Merge android13-5.15 into android13-5.15-lts

Sync up with a lot of abi updates and other bug fixes in the android13-5.15 branch to make maintaining the -lts branch easier and to ensure that no abi breakages are missed in lts merges. This consists of the following commits: * 07610c78ef ANDROID: ABI: Update oplus symbol list * 014ca12b89 ANDROID: Export symbols to do reverse mapping within memcg in kernel modules. * 4f49704212 ANDROID: Revert ABI breakage due to accidental CRC value changes * 461099c5b4 UPSTREAM: Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_ready_cb * 1ca64932b3 UPSTREAM: media: usb: siano: Fix warning due to null work_func_t function pointer * 10800b39da ANDROID: ABI: Create symbol list for Microsoft * d1cef5e9ad BACKPORT: UPSTREAM: perf: Fix function pointer case * a2f1e57122 UPSTREAM: net: tap_open(): set sk_uid from current_fsuid() * 0578bb107f UPSTREAM: net: tun_chr_open(): set sk_uid from current_fsuid() * c1469dbe22 UPSTREAM: netfilter: nf_tables: disallow rule addition to bound chain via NFTA_RULE_CHAIN_ID * d2351ceb4c BACKPORT: arm64: errata: add detection for AMEVCNTR01 incrementing incorrectly * 3ca64f2c1d UPSTREAM: net/sched: cls_route: No longer copy tcf_result on update to avoid use-after-free * c4f310ecd5 UPSTREAM: net/sched: cls_fw: No longer copy tcf_result on update to avoid use-after-free * db2dc2ae80 UPSTREAM: net/sched: cls_u32: No longer copy tcf_result on update to avoid use-after-free * f0fefbe055 ANDROID: usb: gadget: f_accessory: Mitgate handling of non-existent USB request * 1c69349e0d ANDROID: dm-bow: Protect Ranges fetched and erased from the RB tree * b9b42d6732 ANDROID: add a new symbol to symbol list for unisoc * 28caaf3085 ANDROID: mm: Add vendor hook to get status of the page being migrated * 6537ae4cd5 ANDROID: GKI: update tuxera symbol list * 67740efa3b FROMGIT: Multi-gen LRU: skip CMA pages when they are not eligible * af8ceb5091 UPSTREAM: net/sched: sch_qfq: account for stab overhead in qfq_enqueue * eec496882b UPSTREAM: netfilter: nf_tables: skip bound chain on rule flush * dc2a55f68f UPSTREAM: net/sched: sch_qfq: refactor parsing of netlink parameters * e904172713 ANDROID: ABI: Add to QCOM symbols list * 8dd7d8410d UPSTREAM: netfilter: nft_set_pipapo: fix improper element removal * 60b4c8ea74 UPSTREAM: tty: n_gsm: fix UAF in gsm_cleanup_mux * daa0bd125a BACKPORT: mm: skip CMA pages when they are not available * 3db113cdcd Revert "BACKPORT: FROMGIT: mm: skip CMA pages when they are not available" * b3dd32ce1e ANDROID: GKI: update xiaomi symbol list * be8c805371 FROMGIT: fs: drop_caches: draining pages before dropping caches * b730973f76 ANDROID: GKI: Update symbols to symbol list * 5aead1412d ANDROID: vendor_hook: fix the error record position of mutex * e77972189d BACKPORT: FROMGIT: usb: common: usb-conn-gpio: Prevent bailing out if initial role is none * 697790241e ANDROID: GKI: Update GKI symbol list and ABI XML * a04724e312 ANDROID: fuse-bpf: Use stored bpf for create_open * df87c26927 ANDROID: fuse-bpf: Add bpf to negative fuse_dentry * de17606319 ANDROID: fuse-bpf: Check inode not null * aa008180c1 ANDROID: fuse-bpf: Fix flock test compile error * 326735624c ANDROID: fuse-bpf: Add partial ioctl support * 6d6ee09bb7 ANDROID: fuse-bpf: Add partial flock support * 10391a144f ANDROID: ABI: update gki symbol list * 255e289386 ANDROID: Add vendor hook for cma adjusting * f9dbe76124 ANDROID: GKI: Update exynos_wear symbol list * e5366d0f95 FROMGIT: BACKPORT: Multi-gen LRU: Fix can_swap in lru_gen_look_around() * a1cd02b590 FROMGIT: BACKPORT: Multi-gen LRU: Avoid race in inc_min_seq() * c3b46dcc26 FROMGIT: BACKPORT: Multi-gen LRU: Fix per-zone reclaim * 6371b5bc4c ANDROID: ABI: Update oplus symbol list ashmem: is_ashmem_file Export is_ashmem_file function which will be used by the minidump module to get ashmem info. * cdabe27cec ANDROID: GKI: Update symbol list * f9ac52c8b5 ANDROID: vendor_hooks: Add hook for blk request * bd148ab7d8 BACKPORT: FROMGIT: irqchip/gic-v3: Workaround for GIC-700 erratum 2941627 * e7b0c0e42a ANDROID: GKI: Update symbol list for Amlogic * a85c984e4d ANDROID: GKI: add symbol list file for moto * 8affb69804 ANDROID: ABI: Update oplus symbol list * 458659366f ANDROID: Inherit "user-aware property" across rtmutex. * 930cf7174f ANDROID: oplus: Update the ABI xml and symbol list * 01e61d3859 ANDROID: vendor_hooks: Add hooks for lookaround * bbd71c9a9e ANDROID: GKI: Update symbol list for Amlogic * 4554a46a86 UPSTREAM: net/sched: cls_fw: Fix improper refcount update leads to use-after-free * 8f388ad9a2 UPSTREAM: fs/ntfs3: Check fields while reading * 667d368492 ANDROID: set kmi_symbol_list_add_only for Kleaf builds. Change-Id: Ifb67bf1e20138e99b28d20b8a2bed243b9ea88dd Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2023-08-24 18:10:52 +00:00
parent 1463976ddc 07610c78ef
commit a15edf0b7a
57 changed files with 4909 additions and 3970 deletions
--- a/BUILD.bazel
+++ b/BUILD.bazel
@@ -23,6 +23,8 @@ _aarch64_additional_kmi_symbol_lists = [
    "android/abi_gki_aarch64_honor",
    "android/abi_gki_aarch64_imx",
    "android/abi_gki_aarch64_lenovo",
+    "android/abi_gki_aarch64_microsoft",
+    "android/abi_gki_aarch64_moto",
    "android/abi_gki_aarch64_mtk",
    "android/abi_gki_aarch64_mtktv",
    "android/abi_gki_aarch64_oplus",
@@ -52,6 +54,7 @@ define_common_kernels(target_configs = {
        "kmi_symbol_list": "android/abi_gki_aarch64",
        "additional_kmi_symbol_lists": _aarch64_additional_kmi_symbol_lists,
        "abi_definition": "android/abi_gki_aarch64.xml",
+        "kmi_symbol_list_add_only": True,
    },
    "kernel_aarch64_debug": {
        "module_implicit_outs": [
@@ -61,6 +64,7 @@ define_common_kernels(target_configs = {
        "kmi_symbol_list": "android/abi_gki_aarch64",
        "additional_kmi_symbol_lists": _aarch64_additional_kmi_symbol_lists,
        "abi_definition": "android/abi_gki_aarch64.xml",
+        "kmi_symbol_list_add_only": True,
    },
 })

--- a/Documentation/arm64/silicon-errata.rst
+++ b/Documentation/arm64/silicon-errata.rst
@@ -102,6 +102,8 @@ stable kernels.
 +----------------+-----------------+-----------------+-----------------------------+
 | ARM            | Cortex-A710     | #2224489        | ARM64_ERRATUM_2224489       |
 +----------------+-----------------+-----------------+-----------------------------+
+| ARM            | Cortex-A510     | #2457168        | ARM64_ERRATUM_2457168       |
+----------------+-----------------+-----------------+-----------------------------+
 | ARM            | Neoverse-N1     | #1188873,1418040| ARM64_ERRATUM_1418040       |
 +----------------+-----------------+-----------------+-----------------------------+
 | ARM            | Neoverse-N1     | #1349291        | N/A                         |
@@ -117,6 +119,9 @@ stable kernels.
 | ARM            | MMU-500         | #841119,826419  | N/A                         |
 +----------------+-----------------+-----------------+-----------------------------+
 +----------------+-----------------+-----------------+-----------------------------+
+| ARM            | GIC-700         | #2941627        | ARM64_ERRATUM_2941627       |
+----------------+-----------------+-----------------+-----------------------------+
+----------------+-----------------+-----------------+-----------------------------+
 | Broadcom       | Brahma-B53      | N/A             | ARM64_ERRATUM_845719        |
 +----------------+-----------------+-----------------+-----------------------------+
 | Broadcom       | Brahma-B53      | N/A             | ARM64_ERRATUM_843419        |
--- a/android/abi_gki_aarch64.xml
+++ b/android/abi_gki_aarch64.xml
--- a/android/abi_gki_aarch64_amlogic
+++ b/android/abi_gki_aarch64_amlogic
@@ -1109,6 +1109,10 @@
  mdiobus_write
  mdio_device_create
  mdio_device_free
+  media_create_pad_link
+  media_entity_remote_pad
+  media_pipeline_start
+  media_pipeline_stop
  memchr
  memcmp
  memcpy
@@ -1326,6 +1330,7 @@
  param_get_charp
  param_get_hexint
  param_get_int
+  param_get_short
  param_get_string
  param_ops_bool
  param_ops_byte
@@ -1342,6 +1347,7 @@
  param_set_copystring
  param_set_hexint
  param_set_int
+  pci_choose_state
  pci_disable_device
  pci_enable_device
  pci_find_next_bus
@@ -1357,9 +1363,11 @@
  pci_read_config_dword
  pci_remove_root_bus
  pci_rescan_bus
+  pci_set_power_state
  pci_stop_and_remove_bus_device_locked
  pci_stop_root_bus
  pci_unlock_rescan_remove
+  pci_write_config_byte
  pci_write_config_dword
  PDE_DATA
  __per_cpu_offset
@@ -1578,6 +1586,11 @@
  regulator_map_voltage_iterate
  regulator_put
  regulator_set_voltage
+  relay_close
+  relay_file_operations
+  relay_flush
+  relay_open
+  relay_switch_subbuf
  release_firmware
  __release_region
  release_resource
@@ -1899,6 +1912,7 @@
  system_freezing_cnt
  system_highpri_wq
  system_power_efficient_wq
+  system_unbound_wq
  system_wq
  sys_tz
  __tasklet_hi_schedule
@@ -1929,6 +1943,7 @@
  __traceiter_android_rvh_check_preempt_tick
  __traceiter_android_rvh_check_preempt_wakeup
  __traceiter_android_rvh_do_sea
+  __traceiter_android_rvh_enqueue_task
  __traceiter_android_rvh_gic_v3_set_affinity
  __traceiter_android_rvh_iommu_setup_dma_ops
  __traceiter_android_rvh_panic_unhandled
@@ -1936,6 +1951,7 @@
  __traceiter_android_rvh_replace_next_task_fair
  __traceiter_android_rvh_schedule
  __traceiter_android_rvh_select_task_rq_rt
+  __traceiter_android_rvh_tick_entry
  __traceiter_android_vh_cma_drain_all_pages_bypass
  __traceiter_android_vh_cpu_idle_enter
  __traceiter_android_vh_cpu_idle_exit
@@ -1954,12 +1970,14 @@
  __traceiter_mmap_lock_acquire_returned
  __traceiter_mmap_lock_released
  __traceiter_mmap_lock_start_locking
+  __traceiter_sched_switch
  __traceiter_xdp_exception
  trace_output_call
  __tracepoint_android_rvh_arm64_serror_panic
  __tracepoint_android_rvh_check_preempt_tick
  __tracepoint_android_rvh_check_preempt_wakeup
  __tracepoint_android_rvh_do_sea
+  __tracepoint_android_rvh_enqueue_task
  __tracepoint_android_rvh_gic_v3_set_affinity
  __tracepoint_android_rvh_iommu_setup_dma_ops
  __tracepoint_android_rvh_panic_unhandled
@@ -1967,6 +1985,7 @@
  __tracepoint_android_rvh_replace_next_task_fair
  __tracepoint_android_rvh_schedule
  __tracepoint_android_rvh_select_task_rq_rt
+  __tracepoint_android_rvh_tick_entry
  __tracepoint_android_vh_cma_drain_all_pages_bypass
  __tracepoint_android_vh_cpu_idle_enter
  __tracepoint_android_vh_cpu_idle_exit
@@ -1987,6 +2006,7 @@
  __tracepoint_mmap_lock_start_locking
  tracepoint_probe_register
  tracepoint_probe_unregister
+  __tracepoint_sched_switch
  __tracepoint_xdp_exception
  trace_print_array_seq
  trace_print_flags_seq
@@ -2087,17 +2107,22 @@
  utf8_to_utf32
  uuid_null
  v4l2_ctrl_add_handler
+  v4l2_ctrl_find
  v4l2_ctrl_handler_free
  v4l2_ctrl_handler_init_class
  v4l2_ctrl_handler_setup
  v4l2_ctrl_new_custom
+  v4l2_ctrl_new_int_menu
  v4l2_ctrl_new_std
+  __v4l2_ctrl_s_ctrl
+  __v4l2_ctrl_s_ctrl_int64
  v4l2_ctrl_subscribe_event
  v4l2_device_register
  v4l2_device_register_subdev
  v4l2_device_unregister
  v4l2_device_unregister_subdev
  v4l2_event_queue_fh
+  v4l2_event_subdev_unsubscribe
  v4l2_event_subscribe
  v4l2_event_unsubscribe
  v4l2_fh_add
@@ -2105,6 +2130,7 @@
  v4l2_fh_exit
  v4l2_fh_init
  v4l2_fh_open
+  __v4l2_find_nearest_size
  v4l2_i2c_subdev_init
  v4l2_m2m_buf_queue
  v4l2_m2m_buf_remove
@@ -2127,6 +2153,7 @@
  v4l2_m2m_release
  v4l2_m2m_try_schedule
  v4l2_src_change_event_subscribe
+  v4l2_subdev_link_validate
  v4l_bound_align_image
  vabits_actual
  vb2_buffer_done
@@ -2139,6 +2166,7 @@
  vb2_ioctl_create_bufs
  vb2_ioctl_dqbuf
  vb2_ioctl_expbuf
+  vb2_ioctl_prepare_buf
  vb2_ioctl_qbuf
  vb2_ioctl_querybuf
  vb2_ioctl_reqbufs
@@ -2183,6 +2211,7 @@
  wait_for_completion_timeout
  __wait_on_buffer
  wait_on_page_bit
+  wait_woken
  __wake_up
  wake_up_process
  wakeup_source_register
--- a/android/abi_gki_aarch64_exynos_wear
+++ b/android/abi_gki_aarch64_exynos_wear
@@ -135,6 +135,7 @@
  __const_udelay
  consume_skb
  contig_page_data
+  copy_from_kernel_nofault
  __cpu_active_mask
  cpu_all_bits
  cpu_bit_bitmap
@@ -739,6 +740,7 @@
  mmc_free_host
  mmc_gpio_get_cd
  mmc_gpio_get_ro
+  mmc_hw_reset
  mmc_of_parse
  mmc_regulator_get_supply
  mmc_regulator_set_ocr
@@ -1391,6 +1393,7 @@
  __traceiter_android_vh_ipi_stop
  __traceiter_android_vh_logbuf
  __traceiter_android_vh_logbuf_pr_cont
+  __traceiter_android_vh_meminfo_proc_show
  __traceiter_android_vh_scheduler_tick
  __traceiter_android_vh_show_mem
  __traceiter_binder_transaction_received
@@ -1454,6 +1457,7 @@
  __tracepoint_android_vh_ipi_stop
  __tracepoint_android_vh_logbuf
  __tracepoint_android_vh_logbuf_pr_cont
+  __tracepoint_android_vh_meminfo_proc_show
  __tracepoint_android_vh_scheduler_tick
  __tracepoint_android_vh_show_mem
  __tracepoint_binder_transaction_received
--- a/android/abi_gki_aarch64_microsoft
+++ b/android/abi_gki_aarch64_microsoft
@@ -0,0 +1,10 @@
+[abi_symbol_list]
+# required by igb.ko
+  dev_trans_start
+  eth_get_headlen
+  flow_rule_match_eth_addrs
+  __hw_addr_sync_dev
+  __hw_addr_unsync_dev
+  ndo_dflt_fdb_add
+  pci_sriov_set_totalvfs
+  ptp_find_pin
--- a/android/abi_gki_aarch64_moto
+++ b/android/abi_gki_aarch64_moto
@@ -0,0 +1,3 @@
+[abi_symbol_list]
+  __traceiter_android_vh_tune_mmap_readaround
+  __tracepoint_android_vh_tune_mmap_readaround
--- a/android/abi_gki_aarch64_oplus
+++ b/android/abi_gki_aarch64_oplus
@@ -236,6 +236,7 @@
  __page_file_index
  __page_mapcount
  page_mapping
+  page_referenced
  page_to_lruvec
  param_ops_uint
  __per_cpu_offset
@@ -286,6 +287,7 @@
  register_sysctl_table
  register_tcf_proto_ops
  remove_proc_subtree
+  root_mem_cgroup
  rtc_read_alarm
  __rtnl_link_unregister
  sched_clock
@@ -364,6 +366,7 @@
  __traceiter_android_rvh_do_serror
  __traceiter_android_rvh_pick_next_entity
  __traceiter_android_rvh_place_entity
+  __traceiter_android_rvh_rtmutex_force_update
  __traceiter_android_rvh_schedule
  __traceiter_android_rvh_set_balance_anon_file_reclaim
  __traceiter_android_rvh_set_user_nice
@@ -384,12 +387,14 @@
  __traceiter_android_vh_binder_select_worklist_ilocked
  __traceiter_android_vh_binder_thread_read
  __traceiter_android_vh_binder_thread_release
+  __traceiter_android_vh_blk_account_io_done
  __traceiter_android_vh_build_sched_domains
  __traceiter_android_vh_cache_show
  __traceiter_android_vh_check_uninterruptible_tasks_dn
  __traceiter_android_vh_cleanup_old_buffers_bypass
  __traceiter_android_vh_cma_drain_all_pages_bypass
  __traceiter_android_vh_compact_finished
+  __traceiter_android_vh_check_page_look_around_ref
  __traceiter_android_vh_alloc_pages_reclaim_bypass
  __traceiter_android_vh_free_unref_page_bypass
  __traceiter_android_vh_kvmalloc_node_use_vmalloc
@@ -419,6 +424,8 @@
  __traceiter_android_vh_irqtime_account_process_tick
  __traceiter_android_vh_killed_process
  __traceiter_android_vh_kmalloc_slab
+  __traceiter_android_vh_look_around
+  __traceiter_android_vh_look_around_migrate_page
  __traceiter_android_vh_madvise_cold_or_pageout_abort
  __traceiter_android_vh_mark_page_accessed
  __traceiter_android_vh_mem_cgroup_alloc
@@ -444,6 +451,7 @@
  __traceiter_android_vh_record_rtmutex_lock_starttime
  __traceiter_android_vh_record_rwsem_lock_starttime
  __traceiter_android_vh_rmqueue
+  __traceiter_android_vh_rtmutex_waiter_prio
  __traceiter_android_vh_rwsem_can_spin_on_owner
  __traceiter_android_vh_rwsem_opt_spin_finish
  __traceiter_android_vh_rwsem_opt_spin_start
@@ -453,9 +461,11 @@
  __traceiter_android_vh_sched_stat_runtime_rt
  __traceiter_android_vh_show_mapcount_pages
  __traceiter_android_vh_sync_txn_recvd
+  __traceiter_android_vh_task_blocks_on_rtmutex
  __traceiter_android_vh_tune_inactive_ratio
  __traceiter_android_vh_tune_scan_type
  __traceiter_android_vh_tune_swappiness
+  __traceiter_android_vh_test_clear_look_around_ref
  __traceiter_android_vh_update_page_mapcount
  __traceiter_block_bio_complete
  __traceiter_block_bio_queue
@@ -480,6 +490,7 @@
  __tracepoint_android_rvh_do_serror
  __tracepoint_android_rvh_pick_next_entity
  __tracepoint_android_rvh_place_entity
+  __tracepoint_android_rvh_rtmutex_force_update
  __tracepoint_android_rvh_schedule
  __tracepoint_android_rvh_set_balance_anon_file_reclaim
  __tracepoint_android_rvh_set_user_nice
@@ -500,12 +511,14 @@
  __tracepoint_android_vh_binder_select_worklist_ilocked
  __tracepoint_android_vh_binder_thread_read
  __tracepoint_android_vh_binder_thread_release
+  __tracepoint_android_vh_blk_account_io_done
  __tracepoint_android_vh_build_sched_domains
  __tracepoint_android_vh_cache_show
  __tracepoint_android_vh_check_uninterruptible_tasks_dn
  __tracepoint_android_vh_cleanup_old_buffers_bypass
  __tracepoint_android_vh_cma_drain_all_pages_bypass
  __tracepoint_android_vh_compact_finished
+  __tracepoint_android_vh_check_page_look_around_ref
  __tracepoint_android_vh_alloc_pages_reclaim_bypass
  __tracepoint_android_vh_free_unref_page_bypass
  __tracepoint_android_vh_kvmalloc_node_use_vmalloc
@@ -535,6 +548,8 @@
  __tracepoint_android_vh_irqtime_account_process_tick
  __tracepoint_android_vh_killed_process
  __tracepoint_android_vh_kmalloc_slab
+  __tracepoint_android_vh_look_around
+  __tracepoint_android_vh_look_around_migrate_page
  __tracepoint_android_vh_madvise_cold_or_pageout_abort
  __tracepoint_android_vh_mark_page_accessed
  __tracepoint_android_vh_mem_cgroup_alloc
@@ -560,6 +575,7 @@
  __tracepoint_android_vh_record_rtmutex_lock_starttime
  __tracepoint_android_vh_record_rwsem_lock_starttime
  __tracepoint_android_vh_rmqueue
+  __tracepoint_android_vh_rtmutex_waiter_prio
  __tracepoint_android_vh_rwsem_can_spin_on_owner
  __tracepoint_android_vh_rwsem_opt_spin_finish
  __tracepoint_android_vh_rwsem_opt_spin_start
@@ -569,9 +585,11 @@
  __tracepoint_android_vh_sched_stat_runtime_rt
  __tracepoint_android_vh_show_mapcount_pages
  __tracepoint_android_vh_sync_txn_recvd
+  __tracepoint_android_vh_task_blocks_on_rtmutex
  __tracepoint_android_vh_tune_inactive_ratio
  __tracepoint_android_vh_tune_scan_type
  __tracepoint_android_vh_tune_swappiness
+  __tracepoint_android_vh_test_clear_look_around_ref
  __tracepoint_android_vh_update_page_mapcount
  __tracepoint_block_bio_complete
  __tracepoint_block_bio_queue
@@ -614,3 +632,5 @@
  __wake_up
  wake_up_process
  wq_worker_comm
+  is_ashmem_file
+  zero_pfn
--- a/android/abi_gki_aarch64_qcom
+++ b/android/abi_gki_aarch64_qcom
@@ -781,6 +781,9 @@
  geni_se_tx_dma_unprep
  genphy_check_and_restart_aneg
  __genphy_config_aneg
+  genphy_c45_an_config_aneg
+  genphy_c45_check_and_restart_aneg
+  genphy_c45_pma_setup_forced
  genphy_c45_read_status
  genphy_read_abilities
  genphy_read_lpa
@@ -1587,6 +1590,7 @@
  phy_modify
  phy_modify_changed
  phy_modify_mmd
+  phy_modify_mmd_changed
  phy_modify_paged
  phy_modify_paged_changed
  phy_power_off
@@ -1597,6 +1601,7 @@
  phy_restore_page
  phy_save_page
  phy_select_page
+  phy_set_max_speed
  phy_set_mode_ext
  phy_sfp_attach
  phy_sfp_detach
@@ -1848,6 +1853,13 @@
  regulator_set_mode
  regulator_set_voltage
  regulator_unregister_notifier
+  relay_close
+  relay_file_operations
+  relay_flush
+  relay_open
+  relay_reset
+  relay_subbufs_consumed
+  relay_switch_subbuf
  release_firmware
  __release_region
  release_sock
--- a/android/abi_gki_aarch64_tuxera
+++ b/android/abi_gki_aarch64_tuxera
@@ -71,6 +71,7 @@ filemap_fdatawrite
 filemap_flush
 __filemap_set_wb_err
 filemap_write_and_wait_range
+file_check_and_advance_wb_err
 file_remove_privs
 file_update_time
 file_write_and_wait_range
--- a/android/abi_gki_aarch64_unisoc
+++ b/android/abi_gki_aarch64_unisoc
@@ -3149,11 +3149,13 @@
  __traceiter_android_vh_anon_gfp_adjust
  __traceiter_android_vh_alloc_flags_cma_adjust
  __traceiter_android_vh_rmqueue_cma_fallback
+  __traceiter_android_vh_try_cma_fallback
  __tracepoint_android_vh_use_cma_first_check
  __tracepoint_android_vh_alloc_highpage_movable_gfp_adjust
  __tracepoint_android_vh_anon_gfp_adjust
  __tracepoint_android_vh_alloc_flags_cma_adjust
  __tracepoint_android_vh_rmqueue_cma_fallback
+  __tracepoint_android_vh_try_cma_fallback

 # required by unisoc_mm_emem.ko
  __traceiter_android_vh_oom_check_panic
@@ -3162,17 +3164,21 @@
  __tracepoint_android_vh_show_mem

 # required by unisoc_mm_reclaim.ko
+  __traceiter_android_vh_clear_page_migrating
  __traceiter_android_vh_do_page_trylock
  __traceiter_android_vh_handle_failed_page_trylock
  __traceiter_android_vh_page_trylock_clear
  __traceiter_android_vh_page_trylock_get_result
  __traceiter_android_vh_page_trylock_set
+  __traceiter_android_vh_set_page_migrating
  __traceiter_android_vh_shrink_slab_bypass
+  __tracepoint_android_vh_clear_page_migrating
  __tracepoint_android_vh_do_page_trylock
  __tracepoint_android_vh_handle_failed_page_trylock
  __tracepoint_android_vh_page_trylock_clear
  __tracepoint_android_vh_page_trylock_get_result
  __tracepoint_android_vh_page_trylock_set
+  __tracepoint_android_vh_set_page_migrating
  __tracepoint_android_vh_shrink_slab_bypass

 # required by unisoc_mm_slab.ko
--- a/android/abi_gki_aarch64_xiaomi
+++ b/android/abi_gki_aarch64_xiaomi
@@ -122,6 +122,12 @@
  ioc_lookup_icq
  percpu_counter_add_batch

+#required by mq-deadline module
+  blk_mq_debugfs_rq_show
+  seq_list_start
+  seq_list_next
+  __blk_mq_debugfs_rq_show
+
 #required by cs35l41 module
  regcache_drop_region
  regmap_async_complete
--- a/arch/arm64/Kconfig
+++ b/arch/arm64/Kconfig
@@ -819,6 +819,23 @@ config ARM64_ERRATUM_2441009

 	  If unsure, say Y.

+config ARM64_ERRATUM_2457168
+	bool "Cortex-A510: 2457168: workaround for AMEVCNTR01 incrementing incorrectly"
+	depends on ARM64_AMU_EXTN
+	default y
+	help
+	  This option adds the workaround for ARM Cortex-A510 erratum 2457168.
+
+	  The AMU counter AMEVCNTR01 (constant counter) should increment at the same rate
+	  as the system counter. On affected Cortex-A510 cores AMEVCNTR01 increments
+	  incorrectly giving a significantly higher output value.
+
+	  Work around this problem by returning 0 when reading the affected counter in
+	  key locations that results in disabling all users of this counter. This effect
+	  is the same to firmware disabling affected counters.
+
+	  If unsure, say Y.
+
 config CAVIUM_ERRATUM_22375
 	bool "Cavium erratum 22375, 24313"
 	default y
--- a/arch/arm64/kernel/cpu_errata.c
+++ b/arch/arm64/kernel/cpu_errata.c
@@ -544,6 +544,15 @@ const struct arm64_cpu_capabilities arm64_errata[] = {
 		.type = ARM64_CPUCAP_WEAK_LOCAL_CPU_FEATURE,
 		CAP_MIDR_RANGE_LIST(trbe_write_out_of_range_cpus),
 	},
+#endif
+#ifdef CONFIG_ARM64_ERRATUM_2457168
+	{
+		.desc = "ARM erratum 2457168",
+		.capability = ARM64_WORKAROUND_2457168,
+		.type = ARM64_CPUCAP_WEAK_LOCAL_CPU_FEATURE,
+		/* Cortex-A510 r0p0-r1p1 */
+		CAP_MIDR_RANGE(MIDR_CORTEX_A510, 0, 0, 1, 1)
+	},
 #endif
 	{
 	}
--- a/arch/arm64/kernel/cpufeature.c
+++ b/arch/arm64/kernel/cpufeature.c
@@ -1701,7 +1701,10 @@ static void cpu_amu_enable(struct arm64_cpu_capabilities const *cap)
 		pr_info("detected CPU%d: Activity Monitors Unit (AMU)\n",
 			smp_processor_id());
 		cpumask_set_cpu(smp_processor_id(), &amu_cpus);
-		update_freq_counters_refs();
+
+		/* 0 reference values signal broken/disabled counters */
+		if (!this_cpu_has_cap(ARM64_WORKAROUND_2457168))
+			update_freq_counters_refs();
 	}
 }

--- a/arch/arm64/kernel/topology.c
+++ b/arch/arm64/kernel/topology.c
@@ -268,12 +268,25 @@ core_initcall(init_amu_fie);

 static void cpu_read_corecnt(void *val)
 {
+	/*
+	 * A value of 0 can be returned if the current CPU does not support AMUs
+	 * or if the counter is disabled for this CPU. A return value of 0 at
+	 * counter read is properly handled as an error case by the users of the
+	 * counter.
+	 */
 	*(u64 *)val = read_corecnt();
 }

 static void cpu_read_constcnt(void *val)
 {
-	*(u64 *)val = read_constcnt();
+	/*
+	 * Return 0 if the current CPU is affected by erratum 2457168. A value
+	 * of 0 is also returned if the current CPU does not support AMUs or if
+	 * the counter is disabled. A return value of 0 at counter read is
+	 * properly handled as an error case by the users of the counter.
+	 */
+	*(u64 *)val = this_cpu_has_cap(ARM64_WORKAROUND_2457168) ?
+		      0UL : read_constcnt();
 }

 static inline
@@ -300,7 +313,22 @@ int counters_read_on_cpu(int cpu, smp_call_func_t func, u64 *val)
 */
 bool cpc_ffh_supported(void)
 {
-	return freq_counters_valid(get_cpu_with_amu_feat());
+	int cpu = get_cpu_with_amu_feat();
+
+	/*
+	 * FFH is considered supported if there is at least one present CPU that
+	 * supports AMUs. Using FFH to read core and reference counters for CPUs
+	 * that do not support AMUs, have counters disabled or that are affected
+	 * by errata, will result in a return value of 0.
+	 *
+	 * This is done to allow any enabled and valid counters to be read
+	 * through FFH, knowing that potentially returning 0 as counter value is
+	 * properly handled by the users of these counters.
+	 */
+	if ((cpu >= nr_cpu_ids) || !cpumask_test_cpu(cpu, cpu_present_mask))
+		return false;
+
+	return true;
 }

 int cpc_read_ffh(int cpu, struct cpc_reg *reg, u64 *val)
--- a/arch/arm64/tools/cpucaps
+++ b/arch/arm64/tools/cpucaps
@@ -27,7 +27,7 @@ HAS_LDAPR
 HAS_LSE_ATOMICS
 HAS_NO_FPSIMD
 # HAS_NO_HW_PREFETCH
-ANDROID_RESERVED_1
+WORKAROUND_2457168
 HAS_PAN
 HAS_RAS_EXTN
 HAS_RNG
--- a/block/blk-core.c
+++ b/block/blk-core.c
@@ -44,6 +44,8 @@

 #define CREATE_TRACE_POINTS
 #include <trace/events/block.h>
+#undef CREATE_TRACE_POINTS
+#include <trace/hooks/block.h>

 #include "blk.h"
 #include "blk-mq.h"
@@ -1266,6 +1268,7 @@ void blk_account_io_done(struct request *req, u64 now)
 	 * normal IO on queueing nor completion.  Accounting the
 	 * containing request is enough.
 	 */
+	trace_android_vh_blk_account_io_done(req);
 	if (req->part && blk_do_io_stat(req) &&
 	    !(req->rq_flags & RQF_FLUSH_SEQ)) {
 		const int sgrp = op_stat_group(req_op(req));
--- a/block/vendor_hooks.c
+++ b/block/vendor_hooks.c
@@ -15,6 +15,7 @@

 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_blk_alloc_rqs);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_blk_rq_ctx_init);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_blk_account_io_done);

 /*
 * For type visibility
--- a/build.config.gki.aarch64
+++ b/build.config.gki.aarch64
@@ -24,6 +24,8 @@ android/abi_gki_aarch64_general
 android/abi_gki_aarch64_honor
 android/abi_gki_aarch64_imx
 android/abi_gki_aarch64_pixel
+android/abi_gki_aarch64_microsoft
+android/abi_gki_aarch64_moto
 android/abi_gki_aarch64_mtktv
 android/abi_gki_aarch64_mtk
 android/abi_gki_aarch64_qcom
--- a/drivers/android/vendor_hooks.c
+++ b/drivers/android/vendor_hooks.c
@@ -140,6 +140,8 @@ EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_mutex_wait_finish);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_mutex_init);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_process_killed);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_killed_process);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_task_blocks_on_rtmutex);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_rtmutex_waiter_prio);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_rtmutex_wait_start);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_rtmutex_wait_finish);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_mutex_opt_spin_start);
@@ -426,6 +428,7 @@ EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_alloc_highpage_movable_gfp_adjust);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_anon_gfp_adjust);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_alloc_flags_cma_adjust);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_rmqueue_cma_fallback);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_try_cma_fallback);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_dma_buf_stats_teardown);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_madvise_cold_or_pageout);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_madvise_cold_or_pageout_abort);
@@ -446,6 +449,12 @@ EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_use_cma_first_check);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_slab_page_alloced);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_kmalloc_order_alloced);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_compact_finished);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_check_page_look_around_ref);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_look_around);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_look_around_migrate_page);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_test_clear_look_around_ref);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_set_page_migrating);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_clear_page_migrating);
 /*
 * For type visibility
 */
--- a/drivers/irqchip/irq-gic-v3.c
+++ b/drivers/irqchip/irq-gic-v3.c
@@ -51,6 +51,8 @@ struct redist_region {
 	bool			single_redist;
 };

+static DEFINE_STATIC_KEY_FALSE(gic_arm64_2941627_erratum);
+
 static struct gic_chip_data gic_data __read_mostly;
 static DEFINE_STATIC_KEY_TRUE(supports_deactivate_key);

@@ -548,10 +550,39 @@ static void gic_irq_nmi_teardown(struct irq_data *d)
 	gic_irq_set_prio(d, GICD_INT_DEF_PRI);
 }

+static bool gic_arm64_erratum_2941627_needed(struct irq_data *d)
+{
+	enum gic_intid_range range;
+
+	if (!static_branch_unlikely(&gic_arm64_2941627_erratum))
+		return false;
+
+	range = get_intid_range(d);
+
+	/*
+	 * The workaround is needed if the IRQ is an SPI and
+	 * the target cpu is different from the one we are
+	 * executing on.
+	 */
+	return (range == SPI_RANGE || range == ESPI_RANGE) &&
+		!cpumask_test_cpu(raw_smp_processor_id(),
+				  irq_data_get_effective_affinity_mask(d));
+}
+
 static void gic_eoi_irq(struct irq_data *d)
 {
 	write_gicreg(gic_irq(d), ICC_EOIR1_EL1);
 	isb();
+
+	if (gic_arm64_erratum_2941627_needed(d)) {
+		/*
+		 * Make sure the GIC stream deactivate packet
+		 * issued by ICC_EOIR1_EL1 has completed before
+		 * deactivating through GICD_IACTIVER.
+		 */
+		dsb(sy);
+		gic_poke_irq(d, GICD_ICACTIVER);
+	}
 }

 static void gic_eoimode1_eoi_irq(struct irq_data *d)
@@ -562,7 +593,11 @@ static void gic_eoimode1_eoi_irq(struct irq_data *d)
 	 */
 	if (gic_irq(d) >= 8192 || irqd_is_forwarded_to_vcpu(d))
 		return;
-	gic_write_dir(gic_irq(d));
+
+	if (!gic_arm64_erratum_2941627_needed(d))
+		gic_write_dir(gic_irq(d));
+	else
+		gic_poke_irq(d, GICD_ICACTIVER);
 }

 static int gic_set_type(struct irq_data *d, unsigned int type)
@@ -1718,6 +1753,12 @@ static bool gic_enable_quirk_hip06_07(void *data)
 	return false;
 }

+static bool gic_enable_quirk_arm64_2941627(void *data)
+{
+	static_branch_enable(&gic_arm64_2941627_erratum);
+	return true;
+}
+
 static const struct gic_quirk gic_quirks[] = {
 	{
 		.desc	= "GICv3: Qualcomm MSM8996 broken firmware",
@@ -1754,6 +1795,25 @@ static const struct gic_quirk gic_quirks[] = {
 		.mask	= 0xe8f00fff,
 		.init	= gic_enable_quirk_cavium_38539,
 	},
+	{
+		/*
+		 * GIC-700: 2941627 workaround - IP variant [0,1]
+		 *
+		 */
+		.desc	= "GICv3: ARM64 erratum 2941627",
+		.iidr	= 0x0400043b,
+		.mask	= 0xff0e0fff,
+		.init	= gic_enable_quirk_arm64_2941627,
+	},
+	{
+		/*
+		 * GIC-700: 2941627 workaround - IP variant [2]
+		 */
+		.desc	= "GICv3: ARM64 erratum 2941627",
+		.iidr	= 0x0402043b,
+		.mask	= 0xff0f0fff,
+		.init	= gic_enable_quirk_arm64_2941627,
+	},
 	{
 	}
 };
--- a/drivers/md/dm-bow.c
+++ b/drivers/md/dm-bow.c
@@ -611,6 +611,7 @@ static void dm_bow_dtr(struct dm_target *ti)
 		wait_for_completion(dm_get_completion_from_kobject(kobj));
 	}

+	mutex_lock(&bc->ranges_lock);
 	while (rb_first(&bc->ranges)) {
 		struct bow_range *br = container_of(rb_first(&bc->ranges),
 					      struct bow_range, node);
@@ -618,6 +619,7 @@ static void dm_bow_dtr(struct dm_target *ti)
 		rb_erase(&br->node, &bc->ranges);
 		kfree(br);
 	}
+	mutex_unlock(&bc->ranges_lock);

 	mutex_destroy(&bc->ranges_lock);
 	kfree(bc->log_sector);
@@ -1191,6 +1193,7 @@ static void dm_bow_tablestatus(struct dm_target *ti, char *result,
 		return;
 	}

+	mutex_lock(&bc->ranges_lock);
 	for (i = rb_first(&bc->ranges); i; i = rb_next(i)) {
 		struct bow_range *br = container_of(i, struct bow_range, node);

@@ -1198,11 +1201,11 @@ static void dm_bow_tablestatus(struct dm_target *ti, char *result,
 				    readable_type[br->type],
 				    (unsigned long long)br->sector);
 		if (result >= end)
-			return;
+			goto unlock;

 		result += scnprintf(result, end - result, "\n");
 		if (result >= end)
-			return;
+			goto unlock;

 		if (br->type == TRIMMED)
 			++trimmed_range_count;
@@ -1224,19 +1227,22 @@ static void dm_bow_tablestatus(struct dm_target *ti, char *result,
 		if (!rb_next(i)) {
 			scnprintf(result, end - result,
 				  "\nERROR: Last range not of type TOP");
-			return;
+			goto unlock;
 		}

 		if (br->sector > range_top(br)) {
 			scnprintf(result, end - result,
 				  "\nERROR: sectors out of order");
-			return;
+			goto unlock;
 		}
 	}

 	if (trimmed_range_count != trimmed_list_length)
 		scnprintf(result, end - result,
 			  "\nERROR: not all trimmed ranges in trimmed list");
+
+unlock:
+	mutex_unlock(&bc->ranges_lock);
 }

 static void dm_bow_status(struct dm_target *ti, status_type_t type,
--- a/drivers/net/tap.c
+++ b/drivers/net/tap.c
@@ -523,7 +523,7 @@ static int tap_open(struct inode *inode, struct file *file)
 	q->sock.state = SS_CONNECTED;
 	q->sock.file = file;
 	q->sock.ops = &tap_socket_ops;
-	sock_init_data_uid(&q->sock, &q->sk, inode->i_uid);
+	sock_init_data_uid(&q->sock, &q->sk, current_fsuid());
 	q->sk.sk_write_space = tap_sock_write_space;
 	q->sk.sk_destruct = tap_sock_destruct;
 	q->flags = IFF_VNET_HDR | IFF_NO_PI | IFF_TAP;
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -3411,7 +3411,7 @@ static int tun_chr_open(struct inode *inode, struct file * file)
 	tfile->socket.file = file;
 	tfile->socket.ops = &tun_socket_ops;

-	sock_init_data_uid(&tfile->socket, &tfile->sk, inode->i_uid);
+	sock_init_data_uid(&tfile->socket, &tfile->sk, current_fsuid());

 	tfile->sk.sk_write_space = tun_sock_write_space;
 	tfile->sk.sk_sndbuf = INT_MAX;
--- a/drivers/tty/n_gsm.c
+++ b/drivers/tty/n_gsm.c
@@ -2411,8 +2411,10 @@ static void gsm_cleanup_mux(struct gsm_mux *gsm, bool disc)
 		gsm->has_devices = false;
 	}
 	for (i = NUM_DLCI - 1; i >= 0; i--)
-		if (gsm->dlci[i])
+		if (gsm->dlci[i]) {
 			gsm_dlci_release(gsm->dlci[i]);
+			gsm->dlci[i] = NULL;
+		}
 	mutex_unlock(&gsm->mutex);
 	/* Now wipe the queues */
 	tty_ldisc_flush(gsm->tty);
--- a/drivers/usb/common/usb-conn-gpio.c
+++ b/drivers/usb/common/usb-conn-gpio.c
@@ -44,6 +44,16 @@ struct usb_conn_info {
 	struct power_supply *charger;
 };

+/**
+ * struct usb_conn_info_vendor - contains parameters without modifying the format of usb_conn_info
+ * @info: contains usb_conn_info structure reference
+ * initial_detection: bool to check if it's initial detection after probe
+ */
+struct usb_conn_info_vendor {
+	struct usb_conn_info info;
+	bool initial_detection;
+};
+
 /*
 * "DEVICE" = VBUS and "HOST" = !ID, so we have:
 * Both "DEVICE" and "HOST" can't be set as active at the same time
@@ -64,12 +74,15 @@ struct usb_conn_info {
 static void usb_conn_detect_cable(struct work_struct *work)
 {
 	struct usb_conn_info *info;
+	struct usb_conn_info_vendor *v_info;
 	enum usb_role role;
 	int id, vbus, ret;

 	info = container_of(to_delayed_work(work),
 			    struct usb_conn_info, dw_det);

+	v_info = container_of(info, struct usb_conn_info_vendor, info);
+
 	/* check ID and VBUS */
 	id = info->id_gpiod ?
 		gpiod_get_value_cansleep(info->id_gpiod) : 1;
@@ -86,11 +99,13 @@ static void usb_conn_detect_cable(struct work_struct *work)
 	dev_dbg(info->dev, "role %s -> %s, gpios: id %d, vbus %d\n",
 		usb_role_string(info->last_role), usb_role_string(role), id, vbus);

-	if (info->last_role == role) {
+	if (!v_info->initial_detection && info->last_role == role) {
 		dev_warn(info->dev, "repeated role: %s\n", usb_role_string(role));
 		return;
 	}

+	v_info->initial_detection = false;
+
 	if (info->last_role == USB_ROLE_HOST && info->vbus)
 		regulator_disable(info->vbus);

@@ -175,13 +190,15 @@ static int usb_conn_probe(struct platform_device *pdev)
 {
 	struct device *dev = &pdev->dev;
 	struct usb_conn_info *info;
+	struct usb_conn_info_vendor *v_info;
 	bool need_vbus = true;
 	int ret = 0;

-	info = devm_kzalloc(dev, sizeof(*info), GFP_KERNEL);
-	if (!info)
+	v_info = devm_kzalloc(dev, sizeof(*v_info), GFP_KERNEL);
+	if (!v_info)
 		return -ENOMEM;

+	info = &v_info->info;
 	info->dev = dev;
 	info->id_gpiod = devm_gpiod_get_optional(dev, "id", GPIOD_IN);
 	if (IS_ERR(info->id_gpiod))
@@ -274,6 +291,7 @@ static int usb_conn_probe(struct platform_device *pdev)
 	device_set_wakeup_capable(&pdev->dev, true);

 	/* Perform initial detection */
+	v_info->initial_detection = true;
 	usb_conn_queue_dwork(info, 0);

 	return 0;
--- a/drivers/usb/gadget/function/f_accessory.c
+++ b/drivers/usb/gadget/function/f_accessory.c
@@ -679,8 +679,11 @@ fail:
 	pr_err("acc_bind() could not allocate requests\n");
 	while ((req = req_get(dev, &dev->tx_idle)))
 		acc_request_free(req, dev->ep_in);
-	for (i = 0; i < RX_REQ_MAX; i++)
+	for (i = 0; i < RX_REQ_MAX; i++) {
 		acc_request_free(dev->rx_req[i], dev->ep_out);
+		dev->rx_req[i] = NULL;
+	}
+
 	return -1;
 }

@@ -712,6 +715,12 @@ static ssize_t acc_read(struct file *fp, char __user *buf,
 		goto done;
 	}

+	if (!dev->rx_req[0]) {
+		pr_warn("acc_read: USB request already handled/freed");
+		r = -EINVAL;
+		goto done;
+	}
+
 	/*
 	 * Calculate the data length by considering termination character.
 	 * Then compansite the difference of rounding up to
@@ -1208,8 +1217,10 @@ acc_function_unbind(struct usb_configuration *c, struct usb_function *f)

 	while ((req = req_get(dev, &dev->tx_idle)))
 		acc_request_free(req, dev->ep_in);
-	for (i = 0; i < RX_REQ_MAX; i++)
+	for (i = 0; i < RX_REQ_MAX; i++) {
 		acc_request_free(dev->rx_req[i], dev->ep_out);
+		dev->rx_req[i] = NULL;
+	}

 	acc_hid_unbind(dev);
 }
--- a/fs/drop_caches.c
+++ b/fs/drop_caches.c
@@ -10,6 +10,7 @@
 #include <linux/writeback.h>
 #include <linux/sysctl.h>
 #include <linux/gfp.h>
+#include <linux/swap.h>
 #include "internal.h"

 /* A global variable is a bit ugly, but it keeps the code simple */
@@ -59,6 +60,7 @@ int drop_caches_sysctl_handler(struct ctl_table *table, int write,
 		static int stfu;

 		if (sysctl_drop_caches & 1) {
+			lru_add_drain_all();
 			iterate_supers(drop_pagecache_sb, NULL);
 			count_vm_event(DROP_PAGECACHE);
 		}
--- a/fs/fuse/backing.c
+++ b/fs/fuse/backing.c
@@ -208,6 +208,7 @@ int fuse_create_open_backing(
 		struct file *file, unsigned int flags, umode_t mode)
 {
 	struct fuse_inode *dir_fuse_inode = get_fuse_inode(dir);
+	struct fuse_dentry *fuse_entry = get_fuse_dentry(entry);
 	struct fuse_dentry *dir_fuse_dentry = get_fuse_dentry(entry->d_parent);
 	struct dentry *backing_dentry = NULL;
 	struct inode *inode = NULL;
@@ -239,29 +240,28 @@ int fuse_create_open_backing(
 	if (err)
 		goto out;

-	if (get_fuse_dentry(entry)->backing_path.dentry)
-		path_put(&get_fuse_dentry(entry)->backing_path);
-	get_fuse_dentry(entry)->backing_path = (struct path) {
+	if (fuse_entry->backing_path.dentry)
+		path_put(&fuse_entry->backing_path);
+	fuse_entry->backing_path = (struct path) {
 		.mnt = dir_fuse_dentry->backing_path.mnt,
 		.dentry = backing_dentry,
 	};
-	path_get(&get_fuse_dentry(entry)->backing_path);
+	path_get(&fuse_entry->backing_path);

 	if (d_inode)
 		target_nodeid = get_fuse_inode(d_inode)->nodeid;

 	inode = fuse_iget_backing(dir->i_sb, target_nodeid,
-			get_fuse_dentry(entry)->backing_path.dentry->d_inode);
-	if (IS_ERR(inode)) {
-		err = PTR_ERR(inode);
+			fuse_entry->backing_path.dentry->d_inode);
+	if (!inode) {
+		err = -EIO;
 		goto out;
 	}

 	if (get_fuse_inode(inode)->bpf)
 		bpf_prog_put(get_fuse_inode(inode)->bpf);
-	get_fuse_inode(inode)->bpf = dir_fuse_inode->bpf;
-	if (get_fuse_inode(inode)->bpf)
-		bpf_prog_inc(dir_fuse_inode->bpf);
+	get_fuse_inode(inode)->bpf = fuse_entry->bpf;
+	fuse_entry->bpf = NULL;

 	newent = d_splice_alias(inode, entry);
 	if (IS_ERR(newent)) {
@@ -269,10 +269,12 @@ int fuse_create_open_backing(
 		goto out;
 	}

+	inode = NULL;
 	entry = newent ? newent : entry;
 	err = finish_open(file, entry, fuse_open_file_backing);

 out:
+	iput(inode);
 	dput(backing_dentry);
 	return err;
 }
@@ -965,6 +967,33 @@ void *fuse_file_write_iter_finalize(struct fuse_bpf_args *fa,
 	return ERR_PTR(fwio->ret);
 }

+long fuse_backing_ioctl(struct file *file, unsigned int command, unsigned long arg, int flags)
+{
+	struct fuse_file *ff = file->private_data;
+	long ret;
+
+	if (flags & FUSE_IOCTL_COMPAT)
+		ret = -ENOTTY;
+	else
+		ret = vfs_ioctl(ff->backing_file, command, arg);
+
+	return ret;
+}
+
+int fuse_file_flock_backing(struct file *file, int cmd, struct file_lock *fl)
+{
+	struct fuse_file *ff = file->private_data;
+	struct file *backing_file = ff->backing_file;
+	int error;
+
+	fl->fl_file = backing_file;
+	if (backing_file->f_op->flock)
+		error = backing_file->f_op->flock(backing_file, cmd, fl);
+	else
+		error = locks_lock_file_wait(backing_file, fl);
+	return error;
+}
+
 ssize_t fuse_backing_mmap(struct file *file, struct vm_area_struct *vma)
 {
 	int ret;
@@ -1210,61 +1239,62 @@ int fuse_handle_bpf_prog(struct fuse_entry_bpf *feb, struct inode *parent,
 struct dentry *fuse_lookup_finalize(struct fuse_bpf_args *fa, struct inode *dir,
 			   struct dentry *entry, unsigned int flags)
 {
-	struct fuse_dentry *fd;
-	struct dentry *bd;
-	struct inode *inode, *backing_inode;
-	struct inode *d_inode = entry->d_inode;
+	struct fuse_dentry *fuse_entry;
+	struct dentry *backing_entry;
+	struct inode *inode = NULL, *backing_inode;
+	struct inode *entry_inode = entry->d_inode;
 	struct fuse_entry_out *feo = fa->out_args[0].value;
 	struct fuse_entry_bpf_out *febo = fa->out_args[1].value;
-	struct fuse_entry_bpf *feb = container_of(febo, struct fuse_entry_bpf, out);
+	struct fuse_entry_bpf *feb = container_of(febo, struct fuse_entry_bpf,
+						  out);
 	int error = -1;
 	u64 target_nodeid = 0;
-	struct dentry *ret;
+	struct dentry *ret = NULL;

-	fd = get_fuse_dentry(entry);
-	if (!fd) {
+	fuse_entry = get_fuse_dentry(entry);
+	if (!fuse_entry) {
 		ret = ERR_PTR(-EIO);
 		goto out;
 	}

-	bd = fd->backing_path.dentry;
-	if (!bd) {
+	backing_entry = fuse_entry->backing_path.dentry;
+	if (!backing_entry) {
 		ret = ERR_PTR(-ENOENT);
 		goto out;
 	}

-	backing_inode = bd->d_inode;
-	if (!backing_inode) {
-		ret = 0;
-		goto out;
-	}
+	if (entry_inode)
+		target_nodeid = get_fuse_inode(entry_inode)->nodeid;

-	if (d_inode)
-		target_nodeid = get_fuse_inode(d_inode)->nodeid;
+	backing_inode = backing_entry->d_inode;
+	if (backing_inode)
+		inode = fuse_iget_backing(dir->i_sb, target_nodeid,
+					  backing_inode);

-	inode = fuse_iget_backing(dir->i_sb, target_nodeid, backing_inode);
-
-	if (IS_ERR(inode)) {
-		ret = ERR_PTR(PTR_ERR(inode));
-		goto out;
-	}
-
-	error = fuse_handle_bpf_prog(feb, dir, &get_fuse_inode(inode)->bpf);
+	error = inode ?
+		fuse_handle_bpf_prog(feb, dir, &get_fuse_inode(inode)->bpf) :
+		fuse_handle_bpf_prog(feb, dir, &fuse_entry->bpf);
 	if (error) {
 		ret = ERR_PTR(error);
 		goto out;
 	}

-	error = fuse_handle_backing(feb, &get_fuse_inode(inode)->backing_inode, &fd->backing_path);
-	if (error) {
-		ret = ERR_PTR(error);
-		goto out;
+	if (inode) {
+		error = fuse_handle_backing(feb,
+					&get_fuse_inode(inode)->backing_inode,
+					&fuse_entry->backing_path);
+		if (error) {
+			ret = ERR_PTR(error);
+			goto out;
+		}
+
+		get_fuse_inode(inode)->nodeid = feo->nodeid;
+		ret = d_splice_alias(inode, entry);
+		if (!IS_ERR(ret))
+			inode = NULL;
 	}
-
-	get_fuse_inode(inode)->nodeid = feo->nodeid;
-
-	ret = d_splice_alias(inode, entry);
 out:
+	iput(inode);
 	if (feb->backing_file)
 		fput(feb->backing_file);
 	return ret;
--- a/fs/fuse/dir.c
+++ b/fs/fuse/dir.c
@@ -358,9 +358,14 @@ static void fuse_dentry_release(struct dentry *dentry)
 {
 	struct fuse_dentry *fd = dentry->d_fsdata;

+#ifdef CONFIG_FUSE_BPF
 	if (fd && fd->backing_path.dentry)
 		path_put(&fd->backing_path);

+	if (fd && fd->bpf)
+		bpf_prog_put(fd->bpf);
+#endif
+
 	kfree_rcu(fd, rcu);
 }
 #endif
@@ -505,7 +510,6 @@ int fuse_lookup_name(struct super_block *sb, u64 nodeid, const struct qstr *name
 	if (name->len > FUSE_NAME_MAX)
 		goto out;

-
 	forget = fuse_alloc_forget();
 	err = -ENOMEM;
 	if (!forget)
@@ -524,32 +528,34 @@ int fuse_lookup_name(struct super_block *sb, u64 nodeid, const struct qstr *name

 		err = -ENOENT;
 		if (!entry)
-			goto out_queue_forget;
+			goto out_put_forget;

 		err = -EINVAL;
 		backing_file = bpf_arg.backing_file;
 		if (!backing_file)
-			goto out_queue_forget;
+			goto out_put_forget;

 		if (IS_ERR(backing_file)) {
 			err = PTR_ERR(backing_file);
-			goto out_queue_forget;
+			goto out_put_forget;
 		}

 		backing_inode = backing_file->f_inode;
 		*inode = fuse_iget_backing(sb, outarg->nodeid, backing_inode);
 		if (!*inode)
-			goto out;
+			goto out_put_forget;

 		err = fuse_handle_backing(&bpf_arg,
 				&get_fuse_inode(*inode)->backing_inode,
 				&get_fuse_dentry(entry)->backing_path);
-		if (err)
-			goto out;
-
-		err = fuse_handle_bpf_prog(&bpf_arg, NULL, &get_fuse_inode(*inode)->bpf);
-		if (err)
-			goto out;
+		if (!err)
+			err = fuse_handle_bpf_prog(&bpf_arg, NULL,
+					   &get_fuse_inode(*inode)->bpf);
+		if (err) {
+			iput(*inode);
+			*inode = NULL;
+			goto out_put_forget;
+		}
 	} else
 #endif
 	{
@@ -569,9 +575,6 @@ int fuse_lookup_name(struct super_block *sb, u64 nodeid, const struct qstr *name
 	}

 	err = -ENOMEM;
-#ifdef CONFIG_FUSE_BPF
-out_queue_forget:
-#endif
 	if (!*inode && outarg->nodeid) {
 		fuse_queue_forget(fm->fc, forget, outarg->nodeid, 1);
 		goto out;
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -2674,12 +2674,18 @@ static int fuse_file_flock(struct file *file, int cmd, struct file_lock *fl)
 {
 	struct inode *inode = file_inode(file);
 	struct fuse_conn *fc = get_fuse_conn(inode);
+	struct fuse_file *ff = file->private_data;
 	int err;

+#ifdef CONFIG_FUSE_BPF
+	/* TODO - this is simply passthrough, not a proper BPF filter */
+	if (ff->backing_file)
+		return fuse_file_flock_backing(file, cmd, fl);
+#endif
+
 	if (fc->no_flock) {
 		err = locks_lock_file_wait(file, fl);
 	} else {
-		struct fuse_file *ff = file->private_data;

 		/* emulate flock with POSIX locks */
 		ff->flock = true;
--- a/fs/fuse/fuse_i.h
+++ b/fs/fuse/fuse_i.h
@@ -76,7 +76,13 @@ struct fuse_dentry {
 		u64 time;
 		struct rcu_head rcu;
 	};
+
+#ifdef CONFIG_FUSE_BPF
 	struct path backing_path;
+
+	/* bpf program *only* set for negative dentries */
+	struct bpf_prog *bpf;
+#endif
 };

 static inline struct fuse_dentry *get_fuse_dentry(const struct dentry *entry)
@@ -1631,6 +1637,9 @@ int fuse_file_write_iter_backing(struct fuse_bpf_args *fa,
 void *fuse_file_write_iter_finalize(struct fuse_bpf_args *fa,
 		struct kiocb *iocb, struct iov_iter *from);

+long fuse_backing_ioctl(struct file *file, unsigned int command, unsigned long arg, int flags);
+
+int fuse_file_flock_backing(struct file *file, int cmd, struct file_lock *fl);
 ssize_t fuse_backing_mmap(struct file *file, struct vm_area_struct *vma);

 int fuse_file_fallocate_initialize(struct fuse_bpf_args *fa,
--- a/fs/fuse/ioctl.c
+++ b/fs/fuse/ioctl.c
@@ -353,6 +353,15 @@ long fuse_ioctl_common(struct file *file, unsigned int cmd,
 	if (fuse_is_bad(inode))
 		return -EIO;

+#ifdef CONFIG_FUSE_BPF
+	{
+		struct fuse_file *ff = file->private_data;
+
+		/* TODO - this is simply passthrough, not a proper BPF filter */
+		if (ff->backing_file)
+			return fuse_backing_ioctl(file, cmd, arg, flags);
+	}
+#endif
 	return fuse_do_ioctl(file, cmd, arg, flags);
 }

--- a/include/trace/hooks/block.h
+++ b/include/trace/hooks/block.h
@@ -19,6 +19,7 @@
 struct blk_mq_tags;
 struct blk_mq_alloc_data;
 struct blk_mq_tag_set;
+struct request;

 DECLARE_HOOK(android_vh_blk_alloc_rqs,
 	TP_PROTO(size_t *rq_size, struct blk_mq_tag_set *set,
@@ -30,6 +31,10 @@ DECLARE_HOOK(android_vh_blk_rq_ctx_init,
 		struct blk_mq_alloc_data *data, u64 alloc_time_ns),
 	TP_ARGS(rq, tags, data, alloc_time_ns));

+DECLARE_HOOK(android_vh_blk_account_io_done,
+        TP_PROTO(struct request *rq),
+        TP_ARGS(rq));
+
 #endif /* _TRACE_HOOK_BLOCK_H */

 /* This part must be outside protection */
--- a/include/trace/hooks/dtask.h
+++ b/include/trace/hooks/dtask.h
@@ -98,6 +98,16 @@ DECLARE_HOOK(android_vh_record_pcpu_rwsem_starttime,
 	TP_PROTO(struct task_struct *tsk, unsigned long settime_jiffies),
 	TP_ARGS(tsk, settime_jiffies));

+struct rt_mutex_waiter;
+struct ww_acquire_ctx;
+DECLARE_HOOK(android_vh_task_blocks_on_rtmutex,
+	TP_PROTO(struct rt_mutex_base *lock, struct rt_mutex_waiter *waiter,
+		struct task_struct *task, struct ww_acquire_ctx *ww_ctx,
+		unsigned int *chwalk),
+	TP_ARGS(lock, waiter, task, ww_ctx, chwalk));
+DECLARE_HOOK(android_vh_rtmutex_waiter_prio,
+	TP_PROTO(struct task_struct *task, int *waiter_prio),
+	TP_ARGS(task, waiter_prio));
 #endif /* _TRACE_HOOK_DTASK_H */
 /* This part must be outside protection */
 #include <trace/define_trace.h>
--- a/include/trace/hooks/mm.h
+++ b/include/trace/hooks/mm.h
@@ -30,6 +30,7 @@ struct oom_control;
 struct slabinfo;
 struct track;
 struct address_space;
+struct page_vma_mapped_walk;

 DECLARE_RESTRICTED_HOOK(android_rvh_set_skip_swapcache_flags,
 			TP_PROTO(gfp_t *flags),
@@ -229,6 +230,25 @@ DECLARE_HOOK(android_vh_alloc_flags_cma_adjust,
 DECLARE_HOOK(android_vh_rmqueue_cma_fallback,
 	TP_PROTO(struct zone *zone, unsigned int order, struct page **page),
 	TP_ARGS(zone, order, page));
+DECLARE_HOOK(android_vh_test_clear_look_around_ref,
+	TP_PROTO(struct page *page),
+	TP_ARGS(page));
+DECLARE_HOOK(android_vh_look_around_migrate_page,
+	TP_PROTO(struct page *old_page, struct page *new_page),
+	TP_ARGS(old_page, new_page));
+DECLARE_HOOK(android_vh_look_around,
+	TP_PROTO(struct page_vma_mapped_walk *pvmw, struct page *page,
+		struct vm_area_struct *vma, int *referenced),
+	TP_ARGS(pvmw, page, vma, referenced));
+DECLARE_HOOK(android_vh_try_cma_fallback,
+	TP_PROTO(struct zone *zone, unsigned int order, bool *try_cma),
+	TP_ARGS(zone, order, try_cma));
+DECLARE_HOOK(android_vh_set_page_migrating,
+	TP_PROTO(struct page *page),
+	TP_ARGS(page));
+DECLARE_HOOK(android_vh_clear_page_migrating,
+	TP_PROTO(struct page *page),
+	TP_ARGS(page));
 #endif /* _TRACE_HOOK_MM_H */

 /* This part must be outside protection */
--- a/include/trace/hooks/sched.h
+++ b/include/trace/hooks/sched.h
@@ -60,6 +60,10 @@ DECLARE_RESTRICTED_HOOK(android_rvh_finish_prio_fork,
 	TP_PROTO(struct task_struct *p),
 	TP_ARGS(p), 1);

+DECLARE_RESTRICTED_HOOK(android_rvh_rtmutex_force_update,
+	TP_PROTO(struct task_struct *p, struct task_struct *pi_task, int *update),
+	TP_ARGS(p, pi_task, update), 1);
+
 DECLARE_RESTRICTED_HOOK(android_rvh_rtmutex_prepare_setprio,
 	TP_PROTO(struct task_struct *p, struct task_struct *pi_task),
 	TP_ARGS(p, pi_task), 1);
--- a/include/trace/hooks/vmscan.h
+++ b/include/trace/hooks/vmscan.h
@@ -51,6 +51,9 @@ DECLARE_HOOK(android_vh_tune_memcg_scan_type,
 DECLARE_HOOK(android_vh_tune_inactive_ratio,
 	TP_PROTO(unsigned long *inactive_ratio, int file),
 	TP_ARGS(inactive_ratio, file))
+DECLARE_HOOK(android_vh_check_page_look_around_ref,
+	TP_PROTO(struct page *page, int *skip),
+	TP_ARGS(page, skip));
 #endif /* _TRACE_HOOK_VMSCAN_H */
 /* This part must be outside protection */
 #include <trace/define_trace.h>
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -1223,6 +1223,11 @@ static int perf_mux_hrtimer_restart(struct perf_cpu_context *cpuctx)
 	return 0;
 }

+static int perf_mux_hrtimer_restart_ipi(void *arg)
+{
+	return perf_mux_hrtimer_restart(arg);
+}
+
 void perf_pmu_disable(struct pmu *pmu)
 {
 	int *count = this_cpu_ptr(pmu->pmu_disable_count);
@@ -11044,8 +11049,7 @@ perf_event_mux_interval_ms_store(struct device *dev,
 		cpuctx = per_cpu_ptr(pmu->pmu_cpu_context, cpu);
 		cpuctx->hrtimer_interval = ns_to_ktime(NSEC_PER_MSEC * timer);

-		cpu_function_call(cpu,
-			(remote_function_f)perf_mux_hrtimer_restart, cpuctx);
+		cpu_function_call(cpu, perf_mux_hrtimer_restart_ipi, cpuctx);
 	}
 	cpus_read_unlock();
 	mutex_unlock(&mux_interval_mutex);
--- a/kernel/locking/mutex.c
+++ b/kernel/locking/mutex.c
@@ -548,8 +548,10 @@ static noinline void __sched __mutex_unlock_slowpath(struct mutex *lock, unsigne
 void __sched mutex_unlock(struct mutex *lock)
 {
 #ifndef CONFIG_DEBUG_LOCK_ALLOC
-	if (__mutex_unlock_fast(lock))
+	if (__mutex_unlock_fast(lock)) {
+		trace_android_vh_record_mutex_lock_starttime(current, 0);
 		return;
+	}
 #endif
 	__mutex_unlock_slowpath(lock, _RET_IP_);
 	trace_android_vh_record_mutex_lock_starttime(current, 0);
--- a/kernel/locking/rtmutex.c
+++ b/kernel/locking/rtmutex.c
@@ -325,6 +325,11 @@ static __always_inline bool unlock_rt_mutex_safe(struct rt_mutex_base *lock,
 static __always_inline int __waiter_prio(struct task_struct *task)
 {
 	int prio = task->prio;
+	int waiter_prio = 0;
+
+	trace_android_vh_rtmutex_waiter_prio(task, &waiter_prio);
+	if (waiter_prio > 0)
+		return waiter_prio;

 	if (!rt_prio(prio))
 		return DEFAULT_PRIO;
@@ -1139,6 +1144,7 @@ static int __sched task_blocks_on_rt_mutex(struct rt_mutex_base *lock,
 	if (owner == task)
 		return -EDEADLK;

+	trace_android_vh_task_blocks_on_rtmutex(lock, waiter, task, ww_ctx, &chwalk);
 	raw_spin_lock(&task->pi_lock);
 	waiter->task = task;
 	waiter->lock = lock;
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -6970,15 +6970,17 @@ void rt_mutex_setprio(struct task_struct *p, struct task_struct *pi_task)
 	const struct sched_class *prev_class;
 	struct rq_flags rf;
 	struct rq *rq;
+	int update = 0;

 	trace_android_rvh_rtmutex_prepare_setprio(p, pi_task);
 	/* XXX used to be waiter->prio, not waiter->task->prio */
 	prio = __rt_effective_prio(pi_task, p->normal_prio);

+	trace_android_rvh_rtmutex_force_update(p, pi_task, &update);
 	/*
 	 * If nothing changed; bail early.
 	 */
-	if (p->pi_top_task == pi_task && prio == p->prio && !dl_prio(prio))
+	if (!update && p->pi_top_task == pi_task && prio == p->prio && !dl_prio(prio))
 		return;

 	rq = __task_rq_lock(p, &rf);
@@ -6998,7 +7000,7 @@ void rt_mutex_setprio(struct task_struct *p, struct task_struct *pi_task)
 	/*
 	 * For FIFO/RR we only need to set prio, if that matches we're done.
 	 */
-	if (prio == p->prio && !dl_prio(prio))
+	if (!update && prio == p->prio && !dl_prio(prio))
 		goto out_unlock;

 	/*
--- a/kernel/sched/vendor_hooks.c
+++ b/kernel/sched/vendor_hooks.c
@@ -41,6 +41,7 @@ EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_can_migrate_task);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_find_lowest_rq);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_prepare_prio_fork);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_finish_prio_fork);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_rtmutex_force_update);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_rtmutex_prepare_setprio);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_rto_next_cpu);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_is_cpu_allowed);
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -78,6 +78,7 @@ struct cgroup_subsys memory_cgrp_subsys __read_mostly;
 EXPORT_SYMBOL(memory_cgrp_subsys);

 struct mem_cgroup *root_mem_cgroup __read_mostly;
+EXPORT_SYMBOL_GPL(root_mem_cgroup);

 /* Active memory cgroup to use from an interrupt context */
 DEFINE_PER_CPU(struct mem_cgroup *, int_active_memcg);
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -56,6 +56,11 @@
 #define CREATE_TRACE_POINTS
 #include <trace/events/migrate.h>

+#undef CREATE_TRACE_POINTS
+#ifndef __GENKSYMS__
+#include <trace/hooks/mm.h>
+#endif
+
 #include "internal.h"

 int isolate_movable_page(struct page *page, isolate_mode_t mode)
@@ -276,10 +281,14 @@ void remove_migration_ptes(struct page *old, struct page *new, bool locked)
 		.arg = old,
 	};

+	trace_android_vh_set_page_migrating(new);
+
 	if (locked)
 		rmap_walk_locked(new, &rwc);
 	else
 		rmap_walk(new, &rwc);
+
+	trace_android_vh_clear_page_migrating(new);
 }

 /*
@@ -562,6 +571,7 @@ void migrate_page_states(struct page *newpage, struct page *page)
 		SetPageChecked(newpage);
 	if (PageMappedToDisk(page))
 		SetPageMappedToDisk(newpage);
+	trace_android_vh_look_around_migrate_page(page, newpage);

 	/* Move dirty on pages not done by migrate_page_move_mapping() */
 	if (PageDirty(page))
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -74,6 +74,8 @@
 #include <linux/khugepaged.h>
 #include <linux/buffer_head.h>
 #include <trace/hooks/mm.h>
+#include <trace/hooks/vmscan.h>
+
 #include <asm/sections.h>
 #include <asm/tlbflush.h>
 #include <asm/div64.h>
@@ -2618,6 +2620,7 @@ static void prep_new_page(struct page *page, unsigned int order, gfp_t gfp_flags
 		set_page_pfmemalloc(page);
 	else
 		clear_page_pfmemalloc(page);
+	trace_android_vh_test_clear_look_around_ref(page);
 }

 /*
@@ -3173,8 +3176,13 @@ retry:
 	/*
 	 * let normal GFP_MOVABLE has chance to try MIGRATE_CMA
 	 */
-	if (unlikely(!page) && (migratetype == MIGRATE_MOVABLE))
+	if (unlikely(!page) && (migratetype == MIGRATE_MOVABLE)) {
+		bool try_cma = false;
 		trace_android_vh_rmqueue_cma_fallback(zone, order, &page);
+		trace_android_vh_try_cma_fallback(zone, order, &try_cma);
+		if (try_cma)
+			page = __rmqueue_cma_fallback(zone, order);
+	}

 	if (unlikely(!page) && __rmqueue_fallback(zone, order, migratetype,
 						  alloc_flags))
--- a/mm/rmap.c
+++ b/mm/rmap.c
@@ -812,6 +812,7 @@ static bool page_referenced_one(struct page *page, struct vm_area_struct *vma,
 		}

 		if (pvmw.pte) {
+			trace_android_vh_look_around(&pvmw, page, vma, &referenced);
 			if (lru_gen_enabled() && pte_young(*pvmw.pte) &&
 			    !(vma->vm_flags & (VM_SEQ_READ | VM_RAND_READ))) {
 				lru_gen_look_around(&pvmw);
@@ -929,6 +930,7 @@ int page_referenced(struct page *page,

 	return rwc.contended ? -1 : pra.referenced;
 }
+EXPORT_SYMBOL_GPL(page_referenced);

 static bool page_mkclean_one(struct page *page, struct vm_area_struct *vma,
 			    unsigned long address, void *arg)
@@ -2065,10 +2067,14 @@ void try_to_migrate(struct page *page, enum ttu_flags flags)
 	if (!PageKsm(page) && PageAnon(page))
 		rwc.invalid_vma = invalid_migration_vma;

+	trace_android_vh_set_page_migrating(page);
+
 	if (flags & TTU_RMAP_LOCKED)
 		rmap_walk_locked(page, &rwc);
 	else
 		rmap_walk(page, &rwc);
+
+	trace_android_vh_clear_page_migrating(page);
 }

 /*
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -1260,12 +1260,16 @@ static enum page_references page_check_references(struct page *page,
 	unsigned long vm_flags;
 	bool should_protect = false;
 	bool trylock_fail = false;
+	int ret = 0;

 	trace_android_vh_page_should_be_protected(page, &should_protect);
 	if (unlikely(should_protect))
 		return PAGEREF_ACTIVATE;

 	trace_android_vh_page_trylock_set(page);
+	trace_android_vh_check_page_look_around_ref(page, &ret);
+	if (ret)
+		return ret;
 	referenced_ptes = page_referenced(page, 1, sc->target_mem_cgroup,
 					  &vm_flags);
 	referenced_page = TestClearPageReferenced(page);
@@ -1954,14 +1958,14 @@ static __always_inline void update_lru_sizes(struct lruvec *lruvec,
 */
 static bool skip_cma(struct page *page, struct scan_control *sc)
 {
-       return !current_is_kswapd() &&
-                       gfp_migratetype(sc->gfp_mask) != MIGRATE_MOVABLE &&
-                       get_pageblock_migratetype(page) == MIGRATE_CMA;
+	return !current_is_kswapd() &&
+			gfp_migratetype(sc->gfp_mask) != MIGRATE_MOVABLE &&
+			get_pageblock_migratetype(page) == MIGRATE_CMA;
 }
 #else
 static bool skip_cma(struct page *page, struct scan_control *sc)
 {
-       return false;
+	return false;
 }
 #endif

@@ -4134,7 +4138,7 @@ static void inc_max_seq(struct lruvec *lruvec, bool can_swap, bool full_scan)
 	int prev, next;
 	int type, zone;
 	struct lru_gen_struct *lrugen = &lruvec->lrugen;
-
+restart:
 	spin_lock_irq(&lruvec->lru_lock);

 	VM_WARN_ON_ONCE(!seq_is_valid(lruvec));
@@ -4150,6 +4154,13 @@ static void inc_max_seq(struct lruvec *lruvec, bool can_swap, bool full_scan)
 			cond_resched();
 			spin_lock_irq(&lruvec->lru_lock);
 		}
+		if (inc_min_seq(lruvec, type, can_swap))
+			continue;
+
+		spin_unlock_irq(&lruvec->lru_lock);
+		cond_resched();
+		goto restart;
+
 	}

 	/*
@@ -4405,6 +4416,7 @@ void lru_gen_look_around(struct page_vma_mapped_walk *pvmw)
 	int young = 0;
 	unsigned long bitmap[BITS_TO_LONGS(MIN_LRU_BATCH)] = {};
 	struct page *page = pvmw->page;
+	bool can_swap = !page_is_file_lru(page);
 	struct mem_cgroup *memcg = page_memcg(page);
 	struct pglist_data *pgdat = page_pgdat(page);
 	struct lruvec *lruvec = mem_cgroup_lruvec(memcg, pgdat);
@@ -4449,7 +4461,7 @@ void lru_gen_look_around(struct page_vma_mapped_walk *pvmw)
 		if (!pte_young(pte[i]))
 			continue;

-		page = get_pfn_page(pfn, memcg, pgdat, !walk || walk->can_swap);
+		page = get_pfn_page(pfn, memcg, pgdat, can_swap);
 		if (!page)
 			continue;

@@ -4519,7 +4531,8 @@ void lru_gen_look_around(struct page_vma_mapped_walk *pvmw)
 *                          the eviction
 ******************************************************************************/

-static bool sort_page(struct lruvec *lruvec, struct page *page, int tier_idx)
+static bool sort_page(struct lruvec *lruvec, struct page *page, struct scan_control *sc,
+		       int tier_idx)
 {
 	bool success;
 	int gen = page_lru_gen(page);
@@ -4569,6 +4582,13 @@ static bool sort_page(struct lruvec *lruvec, struct page *page, int tier_idx)
 		return true;
 	}

+	/* ineligible */
+	if (zone > sc->reclaim_idx || skip_cma(page, sc)) {
+		gen = page_inc_gen(lruvec, page, false);
+		list_move_tail(&page->lru, &lrugen->lists[gen][type][zone]);
+		return true;
+	}
+
 	/* waiting for writeback */
 	if (PageLocked(page) || PageWriteback(page) ||
 	    (type == LRU_GEN_FILE && PageDirty(page))) {
@@ -4621,7 +4641,8 @@ static bool isolate_page(struct lruvec *lruvec, struct page *page, struct scan_c
 static int scan_pages(struct lruvec *lruvec, struct scan_control *sc,
 		      int type, int tier, struct list_head *list)
 {
-	int gen, zone;
+	int i;
+	int gen;
 	enum vm_event_item item;
 	int sorted = 0;
 	int scanned = 0;
@@ -4637,9 +4658,10 @@ static int scan_pages(struct lruvec *lruvec, struct scan_control *sc,

 	gen = lru_gen_from_seq(lrugen->min_seq[type]);

-	for (zone = sc->reclaim_idx; zone >= 0; zone--) {
+	for (i = MAX_NR_ZONES; i > 0; i--) {
 		LIST_HEAD(moved);
 		int skipped = 0;
+		int zone = (sc->reclaim_idx + i) % MAX_NR_ZONES;
 		struct list_head *head = &lrugen->lists[gen][type][zone];

 		while (!list_empty(head)) {
@@ -4653,7 +4675,7 @@ static int scan_pages(struct lruvec *lruvec, struct scan_control *sc,

 			scanned += delta;

-			if (sort_page(lruvec, page, tier))
+			if (sort_page(lruvec, page, sc, tier))
 				sorted += delta;
 			else if (isolate_page(lruvec, page, sc)) {
 				list_add(&page->lru, list);
--- a/net/bluetooth/l2cap_sock.c
+++ b/net/bluetooth/l2cap_sock.c
@@ -45,6 +45,7 @@ static const struct proto_ops l2cap_sock_ops;
 static void l2cap_sock_init(struct sock *sk, struct sock *parent);
 static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock,
 				     int proto, gfp_t prio, int kern);
+static void l2cap_sock_cleanup_listen(struct sock *parent);

 bool l2cap_is_socket(struct socket *sock)
 {
@@ -1414,6 +1415,7 @@ static int l2cap_sock_release(struct socket *sock)
 	if (!sk)
 		return 0;

+	l2cap_sock_cleanup_listen(sk);
 	bt_sock_unlink(&l2cap_sk_list, sk);

 	err = l2cap_sock_shutdown(sock, SHUT_RDWR);
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -3529,8 +3529,6 @@ static int nf_tables_newrule(struct sk_buff *skb, const struct nfnl_info *info,
 			NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_CHAIN]);
 			return PTR_ERR(chain);
 		}
-		if (nft_chain_is_bound(chain))
-			return -EOPNOTSUPP;

 	} else if (nla[NFTA_RULE_CHAIN_ID]) {
 		chain = nft_chain_lookup_byid(net, table, nla[NFTA_RULE_CHAIN_ID],
@@ -3543,6 +3541,9 @@ static int nf_tables_newrule(struct sk_buff *skb, const struct nfnl_info *info,
 		return -EINVAL;
 	}

+	if (nft_chain_is_bound(chain))
+		return -EOPNOTSUPP;
+
 	if (nla[NFTA_RULE_HANDLE]) {
 		handle = be64_to_cpu(nla_get_be64(nla[NFTA_RULE_HANDLE]));
 		rule = __nft_rule_lookup(chain, handle);
@@ -3795,6 +3796,8 @@ static int nf_tables_delrule(struct sk_buff *skb, const struct nfnl_info *info,
 		list_for_each_entry(chain, &table->chains, list) {
 			if (!nft_is_active_next(net, chain))
 				continue;
+			if (nft_chain_is_bound(chain))
+				continue;

 			ctx.chain = chain;
 			err = nft_delrule_by_chain(&ctx);
--- a/net/netfilter/nft_set_pipapo.c
+++ b/net/netfilter/nft_set_pipapo.c
@@ -1930,7 +1930,11 @@ static void nft_pipapo_remove(const struct net *net, const struct nft_set *set,
 		int i, start, rules_fx;

 		match_start = data;
-		match_end = (const u8 *)nft_set_ext_key_end(&e->ext)->data;
+
+		if (nft_set_ext_exists(&e->ext, NFT_SET_EXT_KEY_END))
+			match_end = (const u8 *)nft_set_ext_key_end(&e->ext)->data;
+		else
+			match_end = data;

 		start = first_rule;
 		rules_fx = rules_f0;
--- a/net/sched/cls_fw.c
+++ b/net/sched/cls_fw.c
@@ -265,7 +265,6 @@ static int fw_change(struct net *net, struct sk_buff *in_skb,
 			return -ENOBUFS;

 		fnew->id = f->id;
-		fnew->res = f->res;
 		fnew->ifindex = f->ifindex;
 		fnew->tp = f->tp;

--- a/net/sched/cls_route.c
+++ b/net/sched/cls_route.c
@@ -511,7 +511,6 @@ static int route4_change(struct net *net, struct sk_buff *in_skb,
 	if (fold) {
 		f->id = fold->id;
 		f->iif = fold->iif;
-		f->res = fold->res;
 		f->handle = fold->handle;

 		f->tp = fold->tp;
--- a/net/sched/cls_u32.c
+++ b/net/sched/cls_u32.c
@@ -812,7 +812,6 @@ static struct tc_u_knode *u32_init_knode(struct net *net, struct tcf_proto *tp,

 	new->ifindex = n->ifindex;
 	new->fshift = n->fshift;
-	new->res = n->res;
 	new->flags = n->flags;
 	RCU_INIT_POINTER(new->ht_down, ht);

--- a/tools/testing/selftests/filesystems/fuse/fuse_test.c
+++ b/tools/testing/selftests/filesystems/fuse/fuse_test.c
@@ -12,6 +12,7 @@
 #include <string.h>
 #include <unistd.h>

+#include <sys/file.h>
 #include <sys/inotify.h>
 #include <sys/mman.h>
 #include <sys/mount.h>
@@ -1336,6 +1337,49 @@ out:
 	return result;
 }

+static int flock_test(const char *mount_dir)
+{
+	const char *file = "file";
+	int result = TEST_FAILURE;
+	int src_fd = -1;
+	int fuse_dev = -1;
+	int fd = -1, fd2 = -1;
+	int backing_fd = -1;
+
+	TEST(src_fd = open(ft_src, O_DIRECTORY | O_RDONLY | O_CLOEXEC),
+	     src_fd != -1);
+	TESTEQUAL(mount_fuse(mount_dir, -1, src_fd, &fuse_dev), 0);
+	TEST(fd = s_open(s_path(s(mount_dir), s(file)),
+			 O_CREAT | O_RDWR | O_CLOEXEC, 0777),
+	     fd != -1);
+	TEST(fd2 = s_open(s_path(s(mount_dir), s(file)),
+				 O_RDWR | O_CLOEXEC, 0777),
+		     fd2 != -1);
+	TESTSYSCALL(flock(fd, LOCK_EX | LOCK_NB));
+	TESTCONDERR((flock(fd2, LOCK_EX | LOCK_NB)) == -1);
+	TESTCOND(errno == EAGAIN);
+	TESTSYSCALL(flock(fd, LOCK_UN));
+	TESTSYSCALL(flock(fd2, LOCK_EX | LOCK_NB));
+	TEST(backing_fd = s_open(s_path(s(ft_src), s(file)),
+				 O_RDONLY | O_CLOEXEC),
+				 backing_fd != -1);
+	TESTCONDERR((flock(backing_fd, LOCK_EX | LOCK_NB)) == -1);
+	TESTCOND(errno == EAGAIN);
+	close(fd2);
+	fd2 = 0;
+	TESTSYSCALL(flock(backing_fd, LOCK_EX | LOCK_NB));
+
+	result = TEST_SUCCESS;
+out:
+	close(fd);
+	close(fd2);
+	close(backing_fd);
+	umount(mount_dir);
+	close(fuse_dev);
+	close(src_fd);
+	return result;
+}
+
 static int readdir_perms_test(const char *mount_dir)
 {
 	int result = TEST_FAILURE;
@@ -1965,6 +2009,44 @@ static int bpf_test_lookup_postfilter(const char *mount_dir)
 	return result;
 }

+/**
+ * Test that a file made via create_and_open correctly gets the bpf assigned
+ * from the negative lookup
+ * bpf blocks file open, but also removes itself from children
+ * This test will fail if the 'remove' is unsuccessful
+ */
+static int bpf_test_create_and_remove_bpf(const char *mount_dir)
+{
+	const char *file = "file";
+
+	int result = TEST_FAILURE;
+	int src_fd = -1;
+	int bpf_fd = -1;
+	int fuse_dev = -1;
+	int fd = -1;
+	int fd2 = -1;
+
+	TEST(src_fd = open(ft_src, O_DIRECTORY | O_RDONLY | O_CLOEXEC),
+	     src_fd != -1);
+	TESTEQUAL(install_elf_bpf("test_bpf.bpf", "test_create_remove", &bpf_fd,
+				  NULL, NULL), 0);
+	TESTEQUAL(mount_fuse_no_init(mount_dir, bpf_fd, src_fd, &fuse_dev), 0);
+	TEST(fd = s_creat(s_path(s(mount_dir), s(file)), 0777),
+	     fd != -1);
+	TEST(fd2 = s_open(s_path(s(mount_dir), s(file)), O_RDONLY),
+	     fd2 != -1);
+
+	result = TEST_SUCCESS;
+out:
+	close(fd2);
+	close(fd);
+	close(fuse_dev);
+	close(bpf_fd);
+	close(src_fd);
+	umount(mount_dir);
+	return result;
+}
+
 static void parse_range(const char *ranges, bool *run_test, size_t tests)
 {
 	size_t i;
@@ -2091,6 +2173,8 @@ int main(int argc, char *argv[])
 		MAKE_TEST(bpf_test_no_readdirplus_without_nodeid),
 		MAKE_TEST(bpf_test_revalidate_handle_backing_fd),
 		MAKE_TEST(bpf_test_lookup_postfilter),
+		MAKE_TEST(flock_test),
+		MAKE_TEST(bpf_test_create_and_remove_bpf),
 	};
 #undef MAKE_TEST

--- a/tools/testing/selftests/filesystems/fuse/test_bpf.c
+++ b/tools/testing/selftests/filesystems/fuse/test_bpf.c
@@ -505,3 +505,29 @@ int lookuppostfilter_test(struct fuse_bpf_args *fa)
 		return FUSE_BPF_BACKING;
 	}
 }
+
+SEC("test_create_remove")
+int createremovebpf_test(struct fuse_bpf_args *fa)
+{
+	switch (fa->opcode) {
+	case FUSE_LOOKUP | FUSE_PREFILTER: {
+		return FUSE_BPF_BACKING | FUSE_BPF_POST_FILTER;
+	}
+
+	case FUSE_LOOKUP | FUSE_POSTFILTER: {
+		struct fuse_entry_bpf_out *febo = fa->out_args[1].value;
+
+		febo->bpf_action = FUSE_ACTION_REMOVE;
+		return 0;
+	}
+
+	case FUSE_OPEN | FUSE_PREFILTER: {
+		return -EIO;
+	}
+
+	default:
+		return FUSE_BPF_BACKING;
+	}
+}
+
+