_FMT_GREY: descr = "8-bit Greyscale"; break; case V4L2_PIX_FMT_Y4: descr = "4-bit Greyscale"; break; case V4L2_PIX_FMT_Y6: descr = "6-bit Greyscale"; break; diff --git a/include/uapi/linux/videodev2.h b/include/uapi/linux/videodev2.h index f3ee34d37e75..a8b7071e0416 100644 --- a/include/uapi/linux/videodev2.h +++ b/include/uapi/linux/videodev2.h @@ -577,6 +577,9 @@ struct v4l2_pix_format { #define V4L2_PIX_FMT_ARGB32 v4l2_fourcc('B', 'A', '2', '4') /* 32 ARGB-8-8-8-8 */ #define V4L2_PIX_FMT_XRGB32 v4l2_fourcc('B', 'X', '2', '4') /* 32 XRGB-8-8-8-8 */ +/* RGB formats (6 or 8 bytes per pixel) */ +#define V4L2_PIX_FMT_BGR48_12 v4l2_fourcc('B', '3', '1', '2') /* 48 BGR 12-bit per component */ + /* Grey formats */ #define V4L2_PIX_FMT_GREY v4l2_fourcc('G', 'R', 'E', 'Y') /* 8 Greyscale */ #define V4L2_PIX_FMT_Y4 v4l2_fourcc('Y', '0', '4', ' ') /* 4 Greyscale */ From 126ef64cbaae66a10171e8aecbe4327f677e0ab2 Mon Sep 17 00:00:00 2001 From: Ming Qian Date: Wed, 22 Mar 2023 05:13:09 +0000 Subject: [PATCH 86/98] UPSTREAM: media: Add ABGR64_12 video format ABGR64_12 is a reversed RGB format with alpha channel last, 12 bits per component like ABGR32, expanded to 16bits. Data in the 12 high bits, zeros in the 4 low bits, arranged in little endian order. Bug: 293213303 Change-Id: Idc4e1100c9e2134a48b594151e3398f6436b010d (cherry picked from commit 302b988ca03d83da0a7e006a57efda646c30f978) Signed-off-by: Ming Qian Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jindong Yue --- Documentation/userspace-api/media/v4l/pixfmt-rgb.rst | 9 +++++++++ drivers/media/v4l2-core/v4l2-common.c | 1 + drivers/media/v4l2-core/v4l2-ioctl.c | 1 + include/uapi/linux/videodev2.h | 1 + 4 files changed, 12 insertions(+) diff --git a/Documentation/userspace-api/media/v4l/pixfmt-rgb.rst b/Documentation/userspace-api/media/v4l/pixfmt-rgb.rst index aadcfeea8b06..4b8cbbc77b1b 100644 --- a/Documentation/userspace-api/media/v4l/pixfmt-rgb.rst +++ b/Documentation/userspace-api/media/v4l/pixfmt-rgb.rst @@ -791,6 +791,15 @@ arranged in little endian order. - G\ :sub:`15-4` - R\ :sub:`15-4` - + * .. _V4L2-PIX-FMT-ABGR64-12: + + - ``V4L2_PIX_FMT_ABGR64_12`` + - 'B412' + + - B\ :sub:`15-4` + - G\ :sub:`15-4` + - R\ :sub:`15-4` + - A\ :sub:`15-4` .. raw:: latex diff --git a/drivers/media/v4l2-core/v4l2-common.c b/drivers/media/v4l2-core/v4l2-common.c index 16d3c91c7da2..3c5ab5ecd678 100644 --- a/drivers/media/v4l2-core/v4l2-common.c +++ b/drivers/media/v4l2-core/v4l2-common.c @@ -253,6 +253,7 @@ const struct v4l2_format_info *v4l2_format_info(u32 format) { .format = V4L2_PIX_FMT_RGB555, .pixel_enc = V4L2_PIXEL_ENC_RGB, .mem_planes = 1, .comp_planes = 1, .bpp = { 2, 0, 0, 0 }, .hdiv = 1, .vdiv = 1 }, { .format = V4L2_PIX_FMT_BGR666, .pixel_enc = V4L2_PIXEL_ENC_RGB, .mem_planes = 1, .comp_planes = 1, .bpp = { 4, 0, 0, 0 }, .hdiv = 1, .vdiv = 1 }, { .format = V4L2_PIX_FMT_BGR48_12, .pixel_enc = V4L2_PIXEL_ENC_RGB, .mem_planes = 1, .comp_planes = 1, .bpp = { 6, 0, 0, 0 }, .hdiv = 1, .vdiv = 1 }, + { .format = V4L2_PIX_FMT_ABGR64_12, .pixel_enc = V4L2_PIXEL_ENC_RGB, .mem_planes = 1, .comp_planes = 1, .bpp = { 8, 0, 0, 0 }, .hdiv = 1, .vdiv = 1 }, /* YUV packed formats */ { .format = V4L2_PIX_FMT_YUYV, .pixel_enc = V4L2_PIXEL_ENC_YUV, .mem_planes = 1, .comp_planes = 1, .bpp = { 2, 0, 0, 0 }, .hdiv = 2, .vdiv = 1 }, diff --git a/drivers/media/v4l2-core/v4l2-ioctl.c b/drivers/media/v4l2-core/v4l2-ioctl.c index 0b00530a29ac..3a4785b3b59a 100644 --- a/drivers/media/v4l2-core/v4l2-ioctl.c +++ b/drivers/media/v4l2-core/v4l2-ioctl.c @@ -1305,6 +1305,7 @@ static void v4l_fill_fmtdesc(struct v4l2_fmtdesc *fmt) case V4L2_PIX_FMT_RGBA32: descr = "32-bit RGBA 8-8-8-8"; break; case V4L2_PIX_FMT_RGBX32: descr = "32-bit RGBX 8-8-8-8"; break; case V4L2_PIX_FMT_BGR48_12: descr = "12-bit Depth BGR"; break; + case V4L2_PIX_FMT_ABGR64_12: descr = "12-bit Depth BGRA"; break; case V4L2_PIX_FMT_GREY: descr = "8-bit Greyscale"; break; case V4L2_PIX_FMT_Y4: descr = "4-bit Greyscale"; break; case V4L2_PIX_FMT_Y6: descr = "6-bit Greyscale"; break; diff --git a/include/uapi/linux/videodev2.h b/include/uapi/linux/videodev2.h index a8b7071e0416..b43f3bbd55ee 100644 --- a/include/uapi/linux/videodev2.h +++ b/include/uapi/linux/videodev2.h @@ -579,6 +579,7 @@ struct v4l2_pix_format { /* RGB formats (6 or 8 bytes per pixel) */ #define V4L2_PIX_FMT_BGR48_12 v4l2_fourcc('B', '3', '1', '2') /* 48 BGR 12-bit per component */ +#define V4L2_PIX_FMT_ABGR64_12 v4l2_fourcc('B', '4', '1', '2') /* 64 BGRA 12-bit per component */ /* Grey formats */ #define V4L2_PIX_FMT_GREY v4l2_fourcc('G', 'R', 'E', 'Y') /* 8 Greyscale */ From ad0b008167cb40ec67be83937739e6ae5447e4bf Mon Sep 17 00:00:00 2001 From: sunshijie Date: Thu, 27 Jul 2023 11:50:56 +0800 Subject: [PATCH 87/98] FROMGIT: erofs: fix wrong primary bvec selection on deduplicated extents When handling deduplicated compressed data, there can be multiple decompressed extents pointing to the same compressed data in one shot. In such cases, the bvecs which belong to the longest extent will be selected as the primary bvecs for real decompressors to decode and the other duplicated bvecs will be directly copied from the primary bvecs. Previously, only relative offsets of the longest extent were checked to decompress the primary bvecs. On rare occasions, it can be incorrect if there are several extents with the same start relative offset. As a result, some short bvecs could be selected for decompression and then cause data corruption. For example, as Shijie Sun reported off-list, considering the following extents of a file: 117: 903345.. 915250 | 11905 : 385024.. 389120 | 4096 ... 119: 919729.. 930323 | 10594 : 385024.. 389120 | 4096 ... 124: 968881.. 980786 | 11905 : 385024.. 389120 | 4096 The start relative offset is the same: 2225, but extent 119 (919729.. 930323) is shorter than the others. Let's restrict the bvec length in addition to the start offset if bvecs are not full. Reported-by: Shijie Sun Fixes: 5c2a64252c5d ("erofs: introduce partial-referenced pclusters") Tested-by Shijie Sun Reviewed-by: Yue Hu Signed-off-by: Gao Xiang Link: https://lore.kernel.org/r/20230719065459.60083-1-hsiangkao@linux.alibaba.com (cherry picked from commit 7d15c91a75aae55767f368e8abbabd7cedf4ec94 https://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs.git dev) Bug: 293245292 Change-Id: Ic8ded9b2d3592ffd0863f4f0d2ac4ae6a1821a1b Signed-off-by: sunshijie --- fs/erofs/zdata.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/fs/erofs/zdata.c b/fs/erofs/zdata.c index bc4971ee26d2..3d1b88efb075 100644 --- a/fs/erofs/zdata.c +++ b/fs/erofs/zdata.c @@ -1013,9 +1013,11 @@ static void z_erofs_do_decompressed_bvec(struct z_erofs_decompress_backend *be, struct z_erofs_bvec *bvec) { struct z_erofs_bvec_item *item; + unsigned int pgnr; - if (!((bvec->offset + be->pcl->pageofs_out) & ~PAGE_MASK)) { - unsigned int pgnr; + if (!((bvec->offset + be->pcl->pageofs_out) & ~PAGE_MASK) && + (bvec->end == PAGE_SIZE || + bvec->offset + bvec->end == be->pcl->length)) { pgnr = (bvec->offset + be->pcl->pageofs_out) >> PAGE_SHIFT; DBG_BUGON(pgnr >= be->nr_pages); From 3bd3d137019f24d73379e14e9a5384cd72d567a6 Mon Sep 17 00:00:00 2001 From: Jindong Yue Date: Tue, 1 Aug 2023 17:49:42 +0900 Subject: [PATCH 88/98] ANDROID: ABI: Update symbol list for imx 2 function symbol(s) added 'bool kthread_freezable_should_stop(bool*)' 'int v4l2_enum_dv_timings_cap(struct v4l2_enum_dv_timings*, const struct v4l2_dv_timings_cap*, v4l2_check_dv_timings_fnc*, void*)' Bug: 283014063 Change-Id: Ib4f8f9c67277501dcaa2fa5d8f2867d5fa670de3 Signed-off-by: Jindong Yue --- android/abi_gki_aarch64.stg | 59 +++++++++++++++++++++++++++++++++++++ android/abi_gki_aarch64_imx | 19 ++++++++++++ 2 files changed, 78 insertions(+) diff --git a/android/abi_gki_aarch64.stg b/android/abi_gki_aarch64.stg index 8e0c51ae4146..ab918ec5c587 100644 --- a/android/abi_gki_aarch64.stg +++ b/android/abi_gki_aarch64.stg @@ -18091,6 +18091,11 @@ pointer_reference { kind: POINTER pointee_type_id: 0x9de31a69 } +pointer_reference { + id: 0x2de928d9 + kind: POINTER + pointee_type_id: 0x9de445fa +} pointer_reference { id: 0x2de9a54b kind: POINTER @@ -26806,6 +26811,11 @@ pointer_reference { kind: POINTER pointee_type_id: 0xc5725d9a } +pointer_reference { + id: 0x3bcd0c02 + kind: POINTER + pointee_type_id: 0xc574d697 +} pointer_reference { id: 0x3bd2bf42 kind: POINTER @@ -30356,6 +30366,11 @@ typedef { name: "uuid_t" referred_type_id: 0x0b526877 } +typedef { + id: 0x9de445fa + name: "v4l2_check_dv_timings_fnc" + referred_type_id: 0xf2553153 +} typedef { id: 0x7c355df7 name: "v4l2_ctrl_notify_fnc" @@ -30711,6 +30726,11 @@ qualified { qualifier: CONST qualified_type_id: 0x658ec0e0 } +qualified { + id: 0xc574d697 + qualifier: CONST + qualified_type_id: 0x6594ecd4 +} qualified { id: 0xc596e113 qualifier: CONST @@ -295072,6 +295092,14 @@ function { return_type_id: 0x6720d32f parameter_id: 0x34e62f02 } +function { + id: 0x90bd2dd7 + return_type_id: 0x6720d32f + parameter_id: 0x376789dd + parameter_id: 0x3bcd0c02 + parameter_id: 0x2de928d9 + parameter_id: 0x18bd6530 +} function { id: 0x90bfa7c3 return_type_id: 0x6720d32f @@ -318270,6 +318298,12 @@ function { return_type_id: 0x6d7f5ff6 parameter_id: 0x33d0e528 } +function { + id: 0xf2553153 + return_type_id: 0x6d7f5ff6 + parameter_id: 0x324e7f0f + parameter_id: 0x18bd6530 +} function { id: 0xf25d597f return_type_id: 0x6d7f5ff6 @@ -319009,6 +319043,11 @@ function { parameter_id: 0x11cfee5a parameter_id: 0x064d6086 } +function { + id: 0xfad7a092 + return_type_id: 0x6d7f5ff6 + parameter_id: 0x11cfee5a +} function { id: 0xfaddfa97 return_type_id: 0x6d7f5ff6 @@ -352419,6 +352458,15 @@ elf_symbol { type_id: 0x1dbb8bb2 full_name: "kthread_flush_worker" } +elf_symbol { + id: 0x2fbecafd + name: "kthread_freezable_should_stop" + is_defined: true + symbol_type: FUNCTION + crc: 0xca7d8764 + type_id: 0xfad7a092 + full_name: "kthread_freezable_should_stop" +} elf_symbol { id: 0x49232ca9 name: "kthread_mod_delayed_work" @@ -376938,6 +376986,15 @@ elf_symbol { type_id: 0x10e93841 full_name: "v4l2_device_unregister_subdev" } +elf_symbol { + id: 0x5c266e47 + name: "v4l2_enum_dv_timings_cap" + is_defined: true + symbol_type: FUNCTION + crc: 0x922ecd29 + type_id: 0x90bd2dd7 + full_name: "v4l2_enum_dv_timings_cap" +} elf_symbol { id: 0xd40ec4d6 name: "v4l2_event_dequeue" @@ -384066,6 +384123,7 @@ interface { symbol_id: 0xeae01788 symbol_id: 0x84839142 symbol_id: 0xa9c37a1d + symbol_id: 0x2fbecafd symbol_id: 0x49232ca9 symbol_id: 0xec609d3e symbol_id: 0x44f92a6d @@ -386791,6 +386849,7 @@ interface { symbol_id: 0xdc3fca57 symbol_id: 0x23051526 symbol_id: 0xad9b8781 + symbol_id: 0x5c266e47 symbol_id: 0xd40ec4d6 symbol_id: 0xcd00be9c symbol_id: 0xef302a24 diff --git a/android/abi_gki_aarch64_imx b/android/abi_gki_aarch64_imx index ac16191a3545..478cb5cab475 100644 --- a/android/abi_gki_aarch64_imx +++ b/android/abi_gki_aarch64_imx @@ -822,6 +822,7 @@ flush_delayed_work flush_work __flush_workqueue + __folio_put fortify_panic fput free_candev @@ -969,7 +970,9 @@ i2c_smbus_read_i2c_block_data i2c_smbus_write_byte i2c_smbus_write_byte_data + __i2c_smbus_xfer i2c_smbus_xfer + __i2c_transfer i2c_transfer i2c_transfer_buffer_flags i2c_unregister_device @@ -1143,6 +1146,7 @@ kstrtoull kthread_bind kthread_create_on_node + kthread_freezable_should_stop kthread_park kthread_parkme kthread_should_park @@ -1324,6 +1328,9 @@ nsecs_to_jiffies ns_to_timespec64 __num_online_cpus + nvmem_cell_get + nvmem_cell_put + nvmem_cell_read nvmem_cell_read_u32 nvmem_cell_read_u64 nvmem_device_read @@ -1377,6 +1384,7 @@ of_gen_pool_get of_get_child_by_name of_get_compatible_child + of_get_cpu_node of_get_display_timing of_get_i2c_adapter_by_node of_get_mac_address @@ -1442,6 +1450,8 @@ of_usb_update_otg_caps oops_in_progress open_candev + page_pinner_inited + __page_pinner_put_page page_pool_alloc_pages page_pool_create page_pool_destroy @@ -1586,6 +1596,7 @@ platform_irqchip_probe platform_irq_count platform_msi_create_irq_domain + pm_genpd_add_subdomain pm_genpd_init pm_genpd_remove pm_genpd_remove_device @@ -1597,6 +1608,7 @@ pm_runtime_forbid pm_runtime_force_resume pm_runtime_force_suspend + pm_runtime_get_if_active __pm_runtime_idle pm_runtime_no_callbacks __pm_runtime_resume @@ -1796,10 +1808,14 @@ rtc_time64_to_tm rtc_tm_to_time64 rtc_update_irq + rt_mutex_lock + rt_mutex_trylock + rt_mutex_unlock rtnl_is_locked rtnl_lock rtnl_unlock sched_clock + sched_setattr_nocheck sched_set_fifo_low schedule schedule_hrtimeout @@ -2248,6 +2264,7 @@ __v4l2_device_register_subdev_nodes v4l2_device_unregister v4l2_device_unregister_subdev + v4l2_enum_dv_timings_cap v4l2_event_dequeue v4l2_event_pending v4l2_event_queue @@ -2298,6 +2315,7 @@ v4l2_m2m_unregister_media_controller v4l2_m2m_update_start_streaming_state v4l2_m2m_update_stop_streaming_state + v4l2_match_dv_timings v4l2_s_parm_cap v4l2_src_change_event_subscribe v4l2_subdev_call_wrappers @@ -2414,6 +2432,7 @@ xdp_do_redirect xdp_master_redirect xdp_return_frame + xdp_return_frame_rx_napi xdp_rxq_info_is_reg __xdp_rxq_info_reg xdp_rxq_info_reg_mem_model From 29e2f3e3d1968adeff803689cb21434b9f12e3be Mon Sep 17 00:00:00 2001 From: Giuliano Procida Date: Wed, 2 Aug 2023 15:48:56 +0100 Subject: [PATCH 89/98] ANDROID: ABI: Update STG ABI to format version 2 If you have trouble reading this new file format, please refresh your prebuilt version of STG with repo sync. Bug: 294213765 Change-Id: I4d7ee716231956c5f4da1343cc0db5170aaaa3b1 Signed-off-by: Giuliano Procida --- android/abi_gki_aarch64.stg | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/android/abi_gki_aarch64.stg b/android/abi_gki_aarch64.stg index ab918ec5c587..85fe49d8c144 100644 --- a/android/abi_gki_aarch64.stg +++ b/android/abi_gki_aarch64.stg @@ -1,10 +1,12 @@ -version: 0x00000001 +version: 0x00000002 root_id: 0x84ea5130 -void { +special { id: 0x48b5725f + kind: VOID } -variadic { +special { id: 0xa52a0930 + kind: VARIADIC } pointer_reference { id: 0x0006db1d From c3d26e2b5aae1e83eeb294a487aadad08453ef43 Mon Sep 17 00:00:00 2001 From: Peifeng Li Date: Tue, 13 Sep 2022 19:07:41 +0800 Subject: [PATCH 90/98] ANDROID: vendor_hooks: Add hooks for lookaround Add hooks for support lookaround in memory reclamation. - android_vh_test_clear_look_around_ref - android_vh_check_folio_look_around_ref - android_vh_look_around_migrate_folio - android_vh_look_around Bug: 292051411 Signed-off-by: Peifeng Li Change-Id: I9a606ae71d2f1303df3b02403b30bc8fdc9d06dd (cherry picked from commit f50f24e781738c8e5aa9f285d8726202f33107d6) [huzhanyuan: changed page to folio where appropriate] --- drivers/android/vendor_hooks.c | 4 ++++ include/trace/hooks/mm.h | 11 +++++++++++ include/trace/hooks/vmscan.h | 3 +++ mm/migrate.c | 6 ++++++ mm/page_alloc.c | 2 ++ mm/rmap.c | 1 + mm/vmscan.c | 5 +++++ 7 files changed, 32 insertions(+) diff --git a/drivers/android/vendor_hooks.c b/drivers/android/vendor_hooks.c index 35baee2a710d..0b9d1866e38e 100644 --- a/drivers/android/vendor_hooks.c +++ b/drivers/android/vendor_hooks.c @@ -315,3 +315,7 @@ EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_rmqueue_smallest_bypass); EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_free_one_page_bypass); EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_regmap_update); EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_enable_thermal_genl_check); +EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_check_folio_look_around_ref); +EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_look_around); +EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_look_around_migrate_folio); +EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_test_clear_look_around_ref); diff --git a/include/trace/hooks/mm.h b/include/trace/hooks/mm.h index cf27ab461c4e..e49cc31ea70d 100644 --- a/include/trace/hooks/mm.h +++ b/include/trace/hooks/mm.h @@ -11,6 +11,7 @@ struct shmem_inode_info; struct folio; +struct page_vma_mapped_walk; DECLARE_RESTRICTED_HOOK(android_rvh_shmem_get_folio, TP_PROTO(struct shmem_inode_info *info, struct folio **folio), @@ -129,6 +130,16 @@ DECLARE_HOOK(android_vh_free_one_page_bypass, TP_PROTO(struct page *page, struct zone *zone, int order, int migratetype, int fpi_flags, bool *bypass), TP_ARGS(page, zone, order, migratetype, fpi_flags, bypass)); +DECLARE_HOOK(android_vh_test_clear_look_around_ref, + TP_PROTO(struct page *page), + TP_ARGS(page)); +DECLARE_HOOK(android_vh_look_around_migrate_folio, + TP_PROTO(struct folio *old_folio, struct folio *new_folio), + TP_ARGS(old_folio, new_folio)); +DECLARE_HOOK(android_vh_look_around, + TP_PROTO(struct page_vma_mapped_walk *pvmw, struct folio *folio, + struct vm_area_struct *vma, int *referenced), + TP_ARGS(pvmw, folio, vma, referenced)); #endif /* _TRACE_HOOK_MM_H */ diff --git a/include/trace/hooks/vmscan.h b/include/trace/hooks/vmscan.h index 0896b1134de5..a52ab44d135f 100644 --- a/include/trace/hooks/vmscan.h +++ b/include/trace/hooks/vmscan.h @@ -36,6 +36,9 @@ DECLARE_HOOK(android_vh_should_continue_reclaim, DECLARE_HOOK(android_vh_file_is_tiny_bypass, TP_PROTO(bool file_is_tiny, bool *bypass), TP_ARGS(file_is_tiny, bypass)); +DECLARE_HOOK(android_vh_check_folio_look_around_ref, + TP_PROTO(struct folio *folio, int *skip), + TP_ARGS(folio, skip)); #endif /* _TRACE_HOOK_VMSCAN_H */ /* This part must be outside protection */ #include diff --git a/mm/migrate.c b/mm/migrate.c index 5c61c3d5b646..ef490976c98e 100644 --- a/mm/migrate.c +++ b/mm/migrate.c @@ -56,6 +56,10 @@ #include +#undef CREATE_TRACE_POINTS +#include +#include + #include "internal.h" int isolate_movable_page(struct page *page, isolate_mode_t mode) @@ -554,6 +558,8 @@ void folio_migrate_flags(struct folio *newfolio, struct folio *folio) if (folio_test_mappedtodisk(folio)) folio_set_mappedtodisk(newfolio); + trace_android_vh_look_around_migrate_folio(folio, newfolio); + /* Move dirty on pages not done by folio_migrate_mapping() */ if (folio_test_dirty(folio)) folio_set_dirty(newfolio); diff --git a/mm/page_alloc.c b/mm/page_alloc.c index c6358579527e..d5ca46562e88 100644 --- a/mm/page_alloc.c +++ b/mm/page_alloc.c @@ -77,6 +77,7 @@ #include #include #include +#include #include #include @@ -2600,6 +2601,7 @@ static void prep_new_page(struct page *page, unsigned int order, gfp_t gfp_flags set_page_pfmemalloc(page); else clear_page_pfmemalloc(page); + trace_android_vh_test_clear_look_around_ref(page); } /* diff --git a/mm/rmap.c b/mm/rmap.c index 9cf4f09cd71d..d1603eb79818 100644 --- a/mm/rmap.c +++ b/mm/rmap.c @@ -826,6 +826,7 @@ static bool folio_referenced_one(struct folio *folio, } if (pvmw.pte) { + trace_android_vh_look_around(&pvmw, folio, vma, &referenced); if (lru_gen_enabled() && pte_young(*pvmw.pte)) { lru_gen_look_around(&pvmw); referenced++; diff --git a/mm/vmscan.c b/mm/vmscan.c index cd4323f336a6..c466a31736cb 100644 --- a/mm/vmscan.c +++ b/mm/vmscan.c @@ -1468,6 +1468,11 @@ static enum folio_references folio_check_references(struct folio *folio, { int referenced_ptes, referenced_folio; unsigned long vm_flags; + int ret = 0; + + trace_android_vh_check_folio_look_around_ref(folio, &ret); + if (ret) + return ret; referenced_ptes = folio_referenced(folio, 1, sc->target_mem_cgroup, &vm_flags); From b283f9b41fc5f3032916637442e3e818ca42fcbc Mon Sep 17 00:00:00 2001 From: huzhanyuan Date: Fri, 28 Jul 2023 20:44:15 +0800 Subject: [PATCH 91/98] ANDROID: oplus: Update the ABI xml and symbol list INFO: ABI DIFFERENCES HAVE BEEN DETECTED! INFO: 4 function symbol(s) added 'int __traceiter_android_vh_check_folio_look_around_ref(void*, struct folio*,int*)' 'int __traceiter_android_vh_look_around(void*, struct page_vma_mapped_walk*,struct folio*, struct vm_area_struct*, int*)' 'int __traceiter_android_vh_look_around_migrate_folio(void*, struct folio*, struct folio*)' 'int __traceiter_android_vh_test_clear_look_around_ref(void*, struct page*)' 4 variable symbol(s) added 'struct tracepoint __tracepoint_android_vh_check_folio_look_around_ref' 'struct tracepoint __tracepoint_android_vh_look_around' 'struct tracepoint __tracepoint_android_vh_look_around_migrate_folio' 'struct tracepoint __tracepoint_android_vh_test_clear_look_around_ref' Bug: 292051411 Change-Id: I25fff4eefc6773d3e1130bd0ff3f3cc21d6c0964 signed-off-by: Zhanyuan Hu --- android/abi_gki_aarch64.stg | 172 ++++++++++++++++++++++++++++++++++ android/abi_gki_aarch64_oplus | 8 ++ 2 files changed, 180 insertions(+) diff --git a/android/abi_gki_aarch64.stg b/android/abi_gki_aarch64.stg index 85fe49d8c144..df6a890d2ac2 100644 --- a/android/abi_gki_aarch64.stg +++ b/android/abi_gki_aarch64.stg @@ -8483,6 +8483,11 @@ pointer_reference { kind: POINTER pointee_type_id: 0x79e2d3b1 } +pointer_reference { + id: 0x14f37d47 + kind: POINTER + pointee_type_id: 0x798d1382 +} pointer_reference { id: 0x14fb0ab0 kind: POINTER @@ -42793,6 +42798,12 @@ member { type_id: 0x33756485 offset: 512 } +member { + id: 0x30e26822 + name: "address" + type_id: 0x33756485 + offset: 256 +} member { id: 0x30e26c68 name: "address" @@ -131796,6 +131807,12 @@ member { type_id: 0xfc0e1dbd offset: 768 } +member { + id: 0xe3b1b19e + name: "nr_pages" + type_id: 0x33756485 + offset: 64 +} member { id: 0xe3b1b2b8 name: "nr_pages" @@ -142461,6 +142478,11 @@ member { type_id: 0x03913382 offset: 52352 } +member { + id: 0x64bb7964 + name: "pfn" + type_id: 0x33756485 +} member { id: 0xeb463452 name: "pfn_base" @@ -144349,6 +144371,12 @@ member { type_id: 0x21082bfc offset: 384 } +member { + id: 0x56639dd1 + name: "pmd" + type_id: 0x21082bfc + offset: 320 +} member { id: 0x569cedab name: "pmd" @@ -150421,11 +150449,23 @@ member { type_id: 0x32bee099 offset: 704 } +member { + id: 0xa17fe2dc + name: "pte" + type_id: 0x32bee099 + offset: 384 +} member { id: 0xa18e706b name: "pte" type_id: 0xc32dc55c } +member { + id: 0xce4422cd + name: "ptl" + type_id: 0x3654c061 + offset: 448 +} member { id: 0xce442d14 name: "ptl" @@ -196497,6 +196537,12 @@ member { type_id: 0x04fd6761 offset: 1280 } +member { + id: 0x239192da + name: "vma" + type_id: 0x0a134144 + offset: 192 +} member { id: 0x23919a13 name: "vma" @@ -236307,6 +236353,23 @@ struct_union { member_id: 0xb59c78b7 } } +struct_union { + id: 0x798d1382 + kind: STRUCT + name: "page_vma_mapped_walk" + definition { + bytesize: 72 + member_id: 0x64bb7964 + member_id: 0xe3b1b19e + member_id: 0xadfdef1c + member_id: 0x239192da + member_id: 0x30e26822 + member_id: 0x56639dd1 + member_id: 0xa17fe2dc + member_id: 0xce4422cd + member_id: 0x2d2d0a20 + } +} struct_union { id: 0x3844dda9 kind: STRUCT @@ -305815,6 +305878,13 @@ function { parameter_id: 0x1b8590a8 parameter_id: 0x107606b0 } +function { + id: 0x9b222516 + return_type_id: 0x6720d32f + parameter_id: 0x18bd6530 + parameter_id: 0x2170d06d + parameter_id: 0x2170d06d +} function { id: 0x9b2239e7 return_type_id: 0x6720d32f @@ -305961,6 +306031,13 @@ function { parameter_id: 0x21069feb parameter_id: 0x1a6ea392 } +function { + id: 0x9b2eaf21 + return_type_id: 0x6720d32f + parameter_id: 0x18bd6530 + parameter_id: 0x2170d06d + parameter_id: 0x13580d6c +} function { id: 0x9b2eba1d return_type_id: 0x6720d32f @@ -307749,6 +307826,12 @@ function { parameter_id: 0x11cfee5a parameter_id: 0x11cfee5a } +function { + id: 0x9bb5b719 + return_type_id: 0x6720d32f + parameter_id: 0x18bd6530 + parameter_id: 0x06835e9c +} function { id: 0x9bb5c5c3 return_type_id: 0x6720d32f @@ -309018,6 +309101,15 @@ function { parameter_id: 0x1b2ca025 parameter_id: 0x2e2c982d } +function { + id: 0x9bf40739 + return_type_id: 0x6720d32f + parameter_id: 0x18bd6530 + parameter_id: 0x14f37d47 + parameter_id: 0x2170d06d + parameter_id: 0x0a134144 + parameter_id: 0x13580d6c +} function { id: 0x9bf6c118 return_type_id: 0x6720d32f @@ -323956,6 +324048,15 @@ elf_symbol { type_id: 0x9b4b913b full_name: "__traceiter_android_vh_check_file_open" } +elf_symbol { + id: 0x6aac0cf8 + name: "__traceiter_android_vh_check_folio_look_around_ref" + is_defined: true + symbol_type: FUNCTION + crc: 0xa2856bd1 + type_id: 0x9b2eaf21 + full_name: "__traceiter_android_vh_check_folio_look_around_ref" +} elf_symbol { id: 0x96d1c9c4 name: "__traceiter_android_vh_check_hibernation_swap" @@ -324460,6 +324561,24 @@ elf_symbol { type_id: 0x9a36ff29 full_name: "__traceiter_android_vh_kswapd_per_node" } +elf_symbol { + id: 0xe19d2bf8 + name: "__traceiter_android_vh_look_around" + is_defined: true + symbol_type: FUNCTION + crc: 0x4d18aae7 + type_id: 0x9bf40739 + full_name: "__traceiter_android_vh_look_around" +} +elf_symbol { + id: 0x993f42ff + name: "__traceiter_android_vh_look_around_migrate_folio" + is_defined: true + symbol_type: FUNCTION + crc: 0xbed1988a + type_id: 0x9b222516 + full_name: "__traceiter_android_vh_look_around_migrate_folio" +} elf_symbol { id: 0xfb6a92a8 name: "__traceiter_android_vh_madvise_cold_pageout_skip" @@ -325153,6 +325272,15 @@ elf_symbol { type_id: 0x9be67f35 full_name: "__traceiter_android_vh_task_blocks_on_rtmutex" } +elf_symbol { + id: 0x48f0cf25 + name: "__traceiter_android_vh_test_clear_look_around_ref" + is_defined: true + symbol_type: FUNCTION + crc: 0x6a7e50c3 + type_id: 0x9bb5b719 + full_name: "__traceiter_android_vh_test_clear_look_around_ref" +} elf_symbol { id: 0x6befbf23 name: "__traceiter_android_vh_thermal_power_cap" @@ -327160,6 +327288,15 @@ elf_symbol { type_id: 0x18ccbd2c full_name: "__tracepoint_android_vh_check_file_open" } +elf_symbol { + id: 0xca5cbc9a + name: "__tracepoint_android_vh_check_folio_look_around_ref" + is_defined: true + symbol_type: OBJECT + crc: 0xdaaccf03 + type_id: 0x18ccbd2c + full_name: "__tracepoint_android_vh_check_folio_look_around_ref" +} elf_symbol { id: 0xaa072f92 name: "__tracepoint_android_vh_check_hibernation_swap" @@ -327664,6 +327801,24 @@ elf_symbol { type_id: 0x18ccbd2c full_name: "__tracepoint_android_vh_kswapd_per_node" } +elf_symbol { + id: 0xda2d53f2 + name: "__tracepoint_android_vh_look_around" + is_defined: true + symbol_type: OBJECT + crc: 0x738994e9 + type_id: 0x18ccbd2c + full_name: "__tracepoint_android_vh_look_around" +} +elf_symbol { + id: 0x50a5a949 + name: "__tracepoint_android_vh_look_around_migrate_folio" + is_defined: true + symbol_type: OBJECT + crc: 0x8b32227d + type_id: 0x18ccbd2c + full_name: "__tracepoint_android_vh_look_around_migrate_folio" +} elf_symbol { id: 0xcb34ca12 name: "__tracepoint_android_vh_madvise_cold_pageout_skip" @@ -328357,6 +328512,15 @@ elf_symbol { type_id: 0x18ccbd2c full_name: "__tracepoint_android_vh_task_blocks_on_rtmutex" } +elf_symbol { + id: 0x4ef2c337 + name: "__tracepoint_android_vh_test_clear_look_around_ref" + is_defined: true + symbol_type: OBJECT + crc: 0x4ffca4ae + type_id: 0x18ccbd2c + full_name: "__tracepoint_android_vh_test_clear_look_around_ref" +} elf_symbol { id: 0x6f25dd05 name: "__tracepoint_android_vh_thermal_power_cap" @@ -380959,6 +381123,7 @@ interface { symbol_id: 0x33c527ab symbol_id: 0x5012fcd8 symbol_id: 0x67bab494 + symbol_id: 0x6aac0cf8 symbol_id: 0x96d1c9c4 symbol_id: 0x42428033 symbol_id: 0x005c7625 @@ -381015,6 +381180,8 @@ interface { symbol_id: 0x4dca46cc symbol_id: 0xf83fbd26 symbol_id: 0x18fde973 + symbol_id: 0xe19d2bf8 + symbol_id: 0x993f42ff symbol_id: 0xfb6a92a8 symbol_id: 0xa94ef105 symbol_id: 0x0e1f9e23 @@ -381092,6 +381259,7 @@ interface { symbol_id: 0x2ecf85e9 symbol_id: 0x34a01a22 symbol_id: 0xdd9dd67b + symbol_id: 0x48f0cf25 symbol_id: 0x6befbf23 symbol_id: 0x226cc38b symbol_id: 0xeecc1529 @@ -381315,6 +381483,7 @@ interface { symbol_id: 0x6f146fe1 symbol_id: 0x678bb5ba symbol_id: 0xf1ec5ef2 + symbol_id: 0xca5cbc9a symbol_id: 0xaa072f92 symbol_id: 0x9620eac1 symbol_id: 0x5cc4ca5b @@ -381371,6 +381540,8 @@ interface { symbol_id: 0x62c13726 symbol_id: 0xafbca760 symbol_id: 0x586a06d1 + symbol_id: 0xda2d53f2 + symbol_id: 0x50a5a949 symbol_id: 0xcb34ca12 symbol_id: 0x2f768c2b symbol_id: 0xc34a5545 @@ -381448,6 +381619,7 @@ interface { symbol_id: 0xefb9e5a3 symbol_id: 0x3fe0157c symbol_id: 0xe5bf742d + symbol_id: 0x4ef2c337 symbol_id: 0x6f25dd05 symbol_id: 0xa5c71571 symbol_id: 0xfa3284c7 diff --git a/android/abi_gki_aarch64_oplus b/android/abi_gki_aarch64_oplus index ea61781c1543..afe0f5c8aa05 100644 --- a/android/abi_gki_aarch64_oplus +++ b/android/abi_gki_aarch64_oplus @@ -117,8 +117,11 @@ __traceiter_android_vh_binder_thread_release __traceiter_android_vh_binder_wait_for_work __traceiter_android_vh_cgroup_set_task + __traceiter_android_vh_check_folio_look_around_ref __traceiter_android_vh_dup_task_struct __traceiter_android_vh_exit_signal + __traceiter_android_vh_look_around + __traceiter_android_vh_look_around_migrate_folio __traceiter_android_vh_mem_cgroup_id_remove __traceiter_android_vh_mem_cgroup_css_offline __traceiter_android_vh_mem_cgroup_css_online @@ -154,6 +157,7 @@ __traceiter_sched_stat_wait __traceiter_sched_waking __traceiter_task_rename + __traceiter_android_vh_test_clear_look_around_ref __tracepoint_android_rvh_post_init_entity_util_avg __tracepoint_android_rvh_rtmutex_force_update __tracepoint_android_vh_account_process_tick_gran @@ -175,6 +179,7 @@ __tracepoint_android_vh_binder_thread_release __tracepoint_android_vh_binder_wait_for_work __tracepoint_android_vh_cgroup_set_task + __tracepoint_android_vh_check_folio_look_around_ref __tracepoint_android_vh_do_futex __tracepoint_android_vh_dup_task_struct __tracepoint_android_vh_exit_signal @@ -190,6 +195,8 @@ __tracepoint_android_vh_futex_wake_traverse_plist __tracepoint_android_vh_futex_wake_up_q_finish __tracepoint_android_vh_irqtime_account_process_tick + __tracepoint_android_vh_look_around + __tracepoint_android_vh_look_around_migrate_folio __tracepoint_android_vh_mutex_can_spin_on_owner __tracepoint_android_vh_mutex_opt_spin_finish __tracepoint_android_vh_mutex_opt_spin_start @@ -210,6 +217,7 @@ __tracepoint_android_vh_shrink_node_memcgs __tracepoint_android_vh_sync_txn_recvd __tracepoint_android_vh_task_blocks_on_rtmutex + __tracepoint_android_vh_test_clear_look_around_ref __tracepoint_block_bio_queue __tracepoint_block_getrq __tracepoint_block_rq_complete From 03812b904e8d763f26573753e5582c7fb847ebd4 Mon Sep 17 00:00:00 2001 From: Jaewon Kim Date: Wed, 2 Aug 2023 18:25:21 +0900 Subject: [PATCH 92/98] ANDROID: ABI: update symbol list for galaxy INFO: 1 function symbol(s) added 'int cleancache_register_ops(const struct cleancache_ops*) Bug: 294177078 Change-Id: Ic22ddae4e92896ed28bc876d98969c6c3e94cb9d Signed-off-by: Jaewon Kim --- android/abi_gki_aarch64.stg | 200 +++++++++++++++++++++++++++++++++ android/abi_gki_aarch64_galaxy | 1 + 2 files changed, 201 insertions(+) diff --git a/android/abi_gki_aarch64.stg b/android/abi_gki_aarch64.stg index df6a890d2ac2..66f8158b4269 100644 --- a/android/abi_gki_aarch64.stg +++ b/android/abi_gki_aarch64.stg @@ -2158,6 +2158,21 @@ pointer_reference { kind: POINTER pointee_type_id: 0x0a52df14 } +pointer_reference { + id: 0x080d391b + kind: POINTER + pointee_type_id: 0x0a7402f1 +} +pointer_reference { + id: 0x080d3f98 + kind: POINTER + pointee_type_id: 0x0a7418fc +} +pointer_reference { + id: 0x080e08ce + kind: POINTER + pointee_type_id: 0x0a78c5a5 +} pointer_reference { id: 0x080fbe64 kind: POINTER @@ -2333,6 +2348,11 @@ pointer_reference { kind: POINTER pointee_type_id: 0x0942f1ca } +pointer_reference { + id: 0x08c420f1 + kind: POINTER + pointee_type_id: 0x09506558 +} pointer_reference { id: 0x08e43718 kind: POINTER @@ -11483,6 +11503,11 @@ pointer_reference { kind: POINTER pointee_type_id: 0xa0815516 } +pointer_reference { + id: 0x22b357e9 + kind: POINTER + pointee_type_id: 0xa08db938 +} pointer_reference { id: 0x22b3ece7 kind: POINTER @@ -13143,6 +13168,11 @@ pointer_reference { kind: POINTER pointee_type_id: 0x86a9103f } +pointer_reference { + id: 0x2b4b15b4 + kind: POINTER + pointee_type_id: 0x876cb04d +} pointer_reference { id: 0x2b584612 kind: POINTER @@ -15563,6 +15593,11 @@ pointer_reference { kind: POINTER pointee_type_id: 0x99c11430 } +pointer_reference { + id: 0x2ce2190b + kind: POINTER + pointee_type_id: 0x99c882b3 +} pointer_reference { id: 0x2ce315c4 kind: POINTER @@ -22563,6 +22598,11 @@ pointer_reference { kind: POINTER pointee_type_id: 0xe2a728bc } +pointer_reference { + id: 0x323d798e + kind: POINTER + pointee_type_id: 0xe2b500a6 +} pointer_reference { id: 0x3240bbe7 kind: POINTER @@ -29223,6 +29263,11 @@ typedef { name: "hfn_t" referred_type_id: 0x92233392 } +typedef { + id: 0xee72cbfc + name: "ino_t" + referred_type_id: 0x21d43a7b +} typedef { id: 0x7e8f5c14 name: "int32" @@ -32338,6 +32383,11 @@ qualified { qualifier: CONST qualified_type_id: 0xfa2455af } +qualified { + id: 0xe2b500a6 + qualifier: CONST + qualified_type_id: 0xfa93b413 +} qualified { id: 0xe2cebd77 qualifier: CONST @@ -85010,6 +85060,11 @@ member { type_id: 0x318f8bcb offset: 256 } +member { + id: 0x4e824c05 + name: "fh" + type_id: 0x982afc69 +} member { id: 0x2db4ae9c name: "fh_list" @@ -93177,6 +93232,12 @@ member { type_id: 0x0cbb9c80 offset: 320 } +member { + id: 0xcf06c106 + name: "get_page" + type_id: 0x2b4b15b4 + offset: 128 +} member { id: 0xacf61961 name: "get_params" @@ -103474,6 +103535,11 @@ member { type_id: 0x295c7202 offset: 128 } +member { + id: 0xedc364a3 + name: "init_fs" + type_id: 0x22b357e9 +} member { id: 0x35f4d7c6 name: "init_fs_context" @@ -103587,6 +103653,12 @@ member { type_id: 0x3292450a offset: 64 } +member { + id: 0xcc9b87bc + name: "init_shared_fs" + type_id: 0x2ce2190b + offset: 64 +} member { id: 0x7ab1d042 name: "init_speed" @@ -103915,6 +103987,11 @@ member { type_id: 0xd5df6730 offset: 256 } +member { + id: 0x0ca7cb72 + name: "ino" + type_id: 0xee72cbfc +} member { id: 0x0cdb9a21 name: "ino" @@ -105094,6 +105171,18 @@ member { type_id: 0x0c5a56fb offset: 512 } +member { + id: 0x6a15223b + name: "invalidate_fs" + type_id: 0x08c420f1 + offset: 384 +} +member { + id: 0x6f43a794 + name: "invalidate_inode" + type_id: 0x080e08ce + offset: 320 +} member { id: 0x17dabd89 name: "invalidate_lock" @@ -105106,6 +105195,12 @@ member { type_id: 0x475137a2 offset: 576 } +member { + id: 0x107f64d3 + name: "invalidate_page" + type_id: 0x080d3f98 + offset: 256 +} member { id: 0xa4356576 name: "invalidate_seq" @@ -108938,6 +109033,11 @@ member { type_id: 0x92233392 offset: 640 } +member { + id: 0x20c5e9f7 + name: "key" + type_id: 0x93e3596e +} member { id: 0x20c661f5 name: "key" @@ -150888,6 +150988,12 @@ member { type_id: 0x2c0bb831 offset: 64 } +member { + id: 0x68c6881b + name: "put_page" + type_id: 0x080d391b + offset: 192 +} member { id: 0xee3c87e4 name: "put_port" @@ -189965,6 +190071,11 @@ member { type_id: 0x5574fba9 offset: 128 } +member { + id: 0xec2a9cea + name: "u" + type_id: 0x55c087bf +} member { id: 0xec2ac37d name: "u" @@ -205792,6 +205903,16 @@ struct_union { member_id: 0xa0d5322b } } +struct_union { + id: 0x55c087bf + kind: UNION + definition { + bytesize: 24 + member_id: 0x0ca7cb72 + member_id: 0x4e824c05 + member_id: 0x20c5e9f7 + } +} struct_union { id: 0x56037e9c kind: UNION @@ -213144,6 +213265,30 @@ struct_union { member_id: 0xd0a3be49 } } +struct_union { + id: 0xca283f54 + kind: STRUCT + name: "cleancache_filekey" + definition { + bytesize: 24 + member_id: 0xec2a9cea + } +} +struct_union { + id: 0xfa93b413 + kind: STRUCT + name: "cleancache_ops" + definition { + bytesize: 56 + member_id: 0xedc364a3 + member_id: 0xcc9b87bc + member_id: 0xcf06c106 + member_id: 0x68c6881b + member_id: 0x107f64d3 + member_id: 0x6f43a794 + member_id: 0x6a15223b + } +} struct_union { id: 0xdd7b47eb kind: STRUCT @@ -277979,6 +278124,27 @@ function { parameter_id: 0x091f4a0b parameter_id: 0x3286774f } +function { + id: 0x0a7402f1 + return_type_id: 0x48b5725f + parameter_id: 0x6720d32f + parameter_id: 0xca283f54 + parameter_id: 0x33756485 + parameter_id: 0x06835e9c +} +function { + id: 0x0a7418fc + return_type_id: 0x48b5725f + parameter_id: 0x6720d32f + parameter_id: 0xca283f54 + parameter_id: 0x33756485 +} +function { + id: 0x0a78c5a5 + return_type_id: 0x48b5725f + parameter_id: 0x6720d32f + parameter_id: 0xca283f54 +} function { id: 0x0a9e8df2 return_type_id: 0x079ff791 @@ -293898,6 +294064,14 @@ function { parameter_id: 0x21003da7 parameter_id: 0x21530c77 } +function { + id: 0x876cb04d + return_type_id: 0x6720d32f + parameter_id: 0x6720d32f + parameter_id: 0xca283f54 + parameter_id: 0x33756485 + parameter_id: 0x06835e9c +} function { id: 0x87739e97 return_type_id: 0x3a583251 @@ -295465,6 +295639,11 @@ function { parameter_id: 0xf435685e parameter_id: 0x0ab1f084 } +function { + id: 0x910fbd4c + return_type_id: 0x6720d32f + parameter_id: 0x323d798e +} function { id: 0x91117703 return_type_id: 0x6720d32f @@ -304094,6 +304273,12 @@ function { return_type_id: 0x6720d32f parameter_id: 0x111ee6f8 } +function { + id: 0x99c882b3 + return_type_id: 0x6720d32f + parameter_id: 0x1e62d0f5 + parameter_id: 0xf435685e +} function { id: 0x99c885a2 return_type_id: 0x6720d32f @@ -315002,6 +315187,11 @@ function { parameter_id: 0x4585663f parameter_id: 0x33756485 } +function { + id: 0xa08db938 + return_type_id: 0x6720d32f + parameter_id: 0xf435685e +} function { id: 0xa08f5503 return_type_id: 0xfc0e1dbd @@ -333278,6 +333468,15 @@ elf_symbol { type_id: 0x1a0b4b72 full_name: "class_unregister" } +elf_symbol { + id: 0xd156aa2c + name: "cleancache_register_ops" + is_defined: true + symbol_type: FUNCTION + crc: 0x5fa588cd + type_id: 0x910fbd4c + full_name: "cleancache_register_ops" +} elf_symbol { id: 0x00d9abe7 name: "cleanup_srcu_struct" @@ -382149,6 +382348,7 @@ interface { symbol_id: 0xb29100f2 symbol_id: 0xef9eb644 symbol_id: 0xf91cb171 + symbol_id: 0xd156aa2c symbol_id: 0x00d9abe7 symbol_id: 0xb63845e5 symbol_id: 0x5332f89b diff --git a/android/abi_gki_aarch64_galaxy b/android/abi_gki_aarch64_galaxy index ebe4fa10620a..9bb57a86455d 100644 --- a/android/abi_gki_aarch64_galaxy +++ b/android/abi_gki_aarch64_galaxy @@ -35,6 +35,7 @@ class_create_file_ns class_find_device class_remove_file_ns + cleancache_register_ops __const_udelay copy_from_kernel_nofault cpu_hwcaps From a7adb988970e13c42f3c7ca4fe157c35e8e885fe Mon Sep 17 00:00:00 2001 From: Kalesh Singh Date: Tue, 1 Aug 2023 19:56:02 -0700 Subject: [PATCH 93/98] FROMGIT: Multi-gen LRU: Fix per-zone reclaim MGLRU has a LRU list for each zone for each type (anon/file) in each generation: long nr_pages[MAX_NR_GENS][ANON_AND_FILE][MAX_NR_ZONES]; The min_seq (oldest generation) can progress independently for each type but the max_seq (youngest generation) is shared for both anon and file. This is to maintain a common frame of reference. In order for eviction to advance the min_seq of a type, all the per-zone lists in the oldest generation of that type must be empty. The eviction logic only considers pages from eligible zones for eviction or promotion. scan_folios() { ... for (zone = sc->reclaim_idx; zone >= 0; zone--) { ... sort_folio(); // Promote ... isolate_folio(); // Evict } ... } Consider the system has the movable zone configured and default 4 generations. The current state of the system is as shown below (only illustrating one type for simplicity): Type: ANON Zone DMA32 Normal Movable Device Gen 0 0 0 4GB 0 Gen 1 0 1GB 1MB 0 Gen 2 1MB 4GB 1MB 0 Gen 3 1MB 1MB 1MB 0 Now consider there is a GFP_KERNEL allocation request (eligible zone index <= Normal), evict_folios() will return without doing any work since there are no pages to scan in the eligible zones of the oldest generation. Reclaim won't make progress until triggered from a ZONE_MOVABLE allocation request; which may not happen soon if there is a lot of free memory in the movable zone. This can lead to OOM kills, although there is 1GB pages in the Normal zone of Gen 1 that we have not yet tried to reclaim. This issue is not seen in the conventional active/inactive LRU since there are no per-zone lists. If there are no (not enough) folios to scan in the eligible zones, move folios from ineligible zone (zone_index > reclaim_index) to the next generation. This allows for the progression of min_seq and reclaiming from the next generation (Gen 1). Qualcomm, Mediatek and raspberrypi [1] discovered this issue independently. [1] https://github.com/raspberrypi/linux/issues/5395 Link: https://lkml.kernel.org/r/20230802025606.346758-1-kaleshsingh@google.com Fixes: ac35a4902374 ("mm: multi-gen LRU: minimal implementation") Change-Id: I5bbf44bd7ffe42f4347df4be59a75c1603c9b947 Signed-off-by: Kalesh Singh Reported-by: Charan Teja Kalla Reported-by: Lecopzer Chen Tested-by: AngeloGioacchino Del Regno [mediatek] Tested-by: Charan Teja Kalla Cc: Yu Zhao Cc: Barry Song Cc: Brian Geffon Cc: Jan Alexander Steffens (heftig) Cc: Matthias Brugger Cc: Oleksandr Natalenko Cc: Qi Zheng Cc: Steven Barrett Cc: Suleiman Souhlal Cc: Suren Baghdasaryan Cc: Aneesh Kumar K V Cc: Signed-off-by: Andrew Morton (cherry picked from commit 1462260adc41c5974362cb54ff577c2a15b8c7b2 https://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm.git mm-unstable) Bug: 288383787 Bug: 291719697 Signed-off-by: Kalesh Singh --- mm/vmscan.c | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) diff --git a/mm/vmscan.c b/mm/vmscan.c index c466a31736cb..68e4c3193f7a 100644 --- a/mm/vmscan.c +++ b/mm/vmscan.c @@ -4794,7 +4794,8 @@ static int lru_gen_memcg_seg(struct lruvec *lruvec) * the eviction ******************************************************************************/ -static bool sort_folio(struct lruvec *lruvec, struct folio *folio, int tier_idx) +static bool sort_folio(struct lruvec *lruvec, struct folio *folio, struct scan_control *sc, + int tier_idx) { bool success; int gen = folio_lru_gen(folio); @@ -4844,6 +4845,13 @@ static bool sort_folio(struct lruvec *lruvec, struct folio *folio, int tier_idx) return true; } + /* ineligible */ + if (zone > sc->reclaim_idx) { + gen = folio_inc_gen(lruvec, folio, false); + list_move_tail(&folio->lru, &lrugen->folios[gen][type][zone]); + return true; + } + /* waiting for writeback */ if (folio_test_locked(folio) || folio_test_writeback(folio) || (type == LRU_GEN_FILE && folio_test_dirty(folio))) { @@ -4892,7 +4900,8 @@ static bool isolate_folio(struct lruvec *lruvec, struct folio *folio, struct sca static int scan_folios(struct lruvec *lruvec, struct scan_control *sc, int type, int tier, struct list_head *list) { - int gen, zone; + int i; + int gen; enum vm_event_item item; int sorted = 0; int scanned = 0; @@ -4908,9 +4917,10 @@ static int scan_folios(struct lruvec *lruvec, struct scan_control *sc, gen = lru_gen_from_seq(lrugen->min_seq[type]); - for (zone = sc->reclaim_idx; zone >= 0; zone--) { + for (i = MAX_NR_ZONES; i > 0; i--) { LIST_HEAD(moved); int skipped = 0; + int zone = (sc->reclaim_idx + i) % MAX_NR_ZONES; struct list_head *head = &lrugen->folios[gen][type][zone]; while (!list_empty(head)) { @@ -4924,7 +4934,7 @@ static int scan_folios(struct lruvec *lruvec, struct scan_control *sc, scanned += delta; - if (sort_folio(lruvec, folio, tier)) + if (sort_folio(lruvec, folio, sc, tier)) sorted += delta; else if (isolate_folio(lruvec, folio, sc)) { list_add(&folio->lru, list); From addf1a9a65a9eb4db8de8d2459e6070d4641c030 Mon Sep 17 00:00:00 2001 From: Kalesh Singh Date: Tue, 1 Aug 2023 19:56:03 -0700 Subject: [PATCH 94/98] FROMGIT: Multi-gen LRU: Avoid race in inc_min_seq() inc_max_seq() will try to inc_min_seq() if nr_gens == MAX_NR_GENS. This is because the generations are reused (the last oldest now empty generation will become the next youngest generation). inc_min_seq() is retried until successful, dropping the lru_lock and yielding the CPU on each failure, and retaking the lock before trying again: while (!inc_min_seq(lruvec, type, can_swap)) { spin_unlock_irq(&lruvec->lru_lock); cond_resched(); spin_lock_irq(&lruvec->lru_lock); } However, the initial condition that required incrementing the min_seq (nr_gens == MAX_NR_GENS) is not retested. This can change by another call to inc_max_seq() from run_aging() with force_scan=true from the debugfs interface. Since the eviction stalls when the nr_gens == MIN_NR_GENS, avoid unnecessarily incrementing the min_seq by rechecking the number of generations before each attempt. This issue was uncovered in previous discussion on the list by Yu Zhao and Aneesh Kumar [1]. [1] https://lore.kernel.org/linux-mm/CAOUHufbO7CaVm=xjEb1avDhHVvnC8pJmGyKcFf2iY_dpf+zR3w@mail.gmail.com/ Link: https://lkml.kernel.org/r/20230802025606.346758-2-kaleshsingh@google.com Fixes: d6c3af7d8a2b ("mm: multi-gen LRU: debugfs interface") Change-Id: I89e84ef2927eb1b0091f1be28bd03eb04dee4c57 Signed-off-by: Kalesh Singh Tested-by: AngeloGioacchino Del Regno [mediatek] Tested-by: Charan Teja Kalla Cc: Yu Zhao Cc: Aneesh Kumar K V Cc: Barry Song Cc: Brian Geffon Cc: Jan Alexander Steffens (heftig) Cc: Lecopzer Chen Cc: Matthias Brugger Cc: Oleksandr Natalenko Cc: Qi Zheng Cc: Steven Barrett Cc: Suleiman Souhlal Cc: Suren Baghdasaryan Cc: Signed-off-by: Andrew Morton (cherry picked from commit 250dbd10306126b06415afda8adfc27b2b780428 https://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm.git mm-unstable) Bug: 288383787 Bug: 291719697 Signed-off-by: Kalesh Singh --- mm/vmscan.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/mm/vmscan.c b/mm/vmscan.c index 68e4c3193f7a..b2573a5ee2f7 100644 --- a/mm/vmscan.c +++ b/mm/vmscan.c @@ -4348,7 +4348,7 @@ static void inc_max_seq(struct lruvec *lruvec, bool can_swap, bool force_scan) int prev, next; int type, zone; struct lru_gen_folio *lrugen = &lruvec->lrugen; - +restart: spin_lock_irq(&lruvec->lru_lock); VM_WARN_ON_ONCE(!seq_is_valid(lruvec)); @@ -4359,11 +4359,12 @@ static void inc_max_seq(struct lruvec *lruvec, bool can_swap, bool force_scan) VM_WARN_ON_ONCE(!force_scan && (type == LRU_GEN_FILE || can_swap)); - while (!inc_min_seq(lruvec, type, can_swap)) { - spin_unlock_irq(&lruvec->lru_lock); - cond_resched(); - spin_lock_irq(&lruvec->lru_lock); - } + if (inc_min_seq(lruvec, type, can_swap)) + continue; + + spin_unlock_irq(&lruvec->lru_lock); + cond_resched(); + goto restart; } /* From 5e1d25ac2ab670561949d82de7b5027e5a9676d5 Mon Sep 17 00:00:00 2001 From: Kalesh Singh Date: Tue, 1 Aug 2023 19:56:04 -0700 Subject: [PATCH 95/98] FROMGIT: BACKPORT: Multi-gen LRU: Fix can_swap in lru_gen_look_around() walk->can_swap might be invalid since it's not guaranteed to be initialized for the particular lruvec. Instead deduce it from the folio type (anon/file). Link: https://lkml.kernel.org/r/20230802025606.346758-3-kaleshsingh@google.com Fixes: 018ee47f1489 ("mm: multi-gen LRU: exploit locality in rmap") Change-Id: I1ae78011d4972d87bac9f2db8c56352cdb7a9be6 Signed-off-by: Kalesh Singh Tested-by: AngeloGioacchino Del Regno [mediatek] Tested-by: Charan Teja Kalla Cc: Yu Zhao Cc: Aneesh Kumar K V Cc: Barry Song Cc: Brian Geffon Cc: Jan Alexander Steffens (heftig) Cc: Lecopzer Chen Cc: Matthias Brugger Cc: Oleksandr Natalenko Cc: Qi Zheng Cc: Steven Barrett Cc: Suleiman Souhlal Cc: Suren Baghdasaryan Signed-off-by: Andrew Morton (cherry picked from commit fdf19e8c8f1cdcee4eccf4c98a875f44f39d8b9d https://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm.git mm-unstable) Bug: 288383787 Bug: 291719697 [ Kalesh Singh - Fix trivial conflict in lru_gen_look_around() ] Signed-off-by: Kalesh Singh --- mm/vmscan.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/mm/vmscan.c b/mm/vmscan.c index b2573a5ee2f7..b15bec001fa1 100644 --- a/mm/vmscan.c +++ b/mm/vmscan.c @@ -4565,6 +4565,7 @@ void lru_gen_look_around(struct page_vma_mapped_walk *pvmw) pte_t *pte = pvmw->pte; unsigned long addr = pvmw->address; struct folio *folio = pfn_folio(pvmw->pfn); + bool can_swap = !folio_is_file_lru(folio); struct mem_cgroup *memcg = folio_memcg(folio); struct pglist_data *pgdat = folio_pgdat(folio); struct lruvec *lruvec = mem_cgroup_lruvec(memcg, pgdat); @@ -4612,7 +4613,7 @@ void lru_gen_look_around(struct page_vma_mapped_walk *pvmw) if (!pte_young(pte[i])) continue; - folio = get_pfn_folio(pfn, memcg, pgdat, !walk || walk->can_swap); + folio = get_pfn_folio(pfn, memcg, pgdat, can_swap); if (!folio) continue; From dbb09068c1df2a75dd712fc0663434d088f8b6d1 Mon Sep 17 00:00:00 2001 From: Jiewen Wang Date: Wed, 2 Aug 2023 19:40:04 +0800 Subject: [PATCH 96/98] ANDROID: vendor_hooks: Add tune scan type hook in get_scan_count() Add hook in get_scan_count() for oem to wield customized reclamation strategy Bug: 294180281 Change-Id: Ic54d35128e458661fc2b641809f5371b1d9a488e Signed-off-by: Jiewen Wang --- drivers/android/vendor_hooks.c | 1 + include/trace/hooks/vmscan.h | 4 ++++ mm/vmscan.c | 1 + 3 files changed, 6 insertions(+) diff --git a/drivers/android/vendor_hooks.c b/drivers/android/vendor_hooks.c index 0b9d1866e38e..229f0e712f93 100644 --- a/drivers/android/vendor_hooks.c +++ b/drivers/android/vendor_hooks.c @@ -319,3 +319,4 @@ EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_check_folio_look_around_ref); EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_look_around); EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_look_around_migrate_folio); EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_test_clear_look_around_ref); +EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_tune_scan_type); diff --git a/include/trace/hooks/vmscan.h b/include/trace/hooks/vmscan.h index a52ab44d135f..d66ab9279266 100644 --- a/include/trace/hooks/vmscan.h +++ b/include/trace/hooks/vmscan.h @@ -39,6 +39,10 @@ DECLARE_HOOK(android_vh_file_is_tiny_bypass, DECLARE_HOOK(android_vh_check_folio_look_around_ref, TP_PROTO(struct folio *folio, int *skip), TP_ARGS(folio, skip)); +enum scan_balance; +DECLARE_HOOK(android_vh_tune_scan_type, + TP_PROTO(enum scan_balance *scan_type), + TP_ARGS(scan_type)); #endif /* _TRACE_HOOK_VMSCAN_H */ /* This part must be outside protection */ #include diff --git a/mm/vmscan.c b/mm/vmscan.c index b15bec001fa1..73e96cd78b21 100644 --- a/mm/vmscan.c +++ b/mm/vmscan.c @@ -3020,6 +3020,7 @@ static void get_scan_count(struct lruvec *lruvec, struct scan_control *sc, fraction[1] = fp; denominator = ap + fp; out: + trace_android_vh_tune_scan_type(&scan_balance); for_each_evictable_lru(lru) { int file = is_file_lru(lru); unsigned long lruvec_size; From 3926cc6ef8cc05e8e85613b0a26acb4e37753442 Mon Sep 17 00:00:00 2001 From: Jiewen Wang Date: Wed, 2 Aug 2023 20:15:25 +0800 Subject: [PATCH 97/98] ANDROID: GKI: Add symbols to symbol list for vivo INFO: 1 function symbol(s) added 'int __traceiter_android_vh_tune_scan_type(void*, enum scan_balance*)' 1 variable symbol(s) added 'struct tracepoint __tracepoint_android_vh_tune_scan_type' Bug: 294180281 Change-Id: I171099cdbe68c04885e286554f56290356d543d2 Signed-off-by: Jiewen Wang --- android/abi_gki_aarch64.stg | 53 ++++++++++++++++++++++++++++++++++++ android/abi_gki_aarch64_vivo | 2 ++ 2 files changed, 55 insertions(+) diff --git a/android/abi_gki_aarch64.stg b/android/abi_gki_aarch64.stg index 66f8158b4269..b14165dbe8c8 100644 --- a/android/abi_gki_aarch64.stg +++ b/android/abi_gki_aarch64.stg @@ -2743,6 +2743,11 @@ pointer_reference { kind: POINTER pointee_type_id: 0x0028f2f5 } +pointer_reference { + id: 0x0a9e3ca3 + kind: POINTER + pointee_type_id: 0x00381413 +} pointer_reference { id: 0x0aa1f0ee kind: POINTER @@ -273756,6 +273761,28 @@ enumeration { } } } +enumeration { + id: 0x00381413 + name: "scan_balance" + definition { + underlying_type_id: 0x4585663f + enumerator { + name: "SCAN_EQUAL" + } + enumerator { + name: "SCAN_FRACT" + value: 1 + } + enumerator { + name: "SCAN_ANON" + value: 2 + } + enumerator { + name: "SCAN_FILE" + value: 3 + } + } +} enumeration { id: 0xbcb85241 name: "scsi_cmnd_submitter" @@ -307421,6 +307448,12 @@ function { return_type_id: 0x6720d32f parameter_id: 0x18150d9f } +function { + id: 0x9b85c291 + return_type_id: 0x6720d32f + parameter_id: 0x18bd6530 + parameter_id: 0x0a9e3ca3 +} function { id: 0x9b85c36d return_type_id: 0x6720d32f @@ -325534,6 +325567,15 @@ elf_symbol { type_id: 0x9b2837bd full_name: "__traceiter_android_vh_try_to_unmap_one" } +elf_symbol { + id: 0x39155e73 + name: "__traceiter_android_vh_tune_scan_type" + is_defined: true + symbol_type: FUNCTION + crc: 0x24602ed2 + type_id: 0x9b85c291 + full_name: "__traceiter_android_vh_tune_scan_type" +} elf_symbol { id: 0x8a773cc3 name: "__traceiter_android_vh_typec_store_partner_src_caps" @@ -328774,6 +328816,15 @@ elf_symbol { type_id: 0x18ccbd2c full_name: "__tracepoint_android_vh_try_to_unmap_one" } +elf_symbol { + id: 0x49b955bd + name: "__tracepoint_android_vh_tune_scan_type" + is_defined: true + symbol_type: OBJECT + crc: 0x45da6384 + type_id: 0x18ccbd2c + full_name: "__tracepoint_android_vh_tune_scan_type" +} elf_symbol { id: 0x18e67da1 name: "__tracepoint_android_vh_typec_store_partner_src_caps" @@ -381466,6 +381517,7 @@ interface { symbol_id: 0x2bc25325 symbol_id: 0x0119fc41 symbol_id: 0xd9f43028 + symbol_id: 0x39155e73 symbol_id: 0x8a773cc3 symbol_id: 0x9545623c symbol_id: 0x558490b1 @@ -381826,6 +381878,7 @@ interface { symbol_id: 0xd9d2bcff symbol_id: 0x09ba106b symbol_id: 0xf9580976 + symbol_id: 0x49b955bd symbol_id: 0x18e67da1 symbol_id: 0x75a2f39e symbol_id: 0x7b5c377f diff --git a/android/abi_gki_aarch64_vivo b/android/abi_gki_aarch64_vivo index 69d634eb4fa5..b17c82fe8684 100644 --- a/android/abi_gki_aarch64_vivo +++ b/android/abi_gki_aarch64_vivo @@ -419,6 +419,7 @@ __traceiter_android_vh_try_to_freeze_todo __traceiter_android_vh_try_to_freeze_todo_unfrozen __traceiter_android_vh_try_to_unmap_one + __traceiter_android_vh_tune_scan_type __traceiter_android_vh_ufs_check_int_errors __traceiter_android_vh_ufs_clock_scaling __traceiter_android_vh_ufs_compl_command @@ -588,6 +589,7 @@ __tracepoint_android_vh_try_to_unmap_one __tracepoint_android_vh_try_to_freeze_todo __tracepoint_android_vh_try_to_freeze_todo_unfrozen + __tracepoint_android_vh_tune_scan_type __tracepoint_android_vh_ufs_check_int_errors __tracepoint_android_vh_ufs_clock_scaling __tracepoint_android_vh_ufs_compl_command From 960d9828eee1f1e74682e84cbab856bdb0c9d126 Mon Sep 17 00:00:00 2001 From: Junki Min Date: Fri, 4 Aug 2023 15:01:02 +0900 Subject: [PATCH 98/98] ANDROID: ABI: Update symbol for Exynos SoC Update symbols for Exynos WLBT driver. 1 function symbol(s) added 'unsigned long __find_nth_bit(const unsigned long*, unsigned long, unsigned long)' Bug: 294470344 Change-Id: I9f8d9d20f643b34bbc475dde468dbaa11f56e667 Signed-off-by: Junki Min --- android/abi_gki_aarch64.stg | 10 ++++++++++ android/abi_gki_aarch64_exynos | 17 +++++++++++++---- 2 files changed, 23 insertions(+), 4 deletions(-) diff --git a/android/abi_gki_aarch64.stg b/android/abi_gki_aarch64.stg index b14165dbe8c8..337a5867ef08 100644 --- a/android/abi_gki_aarch64.stg +++ b/android/abi_gki_aarch64.stg @@ -321120,6 +321120,15 @@ elf_symbol { type_id: 0x20cd94dc full_name: "__fdget" } +elf_symbol { + id: 0xaf8ee687 + name: "__find_nth_bit" + is_defined: true + symbol_type: FUNCTION + crc: 0x3eccbe2c + type_id: 0x3ec500b9 + full_name: "__find_nth_bit" +} elf_symbol { id: 0x746a66fc name: "__flush_workqueue" @@ -381023,6 +381032,7 @@ interface { symbol_id: 0x80f1cf36 symbol_id: 0x3e32c80e symbol_id: 0x5298aa39 + symbol_id: 0xaf8ee687 symbol_id: 0x746a66fc symbol_id: 0x47a334c4 symbol_id: 0xebf4b11f diff --git a/android/abi_gki_aarch64_exynos b/android/abi_gki_aarch64_exynos index e30927aa26b1..d8c9ffac57b6 100644 --- a/android/abi_gki_aarch64_exynos +++ b/android/abi_gki_aarch64_exynos @@ -42,6 +42,7 @@ blocking_notifier_chain_register blocking_notifier_chain_unregister bpf_trace_run1 + bpf_trace_run10 bpf_trace_run2 bpf_trace_run3 bpf_trace_run4 @@ -325,6 +326,7 @@ fd_install fget _find_first_bit + _find_first_zero_bit _find_last_bit _find_next_and_bit _find_next_bit @@ -701,6 +703,7 @@ ___ratelimit raw_notifier_call_chain raw_notifier_chain_register + raw_notifier_chain_unregister _raw_read_lock _raw_read_unlock _raw_spin_lock @@ -1025,7 +1028,6 @@ ww_mutex_unlock # required by cfg80211.ko - bpf_trace_run10 csum_partial debugfs_rename __dev_change_net_namespace @@ -1227,8 +1229,10 @@ match_string memory_read_from_buffer migrate_swap + perf_event_create_kernel_counter + perf_event_enable + perf_event_read_local pick_highest_pushable_task - raw_notifier_chain_unregister raw_spin_rq_lock_nested raw_spin_rq_unlock _raw_write_trylock @@ -1272,6 +1276,7 @@ __traceiter_android_vh_binder_restore_priority __traceiter_android_vh_binder_set_priority __traceiter_android_vh_binder_wakeup_ilocked + __traceiter_android_vh_jiffies_update __traceiter_android_vh_scheduler_tick __traceiter_android_vh_syscall_prctl_finished __traceiter_binder_transaction_received @@ -1302,6 +1307,7 @@ __tracepoint_android_vh_binder_restore_priority __tracepoint_android_vh_binder_set_priority __tracepoint_android_vh_binder_wakeup_ilocked + __tracepoint_android_vh_jiffies_update __tracepoint_android_vh_scheduler_tick __tracepoint_android_vh_syscall_prctl_finished __tracepoint_binder_transaction_received @@ -2048,6 +2054,9 @@ # required by scsc_wlan.ko arp_tbl + __cpuhp_remove_state + __cpuhp_state_add_instance + __cpuhp_state_remove_instance dev_addr_mod dev_alloc_name __dev_queue_xmit @@ -2056,6 +2065,7 @@ dql_reset dst_release ether_setup + __find_nth_bit for_each_kernel_tracepoint in4_pton in6_pton @@ -2200,7 +2210,6 @@ drm_syncobj_get_handle drm_syncobj_replace_fence __fdget - _find_first_zero_bit __folio_put get_random_u32 __get_task_comm @@ -2261,7 +2270,6 @@ __traceiter_gpu_mem_total __tracepoint_android_vh_meminfo_proc_show __tracepoint_gpu_mem_total - ttm_bo_eviction_valuable ttm_bo_init_reserved ttm_bo_kmap ttm_bo_kunmap @@ -2576,5 +2584,6 @@ __skb_get_hash __skb_gso_segment tasklet_unlock_wait + ttm_bo_eviction_valuable ufshcd_mcq_poll_cqe_nolock unregister_netdevice_many