- Remove CONFIG_CGROUP_DEBUG
- Remove CONFIG_RELAY
- Remove CONFIG_RMNET_DATA_DEBUG_PKT
- Remove CONFIG_MSM_SMD_DEBUG
- Remove CONFIG_CORESIGHT
- Remove CONFIG_CORESIGHT_EVENT
- Remove CONFIG_CORESIGHT_FUSE
- Remove CONFIG_CORESIGHT_CTI
- Remove CONFIG_CORESIGHT_CTI_SAVE_DISABLE
- Remove CONFIG_CORESIGHT_TMC
- Remove CONFIG_CORESIGHT_TPIU
- Remove CONFIG_CORESIGHT_FUNNEL
- Remove CONFIG_CORESIGHT_REPLICATOR
- Remove CONFIG_CORESIGHT_STM
- Remove CONFIG_CORESIGHT_HWEVENT
- Remove CONFIG_DYNAMIC_DEBUG

BUG:79487571
Change-Id: Id70fc9ef9842da838fed170da9bf73ee63fa71f2
Signed-off-by: julius_yen <julius_yen@compal.com>

1. Add log into unnecessary suspend/resume function to observe the action
2. Remove all action in unnecessary suspend/resume function

Bug: 117091908
Change-Id: Ied15f0c20a4b8f354b050cbcd4dd33aa8671962a

Request from issue tracker 114066748.
TWM threshold will trigger by UI SOC level 9%.
UI SOC value needs the same as PMIC gauge report value.
So we reset gauge drive TWM value to 0.

Default design idea as below:
   UI 100                                             0 %
       |---------------------------------------|---|
gauge 100                                           3   0 %
After change:
  UI 100                                                   0 %
       |-------------------------------------------|
gauge 100                                                0 %
After change our verify method is that UI SOC level need the same as PMIC gauge report value.

Bug: 114066748
Signed-off-by: mark_pu <mark_pu@compal.com>
Change-Id: I4f9b14aab58d223546dbaf727f8f3a1795eba8dc

Change-Id: I2ad5f1c8e43b0e038d319863e99e799e14ed8241

1.improve coordinate report more smooth
2. touch driver change to edge trigger for avoid new kernel level trigger issue

bug:115385751
Change-Id: I87178cbc14e54f72a83eeee3fe2b6d358bdad11f
Signed-off-by: william_liu <william_liu@compal.com>

This corresponds to the BSP 00041 release (LW301_00041).
Bug: 114686477

Change-Id: Ie974f6f604c00f297de77ac888f127ffeaa64f1f

Sync wlan patch from device/qcom/msm8909w/opensource/wlan/prima

Change-Id: If52ddefeec3fa1ce7593b742ff6a344306b3c6f1

Vignesh Viswanathan authored 6 years ago and Julius Yen committed 6 years ago

Ac comes from user space. Add check for ac in
limSetEdcaBcastACMFlag to avoid out-of-bounds write.

Change-Id: I02a868ef0edf0963784f491dbb2b5c06eaf711ba
CRs-Fixed: 2298563

Abhinav Kumar authored 6 years ago and Julius Yen committed 6 years ago

Remote malice AP may send beacon or probe response with
fake ssid IE length. Add sanity check for ssid IE length
in limLookupNaddHashEntry.

Change-Id: I08dee10a575b614d1966f6d24ea7a265d836ba85
CRs-Fixed: 2259534

Hanumanth Reddy Pothula authored 7 years ago and Julius Yen committed 6 years ago

While processing GET_ANTENA_DIVERSITY_SELECTION IOCTL, HDD is not
waiting for WDA response after posting WDA request. This leads to
return invalid data to upper layer.

In HDD, wait for the WDA response after posting WDA request to get
current antenna index from firmware.

Change-Id: Ic00a4b488825779266ed39726686546fc20365c7
CRs-Fixed: 2234665

Hanumanth Reddy Pothula authored 6 years ago and Julius Yen committed 6 years ago

While processing SET_PACKET_FILTER IOCTL, request memory is not freed
if HDD fails to post respective WDA command.

Do request put on fail to post WDA command, to make sure request memory
is freed.

Change-Id: I78f68399d6325b0f2ca6d2b897f880d0126b8969
CRs-Fixed: 2249784

Hanumanth Reddy Pothula authored 6 years ago and Julius Yen committed 6 years ago

Propagation from qcacld-3.0 to prima.

During initializing ibss security settings there is a possibility
of integer underflow while extracting wpa ie because of ie length
check miss.

Add wpa ie length boundary check before extracting wpa ie.

Change-Id: I3d1fab209d4ea361621fc37bbd5dde1d70646e12
CRs-Fixed: 2268507

Abhishek Singh authored 6 years ago and Julius Yen committed 6 years ago

Fix buffer overwrite in lim_mlm_add_bss() by adding
validation check.

Change-Id: Iba068c8f0167137859cbd56f483abf4f65254abc
CRs-Fixed: 2268676

Abhinav Kumar authored 6 years ago and Julius Yen committed 6 years ago

In function dot11f_unpack functions length of buffer passed is
decremented as pointer advances in the buffer. Add a check for
integer underflow before decrementing the length.
qcacld-3.0 to prima propagation of the following CRs:
2237141, 2231755, 2246426, 2150438

Change-Id: I443ec701bd34c2a374a5ad5ef7a4ceab5b932b85
CRs-Fixed: 2262484

Ashish Kumar Dhanotiya authored 6 years ago and Julius Yen committed 6 years ago

The values used to dictate the end of the for loop is great than the
size of array supp_rates, this will cause an OOB read when loop
through supp_rates. So need modify the size of array supp_rates.
There's also a functional issue in that the second call to
sme_cfg_get_str() overwrites the lower values of the first call,
thus not ever allowing the lower channel rates of A to ever be
valid. So need update the read buffer address for the second
sme_cfg_get_str().

Change-Id: I772042e1caa14c49c54eac2f04e854cb4c9ac9de
CRs-Fixed: 22474984

Apply "qcom,fg-force-load-profile" setting to force device to load profile.
The battery profile is not getting loaded properly. Add this to force device to load the
correct profile data.

Bug: 113338829
Change-Id: Ibabc53029342a85d95bd992066e36ecfc7c2180b

For merging w301_00041_darter_kernel.bundle

Bug: 115533185, 114686477
Change-Id: I693720e45c9e00a53813cc26a6a8b4b9bdca097b

merging lw301_00041_darter_kernel.bundle from compal to
android-msm-darter-3.18 branch

Bug: 114686477

RM: dts: Mount system and vendor for msm8909w from fstabs.
ARM: dts: msm: add sensors device node for msm8909w
ARM: dts: Mount system as root for msm8909
ARM: dts: msm: Update TZ image size for msm8909
ARM: dts: msm: Add common CMA device configuration for msm8909w & apq8009

Change-Id: I40898d72132dc07a61e19fd6d1cb4ddb3effd9a7

defconfig: msm: ARM_KERNMEM_PERMS and STACKPROTECTOR_STRONG for 8909w
defconfig: msm8909w: Enable VTI config for v4 and v6
msm8909w: defconfig: Enable XFRM and crypto configs

Change-Id: If37a32412a0737be7ba3f99b96d66960079d59cd

Conflicts:
	Documentation/devicetree/bindings/power/qpnp-fg-gen3.txt
	drivers/input/touchscreen/Makefile
	drivers/power/fg-core.h
	drivers/power/qpnp-fg-gen3.c
	drivers/soc/qcom/bg_rsb.c

Change-Id: Iaa64370059b25a1eb12bbc7cab10c56063a01a18

Jay Ting authored 6 years ago and Julius Yen committed 6 years ago

Checking HW phase ID to control LDO17 for different phase devices to make NFC
function still working.

BUG: 112267777
BUG: 113707595
Change-Id: Ia0fb388ab98a49f6478a4035b59c88fc4702a353

Enable the DT property to disable FG during TWM entry.

Change-Id: I82cc0ae128efae040724af2628a3bf9469202937
Signed-off-by: Anirudh Ghayal <aghayal@codeaurora.org>

To save power disable FG during TWM entry. Identify
TWM entry via the TWM notifier and disable FG in the
shutdown callback if TWM entry is requested.

Add a DT property "qcom,fg-disable-in-twm" to enable
this feature.

Change-Id: I6eaea1838d3ad9161fd0529c79dd528f5d4bcbe0
Signed-off-by: Anirudh Ghayal <aghayal@codeaurora.org>

Avoids race condition between enable/disable rsb to keep
rsb in proper state.

Change-Id: Ia02defbe4e11b92be0eace6bca37e5022bab79eb
Signed-off-by: Arjun Singh <arsingh@codeaurora.org>

Disables/Enables the Bg interrupts on device suspend and resume.

Change-Id: Ic7131f5b6fff77fbe745fb66afabab6ca927a797
Signed-off-by: Arjun Singh <arsingh@codeaurora.org>

When cleaning up the configurations, make sure we only free the number
of configurations and interfaces that we could have allocated.

Change-Id: I07a2ddd088264030544284ad9680cd6d2b538d21
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Git-commit: 32fd87b3
Git-repo: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git


Signed-off-by: Srinivasa Rao Kuppala <srkupp@codeaurora.org>

The buffer length is unsigned at all layers, but gets cast to int and
checked in hidp_process_report and can lead to a buffer overflow.
Switch len parameter to unsigned int to resolve issue.

Signed-off-by: Mark Salyzyn <salyzyn@google.com>
Fixes: 678af93e46ac10318b54f2f0c9abbdfe75c4e078 ("HID: Bluetooth: hidp: make sure input buffers are big enough")
Bug: 65853588
Change-Id: I779ce783ae7c3bce8c5a66c0954ef31347e42cfc
Git-repo: https://android.googlesource.com/kernel/msm


Git-commit: 34c56d55
Signed-off-by: Dennis Cagle <dcagle@codeaurora.org>

sockev_client_cb creates a netlink message and populates
the nlmsg_data using the socket->sock information.
If socket is closed, while the nlmsg_data is being
populated, a null pointer dereference occurs.

BUG: KASAN: null-ptr-deref in sockev_client_cb+0x1e4/0x310
Read of size 2 at addr 0000000000000010 by task syz-executor/9398
CPU: 6 PID: 9398 Comm: syz-executor Tainted: G W O 4.9.92+ #1

Call trace:
[<ffffff94e2bebec4>] sockev_client_cb+0x1e4/0x310
[<ffffff94e14fb20c>] notifier_call_chain+0x94/0xe0
[<ffffff94e14fb894>] __blocking_notifier_call_chain+0x6c/0xb8
[<ffffff94e14fb920>] blocking_notifier_call_chain+0x40/0x50
[<ffffff94e2b727f8>] sockev_notify net/socket.c:180 [inline]
[<ffffff94e2b727f8>] SYSC_listen net/socket.c:1446 [inline]
[<ffffff94e2b727f8>] SyS_listen+0x1e0/0x1f8
[<ffffff94e1483f70>] el0_svc_naked+0x24/0x28

CR's Fixed: 2251042
Change-Id: Iad9eb58cd05fcdc0b5cc1ed24de56b69abb532b4
Signed-off-by: Sharath Chandra Vurukala <sharathv@codeaurora.org>
Signed-off-by: Tejaswi Tanikella <tejaswit@codeaurora.org>
Signed-off-by: Kaustubh Pandey <kapandey@codeaurora.org>
Acked-by: Chinmay Agarwal <chinagar@qti.qualcomm.com>

Format rpm_stats.

Bug: 109876237
Change-Id: I87874b961b9780ebb21c2bba3ecabdd7bc34f793
Signed-off-by: Badhri Jagan Sridharan <Badhri@google.com>

Reset master_cnt whenever file is closed and reopened.
The makes the driver to return data starting from the first
master(APSS) whenever the debugfs file is closed and reopened.

Bug: 109876237
Change-Id: I53e232268cb7e80a8d10648dab0bd14e4ac231df
Signed-off-by: Badhri Jagan Sridharan <Badhri@google.com>

Adding support to print the additional XO sleep related debug stats
the rpm maintains for each of the masters. The additional stats
include xo_count, xo_last_entered_at, xo_last_exited_at, and
xo_accumulated_duration.

Bug: 109876237
Signed-off-by: Ramakrishnan Ganesh <ramakris@codeaurora.org>
Signed-off-by: Veena Sambasivan <veenas@codeaurora.org>
(cherry picked from commit 86602576)

Conflicts:
	drivers/soc/qcom/rpm_master_stat.c

Change-Id: I996fe28481a7d08296895f6a289961a0fe0d055e

Avoids race condition between enable/disable rsb to kee
proper state.

Qcom release. No modification.

Change-Id: Ic938a208b7d5cfd720b7de0bb49ce93d196ab551
Signed-off-by: Arjun Singh <arsingh@codeaurora.org>

 In msm_cpp_irq function, tx_level is read using msm_carmera_io_r(),
 However, this value is never verified to lower than
 MSM_CPP_TX_FIFO_LEVEL (16), As tx_level is used as the upper bound
 for the following loop, any value bigger than 16 will result in a
 buffer overflow. Hence handling this case as error with error log.

Change-Id: I1a922b0c14bb1a79297e71a6e5dda476042b5414
Signed-off-by: Suprith Malligere Shankaregowda <supgow@codeaurora.org>

jpeg driver is calling class_create with stack variable, which
can be overwritten by other stack variables.

Change-Id: I92ccd4629cef8a06b7715b8483cf53a9607bd22f
Signed-off-by: Deepak Shankar <dees@codeaurora.org>
Signed-off-by: Rahul Sharma <rahsha@codeaurora.org>