Commit Graph

1068206 Commits

Author SHA1 Message Date
Kalesh Singh
e4d3bd98c3 BACKPORT: mm: Multi-gen LRU: remove wait_event_killable()
Android 14 and later default to MGLRU [1] and field telemetry showed
occasional long tail latency (>100ms) in the reclaim path.

Tracing revealed priority inversion in the reclaim path.  In
try_to_inc_max_seq(), when high priority tasks were blocked on
wait_event_killable(), the preemption of the low priority task to call
wake_up_all() caused those high priority tasks to wait longer than
necessary.  In general, this problem is not different from others of its
kind, e.g., one caused by mutex_lock().  However, it is specific to MGLRU
because it introduced the new wait queue lruvec->mm_state.wait.

The purpose of this new wait queue is to avoid the thundering herd
problem.  If many direct reclaimers rush into try_to_inc_max_seq(), only
one can succeed, i.e., the one to wake up the rest, and the rest who
failed might cause premature OOM kills if they do not wait.  So far there
is no evidence supporting this scenario, based on how often the wait has
been hit.  And this begs the question how useful the wait queue is in
practice.

Based on Minchan's recommendation, which is in line with his commit
6d4675e601 ("mm: don't be stuck to rmap lock on reclaim path") and the
rest of the MGLRU code which also uses trylock when possible, remove the
wait queue.

[1] https://android-review.googlesource.com/q/I7ed7fbfd6ef9ce10053347528125dd98c39e50bf

Link: https://lkml.kernel.org/r/20230413214326.2147568-1-kaleshsingh@google.com
Fixes: bd74fdaea1 ("mm: multi-gen LRU: support page table walks")
Change-Id: I911f3968fd1adb25171279cc5b6f48ccb7efc8de
Signed-off-by: Kalesh Singh <kaleshsingh@google.com>
Suggested-by: Minchan Kim <minchan@kernel.org>
Reported-by: Wei Wang <wvw@google.com>
Acked-by: Yu Zhao <yuzhao@google.com>
Cc: Minchan Kim <minchan@kernel.org>
Cc: Jan Alexander Steffens (heftig) <heftig@archlinux.org>
Cc: Oleksandr Natalenko <oleksandr@natalenko.name>
Cc: Suleiman Souhlal <suleiman@google.com>
Cc: Suren Baghdasaryan <surenb@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
(cherry picked from commit 7f63cf2d9b)
Bug: 277906484
[ Kalesh Singh - Fix conflicts in mm/vmscan.c ]
Signed-off-by: Kalesh Singh <kaleshsingh@google.com>
2023-06-08 00:00:33 +00:00
Kalesh Singh
fed85f9573 Revert "ANDROID: BACKPORT: mm: Multi-gen LRU: remove wait_event_killable()"
This reverts commit 397665b3ed.

Will be replace by closer to upstream verion and ABI will be updated.

Bug: 277906484
Change-Id: Ieabfeaad50ac5001f6a5b87c1dd1051d47bc40af
Signed-off-by: Kalesh Singh <kaleshsingh@google.com>
2023-06-08 00:00:33 +00:00
Bing Han
02f1e30bab ANDROID: add vendor fields to swap_info_struct to record swap stats
struct swap_info_struct :: ANDROID_VENDOR_DATA(1)
	It is pointer to a struct to record the following message:
	1) total swapin pages;
	2) total swapout pages;
	3) total number of cold pages swapin;
	4) total number of swapout pages, specified by userspace;
	5) total number of swapout pages, specified by kernel;
	6) the maxmium number of swapout pages;
	7) the maxmium number of swapout pages allowed by kernel;
	8) the maxmium number of swapout pages allowed by framework;

Bug: 225795494
Change-Id: I779145a83d87e339db86ec81c7f962be99946afb
Signed-off-by: Bing Han <bing.han@transsion.com>
(cherry picked from commit af4eb0e377)
(cherry picked from commit 29277e2bf79d36eede562b529c8e7b295e9a53df)
2023-06-08 00:00:33 +00:00
Bing Han
422d698c21 ANDROID: add vendor fields to swap_slots_cache to support multiple swap devices
struct swap_slots_cache  :: ANDROID_VENDOR_DATA(1)
1) Multiple swap devices can be supported;
2) There are different kinds of data;
3) During data reclamation, different types of data are exchanged
   to different swap devices;
4) Each swap device has corresponding arrays of slots and slots_ret;
5) Each swap device has corresponding indexes of nr, cur and n_ret;
6) This field is a pointer, it points to a struct which contains
   all the other arrays and indexes;

Bug: 225795494
Change-Id: Icf116135926be98449a2d96fc458e58e5ad3b7e9
Signed-off-by: Bing Han <bing.han@transsion.com>
(cherry picked from commit a034320a68)
(cherry picked from commit 2fd1f19d555cb63bdf2f810f9b944feabf836dff)
2023-06-08 00:00:33 +00:00
Bing Han
0e9bac35c5 ANDROID: add vendor fields to lruvec to record refault stats
struct lruvec :: ANDROID_VENDOR_DATA(1)
It is pointer to a struct to record the following message:
1)the account of workingset_restore pages of cached anonymous and
   file pages
This is used to adjust the strategy and amount of reclaiming data.

Bug: 225795494
Change-Id: I34e57ee23b6c97ac91effa5b72513d238335a996
Signed-off-by: Bing Han <bing.han@transsion.com>
(cherry picked from commit 1b14ae01b0)
(cherry picked from commit dcac70709fb59478979519d7502b2bb5b8389ff6)
2023-06-08 00:00:33 +00:00
Bart Van Assche
619ba336c3 ANDROID: block: Remove request_queue.requeue_work
request_queue.requeue_work is no longer used since "block: Preserve the
order of requeued requests". Hence remove this request member.

Bug: 280677698
Change-Id: I1c9d9cd9a5f5d630bb638e5b0a64fbe0a9201459
Signed-off-by: Bart Van Assche <bvanassche@google.com>
2023-06-08 00:00:33 +00:00
Bart Van Assche
ff2f1d6faa ANDROID: scsi: ufs: Ungate the clock synchronously
Ungating the clock asynchronously causes ufshcd_queuecommand() to
return SCSI_MLQUEUE_HOST_BUSY and hence causes commands to be requeued.
This is suboptimal. Allow ufshcd_queuecommand() to sleep such that
clock ungating does not trigger command requeuing.

Bug: 280677698
Change-Id: I36f78e9e3c307f4498c0d8c58a102560ecf38c7c
Signed-off-by: Bart Van Assche <bvanassche@google.com>
2023-06-08 00:00:33 +00:00
Bart Van Assche
f6e3f2aff1 ANDROID: scsi: ufs: Enable the BLK_MQ_F_BLOCKING flag
Prepare for adding code in ufshcd_queuecommand() that may sleep.

Bug: 280677698
Change-Id: I20f0a2aa4571b6ca8a51bf75f5dbf0cd8855706a
Signed-off-by: Bart Van Assche <bvanassche@google.com>
2023-06-08 00:00:33 +00:00
Bart Van Assche
d2bdb0021c ANDROID: scsi: core: Support setting BLK_MQ_F_BLOCKING
Prepare for adding code in ufshcd_queuecommand() that may sleep.

Bug: 280677698
Change-Id: I0fa2dc37ac19da889986a80f4dddd638e8571d8a
Signed-off-by: Bart Van Assche <bvanassche@google.com>
2023-06-08 00:00:33 +00:00
Carlos Llamas
61095a49ad ANDROID: ABI: remove stale symbol
The following symbol no longer exists after backporting upstream commit
6fd1d51cfa ("net: SO_RCVMARK socket option for SO_MARK with
recvmsg()"). Removing the symbol fixes the following KMI build issue:

Symbols missing from the ksymtab:
  __sock_recv_ts_and_drops
ERROR: Checking for kmi_symbol_list_strict_mode

Bug: 285364323
Cc: zhangao <zhangao@zeku.com>
Change-Id: I53038b3561c0d758b908307ea17d3f9c8c2ec472
Signed-off-by: Carlos Llamas <cmllamas@google.com>
2023-06-08 00:00:33 +00:00
Eyal Birger
38c8eba1ca UPSTREAM: net: align SO_RCVMARK required privileges with SO_MARK
The commit referenced in the "Fixes" tag added the SO_RCVMARK socket
option for receiving the skb mark in the ancillary data.

Since this is a new capability, and exposes admin configured details
regarding the underlying network setup to sockets, let's align the
needed capabilities with those of SO_MARK.

Fixes: 6fd1d51cfa ("net: SO_RCVMARK socket option for SO_MARK with recvmsg()")
Signed-off-by: Eyal Birger <eyal.birger@gmail.com>
Link: https://lore.kernel.org/r/20220504095459.2663513-1-eyal.birger@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
(cherry picked from commit 1f86123b97)
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I475283f1dc91d3f0b849c888d3a936fbf2105748
2023-06-08 00:00:33 +00:00
Erin MacNeil
645bc81185 UPSTREAM: net: SO_RCVMARK socket option for SO_MARK with recvmsg()
Adding a new socket option, SO_RCVMARK, to indicate that SO_MARK
should be included in the ancillary data returned by recvmsg().

Renamed the sock_recv_ts_and_drops() function to sock_recv_cmsgs().

Signed-off-by: Erin MacNeil <lnx.erin@gmail.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: David Ahern <dsahern@kernel.org>
Acked-by: Marc Kleine-Budde <mkl@pengutronix.de>
Link: https://lore.kernel.org/r/20220427200259.2564-1-lnx.erin@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
(cherry picked from commit 6fd1d51cfa)
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I99221c48889fcc5a0633f633b6da73ecd66e26f2
2023-06-08 00:00:33 +00:00
Jim Wylder
0fed4e1616 UPSTREAM: regmap: Account for register length when chunking
Currently, when regmap_raw_write() splits the data, it uses the
max_raw_write value defined for the bus.  For any bus that includes
the target register address in the max_raw_write value, the chunked
transmission will always exceed the maximum transmission length.
To avoid this problem, subtract the length of the register and the
padding from the maximum transmission.

Signed-off-by: Jim Wylder <jwylder@google.com
Link: https://lore.kernel.org/r/20230517152444.3690870-2-jwylder@google.com
Signed-off-by: Mark Brown <broonie@kernel.org
Bug: 284126209
Change-Id: Ie265716bf523ed29c7d5ef9c0292e220adfb9dfc
(cherry picked from commit 3981514180)
Signed-off-by: Jim Wylder <jwylder@google.com>
2023-06-07 22:48:54 +00:00
Quentin Perret
f744b16d28 ANDROID: KVM: arm64: Initialize hfgwtr_el2 correctly
With FEAT_FGT, most bits in hfgwtr_el2 must be set to 1 to enable
trapping of MSR writes of certain registers. However, there is a
notable (and arguably curious) exception for nSMPRI_EL1 and
nTPIDR2_EL0 which must be set to 1 to _disable_ trapping of the
corresponding SME registers.

Make sure to initialize hfgwtr_el2 in the pKVM init params accordingly
to avoid accidentally enabling certain traps on hardware that supports
FEAT_FGT and FEAT_SME.

Bug: 282917063
Bug: 282993310
Change-Id: Ia96fa6856b4e7ef98b3cea4f03fcbc0ee03f10c5
Tested-by: Nick Desaulniers <ndesaulniers@google.com>
Signed-off-by: Quentin Perret <qperret@google.com>
2023-06-07 16:00:28 +00:00
Qais Yousef
858f6f1541 ANDROID: sched/fair: unlink misfit from cpu overutilized
Partially applies patch from Vincent Guittot

	e5ed0550c0: ("sched/fair: unlink misfit task from cpu overutilized")

The full patch improves the search logic under thermal pressure, but
it's a bit intrusive to fully backport. We are interested in the part
that unlinks misfit from overutilized only.

Bug: 283975667
Signed-off-by: Qais Yousef <qyousef@google.com>
Change-Id: I2ae21499b846d13d3889f8cacdb70652817b066f
2023-06-06 19:51:56 +00:00
Stanley Chang
a393cfd70d UPSTREAM: dt-bindings: usb: snps,dwc3: Add 'snps,parkmode-disable-hs-quirk' quirk
Add a new 'snps,parkmode-disable-hs-quirk' DT quirk to dwc3 core for
disable the high-speed parkmode.

For some USB wifi devices, if enable this feature it will reduce the
performance. Therefore, add an option for disabling HS park mode by
device-tree.

In Synopsys's dwc3 data book:
In a few high speed devices when an IN request is sent within 900ns of the
ACK of the previous packet, these devices send a NAK. When connected to
these devices, if required, the software can disable the park mode if you
see performance drop in your system. When park mode is disabled,
pipelining of multiple packet is disabled and instead one packet at a time
is requested by the scheduler. This allows up to 12 NAKs in a micro-frame
and improves performance of these slow devices.

Acked-by: Rob Herring <robh@kernel.org>
Signed-off-by: Stanley Chang <stanley_chang@realtek.com>
Link: https://lore.kernel.org/r/20230419020044.15475-2-stanley_chang@realtek.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Bug:285992796
(cherry picked from commit 4a2f152af1
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git master)
Change-Id: If445a42082326b981f75ed21bc92a4b7c2fff685
Signed-off-by: Stanley Chang <stanley_chang@realtek.com>
2023-06-06 19:22:36 +00:00
Stanley Chang
d47ecf2f59 UPSTREAM: usb: dwc3: core: add support for disabling High-speed park mode
Setting the PARKMODE_DISABLE_HS bit in the DWC3_USB3_GUCTL1.
When this bit is set to '1' all HS bus instances in park mode are disabled

For some USB wifi devices, if enable this feature it will reduce the
performance. Therefore, add an option for disabling HS park mode by
device-tree.

In Synopsys's dwc3 data book:
In a few high speed devices when an IN request is sent within 900ns of the
ACK of the previous packet, these devices send a NAK. When connected to
these devices, if required, the software can disable the park mode if you
see performance drop in your system. When park mode is disabled,
pipelining of multiple packet is disabled and instead one packet at a time
is requested by the scheduler. This allows up to 12 NAKs in a micro-frame
and improves performance of these slow devices.

Acked-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Signed-off-by: Stanley Chang <stanley_chang@realtek.com>
Link: https://lore.kernel.org/r/20230419020044.15475-1-stanley_chang@realtek.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Bug:285992796
(cherry picked from commit d21a797a3e
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git master)
Change-Id: I81f3a0bf15d2405fbb85bbe3a55cdbeb015ce48e
Signed-off-by: Stanley Chang <stanley_chang@realtek.com>
2023-06-06 19:22:36 +00:00
Bin Yang
cfb11ffd57 UPSTREAM: usb: dwc3: core: do not use 3.0 clock when operating in 2.0 mode
In the 3.0 device core, if the core is programmed to operate in
2.0 only, then setting the GUCTL1.DEV_FORCE_20_CLK_FOR_30_CLK makes
the internal 2.0(utmi/ulpi) clock to be routed as the 3.0 (pipe)
clock. Enabling this feature allows the pipe3 clock to be not-running
when forcibly operating in 2.0 device mode.

Tested-by: Michael Riesch <michael.riesch@wolfvision.net>
Signed-off-by: Bin Yang <yangbin@rock-chips.com>
Signed-off-by: Peter Geis <pgwipeout@gmail.com>
Link: https://lore.kernel.org/r/20220228135700.1089526-6-pgwipeout@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Bug:285984663
(cherry picked from commit 62b20e6e0d
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git master)
Change-Id: I104aefd490413cc3ee8d9bceefba01c5b29a3250
Signed-off-by: Stanley Chang <stanley_chang@realtek.com>
2023-06-06 19:22:36 +00:00
vincent wang
5a5805873e ANDROID: GKI: Update symbol list for Lenovo
Add symbol list for Lenovo

1 function symbol added
	'rebuild_sched_domains()'

Bug: 286015587
Change-Id: I35fe23cc6314fb6b7bf564f0fd749141f4c33752
Signed-off-by: vincent wang <vincentwang3@lenovo.com>
2023-06-06 18:15:52 +00:00
Stephen Dickey
7624f5afdf ANDROID: kernel/sched: rebuild_sched_domains export
Vendor module needs to rebuild sched domains at boot, in the
event that cpufreq initializes the energy model too late.

Bug: 242898038
Change-Id: Ifaf1223366ac81c3f3c382dd0f61110fce9c1b20
Signed-off-by: Stephen Dickey <quic_dickey@quicinc.com>
(cherry picked from commit 20ba031cf8)
2023-06-06 18:15:52 +00:00
Robert Lee
872144a3a9 ANDROID: Update the ABI symbol list
Adding the following symbols:
  - snd_pcm_hw_constraint_integer
  - snd_soc_set_runtime_hwparams

Bug: 264508873
Change-Id: I5616a0aa475456abdfb466d62c08accd5f8b222f
Signed-off-by: Robert Lee <lerobert@google.com>
2023-06-06 12:05:41 +08:00
Wanwei Jiang
fa700b32b1 ANDROID: GKI: Update symbol list for Amlogic
Add the following symbols:
  - bpf_trace_run8
  - dma_fence_get_stub
  - spi_finalize_current_message
  - strim

Bug: 284949440
Change-Id: Ife34464786b780e74dbe08e7acb5611556337597
Signed-off-by: Wanwei Jiang <wanwei.jiang@amlogic.com>
2023-06-05 20:44:39 +00:00
erinwang2
5ef78a29d1 ANDROID: GKI: Add symbol list for lenovo
Add symbol list for lenovo

66 function symbol(s) added
  'struct gendisk* __alloc_disk_node(struct request_queue*, int, struct lock_class_key*)'
  'void blk_freeze_queue_start(struct request_queue*)'
  'bool blk_get_queue(struct request_queue*)'
  'void blk_mark_disk_dead(struct gendisk*)'
  'struct request* blk_mq_alloc_request(struct request_queue*, unsigned int, blk_mq_req_flags_t)'
  'struct request* blk_mq_alloc_request_hctx(struct request_queue*, unsigned int, blk_mq_req_flags_t, unsigned int)'
  'int blk_mq_alloc_sq_tag_set(struct blk_mq_tag_set*, const struct blk_mq_ops*, unsigned int, unsigned int)'
  'bool blk_mq_complete_request_remote(struct request*)'
  'void blk_mq_delay_kick_requeue_list(struct request_queue*, unsigned long)'
  'void blk_mq_free_request(struct request*)'
  'void blk_mq_freeze_queue(struct request_queue*)'
  'void blk_mq_freeze_queue_wait(struct request_queue*)'
  'int blk_mq_freeze_queue_wait_timeout(struct request_queue*, unsigned long)'
  'int blk_mq_pci_map_queues(struct blk_mq_queue_map*, struct pci_dev*, int)'
  'void blk_mq_requeue_request(struct request*, bool)'
  'struct request* blk_mq_tag_to_rq(struct blk_mq_tags*, unsigned int)'
  'void blk_mq_tagset_busy_iter(struct blk_mq_tag_set*, busy_tag_iter_fn*, void*)'
  'void blk_mq_tagset_wait_completed_request(struct blk_mq_tag_set*)'
  'void blk_mq_unfreeze_queue(struct request_queue*)'
  'void blk_mq_update_nr_hw_queues(struct blk_mq_tag_set*, int)'
  'void blk_put_queue(struct request_queue*)'
  'void blk_queue_chunk_sectors(struct request_queue*, unsigned int)'
  'void blk_queue_dma_alignment(struct request_queue*, int)'
  'bool blk_queue_flag_test_and_set(unsigned int, struct request_queue*)'
  'void blk_queue_max_zone_append_sectors(struct request_queue*, unsigned int)'
  'void blk_queue_set_zoned(struct gendisk*, enum blk_zoned_model)'
  'void blk_queue_virt_boundary(struct request_queue*, unsigned long)'
  'int blk_revalidate_disk_zones(struct gendisk*, void(*)(struct gendisk*))'
  'void blk_sync_queue(struct request_queue*)'
  'int blkdev_compat_ptr_ioctl(struct block_device*, fmode_t, unsigned int, unsigned long)'
  'int dev_pm_qos_expose_latency_tolerance(struct device*)'
  'void dev_pm_qos_hide_latency_tolerance(struct device*)'
  'int dev_pm_qos_update_user_latency_tolerance(struct device*, s32)'
  'bool device_remove_file_self(struct device*, const struct device_attribute*)'
  'void devm_release_resource(struct device*, struct resource*)'
  'size_t dma_max_mapping_size(struct device*)'
  'struct fwnode_handle* fwnode_find_reference(const struct fwnode_handle*, const char*, unsigned int)'
  'struct fwnode_handle* fwnode_get_next_child_node(const struct fwnode_handle*, struct fwnode_handle*)'
  'bool irq_check_status_bit(unsigned int, unsigned int)'
  'void irq_domain_associate_many(struct irq_domain*, unsigned int, irq_hw_number_t, int)'
  'int irq_get_percpu_devid_partition(unsigned int, struct cpumask*)'
  'void irq_work_run()'
  'struct mbox_chan* mbox_request_channel_byname(struct mbox_client*, const char*)'
  'void* memchr_inv(const void*, int, size_t)'
  'void* mempool_alloc(mempool_t*, gfp_t)'
  'mempool_t* mempool_create_node(int, mempool_alloc_t*, mempool_free_t*, void*, gfp_t, int)'
  'void mempool_destroy(mempool_t*)'
  'void mempool_free(void*, mempool_t*)'
  'void mempool_kfree(void*, void*)'
  'void* mempool_kmalloc(gfp_t, void*)'
  'int of_reserved_mem_device_init_by_name(struct device*, struct device_node*, const char*)'
  'int param_set_uint_minmax(const char*, const struct kernel_param*, unsigned int, unsigned int)'
  'int pci_aer_clear_nonfatal_status(struct pci_dev*)'
  'int pci_disable_pcie_error_reporting(struct pci_dev*)'
  'phys_addr_t pci_pio_to_address(unsigned long)'
  'int pci_sriov_configure_simple(struct pci_dev*, int)'
  'void pcibios_resource_to_bus(struct pci_bus*, struct pci_bus_region*, struct resource*)'
  'bool pcie_aspm_enabled(struct pci_dev*)'
  'int perf_aux_output_skip(struct perf_output_handle*, unsigned long)'
  'void perf_event_addr_filters_sync(struct perf_event*)'
  'int pinconf_generic_parse_dt_config(struct device_node*, struct pinctrl_dev*, unsigned long**, unsigned int*)'
  'void pinctrl_unregister(struct pinctrl_dev*)'
  'void put_disk(struct gendisk*)'
  'bool this_cpu_has_cap(unsigned int)'
  'void trace_seq_printf(struct trace_seq*, const char*, ...)'
  'void trace_seq_putc(struct trace_seq*, unsigned char)'

Bug: 285569306

Change-Id: I0d844e1026c367aeede6175398784f0776b7120f
Signed-off-by: erinwang2 <erinwang2@lenovo.com>
2023-06-02 22:52:59 -07:00
Sajid Dalvi
93a3eb5322 UPSTREAM: PCI/PM: Reduce D3hot delay with usleep_range()
PCIe r6.0, sec 5.9, requires a 10ms delay between programming a device to
change to or from D3hot and the time the device is next accessed (unless
Readiness Notifications are used).

The 10ms value (PCI_PM_D3HOT_WAIT) doesn't appear directly here because
some chipsets require 120ms for devices *below* them (pci_pm_d3hot_delay)
and some devices require more or less than 10ms (dev->d3hot_delay).

But msleep(10) typically waits about *20*ms, which is more than we need.
Switch to usleep_range() to improve the delay accuracy.

Based on a commit from Sajid in the Pixel 6 kernel tree [1].  On a Pixel 6,
the 10ms delay for the Exynos PCIe device delayed for an average of 19ms.
Switching to usleep_range() decreased the resume time by about 9ms.

[1] 18a8cad68d

[bhelgaas commit log, add timers-howto.rst link]
Link: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/timers/timers-howto.rst?id=v5.19#n73
Link: https://lore.kernel.org/r/20220921212735.2131588-1-willmcvicker@google.com
Signed-off-by: Sajid Dalvi <sdalvi@google.com>
Signed-off-by: Will McVicker <willmcvicker@google.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Matthias Kaehlcke <mka@chromium.org>

Bug: 258100247
Change-Id: Iacde62a3ec8e4b924a21fb654c89a18df2ee2b87
(cherry picked from commit 3e347969a5)
Signed-off-by: Sajid Dalvi <sdalvi@google.com>
2023-06-02 20:54:00 +00:00
tfshen
2e56d401bb ANDROID: GKI: Add RTK TV 14 5.15 KMI symbol list
add initial abi_gki_aarch64_rtktv file.

55 function symbol(s) added
  'int __traceiter_android_vh_dmabuf_heap_flags_validation(void*, struct dma_heap*, size_t, unsigned int, unsigned int, bool*)'
  'int add_memory_subsection(int, u64, u64)'
  'int alloc_contig_range(unsigned long, unsigned long, unsigned int, gfp_t, struct acr_info*)'
  'struct thermal_cooling_device* cpufreq_cooling_register(struct cpufreq_policy*)'
  'void cpufreq_cooling_unregister(struct thermal_cooling_device*)'
  'int dev_pm_opp_of_cpumask_add_table(const struct cpumask*)'
  'int dev_pm_opp_of_get_sharing_cpus(struct device*, struct cpumask*)'
  'int device_pm_wait_for_dev(struct device*, struct device*)'
  'void devm_extcon_dev_unregister(struct device*, struct extcon_dev*)'
  'struct phy* devm_of_phy_get_by_index(struct device*, struct device_node*, int)'
  'int drm_gem_mmap_obj(struct drm_gem_object*, unsigned long, struct vm_area_struct*)'
  'void drm_mode_sort(struct list_head*)'
  'void ehci_init_driver(struct hc_driver*, const struct ehci_driver_overrides*)'
  'int ehci_resume(struct usb_hcd*, bool)'
  'int ehci_setup(struct usb_hcd*)'
  'int ehci_suspend(struct usb_hcd*, bool)'
  'void flush_delayed_fput()'
  'int follow_pfn(struct vm_area_struct*, unsigned long, unsigned long*)'
  'void free_contig_range(unsigned long, unsigned long)'
  'void gen_pool_for_each_chunk(struct gen_pool*, void(*)(struct gen_pool*, struct gen_pool_chunk*, void*), void*)'
  'void kmsg_dump_rewind(struct kmsg_dump_iter*)'
  'bool kthread_freezable_should_stop(bool*)'
  'phys_addr_t memblock_end_of_DRAM()'
  'int memblock_free(phys_addr_t, phys_addr_t)'
  'void mii_ethtool_gset(struct mii_if_info*, struct ethtool_cmd*)'
  'time64_t mktime64(unsigned int, unsigned int, unsigned int, unsigned int, unsigned int, unsigned int)'
  'int mmc_get_ext_csd(struct mmc_card*, u8**)'
  'MPI mpi_alloc(unsigned int)'
  'int mpi_cmp(MPI, MPI)'
  'int mpi_cmp_ui(MPI, unsigned long)'
  'void mpi_free(MPI)'
  'void* mpi_get_buffer(MPI, unsigned int*, int*)'
  'unsigned int mpi_get_nbits(MPI)'
  'int mpi_powm(MPI, MPI, MPI, MPI)'
  'MPI mpi_read_raw_data(const void*, size_t)'
  'int nr_ipi_get()'
  'unsigned int radix_tree_gang_lookup(const struct xarray*, void**, unsigned long, unsigned int)'
  'unsigned int radix_tree_gang_lookup_tag(const struct xarray*, void**, unsigned long, unsigned int, unsigned int)'
  'int radix_tree_preload(gfp_t)'
  'void* radix_tree_tag_clear(struct xarray*, unsigned long, unsigned int)'
  'int radix_tree_tag_get(const struct xarray*, unsigned long, unsigned int)'
  'void* radix_tree_tag_set(struct xarray*, unsigned long, unsigned int)'
  'int send_sig_mceerr(int, void*, short, struct task_struct*)'
  'void smpboot_unregister_percpu_thread(struct smp_hotplug_thread*)'
  'int static_key_count(struct static_key*)'
  'int thermal_zone_unbind_cooling_device(struct thermal_zone_device*, int, struct thermal_cooling_device*)'
  'unsigned int uart_get_divisor(struct uart_port*, unsigned int)'
  'void uart_handle_cts_change(struct uart_port*, unsigned int)'
  'void uart_handle_dcd_change(struct uart_port*, unsigned int)'
  'int unregister_console(struct console*)'
  'int unregister_die_notifier(struct notifier_block*)'
  'int usb_gadget_map_request(struct usb_gadget*, struct usb_request*, int)'
  'void usb_gadget_unmap_request(struct usb_gadget*, struct usb_request*, int)'
  'unsigned long vm_mmap(struct file*, unsigned long, unsigned long, unsigned long, unsigned long, unsigned long)'
  'int vm_munmap(unsigned long, size_t)'

4 variable symbol(s) added
  'struct tracepoint __tracepoint_android_vh_dmabuf_heap_flags_validation'
  'struct static_key_true init_on_alloc'
  'struct resource ioport_resource'
  'int panic_timeout'

Bug: 285483154
Change-Id: Ic3c7a1639682011a8d016b1d65faba52c97c415a
Signed-off-by: tfshen <tfshen@realtek.com>
2023-06-02 15:13:17 +08:00
Avichal Rakesh
f82b531088 Revert "FROMGIT: usb: gadget: udc: core: Prevent redundant calls to pullup"
This reverts commit b9bb33b73c.

Reason: This patch breaks any USB gadget function that deactivates the
gadget on bind (by setting bind_deactivated = true).

Bug: 285019584

Signed-off-by: Avichal Rakesh <arakesh@google.com>
(cherry picked from https://android-review.googlesource.com/q/commit:b59c3ebaf21e40182bad5160dd5d721d8c849f59)
Merged-In: I2885819dd75e9d65de8258b7d2f6fc5d98de6c68
Change-Id: I2885819dd75e9d65de8258b7d2f6fc5d98de6c68
2023-05-30 23:05:30 +00:00
Chungkai Mei
e25b806e1b ANDROID: Update the ABI symbol list
Add the following symbols:
  - __traceiter_android_rvh_schedule
  - __tracepoint_android_rvh_schedule

Bug: 270685154
Test: Build pass
Change-Id: I5dd059785fe33714b92224377ca1251c0f9c38b1
Signed-off-by: Chungkai Mei <chungkai@google.com>
2023-05-30 22:06:22 +00:00
Kalesh Singh
397665b3ed ANDROID: BACKPORT: mm: Multi-gen LRU: remove wait_event_killable()
Android 14 and later default to MGLRU [1] and field telemetry showed
occasional long tail latency (>100ms) in the reclaim path.

Tracing revealed priority inversion in the reclaim path.  In
try_to_inc_max_seq(), when high priority tasks were blocked on
wait_event_killable(), the preemption of the low priority task to call
wake_up_all() caused those high priority tasks to wait longer than
necessary.  In general, this problem is not different from others of its
kind, e.g., one caused by mutex_lock().  However, it is specific to MGLRU
because it introduced the new wait queue lruvec->mm_state.wait.

The purpose of this new wait queue is to avoid the thundering herd
problem.  If many direct reclaimers rush into try_to_inc_max_seq(), only
one can succeed, i.e., the one to wake up the rest, and the rest who
failed might cause premature OOM kills if they do not wait.  So far there
is no evidence supporting this scenario, based on how often the wait has
been hit.  And this begs the question how useful the wait queue is in
practice.

Based on Minchan's recommendation, which is in line with his commit
6d4675e601 ("mm: don't be stuck to rmap lock on reclaim path") and the
rest of the MGLRU code which also uses trylock when possible, remove the
wait queue.

[1] https://android-review.googlesource.com/q/I7ed7fbfd6ef9ce10053347528125dd98c39e50bf

Link: https://lkml.kernel.org/r/20230413214326.2147568-1-kaleshsingh@google.com
Fixes: bd74fdaea1 ("mm: multi-gen LRU: support page table walks")
Change-Id: Ia2c65c92652018bb833e632028075ea27b68477e
Signed-off-by: Kalesh Singh <kaleshsingh@google.com>
Suggested-by: Minchan Kim <minchan@kernel.org>
Reported-by: Wei Wang <wvw@google.com>
Acked-by: Yu Zhao <yuzhao@google.com>
Cc: Minchan Kim <minchan@kernel.org>
Cc: Jan Alexander Steffens (heftig) <heftig@archlinux.org>
Cc: Oleksandr Natalenko <oleksandr@natalenko.name>
Cc: Suleiman Souhlal <suleiman@google.com>
Cc: Suren Baghdasaryan <surenb@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
(cherry picked from commit 7f63cf2d9b)
Bug: 277906484
[ Kalesh Singh - Fix conflicts in mm/vmscan.c ]
[ Kalesh Singh - Fix up ABI breakages in include/linux/mmzone.h ]
Signed-off-by: Kalesh Singh <kaleshsingh@google.com>
2023-05-27 00:49:46 +00:00
Kalesh Singh
522c6b9c55 BACKPORT: FROMGIT: Multi-gen LRU: fix workingset accounting
On Android app cycle workloads, MGLRU showed a significant reduction in
workingset refaults although pgpgin/pswpin remained relatively unchanged.
This indicated MGLRU may be undercounting workingset refaults.

This has impact on userspace programs, like Android's LMKD, that monitor
workingset refault statistics to detect thrashing.

It was found that refaults were only accounted if the MGLRU shadow entry
was for a recently evicted folio.  However, recently evicted folios should
be accounted as workingset activation, and refaults should be accounted
regardless of recency.

Fix MGLRU's workingset refault and activation accounting to more closely
match that of the conventional active/inactive LRU.

Link: https://lkml.kernel.org/r/20230523205922.3852731-1-kaleshsingh@google.com
Fixes: ac35a49023 ("mm: multi-gen LRU: minimal implementation")
Signed-off-by: Kalesh Singh <kaleshsingh@google.com>
Reported-by: Charan Teja Kalla <quic_charante@quicinc.com>
Acked-by: Yu Zhao <yuzhao@google.com>
Cc: Brian Geffon <bgeffon@google.com>
Cc: Jan Alexander Steffens (heftig) <heftig@archlinux.org>
Cc: Oleksandr Natalenko <oleksandr@natalenko.name>
Cc: Suren Baghdasaryan <surenb@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
(cherry picked from commit 02ad728453d2ddb09d7ce5e59854ebb27544d488 https://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm.git mm-unstable)
Bug: 284043217
[ Kalesh Singh - Fix conflicts in mm/workingset.c ]
Signed-off-by: Kalesh Singh <kaleshsingh@google.com>
Change-Id: I6d42cca9064e66099fbbc20aa2143961f84b2003
2023-05-26 13:36:54 -07:00
Todd Kjos
9abc9f635a ANDROID: Disable BTI_KERNEL, enable UNWIND_PATCH_PAC_INTO_SCS
Disable CONFIG_ARM64_BTI_KERNEL since significant overhead has been observed
on systems that don't have BTI/PAC hardware support due to increased number
of NOPs added by these features.

BTI is not as important in kernels that have CFI enabled because the protection
these features offer overlap.

Keep PAC enabled and also enable dynamic SCS (CONFIG_UNWIND_PATCH_PAC_INTO_SCS)
which is available starting in v6.2. This removes SCS overhead on systems that
support PAC, and PAC overhead on systems that need SCS instead. This feature uses
runtime code patching, so it won't have the overhead of additional NOPs.

Bug: 267119345
Change-Id: Ifc7d5e502940bd15d13e7f89c5facd10b6c7b8a8
Signed-off-by: Todd Kjos <tkjos@google.com>
2023-05-25 16:09:30 -07:00
Ard Biesheuvel
845c91e987 BACKPORT: arm64: implement dynamic shadow call stack for Clang
Implement dynamic shadow call stack support on Clang, by parsing the
unwind tables at init time to locate all occurrences of PACIASP/AUTIASP
instructions, and replacing them with the shadow call stack push and pop
instructions, respectively.

This is useful because the overhead of the shadow call stack is
difficult to justify on hardware that implements pointer authentication
(PAC), and given that the PAC instructions are executed as NOPs on
hardware that doesn't, we can just replace them without breaking
anything. As PACIASP/AUTIASP are guaranteed to be paired with respect to
manipulations of the return address, replacing them 1:1 with shadow call
stack pushes and pops is guaranteed to result in the desired behavior.

Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Reviewed-by: Sami Tolvanen <samitolvanen@google.com>
Tested-by: Sami Tolvanen <samitolvanen@google.com>
Link: https://lore.kernel.org/r/20221027155908.1940624-4-ardb@kernel.org
Signed-off-by: Will Deacon <will@kernel.org>

(cherry picked from commit 3b619e22c4)
Bug: 283954062
Change-Id: Idca66f03315191a9fb18ed17d5b79c5bfacc51b8
Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
2023-05-25 16:09:30 -07:00
Ard Biesheuvel
ee09e21c01 UPSTREAM: scs: add support for dynamic shadow call stacks
In order to allow arches to use code patching to conditionally emit the
shadow stack pushes and pops, rather than always taking the performance
hit even on CPUs that implement alternatives such as stack pointer
authentication on arm64, add a Kconfig symbol that can be set by the
arch to omit the SCS codegen itself, without otherwise affecting how
support code for SCS and compiler options (for register reservation, for
instance) are emitted.

Also, add a static key and some plumbing to omit the allocation of
shadow call stack for dynamic SCS configurations if SCS is disabled at
runtime.

Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
Reviewed-by: Kees Cook <keescook@chromium.org>
Reviewed-by: Sami Tolvanen <samitolvanen@google.com>
Tested-by: Sami Tolvanen <samitolvanen@google.com>
Link: https://lore.kernel.org/r/20221027155908.1940624-3-ardb@kernel.org
Signed-off-by: Will Deacon <will@kernel.org>

(cherry picked from commit 9beccca098)
Bug: 283954062
Change-Id: I71ed23533124b071bd6bf5ab91b2af3bbf03b42b
Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
2023-05-25 16:09:30 -07:00
Ard Biesheuvel
6ec9ba5f69 BACKPORT: arm64: unwind: add asynchronous unwind tables to kernel and modules
Enable asynchronous unwind table generation for both the core kernel as
well as modules, and emit the resulting .eh_frame sections as init code
so we can use the unwind directives for code patching at boot or module
load time.

This will be used by dynamic shadow call stack support, which will rely
on code patching rather than compiler codegen to emit the shadow call
stack push and pop instructions.

Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
Reviewed-by: Sami Tolvanen <samitolvanen@google.com>
Tested-by: Sami Tolvanen <samitolvanen@google.com>
Link: https://lore.kernel.org/r/20221027155908.1940624-2-ardb@kernel.org
Signed-off-by: Will Deacon <will@kernel.org>

(cherry picked from commit 68c76ad4a9)
Bug: 283954062
Change-Id: I2e17c7171295dc3859ff385b11a10048f6c87ec5
Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
2023-05-25 16:09:29 -07:00
Vincent Palomares
24cc65e890 ANDROID: GKI: Expose device async to userspace
Setting CONFIG_PM_ADVANCED_DEBUG=y to expose device async fields
to userspace, allowing to fine-tune the suspend/resume path.

Bug: 235135485
Change-Id: I75060e88ce0c1e199aa8740f446a2c0f8167f3d7
Signed-off-by: Vincent Palomares <paillon@google.com>
2023-05-25 20:29:49 +00:00
Bart Van Assche
c80190b43d ANDROID: scsi: core: Only kick the requeue list if necessary
Instead of running the request queue of each device associated with a
host every 3 ms (BLK_MQ_RESOURCE_DELAY) while host error handling is in
progress, run the request queue after error handling has finished.

Bug: 280478861
Change-Id: Icd06853dc4868778bc7942d7fac6de71a7a80f71
Signed-off-by: Bart Van Assche <bvanassche@google.com>
2023-05-25 17:44:43 +00:00
Bart Van Assche
1845d499bd ANDROID: scsi: Trace SCSI sense data
Make the SCSI sense data available in the ftrace output.

Bug: 275581839
Change-Id: I0fc87346effe71940a450d3a114365029d851b77
Signed-off-by: Bart Van Assche <bvanassche@google.com>
2023-05-25 17:44:43 +00:00
Bart Van Assche
99be857cfd ANDROID: block: mq-deadline: Restore npo2 zone size support
Patch "block: mq-deadline: Handle requeued requests correctly" broke
support for zone sizes that are not a power of two. Restore support for
zone sizes that are not a power of two.

Bug: 275581839
Change-Id: I05d1b3253247f21583891502291e4a861bebb15e
Signed-off-by: Bart Van Assche <bvanassche@google.com>
2023-05-25 17:44:43 +00:00
Bart Van Assche
88819308f5 ANDROID: block: Warn if a zoned write is about to be reordered
Make it easier to debug out-of-order zoned writes.

Bug: 275581839
Change-Id: I5d1f1cd47ff1b4c10788edeebba5e80bd82b2bf3
Signed-off-by: Bart Van Assche <bvanassche@google.com>
2023-05-25 17:44:43 +00:00
Bart Van Assche
5d90f7cbaf ANDROID: block: Preserve the order of requeued requests
If a queue is run before all requeued requests have been sent to the I/O
scheduler, the I/O scheduler may dispatch the wrong request. Fix this by
making __blk_mq_run_hw_queue() process the requeue_list instead of
blk_mq_requeue_work().

Bug: 275581839
Change-Id: Id72c0787607f90857ae8e75998d532b96b46b8c2
Signed-off-by: Bart Van Assche <bvanassche@google.com>
2023-05-25 17:44:43 +00:00
Bart Van Assche
a08e170d90 ANDROID: block: Requeue requests if a CPU is unplugged
Requeue requests instead of sending these to the dispatch list if a CPU
is unplugged to prevent reordering of zoned writes.

Bug: 275581839
Change-Id: I2f03ba0832fc9609472c2bfa19d2cdd8abeffd8d
Signed-off-by: Bart Van Assche <bvanassche@google.com>
2023-05-25 17:44:43 +00:00
Bart Van Assche
9102217567 ANDROID: block: Send requeued requests to the I/O scheduler
Make sure that the I/O scheduler has control over which requests are
dispatched.

Bug: 275581839
Change-Id: If8c70df11584b023c452fbba28c67b092ddac850
Signed-off-by: Bart Van Assche <bvanassche@google.com>
2023-05-25 17:44:43 +00:00
Bart Van Assche
cd4d66e62b ANDROID: block: Send FUA requests to the I/O scheduler
Send requests with the REQ_FUA or REQ_PREFLUSH flag set to the I/O
scheduler. Do not change the behavior for REQ_OP_FLUSH requests.
This patch prevents that zoned writes with the REQ_FUA and/or
REQ_PREFLUSH flag set are reordered against each other.

Bug: 275581839
Change-Id: Ib7f18932a066c40f5b76dc69c1864a080350251d
Signed-off-by: Bart Van Assche <bvanassche@google.com>
2023-05-25 17:44:43 +00:00
Bart Van Assche
0545a08098 ANDROID: block: Simplify blk_mq_sched_bypass_insert()
Combine two return statements into a single return statement.

Bug: 275581839
Change-Id: I543e3dad88766157c0c334def4d525c10334e476
Signed-off-by: Bart Van Assche <bvanassche@google.com>
2023-05-25 17:44:43 +00:00
Bart Van Assche
4c21e16028 ANDROID: block: Remove a blk_mq_sched_bypass_insert() argument
Remove the 'hctx' argument because it is not used.

Bug: 275581839
Change-Id: I1f632931bc6c3d1ad89c4e6e93417c7301699559
Signed-off-by: Bart Van Assche <bvanassche@google.com>
2023-05-25 17:44:43 +00:00
davidwang
443ff5cf3b ANDROID: vendor_hooks: add vendor hook for dma_heap_buffer_alloc
Add android_vh_dmabuf_heap_flags_validation vh for
heap flags with vendor valid check.

Bug: 241733930
Signed-off-by: davidwang <davidwang@realtek.com>
Change-Id: I5c1c111b8231a05f733bc56bda34bc408e708554
(cherry picked from commit fc9630b3cb24f5c0dd111cb49b462268a343f66c)
2023-05-25 02:12:13 +00:00
Carlos Llamas
2c8747d414 ANDROID: 5/24/2023 KMI update
Set KMI_GENERATION=7 for 5/24 KMI update

type 'struct binder_transaction' changed
  byte size changed from 176 to 192
  member 'pid_t from_pid' was added
  member 'pid_t from_tid' was added
  13 members ('struct binder_transaction* from_parent' .. 'kuid_t sender_euid') changed
    offset changed by 64
  member 'ktime_t start_time' was added
  4 members ('struct list_head fd_fixups' .. 'u64 android_vendor_data1') changed
    offset changed by 128

Bug: 283322303
Change-Id: Ic9eaacc3707e86614dfb9fc6abde30ba722ed3bf
Signed-off-by: Carlos Llamas <cmllamas@google.com>
2023-05-24 14:39:37 +00:00
Chuang Zhang
99027afdd1 FROMGIT: Binder: Add async from to transaction record
This commit adds support for getting the pid and tid information of
the sender for asynchronous transfers in binderfs transfer records.
In previous versions, it was not possible to obtain this information
from the transfer records. While this information may not be necessary
for all use cases, it can be useful in some scenarios.

Signed-off-by: Chuang Zhang <zhangchuang3@xiaomi.com>
Acked-by: Carlos Llamas <cmllamas@google.com>
Link: https://lore.kernel.org/r/0c1e8bd37c68dd1518bb737b06b768cde9659386.1682333709.git.zhangchuang3@xiaomi.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Bug: 235773151
(cherry picked from commit c21c0f9a20
 git: //git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git
 char-misc-next)
Change-Id: I7e729853353522164c4a3dd1094145dfd19af961
Signed-off-by: Carlos Llamas <cmllamas@google.com>
2023-05-24 13:53:29 +00:00
Chuang Zhang
5d4d5dbeab BACKPORT: FROMGIT: Binder: Add timestamp to transaction record
This patch adds a timestamp field to the binder_transaction
structure to track the time consumed during transmission
when reading binder_transaction records.

Signed-off-by: Chuang Zhang <zhangchuang3@xiaomi.com>
Acked-by: Carlos Llamas <cmllamas@google.com>
Link: https://lore.kernel.org/r/5ac8c0d09392290be789423f0dd78a520b830fab.1682333709.git.zhangchuang3@xiaomi.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Bug: 235773151
(cherry picked from commit 800936191a
 git: //git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git
 char-misc-next)
[cmllamas: resolved minor conflicts with local patches]
Change-Id: If6dab2e9b80c71f9ac3084dc8cf0e519976f55d8
Signed-off-by: Carlos Llamas <cmllamas@google.com>
2023-05-24 13:53:29 +00:00
Nick Desaulniers
9e8b2d8ee2 Revert "ANDROID: gki_config: use DWARFv5 rather than DWARFv4"
This reverts commit ad2bd67e07.

Qualcomm is reporting that internal debugging tools in addition to
Lauterbach Trace32 (T32) debugger (vLT_20230509_159359) are having
issues with DWARFv5.

Since the change to the DWARF debug info format was made after the
Android Feature Complete deadline, revert it from android14-* kernel
branches. We'll leave DWARFv5 for android-mainline and try again next
release in android15-*.

Bug: 281863640
Reported-by: Satya Durga Srinivasu Prabhala <quic_satyap@quicinc.com>
Change-Id: I5a1657bdf6785d23f3492dc12e6f3df0954b8deb
Signed-off-by: Nick Desaulniers <ndesaulniers@google.com>
2023-05-24 13:53:29 +00:00
Tudor Ambarus
6c4ed97791 UPSTREAM: ext4: avoid a potential slab-out-of-bounds in ext4_group_desc_csum
commit 4f04351888 upstream.

When modifying the block device while it is mounted by the filesystem,
syzbot reported the following:

BUG: KASAN: slab-out-of-bounds in crc16+0x206/0x280 lib/crc16.c:58
Read of size 1 at addr ffff888075f5c0a8 by task syz-executor.2/15586

CPU: 1 PID: 15586 Comm: syz-executor.2 Not tainted 6.2.0-rc5-syzkaller-00205-gc96618275234 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/12/2023
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x1b1/0x290 lib/dump_stack.c:106
 print_address_description+0x74/0x340 mm/kasan/report.c:306
 print_report+0x107/0x1f0 mm/kasan/report.c:417
 kasan_report+0xcd/0x100 mm/kasan/report.c:517
 crc16+0x206/0x280 lib/crc16.c:58
 ext4_group_desc_csum+0x81b/0xb20 fs/ext4/super.c:3187
 ext4_group_desc_csum_set+0x195/0x230 fs/ext4/super.c:3210
 ext4_mb_clear_bb fs/ext4/mballoc.c:6027 [inline]
 ext4_free_blocks+0x191a/0x2810 fs/ext4/mballoc.c:6173
 ext4_remove_blocks fs/ext4/extents.c:2527 [inline]
 ext4_ext_rm_leaf fs/ext4/extents.c:2710 [inline]
 ext4_ext_remove_space+0x24ef/0x46a0 fs/ext4/extents.c:2958
 ext4_ext_truncate+0x177/0x220 fs/ext4/extents.c:4416
 ext4_truncate+0xa6a/0xea0 fs/ext4/inode.c:4342
 ext4_setattr+0x10c8/0x1930 fs/ext4/inode.c:5622
 notify_change+0xe50/0x1100 fs/attr.c:482
 do_truncate+0x200/0x2f0 fs/open.c:65
 handle_truncate fs/namei.c:3216 [inline]
 do_open fs/namei.c:3561 [inline]
 path_openat+0x272b/0x2dd0 fs/namei.c:3714
 do_filp_open+0x264/0x4f0 fs/namei.c:3741
 do_sys_openat2+0x124/0x4e0 fs/open.c:1310
 do_sys_open fs/open.c:1326 [inline]
 __do_sys_creat fs/open.c:1402 [inline]
 __se_sys_creat fs/open.c:1396 [inline]
 __x64_sys_creat+0x11f/0x160 fs/open.c:1396
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f72f8a8c0c9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f72f97e3168 EFLAGS: 00000246 ORIG_RAX: 0000000000000055
RAX: ffffffffffffffda RBX: 00007f72f8bac050 RCX: 00007f72f8a8c0c9
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020000280
RBP: 00007f72f8ae7ae9 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffd165348bf R14: 00007f72f97e3300 R15: 0000000000022000

Replace
	le16_to_cpu(sbi->s_es->s_desc_size)
with
	sbi->s_desc_size

It reduces ext4's compiled text size, and makes the code more efficient
(we remove an extra indirect reference and a potential byte
swap on big endian systems), and there is no downside. It also avoids the
potential KASAN / syzkaller failure, as a bonus.

Reported-by: syzbot+fc51227e7100c9294894@syzkaller.appspotmail.com
Reported-by: syzbot+8785e41224a3afd04321@syzkaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?id=70d28d11ab14bd7938f3e088365252aa923cff42
Link: https://syzkaller.appspot.com/bug?id=b85721b38583ecc6b5e72ff524c67302abbc30f3
Link: https://lore.kernel.org/all/000000000000ece18705f3b20934@google.com/
Fixes: 717d50e497 ("Ext4: Uninitialized Block Groups")
Cc: stable@vger.kernel.org
Signed-off-by: Tudor Ambarus <tudor.ambarus@linaro.org>
Link: https://lore.kernel.org/r/20230504121525.3275886-1-tudor.ambarus@linaro.org
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Bug: 269155298
Bug: 270466805
Change-Id: Id14192ab0905c36e154d07d461afb56af7b61488
Signed-off-by: Tudor Ambarus <tudor.ambarus@linaro.org>
2023-05-24 06:37:40 +00:00