Version 1.5.0_20171120-1455 released

arch/arm64/include/asm/memory.h

@@ -36,12 +36,14 @@
  * PAGE_OFFSET - the virtual address of the start of the kernel image (top
  *		 (VA_BITS - 1))
  * VA_BITS - the maximum number of bits for virtual addresses.
+ * VA_START - the first kernel virtual address.
  * TASK_SIZE - the maximum size of a user space task.
  * TASK_UNMAPPED_BASE - the lower boundary of the mmap VM area.
  * The module space lives between the addresses given by TASK_SIZE
  * and PAGE_OFFSET - it must be within 128MB of the kernel text.
  */
 #define VA_BITS			(CONFIG_ARM64_VA_BITS)
+#define VA_START		(UL(0xffffffffffffffff) << VA_BITS)
 #define PAGE_OFFSET		(UL(0xffffffffffffffff) << (VA_BITS - 1))
 #define MODULES_END		(PAGE_OFFSET)
 #define MODULES_VADDR		(MODULES_END - SZ_64M)

arch/arm64/include/asm/pgtable.h

@@ -41,7 +41,7 @@
  *	fixed mappings and modules
  */
 #define VMEMMAP_SIZE		ALIGN((1UL << (VA_BITS - PAGE_SHIFT)) * sizeof(struct page), PUD_SIZE)
-#define VMALLOC_START		(UL(0xffffffffffffffff) << VA_BITS)
+#define VMALLOC_START		(VA_START)
 #define VMALLOC_END		(PAGE_OFFSET - PUD_SIZE - VMEMMAP_SIZE - SZ_64K)
 
 #define vmemmap			((struct page *)(VMALLOC_END + SZ_64K))

drivers/base/dma-contiguous.c

@@ -187,7 +187,7 @@ int __init dma_contiguous_reserve_area(phys_addr_t size, phys_addr_t base,
  * global one. Requires architecture specific dev_get_cma_area() helper
  * function.
  */
-struct page *dma_alloc_from_contiguous(struct device *dev, int count,
+struct page *dma_alloc_from_contiguous(struct device *dev, size_t count,
 				       unsigned int align)
 {
 	if (align > CONFIG_CMA_ALIGNMENT)

drivers/base/platform.c

@@ -731,7 +731,7 @@ static ssize_t driver_override_store(struct device *dev,
 				     const char *buf, size_t count)
 {
 	struct platform_device *pdev = to_platform_device(dev);
-	char *driver_override, *old = pdev->driver_override, *cp;
+	char *driver_override, *old, *cp;
 
 	if (count > PATH_MAX)
 		return -EINVAL;
@@ -744,12 +744,15 @@ static ssize_t driver_override_store(struct device *dev,
 	if (cp)
 		*cp = '\0';
 
+	device_lock(dev);
+	old = pdev->driver_override;
 	if (strlen(driver_override)) {
 		pdev->driver_override = driver_override;
 	} else {
 		kfree(driver_override);
 		pdev->driver_override = NULL;
 	}
+	device_unlock(dev);
 
 	kfree(old);
 
@@ -760,8 +763,12 @@ static ssize_t driver_override_show(struct device *dev,
 				    struct device_attribute *attr, char *buf)
 {
 	struct platform_device *pdev = to_platform_device(dev);
+	ssize_t len;
 
-	return sprintf(buf, "%s\n", pdev->driver_override);
+	device_lock(dev);
+	len = sprintf(buf, "%s\n", pdev->driver_override);
+	device_unlock(dev);
+	return len;
 }
 static DEVICE_ATTR_RW(driver_override);
 

drivers/misc/mediatek/accdet/mt6735/accdet.c

@@ -1271,23 +1271,30 @@ static ssize_t show_TS3A225EConnectorType(struct device_driver *ddri, char *buf)
 
 static DRIVER_ATTR(TS3A225EConnectorType, 0664, show_TS3A225EConnectorType, NULL);
 #endif
+
 static ssize_t accdet_store_call_state(struct device_driver *ddri, const char *buf, size_t count)
 {
-	int ret;
+	int ret = 0;
+	int value = 0;
 
-	ret = sscanf(buf, "%s", &call_status);
-	if (ret != 1) {
-		ACCDET_DEBUG("accdet: Invalid values\n");
-		return -EINVAL;
+	if (buf == NULL) {
+		ACCDET_INFO("[%s] Invalid input!!\n",  __func__);
+		return 0;
 	}
 
+	ret = kstrtoint(buf, sizeof(int), &value);
+	if (ret < 0) {
+		ACCDET_INFO("accdet: Invalid values\n");
+		return 0;
+	}
+
+	call_status = (char)value;
 	switch (call_status) {
 	case CALL_IDLE:
 		ACCDET_DEBUG("[Accdet]accdet call: Idle state!\n");
 		break;
 
 	case CALL_RINGING:
-
 		ACCDET_DEBUG("[Accdet]accdet call: ringing state!\n");
 		break;
 
@@ -1306,11 +1313,16 @@ static ssize_t accdet_store_call_state(struct device_driver *ddri, const char *b
 
 static ssize_t show_pin_recognition_state(struct device_driver *ddri, char *buf)
 {
+	if (buf == NULL) {
+		ACCDET_INFO("[%s] Invalid input!!\n",  __func__);
+		return 0;
+	}
+
 #ifdef CONFIG_ACCDET_PIN_RECOGNIZATION
 	ACCDET_DEBUG("ACCDET show_pin_recognition_state = %d\n", cable_pin_recognition);
-	return sprintf(buf, "%u\n", cable_pin_recognition);
+	return snprintf(buf, (size_t)sizeof(cable_pin_recognition), "%u\n", cable_pin_recognition);
 #else
-	return sprintf(buf, "%u\n", 0);
+	return snprintf(buf, 4, "%u\n", 0);
 #endif
 }
 
@@ -1336,27 +1348,33 @@ static int dbug_thread(void *unused)
 
 static ssize_t store_accdet_start_debug_thread(struct device_driver *ddri, const char *buf, size_t count)
 {
+	int ret = 0;
+	int error = 0;
+	int start_flag = 0;
 
-	char start_flag;
-	int error;
-	int ret;
+	if (buf == NULL) {
+		ACCDET_INFO("[%s] Invalid input!!\n",  __func__);
+		return 0;
+	}
 
-	ret = sscanf(buf, "%s", &start_flag);
-	if (ret != 1) {
+	ret = kstrtoint(buf, sizeof(int), &start_flag);
+	if (ret != 0) {
 		ACCDET_DEBUG("accdet: Invalid values\n");
-		return -EINVAL;
+		return 0;
 	}
 
-	ACCDET_DEBUG("[Accdet] start flag =%d\n", start_flag);
-
-	g_start_debug_thread = start_flag;
-
-	if (1 == start_flag) {
+	if (start_flag) {/* if write 0, Invalid; otherwise, valid */
+		g_start_debug_thread = 1;
 		thread = kthread_run(dbug_thread, 0, "ACCDET");
 		if (IS_ERR(thread)) {
 			error = PTR_ERR(thread);
-			ACCDET_DEBUG(" failed to create kernel thread: %d\n", error);
+			ACCDET_DEBUG("[store_accdet_start_debug_thread] failed to create kernel thread: %d\n", error);
+		} else {
+			ACCDET_INFO("[store_accdet_start_debug_thread] start debug thread!\n");
 		}
+	} else {
+		g_start_debug_thread = 0;
+		ACCDET_INFO("[store_accdet_start_debug_thread] stop debug thread!\n");
 	}
 
 	return count;
@@ -1364,35 +1382,28 @@ static ssize_t store_accdet_start_debug_thread(struct device_driver *ddri, const
 
 static ssize_t store_accdet_set_headset_mode(struct device_driver *ddri, const char *buf, size_t count)
 {
-
-	char value;
-	int ret;
-
-	ret = sscanf(buf, "%s", &value);
-	if (ret != 1) {
-		ACCDET_DEBUG("accdet: Invalid values\n");
-		return -EINVAL;
-	}
-
-	ACCDET_DEBUG("[Accdet]store_accdet_set_headset_mode value =%d\n", value);
-
+	ACCDET_INFO("[%s] Not Support\n", __func__);
 	return count;
 }
 
 static ssize_t store_accdet_dump_register(struct device_driver *ddri, const char *buf, size_t count)
 {
-	char value;
-	int ret;
+	int ret = 0;
+	int value = 0;
 
-	ret = sscanf(buf, "%s", &value);
-	if (ret != 1) {
-		ACCDET_DEBUG("accdet: Invalid values\n");
-		return -EINVAL;
+	if (buf == NULL) {
+		ACCDET_INFO("[%s] Invalid input!!\n",  __func__);
+		return 0;
 	}
 
+	/* if write 0, Invalid; otherwise, valid */
+	ret = kstrtoint(buf, sizeof(int), &value);
+	if (ret != 0) {
+		ACCDET_DEBUG("accdet: Invalid values\n");
+		return 0;
+	}
 	g_dump_register = value;
-
-	ACCDET_DEBUG("[Accdet]store_accdet_dump_register value =%d\n", value);
+	ACCDET_INFO("[store_accdet_dump_register] start flag:%d\n", g_dump_register);
 
 	return count;
 }

drivers/misc/mediatek/cameraisp/src/mt6735/camera_isp_D1.c

@@ -24,12 +24,12 @@
 #include <linux/atomic.h>
 #include <linux/sched.h>
 #include <linux/mm.h>
-#include "inc/mt_typedefs.h"
 /* #include	<mach/mt6593_pll.h>	*/
 #include "inc/camera_isp_D1.h"
 #include <mach/irqs.h>
 #include <mach/mt_clkmgr.h>	/* For clock mgr APIS. enable_clock()/disable_clock(). */
 #include <mt-plat/sync_write.h>	/* For mt65xx_reg_sync_writel(). */
+#include <mt-plat/mt_ccci_common.h>
 #include <linux/of_platform.h>
 #include <linux/of_irq.h>
 #include <linux/of_address.h>
@@ -74,6 +74,7 @@ typedef unsigned int MUINT32;
 typedef signed char MINT8;
 typedef signed int MINT32;
 typedef bool MBOOL;
+typedef unsigned char   BOOL;
 
 
 #ifndef	MTRUE
@@ -941,7 +942,7 @@ static volatile MBOOL g_bDmaERR_p1 = MFALSE;
 static volatile MBOOL g_bDmaERR_p1_d = MFALSE;
 static volatile MBOOL g_bDmaERR_p2 = MFALSE;
 static volatile MBOOL g_bDmaERR_deepDump = MFALSE;
-static volatile UINT32 g_ISPIntErr[_IRQ_MAX] = { 0 };
+static volatile MUINT32 g_ISPIntErr[_IRQ_MAX] = { 0 };
 
 #define	nDMA_ERR_P1		(11)
 #define	nDMA_ERR_P1_D	(7)
@@ -5459,6 +5460,17 @@ static long ISP_Buf_CTRL_FUNC(unsigned long Param)
 										 ring_buf[rt_dma].
 										 data[i].
 										 base_pAddr);
+									/* for openedDma=2,
+									it must update 2 dma's based address,
+									or it will occur tearing */
+					/**/			if (pstRTBuf->ring_buf[ch_imgo].active == MTRUE)
+										ISP_WR32(
+					/**/				    p1_dma_addr_reg[ch_imgo],
+					/**/				    pstRTBuf->ring_buf[ch_imgo].data[i].base_pAddr);
+					/**/			if (pstRTBuf->ring_buf[ch_rrzo].active == MTRUE)
+										ISP_WR32(
+					/**/				    p1_dma_addr_reg[ch_rrzo],
+					/**/				    pstRTBuf->ring_buf[ch_rrzo].data[i].base_pAddr);
 								}
 					/**/			if ((_camsv_imgo_ == rt_dma)
 					/**/			    || (_camsv2_imgo_ == rt_dma)) {
@@ -6096,10 +6108,10 @@ static long ISP_Buf_CTRL_FUNC(unsigned long Param)
 			{
 				MUINT8 array[_rt_dma_max_];
 				/* if(copy_from_user(array, (void __user*)rt_buf_ctrl.data_ptr,
-				sizeof(UINT8)*_rt_dma_max_)     == 0) { */
+				sizeof(MUINT8)*_rt_dma_max_)     == 0) { */
 				if (copy_from_user
 				    (array, (void __user *)rt_buf_ctrl.pExtend,
-				     sizeof(UINT8) * _rt_dma_max_) == 0) {
+				     sizeof(MUINT8) * _rt_dma_max_) == 0) {
 					MUINT32 z;
 
 					bRawEn = MFALSE;
@@ -8318,13 +8330,13 @@ static MINT32 ISP_WaitIrq_v3(ISP_WAIT_IRQ_STRUCT *WaitIrq)
 			/*      */
 			/* v : kernel receive mark request */
 			/* o : kernel receive wait request */
-			/* ¡ô: return to user */
+			/* ¡ô: return to user */
 			/*      */
 			/* case: freeze is true, and passby     signal count = 0 */
 			/*      */
 			/* |                                                                            |     */
 			/* |                                                              (wait)        | */
-			/* |       v-------------o++++++ |¡ô */
+			/* |       v-------------o++++++ |¡ô */
 			/* |                                                                            |     */
 			/* Sig                                                                            Sig */
 			/*      */
@@ -8332,7 +8344,7 @@ static MINT32 ISP_WaitIrq_v3(ISP_WAIT_IRQ_STRUCT *WaitIrq)
 			/*      */
 			/* |                                                                             |     */
 			/* |                                                                             |     */
-			/* |       v---------------------- |-o  ¡ô(return) */
+			/* |       v---------------------- |-o  ¡ô(return) */
 			/* |                                                                             |     */
 			/* Sig                                                                             Sig */
 			/*      */
@@ -10271,6 +10283,11 @@ static long ISP_ioctl(struct file *pFile, unsigned int Cmd, unsigned long Param)
 		if (copy_from_user(DebugFlag, (void *)Param, sizeof(MUINT32) * 2) == 0) {
 			MUINT32 lock_key = _IRQ_MAX;
 
+			if (DebugFlag[1] >= _IRQ_MAX) {
+				LOG_ERR("unsupported module:0x%x\n", DebugFlag[1]);
+				Ret = -EFAULT;
+				break;
+			}
 			if (DebugFlag[1] == _IRQ_D)
 				lock_key = _IRQ;
 			else
@@ -10311,6 +10328,11 @@ static long ISP_ioctl(struct file *pFile, unsigned int Cmd, unsigned long Param)
 			MUINT32 currentPPB = m_CurrentPPB;
 			MUINT32 lock_key = _IRQ_MAX;
 
+			if (DebugFlag[0] >= _IRQ_MAX) {
+				LOG_ERR("unsupported module:0x%x\n", DebugFlag[0]);
+				Ret = -EFAULT;
+				break;
+			}
 			if (DebugFlag[0] == _IRQ_D)
 				lock_key = _IRQ;
 			else
@@ -10950,6 +10972,7 @@ static MINT32 ISP_open(struct inode *pInode, struct file *pFile)
 	MUINT32 i;
 	int q = 0, p = 0;
 	ISP_USER_INFO_STRUCT *pUserInfo;
+	char mode = 0;
 
 	LOG_INF("- E. UserCount: %d.", IspInfo.UserCount);
 	/*      */
@@ -10981,7 +11004,10 @@ static MINT32 ISP_open(struct inode *pInode, struct file *pFile)
 		LOG_DBG("Curr UserCount(%d), (process, pid, tgid)=(%s, %d, %d),	first user",
 			IspInfo.UserCount, current->comm, current->pid, current->tgid);
 	}
-
+	mode = 1;
+	LOG_DBG("before exec_ccci_kern_func_by_md_id enable");
+	exec_ccci_kern_func_by_md_id(0, ID_MD_RF_DESENSE, &mode, sizeof(int) );
+	LOG_DBG("after exec_ccci_kern_func_by_md_id enable");
 	/* kernel log */
 #if (LOG_CONSTRAINT_ADJ == 1)
 	g_log_def_constraint = get_detect_count();
@@ -11127,6 +11153,7 @@ static MINT32 ISP_release(struct inode *pInode, struct file *pFile)
 	ISP_USER_INFO_STRUCT *pUserInfo;
 	MUINT32 Reg;
 	MUINT32 i = 0;
+	char mode = 0;
 
 	LOG_INF("- E. UserCount: %d.", IspInfo.UserCount);
 	/*      */
@@ -11196,6 +11223,10 @@ static MINT32 ISP_release(struct inode *pInode, struct file *pFile)
 	ISP_WR32(ISP_ADDR + 0x4a00, 0x00000001);
 	LOG_DBG("ISP_MCLK1_EN Release");
 	ISP_BufWrite_Free();
+	mode = 0;
+	LOG_DBG("before exec_ccci_kern_func_by_md_id disable");
+	exec_ccci_kern_func_by_md_id(0, ID_MD_RF_DESENSE, &mode, sizeof(int) );
+	LOG_DBG("after exec_ccci_kern_func_by_md_id disable");
 
 #if (LOG_CONSTRAINT_ADJ == 1)
 	set_detect_count(g_log_def_constraint);
@@ -11936,112 +11967,14 @@ static struct platform_driver IspDriver = {
 /*
 ssize_t (*read) (struct file *, char __user *, size_t, loff_t *)
 */
-#define USE_OLD_STYPE_11897 0
-#if USE_OLD_STYPE_11897
-static MINT32 ISP_DumpRegToProc(
-	char *pPage,
-	char **ppStart,
-	off_t off,
-	MINT32 Count,
-	MINT32 *pEof,
-	void *pData)
-#else /* new file_operations style */
 static ssize_t ISP_DumpRegToProc(
 	struct file *pFile,
 	char *pStart,
 	size_t off,
 	loff_t *Count)
-#endif
 {
-#if USE_OLD_STYPE_11897
-	char *p = pPage;
-	MINT32 Length = 0;
-	MUINT32 i = 0;
-	MINT32 ret = 0;
-	/*      */
-	LOG_INF("- E. pPage: %p. off: %d. Count: %d.", pPage, (unsigned int)off, Count);
-	/*      */
-	p += sprintf(p, " MT6593 ISP Register\n");
-	p += sprintf(p, "======	top	====\n");
-	for (i = 0x0; i <= 0x1AC; i += 4)
-		p += sprintf(p, "+0x%08x 0x%08x\n", (unsigned int)(ISP_ADDR + i),
-			     (unsigned int)ISP_RD32(ISP_ADDR + i));
-
-	p += sprintf(p, "======	dma	====\n");
-	for (i = 0x200; i <= 0x3D8; i += 4)
-		p += sprintf(p, "+0x%08x 0x%08x\n\r", (unsigned int)(ISP_ADDR + i),
-			     (unsigned int)ISP_RD32(ISP_ADDR + i));
-
-	p += sprintf(p, "======	tg ====\n");
-	for (i = 0x400; i <= 0x4EC; i += 4)
-		p += sprintf(p, "+0x%08x 0x%08x\n", (unsigned int)(ISP_ADDR + i),
-			     (unsigned int)ISP_RD32(ISP_ADDR + i));
-
-	p += sprintf(p, "======	cdp	(including EIS)	====\n");
-	for (i = 0xB00; i <= 0xDE0; i += 4)
-		p += sprintf(p, "+0x%08x 0x%08x\n", (unsigned int)(ISP_ADDR + i),
-			     (unsigned int)ISP_RD32(ISP_ADDR + i));
-
-	p += sprintf(p, "======	seninf ====\n");
-	for (i = 0x4000; i <= 0x40C0; i += 4)
-		p += sprintf(p, "+0x%08x 0x%08x\n", (unsigned int)(ISP_ADDR + i),
-			     (unsigned int)ISP_RD32(ISP_ADDR + i));
-
-	for (i = 0x4100; i <= 0x41BC; i += 4)
-		p += sprintf(p, "+0x%08x 0x%08x\n", (unsigned int)(ISP_ADDR + i),
-			     (unsigned int)ISP_RD32(ISP_ADDR + i));
-
-	for (i = 0x4200; i <= 0x4208; i += 4)
-		p += sprintf(p, "+0x%08x 0x%08x\n", (unsigned int)(ISP_ADDR + i),
-			     (unsigned int)ISP_RD32(ISP_ADDR + i));
-
-	for (i = 0x4300; i <= 0x4310; i += 4)
-		p += sprintf(p, "+0x%08x 0x%08x\n", (unsigned int)(ISP_ADDR + i),
-			     (unsigned int)ISP_RD32(ISP_ADDR + i));
-
-	for (i = 0x43A0; i <= 0x43B0; i += 4)
-		p += sprintf(p, "+0x%08x 0x%08x\n", (unsigned int)(ISP_ADDR + i),
-			     (unsigned int)ISP_RD32(ISP_ADDR + i));
-
-	for (i = 0x4400; i <= 0x4424; i += 4)
-		p += sprintf(p, "+0x%08x 0x%08x\n", (unsigned int)(ISP_ADDR + i),
-			     (unsigned int)ISP_RD32(ISP_ADDR + i));
-
-	for (i = 0x4500; i <= 0x4520; i += 4)
-		p += sprintf(p, "+0x%08x 0x%08x\n", (unsigned int)(ISP_ADDR + i),
-			     (unsigned int)ISP_RD32(ISP_ADDR + i));
-
-	for (i = 0x4600; i <= 0x4608; i += 4)
-		p += sprintf(p, "+0x%08x 0x%08x\n", (unsigned int)(ISP_ADDR + i),
-			     (unsigned int)ISP_RD32(ISP_ADDR + i));
-
-	for (i = 0x4A00; i <= 0x4A08; i += 4)
-		p += sprintf(p, "+0x%08x 0x%08x\n", (unsigned int)(ISP_ADDR + i),
-			     (unsigned int)ISP_RD32(ISP_ADDR + i));
-
-	p += sprintf(p, "====== 3DNR ====\n");
-
-	for (i = 0x4F00; i <= 0x4F38; i += 4)
-		p += sprintf(p, "+0x%08x 0x%08x\n", (unsigned int)(ISP_ADDR + i),
-			     (unsigned int)ISP_RD32(ISP_ADDR + i));
-	/*      */
-	*ppStart = pPage + off;
-	/*      */
-	Length = p - pPage;
-	if (Length > off)
-		Length -= off;
-	else
-		Length = 0;
-
-	/*      */
-	ret = Length < Count ? Length : Count;
-	LOG_INF("- X. ret: %d.", ret);
-
-	return ret;
-#else /* new file_operations style */
 	LOG_ERR("ISP_DumpRegToProc: Not implement");
 	return 0;
-#endif
 }
 
 /*******************************************************************************
@@ -12050,98 +11983,27 @@ static ssize_t ISP_DumpRegToProc(
 /*
 ssize_t (*write) (struct file *, const char __user *, size_t, loff_t *)
 */
-#define USE_OLD_STYPE_12011 0
-#if USE_OLD_STYPE_12011
-static MINT32 ISP_RegDebug(
-	struct file *pFile,
-	const char *pBuffer,
-	unsigned long Count,
-	void *pData)
-#else /* new file_operations style */
 static ssize_t ISP_RegDebug(
 	struct file *pFile,
 	const char *pBuffer,
 	size_t Count,
 	loff_t *pData)
-#endif
 {
-#if USE_OLD_STYPE_12011
-	char RegBuf[64];
-	MUINT32 CopyBufSize = (Count < (sizeof(RegBuf) - 1)) ? (Count) : (sizeof(RegBuf) - 1);
-	MUINT32 Addr = 0;
-	MUINT32 Data = 0;
-
-	LOG_INF("- E. pFile: %p. pBuffer: %p. Count: %d.", pFile, pBuffer, (int)Count);
-	/*      */
-	if (copy_from_user(RegBuf, pBuffer, CopyBufSize)) {
-		LOG_ERR("copy_from_user() fail.");
-		return -EFAULT;
-	}
-
-	/*      */
-	if (sscanf(RegBuf, "%x %x", &Addr, &Data) == 2) {
-		ISP_WR32(ISP_ADDR_CAMINF + Addr, Data);
-		LOG_INF("Write => Addr:	0x%08X,	Write Data:	0x%08X.	Read Data: 0x%08X.",
-			(int)(ISP_ADDR_CAMINF + Addr), (int)Data,
-			(int)ioread32((void *)(ISP_ADDR_CAMINF + Addr)));
-	} else if (sscanf(RegBuf, "%x", &Addr) == 1) {
-		LOG_INF("Read => Addr: 0x%08X, Read	Data: 0x%08X.",
-			(int)(ISP_ADDR_CAMINF + Addr), (int)ioread32((void *)(ISP_ADDR_CAMINF + Addr)));
-	}
-	/*      */
-	LOG_INF("- X. Count: %d.", (int)Count);
-	return Count;
-#else /* new file_operations style */
 	LOG_ERR("ISP_RegDebug: Not implement");
 	return 0;
-#endif
 }
 
 /*
 ssize_t (*read) (struct file *, char __user *, size_t, loff_t *)
 */
-#define USE_OLD_STYPE_12061 0
-#if USE_OLD_STYPE_12061
-static MUINT32 proc_regOfst;
-static MINT32 CAMIO_DumpRegToProc(
-	char *pPage,
-	char **ppStart,
-	off_t off,
-	MINT32 Count,
-	MINT32 *pEof,
-	void *pData)
-#else /* new file_operations style */
 static ssize_t CAMIO_DumpRegToProc(
 	struct file *pFile,
 	char *pStart,
 	size_t off,
 	loff_t *Count)
-#endif
 {
-#if USE_OLD_STYPE_12061
-	char *p = pPage;
-	MINT32 Length = 0;
-	MINT32 ret = 0;
-	/*      */
-	LOG_INF("- E. pPage: %p. off: %d. Count: %d.", pPage, (int)off, Count);
-	p += sprintf(p, "reg_0x%lx = 0x%08x\n", ISP_ADDR_CAMINF + proc_regOfst,
-		     ioread32((void *)(ISP_ADDR_CAMINF + proc_regOfst)));
-
-	*ppStart = pPage + off;
-	/*      */
-	Length = p - pPage;
-	if (Length > off)
-		Length -= off;
-	else
-		Length = 0;
-	ret = Length < Count ? Length : Count;
-	LOG_INF("- X. ret: %d.", ret);
-
-	return ret;
-#else /* new file_operations style */
 	LOG_ERR("CAMIO_DumpRegToProc: Not implement");
 	return 0;
-#endif
 }
 
 
@@ -12151,54 +12013,14 @@ static ssize_t CAMIO_DumpRegToProc(
 /*
 ssize_t (*write) (struct file *, const char __user *, size_t, loff_t *)
 */
-#define USE_OLD_STYPE_12112 0
-#if USE_OLD_STYPE_12112
-static MINT32 CAMIO_RegDebug(
-	struct file *pFile,
-	const char *pBuffer,
-	unsigned long Count,
-	void *pData)
-#else /* new file_operations style */
 static ssize_t CAMIO_RegDebug(
 	struct file *pFile,
 	const char *pBuffer,
 	size_t Count,
 	loff_t *pData)
-#endif
 {
-#if USE_OLD_STYPE_12112
-	char RegBuf[64];
-	MUINT32 CopyBufSize = (Count < (sizeof(RegBuf) - 1)) ? (Count) : (sizeof(RegBuf) - 1);
-	MUINT32 Addr = 0;
-	MUINT32 Data = 0;
-
-	LOG_INF("- E. pFile: %p. pBuffer: %p. Count: %d.", pFile, pBuffer, (int)Count);
-
-	/*      */
-	if (copy_from_user(RegBuf, pBuffer, CopyBufSize)) {
-		LOG_ERR("copy_from_user() fail.");
-		return -EFAULT;
-	}
-
-	/*      */
-	if (sscanf(RegBuf, "%x %x", &Addr, &Data) == 2) {
-		proc_regOfst = Addr;
-		ISP_WR32(ISP_GPIO_ADDR + Addr, Data);
-		LOG_INF("Write => Addr:	0x%08X,	Write Data: 0x%08X.	Read Data: 0x%08X.",
-			(int)(ISP_GPIO_ADDR + Addr), (int)Data,
-			(int)ioread32((void *)(ISP_GPIO_ADDR + Addr)));
-	} else if (sscanf(RegBuf, "%x", &Addr) == 1) {
-		proc_regOfst = Addr;
-		LOG_INF("Read => Addr: 0x%08X, Read Data: 0x%08X.", (int)(ISP_GPIO_ADDR + Addr),
-			(int)ioread32((void *)(ISP_GPIO_ADDR + Addr)));
-	}
-	/*      */
-	LOG_INF("- X. Count: %d.", (int)Count);
-	return Count;
-#else /* new file_operations style */
 	LOG_ERR("CAMIO_RegDebug: Not implement");
 	return 0;
-#endif
 }
 
 /*******************************************************************************

drivers/misc/mediatek/cameraisp/src/mt6735/camera_isp_D2.c

@@ -40,6 +40,7 @@
 /*#include <mach/mt_spm_idle.h>*/	/* For spm_enable_sodi()/spm_disable_sodi(). */
 
 /*#include <smi_common.h>*/
+#include <mt-plat/mt_ccci_common.h>
 
 #ifdef CONFIG_PM_WAKELOCKS
 #include <linux/pm_wakeup.h>
@@ -1223,7 +1224,7 @@ Bit 31:28 ? {sot_reg, eol_reg, eot_reg, sof} , reg means status record
 Bit 27:24 ?{eot, eol,eot, req}
 Bit 23 : rdy
 
-Rdy should be 1    at idle or end of tile, if not 0, 很可能是mdp 沒回rdy
+Rdy should be 1    at idle or end of tile, if not 0, could be mdp not rdy
 Req  should be 0   at idle or end of tile
 
 sot_reg, eol_reg, eot_reg should be 1  at idle or end of tile
@@ -1234,7 +1235,7 @@ pix count  :  bit 15:0
 
 
 2. 0x4044 / 0x4048 status
-      It is 無須 enable,
+It is �⊿� enable,
 It is clear by 0x4020[31] write or read clear,
 It has many information on it,
 You can look coda
@@ -4595,6 +4596,11 @@ static long ISP_ioctl(struct file *pFile, MUINT32 Cmd, unsigned long Param)
 			    0) {
 				MUINT32 lock_key = _IRQ_MAX;
 
+				if (DebugFlag[1] >= _IRQ_MAX) {
+					LOG_ERR("unsupported module:0x%x\n", DebugFlag[1]);
+					Ret = -EFAULT;
+					break;
+				}
 				if (DebugFlag[1] == _IRQ_D)
 					lock_key = _IRQ;
 				else
@@ -4865,6 +4871,11 @@ static long ISP_ioctl(struct file *pFile, MUINT32 Cmd, unsigned long Param)
 			MUINT32 currentPPB = m_CurrentPPB;
 			MUINT32 lock_key = _IRQ_MAX;
 
+			if (DebugFlag[0] >= _IRQ_MAX) {
+				LOG_ERR("unsupported module:0x%x\n", DebugFlag[0]);
+				Ret = -EFAULT;
+				break;
+			}
 			if (DebugFlag[0] == _IRQ_D)
 				lock_key = _IRQ;
 			else
@@ -5350,6 +5361,7 @@ static MINT32 ISP_open(struct inode *pInode, struct file *pFile)
 	MUINT32 i;
 	ISP_USER_INFO_STRUCT *pUserInfo;
 	unsigned long flags;
+	char mode = 0;
 
 	LOG_DBG("+,UserCount(%d)", g_IspInfo.UserCount);
 
@@ -5423,6 +5435,9 @@ static MINT32 ISP_open(struct inode *pInode, struct file *pFile)
 	}
 
 	g_IspInfo.UserCount++;
+	LOG_DBG("set exec_ccci_kern_func_by_md_id");
+	mode = 1;
+	exec_ccci_kern_func_by_md_id(0, ID_MD_RF_DESENSE, &mode, sizeof(int));
 
 	LOG_DBG("Curr UserCount(%d), (process, pid, tgid)=(%s, %d, %d), first user",
 		g_IspInfo.UserCount, current->comm, current->pid, current->tgid);
@@ -5458,6 +5473,7 @@ EXIT:
 static MINT32 ISP_release(struct inode *pInode, struct file *pFile)
 {
 	ISP_USER_INFO_STRUCT *pUserInfo;
+	char mode = 0;
 
 	LOG_DBG("+,UserCount(%d)", g_IspInfo.UserCount);
 
@@ -5508,7 +5524,9 @@ static MINT32 ISP_release(struct inode *pInode, struct file *pFile)
 	mMclk1User = 0;
 	ISP_WR32(ISP_ADDR + 0x4200, 0x00000001);
 	/*LOG_DBG("ISP_MCLK1_EN release\n");*/
-
+	mode = 0;
+	LOG_DBG("clear exec_ccci_kern_func_by_md_id");
+	exec_ccci_kern_func_by_md_id(0, ID_MD_RF_DESENSE, &mode, sizeof(int));
 #if (LOG_CONSTRAINT_ADJ == 1)
 	set_detect_count(g_log_def_constraint);
 #endif
@@ -6156,91 +6174,8 @@ static struct platform_driver IspDriver = {
 static ssize_t ISP_DumpRegToProc(struct file *pPage,
 				char __user *pBuffer, size_t Count, loff_t *off)
 {
-	char *p = (char*)pPage;
-           char** ppStart=NULL;
-	long Length = 0;
-	MUINT32 i = 0;
-	long ret = 0;
-
-	LOG_DBG("pPage(%p),off(0x%lx),Count(%ld)", pPage, (unsigned long)off, (long int)Count);
-
-	p += sprintf(p, " MT ISP Register\n");
-	p += sprintf(p, "====== top ====\n");
-
-	for (i = 0x0; i <= 0x1AC; i += 4) {
-		p += sprintf(p, "+0x%08x 0x%08x\n", (unsigned int)(ISP_ADDR + i),
-			     ISP_RD32(ISP_ADDR + i));
-	}
-
-	p += sprintf(p, "====== dma ====\n");
-	for (i = 0x200; i <= 0x3D8; i += 4) {
-		p += sprintf(p, "+0x%08x 0x%08x\n\r", (unsigned int)(ISP_ADDR + i),
-			     ISP_RD32(ISP_ADDR + i));
-	}
-
-	p += sprintf(p, "====== tg ====\n");
-	for (i = 0x400; i <= 0x4EC; i += 4) {
-		p += sprintf(p, "+0x%08x 0x%08x\n", (unsigned int)(ISP_ADDR + i),
-			     ISP_RD32(ISP_ADDR + i));
-	}
-
-	p += sprintf(p, "====== cdp (including EIS) ====\n");
-	for (i = 0xB00; i <= 0xDE0; i += 4) {
-		p += sprintf(p, "+0x%08x 0x%08x\n", (unsigned int)(ISP_ADDR + i),
-			     ISP_RD32(ISP_ADDR + i));
-	}
-
-	p += sprintf(p, "====== seninf ====\n");
-	for (i = 0x4000; i <= 0x40C0; i += 4) {
-		p += sprintf(p, "+0x%08x 0x%08x\n", (unsigned int)(ISP_ADDR + i),
-			     ISP_RD32(ISP_ADDR + i));
-	}
-
-	for (i = 0x4100; i <= 0x41BC; i += 4) {
-		p += sprintf(p, "+0x%08x 0x%08x\n", (unsigned int)(ISP_ADDR + i),
-			     ISP_RD32(ISP_ADDR + i));
-	}
-
-	for (i = 0x4300; i <= 0x4310; i += 4) {
-		p += sprintf(p, "+0x%08x 0x%08x\n", (unsigned int)(ISP_ADDR + i),
-			     ISP_RD32(ISP_ADDR + i));
-	}
-
-	for (i = 0x43A0; i <= 0x43B0; i += 4) {
-		p += sprintf(p, "+0x%08x 0x%08x\n", (unsigned int)(ISP_ADDR + i),
-			     ISP_RD32(ISP_ADDR + i));
-	}
-
-	for (i = 0x4400; i <= 0x4424; i += 4) {
-		p += sprintf(p, "+0x%08x 0x%08x\n", (unsigned int)(ISP_ADDR + i),
-			     ISP_RD32((ISP_ADDR + i)));
-	}
-
-	for (i = 0x4500; i <= 0x4520; i += 4) {
-		p += sprintf(p, "+0x%08x 0x%08x\n", (unsigned int)(ISP_ADDR + i),
-			     ISP_RD32(ISP_ADDR + i));
-	}
-
-	p += sprintf(p, "====== 3DNR ====\n");
-	for (i = 0x4F00; i <= 0x4F38; i += 4) {
-		p += sprintf(p, "+0x%08x 0x%08x\n", (unsigned int)(ISP_ADDR + i),
-			     ISP_RD32(ISP_ADDR + i));
-	}
-
-
-	*ppStart = (char*)((unsigned long)pPage + (unsigned long)off);
-
-	Length = (long)((unsigned long)p - (unsigned long)pPage);
-	if (Length > (long)off) {
-		Length -= (long)off;
-	} else {
-		Length = 0;
-	}
-
-	ret = Length < Count ? Length : Count;
-
-	/*LOG_DBG("ret(%ld)", ret);*/
-	return ((ssize_t)(ret));
+	LOG_ERR("ISP_DumpRegToProc: Not implement");
+	return 0;
 }
 
 /*******************************************************************************
@@ -6249,60 +6184,15 @@ static ssize_t ISP_DumpRegToProc(struct file *pPage,
 static ssize_t ISP_RegDebug(struct file *pFile,
 			   const char __user *pBuffer, size_t  Count, loff_t *p_off)
 {
-	char RegBuf[64];
-	MUINT32 CopyBufSize = (Count < (sizeof(RegBuf) - 1)) ? (Count) : (sizeof(RegBuf) - 1);
-	MUINT32 Addr = 0;
-	MUINT32 Data = 0;
-
-	LOG_DBG("pFile(%p),pBuffer(%p),Count(%ld)", pFile, pBuffer, (long int)Count);
-
-	if (copy_from_user(RegBuf, pBuffer, CopyBufSize)) {
-		LOG_ERR("copy_from_user() fail.");
-		return -EFAULT;
-	}
-
-	if (sscanf(RegBuf, "%x %x", &Addr, &Data) == 2) {
-		ISP_WR32((ISP_ADDR_CAMINF + Addr), Data);
-		LOG_ERR("Write => Addr: 0x%08X, Write Data: 0x%08X. Read Data: 0x%08X.",
-			(unsigned int)(ISP_ADDR_CAMINF + Addr), Data,
-			ioread32((void*)(ISP_ADDR_CAMINF + Addr)));
-	} else if (sscanf(RegBuf, "%x", &Addr) == 1) {
-		LOG_ERR("Read => Addr: 0x%08X, Read Data: 0x%08X.",
-			(unsigned int)(ISP_ADDR_CAMINF + Addr), ioread32((void*)(ISP_ADDR_CAMINF + Addr)));
-	}
-
-	LOG_DBG("Count(%d)", (MINT32) Count);
-	return ((ssize_t)Count);
+	LOG_ERR("ISP_RegDebug: Not implement");
+	return 0;
 }
 
-static MUINT32 proc_regOfst;
 static ssize_t CAMIO_DumpRegToProc(struct file *pPage,
 				char __user *pBuffer, size_t Count, loff_t *off)
 {
-	char *p = (char*)pPage;
-           char **ppStart=NULL;
-	long Length = 0;
-	long ret = 0;
-
-	LOG_DBG("pPage(%p),off(0x%lx),Count(%ld)", pPage, (unsigned long)off, (long int)Count);
-
-	p += sprintf(p, "reg_0x%08X = 0x%X\n", (unsigned int)(ISP_ADDR_CAMINF + proc_regOfst),
-		     ioread32((void*)(ISP_ADDR_CAMINF + proc_regOfst)));
-
-	*ppStart = (char*)((unsigned long)pPage + (unsigned long)off);
-
-	Length = (long)((unsigned long)p - (unsigned long)pPage);
-	if (Length > (long)off) {
-		Length -= (long)off;
-	} else {
-		Length = 0;
-	}
-
-	/*  */
-	ret = Length < Count ? Length : Count;
-
-	/*LOG_DBG("ret(%ld)", ret);*/
-	return ((ssize_t)ret);
+	LOG_ERR("CAMIO_DumpRegToProc: Not implement");
+	return 0;
 }
 
 /*******************************************************************************
@@ -6311,33 +6201,8 @@ static ssize_t CAMIO_DumpRegToProc(struct file *pPage,
 static ssize_t CAMIO_RegDebug(struct file *pFile,
 			     const char __user*pBuffer, size_t Count, loff_t *p_off)
 {
-	char RegBuf[64];
-	MUINT32 CopyBufSize = (Count < (sizeof(RegBuf) - 1)) ? (Count) : (sizeof(RegBuf) - 1);
-#if 0
-	MUINT32 Addr = 0;
-	MUINT32 Data = 0;
-#endif
-	LOG_DBG("pFile(%p),pBuffer(%p),Count(%ld)", pFile, pBuffer, (long int)Count);
-
-	if (copy_from_user(RegBuf, pBuffer, CopyBufSize)) {
-		LOG_ERR("copy_from_user() fail.");
-		return -EFAULT;
-	}
-#if 0
-	if (sscanf(RegBuf, "%x %x", &Addr, &Data) == 2) {
-		proc_regOfst = Addr;
-		/* ISP_WR32((void *)(GPIO_BASE + Addr), Data); //TODO: Must fixed by Device tree */
-		LOG_ERR("Write => Addr: 0x%08X, Write Data: 0x%08X. Read Data: 0x%08X.",
-			GPIO_BASE + Addr, Data, ioread32((GPIO_BASE + Addr)));
-	} else if (sscanf(RegBuf, "%x", &Addr) == 1) {
-		proc_regOfst = Addr;
-		LOG_ERR("Read => Addr: 0x%08X, Read Data: 0x%08X.", GPIO_BASE + Addr,
-			ioread32((GPIO_BASE + Addr)));
-	}
-#endif
-
-	LOG_DBG("Count(%ld)", (long int) Count);
-	return ((ssize_t)Count);
+	LOG_ERR("CAMIO_RegDebug: Not implement");
+	return 0;
 }
 
 /*******************************************************************************

drivers/misc/mediatek/cameraisp/src/mt6735/camera_sysram_D1.c

@@ -1110,169 +1110,40 @@ static struct platform_driver SysramPlatformDriver = {
 /*
 ssize_t (*read) (struct file *, char __user *, size_t, loff_t *)
 */
-#define USE_OLD_STYPE_1117 0
-#if USE_OLD_STYPE_1117
-static int SYSRAM_DumpLayoutToProc(
-	char *pPage,
-	char **ppStart,
-	off_t   Off,
-	int     Count,
-	int *pEof,
-	void *pData)
-#else /* new file_operations style */
 static ssize_t SYSRAM_DumpLayoutToProc(
 	struct file *pFile,
 	char *pStart,
 	size_t Off,
 	loff_t *Count)
-#endif
 {
-#if USE_OLD_STYPE_1117
-	char *p = pPage;
-	MUINT32 len = 0;
-	MUINT32 Index = 0;
-	SYSRAM_MEM_NODE_STRUCT *pCurrNode = NULL;
-
-	p += sprintf(p, "\n[SYSRAM_DumpLayoutToProc]\n");
-	p += sprintf(p, "AllocatedTbl = 0x%08lX\n", Sysram.AllocatedTbl);
-	p += sprintf(p, "=========================================\n");
-	for (Index = 0; Index < SYSRAM_MEM_BANK_AMOUNT; Index++) {
-		p += sprintf(p, "\n [Mem Pool %ld] (IndexTbl, UserCount)=(%lX, %ld)\n",
-						Index,
-						SysramMemPoolInfo[Index].IndexTbl,
-						SysramMemPoolInfo[Index].UserCount);
-		p += sprintf(p, "[Locked Time] [Owner   Offset   Size  Index pCurrent pPrevious pNext]\n");
-		p += sprintf(p, "  [pid tgid] [Proc Name / Owner Name]\n");
-		pCurrNode = &SysramMemPoolInfo[Index].pMemNode[0];
-		while (NULL != pCurrNode) {
-			SYSRAM_USER_ENUM const User = pCurrNode->User;
-			if (SYSRAM_IsBadOwner(User)) {
-				p += sprintf(p,
-					"------------ --------"
-					" %2d\t0x%05lX 0x%05lX  %ld    %p %p\t%p\n",
-					(int)(pCurrNode->User),
-					pCurrNode->Offset,
-					pCurrNode->Length,
-					pCurrNode->Index,
-					pCurrNode,
-					pCurrNode->pPrev,
-					pCurrNode->pNext
-				);
-			} else{
-				SYSRAM_USER_STRUCT * const pUserInfo = &Sysram.UserInfo[User];
-				p += sprintf(p,
-					"%5lu.%06lu "
-					" %2d\t0x%05lX 0x%05lX  %ld    %p %p\t%p"
-					" %-4d %-4d \"%s\" / \"%s\"\n",
-					pUserInfo->TimeS,
-					pUserInfo->TimeUS,
-					User,
-					pCurrNode->Offset,
-					pCurrNode->Length,
-					pCurrNode->Index,
-					pCurrNode,
-					pCurrNode->pPrev,
-					pCurrNode->pNext,
-					pUserInfo->pid,
-					pUserInfo->tgid,
-					pUserInfo->ProcName,
-					SysramUserName[User]);
-			}
-			pCurrNode = pCurrNode->pNext;
-		};
-	}
-
-	*ppStart = pPage + Off;
-	len = p - pPage;
-	if (len > Off)
-		len -= Off;
-	else
-		len = 0;
-
-	return len < Count ? len : Count;
-#else /* new file_operations style */
 	LOG_ERR("SYSRAM_DumpLayoutToProc: Not implement");
 	return 0;
-#endif
 }
 /* ------------------------------------------------------------------------------ */
 /*
 ssize_t (*read) (struct file *, char __user *, size_t, loff_t *)
 */
-#define USE_OLD_STYPE_1206 0
-#if USE_OLD_STYPE_1206
-static int SYSRAM_ReadFlag(
-	char *pPage,
-	char **ppStart,
-	off_t   Off,
-	int     Count,
-	int *pEof,
-	void *pData)
-#else /* new file_operations style */
 static ssize_t SYSRAM_ReadFlag(
 	struct file *pFile,
 	char *pStart,
 	size_t  Off,
 	loff_t *Count)
-#endif
 {
-#if USE_OLD_STYPE_1206
-	char *p = pPage;
-	MUINT32 len = 0;
-
-	p += sprintf(p, "\r\n[SYSRAM_ReadFlag]\r\n");
-	p += sprintf(p, "=========================================\r\n");
-	p += sprintf(p, "Sysram.DebugFlag = 0x%08lX\r\n", Sysram.DebugFlag);
-
-	*ppStart = pPage + Off;
-
-	len = p - pPage;
-	if (len > Off)
-		len -= Off;
-	else
-		len = 0;
-
-	return len < Count ? len  : Count;
-#else /* new file_operations style */
 	LOG_ERR("SYSRAM_ReadFlag: Not implement");
 	return 0;
-#endif
 }
 /* ------------------------------------------------------------------------------ */
 /*
 ssize_t (*write) (struct file *, const char __user *, size_t, loff_t *)
 */
-#define USE_OLD_STYPE_1249 0
-#if USE_OLD_STYPE_1249
-static int SYSRAM_WriteFlag(
-	struct file *pFile,
-	const char *pBuffer,
-	unsigned long   Count,
-	void *pData)
-#else /* new file_operations style */
 static ssize_t SYSRAM_WriteFlag(
 	struct file *pFile,
 	const char *pBuffer,
 	size_t Count,
 	loff_t *pData)
-#endif
 {
-#if USE_OLD_STYPE_1249
-	char acBuf[32];
-	MUINT32 u4CopySize = 0;
-	MUINT32 u4SysramDbgFlag = 0;
-
-	u4CopySize = (Count < (sizeof(acBuf) - 1)) ? Count : (sizeof(acBuf) - 1);
-	if (copy_from_user(acBuf, pBuffer, u4CopySize))
-		return 0;
-	acBuf[u4CopySize] = '\0';
-	if (3 == sscanf(acBuf, "%lx", &u4SysramDbgFlag))
-		Sysram.DebugFlag = u4SysramDbgFlag;
-	return Count;
-#else /* new file_operations style */
 	LOG_ERR("SYSRAM_WriteFlag: Not implement");
 	return 0;
-#endif
 }
 /*******************************************************************************
 *

drivers/misc/mediatek/cameraisp/src/mt6735/camera_sysram_D2.c

@@ -1268,112 +1268,24 @@ static struct platform_driver SysramPlatformDriver = {
 static ssize_t SYSRAM_DumpLayoutToProc(struct file *pPage,
 				char __user *pBuffer, size_t Count, loff_t *Off)
 {
-	char *p = (char*)pPage;
-           char** ppStart=NULL;
-	long len = 0;
-	MUINT32 Index = 0;
-           long ret = 0;
-	SYSRAM_MEM_NODE_STRUCT *pCurrNode = NULL;
-	/*  */
-	p += sprintf(p, "\n[SYSRAM_DumpLayoutToProc]\n");
-	p += sprintf(p, "AllocatedTbl = 0x%08lX\n", Sysram.AllocatedTbl);
-	p += sprintf(p, "=========================================\n");
-	for (Index = 0; Index < SYSRAM_MEM_BANK_AMOUNT; Index++) {
-		p += sprintf(p, "\n [Mem Pool %ld] (IndexTbl, UserCount)=(%lX, %ld)\n",
-			     Index,
-			     SysramMemPoolInfo[Index].IndexTbl, SysramMemPoolInfo[Index].UserCount);
-		p += sprintf(p,
-			     "[Locked Time] [Owner   Offset   Size  Index pCurrent pPrevious pNext]  [pid tgid] [Proc Name / Owner Name]\n");
-		pCurrNode = &SysramMemPoolInfo[Index].pMemNode[0];
-		while (NULL != pCurrNode) {
-			SYSRAM_USER_ENUM const User = pCurrNode->User;
-			if (SYSRAM_IsBadOwner(User)) {
-				p += sprintf(p,
-					     "------------ --------"
-					     " %2d\t0x%05lX 0x%05lX  %ld    %p %p\t%p\n",
-					     pCurrNode->User,
-					     pCurrNode->Offset,
-					     pCurrNode->Length,
-					     pCurrNode->Index,
-					     pCurrNode, pCurrNode->pPrev, pCurrNode->pNext);
-			} else {
-				SYSRAM_USER_STRUCT * const pUserInfo = &Sysram.UserInfo[User];
-				p += sprintf(p,
-					     "%5lu.%06lu"
-					     " %2d\t0x%05lX 0x%05lX  %ld    %p %p\t%p"
-					     "  %-4d %-4d \"%s\" / \"%s\"\n",
-					     pUserInfo->TimeS,
-					     pUserInfo->TimeUS,
-					     User,
-					     pCurrNode->Offset,
-					     pCurrNode->Length,
-					     pCurrNode->Index,
-					     pCurrNode,
-					     pCurrNode->pPrev,
-					     pCurrNode->pNext,
-					     pUserInfo->pid,
-					     pUserInfo->tgid,
-					     pUserInfo->ProcName, SysramUserName[User]);
-			}
-			pCurrNode = pCurrNode->pNext;
-		};
-	}
-	/*  */
-	*ppStart = (char*)((unsigned long)pPage + (unsigned long)Off);
-	len = (MUINT32)((unsigned long)p - (unsigned long)pPage);
-	if (len > (long)Off) {
-		len -= (long)Off;
-	} else {
-		len = 0;
-	}
-           ret = len < Count ? len : Count;
-	/*  */
-	return ((ssize_t)(ret));
+	LOG_ERR("SYSRAM_DumpLayoutToProc: Not implement");
+	return 0;
 }
 
 /* ------------------------------------------------------------------------------ */
 static ssize_t SYSRAM_ReadFlag(struct file *pPage,
 				char __user *pBuffer, size_t Count, loff_t *Off)
 {
-	char *p = (char*)pPage;
-           char** ppStart=NULL;
-	long len = 0;
-           long ret = 0;
-	/*  */
-	p += sprintf(p, "\r\n[SYSRAM_ReadFlag]\r\n");
-	p += sprintf(p, "=========================================\r\n");
-	p += sprintf(p, "Sysram.DebugFlag = 0x%08lX\r\n", Sysram.DebugFlag);
-
-	*ppStart = (char*)((unsigned long)pPage + (unsigned long)Off);
-
-	len = (long)((unsigned long)p - (unsigned long)pPage);
-	if (len > (long)Off) {
-		len -= (long)Off;
-	} else {
-		len = 0;
-	}
-	ret = len < Count ? len : Count;
-	/*  */
-	return ((ssize_t)(ret));
+	LOG_ERR("SYSRAM_ReadFlag: Not implement");
+	return 0;
 }
 
 /* ------------------------------------------------------------------------------ */
 static ssize_t SYSRAM_WriteFlag(struct file *pFile,
 			    const char __user *pBuffer, size_t Count, loff_t *p_off)
 {
-	char acBuf[32];
-	MUINT32 u4CopySize = 0;
-	MUINT32 u4SysramDbgFlag = 0;
-	/*  */
-	u4CopySize = (Count < (sizeof(acBuf) - 1)) ? Count : (sizeof(acBuf) - 1);
-	if (copy_from_user(acBuf, pBuffer, u4CopySize)) {
-		return 0;
-	}
-	acBuf[u4CopySize] = '\0';
-	if (3 == sscanf(acBuf, "%lx", &u4SysramDbgFlag)) {
-		Sysram.DebugFlag = u4SysramDbgFlag;
-	}
-	return ((ssize_t)Count);
+	LOG_ERR("SYSRAM_WriteFlag: Not implement");
+	return 0;
 }
 
 /*******************************************************************************

drivers/misc/mediatek/ccci_util/ccci_util_lib_sys.c

@@ -1,3 +1,16 @@
+/*
+*Copyright(C)2017 MediaTek Inc.
+*
+*This program is free software;you can redistribute it and/or modify it under
+*the terms of the GNU General Public License version 2 as published by the
+*Free Software Foundation.
+*
+*This program is distributed in the hope that it will be useful,but WITHOUT
+*ANY WARRANTY;without even the implied warranty of MERCHANTABILITY or FITNESS
+*FOR A PARTICULAR PURPOSE.
+*See http://www.gnu.org/licenses/gpl-2.0.html for more details.
+*/
+
 #include <mt-plat/sync_write.h>
 #include <mt-plat/mt_ccci_common.h>
 #include <linux/slab.h>
@@ -176,330 +189,6 @@ static ssize_t debug_enable_store(const char *buf, size_t count)
 
 CCCI_ATTR(debug, 0660, &debug_enable_show, &debug_enable_store);
 
-/* Sys -- Runtime register debug */
-static char aat_cmd[32];
-static unsigned long aat_para[8];
-static void __iomem *aat_runtime_map_base_vir;
-static phys_addr_t aat_runtime_map_base_phy;
-static unsigned int aat_err_no;
-static char aat_err_str[64];
-static int aat_show_case;
-static unsigned long ast_dump_start_addr;
-static unsigned long ast_dump_size;
-static unsigned long ast_dump_width;
-static unsigned char read8(unsigned char *addr)
-{
-	return ioread8((void __iomem *)addr);
-}
-
-static unsigned short read16(unsigned short *addr)
-{
-	return ioread16((void __iomem *)addr);
-}
-
-static unsigned int read32(unsigned int *addr)
-{
-	return ioread32((void __iomem *)addr);
-}
-
-static void aat_write(unsigned long base, unsigned long val, unsigned long width)
-{
-	switch (width) {
-	case 4L:
-		mt_reg_sync_writel(val, base);
-		break;
-	case 2L:
-		mt_reg_sync_writew(val, base);
-		break;
-	default:
-		mt_reg_sync_writeb(val, base);
-		break;
-	}
-}
-
-static int dump_line_with_8(unsigned long addr, char buf[], int num, int size)
-{
-	int i, ch_in_line = 0;
-	unsigned char tmp;
-	unsigned long tag_addr =
-	    addr - ((unsigned long)aat_runtime_map_base_vir) + ((unsigned long)aat_runtime_map_base_phy);
-
-	ch_in_line += snprintf(&buf[ch_in_line], size - ch_in_line, "[0x%016lX] ", tag_addr);
-	for (i = 0; i < num; i++) {
-		tmp = read8((unsigned char *)(addr + i));
-		ch_in_line += snprintf(&buf[ch_in_line], size - ch_in_line, "%02x ", tmp);
-	}
-	ch_in_line += snprintf(&buf[ch_in_line], size - ch_in_line, "\n");
-	return ch_in_line;
-}
-
-static int dump_line_with_16(unsigned long addr, char buf[], int num, int size)
-{
-	int i, ch_in_line = 0;
-	unsigned short tmp;
-	unsigned long tag_addr =
-	    addr - ((unsigned long)aat_runtime_map_base_vir) + ((unsigned long)aat_runtime_map_base_phy);
-
-	ch_in_line += snprintf(&buf[ch_in_line], size - ch_in_line, "[0x%016lX] ", tag_addr);
-	for (i = 0; i < num; i += 2) {
-		tmp = read16((unsigned short *)(addr + i));
-		ch_in_line += snprintf(&buf[ch_in_line], size - ch_in_line, "%04x ", tmp);
-	}
-	ch_in_line += snprintf(&buf[ch_in_line], size - ch_in_line, "\n");
-	return ch_in_line;
-}
-
-static int dump_line_with_32(unsigned long addr, char buf[], int num, int size)
-{
-	int i, ch_in_line = 0;
-	unsigned int tmp;
-	unsigned long tag_addr =
-	    addr - ((unsigned long)aat_runtime_map_base_vir) + ((unsigned long)aat_runtime_map_base_phy);
-
-	ch_in_line += snprintf(&buf[ch_in_line], size - ch_in_line, "[0x%016lX] ", tag_addr);
-
-	for (i = 0; i < num; i += 4) {
-		tmp = read32((unsigned int *)(addr + i));
-		ch_in_line += snprintf(&buf[ch_in_line], size - ch_in_line, "%08x ", tmp);
-	}
-	ch_in_line += snprintf(&buf[ch_in_line], size - ch_in_line, "\n");
-	return ch_in_line;
-}
-
-static int runtime_reg_dump(unsigned long start_addr, unsigned int size, unsigned int access_width, char out_buf[])
-{
-	unsigned int i, buf_idx, dump_num_in_line, has_dumped;
-	int (*rd_func)(unsigned long, char *, int, int);
-	unsigned long curr_addr;
-
-	if (size > 4096)
-		size = 4096;
-
-	switch (access_width) {
-	case 4:
-		rd_func = dump_line_with_32;
-		size = ((size + 3) & (~0x3));
-		break;
-	case 2:
-		rd_func = dump_line_with_16;
-		size = ((size + 1) & (~0x1));
-		break;
-	default:		/* means 1 */
-		rd_func = dump_line_with_8;
-		break;
-	}
-
-	curr_addr = start_addr;
-	buf_idx = 0;
-	dump_num_in_line = 0;
-	has_dumped = 0;
-
-	for (i = 0; i < size; i += 16) {
-		dump_num_in_line = size - has_dumped;
-		if (dump_num_in_line > 16)
-			dump_num_in_line = 16;
-		buf_idx += rd_func(curr_addr, &out_buf[buf_idx], dump_num_in_line, 4096 - buf_idx);
-		curr_addr += dump_num_in_line;
-		has_dumped += dump_num_in_line;
-	}
-
-	return buf_idx;
-}
-
-static int command_parser(const char *input_str, char cmd[], unsigned long out_put[])
-{
-	int i = 0, j, k;
-	char tmp_buf[32];
-	char filter_str[256];
-	int temp_valu;
-
-	/* Filter out 0xD and 0xA */
-	j = 0;
-	i = 0;
-	while ((i < 256) && (input_str[i] != '\0')) {
-		if ((input_str[i] == 0xD) || (input_str[i] == 0xA)) {
-			i++;
-			continue;
-		}
-		filter_str[j] = input_str[i];
-		i++;
-		j++;
-	}
-	filter_str[j] = '\0';
-
-	i = 0;
-	/* Parse command */
-	if (filter_str[i] == '\0')
-		return 0;
-	j = 0;
-	while (filter_str[i] != '\0') {
-		if (filter_str[i] != '_') {
-			cmd[j] = filter_str[i];
-			j++;
-			i++;
-		} else {
-			i++;
-			break;
-		}
-	}
-	cmd[j] = '\0';
-
-	/* Parse parameters */
-	for (k = 0; k < 4; k++) {
-		if (filter_str[i] == '\0')
-			return k + 1;
-		j = 0;
-		while (filter_str[i] != '\0') {
-			if (filter_str[i] != '_') {
-				tmp_buf[j] = filter_str[i];
-				j++;
-				i++;
-			} else {
-				i++;
-				break;
-			}
-		}
-		tmp_buf[j] = '\0';
-		/* change string to number */
-		temp_valu = kstrtoul(tmp_buf, 16, &out_put[k]);
-		if (temp_valu < 0)
-			CCCI_UTIL_ERR_MSG("sscanf return fail: %d\n", temp_valu);
-	}
-
-	return k + 1;
-}
-
-static void cmd_process(char cmd[], unsigned long para[], int para_num)
-{
-	if ((para_num == 2) && (strcmp(cmd, "IOR") == 0)) {
-		CCCI_UTIL_DBG_MSG("Command:%s, Base addr:0x%p\n", cmd, (void *)para[0]);
-		/* Do IO-REMAP here */
-		if (aat_runtime_map_base_vir == NULL) {
-			aat_runtime_map_base_vir = ioremap_nocache((phys_addr_t) para[0], 4096);
-			if (aat_runtime_map_base_vir == NULL) {
-				snprintf(aat_err_str, 64, "Map phy addr:0x%p fail\n", (void *)para[0]);
-				aat_err_no = 0x00002100;
-			} else {
-				snprintf(aat_err_str, 64, "Map phy addr:0x%p OK\n", (void *)para[0]);
-				aat_err_no = 0x00001000;
-				aat_runtime_map_base_phy = (phys_addr_t) para[0];
-			}
-		} else {
-			snprintf(aat_err_str, 64, "Please Un-map phy addr:0x%pa\n", &aat_runtime_map_base_phy);
-			aat_err_no = 0x00002100;
-		}
-		aat_show_case = 0;	/*Error info */
-	} else if ((para_num == 4) && (strcmp(cmd, "WR") == 0)) {
-		CCCI_UTIL_DBG_MSG("Command:%s, Offset:0x%p, value:0x%p, type:0x%p\n", cmd, (void *)para[0],
-				  (void *)para[1], (void *)para[2]);
-		/* Do write operation here */
-		if (aat_runtime_map_base_vir != NULL) {
-			if (para[0] >= 4096L) {
-				snprintf(aat_err_str, 64, "Offset should less than 4096\n");
-				aat_err_no = 0x00002100;
-			} else {
-				aat_write(((unsigned long)aat_runtime_map_base_vir) + para[0], para[1], para[2]);
-				snprintf(aat_err_str, 64, "Write phy addr:0x%p OK\n",
-					 (void *)((unsigned long)aat_runtime_map_base_phy + para[0]));
-				aat_err_no = 0x00001000;
-			}
-		} else {
-			snprintf(aat_err_str, 64, "Please do io map first\n");
-			aat_err_no = 0x00002100;
-		}
-		aat_show_case = 0;	/*Error info */
-	} else if ((para_num == 4) && (strcmp(cmd, "QUERY") == 0)) {
-		CCCI_UTIL_DBG_MSG("Command:%s, Offset:0x%p, value:0x%p, type:0x%p\n", cmd, (void *)para[0],
-				  (void *)para[1], (void *)para[2]);
-		/* Do read operation here */
-		if (aat_runtime_map_base_vir != NULL) {
-			if (para[0] >= 4096L) {
-				snprintf(aat_err_str, 64, "Offset should less than 4096\n");
-				aat_err_no = 0x00002100;
-				aat_show_case = 0;	/*Error info */
-			} else if ((para[0] + para[1]) > 4096L) {
-				snprintf(aat_err_str, 64, "Offset + Size should less than 4096\n");
-				aat_err_no = 0x00002100;
-				aat_show_case = 0;	/*Error info */
-			} else {
-				snprintf(aat_err_str, 64, "Query offset:0x%p size:0x%p OK\n", (void *)para[0],
-					 (void *)para[1]);
-				ast_dump_start_addr = (unsigned long)aat_runtime_map_base_vir + para[0];
-				ast_dump_size = para[1];
-				ast_dump_width = para[2];
-				aat_err_no = 0x00001000;
-				aat_show_case = 1;	/*Dump data */
-			}
-		} else {
-			snprintf(aat_err_str, 64, "Please do io map first\n");
-			aat_err_no = 0x00002100;
-			aat_show_case = 0;	/*Error info */
-		}
-	} else if ((para_num == 1) && (strcmp(cmd, "IOU") == 0)) {
-		CCCI_UTIL_DBG_MSG("Command:%s\n", cmd);
-		/* Do IO-UNMAP here */
-		if (aat_runtime_map_base_vir != NULL) {
-			iounmap(aat_runtime_map_base_vir);
-			aat_runtime_map_base_vir = NULL;
-			snprintf(aat_err_str, 64, "IO Un-map phy addr:0x%pa OK\n", &aat_runtime_map_base_phy);
-			aat_err_no = 0x00001000;
-		} else {
-			snprintf(aat_err_str, 64, "No need Un-map\n");
-			aat_err_no = 0x00001000;
-		}
-		aat_show_case = 0;	/*Error info */
-	} else if ((para_num == 1) && (strcmp(cmd, "MDFU") == 0)) {	/*MD Force Unlock */
-		CCCI_UTIL_DBG_MSG("Command:%s\n", cmd);
-		/* Do Un-lock operation here, unlock sleep/clock here */
-		snprintf(aat_err_str, 64, "Force MD un-lock\n");
-#ifndef FEATURE_FPGA_PORTING
-		spm_ap_mdsrc_req(0);
-#endif
-		aat_err_no = 0x00001000;
-		aat_show_case = 0;	/*Error info */
-	} else if ((para_num == 1) && (strcmp(cmd, "MDFL") == 0)) {	/*MD Force Lock */
-		CCCI_UTIL_DBG_MSG("Command:%s\n", cmd);
-		/* Do lock operation here, unlock sleep/clock here */
-		snprintf(aat_err_str, 64, "Force MD lock\n");
-#ifndef FEATURE_FPGA_PORTING
-		spm_ap_mdsrc_req(1);
-#endif
-		aat_err_no = 0x00001000;
-		aat_show_case = 0;	/*Error info */
-	} else {
-		CCCI_UTIL_ERR_MSG("In-valid command:%s and parameter number:%d\n", cmd, para_num);
-		snprintf(aat_err_str, 64, "In-valid command:%s and parameter number:%d\n", cmd, para_num);
-		aat_show_case = 0;	/*Error info */
-	}
-}
-
-static ssize_t aat_show(char *buf)
-{
-	unsigned int curr = 0;
-	unsigned int dump_size;
-
-	curr = snprintf(buf, 4096, "0x%08x: %s\n", (unsigned int)aat_err_no, aat_err_str);
-
-	if (aat_show_case == 1) {
-		dump_size = 4096 - curr;
-		if (dump_size > ((unsigned int)ast_dump_size))
-			dump_size = (unsigned int)ast_dump_size;
-		curr += runtime_reg_dump(ast_dump_start_addr, dump_size, (unsigned int)ast_dump_width, &buf[curr]);
-	}
-
-	return (ssize_t) curr;
-}
-
-static ssize_t aat_store(const char *buf, size_t count)
-{
-	int para_num = command_parser(buf, aat_cmd, aat_para);
-
-	cmd_process(aat_cmd, aat_para, para_num);
-	return count;
-}
-
-CCCI_ATTR(aat, 0600, &aat_show, &aat_store);
-
 static ssize_t kcfg_setting_show(char *buf)
 {
 	unsigned int curr = 0;
@@ -562,7 +251,6 @@ static struct attribute *ccci_default_attrs[] = {
 	&ccci_attr_version.attr,
 	&ccci_attr_md_en.attr,
 	&ccci_attr_debug.attr,
-	&ccci_attr_aat.attr,
 	&ccci_attr_kcfg_setting.attr,
 	NULL
 };

drivers/misc/mediatek/debug_latch/lastbus/lastbus.c

@@ -1,3 +1,16 @@
+/*
+ * Copyright (C) 2016 MediaTek Inc.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
+ * See http://www.gnu.org/licenses/gpl-2.0.html for more details.
+ */
+
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/device.h>
@@ -226,18 +239,6 @@ static ssize_t lastbus_test_show(struct device_driver *driver, char *buf)
 
 static ssize_t lastbus_test_store(struct device_driver *driver, const char *buf, size_t count)
 {
-	struct lastbus_plt *plt = lastbus_drv.cur_plt;
-	char *p = (char *)buf;
-	unsigned long num = 0;
-
-	if (kstrtoul(p, 10, &num) != 0) {
-		pr_err("%s:%d: kstrtoul fail for %s\n", __func__, __LINE__, p);
-		return 0;
-	}
-
-	if (plt && plt->ops && (plt->ops->test(plt, num) != 0))
-		pr_err("%s:%d: test failed\n", __func__, __LINE__);
-
 	return count;
 }
 

drivers/misc/mediatek/eccci/ccci_core.c

@@ -541,6 +541,13 @@ int exec_ccci_kern_func_by_md_id(int md_id, unsigned int id, char *buf, unsigned
 	case ID_DUMP_MD_SLEEP_MODE:
 		md->ops->dump_info(md, DUMP_FLAG_SMEM_MDSLP, NULL, 0);
 		break;
+	case ID_MD_RF_DESENSE:
+		if (buf == NULL)
+			CCCI_ERR_MSG(md->index, CHAR, "%ps,ID_MD_RF_DESENSE buf is null\n",
+				__builtin_return_address(0));
+		else
+			ret = ccci_update_rf_desense(md, buf[0]);
+		break;
 	default:
 		ret = -CCCI_ERR_FUNC_ID_ERROR;
 		break;

drivers/misc/mediatek/eccci/ccci_core.h

@@ -777,6 +777,8 @@ struct ccci_modem {
 	unsigned int sim_type;
 	unsigned int sbp_code;
 	unsigned int sbp_code_default;
+	unsigned int rf_desense;
+	unsigned int is_forced_assert;
 	unsigned char critical_user_active[4];
 	unsigned int md_img_exist[MAX_IMG_NUM];
 	struct platform_device *plat_dev;
@@ -892,7 +894,8 @@ static inline void ccci_chk_rx_seq_num(struct ccci_modem *md, struct ccci_header
 	seq_num = ccci_h->seq_num;
 	assert_bit = ccci_h->assert_bit;
 
-	if (assert_bit && md->seq_nums[IN][channel] != 0 && ((seq_num - md->seq_nums[IN][channel]) & 0x7FFF) != 1) {
+	if (md->is_forced_assert == 0 &&
+		assert_bit && md->seq_nums[IN][channel] != 0 && ((seq_num - md->seq_nums[IN][channel]) & 0x7FFF) != 1) {
 		CCCI_ERR_MSG(md->index, CORE, "channel %d seq number out-of-order %d->%d\n",
 			     channel, seq_num, md->seq_nums[IN][channel]);
 		md->ops->dump_info(md, DUMP_FLAG_CLDMA, NULL, qno);
@@ -1016,7 +1019,7 @@ extern void md_bootup_timeout_func(unsigned long data);
 extern void md_status_poller_func(unsigned long data);
 extern void md_status_timeout_func(unsigned long data);
 extern void ccci_subsys_kernel_init(void);
-
+extern int ccci_update_rf_desense(struct ccci_modem *md, int rf_desense);
 /*
  * if recv_request returns 0 or -CCCI_ERR_DROP_PACKET, then it's port's duty to free the request, and caller should
  * NOT reference the request any more. but if it returns other error, caller should be responsible to free the request.

drivers/misc/mediatek/eccci/port_kernel.c

@@ -467,6 +467,23 @@ void dump_pmic_wrap_lte_register(struct ccci_modem *md)
 							*((unsigned int *)pmic_wrap_md_adc_sta2));
 
 }
+
+int ccci_notfiy_md_desense(struct ccci_modem *md)
+{
+	int ret = -1;
+
+	if (md->md_state == READY) {
+		ret =  ccci_send_msg_to_md(md, CCCI_SYSTEM_TX, MD_RF_DESENSE, md->rf_desense, 0);
+		CCCI_INF_MSG(md->index, KERN, "Send desense(%d),ret=%d\n", md->rf_desense, ret);
+	} else
+		CCCI_INF_MSG(md->index, KERN, "Not send desense for md state=%d\n", md->md_state);
+	return ret;
+}
+int ccci_update_rf_desense(struct ccci_modem *md, int rf_desense)
+{
+	md->rf_desense = rf_desense;
+	return ccci_notfiy_md_desense(md);
+}
 /*
  * all supported modems should follow these handshake messages as a protocol.
  * but we still can support un-usual modem by providing cutomed kernel_port_ops.
@@ -504,6 +521,8 @@ static void control_msg_handler(struct ccci_port *port, struct ccci_request *req
 		md->boot_stage = MD_BOOT_STAGE_2;
 		md->ops->broadcast_state(md, READY);
 		ccci_send_virtual_md_msg(md, CCCI_MONITOR_CH, CCCI_MD_MSG_BOOT_READY, 0);
+		if (md->rf_desense)
+			ccci_notfiy_md_desense(md);
 	} else if (ccci_h->data[1] == MD_EX) {
 		if (unlikely(ccci_h->reserved != MD_EX_CHK_ID)) {
 			CCCI_ERR_MSG(md->index, KERN, "receive invalid MD_EX\n");

drivers/misc/mediatek/hwmon/hwmsen/hwmsen_dev.c

@@ -594,6 +594,12 @@ static int hwmsen_enable(struct hwmdev_object *obj, int sensor, int enable)
 
 	sensor_type = 1LL << sensor;
 
+
+	if (sensor > MAX_ANDROID_SENSOR_NUM || sensor < 0) {
+		HWM_ERR("handle %d!\n", sensor);
+		return -EINVAL;
+	}
+
 	if (!obj) {
 		HWM_ERR("hwmdev obj pointer is NULL!\n");
 		return -EINVAL;
@@ -609,7 +615,6 @@ static int hwmsen_enable(struct hwmdev_object *obj, int sensor, int enable)
 	mutex_lock(&obj->dc->lock);
 	cxt = obj->dc->cxt[sensor];
 
-
 	if (enable == 1) {
 		/*{@for mt6582 blocking issue work around*/
 		if (sensor == 7) {
@@ -712,6 +717,11 @@ static int hwmsen_enable_nodata(struct hwmdev_object *obj, int sensor, int enabl
 	HWM_FUN(f);
 	sensor_type = 1LL << sensor;
 
+	if (sensor > MAX_ANDROID_SENSOR_NUM || sensor < 0) {
+		HWM_ERR("handle %d!\n", sensor);
+		return -EINVAL;
+	}
+
 	if (NULL == obj) {
 		HWM_ERR("hwmdev obj pointer is NULL!\n");
 		return -EINVAL;
@@ -720,7 +730,6 @@ static int hwmsen_enable_nodata(struct hwmdev_object *obj, int sensor, int enabl
 		return -ENODEV;
 	}
 
-
 	if (sensor > MAX_ANDROID_SENSOR_NUM) {
 		HWM_ERR("sensor %d!\n", sensor);
 		return -EINVAL;
@@ -771,6 +780,11 @@ static int hwmsen_set_delay(int delay, int handle)
 	int err = 0;
 	struct hwmsen_context *cxt = NULL;
 
+	if (handle > MAX_ANDROID_SENSOR_NUM || handle < 0) {
+		HWM_ERR("handle %d!\n", handle);
+		return -EINVAL;
+	}
+
 	if (handle > MAX_ANDROID_SENSOR_NUM) {
 		HWM_ERR("handle %d!\n", handle);
 		return -EINVAL;

drivers/misc/mediatek/include/mt-plat/mt_ccci_common.h

@@ -667,7 +667,7 @@ enum {
 	ID_RESET_MD = 14,			/* for SVLTE MD3 reset MD1 */
 	ID_DUMP_MD_REG = 15,
 	ID_DUMP_MD_SLEEP_MODE = 16, /* for dump MD debug info from SMEM when AP sleep */
-
+	ID_MD_RF_DESENSE = 17, /* Notify MD camera on/off will affect MD RF */
 	ID_UPDATE_TX_POWER = 100,   /* for SWTP */
 
 };
@@ -730,7 +730,7 @@ enum {
 	MD_SW_MD2_TX_POWER = 0x10F,
 	MD_SW_MD1_TX_POWER_REQ = 0x110,
 	MD_SW_MD2_TX_POWER_REQ = 0x111,
-
+	MD_RF_DESENSE = 0x113,
 	/*c2k ctrl msg start from 0x200*/
 	C2K_STATUS_IND_MSG = 0x201, /* for usb bypass */
 	C2K_STATUS_QUERY_MSG = 0x202, /* for usb bypass */

drivers/misc/mediatek/videocodec/include/vcodec_if_v2.h

@@ -44,6 +44,7 @@ typedef struct {
 typedef enum {
 	VCODEC_COLOR_FORMAT_YUV420,
 	VCODEC_COLOR_FORMAT_YV12,
+	VCODEC_COLOR_FORMAT_NV12,
 } VCODEC_COLOR_FORMAT_T;
 
 typedef struct {
@@ -724,6 +725,17 @@ typedef enum {
 	VCODEC_ENC_PARAM_VPX_MODE,
 	VCODEC_ENC_PARAM_VPX_CPU_USED,
 	VCODEC_ENC_PARAM_YUV_STRIDE,
+	VCODEC_ENC_PARAM_SET_EC_MODE, /* set entropy coding mode, 0: CAVLC, 1: CABAC */
+	VCODEC_ENC_PARAM_LCU_SIZE,
+	VCODEC_ENC_PARAM_INTERLACE,
+	VCODEC_ENC_PARAM_AUTO_KEY,
+	VCODEC_ENC_PARAM_BITS_PER_SLICE,
+	VCODEC_ENC_PARAM_COMPLEXITY,
+	VCODEC_ENC_PARAM_COMPLEXITY_INTRA,
+	VCODEC_ENC_PARAM_REF_DISTANCE,
+	VCODEC_ENC_PARAM_QUALIFY,
+	VCODEC_ENC_PARAM_ADAPTIVEDROP,
+	VCODEC_ENC_PARAM_PREPEND_HEADER,
 	NUM_OF_ENC_PARAM_TYPE
 } VCODEC_ENC_PARAM_TYPE_T;
 

drivers/misc/mediatek/videocodec/include/venc_drv_if_private.h

@@ -12,6 +12,7 @@ extern "C" {
 typedef enum __VENC_DRV_COLOR_FORMAT_T {
 	VENC_DRV_COLOR_FORMAT_YUV420,
 	VENC_DRV_COLOR_FORMAT_YV12,
+	VENC_DRV_COLOR_FORMAT_NV12,
 }
 VENC_DRV_COLOR_FORMAT_T;
 

drivers/mmc/host/mediatek/mt6735/dbg.c

@@ -3141,6 +3141,11 @@ static ssize_t msdc_debug_proc_write_DVT(struct file *file, const char __user *b
 	int scan_ret;
 	struct msdc_host *host;
 
+	if (count == 0)
+		return -1;
+	if (count > 255)
+		count = 255;
+
 	ret = copy_from_user(cmd_buf, buf, count);
 	if (ret < 0)
 		return -1;
@@ -3158,11 +3163,11 @@ static ssize_t msdc_debug_proc_write_DVT(struct file *file, const char __user *b
 	}
 
 	host = mtk_msdc_host[i_msdc_id];
-
-	pr_err("[****SD_Debug****] Start Online Tuning DVT test\n");
-	mt_msdc_online_tuning_test(host, 0, 0, 0);
-	pr_err("[****SD_Debug****] Finish Online Tuning DVT test\n");
-
+	if (host) {
+		pr_err("[****SD_Debug****] Start Online Tuning DVT test\n");
+		mt_msdc_online_tuning_test(host, 0, 0, 0);
+		pr_err("[****SD_Debug****] Finish Online Tuning DVT test\n");
+	}
 	return count;
 }
 #endif				/* ONLINE_TUNING_DVTTEST*/
@@ -3352,6 +3357,11 @@ static ssize_t msdc_voltage_proc_write(struct file *file, const char __user *buf
 	int ret;
 	int scan_ret;
 
+	if (count == 0)
+		return -1;
+	if (count > 255)
+		count = 255;
+
 	ret = copy_from_user(cmd_buf, buf, count);
 	if (ret < 0)
 		return -1;
@@ -3404,16 +3414,20 @@ static const struct file_operations msdc_voltage_flag_fops = {
 #endif
 int msdc_debug_proc_init(void)
 {
+#if 0
 	struct proc_dir_entry *prEntry;
 	struct proc_dir_entry *tune;
 	struct proc_dir_entry *tune_flag;
+#endif
 	kuid_t uid;
 	kgid_t gid;
+
 #ifdef MSDC_HQA
 	struct proc_dir_entry *voltage_flag;
 #endif
 	uid = make_kuid(&init_user_ns, 0);
 	gid = make_kgid(&init_user_ns, 1001);
+#if 0
 #ifndef USER_BUILD_KERNEL
 	prEntry = proc_create("msdc_debug", 0660, NULL, &msdc_proc_fops);
 #else
@@ -3457,8 +3471,9 @@ int msdc_debug_proc_init(void)
 	else
 		pr_err("[%s]: failed to create /proc/msdc_DVT\n", __func__);
 #endif
-
+#endif
 	memset(msdc_drv_mode, 0, sizeof(msdc_drv_mode));
+#if 0
 #ifndef USER_BUILD_KERNEL
 	tune = proc_create("msdc_tune", 0660, NULL, &msdc_tune_fops);
 #else
@@ -3479,6 +3494,7 @@ int msdc_debug_proc_init(void)
 		pr_err("[%s]: successfully create /proc/msdc_tune_flag\n", __func__);
 	else
 		pr_err("[%s]: failed to create /proc/msdc_tune_flag\n", __func__);
+#endif
 #ifdef MSDC_HQA
 #ifndef USER_BUILD_KERNEL
 	voltage_flag = proc_create("msdc_voltage_flag", 0660, NULL, &msdc_voltage_flag_fops);

fs/ext4/inode.c

@@ -662,6 +662,20 @@ has_zeroout:
 		ret = check_block_validity(inode, map);
 		if (ret != 0)
 			return ret;
+
+		/*
+		 * Inodes with freshly allocated blocks where contents will be
+		 * visible after transaction commit must be on transaction's
+		 * ordered data list.
+		 */
+		if (map->m_flags & EXT4_MAP_NEW &&
+		    !(map->m_flags & EXT4_MAP_UNWRITTEN) &&
+		    !IS_NOQUOTA(inode) &&
+		    ext4_should_order_data(inode)) {
+			ret = ext4_jbd2_file_inode(handle, inode);
+			if (ret)
+				return ret;
+		}
 	}
 	return retval;
 }
@@ -1141,15 +1155,6 @@ static int ext4_write_end(struct file *file,
 	int i_size_changed = 0;
 
 	trace_ext4_write_end(inode, pos, len, copied);
-	if (ext4_test_inode_state(inode, EXT4_STATE_ORDERED_MODE)) {
-		ret = ext4_jbd2_file_inode(handle, inode);
-		if (ret) {
-			unlock_page(page);
-			page_cache_release(page);
-			goto errout;
-		}
-	}
-
 	if (ext4_has_inline_data(inode)) {
 		ret = ext4_write_inline_data_end(inode, pos, len,
 						 copied, page);

include/asm-generic/bug.h

@@ -45,9 +45,10 @@ struct bug_entry {
  * users don't need to reboot ASAP and can mostly shut down cleanly.
  */
 #ifdef __aarch64__
+#include <asm/memory.h>
 #define BUG() do { \
 	printk("BUG: failure at %s:%d/%s()!\n", __FILE__, __LINE__, __func__); \
-	*((unsigned *)0xdead) = 0x0aee;	\
+	*((unsigned *)(VA_START - 0x10000 + 0xdead)) = 0x0aee;	\
 	unreachable();	\
 } while (0)
 #define HAVE_ARCH_BUG

include/linux/cma.h

@@ -25,6 +25,6 @@ extern int __init cma_declare_contiguous(phys_addr_t base,
 extern int cma_init_reserved_mem(phys_addr_t base,
 					phys_addr_t size, int order_per_bit,
 					struct cma **res_cma);
-extern struct page *cma_alloc(struct cma *cma, int count, unsigned int align);
+extern struct page *cma_alloc(struct cma *cma, size_t count, unsigned int align);
 extern bool cma_release(struct cma *cma, struct page *pages, int count);
 #endif

include/linux/dma-contiguous.h

@@ -111,7 +111,7 @@ static inline int dma_declare_contiguous(struct device *dev, phys_addr_t size,
 	return ret;
 }
 
-struct page *dma_alloc_from_contiguous(struct device *dev, int count,
+struct page *dma_alloc_from_contiguous(struct device *dev, size_t count,
 				       unsigned int order);
 bool dma_release_from_contiguous(struct device *dev, struct page *pages,
 				 int count);
@@ -144,7 +144,7 @@ int dma_declare_contiguous(struct device *dev, phys_addr_t size,
 }
 
 static inline
-struct page *dma_alloc_from_contiguous(struct device *dev, int count,
+struct page *dma_alloc_from_contiguous(struct device *dev, size_t count,
 				       unsigned int order)
 {
 	return NULL;

include/linux/pid.h

@@ -8,7 +8,9 @@ enum pid_type
 	PIDTYPE_PID,
 	PIDTYPE_PGID,
 	PIDTYPE_SID,
-	PIDTYPE_MAX
+	PIDTYPE_MAX,
+	/* only valid to __task_pid_nr_ns() */
+	__PIDTYPE_TGID
 };
 
 /*

include/linux/sched.h

@@ -1901,31 +1901,8 @@ static inline pid_t task_tgid_nr(struct task_struct *tsk)
 	return tsk->tgid;
 }
 
-pid_t task_tgid_nr_ns(struct task_struct *tsk, struct pid_namespace *ns);
-
-static inline pid_t task_tgid_vnr(struct task_struct *tsk)
-{
-	return pid_vnr(task_tgid(tsk));
-}
-
 
 static inline int pid_alive(const struct task_struct *p);
-static inline pid_t task_ppid_nr_ns(const struct task_struct *tsk, struct pid_namespace *ns)
-{
-	pid_t pid = 0;
-
-	rcu_read_lock();
-	if (pid_alive(tsk))
-		pid = task_tgid_nr_ns(rcu_dereference(tsk->real_parent), ns);
-	rcu_read_unlock();
-
-	return pid;
-}
-
-static inline pid_t task_ppid_nr(const struct task_struct *tsk)
-{
-	return task_ppid_nr_ns(tsk, &init_pid_ns);
-}
 
 static inline pid_t task_pgrp_nr_ns(struct task_struct *tsk,
 					struct pid_namespace *ns)
@@ -1950,6 +1927,33 @@ static inline pid_t task_session_vnr(struct task_struct *tsk)
 	return __task_pid_nr_ns(tsk, PIDTYPE_SID, NULL);
 }
 
+static inline pid_t task_tgid_nr_ns(struct task_struct *tsk, struct pid_namespace *ns)
+{
+	return __task_pid_nr_ns(tsk, __PIDTYPE_TGID, ns);
+}
+
+static inline pid_t task_tgid_vnr(struct task_struct *tsk)
+{
+	return __task_pid_nr_ns(tsk, __PIDTYPE_TGID, NULL);
+}
+
+static inline pid_t task_ppid_nr_ns(const struct task_struct *tsk, struct pid_namespace *ns)
+{
+	pid_t pid = 0;
+
+	rcu_read_lock();
+	if (pid_alive(tsk))
+		pid = task_tgid_nr_ns(rcu_dereference(tsk->real_parent), ns);
+	rcu_read_unlock();
+
+	return pid;
+}
+
+static inline pid_t task_ppid_nr(const struct task_struct *tsk)
+{
+	return task_ppid_nr_ns(tsk, &init_pid_ns);
+}
+
 /* obsolete, do not use */
 static inline pid_t task_pgrp_nr(struct task_struct *tsk)
 {

kernel/bpf/verifier.c

@@ -315,7 +315,8 @@ static const char *const bpf_jmp_string[] = {
 	[BPF_EXIT >> 4] = "exit",
 };
 
-static void print_bpf_insn(struct bpf_insn *insn)
+static void print_bpf_insn(const struct bpf_verifier_env *env,
+			   const struct bpf_insn *insn)
 {
 	u8 class = BPF_CLASS(insn->code);
 
@@ -379,9 +380,19 @@ static void print_bpf_insn(struct bpf_insn *insn)
 				insn->code,
 				bpf_ldst_string[BPF_SIZE(insn->code) >> 3],
 				insn->src_reg, insn->imm);
-		} else if (BPF_MODE(insn->code) == BPF_IMM) {
-			verbose("(%02x) r%d = 0x%x\n",
-				insn->code, insn->dst_reg, insn->imm);
+		} else if (BPF_MODE(insn->code) == BPF_IMM &&
+			   BPF_SIZE(insn->code) == BPF_DW) {
+			/* At this point, we already made sure that the second
+			 * part of the ldimm64 insn is accessible.
+			 */
+			u64 imm = ((u64)(insn + 1)->imm << 32) | (u32)insn->imm;
+			bool map_ptr = insn->src_reg == BPF_PSEUDO_MAP_FD;
+
+			if (map_ptr && !env->allow_ptr_leaks)
+				imm = 0;
+
+			verbose("(%02x) r%d = 0x%llx\n", insn->code,
+				insn->dst_reg, (unsigned long long)imm);
 		} else {
 			verbose("BUG_ld_%02x\n", insn->code);
 			return;
@@ -1524,7 +1535,7 @@ static int do_check(struct verifier_env *env)
 
 		if (log_level) {
 			verbose("%d: ", insn_idx);
-			print_bpf_insn(insn);
+			print_bpf_insn(env, insn);
 		}
 
 		if (class == BPF_ALU || class == BPF_ALU64) {

kernel/events/core.c

@@ -906,6 +906,77 @@ static void put_ctx(struct perf_event_context *ctx)
 	}
 }
 
+/*
+ * Because of perf_event::ctx migration in sys_perf_event_open::move_group and
+ * perf_pmu_migrate_context() we need some magic.
+ *
+ * Those places that change perf_event::ctx will hold both
+ * perf_event_ctx::mutex of the 'old' and 'new' ctx value.
+ *
+ * Lock ordering is by mutex address. There is one other site where
+ * perf_event_context::mutex nests and that is put_event(). But remember that
+ * that is a parent<->child context relation, and migration does not affect
+ * children, therefore these two orderings should not interact.
+ *
+ * The change in perf_event::ctx does not affect children (as claimed above)
+ * because the sys_perf_event_open() case will install a new event and break
+ * the ctx parent<->child relation, and perf_pmu_migrate_context() is only
+ * concerned with cpuctx and that doesn't have children.
+ *
+ * The places that change perf_event::ctx will issue:
+ *
+ *   perf_remove_from_context();
+ *   synchronize_rcu();
+ *   perf_install_in_context();
+ *
+ * to affect the change. The remove_from_context() + synchronize_rcu() should
+ * quiesce the event, after which we can install it in the new location. This
+ * means that only external vectors (perf_fops, prctl) can perturb the event
+ * while in transit. Therefore all such accessors should also acquire
+ * perf_event_context::mutex to serialize against this.
+ *
+ * However; because event->ctx can change while we're waiting to acquire
+ * ctx->mutex we must be careful and use the below perf_event_ctx_lock()
+ * function.
+ *
+ * Lock order:
+ *	task_struct::perf_event_mutex
+ *	  perf_event_context::mutex
+ *	    perf_event_context::lock
+ *	    perf_event::child_mutex;
+ *	    perf_event::mmap_mutex
+ *	    mmap_sem
+ */
+static struct perf_event_context *perf_event_ctx_lock(struct perf_event *event)
+{
+	struct perf_event_context *ctx;
+
+again:
+	rcu_read_lock();
+	ctx = ACCESS_ONCE(event->ctx);
+	if (!atomic_inc_not_zero(&ctx->refcount)) {
+		rcu_read_unlock();
+		goto again;
+	}
+	rcu_read_unlock();
+
+	mutex_lock(&ctx->mutex);
+	if (event->ctx != ctx) {
+		mutex_unlock(&ctx->mutex);
+		put_ctx(ctx);
+		goto again;
+	}
+
+	return ctx;
+}
+
+static void perf_event_ctx_unlock(struct perf_event *event,
+				  struct perf_event_context *ctx)
+{
+	mutex_unlock(&ctx->mutex);
+	put_ctx(ctx);
+}
+
 /*
  * This must be done under the ctx->lock, such as to serialize against
  * context_equiv(), therefore we cannot call put_ctx() since that might end up
@@ -1661,7 +1732,7 @@ int __perf_event_disable(void *info)
  * is the current context on this CPU and preemption is disabled,
  * hence we can't get into perf_event_task_sched_out for this context.
  */
-void perf_event_disable(struct perf_event *event)
+static void _perf_event_disable(struct perf_event *event)
 {
 	struct perf_event_context *ctx = event->ctx;
 	struct task_struct *task = ctx->task;
@@ -1702,6 +1773,19 @@ retry:
 	}
 	raw_spin_unlock_irq(&ctx->lock);
 }
+
+/*
+ * Strictly speaking kernel users cannot create groups and therefore this
+ * interface does not need the perf_event_ctx_lock() magic.
+ */
+void perf_event_disable(struct perf_event *event)
+{
+	struct perf_event_context *ctx;
+
+	ctx = perf_event_ctx_lock(event);
+	_perf_event_disable(event);
+	perf_event_ctx_unlock(event, ctx);
+}
 EXPORT_SYMBOL_GPL(perf_event_disable);
 
 static void perf_set_shadow_time(struct perf_event *event,
@@ -2165,7 +2249,7 @@ unlock:
  * perf_event_for_each_child or perf_event_for_each as described
  * for perf_event_disable.
  */
-void perf_event_enable(struct perf_event *event)
+static void _perf_event_enable(struct perf_event *event)
 {
 	struct perf_event_context *ctx = event->ctx;
 	struct task_struct *task = ctx->task;
@@ -2221,9 +2305,21 @@ retry:
 out:
 	raw_spin_unlock_irq(&ctx->lock);
 }
+
+/*
+ * See perf_event_disable();
+ */
+void perf_event_enable(struct perf_event *event)
+{
+	struct perf_event_context *ctx;
+
+	ctx = perf_event_ctx_lock(event);
+	_perf_event_enable(event);
+	perf_event_ctx_unlock(event, ctx);
+}
 EXPORT_SYMBOL_GPL(perf_event_enable);
 
-int perf_event_refresh(struct perf_event *event, int refresh)
+static int _perf_event_refresh(struct perf_event *event, int refresh)
 {
 	/*
 	 * not supported on inherited events
@@ -2232,10 +2328,25 @@ int perf_event_refresh(struct perf_event *event, int refresh)
 		return -EINVAL;
 
 	atomic_add(refresh, &event->event_limit);
-	perf_event_enable(event);
+	_perf_event_enable(event);
 
 	return 0;
 }
+
+/*
+ * See perf_event_disable()
+ */
+int perf_event_refresh(struct perf_event *event, int refresh)
+{
+	struct perf_event_context *ctx;
+	int ret;
+
+	ctx = perf_event_ctx_lock(event);
+	ret = _perf_event_refresh(event, refresh);
+	perf_event_ctx_unlock(event, ctx);
+
+	return ret;
+}
 EXPORT_SYMBOL_GPL(perf_event_refresh);
 
 static void ctx_sched_out(struct perf_event_context *ctx,
@@ -3428,7 +3539,16 @@ static void perf_remove_from_owner(struct perf_event *event)
 	rcu_read_unlock();
 
 	if (owner) {
-		mutex_lock(&owner->perf_event_mutex);
+		/*
+		 * If we're here through perf_event_exit_task() we're already
+		 * holding ctx->mutex which would be an inversion wrt. the
+		 * normal lock order.
+		 *
+		 * However we can safely take this lock because its the child
+		 * ctx->mutex.
+		 */
+		mutex_lock_nested(&owner->perf_event_mutex, SINGLE_DEPTH_NESTING);
+
 		/*
 		 * We have to re-check the event->owner field, if it is cleared
 		 * we raced with perf_event_exit_task(), acquiring the mutex
@@ -3554,12 +3674,13 @@ static int perf_event_read_group(struct perf_event *event,
 				   u64 read_format, char __user *buf)
 {
 	struct perf_event *leader = event->group_leader, *sub;
-	int n = 0, size = 0, ret = -EFAULT;
 	struct perf_event_context *ctx = leader->ctx;
-	u64 values[5];
+	int n = 0, size = 0, ret;
 	u64 count, enabled, running;
+	u64 values[5];
+
+	lockdep_assert_held(&ctx->mutex);
 
-	mutex_lock(&ctx->mutex);
 	count = perf_event_read_value(leader, &enabled, &running);
 
 	values[n++] = 1 + leader->nr_siblings;
@@ -3574,7 +3695,7 @@ static int perf_event_read_group(struct perf_event *event,
 	size = n * sizeof(u64);
 
 	if (copy_to_user(buf, values, size))
-		goto unlock;
+		return -EFAULT;
 
 	ret = size;
 
@@ -3588,14 +3709,11 @@ static int perf_event_read_group(struct perf_event *event,
 		size = n * sizeof(u64);
 
 		if (copy_to_user(buf + ret, values, size)) {
-			ret = -EFAULT;
-			goto unlock;
+			return -EFAULT;
 		}
 
 		ret += size;
 	}
-unlock:
-	mutex_unlock(&ctx->mutex);
 
 	return ret;
 }
@@ -3667,8 +3785,14 @@ static ssize_t
 perf_read(struct file *file, char __user *buf, size_t count, loff_t *ppos)
 {
 	struct perf_event *event = file->private_data;
+	struct perf_event_context *ctx;
+	int ret;
 
-	return perf_read_hw(event, buf, count);
+	ctx = perf_event_ctx_lock(event);
+	ret = perf_read_hw(event, buf, count);
+	perf_event_ctx_unlock(event, ctx);
+
+	return ret;
 }
 
 static unsigned int perf_poll(struct file *file, poll_table *wait)
@@ -3694,7 +3818,7 @@ static unsigned int perf_poll(struct file *file, poll_table *wait)
 	return events;
 }
 
-static void perf_event_reset(struct perf_event *event)
+static void _perf_event_reset(struct perf_event *event)
 {
 	(void)perf_event_read(event);
 	local64_set(&event->count, 0);
@@ -3713,6 +3837,7 @@ static void perf_event_for_each_child(struct perf_event *event,
 	struct perf_event *child;
 
 	WARN_ON_ONCE(event->ctx->parent_ctx);
+
 	mutex_lock(&event->child_mutex);
 	func(event);
 	list_for_each_entry(child, &event->child_list, child_list)
@@ -3726,14 +3851,13 @@ static void perf_event_for_each(struct perf_event *event,
 	struct perf_event_context *ctx = event->ctx;
 	struct perf_event *sibling;
 
-	WARN_ON_ONCE(ctx->parent_ctx);
-	mutex_lock(&ctx->mutex);
+	lockdep_assert_held(&ctx->mutex);
+
 	event = event->group_leader;
 
 	perf_event_for_each_child(event, func);
 	list_for_each_entry(sibling, &event->sibling_list, group_entry)
 		perf_event_for_each_child(sibling, func);
-	mutex_unlock(&ctx->mutex);
 }
 
 static int perf_event_period(struct perf_event *event, u64 __user *arg)
@@ -3803,25 +3927,24 @@ static int perf_event_set_output(struct perf_event *event,
 				 struct perf_event *output_event);
 static int perf_event_set_filter(struct perf_event *event, void __user *arg);
 
-static long perf_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+static long _perf_ioctl(struct perf_event *event, unsigned int cmd, unsigned long arg)
 {
-	struct perf_event *event = file->private_data;
 	void (*func)(struct perf_event *);
 	u32 flags = arg;
 
 	switch (cmd) {
 	case PERF_EVENT_IOC_ENABLE:
-		func = perf_event_enable;
+		func = _perf_event_enable;
 		break;
 	case PERF_EVENT_IOC_DISABLE:
-		func = perf_event_disable;
+		func = _perf_event_disable;
 		break;
 	case PERF_EVENT_IOC_RESET:
-		func = perf_event_reset;
+		func = _perf_event_reset;
 		break;
 
 	case PERF_EVENT_IOC_REFRESH:
-		return perf_event_refresh(event, arg);
+		return _perf_event_refresh(event, arg);
 
 	case PERF_EVENT_IOC_PERIOD:
 		return perf_event_period(event, (u64 __user *)arg);
@@ -3868,6 +3991,19 @@ static long perf_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 	return 0;
 }
 
+static long perf_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+{
+	struct perf_event *event = file->private_data;
+	struct perf_event_context *ctx;
+	long ret;
+
+	ctx = perf_event_ctx_lock(event);
+	ret = _perf_ioctl(event, cmd, arg);
+	perf_event_ctx_unlock(event, ctx);
+
+	return ret;
+}
+
 #ifdef CONFIG_COMPAT
 static long perf_compat_ioctl(struct file *file, unsigned int cmd,
 				unsigned long arg)
@@ -3890,11 +4026,15 @@ static long perf_compat_ioctl(struct file *file, unsigned int cmd,
 
 int perf_event_task_enable(void)
 {
+	struct perf_event_context *ctx;
 	struct perf_event *event;
 
 	mutex_lock(&current->perf_event_mutex);
-	list_for_each_entry(event, &current->perf_event_list, owner_entry)
-		perf_event_for_each_child(event, perf_event_enable);
+	list_for_each_entry(event, &current->perf_event_list, owner_entry) {
+		ctx = perf_event_ctx_lock(event);
+		perf_event_for_each_child(event, _perf_event_enable);
+		perf_event_ctx_unlock(event, ctx);
+	}
 	mutex_unlock(&current->perf_event_mutex);
 
 	return 0;
@@ -3902,11 +4042,15 @@ int perf_event_task_enable(void)
 
 int perf_event_task_disable(void)
 {
+	struct perf_event_context *ctx;
 	struct perf_event *event;
 
 	mutex_lock(&current->perf_event_mutex);
-	list_for_each_entry(event, &current->perf_event_list, owner_entry)
-		perf_event_for_each_child(event, perf_event_disable);
+	list_for_each_entry(event, &current->perf_event_list, owner_entry) {
+		ctx = perf_event_ctx_lock(event);
+		perf_event_for_each_child(event, _perf_event_disable);
+		perf_event_ctx_unlock(event, ctx);
+	}
 	mutex_unlock(&current->perf_event_mutex);
 
 	return 0;
@@ -7215,6 +7359,46 @@ out:
 	return ret;
 }
 
+static void mutex_lock_double(struct mutex *a, struct mutex *b)
+{
+	if (b < a)
+		swap(a, b);
+
+	mutex_lock(a);
+	mutex_lock_nested(b, SINGLE_DEPTH_NESTING);
+}
+
+/*
+ * Variation on perf_event_ctx_lock_nested(), except we take two context
+ * mutexes.
+ */
+static struct perf_event_context *
+__perf_event_ctx_lock_double(struct perf_event *group_leader,
+			     struct perf_event_context *ctx)
+{
+	struct perf_event_context *gctx;
+
+again:
+	rcu_read_lock();
+	gctx = ACCESS_ONCE(group_leader->ctx);
+	if (!atomic_inc_not_zero(&gctx->refcount)) {
+		rcu_read_unlock();
+		goto again;
+	}
+	rcu_read_unlock();
+
+	mutex_lock_double(&gctx->mutex, &ctx->mutex);
+
+	if (group_leader->ctx != gctx) {
+		mutex_unlock(&ctx->mutex);
+		mutex_unlock(&gctx->mutex);
+		put_ctx(gctx);
+		goto again;
+	}
+
+	return gctx;
+}
+
 /**
  * sys_perf_event_open - open a performance event, associate it to a task/cpu
  *
@@ -7230,7 +7414,7 @@ SYSCALL_DEFINE5(perf_event_open,
 	struct perf_event *group_leader = NULL, *output_event = NULL;
 	struct perf_event *event, *sibling;
 	struct perf_event_attr attr;
-	struct perf_event_context *ctx;
+	struct perf_event_context *ctx, *uninitialized_var(gctx);
 	struct file *event_file = NULL;
 	struct fd group = {NULL, 0};
 	struct task_struct *task = NULL;
@@ -7416,9 +7600,31 @@ SYSCALL_DEFINE5(perf_event_open,
 	}
 
 	if (move_group) {
-		struct perf_event_context *gctx = group_leader->ctx;
+		gctx = __perf_event_ctx_lock_double(group_leader, ctx);
+
+		/*
+		 * Check if we raced against another sys_perf_event_open() call
+		 * moving the software group underneath us.
+		 */
+		if (!(group_leader->group_flags & PERF_GROUP_SOFTWARE)) {
+			/*
+			 * If someone moved the group out from under us, check
+			 * if this new event wound up on the same ctx, if so
+			 * its the regular !move_group case, otherwise fail.
+			 */
+			if (gctx != ctx) {
+				err = -EINVAL;
+				goto err_locked;
+			} else {
+				perf_event_ctx_unlock(group_leader, gctx);
+				move_group = 0;
+			}
+		}
 
-		mutex_lock(&gctx->mutex);
+		/*
+		 * See perf_event_ctx_lock() for comments on the details
+		 * of swizzling perf_event::ctx.
+		 */
 		perf_remove_from_context(group_leader, false);
 
 		/*
@@ -7433,15 +7639,19 @@ SYSCALL_DEFINE5(perf_event_open,
 			perf_event__state_init(sibling);
 			put_ctx(gctx);
 		}
-		mutex_unlock(&gctx->mutex);
-		put_ctx(gctx);
+	} else {
+		mutex_lock(&ctx->mutex);
 	}
 
 	WARN_ON_ONCE(ctx->parent_ctx);
-	mutex_lock(&ctx->mutex);
 
 	if (move_group) {
+		/*
+		 * Wait for everybody to stop referencing the events through
+		 * the old lists, before installing it on new lists.
+		 */
 		synchronize_rcu();
+
 		perf_install_in_context(ctx, group_leader, group_leader->cpu);
 		get_ctx(ctx);
 		list_for_each_entry(sibling, &group_leader->sibling_list,
@@ -7453,6 +7663,11 @@ SYSCALL_DEFINE5(perf_event_open,
 
 	perf_install_in_context(ctx, event, event->cpu);
 	perf_unpin_context(ctx);
+
+	if (move_group) {
+		perf_event_ctx_unlock(group_leader, gctx);
+		put_ctx(gctx);
+	}
 	mutex_unlock(&ctx->mutex);
 
 	put_online_cpus();
@@ -7479,6 +7694,11 @@ SYSCALL_DEFINE5(perf_event_open,
 	fd_install(event_fd, event_file);
 	return event_fd;
 
+err_locked:
+	if (move_group)
+		perf_event_ctx_unlock(group_leader, gctx);
+	mutex_unlock(&ctx->mutex);
+	fput(event_file);
 err_context:
 	perf_unpin_context(ctx);
 	put_ctx(ctx);
@@ -7560,7 +7780,11 @@ void perf_pmu_migrate_context(struct pmu *pmu, int src_cpu, int dst_cpu)
 	src_ctx = &per_cpu_ptr(pmu->pmu_cpu_context, src_cpu)->ctx;
 	dst_ctx = &per_cpu_ptr(pmu->pmu_cpu_context, dst_cpu)->ctx;
 
-	mutex_lock(&src_ctx->mutex);
+	/*
+	 * See perf_event_ctx_lock() for comments on the details
+	 * of swizzling perf_event::ctx.
+	 */
+	mutex_lock_double(&src_ctx->mutex, &dst_ctx->mutex);
 	list_for_each_entry_safe(event, tmp, &src_ctx->event_list,
 				 event_entry) {
 		perf_remove_from_context(event, false);
@@ -7568,11 +7792,9 @@ void perf_pmu_migrate_context(struct pmu *pmu, int src_cpu, int dst_cpu)
 		put_ctx(src_ctx);
 		list_add(&event->migrate_entry, &events);
 	}
-	mutex_unlock(&src_ctx->mutex);
 
 	synchronize_rcu();
 
-	mutex_lock(&dst_ctx->mutex);
 	list_for_each_entry_safe(event, tmp, &events, migrate_entry) {
 		list_del(&event->migrate_entry);
 		if (event->state >= PERF_EVENT_STATE_OFF)
@@ -7582,6 +7804,7 @@ void perf_pmu_migrate_context(struct pmu *pmu, int src_cpu, int dst_cpu)
 		get_ctx(dst_ctx);
 	}
 	mutex_unlock(&dst_ctx->mutex);
+	mutex_unlock(&src_ctx->mutex);
 }
 EXPORT_SYMBOL_GPL(perf_pmu_migrate_context);
 

kernel/pid.c

@@ -524,8 +524,11 @@ pid_t __task_pid_nr_ns(struct task_struct *task, enum pid_type type,
 	if (!ns)
 		ns = task_active_pid_ns(current);
 	if (likely(pid_alive(task))) {
-		if (type != PIDTYPE_PID)
+		if (type != PIDTYPE_PID) {
+			if (type == __PIDTYPE_TGID)
+				type = PIDTYPE_PID;
 			task = task->group_leader;
+		}
 		nr = pid_nr_ns(task->pids[type].pid, ns);
 	}
 	rcu_read_unlock();
@@ -534,12 +537,6 @@ pid_t __task_pid_nr_ns(struct task_struct *task, enum pid_type type,
 }
 EXPORT_SYMBOL(__task_pid_nr_ns);
 
-pid_t task_tgid_nr_ns(struct task_struct *tsk, struct pid_namespace *ns)
-{
-	return pid_nr_ns(task_tgid(tsk), ns);
-}
-EXPORT_SYMBOL(task_tgid_nr_ns);
-
 struct pid_namespace *task_active_pid_ns(struct task_struct *tsk)
 {
 	return ns_of_pid(task_pid(tsk));

mm/cma.c

@@ -338,7 +338,7 @@ err:
  * This function allocates part of contiguous memory on specific
  * contiguous memory area.
  */
-struct page *cma_alloc(struct cma *cma, int count, unsigned int align)
+struct page *cma_alloc(struct cma *cma, size_t count, unsigned int align)
 {
 	unsigned long mask, pfn, start = 0;
 	unsigned long bitmap_maxno, bitmap_no, bitmap_count;
@@ -348,7 +348,7 @@ struct page *cma_alloc(struct cma *cma, int count, unsigned int align)
 	if (!cma || !cma->count)
 		return NULL;
 
-	pr_debug("%s(cma %p, count %d, align %d)\n", __func__, (void *)cma,
+	pr_debug("%s(cma %p, count %zu, align %d)\n", __func__, (void *)cma,
 		 count, align);
 
 	if (!count)

mm/mempolicy.c

@@ -1546,7 +1546,6 @@ COMPAT_SYSCALL_DEFINE5(get_mempolicy, int __user *, policy,
 COMPAT_SYSCALL_DEFINE3(set_mempolicy, int, mode, compat_ulong_t __user *, nmask,
 		       compat_ulong_t, maxnode)
 {
-	long err = 0;
 	unsigned long __user *nm = NULL;
 	unsigned long nr_bits, alloc_size;
 	DECLARE_BITMAP(bm, MAX_NUMNODES);
@@ -1555,14 +1554,13 @@ COMPAT_SYSCALL_DEFINE3(set_mempolicy, int, mode, compat_ulong_t __user *, nmask,
 	alloc_size = ALIGN(nr_bits, BITS_PER_LONG) / 8;
 
 	if (nmask) {
-		err = compat_get_bitmap(bm, nmask, nr_bits);
+		if (compat_get_bitmap(bm, nmask, nr_bits))
+			return -EFAULT;
 		nm = compat_alloc_user_space(alloc_size);
-		err |= copy_to_user(nm, bm, alloc_size);
+		if (copy_to_user(nm, bm, alloc_size))
+			return -EFAULT;
 	}
 
-	if (err)
-		return -EFAULT;
-
 	return sys_set_mempolicy(mode, nm, nr_bits+1);
 }
 
@@ -1570,7 +1568,6 @@ COMPAT_SYSCALL_DEFINE6(mbind, compat_ulong_t, start, compat_ulong_t, len,
 		       compat_ulong_t, mode, compat_ulong_t __user *, nmask,
 		       compat_ulong_t, maxnode, compat_ulong_t, flags)
 {
-	long err = 0;
 	unsigned long __user *nm = NULL;
 	unsigned long nr_bits, alloc_size;
 	nodemask_t bm;
@@ -1579,14 +1576,13 @@ COMPAT_SYSCALL_DEFINE6(mbind, compat_ulong_t, start, compat_ulong_t, len,
 	alloc_size = ALIGN(nr_bits, BITS_PER_LONG) / 8;
 
 	if (nmask) {
-		err = compat_get_bitmap(nodes_addr(bm), nmask, nr_bits);
+		if (compat_get_bitmap(nodes_addr(bm), nmask, nr_bits))
+			return -EFAULT;
 		nm = compat_alloc_user_space(alloc_size);
-		err |= copy_to_user(nm, nodes_addr(bm), alloc_size);
+		if (copy_to_user(nm, nodes_addr(bm), alloc_size))
+			return -EFAULT;
 	}
 
-	if (err)
-		return -EFAULT;
-
 	return sys_mbind(start, len, mode, nm, nr_bits+1, flags);
 }
 

net/dccp/ipv6.c

@@ -479,6 +479,9 @@ static struct sock *dccp_v6_request_recv_sock(struct sock *sk,
 		newsk->sk_backlog_rcv = dccp_v4_do_rcv;
 		newnp->pktoptions  = NULL;
 		newnp->opt	   = NULL;
+		newnp->ipv6_mc_list = NULL;
+		newnp->ipv6_ac_list = NULL;
+		newnp->ipv6_fl_list = NULL;
 		newnp->mcast_oif   = inet6_iif(skb);
 		newnp->mcast_hops  = ipv6_hdr(skb)->hop_limit;
 
@@ -555,6 +558,9 @@ static struct sock *dccp_v6_request_recv_sock(struct sock *sk,
 	newnp->rxopt.all = np->rxopt.all;
 
 	/* Clone pktoptions received with SYN */
+	newnp->ipv6_mc_list = NULL;
+	newnp->ipv6_ac_list = NULL;
+	newnp->ipv6_fl_list = NULL;
 	newnp->pktoptions = NULL;
 	if (ireq->pktopts != NULL) {
 		newnp->pktoptions = skb_clone(ireq->pktopts, GFP_ATOMIC);

net/ipv4/inet_connection_sock.c

@@ -679,6 +679,8 @@ struct sock *inet_csk_clone_lock(const struct sock *sk,
 		inet_sk(newsk)->inet_sport = htons(inet_rsk(req)->ir_num);
 		newsk->sk_write_space = sk_stream_write_space;
 
+		inet_sk(newsk)->mc_list = NULL;
+
 		newsk->sk_mark = inet_rsk(req)->ir_mark;
 
 		newicsk->icsk_retransmits = 0;

net/ipv4/tcp.c

@@ -304,6 +304,9 @@ EXPORT_SYMBOL(sysctl_tcp_wmem);
 atomic_long_t tcp_memory_allocated;	/* Current allocated memory. */
 EXPORT_SYMBOL(tcp_memory_allocated);
 
+int sysctl_tcp_ack_number __read_mostly = 1;
+EXPORT_SYMBOL(sysctl_tcp_ack_number);
+
 /*
  * Current number of TCP sockets.
  */
@@ -793,6 +796,12 @@ ssize_t tcp_splice_read(struct socket *sock, loff_t *ppos,
 				ret = -EAGAIN;
 				break;
 			}
+			/* if __tcp_splice_read() got nothing while we have
+			 * an skb in receive queue, we do not want to loop.
+			 * This might happen with URG data.
+			 */
+			if (!skb_queue_empty(&sk->sk_receive_queue))
+				break;
 			sk_wait_data(sk, &timeo);
 			if (signal_pending(current)) {
 				ret = sock_intr_errno(timeo);
@@ -1432,7 +1441,7 @@ static void tcp_cleanup_rbuf(struct sock *sk, int copied)
 		    * receive. */
 		if (icsk->icsk_ack.blocked ||
 		    /* Once-per-two-segments ACK was not sent by tcp_input.c */
-		    tp->rcv_nxt - tp->rcv_wup > icsk->icsk_ack.rcv_mss ||
+		    tp->rcv_nxt - tp->rcv_wup > sysctl_tcp_ack_number * icsk->icsk_ack.rcv_mss ||
 		    /*
 		     * If this read emptied read buffer, we send ACK, if
 		     * connection is not bidirectional, user drained
@@ -3248,14 +3257,15 @@ restart:
 			sock_hold(sk);
 			spin_unlock_bh(lock);
 
-			local_bh_disable();
-			bh_lock_sock(sk);
+			lock_sock(sk);
 			sk->sk_err = ETIMEDOUT;
 			sk->sk_error_report(sk);
 
+			local_bh_disable();
 			tcp_done(sk);
-			bh_unlock_sock(sk);
 			local_bh_enable();
+
+			release_sock(sk);
 			sock_put(sk);
 
 			goto restart;

net/ipv6/ip6_gre.c

@@ -368,33 +368,35 @@ static void ip6gre_tunnel_uninit(struct net_device *dev)
 static void ip6gre_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 		u8 type, u8 code, int offset, __be32 info)
 {
-	const struct ipv6hdr *ipv6h = (const struct ipv6hdr *)skb->data;
-	__be16 *p = (__be16 *)(skb->data + offset);
-	int grehlen = offset + 4;
+	const struct gre_base_hdr *greh;
+	const struct ipv6hdr *ipv6h;
+	int grehlen = sizeof(*greh);
 	struct ip6_tnl *t;
+	int key_off = 0;
 	__be16 flags;
+	__be32 key;
 
-	flags = p[0];
-	if (flags&(GRE_CSUM|GRE_KEY|GRE_SEQ|GRE_ROUTING|GRE_VERSION)) {
-		if (flags&(GRE_VERSION|GRE_ROUTING))
-			return;
-		if (flags&GRE_KEY) {
-			grehlen += 4;
-			if (flags&GRE_CSUM)
-				grehlen += 4;
-		}
+	if (!pskb_may_pull(skb, offset + grehlen))
+		return;
+	greh = (const struct gre_base_hdr *)(skb->data + offset);
+	flags = greh->flags;
+	if (flags & (GRE_VERSION | GRE_ROUTING))
+		return;
+	if (flags & GRE_CSUM)
+		grehlen += 4;
+	if (flags & GRE_KEY) {
+		key_off = grehlen + offset;
+		grehlen += 4;
 	}
 
-	/* If only 8 bytes returned, keyed message will be dropped here */
-	if (!pskb_may_pull(skb, grehlen))
+	if (!pskb_may_pull(skb, offset + grehlen))
 		return;
 	ipv6h = (const struct ipv6hdr *)skb->data;
-	p = (__be16 *)(skb->data + offset);
+	greh = (const struct gre_base_hdr *)(skb->data + offset);
+	key = key_off ? *(__be32 *)(skb->data + key_off) : 0;
 
 	t = ip6gre_tunnel_lookup(skb->dev, &ipv6h->daddr, &ipv6h->saddr,
-				flags & GRE_KEY ?
-				*(((__be32 *)p) + (grehlen / 4) - 1) : 0,
-				p[1]);
+				key, greh->protocol);
 	if (t == NULL)
 		return;
 

net/ipv6/tcp_ipv6.c

@@ -1092,6 +1092,7 @@ static struct sock *tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
 		newtp->af_specific = &tcp_sock_ipv6_mapped_specific;
 #endif
 
+		newnp->ipv6_mc_list = NULL;
 		newnp->ipv6_ac_list = NULL;
 		newnp->ipv6_fl_list = NULL;
 		newnp->pktoptions  = NULL;
@@ -1163,6 +1164,7 @@ static struct sock *tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
 	   First: no IPv4 options.
 	 */
 	newinet->inet_opt = NULL;
+	newnp->ipv6_mc_list = NULL;
 	newnp->ipv6_ac_list = NULL;
 	newnp->ipv6_fl_list = NULL;
 

net/ipx/af_ipx.c

@@ -1168,11 +1168,10 @@ static int ipxitf_ioctl(unsigned int cmd, void __user *arg)
 		sipx->sipx_network	= ipxif->if_netnum;
 		memcpy(sipx->sipx_node, ipxif->if_node,
 			sizeof(sipx->sipx_node));
-		rc = -EFAULT;
+		rc = 0;
 		if (copy_to_user(arg, &ifr, sizeof(ifr)))
-			break;
+			rc = -EFAULT;
 		ipxitf_put(ipxif);
-		rc = 0;
 		break;
 	}
 	case SIOCAIPXITFCRT:

net/packet/af_packet.c

@@ -1429,14 +1429,15 @@ static int fanout_add(struct sock *sk, u16 id, u16 type_flags)
 	default:
 		return -EINVAL;
 	}
+	mutex_lock(&fanout_mutex);
 
+	err = -EINVAL;
 	if (!po->running)
-		return -EINVAL;
-
+		goto out;
+	err = -EALREADY;
 	if (po->fanout)
-		return -EALREADY;
+		goto out;
 
-	mutex_lock(&fanout_mutex);
 	match = NULL;
 	list_for_each_entry(f, &fanout_list, list) {
 		if (f->id == id &&
@@ -1492,17 +1493,16 @@ static void fanout_release(struct sock *sk)
 	struct packet_sock *po = pkt_sk(sk);
 	struct packet_fanout *f;
 
-	f = po->fanout;
-	if (!f)
-		return;
-
 	mutex_lock(&fanout_mutex);
-	po->fanout = NULL;
+	f = po->fanout;
+	if (f) {
+		po->fanout = NULL;
 
-	if (atomic_dec_and_test(&f->sk_ref)) {
-		list_del(&f->list);
-		dev_remove_pack(&f->prot_hook);
-		kfree(f);
+		if (atomic_dec_and_test(&f->sk_ref)) {
+			list_del(&f->list);
+			dev_remove_pack(&f->prot_hook);
+			kfree(f);
+		}
 	}
 	mutex_unlock(&fanout_mutex);
 }

net/xfrm/xfrm_policy.c

@@ -3334,9 +3334,15 @@ int xfrm_migrate(const struct xfrm_selector *sel, u8 dir, u8 type,
 	struct xfrm_state *x_new[XFRM_MAX_DEPTH];
 	struct xfrm_migrate *mp;
 
+	/* Stage 0 - sanity checks */
 	if ((err = xfrm_migrate_check(m, num_migrate)) < 0)
 		goto out;
 
+	if (dir >= XFRM_POLICY_MAX) {
+		err = -EINVAL;
+		goto out;
+	}
+
 	/* Stage 1 - find policy */
 	if ((pol = xfrm_migrate_policy_find(sel, dir, type, net)) == NULL) {
 		err = -ENOENT;

sound/core/pcm.c

@@ -150,7 +150,9 @@ static int snd_pcm_control_ioctl(struct snd_card *card,
 				err = -ENXIO;
 				goto _error;
 			}
+			mutex_lock(&pcm->open_mutex);
 			err = snd_pcm_info_user(substream, info);
+			mutex_unlock(&pcm->open_mutex);
 		_error:
 			mutex_unlock(&register_mutex);
 			return err;