Merge branch 'android13-5.15' into 'android13-5.15-lts'

Sync up with android13-5.15 for the following commits now that the ABI
is frozen:

e31981896d ANDROID: ABI: Update symbols to unisoc whitelist for the drm
f1bf82c3da ANDROID: Enable GKI Dr. No Enforcement
3456f4eeee ANDROID: GKI: 6/17/2022 KMI update
a047de7997 ANDROID: GKI: add PG_oem_reserved in enum pageflags
b7a7765d8a ANDROID: power: Add ANDROID_OEM_DATA_ARRAY in freq_qos_request.
d1faa010ca FROMGIT: cgroup: Use separate src/dst nodes when preloading css_sets for migration
dfdd57b019 ANDROID: vendor_hooks: export hooks of mem_cgroup subsystem
04bb2779c9 ANDROID: vendor_hooks: add a field in pglist_data
59e1e26589 ANDROID: Allow vendor module to reclaim a memcg
326983dc9c ANDROID: Export memcg functions to allow module to add new files
f50ef59058 ANDROID: vendor_hooks: add hooks in mem_cgroup subsystem
6575ef0cd7 ANDROID: ASoC: core- Add vendor data fields to support  hostless DAI
8255004dae ANDROID: GKI: Add ANDROID_OEM_DATA_ARRAY() in struct ufs_hba
1c450d2d9e ANDROID: gic-v3: Update vendor hook to set affinity in GIC v3
d13008eb9f ANDROID: GKI: add ANDROID_OEM_DATA in struct bio
6abf3c5ef2 BACKPORT: FROMLIST: cfg80211: Indicate MLO connection info in connect and roam callbacks
29356dc0a2 BACKPORT: FROMGIT: wifi: cfg80211: add optional link add/remove callbacks
becbedacf9 BACKPORT: FROMGIT: wifi: cfg80211: sort trace.h
e1913fb476 BACKPORT: FROMGIT: wifi: nl80211: update add/remove link command
3f048cd911 BACKPORT: FROMGIT: wifi: nl80211: support MLO in auth/assoc
9af03657fb BACKPORT: FROMGIT: wifi: cfg80211: simplify cfg80211_mlme_auth() prototype
27f48acb1b BACKPORT: FROMGIT: wifi: ieee80211: add definitions for multi-link element
10f80b7397 BACKPORT: FROMGIT: wifi: nl80211: refactor BSS lookup in nl80211_associate()
442c68f14f BACKPORT: FROMGIT: wifi: cfg80211: mlme: get BSS entry outside cfg80211_mlme_assoc()
d975927513 BACKPORT: FROMGIT: wifi: cfg80211: do some rework towards MLO link APIs
af34adaa6a BACKPORT: FROMLIST: cfg80211: Increase akm_suites array size in cfg80211_crypto_settings
bee631cec5 ANDROID: nl80211/cfg80211: Add support to do API changes after GKI freeze
3dc56c75d2 ANDROID: Add macros to create reserved data fields to backport upstream changes
10f3543124 UPSTREAM: wil6210: remove 'freq' debugfs
d14ea158d6 ANDROID: GKI: Add ANDROID_OEM_DATA() in struct queue_limits
d534eb259e FROMLIST: ALSA: control: Use xarray for faster  lookups
bcef255e59 ANDROID: vendor_hooks: add a field in mem_cgroup
efc7473371 FROMGIT: PCI: dwc: Fix MSI msi_msg dma mapping
99af01f2b7 Revert "ANDROID: PCI: dwc: revert dwc 32-bit DMA mask for MSI address requirement"
7b26719a77 ANDROID: GKI: use internal type definitions in vendor hooks
d5f809c84d ANDROID: GKI: use public type definitions in vendor hooks
6b7259073e ANDROID: GKI: add ANDROID_OEM_DATA() in struct request_queue
7a43f1f694 ANDROID: vendor_hooks: add hook and OEM data for slab shrink
cbd20786b6 FROMLIST: scsi: ufs: Export regulator functions
df17a9b985 ANDROID: GKI: timer.h: add Android ABI padding to a structure
706766bc6c ANDROID: GKI: USB: add Android ABI padding to some structures
a61964fc70 ANDROID: GKI: sched.h: add Android ABI padding to some structures
6a79d5b96b ANDROID: GKI: module.h: add Android ABI padding to some structures
09c51db0d2 ANDROID: GKI: sock.h: add Android ABI padding to some structures
0b82194ecb ANDROID: GKI: sched: add Android ABI padding to some structures
da717c3ce1 ANDROID: GKI: mount.h: add Android ABI padding to some structures
98042d19ad ANDROID: GKI: mm: add Android ABI padding to some structures
b89d56cc81 ANDROID: GKI: add some padding to some driver core structures
5940799827 ANDROID: GKI: add padding to struct hid_device
936b0da47b ANDROID: GKI: USB: XHCI: add Android ABI padding to lots of xhci structures
db2b68eb63 ANDROID: GKI: dwc3: add Android ABI padding to some structures
e5fd26ff2d ANDROID: GKI: sound/usb/card.h: add Android ABI padding to struct snd_usb_endpoint
0e6d2288f0 ANDROID: GKI: user_namespace.h: add Android ABI padding to a structure
55f5cb7439 ANDROID: GKI: quota.h: add Android ABI padding to some structures
8137f1d169 ANDROID: GKI: mmu_notifier.h: add Android ABI padding to some structures
30d36e31c5 ANDROID: GKI: mm.h: add Android ABI padding to a structure
c57f9e1d48 ANDROID: GKI: kobject.h: add Android ABI padding to some structures
4a30d8ecf0 ANDROID: GKI: kernfs.h: add Android ABI padding to some structures
7426a5b28c ANDROID: GKI: irqdomain.h: add Android ABI padding to a structure
abc5541f4c ANDROID: GKI: ioport.h: add Android ABI padding to a structure
80b63f2f01 ANDROID: GKI: iomap.h: add Android ABI padding to a structure
2ca1ba50e6 ANDROID: GKI: hrtimer.h: add Android ABI padding to a structure
f25b001302 ANDROID: GKI: genhd.h: add Android ABI padding to some structures
5988e691de ANDROID: GKI: ethtool.h: add Android ABI padding to a structure
5d4e30d9b9 ANDROID: GKI: dma-mapping.h: add Android ABI padding to a structure
bd3b9b13ef ANDROID: GKI: networking: add Android ABI padding to a lot of networking structures
c422535706 ANDROID: GKI: blk_types.h: add Android ABI padding to a structure
94e58fdb6e ANDROID: GKI: scsi.h: add Android ABI padding to a structure
804026210f ANDROID: GKI: pci: add Android ABI padding to some structures
4e079c929f ANDROID: GKI: add Android ABI padding to struct nf_conn
5e65f67ae0 ANDROID: abi_gki_aarch64_qcom: Add rproc and rpmsg helpers
111cae8473 FROMLIST: rpmsg: core: Introduce rproc_mem_entry_free
9eed2acb93 FROMLIST: remoteproc: core: Add helper to remove carveouts
6ac966ab47 UPSTREAM: remoteproc: move rproc_da_to_va declaration to remoteproc.h
76801c2626 FROMLIST: rpmsg: char: Add support to use rpmsg_rx_done
a4f64634ad FROMLIST: rpmsg: core: Add rx done hooks
60a6ad4211 FROMLIST: mmc: sdhci-msm: Enable force hw reset during cqe recovery
024f778bbb FROMLIST: mmc: core: Introduce new flag to force hardware reset
74e6357176 ANDROID: GKI: Add ANDROID_OEM_DATA in struct ufs_dev_info
9662426af3 ANDROID: sched: Add oem data in struct rq
d6f34bc835 FROMLIST: drivers/thermal/thermal_of: Add critical/hot ops support for thermal_of sensor
50bca2f782 Revert "Revert "ANDROID: GKI: enable CONFIG_BLK_CGROUP_IOCOST""
dc3e85677b Revert "Revert "ANDROID: GKI: Add ANDROID_OEM_DATA in struct blk_mq_tags""
90e5d9e303 Revert "Revert "ANDROID: GKI: Add ANDROID_OEM_DATA in struct blk_mq_ctx""
071859b45a ANDROID: mmc: Add vendor hooks
22c62839a1 ANDROID: scsi: ufs: Enable CONFIG_SCSI_UFS_HPB
1ef6a91031 FROMGIT: drivers/thermal/thermal_of: Add change_mode ops support for thermal_of sensor
377ef18ed6 FROMGIT: mmc: cqhci: Capture eMMC and SD card errors
232df716fb FROMGIT: mmc: debugfs: Add debug fs error state entry for mmc driver
a70d301048 FROMGIT: mmc: debugfs: Add debug fs entry for mmc driver
6f0f720466 FROMGIT: mmc: sdhci: Capture eMMC and SD card errors
7ace0d462a FROMGIT: mmc: core: Capture eMMC and SD card errors
45850948d1 ANDROID: GKI: Add OEM data to mutex/rwsem
1dc9f51423 ANDROID: GKI: net: add vendor hooks for 'struct sock' lifecycle
72c4b4cdad ANDROID: GKI: net: add vendor hooks for 'struct nf_conn' lifecycle
7948b5ff64 ANDROID: GKI: add vendor padding variable in struct sock
889670d815 ANDROID: GKI: add vendor padding variable in struct nf_conn
2d9a4bfb7b FROMLIST: dma-buf: Move sysfs work out of DMA-BUF export path
ebc5cf22b4 ANDROID: Add vendor hook for MemcgV2 optimization
dbb4320c14 UPSTREAM: scsi: ufs: core: Probe for temperature notification support
8ee9980737 ANDROID: scsi: ufs: Support Multi-Circular Queue
b528c7889d UPSTREAM: mmc: core: Add host specific tuning support for eMMC HS400 mode
6b6ee4548a UPSTREAM: mmc: mtk-sd: Add HS400 online tuning support
9a63e4dcc0 UPSTREAM: dt-bindings: mmc: mtk-sd: Add hs400 dly3 setting
6551a55c4d ANDROID: powerpc/mm: protect vm_file during speculative page fault handling
4fc18576ca ANDROID: x86/mm: protect vm_file during speculative page fault handling
0f4ea1e593 ANDROID: arm64/mm: protect vm_file during speculative page fault handling
a3fe25d923 ANDROID: add vma->file_ref_count to synchronize vma->vm_file destruction
a16e169d36 Revert "ANDROID: Use the notifier lock to perform file-backed vma teardown"
f25e13c1bc Revert "ANDROID: Fix build errors caused by missing mmu_notifier_lock definition"
9a526b9527 UPSTREAM: xfrm: fix "disable_policy" flag use when arriving from different devices
6508a3753c UPSTREAM: xfrm: rework default policy structure
3ae9599990 UPSTREAM: net: fix dev_fill_forward_path with pppoe + bridge
75cd98366d UPSTREAM: btrfs: fallback to blocking mode when doing async dio over multiple extents
a5070df850 UPSTREAM: btrfs: fix deadlock due to page faults during direct IO reads and writes
3446e643b7 UPSTREAM: mm: gup: make fault_in_safe_writeable() use fixup_user_fault()
ee1ecd7ea5 UPSTREAM: gfs2: Fix mmap + page fault deadlocks for direct I/O
127a8ed2d3 UPSTREAM: iov_iter: Introduce nofault flag to disable page faults
ccf74d1eca UPSTREAM: selftests/bpf: Add test for reg2btf_ids out of bounds access
83e7514f57 UPSTREAM: bpf: Fix crash due to out of bounds access into reg2btf_ids.
2f53e2190d UPSTREAM: bpf/selftests: Test PTR_TO_RDONLY_MEM
8f07caaddc UPSTREAM: bpf: Add MEM_RDONLY for helper args that are pointers to rdonly mem.
e1714bff1c UPSTREAM: bpf: Make per_cpu_ptr return rdonly PTR_TO_MEM.
d7ebee8df3 UPSTREAM: bpf: Convert PTR_TO_MEM_OR_NULL to composable types.
1cd4928129 UPSTREAM: bpf: Introduce MEM_RDONLY flag
13fc6550b0 UPSTREAM: bpf: Replace PTR_TO_XXX_OR_NULL with PTR_TO_XXX | PTR_MAYBE_NULL
f5a45f25bf UPSTREAM: bpf: Replace RET_XXX_OR_NULL with RET_XXX | PTR_MAYBE_NULL
cc6305f056 UPSTREAM: bpf: Replace ARG_XXX_OR_NULL with ARG_XXX | PTR_MAYBE_NULL
cc3b22bead UPSTREAM: bpf: Introduce composable reg, ret and arg types.
3f1805c930 ANDROID: Update symbol list for mtk
536083a4ce ANDROID: GKI: add symbol list file for honor
4993f5a6dd ANDROID: GKI: Update symbol list for Exynos SoC
546461d83f ANDROID: KVM: arm64: Prevent kmemleak from accessing .hyp.data
4a006e6d47 FROMGIT: KVM: arm64: Prevent kmemleak from accessing pKVM memory
3882af1c70 ANDROID: ABI: Update symbols to unisoc whitelist for the scheduler 4st
7754d28433 ANDROID: GKI: Update symbols to symbol list
4ee2f8b56d FROMLIST: iommu/mediatek: Allow page table PA up to 35bit
0b6600b792 FROMLIST: iommu/io-pgtable-arm-v7s: Add a quirk to allow pgtable PA up to 35bit
4f746c15d7 ANDROID: Add vendor hooks to signal.
fd2e5c65ed ANDROID: ashmem: Export is_ashmem_file
348b1456e9 ANDROID: vendor_hooks: bypass shrink slab
e53e6edb46 FROMLIST: devcoredump : Serialize devcd_del work
ab7e76f60c ANDROID: GKI: Update symbols list for vivo
f58e5166c0 ANDROID: ABI: Update symbols used by the unisoc filesystem whitelist for the 1st
f5ba378e89 FROMLIST: of: of_reserved_mem: Increase limit for reserved_mem regions
648e73245b ANDROID: GKI: Add symbol list file for vivo
64a4e77c86 ANDROID: Revert "tracing: Disable "other" permission bits in the tracefs files"
c8a2e13615 ANDROID: vendor_hooks: Add hook for binder
38d8fefb73 ANDROID: GKI: Update abi_gki_aarch64_qcom for devm_of_clk_del_provider
4a0a0fef25 Revert "ANDROID: umh: Enable usermode helper for required use cases"
43c339540b ANDROID: GKI: update module list for fips140 build
b5b6394e25 BACKPORT: mm: khugepaged: recalculate min_free_kbytes after stopping khugepaged
368cd63a4a ANDROID: fault: Add vendor hook for TLB conflict
56b51fac38 BACKPORT: FROMLIST: block/bfq: Enable I/O statistics
933eddd126 ANDROID: Adding Image.gz and boot-gz.img
f28cdbf9ee ANDROID: usb: dwc3: export tracepoint for dwc3 read/write
7a0c3689e0 ANDROID: usb: add EXPORT_TRACE_SYMBOL to export tracepoint
d03bf01b43 UPSTREAM: usb: dwc3: core: Add error log when core soft reset failed
435a42a0b4 ANDROID: GKI: Update symbols to abi_gki_aarch64_oplus
1502f0ea7c ANDROID: Add hook to show vendor info for transactions
15a32b46ee ANDROID: GKI: Update abi_gki_aarch64_qcom for partial init tracepoint
e8b5afb658 ANDROID: vendor_hooks: Add hook for partial_init
854f840411 ANDROID: mutex: Add vendor hook to init mutex oem data.
7c82ee91c2 FROMLIST: scsi: ufs-mediatek: Introduce workaround for power mode change
0b0ceacf04 FROMLIST: scsi: ufs: Fix ADAPT logic for HS-G5
97d940cfa3 FROMLIST: scsi: ufs: Export ufshcd_uic_change_pwr_mode()
57388a13ab ANDROID: Update symbol list for mtk
2d18a97422 BACKPORT: FROMGIT: usb: dwc3: add power down scale setting
08a1879c87 ANDROID: GKI: remove info print for header generation
5452f089f9 UPSTREAM: gup: Introduce FOLL_NOFAULT flag to disable page faults
18e16d6365 UPSTREAM: iomap: Support partial direct I/O on user copy failures
89f91db7ae UPSTREAM: iomap: Fix iomap_dio_rw return value for user copies
9d16bdb659 UPSTREAM: gfs2: Fix mmap + page fault deadlocks for buffered I/O
64ef40ba87 UPSTREAM: gfs2: Eliminate ip->i_gh
f0a127f84b UPSTREAM: gfs2: Move the inode glock locking to gfs2_file_buffered_write
4e70d7c309 UPSTREAM: gfs2: Introduce flag for glock holder auto-demotion
d0e98c116d UPSTREAM: gfs2: Clean up function may_grant
3b46c843f2 UPSTREAM: gfs2: Add wrapper for iomap_file_buffered_write
6603584106 UPSTREAM: iov_iter: Introduce fault_in_iov_iter_writeable
e1c331f4ec UPSTREAM: iov_iter: Turn iov_iter_fault_in_readable into fault_in_iov_iter_readable
d9fb814064 UPSTREAM: gup: Turn fault_in_pages_{readable,writeable} into fault_in_{readable,writeable}
4d242c3433 ANDROID: vendor_hooks: tune reclaim swappiness or scan type
113b63538c FROMLIST: power_supply: Register cooling device outside of probe
e4e3aadd01 ANDROID: vendor_hooks: Add hooks to tcp/udp send/recv msg functions.
cabca1b98e ANDROID: GKI: Add vendor hook to binder transaction
d1367b5473 ANDROID: binder: fix race in priority restore
e8fcc17a57 ANDROID: binder: switch task argument for binder_thread
16c04a2732 ANDROID: binder: pass desired priority by reference
7da5987f5d ANDROID: binder: fold common setup of node_prio
6fbdd5a252 ANDROID: vendor_hooks: Add hooks for account process tick
0902cc73b7 ANDROID: vendor_hooks: Add hooks for rwsem and mutex
3e3677f8f1 UPSTREAM: usb: gadget: f_mass_storage: Make CD-ROM emulation work with Mac OS-X
e0a580025c ANDROID: Update symbol list for mtk
9a7732c0b2 ANDROID: input: Add vendor hook for __pass_event in evdev.c
c555553a40 ANDROID: umh: Enable usermode helper for required use cases
50a2b178c5 ANDROID: vendor_hooks: Add hooks to dup_task_struct
d450a89aa1 ANDROID: GKI: add symbol list file for xiaomi
bfda92e572 ANDROID: ABI: Update symbols to unisoc whitelist for the 7th
dd4c3a3bc9 ANDROID: GKI: Update abi_gki_aarch64_qcom for pm flag set tracepoint
596dcf7986 ANDROID: vendor_hooks: Add hook in wakeup functionality
388f95c620 ANDROID: gki_defconfig: enable CONFIG_KFENCE_STATIC_KEYS
53df1b822d ANDROID: vendor_hooks: Add hooks for account irqtime process tick
825d9968d9 ANDROID: abi_gki_aarch64_qcom: Update qcom abi symbol list
862fbb8517 FROMGIT: mmc: core: Set reset done after hw reset
b9029542be ANDROID: KVM: arm64: Don't update IOMMUs unnecessarily
39e9847ef0 ANDROID: Creating boot.img for x86_64 GKI
3071eda198 ANDROID: abi_gki_aarch64_qcom: Update symbol list with usb_role_string
1ac270abbd ANDROID: gki_defconfig: Enable RCU_BOOST config
af6c1477c3 ANDROID: abi_gki_aarch64_qcom: Add android_vh_disable_thermal_cooling_stats
f6e47fd00f ANDROID: thermal: vendor hook to disable thermal cooling stats
2baf6bfef4 UPSTREAM: usb: gadget: f_mass_storage: Disable eps during disconnect
c1993b4cbc ANDROID: Update symbols list and ABI for qcom
03b512f716 UPSTREAM: media: uvcvideo: Add UVC_GUID_FORMAT_H265
d1b6bd094b ANDROID: vendor_hooks: Add hook in shrink_node_memcgs
120823bf95 UPSTREAM: usb: dwc3: gadget: Change to dev_dbg() when queuing to inactive gadget/ep
7bfb6542ae ANDROID: Add several symbol lists for unisoc
78d6de7863 ANDROID: Fix the CONFIG_ANDROID_VENDOR_OEM_DATA=n build
45a91f3011 ANDROID: abi_gki_aarch64_qcom: Add kobject_get
842137671f Revert "ANDROID: GKI: Add ANDROID_OEM_DATA in struct request_queue"
443c11e0b1 Revert "ANDROID: GKI: Add ANDROID_OEM_DATA in struct blk_mq_ctx"
b982f17e13 Revert "ANDROID: GKI: Add ANDROID_OEM_DATA in struct blk_mq_tags"
3062974bf9 Revert "ANDROID: GKI: enable CONFIG_BLK_CGROUP_IOCOST"
f0b29dd9e3 ANDROID: lib: Export show_mem() for vendor module usage
50e4cd9df7 ANDROID: vendor_hooks: Add hooks for memory when debug
5a70133feb ANDROID: vendor_hooks: Add hook in try_to_unmap_one()
73c9d4a9d5 ANDROID: vendor_hooks: Add hook in mmap_region()
caaafb7005 FROMGIT: cfi: Fix __cfi_slowpath_diag RCU usage with cpuidle
49ad57e915 ANDROID: mm/memory_hotplug: Don't special case memory_block_size_bytes
6b6c4a7373 ANDROID: abi_gki_aarch64_qcom: Add android_vh_ufs_clock_scaling
3ff9481aad ANDROID: scsi: ufs: Add hook to influence the UFS clock scaling policy
442d3a107b ANDROID: Update symbol list for mtk
f85e3d9101 ANDROID: scheduler: export task_sched_runtime
aa0e7ec774 ANDROID: GKI: enable CONFIG_BLK_CGROUP_IOCOST
9123d4dfe5 ANDROID: GKI: Add ANDROID_OEM_DATA in struct blk_mq_tags
7f6e518e43 ANDROID: GKI: Add ANDROID_OEM_DATA in struct blk_mq_ctx
f4e36db507 ANDROID: GKI: Add ANDROID_OEM_DATA in struct request_queue
7e54032750 ANDROID: Update mtktv symbol list
c6b53b7aac ANDROID: abi_gki_aarch64_qcom: Update qcom abi symbol list
3c55aa6ffe ANDROID: GKI: add vendor padding variable in struct skb_shared_info
f45d12df24 ANDROID: GKI: Enable DM_INIT
149474c544 FROMLIST: power_supply: Use of-thermal cdev registration API
291dfda577 ANDROID: init_task: Init android vendor and oem data
afd403d142 ANDROID: qcom: Add flush_delayed_fput to ABI
6976d861b5 ANDROID: GKI: build damon reclaim
11bc7e6f8e FROMLIST: mm/damon/reclaim: Fix the timer always stays active
71da156123 BACKPORT: treewide: Add missing includes masked by cgroup -> bpf dependency
caffd17b02 UPSTREAM: mm/damon: modify damon_rand() macro to static inline function
802a5dc657 UPSTREAM: mm/damon: add 'age' of region tracepoint support
7019f96d3f UPSTREAM: mm/damon: hide kernel pointer from tracepoint event
c5bf6f61a3 UPSTREAM: mm/damon/vaddr: hide kernel pointer from damon_va_three_regions() failure log
d7cbb8dc2a UPSTREAM: mm/damon/vaddr: use pr_debug() for damon_va_three_regions() failure logging
2d1227b126 UPSTREAM: mm/damon/dbgfs: remove an unnecessary variable
2861a7ee7f UPSTREAM: mm/damon: move the implementation of damon_insert_region to damon.h
508a322b77 UPSTREAM: mm/damon: add access checking for hugetlb pages
6fdce9a014 UPSTREAM: mm/damon/dbgfs: support all DAMOS stats
86a0f3958c UPSTREAM: mm/damon/reclaim: provide reclamation statistics
168c5dc29f UPSTREAM: mm/damon/schemes: account how many times quota limit has exceeded
9818aed77f UPSTREAM: mm/damon/schemes: account scheme actions that successfully applied
82b9795ec7 UPSTREAM: mm/damon: convert macro functions to static inline functions
f92ba978fa UPSTREAM: mm/damon: move damon_rand() definition into damon.h
6e04c85054 UPSTREAM: mm/damon/schemes: add the validity judgment of thresholds
548424cefd UPSTREAM: mm/damon/vaddr: remove swap_ranges() and replace it with swap()
428792a841 UPSTREAM: mm/damon: remove some unneeded function definitions in damon.h
38e43af06a UPSTREAM: mm/damon/core: use abs() instead of diff_of()
cd8dce3046 UPSTREAM: mm/damon: unified access_check function naming rules
bdf02a7f4e UPSTREAM: mm/damon/vaddr-test: remove unnecessary variables
a5bd0713be UPSTREAM: mm/damon/vaddr-test: split a test function having >1024 bytes frame size
2f0229c408 UPSTREAM: mm/damon/vaddr: remove an unnecessary warning message
999d83f120 UPSTREAM: mm/damon/core: remove unnecessary error messages
49de2cb8a5 UPSTREAM: mm/damon/dbgfs: remove an unnecessary error message
e5a2bdfb0a BACKPORT: mm/damon/core: use better timer mechanisms selection threshold
d49b62ccfd BACKPORT: mm/damon/dbgfs: fix missed use of damon_dbgfs_lock
4c2134830a UPSTREAM: mm/damon: remove return value from before_terminate callback
db9b97b547 UPSTREAM: mm/damon: fix a few spelling mistakes in comments and a pr_debug message
c91a782b6f UPSTREAM: mm/damon: simplify stop mechanism
fe6bcb8dd4 UPSTREAM: mm/damon/dbgfs: add adaptive_targets list check before enable monitor_on
ae3795eb00 UPSTREAM: mm/damon: remove unnecessary variable initialization
1a5e255ce9 UPSTREAM: mm/damon: introduce DAMON-based Reclamation (DAMON_RECLAIM)
97567267f7 UPSTREAM: selftests/damon: support watermarks
ffaa746d7c UPSTREAM: mm/damon/dbgfs: support watermarks
c70ef2a367 BACKPORT: mm/damon/schemes: activate schemes based on a watermarks mechanism
defd69e678 UPSTREAM: tools/selftests/damon: update for regions prioritization of schemes
875ca13d08 UPSTREAM: mm/damon/dbgfs: support prioritization weights
4cfed5d5b1 UPSTREAM: mm/damon/vaddr,paddr: support pageout prioritization
6662408061 UPSTREAM: mm/damon/schemes: prioritize regions within the quotas
ddd1df8526 UPSTREAM: mm/damon/selftests: support schemes quotas
5f680e394a UPSTREAM: mm/damon/dbgfs: support quotas of schemes
b4aefd1c72 UPSTREAM: mm/damon/schemes: implement time quota
f80ebb9d5d UPSTREAM: mm/damon/schemes: skip already charged targets and regions
80d2863f9e UPSTREAM: mm/damon/schemes: implement size quota for schemes application speed control
41d98d4c47 UPSTREAM: mm/damon/paddr: support the pageout scheme
8d5c271cff UPSTREAM: mm/damon/dbgfs: remove unnecessary variables
8168da37a5 UPSTREAM: mm/damon/vaddr: constify static mm_walk_ops
fc0bae05e1 UPSTREAM: mm/damon/dbgfs: support physical memory monitoring
ae84fa2e25 UPSTREAM: mm/damon: implement primitives for physical address space monitoring
80990f467b UPSTREAM: mm/damon/vaddr: separate commonly usable functions
12c21e91e4 UPSTREAM: mm/damon/dbgfs-test: add a unit test case for 'init_regions'
efc9721c40 UPSTREAM: mm/damon/dbgfs: allow users to set initial monitoring target regions
70ebdef092 UPSTREAM: selftests/damon: add 'schemes' debugfs tests
a48740173e UPSTREAM: mm/damon/schemes: implement statistics feature
fd5ed35b71 UPSTREAM: mm/damon/dbgfs: support DAMON-based Operation Schemes
573fab31a5 UPSTREAM: mm/damon/vaddr: support DAMON-based Operation Schemes
b35e82062a UPSTREAM: mm/damon/core: implement DAMON-based Operation Schemes (DAMOS)
41e99990b8 UPSTREAM: mm/damon/core: account age of target regions
aaa3878862 UPSTREAM: mm/damon/core: nullify pointer ctx->kdamond with a NULL
340c92bec2 UPSTREAM: mm/damon: needn't hold kdamond_lock to print pid of kdamond
2df0d2dbd1 UPSTREAM: mm/damon: remove unnecessary do_exit() from kdamond
ec9618400e UPSTREAM: mm/damon/core: print kdamond start log in debug mode only
4680f26136 UPSTREAM: include/linux/damon.h: fix kernel-doc comments for 'damon_callback'
f840a4de99 UPSTREAM: mm/damon: grammar s/works/work/
a41c70ee0b ANDROID: vendor_hooks: add vendor hook in blk_mq_rq_ctx_init()
1c6391dd7a ANDROID: vendor_hooks: add vendor hook in blk_mq_alloc_rqs()

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Iefbbab398942ad769576399accd3ffcd24e41e93

Documentation/devicetree/bindings/mmc/mtk-sd.yaml

@@ -119,6 +119,18 @@ properties:
       If present, HS400 command responses are sampled on rising edges.
       If not present, HS400 command responses are sampled on falling edges.
 
+  mediatek,hs400-ds-dly3:
+    $ref: /schemas/types.yaml#/definitions/uint32
+    description:
+      Gear of the third delay line for DS for input data latch in data
+      pad macro, there are 32 stages from 0 to 31.
+      For different corner IC, the time is different about one step, it is
+      about 100ps.
+      The value is confirmed by doing scan and calibration to find a best
+      value with corner IC and it is valid only for HS400 mode.
+    minimum: 0
+    maximum: 31
+
   mediatek,latch-ck:
     $ref: /schemas/types.yaml#/definitions/uint32
     description:

OWNERS

@@ -1,2 +1,12 @@
-# include OWNERS from the authoritative android-mainline branch
+set noparent
-include kernel/common:android-mainline:/OWNERS
+
+# GKI Dr. No Enforcement is active on this branch. Approval of one of the Dr.
+# No reviewers is required following a regular CodeReview+2 vote of a code
+# reviewer.
+#
+# See the GKI release documentation (go/gki-dr-no) for further details.
+#
+# The expanded list of reviewers can be found at:
+# https://android.googlesource.com/kernel/common/+/android-mainline/OWNERS_DrNo
+
+include kernel/common:android-mainline:/OWNERS_DrNo

android/abi_gki_aarch64_exynos

@@ -22,6 +22,9 @@
   __arch_copy_from_user
   __arch_copy_to_user
   arch_freq_scale
+  arch_timer_read_counter
+  argv_free
+  argv_split
   arm64_const_caps_ready
   arm64_use_ng_mappings
   __arm_smccc_hvc
@@ -38,16 +41,24 @@
   bio_endio
   bio_end_io_acct_remapped
   bio_start_io_acct
+  __bitmap_andnot
   __bitmap_clear
   __bitmap_complement
+  bitmap_free
+  __bitmap_or
   bitmap_parse
   bitmap_parselist
   bitmap_print_to_pagebuf
   __bitmap_set
+  __bitmap_shift_left
   bitmap_to_arr32
   __bitmap_weight
+  __bitmap_xor
+  bitmap_zalloc
   __blk_alloc_disk
   blk_cleanup_disk
+  blk_ksm_init
+  blk_ksm_reprogram_all_keys
   blk_queue_flag_clear
   blk_queue_flag_set
   blk_queue_io_min
@@ -71,6 +82,7 @@
   bpf_trace_run7
   bpf_trace_run8
   bpf_trace_run9
+  bsearch
   bus_find_device
   bus_for_each_dev
   bus_register
@@ -112,6 +124,7 @@
   clk_get_rate
   clk_hw_get_name
   clk_hw_get_parent
+  clk_hw_get_rate
   __clk_is_enabled
   clk_prepare
   clk_put
@@ -148,6 +161,7 @@
   console_trylock
   console_unlock
   __const_udelay
+  consume_skb
   contig_page_data
   __cpu_active_mask
   cpu_all_bits
@@ -159,6 +173,8 @@
   cpufreq_driver_fast_switch
   __cpufreq_driver_target
   cpufreq_enable_fast_switch
+  cpufreq_freq_transition_begin
+  cpufreq_freq_transition_end
   cpufreq_frequency_table_get_index
   cpufreq_generic_attr
   cpufreq_get_policy
@@ -196,12 +212,14 @@
   cpus_read_unlock
   cpu_subsys
   cpu_topology
+  crc32_le
   crypto_alloc_base
   crypto_alloc_shash
   crypto_comp_compress
   crypto_comp_decompress
   crypto_destroy_tfm
   crypto_has_alg
+  crypto_shash_digest
   crypto_shash_final
   crypto_shash_update
   _ctype
@@ -219,6 +237,7 @@
   debugfs_create_u32
   debugfs_create_x32
   debugfs_remove
+  debugfs_rename
   dec_zone_page_state
   default_llseek
   deferred_free
@@ -229,6 +248,9 @@
   desc_to_gpio
   destroy_workqueue
   _dev_alert
+  dev_alloc_name
+  __dev_change_net_namespace
+  dev_close
   _dev_crit
   dev_driver_string
   _dev_emerg
@@ -249,16 +271,21 @@
   devfreq_suspend_device
   devfreq_unregister_opp_notifier
   devfreq_update_interval
+  __dev_get_by_index
+  dev_get_by_index
   dev_get_by_name
   dev_get_regmap
+  device_add
   device_add_disk
   device_create
   device_create_bin_file
   device_create_file
   device_create_managed_software_node
+  device_del
   device_destroy
   device_for_each_child
   device_get_child_node_count
+  device_get_dma_attr
   device_get_next_child_node
   device_initialize
   device_init_wakeup
@@ -268,11 +295,14 @@
   device_property_read_u32_array
   device_register
   device_remove_file
+  device_rename
+  device_set_wakeup_enable
   device_show_bool
   device_show_int
   device_store_bool
   device_store_int
   device_unregister
+  device_wakeup_enable
   _dev_info
   __dev_kfree_skb_any
   devm_add_action
@@ -280,11 +310,14 @@
   devm_backlight_device_unregister
   devm_clk_bulk_get_all
   devm_clk_get
+  devm_clk_get_optional
   devm_clk_put
   devm_devfreq_register_notifier
   devm_devfreq_unregister_notifier
   __devm_drm_dev_alloc
   devm_drm_panel_bridge_add_typed
+  devm_extcon_dev_allocate
+  devm_extcon_dev_register
   devm_free_irq
   devm_gen_pool_create
   devm_gpiochip_add_data_with_key
@@ -312,14 +345,18 @@
   __devm_of_phy_provider_register
   devm_phy_create
   devm_phy_get
+  devm_phy_put
   devm_pinctrl_get
+  devm_pinctrl_put
   devm_pinctrl_register
   devm_platform_ioremap_resource
   __devm_regmap_init_i2c
   __devm_regmap_init_mmio_clk
   devm_regulator_bulk_get
   devm_regulator_get
+  devm_regulator_get_optional
   devm_regulator_register
+  __devm_release_region
   __devm_request_region
   devm_request_threaded_irq
   __devm_reset_control_get
@@ -328,6 +365,7 @@
   devm_snd_soc_register_card
   devm_snd_soc_register_component
   devm_thermal_zone_of_sensor_register
+  devm_usb_get_phy_by_phandle
   _dev_notice
   dev_pm_opp_add
   dev_pm_opp_disable
@@ -344,11 +382,13 @@
   dev_pm_qos_read_value
   dev_pm_qos_remove_request
   dev_pm_qos_update_request
+  dev_queue_xmit
   devres_add
   __devres_alloc_node
   devres_free
   devres_release
   dev_set_name
+  dev_vprintk_emit
   _dev_warn
   disable_irq
   disable_irq_nosync
@@ -415,6 +455,7 @@
   dma_map_page_attrs
   dma_map_resource
   dma_map_sgtable
+  dmam_free_coherent
   dma_mmap_attrs
   dma_release_channel
   dma_request_chan
@@ -436,15 +477,18 @@
   __do_once_done
   __do_once_start
   do_SAK
+  do_trace_netlink_extack
   double_rq_lock
   do_wait_intr
   down
+  down_interruptible
   down_read
   down_read_killable
   down_read_trylock
   down_write
   down_write_trylock
   d_path
+  drain_workqueue
   driver_register
   driver_unregister
   drm_add_edid_modes
@@ -713,6 +757,8 @@
   dw_pcie_setup_rc
   dw_pcie_write
   enable_irq
+  ether_setup
+  eth_type_trans
   event_triggers_call
   extcon_get_state
   extcon_set_state_sync
@@ -747,6 +793,10 @@
   generic_file_llseek
   generic_handle_domain_irq
   generic_handle_irq
+  genlmsg_multicast_allns
+  genlmsg_put
+  genl_register_family
+  genl_unregister_family
   gen_pool_add_owner
   gen_pool_alloc_algo_owner
   gen_pool_avail
@@ -760,7 +810,10 @@
   get_cpu_idle_time
   get_device
   __get_free_pages
+  get_net_ns_by_fd
+  get_net_ns_by_pid
   get_options
+  get_random_bytes
   get_random_u32
   __get_task_comm
   get_task_mm
@@ -819,6 +872,7 @@
   i2c_del_driver
   i2c_for_each_dev
   i2c_get_adapter
+  i2c_new_client_device
   i2c_new_dummy_device
   i2c_put_adapter
   i2c_register_driver
@@ -833,6 +887,7 @@
   i2c_transfer_buffer_flags
   i2c_unregister_device
   i2c_verify_client
+  i3c_device_do_priv_xfers
   i3c_generic_ibi_alloc_pool
   i3c_generic_ibi_free_pool
   i3c_generic_ibi_get_free_slot
@@ -849,6 +904,7 @@
   i3c_master_set_info
   i3c_master_unregister
   ida_alloc_range
+  ida_destroy
   ida_free
   idr_alloc
   idr_destroy
@@ -863,6 +919,7 @@
   __iio_device_register
   iio_device_unregister
   inc_zone_page_state
+  inet_csk_get_port
   init_dummy_netdev
   init_net
   init_pseudo
@@ -870,6 +927,7 @@
   __init_swait_queue_head
   init_task
   init_timer_key
+  init_uts_ns
   init_wait_entry
   __init_waitqueue_head
   input_allocate_device
@@ -916,6 +974,7 @@
   iommu_unregister_device_fault_handler
   __ioremap
   iounmap
+  ip_send_check
   iput
   __irq_alloc_descs
   irq_create_mapping_affinity
@@ -926,6 +985,7 @@
   irq_domain_xlate_onetwocell
   irq_domain_xlate_twocell
   irq_force_affinity
+  irq_get_irqchip_state
   irq_get_irq_data
   irq_modify_status
   irq_of_parse_and_map
@@ -955,10 +1015,19 @@
   kernel_kobj
   kern_mount
   kern_unmount
+  key_create_or_update
+  key_put
+  keyring_alloc
+  __kfifo_alloc
+  __kfifo_free
   __kfifo_in
   __kfifo_out
+  __kfifo_to_user
   kfree
   kfree_const
+  kfree_sensitive
+  kfree_skb
+  kfree_skb_list
   kill_anon_super
   kimage_voffset
   __kmalloc
@@ -982,7 +1051,9 @@
   krealloc
   kstat
   kstrdup
+  kstrdup_const
   kstrndup
+  kstrtobool
   kstrtobool_from_user
   kstrtoint
   kstrtoint_from_user
@@ -998,6 +1069,9 @@
   kthread_bind_mask
   kthread_cancel_work_sync
   kthread_create_on_node
+  kthread_create_worker
+  kthread_delayed_work_timer_fn
+  kthread_destroy_worker
   kthread_flush_work
   __kthread_init_worker
   kthread_park
@@ -1009,6 +1083,7 @@
   kthread_unpark
   kthread_worker_fn
   ktime_get
+  ktime_get_coarse_with_offset
   ktime_get_mono_fast_ns
   ktime_get_raw_ts64
   ktime_get_real_seconds
@@ -1019,11 +1094,16 @@
   kvfree
   kvfree_call_rcu
   kvmalloc_node
+  linkwatch_fire_event
   __list_add_valid
   __list_del_entry_valid
+  list_sort
+  llist_add_batch
+  __local_bh_enable_ip
   __lock_page
   loops_per_jiffy
   memchr
+  memcmp
   memcpy
   __memcpy_fromio
   __memcpy_toio
@@ -1069,24 +1149,49 @@
   mutex_lock_interruptible
   mutex_trylock
   mutex_unlock
+  names_cachep
+  __napi_alloc_skb
+  napi_build_skb
   napi_complete_done
+  napi_disable
   napi_enable
   napi_gro_receive
   __napi_schedule
   napi_schedule_prep
   __netdev_alloc_skb
+  netdev_err
+  netif_carrier_off
+  netif_carrier_on
   netif_napi_add
+  __netif_napi_del
   netif_receive_skb
+  netif_rx_ni
+  netif_tx_stop_all_queues
   netif_tx_wake_queue
+  netlink_broadcast
+  netlink_register_notifier
+  netlink_unicast
+  netlink_unregister_notifier
+  net_ns_type_operations
+  nla_find
+  nla_memcpy
+  __nla_parse
+  nla_put
+  nla_put_64bit
+  nla_put_nohdr
+  nla_reserve
+  __nla_validate
   no_llseek
   nonseekable_open
   noop_llseek
   nr_cpu_ids
   nr_irqs
   nsecs_to_jiffies
+  ns_to_kernel_old_timeval
   ns_to_timespec64
   __num_online_cpus
   of_address_to_resource
+  of_alias_get_highest_id
   of_alias_get_id
   of_clk_add_provider
   of_clk_get_by_name
@@ -1104,10 +1209,12 @@
   of_find_device_by_node
   of_find_matching_node_and_match
   of_find_node_by_name
+  of_find_node_by_phandle
   of_find_node_by_type
   of_find_node_opts_by_path
   of_find_node_with_property
   of_find_property
+  of_fwnode_ops
   of_genpd_add_provider_simple
   of_get_child_by_name
   of_get_cpu_node
@@ -1135,6 +1242,8 @@
   of_property_read_string
   of_property_read_string_helper
   of_property_read_u32_index
+  of_property_read_u64
+  of_property_read_variable_u16_array
   of_property_read_variable_u32_array
   of_property_read_variable_u8_array
   of_prop_next_string
@@ -1145,6 +1254,7 @@
   of_reserved_mem_lookup
   of_root
   of_thermal_get_ntrips
+  of_usb_host_tpl_support
   oops_in_progress
   page_endio
   page_mapping
@@ -1159,28 +1269,39 @@
   param_ops_long
   param_ops_string
   param_ops_uint
+  param_ops_ullong
   param_ops_ulong
+  param_set_uint
+  param_set_ulong
   pci_alloc_irq_vectors_affinity
   pci_assign_resource
   pci_assign_unassigned_bus_resources
   pci_bus_resource_n
+  pci_bus_type
   pci_clear_master
   pci_disable_device
   pci_enable_atomic_ops_to_root
   pci_enable_device
   pci_enable_pcie_error_reporting
+  pci_enable_wake
   pci_find_bus
   pci_find_ext_capability
   pci_free_irq_vectors
   pci_generic_config_read
   pci_generic_config_write
   pci_get_device
+  pci_irq_vector
   pci_load_saved_state
   pci_map_rom
+  pcim_enable_device
+  pcim_iomap_regions
+  pcim_iomap_table
   pci_msix_vec_count
   pci_read_config_dword
   pci_read_config_word
   pci_rebar_get_possible_sizes
+  __pci_register_driver
+  pci_release_regions
   pci_release_resource
   pci_rescan_bus
   pci_reset_function
@@ -1188,10 +1309,12 @@
   pci_restore_state
   pci_save_state
   pci_set_master
+  pci_set_power_state
   pci_store_saved_state
   pci_unmap_rom
   pci_unregister_driver
   pci_wait_for_pending_transaction
+  pci_wake_from_d3
   pci_write_config_dword
   pci_write_config_word
   PDE_DATA
@@ -1201,9 +1324,12 @@
   perf_pmu_unregister
   perf_trace_buf_alloc
   perf_trace_run_bpf_submit
+  pfn_is_map_memory
+  phy_configure
   phy_init
   phy_power_off
   phy_power_on
+  phy_reset
   pid_task
   pinconf_generic_dt_node_to_map
   pinctrl_add_gpio_range
@@ -1211,6 +1337,8 @@
   pinctrl_force_sleep
   pinctrl_get
   pinctrl_lookup_state
+  pinctrl_pm_select_default_state
+  pinctrl_pm_select_sleep_state
   pinctrl_put
   pinctrl_remove_gpio_range
   pinctrl_select_state
@@ -1281,8 +1409,11 @@
   proc_mkdir
   proc_remove
   proc_set_size
+  proc_set_user
   proc_symlink
+  __pskb_pull_tail
   put_device
+  __put_net
   __put_page
   __put_task_struct
   put_unused_fd
@@ -1297,24 +1428,32 @@
   raw_notifier_chain_register
   raw_notifier_chain_unregister
   _raw_read_lock
+  _raw_read_lock_bh
   _raw_read_lock_irqsave
   _raw_read_unlock
+  _raw_read_unlock_bh
   _raw_read_unlock_irqrestore
   _raw_spin_lock
+  _raw_spin_lock_bh
   _raw_spin_lock_irq
   _raw_spin_lock_irqsave
   raw_spin_rq_lock_nested
   raw_spin_rq_unlock
   _raw_spin_trylock
   _raw_spin_unlock
+  _raw_spin_unlock_bh
   _raw_spin_unlock_irq
   _raw_spin_unlock_irqrestore
   _raw_write_lock
+  _raw_write_lock_bh
   _raw_write_lock_irqsave
   _raw_write_trylock
   _raw_write_unlock
+  _raw_write_unlock_bh
   _raw_write_unlock_irqrestore
+  rb_erase
   __rb_erase_color
+  rb_first
   rb_first_postorder
   __rb_insert_augmented
   rb_insert_color
@@ -1337,7 +1476,12 @@
   register_chrdev_region
   register_console
   register_die_notifier
+  register_inet6addr_notifier
+  register_inetaddr_notifier
   register_netdev
+  register_netdevice
+  register_netdevice_notifier
+  register_pernet_device
   register_pm_notifier
   register_reboot_notifier
   register_restart_handler
@@ -1359,11 +1503,15 @@
   regulator_bulk_enable
   regulator_disable
   regulator_enable
+  regulator_force_disable
   regulator_get
+  regulator_get_optional
+  regulator_get_voltage
   regulator_is_enabled
   regulator_list_voltage_linear
   regulator_map_voltage_linear
   regulator_put
+  regulator_set_mode
   regulator_set_voltage
   release_firmware
   release_pages
@@ -1381,6 +1529,13 @@
   reset_control_assert
   reset_control_deassert
   return_address
+  rfkill_alloc
+  rfkill_blocked
+  rfkill_destroy
+  rfkill_register
+  rfkill_resume_polling
+  rfkill_set_hw_state_reason
+  rfkill_unregister
   rps_needed
   rtc_class_close
   rtc_class_open
@@ -1390,6 +1545,9 @@
   rtc_tm_to_time64
   rtc_update_irq
   rtc_valid_tm
+  rtnl_is_locked
+  rtnl_lock
+  rtnl_unlock
   runqueues
   sched_clock
   sched_feat_keys
@@ -1401,8 +1559,12 @@
   schedule_timeout
   schedule_timeout_interruptible
   scnprintf
+  scsi_block_when_processing_errors
   scsi_dma_unmap
   scsi_eh_ready_devs
+  __scsi_execute
+  scsi_print_sense_hdr
+  sdev_prefix_printk
   seq_lseek
   seq_printf
   seq_puts
@@ -1438,7 +1600,10 @@
   single_open
   single_open_size
   single_release
+  skb_add_rx_frag
   skb_clone
+  skb_copy
+  skb_copy_bits
   skb_copy_expand
   skb_dequeue
   skb_dequeue_tail
@@ -1448,10 +1613,13 @@
   skb_queue_head
   skb_queue_purge
   skb_queue_tail
+  skb_realloc_headroom
   skb_trim
   smp_call_function
+  smp_call_function_any
   smp_call_function_many
   smp_call_function_single
+  smp_call_function_single_async
   smp_call_on_cpu
   snd_compr_stop_error
   snd_ctl_add
@@ -1543,6 +1711,8 @@
   snd_soc_unregister_component
   snprintf
   soc_device_register
+  __sock_create
+  sock_release
   softnet_data
   sort
   __spi_alloc_controller
@@ -1588,14 +1758,18 @@
   strnstr
   strpbrk
   strrchr
+  strreplace
   strscpy
   strsep
   strstr
   subsys_system_register
+  __sw_hweight16
   __sw_hweight32
   __sw_hweight64
+  __sw_hweight8
   sync_file_create
   sync_file_get_fence
+  synchronize_net
   synchronize_rcu
   syscon_regmap_lookup_by_phandle
   sysfs_add_file_to_group
@@ -1620,6 +1794,7 @@
   system_freezable_wq
   system_freezing_cnt
   system_highpri_wq
+  system_power_efficient_wq
   system_state
   system_unbound_wq
   system_wq
@@ -1628,6 +1803,7 @@
   tasklet_init
   tasklet_kill
   __tasklet_schedule
+  tasklet_setup
   __task_pid_nr_ns
   task_rq_lock
   tcp_register_congestion_control
@@ -1686,8 +1862,12 @@
   __traceiter_android_vh_scheduler_tick
   __traceiter_android_vh_ufs_check_int_errors
   __traceiter_android_vh_ufs_compl_command
+  __traceiter_clock_set_rate
   __traceiter_device_pm_callback_end
   __traceiter_device_pm_callback_start
+  __traceiter_dwc3_ep_queue
+  __traceiter_dwc3_readl
+  __traceiter_dwc3_writel
   __traceiter_gpu_mem_total
   __traceiter_hrtimer_expire_entry
   __traceiter_hrtimer_expire_exit
@@ -1737,8 +1917,12 @@
   __tracepoint_android_vh_scheduler_tick
   __tracepoint_android_vh_ufs_check_int_errors
   __tracepoint_android_vh_ufs_compl_command
+  __tracepoint_clock_set_rate
   __tracepoint_device_pm_callback_end
   __tracepoint_device_pm_callback_start
+  __tracepoint_dwc3_ep_queue
+  __tracepoint_dwc3_readl
+  __tracepoint_dwc3_writel
   __tracepoint_gpu_mem_total
   __tracepoint_hrtimer_expire_entry
   __tracepoint_hrtimer_expire_exit
@@ -1837,12 +2021,16 @@
   __udelay
   ufshcd_auto_hibern8_update
   ufshcd_dme_set_attr
+  ufshcd_hba_stop
   ufshcd_hold
+  ufshcd_make_hba_operational
   ufshcd_pltfrm_init
   ufshcd_query_flag_retry
   ufshcd_release
   ufshcd_remove
+  ufshcd_resume_complete
   ufshcd_shutdown
+  ufshcd_suspend_prepare
   ufshcd_system_resume
   ufshcd_system_suspend
   unlock_page
@@ -1851,17 +2039,26 @@
   unregister_blkdev
   __unregister_chrdev
   unregister_chrdev_region
+  unregister_inet6addr_notifier
+  unregister_inetaddr_notifier
   unregister_netdev
+  unregister_netdevice_notifier
+  unregister_netdevice_queue
+  unregister_pernet_device
   unregister_pm_notifier
   unregister_reboot_notifier
   unregister_shrinker
   up
   update_devfreq
+  update_rq_clock
   up_read
   up_write
   usb_add_function
+  usb_add_hcd
   usb_choose_configuration
   usb_copy_descriptors
+  __usb_create_hcd
+  usb_disabled
   usb_enable_autosuspend
   usb_ep_alloc_request
   usb_ep_autoconfig
@@ -1870,11 +2067,14 @@
   usb_function_register
   usb_function_unregister
   usb_gadget_set_state
+  usb_hcd_is_primary_hcd
   usb_hub_find_child
   usb_interface_id
   usb_otg_state_string
   usb_put_function_instance
+  usb_put_hcd
   usb_register_notify
+  usb_remove_hcd
   usb_speed_string
   usb_string_id
   usb_unregister_notify
@@ -1888,11 +2088,15 @@
   v4l2_ctrl_new_std
   v4l2_ctrl_new_std_menu
   v4l2_device_register
+  v4l2_device_register_subdev
+  v4l2_device_set_name
   v4l2_device_unregister
+  v4l2_device_unregister_subdev
   v4l2_fh_add
   v4l2_fh_del
   v4l2_fh_exit
   v4l2_fh_init
+  v4l2_i2c_subdev_init
   v4l2_m2m_buf_queue
   v4l2_m2m_buf_remove
   v4l2_m2m_ctx_init
@@ -1913,22 +2117,27 @@
   v4l2_m2m_next_buf
   v4l2_m2m_poll
   v4l2_m2m_qbuf
+  v4l2_m2m_querybuf
   v4l2_m2m_release
   v4l2_m2m_reqbufs
   v4l2_m2m_streamoff
   v4l2_m2m_streamon
   v4l2_m2m_try_schedule
   v4l2_match_dv_timings
+  v4l2_subdev_call_wrappers
+  v4l2_subdev_init
   v4l_bound_align_image
   vabits_actual
   vb2_buffer_done
   vb2_dma_sg_memops
   vb2_dqbuf
+  vb2_mmap
   vb2_ops_wait_finish
   vb2_ops_wait_prepare
   vb2_plane_cookie
   vb2_plane_vaddr
   vb2_poll
+  vb2_prepare_buf
   vb2_qbuf
   vb2_querybuf
   vb2_queue_init
@@ -1937,6 +2146,7 @@
   vb2_streamoff
   vb2_streamon
   vb2_wait_for_all_buffers
+  verify_pkcs7_signature
   vfree
   video_devdata
   video_device_alloc
@@ -1946,9 +2156,11 @@
   video_unregister_device
   vmalloc
   vmalloc_to_page
+  vmalloc_to_pfn
   vmap
   vm_get_page_prot
   vm_iomap_memory
+  vprintk_emit
   vscnprintf
   vsnprintf
   vsprintf
@@ -1963,7 +2175,9 @@
   __wake_up_locked
   __wake_up_locked_key
   wake_up_process
+  wakeup_source_add
   wakeup_source_register
+  wakeup_source_remove
   wakeup_source_unregister
   __wake_up_sync
   __warn_printk
@@ -1971,6 +2185,7 @@
   watchdog_register_device
   watchdog_set_restart_priority
   watchdog_unregister_device
+  wireless_nlevent_flush
   work_busy
   ww_mutex_lock
   ww_mutex_lock_interruptible
@@ -1979,3 +2194,8 @@
   __xa_erase
   xa_load
   __xa_store
+  xhci_gen_setup
+  xhci_init_driver
+  xhci_resume
+  xhci_run
+  xhci_suspend

android/abi_gki_aarch64_honor

@@ -0,0 +1,19 @@
+[abi_symbol_list]
+  __traceiter_android_vh_rwsem_init
+  __traceiter_android_vh_rwsem_wake
+  __traceiter_android_vh_rwsem_write_finished
+  __traceiter_android_vh_alter_rwsem_list_add
+  __traceiter_android_vh_mutex_init
+  __traceiter_android_vh_alter_mutex_list_add
+  __traceiter_android_vh_mutex_unlock_slowpath
+  __traceiter_android_vh_mutex_wait_start
+  __traceiter_android_vh_mutex_wait_finish
+  __tracepoint_android_vh_rwsem_init
+  __tracepoint_android_vh_rwsem_wake
+  __tracepoint_android_vh_rwsem_write_finished
+  __tracepoint_android_vh_alter_rwsem_list_add
+  __tracepoint_android_vh_mutex_init
+  __tracepoint_android_vh_alter_mutex_list_add
+  __tracepoint_android_vh_mutex_unlock_slowpath
+  __tracepoint_android_vh_mutex_wait_start
+  __tracepoint_android_vh_mutex_wait_finish

android/abi_gki_aarch64_mtk

@@ -220,6 +220,7 @@
   cpu_latency_qos_remove_request
   cpu_latency_qos_update_request
   cpumask_any_but
+  cpumask_any_distribute
   cpumask_next
   cpumask_next_and
   cpu_number
@@ -543,6 +544,7 @@
   down_timeout
   down_trylock
   down_write
+  down_write_killable
   d_path
   dput
   drain_workqueue
@@ -970,6 +972,7 @@
   irq_work_sync
   is_dma_buf_file
   is_vmalloc_addr
+  iterate_dir
   iterate_fd
   jiffies_64_to_clock_t
   jiffies
@@ -1685,6 +1688,7 @@
   sdio_writeb
   sdio_writel
   sdio_writesb
+  security_file_ioctl
   send_sig
   seq_hex_dump
   seq_lseek
@@ -1898,6 +1902,7 @@
   system_wq
   sys_tz
   task_active_pid_ns
+  task_sched_runtime
   __tasklet_hi_schedule
   tasklet_init
   tasklet_kill
@@ -1929,19 +1934,26 @@
   trace_event_reg
   trace_handle_return
   __traceiter_android_rvh_after_enqueue_task
+  __traceiter_android_rvh_can_migrate_task
   __traceiter_android_rvh_commit_creds
   __traceiter_android_rvh_cpu_overutilized
   __traceiter_android_rvh_dequeue_task
   __traceiter_android_rvh_enqueue_task
   __traceiter_android_rvh_exit_creds
   __traceiter_android_rvh_find_busiest_group
+  __traceiter_android_rvh_find_busiest_queue
   __traceiter_android_rvh_find_energy_efficient_cpu
+  __traceiter_android_rvh_find_lowest_rq
+  __traceiter_android_rvh_find_new_ilb
   __traceiter_android_rvh_finish_prio_fork
+  __traceiter_android_rvh_get_nohz_timer_target
+  __traceiter_android_rvh_is_cpu_allowed
   __traceiter_android_rvh_new_task_stats
   __traceiter_android_rvh_override_creds
   __traceiter_android_rvh_prepare_prio_fork
   __traceiter_android_rvh_revert_creds
   __traceiter_android_rvh_rtmutex_prepare_setprio
+  __traceiter_android_rvh_rto_next_cpu
   __traceiter_android_rvh_sched_newidle_balance
   __traceiter_android_rvh_select_task_rq_fair
   __traceiter_android_rvh_select_task_rq_rt
@@ -1951,6 +1963,7 @@
   __traceiter_android_rvh_selinux_avc_node_replace
   __traceiter_android_rvh_selinux_is_initialized
   __traceiter_android_rvh_setscheduler
+  __traceiter_android_rvh_set_cpus_allowed_ptr_locked
   __traceiter_android_rvh_set_user_nice
   __traceiter_android_rvh_tick_entry
   __traceiter_android_rvh_update_cpu_capacity
@@ -1992,19 +2005,26 @@
   __traceiter_xhci_urb_giveback
   trace_output_call
   __tracepoint_android_rvh_after_enqueue_task
+  __tracepoint_android_rvh_can_migrate_task
   __tracepoint_android_rvh_commit_creds
   __tracepoint_android_rvh_cpu_overutilized
   __tracepoint_android_rvh_dequeue_task
   __tracepoint_android_rvh_enqueue_task
   __tracepoint_android_rvh_exit_creds
   __tracepoint_android_rvh_find_busiest_group
+  __tracepoint_android_rvh_find_busiest_queue
   __tracepoint_android_rvh_find_energy_efficient_cpu
+  __tracepoint_android_rvh_find_lowest_rq
+  __tracepoint_android_rvh_find_new_ilb
   __tracepoint_android_rvh_finish_prio_fork
+  __tracepoint_android_rvh_get_nohz_timer_target
+  __tracepoint_android_rvh_is_cpu_allowed
   __tracepoint_android_rvh_new_task_stats
   __tracepoint_android_rvh_override_creds
   __tracepoint_android_rvh_prepare_prio_fork
   __tracepoint_android_rvh_revert_creds
   __tracepoint_android_rvh_rtmutex_prepare_setprio
+  __tracepoint_android_rvh_rto_next_cpu
   __tracepoint_android_rvh_sched_newidle_balance
   __tracepoint_android_rvh_select_task_rq_fair
   __tracepoint_android_rvh_select_task_rq_rt
@@ -2014,6 +2034,7 @@
   __tracepoint_android_rvh_selinux_avc_node_replace
   __tracepoint_android_rvh_selinux_is_initialized
   __tracepoint_android_rvh_setscheduler
+  __tracepoint_android_rvh_set_cpus_allowed_ptr_locked
   __tracepoint_android_rvh_set_user_nice
   __tracepoint_android_rvh_tick_entry
   __tracepoint_android_rvh_update_cpu_capacity

android/abi_gki_aarch64_mtktv

@@ -203,6 +203,8 @@
   d_add
   d_add_ci
   dbs_update
+  debugfs_attr_read
+  debugfs_attr_write
   debugfs_create_bool
   debugfs_create_devm_seqfile
   debugfs_create_dir
@@ -792,6 +794,7 @@
   kstrtou16
   kstrtou8
   kstrtouint
+  kstrtouint_from_user
   kstrtoull
   kthread_bind
   kthread_create_on_node
@@ -935,6 +938,7 @@
   of_device_is_available
   of_device_is_compatible
   of_dma_configure_id
+  of_dma_is_coherent
   of_drm_find_panel
   of_find_compatible_node
   of_find_device_by_node
@@ -945,6 +949,7 @@
   of_find_node_with_property
   of_find_property
   of_fwnode_ops
+  of_get_child_by_name
   of_get_mac_address
   of_get_named_gpio_flags
   of_get_next_available_child
@@ -1060,7 +1065,9 @@
   pinmux_generic_get_function_groups
   pinmux_generic_get_function_name
   pinmux_generic_remove_function
+  pin_user_pages
   pin_user_pages_fast
+  pin_user_pages_remote
   platform_bus_type
   platform_device_add
   platform_device_alloc
@@ -1502,6 +1509,7 @@
   unlock_new_inode
   unlock_page
   unmap_mapping_range
+  unpin_user_page
   unpin_user_pages
   unregister_blkdev
   __unregister_chrdev

android/abi_gki_aarch64_oplus

@@ -0,0 +1,204 @@
+[abi_symbol_list]
+  address_space_init_once
+  alloc_anon_inode
+  __alloc_pages
+  __alloc_percpu
+  arm64_const_caps_ready
+  autoremove_wake_function
+  bcmp
+  bio_add_page
+  bio_alloc_bioset
+  bio_associate_blkg
+  __bio_crypt_clone
+  bio_crypt_set_ctx
+  bio_endio
+  bio_end_io_acct_remapped
+  bio_put
+  bio_start_io_acct
+  __blk_alloc_disk
+  blk_cleanup_disk
+  blk_cleanup_queue
+  blkdev_get_by_path
+  __blkdev_issue_discard
+  blkdev_issue_flush
+  blkdev_put
+  blk_finish_plug
+  blk_queue_flag_clear
+  blk_queue_flag_set
+  blk_queue_io_min
+  blk_queue_io_opt
+  blk_queue_logical_block_size
+  blk_queue_max_discard_sectors
+  blk_queue_max_hw_sectors
+  blk_queue_max_write_zeroes_sectors
+  blk_queue_physical_block_size
+  blk_queue_write_cache
+  blk_start_plug
+  __class_register
+  class_unregister
+  __ClearPageMovable
+  congestion_wait
+  contig_page_data
+  __cpuhp_remove_state
+  __cpuhp_setup_state
+  __cpuhp_state_add_instance
+  __cpuhp_state_remove_instance
+  cpu_hwcap_keys
+  cpumask_next
+  __cpu_online_mask
+  __cpu_possible_mask
+  crypto_alloc_base
+  crypto_comp_compress
+  crypto_comp_decompress
+  crypto_destroy_tfm
+  crypto_has_alg
+  dec_zone_page_state
+  delayed_work_timer_fn
+  del_gendisk
+  del_timer_sync
+  device_add_disk
+  disk_end_io_acct
+  disk_start_io_acct
+  downgrade_write
+  down_read
+  down_write
+  finish_wait
+  flush_dcache_page
+  flush_work
+  __free_pages
+  free_pages
+  free_percpu
+  fs_bio_set
+  fsync_bdev
+  __get_free_pages
+  idr_alloc
+  idr_destroy
+  idr_find
+  idr_for_each
+  idr_remove
+  inc_zone_page_state
+  init_pseudo
+  __init_rwsem
+  init_timer_key
+  init_wait_entry
+  __init_waitqueue_head
+  io_schedule
+  iput
+  jiffies
+  kasan_flag_enabled
+  kern_mount
+  kern_unmount
+  kfree
+  kill_anon_super
+  kmalloc_caches
+  kmem_cache_alloc
+  kmem_cache_alloc_trace
+  kmem_cache_create
+  kmem_cache_destroy
+  kmem_cache_free
+  kobject_create_and_add
+  kobject_put
+  kstrdup
+  kstrtoint
+  kstrtou16
+  kstrtoull
+  kthread_create_on_node
+  kthread_should_stop
+  kthread_stop
+  __list_add_valid
+  __list_del_entry_valid
+  __lock_page
+  memcpy
+  memparse
+  memset64
+  memset
+  memstart_addr
+  migrate_page_copy
+  mod_timer
+  module_layout
+  msleep
+  __mutex_init
+  mutex_is_locked
+  mutex_lock
+  mutex_trylock
+  mutex_unlock
+  nr_cpu_ids
+  __num_online_cpus
+  page_endio
+  __page_file_index
+  page_mapping
+  param_ops_uint
+  __per_cpu_offset
+  preempt_schedule
+  preempt_schedule_notrace
+  prepare_to_wait
+  prepare_to_wait_event
+  prepare_to_wait_exclusive
+  _printk
+  put_disk
+  __put_page
+  __put_task_struct
+  queue_delayed_work_on
+  queue_work_on
+  radix_tree_delete
+  radix_tree_delete_item
+  radix_tree_insert
+  radix_tree_lookup
+  radix_tree_lookup_slot
+  radix_tree_next_chunk
+  radix_tree_preload
+  radix_tree_replace_slot
+  _raw_read_lock
+  _raw_read_unlock
+  _raw_spin_lock
+  _raw_spin_lock_irqsave
+  _raw_spin_unlock
+  _raw_spin_unlock_irqrestore
+  _raw_write_lock
+  _raw_write_unlock
+  __rcu_read_lock
+  __rcu_read_unlock
+  __register_blkdev
+  register_reboot_notifier
+  register_shrinker
+  schedule
+  schedule_timeout
+  scnprintf
+  shrink_slab
+  set_capacity
+  set_capacity_and_notify
+  __SetPageMovable
+  snprintf
+  sprintf
+  __stack_chk_fail
+  strcmp
+  strcpy
+  strlcpy
+  strlen
+  strncpy
+  submit_bio
+  sysfs_create_files
+  __sysfs_match_string
+  sysfs_remove_files
+  sysfs_streq
+  system_freezable_wq
+  system_wq
+  __ubsan_handle_cfi_check_fail_abort
+  unlock_page
+  unregister_blkdev
+  unregister_reboot_notifier
+  unregister_shrinker
+  up_read
+  up_write
+  vfree
+  vzalloc
+  __wake_up
+  wake_up_process
+  __traceiter_android_vh_page_referenced_check_bypass
+  __traceiter_android_vh_drain_all_pages_bypass
+  __traceiter_android_vh_cma_drain_all_pages_bypass
+  __traceiter_android_vh_pcplist_add_cma_pages_bypass
+  __tracepoint_android_vh_page_referenced_check_bypass
+  __tracepoint_android_vh_drain_all_pages_bypass
+  __tracepoint_android_vh_cma_drain_all_pages_bypass
+  __tracepoint_android_vh_pcplist_add_cma_pages_bypass

android/abi_gki_aarch64_qcom

@@ -365,6 +365,7 @@
   devm_nvmem_device_get
   devm_nvmem_register
   devm_of_clk_add_hw_provider
+  devm_of_clk_del_provider
   devm_of_icc_get
   __devm_of_phy_provider_register
   devm_of_platform_populate
@@ -625,6 +626,7 @@
   flow_rule_match_ports
   flow_rule_match_vlan
   flush_dcache_page
+  flush_delayed_fput
   flush_delayed_work
   flush_work
   flush_workqueue
@@ -995,6 +997,7 @@
   kobject_add
   kobject_create_and_add
   kobject_del
+  kobject_get
   kobject_get_path
   kobject_init
   kobject_init_and_add
@@ -1428,6 +1431,8 @@
   __pm_runtime_use_autosuspend
   __pm_stay_awake
   pm_stay_awake
+  pm_suspend_global_flags
+  pm_suspend_target_state
   pm_system_wakeup
   pm_wakeup_dev_event
   pm_wakeup_ws_event
@@ -1622,8 +1627,12 @@
   reset_control_assert
   reset_control_deassert
   __reset_control_get
+  reset_control_put
   root_task_group
   round_jiffies_relative
+  rpmsg_chrdev_eptdev_create
+  rpmsg_chrdev_eptdev_destroy
+  rpmsg_class
   rpmsg_get_signals
   rpmsg_poll
   rpmsg_register_device
@@ -1641,10 +1650,13 @@
   rproc_coredump_cleanup
   rproc_coredump_set_elf_info
   rproc_coredump_using_sections
+  rproc_da_to_va
   rproc_del
+  rproc_del_carveout
   rproc_free
   rproc_get_by_child
   rproc_get_by_phandle
+  rproc_mem_entry_free
   rproc_put
   rproc_remove_subdev
   rproc_report_crash
@@ -1882,6 +1894,8 @@
   synchronize_rcu_tasks_trace
   synchronize_srcu
   synchronize_srcu_expedited
+  synth_event_create
+  synth_event_delete
   syscon_node_to_regmap
   syscon_regmap_lookup_by_phandle
   sysctl_sched_features
@@ -1949,7 +1963,11 @@
   trace_event_printf
   trace_event_raw_init
   trace_event_reg
+  trace_get_event_file
   trace_handle_return
+  __traceiter_android_vh_ufs_clock_scaling
+  __traceiter_map
+  __traceiter_unmap
   __tracepoint_android_rvh_account_irq_end
   __tracepoint_android_rvh_account_irq_start
   __tracepoint_android_rvh_after_dequeue_task
@@ -1965,10 +1983,13 @@
   __tracepoint_android_rvh_find_lowest_rq
   __tracepoint_android_rvh_flush_task
   __tracepoint_android_rvh_get_nohz_timer_target
+  __tracepoint_android_rvh_gic_v3_set_affinity
   __tracepoint_android_rvh_iommu_setup_dma_ops
   __tracepoint_android_rvh_is_cpu_allowed
   __tracepoint_android_rvh_migrate_queued_task
+  __tracepoint_android_rvh_mmc_cache_card_properties
   __tracepoint_android_rvh_new_task_stats
+  __tracepoint_android_rvh_partial_init
   __tracepoint_android_rvh_replace_next_task_fair
   __tracepoint_android_rvh_rto_next_cpu
   __tracepoint_android_rvh_sched_cpu_dying
@@ -2007,18 +2028,20 @@
   __tracepoint_android_vh_cpu_idle_exit
   __tracepoint_android_vh_cpuidle_psci_enter
   __tracepoint_android_vh_cpuidle_psci_exit
+  __tracepoint_android_vh_disable_thermal_cooling_stats
   __tracepoint_android_vh_ftrace_dump_buffer
   __tracepoint_android_vh_ftrace_format_check
   __tracepoint_android_vh_ftrace_oops_enter
   __tracepoint_android_vh_ftrace_oops_exit
   __tracepoint_android_vh_ftrace_size_check
   __tracepoint_android_vh_gic_resume
-  __tracepoint_android_rvh_gic_v3_set_affinity
+  __tracepoint_android_vh_handle_tlb_conf
   __tracepoint_android_vh_ipi_stop
   __tracepoint_android_vh_jiffies_update
   __tracepoint_android_vh_kswapd_per_node
   __tracepoint_android_vh_logbuf
   __tracepoint_android_vh_logbuf_pr_cont
+  __tracepoint_android_vh_mmc_sdio_pm_flag_set
   __tracepoint_android_vh_printk_hotplug
   __tracepoint_android_vh_rproc_recovery
   __tracepoint_android_vh_rproc_recovery_set
@@ -2027,10 +2050,12 @@
   __tracepoint_android_vh_show_suspend_epoch_val
   __tracepoint_android_vh_timer_calc_index
   __tracepoint_android_vh_ufs_check_int_errors
+  __tracepoint_android_vh_ufs_clock_scaling
   __tracepoint_android_vh_ufs_compl_command
   __tracepoint_android_vh_ufs_send_command
   __tracepoint_android_vh_ufs_send_tm_command
   __tracepoint_android_vh_ufs_send_uic_command
+  __tracepoint_android_vh_ufs_update_sdev
   __tracepoint_android_vh_update_topology_flags_workfn
   __tracepoint_binder_transaction_received
   __tracepoint_cpu_frequency_limits
@@ -2038,12 +2063,14 @@
   __tracepoint_ipi_entry
   __tracepoint_ipi_raise
   __tracepoint_irq_handler_entry
+  __tracepoint_map
   tracepoint_probe_register
   tracepoint_probe_register_prio
   tracepoint_probe_unregister
   __tracepoint_sched_overutilized_tp
   __tracepoint_sched_switch
   __tracepoint_suspend_resume
+  __tracepoint_unmap
   trace_print_array_seq
   trace_raw_output_prep
   trace_seq_printf
@@ -2159,6 +2186,7 @@
   usb_put_function_instance
   usb_register_notify
   usb_remove_phy
+  usb_role_string
   usb_role_switch_find_by_fwnode
   usb_role_switch_get_drvdata
   usb_role_switch_register

android/abi_gki_aarch64_unisoc

@@ -167,6 +167,7 @@
   debugfs_create_x32
   debugfs_initialized
   debugfs_remove
+  debugfs_rename
   debugfs_create_symlink
   dec_zone_page_state
   default_llseek
@@ -174,6 +175,7 @@
   del_timer
   del_timer_sync
   destroy_workqueue
+  dev_close
   dev_driver_string
   _dev_err
   dev_err_probe
@@ -202,6 +204,7 @@
   device_unregister
   _dev_info
   _dev_printk
+  __dev_change_net_namespace
   __dev_kfree_skb_any
   devm_add_action
   devm_backlight_device_register
@@ -268,6 +271,7 @@
   dma_sync_single_for_device
   dma_unmap_sg_attrs
   double_rq_lock
+  do_trace_netlink_extack
   down
   dput
   driver_register
@@ -352,6 +356,7 @@
   fsync_bdev
   fwnode_property_present
   fwnode_property_read_string
+  gcd
   gen_pool_avail
   gen_pool_best_fit
   gen_pool_set_algo
@@ -362,6 +367,7 @@
   generic_mii_ioctl
   generic_read_dir
   generic_ro_fops
+  genlmsg_multicast_allns
   genl_register_family
   genl_unregister_family
   gen_pool_add_owner
@@ -372,6 +378,8 @@
   get_cpu_device
   __get_free_pages
   get_governor_parent_kobj
+  get_net_ns_by_fd
+  get_net_ns_by_pid
   get_pid_task
   get_random_bytes
   get_zeroed_page
@@ -418,6 +426,7 @@
   ignore_console_lock_warning
   igrab
   inet_proto_csum_replace4
+  inet_csk_get_port
   init_net
   __init_rwsem
   __init_swait_queue_head
@@ -506,6 +515,7 @@
   kern_mount
   kern_unmount
   kernel_kobj
+  key_create_or_update
   kasan_flag_enabled
   kasprintf
   kernel_neon_begin
@@ -515,6 +525,7 @@
   __kfifo_in
   __kfifo_out
   kfree
+  kfree_sensitive
   kfree_skb
   kill_anon_super
   kimage_vaddr
@@ -545,9 +556,11 @@
   kthread_should_stop
   kthread_stop
   ktime_get
+  ktime_get_coarse_with_offset
   ktime_get_mono_fast_ns
   ktime_get_real_seconds
   ktime_get_real_ts64
+  kvfree_call_rcu
   LZ4_decompress_safe_partial
   lzo1x_decompress_safe
   lzorle1x_1_compress
@@ -589,12 +602,20 @@
   __netdev_alloc_skb
   __netif_napi_del
   __num_online_cpus
+  netlink_broadcast
+  netlink_register_notifier
+  netlink_unregister_notifier
   netif_carrier_off
   netif_carrier_on
   netif_rx_ni
   netif_tx_wake_queue
+  net_ns_type_operations
+  nla_find
+  nla_reserve
+  __nla_validate
   nf_conntrack_destroy
   nf_conntrack_find_get
+  nf_ct_destroy
   nf_ct_get_tuplepr
   nf_ct_invert_tuple
   nf_ct_l4proto_find
@@ -635,6 +656,7 @@
   of_parse_phandle_with_fixed_args
   of_platform_depopulate
   of_platform_populate
+  of_prop_next_u32
   of_property_count_elems_of_size
   of_property_match_string
   of_property_read_string
@@ -672,6 +694,8 @@
   phy_print_status
   phy_start
   phy_stop
+  phy_pm_runtime_get_sync
+  phy_pm_runtime_put_sync
   pinctrl_lookup_state
   pinctrl_select_state
   pinctrl_pm_select_default_state
@@ -807,9 +831,12 @@
   reset_control_deassert
   return_address
   rfkill_alloc
+  rfkill_blocked
   rfkill_destroy
   rfkill_init_sw_state
   rfkill_register
+  rfkill_resume_polling
+  rfkill_set_hw_state_reason
   rfkill_unregister
   runqueues
   __SetPageMovable
@@ -855,6 +882,7 @@
   single_open
   single_release
   __skb_ext_put
+  skb_add_rx_frag
   skb_clone
   skb_copy
   skb_copy_expand
@@ -893,7 +921,9 @@
   snd_soc_register_component
   snd_soc_unregister_component
   snprintf
+  __sock_create
   __spi_alloc_controller
+  sock_release
   spi_setup
   sprintf
   sscanf
@@ -918,6 +948,8 @@
   strnlen
   strnstr
   strstr
+  __sw_hweight8
+  __sw_hweight16
   __sw_hweight32
   __sw_hweight64
   submit_bio
@@ -1006,6 +1038,7 @@
   unregister_pernet_subsys
   up
   update_rq_clock
+  usb_add_gadget
   usb_add_gadget_udc
   usb_alloc_coherent
   usb_alloc_urb
@@ -1013,6 +1046,7 @@
   usb_autopm_get_interface_no_resume
   usb_autopm_put_interface
   usb_control_msg
+  usb_del_gadget
   usb_del_gadget_udc
   usb_deregister
   usb_ep_alloc_request
@@ -1031,7 +1065,9 @@
   usb_gadget_udc_reset
   usb_get_dr_mode
   usb_get_intf
+  usb_get_maximum_ssp_rate
   usb_hcd_is_primary_hcd
+  usb_initialize_gadget
   usb_interface_id
   usb_kill_urb
   usb_phy_get_charger_current
@@ -1065,6 +1101,7 @@
   usbnet_write_cmd_async
   usbnet_write_cmd_nopm
   usleep_range_state
+  verify_pkcs7_signature
   vabits_actual
   vchan_dma_desc_free_list
   vchan_find_desc
@@ -1095,6 +1132,7 @@
   wakeup_source_register
   wakeup_source_remove
   wakeup_source_unregister
+  wireless_nlevent_flush
   xa_destroy
   xa_erase
   xa_find
@@ -1120,6 +1158,8 @@
   xt_unregister_target
   xt_unregister_targets
   __traceiter_android_rvh_account_irq
+  __traceiter_android_rvh_account_irq_end
+  __traceiter_android_rvh_account_irq_start
   __traceiter_android_rvh_after_dequeue_task
   __traceiter_android_rvh_after_enqueue_task
   __traceiter_android_rvh_build_perf_domains
@@ -1164,6 +1204,7 @@
   __traceiter_android_rvh_update_misfit_status
   __traceiter_android_rvh_wake_up_new_task
   __traceiter_android_vh_arch_set_freq_scale
+  __traceiter_android_vh_atomic_remove_fb
   __traceiter_android_vh_audio_usb_offload_connect
   __traceiter_android_vh_audio_usb_offload_ep_action
   __traceiter_android_vh_audio_usb_offload_synctype
@@ -1173,6 +1214,7 @@
   __traceiter_android_vh_cpufreq_resolve_freq
   __traceiter_android_vh_cpufreq_fast_switch
   __traceiter_android_vh_cpufreq_target
+  __traceiter_android_vh_drm_atomic_check_modeset
   __traceiter_android_vh_dump_throttled_rt_tasks
   __traceiter_android_vh_enable_thermal_power_throttle
   __traceiter_android_vh_get_thermal_zone_device
@@ -1193,6 +1235,8 @@
   __traceiter_pelt_se_tp
   __traceiter_sched_overutilized_tp
   __tracepoint_android_rvh_account_irq
+  __tracepoint_android_rvh_account_irq_end
+  __tracepoint_android_rvh_account_irq_start
   __tracepoint_android_rvh_after_dequeue_task
   __tracepoint_android_rvh_after_enqueue_task
   __tracepoint_android_rvh_build_perf_domains
@@ -1237,6 +1281,7 @@
   __tracepoint_android_rvh_update_misfit_status
   __tracepoint_android_rvh_wake_up_new_task
   __tracepoint_android_vh_arch_set_freq_scale
+  __tracepoint_android_vh_atomic_remove_fb
   __tracepoint_android_vh_audio_usb_offload_ep_action
   __tracepoint_android_vh_audio_usb_offload_synctype
   __tracepoint_android_vh_binder_restore_priority
@@ -1245,6 +1290,7 @@
   __tracepoint_android_vh_cpufreq_resolve_freq
   __tracepoint_android_vh_cpufreq_fast_switch
   __tracepoint_android_vh_cpufreq_target
+  __tracepoint_android_vh_drm_atomic_check_modeset
   __tracepoint_android_vh_dump_throttled_rt_tasks
   __tracepoint_android_vh_enable_thermal_power_throttle
   __tracepoint_android_vh_get_thermal_zone_device
@@ -1665,6 +1711,7 @@
   bpf_trace_run6
   bpf_trace_run7
   bpf_trace_run8
+  bpf_trace_run10
   cache_line_size
   devfreq_cooling_unregister
   devfreq_recommended_opp
@@ -2968,3 +3015,7 @@
   usb_role_switch_get
   usb_role_switch_put
   usb_role_switch_set_role
+
+# required by unisoc_dump_io.ko
+  blk_stat_enable_accounting
+

android/abi_gki_aarch64_xiaomi

@@ -0,0 +1,174 @@
+[abi_symbol_list]
+# commonly used symbols
+
+# required by touch module
+  proc_mkdir_data
+  proc_create_seq_private
+
+# required by aw8697-haptic.ko
+  devm_gpio_free
+  i2c_smbus_read_byte_data
+  i2c_smbus_write_byte_data
+
+#required by memory module
+  blk_execute_rq
+  blk_rq_map_kern
+  scsi_device_lookup
+  scsi_host_lookup
+  scsi_host_put
+  ufshcd_read_desc_param
+  utf16s_to_utf8s
+  async_schedule_node
+  blk_ksm_register
+  blk_ksm_reprogram_all_keys
+  blk_mq_alloc_tag_set
+  blk_mq_init_queue
+  blk_mq_tagset_busy_iter
+  bsg_job_done
+  bsg_remove_queue
+  bsg_setup_queue
+  dev_pm_opp_remove
+  scsi_add_host_with_dma
+  scsi_block_requests
+  scsi_dma_unmap
+  scsi_is_host_device
+  scsi_remove_host
+  scsi_report_bus_reset
+  scsi_scan_host
+  scsi_unblock_requests
+  scsi_change_queue_depth
+  scsi_print_command
+  scsi_dma_map
+  scsi_host_alloc
+  scsi_normalize_sense
+  sg_copy_from_buffer
+  sg_copy_to_buffer
+  ufshcd_alloc_host
+  ufshcd_config_pwr_mode
+  ufshcd_dealloc_host
+  ufshcd_hba_enable
+  ufshcd_make_hba_operational
+  ufshcd_map_desc_id_to_length
+  ufshcd_query_attr_retry
+  ufshcd_query_flag_retry
+  ufshcd_update_evt_hist
+  wait_for_completion_io_timeout
+  __scsi_add_device
+  __scsi_execute
+  blk_mq_free_tag_set
+  blk_queue_update_dma_alignment
+  blk_queue_update_dma_pad
+  blk_ksm_get_slot_idx
+  mempool_resize
+  mempool_alloc_pages
+  mempool_free_pages
+
+#required by cs35l41 module
+  regmap_raw_write_async
+  snd_soc_bytes_tlv_callback
+  regmap_async_complete
+  snd_compr_stop_error
+  snd_soc_component_disable_pin
+  snd_soc_component_force_enable_pin
+  snd_pcm_format_physical_width
+  snd_pcm_hw_constraint_list
+  regmap_multi_reg_write_bypassed
+  snd_ctl_boolean_mono_info
+  snd_soc_put_volsw_range
+  snd_soc_get_volsw_range
+  snd_soc_info_volsw_range
+  regmap_raw_write
+  regcache_drop_region
+  regmap_raw_read
+  regmap_multi_reg_write
+  regulator_bulk_enable
+
+#required by mtd module
+  __blk_mq_end_request
+  balance_dirty_pages_ratelimited
+  bdi_alloc
+  bdi_put
+  bdi_register
+  blk_mq_freeze_queue
+  blk_mq_quiesce_queue
+  blk_mq_start_request
+  blk_mq_unfreeze_queue
+  blk_mq_unquiesce_queue
+  blk_queue_write_cache
+  blk_update_request
+  blkdev_get_by_dev
+  blkdev_get_by_path
+  blkdev_put
+  deactivate_locked_super
+  fixed_size_llseek
+  generic_shutdown_super
+  kmsg_dump_get_buffer
+  kmsg_dump_register
+  kmsg_dump_rewind
+  kmsg_dump_unregister
+  ktime_get_coarse_real_ts64
+  lockref_get
+  logfc
+  lookup_bdev
+  name_to_dev_t
+  nvmem_register
+  nvmem_unregister
+  proc_create_single_data
+  read_cache_page
+  rq_flush_dcache_pages
+  set_disk_ro
+  set_page_dirty
+  sget_fc
+  simple_strtoul
+  sync_blockdev
+  wait_for_device_probe
+
+#required by millet.ko
+  __traceiter_android_vh_binder_wait_for_work
+  __tracepoint_android_vh_binder_wait_for_work
+
+#required by mi_sched.ko
+  __traceiter_android_vh_free_task
+  __tracepoint_android_vh_free_task
+  jiffies_64
+
+#required by migt.ko
+  __traceiter_android_rvh_after_enqueue_task
+  __traceiter_android_rvh_after_dequeue_task
+  __traceiter_android_vh_map_util_freq
+  __tracepoint_android_rvh_after_enqueue_task
+  __tracepoint_android_rvh_after_dequeue_task
+  __tracepoint_android_vh_map_util_freq
+
+#required by turbo.ko
+
+#required by fas.ko
+  __traceiter_android_rvh_check_preempt_tick
+  __traceiter_android_rvh_dequeue_entity
+  __traceiter_android_rvh_enqueue_entity
+  __tracepoint_android_rvh_check_preempt_tick
+  __tracepoint_android_rvh_dequeue_entity
+  __tracepoint_android_rvh_enqueue_entity
+
+#required by pm8941-pwrkey.ko module
+  console_printk
+
+#required by binderinfo.ko module
+  __traceiter_android_vh_binder_transaction_init
+  __tracepoint_android_vh_binder_transaction_init
+
+#required by reclaim module
+
+#required by msm_drm.ko module
+  drm_get_connector_type_name
+
+#required by mi_gamekey.ko module
+  gpio_request_array
+
+#extend_reclaim.ko
+
+##required by xm_power_debug.ko module
+  wakeup_sources_read_lock
+  wakeup_sources_read_unlock
+  wakeup_sources_walk_start
+  wakeup_sources_walk_next

android/gki_aarch64_fips140_modules

@@ -1 +1,3 @@
+mm/zsmalloc.ko
 crypto/fips140.ko
+drivers/block/zram/zram.ko

arch/arm64/configs/gki_defconfig

@@ -13,6 +13,7 @@ CONFIG_TASK_IO_ACCOUNTING=y
 CONFIG_PSI=y
 CONFIG_RCU_EXPERT=y
 CONFIG_RCU_FAST_NO_HZ=y
+CONFIG_RCU_BOOST=y
 CONFIG_RCU_NOCB_CPU=y
 CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
@@ -99,6 +100,7 @@ CONFIG_MODVERSIONS=y
 CONFIG_MODULE_SCMVERSION=y
 CONFIG_MODULE_SIG=y
 CONFIG_MODULE_SIG_PROTECT=y
+CONFIG_BLK_CGROUP_IOCOST=y
 CONFIG_BLK_INLINE_ENCRYPTION=y
 CONFIG_BLK_INLINE_ENCRYPTION_FALLBACK=y
 CONFIG_IOSCHED_BFQ=y
@@ -119,6 +121,9 @@ CONFIG_ZSMALLOC=m
 # CONFIG_ZONE_DMA is not set
 CONFIG_ANON_VMA_NAME=y
 CONFIG_LRU_GEN=y
+CONFIG_DAMON=y
+CONFIG_DAMON_PADDR=y
+CONFIG_DAMON_RECLAIM=y
 CONFIG_NET=y
 CONFIG_PACKET=y
 CONFIG_UNIX=y
@@ -312,11 +317,13 @@ CONFIG_SCSI_UFS_DWC_TC_PLATFORM=y
 CONFIG_SCSI_UFS_HISI=y
 CONFIG_SCSI_UFS_BSG=y
 CONFIG_SCSI_UFS_CRYPTO=y
+CONFIG_SCSI_UFS_HPB=y
 CONFIG_MD=y
 CONFIG_BLK_DEV_DM=y
 CONFIG_DM_CRYPT=y
 CONFIG_DM_DEFAULT_KEY=y
 CONFIG_DM_SNAPSHOT=y
+CONFIG_DM_INIT=y
 CONFIG_DM_UEVENT=y
 CONFIG_DM_VERITY=y
 CONFIG_DM_VERITY_FEC=y
@@ -678,6 +685,7 @@ CONFIG_KASAN_HW_TAGS=y
 CONFIG_KFENCE=y
 CONFIG_KFENCE_SAMPLE_INTERVAL=500
 CONFIG_KFENCE_NUM_OBJECTS=63
+CONFIG_KFENCE_STATIC_KEYS=y
 CONFIG_PANIC_ON_OOPS=y
 CONFIG_PANIC_TIMEOUT=-1
 CONFIG_SOFTLOCKUP_DETECTOR=y

arch/arm64/include/asm/esr.h

@@ -112,6 +112,7 @@
 #define ESR_ELx_FSC_ACCESS	(0x08)
 #define ESR_ELx_FSC_FAULT	(0x04)
 #define ESR_ELx_FSC_PERM	(0x0C)
+#define ESR_ELx_FSC_TLBCONF	(0x30)
 
 /* ISS field definitions for Data Aborts */
 #define ESR_ELx_ISV_SHIFT	(24)

arch/arm64/kvm/arm.c

@@ -2172,11 +2172,12 @@ static int finalize_hyp_mode(void)
 		return 0;
 
 	/*
-	 * Exclude HYP BSS from kmemleak so that it doesn't get peeked
+	 * Exclude HYP sections from kmemleak so that they don't get peeked
-	 * at, which would end badly once the section is inaccessible.
+	 * at, which would end badly once inaccessible.
-	 * None of other sections should ever be introspected.
 	 */
 	kmemleak_free_part(__hyp_bss_start, __hyp_bss_end - __hyp_bss_start);
+	kmemleak_free_part(__hyp_data_start, __hyp_data_end - __hyp_data_start);
+	kmemleak_free_part(__va(hyp_mem_base), hyp_mem_size);
 	return pkvm_drop_host_privileges();
 }
 

arch/arm64/kvm/hyp/include/nvhe/mem_protect.h

@@ -78,7 +78,8 @@ int __pkvm_remove_ioguard_page(struct kvm_vcpu *vcpu, u64 ipa);
 bool __pkvm_check_ioguard_page(struct kvm_vcpu *vcpu);
 
 bool addr_is_memory(phys_addr_t phys);
-int host_stage2_idmap_locked(phys_addr_t addr, u64 size, enum kvm_pgtable_prot prot);
+int host_stage2_idmap_locked(phys_addr_t addr, u64 size, enum kvm_pgtable_prot prot,
+			     bool update_iommu);
 int host_stage2_set_owner_locked(phys_addr_t addr, u64 size, pkvm_id owner_id);
 int host_stage2_unmap_dev_locked(phys_addr_t start, u64 size);
 int kvm_host_prepare_stage2(void *pgt_pool_base);

arch/arm64/kvm/hyp/nvhe/mem_protect.c

@@ -465,7 +465,8 @@ static bool range_is_memory(u64 start, u64 end)
 }
 
 static inline int __host_stage2_idmap(u64 start, u64 end,
-				      enum kvm_pgtable_prot prot)
+				      enum kvm_pgtable_prot prot,
+				      bool update_iommu)
 {
 	int ret;
 
@@ -474,7 +475,8 @@ static inline int __host_stage2_idmap(u64 start, u64 end,
 	if (ret)
 		return ret;
 
-	pkvm_iommu_host_stage2_idmap(start, end, prot);
+	if (update_iommu)
+		pkvm_iommu_host_stage2_idmap(start, end, prot);
 	return 0;
 }
 
@@ -536,9 +538,9 @@ static int host_stage2_adjust_range(u64 addr, struct kvm_mem_range *range)
 }
 
 int host_stage2_idmap_locked(phys_addr_t addr, u64 size,
-			     enum kvm_pgtable_prot prot)
+			     enum kvm_pgtable_prot prot, bool update_iommu)
 {
-	return host_stage2_try(__host_stage2_idmap, addr, addr + size, prot);
+	return host_stage2_try(__host_stage2_idmap, addr, addr + size, prot, update_iommu);
 }
 
 #define KVM_INVALID_PTE_OWNER_MASK	GENMASK(32, 1)
@@ -612,7 +614,7 @@ static int host_stage2_idmap(u64 addr)
 	if (ret)
 		return ret;
 
-	return host_stage2_idmap_locked(range.start, range.end - range.start, prot);
+	return host_stage2_idmap_locked(range.start, range.end - range.start, prot, false);
 }
 
 static bool is_dabt(u64 esr)
@@ -833,7 +835,7 @@ static int __host_set_page_state_range(u64 addr, u64 size,
 {
 	enum kvm_pgtable_prot prot = pkvm_mkstate(PKVM_HOST_MEM_PROT, state);
 
-	return host_stage2_idmap_locked(addr, size, prot);
+	return host_stage2_idmap_locked(addr, size, prot, true);
 }
 
 static int host_request_owned_transition(u64 *completer_addr,

arch/arm64/kvm/hyp/nvhe/setup.c

@@ -222,7 +222,7 @@ static int fix_host_ownership_walker(u64 addr, u64 end, u32 level,
 		return -EINVAL;
 	}
 
-	return host_stage2_idmap_locked(phys, PAGE_SIZE, prot);
+	return host_stage2_idmap_locked(phys, PAGE_SIZE, prot, false);
 }
 
 static int fix_hyp_pgtable_refcnt_walker(u64 addr, u64 end, u32 level,

arch/arm64/mm/fault.c

@@ -542,6 +542,7 @@ static int __kprobes do_page_fault(unsigned long far, unsigned int esr,
 	unsigned int mm_flags = FAULT_FLAG_DEFAULT;
 	unsigned long addr = untagged_addr(far);
 #ifdef CONFIG_SPECULATIVE_PAGE_FAULT
+	struct vm_area_struct *orig_vma = NULL;
 	struct vm_area_struct *vma;
 	struct vm_area_struct pvma;
 	unsigned long seq;
@@ -629,17 +630,29 @@ static int __kprobes do_page_fault(unsigned long far, unsigned int esr,
 		count_vm_spf_event(SPF_ABORT_NO_SPECULATE);
 		goto spf_abort;
 	}
+	if (vma->vm_file) {
+		if (!vma_get_file_ref(vma)) {
+			rcu_read_unlock();
+			count_vm_spf_event(SPF_ABORT_UNMAPPED);
+			goto spf_abort;
+		}
+		orig_vma = vma;
+	}
 	pvma = *vma;
 	rcu_read_unlock();
-	if (!mmap_seq_read_check(mm, seq, SPF_ABORT_VMA_COPY))
+	if (!mmap_seq_read_check(mm, seq, SPF_ABORT_VMA_COPY)) {
+		vma_put_file_ref(orig_vma);
 		goto spf_abort;
+	}
 	vma = &pvma;
 	if (!(vma->vm_flags & vm_flags)) {
 		count_vm_spf_event(SPF_ABORT_ACCESS_ERROR);
+		vma_put_file_ref(orig_vma);
 		goto spf_abort;
 	}
 	fault = do_handle_mm_fault(vma, addr & PAGE_MASK,
 			mm_flags | FAULT_FLAG_SPECULATIVE, seq, regs);
+	vma_put_file_ref(orig_vma);
 
 	/* Quick path to respond to signals */
 	if (fault_signal_pending(fault, regs)) {
@@ -779,7 +792,11 @@ static int do_alignment_fault(unsigned long far, unsigned int esr,
 
 static int do_bad(unsigned long far, unsigned int esr, struct pt_regs *regs)
 {
-	return 1; /* "fault" */
+	unsigned long addr = untagged_addr(far);
+	int ret = 1;
+
+	trace_android_vh_handle_tlb_conf(addr, esr, &ret);
+	return ret;
 }
 
 static int do_sea(unsigned long far, unsigned int esr, struct pt_regs *regs)

arch/powerpc/kernel/kvm.c

@@ -669,7 +669,8 @@ static void __init kvm_use_magic_page(void)
 	on_each_cpu(kvm_map_magic_page, &features, 1);
 
 	/* Quick self-test to see if the mapping works */
-	if (fault_in_pages_readable((const char *)KVM_MAGIC_PAGE, sizeof(u32))) {
+	if (fault_in_readable((const char __user *)KVM_MAGIC_PAGE,
+			      sizeof(u32))) {
 		kvm_patching_worked = false;
 		return;
 	}

arch/powerpc/kernel/signal_32.c

@@ -1048,7 +1048,7 @@ SYSCALL_DEFINE3(swapcontext, struct ucontext __user *, old_ctx,
 	if (new_ctx == NULL)
 		return 0;
 	if (!access_ok(new_ctx, ctx_size) ||
-	    fault_in_pages_readable((u8 __user *)new_ctx, ctx_size))
+	    fault_in_readable((char __user *)new_ctx, ctx_size))
 		return -EFAULT;
 
 	/*
@@ -1239,7 +1239,7 @@ SYSCALL_DEFINE3(debug_setcontext, struct ucontext __user *, ctx,
 #endif
 
 	if (!access_ok(ctx, sizeof(*ctx)) ||
-	    fault_in_pages_readable((u8 __user *)ctx, sizeof(*ctx)))
+	    fault_in_readable((char __user *)ctx, sizeof(*ctx)))
 		return -EFAULT;
 
 	/*

arch/powerpc/kernel/signal_64.c

@@ -688,7 +688,7 @@ SYSCALL_DEFINE3(swapcontext, struct ucontext __user *, old_ctx,
 	if (new_ctx == NULL)
 		return 0;
 	if (!access_ok(new_ctx, ctx_size) ||
-	    fault_in_pages_readable((u8 __user *)new_ctx, ctx_size))
+	    fault_in_readable((char __user *)new_ctx, ctx_size))
 		return -EFAULT;
 
 	/*

arch/powerpc/mm/fault.c

@@ -395,6 +395,7 @@ static int ___do_page_fault(struct pt_regs *regs, unsigned long address,
 	vm_fault_t fault, major = 0;
 	bool kprobe_fault = kprobe_page_fault(regs, 11);
 #ifdef CONFIG_SPECULATIVE_PAGE_FAULT
+	struct vm_area_struct *orig_vma = NULL;
 	struct vm_area_struct pvma;
 	unsigned long seq;
 #endif
@@ -480,24 +481,37 @@ static int ___do_page_fault(struct pt_regs *regs, unsigned long address,
 		count_vm_spf_event(SPF_ABORT_NO_SPECULATE);
 		goto spf_abort;
 	}
+	if (vma->vm_file) {
+		if (!vma_get_file_ref(vma)) {
+			rcu_read_unlock();
+			count_vm_spf_event(SPF_ABORT_UNMAPPED);
+			goto spf_abort;
+		}
+		orig_vma = vma;
+	}
 	pvma = *vma;
 	rcu_read_unlock();
-	if (!mmap_seq_read_check(mm, seq, SPF_ABORT_VMA_COPY))
+	if (!mmap_seq_read_check(mm, seq, SPF_ABORT_VMA_COPY)) {
+		vma_put_file_ref(orig_vma);
 		goto spf_abort;
+	}
 	vma = &pvma;
 #ifdef CONFIG_PPC_MEM_KEYS
 	if (unlikely(access_pkey_error(is_write, is_exec,
 				       (error_code & DSISR_KEYFAULT), vma))) {
 		count_vm_spf_event(SPF_ABORT_ACCESS_ERROR);
+		vma_put_file_ref(orig_vma);
 		goto spf_abort;
 	}
 #endif /* CONFIG_PPC_MEM_KEYS */
 	if (unlikely(access_error(is_write, is_exec, vma))) {
 		count_vm_spf_event(SPF_ABORT_ACCESS_ERROR);
+		vma_put_file_ref(orig_vma);
 		goto spf_abort;
 	}
 	fault = do_handle_mm_fault(vma, address,
 				   flags | FAULT_FLAG_SPECULATIVE, seq, regs);
+	vma_put_file_ref(orig_vma);
 	major |= fault & VM_FAULT_MAJOR;
 
 	if (fault_signal_pending(fault, regs))

arch/x86/configs/gki_defconfig

@@ -15,6 +15,7 @@ CONFIG_TASK_IO_ACCOUNTING=y
 CONFIG_PSI=y
 CONFIG_RCU_EXPERT=y
 CONFIG_RCU_FAST_NO_HZ=y
+CONFIG_RCU_BOOST=y
 CONFIG_RCU_NOCB_CPU=y
 CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
@@ -80,6 +81,7 @@ CONFIG_MODVERSIONS=y
 CONFIG_MODULE_SCMVERSION=y
 CONFIG_MODULE_SIG=y
 CONFIG_MODULE_SIG_PROTECT=y
+CONFIG_BLK_CGROUP_IOCOST=y
 CONFIG_BLK_INLINE_ENCRYPTION=y
 CONFIG_BLK_INLINE_ENCRYPTION_FALLBACK=y
 CONFIG_IOSCHED_BFQ=y
@@ -99,6 +101,9 @@ CONFIG_CMA_AREAS=16
 # CONFIG_ZONE_DMA is not set
 CONFIG_ANON_VMA_NAME=y
 CONFIG_LRU_GEN=y
+CONFIG_DAMON=y
+CONFIG_DAMON_PADDR=y
+CONFIG_DAMON_RECLAIM=y
 CONFIG_NET=y
 CONFIG_PACKET=y
 CONFIG_UNIX=y
@@ -282,11 +287,13 @@ CONFIG_SCSI_UFSHCD_PLATFORM=y
 CONFIG_SCSI_UFS_DWC_TC_PLATFORM=y
 CONFIG_SCSI_UFS_BSG=y
 CONFIG_SCSI_UFS_CRYPTO=y
+CONFIG_SCSI_UFS_HPB=y
 CONFIG_MD=y
 CONFIG_BLK_DEV_DM=y
 CONFIG_DM_CRYPT=y
 CONFIG_DM_DEFAULT_KEY=y
 CONFIG_DM_SNAPSHOT=y
+CONFIG_DM_INIT=y
 CONFIG_DM_UEVENT=y
 CONFIG_DM_VERITY=y
 CONFIG_DM_VERITY_FEC=y
@@ -612,6 +619,7 @@ CONFIG_DEBUG_MEMORY_INIT=y
 CONFIG_KFENCE=y
 CONFIG_KFENCE_SAMPLE_INTERVAL=500
 CONFIG_KFENCE_NUM_OBJECTS=63
+CONFIG_KFENCE_STATIC_KEYS=y
 CONFIG_PANIC_ON_OOPS=y
 CONFIG_PANIC_TIMEOUT=-1
 CONFIG_SOFTLOCKUP_DETECTOR=y

arch/x86/kernel/fpu/signal.c

@@ -205,7 +205,7 @@ retry:
 	fpregs_unlock();
 
 	if (ret) {
-		if (!fault_in_pages_writeable(buf_fx, fpu_user_xstate_size))
+		if (!fault_in_writeable(buf_fx, fpu_user_xstate_size))
 			goto retry;
 		return -EFAULT;
 	}
@@ -278,10 +278,9 @@ retry:
 		if (ret != -EFAULT)
 			return -EINVAL;
 
-		ret = fault_in_pages_readable(buf, size);
+		if (!fault_in_readable(buf, size))
-		if (!ret)
 			goto retry;
-		return ret;
+		return -EFAULT;
 	}
 
 	/*

arch/x86/mm/fault.c

@@ -1227,6 +1227,7 @@ void do_user_addr_fault(struct pt_regs *regs,
 	vm_fault_t fault;
 	unsigned int flags = FAULT_FLAG_DEFAULT;
 #ifdef CONFIG_SPECULATIVE_PAGE_FAULT
+	struct vm_area_struct *orig_vma = NULL;
 	struct vm_area_struct pvma;
 	unsigned long seq;
 #endif
@@ -1353,17 +1354,29 @@ void do_user_addr_fault(struct pt_regs *regs,
 		count_vm_spf_event(SPF_ABORT_NO_SPECULATE);
 		goto spf_abort;
 	}
+	if (vma->vm_file) {
+		if (!vma_get_file_ref(vma)) {
+			rcu_read_unlock();
+			count_vm_spf_event(SPF_ABORT_UNMAPPED);
+			goto spf_abort;
+		}
+		orig_vma = vma;
+	}
 	pvma = *vma;
 	rcu_read_unlock();
-	if (!mmap_seq_read_check(mm, seq, SPF_ABORT_VMA_COPY))
+	if (!mmap_seq_read_check(mm, seq, SPF_ABORT_VMA_COPY)) {
+		vma_put_file_ref(orig_vma);
 		goto spf_abort;
+	}
 	vma = &pvma;
 	if (unlikely(access_error(error_code, vma))) {
 		count_vm_spf_event(SPF_ABORT_ACCESS_ERROR);
+		vma_put_file_ref(orig_vma);
 		goto spf_abort;
 	}
 	fault = do_handle_mm_fault(vma, address,
 				   flags | FAULT_FLAG_SPECULATIVE, seq, regs);
+	vma_put_file_ref(orig_vma);
 
 	if (!(fault & VM_FAULT_RETRY))
 		goto done;

block/bfq-iosched.c

@@ -132,6 +132,7 @@
 #include "blk-mq-tag.h"
 #include "blk-mq-sched.h"
 #include "bfq-iosched.h"
+#include "blk-stat.h"
 #include "blk-wbt.h"
 
 #define BFQ_BFQQ_FNS(name)						\
@@ -7032,6 +7033,8 @@ static int bfq_init_queue(struct request_queue *q, struct elevator_type *e)
 	bfq_init_entity(&bfqd->oom_bfqq.entity, bfqd->root_group);
 
 	wbt_disable_default(q);
+	blk_stat_enable_accounting(q);
+
 	return 0;
 
 out_free:

block/blk-mq-tag.h

@@ -26,6 +26,8 @@ struct blk_mq_tags {
 	 * request pool
 	 */
 	spinlock_t lock;
+
+	ANDROID_OEM_DATA(1);
 };
 
 extern struct blk_mq_tags *blk_mq_init_tags(unsigned int nr_tags,

block/blk-mq.c

@@ -41,6 +41,8 @@
 #include "blk-mq-sched.h"
 #include "blk-rq-qos.h"
 
+#include <trace/hooks/block.h>
+
 static DEFINE_PER_CPU(struct llist_head, blk_cpu_done);
 
 static void blk_mq_poll_stats_start(struct request_queue *q);
@@ -349,6 +351,7 @@ static struct request *blk_mq_rq_ctx_init(struct blk_mq_alloc_data *data,
 	}
 
 	data->hctx->queued++;
+	trace_android_vh_blk_rq_ctx_init(rq, tags, data, alloc_time_ns);
 	return rq;
 }
 
@@ -2459,6 +2462,7 @@ int blk_mq_alloc_rqs(struct blk_mq_tag_set *set, struct blk_mq_tags *tags,
 	 */
 	rq_size = round_up(sizeof(struct request) + set->cmd_size,
 				cache_line_size());
+	trace_android_vh_blk_alloc_rqs(&rq_size, set, tags);
 	left = rq_size * depth;
 
 	for (i = 0; i < depth; ) {

block/blk-mq.h

@@ -35,6 +35,8 @@ struct blk_mq_ctx {
 	struct request_queue	*queue;
 	struct blk_mq_ctxs      *ctxs;
 	struct kobject		kobj;
+
+	ANDROID_OEM_DATA_ARRAY(1, 2);
 } ____cacheline_aligned_in_smp;
 
 void blk_mq_exit_queue(struct request_queue *q);

build.config.common

@@ -1,6 +1,6 @@
 . ${ROOT_DIR}/${KERNEL_DIR}/build.config.constants
 
-KMI_GENERATION=7
+KMI_GENERATION=8
 
 LLVM=1
 DEPMOD=depmod

build.config.gki.aarch64

@@ -4,6 +4,7 @@
 
 MAKE_GOALS="${MAKE_GOALS}
 Image.lz4
+Image.gz
 "
 
 ABI_DEFINITION=android/abi_gki_aarch64.xml
@@ -16,16 +17,21 @@ android/abi_gki_aarch64_db845c
 android/abi_gki_aarch64_exynos
 android/abi_gki_aarch64_exynosauto
 android/abi_gki_aarch64_fips140
+android/abi_gki_aarch64_honor
 android/abi_gki_aarch64_imx
 android/abi_gki_aarch64_pixel
 android/abi_gki_aarch64_mtktv
 android/abi_gki_aarch64_mtk
 android/abi_gki_aarch64_qcom
 android/abi_gki_aarch64_unisoc
+android/abi_gki_aarch64_vivo
+android/abi_gki_aarch64_xiaomi
+android/abi_gki_aarch64_oplus
 "
 
 FILES="${FILES}
 arch/arm64/boot/Image.lz4
+arch/arm64/boot/Image.gz
 "
 
 # Update BUILD.bazel, define_common_kernels() if the value is not 1.
@@ -41,4 +47,5 @@ BUILD_GKI_CERTIFICATION_TOOLS=1
 
 BUILD_GKI_ARTIFACTS=1
 BUILD_GKI_BOOT_IMG_SIZE=67108864
+BUILD_GKI_BOOT_IMG_GZ_SIZE=47185920
 BUILD_GKI_BOOT_IMG_LZ4_SIZE=53477376

build.config.gki.x86_64

@@ -5,4 +5,5 @@
 BUILD_SYSTEM_DLKM=1
 MODULES_LIST=${ROOT_DIR}/${KERNEL_DIR}/android/gki_system_dlkm_modules
 
-BUILD_GKI_CERTIFICATION_TOOLS=1
+BUILD_GKI_ARTIFACTS=1
+BUILD_GKI_BOOT_IMG_SIZE=67108864

drivers/android/binder.c

@@ -648,20 +648,21 @@ static int to_kernel_prio(int policy, int user_priority)
 		return MAX_RT_PRIO - 1 - user_priority;
 }
 
-static void binder_do_set_priority(struct task_struct *task,
+static void binder_do_set_priority(struct binder_thread *thread,
-				   struct binder_priority desired,
+				   const struct binder_priority *desired,
 				   bool verify)
 {
+	struct task_struct *task = thread->task;
 	int priority; /* user-space prio value */
 	bool has_cap_nice;
-	unsigned int policy = desired.sched_policy;
+	unsigned int policy = desired->sched_policy;
 
-	if (task->policy == policy && task->normal_prio == desired.prio)
+	if (task->policy == policy && task->normal_prio == desired->prio)
 		return;
 
 	has_cap_nice = has_capability_noaudit(task, CAP_SYS_NICE);
 
-	priority = to_userspace_prio(policy, desired.prio);
+	priority = to_userspace_prio(policy, desired->prio);
 
 	if (verify && is_rt_policy(policy) && !has_cap_nice) {
 		long max_rtprio = task_rlimit(task, RLIMIT_RTPRIO);
@@ -686,16 +687,30 @@ static void binder_do_set_priority(struct task_struct *task,
 		}
 	}
 
-	if (policy != desired.sched_policy ||
+	if (policy != desired->sched_policy ||
-	    to_kernel_prio(policy, priority) != desired.prio)
+	    to_kernel_prio(policy, priority) != desired->prio)
 		binder_debug(BINDER_DEBUG_PRIORITY_CAP,
 			     "%d: priority %d not allowed, using %d instead\n",
-			      task->pid, desired.prio,
+			      task->pid, desired->prio,
 			      to_kernel_prio(policy, priority));
 
 	trace_binder_set_priority(task->tgid, task->pid, task->normal_prio,
 				  to_kernel_prio(policy, priority),
-				  desired.prio);
+				  desired->prio);
+
+	spin_lock(&thread->prio_lock);
+	if (!verify && thread->prio_state == BINDER_PRIO_ABORT) {
+		/*
+		 * A new priority has been set by an incoming nested
+		 * transaction. Abort this priority restore and allow
+		 * the transaction to run at the new desired priority.
+		 */
+		spin_unlock(&thread->prio_lock);
+		binder_debug(BINDER_DEBUG_PRIORITY_CAP,
+			"%d: %s: aborting priority restore\n",
+			thread->pid, __func__);
+		return;
+	}
 
 	/* Set the actual priority */
 	if (task->policy != policy || is_rt_policy(policy)) {
@@ -709,37 +724,47 @@ static void binder_do_set_priority(struct task_struct *task,
 	}
 	if (is_fair_policy(policy))
 		set_user_nice(task, priority);
+
+	thread->prio_state = BINDER_PRIO_SET;
+	spin_unlock(&thread->prio_lock);
 }
 
-static void binder_set_priority(struct task_struct *task,
+static void binder_set_priority(struct binder_thread *thread,
-				struct binder_priority desired)
+				const struct binder_priority *desired)
 {
-	binder_do_set_priority(task, desired, /* verify = */ true);
+	binder_do_set_priority(thread, desired, /* verify = */ true);
 }
 
-static void binder_restore_priority(struct task_struct *task,
+static void binder_restore_priority(struct binder_thread *thread,
-				    struct binder_priority desired)
+				    const struct binder_priority *desired)
 {
-	binder_do_set_priority(task, desired, /* verify = */ false);
+	binder_do_set_priority(thread, desired, /* verify = */ false);
 }
 
-static void binder_transaction_priority(struct task_struct *task,
+static void binder_transaction_priority(struct binder_thread *thread,
 					struct binder_transaction *t,
-					struct binder_priority node_prio,
+					struct binder_node *node)
-					bool inherit_rt)
 {
-	struct binder_priority desired_prio = t->priority;
+	struct task_struct *task = thread->task;
+	struct binder_priority desired = t->priority;
+	const struct binder_priority node_prio = {
+		.sched_policy = node->sched_policy,
+		.prio = node->min_priority,
+	};
+	bool skip = false;
 
 	if (t->set_priority_called)
 		return;
 
 	t->set_priority_called = true;
-	t->saved_priority.sched_policy = task->policy;
-	t->saved_priority.prio = task->normal_prio;
 
-	if (!inherit_rt && is_rt_policy(desired_prio.sched_policy)) {
+	trace_android_vh_binder_priority_skip(task, &skip);
-		desired_prio.prio = NICE_TO_PRIO(0);
+	if (skip)
-		desired_prio.sched_policy = SCHED_NORMAL;
+		return;
+
+	if (!node->inherit_rt && is_rt_policy(desired.sched_policy)) {
+		desired.prio = NICE_TO_PRIO(0);
+		desired.sched_policy = SCHED_NORMAL;
 	}
 
 	if (node_prio.prio < t->priority.prio ||
@@ -752,10 +777,29 @@ static void binder_transaction_priority(struct task_struct *task,
 		 * SCHED_FIFO, prefer SCHED_FIFO, since it can
 		 * run unbounded, unlike SCHED_RR.
 		 */
-		desired_prio = node_prio;
+		desired = node_prio;
 	}
 
-	binder_set_priority(task, desired_prio);
+	spin_lock(&thread->prio_lock);
+	if (thread->prio_state == BINDER_PRIO_PENDING) {
+		/*
+		 * Task is in the process of changing priorities
+		 * saving its current values would be incorrect.
+		 * Instead, save the pending priority and signal
+		 * the task to abort the priority restore.
+		 */
+		t->saved_priority = thread->prio_next;
+		thread->prio_state = BINDER_PRIO_ABORT;
+		binder_debug(BINDER_DEBUG_PRIORITY_CAP,
+			"%d: saved pending priority %d\n",
+			current->pid, thread->prio_next.prio);
+	} else {
+		t->saved_priority.sched_policy = task->policy;
+		t->saved_priority.prio = task->normal_prio;
+	}
+	spin_unlock(&thread->prio_lock);
+
+	binder_set_priority(thread, &desired);
 	trace_android_vh_binder_set_priority(t, task);
 }
 
@@ -2501,14 +2545,11 @@ static int binder_proc_transaction(struct binder_transaction *t,
 				    struct binder_thread *thread)
 {
 	struct binder_node *node = t->buffer->target_node;
-	struct binder_priority node_prio;
 	bool oneway = !!(t->flags & TF_ONE_WAY);
 	bool pending_async = false;
 
 	BUG_ON(!node);
 	binder_node_lock(node);
-	node_prio.prio = node->min_priority;
-	node_prio.sched_policy = node->sched_policy;
 
 	if (oneway) {
 		BUG_ON(thread);
@@ -2535,8 +2576,7 @@ static int binder_proc_transaction(struct binder_transaction *t,
 		thread = binder_select_thread_ilocked(proc);
 
 	if (thread) {
-		binder_transaction_priority(thread->task, t, node_prio,
+		binder_transaction_priority(thread, t, node);
-					    node->inherit_rt);
 		binder_enqueue_thread_work_ilocked(thread, &t->work);
 	} else if (!pending_async) {
 		binder_enqueue_work_ilocked(&t->work, &proc->todo);
@@ -2626,6 +2666,7 @@ static void binder_transaction(struct binder_proc *proc,
 	u32 secctx_sz = 0;
 	const void __user *user_buffer = (const void __user *)
 				(uintptr_t)tr->data.ptr.buffer;
+	bool is_nested = false;
 
 	e = binder_transaction_log_add(&binder_transaction_log);
 	e->debug_id = t_debug_id;
@@ -2808,6 +2849,7 @@ static void binder_transaction(struct binder_proc *proc,
 					atomic_inc(&from->tmp_ref);
 					target_thread = from;
 					spin_unlock(&tmp->lock);
+					is_nested = true;
 					break;
 				}
 				spin_unlock(&tmp->lock);
@@ -2819,6 +2861,7 @@ static void binder_transaction(struct binder_proc *proc,
 	if (target_thread)
 		e->to_thread = target_thread->pid;
 	e->to_proc = target_proc->pid;
+	trace_android_rvh_binder_transaction(target_proc, proc, thread, tr);
 
 	/* TODO: reuse incoming transaction for reply */
 	t = kzalloc(sizeof(*t), GFP_KERNEL);
@@ -2872,6 +2915,7 @@ static void binder_transaction(struct binder_proc *proc,
 	t->to_thread = target_thread;
 	t->code = tr->code;
 	t->flags = tr->flags;
+	t->is_nested = is_nested;
 	if (!(t->flags & TF_ONE_WAY) &&
 	    binder_supported_policy(current->policy)) {
 		/* Inherit supported policies for synchronous transactions */
@@ -3242,9 +3286,15 @@ static void binder_transaction(struct binder_proc *proc,
 		binder_enqueue_thread_work_ilocked(target_thread, &t->work);
 		target_proc->outstanding_txns++;
 		binder_inner_proc_unlock(target_proc);
+		if (in_reply_to->is_nested) {
+			spin_lock(&thread->prio_lock);
+			thread->prio_state = BINDER_PRIO_PENDING;
+			thread->prio_next = in_reply_to->saved_priority;
+			spin_unlock(&thread->prio_lock);
+		}
 		wake_up_interruptible_sync(&target_thread->wait);
 		trace_android_vh_binder_restore_priority(in_reply_to, current);
-		binder_restore_priority(current, in_reply_to->saved_priority);
+		binder_restore_priority(thread, &in_reply_to->saved_priority);
 		binder_free_transaction(in_reply_to);
 	} else if (!(t->flags & TF_ONE_WAY)) {
 		BUG_ON(t->buffer->async_transaction != 0);
@@ -3360,7 +3410,7 @@ err_invalid_target_handle:
 	BUG_ON(thread->return_error.cmd != BR_OK);
 	if (in_reply_to) {
 		trace_android_vh_binder_restore_priority(in_reply_to, current);
-		binder_restore_priority(current, in_reply_to->saved_priority);
+		binder_restore_priority(thread, &in_reply_to->saved_priority);
 		thread->return_error.cmd = BR_TRANSACTION_COMPLETE;
 		binder_enqueue_thread_work(thread, &thread->return_error.work);
 		binder_send_failed_reply(in_reply_to, return_error);
@@ -4040,7 +4090,7 @@ retry:
 						 binder_stop_on_user_error < 2);
 		}
 		trace_android_vh_binder_restore_priority(NULL, current);
-		binder_restore_priority(current, proc->default_priority);
+		binder_restore_priority(thread, &proc->default_priority);
 	}
 
 	if (non_block) {
@@ -4267,14 +4317,10 @@ retry:
 		BUG_ON(t->buffer == NULL);
 		if (t->buffer->target_node) {
 			struct binder_node *target_node = t->buffer->target_node;
-			struct binder_priority node_prio;
 
 			trd->target.ptr = target_node->ptr;
 			trd->cookie =  target_node->cookie;
-			node_prio.sched_policy = target_node->sched_policy;
+			binder_transaction_priority(thread, t, target_node);
-			node_prio.prio = target_node->min_priority;
-			binder_transaction_priority(current, t, node_prio,
-						    target_node->inherit_rt);
 			cmd = BR_TRANSACTION;
 		} else {
 			trd->target.ptr = 0;
@@ -4505,6 +4551,8 @@ static struct binder_thread *binder_get_thread_ilocked(
 	thread->return_error.cmd = BR_OK;
 	thread->reply_error.work.type = BINDER_WORK_RETURN_ERROR;
 	thread->reply_error.cmd = BR_OK;
+	spin_lock_init(&thread->prio_lock);
+	thread->prio_state = BINDER_PRIO_SET;
 	INIT_LIST_HEAD(&new_thread->waiting_thread_node);
 	return thread;
 }
@@ -5580,6 +5628,7 @@ static void print_binder_transaction_ilocked(struct seq_file *m,
 	struct binder_buffer *buffer = t->buffer;
 
 	spin_lock(&t->lock);
+	trace_android_vh_binder_print_transaction_info(m, proc, prefix, t);
 	to_proc = t->to_proc;
 	seq_printf(m,
 		   "%s %d: %pK from %d:%d to %d:%d code %x flags %x pri %d:%d r%d",

drivers/android/binder_internal.h

@@ -367,6 +367,12 @@ struct binder_priority {
 	int prio;
 };
 
+enum binder_prio_state {
+	BINDER_PRIO_SET,	/* desired priority set */
+	BINDER_PRIO_PENDING,	/* initiated a saved priority restore */
+	BINDER_PRIO_ABORT,	/* abort the pending priority restore */
+};
+
 /**
  * struct binder_proc - binder process bookkeeping
  * @proc_node:            element for binder_procs list
@@ -511,6 +517,12 @@ struct binder_proc {
  *                        when outstanding transactions are cleaned up
  *                        (protected by @proc->inner_lock)
  * @task:                 struct task_struct for this thread
+ * @prio_lock:            protects thread priority fields
+ * @prio_next:            saved priority to be restored next
+ *                        (protected by @prio_lock)
+ * @prio_state:           state of the priority restore process as
+ *                        defined by enum binder_prio_state
+ *                        (protected by @prio_lock)
  *
  * Bookkeeping structure for binder threads.
  */
@@ -531,6 +543,9 @@ struct binder_thread {
 	atomic_t tmp_ref;
 	bool is_dead;
 	struct task_struct *task;
+	spinlock_t prio_lock;
+	struct binder_priority prio_next;
+	enum binder_prio_state prio_state;
 };
 
 /**
@@ -567,6 +582,7 @@ struct binder_transaction {
 	struct binder_priority priority;
 	struct binder_priority saved_priority;
 	bool set_priority_called;
+	bool is_nested;
 	kuid_t  sender_euid;
 	struct list_head fd_fixups;
 	binder_uintptr_t security_ctx;

drivers/android/vendor_hooks.c

@@ -29,6 +29,7 @@
 #include <trace/hooks/preemptirq.h>
 #include <trace/hooks/ftrace_dump.h>
 #include <trace/hooks/ufshcd.h>
+#include <trace/hooks/block.h>
 #include <trace/hooks/cgroup.h>
 #include <trace/hooks/sys.h>
 #include <trace/hooks/iommu.h>
@@ -63,6 +64,10 @@
 #include <trace/hooks/regmap.h>
 #include <trace/hooks/dmabuf.h>
 #include <trace/hooks/mmc.h>
+#include <trace/hooks/evdev.h>
+#include <trace/hooks/ipv4.h>
+#include <trace/hooks/signal.h>
+#include <trace/hooks/cfg80211.h>
 
 /*
  * Export tracepoints that act as a bare tracehook (ie: have no trace event
@@ -82,15 +87,22 @@ EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_prepare_prio_fork);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_finish_prio_fork);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_set_user_nice);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_setscheduler);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_sk_alloc);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_sk_free);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_nf_conn_alloc);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_nf_conn_free);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_arch_set_freq_scale);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_is_fpsimd_save);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_binder_transaction_init);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_binder_priority_skip);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_binder_set_priority);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_binder_restore_priority);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_binder_wakeup_ilocked);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_do_send_sig_info);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_alter_futex_plist_add);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_mutex_wait_start);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_mutex_wait_finish);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_mutex_init);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_rtmutex_wait_start);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_rtmutex_wait_finish);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_rwsem_read_wait_start);
@@ -184,6 +196,22 @@ EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_ufs_send_uic_command);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_ufs_send_tm_command);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_ufs_check_int_errors);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_ufs_update_sdev);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_ufs_clock_scaling);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_ufs_use_mcq_hooks);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_ufs_mcq_max_tag);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_ufs_mcq_map_tag);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_ufs_mcq_set_sqid);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_ufs_mcq_handler);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_ufs_mcq_make_hba_operational);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_ufs_mcq_hba_capabilities);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_ufs_mcq_print_trs);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_ufs_mcq_send_command);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_ufs_mcq_config);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_ufs_mcq_has_oustanding_reqs);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_ufs_mcq_get_outstanding_reqs);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_ufs_mcq_abort);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_ufs_mcq_clear_cmd);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_ufs_mcq_clear_pending);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_cgroup_attach);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_iommu_setup_dma_ops);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_iommu_iovad_alloc_iova);
@@ -200,6 +228,7 @@ EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_check_preempt_wakeup_ignore);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_replace_next_task_fair);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_do_sched_yield);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_binder_wait_for_work);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_binder_transaction);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_sync_txn_recvd);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_build_sched_domains);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_update_topology_flags_workfn);
@@ -213,7 +242,10 @@ EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_page_referenced_check_bypass);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_drain_all_pages_bypass);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_cma_drain_all_pages_bypass);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_pcplist_add_cma_pages_bypass);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_irqtime_account_process_tick);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_shrink_slab_bypass);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_free_task);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_dup_task_struct);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_after_enqueue_task);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_after_dequeue_task);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_enqueue_entity);
@@ -252,6 +284,13 @@ EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_check_uninterruptible_tasks);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_check_uninterruptible_tasks_dn);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_uclamp_eff_get);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_util_est_update);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_meminfo_proc_show);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_exit_mm);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_alloc_pages_slowpath);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_show_mem);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_print_slabinfo_header);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_do_shrink_slab);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_cache_show);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_setscheduler_uclamp);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_do_wake_up_sync);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_set_wake_flags);
@@ -277,6 +316,7 @@ EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_modify_thermal_target_freq);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_thermal_register);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_thermal_unregister);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_rproc_recovery_set);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_disable_thermal_cooling_stats);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_enable_thermal_power_throttle);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_rwsem_init);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_rwsem_wake);
@@ -299,5 +339,42 @@ EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_usb_new_device_added);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_force_compatible_pre);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_force_compatible_post);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_regmap_update);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_alter_mutex_list_add);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_mutex_unlock_slowpath);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_dma_buf_release);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_pass_input_event);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_mmc_check_status);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_blk_alloc_rqs);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_blk_rq_ctx_init);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_mmap_region);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_try_to_unmap_one);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_shrink_node_memcgs);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_mmc_sdio_pm_flag_set);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_account_task_time);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_tcp_sendmsg_locked);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_tcp_recvmsg);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_udp_sendmsg);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_udp_recvmsg);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_tcp_recvmsg_stat);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_tune_scan_type);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_tune_swappiness);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_partial_init);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_mmc_cache_card_properties);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_binder_print_transaction_info);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_handle_tlb_conf);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_memcgv2_init);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_memcgv2_calc_decayed_watermark);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_update_watermark);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_mmc_blk_reset);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_mmc_blk_mq_rw_recovery);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_sd_update_bus_speed_mode);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_mmc_attach_sd);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_sdhci_get_cd);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_mmc_gpio_cd_irqt);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_cfg80211_set_context);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_cfg80211_get_context);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_mem_cgroup_id_remove);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_mem_cgroup_css_offline);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_mem_cgroup_css_online);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_mem_cgroup_free);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_mem_cgroup_alloc);

drivers/base/devcoredump.c

@@ -25,6 +25,47 @@ struct devcd_entry {
 	struct device devcd_dev;
 	void *data;
 	size_t datalen;
+	/*
+	 * Here, mutex is required to serialize the calls to del_wk work between
+	 * user/kernel space which happens when devcd is added with device_add()
+	 * and that sends uevent to user space. User space reads the uevents,
+	 * and calls to devcd_data_write() which try to modify the work which is
+	 * not even initialized/queued from devcoredump.
+	 *
+	 *
+	 *
+	 *        cpu0(X)                                 cpu1(Y)
+	 *
+	 *        dev_coredump() uevent sent to user space
+	 *        device_add()  ======================> user space process Y reads the
+	 *                                              uevents writes to devcd fd
+	 *                                              which results into writes to
+	 *
+	 *                                             devcd_data_write()
+	 *                                               mod_delayed_work()
+	 *                                                 try_to_grab_pending()
+	 *                                                   del_timer()
+	 *                                                     debug_assert_init()
+	 *       INIT_DELAYED_WORK()
+	 *       schedule_delayed_work()
+	 *
+	 *
+	 * Also, mutex alone would not be enough to avoid scheduling of
+	 * del_wk work after it get flush from a call to devcd_free()
+	 * mentioned as below.
+	 *
+	 *	disabled_store()
+	 *        devcd_free()
+	 *          mutex_lock()             devcd_data_write()
+	 *          flush_delayed_work()
+	 *          mutex_unlock()
+	 *                                   mutex_lock()
+	 *                                   mod_delayed_work()
+	 *                                   mutex_unlock()
+	 * So, delete_work flag is required.
+	 */
+	struct mutex mutex;
+	bool delete_work;
 	struct module *owner;
 	ssize_t (*read)(char *buffer, loff_t offset, size_t count,
 			void *data, size_t datalen);
@@ -84,7 +125,12 @@ static ssize_t devcd_data_write(struct file *filp, struct kobject *kobj,
 	struct device *dev = kobj_to_dev(kobj);
 	struct devcd_entry *devcd = dev_to_devcd(dev);
 
-	mod_delayed_work(system_wq, &devcd->del_wk, 0);
+	mutex_lock(&devcd->mutex);
+	if (!devcd->delete_work) {
+		devcd->delete_work = true;
+		mod_delayed_work(system_wq, &devcd->del_wk, 0);
+	}
+	mutex_unlock(&devcd->mutex);
 
 	return count;
 }
@@ -112,7 +158,12 @@ static int devcd_free(struct device *dev, void *data)
 {
 	struct devcd_entry *devcd = dev_to_devcd(dev);
 
+	mutex_lock(&devcd->mutex);
+	if (!devcd->delete_work)
+		devcd->delete_work = true;
+
 	flush_delayed_work(&devcd->del_wk);
+	mutex_unlock(&devcd->mutex);
 	return 0;
 }
 
@@ -122,6 +173,30 @@ static ssize_t disabled_show(struct class *class, struct class_attribute *attr,
 	return sysfs_emit(buf, "%d\n", devcd_disabled);
 }
 
+/*
+ *
+ *	disabled_store()                                	worker()
+ *	 class_for_each_device(&devcd_class,
+ *		NULL, NULL, devcd_free)
+ *         ...
+ *         ...
+ *	   while ((dev = class_dev_iter_next(&iter))
+ *                                                             devcd_del()
+ *                                                               device_del()
+ *                                                                 put_device() <- last reference
+ *             error = fn(dev, data)                           devcd_dev_release()
+ *             devcd_free(dev, data)                           kfree(devcd)
+ *             mutex_lock(&devcd->mutex);
+ *
+ *
+ * In the above diagram, It looks like disabled_store() would be racing with parallely
+ * running devcd_del() and result in memory abort while acquiring devcd->mutex which
+ * is called after kfree of devcd memory  after dropping its last reference with
+ * put_device(). However, this will not happens as fn(dev, data) runs
+ * with its own reference to device via klist_node so it is not its last reference.
+ * so, above situation would not occur.
+ */
+
 static ssize_t disabled_store(struct class *class, struct class_attribute *attr,
 			      const char *buf, size_t count)
 {
@@ -278,13 +353,16 @@ void dev_coredumpm(struct device *dev, struct module *owner,
 	devcd->read = read;
 	devcd->free = free;
 	devcd->failing_dev = get_device(dev);
+	devcd->delete_work = false;
 
+	mutex_init(&devcd->mutex);
 	device_initialize(&devcd->devcd_dev);
 
 	dev_set_name(&devcd->devcd_dev, "devcd%d",
 		     atomic_inc_return(&devcd_count));
 	devcd->devcd_dev.class = &devcd_class;
 
+	mutex_lock(&devcd->mutex);
 	if (device_add(&devcd->devcd_dev))
 		goto put_device;
 
@@ -301,10 +379,11 @@ void dev_coredumpm(struct device *dev, struct module *owner,
 
 	INIT_DELAYED_WORK(&devcd->del_wk, devcd_del);
 	schedule_delayed_work(&devcd->del_wk, DEVCD_TIMEOUT);
-
+	mutex_unlock(&devcd->mutex);
 	return;
  put_device:
 	put_device(&devcd->devcd_dev);
+	mutex_unlock(&devcd->mutex);
  put_module:
 	module_put(owner);
  free:

drivers/dma-buf/dma-buf-sysfs-stats.c

@@ -11,6 +11,7 @@
 #include <linux/printk.h>
 #include <linux/slab.h>
 #include <linux/sysfs.h>
+#include <linux/workqueue.h>
 
 #include "dma-buf-sysfs-stats.h"
 
@@ -168,10 +169,46 @@ void dma_buf_uninit_sysfs_statistics(void)
 	kset_unregister(dma_buf_stats_kset);
 }
 
+static void sysfs_add_workfn(struct work_struct *work)
+{
+	struct dma_buf_sysfs_entry *sysfs_entry =
+		container_of(work, struct dma_buf_sysfs_entry, sysfs_add_work);
+	struct dma_buf *dmabuf = sysfs_entry->dmabuf;
+
+	/*
+	 * A dmabuf is ref-counted via its file member. If this handler holds the only
+	 * reference to the dmabuf, there is no need for sysfs kobject creation. This is an
+	 * optimization and a race; when the reference count drops to 1 immediately after
+	 * this check it is not harmful as the sysfs entry will still get cleaned up in
+	 * dma_buf_stats_teardown, which won't get called until the final dmabuf reference
+	 * is released, and that can't happen until the end of this function.
+	 */
+	if (file_count(dmabuf->file) > 1) {
+		/*
+		 * kobject_init_and_add expects kobject to be zero-filled, but we have populated it
+		 * (the sysfs_add_work union member) to trigger this work function.
+		 */
+		memset(&dmabuf->sysfs_entry->kobj, 0, sizeof(dmabuf->sysfs_entry->kobj));
+		dmabuf->sysfs_entry->kobj.kset = dma_buf_per_buffer_stats_kset;
+		if (kobject_init_and_add(&dmabuf->sysfs_entry->kobj, &dma_buf_ktype, NULL,
+						"%lu", file_inode(dmabuf->file)->i_ino)) {
+			kobject_put(&dmabuf->sysfs_entry->kobj);
+			dmabuf->sysfs_entry = NULL;
+		}
+	} else {
+		/*
+		 * Free the sysfs_entry and reset the pointer so dma_buf_stats_teardown doesn't
+		 * attempt to operate on it.
+		 */
+		kfree(dmabuf->sysfs_entry);
+		dmabuf->sysfs_entry = NULL;
+	}
+	dma_buf_put(dmabuf);
+}
+
 int dma_buf_stats_setup(struct dma_buf *dmabuf)
 {
 	struct dma_buf_sysfs_entry *sysfs_entry;
-	int ret;
 
 	if (!dmabuf || !dmabuf->file)
 		return -EINVAL;
@@ -181,25 +218,16 @@ int dma_buf_stats_setup(struct dma_buf *dmabuf)
 		return -EINVAL;
 	}
 
-	sysfs_entry = kzalloc(sizeof(struct dma_buf_sysfs_entry), GFP_KERNEL);
+	sysfs_entry = kmalloc(sizeof(struct dma_buf_sysfs_entry), GFP_KERNEL);
 	if (!sysfs_entry)
 		return -ENOMEM;
 
-	sysfs_entry->kobj.kset = dma_buf_per_buffer_stats_kset;
 	sysfs_entry->dmabuf = dmabuf;
-
 	dmabuf->sysfs_entry = sysfs_entry;
 
-	/* create the directory for buffer stats */
+	INIT_WORK(&dmabuf->sysfs_entry->sysfs_add_work, sysfs_add_workfn);
-	ret = kobject_init_and_add(&sysfs_entry->kobj, &dma_buf_ktype, NULL,
+	get_dma_buf(dmabuf); /* This reference will be dropped in sysfs_add_workfn. */
-				   "%lu", file_inode(dmabuf->file)->i_ino);
+	schedule_work(&dmabuf->sysfs_entry->sysfs_add_work);
-	if (ret)
-		goto err_sysfs_dmabuf;
 
 	return 0;
-
-err_sysfs_dmabuf:
-	kobject_put(&sysfs_entry->kobj);
-	dmabuf->sysfs_entry = NULL;
-	return ret;
 }

drivers/gpu/drm/armada/armada_gem.c

@@ -336,7 +336,7 @@ int armada_gem_pwrite_ioctl(struct drm_device *dev, void *data,
 	struct drm_armada_gem_pwrite *args = data;
 	struct armada_gem_object *dobj;
 	char __user *ptr;
-	int ret;
+	int ret = 0;
 
 	DRM_DEBUG_DRIVER("handle %u off %u size %u ptr 0x%llx\n",
 		args->handle, args->offset, args->size, args->ptr);
@@ -349,9 +349,8 @@ int armada_gem_pwrite_ioctl(struct drm_device *dev, void *data,
 	if (!access_ok(ptr, args->size))
 		return -EFAULT;
 
-	ret = fault_in_pages_readable(ptr, args->size);
+	if (fault_in_readable(ptr, args->size))
-	if (ret)
+		return -EFAULT;
-		return ret;
 
 	dobj = armada_gem_object_lookup(file, args->handle);
 	if (dobj == NULL)

drivers/input/evdev.c

@@ -24,6 +24,7 @@
 #include <linux/device.h>
 #include <linux/cdev.h>
 #include "input-compat.h"
+#include <trace/hooks/evdev.h>
 
 struct evdev {
 	int open;
@@ -214,6 +215,9 @@ static int evdev_set_clk_type(struct evdev_client *client, unsigned int clkid)
 static void __pass_event(struct evdev_client *client,
 			 const struct input_event *event)
 {
+	trace_android_vh_pass_input_event(client->head, client->tail, client->bufsize,
+		event->type, event->code, event->value);
+
 	client->buffer[client->head++] = *event;
 	client->head &= client->bufsize - 1;
 

drivers/iommu/io-pgtable-arm-v7s.c

@@ -182,14 +182,8 @@ static bool arm_v7s_is_mtk_enabled(struct io_pgtable_cfg *cfg)
 		(cfg->quirks & IO_PGTABLE_QUIRK_ARM_MTK_EXT);
 }
 
-static arm_v7s_iopte paddr_to_iopte(phys_addr_t paddr, int lvl,
+static arm_v7s_iopte to_mtk_iopte(phys_addr_t paddr, arm_v7s_iopte pte)
-				    struct io_pgtable_cfg *cfg)
 {
-	arm_v7s_iopte pte = paddr & ARM_V7S_LVL_MASK(lvl);
-
-	if (!arm_v7s_is_mtk_enabled(cfg))
-		return pte;
-
 	if (paddr & BIT_ULL(32))
 		pte |= ARM_V7S_ATTR_MTK_PA_BIT32;
 	if (paddr & BIT_ULL(33))
@@ -199,6 +193,17 @@ static arm_v7s_iopte paddr_to_iopte(phys_addr_t paddr, int lvl,
 	return pte;
 }
 
+static arm_v7s_iopte paddr_to_iopte(phys_addr_t paddr, int lvl,
+				    struct io_pgtable_cfg *cfg)
+{
+	arm_v7s_iopte pte = paddr & ARM_V7S_LVL_MASK(lvl);
+
+	if (arm_v7s_is_mtk_enabled(cfg))
+		return to_mtk_iopte(paddr, pte);
+
+	return pte;
+}
+
 static phys_addr_t iopte_to_paddr(arm_v7s_iopte pte, int lvl,
 				  struct io_pgtable_cfg *cfg)
 {
@@ -240,10 +245,17 @@ static void *__arm_v7s_alloc_table(int lvl, gfp_t gfp,
 	dma_addr_t dma;
 	size_t size = ARM_V7S_TABLE_SIZE(lvl, cfg);
 	void *table = NULL;
+	gfp_t gfp_l1;
+
+	/*
+	 * ARM_MTK_TTBR_EXT extend the translation table base support larger
+	 * memory address.
+	 */
+	gfp_l1 = cfg->quirks & IO_PGTABLE_QUIRK_ARM_MTK_TTBR_EXT ?
+		 GFP_KERNEL : ARM_V7S_TABLE_GFP_DMA;
 
 	if (lvl == 1)
-		table = (void *)__get_free_pages(
+		table = (void *)__get_free_pages(gfp_l1 | __GFP_ZERO, get_order(size));
-			__GFP_ZERO | ARM_V7S_TABLE_GFP_DMA, get_order(size));
 	else if (lvl == 2)
 		table = kmem_cache_zalloc(data->l2_tables, gfp);
 
@@ -251,7 +263,8 @@ static void *__arm_v7s_alloc_table(int lvl, gfp_t gfp,
 		return NULL;
 
 	phys = virt_to_phys(table);
-	if (phys != (arm_v7s_iopte)phys) {
+	if (cfg->quirks & IO_PGTABLE_QUIRK_ARM_MTK_TTBR_EXT ?
+	    phys >= (1ULL << cfg->oas) : phys != (arm_v7s_iopte)phys) {
 		/* Doesn't fit in PTE */
 		dev_err(dev, "Page table does not fit in PTE: %pa", &phys);
 		goto out_free;
@@ -457,9 +470,14 @@ static arm_v7s_iopte arm_v7s_install_table(arm_v7s_iopte *table,
 					   arm_v7s_iopte curr,
 					   struct io_pgtable_cfg *cfg)
 {
+	phys_addr_t phys = virt_to_phys(table);
 	arm_v7s_iopte old, new;
 
-	new = virt_to_phys(table) | ARM_V7S_PTE_TYPE_TABLE;
+	new = phys | ARM_V7S_PTE_TYPE_TABLE;
+
+	if (cfg->quirks & IO_PGTABLE_QUIRK_ARM_MTK_TTBR_EXT)
+		new = to_mtk_iopte(phys, new);
+
 	if (cfg->quirks & IO_PGTABLE_QUIRK_ARM_NS)
 		new |= ARM_V7S_ATTR_NS_TABLE;
 
@@ -779,6 +797,8 @@ static struct io_pgtable *arm_v7s_alloc_pgtable(struct io_pgtable_cfg *cfg,
 						void *cookie)
 {
 	struct arm_v7s_io_pgtable *data;
+	slab_flags_t slab_flag;
+	phys_addr_t paddr;
 
 	if (cfg->ias > (arm_v7s_is_mtk_enabled(cfg) ? 34 : ARM_V7S_ADDR_BITS))
 		return NULL;
@@ -788,7 +808,8 @@ static struct io_pgtable *arm_v7s_alloc_pgtable(struct io_pgtable_cfg *cfg,
 
 	if (cfg->quirks & ~(IO_PGTABLE_QUIRK_ARM_NS |
 			    IO_PGTABLE_QUIRK_NO_PERMS |
-			    IO_PGTABLE_QUIRK_ARM_MTK_EXT))
+			    IO_PGTABLE_QUIRK_ARM_MTK_EXT |
+			    IO_PGTABLE_QUIRK_ARM_MTK_TTBR_EXT))
 		return NULL;
 
 	/* If ARM_MTK_4GB is enabled, the NO_PERMS is also expected. */
@@ -796,15 +817,27 @@ static struct io_pgtable *arm_v7s_alloc_pgtable(struct io_pgtable_cfg *cfg,
 	    !(cfg->quirks & IO_PGTABLE_QUIRK_NO_PERMS))
 			return NULL;
 
+	if ((cfg->quirks & IO_PGTABLE_QUIRK_ARM_MTK_TTBR_EXT) &&
+	    !arm_v7s_is_mtk_enabled(cfg))
+		return NULL;
+
 	data = kmalloc(sizeof(*data), GFP_KERNEL);
 	if (!data)
 		return NULL;
 
 	spin_lock_init(&data->split_lock);
+
+	/*
+	 * ARM_MTK_TTBR_EXT extend the translation table base support larger
+	 * memory address.
+	 */
+	slab_flag = cfg->quirks & IO_PGTABLE_QUIRK_ARM_MTK_TTBR_EXT ?
+		    0 : ARM_V7S_TABLE_SLAB_FLAGS;
+
 	data->l2_tables = kmem_cache_create("io-pgtable_armv7s_l2",
 					    ARM_V7S_TABLE_SIZE(2, cfg),
 					    ARM_V7S_TABLE_SIZE(2, cfg),
-					    ARM_V7S_TABLE_SLAB_FLAGS, NULL);
+					    slab_flag, NULL);
 	if (!data->l2_tables)
 		goto out_free_data;
 
@@ -850,12 +883,18 @@ static struct io_pgtable *arm_v7s_alloc_pgtable(struct io_pgtable_cfg *cfg,
 	wmb();
 
 	/* TTBR */
-	cfg->arm_v7s_cfg.ttbr = virt_to_phys(data->pgd) | ARM_V7S_TTBR_S |
+	paddr = virt_to_phys(data->pgd);
+	cfg->arm_v7s_cfg.ttbr = paddr | ARM_V7S_TTBR_S |
 				(cfg->coherent_walk ? (ARM_V7S_TTBR_NOS |
 				 ARM_V7S_TTBR_IRGN_ATTR(ARM_V7S_RGN_WBWA) |
 				 ARM_V7S_TTBR_ORGN_ATTR(ARM_V7S_RGN_WBWA)) :
 				(ARM_V7S_TTBR_IRGN_ATTR(ARM_V7S_RGN_NC) |
 				 ARM_V7S_TTBR_ORGN_ATTR(ARM_V7S_RGN_NC)));
+
+	if (cfg->quirks & IO_PGTABLE_QUIRK_ARM_MTK_TTBR_EXT)
+		cfg->arm_v7s_cfg.ttbr = (paddr & GENMASK(31, 7)) |
+					 upper_32_bits(paddr);
+
 	return &data->iop;
 
 out_free_data:

drivers/iommu/mtk_iommu.c

@@ -118,6 +118,7 @@
 #define WR_THROT_EN			BIT(6)
 #define HAS_LEGACY_IVRP_PADDR		BIT(7)
 #define IOVA_34_EN			BIT(8)
+#define PGTABLE_PA_35_EN		BIT(9)
 
 #define MTK_IOMMU_HAS_FLAG(pdata, _x) \
 		((((pdata)->flags) & (_x)) == (_x))
@@ -125,6 +126,7 @@
 struct mtk_iommu_domain {
 	struct io_pgtable_cfg		cfg;
 	struct io_pgtable_ops		*iop;
+	u32				ttbr;
 
 	struct mtk_iommu_data		*data;
 	struct iommu_domain		domain;
@@ -393,6 +395,7 @@ static int mtk_iommu_domain_finalise(struct mtk_iommu_domain *dom,
 	if (data->m4u_dom) {
 		dom->iop = data->m4u_dom->iop;
 		dom->cfg = data->m4u_dom->cfg;
+		dom->ttbr = data->m4u_dom->ttbr;
 		dom->domain.pgsize_bitmap = data->m4u_dom->cfg.pgsize_bitmap;
 		goto update_iova_region;
 	}
@@ -406,6 +409,9 @@ static int mtk_iommu_domain_finalise(struct mtk_iommu_domain *dom,
 		.iommu_dev = data->dev,
 	};
 
+	if (MTK_IOMMU_HAS_FLAG(data->plat_data, PGTABLE_PA_35_EN))
+		dom->cfg.quirks |= IO_PGTABLE_QUIRK_ARM_MTK_TTBR_EXT;
+
 	if (MTK_IOMMU_HAS_FLAG(data->plat_data, HAS_4GB_MODE))
 		dom->cfg.oas = data->enable_4GB ? 33 : 32;
 	else
@@ -416,6 +422,9 @@ static int mtk_iommu_domain_finalise(struct mtk_iommu_domain *dom,
 		dev_err(data->dev, "Failed to alloc io pgtable\n");
 		return -EINVAL;
 	}
+	dom->ttbr = dom->cfg.quirks & IO_PGTABLE_QUIRK_ARM_MTK_TTBR_EXT ?
+		    dom->cfg.arm_v7s_cfg.ttbr :
+		    dom->cfg.arm_v7s_cfg.ttbr & MMU_PT_ADDR_MASK;
 
 	/* Update our support page sizes bitmap */
 	dom->domain.pgsize_bitmap = dom->cfg.pgsize_bitmap;
@@ -477,8 +486,7 @@ static int mtk_iommu_attach_device(struct iommu_domain *domain,
 			return ret;
 		}
 		data->m4u_dom = dom;
-		writel(dom->cfg.arm_v7s_cfg.ttbr & MMU_PT_ADDR_MASK,
+		writel(data->m4u_dom->ttbr, data->base + REG_MMU_PT_BASE_ADDR);
-		       data->base + REG_MMU_PT_BASE_ADDR);
 
 		pm_runtime_put(m4udev);
 	}
@@ -1009,7 +1017,7 @@ static int __maybe_unused mtk_iommu_runtime_resume(struct device *dev)
 	writel_relaxed(reg->int_main_control, base + REG_MMU_INT_MAIN_CONTROL);
 	writel_relaxed(reg->ivrp_paddr, base + REG_MMU_IVRP_PADDR);
 	writel_relaxed(reg->vld_pa_rng, base + REG_MMU_VLD_PA_RNG);
-	writel(m4u_dom->cfg.arm_v7s_cfg.ttbr & MMU_PT_ADDR_MASK, base + REG_MMU_PT_BASE_ADDR);
+	writel(m4u_dom->ttbr, base + REG_MMU_PT_BASE_ADDR);
 	return 0;
 }
 
@@ -1030,7 +1038,8 @@ static const struct mtk_iommu_plat_data mt2712_data = {
 
 static const struct mtk_iommu_plat_data mt6779_data = {
 	.m4u_plat      = M4U_MT6779,
-	.flags         = HAS_SUB_COMM | OUT_ORDER_WR_EN | WR_THROT_EN,
+	.flags         = HAS_SUB_COMM | OUT_ORDER_WR_EN | WR_THROT_EN |
+			 PGTABLE_PA_35_EN,
 	.inv_sel_reg   = REG_MMU_INV_SEL_GEN2,
 	.iova_region   = single_domain,
 	.iova_region_nr = ARRAY_SIZE(single_domain),

drivers/irqchip/irq-gic-v3.c

@@ -1273,7 +1273,9 @@ static int gic_set_affinity(struct irq_data *d, const struct cpumask *mask_val,
 	reg = gic_dist_base(d) + offset + (index * 8);
 	val = gic_mpidr_to_affinity(cpu_logical_map(cpu));
 
-	trace_android_rvh_gic_v3_set_affinity(d, mask_val, &val, force, gic_dist_base(d));
+	trace_android_rvh_gic_v3_set_affinity(d, mask_val, &val, force, gic_dist_base(d),
+					gic_data.redist_regions[0].redist_base,
+					gic_data.redist_stride);
 	gic_write_irouter(val, reg);
 
 	/*

drivers/media/usb/uvc/uvc_driver.c

@@ -155,6 +155,11 @@ static struct uvc_format_desc uvc_fmts[] = {
 		.guid		= UVC_GUID_FORMAT_H264,
 		.fcc		= V4L2_PIX_FMT_H264,
 	},
+	{
+		.name		= "H.265",
+		.guid		= UVC_GUID_FORMAT_H265,
+		.fcc		= V4L2_PIX_FMT_HEVC,
+	},
 	{
 		.name		= "Greyscale 8 L/R (Y8I)",
 		.guid		= UVC_GUID_FORMAT_Y8I,

drivers/media/usb/uvc/uvcvideo.h

@@ -139,6 +139,9 @@
 #define UVC_GUID_FORMAT_H264 \
 	{ 'H',  '2',  '6',  '4', 0x00, 0x00, 0x10, 0x00, \
 	 0x80, 0x00, 0x00, 0xaa, 0x00, 0x38, 0x9b, 0x71}
+#define UVC_GUID_FORMAT_H265 \
+	{ 'H',  '2',  '6',  '5', 0x00, 0x00, 0x10, 0x00, \
+	 0x80, 0x00, 0x00, 0xaa, 0x00, 0x38, 0x9b, 0x71}
 #define UVC_GUID_FORMAT_Y8I \
 	{ 'Y',  '8',  'I',  ' ', 0x00, 0x00, 0x10, 0x00, \
 	 0x80, 0x00, 0x00, 0xaa, 0x00, 0x38, 0x9b, 0x71}

drivers/mmc/core/block.c

@@ -49,6 +49,8 @@
 
 #include <linux/uaccess.h>
 
+#include <trace/hooks/mmc.h>
+
 #include "queue.h"
 #include "block.h"
 #include "core.h"
@@ -1009,6 +1011,8 @@ static int mmc_blk_reset(struct mmc_blk_data *md, struct mmc_host *host,
 			 */
 			return -ENODEV;
 		}
+
+		trace_android_vh_mmc_blk_reset(host, err);
 	}
 	return err;
 }
@@ -1480,10 +1484,9 @@ void mmc_blk_cqe_recovery(struct mmc_queue *mq)
 	pr_debug("%s: CQE recovery start\n", mmc_hostname(host));
 
 	err = mmc_cqe_recovery(host);
-	if (err)
+	if (err || host->cqe_recovery_reset_always)
 		mmc_blk_reset(mq->blkdata, host, MMC_BLK_CQE_RECOVERY);
-	else
+	mmc_blk_reset_success(mq->blkdata, MMC_BLK_CQE_RECOVERY);
-		mmc_blk_reset_success(mq->blkdata, MMC_BLK_CQE_RECOVERY);
 
 	pr_debug("%s: CQE recovery done\n", mmc_hostname(host));
 }
@@ -1839,6 +1842,7 @@ static void mmc_blk_mq_rw_recovery(struct mmc_queue *mq, struct request *req)
 	    err && mmc_blk_reset(md, card->host, type)) {
 		pr_err("%s: recovery failed!\n", req->rq_disk->disk_name);
 		mqrq->retries = MMC_NO_RETRIES;
+		trace_android_vh_mmc_blk_mq_rw_recovery(card);
 		return;
 	}
 

drivers/mmc/core/core.c

@@ -944,12 +944,15 @@ int mmc_execute_tuning(struct mmc_card *card)
 	}
 
 	/* Only print error when we don't check for card removal */
-	if (!host->detect_change)
+	if (!host->detect_change) {
 		pr_err("%s: tuning execution failed: %d\n",
 			mmc_hostname(host), err);
+		mmc_debugfs_err_stats_inc(host, MMC_ERR_TUNING);
+	}
 
 	return err;
 }
+EXPORT_SYMBOL_GPL(mmc_execute_tuning);
 
 /*
  * Change the bus mode (open drain/push-pull) of a host.
@@ -959,6 +962,7 @@ void mmc_set_bus_mode(struct mmc_host *host, unsigned int mode)
 	host->ios.bus_mode = mode;
 	mmc_set_ios(host);
 }
+EXPORT_SYMBOL_GPL(mmc_set_bus_mode);
 
 /*
  * Change data bus width of a host.
@@ -968,6 +972,7 @@ void mmc_set_bus_width(struct mmc_host *host, unsigned int width)
 	host->ios.bus_width = width;
 	mmc_set_ios(host);
 }
+EXPORT_SYMBOL_GPL(mmc_set_bus_width);
 
 /*
  * Set initial state after a power cycle or a hw_reset.
@@ -2245,6 +2250,12 @@ void mmc_rescan(struct work_struct *work)
 		if (freqs[i] <= host->f_min)
 			break;
 	}
+
+	/*
+	 * Ignore the command timeout errors observed during
+	 * the card init as those are excepted.
+	 */
+	host->err_stats[MMC_ERR_CMD_TIMEOUT] = 0;
 	mmc_release_host(host);
 
  out:

drivers/mmc/core/debugfs.c

@@ -223,6 +223,77 @@ static int mmc_clock_opt_set(void *data, u64 val)
 DEFINE_DEBUGFS_ATTRIBUTE(mmc_clock_fops, mmc_clock_opt_get, mmc_clock_opt_set,
 	"%llu\n");
 
+static int mmc_err_state_get(void *data, u64 *val)
+{
+	struct mmc_host *host = data;
+	int i;
+
+	*val = 0;
+	for (i = 0; i < ARRAY_SIZE(host->err_stats); i++) {
+		if (host->err_stats[i]) {
+			*val = 1;
+			break;
+		}
+	}
+
+	return 0;
+}
+
+DEFINE_DEBUGFS_ATTRIBUTE(mmc_err_state, mmc_err_state_get, NULL, "%llu\n");
+
+static int mmc_err_stats_show(struct seq_file *file, void *data)
+{
+	struct mmc_host *host = (struct mmc_host *)file->private;
+	static const char *desc[MMC_ERR_MAX] = {
+		[MMC_ERR_CMD_TIMEOUT] = "Command Timeout Occurred",
+		[MMC_ERR_CMD_CRC] = "Command CRC Errors Occurred",
+		[MMC_ERR_DAT_TIMEOUT] = "Data Timeout Occurred",
+		[MMC_ERR_DAT_CRC] = "Data CRC Errors Occurred",
+		[MMC_ERR_AUTO_CMD] = "Auto-Cmd Error Occurred",
+		[MMC_ERR_ADMA] = "ADMA Error Occurred",
+		[MMC_ERR_TUNING] = "Tuning Error Occurred",
+		[MMC_ERR_CMDQ_RED] = "CMDQ RED Errors",
+		[MMC_ERR_CMDQ_GCE] = "CMDQ GCE Errors",
+		[MMC_ERR_CMDQ_ICCE] = "CMDQ ICCE Errors",
+		[MMC_ERR_REQ_TIMEOUT] = "Request Timedout",
+		[MMC_ERR_CMDQ_REQ_TIMEOUT] = "CMDQ Request Timedout",
+		[MMC_ERR_ICE_CFG] = "ICE Config Errors",
+		[MMC_ERR_CTRL_TIMEOUT] = "Controller Timedout errors",
+		[MMC_ERR_UNEXPECTED_IRQ] = "Unexpected IRQ errors",
+	};
+	int i;
+
+	for (i = 0; i < ARRAY_SIZE(desc); i++) {
+		if (desc[i])
+			seq_printf(file, "# %s:\t %d\n",
+					desc[i], host->err_stats[i]);
+	}
+
+	return 0;
+}
+
+static int mmc_err_stats_open(struct inode *inode, struct file *file)
+{
+	return single_open(file, mmc_err_stats_show, inode->i_private);
+}
+
+static ssize_t mmc_err_stats_write(struct file *filp, const char __user *ubuf,
+				   size_t cnt, loff_t *ppos)
+{
+	struct mmc_host *host = filp->f_mapping->host->i_private;
+
+	pr_debug("%s: Resetting MMC error statistics\n", __func__);
+	memset(host->err_stats, 0, sizeof(host->err_stats));
+
+	return cnt;
+}
+
+static const struct file_operations mmc_err_stats_fops = {
+	.open	= mmc_err_stats_open,
+	.read	= seq_read,
+	.write	= mmc_err_stats_write,
+};
+
 void mmc_add_host_debugfs(struct mmc_host *host)
 {
 	struct dentry *root;
@@ -236,6 +307,11 @@ void mmc_add_host_debugfs(struct mmc_host *host)
 	debugfs_create_file_unsafe("clock", S_IRUSR | S_IWUSR, root, host,
 				   &mmc_clock_fops);
 
+	debugfs_create_file("err_state", 0600, root, host,
+			    &mmc_err_state);
+	debugfs_create_file("err_stats", 0600, root, host,
+			    &mmc_err_stats_fops);
+
 #ifdef CONFIG_FAIL_MMC_REQUEST
 	if (fail_request)
 		setup_fault_attr(&fail_default_attr, fail_request);

drivers/mmc/core/host.c

@@ -166,6 +166,7 @@ void mmc_retune_hold(struct mmc_host *host)
 		host->retune_now = 1;
 	host->hold_retune += 1;
 }
+EXPORT_SYMBOL(mmc_retune_hold);
 
 void mmc_retune_release(struct mmc_host *host)
 {

drivers/mmc/core/mmc.c

@@ -16,6 +16,7 @@
 #include <linux/mmc/host.h>
 #include <linux/mmc/card.h>
 #include <linux/mmc/mmc.h>
+#include <trace/hooks/mmc.h>
 
 #include "core.h"
 #include "card.h"
@@ -1227,6 +1228,14 @@ int mmc_select_hs400(struct mmc_card *card)
 	mmc_set_timing(host, MMC_TIMING_MMC_HS400);
 	mmc_set_bus_speed(card);
 
+	if (host->ops->execute_hs400_tuning) {
+		mmc_retune_disable(host);
+		err = host->ops->execute_hs400_tuning(host, card);
+		mmc_retune_enable(host);
+		if (err)
+			goto out_err;
+	}
+
 	if (host->ops->hs400_complete)
 		host->ops->hs400_complete(host);
 
@@ -2098,9 +2107,10 @@ static int _mmc_suspend(struct mmc_host *host, bool is_suspend)
 	    ((host->caps2 & MMC_CAP2_FULL_PWR_CYCLE) || !is_suspend ||
 	     (host->caps2 & MMC_CAP2_FULL_PWR_CYCLE_IN_SUSPEND)))
 		err = mmc_poweroff_notify(host->card, notify_type);
-	else if (mmc_can_sleep(host->card))
+	else if (mmc_can_sleep(host->card)) {
+		trace_android_rvh_mmc_cache_card_properties(host);
 		err = mmc_sleep(host);
-	else if (!mmc_host_is_spi(host))
+	} else if (!mmc_host_is_spi(host))
 		err = mmc_deselect_cards(host);
 
 	if (!err) {
@@ -2135,6 +2145,7 @@ static int mmc_suspend(struct mmc_host *host)
 static int _mmc_resume(struct mmc_host *host)
 {
 	int err = 0;
+	bool partial_init = false;
 
 	mmc_claim_host(host);
 
@@ -2142,7 +2153,9 @@ static int _mmc_resume(struct mmc_host *host)
 		goto out;
 
 	mmc_power_up(host, host->card->ocr);
-	err = mmc_init_card(host, host->card->ocr, host->card);
+	trace_android_rvh_partial_init(host, &partial_init);
+	if (!partial_init)
+		err = mmc_init_card(host, host->card->ocr, host->card);
 	mmc_card_clr_suspended(host->card);
 
 out:

drivers/mmc/core/mmc_ops.c

@@ -110,6 +110,7 @@ int mmc_select_card(struct mmc_card *card)
 
 	return _mmc_select_card(card->host, card);
 }
+EXPORT_SYMBOL_GPL(mmc_select_card);
 
 int mmc_deselect_cards(struct mmc_host *host)
 {
@@ -545,6 +546,7 @@ bool mmc_prepare_busy_cmd(struct mmc_host *host, struct mmc_command *cmd,
 	cmd->busy_timeout = timeout_ms;
 	return true;
 }
+EXPORT_SYMBOL_GPL(mmc_prepare_busy_cmd);
 
 /**
  *	__mmc_switch - modify EXT_CSD register

drivers/mmc/core/mmc_ops.h

@@ -38,7 +38,6 @@ int mmc_spi_read_ocr(struct mmc_host *host, int highcap, u32 *ocrp);
 int mmc_spi_set_crc(struct mmc_host *host, int use_crc);
 int mmc_bus_test(struct mmc_card *card, u8 bus_width);
 int mmc_can_ext_csd(struct mmc_card *card);
-int mmc_get_ext_csd(struct mmc_card *card, u8 **new_ext_csd);
 int mmc_switch_status(struct mmc_card *card, bool crc_err_fatal);
 bool mmc_prepare_busy_cmd(struct mmc_host *host, struct mmc_command *cmd,
 			  unsigned int timeout_ms);

drivers/mmc/core/sd.c

@@ -18,6 +18,8 @@
 #include <linux/mmc/mmc.h>
 #include <linux/mmc/sd.h>
 
+#include <trace/hooks/mmc.h>
+
 #include "core.h"
 #include "card.h"
 #include "host.h"
@@ -472,6 +474,8 @@ static void sd_update_bus_speed_mode(struct mmc_card *card)
 		    SD_MODE_UHS_SDR12)) {
 			card->sd_bus_speed = UHS_SDR12_BUS_SPEED;
 	}
+
+	trace_android_vh_sd_update_bus_speed_mode(card);
 }
 
 static int sd_set_bus_speed_mode(struct mmc_card *card, u8 *status)
@@ -1874,5 +1878,7 @@ err:
 	pr_err("%s: error %d whilst initialising SD card\n",
 		mmc_hostname(host), err);
 
+	trace_android_vh_mmc_attach_sd(host, ocr, err);
+
 	return err;
 }

drivers/mmc/core/sdio.c

@@ -15,6 +15,8 @@
 #include <linux/mmc/sdio_func.h>
 #include <linux/mmc/sdio_ids.h>
 
+#include <trace/hooks/mmc.h>
+
 #include "core.h"
 #include "card.h"
 #include "host.h"
@@ -1094,6 +1096,8 @@ out:
 	mmc_release_host(host);
 
 	host->pm_flags &= ~MMC_PM_KEEP_POWER;
+	trace_android_vh_mmc_sdio_pm_flag_set(host);
+
 	return err;
 }
 

drivers/mmc/core/slot-gpio.c

@@ -14,6 +14,8 @@
 #include <linux/module.h>
 #include <linux/slab.h>
 
+#include <trace/hooks/mmc.h>
+
 #include "slot-gpio.h"
 
 struct mmc_gpio {
@@ -30,6 +32,11 @@ static irqreturn_t mmc_gpio_cd_irqt(int irq, void *dev_id)
 	/* Schedule a card detection after a debounce timeout */
 	struct mmc_host *host = dev_id;
 	struct mmc_gpio *ctx = host->slot.handler_priv;
+	bool allow = true;
+
+	trace_android_vh_mmc_gpio_cd_irqt(host, &allow);
+	if (!allow)
+		return IRQ_HANDLED;
 
 	host->trigger_card_event = true;
 	mmc_detect_change(host, msecs_to_jiffies(ctx->cd_debounce_delay_ms));

drivers/mmc/host/cqhci-core.c

@@ -822,8 +822,15 @@ irqreturn_t cqhci_irq(struct mmc_host *mmc, u32 intmask, int cmd_error,
 	pr_debug("%s: cqhci: IRQ status: 0x%08x\n", mmc_hostname(mmc), status);
 
 	if ((status & (CQHCI_IS_RED | CQHCI_IS_GCE | CQHCI_IS_ICCE)) ||
-	    cmd_error || data_error)
+	    cmd_error || data_error) {
+		if (status & CQHCI_IS_RED)
+			mmc_debugfs_err_stats_inc(mmc, MMC_ERR_CMDQ_RED);
+		if (status & CQHCI_IS_GCE)
+			mmc_debugfs_err_stats_inc(mmc, MMC_ERR_CMDQ_GCE);
+		if (status & CQHCI_IS_ICCE)
+			mmc_debugfs_err_stats_inc(mmc, MMC_ERR_CMDQ_ICCE);
 		cqhci_error_irq(mmc, status, cmd_error, data_error);
+	}
 
 	if (status & CQHCI_IS_TCC) {
 		/* read TCN and complete the request */

drivers/mmc/host/mtk-sd.c

@@ -259,6 +259,7 @@
 #define MSDC_PAD_TUNE_RD_SEL	  (0x1 << 13)   /* RW */
 #define MSDC_PAD_TUNE_CMD_SEL	  (0x1 << 21)   /* RW */
 
+#define PAD_DS_TUNE_DLY_SEL       (0x1 << 0)	/* RW */
 #define PAD_DS_TUNE_DLY1	  (0x1f << 2)   /* RW */
 #define PAD_DS_TUNE_DLY2	  (0x1f << 7)   /* RW */
 #define PAD_DS_TUNE_DLY3	  (0x1f << 12)  /* RW */
@@ -302,6 +303,11 @@
 #define PAD_CMD_RD_RXDLY_SEL    (0x1 << 11)     /* RW */
 #define PAD_CMD_TX_DLY          (0x1f << 12)    /* RW */
 
+/* EMMC50_PAD_DS_TUNE mask */
+#define PAD_DS_DLY_SEL		(0x1 << 16)	/* RW */
+#define PAD_DS_DLY1		(0x1f << 10)	/* RW */
+#define PAD_DS_DLY3		(0x1f << 0)	/* RW */
+
 #define REQ_CMD_EIO  (0x1 << 0)
 #define REQ_CMD_TMO  (0x1 << 1)
 #define REQ_DAT_ERR  (0x1 << 2)
@@ -449,11 +455,13 @@ struct msdc_host {
 	bool vqmmc_enabled;
 	u32 latch_ck;
 	u32 hs400_ds_delay;
+	u32 hs400_ds_dly3;
 	u32 hs200_cmd_int_delay; /* cmd internal delay for HS200/SDR104 */
 	u32 hs400_cmd_int_delay; /* cmd internal delay for HS400 */
 	bool hs400_cmd_resp_sel_rising;
 				 /* cmd response sample selection for HS400 */
 	bool hs400_mode;	/* current eMMC will run at hs400 mode */
+	bool hs400_tuning;	/* hs400 mode online tuning */
 	bool internal_cd;	/* Use internal card-detect logic */
 	bool cqhci;		/* support eMMC hw cmdq */
 	struct msdc_save_para save_para; /* used when gate HCLK */
@@ -1191,7 +1199,8 @@ static bool msdc_cmd_done(struct msdc_host *host, int events,
 	if (!sbc_error && !(events & MSDC_INT_CMDRDY)) {
 		if (events & MSDC_INT_CMDTMO ||
 		    (cmd->opcode != MMC_SEND_TUNING_BLOCK &&
-		     cmd->opcode != MMC_SEND_TUNING_BLOCK_HS200))
+		     cmd->opcode != MMC_SEND_TUNING_BLOCK_HS200 &&
+		     !host->hs400_tuning))
 			/*
 			 * should not clear fifo/interrupt as the tune data
 			 * may have alreay come when cmd19/cmd21 gets response
@@ -1286,7 +1295,8 @@ static void msdc_cmd_next(struct msdc_host *host,
 	if ((cmd->error &&
 	    !(cmd->error == -EILSEQ &&
 	      (cmd->opcode == MMC_SEND_TUNING_BLOCK ||
-	       cmd->opcode == MMC_SEND_TUNING_BLOCK_HS200))) ||
+	       cmd->opcode == MMC_SEND_TUNING_BLOCK_HS200 ||
+	       host->hs400_tuning))) ||
 	    (mrq->sbc && mrq->sbc->error))
 		msdc_request_done(host, mrq);
 	else if (cmd == mrq->sbc)
@@ -2258,6 +2268,67 @@ static int msdc_prepare_hs400_tuning(struct mmc_host *mmc, struct mmc_ios *ios)
 	return 0;
 }
 
+static int msdc_execute_hs400_tuning(struct mmc_host *mmc, struct mmc_card *card)
+{
+	struct msdc_host *host = mmc_priv(mmc);
+	struct msdc_delay_phase dly1_delay;
+	u32 val, result_dly1 = 0;
+	u8 *ext_csd;
+	int i, ret;
+
+	if (host->top_base) {
+		sdr_set_bits(host->top_base + EMMC50_PAD_DS_TUNE,
+			     PAD_DS_DLY_SEL);
+		if (host->hs400_ds_dly3)
+			sdr_set_field(host->top_base + EMMC50_PAD_DS_TUNE,
+				      PAD_DS_DLY3, host->hs400_ds_dly3);
+	} else {
+		sdr_set_bits(host->base + PAD_DS_TUNE, PAD_DS_TUNE_DLY_SEL);
+		if (host->hs400_ds_dly3)
+			sdr_set_field(host->base + PAD_DS_TUNE,
+				      PAD_DS_TUNE_DLY3, host->hs400_ds_dly3);
+	}
+
+	host->hs400_tuning = true;
+	for (i = 0; i < PAD_DELAY_MAX; i++) {
+		if (host->top_base)
+			sdr_set_field(host->top_base + EMMC50_PAD_DS_TUNE,
+				      PAD_DS_DLY1, i);
+		else
+			sdr_set_field(host->base + PAD_DS_TUNE,
+				      PAD_DS_TUNE_DLY1, i);
+		ret = mmc_get_ext_csd(card, &ext_csd);
+		if (!ret)
+			result_dly1 |= (1 << i);
+	}
+	host->hs400_tuning = false;
+
+	dly1_delay = get_best_delay(host, result_dly1);
+	if (dly1_delay.maxlen == 0) {
+		dev_err(host->dev, "Failed to get DLY1 delay!\n");
+		goto fail;
+	}
+	if (host->top_base)
+		sdr_set_field(host->top_base + EMMC50_PAD_DS_TUNE,
+			      PAD_DS_DLY1, dly1_delay.final_phase);
+	else
+		sdr_set_field(host->base + PAD_DS_TUNE,
+			      PAD_DS_TUNE_DLY1, dly1_delay.final_phase);
+
+	if (host->top_base)
+		val = readl(host->top_base + EMMC50_PAD_DS_TUNE);
+	else
+		val = readl(host->base + PAD_DS_TUNE);
+
+	dev_info(host->dev, "Fianl PAD_DS_TUNE: 0x%x\n", val);
+
+	return 0;
+
+fail:
+	dev_err(host->dev, "Failed to tuning DS pin delay!\n");
+	return -EIO;
+}
+
 static void msdc_hw_reset(struct mmc_host *mmc)
 {
 	struct msdc_host *host = mmc_priv(mmc);
@@ -2388,6 +2459,7 @@ static const struct mmc_host_ops mt_msdc_ops = {
 	.card_busy = msdc_card_busy,
 	.execute_tuning = msdc_execute_tuning,
 	.prepare_hs400_tuning = msdc_prepare_hs400_tuning,
+	.execute_hs400_tuning = msdc_execute_hs400_tuning,
 	.hw_reset = msdc_hw_reset,
 };
 
@@ -2407,6 +2479,9 @@ static void msdc_of_property_parse(struct platform_device *pdev,
 	of_property_read_u32(pdev->dev.of_node, "hs400-ds-delay",
 			     &host->hs400_ds_delay);
 
+	of_property_read_u32(pdev->dev.of_node, "mediatek,hs400-ds-dly3",
+			     &host->hs400_ds_dly3);
+
 	of_property_read_u32(pdev->dev.of_node, "mediatek,hs200-cmd-int-delay",
 			     &host->hs200_cmd_int_delay);
 

drivers/mmc/host/sdhci-msm.c

@@ -2756,6 +2756,9 @@ static int sdhci_msm_probe(struct platform_device *pdev)
 
 	msm_host->mmc->caps |= MMC_CAP_WAIT_WHILE_BUSY | MMC_CAP_NEED_RSP_BUSY;
 
+	/* Enable force hw reset during cqe recovery */
+	msm_host->mmc->cqe_recovery_reset_always = true;
+
 	/* Set the timeout value to max possible */
 	host->max_timeout_count = 0xF;
 

drivers/mmc/host/sdhci.c

@@ -32,6 +32,8 @@
 #include <linux/mmc/sdio.h>
 #include <linux/mmc/slot-gpio.h>
 
+#include <trace/hooks/mmc.h>
+
 #include "sdhci.h"
 
 #define DRIVER_NAME "sdhci"
@@ -224,6 +226,7 @@ void sdhci_reset(struct sdhci_host *host, u8 mask)
 		if (timedout) {
 			pr_err("%s: Reset 0x%x never completed.\n",
 				mmc_hostname(host->mmc), (int)mask);
+			sdhci_err_stats_inc(host, CTRL_TIMEOUT);
 			sdhci_dumpregs(host);
 			return;
 		}
@@ -1719,6 +1722,7 @@ static bool sdhci_send_command_retry(struct sdhci_host *host,
 		if (!timeout--) {
 			pr_err("%s: Controller never released inhibit bit(s).\n",
 			       mmc_hostname(host->mmc));
+			sdhci_err_stats_inc(host, CTRL_TIMEOUT);
 			sdhci_dumpregs(host);
 			cmd->error = -EIO;
 			return false;
@@ -1968,6 +1972,7 @@ void sdhci_enable_clk(struct sdhci_host *host, u16 clk)
 		if (timedout) {
 			pr_err("%s: Internal clock never stabilised.\n",
 			       mmc_hostname(host->mmc));
+			sdhci_err_stats_inc(host, CTRL_TIMEOUT);
 			sdhci_dumpregs(host);
 			return;
 		}
@@ -1990,6 +1995,7 @@ void sdhci_enable_clk(struct sdhci_host *host, u16 clk)
 			if (timedout) {
 				pr_err("%s: PLL clock never stabilised.\n",
 				       mmc_hostname(host->mmc));
+				sdhci_err_stats_inc(host, CTRL_TIMEOUT);
 				sdhci_dumpregs(host);
 				return;
 			}
@@ -2417,6 +2423,7 @@ static int sdhci_get_cd(struct mmc_host *mmc)
 {
 	struct sdhci_host *host = mmc_priv(mmc);
 	int gpio_cd = mmc_gpio_get_cd(mmc);
+	bool allow = true;
 
 	if (host->flags & SDHCI_DEVICE_DEAD)
 		return 0;
@@ -2425,6 +2432,10 @@ static int sdhci_get_cd(struct mmc_host *mmc)
 	if (!mmc_card_is_removable(mmc))
 		return 1;
 
+	trace_android_vh_sdhci_get_cd(host, &allow);
+	if (!allow)
+		return 0;
+
 	/*
 	 * Try slot gpio detect, if defined it take precedence
 	 * over build in controller functionality
@@ -3145,6 +3156,7 @@ static void sdhci_timeout_timer(struct timer_list *t)
 	if (host->cmd && !sdhci_data_line_cmd(host->cmd)) {
 		pr_err("%s: Timeout waiting for hardware cmd interrupt.\n",
 		       mmc_hostname(host->mmc));
+		sdhci_err_stats_inc(host, REQ_TIMEOUT);
 		sdhci_dumpregs(host);
 
 		host->cmd->error = -ETIMEDOUT;
@@ -3167,6 +3179,7 @@ static void sdhci_timeout_data_timer(struct timer_list *t)
 	    (host->cmd && sdhci_data_line_cmd(host->cmd))) {
 		pr_err("%s: Timeout waiting for hardware interrupt.\n",
 		       mmc_hostname(host->mmc));
+		sdhci_err_stats_inc(host, REQ_TIMEOUT);
 		sdhci_dumpregs(host);
 
 		if (host->data) {
@@ -3218,17 +3231,21 @@ static void sdhci_cmd_irq(struct sdhci_host *host, u32 intmask, u32 *intmask_p)
 			return;
 		pr_err("%s: Got command interrupt 0x%08x even though no command operation was in progress.\n",
 		       mmc_hostname(host->mmc), (unsigned)intmask);
+		sdhci_err_stats_inc(host, UNEXPECTED_IRQ);
 		sdhci_dumpregs(host);
 		return;
 	}
 
 	if (intmask & (SDHCI_INT_TIMEOUT | SDHCI_INT_CRC |
 		       SDHCI_INT_END_BIT | SDHCI_INT_INDEX)) {
-		if (intmask & SDHCI_INT_TIMEOUT)
+		if (intmask & SDHCI_INT_TIMEOUT) {
 			host->cmd->error = -ETIMEDOUT;
-		else
+			sdhci_err_stats_inc(host, CMD_TIMEOUT);
+		} else {
 			host->cmd->error = -EILSEQ;
-
+			if (!mmc_op_tuning(host->cmd->opcode))
+				sdhci_err_stats_inc(host, CMD_CRC);
+		}
 		/* Treat data command CRC error the same as data CRC error */
 		if (host->cmd->data &&
 		    (intmask & (SDHCI_INT_CRC | SDHCI_INT_TIMEOUT)) ==
@@ -3249,6 +3266,8 @@ static void sdhci_cmd_irq(struct sdhci_host *host, u32 intmask, u32 *intmask_p)
 		int err = (auto_cmd_status & SDHCI_AUTO_CMD_TIMEOUT) ?
 			  -ETIMEDOUT :
 			  -EILSEQ;
+		sdhci_err_stats_inc(host, AUTO_CMD);
+
 
 		if (mrq->sbc && (host->flags & SDHCI_AUTO_CMD23)) {
 			mrq->sbc->error = err;
@@ -3326,6 +3345,7 @@ static void sdhci_data_irq(struct sdhci_host *host, u32 intmask)
 			if (intmask & SDHCI_INT_DATA_TIMEOUT) {
 				host->data_cmd = NULL;
 				data_cmd->error = -ETIMEDOUT;
+				sdhci_err_stats_inc(host, CMD_TIMEOUT);
 				__sdhci_finish_mrq(host, data_cmd->mrq);
 				return;
 			}
@@ -3354,23 +3374,30 @@ static void sdhci_data_irq(struct sdhci_host *host, u32 intmask)
 
 		pr_err("%s: Got data interrupt 0x%08x even though no data operation was in progress.\n",
 		       mmc_hostname(host->mmc), (unsigned)intmask);
+		sdhci_err_stats_inc(host, UNEXPECTED_IRQ);
 		sdhci_dumpregs(host);
 
 		return;
 	}
 
-	if (intmask & SDHCI_INT_DATA_TIMEOUT)
+	if (intmask & SDHCI_INT_DATA_TIMEOUT) {
 		host->data->error = -ETIMEDOUT;
-	else if (intmask & SDHCI_INT_DATA_END_BIT)
+		sdhci_err_stats_inc(host, DAT_TIMEOUT);
+	} else if (intmask & SDHCI_INT_DATA_END_BIT) {
 		host->data->error = -EILSEQ;
-	else if ((intmask & SDHCI_INT_DATA_CRC) &&
+		if (!mmc_op_tuning(SDHCI_GET_CMD(sdhci_readw(host, SDHCI_COMMAND))))
+			sdhci_err_stats_inc(host, DAT_CRC);
+	} else if ((intmask & SDHCI_INT_DATA_CRC) &&
 		SDHCI_GET_CMD(sdhci_readw(host, SDHCI_COMMAND))
-			!= MMC_BUS_TEST_R)
+			!= MMC_BUS_TEST_R) {
 		host->data->error = -EILSEQ;
-	else if (intmask & SDHCI_INT_ADMA_ERROR) {
+		if (!mmc_op_tuning(SDHCI_GET_CMD(sdhci_readw(host, SDHCI_COMMAND))))
+			sdhci_err_stats_inc(host, DAT_CRC);
+	} else if (intmask & SDHCI_INT_ADMA_ERROR) {
 		pr_err("%s: ADMA error: 0x%08x\n", mmc_hostname(host->mmc),
 		       intmask);
 		sdhci_adma_show_error(host);
+		sdhci_err_stats_inc(host, ADMA);
 		host->data->error = -EIO;
 		if (host->ops->adma_workaround)
 			host->ops->adma_workaround(host, intmask);
@@ -3568,6 +3595,7 @@ out:
 	if (unexpected) {
 		pr_err("%s: Unexpected interrupt 0x%08x.\n",
 			   mmc_hostname(host->mmc), unexpected);
+		sdhci_err_stats_inc(host, UNEXPECTED_IRQ);
 		sdhci_dumpregs(host);
 	}
 
@@ -3889,20 +3917,27 @@ bool sdhci_cqe_irq(struct sdhci_host *host, u32 intmask, int *cmd_error,
 	if (!host->cqe_on)
 		return false;
 
-	if (intmask & (SDHCI_INT_INDEX | SDHCI_INT_END_BIT | SDHCI_INT_CRC))
+	if (intmask & (SDHCI_INT_INDEX | SDHCI_INT_END_BIT | SDHCI_INT_CRC)) {
 		*cmd_error = -EILSEQ;
-	else if (intmask & SDHCI_INT_TIMEOUT)
+		if (!mmc_op_tuning(host->cmd->opcode))
+			sdhci_err_stats_inc(host, CMD_CRC);
+	} else if (intmask & SDHCI_INT_TIMEOUT) {
 		*cmd_error = -ETIMEDOUT;
-	else
+		sdhci_err_stats_inc(host, CMD_TIMEOUT);
+	} else
 		*cmd_error = 0;
 
-	if (intmask & (SDHCI_INT_DATA_END_BIT | SDHCI_INT_DATA_CRC))
+	if (intmask & (SDHCI_INT_DATA_END_BIT | SDHCI_INT_DATA_CRC)) {
 		*data_error = -EILSEQ;
-	else if (intmask & SDHCI_INT_DATA_TIMEOUT)
+		if (!mmc_op_tuning(host->cmd->opcode))
+			sdhci_err_stats_inc(host, DAT_CRC);
+	} else if (intmask & SDHCI_INT_DATA_TIMEOUT) {
 		*data_error = -ETIMEDOUT;
-	else if (intmask & SDHCI_INT_ADMA_ERROR)
+		sdhci_err_stats_inc(host, DAT_TIMEOUT);
+	} else if (intmask & SDHCI_INT_ADMA_ERROR) {
 		*data_error = -EIO;
-	else
+		sdhci_err_stats_inc(host, ADMA);
+	} else
 		*data_error = 0;
 
 	/* Clear selected interrupts. */
@@ -3918,6 +3953,7 @@ bool sdhci_cqe_irq(struct sdhci_host *host, u32 intmask, int *cmd_error,
 		sdhci_writel(host, intmask, SDHCI_INT_STATUS);
 		pr_err("%s: CQE: Unexpected interrupt 0x%08x.\n",
 		       mmc_hostname(host->mmc), intmask);
+		sdhci_err_stats_inc(host, UNEXPECTED_IRQ);
 		sdhci_dumpregs(host);
 	}
 

drivers/mmc/host/sdhci.h

@@ -357,6 +357,9 @@ struct sdhci_adma2_64_desc {
  */
 #define MMC_CMD_TRANSFER_TIME	(10 * NSEC_PER_MSEC) /* max 10 ms */
 
+#define sdhci_err_stats_inc(host, err_name) \
+	mmc_debugfs_err_stats_inc((host)->mmc, MMC_ERR_##err_name)
+
 enum sdhci_cookie {
 	COOKIE_UNMAPPED,
 	COOKIE_PRE_MAPPED,	/* mapped by sdhci_pre_req() */

drivers/net/ppp/pppoe.c

@@ -988,6 +988,7 @@ static int pppoe_fill_forward_path(struct net_device_path_ctx *ctx,
 	path->encap.proto = htons(ETH_P_PPP_SES);
 	path->encap.id = be16_to_cpu(po->num);
 	memcpy(path->encap.h_dest, po->pppoe_pa.remote, ETH_ALEN);
+	memcpy(ctx->daddr, po->pppoe_pa.remote, ETH_ALEN);
 	path->dev = ctx->dev;
 	ctx->dev = dev;
 

drivers/net/wireless/ath/ath6kl/cfg80211.c

@@ -807,7 +807,7 @@ void ath6kl_cfg80211_connect_event(struct ath6kl_vif *vif, u16 channel,
 		cfg80211_put_bss(ar->wiphy, bss);
 	} else if (vif->sme_state == SME_CONNECTED) {
 		struct cfg80211_roam_info roam_info = {
-			.bss = bss,
+			.links[0].bss = bss,
 			.req_ie = assoc_req_ie,
 			.req_ie_len = assoc_req_len,
 			.resp_ie = assoc_resp_ie,
@@ -1119,7 +1119,7 @@ void ath6kl_cfg80211_ch_switch_notify(struct ath6kl_vif *vif, int freq,
 					NL80211_CHAN_HT20 : NL80211_CHAN_NO_HT);
 
 	mutex_lock(&vif->wdev.mtx);
-	cfg80211_ch_switch_notify(vif->ndev, &chandef);
+	cfg80211_ch_switch_notify(vif->ndev, &chandef, 0);
 	mutex_unlock(&vif->wdev.mtx);
 }
 
@@ -2967,7 +2967,8 @@ static int ath6kl_change_beacon(struct wiphy *wiphy, struct net_device *dev,
 	return ath6kl_set_ies(vif, beacon);
 }
 
-static int ath6kl_stop_ap(struct wiphy *wiphy, struct net_device *dev)
+static int ath6kl_stop_ap(struct wiphy *wiphy, struct net_device *dev,
+			  unsigned int link_id)
 {
 	struct ath6kl *ar = ath6kl_priv(dev);
 	struct ath6kl_vif *vif = netdev_priv(dev);
@@ -3368,6 +3369,7 @@ static int ath6kl_cfg80211_sscan_stop(struct wiphy *wiphy,
 
 static int ath6kl_cfg80211_set_bitrate(struct wiphy *wiphy,
 				       struct net_device *dev,
+				       unsigned int link_id,
 				       const u8 *addr,
 				       const struct cfg80211_bitrate_mask *mask)
 {

drivers/net/wireless/ath/wil6210/cfg80211.c

@@ -2097,8 +2097,8 @@ static int wil_cfg80211_change_beacon(struct wiphy *wiphy,
 			     bcon->tail_len))
 		privacy = 1;
 
-	memcpy(vif->ssid, wdev->ssid, wdev->ssid_len);
+	memcpy(vif->ssid, wdev->u.ap.ssid, wdev->u.ap.ssid_len);
-	vif->ssid_len = wdev->ssid_len;
+	vif->ssid_len = wdev->u.ap.ssid_len;
 
 	/* in case privacy has changed, need to restart the AP */
 	if (vif->privacy != privacy) {
@@ -2107,7 +2107,7 @@ static int wil_cfg80211_change_beacon(struct wiphy *wiphy,
 
 		rc = _wil_cfg80211_start_ap(wiphy, ndev, vif->ssid,
 					    vif->ssid_len, privacy,
-					    wdev->beacon_interval,
+					    wdev->links[0].ap.beacon_interval,
 					    vif->channel,
 					    vif->wmi_edmg_channel, bcon,
 					    vif->hidden_ssid,
@@ -2185,7 +2185,8 @@ static int wil_cfg80211_start_ap(struct wiphy *wiphy,
 }
 
 static int wil_cfg80211_stop_ap(struct wiphy *wiphy,
-				struct net_device *ndev)
+				struct net_device *ndev,
+				unsigned int link_id)
 {
 	struct wil6210_priv *wil = wiphy_to_wil(wiphy);
 	struct wil6210_vif *vif = ndev_to_vif(ndev);

drivers/net/wireless/ath/wil6210/debugfs.c

@@ -1391,19 +1391,6 @@ static int temp_show(struct seq_file *s, void *data)
 }
 DEFINE_SHOW_ATTRIBUTE(temp);
 
-/*---------freq------------*/
-static int freq_show(struct seq_file *s, void *data)
-{
-	struct wil6210_priv *wil = s->private;
-	struct wireless_dev *wdev = wil->main_ndev->ieee80211_ptr;
-	u32 freq = wdev->chandef.chan ? wdev->chandef.chan->center_freq : 0;
-
-	seq_printf(s, "Freq = %d\n", freq);
-
-	return 0;
-}
-DEFINE_SHOW_ATTRIBUTE(freq);
-
 /*---------link------------*/
 static int link_show(struct seq_file *s, void *data)
 {
@@ -2380,7 +2367,6 @@ static const struct {
 	{"pmcdata",	0444,		&fops_pmcdata},
 	{"pmcring",	0444,		&fops_pmcring},
 	{"temp",	0444,		&temp_fops},
-	{"freq",	0444,		&freq_fops},
 	{"link",	0444,		&link_fops},
 	{"info",	0444,		&info_fops},
 	{"recovery", 0644,		&fops_recovery},

drivers/net/wireless/ath/wil6210/wmi.c

@@ -1822,8 +1822,8 @@ wmi_evt_reassoc_status(struct wil6210_vif *vif, int id, void *d, int len)
 	freq = ieee80211_channel_to_frequency(ch, NL80211_BAND_60GHZ);
 
 	memset(&info, 0, sizeof(info));
-	info.channel = ieee80211_get_channel(wiphy, freq);
+	info.links[0].channel = ieee80211_get_channel(wiphy, freq);
-	info.bss = vif->bss;
+	info.links[0].bss = vif->bss;
 	info.req_ie = assoc_req_ie;
 	info.req_ie_len = assoc_req_ie_len;
 	info.resp_ie = assoc_resp_ie;

drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c

@@ -4943,7 +4943,8 @@ exit:
 	return err;
 }
 
-static int brcmf_cfg80211_stop_ap(struct wiphy *wiphy, struct net_device *ndev)
+static int brcmf_cfg80211_stop_ap(struct wiphy *wiphy, struct net_device *ndev,
+				  unsigned int link_id)
 {
 	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
 	struct brcmf_if *ifp = netdev_priv(ndev);
@@ -5280,6 +5281,7 @@ exit:
 
 static int brcmf_cfg80211_get_channel(struct wiphy *wiphy,
 				      struct wireless_dev *wdev,
+				      unsigned int link_id,
 				      struct cfg80211_chan_def *chandef)
 {
 	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
@@ -5993,8 +5995,8 @@ brcmf_bss_roaming_done(struct brcmf_cfg80211_info *cfg,
 done:
 	kfree(buf);
 
-	roam_info.channel = notify_channel;
+	roam_info.links[0].channel = notify_channel;
-	roam_info.bssid = profile->bssid;
+	roam_info.links[0].bssid = profile->bssid;
 	roam_info.req_ie = conn_info->req_ie;
 	roam_info.req_ie_len = conn_info->req_ie_len;
 	roam_info.resp_ie = conn_info->resp_ie;
@@ -6037,7 +6039,7 @@ brcmf_bss_connect_done(struct brcmf_cfg80211_info *cfg,
 		} else {
 			conn_params.status = WLAN_STATUS_AUTH_TIMEOUT;
 		}
-		conn_params.bssid = profile->bssid;
+		conn_params.links[0].bssid = profile->bssid;
 		conn_params.req_ie = conn_info->req_ie;
 		conn_params.req_ie_len = conn_info->req_ie_len;
 		conn_params.resp_ie = conn_info->resp_ie;

drivers/net/wireless/marvell/libertas/mesh.c

@@ -109,9 +109,9 @@ static int lbs_mesh_config(struct lbs_private *priv, uint16_t action,
 
 		if (priv->mesh_dev) {
 			mesh_wdev = priv->mesh_dev->ieee80211_ptr;
-			ie->val.mesh_id_len = mesh_wdev->mesh_id_up_len;
+			ie->val.mesh_id_len = mesh_wdev->u.mesh.id_up_len;
-			memcpy(ie->val.mesh_id, mesh_wdev->ssid,
+			memcpy(ie->val.mesh_id, mesh_wdev->u.mesh.id,
-						mesh_wdev->mesh_id_up_len);
+						mesh_wdev->u.mesh.id_up_len);
 		}
 
 		ie->len = sizeof(struct mrvl_meshie_val) -
@@ -986,8 +986,8 @@ static int lbs_add_mesh(struct lbs_private *priv)
 	mesh_wdev->wiphy = priv->wdev->wiphy;
 
 	if (priv->mesh_tlv) {
-		sprintf(mesh_wdev->ssid, "mesh");
+		sprintf(mesh_wdev->u.mesh.id, "mesh");
-		mesh_wdev->mesh_id_up_len = 4;
+		mesh_wdev->u.mesh.id_up_len = 4;
 	}
 
 	mesh_wdev->netdev = mesh_dev;

drivers/net/wireless/marvell/mwifiex/11h.c

@@ -303,5 +303,5 @@ void mwifiex_dfs_chan_sw_work_queue(struct work_struct *work)
 
 	mwifiex_dbg(priv->adapter, MSG,
 		    "indicating channel switch completion to kernel\n");
-	cfg80211_ch_switch_notify(priv->netdev, &priv->dfs_chandef);
+	cfg80211_ch_switch_notify(priv->netdev, &priv->dfs_chandef, 0);
 }

drivers/net/wireless/marvell/mwifiex/cfg80211.c

@@ -1680,10 +1680,12 @@ mwifiex_mgmt_stypes[NUM_NL80211_IFTYPES] = {
  * Function configures data rates to firmware using bitrate mask
  * provided by cfg80211.
  */
-static int mwifiex_cfg80211_set_bitrate_mask(struct wiphy *wiphy,
+static int
-				struct net_device *dev,
+mwifiex_cfg80211_set_bitrate_mask(struct wiphy *wiphy,
-				const u8 *peer,
+				  struct net_device *dev,
-				const struct cfg80211_bitrate_mask *mask)
+				  unsigned int link_id,
+				  const u8 *peer,
+				  const struct cfg80211_bitrate_mask *mask)
 {
 	struct mwifiex_private *priv = mwifiex_netdev_get_priv(dev);
 	u16 bitmap_rates[MAX_BITMAP_RATES_SIZE];
@@ -1925,7 +1927,8 @@ mwifiex_cfg80211_get_antenna(struct wiphy *wiphy, u32 *tx_ant, u32 *rx_ant)
 /* cfg80211 operation handler for stop ap.
  * Function stops BSS running at uAP interface.
  */
-static int mwifiex_cfg80211_stop_ap(struct wiphy *wiphy, struct net_device *dev)
+static int mwifiex_cfg80211_stop_ap(struct wiphy *wiphy, struct net_device *dev,
+				    unsigned int link_id)
 {
 	struct mwifiex_private *priv = mwifiex_netdev_get_priv(dev);
 
@@ -2348,7 +2351,7 @@ mwifiex_cfg80211_connect(struct wiphy *wiphy, struct net_device *dev,
 		return -EINVAL;
 	}
 
-	if (priv->wdev.current_bss) {
+	if (priv->wdev.connected) {
 		mwifiex_dbg(adapter, ERROR,
 			    "%s: already connected\n", dev->name);
 		return -EALREADY;
@@ -2576,7 +2579,7 @@ mwifiex_cfg80211_scan(struct wiphy *wiphy,
 		return -EBUSY;
 	}
 
-	if (!priv->wdev.current_bss && priv->scan_block)
+	if (!priv->wdev.connected && priv->scan_block)
 		priv->scan_block = false;
 
 	if (!mwifiex_stop_bg_scan(priv))
@@ -3987,6 +3990,7 @@ mwifiex_cfg80211_channel_switch(struct wiphy *wiphy, struct net_device *dev,
 
 static int mwifiex_cfg80211_get_channel(struct wiphy *wiphy,
 					struct wireless_dev *wdev,
+					unsigned int link_id,
 					struct cfg80211_chan_def *chandef)
 {
 	struct mwifiex_private *priv = mwifiex_netdev_get_priv(wdev->netdev);

drivers/net/wireless/microchip/wilc1000/cfg80211.c

@@ -1374,7 +1374,8 @@ static int change_beacon(struct wiphy *wiphy, struct net_device *dev,
 	return wilc_add_beacon(vif, 0, 0, beacon);
 }
 
-static int stop_ap(struct wiphy *wiphy, struct net_device *dev)
+static int stop_ap(struct wiphy *wiphy, struct net_device *dev,
+		   unsigned int link_id)
 {
 	int ret;
 	struct wilc_vif *vif = netdev_priv(dev);

drivers/net/wireless/quantenna/qtnfmac/cfg80211.c

@@ -352,7 +352,8 @@ static int qtnf_start_ap(struct wiphy *wiphy, struct net_device *dev,
 	return ret;
 }
 
-static int qtnf_stop_ap(struct wiphy *wiphy, struct net_device *dev)
+static int qtnf_stop_ap(struct wiphy *wiphy, struct net_device *dev,
+			unsigned int link_id)
 {
 	struct qtnf_vif *vif = qtnf_netdev_get_priv(dev);
 	int ret;
@@ -500,7 +501,7 @@ qtnf_dump_station(struct wiphy *wiphy, struct net_device *dev,
 
 	switch (vif->wdev.iftype) {
 	case NL80211_IFTYPE_STATION:
-		if (idx != 0 || !vif->wdev.current_bss)
+		if (idx != 0 || !vif->wdev.connected)
 			return -ENOENT;
 
 		ether_addr_copy(mac, vif->bssid);
@@ -729,7 +730,7 @@ qtnf_disconnect(struct wiphy *wiphy, struct net_device *dev,
 		pr_err("VIF%u.%u: failed to disconnect\n",
 		       mac->macid, vif->vifid);
 
-	if (vif->wdev.current_bss) {
+	if (vif->wdev.connected) {
 		netif_carrier_off(vif->netdev);
 		cfg80211_disconnected(vif->netdev, reason_code,
 				      NULL, 0, true, GFP_KERNEL);
@@ -745,10 +746,11 @@ qtnf_dump_survey(struct wiphy *wiphy, struct net_device *dev,
 	struct qtnf_wmac *mac = wiphy_priv(wiphy);
 	struct wireless_dev *wdev = dev->ieee80211_ptr;
 	struct ieee80211_supported_band *sband;
-	const struct cfg80211_chan_def *chandef = &wdev->chandef;
+	const struct cfg80211_chan_def *chandef = wdev_chandef(wdev, 0);
 	struct ieee80211_channel *chan;
 	int ret;
 
+
 	sband = wiphy->bands[NL80211_BAND_2GHZ];
 	if (sband && idx >= sband->n_channels) {
 		idx -= sband->n_channels;
@@ -765,7 +767,7 @@ qtnf_dump_survey(struct wiphy *wiphy, struct net_device *dev,
 	survey->channel = chan;
 	survey->filled = 0x0;
 
-	if (chan == chandef->chan)
+	if (chandef && chan == chandef->chan)
 		survey->filled = SURVEY_INFO_IN_USE;
 
 	ret = qtnf_cmd_get_chan_stats(mac, chan->center_freq, survey);
@@ -778,7 +780,7 @@ qtnf_dump_survey(struct wiphy *wiphy, struct net_device *dev,
 
 static int
 qtnf_get_channel(struct wiphy *wiphy, struct wireless_dev *wdev,
-		 struct cfg80211_chan_def *chandef)
+		 unsigned int link_id, struct cfg80211_chan_def *chandef)
 {
 	struct net_device *ndev = wdev->netdev;
 	struct qtnf_vif *vif;

drivers/net/wireless/quantenna/qtnfmac/commands.c

@@ -241,6 +241,7 @@ int qtnf_cmd_send_start_ap(struct qtnf_vif *vif,
 	struct qlink_auth_encr *aen;
 	int ret;
 	int i;
+	int n;
 
 	if (!qtnf_cmd_start_ap_can_fit(vif, s))
 		return -E2BIG;
@@ -280,8 +281,9 @@ int qtnf_cmd_send_start_ap(struct qtnf_vif *vif,
 	for (i = 0; i < QLINK_MAX_NR_CIPHER_SUITES; i++)
 		aen->ciphers_pairwise[i] =
 				cpu_to_le32(s->crypto.ciphers_pairwise[i]);
-	aen->n_akm_suites = cpu_to_le32(s->crypto.n_akm_suites);
+	n = min(QLINK_MAX_NR_AKM_SUITES, s->crypto.n_akm_suites);
-	for (i = 0; i < QLINK_MAX_NR_AKM_SUITES; i++)
+	aen->n_akm_suites = cpu_to_le32(n);
+	for (i = 0; i < n; i++)
 		aen->akm_suites[i] = cpu_to_le32(s->crypto.akm_suites[i]);
 	aen->control_port = s->crypto.control_port;
 	aen->control_port_no_encrypt = s->crypto.control_port_no_encrypt;
@@ -2005,7 +2007,7 @@ int qtnf_cmd_send_scan(struct qtnf_wmac *mac)
 		dwell_active = scan_req->duration;
 		dwell_passive = scan_req->duration;
 	} else if (wdev->iftype == NL80211_IFTYPE_STATION &&
-		   wdev->current_bss) {
+		   wdev->connected) {
 		/* let device select dwell based on traffic conditions */
 		dwell_active = QTNF_SCAN_TIME_AUTO;
 		dwell_passive = QTNF_SCAN_TIME_AUTO;
@@ -2076,6 +2078,7 @@ int qtnf_cmd_send_connect(struct qtnf_vif *vif,
 	struct qlink_auth_encr *aen;
 	int ret;
 	int i;
+	int n;
 	u32 connect_flags = 0;
 
 	cmd_skb = qtnf_cmd_alloc_new_cmdskb(vif->mac->macid, vif->vifid,
@@ -2132,9 +2135,10 @@ int qtnf_cmd_send_connect(struct qtnf_vif *vif,
 		aen->ciphers_pairwise[i] =
 			cpu_to_le32(sme->crypto.ciphers_pairwise[i]);
 
-	aen->n_akm_suites = cpu_to_le32(sme->crypto.n_akm_suites);
+	n = min(QLINK_MAX_NR_AKM_SUITES, sme->crypto.n_akm_suites);
+	aen->n_akm_suites = cpu_to_le32(n);
 
-	for (i = 0; i < QLINK_MAX_NR_AKM_SUITES; i++)
+	for (i = 0; i < n; i++)
 		aen->akm_suites[i] = cpu_to_le32(sme->crypto.akm_suites[i]);
 
 	aen->control_port = sme->crypto.control_port;

drivers/net/wireless/quantenna/qtnfmac/event.c

@@ -189,7 +189,7 @@ qtnf_event_handle_bss_join(struct qtnf_vif *vif,
 			vif->mac->macid, vif->vifid,
 			join_info->bssid, chandef.chan->hw_value);
 
-		if (!vif->wdev.ssid_len) {
+		if (!vif->wdev.u.client.ssid_len) {
 			pr_warn("VIF%u.%u: SSID unknown for BSS:%pM\n",
 				vif->mac->macid, vif->vifid,
 				join_info->bssid);
@@ -197,7 +197,7 @@ qtnf_event_handle_bss_join(struct qtnf_vif *vif,
 			goto done;
 		}
 
-		ie = kzalloc(2 + vif->wdev.ssid_len, GFP_KERNEL);
+		ie = kzalloc(2 + vif->wdev.u.client.ssid_len, GFP_KERNEL);
 		if (!ie) {
 			pr_warn("VIF%u.%u: IE alloc failed for BSS:%pM\n",
 				vif->mac->macid, vif->vifid,
@@ -207,14 +207,15 @@ qtnf_event_handle_bss_join(struct qtnf_vif *vif,
 		}
 
 		ie[0] = WLAN_EID_SSID;
-		ie[1] = vif->wdev.ssid_len;
+		ie[1] = vif->wdev.u.client.ssid_len;
-		memcpy(ie + 2, vif->wdev.ssid, vif->wdev.ssid_len);
+		memcpy(ie + 2, vif->wdev.u.client.ssid,
+		       vif->wdev.u.client.ssid_len);
 
 		bss = cfg80211_inform_bss(wiphy, chandef.chan,
 					  CFG80211_BSS_FTYPE_UNKNOWN,
 					  join_info->bssid, 0,
 					  WLAN_CAPABILITY_ESS, 100,
-					  ie, 2 + vif->wdev.ssid_len,
+					  ie, 2 + vif->wdev.u.client.ssid_len,
 					  0, GFP_KERNEL);
 		if (!bss) {
 			pr_warn("VIF%u.%u: can't connect to unknown BSS: %pM\n",
@@ -470,14 +471,14 @@ qtnf_event_handle_freq_change(struct qtnf_wmac *mac,
 			continue;
 
 		if (vif->wdev.iftype == NL80211_IFTYPE_STATION &&
-		    !vif->wdev.current_bss)
+		    !vif->wdev.connected)
 			continue;
 
 		if (!vif->netdev)
 			continue;
 
 		mutex_lock(&vif->wdev.mtx);
-		cfg80211_ch_switch_notify(vif->netdev, &chandef);
+		cfg80211_ch_switch_notify(vif->netdev, &chandef, 0);
 		mutex_unlock(&vif->wdev.mtx);
 	}
 

drivers/net/wireless/rndis_wlan.c

@@ -2813,8 +2813,9 @@ static void rndis_wlan_do_link_up_work(struct usbnet *usbdev)
 						resp_ie_len, 0, GFP_KERNEL);
 		} else {
 			struct cfg80211_roam_info roam_info = {
-				.channel = get_current_channel(usbdev, NULL),
+				.links[0].channel =
-				.bssid = bssid,
+					get_current_channel(usbdev, NULL),
+				.links[0].bssid = bssid,
 				.req_ie = req_ie,
 				.req_ie_len = req_ie_len,
 				.resp_ie = resp_ie,

drivers/of/of_reserved_mem.c

@@ -25,7 +25,7 @@
 
 #include "of_private.h"
 
-#define MAX_RESERVED_REGIONS	64
+#define MAX_RESERVED_REGIONS	128
 static struct reserved_mem reserved_mem[MAX_RESERVED_REGIONS];
 static int reserved_mem_count;
 

drivers/pci/controller/dwc/pcie-designware-host.c

@@ -268,8 +268,9 @@ static void dw_pcie_free_msi(struct pcie_port *pp)
 		struct dw_pcie *pci = to_dw_pcie_from_pp(pp);
 		struct device *dev = pci->dev;
 
-		dma_unmap_single_attrs(dev, pp->msi_data, sizeof(pp->msi_msg),
+		dma_unmap_page(dev, pp->msi_data, PAGE_SIZE, DMA_FROM_DEVICE);
-				       DMA_FROM_DEVICE, DMA_ATTR_SKIP_CPU_SYNC);
+		if (pp->msi_page)
+			__free_page(pp->msi_page);
 	}
 }
 
@@ -373,12 +374,17 @@ int dw_pcie_host_init(struct pcie_port *pp)
 							    dw_chained_msi_isr,
 							    pp);
 
-			pp->msi_data = dma_map_single_attrs(pci->dev, &pp->msi_msg,
+			ret = dma_set_mask(pci->dev, DMA_BIT_MASK(32));
-						      sizeof(pp->msi_msg),
+			if (ret)
-						      DMA_FROM_DEVICE,
+				dev_warn(pci->dev, "Failed to set DMA mask to 32-bit. Devices with only 32-bit MSI support may not work properly\n");
-						      DMA_ATTR_SKIP_CPU_SYNC);
+
+			pp->msi_page = alloc_page(GFP_DMA32);
+			pp->msi_data = dma_map_page(pci->dev, pp->msi_page, 0, PAGE_SIZE,
+						    DMA_FROM_DEVICE);
 			if (dma_mapping_error(pci->dev, pp->msi_data)) {
 				dev_err(pci->dev, "Failed to map MSI data\n");
+				__free_page(pp->msi_page);
+				pp->msi_page = NULL;
 				pp->msi_data = 0;
 				goto err_free_msi;
 			}

drivers/pci/controller/dwc/pcie-designware.h

@@ -190,8 +190,8 @@ struct pcie_port {
 	int			msi_irq;
 	struct irq_domain	*irq_domain;
 	struct irq_domain	*msi_domain;
-	u16			msi_msg;
 	dma_addr_t		msi_data;
+	struct page		*msi_page;
 	struct irq_chip		*msi_irq_chip;
 	u32			num_vectors;
 	u32			irq_mask[MAX_MSI_CTRLS];

drivers/pci/pci.h

@@ -3,6 +3,7 @@
 #define DRIVERS_PCI_H
 
 #include <linux/pci.h>
+#include <linux/android_kabi.h>
 
 /* Number of possible devfns: 0.0 to 1f.7 inclusive */
 #define MAX_NR_DEVFNS 256
@@ -339,6 +340,11 @@ struct pci_sriov {
 	u16		subsystem_device; /* VF subsystem device */
 	resource_size_t	barsz[PCI_SRIOV_NUM_BARS];	/* VF BAR size */
 	bool		drivers_autoprobe; /* Auto probing of VFs by driver */
+
+	ANDROID_KABI_RESERVE(1);
+	ANDROID_KABI_RESERVE(2);
+	ANDROID_KABI_RESERVE(3);
+	ANDROID_KABI_RESERVE(4);
 };
 
 /**

drivers/power/supply/power_supply_core.c

@@ -132,6 +132,7 @@ void power_supply_changed(struct power_supply *psy)
 }
 EXPORT_SYMBOL_GPL(power_supply_changed);
 
+static int psy_register_cooler(struct power_supply *psy);
 /*
  * Notify that power supply was registered after parent finished the probing.
  *
@@ -139,6 +140,8 @@ EXPORT_SYMBOL_GPL(power_supply_changed);
  * calling power_supply_changed() directly from power_supply_register()
  * would lead to execution of get_property() function provided by the driver
  * too early - before the probe ends.
+ * Also, registering cooling device from the probe will execute the
+ * get_property() function. So register the cooling device after the probe.
  *
  * Avoid that by waiting on parent's mutex.
  */
@@ -156,6 +159,7 @@ static void power_supply_deferred_register_work(struct work_struct *work)
 	}
 
 	power_supply_changed(psy);
+	psy_register_cooler(psy);
 
 	if (psy->dev.parent)
 		mutex_unlock(&psy->dev.parent->mutex);
@@ -1153,9 +1157,15 @@ static int psy_register_cooler(struct power_supply *psy)
 	for (i = 0; i < psy->desc->num_properties; i++) {
 		if (psy->desc->properties[i] ==
 				POWER_SUPPLY_PROP_CHARGE_CONTROL_LIMIT) {
-			psy->tcd = thermal_cooling_device_register(
+			if (psy->dev.parent)
-							(char *)psy->desc->name,
+				psy->tcd = thermal_of_cooling_device_register(
-							psy, &psy_tcd_ops);
+						dev_of_node(psy->dev.parent),
+						(char *)psy->desc->name,
+						psy, &psy_tcd_ops);
+			else
+				psy->tcd = thermal_cooling_device_register(
+						(char *)psy->desc->name,
+						psy, &psy_tcd_ops);
 			return PTR_ERR_OR_ZERO(psy->tcd);
 		}
 	}
@@ -1261,10 +1271,6 @@ __power_supply_register(struct device *parent,
 	if (rc)
 		goto register_thermal_failed;
 
-	rc = psy_register_cooler(psy);
-	if (rc)
-		goto register_cooler_failed;
-
 	rc = power_supply_create_triggers(psy);
 	if (rc)
 		goto create_triggers_failed;
@@ -1294,8 +1300,6 @@ __power_supply_register(struct device *parent,
 add_hwmon_sysfs_failed:
 	power_supply_remove_triggers(psy);
 create_triggers_failed:
-	psy_unregister_cooler(psy);
-register_cooler_failed:
 	psy_unregister_thermal(psy);
 register_thermal_failed:
 	device_del(dev);

drivers/remoteproc/remoteproc_core.c

@@ -1007,6 +1007,26 @@ void rproc_add_carveout(struct rproc *rproc, struct rproc_mem_entry *mem)
 }
 EXPORT_SYMBOL(rproc_add_carveout);
 
+/**
+ * rproc_del_carveout() - remove an allocated carveout region
+ * @rproc: rproc handle
+ * @mem: memory entry to register
+ *
+ * This function removes specified memory entry in @rproc carveouts list.
+ */
+void rproc_del_carveout(struct rproc *rproc, struct rproc_mem_entry *mem)
+{
+	struct rproc_mem_entry *entry, *tmp;
+
+	list_for_each_entry_safe(entry, tmp, &rproc->carveouts, node) {
+		if (entry == mem) {
+			list_del(&mem->node);
+			return;
+		}
+	}
+}
+EXPORT_SYMBOL(rproc_del_carveout);
+
 /**
  * rproc_mem_entry_init() - allocate and initialize rproc_mem_entry struct
  * @dev: pointer on device struct
@@ -1055,6 +1075,19 @@ rproc_mem_entry_init(struct device *dev,
 }
 EXPORT_SYMBOL(rproc_mem_entry_init);
 
+/**
+ * rproc_mem_entry_free() - free a rproc_mem_entry struct
+ * @mem: rproc_mem_entry allocated by rproc_mem_entry_init()
+ *
+ * This function frees a rproc_mem_entry_struct that was allocated by
+ * rproc_mem_entry_init().
+ */
+void rproc_mem_entry_free(struct rproc_mem_entry *mem)
+{
+	kfree(mem);
+}
+EXPORT_SYMBOL(rproc_mem_entry_free);
+
 /**
  * rproc_of_resm_mem_entry_init() - allocate and initialize rproc_mem_entry struct
  * from a reserved memory phandle

drivers/remoteproc/remoteproc_internal.h

@@ -84,7 +84,6 @@ static inline void  rproc_char_device_remove(struct rproc *rproc)
 void rproc_free_vring(struct rproc_vring *rvring);
 int rproc_alloc_vring(struct rproc_vdev *rvdev, int i);
 
-void *rproc_da_to_va(struct rproc *rproc, u64 da, size_t len, bool *is_iomem);
 phys_addr_t rproc_va_to_pa(void *cpu_addr);
 int rproc_trigger_recovery(struct rproc *rproc);
 

drivers/rpmsg/rpmsg_char.c

@@ -91,8 +91,8 @@ int rpmsg_chrdev_eptdev_destroy(struct device *dev, void *data)
 }
 EXPORT_SYMBOL(rpmsg_chrdev_eptdev_destroy);
 
-static int rpmsg_ept_cb(struct rpmsg_device *rpdev, void *buf, int len,
+static int rpmsg_ept_copy_cb(struct rpmsg_device *rpdev, void *buf, int len,
-			void *priv, u32 addr)
+			     void *priv, u32 addr)
 {
 	struct rpmsg_eptdev *eptdev = priv;
 	struct sk_buff *skb;
@@ -113,6 +113,43 @@ static int rpmsg_ept_cb(struct rpmsg_device *rpdev, void *buf, int len,
 	return 0;
 }
 
+static int rpmsg_ept_no_copy_cb(struct rpmsg_device *rpdev, void *buf, int len,
+				void *priv, u32 addr)
+{
+	struct rpmsg_eptdev *eptdev = priv;
+	struct sk_buff *skb;
+
+	skb = alloc_skb(0, GFP_ATOMIC);
+	if (!skb)
+		return -ENOMEM;
+
+	skb->head = buf;
+	skb->data = buf;
+	skb_reset_tail_pointer(skb);
+	skb_set_end_offset(skb, len);
+	skb_put(skb, len);
+
+	spin_lock(&eptdev->queue_lock);
+	skb_queue_tail(&eptdev->queue, skb);
+	spin_unlock(&eptdev->queue_lock);
+
+	/* wake up any blocking processes, waiting for new data */
+	wake_up_interruptible(&eptdev->readq);
+
+	return RPMSG_DEFER;
+}
+
+static int rpmsg_ept_cb(struct rpmsg_device *rpdev, void *buf, int len,
+			void *priv, u32 addr)
+{
+	struct rpmsg_eptdev *eptdev = priv;
+	rpmsg_rx_cb_t cb;
+
+	cb = (eptdev->ept->rx_done) ? rpmsg_ept_no_copy_cb : rpmsg_ept_copy_cb;
+
+	return cb(rpdev, buf, len, priv, addr);
+}
+
 static int rpmsg_eptdev_open(struct inode *inode, struct file *filp)
 {
 	struct rpmsg_eptdev *eptdev = cdev_to_eptdev(inode->i_cdev);
@@ -210,6 +247,15 @@ static ssize_t rpmsg_eptdev_read_iter(struct kiocb *iocb, struct iov_iter *to)
 	if (copy_to_iter(skb->data, use, to) != use)
 		use = -EFAULT;
 
+	if (eptdev->ept->rx_done) {
+		rpmsg_rx_done(eptdev->ept, skb->data);
+		/*
+		 * Data memory is freed by rpmsg_rx_done(), reset the skb data
+		 * pointers so kfree_skb() does not try to free a second time.
+		 */
+		skb->head = NULL;
+		skb->data = NULL;
+	}
 	kfree_skb(skb);
 
 	return use;

drivers/rpmsg/rpmsg_core.c

@@ -366,6 +366,26 @@ int rpmsg_set_signals(struct rpmsg_endpoint *ept, u32 set, u32 clear)
 }
 EXPORT_SYMBOL(rpmsg_set_signals);
 
+/**
+ * rpmsg_rx_done() - release resources related to @data from a @rx_cb
+ * @ept:	the rpmsg endpoint
+ * @data:	payload from a message
+ *
+ * Returns 0 on success and an appropriate error value on failure.
+ */
+int rpmsg_rx_done(struct rpmsg_endpoint *ept, void *data)
+{
+	if (WARN_ON(!ept))
+		return -EINVAL;
+	if (!ept->ops->rx_done)
+		return -ENXIO;
+	if (!ept->rx_done)
+		return -EINVAL;
+
+	return ept->ops->rx_done(ept, data);
+}
+EXPORT_SYMBOL(rpmsg_rx_done);
+
 /*
  * match a rpmsg channel with a channel info struct.
  * this is used to make sure we're not creating rpmsg devices for channels

drivers/rpmsg/rpmsg_internal.h

@@ -77,6 +77,7 @@ struct rpmsg_endpoint_ops {
 			     void *data, int len);
 	__poll_t (*poll)(struct rpmsg_endpoint *ept, struct file *filp,
 			     poll_table *wait);
+	int (*rx_done)(struct rpmsg_endpoint *ept, void *data);
 	int (*get_signals)(struct rpmsg_endpoint *ept);
 	int (*set_signals)(struct rpmsg_endpoint *ept, u32 set, u32 clear);
 };

drivers/scsi/sd.h

@@ -125,6 +125,9 @@ struct scsi_disk {
 	unsigned	urswrz : 1;
 	unsigned	security : 1;
 	unsigned	ignore_medium_access_errors : 1;
+
+	ANDROID_KABI_RESERVE(1);
+	ANDROID_KABI_RESERVE(2);
 };
 #define to_scsi_disk(obj) container_of(obj,struct scsi_disk,dev)
 

drivers/scsi/ufs/Kconfig

@@ -199,3 +199,12 @@ config SCSI_UFS_FAULT_INJECTION
 	help
 	  Enable fault injection support in the UFS driver. This makes it easier
 	  to test the UFS error handler and abort handler.
+
+config SCSI_UFS_HWMON
+	bool "UFS  Temperature Notification"
+	depends on SCSI_UFSHCD && HWMON
+	help
+	  This provides support for UFS hardware monitoring. If enabled,
+	  a hardware monitoring device will be created for the UFS device.
+
+	  If unsure, say N.

drivers/scsi/ufs/Makefile

@@ -10,6 +10,7 @@ ufshcd-core-$(CONFIG_SCSI_UFS_BSG)	+= ufs_bsg.o
 ufshcd-core-$(CONFIG_SCSI_UFS_CRYPTO)	+= ufshcd-crypto.o
 ufshcd-core-$(CONFIG_SCSI_UFS_HPB)	+= ufshpb.o
 ufshcd-core-$(CONFIG_SCSI_UFS_FAULT_INJECTION) += ufs-fault-injection.o
+ufshcd-core-$(CONFIG_SCSI_UFS_HWMON) += ufs-hwmon.o
 
 obj-$(CONFIG_SCSI_UFS_DWC_TC_PCI) += tc-dwc-g210-pci.o ufshcd-dwc.o tc-dwc-g210.o
 obj-$(CONFIG_SCSI_UFS_DWC_TC_PLATFORM) += tc-dwc-g210-pltfrm.o ufshcd-dwc.o tc-dwc-g210.o

drivers/scsi/ufs/ufs-hwmon.c

@@ -0,0 +1,198 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * UFS hardware monitoring support
+ * Copyright (c) 2021, Western Digital Corporation
+ */
+
+#include <linux/hwmon.h>
+#include <linux/units.h>
+
+#include "ufshcd.h"
+
+struct ufs_hwmon_data {
+	struct ufs_hba *hba;
+	u8 mask;
+};
+
+static int ufs_read_temp_enable(struct ufs_hba *hba, u8 mask, long *val)
+{
+	u32 ee_mask;
+	int err;
+
+	err = ufshcd_query_attr(hba, UPIU_QUERY_OPCODE_READ_ATTR, QUERY_ATTR_IDN_EE_CONTROL, 0, 0,
+				&ee_mask);
+	if (err)
+		return err;
+
+	*val = (mask & ee_mask & MASK_EE_TOO_HIGH_TEMP) || (mask & ee_mask & MASK_EE_TOO_LOW_TEMP);
+
+	return 0;
+}
+
+static int ufs_get_temp(struct ufs_hba *hba, enum attr_idn idn, long *val)
+{
+	u32 value;
+	int err;
+
+	err = ufshcd_query_attr(hba, UPIU_QUERY_OPCODE_READ_ATTR, idn, 0, 0, &value);
+	if (err)
+		return err;
+
+	if (value == 0)
+		return -ENODATA;
+
+	*val = ((long)value - 80) * MILLIDEGREE_PER_DEGREE;
+
+	return 0;
+}
+
+static int ufs_hwmon_read(struct device *dev, enum hwmon_sensor_types type, u32 attr, int channel,
+			  long *val)
+{
+	struct ufs_hwmon_data *data = dev_get_drvdata(dev);
+	struct ufs_hba *hba = data->hba;
+	int err;
+
+	down(&hba->host_sem);
+
+	if (!ufshcd_is_user_access_allowed(hba)) {
+		up(&hba->host_sem);
+		return -EBUSY;
+	}
+
+	ufshcd_rpm_get_sync(hba);
+
+	switch (attr) {
+	case hwmon_temp_enable:
+		err = ufs_read_temp_enable(hba, data->mask, val);
+
+		break;
+	case hwmon_temp_crit:
+		err = ufs_get_temp(hba, QUERY_ATTR_IDN_HIGH_TEMP_BOUND, val);
+
+		break;
+	case hwmon_temp_lcrit:
+		err = ufs_get_temp(hba, QUERY_ATTR_IDN_LOW_TEMP_BOUND, val);
+
+		break;
+	case hwmon_temp_input:
+		err = ufs_get_temp(hba, QUERY_ATTR_IDN_CASE_ROUGH_TEMP, val);
+
+		break;
+	default:
+		err = -EOPNOTSUPP;
+
+		break;
+	}
+
+	ufshcd_rpm_put_sync(hba);
+
+	up(&hba->host_sem);
+
+	return err;
+}
+
+static int ufs_hwmon_write(struct device *dev, enum hwmon_sensor_types type, u32 attr, int channel,
+			   long val)
+{
+	struct ufs_hwmon_data *data = dev_get_drvdata(dev);
+	struct ufs_hba *hba = data->hba;
+	int err;
+
+	if (attr != hwmon_temp_enable)
+		return -EINVAL;
+
+	if (val != 0 && val != 1)
+		return -EINVAL;
+
+	down(&hba->host_sem);
+
+	if (!ufshcd_is_user_access_allowed(hba)) {
+		up(&hba->host_sem);
+		return -EBUSY;
+	}
+
+	ufshcd_rpm_get_sync(hba);
+
+	if (val == 1)
+		err = ufshcd_update_ee_usr_mask(hba, MASK_EE_URGENT_TEMP, 0);
+	else
+		err = ufshcd_update_ee_usr_mask(hba, 0, MASK_EE_URGENT_TEMP);
+
+	ufshcd_rpm_put_sync(hba);
+
+	up(&hba->host_sem);
+
+	return err;
+}
+
+static umode_t ufs_hwmon_is_visible(const void *_data, enum hwmon_sensor_types type, u32 attr,
+				    int channel)
+{
+	if (type != hwmon_temp)
+		return 0;
+
+	switch (attr) {
+	case hwmon_temp_enable:
+		return 0644;
+	case hwmon_temp_crit:
+	case hwmon_temp_lcrit:
+	case hwmon_temp_input:
+		return 0444;
+	default:
+		break;
+	}
+	return 0;
+}
+
+static const struct hwmon_channel_info *ufs_hwmon_info[] = {
+	HWMON_CHANNEL_INFO(temp, HWMON_T_ENABLE | HWMON_T_INPUT | HWMON_T_CRIT | HWMON_T_LCRIT),
+	NULL
+};
+
+static const struct hwmon_ops ufs_hwmon_ops = {
+	.is_visible	= ufs_hwmon_is_visible,
+	.read		= ufs_hwmon_read,
+	.write		= ufs_hwmon_write,
+};
+
+static const struct hwmon_chip_info ufs_hwmon_hba_info = {
+	.ops	= &ufs_hwmon_ops,
+	.info	= ufs_hwmon_info,
+};
+
+void ufs_hwmon_probe(struct ufs_hba *hba, u8 mask)
+{
+	struct device *dev = hba->dev;
+	struct ufs_hwmon_data *data;
+	struct device *hwmon;
+
+	data = kzalloc(sizeof(*data), GFP_KERNEL);
+	if (!data)
+		return;
+
+	data->hba = hba;
+	data->mask = mask;
+
+	hwmon = hwmon_device_register_with_info(dev, "ufs", data, &ufs_hwmon_hba_info, NULL);
+	if (IS_ERR(hwmon)) {
+		dev_warn(dev, "Failed to instantiate hwmon device\n");
+		kfree(data);
+		return;
+	}
+
+	hba->hwmon_device = hwmon;
+}
+
+void ufs_hwmon_remove(struct ufs_hba *hba)
+{
+	struct ufs_hwmon_data *data;
+
+	if (!hba->hwmon_device)
+		return;
+
+	data = dev_get_drvdata(hba->hwmon_device);
+	hwmon_device_unregister(hba->hwmon_device);
+	hba->hwmon_device = NULL;
+	kfree(data);
+}

drivers/scsi/ufs/ufs-mediatek.c

@@ -77,6 +77,13 @@ static bool ufs_mtk_is_broken_vcc(struct ufs_hba *hba)
 	return !!(host->caps & UFS_MTK_CAP_BROKEN_VCC);
 }
 
+static bool ufs_mtk_is_pmc_via_fastauto(struct ufs_hba *hba)
+{
+	struct ufs_mtk_host *host = ufshcd_get_variant(hba);
+
+	return (host->caps & UFS_MTK_CAP_PMC_VIA_FASTAUTO);
+}
+
 static void ufs_mtk_cfg_unipro_cg(struct ufs_hba *hba, bool enable)
 {
 	u32 tmp;
@@ -579,6 +586,9 @@ static void ufs_mtk_init_host_caps(struct ufs_hba *hba)
 	if (of_property_read_bool(np, "mediatek,ufs-broken-vcc"))
 		host->caps |= UFS_MTK_CAP_BROKEN_VCC;
 
+	if (of_property_read_bool(np, "mediatek,ufs-pmc-via-fastauto"))
+		host->caps |= UFS_MTK_CAP_PMC_VIA_FASTAUTO;
+
 	dev_info(hba->dev, "caps: 0x%x", host->caps);
 }
 
@@ -754,6 +764,26 @@ out:
 	return err;
 }
 
+static bool ufs_mtk_pmc_via_fastauto(struct ufs_hba *hba,
+	struct ufs_pa_layer_attr *dev_req_params)
+{
+	if (!ufs_mtk_is_pmc_via_fastauto(hba))
+		return false;
+
+	if (dev_req_params->hs_rate == hba->pwr_info.hs_rate)
+		return false;
+
+	if ((dev_req_params->pwr_tx != FAST_MODE) &&
+		(dev_req_params->gear_tx < UFS_HS_G4))
+		return false;
+
+	if ((dev_req_params->pwr_rx != FAST_MODE) &&
+		(dev_req_params->gear_rx < UFS_HS_G4))
+		return false;
+
+	return true;
+}
+
 static int ufs_mtk_pre_pwr_change(struct ufs_hba *hba,
 				  struct ufs_pa_layer_attr *dev_max_params,
 				  struct ufs_pa_layer_attr *dev_req_params)
@@ -763,8 +793,8 @@ static int ufs_mtk_pre_pwr_change(struct ufs_hba *hba,
 	int ret;
 
 	ufshcd_init_pwr_dev_param(&host_cap);
-	host_cap.hs_rx_gear = UFS_HS_G4;
+	host_cap.hs_rx_gear = UFS_HS_G5;
-	host_cap.hs_tx_gear = UFS_HS_G4;
+	host_cap.hs_tx_gear = UFS_HS_G5;
 
 	ret = ufshcd_get_pwr_dev_param(&host_cap,
 				       dev_max_params,
@@ -774,6 +804,32 @@ static int ufs_mtk_pre_pwr_change(struct ufs_hba *hba,
 			__func__);
 	}
 
+	if (ufs_mtk_pmc_via_fastauto(hba, dev_req_params)) {
+		ufshcd_dme_set(hba, UIC_ARG_MIB(PA_TXTERMINATION), true);
+		ufshcd_dme_set(hba, UIC_ARG_MIB(PA_TXGEAR), UFS_HS_G1);
+
+		ufshcd_dme_set(hba, UIC_ARG_MIB(PA_RXTERMINATION), true);
+		ufshcd_dme_set(hba, UIC_ARG_MIB(PA_RXGEAR), UFS_HS_G1);
+
+		ufshcd_dme_set(hba, UIC_ARG_MIB(PA_ACTIVETXDATALANES),
+			dev_req_params->lane_tx);
+		ufshcd_dme_set(hba, UIC_ARG_MIB(PA_ACTIVERXDATALANES),
+			dev_req_params->lane_rx);
+		ufshcd_dme_set(hba, UIC_ARG_MIB(PA_HSSERIES),
+			dev_req_params->hs_rate);
+
+		ufshcd_dme_set(hba, UIC_ARG_MIB(PA_TXHSADAPTTYPE),
+			PA_NO_ADAPT);
+
+		ret = ufshcd_uic_change_pwr_mode(hba,
+			FASTAUTO_MODE << 4 | FASTAUTO_MODE);
+
+		if (ret) {
+			dev_err(hba->dev, "%s: HSG1B FASTAUTO failed ret=%d\n",
+				__func__, ret);
+		}
+	}
+
 	if (host->hw_ver.major >= 3) {
 		ret = ufshcd_dme_configure_adapt(hba,
 					   dev_req_params->gear_tx,

drivers/scsi/ufs/ufs-mediatek.h

@@ -107,6 +107,7 @@ enum ufs_mtk_host_caps {
 	UFS_MTK_CAP_VA09_PWR_CTRL              = 1 << 1,
 	UFS_MTK_CAP_DISABLE_AH8                = 1 << 2,
 	UFS_MTK_CAP_BROKEN_VCC                 = 1 << 3,
+	UFS_MTK_CAP_PMC_VIA_FASTAUTO	       = 1 << 6,
 };
 
 struct ufs_mtk_crypt_cfg {

drivers/scsi/ufs/ufs.h

@@ -14,6 +14,7 @@
 #include <linux/mutex.h>
 #include <linux/types.h>
 #include <linux/android_kabi.h>
+#include <linux/android_vendor.h>
 #include <uapi/scsi/scsi_bsg_ufs.h>
 
 #define GENERAL_UPIU_REQUEST_SIZE (sizeof(struct utp_upiu_req))
@@ -153,6 +154,9 @@ enum attr_idn {
 	QUERY_ATTR_IDN_PSA_STATE		= 0x15,
 	QUERY_ATTR_IDN_PSA_DATA_SIZE		= 0x16,
 	QUERY_ATTR_IDN_REF_CLK_GATING_WAIT_TIME	= 0x17,
+	QUERY_ATTR_IDN_CASE_ROUGH_TEMP          = 0x18,
+	QUERY_ATTR_IDN_HIGH_TEMP_BOUND          = 0x19,
+	QUERY_ATTR_IDN_LOW_TEMP_BOUND           = 0x1A,
 	QUERY_ATTR_IDN_WB_FLUSH_STATUS	        = 0x1C,
 	QUERY_ATTR_IDN_AVAIL_WB_BUFF_SIZE       = 0x1D,
 	QUERY_ATTR_IDN_WB_BUFF_LIFE_TIME_EST    = 0x1E,
@@ -339,6 +343,9 @@ enum {
 
 /* Possible values for dExtendedUFSFeaturesSupport */
 enum {
+	UFS_DEV_LOW_TEMP_NOTIF		= BIT(4),
+	UFS_DEV_HIGH_TEMP_NOTIF		= BIT(5),
+	UFS_DEV_EXT_TEMP_NOTIF		= BIT(6),
 	UFS_DEV_HPB_SUPPORT		= BIT(7),
 	UFS_DEV_WRITE_BOOSTER_SUP	= BIT(8),
 };
@@ -371,6 +378,7 @@ enum {
 	MASK_EE_WRITEBOOSTER_EVENT	= BIT(5),
 	MASK_EE_PERFORMANCE_THROTTLING	= BIT(6),
 };
+#define MASK_EE_URGENT_TEMP (MASK_EE_TOO_HIGH_TEMP | MASK_EE_TOO_LOW_TEMP)
 
 /* Background operation status */
 enum bkops_status {
@@ -606,6 +614,8 @@ struct ufs_dev_info {
 	bool	b_rpm_dev_flush_capable;
 	u8	b_presrv_uspc_en;
 	ANDROID_KABI_RESERVE(1);
+
+	ANDROID_OEM_DATA(1);
 };
 
 /*

drivers/scsi/ufs/ufshcd-pltfrm.c

@@ -108,8 +108,8 @@ out:
 }
 
 #define MAX_PROP_SIZE 32
-static int ufshcd_populate_vreg(struct device *dev, const char *name,
+int ufshcd_populate_vreg(struct device *dev, const char *name,
-		struct ufs_vreg **out_vreg)
+			 struct ufs_vreg **out_vreg)
 {
 	char prop_name[MAX_PROP_SIZE];
 	struct ufs_vreg *vreg = NULL;
@@ -144,6 +144,7 @@ out:
 	*out_vreg = vreg;
 	return 0;
 }
+EXPORT_SYMBOL_GPL(ufshcd_populate_vreg);
 
 /**
  * ufshcd_parse_regulator_info - get regulator info from device tree

drivers/scsi/ufs/ufshcd-pltfrm.h

@@ -32,5 +32,7 @@ void ufshcd_init_pwr_dev_param(struct ufs_dev_params *dev_param);
 int ufshcd_pltfrm_init(struct platform_device *pdev,
 		       const struct ufs_hba_variant_ops *vops);
 void ufshcd_pltfrm_shutdown(struct platform_device *pdev);
+int ufshcd_populate_vreg(struct device *dev, const char *name,
+			 struct ufs_vreg **out_vreg);
 
 #endif /* UFSHCD_PLTFRM_H_ */

drivers/scsi/ufs/ufshcd.c

@@ -253,6 +253,15 @@ static inline void ufshcd_wb_toggle_flush(struct ufs_hba *hba, bool enable);
 static void ufshcd_hba_vreg_set_lpm(struct ufs_hba *hba);
 static void ufshcd_hba_vreg_set_hpm(struct ufs_hba *hba);
 
+static inline int ufshcd_use_mcq_hooks(struct ufs_hba *hba)
+{
+	bool mcq_hooks = false;
+
+	trace_android_vh_ufs_use_mcq_hooks(hba, &mcq_hooks);
+
+	return mcq_hooks;
+}
+
 static inline void ufshcd_enable_irq(struct ufs_hba *hba)
 {
 	if (!hba->is_irq_enabled) {
@@ -366,7 +375,7 @@ static void ufshcd_add_uic_command_trace(struct ufs_hba *hba,
 				 ufshcd_readl(hba, REG_UIC_COMMAND_ARG_3));
 }
 
-static void ufshcd_add_command_trace(struct ufs_hba *hba, unsigned int tag,
+void ufshcd_add_command_trace(struct ufs_hba *hba, unsigned int tag,
 				     enum ufs_trace_str_t str_t)
 {
 	u64 lba = 0;
@@ -409,6 +418,7 @@ static void ufshcd_add_command_trace(struct ufs_hba *hba, unsigned int tag,
 	trace_ufshcd_command(dev_name(hba->dev), str_t, tag,
 			doorbell, transfer_len, intr, lba, opcode, group_id);
 }
+EXPORT_SYMBOL_GPL(ufshcd_add_command_trace);
 
 static void ufshcd_print_clk_freqs(struct ufs_hba *hba)
 {
@@ -1313,6 +1323,8 @@ static int ufshcd_devfreq_target(struct device *dev,
 	struct list_head *clk_list = &hba->clk_list_head;
 	struct ufs_clk_info *clki;
 	unsigned long irq_flags;
+	bool force_out = false;
+	bool force_scaling = false;
 
 	if (!ufshcd_is_clkscaling_supported(hba))
 		return -EINVAL;
@@ -1338,8 +1350,11 @@ static int ufshcd_devfreq_target(struct device *dev,
 	scale_up = (*freq == clki->max_freq) ? true : false;
 	if (!scale_up)
 		*freq = clki->min_freq;
+
+	trace_android_vh_ufs_clock_scaling(hba, &force_out, &force_scaling, &scale_up);
+
 	/* Update the frequency */
-	if (!ufshcd_is_devfreq_scaling_required(hba, scale_up)) {
+	if (force_out || (!force_scaling && !ufshcd_is_devfreq_scaling_required(hba, scale_up))) {
 		spin_unlock_irqrestore(hba->host->host_lock, irq_flags);
 		ret = 0;
 		goto out; /* no state change required */
@@ -1389,6 +1404,7 @@ static int ufshcd_devfreq_get_dev_status(struct device *dev,
 	struct list_head *clk_list = &hba->clk_list_head;
 	struct ufs_clk_info *clki;
 	ktime_t curr_t;
+	bool has_outstanding;
 
 	if (!ufshcd_is_clkscaling_supported(hba))
 		return -EINVAL;
@@ -1417,7 +1433,10 @@ start_window:
 	scaling->window_start_t = curr_t;
 	scaling->tot_busy_t = 0;
 
-	if (hba->outstanding_reqs) {
+	has_outstanding = hba->outstanding_reqs != 0;
+	trace_android_vh_ufs_mcq_has_oustanding_reqs(hba, &has_outstanding);
+
+	if (has_outstanding) {
 		scaling->busy_start_t = curr_t;
 		scaling->is_busy_started = true;
 	} else {
@@ -1983,7 +2002,7 @@ static void ufshcd_exit_clk_gating(struct ufs_hba *hba)
 }
 
 /* Must be called with host lock acquired */
-static void ufshcd_clk_scaling_start_busy(struct ufs_hba *hba)
+void ufshcd_clk_scaling_start_busy(struct ufs_hba *hba)
 {
 	bool queue_resume_work = false;
 	ktime_t curr_t = ktime_get();
@@ -2017,18 +2036,22 @@ static void ufshcd_clk_scaling_start_busy(struct ufs_hba *hba)
 	}
 	spin_unlock_irqrestore(hba->host->host_lock, flags);
 }
+EXPORT_SYMBOL_GPL(ufshcd_clk_scaling_start_busy);
 
-static void ufshcd_clk_scaling_update_busy(struct ufs_hba *hba)
+void ufshcd_clk_scaling_update_busy(struct ufs_hba *hba)
 {
 	struct ufs_clk_scaling *scaling = &hba->clk_scaling;
 	unsigned long flags;
+	bool has_outstanding;
 
 	if (!ufshcd_is_clkscaling_supported(hba))
 		return;
 
 	spin_lock_irqsave(hba->host->host_lock, flags);
 	hba->clk_scaling.active_reqs--;
-	if (!hba->outstanding_reqs && scaling->is_busy_started) {
+	has_outstanding = hba->outstanding_reqs != 0;
+	trace_android_vh_ufs_mcq_has_oustanding_reqs(hba, &has_outstanding);
+	if (!has_outstanding && scaling->is_busy_started) {
 		scaling->tot_busy_t += ktime_to_us(ktime_sub(ktime_get(),
 					scaling->busy_start_t));
 		scaling->busy_start_t = 0;
@@ -2036,6 +2059,7 @@ static void ufshcd_clk_scaling_update_busy(struct ufs_hba *hba)
 	}
 	spin_unlock_irqrestore(hba->host->host_lock, flags);
 }
+EXPORT_SYMBOL_GPL(ufshcd_clk_scaling_update_busy);
 
 static inline int ufshcd_monitor_opcode2dir(u8 opcode)
 {
@@ -2111,6 +2135,11 @@ void ufshcd_send_command(struct ufs_hba *hba, unsigned int task_tag)
 	struct ufshcd_lrb *lrbp = &hba->lrb[task_tag];
 	unsigned long flags;
 
+	if (ufshcd_use_mcq_hooks(hba)) {
+		trace_android_vh_ufs_mcq_send_command(hba, task_tag);
+		return;
+	}
+
 	lrbp->issue_time_stamp = ktime_get();
 	lrbp->compl_time_stamp = ktime_set(0, 0);
 	trace_android_vh_ufs_send_command(hba, lrbp);
@@ -2196,7 +2225,7 @@ int ufshcd_copy_query_response(struct ufs_hba *hba, struct ufshcd_lrb *lrbp)
  */
 static inline int ufshcd_hba_capabilities(struct ufs_hba *hba)
 {
-	int err;
+	int err = 0;
 
 	hba->capabilities = ufshcd_readl(hba, REG_CONTROLLER_CAPABILITIES);
 
@@ -2206,11 +2235,15 @@ static inline int ufshcd_hba_capabilities(struct ufs_hba *hba)
 	((hba->capabilities & MASK_TASK_MANAGEMENT_REQUEST_SLOTS) >> 16) + 1;
 	hba->reserved_slot = hba->nutrs - 1;
 
+	trace_android_vh_ufs_mcq_hba_capabilities(hba, &err);
+	if (err)
+		goto out;
+
 	/* Read crypto capabilities */
 	err = ufshcd_hba_init_crypto_capabilities(hba);
 	if (err)
 		dev_err(hba->dev, "crypto setup failed\n");
-
+out:
 	return err;
 }
 
@@ -2709,6 +2742,9 @@ static int ufshcd_queuecommand(struct Scsi_Host *host, struct scsi_cmnd *cmd)
 	struct ufshcd_lrb *lrbp;
 	int err = 0;
 
+	trace_android_vh_ufs_mcq_map_tag(hba,
+				(scsi_cmd_to_rq(cmd)->mq_hctx->queue_num), &tag);
+
 	WARN_ONCE(tag < 0, "Invalid tag %d\n", tag);
 
 	if (!down_read_trylock(&hba->clk_scaling_lock))
@@ -2764,6 +2800,8 @@ static int ufshcd_queuecommand(struct Scsi_Host *host, struct scsi_cmnd *cmd)
 	lrbp->lun = ufshcd_scsi_to_upiu_lun(cmd->device->lun);
 	lrbp->intr_cmd = !ufshcd_is_intr_aggr_allowed(hba) ? true : false;
 
+	trace_android_vh_ufs_mcq_set_sqid(hba, scsi_cmd_to_rq(cmd)->mq_hctx->queue_num, lrbp);
+
 	ufshcd_prepare_lrbp_crypto(scsi_cmd_to_rq(cmd), lrbp);
 
 	trace_android_vh_ufs_prepare_command(hba, scsi_cmd_to_rq(cmd), lrbp,
@@ -2824,6 +2862,11 @@ ufshcd_clear_cmd(struct ufs_hba *hba, int tag)
 	unsigned long flags;
 	u32 mask = 1 << tag;
 
+	if (ufshcd_use_mcq_hooks(hba)) {
+		trace_android_vh_ufs_mcq_clear_cmd(hba, tag, &err);
+		return err;
+	}
+
 	/* clear outstanding transaction before retry */
 	spin_lock_irqsave(hba->host->host_lock, flags);
 	ufshcd_utrl_clear(hba, tag);
@@ -2900,6 +2943,7 @@ static int ufshcd_wait_for_dev_cmd(struct ufs_hba *hba,
 	int err = 0;
 	unsigned long time_left;
 	unsigned long flags;
+	unsigned long *outstanding_reqs;
 
 	time_left = wait_for_completion_timeout(hba->dev_cmd.complete,
 			msecs_to_jiffies(max_timeout));
@@ -2926,7 +2970,10 @@ static int ufshcd_wait_for_dev_cmd(struct ufs_hba *hba,
 		 * field in hba
 		 */
 		spin_lock_irqsave(&hba->outstanding_lock, flags);
-		__clear_bit(lrbp->task_tag, &hba->outstanding_reqs);
+		outstanding_reqs = &hba->outstanding_reqs;
+		trace_android_vh_ufs_mcq_get_outstanding_reqs(hba,
+								&outstanding_reqs, NULL);
+		__clear_bit(lrbp->task_tag, outstanding_reqs);
 		spin_unlock_irqrestore(&hba->outstanding_lock, flags);
 	}
 
@@ -2963,6 +3010,8 @@ static int ufshcd_exec_dev_cmd(struct ufs_hba *hba,
 
 	hba->dev_cmd.complete = &wait;
 
+	trace_android_vh_ufs_mcq_set_sqid(hba, 0, lrbp);
+
 	ufshcd_add_query_upiu_trace(hba, UFS_QUERY_SEND, lrbp->ucd_req_ptr);
 
 	ufshcd_send_command(hba, tag);
@@ -3579,9 +3628,12 @@ static int ufshcd_get_ref_clk_gating_wait(struct ufs_hba *hba)
 static int ufshcd_memory_alloc(struct ufs_hba *hba)
 {
 	size_t utmrdl_size, utrdl_size, ucdl_size;
+	int pool_size = hba->nutrs;
+
+	trace_android_vh_ufs_mcq_max_tag(hba, &pool_size);
 
 	/* Allocate memory for UTP command descriptors */
-	ucdl_size = (sizeof_utp_transfer_cmd_desc(hba) * hba->nutrs);
+	ucdl_size = (sizeof_utp_transfer_cmd_desc(hba) * pool_size);
 	hba->ucdl_base_addr = dmam_alloc_coherent(hba->dev,
 						  ucdl_size,
 						  &hba->ucdl_dma_addr,
@@ -3604,7 +3656,7 @@ static int ufshcd_memory_alloc(struct ufs_hba *hba)
 	 * Allocate memory for UTP Transfer descriptors
 	 * UFSHCI requires 1024 byte alignment of UTRD
 	 */
-	utrdl_size = (sizeof(struct utp_transfer_req_desc) * hba->nutrs);
+	utrdl_size = (sizeof(struct utp_transfer_req_desc) * pool_size);
 	hba->utrdl_base_addr = dmam_alloc_coherent(hba->dev,
 						   utrdl_size,
 						   &hba->utrdl_dma_addr,
@@ -3634,7 +3686,7 @@ static int ufshcd_memory_alloc(struct ufs_hba *hba)
 
 	/* Allocate memory for local reference block */
 	hba->lrb = devm_kcalloc(hba->dev,
-				hba->nutrs, sizeof(struct ufshcd_lrb),
+				pool_size, sizeof(struct ufshcd_lrb),
 				GFP_KERNEL);
 	if (!hba->lrb) {
 		dev_err(hba->dev, "LRB Memory allocation failed\n");
@@ -3667,6 +3719,9 @@ static void ufshcd_host_memory_configure(struct ufs_hba *hba)
 	u16 prdt_offset;
 	int cmd_desc_size;
 	int i;
+	int pool_size = hba->nutrs;
+
+	trace_android_vh_ufs_mcq_max_tag(hba, &pool_size);
 
 	utrdlp = hba->utrdl_base_addr;
 
@@ -3678,7 +3733,7 @@ static void ufshcd_host_memory_configure(struct ufs_hba *hba)
 	cmd_desc_size = sizeof_utp_transfer_cmd_desc(hba);
 	cmd_desc_dma_addr = hba->ucdl_dma_addr;
 
-	for (i = 0; i < hba->nutrs; i++) {
+	for (i = 0; i < pool_size; i++) {
 		/* Configure UTRD with command descriptor base address */
 		cmd_desc_element_addr =
 				(cmd_desc_dma_addr + (cmd_desc_size * i));
@@ -3762,7 +3817,7 @@ int ufshcd_dme_configure_adapt(struct ufs_hba *hba,
 {
 	int ret;
 
-	if (agreed_gear != UFS_HS_G4)
+	if (agreed_gear < UFS_HS_G4)
 		adapt_val = PA_NO_ADAPT;
 
 	ret = ufshcd_dme_set(hba,
@@ -4051,7 +4106,7 @@ out_unlock:
  *
  * Returns 0 on success, non-zero value on failure
  */
-static int ufshcd_uic_change_pwr_mode(struct ufs_hba *hba, u8 mode)
+int ufshcd_uic_change_pwr_mode(struct ufs_hba *hba, u8 mode)
 {
 	struct uic_command uic_cmd = {0};
 	int ret;
@@ -4076,6 +4131,7 @@ static int ufshcd_uic_change_pwr_mode(struct ufs_hba *hba, u8 mode)
 out:
 	return ret;
 }
+EXPORT_SYMBOL_GPL(ufshcd_uic_change_pwr_mode);
 
 int ufshcd_link_recovery(struct ufs_hba *hba)
 {
@@ -4447,6 +4503,11 @@ int ufshcd_make_hba_operational(struct ufs_hba *hba)
 	int err = 0;
 	u32 reg;
 
+	if (ufshcd_use_mcq_hooks(hba)) {
+		trace_android_vh_ufs_mcq_make_hba_operational(hba, &err);
+		return err;
+	}
+
 	/* Enable required interrupts */
 	ufshcd_enable_intr(hba, UFSHCD_ENABLE_INTRS);
 
@@ -5102,8 +5163,7 @@ ufshcd_scsi_cmd_status(struct ufshcd_lrb *lrbp, int scsi_status)
  *
  * Returns result of the command to notify SCSI midlayer
  */
-static inline int
+int ufshcd_transfer_rsp_status(struct ufs_hba *hba, struct ufshcd_lrb *lrbp)
-ufshcd_transfer_rsp_status(struct ufs_hba *hba, struct ufshcd_lrb *lrbp)
 {
 	int result = 0;
 	int scsi_status;
@@ -5202,6 +5262,7 @@ ufshcd_transfer_rsp_status(struct ufs_hba *hba, struct ufshcd_lrb *lrbp)
 		ufshcd_print_trs(hba, 1 << lrbp->task_tag, true);
 	return result;
 }
+EXPORT_SYMBOL_GPL(ufshcd_transfer_rsp_status);
 
 static bool ufshcd_is_auto_hibern8_error(struct ufs_hba *hba,
 					 u32 intr_mask)
@@ -5328,6 +5389,9 @@ static irqreturn_t ufshcd_transfer_req_compl(struct ufs_hba *hba,
 	unsigned long completed_reqs, flags;
 	u32 tr_doorbell;
 
+	if (ufshcd_use_mcq_hooks(hba))
+		return IRQ_HANDLED;
+
 	/* Resetting interrupt aggregation counters first and reading the
 	 * DOOR_BELL afterward allows us to handle all the completed requests.
 	 * In order to prevent other interrupts starvation the DB is read once
@@ -6078,6 +6142,8 @@ static void ufshcd_err_handler(struct work_struct *work)
 	int err = 0, pmc_err;
 	int tag;
 	bool needs_reset = false, needs_restore = false;
+	unsigned long *outstanding_reqs;
+	int nr_tag;
 
 	hba = container_of(work, struct ufs_hba, eh_work);
 
@@ -6126,7 +6192,11 @@ static void ufshcd_err_handler(struct work_struct *work)
 		ufshcd_print_pwr_info(hba);
 		ufshcd_print_evt_hist(hba);
 		ufshcd_print_tmrs(hba, hba->outstanding_tasks);
-		ufshcd_print_trs(hba, hba->outstanding_reqs, pr_prdt);
+
+		if (ufshcd_use_mcq_hooks(hba))
+			trace_android_vh_ufs_mcq_print_trs(hba, pr_prdt);
+		else
+			ufshcd_print_trs(hba, hba->outstanding_reqs, pr_prdt);
 		spin_lock_irqsave(hba->host->host_lock, flags);
 	}
 
@@ -6163,8 +6233,12 @@ static void ufshcd_err_handler(struct work_struct *work)
 	hba->silence_err_logs = true;
 	/* release lock as clear command might sleep */
 	spin_unlock_irqrestore(hba->host->host_lock, flags);
+	outstanding_reqs = &hba->outstanding_reqs;
+	nr_tag = hba->nutrs;
+	trace_android_vh_ufs_mcq_get_outstanding_reqs(hba,
+								&outstanding_reqs, &nr_tag);
 	/* Clear pending transfer requests */
-	for_each_set_bit(tag, &hba->outstanding_reqs, hba->nutrs) {
+	for_each_set_bit(tag, outstanding_reqs, nr_tag) {
 		if (ufshcd_try_to_abort_task(hba, tag)) {
 			err_xfer = true;
 			goto lock_skip_pending_xfer_clear;
@@ -6466,6 +6540,8 @@ static irqreturn_t ufshcd_sl_intr(struct ufs_hba *hba, u32 intr_status)
 	if (intr_status & UTP_TRANSFER_REQ_COMPL)
 		retval |= ufshcd_transfer_req_compl(hba, /*retry_requests=*/false);
 
+	trace_android_vh_ufs_mcq_handler(hba, intr_status, &retval);
+
 	return retval;
 }
 
@@ -6484,6 +6560,7 @@ static irqreturn_t ufshcd_intr(int irq, void *__hba)
 	irqreturn_t retval = IRQ_NONE;
 	struct ufs_hba *hba = __hba;
 	int retries = hba->nutrs;
+	bool has_outstanding;
 
 	intr_status = ufshcd_readl(hba, REG_INTERRUPT_STATUS);
 	hba->ufs_stats.last_intr_status = intr_status;
@@ -6505,9 +6582,12 @@ static irqreturn_t ufshcd_intr(int irq, void *__hba)
 		intr_status = ufshcd_readl(hba, REG_INTERRUPT_STATUS);
 	}
 
+	has_outstanding = hba->outstanding_reqs != 0;
+	trace_android_vh_ufs_mcq_has_oustanding_reqs(hba, &has_outstanding);
+
 	if (enabled_intr_status && retval == IRQ_NONE &&
 	    (!(enabled_intr_status & UTP_TRANSFER_REQ_COMPL) ||
-	     hba->outstanding_reqs) && !ufshcd_eh_in_progress(hba)) {
+	     has_outstanding) && !ufshcd_eh_in_progress(hba)) {
 		dev_err(hba->dev, "%s: Unhandled interrupt 0x%08x (0x%08x, 0x%08x)\n",
 					__func__,
 					intr_status,
@@ -6698,6 +6778,9 @@ static int ufshcd_issue_devman_upiu_cmd(struct ufs_hba *hba,
 	lrbp->task_tag = tag;
 	lrbp->lun = 0;
 	lrbp->intr_cmd = true;
+
+	trace_android_vh_ufs_mcq_set_sqid(hba, 0, lrbp);
+
 	ufshcd_prepare_lrbp_crypto(NULL, lrbp);
 	hba->dev_cmd.type = cmd_type;
 
@@ -6858,13 +6941,17 @@ static int ufshcd_eh_device_reset_handler(struct scsi_cmnd *cmd)
 		goto out;
 	}
 
-	/* clear the commands that were pending for corresponding LUN */
+	if (ufshcd_use_mcq_hooks(hba)) {
-	for_each_set_bit(pos, &hba->outstanding_reqs, hba->nutrs) {
+		trace_android_vh_ufs_mcq_clear_pending(hba, &err);
-		if (hba->lrb[pos].lun == lun) {
+	} else {
-			err = ufshcd_clear_cmd(hba, pos);
+		/* clear the commands that were pending for corresponding LUN */
-			if (err)
+		for_each_set_bit(pos, &hba->outstanding_reqs, hba->nutrs) {
-				break;
+			if (hba->lrb[pos].lun == lun) {
-			__ufshcd_transfer_req_compl(hba, 1U << pos, false);
+				err = ufshcd_clear_cmd(hba, pos);
+				if (err)
+					break;
+				__ufshcd_transfer_req_compl(hba, 1U << pos, false);
+			}
 		}
 	}
 
@@ -6988,8 +7075,16 @@ static int ufshcd_abort(struct scsi_cmnd *cmd)
 	int err = FAILED;
 	u32 reg;
 
+	trace_android_vh_ufs_mcq_map_tag(hba,
+				(scsi_cmd_to_rq(cmd)->mq_hctx->queue_num), &tag);
+
 	WARN_ONCE(tag < 0, "Invalid tag %d\n", tag);
 
+	if (ufshcd_use_mcq_hooks(hba)) {
+		trace_android_vh_ufs_mcq_abort(cmd, &err);
+		return err;
+	}
+
 	ufshcd_hold(hba, false);
 	reg = ufshcd_readl(hba, REG_UTP_TRANSFER_REQ_DOOR_BELL);
 	/* If command is already aborted/completed, return FAILED. */
@@ -7463,6 +7558,29 @@ wb_disabled:
 	hba->caps &= ~UFSHCD_CAP_WB_EN;
 }
 
+static void ufshcd_temp_notif_probe(struct ufs_hba *hba, u8 *desc_buf)
+{
+	struct ufs_dev_info *dev_info = &hba->dev_info;
+	u32 ext_ufs_feature;
+	u8 mask = 0;
+
+	if (!(hba->caps & UFSHCD_CAP_TEMP_NOTIF) || dev_info->wspecversion < 0x300)
+		return;
+
+	ext_ufs_feature = get_unaligned_be32(desc_buf + DEVICE_DESC_PARAM_EXT_UFS_FEATURE_SUP);
+
+	if (ext_ufs_feature & UFS_DEV_LOW_TEMP_NOTIF)
+		mask |= MASK_EE_TOO_LOW_TEMP;
+
+	if (ext_ufs_feature & UFS_DEV_HIGH_TEMP_NOTIF)
+		mask |= MASK_EE_TOO_HIGH_TEMP;
+
+	if (mask) {
+		ufshcd_enable_ee(hba, mask);
+		ufs_hwmon_probe(hba, mask);
+	}
+}
+
 void ufshcd_fixup_dev_quirks(struct ufs_hba *hba, struct ufs_dev_fix *fixups)
 {
 	struct ufs_dev_fix *f;
@@ -7558,6 +7676,8 @@ static int ufs_get_device_desc(struct ufs_hba *hba)
 
 	ufshcd_wb_probe(hba, desc_buf);
 
+	ufshcd_temp_notif_probe(hba, desc_buf);
+
 	/*
 	 * ufshcd_read_string_desc returns size of the string
 	 * reset the error value
@@ -8246,7 +8366,7 @@ static int ufshcd_setup_hba_vreg(struct ufs_hba *hba, bool on)
 	return ufshcd_toggle_vreg(hba->dev, info->vdd_hba, on);
 }
 
-static int ufshcd_get_vreg(struct device *dev, struct ufs_vreg *vreg)
+int ufshcd_get_vreg(struct device *dev, struct ufs_vreg *vreg)
 {
 	int ret = 0;
 
@@ -8262,6 +8382,7 @@ static int ufshcd_get_vreg(struct device *dev, struct ufs_vreg *vreg)
 out:
 	return ret;
 }
+EXPORT_SYMBOL_GPL(ufshcd_get_vreg);
 
 static int ufshcd_init_vreg(struct ufs_hba *hba)
 {
@@ -9305,6 +9426,7 @@ void ufshcd_remove(struct ufs_hba *hba)
 {
 	if (hba->sdev_ufs_device)
 		ufshcd_rpm_get_sync(hba);
+	ufs_hwmon_remove(hba);
 	ufs_bsg_remove(hba);
 	ufshpb_remove(hba);
 	ufs_sysfs_remove_nodes(hba->dev);
@@ -9472,6 +9594,12 @@ int ufshcd_init(struct ufs_hba *hba, void __iomem *mmio_base, unsigned int irq)
 
 	hba->max_pwr_info.is_valid = false;
 
+	if (ufshcd_use_mcq_hooks(hba)) {
+		trace_android_vh_ufs_mcq_config(hba, &err);
+		if (err)
+			goto out_disable;
+	}
+
 	/* Initialize work queues */
 	snprintf(eh_wq_name, sizeof(eh_wq_name), "ufs_eh_wq_%d",
 		 hba->host->host_no);

drivers/scsi/ufs/ufshcd.h

@@ -224,6 +224,8 @@ struct ufshcd_lrb {
 
 	bool req_abort_skip;
 
+	ANDROID_VENDOR_DATA(1);
+
 	ANDROID_KABI_RESERVE(1);
 };
 
@@ -701,6 +703,12 @@ enum ufshcd_caps {
 	 * in order to exit DeepSleep state.
 	 */
 	UFSHCD_CAP_DEEPSLEEP				= 1 << 10,
+
+	/*
+	 * This capability allows the host controller driver to use temperature
+	 * notification if it is supported by the UFS device.
+	 */
+	UFSHCD_CAP_TEMP_NOTIF				= 1 << 11,
 };
 
 struct ufs_hba_variant_params {
@@ -841,6 +849,10 @@ struct ufs_hba {
 	struct scsi_device *sdev_ufs_device;
 	struct scsi_device *sdev_rpmb;
 
+#ifdef CONFIG_SCSI_UFS_HWMON
+	struct device *hwmon_device;
+#endif
+
 	enum ufs_dev_pwr_mode curr_dev_pwr_mode;
 	enum uic_link_state uic_link_state;
 	/* Desired UFS power management level during runtime PM */
@@ -970,6 +982,9 @@ struct ufs_hba {
 	u32 luns_avail;
 	bool complete_put;
 
+	ANDROID_VENDOR_DATA(1);
+	ANDROID_OEM_DATA_ARRAY(1, 2);
+
 	ANDROID_KABI_RESERVE(1);
 	ANDROID_KABI_RESERVE(2);
 	ANDROID_KABI_RESERVE(3);
@@ -1109,6 +1124,14 @@ static inline u8 ufshcd_wb_get_query_index(struct ufs_hba *hba)
 	return 0;
 }
 
+#ifdef CONFIG_SCSI_UFS_HWMON
+void ufs_hwmon_probe(struct ufs_hba *hba, u8 mask);
+void ufs_hwmon_remove(struct ufs_hba *hba);
+#else
+static inline void ufs_hwmon_probe(struct ufs_hba *hba, u8 mask) {}
+static inline void ufs_hwmon_remove(struct ufs_hba *hba) {}
+#endif
+
 #ifdef CONFIG_PM
 extern int ufshcd_runtime_suspend(struct device *dev);
 extern int ufshcd_runtime_resume(struct device *dev);
@@ -1127,6 +1150,7 @@ extern int ufshcd_dme_get_attr(struct ufs_hba *hba, u32 attr_sel,
 			       u32 *mib_val, u8 peer);
 extern int ufshcd_config_pwr_mode(struct ufs_hba *hba,
 			struct ufs_pa_layer_attr *desired_pwr_mode);
+extern int ufshcd_uic_change_pwr_mode(struct ufs_hba *hba, u8 mode);
 
 /* UIC command interfaces for DME primitives */
 #define DME_LOCAL	0
@@ -1228,6 +1252,7 @@ void ufshcd_map_desc_id_to_length(struct ufs_hba *hba, enum desc_idn desc_id,
 				  int *desc_length);
 
 u32 ufshcd_get_local_unipro_ver(struct ufs_hba *hba);
+int ufshcd_get_vreg(struct device *dev, struct ufs_vreg *vreg);
 
 int ufshcd_send_uic_cmd(struct ufs_hba *hba, struct uic_command *uic_cmd);
 
@@ -1454,4 +1479,10 @@ static inline int ufshcd_rpm_put(struct ufs_hba *hba)
 	return pm_runtime_put(&hba->sdev_ufs_device->sdev_gendev);
 }
 
+int ufshcd_transfer_rsp_status(struct ufs_hba *hba, struct ufshcd_lrb *lrbp);
+void ufshcd_clk_scaling_start_busy(struct ufs_hba *hba);
+void ufshcd_clk_scaling_update_busy(struct ufs_hba *hba);
+void ufshcd_add_command_trace(struct ufs_hba *hba, unsigned int tag,
+				     enum ufs_trace_str_t str_t);
+
 #endif /* End of Header */

drivers/scsi/ufs/unipro.h

@@ -231,6 +231,7 @@ enum ufs_hs_gear_tag {
 	UFS_HS_G2,		/* HS Gear 2 */
 	UFS_HS_G3,		/* HS Gear 3 */
 	UFS_HS_G4,		/* HS Gear 4 */
+	UFS_HS_G5,		/* HS Gear 5 */
 };
 
 enum ufs_unipro_ver {

drivers/staging/android/ashmem.c

@@ -916,6 +916,15 @@ static const struct file_operations ashmem_fops = {
 #endif
 };
 
+/*
+ * is_ashmem_file - Check if struct file* is associated with ashmem
+ */
+int is_ashmem_file(struct file *file)
+{
+	return file->f_op == &ashmem_fops;
+}
+EXPORT_SYMBOL_GPL(is_ashmem_file);
+
 static struct miscdevice ashmem_misc = {
 	.minor = MISC_DYNAMIC_MINOR,
 	.name = "ashmem",

drivers/staging/android/ashmem.h

@@ -21,4 +21,6 @@
 #define COMPAT_ASHMEM_SET_PROT_MASK	_IOW(__ASHMEMIOC, 5, unsigned int)
 #endif
 
+int is_ashmem_file(struct file *file);
+
 #endif	/* _LINUX_ASHMEM_H */

drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c

@@ -462,8 +462,8 @@ check_bss:
 
 		notify_channel = ieee80211_get_channel(wiphy, freq);
 
-		roam_info.channel = notify_channel;
+		roam_info.links[0].channel = notify_channel;
-		roam_info.bssid = cur_network->network.mac_address;
+		roam_info.links[0].bssid = cur_network->network.mac_address;
 		roam_info.req_ie =
 			pmlmepriv->assoc_req+sizeof(struct ieee80211_hdr_3addr)+2;
 		roam_info.req_ie_len =
@@ -2120,6 +2120,7 @@ static u8 rtw_get_chan_type(struct adapter *adapter)
 }
 
 static int cfg80211_rtw_get_channel(struct wiphy *wiphy, struct wireless_dev *wdev,
+				    unsigned int link_id,
 				    struct cfg80211_chan_def *chandef)
 {
 	struct adapter *adapter = wiphy_to_adapter(wiphy);
@@ -2480,7 +2481,8 @@ static int cfg80211_rtw_change_beacon(struct wiphy *wiphy, struct net_device *nd
 	return rtw_add_beacon(adapter, info->head, info->head_len, info->tail, info->tail_len);
 }
 
-static int cfg80211_rtw_stop_ap(struct wiphy *wiphy, struct net_device *ndev)
+static int cfg80211_rtw_stop_ap(struct wiphy *wiphy, struct net_device *ndev,
+				unsigned int link_id)
 {
 	return 0;
 }