If a dev command times out, clk_scaling.active_reqs is not decreased which
causes abnormal clock scaling.
It is complicated to handle different dev command timeout cases in both
legacy mode and MCQ mode. Besides, dev cmds are rarely used and the busy
time is short.
Remove clock scaling busy window for dev cmds like we do for UIC or TM cmds
which don't update busy window either.
Change-Id: I2f25dc5032126778ac99b6a79bd78f9578dd730c
(cherry picked from commit e66413faa5b55800ad42a570aad674aed634c5e6)
Signed-off-by: Peter Wang <peter.wang@mediatek.com>
Link: https://lore.kernel.org/r/20231004062454.29165-1-peter.wang@mediatek.com
Reviewed-by: Stanley Chu <stanley.chu@mediatek.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Add the underlying symbols for trace_android_vh_try_fixup_sea.
Bug: 320358381
Change-Id: I0fa34513d1cd503159abfef0eb6fe50284f21316
Signed-off-by: Chris Goldsworthy <quic_cgoldswo@quicinc.com>
path_lookupat() is capable of safely reading unampped VAs. If an
unmapped VA is read whilst the function is being called, the resulting
page fault will get re-directed to __do_page_fault(), which will call
fixup_exception() to handle the aforementioned unmapped VA read.
Now, for an OS running in a VM, let's say that memory was still mapped
at S1 but lent to another VM (i.e. unmapped at S2 for the given VM).
The reading of an unmapped VA in path_lookupat() still needs to be
handled. For hypervisors that inject an abort leading to a do_sea()
call, call fixup_exception() from do_sea() if
trace_android_vh_try_fixup_sea() indicates that we can do so.
Bug: 320358381
Change-Id: I0aedcd954f08e3011b27524f9a7b038debbb246d
Signed-off-by: Chris Goldsworthy <quic_cgoldswo@quicinc.com>
In dw_pcie_host_init() regardless of whether the link has been
started or not, the code waits for the link to come up. Even in
cases where start_link() is not defined the code ends up spinning
in a loop for 1 second. Since in some systems dw_pcie_host_init()
gets called during probe, this one second loop for each pcie
interface instance ends up extending the boot time.
Wait for the link up in only if the start_link() is defined.
The patch submitted to the upstream kernel (see link below) was not
accepted due to no upstream user.
The change here is a simplified version of that patch, which will wait
for a link only if start_link ops has been defined.
Bug: 315052790
Link: https://lore.kernel.org/all/20240112093006.2832105-1-ajayagarwal@google.com/
Change-Id: I4e8d00f6195062728417e41ddd51072880676920
Signed-off-by: Sajid Dalvi <sdalvi@google.com>
Currently the core UFS driver does not have a vops to notify when the
device is operational. This commit introduces a hook, which serves to
notify device completing initialization and is ready to accept I/O.
This is required by the FIPS140-2 [1] self integrity test of inline
encryption engine, which must run whenever the host controller is reset.
The code requires sleeping while waiting for I/O to complete and allocating
some memory dynamically, which requires the vendor hook to be restricted.
[1] https://csrc.nist.gov/publications/detail/fips/140/2/final
Bug: 185809932
Signed-off-by: Konstantin Vyshetsky <vkon@google.com>
(cherry picked from commit e774e4eca6)
(cherry picked from https://android-review.googlesource.com/q/commit:c0f24579002c3fb0e404f223f8574c7f4fdac200)
Merged-In: I6f476f9c2e2b50574d2898c3f1ef6b648d92df24
Change-Id: I6f476f9c2e2b50574d2898c3f1ef6b648d92df24
Adding the following symbols:
- devfreq_remove_governor
Test: Build
Bug: 325161541
Change-Id: I76dd0eed62685b71fd95f758fd9b401da87e4df2
Signed-off-by: Will Song <jinpengsong@google.com>
If a virtio_pci_device supports native PCI power management and has the
No_Soft_Reset bit set, then skip resetting and reinitializing the device
when suspending and restoring the device. This allows system-wide low
power states like s2idle to be used in systems with stateful virtio
devices that can't simply be re-initialized (e.g. virtio-fs).
Signed-off-by: David Stevens <stevensd@chromium.org>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Bug: 318540621
Change-Id: Ifc60f72a6a6bd256fa14e291e615c7514dcb4d7d
(cherry picked from commit dff4fa0e57856045359440d05af9e9b7f7048f52)
Signed-off-by: Philip Chen <philipchen@google.com>
(cherry picked from commit a7dcf250aeb8e2a572774a0e51fc0432875b6661)
commit b1db244ffd041a49ecc9618e8feb6b5c1afcdaa7 upstream.
When deactivating the catch-all set element, check the state in the next
generation that represents this transaction.
This bug uncovered after the recent removal of the element busy mark
a2dd0233cb ("netfilter: nf_tables: remove busy mark and gc batch API").
Bug: 323034444
Fixes: aaa31047a6 ("netfilter: nftables: add catch-all set element support")
Cc: stable@vger.kernel.org
Reported-by: lonial con <kongln9170@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit a372f1d01b)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I40ac92a33db48a2709079d27d7d529946ba297c7
kthread_create_on_cpu no longer marks the created thread as a per cpu
thread, so the affinity might get lost on suspend or other hotplug
events.
Export kthread_set_per_cpu so a module that needs a kthread to stay on a
specific cpu can accomplish that.
Bug: 274202992
Change-Id: Iaafc12f93f341f9e0586cb051b7f1c941f140866
Signed-off-by: Arve Hjønnevåg <arve@android.com>
(cherry picked from commit 4fdc7e4658)
The following list of commits, which are in the 6.1.57 release, add a
new field in struct ipv6_devconf and this breaks the abi. Fix this by
using one of the reserved slots for upstream changes and update the stg
file to preserve the build.
b691264274 ("net: release reference to inet6_dev pointer")
bad004c384 ("net: change accept_ra_min_rtr_lft to affect all RA lifetimes")
ec4162bb70 ("net: add sysctl accept_ra_min_rtr_lft")
type 'struct ipv6_devconf' changed
member 'union { struct { __s32 accept_ra_min_lft; u32 padding; }; struct { u64 android_kabi_reserved1; }; union { }; }' was added
member 'u64 android_kabi_reserved1' was removed
Bug: 320243175
Change-Id: Icddcad574f3c29f6d3e63b10f8c7e51bdf46fe7f
Signed-off-by: Carlos Llamas <cmllamas@google.com>
The android_kabi.h header file uses the __stringify() macro without
explicitly including its definition via linux/stringify.h. This can
result in build breaking when using the ANDROID_KABI_USE macro:
common/include/linux/ipv6.h:83:2: error: expected ')'
ANDROID_KABI_USE(1, struct { __s32 accept_ra_min_lft; u32 padding; });
^
[...]
common/include/linux/android_kabi.h:44:24: note: expanded from macro '__ANDROID_KABI_CHECK_SIZE_ALIGN'
__FILE__ ":" __stringify(__LINE__) ": " \
^
To fix this let android_kabi.h include stringify.h explicitly instead of
relying on includes of previous unrelated header files.
Bug: 324437514
Change-Id: I16cced44e723871b2e1a92b312e60f38e41fea70
Signed-off-by: Carlos Llamas <cmllamas@google.com>
I encountered a race issue after lengthy (~594647 sec) stress tests on
a 64k-page arm64 VM with several 4k-block EROFS images. The timing
is like below:
z_erofs_try_inplace_io z_erofs_fill_bio_vec
cmpxchg(&compressed_bvecs[].page,
NULL, ..)
[access bufvec]
compressed_bvecs[] = *bvec;
Previously, z_erofs_submit_queue() just accessed bufvec->page only, so
other fields in bufvec didn't matter. After the subpage block support
is landed, .offset and .end can be used too, but filling bufvec isn't
an atomic operation which can cause inconsistency.
Let's use a spinlock to keep the atomicity of each bufvec.
Fixes: 192351616a9d ("erofs: support I/O submission for sub-page compressed blocks")
Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
Reviewed-by: Sandeep Dhavale <dhavale@google.com>
Reviewed-by: Yue Hu <huyue2@coolpad.com>
Link: https://lore.kernel.org/r/20240125120039.3228103-1-hsiangkao@linux.alibaba.com
Bug: 324640522
(cherry picked from commit cc4b2dd95f0d1eba8c691b36e8f4d1795582f1ff
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/ master)
[dhavale: introduced spinlock in struct erofs_workgroup, upstream has a
change where atomic is replaced by lockref but pulling that and related
changes will cause unnecessary churn. Adding spinlock keeps the spirit
of the change in-tact by fixing the race. Also updated commit message
as we are not using lockref.]
Change-Id: Id20a0a433277ab71d46bce48c81824564d1b391d
Signed-off-by: Sandeep Dhavale <dhavale@google.com>
Instead of invalidating the tlb of the guest every page it relinquishes,
invalidate once before the host is informed about the free pages.
Bug: 315173520
Change-Id: I8450fd552a27dfc791efa15e884982aeedaa3234
Signed-off-by: Prakruthi Deepak Heragu <quic_pheragu@quicinc.com>
Move out the kvm specific page_relinquish call and introduce a generic
hypervisor_ops structure. Based on the hypervisor running underneath the
guest, populate the operations to make specific hypercalls.
Bug: 315173520
Change-Id: I93d5a92553a04d56811b0666dec6eacc1ca168e7
Signed-off-by: Prakruthi Deepak Heragu <quic_pheragu@quicinc.com>
Full LTO takes the '-mbranch-protection=none' passed to the compiler
when generating the dynamic shadow call stack patching code as a hint to
stop emitting PAC instructions altogether. (Thin LTO appears unaffected
by this)
Work around this by disabling LTO for the compilation unit, which
appears to convince the linker that it should still use PAC in the rest
of the kernel..
Fixes: 3b619e22c4 ("arm64: implement dynamic shadow call stack for Clang")
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Reviewed-by: Kees Cook <keescook@chromium.org>
Reviewed-by: Sami Tolvanen <samitolvanen@google.com>
Tested-by: Sami Tolvanen <samitolvanen@google.com>
Link: https://lore.kernel.org/r/20240123133052.1417449-6-ardb+git@google.com
Signed-off-by: Will Deacon <will@kernel.org>
(cherry picked from commit d104a6fef3fec137d8d44961224ab76edbd6cbc7)
Bug: 317883735
Change-Id: Ic4bdb0a6e527f8cb2745282b81945aa7b7231502
Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
Blocks are tracked by u32, so the max permitted filesize is
(U32_MAX + 1) * BLOCK_SIZE. Additionally, in order to support crypto
data unit sizes of 4K with a 16K block with IV_INO_LBLK_{32,64}, we must
further restrict max filesize to (U32_MAX + 1) * 4096. This does not
affect 4K blocksize f2fs as the natural limit for files are well below
that.
Fixes: cf46c5872022 ("BACKPORT: Support Block Size == Page Size")
Signed-off-by: Daniel Rosenberg <drosen@google.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Change-Id: I8697e37841e1882a3f613e9aab1857ad7e4c3f2f
Bug: 248132568
(cherry picked from commit a6a010f5def544af3efcfe21683905a712b60536)
This allows f2fs to support cases where the block size = page size for
both 4K and 16K block sizes. Other sizes should work as well, should the
need arise. This does not currently support 4K Block size filesystems if
the page size is 16K.
Change-Id: Ifab03cddeec1389a6a3fb64174063ffccbb93072
Signed-off-by: Daniel Rosenberg <drosen@google.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Bug: 248132568
(cherry picked from commit 8b8e202be3264fc33464f8dc319e0c1563ac89d8)
(fixed minor conflict in fs/f2fs/inode.c)
If the PD is disabled for the port, port->pds will be left as NULL,
which causes the following crash during caps intilisation. Fix the
crash.
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
Call trace:
tcpm_register_port+0xaec/0xc44
qcom_pmic_typec_probe+0x1a4/0x254
platform_probe+0x68/0xc0
really_probe+0x148/0x2ac
__driver_probe_device+0x78/0x12c
driver_probe_device+0xd8/0x160
Bluetooth: hci0: QCA Product ID :0x0000000a
__device_attach_driver+0xb8/0x138
bus_for_each_drv+0x80/0xdc
Bluetooth: hci0: QCA SOC Version :0x40020150
__device_attach+0x9c/0x188
device_initial_probe+0x14/0x20
bus_probe_device+0xac/0xb0
deferred_probe_work_func+0x8c/0xc8
process_one_work+0x1ec/0x51c
worker_thread+0x1ec/0x3e4
kthread+0x120/0x124
ret_from_fork+0x10/0x20
Fixes: cd099cde4ed2 ("usb: typec: tcpm: Support multiple capabilities")
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Link: https://lore.kernel.org/r/20240113-pmi632-typec-v2-5-182d9aa0a5b3@linaro.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
BUG: 206108037
(cherry picked from commit f2e5d3de7e1fbf24483e7f996e519b3ebc3935a1)
Change-Id: If3e81f4bc7c22830d8b0e8400b6e2fc8719a7f6b
Signed-off-by: Kyle Tso <kyletso@google.com>
commit f342de4e2f33e0e39165d8639387aa6c19dff660 upstream.
This reverts commit e0abdadcc6.
core.c:nf_hook_slow assumes that the upper 16 bits of NF_DROP
verdicts contain a valid errno, i.e. -EPERM, -EHOSTUNREACH or similar,
or 0.
Due to the reverted commit, its possible to provide a positive
value, e.g. NF_ACCEPT (1), which results in use-after-free.
Its not clear to me why this commit was made.
NF_QUEUE is not used by nftables; "queue" rules in nftables
will result in use of "nft_queue" expression.
If we later need to allow specifiying errno values from userspace
(do not know why), this has to call NF_DROP_GETERR and check that
"err <= 0" holds true.
Bug: 323034288
Fixes: e0abdadcc6 ("netfilter: nf_tables: accept QUEUE/DROP verdict parameters")
Cc: stable@vger.kernel.org
Reported-by: Notselwyn <notselwyn@pwning.tech>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 8e34430e33)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: Ie6c699cea6f92cd4a7642f196d5f5cbffe268a6d
The d_canonical_path is added for Android. The another fuse daemon
such as ntfs.3g do not implement it. The fsnotify can not work when
using those fuse daemon.
Fixes: aca265111a ("ANDROID: fuse: Add support for d_canonical_path")
Change-Id: I4244431fa1520b5bc33e07da456b3062b635dc5c
Signed-off-by: chenyuwen <chenyuwen1@meizu.com>
The function is required by out of tree cpufreq governors.
Bug: 322549912
Signed-off-by: Qais Yousef <qyousef@google.com>
Change-Id: Ib62bb957d72878a56cbbd955447b372cdad3b92c
Both kernel modules are important for testing block layer and SCSI core
performance and functionality. Hence enable these in the kernel
configuration.
Bug: 323406846
Change-Id: I23cee78cd7d4e5f891395624a6bed01cffee4aa8
Signed-off-by: Bart Van Assche <bvanassche@google.com>
There are two tracepoints in dwc3_readl() and dwc3_writel().
This patch will export the tracepoints so that vendor modules
can use them.
Bug: 184920962
Signed-off-by: Ray Chi <raychi@google.com>
Change-Id: I1170d853be1fa1c47afbba133567b1996418d8e8
Some hardware has a way to restore all keyslots at once that is
significantly faster than restoring each keyslot individually, as is
done by blk_ksm_reprogram_all_keys(). Add a hook
"android_rvh_ufs_reprogram_all_keys" that allows overriding the
restoration of all keyslots after UFS reset. This may sleep, so this
must be a "restricted" Android vendor hook rather than a regular one.
Note that currently this functionality can't be upstreamed, as support
for the hardware that needs it would need to be upstreamed first.
(cherry picked from commit e2e063f507)
Bug: 162257402
Bug: 181905172
Bug: 241106918
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Kenny Root <kroot@google.com>
Change-Id: I0b25393a5131941f085892560e08a64e63cd1369
Add hook for binder_detect_low_async_space_locked, which gives the vendor a choice whether or not this alloc new buf should go on or not
Bug: 322915513
Change-Id: Ie7f1567dae6dee0fb22b014cd1eacc3308ccb205
Signed-off-by: chenweitao <chenweitao@oppo.com>
type 'struct tcpm_port' changed
byte size changed from 12536 to 12552
member 'struct usb_power_delivery** pds' was added
member 'struct pd_data** pd_list' was added
member 'struct usb_power_delivery* pd' was removed
5 members ('struct usb_power_delivery_capabilities* port_source_caps' .. 'struct usb_power_delivery_capabilities* partner_sink_caps') changed
offset changed by 64
member 'struct usb_power_delivery* selected_pd' was added
5 members ('u32 sink_request' .. 'unsigned int nr_sink_caps') changed
offset changed by 128
member 'unsigned int pd_count' was added
14 members ('u32 src_pdo[7]' .. 'u32 supply_voltage') changed
offset changed by 160
32 members ('struct power_supply* psy' .. 'u8* logbuffer[1024]') changed
offset changed by 128
Bug: 206108037
Change-Id: I533d197558e12eefeb4984dbbd58c8f5b4d9e9ac
Signed-off-by: Kyle Tso <kyletso@google.com>
Refactor tcpm_fw_get_caps to support the multiple pd capabilities got
from fwnode. For backward compatibility, the original single capability
is still applicable. The fetched data is stored in the newly defined
structure "pd_data" and there is an array "pd_list" to store the
pointers to them. A dedicated array "pds" is used to store the handles
of the registered usb_power_delivery instances.
Also implement the .pd_get and .pd_set ops which are introduced in
commit a7cff92f06 ("usb: typec: USB Power Delivery helpers for ports
and partners"). Once the .pd_set is called, the current capability will
be updated and state machine will re-negotiate the power contract if
possible.
Signed-off-by: Kyle Tso <kyletso@google.com>
Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Link: https://lore.kernel.org/r/20231216104630.2720818-3-kyletso@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Bug: 206108037
(cherry picked from commit cd099cde4ed264403b434d8344994f97ac2a4349)
Signed-off-by: Kyle Tso <kyletso@google.com>
(cherry picked from https://android-review.googlesource.com/q/commit:eab651bc575f23415e8aa8cb39b45a92fcf8eeee)
Merged-In: I58ee6e321f304b758507287ced314cc7a07466eb
Change-Id: I58ee6e321f304b758507287ced314cc7a07466eb
[ Upstream commit 810c38a369a0a0ce625b5c12169abce1dd9ccd53 ]
Because rose_ioctl() accesses sk->sk_receive_queue
without holding a sk->sk_receive_queue.lock, it can
cause a race with rose_accept().
A use-after-free for skb occurs with the following flow.
```
rose_ioctl() -> skb_peek()
rose_accept() -> skb_dequeue() -> kfree_skb()
```
Add sk->sk_receive_queue.lock to rose_ioctl() to fix this issue.
Bug: 321175740
Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Signed-off-by: Hyunwoo Kim <v4bel@theori.io>
Link: https://lore.kernel.org/r/20231209100538.GA407321@v4bel-B760M-AORUS-ELITE-AX
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
(cherry picked from commit 3f1f6a94d8)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I94d2aae6221fb95cb285e1a6d0c6fe39a70e35d2
[ Upstream commit af73483f4e8b6f5c68c9aa63257bdd929a9c194a ]
The IDA usually detects double-frees, but that detection failed to
consider the case when there are no nearby IDs allocated and so we have a
NULL bitmap rather than simply having a clear bit. Add some tests to the
test-suite to be sure we don't inadvertently reintroduce this problem.
Unfortunately they're quite noisy so include a message to disregard
the warnings.
Bug: 321878978
Reported-by: Zhenghan Wang <wzhmmmmm@gmail.com>
Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
(cherry picked from commit 5dbcdaf4db)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I4919e5c64af12f86fe1a91e1e9224a58eedbf345
This reverts commit 63eafbb6b3.
Keeps the ABI stable by taking advantage of a hole in the structure!
Bug: 307236803
Change-Id: Ic5f7ebeb3a9b13afdb3bfff7e54c4a93b863dab6
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
