A525FXXU4AUJ2

Change-Id: Ie6658c2ce4ebd506356e684fff3a831535e57d1b

arch/arm64/configs/vendor/lineage-a52q_defconfig

@@ -410,6 +410,8 @@ CONFIG_RWSEM_PRIO_AWARE=y
 CONFIG_FREEZER=y
 # CONFIG_OLAF_SUPPORT is not set
 CONFIG_SEC_A52Q_PROJECT=y
+# CONFIG_SEC_A72Q_PROJECT is not set
+# CONFIG_SEC_M42Q_PROJECT is not set
 CONFIG_SEC_A52Q_EUR_OPEN=y
 # CONFIG_SEC_A52Q_LTN_OPEN is not set
 
@@ -5656,6 +5658,7 @@ CONFIG_SEC_LOG_STORE_LPM_KMSG=y
 # CONFIG_SEC_STORE_POWER_ONOFF_HISTORY is not set
 CONFIG_SEC_DEBUG_SCHED_LOG=y
 # CONFIG_SEC_DEBUG_SCHED_LOG_PER_CPU is not set
+# CONFIG_SEC_DEBUG_SCHED_LOG_IRQ_V2 is not set
 # CONFIG_SEC_DEBUG_MSG_LOG is not set
 # CONFIG_SEC_DEBUG_DCVS_LOG is not set
 # CONFIG_SEC_DEBUG_POWER_LOG is not set

drivers/adsp_factory/flip_cover_detector.c

@@ -494,6 +494,8 @@ static int __init flip_cover_detector_factory_init(void)
 
 	fcd_data->poll_delay = ns_to_ktime(MAG_DELAY_MS * NSEC_PER_MSEC);
 
+	snprintf(sysfs_cover_status, 10, "OPEN");
+
 	pr_info("[FACTORY] %s\n", __func__);
 
 	return 0;

drivers/battery/charger/sm5440_charger.c

@@ -12,7 +12,7 @@
 #include <linux/debugfs.h>
 #include <linux/seq_file.h>
 #include <linux/power_supply.h>
-#if defined (CONFIG_OF)
+#if defined(CONFIG_OF)
 #include <linux/of_device.h>
 #include <linux/of_gpio.h>
 #include <linux/pinctrl/consumer.h>
@@ -29,6 +29,8 @@ static bool wireless_4x_charger = 1;
 static int offset_4x;
 #endif
 
+#define SM5440_DC_VERSION  "UF2"
+
 static int sm5440_read_reg(struct sm5440_charger *sm5440, u8 reg, u8 *dest)
 {
 	int i, cnt, ret;
@@ -94,7 +96,7 @@ static int sm5440_write_reg(struct sm5440_charger *sm5440, u8 reg, u8 value)
 	return ret;
 }
 
-static int sm5440_update_reg(struct sm5440_charger *sm5440, u8 reg, 
+static int sm5440_update_reg(struct sm5440_charger *sm5440, u8 reg,
 		u8 val, u8 mask, u8 pos)
 {
 	int ret;
@@ -105,7 +107,9 @@ static int sm5440_update_reg(struct sm5440_charger *sm5440, u8 reg,
 	ret = sm5440_read_reg(sm5440, reg, &old_val);
 
 	if (ret == 0) {
-		u8 new_val = (val & mask) << pos | (old_val & ~(mask << pos));
+		u8 new_val;
+
+		new_val = (val & mask) << pos | (old_val & ~(mask << pos));
 		ret = sm5440_write_reg(sm5440, reg, new_val);
 	}
 
@@ -185,14 +189,16 @@ static struct sm_dc_info *select_sm_dc_info(struct sm5440_charger *sm5440)
 
 static int sm5440_convert_adc(struct sm5440_charger *sm5440, u8 index)
 {
-	struct sm_dc_info *sm_dc = select_sm_dc_info(sm5440);
 	u8 reg1, reg2;
 	int adc;
+#if !defined(CONFIG_SEC_FACTORY)
+	struct sm_dc_info *sm_dc = select_sm_dc_info(sm5440);
 
 	if (sm_dc_get_current_state(sm_dc) < SM_DC_CHECK_VBAT) {
 		/* Didn't worked ADC block during on CHG-OFF status */
-		return 0;
+		return -1;
 	}
+#endif
 
 	switch (index) {
 	case SM5440_ADC_THEM:
@@ -239,7 +245,7 @@ static void sm5440_print_regmap(struct sm5440_charger *sm5440)
 	int i;
 
 	sm5440_bulk_read(sm5440, SM5440_REG_MSK1, 0x1F, regs);
-	sm5440_bulk_read(sm5440, SM5440_REG_MSK1 + 0x1F, 
+	sm5440_bulk_read(sm5440, SM5440_REG_MSK1 + 0x1F,
 			print_reg_num - 0x1F, regs + 0x1F);
 
 	for (i = 0; i < print_reg_num; ++i) {
@@ -304,14 +310,16 @@ static int sm5440_sw_reset(struct sm5440_charger *sm5440)
 	sm5440_write_reg(sm5440, SM5440_REG_CNTL1, 0x1);        /* Do SW RESET */
 
 	for (i = 0; i < 0xff; ++i) {
-		msleep(20);
+		usleep_range(1000, 2000);
 		sm5440_read_reg(sm5440, SM5440_REG_CNTL1, &reg);
 		if (!(reg & 0x1))
 			break;
 	}
 
-	if (i == 0xff)
+	if (i == 0xff) {
+		dev_err(sm5440->dev, "%s: didn't clear reset bit\n", __func__);
 		return -EBUSY;
+	}
 
 	return 0;
 }
@@ -346,7 +354,7 @@ static int sm5440_reverse_boost_enable(struct sm5440_charger *sm5440, bool enabl
 }
 
 static int sm5440_set_ENHIZ(struct sm5440_charger *sm5440, bool vbus, bool chg_en)
-{   
+{
 	u8 enhiz = 0;   /* case : chg_on or chg_off & vbus_uvlo */
 
 	if (vbus && !(chg_en))
@@ -374,6 +382,7 @@ static bool sm5440_check_charging_enable(struct sm5440_charger *sm5440)
 static void set_divide4_mode(struct sm5440_charger *sm5440, int mode)
 {
 	union power_supply_propval value;
+
 	pr_info("%s: %d\n", __func__, mode);
 
 	value.intval = 1;
@@ -459,10 +468,28 @@ static int get_apdo_max_power(struct sm5440_charger *sm5440, struct sm_dc_power_
 	return ret;
 }
 
+static void sm5440_init_reg_param(struct sm5440_charger *sm5440)
+{
+	sm5440_set_wdt_timer(sm5440, WDT_TIMER_S_30);
+	sm5440_set_freq(sm5440, sm5440->pdata->freq);
+
+	sm5440_write_reg(sm5440, SM5440_REG_CNTL2, 0xF2);               /* disable IBUSOCP,IBATOCP,THEM */
+	sm5440_write_reg(sm5440, SM5440_REG_CNTL3, 0xB8);               /* disable CHGTMR */
+	sm5440_write_reg(sm5440, SM5440_REG_CNTL4, 0xFF);               /* used DEB:8ms */
+	sm5440_write_reg(sm5440, SM5440_REG_CNTL6, 0x09);               /* forced PWM mode, disable ENHIZ */
+	sm5440_update_reg(sm5440, SM5440_REG_VBUSCNTL, 0x7, 0x7, 0);    /* VBUS_OVP_TH=11V */
+	sm5440_write_reg(sm5440, SM5440_REG_VOUTCNTL, 0x3F);            /* VOUT=max */
+	sm5440_write_reg(sm5440, SM5440_REG_PRTNCNTL, 0xFE);            /* OCP,OVP setting */
+	sm5440_update_reg(sm5440, SM5440_REG_ADCCNTL1, 1, 0x1, 3);      /* ADC average sample = 32 */
+	sm5440_write_reg(sm5440, SM5440_REG_ADCCNTL2, 0xDF);            /* ADC channel setting */
+	sm5440_write_reg(sm5440, SM5440_REG_THEMCNTL1, 0x0C);           /* Thermal Regulation threshold = 120'C */
+}
+
 static int sm5440_start_charging(struct sm5440_charger *sm5440)
 {
 	struct sm_dc_info *sm_dc = select_sm_dc_info(sm5440);
 	struct sm_dc_power_source_info ta;
+	int state = sm_dc_get_current_state(sm_dc);
 	int ret;
 
 	if (sm5440->cable_online < 1) {
@@ -470,6 +497,17 @@ static int sm5440_start_charging(struct sm5440_charger *sm5440)
 				__func__, sm5440->cable_online);
 		return -ENODEV;
 	}
+
+	if (state < SM_DC_CHECK_VBAT) {
+		dev_info(sm5440->dev, "%s: charging off state (state=%d)\n", __func__, state);
+		ret = sm5440_sw_reset(sm5440);
+		if (ret < 0) {
+			dev_err(sm5440->dev, "%s: fail to sw reset(ret=%d)\n", __func__, ret);
+			return ret;
+		}
+		sm5440_init_reg_param(sm5440);
+	}
+
 #if defined(MULTIPLE_4X)
 	ret = get_wpc_mfd_max_power(sm5440, &ta);
 	if (ret < 0) {
@@ -478,9 +516,9 @@ static int sm5440_start_charging(struct sm5440_charger *sm5440)
 	}
 
 	/* 0 : DA935X_STATE_OFF
-	* 1 : DA935X_STATE_ONLINE_BYPASS
-	* 2 : DA935X_STATE_ONLINE_CONVERT
-	*/
+	 * 1 : DA935X_STATE_ONLINE_BYPASS
+	 * 2 : DA935X_STATE_ONLINE_CONVERT
+	 */
 
 	set_divide4_mode(sm5440, 2);
 	{
@@ -666,7 +704,7 @@ static const char *sm5440_dc_state_str[] = {
 	"NO_CHARGING", "DC_ERR", "CHARGING_DONE", "CHECK_VBAT", "PRESET_DC", 
 	"ADJUST_CC", "UPDATE_BAT", "CC_MODE", "CV_MODE"
 };
-static int psy_chg_get_ext_direct_charger_chg_status(struct sm5440_charger *sm5440, 
+static int psy_chg_get_ext_direct_charger_chg_status(struct sm5440_charger *sm5440,
 		union power_supply_propval *val)
 {
 	struct sm_dc_info *sm_dc = select_sm_dc_info(sm5440);
@@ -683,7 +721,7 @@ static int sm5440_chg_get_property(struct power_supply *psy,
 		union power_supply_propval *val)
 {
 	struct sm5440_charger *sm5440 = power_supply_get_drvdata(psy);
-	enum power_supply_ext_property ext_psp = 
+	enum power_supply_ext_property ext_psp =
 		(enum power_supply_ext_property) psp;
 
 	dev_info(sm5440->dev, "%s: psp=%d\n", __func__, psp);
@@ -724,6 +762,7 @@ static int sm5440_chg_get_property(struct power_supply *psy,
 #if defined(MULTIPLE_4X)
 			{
 				union power_supply_propval value;
+
 				dev_err(sm5440->dev, "%s: %d\n", __func__, ext_psp);
 				psy_do_property("da935x-usb", get,
 						(enum power_supply_property)ext_psp, value);
@@ -758,6 +797,8 @@ static int psy_chg_set_online(struct sm5440_charger *sm5440, int online)
 {
 	struct sm_dc_info *sm_dc = select_sm_dc_info(sm5440);
 	int ret = 0;
+	u8 vbus_pok = 0x0;
+	u8 reg = 0x0;
 
 	dev_info(sm5440->dev, "%s: online=%d\n", __func__, online);
 
@@ -768,7 +809,11 @@ static int psy_chg_set_online(struct sm5440_charger *sm5440, int online)
 	}
 	sm5440->cable_online = online;
 
-	sm5440->vbus_in = sm5440->cable_online > 1 ? true : false;
+	sm5440_read_reg(sm5440, SM5440_REG_STATUS3, &reg);
+	dev_info(sm5440->dev, "%s: STATUS3=0x%x\n", __func__, reg);
+	vbus_pok = (reg >> 5) & 0x1;
+
+	sm5440->vbus_in = vbus_pok;
 	sm5440_set_ENHIZ(sm5440, sm5440->vbus_in, sm5440_check_charging_enable(sm5440));
 
 	if (sm5440->wpc_dc) {
@@ -828,10 +873,13 @@ static int psy_chg_set_input_curr(struct sm5440_charger *sm5440, int ibus)
 
 static int psy_chg_ext_direct_float_max(struct sm5440_charger *sm5440, int max_vbat)
 {
+	struct sm_dc_info *sm_dc = select_sm_dc_info(sm5440);
+	
 	dev_info(sm5440->dev, "%s: max_vbat [%dmA] to [%dmA]\n",
 			__func__, sm5440->max_vbat, max_vbat);
 
 	sm5440->max_vbat = max_vbat;
+	sm_dc->config.chg_float_voltage = max_vbat;
 
 	return 0;
 
@@ -849,20 +897,21 @@ static int psy_chg_ext_wdt_control(struct sm5440_charger *sm5440, int wdt_contro
 	return 0;
 }
 
+static int sm5440_set_adc_mode(struct i2c_client *i2c, u8 mode);
 
 static int sm5440_chg_set_property(struct power_supply *psy,
 		enum power_supply_property psp,
 		const union power_supply_propval *val)
 {
 	struct sm5440_charger *sm5440 = power_supply_get_drvdata(psy);
-	enum power_supply_ext_property ext_psp = 
+	enum power_supply_ext_property ext_psp =
 		(enum power_supply_ext_property) psp;
 
-	int ret;
+	int ret = 0;
 
 	dev_info(sm5440->dev, "%s: psp=%d, val-intval=%d\n", __func__, psp, val->intval);
 
-	switch (psp) {	
+	switch (psp) {
 	case POWER_SUPPLY_PROP_ONLINE:
 		psy_chg_set_online(sm5440, val->intval);
 		break;
@@ -899,10 +948,10 @@ static int sm5440_chg_set_property(struct power_supply *psy,
 			ret = psy_chg_ext_direct_float_max(sm5440, val->intval);
 			break;
 		case POWER_SUPPLY_EXT_PROP_DIRECT_ADC_CTRL:
-			/**
-			 *  Need to check operation details.. by SEC.
-			 */
-			dev_err(sm5440->dev, "%s: need to works\n", __func__);
+			if (val->intval)
+				sm5440_set_adc_mode(sm5440->i2c, SM_DC_ADC_MODE_ONESHOT);
+			else
+				sm5440_set_adc_mode(sm5440->i2c, SM_DC_ADC_MODE_OFF);
 			break;
 #if defined(MULTIPLE_4X)
 		case POWER_SUPPLY_EXT_PROP_CHARGE_BOOST:
@@ -947,7 +996,7 @@ static const struct power_supply_desc sm5440_charger_power_supply_desc = {
 	.name		= "sm5440-charger",
 	.type		= POWER_SUPPLY_TYPE_UNKNOWN,
 	.get_property	= sm5440_chg_get_property,
-	.set_property 	= sm5440_chg_set_property,
+	.set_property	= sm5440_chg_set_property,
 	.properties	= sm5440_charger_props,
 	.num_properties	= ARRAY_SIZE(sm5440_charger_props),
 };
@@ -1207,6 +1256,7 @@ static int sm5440_send_wpc_msg(struct i2c_client *i2c, struct sm_dc_power_source
 
 	if (is_hv_wireless_type(sm5440->cable_online)) {
 		union power_supply_propval value;
+
 		value.intval = pps_v;
 		ret = psy_do_property("mfc-charger", set, POWER_SUPPLY_EXT_PROP_WIRELESS_SET_VOUT, value);
 	} else {
@@ -1247,13 +1297,13 @@ static void sm5440_adc_work(struct work_struct *work)
 
 static void sm5440_ocp_check_work(struct work_struct *work)
 {
-	struct sm5440_charger *sm5440 = container_of(work, struct sm5440_charger, 
+	struct sm5440_charger *sm5440 = container_of(work, struct sm5440_charger,
 			ocp_check_work.work);
 	struct sm_dc_info *sm_dc = select_sm_dc_info(sm5440);
 	int i;
 	u8 reg;
 
-	for (i=0; i < 3; ++i) {
+	for (i = 0; i < 3; ++i) {
 		sm5440_read_reg(sm5440, SM5440_REG_STATUS2, &reg);
 		if (reg & (0x1 << 7)) { /* activate IBUSLIM */
 			dev_err(sm5440->dev, "%s: detect IBUSLIM (i=%d)\n", __func__, i);
@@ -1332,7 +1382,7 @@ static irqreturn_t sm5440_irq_thread(int irq, void *data)
 		dev_info(sm5440->dev, "%s: VBUS UVLO detected\n", __func__);
 		psy_do_property("da935x-wireless", get,
 				POWER_SUPPLY_PROP_ONLINE, value);
-		pr_info("%s: DC Error Occured. Check da9352 wireless online : %d\n",
+		pr_info("%s: DC Error Occurred. Check da9352 wireless online : %d\n",
 				__func__, value.intval);
 		if (value.intval == 2)
 			sm5440_irq_vbus_uvlo(sm5440);
@@ -1371,7 +1421,7 @@ static int sm5440_irq_init(struct sm5440_charger *sm5440)
 	sm5440_write_reg(sm5440, SM5440_REG_MSK3, 0x18);
 	sm5440_write_reg(sm5440, SM5440_REG_MSK4, 0xF8);
 
-	ret = request_threaded_irq(sm5440->irq, NULL, sm5440_irq_thread, 
+	ret = request_threaded_irq(sm5440->irq, NULL, sm5440_irq_thread,
 			IRQF_TRIGGER_LOW | IRQF_ONESHOT,
 			"sm5440-irq", sm5440);
 	if (ret) {
@@ -1397,19 +1447,7 @@ static int sm5440_hw_init_config(struct sm5440_charger *sm5440)
 	}
 	sm5440->pdata->rev_id = (reg >> 4) & 0xf;
 
-	sm5440_set_wdt_timer(sm5440, WDT_TIMER_S_30);
-	sm5440_set_freq(sm5440, sm5440->pdata->freq);
-
-	sm5440_write_reg(sm5440, SM5440_REG_CNTL2, 0xF2);               /* disable IBUSOCP,IBATOCP,THEM */
-	sm5440_write_reg(sm5440, SM5440_REG_CNTL3, 0xB8);               /* disable CHGTMR */
-	sm5440_write_reg(sm5440, SM5440_REG_CNTL4, 0xFF);               /* used DEB:8ms */
-	sm5440_write_reg(sm5440, SM5440_REG_CNTL6, 0x09);               /* forced PWM mode, disable ENHIZ */
-	sm5440_update_reg(sm5440, SM5440_REG_VBUSCNTL, 0x7, 0x7, 0);    /* VBUS_OVP_TH=11V */
-	sm5440_write_reg(sm5440, SM5440_REG_VOUTCNTL, 0x3F);            /* VOUT=max */
-	sm5440_write_reg(sm5440, SM5440_REG_PRTNCNTL, 0xFE);            /* OCP,OVP setting */
-	sm5440_update_reg(sm5440, SM5440_REG_ADCCNTL1, 1, 0x1, 3);      /* ADC average sample = 32 */
-	sm5440_write_reg(sm5440, SM5440_REG_ADCCNTL2, 0xDF);            /* ADC channel setting */
-	sm5440_write_reg(sm5440, SM5440_REG_THEMCNTL1, 0x0C);           /* Thermal Regulation threshold = 120'C */
+	sm5440_init_reg_param(sm5440);
 
 #if defined(CONFIG_BATTERY_SAMSUNG)
 	psy_chg_set_const_chg_voltage(sm5440, sm5440->pdata->battery.chg_float_voltage);
@@ -1419,7 +1457,7 @@ static int sm5440_hw_init_config(struct sm5440_charger *sm5440)
 }
 
 #if defined(CONFIG_OF)
-static int sm5440_charger_parse_dt(struct device *dev, 
+static int sm5440_charger_parse_dt(struct device *dev,
 		struct sm5440_platform_data *pdata)
 {
 	struct device_node *np_sm5440 = dev->of_node;
@@ -1427,7 +1465,7 @@ static int sm5440_charger_parse_dt(struct device *dev,
 	int ret;
 
 	/* Parse: sm5440 node */
-	if(!np_sm5440) {
+	if (!np_sm5440) {
 		dev_err(dev, "%s: empty of_node for sm5440_dev\n", __func__);
 		return -EINVAL;
 	}
@@ -1442,7 +1480,7 @@ static int sm5440_charger_parse_dt(struct device *dev,
 
 	/* Parse: battery node */
 	np_battery = of_find_node_by_name(NULL, "battery");
-	if(!np_battery) {
+	if (!np_battery) {
 		dev_err(dev, "%s: empty of_node for battery\n", __func__);
 		return -EINVAL;
 	}
@@ -1667,7 +1705,7 @@ static int sm5440_dbg_write_reg(void *data, u64 val)
 
 	return 0;
 }
-DEFINE_SIMPLE_ATTRIBUTE(register_debug_ops, sm5440_dbg_read_reg, 
+DEFINE_SIMPLE_ATTRIBUTE(register_debug_ops, sm5440_dbg_read_reg,
 		sm5440_dbg_write_reg, "0x%02llx\n");
 
 static int sm5440_create_debugfs_entries(struct sm5440_charger *sm5440)
@@ -1859,7 +1897,6 @@ static int sm5440_charger_remove(struct i2c_client *i2c)
 	struct sm5440_charger *sm5440 = i2c_get_clientdata(i2c);
 
 	sm5440_stop_charging(sm5440);
-	sm5440_sw_reset(sm5440);
 
 	power_supply_unregister(sm5440->psy_chg);
 	mutex_destroy(&sm5440->i2c_lock);
@@ -1938,7 +1975,7 @@ static struct i2c_driver sm5440_charger_driver = {
 #endif  /* CONFIG_OF */
 #if defined(CONFIG_PM)
 		.pm = &sm5440_pm_ops,
-#endif  /* CONFIG_PM */  
+#endif  /* CONFIG_PM */
 	},
 	.probe        = sm5440_charger_probe,
 	.remove       = sm5440_charger_remove,

drivers/battery/charger/sm_direct_charger.c

@@ -30,7 +30,7 @@ static u32 pps_v(u32 vol)
 }
 
 static u32 pps_c(u32 cur)
-{   
+{
 	if ((cur % PPS_C_STEP) >= (PPS_C_STEP / 2))
 		cur += PPS_C_STEP;
 
@@ -144,13 +144,13 @@ static int update_work_state(struct sm_dc_info *sm_dc, u8 state)
 		pr_info("%s %s: changed chg param, request: update_bat\n", sm_dc->name, __func__);
 		request_state_work(sm_dc, SM_DC_UPDAT_BAT, DELAY_NONE);
 		ret = -EINVAL;
-	} else {
-		if (sm_dc->state != state) {
-			mutex_lock(&sm_dc->st_lock);
-			sm_dc->state = state;
-			mutex_unlock(&sm_dc->st_lock);
-			report_dc_state(sm_dc);
-		}
+	}
+
+	if (sm_dc->state != state) {
+		mutex_lock(&sm_dc->st_lock);
+		sm_dc->state = state;
+		mutex_unlock(&sm_dc->st_lock);
+		report_dc_state(sm_dc);
 	}
 
 	return ret;
@@ -165,7 +165,7 @@ static int send_power_source_msg(struct sm_dc_info *sm_dc)
 
 	if (sm_dc->ta.v > sm_dc->ta.v_max || sm_dc->ta.c > sm_dc->ta.c_max) {
 		pr_err("%s %s: ERROR: out of bounce v=%dmV(max=%dmV) c=%dmA(max=%dmA)\n",
-			sm_dc->name, __func__, sm_dc->ta.v, sm_dc->ta.v_max, 
+			sm_dc->name, __func__, sm_dc->ta.v, sm_dc->ta.v_max,
 			sm_dc->ta.c, sm_dc->ta.c_max);
 
 		sm_dc->err = SM_DC_ERR_SEND_PD_MSG;
@@ -243,7 +243,7 @@ static int check_error_state(struct sm_dc_info *sm_dc, u8 retry_state)
 	return 0;
 }
 
-static int get_adc_values(struct sm_dc_info *sm_dc, const char *str, int *vbus, int *ibus, int *vout, 
+static int get_adc_values(struct sm_dc_info *sm_dc, const char *str, int *vbus, int *ibus, int *vout,
 		int *vbat, int *ibat, int *them, int *dietemp)
 {
 	int adc_vbus, adc_ibus, adc_vout, adc_vbat, adc_ibat, adc_them, adc_dietemp;
@@ -311,7 +311,19 @@ static inline u32 _calc_pps_v_init_offset(struct sm_dc_info *sm_dc)
 	offset = (sm_dc->ta.c * (sm_dc->config.pps_lr + sm_dc->config.rpara +
 				(sm_dc->config.rsns * 2) + (sm_dc->config.rpcm * 2))) / 1000000;
 	offset += 200;   /* add to extra initial offset */
-	pr_info("%s %s: pps_c=%dmA, v_init_offset=%d\n", sm_dc->name, __func__, sm_dc->ta.c, offset);
+	pr_info("%s %s: pps_c=%dmA, v_init_offset=%dmV\n", sm_dc->name, __func__, sm_dc->ta.c, offset);
+
+	return offset;
+}
+
+static inline u32 _calc_ibus_voffset(struct sm_dc_info *sm_dc, int adc_ibus)
+{
+	u32 offset;
+
+	offset = ((sm_dc->ta.c - adc_ibus) * (sm_dc->config.pps_lr + sm_dc->config.rpara +
+		(sm_dc->config.rsns * 2) + (sm_dc->config.rpcm * 2))) / 1000000;
+	offset = pps_v((offset > PPS_V_STEP * 10) ? (PPS_V_STEP * 10) : offset);
+	pr_info("%s %s: offset=%dmV\n", sm_dc->name, __func__, offset);
 
 	return offset;
 }
@@ -362,8 +374,8 @@ static inline int _pd_pre_cc_check_limitation(struct sm_dc_info *sm_dc, int adc_
 	}
 
 	if ((adc_ibus > sm_dc->ta.c - PRE_CC_ST_IBUS_OFFSET) &&
-			(adc_vbus < sm_dc->wq.prev_adc_vbus + (PPS_V_STEP/2)) &&
-			(adc_ibus < sm_dc->wq.prev_adc_ibus + (PPS_C_STEP)) &&
+			(adc_vbus < sm_dc->wq.prev_adc_vbus + (PPS_V_STEP * 2)) &&
+			(adc_ibus < sm_dc->wq.prev_adc_ibus + (PPS_C_STEP * 2)) &&
 			(sm_dc->wq.c_down == 0 && sm_dc->wq.pps_cl == 0)) {
 		ret = 1;
 	} else if (sm_dc->wq.ci_gl == sm_dc->config.ta_min_current) {     /* Case: didn't reduce PPS_C than TA_MIN_C */
@@ -385,7 +397,7 @@ static inline int _pd_pre_cc_check_limitation(struct sm_dc_info *sm_dc, int adc_
 	return ret;
 }
 
-static inline int _try_to_adjust_cc(struct sm_dc_info *sm_dc)
+static inline int _try_to_adjust_cc_up(struct sm_dc_info *sm_dc)
 {
 	sm_dc->wq.cc_cnt += 1;
 
@@ -396,15 +408,19 @@ static inline int _try_to_adjust_cc(struct sm_dc_info *sm_dc)
 				sm_dc->ta.v = sm_dc->ta.v_max;
 		} else {
 			sm_dc->ta.c += PPS_C_STEP;
+			if (sm_dc->ta.c > sm_dc->ta.c_max)
+				sm_dc->ta.c = sm_dc->ta.c_max;
 		}
 	} else {
-		if (sm_dc->ta.c + PPS_C_STEP <= sm_dc->target_ibus)
+		if (sm_dc->ta.c + PPS_C_STEP <= sm_dc->target_ibus) {
 			sm_dc->ta.c += PPS_C_STEP;
+			if (sm_dc->ta.c > sm_dc->ta.c_max)
+				sm_dc->ta.c = sm_dc->ta.c_max;
+		}
 	}
-
 	if ((sm_dc->ta.v * sm_dc->ta.c >= sm_dc->ta.p_max) ||
 		(sm_dc->ta.v == sm_dc->ta.v_max) || (sm_dc->ta.c == sm_dc->ta.c_max)) {
-		pr_info("%s %s: PPS-TA has been reached limitation(v=%dmV, c=%dmA)\n", 
+		pr_info("%s %s: PPS-TA has been reached limitation(v=%dmV, c=%dmA)\n",
 			sm_dc->name, __func__, sm_dc->ta.v, sm_dc->ta.c);
 		sm_dc->wq.cc_limit = 1;
 
@@ -414,6 +430,17 @@ static inline int _try_to_adjust_cc(struct sm_dc_info *sm_dc)
 	return 0;
 }
 
+static inline void _try_to_adjust_cc_down(struct sm_dc_info *sm_dc)
+{
+	sm_dc->wq.cc_cnt += 1;
+
+	if (sm_dc->wq.cc_cnt % 2)
+		sm_dc->ta.c -= PPS_C_STEP;
+	else
+		sm_dc->ta.v -= PPS_V_STEP;
+
+	return;
+}
 
 static void pd_check_vbat_work(struct work_struct *work)
 {
@@ -542,6 +569,18 @@ static void pd_pre_cc_work(struct work_struct *work)
 				return;
 		}
 		sm_dc->ta.c -= PPS_C_STEP;
+		if(sm_dc->ta.c < sm_dc->config.ta_min_current) {
+			sm_dc->ta.c = sm_dc->config.ta_min_current;
+			pr_info("%s %s: can't used less then ta_min_current\n",
+				sm_dc->name, __func__);
+			sm_dc->ta.v -= PPS_V_STEP;
+			if(sm_dc->ta.v < sm_dc->config.ta_min_voltage) {
+				pr_err("%s %s: SM_DC_ERR_FAIL_ADJUST\n", sm_dc->name, __func__);
+				sm_dc->err = SM_DC_ERR_FAIL_ADJUST;
+				request_state_work(sm_dc, SM_DC_ERR, DELAY_NONE);
+				return;
+			}
+		}
 		ret = send_power_source_msg(sm_dc);
 		if (ret < 0)
 			return;
@@ -581,7 +620,9 @@ static void pd_pre_cc_work(struct work_struct *work)
 		return;
 	}
 
-	if ((sm_dc->wq.pps_cl) && (sm_dc->ta.v * (sm_dc->ta.c + PPS_C_STEP) >= sm_dc->ta.p_max)) {
+	if ((sm_dc->wq.pps_cl) &&
+		((sm_dc->ta.v * (sm_dc->ta.c + PPS_C_STEP) >= sm_dc->ta.p_max) ||
+		((sm_dc->ta.c + PPS_C_STEP) >= sm_dc->ta.c_max))) {
 		sm_dc->wq.c_offset = 0;
 		sm_dc->wq.cc_limit = 0;
 		sm_dc->wq.cc_cnt = 0;
@@ -590,22 +631,48 @@ static void pd_pre_cc_work(struct work_struct *work)
 		request_state_work(sm_dc, SM_DC_CC, DELAY_ADC_UPDATE);
 		return;
 	}
+#if defined(CONFIG_SEC_FACTORY)
+	if (sm_dc->wq.pps_cl) {
+		if ((adc_ibus < sm_dc->wq.ci_gl - (PPS_C_STEP * 12)) &&
+			(sm_dc->ta.c < sm_dc->wq.ci_gl - (PPS_C_STEP * 12)))
+			sm_dc->ta.c += (PPS_C_STEP * 10);
+		else if ((adc_ibus < sm_dc->wq.ci_gl - (PPS_C_STEP * 7)) &&
+			(sm_dc->ta.c < sm_dc->wq.ci_gl - (PPS_C_STEP * 7)))
+			sm_dc->ta.c += (PPS_C_STEP * 5);
+		else if ((adc_ibus < sm_dc->wq.ci_gl - (PPS_C_STEP * 4)) &&
+			(sm_dc->ta.c < sm_dc->wq.ci_gl - (PPS_C_STEP * 4)))
+			sm_dc->ta.c += (PPS_C_STEP * 2);
+		else
+			sm_dc->ta.c += PPS_C_STEP;
 
+		ret = send_power_source_msg(sm_dc);
+		if (ret < 0)
+			return;
+		sm_dc->wq.c_up = 1;
+		sm_dc->wq.c_down = 0;
+	} else {
+		if (((adc_ibus < sm_dc->ta.c - (PPS_C_STEP * 4)) && (sm_dc->wq.v_up != 1)) ||
+			(adc_ibus < sm_dc->wq.prev_adc_ibus - PPS_C_STEP))
+			sm_dc->ta.v += _calc_ibus_voffset(sm_dc, adc_ibus);
+		else
+			sm_dc->ta.v += PPS_V_STEP * 2;
+		ret = send_power_source_msg(sm_dc);
+		if (ret < 0)
+			return;
+		sm_dc->wq.v_up = 1;
+		sm_dc->wq.v_down = 0;
+	}
+#else
 	if (sm_dc->wq.pps_cl) {
 		if ((adc_ibus < sm_dc->wq.ci_gl - (PPS_C_STEP * 6)) &&
 				(sm_dc->ta.c < ((sm_dc->wq.ci_gl * 90)/100)))
-#if defined(CONFIG_SEC_FACTORY)
-			sm_dc->ta.c += (PPS_C_STEP * 5);
-#else
 			sm_dc->ta.c += (PPS_C_STEP * 3);
-#endif
 		else
 			sm_dc->ta.c += PPS_C_STEP;
 
 		ret = send_power_source_msg(sm_dc);
 		if (ret < 0)
 			return;
-
 		sm_dc->wq.c_up = 1;
 		sm_dc->wq.c_down = 0;
 	} else {
@@ -613,10 +680,10 @@ static void pd_pre_cc_work(struct work_struct *work)
 		ret = send_power_source_msg(sm_dc);
 		if (ret < 0)
 			return;
-
 		sm_dc->wq.v_up = 1;
 		sm_dc->wq.v_down = 0;
 	}
+#endif
 
 	sm_dc->wq.prev_adc_vbus = adc_vbus;
 	sm_dc->wq.prev_adc_ibus = adc_ibus;
@@ -659,6 +726,18 @@ static void pd_cc_work(struct work_struct *work)
 		break;
 	}
 
+	/* CC_STEP_DOWN */
+	if (sm_dc->wq.ci_gl + CC_ST_IBUS_OFFSET < adc_ibus && (sm_dc->wq.cc_limit == 0)) {
+		_try_to_adjust_cc_down(sm_dc);
+		if (sm_dc->config.support_pd_remain) {
+			ret = send_power_source_msg(sm_dc);
+			if (ret < 0)
+				return;
+		}
+		request_state_work(sm_dc, SM_DC_CC, DELAY_ADC_UPDATE);
+		return;
+	}
+
 	if (adc_ibus >= sm_dc->wq.ci_gl - CC_ST_IBUS_OFFSET || sm_dc->wq.cc_limit) {
 		if (sm_dc->config.support_pd_remain) {
 			ret = send_power_source_msg(sm_dc);
@@ -669,7 +748,8 @@ static void pd_cc_work(struct work_struct *work)
 		return;
 	}
 
-	ret = _try_to_adjust_cc(sm_dc);
+	/* CC_STEP_UP */
+	ret = _try_to_adjust_cc_up(sm_dc);
 	if (ret < 0) {
 		if (sm_dc->config.support_pd_remain) {
 			ret = send_power_source_msg(sm_dc);
@@ -724,6 +804,13 @@ static void pd_cv_work(struct work_struct *work)
 			return;
 
 		delay = DELAY_PPS_UPDATE;
+	} else if (loop_status & LOOP_THEMREG) {
+		if (sm_dc->config.support_pd_remain) {
+			ret = send_power_source_msg(sm_dc);
+			if (ret < 0)
+				return;
+		}
+		delay = DELAY_PPS_UPDATE;
 	}
 
 	/* occurred abnormal CV status */
@@ -1070,7 +1157,7 @@ static void wpc_pre_cc_work(struct work_struct *work)
 	}
 
 	if ((sm_dc->ta.v + WPC_V_STEP) >= sm_dc->ta.v_max) {
-		pr_info("%s %s: can't increase voltage(v:%d v_max:%d)\n", sm_dc->name, 
+		pr_info("%s %s: can't increase voltage(v:%d v_max:%d)\n", sm_dc->name,
 				__func__, sm_dc->ta.v, sm_dc->ta.v_max);
 		pr_info("%s %s: [request] pre_cc -> cc\n", sm_dc->name, __func__);
 		sm_dc->ops->set_adc_mode(sm_dc->i2c, SM_DC_ADC_MODE_CONTINUOUS);
@@ -1154,7 +1241,8 @@ static void wpc_cc_work(struct work_struct *work)
 	pr_info("%s %s: Changed WPC Msg\n", sm_dc->name, __func__);
 	sm_dc->ta.v = _wpc_calc_voltage(sm_dc, sm_dc->ta.v, dir);
 	if (sm_dc->ta.v >= sm_dc->ta.v_max) {
-		pr_info("%s %s: can't increase wpc_v(v:%d, v_max:%d)\n", sm_dc->name, __func__, sm_dc->ta.v, sm_dc->ta.v_max);
+		pr_info("%s %s: can't increase wpc_v(v:%d, v_max:%d)\n",
+			sm_dc->name, __func__, sm_dc->ta.v, sm_dc->ta.v_max);
 		sm_dc->ta.v = sm_dc->ta.v_max;
 		ret = send_power_source_msg(sm_dc);
 		if (ret < 0)
@@ -1308,7 +1396,7 @@ static void wpc_error_work(struct work_struct *work)
 /**
  * SM Direct-charging module management APIs
  */
-struct sm_dc_info *sm_dc_create_pd_instance(const char* name, struct i2c_client *i2c)
+struct sm_dc_info *sm_dc_create_pd_instance(const char *name, struct i2c_client *i2c)
 {
 	struct sm_dc_info *sm_dc;
 	int ret;
@@ -1350,7 +1438,7 @@ err_kmem:
 }
 EXPORT_SYMBOL(sm_dc_create_pd_instance);
 
-struct sm_dc_info *sm_dc_create_wpc_instance(const char* name, struct i2c_client *i2c)
+struct sm_dc_info *sm_dc_create_wpc_instance(const char *name, struct i2c_client *i2c)
 {
 	struct sm_dc_info *sm_dc;
 	int ret;

drivers/battery_v2/include/sec_battery.h

@@ -183,8 +183,9 @@ struct sec_bat_pdic_info {
 #endif
 };
 
+#define MAX_PDO_NUM 8
 struct sec_bat_pdic_list {
-	struct sec_bat_pdic_info pd_info[8]; /* 5V ~ 12V */
+	struct sec_bat_pdic_info pd_info[MAX_PDO_NUM]; /* 5V ~ 12V */
 	unsigned int now_pd_index;
 	unsigned int max_pd_count;
 #if defined(CONFIG_PDIC_PD30)

drivers/battery_v2/sec_battery.c

@@ -482,7 +482,7 @@ static void sec_bat_get_charging_current_by_siop(struct sec_battery_info *batter
 
 static void sec_bat_change_pdo(struct sec_battery_info *battery, int vol)
 {
-	unsigned int target_pd_index = 0;
+	int target_pd_index = 0;
 
 	if (is_pd_wire_type(battery->wire_status)) {
 
@@ -497,6 +497,12 @@ static void sec_bat_change_pdo(struct sec_battery_info *battery, int vol)
 			/* select 5V PDO */
 			target_pd_index = 0;
 		}
+
+		if (target_pd_index < 0 || target_pd_index >= MAX_PDO_NUM) {
+			pr_info("%s: target_pd_index is wrong %d\n", __func__, target_pd_index);
+			return;
+		}
+
 		pr_info("%s: target_pd_index: %d, now_pd_index: %d\n", __func__,
 			target_pd_index, battery->pd_list.now_pd_index);
 
@@ -520,7 +526,8 @@ static void sec_bat_change_pdo(struct sec_battery_info *battery, int vol)
 					POWER_SUPPLY_PROP_CURRENT_MAX, value);
 			}
 			battery->pdic_ps_rdy = false;
-			select_pdo(battery->pd_list.pd_info[target_pd_index].pdo_index);
+			if (target_pd_index >= 0 && target_pd_index < MAX_PDO_NUM)
+				select_pdo(battery->pd_list.pd_info[target_pd_index].pdo_index);
 		}
 	}
 }
@@ -926,7 +933,7 @@ extern void select_pdo(int num);
 static bool sec_bat_change_vbus_pd(struct sec_battery_info *battery, int *input_current)
 {
 #if defined(CONFIG_SUPPORT_HV_CTRL)
-	unsigned int target_pd_index = 0;
+	int target_pd_index = 0;
 
 	if (battery->pdata->chg_temp_check_type == SEC_BATTERY_TEMP_CHECK_NONE)
 		return false;
@@ -948,6 +955,12 @@ static bool sec_bat_change_vbus_pd(struct sec_battery_info *battery, int *input_
 			/* select 5V PDO */
 			target_pd_index = 0;
 		}
+
+	if (target_pd_index < 0 || target_pd_index >= MAX_PDO_NUM) {
+			pr_info("%s: target_pd_index is wrong %d\n", __func__, target_pd_index);
+			return;
+		}
+
 		pr_info("%s: target_pd_index: %d, now_pd_index: %d\n", __func__,
 			target_pd_index, battery->pd_list.now_pd_index);
 
@@ -975,7 +988,9 @@ static bool sec_bat_change_vbus_pd(struct sec_battery_info *battery, int *input_
 			battery->pdic_ps_rdy = false;
 			sec_bat_set_current_event(battery, SEC_BAT_CURRENT_EVENT_SELECT_PDO,
 				SEC_BAT_CURRENT_EVENT_SELECT_PDO);
-			select_pdo(battery->pd_list.pd_info[target_pd_index].pdo_index);
+			if (target_pd_index >= 0 && target_pd_index < MAX_PDO_NUM)
+				select_pdo(battery->pd_list.pd_info[target_pd_index].pdo_index);
+
 			return true;
 		}
 	}
@@ -1285,6 +1300,12 @@ int sec_bat_set_charging_current(struct sec_battery_info *battery)
 		(battery->charging_current != charging_current)) {
 		/* update charge power */
 		battery->charge_power = battery->input_voltage * input_current;
+
+		if (battery->current_event & SEC_BAT_CURRENT_EVENT_HV_DISABLE) {
+			if (battery->charge_power > battery->pdata->nv_charge_power)
+				battery->charge_power = battery->pdata->nv_charge_power;
+		}
+
 		if (battery->charge_power > battery->max_charge_power)
 			battery->max_charge_power = battery->charge_power;
 
@@ -5621,6 +5642,7 @@ static int sec_bat_set_property(struct power_supply *psy,
 	int full_check_type = SEC_BATTERY_FULLCHARGED_NONE;
 	union power_supply_propval value = {0, };
 	enum power_supply_ext_property ext_psp = (enum power_supply_ext_property) psp;
+	int target_pd_index = 0;
 
 	dev_dbg(battery->dev,
 		"%s: (%d,%d)\n", __func__, psp, val->intval);
@@ -5847,14 +5869,20 @@ static int sec_bat_set_property(struct power_supply *psy,
 				sec_bat_set_current_event(battery,
 					0, SEC_BAT_CURRENT_EVENT_HV_DISABLE);
 
-				if (is_pd_wire_type(battery->cable_type)) {
-					battery->update_pd_list = true;
-					pr_info("%s: update pd list\n", __func__);
 #if defined(CONFIG_PDIC_PD30)
-					select_pdo(battery->pd_list.pd_info[battery->pd_list.num_fpdo - 1].pdo_index);
+				target_pd_index = battery->pd_list.num_fpdo - 1;
 #else
-					select_pdo(battery->pd_list.pd_info[battery->pd_list.max_pd_count - 1].pdo_index);
+				target_pd_index = battery->pd_list.max_pd_count - 1;
 #endif
+				if (target_pd_index < 0 || target_pd_index >= MAX_PDO_NUM) {
+					pr_info("%s: target_pd_index is wrong %d\n", __func__, target_pd_index);
+					return 0;
+				}
+				if (is_pd_wire_type(battery->cable_type)) {
+					battery->update_pd_list = true;
+					pr_info("%s: update pd list\n", __func__);
+
+					select_pdo(battery->pd_list.pd_info[target_pd_index].pdo_index);
 				}
 			}
 			break;
@@ -7087,7 +7115,7 @@ static int make_pd_list(struct sec_battery_info *battery)
 		{
 			pPower_list = &battery->pdic_info.sink_status.power_list[i];
 
-			if (pPower_list->apdo) {
+			if (pPower_list->apdo && pd_list_index >= 0 && pd_list_index < MAX_PDO_NUM) {
 				battery->pd_list.pd_info[pd_list_index].pdo_index = i;
 				battery->pd_list.pd_info[pd_list_index].apdo = true;
 				battery->pd_list.pd_info[pd_list_index].max_voltage = pPower_list->max_voltage;
@@ -7106,8 +7134,8 @@ static int make_pd_list(struct sec_battery_info *battery)
 
 	num_pd_list = pd_list_index;
 
-	if (num_pd_list <= 0) {
-		pr_info("%s : PDO list is empty!!\n", __func__);
+	if (num_pd_list <= 0 || num_pd_list > MAX_PDO_NUM) {
+		pr_info("%s : PDO list is wrong: %d\n", __func__, num_pd_list);
 		return 0;
 	} else {
 #if defined(CONFIG_PDIC_PD30)
@@ -7133,6 +7161,10 @@ static int make_pd_list(struct sec_battery_info *battery)
 #else
 	pd_list_select = num_pd_list - 1;
 #endif
+	if (pd_list_select < 0 || pd_list_select >= MAX_PDO_NUM) {
+		pr_info("%s : pd_list_select is wrong: %d\n", __func__, pd_list_select);
+		return 0;
+	}
 
 	for (i = 0; i < num_pd_list; i++) {
 #if defined(CONFIG_PDIC_PD30)
@@ -7199,7 +7231,8 @@ static int make_pd_list(struct sec_battery_info *battery)
 		battery->pdic_ps_rdy = false;
 		sec_bat_set_current_event(battery, SEC_BAT_CURRENT_EVENT_SELECT_PDO,
 			SEC_BAT_CURRENT_EVENT_SELECT_PDO);
-		select_pdo(battery->pd_list.pd_info[pd_list_select].pdo_index);
+		if (pd_list_select >= 0 && pd_list_select < MAX_PDO_NUM)
+			select_pdo(battery->pd_list.pd_info[pd_list_select].pdo_index);
 	}
 
 	battery->pd_list.now_pd_index = sec_bat_get_pd_list_index(&battery->pdic_info.sink_status,

drivers/battery_v2/sec_battery_sysfs.c

@@ -690,6 +690,8 @@ ssize_t sec_bat_show_attrs(struct device *dev,
 					battery->max_charge_power >= HV_CHARGER_STATUS_STANDARD1) /* 12000mW */
 					check_val = AFC_9V_OR_15W;
 			}
+			pr_info("%s : HV_CHARGER_STATUS(%d) pd max charge power(%d), max_charge_power(%d)\n",
+				__func__, check_val, battery->pd_max_charge_power, battery->max_charge_power);
 			i += scnprintf(buf + i, PAGE_SIZE - i, "%d\n", check_val);
 		}
 		break;

drivers/block/zram/zram_drv.h

@@ -18,6 +18,7 @@
 #include <linux/rwsem.h>
 #include <linux/zsmalloc.h>
 #include <linux/crypto.h>
+#include <linux/mm.h>
 #include <linux/spinlock.h>
 
 #include "zcomp.h"
@@ -55,6 +56,8 @@ enum zram_pageflags {
 	ZRAM_IDLE,	/* not accessed page since last idle marking */
 	ZRAM_EXPIRE,
 	ZRAM_READ_BDEV,
+	ZRAM_PPR,
+	ZRAM_UNDER_PPR,
 
 	__NR_ZRAM_PAGEFLAGS,
 };
@@ -111,10 +114,26 @@ struct zram_stats {
 #ifdef CONFIG_ZRAM_LRU_WRITEBACK
 	atomic64_t bd_expire;
 	atomic64_t bd_objcnt;
+	atomic64_t bd_size;
+	atomic64_t bd_max_count;
+	atomic64_t bd_max_size;
+	atomic64_t bd_ppr_count;
+	atomic64_t bd_ppr_reads;
+	atomic64_t bd_ppr_writes;
+	atomic64_t bd_ppr_objcnt;
+	atomic64_t bd_ppr_size;
+	atomic64_t bd_ppr_max_count;
+	atomic64_t bd_ppr_max_size;
+	atomic64_t bd_objreads;
+	atomic64_t bd_objwrites;
 #endif
 };
 
 #ifdef CONFIG_ZRAM_LRU_WRITEBACK
+#define ZRAM_WB_THRESHOLD 32
+#define NR_ZWBS 16
+#define NR_FALLOC_PAGES 512
+#define FALLOC_ALIGN_MASK (~(NR_FALLOC_PAGES - 1))
 struct zram_wb_header {
 	u32 index;
 	u32 size;
@@ -134,6 +153,20 @@ struct zram_wb_entry {
 	unsigned int offset;
 	unsigned int size;
 };
+
+struct zwbs {
+	struct zram_wb_entry entry[ZRAM_WB_THRESHOLD];
+	struct page *page;
+	u32 cnt;
+	u32 off;
+};
+
+void free_zwbs(struct zwbs **);
+int alloc_zwbs(struct zwbs **);
+bool zram_is_app_launch(void);
+int is_writeback_entry(swp_entry_t);
+void swap_add_to_list(struct list_head *, swp_entry_t);
+void swap_writeback_list(struct zwbs **, struct list_head *);
 #endif
 
 struct zram_hash {
@@ -184,11 +217,15 @@ struct zram {
 	struct task_struct *wbd;
 	wait_queue_head_t wbd_wait;
 	u8 *wb_table;
+	unsigned long *chunk_bitmap;
 	bool wbd_running;
 	bool io_complete;
 	struct list_head list;
 	spinlock_t list_lock;
 	spinlock_t wb_table_lock;
+	spinlock_t bitmap_lock;
+	unsigned long *blk_bitmap;
+	struct mutex blk_bitmap_lock;
 #endif
 };
 

drivers/char/adsprpc.c

@@ -3427,11 +3427,14 @@ static int fastrpc_set_process_info(struct fastrpc_file *fl)
 {
 	int err = 0, buf_size = 0;
 	char strpid[PID_SIZE];
+	char cur_comm[TASK_COMM_LEN];
 
+	memcpy(cur_comm, current->comm, TASK_COMM_LEN);
+	cur_comm[TASK_COMM_LEN-1] = '\0';
 	fl->tgid = current->tgid;
 	snprintf(strpid, PID_SIZE, "%d", current->pid);
 	if (debugfs_root) {
-		buf_size = strlen(current->comm) + strlen("_")
+		buf_size = strlen(cur_comm) + strlen("_")
 			+ strlen(strpid) + 1;
 
 		spin_lock(&fl->hlock);
@@ -3447,13 +3450,13 @@ static int fastrpc_set_process_info(struct fastrpc_file *fl)
 			err = -ENOMEM;
 			return err;
 		}
-		snprintf(fl->debug_buf, UL_SIZE, "%.10s%s%d",
-			current->comm, "_", current->pid);
+		snprintf(fl->debug_buf, buf_size, "%.10s%s%d",
+			cur_comm, "_", current->pid);
 		fl->debugfs_file = debugfs_create_file(fl->debug_buf, 0644,
 			debugfs_root, fl, &debugfs_fops);
 		if (IS_ERR_OR_NULL(fl->debugfs_file)) {
 			pr_warn("Error: %s: %s: failed to create debugfs file %s\n",
-				current->comm, __func__, fl->debug_buf);
+				cur_comm, __func__, fl->debug_buf);
 			fl->debugfs_file = NULL;
 			kfree(fl->debug_buf);
 			fl->debug_buf = NULL;

drivers/char/diag/diag_dci.c

@@ -1061,6 +1061,11 @@ void extract_dci_pkt_rsp(unsigned char *buf, int len, int data_source,
 		return;
 	}
 
+	if (token != entry->client_info.token) {
+		mutex_unlock(&driver->dci_mutex);
+		return;
+	}
+	
 	mutex_lock(&entry->buffers[data_source].buf_mutex);
 	rsp_buf = entry->buffers[data_source].buf_cmd;
 
@@ -1732,7 +1737,16 @@ static int diag_send_dci_pkt_remote(unsigned char *data, int len, int tag,
 	write_len += dci_header_size;
 	*(int *)(buf + write_len) = tag;
 	write_len += sizeof(int);
-	memcpy(buf + write_len, data, len);
+	if ((write_len + len) < DIAG_MDM_BUF_SIZE) {
+		memcpy(buf + write_len, data, len);
+	} else {
+		pr_err("diag: skip writing invalid length packet, token: %d, pkt_len: %d\n",
+			token, (write_len + len));
+		spin_lock_irqsave(&driver->dci_mempool_lock, flags);
+		diagmem_free(driver, buf, dci_ops_tbl[token].mempool);
+		spin_unlock_irqrestore(&driver->dci_mempool_lock, flags);
+		return -EAGAIN;
+	}	
 	write_len += len;
 	*(buf + write_len) = CONTROL_CHAR; /* End Terminator */
 	write_len += sizeof(uint8_t);

drivers/char/diag/diagchar_core.c

@@ -1996,13 +1996,15 @@ static int diag_switch_logging(struct diag_logging_mode_param_t *param)
 				driver->pcie_switch_pid = current->tgid;
 			}
 			if (new_mode == DIAG_PCIE_MODE) {
-				driver->transport_set = DIAG_ROUTE_TO_PCIE;
+				driver->transport_set =
+					DIAG_ROUTE_TO_PCIE;
 				diagmem_setsize(POOL_TYPE_MUX_APPS,
 					itemsize_pcie_apps,
 					(poolsize_pcie_apps + 1 +
 						(NUM_PERIPHERALS * 6)));
 			} else if (new_mode == DIAG_USB_MODE) {
-				driver->transport_set = DIAG_ROUTE_TO_USB;
+				driver->transport_set =
+					DIAG_ROUTE_TO_USB;
 				diagmem_setsize(POOL_TYPE_MUX_APPS,
 					itemsize_usb_apps,
 					(poolsize_usb_apps + 1 +
@@ -4400,7 +4402,7 @@ static void diag_init_transport(void)
 	 * The number of buffers encompasses Diag data generated on
 	 * the Apss processor + 1 for the responses generated
 	 * exclusively on the Apps processor + data from data channels
-	 *(4 channels periperipheral) + data from command channels (2)
+	 *(4 channels per peripheral) + data from command channels (2)
 	 */
 	diagmem_setsize(POOL_TYPE_MUX_APPS, itemsize_pcie_apps,
 		poolsize_pcie_apps + 1 + (NUM_PERIPHERALS * 6));
@@ -4419,7 +4421,7 @@ static void diag_init_transport(void)
 	 * The number of buffers encompasses Diag data generated on
 	 * the Apss processor + 1 for the responses generated
 	 * exclusively on the Apps processor + data from data channels
-	 *(4 channels periperipheral) + data from command channels (2)
+	 *(4 channels per peripheral) + data from command channels (2)
 	 */
 	diagmem_setsize(POOL_TYPE_MUX_APPS, itemsize_usb_apps,
 		poolsize_usb_apps + 1 + (NUM_PERIPHERALS * 6));

drivers/char/diag/diagmem.c

@@ -152,6 +152,9 @@ void diagmem_setsize(int pool_idx, int itemsize, int poolsize)
 	}
 
 	diag_mempools[pool_idx].itemsize = itemsize;
+	if (diag_mempools[pool_idx].pool)
+		diag_mempools[pool_idx].pool->pool_data =
+			(void *)(uintptr_t)itemsize;
 	diag_mempools[pool_idx].poolsize = poolsize;
 	pr_debug("diag: Mempool %s sizes: itemsize %d poolsize %d\n",
 		 diag_mempools[pool_idx].name, diag_mempools[pool_idx].itemsize,
@@ -177,7 +180,8 @@ void *diagmem_alloc(struct diagchar_dev *driver, int size, int pool_type)
 					   mempool->name);
 			break;
 		}
-		if (size == 0 || size > mempool->itemsize) {
+		if (size == 0 || size > mempool->itemsize ||
+			size > (int)mempool->pool->pool_data) {			
 			pr_err_ratelimited("diag: cannot alloc from mempool %s, invalid size: %d\n",
 					   mempool->name, size);
 			break;

drivers/gpu/drm/msm/samsung_lego/S6E3FC3_AMS646YD04/ss_dsi_panel_S6E3FC3_AMS646YD04.c

@@ -239,6 +239,7 @@ static struct dsi_panel_cmd_set *ss_vrr_hbm(struct samsung_display_driver_data *
 #define HBM_NORMAL_DELAY_60FPS (9)
 #define HBM_NORMAL_DELAY_90FPS (12)
 #define HBM_NORMAL_DELAY_120FPS (3)
+static bool last_br_hbm;
 
 #define get_bit(value, shift, width)	((value >> shift) & (GENMASK(width - 1, 0)))
 static struct dsi_panel_cmd_set *ss_brightness_gamma_mode2_normal
@@ -330,6 +331,7 @@ static struct dsi_panel_cmd_set *ss_brightness_gamma_mode2_normal
 	}
 
 	*level_key = LEVEL_KEY_NONE;
+	last_br_hbm = false;
 
 	return pcmds;
 }
@@ -363,13 +365,15 @@ static struct dsi_panel_cmd_set *ss_brightness_gamma_mode2_hbm
 				vdd->br_info.temperature : (char)(BIT(7) | (-1 * vdd->br_info.temperature));
 
 		if (vdd->finger_mask_updated) {
-			/* Smooth Dimming Off First */
-			if (vdd->vrr.cur_refresh_rate > 60)
-				pcmds_smooth_off->cmds[3].post_wait_ms = FRAME_WAIT_90FPS;
-			else
-				pcmds_smooth_off->cmds[3].post_wait_ms = FRAME_WAIT_60FPS;
+			if (last_br_hbm == false) { /* Normal -> HBM Case Only */
+				/* Smooth Dimming Off First */
+				if (vdd->vrr.cur_refresh_rate > 60)
+					pcmds_smooth_off->cmds[3].post_wait_ms = FRAME_WAIT_90FPS;
+				else
+					pcmds_smooth_off->cmds[3].post_wait_ms = FRAME_WAIT_60FPS;
 
-			ss_send_cmd(vdd, TX_SMOOTH_DIMMING_OFF);
+				ss_send_cmd(vdd, TX_SMOOTH_DIMMING_OFF);
+			}
 
 			/*
 				There is panel limitation for HBM & AOR setting.
@@ -414,6 +418,7 @@ static struct dsi_panel_cmd_set *ss_brightness_gamma_mode2_hbm
 	}
 
 	*level_key = LEVEL_KEY_NONE;
+	last_br_hbm = true;
 
 	return pcmds;
 }

drivers/gpu/drm/msm/samsung_lego/S6E3FC3_AMS667YM01/ss_dsi_panel_S6E3FC3_AMS667YM01.c

@@ -233,6 +233,7 @@ static struct dsi_panel_cmd_set *ss_vrr_hbm(struct samsung_display_driver_data *
 #define FRAME_WAIT_90FPS (12)
 #define HBM_NORMAL_DELAY_60FPS (12)
 #define HBM_NORMAL_DELAY_90FPS (12)
+static bool last_br_hbm;
 
 #define get_bit(value, shift, width)	((value >> shift) & (GENMASK(width - 1, 0)))
 static struct dsi_panel_cmd_set *ss_brightness_gamma_mode2_normal
@@ -325,6 +326,7 @@ static struct dsi_panel_cmd_set *ss_brightness_gamma_mode2_normal
 	}
 
 	*level_key = LEVEL_KEY_NONE;
+	last_br_hbm = false;
 
 	return pcmds;
 }
@@ -358,13 +360,15 @@ static struct dsi_panel_cmd_set *ss_brightness_gamma_mode2_hbm
 				vdd->br_info.temperature : (char)(BIT(7) | (-1 * vdd->br_info.temperature));
 
 		if (vdd->finger_mask_updated) {
-			/* Smooth Dimming Off First */
-			if (vdd->vrr.cur_refresh_rate > 60)
-				pcmds_smooth_off->cmds[3].post_wait_ms = FRAME_WAIT_90FPS;
-			else
-				pcmds_smooth_off->cmds[3].post_wait_ms = FRAME_WAIT_60FPS;
+			if (last_br_hbm == false) { /* Normal -> HBM Case Only */
+				/* Smooth Dimming Off First */
+				if (vdd->vrr.cur_refresh_rate > 60)
+					pcmds_smooth_off->cmds[3].post_wait_ms = FRAME_WAIT_90FPS;
+				else
+					pcmds_smooth_off->cmds[3].post_wait_ms = FRAME_WAIT_60FPS;
 
-			ss_send_cmd(vdd, TX_SMOOTH_DIMMING_OFF);
+				ss_send_cmd(vdd, TX_SMOOTH_DIMMING_OFF);
+			}
 
 			/*
 				There is panel limitation for HBM & AOR setting.
@@ -409,6 +413,7 @@ static struct dsi_panel_cmd_set *ss_brightness_gamma_mode2_hbm
 	}
 
 	*level_key = LEVEL_KEY_NONE;
+	last_br_hbm = true;
 
 	return pcmds;
 }

drivers/media/platform/msm/camera/cam_cpas/cam_cpas_hw.c

@@ -526,7 +526,6 @@ static int cam_cpas_hw_reg_read(struct cam_hw_info *cpas_hw,
 	if (!CAM_CPAS_CLIENT_VALID(client_indx))
 		return -EINVAL;
 
-	mutex_lock(&cpas_core->client_mutex[client_indx]);
 	cpas_client = cpas_core->cpas_client[client_indx];
 
 	if (!CAM_CPAS_CLIENT_STARTED(cpas_core, client_indx)) {
@@ -534,7 +533,7 @@ static int cam_cpas_hw_reg_read(struct cam_hw_info *cpas_hw,
 			client_indx, cpas_client->data.identifier,
 			cpas_client->data.cell_index);
 		rc = -EPERM;
-		goto unlock_client;
+		return rc;
 	}
 
 	if (mb)
@@ -546,8 +545,6 @@ static int cam_cpas_hw_reg_read(struct cam_hw_info *cpas_hw,
 
 	*value = reg_value;
 
-unlock_client:
-	mutex_unlock(&cpas_core->client_mutex[client_indx]);
 	return rc;
 }
 

drivers/media/platform/msm/camera/cam_icp/icp_hw/icp_hw_mgr/cam_icp_hw_mgr.c

@@ -1461,7 +1461,8 @@ static int cam_icp_hw_mgr_create_debugfs_entry(void)
 		rc = -ENOMEM;
 		goto err;
 	}
-
+	/* Set default hang dump lvl */
+    icp_hw_mgr.a5_fw_dump_lvl = HFI_FW_DUMP_ON_FAILURE;
 	return rc;
 err:
 	debugfs_remove_recursive(icp_hw_mgr.dentry);

drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/cam_ife_hw_mgr.c

@@ -5084,8 +5084,7 @@ static int cam_ife_hw_mgr_get_err_type(
 
 	core_idx = evt_payload->core_index;
 	evt_payload->evt_id = CAM_ISP_HW_EVENT_ERROR;
-	evt_payload->enable_reg_dump =
-		g_ife_hw_mgr.debug_cfg.enable_reg_dump;
+	evt_payload->enable_reg_dump = true;
 
 	list_for_each_entry(isp_ife_camif_res,
 		&ife_hwr_mgr_ctx->res_list_ife_src, list) {

drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_bus/cam_vfe_bus_ver2.c

@@ -1393,7 +1393,7 @@ static int cam_vfe_bus_err_bottom_half(void *ctx_priv,
 
 	evt_payload = evt_payload_priv;
 	common_data = evt_payload->ctx;
-	enable_dmi_dump = evt_payload->enable_dump;
+	enable_dmi_dump = 0x3;
 	stats_cfg = common_data->stats_data->stats_cfg_offset;
 	dmi_cfg = common_data->stats_data->dmi_offset_info;
 	val = evt_payload->debug_status_0;

drivers/media/platform/msm/camera/cam_sensor_module/cam_flash/cam_flash_core.c

@@ -54,6 +54,11 @@ static int cam_flash_prepare(struct cam_flash_ctrl *flash_ctrl,
 		(struct cam_flash_private_soc *)
 		flash_ctrl->soc_info.soc_private;
 
+	// Set the PMIC voltage to 5V for Flash operation
+#if defined(CONFIG_LEDS_SM5714)
+	sm5714_fled_mode_ctrl(SM5714_FLED_MODE_PREPARE_FLASH, 0);
+#endif
+
 #if !defined(CONFIG_LEDS_S2MU107_FLASH) && !defined(CONFIG_LEDS_S2MU106_FLASH) && !defined(CONFIG_LEDS_SM5714)
 	if (!(flash_ctrl->switch_trigger)) {
 		CAM_ERR(CAM_FLASH, "Invalid argument");
@@ -1947,6 +1952,11 @@ int cam_flash_release_dev(struct cam_flash_ctrl *fctrl)
 {
 	int rc = 0;
 
+	// Re-Set the PMIC voltage 5V -> 9V
+#if defined(CONFIG_LEDS_SM5714)
+	sm5714_fled_mode_ctrl(SM5714_FLED_MODE_CLOSE_FLASH, 0);
+#endif
+
 	if (fctrl->bridge_intf.device_hdl != 1) {
 		rc = cam_destroy_device_hdl(fctrl->bridge_intf.device_hdl);
 		if (rc)

drivers/media/platform/msm/camera/cam_sensor_module/cam_sensor/cam_sensor_core.c

@@ -19,10 +19,6 @@
 #include "cam_common_util.h"
 #include "cam_packet_util.h"
 
-#if defined(CONFIG_LEDS_SM5714)
-#include <linux/mfd/sm/sm5714/sm5714.h>
-#endif
-
 #if defined(CONFIG_GC5035_MACRO_OTP_DD_AUTOLOAD)
 #include "gc5035_macro_otp.h"
 #endif
@@ -1561,14 +1557,6 @@ int32_t cam_sensor_driver_cmd(struct cam_sensor_ctrl_t *s_ctrl,
 			goto release_mutex;
 		}
 
-		// Set the PMIC voltage to 5V for Flash operation on Rear Sensor
-#if defined(CONFIG_LEDS_SM5714)
-		if(s_ctrl->soc_info.index == 0 || s_ctrl->soc_info.index == 4)
-		{
-			sm5714_fled_mode_ctrl(SM5714_FLED_MODE_PREPARE_FLASH, 0);
-		}
-#endif
-
 		rc = cam_sensor_power_up(s_ctrl);
 		if (rc < 0) {
 			CAM_ERR(CAM_SENSOR, "Sensor Power up failed");
@@ -1602,14 +1590,6 @@ int32_t cam_sensor_driver_cmd(struct cam_sensor_ctrl_t *s_ctrl,
 			goto release_mutex;
 		}
 
-		// Re-Set the PMIC voltage 5V -> 9V
-#if defined(CONFIG_LEDS_SM5714)
-		if(s_ctrl->soc_info.index == 0 || s_ctrl->soc_info.index == 4)
-		{
-			sm5714_fled_mode_ctrl(SM5714_FLED_MODE_CLOSE_FLASH, 0);
-		}
-#endif
-
 		rc = cam_sensor_power_down(s_ctrl);
 		if (rc < 0) {
 			CAM_ERR(CAM_SENSOR, "Sensor Power Down failed");

drivers/media/platform/msm/camera/cam_smmu/cam_smmu_api.c

@@ -3197,6 +3197,7 @@ static int cam_smmu_setup_cb(struct cam_context_bank_info *cb,
 	struct device *dev)
 {
 	int rc = 0;
+	int32_t stall_disable = 1;
 
 	if (!cb || !dev) {
 		CAM_ERR(CAM_SMMU, "Error: invalid input params");
@@ -3263,6 +3264,12 @@ static int cam_smmu_setup_cb(struct cam_context_bank_info *cb,
 			CAM_ERR(CAM_SMMU,
 				"Error: failed to set non fatal fault attribute");
 		}
+		if (iommu_domain_set_attr(cb->mapping->domain,
+			DOMAIN_ATTR_CB_STALL_DISABLE,
+			&stall_disable) < 0) {
+			CAM_ERR(CAM_SMMU,
+					"Error: failed to set cb stall disable");
+		}
 
 	} else {
 		CAM_ERR(CAM_SMMU, "Context bank does not have IO region");

drivers/misc/qseecom.c

@@ -3048,6 +3048,11 @@ static int qseecom_unload_app(struct qseecom_dev_handle *data,
 		goto unload_exit;
 	}
 
+	if (!memcmp(data->client.app_name, "tz_hdm", strlen("tz_hdm"))) {
+		pr_debug("Do not unload tz_hdm app from tz\n");
+		goto unload_exit;
+	}
+
 	__qseecom_cleanup_app(data);
 	__qseecom_reentrancy_check_if_no_app_blocked(TZ_OS_APP_SHUTDOWN_ID);
 
@@ -3823,54 +3828,60 @@ static int qseecom_send_cmd(struct qseecom_dev_handle *data, void __user *argp)
 
 int __boundary_checks_offset(struct qseecom_send_modfd_cmd_req *req,
 			struct qseecom_send_modfd_listener_resp *lstnr_resp,
-			struct qseecom_dev_handle *data, int i)
+			struct qseecom_dev_handle *data, int i, size_t size)
 {
+	char *curr_field = NULL;
+	char *temp_field = NULL;
+	int j = 0;
 
 	if ((data->type != QSEECOM_LISTENER_SERVICE) &&
 						(req->ifd_data[i].fd > 0)) {
-		if ((req->cmd_req_len < sizeof(uint32_t)) ||
+		if ((req->cmd_req_len < size) ||
 			(req->ifd_data[i].cmd_buf_offset >
-			req->cmd_req_len - sizeof(uint32_t))) {
+			req->cmd_req_len - size)) {
 			pr_err("Invalid offset (req len) 0x%x\n",
 				req->ifd_data[i].cmd_buf_offset);
 			return -EINVAL;
 		}
-	} else if ((data->type == QSEECOM_LISTENER_SERVICE) &&
-					(lstnr_resp->ifd_data[i].fd > 0)) {
-		if ((lstnr_resp->resp_len < sizeof(uint32_t)) ||
-			(lstnr_resp->ifd_data[i].cmd_buf_offset >
-			lstnr_resp->resp_len - sizeof(uint32_t))) {
-			pr_err("Invalid offset (lstnr resp len) 0x%x\n",
-				lstnr_resp->ifd_data[i].cmd_buf_offset);
-			return -EINVAL;
-		}
-	}
-	return 0;
-}
 
-static int __boundary_checks_offset_64(struct qseecom_send_modfd_cmd_req *req,
-			struct qseecom_send_modfd_listener_resp *lstnr_resp,
-			struct qseecom_dev_handle *data, int i)
-{
-
-	if ((data->type != QSEECOM_LISTENER_SERVICE) &&
-						(req->ifd_data[i].fd > 0)) {
-		if ((req->cmd_req_len < sizeof(uint64_t)) ||
-			(req->ifd_data[i].cmd_buf_offset >
-			req->cmd_req_len - sizeof(uint64_t))) {
-			pr_err("Invalid offset (req len) 0x%x\n",
+		curr_field = (char *) (req->cmd_req_buf +
 				req->ifd_data[i].cmd_buf_offset);
-			return -EINVAL;
+		for (j = 0; j < MAX_ION_FD; j++) {
+			if ((req->ifd_data[j].fd > 0) && i != j) {
+				temp_field = (char *) (req->cmd_req_buf +
+					req->ifd_data[j].cmd_buf_offset);
+				if (temp_field >= curr_field && temp_field <
+					(curr_field + size)) {
+					pr_err("Invalid field offset 0x%x\n",
+					req->ifd_data[i].cmd_buf_offset);
+					return -EINVAL;
+				}
+			}
 		}
 	} else if ((data->type == QSEECOM_LISTENER_SERVICE) &&
 					(lstnr_resp->ifd_data[i].fd > 0)) {
-		if ((lstnr_resp->resp_len < sizeof(uint64_t)) ||
+		if ((lstnr_resp->resp_len < size) ||
 			(lstnr_resp->ifd_data[i].cmd_buf_offset >
-			lstnr_resp->resp_len - sizeof(uint64_t))) {
+			lstnr_resp->resp_len - size)) {
 			pr_err("Invalid offset (lstnr resp len) 0x%x\n",
 				lstnr_resp->ifd_data[i].cmd_buf_offset);
 			return -EINVAL;
 		}
+
+		curr_field = (char *) (lstnr_resp->resp_buf_ptr +
+				lstnr_resp->ifd_data[i].cmd_buf_offset);
+		for (j = 0; j < MAX_ION_FD; j++) {
+			if ((lstnr_resp->ifd_data[j].fd > 0) && i != j) {
+				temp_field = (char *) lstnr_resp->resp_buf_ptr +
+					lstnr_resp->ifd_data[j].cmd_buf_offset;
+				if (temp_field >= curr_field && temp_field <
+					(curr_field + size)) {
+					pr_err("Invalid lstnr field offset 0x%x\n",
+					lstnr_resp->ifd_data[i].cmd_buf_offset);
+					return -EINVAL;
+				}
+			}
+		}
 	}
 	return 0;
 }
@@ -3945,8 +3956,10 @@ static int __qseecom_update_cmd_buf(void *msg, bool cleanup,
 		if (sg_ptr->nents == 1) {
 			uint32_t *update;
 
-			if (__boundary_checks_offset(req, lstnr_resp, data, i))
+			if (__boundary_checks_offset(req, lstnr_resp, data, i,
+				sizeof(uint32_t)))
 				goto err;
+
 			if ((data->type == QSEECOM_CLIENT_APP &&
 				(data->client.app_arch == ELFCLASS32 ||
 				data->client.app_arch == ELFCLASS64)) ||
@@ -3977,30 +3990,10 @@ static int __qseecom_update_cmd_buf(void *msg, bool cleanup,
 			struct qseecom_sg_entry *update;
 			int j = 0;
 
-			if ((data->type != QSEECOM_LISTENER_SERVICE) &&
-					(req->ifd_data[i].fd > 0)) {
-
-				if ((req->cmd_req_len <
-					 SG_ENTRY_SZ * sg_ptr->nents) ||
-					(req->ifd_data[i].cmd_buf_offset >
-						(req->cmd_req_len -
-						SG_ENTRY_SZ * sg_ptr->nents))) {
-					pr_err("Invalid offset = 0x%x\n",
-					req->ifd_data[i].cmd_buf_offset);
-					goto err;
-				}
-
-			} else if ((data->type == QSEECOM_LISTENER_SERVICE) &&
-					(lstnr_resp->ifd_data[i].fd > 0)) {
+			if (__boundary_checks_offset(req, lstnr_resp, data, i,
+				(SG_ENTRY_SZ * sg_ptr->nents)))
+				goto err;
 
-				if ((lstnr_resp->resp_len <
-						SG_ENTRY_SZ * sg_ptr->nents) ||
-				(lstnr_resp->ifd_data[i].cmd_buf_offset >
-						(lstnr_resp->resp_len -
-						SG_ENTRY_SZ * sg_ptr->nents))) {
-					goto err;
-				}
-			}
 			if ((data->type == QSEECOM_CLIENT_APP &&
 				(data->client.app_arch == ELFCLASS32 ||
 				data->client.app_arch == ELFCLASS64)) ||
@@ -4220,9 +4213,10 @@ static int __qseecom_update_cmd_buf_64(void *msg, bool cleanup,
 		if (sg_ptr->nents == 1) {
 			uint64_t *update_64bit;
 
-			if (__boundary_checks_offset_64(req, lstnr_resp,
-							data, i))
+			if (__boundary_checks_offset(req, lstnr_resp, data, i,
+				sizeof(uint64_t)))
 				goto err;
+
 				/* 64bit app uses 64bit address */
 			update_64bit = (uint64_t *) field;
 			*update_64bit = cleanup ? 0 :
@@ -4232,30 +4226,9 @@ static int __qseecom_update_cmd_buf_64(void *msg, bool cleanup,
 			struct qseecom_sg_entry_64bit *update_64bit;
 			int j = 0;
 
-			if ((data->type != QSEECOM_LISTENER_SERVICE) &&
-					(req->ifd_data[i].fd > 0)) {
-
-				if ((req->cmd_req_len <
-					 SG_ENTRY_SZ_64BIT * sg_ptr->nents) ||
-					(req->ifd_data[i].cmd_buf_offset >
-					(req->cmd_req_len -
-					SG_ENTRY_SZ_64BIT * sg_ptr->nents))) {
-					pr_err("Invalid offset = 0x%x\n",
-					req->ifd_data[i].cmd_buf_offset);
-					goto err;
-				}
-
-			} else if ((data->type == QSEECOM_LISTENER_SERVICE) &&
-					(lstnr_resp->ifd_data[i].fd > 0)) {
-
-				if ((lstnr_resp->resp_len <
-					SG_ENTRY_SZ_64BIT * sg_ptr->nents) ||
-				(lstnr_resp->ifd_data[i].cmd_buf_offset >
-						(lstnr_resp->resp_len -
-					SG_ENTRY_SZ_64BIT * sg_ptr->nents))) {
-					goto err;
-				}
-			}
+			if (__boundary_checks_offset(req, lstnr_resp, data, i,
+				(SG_ENTRY_SZ_64BIT * sg_ptr->nents)))
+				goto err;
 			/* 64bit app uses 64bit address */
 			update_64bit = (struct qseecom_sg_entry_64bit *)field;
 			for (j = 0; j < sg_ptr->nents; j++) {

drivers/net/wireless/qualcomm/wcn39xx/fw-api/fw/wmi_unified.h

@@ -2080,6 +2080,7 @@ typedef enum {
 #define WMI_CHAN_FLAG_DFS_CFREQ2  16 /* Enable radar event reporting for sec80 in VHT80p80 */
 #define WMI_CHAN_FLAG_ALLOW_HE    17 /* HE (11ax) is allowed on this channel */
 #define WMI_CHAN_FLAG_PSC         18 /* Indicate it is a PSC (preferred scanning channel) */
+#define WMI_CHAN_FLAG_NAN_DISABLED 19 /* Indicates that NAN operations are disabled on this channel */
 
 #define WMI_SET_CHANNEL_FLAG(pwmi_channel,flag) do { \
         (pwmi_channel)->info |=  (1 << flag);      \
@@ -3907,6 +3908,32 @@ typedef struct {
 #define WMI_RSRC_CFG_HOST_SERVICE_FLAG_NAN_IFACE_SUPPORT_SET(host_service_flags, val) \
     WMI_SET_BITS(host_service_flags, 0, 1, val)
 
+#define WMI_RSRC_CFG_HOST_SERVICE_FLAG_HOST_SUPPORT_MULTI_RADIO_EVTS_PER_RADIO_GET(host_service_flags) \
+    WMI_GET_BITS(host_service_flags, 1, 1)
+#define WMI_RSRC_CFG_HOST_SERVICE_FLAG_HOST_SUPPORT_MULTI_RADIO_EVTS_PER_RADIO_SET(host_service_flags, val) \
+    WMI_SET_BITS(host_service_flags, 1, 1, val)
+
+#define WMI_RSRC_CFG_HOST_SERVICE_FLAG_SPLIT_AST_FEATURE_HOST_SUPPORT_GET(host_service_flags) \
+    WMI_GET_BITS(host_service_flags, 2, 1)
+#define WMI_RSRC_CFG_HOST_SERVICE_FLAG_SPLIT_AST_FEATURE_HOST_SUPPORT_SET(host_service_flags, val) \
+    WMI_SET_BITS(host_service_flags, 2, 1, val)
+
+#define WMI_RSRC_CFG_HOST_SERVICE_FLAG_SAE_EAPOL_OFFLOAD_SUPPORT_GET(host_service_flags) \
+    WMI_GET_BITS(host_service_flags, 3, 1)
+#define WMI_RSRC_CFG_HOST_SERVICE_FLAG_SAE_EAPOL_OFFLOAD_SUPPORT_SET(host_service_flags, val) \
+    WMI_SET_BITS(host_service_flags, 3, 1, val)
+
+#define WMI_RSRC_CFG_HOST_SERVICE_FLAG_REG_CC_EXT_SUPPORT_GET(host_service_flags) \
+    WMI_GET_BITS(host_service_flags, 4, 1)
+#define WMI_RSRC_CFG_HOST_SERVICE_FLAG_REG_CC_EXT_SUPPORT_SET(host_service_flags, val) \
+    WMI_SET_BITS(host_service_flags, 4, 1, val)
+
+#define WMI_RSRC_CFG_HOST_SERVICE_FLAG_NAN_CHANNEL_SUPPORT_GET(host_service_flags) \
+    WMI_GET_BITS(host_service_flags, 5, 1)
+#define WMI_RSRC_CFG_HOST_SERVICE_FLAG_NAN_CHANNEL_SUPPORT_SET(host_service_flags, val) \
+    WMI_SET_BITS(host_service_flags, 5, 1, val)
+
+
 typedef struct {
     A_UINT32 tlv_header; /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_init_cmd_fixed_param */
 

drivers/net/wireless/qualcomm/wcn39xx/fw-api/fw/wmi_version.h

@@ -36,7 +36,7 @@
 #define __WMI_VER_MINOR_    0
 /** WMI revision number has to be incremented when there is a
  *  change that may or may not break compatibility. */
-#define __WMI_REVISION_ 906
+#define __WMI_REVISION_ 992
 
 /** The Version Namespace should not be normally changed. Only
  *  host and firmware of the same WMI namespace will work

drivers/net/wireless/qualcomm/wcn39xx/qca-wifi-host-cmn/os_if/linux/qca_vendor.h

@@ -140,7 +140,20 @@
  * @QCA_NL80211_VENDOR_SUBCMD_GET_PREFERRED_FREQ_LIST: get preferred channel
 	list
  * @QCA_NL80211_VENDOR_SUBCMD_SET_PROBABLE_OPER_CHANNEL: channel hint
- * @QCA_NL80211_VENDOR_SUBCMD_SETBAND: vendor setband command
+ * @QCA_NL80211_VENDOR_SUBCMD_SETBAND: Command to configure the band
+ *	to the host driver. This command sets the band through either
+ *	the attribute QCA_WLAN_VENDOR_ATTR_SETBAND_VALUE or
+ *	QCA_WLAN_VENDOR_ATTR_SETBAND_MASK. QCA_WLAN_VENDOR_ATTR_SETBAND_VALUE
+ *	refers enum qca_set_band as unsigned integer values and
+ *	QCA_WLAN_VENDOR_ATTR_SETBAND_MASK refers it as 32 bit unsigned BitMask
+ *	values. Also, the acceptable values for
+ *	QCA_WLAN_VENDOR_ATTR_SETBAND_VALUE are only till QCA_SETBAND_2G. Further
+ *	values/bitmask's are valid for QCA_WLAN_VENDOR_ATTR_SETBAND_MASK. The
+ *	attribute QCA_WLAN_VENDOR_ATTR_SETBAND_VALUE is deprecated and the
+ *	recommendation is to use the QCA_WLAN_VENDOR_ATTR_SETBAND_MASK. If the
+ *	implementations configure using both the attributes, the configurations
+ *	through QCA_WLAN_VENDOR_ATTR_SETBAND_MASK shall always take the
+ *	precedence.
  * @QCA_NL80211_VENDOR_SUBCMD_TRIGGER_SCAN: venodr scan command
  * @QCA_NL80211_VENDOR_SUBCMD_SCAN_DONE: vendor scan complete
  * @QCA_NL80211_VENDOR_SUBCMD_ABORT_SCAN: vendor abort scan
@@ -620,6 +633,7 @@ enum qca_nl80211_vendor_subcmds {
 	QCA_NL80211_VENDOR_SUBCMD_GET_SAR_LIMITS_EVENT = 187,
 	QCA_NL80211_VENDOR_SUBCMD_UPDATE_STA_INFO = 188,
 	QCA_NL80211_VENDOR_SUBCMD_DRIVER_DISCONNECT_REASON = 189,
+    QCA_NL80211_VENDOR_SUBCMD_GETBAND = 192,
 };
 
 enum qca_wlan_vendor_tos {
@@ -1068,6 +1082,11 @@ enum qca_wlan_vendor_attr_get_station_info {
  * @QCA_NL80211_VENDOR_SUBCMD_NAN_EXT_INDEX: NAN Extended index
  * @QCA_NL80211_VENDOR_SUBCMD_BEACON_REPORTING_INDEX: Beacon reporting index
  * @QCA_NL80211_VENDOR_SUBCMD_REQUEST_SAR_LIMITS_INDEX: Request SAR limit index
+ *
+ * @QCA_NL80211_VENDOR_SUBCMD_GETBAND: Command to get the configured band from
+ * the host driver. The band configurations obtained are referred through
+ * QCA_WLAN_VENDOR_ATTR_SETBAND_MASK.
+ *
  */
 
 enum qca_nl80211_vendor_subcmds_index {
@@ -1333,7 +1352,13 @@ enum qca_wlan_vendor_attr {
 	QCA_WLAN_VENDOR_ATTR_MAX_CONCURRENT_CHANNELS_2_4_BAND = 10,
 	/* Unsigned 32-bit value */
 	QCA_WLAN_VENDOR_ATTR_MAX_CONCURRENT_CHANNELS_5_0_BAND = 11,
-	/* Unsigned 32-bit value from enum qca_set_band. */
+	/* Unsigned 32-bit value from enum qca_set_band. Also, the acceptable
+	 * value for this attribute are only till QCA_SETBAND_2G. This attribute
+	 * is deprecated. Recommendation is to use
+	 * QCA_WLAN_VENDOR_ATTR_SETBAND_MASK instead. If the band is configured
+	 * using both the attributes, the ones configured through
+	 * QCA_WLAN_VENDOR_ATTR_SETBAND_MASK take the precedence.
+	 */
 	QCA_WLAN_VENDOR_ATTR_SETBAND_VALUE = 12,
 	/* Dummy (NOP) attribute for 64 bit padding */
 	QCA_WLAN_VENDOR_ATTR_PAD = 13,
@@ -1520,9 +1545,18 @@ enum qca_wlan_vendor_attr {
 	 */
 	QCA_WLAN_VENDOR_ATTR_FW_STATE = 42,
 
+	/* Unsigned 32-bitmask value from enum qca_set_band. Substitutes the
+	 * attribute QCA_WLAN_VENDOR_ATTR_SETBAND_VALUE for which only the
+	 * integer values of enum qca_set_band till QCA_SETBAND_2G are valid.
+	 * This attribute shall consider the bitmask combinations to define
+	 * the respective Band combinations and always takes precedence over
+	 * QCA_WLAN_VENDOR_ATTR_SETBAND_VALUE.
+	 */
+	QCA_WLAN_VENDOR_ATTR_SETBAND_MASK = 43,
+
 	/* keep last */
 	QCA_WLAN_VENDOR_ATTR_AFTER_LAST,
-		QCA_WLAN_VENDOR_ATTR_MAX = QCA_WLAN_VENDOR_ATTR_AFTER_LAST - 1
+	QCA_WLAN_VENDOR_ATTR_MAX = QCA_WLAN_VENDOR_ATTR_AFTER_LAST - 1
 };
 
 enum qca_wlan_vendor_attr_extscan_config_params {
@@ -4772,9 +4806,10 @@ enum qca_wlan_vendor_attr_pcl_config {
 };
 
 enum qca_set_band {
-	QCA_SETBAND_AUTO,
-	QCA_SETBAND_5G,
-	QCA_SETBAND_2G,
+	QCA_SETBAND_AUTO = 0,
+	QCA_SETBAND_5G = BIT(0),
+	QCA_SETBAND_2G = BIT(1),
+	QCA_SETBAND_6G = BIT(2),
 };
 
 /**

drivers/net/wireless/qualcomm/wcn39xx/qca-wifi-host-cmn/umac/regulatory/core/src/reg_build_chan_list.c

@@ -253,18 +253,43 @@ static void reg_modify_chan_list_for_indoor_channels(
 	}
 }
 
+#ifdef CONFIG_BAND_6GHZ
+static void reg_modify_chan_list_for_band_6G(
+					struct regulatory_channel *chan_list)
+{
+	enum channel_enum chan_enum;
+
+	reg_debug("disabling 6G");
+	for (chan_enum = MIN_6GHZ_CHANNEL;
+	     chan_enum <= MAX_6GHZ_CHANNEL; chan_enum++) {
+		chan_list[chan_enum].chan_flags |=
+			REGULATORY_CHAN_DISABLED;
+		chan_list[chan_enum].state = CHANNEL_STATE_DISABLE;
+	}
+}
+#else
+static inline void reg_modify_chan_list_for_band_6G(
+					struct regulatory_channel *chan_list)
+{
+}
+#endif
+
 /**
- * reg_modify_chan_list_for_band() - Based on the input band value, either
- * disable 2GHz or 5GHz channels.
+ * reg_modify_chan_list_for_band() - Based on the input band bitmap, either
+ * disable 2GHz, 5GHz, or 6GHz channels.
  * @chan_list: Pointer to regulatory channel list.
- * @band_val: Input band value.
+ * @band_bitmap: Input bitmap of reg_wifi_band values.
  */
 static void reg_modify_chan_list_for_band(struct regulatory_channel *chan_list,
-					  enum band_info band_val)
+					  uint32_t band_bitmap)
 {
 	enum channel_enum chan_enum;
 
-	if (band_val == BAND_2G) {
+	if (!band_bitmap)
+		return;
+
+	if (!(band_bitmap & BIT(REG_BAND_5G))) {
+		reg_debug("disabling 5G");
 		for (chan_enum = MIN_5GHZ_CHANNEL;
 		     chan_enum <= MAX_5GHZ_CHANNEL; chan_enum++) {
 			chan_list[chan_enum].chan_flags |=
@@ -273,7 +298,8 @@ static void reg_modify_chan_list_for_band(struct regulatory_channel *chan_list,
 		}
 	}
 
-	if (band_val == BAND_5G) {
+	if (!(band_bitmap & BIT(REG_BAND_2G))) {
+		reg_debug("disabling 2G");
 		for (chan_enum = MIN_24GHZ_CHANNEL;
 		     chan_enum <= MAX_24GHZ_CHANNEL; chan_enum++) {
 			chan_list[chan_enum].chan_flags |=
@@ -281,6 +307,10 @@ static void reg_modify_chan_list_for_band(struct regulatory_channel *chan_list,
 			chan_list[chan_enum].state = CHANNEL_STATE_DISABLE;
 		}
 	}
+
+	if (!(band_bitmap & BIT(REG_BAND_6G)))
+		reg_modify_chan_list_for_band_6G(chan_list);
+
 }
 
 /**
@@ -1053,7 +1083,8 @@ QDF_STATUS reg_process_master_chan_list(
 			REGULATORY_CHAN_DISABLED;
 		mas_chan_list[chan_enum].state =
 			CHANNEL_STATE_DISABLE;
-		mas_chan_list[chan_enum].nol_chan = false;
+		if (!soc_reg->retain_nol_across_regdmn_update)
+			mas_chan_list[chan_enum].nol_chan = false;
 	}
 
 	soc_reg->num_phy = regulat_info->num_phy;

drivers/net/wireless/qualcomm/wcn39xx/qca-wifi-host-cmn/umac/regulatory/core/src/reg_priv_objs.c

@@ -82,7 +82,8 @@ QDF_STATUS wlan_regulatory_psoc_obj_created_notification(
 	soc_reg_obj->offload_enabled = false;
 	soc_reg_obj->psoc_ptr = psoc;
 	soc_reg_obj->dfs_enabled = true;
-	soc_reg_obj->band_capability = BAND_ALL;
+	soc_reg_obj->band_capability = (BIT(REG_BAND_2G) | BIT(REG_BAND_5G) |
+					BIT(REG_BAND_6G));
 	soc_reg_obj->enable_11d_supp = false;
 	soc_reg_obj->indoor_chan_enabled = true;
 	soc_reg_obj->force_ssc_disable_indoor_channel = false;
@@ -92,6 +93,7 @@ QDF_STATUS wlan_regulatory_psoc_obj_created_notification(
 	soc_reg_obj->restart_beaconing = CH_AVOID_RULE_RESTART;
 	soc_reg_obj->enable_srd_chan_in_master_mode = true;
 	soc_reg_obj->enable_11d_in_world_mode = false;
+	soc_reg_obj->retain_nol_across_regdmn_update = false;
 
 	for (i = 0; i < MAX_STA_VDEV_CNT; i++)
 		soc_reg_obj->vdev_ids_11d[i] = INVALID_VDEV_ID;
@@ -204,7 +206,7 @@ QDF_STATUS wlan_regulatory_pdev_obj_created_notification(
 	pdev_priv_obj->pdev_ptr = pdev;
 	pdev_priv_obj->dfs_enabled = psoc_priv_obj->dfs_enabled;
 	pdev_priv_obj->set_fcc_channel = false;
-	pdev_priv_obj->band_capability =  psoc_priv_obj->band_capability;
+	pdev_priv_obj->band_capability = psoc_priv_obj->band_capability;
 	pdev_priv_obj->indoor_chan_enabled =
 		psoc_priv_obj->indoor_chan_enabled;
 	pdev_priv_obj->en_chan_144 = true;

drivers/net/wireless/qualcomm/wcn39xx/qca-wifi-host-cmn/umac/regulatory/core/src/reg_priv_objs.h

@@ -89,8 +89,12 @@ struct chan_change_cbk_entry {
  *	country update is pending for pdev (phy_id).
  * @world_country_pending: In this array, element[phy_id] is true if any world
  *	country update is pending for pdev (phy_id).
+ * @band_capability: bitmap of bands enabled, using enum reg_wifi_band as the
+ *	bit position value
  * @ignore_fw_reg_offload_ind: Ignore FW reg offload indication
  * @six_ghz_supported: whether 6ghz is supported
+ * @retain_nol_across_regdmn_update: Retain the NOL list across the regdomain
+ *	changes.
  */
 struct wlan_regulatory_psoc_priv_obj {
 	struct mas_chan_params mas_chan_params[PSOC_MAX_PHY_REG_CAP];
@@ -109,7 +113,7 @@ struct wlan_regulatory_psoc_priv_obj {
 	bool new_11d_ctry_pending[PSOC_MAX_PHY_REG_CAP];
 	bool world_country_pending[PSOC_MAX_PHY_REG_CAP];
 	bool dfs_enabled;
-	enum band_info band_capability;
+	uint32_t band_capability;
 	bool indoor_chan_enabled;
 	bool ignore_fw_reg_offload_ind;
 	bool enable_11d_supp_original;
@@ -140,11 +144,14 @@ struct wlan_regulatory_psoc_priv_obj {
 	bool enable_srd_chan_in_master_mode;
 	bool enable_11d_in_world_mode;
 	qdf_spinlock_t cbk_list_lock;
+	bool retain_nol_across_regdmn_update;
 };
 
 /**
  * struct wlan_regulatory_pdev_priv_obj - wlan regulatory pdev private object
  * @pdev_opened: whether pdev has been opened by application
+ * @band_capability: bitmap of bands enabled, using enum reg_wifi_band as the
+ *	bit position value
  */
 struct wlan_regulatory_pdev_priv_obj {
 	struct regulatory_channel cur_chan_list[NUM_CHANNELS];
@@ -172,7 +179,7 @@ struct wlan_regulatory_pdev_priv_obj {
 	qdf_freq_t range_5g_high;
 	bool dfs_enabled;
 	bool set_fcc_channel;
-	enum band_info band_capability;
+	uint32_t band_capability;
 	bool indoor_chan_enabled;
 	bool en_chan_144;
 	uint32_t wireless_modes;

drivers/net/wireless/qualcomm/wcn39xx/qca-wifi-host-cmn/umac/regulatory/core/src/reg_services_common.c

@@ -1509,22 +1509,6 @@ void reg_set_channel_params(struct wlan_objmgr_pdev *pdev,
 }
 #endif /* CONFIG_CHAN_NUM_API */
 
-QDF_STATUS reg_get_curr_band(struct wlan_objmgr_pdev *pdev,
-			     enum band_info *band)
-{
-	struct wlan_regulatory_pdev_priv_obj *pdev_reg;
-
-	pdev_reg = reg_get_pdev_obj(pdev);
-	if (!IS_VALID_PDEV_REG_OBJ(pdev_reg)) {
-		reg_err("pdev reg component is NULL");
-		return QDF_STATUS_E_INVAL;
-	}
-
-	*band = pdev_reg->band_capability;
-
-	return QDF_STATUS_SUCCESS;
-}
-
 QDF_STATUS reg_read_default_country(struct wlan_objmgr_psoc *psoc,
 				    uint8_t *country_code)
 {
@@ -2357,6 +2341,32 @@ static inline bool BAND_5G_PRESENT(uint8_t band_mask)
 	return !!(band_mask & (BIT(REG_BAND_5G)));
 }
 
+bool reg_is_freq_indoor(struct wlan_objmgr_pdev *pdev, qdf_freq_t freq)
+{
+	struct regulatory_channel *cur_chan_list;
+	struct wlan_regulatory_pdev_priv_obj *pdev_priv_obj;
+	enum channel_enum chan_enum;
+
+	pdev_priv_obj = reg_get_pdev_obj(pdev);
+
+	if (!IS_VALID_PDEV_REG_OBJ(pdev_priv_obj)) {
+		reg_err("reg pdev priv obj is NULL");
+		return false;
+	}
+
+	chan_enum = reg_get_chan_enum_for_freq(freq);
+
+	if (chan_enum == INVALID_CHANNEL) {
+		reg_err_rl("Invalid chan enum %d", chan_enum);
+		return false;
+	}
+
+	cur_chan_list = pdev_priv_obj->cur_chan_list;
+
+	return (cur_chan_list[chan_enum].chan_flags &
+		REGULATORY_CHAN_INDOOR_ONLY);
+}
+
 #ifdef CONFIG_BAND_6GHZ
 bool reg_is_6ghz_chan_freq(uint16_t freq)
 {
@@ -3410,13 +3420,46 @@ bool reg_is_dfs_for_freq(struct wlan_objmgr_pdev *pdev, qdf_freq_t freq)
 	return chan_flags & REGULATORY_CHAN_RADAR;
 }
 
+#ifdef CONFIG_REG_CLIENT
+/**
+ * reg_get_psoc_mas_chan_list () - Get psoc master channel list
+ * @pdev: pointer to pdev object
+ * @psoc: pointer to psoc object
+ *
+ * Return: psoc master chanel list
+ */
+static struct regulatory_channel *reg_get_psoc_mas_chan_list(
+						struct wlan_objmgr_pdev *pdev,
+						struct wlan_objmgr_psoc *psoc)
+{
+	struct wlan_regulatory_psoc_priv_obj *soc_reg;
+	uint8_t pdev_id;
+
+	soc_reg = reg_get_psoc_obj(psoc);
+	if (!soc_reg) {
+		reg_err("reg psoc private obj is NULL");
+		return NULL;
+	}
+	pdev_id = wlan_objmgr_pdev_get_pdev_id(pdev);
+
+	return soc_reg->mas_chan_params[pdev_id].mas_chan_list;
+}
+#else
+static inline struct regulatory_channel *reg_get_psoc_mas_chan_list(
+						struct wlan_objmgr_pdev *pdev,
+						struct wlan_objmgr_psoc *psoc)
+{
+	return NULL;
+}
+#endif
+
 void reg_update_nol_ch_for_freq(struct wlan_objmgr_pdev *pdev,
 				uint16_t *chan_freq_list,
 				uint8_t num_chan,
 				bool nol_chan)
 {
 	enum channel_enum chan_enum;
-	struct regulatory_channel *mas_chan_list;
+	struct regulatory_channel *mas_chan_list, *psoc_mas_chan_list;
 	struct wlan_regulatory_pdev_priv_obj *pdev_priv_obj;
 	struct wlan_objmgr_psoc *psoc;
 	uint16_t i;
@@ -3434,6 +3477,8 @@ void reg_update_nol_ch_for_freq(struct wlan_objmgr_pdev *pdev,
 		return;
 	}
 
+	psoc_mas_chan_list = reg_get_psoc_mas_chan_list(pdev, psoc);
+
 	mas_chan_list = pdev_priv_obj->mas_chan_list;
 	for (i = 0; i < num_chan; i++) {
 		chan_enum = reg_get_chan_enum_for_freq(chan_freq_list[i]);
@@ -3443,6 +3488,8 @@ void reg_update_nol_ch_for_freq(struct wlan_objmgr_pdev *pdev,
 			continue;
 		}
 		mas_chan_list[chan_enum].nol_chan = nol_chan;
+		if (psoc_mas_chan_list)
+			psoc_mas_chan_list[chan_enum].nol_chan = nol_chan;
 	}
 
 	reg_compute_pdev_current_chan_list(pdev_priv_obj);
@@ -3645,3 +3692,30 @@ reg_get_unii_5g_bitmap(struct wlan_objmgr_pdev *pdev, uint8_t *bitmap)
 	return QDF_STATUS_SUCCESS;
 }
 #endif
+
+#ifdef CONFIG_REG_CLIENT
+enum band_info reg_band_bitmap_to_band_info(uint32_t band_bitmap)
+{
+	if ((band_bitmap & BIT(REG_BAND_2G)) &&
+	    (band_bitmap & BIT(REG_BAND_5G)) &&
+	    (band_bitmap & BIT(REG_BAND_6G)))
+		return BAND_ALL;
+	else if ((band_bitmap & BIT(REG_BAND_5G)) &&
+		 (band_bitmap & BIT(REG_BAND_6G)))
+		return BAND_5G;
+	else if ((band_bitmap & BIT(REG_BAND_2G)) &&
+		 (band_bitmap & BIT(REG_BAND_6G)))
+		return BAND_2G;
+	else if ((band_bitmap & BIT(REG_BAND_2G)) &&
+		 (band_bitmap & BIT(REG_BAND_5G)))
+		return BAND_ALL;
+	else if (band_bitmap & BIT(REG_BAND_2G))
+		return BAND_2G;
+	else if (band_bitmap & BIT(REG_BAND_5G))
+		return BAND_5G;
+	else if (band_bitmap & BIT(REG_BAND_6G))
+		return BAND_2G;
+	else
+		return BAND_UNKNOWN;
+}
+#endif

drivers/net/wireless/qualcomm/wcn39xx/qca-wifi-host-cmn/umac/regulatory/core/src/reg_services_common.h

@@ -354,16 +354,6 @@ QDF_STATUS reg_program_default_cc(struct wlan_objmgr_pdev *pdev,
 QDF_STATUS reg_get_current_cc(struct wlan_objmgr_pdev *pdev,
 			      struct cc_regdmn_s *rd);
 
-/**
- * reg_get_curr_band() - Get current band
- * @pdev: Pdev pointer
- * @band: Pointer to save the current band
- *
- * Return: QDF_STATUS
- */
-QDF_STATUS reg_get_curr_band(struct wlan_objmgr_pdev *pdev,
-			     enum band_info *band);
-
 /**
  * reg_set_regdb_offloaded() - set/clear regulatory offloaded flag
  *
@@ -499,6 +489,15 @@ bool reg_is_24ghz_ch_freq(uint32_t freq);
  */
 bool reg_is_5ghz_ch_freq(uint32_t freq);
 
+/**
+ * reg_is_freq_indoor() - Check if the input frequency is an indoor frequency.
+ * @pdev: Pointer to pdev.
+ * @freq: Channel frequency.
+ *
+ * Return: Return true if the input frequency is indoor, else false.
+ */
+bool reg_is_freq_indoor(struct wlan_objmgr_pdev *pdev, qdf_freq_t freq);
+
 #ifdef CONFIG_BAND_6GHZ
 /**
  * reg_is_6ghz_chan_freq() - Check if the given channel frequency is 6GHz
@@ -1015,4 +1014,17 @@ QDF_STATUS
 reg_get_unii_5g_bitmap(struct wlan_objmgr_pdev *pdev, uint8_t *bitmap);
 #endif
 
+#ifdef CONFIG_REG_CLIENT
+/**
+ * reg_band_bitmap_to_band_info() - Convert the band_bitmap to a band_info enum.
+ *	Since band_info enum only has combinations for 2G and 5G, 6G is not
+ *	considered in this function.
+ * @band_bitmap: bitmap on top of reg_wifi_band of bands enabled
+ *
+ * Return: BAND_ALL if both 2G and 5G band is enabled
+ *	BAND_2G if 2G is enabled but 5G isn't
+ *	BAND_5G if 5G is enabled but 2G isn't
+ */
+enum band_info reg_band_bitmap_to_band_info(uint32_t band_bitmap);
+#endif
 #endif

drivers/net/wireless/qualcomm/wcn39xx/qca-wifi-host-cmn/umac/regulatory/core/src/reg_utils.c

@@ -449,8 +449,7 @@ bool reg_is_etsi13_srd_chan_allowed_master_mode(struct wlan_objmgr_pdev *pdev)
 }
 #endif
 
-QDF_STATUS reg_set_band(struct wlan_objmgr_pdev *pdev,
-			enum band_info band)
+QDF_STATUS reg_set_band(struct wlan_objmgr_pdev *pdev, uint32_t band_bitmap)
 {
 	struct wlan_regulatory_psoc_priv_obj *psoc_priv_obj;
 	struct wlan_regulatory_pdev_priv_obj *pdev_priv_obj;
@@ -464,8 +463,8 @@ QDF_STATUS reg_set_band(struct wlan_objmgr_pdev *pdev,
 		return QDF_STATUS_E_INVAL;
 	}
 
-	if (pdev_priv_obj->band_capability == band) {
-		reg_info("same band %d", band);
+	if (pdev_priv_obj->band_capability == band_bitmap) {
+		reg_info("same band %d", band_bitmap);
 		return QDF_STATUS_SUCCESS;
 	}
 
@@ -481,8 +480,8 @@ QDF_STATUS reg_set_band(struct wlan_objmgr_pdev *pdev,
 		return QDF_STATUS_E_INVAL;
 	}
 
-	reg_info("set band_info: %d", band);
-	pdev_priv_obj->band_capability = band;
+	reg_info("set band bitmap: %d", band_bitmap);
+	pdev_priv_obj->band_capability = band_bitmap;
 
 	reg_compute_pdev_current_chan_list(pdev_priv_obj);
 
@@ -492,11 +491,9 @@ QDF_STATUS reg_set_band(struct wlan_objmgr_pdev *pdev,
 }
 
 QDF_STATUS reg_get_band(struct wlan_objmgr_pdev *pdev,
-			enum band_info *band)
+			uint32_t *band_bitmap)
 {
-	struct wlan_regulatory_psoc_priv_obj *psoc_priv_obj;
 	struct wlan_regulatory_pdev_priv_obj *pdev_priv_obj;
-	struct wlan_objmgr_psoc *psoc;
 
 	pdev_priv_obj = reg_get_pdev_obj(pdev);
 
@@ -505,20 +502,8 @@ QDF_STATUS reg_get_band(struct wlan_objmgr_pdev *pdev,
 		return QDF_STATUS_E_INVAL;
 	}
 
-	psoc = wlan_pdev_get_psoc(pdev);
-	if (!psoc) {
-		reg_err("psoc is NULL");
-		return QDF_STATUS_E_INVAL;
-	}
-
-	psoc_priv_obj = reg_get_psoc_obj(psoc);
-	if (!IS_VALID_PSOC_REG_OBJ(psoc_priv_obj)) {
-		reg_err("psoc reg component is NULL");
-		return QDF_STATUS_E_INVAL;
-	}
-
-	reg_debug("get band_info: %d", pdev_priv_obj->band_capability);
-	*band = pdev_priv_obj->band_capability;
+	reg_debug("get band bitmap: %d", pdev_priv_obj->band_capability);
+	*band_bitmap = pdev_priv_obj->band_capability;
 
 	return QDF_STATUS_SUCCESS;
 }
@@ -802,6 +787,8 @@ QDF_STATUS reg_set_config_vars(struct wlan_objmgr_psoc *psoc,
 		config_vars.enable_srd_chan_in_master_mode;
 	psoc_priv_obj->enable_11d_in_world_mode =
 		config_vars.enable_11d_in_world_mode;
+	psoc_priv_obj->retain_nol_across_regdmn_update =
+		config_vars.retain_nol_across_regdmn_update;
 
 	status = wlan_objmgr_psoc_try_get_ref(psoc, WLAN_REGULATORY_SB_ID);
 	if (QDF_IS_STATUS_ERROR(status)) {

drivers/net/wireless/qualcomm/wcn39xx/qca-wifi-host-cmn/umac/regulatory/core/src/reg_utils.h

@@ -216,20 +216,20 @@ QDF_STATUS reg_cache_channel_state(struct wlan_objmgr_pdev *pdev,
 /**
  * reg_set_band() - Sets the band information for the PDEV
  * @pdev: The physical dev to set the band for
- * @band: The set band parameters to configure for the physical device
+ * @band_bitmap: The set band parameters to configure for the physical device
  *
  * Return: QDF_STATUS
  */
-QDF_STATUS reg_set_band(struct wlan_objmgr_pdev *pdev, enum band_info band);
+QDF_STATUS reg_set_band(struct wlan_objmgr_pdev *pdev, uint32_t band_bitmap);
 
 /**
  * reg_get_band() - Get the band information for the PDEV
  * @pdev: The physical dev to get the band for
- * @band: The band parameters of the physical device
+ * @band_bitmap: The band parameters of the physical device
  *
  * Return: QDF_STATUS
  */
-QDF_STATUS reg_get_band(struct wlan_objmgr_pdev *pdev, enum band_info *band);
+QDF_STATUS reg_get_band(struct wlan_objmgr_pdev *pdev, uint32_t *band_bitmap);
 
 /**
  * reg_set_fcc_constraint() - Apply fcc constraints on channels 12/13
@@ -655,4 +655,5 @@ static inline void set_disable_channel_state(
 {
 }
 #endif
+
 #endif

drivers/net/wireless/qualcomm/wcn39xx/qca-wifi-host-cmn/umac/regulatory/dispatcher/inc/reg_services_public_struct.h

@@ -949,18 +949,20 @@ enum restart_beaconing_on_ch_avoid_rule {
  * away from active LTE channels
  * @enable_srd_chan_in_master_mode: SRD channel support in master mode
  * @enable_11d_in_world_mode: enable 11d in world mode
+ * @retain_nol_across_regdmn_update: Retain the NOL list across the regdomain.
  */
 struct reg_config_vars {
 	uint32_t enable_11d_support;
 	uint32_t scan_11d_interval;
 	uint32_t userspace_ctry_priority;
-	enum band_info band_capability;
+	uint32_t band_capability;
 	uint32_t dfs_enabled;
 	uint32_t indoor_chan_enabled;
 	uint32_t force_ssc_disable_indoor_channel;
 	enum restart_beaconing_on_ch_avoid_rule restart_beaconing;
 	bool enable_srd_chan_in_master_mode;
 	bool enable_11d_in_world_mode;
+	bool retain_nol_across_regdmn_update;
 };
 
 /**

drivers/net/wireless/qualcomm/wcn39xx/qca-wifi-host-cmn/umac/regulatory/dispatcher/inc/wlan_reg_services_api.h

@@ -132,6 +132,15 @@ bool wlan_reg_is_24ghz_ch_freq(qdf_freq_t freq);
 #define WLAN_REG_IS_5GHZ_CH_FREQ(freq) wlan_reg_is_5ghz_ch_freq(freq)
 bool wlan_reg_is_5ghz_ch_freq(qdf_freq_t freq);
 
+/**
+ * wlan_reg_is_freq_indoor() - Check if a frequency is indoor.
+ * @pdev: Pointer to pdev.
+ * @freq: Channel frequency.
+ *
+ * Return: Return true if a frequency is indoor, else false.
+ */
+bool wlan_reg_is_freq_indoor(struct wlan_objmgr_pdev *pdev, qdf_freq_t freq);
+
 #ifdef CONFIG_BAND_6GHZ
 /**
  * wlan_reg_is_6ghz_chan_freq() - Check if the given channel frequency is 6GHz
@@ -1294,4 +1303,16 @@ wlan_reg_country_chan_opclass_to_freq(struct wlan_objmgr_pdev *pdev,
 uint16_t wlan_reg_chan_opclass_to_freq(uint8_t chan,
 				       uint8_t op_class,
 				       bool global_tbl_lookup);
+#ifdef CONFIG_REG_CLIENT
+/**
+ * wlan_reg_band_bitmap_to_band_info() - Convert the band_bitmap to a
+ *	band_info enum
+ * @band_bitmap: bitmap on top of reg_wifi_band of bands enabled
+ *
+ * Return: BAND_ALL if both 2G and 5G band is enabled
+ *	BAND_2G if 2G is enabled but 5G isn't
+ *	BAND_5G if 5G is enabled but 2G isn't
+ */
+enum band_info wlan_reg_band_bitmap_to_band_info(uint32_t band_bitmap);
+#endif
 #endif

drivers/net/wireless/qualcomm/wcn39xx/qca-wifi-host-cmn/umac/regulatory/dispatcher/inc/wlan_reg_ucfg_api.h

@@ -31,22 +31,23 @@ typedef QDF_STATUS (*reg_event_cb)(void *status_struct);
 /**
  * ucfg_reg_set_band() - Sets the band information for the PDEV
  * @pdev: The physical pdev to set the band for
- * @band: The set band parameter to configure for the physical device
+ * @band_bitmap: The band bitmap parameter (over reg_wifi_band) to configure
+ *	for the physical device
  *
  * Return: QDF_STATUS
  */
 QDF_STATUS ucfg_reg_set_band(struct wlan_objmgr_pdev *pdev,
-			     enum band_info band);
+			     uint32_t band_bitmap);
 
 /**
  * ucfg_reg_get_band() - Gets the band information for the PDEV
  * @pdev: The physical pdev to get the band for
- * @band: The band parameter of the physical device
+ * @band_bitmap: The band parameter of the physical device
  *
  * Return: QDF_STATUS
  */
 QDF_STATUS ucfg_reg_get_band(struct wlan_objmgr_pdev *pdev,
-			     enum band_info *band);
+			     uint32_t *band_bitmap);
 
 /**
  * ucfg_reg_notify_sap_event() - Notify regulatory domain for sap event
@@ -175,15 +176,6 @@ QDF_STATUS ucfg_reg_set_country(struct wlan_objmgr_pdev *dev,
  */
 QDF_STATUS ucfg_reg_reset_country(struct wlan_objmgr_psoc *psoc);
 
-/**
- * ucfg_reg_get_curr_band() - Get the current band capability
- * @pdev: The physical dev to get default country from
- * @band: buffer to populate the band into
- *
- * Return: QDF_STATUS
- */
-QDF_STATUS ucfg_reg_get_curr_band(struct wlan_objmgr_pdev *pdev,
-		enum band_info *band);
 /**
  * ucfg_reg_enable_dfs_channels() - Enable the use of DFS channels
  * @pdev: The physical dev to enable DFS channels for

drivers/net/wireless/qualcomm/wcn39xx/qca-wifi-host-cmn/umac/regulatory/dispatcher/src/wlan_reg_services_api.c

@@ -751,6 +751,11 @@ bool wlan_reg_is_5ghz_ch_freq(qdf_freq_t freq)
 	return reg_is_5ghz_ch_freq(freq);
 }
 
+bool wlan_reg_is_freq_indoor(struct wlan_objmgr_pdev *pdev, qdf_freq_t freq)
+{
+	return reg_is_freq_indoor(pdev, freq);
+}
+
 #ifdef CONFIG_BAND_6GHZ
 bool wlan_reg_is_6ghz_chan_freq(uint16_t freq)
 {
@@ -1111,3 +1116,10 @@ uint16_t wlan_reg_chan_opclass_to_freq(uint8_t chan,
 
 	return reg_chan_opclass_to_freq(chan, op_class, global_tbl_lookup);
 }
+
+#ifdef CONFIG_REG_CLIENT
+enum band_info wlan_reg_band_bitmap_to_band_info(uint32_t band_bitmap)
+{
+	return reg_band_bitmap_to_band_info(band_bitmap);
+}
+#endif

drivers/net/wireless/qualcomm/wcn39xx/qca-wifi-host-cmn/umac/regulatory/dispatcher/src/wlan_reg_ucfg_api.c

@@ -119,15 +119,15 @@ QDF_STATUS ucfg_reg_get_current_cc(struct wlan_objmgr_pdev *pdev,
 #ifdef CONFIG_REG_CLIENT
 
 QDF_STATUS ucfg_reg_set_band(struct wlan_objmgr_pdev *pdev,
-			     enum band_info band)
+			     uint32_t band_bitmap)
 {
-	return reg_set_band(pdev, band);
+	return reg_set_band(pdev, band_bitmap);
 }
 
 QDF_STATUS ucfg_reg_get_band(struct wlan_objmgr_pdev *pdev,
-			     enum band_info *band)
+			     uint32_t *band_bitmap)
 {
-	return reg_get_band(pdev, band);
+	return reg_get_band(pdev, band_bitmap);
 }
 
 /**
@@ -227,13 +227,6 @@ QDF_STATUS ucfg_reg_enable_dfs_channels(struct wlan_objmgr_pdev *pdev,
 	return reg_enable_dfs_channels(pdev, dfs_enable);
 }
 
-QDF_STATUS ucfg_reg_get_curr_band(struct wlan_objmgr_pdev *pdev,
-				  enum band_info *band)
-{
-	return reg_get_curr_band(pdev, band);
-
-}
-
 void ucfg_reg_register_chan_change_callback(struct wlan_objmgr_psoc *psoc,
 					    void *cbk, void *arg)
 {

drivers/net/wireless/qualcomm/wcn39xx/qca-wifi-host-cmn/umac/scan/dispatcher/inc/wlan_scan_utils_api.h

@@ -1401,7 +1401,7 @@ util_scan_entry_get_extcap(struct scan_cache_entry *scan_entry,
 	if (!ext_cap)
 		return QDF_STATUS_E_NULL_VALUE;
 
-	if (ext_cap->ext_cap_len < ext_caps_byte)
+	if (ext_cap->ext_cap_len <= ext_caps_byte)
 		return QDF_STATUS_E_NULL_VALUE;
 
 	*extcap_value =

drivers/net/wireless/qualcomm/wcn39xx/qca-wifi-host-cmn/wmi/inc/wmi_unified_param.h

@@ -620,6 +620,7 @@ typedef enum {
  * @set_agile: is agile mode
  * @allow_he: HE allowed on chan
  * @psc_channel: 6 ghz preferred scan chan
+ * @nan_disabled: is NAN disabled on @mhz
  * @phy_mode: phymode (vht80 or ht40 or ...)
  * @cfreq1: centre frequency on primary
  * @cfreq2: centre frequency on secondary
@@ -644,7 +645,8 @@ struct channel_param {
 		allow_vht:1,
 		set_agile:1,
 		allow_he:1,
-		psc_channel:1;
+		psc_channel:1,
+		nan_disabled:1;
 	uint32_t phy_mode;
 	uint32_t cfreq1;
 	uint32_t cfreq2;

drivers/net/wireless/qualcomm/wcn39xx/qca-wifi-host-cmn/wmi/src/wmi_unified_tlv.c

@@ -3297,6 +3297,10 @@ static QDF_STATUS send_scan_chan_list_cmd_tlv(wmi_unified_t wmi_handle,
 				WMI_SET_CHANNEL_FLAG(chan_info,
 						     WMI_CHAN_FLAG_PSC);
 
+			if (tchan_info->nan_disabled)
+				WMI_SET_CHANNEL_FLAG(chan_info,
+					     WMI_CHAN_FLAG_NAN_DISABLED);
+
 			/* also fill in power information */
 			WMI_SET_CHANNEL_MIN_POWER(chan_info,
 						  tchan_info->minpower);
@@ -6648,6 +6652,19 @@ static void wmi_copy_twt_resource_config(wmi_resource_config *resource_cfg,
 }
 #endif
 
+#ifdef WLAN_FEATURE_NAN
+static void wmi_set_nan_channel_support(wmi_resource_config *resource_cfg)
+{
+	WMI_RSRC_CFG_HOST_SERVICE_FLAG_NAN_CHANNEL_SUPPORT_SET(
+		resource_cfg->host_service_flags, 1);
+}
+#else
+static inline
+void wmi_set_nan_channel_support(wmi_resource_config *resource_cfg)
+{
+}
+#endif
+
 static
 void wmi_copy_resource_config(wmi_resource_config *resource_cfg,
 				target_resource_config *tgt_res_cfg)
@@ -6855,6 +6872,7 @@ void wmi_copy_resource_config(wmi_resource_config *resource_cfg,
 		resource_cfg->host_service_flags,
 		tgt_res_cfg->nan_separate_iface_support);
 
+	wmi_set_nan_channel_support(resource_cfg);
 }
 
 /* copy_hw_mode_id_in_init_cmd() - Helper routine to copy hw_mode in init cmd

drivers/net/wireless/qualcomm/wcn39xx/qcacld-3.0/components/cmn_services/policy_mgr/src/wlan_policy_mgr_action.c

@@ -35,6 +35,7 @@
 #include "wlan_nan_api.h"
 #include "nan_ucfg_api.h"
 #include "sap_api.h"
+#include "wlan_mlme_api.h"
 
 enum policy_mgr_conc_next_action (*policy_mgr_get_current_pref_hw_mode_ptr)
 	(struct wlan_objmgr_psoc *psoc);
@@ -1940,6 +1941,22 @@ QDF_STATUS policy_mgr_valid_sap_conc_channel_check(
 	uint32_t temp_ch_freq = 0;
 	struct policy_mgr_psoc_priv_obj *pm_ctx;
 	bool sta_sap_scc_on_dfs_chan;
+	struct wlan_objmgr_vdev *vdev;
+	enum QDF_OPMODE vdev_opmode;
+	bool enable_srd_channel;
+
+	vdev = wlan_objmgr_get_vdev_by_id_from_psoc(psoc, sap_vdev_id,
+						    WLAN_POLICY_MGR_ID);
+	if (!vdev) {
+		policy_mgr_err("vdev is NULL");
+		return QDF_STATUS_E_INVAL;
+	}
+
+	vdev_opmode = wlan_vdev_mlme_get_opmode(vdev);
+	wlan_objmgr_vdev_release_ref(vdev, WLAN_POLICY_MGR_ID);
+
+	wlan_mlme_get_srd_master_mode_for_vdev(psoc, vdev_opmode,
+					       &enable_srd_channel);
 
 	pm_ctx = policy_mgr_get_context(psoc);
 	if (!pm_ctx) {
@@ -1981,8 +1998,7 @@ QDF_STATUS policy_mgr_valid_sap_conc_channel_check(
 							    ch_freq) ||
 		    !(policy_mgr_sta_sap_scc_on_lte_coex_chan(psoc) ||
 		      policy_mgr_is_safe_channel(psoc, ch_freq)) ||
-		    (!wlan_reg_is_etsi13_srd_chan_allowed_master_mode(
-								pm_ctx->pdev) &&
+		    (!enable_srd_channel &&
 		     wlan_reg_is_etsi13_srd_chan_for_freq(pm_ctx->pdev,
 							  ch_freq))) {
 			if (wlan_reg_is_dfs_for_freq(pm_ctx->pdev, ch_freq) &&

drivers/net/wireless/qualcomm/wcn39xx/qcacld-3.0/components/cmn_services/policy_mgr/src/wlan_policy_mgr_core.c

@@ -2116,7 +2116,6 @@ QDF_STATUS policy_mgr_get_channel_list(struct wlan_objmgr_psoc *psoc,
 	uint32_t sbs_num_channels = 0;
 	uint32_t chan_index_24 = 0, chan_index_5 = 0, chan_index_6 = 0;
 	bool skip_dfs_channel = false;
-	bool is_etsi13_srd_chan_allowed_in_mas_mode = true;
 	uint32_t i = 0, j = 0;
 	struct policy_mgr_psoc_priv_obj *pm_ctx;
 	bool sta_sap_scc_on_dfs_chan;
@@ -2180,9 +2179,6 @@ QDF_STATUS policy_mgr_get_channel_list(struct wlan_objmgr_psoc *psoc,
 			policy_mgr_debug("skip DFS ch from pcl for SAP/Go");
 			skip_dfs_channel = true;
 		}
-		is_etsi13_srd_chan_allowed_in_mas_mode =
-			wlan_reg_is_etsi13_srd_chan_allowed_master_mode(pm_ctx->
-									pdev);
 	}
 
 	/* Let's divide the list in 2.4 & 5 Ghz lists */
@@ -2195,11 +2191,6 @@ QDF_STATUS policy_mgr_get_channel_list(struct wlan_objmgr_psoc *psoc,
 						     channel_list[i]))
 				continue;
 
-			if (!is_etsi13_srd_chan_allowed_in_mas_mode &&
-			    wlan_reg_is_etsi13_srd_chan_for_freq(
-			    pm_ctx->pdev, channel_list[i]))
-				continue;
-
 			channel_list_5[chan_index_5++] = channel_list[i];
 		} else if (wlan_reg_is_6ghz_chan_freq(channel_list[i])) {
 			/* Add to 5G list untill 6G conc support is enabled */

drivers/net/wireless/qualcomm/wcn39xx/qcacld-3.0/components/cmn_services/policy_mgr/src/wlan_policy_mgr_pcl.c

@@ -545,18 +545,12 @@ policy_mgr_modify_pcl_based_on_srd(struct wlan_objmgr_psoc *psoc,
 	uint32_t pcl_list[NUM_CHANNELS];
 	uint8_t weight_list[NUM_CHANNELS];
 	struct policy_mgr_psoc_priv_obj *pm_ctx;
-	bool is_etsi13_srd_chan_allowed_in_mas_mode = true;
 
 	pm_ctx = policy_mgr_get_context(psoc);
 	if (!pm_ctx) {
 		policy_mgr_err("Invalid Context");
 		return QDF_STATUS_E_FAILURE;
 	}
-	is_etsi13_srd_chan_allowed_in_mas_mode =
-		wlan_reg_is_etsi13_srd_chan_allowed_master_mode(pm_ctx->pdev);
-
-	if (is_etsi13_srd_chan_allowed_in_mas_mode)
-		return QDF_STATUS_SUCCESS;
 
 	if (*pcl_len_org > NUM_CHANNELS) {
 		policy_mgr_err("Invalid PCL List Length %d", *pcl_len_org);
@@ -589,6 +583,7 @@ static QDF_STATUS policy_mgr_pcl_modification_for_sap(
 	bool nol_modified_pcl = false;
 	bool dfs_modified_pcl = false;
 	bool modified_final_pcl = false;
+	bool srd_chan_enabled;
 
 	if (policy_mgr_is_sap_mandatory_channel_set(psoc)) {
 		status = policy_mgr_modify_sap_pcl_based_on_mandatory_channel(
@@ -617,12 +612,18 @@ static QDF_STATUS policy_mgr_pcl_modification_for_sap(
 	}
 	dfs_modified_pcl = true;
 
-	status = policy_mgr_modify_pcl_based_on_srd
-			(psoc, pcl_channels, pcl_weight, len);
-	if (QDF_IS_STATUS_ERROR(status)) {
-		policy_mgr_err("failed to get srd modified pcl for SAP");
-		return status;
+	wlan_mlme_get_srd_master_mode_for_vdev(psoc, QDF_SAP_MODE,
+					       &srd_chan_enabled);
+
+	if (!srd_chan_enabled) {
+		status = policy_mgr_modify_pcl_based_on_srd
+				(psoc, pcl_channels, pcl_weight, len);
+		if (QDF_IS_STATUS_ERROR(status)) {
+			policy_mgr_err("Failed to modify SRD in pcl for SAP");
+			return status;
+		}
 	}
+
 	modified_final_pcl = true;
 	policy_mgr_debug(" %d %d %d %d",
 			 mandatory_modified_pcl,
@@ -640,6 +641,7 @@ static QDF_STATUS policy_mgr_pcl_modification_for_p2p_go(
 {
 	QDF_STATUS status = QDF_STATUS_E_FAILURE;
 	struct policy_mgr_psoc_priv_obj *pm_ctx;
+	bool srd_chan_enabled;
 
 	pm_ctx = policy_mgr_get_context(psoc);
 	if (!pm_ctx) {
@@ -654,12 +656,18 @@ static QDF_STATUS policy_mgr_pcl_modification_for_p2p_go(
 		return status;
 	}
 
-	status = policy_mgr_modify_pcl_based_on_srd
-			(psoc, pcl_channels, pcl_weight, len);
-	if (QDF_IS_STATUS_ERROR(status)) {
-		policy_mgr_err("failed to get srd modified pcl for P2P-GO");
-		return status;
+	wlan_mlme_get_srd_master_mode_for_vdev(psoc, QDF_P2P_GO_MODE,
+					       &srd_chan_enabled);
+
+	if (!srd_chan_enabled) {
+		status = policy_mgr_modify_pcl_based_on_srd
+				(psoc, pcl_channels, pcl_weight, len);
+		if (QDF_IS_STATUS_ERROR(status)) {
+			policy_mgr_err("Failed to modify SRD in pcl for GO");
+			return status;
+		}
 	}
+
 	policy_mgr_dump_channel_list(*len, pcl_channels, pcl_weight);
 
 	return QDF_STATUS_SUCCESS;

drivers/net/wireless/qualcomm/wcn39xx/qcacld-3.0/components/mlme/core/src/wlan_mlme_main.c

@@ -2392,8 +2392,8 @@ static void mlme_init_reg_cfg(struct wlan_objmgr_psoc *psoc,
 	struct wlan_objmgr_pdev *pdev = NULL;
 
 	reg->self_gen_frm_pwr = cfg_get(psoc, CFG_SELF_GEN_FRM_PWR);
-	reg->etsi13_srd_chan_in_master_mode =
-			cfg_get(psoc, CFG_ETSI13_SRD_CHAN_IN_MASTER_MODE);
+	reg->etsi_srd_chan_in_master_mode =
+			cfg_get(psoc, CFG_ETSI_SRD_CHAN_IN_MASTER_MODE);
 	reg->restart_beaconing_on_ch_avoid =
 			cfg_get(psoc, CFG_RESTART_BEACONING_ON_CH_AVOID);
 	reg->indoor_channel_support = cfg_get(psoc, CFG_INDOOR_CHANNEL_SUPPORT);
@@ -2405,6 +2405,8 @@ static void mlme_init_reg_cfg(struct wlan_objmgr_psoc *psoc,
 	reg->ignore_fw_reg_offload_ind = cfg_get(
 						psoc,
 						CFG_IGNORE_FW_REG_OFFLOAD_IND);
+	reg->retain_nol_across_regdmn_update =
+		cfg_get(psoc, CFG_RETAIN_NOL_ACROSS_REG_DOMAIN);
 
 	qdf_uint8_array_parse(cfg_default(CFG_VALID_CHANNEL_LIST),
 			      channel_list,
@@ -2412,6 +2414,9 @@ static void mlme_init_reg_cfg(struct wlan_objmgr_psoc *psoc,
 			      &valid_channel_list_num);
 	reg->valid_channel_list_num = (uint8_t)valid_channel_list_num;
 
+	reg->enable_nan_on_indoor_channels =
+		cfg_get(psoc, CFG_INDOOR_CHANNEL_SUPPORT_FOR_NAN);
+
 	pdev = wlan_objmgr_get_pdev_by_id(psoc, 0, WLAN_MLME_NB_ID);
 	if (!pdev) {
 		mlme_legacy_err("null pdev");

drivers/net/wireless/qualcomm/wcn39xx/qcacld-3.0/components/mlme/dispatcher/inc/cfg_mlme_reg.h

@@ -73,14 +73,20 @@
 
 /*
  * <ini>
- * etsi13_srd_chan_in_master_mode - Enable/disable ETSI SRD channels in
+ * etsi_srd_chan_in_master_mode - Enable/disable ETSI SRD channels in
  * master mode PCL and ACS functionality
  * @Min: 0
- * @Max: 1
- * @Default: 0
+ * @Max: 0xFF
+ * @Default: 6
  *
- * etsi13_srd_chan_in_master_mode is to enable/disable ETSI SRD channels in
+ * etsi_srd_chan_in_master_mode is to enable/disable ETSI SRD channels in
  * master mode PCL and ACS functionality
+ * Bit map for enabling the SRD mode in various modes are as follows:-
+ * BIT 0:- Enable/Disable SRD channels for SAP.
+ * BIT 1:- Enable/Disable SRD channels for P2P-GO.
+ * BIT 2:- Enable/Disable SRD channels for NAN.
+ * Rest of the bits are currently reserved for future SRD channel support for
+ * other vdevs.
  *
  * Related: None
  *
@@ -90,11 +96,37 @@
  *
  * </ini>
  */
-#define CFG_ETSI13_SRD_CHAN_IN_MASTER_MODE CFG_INI_BOOL( \
+#define CFG_ETSI_SRD_CHAN_IN_MASTER_MODE CFG_INI_UINT( \
 	"etsi13_srd_chan_in_master_mode", \
 	0, \
+	0xff, \
+	6, \
+	CFG_VALUE_OR_DEFAULT, \
 	"enable/disable ETSI SRD channels in master mode")
 
+/*
+ * <ini>
+ * enable_nan_indoor_channel - Enable Indoor channels for NAN
+ * @Min: 0
+ * @Max: 1
+ * @Default: 0
+ *
+ * This ini is used to support to indoor channels for NAN interface
+ * Customer can config this item to enable/disable NAN in indoor channel
+ *
+ * Related: None
+ *
+ * Supported Feature: NAN
+ *
+ * Usage: External
+ *
+ * </ini>
+ */
+#define CFG_INDOOR_CHANNEL_SUPPORT_FOR_NAN CFG_INI_BOOL( \
+	"enable_nan_indoor_channel", \
+	0, \
+	"enable/disable indoor channels for NAN")
+
 #ifdef SAP_AVOID_ACS_FREQ_LIST
 #define SAP_AVOID_ACS_FREQ_LIST_DEFAULT ""
 
@@ -297,17 +329,42 @@
 			0, \
 			"Enable Pending list req")
 
+/*
+ * <ini>
+ * retain_nol_across_regdmn - Retain NOL across reg domain
+ * @Min: 0
+ * @Max: 1
+ * @Default: 1
+ *
+ * This ini is used to set if NOL needs to be retained
+ * on the reg domain change.
+ *
+ * Related: None
+ *
+ * Supported Feature: SAP
+ *
+ * Usage: External
+ *
+ * </ini>
+ */
+#define CFG_RETAIN_NOL_ACROSS_REG_DOMAIN CFG_INI_BOOL( \
+		"retain_nol_across_regdmn", \
+		1, \
+		"Retain NOL even if the regdomain changes")
+
 #define CFG_REG_ALL \
 	CFG(CFG_SELF_GEN_FRM_PWR) \
 	CFG(CFG_ENABLE_PENDING_CHAN_LIST_REQ) \
 	CFG(CFG_ENABLE_11D_IN_WORLD_MODE) \
-	CFG(CFG_ETSI13_SRD_CHAN_IN_MASTER_MODE) \
+	CFG(CFG_ETSI_SRD_CHAN_IN_MASTER_MODE) \
+	CFG(CFG_INDOOR_CHANNEL_SUPPORT_FOR_NAN) \
 	CFG(CFG_RESTART_BEACONING_ON_CH_AVOID) \
 	CFG(CFG_INDOOR_CHANNEL_SUPPORT) \
 	CFG(CFG_SCAN_11D_INTERVAL) \
 	CFG(CFG_VALID_CHANNEL_LIST) \
 	CFG(CFG_COUNTRY_CODE) \
 	CFG(CFG_IGNORE_FW_REG_OFFLOAD_IND) \
+	CFG(CFG_RETAIN_NOL_ACROSS_REG_DOMAIN) \
 	CFG_SAP_AVOID_ACS_FREQ_LIST_ALL
 
 #endif /* CFG_MLME_REG_H__ */

drivers/net/wireless/qualcomm/wcn39xx/qcacld-3.0/components/mlme/dispatcher/inc/wlan_mlme_api.h

@@ -1903,6 +1903,30 @@ QDF_STATUS wlan_mlme_get_vht_tx_mcs_2x2(struct wlan_objmgr_psoc *psoc,
 QDF_STATUS
 wlan_mlme_get_vht20_mcs9(struct wlan_objmgr_psoc *psoc, bool *value);
 
+/**
+ * wlan_mlme_get_srd_master_mode_for_vdev  - Get SRD master mode for vdev
+ * @psoc:          pointer to psoc object
+ * @vdev_opmode:   vdev operating mode
+ * @value:  pointer to the value which will be filled for the caller
+ *
+ * Return: QDF Status
+ */
+QDF_STATUS
+wlan_mlme_get_srd_master_mode_for_vdev(struct wlan_objmgr_psoc *psoc,
+				       enum QDF_OPMODE vdev_opmode,
+				       bool *value);
+
+/**
+ * wlan_mlme_get_indoor_support_for_nan  - Get indoor channel support for NAN
+ * @psoc: pointer to psoc object
+ * @value: pointer to the value which will be filled for the caller
+ *
+ * Return: QDF Status
+ */
+QDF_STATUS
+wlan_mlme_get_indoor_support_for_nan(struct wlan_objmgr_psoc *psoc,
+				     bool *value);
+
 /**
  * wlan_mlme_get_vht_enable2x2() - Enables/disables VHT Tx/Rx MCS values for 2x2
  * @psoc: psoc context

drivers/net/wireless/qualcomm/wcn39xx/qcacld-3.0/components/mlme/dispatcher/inc/wlan_mlme_public_struct.h

@@ -2211,11 +2211,23 @@ struct wlan_mlme_mwc {
 };
 #endif
 
+/**
+ * enum mlme_reg_srd_master_modes  - Bitmap of SRD master modes supported
+ * @MLME_SRD_MASTER_MODE_SAP: SRD master mode for SAP
+ * @MLME_SRD_MASTER_MODE_P2P_GO: SRD master mode for P2P-GO
+ * @MLME_SRD_MASTER_MODE_NAN: SRD master mode for NAN
+ */
+enum mlme_reg_srd_master_modes {
+	MLME_SRD_MASTER_MODE_SAP = 1,
+	MLME_SRD_MASTER_MODE_P2P_GO = 2,
+	MLME_SRD_MASTER_MODE_NAN = 4,
+};
+
 /**
  * struct wlan_mlme_reg - REG related configs
  * @self_gen_frm_pwr: self-generated frame power in tx chain mask
  * for CCK rates
- * @etsi13_srd_chan_in_master_mode: etsi13 srd chan in master mode
+ * @etsi_srd_chan_in_master_mode: etsi srd chan in master mode
  * @restart_beaconing_on_ch_avoid: restart beaconing on ch avoid
  * @indoor_channel_support: indoor channel support
  * @scan_11d_interval: scan 11d interval
@@ -2230,10 +2242,12 @@ struct wlan_mlme_mwc {
  * @ignore_fw_reg_offload_ind: Ignore fw regulatory offload indication
  * @enable_pending_chan_list_req: enables/disables scan channel
  * list command to FW till the current scan is complete.
+ * @retain_nol_across_regdmn_update: Retain the NOL list across the regdomain.
+ * @enable_nan_on_indoor_channels: Enable nan on Indoor channels
  */
 struct wlan_mlme_reg {
 	uint32_t self_gen_frm_pwr;
-	bool etsi13_srd_chan_in_master_mode;
+	uint8_t etsi_srd_chan_in_master_mode;
 	enum restart_beaconing_on_ch_avoid_rule
 		restart_beaconing_on_ch_avoid;
 	bool indoor_channel_support;
@@ -2249,6 +2263,8 @@ struct wlan_mlme_reg {
 #endif
 	bool ignore_fw_reg_offload_ind;
 	bool enable_pending_chan_list_req;
+	bool retain_nol_across_regdmn_update;
+	bool enable_nan_on_indoor_channels;
 };
 
 /**

drivers/net/wireless/qualcomm/wcn39xx/qcacld-3.0/components/mlme/dispatcher/inc/wlan_mlme_ucfg_api.h

@@ -3750,7 +3750,7 @@ ucfg_mlme_get_mws_coex_scc_channel_avoid_delay(struct wlan_objmgr_psoc *psoc,
 #endif
 
 /**
- * ucfg_mlme_get_etsi13_srd_chan_in_master_mode  - get etsi13 srd chan
+ * ucfg_mlme_get_etsi_srd_chan_in_master_mode  - get etsi srd chan
  * in master mode
  * @psoc:   pointer to psoc object
  * @value:  pointer to the value which will be filled for the caller
@@ -3758,8 +3758,21 @@ ucfg_mlme_get_mws_coex_scc_channel_avoid_delay(struct wlan_objmgr_psoc *psoc,
  * Return: QDF Status
  */
 QDF_STATUS
-ucfg_mlme_get_etsi13_srd_chan_in_master_mode(struct wlan_objmgr_psoc *psoc,
-					     bool *value);
+ucfg_mlme_get_etsi_srd_chan_in_master_mode(struct wlan_objmgr_psoc *psoc,
+					   uint8_t *value);
+
+/**
+ * ucfg_mlme_get_srd_master_mode_for_vdev()  - Get SRD master mode for vdev
+ * @psoc:          pointer to psoc object
+ * @vdev_opmode:   vdev opmode
+ * @value:  pointer to the value which will be filled for the caller
+ *
+ * Return: QDF Status
+ */
+QDF_STATUS
+ucfg_mlme_get_srd_master_mode_for_vdev(struct wlan_objmgr_psoc *psoc,
+				       enum QDF_OPMODE vdev_opmode,
+				       bool *value);
 
 #ifdef SAP_AVOID_ACS_FREQ_LIST
 /**
@@ -3830,6 +3843,17 @@ QDF_STATUS
 ucfg_mlme_get_scan_11d_interval(struct wlan_objmgr_psoc *psoc,
 				uint32_t *value);
 
+/**
+ * ucfg_mlme_get_nol_across_regdmn() - get scan 11d interval
+ * @psoc: pointer to psoc object
+ * @value:  Pointer to the value which will be filled for the caller
+ *
+ * Return: QDF Status
+ */
+
+QDF_STATUS
+ucfg_mlme_get_nol_across_regdmn(struct wlan_objmgr_psoc *psoc, bool *value);
+
 /**
  * ucfg_mlme_get_valid_channel_freq_list() - get valid channel
  * list

drivers/net/wireless/qualcomm/wcn39xx/qcacld-3.0/components/mlme/dispatcher/src/wlan_mlme_api.c

@@ -2971,6 +2971,59 @@ wlan_mlme_get_vht20_mcs9(struct wlan_objmgr_psoc *psoc, bool *value)
 	return QDF_STATUS_SUCCESS;
 }
 
+QDF_STATUS
+wlan_mlme_get_indoor_support_for_nan(struct wlan_objmgr_psoc *psoc,
+				     bool *value)
+{
+	struct wlan_mlme_psoc_ext_obj *mlme_obj;
+
+	mlme_obj = mlme_get_psoc_ext_obj(psoc);
+	if (!mlme_obj) {
+		*value = false;
+		mlme_legacy_err("Failed to get MLME Obj");
+		return QDF_STATUS_E_INVAL;
+	}
+
+	*value = mlme_obj->cfg.reg.enable_nan_on_indoor_channels;
+
+	return QDF_STATUS_SUCCESS;
+}
+
+QDF_STATUS
+wlan_mlme_get_srd_master_mode_for_vdev(struct wlan_objmgr_psoc *psoc,
+				       enum QDF_OPMODE vdev_opmode,
+				       bool *value)
+{
+	struct wlan_mlme_psoc_ext_obj *mlme_obj;
+
+	mlme_obj = mlme_get_psoc_ext_obj(psoc);
+	if (!mlme_obj) {
+		*value = false;
+		mlme_legacy_err("Failed to get MLME Obj");
+		return QDF_STATUS_E_INVAL;
+	}
+
+	switch (vdev_opmode) {
+	case QDF_SAP_MODE:
+		*value = mlme_obj->cfg.reg.etsi_srd_chan_in_master_mode &
+			 MLME_SRD_MASTER_MODE_SAP;
+		break;
+	case QDF_P2P_GO_MODE:
+		*value = mlme_obj->cfg.reg.etsi_srd_chan_in_master_mode &
+			 MLME_SRD_MASTER_MODE_P2P_GO;
+		break;
+	case QDF_NAN_DISC_MODE:
+		*value = mlme_obj->cfg.reg.etsi_srd_chan_in_master_mode &
+			 MLME_SRD_MASTER_MODE_NAN;
+		break;
+	default:
+		mlme_legacy_err("Unexpected opmode %d", vdev_opmode);
+		*value = false;
+	}
+
+	return QDF_STATUS_SUCCESS;
+}
+
 QDF_STATUS
 wlan_mlme_get_vht_enable2x2(struct wlan_objmgr_psoc *psoc, bool *value)
 {

drivers/net/wireless/qualcomm/wcn39xx/qcacld-3.0/components/mlme/dispatcher/src/wlan_mlme_ucfg_api.c

@@ -1537,23 +1537,31 @@ ucfg_mlme_get_mws_coex_scc_channel_avoid_delay(struct wlan_objmgr_psoc *psoc,
 #endif
 
 QDF_STATUS
-ucfg_mlme_get_etsi13_srd_chan_in_master_mode(struct wlan_objmgr_psoc *psoc,
-					     bool *value)
+ucfg_mlme_get_etsi_srd_chan_in_master_mode(struct wlan_objmgr_psoc *psoc,
+					   uint8_t *value)
 {
 	struct wlan_mlme_psoc_ext_obj *mlme_obj;
 
 	mlme_obj = mlme_get_psoc_ext_obj(psoc);
 	if (!mlme_obj) {
-		*value = cfg_default(CFG_ETSI13_SRD_CHAN_IN_MASTER_MODE);
+		*value = cfg_default(CFG_ETSI_SRD_CHAN_IN_MASTER_MODE);
 		mlme_legacy_err("Failed to get MLME Obj");
 		return QDF_STATUS_E_INVAL;
 	}
 
-	*value = mlme_obj->cfg.reg.etsi13_srd_chan_in_master_mode;
+	*value = mlme_obj->cfg.reg.etsi_srd_chan_in_master_mode;
 
 	return QDF_STATUS_SUCCESS;
 }
 
+QDF_STATUS
+ucfg_mlme_get_srd_master_mode_for_vdev(struct wlan_objmgr_psoc *psoc,
+				       enum QDF_OPMODE vdev_opmode,
+				       bool *value)
+{
+	return wlan_mlme_get_srd_master_mode_for_vdev(psoc, vdev_opmode, value);
+}
+
 #ifdef SAP_AVOID_ACS_FREQ_LIST
 QDF_STATUS
 ucfg_mlme_get_acs_avoid_freq_list(struct wlan_objmgr_psoc *psoc,
@@ -1653,6 +1661,22 @@ ucfg_mlme_get_scan_11d_interval(struct wlan_objmgr_psoc *psoc,
 	return QDF_STATUS_SUCCESS;
 }
 
+QDF_STATUS
+ucfg_mlme_get_nol_across_regdmn(struct wlan_objmgr_psoc *psoc, bool *value)
+{
+	struct wlan_mlme_psoc_ext_obj *mlme_obj;
+
+	mlme_obj = mlme_get_psoc_ext_obj(psoc);
+	if (!mlme_obj) {
+		*value = cfg_default(CFG_RETAIN_NOL_ACROSS_REG_DOMAIN);
+		mlme_legacy_err("Failed to get MLME Obj");
+		return QDF_STATUS_E_INVAL;
+	}
+
+	*value = mlme_obj->cfg.reg.retain_nol_across_regdmn_update;
+	return QDF_STATUS_SUCCESS;
+}
+
 QDF_STATUS
 ucfg_mlme_get_valid_channel_freq_list(struct wlan_objmgr_psoc *psoc,
 				      uint32_t *channel_list,

drivers/net/wireless/qualcomm/wcn39xx/qcacld-3.0/components/nan/core/inc/wlan_nan_api.h

@@ -207,6 +207,18 @@ bool wlan_nan_get_sap_conc_support(struct wlan_objmgr_psoc *psoc);
  * Return: Cleanup NAN state upon NAN disable
  */
 QDF_STATUS nan_disable_cleanup(struct wlan_objmgr_psoc *psoc);
+
+/**
+ * wlan_is_nan_allowed_on_freq() - Check if NAN is allowed on given freq
+ * @pdev: pdev context
+ * @freq: Frequency to be checked
+ *
+ * Check if NAN/NDP can be enabled on given frequency.
+ *
+ * Return: True if NAN is allowed on the given frequency
+ */
+bool wlan_is_nan_allowed_on_freq(struct wlan_objmgr_pdev *pdev, uint32_t freq);
+
 #else /* WLAN_FEATURE_NAN */
 static inline QDF_STATUS nan_init(void)
 {
@@ -252,5 +264,11 @@ QDF_STATUS nan_disable_cleanup(struct wlan_objmgr_psoc *psoc)
 {
 	return QDF_STATUS_E_FAILURE;
 }
+
+static inline
+bool wlan_is_nan_allowed_on_freq(struct wlan_objmgr_pdev *pdev, uint32_t freq)
+{
+	return false;
+}
 #endif /* WLAN_FEATURE_NAN */
 #endif /* _WLAN_NAN_API_H_ */

drivers/net/wireless/qualcomm/wcn39xx/qcacld-3.0/components/nan/core/src/nan_api.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2016-2020 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2016-2021 The Linux Foundation. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -30,6 +30,7 @@
 #include "wlan_objmgr_pdev_obj.h"
 #include "wlan_objmgr_vdev_obj.h"
 #include "nan_ucfg_api.h"
+#include <wlan_mlme_api.h>
 
 static QDF_STATUS nan_psoc_obj_created_notification(
 		struct wlan_objmgr_psoc *psoc, void *arg_list)
@@ -414,3 +415,24 @@ QDF_STATUS nan_psoc_disable(struct wlan_objmgr_psoc *psoc)
 
 	return QDF_STATUS_SUCCESS;
 }
+
+bool wlan_is_nan_allowed_on_freq(struct wlan_objmgr_pdev *pdev, uint32_t freq)
+{
+	bool nan_allowed = true;
+
+	/* Check for SRD channels */
+	if (wlan_reg_is_etsi13_srd_chan_for_freq(pdev, freq))
+		wlan_mlme_get_srd_master_mode_for_vdev(wlan_pdev_get_psoc(pdev),
+						       QDF_NAN_DISC_MODE,
+						       &nan_allowed);
+
+	/* Check for Indoor channels */
+	if (wlan_reg_is_freq_indoor(pdev, freq))
+		wlan_mlme_get_indoor_support_for_nan(wlan_pdev_get_psoc(pdev),
+						     &nan_allowed);
+	/* Check for dfs only if channel is not indoor */
+	else if (wlan_reg_is_dfs_for_freq(pdev, freq))
+		nan_allowed = false;
+
+	return nan_allowed;
+}

drivers/net/wireless/qualcomm/wcn39xx/qcacld-3.0/components/nan/dispatcher/inc/nan_ucfg_api.h

@@ -455,6 +455,19 @@ bool ucfg_is_nan_vdev(struct wlan_objmgr_vdev *vdev);
  * Return: QDF_STATUS
  */
 QDF_STATUS ucfg_nan_disable_ind_to_userspace(struct wlan_objmgr_psoc *psoc);
+
+/**
+ * ucfg_is_nan_allowed_on_freq() - Check if NAN is allowed on given freq
+ * @pdev: pdev context
+ * @freq: Frequency to be checked
+ *
+ * Check if NAN/NDP can be enabled on given frequency.
+ * Validate SRD channels based on the ini and reg domain. Assume rest of the
+ * channels support NAN/NDP for now.
+ *
+ * Return: True if NAN is allowed on the given frequency
+ */
+bool ucfg_is_nan_allowed_on_freq(struct wlan_objmgr_pdev *pdev, uint32_t freq);
 #else /* WLAN_FEATURE_NAN */
 
 static inline
@@ -562,5 +575,11 @@ QDF_STATUS ucfg_nan_disable_ind_to_userspace(struct wlan_objmgr_psoc *psoc)
 {
 	return QDF_STATUS_SUCCESS;
 }
+
+static inline
+bool ucfg_is_nan_allowed_on_freq(struct wlan_objmgr_pdev *pdev, uint32_t freq)
+{
+	return false;
+}
 #endif /* WLAN_FEATURE_NAN */
 #endif /* _NAN_UCFG_API_H_ */

drivers/net/wireless/qualcomm/wcn39xx/qcacld-3.0/components/nan/dispatcher/src/nan_ucfg_api.c

@@ -32,6 +32,7 @@
 #include "wlan_policy_mgr_api.h"
 #include "cfg_ucfg_api.h"
 #include "cfg_nan.h"
+#include "wlan_mlme_api.h"
 
 struct wlan_objmgr_psoc;
 struct wlan_objmgr_vdev;
@@ -1272,3 +1273,8 @@ QDF_STATUS ucfg_nan_disable_ind_to_userspace(struct wlan_objmgr_psoc *psoc)
 	qdf_mem_free(disable_ind);
 	return QDF_STATUS_SUCCESS;
 }
+
+bool ucfg_is_nan_allowed_on_freq(struct wlan_objmgr_pdev *pdev, uint32_t freq)
+{
+	return wlan_is_nan_allowed_on_freq(pdev, freq);
+}

drivers/net/wireless/qualcomm/wcn39xx/qcacld-3.0/components/tdls/core/src/wlan_tdls_peer.c

@@ -477,7 +477,7 @@ void tdls_extract_peer_state_param(struct tdls_peer_update_state *peer_param,
 	enum channel_state ch_state;
 	struct wlan_objmgr_pdev *pdev;
 	uint8_t chan_id;
-	enum band_info cur_band = BAND_ALL;
+	uint32_t cur_band;
 	qdf_freq_t ch_freq;
 
 	vdev_obj = peer->vdev_priv;
@@ -513,7 +513,7 @@ void tdls_extract_peer_state_param(struct tdls_peer_update_state *peer_param,
 		return;
 	}
 
-	if (BAND_2G == cur_band) {
+	if (BIT(REG_BAND_2G) == cur_band) {
 		tdls_err("sending the offchannel value as 0 as only 2g is supported");
 		peer_param->peer_cap.pref_off_channum = 0;
 		peer_param->peer_cap.opclass_for_prefoffchan = 0;

drivers/net/wireless/qualcomm/wcn39xx/qcacld-3.0/core/hdd/inc/wlan_hdd_regulatory.h

@@ -61,14 +61,24 @@ void hdd_send_wiphy_regd_sync_event(struct hdd_context *hdd_ctx);
  */
 int hdd_reg_set_country(struct hdd_context *hdd_ctx, char *country_code);
 
+/**
+ * hdd_reg_legacy_setband_to_reg_wifi_band_bitmap() - Convert the user space
+ *	band input to a bitmap of band capabilities, with reg_wifi_band as the
+ *	bit value
+ * @qca_setband: user space/setband value band input, can be 0, 1, or 2
+ *
+ * Return: bitmap on top of reg_wifi_band of bands enabled
+ */
+uint32_t hdd_reg_legacy_setband_to_reg_wifi_band_bitmap(uint8_t qca_setband);
+
 /**
  * hdd_reg_set_band() - helper function for setting the regulatory band
  * @hdd_ctx: the HDD context to set the band for
- * @ui_band: the UI band to configure
+ * @band_bitmap: the band bitmap to configure
  *
  * Return: zero for success, non-zero error code for failure
  */
-int hdd_reg_set_band(struct net_device *dev, u8 ui_band);
+int hdd_reg_set_band(struct net_device *dev, uint32_t band_bitmap);
 
 /**
  * hdd_update_indoor_channel() - enable/disable indoor channel

drivers/net/wireless/qualcomm/wcn39xx/qcacld-3.0/core/hdd/src/wlan_hdd_cfg80211.c

@@ -11512,6 +11512,26 @@ static int wlan_hdd_cfg80211_get_bus_size(struct wiphy *wiphy,
 	return errno;
 }
 
+const struct nla_policy setband_policy[QCA_WLAN_VENDOR_ATTR_MAX + 1] = {
+	[QCA_WLAN_VENDOR_ATTR_SETBAND_VALUE] = {.type = NLA_U32},
+	[QCA_WLAN_VENDOR_ATTR_SETBAND_MASK] = {.type = NLA_U32},
+};
+
+static uint32_t
+wlan_vendor_bitmap_to_reg_wifi_band_bitmap(uint32_t vendor_bitmap)
+{
+	uint32_t reg_bitmap = 0;
+
+	if (vendor_bitmap & QCA_SETBAND_2G)
+		reg_bitmap |= BIT(REG_BAND_2G);
+	if (vendor_bitmap & QCA_SETBAND_5G)
+		reg_bitmap |= BIT(REG_BAND_5G);
+	if (vendor_bitmap & QCA_SETBAND_6G)
+		reg_bitmap |= BIT(REG_BAND_6G);
+
+	return reg_bitmap;
+}
+
 /**
  *__wlan_hdd_cfg80211_setband() - set band
  * @wiphy: Pointer to wireless phy
@@ -11529,8 +11549,7 @@ static int __wlan_hdd_cfg80211_setband(struct wiphy *wiphy,
 	struct net_device *dev = wdev->netdev;
 	struct nlattr *tb[QCA_WLAN_VENDOR_ATTR_MAX + 1];
 	int ret;
-	static const struct nla_policy policy[QCA_WLAN_VENDOR_ATTR_MAX + 1]
-		= {[QCA_WLAN_VENDOR_ATTR_SETBAND_VALUE] = { .type = NLA_U32 } };
+	uint32_t reg_wifi_band_bitmap = 0, band_val, band_mask;
 
 	hdd_enter();
 
@@ -11539,18 +11558,28 @@ static int __wlan_hdd_cfg80211_setband(struct wiphy *wiphy,
 		return ret;
 
 	if (wlan_cfg80211_nla_parse(tb, QCA_WLAN_VENDOR_ATTR_MAX,
-				    data, data_len, policy)) {
+				    data, data_len, setband_policy)) {
 		hdd_err("Invalid ATTR");
 		return -EINVAL;
 	}
 
-	if (!tb[QCA_WLAN_VENDOR_ATTR_SETBAND_VALUE]) {
+	if (tb[QCA_WLAN_VENDOR_ATTR_SETBAND_MASK]) {
+		band_mask = nla_get_u32(tb[QCA_WLAN_VENDOR_ATTR_SETBAND_MASK]);
+		reg_wifi_band_bitmap =
+			wlan_vendor_bitmap_to_reg_wifi_band_bitmap(band_mask);
+	} else if (tb[QCA_WLAN_VENDOR_ATTR_SETBAND_VALUE]) {
+		band_val = nla_get_u32(tb[QCA_WLAN_VENDOR_ATTR_SETBAND_VALUE]);
+		reg_wifi_band_bitmap =
+			hdd_reg_legacy_setband_to_reg_wifi_band_bitmap(
+								      band_val);
+	}
+
+	if (!reg_wifi_band_bitmap) {
 		hdd_err("attr SETBAND_VALUE failed");
 		return -EINVAL;
 	}
 
-	ret = hdd_reg_set_band(dev,
-		nla_get_u32(tb[QCA_WLAN_VENDOR_ATTR_SETBAND_VALUE]));
+	ret = hdd_reg_set_band(dev, reg_wifi_band_bitmap);
 
 	hdd_exit();
 	return ret;
@@ -12180,6 +12209,108 @@ static int wlan_hdd_cfg80211_setband(struct wiphy *wiphy,
 	return errno;
 }
 
+static uint32_t
+wlan_reg_wifi_band_bitmap_to_vendor_bitmap(uint32_t reg_wifi_band_bitmap)
+{
+	uint32_t vendor_mask = 0;
+
+	if (reg_wifi_band_bitmap & BIT(REG_BAND_2G))
+		vendor_mask |= QCA_SETBAND_2G;
+	if (reg_wifi_band_bitmap & BIT(REG_BAND_5G))
+		vendor_mask |= QCA_SETBAND_5G;
+	if (reg_wifi_band_bitmap & BIT(REG_BAND_6G))
+		vendor_mask |= QCA_SETBAND_6G;
+
+	return vendor_mask;
+}
+
+/**
+ *__wlan_hdd_cfg80211_getband() - get band
+ * @wiphy: Pointer to wireless phy
+ * @wdev: Pointer to wireless device
+ * @data: Pointer to data
+ * @data_len: Length of @data
+ *
+ * Return: 0 on success, negative errno on failure
+ */
+static int __wlan_hdd_cfg80211_getband(struct wiphy *wiphy,
+				       struct wireless_dev *wdev,
+				       const void *data, int data_len)
+{
+	struct hdd_context *hdd_ctx = wiphy_priv(wiphy);
+	struct sk_buff *skb;
+	QDF_STATUS status = QDF_STATUS_SUCCESS;
+	int ret;
+	uint32_t reg_wifi_band_bitmap, vendor_band_mask;
+
+	hdd_enter();
+
+	ret = wlan_hdd_validate_context(hdd_ctx);
+	if (ret)
+		return ret;
+
+	skb = cfg80211_vendor_cmd_alloc_reply_skb(hdd_ctx->wiphy,
+						  sizeof(uint32_t) +
+						  NLA_HDRLEN);
+
+	if (!skb) {
+		hdd_err("cfg80211_vendor_event_alloc failed");
+		return -ENOMEM;
+	}
+
+	status = ucfg_reg_get_band(hdd_ctx->pdev, &reg_wifi_band_bitmap);
+	if (!QDF_IS_STATUS_SUCCESS(status)) {
+		hdd_err("failed to get band");
+		goto failure;
+	}
+
+	vendor_band_mask = wlan_reg_wifi_band_bitmap_to_vendor_bitmap(
+							reg_wifi_band_bitmap);
+
+	if (nla_put_u32(skb, QCA_WLAN_VENDOR_ATTR_SETBAND_MASK,
+			vendor_band_mask)) {
+		hdd_err("nla put failure");
+		goto failure;
+	}
+
+	cfg80211_vendor_cmd_reply(skb);
+
+	hdd_exit();
+
+	return 0;
+
+failure:
+	kfree_skb(skb);
+	return -EINVAL;
+}
+
+/**
+ * wlan_hdd_cfg80211_getband() - Wrapper to getband
+ * @wiphy:    wiphy structure pointer
+ * @wdev:     Wireless device structure pointer
+ * @data:     Pointer to the data received
+ * @data_len: Length of @data
+ *
+ * Return: 0 on success; errno on failure
+ */
+static int wlan_hdd_cfg80211_getband(struct wiphy *wiphy,
+				     struct wireless_dev *wdev,
+				     const void *data, int data_len)
+{
+	int errno;
+	struct osif_vdev_sync *vdev_sync;
+
+	errno = osif_vdev_sync_op_start(wdev->netdev, &vdev_sync);
+	if (errno)
+		return errno;
+
+	errno = __wlan_hdd_cfg80211_getband(wiphy, wdev, data, data_len);
+
+	osif_vdev_sync_op_stop(vdev_sync);
+
+	return errno;
+}
+
 /**
  * wlan_hdd_cfg80211_sar_convert_limit_set() - Convert limit set value
  * @nl80211_value:    Vendor command attribute value
@@ -12190,6 +12321,7 @@ static int wlan_hdd_cfg80211_setband(struct wiphy *wiphy,
  */
 static int wlan_hdd_cfg80211_sar_convert_limit_set(u32 nl80211_value,
 						   u32 *wmi_value)
+
 {
 	int ret = 0;
 
@@ -15137,6 +15269,14 @@ const struct wiphy_vendor_command hdd_wiphy_vendor_commands[] = {
 					WIPHY_VENDOR_CMD_NEED_RUNNING,
 		.doit = wlan_hdd_cfg80211_setband
 	},
+	{
+		.info.vendor_id = QCA_NL80211_VENDOR_ID,
+		.info.subcmd = QCA_NL80211_VENDOR_SUBCMD_GETBAND,
+		.flags = WIPHY_VENDOR_CMD_NEED_WDEV |
+			 WIPHY_VENDOR_CMD_NEED_NETDEV |
+			 WIPHY_VENDOR_CMD_NEED_RUNNING,
+		.doit = wlan_hdd_cfg80211_getband,
+	},
 	{
 		.info.vendor_id = QCA_NL80211_VENDOR_ID,
 		.info.subcmd = QCA_NL80211_VENDOR_SUBCMD_ROAMING,
@@ -15442,6 +15582,7 @@ static void wlan_hdd_copy_dsrc_ch(char *ch_ptr, int ch_arr_len)
 	qdf_mem_copy(ch_ptr, &hdd_channels_dot11p[0], ch_arr_len);
 }
 
+
 static void wlan_hdd_get_num_srd_ch_and_len(struct hdd_config *hdd_cfg,
 					    int *num_ch, int *ch_len)
 {

drivers/net/wireless/qualcomm/wcn39xx/qcacld-3.0/core/hdd/src/wlan_hdd_hostapd.c

@@ -6278,6 +6278,8 @@ static int __wlan_hdd_cfg80211_start_ap(struct wiphy *wiphy,
 	struct cfg80211_chan_def new_chandef;
 	struct cfg80211_chan_def *chandef;
 	uint16_t sap_ch;
+	bool srd_channel_allowed;
+	enum QDF_OPMODE vdev_opmode;
 
 	hdd_enter();
 
@@ -6382,9 +6384,15 @@ static int __wlan_hdd_cfg80211_start_ap(struct wiphy *wiphy,
 		hdd_err("SAP not allowed on DFS channel if no dfs master capability!!");
 		return -EINVAL;
 	}
-	if (!wlan_reg_is_etsi13_srd_chan_allowed_master_mode(hdd_ctx->pdev) &&
+
+	vdev_opmode = wlan_vdev_mlme_get_opmode(adapter->vdev);
+	ucfg_mlme_get_srd_master_mode_for_vdev(hdd_ctx->psoc, vdev_opmode,
+					       &srd_channel_allowed);
+
+	if (!srd_channel_allowed &&
 	    wlan_reg_is_etsi13_srd_chan(hdd_ctx->pdev, channel)) {
-		hdd_err("SAP not allowed on SRD channel.");
+		hdd_err("vdev opmode %d not allowed on SRD channel.",
+			vdev_opmode);
 		return -EINVAL;
 	}
 	if (cds_is_sub_20_mhz_enabled()) {

drivers/net/wireless/qualcomm/wcn39xx/qcacld-3.0/core/hdd/src/wlan_hdd_ioctl.c

@@ -3382,6 +3382,7 @@ static int drv_cmd_set_band(struct hdd_adapter *adapter,
 {
 	int err;
 	uint8_t band;
+	uint32_t band_bitmap;
 
 	/*
 	 * Parse the band value passed from userspace. The first 8 bytes
@@ -3393,7 +3394,9 @@ static int drv_cmd_set_band(struct hdd_adapter *adapter,
 		return err;
 	}
 
-	return hdd_reg_set_band(adapter->dev, band);
+	band_bitmap = hdd_reg_legacy_setband_to_reg_wifi_band_bitmap(band);
+
+	return hdd_reg_set_band(adapter->dev, band_bitmap);
 }
 
 static int drv_cmd_set_wmmps(struct hdd_adapter *adapter,

drivers/net/wireless/qualcomm/wcn39xx/qcacld-3.0/core/hdd/src/wlan_hdd_regulatory.c

@@ -212,7 +212,7 @@ static void reg_program_config_vars(struct hdd_context *hdd_ctx,
 	uint32_t scan_11d_interval = 0;
 	bool indoor_chan_enabled = false;
 	uint32_t restart_beaconing = 0;
-	bool enable_srd_chan = false;
+	uint8_t enable_srd_chan;
 	QDF_STATUS status;
 	bool country_priority = 0;
 	bool value = false;
@@ -232,6 +232,9 @@ static void reg_program_config_vars(struct hdd_context *hdd_ctx,
 		hdd_err("Invalid 11d_enable flag");
 	config_vars->enable_11d_support = value;
 
+	ucfg_mlme_get_nol_across_regdmn(hdd_ctx->psoc, &value);
+	config_vars->retain_nol_across_regdmn_update = value;
+
 	ucfg_mlme_get_scan_11d_interval(hdd_ctx->psoc, &scan_11d_interval);
 	config_vars->scan_11d_interval = scan_11d_interval;
 
@@ -255,8 +258,8 @@ static void reg_program_config_vars(struct hdd_context *hdd_ctx,
 						    &restart_beaconing);
 	config_vars->restart_beaconing = restart_beaconing;
 
-	ucfg_mlme_get_etsi13_srd_chan_in_master_mode(hdd_ctx->psoc,
-						     &enable_srd_chan);
+	ucfg_mlme_get_etsi_srd_chan_in_master_mode(hdd_ctx->psoc,
+						   &enable_srd_chan);
 	config_vars->enable_srd_chan_in_master_mode = enable_srd_chan;
 
 	ucfg_mlme_get_11d_in_world_mode(hdd_ctx->psoc,
@@ -746,92 +749,60 @@ int hdd_reg_set_country(struct hdd_context *hdd_ctx, char *country_code)
 	return qdf_status_to_os_return(status);
 }
 
-int hdd_reg_set_band(struct net_device *dev, u8 ui_band)
+uint32_t hdd_reg_legacy_setband_to_reg_wifi_band_bitmap(uint8_t qca_setband)
 {
-	struct hdd_adapter *adapter = WLAN_HDD_GET_PRIV_PTR(dev);
-	mac_handle_t mac_handle;
-	enum band_info band;
-	QDF_STATUS status;
-	struct hdd_context *hdd_ctx;
-	enum band_info current_band;
-	enum band_info connected_band;
+	uint32_t band_bitmap = 0;
 
-	hdd_ctx = WLAN_HDD_GET_CTX(adapter);
-
-	switch (ui_band) {
-	case WLAN_HDD_UI_BAND_AUTO:
-		band = BAND_ALL;
+	switch (qca_setband) {
+	case QCA_SETBAND_AUTO:
+		band_bitmap |= (BIT(REG_BAND_2G) | BIT(REG_BAND_5G));
 		break;
-	case WLAN_HDD_UI_BAND_5_GHZ:
-		band = BAND_5G;
+	case QCA_SETBAND_5G:
+		band_bitmap |= BIT(REG_BAND_5G);
 		break;
-	case WLAN_HDD_UI_BAND_2_4_GHZ:
-		band = BAND_2G;
+	case QCA_SETBAND_2G:
+		band_bitmap |= BIT(REG_BAND_2G);
 		break;
 	default:
-		hdd_err("Invalid band value %u", ui_band);
+		hdd_err("Invalid band value %u", qca_setband);
+		return 0;
+	}
+
+	return band_bitmap;
+}
+
+int hdd_reg_set_band(struct net_device *dev, uint32_t band_bitmap)
+{
+	struct hdd_adapter *adapter = WLAN_HDD_GET_PRIV_PTR(dev);
+	struct hdd_context *hdd_ctx;
+	uint32_t current_band;
+
+	hdd_ctx = WLAN_HDD_GET_CTX(adapter);
+
+	if (!band_bitmap) {
+		hdd_err("Can't disable all bands");
 		return -EINVAL;
 	}
 
-	hdd_debug("change band to %u", band);
+	hdd_debug("change band to %u", band_bitmap);
 
-	if (ucfg_reg_get_curr_band(hdd_ctx->pdev, &current_band) !=
+	if (ucfg_reg_get_band(hdd_ctx->pdev, &current_band) !=
 	    QDF_STATUS_SUCCESS) {
 		hdd_debug("Failed to get current band config");
 		return -EIO;
 	}
 
-	if (current_band == band)
+	if (current_band == band_bitmap) {
+		hdd_debug("band is the same so not updating");
 		return 0;
-
-	hdd_ctx->curr_band = band;
-
-	/* Change band request received.
-	 * Abort pending scan requests, flush the existing scan results,
-	 * and change the band capability
-	 */
-	hdd_debug("Current band value = %u, new setting %u ",
-			current_band, band);
-
-	mac_handle = hdd_ctx->mac_handle;
-	hdd_for_each_adapter(hdd_ctx, adapter) {
-		wlan_abort_scan(hdd_ctx->pdev, INVAL_PDEV_ID,
-				adapter->vdev_id, INVALID_SCAN_ID, false);
-		connected_band = hdd_conn_get_connected_band(
-				WLAN_HDD_GET_STATION_CTX_PTR(adapter));
-
-		/* Handling is done only for STA and P2P */
-		if (band != BAND_ALL &&
-		    ((adapter->device_mode == QDF_STA_MODE) ||
-		     (adapter->device_mode == QDF_P2P_CLIENT_MODE)) &&
-		    (hdd_conn_is_connected(
-				WLAN_HDD_GET_STATION_CTX_PTR(adapter)))
-			&& (connected_band != band)) {
-			status = QDF_STATUS_SUCCESS;
-
-			/* STA already connected on current
-			 * band, So issue disconnect first,
-			 * then change the band
-			 */
-
-			hdd_debug("STA (Device mode %s(%d)) connected in band %u, Changing band to %u, Issuing Disconnect",
-				  qdf_opmode_str(adapter->device_mode),
-				  adapter->device_mode, current_band, band);
-
-			status = wlan_hdd_disconnect(adapter,
-					eCSR_DISCONNECT_REASON_UNSPECIFIED,
-					eSIR_MAC_OPER_CHANNEL_BAND_CHANGE);
-			if (status) {
-				hdd_err("Hdd disconnect failed, status: %d",
-					status);
-				return -EINVAL;
-			}
-		}
-		ucfg_scan_flush_results(hdd_ctx->pdev, NULL);
 	}
 
-	if (QDF_IS_STATUS_ERROR(ucfg_reg_set_band(hdd_ctx->pdev, band))) {
-		hdd_err("Failed to set the band value to %u", band);
+	hdd_ctx->curr_band = wlan_reg_band_bitmap_to_band_info(band_bitmap);
+
+	if (QDF_IS_STATUS_ERROR(ucfg_reg_set_band(hdd_ctx->pdev,
+						  band_bitmap))) {
+		hdd_err("Failed to set the band bitmap value to %u",
+			band_bitmap);
 		return -EINVAL;
 	}
 

drivers/net/wireless/qualcomm/wcn39xx/qcacld-3.0/core/hdd/src/wlan_hdd_tdls.c

@@ -879,7 +879,7 @@ void hdd_config_tdls_with_band_switch(struct hdd_context *hdd_ctx)
 {
 	struct wlan_objmgr_vdev *tdls_obj_vdev;
 	int offchmode;
-	enum band_info current_band;
+	uint32_t current_band;
 	bool tdls_off_ch;
 
 	if (!hdd_ctx) {
@@ -887,7 +887,7 @@ void hdd_config_tdls_with_band_switch(struct hdd_context *hdd_ctx)
 		return;
 	}
 
-	if (ucfg_reg_get_curr_band(hdd_ctx->pdev, &current_band) !=
+	if (ucfg_reg_get_band(hdd_ctx->pdev, &current_band) !=
 	    QDF_STATUS_SUCCESS) {
 		hdd_err("Failed to get current band config");
 		return;
@@ -902,7 +902,8 @@ void hdd_config_tdls_with_band_switch(struct hdd_context *hdd_ctx)
 	 * If 2g or 5g is not supported. Disable tdls off channel only when
 	 * tdls off channel is enabled currently.
 	 */
-	if (current_band == BAND_ALL) {
+	if ((current_band & BIT(REG_BAND_2G)) &&
+	    (current_band & BIT(REG_BAND_5G))) {
 		if (cfg_tdls_get_off_channel_enable_orig(
 			hdd_ctx->psoc, &tdls_off_ch) !=
 		    QDF_STATUS_SUCCESS) {

drivers/net/wireless/qualcomm/wcn39xx/qcacld-3.0/core/mac/inc/qwlan_version.h

@@ -34,27 +34,27 @@
 #define QWLAN_VERSION_PATCH            022
 #if defined(CONFIG_LITHIUM)
 #if defined(QCA_WIFI_QCA6390) //Hastings
-#define QWLAN_VERSION_EXTRA            "Q-HS210304A"
+#define QWLAN_VERSION_EXTRA            "Q-HS210811A"
 #elif defined(QCA_WIFI_QCA6490) // Hastings Prime
-#define QWLAN_VERSION_EXTRA            "Q-HP210304A"
+#define QWLAN_VERSION_EXTRA            "Q-HP210811A"
 #else
 #define QWLAN_VERSION_EXTRA            "Q-QCOM"
 #endif
 #else
-#define QWLAN_VERSION_EXTRA            "Q-HL210304A"
+#define QWLAN_VERSION_EXTRA            "Q-HL210811A"
 #endif
 #define QWLAN_VERSION_BUILD            3
 
 #if defined(CONFIG_LITHIUM)
 #if defined(QCA_WIFI_QCA6390) //Hastings
-#define QWLAN_VERSIONSTR               "5.2.022.3Q-HS210304A"
+#define QWLAN_VERSIONSTR               "5.2.022.3Q-HS210811A"
 #elif defined(QCA_WIFI_QCA6490) // Hastings Prime
-#define QWLAN_VERSIONSTR               "5.2.022.3Q-HP210304A"
+#define QWLAN_VERSIONSTR               "5.2.022.3Q-HP210811A"
 #else
 #define QWLAN_VERSIONSTR               "5.2.022.3Q-QCOM"
 #endif
 #else
-#define QWLAN_VERSIONSTR               "5.2.022.3Q-HL210304A"
+#define QWLAN_VERSIONSTR               "5.2.022.3Q-HL210811A"
 #endif
 
 #endif /* QWLAN_VERSION_H */

drivers/net/wireless/qualcomm/wcn39xx/qcacld-3.0/core/mac/inc/sir_api.h

@@ -2538,6 +2538,7 @@ typedef struct sSirScanOffloadEvent {
  * @dfsSet: is dfs supported or not
  * @half_rate: is the channel operating at 10MHz
  * @quarter_rate: is the channel operating at 5MHz
+ * @nan_disabled: is NAN disabled on @freq
  */
 typedef struct sSirUpdateChanParam {
 	uint32_t freq;
@@ -2545,6 +2546,7 @@ typedef struct sSirUpdateChanParam {
 	bool dfsSet;
 	bool half_rate;
 	bool quarter_rate;
+	bool nan_disabled;
 } tSirUpdateChanParam, *tpSirUpdateChanParam;
 
 typedef struct sSirUpdateChan {

drivers/net/wireless/qualcomm/wcn39xx/qcacld-3.0/core/sap/src/sap_fsm.c

@@ -3294,6 +3294,8 @@ static QDF_STATUS sap_get_freq_list(struct sap_context *sap_ctx,
 	struct acs_weight_range *range_list;
 	bool freq_present_in_list = false;
 	uint8_t i;
+	bool srd_chan_enabled;
+	enum QDF_OPMODE vdev_opmode;
 
 	mac_ctx = sap_get_mac_context();
 	if (!mac_ctx) {
@@ -3412,15 +3414,19 @@ static QDF_STATUS sap_get_freq_list(struct sap_context *sap_ctx,
 				mac_ctx->mlme_cfg->acs.np_chan_weightage);
 			freq_present_in_list = true;
 		}
-		/* Dont scan ETSI13 SRD channels if the ETSI13 SRD channels
-		 * are not enabled in master mode
-		 */
-		if (!wlan_reg_is_etsi13_srd_chan_allowed_master_mode(mac_ctx->
-								     pdev) &&
-		    wlan_reg_is_etsi13_srd_chan_for_freq(
-					mac_ctx->pdev,
-					WLAN_REG_CH_TO_FREQ(loop_count)))
+
+		vdev_opmode = wlan_vdev_mlme_get_opmode(sap_ctx->vdev);
+		wlan_mlme_get_srd_master_mode_for_vdev(mac_ctx->psoc,
+						       vdev_opmode,
+						       &srd_chan_enabled);
+
+		if (!srd_chan_enabled &&
+		    wlan_reg_is_etsi13_srd_chan_for_freq(mac_ctx->pdev,
+					WLAN_REG_CH_TO_FREQ(loop_count))) {
+			sap_debug("vdev opmode %d not allowed on SRD freq %d",
+				  vdev_opmode, WLAN_REG_CH_TO_FREQ(loop_count));
 			continue;
+		}
 
 		/* Check if the freq is present in range list */
 		for (i = 0; i < mac_ctx->mlme_cfg->acs.num_weight_range; i++) {

drivers/net/wireless/qualcomm/wcn39xx/qcacld-3.0/core/sap/src/sap_module.c

@@ -2995,14 +2995,14 @@ qdf_freq_t wlansap_get_chan_band_restrict(struct sap_context *sap_ctx)
 		return 0;
 	}
 
-	if (ucfg_reg_get_curr_band(mac->pdev, &band) != QDF_STATUS_SUCCESS) {
+	if (ucfg_reg_get_band(mac->pdev, &band) != QDF_STATUS_SUCCESS) {
 		sap_err("Failed to get current band config");
 		return 0;
 	}
 	sap_band = wlan_reg_freq_to_band(sap_ctx->chan_freq);
 	sap_debug("SAP/Go current band: %d, pdev band capability: %d",
 		  sap_band, band);
-	if (sap_band == REG_BAND_5G && band == BAND_2G) {
+	if (sap_band == REG_BAND_5G && band == BIT(REG_BAND_2G)) {
 		sap_ctx->chan_freq_before_switch_band = sap_ctx->chan_freq;
 		sap_ctx->chan_width_before_switch_band =
 			sap_ctx->ch_params.ch_width;
@@ -3018,8 +3018,7 @@ qdf_freq_t wlansap_get_chan_band_restrict(struct sap_context *sap_ctx)
 			sap_debug("set 40M when switch SAP to 2G");
 			restart_ch_width = CH_WIDTH_40MHZ;
 		}
-	} else if (sap_band == REG_BAND_2G &&
-		   (band == BAND_ALL || band == BAND_5G)) {
+	} else if (sap_band == REG_BAND_2G && (band & BIT(REG_BAND_5G))) {
 		if (sap_ctx->chan_freq_before_switch_band == 0)
 			return 0;
 		restart_freq = sap_ctx->chan_freq_before_switch_band;

drivers/net/wireless/qualcomm/wcn39xx/qcacld-3.0/core/sme/src/common/sme_api.c

@@ -1784,6 +1784,7 @@ QDF_STATUS sme_set_ese_roam_scan_channel_list(mac_handle_t mac_handle,
 	uint8_t newChannelList[CFG_VALID_CHANNEL_LIST_LEN * 5] = { 0 };
 	uint8_t i = 0, j = 0;
 	enum band_info band = -1;
+	uint32_t band_bitmap;
 
 	if (sessionId >= WLAN_MAX_VDEVS) {
 		QDF_TRACE(QDF_MODULE_ID_SME, QDF_TRACE_LEVEL_ERROR,
@@ -1806,7 +1807,8 @@ QDF_STATUS sme_set_ese_roam_scan_channel_list(mac_handle_t mac_handle,
 				curchnl_list_info->freq_list[i]);
 		}
 	}
-        ucfg_reg_get_band(mac->pdev, &band);
+	ucfg_reg_get_band(mac->pdev, &band_bitmap);
+	band = wlan_reg_band_bitmap_to_band_info(band_bitmap);
 	status = csr_create_roam_scan_channel_list(mac, sessionId,
 				chan_freq_list, numChannels,
 				band);

drivers/net/wireless/qualcomm/wcn39xx/qcacld-3.0/core/sme/src/csr/csr_api_roam.c

@@ -67,6 +67,7 @@
 #include "wlan_scan_utils_api.h"
 #include "wlan_p2p_cfg_api.h"
 #include "cfg_nan_api.h"
+#include "nan_ucfg_api.h"
 
 #include <ol_defines.h>
 
@@ -1547,11 +1548,12 @@ QDF_STATUS csr_update_channel_list(struct mac_context *mac)
 				}
 			}
 
+			if (!ucfg_is_nan_allowed_on_freq(mac->pdev,
+				pChanList->chanParam[num_channel].freq))
+				pChanList->chanParam[num_channel].nan_disabled =
+					true;
 
-			if (CHANNEL_STATE_ENABLE == channel_state)
-				pChanList->chanParam[num_channel].dfsSet =
-					false;
-			else
+			if (CHANNEL_STATE_ENABLE != channel_state)
 				pChanList->chanParam[num_channel].dfsSet =
 					true;
 

drivers/net/wireless/qualcomm/wcn39xx/qcacld-3.0/core/wma/src/wma_scan_roam.c

@@ -168,6 +168,9 @@ QDF_STATUS wma_update_channel_list(WMA_HANDLE handle,
 			chan_p->dfs_set = 1;
 		}
 
+		if (chan_list->chanParam[i].nan_disabled)
+			chan_p->nan_disabled = 1;
+
 		if (chan_p->mhz < WMA_2_4_GHZ_MAX_FREQ) {
 			chan_p->phy_mode = MODE_11G;
 			if (chan_list->vht_en && chan_list->vht_24_en)

drivers/samsung/debug/Kconfig

@@ -82,6 +82,13 @@ config SEC_DEBUG_SCHED_LOG_PER_CPU
 	help
 	  Samsung Scheduler Logging using per_cpu Feature for Debug use.
 
+config SEC_DEBUG_SCHED_LOG_IRQ_V2
+	bool "Samsung Scheduler IRQ Logging V2"
+	default n
+	depends on SEC_DEBUG_SCHED_LOG
+	help
+	  Samsung Scheduler IRQ Logging V2.
+
 config SEC_DEBUG_MSG_LOG
 	bool "Message Log for ram dump debug (DEPRECATED)"
 	default n

drivers/samsung/debug/sec_debug.c

@@ -392,6 +392,9 @@ void sec_debug_update_restart_reason(const char *cmd, const int in_panic,
 		{ "from_fastboot",
 			PON_RESTART_REASON_NORMALBOOT,
 			RESTART_REASON_NOT_HANDLE, NULL},
+		{ "disallow,fastboot",
+			PON_RESTART_REASON_NORMALBOOT,
+			RESTART_REASON_NOT_HANDLE, NULL},
 #ifdef CONFIG_MUIC_SUPPORT_RUSTPROOF
 		{ "swsel",
 			PON_RESTART_REASON_UNKNOWN,
@@ -788,15 +791,17 @@ static int __init __sec_debug_dt_addr_init(void)
 		return -ENODEV;
 	}
 
-	watchdog_base = of_iomap(np, 0);
-	if (unlikely(!watchdog_base)) {
-		pr_err("unable to map watchdog_base offset\n");
-		return -ENODEV;
-	}
+	if (of_device_is_available(np)) {
+		watchdog_base = of_iomap(np, 0);
+		if (unlikely(!watchdog_base)) {
+			pr_err("unable to map watchdog_base offset\n");
+			return -ENODEV;
+		}
 
-	/* check upload_cause here */
-	pr_emerg("watchdog_base addr : 0x%p(0x%llx)\n", watchdog_base,
-			(unsigned long long)virt_to_phys(watchdog_base));
+		/* check upload_cause here */
+		pr_emerg("watchdog_base addr : 0x%p(0x%llx)\n", watchdog_base,
+				(unsigned long long)virt_to_phys(watchdog_base));
+	}
 #endif
 
 	return 0;
@@ -841,7 +846,7 @@ static int __init sec_debug_init(void)
 	case ANDROID_DEBUG_LEVEL_MID:
 #endif
 
-#if defined(CONFIG_SEC_A52Q_PROJECT) || defined(CONFIG_SEC_A72Q_PROJECT)
+#if defined(CONFIG_ARCH_ATOLL) || defined(CONFIG_ARCH_SEC_SM7150)
 		if (!force_upload)
 			qcom_scm_disable_sdi();
 #endif

drivers/samsung/debug/sec_debug_partition.c

@@ -248,6 +248,7 @@ static void init_debug_partition(void)
 
 	/*++ add here need init data ++*/
 	init_ap_health_data();
+	init_lcd_debug_data();
 	/*-- add here need init data --*/
 
 	while (1) {

drivers/samsung/debug/sec_debug_sched_log.c

@@ -20,6 +20,8 @@
 #include <linux/kernel.h>
 #include <linux/sched.h>
 #include <linux/slab.h>
+#include <linux/interrupt.h>
+#include <linux/irq.h>
 
 #include <asm/io.h>
 
@@ -123,7 +125,7 @@ void sec_debug_task_sched_log(int cpu, bool preempt,
 	sched_buf->prev_prio = prev->prio;
 }
 
-void sec_debug_irq_sched_log(unsigned int irq, void *fn,
+void sec_debug_softirq_sched_log(unsigned int irq, void *fn,
 		char *name, unsigned int en)
 {
 	struct irq_buf *irq_buf;
@@ -148,11 +150,55 @@ void sec_debug_irq_sched_log(unsigned int irq, void *fn,
 
 	irq_buf->time = cpu_clock(cpu);
 	irq_buf->irq = irq;
-	irq_buf->fn = (void *)fn;
+	irq_buf->fn = fn;
 	irq_buf->name = name;
+	irq_buf->context = &cpu;
 	irq_buf->en = irqs_disabled();
 	irq_buf->preempt_count = preempt_count();
+	irq_buf->pid = current->pid;
+	irq_buf->entry_exit = en;
+}
+
+void sec_debug_irq_sched_log(unsigned int irq, void *desc_or_fn,
+		void *action_or_name, unsigned int en)
+{
+	struct irq_buf *irq_buf;
+	int cpu = smp_processor_id();
+	int i;
+#if defined(CONFIG_SEC_DEBUG_SCHED_LOG_IRQ_V2)
+	struct irq_desc *desc = (struct irq_desc *)desc_or_fn;
+	struct irqaction *action = (struct irqaction *)action_or_name;
+#endif
+
+#if defined(CONFIG_SEC_DEBUG_SCHED_LOG_PER_CPU)
+	struct sec_debug_log *sec_dbg_log;
+	sec_dbg_log = &per_cpu(sec_debug_log_cpu, cpu);
+	if (unlikely(!sec_dbg_log))
+		return;
+
+	i = ++(sec_dbg_log->irq.idx) & (SCHED_LOG_MAX - 1);
+	irq_buf = &sec_dbg_log->irq.buf[i];
+#else
+	if (unlikely(!secdbg_log))
+		return;
+
+	i = ++(secdbg_log->irq[cpu].idx) & (SCHED_LOG_MAX - 1);
+	irq_buf = &secdbg_log->irq[cpu].buf[i];
+#endif
+
+	irq_buf->time = cpu_clock(cpu);
+	irq_buf->irq = irq;
+#if defined(CONFIG_SEC_DEBUG_SCHED_LOG_IRQ_V2)
+	irq_buf->fn = action->handler;
+	irq_buf->name = (char *)action->name;
+	irq_buf->hwirq = desc->irq_data.hwirq;
+#else
+	irq_buf->fn = (void *)desc_or_fn;
+	irq_buf->name = (char *)action_or_name;
 	irq_buf->context = &cpu;
+#endif
+	irq_buf->en = irqs_disabled();
+	irq_buf->preempt_count = preempt_count();
 	irq_buf->pid = current->pid;
 	irq_buf->entry_exit = en;
 }

drivers/samsung/debug/sec_debug_summary.c

@@ -112,13 +112,12 @@ int sec_debug_summary_save_die_info(const char *str, struct pt_regs *regs)
 #ifndef CONFIG_SAMSUNG_PRODUCT_SHIP
 	sec_delay_check = 0;
 #endif
-	if (!secdbg_apss)
-		return -ENOMEM;
-
-	snprintf(secdbg_apss->excp.pc_sym, sizeof(secdbg_apss->excp.pc_sym),
-		"%pS", (void *)regs->PT_REGS_PC);
-	snprintf(secdbg_apss->excp.lr_sym, sizeof(secdbg_apss->excp.lr_sym),
-		"%pS", (void *)regs->PT_REGS_LR);
+	if (secdbg_apss) {
+		snprintf(secdbg_apss->excp.pc_sym, sizeof(secdbg_apss->excp.pc_sym),
+				"%pS", (void *)regs->PT_REGS_PC);
+		snprintf(secdbg_apss->excp.lr_sym, sizeof(secdbg_apss->excp.lr_sym),
+				"%pS", (void *)regs->PT_REGS_LR);
+	}
 
 	__summary_save_dying_msg_for_user_reset_debug(str,
 			(void *)regs->PT_REGS_PC, (void *)regs->PT_REGS_LR);
@@ -131,16 +130,15 @@ int sec_debug_summary_save_panic_info(const char *str, unsigned long caller)
 #ifndef CONFIG_SAMSUNG_PRODUCT_SHIP
 	sec_delay_check = 0;
 #endif
-	if (!secdbg_apss)
-		return -ENOMEM;
-
-	snprintf(secdbg_apss->excp.panic_caller,
-		sizeof(secdbg_apss->excp.panic_caller), "%pS", (void *)caller);
-	snprintf(secdbg_apss->excp.panic_msg,
-		sizeof(secdbg_apss->excp.panic_msg), "%s", str);
-	snprintf(secdbg_apss->excp.thread,
-		sizeof(secdbg_apss->excp.thread), "%s:%d", current->comm,
-		task_pid_nr(current));
+	if (secdbg_apss) {
+		snprintf(secdbg_apss->excp.panic_caller,
+			sizeof(secdbg_apss->excp.panic_caller), "%pS", (void *)(caller - ARCH_INSTR_SIZE));
+		snprintf(secdbg_apss->excp.panic_msg,
+			sizeof(secdbg_apss->excp.panic_msg), "%s", str);
+		snprintf(secdbg_apss->excp.thread,
+			sizeof(secdbg_apss->excp.thread), "%s:%d", current->comm,
+			task_pid_nr(current));
+	}
 
 	__summary_save_dying_msg_for_user_reset_debug(str,
 			(void *)(caller - ARCH_INSTR_SIZE), (void *)caller);

drivers/samsung/debug/sec_log_buf.c

@@ -323,8 +323,9 @@ static int sec_log_store(struct notifier_block *nb,
 	switch (action) {
 	case SYS_RESTART:
 	case SYS_POWER_OFF:
-		pr_info("%s, %s, %ptR(TZ:%02d)\n",
-				action == SYS_RESTART ? "reboot" : "power off", cmd, &local_tm, -sys_tz.tz_minuteswest / 60);
+		pr_info("%ptR(TZ:%02d), %s, %s\n",
+				&local_tm, -sys_tz.tz_minuteswest / 60,
+				action == SYS_RESTART ? "reboot" : "power off", cmd);
 		write_debug_partition(debug_index_reset_klog, s_log_buf);
 		break;
 	}

drivers/samsung/misc/sec_argos.c

@@ -585,10 +585,14 @@ static int argos_pm_qos_notify(struct notifier_block *nfb,
 
 	prev_level = cnode->prev_level;
 
-	pr_debug("name:%s, speed:%ldMbps\n", cnode->desc, speed);
-
 	argos_blocked = cnode->argos_block;
 
+	if (cnode->tables[0].items[THRESHOLD] == 0) {
+		pr_debug("skip not used name:%s, speed:%ldMbps\n",\
+			 cnode->desc, speed);
+		goto out;
+	}
+
 	/* Find proper level */
 	for (level = 0; level < cnode->ntables; level++) {
 		struct boost_table *t = &cnode->tables[level];

drivers/security/samsung/icdrv/oemflag.c

@@ -39,24 +39,27 @@ int oem_flags_set(enum oemflag_id index)
 	if (name > OEMFLAG_MIN_FLAG && name < OEMFLAG_NUM_OF_FLAG) {
 		if (check_flags(name)) {
 			pr_info("[oemflag]flag is already set. %u\n", name);
-			return 0;
+			return OEMFLAG_SUCCESS;
 		}
 
 		pr_info("[oemflag]set_fuse_name : %u\n", name);
 
 		ret = set_tamper_fuse(name);
-		if (ret)
+		if (ret) {
 			pr_err("set_tamper_fuse error: ret=%d\n", ret);
+			return OEMFLAG_FAIL;
+		}
 		ret = get_tamper_fuse(name);
-		if (!ret)
+		if (!ret) {
 			pr_err("get_tamper_fuse error: ret=%d\n", ret);
+			return OEMFLAG_FAIL;
+		}
 		oem_flags_check[name] = 1;
 	} else {
 		pr_info("[oemflag]param name is wrong\n");
-		ret = -EINVAL;
+		return -EINVAL;
 	}
-
-	return ret;
+	return OEMFLAG_SUCCESS;
 }
 
 int oem_flags_get(enum oemflag_id index)

drivers/security/samsung/icdrv/oemflag.h

@@ -17,6 +17,9 @@
 #ifndef __OEM_FLAG_H
 #define __OEM_FLAG_H
 
+#define OEMFLAG_SUCCESS 0
+#define OEMFLAG_FAIL -1
+
 enum oemflag_id {
 	OEMFLAG_NONE = 0,
 	OEMFLAG_MIN_FLAG = 2,

drivers/tty/serial/msm_geni_serial.c

@@ -1502,21 +1502,13 @@ static void start_rx_sequencer(struct uart_port *uport)
 		spin_unlock_irqrestore(&uport->lock, flags);
 	}
 
-#if !defined(CONFIG_ARCH_ATOLL)
-	/* Start RX with the RFR_OPEN to keep RFR in always ready state */
-	msm_geni_serial_enable_interrupts(uport);
-	geni_setup_s_cmd(uport->membase, UART_START_READ, geni_se_param);
-#endif
-
 	if (port->xfer_mode == SE_DMA)
 		geni_se_rx_dma_start(uport->membase, DMA_RX_BUF_SIZE,
 							&port->rx_dma);
 
-#if defined(CONFIG_ARCH_ATOLL)
 	/* Start RX with the RFR_OPEN to keep RFR in always ready state */
 	geni_setup_s_cmd(uport->membase, UART_START_READ, geni_se_param);
 	msm_geni_serial_enable_interrupts(uport);
-#endif
 
 	/* Ensure that the above writes go through */
 	mb();

drivers/tty/tty_io.c

@@ -2739,10 +2739,14 @@ void __do_SAK(struct tty_struct *tty)
 	struct task_struct *g, *p;
 	struct pid *session;
 	int		i;
+	unsigned long flags;
 
 	if (!tty)
 		return;
-	session = tty->session;
+
+	spin_lock_irqsave(&tty->ctrl_lock, flags);
+	session = get_pid(tty->session);
+	spin_unlock_irqrestore(&tty->ctrl_lock, flags);
 
 	tty_ldisc_flush(tty);
 
@@ -2774,6 +2778,7 @@ void __do_SAK(struct tty_struct *tty)
 		task_unlock(p);
 	} while_each_thread(g, p);
 	read_unlock(&tasklist_lock);
+	put_pid(session);
 #endif
 }
 

drivers/tty/tty_jobctrl.c

@@ -102,8 +102,8 @@ static void __proc_set_tty(struct tty_struct *tty)
 	put_pid(tty->session);
 	put_pid(tty->pgrp);
 	tty->pgrp = get_pid(task_pgrp(current));
-	spin_unlock_irqrestore(&tty->ctrl_lock, flags);
 	tty->session = get_pid(task_session(current));
+	spin_unlock_irqrestore(&tty->ctrl_lock, flags);
 	if (current->signal->tty) {
 		tty_debug(tty, "current tty %s not NULL!!\n",
 			  current->signal->tty->name);
@@ -292,20 +292,23 @@ void disassociate_ctty(int on_exit)
 	spin_lock_irq(&current->sighand->siglock);
 	put_pid(current->signal->tty_old_pgrp);
 	current->signal->tty_old_pgrp = NULL;
-
 	tty = tty_kref_get(current->signal->tty);
+	spin_unlock_irq(&current->sighand->siglock);
+
 	if (tty) {
 		unsigned long flags;
+
+		tty_lock(tty);
 		spin_lock_irqsave(&tty->ctrl_lock, flags);
 		put_pid(tty->session);
 		put_pid(tty->pgrp);
 		tty->session = NULL;
 		tty->pgrp = NULL;
 		spin_unlock_irqrestore(&tty->ctrl_lock, flags);
+		tty_unlock(tty);
 		tty_kref_put(tty);
 	}
 
-	spin_unlock_irq(&current->sighand->siglock);
 	/* Now clear signal->tty under the lock */
 	read_lock(&tasklist_lock);
 	session_clear_tty(task_session(current));
@@ -476,14 +479,19 @@ static int tiocspgrp(struct tty_struct *tty, struct tty_struct *real_tty, pid_t
 		return -ENOTTY;
 	if (retval)
 		return retval;
-	if (!current->signal->tty ||
-	    (current->signal->tty != real_tty) ||
-	    (real_tty->session != task_session(current)))
-		return -ENOTTY;
+
 	if (get_user(pgrp_nr, p))
 		return -EFAULT;
 	if (pgrp_nr < 0)
 		return -EINVAL;
+
+	spin_lock_irq(&real_tty->ctrl_lock);
+	if (!current->signal->tty ||
+	    (current->signal->tty != real_tty) ||
+	    (real_tty->session != task_session(current))) {
+		retval = -ENOTTY;
+		goto out_unlock_ctrl;
+	}
 	rcu_read_lock();
 	pgrp = find_vpid(pgrp_nr);
 	retval = -ESRCH;
@@ -493,12 +501,12 @@ static int tiocspgrp(struct tty_struct *tty, struct tty_struct *real_tty, pid_t
 	if (session_of_pgrp(pgrp) != task_session(current))
 		goto out_unlock;
 	retval = 0;
-	spin_lock_irq(&real_tty->ctrl_lock);
 	put_pid(real_tty->pgrp);
 	real_tty->pgrp = get_pid(pgrp);
-	spin_unlock_irq(&real_tty->ctrl_lock);
 out_unlock:
 	rcu_read_unlock();
+out_unlock_ctrl:
+	spin_unlock_irq(&real_tty->ctrl_lock);
 	return retval;
 }
 
@@ -510,20 +518,30 @@ out_unlock:
  *
  *	Obtain the session id of the tty. If there is no session
  *	return an error.
- *
- *	Locking: none. Reference to current->signal->tty is safe.
  */
 static int tiocgsid(struct tty_struct *tty, struct tty_struct *real_tty, pid_t __user *p)
 {
+	unsigned long flags;
+	pid_t sid;
+
 	/*
 	 * (tty == real_tty) is a cheap way of
 	 * testing if the tty is NOT a master pty.
 	*/
 	if (tty == real_tty && current->signal->tty != real_tty)
 		return -ENOTTY;
+
+	spin_lock_irqsave(&real_tty->ctrl_lock, flags);
 	if (!real_tty->session)
-		return -ENOTTY;
-	return put_user(pid_vnr(real_tty->session), p);
+		goto err;
+	sid = pid_vnr(real_tty->session);
+	spin_unlock_irqrestore(&real_tty->ctrl_lock, flags);
+
+	return put_user(sid, p);
+
+err:
+	spin_unlock_irqrestore(&real_tty->ctrl_lock, flags);
+	return -ENOTTY;
 }
 
 /*

drivers/usb/gadget/function/f_cdev.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011, 2013-2020, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011, 2013-2021, The Linux Foundation. All rights reserved.
  * Linux Foundation chooses to take subject only to the GPLv2 license terms,
  * and distributes only under these terms.
  *
@@ -94,7 +94,7 @@ struct cserial {
 
 struct f_cdev {
 	struct cdev		fcdev_cdev;
-	struct device		*dev;
+	struct device		dev;
 	unsigned int		port_num;
 	char			name[sizeof(DEVICE_NAME) + 2];
 	int			minor;
@@ -953,13 +953,16 @@ static void cser_free_inst(struct usb_function_instance *fi)
 	opts = container_of(fi, struct f_cdev_opts, func_inst);
 
 	if (opts->port) {
-		device_destroy(fcdev_classp, MKDEV(major, opts->port->minor));
-		cdev_del(&opts->port->fcdev_cdev);
+		cdev_device_del(&opts->port->fcdev_cdev, &opts->port->dev);
+		mutex_lock(&chardev_ida_lock);
+		ida_simple_remove(&chardev_ida, opts->port->minor);
+		mutex_unlock(&chardev_ida_lock);
 		usb_cser_debugfs_exit(opts->port);
+		put_device(&opts->port->dev);
 	}
+
 	usb_cser_chardev_deinit();
 	kfree(opts->func_name);
-	kfree(opts->port);
 	kfree(opts);
 }
 
@@ -1181,13 +1184,10 @@ int f_cdev_open(struct inode *inode, struct file *file)
 	struct f_cdev *port;
 
 	port = container_of(inode->i_cdev, struct f_cdev, fcdev_cdev);
-	if (!port) {
-		pr_err("Port is NULL.\n");
-		return -EINVAL;
-	}
-
-	if (port && port->port_open) {
+	get_device(&port->dev);
+	if (port->port_open) {
 		pr_err("port is already opened.\n");
+		put_device(&port->dev);
 		return -EBUSY;
 	}
 
@@ -1197,6 +1197,7 @@ int f_cdev_open(struct inode *inode, struct file *file)
 					port->is_connected);
 	if (ret) {
 		pr_debug("open interrupted.\n");
+		put_device(&port->dev);
 		return ret;
 	}
 
@@ -1216,16 +1217,12 @@ int f_cdev_release(struct inode *inode, struct file *file)
 	struct f_cdev *port;
 
 	port = file->private_data;
-	if (!port) {
-		pr_err("port is NULL.\n");
-		return -EINVAL;
-	}
-
 	spin_lock_irqsave(&port->port_lock, flags);
 	port->port_open = false;
 	port->cbits_updated = false;
 	spin_unlock_irqrestore(&port->port_lock, flags);
 	pr_debug("port(%s)(%pK) is closed.\n", port->name, port);
+	put_device(&port->dev);
 
 	return 0;
 }
@@ -1830,11 +1827,17 @@ static void usb_cser_debugfs_exit(struct f_cdev *port)
 	debugfs_remove_recursive(port->debugfs_root);
 }
 
+static void cdev_device_release(struct device *dev)
+{
+	struct f_cdev *port = container_of(dev, struct f_cdev, dev);
+
+	pr_debug("Free cdev port(%d)\n", port->port_num);
+	kfree(port);
+}
+
 static struct f_cdev *f_cdev_alloc(char *func_name, int portno)
 {
 	int ret;
-	dev_t dev;
-	struct device *device;
 	struct f_cdev *port;
 
 	port = kzalloc(sizeof(struct f_cdev), GFP_KERNEL);
@@ -1885,27 +1888,24 @@ static struct f_cdev *f_cdev_alloc(char *func_name, int portno)
 
 	/* create char device */
 	cdev_init(&port->fcdev_cdev, &f_cdev_fops);
-	dev = MKDEV(major, port->minor);
-	ret = cdev_add(&port->fcdev_cdev, dev, 1);
+	device_initialize(&port->dev);
+	port->dev.class = fcdev_classp;
+	port->dev.parent = NULL;
+	port->dev.release = cdev_device_release;
+	port->dev.devt = MKDEV(major, port->minor);
+	dev_set_name(&port->dev, "%s", port->name);
+	ret = cdev_device_add(&port->fcdev_cdev, &port->dev);
 	if (ret) {
 		pr_err("Failed to add cdev for port(%s)\n", port->name);
 		goto err_cdev_add;
 	}
 
-	device = device_create(fcdev_classp, NULL, dev, NULL, port->name);
-	if (IS_ERR(device)) {
-		ret = PTR_ERR(device);
-		goto err_create_dev;
-	}
-
 	usb_cser_debugfs_init(port);
 
 	pr_info("port_name:%s (%pK) portno:(%d)\n",
 			port->name, port, port->port_num);
 	return port;
 
-err_create_dev:
-	cdev_del(&port->fcdev_cdev);
 err_cdev_add:
 	destroy_workqueue(port->fcdev_wq);
 err_get_ida:

drivers/usb/gadget/function/f_conn_gadget.c

@@ -59,6 +59,7 @@
 #include <linux/file.h>
 #include <linux/configfs.h>
 #include <linux/usb/composite.h>
+#include <linux/kref.h>
 
 /* platform specific definitions */
 /* ex) #define __ANDROID__ */
@@ -124,6 +125,8 @@ struct conn_gadget_dev {
 	/* flag variable that save flush call status
 	* to check wakeup reason */
 	atomic_t flush;
+	
+	struct kref kref;
 };
 
 static struct usb_interface_descriptor conn_gadget_interface_desc = {
@@ -231,6 +234,7 @@ struct conn_gadget_instance {
 	const char *name;
 };
 
+static void conn_gadget_cleanup(struct kref *kref);
 
 static inline struct conn_gadget_dev *func_to_conn_gadget(struct usb_function *f)
 {
@@ -711,6 +715,11 @@ static int conn_gadget_open(struct inode *ip, struct file *fp)
 		return -EBUSY;
 	}
 
+	if (!kref_get_unless_zero(&_conn_gadget_dev->kref)) {
+		CONN_GADGET_ERR("already device removed\n");
+		return -ENODEV;
+	}
+
 	fp->private_data = _conn_gadget_dev;
 
 	/* clear the error latch */
@@ -757,6 +766,8 @@ static int conn_gadget_release(struct inode *ip, struct file *fp)
 	atomic_set(&_conn_gadget_dev->flush, 0);
 
 	conn_gadget_unlock(&_conn_gadget_dev->open_excl);
+	
+	kref_put(&_conn_gadget_dev->kref, conn_gadget_cleanup);
 	return 0;
 }
 
@@ -1245,6 +1256,8 @@ static int conn_gadget_setup(struct conn_gadget_instance *fi_conn_gadget)
 	atomic_set(&dev->flush, 0);
 	atomic_set(&dev->ep_out_excl, 0);
 
+	kref_init(&dev->kref);
+
 	INIT_LIST_HEAD(&dev->tx_idle);
 	INIT_LIST_HEAD(&dev->rx_idle);
 	INIT_LIST_HEAD(&dev->rx_busy);
@@ -1294,7 +1307,7 @@ err_:
 	return ret;
 }
 
-static void conn_gadget_cleanup(void)
+static void conn_gadget_cleanup(struct kref *kref)
 {
 	printk(KERN_INFO "conn_gadget_cleanup\n");
 
@@ -1370,8 +1383,8 @@ static void conn_gadget_free_inst(struct usb_function_instance *fi)
 
 	fi_conn_gadget = to_fi_conn_gadget(fi);
 	kfree(fi_conn_gadget->name);
-	conn_gadget_cleanup();
 	kfree(fi_conn_gadget);
+	kref_put(&_conn_gadget_dev->kref, conn_gadget_cleanup);
 }
 
 struct usb_function_instance *alloc_inst_conn_gadget(void)

fs/f2fs/file.c

@@ -2818,6 +2818,9 @@ static int f2fs_move_file_range(struct file *file_in, loff_t pos_in,
 	if (IS_ENCRYPTED(src) || IS_ENCRYPTED(dst))
 		return -EOPNOTSUPP;
 
+	if (pos_out < 0 || pos_in < 0)
+		return -EINVAL;
+
 	if (src == dst) {
 		if (pos_in == pos_out)
 			return 0;

fs/proc/task_mmu.c

@@ -19,6 +19,7 @@
 #include <linux/shmem_fs.h>
 #include <linux/uaccess.h>
 #include <linux/mm_inline.h>
+#include <linux/freezer.h>
 #include <linux/ctype.h>
 #include <linux/io_record.h>
 
@@ -27,6 +28,11 @@
 #include <asm/tlbflush.h>
 #include "internal.h"
 
+#ifdef CONFIG_ZRAM_LRU_WRITEBACK
+#include <linux/delay.h>
+#include "../../drivers/block/zram/zram_drv.h"
+#endif
+
 void task_mem(struct seq_file *m, struct mm_struct *mm)
 {
 	unsigned long text, lib, swap, ptes, pmds, anon, file, shmem;
@@ -531,6 +537,9 @@ struct mem_size_stats {
 	unsigned long anonymous_thp;
 	unsigned long shmem_thp;
 	unsigned long swap;
+#ifdef CONFIG_ZRAM_LRU_WRITEBACK
+	unsigned long writeback;
+#endif
 	unsigned long shared_hugetlb;
 	unsigned long private_hugetlb;
 	unsigned long first_vma_start;
@@ -627,6 +636,10 @@ static void smaps_pte_entry(pte_t *pte, unsigned long addr,
 			int mapcount;
 
 			mss->swap += PAGE_SIZE;
+#ifdef CONFIG_ZRAM_LRU_WRITEBACK
+			if (is_writeback_entry(swpent))
+				mss->writeback += PAGE_SIZE;
+#endif
 			mapcount = swp_swapcount(swpent);
 			if (mapcount >= 2) {
 				u64 pss_delta = (u64)PAGE_SIZE << PSS_SHIFT;
@@ -935,6 +948,9 @@ static int show_smap(struct seq_file *m, void *v, int is_pid)
 			   "Private_Hugetlb: %7lu kB\n"
 			   "Swap:           %8lu kB\n"
 			   "SwapPss:        %8lu kB\n"
+#ifdef CONFIG_ZRAM_LRU_WRITEBACK
+			   "Writeback:      %8lu kB\n"
+#endif
 			   "Locked:         %8lu kB\n",
 			   mss->resident >> 10,
 			   (unsigned long)(mss->pss >> (10 + PSS_SHIFT)),
@@ -951,6 +967,9 @@ static int show_smap(struct seq_file *m, void *v, int is_pid)
 			   mss->private_hugetlb >> 10,
 			   mss->swap >> 10,
 			   (unsigned long)(mss->swap_pss >> (10 + PSS_SHIFT)),
+#ifdef CONFIG_ZRAM_LRU_WRITEBACK
+			   mss->writeback >> 10,
+#endif
 			   (unsigned long)(mss->pss_locked >> (10 + PSS_SHIFT)));
 
 	if (!rollup_mode) {
@@ -1703,6 +1722,18 @@ const struct file_operations proc_pagemap_operations = {
 };
 #endif /* CONFIG_PROC_PAGE_MONITOR */
 
+#ifdef CONFIG_FREEZING
+static inline bool is_pm_freezing(void)
+{
+	return pm_freezing;
+}
+#else
+static inline bool is_pm_freezing(void)
+{
+	return false;
+}
+#endif /* CONFIG_FREEZING */
+
 #ifdef CONFIG_PROCESS_RECLAIM
 static int reclaim_pte_range(pmd_t *pmd, unsigned long addr,
 				unsigned long end, struct mm_walk *walk)
@@ -1716,12 +1747,21 @@ static int reclaim_pte_range(pmd_t *pmd, unsigned long addr,
 	int isolated;
 	int reclaimed;
 
+#ifdef CONFIG_ZRAM_LRU_WRITEBACK
+	bool is_lru_wb = false;
+
+	if (!strcmp("PerProcessNands", current->comm))
+		is_lru_wb = true;
+#endif
+
 	split_huge_pmd(vma, addr, pmd);
 	if (pmd_trans_unstable(pmd) || !rp->nr_to_reclaim)
 		return 0;
 cont:
 	if (rwsem_is_contended(&walk->mm->mmap_sem))
 		return -1;
+	if (is_pm_freezing())
+		return -1;
 
 	isolated = 0;
 	pte = pte_offset_map_lock(vma->vm_mm, pmd, addr, &ptl);
@@ -1740,6 +1780,11 @@ cont:
 		if (!PageLRU(page))
 			continue;
 
+#ifdef CONFIG_ZRAM_LRU_WRITEBACK
+		if (is_lru_wb && ptep_test_and_clear_young(vma, addr, pte))
+			continue;
+#endif
+
 		if (isolate_lru_page(page))
 			continue;
 
@@ -1777,11 +1822,53 @@ cont:
 	return 0;
 }
 
+#ifdef CONFIG_ZRAM_LRU_WRITEBACK
+static int writeback_pte_range(pmd_t *pmd, unsigned long addr,
+		unsigned long end, struct mm_walk *walk)
+{
+	struct mm_struct *mm = walk->mm;
+	struct zwbs **zwbs = walk->private;
+	pte_t *pte, ptent;
+	spinlock_t *ptl;
+	LIST_HEAD(swp_entry_list);
+
+	if (pmd_trans_huge(*pmd))
+		return 0;
+	if (rwsem_is_contended(&mm->mmap_sem))
+		return -1;
+	if (is_pm_freezing())
+		return -1;
+	if (zram_is_app_launch())
+		return -1;
+
+	pte = pte_offset_map_lock(mm, pmd, addr, &ptl);
+	for (; addr != end; pte++, addr += PAGE_SIZE) {
+		ptent = *pte;
+		if (is_swap_pte(ptent)) {
+			swp_entry_t entry = pte_to_swp_entry(ptent);
+			if (unlikely(non_swap_entry(entry)))
+				continue;
+			if (swp_swapcount(entry) > 1)
+				continue;
+			swap_add_to_list(&swp_entry_list, entry);
+		}
+	}
+	pte_unmap_unlock(pte - 1, ptl);
+	swap_writeback_list(zwbs, &swp_entry_list);
+
+	cond_resched();
+	return 0;
+}
+#endif
+
 enum reclaim_type {
 	RECLAIM_FILE,
 	RECLAIM_ANON,
 	RECLAIM_ALL,
 	RECLAIM_RANGE,
+#ifdef CONFIG_ZRAM_LRU_WRITEBACK
+	RECLAIM_WRITEBACK,
+#endif
 };
 
 struct reclaim_param reclaim_task_anon(struct task_struct *task,
@@ -1842,6 +1929,10 @@ static ssize_t reclaim_write(struct file *file, const char __user *buf,
 	unsigned long start = 0;
 	unsigned long end = 0;
 	struct reclaim_param rp;
+#ifdef CONFIG_ZRAM_LRU_WRITEBACK
+	struct zwbs *zwbs[NR_ZWBS];
+	int sleep_count = 0;
+#endif
 
 	memset(buffer, 0, sizeof(buffer));
 	if (count > sizeof(buffer) - 1)
@@ -1859,6 +1950,10 @@ static ssize_t reclaim_write(struct file *file, const char __user *buf,
 		type = RECLAIM_ALL;
 	else if (isdigit(*type_buf))
 		type = RECLAIM_RANGE;
+#ifdef CONFIG_ZRAM_LRU_WRITEBACK
+	else if (!strcmp(type_buf, "writeback"))
+		type = RECLAIM_WRITEBACK;
+#endif
 	else
 		goto out_err;
 
@@ -1896,6 +1991,19 @@ static ssize_t reclaim_write(struct file *file, const char __user *buf,
 	task = get_proc_task(file->f_path.dentry->d_inode);
 	if (!task)
 		return -ESRCH;
+#ifdef CONFIG_ZRAM_LRU_WRITEBACK
+	if (type == RECLAIM_WRITEBACK) {
+		if (alloc_zwbs(zwbs)) {
+			pr_info("%s alloc_zwbs failed", __func__);
+			return -ENOMEM;
+		}
+		while (zram_is_app_launch()) {
+			if (is_pm_freezing() || sleep_count++ >= 10)
+				goto out;
+			msleep(1000);
+		}
+	}
+#endif
 
 	mm = get_task_mm(task);
 	if (!mm)
@@ -1908,6 +2016,13 @@ static ssize_t reclaim_write(struct file *file, const char __user *buf,
 	rp.nr_reclaimed = 0;
 	reclaim_walk.private = &rp;
 
+#ifdef CONFIG_ZRAM_LRU_WRITEBACK
+	if (type == RECLAIM_WRITEBACK) {
+		reclaim_walk.pmd_entry = writeback_pte_range;
+		reclaim_walk.private = (void *)zwbs;
+	}
+#endif
+
 	down_read(&mm->mmap_sem);
 	if (type == RECLAIM_RANGE) {
 		vma = find_vma(mm, start);
@@ -1935,6 +2050,11 @@ static ssize_t reclaim_write(struct file *file, const char __user *buf,
 			if (type == RECLAIM_FILE && !vma->vm_file)
 				continue;
 
+#ifdef CONFIG_ZRAM_LRU_WRITEBACK
+			if (type == RECLAIM_WRITEBACK && vma->vm_file)
+				continue;
+#endif
+
 			rp.vma = vma;
 			if (walk_page_range(vma->vm_start, vma->vm_end,
 				&reclaim_walk))
@@ -1947,6 +2067,12 @@ static ssize_t reclaim_write(struct file *file, const char __user *buf,
 	mmput(mm);
 out:
 	put_task_struct(task);
+#ifdef CONFIG_ZRAM_LRU_WRITEBACK
+	if (type == RECLAIM_WRITEBACK) {
+		swap_writeback_list(zwbs, NULL);
+		free_zwbs(zwbs);
+	}
+#endif
 	return count;
 
 out_err:

include/linux/samsung/debug/sec_debug.h

@@ -10,8 +10,13 @@
 
 #include <asm/cacheflush.h>
 
+#if defined(CONFIG_SEC_DEBUG_SCHED_LOG_IRQ_V2)
+#define IRQ_ENTRY_V2	0x76324945
+#define IRQ_EXIT_V2	0x76324958
+#else
 #define IRQ_ENTRY	0x4945
 #define IRQ_EXIT	0x4958
+#endif
 
 #define SOFTIRQ_ENTRY	0x5345
 #define SOFTIRQ_EXIT	0x5358

include/linux/samsung/debug/sec_debug_sched_log.h

@@ -20,8 +20,10 @@ extern void sec_debug_task_sched_log(int cpu, bool preempt, struct task_struct *
 
 /* called @ kernel/irq/chip.c */
 /* called @ kernel/irq/handle.c */
+extern void sec_debug_irq_sched_log(unsigned int irq, void *desc_or_fn, void *action_or_name, unsigned int en);
+
 /* called @ kernel/softirq.c */
-extern void sec_debug_irq_sched_log(unsigned int irq, void *fn, char *name, unsigned int en);
+extern void sec_debug_softirq_sched_log(unsigned int irq, void *fn, char *name, unsigned int en);
 
 /* called @ arch/arm64/kernel/traps.c */
 /* called @ drivers/cpuidle/lpm-levels.c */
@@ -44,7 +46,8 @@ static inline int sec_debug_sched_msg(char *fmt, ...) { return 0; }
 static inline void sec_debug_secure_log(u32 svc_id, u32 cmd_id) {}
 static inline void sec_debug_task_sched_log(int cpu, bool preempt, struct task_struct *task, struct task_struct *prev) {}
 static inline void sec_debug_timer_log(unsigned int type, int int_lock, void *fn) {}
-static inline void sec_debug_irq_sched_log(unsigned int irq, void *fn, char *name, unsigned int en) {}
+static inline void sec_debug_irq_sched_log(unsigned int irq, void *desc_or_fn, void *action_or_name, unsigned int en) {}
+static inline void sec_debug_softirq_sched_log(unsigned int irq, void *fn, char *name, unsigned int en) {}
 #endif /* CONFIG_SEC_DEBUG_SCHED_LOG */
 
 

include/linux/samsung/debug/sec_debug_sched_log_type.h

@@ -12,7 +12,10 @@ struct irq_buf {
 	char *name;
 	int en;
 	int preempt_count;
-	void *context;
+	union {
+		void *context;
+		irq_hw_number_t hwirq;
+	};
 	pid_t pid;
 	unsigned int entry_exit;
 };

include/linux/samsung/debug/sec_debug_user_reset_type.h

@@ -285,7 +285,7 @@ struct tzdbg_t {
 		struct {
 			uint8_t reserve[512];
 
-			uint8_t num_interrupts;
+			uint32_t num_interrupts;
 
 			uint8_t reserve2[3648];
 

include/linux/tty.h

@@ -305,6 +305,10 @@ struct tty_struct {
 	struct termiox *termiox;	/* May be NULL for unsupported */
 	char name[64];
 	struct pid *pgrp;		/* Protected by ctrl lock */
+	/*
+	 * Writes protected by both ctrl lock and legacy mutex, readers must use
+	 * at least one of them.
+	 */
 	struct pid *session;
 	unsigned long flags;
 	int count;

include/trace/events/ext4.h

@@ -879,7 +879,6 @@ TRACE_EVENT(ext4_free_blocks,
 		  show_free_flags(__entry->flags))
 );
 
-/* @fs.sec -- 84802e246d0781e97b5b13c60ae460dc346ba707 -- */
 TRACE_EVENT(ext4_sync_file_enter,
 	TP_PROTO(struct file *file, int datasync),
 
@@ -890,7 +889,6 @@ TRACE_EVENT(ext4_sync_file_enter,
 		__field(	ino_t,	ino			)
 		__field(	ino_t,	parent			)
 		__field(	int,	datasync		)
-		__array(unsigned char,	d_name,	EXT4_NAME_LEN)
 	),
 
 	TP_fast_assign(
@@ -900,14 +898,12 @@ TRACE_EVENT(ext4_sync_file_enter,
 		__entry->ino		= d_inode(dentry)->i_ino;
 		__entry->datasync	= datasync;
 		__entry->parent		= d_inode(dentry->d_parent)->i_ino;
-		memcpy(__entry->d_name, dentry->d_name.name, EXT4_NAME_LEN);
 	),
 
-	TP_printk("dev %d,%d ino %lu parent %lu datasync %d d_name %s",
+	TP_printk("dev %d,%d ino %lu parent %lu datasync %d ",
 		  MAJOR(__entry->dev), MINOR(__entry->dev),
 		  (unsigned long) __entry->ino,
-		  (unsigned long) __entry->parent, __entry->datasync,
-		  __entry->d_name)
+		  (unsigned long) __entry->parent, __entry->datasync)
 );
 
 TRACE_EVENT(ext4_sync_file_exit,
@@ -1455,7 +1451,6 @@ TRACE_EVENT(ext4_unlink_enter,
 		__field(	ino_t,	ino			)
 		__field(	ino_t,	parent			)
 		__field(	loff_t,	size			)
-		__array(unsigned char,	d_name,	EXT4_NAME_LEN)
 	),
 
 	TP_fast_assign(
@@ -1463,13 +1458,12 @@ TRACE_EVENT(ext4_unlink_enter,
 		__entry->ino		= d_inode(dentry)->i_ino;
 		__entry->parent		= parent->i_ino;
 		__entry->size		= d_inode(dentry)->i_size;
-		memcpy(__entry->d_name, dentry->d_name.name, EXT4_NAME_LEN);
 	),
 
-	TP_printk("dev %d,%d ino %lu size %lld parent %lu d_name %s",
+	TP_printk("dev %d,%d ino %lu size %lld parent %lu",
 		  MAJOR(__entry->dev), MINOR(__entry->dev),
 		  (unsigned long) __entry->ino, __entry->size,
-		  (unsigned long) __entry->parent, __entry->d_name)
+		  (unsigned long) __entry->parent)
 );
 
 TRACE_EVENT(ext4_unlink_exit,
@@ -1481,20 +1475,18 @@ TRACE_EVENT(ext4_unlink_exit,
 		__field(	dev_t,	dev			)
 		__field(	ino_t,	ino			)
 		__field(	int,	ret			)
-		__array(unsigned char,	d_name,	EXT4_NAME_LEN)
 	),
 
 	TP_fast_assign(
 		__entry->dev		= dentry->d_sb->s_dev;
 		__entry->ino		= d_inode(dentry)->i_ino;
 		__entry->ret		= ret;
-		memcpy(__entry->d_name, dentry->d_name.name, EXT4_NAME_LEN);
 	),
 
-	TP_printk("dev %d,%d ino %lu ret %d d_name %s",
+	TP_printk("dev %d,%d ino %lu ret %d",
 		  MAJOR(__entry->dev), MINOR(__entry->dev),
 		  (unsigned long) __entry->ino,
-		  __entry->ret, __entry->d_name)
+		  __entry->ret)
 );
 
 DECLARE_EVENT_CLASS(ext4__truncate,

kernel/cred.c

@@ -843,7 +843,7 @@ const struct cred *override_creds(const struct cred *new)
 		rcu_assign_pointer(current->cred, new_ro);
 	} else
 #endif /* CONFIG_RKP_KDP */
-		rcu_assign_pointer(current->cred, new);
+	rcu_assign_pointer(current->cred, new);
 	alter_cred_subscribers(old, -1);
 
 	kdebug("override_creds() = %p{%d,%d}", old,
@@ -878,8 +878,8 @@ void revert_creds(const struct cred *old)
 		if (rkp_ro_page((unsigned long)override)) {
 			if (get_rocred_rcu(override)->reflected_cred)
 				put_cred((struct cred *)(get_rocred_rcu(override)->reflected_cred));
-	put_cred(override);
-}
+			put_cred(override);
+		}
 	}
 #endif
 	put_cred(override);

net/core/dev_monitor.c

@@ -20,7 +20,8 @@ struct dev_addr_info {
 
 static struct list_head dev_info;
 static struct list_head cleanup_dev_info;
-static struct work_struct cleanup_work;
+static void dev_monitor_deferred_cleanup(struct work_struct *work);
+static DECLARE_DELAYED_WORK(cleanup_work, dev_monitor_deferred_cleanup);
 
 static struct dev_addr_info *get_dev_info(struct list_head *head,
 					  struct net_device *dev, int family)
@@ -256,8 +257,9 @@ static int dev_monitor_inetaddr_event(struct notifier_block *this,
 
 		addr_info = get_dev_info(&dev_info, dev, AF_INET);
 		if (addr_info) {
-			if ((addr_info->addr.addr4 == ifa->ifa_local) &&
-					(addr_info->prefixlen != ifa->ifa_prefixlen)) {
+			__be32 mask = inet_make_mask(addr_info->prefixlen);
+
+			if (!((addr_info->addr.addr4 ^ ifa->ifa_local) & mask)) {
 				pr_err("%s %s: %pI4/%d, updated:%pI4/%d\n", __func__, dev->name,
 						&addr_info->addr.addr4, addr_info->prefixlen,
 						&ifa->ifa_local, ifa->ifa_prefixlen);
@@ -272,8 +274,8 @@ static int dev_monitor_inetaddr_event(struct notifier_block *this,
 				// tcp_disconnect calls might_sleep function
 				// so it crashes when this routine calls
 				// dev_monitor_cleanup_sock directly
-				if (!work_pending(&cleanup_work))
-					schedule_work(&cleanup_work);
+				if (!delayed_work_pending(&cleanup_work))
+					schedule_delayed_work(&cleanup_work, msecs_to_jiffies(1000));
 			}
 		}
 
@@ -331,8 +333,7 @@ static int dev_monitor_inet6addr_event(struct notifier_block *this,
 
 		addr_info = get_dev_info(&dev_info, dev, AF_INET6);
 		if (addr_info) {
-			if (ipv6_addr_equal(&addr_info->addr.addr6, &ifa->addr) &&
-					!ipv6_prefix_equal(&addr_info->addr.addr6, &ifa->addr, ifa->prefix_len)) {
+			if (ipv6_prefix_equal(&addr_info->addr.addr6, &ifa->addr, ifa->prefix_len)) {
 				pr_err("%s %s: %pI6/%d, updated:%pI6/%d\n", __func__, dev->name,
 						&addr_info->addr.addr6, addr_info->prefixlen,
 						&ifa->addr, ifa->prefix_len);
@@ -347,8 +348,8 @@ static int dev_monitor_inet6addr_event(struct notifier_block *this,
 				// tcp_disconnect calls might_sleep function
 				// so it crashes when this routine calls
 				// dev_monitor_cleanup_sock directly
-				if (!work_pending(&cleanup_work))
-					schedule_work(&cleanup_work);
+				if (!delayed_work_pending(&cleanup_work))
+					schedule_delayed_work(&cleanup_work, msecs_to_jiffies(1000));
 			}
 		}
 
@@ -386,7 +387,6 @@ static int __init dev_monitor_init(void)
 
 	INIT_LIST_HEAD(&dev_info);
 	INIT_LIST_HEAD(&cleanup_dev_info);
-	INIT_WORK(&cleanup_work, dev_monitor_deferred_cleanup);
 	ret = register_netdevice_notifier(&dev_monitor_nb);
 	if (ret) {
 		pr_err("%s: registering notifier error %d\n", __func__, ret);

net/ipv6/addrconf.c

@@ -4037,6 +4037,15 @@ static void addrconf_dad_work(struct work_struct *w)
 	}
 
 	ifp->dad_probes--;
+	if (!strcmp(ifp->idev->dev->name, "aware_data0")) {
+		pr_info("Reduce waing time from %lu to %lu (HZ=%lu) to send NS for quick transmission for %s\n",
+			NEIGH_VAR(ifp->idev->nd_parms, RETRANS_TIME),
+			NEIGH_VAR(ifp->idev->nd_parms, RETRANS_TIME)/10,
+			HZ,
+			ifp->idev->dev->name);
+		addrconf_mod_dad_work(ifp,
+					NEIGH_VAR(ifp->idev->nd_parms, RETRANS_TIME)/10);
+	} else
 	addrconf_mod_dad_work(ifp,
 			      NEIGH_VAR(ifp->idev->nd_parms, RETRANS_TIME));
 	spin_unlock(&ifp->lock);

net/qrtr/qrtr.c

@@ -1749,6 +1749,11 @@ static int qrtr_recvmsg(struct socket *sock, struct msghdr *msg,
 	rc = copied;
 
 	if (addr) {
+		/* There is an anonymous 2-byte hole after sq_family,
+		 * make sure to clear it.
+		 */
+		memset(addr, 0, sizeof(*addr));
+
 		addr->sq_family = AF_QIPCRTR;
 		addr->sq_node = cb->src_node;
 		addr->sq_port = cb->src_port;

security/defex_lsm/Kconfig

@@ -1,6 +1,13 @@
 config SECURITY_DEFEX
 	bool "Defex Support"
-	depends on SECURITY
+	depends on SECURITY && (!KCOV || SAMSUNG_PRODUCT_SHIP)
+	select CRYPTO
+	select CRYPTO_RSA
+	select CRYPTO_SHA1
+	select CRYPTO_SHA256
+	select CRYPTO_HASH_INFO
+	select INTEGRITY_SIGNATURE
+	select INTEGRITY_ASYMMETRIC_KEYS
 	default n
 	help
 	  This selects the Defex support.
@@ -8,7 +15,7 @@ config SECURITY_DEFEX
 
 config DEFEX_KERNEL_ONLY
 	bool "Defex Kernel Only"
-	depends on SECURITY
+	depends on SECURITY_DEFEX
 	default y
 	help
 	  This lets defex know whether kernel-only build or not.

security/defex_lsm/Makefile

@@ -5,75 +5,158 @@
 # Features to Enable
 PED_ENABLE=true
 SAFEPLACE_ENABLE=true
-INTEGRITY_ENABLE=true
+IMMUTABLE_ENABLE=true
+LP_ENABLE=true
+UMH_RESTRICTION_ENABLE=true
+
+ifneq ($(wildcard $(srctree)/include/crypto/internal/rsa.h),)
+    $(warning [DEFEX] INTEGRITY_ENABLE)
+    INTEGRITY_ENABLE=true
+endif
 
 # caches to enable
 CACHES_ENABLE=true
 
-obj-y := defex_lsm.o
-obj-y += defex_catch_list.o
-obj-y += defex_ht.o
-obj-y += defex_config.o
-obj-y += defex_sysfs.o
-obj-y += defex_procs.o
-obj-y += defex_catch_list_compat.o
-obj-y += defex_rules.o
+# OEM Unlock dependency
+OEM_UNLOCK_DEPENDENCY=true
+
+# use the ramdisk or system_root to store rules file
+RAMDISK_ENABLE=true
+
+# do signing for rules
+SIGN_ENABLE=true
+
+defex-y := core/defex_common.o
+defex-y += core/defex_lsm.o
+defex-y += core/defex_main.o
+defex-y += core/defex_get_mode.o
+defex-y += core/defex_sysfs.o
+defex-y += catch_engine/defex_catch_list.o
+defex-y += catch_engine/defex_ht.o
+defex-y += defex_rules.o
+defex-$(CONFIG_COMPAT) += catch_engine/defex_catch_list_compat.o
+
+# Immutable Feature is applied with permissive mode first.
+DEFEX_DEFINES := -DDEFEX_PERMISSIVE_IM
 
 ifeq ($(CONFIG_DEFEX_KERNEL_ONLY), y)
-EXTRA_CFLAGS += -DDEFEX_KERNEL_ONLY
+    DEFEX_DEFINES += -DDEFEX_KERNEL_ONLY
+    ifeq ($(CONFIG_SAMSUNG_PRODUCT_SHIP), y)
+        $(warning [DEFEX] Kernel_only & Ship)
+    else
+        $(warning [DEFEX] Kernel_only & Noship)
+        DEFEX_DEFINES += -DDEFEX_PERMISSIVE_SP
+        DEFEX_DEFINES += -DDEFEX_PERMISSIVE_IM
+        DEFEX_DEFINES += -DDEFEX_PERMISSIVE_LP
+        DEFEX_DEFINES += -DDEFEX_DEBUG_ENABLE
+    endif
+endif
+
+ifeq ($(CONFIG_SEC_FACTORY), y)
+    DEFEX_DEFINES += -DDEFEX_FACTORY_ENABLE
+endif
+
+# kunit tests options:
+ifeq ($(CONFIG_KUNIT), y)
+    GCOV_PROFILE := y
+    DEFEX_DEFINES += -DDEFEX_KUNIT_ENABLED
+else
+    DEFEX_DEFINES += -D__visible_for_testing=static
 endif
 
 ifeq ($(PED_ENABLE), true)
-    obj-y += defex_priv.o
-    EXTRA_CFLAGS += -DDEFEX_PED_ENABLE
+    defex-y += feature_privilege_escalation_detection/defex_priv.o
+    DEFEX_DEFINES += -DDEFEX_PED_ENABLE
 endif
 
 ifeq ($(SAFEPLACE_ENABLE), true)
-    obj-y += defex_safeplace.o
-    EXTRA_CFLAGS += -DDEFEX_SAFEPLACE_ENABLE
+    defex-y += feature_safeplace/defex_safeplace.o
+    DEFEX_DEFINES += -DDEFEX_SAFEPLACE_ENABLE
 endif
 
 ifeq ($(INTEGRITY_ENABLE), true)
-    EXTRA_CFLAGS += -DDEFEX_INTEGRITY_ENABLE
+    DEFEX_DEFINES += -DDEFEX_INTEGRITY_ENABLE
+endif
+
+ifeq ($(IMMUTABLE_ENABLE), true)
+    defex-y += feature_immutable/defex_immutable.o
+    DEFEX_DEFINES += -DDEFEX_IMMUTABLE_ENABLE
+endif
+
+ifeq ($(LP_ENABLE), true)
+    DEFEX_DEFINES += -DDEFEX_LP_ENABLE
+endif
+
+ifeq ($(UMH_RESTRICTION_ENABLE), true)
+    DEFEX_DEFINES += -DDEFEX_UMH_RESTRICTION_ENABLE
 endif
 
 ifeq ($(CACHES_ENABLE), true)
-    obj-y += defex_caches.o
-    EXTRA_CFLAGS += -DDEFEX_CACHES_ENABLE
+    defex-y += catch_engine/defex_caches.o
+    DEFEX_DEFINES += -DDEFEX_CACHES_ENABLE
 endif
 
-ifneq (,$(filter userdebug eng, $(TARGET_BUILD_VARIANT)))
-    obj-y += defex_debug.o
-    EXTRA_CFLAGS += -DDEFEX_PERMISSIVE_SP
-    EXTRA_CFLAGS += -DDEFEX_DEBUG_ENABLE
-    EXTRA_CFLAGS += -DDEFEX_SYSFS_ENABLE
+ifeq ($(OEM_UNLOCK_DEPENDENCY), true)
+    DEFEX_DEFINES += -DDEFEX_DEPENDING_ON_OEMUNLOCK
 endif
 
-ifeq ($(SEC_BUILD_OPTION_VTS), true)
-$(warning [DEFEX] VTS true $(SEC_BUILD_OPTION_VTS))
-EXTRA_CFLAGS += -DDEFEX_PERMISSIVE_SP
-EXTRA_CFLAGS += -DDEFEX_PERMISSIVE_PED
-else
-$(warning [DEFEX] VTS false $(SEC_BUILD_OPTION_VTS))
+ifeq ($(RAMDISK_ENABLE), true)
+    DEFEX_DEFINES += -DDEFEX_RAMDISK_ENABLE
+ifeq ($(SIGN_ENABLE), true)
+    defex-y += cert/defex_cert.o
+    defex-y += cert/defex_sign.o
+    DEFEX_DEFINES += -DDEFEX_SIGN_ENABLE
+endif
 endif
 
-ifeq ($(CONFIG_SEC_FACTORY), y)
-EXTRA_CFLAGS += -DDEFEX_PERMISSIVE_SP
-EXTRA_CFLAGS += -DDEFEX_PERMISSIVE_PED
+ifneq (,$(filter userdebug eng, $(TARGET_BUILD_VARIANT)))
+    defex-y += debug/defex_debug.o
+    DEFEX_DEFINES += -DDEFEX_PERMISSIVE_SP
+    DEFEX_DEFINES += -DDEFEX_PERMISSIVE_IM
+    DEFEX_DEFINES += -DDEFEX_PERMISSIVE_LP
+    DEFEX_DEFINES += -DDEFEX_DEBUG_ENABLE
+    DEFEX_DEFINES += -DDEFEX_SYSFS_ENABLE
+else
+    ifeq ($(CONFIG_SECURITY_DSMS), y)
+        DEFEX_DEFINES += -DDEFEX_DSMS_ENABLE
+    endif
 endif
 
+ccflags-y := -Wformat
+
+EXTRA_CFLAGS += -I$(srctree)/$(src)
+EXTRA_AFLAGS += -Isecurity/samsung/defex_lsm
+EXTRA_CFLAGS += -I$(srctree)/$(src)/cert
+EXTRA_AFLAGS += -Isecurity/samsung/defex_lsm/cert
+
 ifneq ($(wildcard  $(srctree)/$(src)/pack_rules.c),)
-    EXTRA_CFLAGS += -DDEFEX_USE_PACKED_RULES
+    DEFEX_DEFINES += -DDEFEX_USE_PACKED_RULES
+    EXTRA_CFLAGS += $(DEFEX_DEFINES)
+    EXTRA_AFLAGS += $(DEFEX_DEFINES)
     hostprogs-y := pack_rules
-    HOST_EXTRACFLAGS += $(EXTRA_CFLAGS)
+    HOST_EXTRACFLAGS += $(DEFEX_DEFINES)
     clean-files := $(srctree)/$(src)/defex_packed_rules.inc
     DEPEND_LIST := $(obj)/pack_rules
 
-    $(obj)/defex_sysfs.o: $(obj)/pack_rules $(srctree)/$(src)/defex_packed_rules.inc
+    quiet_cmd_copy = COPY    $(obj)/pack_rules
+          cmd_copy = cp -n $(obj)/pack_rules $(srctree)/$(src)/pack_rules 2>/dev/null || true
 
     quiet_cmd_pack = PACK    $<
           cmd_pack = $(obj)/pack_rules -p $< $@ $(srctree)/$(src)/defex_packed_rules.bin
 
+    quiet_cmd_mkey = MAKEKEY $<
+          cmd_mkey = cp -n $< $@ 2>/dev/null || true
+
+    $(obj)/core/defex_sysfs.o: $(obj)/pack_rules $(srctree)/$(src)/defex_packed_rules.inc
+
+    $(obj)/cert/defex_cert.o: $(obj)/cert/pubkey_eng.der $(obj)/cert/pubkey_user.der
+
+    $(obj)/cert/pubkey_eng.der: $(srctree)/$(src)/cert/x509_five_eng.der
+	$(call cmd,mkey)
+
+    $(obj)/cert/pubkey_user.der: $(srctree)/$(src)/cert/x509_five_user.der
+	$(call cmd,mkey)
+
     SOURCE_RULES := $(srctree)/$(src)/defex_rules.c
     ifneq ($(wildcard $(srctree)/$(src)/file_list),)
         $(warning '[DEFEX] file_list found')
@@ -91,6 +174,11 @@ ifneq ($(wildcard  $(srctree)/$(src)/pack_rules.c),)
 
     $(srctree)/$(src)/defex_packed_rules.inc: $(SOURCE_RULES) $(DEPEND_LIST)
 	$(call cmd,pack)
+	$(call cmd,copy)
 
+else
+    EXTRA_CFLAGS += $(DEFEX_DEFINES)
+    EXTRA_AFLAGS += $(DEFEX_DEFINES)
 endif
 
+obj-$(CONFIG_SECURITY_DEFEX) := $(defex-y)

security/defex_lsm/catch_engine/defex_catch_list.c

@@ -6,7 +6,7 @@
  * as published by the Free Software Foundation.
 */
 
-#include <asm/uaccess.h>
+#include <linux/uaccess.h>
 #include <linux/device.h>
 #include <linux/init.h>
 #include <linux/kernel.h>
@@ -16,6 +16,12 @@
 #include <linux/unistd.h>
 #include "include/defex_catch_list.h"
 
+#ifdef DEFEX_KUNIT_ENABLED
+#ifndef __NR_syscalls
+#define __NR_syscalls   436
+#endif
+#endif
+
 #define DEFEX_CATCH_COUNT	__NR_syscalls
 const int defex_nr_syscalls = DEFEX_CATCH_COUNT;
 
@@ -23,7 +29,7 @@ const int defex_nr_syscalls = DEFEX_CATCH_COUNT;
 
 const struct local_syscall_struct *get_local_syscall(int syscall_no)
 {
-	if (syscall_no >= __NR_syscalls)
+	if ((unsigned int)syscall_no >= __NR_syscalls)
 		return NULL;
 
 	if (!syscall_catch_arr[syscall_no].local_syscall && !syscall_catch_arr[syscall_no].err_code && syscall_no) {