Enables CONFIG_CFG80211_PROP_MULTI_LINK_EXT_SUPPORT config
for MLO ext feature.

Change-Id: I282031cc31ee3a08c24c8e6e6ff81b92e4828552
Signed-off-by: Aditya Chillara <quic_achillar@quicinc.com>

revert this change as rdkb-v1 kernel config enabled for pinnacles2.2

This reverts commit 5a97be65.

Change-Id: If480f340b35db3a3f37ae7d4caed197d059d5d5f
Signed-off-by: Tianzhen Wang <quic_tianzhen@quicinc.com>

Merge "FROMGIT: media: venus: hfi: add a check to handle OOB in sfr region" into kernel.lnx.5.15.r14-rel

sfr->buf_size is in shared memory and can be modified by malicious user.
OOB write is possible when the size is made higher than actual sfr data
buffer. Cap the size to allocated size for such cases.

Cc: stable@vger.kernel.org
Fixes: d96d3f30 ("[media] media: venus: hfi: add Venus HFI files")
Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
CRs-Fixed: 3947576
Change-Id: I483a5feff3dfa35dae8f444e57601d2d1d85246f
Git-commit: f4b211714bcc70effa60c34d9fa613d182e3ef1e
Git-repo: https://gitlab.freedesktop.org/linux-media/media-committers.git


Signed-off-by: Vikash Garodia <quic_vgarodia@quicinc.com>

qsize represents size of shared queued between driver and video
firmware. Firmware can modify this value to an invalid large value. In
such situation, empty_space will be bigger than the space actually
available. Since new_wr_idx is not checked, so the following code will
result in an OOB write.
...
qsize = qhdr->q_size

if (wr_idx >= rd_idx)
 empty_space = qsize - (wr_idx - rd_idx)
....
if (new_wr_idx < qsize) {
 memcpy(wr_ptr, packet, dwords << 2) --> OOB write

Add check to ensure qsize is within the allocated size while
reading and writing packets into the queue.

Cc: stable@vger.kernel.org
Fixes: d96d3f30 ("[media] media: venus: hfi: add Venus HFI files")
Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
CRs-Fixed: 3935673
Change-Id: Ifb907d4a4c82f853081492e06e68180476367ed5
Git-commit: 69baf245b23e20efda0079238b27fc63ecf13de1
Git-repo: https://gitlab.freedesktop.org/linux-media/media-committers.git


Signed-off-by: Vikash Garodia <quic_vgarodia@quicinc.com>

Change-Id: I6cf48db3d523a539af69ba27e3ce6160d60baeab

Correct serdes tx lane mode 3 register value as per the latest
serdes HPG.

Change-Id: If96eef08829a63cfff74afbf1123326586d2ac21
Signed-off-by: Lakshit Tyagi <quic_ltyagi@quicinc.com>
(cherry picked from commit f61e848a)

Change-Id: Ied6b43c8198af541f918ae0134e9b688ce4cc1c5

There is a possibility that init_codecs is invoked multiple times during
manipulated payload from video firmware. In such case, if codecs_count
can get incremented to value more than MAX_CODEC_NUM, there can be OOB
access. Reset the count so that it always starts from beginning.

Cc: stable@vger.kernel.org
Fixes: 1a73374a ("media: venus: hfi_parser: add common capability parser")
Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
CRs-Fixed: 3935643
Change-Id: I6216e773af65082e4775b415789ffd549e0bed2d
Git-commit: 172bf5a9ef70a399bb227809db78442dc01d9e48
Git-repo: https://gitlab.freedesktop.org/linux-media/media-committers.git


Signed-off-by: Vikash Garodia <quic_vgarodia@quicinc.com>

Add radio iface name parameter in vif_params.
Add attributes & policy to support the same.

Change-Id: Ie2fadb006f02d45adfc27698d9f1f15c27443822
Signed-off-by: Shwetha G K <quic_kshwetha@quicinc.com>

define new variable to identify metadata version in driver and
mlo enablement status in ipacm.

Change-Id: If55fe3d419a784478c4f2cfeda8b7a4bc354b722
Signed-off-by: Fakruddin Vohra <quic_fakruddi@quicinc.com>

Remove SW offloads and other netdev features for AQC113
as a workaround for SMMU crash which is being observed after
atl_clean_tx is executed.

Change-Id: Icc2925a2cc2b5ad2c7d5bc1c8a7c5948de124aa6
Signed-off-by: Lakshit Tyagi <quic_ltyagi@quicinc.com>

Add check for NUll access.

Change-Id: Ia4b8629c70791b144c580458980da2d5c66d99f3
Signed-off-by: Gaurav Nagar <quic_gauk@quicinc.com>

Disable kprobe event gen test and sanity test to avoid
conflicts with upstream LTS changes.

Change-Id: Ica375a5616cb837d3186cfc55c83211df98c82e1
Signed-off-by: Vishnu Teja <quic_vteja@quicinc.com>

If dwc3-msm is already pm suspended, and then we receive a cable
connect notification before APP suspends, dwc3_resume_work won't
schedule otg_sm_work since pm_suspended flag is set. This flag is
only cleared when we receive a pm_resume callback, and pm_resume
doesn't get called here because APPS is suspending as there is no
active source. Hence forcefully wakeup APPS, aborting the suspend
in progress and wake up from suspend-to-idle.

There is another case where we get vbus_notifier before dwc3-msm
pm suspend happens, but APPS suspends after resume_work() queues
otg_sm_work. This leads to freezing of all workqueues,and causes
enumeration loss. Fix this by keeping the APPS active by calling
pm_stay_awake, subsequent dwc3_msm_resume/suspend (called after
processing cable change event) should balance it.

Change-Id: Ia2c24ef7020d90ebc0de6bcea6d2821112bd5f39
Signed-off-by: Prashanth K <quic_prashk@quicinc.com>

Enable PPPoE configuration.

Change-Id: Ib4f426e44c860976784090c5119d3057d822b82e
Signed-off-by: HuaWen CHEN <quic_huawenc@quicinc.com>

xfrm6_dst_lookup won't work in case of IPv4 dst for IPv6 state.
We will use ip output method switching instead.

Change-Id: I27b942caab2957f5e90f892599979a327eca88b2
Signed-off-by: Ilia Lin <quic_ilial@quicinc.com>

Change-Id: I49a60f4a26daa2bbbf6b8f726e071e70dca7b624

Correct serdes tx lane mode 3 register value as per the latest
serdes HPG.

Change-Id: If96eef08829a63cfff74afbf1123326586d2ac21
Signed-off-by: Lakshit Tyagi <quic_ltyagi@quicinc.com>

Enable EP-PCIe & MHI MSM configs for 128MB sdxbaagha to support MHI
protocol over PCIe for mobile broadband interface.

Change-Id: Ic4d5f7695ac8106afa0354d2f208ff47710389a1
Signed-off-by: Sai Chaitanya Kaveti <quic_skaveti@quicinc.com>

With commit <735a0f425c98> ("msm: ep_pcie: Allow Clients to Query the
Link State during Non-PCIe Boot"), the EP PCIe driver sets the link
state to INVALID in the case of a non-PCIe boot. So, let's query the
link state, and if it is a non-PCIe boot (link state returned as
INVALID), then simply return failure without proceeding with any further
initialization.

Here, the MHI driver should depend on the EP PCIe driver (meaning the
MHI driver should probe only if the EP PCIe driver probes).
This change works only if this dependency chain is taken care of properly.

If MHI driver proceeds with probe in non-PCIe boot, its holding a
wakelock, which prevents system from suspend.

Change-Id: If4a737441f3a5b42256c9155140628496629eb49
Signed-off-by: Sumit Kumar <quic_sumk@quicinc.com>

This change enables the host to reset the device after
writing to the EDL cookie in EDL path on sa525m platform.

Change-Id: Icd2a542f967642bb4396cf95aa8a20b9046717dc
Signed-off-by: Naga Rashmi Ayiluri <quic_nayiluri@quicinc.com>