Merge tag 'LA.BR.1.2.9.1-02310-8x16.0' of https://source.codeaurora.o…

…rg/quic/la/kernel/msm-3.10 into lineage-15.1

"LA.BR.1.2.9.1-02310-8x16.0"

 Conflicts:
	fs/dcache.c
	sound/core/rawmidi.c

arch/arm/configs/msm8916-perf_defconfig

@@ -454,7 +454,6 @@ CONFIG_ANDROID=y
 CONFIG_ANDROID_BINDER_IPC=y
 CONFIG_ANDROID_BINDER_DEVICES="binder,hwbinder,vndbinder"
 CONFIG_ASHMEM=y
-CONFIG_ANDROID_LOGGER=y
 CONFIG_ANDROID_TIMED_GPIO=y
 CONFIG_ANDROID_LOW_MEMORY_KILLER=y
 CONFIG_ANDROID_INTF_ALARM_DEV=y

arch/arm/configs/msm8916_defconfig

@@ -460,7 +460,6 @@ CONFIG_ANDROID=y
 CONFIG_ANDROID_BINDER_IPC=y
 CONFIG_ANDROID_BINDER_DEVICES="binder,hwbinder,vndbinder"
 CONFIG_ASHMEM=y
-CONFIG_ANDROID_LOGGER=y
 CONFIG_ANDROID_TIMED_GPIO=y
 CONFIG_ANDROID_LOW_MEMORY_KILLER=y
 CONFIG_ANDROID_INTF_ALARM_DEV=y

arch/arm/include/asm/hw_breakpoint.h

@@ -51,6 +51,7 @@ static inline void decode_ctrl_reg(u32 reg,
 #define ARM_DEBUG_ARCH_V7_ECP14	3
 #define ARM_DEBUG_ARCH_V7_MM	4
 #define ARM_DEBUG_ARCH_V7_1	5
+#define ARM_DEBUG_ARCH_V8	6
 
 /* Breakpoint */
 #define ARM_BREAKPOINT_EXECUTE	0

arch/arm/kernel/hw_breakpoint.c

@@ -167,7 +167,7 @@ static int debug_arch_supported(void)
 /* Can we determine the watchpoint access type from the fsr? */
 static int debug_exception_updates_fsr(void)
 {
-	return 0;
+	return get_debug_arch() >= ARM_DEBUG_ARCH_V8;
 }
 
 /* Determine number of WRP registers available. */
@@ -268,6 +268,7 @@ static int enable_monitor_mode(void)
 		break;
 	case ARM_DEBUG_ARCH_V7_ECP14:
 	case ARM_DEBUG_ARCH_V7_1:
+	case ARM_DEBUG_ARCH_V8:
 		ARM_DBG_WRITE(c0, c2, 2, (dscr | ARM_DSCR_MDBGEN));
 		isb();
 		break;

arch/arm64/configs/msm-perf_defconfig

@@ -440,7 +440,6 @@ CONFIG_ANDROID=y
 CONFIG_ANDROID_BINDER_IPC=y
 CONFIG_ANDROID_BINDER_DEVICES="binder,hwbinder,vndbinder"
 CONFIG_ASHMEM=y
-CONFIG_ANDROID_LOGGER=y
 CONFIG_ANDROID_LOW_MEMORY_KILLER=y
 CONFIG_ANDROID_INTF_ALARM_DEV=y
 CONFIG_ONESHOT_SYNC=y

arch/arm64/configs/msm_defconfig

@@ -452,7 +452,6 @@ CONFIG_ANDROID=y
 CONFIG_ANDROID_BINDER_IPC=y
 CONFIG_ANDROID_BINDER_DEVICES="binder,hwbinder,vndbinder"
 CONFIG_ASHMEM=y
-CONFIG_ANDROID_LOGGER=y
 CONFIG_ANDROID_LOW_MEMORY_KILLER=y
 CONFIG_ANDROID_INTF_ALARM_DEV=y
 CONFIG_ONESHOT_SYNC=y

drivers/char/diag/diag_dci.c

@@ -1,4 +1,4 @@
-/* Copyright (c) 2012-2017, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2012-2018, The Linux Foundation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 and
@@ -818,7 +818,7 @@ static void dci_process_ctrl_status(unsigned char *buf, int len, int token)
 	read_len += sizeof(struct diag_ctrl_dci_status);
 
 	for (i = 0; i < header->count; i++) {
-		if (read_len > len) {
+		if (read_len > (len - 2)) {
 			pr_err("diag: In %s, Invalid length len: %d\n",
 			       __func__, len);
 			return;
@@ -1097,18 +1097,31 @@ void extract_dci_events(unsigned char *buf, int len, int data_source, int token)
 	struct list_head *start, *temp;
 	struct diag_dci_client_tbl *entry = NULL;
 
-	length =  *(uint16_t *)(buf + 1); /* total length of event series */
-	if (length == 0) {
-		pr_err("diag: Incoming dci event length is invalid\n");
+	if (!buf) {
+		pr_err("diag: In %s buffer is NULL\n", __func__);
 		return;
 	}
-	/* Move directly to the start of the event series. 1 byte for
-	 * event code and 2 bytes for the length field.
-	 */
-	/* The length field indicates the total length removing the cmd_code
+	/*
+	 * 1 byte for event code and 2 bytes for the length field.
+	 * The length field indicates the total length removing the cmd_code
 	 * and the lenght field. The event parsing in that case should happen
 	 * till the end.
 	 */
+	if (len < 3) {
+		pr_err("diag: In %s invalid len: %d\n", __func__, len);
+		return;
+	}
+	length = *(uint16_t *)(buf + 1); /* total length of event series */
+	if ((length == 0) || (len != (length + 3))) {
+		pr_err("diag: Incoming dci event length: %d is invalid\n",
+			length);
+		return;
+	}
+	/*
+	 * Move directly to the start of the event series.
+	 * The event parsing should happen from start of event
+	 * series till the end.
+	 */
 	temp_len = 3;
 	while (temp_len < length) {
 		event_id_packet = *(uint16_t *)(buf + temp_len);
@@ -1125,30 +1138,60 @@ void extract_dci_events(unsigned char *buf, int len, int data_source, int token)
 			 * necessary.
 			 */
 			timestamp_len = 8;
-			memcpy(timestamp, buf + temp_len + 2, timestamp_len);
+			if ((temp_len + timestamp_len + 2) <= len)
+				memcpy(timestamp, buf + temp_len + 2,
+					timestamp_len);
+			else {
+				pr_err("diag: Invalid length in %s, len: %d, temp_len: %d",
+						__func__, len, temp_len);
+				return;
+			}
 		}
 		/* 13th and 14th bit represent the payload length */
 		if (((event_id_packet & 0x6000) >> 13) == 3) {
 			payload_len_field = 1;
-			payload_len = *(uint8_t *)
+			if ((temp_len + timestamp_len + 3) <= len) {
+				payload_len = *(uint8_t *)
 					(buf + temp_len + 2 + timestamp_len);
-			if (payload_len < (MAX_EVENT_SIZE - 13)) {
-				/* copy the payload length and the payload */
+			} else {
+				pr_err("diag: Invalid length in %s, len: %d, temp_len: %d",
+						__func__, len, temp_len);
+				return;
+			}
+			if ((payload_len < (MAX_EVENT_SIZE - 13)) &&
+			((temp_len + timestamp_len + payload_len + 3) <= len)) {
+				/*
+				 * Copy the payload length and the payload
+				 * after skipping temp_len bytes for already
+				 * parsed packet, timestamp_len for timestamp
+				 * buffer, 2 bytes for event_id_packet.
+				 */
 				memcpy(event_data + 12, buf + temp_len + 2 +
 							timestamp_len, 1);
 				memcpy(event_data + 13, buf + temp_len + 2 +
 					timestamp_len + 1, payload_len);
 			} else {
-				pr_err("diag: event > %d, payload_len = %d\n",
-					(MAX_EVENT_SIZE - 13), payload_len);
+				pr_err("diag: event > %d, payload_len = %d, temp_len = %d\n",
+				(MAX_EVENT_SIZE - 13), payload_len, temp_len);
 				return;
 			}
 		} else {
 			payload_len_field = 0;
 			payload_len = (event_id_packet & 0x6000) >> 13;
-			/* copy the payload */
-			memcpy(event_data + 12, buf + temp_len + 2 +
+			/*
+			 * Copy the payload after skipping temp_len bytes
+			 * for already parsed packet, timestamp_len for
+			 * timestamp buffer, 2 bytes for event_id_packet.
+			 */
+			if ((payload_len < (MAX_EVENT_SIZE - 12)) &&
+			((temp_len + timestamp_len + payload_len + 2) <= len))
+				memcpy(event_data + 12, buf + temp_len + 2 +
 						timestamp_len, payload_len);
+			else {
+				pr_err("diag: event > %d, payload_len = %d, temp_len = %d\n",
+				(MAX_EVENT_SIZE - 12), payload_len, temp_len);
+				return;
+			}
 		}
 
 		/* Before copying the data to userspace, check if we are still
@@ -1264,19 +1307,19 @@ void extract_dci_log(unsigned char *buf, int len, int data_source, int token)
 		pr_err("diag: In %s buffer is NULL\n", __func__);
 		return;
 	}
-
-	/* The first six bytes for the incoming log packet contains
-	 * Command code (2), the length of the packet (2) and the length
-	 * of the log (2)
+	/*
+	 * The first eight bytes for the incoming log packet contains
+	 * Command code (2), the length of the packet (2), the length
+	 * of the log (2) and log code (2)
 	 */
-	log_code = *(uint16_t *)(buf + 6);
-	read_bytes += sizeof(uint16_t) + 6;
-	if (read_bytes > len) {
-		pr_err("diag: Invalid length in %s, len: %d, read: %d",
-						__func__, len, read_bytes);
+	if (len < 8) {
+		pr_err("diag: In %s invalid len: %d\n", __func__, len);
 		return;
 	}
 
+	log_code = *(uint16_t *)(buf + 6);
+	read_bytes += sizeof(uint16_t) + 6;
+
 	/* parse through log mask table of each client and check mask */
 	list_for_each_safe(start, temp, &driver->dci_client_list) {
 		entry = list_entry(start, struct diag_dci_client_tbl, track);

drivers/char/diag/diagchar_core.c

@@ -1,4 +1,4 @@
-/* Copyright (c) 2008-2016, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2008-2018, The Linux Foundation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 and
@@ -322,8 +322,8 @@ static int diagchar_open(struct inode *inode, struct file *file)
 	return -ENOMEM;
 
 fail:
-	mutex_unlock(&driver->diagchar_mutex);
 	driver->num_clients--;
+	mutex_unlock(&driver->diagchar_mutex);
 	pr_alert("diag: Insufficient memory for new client");
 	return -ENOMEM;
 }

drivers/gpu/msm/kgsl.h

@@ -28,7 +28,7 @@
 /* The number of memstore arrays limits the number of contexts allowed.
  * If more contexts are needed, update multiple for MEMSTORE_SIZE
  */
-#define KGSL_MEMSTORE_SIZE	((int)(PAGE_SIZE * 2))
+#define KGSL_MEMSTORE_SIZE	((int)(PAGE_SIZE * 8))
 #define KGSL_MEMSTORE_GLOBAL	(0)
 #define KGSL_PRIORITY_MAX_RB_LEVELS 4
 #define KGSL_MEMSTORE_MAX	(KGSL_MEMSTORE_SIZE / \

drivers/platform/msm/ipa/ipa_rt.c

@@ -1,4 +1,4 @@
-/* Copyright (c) 2012-2014,2017 The Linux Foundation. All rights reserved.
+/* Copyright (c) 2012-2018, The Linux Foundation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 and
@@ -1072,6 +1072,15 @@ int __ipa_del_rt_rule(u32 rule_hdl)
 		return -EINVAL;
 	}
 
+	if (!strcmp(entry->tbl->name, IPA_DFLT_RT_TBL_NAME)) {
+		IPADBG("Deleting rule from default rt table idx=%u\n",
+			entry->tbl->idx);
+		if (entry->tbl->rule_cnt == 1) {
+			IPAERR("Default tbl last rule cannot be deleted\n");
+			return -EINVAL;
+		}
+	}
+
 	if (entry->hdr)
 		__ipa_release_hdr(entry->hdr->id);
 	else if (entry->proc_ctx)

drivers/soc/qcom/jtagv8.c

@@ -44,7 +44,9 @@
 #define BMVAL(val, lsb, msb)	((val & BM(lsb, msb)) >> lsb)
 #define BVAL(val, n)		((val & BIT(n)) >> n)
 
+#ifdef CONFIG_ARM64
 #define ARM_DEBUG_ARCH_V8	(0x6)
+#endif
 
 #define MAX_DBG_REGS		(66)
 #define MAX_DBG_STATE_SIZE	(MAX_DBG_REGS * num_possible_cpus())

drivers/thermal/msm_thermal-dev.c

@@ -1,4 +1,4 @@
-/* Copyright (c) 2013-2017, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2013-2018, The Linux Foundation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 and
@@ -32,8 +32,10 @@ static int msm_thermal_major;
 static struct class *thermal_class;
 static struct msm_thermal_ioctl_dev *msm_thermal_dev;
 static unsigned int freq_table_len[NR_CPUS], freq_table_set[NR_CPUS];
+static unsigned int voltage_table_set[NR_CPUS];
 static unsigned int *freq_table_ptr[NR_CPUS];
 static DEFINE_MUTEX(ioctl_access_mutex);
+static uint32_t *voltage_table_ptr[NR_CPUS];
 
 static int msm_thermal_ioctl_open(struct inode *node, struct file *filep)
 {
@@ -193,6 +195,93 @@ static long msm_thermal_process_freq_table_req(struct msm_thermal_ioctl *query,
 	return ret;
 }
 
+static long msm_thermal_process_voltage_table_req(
+		struct msm_thermal_ioctl *query,
+		unsigned long *arg)
+{
+	long ret = 0;
+	uint32_t table_idx = 0, idx = 0;
+	uint32_t cluster_id = query->voltage.cluster_num;
+	struct voltage_plan_arg *voltage = &(query->voltage);
+
+	if (cluster_id >= num_possible_cpus())
+		return -EINVAL;
+
+	if (!voltage_table_ptr[cluster_id]) {
+		if (!freq_table_len[cluster_id]) {
+			ret = msm_thermal_get_freq_plan_size(cluster_id,
+				&freq_table_len[cluster_id]);
+			if (ret) {
+				pr_err(
+				"%s: Cluster%d freq table len err:%ld\n",
+				KBUILD_MODNAME, cluster_id, ret);
+				goto process_volt_exit;
+			}
+			if (!freq_table_len[cluster_id]) {
+				pr_err("%s: Cluster%d freq table empty\n",
+					KBUILD_MODNAME, cluster_id);
+				ret = -EAGAIN;
+				goto process_volt_exit;
+			}
+		}
+		voltage_table_ptr[cluster_id] = kzalloc(
+			sizeof(uint32_t) *
+			freq_table_len[cluster_id], GFP_KERNEL);
+		if (!voltage_table_ptr[cluster_id]) {
+			pr_err("%s: memory alloc failed\n",
+				KBUILD_MODNAME);
+			ret = -ENOMEM;
+			goto process_volt_exit;
+		}
+		ret = msm_thermal_get_cluster_voltage_plan(cluster_id,
+			voltage_table_ptr[cluster_id]);
+		if (ret) {
+			pr_err("%s: Error getting voltage table. err:%ld\n",
+				KBUILD_MODNAME, ret);
+			kfree(voltage_table_ptr[cluster_id]);
+			voltage_table_ptr[cluster_id] = NULL;
+			goto process_volt_exit;
+		}
+	}
+
+	if (!voltage->voltage_table_len) {
+		voltage->voltage_table_len = freq_table_len[cluster_id];
+		goto copy_and_return;
+	}
+
+	voltage_table_set[cluster_id] = freq_table_len[cluster_id]
+					/ MSM_IOCTL_FREQ_SIZE;
+	if (freq_table_len[cluster_id] % MSM_IOCTL_FREQ_SIZE)
+		voltage_table_set[cluster_id]++;
+
+	if (voltage->set_idx >= voltage_table_set[cluster_id]) {
+		pr_err("%s: Invalid voltage table set%d for cluster%d\n",
+			KBUILD_MODNAME, voltage->set_idx,
+			cluster_id);
+		ret = -EINVAL;
+		goto process_volt_exit;
+	}
+
+	table_idx = MSM_IOCTL_FREQ_SIZE * voltage->set_idx;
+	for (; table_idx < freq_table_len[cluster_id]
+		&& idx < MSM_IOCTL_FREQ_SIZE; idx++, table_idx++) {
+		voltage->voltage_table[idx] =
+			voltage_table_ptr[cluster_id][table_idx];
+	}
+	voltage->voltage_table_len = idx;
+
+copy_and_return:
+	ret = copy_to_user((void __user *)(*arg), query,
+		sizeof(struct msm_thermal_ioctl));
+	if (ret) {
+		pr_err("%s: copy_to_user error:%ld.\n", KBUILD_MODNAME, ret);
+		goto process_volt_exit;
+	}
+
+process_volt_exit:
+	return ret;
+}
+
 static long msm_thermal_ioctl_process(struct file *filep, unsigned int cmd,
 	unsigned long arg)
 {
@@ -226,6 +315,9 @@ static long msm_thermal_ioctl_process(struct file *filep, unsigned int cmd,
 	case MSM_THERMAL_GET_CLUSTER_FREQUENCY_PLAN:
 		ret = msm_thermal_process_freq_table_req(&query, &arg);
 		break;
+	case MSM_THERMAL_GET_CLUSTER_VOLTAGE_PLAN:
+		ret = msm_thermal_process_voltage_table_req(&query, &arg);
+		break;
 	default:
 		ret = -ENOTTY;
 		goto process_exit;
@@ -328,8 +420,10 @@ void msm_thermal_ioctl_cleanup()
 		return;
 	}
 
-	for (; idx < num_possible_cpus(); idx++)
+	for (; idx < num_possible_cpus(); idx++) {
 		kfree(freq_table_ptr[idx]);
+		kfree(voltage_table_ptr[idx]);
+	}
 	device_destroy(thermal_class, thermal_dev);
 	class_destroy(thermal_class);
 	cdev_del(&msm_thermal_dev->char_dev);