EVONIX Kernel v3.5

EVONIX Kernel v3.5

Build Overview

Attribute	Specification
Device	Xiaomi POCO X7 Pro / Redmi Turbo 4 (rodin)
SoC	MediaTek Dimensity 8400 Ultra (MT6899)
Kernel Base	Linux 6.6.142
Stable Maintenance	Linux 6.6.143 through 6.6.156 (cherry-picked from kernel.org)
Target ROM	HyperOS
Toolchain	Clang 23.0.1 / LLD 23.0.1 (Android Clang r614150)
Optimizations	ThinLTO + AutoFDO (Android 6.6.142 profile)
Hardware Extensions	MTE (Memory Tagging Extension) disabled
Root Integration	KernelSU Next + SuSFS (KSU build variant)

---

Stable Maintenance & Scope

• Kernel Base: EVONIX remains based on Linux 6.6.142. This is a hardened, targeted backport series rather than a blind rebase or full version jump to 6.6.156.
• Selective Upstream Backports: Cherry-picked relevant stable patches from Linux 6.6.143 through v6.6.156 directly from kernel.org (linux-6.6.y stable git tree).
• Scoping: Limited strictly to fixes applicable to rodin, Android GKI, enabled kernel features, and active runtime code paths.
• Omissions: Server-only, non-arm64 architecture, debug-only, and disabled-subsystem changes were intentionally omitted.
• Validation: Source and hardware validated on-device. Zero kernel panics, BUGs, Oops, use-after-free conditions, or lockups detected under stress testing.

---

Build & Compiler Foundation

• Updated compiler toolchain to Clang 23.0.1 / LLD 23.0.1 (Android Clang build r614150).
• Enabled ThinLTO (Link-Time Optimization) for smaller binary footprint and cross-module inlining.
• Enabled AutoFDO (Automatic Feedback-Directed Optimization) using Google's Android Linux 6.6.142 AutoFDO profile.
• Added pinned Clang 23 toolchain configuration for fully reproducible builds.
• Disabled Memory Tagging Extension (MTE) to eliminate runtime overhead and avoid vendor module conflicts on Dimensity 8400.
• Preserved KernelSU Next and SuSFS integration across builds.

---

Upstream Linux Backports (6.6.143 to 6.6.156)

Rather than waiting for upstream changes to propagate through Google's Android Common Kernel (ACK), critical stable fixes from kernel.org releases 6.6.143 through 6.6.156 were selectively audited and merged directly from the kernel.org stable tree:

• Targeted Integration: Excluded enterprise, server-only, and non-arm64 architecture patches. Only improvements directly relevant to mobile workloads, Android GKI, memory efficiency, and storage were included.
• Kernel Version Identity: The kernel identifies as 6.6.142-EVONIX-HOS-V3.5, containing approximately three months of upstream stable fixes applied beneath the base version.

---

Detailed Component Changelog

Scheduler & EAS (Energy-Aware Scheduling)

• Utilization Accounting: Corrected runnable utilization accounting during CPU migration; separated runnable_avg and util_avg arithmetic to resolve estimation skew when runnable boosting is active, maintaining consistency between EAS and schedutil.
• Affinity-Aware Wakeup Stats: Wakeup group statistics now strictly respect the task's allowed CPU mask, preventing disallowed CPUs from skewing destination-group idle statistics.
• Overloaded Classification: Resolved false overloaded-group classifications under EAS/uclamp by tracking per-group CPU overutilization; requires an actually overutilized CPU before an EAS group is marked overloaded, preventing capacity-clamped groups from outranking genuine misfit groups while preserving root-domain tracking.
• Overutilization with UCLAMP: Removed uclamp_min from CPU saturation detection to decouple minimum-performance requests from genuine saturation, preserving uclamp_max and vendor-hook hooks.
• Asymmetric-Capacity Busiest-Group Selection: Evaluates CPU capacity prior to comparing load-balancer group types, preventing unsuitable higher-capacity source groups from prematurely winning selection and pulling tasks toward weaker destination CPUs.
• Misfit Accounting: Only classifies a scheduling group as misfit when the destination CPU provides meaningfully greater capacity; allows standard has_spare / fully_busy balancing when migration yields no advantage, while maintaining root-domain overload signals and Android 6.6 sg_status / misfit-reason tracking.
• RT Push IPI: Resolved an RT push IPI condition that could induce real-time scheduling livelocks or severe latency spikes on non-RT kernels.
• PSI Timer Lifetime: Switched psi_cgroup_free() to timer_shutdown_sync(), preventing the PSI realtime poll timer from firing after its cgroup memory has been deallocated.

CPUFreq & Power Management

• Hotplug / Suspend Synchronization: Synchronized cpufreq_suspend() against concurrent CPU hotplug events during reboot and suspend sequences, preventing governor data structures from being freed while still referenced by the suspend path.

Memory Management

• File-Backed Huge-Page Accounting: Updated file PMD memory counters prior to releasing folio references, preventing access to folio state after the final reference is dropped.
• Memfd Sealing Hardening: Enforced strict F_SEAL_WRITE semantics to prevent writable mappings from being created in violation of seal rules.
• Deferred TLB Invalidation: Flushed deferred TLB invalidations prior to destroying reclaimed large folios, preventing stale translation entries from surviving folio deallocation.
• Huge Zero PFN Concurrency: Corrected synchronization primitives around huge zero-page PFN access.

Cgroup Writeback

• Lock Contention: Eliminated unnecessary wb->list_lock acquisitions when switching inode writeback contexts if no list migration is required.
• Teardown Races: Resolved race conditions between cgroup writeback teardown and inode writeback switching (inode_switch_wbs()).
• Asynchronous Switching UAF: Fixed a use-after-free condition in inode_switch_wbs_work_fn() by correcting writeback work lifetime handling.
• Synchronization Cleanup: Removed the obsolete global RCU barrier from cgroup writeback teardown following race resolutions.

Userfaultfd

• PTE Validation: Userfaultfd wait logic now checks writability only when the page table entry (PTE) is actually present.
• VMA Registration Restrictions: Hardened registration against incompatible VMAs; explicitly rejects shadow-stack VMAs and unsupported VM_SPECIAL mappings while preserving valid hugetlb operation.

DAMON (Data Access Monitor)

• LRU Lifetime Ordering: Acquires folio references prior to verifying LRU presence in DAMON LRU-state checks.
• Region Management: Corrected tried-region removal routines, fixed hotness scoring under extreme intervals, and enforced exclusive handling of region end addresses.
• Sysfs Cleanup & Validation: Corrected cleanup ordering for sysfs directories and statistics on internal initialization failures; added range validation to damon_set_regions() to reject overlapping ranges and invalid layouts.

Page Reporting, Suspend & ZRAM

• Page Reporting Teardown: Transitioned page-reporting tasks onto the freezable system workqueue, ensuring reporting operations freeze before balloon queues are torn down during suspend.
• ZRAM Partial-Write UAF: Resolved a use-after-free in ZRAM partial writes by ensuring backing-device read operations complete before temporary pages can be modified or released.

eBPF Subsystem

• Buffer Management: Corrected buffer deallocation in replaced BPF sysctl write paths by using kvfree() for buffers allocated via kvzalloc().
• Cgroup Sysctl Propagation: Restored propagation of sysctl values modified through bpf_sysctl_set_new_value().
• Filesystem Inode Lifetime: Restored RCU-delayed freeing for bpffs inode data accessed during RCU path walks.
• ABI & Structure Validation: Hardened bpf_prog_info userspace ABI by validating trailing padding for future structure compatibility.
• Network & Socket Handling: Corrected IPv4 TOS handling through the INET6 API on IPv4-mapped IPv6 sockets; fixed NULL dereference in xdp_master_redirect() by verifying the master device before access; ensured private SKB creation before running egress BPF programs on shared SKBs in generic devmaps; hardened devmaps against fragmented frames in clone paths.
• Message Data Bounds: Resolved integer overflows in bpf_msg_push_data() and bpf_msg_pop_data(), preventing undersized allocations, invalid bounds checks, and scatterlist out-of-bounds copies.
• Verifier Logic: Corrected verifier stack-slot indexing for speculative-store-bypass mitigations; ensured verification of both normal and abnormal return paths for ld_abs / ld_ind within subprograms; preserved pointer provenance during scalar-pointer commuted arithmetic; enforced valid PTR_TO_STACK arguments in process_iter_arg().
• JIT & Security: Added range validation for ARM64 BPF JIT conditional branches to reject out-of-range B.cond targets; hardened BPF inode-storage map allocation by rejecting BPF_MAP_TYPE_INODE_STORAGE when BPF LSM is uninitialized; restricted attachment to unsupported LSM hooks while retaining getselfattr support; corrected effective program replacement indexing under BPF_F_PREORDER; enforced rcu_dereference_bh() on TC egress filter reads in act_bpf.

File System (F2FS)

• Deadlock Resolution: Resolved a deadlock in f2fs_balance_fs() and eliminated the gc_merge deadlock path by flushing cached OPU/IPU data BIOs prior to initiating garbage collection.
• Data Integrity: Prevented atomic write retry sequences from zeroing out original file data upon failure.
• Metadata Hardening: Validated orphan inode entry counts, audited compressed-cache inodes when compression is disabled, enforced short/full ACL entry-size verification, bounded i_inline_xattr_size for non-inline inodes, and repaired corrupted extended-attribute list traversals.
• I/O & Memory Safety: Resolved a use-after-free in f2fs_merge_page_bio(), aligned pinned-file fallocate() sections, and removed redundant zero checks in __destroy_extent_node() to correct FI_NO_EXTENT handling.

---

Installation

Requirements

1. Unlocked bootloader on POCO X7 Pro / Redmi Turbo 4 (rodin).
2. Custom recovery (OrangeFox / TWRP) or a root kernel flashing tool (Kernel Flasher).
3. Valid backup of current boot.img and init_boot.img partitions.

Flashing Procedure

1. Transfer the selected zip package (KSU or Normal) to device storage.
2. Flash the zip through recovery or Kernel Flasher.
3. Optional: Wipe Dalvik/ART Cache.
4. Reboot to system.

---

Disclaimer

Flashing custom kernels involves modifications to critical boot partitions. Maintain verified backups of your stock partitions before installation.