Merge android-4.4.132 (46155cc) into msm-4.4

* refs/heads/tmp-46155cc
  Linux 4.4.132
  perf/x86: Fix possible Spectre-v1 indexing for x86_pmu::event_map()
  perf/core: Fix possible Spectre-v1 indexing for ->aux_pages[]
  perf/x86/msr: Fix possible Spectre-v1 indexing in the MSR driver
  perf/x86/cstate: Fix possible Spectre-v1 indexing for pkg_msr
  perf/x86: Fix possible Spectre-v1 indexing for hw_perf_event cache_*
  tracing/uprobe_event: Fix strncpy corner case
  Revert "Bluetooth: btusb: Fix quirk for Atheros 1525/QCA6174"
  atm: zatm: Fix potential Spectre v1
  net: atm: Fix potential Spectre v1
  can: kvaser_usb: Increase correct stats counter in kvaser_usb_rx_can_msg()
  tracing: Fix regex_match_front() to not over compare the test string
  libata: Apply NOLPM quirk for SanDisk SD7UB3Q*G1001 SSDs
  rfkill: gpio: fix memory leak in probe error path
  xfrm_user: fix return value from xfrm_user_rcv_msg
  f2fs: fix a dead loop in f2fs_fiemap()
  bdi: Fix oops in wb_workfn()
  tcp: fix TCP_REPAIR_QUEUE bound checking
  perf: Remove superfluous allocation error check
  soreuseport: initialise timewait reuseport field
  dccp: initialize ireq->ir_mark
  net: fix uninit-value in __hw_addr_add_ex()
  net: initialize skb->peeked when cloning
  net: fix rtnh_ok()
  netlink: fix uninit-value in netlink_sendmsg
  crypto: af_alg - fix possible uninit-value in alg_bind()
  ipvs: fix rtnl_lock lockups caused by start_sync_thread
  usb: musb: host: fix potential NULL pointer dereference
  USB: serial: option: adding support for ublox R410M
  USB: serial: option: reimplement interface masking
  USB: Accept bulk endpoints with 1024-byte maxpacket
  USB: serial: visor: handle potential invalid device configuration
  test_firmware: fix setting old custom fw path back on exit, second try
  drm/vmwgfx: Fix a buffer object leak
  IB/mlx5: Use unlimited rate when static rate is not supported
  NET: usb: qmi_wwan: add support for ublox R410M PID 0x90b2
  RDMA/mlx5: Protect from shift operand overflow
  RDMA/ucma: Allow resolving address w/o specifying source address
  xfs: prevent creating negative-sized file via INSERT_RANGE
  Input: atmel_mxt_ts - add touchpad button mapping for Samsung Chromebook Pro
  Input: leds - fix out of bound access
  tracepoint: Do not warn on ENOMEM
  ALSA: aloop: Add missing cable lock to ctl API callbacks
  ALSA: aloop: Mark paused device as inactive
  ALSA: seq: Fix races at MIDI encoding in snd_virmidi_output_trigger()
  ALSA: pcm: Check PCM state at xfern compat ioctl
  USB: serial: option: Add support for Quectel EP06
  gpmi-nand: Handle ECC Errors in erased pages
  ath10k: rebuild crypto header in rx data frames
  ath10k: fix rfc1042 header retrieval in QCA4019 with eth decap mode
  mac80211: Add RX flag to indicate ICV stripped
  mac80211: allow same PN for AMSDU sub-frames
  mac80211: allow not sending MIC up from driver for HW crypto
  percpu: include linux/sched.h for cond_resched()
  KVM: s390: Enable all facility bits that are known good for passthrough
  bpf: map_get_next_key to return first key on NULL
  perf/core: Fix the perf_cpu_time_max_percent check
  goldfish: pipe: ANDROID: mark local functions static
  Revert "goldfish: pipe: ANDROID: Allocate memory with GFP_KERNEL."
  UPSTREAM: ANDROID: binder: prevent transactions into own process.
  goldfish: pipe: ANDROID: Add DMA support
  UPSTREAM: f2fs: clear PageError on writepage - part 2
  UPSTREAM: f2fs: avoid fsync() failure caused by EAGAIN in writepage()
  ANDROID: build.config: enforce trace_printk check
  ANDROID: x86_64_cuttlefish_defconfig: Disable KPTI
  UPSTREAM: mac80211: ibss: Fix channel type enum in ieee80211_sta_join_ibss()
  UPSTREAM: mac80211: Fix clang warning about constant operand in logical operation
  UPSTREAM: nl80211: Fix enum type of variable in nl80211_put_sta_rate()
  UPSTREAM: sysfs: remove signedness from sysfs_get_dirent
  UPSTREAM: tracing: Use cpumask_available() to check if cpumask variable may be used
  BACKPORT: clocksource: Use GENMASK_ULL in definition of CLOCKSOURCE_MASK
  UPSTREAM: netpoll: Fix device name check in netpoll_setup()
  FROMLIST: staging: Fix sparse warnings in vsoc driver.
  FROMLIST: staging: vsoc: Fix a i386-randconfig warning.
  FROMLIST: staging: vsoc: Create wc kernel mapping for region shm.
  Revert "goldfish: pipe: ANDROID: remove a redundant target"
  goldfish: pipe: ANDROID: Replace writel with gf_write_ptr
  goldfish: pipe: ANDROID: Use dev_ logging instead of pr_
  goldfish: pipe: ANDROID: fix checkpatch warnings
  goldfish: pipe: ANDROID: Update module license

Conflicts:
	drivers/net/wireless/ath/ath10k/core.c
	drivers/net/wireless/ath/ath10k/core.h
	drivers/net/wireless/ath/ath10k/htt_rx.c

Change-Id: If2ede1dea6a07b3fd498724e83071fd547170e1c
[spathi@codeaurora.org: resolved compilation errors in ath10k
by rebuilding crypto header in rx data frames]
Signed-off-by: Srinivasarao P <spathi@codeaurora.org>

1 files changed, 73 insertions, 5 deletions

diff --git a/drivers/mtd/nand/gpmi-nand/gpmi-nand.c b/drivers/mtd/nand/gpmi-nand/gpmi-nand.c
index e2a239c1f40b..40a335c6b792 100644
--- a/drivers/mtd/nand/gpmi-nand/gpmi-nand.c
+++ b/drivers/mtd/nand/gpmi-nand/gpmi-nand.c
@@ -1032,14 +1032,87 @@ static int gpmi_ecc_read_page(struct mtd_info *mtd, struct nand_chip *chip,
 	/* Loop over status bytes, accumulating ECC status. */
 	status = auxiliary_virt + nfc_geo->auxiliary_status_offset;
 
+	read_page_swap_end(this, buf, nfc_geo->payload_size,
+			   this->payload_virt, this->payload_phys,
+			   nfc_geo->payload_size,
+			   payload_virt, payload_phys);
+
 	for (i = 0; i < nfc_geo->ecc_chunk_count; i++, status++) {
 		if ((*status == STATUS_GOOD) || (*status == STATUS_ERASED))
 			continue;
 
 		if (*status == STATUS_UNCORRECTABLE) {
+			int eccbits = nfc_geo->ecc_strength * nfc_geo->gf_len;
+			u8 *eccbuf = this->raw_buffer;
+			int offset, bitoffset;
+			int eccbytes;
+			int flips;
+
+			/* Read ECC bytes into our internal raw_buffer */
+			offset = nfc_geo->metadata_size * 8;
+			offset += ((8 * nfc_geo->ecc_chunk_size) + eccbits) * (i + 1);
+			offset -= eccbits;
+			bitoffset = offset % 8;
+			eccbytes = DIV_ROUND_UP(offset + eccbits, 8);
+			offset /= 8;
+			eccbytes -= offset;
+			chip->cmdfunc(mtd, NAND_CMD_RNDOUT, offset, -1);
+			chip->read_buf(mtd, eccbuf, eccbytes);
+
+			/*
+			 * ECC data are not byte aligned and we may have
+			 * in-band data in the first and last byte of
+			 * eccbuf. Set non-eccbits to one so that
+			 * nand_check_erased_ecc_chunk() does not count them
+			 * as bitflips.
+			 */
+			if (bitoffset)
+				eccbuf[0] |= GENMASK(bitoffset - 1, 0);
+
+			bitoffset = (bitoffset + eccbits) % 8;
+			if (bitoffset)
+				eccbuf[eccbytes - 1] |= GENMASK(7, bitoffset);
+
+			/*
+			 * The ECC hardware has an uncorrectable ECC status
+			 * code in case we have bitflips in an erased page. As
+			 * nothing was written into this subpage the ECC is
+			 * obviously wrong and we can not trust it. We assume
+			 * at this point that we are reading an erased page and
+			 * try to correct the bitflips in buffer up to
+			 * ecc_strength bitflips. If this is a page with random
+			 * data, we exceed this number of bitflips and have a
+			 * ECC failure. Otherwise we use the corrected buffer.
+			 */
+			if (i == 0) {
+				/* The first block includes metadata */
+				flips = nand_check_erased_ecc_chunk(
+						buf + i * nfc_geo->ecc_chunk_size,
+						nfc_geo->ecc_chunk_size,
+						eccbuf, eccbytes,
+						auxiliary_virt,
+						nfc_geo->metadata_size,
+						nfc_geo->ecc_strength);
+			} else {
+				flips = nand_check_erased_ecc_chunk(
+						buf + i * nfc_geo->ecc_chunk_size,
+						nfc_geo->ecc_chunk_size,
+						eccbuf, eccbytes,
+						NULL, 0,
+						nfc_geo->ecc_strength);
+			}
+
+			if (flips > 0) {
+				max_bitflips = max_t(unsigned int, max_bitflips,
+						     flips);
+				mtd->ecc_stats.corrected += flips;
+				continue;
+			}
+
 			mtd->ecc_stats.failed++;
 			continue;
 		}
+
 		mtd->ecc_stats.corrected += *status;
 		max_bitflips = max_t(unsigned int, max_bitflips, *status);
 	}
@@ -1062,11 +1135,6 @@ static int gpmi_ecc_read_page(struct mtd_info *mtd, struct nand_chip *chip,
 		chip->oob_poi[0] = ((uint8_t *) auxiliary_virt)[0];
 	}
 
-	read_page_swap_end(this, buf, nfc_geo->payload_size,
-			this->payload_virt, this->payload_phys,
-			nfc_geo->payload_size,
-			payload_virt, payload_phys);
-
 	return max_bitflips;
 }