Merge tag 'LA.UM.9.15.r1-06000-KAMORTA.QSSI13.0' of https://git.codel…

…inaro.org/clo/la/kernel/msm-4.19 into main

"LA.UM.9.15.r1-06000-KAMORTA.QSSI13.0"

* tag 'LA.UM.9.15.r1-06000-KAMORTA.QSSI13.0' of https://git.codelinaro.org/clo/la/kernel/msm-4.19: (54 commits)
  msm: kgsl: Use copy_struct_from_user() helper
  msm: ADSPRPC: Update unsigned pd support on cDSP from kernel
  dfc: bearer based QMAP powersave
  BACKPORT: dmabuf: fix use-after-free of dmabuf's file->f_inode
  sched: Improve the scheduler
  lib: introduce copy_struct_from_user() helper
  fbdev: msm: check for valid fence before using objects
  msm:ipa3: Fixed pointer dereference issue without checking for null
  msm: kgsl: Assign a default value to the variable ret
  msm: kgsl: Remove unnecessary NULL checks
  diag: Use correct size while reallocating for hdlc encoding
  msm: synx: release reference holding the lock
  sched: walt: Improve the scheduler
  tasks, sched/core: Ensure tasks are available for a grace period after leaving the runqueue
  tasks: Add a count of task RCU users
  usb: misc: Add snapshot of diag_ipc_bridge driver
  usb: misc: ks_bridge: Add snapshot of ks_bridge driver
  msm: adsprpc: Wait for actual shutdown to complete
  defconfig: msm: Enable LED for QCS2290
  qseecom : qseecom_scale_bus_bandwidth doesn't check the negative mode
  ...

Signed-off-by: Carlos Jimenez (JavaShin-X) <[email protected]>

arch/arm/configs/vendor/bengal-perf_defconfig

@@ -448,6 +448,7 @@ CONFIG_NEW_LEDS=y
 CONFIG_LEDS_CLASS=y
 CONFIG_LEDS_CLASS_FLASH=y
 CONFIG_LEDS_QTI_FLASH=y
+CONFIG_LEDS_GPIO=y
 CONFIG_LEDS_PWM=y
 CONFIG_LEDS_QTI_TRI_LED=y
 CONFIG_LEDS_QPNP_FLASH_V2=y

arch/arm/configs/vendor/bengal_defconfig

@@ -486,6 +486,7 @@ CONFIG_NEW_LEDS=y
 CONFIG_LEDS_CLASS=y
 CONFIG_LEDS_CLASS_FLASH=y
 CONFIG_LEDS_QTI_FLASH=y
+CONFIG_LEDS_GPIO=y
 CONFIG_LEDS_PWM=y
 CONFIG_LEDS_QTI_TRI_LED=y
 CONFIG_LEDS_QPNP_FLASH_V2=y

arch/arm/configs/vendor/msm8937-perf_defconfig

@@ -611,6 +611,7 @@ CONFIG_ANDROID=y
 CONFIG_ANDROID_BINDER_IPC=y
 CONFIG_ANDROID_BINDERFS=y
 CONFIG_QCOM_QFPROM=y
+CONFIG_NVMEM_SPMI_SDAM=y
 CONFIG_SLIMBUS_MSM_NGD=y
 CONFIG_SENSORS_SSC=y
 CONFIG_QCOM_KGSL=y

arch/arm/configs/vendor/msm8937_32go-perf_defconfig

@@ -601,6 +601,7 @@ CONFIG_ANDROID=y
 CONFIG_ANDROID_BINDER_IPC=y
 CONFIG_ANDROID_BINDERFS=y
 CONFIG_QCOM_QFPROM=y
+CONFIG_NVMEM_SPMI_SDAM=y
 CONFIG_SLIMBUS_MSM_NGD=y
 CONFIG_SENSORS_SSC=y
 CONFIG_QCOM_KGSL=y

arch/arm/configs/vendor/msm8937_32go_defconfig

@@ -616,6 +616,7 @@ CONFIG_ANDROID=y
 CONFIG_ANDROID_BINDER_IPC=y
 CONFIG_ANDROID_BINDERFS=y
 CONFIG_QCOM_QFPROM=y
+CONFIG_NVMEM_SPMI_SDAM=y
 CONFIG_SLIMBUS_MSM_NGD=y
 CONFIG_SENSORS_SSC=y
 CONFIG_QCOM_KGSL=y

arch/arm/configs/vendor/msm8937_defconfig

@@ -624,6 +624,7 @@ CONFIG_ANDROID=y
 CONFIG_ANDROID_BINDER_IPC=y
 CONFIG_ANDROID_BINDERFS=y
 CONFIG_QCOM_QFPROM=y
+CONFIG_NVMEM_SPMI_SDAM=y
 CONFIG_SLIMBUS_MSM_NGD=y
 CONFIG_SENSORS_SSC=y
 CONFIG_QCOM_KGSL=y

arch/arm/mm/iomap.c

@@ -35,8 +35,7 @@ EXPORT_SYMBOL(pcibios_min_mem);
 
 void pci_iounmap(struct pci_dev *dev, void __iomem *addr)
 {
-	if ((unsigned long)addr >= VMALLOC_START &&
-	    (unsigned long)addr < VMALLOC_END)
+	if (is_vmalloc_addr(addr))
 		iounmap(addr);
 }
 EXPORT_SYMBOL(pci_iounmap);

arch/arm/mm/ioremap.c

@@ -119,10 +119,17 @@ void __check_vmalloc_seq(struct mm_struct *mm)
 
 	do {
 		seq = init_mm.context.vmalloc_seq;
+#ifdef CONFIG_ENABLE_VMALLOC_SAVING
+		memcpy(pgd_offset(mm, PAGE_OFFSET),
+				pgd_offset_k(PAGE_OFFSET),
+				sizeof(pgd_t) * (pgd_index(VMALLOC_END) -
+					pgd_index(PAGE_OFFSET)));
+#else
 		memcpy(pgd_offset(mm, VMALLOC_START),
 		       pgd_offset_k(VMALLOC_START),
 		       sizeof(pgd_t) * (pgd_index(VMALLOC_END) -
 					pgd_index(VMALLOC_START)));
+#endif
 		mm->context.vmalloc_seq = seq;
 	} while (seq != init_mm.context.vmalloc_seq);
 }

arch/arm64/configs/vendor/kona-iot-perf_defconfig

@@ -479,6 +479,7 @@ CONFIG_USB_CONFIGFS_MASS_STORAGE=y
 CONFIG_USB_CONFIGFS_F_FS=y
 CONFIG_USB_CONFIGFS_F_ACC=y
 CONFIG_USB_CONFIGFS_F_AUDIO_SRC=y
+CONFIG_USB_CONFIGFS_F_UAC1=y
 CONFIG_USB_CONFIGFS_F_UAC2=y
 CONFIG_USB_CONFIGFS_F_MIDI=y
 CONFIG_USB_CONFIGFS_F_HID=y

arch/arm64/configs/vendor/kona-iot_defconfig

@@ -496,6 +496,7 @@ CONFIG_USB_CONFIGFS_MASS_STORAGE=y
 CONFIG_USB_CONFIGFS_F_FS=y
 CONFIG_USB_CONFIGFS_F_ACC=y
 CONFIG_USB_CONFIGFS_F_AUDIO_SRC=y
+CONFIG_USB_CONFIGFS_F_UAC1=y
 CONFIG_USB_CONFIGFS_F_UAC2=y
 CONFIG_USB_CONFIGFS_F_MIDI=y
 CONFIG_USB_CONFIGFS_F_HID=y

arch/arm64/configs/vendor/kona-perf_defconfig

@@ -263,6 +263,8 @@ CONFIG_QRTR_SMD=y
 CONFIG_QRTR_MHI=y
 CONFIG_BPF_JIT=y
 CONFIG_SOCKEV_NLMCAST=y
+CONFIG_CAN=y
+CONFIG_CAN_MCP25XXFD=y
 CONFIG_BT=y
 CONFIG_MSM_BT_POWER=y
 CONFIG_BT_SLIM_QCA6390=y

drivers/char/adsprpc.c

@@ -484,6 +484,7 @@ struct fastrpc_file {
 	int debug_buf_alloced_attempted;
 	/* Flag to indicate dynamic process creation status*/
 	bool in_process_create;
+	struct completion shutdown;
 };
 
 static struct fastrpc_apps gfa;
@@ -1846,7 +1847,8 @@ static int get_args(uint32_t kernel, struct smq_invoke_ctx *ctx)
 				}
 				offset = buf_page_start(buf) - vma->vm_start;
 				up_read(&current->mm->mmap_sem);
-				VERIFY(err, offset < (uintptr_t)map->size);
+				VERIFY(err,
+					offset + len <= (uintptr_t)map->size);
 				if (err)
 					goto bail;
 			}
@@ -2971,8 +2973,10 @@ static int fastrpc_release_current_dsp_process(struct fastrpc_file *fl)
 	if (err)
 		goto bail;
 	VERIFY(err, fl->apps->channel[fl->cid].issubsystemup == 1);
-	if (err)
+	if (err) {
+		wait_for_completion(&fl->shutdown);
 		goto bail;
+	}
 	tgid = fl->tgid;
 	ra[0].buf.pv = (void *)&tgid;
 	ra[0].buf.len = sizeof(tgid);
@@ -4129,6 +4133,7 @@ static int fastrpc_device_open(struct inode *inode, struct file *filp)
 	hlist_add_head(&fl->hn, &me->drivers);
 	spin_unlock(&me->hlock);
 	mutex_init(&fl->perf_mutex);
+	init_completion(&fl->shutdown);
 	return 0;
 }
 
@@ -4432,6 +4437,27 @@ static int fastrpc_get_dsp_info(struct fastrpc_ioctl_dsp_capabilities *dsp_cap,
 	return err;
 }
 
+static int fastrpc_update_cdsp_support(struct fastrpc_file *fl)
+{
+	struct fastrpc_ioctl_dsp_capabilities *dsp_query;
+	struct fastrpc_apps *me = &gfa;
+	int err = 0;
+
+	VERIFY(err, NULL != (dsp_query = kzalloc(sizeof(*dsp_query),
+				GFP_KERNEL)));
+	if (err)
+		goto bail;
+	dsp_query->domain = CDSP_DOMAIN_ID;
+	err = fastrpc_get_info_from_kernel(dsp_query, fl);
+	if (err)
+		goto bail;
+	if (!(dsp_query->dsp_attributes[1]))
+		me->channel[CDSP_DOMAIN_ID].unsigned_support = false;
+bail:
+	kfree(dsp_query);
+	return err;
+}
+
 static long fastrpc_device_ioctl(struct file *file, unsigned int ioctl_num,
 				 unsigned long ioctl_param)
 {
@@ -4455,6 +4481,7 @@ static long fastrpc_device_ioctl(struct file *file, unsigned int ioctl_num,
 	struct fastrpc_file *fl = (struct fastrpc_file *)file->private_data;
 	int size = 0, err = 0;
 	uint32_t info;
+	static bool isquerydone;
 
 	p.inv.fds = NULL;
 	p.inv.attrs = NULL;
@@ -4596,6 +4623,10 @@ static long fastrpc_device_ioctl(struct file *file, unsigned int ioctl_num,
 		VERIFY(err, 0 == (err = fastrpc_init_process(fl, &p.init)));
 		if (err)
 			goto bail;
+		if ((fl->cid == CDSP_DOMAIN_ID) && !isquerydone) {
+			if (!fastrpc_update_cdsp_support(fl))
+				isquerydone = true;
+		}
 		break;
 	case FASTRPC_IOCTL_GET_DSP_INFO:
 		err = fastrpc_get_dsp_info(&p.dsp_cap, param, fl);
@@ -4614,6 +4645,8 @@ static int fastrpc_restart_notifier_cb(struct notifier_block *nb,
 {
 	struct fastrpc_apps *me = &gfa;
 	struct fastrpc_channel_ctx *ctx;
+	struct fastrpc_file *fl;
+	struct hlist_node *n;
 	struct notif_data *notifdata = (struct notif_data *)data;
 	int cid = -1;
 
@@ -4626,6 +4659,16 @@ static int fastrpc_restart_notifier_cb(struct notifier_block *nb,
 		ctx->ssrcount++;
 		ctx->issubsystemup = 0;
 		mutex_unlock(&me->channel[cid].smd_mutex);
+	} else if (code == SUBSYS_AFTER_SHUTDOWN) {
+		pr_info("adsprpc: %s: %s subsystem is down\n",
+			__func__, gcinfo[cid].subsys);
+		spin_lock(&me->hlock);
+		hlist_for_each_entry_safe(fl, n, &me->drivers, hn) {
+			if (fl->cid != cid)
+				continue;
+			complete(&fl->shutdown);
+		}
+		spin_unlock(&me->hlock);
 	} else if (code == SUBSYS_RAMDUMP_NOTIFICATION) {
 		if (cid == RH_CID) {
 			if (me->ramdump_handle)

drivers/char/adsprpc_compat.c

@@ -156,20 +156,16 @@ struct compat_fastrpc_ioctl_dsp_capabilities {
 static int compat_get_fastrpc_ioctl_invoke(
 			struct compat_fastrpc_ioctl_invoke_crc __user *inv32,
 			struct fastrpc_ioctl_invoke_crc __user **inva,
-			unsigned int cmd)
+			unsigned int cmd, unsigned int sc)
 {
-	compat_uint_t u, sc;
+	compat_uint_t u;
 	compat_size_t s;
 	compat_uptr_t p;
 	struct fastrpc_ioctl_invoke_crc *inv;
 	union compat_remote_arg *pra32;
 	union remote_arg *pra;
 	int err, len, j;
 
-	err = get_user(sc, &inv32->inv.sc);
-	if (err)
-		return err;
-
 	len = REMOTE_SCALARS_LENGTH(sc);
 	VERIFY(err, NULL != (inv = compat_alloc_user_space(
 				sizeof(*inv) + len * sizeof(*pra))));
@@ -513,6 +509,7 @@ long compat_fastrpc_device_ioctl(struct file *filp, unsigned int cmd,
 				unsigned long arg)
 {
 	int err = 0;
+	compat_uint_t sc;
 
 	if (!filp->f_op || !filp->f_op->unlocked_ioctl)
 		return -ENOTTY;
@@ -526,9 +523,13 @@ long compat_fastrpc_device_ioctl(struct file *filp, unsigned int cmd,
 		struct compat_fastrpc_ioctl_invoke_crc __user *inv32;
 		struct fastrpc_ioctl_invoke_crc __user *inv;
 
+		err = get_user(sc, &inv32->inv.sc);
+		if (err)
+			return err;
+
 		inv32 = compat_ptr(arg);
 		VERIFY(err, 0 == compat_get_fastrpc_ioctl_invoke(inv32,
-							&inv, cmd));
+							&inv, cmd, sc));
 		if (err)
 			return err;
 		return filp->f_op->unlocked_ioctl(filp,

drivers/char/diag/diagfwd_peripheral.c

@@ -1,5 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0-only
 /* Copyright (c) 2015-2019, 2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
  */
 #include <linux/slab.h>
 #include <linux/err.h>
@@ -179,7 +180,7 @@ static int diag_add_hdlc_encoding(unsigned char *dest_buf, int *dest_len,
 static int check_bufsize_for_encoding(struct diagfwd_buf_t *buf, uint32_t len)
 {
 	int i, ctx = 0, flag_64k = 0;
-	uint32_t max_size = 0;
+	uint32_t max_size = 0, realloc_len = 0;
 	unsigned long flags;
 	unsigned char *temp_buf = NULL;
 	struct diag_md_info *ch = NULL;
@@ -223,20 +224,20 @@ static int check_bufsize_for_encoding(struct diagfwd_buf_t *buf, uint32_t len)
 				}
 				spin_unlock_irqrestore(&ch->lock, flags);
 			}
-			temp_buf = krealloc(buf->data, max_size +
-						APF_DIAG_PADDING,
+
+			if (flag_64k)
+				realloc_len = MAX_PERIPHERAL_HDLC_BUF_SZ;
+			else
+				realloc_len = MAX_PERIPHERAL_BUF_SZ;
+
+			temp_buf = krealloc(buf->data, realloc_len,
 					    GFP_KERNEL);
 			if (!temp_buf) {
 				mutex_unlock(&driver->md_session_lock);
 				return -ENOMEM;
 			}
 			buf->data = temp_buf;
-
-			if (flag_64k)
-				buf->len = MAX_PERIPHERAL_HDLC_BUF_SZ;
-			else
-				buf->len = MAX_PERIPHERAL_BUF_SZ;
-
+			buf->len = realloc_len;
 			DIAG_LOG(DIAG_DEBUG_PERIPHERALS,
 			"diag: Reallocated data buffer: %pK with size: %d, max_buf_len: %d, p: %d, t: %d, n: %d\n",
 			temp_buf, max_size, buf->len,

drivers/dma-buf/dma-buf.c

@@ -124,10 +124,6 @@ static void dma_buf_release(struct dentry *dentry)
 	 */
 	BUG_ON(dmabuf->cb_shared.active || dmabuf->cb_excl.active);
 
-	mutex_lock(&db_list.lock);
-	list_del(&dmabuf->list_node);
-	mutex_unlock(&db_list.lock);
-
 	if (dmabuf->dtor)
 		dtor_ret = dmabuf->dtor(dmabuf, dmabuf->dtor_data);
 
@@ -146,6 +142,22 @@ static void dma_buf_release(struct dentry *dentry)
 	dmabuf_dent_put(dmabuf);
 }
 
+static int dma_buf_file_release(struct inode *inode, struct file *file)
+{
+	struct dma_buf *dmabuf;
+
+	if (!is_dma_buf_file(file))
+		return -EINVAL;
+
+	dmabuf = file->private_data;
+
+	mutex_lock(&db_list.lock);
+	list_del(&dmabuf->list_node);
+	mutex_unlock(&db_list.lock);
+
+	return 0;
+}
+
 static const struct dentry_operations dma_buf_dentry_ops = {
 	.d_dname = dmabuffs_dname,
 	.d_release = dma_buf_release,
@@ -484,6 +496,7 @@ static void dma_buf_show_fdinfo(struct seq_file *m, struct file *file)
 }
 
 static const struct file_operations dma_buf_fops = {
+	.release	= dma_buf_file_release,
 	.mmap		= dma_buf_mmap_internal,
 	.llseek		= dma_buf_llseek,
 	.poll		= dma_buf_poll,

drivers/gpu/msm/adreno_debugfs.c

@@ -147,8 +147,7 @@ static void sync_event_print(struct seq_file *s,
 		break;
 	}
 	case KGSL_CMD_SYNCPOINT_TYPE_FENCE: {
-		struct event_fence_info *info = sync_event ?
-				sync_event->priv : NULL;
+		struct event_fence_info *info = sync_event->priv;
 		int i;
 
 		for (i = 0; info && i < info->num_fences; i++)

drivers/gpu/msm/kgsl.c

@@ -2189,7 +2189,7 @@ long kgsl_ioctl_gpu_aux_command(struct kgsl_device_private *dev_priv,
 	cmdlist = u64_to_user_ptr(param->cmdlist);
 
 	/* Create a draw object for KGSL_GPU_AUX_COMMAND_TIMELINE */
-	if (kgsl_copy_struct_from_user(&generic, sizeof(generic),
+	if (copy_struct_from_user(&generic, sizeof(generic),
 		cmdlist, param->cmdsize)) {
 		ret = -EFAULT;
 		goto err;