Merge android16-6.12 into android16-6.12-lts

This merges the android16-6.12 branch into the -lts branch, catching it up with the latest changes in there. It contains the following commits: * eb58d7821a ANDROID: Delete unused protected_exports file * 97f4744468 ANDROID: Remove list of protected modules & exports * 4446f7e727 Revert "ANDROID: Add IFTTT analyzer markers for GKI modules" * 2737d550a6 ANDROID: Add ufs headers to aarch64 allowlist * d3ea4f08e5 ANDROID: KVM: arm64: allow nvhe/trace.h for in-tree/DDK pKVM modules * 67160594b2 ANDROID: KVM: arm64: Move pKVM module for headers to its own dir. * 7a2f90ea8a ANDROID: Create list of protected module names * a3fde76f1e ANDROID: enforce symbol import protection * 9593e47f47 ANDROID: compile / link / clean permitted-imports.o * 19ee9bccea ANDROID: modpost: generate permitted imports * cf33526ab7 ANDROID: enforce symbol export protection * a16ea85f69 ANDROID: enable protected-exports.c generation in modpost * c909fab8b3 ANDROID: compile / link / clean protected-exports.o * 48559833d1 ANDROID: modpost: generate protected exports * 54bfd8db38 ANDROID: add MODULE_SIG_PROTECT and MODULE_SIG_PROTECT_LIST options * 255e2003ee Revert "ANDROID: GKI: Add script to generate symbol protection headers" * e6f5a053f2 ANDROID: remove CONFIG_MODULE_SIG_PROTECT from GKI defconfig * 39ef94bb72 ANDROID: GKI: Add symbols to vivo symbol list * ec4e325796 ANDROID: GKI: Update symbol list for Amlogic * b93d53f5dd ANDROID: Fix CMA pages placement in correct pcp_list * ae38a8a0e4 ANDROID: abi_gki_aarch64_qcom: Add hibernation APIs * 0034411d55 ANDROID: MEMORY: mm/page_alloc.c the pointer is not initialized * 650df1f653 ANDROID: GKI: Update the ABI symbol list for qcom * c2416bd002 ANDROID: GKI: Add RTK TV KMI symbol list * 6cb6c8c42e ANDROID: mm/memory_hotplug: implement {add/remove}_memory_subsection * 3654b006f0 ANDROID: GKI: Export memblock_free to drivers Change-Id: Idbc1a28837026abebe8083d06d9e12a93cc853fb Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2025-05-30 13:37:56 +00:00
parent ad2b007ef4 eb58d7821a
commit 26bd1ac1ad
39 changed files with 1410 additions and 913 deletions
--- a/BUILD.bazel
+++ b/BUILD.bazel
@@ -101,9 +101,12 @@ write_file(
 )

 write_file(
-    name = "gki_aarch64_protected_modules",
-    out = "gki/aarch64/protected_modules",
-    content = get_gki_protected_modules_list("arm64") + [
+    name = "gki_aarch64_protected_module_names",
+    out = "gki/aarch64/protected_module_names",
+    content = [
+        module.removesuffix(".ko")
+        for module in get_gki_protected_modules_list("arm64")
+    ] + [
        "",  # Ensure new line at the end.
    ],
 )
@@ -119,9 +122,12 @@ write_file(
 )

 write_file(
-    name = "gki_x86_64_protected_modules",
-    out = "gki/x86_64/protected_modules",
-    content = get_gki_protected_modules_list("x86_64") + [
+    name = "gki_x86_64_protected_module_names",
+    out = "gki/x86_64/protected_module_names",
+    content = [
+        module.removesuffix(".ko")
+        for module in get_gki_protected_modules_list("x86_64")
+    ] + [
        "",  # Ensure new line at the end.
    ],
 )
@@ -189,6 +195,7 @@ filegroup(
        "gki/aarch64/symbols/pixel",
        "gki/aarch64/symbols/qcom",
        "gki/aarch64/symbols/rtkstb",
+        "gki/aarch64/symbols/rtktv",
        "gki/aarch64/symbols/trusty",
        "gki/aarch64/symbols/tuxera",
        "gki/aarch64/symbols/type_visibility",
@@ -247,8 +254,7 @@ common_kernel(
    make_goals = _GKI_AARCH64_MAKE_GOALS,
    makefile = ":Makefile",
    module_implicit_outs = get_gki_modules_list("arm64") + get_kunit_modules_list("arm64"),
-    protected_exports_list = "gki/aarch64/protected_exports",
-    protected_modules_list = ":gki_aarch64_protected_modules",
+    protected_module_names_list = ":gki_aarch64_protected_module_names",
    system_dlkm_extra_archive_files = [":generate_gki_module_info_arm64"],
    trim_nonlisted_kmi = True,
    visibility = ["//visibility:public"],
@@ -278,8 +284,7 @@ common_kernel(
    makefile = ":Makefile",
    module_implicit_outs = get_gki_modules_list("arm64") + get_kunit_modules_list("arm64"),
    page_size = "16k",
-    protected_exports_list = "gki/aarch64/protected_exports",
-    protected_modules_list = ":gki_aarch64_protected_modules",
+    protected_module_names_list = ":gki_aarch64_protected_module_names",
    system_dlkm_extra_archive_files = [":generate_gki_module_info_arm64"],
    trim_nonlisted_kmi = True,
    visibility = ["//visibility:public"],
@@ -307,8 +312,7 @@ common_kernel(
    makefile = ":Makefile",
    module_implicit_outs = get_gki_modules_list("arm64") + get_kunit_modules_list("arm64"),
    pre_defconfig_fragments = ["arch/arm64/configs/tv_gki.fragment"],
-    protected_exports_list = "gki/aarch64/protected_exports",
-    protected_modules_list = ":gki_aarch64_protected_modules",
+    protected_module_names_list = ":gki_aarch64_protected_module_names",
    system_dlkm_extra_archive_files = [":generate_gki_module_info_arm64"],
    trim_nonlisted_kmi = True,
    visibility = ["//visibility:public"],
@@ -347,8 +351,7 @@ common_kernel(
    make_goals = _GKI_AARCH64_MAKE_GOALS,
    makefile = ":Makefile",
    module_implicit_outs = get_gki_modules_list("arm64") + get_kunit_modules_list("arm64"),
-    protected_exports_list = "gki/aarch64/protected_exports",
-    protected_modules_list = ":gki_aarch64_protected_modules",
+    protected_module_names_list = ":gki_aarch64_protected_module_names",
    system_dlkm_extra_archive_files = [":generate_gki_module_info_arm64"],
    trim_nonlisted_kmi = True,
    visibility = ["//visibility:public"],
@@ -1605,6 +1608,22 @@ ddk_headers(
 # Implementation details for DDK headers. The targets below cannot be directly
 # depended on by DDK modules.

+# Headers for building pKVM modules. They are for pKVM only so not added to
+# all_headers_aarch64.
+ddk_headers(
+    name = "pkvm_headers_aarch64",
+    hdrs = [
+        "arch/arm64/kvm/hyp/include/module/nvhe/define_events.h",
+        "arch/arm64/kvm/hyp/include/module/nvhe/trace.h",
+    ],
+    includes = [
+        # LINT.IfChange(pkvm_includes)
+        "arch/arm64/kvm/hyp/include/module",
+        # LINT.ThenChange(/arch/arm64/kvm/hyp/nvhe/Makefile.module:includes)
+    ],
+    visibility = ["//visibility:private"],
+)
+
 # Headers needed to include drivers/usb/host/xhci.h.
 ddk_headers(
    name = "xhci_headers",
@@ -1637,12 +1656,16 @@ ddk_headers(
        "drivers/thermal/thermal_debugfs.h",
        "drivers/thermal/thermal_netlink.h",
        "drivers/thermal/thermal_thresholds.h",
+        "drivers/ufs/core/ufshcd-crypto.h",
+        "drivers/ufs/core/ufshcd-priv.h",
+        "drivers/ufs/host/ufshcd-pltfrm.h",
        "drivers/usb/dwc3/core.h",
        "sound/usb/card.h",
        "sound/usb/usbaudio.h",
        ":all_headers_allowlist_aarch64_globs",
        ":all_headers_allowlist_common_globs",
        ":all_headers_allowlist_exynos",
+        ":pkvm_headers_aarch64",
        ":xhci_headers",
    ],
    # The list of include directories where source files can #include headers
@@ -1655,6 +1678,7 @@ ddk_headers(
        "drivers/pci",
        "drivers/pci/controller/dwc",
        "drivers/thermal",
+        "drivers/ufs",
        "drivers/usb",
        "sound/usb",
        "include",
--- a/3
+++ b/3
@@ -1553,7 +1553,8 @@ CLEAN_FILES += vmlinux.symvers modules-only.symvers \
 	       modules.builtin modules.builtin.modinfo modules.nsdeps \
 	       modules.builtin.ranges vmlinux.o.map \
 	       compile_commands.json rust/test \
-	       rust-project.json .vmlinux.objs .vmlinux.export.c
+	       rust-project.json .vmlinux.objs .vmlinux.export.c \
+	       .vmlinux.protected-exports.c .vmlinux.permitted-imports.c

 # Directories & files removed with 'make mrproper'
 MRPROPER_FILES += include/config include/generated          \
--- a/arch/arm64/configs/gki_defconfig
+++ b/arch/arm64/configs/gki_defconfig
@@ -108,7 +108,6 @@ CONFIG_MODVERSIONS=y
 CONFIG_GENDWARFKSYMS=y
 CONFIG_MODULE_SCMVERSION=y
 CONFIG_MODULE_SIG=y
-CONFIG_MODULE_SIG_PROTECT=y
 CONFIG_MODPROBE_PATH="/system/bin/modprobe"
 CONFIG_BLK_DEV_ZONED=y
 CONFIG_BLK_WBT=y
--- a/arch/arm64/include/asm/kvm_hypevents.h
+++ b/arch/arm64/include/asm/kvm_hypevents.h
@@ -4,7 +4,7 @@
 #define __ARM64_KVM_HYPEVENTS_H_

 #ifdef __KVM_NVHE_HYPERVISOR__
-#include <nvhe/trace/trace.h>
+#include <nvhe/trace.h>
 #endif

 /*
--- a/arch/arm64/kvm/hyp/Makefile
+++ b/arch/arm64/kvm/hyp/Makefile
@@ -7,4 +7,8 @@ incdir := $(src)/include
 subdir-asflags-y := -I$(incdir)
 subdir-ccflags-y := -I$(incdir)

+# ANDROID: Add -I for tracing
+subdir-asflags-y += -I$(incdir)/module
+subdir-ccflags-y += -I$(incdir)/module
+
 obj-$(CONFIG_KVM) += vhe/ nvhe/ pgtable.o
--- a/arch/arm64/kvm/hyp/include/module/nvhe/define_events.h
+++ b/arch/arm64/kvm/hyp/include/module/nvhe/define_events.h
--- a/arch/arm64/kvm/hyp/include/module/nvhe/trace.h
+++ b/arch/arm64/kvm/hyp/include/module/nvhe/trace.h
--- a/arch/arm64/kvm/hyp/nvhe/Makefile.module
+++ b/arch/arm64/kvm/hyp/nvhe/Makefile.module
@@ -5,4 +5,11 @@ $(obj)/hyp.lds: arch/arm64/kvm/hyp/nvhe/module.lds.S FORCE

 include $(srctree)/arch/arm64/kvm/hyp/nvhe/Makefile.nvhe

-ccflags-y += -I$(srctree)/arch/arm64/kvm/hyp/include/nvhe/trace/ -DMODULE
+# Deprecated; subject to removal.
+ccflags-y += -I$(srctree)/arch/arm64/kvm/hyp/include/module/nvhe
+
+# LINT.IfChange(includes)
+ccflags-y += -I$(srctree)/arch/arm64/kvm/hyp/include/module
+# LINT.ThenChange(/BUILD.bazel:pkvm_includes)
+
+ccflags-y += -DMODULE
--- a/arch/arm64/kvm/hyp/nvhe/events.c
+++ b/arch/arm64/kvm/hyp/nvhe/events.c
@@ -5,9 +5,9 @@

 #include <nvhe/mm.h>
 #include <nvhe/mem_protect.h>
-#include <nvhe/trace/trace.h>
+#include <nvhe/trace.h>

-#include <nvhe/trace/define_events.h>
+#include <nvhe/define_events.h>

 extern struct hyp_event_id __hyp_event_ids_start[];
 extern struct hyp_event_id __hyp_event_ids_end[];
--- a/arch/arm64/kvm/hyp/nvhe/hyp-main.c
+++ b/arch/arm64/kvm/hyp/nvhe/hyp-main.c
@@ -26,7 +26,7 @@
 #include <nvhe/mm.h>
 #include <nvhe/pkvm.h>
 #include <nvhe/pviommu-host.h>
-#include <nvhe/trace/trace.h>
+#include <nvhe/trace.h>
 #include <nvhe/trap_handler.h>

 #include <linux/irqchip/arm-gic-v3.h>
--- a/arch/arm64/kvm/hyp/nvhe/modules.c
+++ b/arch/arm64/kvm/hyp/nvhe/modules.c
@@ -14,7 +14,7 @@
 #include <nvhe/mm.h>
 #include <nvhe/serial.h>
 #include <nvhe/spinlock.h>
-#include <nvhe/trace/trace.h>
+#include <nvhe/trace.h>
 #include <nvhe/trap_handler.h>

 static void *__pkvm_module_memcpy(void *to, const void *from, size_t count)
--- a/arch/arm64/kvm/hyp/nvhe/setup.c
+++ b/arch/arm64/kvm/hyp/nvhe/setup.c
@@ -19,7 +19,7 @@
 #include <nvhe/mm.h>
 #include <nvhe/pkvm.h>
 #include <nvhe/serial.h>
-#include <nvhe/trace/trace.h>
+#include <nvhe/trace.h>
 #include <nvhe/trap_handler.h>

 unsigned long hyp_nr_cpus;
--- a/arch/arm64/kvm/hyp/nvhe/trace.c
+++ b/arch/arm64/kvm/hyp/nvhe/trace.c
@@ -8,7 +8,7 @@
 #include <nvhe/clock.h>
 #include <nvhe/mem_protect.h>
 #include <nvhe/mm.h>
-#include <nvhe/trace/trace.h>
+#include <nvhe/trace.h>

 #include <asm/percpu.h>
 #include <asm/kvm_mmu.h>
--- a/arch/x86/configs/gki_defconfig
+++ b/arch/x86/configs/gki_defconfig
@@ -100,7 +100,6 @@ CONFIG_MODVERSIONS=y
 CONFIG_GENDWARFKSYMS=y
 CONFIG_MODULE_SCMVERSION=y
 CONFIG_MODULE_SIG=y
-CONFIG_MODULE_SIG_PROTECT=y
 CONFIG_MODPROBE_PATH=""
 CONFIG_BLK_DEV_ZONED=y
 CONFIG_BLK_WBT=y
--- a/gki/README.md
+++ b/gki/README.md
@@ -11,7 +11,6 @@ gki
 |   |   |-- virtual_device
 |   |   |-- $partner
 |   |   +-- ...
-|   |-- protected_exports
 |   |-- abi.stg
 |   |-- abi.stg.allowed_breaks
 |   +-- afdo
@@ -28,9 +27,6 @@ architecture. Within each such subdirectory:
      * maintained by the partner
      * e.g. `kmi_symbol_list = "//common:gki/aarch64/symbols/acme"`
      * e.g. `tools/bazel run //modules:acme_aarch64_abi_update_symbol_list`
-* `protected_exports` - a list of symbols owned by GKI modules
-   * maintained by Kleaf
-   * e.g. `tools/bazel run //common:kernel_aarch64_abi_update_protected_exports`
 * `abi.stg` - the tracked ABI
   * maintained by Kleaf
   * e.g. `tools/bazel run //common:kernel_aarch64_abi_update`
--- a/gki/aarch64/abi.stg
+++ b/gki/aarch64/abi.stg
--- a/gki/aarch64/protected_exports
+++ b/gki/aarch64/protected_exports
@@ -1,590 +0,0 @@
-__SCK__tp_func_9p_fid_ref
-__SCK__tp_func_android_vh_rust_binder_restore_priority
-__SCK__tp_func_android_vh_rust_binder_set_priority
-__SCK__tp_func_netfs_sreq
-__hci_cmd_send
-__hci_cmd_sync
-__hci_cmd_sync_ev
-__hci_cmd_sync_sk
-__hci_cmd_sync_status
-__hci_cmd_sync_status_sk
-__kunit_abort
-__kunit_activate_static_stub
-__kunit_add_resource
-__kunit_do_failed_assertion
-__kunit_test_suites_exit
-__kunit_test_suites_init
-__nfc_alloc_vendor_cmd_reply_skb
-__regmap_init_ram
-__regmap_init_raw_ram
-__traceiter_9p_fid_ref
-__traceiter_android_vh_rust_binder_restore_priority
-__traceiter_android_vh_rust_binder_set_priority
-__traceiter_netfs_sreq
-__tracepoint_9p_fid_ref
-__tracepoint_android_vh_rust_binder_restore_priority
-__tracepoint_android_vh_rust_binder_set_priority
-__tracepoint_netfs_sreq
-__usb_serial_register_drivers
-alloc_can_err_skb
-alloc_can_skb
-alloc_candev_mqs
-alloc_canfd_skb
-alloc_canxl_skb
-arc4_crypt
-arc4_setkey
-baswap
-bt_accept_dequeue
-bt_accept_enqueue
-bt_accept_unlink
-bt_debugfs
-bt_err
-bt_err_ratelimited
-bt_info
-bt_procfs_cleanup
-bt_procfs_init
-bt_sock_alloc
-bt_sock_ioctl
-bt_sock_link
-bt_sock_linked
-bt_sock_poll
-bt_sock_reclassify_lock
-bt_sock_recvmsg
-bt_sock_register
-bt_sock_stream_recvmsg
-bt_sock_unlink
-bt_sock_unregister
-bt_sock_wait_ready
-bt_sock_wait_state
-bt_status
-bt_to_errno
-bt_warn
-bt_warn_ratelimited
-btbcm_check_bdaddr
-btbcm_finalize
-btbcm_initialize
-btbcm_patchram
-btbcm_read_pcm_int_params
-btbcm_set_bdaddr
-btbcm_setup_apple
-btbcm_setup_patchram
-btbcm_write_pcm_int_params
-can_bus_off
-can_change_mtu
-can_change_state
-can_dropped_invalid_skb
-can_eth_ioctl_hwts
-can_ethtool_op_get_ts_info_hwts
-can_fd_dlc2len
-can_fd_len2dlc
-can_free_echo_skb
-can_get_echo_skb
-can_get_state_str
-can_proto_register
-can_proto_unregister
-can_put_echo_skb
-can_rx_offload_add_fifo
-can_rx_offload_add_manual
-can_rx_offload_add_timestamp
-can_rx_offload_del
-can_rx_offload_enable
-can_rx_offload_get_echo_skb_queue_tail
-can_rx_offload_get_echo_skb_queue_timestamp
-can_rx_offload_irq_finish
-can_rx_offload_irq_offload_fifo
-can_rx_offload_irq_offload_timestamp
-can_rx_offload_queue_tail
-can_rx_offload_queue_timestamp
-can_rx_offload_threaded_irq_finish
-can_rx_register
-can_rx_unregister
-can_send
-can_skb_get_frame_len
-can_sock_destruct
-can_state_get_by_berr_counter
-cdc_ncm_bind_common
-cdc_ncm_change_mtu
-cdc_ncm_fill_tx_frame
-cdc_ncm_rx_fixup
-cdc_ncm_rx_verify_ndp16
-cdc_ncm_rx_verify_ndp32
-cdc_ncm_rx_verify_nth16
-cdc_ncm_rx_verify_nth32
-cdc_ncm_select_altsetting
-cdc_ncm_tx_fixup
-cdc_ncm_unbind
-cfg802154_device_is_child
-cfg802154_device_is_parent
-cfg802154_get_free_short_addr
-cfg802154_set_max_associations
-clk_get_kunit
-clk_hw_get_clk_kunit
-clk_hw_get_clk_prepared_enabled_kunit
-clk_hw_register_kunit
-clk_prepare_enable_kunit
-close_candev
-devm_pwrseq_device_register
-devm_pwrseq_get
-do_trace_9p_fid_get
-do_trace_9p_fid_put
-free_candev
-generic_mii_ioctl
-gnss_allocate_device
-gnss_deregister_device
-gnss_insert_raw
-gnss_put_device
-gnss_register_device
-h4_recv_buf
-hci_alloc_dev_priv
-hci_cmd_sync
-hci_cmd_sync_cancel
-hci_cmd_sync_cancel_entry
-hci_cmd_sync_cancel_sync
-hci_cmd_sync_dequeue
-hci_cmd_sync_dequeue_once
-hci_cmd_sync_lookup_entry
-hci_cmd_sync_queue
-hci_cmd_sync_queue_once
-hci_cmd_sync_run
-hci_cmd_sync_run_once
-hci_cmd_sync_status
-hci_cmd_sync_submit
-hci_conn_check_secure
-hci_conn_security
-hci_conn_switch_role
-hci_devcd_abort
-hci_devcd_append
-hci_devcd_append_pattern
-hci_devcd_complete
-hci_devcd_init
-hci_devcd_register
-hci_devcd_rx
-hci_devcd_timeout
-hci_drv_cmd_complete
-hci_drv_cmd_status
-hci_drv_process_cmd
-hci_free_dev
-hci_get_route
-hci_mgmt_chan_register
-hci_mgmt_chan_unregister
-hci_recv_diag
-hci_recv_frame
-hci_register_cb
-hci_register_dev
-hci_release_dev
-hci_reset_dev
-hci_resume_dev
-hci_set_fw_info
-hci_set_hw_info
-hci_suspend_dev
-hci_uart_register_device_priv
-hci_uart_tx_wakeup
-hci_uart_unregister_device
-hci_unregister_cb
-hci_unregister_dev
-ieee802154_alloc_hw
-ieee802154_beacon_push
-ieee802154_configure_durations
-ieee802154_free_hw
-ieee802154_hdr_peek
-ieee802154_hdr_peek_addrs
-ieee802154_hdr_pull
-ieee802154_hdr_push
-ieee802154_mac_cmd_pl_pull
-ieee802154_mac_cmd_push
-ieee802154_max_payload
-ieee802154_register_hw
-ieee802154_rx_irqsafe
-ieee802154_unregister_hw
-ieee802154_xmit_complete
-ieee802154_xmit_error
-ieee802154_xmit_hw_error
-kunit_add_action
-kunit_add_action_or_reset
-kunit_assert_prologue
-kunit_binary_assert_format
-kunit_binary_ptr_assert_format
-kunit_binary_str_assert_format
-kunit_cleanup
-kunit_deactivate_static_stub
-kunit_destroy_resource
-kunit_device_register
-kunit_device_register_with_driver
-kunit_device_unregister
-kunit_driver_create
-kunit_fail_assert_format
-kunit_init_test
-kunit_kfree
-kunit_kfree_const
-kunit_kmalloc_array
-kunit_kstrdup_const
-kunit_log_append
-kunit_mem_assert_format
-kunit_platform_device_add
-kunit_platform_device_alloc
-kunit_platform_device_prepare_wait_for_probe
-kunit_platform_driver_register
-kunit_ptr_not_err_assert_format
-kunit_release_action
-kunit_remove_action
-kunit_remove_resource
-kunit_run_tests
-kunit_suite_has_succeeded
-kunit_suite_num_test_cases
-kunit_test_case_num
-kunit_try_catch_run
-kunit_try_catch_throw
-kunit_unary_assert_format
-kunit_vm_mmap
-l2cap_add_psm
-l2cap_chan_close
-l2cap_chan_connect
-l2cap_chan_create
-l2cap_chan_del
-l2cap_chan_list
-l2cap_chan_put
-l2cap_chan_send
-l2cap_chan_set_defaults
-l2cap_conn_get
-l2cap_conn_put
-l2cap_is_socket
-l2cap_register_user
-l2cap_unregister_user
-l2tp_recv_common
-l2tp_session_create
-l2tp_session_delete
-l2tp_session_get
-l2tp_session_get_by_ifname
-l2tp_session_get_next
-l2tp_session_put
-l2tp_session_register
-l2tp_session_set_header_len
-l2tp_sk_to_tunnel
-l2tp_tunnel_create
-l2tp_tunnel_delete
-l2tp_tunnel_get
-l2tp_tunnel_get_next
-l2tp_tunnel_put
-l2tp_tunnel_register
-l2tp_udp_encap_recv
-l2tp_v2_session_get
-l2tp_v3_session_get
-l2tp_xmit_skb
-lowpan_header_compress
-lowpan_header_decompress
-lowpan_nhc_add
-lowpan_nhc_del
-lowpan_register_netdev
-lowpan_register_netdevice
-lowpan_unregister_netdev
-lowpan_unregister_netdevice
-macsec_get_real_dev
-macsec_netdev_is_offloaded
-macsec_pn_wrapped
-mii_check_gmii_support
-mii_check_link
-mii_check_media
-mii_ethtool_get_link_ksettings
-mii_ethtool_gset
-mii_ethtool_set_link_ksettings
-mii_ethtool_sset
-mii_link_ok
-mii_nway_restart
-netfs_buffered_read_iter
-netfs_buffered_write_iter_locked
-netfs_clear_inode_writeback
-netfs_dirty_folio
-netfs_end_io_direct
-netfs_end_io_read
-netfs_end_io_write
-netfs_extract_user_iter
-netfs_file_read_iter
-netfs_file_write_iter
-netfs_invalidate_folio
-netfs_limit_iter
-netfs_page_mkwrite
-netfs_perform_write
-netfs_prepare_write_failed
-netfs_read_folio
-netfs_read_subreq_progress
-netfs_read_subreq_terminated
-netfs_readahead
-netfs_release_folio
-netfs_start_io_direct
-netfs_start_io_read
-netfs_start_io_write
-netfs_unbuffered_read_iter
-netfs_unbuffered_read_iter_locked
-netfs_unbuffered_write_iter
-netfs_unbuffered_write_iter_locked
-netfs_unpin_writeback
-netfs_write_begin
-netfs_write_subrequest_terminated
-netfs_writepages
-nfc_add_se
-nfc_alloc_recv_skb
-nfc_allocate_device
-nfc_class
-nfc_dep_link_is_up
-nfc_driver_failure
-nfc_find_se
-nfc_fw_download_done
-nfc_get_local_general_bytes
-nfc_proto_register
-nfc_proto_unregister
-nfc_register_device
-nfc_remove_se
-nfc_se_connectivity
-nfc_se_transaction
-nfc_send_to_raw_sock
-nfc_set_remote_general_bytes
-nfc_target_lost
-nfc_targets_found
-nfc_tm_activated
-nfc_tm_data_received
-nfc_tm_deactivated
-nfc_unregister_device
-nfc_vendor_cmd_reply
-nl802154_beaconing_done
-nl802154_scan_done
-nl802154_scan_event
-nl802154_scan_started
-of_can_transceiver
-of_clk_get_kunit
-of_clk_hw_register_kunit
-of_node_put_kunit
-of_root_kunit_skip
-open_candev
-p9_client_attach
-p9_client_begin_disconnect
-p9_client_cb
-p9_client_clunk
-p9_client_create
-p9_client_create_dotl
-p9_client_destroy
-p9_client_disconnect
-p9_client_fcreate
-p9_client_fsync
-p9_client_getattr_dotl
-p9_client_getlock_dotl
-p9_client_link
-p9_client_lock_dotl
-p9_client_mkdir_dotl
-p9_client_mknod_dotl
-p9_client_open
-p9_client_read
-p9_client_read_once
-p9_client_readdir
-p9_client_readlink
-p9_client_remove
-p9_client_rename
-p9_client_renameat
-p9_client_setattr
-p9_client_stat
-p9_client_statfs
-p9_client_symlink
-p9_client_unlinkat
-p9_client_walk
-p9_client_write
-p9_client_write_subreq
-p9_client_wstat
-p9_client_xattrcreate
-p9_client_xattrwalk
-p9_error_init
-p9_errstr2errno
-p9_fcall_fini
-p9_is_proto_dotl
-p9_is_proto_dotu
-p9_parse_header
-p9_release_pages
-p9_req_put
-p9_show_client_options
-p9_tag_lookup
-p9dirent_read
-p9stat_free
-p9stat_read
-ppp_channel_index
-ppp_dev_name
-ppp_input
-ppp_input_error
-ppp_output_wakeup
-ppp_register_channel
-ppp_register_compressor
-ppp_register_net_channel
-ppp_unit_number
-ppp_unregister_channel
-ppp_unregister_compressor
-pppox_compat_ioctl
-pppox_ioctl
-pppox_unbind_sock
-pps_event
-pps_lookup_dev
-pps_register_source
-pps_unregister_source
-ptp_cancel_worker_sync
-ptp_clock_event
-ptp_clock_index
-ptp_clock_register
-ptp_clock_unregister
-ptp_find_pin
-ptp_find_pin_unlocked
-ptp_schedule_worker
-pwrseq_device_get_drvdata
-pwrseq_device_register
-pwrseq_device_unregister
-pwrseq_get
-pwrseq_power_off
-pwrseq_power_on
-pwrseq_put
-qca_read_soc_version
-qca_send_pre_shutdown_cmd
-qca_set_bdaddr
-qca_set_bdaddr_rome
-qca_uart_setup
-register_candev
-register_pppox_proto
-rfkill_alloc
-rfkill_blocked
-rfkill_destroy
-rfkill_find_type
-rfkill_get_led_trigger_name
-rfkill_init_sw_state
-rfkill_pause_polling
-rfkill_register
-rfkill_resume_polling
-rfkill_set_hw_state_reason
-rfkill_set_led_trigger_name
-rfkill_set_states
-rfkill_set_sw_state
-rfkill_soft_blocked
-rfkill_unregister
-rtl8152_get_version
-safe_candev_priv
-slhc_compress
-slhc_free
-slhc_init
-slhc_remember
-slhc_toss
-slhc_uncompress
-tipc_dump_done
-tipc_dump_start
-tipc_nl_sk_walk
-tipc_sk_fill_sock_diag
-unregister_candev
-unregister_pppox_proto
-usb_serial_claim_interface
-usb_serial_deregister_drivers
-usb_serial_generic_chars_in_buffer
-usb_serial_generic_close
-usb_serial_generic_get_icount
-usb_serial_generic_open
-usb_serial_generic_process_read_urb
-usb_serial_generic_read_bulk_callback
-usb_serial_generic_resume
-usb_serial_generic_submit_read_urbs
-usb_serial_generic_throttle
-usb_serial_generic_tiocmiwait
-usb_serial_generic_unthrottle
-usb_serial_generic_wait_until_sent
-usb_serial_generic_write
-usb_serial_generic_write_bulk_callback
-usb_serial_generic_write_start
-usb_serial_handle_dcd_change
-usb_serial_port_softint
-usb_serial_resume
-usb_serial_suspend
-usbnet_cdc_bind
-usbnet_cdc_status
-usbnet_cdc_unbind
-usbnet_cdc_update_filter
-usbnet_cdc_zte_rx_fixup
-usbnet_change_mtu
-usbnet_defer_kevent
-usbnet_device_suggests_idle
-usbnet_disconnect
-usbnet_ether_cdc_bind
-usbnet_generic_cdc_bind
-usbnet_get_drvinfo
-usbnet_get_endpoints
-usbnet_get_ethernet_addr
-usbnet_get_link
-usbnet_get_link_ksettings_internal
-usbnet_get_link_ksettings_mii
-usbnet_get_msglevel
-usbnet_link_change
-usbnet_manage_power
-usbnet_nway_reset
-usbnet_open
-usbnet_pause_rx
-usbnet_probe
-usbnet_purge_paused_rxq
-usbnet_read_cmd
-usbnet_read_cmd_nopm
-usbnet_resume
-usbnet_resume_rx
-usbnet_set_link_ksettings_mii
-usbnet_set_msglevel
-usbnet_set_rx_mode
-usbnet_skb_return
-usbnet_start_xmit
-usbnet_status_start
-usbnet_status_stop
-usbnet_stop
-usbnet_suspend
-usbnet_tx_timeout
-usbnet_unlink_rx_urbs
-usbnet_update_max_qlen
-usbnet_write_cmd
-usbnet_write_cmd_async
-usbnet_write_cmd_nopm
-v9fs_get_default_trans
-v9fs_get_trans_by_name
-v9fs_register_trans
-v9fs_unregister_trans
-vp_legacy_config_vector
-vp_legacy_get_driver_features
-vp_legacy_get_features
-vp_legacy_get_queue_enable
-vp_legacy_get_queue_size
-vp_legacy_get_status
-vp_legacy_probe
-vp_legacy_queue_vector
-vp_legacy_remove
-vp_legacy_set_features
-vp_legacy_set_queue_address
-vp_legacy_set_status
-vp_modern_avq_index
-vp_modern_avq_num
-vp_modern_config_vector
-vp_modern_generation
-vp_modern_get_driver_features
-vp_modern_get_features
-vp_modern_get_num_queues
-vp_modern_get_queue_enable
-vp_modern_get_queue_reset
-vp_modern_get_queue_size
-vp_modern_get_status
-vp_modern_map_vq_notify
-vp_modern_probe
-vp_modern_queue_address
-vp_modern_queue_vector
-vp_modern_remove
-vp_modern_set_features
-vp_modern_set_queue_enable
-vp_modern_set_queue_reset
-vp_modern_set_queue_size
-vp_modern_set_status
-wpan_phy_find
-wpan_phy_for_each
-wpan_phy_free
-wpan_phy_new
-wpan_phy_register
-wpan_phy_unregister
-wwan_create_port
-wwan_port_get_drvdata
-wwan_port_rx
-wwan_port_txoff
-wwan_port_txon
-wwan_register_ops
-wwan_remove_port
-wwan_unregister_ops
--- a/gki/aarch64/symbols/amlogic
+++ b/gki/aarch64/symbols/amlogic
@@ -49,6 +49,7 @@
  __bitmap_and
  __bitmap_andnot
  __bitmap_clear
+  __bitmap_complement
  __bitmap_equal
  bitmap_find_next_zero_area_off
  bitmap_free
@@ -90,6 +91,7 @@
  bpf_trace_run6
  bpf_trace_run7
  bpf_trace_run8
+  bpf_trace_run9
  bpf_warn_invalid_xdp_action
  __bread_gfp
  __brelse
@@ -301,6 +303,7 @@
  dev_alloc_name
  __dev_change_net_namespace
  dev_close
+  _dev_crit
  dev_driver_string
  _dev_err
  dev_err_probe
@@ -378,6 +381,7 @@
  devm_hwrng_register
  devm_iio_channel_get
  devm_iio_device_alloc
+  __devm_iio_device_register
  devm_input_allocate_device
  devm_ioremap
  devm_ioremap_resource
@@ -442,6 +446,7 @@
  dev_pm_domain_attach_by_id
  dev_pm_domain_attach_by_name
  dev_pm_domain_detach
+  dev_pm_genpd_set_performance_state
  dev_pm_opp_clear_config
  dev_pm_opp_find_freq_ceil
  dev_pm_opp_find_freq_exact
@@ -544,6 +549,15 @@
  __dma_sync_single_for_device
  dma_unmap_page_attrs
  dma_unmap_sg_attrs
+  dm_get_device
+  dm_io
+  dm_io_client_create
+  dm_io_client_destroy
+  dm_per_bio_data
+  dm_put_device
+  dm_register_target
+  dm_table_get_mode
+  dm_unregister_target
  d_obtain_alias
  do_SAK
  do_trace_netlink_extack
@@ -561,6 +575,8 @@
  dql_completed
  dql_reset
  drain_workqueue
+  driver_attach
+  driver_register
  driver_unregister
  drm_add_modes_noedid
  drm_atomic_add_affected_connectors
@@ -853,6 +869,7 @@
  fs_param_is_string
  fs_param_is_u32
  __fs_parse
+  fs_umode_to_dtype
  fwnode_device_is_available
  fwnode_find_reference
  fwnode_get_name
@@ -928,6 +945,7 @@
  get_fs_type
  get_net_ns_by_fd
  get_net_ns_by_pid
+  get_pfnblock_flags_mask
  get_random_bytes
  get_random_u16
  get_random_u32
@@ -945,6 +963,7 @@
  gpiochip_get_data
  gpiochip_line_is_valid
  gpiochip_lock_as_irq
+  gpiochip_remove
  gpiochip_unlock_as_irq
  gpiod_cansleep
  gpiod_count
@@ -1037,15 +1056,27 @@
  iget5_locked
  iget_failed
  ihold
+  iio_alloc_pollfunc
  iio_buffer_enabled
  iio_buffer_init
  iio_buffer_put
+  iio_dealloc_pollfunc
+  iio_device_alloc
  iio_device_attach_buffer
+  iio_device_claim_direct_mode
+  iio_device_free
+  iio_device_id
  __iio_device_register
+  iio_device_release_direct_mode
  iio_device_unregister
  iio_get_time_ns
+  iio_push_event
  iio_push_to_buffers
  iio_read_channel_processed
+  iio_read_mount_matrix
+  iio_show_mount_matrix
+  iio_trigger_notify_done
+  iio_trigger_unregister
  ilookup
  inc_nlink
  inc_zone_page_state
@@ -1137,6 +1168,7 @@
  irq_stat
  irq_to_desc
  is_bad_inode
+  is_dma_buf_file
  is_vmalloc_addr
  iter_file_splice_write
  iwe_stream_add_event
@@ -1216,6 +1248,7 @@
  kstrtou16
  kstrtou16_from_user
  kstrtou8
+  kstrtou8_from_user
  kstrtouint
  kstrtouint_from_user
  kstrtoull
@@ -1247,6 +1280,7 @@
  led_classdev_unregister
  led_init_default_state_get
  led_set_brightness
+  led_set_brightness_nosleep
  led_trigger_blink_oneshot
  led_trigger_event
  led_trigger_register
@@ -1330,6 +1364,7 @@
  __memset_io
  memstart_addr
  memunmap
+  migrate_pages
  misc_deregister
  misc_register
  __mmap_lock_do_trace_acquire_returned
@@ -1344,6 +1379,7 @@
  mmc_cqe_request_done
  mmc_detect_change
  mmc_free_host
+  mmc_get_ext_csd
  mmc_gpiod_request_cd
  mmc_gpio_get_cd
  mmc_of_parse
@@ -1483,6 +1519,7 @@
  of_get_phy_mode
  of_get_property
  of_get_regulator_init_data
+  of_get_required_opp_performance_state
  of_graph_get_remote_node
  of_graph_get_remote_port_parent
  of_graph_is_present
@@ -1528,6 +1565,7 @@
  oops_in_progress
  out_of_line_wait_on_bit_lock
  overflowgid
+  overflowuid
  pagecache_get_page
  page_get_link
  __page_pinner_failure_detect
@@ -1542,12 +1580,15 @@
  param_array_ops
  param_get_bool
  param_get_charp
+  param_get_hexint
  param_get_int
+  param_get_short
  param_get_string
  param_ops_bool
  param_ops_byte
  param_ops_charp
  param_ops_int
+  param_ops_long
  param_ops_short
  param_ops_string
  param_ops_uint
@@ -1556,6 +1597,7 @@
  param_ops_ushort
  param_set_charp
  param_set_copystring
+  param_set_hexint
  param_set_int
  pci_alloc_irq_vectors_affinity
  pci_bus_type
@@ -1759,6 +1801,7 @@
  ptp_clock_index
  ptp_clock_register
  ptp_clock_unregister
+  putback_movable_pages
  __put_cred
  put_device
  put_disk
@@ -1814,6 +1857,7 @@
  __rcu_read_unlock
  rdev_get_drvdata
  readahead_expand
+  readahead_gfp_mask
  read_cache_page
  read_cache_page_gfp
  read_sanitised_ftr_reg
@@ -1845,6 +1889,7 @@
  register_syscore_ops
  register_sysctl_sz
  register_wide_hw_breakpoint
+  regmap_bulk_read
  regmap_bulk_write
  regmap_field_read
  regmap_field_update_bits_base
@@ -2058,22 +2103,36 @@
  smpboot_register_percpu_thread
  smp_call_function
  smp_call_function_single
+  snd_card_ref
+  snd_card_register
+  snd_card_rw_proc_new
  snd_ctl_add
  snd_ctl_boolean_mono_info
  snd_ctl_enum_info
  snd_ctl_new1
+  snd_ctl_notify
+  snd_devm_card_new
  snd_dma_alloc_dir_pages
  snd_dma_free_pages
+  snd_ecards_limit
+  snd_info_get_line
+  snd_interval_refine
+  snd_pcm_format_physical_width
+  snd_pcm_format_set_silence
  snd_pcm_format_width
  snd_pcm_hw_constraint_integer
+  snd_pcm_hw_rule_add
  snd_pcm_kernel_ioctl
  snd_pcm_lib_default_mmap
  snd_pcm_lib_free_pages
  snd_pcm_lib_ioctl
  snd_pcm_lib_malloc_pages
  snd_pcm_lib_preallocate_pages
+  snd_pcm_new
  snd_pcm_period_elapsed
  snd_pcm_rate_to_rate_bit
+  snd_pcm_set_managed_buffer_all
+  snd_pcm_set_ops
  snd_pcm_stop
  snd_pcm_stop_xrun
  _snd_pcm_stream_lock_irqsave
@@ -2116,11 +2175,18 @@
  snd_soc_register_component
  snd_soc_set_runtime_hwparams
  snd_soc_unregister_component
+  snd_timer_close
+  snd_timer_instance_free
+  snd_timer_instance_new
+  snd_timer_open
+  snd_timer_start
+  snd_timer_stop
  snprintf
  __sock_create
  sock_release
  sock_wfree
  sort
+  spi_add_device
  __spi_alloc_controller
  spi_alloc_device
  spi_controller_resume
@@ -2134,6 +2200,7 @@
  __spi_register_driver
  spi_setup
  spi_sync
+  spi_unregister_device
  split_page
  sprintf
  sprint_symbol
@@ -2170,6 +2237,7 @@
  strnstr
  strpbrk
  strrchr
+  strreplace
  strsep
  strspn
  strstr
@@ -2202,6 +2270,7 @@
  sysfs_create_groups
  sysfs_create_link
  sysfs_emit
+  sysfs_emit_at
  __sysfs_match_string
  sysfs_remove_bin_file
  sysfs_remove_file_ns
@@ -2337,7 +2406,33 @@
  truncate_setsize
  try_module_get
  try_wait_for_completion
+  __tty_alloc_driver
+  tty_driver_kref_put
+  tty_encode_baud_rate
  tty_flip_buffer_push
+  tty_get_char_size
+  tty_hangup
+  tty_kref_put
+  tty_ldisc_deref
+  tty_ldisc_ref
+  tty_port_close
+  tty_port_destroy
+  tty_port_hangup
+  tty_port_init
+  tty_port_open
+  tty_port_register_device
+  tty_port_tty_get
+  tty_port_tty_wakeup
+  tty_put_char
+  tty_register_driver
+  tty_standard_install
+  tty_std_termios
+  tty_termios_baud_rate
+  tty_termios_copy_hw
+  tty_termios_hw_change
+  tty_unregister_device
+  tty_unregister_driver
+  tty_vhangup
  uart_add_one_port
  uart_console_device
  uart_console_write
@@ -2400,7 +2495,9 @@
  usb_autopm_get_interface
  usb_autopm_put_interface
  usb_bulk_msg
+  usb_clear_halt
  usb_control_msg
+  usb_control_msg_recv
  __usb_create_hcd
  usb_create_hcd
  usb_debug_root
@@ -2428,6 +2525,7 @@
  usb_get_dev
  usb_get_dr_mode
  usb_get_from_anchor
+  usb_get_intf
  usb_get_maximum_speed
  usb_get_maximum_ssp_rate
  usb_get_role_switch_default_mode
@@ -2452,9 +2550,13 @@
  usb_kill_anchored_urbs
  usb_kill_urb
  usb_lock_device_for_reset
+  usb_match_id
+  usb_match_one_id
  usb_phy_set_charger_current
+  usb_poison_urb
  usb_put_dev
  usb_put_hcd
+  usb_put_intf
  usb_register_dev
  usb_register_driver
  usb_remove_hcd
@@ -2465,13 +2567,25 @@
  usb_role_switch_unregister
  usb_root_hub_lost_power
  usb_scuttle_anchored_urbs
+  usb_serial_deregister_drivers
+  usb_serial_generic_close
+  usb_serial_generic_get_icount
+  usb_serial_generic_open
+  usb_serial_generic_resume
+  usb_serial_generic_throttle
+  usb_serial_generic_tiocmiwait
+  usb_serial_generic_unthrottle
+  usb_serial_handle_dcd_change
  usb_set_interface
  usb_sg_init
  usb_sg_wait
+  usb_show_dynids
+  usb_store_new_id
  usb_submit_urb
  usb_unanchor_urb
  usb_unlink_anchored_urbs
  usb_unlink_urb
+  usb_unpoison_urb
  usb_wakeup_notification
  __usecs_to_jiffies
  usleep_range_state
--- a/gki/aarch64/symbols/qcom
+++ b/gki/aarch64/symbols/qcom
@@ -659,6 +659,7 @@
  devm_pwm_get
  devm_qcom_smem_state_get
  devm_regmap_add_irq_chip
+  devm_regmap_add_irq_chip_fwnode
  devm_regmap_del_irq_chip
  devm_regmap_field_alloc
  devm_regmap_field_bulk_alloc
@@ -1615,8 +1616,10 @@
  irq_dispose_mapping
  __irq_domain_alloc_irqs
  irq_domain_alloc_irqs_parent
+  __irq_domain_alloc_fwnode
  irq_domain_create_hierarchy
  irq_domain_disconnect_hierarchy
+  irq_domain_free_fwnode
  irq_domain_free_irqs_common
  irq_domain_free_irqs_parent
  irq_domain_get_irq_data
@@ -1828,6 +1831,7 @@
  led_trigger_register_simple
  led_trigger_unregister
  led_trigger_unregister_simple
+  linear_range_values_in_range
  linkwatch_fire_event
  __list_add_valid_or_report
  __list_del_entry_valid_or_report
@@ -3385,6 +3389,7 @@
  __traceiter_android_vh_binder_restore_priority
  __traceiter_android_vh_binder_set_priority
  __traceiter_android_vh_build_sched_domains
+  __traceiter_android_vh_check_hibernation_swap
  __traceiter_android_vh_check_uninterruptible_tasks
  __traceiter_android_vh_check_uninterruptible_tasks_dn
  __traceiter_android_vh_cpufreq_fast_switch
@@ -3413,6 +3418,8 @@
  __traceiter_android_vh_printk_hotplug
  __traceiter_android_vh_rproc_recovery
  __traceiter_android_vh_rproc_recovery_set
+  __traceiter_android_vh_save_cpu_resume
+  __traceiter_android_vh_save_hib_resume_bdev
  __traceiter_android_vh_scheduler_tick
  __traceiter_android_vh_setscheduler_uclamp
  __traceiter_android_vh_show_resume_epoch_val
@@ -3521,6 +3528,7 @@
  __tracepoint_android_vh_binder_restore_priority
  __tracepoint_android_vh_binder_set_priority
  __tracepoint_android_vh_build_sched_domains
+  __tracepoint_android_vh_check_hibernation_swap
  __tracepoint_android_vh_check_uninterruptible_tasks
  __tracepoint_android_vh_check_uninterruptible_tasks_dn
  __tracepoint_android_vh_cpufreq_fast_switch
@@ -3549,6 +3557,8 @@
  __tracepoint_android_vh_printk_hotplug
  __tracepoint_android_vh_rproc_recovery
  __tracepoint_android_vh_rproc_recovery_set
+  __tracepoint_android_vh_save_cpu_resume
+  __tracepoint_android_vh_save_hib_resume_bdev
  __tracepoint_android_vh_scheduler_tick
  __tracepoint_android_vh_setscheduler_uclamp
  __tracepoint_android_vh_show_resume_epoch_val
--- a/gki/aarch64/symbols/rtktv
+++ b/gki/aarch64/symbols/rtktv
@@ -0,0 +1,29 @@
+[abi_symbol_list]
+  add_memory_subsection
+  cpufreq_cooling_register
+  cpufreq_cooling_unregister
+  device_pm_wait_for_dev
+  device_pm_wait_for_dev
+  device_pm_wait_for_dev
+  device_pm_wait_for_dev
+  drm_handle_vblank
+  memblock_free
+  mpi_alloc
+  mpi_cmp
+  mpi_cmp_ui
+  mpi_free
+  mpi_get_buffer
+  mpi_get_nbits
+  mpi_powm
+  mpi_read_raw_data
+  pm_schedule_suspend
+  radix_tree_gang_lookup
+  radix_tree_gang_lookup_tag
+  radix_tree_preload
+  radix_tree_preload
+  radix_tree_tag_clear
+  radix_tree_tag_get
+  radix_tree_tag_set
+  remove_memory_subsection
+  send_sig_mceerr
+  smpboot_unregister_percpu_thread
--- a/gki/aarch64/symbols/vivo
+++ b/gki/aarch64/symbols/vivo
@@ -70,6 +70,11 @@
  tcf_block_put
  tcf_classify
  timer_reduce
+  cpufreq_unregister_notifier
+  jiffies64_to_nsecs
+  profile_event_unregister
+  __irq_regs
+
  __traceiter_android_rvh_alloc_and_link_pwqs
  __traceiter_android_rvh_alloc_pages_reclaim_cycle_end
  __traceiter_android_rvh_alloc_pages_reclaim_start
@@ -163,6 +168,13 @@
  __traceiter_tcp_retransmit_skb
  __traceiter_workqueue_execute_end
  __traceiter_workqueue_execute_start
+  __traceiter_android_vh_binder_alloc_new_buf_locked
+  __traceiter_pelt_se_tp
+  __traceiter_android_vh_kvmalloc_node_use_vmalloc
+  __traceiter_android_vh_adjust_kvmalloc_flags
+  __traceiter_android_vh_alter_futex_plist_add
+  __traceiter_task_newtask
+  __traceiter_android_vh_mutex_init
  __tracepoint_android_rvh_alloc_and_link_pwqs
  __tracepoint_android_rvh_alloc_pages_reclaim_cycle_end
  __tracepoint_android_rvh_alloc_pages_reclaim_start
@@ -256,6 +268,13 @@
  __tracepoint_tcp_retransmit_skb
  __tracepoint_workqueue_execute_end
  __tracepoint_workqueue_execute_start
+  __tracepoint_android_vh_binder_alloc_new_buf_locked
+  __tracepoint_pelt_se_tp
+  __tracepoint_android_vh_kvmalloc_node_use_vmalloc
+  __tracepoint_android_vh_adjust_kvmalloc_flags
+  __tracepoint_android_vh_alter_futex_plist_add
+  __tracepoint_task_newtask
+  __tracepoint_android_vh_mutex_init
  ucsi_send_command
  unlock_buffer
  __wait_on_buffer
--- a/include/linux/memory_hotplug.h
+++ b/include/linux/memory_hotplug.h
@@ -282,6 +282,7 @@ extern void try_offline_node(int nid);
 extern int offline_pages(unsigned long start_pfn, unsigned long nr_pages,
 			 struct zone *zone, struct memory_group *group);
 extern int remove_memory(u64 start, u64 size);
+extern int remove_memory_subsection(u64 start, u64 size);
 extern void __remove_memory(u64 start, u64 size);
 extern int offline_and_remove_memory(u64 start, u64 size);

@@ -306,6 +307,7 @@ static inline void __remove_memory(u64 start, u64 size) {}
 extern void __ref free_area_init_core_hotplug(struct pglist_data *pgdat);
 extern int __add_memory(int nid, u64 start, u64 size, mhp_t mhp_flags);
 extern int add_memory(int nid, u64 start, u64 size, mhp_t mhp_flags);
+extern int add_memory_subsection(int nid, u64 start, u64 size);
 extern int add_memory_resource(int nid, struct resource *resource,
 			       mhp_t mhp_flags);
 extern int add_memory_driver_managed(int nid, u64 start, u64 size,
--- a/kernel/.gitignore
+++ b/kernel/.gitignore
@@ -1,5 +1,3 @@
 # SPDX-License-Identifier: GPL-2.0-only
 /config_data
 /kheaders.md5
-/gki_module_exported.h
-/gki_module_protected.h
--- a/kernel/module/Kconfig
+++ b/kernel/module/Kconfig
@@ -286,19 +286,6 @@ config MODULE_SIG_FORCE
 	  Reject unsigned modules or signed modules for which we don't have a
 	  key.  Without this, such modules will simply taint the kernel.

-config MODULE_SIG_PROTECT
-	bool "Android GKI module protection"
-	depends on MODULE_SIG && !MODULE_SIG_FORCE
-	help
-	  Enables Android GKI symbol and export protection support.
-
-	  This modifies the behavior of the MODULE_SIG_FORCE as follows:
-	  - Allows Android GKI Modules signed using MODULE_SIG_ALL during build.
-	  - Allows other modules to load if they don't violate the access to
-	    Android GKI protected symbols and do not export the symbols already
-	    exported by the Android GKI modules. Loading will fail and return
-	    -EACCES (Permission denied) if symbol access conditions are not met.
-
 config MODULE_SIG_ALL
 	bool "Automatically sign all modules"
 	default y
@@ -310,6 +297,24 @@ config MODULE_SIG_ALL
 comment "Do not forget to sign required modules with scripts/sign-file"
 	depends on MODULE_SIG_FORCE && !MODULE_SIG_ALL

+config MODULE_SIG_PROTECT_LIST
+	string "File with signed module names whose exports are to be protected"
+	default ""
+	depends on MODULE_SIG && !MODULE_SIG_FORCE
+	help
+	  Enables symbol export protection support for the listed signed
+	  modules. This option prevents unsigned modules from exporting symbols
+	  which are exported by the listed modules. Any unsigned module which
+	  tries to export such a symbol will fail to load.
+
+	  The value to set here is the path to a text file in the source
+	  directory containing the list of module names, one per line. The path
+	  can be absolute, or relative to the kernel source or obj tree.
+
+config MODULE_SIG_PROTECT
+	def_bool y
+	depends on MODULE_SIG_PROTECT_LIST != ""
+
 choice
 	prompt "Hash algorithm to sign modules"
 	depends on MODULE_SIG || IMA_APPRAISE_MODSIG
--- a/kernel/module/Makefile
+++ b/kernel/module/Makefile
@@ -13,7 +13,6 @@ obj-y += kmod.o
 obj-$(CONFIG_MODULE_DEBUG_AUTOLOAD_DUPS) += dups.o
 obj-$(CONFIG_MODULE_DECOMPRESS) += decompress.o
 obj-$(CONFIG_MODULE_SIG) += signing.o
-obj-$(CONFIG_MODULE_SIG_PROTECT) += gki_module.o
 obj-$(CONFIG_LIVEPATCH) += livepatch.o
 obj-$(CONFIG_MODULES_TREE_LOOKUP) += tree_lookup.o
 obj-$(CONFIG_DEBUG_KMEMLEAK) += debug_kmemleak.o
@@ -24,36 +23,3 @@ obj-$(CONFIG_KGDB_KDB) += kdb.o
 obj-$(CONFIG_MODVERSIONS) += version.o
 obj-$(CONFIG_MODULE_UNLOAD_TAINT_TRACKING) += tracking.o
 obj-$(CONFIG_MODULE_STATS) += stats.o
-
-#
-# ANDROID: GKI: Generate headerfiles required for gki_module.o
-#
-# Dependencies on generated files need to be listed explicitly
-$(obj)/gki_module.o: include/generated/gki_module_protected_exports.h \
-			include/generated/gki_module_unprotected.h
-
-ifneq ($(CONFIG_UNUSED_KSYMS_WHITELIST),)
-ALL_KMI_SYMBOLS := $(CONFIG_UNUSED_KSYMS_WHITELIST)
-else
-ALL_KMI_SYMBOLS := include/config/abi_gki_kmi_symbols
-$(ALL_KMI_SYMBOLS):
-	: > $@
-endif
-
-include/generated/gki_module_unprotected.h: $(ALL_KMI_SYMBOLS) \
-				$(srctree)/scripts/gen_gki_modules_headers.sh
-	$(Q)$(CONFIG_SHELL) $(srctree)/scripts/gen_gki_modules_headers.sh $@ \
-	"$(srctree)" \
-	$(ALL_KMI_SYMBOLS)
-
-# AARCH is the same as ARCH, except that arm64 becomes aarch64
-AARCH := $(if $(filter arm64,$(ARCH)),aarch64,$(ARCH))
-
-# ABI protected exports list file specific to ARCH if exists else empty
-ABI_PROTECTED_EXPORTS_FILE := $(wildcard $(srctree)/gki/$(AARCH)/protected_exports)
-
-include/generated/gki_module_protected_exports.h: $(ABI_PROTECTED_EXPORTS_FILE) \
-				$(srctree)/scripts/gen_gki_modules_headers.sh
-	$(Q)$(CONFIG_SHELL) $(srctree)/scripts/gen_gki_modules_headers.sh $@ \
-	"$(srctree)" \
-	$(ABI_PROTECTED_EXPORTS_FILE)
--- a/kernel/module/gki_module.c
+++ b/kernel/module/gki_module.c
@@ -1,70 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0-only
-/*
- * Copyright 2022 Google LLC
- * Author: ramjiyani@google.com (Ramji Jiyani)
- */
-
-#include <linux/bsearch.h>
-#include <linux/errno.h>
-#include <linux/kernel.h>
-#include <linux/printk.h>
-#include <linux/string.h>
-
-#include "internal.h"
-
-/*
- * Build time generated header files
- *
- * gki_module_protected_exports.h -- Symbols protected from _export_ by unsigned modules
- * gki_module_unprotected.h -- Symbols allowed to _access_ by unsigned modules
- */
-#include <generated/gki_module_protected_exports.h>
-#include <generated/gki_module_unprotected.h>
-
-#define MAX_STRCMP_LEN (max(MAX_UNPROTECTED_NAME_LEN, MAX_PROTECTED_EXPORTS_NAME_LEN))
-
-/* bsearch() comparision callback */
-static int gki_cmp_name(const void *sym, const void *protected_sym)
-{
-	return strncmp(sym, protected_sym, MAX_STRCMP_LEN);
-}
-
-/**
- * gki_is_module_protected_export - Is a symbol exported from a protected GKI module?
- *
- * @name:	Symbol being checked against exported symbols from protected GKI modules
- */
-bool gki_is_module_protected_export(const char *name)
-{
-	if (NR_UNPROTECTED_SYMBOLS) {
-		return bsearch(name, gki_protected_exports_symbols, NR_PROTECTED_EXPORTS_SYMBOLS,
-		       MAX_PROTECTED_EXPORTS_NAME_LEN, gki_cmp_name) != NULL;
-	} else {
-		/*
-		 * If there are no symbols in unprotected list; We don't need to
-		 * protect exports as there is no KMI enforcement.
-		 * Treat everything exportable in this case.
-		 */
-		return false;
-	}
-}
-
-/**
- * gki_is_module_unprotected_symbol - Is a symbol unprotected for unsigned module?
- *
- * @name:	Symbol being checked in list of unprotected symbols
- */
-bool gki_is_module_unprotected_symbol(const char *name)
-{
-	if (NR_UNPROTECTED_SYMBOLS) {
-		return bsearch(name, gki_unprotected_symbols, NR_UNPROTECTED_SYMBOLS,
-				MAX_UNPROTECTED_NAME_LEN, gki_cmp_name) != NULL;
-	} else {
-		/*
-		 * If there are no symbols in unprotected list;
-		 * there isn't a KMI enforcement for the kernel.
-		 * Treat everything accessible in this case.
-		 */
-		return true;
-	}
-}
--- a/kernel/module/internal.h
+++ b/kernel/module/internal.h
@@ -422,15 +422,17 @@ static inline int same_magic(const char *amagic, const char *bmagic, bool has_cr
 #endif /* CONFIG_MODVERSIONS */

 #ifdef CONFIG_MODULE_SIG_PROTECT
-extern bool gki_is_module_unprotected_symbol(const char *name);
-extern bool gki_is_module_protected_export(const char *name);
+extern const char *const protected_symbol_exports[];
+extern size_t protected_symbol_exports_count;
 #else
-static inline bool gki_is_module_unprotected_symbol(const char *name)
-{
-	return true;
-}
-static inline bool gki_is_module_protected_export(const char *name)
-{
-	return false;
-}
-#endif /* CONFIG_MODULE_SIG_PROTECT */
+#define protected_symbol_exports NULL
+#define protected_symbol_exports_count 0UL
+#endif
+
+#ifdef CONFIG_TRIM_UNUSED_KSYMS
+extern const char *const permitted_symbol_imports[];
+extern size_t permitted_symbol_imports_count;
+#else
+#define permitted_symbol_imports NULL
+#define permitted_symbol_imports_count 0UL
+#endif
--- a/kernel/module/main.c
+++ b/kernel/module/main.c
@@ -90,6 +90,13 @@ struct symsearch {
 	enum mod_license license;
 };

+#if defined(CONFIG_MODULE_SIG_PROTECT) || defined(CONFIG_TRIM_UNUSED_KSYMS)
+static int cmp_string(const void *a, const void *b)
+{
+	return strcmp((const char *)a, *(const char **)b);
+}
+#endif
+
 /*
 * Bounds of module memory, for speeding up __module_address.
 * Protected by module_mutex.
@@ -1141,14 +1148,25 @@ static bool inherit_taint(struct module *mod, struct module *owner, const char *
 	return true;
 }

+#ifdef CONFIG_TRIM_UNUSED_KSYMS
+static bool is_permitted_symbol_import(const char *name)
+{
+	return bsearch(name, permitted_symbol_imports,
+		       permitted_symbol_imports_count,
+		       sizeof(const char *), cmp_string) != NULL;
+}
+#endif
+
 /* Resolve a symbol for this module.  I.e. if we find one, record usage. */
 static const struct kernel_symbol *resolve_symbol(struct module *mod,
 						  const struct load_info *info,
 						  const char *name,
 						  char ownername[])
 {
+#ifdef CONFIG_TRIM_UNUSED_KSYMS
 	bool is_vendor_module;
 	bool is_vendor_exported_symbol;
+#endif
 	struct find_symbol_arg fsa = {
 		.name	= name,
 		.gplok	= !(mod->taints & (1 << TAINT_PROPRIETARY_MODULE)),
@@ -1191,17 +1209,19 @@ static const struct kernel_symbol *resolve_symbol(struct module *mod,
 	 * Vendor (i.e., unsigned) modules are only permitted to use:
 	 *
 	 * 1. symbols exported by other vendor (unsigned) modules
-	 * 2. unprotected symbols
+	 * 2. symbols which are permitted explicitly
 	 */
+#ifdef CONFIG_TRIM_UNUSED_KSYMS
 	is_vendor_module = !mod->sig_ok;
 	is_vendor_exported_symbol = fsa.owner && !fsa.owner->sig_ok;

 	if (is_vendor_module &&
 	    !is_vendor_exported_symbol &&
-	    !gki_is_module_unprotected_symbol(name)) {
+	    !is_permitted_symbol_import(name)) {
 		fsa.sym = ERR_PTR(-EACCES);
 		goto getname;
 	}
+#endif

 	err = ref_module(mod, fsa.owner);
 	if (err) {
@@ -1380,6 +1400,15 @@ fail:
 }
 EXPORT_SYMBOL_GPL(__symbol_get);

+#ifdef CONFIG_MODULE_SIG_PROTECT
+static bool is_protected_symbol_export(const char *name)
+{
+	return bsearch(name, protected_symbol_exports,
+		       protected_symbol_exports_count,
+		       sizeof(const char *), cmp_string) != NULL;
+}
+#endif
+
 /*
 * Ensure that an exported symbol [global namespace] does not already exist
 * in the kernel or in some other module's exported symbol table.
@@ -1404,14 +1433,6 @@ static int verify_exported_symbols(struct module *mod)
 				.name	= kernel_symbol_name(s),
 				.gplok	= true,
 			};
-
-			if (!mod->sig_ok && gki_is_module_protected_export(
-						kernel_symbol_name(s))) {
-				pr_err("%s: exports protected symbol %s\n",
-				       mod->name, kernel_symbol_name(s));
-				return -EACCES;
-			}
-
 			if (find_symbol(&fsa)) {
 				pr_err("%s: exports duplicate symbol %s"
 				       " (owned by %s)\n",
@@ -1419,6 +1440,13 @@ static int verify_exported_symbols(struct module *mod)
 				       module_name(fsa.owner));
 				return -ENOEXEC;
 			}
+#ifdef CONFIG_MODULE_SIG_PROTECT
+			if (!mod->sig_ok && is_protected_symbol_export(kernel_symbol_name(s))) {
+				pr_err("%s: exports protected symbol %s\n",
+				       mod->name, kernel_symbol_name(s));
+				return -EACCES;
+			}
+#endif
 		}
 	}
 	return 0;
--- a/kernel/module/signing.c
+++ b/kernel/module/signing.c
@@ -19,20 +19,8 @@
 #undef MODULE_PARAM_PREFIX
 #define MODULE_PARAM_PREFIX "module."

-/*
- * ANDROID: GKI:
- * Only enforce signature if SIG_PROTECT is not set
- */
-#ifndef CONFIG_MODULE_SIG_PROTECT
 static bool sig_enforce = IS_ENABLED(CONFIG_MODULE_SIG_FORCE);
 module_param(sig_enforce, bool_enable_only, 0644);
-void set_module_sig_enforced(void)
-{
-	sig_enforce = true;
-}
-#else
-#define sig_enforce false
-#endif

 /*
 * Export sig_enforce kernel cmdline parameter to allow other subsystems rely
@@ -44,6 +32,11 @@ bool is_module_sig_enforced(void)
 }
 EXPORT_SYMBOL(is_module_sig_enforced);

+void set_module_sig_enforced(void)
+{
+	sig_enforce = true;
+}
+
 /*
 * Verify the signature on a module.
 */
@@ -128,13 +121,5 @@ int module_sig_check(struct load_info *info, int flags)
 		return -EKEYREJECTED;
 	}

-/*
- * ANDROID: GKI: Do not prevent loading of unsigned modules;
- * as all modules except GKI modules are not signed.
- */
-#ifndef CONFIG_MODULE_SIG_PROTECT
 	return security_locked_down(LOCKDOWN_MODULE_SIGNATURE);
-#else
-	return 0;
-#endif
 }
--- a/mm/memblock.c
+++ b/mm/memblock.c
@@ -924,6 +924,9 @@ int __init_memblock memblock_phys_free(phys_addr_t base, phys_addr_t size)
 	kmemleak_free_part_phys(base, size);
 	return memblock_remove_range(&memblock.reserved, base, size);
 }
+#ifdef CONFIG_ARCH_KEEP_MEMBLOCK
+EXPORT_SYMBOL_GPL(memblock_free);
+#endif

 int __init_memblock memblock_reserve(phys_addr_t base, phys_addr_t size)
 {
--- a/mm/memory_hotplug.c
+++ b/mm/memory_hotplug.c
@@ -1607,6 +1607,46 @@ int add_memory(int nid, u64 start, u64 size, mhp_t mhp_flags)
 }
 EXPORT_SYMBOL_GPL(add_memory);

+int add_memory_subsection(int nid, u64 start, u64 size)
+{
+	struct mhp_params params = { .pgprot = PAGE_KERNEL };
+	struct resource *res;
+	int ret;
+
+	if (size == memory_block_size_bytes())
+		return add_memory(nid, start, size, MHP_NONE);
+
+	if (!IS_ALIGNED(start, SUBSECTION_SIZE) ||
+	    !IS_ALIGNED(size, SUBSECTION_SIZE)) {
+		pr_err("%s: start 0x%llx size 0x%llx not aligned to subsection size\n",
+			   __func__, start, size);
+		return -EINVAL;
+	}
+
+	res = register_memory_resource(start, size, "System RAM");
+	if (IS_ERR(res))
+		return PTR_ERR(res);
+
+	mem_hotplug_begin();
+
+	nid = memory_add_physaddr_to_nid(start);
+
+	if (IS_ENABLED(CONFIG_ARCH_KEEP_MEMBLOCK))
+		memblock_add_node(start, size, nid, MEMBLOCK_NONE);
+
+	ret = arch_add_memory(nid, start, size, &params);
+	if (ret) {
+		if (IS_ENABLED(CONFIG_ARCH_KEEP_MEMBLOCK))
+			memblock_remove(start, size);
+		pr_err("%s failed to add subsection start 0x%llx size 0x%llx\n",
+			   __func__, start, size);
+	}
+	mem_hotplug_done();
+
+	return ret;
+}
+EXPORT_SYMBOL_GPL(add_memory_subsection);
+
 /*
 * Add special, driver-managed memory to the system as system RAM. Such
 * memory is not exposed via the raw firmware-provided memmap as system
@@ -2319,6 +2359,40 @@ int remove_memory(u64 start, u64 size)
 }
 EXPORT_SYMBOL_GPL(remove_memory);

+int remove_memory_subsection(u64 start, u64 size)
+{
+	if (size ==  memory_block_size_bytes())
+		return remove_memory(start, size);
+
+	if (!IS_ALIGNED(start, SUBSECTION_SIZE) ||
+	    !IS_ALIGNED(size, SUBSECTION_SIZE)) {
+		pr_err("%s: start 0x%llx size 0x%llx not aligned to subsection size\n",
+			   __func__, start, size);
+		return -EINVAL;
+	}
+
+	mem_hotplug_begin();
+
+	if (test_pages_isolated(start, start + size, MEMORY_OFFLINE)) {
+		pr_err("%s: [%llx, %llx) PFNs are not isolated\n",
+			   __func__, start, start + size);
+		mem_hotplug_done();
+		return -EBUSY;
+	}
+
+	arch_remove_memory(start, size, NULL);
+
+	if (IS_ENABLED(CONFIG_ARCH_KEEP_MEMBLOCK))
+		memblock_remove(start, size);
+
+	release_mem_region_adjustable(start, size);
+
+	mem_hotplug_done();
+
+	return 0;
+}
+EXPORT_SYMBOL_GPL(remove_memory_subsection);
+
 static int try_offline_memory_block(struct memory_block *mem, void *arg)
 {
 	uint8_t online_type = MMOP_ONLINE_KERNEL;
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -617,6 +617,9 @@ static inline unsigned int order_to_pindex(int migratetype, int order)
 		VM_BUG_ON(order != HPAGE_PMD_ORDER);

 		movable = migratetype == MIGRATE_MOVABLE;
+#ifdef CONFIG_CMA
+		movable |= migratetype == MIGRATE_CMA;
+#endif

 		return NR_LOWORDER_PCP_LISTS + movable;
 	}
@@ -5115,7 +5118,7 @@ EXPORT_SYMBOL_GPL(alloc_pages_bulk_noprof);
 struct page *__alloc_pages_noprof(gfp_t gfp, unsigned int order,
 				      int preferred_nid, nodemask_t *nodemask)
 {
-	struct page *page;
+	struct page *page = NULL;
 	unsigned int alloc_flags = ALLOC_WMARK_LOW;
 	gfp_t alloc_gfp; /* The gfp_t that was actually used for allocation */
 	struct alloc_context ac = { };
--- a/modules.bzl
+++ b/modules.bzl
@@ -6,7 +6,6 @@ This module contains a full list of kernel modules
 compiled by GKI.
 """

-# LINT.IfChange
 _COMMON_GKI_MODULES_LIST = [
    # keep sorted
    "drivers/block/virtio_blk.ko",
@@ -104,7 +103,6 @@ _ARM64_GKI_MODULES_LIST = [
    "drivers/misc/open-dice.ko",
    "drivers/ptp/ptp_kvm.ko",
 ]
-# LINT.ThenChange(gki/aarch64/protected_exports)

 _X86_GKI_MODULES_LIST = [
    # keep sorted
@@ -205,12 +203,10 @@ def get_kunit_modules_list(arch = None):

    return kunit_modules_list

-# LINT.IfChange
 _COMMON_UNPROTECTED_MODULES_LIST = [
    "drivers/block/zram/zram.ko",
    "mm/zsmalloc.ko",
 ]
-# LINT.ThenChange(gki/aarch64/protected_exports)

 # buildifier: disable=unnamed-macro
 def get_gki_protected_modules_list(arch = None):
--- a/scripts/Makefile.modpost
+++ b/scripts/Makefile.modpost
@@ -198,6 +198,13 @@ modpost-args += -e $(addprefix -i , $(KBUILD_EXTRA_SYMBOLS))

 endif # ($(KBUILD_EXTMOD),)

+ifdef CONFIG_MODULE_SIG_PROTECT
+mod-protect-list := $(CONFIG_MODULE_SIG_PROTECT_LIST)
+mod-protect-list := $(if $(filter-out /%, $(mod-protect-list)),$(if $(wildcard $(mod-protect-list)),,$(srctree)/))$(mod-protect-list)
+modpost-args += $(addprefix -p , $(mod-protect-list))
+modpost-deps += $(mod-protect-list)
+endif
+
 quiet_cmd_modpost = MODPOST $@
      cmd_modpost = \
 	$(if $(missing-input), \
--- a/scripts/Makefile.vmlinux
+++ b/scripts/Makefile.vmlinux
@@ -20,6 +20,17 @@ quiet_cmd_cc_o_c = CC      $@
 ifdef CONFIG_MODULES
 targets += .vmlinux.export.o
 vmlinux: .vmlinux.export.o
+
+ifdef CONFIG_MODULE_SIG_PROTECT
+targets += .vmlinux.protected-exports.o
+vmlinux: .vmlinux.protected-exports.o
+endif
+
+ifdef CONFIG_TRIM_UNUSED_KSYMS
+targets += .vmlinux.permitted-imports.o
+vmlinux: .vmlinux.permitted-imports.o
+endif
+
 endif

 ARCH_POSTLINK := $(wildcard $(srctree)/arch/$(SRCARCH)/Makefile.postlink)
--- a/scripts/gen_gki_modules_headers.sh
+++ b/scripts/gen_gki_modules_headers.sh
@@ -1,123 +0,0 @@
-#!/bin/bash
-# SPDX-License-Identifier: GPL-2.0-only
-#
-# Copyright 2022 Google LLC
-# Author: ramjiyani@google.com (Ramji Jiyani)
-#
-
-#
-# Generates header file with list of unprotected symbols
-#
-# Called By: KERNEL_SRC/kernel/Makefile if CONFIG_MODULE_SIG_PROTECT=y
-#
-# gki_module_unprotected.h: Symbols allowed to _access_ by unsigned modules
-#
-# If valid symbol file doesn't exists then still generates valid C header files for
-# compilation to proceed with no symbols to protect
-#
-
-# Collect arguments from Makefile
-TARGET=$1
-SRCTREE=$2
-SYMBOL_LIST=$3
-
-set -e
-
-#
-# Common Definitions
-#
-# Use "make V=1" to debug this script.
-case "$KBUILD_VERBOSE" in
-*1*)
-	set -x
-	;;
-esac
-
-#
-# generate_header():
-# Args: $1 = Name of the header file
-#       $2 = Input symbol list
-#       $3 = Symbol type ("unprotected")
-#
-generate_header() {
-	local header_file=$1
-	local symbol_file=$2
-	local symbol_type=$3
-
-	if [ -f "${header_file}" ]; then
-		rm -f -- "${header_file}"
-	fi
-
-	# If symbol_file exist preprocess it and find maximum name length
-	if [  -s "${symbol_file}" ]; then
-		# Remove any trailing CR, leading / trailing whitespace,
-		# line comments, empty lines and symbol list markers.
-		sed -i '
-			s/\r$//
-			s/^[[:space:]]*//
-			s/[[:space:]]*$//
-			/^#/d
-			/^$/d
-			/^\[abi_symbol_list\]$/d
-		' "${symbol_file}"
-
-		# Sort in byte order for kernel binary search at runtime
-		LC_ALL=C sort -u -o "${symbol_file}" "${symbol_file}"
-
-		# Trim white spaces & +1 for null termination
-		local max_name_len=$(awk '
-				{
-					$1=$1;
-					if ( length > L ) {
-						L=length
-					}
-				} END { print ++L }' "${symbol_file}")
-	else
-		# Set to 1 to generate valid C header file
-		local max_name_len=1
-	fi
-
-	# Header generation
-	cat > "${header_file}" <<- EOT
-	/*
-	 * DO NOT EDIT
-	 *
-	 * Build generated header file with ${symbol_type}
-	 */
-
-	#define NR_$(printf ${symbol_type} | tr [:lower:] [:upper:])_SYMBOLS \\
-	$(printf '\t')(ARRAY_SIZE(gki_${symbol_type}_symbols))
-	#define MAX_$(printf ${symbol_type} | tr [:lower:] [:upper:])_NAME_LEN (${max_name_len})
-
-	static const char gki_${symbol_type}_symbols[][MAX_$(printf ${symbol_type} |
-							tr [:lower:] [:upper:])_NAME_LEN] = {
-	EOT
-
-	# If a valid symbol_file present add symbols in an array except the 1st line
-	if [  -s "${symbol_file}" ]; then
-		sed -e 's/^[ \t]*/\t"/;s/[ \t]*$/",/' "${symbol_file}" >> "${header_file}"
-	fi
-
-	# Terminate the file
-	echo "};" >> "${header_file}"
-}
-
-if [ "$(basename "${TARGET}")" = "gki_module_unprotected.h" ]; then
-	# Union of vendor symbol lists
-	GKI_VENDOR_SYMBOLS="${SYMBOL_LIST}"
-	generate_header "${TARGET}" "${GKI_VENDOR_SYMBOLS}" "unprotected"
-else
-	# Sorted list of exported symbols
-	GKI_EXPORTED_SYMBOLS="include/config/abi_gki_protected_exports"
-
-	if [ -z "${SYMBOL_LIST}" ]; then
-		# Create empty list if ARCH doesn't have protected exports
-		touch "${GKI_EXPORTED_SYMBOLS}"
-	else
-		# Make a temp copy to avoid changing source during pre-processing
-		cp -f "${SYMBOL_LIST}" "${GKI_EXPORTED_SYMBOLS}"
-	fi
-
-	generate_header "${TARGET}" "${GKI_EXPORTED_SYMBOLS}" "protected_exports"
-fi
-
--- a/scripts/link-vmlinux.sh
+++ b/scripts/link-vmlinux.sh
@@ -70,6 +70,12 @@ vmlinux_link()

 	if is_enabled CONFIG_MODULES; then
 		objs="${objs} .vmlinux.export.o"
+		if is_enabled CONFIG_MODULE_SIG_PROTECT; then
+			objs="${objs} .vmlinux.protected-exports.o"
+		fi
+		if is_enabled CONFIG_TRIM_UNUSED_KSYMS; then
+			objs="${objs} .vmlinux.permitted-imports.o"
+		fi
 	fi

 	objs="${objs} init/version-timestamp.o"
--- a/scripts/mod/modpost.c
+++ b/scripts/mod/modpost.c
@@ -20,6 +20,7 @@
 #include <limits.h>
 #include <stdbool.h>
 #include <errno.h>
+#include <stdlib.h>

 #include <hashtable.h>
 #include <list.h>
@@ -60,6 +61,9 @@ static bool extra_warn;
 bool target_is_big_endian;
 bool host_is_big_endian;

+static unsigned int nr_module_exported_symbols;
+static unsigned int nr_white_list_symbols;
+
 /*
 * Cut off the warnings when there are too many. This typically occurs when
 * vmlinux is missing. ('make modules' without building vmlinux.)
@@ -99,6 +103,11 @@ static inline bool strends(const char *str, const char *postfix)
 	return strcmp(str + strlen(str) - strlen(postfix), postfix) == 0;
 }

+static int symbol_cmp(const void *a, const void *b)
+{
+	return strcmp(*(const char **)a, *(const char **)b);
+}
+
 char *read_text_file(const char *filename)
 {
 	struct stat st;
@@ -365,6 +374,9 @@ static struct symbol *sym_add_exported(const char *name, struct module *mod,
 	s->namespace = xstrdup(namespace);
 	list_add_tail(&s->list, &mod->exported_symbols);
 	hash_add_symbol(s);
+	if (!mod->is_vmlinux && !mod->from_dump) {
+		++nr_module_exported_symbols;
+	}

 	return s;
 }
@@ -1726,18 +1738,29 @@ static void check_exports(struct module *mod)
 	}
 }

-static void handle_white_list_exports(const char *white_list)
+struct permitted_symbol {
+	struct list_head list;
+	const char *name;
+};
+
+static void handle_white_list_exports(const char *white_list,
+				      struct list_head *permitted_symbols)
 {
 	char *buf, *p, *name;
-
+	struct permitted_symbol *ps;
 	buf = read_text_file(white_list);
 	p = buf;

 	while ((name = strsep(&p, "\n"))) {
 		struct symbol *sym = find_symbol(name);

-		if (sym)
+		if (sym) {
 			sym->used = true;
+			ps = xmalloc(sizeof(*ps));
+			ps->name = sym->name;
+			list_add_tail(&ps->list, permitted_symbols);
+			++nr_white_list_symbols;
+		}
 	}

 	free(buf);
@@ -2179,17 +2202,90 @@ static void check_host_endian(void)
 	}
 }

+static void handle_protected_modules_list(const char *fname)
+{
+	char *buf, *p, *name;
+
+	buf = read_text_file(fname);
+	p = buf;
+
+	while ((name = strsep(&p, "\n"))) {
+		struct module *mod = find_module(name);
+
+		if (mod)
+			mod->is_protected = true;
+	}
+
+	free(buf);
+}
+
+static void write_protected_exports_c_file(void)
+{
+	const char* symbols[nr_module_exported_symbols];
+	unsigned int symbols_size = 0;
+	unsigned int i;
+	struct module *mod;
+	struct symbol *sym;
+	struct buffer buf = {};
+
+	list_for_each_entry(mod, &modules, list) {
+		if (mod->is_vmlinux || mod->from_dump || !mod->is_protected)
+			continue;
+
+		list_for_each_entry(sym, &mod->exported_symbols, list) {
+			symbols[symbols_size++] = sym->name;
+		}
+	}
+	qsort(symbols, symbols_size, sizeof(const char*), symbol_cmp);
+
+	buf_printf(&buf, "#include \"../kernel/module/internal.h\"\n\n");
+	buf_printf(&buf, "size_t protected_symbol_exports_count = %d;\n\n", symbols_size);
+	buf_printf(&buf, "const char *const protected_symbol_exports[] = {\n");
+	for (i=0; i<symbols_size; ++i) {
+		buf_printf(&buf, "\t\"%s\",\n", symbols[i]);
+	}
+	buf_printf(&buf, "};\n");
+	write_if_changed(&buf, ".vmlinux.protected-exports.c");
+	free(buf.p);
+}
+
+static void write_permitted_imports_c_file(struct list_head *permitted_symbols)
+{
+	struct permitted_symbol *ps, *ps2;
+	const char *symbols[nr_white_list_symbols];
+	unsigned int i = 0;
+	struct buffer buf = {};
+
+	list_for_each_entry_safe(ps, ps2, permitted_symbols, list) {
+		symbols[i++] = ps->name;
+		list_del(&ps->list);
+		free(ps);
+	}
+	qsort(symbols, nr_white_list_symbols, sizeof(const char *), symbol_cmp);
+
+	buf_printf(&buf, "#include \"../kernel/module/internal.h\"\n\n");
+	buf_printf(&buf, "size_t permitted_symbol_imports_count = %d;\n\n", nr_white_list_symbols);
+	buf_printf(&buf, "const char *const permitted_symbol_imports[] = {\n");
+	for (i=0; i<nr_white_list_symbols; ++i) {
+		buf_printf(&buf, "\t\"%s\",\n", symbols[i]);
+	}
+	buf_printf(&buf, "};\n");
+	write_if_changed(&buf, ".vmlinux.permitted-imports.c");
+	free(buf.p);
+}
+
 int main(int argc, char **argv)
 {
 	struct module *mod;
 	char *missing_namespace_deps = NULL;
 	char *unused_exports_white_list = NULL;
+	char *protected_modules_list = NULL;
 	char *dump_write = NULL, *files_source = NULL;
 	int opt;
 	LIST_HEAD(dump_lists);
 	struct dump_list *dl, *dl2;

-	while ((opt = getopt(argc, argv, "ei:MmnT:to:au:WwENd:v:xb")) != -1) {
+	while ((opt = getopt(argc, argv, "ei:MmnT:to:au:WwENd:v:xbp:")) != -1) {
 		switch (opt) {
 		case 'e':
 			external_module = true;
@@ -2247,6 +2343,9 @@ int main(int argc, char **argv)
 		case 'x':
 			extended_modversions = true;
 			break;
+		case 'p':
+			protected_modules_list = optarg;
+			break;
 		default:
 			exit(1);
 		}
@@ -2274,8 +2373,13 @@ int main(int argc, char **argv)
 		check_exports(mod);
 	}

-	if (unused_exports_white_list)
-		handle_white_list_exports(unused_exports_white_list);
+	if (trim_unused_exports) {
+		LIST_HEAD(permitted_imports);
+		if (unused_exports_white_list)
+			handle_white_list_exports(unused_exports_white_list,
+						  &permitted_imports);
+		write_permitted_imports_c_file(&permitted_imports);
+	}

 	list_for_each_entry(mod, &modules, list) {
 		if (mod->from_dump)
@@ -2300,5 +2404,10 @@ int main(int argc, char **argv)
 		warn("suppressed %u unresolved symbol warnings because there were too many)\n",
 		     nr_unresolved - MAX_UNRESOLVED_REPORTS);

+	if (protected_modules_list) {
+		handle_protected_modules_list(protected_modules_list);
+		write_protected_exports_c_file();
+	}
+
 	return error_occurred ? 1 : 0;
 }
--- a/scripts/mod/modpost.h
+++ b/scripts/mod/modpost.h
@@ -89,6 +89,7 @@ struct module {
 	bool seen;
 	bool has_init;
 	bool has_cleanup;
+	bool is_protected;  /* true if module exports are protected */
 	struct buffer dev_table_buf;
 	char	     srcversion[25];
 	// Missing namespace dependencies