Piteball/android_kernel_samsung_msm8976
1
1
Fork 0
mirror of https://github.com/team-infusion-developers/android_kernel_samsung_msm8976.git synced 2024-09-21 03:43:03 +00:00
Code Issues Projects Releases Wiki Activity

Merge tag 'LA.BR.1.3.6-05010-8976.0' of https://source.codeaurora.org/quic/la/kernel/msm-3.10 into cm-14.1-merge

Browse source 
"LA.BR.1.3.6-05010-8976.0"
This commit is contained in:
LuK1337 2017-11-22 00:26:48 +01:00
parent 97b0964874 deaf4056f4
commit b2213f5c42
31 changed files with 330 additions and 159 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

24
drivers/char/diag/diag_dci.c
View file

@ -1,4 +1,4 @@
/* Copyright (c) 2012-2016, The Linux Foundation. All rights reserved.
/* Copyright (c) 2012-2017, The Linux Foundation. All rights reserved.
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License version 2 and
@ -2114,10 +2114,28 @@ struct diag_dci_client_tbl *dci_lookup_client_entry_pid(int tgid)
{
struct list_head *start, *temp;
struct diag_dci_client_tbl *entry = NULL;
struct pid *pid_struct = NULL;
struct task_struct *task_s = NULL;
list_for_each_safe(start, temp, &driver->dci_client_list) {
entry = list_entry(start, struct diag_dci_client_tbl, track);
if (entry->client->tgid == tgid)
return entry;
pid_struct = find_get_pid(entry->tgid);
if (!pid_struct) {
DIAG_LOG(DIAG_DEBUG_DCI,
"diag: valid pid doesn't exist for pid = %d\n",
entry->tgid);
continue;
}
task_s = get_pid_task(pid_struct, PIDTYPE_PID);
if (!task_s) {
DIAG_LOG(DIAG_DEBUG_DCI,
"diag: valid task doesn't exist for pid = %d\n",
entry->tgid);
continue;
}
if (task_s == entry->client)
if (entry->client->tgid == tgid)
return entry;
}
return NULL;
}

1
drivers/char/diag/diag_dci.h
View file

@ -141,6 +141,7 @@ struct diag_dci_buf_peripheral_t {
};
struct diag_dci_client_tbl {
int tgid;
struct diag_dci_reg_tbl_t client_info;
struct task_struct *client;
unsigned char *dci_log_mask;

7
drivers/char/diag/diag_debugfs.c
View file

@ -42,7 +42,7 @@ static int diag_dbgfs_bridgeinfo_index;
static int diag_dbgfs_finished;
static int diag_dbgfs_dci_data_index;
static int diag_dbgfs_dci_finished;
static struct mutex diag_dci_dbgfs_mutex;
static ssize_t diag_dbgfs_read_status(struct file *file, char __user *ubuf,
size_t count, loff_t *ppos)
{
@ -139,6 +139,7 @@ static ssize_t diag_dbgfs_read_dcistats(struct file *file,
buf_size = ksize(buf);
bytes_remaining = buf_size;
mutex_lock(&diag_dci_dbgfs_mutex);
if (diag_dbgfs_dci_data_index == 0) {
bytes_written =
scnprintf(buf, buf_size,
@ -194,8 +195,8 @@ static ssize_t diag_dbgfs_read_dcistats(struct file *file,
}
temp_data++;
}
diag_dbgfs_dci_data_index = (i >= DIAG_DCI_DEBUG_CNT) ? 0 : i + 1;
mutex_unlock(&diag_dci_dbgfs_mutex);
bytes_written = simple_read_from_buffer(ubuf, count, ppos, buf,
bytes_in_buf);
kfree(buf);
@ -1008,6 +1009,7 @@ int diag_debugfs_init(void)
pr_warn("diag: could not allocate memory for dci debug info\n");
mutex_init(&dci_stat_mutex);
mutex_init(&diag_dci_dbgfs_mutex);
return 0;
err:
kfree(dci_traffic);
@ -1024,6 +1026,7 @@ void diag_debugfs_cleanup(void)
kfree(dci_traffic);
mutex_destroy(&dci_stat_mutex);
mutex_destroy(&diag_dci_dbgfs_mutex);
}
#else
int diag_debugfs_init(void) { return 0; }

27
drivers/char/diag/diagchar_core.c
View file

@ -1383,14 +1383,18 @@ static int diag_ioctl_lsm_deinit(void)
{
int i;
mutex_lock(&driver->diagchar_mutex);
for (i = 0; i < driver->num_clients; i++)
if (driver->client_map[i].pid == current->tgid)
break;
if (i == driver->num_clients)
if (i == driver->num_clients) {
mutex_unlock(&driver->diagchar_mutex);
return -EINVAL;
}
driver->data_ready[i] |= DEINIT_TYPE;
mutex_unlock(&driver->diagchar_mutex);
wake_up_interruptible(&driver->wait_q);
return 1;
@ -2446,6 +2450,16 @@ int silent_log_panic_handler(void)
}
EXPORT_SYMBOL(silent_log_panic_handler);
static int check_data_ready(int index)
{
int data_type = 0;
mutex_lock(&driver->diagchar_mutex);
data_type = driver->data_ready[index];
mutex_unlock(&driver->diagchar_mutex);
return data_type;
}
static ssize_t diagchar_read(struct file *file, char __user *buf, size_t count,
loff_t *ppos)
{
@ -2457,9 +2471,11 @@ static ssize_t diagchar_read(struct file *file, char __user *buf, size_t count,
int exit_stat = 0;
int write_len = 0;
mutex_lock(&driver->diagchar_mutex);
for (i = 0; i < driver->num_clients; i++)
if (driver->client_map[i].pid == current->tgid)
index = i;
mutex_unlock(&driver->diagchar_mutex);
if (index == -1) {
pr_err("diag: Client PID not found in table");
@ -2469,7 +2485,7 @@ static ssize_t diagchar_read(struct file *file, char __user *buf, size_t count,
pr_err("diag: bad address from user side\n");
return -EFAULT;
}
wait_event_interruptible(driver->wait_q, driver->data_ready[index]);
wait_event_interruptible(driver->wait_q, (check_data_ready(index)) > 0);
mutex_lock(&driver->diagchar_mutex);
@ -2587,11 +2603,11 @@ static ssize_t diagchar_read(struct file *file, char __user *buf, size_t count,
}
exit:
mutex_unlock(&driver->diagchar_mutex);
if (driver->data_ready[index] & DCI_DATA_TYPE) {
mutex_lock(&driver->dci_mutex);
/* Copy the type of data being passed */
data_type = driver->data_ready[index] & DCI_DATA_TYPE;
mutex_unlock(&driver->diagchar_mutex);
/* Copy the type of data being passed */
mutex_lock(&driver->dci_mutex);
list_for_each_safe(start, temp, &driver->dci_client_list) {
entry = list_entry(start, struct diag_dci_client_tbl,
track);
@ -2623,6 +2639,7 @@ exit:
mutex_unlock(&driver->dci_mutex);
goto end;
}
mutex_unlock(&driver->diagchar_mutex);
end:
/*
* Flush any read that is currently pending on DCI data and

42
drivers/crypto/msm/ice.c
View file

@ -361,7 +361,7 @@ static void qcom_ice_enable(struct ice_device *ice_dev)
(ICE_REV(ice_dev->ice_hw_version, MINOR) >= 1))) {
reg = qcom_ice_readl(ice_dev, QCOM_ICE_REGS_BYPASS_STATUS);
if ((reg & 0x80000000) != 0x0) {
pr_err("%s: Bypass failed for ice = %p",
pr_err("%s: Bypass failed for ice = %pK",
__func__, (void *)ice_dev);
BUG();
}
@ -386,7 +386,7 @@ static int qcom_ice_verify_ice(struct ice_device *ice_dev)
}
ice_dev->ice_hw_version = rev;
dev_info(ice_dev->pdev, "QC ICE %d.%d.%d device found @0x%p\n",
dev_info(ice_dev->pdev, "QC ICE %d.%d.%d device found @0x%pK\n",
maj_rev, min_rev, step_rev,
ice_dev->mmio);
@ -842,7 +842,7 @@ static int qcom_ice_restore_config(void)
static int qcom_ice_init_clocks(struct ice_device *ice)
{
int ret = -1;
struct ice_clk_info *clki;
struct ice_clk_info *clki = NULL;
struct device *dev = ice->pdev;
struct list_head *head = &ice->clk_list_head;
@ -886,7 +886,7 @@ out:
static int qcom_ice_enable_clocks(struct ice_device *ice, bool enable)
{
int ret = 0;
struct ice_clk_info *clki;
struct ice_clk_info *clki = NULL;
struct device *dev = ice->pdev;
struct list_head *head = &ice->clk_list_head;
@ -1211,7 +1211,7 @@ static void qcom_ice_debug(struct platform_device *pdev)
if (!ice_dev->is_ice_enabled)
pr_err("%s: ICE device is not enabled\n", __func__);
pr_err("%s: =========== REGISTER DUMP (%p)===========\n",
pr_err("%s: =========== REGISTER DUMP (%pK)===========\n",
ice_dev->ice_instance_type, ice_dev);
pr_err("%s: ICE Control: 0x%08x | ICE Reset: 0x%08x\n",
@ -1503,7 +1503,7 @@ struct platform_device *qcom_ice_get_pdevice(struct device_node *node)
struct ice_device *ice_dev = NULL;
if (!node) {
pr_err("%s: invalid node %p", __func__, node);
pr_err("%s: invalid node %pK", __func__, node);
goto out;
}
@ -1521,13 +1521,16 @@ struct platform_device *qcom_ice_get_pdevice(struct device_node *node)
list_for_each_entry(ice_dev, &ice_devices, list) {
if (ice_dev->pdev->of_node == node) {
pr_info("%s: found ice device %p\n", __func__, ice_dev);
pr_info("%s: found ice device %pK\n", __func__,
ice_dev);
ice_pdev = to_platform_device(ice_dev->pdev);
break;
}
}
ice_pdev = to_platform_device(ice_dev->pdev);
pr_info("%s: matching platform device %p\n", __func__, ice_pdev);
if (ice_pdev)
pr_info("%s: matching platform device %pK\n", __func__,
ice_pdev);
out:
return ice_pdev;
}
@ -1545,12 +1548,13 @@ static struct ice_device *get_ice_device_from_storage_type
list_for_each_entry(ice_dev, &ice_devices, list) {
if (!strcmp(ice_dev->ice_instance_type, storage_type)) {
pr_info("%s: found ice device %p\n", __func__, ice_dev);
break;
pr_info("%s: found ice device %pK\n", __func__,
ice_dev);
return ice_dev;
}
}
out:
return ice_dev;
return NULL;
}
@ -1566,7 +1570,7 @@ static int enable_ice_setup(struct ice_device *ice_dev)
}
ret = regulator_enable(ice_dev->reg);
if (ret) {
pr_err("%s:%p: Could not enable regulator\n",
pr_err("%s:%pK: Could not enable regulator\n",
__func__, ice_dev);
goto out;
}
@ -1574,7 +1578,7 @@ static int enable_ice_setup(struct ice_device *ice_dev)
/* Setup Clocks */
if (qcom_ice_enable_clocks(ice_dev, true)) {
pr_err("%s:%p:%s Could not enable clocks\n", __func__,
pr_err("%s:%pK:%s Could not enable clocks\n", __func__,
ice_dev, ice_dev->ice_instance_type);
goto out_reg;
}
@ -1586,7 +1590,7 @@ static int enable_ice_setup(struct ice_device *ice_dev)
ret = qcom_ice_set_bus_vote(ice_dev, vote);
if (ret) {
pr_err("%s:%p: failed %d\n", __func__, ice_dev, ret);
pr_err("%s:%pK: failed %d\n", __func__, ice_dev, ret);
goto out_clocks;
}
@ -1618,19 +1622,19 @@ static int disable_ice_setup(struct ice_device *ice_dev)
/* Setup Bus Vote */
vote = qcom_ice_get_bus_vote(ice_dev, "MIN");
if (vote < 0) {
pr_err("%s:%p: Unable to get bus vote\n", __func__, ice_dev);
pr_err("%s:%pK: Unable to get bus vote\n", __func__, ice_dev);
goto out_disable_clocks;
}
ret = qcom_ice_set_bus_vote(ice_dev, vote);
if (ret)
pr_err("%s:%p: failed %d\n", __func__, ice_dev, ret);
pr_err("%s:%pK: failed %d\n", __func__, ice_dev, ret);
out_disable_clocks:
/* Setup Clocks */
if (qcom_ice_enable_clocks(ice_dev, false))
pr_err("%s:%p:%s Could not disable clocks\n", __func__,
pr_err("%s:%pK:%s Could not disable clocks\n", __func__,
ice_dev, ice_dev->ice_instance_type);
/* Setup Regulator */
@ -1641,7 +1645,7 @@ out_disable_clocks:
}
ret = regulator_disable(ice_dev->reg);
if (ret) {
pr_err("%s:%p: Could not disable regulator\n",
pr_err("%s:%pK: Could not disable regulator\n",
__func__, ice_dev);
goto out;
}

4
drivers/crypto/msm/ota_crypto.c
View file

@ -172,7 +172,7 @@ static int qcota_release(struct inode *inode, struct file *file)
podev = file->private_data;
if (podev != NULL && podev->magic != OTA_MAGIC) {
pr_err("%s: invalid handle %p\n",
pr_err("%s: invalid handle %pK\n",
__func__, podev);
}
@ -441,7 +441,7 @@ static long qcota_ioctl(struct file *file,
podev = file->private_data;
if (podev == NULL || podev->magic != OTA_MAGIC) {
pr_err("%s: invalid handle %p\n",
pr_err("%s: invalid handle %pK\n",
__func__, podev);
return -ENOENT;
}

18
drivers/crypto/msm/qce50.c
View file

@ -1,6 +1,6 @@
/* Qualcomm Crypto Engine driver.
*
* Copyright (c) 2012-2015, The Linux Foundation. All rights reserved.
* Copyright (c) 2012-2015, 2017, The Linux Foundation. All rights reserved.
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License version 2 and
@ -235,11 +235,11 @@ static int _probe_ce_engine(struct qce_device *pce_dev)
pce_dev->ce_sps.ce_burst_size = MAX_CE_BAM_BURST_SIZE;
dev_info(pce_dev->pdev,
"CE device = 0x%x\n, "
"IO base, CE = 0x%p\n, "
"CE device = 0x%x\n"
"IO base, CE = 0x%pK\n"
"Consumer (IN) PIPE %d, "
"Producer (OUT) PIPE %d\n"
"IO base BAM = 0x%p\n"
"IO base BAM = 0x%pK\n"
"BAM IRQ %d\n"
"Engines Availability = 0x%x\n",
pce_dev->ce_sps.ce_device,
@ -1092,7 +1092,7 @@ static void _qce_dump_descr_fifos_dbg(struct qce_device *pce_dev)
#define QCE_WRITE_REG(val, addr) \
{ \
pr_info(" [0x%p] 0x%x\n", addr, (uint32_t)val); \
pr_info(" [0x%pK] 0x%x\n", addr, (uint32_t)val); \
writel_relaxed(val, addr); \
}
@ -2510,7 +2510,7 @@ static int qce_sps_init_ep_conn(struct qce_device *pce_dev,
sps_event->xfer_done = NULL;
sps_event->user = (void *)pce_dev;
pr_debug("success, %s : pipe_handle=0x%lx, desc fifo base (phy) = 0x%p\n",
pr_debug("success, %s : pipe_handle=0x%lx, desc fifo base (phy) = 0x%pK\n",
is_producer ? "PRODUCER(RX/OUT)" : "CONSUMER(TX/IN)",
(uintptr_t)sps_pipe_info, &sps_connect_info->desc.phys_base);
goto out;
@ -2674,7 +2674,7 @@ static int qce_sps_get_bam(struct qce_device *pce_dev)
bam.ee = pce_dev->ce_sps.bam_ee;
pr_debug("bam physical base=0x%lx\n", (uintptr_t)bam.phys_addr);
pr_debug("bam virtual base=0x%p\n", bam.virt_addr);
pr_debug("bam virtual base=0x%pK\n", bam.virt_addr);
/* Register CE Peripheral BAM device to SPS driver */
rc = sps_register_bam_device(&bam, &pbam->handle);
@ -2761,9 +2761,9 @@ static void qce_sps_exit(struct qce_device *pce_dev)
static void print_notify_debug(struct sps_event_notify *notify)
{
phys_addr_t addr = DESC_FULL_ADDR(notify->data.transfer.iovec.flags,
phys_addr_t addr = DESC_FULL_ADDR(notify->data.transfer.iovec.flags,
notify->data.transfer.iovec.addr);
pr_debug("sps ev_id=%d, addr=0x%pa, size=0x%x, flags=0x%x user=0x%p\n",
pr_debug("sps ev_id=%d, addr=0x%pa, size=0x%x, flags=0x%x user=0x%pK\n",
notify->event_id, &addr,
notify->data.transfer.iovec.size,
notify->data.transfer.iovec.flags,

6
drivers/crypto/msm/qcedev.c
View file

@ -228,7 +228,7 @@ static int qcedev_release(struct inode *inode, struct file *file)
handle = file->private_data;
podev = handle->cntl;
if (podev != NULL && podev->magic != QCEDEV_MAGIC) {
pr_err("%s: invalid handle %p\n",
pr_err("%s: invalid handle %pK\n",
__func__, podev);
}
kzfree(handle);
@ -300,8 +300,6 @@ void qcedev_sha_req_cb(void *cookie, unsigned char *digest,
if (authdata) {
handle->sha_ctxt.auth_data[0] = auth32[0];
handle->sha_ctxt.auth_data[1] = auth32[1];
handle->sha_ctxt.auth_data[2] = auth32[2];
handle->sha_ctxt.auth_data[3] = auth32[3];
}
tasklet_schedule(&pdev->done_tasklet);
@ -1634,7 +1632,7 @@ long qcedev_ioctl(struct file *file, unsigned cmd, unsigned long arg)
podev = handle->cntl;
qcedev_areq.handle = handle;
if (podev == NULL || podev->magic != QCEDEV_MAGIC) {
pr_err("%s: invalid handle %p\n",
pr_err("%s: invalid handle %pK\n",
__func__, podev);
return -ENOENT;
}

20
drivers/crypto/msm/qcrypto.c
View file

@ -1433,7 +1433,7 @@ static void _qce_ahash_complete(void *cookie, unsigned char *digest,
pengine = rctx->pengine;
#ifdef QCRYPTO_DEBUG
dev_info(&pengine->pdev->dev, "_qce_ahash_complete: %p ret %d\n",
dev_info(&pengine->pdev->dev, "_qce_ahash_complete: %pK ret %d\n",
areq, ret);
#endif
if (digest) {
@ -1481,7 +1481,7 @@ static void _qce_ablk_cipher_complete(void *cookie, unsigned char *icb,
rctx = ablkcipher_request_ctx(areq);
pengine = rctx->pengine;
#ifdef QCRYPTO_DEBUG
dev_info(&pengine->pdev->dev, "_qce_ablk_cipher_complete: %p ret %d\n",
dev_info(&pengine->pdev->dev, "_qce_ablk_cipher_complete: %pK ret %d\n",
areq, ret);
#endif
if (iv)
@ -2299,7 +2299,7 @@ static int _qcrypto_enc_aes_ecb(struct ablkcipher_request *req)
BUG_ON(crypto_tfm_alg_type(req->base.tfm) !=
CRYPTO_ALG_TYPE_ABLKCIPHER);
#ifdef QCRYPTO_DEBUG
dev_info(&ctx->pengine->pdev->dev, "_qcrypto_enc_aes_ecb: %p\n", req);
dev_info(&ctx->pengine->pdev->dev, "_qcrypto_enc_aes_ecb: %pK\n", req);
#endif
if ((ctx->enc_key_len == AES_KEYSIZE_192) &&
@ -2329,7 +2329,7 @@ static int _qcrypto_enc_aes_cbc(struct ablkcipher_request *req)
BUG_ON(crypto_tfm_alg_type(req->base.tfm) !=
CRYPTO_ALG_TYPE_ABLKCIPHER);
#ifdef QCRYPTO_DEBUG
dev_info(&ctx->pengine->pdev->dev, "_qcrypto_enc_aes_cbc: %p\n", req);
dev_info(&ctx->pengine->pdev->dev, "_qcrypto_enc_aes_cbc: %pK\n", req);
#endif
if ((ctx->enc_key_len == AES_KEYSIZE_192) &&
@ -2359,7 +2359,7 @@ static int _qcrypto_enc_aes_ctr(struct ablkcipher_request *req)
BUG_ON(crypto_tfm_alg_type(req->base.tfm) !=
CRYPTO_ALG_TYPE_ABLKCIPHER);
#ifdef QCRYPTO_DEBUG
dev_info(&ctx->pengine->pdev->dev, "_qcrypto_enc_aes_ctr: %p\n", req);
dev_info(&ctx->pengine->pdev->dev, "_qcrypto_enc_aes_ctr: %pK\n", req);
#endif
if ((ctx->enc_key_len == AES_KEYSIZE_192) &&
@ -2543,7 +2543,7 @@ static int _qcrypto_dec_aes_ecb(struct ablkcipher_request *req)
BUG_ON(crypto_tfm_alg_type(req->base.tfm) !=
CRYPTO_ALG_TYPE_ABLKCIPHER);
#ifdef QCRYPTO_DEBUG
dev_info(&ctx->pengine->pdev->dev, "_qcrypto_dec_aes_ecb: %p\n", req);
dev_info(&ctx->pengine->pdev->dev, "_qcrypto_dec_aes_ecb: %pK\n", req);
#endif
if ((ctx->enc_key_len == AES_KEYSIZE_192) &&
@ -2573,7 +2573,7 @@ static int _qcrypto_dec_aes_cbc(struct ablkcipher_request *req)
BUG_ON(crypto_tfm_alg_type(req->base.tfm) !=
CRYPTO_ALG_TYPE_ABLKCIPHER);
#ifdef QCRYPTO_DEBUG
dev_info(&ctx->pengine->pdev->dev, "_qcrypto_dec_aes_cbc: %p\n", req);
dev_info(&ctx->pengine->pdev->dev, "_qcrypto_dec_aes_cbc: %pK\n", req);
#endif
if ((ctx->enc_key_len == AES_KEYSIZE_192) &&
@ -2603,7 +2603,7 @@ static int _qcrypto_dec_aes_ctr(struct ablkcipher_request *req)
BUG_ON(crypto_tfm_alg_type(req->base.tfm) !=
CRYPTO_ALG_TYPE_ABLKCIPHER);
#ifdef QCRYPTO_DEBUG
dev_info(&ctx->pengine->pdev->dev, "_qcrypto_dec_aes_ctr: %p\n", req);
dev_info(&ctx->pengine->pdev->dev, "_qcrypto_dec_aes_ctr: %pK\n", req);
#endif
if ((ctx->enc_key_len == AES_KEYSIZE_192) &&
@ -2915,7 +2915,7 @@ static int _qcrypto_aead_encrypt_aes_cbc(struct aead_request *req)
#ifdef QCRYPTO_DEBUG
dev_info(&ctx->pengine->pdev->dev,
"_qcrypto_aead_encrypt_aes_cbc: %p\n", req);
"_qcrypto_aead_encrypt_aes_cbc: %pK\n", req);
#endif
rctx = aead_request_ctx(req);
@ -2942,7 +2942,7 @@ static int _qcrypto_aead_decrypt_aes_cbc(struct aead_request *req)
#ifdef QCRYPTO_DEBUG
dev_info(&ctx->pengine->pdev->dev,
"_qcrypto_aead_decrypt_aes_cbc: %p\n", req);
"_qcrypto_aead_decrypt_aes_cbc: %pK\n", req);
#endif
rctx = aead_request_ctx(req);
rctx->aead = 1;

12
drivers/gpu/msm/adreno_a5xx.c
View file

@ -1053,8 +1053,8 @@ static void _load_regfile(struct adreno_device *adreno_dev)
{
struct kgsl_device *device = &adreno_dev->dev;
const struct firmware *fw;
uint32_t block_size = 0, block_total = 0, fw_size;
uint32_t *block;
uint64_t block_size = 0, block_total = 0;
uint32_t fw_size, *block;
int ret = -EINVAL;
ret = request_firmware(&fw, adreno_dev->gpucore->regfw_name,
@ -1073,7 +1073,8 @@ static void _load_regfile(struct adreno_device *adreno_dev)
/* All offset numbers calculated from file description */
while (block_total < fw_size) {
block_size = block[0];
if (block_size >= fw_size || block_size < 2)
if (((block_total + block_size) >= fw_size)
|| block_size < 5)
goto err;
if (block[1] != GPMU_SEQUENCE_ID)
goto err;
@ -1088,6 +1089,9 @@ static void _load_regfile(struct adreno_device *adreno_dev)
goto err;
adreno_dev->lm_fw = fw;
if (block[2] > (block_size - 2))
goto err;
adreno_dev->lm_sequence = block + block[2] + 3;
adreno_dev->lm_size = block_size - block[2] - 2;
}
@ -1100,7 +1104,7 @@ static void _load_regfile(struct adreno_device *adreno_dev)
err:
release_firmware(fw);
KGSL_PWR_ERR(device,
"Register file failed to load sz=%d bsz=%d header=%d\n",
"Register file failed to load sz=%d bsz=%llu header=%d\n",
fw_size, block_size, ret);
return;
}

6
drivers/media/platform/msm/camera_v2/isp/msm_isp_stats_util.c
View file

@ -823,6 +823,12 @@ int msm_isp_update_stats_stream(struct vfe_device *vfe_dev, void *arg)
struct msm_vfe_axi_stream_cfg_update_info *update_info = NULL;
struct msm_isp_sw_framskip *sw_skip_info = NULL;
if (update_cmd->num_streams > MSM_ISP_STATS_MAX) {
pr_err("%s: Invalid num_streams %d\n",
__func__, update_cmd->num_streams);
return -EINVAL;
}
/*validate request*/
for (i = 0; i < update_cmd->num_streams; i++) {
update_info = &update_cmd->update_info[i];

10
drivers/media/platform/msm/camera_v2/msm.c
View file

@ -264,25 +264,25 @@ void msm_delete_stream(unsigned int session_id, unsigned int stream_id)
return;
while (1) {
unsigned long wl_flags;
if (try_count > 5) {
pr_err("%s : not able to delete stream %d\n",
__func__, __LINE__);
break;
}
write_lock(&session->stream_rwlock);
write_lock_irqsave(&session->stream_rwlock, wl_flags);
try_count++;
stream = msm_queue_find(&session->stream_q, struct msm_stream,
list, __msm_queue_find_stream, &stream_id);
if (!stream) {
write_unlock(&session->stream_rwlock);
write_unlock_irqrestore(&session->stream_rwlock, wl_flags);
return;
}
if (msm_vb2_get_stream_state(stream) != 1) {
write_unlock(&session->stream_rwlock);
write_unlock_irqrestore(&session->stream_rwlock, wl_flags);
continue;
}
@ -292,7 +292,7 @@ void msm_delete_stream(unsigned int session_id, unsigned int stream_id)
kfree(stream);
stream = NULL;
spin_unlock_irqrestore(&(session->stream_q.lock), flags);
write_unlock(&session->stream_rwlock);
write_unlock_irqrestore(&session->stream_rwlock, wl_flags);
break;
}

69
drivers/media/platform/msm/camera_v2/msm_vb2/msm_vb2.c
View file

@ -45,22 +45,23 @@ int msm_vb2_buf_init(struct vb2_buffer *vb)
struct msm_stream *stream;
struct msm_session *session;
struct msm_vb2_buffer *msm_vb2_buf;
unsigned long rl_flags;
session = msm_get_session_from_vb2q(vb->vb2_queue);
if (IS_ERR_OR_NULL(session))
return -EINVAL;
read_lock(&session->stream_rwlock);
read_lock_irqsave(&session->stream_rwlock, rl_flags);
stream = msm_get_stream_from_vb2q(vb->vb2_queue);
if (!stream) {
pr_err("%s: Couldn't find stream\n", __func__);
read_unlock(&session->stream_rwlock);
read_unlock_irqrestore(&session->stream_rwlock, rl_flags);
return -EINVAL;
}
msm_vb2_buf = container_of(vb, struct msm_vb2_buffer, vb2_buf);
msm_vb2_buf->in_freeq = 0;
read_unlock(&session->stream_rwlock);
read_unlock_irqrestore(&session->stream_rwlock, rl_flags);
return 0;
}
@ -69,7 +70,7 @@ static void msm_vb2_buf_queue(struct vb2_buffer *vb)
struct msm_vb2_buffer *msm_vb2;
struct msm_stream *stream;
struct msm_session *session;
unsigned long flags;
unsigned long flags, rl_flags;
msm_vb2 = container_of(vb, struct msm_vb2_buffer, vb2_buf);
@ -82,19 +83,19 @@ static void msm_vb2_buf_queue(struct vb2_buffer *vb)
if (IS_ERR_OR_NULL(session))
return;
read_lock(&session->stream_rwlock);
read_lock_irqsave(&session->stream_rwlock, rl_flags);
stream = msm_get_stream_from_vb2q(vb->vb2_queue);
if (!stream) {
pr_err("%s:%d] NULL stream", __func__, __LINE__);
read_unlock(&session->stream_rwlock);
read_unlock_irqrestore(&session->stream_rwlock, rl_flags);
return;
}
spin_lock_irqsave(&stream->stream_lock, flags);
list_add_tail(&msm_vb2->list, &stream->queued_list);
spin_unlock_irqrestore(&stream->stream_lock, flags);
read_unlock(&session->stream_rwlock);
read_unlock_irqrestore(&session->stream_rwlock, rl_flags);
}
static int msm_vb2_buf_finish(struct vb2_buffer *vb)
@ -102,7 +103,7 @@ static int msm_vb2_buf_finish(struct vb2_buffer *vb)
struct msm_vb2_buffer *msm_vb2;
struct msm_stream *stream;
struct msm_session *session;
unsigned long flags;
unsigned long flags, rl_flags;
struct msm_vb2_buffer *msm_vb2_entry, *temp;
msm_vb2 = container_of(vb, struct msm_vb2_buffer, vb2_buf);
@ -116,12 +117,12 @@ static int msm_vb2_buf_finish(struct vb2_buffer *vb)
if (IS_ERR_OR_NULL(session))
return -EINVAL;
read_lock(&session->stream_rwlock);
read_lock_irqsave(&session->stream_rwlock, rl_flags);
stream = msm_get_stream_from_vb2q(vb->vb2_queue);
if (!stream) {
pr_err("%s:%d] NULL stream", __func__, __LINE__);
read_unlock(&session->stream_rwlock);
read_unlock_irqrestore(&session->stream_rwlock, rl_flags);
return -EINVAL;
}
@ -134,7 +135,7 @@ static int msm_vb2_buf_finish(struct vb2_buffer *vb)
}
}
spin_unlock_irqrestore(&stream->stream_lock, flags);
read_unlock(&session->stream_rwlock);
read_unlock_irqrestore(&session->stream_rwlock, rl_flags);
return 0;
}
@ -143,7 +144,7 @@ static void msm_vb2_buf_cleanup(struct vb2_buffer *vb)
struct msm_vb2_buffer *msm_vb2;
struct msm_stream *stream;
struct msm_session *session;
unsigned long flags;
unsigned long flags, rl_flags;
msm_vb2 = container_of(vb, struct msm_vb2_buffer, vb2_buf);
@ -156,19 +157,19 @@ static void msm_vb2_buf_cleanup(struct vb2_buffer *vb)
if (IS_ERR_OR_NULL(session))
return;
read_lock(&session->stream_rwlock);
read_lock_irqsave(&session->stream_rwlock, rl_flags);
stream = msm_get_stream_from_vb2q(vb->vb2_queue);
if (!stream) {
pr_err_ratelimited("%s:%d] NULL stream", __func__, __LINE__);
read_unlock(&session->stream_rwlock);
pr_err("%s:%d] NULL stream", __func__, __LINE__);
read_unlock_irqrestore(&session->stream_rwlock, rl_flags);
return;
}
spin_lock_irqsave(&stream->stream_lock, flags);
INIT_LIST_HEAD(&stream->queued_list);
spin_unlock_irqrestore(&stream->stream_lock, flags);
read_unlock(&session->stream_rwlock);
read_unlock_irqrestore(&session->stream_rwlock, rl_flags);
}
int msm_vb2_get_stream_state(struct msm_stream *stream)
@ -244,17 +245,17 @@ static struct vb2_buffer *msm_vb2_get_buf(int session_id,
struct msm_session *session;
struct vb2_buffer *vb2_buf = NULL;
struct msm_vb2_buffer *msm_vb2 = NULL;
unsigned long flags;
unsigned long flags, rl_flags;
session = msm_get_session(session_id);
if (IS_ERR_OR_NULL(session))
return NULL;
read_lock(&session->stream_rwlock);
read_lock_irqsave(&session->stream_rwlock, rl_flags);
stream = msm_get_stream(session, stream_id);
if (IS_ERR_OR_NULL(stream)) {
read_unlock(&session->stream_rwlock);
read_unlock_irqrestore(&session->stream_rwlock, rl_flags);
return NULL;
}
@ -280,7 +281,7 @@ static struct vb2_buffer *msm_vb2_get_buf(int session_id,
vb2_buf = NULL;
end:
spin_unlock_irqrestore(&stream->stream_lock, flags);
read_unlock(&session->stream_rwlock);
read_unlock_irqrestore(&session->stream_rwlock, rl_flags);
return vb2_buf;
}
@ -292,17 +293,17 @@ static int msm_vb2_put_buf(struct vb2_buffer *vb, int session_id,
struct msm_vb2_buffer *msm_vb2;
struct vb2_buffer *vb2_buf = NULL;
int rc = 0;
unsigned long flags;
unsigned long flags, rl_flags;
session = msm_get_session(session_id);
if (IS_ERR_OR_NULL(session))
return -EINVAL;
read_lock(&session->stream_rwlock);
read_lock_irqsave(&session->stream_rwlock, rl_flags);
stream = msm_get_stream(session, stream_id);
if (IS_ERR_OR_NULL(stream)) {
read_unlock(&session->stream_rwlock);
read_unlock_irqrestore(&session->stream_rwlock, rl_flags);
return -EINVAL;
}
@ -317,7 +318,7 @@ static int msm_vb2_put_buf(struct vb2_buffer *vb, int session_id,
pr_err("VB buffer is INVALID vb=%pK, ses_id=%d, str_id=%d\n",
vb, session_id, stream_id);
spin_unlock_irqrestore(&stream->stream_lock, flags);
read_unlock(&session->stream_rwlock);
read_unlock_irqrestore(&session->stream_rwlock, rl_flags);
return -EINVAL;
}
msm_vb2 =
@ -333,14 +334,14 @@ static int msm_vb2_put_buf(struct vb2_buffer *vb, int session_id,
rc = -EINVAL;
}
spin_unlock_irqrestore(&stream->stream_lock, flags);
read_unlock(&session->stream_rwlock);
read_unlock_irqrestore(&session->stream_rwlock, rl_flags);
return rc;
}
static int msm_vb2_buf_done(struct vb2_buffer *vb, int session_id,
unsigned int stream_id)
{
unsigned long flags;
unsigned long flags, rl_flags;
struct msm_vb2_buffer *msm_vb2;
struct msm_stream *stream;
struct msm_session *session;
@ -351,11 +352,11 @@ static int msm_vb2_buf_done(struct vb2_buffer *vb, int session_id,
if (IS_ERR_OR_NULL(session))
return 0;
read_lock(&session->stream_rwlock);
read_lock_irqsave(&session->stream_rwlock, rl_flags);
stream = msm_get_stream(session, stream_id);
if (IS_ERR_OR_NULL(stream)) {
read_unlock(&session->stream_rwlock);
read_unlock_irqrestore(&session->stream_rwlock, rl_flags);
return -EINVAL;
}
@ -370,7 +371,7 @@ static int msm_vb2_buf_done(struct vb2_buffer *vb, int session_id,
pr_err("VB buffer is INVALID ses_id=%d, str_id=%d, vb=%pK\n",
session_id, stream_id, vb);
spin_unlock_irqrestore(&stream->stream_lock, flags);
read_unlock(&session->stream_rwlock);
read_unlock_irqrestore(&session->stream_rwlock, rl_flags);
return -EINVAL;
}
msm_vb2 =
@ -388,13 +389,13 @@ static int msm_vb2_buf_done(struct vb2_buffer *vb, int session_id,
rc = -EINVAL;
}
spin_unlock_irqrestore(&stream->stream_lock, flags);
read_unlock(&session->stream_rwlock);
read_unlock_irqrestore(&session->stream_rwlock, rl_flags);
return rc;
}
static int msm_vb2_flush_buf(int session_id, unsigned int stream_id)
{
unsigned long flags;
unsigned long flags, rl_flags;
struct msm_vb2_buffer *msm_vb2;
struct msm_session *session;
struct msm_stream *stream;
@ -404,11 +405,11 @@ static int msm_vb2_flush_buf(int session_id, unsigned int stream_id)
if (IS_ERR_OR_NULL(session))
return -EINVAL;
read_lock(&session->stream_rwlock);
read_lock_irqsave(&session->stream_rwlock, rl_flags);
stream = msm_get_stream(session, stream_id);
if (IS_ERR_OR_NULL(stream)) {
read_unlock(&session->stream_rwlock);
read_unlock_irqrestore(&session->stream_rwlock, rl_flags);
return -EINVAL;
}
@ -420,7 +421,7 @@ static int msm_vb2_flush_buf(int session_id, unsigned int stream_id)
msm_vb2->in_freeq = 0;
}
spin_unlock_irqrestore(&stream->stream_lock, flags);
read_unlock(&session->stream_rwlock);
read_unlock_irqrestore(&session->stream_rwlock, rl_flags);
return 0;
}

21
drivers/media/platform/msm/camera_v2/sensor/actuator/msm_actuator.c
View file

@ -145,6 +145,21 @@ static void msm_actuator_parse_i2c_params(struct msm_actuator_ctrl_t *a_ctrl,
uint32_t size = a_ctrl->reg_tbl_size, i = 0;
struct msm_camera_i2c_reg_array *i2c_tbl = a_ctrl->i2c_reg_tbl;
CDBG("Enter\n");
if (a_ctrl == NULL) {
pr_err("failed. actuator ctrl is NULL");
return;
}
if (a_ctrl->i2c_reg_tbl == NULL) {
pr_err("failed. i2c reg tabl is NULL");
return;
}
size = a_ctrl->reg_tbl_size;
write_arr = a_ctrl->reg_tbl;
i2c_tbl = a_ctrl->i2c_reg_tbl;
for (i = 0; i < size; i++) {
if (write_arr[i].reg_write_type == MSM_ACTUATOR_WRITE_DAC) {
value = (next_lens_position <<
@ -1296,9 +1311,11 @@ static int32_t msm_actuator_set_param(struct msm_actuator_ctrl_t *a_ctrl,
if (copy_from_user(&a_ctrl->region_params,
(void *)set_info->af_tuning_params.region_params,
a_ctrl->region_size * sizeof(struct region_params_t)))
a_ctrl->region_size * sizeof(struct region_params_t))) {
a_ctrl->total_steps = 0;
pr_err("Error copying region_params\n");
return -EFAULT;
}
if (a_ctrl->act_device_type == MSM_CAMERA_PLATFORM_DEVICE) {
cci_client = a_ctrl->i2c_client.cci_client;
cci_client->sid =

1
drivers/media/v4l2-core/v4l2-compat-ioctl32.c
View file

@ -844,6 +844,7 @@ static long do_video_ioctl(struct file *file, unsigned int cmd, unsigned long ar
int compatible_arg = 1;
long err = 0;
memset(&karg, 0, sizeof(karg));
/* First, convert the command. */
switch (cmd) {
case VIDIOC_G_FMT32: cmd = VIDIOC_G_FMT; break;

8
drivers/mfd/wcd9xxx-core.c
View file

@ -3001,19 +3001,19 @@ static int wcd9xxx_slim_probe(struct slim_device *slim)
("wcd9xxx_core", 0);
if (!IS_ERR(debugfs_wcd9xxx_dent)) {
debugfs_peek = debugfs_create_file("slimslave_peek",
S_IFREG | S_IRUGO, debugfs_wcd9xxx_dent,
S_IFREG | S_IRUSR, debugfs_wcd9xxx_dent,
(void *) "slimslave_peek", &codec_debug_ops);
debugfs_poke = debugfs_create_file("slimslave_poke",
S_IFREG | S_IRUGO, debugfs_wcd9xxx_dent,
S_IFREG | S_IRUSR, debugfs_wcd9xxx_dent,
(void *) "slimslave_poke", &codec_debug_ops);
debugfs_power_state = debugfs_create_file("power_state",
S_IFREG | S_IRUGO, debugfs_wcd9xxx_dent,
S_IFREG | S_IRUSR, debugfs_wcd9xxx_dent,
(void *) "power_state", &codec_debug_ops);
debugfs_reg_dump = debugfs_create_file("slimslave_reg_dump",
S_IFREG | S_IRUGO, debugfs_wcd9xxx_dent,
S_IFREG | S_IRUSR, debugfs_wcd9xxx_dent,
(void *) "slimslave_reg_dump", &codec_debug_ops);
}
#endif

53
drivers/mmc/core/debugfs.c
View file

@ -443,9 +443,10 @@ static ssize_t mmc_wr_pack_stats_read(struct file *filp, char __user *ubuf,
{
struct mmc_card *card = filp->private_data;
struct mmc_wr_pack_stats *pack_stats;
int i;
int i, ret = 0;
int max_num_of_packed_reqs = 0;
char *temp_buf;
char *temp_buf, *temp_ubuf;
size_t tubuf_cnt = 0;
if (!card)
return cnt;
@ -471,15 +472,24 @@ static ssize_t mmc_wr_pack_stats_read(struct file *filp, char __user *ubuf,
max_num_of_packed_reqs = card->ext_csd.max_packed_writes;
temp_buf = kmalloc(TEMP_BUF_SIZE, GFP_KERNEL);
if (cnt <= (strlen_user(ubuf) + 1))
goto exit;
temp_buf = kzalloc(TEMP_BUF_SIZE, GFP_KERNEL);
if (!temp_buf)
goto exit;
tubuf_cnt = cnt - strlen_user(ubuf) - 1;
temp_ubuf = kzalloc(tubuf_cnt, GFP_KERNEL);
if (!temp_ubuf)
goto cleanup;
spin_lock(&pack_stats->lock);
snprintf(temp_buf, TEMP_BUF_SIZE, "%s: write packing statistics:\n",
mmc_hostname(card->host));
strlcat(ubuf, temp_buf, cnt);
strlcat(temp_ubuf, temp_buf, tubuf_cnt);
for (i = 1 ; i <= max_num_of_packed_reqs ; ++i) {
if (pack_stats->packing_events[i]) {
@ -487,63 +497,63 @@ static ssize_t mmc_wr_pack_stats_read(struct file *filp, char __user *ubuf,
"%s: Packed %d reqs - %d times\n",
mmc_hostname(card->host), i,
pack_stats->packing_events[i]);
strlcat(ubuf, temp_buf, cnt);
strlcat(temp_ubuf, temp_buf, tubuf_cnt);
}
}
snprintf(temp_buf, TEMP_BUF_SIZE,
"%s: stopped packing due to the following reasons:\n",
mmc_hostname(card->host));
strlcat(ubuf, temp_buf, cnt);
strlcat(temp_ubuf, temp_buf, tubuf_cnt);
if (pack_stats->pack_stop_reason[EXCEEDS_SEGMENTS]) {
snprintf(temp_buf, TEMP_BUF_SIZE,
"%s: %d times: exceed max num of segments\n",
mmc_hostname(card->host),
pack_stats->pack_stop_reason[EXCEEDS_SEGMENTS]);
strlcat(ubuf, temp_buf, cnt);
strlcat(temp_ubuf, temp_buf, tubuf_cnt);
}
if (pack_stats->pack_stop_reason[EXCEEDS_SECTORS]) {
snprintf(temp_buf, TEMP_BUF_SIZE,
"%s: %d times: exceed max num of sectors\n",
mmc_hostname(card->host),
pack_stats->pack_stop_reason[EXCEEDS_SECTORS]);
strlcat(ubuf, temp_buf, cnt);
strlcat(temp_ubuf, temp_buf, tubuf_cnt);
}
if (pack_stats->pack_stop_reason[WRONG_DATA_DIR]) {
snprintf(temp_buf, TEMP_BUF_SIZE,
"%s: %d times: wrong data direction\n",
mmc_hostname(card->host),
pack_stats->pack_stop_reason[WRONG_DATA_DIR]);
strlcat(ubuf, temp_buf, cnt);
strlcat(temp_ubuf, temp_buf, tubuf_cnt);
}
if (pack_stats->pack_stop_reason[FLUSH_OR_DISCARD]) {
snprintf(temp_buf, TEMP_BUF_SIZE,
"%s: %d times: flush or discard\n",
mmc_hostname(card->host),
pack_stats->pack_stop_reason[FLUSH_OR_DISCARD]);
strlcat(ubuf, temp_buf, cnt);
strlcat(temp_ubuf, temp_buf, tubuf_cnt);
}
if (pack_stats->pack_stop_reason[EMPTY_QUEUE]) {
snprintf(temp_buf, TEMP_BUF_SIZE,
"%s: %d times: empty queue\n",
mmc_hostname(card->host),
pack_stats->pack_stop_reason[EMPTY_QUEUE]);
strlcat(ubuf, temp_buf, cnt);
strlcat(temp_ubuf, temp_buf, tubuf_cnt);
}
if (pack_stats->pack_stop_reason[REL_WRITE]) {
snprintf(temp_buf, TEMP_BUF_SIZE,
"%s: %d times: rel write\n",
mmc_hostname(card->host),
pack_stats->pack_stop_reason[REL_WRITE]);
strlcat(ubuf, temp_buf, cnt);
strlcat(temp_ubuf, temp_buf, tubuf_cnt);
}
if (pack_stats->pack_stop_reason[THRESHOLD]) {
snprintf(temp_buf, TEMP_BUF_SIZE,
"%s: %d times: Threshold\n",
mmc_hostname(card->host),
pack_stats->pack_stop_reason[THRESHOLD]);
strlcat(ubuf, temp_buf, cnt);
strlcat(temp_ubuf, temp_buf, tubuf_cnt);
}
if (pack_stats->pack_stop_reason[LARGE_SEC_ALIGN]) {
@ -551,25 +561,36 @@ static ssize_t mmc_wr_pack_stats_read(struct file *filp, char __user *ubuf,
"%s: %d times: Large sector alignment\n",
mmc_hostname(card->host),
pack_stats->pack_stop_reason[LARGE_SEC_ALIGN]);
strlcat(ubuf, temp_buf, cnt);
strlcat(temp_ubuf, temp_buf, tubuf_cnt);
}
if (pack_stats->pack_stop_reason[RANDOM]) {
snprintf(temp_buf, TEMP_BUF_SIZE,
"%s: %d times: random request\n",
mmc_hostname(card->host),
pack_stats->pack_stop_reason[RANDOM]);
strlcat(ubuf, temp_buf, cnt);
strlcat(temp_ubuf, temp_buf, tubuf_cnt);
}
if (pack_stats->pack_stop_reason[FUA]) {
snprintf(temp_buf, TEMP_BUF_SIZE,
"%s: %d times: fua request\n",
mmc_hostname(card->host),
pack_stats->pack_stop_reason[FUA]);
strlcat(ubuf, temp_buf, cnt);
strlcat(temp_ubuf, temp_buf, tubuf_cnt);
}
if (strlen_user(ubuf) < cnt - strlen(temp_ubuf))
ret = copy_to_user((ubuf + strlen_user(ubuf)),
temp_ubuf, tubuf_cnt);
else
ret = -EFAULT;
if (ret)
pr_err("%s: %s: Copy to userspace failed: %s\n",
mmc_hostname(card->host), __func__, ubuf);
spin_unlock(&pack_stats->lock);
kfree(temp_ubuf);
cleanup:
kfree(temp_buf);
pr_info("%s", ubuf);

3
drivers/net/wireless/ath/wil6210/cfg80211.c
View file

@ -527,6 +527,9 @@ int wil_cfg80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
struct wmi_sw_tx_complete_event evt;
} __packed evt;
if (len < sizeof(struct ieee80211_mgmt))
return -EINVAL;
cmd = kmalloc(sizeof(*cmd) + len, GFP_KERNEL);
if (!cmd) {
rc = -ENOMEM;

6
drivers/net/wireless/ath/wil6210/debugfs.c
View file

@ -705,8 +705,12 @@ static ssize_t wil_write_file_txmgmt(struct file *file, const char __user *buf,
struct wiphy *wiphy = wil_to_wiphy(wil);
struct wireless_dev *wdev = wil_to_wdev(wil);
int rc;
void *frame = kmalloc(len, GFP_KERNEL);
void *frame;
if (!len)
return -EINVAL;
frame = kmalloc(len, GFP_KERNEL);
if (!frame)
return -ENOMEM;

16
drivers/net/wireless/wcnss/wcnss_wlan.c
View file

@ -2043,21 +2043,23 @@ void extract_cal_data(int len)
return;
}
mutex_lock(&penv->dev_lock);
rc = smd_read(penv->smd_ch, (unsigned char *)&calhdr,
sizeof(struct cal_data_params));
if (rc < sizeof(struct cal_data_params)) {
pr_err("wcnss: incomplete cal header read from smd\n");
mutex_unlock(&penv->dev_lock);
return;
}
if (penv->fw_cal_exp_frag != calhdr.frag_number) {
pr_err("wcnss: Invalid frgament");
goto exit;
goto unlock_exit;
}
if (calhdr.frag_size > WCNSS_MAX_FRAME_SIZE) {
pr_err("wcnss: Invalid fragment size");
goto exit;
goto unlock_exit;
}
if (penv->fw_cal_available) {
@ -2066,8 +2068,9 @@ void extract_cal_data(int len)
penv->fw_cal_exp_frag++;
if (calhdr.msg_flags & LAST_FRAGMENT) {
penv->fw_cal_exp_frag = 0;
goto exit;
goto unlock_exit;
}
mutex_unlock(&penv->dev_lock);
return;
}
@ -2075,7 +2078,7 @@ void extract_cal_data(int len)
if (calhdr.total_size > MAX_CALIBRATED_DATA_SIZE) {
pr_err("wcnss: Invalid cal data size %d",
calhdr.total_size);
goto exit;
goto unlock_exit;
}
kfree(penv->fw_cal_data);
penv->fw_cal_rcvd = 0;
@ -2083,11 +2086,10 @@ void extract_cal_data(int len)
GFP_KERNEL);
if (penv->fw_cal_data == NULL) {
smd_read(penv->smd_ch, NULL, calhdr.frag_size);
goto exit;
goto unlock_exit;
}
}
mutex_lock(&penv->dev_lock);
if (penv->fw_cal_rcvd + calhdr.frag_size >
MAX_CALIBRATED_DATA_SIZE) {
pr_err("calibrated data size is more than expected %d",
@ -2122,8 +2124,6 @@ void extract_cal_data(int len)
unlock_exit:
mutex_unlock(&penv->dev_lock);
exit:
wcnss_send_cal_rsp(fw_status);
return;
}

3
drivers/platform/msm/ipa/ipa_hdr.c
View file

@ -580,7 +580,8 @@ ipa_insert_failed:
list_del(&entry->link);
htbl->proc_ctx_cnt--;
bad_len:
hdr_entry->ref_cnt--;
if (add_ref_hdr)
hdr_entry->ref_cnt--;
entry->cookie = 0;
kmem_cache_free(ipa_ctx->hdr_proc_ctx_cache, entry);
return -EPERM;

15
drivers/platform/msm/ipa/ipa_rt.c
View file

@ -1,4 +1,4 @@
/* Copyright (c) 2012-2015, The Linux Foundation. All rights reserved.
/* Copyright (c) 2012-2017, The Linux Foundation. All rights reserved.
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License version 2 and
@ -53,7 +53,7 @@ int __ipa_generate_rt_hw_rule_v2(enum ipa_ip_type ip,
int pipe_idx;
if (buf == NULL) {
memset(tmp, 0, IPA_RT_FLT_HW_RULE_BUF_SIZE);
memset(tmp, 0, (IPA_RT_FLT_HW_RULE_BUF_SIZE/4));
buf = (u8 *)tmp;
}
@ -75,8 +75,15 @@ int __ipa_generate_rt_hw_rule_v2(enum ipa_ip_type ip,
rule_hdr->u.hdr.pipe_dest_idx = pipe_idx;
rule_hdr->u.hdr.system = !ipa_ctx->hdr_tbl_lcl;
if (entry->hdr) {
rule_hdr->u.hdr.hdr_offset =
entry->hdr->offset_entry->offset >> 2;
if (entry->hdr->cookie == IPA_HDR_COOKIE) {
rule_hdr->u.hdr.hdr_offset =
entry->hdr->offset_entry->offset >> 2;
} else {
IPAERR("Entry hdr deleted by user = %d cookie = %u\n",
entry->hdr->user_deleted, entry->hdr->cookie);
WARN_ON(1);
rule_hdr->u.hdr.hdr_offset = 0;
}
} else {
rule_hdr->u.hdr.hdr_offset = 0;
}

10
drivers/platform/msm/ipa/rmnet_ipa.c
View file

@ -394,12 +394,15 @@ int copy_ul_filter_rule_to_ipa(struct ipa_install_fltr_rule_req_msg_v01
{
int i, j;
/* prevent multi-threads accessing num_q6_rule */
mutex_lock(&add_mux_channel_lock);
if (rule_req->filter_spec_list_valid == true) {
num_q6_rule = rule_req->filter_spec_list_len;
IPAWANDBG("Received (%d) install_flt_req\n", num_q6_rule);
} else {
num_q6_rule = 0;
IPAWANERR("got no UL rules from modem\n");
mutex_unlock(&add_mux_channel_lock);
return -EINVAL;
}
@ -593,9 +596,11 @@ failure:
num_q6_rule = 0;
memset(ipa_qmi_ctx->q6_ul_filter_rule, 0,
sizeof(ipa_qmi_ctx->q6_ul_filter_rule));
mutex_unlock(&add_mux_channel_lock);
return -EINVAL;
success:
mutex_unlock(&add_mux_channel_lock);
return 0;
}
@ -1382,6 +1387,8 @@ static int ipa_wwan_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
mutex_unlock(&add_mux_channel_lock);
return -EFAULT;
}
extend_ioctl_data.u.rmnet_mux_val.vchannel_name
[IFNAMSIZ-1] = '\0';
IPAWANDBG("ADD_MUX_CHANNEL(%d, name: %s)\n",
extend_ioctl_data.u.rmnet_mux_val.mux_id,
extend_ioctl_data.u.rmnet_mux_val.vchannel_name);
@ -1463,6 +1470,8 @@ static int ipa_wwan_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
IPAWANERR("failed to config egress endpoint\n");
if (num_q6_rule != 0) {
/* protect num_q6_rule */
mutex_lock(&add_mux_channel_lock);
/* already got Q6 UL filter rules*/
if (ipa_qmi_ctx &&
ipa_qmi_ctx->modem_cfg_emb_pipe_flt
@ -1470,6 +1479,7 @@ static int ipa_wwan_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
rc = wwan_add_ul_flt_rule_to_ipa();
else
rc = 0;
mutex_unlock(&add_mux_channel_lock);
egress_set = true;
if (rc)
IPAWANERR("install UL rules failed\n");

9
drivers/power/qcom/msm-core.c
View file

@ -1,4 +1,4 @@
/* Copyright (c) 2014-2015, The Linux Foundation. All rights reserved.
/* Copyright (c) 2014-2017, The Linux Foundation. All rights reserved.
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License version 2 and
@ -380,9 +380,10 @@ static int update_userspace_power(struct sched_params __user *argp)
if (!sp)
return -ENOMEM;
mutex_lock(&policy_update_mutex);
sp->power = allocate_2d_array_uint32_t(node->sp->num_of_freqs);
if (IS_ERR_OR_NULL(sp->power)) {
mutex_unlock(&policy_update_mutex);
ret = PTR_ERR(sp->power);
kfree(sp);
return ret;
@ -401,8 +402,8 @@ static int update_userspace_power(struct sched_params __user *argp)
/* Copy the same power values for all the cpus in the cpumask
* argp->cpumask within the cluster (argp->cluster)
*/
get_user(cpumask, &argp->cpumask);
spin_lock(&update_lock);
get_user(cpumask, &argp->cpumask);
for (i = 0; i < MAX_CORES_PER_CLUSTER; i++, cpumask >>= 1) {
if (!(cpumask & 0x01))
continue;
@ -425,11 +426,13 @@ static int update_userspace_power(struct sched_params __user *argp)
}
}
spin_unlock(&update_lock);
mutex_unlock(&policy_update_mutex);
activate_power_table = true;
return 0;
failed:
mutex_unlock(&policy_update_mutex);
for (i = 0; i < TEMP_DATA_POINTS; i++)
kfree(sp->power[i]);
kfree(sp->power);

14
drivers/scsi/ufs/qcom-debugfs.c
View file

@ -1,5 +1,5 @@
/*
* Copyright (c) 2015, Linux Foundation. All rights reserved.
* Copyright (c) 2015,2017, Linux Foundation. All rights reserved.
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License version 2 and
@ -104,12 +104,14 @@ static ssize_t ufs_qcom_dbg_testbus_cfg_write(struct file *file,
loff_t *ppos)
{
struct ufs_qcom_host *host = file->f_mapping->host->i_private;
char configuration[TESTBUS_CFG_BUFF_LINE_SIZE] = {0};
char configuration[TESTBUS_CFG_BUFF_LINE_SIZE] = {'\0'};
loff_t buff_pos = 0;
char *comma;
int ret = 0;
int major;
int minor;
unsigned long flags;
struct ufs_hba *hba = host->hba;
cnt = simple_write_to_buffer(configuration, TESTBUS_CFG_BUFF_LINE_SIZE,
&buff_pos, ubuf, cnt);
@ -118,6 +120,7 @@ static ssize_t ufs_qcom_dbg_testbus_cfg_write(struct file *file,
__func__);
goto out;
}
configuration[cnt] = '\0';
comma = strnchr(configuration, TESTBUS_CFG_BUFF_LINE_SIZE, ',');
if (!comma || comma == configuration) {
@ -135,8 +138,15 @@ static ssize_t ufs_qcom_dbg_testbus_cfg_write(struct file *file,
goto out;
}
if (!ufs_qcom_testbus_cfg_is_ok(host, major, minor)) {
ret = -EPERM;
goto out;
}
spin_lock_irqsave(hba->host->host_lock, flags);
host->testbus.select_major = (u8)major;
host->testbus.select_minor = (u8)minor;
spin_unlock_irqrestore(hba->host->host_lock, flags);
/*
* Sanity check of the {major, minor} tuple is done in the

42
drivers/scsi/ufs/ufs-qcom.c
View file

@ -1,5 +1,5 @@
/*
* Copyright (c) 2013-2015, Linux Foundation. All rights reserved.
* Copyright (c) 2013-2017, Linux Foundation. All rights reserved.
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License version 2 and
@ -1488,12 +1488,13 @@ static void ufs_qcom_get_default_testbus_cfg(struct ufs_qcom_host *host)
host->testbus.select_minor = 1;
}
static bool ufs_qcom_testbus_cfg_is_ok(struct ufs_qcom_host *host)
bool ufs_qcom_testbus_cfg_is_ok(struct ufs_qcom_host *host,
u8 select_major, u8 select_minor)
{
if (host->testbus.select_major >= TSTBUS_MAX) {
if (select_major >= TSTBUS_MAX) {
dev_err(host->hba->dev,
"%s: UFS_CFG1[TEST_BUS_SEL} may not equal 0x%05X\n",
__func__, host->testbus.select_major);
__func__, select_major);
return false;
}
@ -1502,10 +1503,10 @@ static bool ufs_qcom_testbus_cfg_is_ok(struct ufs_qcom_host *host)
* mappings of select_minor, since there is no harm in
* configuring a non-existent select_minor
*/
if (host->testbus.select_major > 0x1F) {
if (select_minor > 0x1F) {
dev_err(host->hba->dev,
"%s: 0x%05X is not a legal testbus option\n",
__func__, host->testbus.select_minor);
__func__, select_minor);
return false;
}
@ -1514,16 +1515,16 @@ static bool ufs_qcom_testbus_cfg_is_ok(struct ufs_qcom_host *host)
int ufs_qcom_testbus_config(struct ufs_qcom_host *host)
{
int reg;
int offset;
int reg = 0;
int offset, ret = 0, testbus_sel_offset = 19;
u32 mask = TEST_BUS_SUB_SEL_MASK;
unsigned long flags;
struct ufs_hba *hba;
if (!host)
return -EINVAL;
if (!ufs_qcom_testbus_cfg_is_ok(host))
return -EPERM;
hba = host->hba;
spin_lock_irqsave(hba->host->host_lock, flags);
switch (host->testbus.select_major) {
case TSTBUS_UAWM:
reg = UFS_TEST_BUS_CTRL_0;
@ -1580,21 +1581,28 @@ int ufs_qcom_testbus_config(struct ufs_qcom_host *host)
*/
}
mask <<= offset;
spin_unlock_irqrestore(hba->host->host_lock, flags);
ufshcd_hold(host->hba, false);
pm_runtime_get_sync(host->hba->dev);
ufshcd_rmwl(host->hba, TEST_BUS_SEL,
(u32)host->testbus.select_major << 19,
if (reg) {
ufshcd_rmwl(host->hba, TEST_BUS_SEL,
(u32)host->testbus.select_major << testbus_sel_offset,
REG_UFS_CFG1);
ufshcd_rmwl(host->hba, mask,
ufshcd_rmwl(host->hba, mask,
(u32)host->testbus.select_minor << offset,
reg);
} else {
dev_err(hba->dev, "%s: Problem setting minor\n", __func__);
ret = -EINVAL;
goto out;
}
ufs_qcom_enable_test_bus(host);
out:
pm_runtime_put_sync(host->hba->dev);
ufshcd_release(host->hba, false);
return 0;
return ret;
}
static void ufs_qcom_testbus_read(struct ufs_hba *hba)

1
drivers/soc/qcom/qdsp6v2/apr.c
View file

@ -753,6 +753,7 @@ void dispatch_event(unsigned long code, uint16_t proc)
uint16_t clnt;
int i, j;
memset(&data, 0, sizeof(data));
data.opcode = RESET_EVENTS;
data.reset_event = code;

7
include/linux/scsi/ufs/ufs-qcom.h
View file

@ -1,4 +1,4 @@
/* Copyright (c) 2013-2015, The Linux Foundation. All rights reserved.
/* Copyright (c) 2013-2017, The Linux Foundation. All rights reserved.
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License version 2 and
@ -84,7 +84,7 @@ enum {
/* bit definitions for REG_UFS_CFG1 register */
#define TEST_BUS_EN BIT(18)
#define TEST_BUS_SEL GENMASK(22, 19)
#define TEST_BUS_SEL 0x780000
/* bit definitions for REG_UFS_CFG2 register */
#define UAWM_HW_CGC_EN (1 << 0)
@ -253,7 +253,8 @@ struct ufs_qcom_host {
#define ufs_qcom_is_link_off(hba) ufshcd_is_link_off(hba)
#define ufs_qcom_is_link_active(hba) ufshcd_is_link_active(hba)
#define ufs_qcom_is_link_hibern8(hba) ufshcd_is_link_hibern8(hba)
bool ufs_qcom_testbus_cfg_is_ok(struct ufs_qcom_host *host,
u8 select_major, u8 select_minor);
int ufs_qcom_testbus_config(struct ufs_qcom_host *host);
void ufs_qcom_print_hw_debug_reg_all(struct ufs_hba *hba, void *priv,
void (*print_fn)(struct ufs_hba *hba, int offset, int num_regs,

1
net/dccp/ipv6.c
View file

@ -561,7 +561,6 @@ static struct sock *dccp_v6_request_recv_sock(struct sock *sk,
/* Clone RX bits */
newnp->rxopt.all = np->rxopt.all;
/* Clone pktoptions received with SYN */
newnp->ipv6_mc_list = NULL;
newnp->ipv6_ac_list = NULL;
newnp->ipv6_fl_list = NULL;

1
net/rmnet_data/rmnet_data_handlers.c
View file

@ -336,6 +336,7 @@ static rx_handler_result_t _rmnet_map_ingress_handler(struct sk_buff *skb,
else if (ckresult != RMNET_MAP_CHECKSUM_ERR_UNKNOWN_IP_VERSION
&& ckresult != RMNET_MAP_CHECKSUM_ERR_UNKNOWN_TRANSPORT
&& ckresult != RMNET_MAP_CHECKSUM_VALID_FLAG_NOT_SET
&& ckresult != RMNET_MAP_CHECKSUM_VALIDATION_FAILED
&& ckresult != RMNET_MAP_CHECKSUM_FRAGMENTED_PACKET) {
rmnet_kfree_skb(skb,
RMNET_STATS_SKBFREE_INGRESS_BAD_MAP_CKSUM);

32
sound/soc/msm/qdsp6v2/rtac.c
View file

@ -863,6 +863,14 @@ u32 send_adm_apr(void *buf, u32 opcode)
bytes_returned = ((u32 *)rtac_cal[ADM_RTAC_CAL].cal_data.
kvaddr)[2] + 3 * sizeof(u32);
if (bytes_returned > rtac_cal[ADM_RTAC_CAL].
map_data.map_size) {
pr_err("%s: Invalid data size = %d\n",
__func__, bytes_returned);
result = -EINVAL;
goto err;
}
if (bytes_returned > user_buf_size) {
pr_err("%s: User buf not big enough, size = 0x%x, returned size = 0x%x\n",
__func__, user_buf_size, bytes_returned);
@ -1084,6 +1092,14 @@ u32 send_rtac_asm_apr(void *buf, u32 opcode)
bytes_returned = ((u32 *)rtac_cal[ASM_RTAC_CAL].cal_data.
kvaddr)[2] + 3 * sizeof(u32);
if (bytes_returned > rtac_cal[ASM_RTAC_CAL].
map_data.map_size) {
pr_err("%s: Invalid data size = %d\n",
__func__, bytes_returned);
result = -EINVAL;
goto err;
}
if (bytes_returned > user_buf_size) {
pr_err("%s: User buf not big enough, size = 0x%x, returned size = 0x%x\n",
__func__, user_buf_size, bytes_returned);
@ -1343,6 +1359,14 @@ static u32 send_rtac_afe_apr(void *buf, uint32_t opcode)
bytes_returned = get_resp->param_size +
sizeof(struct afe_port_param_data_v2);
if (bytes_returned > rtac_cal[AFE_RTAC_CAL].
map_data.map_size) {
pr_err("%s: Invalid data size = %d\n",
__func__, bytes_returned);
result = -EINVAL;
goto err;
}
if (bytes_returned > user_afe_buf.buf_size) {
pr_err("%s: user size = 0x%x, returned size = 0x%x\n",
__func__, user_afe_buf.buf_size,
@ -1564,6 +1588,14 @@ u32 send_voice_apr(u32 mode, void *buf, u32 opcode)
bytes_returned = ((u32 *)rtac_cal[VOICE_RTAC_CAL].cal_data.
kvaddr)[2] + 3 * sizeof(u32);
if (bytes_returned > rtac_cal[VOICE_RTAC_CAL].
map_data.map_size) {
pr_err("%s: Invalid data size = %d\n",
__func__, bytes_returned);
result = -EINVAL;
goto err;
}
if (bytes_returned > user_buf_size) {
pr_err("%s: User buf not big enough, size = 0x%x, returned size = 0x%x\n",
__func__, user_buf_size, bytes_returned);