Merge branch 'lf-6.6.y_android' into dev_automotive-15.0_1.3.0

BUILD.bazel

@@ -27,7 +27,12 @@ load(
     "merged_kernel_uapi_headers",
 )
 load(":abi.bzl", "cc_binary_with_abi")
-load(":modules.bzl", "get_gki_modules_list", "get_kunit_modules_list")
+load(
+    ":modules.bzl",
+    "get_gki_modules_list",
+    "get_gki_protected_modules_list",
+    "get_kunit_modules_list",
+)
 load(":imx.bzl", "define_imx")
 define_imx()
 
@@ -95,6 +100,14 @@ write_file(
     ],
 )
 
+write_file(
+    name = "gki_aarch64_protected_modules",
+    out = "android/gki_aarch64_protected_modules",
+    content = get_gki_protected_modules_list("arm64") + [
+        "",  # Ensure new line at the end.
+    ],
+)
+
 filegroup(
     name = "aarch64_additional_kmi_symbol_lists",
     srcs = [
@@ -137,7 +150,7 @@ define_common_kernels(target_configs = {
         "additional_kmi_symbol_lists": [":aarch64_additional_kmi_symbol_lists"],
         "trim_nonlisted_kmi": True,
         "protected_exports_list": "android/abi_gki_protected_exports_aarch64",
-        "protected_modules_list": "android/gki_aarch64_protected_modules",
+        "protected_modules_list": ":gki_aarch64_protected_modules",
         "module_implicit_outs": get_gki_modules_list("arm64") + get_kunit_modules_list("arm64"),
         "make_goals": _GKI_AARCH64_MAKE_GOALS,
         "ddk_headers_archive": ":kernel_aarch64_ddk_headers_archive",
@@ -152,7 +165,7 @@ define_common_kernels(target_configs = {
         "additional_kmi_symbol_lists": [":aarch64_additional_kmi_symbol_lists"],
         "trim_nonlisted_kmi": True,
         "protected_exports_list": "android/abi_gki_protected_exports_aarch64",
-        "protected_modules_list": "android/gki_aarch64_protected_modules",
+        "protected_modules_list": ":gki_aarch64_protected_modules",
         "module_implicit_outs": get_gki_modules_list("arm64") + get_kunit_modules_list("arm64"),
         "make_goals": _GKI_AARCH64_MAKE_GOALS,
         "ddk_headers_archive": ":kernel_aarch64_ddk_headers_archive",
@@ -626,7 +639,6 @@ _ROCKPI4_MODULE_OUTS = [
     "drivers/thermal/rockchip_thermal.ko",
     "drivers/usb/host/ohci-hcd.ko",
     "drivers/usb/host/ohci-platform.ko",
-    "drivers/virtio/virtio_pci_legacy_dev.ko",
     "net/core/failover.ko",
 ]
 
@@ -935,8 +947,10 @@ ddk_headers(
         "drivers/usb/core/usb.h",
         "drivers/usb/host/pci-quirks.h",
         "drivers/usb/host/xhci.h",
+        "drivers/usb/host/xhci-caps.h",
         "drivers/usb/host/xhci-ext-caps.h",
         "drivers/usb/host/xhci-plat.h",
+        "drivers/usb/host/xhci-port.h",
     ],
     linux_includes = [
         "drivers/usb",
@@ -950,8 +964,11 @@ ddk_headers(
 ddk_headers(
     name = "all_headers_allowlist_aarch64",
     hdrs = [
+        "drivers/dma-buf/heaps/deferred-free-helper.h",
+        "drivers/extcon/extcon.h",
         "drivers/thermal/thermal_core.h",
         "drivers/thermal/thermal_netlink.h",
+        "drivers/usb/dwc3/core.h",
         "sound/usb/card.h",
         "sound/usb/usbaudio.h",
         ":all_headers_allowlist_aarch64_globs",
@@ -964,7 +981,10 @@ ddk_headers(
     linux_includes = [
         "arch/arm64/include",
         "arch/arm64/include/uapi",
+        "drivers/dma-buf",
+        "drivers/extcon",
         "drivers/thermal",
+        "drivers/usb",
         "sound/usb",
         "include",
         "include/uapi",
@@ -1067,34 +1087,10 @@ _KSELFTEST_COPTS = [
     "-pthread",
     "-std=gnu99",
 ] + select({
-    ":arm": ["-mcpu=cortex-a8"],
+    "//build/kernel/kleaf/platforms/config_settings:android_arm": ["-mcpu=cortex-a8"],
     "//conditions:default": [],
 })
 
-config_setting(
-    name = "x86_64",
-    values = {"platforms": "//build/kernel/kleaf/impl:android_x86_64"},
-    visibility = ["//visibility:private"],
-)
-
-config_setting(
-    name = "i386",
-    values = {"platforms": "//build/kernel/kleaf/impl:android_i386"},
-    visibility = ["//visibility:private"],
-)
-
-config_setting(
-    name = "arm64",
-    values = {"platforms": "//build/kernel/kleaf/impl:android_arm64"},
-    visibility = ["//visibility:private"],
-)
-
-config_setting(
-    name = "arm",
-    values = {"platforms": "//build/kernel/kleaf/impl:android_arm"},
-    visibility = ["//visibility:private"],
-)
-
 cc_library(
     name = "kselftest_headers_lib",
     hdrs = glob(["tools/testing/selftests/*.h"]),
@@ -1118,9 +1114,9 @@ cc_binary_with_abi(
 cc_binary_with_abi(
     name = "kselftest_breakpoints_breakpoint_test",
     srcs = select({
-        ":x86_64": ["tools/testing/selftests/breakpoints/breakpoint_test.c"],
+        "//build/kernel/kleaf/platforms/config_settings:android_x86_64": ["tools/testing/selftests/breakpoints/breakpoint_test.c"],
-        ":i386": ["tools/testing/selftests/breakpoints/breakpoint_test.c"],
+        "//build/kernel/kleaf/platforms/config_settings:android_i386": ["tools/testing/selftests/breakpoints/breakpoint_test.c"],
-        ":arm64": ["tools/testing/selftests/breakpoints/breakpoint_test_arm64.c"],
+        "//build/kernel/kleaf/platforms/config_settings:android_arm64": ["tools/testing/selftests/breakpoints/breakpoint_test_arm64.c"],
         "//conditions:default": [],
     }),
     copts = _KSELFTEST_COPTS,
@@ -1392,6 +1388,28 @@ cc_binary_with_abi(
     ],
 )
 
+cc_library(
+    name = "kselftest_memfd",
+    srcs = ["tools/testing/selftests/memfd/common.c"],
+    hdrs = ["tools/testing/selftests/memfd/common.h"],
+    copts = _KSELFTEST_COPTS,
+    visibility = ["//visibility:private"],
+    deps = [
+        ":kselftest_headers_lib",
+    ],
+)
+
+cc_binary_with_abi(
+    name = "kselftest_memfd_test",
+    srcs = ["tools/testing/selftests/memfd/memfd_test.c"],
+    copts = _KSELFTEST_COPTS,
+    includes = ["tools/testing/selftests"],
+    path_prefix = _KSELFTEST_DIR,
+    target_compatible_with = ["@platforms//os:android"],
+    visibility = ["//visibility:private"],
+    deps = [":kselftest_memfd"],
+)
+
 cc_binary_with_abi(
     name = "kselftest_mm_compaction_test",
     srcs = ["tools/testing/selftests/mm/compaction_test.c"],
@@ -1634,7 +1652,7 @@ cc_binary_with_abi(
     name = "kselftest_size_test_get_size",
     srcs = ["tools/testing/selftests/size/get_size.c"],
     copts = _KSELFTEST_COPTS + select({
-        ":x86_64": ["-mstackrealign"],
+        "//build/kernel/kleaf/platforms/config_settings:android_x86_64": ["-mstackrealign"],
         "//conditions:default": [],
     }),
     includes = [
@@ -2074,10 +2092,10 @@ cc_binary_with_abi(
 copy_file(
     name = "kselftest_gen_config",
     src = select({
-        ":x86_64": "tools/testing/selftests/android/config_x86_64.xml",
+        "//build/kernel/kleaf/platforms/config_settings:android_x86_64": "tools/testing/selftests/android/config_x86_64.xml",
-        ":i386": "tools/testing/selftests/android/config_x86.xml",
+        "//build/kernel/kleaf/platforms/config_settings:android_i386": "tools/testing/selftests/android/config_x86.xml",
-        ":arm64": "tools/testing/selftests/android/config_arm64.xml",
+        "//build/kernel/kleaf/platforms/config_settings:android_arm64": "tools/testing/selftests/android/config_arm64.xml",
-        ":arm": "tools/testing/selftests/android/config_arm.xml",
+        "//build/kernel/kleaf/platforms/config_settings:android_arm": "tools/testing/selftests/android/config_arm.xml",
     }),
     out = _KSELFTEST_DIR + "/selftests.config",
     visibility = ["//visibility:private"],
@@ -2101,6 +2119,7 @@ android_filegroup(
         ":kselftest_futex_futex_wait_x86_64",
         ":kselftest_gen_config",
         ":kselftest_kcmp_kcmp_test_x86_64",
+        ":kselftest_memfd_test_x86_64",
         ":kselftest_mm_compaction_test_x86_64",
         ":kselftest_mm_hugepage_mmap_x86_64",
         ":kselftest_mm_hugepage_shm_x86_64",
@@ -2305,6 +2324,7 @@ android_filegroup(
         ":kselftest_futex_futex_wait_wouldblock_arm64",
         ":kselftest_gen_config",
         ":kselftest_kcmp_kcmp_test_arm64",
+        ":kselftest_memfd_test_arm64",
         ":kselftest_mm_compaction_test_arm64",
         ":kselftest_mm_hugepage_mmap_arm64",
         ":kselftest_mm_hugepage_shm_arm64",

Documentation/ABI/testing/configfs-usb-gadget-uvc

@@ -342,6 +342,70 @@ Description:	Specific uncompressed frame descriptors
 					   support
 		=========================  =====================================
 
+What:           /config/usb-gadget/gadget/functions/uvc.name/streaming/framebased
+Date:           Sept 2024
+KernelVersion:  5.15
+Description:    Framebased format descriptors
+
+What:           /config/usb-gadget/gadget/functions/uvc.name/streaming/framebased/name
+Date:           Sept 2024
+KernelVersion:  5.15
+Description:    Specific framebased format descriptors
+
+                ==================      =======================================
+                bFormatIndex            unique id for this format descriptor;
+                                        only defined after parent header is
+                                        linked into the streaming class;
+                                        read-only
+                bmaControls             this format's data for bmaControls in
+                                        the streaming header
+                bmInterlaceFlags        specifies interlace information,
+                                        read-only
+                bAspectRatioY           the X dimension of the picture aspect
+                                        ratio, read-only
+                bAspectRatioX           the Y dimension of the picture aspect
+                                        ratio, read-only
+                bDefaultFrameIndex      optimum frame index for this stream
+                bBitsPerPixel           number of bits per pixel used to
+                                        specify color in the decoded video
+                                        frame
+                guidFormat              globally unique id used to identify
+                                        stream-encoding format
+                ==================      =======================================
+
+What:           /config/usb-gadget/gadget/functions/uvc.name/streaming/framebased/name/name
+Date:           Sept 2024
+KernelVersion:  5.15
+Description:    Specific framebased frame descriptors
+
+                =========================  =====================================
+                bFrameIndex                unique id for this framedescriptor;
+                                           only defined after parent format is
+                                           linked into the streaming header;
+                                           read-only
+                dwFrameInterval            indicates how frame interval can be
+                                           programmed; a number of values
+                                           separated by newline can be specified
+                dwDefaultFrameInterval     the frame interval the device would
+                                           like to use as default
+                dwBytesPerLine             Specifies the number of bytes per line
+                                           of video for packed fixed frame size
+                                           formats, allowing the receiver to
+                                           perform stride alignment of the video.
+                                           If the bVariableSize value (above) is
+                                           TRUE (1), or if the format does not
+                                           permit such alignment, this value shall
+                                           be set to zero (0).
+                dwMaxBitRate               the maximum bit rate at the shortest
+                                           frame interval in bps
+                dwMinBitRate               the minimum bit rate at the longest
+                                           frame interval in bps
+                wHeight                    height of decoded bitmap frame in px
+                wWidth                     width of decoded bitmam frame in px
+                bmCapabilities             still image support, fixed frame-rate
+                                           support
+                =========================  =====================================
+
 What:		/config/usb-gadget/gadget/functions/uvc.name/streaming/header
 Date:		Dec 2014
 KernelVersion:	4.0

Documentation/ABI/testing/sysfs-fs-f2fs

@@ -311,10 +311,13 @@ Description:	Do background GC aggressively when set. Set to 0 by default.
 		GC approach and turns SSR mode on.
 		gc urgent low(2): lowers the bar of checking I/O idling in
 		order to process outstanding discard commands and GC a
-		little bit aggressively. uses cost benefit GC approach.
+		little bit aggressively. always uses cost benefit GC approach,
+		and will override age-threshold GC approach if ATGC is enabled
+		at the same time.
 		gc urgent mid(3): does GC forcibly in a period of given
 		gc_urgent_sleep_time and executes a mid level of I/O idling check.
-		uses cost benefit GC approach.
+		always uses cost benefit GC approach, and will override
+		age-threshold GC approach if ATGC is enabled at the same time.
 
 What:		/sys/fs/f2fs/<disk>/gc_urgent_sleep_time
 Date:		August 2017
@@ -819,3 +822,9 @@ Description:	It controls the valid block ratio threshold not to trigger excessiv
 		for zoned deivces. The initial value of it is 95(%). F2FS will stop the
 		background GC thread from intiating GC for sections having valid blocks
 		exceeding the ratio.
+
+What:		/sys/fs/f2fs/<disk>/max_read_extent_count
+Date:		November 2024
+Contact:	"Chao Yu" <chao@kernel.org>
+Description:	It controls max read extent count for per-inode, the value of threshold
+		is 10240 by default.

Documentation/admin-guide/kernel-parameters.txt

@@ -6472,6 +6472,15 @@
 			<deci-seconds>: poll all this frequency
 			0: no polling (default)
 
+	thp_anon=	[KNL]
+			Format: <size>,<size>[KMG]:<state>;<size>-<size>[KMG]:<state>
+			state is one of "always", "madvise", "never" or "inherit".
+			Control the default behavior of the system with respect
+			to anonymous transparent hugepages.
+			Can be used multiple times for multiple anon THP sizes.
+			See Documentation/admin-guide/mm/transhuge.rst for more
+			details.
+
 	threadirqs	[KNL]
 			Force threading of all interrupt handlers except those
 			marked explicitly IRQF_NO_THREAD.

Documentation/admin-guide/mm/transhuge.rst

@@ -284,13 +284,37 @@ processes. Exceeding the number would block the collapse::
 
 A higher value may increase memory footprint for some workloads.
 
-Boot parameter
+Boot parameters
-==============
+===============
 
-You can change the sysfs boot time defaults of Transparent Hugepage
+You can change the sysfs boot time default for the top-level "enabled"
-Support by passing the parameter ``transparent_hugepage=always`` or
+control by passing the parameter ``transparent_hugepage=always`` or
-``transparent_hugepage=madvise`` or ``transparent_hugepage=never``
+``transparent_hugepage=madvise`` or ``transparent_hugepage=never`` to the
-to the kernel command line.
+kernel command line.
+
+Alternatively, each supported anonymous THP size can be controlled by
+passing ``thp_anon=<size>,<size>[KMG]:<state>;<size>-<size>[KMG]:<state>``,
+where ``<size>`` is the THP size (must be a power of 2 of PAGE_SIZE and
+supported anonymous THP)  and ``<state>`` is one of ``always``, ``madvise``,
+``never`` or ``inherit``.
+
+For example, the following will set 16K, 32K, 64K THP to ``always``,
+set 128K, 512K to ``inherit``, set 256K to ``madvise`` and 1M, 2M
+to ``never``::
+
+	thp_anon=16K-64K:always;128K,512K:inherit;256K:madvise;1M-2M:never
+
+``thp_anon=`` may be specified multiple times to configure all THP sizes as
+required. If ``thp_anon=`` is specified at least once, any anon THP sizes
+not explicitly configured on the command line are implicitly set to
+``never``.
+
+``transparent_hugepage`` setting only affects the global toggle. If
+``thp_anon`` is not specified, PMD_ORDER THP will default to ``inherit``.
+However, if a valid ``thp_anon`` setting is provided by the user, the
+PMD_ORDER THP policy will be overridden. If the policy for PMD_ORDER
+is not defined within a valid ``thp_anon``, its policy will default to
+``never``.
 
 Hugepages in tmpfs/shmem
 ========================

Documentation/csf_sync_state_dump.rst

@@ -1,58 +1,55 @@
-# SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note
+.. SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note
-#
-# (C) COPYRIGHT 2022-2023 ARM Limited. All rights reserved.
-#
-# This program is free software and is provided to you under the terms of the
-# GNU General Public License version 2 as published by the Free Software
-# Foundation, and any use by you of this program is subject to the terms
-# of such GNU license.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with this program; if not, you can access it online at
-# http://www.gnu.org/licenses/gpl-2.0.html.
-#
-#
 
-DebugFS interface:
+==================
-------------------
+DebugFS interface
+==================
+
+**Copyright:** \(C) 2022-2024 ARM Limited. All rights reserved.
+..
+    This program is free software and is provided to you under the terms of the
+    GNU General Public License version 2 as published by the Free Software
+    Foundation, and any use by you of this program is subject to the terms
+    of such GNU license.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program; if not, you can access it online at
+    http://www.gnu.org/licenses/gpl-2.0.html.
 
 A new per-kbase-context debugfs file called csf_sync has been implemented
 which captures the current KCPU & GPU queue state of the not-yet-completed
 operations and displayed through the debugfs file.
-This file is at:
+This file is at
-=======================================================
-/sys/kernel/debug/mali0/ctx/<pid>_<context id>/csf_sync
-=======================================================
 
-Output Format:
+::
-----------------
+
+        /sys/kernel/debug/mali0/ctx/<pid>_<context id>/csf_sync
+
+
+Output Format
+-------------
 
 The csf_sync file contains important data for the currently active queues.
 This data is formatted into two segments, which are separated by a
 pipe character: the common properties and the operation-specific properties.
 
-Common Properties:
+Common Properties
-------------------
+-----------------
 
 * Queue type: GPU or KCPU.
 * kbase context id and the queue id.
-* If the queue type is a GPU queue then the group handle is also noted,
+* If the queue type is a GPU queue then the group handle is also noted,in the middle of the other two IDs. The slot value is also dumped.
-in the middle of the other two IDs. The slot value is also dumped.
 * Execution status, which can either be 'P' for pending or 'S' for started.
-* Command type is then output which indicates the type of dependency
+* Command type is then output which indicates the type of dependency (i.e. wait or signal).
-(i.e. wait or signal).
+* Object address which is a pointer to the sync object that the command operates on.
-* Object address which is a pointer to the sync object that the
-command operates on.
-* The live value, which is the value of the synchronization object
-at the time of dumping. This could help to determine why wait
-operations might be blocked.
 
-Operation-Specific Properties:
+* The live value, which is the value of the synchronization object at the time of dumping. This could help to determine why wait operations might be blocked.
+
+Operation-Specific Properties
 ------------------------------
 
 The operation-specific values for KCPU queue fence operations
@@ -67,48 +64,49 @@ which are always shown; the argument value to wait on or set/add to,
 and the operation type (set/add) or wait condition (e.g. LE, GT, GE).
 
 Examples
---------
+========
+
 GPU Queue Example
 ------------------
 
 The following output is of a GPU queue, from a process that has a KCTX ID of 52,
 is in Queue Group (CSG) 0, and has Queue ID 0. It has started and is waiting on
-the object at address 0x0000007f81ffc800. The live value is 0,
+the object at address **0x0000007f81ffc800**. The live value is 0,
 as is the arg value. However, the operation "op" is GT, indicating it's waiting
 for the live value to surpass the arg value:
 
-======================================================================================================================================
+::
-queue:GPU-52-0-0 exec:S cmd:SYNC_WAIT slot:4 obj:0x0000007f81ffc800 live_value:0x0000000000000000 | op:gt arg_value:0x0000000000000000
+
-======================================================================================================================================
+        queue:GPU-52-0-0 exec:S cmd:SYNC_WAIT slot:4 obj:0x0000007f81ffc800 live_value:0x0000000000000000 | op:gt arg_value:0x0000000000000000
 
 The following is an example of GPU queue dump, where the SYNC SET operation
 is blocked by the preceding SYNC WAIT operation. This shows two GPU queues,
 with the same KCTX ID of 8, Queue Group (CSG) 0, and Queue ID 0. The SYNC WAIT
 operation has started, while the SYNC SET is pending, blocked by the SYNC WAIT.
 Both operations are on the same slot, 2 and have live value of 0. The SYNC WAIT
-is waiting on the object at address 0x0000007f81ffc800, while the SYNC SET will
+is waiting on the object at address **0x0000007f81ffc800**, while the SYNC SET will
-set the object at address 0x00000000a3bad4fb when it is unblocked.
+set the object at address **0x00000000a3bad4fb** when it is unblocked.
 The operation "op" is GT for the SYNC WAIT, indicating it's waiting for the
 live value to surpass the arg value, while the operation and arg value for the
-SYNC SET is "set" and "1" respectively:
+SYNC SET is "set" and "1" respectively.
 
-======================================================================================================================================
+::
-queue:GPU-8-0-0 exec:S cmd:SYNC_WAIT slot:2 obj:0x0000007f81ffc800 live_value:0x0000000000000000 | op:gt arg_value:0x0000000000000000
+
-queue:GPU-8-0-0 exec:P cmd:SYNC_SET slot:2 obj:0x00000000a3bad4fb live_value:0x0000000000000000 | op:set arg_value:0x0000000000000001
+        queue:GPU-8-0-0 exec:S cmd:SYNC_WAIT slot:2 obj:0x0000007f81ffc800 live_value:0x0000000000000000 | op:gt arg_value:0x0000000000000000
-======================================================================================================================================
+        queue:GPU-8-0-0 exec:P cmd:SYNC_SET slot:2 obj:0x00000000a3bad4fb live_value:0x0000000000000000 | op:set arg_value:0x0000000000000001
 
 KCPU Queue Example
 ------------------
 
 The following is an example of a KCPU queue, from a process that has
 a KCTX ID of 0 and has Queue ID 1. It has started and is waiting on the
-object at address 0x0000007fbf6f2ff8. The live value is currently 0 with
+object at address **0x0000007fbf6f2ff8**. The live value is currently 0 with
 the "op" being GT indicating it is waiting on the live value to
 surpass the arg value.
 
-===============================================================================================================================
+::
-queue:KCPU-0-1 exec:S cmd:CQS_WAIT_OPERATION obj:0x0000007fbf6f2ff8 live_value:0x0000000000000000 | op:gt arg_value: 0x00000000
+
-===============================================================================================================================
+        queue:KCPU-0-1 exec:S cmd:CQS_WAIT_OPERATION obj:0x0000007fbf6f2ff8 live_value:0x0000000000000000 | op:gt arg_value: 0x00000000
 
 CSF Sync State Dump For Fence Signal Timeouts
 ---------------------------------------------
@@ -142,18 +140,23 @@ which is written to, to turn this feature on and off.
 
 Example:
 --------
-when writing to fence_signal_timeout_enable entry:
+when writing to fence_signal_timeout_enable entry
-echo 1 > /sys/kernel/debug/mali0/fence_signal_timeout_enable -> feature is enabled.
+
-echo 0 > /sys/kernel/debug/mali0/fence_signal_timeout_enable -> feature is disabled.
+::
+
+        echo 1 > /sys/kernel/debug/mali0/fence_signal_timeout_enable -> feature is enabled.
+        echo 0 > /sys/kernel/debug/mali0/fence_signal_timeout_enable -> feature is disabled.
 
 It is also possible to read from this file to check if the feature is currently
 enabled or not checking the return value of fence_signal_timeout_enable.
 
 Example:
 --------
-when reading from fence_signal_timeout_enable entry, if:
+when reading from fence_signal_timeout_enable entry, if
-cat /sys/kernel/debug/mali0/fence_signal_timeout_enable returns 1 -> feature is enabled.
+::
-cat /sys/kernel/debug/mali0/fence_signal_timeout_enable returns 0 -> feature is disabled.
+
+        cat /sys/kernel/debug/mali0/fence_signal_timeout_enable returns 1 -> feature is enabled.
+        cat /sys/kernel/debug/mali0/fence_signal_timeout_enable returns 0 -> feature is disabled.
 
 Update Timer Duration
 ---------------------
@@ -163,11 +166,15 @@ milliseconds.
 
 Example:
 --------
-cat /sys/kernel/debug/mali0/fence_signal_timeout_ms
+::
+
+        cat /sys/kernel/debug/mali0/fence_signal_timeout_ms
 
 The 'fence_signal_timeout_ms' debugfs entry can also be written to, to update
 the time in milliseconds.
 
 Example:
 --------
-echo 10000 > /sys/kernel/debug/mali0/fence_signal_timeout_ms
+::
+
+        echo 10000 > /sys/kernel/debug/mali0/fence_signal_timeout_ms

Documentation/dev-tools/kselftest.rst

@@ -255,9 +255,21 @@ Contributing new tests (details)
 
    TEST_PROGS_EXTENDED, TEST_GEN_PROGS_EXTENDED mean it is the
    executable which is not tested by default.
+
    TEST_FILES, TEST_GEN_FILES mean it is the file which is used by
    test.
 
+   TEST_INCLUDES is similar to TEST_FILES, it lists files which should be
+   included when exporting or installing the tests, with the following
+   differences:
+
+    * symlinks to files in other directories are preserved
+    * the part of paths below tools/testing/selftests/ is preserved when
+      copying the files to the output directory
+
+   TEST_INCLUDES is meant to list dependencies located in other directories of
+   the selftests hierarchy.
+
  * First use the headers inside the kernel source and/or git repo, and then the
    system headers.  Headers for the kernel release as opposed to headers
    installed by the distro on the system should be the primary focus to be able

Documentation/devicetree/bindings/arm/arm,coresight-mali-source.yaml

@@ -0,0 +1,163 @@
+# SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note
+#
+# (C) COPYRIGHT 2022-2024 ARM Limited. All rights reserved.
+#
+# This program is free software and is provided to you under the terms of the
+# GNU General Public License version 2 as published by the Free Software
+# Foundation, and any use by you of this program is subject to the terms
+# of such GNU license.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, you can access it online at
+# http://www.gnu.org/licenses/gpl-2.0.html.
+#
+#
+%YAML 1.2
+---
+$id: http://devicetree.org/schemas/arm/arm,coresight-mali-source.yaml#
+$schema: http://devicetree.org/meta-schemas/core.yaml#
+
+title: ARM CoreSight Mali Source integration
+
+maintainers:
+  - ARM Ltd.
+
+description: |
+  See Documentation/trace/coresight/coresight.rst for detailed information
+  about Coresight.
+
+  This documentation will cover Mali specific devicetree integration.
+
+  References to Sink ports are given as examples. Access to Sink is specific
+  to an implementation and would require dedicated kernel modules.
+
+  Arm Mali GPU are supporting 3 different sources: ITM, ETM, ELA
+
+  ELA source configuration via SysFS entries:
+
+    The register values used by CoreSight for ELA can be configured using SysFS
+    interfaces. This implicitly includes configuring the ELA for independent or
+    shared JCN request and response channels.
+
+properties:
+  compatible:
+    enum:
+      - arm,coresight-mali-source-itm
+      - arm,coresight-mali-source-etm
+      - arm,coresight-mali-source-ela
+
+  gpu:
+    minItems: 1
+    maxItems: 1
+    description:
+      Phandle to a Mali GPU definition
+
+  port:
+    description:
+      Output connection to CoreSight Sink Trace bus.
+
+      Legacy binding between Coresight Sources and CoreSight Sink.
+      For Linux kernel < v4.20.
+    $ref: /schemas/graph.yaml#/properties/port
+
+  out-ports:
+    description:
+      Binding between Coresight Sources and CoreSight Sink.
+      For Linux kernel >= v4.20.
+    $ref: /schemas/graph.yaml#/properties/ports
+
+    properties:
+      port:
+        description: Output connection to CoreSight Sink Trace bus.
+        $ref: /schemas/graph.yaml#/properties/port
+
+required:
+  - compatible
+  - gpu
+  - port
+  - out-ports
+
+additionalProperties: false
+
+examples:
+
+# A Sink node without legacy CoreSight connections
+  - |
+    mali-source-itm {
+        compatible = "arm,coresight-mali-source-itm";
+        gpu = <&gpu>;
+
+        out-ports {
+            port {
+                mali_source_itm_out_port0: endpoint {
+                    remote-endpoint = <&mali_sink_in_port0>;
+                };
+            };
+        };
+    };
+
+    mali-source-ela {
+        compatible = "arm,coresight-mali-source-ela";
+        gpu = <&gpu>;
+
+        out-ports {
+            port {
+                mali_source_ela_out_port0: endpoint {
+                    remote-endpoint = <&mali_sink_in_port1>;
+                };
+            };
+        };
+    };
+
+    mali-source-etm {
+        compatible = "arm,coresight-mali-source-etm";
+        gpu = <&gpu>;
+
+        out-ports {
+            port {
+                mali_source_etm_out_port0: endpoint {
+                    remote-endpoint = <&mali_sink_in_port2>;
+                };
+            };
+        };
+    };
+
+# A Sink node with legacy CoreSight connections
+  - |
+    mali-source-itm {
+        compatible = "arm,coresight-mali-source-itm";
+        gpu = <&gpu>;
+
+        port {
+            mali_source_itm_out_port0: endpoint {
+                remote-endpoint = <&mali_sink_in_port0>;
+            };
+        };
+    };
+
+    mali-source-etm {
+        compatible = "arm,coresight-mali-source-etm";
+        gpu = <&gpu>;
+
+        port {
+            mali_source_etm_out_port0: endpoint {
+                remote-endpoint = <&mali_sink_in_port1>;
+            };
+        };
+    };
+
+    mali-source-ela {
+        compatible = "arm,coresight-mali-source-ela";
+        gpu = <&gpu>;
+
+        port {
+            mali_source_ela_out_port0: endpoint {
+                remote-endpoint = <&mali_sink_in_port2>;
+            };
+        };
+    };

Documentation/devicetree/bindings/arm/mali-coresight-source.txt

@@ -1,116 +0,0 @@
-# SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note
-#
-# (C) COPYRIGHT 2023 ARM Limited. All rights reserved.
-#
-# This program is free software and is provided to you under the terms of the
-# GNU General Public License version 2 as published by the Free Software
-# Foundation, and any use by you of this program is subject to the terms
-# of such GNU license.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with this program; if not, you can access it online at
-# http://www.gnu.org/licenses/gpl-2.0.html.
-#
-#
-=====================================
-ARM CoreSight Mali Source integration
-=====================================
-
-See Documentation/trace/coresight/coresight.rst for detailed information
-about Coresight.
-
-This documentation will cover Mali specific devicetree integration.
-
-References to Sink ports are given as examples. Access to Sink is specific
-to an implementation and would require dedicated kernel modules.
-
-ARM Coresight Mali Source ITM
-=============================
-
-Required properties
--------------------
-
-- compatible: Has to be "arm,coresight-mali-source-itm"
-- gpu : phandle to a Mali GPU definition
-- port:
-  - endpoint:
-    - remote-endpoint: phandle to a Coresight sink port
-
-Example
--------
-
-mali-source-itm {
-  compatible = "arm,coresight-mali-source-itm";
-  gpu = <&gpu>;
-  port {
-    mali_source_itm_out_port0: endpoint {
-      remote-endpoint = <&mali_sink_in_port0>;
-    };
-  };
-};
-
-ARM Coresight Mali Source ETM
-=============================
-
-Required properties
--------------------
-
-- compatible: Has to be "arm,coresight-mali-source-etm"
-- gpu : phandle to a Mali GPU definition
-- port:
-  - endpoint:
-    - remote-endpoint: phandle to a Coresight sink port
-
-Example
--------
-
-mali-source-etm {
-  compatible = "arm,coresight-mali-source-etm";
-  gpu = <&gpu>;
-  port {
-    mali_source_etm_out_port0: endpoint {
-      remote-endpoint = <&mali_sink_in_port1>;
-    };
-  };
-};
-
-ARM Coresight Mali Source ELA
-=============================
-
-Required properties
--------------------
-
-- compatible: Has to be "arm,coresight-mali-source-ela"
-- gpu : phandle to a Mali GPU definition
-- port:
-  - endpoint:
-    - remote-endpoint: phandle to a Coresight sink port
-
-Example: Split JCN request/response channel
---------------------------------------------
-
-This examples applies to implementations with a total of 5 signal groups,
-where JCN request and response are assigned to independent or shared
-channels depending on the GPU model.
-
-mali-source-ela {
-  compatible = "arm,coresight-mali-source-ela";
-  gpu = <&gpu>;
-  port {
-    mali_source_ela_out_port0: endpoint {
-      remote-endpoint = <&mali_sink_in_port2>;
-    };
-  };
-};
-
-SysFS Configuration
---------------------------------------------
-
-The register values used by CoreSight for ELA can be configured using SysFS
-interfaces. This implicitly includes configuring the ELA for independent or
-shared JCN request and response channels.

Documentation/devicetree/bindings/arm/mali-midgard.txt

@@ -1,6 +1,6 @@
 # SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note
 #
-# (C) COPYRIGHT 2013-2023 ARM Limited. All rights reserved.
+# (C) COPYRIGHT 2013-2024 ARM Limited. All rights reserved.
 #
 # This program is free software and is provided to you under the terms of the
 # GNU General Public License version 2 as published by the Free Software
@@ -35,14 +35,21 @@ Optional:
 
 - clocks : One or more pairs of phandle to clock and clock specifier
            for the Mali device. The order is important: the first clock
-           shall correspond to the "clk_mali" source, while the second clock
+           shall correspond to the "clk_mali" source. Other clocks are optional
-           (that is optional) shall correspond to the "shadercores" source.
+           and, if present, they shall correspond to domains like "shadercores",
-- clock-names : Shall be set to: "clk_mali", "shadercores".
+           which is available for all GPUs, or "coregroup" and "neuralengines"
+           which are available for newer GPUs. Also notice that the "neuralengines"
+           clock domain, if present, doesn't expect a corresponding regulator.
+- clock-names : Shall be set to values like: "clk_mali", "shadercores", "coregroup",
+                "neuralengines". Only the first one is mandatory. Most GPUs
+                support only the first two entries.
 - mali-supply : Phandle to the top level regulator for the Mali device.
                 Refer to
 Documentation/devicetree/bindings/regulator/regulator.txt for details.
 - shadercores-supply : Phandle to shader cores regulator for the Mali device.
                        This is optional.
+- coregroup-supply: Phandle to core group regulator for the Mali device.
+                    This is optional and only available on newer GPUs.
 - operating-points-v2 : Refer to Documentation/devicetree/bindings/power/mali-opp.txt
 for details.
 - quirks-gpu : Used to write to the JM_CONFIG or CSF_CONFIG register.
@@ -133,6 +140,10 @@ for details.
 		   set and the setting coresponding to the SYSC_ALLOC register.
 - propagate-bits: Used to write to L2_CONFIG.PBHA_HWU. This bitset establishes which
 		   PBHA bits are propagated on the AXI bus.
+- mma-wa-id: Sets the PBHA ID to be used for the PBHA override based MMA violation workaround.
+	     The read and write allocation override bits for the PBHA are set to NONCACHEABLE
+	     and the driver encodes the PBHA ID in the PTEs where this workaround is to be applied.
+	     Valid values are from 1 to 15.
 
 
 Example for a Mali GPU with 1 clock and 1 regulator:
@@ -242,6 +253,7 @@ gpu@0xfc010000 {
     pbha {
         int-id-override = <2 0x32>, <9 0x05>, <16 0x32>;
         propagate-bits = /bits/ 8 <0x03>;
+        mma-wa-id = <2>;
     };
     ...
 };

Documentation/devicetree/bindings/connector/usb-connector.yaml

@@ -231,6 +231,46 @@ properties:
       SNK_READY for non-pd link.
     type: boolean
 
+  sink-wait-cap-time-ms:
+    description: Represents the max time in ms that USB Type-C port (in sink
+      role) should wait for the port partner (source role) to send source caps.
+      SinkWaitCap timer starts when port in sink role attaches to the source.
+      This timer will stop when sink receives PD source cap advertisement before
+      timeout in which case it'll move to capability negotiation stage. A
+      timeout leads to a hard reset message by the port.
+    minimum: 310
+    maximum: 620
+    default: 310
+
+  ps-source-off-time-ms:
+    description: Represents the max time in ms that a DRP in source role should
+      take to turn off power after the PsSourceOff timer starts. PsSourceOff
+      timer starts when a sink's PHY layer receives EOP of the GoodCRC message
+      (corresponding to an Accept message sent in response to a PR_Swap or a
+      FR_Swap request). This timer stops when last bit of GoodCRC EOP
+      corresponding to the received PS_RDY message is transmitted by the PHY
+      layer. A timeout shall lead to error recovery in the type-c port.
+    minimum: 750
+    maximum: 920
+    default: 920
+
+  cc-debounce-time-ms:
+    description: Represents the max time in ms that a port shall wait to
+      determine if it's attached to a partner.
+    minimum: 100
+    maximum: 200
+    default: 200
+
+  sink-bc12-completion-time-ms:
+    description: Represents the max time in ms that a port in sink role takes
+      to complete Battery Charger (BC1.2) Detection. BC1.2 detection is a
+      hardware mechanism, which in some TCPC implementations, can run in
+      parallel once the Type-C connection state machine reaches the "potential
+      connect as sink" state. In TCPCs where this causes delays to respond to
+      the incoming PD messages, sink-bc12-completion-time-ms is used to delay
+      PD negotiation till BC1.2 detection completes.
+    default: 0
+
 dependencies:
   sink-vdos-v1: [ sink-vdos ]
   sink-vdos: [ sink-vdos-v1 ]
@@ -316,7 +356,7 @@ examples:
     };
 
   # USB-C connector attached to a typec port controller(ptn5110), which has
-  # power delivery support and enables drp.
+  # power delivery support, explicitly defines time properties and enables drp.
   - |
     #include <dt-bindings/usb/pd.h>
     typec: ptn5110 {
@@ -329,6 +369,10 @@ examples:
             sink-pdos = <PDO_FIXED(5000, 2000, PDO_FIXED_USB_COMM)
                          PDO_VAR(5000, 12000, 2000)>;
             op-sink-microwatt = <10000000>;
+            sink-wait-cap-time-ms = <465>;
+            ps-source-off-time-ms = <835>;
+            cc-debounce-time-ms = <101>;
+            sink-bc12-completion-time-ms = <500>;
         };
     };
 

Documentation/devicetree/bindings/firmware/mediatek,geniezone.yaml

@@ -10,7 +10,7 @@ maintainers:
   - Yingshiuan Pan <yingshiuan.pan@mediatek.com>
 
 description:
-  GenieZone is a proprietary type-II hypervisor firmware developed by MediaTek,
+  GenieZone is a proprietary type-I hypervisor firmware developed by MediaTek,
   providing an isolated execution environment for mTEE (MediaTek Trusted
   Execution Environment) and AVF (Android Virtualization Framework) virtual
   machines. This binding facilitates the integration of GenieZone into the

Documentation/devicetree/bindings/usb/maxim,max33359.yaml

@@ -69,6 +69,7 @@ examples:
                                        PDO_FIXED_DATA_SWAP |
                                        PDO_FIXED_DUAL_ROLE)
                                        PDO_FIXED(9000, 2000, 0)>;
+                sink-bc12-completion-time-ms = <500>;
             };
         };
     };

Documentation/dma-buf-test-exporter.rst

@@ -0,0 +1,42 @@
+..  SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note
+
+=====================
+dma-buf-test-exporter
+=====================
+
+**Copyright:** \(C) 2012-2013, 2020-2022, 2024 ARM Limited. All rights reserved.
+
+..
+    This program is free software and is provided to you under the terms of the
+    GNU General Public License version 2 as published by the Free Software
+    Foundation, and any use by you of this program is subject to the terms
+    of such GNU license.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program; if not, you can access it online at
+    http://www.gnu.org/licenses/gpl-2.0.html.
+
+Overview
+--------
+
+The dma-buf-test-exporter is a simple exporter of dma_buf objects.
+It has a private API to allocate and manipulate the buffers which are represented as dma_buf fds.
+The private API allows:
+
+* simple allocation of physically non-contiguous buffers
+* simple allocation of physically contiguous buffers
+* query kernel side API usage stats (number of attachments, number of mappings, mmaps)
+* failure mode configuration (fail attach, mapping, mmap)
+* kernel side memset of buffers
+
+The buffers support all of the dma_buf API, including mmap.
+
+It supports being compiled as a module both in-tree and out-of-tree.
+
+See **include/uapi/base/arm/dma_buf_test_exporter/dma-buf-test-exporter.h** for the ioctl interface.
+See **Documentation/dma-buf-sharing.txt** for details on dma_buf.

Documentation/dma-buf-test-exporter.txt

@@ -1,42 +0,0 @@
-# SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note
-#
-# (C) COPYRIGHT 2012-2013, 2020-2022 ARM Limited. All rights reserved.
-#
-# This program is free software and is provided to you under the terms of the
-# GNU General Public License version 2 as published by the Free Software
-# Foundation, and any use by you of this program is subject to the terms
-# of such GNU license.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with this program; if not, you can access it online at
-# http://www.gnu.org/licenses/gpl-2.0.html.
-#
-#
-
-=====================
-dma-buf-test-exporter
-=====================
-
-Overview
---------
-
-The dma-buf-test-exporter is a simple exporter of dma_buf objects.
-It has a private API to allocate and manipulate the buffers which are represented as dma_buf fds.
-The private API allows:
-* simple allocation of physically non-contiguous buffers
-* simple allocation of physically contiguous buffers
-* query kernel side API usage stats (number of attachments, number of mappings, mmaps)
-* failure mode configuration (fail attach, mapping, mmap)
-* kernel side memset of buffers
-
-The buffers support all of the dma_buf API, including mmap.
-
-It supports being compiled as a module both in-tree and out-of-tree.
-
-See include/uapi/base/arm/dma_buf_test_exporter/dma-buf-test-exporter.h for the ioctl interface.
-See Documentation/dma-buf-sharing.txt for details on dma_buf.

Documentation/filesystems/f2fs.rst

@@ -943,3 +943,47 @@ NVMe Zoned Namespace devices
   can start before the zone-capacity and span across zone-capacity boundary.
   Such spanning segments are also considered as usable segments. All blocks
   past the zone-capacity are considered unusable in these segments.
+
+Device aliasing feature
+-----------------------
+
+f2fs can utilize a special file called a "device aliasing file." This file allows
+the entire storage device to be mapped with a single, large extent, not using
+the usual f2fs node structures. This mapped area is pinned and primarily intended
+for holding the space.
+
+Essentially, this mechanism allows a portion of the f2fs area to be temporarily
+reserved and used by another filesystem or for different purposes. Once that
+external usage is complete, the device aliasing file can be deleted, releasing
+the reserved space back to F2FS for its own use.
+
+<use-case>
+
+# ls /dev/vd*
+/dev/vdb (32GB) /dev/vdc (32GB)
+# mkfs.ext4 /dev/vdc
+# mkfs.f2fs -c /dev/vdc@vdc.file /dev/vdb
+# mount /dev/vdb /mnt/f2fs
+# ls -l /mnt/f2fs
+vdc.file
+# df -h
+/dev/vdb                            64G   33G   32G  52% /mnt/f2fs
+
+# mount -o loop /dev/vdc /mnt/ext4
+# df -h
+/dev/vdb                            64G   33G   32G  52% /mnt/f2fs
+/dev/loop7                          32G   24K   30G   1% /mnt/ext4
+# umount /mnt/ext4
+
+# f2fs_io getflags /mnt/f2fs/vdc.file
+get a flag on /mnt/f2fs/vdc.file ret=0, flags=nocow(pinned),immutable
+# f2fs_io setflags noimmutable /mnt/f2fs/vdc.file
+get a flag on noimmutable ret=0, flags=800010
+set a flag on /mnt/f2fs/vdc.file ret=0, flags=noimmutable
+# rm /mnt/f2fs/vdc.file
+# df -h
+/dev/vdb                            64G  753M   64G   2% /mnt/f2fs
+
+So, the key idea is, user can do any file operations on /dev/vdc, and
+reclaim the space after the use, while the space is counted as /data.
+That doesn't require modifying partition size and filesystem format.

Documentation/virt/geniezone/introduction.rst

@@ -6,12 +6,12 @@ GenieZone Introduction
 
 Overview
 ========
-GenieZone hypervisor (gzvm) is a type-1 hypervisor that supports various virtual
+GenieZone hypervisor (gzvm) is a type-I hypervisor that supports various virtual
 machine types and provides security features such as TEE-like scenarios and
 secure boot. It can create guest VMs for security use cases and has
 virtualization capabilities for both platform and interrupt. Although the
 hypervisor can be booted independently, it requires the assistance of GenieZone
-hypervisor kernel driver(also named gzvm) to leverage the ability of Linux
+hypervisor kernel driver (also named gzvm) to leverage the ability of Linux
 kernel for vCPU scheduling, memory management, inter-VM communication and virtio
 backend support.
 
@@ -32,34 +32,34 @@ Features
 
   Direct use of physical memory from VMs is forbidden and designed to be
   dictated to the privilege models managed by GenieZone hypervisor for security
-  reason. With the help of gzvm module, the hypervisor would be able to manipulate
+  reason. With the help of the gzvm module, the hypervisor is able to manipulate
   memory as objects.
 
 - Virtual Platform
 
-  We manage to emulate a virtual mobile platform for guest OS running on guest
+  The gzvm hypervisor emulates a virtual mobile platform for guest OS running on
-  VM. The platform supports various architecture-defined devices, such as
+  guest VM. The platform supports various architecture-defined devices, such as
   virtual arch timer, GIC, MMIO, PSCI, and exception watching...etc.
 
 - Inter-VM Communication
 
-  Communication among guest VMs was provided mainly on RPC. More communication
+  Communication among guest VMs is provided mainly on RPC. More communication
-  mechanisms were to be provided in the future based on VirtIO-vsock.
+  mechanisms will be provided in the future based on VirtIO-vsock.
 
 - Device Virtualization
 
-  The solution is provided using the well-known VirtIO. The gzvm module would
+  The solution is provided using the well-known VirtIO. The gzvm module redirects
-  redirect MMIO traps back to VMM where the virtual devices are mostly emulated.
+  MMIO traps back to VMM where the virtual devices are mostly emulated.
   Ioeventfd is implemented using eventfd for signaling host VM that some IO
   events in guest VMs need to be processed.
 
 - Interrupt virtualization
 
-  All Interrupts during some guest VMs running would be handled by GenieZone
+  All interrupts during some guest VMs running are handled by GenieZone
   hypervisor with the help of gzvm module, both virtual and physical ones.
-  In case there's no guest VM running out there, physical interrupts would be
+  In case there's no guest VM running, physical interrupts are handled by host
-  handled by host VM directly for performance reason. Irqfd is also implemented
+  VM directly for performance reason. Irqfd is also implemented using eventfd
-  using eventfd for accepting vIRQ requests in gzvm module.
+  for accepting vIRQ requests in gzvm module.
 
 Platform architecture component
 ===============================
@@ -74,14 +74,14 @@ Platform architecture component
 
 - vcpu
 
-  The vcpu component is the core of virtualizing aarch64 physical CPU runnable,
+  The vcpu component is the core of virtualizing an aarch64 physical CPU, and it
-  and it controls the vCPU lifecycle including creating, running and destroying.
+  controls the vCPU lifecycle including creating, running and destroying.
-  With self-defined exit handler, the vm component would be able to act
+  With self-defined exit handler, the vm component is able to act accordingly
-  accordingly before terminated.
+  before termination.
 
 - vgic
 
   The vgic component exposes control interfaces to Linux kernel via irqchip, and
   we intend to support all SPI, PPI, and SGI. When it comes to virtual
-  interrupts, the GenieZone hypervisor would write to list registers and trigger
+  interrupts, the GenieZone hypervisor writes to list registers and triggers
   vIRQ injection in guest VMs via GIC.

Makefile

@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0
 VERSION = 6
 PATCHLEVEL = 6
-SUBLEVEL = 56
+SUBLEVEL = 58
 EXTRAVERSION =
 NAME = Pinguïn Aangedreven
 

android/abi_gki_aarch64

@@ -2,3 +2,4 @@
 # commonly used symbols
   module_layout
   __put_task_struct
+  utf8_data_table

android/abi_gki_aarch64.stg.allowed_breaks

@@ -0,0 +1,103 @@
+# How to use this file: http://go/approve-abi-break
+# ABI freeze commit: 666cbbfe5c567ca79da30dccad8b5257ca88f02c
+
+type 'struct shash_alg' changed
+  member 'u64 android_backport_reserved1' was removed
+  member 'u64 android_backport_reserved2' was removed
+  member 'union { int(* finup_mb)(struct shash_desc*, const u8* const*, unsigned int, u8* const*, unsigned int); struct { u64 android_backport_reserved1; }; union { }; }' was added
+  member 'union { unsigned int mb_max_msgs; struct { u64 android_backport_reserved2; }; union { }; }' was added
+
+type 'struct fsverity_info' changed
+  byte size changed from 272 to 264
+  member 'spinlock_t hash_page_init_lock' was removed
+
+type 'enum binder_work_type' changed
+  enumerator 'BINDER_WORK_FROZEN_BINDER' (10) was added
+  ... 1 other enumerator(s) added
+
+type 'struct ufs_clk_scaling' changed
+  member 'bool suspend_on_no_request' was added
+
+type 'struct tty_operations' changed
+  member 'u64 android_kabi_reserved1' was removed
+  member 'union { int(* ldisc_ok)(struct tty_struct*, int); struct { u64 android_kabi_reserved1; }; union { }; }' was added
+
+type 'struct kvm_hyp_iommu' changed
+  member changed from 'hyp_spinlock_t lock' to 'u32 lock'
+    type changed from 'hyp_spinlock_t' = 'union hyp_spinlock' to 'u32' = '__u32' = 'unsigned int'
+      resolved type changed from 'union hyp_spinlock' to 'unsigned int'
+
+type 'struct fsverity_hash_alg' changed
+  member 'int mb_max_msgs' was added
+
+type 'struct pkvm_module_ops' changed
+  member 'u64 android_kabi_reserved1' was removed
+  member 'u64 android_kabi_reserved2' was removed
+  member 'u64 android_kabi_reserved3' was removed
+  member 'union { void(* iommu_flush_unmap_cache)(struct kvm_iommu_paddr_cache*); struct { u64 android_kabi_reserved1; }; union { }; }' was added
+  member 'union { int(* host_stage2_enable_lazy_pte)(u64, u64); struct { u64 android_kabi_reserved2; }; union { }; }' was added
+  member 'union { int(* host_stage2_disable_lazy_pte)(u64, u64); struct { u64 android_kabi_reserved3; }; union { }; }' was added
+
+type 'struct kvm_hyp_iommu' changed
+  member 'u32 unused' was removed
+  member 'u32 lock' was added
+
+type 'struct pkvm_module_ops' changed
+  member 'u64 android_kabi_reserved2' was removed
+  member 'u64 android_kabi_reserved3' was removed
+  member 'union { int(* host_stage2_enable_lazy_pte)(u64, u64); struct { u64 android_kabi_reserved2; }; union { }; }' was added
+  member 'union { int(* host_stage2_disable_lazy_pte)(u64, u64); struct { u64 android_kabi_reserved3; }; union { }; }' was added
+
+11 function symbol(s) removed
+  'int __traceiter_android_rvh_ogki_hiview_hievent_create(void*, unsigned int, void**)'
+  'int __traceiter_android_rvh_ogki_hiview_hievent_destroy(void*, void*)'
+  'int __traceiter_android_rvh_ogki_hiview_hievent_put_integral(void*, void*, const char*, long long, int*)'
+  'int __traceiter_android_rvh_ogki_hiview_hievent_put_string(void*, void*, const char*, const char*, int*)'
+  'int __traceiter_android_rvh_ogki_hiview_hievent_report(void*, void*, int*)'
+  'int __traceiter_android_rvh_ogki_security_audit_log_module_sign(void*, int)'
+  'int __traceiter_android_rvh_ogki_security_audit_log_usercopy(void*, bool, const char*, unsigned long)'
+  'int __traceiter_android_vh_ogki_security_audit_log_cfi(void*, unsigned long, unsigned long*)'
+  'int __traceiter_android_vh_ogki_security_audit_log_setid(void*, u32, u32, u32)'
+  'int __traceiter_android_vh_ogki_tcp_rcv_established_fast_path(void*, struct sock*)'
+  'int __traceiter_android_vh_ogki_tcp_rcv_established_slow_path(void*, struct sock*)'
+
+11 variable symbol(s) removed
+  'struct tracepoint __tracepoint_android_rvh_ogki_hiview_hievent_create'
+  'struct tracepoint __tracepoint_android_rvh_ogki_hiview_hievent_destroy'
+  'struct tracepoint __tracepoint_android_rvh_ogki_hiview_hievent_put_integral'
+  'struct tracepoint __tracepoint_android_rvh_ogki_hiview_hievent_put_string'
+  'struct tracepoint __tracepoint_android_rvh_ogki_hiview_hievent_report'
+  'struct tracepoint __tracepoint_android_rvh_ogki_security_audit_log_module_sign'
+  'struct tracepoint __tracepoint_android_rvh_ogki_security_audit_log_usercopy'
+  'struct tracepoint __tracepoint_android_vh_ogki_security_audit_log_cfi'
+  'struct tracepoint __tracepoint_android_vh_ogki_security_audit_log_setid'
+  'struct tracepoint __tracepoint_android_vh_ogki_tcp_rcv_established_fast_path'
+  'struct tracepoint __tracepoint_android_vh_ogki_tcp_rcv_established_slow_path'
+
+type 'enum ftrace_dump_mode' changed
+  enumerator 'DUMP_PARAM' (3) was added
+
+1 function symbol(s) removed
+  'int __traceiter_android_vh_suitable_migration_target_bypass(void*, struct page*, bool*)'
+
+1 variable symbol(s) removed
+  'struct tracepoint __tracepoint_android_vh_suitable_migration_target_bypass'
+
+type 'struct cgroup_root' changed
+  member 'u8 android_backport_reserved1[28]' was removed
+  member 'union { struct callback_head rcu; struct { u8 android_backport_reserved1[28]; }; union { }; }' was added
+
+1 function symbol(s) removed
+  'int __traceiter_android_vh_mutex_unlock_slowpath_before_wakeq(void*, struct mutex*)'
+
+1 variable symbol(s) removed
+  'struct tracepoint __tracepoint_android_vh_mutex_unlock_slowpath_before_wakeq'
+
+2 function symbol(s) removed
+  'int __traceiter_android_vh_mutex_unlock_slowpath_before_wakeq(void*, struct mutex*)'
+  'int __traceiter_android_vh_suitable_migration_target_bypass(void*, struct page*, bool*)'
+
+2 variable symbol(s) removed
+  'struct tracepoint __tracepoint_android_vh_mutex_unlock_slowpath_before_wakeq'
+  'struct tracepoint __tracepoint_android_vh_suitable_migration_target_bypass'
+

android/abi_gki_aarch64_amlogic

@@ -181,7 +181,9 @@
   clk_put
   clk_register
   clk_register_composite
+  clk_restore_context
   clk_round_rate
+  clk_save_context
   clk_set_max_rate
   clk_set_min_rate
   clk_set_parent
@@ -538,6 +540,15 @@
   dma_sync_single_for_device
   dma_unmap_page_attrs
   dma_unmap_sg_attrs
+  dm_get_device
+  dm_io
+  dm_io_client_create
+  dm_io_client_destroy
+  dm_per_bio_data
+  dm_put_device
+  dm_register_target
+  dm_table_get_mode
+  dm_unregister_target
   d_obtain_alias
   do_SAK
   do_trace_netlink_extack
@@ -726,6 +737,7 @@
   drm_property_blob_get
   drm_property_blob_put
   drm_property_create
+  drm_property_create_blob
   drm_property_create_bool
   drm_property_create_enum
   drm_property_create_range
@@ -1330,6 +1342,7 @@
   mmc_cqe_request_done
   mmc_detect_change
   mmc_free_host
+  mmc_get_ext_csd
   mmc_gpiod_request_cd
   mmc_gpio_get_cd
   mmc_of_parse
@@ -1668,6 +1681,7 @@
   platform_get_irq_byname_optional
   platform_get_resource
   platform_get_resource_byname
+  platform_irq_count
   pm_genpd_add_subdomain
   pm_genpd_init
   pm_genpd_remove
@@ -2192,6 +2206,7 @@
   thermal_zone_device_unregister
   thermal_zone_device_update
   thermal_zone_get_num_trips
+  thermal_zone_get_temp
   __thermal_zone_get_trip
   thermal_zone_get_trip
   thermal_zone_get_zone_by_name

android/abi_gki_aarch64_asr

@@ -51,6 +51,8 @@
   v4l2_ctrl_type_op_log
   v4l2_m2m_buf_done_and_job_finish
   v4l2_m2m_last_buf
+  v4l2_type_names
+  devm_devfreq_register_opp_notifier
 
 # required by jpu_heap.ko
   kmem_cache_size
@@ -64,3 +66,9 @@
 # required by xhci-asr.ko
   extcon_find_edev_by_node
 
+# required by clk-asr.ko
+  clk_register_mux_table
+
+# required by keypad-asr.ko
+  input_device_enabled
+  fwnode_create_software_node

android/abi_gki_aarch64_galaxy

@@ -79,6 +79,7 @@
   __traceiter_android_rvh_report_bug
   __traceiter_android_rvh_try_alloc_pages
   __traceiter_android_rvh_try_alloc_pages_gfp
+  __traceiter_android_rvh_usb_dev_suspend
   __traceiter_android_vh_alloc_contig_range_not_isolated
   __traceiter_android_vh_alloc_pages_slowpath_start
   __traceiter_android_vh_alloc_pages_slowpath_end
@@ -112,6 +113,7 @@
   __traceiter_android_vh_madvise_pageout_swap_entry
   __traceiter_android_vh_madvise_swapin_walk_pmd_entry
   __traceiter_android_vh_meminfo_proc_show
+  __traceiter_android_vh_migration_target_bypass
   __traceiter_android_vh_mmc_update_mmc_queue
   __traceiter_android_vh_si_meminfo_adjust_shmem
   __traceiter_android_vh_shmem_mod_shmem
@@ -130,18 +132,21 @@
   __traceiter_android_vh_smaps_pte_entry
   __traceiter_android_vh_smaps_swap_shared
   __traceiter_android_vh_show_smap_swap_shared
-  __traceiter_android_vh_suitable_migration_target_bypass
   __traceiter_android_vh_split_large_folio_bypass
   __traceiter_android_vh_sync_irq_wait_finish
   __traceiter_android_vh_sync_irq_wait_start
   __traceiter_android_vh_try_to_freeze_todo
   __traceiter_android_vh_try_to_freeze_todo_unfrozen
   __traceiter_android_vh_tune_scan_control
+  __traceiter_android_vh_usb_dev_resume
+  __traceiter_android_vh_usb_new_device_added
   __traceiter_android_vh_use_vm_swappiness
   __traceiter_android_vh_warn_alloc_tune_ratelimit
   __traceiter_android_vh_warn_alloc_show_mem_bypass
   __traceiter_android_vh_watchdog_timer_softlockup
   __traceiter_android_vh_wq_lockup_pool
+  __traceiter_android_vh_xhci_resume
+  __traceiter_android_vh_xhci_suspend
   __traceiter_android_vh_zs_shrinker_adjust
   __traceiter_android_vh_zs_shrinker_bypass
   __traceiter_console
@@ -163,6 +168,7 @@
   __tracepoint_android_rvh_report_bug
   __tracepoint_android_rvh_try_alloc_pages
   __tracepoint_android_rvh_try_alloc_pages_gfp
+  __tracepoint_android_rvh_usb_dev_suspend
   __tracepoint_android_vh_alloc_contig_range_not_isolated
   __tracepoint_android_vh_alloc_pages_slowpath_start
   __tracepoint_android_vh_alloc_pages_slowpath_end
@@ -196,6 +202,7 @@
   __tracepoint_android_vh_madvise_pageout_swap_entry
   __tracepoint_android_vh_madvise_swapin_walk_pmd_entry
   __tracepoint_android_vh_meminfo_proc_show
+  __tracepoint_android_vh_migration_target_bypass
   __tracepoint_android_vh_mmc_update_mmc_queue
   __tracepoint_android_vh_si_meminfo_adjust_shmem
   __tracepoint_android_vh_shmem_mod_shmem
@@ -215,17 +222,20 @@
   __tracepoint_android_vh_smaps_swap_shared
   __tracepoint_android_vh_show_smap_swap_shared
   __tracepoint_android_vh_split_large_folio_bypass
-  __tracepoint_android_vh_suitable_migration_target_bypass
   __tracepoint_android_vh_sync_irq_wait_finish
   __tracepoint_android_vh_sync_irq_wait_start
   __tracepoint_android_vh_try_to_freeze_todo
   __tracepoint_android_vh_try_to_freeze_todo_unfrozen
   __tracepoint_android_vh_tune_scan_control
+  __tracepoint_android_vh_usb_dev_resume
+  __tracepoint_android_vh_usb_new_device_added
   __tracepoint_android_vh_use_vm_swappiness
   __tracepoint_android_vh_warn_alloc_tune_ratelimit
   __tracepoint_android_vh_warn_alloc_show_mem_bypass
   __tracepoint_android_vh_watchdog_timer_softlockup
   __tracepoint_android_vh_wq_lockup_pool
+  __tracepoint_android_vh_xhci_resume
+  __tracepoint_android_vh_xhci_suspend
   __tracepoint_android_vh_zs_shrinker_adjust
   __tracepoint_android_vh_zs_shrinker_bypass
   __tracepoint_console

android/abi_gki_aarch64_honor

@@ -55,6 +55,16 @@
   tty_unlock
   tty_set_ldisc
   tty_kclose
+  android_debug_per_cpu_symbol
+  android_debug_symbol
+  __traceiter_rpm_idle
+  __tracepoint_rpm_idle
+  __traceiter_rpm_suspend
+  __tracepoint_rpm_suspend
+  __traceiter_rpm_resume
+  __tracepoint_rpm_resume
+  __traceiter_rpm_return_int
+  __tracepoint_rpm_return_int
   __kfifo_len_r
   __traceiter_android_vh_killed_process
   __tracepoint_android_vh_killed_process
@@ -112,6 +122,10 @@
   __tracepoint_android_vh_udp_unicast_rcv_skb
   __traceiter_android_vh_udp6_unicast_rcv_skb
   __tracepoint_android_vh_udp6_unicast_rcv_skb
+  __traceiter_android_vh_tcp_rcv_established_fast_path
+  __tracepoint_android_vh_tcp_rcv_established_fast_path
+  __traceiter_android_vh_tcp_rcv_established_slow_path
+  __tracepoint_android_vh_tcp_rcv_established_slow_path
   __tracepoint_android_vh_si_mem_available_adjust
   __traceiter_android_vh_si_mem_available_adjust
   __tracepoint_android_vh_si_meminfo_adjust
@@ -236,3 +250,5 @@
   __traceiter_android_vh_wq_wake_idle_worker
   __tracepoint_android_vh_wq_queue_work
   __tracepoint_android_vh_wq_wake_idle_worker
+  __traceiter_android_vh_mutex_unlock_slowpath_bf_wakeq
+  __tracepoint_android_vh_mutex_unlock_slowpath_bf_wakeq

android/abi_gki_aarch64_mtk

@@ -18,6 +18,7 @@
   alarm_start_relative
   alarm_try_to_cancel
   alloc_chrdev_region
+  alloc_contig_range
   alloc_etherdev_mqs
   alloc_io_pgtable_ops
   alloc_netdev_mqs
@@ -1025,6 +1026,7 @@
   frame_vector_destroy
   frame_vector_to_pages
   frame_vector_to_pfns
+  free_contig_range
   free_io_pgtable_ops
   free_irq
   free_netdev
@@ -1721,6 +1723,8 @@
   netdev_rx_handler_register
   netdev_rx_handler_unregister
   netdev_set_default_ethtool_ops
+  netdev_stats_to_stats64
+  netdev_sw_irq_coalesce_default_on
   netdev_update_features
   netdev_upper_dev_link
   netdev_upper_dev_unlink
@@ -1939,6 +1943,7 @@
   pci_alloc_irq_vectors_affinity
   pci_ats_supported
   pci_bus_type
+  pci_clear_mwi
   pci_device_group
   pci_device_is_present
   pci_dev_put
@@ -1990,6 +1995,7 @@
   pci_save_state
   pci_select_bars
   pci_set_master
+  pci_set_mwi
   pci_set_power_state
   pci_stop_root_bus
   pci_unlock_rescan_remove
@@ -2653,6 +2659,7 @@
   snd_ctl_boolean_mono_info
   snd_jack_set_key
   snd_pcm_format_physical_width
+  snd_pcm_format_set_silence
   snd_pcm_format_width
   snd_pcm_hw_constraint_integer
   snd_pcm_hw_constraint_minmax
@@ -3211,6 +3218,7 @@
   typec_partner_set_identity
   typec_partner_set_pd_revision
   typec_partner_set_svdm_version
+  typec_port_register_altmodes
   typec_register_partner
   typec_register_port
   typec_set_data_role

android/abi_gki_aarch64_oplus

@@ -187,7 +187,9 @@
   tcf_exts_init_ex
   tcf_exts_validate
   tcf_queue_work
+  tcp_cong_avoid_ai
   tcp_hashinfo
+  tcp_reno_undo_cwnd
   touch_atime
   __traceiter_android_rvh_post_init_entity_util_avg
   __traceiter_android_rvh_rtmutex_force_update
@@ -511,6 +513,7 @@
   vfs_path_lookup
   vfs_rename
   vfs_rmdir
+  vfs_splice_read
   vfs_statfs
   vfs_unlink
   __vmalloc_array

android/abi_gki_aarch64_pixel

@@ -24,6 +24,7 @@
   __alloc_skb
   alloc_skb_with_frags
   alloc_workqueue
+  all_vm_events
   alt_cb_patch_nops
   amba_bustype
   amba_driver_register
@@ -305,6 +306,7 @@
   debugfs_create_u8
   debugfs_create_x32
   debugfs_lookup
+  debugfs_lookup_and_remove
   debugfs_remove
   debugfs_rename
   default_llseek
@@ -443,6 +445,7 @@
   devm_power_supply_register
   devm_pwm_get
   devm_register_reboot_notifier
+  devm_register_sys_off_handler
   devm_regmap_add_irq_chip
   __devm_regmap_init
   __devm_regmap_init_i2c
@@ -577,6 +580,7 @@
   dma_unmap_resource
   dma_unmap_sg_attrs
   do_SAK
+  do_send_sig_info
   do_trace_netlink_extack
   do_wait_intr_irq
   down
@@ -812,6 +816,7 @@
   drop_reasons_unregister_subsys
   dump_backtrace
   dump_stack
+  dump_tasks
   dw_handle_msi_irq
   dw_pcie_find_capability
   dw_pcie_host_init
@@ -931,6 +936,7 @@
   get_random_u32
   __get_random_u32_below
   get_random_u8
+  get_reclaim_params
   get_sg_io_hdr
   __get_task_comm
   get_task_cred
@@ -1068,6 +1074,7 @@
   init_dummy_netdev
   init_iova_domain
   init_net
+  init_on_free
   init_pid_ns
   __init_rwsem
   __init_swait_queue_head
@@ -1522,6 +1529,7 @@
   of_reserved_mem_lookup
   of_root
   of_usb_host_tpl_support
+  __oom_reap_task_mm
   page_frag_alloc_align
   __page_frag_cache_drain
   page_frag_free
@@ -1543,6 +1551,7 @@
   param_ops_ulong
   param_set_copystring
   param_set_int
+  param_set_uint
   param_set_uint_minmax
   pci_alloc_irq_vectors
   pci_alloc_irq_vectors_affinity
@@ -1556,6 +1565,7 @@
   pci_find_bus
   pci_find_capability
   pci_find_ext_capability
+  pci_free_irq
   pci_free_irq_vectors
   pci_get_device
   pci_iomap
@@ -1570,6 +1580,7 @@
   __pci_register_driver
   pci_release_region
   pci_release_regions
+  pci_request_irq
   pci_request_region
   pci_rescan_bus
   pci_restore_msi_state
@@ -1911,6 +1922,7 @@
   sched_uclamp_used
   schedule
   schedule_timeout
+  schedule_timeout_idle
   schedule_timeout_interruptible
   scnprintf
   scsi_alloc_request
@@ -1936,6 +1948,8 @@
   __seq_open_private
   seq_printf
   seq_putc
+  seq_put_decimal_ull
+  seq_put_decimal_ull_width
   seq_puts
   seq_read
   seq_release
@@ -1950,6 +1964,7 @@
   set_page_dirty
   set_page_dirty_lock
   __SetPageMovable
+  set_reclaim_params
   set_task_cpu
   set_user_nice
   sg_alloc_table
@@ -1961,6 +1976,7 @@
   __sg_page_iter_next
   __sg_page_iter_start
   shmem_file_setup
+  si_meminfo
   simple_attr_open
   simple_attr_read
   simple_attr_release
@@ -2251,6 +2267,7 @@
   thermal_zone_get_trip
   thermal_zone_get_zone_by_name
   thread_group_cputime_adjusted
+  tick_nohz_get_idle_calls_cpu
   time64_to_tm
   timer_delete
   timer_delete_sync
@@ -2272,6 +2289,7 @@
   __traceiter_android_rvh_dequeue_task
   __traceiter_android_rvh_dequeue_task_fair
   __traceiter_android_rvh_detach_entity_load_avg
+  __traceiter_android_rvh_do_read_fault
   __traceiter_android_rvh_enqueue_task
   __traceiter_android_rvh_enqueue_task_fair
   __traceiter_android_rvh_find_lowest_rq
@@ -2280,9 +2298,14 @@
   __traceiter_android_rvh_iommu_limit_align_shift
   __traceiter_android_rvh_irqs_disable
   __traceiter_android_rvh_irqs_enable
+  __traceiter_android_rvh_madvise_pageout_begin
+  __traceiter_android_rvh_madvise_pageout_end
+  __traceiter_android_rvh_mapping_shrinkable
+  __traceiter_android_rvh_meminfo_proc_show
   __traceiter_android_rvh_post_init_entity_util_avg
   __traceiter_android_rvh_preempt_disable
   __traceiter_android_rvh_preempt_enable
+  __traceiter_android_rvh_reclaim_folio_list
   __traceiter_android_rvh_remove_entity_load_avg
   __traceiter_android_rvh_rtmutex_prepare_setprio
   __traceiter_android_rvh_sched_newidle_balance
@@ -2306,24 +2329,33 @@
   __traceiter_android_rvh_util_est_update
   __traceiter_android_rvh_util_fits_cpu
   __traceiter_android_vh_arch_set_freq_scale
+  __traceiter_android_vh_binder_proc_transaction_finish
   __traceiter_android_vh_binder_restore_priority
   __traceiter_android_vh_binder_set_priority
+  __traceiter_android_vh_check_new_page
   __traceiter_android_vh_cpu_idle_enter
   __traceiter_android_vh_cpu_idle_exit
   __traceiter_android_vh_dump_throttled_rt_tasks
   __traceiter_android_vh_dup_task_struct
   __traceiter_android_vh_early_resume_begin
   __traceiter_android_vh_enable_thermal_genl_check
+  __traceiter_android_vh_filemap_get_folio
+  __traceiter_android_vh_free_pages_prepare_init
   __traceiter_android_vh_ipi_stop
+  __traceiter_android_vh_mm_compaction_begin
+  __traceiter_android_vh_mm_compaction_end
   __traceiter_android_vh_mm_kcompactd_cpu_online
+  __traceiter_android_vh_post_alloc_hook
   __traceiter_android_vh_prio_inheritance
   __traceiter_android_vh_prio_restore
   __traceiter_android_vh_resume_end
+  __traceiter_android_vh_rmqueue
   __traceiter_android_vh_scheduler_tick
   __traceiter_android_vh_setscheduler_uclamp
   __traceiter_android_vh_set_task_comm
   __traceiter_android_vh_si_meminfo_adjust
   __traceiter_android_vh_sysrq_crash
+  __traceiter_android_vh_tune_swappiness
   __traceiter_android_vh_uclamp_validate
   __traceiter_android_vh_ufs_check_int_errors
   __traceiter_android_vh_ufs_compl_command
@@ -2336,6 +2368,8 @@
   __traceiter_android_vh_ufs_update_sysfs
   __traceiter_android_vh_use_amu_fie
   __traceiter_clock_set_rate
+  __traceiter_cma_alloc_finish
+  __traceiter_cma_alloc_start
   __traceiter_cpu_idle
   __traceiter_device_pm_callback_end
   __traceiter_device_pm_callback_start
@@ -2373,6 +2407,7 @@
   __tracepoint_android_rvh_dequeue_task
   __tracepoint_android_rvh_dequeue_task_fair
   __tracepoint_android_rvh_detach_entity_load_avg
+  __tracepoint_android_rvh_do_read_fault
   __tracepoint_android_rvh_enqueue_task
   __tracepoint_android_rvh_enqueue_task_fair
   __tracepoint_android_rvh_find_lowest_rq
@@ -2381,9 +2416,14 @@
   __tracepoint_android_rvh_iommu_limit_align_shift
   __tracepoint_android_rvh_irqs_disable
   __tracepoint_android_rvh_irqs_enable
+  __tracepoint_android_rvh_madvise_pageout_begin
+  __tracepoint_android_rvh_madvise_pageout_end
+  __tracepoint_android_rvh_mapping_shrinkable
+  __tracepoint_android_rvh_meminfo_proc_show
   __tracepoint_android_rvh_post_init_entity_util_avg
   __tracepoint_android_rvh_preempt_disable
   __tracepoint_android_rvh_preempt_enable
+  __tracepoint_android_rvh_reclaim_folio_list
   __tracepoint_android_rvh_remove_entity_load_avg
   __tracepoint_android_rvh_rtmutex_prepare_setprio
   __tracepoint_android_rvh_sched_newidle_balance
@@ -2407,24 +2447,33 @@
   __tracepoint_android_rvh_util_est_update
   __tracepoint_android_rvh_util_fits_cpu
   __tracepoint_android_vh_arch_set_freq_scale
+  __tracepoint_android_vh_binder_proc_transaction_finish
   __tracepoint_android_vh_binder_restore_priority
   __tracepoint_android_vh_binder_set_priority
+  __tracepoint_android_vh_check_new_page
   __tracepoint_android_vh_cpu_idle_enter
   __tracepoint_android_vh_cpu_idle_exit
   __tracepoint_android_vh_dump_throttled_rt_tasks
   __tracepoint_android_vh_dup_task_struct
   __tracepoint_android_vh_early_resume_begin
   __tracepoint_android_vh_enable_thermal_genl_check
+  __tracepoint_android_vh_filemap_get_folio
+  __tracepoint_android_vh_free_pages_prepare_init
   __tracepoint_android_vh_ipi_stop
+  __tracepoint_android_vh_mm_compaction_begin
+  __tracepoint_android_vh_mm_compaction_end
   __tracepoint_android_vh_mm_kcompactd_cpu_online
+  __tracepoint_android_vh_post_alloc_hook
   __tracepoint_android_vh_prio_inheritance
   __tracepoint_android_vh_prio_restore
   __tracepoint_android_vh_resume_end
+  __tracepoint_android_vh_rmqueue
   __tracepoint_android_vh_scheduler_tick
   __tracepoint_android_vh_setscheduler_uclamp
   __tracepoint_android_vh_set_task_comm
   __tracepoint_android_vh_si_meminfo_adjust
   __tracepoint_android_vh_sysrq_crash
+  __tracepoint_android_vh_tune_swappiness
   __tracepoint_android_vh_uclamp_validate
   __tracepoint_android_vh_ufs_check_int_errors
   __tracepoint_android_vh_ufs_compl_command
@@ -2437,6 +2486,8 @@
   __tracepoint_android_vh_ufs_update_sysfs
   __tracepoint_android_vh_use_amu_fie
   __tracepoint_clock_set_rate
+  __tracepoint_cma_alloc_finish
+  __tracepoint_cma_alloc_start
   __tracepoint_cpu_idle
   __tracepoint_device_pm_callback_end
   __tracepoint_device_pm_callback_start
@@ -2662,6 +2713,7 @@
   vmf_insert_pfn_prot
   vm_node_stat
   vm_unmapped_area
+  vm_zone_stat
   vprintk
   vprintk_emit
   vring_del_virtqueue
@@ -2677,6 +2729,7 @@
   wait_for_completion_interruptible_timeout
   wait_for_completion_killable
   wait_for_completion_timeout
+  wait_on_page_writeback
   wait_woken
   __wake_up
   __wake_up_locked
@@ -2717,6 +2770,12 @@
   xhci_init_driver
   xhci_resume
   xhci_run
+  xhci_sideband_add_endpoint
+  xhci_sideband_create_interrupter
+  xhci_sideband_register
+  xhci_sideband_remove_endpoint
+  xhci_sideband_remove_interrupter
+  xhci_sideband_unregister
   xhci_suspend
   zs_compact
   zs_create_pool

android/abi_gki_aarch64_pixel_watch

@@ -82,6 +82,7 @@
   cache_line_size
   cancel_delayed_work
   cancel_delayed_work_sync
+  cancel_work
   cancel_work_sync
   capable
   cdev_add
@@ -97,10 +98,12 @@
   check_preempt_curr
   check_zeroed_user
   class_create
+  class_create_file_ns
   class_destroy
   class_find_device
   class_for_each_device
   class_register
+  class_remove_file_ns
   class_unregister
   cleanup_srcu_struct
   clear_page
@@ -295,8 +298,10 @@
   _dev_err
   dev_err_probe
   devfreq_add_device
+  devfreq_add_governor
   devfreq_get_devfreq_by_node
   devfreq_remove_device
+  devfreq_remove_governor
   devfreq_resume_device
   devfreq_suspend_device
   __dev_fwnode
@@ -888,6 +893,7 @@
   housekeeping_test_cpu
   hrtimer_active
   hrtimer_cancel
+  hrtimer_forward
   __hrtimer_get_remaining
   hrtimer_init
   hrtimer_start_range_ns
@@ -1127,6 +1133,7 @@
   kobject_uevent_env
   kobj_sysfs_ops
   krealloc
+  kset_create_and_add
   ksize
   ksoftirqd
   kstat_irqs_usr
@@ -1494,9 +1501,11 @@
   pm_clk_suspend
   pm_generic_resume
   pm_generic_suspend
+  pm_genpd_add_device
   pm_genpd_add_subdomain
   pm_genpd_init
   pm_genpd_remove
+  pm_genpd_remove_device
   pm_genpd_remove_subdomain
   pm_power_off
   __pm_relax
@@ -1546,6 +1555,7 @@
   proc_dostring
   proc_douintvec_minmax
   proc_mkdir
+  proc_remove
   proto_register
   proto_unregister
   pskb_expand_head
@@ -1615,6 +1625,7 @@
   rebuild_sched_domains
   refcount_dec_not_one
   refcount_warn_saturate
+  regcache_cache_bypass
   regcache_cache_only
   regcache_mark_dirty
   regcache_sync
@@ -1726,6 +1737,7 @@
   rproc_report_crash
   rproc_set_firmware
   rproc_shutdown
+  rtc_add_group
   rtc_class_close
   rtc_class_open
   rtc_read_time
@@ -1795,6 +1807,7 @@
   sdio_writew
   select_fallback_rq
   send_sig_info
+  seq_buf_printf
   seq_hex_dump
   seq_lseek
   seq_open
@@ -1984,6 +1997,7 @@
   strnstr
   strpbrk
   strrchr
+  strreplace
   strscpy
   strscpy_pad
   strsep
@@ -2231,6 +2245,7 @@
   __trace_trigger_soft_disabled
   tracing_off
   try_module_get
+  try_to_del_timer_sync
   try_wait_for_completion
   tty_flip_buffer_push
   __tty_insert_flip_string_flags
@@ -2293,6 +2308,8 @@
   usb_free_all_descriptors
   usb_function_register
   usb_function_unregister
+  usb_gadget_connect
+  usb_gadget_disconnect
   usb_gadget_wakeup
   usb_hcd_is_primary_hcd
   usb_interface_id
@@ -2310,6 +2327,7 @@
   usb_unregister_notify
   __usecs_to_jiffies
   usleep_range_state
+  utf8_data_table
   v4l2_ctrl_find
   v4l2_ctrl_handler_free
   v4l2_ctrl_handler_init_class

android/abi_gki_aarch64_qcom

@@ -1180,12 +1180,15 @@
   mmc_cqe_request_done
   mmc_execute_tuning
   mmc_hs200_tuning
+  __mmc_poll_for_busy
+  mmc_prepare_busy_cmd
   mmc_issue_type
   mmc_of_parse
   mmc_regulator_get_supply
   mmc_regulator_set_ocr
   mmc_regulator_set_vqmmc
   mmc_retune_hold
+  mmc_retune_release
   mmc_select_bus_width
   mmc_select_card
   mmc_select_hs
@@ -2057,6 +2060,8 @@
   __traceiter_android_rvh_irqs_disable
   __traceiter_android_rvh_irqs_enable
   __traceiter_android_rvh_is_cpu_allowed
+  __traceiter_android_rvh_mmc_resume
+  __traceiter_android_rvh_mmc_suspend
   __traceiter_android_rvh_new_task_stats
   __traceiter_android_rvh_preempt_disable
   __traceiter_android_rvh_preempt_enable
@@ -2161,6 +2166,8 @@
   __tracepoint_android_rvh_irqs_disable
   __tracepoint_android_rvh_irqs_enable
   __tracepoint_android_rvh_is_cpu_allowed
+  __tracepoint_android_rvh_mmc_resume
+  __tracepoint_android_rvh_mmc_suspend
   __tracepoint_android_rvh_new_task_stats
   __tracepoint_android_rvh_preempt_disable
   __tracepoint_android_rvh_preempt_enable
@@ -2436,6 +2443,7 @@
   __xa_alloc
   __xa_alloc_cyclic
   xa_destroy
+  __xa_erase
   xa_erase
   xa_find
   xa_find_after

android/abi_gki_aarch64_sunxi

@@ -68,6 +68,10 @@
   v4l2_ctrl_cluster
   v4l2_g_ctrl
   v4l2_i2c_new_subdev
+  v4l2_src_change_event_subdev_subscribe
+  v4l2_valid_dv_timings
+  v4l2_subdev_notify_event
+  v4l2_ctrl_get_name
   vb2_dma_contig_set_max_seg_size
   usb_serial_port_softint
   usb_role_switch_get_role

android/abi_gki_aarch64_virtual_device

@@ -26,8 +26,6 @@
   cancel_delayed_work_sync
   cancel_work_sync
   __check_object_size
-  class_register
-  class_unregister
   clk_disable
   clk_enable
   clk_get_rate
@@ -42,6 +40,7 @@
   cpufreq_unregister_driver
   cpu_number
   __cpu_online_mask
+  __cpu_possible_mask
   crc32_le
   csum_partial
   debugfs_attr_read
@@ -60,7 +59,6 @@
   dev_close
   _dev_err
   __dev_get_by_index
-  device_create
   device_create_file
   device_remove_file
   device_set_wakeup_capable
@@ -76,20 +74,17 @@
   devm_kmalloc
   devm_platform_ioremap_resource
   devm_request_threaded_irq
-  _dev_notice
   _dev_printk
   __dev_queue_xmit
   devres_add
   __devres_alloc_node
   devres_free
   _dev_warn
-  dma_alloc_attrs
   dma_buf_export
   dma_fence_context_alloc
   dma_fence_init
   dma_fence_release
   dma_fence_signal_locked
-  dma_free_attrs
   dmam_alloc_attrs
   dma_set_coherent_mask
   dma_set_mask
@@ -161,7 +156,6 @@
   flush_delayed_work
   flush_work
   __flush_workqueue
-  __folio_put
   fortify_panic
   fput
   free_irq
@@ -171,7 +165,6 @@
   genlmsg_put
   genl_register_family
   genl_unregister_family
-  get_device
   __get_free_pages
   get_random_bytes
   get_unused_fd_flags
@@ -226,6 +219,7 @@
   kimage_voffset
   __kmalloc
   kmalloc_caches
+  kmalloc_large
   kmalloc_trace
   kmemdup
   kstrndup
@@ -234,7 +228,6 @@
   kthread_park
   kthread_should_stop
   kthread_stop
-  kthread_stop_put
   kthread_unpark
   ktime_get
   ktime_get_ts64
@@ -298,12 +291,9 @@
   nla_put_64bit
   nonseekable_open
   noop_llseek
-  nr_cpu_ids
   of_device_is_compatible
   of_find_property
   of_property_read_variable_u32_array
-  page_pinner_inited
-  __page_pinner_put_page
   page_pool_alloc_frag
   page_pool_destroy
   page_pool_put_defragged_page
@@ -313,17 +303,11 @@
   param_ops_uint
   passthru_features_check
   pci_bus_type
-  pci_disable_device
+  pci_iomap_range
-  pci_enable_device
-  pci_find_capability
-  pci_find_next_capability
-  pci_iounmap
-  pci_read_config_byte
-  pci_read_config_dword
-  __pci_register_driver
   pci_release_region
+  pci_release_selected_regions
   pci_request_region
-  pci_unregister_driver
+  pci_request_selected_regions
   __per_cpu_offset
   perf_trace_buf_alloc
   perf_trace_run_bpf_submit
@@ -366,7 +350,6 @@
   register_netdevice
   register_netdevice_notifier
   register_pernet_device
-  register_virtio_device
   register_virtio_driver
   __regmap_init
   regmap_write
@@ -385,10 +368,8 @@
   schedule
   schedule_timeout
   scnprintf
-  seq_lseek
   seq_printf
   seq_puts
-  seq_read
   serio_close
   serio_interrupt
   serio_open
@@ -408,8 +389,6 @@
   simple_attr_release
   simple_open
   simple_read_from_buffer
-  single_open
-  single_release
   skb_add_rx_frag
   skb_clone
   skb_copy
@@ -433,21 +412,17 @@
   strcmp
   strcpy
   strlen
+  strncpy
   strnlen
   strscpy
   __sw_hweight16
   __sw_hweight32
   __sw_hweight8
   sync_file_create
-  synchronize_irq
   synchronize_net
   synchronize_rcu
-  sysfs_create_group
-  sysfs_emit
-  sysfs_remove_group
   sysfs_remove_link
   system_cpucaps
-  system_freezable_wq
   system_wq
   __tasklet_schedule
   tasklet_setup
@@ -466,7 +441,6 @@
   unregister_netdevice_notifier
   unregister_netdevice_queue
   unregister_pernet_device
-  unregister_virtio_device
   unregister_virtio_driver
   up_write
   usb_add_hcd
@@ -497,12 +471,21 @@
   usb_unanchor_urb
   __usecs_to_jiffies
   usleep_range_state
+  v4l2_device_register
+  v4l2_device_unregister
+  v4l2_event_pending
+  v4l2_event_subscribe
+  v4l2_event_unsubscribe
+  v4l2_fh_add
+  v4l2_fh_del
+  v4l2_fh_exit
+  v4l2_fh_init
   vfree
-  virtio_break_device
+  video_devdata
+  video_ioctl2
+  __video_register_device
+  video_unregister_device
   virtio_check_driver_offered_feature
-  virtio_config_changed
-  virtio_device_freeze
-  virtio_device_restore
   virtio_reset_device
   virtqueue_add_inbuf
   virtqueue_add_outbuf
@@ -510,10 +493,7 @@
   virtqueue_detach_unused_buf
   virtqueue_disable_cb
   virtqueue_enable_cb
-  virtqueue_get_avail_addr
   virtqueue_get_buf
-  virtqueue_get_desc_addr
-  virtqueue_get_used_addr
   virtqueue_get_vring_size
   virtqueue_is_broken
   virtqueue_kick
@@ -522,11 +502,7 @@
   vmalloc
   vmalloc_to_page
   vm_get_page_prot
-  vring_create_virtqueue
+  vzalloc
-  vring_del_virtqueue
-  vring_interrupt
-  vring_notification_data
-  vring_transport_features
   __wake_up
   wake_up_process
   __warn_printk
@@ -538,22 +514,6 @@
   clk_put
   serio_unregister_port
 
-# required by android-v-virt-cpufreq.ko
-  arch_freq_scale
-  cpufreq_cpu_get
-  cpufreq_cpu_put
-  cpufreq_frequency_table_verify
-  cpufreq_get_hw_max_freq
-  cpu_scale
-  dev_pm_opp_free_cpufreq_table
-  dev_pm_opp_get_opp_count
-  dev_pm_opp_init_cpufreq_table
-  dev_pm_opp_of_add_table
-  get_cpu_device
-  topology_clear_scale_freq_source
-  topology_set_scale_freq_source
-  topology_update_thermal_pressure
-
 # required by armmmci.ko
   clk_round_rate
   devm_of_iomap
@@ -644,6 +604,8 @@
   bpf_trace_run11
   bpf_trace_run7
   bpf_trace_run8
+  class_register
+  class_unregister
   _ctype
   debugfs_rename
   __dev_change_net_namespace
@@ -698,9 +660,11 @@
   regmap_read
 
 # required by drm_dma_helper.ko
+  dma_alloc_attrs
   dma_alloc_pages
   dma_buf_vmap_unlocked
   dma_buf_vunmap_unlocked
+  dma_free_attrs
   dma_free_pages
   dma_get_sgtable_attrs
   dma_mmap_attrs
@@ -730,6 +694,11 @@
 # required by goldfish_address_space.ko
   memremap
   memunmap
+  pci_disable_device
+  pci_enable_device
+  pci_read_config_byte
+  __pci_register_driver
+  pci_unregister_driver
 
 # required by goldfish_battery.ko
   power_supply_changed
@@ -802,7 +771,6 @@
   bitmap_free
   bitmap_zalloc
   call_rcu
-  __cpu_possible_mask
   crc32_be
   crypto_aead_decrypt
   crypto_aead_encrypt
@@ -834,7 +802,6 @@
   kernel_param_lock
   kernel_param_unlock
   kfree_skb_list_reason
-  kmalloc_large
   ktime_get_seconds
   netdev_set_default_ethtool_ops
   netif_receive_skb
@@ -853,8 +820,8 @@
   skb_ensure_writable
   __skb_get_hash
   __skb_gso_segment
-  strncpy
   __sw_hweight64
+  system_freezable_wq
   tasklet_kill
   unregister_inet6addr_notifier
   unregister_inetaddr_notifier
@@ -863,6 +830,7 @@
   class_create
   class_destroy
   device_bind_driver
+  device_create
   device_release_driver
   dst_release
   genl_notify
@@ -913,6 +881,10 @@
 # required by mt76x02-lib.ko
   debugfs_create_bool
   __kfifo_init
+  seq_lseek
+  seq_read
+  single_open
+  single_release
 
 # required by mt76x02-usb.ko
   hrtimer_active
@@ -975,6 +947,7 @@
   device_link_add
   device_link_remove
   device_remove_groups
+  _dev_notice
   i2c_adapter_type
   i2c_bus_type
   i2c_client_type
@@ -1036,6 +1009,30 @@
   scmi_driver_register
   scmi_driver_unregister
   strrchr
+  sysfs_emit
+
+# required by snd-aloop.ko
+  devm_kfree
+  devm_kstrdup
+  snd_card_ref
+  snd_card_rw_proc_new
+  snd_ctl_boolean_mono_info
+  snd_devm_card_new
+  snd_ecards_limit
+  snd_info_get_line
+  snd_interval_refine
+  snd_pcm_format_set_silence
+  snd_pcm_hw_rule_add
+  snd_pcm_stop
+  snd_pcm_stop_xrun
+  snd_timer_close
+  snd_timer_instance_free
+  snd_timer_instance_new
+  snd_timer_open
+  snd_timer_start
+  snd_timer_stop
+  strim
+  strpbrk
 
 # required by system_heap.ko
   dma_heap_add
@@ -1063,25 +1060,11 @@
   v4l2_ctrl_handler_setup
   v4l2_ctrl_new_custom
   v4l2_ctrl_subscribe_event
-  v4l2_device_register
-  v4l2_device_unregister
-  v4l2_event_pending
   v4l2_event_queue
-  v4l2_event_subscribe
-  v4l2_event_unsubscribe
-  v4l2_fh_add
-  v4l2_fh_del
-  v4l2_fh_exit
-  v4l2_fh_init
   v4l2_format_info
-  video_devdata
   video_device_alloc
   video_device_release
-  video_ioctl2
-  __video_register_device
-  video_unregister_device
   vm_insert_page
-  vzalloc
 
 # required by vexpress-config.ko
   of_find_compatible_node
@@ -1102,9 +1085,12 @@
   kernel_sock_shutdown
   kstrtoint
   kstrtoll
+  kthread_stop_put
   platform_bus
   sockfd_lookup
   strchr
+  sysfs_create_group
+  sysfs_remove_group
   usb_speed_string
 
 # required by virt_wifi.ko
@@ -1216,116 +1202,40 @@
   ww_mutex_lock_interruptible
   ww_mutex_unlock
 
+# required by virtio-media.ko
+  frame_vector_to_pages
+  pfn_is_map_memory
+  sg_alloc_table_from_pages_segment
+  sg_nents
+  v4l2_event_queue_fh
+  v4l2_src_change_event_subscribe
+  vb2_create_framevec
+  vb2_destroy_framevec
+  video_device_release_empty
+
 # required by virtio-rng.ko
   hwrng_register
   hwrng_unregister
   wait_for_completion_killable
 
-# required by virtio_balloon.ko
-  adjust_managed_page_count
-  all_vm_events
-  balloon_mops
-  balloon_page_alloc
-  balloon_page_dequeue
-  balloon_page_enqueue
-  __ClearPageMovable
-  init_on_free
-  mutex_trylock
-  page_relinquish
-  page_reporting_register
-  page_reporting_unregister
-  post_page_relinquish_tlb_inv
-  register_oom_notifier
-  register_shrinker
-  __SetPageMovable
-  si_mem_available
-  si_meminfo
-  unregister_oom_notifier
-  unregister_shrinker
-  virtqueue_disable_dma_api_for_buffers
-  vm_event_states
-  vm_node_stat
-
-# required by virtio_blk.ko
-  blk_execute_rq
-  __blk_mq_alloc_disk
-  blk_mq_alloc_request
-  blk_mq_alloc_tag_set
-  blk_mq_complete_request
-  blk_mq_complete_request_remote
-  blk_mq_end_request
-  blk_mq_end_request_batch
-  blk_mq_free_request
-  blk_mq_free_tag_set
-  blk_mq_freeze_queue
-  blk_mq_map_queues
-  blk_mq_requeue_request
-  blk_mq_start_request
-  blk_mq_start_stopped_hw_queues
-  blk_mq_stop_hw_queue
-  blk_mq_unfreeze_queue
-  blk_mq_virtio_map_queues
-  blk_queue_alignment_offset
-  blk_queue_chunk_sectors
-  blk_queue_flag_set
-  blk_queue_io_min
-  blk_queue_io_opt
-  blk_queue_logical_block_size
-  blk_queue_max_discard_sectors
-  blk_queue_max_discard_segments
-  blk_queue_max_hw_sectors
-  blk_queue_max_secure_erase_sectors
-  blk_queue_max_segments
-  blk_queue_max_segment_size
-  blk_queue_max_write_zeroes_sectors
-  blk_queue_max_zone_append_sectors
-  blk_queue_physical_block_size
-  blk_queue_write_cache
-  blk_revalidate_disk_zones
-  blk_rq_map_kern
-  __blk_rq_map_sg
-  blk_status_to_errno
-  del_gendisk
-  device_add_disk
-  disk_set_zoned
-  put_disk
-  __register_blkdev
-  set_capacity_and_notify
-  set_disk_ro
-  sg_alloc_table_chained
-  sg_free_table_chained
-  string_get_size
-  __sysfs_match_string
-  unregister_blkdev
-  virtio_max_dma_size
-  __vmalloc
-
-# required by virtio_console.ko
-  cdev_add
-  cdev_alloc
-  cdev_del
-  device_destroy
-  fasync_helper
-  hvc_alloc
-  hvc_instantiate
-  hvc_kick
-  hvc_poll
-  hvc_remove
-  __hvc_resize
-  kill_fasync
-  kobject_uevent
-  pipe_lock
-  pipe_unlock
-  __register_chrdev
-  __splice_from_pipe
-  unlock_page
-  __unregister_chrdev
-  wait_for_completion
-
 # required by virtio_mmio.ko
   device_for_each_child
   device_register
   memparse
+  register_virtio_device
+  synchronize_irq
+  unregister_virtio_device
+  virtio_config_changed
+  virtio_device_freeze
+  virtio_device_restore
+  virtqueue_get_avail_addr
+  virtqueue_get_desc_addr
+  virtqueue_get_used_addr
+  vring_create_virtqueue
+  vring_del_virtqueue
+  vring_interrupt
+  vring_notification_data
+  vring_transport_features
 
 # required by virtio_net.ko
   bpf_dispatcher_xdp_func
@@ -1347,6 +1257,7 @@
   ethtool_sprintf
   ethtool_virtdev_set_link_ksettings
   flow_keys_basic_dissector
+  __folio_put
   jiffies_to_usecs
   __napi_alloc_skb
   napi_consume_skb
@@ -1359,7 +1270,10 @@
   __netif_set_xps_queue
   netif_tx_lock
   netif_tx_unlock
+  nr_cpu_ids
   __num_online_cpus
+  page_pinner_inited
+  __page_pinner_put_page
   sched_clock
   skb_coalesce_rx_frag
   __skb_flow_dissect
@@ -1394,27 +1308,9 @@
   xdp_rxq_info_unreg
   xdp_warn
 
-# required by virtio_pci.ko
-  __irq_apply_affinity_hint
-  pci_alloc_irq_vectors_affinity
-  pci_device_is_present
-  pci_disable_sriov
-  pci_enable_sriov
-  pci_find_ext_capability
-  pci_free_irq_vectors
-  pci_irq_get_affinity
-  pci_irq_vector
-  pci_read_config_word
-  pci_set_master
-  pci_vfs_assigned
-
 # required by virtio_pci_legacy_dev.ko
   pci_iomap
-
+  pci_iounmap
-# required by virtio_pci_modern_dev.ko
-  pci_iomap_range
-  pci_release_selected_regions
-  pci_request_selected_regions
 
 # required by virtio_pmem.ko
   nvdimm_bus_register
@@ -1440,6 +1336,16 @@
   snd_pcm_set_ops
   wait_for_completion_interruptible_timeout
 
+# required by virtual-cpufreq.ko
+  arch_freq_scale
+  cpufreq_freq_transition_begin
+  cpufreq_freq_transition_end
+  cpufreq_frequency_table_verify
+  cpufreq_get_hw_max_freq
+  get_cpu_device
+  topology_clear_scale_freq_source
+  topology_set_scale_freq_source
+
 # required by vkms.ko
   __devm_drm_dev_alloc
   devres_open_group
@@ -1483,8 +1389,127 @@
   drm_writeback_queue_job
   drm_writeback_signal_completion
 
-# required by vmw_vsock_virtio_transport.ko
+# preserved by --additions-only
+  adjust_managed_page_count
+  all_vm_events
+  balloon_mops
+  balloon_page_alloc
+  balloon_page_dequeue
+  balloon_page_enqueue
+  blk_execute_rq
+  __blk_mq_alloc_disk
+  blk_mq_alloc_request
+  blk_mq_alloc_tag_set
+  blk_mq_complete_request
+  blk_mq_complete_request_remote
+  blk_mq_end_request
+  blk_mq_end_request_batch
+  blk_mq_free_request
+  blk_mq_free_tag_set
+  blk_mq_freeze_queue
+  blk_mq_map_queues
+  blk_mq_quiesce_queue
+  blk_mq_requeue_request
+  blk_mq_start_request
+  blk_mq_start_stopped_hw_queues
+  blk_mq_stop_hw_queue
+  blk_mq_unfreeze_queue
+  blk_mq_unquiesce_queue
+  blk_mq_virtio_map_queues
+  blk_queue_alignment_offset
+  blk_queue_chunk_sectors
+  blk_queue_flag_set
+  blk_queue_io_min
+  blk_queue_io_opt
+  blk_queue_logical_block_size
+  blk_queue_max_discard_sectors
+  blk_queue_max_discard_segments
+  blk_queue_max_hw_sectors
+  blk_queue_max_secure_erase_sectors
+  blk_queue_max_segments
+  blk_queue_max_segment_size
+  blk_queue_max_write_zeroes_sectors
+  blk_queue_max_zone_append_sectors
+  blk_queue_physical_block_size
+  blk_queue_write_cache
+  blk_revalidate_disk_zones
+  blk_rq_map_kern
+  __blk_rq_map_sg
+  blk_status_to_errno
+  cdev_add
+  cdev_alloc
+  cdev_del
+  __ClearPageMovable
+  cpufreq_cpu_get
+  cpufreq_cpu_put
+  cpu_scale
+  del_gendisk
+  device_add_disk
+  device_destroy
+  dev_pm_opp_free_cpufreq_table
+  dev_pm_opp_get_opp_count
+  dev_pm_opp_init_cpufreq_table
+  dev_pm_opp_of_add_table
+  disk_set_zoned
+  fasync_helper
+  get_device
+  hvc_alloc
+  hvc_instantiate
+  hvc_kick
+  hvc_poll
+  hvc_remove
+  __hvc_resize
+  init_on_free
+  __irq_apply_affinity_hint
+  kill_fasync
+  kobject_uevent
+  mutex_trylock
+  page_relinquish
+  page_reporting_register
+  page_reporting_unregister
+  page_shift_compat
+  page_shift_compat_enabled
+  pci_alloc_irq_vectors_affinity
+  pci_device_is_present
+  pci_disable_sriov
+  pci_enable_sriov
+  pci_find_capability
+  pci_find_ext_capability
+  pci_find_next_capability
+  pci_free_irq_vectors
+  pci_irq_get_affinity
+  pci_irq_vector
+  pci_read_config_dword
+  pci_read_config_word
+  pci_set_master
+  pci_vfs_assigned
+  pipe_lock
+  pipe_unlock
+  post_page_relinquish_tlb_inv
+  put_disk
+  __register_blkdev
+  __register_chrdev
+  register_oom_notifier
+  register_shrinker
+  set_capacity_and_notify
+  set_disk_ro
+  __SetPageMovable
+  sg_alloc_table_chained
+  sg_free_table_chained
+  si_mem_available
+  si_meminfo
   sk_error_report
+  __splice_from_pipe
+  string_get_size
+  __sysfs_match_string
+  topology_update_thermal_pressure
+  unlock_page
+  unregister_blkdev
+  __unregister_chrdev
+  unregister_oom_notifier
+  unregister_shrinker
+  virtio_break_device
+  virtio_max_dma_size
   virtio_transport_connect
   virtio_transport_deliver_tap_pkt
   virtio_transport_destruct
@@ -1520,12 +1545,29 @@
   virtio_transport_stream_has_space
   virtio_transport_stream_is_active
   virtio_transport_stream_rcvhiwat
+  virtqueue_disable_dma_api_for_buffers
+  __vmalloc
+  vm_event_states
+  vm_node_stat
+  vp_modern_config_vector
+  vp_modern_generation
+  vp_modern_get_features
+  vp_modern_get_num_queues
+  vp_modern_get_queue_enable
+  vp_modern_get_queue_reset
+  vp_modern_get_queue_size
+  vp_modern_get_status
+  vp_modern_map_vq_notify
+  vp_modern_probe
+  vp_modern_queue_address
+  vp_modern_queue_vector
+  vp_modern_remove
+  vp_modern_set_features
+  vp_modern_set_queue_enable
+  vp_modern_set_queue_reset
+  vp_modern_set_queue_size
+  vp_modern_set_status
   vsock_core_register
   vsock_core_unregister
   vsock_for_each_connected_socket
-
+  wait_for_completion
-# preserved by --additions-only
-  blk_mq_quiesce_queue
-  blk_mq_unquiesce_queue
-  page_shift_compat
-  page_shift_compat_enabled

android/abi_gki_aarch64_vivo

@@ -150,10 +150,12 @@
   __traceiter_android_vh_lock_folio_drop_mmap_start
   __traceiter_android_vh_look_around
   __traceiter_android_vh_look_around_migrate_folio
+  __traceiter_android_vh_lruvec_add_folio
+  __traceiter_android_vh_lruvec_del_folio
   __traceiter_android_vh_mmap_region
   __traceiter_android_vh_mutex_init
   __traceiter_android_vh_mutex_unlock_slowpath
-  __traceiter_android_vh_mutex_unlock_slowpath_before_wakeq
+  __traceiter_android_vh_mutex_unlock_slowpath_bf_wakeq
   __traceiter_android_vh_mutex_wait_finish
   __traceiter_android_vh_mutex_wait_start
   __traceiter_android_vh_oom_swapmem_gather_finish
@@ -177,6 +179,7 @@
   __traceiter_android_vh_scheduler_tick
   __traceiter_android_vh_sd_init_unmap_multi_segment
   __traceiter_android_vh_sd_setup_unmap_multi_segment
+  __traceiter_android_vh_send_signal_locked
   __traceiter_android_vh_shmem_swapin_folio
   __traceiter_android_vh_should_alloc_pages_retry
   __traceiter_android_vh_shrink_folio_list
@@ -276,10 +279,12 @@
   __tracepoint_android_vh_lock_folio_drop_mmap_start
   __tracepoint_android_vh_look_around
   __tracepoint_android_vh_look_around_migrate_folio
+  __tracepoint_android_vh_lruvec_add_folio
+  __tracepoint_android_vh_lruvec_del_folio
   __tracepoint_android_vh_mmap_region
   __tracepoint_android_vh_mutex_init
   __tracepoint_android_vh_mutex_unlock_slowpath
-  __tracepoint_android_vh_mutex_unlock_slowpath_before_wakeq
+  __tracepoint_android_vh_mutex_unlock_slowpath_bf_wakeq
   __tracepoint_android_vh_mutex_wait_finish
   __tracepoint_android_vh_mutex_wait_start
   __tracepoint_android_vh_oom_swapmem_gather_finish
@@ -303,6 +308,7 @@
   __tracepoint_android_vh_scheduler_tick
   __tracepoint_android_vh_sd_init_unmap_multi_segment
   __tracepoint_android_vh_sd_setup_unmap_multi_segment
+  __tracepoint_android_vh_send_signal_locked
   __tracepoint_android_vh_shmem_swapin_folio
   __tracepoint_android_vh_should_alloc_pages_retry
   __tracepoint_android_vh_shrink_folio_list
@@ -340,3 +346,4 @@
   unlock_buffer
   __wait_on_buffer
   zs_lookup_class_index
+  utf8_data_table_new

android/abi_gki_aarch64_xiaomi

@@ -71,8 +71,15 @@
   blk_mq_quiesce_tagset
   blk_mq_unquiesce_tagset
   memblock_free
+  __mem_cgroup_charge
+  __mem_cgroup_uncharge
+  __mod_memcg_lruvec_state
+  unpack_shadow
+  bucket_order
   mem_cgroup_move_account
   sum_mthp_stat
+  all_pcp_disable
+  all_pcp_enable
   __traceiter_android_vh_anon_vma_name_recog
   __traceiter_android_vh_restore_mm_flags
   __traceiter_android_vh_update_vma_flags
@@ -89,12 +96,28 @@
   __tracepoint_android_vh_customize_thp_pcp_order
   __traceiter_android_vh_customize_thp_gfp_orders
   __tracepoint_android_vh_customize_thp_gfp_orders
+  __traceiter_android_vh_customize_pmd_gfp_bypass
+  __tracepoint_android_vh_customize_pmd_gfp_bypass
+  __traceiter_android_vh_refault_filemap_add_folio
+  __tracepoint_android_vh_refault_filemap_add_folio
   __traceiter_android_vh_mem_cgroup_charge
   __traceiter_android_vh_filemap_add_folio
   __traceiter_android_vh_shrink_node
   __tracepoint_android_vh_mem_cgroup_charge
   __tracepoint_android_vh_filemap_add_folio
   __tracepoint_android_vh_shrink_node
+  __tracepoint_cma_alloc_start
+  __tracepoint_cma_alloc_busy_retry
+  __tracepoint_cma_alloc_finish
+  __tracepoint_cma_release
+  __traceiter_cma_alloc_start
+  __traceiter_cma_alloc_busy_retry
+  __traceiter_cma_alloc_finish
+  __traceiter_cma_release
+  __traceiter_android_vh_dma_buf_release
+  __tracepoint_android_vh_dma_buf_release
+  mmc_set_blocklen
+  nr_free_buffer_pages
 
 #required by metis.ko module
   __traceiter_android_vh_rwsem_read_wait_start
@@ -132,6 +155,14 @@
   __traceiter_android_rvh_fiq_dump
   __tracepoint_android_rvh_fiq_dump
 
+# required by kmod_protect.ko
+  __traceiter_android_vh_free_mod_mem
+  __traceiter_android_vh_set_mod_perm_after_init
+  __traceiter_android_vh_set_mod_perm_before_init
+  __tracepoint_android_vh_free_mod_mem
+  __tracepoint_android_vh_set_mod_perm_after_init
+  __tracepoint_android_vh_set_mod_perm_before_init
+
 #required by mi_sched.ko
   __traceiter_android_vh_scheduler_tick
   __traceiter_android_vh_free_user
@@ -391,6 +422,20 @@
   __tracepoint_android_vh_psi_event
   __tracepoint_android_vh_psi_group
 
+#required by io_monitor.ko
+  __tracepoint_f2fs_gc_begin
+  __tracepoint_f2fs_gc_end
+  __tracepoint_f2fs_write_checkpoint
+  __tracepoint_f2fs_sync_file_enter
+  __tracepoint_f2fs_sync_file_exit
+  __tracepoint_ufshcd_command
+  __traceiter_f2fs_gc_begin
+  __traceiter_f2fs_gc_end
+  __traceiter_f2fs_write_checkpoint
+  __traceiter_f2fs_sync_file_enter
+  __traceiter_f2fs_sync_file_exit
+  __traceiter_ufshcd_command
+
 #required by zram.ko module
   __blk_alloc_disk
   bio_end_io_acct_remapped
@@ -438,3 +483,33 @@ __tracepoint_android_vh_do_folio_trylock
 reclaim_pages
 __tracepoint_android_vh_alloc_flags_cma_adjust
 __traceiter_android_vh_alloc_flags_cma_adjust
+
+# required by xr-qi.ko
+__tracepoint_android_vh_futex_wait_queue_start
+__traceiter_android_vh_futex_wait_queue_start
+
+# required by zsmalloc.ko
+__traceiter_android_vh_zs_shrinker_adjust
+__traceiter_android_vh_zs_shrinker_bypass
+__tracepoint_android_vh_zs_shrinker_adjust
+__tracepoint_android_vh_zs_shrinker_bypass
+
+# required by msm_drm.ko
+pwm_apply_might_sleep
+
+# required by mi_buffer_io_reclaim ko
+shrink_inactive_list
+__tracepoint_android_vh_copy_page_to_user
+__traceiter_android_vh_copy_page_to_user
+__tracepoint_android_vh_copy_page_from_user
+__traceiter_android_vh_copy_page_from_user
+__tracepoint_android_vh_destroy_inode
+__traceiter_android_vh_destroy_inode
+
+# required by gzvm.ko
+__traceiter_android_vh_gzvm_destroy_vm_post_process
+__tracepoint_android_vh_gzvm_destroy_vm_post_process
+__traceiter_android_vh_gzvm_handle_demand_page_pre
+__traceiter_android_vh_gzvm_handle_demand_page_post
+__tracepoint_android_vh_gzvm_handle_demand_page_pre
+__tracepoint_android_vh_gzvm_handle_demand_page_post

android/gki_aarch64_protected_modules

@@ -1,64 +0,0 @@
-arch/arm64/geniezone/gzvm.ko
-drivers/bluetooth/btbcm.ko
-drivers/bluetooth/btqca.ko
-drivers/bluetooth/btsdio.ko
-drivers/bluetooth/hci_uart.ko
-drivers/net/can/dev/can-dev.ko
-drivers/net/can/slcan/slcan.ko
-drivers/net/can/vcan.ko
-drivers/net/macsec.ko
-drivers/net/mii.ko
-drivers/net/ppp/bsd_comp.ko
-drivers/net/ppp/ppp_deflate.ko
-drivers/net/ppp/ppp_generic.ko
-drivers/net/ppp/ppp_mppe.ko
-drivers/net/ppp/pppox.ko
-drivers/net/ppp/pptp.ko
-drivers/net/slip/slhc.ko
-drivers/net/usb/aqc111.ko
-drivers/net/usb/asix.ko
-drivers/net/usb/ax88179_178a.ko
-drivers/net/usb/cdc_eem.ko
-drivers/net/usb/cdc_ether.ko
-drivers/net/usb/cdc_ncm.ko
-drivers/net/usb/r8152.ko
-drivers/net/usb/r8153_ecm.ko
-drivers/net/usb/rtl8150.ko
-drivers/net/usb/usbnet.ko
-drivers/net/wwan/wwan.ko
-drivers/pps/pps_core.ko
-drivers/ptp/ptp.ko
-drivers/ptp/ptp_kvm.ko
-drivers/usb/class/cdc-acm.ko
-drivers/usb/mon/usbmon.ko
-drivers/usb/serial/ftdi_sio.ko
-drivers/usb/serial/usbserial.ko
-lib/crypto/libarc4.ko
-net/6lowpan/6lowpan.ko
-net/6lowpan/nhc_dest.ko
-net/6lowpan/nhc_fragment.ko
-net/6lowpan/nhc_hop.ko
-net/6lowpan/nhc_ipv6.ko
-net/6lowpan/nhc_mobility.ko
-net/6lowpan/nhc_routing.ko
-net/6lowpan/nhc_udp.ko
-net/8021q/8021q.ko
-net/9p/9pnet.ko
-net/9p/9pnet_fd.ko
-net/bluetooth/bluetooth.ko
-net/bluetooth/hidp/hidp.ko
-net/bluetooth/rfcomm/rfcomm.ko
-net/can/can.ko
-net/can/can-bcm.ko
-net/can/can-gw.ko
-net/can/can-raw.ko
-net/ieee802154/6lowpan/ieee802154_6lowpan.ko
-net/ieee802154/ieee802154.ko
-net/ieee802154/ieee802154_socket.ko
-net/l2tp/l2tp_core.ko
-net/l2tp/l2tp_ppp.ko
-net/mac802154/mac802154.ko
-net/nfc/nfc.ko
-net/rfkill/rfkill.ko
-net/tipc/diag.ko
-net/tipc/tipc.ko

arch/arm/boot/dts/broadcom/bcm2837-rpi-cm3-io3.dts

@@ -77,7 +77,7 @@
 };
 
 &hdmi {
-	hpd-gpios = <&expgpio 1 GPIO_ACTIVE_LOW>;
+	hpd-gpios = <&expgpio 0 GPIO_ACTIVE_LOW>;
 	power-domains = <&power RPI_POWER_DOMAIN_HDMI>;
 	status = "okay";
 };

arch/arm64/Makefile

@@ -10,7 +10,7 @@
 #
 # Copyright (C) 1995-2001 by Russell King
 
-LDFLAGS_vmlinux	:=--no-undefined -X
+LDFLAGS_vmlinux	:=--no-undefined -X --pic-veneer
 
 ifeq ($(CONFIG_RELOCATABLE), y)
 # Pass --no-apply-dynamic-relocs to restore pre-binutils-2.27 behaviour

arch/arm64/boot/dts/freescale/imx8mm-android.dtsi

@@ -69,3 +69,8 @@
 &uart1 {
        /delete-node/ bluetooth;
 };
+
+/* Disable uart3 which conflicts with the mute pin of 8mic board */
+&uart3 {
+    status = "disabled";
+};

arch/arm64/boot/dts/freescale/imx8mm-evk-iw612.dts

@@ -7,3 +7,7 @@
 &usdhc1 {
 	status = "disabled";
 };
+
+&uart3 {
+    status = "ok";
+};

arch/arm64/boot/dts/freescale/imx8mn-android.dtsi

@@ -69,3 +69,8 @@
 &uart1 {
        /delete-node/ bluetooth;
 };
+
+/* Disable uart3 which conflicts with the mute pin of 8mic board */
+&uart3 {
+    status = "disabled";
+};

arch/arm64/boot/dts/freescale/imx8qm-mek-revd.dtso

@@ -26,7 +26,6 @@
 		model = "wm8962-audio";
 		audio-cpu = <&sai1>;
 		audio-codec = <&wm8962>;
-		hp-det-gpio = <&lsio_gpio0 31 GPIO_ACTIVE_HIGH>;
 		audio-routing =
 			"Headphone Jack", "HPOUTL",
 			"Headphone Jack", "HPOUTR",

arch/arm64/boot/dts/freescale/imx8qxp-android.dtsi

@@ -66,8 +66,34 @@
 		ftrace-size     = <0x00020000>;
 		pmsg-size       = <0x00020000>;
 	};
+	secure_region: secure {
+		compatible = "imx-secure-ion-pool";
+		reg = <0x0 0xE0000000 0 0x10000000>;
+	};
 };
 
 &lpuart1 {
        /delete-node/ bluetooth;
 };
+
+&dc0_dpr1_channel1 {
+	trusty;
+};
+&dc0_dpr1_channel2 {
+	trusty;
+};
+&dc0_dpr1_channel3 {
+	trusty;
+};
+&dc0_dpr2_channel1 {
+	trusty;
+};
+&dc0_dpr2_channel2 {
+	trusty;
+};
+&dc0_dpr2_channel3 {
+	trusty;
+};
+&dpu1 {
+	trusty;
+};

arch/arm64/boot/dts/freescale/imx8x-mek.dtsi

@@ -88,8 +88,8 @@
 		#size-cells = <2>;
 		ranges;
 
-		decoder_boot: decoder-boot@84000000 {
+		decoder_boot: decoder-boot@96000000 {
-			reg = <0 0x84000000 0 0x2000000>;
+			reg = <0 0x96000000 0 0x2000000>;
 			no-map;
 		};
 
@@ -98,8 +98,8 @@
 			no-map;
 		};
 
-		decoder_rpc: decoder-rpc@92000000 {
+		decoder_rpc: decoder-rpc@a4000000 {
-			reg = <0 0x92000000 0 0x100000>;
+			reg = <0 0xa4000000 0 0x100000>;
 			no-map;
 		};
 

arch/arm64/configs/gki_defconfig

@@ -137,6 +137,7 @@ CONFIG_DAMON_VADDR=y
 CONFIG_DAMON_SYSFS=y
 CONFIG_NET=y
 CONFIG_PACKET=y
+CONFIG_TLS=m
 CONFIG_XFRM_USER=y
 CONFIG_XFRM_INTERFACE=y
 CONFIG_XFRM_MIGRATE=y
@@ -526,6 +527,7 @@ CONFIG_USB_ANNOUNCE_NEW_DEVICES=y
 CONFIG_USB_OTG=y
 CONFIG_USB_MON=m
 CONFIG_USB_XHCI_HCD=y
+CONFIG_USB_XHCI_SIDEBAND=y
 CONFIG_USB_EHCI_HCD=y
 CONFIG_USB_EHCI_ROOT_HUB_TT=y
 CONFIG_USB_EHCI_HCD_PLATFORM=y
@@ -590,7 +592,6 @@ CONFIG_GUNYAH=y
 CONFIG_GUNYAH_IRQFD=y
 CONFIG_GUNYAH_IOEVENTFD=y
 CONFIG_VIRTIO_PCI=m
-# CONFIG_VIRTIO_PCI_LEGACY is not set
 CONFIG_VIRTIO_BALLOON=m
 CONFIG_VHOST_VSOCK=y
 CONFIG_STAGING=y

arch/arm64/geniezone/vm.c

@@ -81,15 +81,24 @@ int gzvm_arch_inform_exit(u16 vm_id)
 	return 0;
 }
 
-int gzvm_arch_probe(void)
+int gzvm_arch_probe(struct gzvm_version drv_version,
+		    struct gzvm_version *hyp_version)
 {
 	struct arm_smccc_res res;
 	int ret;
 
-	ret = gzvm_hypcall_wrapper(MT_HVC_GZVM_PROBE, 0, 0, 0, 0, 0, 0, 0, &res);
+	ret = gzvm_hypcall_wrapper(MT_HVC_GZVM_PROBE,
+				   drv_version.major,
+				   drv_version.minor,
+				   drv_version.sub,
+				   0, 0, 0, 0, &res);
 	if (ret)
 		return -ENXIO;
 
+	hyp_version->major = (u32)res.a1;
+	hyp_version->minor = (u32)res.a2;
+	hyp_version->sub = res.a3;
+
 	return 0;
 }
 
@@ -166,12 +175,18 @@ int gzvm_arch_create_vm(unsigned long vm_type)
 	return ret ? ret : res.a1;
 }
 
-int gzvm_arch_destroy_vm(u16 vm_id)
+int gzvm_arch_destroy_vm(u16 vm_id, u64 destroy_page_gran)
 {
 	struct arm_smccc_res res;
+	int ret;
 
-	return gzvm_hypcall_wrapper(MT_HVC_GZVM_DESTROY_VM, vm_id, 0, 0, 0, 0,
+	do {
-				    0, 0, &res);
+		ret = gzvm_hypcall_wrapper(MT_HVC_GZVM_DESTROY_VM, vm_id,
+					   destroy_page_gran, 0, 0,
+					   0, 0, 0, &res);
+	} while (ret == -EAGAIN);
+
+	return ret;
 }
 
 int gzvm_arch_memregion_purpose(struct gzvm *gzvm,
@@ -203,6 +218,50 @@ static int gzvm_vm_arch_enable_cap(struct gzvm *gzvm,
 				    res);
 }
 
+static int gzvm_arch_enable_cap(struct gzvm_enable_cap *cap,
+				struct arm_smccc_res *res)
+{
+	return gzvm_hypcall_wrapper(MT_HVC_GZVM_ENABLE_CAP, 0,
+				    cap->cap, cap->args[0], cap->args[1],
+				    cap->args[2], cap->args[3], cap->args[4],
+				    res);
+}
+
+int gzvm_arch_query_hyp_batch_pages(struct gzvm_enable_cap *cap,
+				    void __user *argp)
+{
+	struct arm_smccc_res res = {0};
+	int ret;
+
+	ret = gzvm_arch_enable_cap(cap, &res);
+
+	if (ret)
+		return ret;
+
+	if (res.a1 == 0 ||
+	    GZVM_BLOCK_BASED_DEMAND_PAGE_SIZE % (PAGE_SIZE * res.a1) != 0)
+		return -EFAULT;
+
+	cap->args[0] = res.a1;
+
+	return ret;
+}
+
+int gzvm_arch_query_destroy_batch_pages(struct gzvm_enable_cap *cap,
+					void __user *argp)
+{
+	struct arm_smccc_res res = {0};
+	int ret;
+
+	ret = gzvm_arch_enable_cap(cap, &res);
+	/* destroy page batch size should be power of 2 */
+	if (ret || ((res.a1 & (res.a1 - 1)) != 0))
+		return -EINVAL;
+
+	cap->args[0] = res.a1;
+	return ret;
+}
+
 /**
  * gzvm_vm_ioctl_get_pvmfw_size() - Get pvmfw size from hypervisor, return
  *				    in x1, and return to userspace in args

arch/arm64/include/asm/kvm_host.h

@@ -232,6 +232,8 @@ struct kvm_pinned_page {
 	u16			pins;
 };
 
+#define KVM_DUMMY_PPAGE ((struct kvm_pinned_page *)-1)
+
 typedef unsigned int pkvm_handle_t;
 
 struct kvm_protected_vm {

arch/arm64/include/asm/uprobes.h

@@ -10,11 +10,9 @@
 #include <asm/insn.h>
 #include <asm/probes.h>
 
-#define MAX_UINSN_BYTES		AARCH64_INSN_SIZE
-
 #define UPROBE_SWBP_INSN	cpu_to_le32(BRK64_OPCODE_UPROBES)
 #define UPROBE_SWBP_INSN_SIZE	AARCH64_INSN_SIZE
-#define UPROBE_XOL_SLOT_BYTES	MAX_UINSN_BYTES
+#define UPROBE_XOL_SLOT_BYTES	AARCH64_INSN_SIZE
 
 typedef __le32 uprobe_opcode_t;
 
@@ -23,8 +21,8 @@ struct arch_uprobe_task {
 
 struct arch_uprobe {
 	union {
-		u8 insn[MAX_UINSN_BYTES];
+		__le32 insn;
-		u8 ixol[MAX_UINSN_BYTES];
+		__le32 ixol;
 	};
 	struct arch_probe_insn api;
 	bool simulate;

arch/arm64/kernel/probes/decode-insn.c

@@ -99,10 +99,6 @@ arm_probe_decode_insn(probe_opcode_t insn, struct arch_probe_insn *api)
 	    aarch64_insn_is_blr(insn) ||
 	    aarch64_insn_is_ret(insn)) {
 		api->handler = simulate_br_blr_ret;
-	} else if (aarch64_insn_is_ldr_lit(insn)) {
-		api->handler = simulate_ldr_literal;
-	} else if (aarch64_insn_is_ldrsw_lit(insn)) {
-		api->handler = simulate_ldrsw_literal;
 	} else {
 		/*
 		 * Instruction cannot be stepped out-of-line and we don't
@@ -140,6 +136,17 @@ arm_kprobe_decode_insn(kprobe_opcode_t *addr, struct arch_specific_insn *asi)
 	probe_opcode_t insn = le32_to_cpu(*addr);
 	probe_opcode_t *scan_end = NULL;
 	unsigned long size = 0, offset = 0;
+	struct arch_probe_insn *api = &asi->api;
+
+	if (aarch64_insn_is_ldr_lit(insn)) {
+		api->handler = simulate_ldr_literal;
+		decoded = INSN_GOOD_NO_SLOT;
+	} else if (aarch64_insn_is_ldrsw_lit(insn)) {
+		api->handler = simulate_ldrsw_literal;
+		decoded = INSN_GOOD_NO_SLOT;
+	} else {
+		decoded = arm_probe_decode_insn(insn, &asi->api);
+	}
 
 	/*
 	 * If there's a symbol defined in front of and near enough to
@@ -157,7 +164,6 @@ arm_kprobe_decode_insn(kprobe_opcode_t *addr, struct arch_specific_insn *asi)
 		else
 			scan_end = addr - MAX_ATOMIC_CONTEXT_SIZE;
 	}
-	decoded = arm_probe_decode_insn(insn, &asi->api);
 
 	if (decoded != INSN_REJECTED && scan_end)
 		if (is_probed_address_atomic(addr - 1, scan_end))

arch/arm64/kernel/probes/simulate-insn.c

@@ -171,17 +171,15 @@ simulate_tbz_tbnz(u32 opcode, long addr, struct pt_regs *regs)
 void __kprobes
 simulate_ldr_literal(u32 opcode, long addr, struct pt_regs *regs)
 {
-	u64 *load_addr;
+	unsigned long load_addr;
 	int xn = opcode & 0x1f;
-	int disp;
 
-	disp = ldr_displacement(opcode);
+	load_addr = addr + ldr_displacement(opcode);
-	load_addr = (u64 *) (addr + disp);
 
 	if (opcode & (1 << 30))	/* x0-x30 */
-		set_x_reg(regs, xn, *load_addr);
+		set_x_reg(regs, xn, READ_ONCE(*(u64 *)load_addr));
 	else			/* w0-w30 */
-		set_w_reg(regs, xn, *load_addr);
+		set_w_reg(regs, xn, READ_ONCE(*(u32 *)load_addr));
 
 	instruction_pointer_set(regs, instruction_pointer(regs) + 4);
 }
@@ -189,14 +187,12 @@ simulate_ldr_literal(u32 opcode, long addr, struct pt_regs *regs)
 void __kprobes
 simulate_ldrsw_literal(u32 opcode, long addr, struct pt_regs *regs)
 {
-	s32 *load_addr;
+	unsigned long load_addr;
 	int xn = opcode & 0x1f;
-	int disp;
 
-	disp = ldr_displacement(opcode);
+	load_addr = addr + ldr_displacement(opcode);
-	load_addr = (s32 *) (addr + disp);
 
-	set_x_reg(regs, xn, *load_addr);
+	set_x_reg(regs, xn, READ_ONCE(*(s32 *)load_addr));
 
 	instruction_pointer_set(regs, instruction_pointer(regs) + 4);
 }

arch/arm64/kernel/probes/uprobes.c

@@ -42,7 +42,7 @@ int arch_uprobe_analyze_insn(struct arch_uprobe *auprobe, struct mm_struct *mm,
 	else if (!IS_ALIGNED(addr, AARCH64_INSN_SIZE))
 		return -EINVAL;
 
-	insn = *(probe_opcode_t *)(&auprobe->insn[0]);
+	insn = le32_to_cpu(auprobe->insn);
 
 	switch (arm_probe_decode_insn(insn, &auprobe->api)) {
 	case INSN_REJECTED:
@@ -108,7 +108,7 @@ bool arch_uprobe_skip_sstep(struct arch_uprobe *auprobe, struct pt_regs *regs)
 	if (!auprobe->simulate)
 		return false;
 
-	insn = *(probe_opcode_t *)(&auprobe->insn[0]);
+	insn = le32_to_cpu(auprobe->insn);
 	addr = instruction_pointer(regs);
 
 	if (auprobe->api.handler)

arch/arm64/kvm/hyp/nvhe/alloc.c

@@ -798,9 +798,15 @@ done:
 int hyp_alloc_refill(struct kvm_hyp_memcache *host_mc)
 {
 	struct kvm_hyp_memcache *alloc_mc = this_cpu_ptr(&hyp_allocator_mc);
+	int ret;
+	struct hyp_allocator *allocator = &hyp_allocator;
 
-	return refill_memcache(alloc_mc, host_mc->nr_pages + alloc_mc->nr_pages,
+	hyp_spin_lock(&allocator->lock);
-			       host_mc);
+	ret = refill_memcache(alloc_mc, host_mc->nr_pages + alloc_mc->nr_pages,
+			      host_mc);
+	hyp_spin_unlock(&allocator->lock);
+
+	return ret;
 }
 
 int hyp_alloc_init(size_t size)

arch/arm64/kvm/hyp/nvhe/mem_protect.c

@@ -158,22 +158,16 @@ static void prepare_host_vtcr(void)
 static int prepopulate_host_stage2(void)
 {
 	struct memblock_region *reg;
-	u64 addr = 0;
+	int i, ret = 0;
-	int i, ret;
 
 	for (i = 0; i < hyp_memblock_nr; i++) {
 		reg = &hyp_memory[i];
-		ret = host_stage2_idmap_locked(addr, reg->base - addr, PKVM_HOST_MMIO_PROT, false);
-		if (ret)
-			return ret;
 		ret = host_stage2_idmap_locked(reg->base, reg->size, PKVM_HOST_MEM_PROT, false);
 		if (ret)
 			return ret;
-		addr = reg->base + reg->size;
 	}
 
-	return host_stage2_idmap_locked(addr, BIT(host_mmu.pgt.ia_bits) - addr,
+	return ret;
-					PKVM_HOST_MMIO_PROT, false);
 }
 
 int kvm_host_prepare_stage2(void *pgt_pool_base)
@@ -1209,9 +1203,9 @@ static int host_ack_donation(u64 addr,
 
 static int host_ack_unshare(const struct pkvm_checked_mem_transition *checked_tx)
 {
-	return __host_ack_transition(checked_tx->completer_addr,
+	return __host_check_page_state_range(checked_tx->completer_addr,
-				     checked_tx->nr_pages * PAGE_SIZE,
+					     checked_tx->nr_pages * PAGE_SIZE,
-				     checked_tx->tx, PKVM_PAGE_SHARED_BORROWED);
+					     PKVM_PAGE_SHARED_BORROWED);
 }
 
 static int host_complete_share(const struct pkvm_checked_mem_transition *checked_tx,
@@ -1325,13 +1319,9 @@ static int hyp_ack_share(const struct pkvm_checked_mem_transition *checked_tx,
 
 static int hyp_ack_unshare(const struct pkvm_checked_mem_transition *checked_tx)
 {
-	const struct pkvm_mem_transition *tx = checked_tx->tx;
 	u64 size = checked_tx->nr_pages * PAGE_SIZE;
 	u64 addr = checked_tx->completer_addr;
 
-	if (__hyp_ack_skip_pgtable_check(tx))
-		return 0;
-
 	return __hyp_check_page_state_range(addr, size,
 					    PKVM_PAGE_SHARED_BORROWED);
 }
@@ -2832,14 +2822,7 @@ void destroy_hyp_vm_pgt(struct pkvm_hyp_vm *vm)
 
 void drain_hyp_pool(struct pkvm_hyp_vm *vm, struct kvm_hyp_memcache *mc)
 {
-	void *addr = hyp_alloc_pages(&vm->pool, 0);
+	WARN_ON(reclaim_hyp_pool(&vm->pool, mc, INT_MAX) != -ENOMEM);
-
-	while (addr) {
-		hyp_page_ref_dec(hyp_virt_to_page(addr));
-		push_hyp_memcache(mc, addr, hyp_virt_to_phys, 0);
-		WARN_ON(__pkvm_hyp_donate_host(hyp_virt_to_pfn(addr), 1));
-		addr = hyp_alloc_pages(&vm->pool, 0);
-	}
 }
 
 int __pkvm_host_reclaim_page(struct pkvm_hyp_vm *vm, u64 pfn, u64 ipa, u8 order)

arch/arm64/kvm/hyp/nvhe/mm.c

@@ -620,18 +620,31 @@ int refill_hyp_pool(struct hyp_pool *pool, struct kvm_hyp_memcache *host_mc)
 int reclaim_hyp_pool(struct hyp_pool *pool, struct kvm_hyp_memcache *host_mc,
 		     int nr_pages)
 {
-	void *p;
 	struct hyp_page *page;
+	u8 order;
+	void *p;
 
 	while (nr_pages > 0) {
 		p = hyp_alloc_pages(pool, 0);
 		if (!p)
 			return -ENOMEM;
 		page = hyp_virt_to_page(p);
-		nr_pages -= (1 << page->order);
+		order = page->order;
-		push_hyp_memcache(host_mc, p, hyp_virt_to_phys, page->order);
+		nr_pages -= (1 << order);
-		WARN_ON(__pkvm_hyp_donate_host(hyp_virt_to_pfn(p), 1 << page->order));
+
-		memset(page, 0, sizeof(struct hyp_page));
+		/*
+		 * For a compound page all the tail pages should normally
+		 * have page->order == HYP_NO_ORDER which would need to be
+		 * cleared one by one. But in this instance, the order 0
+		 * allocation above can only return an _external_ compound
+		 * page which is in fact ignored by the buddy logic, and the
+		 * tail pages are never touched.
+		 */
+		page->order = 0;
+		hyp_page_ref_dec(page);
+
+		push_hyp_memcache(host_mc, p, hyp_virt_to_phys, order);
+		WARN_ON(__pkvm_hyp_donate_host(hyp_virt_to_pfn(p), 1 << order));
 	}
 
 	return 0;

arch/arm64/kvm/mmu.c

@@ -326,6 +326,9 @@ static int pkvm_unmap_range(struct kvm *kvm, u64 start, u64 end)
 
 	mt_for_each(&kvm->arch.pkvm.pinned_pages, entry, index, end - 1) {
 		struct kvm_pinned_page *ppage = entry;
+
+		if (ppage == KVM_DUMMY_PPAGE)
+			continue;
 		ret = pkvm_unmap_guest(kvm, ppage);
 		if (ret)
 			break;
@@ -425,6 +428,8 @@ static void pkvm_stage2_flush(struct kvm *kvm)
 	mt_for_each(&kvm->arch.pkvm.pinned_pages, entry, index, ULONG_MAX) {
 		struct kvm_pinned_page *ppage = entry;
 
+		if (ppage == KVM_DUMMY_PPAGE)
+			continue;
 		__clean_dcache_guest_page(page_address(ppage->page), PAGE_SIZE);
 		cond_resched_rwlock_write(&kvm->mmu_lock);
 	}
@@ -1284,7 +1289,11 @@ static int pkvm_wp_range(struct kvm *kvm, u64 start, u64 end)
 
 	mt_for_each(&kvm->arch.pkvm.pinned_pages, entry, index, end - 1) {
 		struct kvm_pinned_page *ppage = entry;
-		int ret = pkvm_call_hyp_nvhe_ppage(ppage, __pkvm_wrprotect_call,
+		int ret;
+
+		if (ppage == KVM_DUMMY_PPAGE)
+			continue;
+		ret = pkvm_call_hyp_nvhe_ppage(ppage, __pkvm_wrprotect_call,
 						   kvm, false);
 
 		if (ret)
@@ -1635,27 +1644,22 @@ find_ppage_or_above(struct kvm *kvm, phys_addr_t ipa)
 	unsigned long index = ipa;
 	void *entry;
 
-	mt_for_each(&kvm->arch.pkvm.pinned_pages, entry, index, ULONG_MAX)
+	mt_for_each(&kvm->arch.pkvm.pinned_pages, entry, index, ULONG_MAX) {
+		if (entry == KVM_DUMMY_PPAGE)
+			continue;
 		return entry;
+	}
 
 	return NULL;
 }
 
-static int insert_ppage(struct kvm *kvm, struct kvm_pinned_page *ppage)
-{
-	size_t size = PAGE_SIZE << ppage->order;
-	unsigned long start = ppage->ipa;
-	unsigned long end = start + size - 1;
-
-	return mtree_insert_range(&kvm->arch.pkvm.pinned_pages, start, end,
-				  ppage, GFP_KERNEL);
-}
-
 static struct kvm_pinned_page *find_ppage(struct kvm *kvm, u64 ipa)
 {
+	struct kvm_pinned_page *ppage;
 	unsigned long index = ipa;
 
-	return mt_find(&kvm->arch.pkvm.pinned_pages, &index, ipa + PAGE_SIZE - 1);
+	ppage = mt_find(&kvm->arch.pkvm.pinned_pages, &index, ipa + PAGE_SIZE - 1);
+	return ppage == KVM_DUMMY_PPAGE ? NULL : ppage;
 }
 
 static int __pkvm_relax_perms_call(u64 pfn, u64 gfn, u8 order, void *args)
@@ -1707,10 +1711,11 @@ static int pkvm_mem_abort(struct kvm_vcpu *vcpu, phys_addr_t *fault_ipa,
 {
 	unsigned int flags = FOLL_HWPOISON | FOLL_LONGTERM | FOLL_WRITE;
 	struct kvm_hyp_memcache *hyp_memcache = &vcpu->arch.stage2_mc;
-	unsigned long index, pmd_offset, page_size;
+	unsigned long index, pmd_offset, page_size, end;
 	struct mm_struct *mm = current->mm;
 	struct kvm_pinned_page *ppage;
 	struct kvm *kvm = vcpu->kvm;
+	struct maple_tree *mt = &kvm->arch.pkvm.pinned_pages;
 	int ret, nr_pages;
 	struct page *page;
 	u64 pfn;
@@ -1765,53 +1770,60 @@ static int pkvm_mem_abort(struct kvm_vcpu *vcpu, phys_addr_t *fault_ipa,
 						fault_ipa);
 	page = pfn_to_page(pfn);
 
+retry:
 	if (size)
 		*size = page_size;
 
-retry:
 	ret = account_locked_vm(mm, page_size >> PAGE_SHIFT, true);
 	if (ret)
 		goto unpin;
 
-	write_lock(&kvm->mmu_lock);
+	index = *fault_ipa;
+	end = index + page_size - 1;
+	ppage->page = page;
+	ppage->ipa = *fault_ipa;
+	ppage->order = get_order(page_size);
+	ppage->pins = 1 << ppage->order;
+
 	/*
 	 * If we already have a mapping in the middle of the THP, we have no
 	 * other choice than enforcing PAGE_SIZE for pkvm_host_map_guest() to
 	 * succeed.
 	 */
-	index = *fault_ipa;
+	if (page_size > PAGE_SIZE && mt_find(mt, &index, end)) {
-	if (page_size > PAGE_SIZE &&
-	    mt_find(&kvm->arch.pkvm.pinned_pages, &index, index + page_size - 1)) {
-		write_unlock(&kvm->mmu_lock);
 		*fault_ipa += pmd_offset;
 		pfn += pmd_offset >> PAGE_SHIFT;
 		page = pfn_to_page(pfn);
-		page_size = PAGE_SIZE;
 		account_locked_vm(mm, page_size >> PAGE_SHIFT, false);
+		page_size = PAGE_SIZE;
 		goto retry;
 	}
 
-	ret = pkvm_host_map_guest(pfn, *fault_ipa >> PAGE_SHIFT,
+	/* Reserve space in the mtree */
-				  page_size >> PAGE_SHIFT, KVM_PGTABLE_PROT_R);
+	ret = mtree_insert_range(mt, index, end, KVM_DUMMY_PPAGE, GFP_KERNEL);
 	if (ret) {
-		if (ret == -EAGAIN)
+		if (ret == -EEXIST)
 			ret = 0;
-
 		goto dec_account;
 	}
 
-	ppage->page = page;
+	write_lock(&kvm->mmu_lock);
-	ppage->ipa = *fault_ipa;
+	ret = pkvm_host_map_guest(pfn, *fault_ipa >> PAGE_SHIFT,
-	ppage->order = get_order(page_size);
+				  page_size >> PAGE_SHIFT, KVM_PGTABLE_PROT_R);
-	ppage->pins = 1 << ppage->order;
+	if (ret) {
-	WARN_ON(insert_ppage(kvm, ppage));
+		if (WARN_ON(ret == -EAGAIN))
+			ret = 0;
 
+		goto err_unlock;
+	}
+	WARN_ON(mtree_store_range(mt, index, end, ppage, GFP_ATOMIC));
 	write_unlock(&kvm->mmu_lock);
 
 	return 0;
 
-dec_account:
+err_unlock:
 	write_unlock(&kvm->mmu_lock);
+dec_account:
 	account_locked_vm(mm, page_size >> PAGE_SHIFT, false);
 unpin:
 	unpin_user_pages(&page, 1);
@@ -1842,7 +1854,7 @@ int pkvm_mem_abort_range(struct kvm_vcpu *vcpu, phys_addr_t fault_ipa, size_t si
 	ppage = find_ppage_or_above(vcpu->kvm, fault_ipa);
 
 	while (fault_ipa < ipa_end) {
-		if (ppage && ppage->ipa == fault_ipa) {
+		if (ppage && ppage != KVM_DUMMY_PPAGE && ppage->ipa == fault_ipa) {
 			page_size = PAGE_SIZE << ppage->order;
 			ppage = mt_next(&vcpu->kvm->arch.pkvm.pinned_pages,
 					ppage->ipa, ULONG_MAX);

arch/arm64/kvm/pkvm.c

@@ -330,6 +330,8 @@ static void __pkvm_destroy_hyp_vm(struct kvm *host_kvm)
 	WARN_ON(kvm_call_hyp_nvhe(__pkvm_start_teardown_vm, host_kvm->arch.pkvm.handle));
 
 	mt_for_each(&host_kvm->arch.pkvm.pinned_pages, ppage, ipa, ULONG_MAX) {
+		if (WARN_ON(ppage == KVM_DUMMY_PPAGE))
+			continue;
 		WARN_ON(pkvm_call_hyp_nvhe_ppage(ppage,
 						 __reclaim_dying_guest_page_call,
 						 host_kvm, true));
@@ -539,7 +541,7 @@ void pkvm_host_reclaim_page(struct kvm *host_kvm, phys_addr_t ipa)
 	write_lock(&host_kvm->mmu_lock);
 	ppage = mt_find(&host_kvm->arch.pkvm.pinned_pages, &index,
 			index + PAGE_SIZE - 1);
-	if (ppage) {
+	if (ppage && ppage != KVM_DUMMY_PPAGE) {
 		if (ppage->pins)
 			ppage->pins--;
 		else

arch/loongarch/kernel/process.c

@@ -293,13 +293,15 @@ unsigned long stack_top(void)
 {
 	unsigned long top = TASK_SIZE & PAGE_MASK;
 
-	/* Space for the VDSO & data page */
+	if (current->thread.vdso) {
-	top -= PAGE_ALIGN(current->thread.vdso->size);
+		/* Space for the VDSO & data page */
-	top -= VVAR_SIZE;
+		top -= PAGE_ALIGN(current->thread.vdso->size);
+		top -= VVAR_SIZE;
 
-	/* Space to randomize the VDSO base */
+		/* Space to randomize the VDSO base */
-	if (current->flags & PF_RANDOMIZE)
+		if (current->flags & PF_RANDOMIZE)
-		top -= VDSO_RANDOMIZE_SIZE;
+			top -= VDSO_RANDOMIZE_SIZE;
+	}
 
 	return top;
 }

arch/loongarch/pci/acpi.c

@@ -225,6 +225,7 @@ struct pci_bus *pci_acpi_scan_root(struct acpi_pci_root *root)
 	if (bus) {
 		memcpy(bus->sysdata, info->cfg, sizeof(struct pci_config_window));
 		kfree(info);
+		kfree(root_ops);
 	} else {
 		struct pci_bus *child;
 

arch/powerpc/configs/ps3_defconfig

@@ -24,7 +24,6 @@ CONFIG_PS3_VRAM=m
 CONFIG_PS3_LPM=m
 # CONFIG_PPC_OF_BOOT_TRAMPOLINE is not set
 CONFIG_KEXEC=y
-# CONFIG_PPC64_BIG_ENDIAN_ELF_ABI_V2 is not set
 CONFIG_PPC_4K_PAGES=y
 CONFIG_SCHED_SMT=y
 CONFIG_PM=y

arch/riscv/include/asm/sbi.h

@@ -327,6 +327,8 @@ static inline int sbi_remote_fence_i(const struct cpumask *cpu_mask) { return -1
 static inline void sbi_init(void) {}
 #endif /* CONFIG_RISCV_SBI */
 
+unsigned long riscv_get_mvendorid(void);
+unsigned long riscv_get_marchid(void);
 unsigned long riscv_cached_mvendorid(unsigned int cpu_id);
 unsigned long riscv_cached_marchid(unsigned int cpu_id);
 unsigned long riscv_cached_mimpid(unsigned int cpu_id);

arch/riscv/include/asm/sparsemem.h

@@ -7,7 +7,7 @@
 #ifdef CONFIG_64BIT
 #define MAX_PHYSMEM_BITS	56
 #else
-#define MAX_PHYSMEM_BITS	34
+#define MAX_PHYSMEM_BITS	32
 #endif /* CONFIG_64BIT */
 #define SECTION_SIZE_BITS	27
 #endif /* CONFIG_SPARSEMEM */

arch/riscv/include/asm/thread_info.h

@@ -33,7 +33,6 @@
 
 #define THREAD_SHIFT            (PAGE_SHIFT + THREAD_SIZE_ORDER)
 #define OVERFLOW_STACK_SIZE     SZ_4K
-#define SHADOW_OVERFLOW_STACK_SIZE (1024)
 
 #define IRQ_STACK_SIZE		THREAD_SIZE
 

arch/riscv/kernel/cpu.c

@@ -139,6 +139,34 @@ int riscv_of_parent_hartid(struct device_node *node, unsigned long *hartid)
 	return -1;
 }
 
+unsigned long __init riscv_get_marchid(void)
+{
+	struct riscv_cpuinfo *ci = this_cpu_ptr(&riscv_cpuinfo);
+
+#if IS_ENABLED(CONFIG_RISCV_SBI)
+	ci->marchid = sbi_spec_is_0_1() ? 0 : sbi_get_marchid();
+#elif IS_ENABLED(CONFIG_RISCV_M_MODE)
+	ci->marchid = csr_read(CSR_MARCHID);
+#else
+	ci->marchid = 0;
+#endif
+	return ci->marchid;
+}
+
+unsigned long __init riscv_get_mvendorid(void)
+{
+	struct riscv_cpuinfo *ci = this_cpu_ptr(&riscv_cpuinfo);
+
+#if IS_ENABLED(CONFIG_RISCV_SBI)
+	ci->mvendorid = sbi_spec_is_0_1() ? 0 : sbi_get_mvendorid();
+#elif IS_ENABLED(CONFIG_RISCV_M_MODE)
+	ci->mvendorid = csr_read(CSR_MVENDORID);
+#else
+	ci->mvendorid = 0;
+#endif
+	return ci->mvendorid;
+}
+
 DEFINE_PER_CPU(struct riscv_cpuinfo, riscv_cpuinfo);
 
 unsigned long riscv_cached_mvendorid(unsigned int cpu_id)
@@ -170,12 +198,16 @@ static int riscv_cpuinfo_starting(unsigned int cpu)
 	struct riscv_cpuinfo *ci = this_cpu_ptr(&riscv_cpuinfo);
 
 #if IS_ENABLED(CONFIG_RISCV_SBI)
-	ci->mvendorid = sbi_spec_is_0_1() ? 0 : sbi_get_mvendorid();
+	if (!ci->mvendorid)
-	ci->marchid = sbi_spec_is_0_1() ? 0 : sbi_get_marchid();
+		ci->mvendorid = sbi_spec_is_0_1() ? 0 : sbi_get_mvendorid();
+	if (!ci->marchid)
+		ci->marchid = sbi_spec_is_0_1() ? 0 : sbi_get_marchid();
 	ci->mimpid = sbi_spec_is_0_1() ? 0 : sbi_get_mimpid();
 #elif IS_ENABLED(CONFIG_RISCV_M_MODE)
-	ci->mvendorid = csr_read(CSR_MVENDORID);
+	if (!ci->mvendorid)
-	ci->marchid = csr_read(CSR_MARCHID);
+		ci->mvendorid = csr_read(CSR_MVENDORID);
+	if (!ci->marchid)
+		ci->marchid = csr_read(CSR_MARCHID);
 	ci->mimpid = csr_read(CSR_MIMPID);
 #else
 	ci->mvendorid = 0;

arch/riscv/kernel/cpufeature.c

@@ -482,6 +482,8 @@ static void __init riscv_fill_hwcap_from_isa_string(unsigned long *isa2hwcap)
 	struct acpi_table_header *rhct;
 	acpi_status status;
 	unsigned int cpu;
+	u64 boot_vendorid;
+	u64 boot_archid;
 
 	if (!acpi_disabled) {
 		status = acpi_get_table(ACPI_SIG_RHCT, 0, &rhct);
@@ -489,6 +491,9 @@ static void __init riscv_fill_hwcap_from_isa_string(unsigned long *isa2hwcap)
 			return;
 	}
 
+	boot_vendorid = riscv_get_mvendorid();
+	boot_archid = riscv_get_marchid();
+
 	for_each_possible_cpu(cpu) {
 		struct riscv_isainfo *isainfo = &hart_isa[cpu];
 		unsigned long this_hwcap = 0;
@@ -536,8 +541,7 @@ static void __init riscv_fill_hwcap_from_isa_string(unsigned long *isa2hwcap)
 		 * CPU cores with the ratified spec will contain non-zero
 		 * marchid.
 		 */
-		if (acpi_disabled && riscv_cached_mvendorid(cpu) == THEAD_VENDOR_ID &&
+		if (acpi_disabled && boot_vendorid == THEAD_VENDOR_ID && boot_archid == 0x0) {
-		    riscv_cached_marchid(cpu) == 0x0) {
 			this_hwcap &= ~isa2hwcap[RISCV_ISA_EXT_v];
 			clear_bit(RISCV_ISA_EXT_v, isainfo->isa);
 		}

arch/riscv/kernel/elf_kexec.c

@@ -444,6 +444,12 @@ int arch_kexec_apply_relocations_add(struct purgatory_info *pi,
 			*(u32 *)loc = CLEAN_IMM(CJTYPE, *(u32 *)loc) |
 				 ENCODE_CJTYPE_IMM(val - addr);
 			break;
+		case R_RISCV_ADD16:
+			*(u16 *)loc += val;
+			break;
+		case R_RISCV_SUB16:
+			*(u16 *)loc -= val;
+			break;
 		case R_RISCV_ADD32:
 			*(u32 *)loc += val;
 			break;

arch/riscv/kernel/entry.S

@@ -228,8 +228,8 @@ SYM_CODE_START(ret_from_fork)
 	jalr s0
 1:
 	move a0, sp /* pt_regs */
-	la ra, ret_from_exception
+	call syscall_exit_to_user_mode
-	tail syscall_exit_to_user_mode
+	j ret_from_exception
 SYM_CODE_END(ret_from_fork)
 
 /*

arch/riscv/net/bpf_jit_comp64.c

@@ -555,8 +555,8 @@ static void emit_atomic(u8 rd, u8 rs, s16 off, s32 imm, bool is64,
 		     rv_lr_w(r0, 0, rd, 0, 0), ctx);
 		jmp_offset = ninsns_rvoff(8);
 		emit(rv_bne(RV_REG_T2, r0, jmp_offset >> 1), ctx);
-		emit(is64 ? rv_sc_d(RV_REG_T3, rs, rd, 0, 0) :
+		emit(is64 ? rv_sc_d(RV_REG_T3, rs, rd, 0, 1) :
-		     rv_sc_w(RV_REG_T3, rs, rd, 0, 0), ctx);
+		     rv_sc_w(RV_REG_T3, rs, rd, 0, 1), ctx);
 		jmp_offset = ninsns_rvoff(-6);
 		emit(rv_bne(RV_REG_T3, 0, jmp_offset >> 1), ctx);
 		emit(rv_fence(0x3, 0x3), ctx);

arch/s390/include/asm/facility.h

@@ -60,8 +60,10 @@ static inline int test_facility(unsigned long nr)
 	unsigned long facilities_als[] = { FACILITIES_ALS };
 
 	if (__builtin_constant_p(nr) && nr < sizeof(facilities_als) * 8) {
-		if (__test_facility(nr, &facilities_als))
+		if (__test_facility(nr, &facilities_als)) {
-			return 1;
+			if (!__is_defined(__DECOMPRESSOR))
+				return 1;
+		}
 	}
 	return __test_facility(nr, &stfle_fac_list);
 }

arch/s390/include/asm/io.h

@@ -16,8 +16,10 @@
 #include <asm/pci_io.h>
 
 #define xlate_dev_mem_ptr xlate_dev_mem_ptr
+#define kc_xlate_dev_mem_ptr xlate_dev_mem_ptr
 void *xlate_dev_mem_ptr(phys_addr_t phys);
 #define unxlate_dev_mem_ptr unxlate_dev_mem_ptr
+#define kc_unxlate_dev_mem_ptr unxlate_dev_mem_ptr
 void unxlate_dev_mem_ptr(phys_addr_t phys, void *addr);
 
 #define IO_SPACE_LIMIT 0

arch/s390/include/asm/perf_event.h

@@ -73,6 +73,7 @@ struct perf_sf_sde_regs {
 #define SAMPLE_FREQ_MODE(hwc)	(SAMPL_FLAGS(hwc) & PERF_CPUM_SF_FREQ_MODE)
 
 #define perf_arch_fetch_caller_regs(regs, __ip) do {			\
+	(regs)->psw.mask = 0;						\
 	(regs)->psw.addr = (__ip);					\
 	(regs)->gprs[15] = (unsigned long)__builtin_frame_address(0) -	\
 		offsetof(struct stack_frame, back_chain);		\

arch/s390/kernel/perf_cpum_sf.c

@@ -1463,7 +1463,7 @@ static int aux_output_begin(struct perf_output_handle *handle,
 	unsigned long range, i, range_scan, idx, head, base, offset;
 	struct hws_trailer_entry *te;
 
-	if (WARN_ON_ONCE(handle->head & ~PAGE_MASK))
+	if (handle->head & ~PAGE_MASK)
 		return -EINVAL;
 
 	aux->head = handle->head >> PAGE_SHIFT;
@@ -1642,7 +1642,7 @@ static void hw_collect_aux(struct cpu_hw_sf *cpuhw)
 	unsigned long num_sdb;
 
 	aux = perf_get_aux(handle);
-	if (WARN_ON_ONCE(!aux))
+	if (!aux)
 		return;
 
 	/* Inform user space new data arrived */
@@ -1661,7 +1661,7 @@ static void hw_collect_aux(struct cpu_hw_sf *cpuhw)
 				num_sdb);
 			break;
 		}
-		if (WARN_ON_ONCE(!aux))
+		if (!aux)
 			return;
 
 		/* Update head and alert_mark to new position */
@@ -1896,12 +1896,8 @@ static void cpumsf_pmu_start(struct perf_event *event, int flags)
 {
 	struct cpu_hw_sf *cpuhw = this_cpu_ptr(&cpu_hw_sf);
 
-	if (WARN_ON_ONCE(!(event->hw.state & PERF_HES_STOPPED)))
+	if (!(event->hw.state & PERF_HES_STOPPED))
 		return;
-
-	if (flags & PERF_EF_RELOAD)
-		WARN_ON_ONCE(!(event->hw.state & PERF_HES_UPTODATE));
-
 	perf_pmu_disable(event->pmu);
 	event->hw.state = 0;
 	cpuhw->lsctl.cs = 1;

arch/s390/kvm/diag.c

@@ -77,7 +77,7 @@ static int __diag_page_ref_service(struct kvm_vcpu *vcpu)
 	vcpu->stat.instruction_diagnose_258++;
 	if (vcpu->run->s.regs.gprs[rx] & 7)
 		return kvm_s390_inject_program_int(vcpu, PGM_SPECIFICATION);
-	rc = read_guest(vcpu, vcpu->run->s.regs.gprs[rx], rx, &parm, sizeof(parm));
+	rc = read_guest_real(vcpu, vcpu->run->s.regs.gprs[rx], &parm, sizeof(parm));
 	if (rc)
 		return kvm_s390_inject_prog_cond(vcpu, rc);
 	if (parm.parm_version != 2 || parm.parm_len < 5 || parm.code != 0x258)

arch/s390/kvm/gaccess.c

@@ -1001,6 +1001,8 @@ static int access_guest_page(struct kvm *kvm, enum gacc_mode mode, gpa_t gpa,
 	const gfn_t gfn = gpa_to_gfn(gpa);
 	int rc;
 
+	if (!gfn_to_memslot(kvm, gfn))
+		return PGM_ADDRESSING;
 	if (mode == GACC_STORE)
 		rc = kvm_write_guest_page(kvm, gfn, data, offset, len);
 	else
@@ -1158,6 +1160,8 @@ int access_guest_real(struct kvm_vcpu *vcpu, unsigned long gra,
 		gra += fragment_len;
 		data += fragment_len;
 	}
+	if (rc > 0)
+		vcpu->arch.pgm.code = rc;
 	return rc;
 }
 

arch/s390/kvm/gaccess.h

@@ -405,11 +405,12 @@ int read_guest_abs(struct kvm_vcpu *vcpu, unsigned long gpa, void *data,
  * @len: number of bytes to copy
  *
  * Copy @len bytes from @data (kernel space) to @gra (guest real address).
- * It is up to the caller to ensure that the entire guest memory range is
- * valid memory before calling this function.
  * Guest low address and key protection are not checked.
  *
- * Returns zero on success or -EFAULT on error.
+ * Returns zero on success, -EFAULT when copying from @data failed, or
+ * PGM_ADRESSING in case @gra is outside a memslot. In this case, pgm check info
+ * is also stored to allow injecting into the guest (if applicable) using
+ * kvm_s390_inject_prog_cond().
  *
  * If an error occurs data may have been copied partially to guest memory.
  */
@@ -428,11 +429,12 @@ int write_guest_real(struct kvm_vcpu *vcpu, unsigned long gra, void *data,
  * @len: number of bytes to copy
  *
  * Copy @len bytes from @gra (guest real address) to @data (kernel space).
- * It is up to the caller to ensure that the entire guest memory range is
- * valid memory before calling this function.
  * Guest key protection is not checked.
  *
- * Returns zero on success or -EFAULT on error.
+ * Returns zero on success, -EFAULT when copying to @data failed, or
+ * PGM_ADRESSING in case @gra is outside a memslot. In this case, pgm check info
+ * is also stored to allow injecting into the guest (if applicable) using
+ * kvm_s390_inject_prog_cond().
  *
  * If an error occurs data may have been copied partially to kernel space.
  */

arch/s390/mm/cmm.c

@@ -95,11 +95,12 @@ static long cmm_alloc_pages(long nr, long *counter,
 		(*counter)++;
 		spin_unlock(&cmm_lock);
 		nr--;
+		cond_resched();
 	}
 	return nr;
 }
 
-static long cmm_free_pages(long nr, long *counter, struct cmm_page_array **list)
+static long __cmm_free_pages(long nr, long *counter, struct cmm_page_array **list)
 {
 	struct cmm_page_array *pa;
 	unsigned long addr;
@@ -123,6 +124,21 @@ static long cmm_free_pages(long nr, long *counter, struct cmm_page_array **list)
 	return nr;
 }
 
+static long cmm_free_pages(long nr, long *counter, struct cmm_page_array **list)
+{
+	long inc = 0;
+
+	while (nr) {
+		inc = min(256L, nr);
+		nr -= inc;
+		inc = __cmm_free_pages(inc, counter, list);
+		if (inc)
+			break;
+		cond_resched();
+	}
+	return nr + inc;
+}
+
 static int cmm_oom_notify(struct notifier_block *self,
 			  unsigned long dummy, void *parm)
 {

arch/s390/pci/pci_event.c

@@ -272,18 +272,19 @@ static void __zpci_event_error(struct zpci_ccdf_err *ccdf)
 		goto no_pdev;
 
 	switch (ccdf->pec) {
-	case 0x003a: /* Service Action or Error Recovery Successful */
+	case 0x002a: /* Error event concerns FMB */
+	case 0x002b:
+	case 0x002c:
+		break;
+	case 0x0040: /* Service Action or Error Recovery Failed */
+	case 0x003b:
+		zpci_event_io_failure(pdev, pci_channel_io_perm_failure);
+		break;
+	default: /* PCI function left in the error state attempt to recover */
 		ers_res = zpci_event_attempt_error_recovery(pdev);
 		if (ers_res != PCI_ERS_RESULT_RECOVERED)
 			zpci_event_io_failure(pdev, pci_channel_io_perm_failure);
 		break;
-	default:
-		/*
-		 * Mark as frozen not permanently failed because the device
-		 * could be subsequently recovered by the platform.
-		 */
-		zpci_event_io_failure(pdev, pci_channel_io_frozen);
-		break;
 	}
 	pci_dev_put(pdev);
 no_pdev:

arch/x86/configs/gki_defconfig

@@ -128,6 +128,7 @@ CONFIG_DAMON_VADDR=y
 CONFIG_DAMON_SYSFS=y
 CONFIG_NET=y
 CONFIG_PACKET=y
+CONFIG_TLS=m
 CONFIG_XFRM_USER=y
 CONFIG_XFRM_INTERFACE=y
 CONFIG_XFRM_MIGRATE=y
@@ -483,6 +484,7 @@ CONFIG_USB_HIDDEV=y
 CONFIG_USB_ANNOUNCE_NEW_DEVICES=y
 CONFIG_USB_MON=m
 CONFIG_USB_XHCI_HCD=y
+CONFIG_USB_XHCI_SIDEBAND=y
 CONFIG_USB_EHCI_HCD=y
 CONFIG_USB_EHCI_ROOT_HUB_TT=y
 CONFIG_USB_EHCI_HCD_PLATFORM=y
@@ -538,7 +540,6 @@ CONFIG_DMABUF_HEAPS_DEFERRED_FREE=y
 CONFIG_DMABUF_HEAPS_PAGE_POOL=y
 CONFIG_UIO=y
 CONFIG_VIRTIO_PCI=m
-# CONFIG_VIRTIO_PCI_LEGACY is not set
 CONFIG_VIRTIO_BALLOON=m
 CONFIG_VHOST_VSOCK=y
 CONFIG_STAGING=y

arch/x86/crypto/TEST_MAPPING

@@ -9,8 +9,8 @@
     {
       "path": "system/netd"
     }
- ],
+  ],
- "presubmit": [
+  "presubmit": [
     {
       "name": "CtsAppEnumerationTestCases",
       "options": [
@@ -289,6 +289,15 @@
     },
     {
       "name": "vts_kernel_net_tests"
+    },
+    {
+      "name": "binderLibTest"
+    },
+    {
+      "name": "CtsLibcoreTestCases"
+    },
+    {
+      "name": "CtsUsbTests"
     }
   ]
 }

arch/x86/entry/entry.S

@@ -9,6 +9,8 @@
 #include <asm/unwind_hints.h>
 #include <asm/segment.h>
 #include <asm/cache.h>
+#include <asm/cpufeatures.h>
+#include <asm/nospec-branch.h>
 
 .pushsection .noinstr.text, "ax"
 
@@ -17,6 +19,9 @@ SYM_FUNC_START(entry_ibpb)
 	movl	$PRED_CMD_IBPB, %eax
 	xorl	%edx, %edx
 	wrmsr
+
+	/* Make sure IBPB clears return stack preductions too. */
+	FILL_RETURN_BUFFER %rax, RSB_CLEAR_LOOPS, X86_BUG_IBPB_NO_RET
 	RET
 SYM_FUNC_END(entry_ibpb)
 /* For KVM */

arch/x86/entry/entry_32.S

@@ -875,6 +875,8 @@ SYM_FUNC_START(entry_SYSENTER_32)
 
 	/* Now ready to switch the cr3 */
 	SWITCH_TO_USER_CR3 scratch_reg=%eax
+	/* Clobbers ZF */
+	CLEAR_CPU_BUFFERS
 
 	/*
 	 * Restore all flags except IF. (We restore IF separately because
@@ -885,7 +887,6 @@ SYM_FUNC_START(entry_SYSENTER_32)
 	BUG_IF_WRONG_CR3 no_user_check=1
 	popfl
 	popl	%eax
-	CLEAR_CPU_BUFFERS
 
 	/*
 	 * Return back to the vDSO, which will pop ecx and edx.
@@ -1148,7 +1149,6 @@ SYM_CODE_START(asm_exc_nmi)
 
 	/* Not on SYSENTER stack. */
 	call	exc_nmi
-	CLEAR_CPU_BUFFERS
 	jmp	.Lnmi_return
 
 .Lnmi_from_sysenter_stack:
@@ -1169,6 +1169,7 @@ SYM_CODE_START(asm_exc_nmi)
 
 	CHECK_AND_APPLY_ESPFIX
 	RESTORE_ALL_NMI cr3_reg=%edi pop=4
+	CLEAR_CPU_BUFFERS
 	jmp	.Lirq_return
 
 #ifdef CONFIG_X86_ESPFIX32
@@ -1210,6 +1211,7 @@ SYM_CODE_START(asm_exc_nmi)
 	 *  1 - orig_ax
 	 */
 	lss	(1+5+6)*4(%esp), %esp			# back to espfix stack
+	CLEAR_CPU_BUFFERS
 	jmp	.Lirq_return
 #endif
 SYM_CODE_END(asm_exc_nmi)

arch/x86/include/asm/TEST_MAPPING

@@ -298,6 +298,30 @@
     },
     {
       "name": "VtsBootconfigTest"
+    },
+    {
+      "name": "binderDriverInterfaceTest"
+    },
+    {
+      "name": "binderLibTest"
+    },
+    {
+      "name": "binderSafeInterfaceTest"
+    },
+    {
+      "name": "memunreachable_binder_test"
+    },
+    {
+      "name": "VtsHalBluetoothAudioTargetTest"
+    },
+    {
+      "name": "CtsBionicTestCases"
+    },
+    {
+      "name": "CtsLibcoreTestCases"
+    },
+    {
+      "name": "CtsUsbTests"
     }
   ]
 }

arch/x86/include/asm/cpufeatures.h

@@ -216,7 +216,7 @@
 #define X86_FEATURE_SPEC_STORE_BYPASS_DISABLE	( 7*32+23) /* "" Disable Speculative Store Bypass. */
 #define X86_FEATURE_LS_CFG_SSBD		( 7*32+24)  /* "" AMD SSBD implementation via LS_CFG MSR */
 #define X86_FEATURE_IBRS		( 7*32+25) /* Indirect Branch Restricted Speculation */
-#define X86_FEATURE_IBPB		( 7*32+26) /* Indirect Branch Prediction Barrier */
+#define X86_FEATURE_IBPB		( 7*32+26) /* "ibpb" Indirect Branch Prediction Barrier without a guaranteed RSB flush */
 #define X86_FEATURE_STIBP		( 7*32+27) /* Single Thread Indirect Branch Predictors */
 #define X86_FEATURE_ZEN			( 7*32+28) /* "" Generic flag for all Zen and newer */
 #define X86_FEATURE_L1TF_PTEINV		( 7*32+29) /* "" L1TF workaround PTE inversion */
@@ -347,6 +347,7 @@
 #define X86_FEATURE_CPPC		(13*32+27) /* Collaborative Processor Performance Control */
 #define X86_FEATURE_AMD_PSFD            (13*32+28) /* "" Predictive Store Forwarding Disable */
 #define X86_FEATURE_BTC_NO		(13*32+29) /* "" Not vulnerable to Branch Type Confusion */
+#define X86_FEATURE_AMD_IBPB_RET	(13*32+30) /* "" IBPB clears return address predictor */
 #define X86_FEATURE_BRS			(13*32+31) /* Branch Sampling available */
 
 /* Thermal and Power Management Leaf, CPUID level 0x00000006 (EAX), word 14 */
@@ -516,4 +517,5 @@
 #define X86_BUG_DIV0			X86_BUG(1*32 + 1) /* AMD DIV0 speculation bug */
 #define X86_BUG_RFDS			X86_BUG(1*32 + 2) /* CPU is vulnerable to Register File Data Sampling */
 #define X86_BUG_BHI			X86_BUG(1*32 + 3) /* CPU is affected by Branch History Injection */
+#define X86_BUG_IBPB_NO_RET		X86_BUG(1*32 + 4) /* "ibpb_no_ret" IBPB omits return target predictions */
 #endif /* _ASM_X86_CPUFEATURES_H */

arch/x86/include/asm/nospec-branch.h

@@ -332,7 +332,16 @@
  * Note: Only the memory operand variant of VERW clears the CPU buffers.
  */
 .macro CLEAR_CPU_BUFFERS
-	ALTERNATIVE "", __stringify(verw _ASM_RIP(mds_verw_sel)), X86_FEATURE_CLEAR_CPU_BUF
+#ifdef CONFIG_X86_64
+	ALTERNATIVE "", "verw mds_verw_sel(%rip)", X86_FEATURE_CLEAR_CPU_BUF
+#else
+	/*
+	 * In 32bit mode, the memory operand must be a %cs reference. The data
+	 * segments may not be usable (vm86 mode), and the stack segment may not
+	 * be flat (ESPFIX32).
+	 */
+	ALTERNATIVE "", "verw %cs:mds_verw_sel", X86_FEATURE_CLEAR_CPU_BUF
+#endif
 .endm
 
 #ifdef CONFIG_X86_64

arch/x86/kernel/amd_nb.c

@@ -26,6 +26,7 @@
 #define PCI_DEVICE_ID_AMD_19H_M70H_ROOT		0x14e8
 #define PCI_DEVICE_ID_AMD_1AH_M00H_ROOT		0x153a
 #define PCI_DEVICE_ID_AMD_1AH_M20H_ROOT		0x1507
+#define PCI_DEVICE_ID_AMD_1AH_M60H_ROOT		0x1122
 #define PCI_DEVICE_ID_AMD_MI200_ROOT		0x14bb
 
 #define PCI_DEVICE_ID_AMD_17H_DF_F4		0x1464
@@ -61,6 +62,7 @@ static const struct pci_device_id amd_root_ids[] = {
 	{ PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_19H_M70H_ROOT) },
 	{ PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_1AH_M00H_ROOT) },
 	{ PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_1AH_M20H_ROOT) },
+	{ PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_1AH_M60H_ROOT) },
 	{ PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_MI200_ROOT) },
 	{}
 };
@@ -92,6 +94,8 @@ static const struct pci_device_id amd_nb_misc_ids[] = {
 	{ PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_19H_M78H_DF_F3) },
 	{ PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_1AH_M00H_DF_F3) },
 	{ PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_1AH_M20H_DF_F3) },
+	{ PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_1AH_M60H_DF_F3) },
+	{ PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_1AH_M70H_DF_F3) },
 	{ PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_MI200_DF_F3) },
 	{}
 };

arch/x86/kernel/apic/apic.c

@@ -473,7 +473,19 @@ static int lapic_timer_shutdown(struct clock_event_device *evt)
 	v = apic_read(APIC_LVTT);
 	v |= (APIC_LVT_MASKED | LOCAL_TIMER_VECTOR);
 	apic_write(APIC_LVTT, v);
-	apic_write(APIC_TMICT, 0);
+
+	/*
+	 * Setting APIC_LVT_MASKED (above) should be enough to tell
+	 * the hardware that this timer will never fire. But AMD
+	 * erratum 411 and some Intel CPU behavior circa 2024 say
+	 * otherwise.  Time for belt and suspenders programming: mask
+	 * the timer _and_ zero the counter registers:
+	 */
+	if (v & APIC_LVT_TIMER_TSCDEADLINE)
+		wrmsrl(MSR_IA32_TSC_DEADLINE, 0);
+	else
+		apic_write(APIC_TMICT, 0);
+
 	return 0;
 }
 

arch/x86/kernel/cpu/amd.c

@@ -1374,7 +1374,8 @@ void amd_check_microcode(void)
 	if (boot_cpu_data.x86_vendor != X86_VENDOR_AMD)
 		return;
 
-	on_each_cpu(zenbleed_check_cpu, NULL, 1);
+	if (cpu_feature_enabled(X86_FEATURE_ZEN2))
+		on_each_cpu(zenbleed_check_cpu, NULL, 1);
 }
 
 /*

arch/x86/kernel/cpu/bugs.c

@@ -1113,8 +1113,25 @@ do_cmd_auto:
 
 	case RETBLEED_MITIGATION_IBPB:
 		setup_force_cpu_cap(X86_FEATURE_ENTRY_IBPB);
+
+		/*
+		 * IBPB on entry already obviates the need for
+		 * software-based untraining so clear those in case some
+		 * other mitigation like SRSO has selected them.
+		 */
+		setup_clear_cpu_cap(X86_FEATURE_UNRET);
+		setup_clear_cpu_cap(X86_FEATURE_RETHUNK);
+
 		setup_force_cpu_cap(X86_FEATURE_IBPB_ON_VMEXIT);
 		mitigate_smt = true;
+
+		/*
+		 * There is no need for RSB filling: entry_ibpb() ensures
+		 * all predictions, including the RSB, are invalidated,
+		 * regardless of IBPB implementation.
+		 */
+		setup_clear_cpu_cap(X86_FEATURE_RSB_VMEXIT);
+
 		break;
 
 	case RETBLEED_MITIGATION_STUFF:
@@ -2610,6 +2627,14 @@ static void __init srso_select_mitigation(void)
 			if (has_microcode) {
 				setup_force_cpu_cap(X86_FEATURE_ENTRY_IBPB);
 				srso_mitigation = SRSO_MITIGATION_IBPB;
+
+				/*
+				 * IBPB on entry already obviates the need for
+				 * software-based untraining so clear those in case some
+				 * other mitigation like Retbleed has selected them.
+				 */
+				setup_clear_cpu_cap(X86_FEATURE_UNRET);
+				setup_clear_cpu_cap(X86_FEATURE_RETHUNK);
 			}
 		} else {
 			pr_err("WARNING: kernel not compiled with CPU_IBPB_ENTRY.\n");
@@ -2622,6 +2647,13 @@ static void __init srso_select_mitigation(void)
 			if (!boot_cpu_has(X86_FEATURE_ENTRY_IBPB) && has_microcode) {
 				setup_force_cpu_cap(X86_FEATURE_IBPB_ON_VMEXIT);
 				srso_mitigation = SRSO_MITIGATION_IBPB_ON_VMEXIT;
+
+				/*
+				 * There is no need for RSB filling: entry_ibpb() ensures
+				 * all predictions, including the RSB, are invalidated,
+				 * regardless of IBPB implementation.
+				 */
+				setup_clear_cpu_cap(X86_FEATURE_RSB_VMEXIT);
 			}
 		} else {
 			pr_err("WARNING: kernel not compiled with CPU_SRSO.\n");

arch/x86/kernel/cpu/common.c

@@ -1483,6 +1483,9 @@ static void __init cpu_set_bug_bits(struct cpuinfo_x86 *c)
 	     boot_cpu_has(X86_FEATURE_HYPERVISOR)))
 		setup_force_cpu_bug(X86_BUG_BHI);
 
+	if (cpu_has(c, X86_FEATURE_AMD_IBPB) && !cpu_has(c, X86_FEATURE_AMD_IBPB_RET))
+		setup_force_cpu_bug(X86_BUG_IBPB_NO_RET);
+
 	if (cpu_matches(cpu_vuln_whitelist, NO_MELTDOWN))
 		return;
 

arch/x86/kernel/cpu/resctrl/core.c

@@ -193,7 +193,7 @@ static inline bool rdt_get_mb_table(struct rdt_resource *r)
 	return false;
 }
 
-static bool __get_mem_config_intel(struct rdt_resource *r)
+static __init bool __get_mem_config_intel(struct rdt_resource *r)
 {
 	struct rdt_hw_resource *hw_res = resctrl_to_arch_res(r);
 	union cpuid_0x10_3_eax eax;
@@ -227,7 +227,7 @@ static bool __get_mem_config_intel(struct rdt_resource *r)
 	return true;
 }
 
-static bool __rdt_get_mem_config_amd(struct rdt_resource *r)
+static __init bool __rdt_get_mem_config_amd(struct rdt_resource *r)
 {
 	struct rdt_hw_resource *hw_res = resctrl_to_arch_res(r);
 	u32 eax, ebx, ecx, edx, subleaf;

arch/x86/kernel/cpu/resctrl/ctrlmondata.c

@@ -27,10 +27,10 @@
  * hardware. The allocated bandwidth percentage is rounded to the next
  * control step available on the hardware.
  */
-static bool bw_validate(char *buf, unsigned long *data, struct rdt_resource *r)
+static bool bw_validate(char *buf, u32 *data, struct rdt_resource *r)
 {
-	unsigned long bw;
 	int ret;
+	u32 bw;
 
 	/*
 	 * Only linear delay values is supported for current Intel SKUs.
@@ -40,16 +40,21 @@ static bool bw_validate(char *buf, unsigned long *data, struct rdt_resource *r)
 		return false;
 	}
 
-	ret = kstrtoul(buf, 10, &bw);
+	ret = kstrtou32(buf, 10, &bw);
 	if (ret) {
-		rdt_last_cmd_printf("Non-decimal digit in MB value %s\n", buf);
+		rdt_last_cmd_printf("Invalid MB value %s\n", buf);
 		return false;
 	}
 
-	if ((bw < r->membw.min_bw || bw > r->default_ctrl) &&
+	/* Nothing else to do if software controller is enabled. */
-	    !is_mba_sc(r)) {
+	if (is_mba_sc(r)) {
-		rdt_last_cmd_printf("MB value %ld out of range [%d,%d]\n", bw,
+		*data = bw;
-				    r->membw.min_bw, r->default_ctrl);
+		return true;
+	}
+
+	if (bw < r->membw.min_bw || bw > r->default_ctrl) {
+		rdt_last_cmd_printf("MB value %u out of range [%d,%d]\n",
+				    bw, r->membw.min_bw, r->default_ctrl);
 		return false;
 	}
 
@@ -63,7 +68,7 @@ int parse_bw(struct rdt_parse_data *data, struct resctrl_schema *s,
 	struct resctrl_staged_config *cfg;
 	u32 closid = data->rdtgrp->closid;
 	struct rdt_resource *r = s->res;
-	unsigned long bw_val;
+	u32 bw_val;
 
 	cfg = &d->staged_config[s->conf_type];
 	if (cfg->have_new_ctrl) {

arch/x86/kernel/fpu/TEST_MAPPING

@@ -298,6 +298,30 @@
     },
     {
       "name": "VtsBootconfigTest"
+    },
+    {
+      "name": "binderDriverInterfaceTest"
+    },
+    {
+      "name": "binderLibTest"
+    },
+    {
+      "name": "binderSafeInterfaceTest"
+    },
+    {
+      "name": "memunreachable_binder_test"
+    },
+    {
+      "name": "VtsHalBluetoothAudioTargetTest"
+    },
+    {
+      "name": "CtsBionicTestCases"
+    },
+    {
+      "name": "CtsLibcoreTestCases"
+    },
+    {
+      "name": "CtsUsbTests"
     }
   ]
 }

arch/x86/net/bpf_jit_comp.c

@@ -58,6 +58,56 @@ static bool is_imm8(int value)
 	return value <= 127 && value >= -128;
 }
 
+/*
+ * Let us limit the positive offset to be <= 123.
+ * This is to ensure eventual jit convergence For the following patterns:
+ * ...
+ * pass4, final_proglen=4391:
+ *   ...
+ *   20e:    48 85 ff                test   rdi,rdi
+ *   211:    74 7d                   je     0x290
+ *   213:    48 8b 77 00             mov    rsi,QWORD PTR [rdi+0x0]
+ *   ...
+ *   289:    48 85 ff                test   rdi,rdi
+ *   28c:    74 17                   je     0x2a5
+ *   28e:    e9 7f ff ff ff          jmp    0x212
+ *   293:    bf 03 00 00 00          mov    edi,0x3
+ * Note that insn at 0x211 is 2-byte cond jump insn for offset 0x7d (-125)
+ * and insn at 0x28e is 5-byte jmp insn with offset -129.
+ *
+ * pass5, final_proglen=4392:
+ *   ...
+ *   20e:    48 85 ff                test   rdi,rdi
+ *   211:    0f 84 80 00 00 00       je     0x297
+ *   217:    48 8b 77 00             mov    rsi,QWORD PTR [rdi+0x0]
+ *   ...
+ *   28d:    48 85 ff                test   rdi,rdi
+ *   290:    74 1a                   je     0x2ac
+ *   292:    eb 84                   jmp    0x218
+ *   294:    bf 03 00 00 00          mov    edi,0x3
+ * Note that insn at 0x211 is 6-byte cond jump insn now since its offset
+ * becomes 0x80 based on previous round (0x293 - 0x213 = 0x80).
+ * At the same time, insn at 0x292 is a 2-byte insn since its offset is
+ * -124.
+ *
+ * pass6 will repeat the same code as in pass4 and this will prevent
+ * eventual convergence.
+ *
+ * To fix this issue, we need to break je (2->6 bytes) <-> jmp (5->2 bytes)
+ * cycle in the above. In the above example je offset <= 0x7c should work.
+ *
+ * For other cases, je <-> je needs offset <= 0x7b to avoid no convergence
+ * issue. For jmp <-> je and jmp <-> jmp cases, jmp offset <= 0x7c should
+ * avoid no convergence issue.
+ *
+ * Overall, let us limit the positive offset for 8bit cond/uncond jmp insn
+ * to maximum 123 (0x7b). This way, the jit pass can eventually converge.
+ */
+static bool is_imm8_jmp_offset(int value)
+{
+	return value <= 123 && value >= -128;
+}
+
 static bool is_simm32(s64 value)
 {
 	return value == (s64)(s32)value;
@@ -1774,7 +1824,7 @@ emit_cond_jmp:		/* Convert BPF opcode to x86 */
 				return -EFAULT;
 			}
 			jmp_offset = addrs[i + insn->off] - addrs[i];
-			if (is_imm8(jmp_offset)) {
+			if (is_imm8_jmp_offset(jmp_offset)) {
 				if (jmp_padding) {
 					/* To keep the jmp_offset valid, the extra bytes are
 					 * padded before the jump insn, so we subtract the
@@ -1856,7 +1906,7 @@ emit_cond_jmp:		/* Convert BPF opcode to x86 */
 				break;
 			}
 emit_jmp:
-			if (is_imm8(jmp_offset)) {
+			if (is_imm8_jmp_offset(jmp_offset)) {
 				if (jmp_padding) {
 					/* To avoid breaking jmp_offset, the extra bytes
 					 * are padded before the actual jmp insn, so

block/TEST_MAPPING

@@ -306,6 +306,30 @@
     },
     {
       "name": "VtsBootconfigTest"
+    },
+    {
+      "name": "binderDriverInterfaceTest"
+    },
+    {
+      "name": "binderLibTest"
+    },
+    {
+      "name": "binderSafeInterfaceTest"
+    },
+    {
+      "name": "memunreachable_binder_test"
+    },
+    {
+      "name": "VtsHalBluetoothAudioTargetTest"
+    },
+    {
+      "name": "CtsBionicTestCases"
+    },
+    {
+      "name": "CtsLibcoreTestCases"
+    },
+    {
+      "name": "CtsUsbTests"
     }
   ]
 }

block/blk-rq-qos.c

@@ -219,8 +219,8 @@ static int rq_qos_wake_function(struct wait_queue_entry *curr,
 
 	data->got_token = true;
 	smp_wmb();
-	list_del_init(&curr->entry);
 	wake_up_process(data->task);
+	list_del_init_careful(&curr->entry);
 	return 1;
 }
 

block/partitions/core.c

@@ -253,6 +253,8 @@ static int part_uevent(const struct device *dev, struct kobj_uevent_env *env)
 	add_uevent_var(env, "PARTN=%u", part->bd_partno);
 	if (part->bd_meta_info && part->bd_meta_info->volname[0])
 		add_uevent_var(env, "PARTNAME=%s", part->bd_meta_info->volname);
+	if (part->bd_meta_info && part->bd_meta_info->uuid[0])
+		add_uevent_var(env, "PARTUUID=%s", part->bd_meta_info->uuid);
 	return 0;
 }
 

drivers/accel/qaic/qaic_control.c

@@ -496,7 +496,7 @@ static int encode_addr_size_pairs(struct dma_xfer *xfer, struct wrapper_list *wr
 	nents = sgt->nents;
 	nents_dma = nents;
 	*size = QAIC_MANAGE_EXT_MSG_LENGTH - msg_hdr_len - sizeof(**out_trans);
-	for_each_sgtable_sg(sgt, sg, i) {
+	for_each_sgtable_dma_sg(sgt, sg, i) {
 		*size -= sizeof(*asp);
 		/* Save 1K for possible follow-up transactions. */
 		if (*size < SZ_1K) {

drivers/accel/qaic/qaic_data.c

@@ -177,7 +177,7 @@ static int clone_range_of_sgt_for_slice(struct qaic_device *qdev, struct sg_tabl
 	nents = 0;
 
 	size = size ? size : PAGE_SIZE;
-	for (sg = sgt_in->sgl; sg; sg = sg_next(sg)) {
+	for_each_sgtable_dma_sg(sgt_in, sg, j) {
 		len = sg_dma_len(sg);
 
 		if (!len)
@@ -214,7 +214,7 @@ static int clone_range_of_sgt_for_slice(struct qaic_device *qdev, struct sg_tabl
 
 	/* copy relevant sg node and fix page and length */
 	sgn = sgf;
-	for_each_sgtable_sg(sgt, sg, j) {
+	for_each_sgtable_dma_sg(sgt, sg, j) {
 		memcpy(sg, sgn, sizeof(*sg));
 		if (sgn == sgf) {
 			sg_dma_address(sg) += offf;
@@ -294,7 +294,7 @@ static int encode_reqs(struct qaic_device *qdev, struct bo_slice *slice,
 	 * fence.
 	 */
 	dev_addr = req->dev_addr;
-	for_each_sgtable_sg(slice->sgt, sg, i) {
+	for_each_sgtable_dma_sg(slice->sgt, sg, i) {
 		slice->reqs[i].cmd = cmd;
 		slice->reqs[i].src_addr = cpu_to_le64(slice->dir == DMA_TO_DEVICE ?
 						      sg_dma_address(sg) : dev_addr);

drivers/android/TEST_MAPPING

@@ -298,6 +298,30 @@
     },
     {
       "name": "VtsBootconfigTest"
+    },
+    {
+      "name": "binderDriverInterfaceTest"
+    },
+    {
+      "name": "binderLibTest"
+    },
+    {
+      "name": "binderSafeInterfaceTest"
+    },
+    {
+      "name": "memunreachable_binder_test"
+    },
+    {
+      "name": "VtsHalBluetoothAudioTargetTest"
+    },
+    {
+      "name": "CtsBionicTestCases"
+    },
+    {
+      "name": "CtsLibcoreTestCases"
+    },
+    {
+      "name": "CtsUsbTests"
     }
   ]
 }

drivers/android/binder.c

@@ -1404,6 +1404,10 @@ static void binder_cleanup_ref_olocked(struct binder_ref *ref)
 		binder_dequeue_work(ref->proc, &ref->death->work);
 		binder_stats_deleted(BINDER_STAT_DEATH);
 	}
+
+	if (ref->freeze)
+		binder_dequeue_work(ref->proc, &ref->freeze->work);
+
 	binder_stats_deleted(BINDER_STAT_REF);
 }
 
@@ -4072,7 +4076,6 @@ binder_request_freeze_notification(struct binder_proc *proc,
 {
 	struct binder_ref_freeze *freeze;
 	struct binder_ref *ref;
-	bool is_frozen;
 
 	freeze = kzalloc(sizeof(*freeze), GFP_KERNEL);
 	if (!freeze)
@@ -4088,31 +4091,30 @@ binder_request_freeze_notification(struct binder_proc *proc,
 	}
 
 	binder_node_lock(ref->node);
-
+	if (ref->freeze) {
-	if (ref->freeze || !ref->node->proc) {
+		binder_user_error("%d:%d BC_REQUEST_FREEZE_NOTIFICATION already set\n",
-		binder_user_error("%d:%d invalid BC_REQUEST_FREEZE_NOTIFICATION %s\n",
+				  proc->pid, thread->pid);
-				  proc->pid, thread->pid,
-				  ref->freeze ? "already set" : "dead node");
 		binder_node_unlock(ref->node);
 		binder_proc_unlock(proc);
 		kfree(freeze);
 		return -EINVAL;
 	}
-	binder_inner_proc_lock(ref->node->proc);
-	is_frozen = ref->node->proc->is_frozen;
-	binder_inner_proc_unlock(ref->node->proc);
 
 	INIT_LIST_HEAD(&freeze->work.entry);
 	freeze->cookie = handle_cookie->cookie;
 	freeze->work.type = BINDER_WORK_FROZEN_BINDER;
-	freeze->is_frozen = is_frozen;
-
 	ref->freeze = freeze;
 
-	binder_inner_proc_lock(proc);
+	if (ref->node->proc) {
-	binder_enqueue_work_ilocked(&ref->freeze->work, &proc->todo);
+		binder_inner_proc_lock(ref->node->proc);
-	binder_wakeup_proc_ilocked(proc);
+		freeze->is_frozen = ref->node->proc->is_frozen;
-	binder_inner_proc_unlock(proc);
+		binder_inner_proc_unlock(ref->node->proc);
+
+		binder_inner_proc_lock(proc);
+		binder_enqueue_work_ilocked(&freeze->work, &proc->todo);
+		binder_wakeup_proc_ilocked(proc);
+		binder_inner_proc_unlock(proc);
+	}
 
 	binder_node_unlock(ref->node);
 	binder_proc_unlock(proc);
@@ -5392,6 +5394,15 @@ static void binder_release_work(struct binder_proc *proc,
 		} break;
 		case BINDER_WORK_NODE:
 			break;
+		case BINDER_WORK_CLEAR_FREEZE_NOTIFICATION: {
+			struct binder_ref_freeze *freeze;
+
+			freeze = container_of(w, struct binder_ref_freeze, work);
+			binder_debug(BINDER_DEBUG_DEAD_TRANSACTION,
+				     "undelivered freeze notification, %016llx\n",
+				     (u64)freeze->cookie);
+			kfree(freeze);
+		} break;
 		default:
 			pr_err("unexpected work type, %d, not freed\n",
 			       wtype);
@@ -5804,6 +5815,7 @@ static bool binder_txns_pending_ilocked(struct binder_proc *proc)
 
 static void binder_add_freeze_work(struct binder_proc *proc, bool is_frozen)
 {
+	struct binder_node *prev = NULL;
 	struct rb_node *n;
 	struct binder_ref *ref;
 
@@ -5812,7 +5824,10 @@ static void binder_add_freeze_work(struct binder_proc *proc, bool is_frozen)
 		struct binder_node *node;
 
 		node = rb_entry(n, struct binder_node, rb_node);
+		binder_inc_node_tmpref_ilocked(node);
 		binder_inner_proc_unlock(proc);
+		if (prev)
+			binder_put_node(prev);
 		binder_node_lock(node);
 		hlist_for_each_entry(ref, &node->refs, node_entry) {
 			/*
@@ -5838,10 +5853,15 @@ static void binder_add_freeze_work(struct binder_proc *proc, bool is_frozen)
 			}
 			binder_inner_proc_unlock(ref->proc);
 		}
+		prev = node;
 		binder_node_unlock(node);
 		binder_inner_proc_lock(proc);
+		if (proc->is_dead)
+			break;
 	}
 	binder_inner_proc_unlock(proc);
+	if (prev)
+		binder_put_node(prev);
 }
 
 static int binder_ioctl_freeze(struct binder_freeze_info *info,
@@ -6526,6 +6546,7 @@ static void binder_deferred_release(struct binder_proc *proc)
 	if (special_list)
 		binder_release_work(proc, special_list);
 	binder_release_work(proc, &proc->delivered_death);
+	binder_release_work(proc, &proc_wrapper(proc)->delivered_freeze);
 
 	binder_debug(BINDER_DEBUG_OPEN_CLOSE,
 		     "%s: %d threads %d, nodes %d (ref %d), refs %d, active transactions %d\n",
@@ -6660,6 +6681,12 @@ static void print_binder_work_ilocked(struct seq_file *m,
 	case BINDER_WORK_CLEAR_DEATH_NOTIFICATION:
 		seq_printf(m, "%shas cleared death notification\n", prefix);
 		break;
+	case BINDER_WORK_FROZEN_BINDER:
+		seq_printf(m, "%shas frozen binder\n", prefix);
+		break;
+	case BINDER_WORK_CLEAR_FREEZE_NOTIFICATION:
+		seq_printf(m, "%shas cleared freeze notification\n", prefix);
+		break;
 	default:
 		seq_printf(m, "%sunknown work: type %d\n", prefix, w->type);
 		break;
@@ -6809,6 +6836,10 @@ static void print_binder_proc(struct seq_file *m,
 		seq_puts(m, "  has delivered dead binder\n");
 		break;
 	}
+	list_for_each_entry(w, &proc_wrapper(proc)->delivered_freeze, entry) {
+		seq_puts(m, "  has delivered freeze binder\n");
+		break;
+	}
 	binder_inner_proc_unlock(proc);
 	if (!print_all && m->count == header_pos)
 		m->count = start_pos;

drivers/android/vendor_hooks.c

@@ -37,6 +37,7 @@
 #include <trace/hooks/lz4_decompress.h>
 #include <trace/hooks/avc.h>
 #include <trace/hooks/creds.h>
+#include <trace/hooks/module.h>
 #include <trace/hooks/selinux.h>
 #include <trace/hooks/syscall_check.h>
 #include <trace/hooks/gic.h>
@@ -79,6 +80,7 @@
 #include <trace/hooks/fsnotify.h>
 #include <trace/hooks/perf.h>
 #include <trace/hooks/dmabuf.h>
+#include <trace/hooks/xhci.h>
 
 /*
  * Export tracepoints that act as a bare tracehook (ie: have no trace event
@@ -219,6 +221,9 @@ EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_record_mutex_lock_starttime);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_record_rtmutex_lock_starttime);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_record_rwsem_lock_starttime);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_record_pcpu_rwsem_starttime);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_free_mod_mem);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_set_mod_perm_after_init);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_set_mod_perm_before_init);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_selinux_is_initialized);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_shmem_get_folio);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_shmem_mod_shmem);
@@ -273,15 +278,19 @@ EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_futex_wait_end);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_futex_wake_traverse_plist);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_futex_wake_this);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_futex_wake_up_q_finish);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_futex_wait_queue_start);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_ctl_dirty_rate);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_sha256);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_aes_expandkey);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_aes_encrypt);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_aes_decrypt);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_mmc_resume);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_mmc_suspend);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_mmc_update_mmc_queue);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_rwsem_downgrade_wake_finish);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_rwsem_wake_finish);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_meminfo_proc_show);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_meminfo_proc_show);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_exit_mm);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_show_mem);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_print_slabinfo_header);
@@ -304,7 +313,7 @@ EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_gzvm_handle_demand_page_post);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_gzvm_destroy_vm_post_process);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_alter_mutex_list_add);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_mutex_unlock_slowpath);
-EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_mutex_unlock_slowpath_before_wakeq);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_mutex_unlock_slowpath_bf_wakeq);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_save_track_hash);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_should_fault_around);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_mem_cgroup_charge);
@@ -322,6 +331,10 @@ EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_binder_reply);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_binder_trans);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_binder_wait_for_work);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_alloc_flags_cma_adjust);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_mapping_shrinkable);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_madvise_pageout_begin);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_madvise_pageout_end);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_reclaim_folio_list);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_exit_signal_whether_wake);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_exit_check);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_freeze_whether_wake);
@@ -381,6 +394,8 @@ EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_tcp_clean_rtx_queue);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_tcp_rcv_synack);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_udp_unicast_rcv_skb);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_udp6_unicast_rcv_skb);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_tcp_rcv_established_fast_path);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_tcp_rcv_established_slow_path);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_try_to_unmap_one);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_record_rwsem_reader_owned);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_clear_rwsem_reader_owned);
@@ -456,6 +471,8 @@ EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_filemap_add_folio);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_lock_folio_drop_mmap_start);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_lock_folio_drop_mmap_end);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_filemap_update_page);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_lruvec_add_folio);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_lruvec_del_folio);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_update_page_mapcount);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_add_page_to_lrulist);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_del_page_from_lrulist);
@@ -481,6 +498,9 @@ EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_read_lazy_flag);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_set_tsk_need_resched_lazy);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_usb_dev_suspend);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_usb_dev_resume);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_usb_new_device_added);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_xhci_suspend);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_xhci_resume);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_bd_link_disk_holder);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_do_new_mount_fc);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_blk_fill_rwbs);
@@ -508,6 +528,9 @@ EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_perf_rotate_context);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_process_madvise_bypass);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_free_pages_prepare_bypass);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_free_pages_ok_bypass);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_free_pages_prepare_init);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_post_alloc_hook);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_check_new_page);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_split_large_folio_bypass);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_madvise_pageout_return_error);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_process_madvise_return_error);
@@ -568,11 +591,12 @@ EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_ogki_udp6_unicast_rcv_skb);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_ogki_kmem_cache_create_usercopy);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_customize_thp_pcp_order);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_customize_thp_gfp_orders);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_customize_pmd_gfp_bypass);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_init_adjust_zone_wmark);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_cma_alloc_retry);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_ksys_umount);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_do_group_exit);
-EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_suitable_migration_target_bypass);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_migration_target_bypass);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_shrink_node_memcgs);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_swap_writepage);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_dpm_wait_start);
@@ -583,7 +607,18 @@ EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_flush_wq_wait_start);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_flush_wq_wait_finish);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_flush_work_wait_start);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_flush_work_wait_finish);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_refault_filemap_add_folio);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_direct_reclaim_begin);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_direct_reclaim_end);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_wq_queue_work);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_wq_wake_idle_worker);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_dma_buf_release);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_send_signal_locked);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_copy_page_to_user);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_copy_page_from_user);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_destroy_inode);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_rmqueue);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_filemap_get_folio);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_mm_compaction_begin);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_mm_compaction_end);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_do_read_fault);

drivers/ata/ahci.c

@@ -667,6 +667,87 @@ static int mobile_lpm_policy = -1;
 module_param(mobile_lpm_policy, int, 0644);
 MODULE_PARM_DESC(mobile_lpm_policy, "Default LPM policy for mobile chipsets");
 
+static char *ahci_mask_port_map;
+module_param_named(mask_port_map, ahci_mask_port_map, charp, 0444);
+MODULE_PARM_DESC(mask_port_map,
+		 "32-bits port map masks to ignore controllers ports. "
+		 "Valid values are: "
+		 "\"<mask>\" to apply the same mask to all AHCI controller "
+		 "devices, and \"<pci_dev>=<mask>,<pci_dev>=<mask>,...\" to "
+		 "specify different masks for the controllers specified, "
+		 "where <pci_dev> is the PCI ID of an AHCI controller in the "
+		 "form \"domain:bus:dev.func\"");
+
+static void ahci_apply_port_map_mask(struct device *dev,
+				     struct ahci_host_priv *hpriv, char *mask_s)
+{
+	unsigned int mask;
+
+	if (kstrtouint(mask_s, 0, &mask)) {
+		dev_err(dev, "Invalid port map mask\n");
+		return;
+	}
+
+	hpriv->mask_port_map = mask;
+}
+
+static void ahci_get_port_map_mask(struct device *dev,
+				   struct ahci_host_priv *hpriv)
+{
+	char *param, *end, *str, *mask_s;
+	char *name;
+
+	if (!strlen(ahci_mask_port_map))
+		return;
+
+	str = kstrdup(ahci_mask_port_map, GFP_KERNEL);
+	if (!str)
+		return;
+
+	/* Handle single mask case */
+	if (!strchr(str, '=')) {
+		ahci_apply_port_map_mask(dev, hpriv, str);
+		goto free;
+	}
+
+	/*
+	 * Mask list case: parse the parameter to apply the mask only if
+	 * the device name matches.
+	 */
+	param = str;
+	end = param + strlen(param);
+	while (param && param < end && *param) {
+		name = param;
+		param = strchr(name, '=');
+		if (!param)
+			break;
+
+		*param = '\0';
+		param++;
+		if (param >= end)
+			break;
+
+		if (strcmp(dev_name(dev), name) != 0) {
+			param = strchr(param, ',');
+			if (param)
+				param++;
+			continue;
+		}
+
+		mask_s = param;
+		param = strchr(mask_s, ',');
+		if (param) {
+			*param = '\0';
+			param++;
+		}
+
+		ahci_apply_port_map_mask(dev, hpriv, mask_s);
+	}
+
+free:
+	kfree(str);
+}
+
 static void ahci_pci_save_initial_config(struct pci_dev *pdev,
 					 struct ahci_host_priv *hpriv)
 {
@@ -689,6 +770,10 @@ static void ahci_pci_save_initial_config(struct pci_dev *pdev,
 			  "Disabling your PATA port. Use the boot option 'ahci.marvell_enable=0' to avoid this.\n");
 	}
 
+	/* Handle port map masks passed as module parameter. */
+	if (ahci_mask_port_map)
+		ahci_get_port_map_mask(&pdev->dev, hpriv);
+
 	ahci_save_initial_config(&pdev->dev, hpriv);
 }