Merge tag 'LA.UM.9.14.r1-22000-LAHAINA.QSSI12.0' of https://git.codelinaro.org/clo/la/kernel/msm-5.4 into android13-5.4-lahaina

"LA.UM.9.14.r1-22000-LAHAINA.QSSI12.0"

* tag 'LA.UM.9.14.r1-22000-LAHAINA.QSSI12.0' of https://git.codelinaro.org/clo/la/kernel/msm-5.4:
  cpufreq: schedutil: Fix UAF issue
  msm: mhi_dev: Support async write in UCI for size greater than 8k
  mtd: msm_qpic_nand: Add boot_a and boot_b access to APPS
  qcom: cpufreq-hw: Use the topology coreid for offset
  soc: qcom: Add Upperbounds check for program header
  msm: adsprpc: Handle UAF in fastrpc_buf_free
  interconnect: qcom: sm8150: fix UAF under remove function
  interconnect: qcom: monaco: fix UAF under remove function
  interconnect: qcom: direwolf: fix UAF under remove function
  interconnect: qcom: yupik: fix UAF under remove function
  interconnect: qcom: sdxnightjar: fix UAF under remove function
  interconnect: qcom: sdxlemur: fix UAF under remove function
  interconnect: qcom: sm6150: fix UAF under remove function
  interconnect: qcom: shima: fix UAF under remove function
  interconnect: qcom: scshrike: fix UAF under remove function
  interconnect: qcom: lahaina: fix UAF under remove function
  interconnect: qcom: holi: fix UAF under remove function
  qcedev: vote for crypto clocks during module close
  msm: synx: Check for zero before reducing bind handles
  msm: adsprpc: Handle UAF in fastrpc internal munmap
  mtd: msm_qpic_nand: Add boot_a and boot_b access to APPS
  coresight-tmc: increase qdss pcie sw path throughput
  net: qrtr: Move service id based filter check before queueing skb
  defconfig: sdxlemur: Enable R8168 driver config
  virt: haven: rsc_mgr: Allocate right buffer size of requests

 Conflicts:
	arch/arm64/boot/dts/vendor/bindings/phy/amlogic,g12a-usb3-pcie-phy.yaml
	arch/arm64/boot/dts/vendor/bindings/sound/qcom,wcd9335.txt
	drivers/edac/qcom_edac.c
	drivers/net/ethernet/stmicro/stmmac/dwmac-qcom-ethqos.c
	drivers/net/ethernet/stmicro/stmmac/stmmac_hwtstamp.c
	drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
	mm/khugepaged.c

Change-Id: I5b49e94db45d481ea90ba77800b26c32bd7433ab

android/GKI_VERSION

@@ -1 +1 @@
-LTS_5.4.226_2af3bdf29330
+LTS_5.4.233_4716ccc31d55

arch/arm/configs/vendor/sdxlemur.config

@@ -363,6 +363,7 @@ CONFIG_IOSS=m
 CONFIG_AQFWD_IOSS=m
 CONFIG_R8125=y
 CONFIG_R8125_IOSS=m
+CONFIG_R8168=y
 CONFIG_QCOM_SHOW_RESUME_IRQ=y
 CONFIG_HARDENED_USERCOPY=y
 # CONFIG_HARDENED_USERCOPY_FALLBACK is not set

drivers/char/adsprpc.c

@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: GPL-2.0-only
 /*
  * Copyright (c) 2012-2021, The Linux Foundation. All rights reserved.
- * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2022-2023, Qualcomm Innovation Center, Inc. All rights reserved.
  */
 
 /* Uncomment this block to log an error on every VERIFY failure */
@@ -579,10 +579,11 @@ struct fastrpc_mmap {
 	bool is_persistent;		/* Indicates whether map is persistent */
 	int frpc_md_index;		/* Minidump unique index */
 	uintptr_t attr;
-	bool in_use;			/* Indicates if persistent map is in use*/
+	bool in_use;			/* Indicates if persistent map is in use */
 	struct timespec64 map_start_time;
 	struct timespec64 map_end_time;
-	bool is_filemap; /*flag to indicate map used in process init*/
+	bool is_filemap; /* flag to indicate map used in process init */
+	unsigned int ctx_refs; /* Indicates reference count for context map */
 };
 
 enum fastrpc_perfkeys {
@@ -1016,8 +1017,8 @@ static void fastrpc_buf_free(struct fastrpc_buf *buf, int cache)
 		}
 		hlist_add_head(&buf->hn, &fl->cached_bufs);
 		fl->num_cached_buf++;
-		spin_unlock(&fl->hlock);
 		buf->type = -1;
+		spin_unlock(&fl->hlock);
 		return;
 	}
 skip_buf_cache:
@@ -1220,7 +1221,7 @@ static int fastrpc_mmap_remove(struct fastrpc_file *fl, int fd, uintptr_t va,
 	hlist_for_each_entry_safe(map, n, &me->maps, hn) {
 		if (map->refs == 1 && map->raddr == va &&
 			map->raddr + map->len == va + len &&
-			/*Remove map if not used in process initialization*/
+			/* Remove map if not used in process initialization */
 			!map->is_filemap) {
 			match = map;
 			hlist_del_init(&map->hn);
@@ -1233,9 +1234,10 @@ static int fastrpc_mmap_remove(struct fastrpc_file *fl, int fd, uintptr_t va,
 		return 0;
 	}
 	hlist_for_each_entry_safe(map, n, &fl->maps, hn) {
-		if (map->refs == 1 && map->raddr == va &&
+		/* Remove if only one reference map and no context map */
-			map->raddr + map->len == va + len &&
+		if (map->refs == 1 && !map->ctx_refs &&
-			/*Remove map if not used in process initialization*/
+			map->raddr == va && map->raddr + map->len == va + len &&
+			/* Remove map if not used in process initialization */
 			!map->is_filemap) {
 			match = map;
 			hlist_del_init(&map->hn);
@@ -1274,7 +1276,7 @@ static void fastrpc_mmap_free(struct fastrpc_mmap *map, uint32_t flags)
 				map->flags == ADSP_MMAP_REMOTE_HEAP_ADDR) {
 		spin_lock(&me->hlock);
 		map->refs--;
-		if (!map->refs && !map->is_persistent)
+		if (!map->refs && !map->is_persistent && !map->ctx_refs)
 			hlist_del_init(&map->hn);
 		spin_unlock(&me->hlock);
 		if (map->refs > 0) {
@@ -1290,7 +1292,7 @@ static void fastrpc_mmap_free(struct fastrpc_mmap *map, uint32_t flags)
 		}
 	} else {
 		map->refs--;
-		if (!map->refs)
+		if (!map->refs && !map->ctx_refs)
 			hlist_del_init(&map->hn);
 		if (map->refs > 0 && !flags)
 			return;
@@ -1426,6 +1428,7 @@ static int fastrpc_mmap_create(struct fastrpc_file *fl, int fd,
 	map->attr = attr;
 	map->frpc_md_index = -1;
 	map->is_filemap = false;
+	map->ctx_refs = 0;
 	ktime_get_real_ts64(&map->map_start_time);
 	if (mflags == ADSP_MMAP_HEAP_ADDR ||
 				mflags == ADSP_MMAP_REMOTE_HEAP_ADDR) {
@@ -2177,8 +2180,11 @@ static void context_free(struct smq_invoke_ctx *ctx)
 	spin_unlock(&ctx->fl->hlock);
 
 	mutex_lock(&ctx->fl->map_mutex);
-	for (i = 0; i < nbufs; ++i)
+	for (i = 0; i < nbufs; ++i) {
+		if (ctx->maps[i] && ctx->maps[i]->ctx_refs)
+			ctx->maps[i]->ctx_refs--;
 		fastrpc_mmap_free(ctx->maps[i], 0);
+	}
 	mutex_unlock(&ctx->fl->map_mutex);
 
 	fastrpc_buf_free(ctx->buf, 1);
@@ -2485,6 +2491,8 @@ static int get_args(uint32_t kernel, struct smq_invoke_ctx *ctx)
 			err = fastrpc_mmap_create(ctx->fl, ctx->fds[i],
 					ctx->attrs[i], buf, len,
 					mflags, &ctx->maps[i]);
+		if (ctx->maps[i])
+			ctx->maps[i]->ctx_refs++;
 		mutex_unlock(&ctx->fl->map_mutex);
 		if (err)
 			goto bail;
@@ -2502,9 +2510,14 @@ static int get_args(uint32_t kernel, struct smq_invoke_ctx *ctx)
 			err = fastrpc_mmap_create(ctx->fl, ctx->fds[i],
 					FASTRPC_ATTR_NOVA, 0, 0, dmaflags,
 					&ctx->maps[i]);
+		if (!err && ctx->maps[i])
+			ctx->maps[i]->ctx_refs++;
 		if (err) {
-			for (j = bufs; j < i; j++)
+			for (j = bufs; j < i; j++) {
+				if (ctx->maps[j] && ctx->maps[j]->ctx_refs)
+					ctx->maps[j]->ctx_refs--;
 				fastrpc_mmap_free(ctx->maps[j], 0);
+			}
 			mutex_unlock(&ctx->fl->map_mutex);
 			goto bail;
 		}
@@ -2835,6 +2848,8 @@ static int put_args(uint32_t kernel, struct smq_invoke_ctx *ctx,
 			}
 		} else {
 			mutex_lock(&ctx->fl->map_mutex);
+			if (ctx->maps[i]->ctx_refs)
+				ctx->maps[i]->ctx_refs--;
 			fastrpc_mmap_free(ctx->maps[i], 0);
 			mutex_unlock(&ctx->fl->map_mutex);
 			ctx->maps[i] = NULL;
@@ -2845,8 +2860,11 @@ static int put_args(uint32_t kernel, struct smq_invoke_ctx *ctx,
 		if (!fdlist[i])
 			break;
 		if (!fastrpc_mmap_find(ctx->fl, (int)fdlist[i], 0, 0,
-					0, 0, &mmap))
+					0, 0, &mmap)) {
+			if (mmap && mmap->ctx_refs)
+				mmap->ctx_refs--;
 			fastrpc_mmap_free(mmap, 0);
+		}
 	}
 	mutex_unlock(&ctx->fl->map_mutex);
 	if (ctx->crc && crclist && rpra)

drivers/cpufreq/qcom-cpufreq-hw.c

@@ -17,6 +17,7 @@
 #include <linux/pm_opp.h>
 #include <linux/sched.h>
 #include <linux/slab.h>
+#include <linux/topology.h>
 
 #define CREATE_TRACE_POINTS
 #include <trace/events/dcvsh.h>
@@ -33,8 +34,8 @@
 #define LIMITS_POLLING_DELAY_MS		10
 #define MAX_ROW				2
 
-#define CYCLE_CNTR_OFFSET(c, m, acc_count)				\
+#define CYCLE_CNTR_OFFSET(core_id, m, acc_count)				\
-			(acc_count ? ((c - cpumask_first(m) + 1) * 4) : 0)
+			(acc_count ? ((core_id + 1) * 4) : 0)
 
 enum {
 	REG_ENABLE,
@@ -214,7 +215,7 @@ static u64 qcom_cpufreq_get_cpu_cycle_counter(int cpu)
 	cpu_counter = &qcom_cpufreq_counter[cpu];
 	spin_lock_irqsave(&cpu_counter->lock, flags);
 
-	offset = CYCLE_CNTR_OFFSET(cpu, policy->related_cpus,
+	offset = CYCLE_CNTR_OFFSET(topology_core_id(cpu), policy->related_cpus,
 					accumulative_counter);
 	val = readl_relaxed_no_log(policy->driver_data +
 				    offsets[REG_CYCLE_CNTR] + offset);
@@ -232,6 +233,8 @@ static u64 qcom_cpufreq_get_cpu_cycle_counter(int cpu)
 	cycle_counter_ret = cpu_counter->total_cycle_counter;
 	spin_unlock_irqrestore(&cpu_counter->lock, flags);
 
+	pr_debug("CPU %u, core-id 0x%x, offset %u\n", cpu, topology_core_id(cpu), offset);
+
 	return cycle_counter_ret;
 }
 

drivers/crypto/msm/qcedev.c

@@ -2163,8 +2163,11 @@ static int qcedev_remove(struct platform_device *pdev)
 	podev = platform_get_drvdata(pdev);
 	if (!podev)
 		return 0;
+
+	qcedev_ce_high_bw_req(podev, true);
 	if (podev->qce)
 		qce_close(podev->qce);
+	qcedev_ce_high_bw_req(podev, false);
 
 	if (podev->icc_path)
 		icc_put(podev->icc_path);

drivers/hwtracing/coresight/coresight-tmc-etr.c

@@ -1129,9 +1129,11 @@ tmc_etr_setup_sysfs_buf(struct tmc_drvdata *drvdata)
 			&& drvdata->byte_cntr->sw_usb)
 			new_buf = tmc_alloc_etr_buf(drvdata, TMC_ETR_SW_USB_BUF_SIZE,
 					 0, cpu_to_node(0), NULL);
-		else if (drvdata->out_mode == TMC_ETR_OUT_MODE_PCIE)
+		else if (drvdata->out_mode == TMC_ETR_OUT_MODE_PCIE) {
 			new_buf = tmc_alloc_etr_buf(drvdata, TMC_ETR_PCIE_MEM_SIZE,
 					 0, cpu_to_node(0), NULL);
+			drvdata->size = TMC_ETR_PCIE_MEM_SIZE;
+		}
 		else
 			new_buf = tmc_alloc_etr_buf(drvdata, drvdata->size,
 					 0, cpu_to_node(0), NULL);

drivers/hwtracing/coresight/coresight-tmc.h

@@ -104,7 +104,7 @@
 #define TMC_ETR_BAM_PIPE_INDEX	0
 #define TMC_ETR_BAM_NR_PIPES	2
 
-#define TMC_ETR_PCIE_MEM_SIZE	0x400000
+#define TMC_ETR_PCIE_MEM_SIZE	0x2000000
 
 #define TMC_AUTH_NSID_MASK	GENMASK(1, 0)
 

drivers/interconnect/qcom/direwolf.c

@@ -1,6 +1,7 @@
 // SPDX-License-Identifier: GPL-2.0-only
 /*
  * Copyright (c) 2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023, Qualcomm Innovation Center, Inc. All rights reserved.
  *
  */
 
@@ -2693,11 +2694,5 @@ static int __init qnoc_driver_init(void)
 }
 core_initcall(qnoc_driver_init);
 
-static void __exit qnoc_driver_exit(void)
-{
-	platform_driver_unregister(&qnoc_driver);
-}
-module_exit(qnoc_driver_exit);
-
 MODULE_DESCRIPTION("Direwolf NoC driver");
 MODULE_LICENSE("GPL v2");

drivers/interconnect/qcom/holi.c

@@ -1,6 +1,7 @@
 // SPDX-License-Identifier: GPL-2.0-only
 /*
  * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023, Qualcomm Innovation Center, Inc. All rights reserved.
  *
  */
 
@@ -1868,11 +1869,5 @@ static int __init qnoc_driver_init(void)
 }
 core_initcall(qnoc_driver_init);
 
-static void __exit qnoc_driver_exit(void)
-{
-	platform_driver_unregister(&qnoc_driver);
-}
-module_exit(qnoc_driver_exit);
-
 MODULE_DESCRIPTION("Holi NoC driver");
 MODULE_LICENSE("GPL v2");

drivers/interconnect/qcom/lahaina.c

@@ -1,6 +1,7 @@
 // SPDX-License-Identifier: GPL-2.0-only
 /*
  * Copyright (c) 2019-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023, Qualcomm Innovation Center, Inc. All rights reserved.
  *
  */
 
@@ -2903,11 +2904,5 @@ static int __init qnoc_driver_init(void)
 }
 core_initcall(qnoc_driver_init);
 
-static void __exit qnoc_driver_exit(void)
-{
-	platform_driver_unregister(&qnoc_driver);
-}
-module_exit(qnoc_driver_exit);
-
 MODULE_DESCRIPTION("Lahaina NoC driver");
 MODULE_LICENSE("GPL v2");

drivers/interconnect/qcom/monaco.c

@@ -1,6 +1,7 @@
 // SPDX-License-Identifier: GPL-2.0-only
 /*
  * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023, Qualcomm Innovation Center, Inc. All rights reserved.
  *
  */
 
@@ -1389,11 +1390,5 @@ static int __init qnoc_driver_init(void)
 }
 core_initcall(qnoc_driver_init);
 
-static void __exit qnoc_driver_exit(void)
-{
-	platform_driver_unregister(&qnoc_driver);
-}
-module_exit(qnoc_driver_exit);
-
 MODULE_DESCRIPTION("Monaco NoC driver");
 MODULE_LICENSE("GPL v2");

drivers/interconnect/qcom/scshrike.c

@@ -1,6 +1,7 @@
 // SPDX-License-Identifier: GPL-2.0-only
 /*
  * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023, Qualcomm Innovation Center, Inc. All rights reserved.
  *
  */
 
@@ -2977,11 +2978,5 @@ static int __init qnoc_driver_init(void)
 }
 core_initcall(qnoc_driver_init);
 
-static void __exit qnoc_driver_exit(void)
-{
-	platform_driver_unregister(&qnoc_driver);
-}
-module_exit(qnoc_driver_exit);
-
 MODULE_DESCRIPTION("SCSHRIKE NoC driver");
 MODULE_LICENSE("GPL v2");

drivers/interconnect/qcom/sdxlemur.c

@@ -1,6 +1,7 @@
 // SPDX-License-Identifier: GPL-2.0-only
 /*
  * Copyright (c) 2020, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023, Qualcomm Innovation Center, Inc. All rights reserved.
  *
  */
 
@@ -1289,11 +1290,5 @@ static int __init qnoc_driver_init(void)
 }
 core_initcall(qnoc_driver_init);
 
-static void __exit qnoc_driver_exit(void)
-{
-	platform_driver_unregister(&qnoc_driver);
-}
-module_exit(qnoc_driver_exit);
-
 MODULE_DESCRIPTION("SDXLEMUR NoC driver");
 MODULE_LICENSE("GPL v2");

drivers/interconnect/qcom/sdxnightjar.c

@@ -1,6 +1,7 @@
 // SPDX-License-Identifier: GPL-2.0-only
 /*
  * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023, Qualcomm Innovation Center, Inc. All rights reserved.
  *
  */
 
@@ -1027,11 +1028,5 @@ static int __init qnoc_driver_init(void)
 }
 core_initcall(qnoc_driver_init);
 
-static void __exit qnoc_driver_exit(void)
-{
-	platform_driver_unregister(&qnoc_driver);
-}
-module_exit(qnoc_driver_exit);
-
 MODULE_DESCRIPTION("sdxnightjar NoC driver");
 MODULE_LICENSE("GPL v2");

drivers/interconnect/qcom/shima.c

@@ -1,6 +1,7 @@
 // SPDX-License-Identifier: GPL-2.0-only
 /*
  * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023, Qualcomm Innovation Center, Inc. All rights reserved.
  *
  */
 
@@ -2708,11 +2709,5 @@ static int __init qnoc_driver_init(void)
 }
 core_initcall(qnoc_driver_init);
 
-static void __exit qnoc_driver_exit(void)
-{
-	platform_driver_unregister(&qnoc_driver);
-}
-module_exit(qnoc_driver_exit);
-
 MODULE_DESCRIPTION("Shima NoC driver");
 MODULE_LICENSE("GPL v2");

drivers/interconnect/qcom/sm6150.c

@@ -1,6 +1,7 @@
 // SPDX-License-Identifier: GPL-2.0-only
 /*
  * Copyright (c) 2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023, Qualcomm Innovation Center, Inc. All rights reserved.
  *
  */
 
@@ -2457,11 +2458,5 @@ static int __init qnoc_driver_init(void)
 }
 core_initcall(qnoc_driver_init);
 
-static void __exit qnoc_driver_exit(void)
-{
-	platform_driver_unregister(&qnoc_driver);
-}
-module_exit(qnoc_driver_exit);
-
 MODULE_DESCRIPTION("SM6150 NoC driver");
 MODULE_LICENSE("GPL v2");

drivers/interconnect/qcom/sm8150.c

@@ -1,6 +1,7 @@
 // SPDX-License-Identifier: GPL-2.0-only
 /*
  * Copyright (c) 2020, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023, Qualcomm Innovation Center, Inc. All rights reserved.
  *
  */
 
@@ -2899,11 +2900,5 @@ static int __init qnoc_driver_init(void)
 }
 core_initcall(qnoc_driver_init);
 
-static void __exit qnoc_driver_exit(void)
-{
-	platform_driver_unregister(&qnoc_driver);
-}
-module_exit(qnoc_driver_exit);
-
 MODULE_DESCRIPTION("SM8150 NoC driver");
 MODULE_LICENSE("GPL v2");

drivers/interconnect/qcom/yupik.c

@@ -1,6 +1,7 @@
 // SPDX-License-Identifier: GPL-2.0-only
 /*
  * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023, Qualcomm Innovation Center, Inc. All rights reserved.
  *
  */
 
@@ -2731,11 +2732,5 @@ static int __init qnoc_driver_init(void)
 }
 core_initcall(qnoc_driver_init);
 
-static void __exit qnoc_driver_exit(void)
-{
-	platform_driver_unregister(&qnoc_driver);
-}
-module_exit(qnoc_driver_exit);
-
 MODULE_DESCRIPTION("Yupik NoC driver");
 MODULE_LICENSE("GPL v2");

drivers/mtd/devices/msm_qpic_nand.c

@@ -2,6 +2,7 @@
 /*
  * Copyright (C) 2007 Google, Inc.
  * Copyright (c) 2012-2021 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
  */
 
 #include "msm_qpic_nand.h"
@@ -18,8 +19,24 @@
 #define SMEM_AARM_PARTITION_TABLE 9
 #define SMEM_APPS 0
 #define ONE_CODEWORD_SIZE 516
+#define ACTIVE_BOOT_PART_MAX 30
 
 static struct device *dev_node;
+static char active_boot_part[ACTIVE_BOOT_PART_MAX] = "boot";
+
+/*
+ * Function to get the active boot partition information
+ * from kernel command line during system boot.
+ */
+#ifndef MODULE
+static int __init get_active_boot_part(char *str)
+{
+	strlcpy(active_boot_part, str, ACTIVE_BOOT_PART_MAX);
+	return 0;
+}
+
+__setup("part.activeboot=", get_active_boot_part);
+#endif
 
 /*
  * Get the DMA memory for requested amount of size. It returns the pointer
@@ -797,18 +814,25 @@ static int msm_nand_flash_onfi_probe(struct msm_nand_info *info)
 
 	memset(&data, 0, sizeof(struct msm_nand_flash_onfi_data));
 
-	/* Lookup the partition to which apps has access to */
+	/* Lookup the partition to which apps has access to
+	 *
+	 * active_boot_part value gets updated to either kernel command line
+	 * parameter "part.activeboot=" value (if present) or hold the default
+	 * "boot" value.
+	 */
 	for (i = 0; i < FLASH_PTABLE_MAX_PARTS_V4; i++) {
-		if (mtd_part[i].name && !strcmp("boot", mtd_part[i].name)) {
+		if (mtd_part[i].name && !strcmp(active_boot_part, mtd_part[i].name)) {
 			page_address = mtd_part[i].offset << 6;
 			break;
 		}
 	}
+
 	if (!page_address) {
 		pr_err("%s: no apps partition found in smem\n", __func__);
 		ret = -EPERM;
 		goto free_dma;
 	}
+
 	data.cfg.cmd = MSM_NAND_CMD_PAGE_READ_ONFI;
 	data.exec = 1;
 	data.cfg.addr0 = (page_address << 16) |

drivers/net/ethernet/stmicro/stmmac/dwmac-qcom-ethqos.c

@@ -1646,6 +1646,8 @@ static int qcom_ethqos_probe(struct platform_device *pdev)
 	plat_dat->has_gmac4 = 1;
 	plat_dat->pmt = 1;
 	plat_dat->tso_en = of_property_read_bool(np, "snps,tso");
+	if (of_device_is_compatible(np, "qcom,qcs404-ethqos"))
+		plat_dat->rx_clk_runs_in_lpi = 1;
 	plat_dat->early_eth = ethqos->early_eth_enabled;
 	plat_dat->handle_prv_ioctl = ethqos_handle_prv_ioctl;
 	plat_dat->request_phy_wol = qcom_ethqos_request_phy_wol;
@@ -1683,8 +1685,6 @@ static int qcom_ethqos_probe(struct platform_device *pdev)
 	}
 
 	plat_dat->stmmac_emb_smmu_ctx = emac_emb_smmu_ctx;
-	if (of_device_is_compatible(np, "qcom,qcs404-ethqos"))
-		plat_dat->rx_clk_runs_in_lpi = 1;
 
 	ret = stmmac_dvr_probe(&pdev->dev, plat_dat, &stmmac_res);
 	if (ret)

drivers/platform/msm/mhi_dev/mhi.h

@@ -267,6 +267,7 @@ struct mhi_config {
 #define MHI_ENV_VALUE			2
 #define MHI_MASK_ROWS_CH_EV_DB		4
 #define TRB_MAX_DATA_SIZE		8192
+#define TRB_MAX_DATA_SIZE_16K		16384
 #define MHI_CTRL_STATE			100
 
 /* maximum transfer completion events buffer */

drivers/platform/msm/mhi_dev/mhi_uci.c

@@ -173,7 +173,7 @@ static const struct chan_attr mhi_chan_attr_table[] = {
 	},
 	{
 		MHI_CLIENT_DIAG_OUT,
-		TRB_MAX_DATA_SIZE,
+		TRB_MAX_DATA_SIZE_16K,
 		MAX_NR_TRBS_PER_CHAN,
 		MHI_DIR_OUT,
 		NULL,
@@ -184,7 +184,7 @@ static const struct chan_attr mhi_chan_attr_table[] = {
 	},
 	{
 		MHI_CLIENT_DIAG_IN,
-		TRB_MAX_DATA_SIZE,
+		TRB_MAX_DATA_SIZE_16K,
 		MAX_NR_TRBS_PER_CHAN,
 		MHI_DIR_IN,
 		NULL,
@@ -629,10 +629,17 @@ static int mhi_uci_send_sync(struct uci_client *uci_handle,
 	struct mhi_req ureq;
 	int ret_val;
 
-	uci_log(UCI_DBG_VERBOSE,
+	uci_log(UCI_DBG_DBG,
 		"Sync write for ch_id:%d size %d\n",
 		uci_handle->out_chan, size);
 
+	if (size > TRB_MAX_DATA_SIZE) {
+		uci_log(UCI_DBG_ERROR,
+				"Too big write size: %lu, max supported size is %d\n",
+				size, TRB_MAX_DATA_SIZE);
+			return -EFBIG;
+	}
+
 	ureq.client = uci_handle->out_handle;
 	ureq.buf = data_loc;
 	ureq.len = size;
@@ -945,7 +952,7 @@ static int mhi_uci_read_sync(struct uci_client *uci_handle, int *bytes_avail)
 	struct mhi_req ureq;
 	struct mhi_dev_client *client_handle;
 
-	uci_log(UCI_DBG_INFO,
+	uci_log(UCI_DBG_DBG,
 		"Sync read for ch_id:%d\n", uci_handle->in_chan);
 
 	client_handle = uci_handle->in_handle;
@@ -1484,11 +1491,10 @@ static ssize_t mhi_uci_client_write(struct file *file,
 		return -ENODEV;
 	}
 
-	if (count > TRB_MAX_DATA_SIZE) {
+	if (count > uci_handle->out_chan_attr->max_packet_size) {
-		uci_log(UCI_DBG_ERROR,
+		uci_log(UCI_DBG_DBG,
-			"Too big write size: %lu, max supported size is %d\n",
+			"Warning: big write size: %lu, max supported size is %d\n",
-			count, TRB_MAX_DATA_SIZE);
+			count, uci_handle->out_chan_attr->max_packet_size);
-		return -EFBIG;
 	}
 
 	data_loc = kmalloc(count, GFP_KERNEL);
@@ -1543,11 +1549,10 @@ static ssize_t mhi_uci_client_write_iter(struct kiocb *iocb,
 		return -ENODEV;
 	}
 
-	if (count > TRB_MAX_DATA_SIZE) {
+	if (count > uci_handle->out_chan_attr->max_packet_size) {
-		uci_log(UCI_DBG_ERROR,
+		uci_log(UCI_DBG_DBG,
-			"Too big write size: %lu, max supported size is %d\n",
+			"Warning: big write size: %lu, max supported size is %d\n",
-			count, TRB_MAX_DATA_SIZE);
+			count, uci_handle->out_chan_attr->max_packet_size);
-		return -EFBIG;
 	}
 
 	data_loc = kmalloc(count, GFP_KERNEL);

drivers/soc/qcom/mdt_loader.c

@@ -95,7 +95,7 @@ void *qcom_mdt_read_metadata(const struct firmware *fw, size_t *data_len)
 	ehdr = (struct elf32_hdr *)fw->data;
 	phdrs = (struct elf32_phdr *)(ehdr + 1);
 
-	if (ehdr->e_phnum < 2)
+	if (ehdr->e_phnum < 2 || ehdr->e_phnum > PN_XNUM)
 		return ERR_PTR(-EINVAL);
 
 	if (phdrs[0].p_type == PT_LOAD)

drivers/virt/haven/hh_rm_core.c

@@ -525,7 +525,7 @@ static int hh_rm_send_request(u32 message_id,
 		return -E2BIG;
 	}
 
-	msg = kzalloc(HH_RM_MAX_MSG_SIZE_BYTES, GFP_KERNEL);
+	msg = kzalloc(HH_MSGQ_MAX_MSG_SIZE_BYTES, GFP_KERNEL);
 	if (!msg)
 		return -ENOMEM;
 
@@ -542,7 +542,7 @@ static int hh_rm_send_request(u32 message_id,
 			payload_size = buff_size_remaining;
 		}
 
-		memset(msg, 0, HH_RM_MAX_MSG_SIZE_BYTES);
+		memset(msg, 0, HH_MSGQ_MAX_MSG_SIZE_BYTES);
 		/* Fill header */
 		hdr = msg;
 

kernel/sched/cpufreq_schedutil.c

@@ -1296,12 +1296,14 @@ static void sugov_exit(struct cpufreq_policy *policy)
 
 	mutex_lock(&global_tunables_lock);
 
+	/* Save tunables before last owner release it in gov_attr_set_put() */
+	if (tunables->attr_set.usage_count == 1)
+		sugov_tunables_save(policy, tunables);
+
 	count = gov_attr_set_put(&tunables->attr_set, &sg_policy->tunables_hook);
 	policy->governor_data = NULL;
-	if (!count) {
+	if (!count)
-		sugov_tunables_save(policy, tunables);
 		sugov_clear_global_tunables();
-	}
 
 	mutex_unlock(&global_tunables_lock);
 

net/qrtr/qrtr.c

@@ -939,13 +939,6 @@ int qrtr_endpoint_post(struct qrtr_endpoint *ep, const void *data, size_t len)
 			return -ENODEV;
 		}
 
-		if (sock_queue_rcv_skb(&ipc->sk, skb))
-			goto err;
-
-		/* Force wakeup for all packets except for sensors */
-		if (node->nid != 9 && node->nid != 5)
-			pm_wakeup_ws_event(node->ws, qrtr_wakeup_ms, true);
-
 		if (node->nid == 5) {
 			svc_id = qrtr_get_service_id(cb->src_node, cb->src_port);
 			if (svc_id > 0) {
@@ -956,9 +949,19 @@ int qrtr_endpoint_post(struct qrtr_endpoint *ep, const void *data, size_t len)
 					}
 				}
 			}
-			if (wake)
-				pm_wakeup_ws_event(node->ws, qrtr_wakeup_ms, true);
 		}
+
+		if (sock_queue_rcv_skb(&ipc->sk, skb))
+			goto err;
+
+		/**
+		 * Force wakeup for all packets except for sensors and blacklisted services
+		 * from adsp side
+		 */
+		if ((node->nid != 9 && node->nid != 5) ||
+		    (node->nid == 5 && wake))
+			pm_wakeup_ws_event(node->ws, qrtr_wakeup_ms, true);
+
 		qrtr_port_put(ipc);
 	}