From 8812ab3f9d3d4f9254b5e454e09979899e9820f8 Mon Sep 17 00:00:00 2001 From: Jann Horn Date: Wed, 31 Aug 2022 21:13:48 +0200 Subject: [PATCH 01/10] UPSTREAM: mm: Force TLB flush for PFNMAP mappings before unlink_file_vma() commit b67fbebd4cf980aecbcc750e1462128bffe8ae15 upstream. Some drivers rely on having all VMAs through which a PFN might be accessible listed in the rmap for correctness. However, on X86, it was possible for a VMA with stale TLB entries to not be listed in the rmap. This was fixed in mainline with commit b67fbebd4cf9 ("mmu_gather: Force tlb-flush VM_PFNMAP vmas"), but that commit relies on preceding refactoring in commit 18ba064e42df3 ("mmu_gather: Let there be one tlb_{start,end}_vma() implementation") and commit 1e9fdf21a4339 ("mmu_gather: Remove per arch tlb_{start,end}_vma()"). This patch provides equivalent protection without needing that refactoring, by forcing a TLB flush between removing PTEs in unmap_vmas() and the call to unlink_file_vma() in free_pgtables(). Bug: 245812080 [This is a stable-specific rewrite of the upstream commit!] Signed-off-by: Jann Horn Signed-off-by: Greg Kroah-Hartman Signed-off-by: Lee Jones Change-Id: I8f539ff0365fb9b5d10fddb84082d5995348b897 --- mm/mmap.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/mm/mmap.c b/mm/mmap.c index cb5fded3aa0b..0a7476d0685d 100644 --- a/mm/mmap.c +++ b/mm/mmap.c @@ -2773,6 +2773,18 @@ static void unmap_region(struct mm_struct *mm, tlb_gather_mmu(&tlb, mm, start, end); update_hiwater_rss(mm); unmap_vmas(&tlb, vma, start, end); + + /* + * Ensure we have no stale TLB entries by the time this mapping is + * removed from the rmap. + * Note that we don't have to worry about nested flushes here because + * we're holding the mm semaphore for removing the mapping - so any + * concurrent flush in this region has to be coming through the rmap, + * and we synchronize against that using the rmap lock. + */ + if ((vma->vm_flags & (VM_PFNMAP|VM_MIXEDMAP)) != 0) + tlb_flush_mmu(&tlb); + free_pgtables(&tlb, vma, prev ? prev->vm_end : FIRST_USER_ADDRESS, next ? next->vm_start : USER_PGTABLES_CEILING); tlb_finish_mmu(&tlb, start, end); From 75c194cf1af61415cd96e0ac4509d702100d8157 Mon Sep 17 00:00:00 2001 From: Herbert Xu Date: Thu, 4 Aug 2022 18:03:46 +0800 Subject: [PATCH 02/10] UPSTREAM: af_key: Do not call xfrm_probe_algs in parallel [ Upstream commit ba953a9d89a00c078b85f4b190bc1dde66fe16b5 ] When namespace support was added to xfrm/afkey, it caused the previously single-threaded call to xfrm_probe_algs to become multi-threaded. This is buggy and needs to be fixed with a mutex. Bug: 245674737 Reported-by: Abhishek Shah Fixes: 283bc9f35bbb ("xfrm: Namespacify xfrm state/policy locks") Signed-off-by: Herbert Xu Signed-off-by: Steffen Klassert Signed-off-by: Sasha Levin Change-Id: I71fb89a999447862a6c4b1ff754378bb0452ad3a Signed-off-by: Lee Jones --- net/key/af_key.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/key/af_key.c b/net/key/af_key.c index d1364b858fdf..91da57dcb7f0 100644 --- a/net/key/af_key.c +++ b/net/key/af_key.c @@ -1701,9 +1701,12 @@ static int pfkey_register(struct sock *sk, struct sk_buff *skb, const struct sad pfk->registered |= (1<sadb_msg_satype); } + mutex_lock(&pfkey_mutex); xfrm_probe_algs(); supp_skb = compose_sadb_supported(hdr, GFP_KERNEL); + mutex_unlock(&pfkey_mutex); + if (!supp_skb) { if (hdr->sadb_msg_satype != SADB_SATYPE_UNSPEC) pfk->registered &= ~(1<sadb_msg_satype); From c0ce22abf7b70bf9daf43ba8ca0b794bf533bf4c Mon Sep 17 00:00:00 2001 From: Jann Horn Date: Thu, 15 Sep 2022 16:25:19 +0200 Subject: [PATCH 03/10] UPSTREAM: mm: Fix TLB flush for not-first PFNMAP mappings in unmap_region() This is a stable-specific patch. I botched the stable-specific rewrite of commit b67fbebd4cf98 ("mmu_gather: Force tlb-flush VM_PFNMAP vmas"): As Hugh pointed out, unmap_region() actually operates on a list of VMAs, and the variable "vma" merely points to the first VMA in that list. So if we want to check whether any of the VMAs we're operating on is PFNMAP or MIXEDMAP, we have to iterate through the list and check each VMA. Bug: 245812080 Signed-off-by: Jann Horn Signed-off-by: Greg Kroah-Hartman (cherry picked from commit 3998dc50ebdc127ae79b10992856fb76debc2005) Signed-off-by: Lee Jones Change-Id: I115183f65fc7df5d33264e6211adcd2ec531d996 --- mm/mmap.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/mm/mmap.c b/mm/mmap.c index 0a7476d0685d..7d91528c3400 100644 --- a/mm/mmap.c +++ b/mm/mmap.c @@ -2768,6 +2768,7 @@ static void unmap_region(struct mm_struct *mm, { struct vm_area_struct *next = vma_next(mm, prev); struct mmu_gather tlb; + struct vm_area_struct *cur_vma; lru_add_drain(); tlb_gather_mmu(&tlb, mm, start, end); @@ -2782,8 +2783,12 @@ static void unmap_region(struct mm_struct *mm, * concurrent flush in this region has to be coming through the rmap, * and we synchronize against that using the rmap lock. */ - if ((vma->vm_flags & (VM_PFNMAP|VM_MIXEDMAP)) != 0) - tlb_flush_mmu(&tlb); + for (cur_vma = vma; cur_vma; cur_vma = cur_vma->vm_next) { + if ((cur_vma->vm_flags & (VM_PFNMAP|VM_MIXEDMAP)) != 0) { + tlb_flush_mmu(&tlb); + break; + } + } free_pgtables(&tlb, vma, prev ? prev->vm_end : FIRST_USER_ADDRESS, next ? next->vm_start : USER_PGTABLES_CEILING); From 89fed37332fd48e0cd13b256cd85d6929d5da319 Mon Sep 17 00:00:00 2001 From: Minchan Kim Date: Wed, 2 Nov 2022 09:04:41 -0700 Subject: [PATCH 04/10] ANDROID: vendor hook to control blk_plug for shrink_lruvec Add vendor hook to contorl blk plugging for shrink_lruvec. Bug: 255471591 Bug: 238728493 Change-Id: Iba2603ff2e1b62cf2ee8fd6969d8ccd71416a288 Signed-off-by: Minchan Kim --- drivers/android/vendor_hooks.c | 1 + include/trace/hooks/mm.h | 3 +++ mm/vmscan.c | 8 ++++++-- 3 files changed, 10 insertions(+), 2 deletions(-) diff --git a/drivers/android/vendor_hooks.c b/drivers/android/vendor_hooks.c index bfd9a74a0f61..bbcd6637148b 100644 --- a/drivers/android/vendor_hooks.c +++ b/drivers/android/vendor_hooks.c @@ -285,6 +285,7 @@ EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_include_reserved_zone); EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_alloc_pages_slowpath); EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_do_madvise_blk_plug); EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_shrink_inactive_list_blk_plug); +EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_shrink_lruvec_blk_plug); EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_reclaim_pages_plug); EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_zap_pte_range_tlb_start); EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_zap_pte_range_tlb_force_flush); diff --git a/include/trace/hooks/mm.h b/include/trace/hooks/mm.h index 785ec3da0aa4..d9be2be468de 100644 --- a/include/trace/hooks/mm.h +++ b/include/trace/hooks/mm.h @@ -106,6 +106,9 @@ DECLARE_HOOK(android_vh_do_madvise_blk_plug, DECLARE_HOOK(android_vh_shrink_inactive_list_blk_plug, TP_PROTO(bool *do_plug), TP_ARGS(do_plug)); +DECLARE_HOOK(android_vh_shrink_lruvec_blk_plug, + TP_PROTO(bool *do_plug), + TP_ARGS(do_plug)); DECLARE_HOOK(android_vh_reclaim_pages_plug, TP_PROTO(bool *do_plug), TP_ARGS(do_plug)); diff --git a/mm/vmscan.c b/mm/vmscan.c index f4a22e18951d..02d2172afe89 100644 --- a/mm/vmscan.c +++ b/mm/vmscan.c @@ -5275,6 +5275,7 @@ static void shrink_lruvec(struct lruvec *lruvec, struct scan_control *sc) unsigned long nr_reclaimed = 0; unsigned long nr_to_reclaim = sc->nr_to_reclaim; struct blk_plug plug; + bool do_plug = true; bool scan_adjusted; if (lru_gen_enabled()) { @@ -5301,7 +5302,9 @@ static void shrink_lruvec(struct lruvec *lruvec, struct scan_control *sc) scan_adjusted = (!cgroup_reclaim(sc) && !current_is_kswapd() && sc->priority == DEF_PRIORITY); - blk_start_plug(&plug); + trace_android_vh_shrink_lruvec_blk_plug(&do_plug); + if (do_plug) + blk_start_plug(&plug); while (nr[LRU_INACTIVE_ANON] || nr[LRU_ACTIVE_FILE] || nr[LRU_INACTIVE_FILE]) { unsigned long nr_anon, nr_file, percentage; @@ -5373,7 +5376,8 @@ static void shrink_lruvec(struct lruvec *lruvec, struct scan_control *sc) scan_adjusted = true; } - blk_finish_plug(&plug); + if (do_plug) + blk_finish_plug(&plug); sc->nr_reclaimed += nr_reclaimed; /* From 9ffd177dcec75427898aa4ad2394969d69d2c241 Mon Sep 17 00:00:00 2001 From: Minchan Kim Date: Thu, 3 Nov 2022 07:38:38 -0700 Subject: [PATCH 05/10] ANDROID: Update the ABI representation 1 function symbol(s) added 'int __traceiter_android_vh_shrink_lruvec_blk_plug(void *, bool *)' 1 variable symbol(s) added 'struct tracepoint __tracepoint_android_vh_shrink_lruvec_blk_plug' Bug: 255471591 Bug: 238728493 Change-Id: I8746bbe2f7ccc09e366deed6aa00bc4834643084 Signed-off-by: Minchan Kim --- android/abi_gki_aarch64.xml | 945 ++++++++++++++------------------ android/abi_gki_aarch64_generic | 2 + 2 files changed, 414 insertions(+), 533 deletions(-) diff --git a/android/abi_gki_aarch64.xml b/android/abi_gki_aarch64.xml index c3a7ec57372e..32a6709a4e4c 100644 --- a/android/abi_gki_aarch64.xml +++ b/android/abi_gki_aarch64.xml @@ -296,6 +296,7 @@ + @@ -3893,6 +3894,7 @@ + @@ -4187,71 +4189,6 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - @@ -5028,7 +4965,7 @@ - + @@ -7872,7 +7809,7 @@ - + @@ -9014,7 +8951,7 @@ - + @@ -10550,9 +10487,6 @@ - - - @@ -12092,7 +12026,7 @@ - + @@ -15120,7 +15054,7 @@ - + @@ -22042,7 +21976,7 @@ - + @@ -24483,7 +24417,7 @@ - + @@ -26448,7 +26382,7 @@ - + @@ -34139,7 +34073,7 @@ - + @@ -36932,7 +36866,7 @@ - + @@ -38255,17 +38189,7 @@ - - - - - - - - - - - + @@ -44545,7 +44469,6 @@ - @@ -47955,14 +47878,6 @@ - - - - - - - - @@ -48267,13 +48182,13 @@ - + - + - + @@ -48282,7 +48197,7 @@ - + @@ -52449,7 +52364,7 @@ - + @@ -55138,7 +55053,6 @@ - @@ -58512,61 +58426,61 @@ - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + @@ -62114,7 +62028,7 @@ - + @@ -62205,7 +62119,7 @@ - + @@ -66235,7 +66149,7 @@ - + @@ -66954,7 +66868,7 @@ - + @@ -67818,25 +67732,25 @@ - + - + - + - + - + - + - + @@ -70436,7 +70350,7 @@ - + @@ -70463,7 +70377,7 @@ - + @@ -70474,7 +70388,7 @@ - + @@ -71280,7 +71194,7 @@ - + @@ -71293,7 +71207,7 @@ - + @@ -71323,7 +71237,7 @@ - + @@ -71366,7 +71280,7 @@ - + @@ -71393,7 +71307,7 @@ - + @@ -71401,7 +71315,7 @@ - + @@ -71409,7 +71323,7 @@ - + @@ -71422,25 +71336,25 @@ - + - + - + - + - + - + - + @@ -71473,7 +71387,7 @@ - + @@ -71484,7 +71398,7 @@ - + @@ -71497,7 +71411,7 @@ - + @@ -71543,7 +71457,7 @@ - + @@ -71568,15 +71482,15 @@ - + - + - + @@ -71584,7 +71498,7 @@ - + @@ -71678,7 +71592,7 @@ - + @@ -71686,21 +71600,21 @@ - + - + - + - + - + @@ -71737,10 +71651,10 @@ - + - + @@ -71756,7 +71670,7 @@ - + @@ -71783,10 +71697,10 @@ - + - + @@ -71830,7 +71744,7 @@ - + @@ -71843,7 +71757,7 @@ - + @@ -71873,7 +71787,7 @@ - + @@ -71886,7 +71800,7 @@ - + @@ -71922,13 +71836,13 @@ - + - + - + @@ -71989,7 +71903,7 @@ - + @@ -72000,13 +71914,13 @@ - + - + @@ -72014,7 +71928,7 @@ - + @@ -72030,7 +71944,7 @@ - + @@ -72134,7 +72048,7 @@ - + @@ -72283,10 +72197,10 @@ - + - + @@ -72302,27 +72216,27 @@ - + - + - + - + - + - + - + @@ -72338,22 +72252,22 @@ - + - + - + - + - + - + @@ -72412,36 +72326,36 @@ - + - + - + - + - + - + - + - + - + - + @@ -72452,7 +72366,7 @@ - + @@ -72476,96 +72390,96 @@ - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + @@ -72578,13 +72492,13 @@ - + - + - + @@ -72724,7 +72638,7 @@ - + @@ -77232,7 +77146,7 @@ - + @@ -77279,7 +77193,6 @@ - @@ -85967,7 +85880,7 @@ - + @@ -87379,7 +87292,7 @@ - + @@ -87463,22 +87376,22 @@ - + - + - + - + - + - + @@ -93306,7 +93219,7 @@ - + @@ -93740,9 +93653,6 @@ - - - @@ -97231,7 +97141,7 @@ - + @@ -98479,39 +98389,7 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + @@ -98519,7 +98397,7 @@ - + @@ -98527,7 +98405,7 @@ - + @@ -98538,7 +98416,7 @@ - + @@ -98546,7 +98424,7 @@ - + @@ -98563,7 +98441,7 @@ - + @@ -98571,7 +98449,7 @@ - + @@ -98579,7 +98457,7 @@ - + @@ -98593,7 +98471,7 @@ - + @@ -98607,12 +98485,12 @@ - + - + @@ -98626,7 +98504,7 @@ - + @@ -98643,7 +98521,7 @@ - + @@ -98654,7 +98532,7 @@ - + @@ -98671,7 +98549,7 @@ - + @@ -98679,7 +98557,7 @@ - + @@ -98690,7 +98568,7 @@ - + @@ -98701,7 +98579,7 @@ - + @@ -98709,7 +98587,7 @@ - + @@ -98885,13 +98763,13 @@ - + - + @@ -98902,7 +98780,7 @@ - + @@ -98913,7 +98791,7 @@ - + @@ -98921,7 +98799,7 @@ - + @@ -98929,7 +98807,7 @@ - + @@ -98943,7 +98821,7 @@ - + @@ -98951,7 +98829,7 @@ - + @@ -98959,7 +98837,7 @@ - + @@ -98967,7 +98845,7 @@ - + @@ -98975,7 +98853,7 @@ - + @@ -98986,7 +98864,7 @@ - + @@ -98994,7 +98872,7 @@ - + @@ -99008,7 +98886,7 @@ - + @@ -99019,7 +98897,7 @@ - + @@ -99027,7 +98905,7 @@ - + @@ -99035,7 +98913,7 @@ - + @@ -99043,7 +98921,7 @@ - + @@ -99063,7 +98941,7 @@ - + @@ -99077,7 +98955,7 @@ - + @@ -99094,7 +98972,7 @@ - + @@ -99108,7 +98986,7 @@ - + @@ -99122,7 +99000,7 @@ - + @@ -99130,7 +99008,7 @@ - + @@ -99144,7 +99022,7 @@ - + @@ -99155,7 +99033,7 @@ - + @@ -99172,7 +99050,7 @@ - + @@ -99180,7 +99058,7 @@ - + @@ -99188,7 +99066,7 @@ - + @@ -99199,7 +99077,7 @@ - + @@ -99210,7 +99088,7 @@ - + @@ -99218,7 +99096,7 @@ - + @@ -99235,7 +99113,7 @@ - + @@ -99258,7 +99136,7 @@ - + @@ -99266,7 +99144,7 @@ - + @@ -99277,7 +99155,7 @@ - + @@ -99291,18 +99169,18 @@ - + - + - + @@ -99328,7 +99206,7 @@ - + @@ -99339,7 +99217,7 @@ - + @@ -99347,7 +99225,7 @@ - + @@ -99367,7 +99245,7 @@ - + @@ -99378,7 +99256,7 @@ - + @@ -99389,12 +99267,12 @@ - + - + @@ -99402,7 +99280,7 @@ - + @@ -99410,7 +99288,7 @@ - + @@ -99418,7 +99296,7 @@ - + @@ -99426,12 +99304,12 @@ - + - + @@ -99439,7 +99317,7 @@ - + @@ -99447,7 +99325,7 @@ - + @@ -99455,7 +99333,7 @@ - + @@ -99463,7 +99341,7 @@ - + @@ -99471,7 +99349,7 @@ - + @@ -99479,7 +99357,7 @@ - + @@ -99520,7 +99398,7 @@ - + @@ -99534,7 +99412,7 @@ - + @@ -99560,7 +99438,7 @@ - + @@ -99625,7 +99503,7 @@ - + @@ -99636,7 +99514,7 @@ - + @@ -99653,7 +99531,7 @@ - + @@ -99697,7 +99575,7 @@ - + @@ -99708,7 +99586,7 @@ - + @@ -99719,7 +99597,7 @@ - + @@ -99739,7 +99617,7 @@ - + @@ -99747,7 +99625,7 @@ - + @@ -99764,7 +99642,7 @@ - + @@ -99793,7 +99671,7 @@ - + @@ -99810,7 +99688,7 @@ - + @@ -99824,17 +99702,17 @@ - + - + - + @@ -99842,7 +99720,7 @@ - + @@ -99853,7 +99731,7 @@ - + @@ -99861,7 +99739,7 @@ - + @@ -99902,7 +99780,7 @@ - + @@ -99910,7 +99788,7 @@ - + @@ -99918,7 +99796,7 @@ - + @@ -99932,7 +99810,7 @@ - + @@ -99952,7 +99830,7 @@ - + @@ -99960,7 +99838,7 @@ - + @@ -99968,7 +99846,7 @@ - + @@ -99976,12 +99854,12 @@ - + - + @@ -99989,7 +99867,7 @@ - + @@ -100000,7 +99878,7 @@ - + @@ -100008,18 +99886,18 @@ - + - + - - + + @@ -100033,12 +99911,12 @@ - + - + @@ -100046,12 +99924,12 @@ - + - + @@ -100059,12 +99937,12 @@ - + - + @@ -100081,7 +99959,7 @@ - + @@ -100089,7 +99967,7 @@ - + @@ -100097,12 +99975,12 @@ - + - + @@ -100110,7 +99988,7 @@ - + @@ -100118,7 +99996,7 @@ - + @@ -100135,12 +100013,12 @@ - + - + @@ -100166,7 +100044,7 @@ - + @@ -100177,7 +100055,7 @@ - + @@ -100197,7 +100075,7 @@ - + @@ -100220,7 +100098,7 @@ - + @@ -100234,12 +100112,12 @@ - + - + @@ -100250,7 +100128,7 @@ - + @@ -100264,7 +100142,7 @@ - + @@ -100275,7 +100153,7 @@ - + @@ -100289,7 +100167,7 @@ - + @@ -100303,12 +100181,12 @@ - + - + @@ -100316,7 +100194,7 @@ - + @@ -100330,7 +100208,7 @@ - + @@ -100338,7 +100216,7 @@ - + @@ -100349,7 +100227,7 @@ - + @@ -100366,7 +100244,7 @@ - + @@ -100386,7 +100264,7 @@ - + @@ -100403,7 +100281,7 @@ - + @@ -100414,7 +100292,7 @@ - + @@ -100422,7 +100300,7 @@ - + @@ -100430,7 +100308,7 @@ - + @@ -100438,7 +100316,7 @@ - + @@ -100452,7 +100330,7 @@ - + @@ -100460,7 +100338,7 @@ - + @@ -100471,7 +100349,7 @@ - + @@ -100488,7 +100366,7 @@ - + @@ -100514,7 +100392,7 @@ - + @@ -100525,7 +100403,7 @@ - + @@ -100536,7 +100414,7 @@ - + @@ -100956,11 +100834,6 @@ - - - - - @@ -105401,7 +105274,7 @@ - + @@ -108273,7 +108146,7 @@ - + @@ -109590,7 +109463,7 @@ - + @@ -111710,9 +111583,9 @@ - - - + + + @@ -111768,9 +111641,14 @@ - - - + + + + + + + + @@ -111922,20 +111800,20 @@ - - - + + + - - - - + + + + - - - + + + @@ -112191,7 +112069,7 @@ - + @@ -112200,7 +112078,8 @@ - + + @@ -112224,9 +112103,9 @@ - - - + + + @@ -112758,8 +112637,8 @@ - - + + @@ -120776,11 +120655,11 @@ - + - - + + @@ -124318,10 +124197,10 @@ - + - + @@ -125126,12 +125005,12 @@ - - - - - - + + + + + + @@ -125287,7 +125166,7 @@ - + @@ -125476,29 +125355,29 @@ - - + + - - - + + + - - - - + + + + - - - - + + + + - - + + @@ -125536,7 +125415,7 @@ - + @@ -125972,9 +125851,9 @@ - - - + + + @@ -128352,11 +128231,11 @@ - - - - - + + + + + @@ -129732,16 +129611,16 @@ - - - - + + + + - - - - + + + + @@ -129788,23 +129667,23 @@ - - - - + + + + - - - - + + + + - - - - - + + + + + diff --git a/android/abi_gki_aarch64_generic b/android/abi_gki_aarch64_generic index 7b0d8f603f8b..b95190597b46 100644 --- a/android/abi_gki_aarch64_generic +++ b/android/abi_gki_aarch64_generic @@ -2280,6 +2280,7 @@ __traceiter_android_vh_setscheduler_uclamp __traceiter_android_vh_show_max_freq __traceiter_android_vh_shrink_inactive_list_blk_plug + __traceiter_android_vh_shrink_lruvec_blk_plug __traceiter_android_vh_skip_lru_disable __traceiter_android_vh_snd_compr_use_pause_in_drain __traceiter_android_vh_sound_usb_support_cpu_suspend @@ -2415,6 +2416,7 @@ __tracepoint_android_vh_setscheduler_uclamp __tracepoint_android_vh_show_max_freq __tracepoint_android_vh_shrink_inactive_list_blk_plug + __tracepoint_android_vh_shrink_lruvec_blk_plug __tracepoint_android_vh_skip_lru_disable __tracepoint_android_vh_snd_compr_use_pause_in_drain __tracepoint_android_vh_sound_usb_support_cpu_suspend From b684150a44187376ae2ea8369c400140ffc3ea67 Mon Sep 17 00:00:00 2001 From: Carlos Llamas Date: Fri, 4 Nov 2022 17:54:49 +0000 Subject: [PATCH 06/10] FROMLIST: binder: fix UAF of alloc->vma in race with munmap() In commit 720c24192404 ("ANDROID: binder: change down_write to down_read") binder assumed the mmap read lock is sufficient to protect alloc->vma inside binder_update_page_range(). This used to be accurate until commit dd2283f2605e ("mm: mmap: zap pages with read mmap_sem in munmap"), which now downgrades the mmap_lock after detaching the vma from the rbtree in munmap(). Then it proceeds to teardown and free the vma with only the read lock held. This means that accesses to alloc->vma in binder_update_page_range() now will race with vm_area_free() in munmap() and can cause a UAF as shown in the following KASAN trace: ================================================================== BUG: KASAN: use-after-free in vm_insert_page+0x7c/0x1f0 Read of size 8 at addr ffff16204ad00600 by task server/558 CPU: 3 PID: 558 Comm: server Not tainted 5.10.150-00001-gdc8dcf942daa #1 Hardware name: linux,dummy-virt (DT) Call trace: dump_backtrace+0x0/0x2a0 show_stack+0x18/0x2c dump_stack+0xf8/0x164 print_address_description.constprop.0+0x9c/0x538 kasan_report+0x120/0x200 __asan_load8+0xa0/0xc4 vm_insert_page+0x7c/0x1f0 binder_update_page_range+0x278/0x50c binder_alloc_new_buf+0x3f0/0xba0 binder_transaction+0x64c/0x3040 binder_thread_write+0x924/0x2020 binder_ioctl+0x1610/0x2e5c __arm64_sys_ioctl+0xd4/0x120 el0_svc_common.constprop.0+0xac/0x270 do_el0_svc+0x38/0xa0 el0_svc+0x1c/0x2c el0_sync_handler+0xe8/0x114 el0_sync+0x180/0x1c0 Allocated by task 559: kasan_save_stack+0x38/0x6c __kasan_kmalloc.constprop.0+0xe4/0xf0 kasan_slab_alloc+0x18/0x2c kmem_cache_alloc+0x1b0/0x2d0 vm_area_alloc+0x28/0x94 mmap_region+0x378/0x920 do_mmap+0x3f0/0x600 vm_mmap_pgoff+0x150/0x17c ksys_mmap_pgoff+0x284/0x2dc __arm64_sys_mmap+0x84/0xa4 el0_svc_common.constprop.0+0xac/0x270 do_el0_svc+0x38/0xa0 el0_svc+0x1c/0x2c el0_sync_handler+0xe8/0x114 el0_sync+0x180/0x1c0 Freed by task 560: kasan_save_stack+0x38/0x6c kasan_set_track+0x28/0x40 kasan_set_free_info+0x24/0x4c __kasan_slab_free+0x100/0x164 kasan_slab_free+0x14/0x20 kmem_cache_free+0xc4/0x34c vm_area_free+0x1c/0x2c remove_vma+0x7c/0x94 __do_munmap+0x358/0x710 __vm_munmap+0xbc/0x130 __arm64_sys_munmap+0x4c/0x64 el0_svc_common.constprop.0+0xac/0x270 do_el0_svc+0x38/0xa0 el0_svc+0x1c/0x2c el0_sync_handler+0xe8/0x114 el0_sync+0x180/0x1c0 [...] ================================================================== To prevent the race above, revert back to taking the mmap write lock inside binder_update_page_range(). One might expect an increase of mmap lock contention. However, binder already serializes these calls via top level alloc->mutex. Also, there was no performance impact shown when running the binder benchmark tests. Note this patch is specific to stable branches 5.4 and 5.10. Since in newer kernel releases binder no longer caches a pointer to the vma. Instead, it has been refactored to use vma_lookup() which avoids the issue described here. This switch was introduced in commit a43cfc87caaf ("android: binder: stop saving a pointer to the VMA"). Bug: 254837884 Link: https://lore.kernel.org/all/20221104175450.306810-1-cmllamas@google.com/ Fixes: dd2283f2605e ("mm: mmap: zap pages with read mmap_sem in munmap") Reported-by: Jann Horn Cc: # 5.10.x Cc: Minchan Kim Cc: Yang Shi Cc: Liam Howlett Signed-off-by: Carlos Llamas Change-Id: Ieabadbfa30f99812da9c226cf1ddd5e60f62c607 --- drivers/android/binder_alloc.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/android/binder_alloc.c b/drivers/android/binder_alloc.c index d30267e08536..447342a878ff 100644 --- a/drivers/android/binder_alloc.c +++ b/drivers/android/binder_alloc.c @@ -213,7 +213,7 @@ static int binder_update_page_range(struct binder_alloc *alloc, int allocate, mm = alloc->vma_vm_mm; if (mm) { - mmap_read_lock(mm); + mmap_write_lock(mm); vma = alloc->vma; } @@ -271,7 +271,7 @@ static int binder_update_page_range(struct binder_alloc *alloc, int allocate, trace_binder_alloc_page_end(alloc, index); } if (mm) { - mmap_read_unlock(mm); + mmap_write_unlock(mm); mmput(mm); } return 0; @@ -304,7 +304,7 @@ static int binder_update_page_range(struct binder_alloc *alloc, int allocate, } err_no_vma: if (mm) { - mmap_read_unlock(mm); + mmap_write_unlock(mm); mmput(mm); } return vma ? -ENOMEM : -ESRCH; From 3de7d142cf6eb4dcbd453743c8b9e02fae73a5d9 Mon Sep 17 00:00:00 2001 From: Ryan Roberts Date: Thu, 27 Oct 2022 13:09:45 +0100 Subject: [PATCH 07/10] BACKPORT: KVM: arm64: Fix bad dereference on MTE-enabled systems enter_exception64() performs an MTE check, which involves dereferencing vcpu->kvm. While vcpu has already been fixed up to be a HYP VA pointer, kvm is still a pointer in the kernel VA space. This only affects nVHE configurations with MTE enabled, as in other cases, the pointer is either valid (VHE) or not dereferenced (!MTE). Fix this by first converting kvm to a HYP VA pointer. Fixes: ea7fc1bb1cd1 ("KVM: arm64: Introduce MTE VM feature") Signed-off-by: Ryan Roberts Reviewed-by: Steven Price [maz: commit message tidy-up] Signed-off-by: Marc Zyngier Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20221027120945.29679-1-ryan.roberts@arm.com (cherry picked from commit b6bcdc9f6b8321e4471ff45413b6410e16762a8d) [willdeacon@: Fixed conflict with aosp/2038249 rework moving MTE feature check into caller] Signed-off-by: Will Deacon Bug: 233587962 Bug: 233588291 Change-Id: Id0aac0fc38dff2569081910af7468ecf97b6eca3 --- arch/arm64/kvm/hyp/exception.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/arch/arm64/kvm/hyp/exception.c b/arch/arm64/kvm/hyp/exception.c index 14a80b0e2f91..ceb6808c2d80 100644 --- a/arch/arm64/kvm/hyp/exception.c +++ b/arch/arm64/kvm/hyp/exception.c @@ -13,6 +13,7 @@ #include #include #include +#include #if !defined (__KVM_NVHE_HYPERVISOR__) && !defined (__KVM_VHE_HYPERVISOR__) #error Hypervisor code only! @@ -165,7 +166,8 @@ static void enter_exception64(struct kvm_vcpu *vcpu, unsigned long target_mode, *vcpu_pc(vcpu) = vbar + offset; old = *vcpu_cpsr(vcpu); - new = get_except64_cpsr(old, kvm_has_mte(vcpu->kvm), sctlr, target_mode); + new = get_except64_cpsr(old, kvm_has_mte(kern_hyp_va(vcpu->kvm)), sctlr, + target_mode); *vcpu_cpsr(vcpu) = new; __vcpu_write_spsr(vcpu, old); } From 9e3ae1fbd38957a9bbcaf5a97977901ad0f2da6f Mon Sep 17 00:00:00 2001 From: Peter Zijlstra Date: Mon, 14 Feb 2022 10:16:57 +0100 Subject: [PATCH 08/10] UPSTREAM: sched: Fix yet more sched_fork() races Where commit 4ef0c5c6b5ba ("kernel/sched: Fix sched_fork() access an invalid sched_task_group") fixed a fork race vs cgroup, it opened up a race vs syscalls by not placing the task on the runqueue before it gets exposed through the pidhash. Commit 13765de8148f ("sched/fair: Fix fault in reweight_entity") is trying to fix a single instance of this, instead fix the whole class of issues, effectively reverting this commit. Bug: 255159688 Fixes: 4ef0c5c6b5ba ("kernel/sched: Fix sched_fork() access an invalid sched_task_group") Reported-by: Linus Torvalds Signed-off-by: Peter Zijlstra (Intel) Tested-by: Tadeusz Struk Tested-by: Zhang Qiao Tested-by: Dietmar Eggemann Link: https://lkml.kernel.org/r/YgoeCbwj5mbCR0qA@hirez.programming.kicks-ass.net (cherry picked from commit b1e8206582f9d680cff7d04828708c8b6ab32957) Signed-off-by: Woody Lin Change-Id: Ic593aafb0cc8dae5ba382cdc4ab68526973fdfca --- include/linux/sched/task.h | 4 ++-- kernel/fork.c | 13 ++++++++++++- kernel/sched/core.c | 23 ++++++++++++++++------- 3 files changed, 30 insertions(+), 10 deletions(-) diff --git a/include/linux/sched/task.h b/include/linux/sched/task.h index fa75f325dad5..cea4bdfd0f05 100644 --- a/include/linux/sched/task.h +++ b/include/linux/sched/task.h @@ -55,8 +55,8 @@ extern asmlinkage void schedule_tail(struct task_struct *prev); extern void init_idle(struct task_struct *idle, int cpu); extern int sched_fork(unsigned long clone_flags, struct task_struct *p); -extern void sched_post_fork(struct task_struct *p, - struct kernel_clone_args *kargs); +extern void sched_cgroup_fork(struct task_struct *p, struct kernel_clone_args *kargs); +extern void sched_post_fork(struct task_struct *p); extern void sched_dead(struct task_struct *p); void __noreturn do_task_dead(void); diff --git a/kernel/fork.c b/kernel/fork.c index a33cb21a05a5..8d2c3eb1b8fa 100644 --- a/kernel/fork.c +++ b/kernel/fork.c @@ -2260,6 +2260,17 @@ static __latent_entropy struct task_struct *copy_process( if (retval) goto bad_fork_put_pidfd; + /* + * Now that the cgroups are pinned, re-clone the parent cgroup and put + * the new task on the correct runqueue. All this *before* the task + * becomes visible. + * + * This isn't part of ->can_fork() because while the re-cloning is + * cgroup specific, it unconditionally needs to place the task on a + * runqueue. + */ + sched_cgroup_fork(p, args); + /* * From this point on we must avoid any synchronous user-space * communication until we take the tasklist-lock. In particular, we do @@ -2367,7 +2378,7 @@ static __latent_entropy struct task_struct *copy_process( fd_install(pidfd, pidfile); proc_fork_connector(p); - sched_post_fork(p, args); + sched_post_fork(p); cgroup_post_fork(p, args); perf_event_fork(p); diff --git a/kernel/sched/core.c b/kernel/sched/core.c index 5000f595fac0..583094de1de0 100644 --- a/kernel/sched/core.c +++ b/kernel/sched/core.c @@ -3506,6 +3506,7 @@ int sched_fork(unsigned long clone_flags, struct task_struct *p) init_entity_runnable_average(&p->se); trace_android_rvh_finish_prio_fork(p); + #ifdef CONFIG_SCHED_INFO if (likely(sched_info_on())) memset(&p->sched_info, 0, sizeof(p->sched_info)); @@ -3521,18 +3522,23 @@ int sched_fork(unsigned long clone_flags, struct task_struct *p) return 0; } -void sched_post_fork(struct task_struct *p, struct kernel_clone_args *kargs) +void sched_cgroup_fork(struct task_struct *p, struct kernel_clone_args *kargs) { unsigned long flags; -#ifdef CONFIG_CGROUP_SCHED - struct task_group *tg; -#endif + /* + * Because we're not yet on the pid-hash, p->pi_lock isn't strictly + * required yet, but lockdep gets upset if rules are violated. + */ raw_spin_lock_irqsave(&p->pi_lock, flags); #ifdef CONFIG_CGROUP_SCHED - tg = container_of(kargs->cset->subsys[cpu_cgrp_id], - struct task_group, css); - p->sched_task_group = autogroup_task_group(p, tg); + if (1) { + struct task_group *tg; + tg = container_of(kargs->cset->subsys[cpu_cgrp_id], + struct task_group, css); + tg = autogroup_task_group(p, tg); + p->sched_task_group = tg; + } #endif rseq_migrate(p); /* @@ -3543,7 +3549,10 @@ void sched_post_fork(struct task_struct *p, struct kernel_clone_args *kargs) if (p->sched_class->task_fork) p->sched_class->task_fork(p); raw_spin_unlock_irqrestore(&p->pi_lock, flags); +} +void sched_post_fork(struct task_struct *p) +{ uclamp_post_fork(p); } From bcb19fa29658768dd596182be44acaafab593b1e Mon Sep 17 00:00:00 2001 From: Khalid Shaik Date: Mon, 24 Oct 2022 21:21:48 +0530 Subject: [PATCH 09/10] ANDROID: GKI: Add symbol list for exynos - Add Initial ABI Symbol list for Exynos SOC 20 function symbol(s) added 'int __iio_device_register(struct iio_dev *, struct module *)' 'int cpufreq_unregister_notifier(struct notifier_block *, unsigned int)' 'int is_console_locked()' 'struct __kernel_old_timeval ns_to_kernel_old_timeval(const s64)' 'void proc_set_user(struct proc_dir_entry *, kuid_t, kgid_t)' 'int sysfs_create_bin_file(struct kobject *, const struct bin_attribute *)' 'int v4l2_ctrl_handler_setup(struct v4l2_ctrl_handler *)' 'int v4l2_device_register_subdev(struct v4l2_device *, struct v4l2_subdev *)' 'int v4l2_device_set_name(struct v4l2_device *, const char *, atomic_t *)' 'void v4l2_device_unregister_subdev(struct v4l2_subdev *)' 'void v4l2_i2c_subdev_init(struct v4l2_subdev *, struct i2c_client *, const struct v4l2_subdev_ops *)' 'int v4l2_m2m_dqbuf(struct file *, struct v4l2_m2m_ctx *, struct v4l2_buffer *)' 'int v4l2_m2m_mmap(struct file *, struct v4l2_m2m_ctx *, struct vm_area_struct *)' '__poll_t v4l2_m2m_poll(struct file *, struct v4l2_m2m_ctx *, struct poll_table_struct *)' 'int v4l2_m2m_reqbufs(struct file *, struct v4l2_m2m_ctx *, struct v4l2_requestbuffers *)' 'int v4l2_m2m_streamoff(struct file *, struct v4l2_m2m_ctx *, enum v4l2_buf_type)' 'int v4l2_m2m_streamon(struct file *, struct v4l2_m2m_ctx *, enum v4l2_buf_type)' 'void v4l2_subdev_init(struct v4l2_subdev *, const struct v4l2_subdev_ops *)' 'void v4l_bound_align_image(u32 *, unsigned int, unsigned int, unsigned int, u32 *, unsigned int, unsigned int, unsigned int, unsigned int)' 'unsigned long int vmalloc_to_pfn(void *)' 1 variable symbol(s) added 'const struct v4l2_subdev_ops v4l2_subdev_call_wrappers' Bug: 254608320 Signed-off-by: Khalid Shaik Change-Id: I664d1eac2ba9b86fe29f978b8eb915c1386c9ba4 --- BUILD.bazel | 1 + android/abi_gki_aarch64.xml | 920 +++++++++++++++++++++------------ android/abi_gki_aarch64_exynos | 779 ++++++++++++++++++++++++++++ build.config.gki.aarch64 | 1 + 4 files changed, 1375 insertions(+), 326 deletions(-) create mode 100644 android/abi_gki_aarch64_exynos diff --git a/BUILD.bazel b/BUILD.bazel index dc6ff92044b3..b80c5b10dcb9 100644 --- a/BUILD.bazel +++ b/BUILD.bazel @@ -23,6 +23,7 @@ _aarch64_additional_kmi_symbol_lists = [ # keep sorted "android/abi_gki_aarch64_core", "android/abi_gki_aarch64_db845c", + "android/abi_gki_aarch64_exynos", "android/abi_gki_aarch64_fips140", "android/abi_gki_aarch64_generic", "android/abi_gki_aarch64_hikey960", diff --git a/android/abi_gki_aarch64.xml b/android/abi_gki_aarch64.xml index 32a6709a4e4c..34ae777f69f6 100644 --- a/android/abi_gki_aarch64.xml +++ b/android/abi_gki_aarch64.xml @@ -100,6 +100,7 @@ + @@ -771,6 +772,7 @@ + @@ -2045,6 +2047,7 @@ + @@ -2338,6 +2341,7 @@ + @@ -2671,6 +2675,7 @@ + @@ -3288,6 +3293,7 @@ + @@ -3568,21 +3574,27 @@ + + + + + + @@ -3594,9 +3606,16 @@ + + + + + + + @@ -3708,6 +3727,7 @@ + @@ -4070,6 +4090,7 @@ + @@ -4189,6 +4210,71 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -4965,7 +5051,7 @@ - + @@ -7809,7 +7895,7 @@ - + @@ -8951,7 +9037,7 @@ - + @@ -10487,6 +10573,9 @@ + + + @@ -12026,7 +12115,7 @@ - + @@ -15054,7 +15143,7 @@ - + @@ -20021,7 +20110,7 @@ - + @@ -21976,7 +22065,7 @@ - + @@ -24417,7 +24506,7 @@ - + @@ -26382,7 +26471,7 @@ - + @@ -29315,6 +29404,14 @@ + + + + + + + + @@ -34073,7 +34170,7 @@ - + @@ -36866,7 +36963,7 @@ - + @@ -38189,7 +38286,17 @@ - + + + + + + + + + + + @@ -44469,6 +44576,7 @@ + @@ -47878,6 +47986,14 @@ + + + + + + + + @@ -48182,13 +48298,13 @@ - + - + - + @@ -48197,7 +48313,7 @@ - + @@ -52364,7 +52480,7 @@ - + @@ -55053,6 +55169,7 @@ + @@ -58426,61 +58543,61 @@ - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + @@ -62028,7 +62145,7 @@ - + @@ -62119,7 +62236,7 @@ - + @@ -66149,7 +66266,7 @@ - + @@ -66868,7 +66985,7 @@ - + @@ -67732,25 +67849,25 @@ - + - + - + - + - + - + - + @@ -70350,7 +70467,7 @@ - + @@ -70377,7 +70494,7 @@ - + @@ -70388,7 +70505,7 @@ - + @@ -71194,7 +71311,7 @@ - + @@ -71207,7 +71324,7 @@ - + @@ -71237,7 +71354,7 @@ - + @@ -71280,7 +71397,7 @@ - + @@ -71307,7 +71424,7 @@ - + @@ -71315,7 +71432,7 @@ - + @@ -71323,7 +71440,7 @@ - + @@ -71336,25 +71453,25 @@ - + - + - + - + - + - + - + @@ -71387,7 +71504,7 @@ - + @@ -71398,7 +71515,7 @@ - + @@ -71411,7 +71528,7 @@ - + @@ -71457,7 +71574,7 @@ - + @@ -71482,15 +71599,15 @@ - + - + - + @@ -71498,7 +71615,7 @@ - + @@ -71592,7 +71709,7 @@ - + @@ -71600,21 +71717,21 @@ - + - + - + - + - + @@ -71651,10 +71768,10 @@ - + - + @@ -71670,7 +71787,7 @@ - + @@ -71697,10 +71814,10 @@ - + - + @@ -71744,7 +71861,7 @@ - + @@ -71757,7 +71874,7 @@ - + @@ -71787,7 +71904,7 @@ - + @@ -71800,7 +71917,7 @@ - + @@ -71836,13 +71953,13 @@ - + - + - + @@ -71903,7 +72020,7 @@ - + @@ -71914,13 +72031,13 @@ - + - + @@ -71928,7 +72045,7 @@ - + @@ -71944,7 +72061,7 @@ - + @@ -72048,7 +72165,7 @@ - + @@ -72197,10 +72314,10 @@ - + - + @@ -72216,27 +72333,27 @@ - + - + - + - + - + - + - + @@ -72252,22 +72369,22 @@ - + - + - + - + - + - + @@ -72326,36 +72443,36 @@ - + - + - + - + - + - + - + - + - + - + @@ -72366,7 +72483,7 @@ - + @@ -72390,96 +72507,96 @@ - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + @@ -72492,13 +72609,13 @@ - + - + - + @@ -72638,7 +72755,7 @@ - + @@ -77146,7 +77263,7 @@ - + @@ -77193,6 +77310,7 @@ + @@ -85880,7 +85998,7 @@ - + @@ -87292,7 +87410,7 @@ - + @@ -87376,22 +87494,22 @@ - + - + - + - + - + - + @@ -93219,7 +93337,7 @@ - + @@ -93653,6 +93771,9 @@ + + + @@ -97141,7 +97262,7 @@ - + @@ -98389,7 +98510,39 @@ - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -98397,7 +98550,7 @@ - + @@ -98405,7 +98558,7 @@ - + @@ -98416,7 +98569,7 @@ - + @@ -98424,7 +98577,7 @@ - + @@ -98441,7 +98594,7 @@ - + @@ -98449,7 +98602,7 @@ - + @@ -98457,7 +98610,7 @@ - + @@ -98471,7 +98624,7 @@ - + @@ -98485,12 +98638,12 @@ - + - + @@ -98504,7 +98657,7 @@ - + @@ -98521,7 +98674,7 @@ - + @@ -98532,7 +98685,7 @@ - + @@ -98549,7 +98702,7 @@ - + @@ -98557,7 +98710,7 @@ - + @@ -98568,7 +98721,7 @@ - + @@ -98579,7 +98732,7 @@ - + @@ -98587,7 +98740,7 @@ - + @@ -98763,13 +98916,13 @@ - + - + @@ -98780,7 +98933,7 @@ - + @@ -98791,7 +98944,7 @@ - + @@ -98799,7 +98952,7 @@ - + @@ -98807,7 +98960,7 @@ - + @@ -98821,7 +98974,7 @@ - + @@ -98829,7 +98982,7 @@ - + @@ -98837,7 +98990,7 @@ - + @@ -98845,7 +98998,7 @@ - + @@ -98853,7 +99006,7 @@ - + @@ -98864,7 +99017,7 @@ - + @@ -98872,7 +99025,7 @@ - + @@ -98886,7 +99039,7 @@ - + @@ -98897,7 +99050,7 @@ - + @@ -98905,7 +99058,7 @@ - + @@ -98913,7 +99066,7 @@ - + @@ -98921,7 +99074,7 @@ - + @@ -98941,7 +99094,7 @@ - + @@ -98955,7 +99108,7 @@ - + @@ -98972,7 +99125,7 @@ - + @@ -98986,7 +99139,7 @@ - + @@ -99000,7 +99153,7 @@ - + @@ -99008,7 +99161,7 @@ - + @@ -99022,7 +99175,7 @@ - + @@ -99033,7 +99186,7 @@ - + @@ -99050,7 +99203,7 @@ - + @@ -99058,7 +99211,7 @@ - + @@ -99066,7 +99219,7 @@ - + @@ -99077,7 +99230,7 @@ - + @@ -99088,7 +99241,7 @@ - + @@ -99096,7 +99249,7 @@ - + @@ -99113,7 +99266,7 @@ - + @@ -99136,7 +99289,7 @@ - + @@ -99144,7 +99297,7 @@ - + @@ -99155,7 +99308,7 @@ - + @@ -99169,18 +99322,18 @@ - + - + - + @@ -99206,7 +99359,7 @@ - + @@ -99217,7 +99370,7 @@ - + @@ -99225,7 +99378,7 @@ - + @@ -99245,7 +99398,7 @@ - + @@ -99256,7 +99409,7 @@ - + @@ -99267,12 +99420,12 @@ - + - + @@ -99280,7 +99433,7 @@ - + @@ -99288,7 +99441,7 @@ - + @@ -99296,7 +99449,7 @@ - + @@ -99304,12 +99457,12 @@ - + - + @@ -99317,7 +99470,7 @@ - + @@ -99325,7 +99478,7 @@ - + @@ -99333,7 +99486,7 @@ - + @@ -99341,7 +99494,7 @@ - + @@ -99349,7 +99502,7 @@ - + @@ -99357,7 +99510,7 @@ - + @@ -99398,7 +99551,7 @@ - + @@ -99412,7 +99565,7 @@ - + @@ -99438,7 +99591,7 @@ - + @@ -99503,7 +99656,7 @@ - + @@ -99514,7 +99667,7 @@ - + @@ -99531,7 +99684,7 @@ - + @@ -99575,7 +99728,7 @@ - + @@ -99586,7 +99739,7 @@ - + @@ -99597,7 +99750,7 @@ - + @@ -99617,7 +99770,7 @@ - + @@ -99625,7 +99778,7 @@ - + @@ -99642,7 +99795,7 @@ - + @@ -99671,7 +99824,7 @@ - + @@ -99688,7 +99841,7 @@ - + @@ -99702,17 +99855,17 @@ - + - + - + @@ -99720,7 +99873,7 @@ - + @@ -99731,7 +99884,7 @@ - + @@ -99739,7 +99892,7 @@ - + @@ -99780,7 +99933,7 @@ - + @@ -99788,7 +99941,7 @@ - + @@ -99796,7 +99949,7 @@ - + @@ -99810,7 +99963,7 @@ - + @@ -99830,7 +99983,7 @@ - + @@ -99838,7 +99991,7 @@ - + @@ -99846,7 +99999,7 @@ - + @@ -99854,12 +100007,12 @@ - + - + @@ -99867,7 +100020,7 @@ - + @@ -99878,7 +100031,7 @@ - + @@ -99886,18 +100039,18 @@ - + - + - - + + @@ -99911,12 +100064,12 @@ - + - + @@ -99924,12 +100077,12 @@ - + - + @@ -99937,12 +100090,12 @@ - + - + @@ -99959,7 +100112,7 @@ - + @@ -99967,7 +100120,7 @@ - + @@ -99975,12 +100128,12 @@ - + - + @@ -99988,7 +100141,7 @@ - + @@ -99996,7 +100149,7 @@ - + @@ -100013,12 +100166,12 @@ - + - + @@ -100044,7 +100197,7 @@ - + @@ -100055,7 +100208,7 @@ - + @@ -100075,7 +100228,7 @@ - + @@ -100098,7 +100251,7 @@ - + @@ -100112,12 +100265,12 @@ - + - + @@ -100128,7 +100281,7 @@ - + @@ -100142,7 +100295,7 @@ - + @@ -100153,7 +100306,7 @@ - + @@ -100167,7 +100320,7 @@ - + @@ -100181,12 +100334,12 @@ - + - + @@ -100194,7 +100347,7 @@ - + @@ -100208,7 +100361,7 @@ - + @@ -100216,7 +100369,7 @@ - + @@ -100227,7 +100380,7 @@ - + @@ -100244,7 +100397,7 @@ - + @@ -100264,7 +100417,7 @@ - + @@ -100281,7 +100434,7 @@ - + @@ -100292,7 +100445,7 @@ - + @@ -100300,7 +100453,7 @@ - + @@ -100308,7 +100461,7 @@ - + @@ -100316,7 +100469,7 @@ - + @@ -100330,7 +100483,7 @@ - + @@ -100338,7 +100491,7 @@ - + @@ -100349,7 +100502,7 @@ - + @@ -100366,7 +100519,7 @@ - + @@ -100392,7 +100545,7 @@ - + @@ -100403,7 +100556,7 @@ - + @@ -100414,7 +100567,7 @@ - + @@ -100834,6 +100987,11 @@ + + + + + @@ -105274,7 +105432,7 @@ - + @@ -108146,7 +108304,7 @@ - + @@ -109463,7 +109621,7 @@ - + @@ -110452,6 +110610,11 @@ + + + + + @@ -114428,6 +114591,11 @@ + + + + + @@ -121115,6 +121283,9 @@ + + + @@ -122581,6 +122752,10 @@ + + + + @@ -124304,6 +124479,12 @@ + + + + + + @@ -127532,6 +127713,11 @@ + + + + + @@ -128934,6 +129120,10 @@ + + + + @@ -128969,10 +129159,25 @@ + + + + + + + + + + + + + + + @@ -128994,6 +129199,12 @@ + + + + + + @@ -129013,6 +129224,12 @@ + + + + + + @@ -129071,10 +129288,22 @@ + + + + + + + + + + + + @@ -129085,6 +129314,42 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -129651,6 +129916,10 @@ + + + + @@ -130125,7 +130394,6 @@ - diff --git a/android/abi_gki_aarch64_exynos b/android/abi_gki_aarch64_exynos new file mode 100644 index 000000000000..b5d9be87a521 --- /dev/null +++ b/android/abi_gki_aarch64_exynos @@ -0,0 +1,779 @@ +[abi_symbol_list] +# commonly used symbols + add_timer + add_timer_on + adjust_managed_page_count + alloc_chrdev_region + alloc_netdev_mqs + __alloc_pages_nodemask + __alloc_percpu + __alloc_skb + alloc_workqueue + __arch_copy_from_user + __arch_copy_to_user + arm64_const_caps_ready + arm64_use_ng_mappings + __arm_smccc_smc + atomic_notifier_call_chain + atomic_notifier_chain_register + atomic_notifier_chain_unregister + bcmp + bitmap_parse + bitmap_parselist + bitmap_print_to_pagebuf + blocking_notifier_call_chain + blocking_notifier_chain_register + blocking_notifier_chain_unregister + bpf_trace_run1 + bpf_trace_run2 + bpf_trace_run3 + bpf_trace_run4 + bpf_trace_run5 + bpf_trace_run6 + bpf_trace_run7 + cancel_delayed_work + cancel_delayed_work_sync + cancel_work_sync + cdev_add + cdev_del + cdev_init + __cfi_slowpath + __check_object_size + __class_create + class_destroy + class_unregister + clk_disable + clk_enable + clk_get + clk_get_rate + __clk_is_enabled + clk_prepare + clk_put + clk_set_parent + clk_set_rate + clk_unprepare + cma_alloc + cma_release + compat_alloc_user_space + complete + complete_all + completion_done + config_ep_by_speed + config_group_init_type_name + console_suspend_enabled + console_unlock + __const_udelay + __cpu_active_mask + cpu_bit_bitmap + cpufreq_cpu_get + cpufreq_cpu_put + cpufreq_quick_get + cpufreq_register_notifier + cpufreq_unregister_notifier + __cpuhp_remove_state + __cpuhp_setup_state + cpu_hwcap_keys + cpu_hwcaps + cpumask_next + cpumask_next_and + cpu_number + __cpu_online_mask + __cpu_possible_mask + cpu_scale + cpu_subsys + crc32_le + crypto_destroy_tfm + crypto_register_alg + crypto_register_scomp + crypto_unregister_alg + crypto_unregister_scomp + _ctype + debugfs_create_bool + debugfs_create_dir + debugfs_create_file + debugfs_create_u32 + debugfs_remove + default_llseek + delayed_work_timer_fn + del_timer + del_timer_sync + destroy_workqueue + dev_driver_string + _dev_emerg + _dev_err + device_create + device_create_bin_file + device_create_file + device_destroy + device_for_each_child + device_initialize + device_init_wakeup + device_property_present + device_property_read_u32_array + device_remove_file + _dev_info + __dev_kfree_skb_any + devm_add_action + devm_clk_get + devm_free_irq + devm_ioremap + devm_ioremap_resource + devm_iounmap + devm_kasprintf + devm_kfree + devm_kmalloc + devm_kmemdup + __devm_of_phy_provider_register + devm_phy_create + devm_phy_get + devm_pinctrl_get + devm_pinctrl_put + devm_platform_ioremap_resource + devm_regulator_get + __devm_request_region + devm_request_threaded_irq + __devm_reset_control_get + _dev_notice + dev_pm_opp_add + dev_pm_opp_find_freq_ceil + dev_pm_opp_get_voltage + dev_pm_opp_put + dev_set_name + _dev_warn + disable_irq + disable_irq_nosync + dma_alloc_attrs + dma_buf_attach + dma_buf_begin_cpu_access + dma_buf_detach + dma_buf_end_cpu_access + dma_buf_export + dma_buf_get + dma_buf_map_attachment + dma_buf_mmap + dma_buf_put + dma_buf_unmap_attachment + dma_buf_vmap + dma_buf_vunmap + dma_fence_add_callback + dma_fence_context_alloc + dma_fence_default_wait + dma_fence_get_status + dma_fence_init + dma_fence_release + dma_fence_remove_callback + dma_fence_signal + dma_free_attrs + dma_heap_buffer_alloc + dma_heap_find + dma_heap_put + dmam_alloc_attrs + dma_map_page_attrs + dma_map_sg_attrs + dma_release_channel + dma_request_chan + dma_set_coherent_mask + dma_set_mask + dma_sync_sg_for_cpu + dma_sync_sg_for_device + dma_sync_single_for_cpu + dma_sync_single_for_device + dma_unmap_page_attrs + dma_unmap_sg_attrs + down + down_interruptible + down_read + down_write + driver_unregister + dump_stack + enable_irq + event_triggers_call + failure_tracking + fd_install + find_last_bit + find_next_bit + find_next_zero_bit + find_vpid + finish_wait + flush_dcache_page + flush_work + flush_workqueue + fput + free_irq + free_netdev + __free_pages + free_pages + free_percpu + freq_qos_update_request + generic_file_llseek + gen_pool_add_owner + gen_pool_alloc_algo_owner + gen_pool_free_owner + get_cpu_device + get_device + __get_free_pages + get_thermal_instance + get_unused_fd_flags + gic_nonsecure_priorities + gpiod_direction_input + gpiod_direction_output_raw + gpiod_get_raw_value + gpiod_set_raw_value + gpiod_to_irq + gpio_free + gpio_request + gpio_request_one + gpio_to_desc + gserial_alloc_line + gserial_connect + gserial_disconnect + handle_level_irq + handle_nested_irq + hex_dump_to_buffer + hrtimer_active + hrtimer_cancel + hrtimer_forward + hrtimer_init + hrtimer_start_range_ns + i2c_add_numbered_adapter + i2c_del_adapter + i2c_del_driver + i2c_new_dummy_device + i2c_register_driver + i2c_smbus_read_byte_data + i2c_smbus_read_i2c_block_data + i2c_smbus_write_byte_data + i2c_smbus_write_i2c_block_data + i2c_transfer + i2c_transfer_buffer_flags + i2c_unregister_device + idr_alloc + idr_remove + __iio_device_register + iio_device_unregister + __init_rwsem + __init_swait_queue_head + init_task + init_timer_key + init_wait_entry + __init_waitqueue_head + input_allocate_device + input_event + input_free_device + input_register_device + input_set_capability + input_unregister_device + iomem_resource + iommu_get_domain_for_dev + iommu_map_sg + iommu_register_device_fault_handler + iommu_unmap + iommu_unregister_device_fault_handler + __ioremap + iounmap + __irq_alloc_descs + irq_get_irq_data + irq_modify_status + irq_of_parse_and_map + irq_set_affinity_hint + irq_set_chip_and_handler_name + irq_set_chip_data + irq_set_irq_wake + irq_to_desc + is_console_locked + is_vmalloc_addr + jiffies + jiffies_to_msecs + jiffies_to_usecs + kasan_flag_enabled + kasprintf + kernel_kobj + __kfifo_alloc + __kfifo_free + __kfifo_in + __kfifo_to_user + kfree + kfree_skb + kimage_voffset + __kmalloc + kmalloc_caches + kmalloc_order_trace + kmem_cache_alloc + kmem_cache_alloc_trace + kmem_cache_create + kmem_cache_destroy + kmem_cache_free + kmemdup + kobject_create_and_add + kobject_init_and_add + kobject_put + kobject_uevent_env + krealloc + kstrdup + kstrndup + kstrtobool + kstrtobool_from_user + kstrtoint + kstrtoint_from_user + kstrtoll + kstrtou8 + kstrtouint + kstrtouint_from_user + kstrtoull + kthread_bind + kthread_create_on_node + kthread_delayed_work_timer_fn + kthread_flush_worker + __kthread_init_worker + kthread_queue_work + kthread_should_stop + kthread_stop + kthread_worker_fn + ktime_get + ktime_get_mono_fast_ns + ktime_get_raw_ts64 + ktime_get_real_ts64 + ktime_get_ts64 + ktime_get_with_offset + kvfree + kvfree_call_rcu + kvmalloc_node + __list_add_valid + __list_del_entry_valid + __log_post_read_mmio + __log_read_mmio + __log_write_mmio + loops_per_jiffy + lzo1x_decompress_safe + memcpy + __memcpy_fromio + __memcpy_toio + memdup_user + memset + __memset_io + memstart_addr + mfd_add_devices + mfd_remove_devices + misc_deregister + misc_register + mod_delayed_work_on + mod_timer + module_layout + module_put + __msecs_to_jiffies + msleep + msleep_interruptible + __mutex_init + mutex_is_locked + mutex_lock + mutex_lock_interruptible + mutex_trylock + mutex_unlock + napi_complete_done + napi_gro_receive + __napi_schedule + napi_schedule_prep + __netdev_alloc_skb + netif_napi_add + netif_receive_skb + netif_tx_wake_queue + nla_put + no_llseek + nonseekable_open + noop_llseek + nr_cpu_ids + ns_to_kernel_old_timeval + ns_to_timespec64 + __num_online_cpus + of_address_to_resource + of_alias_get_id + of_count_phandle_with_args + of_device_get_match_data + of_device_is_available + of_device_is_compatible + of_find_compatible_node + of_find_device_by_node + of_find_matching_node_and_match + of_find_node_by_name + of_find_node_opts_by_path + of_find_property + of_get_child_by_name + of_get_cpu_node + of_get_named_gpio_flags + of_get_next_available_child + of_get_next_child + of_get_property + of_iomap + of_machine_is_compatible + of_match_device + of_match_node + of_n_addr_cells + of_n_size_cells + of_parse_phandle + of_phandle_iterator_init + of_phandle_iterator_next + of_platform_populate + of_property_count_elems_of_size + of_property_match_string + of_property_read_string + of_property_read_string_helper + of_property_read_u32_index + of_property_read_variable_u32_array + of_prop_next_string + of_prop_next_u32 + of_reserved_mem_device_init_by_idx + of_reserved_mem_device_release + of_reserved_mem_lookup + of_root + __page_pinner_put_page + panic + panic_notifier_list + param_array_ops + param_ops_bool + param_ops_charp + param_ops_int + param_ops_string + param_ops_uint + param_ops_ulong + PDE_DATA + __per_cpu_offset + perf_trace_buf_alloc + perf_trace_run_bpf_submit + pfn_valid + phy_power_off + phy_power_on + pinctrl_lookup_state + pinctrl_select_state + pin_user_pages + platform_device_unregister + __platform_driver_register + platform_driver_unregister + platform_get_irq + platform_get_irq_byname + platform_get_resource + platform_get_resource_byname + __pm_relax + pm_relax + __pm_runtime_disable + pm_runtime_enable + pm_runtime_forbid + pm_runtime_force_resume + pm_runtime_force_suspend + __pm_runtime_idle + __pm_runtime_resume + pm_runtime_set_autosuspend_delay + __pm_runtime_set_status + __pm_runtime_suspend + __pm_runtime_use_autosuspend + __pm_stay_awake + pm_stay_awake + pm_wakeup_ws_event + power_supply_changed + power_supply_get_by_name + power_supply_get_drvdata + power_supply_get_property + power_supply_register + power_supply_set_property + power_supply_unregister + preempt_schedule + preempt_schedule_notrace + prepare_to_wait_event + print_hex_dump + printk + proc_create + proc_create_data + proc_mkdir + proc_set_user + put_device + __put_page + __put_task_struct + put_unused_fd + queue_delayed_work_on + queue_work_on + ___ratelimit + raw_notifier_call_chain + raw_notifier_chain_register + _raw_read_lock + _raw_read_unlock + _raw_spin_lock + _raw_spin_lock_bh + _raw_spin_lock_irq + _raw_spin_lock_irqsave + _raw_spin_trylock + _raw_spin_unlock + _raw_spin_unlock_bh + _raw_spin_unlock_irq + _raw_spin_unlock_irqrestore + _raw_write_lock_irqsave + _raw_write_unlock_irqrestore + rb_insert_color + __rcu_read_lock + __rcu_read_unlock + refcount_warn_saturate + regcache_cache_only + __register_chrdev + register_chrdev_region + register_pm_notifier + register_reboot_notifier + register_restart_handler + register_shrinker + register_syscore_ops + regmap_read + regmap_update_bits_base + regmap_write + regulator_disable + regulator_enable + regulator_get + regulator_get_optional + regulator_is_enabled + regulator_put + regulator_set_voltage + release_firmware + __release_region + remap_pfn_range + remove_cpu + remove_proc_entry + request_firmware + __request_region + request_threaded_irq + reset_control_assert + reset_control_deassert + return_address + rtc_class_close + rtc_class_open + rtc_read_time + sched_clock + sched_setscheduler_nocheck + schedule + schedule_timeout + scnprintf + seq_lseek + seq_printf + seq_puts + seq_read + seq_release + set_cpus_allowed_ptr + sg_alloc_table + sg_free_table + sg_init_table + sg_miter_next + sg_miter_start + sg_miter_stop + sg_next + __sg_page_iter_next + __sg_page_iter_start + simple_attr_open + simple_attr_read + simple_attr_release + simple_attr_write + simple_open + simple_read_from_buffer + simple_write_to_buffer + single_open + single_release + skb_copy_expand + skb_dequeue + skb_pull + skb_push + skb_put + skb_queue_head + skb_queue_purge + skb_queue_tail + skb_trim + smp_call_function + smp_call_function_single + snd_pcm_format_width + snd_soc_dapm_get_enum_double + snd_soc_dapm_get_volsw + snd_soc_dapm_ignore_suspend + snd_soc_dapm_info_pin_switch + snd_soc_dapm_put_enum_double + snd_soc_dapm_put_volsw + snd_soc_dapm_sync + snd_soc_get_enum_double + snd_soc_get_volsw + snd_soc_info_enum_double + snd_soc_info_volsw + snd_soc_put_enum_double + snd_soc_put_volsw + snd_soc_register_component + snd_soc_unregister_component + snprintf + sort + sprintf + sscanf + __stack_chk_fail + static_key_slow_dec + static_key_slow_inc + stpcpy + strcasecmp + strcat + strchr + strcmp + strcpy + strlcat + strlcpy + strlen + strncasecmp + strncmp + strncpy + strnlen + strrchr + strscpy + strsep + strstr + __sw_hweight32 + __sw_hweight64 + sync_file_create + sync_file_get_fence + synchronize_rcu + syscon_regmap_lookup_by_phandle + sysfs_add_file_to_group + sysfs_create_bin_file + sysfs_create_file_ns + sysfs_create_group + sysfs_create_groups + sysfs_create_link + sysfs_emit + sysfs_notify + sysfs_remove_file_ns + sysfs_remove_group + sysfs_streq + system_wq + sys_tz + __tasklet_hi_schedule + tasklet_init + tasklet_kill + __tasklet_schedule + thermal_of_cooling_device_register + thermal_zone_get_temp + thermal_zone_get_zone_by_name + time64_to_tm + _totalram_pages + trace_event_buffer_commit + trace_event_buffer_reserve + trace_event_ignore_this_pid + trace_event_raw_init + trace_event_reg + trace_handle_return + __traceiter_android_vh_cpu_idle_enter + __traceiter_android_vh_cpu_idle_exit + __traceiter_device_pm_callback_end + __traceiter_device_pm_callback_start + __traceiter_pelt_cfs_tp + __traceiter_rwmmio_post_read + __traceiter_rwmmio_read + __traceiter_rwmmio_write + __traceiter_suspend_resume + __tracepoint_android_vh_cpu_idle_enter + __tracepoint_android_vh_cpu_idle_exit + __tracepoint_device_pm_callback_end + __tracepoint_device_pm_callback_start + __tracepoint_pelt_cfs_tp + tracepoint_probe_register + __tracepoint_rwmmio_post_read + __tracepoint_rwmmio_read + __tracepoint_rwmmio_write + __tracepoint_suspend_resume + trace_print_array_seq + trace_raw_output_prep + trace_seq_printf + try_module_get + __udelay + unpin_user_page + __unregister_chrdev + unregister_chrdev_region + unregister_pm_notifier + unregister_shrinker + up + up_read + up_write + usb_add_function + usb_copy_descriptors + usb_ep_autoconfig + usb_function_register + usb_function_unregister + usb_hub_find_child + usb_interface_id + usb_put_function_instance + usb_register_notify + usb_string_id + usb_unregister_notify + __usecs_to_jiffies + usleep_range + v4l2_ctrl_handler_free + v4l2_ctrl_handler_init_class + v4l2_ctrl_handler_setup + v4l2_ctrl_new_custom + v4l2_ctrl_new_std + v4l2_ctrl_new_std_menu + v4l2_device_register + v4l2_device_register_subdev + v4l2_device_set_name + v4l2_device_unregister + v4l2_device_unregister_subdev + v4l2_fh_add + v4l2_fh_del + v4l2_fh_exit + v4l2_fh_init + v4l2_i2c_subdev_init + v4l2_m2m_buf_queue + v4l2_m2m_buf_remove + v4l2_m2m_ctx_init + v4l2_m2m_ctx_release + v4l2_m2m_dqbuf + v4l2_m2m_get_curr_priv + v4l2_m2m_get_vq + v4l2_m2m_init + v4l2_m2m_job_finish + v4l2_m2m_mmap + v4l2_m2m_next_buf + v4l2_m2m_poll + v4l2_m2m_qbuf + v4l2_m2m_release + v4l2_m2m_reqbufs + v4l2_m2m_streamoff + v4l2_m2m_streamon + v4l2_subdev_call_wrappers + v4l2_subdev_init + v4l_bound_align_image + vabits_actual + vb2_buffer_done + vb2_dma_sg_memops + vb2_dqbuf + vb2_mmap + vb2_plane_cookie + vb2_plane_vaddr + vb2_poll + vb2_qbuf + vb2_querybuf + vb2_queue_init + vb2_queue_release + vb2_reqbufs + vb2_streamoff + vb2_streamon + vfree + video_devdata + video_device_alloc + video_device_release + video_ioctl2 + __video_register_device + video_unregister_device + vmalloc + vmalloc_to_pfn + vmap + vscnprintf + vsnprintf + vunmap + vzalloc + wait_for_completion + wait_for_completion_interruptible + wait_for_completion_interruptible_timeout + wait_for_completion_timeout + __wake_up + wake_up_process + wakeup_source_add + wakeup_source_register + wakeup_source_remove + wakeup_source_unregister + __warn_printk diff --git a/build.config.gki.aarch64 b/build.config.gki.aarch64 index ad7b6b86db07..a571f19915a1 100644 --- a/build.config.gki.aarch64 +++ b/build.config.gki.aarch64 @@ -13,6 +13,7 @@ KMI_SYMBOL_LIST=android/abi_gki_aarch64 ADDITIONAL_KMI_SYMBOL_LISTS=" android/abi_gki_aarch64_type_visibility android/abi_gki_aarch64_core +android/abi_gki_aarch64_exynos android/abi_gki_aarch64_fips140 android/abi_gki_aarch64_generic android/abi_gki_aarch64_virtual_device From 52e7aa3245d7cc74886630ab2c85cd3c5afe21dd Mon Sep 17 00:00:00 2001 From: Marc Zyngier Date: Tue, 11 Oct 2022 17:54:00 +0100 Subject: [PATCH 10/10] FROMLIST: KVM: arm64: pkvm: Fixup boot mode to reflect that the kernel resumes from EL1 The kernel has an awfully complicated boot sequence in order to cope with the various EL2 configurations, including those that "enhanced" the architecture. We go from EL2 to EL1, then back to EL2, staying at EL2 if VHE capable and otherwise go back to EL1. Here's a paracetamol tablet for you. The cpu_resume path follows the same logic, because coming up with two versions of a square wheel is hard. However, things aren't this straightforward with pKVM, as the host resume path is always proxied by the hypervisor, which means that the kernel is always entered at EL1. Which contradicts what the __boot_cpu_mode[] array contains (it obviously says EL2). This thus triggers a HVC call from EL1 to EL2 in a vain attempt to upgrade from EL1 to EL2 VHE, which we are, funnily enough, reluctant to grant to the host kernel. This is also completely unexpected, and puzzles your average EL2 hacker. Address it by fixing up the boot mode at the point the host gets deprivileged. is_hyp_mode_available() and co already have a static branch to deal with this, making it pretty safe. Cc: # 5.15+ Reported-by: Vincent Donnefort Signed-off-by: Marc Zyngier Tested-by: Vincent Donnefort Bug: 258157858 Link: https://lore.kernel.org/all/20221108100138.3887862-1-vdonnefort@google.com/ Change-Id: I4a2269402ececa0ec47cab88343c3c623b4b2e3d --- arch/arm64/kvm/arm.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/arch/arm64/kvm/arm.c b/arch/arm64/kvm/arm.c index 8e22c300752c..366999f8698a 100644 --- a/arch/arm64/kvm/arm.c +++ b/arch/arm64/kvm/arm.c @@ -2129,6 +2129,17 @@ static int pkvm_drop_host_privileges(void) * once the host stage 2 is installed. */ static_branch_enable(&kvm_protected_mode_initialized); + + /* + * Fixup the boot mode so that we don't take spurious round + * trips via EL2 on cpu_resume. Flush to the PoC for a good + * measure, so that it can be observed by a CPU coming out of + * suspend with the MMU off. + */ + __boot_cpu_mode[0] = __boot_cpu_mode[1] = BOOT_CPU_MODE_EL1; + dcache_clean_poc((unsigned long)__boot_cpu_mode, + (unsigned long)(__boot_cpu_mode + 2)); + on_each_cpu(_kvm_host_prot_finalize, &ret, 1); return ret; }