Merge branch 'android16-6.12' into android16-6.12-lts

Catch the -lts branch up with changes made in the main branch.  Changes
in here are:

* 6c96f52eb0 ANDROID: binder: add ANDROID_BINDER_IPC_RUST_DUMMY
* 39ce6d6edf ANDROID: KVM: arm64: IWYU for hyp-constants.c.
* d1febc909d ANDROID: Add all_headers_allowlist_exynos to aarch64 allowlist
* 65bb7abf4c ANDROID: rust_binder: check FDA len before allocating
* 87dbecd2e0 ANDROID: GKI: Add Tuxera symbol list
* 9464dc3f22 ANDROID: dm: Split zoned writes at the top of the stack
* 49dd742eed ANDROID: block: Fix a deadlock related freezing zoned storage devices
* 7f4abd95ae ANDROID: ABI: Update pixel symbol list
* 60d884ac0e ANDROID: GKI: Update symbol list for vivo
* aefca998d5 ANDROID: mm/memory.c: allow do_swap_page() to allocate from CMA
* 14abb0c187 ANDROID: mm: Create hooks for ZONE_MOVABLE allocs
* fb5cc85bab ANDROID: qcom: Update the ABI symbol list
* 384d6e1eb6 ANDROID: GKI: Update symbol list for vivo
* 205d32456b ANDROID: vendor_hooks: add vendor hooks for readahead bio
* 034ca00e74 ANDROID: KVM: Fix func filter HVC for pKVM Ftrace
* e7a034a56f ANDROID: binder: fix minimum node priority comparison
* f5a89c1379 FROMLIST: firmware: arm_scmi: Fix up turbo frequencies selection
* 620cff923f ANDROID: GKI: Update symbols list for vivo
* d3e9951ff1 UPSTREAM: xhci: dbc: Avoid event polling busyloop if pending rx transfers are inactive.
* 5db5b73d80 ANDROID: GKI: Update symbol list for vivo
* c7cef0a951 ANDROID: vendor_hooks: add hooks for exting task's swp_entrys
* 0629d7c40c ANDROID: GKI: Update symbol list for vivo
* 60c1841adc ANDROID: vendor_hooks: add hook for boost free pages mapped by the exiting process
* bf3d08843a ANDROID: 16K: x86_64: Remove /dev/userfaultfd
* ea51b1c431 ANDROID: 16K: Remove ELF padding entry from map_file ranges
* 49c29cd38a ANDROID: GKI: Update symbol list for vivo
* 575d29316a ANDROID: vendor_hooks: Add hook to precisely control readahead
* 2b9ccc455b UPSTREAM: net/tls: fix kernel panic when alloc_page failed
* 8b1cec7a18 ANDROID: Do not expect rust_binder.ko on ARM32
* 759f99de87 UPSTREAM: net_sched: sch_sfq: move the limit validation
* 18d0a694db UPSTREAM: net_sched: sch_sfq: use a temporary work area for validating configuration

Change-Id: Ia13c6bb19c7f4175c514c9db35acae1d1feb492e
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>

BUILD.bazel

@@ -190,6 +190,7 @@ filegroup(
         "gki/aarch64/symbols/qcom",
         "gki/aarch64/symbols/rtkstb",
         "gki/aarch64/symbols/trusty",
+        "gki/aarch64/symbols/tuxera",
         "gki/aarch64/symbols/type_visibility",
         "gki/aarch64/symbols/unisoc",
         "gki/aarch64/symbols/virtual_device",
@@ -1641,6 +1642,7 @@ ddk_headers(
         "sound/usb/usbaudio.h",
         ":all_headers_allowlist_aarch64_globs",
         ":all_headers_allowlist_common_globs",
+        ":all_headers_allowlist_exynos",
         ":xhci_headers",
     ],
     # The list of include directories where source files can #include headers
@@ -1778,6 +1780,24 @@ ddk_headers(
     visibility = ["//visibility:private"],
 )
 
+ddk_headers(
+    name = "all_headers_allowlist_exynos",
+    hdrs = [
+        "drivers/android/binder_alloc.h",
+        "drivers/android/binder_internal.h",
+        "drivers/android/binder_trace.h",
+        "drivers/android/dbitmap.h",
+        "kernel/sched/cpudeadline.h",
+        "kernel/sched/cpupri.h",
+        "kernel/sched/ext.h",
+        "kernel/sched/features.h",
+        "kernel/sched/sched.h",
+        "kernel/sched/stats.h",
+        "kernel/workqueue_internal.h",
+    ],
+    visibility = ["//visibility:private"],
+)
+
 _KSELFTEST_DIR = "testcases/selftests"
 
 _KSELFTEST_COPTS = [

arch/arm64/kvm/hyp/hyp-constants.c

@@ -3,7 +3,6 @@
 #include <linux/kbuild.h>
 #include <nvhe/memory.h>
 #include <nvhe/pkvm.h>
-#include <nvhe/trace/trace.h>
 
 int main(void)
 {

arch/arm64/kvm/hyp/nvhe/ftrace.c

@@ -394,10 +394,8 @@ void *hyp_ftrace_sync(unsigned long *funcs_pg, unsigned long *funcs,
 		.funcs_pg = funcs_pg,
 	};
 
-	if (!funcs || !funcs_end) {
-		funcs = __hyp_patchable_function_entries_start;
+	if (!funcs_end)
 		funcs_end = __hyp_patchable_function_entries_end;
-	}
 
 	hyp_ftrace_patch(funcs, funcs_end, 2 * AARCH64_INSN_SIZE,
 			 __get_enable_disable_ins_from_funcs_pg, (void *)&args);

block/blk-core.c

@@ -621,6 +621,13 @@ static inline blk_status_t blk_check_zone_append(struct request_queue *q,
 	return BLK_STS_OK;
 }
 
+/*
+ * Do not call bio_queue_enter() if the BIO_ZONE_WRITE_PLUGGING flag has been
+ * set because this causes blk_mq_freeze_queue() to deadlock if
+ * blk_zone_wplug_bio_work() submits a bio. Calling bio_queue_enter() for bios
+ * on the plug list is not necessary since a q_usage_counter reference is held
+ * while a bio is on the plug list.
+ */
 static void __submit_bio(struct bio *bio)
 {
 	/* If plug is not used, add new plug here to cache nsecs time. */
@@ -633,8 +640,12 @@ static void __submit_bio(struct bio *bio)
 
 	if (!bdev_test_flag(bio->bi_bdev, BD_HAS_SUBMIT_BIO)) {
 		blk_mq_submit_bio(bio);
-	} else if (likely(bio_queue_enter(bio) == 0)) {
+	} else {
 		struct gendisk *disk = bio->bi_bdev->bd_disk;
+		bool zwp = bio_zone_write_plugging(bio);
+
+		if (unlikely(!zwp && bio_queue_enter(bio) != 0))
+			goto finish_plug;
 	
 		if ((bio->bi_opf & REQ_POLLED) &&
 		    !(disk->queue->limits.features & BLK_FEAT_POLL)) {
@@ -643,9 +654,12 @@ static void __submit_bio(struct bio *bio)
 		} else {
 			disk->fops->submit_bio(bio);
 		}
-		blk_queue_exit(disk->queue);
+
+		if (!zwp)
+			blk_queue_exit(disk->queue);
 	}
 
+finish_plug:
 	blk_finish_plug(&plug);
 }
 

drivers/android/Kconfig

@@ -49,6 +49,15 @@ config ANDROID_BINDER_IPC_RUST
 
 	  To build this as a GKI module, choose m.
 
+config ANDROID_BINDER_IPC_RUST_DUMMY
+	tristate "Empty module called rust_binder.ko"
+	depends on ANDROID_BINDER_IPC && !ANDROID_BINDER_IPC_RUST
+	help
+	  This creates an empty module of the same name as the Rust Binder
+	  module. This option can be used to trick the build system into
+	  thinking that Rust Binder was successfully built in cases where Rust
+	  support is unavailable.
+
 config ANDROID_BINDER_IPC_SELFTEST
 	bool "Android Binder IPC Driver Selftest"
 	depends on ANDROID_BINDER_IPC

drivers/android/Makefile

@@ -8,5 +8,10 @@ obj-$(CONFIG_ANDROID_VENDOR_HOOKS) += vendor_hooks.o
 obj-$(CONFIG_ANDROID_DEBUG_KINFO)	+= debug_kinfo.o
 
 obj-$(CONFIG_ANDROID_BINDER_IPC_RUST)	+= rust_binder.o
+obj-$(CONFIG_ANDROID_BINDER_IPC_RUST_DUMMY)	+= rust_binder.o
+ifdef CONFIG_ANDROID_BINDER_IPC_RUST
 rust_binder-objs := binder/rust_binder.o binder/rust_binderfs.o binder/rust_binder_events.o
 rust_binder-objs += binder/rust_binder_hooks.o binder/page_range_helper.o
+else
+rust_binder-objs := binder/dummy.o
+endif

drivers/android/binder.c

@@ -827,8 +827,8 @@ static void binder_transaction_priority(struct binder_thread *thread,
 		desired.sched_policy = SCHED_NORMAL;
 	}
 
-	if (node_prio.prio < t->priority.prio ||
-	    (node_prio.prio == t->priority.prio &&
+	if (node_prio.prio < desired.prio ||
+	    (node_prio.prio == desired.prio &&
 	     node_prio.sched_policy == SCHED_FIFO)) {
 		/*
 		 * In case the minimum priority on the node is

drivers/android/binder/dummy.c

@@ -0,0 +1,15 @@
+// SPDX-License-Identifier: GPL-2.0
+
+#include <linux/module.h>
+#include <linux/init.h>
+
+static int __init rbd_init(void)
+{
+	pr_warn("Using Rust Binder dummy module");
+	return 0;
+}
+
+module_init(rbd_init);
+MODULE_DESCRIPTION("Dummy Rust Binder module");
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Alice Ryhl <aliceryhl@google.com>");

drivers/android/binder/thread.rs

@@ -909,9 +909,8 @@ impl Thread {
                 let num_fds = usize::try_from(obj.num_fds).map_err(|_| EINVAL)?;
                 let fds_len = num_fds.checked_mul(size_of::<u32>()).ok_or(EINVAL)?;
 
-                view.alloc.info_add_fd_reserve(num_fds)?;
-
                 let info = sg_state.validate_parent_fixup(parent_index, parent_offset, fds_len)?;
+                view.alloc.info_add_fd_reserve(num_fds)?;
 
                 sg_state.ancestors.truncate(info.num_ancestors);
                 let parent_entry = match sg_state.sg_entries.get_mut(info.parent_sg_index) {

drivers/android/vendor_hooks.c

@@ -384,6 +384,7 @@ EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_fuse_request_send);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_fuse_request_end);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_lruvec_add_folio);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_lruvec_del_folio);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_do_async_mmap_readahead);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_tcp_sock_error);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_tcp_fastsyn);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_tcp_state_change);
@@ -516,6 +517,7 @@ EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_init_adjust_zone_wmark);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_lock_folio_drop_mmap_start);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_lock_folio_drop_mmap_end);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_filemap_update_page);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_f2fs_ra_op_flags);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_hibernated_do_mem_alloc);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_hibernate_save_cmp_len);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_percpu_rwsem_down_read);
@@ -535,3 +537,11 @@ EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_mm_may_oom_exit);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_calculate_totalreserve_pages);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_madvise_cold_pageout_skip);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_rmqueue_pcplist_override_batch);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_do_group_exit);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_swapmem_gather_init);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_swapmem_gather_add_bypass);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_swapmem_gather_finish);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_oom_swapmem_gather_init);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_oom_swapmem_gather_finish);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_set_gfp_zone_flags);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_set_readahead_gfp_mask);

drivers/firmware/arm_scmi/perf.c

@@ -892,7 +892,7 @@ static int scmi_dvfs_device_opps_add(const struct scmi_protocol_handle *ph,
 			freq = dom->opp[idx].indicative_freq * dom->mult_factor;
 
 		/* All OPPs above the sustained frequency are treated as turbo */
-		data.turbo = freq > dom->sustained_freq_khz * 1000;
+		data.turbo = freq > dom->sustained_freq_khz * 1000UL;
 
 		data.level = dom->opp[idx].perf;
 		data.freq = freq;

drivers/md/dm.c

@@ -1788,11 +1788,14 @@ static inline bool dm_zone_bio_needs_split(struct mapped_device *md,
 					   struct bio *bio)
 {
 	/*
-	 * For mapped device that need zone append emulation, we must
-	 * split any large BIO that straddles zone boundaries.
+	 * For a mapped device that needs zone append emulation, we must
+	 * split any large BIO that straddles zone boundaries. Additionally,
+	 * split sequential zoned writes to prevent that splitting lower in the
+	 * stack causes bio reordering.
 	 */
-	return dm_emulate_zone_append(md) && bio_straddles_zones(bio) &&
-		!bio_flagged(bio, BIO_ZONE_WRITE_PLUGGING);
+	return ((dm_emulate_zone_append(md) && bio_straddles_zones(bio)) ||
+		(bio_op(bio) == REQ_OP_WRITE && bdev_is_zoned(bio->bi_bdev))) &&
+	       !bio_flagged(bio, BIO_ZONE_WRITE_PLUGGING);
 }
 static inline bool dm_zone_plug_bio(struct mapped_device *md, struct bio *bio)
 {

drivers/usb/host/xhci-dbgcap.c

@@ -822,6 +822,7 @@ static enum evtreturn xhci_dbc_do_handle_events(struct xhci_dbc *dbc)
 {
 	dma_addr_t		deq;
 	union xhci_trb		*evt;
+	enum evtreturn		ret = EVT_DONE;
 	u32			ctrl, portsc;
 	bool			update_erdp = false;
 
@@ -906,6 +907,7 @@ static enum evtreturn xhci_dbc_do_handle_events(struct xhci_dbc *dbc)
 			break;
 		case TRB_TYPE(TRB_TRANSFER):
 			dbc_handle_xfer_event(dbc, evt);
+			ret = EVT_XFER_DONE;
 			break;
 		default:
 			break;
@@ -924,7 +926,7 @@ static enum evtreturn xhci_dbc_do_handle_events(struct xhci_dbc *dbc)
 		lo_hi_writeq(deq, &dbc->regs->erdp);
 	}
 
-	return EVT_DONE;
+	return ret;
 }
 
 static void xhci_dbc_handle_events(struct work_struct *work)
@@ -933,6 +935,7 @@ static void xhci_dbc_handle_events(struct work_struct *work)
 	struct xhci_dbc		*dbc;
 	unsigned long		flags;
 	unsigned int		poll_interval;
+	unsigned long		busypoll_timelimit;
 
 	dbc = container_of(to_delayed_work(work), struct xhci_dbc, event_work);
 	poll_interval = dbc->poll_interval;
@@ -951,11 +954,21 @@ static void xhci_dbc_handle_events(struct work_struct *work)
 			dbc->driver->disconnect(dbc);
 		break;
 	case EVT_DONE:
-		/* set fast poll rate if there are pending data transfers */
+		/*
+		 * Set fast poll rate if there are pending out transfers, or
+		 * a transfer was recently processed
+		 */
+		busypoll_timelimit = dbc->xfer_timestamp +
+			msecs_to_jiffies(DBC_XFER_INACTIVITY_TIMEOUT);
+
 		if (!list_empty(&dbc->eps[BULK_OUT].list_pending) ||
-		    !list_empty(&dbc->eps[BULK_IN].list_pending))
+		    time_is_after_jiffies(busypoll_timelimit))
 			poll_interval = 0;
 		break;
+	case EVT_XFER_DONE:
+		dbc->xfer_timestamp = jiffies;
+		poll_interval = 0;
+		break;
 	default:
 		dev_info(dbc->dev, "stop handling dbc events\n");
 		return;

drivers/usb/host/xhci-dbgcap.h

@@ -96,6 +96,7 @@ struct dbc_ep {
 #define DBC_WRITE_BUF_SIZE		8192
 #define DBC_POLL_INTERVAL_DEFAULT	64	/* milliseconds */
 #define DBC_POLL_INTERVAL_MAX		5000	/* milliseconds */
+#define DBC_XFER_INACTIVITY_TIMEOUT	10	/* milliseconds */
 /*
  * Private structure for DbC hardware state:
  */
@@ -142,6 +143,7 @@ struct xhci_dbc {
 	enum dbc_state			state;
 	struct delayed_work		event_work;
 	unsigned int			poll_interval;	/* ms */
+	unsigned long			xfer_timestamp;
 	unsigned			resume_required:1;
 	struct dbc_ep			eps[2];
 
@@ -187,6 +189,7 @@ struct dbc_request {
 enum evtreturn {
 	EVT_ERR	= -1,
 	EVT_DONE,
+	EVT_XFER_DONE,
 	EVT_GSER,
 	EVT_DISC,
 };

fs/f2fs/data.c

@@ -27,6 +27,7 @@
 #include "segment.h"
 #include "iostat.h"
 #include <trace/events/f2fs.h>
+#include <trace/hooks/blk.h>
 
 #define NUM_PREALLOC_POST_READ_CTXS	128
 
@@ -2069,7 +2070,10 @@ static inline loff_t f2fs_readpage_limit(struct inode *inode)
 
 static inline blk_opf_t f2fs_ra_op_flags(struct readahead_control *rac)
 {
-	return rac ? REQ_RAHEAD : 0;
+	blk_opf_t op_flag = rac ? REQ_RAHEAD : 0;
+
+	trace_android_vh_f2fs_ra_op_flags(&op_flag, rac);
+	return op_flag;
 }
 
 static int f2fs_read_single_page(struct inode *inode, struct folio *folio,

fs/proc/base.c

@@ -65,6 +65,7 @@
 #include <linux/namei.h>
 #include <linux/mnt_namespace.h>
 #include <linux/mm.h>
+#include <linux/pgsize_migration.h>
 #include <linux/swap.h>
 #include <linux/rcupdate.h>
 #include <linux/kallsyms.h>
@@ -2471,7 +2472,7 @@ proc_map_files_readdir(struct file *file, struct dir_context *ctx)
 		}
 
 		p->start = vma->vm_start;
-		p->end = vma->vm_end;
+		p->end = VMA_PAD_START(vma);
 		p->mode = vma->vm_file->f_mode;
 	}
 	mmap_read_unlock(mm);

fs/userfaultfd.c

@@ -2188,6 +2188,9 @@ static int __init userfaultfd_init(void)
 {
 	int ret;
 
+	if (__PAGE_SIZE != PAGE_SIZE)
+		return 0;
+
 	ret = misc_register(&userfaultfd_misc);
 	if (ret)
 		return ret;

gki/aarch64/protected_exports

@@ -1,4 +1,6 @@
 __SCK__tp_func_9p_fid_ref
+__SCK__tp_func_android_vh_rust_binder_restore_priority
+__SCK__tp_func_android_vh_rust_binder_set_priority
 __SCK__tp_func_netfs_sreq
 __hci_cmd_send
 __hci_cmd_sync
@@ -16,8 +18,12 @@ __nfc_alloc_vendor_cmd_reply_skb
 __regmap_init_ram
 __regmap_init_raw_ram
 __traceiter_9p_fid_ref
+__traceiter_android_vh_rust_binder_restore_priority
+__traceiter_android_vh_rust_binder_set_priority
 __traceiter_netfs_sreq
 __tracepoint_9p_fid_ref
+__tracepoint_android_vh_rust_binder_restore_priority
+__tracepoint_android_vh_rust_binder_set_priority
 __tracepoint_netfs_sreq
 __usb_serial_register_drivers
 alloc_can_err_skb

gki/aarch64/symbols/pixel

@@ -2868,7 +2868,10 @@
   __xa_store
   xa_store
   __xfrm_state_destroy
+  xfrm_state_alloc
+  xfrm_state_delete
   xfrm_state_lookup_byspi
+  xfrm_state_migrate
   xfrm_stateonly_find
   xhci_gen_setup
   xhci_init_driver

gki/aarch64/symbols/qcom

@@ -887,6 +887,7 @@
   __drm_atomic_helper_plane_duplicate_state
   drm_atomic_helper_prepare_planes
   __drm_atomic_helper_private_obj_duplicate_state
+  drm_atomic_helper_resume
   drm_atomic_helper_set_config
   drm_atomic_helper_shutdown
   drm_atomic_helper_swap_state
@@ -957,6 +958,7 @@
   __drm_err
   drm_event_reserve_init_locked
   drm_format_info
+  drm_framebuffer_cleanup
   drm_framebuffer_init
   drm_framebuffer_lookup
   drm_framebuffer_remove
@@ -978,6 +980,7 @@
   drm_gem_prime_handle_to_fd
   drm_gem_private_object_init
   drm_gem_put_pages
+  drm_gem_shmem_get_pages_sgt
   drm_gem_vm_close
   drm_gem_vm_open
   drm_get_connector_status_name

gki/aarch64/symbols/tuxera

@@ -0,0 +1,53 @@
+[abi_symbol_list]
+  _atomic_dec_and_lock
+  __bforget
+  __bh_read_batch
+  bio_alloc_clone
+  bit_waitqueue
+  block_is_partially_uptodate
+  __breadahead
+  capable_wrt_inode_uidgid
+  clear_page_dirty_for_io
+  cont_write_begin
+  d_add_ci
+  dirty_writeback_interval
+  disk_live
+  fault_in_safe_writeable
+  file_check_and_advance_wb_err
+  filemap_add_folio
+  filemap_check_errors
+  filemap_release_folio
+  __folio_cancel_dirty
+  folio_end_read
+  folio_zero_new_buffers
+  generic_cont_expand_simple
+  generic_error_remove_folio
+  generic_file_direct_write
+  iget_locked
+  ilookup5
+  inode_add_bytes
+  inode_maybe_inc_iversion
+  inode_query_iversion
+  __insert_inode_hash
+  iov_iter_single_seg_count
+  make_vfsgid
+  make_vfsuid
+  mark_buffer_write_io_error
+  match_octal
+  migrate_folio
+  mount_bdev
+  pagecache_isize_extended
+  page_cache_next_miss
+  page_cache_prev_miss
+  page_symlink
+  __remove_inode_hash
+  sb_min_blocksize
+  security_inode_init_security
+  __sync_dirty_buffer
+  sysctl_hung_task_timeout_secs
+  tag_pages_for_writeback
+  try_to_free_buffers
+  try_to_writeback_inodes_sb
+  utf32_to_utf8
+  wake_bit_function
+  wrap_directory_iterator

gki/aarch64/symbols/vivo

@@ -23,6 +23,8 @@
   kblockd_mod_delayed_work_on
   kern_path
   __lock_buffer
+  mempool_kfree
+  mempool_kmalloc
   mipi_dsi_dcs_write
   __neigh_create
   netdev_is_rx_handler_busy
@@ -42,6 +44,7 @@
   qdisc_put
   qdisc_reset
   qdisc_tree_reduce_backlog
+  readahead_gfp_mask
   regulator_get_drvdata
   remove_proc_entry
   sbitmap_add_wait_queue
@@ -80,6 +83,8 @@
   __traceiter_android_rvh_inet_sock_release
   __traceiter_android_rvh_replace_next_task_fair
   __traceiter_android_rvh_set_user_nice
+  __traceiter_android_rvh_set_gfp_zone_flags
+  __traceiter_android_rvh_set_readahead_gfp_mask
   __traceiter_android_rvh_tcp_recvmsg
   __traceiter_android_rvh_tcp_select_window
   __traceiter_android_rvh_tcp_sendmsg
@@ -103,9 +108,12 @@
   __traceiter_android_vh_do_send_sig_info
   __traceiter_android_vh_clear_rwsem_reader_owned
   __traceiter_android_vh_clear_rwsem_writer_owned
+  __traceiter_android_vh_do_async_mmap_readahead
+  __traceiter_android_vh_do_group_exit
   __traceiter_android_vh_do_new_mount_fc
   __traceiter_android_vh_dup_task_struct
   __traceiter_android_vh_f2fs_file_open
+  __traceiter_android_vh_f2fs_ra_op_flags
   __traceiter_android_vh_filemap_update_page
   __traceiter_android_vh_free_task
   __traceiter_android_vh_fuse_request_end
@@ -122,6 +130,8 @@
   __traceiter_android_vh_mutex_unlock_slowpath_before_wakeq
   __traceiter_android_vh_mutex_wait_finish
   __traceiter_android_vh_mutex_wait_start
+  __traceiter_android_vh_oom_swapmem_gather_finish
+  __traceiter_android_vh_oom_swapmem_gather_init
   __traceiter_android_vh_record_rwsem_reader_owned
   __traceiter_android_vh_record_rwsem_writer_owned
   __traceiter_android_vh_rwsem_init
@@ -137,6 +147,9 @@
   __traceiter_android_vh_shrink_node_memcgs_bypass
   __traceiter_android_vh_sk_alloc
   __traceiter_android_vh_sk_free
+  __traceiter_android_vh_swapmem_gather_add_bypass
+  __traceiter_android_vh_swapmem_gather_finish
+  __traceiter_android_vh_swapmem_gather_init
   __traceiter_android_vh_percpu_rwsem_down_read
   __traceiter_android_vh_percpu_rwsem_up_write
   __traceiter_android_vh_sync_txn_recvd
@@ -163,6 +176,8 @@
   __tracepoint_android_rvh_inet_sock_release
   __tracepoint_android_rvh_replace_next_task_fair
   __tracepoint_android_rvh_set_user_nice
+  __tracepoint_android_rvh_set_gfp_zone_flags
+  __tracepoint_android_rvh_set_readahead_gfp_mask
   __tracepoint_android_rvh_tcp_recvmsg
   __tracepoint_android_rvh_tcp_select_window
   __tracepoint_android_rvh_tcp_sendmsg
@@ -186,9 +201,12 @@
   __tracepoint_android_vh_do_send_sig_info
   __tracepoint_android_vh_clear_rwsem_reader_owned
   __tracepoint_android_vh_clear_rwsem_writer_owned
+  __tracepoint_android_vh_do_async_mmap_readahead
+  __tracepoint_android_vh_do_group_exit
   __tracepoint_android_vh_do_new_mount_fc
   __tracepoint_android_vh_dup_task_struct
   __tracepoint_android_vh_f2fs_file_open
+  __tracepoint_android_vh_f2fs_ra_op_flags
   __tracepoint_android_vh_filemap_update_page
   __tracepoint_android_vh_free_task
   __tracepoint_android_vh_fuse_request_end
@@ -205,6 +223,8 @@
   __tracepoint_android_vh_mutex_unlock_slowpath_before_wakeq
   __tracepoint_android_vh_mutex_wait_finish
   __tracepoint_android_vh_mutex_wait_start
+  __tracepoint_android_vh_oom_swapmem_gather_finish
+  __tracepoint_android_vh_oom_swapmem_gather_init
   __tracepoint_android_vh_record_rwsem_reader_owned
   __tracepoint_android_vh_record_rwsem_writer_owned
   __tracepoint_android_vh_rwsem_init
@@ -220,6 +240,9 @@
   __tracepoint_android_vh_shrink_node_memcgs_bypass
   __tracepoint_android_vh_sk_alloc
   __tracepoint_android_vh_sk_free
+  __tracepoint_android_vh_swapmem_gather_add_bypass
+  __tracepoint_android_vh_swapmem_gather_finish
+  __tracepoint_android_vh_swapmem_gather_init
   __tracepoint_android_vh_sync_txn_recvd
   __tracepoint_android_vh_tcp_rtt_estimator
   __tracepoint_android_vh_udp_enqueue_schedule_skb

include/linux/gfp.h

@@ -127,7 +127,7 @@ static inline bool gfpflags_allow_blocking(const gfp_t gfp_flags)
 	| 1 << (___GFP_MOVABLE | ___GFP_DMA32 | ___GFP_DMA | ___GFP_HIGHMEM)  \
 )
 
-static inline enum zone_type gfp_zone(gfp_t flags)
+static inline enum zone_type __gfp_zone(gfp_t flags)
 {
 	enum zone_type z;
 	int bit = (__force int) (flags & GFP_ZONEMASK);
@@ -138,6 +138,8 @@ static inline enum zone_type gfp_zone(gfp_t flags)
 	return z;
 }
 
+enum zone_type gfp_zone(gfp_t flags);
+
 /*
  * There is only one page-allocator function, and two main namespaces to
  * it. The alloc_page*() variants return 'struct page *' and as such

include/linux/pagemap.h

@@ -683,11 +683,13 @@ static inline struct page *__page_cache_alloc(gfp_t gfp)
 	return &filemap_alloc_folio(gfp, 0)->page;
 }
 
-static inline gfp_t readahead_gfp_mask(struct address_space *x)
+static inline gfp_t __readahead_gfp_mask(struct address_space *x)
 {
 	return mapping_gfp_mask(x) | __GFP_NORETRY | __GFP_NOWARN;
 }
 
+gfp_t readahead_gfp_mask(struct address_space *x);
+
 typedef int filler_t(struct file *, struct folio *);
 
 pgoff_t page_cache_next_miss(struct address_space *mapping,

include/trace/hooks/blk.h

@@ -35,6 +35,13 @@ DECLARE_HOOK(android_vh_blk_mq_kick_requeue_list,
 	TP_PROTO(struct request_queue *q, unsigned long delay, bool *skip),
 	TP_ARGS(q, delay, skip));
 
+struct readahead_control;
+typedef __u32 __bitwise blk_opf_t;
+
+DECLARE_HOOK(android_vh_f2fs_ra_op_flags,
+	TP_PROTO(blk_opf_t *op_flag, struct readahead_control *rac),
+	TP_ARGS(op_flag, rac));
+
 #endif /* _TRACE_HOOK_BLK_H */
 /* This part must be outside protection */
 #include <trace/define_trace.h>

include/trace/hooks/mm.h

@@ -52,18 +52,13 @@ DECLARE_RESTRICTED_HOOK(android_rvh_bitmap_find_best_next_area,
 DECLARE_HOOK(android_vh_madvise_cold_pageout_skip,
 	     TP_PROTO(struct vm_area_struct *vma, struct folio *folio, bool pageout, bool *need_skip),
 	     TP_ARGS(vma, folio, pageout, need_skip));
-/*
 
-DECLARE_RESTRICTED_HOOK(android_rvh_set_skip_swapcache_flags,
-			TP_PROTO(gfp_t *flags),
-			TP_ARGS(flags), 1);
 DECLARE_RESTRICTED_HOOK(android_rvh_set_gfp_zone_flags,
-			TP_PROTO(gfp_t *flags),
+			TP_PROTO(unsigned int *flags),	/* gfp_t *flags */
 			TP_ARGS(flags), 1);
 DECLARE_RESTRICTED_HOOK(android_rvh_set_readahead_gfp_mask,
-			TP_PROTO(gfp_t *flags),
+			TP_PROTO(unsigned int *flags),	/* gfp_t *flags */
 			TP_ARGS(flags), 1);
-*/
 struct mem_cgroup;
 DECLARE_HOOK(android_vh_mem_cgroup_alloc,
 	TP_PROTO(struct mem_cgroup *memcg),
@@ -323,6 +318,11 @@ DECLARE_HOOK(android_vh_alloc_pages_slowpath_end,
 DECLARE_HOOK(android_vh_add_lazyfree_bypass,
 	TP_PROTO(struct lruvec *lruvec, struct folio *folio, bool *bypass),
 	TP_ARGS(lruvec, folio, bypass));
+
+DECLARE_HOOK(android_vh_do_async_mmap_readahead,
+	TP_PROTO(struct vm_fault *vmf, struct folio *folio, bool *skip),
+	TP_ARGS(vmf, folio, skip));
+
 DECLARE_HOOK(android_vh_alloc_contig_range_not_isolated,
 	TP_PROTO(unsigned long start, unsigned end),
 	TP_ARGS(start, end));
@@ -479,6 +479,24 @@ DECLARE_HOOK(android_vh_lruvec_del_folio,
 DECLARE_HOOK(android_vh_rmqueue_pcplist_override_batch,
 	TP_PROTO(int *batch),
 	TP_ARGS(batch));
+DECLARE_HOOK(android_vh_do_group_exit,
+	TP_PROTO(struct task_struct *tsk),
+	TP_ARGS(tsk));
+DECLARE_HOOK(android_vh_swapmem_gather_init,
+	TP_PROTO(struct mm_struct *mm),
+	TP_ARGS(mm));
+DECLARE_HOOK(android_vh_swapmem_gather_add_bypass,
+	TP_PROTO(struct mm_struct *mm, swp_entry_t entry, int nr, bool *bypass),
+	TP_ARGS(mm, entry, nr, bypass));
+DECLARE_HOOK(android_vh_swapmem_gather_finish,
+	TP_PROTO(struct mm_struct *mm),
+	TP_ARGS(mm));
+DECLARE_HOOK(android_vh_oom_swapmem_gather_init,
+	TP_PROTO(struct mm_struct *mm),
+	TP_ARGS(mm));
+DECLARE_HOOK(android_vh_oom_swapmem_gather_finish,
+	TP_PROTO(struct mm_struct *mm),
+	TP_ARGS(mm));
 #endif /* _TRACE_HOOK_MM_H */
 
 /* This part must be outside protection */

kernel/exit.c

@@ -1089,6 +1089,7 @@ do_group_exit(int exit_code)
 		}
 		spin_unlock_irq(&sighand->siglock);
 	}
+	trace_android_vh_do_group_exit(current);
 
 	do_exit(exit_code);
 	/* NOTREACHED */

mm/filemap.c

@@ -3272,6 +3272,11 @@ static struct file *do_async_mmap_readahead(struct vm_fault *vmf,
 	DEFINE_READAHEAD(ractl, file, ra, file->f_mapping, vmf->pgoff);
 	struct file *fpin = NULL;
 	unsigned int mmap_miss;
+	bool skip = false;
+
+	trace_android_vh_do_async_mmap_readahead(vmf, folio, &skip);
+	if (skip)
+		return fpin;
 
 	/* If we don't want any read-ahead, don't bother */
 	if (vmf->vma->vm_flags & VM_RAND_READ || !ra->ra_pages)

mm/memory.c

@@ -1604,6 +1604,7 @@ static unsigned long zap_pte_range(struct mmu_gather *tlb,
 	pte_t *pte;
 	swp_entry_t entry;
 	int nr;
+	bool bypass = false;
 
 	tlb_change_page_size(tlb, PAGE_SIZE);
 	init_rss_vec(rss);
@@ -1663,6 +1664,9 @@ static unsigned long zap_pte_range(struct mmu_gather *tlb,
 			if (!should_zap_cows(details))
 				continue;
 			rss[MM_SWAPENTS] -= nr;
+			trace_android_vh_swapmem_gather_add_bypass(mm, entry, nr, &bypass);
+			if (bypass)
+				goto skip;
 			free_swap_and_cache_nr(entry, nr);
 		} else if (is_migration_entry(entry)) {
 			folio = pfn_swap_entry_folio(entry);
@@ -1694,6 +1698,7 @@ static unsigned long zap_pte_range(struct mmu_gather *tlb,
 			pr_alert("unrecognized swap entry 0x%lx\n", entry.val);
 			WARN_ON_ONCE(1);
 		}
+skip:
 		clear_not_present_full_ptes(mm, addr, pte, nr, tlb->fullmm);
 		zap_install_uffd_wp_if_needed(vma, addr, pte, nr, details, ptent);
 	} while (pte += nr, addr += PAGE_SIZE * nr, addr != end);
@@ -4035,8 +4040,8 @@ static struct folio *__alloc_swap_folio(struct vm_fault *vmf)
 	struct folio *folio;
 	swp_entry_t entry;
 
-	folio = vma_alloc_folio(GFP_HIGHUSER_MOVABLE, 0, vma,
-				vmf->address, false);
+	folio = vma_alloc_folio(GFP_HIGHUSER_MOVABLE | __GFP_CMA,
+				0, vma, vmf->address, false);
 	if (!folio)
 		return NULL;
 
@@ -4346,7 +4351,8 @@ vm_fault_t do_swap_page(struct vm_fault *vmf)
 				folio->private = NULL;
 			}
 		} else {
-			folio = swapin_readahead(entry, GFP_HIGHUSER_MOVABLE,
+			folio = swapin_readahead(entry,
+						GFP_HIGHUSER_MOVABLE | __GFP_CMA,
 						vmf);
 			swapcache = folio;
 		}

mm/mmap.c

@@ -1952,9 +1952,11 @@ void exit_mmap(struct mm_struct *mm)
 	lru_add_drain();
 	flush_cache_mm(mm);
 	tlb_gather_mmu_fullmm(&tlb, mm);
+	trace_android_vh_swapmem_gather_init(mm);
 	/* update_hiwater_rss(mm) here? but nobody should be looking */
 	/* Use ULONG_MAX here to ensure all VMAs in the mm are unmapped */
 	unmap_vmas(&tlb, &vmi.mas, vma, 0, ULONG_MAX, ULONG_MAX, false);
+	trace_android_vh_swapmem_gather_finish(mm);
 	mmap_read_unlock(mm);
 
 	/*

mm/mmzone.c

@@ -9,6 +9,7 @@
 #include <linux/stddef.h>
 #include <linux/mm.h>
 #include <linux/mmzone.h>
+#include <trace/hooks/mm.h>
 
 struct pglist_data *first_online_pgdat(void)
 {
@@ -111,3 +112,10 @@ int folio_xchg_last_cpupid(struct folio *folio, int cpupid)
 	return last_cpupid;
 }
 #endif
+
+enum zone_type gfp_zone(gfp_t flags)
+{
+	trace_android_rvh_set_gfp_zone_flags(&flags);
+
+	return __gfp_zone(flags);
+}

mm/oom_kill.c

@@ -53,6 +53,8 @@
 
 #define CREATE_TRACE_POINTS
 #include <trace/events/oom.h>
+#undef CREATE_TRACE_POINTS
+#include <trace/hooks/mm.h>
 
 #undef CREATE_TRACE_POINTS
 #include <trace/hooks/mm.h>
@@ -531,6 +533,7 @@ bool __oom_reap_task_mm(struct mm_struct *mm)
 	 */
 	set_bit(MMF_UNSTABLE, &mm->flags);
 
+	trace_android_vh_oom_swapmem_gather_init(mm);
 	for_each_vma(vmi, vma) {
 		if (vma->vm_flags & (VM_HUGETLB|VM_PFNMAP))
 			continue;
@@ -563,6 +566,7 @@ bool __oom_reap_task_mm(struct mm_struct *mm)
 			tlb_finish_mmu(&tlb);
 		}
 	}
+	trace_android_vh_oom_swapmem_gather_finish(mm);
 
 	return ret;
 }

mm/readahead.c

@@ -144,6 +144,15 @@ file_ra_state_init(struct file_ra_state *ra, struct address_space *mapping)
 }
 EXPORT_SYMBOL_GPL(file_ra_state_init);
 
+gfp_t readahead_gfp_mask(struct address_space *x)
+{
+	gfp_t mask = __readahead_gfp_mask(x);
+
+	trace_android_rvh_set_readahead_gfp_mask(&mask);
+	return mask;
+}
+EXPORT_SYMBOL_GPL(readahead_gfp_mask);
+
 static void read_pages(struct readahead_control *rac)
 {
 	const struct address_space_operations *aops = rac->mapping->a_ops;

modules.bzl

@@ -9,7 +9,6 @@ This module contains a full list of kernel modules
 # LINT.IfChange
 _COMMON_GKI_MODULES_LIST = [
     # keep sorted
-    "drivers/android/rust_binder.ko",
     "drivers/block/virtio_blk.ko",
     "drivers/block/zram/zram.ko",
     "drivers/bluetooth/btbcm.ko",
@@ -100,6 +99,7 @@ _ARM_GKI_MODULES_LIST = [
 _ARM64_GKI_MODULES_LIST = [
     # keep sorted
     "arch/arm64/geniezone/gzvm.ko",
+    "drivers/android/rust_binder.ko",
     "drivers/char/hw_random/cctrng.ko",
     "drivers/misc/open-dice.ko",
     "drivers/ptp/ptp_kvm.ko",
@@ -113,6 +113,7 @@ _X86_GKI_MODULES_LIST = [
 
 _X86_64_GKI_MODULES_LIST = [
     # keep sorted
+    "drivers/android/rust_binder.ko",
     "drivers/ptp/ptp_kvm.ko",
 ]
 

net/tls/tls_strp.c

@@ -396,7 +396,6 @@ static int tls_strp_read_copy(struct tls_strparser *strp, bool qshort)
 		return 0;
 
 	shinfo = skb_shinfo(strp->anchor);
-	shinfo->frag_list = NULL;
 
 	/* If we don't know the length go max plus page for cipher overhead */
 	need_spc = strp->stm.full_len ?: TLS_MAX_PAYLOAD_SIZE + PAGE_SIZE;
@@ -412,6 +411,8 @@ static int tls_strp_read_copy(struct tls_strparser *strp, bool qshort)
 				   page, 0, 0);
 	}
 
+	shinfo->frag_list = NULL;
+
 	strp->copy_mode = 1;
 	strp->stm.offset = 0;