Merge tag 'LA.UM.9.14.r1-22400-LAHAINA.QSSI13.0' of https://git.codelinaro.org/clo/la/kernel/msm-5.4 into android13-5.4-lahaina

"LA.UM.9.14.r1-22400-LAHAINA.QSSI13.0"

* tag 'LA.UM.9.14.r1-22400-LAHAINA.QSSI13.0' of https://git.codelinaro.org/clo/la/kernel/msm-5.4:
  virt: haven: Correct max_buf_size for a connection
  mtd: msm_qpic_nand: Add runtime status check in notifiers
  defconfig: sdxlemur: Enable binder configs
  BACKPORT: FROMLIST: mm: protect free_pgtables with mmap_lock write lock in exit_mmap
  PCI: Configure RC MPS to 128 for Realtek 8168 attach
  bus: mhi: misc: Add check for dev_rp if it is iommu range or not
  drivers: qcom: pil: Use update_marker for modem book kpi
  soc: qcom: add buffer overflow check on AON rx_buffer
  msm: kgsl: Defer drawobj_sync_timeline_fence_work() to a workqueue
  memshare: Avoid accessing uninitialized nodes
  ANDROID: HID: Only utilise UHID provided exports if UHID is enabled
  soc: qcom: socinfo: Add soc information for Blair APQ
  soc: qcom: minidump: check the size parameter passed to qcom_smem_get()
  drivers: qcom: pil: Add KPI boot markers for modem
  usb: gadget: cdev: Fix spinlock recursion
  defconfig: sdxlemur: Realtek r8168 IOSS glue driver config

 Conflicts:
	arch/arm64/boot/dts/vendor/bindings/rtc/allwinner,sun6i-a31-rtc.yaml
	drivers/clk/qcom/gcc-qcs404.c

Change-Id: Ied2b86eda79d66e747ce5f4b7a3c83c3328edd2b

android/GKI_VERSION

@@ -1 +1 @@
-LTS_5.4.233_4716ccc31d55
+LTS_5.4.242_e699d543bbc9

android/abi_gki_aarch64_qcom

@@ -2561,6 +2561,7 @@
   ufshcd_remove
   ufshcd_uic_hibern8_enter
   ufshcd_uic_hibern8_exit
+  uhid_hid_driver
   __uio_register_device
   uhid_hid_driver
   uio_unregister_device

arch/arm/configs/vendor/sdxlemur.config

@@ -364,6 +364,7 @@ CONFIG_AQFWD_IOSS=m
 CONFIG_R8125=y
 CONFIG_R8125_IOSS=m
 CONFIG_R8168=y
+CONFIG_R8168_IOSS=m
 CONFIG_QCOM_SHOW_RESUME_IRQ=y
 CONFIG_HARDENED_USERCOPY=y
 # CONFIG_HARDENED_USERCOPY_FALLBACK is not set
@@ -505,3 +506,7 @@ CONFIG_DM_VERITY=y
 # CONFIG_DEVMEM is not set
 CONFIG_DAX=y
 CONFIG_LSM_MMAP_MIN_ADDR=32768
+CONFIG_ANDROID_BINDER_IPC=y
+CONFIG_ANDROID_BINDERFS=y
+CONFIG_ANDROID_BINDER_DEVICES="binder,hwbinder,vndbinder"
+# CONFIG_ANDROID_BINDER_IPC_SELFTEST is not set

drivers/bus/mhi/core/mhi_internal.h

@@ -809,6 +809,12 @@ static inline void mhi_trigger_resume(struct mhi_controller *mhi_cntrl)
 	pm_wakeup_hard_event(&mhi_cntrl->mhi_dev->dev);
 }
 
+static inline bool is_valid_ring_ptr(struct mhi_ring *ring, dma_addr_t addr)
+{
+	return ((addr >= ring->iommu_base &&
+		addr < ring->iommu_base + ring->len) && (addr % 16 == 0));
+}
+
 /* queue transfer buffer */
 int mhi_gen_tre(struct mhi_controller *mhi_cntrl, struct mhi_chan *mhi_chan,
 		void *buf, void *cb, size_t buf_len, enum MHI_FLAGS flags);

drivers/bus/mhi/core/mhi_main.c

@@ -1403,6 +1403,12 @@ int mhi_process_tsync_ev_ring(struct mhi_controller *mhi_cntrl,
 	int ret = 0;
 
 	spin_lock_bh(&mhi_event->lock);
+	if (!is_valid_ring_ptr(ev_ring, er_ctxt->rp)) {
+		MHI_ERR("Event ring rp points outside of the event ring or unalign rp %llx\n",
+				er_ctxt->rp);
+		spin_unlock_bh(&mhi_event->lock);
+		return 0;
+	}
 	dev_rp = mhi_to_virtual(ev_ring, er_ctxt->rp);
 	if (ev_ring->rp == dev_rp) {
 		spin_unlock_bh(&mhi_event->lock);
@@ -1496,8 +1502,14 @@ int mhi_process_bw_scale_ev_ring(struct mhi_controller *mhi_cntrl,
 	int ret = 0;
 
 	spin_lock_bh(&mhi_event->lock);
-	dev_rp = mhi_to_virtual(ev_ring, er_ctxt->rp);
+	if (!is_valid_ring_ptr(ev_ring, er_ctxt->rp)) {
+		MHI_ERR("Event ring rp points outside of the event ring or unalign rp %llx\n",
+				er_ctxt->rp);
+		spin_unlock_bh(&mhi_event->lock);
+		return 0;
+	}
 
+	dev_rp = mhi_to_virtual(ev_ring, er_ctxt->rp);
 	if (ev_ring->rp == dev_rp) {
 		spin_unlock_bh(&mhi_event->lock);
 		goto exit_bw_scale_process;

drivers/clk/qcom/gcc-qcs404.c

@@ -117,7 +117,8 @@ static const struct parent_map gcc_parent_map_5[] = {
 
 static const char * const gcc_parent_names_5[] = {
 	"bi_tcxo",
-	"dsi0pllbyte",
+	"dsi0pll_byteclk_src",
+	"gpll0_out_aux",
 	"core_bi_pll_test_se",
 };
 
@@ -129,7 +130,8 @@ static const struct parent_map gcc_parent_map_6[] = {
 
 static const char * const gcc_parent_names_6[] = {
 	"bi_tcxo",
-	"dsi0pllbyte",
+	"dsi0_phy_pll_out_byteclk",
+	"gpll0_out_aux",
 	"core_bi_pll_test_se",
 };
 
@@ -209,7 +211,8 @@ static const struct parent_map gcc_parent_map_12[] = {
 
 static const char * const gcc_parent_names_12[] = {
 	"bi_tcxo",
-	"dsi0pll",
+	"dsi0pll_pclk_src",
+	"gpll0_out_aux",
 	"core_bi_pll_test_se",
 };
 
@@ -243,14 +246,39 @@ static const char * const gcc_parent_names_14[] = {
 
 static const struct parent_map gcc_parent_map_15[] = {
 	{ P_BI_TCXO, 0 },
+	{ P_GPLL0_OUT_AUX, 2 },
 	{ P_CORE_BI_PLL_TEST_SE, 7 },
 };
 
 static const char * const gcc_parent_names_15[] = {
 	"bi_tcxo",
+	"gpll0_out_aux",
 	"core_bi_pll_test_se",
 };
 
+static const struct parent_map gcc_parent_map_16[] = {
+	{ P_XO, 0 },
+	{ P_GPLL0_OUT_MAIN, 1 },
+	{ P_CORE_BI_PLL_TEST_SE, 7 },
+};
+
+static const char * const gcc_parent_names_16[] = {
+	"cxo",
+	"gpll0_out_main",
+	"core_bi_pll_test_se",
+};
+
+static struct clk_fixed_factor cxo = {
+	.mult = 1,
+	.div = 1,
+	.hw.init = &(struct clk_init_data){
+		.name = "cxo",
+		.parent_names = (const char *[]){ "xo-board" },
+		.num_parents = 1,
+		.ops = &clk_fixed_factor_ops,
+	},
+};
+
 static struct clk_alpha_pll gpll0_sleep_clk_src = {
 	.offset = 0x21000,
 	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT],

drivers/mtd/devices/msm_qpic_nand.c

@@ -4371,6 +4371,15 @@ static int msm_nand_bam_panic_notifier(struct notifier_block *this,
 	struct msm_nand_chip *chip = &info->nand_chip;
 	int err;
 
+	/* We shouldn't request for a new resource during panic
+	 * as the cores and irq's were already in disabled state.
+	 * So, check device runtime status before request for a
+	 * resource (clock and bus).
+	 */
+
+	if (pm_runtime_suspended(chip->dev))
+		return NOTIFY_DONE;
+
 	err = msm_nand_get_device(chip->dev);
 	if (err)
 		goto out;

drivers/pci/quirks.c

@@ -2415,6 +2415,20 @@ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_NVIDIA,  PCI_DEVICE_ID_NVIDIA_CK804_PCIE,
 DECLARE_PCI_FIXUP_RESUME_EARLY(PCI_VENDOR_ID_NVIDIA,  PCI_DEVICE_ID_NVIDIA_CK804_PCIE,
 			quirk_nvidia_ck804_pcie_aer_ext_cap);
 
+/*
+ * Quirk to limit QCOM RC MPS to 128 in case of Realtek 8168
+ * attaches.
+ */
+static void quirk_realtek_rc_mpss_limit(struct pci_dev *pdev)
+{
+	struct pci_dev *root_port = pcie_find_root_port(pdev);
+
+	if (root_port->vendor  == PCI_VENDOR_ID_QCOM)
+		pcie_set_mps(root_port, 128);
+}
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_REALTEK, 0x8168,
+			quirk_realtek_rc_mpss_limit);
+
 static void quirk_via_cx700_pci_parking_caching(struct pci_dev *dev)
 {
 	/*

drivers/soc/qcom/boot_stats.c

@@ -150,6 +150,13 @@ void place_marker(const char *name)
 }
 EXPORT_SYMBOL(place_marker);
 
+void update_marker(const char *name)
+{
+	destroy_marker(name);
+	place_marker(name);
+}
+EXPORT_SYMBOL(update_marker);
+
 void destroy_marker(const char *name)
 {
 	_destroy_boot_marker((char *) name);
@@ -217,7 +224,7 @@ static ssize_t bootkpi_writer(struct kobject *obj, struct kobj_attribute *attr,
 		return rc;
 
 	buf[rc] = '\0';
-	place_marker(buf);
+	update_marker(buf);
 	return rc;
 }
 

drivers/soc/qcom/memshare/msm_memshare.c

@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0-only
 /* Copyright (c) 2013-2020, The Linux Foundation. All rights reserved.
- * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2022-2023, Qualcomm Innovation Center, Inc. All rights reserved.
  */
 
 #include <linux/err.h>
@@ -104,7 +104,7 @@ static int check_client(int client_id, int proc, int request)
 	int i = 0, rc;
 	int found = DHMS_MEM_CLIENT_INVALID;
 
-	for (i = 0; i < MAX_CLIENTS; i++) {
+	for (i = 0; i < num_clients; i++) {
 		if (memblock[i].client_id == client_id &&
 				memblock[i].peripheral == proc) {
 			found = i;
@@ -484,7 +484,7 @@ static void handle_alloc_generic_req(struct qmi_handle *handle,
 		return;
 	}
 
-	for (i = 0; i < MAX_CLIENTS; i++) {
+	for (i = 0; i < num_clients; i++) {
 		if (memsh_child[i]->client_id == alloc_req->client_id) {
 			client_node = memsh_child[i];
 			dev_info(memsh_drv->dev,
@@ -577,7 +577,7 @@ static void handle_free_generic_req(struct qmi_handle *handle,
 		flag = 1;
 	}
 
-	for (i = 0; i < MAX_CLIENTS; i++) {
+	for (i = 0; i < num_clients; i++) {
 		if (memsh_child[i]->client_id == free_req->client_id) {
 			client_node = memsh_child[i];
 			dev_info(memsh_drv->dev,

drivers/soc/qcom/msm_minidump.c

@@ -561,7 +561,7 @@ static int __init msm_minidump_init(void)
 	}
 
 	/*Check global minidump support initialization */
-	if (!md_global_toc->md_toc_init) {
+	if (size < sizeof(*md_global_toc) || !md_global_toc->md_toc_init) {
 		pr_err("System Minidump TOC not initialized\n");
 		return -ENODEV;
 	}

drivers/soc/qcom/msm_subsystem_restart.c

@@ -652,6 +652,11 @@ static int subsystem_shutdown(struct subsys_device *dev, void *data)
 	dev->crash_count++;
 	subsys_set_state(dev, SUBSYS_OFFLINE);
 
+#ifdef CONFIG_QGKI_MSM_BOOT_TIME_MARKER
+	if (!strcmp(dev->desc->name, "modem"))
+		update_marker("M - Modem Stop");
+#endif
+
 	return 0;
 }
 

drivers/soc/qcom/peripheral-loader.c

@@ -472,7 +472,10 @@ int pil_do_ramdump(struct pil_desc *desc,
 	if (ret)
 		pil_err(desc, "%s: Ramdump collection failed for subsys %s rc:%d\n",
 				__func__, desc->name, ret);
-
+#ifdef CONFIG_QGKI_MSM_BOOT_TIME_MARKER
+	if (!strcmp(desc->name, "modem"))
+		update_marker("M - Modem Dump completed");
+#endif
 	if (desc->subsys_vmid > 0)
 		ret = pil_assign_mem_to_subsys(desc, priv->region_start,
 				(priv->region_end - priv->region_start));
@@ -870,7 +873,7 @@ static int pil_init_mmap(struct pil_desc *desc, const struct pil_mdt *mdt)
 
 #ifdef CONFIG_QGKI_MSM_BOOT_TIME_MARKER
 	if (!strcmp(desc->name, "modem"))
-		place_marker("M - Modem Image Start Loading");
+		update_marker("M - Modem Image Start Loading");
 #endif
 
 	pil_info(desc, "loading from %pa to %pa\n", &priv->region_start,
@@ -1336,7 +1339,7 @@ int pil_boot(struct pil_desc *desc)
 
 #ifdef CONFIG_QGKI_MSM_BOOT_TIME_MARKER
 	if (!strcmp(desc->name, "modem"))
-		place_marker("M - Modem out of reset");
+		update_marker("M - Modem out of reset");
 #endif
 
 	pil_info(desc, "Brought out of reset\n");

drivers/soc/qcom/slate_events_bridge.c

@@ -1,6 +1,7 @@
 // SPDX-License-Identifier: GPL-2.0-only
 /*
  * Copyright (c) 2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023, Qualcomm Innovation Center, Inc. All rights reserved.
  */
 
 #include <linux/delay.h>
@@ -439,6 +440,10 @@ void seb_rx_msg(void *data, int len)
 	dev->seb_resp_cmplt = true;
 	wake_up(&dev->link_state_wait);
 	if (dev->wait_for_resp) {
+		if (len > SEB_GLINK_INTENT_SIZE) {
+			pr_err("Invalid seb rx buffer length\n");
+			return;
+		}
 		memcpy(dev->rx_buf, data, len);
 	} else {
 		/* Handle the event received from Slate */

drivers/soc/qcom/socinfo.c

@@ -680,6 +680,8 @@ static const struct soc_id soc_id[] = {
 	{ 450, "SHIMA" },
 	{ 454, "HOLI" },
 	{ 507, "BLAIR" },
+	{ 565, "BLAIRP" },
+	{ 628, "BLAIRP-XR" },
 	{ 486, "MONACO" },
 	{ 458, "SDXLEMUR" },
 	{ 483, "SDXLEMUR-SD"},

drivers/soc/qcom/subsys-pil-tz.c

@@ -871,6 +871,10 @@ static int subsys_ramdump(int enable, const struct subsys_desc *subsys)
 
 	if (!enable)
 		return 0;
+#ifdef CONFIG_QGKI_MSM_BOOT_TIME_MARKER
+	if (!strcmp(subsys->name, "modem"))
+		update_marker("M - Modem Dump start");
+#endif
 
 	return pil_do_ramdump(&d->desc, d->ramdump_dev, d->minidump_dev);
 }
@@ -915,6 +919,10 @@ static irqreturn_t subsys_err_fatal_intr_handler (int irq, void *drv_data)
 							d->subsys_desc.name);
 		return IRQ_HANDLED;
 	}
+#ifdef CONFIG_QGKI_MSM_BOOT_TIME_MARKER
+	if (!strcmp(d->subsys_desc.name, "modem"))
+		update_marker("M - Modem crash");
+#endif
 	subsys_set_crash_status(d->subsys, CRASH_STATUS_ERR_FATAL);
 	log_failure_reason(d);
 	subsystem_restart_dev(d->subsys);

drivers/usb/gadget/function/f_cdev.c

@@ -1679,6 +1679,7 @@ static void usb_cser_notify_modem(void *fport, int ctrl_bits)
 	spin_lock_irqsave(&port->port_lock, flags);
 	port->cbits_to_modem = temp;
 	port->cbits_updated = true;
+	spin_unlock_irqrestore(&port->port_lock, flags);
 
 	 /* if DTR is high, update latest modem info to laptop */
 	if (port->cbits_to_modem & TIOCM_DTR) {
@@ -1691,7 +1692,6 @@ static void usb_cser_notify_modem(void *fport, int ctrl_bits)
 			cser->send_modem_ctrl_bits(cser, cbits_to_laptop);
 	}
 
-	spin_unlock_irqrestore(&port->port_lock, flags);
 	wake_up(&port->read_wq);
 }
 

drivers/virt/haven/hh_rm_core.c

@@ -1,6 +1,7 @@
 // SPDX-License-Identifier: GPL-2.0-only
 /*
  * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  */
 
@@ -114,8 +115,8 @@ hh_rm_init_connection_buff(struct hh_rm_connection *connection,
 	if (!payload_size)
 		return 0;
 
-	max_buf_size = (HH_MSGQ_MAX_MSG_SIZE_BYTES - hdr_size) *
-			(hdr->fragments + 1);
+	max_buf_size = payload_size +
+			(hdr->fragments * HH_RM_MAX_MSG_SIZE_BYTES);
 
 	if (payload_size > max_buf_size) {
 		pr_err("%s: Payload size exceeds max buff size\n", __func__);

include/soc/qcom/boot_stats.h

@@ -6,6 +6,7 @@
 
 #ifdef CONFIG_QGKI_MSM_BOOT_TIME_MARKER
 void place_marker(const char *name);
+void update_marker(const char *name);
 void destroy_marker(const char *name);
 unsigned long long msm_timer_get_sclk_ticks(void);
 static inline int boot_marker_enabled(void) { return 1; }
@@ -13,6 +14,7 @@ static inline int boot_marker_enabled(void) { return 1; }
 static inline int init_bootkpi(void) { return 0; }
 static inline void exit_bootkpi(void) { };
 static inline void place_marker(char *name) { };
+static inline void update_marker(char *name) { };
 static inline void destroy_marker(const char *name) { };
 static inline int boot_marker_enabled(void) { return 0; }
 static inline unsigned long long msm_timer_get_sclk_ticks(void) { return -EINVAL; }

mm/mmap.c

@@ -3254,10 +3254,9 @@ void exit_mmap(struct mm_struct *mm)
 		(void)__oom_reap_task_mm(mm);
 
 		set_bit(MMF_OOM_SKIP, &mm->flags);
-		down_write(&mm->mmap_sem);
-		up_write(&mm->mmap_sem);
 	}
 
+	down_write(&mm->mmap_sem);
 	if (mm->locked_vm) {
 		vma = mm->mmap;
 		while (vma) {
@@ -3270,8 +3269,11 @@ void exit_mmap(struct mm_struct *mm)
 	arch_exit_mmap(mm);
 
 	vma = mm->mmap;
-	if (!vma)	/* Can happen if dup_mmap() received an OOM */
+	if (!vma) {
+		/* Can happen if dup_mmap() received an OOM */
+		up_write(&mm->mmap_sem);;
 		return;
+	}
 
 	lru_add_drain();
 	flush_cache_mm(mm);
@@ -3282,16 +3284,14 @@ void exit_mmap(struct mm_struct *mm)
 	free_pgtables(&tlb, vma, FIRST_USER_ADDRESS, USER_PGTABLES_CEILING);
 	tlb_finish_mmu(&tlb, 0, -1);
 
-	/*
-	 * Walk the list again, actually closing and freeing it,
-	 * with preemption enabled, without holding any MM locks.
-	 */
+	/* Walk the list again, actually closing and freeing it. */
 	while (vma) {
 		if (vma->vm_flags & VM_ACCOUNT)
 			nr_accounted += vma_pages(vma);
 		vma = remove_vma(vma);
 		cond_resched();
 	}
+	up_write(&mm->mmap_sem);
 	vm_unacct_memory(nr_accounted);
 }