Oneui 4.1

build.config.universal9820

@@ -2,6 +2,7 @@ ARCH=arm64
 CROSS_COMPILE=aarch64-linux-android-
 CLANG_TRIPLE=aarch64-linux-gnu-
 DEFCONFIG=universal9820_Q_defconfig
+MALI_CONFIG=universal9820_mali.cfg
 CLANG_VERSION=clang-4691093
 TARGET_SOC=exynos9820
 FILES="

build.config.universal9820_5g

@@ -2,6 +2,7 @@ ARCH=arm64
 CROSS_COMPILE=aarch64-linux-android-
 CLANG_TRIPLE=aarch64-linux-gnu-
 DEFCONFIG=universal9820_5g_defconfig
+MALI_CONFIG=universal9820_mali.cfg
 CLANG_VERSION=clang-4691093
 TARGET_SOC=exynos9820
 FILES="

build.config.universal9825

@@ -2,6 +2,7 @@ ARCH=arm64
 CROSS_COMPILE=aarch64-linux-android-
 CLANG_TRIPLE=aarch64-linux-gnu-
 DEFCONFIG=universal9820_Q_defconfig
+MALI_CONFIG=universal9820_mali.cfg
 CLANG_VERSION=clang-4691093
 TARGET_SOC=exynos9820
 FILES="

drivers/Makefile

@@ -205,8 +205,10 @@ obj-$(CONFIG_EXYNOS_BTS) += bts/
 obj-$(CONFIG_TRUSTONIC_TEE) += gud/
 
 # FIVE TEE driver
+ifneq ($(CONFIG_PROCA_S_OS), y)
 obj-$(CONFIG_FIVE_TEE_DRIVER) += security/samsung/five_tee_driver/
 obj-$(CONFIG_ICD) += security/samsung/icdrv/
+endif
 
 # vision driver
 obj-$(CONFIG_VISION_SUPPORT) += vision/
@@ -239,7 +241,9 @@ obj-y += kperfmon/
 obj-$(CONFIG_SEC_EXT) += samsung/
 
 #TZIC
+ifneq ($(CONFIG_PROCA_S_OS), y)
 obj-y += security/samsung/tzic/
+endif
 
 # SPU signature verify
 obj-$(CONFIG_SPU_VERIFY) += spu_verify/

drivers/android/binder.c

@@ -3017,15 +3017,18 @@ static struct binder_node *binder_get_node_refs_for_txn(
 }
 
 #ifdef CONFIG_SAMSUNG_FREECESS
-// 1) Skip first 8 bytes (useless data)
+// 1) Skip first 8(P)/12(Q) bytes (useless data)
 // 2) Make sure that the invalid address issue is not occuring (j=9, j+=2)
 // 3) Java layer uses 2 bytes char. And only the first byte has the data. (p+=2)
+// 4) Parcel::writeInterfaceToken() in frameworks/native/libs/binder/Parcel.cpp
 static void freecess_async_binder_report(struct binder_proc *proc,
-  struct binder_proc *target_proc,
-  struct binder_transaction_data *tr,
-  struct binder_transaction *t)
+ struct binder_proc *target_proc,
+ struct binder_transaction_data *tr,
+ struct binder_transaction *t)
 {
+ char buf_user[INTERFACETOKEN_BUFF_SIZE] = {0};
  char buf[INTERFACETOKEN_BUFF_SIZE] = {0};
+ char *p = NULL;
  int i = 0;
  int j = 0;
  int skip_bytes = 8;
@@ -3038,23 +3041,28 @@ static void freecess_async_binder_report(struct binder_proc *proc,
  skip_bytes = 8;
  else if (freecess_fw_version == 1)
  skip_bytes = 12;
+ else if (freecess_fw_version == 2)
+ skip_bytes = 16;
 
  if ((tr->flags & TF_ONE_WAY) && target_proc
- && target_proc->tsk && target_proc->tsk->cred
- && (target_proc->tsk->cred->euid.val > 10000)
+ && target_proc->tsk && task_euid(target_proc->tsk).val > 10000
  && (proc->pid != target_proc->pid)) {
  if (thread_group_is_frozen(target_proc->tsk)) {
  if (t->buffer->data_size > skip_bytes) {
- char *p = (char *)(t->buffer->data) + skip_bytes;
- j = skip_bytes + 1;
- while (i < INTERFACETOKEN_BUFF_SIZE && j < t->buffer->data_size && *p != '\0') {
- buf[i++] = *p;
- j+=2;
- p+=2;
+ if (0 == copy_from_user(buf_user, (const void __user *)(uintptr_t)tr->data.ptr.buffer,
+ min_t(binder_size_t, tr->data_size, INTERFACETOKEN_BUFF_SIZE - 2))) {
+ p = &buf_user[skip_bytes];
+ i = 0;
+ j = skip_bytes + 1;
+ while (i < INTERFACETOKEN_BUFF_SIZE && j < t->buffer->data_size && *p != '\0') {
+ buf[i++] = *p;
+ j += 2;
+ p += 2;
+ }
+ if (i == INTERFACETOKEN_BUFF_SIZE) buf[i-1] = '\0';
  }
- if (i == INTERFACETOKEN_BUFF_SIZE) buf[i-1] = '\0';
+ binder_report(target_proc->tsk, tr->code, buf, tr->flags & TF_ONE_WAY);
  }
- binder_report(target_proc->tsk, tr->code, buf, tr->flags & TF_ONE_WAY);
  }
  }
 }
@@ -3067,8 +3075,7 @@ static void freecess_sync_binder_report(struct binder_proc *proc,
  return;
 
  if ((!(tr->flags & TF_ONE_WAY)) && target_proc
- && target_proc->tsk && target_proc->tsk->cred
- && (target_proc->tsk->cred->euid.val > 10000)
+ && target_proc->tsk && task_euid(target_proc->tsk).val > 10000
  && (proc->pid != target_proc->pid) 
  && thread_group_is_frozen(target_proc->tsk)) {
  //if sync binder, we don't need detecting info, so set code and interfacename as default value.
@@ -4864,23 +4871,20 @@ static int binder_thread_release(struct binder_proc *proc,
  }
 
  /*
- * If this thread used poll, make sure we remove the waitqueue
- * from any epoll data structures holding it with POLLFREE.
- * waitqueue_active() is safe to use here because we're holding
- * the inner lock.
+ * If this thread used poll, make sure we remove the waitqueue from any
+ * poll data structures holding it.
  */
- if ((thread->looper & BINDER_LOOPER_STATE_POLL) &&
- waitqueue_active(&thread->wait)) {
- wake_up_poll(&thread->wait, POLLHUP | POLLFREE);
- }
+ if (thread->looper & BINDER_LOOPER_STATE_POLL)
+ wake_up_pollfree(&thread->wait);
 
  binder_inner_proc_unlock(thread->proc);
 
  /*
- * This is needed to avoid races between wake_up_poll() above and
- * and ep_remove_waitqueue() called for other reasons (eg the epoll file
- * descriptor being closed); ep_remove_waitqueue() holds an RCU read
- * lock, so we can be sure it's done after calling synchronize_rcu().
+ * This is needed to avoid races between wake_up_pollfree() above and
+ * someone else removing the last entry from the queue for other reasons
+ * (e.g. ep_remove_wait_queue() being called due to an epoll file
+ * descriptor being closed). Such other users hold an RCU read lock, so
+ * we can be sure they're done after we call synchronize_rcu().
  */
  if (thread->looper & BINDER_LOOPER_STATE_POLL)
  synchronize_rcu();
@@ -5861,13 +5865,12 @@ static void print_binder_proc(struct seq_file *m,
 }
 
 #ifdef CONFIG_SAMSUNG_FREECESS
-static void binder_in_transaction(struct binder_proc *proc)
+static void binder_in_transaction(struct binder_proc *proc, int uid)
 {
  struct rb_node *n = NULL;
  struct binder_thread *thread = NULL;
- int uid = -1;
- struct task_struct *tsk = NULL;
  struct binder_transaction *t = NULL;
+ struct binder_work *w = NULL;
  bool empty = true;
  bool found = false;
 
@@ -5876,49 +5879,100 @@ static void binder_in_transaction(struct binder_proc *proc)
  for (n = rb_first(&proc->threads); n != NULL; n = rb_next(n)) {
  thread = rb_entry(n, struct binder_thread, rb_node);
  empty = binder_worklist_empty_ilocked(&thread->todo);
- tsk = thread->task;
+ if (!empty) {
+ list_for_each_entry(w, &thread->todo, entry) {
+ if (w->type == BINDER_WORK_TRANSACTION) {
+ t = container_of(w, struct binder_transaction, work);
+ if (!(t->flags & TF_ONE_WAY)) {
+ found = true;
+ break;
+ }
+ }
+ else if (w->type != BINDER_WORK_TRANSACTION_COMPLETE && w->type != BINDER_WORK_NODE) {
+ found = true;
+ break;
+ }
+ }
 
- if (tsk != NULL) {
- //have some binders to do
- if (!empty) {
- //report uid to FW, only report one time
- uid = tsk->cred->euid.val;
+ if (found == true) {
  binder_inner_proc_unlock(proc);
  cfb_report(uid, "thread");
  return;
  }
+ }
 
- //processing one binder call
- t = thread->transaction_stack;
- if (t) {
- spin_lock(&t->lock);
- if (t->to_thread == thread) {
- //check incoming, it has one
+ //processing one binder call
+ t = thread->transaction_stack;
+ if (t) {
+ if (t->to_thread == thread) {
+ binder_inner_proc_unlock(proc);
+ cfb_report(uid, "transaction_stack");
+ return;
+ }
+ }
+ }
+
+ //check binder proc todo list
+#ifdef CONFIG_FAST_TRACK
+ empty = binder_proc_worklist_empty_ilocked(proc);
+ if (!empty) {
+ list_for_each_entry(w, &proc->todo, entry) {
+ if (w->type == BINDER_WORK_TRANSACTION) {
+ t = container_of(w, struct binder_transaction, work);
+ if (!(t->flags & TF_ONE_WAY)) {
  found = true;
- uid = tsk->cred->euid.val;
+ break;
  }
- spin_unlock(&t->lock);
- if (found == true){
- //report uid to FW, only report one time
- binder_inner_proc_unlock(proc);
- cfb_report(uid, "transaction_stack");
- return;
+ }
+ else if (w->type != BINDER_WORK_TRANSACTION_COMPLETE && w->type != BINDER_WORK_NODE) {
+ found = true;
+ break;
+ }
+ }
+ list_for_each_entry(w, &proc->fg_todo, entry) {
+ if (w->type == BINDER_WORK_TRANSACTION) {
+ t = container_of(w, struct binder_transaction, work);
+ if (!(t->flags & TF_ONE_WAY)) {
+ found = true;
+ break;
  }
  }
+ else if (w->type != BINDER_WORK_TRANSACTION_COMPLETE && w->type != BINDER_WORK_NODE) {
+ found = true;
+ break;
+ }
+ }
+ if (found == true) {
+ binder_inner_proc_unlock(proc);
+ cfb_report(uid, "proc");
+ return;
  }
  }
-
- //check binder proc todo list
+#else
  empty = binder_worklist_empty_ilocked(&proc->todo);
- tsk = proc->tsk;
- if (tsk != NULL && !empty) {
- //report uid to FW
- uid = tsk->cred->euid.val;
- binder_inner_proc_unlock(proc);
- cfb_report(uid, "proc");
+ if (!empty) {
+ list_for_each_entry(w, &proc->todo, entry) {
+ if (w->type == BINDER_WORK_TRANSACTION) {
+ t = container_of(w, struct binder_transaction, work);
+ if (!(t->flags & TF_ONE_WAY)) {
+ found = true;
+ break;
+ }
+ }
+ else if (w->type != BINDER_WORK_TRANSACTION_COMPLETE && w->type != BINDER_WORK_NODE) {
+ found = true;
+ break;
+ }
+ }
+
+ if (found == true) {
+ binder_inner_proc_unlock(proc);
+ cfb_report(uid, "proc");
+ return;
+ }
  }
- else
-  binder_inner_proc_unlock(proc);
+#endif
+ binder_inner_proc_unlock(proc);
 }
 
 void binders_in_transcation(int uid)
@@ -5927,8 +5981,8 @@ void binders_in_transcation(int uid)
 
  mutex_lock(&binder_procs_lock);
  hlist_for_each_entry(itr, &binder_procs, proc_node) {
- if (itr != NULL && (itr->tsk->cred->euid.val == uid)) {
- binder_in_transaction(itr);
+ if (itr != NULL && task_euid(itr->tsk).val == uid) {
+ binder_in_transaction(itr, uid);
  }
  }
  mutex_unlock(&binder_procs_lock);

drivers/battery_v2/include/sec_battery.h

@@ -658,6 +658,7 @@ struct sec_battery_info {
 
  bool support_unknown_wpcthm;
  int batt_full_capacity;
+ bool usb_slow_chg;
 };
 
 /* event check */

drivers/battery_v2/sec_battery.c

@@ -4289,8 +4289,10 @@ static void sec_bat_check_slowcharging_work(struct work_struct *work)
  battery->cable_type == SEC_BATTERY_CABLE_USB) {
  if (!get_usb_enumeration_state() &&
  (battery->current_event & SEC_BAT_CURRENT_EVENT_USB_100MA)) {
- sec_bat_set_misc_event(battery, BATT_MISC_EVENT_TIMEOUT_OPEN_TYPE, BATT_MISC_EVENT_TIMEOUT_OPEN_TYPE);
+ battery->usb_slow_chg = true;
  battery->max_charge_power = (battery->input_voltage * battery->current_max) / 10;
+ wake_lock(&battery->monitor_wake_lock);
+ queue_delayed_work(battery->monitor_wqueue, &battery->monitor_work, 0);
  }
  }
  dev_info(battery->dev, "%s: \n",__func__);
@@ -5598,6 +5600,7 @@ static void sec_bat_cable_work(struct work_struct *work)
 #endif
 
  sec_bat_set_charge(battery, SEC_BAT_CHG_MODE_CHARGING_OFF);
+ battery->usb_slow_chg = false;
  } else if (is_slate_mode(battery)) {
  dev_info(battery->dev,
  "%s:slate mode on\n",__func__);
@@ -5984,14 +5987,14 @@ static int sec_bat_set_property(struct power_supply *psy,
  sec_bat_set_current_event(battery, SEC_BAT_CURRENT_EVENT_USB_100MA,
  (SEC_BAT_CURRENT_EVENT_USB_100MA | SEC_BAT_CURRENT_EVENT_USB_SUPER));
  } else if (val->intval == USB_CURRENT_HIGH_SPEED) {
- sec_bat_set_misc_event(battery, 0, BATT_MISC_EVENT_TIMEOUT_OPEN_TYPE);
+ battery->usb_slow_chg = false;
  sec_bat_set_current_event(battery, 0,
  (SEC_BAT_CURRENT_EVENT_USB_100MA | SEC_BAT_CURRENT_EVENT_USB_SUPER));
  sec_bat_change_default_current(battery, SEC_BATTERY_CABLE_USB,
  battery->pdata->default_usb_input_current,
  battery->pdata->default_usb_charging_current);
  } else if (val->intval == USB_CURRENT_SUPER_SPEED) {
- sec_bat_set_misc_event(battery, 0, BATT_MISC_EVENT_TIMEOUT_OPEN_TYPE);
+ battery->usb_slow_chg = false;
  sec_bat_set_current_event(battery, SEC_BAT_CURRENT_EVENT_USB_SUPER,
  (SEC_BAT_CURRENT_EVENT_USB_100MA | SEC_BAT_CURRENT_EVENT_USB_SUPER));
  sec_bat_change_default_current(battery, SEC_BATTERY_CABLE_USB,
@@ -6148,6 +6151,9 @@ static int sec_bat_get_property(struct power_supply *psy,
  val->intval = POWER_SUPPLY_CHARGE_TYPE_NONE;
  } else if (is_hv_wire_type(battery->cable_type) || is_pd_wire_type(battery->cable_type)) {
  val->intval = POWER_SUPPLY_CHARGE_TYPE_FAST;
+ } else if (battery->usb_slow_chg) {
+ val->intval = POWER_SUPPLY_CHARGE_TYPE_SLOW;
+ pr_info("%s: slow-charging mode\n", __func__);
  } else {
  psy_do_property(battery->pdata->charger_name, get,
  POWER_SUPPLY_PROP_CHARGE_TYPE, value);
@@ -8467,6 +8473,7 @@ static int sec_battery_probe(struct platform_device *pdev)
  battery->usb_temp_flag = false;
 
  battery->batt_full_capacity = 0;
+ battery->usb_slow_chg = false;
 
  /* Check High Voltage charging option for wireless charging */
  /* '1' means disabling High Voltage charging */