Merge keystone/android13-5.15-keystone-qcom-release.123 (ba02a0e) into msm-5.15

* refs/heads/tmp-ba02a0e:
  ANDROID: GKI: Add symbol list for Transsion
  ANDROID: GKI: Update symbol list for Amlogic
  ANDROID: mm: add vendor hook in isolate_freepages()
  UPSTREAM: kthread: dynamically allocate memory to store kthread's full name
  BACKPORT: firmware_loader: Abort all upcoming firmware load request once reboot triggered
  UPSTREAM: firmware_loader: Refactor kill_pending_fw_fallback_reqs()
  UPSTREAM: vringh: don't use vringh_kiov_advance() in vringh_iov_xfer()
  FROMGIT: ufs: core: wlun send SSU timeout recovery
  ANDROID: abi_gki_aarch64_qcom: Update QCOM symbol list
  ANDROID: ABI: Update symbols to unisoc whitelist
  UPSTREAM: netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c
  BACKPORT: usb: gadget: uvc: Add missing initialization of ssp config descriptor
  BACKPORT: usb: gadget: unconditionally allocate hs/ss descriptor in bind operation
  UPSTREAM: usb: gadget: f_uvc: change endpoint allocation in uvc_function_bind()
  UPSTREAM: usb: gadget: function: Remove unused declarations
  UPSTREAM: usb: gadget: uvc: clean up comments and styling in video_pump
  UPSTREAM: ravb: Fix use-after-free issue in ravb_tx_timeout_work()
  UPSTREAM: ravb: Fix up dma_free_coherent() call in ravb_remove()
  ANDROID: GKI: Update symbol list for Tuxera
  ANDROID: GKI: Update symbol list for Amlogic
  ANDROID: mm: allow hooks into __alloc_pages()
  UPSTREAM: netfilter: ipset: Fix race between IPSET_CMD_CREATE and IPSET_CMD_SWAP
  ANDROID: fuse-bpf: Add NULL pointer check in fuse_entry_revalidate
  UPSTREAM: net: xfrm: Fix xfrm_address_filter OOB read
  UPSTREAM: igb: set max size RX buffer when store bad packet is enabled
  ANDROID: abi_gki_aarch64_qcom: Add wait_for_device_probe symbol
  ANDROID: GKI: Update symbol list for Amlogic
  BACKPORT: take care to handle NULL ->proc_lseek()
  ANDROID: GKI: Update symbol list for Amlogic
  ANDROID: vendor_hooks: add vendor hook in __alloc_pages()
  UPSTREAM: netfilter: xt_sctp: validate the flag_info count


Change-Id: I681ee7c4d8dbc6f78464d3de1a298056c9642a22
Signed-off-by: Sivasri Kumar, Vanka <quic_svanka@quicinc.com>

BUILD.bazel

@@ -35,6 +35,7 @@ _aarch64_additional_kmi_symbol_lists = [
     "android/abi_gki_aarch64_rtktv",
     "android/abi_gki_aarch64_sony",
     "android/abi_gki_aarch64_sunxi",
+    "android/abi_gki_aarch64_transsion",
     "android/abi_gki_aarch64_tuxera",
     "android/abi_gki_aarch64_type_visibility",
     "android/abi_gki_aarch64_unisoc",

android/ACK_SHA

@@ -1,2 +1,2 @@
-39606e3309fcaf2b26047f43a26ad93521a1fa40
+3ca6a2912c7e6f416930ce3dbb26381cb04ec8d5
-android13-5.15-2023-10_r1
+android13-5.15-2023-11_r1

android/abi_gki_aarch64_amlogic

@@ -536,6 +536,7 @@
   drm_atomic_helper_resume
   drm_atomic_helper_set_config
   drm_atomic_helper_setup_commit
+  drm_atomic_helper_shutdown
   drm_atomic_helper_suspend
   drm_atomic_helper_swap_state
   drm_atomic_helper_update_plane
@@ -647,6 +648,8 @@
   drm_poll
   drm_prime_gem_destroy
   drm_printf
+  __drm_printfn_coredump
+  __drm_printfn_seq_file
   drm_property_add_enum
   drm_property_blob_get
   drm_property_blob_put
@@ -657,9 +660,12 @@
   drm_property_destroy
   drm_property_lookup_blob
   drm_property_replace_blob
+  __drm_puts_coredump
+  __drm_puts_seq_file
   drm_read
   drm_release
   drm_self_refresh_helper_update_avg_times
+  drm_state_dump
   drm_universal_plane_init
   drm_vblank_init
   drm_writeback_connector_init
@@ -1963,6 +1969,7 @@
   __traceiter_android_rvh_schedule
   __traceiter_android_rvh_select_task_rq_rt
   __traceiter_android_rvh_tick_entry
+  __traceiter_android_vh_alloc_pages_entry
   __traceiter_android_vh_cma_alloc_bypass
   __traceiter_android_vh_cma_drain_all_pages_bypass
   __traceiter_android_vh_cpu_idle_enter
@@ -1972,6 +1979,7 @@
   __traceiter_android_vh_ftrace_format_check
   __traceiter_android_vh_iommu_iovad_free_iova
   __traceiter_android_vh_ipi_stop
+  __traceiter_android_vh_isolate_freepages
   __traceiter_android_vh_mem_cgroup_alloc
   __traceiter_android_vh_mmc_sd_update_cmdline_timing
   __traceiter_android_vh_mmc_sd_update_dataline_timing
@@ -1985,6 +1993,11 @@
   __traceiter_mmap_lock_acquire_returned
   __traceiter_mmap_lock_released
   __traceiter_mmap_lock_start_locking
+  __traceiter_mm_page_alloc
+  __traceiter_rwmmio_post_read
+  __traceiter_rwmmio_post_write
+  __traceiter_rwmmio_read
+  __traceiter_rwmmio_write
   __traceiter_sched_switch
   __traceiter_xdp_exception
   trace_output_call
@@ -2002,6 +2015,7 @@
   __tracepoint_android_rvh_schedule
   __tracepoint_android_rvh_select_task_rq_rt
   __tracepoint_android_rvh_tick_entry
+  __tracepoint_android_vh_alloc_pages_entry
   __tracepoint_android_vh_cma_alloc_bypass
   __tracepoint_android_vh_cma_drain_all_pages_bypass
   __tracepoint_android_vh_cpu_idle_enter
@@ -2011,6 +2025,7 @@
   __tracepoint_android_vh_ftrace_format_check
   __tracepoint_android_vh_iommu_iovad_free_iova
   __tracepoint_android_vh_ipi_stop
+  __tracepoint_android_vh_isolate_freepages
   __tracepoint_android_vh_mem_cgroup_alloc
   __tracepoint_android_vh_mmc_sd_update_cmdline_timing
   __tracepoint_android_vh_mmc_sd_update_dataline_timing
@@ -2024,8 +2039,13 @@
   __tracepoint_mmap_lock_acquire_returned
   __tracepoint_mmap_lock_released
   __tracepoint_mmap_lock_start_locking
+  __tracepoint_mm_page_alloc
   tracepoint_probe_register
   tracepoint_probe_unregister
+  __tracepoint_rwmmio_post_read
+  __tracepoint_rwmmio_post_write
+  __tracepoint_rwmmio_read
+  __tracepoint_rwmmio_write
   __tracepoint_sched_switch
   __tracepoint_xdp_exception
   trace_print_array_seq

android/abi_gki_aarch64_qcom

@@ -375,6 +375,7 @@
   dev_get_by_name
   dev_get_by_name_rcu
   dev_get_regmap
+  dev_get_tstats64
   device_add
   device_add_disk
   device_add_groups
@@ -698,6 +699,7 @@
   ethnl_cable_test_pulse
   ethnl_cable_test_result
   ethnl_cable_test_step
+  eth_platform_get_mac_address
   ethtool_convert_legacy_u32_to_link_mode
   ethtool_convert_link_mode_to_legacy_u32
   eventfd_ctx_fdget
@@ -765,6 +767,7 @@
   generic_handle_domain_irq
   generic_handle_irq
   generic_iommu_put_resv_regions
+  generic_mii_ioctl
   geni_icc_disable
   geni_icc_enable
   geni_icc_get
@@ -1296,6 +1299,8 @@
   migrate_pages
   migrate_swap
   __migrate_task
+  mii_check_media
+  mii_ethtool_gset
   mipi_dsi_dcs_set_tear_off
   misc_deregister
   misc_register
@@ -2573,6 +2578,8 @@
   usb_alloc_coherent
   usb_alloc_dev
   usb_assign_descriptors
+  usb_autopm_get_interface_async
+  usb_autopm_put_interface_async
   usb_bus_idr
   usb_bus_idr_lock
   usb_composite_setup_continue
@@ -2601,6 +2608,26 @@
   usb_interface_id
   usb_mon_deregister
   usb_mon_register
+  usbnet_disconnect
+  usbnet_get_endpoints
+  usbnet_get_msglevel
+  usbnet_link_change
+  usbnet_nway_reset
+  usbnet_open
+  usbnet_probe
+  usbnet_read_cmd
+  usbnet_read_cmd_nopm
+  usbnet_resume
+  usbnet_set_msglevel
+  usbnet_skb_return
+  usbnet_start_xmit
+  usbnet_stop
+  usbnet_suspend
+  usbnet_tx_timeout
+  usbnet_update_max_qlen
+  usbnet_write_cmd
+  usbnet_write_cmd_async
+  usbnet_write_cmd_nopm
   usb_phy_set_charger_current
   usb_pipe_type_check
   usb_put_function_instance
@@ -2676,6 +2703,7 @@
   wait_for_completion_interruptible_timeout
   wait_for_completion_io_timeout
   wait_for_completion_timeout
+  wait_for_device_probe
   __wait_rcu_gp
   __wake_up
   wake_up_if_idle

android/abi_gki_aarch64_transsion

@@ -0,0 +1,2 @@
+[abi_symbol_list]
+  avenrun

android/abi_gki_aarch64_tuxera

@@ -23,6 +23,7 @@ blk_start_plug
 __blockdev_direct_IO
 block_invalidatepage
 block_is_partially_uptodate
+block_read_full_page
 __breadahead
 __bread_gfp
 __brelse
@@ -49,6 +50,7 @@ delete_from_page_cache
 d_instantiate
 d_make_root
 d_obtain_alias
+dirty_writeback_interval
 down_read
 down_write
 down_write_trylock
@@ -104,6 +106,7 @@ __init_rwsem
 init_special_inode
 init_wait_entry
 __init_waitqueue_head
+inode_add_bytes
 inode_dio_wait
 inode_init_once
 inode_init_owner
@@ -255,6 +258,7 @@ truncate_inode_pages
 truncate_inode_pages_final
 truncate_pagecache
 truncate_setsize
+try_to_free_buffers
 try_to_release_page
 try_to_writeback_inodes_sb
 __ubsan_handle_cfi_check_fail_abort
@@ -266,6 +270,7 @@ unmap_mapping_range
 unregister_filesystem
 up_read
 up_write
+utf32_to_utf8
 vfree
 vfs_fsync_range
 __vmalloc

android/abi_gki_aarch64_unisoc

@@ -2354,6 +2354,8 @@
   skb_copy_bits
   skb_vlan_untag
   unregister_netdevice_notifier
+  vlan_dev_real_dev
+  vlan_dev_vlan_id
 
 # required by sha1-ce.ko
   crypto_sha1_finup

build.config.gki.aarch64

@@ -42,6 +42,7 @@ android/abi_gki_aarch64_sunxi
 android/abi_gki_aarch64_pasa
 android/abi_gki_aarch64_zeku
 android/abi_gki_aarch64_lenovo
+android/abi_gki_aarch64_transsion
 "
 
 FILES="${FILES}

drivers/android/vendor_hooks.c

@@ -460,6 +460,8 @@ EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_clear_page_migrating);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_cma_alloc_bypass);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_enable_thermal_genl_check);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_xhci_urb_suitable_bypass);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_alloc_pages_entry);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_isolate_freepages);
 /*
  * For type visibility
  */

drivers/base/firmware_loader/fallback.c

@@ -106,7 +106,7 @@ static void fw_load_abort(struct fw_sysfs *fw_sysfs)
 
 static LIST_HEAD(pending_fw_head);
 
-void kill_pending_fw_fallback_reqs(bool only_kill_custom)
+void kill_pending_fw_fallback_reqs(bool kill_all)
 {
 	struct fw_priv *fw_priv;
 	struct fw_priv *next;
@@ -114,9 +114,13 @@ void kill_pending_fw_fallback_reqs(bool only_kill_custom)
 	mutex_lock(&fw_lock);
 	list_for_each_entry_safe(fw_priv, next, &pending_fw_head,
 				 pending_list) {
-		if (!fw_priv->need_uevent || !only_kill_custom)
+		if (kill_all || !fw_priv->need_uevent)
 			 __fw_load_abort(fw_priv);
 	}
+
+	if (kill_all)
+		fw_load_abort_all = true;
+
 	mutex_unlock(&fw_lock);
 }
 
@@ -511,7 +515,7 @@ static int fw_load_sysfs_fallback(struct fw_sysfs *fw_sysfs, long timeout)
 	}
 
 	mutex_lock(&fw_lock);
-	if (fw_state_is_aborted(fw_priv)) {
+	if (fw_load_abort_all || fw_state_is_aborted(fw_priv)) {
 		mutex_unlock(&fw_lock);
 		retval = -EINTR;
 		goto out;

drivers/base/firmware_loader/fallback.h

@@ -35,7 +35,7 @@ int firmware_fallback_sysfs(struct firmware *fw, const char *name,
 			    struct device *device,
 			    u32 opt_flags,
 			    int ret);
-void kill_pending_fw_fallback_reqs(bool only_kill_custom);
+void kill_pending_fw_fallback_reqs(bool kill_all);
 
 void fw_fallback_set_cache_timeout(void);
 void fw_fallback_set_default_timeout(void);
@@ -52,7 +52,7 @@ static inline int firmware_fallback_sysfs(struct firmware *fw, const char *name,
 	return ret;
 }
 
-static inline void kill_pending_fw_fallback_reqs(bool only_kill_custom) { }
+static inline void kill_pending_fw_fallback_reqs(bool kill_all) { }
 static inline void fw_fallback_set_cache_timeout(void) { }
 static inline void fw_fallback_set_default_timeout(void) { }
 

drivers/base/firmware_loader/firmware.h

@@ -87,6 +87,7 @@ struct fw_priv {
 };
 
 extern struct mutex fw_lock;
+extern bool fw_load_abort_all;
 
 static inline bool __fw_state_check(struct fw_priv *fw_priv,
 				    enum fw_status status)

drivers/base/firmware_loader/main.c

@@ -92,6 +92,7 @@ static inline struct fw_priv *to_fw_priv(struct kref *ref)
 DEFINE_MUTEX(fw_lock);
 
 static struct firmware_cache fw_cache;
+bool fw_load_abort_all;
 
 /* Builtin firmware support */
 
@@ -1525,10 +1526,10 @@ static int fw_pm_notify(struct notifier_block *notify_block,
 	case PM_SUSPEND_PREPARE:
 	case PM_RESTORE_PREPARE:
 		/*
-		 * kill pending fallback requests with a custom fallback
+		 * Here, kill pending fallback requests will only kill
-		 * to avoid stalling suspend.
+		 * non-uevent firmware request to avoid stalling suspend.
 		 */
-		kill_pending_fw_fallback_reqs(true);
+		kill_pending_fw_fallback_reqs(false);
 		device_cache_fw_images();
 		break;
 
@@ -1613,7 +1614,7 @@ static int fw_shutdown_notify(struct notifier_block *unused1,
 	 * Kill all pending fallback requests to avoid both stalling shutdown,
 	 * and avoid a deadlock with the usermode_lock.
 	 */
-	kill_pending_fw_fallback_reqs(false);
+	kill_pending_fw_fallback_reqs(true);
 
 	return NOTIFY_DONE;
 }

drivers/net/ethernet/intel/igb/igb_main.c

@@ -4737,6 +4737,10 @@ void igb_configure_rx_ring(struct igb_adapter *adapter,
 static void igb_set_rx_buffer_len(struct igb_adapter *adapter,
 				  struct igb_ring *rx_ring)
 {
+#if (PAGE_SIZE < 8192)
+	struct e1000_hw *hw = &adapter->hw;
+#endif
+
 	/* set build_skb and buffer size flags */
 	clear_ring_build_skb_enabled(rx_ring);
 	clear_ring_uses_large_buffer(rx_ring);
@@ -4747,10 +4751,9 @@ static void igb_set_rx_buffer_len(struct igb_adapter *adapter,
 	set_ring_build_skb_enabled(rx_ring);
 
 #if (PAGE_SIZE < 8192)
-	if (adapter->max_frame_size <= IGB_MAX_FRAME_BUILD_SKB)
+	if (adapter->max_frame_size > IGB_MAX_FRAME_BUILD_SKB ||
-		return;
+	    rd32(E1000_RCTL) & E1000_RCTL_SBP)
-
+		set_ring_uses_large_buffer(rx_ring);
-	set_ring_uses_large_buffer(rx_ring);
 #endif
 }
 

drivers/net/ethernet/renesas/ravb_main.c

@@ -1774,6 +1774,8 @@ static int ravb_close(struct net_device *ndev)
 			of_phy_deregister_fixed_link(np);
 	}
 
+	cancel_work_sync(&priv->work);
+
 	if (info->multi_irqs) {
 		free_irq(priv->tx_irqs[RAVB_NC], ndev);
 		free_irq(priv->rx_irqs[RAVB_NC], ndev);
@@ -2382,14 +2384,14 @@ static int ravb_remove(struct platform_device *pdev)
 
 	clk_disable_unprepare(priv->refclk);
 
-	dma_free_coherent(ndev->dev.parent, priv->desc_bat_size, priv->desc_bat,
-			  priv->desc_bat_dma);
 	/* Set reset mode */
 	ravb_write(ndev, CCC_OPC_RESET, CCC);
 	unregister_netdev(ndev);
 	netif_napi_del(&priv->napi[RAVB_NC]);
 	netif_napi_del(&priv->napi[RAVB_BE]);
 	ravb_mdio_release(priv);
+	dma_free_coherent(ndev->dev.parent, priv->desc_bat_size, priv->desc_bat,
+			  priv->desc_bat_dma);
 	pm_runtime_put_sync(&pdev->dev);
 	pm_runtime_disable(&pdev->dev);
 	reset_control_assert(priv->rstc);

drivers/scsi/ufs/ufshcd.c

@@ -7318,6 +7318,20 @@ static int ufshcd_eh_host_reset_handler(struct scsi_cmnd *cmd)
 
 	hba = shost_priv(cmd->device->host);
 
+	/*
+	 * If runtime pm send SSU and got timeout, scsi_error_handler
+	 * stuck at this function to wait for flush_work(&hba->eh_work).
+	 * And ufshcd_err_handler(eh_work) stuck at wait for runtime pm active.
+	 * Do ufshcd_link_recovery instead schedule eh_work can prevent
+	 * dead lock to happen.
+	 */
+	if (hba->pm_op_in_progress) {
+		if (ufshcd_link_recovery(hba))
+			err = FAILED;
+
+		return err;
+	}
+
 	spin_lock_irqsave(hba->host->host_lock, flags);
 	hba->force_reset = true;
 	ufshcd_schedule_eh_work(hba);

drivers/usb/gadget/function/f_midi.c

@@ -1023,40 +1023,30 @@ static int f_midi_bind(struct usb_configuration *c, struct usb_function *f)
 	if (!f->fs_descriptors)
 		goto fail_f_midi;
 
-	if (gadget_is_dualspeed(c->cdev->gadget)) {
+	bulk_in_desc.wMaxPacketSize = cpu_to_le16(512);
-		bulk_in_desc.wMaxPacketSize = cpu_to_le16(512);
+	bulk_out_desc.wMaxPacketSize = cpu_to_le16(512);
-		bulk_out_desc.wMaxPacketSize = cpu_to_le16(512);
+	f->hs_descriptors = usb_copy_descriptors(midi_function);
-		f->hs_descriptors = usb_copy_descriptors(midi_function);
+	if (!f->hs_descriptors)
-		if (!f->hs_descriptors)
+		goto fail_f_midi;
-			goto fail_f_midi;
-	}
 
-	if (gadget_is_superspeed(c->cdev->gadget)) {
+	bulk_in_desc.wMaxPacketSize = cpu_to_le16(1024);
-		bulk_in_desc.wMaxPacketSize = cpu_to_le16(1024);
+	bulk_out_desc.wMaxPacketSize = cpu_to_le16(1024);
-		bulk_out_desc.wMaxPacketSize = cpu_to_le16(1024);
+	i = endpoint_descriptor_index;
-		i = endpoint_descriptor_index;
+	midi_function[i++] = (struct usb_descriptor_header *)
-		midi_function[i++] = (struct usb_descriptor_header *)
+			     &bulk_out_desc;
-				     &bulk_out_desc;
+	midi_function[i++] = (struct usb_descriptor_header *)
-		midi_function[i++] = (struct usb_descriptor_header *)
+			     &bulk_out_ss_comp_desc;
-				     &bulk_out_ss_comp_desc;
+	midi_function[i++] = (struct usb_descriptor_header *)
-		midi_function[i++] = (struct usb_descriptor_header *)
+			     &ms_out_desc;
-				     &ms_out_desc;
+	midi_function[i++] = (struct usb_descriptor_header *)
-		midi_function[i++] = (struct usb_descriptor_header *)
+			     &bulk_in_desc;
-				     &bulk_in_desc;
+	midi_function[i++] = (struct usb_descriptor_header *)
-		midi_function[i++] = (struct usb_descriptor_header *)
+			     &bulk_in_ss_comp_desc;
-				     &bulk_in_ss_comp_desc;
+	midi_function[i++] = (struct usb_descriptor_header *)
-		midi_function[i++] = (struct usb_descriptor_header *)
+			     &ms_in_desc;
-				     &ms_in_desc;
+	f->ss_descriptors = usb_copy_descriptors(midi_function);
-		f->ss_descriptors = usb_copy_descriptors(midi_function);
+	if (!f->ss_descriptors)
-		if (!f->ss_descriptors)
+		goto fail_f_midi;
-			goto fail_f_midi;
-
-		if (gadget_is_superspeed_plus(c->cdev->gadget)) {
-			f->ssp_descriptors = usb_copy_descriptors(midi_function);
-			if (!f->ssp_descriptors)
-				goto fail_f_midi;
-		}
-	}
 
 	kfree(midi_function);
 

drivers/usb/gadget/function/f_uvc.c

@@ -492,6 +492,7 @@ uvc_copy_descriptors(struct uvc_device *uvc, enum usb_device_speed speed)
 	void *mem;
 
 	switch (speed) {
+	case USB_SPEED_SUPER_PLUS:
 	case USB_SPEED_SUPER:
 		uvc_control_desc = uvc->desc.ss_control;
 		uvc_streaming_cls = uvc->desc.ss_streaming;
@@ -536,7 +537,8 @@ uvc_copy_descriptors(struct uvc_device *uvc, enum usb_device_speed speed)
 	      + uvc_control_ep.bLength + uvc_control_cs_ep.bLength
 	      + uvc_streaming_intf_alt0.bLength;
 
-	if (speed == USB_SPEED_SUPER) {
+	if (speed == USB_SPEED_SUPER ||
+	    speed == USB_SPEED_SUPER_PLUS) {
 		bytes += uvc_ss_control_comp.bLength;
 		n_desc = 6;
 	} else {
@@ -580,7 +582,8 @@ uvc_copy_descriptors(struct uvc_device *uvc, enum usb_device_speed speed)
 	uvc_control_header->baInterfaceNr[0] = uvc->streaming_intf;
 
 	UVC_COPY_DESCRIPTOR(mem, dst, &uvc_control_ep);
-	if (speed == USB_SPEED_SUPER)
+	if (speed == USB_SPEED_SUPER
+	    || speed == USB_SPEED_SUPER_PLUS)
 		UVC_COPY_DESCRIPTOR(mem, dst, &uvc_ss_control_comp);
 
 	UVC_COPY_DESCRIPTOR(mem, dst, &uvc_control_cs_ep);
@@ -673,21 +676,13 @@ uvc_function_bind(struct usb_configuration *c, struct usb_function *f)
 	}
 	uvc->control_ep = ep;
 
-	if (gadget_is_superspeed(c->cdev->gadget))
+	ep = usb_ep_autoconfig(cdev->gadget, &uvc_fs_streaming_ep);
-		ep = usb_ep_autoconfig_ss(cdev->gadget, &uvc_ss_streaming_ep,
-					  &uvc_ss_streaming_comp);
-	else if (gadget_is_dualspeed(cdev->gadget))
-		ep = usb_ep_autoconfig(cdev->gadget, &uvc_hs_streaming_ep);
-	else
-		ep = usb_ep_autoconfig(cdev->gadget, &uvc_fs_streaming_ep);
-
 	if (!ep) {
 		uvcg_info(f, "Unable to allocate streaming EP\n");
 		goto error;
 	}
 	uvc->video.ep = ep;
 
-	uvc_fs_streaming_ep.bEndpointAddress = uvc->video.ep->address;
 	uvc_hs_streaming_ep.bEndpointAddress = uvc->video.ep->address;
 	uvc_ss_streaming_ep.bEndpointAddress = uvc->video.ep->address;
 
@@ -726,21 +721,26 @@ uvc_function_bind(struct usb_configuration *c, struct usb_function *f)
 		f->fs_descriptors = NULL;
 		goto error;
 	}
-	if (gadget_is_dualspeed(cdev->gadget)) {
+
-		f->hs_descriptors = uvc_copy_descriptors(uvc, USB_SPEED_HIGH);
+	f->hs_descriptors = uvc_copy_descriptors(uvc, USB_SPEED_HIGH);
-		if (IS_ERR(f->hs_descriptors)) {
+	if (IS_ERR(f->hs_descriptors)) {
-			ret = PTR_ERR(f->hs_descriptors);
+		ret = PTR_ERR(f->hs_descriptors);
-			f->hs_descriptors = NULL;
+		f->hs_descriptors = NULL;
-			goto error;
+		goto error;
-		}
 	}
-	if (gadget_is_superspeed(c->cdev->gadget)) {
+
-		f->ss_descriptors = uvc_copy_descriptors(uvc, USB_SPEED_SUPER);
+	f->ss_descriptors = uvc_copy_descriptors(uvc, USB_SPEED_SUPER);
-		if (IS_ERR(f->ss_descriptors)) {
+	if (IS_ERR(f->ss_descriptors)) {
-			ret = PTR_ERR(f->ss_descriptors);
+		ret = PTR_ERR(f->ss_descriptors);
-			f->ss_descriptors = NULL;
+		f->ss_descriptors = NULL;
-			goto error;
+		goto error;
-		}
+	}
+
+	f->ssp_descriptors = uvc_copy_descriptors(uvc, USB_SPEED_SUPER_PLUS);
+	if (IS_ERR(f->ssp_descriptors)) {
+		ret = PTR_ERR(f->ssp_descriptors);
+		f->ssp_descriptors = NULL;
+		goto error;
 	}
 
 	/* Preallocate control endpoint request. */

drivers/usb/gadget/function/u_phonet.h

@@ -20,7 +20,6 @@ struct f_phonet_opts {
 struct net_device *gphonet_setup_default(void);
 void gphonet_set_gadget(struct net_device *net, struct usb_gadget *g);
 int gphonet_register_netdev(struct net_device *net);
-int phonet_bind_config(struct usb_configuration *c, struct net_device *dev);
 void gphonet_cleanup(struct net_device *dev);
 
 #endif /* __U_PHONET_H */

drivers/usb/gadget/function/u_serial.h

@@ -71,8 +71,4 @@ void gserial_disconnect(struct gserial *);
 void gserial_suspend(struct gserial *p);
 void gserial_resume(struct gserial *p);
 
-/* functions are bound to configurations by a config or gadget driver */
-int gser_bind_config(struct usb_configuration *c, u8 port_num);
-int obex_bind_config(struct usb_configuration *c, u8 port_num);
-
 #endif /* __U_SERIAL_H */

drivers/usb/gadget/function/uvc.h

@@ -176,8 +176,6 @@ struct uvc_file_handle {
  */
 
 extern void uvc_function_setup_continue(struct uvc_device *uvc);
-extern void uvc_endpoint_stream(struct uvc_device *dev);
-
 extern void uvc_function_connect(struct uvc_device *uvc);
 extern void uvc_function_disconnect(struct uvc_device *uvc);
 

drivers/usb/gadget/function/uvc_video.c

@@ -382,13 +382,13 @@ static void uvcg_video_pump(struct work_struct *work)
 {
 	struct uvc_video *video = container_of(work, struct uvc_video, pump);
 	struct uvc_video_queue *queue = &video->queue;
+	/* video->max_payload_size is only set when using bulk transfer */
+	bool is_bulk = video->max_payload_size;
 	struct usb_request *req = NULL;
 	struct uvc_buffer *buf;
 	unsigned long flags;
+	bool buf_done;
 	int ret;
-	bool buf_int;
-	/* video->max_payload_size is only set when using bulk transfer */
-	bool is_bulk = video->max_payload_size;
 
 	while (video->ep->enabled) {
 		/*
@@ -414,20 +414,19 @@ static void uvcg_video_pump(struct work_struct *work)
 
 		if (buf != NULL) {
 			video->encode(req, video, buf);
-			/* Always interrupt for the last request of a video buffer */
+			buf_done = buf->state == UVC_BUF_STATE_DONE;
-			buf_int = buf->state == UVC_BUF_STATE_DONE;
 		} else if (!(queue->flags & UVC_QUEUE_DISCONNECTED) && !is_bulk) {
 			/*
 			 * No video buffer available; the queue is still connected and
-			 * we're traferring over ISOC. Queue a 0 length request to
+			 * we're transferring over ISOC. Queue a 0 length request to
 			 * prevent missed ISOC transfers.
 			 */
 			req->length = 0;
-			buf_int = false;
+			buf_done = false;
 		} else {
 			/*
-			 * Either queue has been disconnected or no video buffer
+			 * Either the queue has been disconnected or no video buffer
-			 * available to bulk transfer. Either way, stop processing
+			 * available for bulk transfer. Either way, stop processing
 			 * further.
 			 */
 			spin_unlock_irqrestore(&queue->irqlock, flags);
@@ -435,11 +434,24 @@ static void uvcg_video_pump(struct work_struct *work)
 		}
 
 		/*
-		 * With usb3 we have more requests. This will decrease the
+		 * With USB3 handling more requests at a higher speed, we can't
-		 * interrupt load to a quarter but also catches the corner
+		 * afford to generate an interrupt for every request. Decide to
-		 * cases, which needs to be handled.
+		 * interrupt:
+		 *
+		 * - When no more requests are available in the free queue, as
+		 *   this may be our last chance to refill the endpoint's
+		 *   request queue.
+		 *
+		 * - When this is request is the last request for the video
+		 *   buffer, as we want to start sending the next video buffer
+		 *   ASAP in case it doesn't get started already in the next
+		 *   iteration of this loop.
+		 *
+		 * - Four times over the length of the requests queue (as
+		 *   indicated by video->uvc_num_requests), as a trade-off
+		 *   between latency and interrupt load.
 		 */
-		if (list_empty(&video->req_free) || buf_int ||
+		if (list_empty(&video->req_free) || buf_done ||
 		    !(video->req_int_count %
 		       DIV_ROUND_UP(video->uvc_num_requests, 4))) {
 			video->req_int_count = 0;

drivers/vhost/vringh.c

@@ -123,8 +123,18 @@ static inline ssize_t vringh_iov_xfer(struct vringh *vrh,
 		done += partlen;
 		len -= partlen;
 		ptr += partlen;
+		iov->consumed += partlen;
+		iov->iov[iov->i].iov_len -= partlen;
+		iov->iov[iov->i].iov_base += partlen;
 
-		vringh_kiov_advance(iov, partlen);
+		if (!iov->iov[iov->i].iov_len) {
+			/* Fix up old iov element then increment. */
+			iov->iov[iov->i].iov_len = iov->consumed;
+			iov->iov[iov->i].iov_base -= iov->consumed;
+
+			iov->consumed = 0;
+			iov->i++;
+		}
 	}
 	return done;
 }

fs/fuse/dir.c

@@ -186,7 +186,7 @@ static bool backing_data_changed(struct fuse_inode *fi, struct dentry *entry,
 	int err;
 	bool ret = true;
 
-	if (!entry) {
+	if (!entry || !fi->backing_inode) {
 		ret = false;
 		goto put_backing_file;
 	}

fs/proc/array.c

@@ -92,6 +92,7 @@
 #include <linux/string_helpers.h>
 #include <linux/user_namespace.h>
 #include <linux/fs_struct.h>
+#include <linux/kthread.h>
 
 #include <asm/processor.h>
 #include "internal.h"
@@ -102,6 +103,8 @@ void proc_task_name(struct seq_file *m, struct task_struct *p, bool escape)
 
 	if (p->flags & PF_WQ_WORKER)
 		wq_worker_comm(tcomm, sizeof(tcomm), p);
+	else if (p->flags & PF_KTHREAD)
+		get_kthread_comm(tcomm, sizeof(tcomm), p);
 	else
 		__get_task_comm(tcomm, sizeof(tcomm), p);
 

fs/proc/inode.c

@@ -489,6 +489,9 @@ static int proc_reg_open(struct inode *inode, struct file *file)
 	typeof_member(struct proc_ops, proc_release) release;
 	struct pde_opener *pdeo;
 
+	if (!pde->proc_ops->proc_lseek)
+		file->f_mode &= ~FMODE_LSEEK;
+
 	if (pde_is_permanent(pde)) {
 		open = pde->proc_ops->proc_open;
 		if (open)

include/linux/kthread.h

@@ -33,6 +33,7 @@ struct task_struct *kthread_create_on_cpu(int (*threadfn)(void *data),
 					  unsigned int cpu,
 					  const char *namefmt);
 
+void get_kthread_comm(char *buf, size_t buf_size, struct task_struct *tsk);
 void set_kthread_struct(struct task_struct *p);
 
 void kthread_set_per_cpu(struct task_struct *k, int cpu);

include/trace/hooks/mm.h

@@ -33,6 +33,7 @@ struct track;
 struct address_space;
 struct page_vma_mapped_walk;
 struct cma;
+struct compact_control;
 
 DECLARE_RESTRICTED_HOOK(android_rvh_set_skip_swapcache_flags,
 			TP_PROTO(gfp_t *flags),
@@ -255,6 +256,13 @@ DECLARE_HOOK(android_vh_cma_alloc_bypass,
 	TP_PROTO(struct cma *cma, unsigned long count, unsigned int align,
 		bool no_warn, struct page **page, bool *bypass),
 	TP_ARGS(cma, count, align, no_warn, page, bypass));
+DECLARE_HOOK(android_vh_alloc_pages_entry,
+	TP_PROTO(gfp_t *gfp, unsigned int order, int preferred_nid,
+		nodemask_t *nodemask),
+	TP_ARGS(gfp, order, preferred_nid, nodemask));
+DECLARE_HOOK(android_vh_isolate_freepages,
+	TP_PROTO(struct compact_control *cc, struct page *page, bool *bypass),
+	TP_ARGS(cc, page, bypass));
 #endif /* _TRACE_HOOK_MM_H */
 
 /* This part must be outside protection */

kernel/kthread.c

@@ -60,6 +60,8 @@ struct kthread {
 #ifdef CONFIG_BLK_CGROUP
 	struct cgroup_subsys_state *blkcg_css;
 #endif
+	/* To store the full name if task comm is truncated. */
+	char *full_name;
 };
 
 enum KTHREAD_BITS {
@@ -93,6 +95,18 @@ static inline struct kthread *__to_kthread(struct task_struct *p)
 	return kthread;
 }
 
+void get_kthread_comm(char *buf, size_t buf_size, struct task_struct *tsk)
+{
+	struct kthread *kthread = to_kthread(tsk);
+
+	if (!kthread || !kthread->full_name) {
+		__get_task_comm(buf, buf_size, tsk);
+		return;
+	}
+
+	strscpy_pad(buf, kthread->full_name, buf_size);
+}
+
 void set_kthread_struct(struct task_struct *p)
 {
 	struct kthread *kthread;
@@ -118,9 +132,13 @@ void free_kthread_struct(struct task_struct *k)
 	 * or if kmalloc() in kthread() failed.
 	 */
 	kthread = to_kthread(k);
+	if (!kthread)
+		return;
+
 #ifdef CONFIG_BLK_CGROUP
-	WARN_ON_ONCE(kthread && kthread->blkcg_css);
+	WARN_ON_ONCE(kthread->blkcg_css);
 #endif
+	kfree(kthread->full_name);
 	kfree(kthread);
 }
 
@@ -399,12 +417,22 @@ struct task_struct *__kthread_create_on_node(int (*threadfn)(void *data),
 	if (!IS_ERR(task)) {
 		static const struct sched_param param = { .sched_priority = 0 };
 		char name[TASK_COMM_LEN];
+		va_list aq;
+		int len;
 
 		/*
 		 * task is already visible to other tasks, so updating
 		 * COMM must be protected.
 		 */
-		vsnprintf(name, sizeof(name), namefmt, args);
+		va_copy(aq, args);
+		len = vsnprintf(name, sizeof(name), namefmt, aq);
+		va_end(aq);
+		if (len >= TASK_COMM_LEN) {
+			struct kthread *kthread = to_kthread(task);
+
+			/* leave it truncated when out of memory. */
+			kthread->full_name = kvasprintf(GFP_KERNEL, namefmt, args);
+		}
 		set_task_comm(task, name);
 		/*
 		 * root may have changed our (kthreadd's) priority or CPU mask.

mm/compaction.c

@@ -1601,6 +1601,7 @@ static void isolate_freepages(struct compact_control *cc)
 	unsigned long low_pfn;	     /* lowest pfn scanner is able to scan */
 	struct list_head *freelist = &cc->freepages;
 	unsigned int stride;
+	bool bypass = false;
 
 	/* Try a small search of the free lists for a candidate */
 	isolate_start_pfn = fast_isolate_freepages(cc);
@@ -1656,6 +1657,10 @@ static void isolate_freepages(struct compact_control *cc)
 		if (!isolation_suitable(cc, page))
 			continue;
 
+		trace_android_vh_isolate_freepages(cc, page, &bypass);
+		if (bypass)
+			continue;
+
 		/* Found a block suitable for isolating free pages from. */
 		nr_isolated = isolate_freepages_block(cc, &isolate_start_pfn,
 					block_end_pfn, freelist, stride, false);

mm/page_alloc.c

@@ -83,6 +83,8 @@
 #include "shuffle.h"
 #include "page_reporting.h"
 
+EXPORT_TRACEPOINT_SYMBOL_GPL(mm_page_alloc);
+
 /* Free Page Internal flags: for internal, non-pcp variants of free_pages(). */
 typedef int __bitwise fpi_t;
 
@@ -5740,6 +5742,7 @@ struct page *__alloc_pages(gfp_t gfp, unsigned int order, int preferred_nid,
 	gfp_t alloc_gfp; /* The gfp_t that was actually used for allocation */
 	struct alloc_context ac = { };
 
+	trace_android_vh_alloc_pages_entry(&gfp, order, preferred_nid, nodemask);
 	/*
 	 * There are several places where we assume that the order value is sane
 	 * so bail out early if the request is out of bound.

net/netfilter/ipset/ip_set_core.c

@@ -682,6 +682,14 @@ __ip_set_put(struct ip_set *set)
 /* set->ref can be swapped out by ip_set_swap, netlink events (like dump) need
  * a separate reference counter
  */
+static void
+__ip_set_get_netlink(struct ip_set *set)
+{
+	write_lock_bh(&ip_set_ref_lock);
+	set->ref_netlink++;
+	write_unlock_bh(&ip_set_ref_lock);
+}
+
 static void
 __ip_set_put_netlink(struct ip_set *set)
 {
@@ -1695,11 +1703,11 @@ call_ad(struct net *net, struct sock *ctnl, struct sk_buff *skb,
 
 	do {
 		if (retried) {
-			__ip_set_get(set);
+			__ip_set_get_netlink(set);
 			nfnl_unlock(NFNL_SUBSYS_IPSET);
 			cond_resched();
 			nfnl_lock(NFNL_SUBSYS_IPSET);
-			__ip_set_put(set);
+			__ip_set_put_netlink(set);
 		}
 
 		ip_set_lock(set);

net/netfilter/ipset/ip_set_hash_netportnet.c

@@ -36,6 +36,7 @@ MODULE_ALIAS("ip_set_hash:net,port,net");
 #define IP_SET_HASH_WITH_PROTO
 #define IP_SET_HASH_WITH_NETS
 #define IPSET_NET_COUNT 2
+#define IP_SET_HASH_WITH_NET0
 
 /* IPv4 variant */
 

net/netfilter/xt_sctp.c

@@ -150,6 +150,8 @@ static int sctp_mt_check(const struct xt_mtchk_param *par)
 {
 	const struct xt_sctp_info *info = par->matchinfo;
 
+	if (info->flag_count > ARRAY_SIZE(info->flag_info))
+		return -EINVAL;
 	if (info->flags & ~XT_SCTP_VALID_FLAGS)
 		return -EINVAL;
 	if (info->invflags & ~XT_SCTP_VALID_FLAGS)

net/xfrm/xfrm_user.c

@@ -1159,6 +1159,15 @@ static int xfrm_dump_sa(struct sk_buff *skb, struct netlink_callback *cb)
 					 sizeof(*filter), GFP_KERNEL);
 			if (filter == NULL)
 				return -ENOMEM;
+
+			/* see addr_match(), (prefix length >> 5) << 2
+			 * will be used to compare xfrm_address_t
+			 */
+			if (filter->splen > (sizeof(xfrm_address_t) << 3) ||
+			    filter->dplen > (sizeof(xfrm_address_t) << 3)) {
+				kfree(filter);
+				return -EINVAL;
+			}
 		}
 
 		if (attrs[XFRMA_PROTO])