Integer overflow in refcount of map is leading to use after free. Error
out if refcount reaches INT_MAX

Change-Id: I21e88361a8e70ef8c5c9593f1fc0ddd2b351a55a
Acked-by: Himateja Reddy <hmreddy@qti.qualcomm.com>
Signed-off-by: Tharun Kumar Merugu <mtharu@codeaurora.org>

Correct the out of bounds check and prevent moving the temp pointer
further than out of bounds check which is not necessary while
processing dci pkt rsp.

Change-Id: I01f8cd7454aff81b24c986eade35c79724976151
Signed-off-by: Manoj Prabhu B <bmanoj@codeaurora.org>

Update polling_delay for quiet-thermal-adc user_space thermal zone
for TRINKET.

Change-Id: I471644a7628176f3700bb2d1128fdd9177451b7f
Signed-off-by: Manaf Meethalavalappu Pallikunhi <manafm@codeaurora.org>

In SM6125 target clock will be enabled through RPM driver, before enabling
clocks some times IPA clock vote was increased causing NOC error. Add
changes to increment IPA clock vote count after enabling clock.

Change-Id: I6f19da9e0d03eab744292588c5bc526b8a90482a
Signed-off-by: Ashok Vuyyuru <avuyyuru@codeaurora.org>

Consider a case of quick pull-up disable after pull-up is enabled.
If a SETUP packet comes after bus reset event followed by connection
done event, there is a possibility of race between
composite_dev_cleanup() freeing cdev->req called from
configfs_composite_unbind() and composite_setup() storing req pointer
to stack. This causes use after free of cdev->req. To fix this flush
the bottom half work if there was any work pending before disabling
dwc3_irq.

Change-Id:I309f2117325c500f31e93925ac0a7b0d61ccc078
Signed-off-by: Pratham Pratap <prathampratap@codeaurora.org>

Corrected the mnt flags argument for trinket

Change-Id: Iafc62d6d92eddcabb518d8bad4a06f6414270807
Signed-off-by: Mohit Sharma <smohit@codeaurora.org>

In secure camera mode, publish topology and stream
start and stop events to TZ for it to reset the
modules, which adds to the security of the data.

Change-Id: If7f4b85199e628846a1a416530f43ad4afa786ac
Signed-off-by: Vijay kumar Tumati <vtumati@codeaurora.org>
Signed-off-by: Shadul Shaikh <sshadu@codeaurora.org>
Signed-off-by: Sumalatha Malothu <smalot@codeaurora.org>

mbox_send_msg returns a value >= 0 on success, and a negative value
on failure.

Change-Id: I9fe56d5fddda0d6abb8dd5eb95743f12adac9eef
Signed-off-by: Patrick Daly <pdaly@codeaurora.org>
Signed-off-by: Charan Teja Reddy <charante@codeaurora.org>

Add checks to make sure thermal power level restrictions are
enforced and power level is always within thermal min and max
limit. Currently, thermal limits are breached in cases where
GPU min_pwrlevel and max_pwrlevel sysfs entries are updated by
performance daemon to maintain performance and thermal mitigation
kicks in at same time.

Change-Id: Id3f0c2d878588633398d20d43223b26ec292b98e
Signed-off-by: Deepak Kumar <dkumar@codeaurora.org>

In a case where the core is resumed by a child device
after the dwc3-msm driver has processed the disconnect
and entered lpm, there is a possiblity that PMIC is
running APSD for the next connect during this.
Once PMIC notified the driver of connect, the core and
the PHYs are not reset again resulting in erratic
behavior.
Fix this by setting the WAIT_FOR_LPM whenever the
dwc3_msm_resume is called without any events.

Change-Id: I19f00188595c9b2e620be38192a47a902d6b0beb
Signed-off-by: Sriharsha Allenki <sallenki@codeaurora.org>

Some CTIs can go into power collapse when accessing CTI's register space,
hence require a bunch of clks and regulators to be configured. This change
add support in CIT driver to enable them when CTI is used for first time
and disable them when CTI isn't used.

Change-Id: Ia8a54cbc0f8363d19811c3a0712f5b8c23530b32
Signed-off-by: Yuanfang Zhang <zhangyuanfang@codeaurora.org>
Signed-off-by: Mao Jinlong <jinlmao@codeaurora.org>

Need to vote the gpu clocks and regulators for gpu cti when enable
and disable it.

Change-Id: I01c023a607cd623086d1c21dc4ac52ef0fa13494
Signed-off-by: Mao Jinlong <jinlmao@codeaurora.org>

Array 'eq' of size 2 may use index value(s) 2.

Change-Id: I69f8a0992a26cc7dabed35d734cf046e9bd42408
Signed-off-by: Linyu Yuan <linyyuan@codeaurora.org>

dchdr->dlen is a short variable controlled by the user-provided data.
If the value is negative, loop continues, also increasing the value
of "len". As a result buffer overflow occurs. So define the len as
unsigned and check with length of string input from user space.

Change-Id: I8bb9ab33d543c826eb330e16ae116385d823ca98
Signed-off-by: raghavendra ambadas <rambad@codeaurora.org>

With some PCIe endpoints, link down interrupt is being triggered on RC
side after endpoint enumeration if l0s is enabled. As workaround,
suggestion is to disable l0s low power mode. Hence disable l0s low power
mode for QCS405 to avoid PCIe link down issue.

Change-Id: I6e52bd8c5afa824f2d88fda29069fb56fddf8043
Signed-off-by: Vijayavardhan Vennapusa <vvreddy@codeaurora.org>

Enable powerdown of PCIe PHY in probe to avoid leakage
current seen on QCS405 when PCI is not enabled.

Change-Id: Ie8d457c034d1ddbc949cec272e37402cf373a12a
Signed-off-by: Vijayavardhan Vennapusa <vvreddy@codeaurora.org>

Add support to powerdown PCIe PHY in probe() to avoid leakage
current on platforms, where leakage is seen without PCI enablement.

Change-Id: Idc31573647da4e82686df139224f28495f73c13e
Signed-off-by: Vijayavardhan Vennapusa <vvreddy@codeaurora.org>

Enable PCIe bus driver to support endpoints connected to QCS405
PCIe slots.

Change-Id: I01399c8635ac419e0ac72c0caf7fe80063a82d74
Signed-off-by: Rama Krishna Phani A <rphani@codeaurora.org>

In some erroneous cases there could be back-to-back
calls to process the accumulator data which may lead
to a array overflow. Fix this by adding range check
while populating the FIFO data.

Change-Id: I3f2495649153ae16040579b71dff5b78315b29a9
Signed-off-by: Anirudh Ghayal <aghayal@codeaurora.org>

Add MSM PCIe bus driver device nodes in main and pinctrl
devicetree for QCS405 to enable communication between QCS405
and external peripherals connected via PCIe in RC mode.

Change-Id: I06fd890bf3dc84828dc37853ac274ee01018eb6b
Signed-off-by: Rama Krishna Phani A <rphani@codeaurora.org>
Signed-off-by: Vijayavardhan Vennapusa <vvreddy@codeaurora.org>

Add PCIe controller support for QCS405 for RC mode.

Change-Id: I3aaa54ef24fc3d69ea536bca5e0903e6684dbab4
Signed-off-by: Rama Krishna Phani A <rphani@codeaurora.org>
Signed-off-by: Vijayavardhan Vennapusa <vvreddy@codeaurora.org>

Do not set the min voltages of the L1P/L2P more than the parent
regulator to make sure the proper min voltage vote on the parent.
Hence, remove the min voltage modifications.

Change-Id: Ia9fa26d90f1b9a009913fff8fb6c939890b43cbf
Signed-off-by: Kiran Gunda <kgunda@codeaurora.org>

Add the check to not send the remote wakeup again if last remote
wakeup hasn't taken effect and usb state not been changed yet.

Change-Id: I55b2285264f85dfa4befedae4a1af5e6eaf71c4b
Signed-off-by: Bojun Pan <bojunp@codeaurora.org>

Increased resolution of mapping between raw adc code and temperature
for thermistors. Adjust thresholds written to ensure interrupts get
triggered correctly for temperatures read.
In addition, measure temperature causing threshold violation and
provide it directly to thermal framework instead of waiting for thermal
framework to read it.

Change-Id: I4330c659a91021ef44fa17c9c79e379105aa8fc3
Signed-off-by: Jishnu Prakash <jprakash@codeaurora.org>

While allocating a secure memory if locking fails with error code
EADDRNOTAVAIL then don't free the allocated memory either to pool
or buddy system as security state of the pages is unknown after
this failure which make this memory unusable.

Change-Id: Ia9dff942193d8d88871a15bc855264eb37fc7b56
Signed-off-by: Deepak Kumar <dkumar@codeaurora.org>