Cleanup

- Removes unused files/patches
- Removes many guards, these likely don't work anyway due to patchsets having dependencies
- No functional change

Signed-off-by: Tavi <tavi@divested.dev>

Patches/Common/android_external_hardened_malloc/0001-Broken_Cameras-1.patch

@@ -0,0 +1,102 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Tue, 1 Jan 2019 14:45:27 -0500
+Subject: [PATCH] workarounds for Pixel 3 SoC era camera driver bugs
+
+---
+ h_malloc.c | 33 ++++++++++++++++++++++++++++-----
+ 1 file changed, 28 insertions(+), 5 deletions(-)
+
+diff --git a/h_malloc.c b/h_malloc.c
+index 15be0a2..3fa9ed7 100644
+--- a/h_malloc.c
++++ b/h_malloc.c
+@@ -80,6 +80,9 @@ static union {
+ #ifdef MEMTAG
+         bool is_memtag_disabled;
+ #endif
++        bool zero_on_free;
++        bool purge_slabs;
++        bool region_quarantine_protect;
+     };
+     char padding[PAGE_SIZE];
+ } ro __attribute__((aligned(PAGE_SIZE)));
+@@ -465,7 +468,7 @@ static void *slot_pointer(size_t size, void *slab, size_t slot) {
+ }
+ 
+ static void write_after_free_check(const char *p, size_t size) {
+-    if (!WRITE_AFTER_FREE_CHECK) {
++    if (!WRITE_AFTER_FREE_CHECK || !ro.zero_on_free) {
+         return;
+     }
+ 
+@@ -812,7 +815,7 @@ static inline void deallocate_small(void *p, const size_t *expected_size) {
+         }
+ #endif
+ 
+-        if (ZERO_ON_FREE && !skip_zero) {
++        if (ro.zero_on_free && !skip_zero) {
+             memset(p, 0, size - canary_size);
+         }
+     }
+@@ -890,7 +893,7 @@ static inline void deallocate_small(void *p, const size_t *expected_size) {
+ 
+         if (c->empty_slabs_total + slab_size > max_empty_slabs_total) {
+             int saved_errno = errno;
+-            if (!memory_map_fixed(slab, slab_size)) {
++            if (ro.purge_slabs && !memory_map_fixed(slab, slab_size)) {
+                 label_slab(slab, slab_size, class);
+                 stats_slab_deallocate(c, slab_size);
+                 enqueue_free_slab(c, metadata);
+@@ -976,7 +979,7 @@ static void regions_quarantine_deallocate_pages(void *p, size_t size, size_t gua
+         return;
+     }
+ 
+-    if (unlikely(memory_map_fixed(p, size))) {
++    if (!ro.region_quarantine_protect || unlikely(memory_map_fixed(p, size))) {
+         memory_purge(p, size);
+     } else {
+         memory_set_name(p, size, "malloc large quarantine");
+@@ -1192,6 +1195,21 @@ static inline void enforce_init(void) {
+     }
+ }
+ 
++COLD static void handle_bugs(void) {
++    char path[256];
++    if (readlink("/proc/self/exe", path, sizeof(path)) == -1) {
++        return;
++    }
++
++    // Pixel 3, Pixel 3 XL, Pixel 3a and Pixel 3a XL camera provider
++    const char camera_provider[] = "/vendor/bin/hw/android.hardware.camera.provider@2.4-service_64";
++    if (strcmp(camera_provider, path) == 0) {
++        ro.zero_on_free = false;
++        ro.purge_slabs = false;
++        ro.region_quarantine_protect = false;
++    }
++}
++
+ static struct mutex init_lock = MUTEX_INITIALIZER;
+ 
+ COLD static void init_slow_path(void) {
+@@ -1207,6 +1225,11 @@ COLD static void init_slow_path(void) {
+     ro.metadata_pkey = pkey_alloc(0, 0);
+ #endif
+ 
++    ro.purge_slabs = true;
++    ro.zero_on_free = ZERO_ON_FREE;
++    ro.region_quarantine_protect = true;
++    handle_bugs();
++
+     if (unlikely(sysconf(_SC_PAGESIZE) != PAGE_SIZE)) {
+         fatal_error("runtime page size does not match compile-time page size which is not supported");
+     }
+@@ -1491,7 +1514,7 @@ EXPORT void *h_calloc(size_t nmemb, size_t size) {
+     }
+     total_size = adjust_size_for_canary(total_size);
+     void *p = alloc(total_size);
+-    if (!ZERO_ON_FREE && likely(p != NULL) && total_size && total_size <= max_slab_size_class) {
++    if (!ro.zero_on_free && likely(p != NULL) && total_size && total_size <= max_slab_size_class) {
+         memset(p, 0, total_size - canary_size);
+     }
+ #ifdef HAS_ARM_MTE

Patches/Common/android_external_hardened_malloc/0001-Broken_Cameras-2.patch

@@ -0,0 +1,25 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Tad <tad@spotco.us>
+Date: Tue, 15 Mar 2022 22:18:26 -0400
+Subject: [PATCH] Expand workaround to all camera executables
+
+Signed-off-by: Tad <tad@spotco.us>
+Change-Id: I23513ec0379bbb10829f989690334e9704fd20e2
+---
+ h_malloc.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/h_malloc.c b/h_malloc.c
+index 3fa9ed7..0308d73 100644
+--- a/h_malloc.c
++++ b/h_malloc.c
+@@ -1203,7 +1203,8 @@ COLD static void handle_bugs(void) {
+ 
+     // Pixel 3, Pixel 3 XL, Pixel 3a and Pixel 3a XL camera provider
+     const char camera_provider[] = "/vendor/bin/hw/android.hardware.camera.provider@2.4-service_64";
+-    if (strcmp(camera_provider, path) == 0) {
++    // Any camera executable on system partition
++    if (strcmp(camera_provider, path) == 0 || (strstr(path, "camera") != NULL && (strncmp("/system", path, 7) == 0 || strncmp("/vendor", path, 7) == 0 || strncmp("/apex", path, 5) == 0))) {
+         ro.zero_on_free = false;
+         ro.purge_slabs = false;
+         ro.region_quarantine_protect = false;

Patches/Common/android_external_hardened_malloc/0002-Broken_Displays.patch

@@ -0,0 +1,31 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Tad <tad@spotco.us>
+Date: Tue, 22 Nov 2022 07:23:10 -0500
+Subject: [PATCH] Add workaround for OnePlus 8 & 9 display driver crash
+
+Change-Id: Ie7a0ca79bb629814e57958d57546f85030b67048
+Signed-off-by: Tad <tad@spotco.us>
+---
+ h_malloc.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/h_malloc.c b/h_malloc.c
+index 0308d73..6c3b148 100644
+--- a/h_malloc.c
++++ b/h_malloc.c
+@@ -1209,6 +1209,15 @@ COLD static void handle_bugs(void) {
+         ro.purge_slabs = false;
+         ro.region_quarantine_protect = false;
+     }
++
++    // OnePlus 8 & 9 display composer
++    // https://gitlab.com/divested-mobile/divestos-build/-/issues/19
++    const char hwc[] = "/vendor/bin/hw/vendor.qti.hardware.display.composer-service";
++    if (strcmp(hwc, path) == 0) {
++        ro.zero_on_free = false;
++        ro.purge_slabs = false;
++        ro.region_quarantine_protect = false;
++    }
+ }
+ 
+ static struct mutex init_lock = MUTEX_INITIALIZER;

Patches/Common/android_external_hardened_malloc/0003-Broken_Audio.patch

@@ -0,0 +1,51 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Daniel Micay <danielmicay@gmail.com>
+Date: Thu, 28 May 2020 20:19:14 -0400
+Subject: [PATCH] workaround for audio service sorting bug
+
+---
+ h_malloc.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/h_malloc.c b/h_malloc.c
+index 6c3b148..4090b0c 100644
+--- a/h_malloc.c
++++ b/h_malloc.c
+@@ -83,6 +83,7 @@ static union {
+         bool zero_on_free;
+         bool purge_slabs;
+         bool region_quarantine_protect;
++        bool slot_randomize;
+     };
+     char padding[PAGE_SIZE];
+ } ro __attribute__((aligned(PAGE_SIZE)));
+@@ -386,7 +387,7 @@ static u64 get_mask(size_t slots) {
+ }
+ 
+ static size_t get_free_slot(struct random_state *rng, size_t slots, const struct slab_metadata *metadata) {
+-    if (SLOT_RANDOMIZE) {
++    if (ro.slot_randomize) {
+         // randomize start location for linear search (uniform random choice is too slow)
+         size_t random_index = get_random_u16_uniform(rng, slots);
+         size_t first_bitmap = random_index / U64_WIDTH;
+@@ -1218,6 +1219,12 @@ COLD static void handle_bugs(void) {
+         ro.purge_slabs = false;
+         ro.region_quarantine_protect = false;
+     }
++
++    // DeviceDescriptor sorting wrongly relies on malloc addresses
++    const char audio_service[] = "/system/bin/audioserver";
++    if (strcmp(audio_service, path) == 0) {
++        ro.slot_randomize = false;
++    }
+ }
+ 
+ static struct mutex init_lock = MUTEX_INITIALIZER;
+@@ -1238,6 +1245,7 @@ COLD static void init_slow_path(void) {
+     ro.purge_slabs = true;
+     ro.zero_on_free = ZERO_ON_FREE;
+     ro.region_quarantine_protect = true;
++    ro.slot_randomize = SLOT_RANDOMIZE;
+     handle_bugs();
+ 
+     if (unlikely(sysconf(_SC_PAGESIZE) != PAGE_SIZE)) {