review.tizen.org Git - platform/kernel/linux-rpi.git/log

ARM: 9130/1: mm: Provide die_kernel_fault() helper

Provide die_kernel_fault() helper to do the kernel fault reporting,
which with msg argument, it could report different message in different
scenes, and the later patch "ARM: mm: Fix PXN process with LPAE feature"
will use it.

Signed-off-by: Kefeng Wang <wangkefeng.wang@huawei.com>
Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
[backport of mainline commit 2e707106fac7f81f780d7c76770a726c46757a84]
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>
Change-Id: I4143a6323aef64f05752616f27361a2f92f33e8e

ARM: 9127/1: mm: Cleanup access_error()

Now the write fault check in do_page_fault() and access_error() twice,
we can cleanup access_error(), and make the fault check and vma flags set
into do_page_fault() directly, then pass the vma flags to __do_page_fault.

No functional change.

Signed-off-by: Kefeng Wang <wangkefeng.wang@huawei.com>
Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
[backport of mainline commit f177b06ed7d56c1d8256769d1a6e1feec90153dc]
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>
Change-Id: I87a54628bad2b5ed14cc2fbaaa5b8f547d90294f

ARM: 9129/1: mm: Kill task_struct argument for __do_page_fault()

The __do_page_fault() won't use task_struct argument, kill it
and also use current->mm directly in do_page_fault().

No functional change.

Signed-off-by: Kefeng Wang <wangkefeng.wang@huawei.com>
Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
[backport of mainline commit 488cab12c37169687015fbdfa8be7b0da42f3146]
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>
Change-Id: I754182937867caad76e7fd5179eb35f697082cec

ARM: 9128/1: mm: Refactor the __do_page_fault()

Clean up the multiple goto statements and drops local variable
vm_fault_t fault, which will make the __do_page_fault() much more
readability.

No functional change.

Signed-off-by: Kefeng Wang <wangkefeng.wang@huawei.com>
Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
[backport of mainline commit caed89dab0ca0e73d7e016c04e1f5957650f4ec3]
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>
Change-Id: Ice8f005ae5aa4cc54a983a377d89657511bfa632

kfence: make compatible with kmemleak

Because memblock allocations are registered with kmemleak, the KFENCE
pool was seen by kmemleak as one large object. Later allocations through
kfence_alloc() that were registered with kmemleak via
slab_post_alloc_hook() would then overlap and trigger a warning.
Therefore, once the pool is initialized, we can remove (free) it from
kmemleak again, since it should be treated as allocator-internal and be
seen as "free memory".

The second problem is that kmemleak is passed the rounded size, and not
the originally requested size, which is also the size of KFENCE objects.
To avoid kmemleak scanning past the end of an object and trigger a
KFENCE out-of-bounds error, fix the size if it is a KFENCE object.

For simplicity, to avoid a call to kfence_ksize() in
slab_post_alloc_hook() (and avoid new IS_ENABLED(CONFIG_DEBUG_KMEMLEAK)
guard), just call kfence_ksize() in mm/kmemleak.c:create_object().

Reported-by: Luis Henriques <lhenriques@suse.de>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Marco Elver <elver@google.com>
Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
Tested-by: Luis Henriques <lhenriques@suse.de>
[port kfence feature to rpi-5.10.95]
Signed-off-by: Sung-hun Kim <sfoon.kim@samsung.com>
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>
Change-Id: Id820bc92f5fa8ca766b63c64101bdc7f13f96a46

kfence, slab: fix cache_alloc_debugcheck_after() for bulk allocations

cache_alloc_debugcheck_after() performs checks on an object, including
adjusting the returned pointer. None of this should apply to KFENCE
objects. While for non-bulk allocations, the checks are skipped when we
allocate via KFENCE, for bulk allocations cache_alloc_debugcheck_after()
is called via cache_alloc_debugcheck_after_bulk().

Fix it by skipping cache_alloc_debugcheck_after() for KFENCE objects.

Signed-off-by: Marco Elver <elver@google.com>
[port kfence feature to rpi-5.10.95]
Signed-off-by: Sung-hun Kim <sfoon.kim@samsung.com>
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>
Change-Id: I07e1131fb1659455be3ac7e65147e627de63520a

kfence: fix reports if constant function prefixes exist

Some architectures prefix all functions with a constant string ('.' on
ppc64). Add ARCH_FUNC_PREFIX, which may optionally be defined in
<asm/kfence.h>, so that get_stack_skipnr() can work properly.

Link: https://lkml.kernel.org/r/f036c53d-7e81-763c-47f4-6024c6c5f058@csgroup.eu
Reported-by: Christophe Leroy <christophe.leroy@csgroup.eu>
Tested-by: Christophe Leroy <christophe.leroy@csgroup.eu>
Signed-off-by: Marco Elver <elver@google.com>
[port kfence feature to rpi-5.10.95]
Signed-off-by: Sung-hun Kim <sfoon.kim@samsung.com>
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>
Change-Id: If0898f06ef741cc25dc0eaed3c4e2095ffe420f5

kfence: fix printk format for ptrdiff_t

Use %td for ptrdiff_t.

Link: https://lkml.kernel.org/r/3abbe4c9-16ad-c168-a90f-087978ccd8f7@csgroup.eu
Reported-by: Christophe Leroy <christophe.leroy@csgroup.eu>
Signed-off-by: Marco Elver <elver@google.com>
Reviewed-by: Alexander Potapenko <glider@google.com>
[port kfence feature to rpi-5.10.95]
Signed-off-by: Sung-hun Kim <sfoon.kim@samsung.com>
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>
Change-Id: I1311862fe3bba39d7837c271a95e3513c8ef2c66

kfence: report sensitive information based on no_hash_pointers

We cannot rely on CONFIG_DEBUG_KERNEL to decide if we're running a
"debug kernel" where we can safely show potentially sensitive
information in the kernel log.

Instead, simply rely on the newly introduced "no_hash_pointers" to print
unhashed kernel pointers, as well as decide if our reports can include
other potentially sensitive information such as registers and corrupted
bytes.

Cc: Timur Tabi <timur@kernel.org>
Signed-off-by: Marco Elver <elver@google.com>
[port kfence feature to rpi-5.10.95]
Signed-off-by: Sung-hun Kim <sfoon.kim@samsung.com>
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>
Change-Id: Ie87a49f890db5a49503afe50e63d908247eb31a3

Merge tag 'printk-for-5.12' of git://git./linux/kernel/git/printk/linux

Pull printk updates from Petr Mladek:

- New "no_hash_pointers" kernel parameter causes that %p shows raw
   pointer values instead of hashed ones. It is intended only for
   debugging purposes. Misuse is prevented by a fat warning message that
   is inspired by trace_printk().

- Prevent a possible deadlock when flushing printk_safe buffers during
   panic().

- Fix performance regression caused by the lockless printk ringbuffer.
   It was visible with huge log buffer and long messages.

- Documentation fix-up.

* tag 'printk-for-5.12' of git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux:
  lib/vsprintf: no_hash_pointers prints all addresses as unhashed
  kselftest: add support for skipped tests
  lib: use KSTM_MODULE_GLOBALS macro in kselftest drivers
  printk: avoid prb_first_valid_seq() where possible
  printk: fix deadlock when kernel panic
  printk: rectify kernel-doc for prb_rec_init_wr()

[port kfence feature to rpi-5.10.95]
Signed-off-by: Sung-hun Kim <sfoon.kim@samsung.com>
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>
Change-Id: I13558832bbd4970d2b35f39db052df735a6ced4f

kfence: show access type in report

Show the access type in KFENCE reports by plumbing through read/write
information from the page fault handler. Update the documentation and
test accordingly.

Suggested-by: Jörn Engel <joern@purestorage.com>
Signed-off-by: Marco Elver <elver@google.com>
Reviewed-by: Jörn Engel <joern@purestorage.com>
[port kfence feature to rpi-5.10.95]
Signed-off-by: Sung-hun Kim <sfoon.kim@samsung.com>
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>
Change-Id: I9bae89e3fb99fe4c87ad17ab76c731ba91c6f830

kfence: fix typo in test

Fix a typo/accidental copy-paste that resulted in the obviously
incorrect 'GFP_KERNEL * 2' expression.

Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Marco Elver <elver@google.com>
Acked-by: Alexander Potapenko <glider@google.com>
[port kfence feature to rpi-5.10.95]
Signed-off-by: Sung-hun Kim <sfoon.kim@samsung.com>
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>
Change-Id: I157e9378f99fe2b1db005ee402dc0cdb6fe54164

kfence: Avoid stalling work queue task without allocations

To toggle the allocation gates, we set up a delayed work that calls
toggle_allocation_gate(). Here we use wait_event() to await an
allocation and subsequently disable the static branch again. However, if
the kernel has stopped doing allocations entirely, we'd wait
indefinitely, and stall the worker task. This may also result in the
appropriate warnings if CONFIG_DETECT_HUNG_TASK=y.

Therefore, introduce a 1 second timeout and use wait_event_timeout(). If
the timeout is reached, the static branch is disabled and a new delayed
work is scheduled to try setting up an allocation at a later time.

Note that, this scenario is very unlikely during normal workloads once
the kernel has booted and user space tasks are running. It can, however,
happen during early boot after KFENCE has been enabled, when e.g.
running tests that do not result in any allocations.

Link: https://lkml.kernel.org/r/CADYN=9J0DQhizAGB0-jz4HOBBh+05kMBXb4c0cXMS7Qi5NAJiw@mail.gmail.com
Reported-by: Anders Roxell <anders.roxell@linaro.org>
Signed-off-by: Marco Elver <elver@google.com>
[port kfence feature to rpi-5.10.95]
Signed-off-by: Sung-hun Kim <sfoon.kim@samsung.com>
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>
Change-Id: Ia4e37404fce3497d6c9d32cae23ffa5d106055da

kfence: Fix parameter description for kfence_object_start()

Describe parameter @addr correctly by delimiting with ':'.

Reported-by: Stephen Rothwell <sfr@canb.auug.org.au>
Signed-off-by: Marco Elver <elver@google.com>
Reviewed-by: Alexander Potapenko <glider@google.com>
[port kfence feature to rpi-5.10.95]
Signed-off-by: Sung-hun Kim <sfoon.kim@samsung.com>
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>
Change-Id: I8b0d1b892c343d42683899054adeb911a0676449

kfence: Use pt_regs to generate stack trace on faults

Instead of removing the fault handling portion of the stack trace based
on the fault handler's name, just use struct pt_regs directly.

Change kfence_handle_page_fault() to take a struct pt_regs, and plumb it
through to kfence_report_error() for out-of-bounds, use-after-free, or
invalid access errors, where pt_regs is used to generate the stack
trace.

If the kernel is a DEBUG_KERNEL, also show registers for more
information.

Suggested-by: Mark Rutland <mark.rutland@arm.com>
Signed-off-by: Marco Elver <elver@google.com>
Acked-by: Mark Rutland <mark.rutland@arm.com>
[port kfence feature to rpi-5.10.95]
Signed-off-by: Sung-hun Kim <sfoon.kim@samsung.com>
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>
Change-Id: I58550db6cbed87fd6315df821b2c249f8ab3a330

MAINTAINERS: add entry for KFENCE

Add entry for KFENCE maintainers.

Reviewed-by: Dmitry Vyukov <dvyukov@google.com>
Reviewed-by: SeongJae Park <sjpark@amazon.de>
Co-developed-by: Alexander Potapenko <glider@google.com>
Signed-off-by: Alexander Potapenko <glider@google.com>
Signed-off-by: Marco Elver <elver@google.com>
[port kfence feature to rpi-5.10.95]
Signed-off-by: Sung-hun Kim <sfoon.kim@samsung.com>
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>
Change-Id: I4b60248d9eb9b3d5194f4e26379cdd62bd2ab0e2

kfence: add test suite

Add KFENCE test suite, testing various error detection scenarios. Makes
use of KUnit for test organization. Since KFENCE's interface to obtain
error reports is via the console, the test verifies that KFENCE outputs
expected reports to the console.

Reviewed-by: Dmitry Vyukov <dvyukov@google.com>
Co-developed-by: Alexander Potapenko <glider@google.com>
Signed-off-by: Alexander Potapenko <glider@google.com>
Signed-off-by: Marco Elver <elver@google.com>
Reviewed-by: Jann Horn <jannh@google.com>
[port kfence feature to rpi-5.10.95]
Signed-off-by: Sung-hun Kim <sfoon.kim@samsung.com>
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>
Change-Id: I53be34fd941da7928e02f7d3fd18536e62a0bc3e

kfence, Documentation: add KFENCE documentation

Add KFENCE documentation in dev-tools/kfence.rst, and add to index.

Reviewed-by: Dmitry Vyukov <dvyukov@google.com>
Co-developed-by: Alexander Potapenko <glider@google.com>
Signed-off-by: Alexander Potapenko <glider@google.com>
Signed-off-by: Marco Elver <elver@google.com>
Reviewed-by: Jann Horn <jannh@google.com>
[port kfence feature to rpi-5.10.95]
Signed-off-by: Sung-hun Kim <sfoon.kim@samsung.com>
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>
Change-Id: I8747dbbd292a396b812f4255985faa95c11d74e7

kfence, kasan: make KFENCE compatible with KASAN

Make KFENCE compatible with KASAN. Currently this helps test KFENCE
itself, where KASAN can catch potential corruptions to KFENCE state, or
other corruptions that may be a result of freepointer corruptions in the
main allocators.

Reviewed-by: Dmitry Vyukov <dvyukov@google.com>
Reviewed-by: Jann Horn <jannh@google.com>
Co-developed-by: Marco Elver <elver@google.com>
Signed-off-by: Marco Elver <elver@google.com>
Signed-off-by: Alexander Potapenko <glider@google.com>
[port kfence feature to rpi-5.10.95]
Signed-off-by: Sung-hun Kim <sfoon.kim@samsung.com>
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>
Change-Id: Ia2ef98d6a2c24d599b0646ca37a0312a201497b9

mm, kfence: insert KFENCE hooks for SLUB

Inserts KFENCE hooks into the SLUB allocator.

To pass the originally requested size to KFENCE, add an argument
'orig_size' to slab_alloc*(). The additional argument is required to
preserve the requested original size for kmalloc() allocations, which
uses size classes (e.g. an allocation of 272 bytes will return an object
of size 512). Therefore, kmem_cache::size does not represent the
kmalloc-caller's requested size, and we must introduce the argument
'orig_size' to propagate the originally requested size to KFENCE.

Without the originally requested size, we would not be able to detect
out-of-bounds accesses for objects placed at the end of a KFENCE object
page if that object is not equal to the kmalloc-size class it was
bucketed into.

When KFENCE is disabled, there is no additional overhead, since
slab_alloc*() functions are __always_inline.

Reviewed-by: Dmitry Vyukov <dvyukov@google.com>
Reviewed-by: Jann Horn <jannh@google.com>
Co-developed-by: Marco Elver <elver@google.com>
Signed-off-by: Marco Elver <elver@google.com>
Signed-off-by: Alexander Potapenko <glider@google.com>
[port kfence feature to rpi-5.10.95]
Signed-off-by: Sung-hun Kim <sfoon.kim@samsung.com>
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>
Change-Id: Id2b0d64b10cc68d176c935dea3b7135bf2190d1f

mm, kfence: insert KFENCE hooks for SLAB

Inserts KFENCE hooks into the SLAB allocator.

To pass the originally requested size to KFENCE, add an argument
'orig_size' to slab_alloc*(). The additional argument is required to
preserve the requested original size for kmalloc() allocations, which
uses size classes (e.g. an allocation of 272 bytes will return an object
of size 512). Therefore, kmem_cache::size does not represent the
kmalloc-caller's requested size, and we must introduce the argument
'orig_size' to propagate the originally requested size to KFENCE.

Without the originally requested size, we would not be able to detect
out-of-bounds accesses for objects placed at the end of a KFENCE object
page if that object is not equal to the kmalloc-size class it was
bucketed into.

When KFENCE is disabled, there is no additional overhead, since
slab_alloc*() functions are __always_inline.

Reviewed-by: Dmitry Vyukov <dvyukov@google.com>
Co-developed-by: Marco Elver <elver@google.com>
Signed-off-by: Marco Elver <elver@google.com>
Signed-off-by: Alexander Potapenko <glider@google.com>
[port kfence feature to rpi-5.10.95]
Signed-off-by: Sung-hun Kim <sfoon.kim@samsung.com>
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>
Change-Id: I3a5660422a01623a21468f3ff62d506725fa11ed

arm64, kfence: enable KFENCE for ARM64

Add architecture specific implementation details for KFENCE and enable
KFENCE for the arm64 architecture. In particular, this implements the
required interface in <asm/kfence.h>.

KFENCE requires that attributes for pages from its memory pool can
individually be set. Therefore, force the entire linear map to be mapped
at page granularity. Doing so may result in extra memory allocated for
page tables in case rodata=full is not set; however, currently
CONFIG_RODATA_FULL_DEFAULT_ENABLED=y is the default, and the common case
is therefore not affected by this change.

Reviewed-by: Dmitry Vyukov <dvyukov@google.com>
Co-developed-by: Alexander Potapenko <glider@google.com>
Signed-off-by: Alexander Potapenko <glider@google.com>
Signed-off-by: Marco Elver <elver@google.com>
Reviewed-by: Jann Horn <jannh@google.com>
Reviewed-by: Mark Rutland <mark.rutland@arm.com>
[port kfence feature to rpi-5.10.95]
Signed-off-by: Sung-hun Kim <sfoon.kim@samsung.com>
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>
Change-Id: I1cb00f8faea0324b850f4c5879a51b1721bc155f

x86, kfence: enable KFENCE for x86

Add architecture specific implementation details for KFENCE and enable
KFENCE for the x86 architecture. In particular, this implements the
required interface in <asm/kfence.h> for setting up the pool and
providing helper functions for protecting and unprotecting pages.

For x86, we need to ensure that the pool uses 4K pages, which is done
using the set_memory_4k() helper function.

Reviewed-by: Dmitry Vyukov <dvyukov@google.com>
Co-developed-by: Marco Elver <elver@google.com>
Signed-off-by: Marco Elver <elver@google.com>
Signed-off-by: Alexander Potapenko <glider@google.com>
Reviewed-by: Jann Horn <jannh@google.com>
[port kfence feature to rpi-5.10.95]
Signed-off-by: Sung-hun Kim <sfoon.kim@samsung.com>
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>
Change-Id: Idfebe6e03d9bda5de4bd6d0084f65bd0feda8d8a

mm: add Kernel Electric-Fence infrastructure

This adds the Kernel Electric-Fence (KFENCE) infrastructure. KFENCE is a
low-overhead sampling-based memory safety error detector of heap
use-after-free, invalid-free, and out-of-bounds access errors.

KFENCE is designed to be enabled in production kernels, and has near
zero performance overhead. Compared to KASAN, KFENCE trades performance
for precision. The main motivation behind KFENCE's design, is that with
enough total uptime KFENCE will detect bugs in code paths not typically
exercised by non-production test workloads. One way to quickly achieve a
large enough total uptime is when the tool is deployed across a large
fleet of machines.

KFENCE objects each reside on a dedicated page, at either the left or
right page boundaries. The pages to the left and right of the object
page are "guard pages", whose attributes are changed to a protected
state, and cause page faults on any attempted access to them. Such page
faults are then intercepted by KFENCE, which handles the fault
gracefully by reporting a memory access error. To detect out-of-bounds
writes to memory within the object's page itself, KFENCE also uses
pattern-based redzones. The following figure illustrates the page
layout:

  ---+-----------+-----------+-----------+-----------+-----------+---
     | xxxxxxxxx | O :       | xxxxxxxxx |       : O | xxxxxxxxx |
     | xxxxxxxxx | B :       | xxxxxxxxx |       : B | xxxxxxxxx |
     | x GUARD x | J : RED-  | x GUARD x | RED-  : J | x GUARD x |
     | xxxxxxxxx | E :  ZONE | xxxxxxxxx |  ZONE : E | xxxxxxxxx |
     | xxxxxxxxx | C :       | xxxxxxxxx |       : C | xxxxxxxxx |
     | xxxxxxxxx | T :       | xxxxxxxxx |       : T | xxxxxxxxx |
  ---+-----------+-----------+-----------+-----------+-----------+---

Guarded allocations are set up based on a sample interval (can be set
via kfence.sample_interval). After expiration of the sample interval, a
guarded allocation from the KFENCE object pool is returned to the main
allocator (SLAB or SLUB). At this point, the timer is reset, and the
next allocation is set up after the expiration of the interval.

To enable/disable a KFENCE allocation through the main allocator's
fast-path without overhead, KFENCE relies on static branches via the
static keys infrastructure. The static branch is toggled to redirect the
allocation to KFENCE. To date, we have verified by running synthetic
benchmarks (sysbench I/O, hackbench) that a kernel compiled with KFENCE
is performance-neutral compared to the non-KFENCE baseline.

For more details, see Documentation/dev-tools/kfence.rst (added later in
the series).

Reviewed-by: Dmitry Vyukov <dvyukov@google.com>
Reviewed-by: SeongJae Park <sjpark@amazon.de>
Co-developed-by: Marco Elver <elver@google.com>
Signed-off-by: Marco Elver <elver@google.com>
Signed-off-by: Alexander Potapenko <glider@google.com>
Reviewed-by: Jann Horn <jannh@google.com>
[port kfence feature to rpi-5.10.95]
Signed-off-by: Sung-hun Kim <sfoon.kim@samsung.com>
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>
Change-Id: I03cc6246dd8436b86e0681a1b3015bf0d142db67

arm64/mm: define arch_get_mappable_range()

This overrides arch_get_mappable_range() on arm64 platform which will be
used with recently added generic framework. It drops
inside_linear_region() and subsequent check in arch_add_memory() which are
no longer required. It also adds a VM_BUG_ON() check that would ensure
that mhp_range_allowed() has already been called.

Link: https://lkml.kernel.org/r/1612149902-7867-3-git-send-email-anshuman.khandual@arm.com
Signed-off-by: Anshuman Khandual <anshuman.khandual@arm.com>
Reviewed-by: David Hildenbrand <david@redhat.com>
Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
Cc: Will Deacon <will@kernel.org>
Cc: Ard Biesheuvel <ardb@kernel.org>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Heiko Carstens <hca@linux.ibm.com>
Cc: Jason Wang <jasowang@redhat.com>
Cc: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Cc: "Michael S. Tsirkin" <mst@redhat.com>
Cc: Michal Hocko <mhocko@kernel.org>
Cc: Oscar Salvador <osalvador@suse.de>
Cc: Pankaj Gupta <pankaj.gupta@cloud.ionos.com>
Cc: Pankaj Gupta <pankaj.gupta.linux@gmail.com>
Cc: teawater <teawaterz@linux.alibaba.com>
Cc: Vasily Gorbik <gor@linux.ibm.com>
Cc: Wei Yang <richard.weiyang@linux.alibaba.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
[port kfence feature to rpi-5.10.95]
Signed-off-by: Sung-hun Kim <sfoon.kim@samsung.com>
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>
Change-Id: I6c68c5b0382419a98a3ae03045790e0078e47898

ARM64: tizen_bcm2711: disable configurations for fTHP

Disable configurations for fTHP (CONFIG_TRANSPARENT_HUGEPAGE,
CONFIG_READ_ONLY_THP_FOR_FS, CONFIG_FINEGRAINED_THP) on
Tizen-7.0.

Change-Id: If17a7a582a019ad7b45b982102282aa12d4bd23f
Signed-off-by: Sung-hun Kim <sfoon.kim@samsung.com>

mm: LKSM: fix a bug in the filter length calculation

Since type of a size variable in the calculation of the
filter length is signed integer, it can make a buggy
situation when the size of a vma is bigger than a range
of a signed integer variable. In this case, the size is
treated as a negative number. As a result, it incurs a
kernel bug at BUG_ON(size < 0).

This patch changes types of variables and members in
lksm_region data structure from signed integer to unsigned
long. Additionally, remove an assertion BUG_ON(size < 0)
because the size never be a negative number.

Change-Id: I822a2ba5d372596ee55dcbec90a019fdf1dc2416
Signed-off-by: Sung-hun Kim <sfoon.kim@samsung.com>

ARM/ARM64: tizen_bcm2711: enable CONFIG_RTL8192CU_VENDOR

Enable CONFIG_RTL8192CU_VENDOR as module.

Change-Id: Ic3e8954b432bafda47b50dbc1f30c922035435b1
Signed-off-by: Jaehoon Chung <jh80.chung@samsung.com>

net: rtl8192cu: fix wrong configuration in Makefile

RTL8192CU_VENDOR is to distinguish with mainline and non-mainlne.
RTL8192CU_VENDOR is for non-mainline. So it needs to use
CONFIG_RTL8192CU_VENDOR instead of CONFIG_RTL8182CU.

It's why rtl8192cu dongle doesn't work in RPI4 target.

Change-Id: I93a50f5db3a965fdb4d8ee1e5a70d3956d5f6679
Signed-off-by: Jaehoon Chung <jh80.chung@samsung.com>

ARM64: tizen_bcm2711_defconfig: enable configs reelvant to RT2800USB

To use USB Wifi, enable configs relevant to RT2800USB.

Change-Id: Ib0b0f6f65d0e2a6420e2fd220a29fcccbce68c94
Signed-off-by: Jaehoon Chung <jh80.chung@samsung.com>

ARM/ARM64: tizen_bcm2711_defconfig: Enable RT_GROUP_SCHED config

Enable RT_GROUP_SCHED configuration to use the cgroup scheduling.

Change-Id: Iab166b7ab312a780b77316118194af1999abc4fb
Signed-off-by: Jaehoon Chung <jh80.chung@samsung.com>

USB: serial: cp210x: add cp210x-stlink driver

Support usb st-link device and its application, add fixed
version of cp210x driver.

Change-Id: Ic1d1a54723697cabf55545d708e2e92f8caddee2
Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>

Revert "USB: serial: cp210x: add support smartthings link devices"

This reverts commit e28a9455eb7dc4b50a718b278678d3a1671f2f5c.

The app for st link uses gpio ioctls not in normal cp210x
driver and it will be supported with new driver instead of
changing existing cp210x.

Change-Id: I76d126ae88ddf2f0cfc7b6fffcca930741be2388
Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>

ARM/ARM64: tizen_bcm2711_defconfig: Enable BT_HCIBTUSB config

Enable CONFIG_BT_HCIBTUSB config.
Tizen GHI image is using the USB BT device. To test BT, it needs to enable.

Change-Id: Ic1a233dd10978ee6cd7b9535c4cf240352605bd6
Signed-off-by: Jaehoon Chung <jh80.chung@samsung.com>

USB: serial: cp210x: add support smartthings link devices

Add support smartthings link devices.

Change-Id: I54293b816779754f987d876272b1c1a145d9baf2
Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>

arm64: tizen_bcm2711_defconfig: disaple framebuffer console

Framebuffer (both simplefb and drm-based) are not really needed for Tizen,
so disable them. This is a workaround for the RPi4 firmware bug, which
block HDMI0 vblank handling on full-HD displays.

Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Change-Id: I6ce8446fe257c27ce6f009dbd16e21b0851da41f

arm: tizen_bcm2711_defconfig: disaple framebuffer console

Framebuffer (both simplefb and drm-based) are not really needed for Tizen,
so disable them. This is a workaround for the RPi4 firmware bug, which
block HDMI0 vblank handling on full-HD displays.

Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Change-Id: Ic576a8d25b049d366363a5d1eb7aff0a6c6b126b

Revert "kdbus: Add magic value"

This reverts commit 5d79c163177419f0be2b0c9d6c644df39038f4c0.

The kdbus magic value is moved to linux-tizen-modules-source tree,
so commit in kernel tree is not anymore required.

Change-Id: I2a98f750b525a659fd341f59f584f0955c5dcc82
Ref: https://git.tizen.org/cgit/platform/kernel/linux-tizen-modules-source/commit/?h=tizen&id=adf25c245d67f341520c77fda3adccd1c76a2bff
Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>

script: update build-rpi4 script to support RT kernel build

Update build-rpi4 script to support RT kernel build.

Change-Id: I6f6e8e7579b4ae10defc4110949135f0459871ed
Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>

packaging: change a file name to _localversion-rt

Change a file name from localversion-rt to _localversion-rt.

Change-Id: I3a8663aa8f3baab6006c554aafaa13b090b72471
Signed-off-by: Jaehoon Chung <jh80.chung@samsung.com>

lib/iov_iter: initialize "flags" in new pipe_buffer

commit 9d2231c5d74e13b2a0546fee6737ee4446017903 upstream.

The functions copy_page_to_iter_pipe() and push_pipe() can both
allocate a new pipe_buffer, but the "flags" member initializer is
missing.

Fixes: 241699cd72a8 ("new iov_iter flavour: pipe-backed")
To: Alexander Viro <viro@zeniv.linux.org.uk>
To: linux-fsdevel@vger.kernel.org
To: linux-kernel@vger.kernel.org
Cc: stable@vger.kernel.org
Signed-off-by: Max Kellermann <max.kellermann@ionos.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[sw0312.kim: chery-pick linux-5.10.y stable commit b19ec7afa929 to resolve CVE-2022-0847]
Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>
Change-Id: Ie8e16157cca8dc16f9b1f222889aa8ed15c281b9

spec: Build rt packages

Build a second set of packages with PREEMPT_RT enabled

Change-Id: I1c0ec964f68eda41d6c628b0476a5246045171ad
Signed-off-by: Łukasz Stelmach <l.stelmach@samsung.com>

Add tizen_bcm2711_rt_defconfig for arm and arm64

Add defconfigfiles with PREEMPT_RT enabled

Change-Id: I58b17d42cfa35ba9bd24c8109cd71f33fe3cd7be
Signed-off-by: Łukasz Stelmach <l.stelmach@samsung.com>

printk: suppress printing less important messages to console

Suppress printing to console messages with loglevel above the
console_loglevel via print_sync().

Change-Id: Ia8d53fd2fadb74e323d776f053c91f7832402021
Fixes: 5d6a5a2378db ("patch-5.10.100-rt62.patch")
Signed-off-by: Łukasz Stelmach <l.stelmach@samsung.com>

patch-5.10.100-rt62.patch

Apply PREEMPT_RT patch 5.10.100-rt62.

Change-Id: Ifc945830d28bb3ac251e611043cc625e656eceda
Signed-off-by: Łukasz Stelmach <l.stelmach@samsung.com>

kernel: delete repeated words in comments

[ Upstream commit c034f48e99907d5be147ac8f0f3e630a9307c2be ]

Drop repeated words in kernel/events/.
{if, the, that, with, time}

Drop repeated words in kernel/locking/.
{it, no, the}

Drop repeated words in kernel/sched/.
{in, not}

Change-Id: I15382584b650bb8fe5732946fa27a51b4e8a9d96
Link: https://lkml.kernel.org/r/20210127023412.26292-1-rdunlap@infradead.org
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Acked-by: Will Deacon <will@kernel.org> [kernel/locking/]
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Arnaldo Carvalho de Melo <acme@kernel.org>
Cc: Will Deacon <will@kernel.org>
Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Cc: "Paul E. McKenney" <paulmck@kernel.org>
Cc: Juri Lelli <juri.lelli@redhat.com>
Cc: Vincent Guittot <vincent.guittot@linaro.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

cpuset: Fix the bug that subpart_cpus updated wrongly in update_cpumask()

commit c80d401c52a2d1baf2a5afeb06f0ffe678e56d23 upstream.

subparts_cpus should be limited as a subset of cpus_allowed, but it is
updated wrongly by using cpumask_andnot(). Use cpumask_and() instead to
fix it.

Change-Id: Ic7a654e9f101a27115a767535e5534a9f4ab4010
Fixes: ee8dde0cd2ce ("cpuset: Add new v2 cpuset.sched.partition flag")
Signed-off-by: Tianchen Ding <dtcccc@linux.alibaba.com>
Reviewed-by: Waiman Long <longman@redhat.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

ARM: dts: bcm2711-rpi-4-b: Set dwc2 mode as peripheral

If dwc2 mode is set to otg, forcing dwc2 mode as peripheral is
proceeded in the early boot time, but since tizen configures the
gadget with configfs after system is prepared. It causes enumeration
problem. To prevent it, default mode will be fixed as peripheral.
Actully, since type-c usb port is only used as power-source and
peripheral port, it is more precise setting though.

Change-Id: I78bc6c683c4d095283219b1ab3066fbe7d0c6e53
Signed-off-by: Dongwoo Lee <dwoo08.lee@samsung.com>

WORKAROUND: Revert "staging: bcm2835-codec: Format changed should trigger drain"

This reverts commit b7e6b495eff31298ba4665f71b2414cc9a8f99c2.

When setting last buffer done on format changed event, bcm2835-codec does not
work for decoding because it recognizes there is no queued buffer even it is
not well fit for v4l2 codec spec. Maybe it is because v4l2 codec gst plugin
v4l2 usage is not up to date in tizen. Until properly fixing it, revert it
to support video h/w decoding on rpi4 in tizen.

Change-Id: Id7d77ee57e58d42eab5a080d63eb8eb1518e6f7a
Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>

Revert "cgroup: Disable cgroup "memory" by default"

This reverts commit 2b13c54592135b6fab269517ed687fa9f80bf8e5.

The feature is used for saving memory which is consumed by memcg-related
structure (32bytes per 4K page), but now it is no longer merged on the
latest raspberry pi kernel. So instead of enabling memory cgroup by
adding command to cmdline.txt while preserving this feature, in order to
enable memory cgroup by default, this reverts commit '2b13c5459213
("cgroup: Disable cgroup "memory" by default")'

Change-Id: I1830129125fb44b36bfe64f97fddf329ea795c3c
Signed-off-by: Dongwoo Lee <dwoo08.lee@samsung.com>
Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>

kdbus: Add magic value

[partially picked from commit 216823ac83c0ab89348e2ed6f66179f53626586e]

except of all the kdbus driver, add magic value of it only.

Original authors of the files are those from commit 216823ac83c0ab8934.

Cherry-picked from 4.14 commit 970070c4f68f113284f86cf7b6fbd23d6b35b511.

Change-Id: Id60af5faf794fc4ae7122976621076f1021f6c38
Signed-off-by: Adrian Szyndela <adrian.s@samsung.com>
Signed-off-by: Hyotaek Shim <hyotaek.shim@samsung.com>
Signed-off-by: Łukasz Stelmach <l.stelmach@samsung.com>
Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>

kdbus: export needed symbols for out-of-tree support

We have been asked to move kdbus out-of-tree. It uses a couple
unexported symbols, so we need to (grudgingly) export them.

Change-Id: Ide04c46bbc71f8fffbdefca68959e1048af1c905
Signed-off-by: Mateusz Majewski <m.majewski2@samsung.com>

kdbus: Revert "fs: unexport poll_schedule_timeout"

This reverts commit 8f546ae1fc5ce8396827d4868c7eee1f1cc6947a.

Change-Id: I5429471eeb092c55a50e37c0b642d50d69daebc7
Signed-off-by: Łukasz Stelmach <l.stelmach@samsung.com>

packaging: Added '.gbs.conf' for partial build

Added gbs configuration file for enhanced building.
it makes gbs build faster than before.

https://source.tizen.org/documentation/reference/git-build-system/maintenance-models-supported-gbs

Change-Id: I79d57aa5eb49d0fbfa9a3744ec2acb032a274e5e
Signed-off-by: Jaechul Lee <jcsing.lee@samsung.com>
Signed-off-by: Joonyoung Shim <jy0922.shim@samsung.com>

mm: thp: Revert "mm, thp: preventing hugepage creation for read-write file pages"

Once the issue with modified read-only files has been fixed by the commit
"mm: thp: avoid mapping a 64kB THP when anonymous COW-ed pages exist",
this workaround is no longer needed.

This reverts commit bca41ebfc598858807071491cdb85f61773d8a77.

Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Change-Id: I3df73b53fffe6dc49bbc844852aff68e4157582b

mm: thp: Avoid mapping a 64kB THP when anonymous COW-ed pages exist

For the given read-only file there might exist copy-on-write anonymous
pages (e.g. when application has modified something in its .data
section).

Presence of such pages causes that the retract_page_tables() function in
mm/khugepaged.c skips retracting their PTE entries, even if the original
(unmodified) file pages have been replaced by the khugepaged with 64kB
THP. Those COW-ed pages remain mapped with 4kB entries.

When read-fault happens on the adjacent page, kernel checks if it can be
mapped with 64kB entry. Without a check for non-NULL vma->anon_vma the
4kB entries for the COW-ed pages will be replaced by the 64kB entries for
the unmodiffied pages of the original file.

This issue has not been observed for 2MB THPs, because PMD-fault (related
to 2MB THP size) doesn't happen if there are any pages still mapped with
4kB TLB entries.

This fixes the random crashes when CONFIG_THP_CONSERVATIVE mode is
enabled.

Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Change-Id: Ic1d87b887f589894732e1c1066123aa88f4f582d

mm: thp: Fix condition check for THP creation

The 'hend' is already THP-aligned, so the proper check should be
exclusive. This fixes forcing 64kB THP pages for the last 2MB of each
process memory area.

Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Change-Id: I0b2187f1e045bc61207122f0162fdb145214ddad

ARM: tizen_bcm2711_defconfig: Enable defconfig for touchscreen

Required defconfig for 7inch touchscreen operation.

Change-Id: I428d3569ec09e20a8cc44df2b41c00446710059a
Signed-off-by: Hoegeun Kwon <hoegeun.kwon@samsung.com>

arm64: tizen_bcm2711_defconfig: Enable defconfig for touchscreen

Required defconfig for 7inch touchscreen operation.

Change-Id: I19a35976e0e7782a79275f56c14ebdba82099ec3
Signed-off-by: Hoegeun Kwon <hoegeun.kwon@samsung.com>

rpi4: boot: config: Add ignore_lcd flag for 7inch touchscreen

Add flag for 7inch touchscreen operation.

Change-Id: Ie750ae0e00daf8448515ba0c4c4596168114882a
Signed-off-by: Hoegeun Kwon <hoegeun.kwon@samsung.com>

drm/vc4: Fix to wait for attach call and return as bind success

If the panel is not connected, the attach function is not called and a
bridge node is not created. In Tizen, dsi_bind operates as drm vc4
when dsi_bind is normally terminated. After waiting 5 attach calls,
dsi_bind returns to success.

Change-Id: I89b29752d63f5152415df3327cb47790d1b03979
Signed-off-by: Hoegeun Kwon <hoegeun.kwon@samsung.com>

ARM: dts: bcm2711-rpi-4-b: Add vc4-kms-dsi-7inch overlay

Add vc4-kms-dsi-7inch overlay as built-in DT.

Change-Id: I15ec96afbababd31185c287ecdf6ab52463dcec6
Signed-off-by: Hoegeun Kwon <hoegeun.kwon@samsung.com>

WORKAROUND: drm/vc4: hdmi: Remove warn for pm_runtime_status

Remove check warn for pm_runtime_status_suspended. Actually resume
state, but confirmed as suspend state. Resolved from firmwares
v5.10.47.

Change-Id: I1f1505588440cccc18acdd285a356bdf8da48f96
Signed-off-by: Hoegeun Kwon <hoegeun.kwon@samsung.com>

rpi4: boot: Update the firmwares for kernel v5.10.46

Update the firmwares with the latest version from the vendor git repo.

The commit base is "d06e0ef85c22 kernel: Bump to 5.10.46"

Since firmwares v5.10.47, there is an issue where HDMI-0 UHD does not
work. So we apply firmwaresv5.10.46.

Change-Id: Iffd23e0e866284ea68a42136ce735f5412e59f25
Signed-off-by: Hoegeun Kwon <hoegeun.kwon@samsung.com>

packaging: Change the kernel version of the spec file

Change the kernel version to 5.10.95

Change-Id: Ia92dc3b1750e4cc693608bdc06f8bb32efcc8722
Signed-off-by: Hoegeun Kwon <hoegeun.kwon@samsung.com>

ARM: tizen_bcm2711_defconfig: Enable vc4_hdmi_cec

CEC driver is required for hdmi operation.

Change-Id: I4f6333945affe0230c78d38e456f5daee91883f2
Signed-off-by: Hoegeun Kwon <hoegeun.kwon@samsung.com>

arm64: tizen_bcm2711_defconfig: Enable vc4_hdmi_cec

CEC driver is required for hdmi operation.

Change-Id: I2b63797641163a4da088b492c05c3d957fbaa208
Signed-off-by: Hoegeun Kwon <hoegeun.kwon@samsung.com>

ARM: dts: bcm2711-rpi-4-b: Enable aon_intr driver

The Set Top Box Level 2 Interrupt controller required to use drm.

Change-Id: Ibe417dbb6f1e6372ef73c70dd812d543bf7a9d83
Signed-off-by: Hoegeun Kwon <hoegeun.kwon@samsung.com>

misc/trinity: Fix invalid spdx identifiers for uapi haeder

The user api header requires "WITH Linux-syscall-note" for
SPDX-License-Identifier when installing. Without it, the command
"make headers_install" fails. To fix it, add proper spdx license
identifier for uapi header.

Change-Id: I95272a29b6808d32eea0e5e95c399a43705f1c96
Fixes: commit 12fc392663db ("misc/trinity: Add trinity npu driver")
Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>

misc/trinity: Fix invalid spdk identifiers

This patch fixes invalid spdk identifiers.
'//' does not work in non-source files.

Change-Id: I1e1a404eb1769440c2fbfb29a461a27c088b19ef
Signed-off-by: Dongju Chae <dongju.chae@samsung.com>

misc/trinity: Add trinity npu driver

This patch uploads trinity npu driver source codes
(for now, triv2 only) including the srnpu iommu codes.

Note that the driver may not available in the rpi4 board,
but let's just sync codes as the reference tizen kernel.

Change-Id: I61353768adb948e6189aeb2c7c79082c3ddbc2ba
Signed-off-by: Dongju Chae <dongju.chae@samsung.com>

usb: gadget: f_fs: Prevent panic due to failure of huge size buffer allocation

The f_fs daemons usually use large size buffer for increasing transfer
performance, but it can cause memory allocation failure in case of
that buddy space is fragmented. Since this, instead of just returning
error in this case, give the chance to retry to allocate memory with
a half length in order to prevent daemon crash due to failure of
buffer allocation.

Change-Id: I4df1987a6f07e558772dcc5f6f020cc550fb1b13
Signed-off-by: Dongwoo Lee <dwoo08.lee@samsung.com>

scripts: mkbootimg_rpi4.sh: Stop build on any kind of errors

Currently, even if an error occurs during image creation, the script
does not abort, which may result in incorrect image creation. In order
to avoid confusion due to this, if any kind of error occurs during the
build process, the build will be stopped.

Change-Id: I8094f4b97128a8c754e5a9ff22f1b3395a3756b1
Signed-off-by: Dongwoo Lee <dwoo08.lee@samsung.com>

tizen: rpi4: disable obsolete options in config.txt

Overlays are not supported on Tizen and 'vc4-fkms-v3d' overlay has been
obsoleted long time ago when VC4 DRM gained full support of the RPi4
hardware, so remove it from the default config.txt. Same for
'dtparam=audio=on'.

Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Change-Id: Iaa4ad049951e1538d818caa144928a08560911bd

mm: thp: add missing pte_unmap() calls

pte_offset_map() requires to call pte_unmap() after using the returned
pte pointer. Add missing calls.

Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Change-Id: I1d883c10f627334feec4be4e6d6efce0a3fde38f

mm: thp: fix split_huge_pte() operation on non-THP aligned address

When split_huge_pte() has been called on the address, which is not THP
aligned, the pte ptr should also be adjusted to the beginning of the THP
page.

Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Change-Id: Idf1ddf95b3f5a5a790fd2b0eb85ac4c22e561a48

mm, thp: preventing hugepage creation for read-write file pages

Sometimes, an user process incurs writes on file pages
which has VM_DENYWRITE flag in its vma->vm_flags (of
course, the vma has VM_WRITE flags too). In this case,
the kernel creates a new page by a COW fault, but it is
an unexpected behaviour for 64KB file hugepages.

This patch disallows scanning of read-write file pages
to prevent unexpected buggy behaviours.

Change-Id: I28c1da7f7ad4be55be5607316b29a2978896fcb9
Signed-off-by: Sung-hun Kim <sfoon.kim@samsung.com>

thp, khugepaged: skip retracting page table if a 64KB hugepage mapping is already established

When khugepaged tries to retract page table entries,
an user can try to handle a page fault. To prevent
concurrent modifications for an address space, an
mmap_lock is used.

If khugepaged failed to get lock, it delays page
table retraction to the next interation. Previously,
however, khugepaged assumes that page table entries
have normal mapping, especially for 64KB hugepages.

This patch checks that a mapping is already
established for 64KB hugepage appropriately. If it is
khugepaged just skips a retraction.

Change-Id: I961e21e65e2ae09df43488582d1469e250059909
Signed-off-by: Sung-hun Kim <sfoon.kim@samsung.com>

mm: thp: khugepaged: flush tlb range to prevent concurrent memory accesses

When khugepaged creates a hugepage while a user accesses memory,
khugepaged should prohibit current accesses to scanning area
because it can make a race condition.

Before creating a hugepage, khugepaged holds a lock of mm_struct
then flushes tlbs of scanning range. For 64KB hugepage, however,
it does not flush tlbs before it installs a new hugepage into the
page table. In this case, the user can lose their progress because
the user process still have memory map in its TLB entries.

By flushing TLBs right after acquiring mmap_lock, the process can
stall before reusing their memory contents.

Change-Id: I408662d69fa68e6210be8ad0b585943bfb8894e8
Signed-off-by: Sung-hun Kim <sfoon.kim@samsung.com>

mm, thp: do not set PTE_SPECIAL for huge zero page

In previous version of the kernel, a huge zero page is remapped
to normal pte mappings with PTE_SPECIAL flag when the split of
hugepage is requested. It makes a buggy situation when the
kernel tries to find a page with vm_normal_page.

This patch resolves this problem by adding a condition to if-
statement.

Change-Id: I62946d3c3e92be309ccbe987f24a33503a7e23dc
Signed-off-by: Sung-hun Kim <sfoon.kim@samsung.com>

mm: thp: add acquisition/release of a lock to guarantee consistent locking state

arm64_wp_huge_pte should acquire a lock before return
to keep the lock semantics of the caller.
To guarantee this, add a new lock acquisition and a
new lock release statements in proper positions.

Change-Id: I81fb8afc37f54bce83f353ca6b6894e70ef86934
Signed-off-by: Sung-hun Kim <sfoon.kim@samsung.com>

mm, thp: modify coverage of CONFIG_FINEGRAINED_THP macro

Some codes should be applied only in fTHP-enabled
kernel. This patch rearranges the coverage of
CONFIG_FINEGRAINED_THP macro.

Change-Id: I0541c36369f8bd7a8fe4b8868c51dc0e6879f100
Signed-off-by: Sung-hun Kim <sfoon.kim@samsung.com>

meminfo, thp: modify ifdef coverage to remove unexpected variable printing

If the system uses fTHP, the user can show statistics of
hugepage-mapped CMA pages via /proc/meminfo.
Otherwise, the user does not need to aware of such variables.
This patch removes such exported variables when fTHP-disabled
kernel is used.

Change-Id: Iaff9dd8d81da1a3caa60959b9c5c1f44544f30d4
Signed-off-by: Sung-hun Kim <sfoon.kim@samsung.com>

mm: thp: count 64k shmem pages separately

64k THP for shmem needs separate counters, otherwise ShmemHugePages entry
in /proc/meminfo incorrectly shows both 2M and 64k THPs as 2M ones.

Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Change-Id: I460ea9f4e9c2f84bb066f68bfb6a291183416bb1

mm, thp, migrate: handling migration of 64KB hugepages

When a 64KB hugepage is migrated, it should be properly
handled since it is different from other normal page
mappings. The kernel should handle a set of sequential
16 page mappings at once. If not, the kernel can mishandle
map counts of a compound page (that is, a set of pages).
It can be a source of kernel bugs and the bug is easily
reproduced on low-memory devices.

This patch deals with the migration of 64KB hugepages.

Fixes: 90eb23660fef ('mm: THP: introducing a fine-grained transparent hugepage technique for ARM64 architecture')
Change-Id: I50a5d4e9a263e7dcbded15c982f57c15a3a48f39
Signed-off-by: Sung-hun Kim <sfoon.kim@samsung.com>

mm, thp: hide remap_try_huge_pmd for the THP-disabled kernel

Since remap_try_huge_pmd is dependent on the kernel
configuration CONFIG_TRANSPARENT_HUGEPAGE, it should be
hidden when the kernel configuration is disabled.

Fixes: 90eb23660fef ('mm: THP: introducing a fine-grained transparent hugepage technique for ARM64 architecture')
Change-Id: Iae9efb2edf6cd563c794af68bea7987110a5b2da
Signed-off-by: Sung-hun Kim <sfoon.kim@samsung.com>

Partially Revert "brcmfmac: p2p: Deal with set but unused variables"

This partially reverts commit 2de64ca7c9fadd32b261530592db4a6adbfcb53f.

The commit 61325dc073e2 ("Revert "brcmfmac: move configuration of
probe request IEs"") requires vif set with p2p interface, but commit
2de64ca7c9fa removes setting. Partially revert the commit to support
p2p usage with p2p interface.

Change-Id: Ia90e256c3d10396b1018e3aec8145139accfb39e
Reported-by: Jiung Yu <jiung.yu@samsung.com>
Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>

arm64: defconfig: enable finegrained-THP configuration

Enable finegrained-THP to allow creation of 64KB hugepages.

Change-Id: If23d2489571ac0a5c367db54126b7b6abf42eebc
Signed-off-by: Sung-hun Kim <sfoon.kim@samsung.com>

arm64: defconfig: enable default THP configurations

Enable default THP in Linux.
With this configuration, the Linux kernel can make 2MB hugepages
without user intervention.

Change-Id: Ifdfc472a78edf76be32c359b2b15c0ca28a2bc8b
Signed-off-by: Sung-hun Kim <sfoon.kim@samsung.com>

mm: THP: introducing a fine-grained transparent hugepage technique for ARM64 architecture

Transparent hugepage (THP) is one of promise solutions to deal with
increased memory footprints, but it mostly focused on server-side
environments.

This patch claims that embedded systems also get benefits by using
THP to deal with increased but still small-sized memory footprints
in applications on the embedded system.

An ARM64 architecture featured a fine-grained hugepage which support
64KB sized hugepages while the size of commonly used hugepage is 2MB.
We used these two kinds of hugepages corresponding to required size
of virtual memory.

In this patch, we developed an eager-and-conservative policy. With
this policy, the kernel do not allow to allocate 2MB hugepages on
page faults to decrease enlarged page fault latencies. Instead, the
kernel allocates 64KB hugepages to deal with hugepage allocation.
Since 64KB hugepages require the smaller order pages than 2MB
hugepages, it does not severely affect to user-noticed memory latency
due to the memory management tasks such as memory compaction.

On the other hand, khugepaged makes both 64KB hugepages and 2MB
hugepages for both anonymous pages and file pages corresponding to
virtual memory sizes.

Moreover, our proposed finegrained THP (fTHP) supports hugepage
mappings on pages in CMA. Since pages in CMA already contiguous, fTHP
just allows hugepage mappings for 64KB or 2MB aligned memory areas.

The proposed method achieves upto 32% of throughput improvement
against Linux kernel with default THP that the system runs a read
workload in lmbench [1] when the buffer is fitted in the CPU
last-level-cache. For the large-sized buffer (bigger than 2MB),
the proposed method shows similar throughput to default THP in Linux
kernel.

[1] LMbench - Tools for peformance analysis:
http://lmbench.sourceforge.net

Change-Id: I750528db8f04b37fda39052bea775d18ca5d53fb
Signed-off-by: Sung-hun Kim <sfoon.kim@samsung.com>
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>

mm: use proper type for cma_[alloc|release]

size_t in cma_alloc is confusing since it makes people think it's byte
count, not pages. Change it to unsigned long[1].

The unsigned int in cma_release is also not right so change it. Since we
have unsigned long in cma_release, free_contig_range should also respect
it.

[1] 67a2e213e7e9, mm: cma: fix incorrect type conversion for size during dma allocation

Link: https://lore.kernel.org/linux-mm/20210324043434.GP1719932@casper.infradead.org/
Link: https://lkml.kernel.org/r/20210331164018.710560-1-minchan@kernel.org
Signed-off-by: Minchan Kim <minchan@kernel.org>
Reviewed-by: David Hildenbrand <david@redhat.com>
Cc: Matthew Wilcox <willy@infradead.org>
Cc: David Hildenbrand <david@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Origin: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?h=78fa51503fdbe463c96eef4c3cf69ca54032647a
Signed-off-by: Łukasz Stelmach <l.stelmach@samsung.com>
Change-Id: Ie6de7e88bdae134120d2d88178e5a71cd00bd460

mm: cma: support sysfs

Since CMA is getting used more widely, it's more important to keep
monitoring CMA statistics for system health since it's directly related to
user experience.

This patch introduces sysfs statistics for CMA, in order to provide some
basic monitoring of the CMA allocator.

* the number of CMA page successful allocations
* the number of CMA page allocation failures

These two values allow the user to calcuate the allocation
failure rate for each CMA area.

e.g.)
  /sys/kernel/mm/cma/WIFI/alloc_pages_[success|fail]
  /sys/kernel/mm/cma/SENSOR/alloc_pages_[success|fail]
  /sys/kernel/mm/cma/BLUETOOTH/alloc_pages_[success|fail]

The cma_stat was intentionally allocated by dynamic allocation
to harmonize with kobject lifetime management.
https://lore.kernel.org/linux-mm/YCOAmXqt6dZkCQYs@kroah.com/

Link: https://lkml.kernel.org/r/20210324230759.2213957-1-minchan@kernel.org
Link: https://lore.kernel.org/linux-mm/20210316100433.17665-1-colin.king@canonical.com/
Signed-off-by: Minchan Kim <minchan@kernel.org>
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Tested-by: Dmitry Osipenko <digetx@gmail.com>
Reviewed-by: Dmitry Osipenko <digetx@gmail.com>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Reviewed-by: John Hubbard <jhubbard@nvidia.com>
Tested-by: Anders Roxell <anders.roxell@linaro.org>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: John Dias <joaodias@google.com>
Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
Cc: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au>
Origin: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?h=43ca106fa8ec7d684776fbe561214d3b2b7cb9cb
Signed-off-by: Łukasz Stelmach <l.stelmach@samsung.com>
Change-Id: I80c0f2c8d60d250418002260b0a20e5a796a9823

mm: cma: add the CMA instance name to cma trace events

There were missing places to add cma instance name. To identify each CMA
instance, let's add the name for every cma trace. This patch also changes
the existing cma_trace_alloc to cma_trace_finish since we have
cma_alloc_start[1].

[1] https://lore.kernel.org/linux-mm/20210324160740.15901-1-georgi.djakov@linaro.org

Link: https://lkml.kernel.org/r/20210330220237.748899-1-minchan@kernel.org
Signed-off-by: Minchan Kim <minchan@kernel.org>
Cc: Liam Mark <lmark@codeaurora.org>
Cc: Georgi Djakov <georgi.djakov@linaro.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Origin: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?h=3aab8ae7aace3388da319a233edf48f0f5d26a44
Signed-off-by: Łukasz Stelmach <l.stelmach@samsung.com>
Change-Id: I94fb2a7925f56e467c954f4d07d492cbd1b1c4e4

mm: cma: add trace events for CMA alloc perf testing

Add cma and migrate trace events to enable CMA allocation performance to
be measured via ftrace.

[georgi.djakov@linaro.org: add the CMA instance name to the cma_alloc_start trace event]
Link: https://lkml.kernel.org/r/20210326155414.25006-1-georgi.djakov@linaro.org
Link: https://lkml.kernel.org/r/20210324160740.15901-1-georgi.djakov@linaro.org
Signed-off-by: Liam Mark <lmark@codeaurora.org>
Signed-off-by: Georgi Djakov <georgi.djakov@linaro.org>
Acked-by: Minchan Kim <minchan@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Origin: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?h=7bc1aec5e28765ad18742824b3b972471807a632
Signed-off-by: Łukasz Stelmach <l.stelmach@samsung.com>
Change-Id: I61b2cdb2a7416c69fc577080c08be50255921305

mm: cma: use pr_err_ratelimited for CMA warning

If we did not reserve extra CMA memory, the log buffer can be easily
filled up by CMA failure warning when the devices calling
dmam_alloc_coherent() to alloc DMA memory. Thus we can use
pr_err_ratelimited() instead to reduce the duplicate CMA warning.

Link: https://lkml.kernel.org/r/ce2251ef49e1727a9a40531d1996660b05462bd2.1615279825.git.baolin.wang@linux.alibaba.com
Signed-off-by: Baolin Wang <baolin.wang@linux.alibaba.com>
Reviewed-by: David Hildenbrand <david@redhat.com>
Acked-by: Minchan Kim <minchan@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Origin: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?h=63f83b31f4f36d933e13bd8b9a25d6d9a0cf89dd
Signed-off-by: Łukasz Stelmach <l.stelmach@samsung.com>
Change-Id: I24e03acb8288fc60e22dddfd409d56b50f3ac12f

mm: vmstat: add cma statistics

Since CMA is used more widely, it's worth to have CMA allocation
statistics into vmstat. With it, we could know how agressively system
uses cma allocation and how often it fails.

Link: https://lkml.kernel.org/r/20210302183346.3707237-1-minchan@kernel.org
Signed-off-by: Minchan Kim <minchan@kernel.org>
Reviewed-by: John Hubbard <jhubbard@nvidia.com>
Cc: John Dias <joaodias@google.com>
Cc: Suren Baghdasaryan <surenb@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Origin: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?h=bbb269206f3c914d4f23e023de4ec020abea6d1b
Signed-off-by: Łukasz Stelmach <l.stelmach@samsung.com>
Change-Id: Iadf5fef76fe6dfa41177cfccf022ea39ae1cb19e

mm: cma: print region name on failure

Print the name of the CMA region for convenience. This is useful
information to have when cma_alloc() fails.

[pdaly@codeaurora.org: print the "count" variable]
Link: https://lkml.kernel.org/r/20210209142414.12768-1-georgi.djakov@linaro.org
Link: https://lkml.kernel.org/r/20210208115200.20286-1-georgi.djakov@linaro.org
Signed-off-by: Patrick Daly <pdaly@codeaurora.org>
Signed-off-by: Georgi Djakov <georgi.djakov@linaro.org>
Acked-by: Minchan Kim <minchan@kernel.org>
Reviewed-by: David Hildenbrand <david@redhat.com>
Reviewed-by: Randy Dunlap <rdunlap@infradead.org>
Cc: Minchan Kim <minchan@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Origin: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?h=a052d4d13d88c2073d1339d9dce02cba7b4dc609
Signed-off-by: Łukasz Stelmach <l.stelmach@samsung.com>
Change-Id: Id498bfa25916823d7e3d804db01691916fc8fac4

mm: cma: improve pr_debug log in cma_release()

It is required to print 'count' of pages, along with the pages, passed to
cma_release to debug the cases of mismatched count value passed between
cma_alloc() and cma_release() from a code path.

As an example, consider the below scenario:

1) CMA pool size is 4MB and

2) User doing the erroneous step of allocating 2 pages but freeing 1
page in a loop from this CMA pool. The step 2 causes cma_alloc() to
return NULL at one point of time because of -ENOMEM condition.

And the current pr_debug logs is not giving the info about these types of
allocation patterns because of count value not being printed in
cma_release().

We are printing the count value in the trace logs, just extend the same to
pr_debug logs too.

[akpm@linux-foundation.org: fix printk warning]

Link: https://lkml.kernel.org/r/1606318341-29521-1-git-send-email-charante@codeaurora.org
Signed-off-by: Charan Teja Reddy <charante@codeaurora.org>
Reviewed-by: Souptick Joarder <jrdr.linux@gmail.com>
Reviewed-by: David Hildenbrand <david@redhat.com>
Acked-by: Vlastimil Babka <vbabka@suse.cz>
Cc: Vinayak Menon <vinmenon@codeaurora.org>
Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Origin: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?h=b8ca396f984295ba09f25f6982f9abd0bb7f5a29
Signed-off-by: Łukasz Stelmach <l.stelmach@samsung.com>
Change-Id: Ic44cb49df247f690145a2d9dc8279aa94de4205f