Merge 90de98dfa4 on remote branch

Change-Id: I2aa310ff14b33f02f77ffaef1640568e1170765a

arch/arm64/configs/vendor/kona-perf_defconfig

@@ -499,6 +499,7 @@ CONFIG_USB_CONFIGFS_MASS_STORAGE=y
 CONFIG_USB_CONFIGFS_F_FS=y
 CONFIG_USB_CONFIGFS_F_ACC=y
 CONFIG_USB_CONFIGFS_F_AUDIO_SRC=y
+CONFIG_USB_CONFIGFS_F_UAC1=y
 CONFIG_USB_CONFIGFS_F_UAC2=y
 CONFIG_USB_CONFIGFS_F_MIDI=y
 CONFIG_USB_CONFIGFS_F_HID=y

arch/arm64/configs/vendor/kona_defconfig

@@ -519,6 +519,7 @@ CONFIG_USB_CONFIGFS_MASS_STORAGE=y
 CONFIG_USB_CONFIGFS_F_FS=y
 CONFIG_USB_CONFIGFS_F_ACC=y
 CONFIG_USB_CONFIGFS_F_AUDIO_SRC=y
+CONFIG_USB_CONFIGFS_F_UAC1=y
 CONFIG_USB_CONFIGFS_F_UAC2=y
 CONFIG_USB_CONFIGFS_F_MIDI=y
 CONFIG_USB_CONFIGFS_F_HID=y

drivers/char/adsprpc.c

@@ -482,6 +482,8 @@ struct fastrpc_file {
 	uint32_t ws_timeout;
 	/* To indicate attempt has been made to allocate memory for debug_buf */
 	int debug_buf_alloced_attempted;
+	/* Flag to indicate dynamic process creation status*/
+	bool in_process_create;
 };
 
 static struct fastrpc_apps gfa;
@@ -2577,6 +2579,15 @@ static int fastrpc_init_process(struct fastrpc_file *fl,
 			int siglen;
 		} inbuf;
 
+		spin_lock(&fl->hlock);
+		if (fl->in_process_create) {
+			err = -EALREADY;
+			pr_err("Already in create init process\n");
+			spin_unlock(&fl->hlock);
+			return err;
+		}
+		fl->in_process_create = true;
+		spin_unlock(&fl->hlock);
 		inbuf.pgid = fl->tgid;
 		inbuf.namelen = strlen(current->comm) + 1;
 		inbuf.filelen = init->filelen;
@@ -2788,6 +2799,11 @@ bail:
 		fastrpc_mmap_free(file, 0);
 		mutex_unlock(&fl->map_mutex);
 	}
+	if (init->flags == FASTRPC_INIT_CREATE) {
+		spin_lock(&fl->hlock);
+		fl->in_process_create = false;
+		spin_unlock(&fl->hlock);
+	}
 	return err;
 }
 
@@ -3700,6 +3716,7 @@ static int fastrpc_file_free(struct fastrpc_file *fl)
 	}
 	spin_lock(&fl->hlock);
 	fl->file_close = 1;
+	fl->in_process_create = false;
 	spin_unlock(&fl->hlock);
 	if (!IS_ERR_OR_NULL(fl->init_mem))
 		fastrpc_buf_free(fl->init_mem, 0);
@@ -4101,6 +4118,7 @@ static int fastrpc_device_open(struct inode *inode, struct file *filp)
 	fl->cid = -1;
 	fl->dev_minor = dev_minor;
 	fl->init_mem = NULL;
+	fl->in_process_create = false;
 	memset(&fl->perf, 0, sizeof(fl->perf));
 	fl->qos_request = 0;
 	fl->dsp_proc_init = 0;

drivers/char/diag/diag_dci.c

@@ -1,5 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0-only
 /* Copyright (c) 2012-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022, Qualcomm Innovation Center, Inc. All rights reserved.
  */
 
 #include <linux/slab.h>
@@ -1625,7 +1626,6 @@ static int diag_send_dci_pkt(struct diag_cmd_reg_t *entry,
 		return -EIO;
 	}
 
-	mutex_lock(&driver->dci_mutex);
 	/* prepare DCI packet */
 	header.start = CONTROL_CHAR;
 	header.version = 1;
@@ -1644,7 +1644,6 @@ static int diag_send_dci_pkt(struct diag_cmd_reg_t *entry,
 		diag_update_pkt_buffer(driver->apps_dci_buf, write_len,
 				       DCI_PKT_TYPE);
 		diag_update_sleeping_process(entry->pid, DCI_PKT_TYPE);
-		mutex_unlock(&driver->dci_mutex);
 		return DIAG_DCI_NO_ERROR;
 	}
 
@@ -1664,7 +1663,6 @@ static int diag_send_dci_pkt(struct diag_cmd_reg_t *entry,
 		       entry->proc);
 		status = DIAG_DCI_SEND_DATA_FAIL;
 	}
-	mutex_unlock(&driver->dci_mutex);
 	return status;
 }
 
@@ -1989,12 +1987,13 @@ static int diag_process_dci_pkt_rsp(unsigned char *buf, int len)
 {
 	int ret = DIAG_DCI_TABLE_ERR;
 	int common_cmd = 0, header_len = 0;
+	int req_tag = 0;
 	struct diag_pkt_header_t *header = NULL;
 	unsigned char *temp = buf;
 	unsigned char *req_buf = NULL;
 	uint8_t retry_count = 0, max_retries = 3;
 	uint32_t read_len = 0, req_len = len;
-	struct dci_pkt_req_entry_t *req_entry = NULL;
+	struct dci_pkt_req_entry_t *req_entry = NULL, *test_entry = NULL;
 	struct diag_dci_client_tbl *dci_entry = NULL;
 	struct dci_pkt_req_t req_hdr;
 	struct diag_cmd_reg_t *reg_item;
@@ -2099,6 +2098,7 @@ static int diag_process_dci_pkt_rsp(unsigned char *buf, int len)
 		mutex_unlock(&driver->dci_mutex);
 		return DIAG_DCI_NO_REG;
 	}
+	req_tag = req_entry->tag;
 	mutex_unlock(&driver->dci_mutex);
 
 	/*
@@ -2106,14 +2106,14 @@ static int diag_process_dci_pkt_rsp(unsigned char *buf, int len)
 	 * remote processor
 	 */
 	if (dci_entry->client_info.token > 0) {
-		ret = diag_send_dci_pkt_remote(req_buf, req_len, req_entry->tag,
+		ret = diag_send_dci_pkt_remote(req_buf, req_len, req_tag,
 					       dci_entry->client_info.token);
 		return ret;
 	}
 
 	/* Check if it is a dedicated Apps command */
 	ret = diag_dci_process_apps_pkt(header, req_buf, req_len,
-					req_entry->tag, header_len);
+					req_tag, header_len);
 	if ((ret == DIAG_DCI_NO_ERROR && !common_cmd) || ret < 0)
 		return ret;
 
@@ -2136,8 +2136,14 @@ static int diag_process_dci_pkt_rsp(unsigned char *buf, int len)
 	if (temp_entry) {
 		reg_item = container_of(temp_entry, struct diag_cmd_reg_t,
 								entry);
-		ret = diag_send_dci_pkt(reg_item, req_buf, req_len,
+		mutex_lock(&driver->dci_mutex);
-					req_entry->tag);
+		test_entry = diag_dci_get_request_entry(req_tag);
+		if (test_entry)
+			ret = diag_send_dci_pkt(reg_item, req_buf, req_len,
+					test_entry->tag);
+		else
+			ret = -EIO;
+		mutex_unlock(&driver->dci_mutex);
 	} else {
 		DIAG_LOG(DIAG_DEBUG_DCI, "Command not found: %02x %02x %02x\n",
 				reg_entry.cmd_code, reg_entry.subsys_id,

drivers/gpu/msm/kgsl.c

@@ -2610,6 +2610,15 @@ static int memdesc_sg_virt(struct kgsl_memdesc *memdesc, unsigned long useraddr)
 
 	ret = sg_alloc_table_from_pages(memdesc->sgt, pages, npages,
 					0, memdesc->size, GFP_KERNEL);
+
+	if (ret)
+		goto out;
+
+	ret = kgsl_cache_range_op(memdesc, 0, memdesc->size,
+			KGSL_CACHE_OP_FLUSH);
+
+	if (ret)
+		sg_free_table(memdesc->sgt);
 out:
 	if (ret) {
 		for (i = 0; i < npages; i++)

drivers/i2c/busses/i2c-msm-v2.c

@@ -435,13 +435,13 @@ static int i2c_msm_set_mstr_clk_ctl(struct i2c_msm_ctrl *ctrl, int fs_div,
 
 	/*
 	 * find matching freq and set divider values unless they are forced
-	 * from parametr list
+	 * from parameter list
 	 */
 	for (i = 0; i < ARRAY_SIZE(i2c_msm_clk_div_map); ++i, ++itr) {
 		if (ctrl->rsrcs.clk_freq_out == itr->clk_freq_out) {
-			if (!fs_div)
+			if (fs_div < 0)
 				fs_div = itr->fs_div;
-			if (!ht_div)
+			if (ht_div < 0)
 				ht_div = itr->ht_div;
 			break;
 		}
@@ -450,7 +450,7 @@ static int i2c_msm_set_mstr_clk_ctl(struct i2c_msm_ctrl *ctrl, int fs_div,
 	/* For non-standard clock freq, clk divider value
 	 * fs_div should be supplied by client through device tree
 	 */
-	if (!fs_div) {
+	if (fs_div < 0) {
 		dev_err(ctrl->dev, "Missing clk divider value in DT for %dKHz\n",
 			(ctrl->rsrcs.clk_freq_out / 1000));
 		return -EINVAL;
@@ -2484,7 +2484,7 @@ static int i2c_msm_dt_to_pdata_populate(struct i2c_msm_ctrl *ctrl,
 static int i2c_msm_rsrcs_process_dt(struct i2c_msm_ctrl *ctrl,
 					struct platform_device *pdev)
 {
-	u32 fs_clk_div, ht_clk_div, noise_rjct_scl, noise_rjct_sda;
+	int fs_clk_div, ht_clk_div, noise_rjct_scl, noise_rjct_sda;
 	int ret;
 
 	struct i2c_msm_dt_to_pdata_map map[] = {
@@ -2502,9 +2502,9 @@ static int i2c_msm_rsrcs_process_dt(struct i2c_msm_ctrl *ctrl,
 	{"qcom,noise-rjct-sda",		&noise_rjct_sda,
 							DT_OPT,  DT_U32,  0},
 	{"qcom,high-time-clk-div",	&ht_clk_div,
-							DT_OPT,  DT_U32,  0},
+							DT_OPT,  DT_U32,  -1},
 	{"qcom,fs-clk-div",		&fs_clk_div,
-							DT_OPT,  DT_U32,  0},
+							DT_OPT,  DT_U32,  -1},
 	{NULL,  NULL,					0,       0,       0},
 	};
 

drivers/media/platform/msm/synx/synx_debugfs.c

@@ -1,6 +1,7 @@
 // SPDX-License-Identifier: GPL-2.0-only
 /*
- * Copyright (c) 2019, 2022, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2019, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022, Qualcomm Innovation Center, Inc. All rights reserved.
  */
 
 #include <linux/io.h>

drivers/net/wireless/cnss2/qmi.c

@@ -2227,6 +2227,11 @@ int cnss_wlfw_server_arrive(struct cnss_plat_data *plat_priv, void *data)
 		return -EINVAL;
 	}
 
+	if (test_bit(CNSS_IN_REBOOT, &plat_priv->driver_state)) {
+		cnss_pr_err("WLFW server will exit on shutdown\n");
+		return -EINVAL;
+	}
+
 	cnss_ignore_qmi_failure(false);
 
 	ret = cnss_wlfw_connect_to_server(plat_priv, data);

drivers/soc/qcom/fsa4480-i2c.c

@@ -402,10 +402,7 @@ static int fsa4480_probe(struct i2c_client *i2c,
 	INIT_WORK(&fsa_priv->usbc_analog_work,
 		  fsa4480_usbc_analog_work_fn);
 
-	fsa_priv->fsa4480_notifier.rwsem =
+	BLOCKING_INIT_NOTIFIER_HEAD(&fsa_priv->fsa4480_notifier);
-		(struct rw_semaphore)__RWSEM_INITIALIZER
-		((fsa_priv->fsa4480_notifier).rwsem);
-	fsa_priv->fsa4480_notifier.head = NULL;
 
 	return 0;
 

drivers/soc/qcom/socinfo.c

@@ -338,6 +338,12 @@ static struct msm_soc_info cpu_of_id[] = {
 	/* Khaje ID */
 	[518] = {MSM_CPU_KHAJE, "KHAJE"},
 
+	/* Khajep ID */
+	[561] = {MSM_CPU_KHAJEP, "KHAJEP"},
+
+	/* Khajeq ID */
+	[562] = {MSM_CPU_KHAJEQ, "KHAJEQ"},
+
 	/* Lagoon ID */
 	[434] = {MSM_CPU_LAGOON, "LAGOON"},
 	[459] = {MSM_CPU_LAGOON, "LAGOON"},
@@ -1268,6 +1274,14 @@ static void * __init setup_dummy_socinfo(void)
 		dummy_socinfo.id = 518;
 		strlcpy(dummy_socinfo.build_id, "khaje - ",
 		sizeof(dummy_socinfo.build_id));
+	} else if (early_machine_is_khajep()) {
+		dummy_socinfo.id = 561;
+		strlcpy(dummy_socinfo.build_id, "khajep - ",
+		sizeof(dummy_socinfo.build_id));
+	} else if (early_machine_is_khajeq()) {
+		dummy_socinfo.id = 562;
+		strlcpy(dummy_socinfo.build_id, "khajeq - ",
+		sizeof(dummy_socinfo.build_id));
 	} else if (early_machine_is_bengalp()) {
 		dummy_socinfo.id = 445;
 		strlcpy(dummy_socinfo.build_id, "bengalp - ",

drivers/spi/spi-geni-qcom.c

@@ -751,12 +751,24 @@ static int spi_geni_prepare_message(struct spi_master *spi,
 
 	if (mas->shared_ee) {
 		if (mas->setup) {
+			/* Client to respect system suspend */
+			if (!pm_runtime_enabled(mas->dev)) {
+				GENI_SE_ERR(mas->ipc, false, NULL,
+					"%s: System suspended\n", __func__);
+				return -EACCES;
+			}
+
 			ret = pm_runtime_get_sync(mas->dev);
 			if (ret < 0) {
 				dev_err(mas->dev,
 					"%s:pm_runtime_get_sync failed %d\n",
 							__func__, ret);
+				WARN_ON_ONCE(1);
 				pm_runtime_put_noidle(mas->dev);
+				/* Set device in suspended since resume
+				 * failed
+				 */
+				pm_runtime_set_suspended(mas->dev);
 				goto exit_prepare_message;
 			}
 			ret = 0;
@@ -774,6 +786,25 @@ static int spi_geni_prepare_message(struct spi_master *spi,
 		}
 	}
 
+	if (pm_runtime_status_suspended(mas->dev)) {
+		if (!pm_runtime_enabled(mas->dev)) {
+			GENI_SE_ERR(mas->ipc, false, NULL,
+				"%s: System suspended\n", __func__);
+			return -EACCES;
+		}
+
+		ret = pm_runtime_get_sync(mas->dev);
+		if (ret < 0) {
+			dev_err(mas->dev,
+			"%s:pm_runtime_get_sync failed %d\n", __func__, ret);
+			WARN_ON_ONCE(1);
+			pm_runtime_put_noidle(mas->dev);
+			/* Set device in suspended since resume failed */
+			pm_runtime_set_suspended(mas->dev);
+			return ret;
+		}
+	}
+
 	mas->cur_xfer_mode = select_xfer_mode(spi, spi_msg);
 
 	if (mas->cur_xfer_mode < 0) {
@@ -813,7 +844,8 @@ static int spi_geni_unprepare_message(struct spi_master *spi_mas,
 				GENI_SE_ERR(mas->ipc, false, NULL,
 					"suspend usage count mismatch:%d",
 								count);
-		} else {
+		} else if (!pm_runtime_status_suspended(mas->dev) &&
+				pm_runtime_enabled(mas->dev)) {
 			pm_runtime_mark_last_busy(mas->dev);
 			pm_runtime_put_autosuspend(mas->dev);
 		}
@@ -882,6 +914,14 @@ static int spi_geni_prepare_transfer_hardware(struct spi_master *spi)
 
 	/* Adjust the IB based on the max speed of the slave.*/
 	rsc->ib = max_speed * DEFAULT_BUS_WIDTH;
+
+	/* Client to respect system suspend */
+	if (!pm_runtime_enabled(mas->dev)) {
+		GENI_SE_ERR(mas->ipc, false, NULL,
+			"%s: System suspended\n", __func__);
+		return -EACCES;
+	}
+
 	if (mas->gsi_mode && !mas->shared_ee) {
 		struct se_geni_rsc *rsc;
 		int ret = 0;
@@ -900,7 +940,10 @@ static int spi_geni_prepare_transfer_hardware(struct spi_master *spi)
 			dev_err(mas->dev,
 				"%s:pm_runtime_get_sync failed %d\n",
 							__func__, ret);
+			WARN_ON_ONCE(1);
 			pm_runtime_put_noidle(mas->dev);
+			/* Set device in suspended since resume failed */
+			pm_runtime_set_suspended(mas->dev);
 			goto exit_prepare_transfer_hardware;
 		}
 		ret = 0;
@@ -1057,7 +1100,8 @@ static int spi_geni_unprepare_transfer_hardware(struct spi_master *spi)
 		if (count < 0)
 			GENI_SE_ERR(mas->ipc, false, NULL,
 				"suspend usage count mismatch:%d", count);
-	} else {
+	} else if (!pm_runtime_status_suspended(mas->dev) &&
+			pm_runtime_enabled(mas->dev)) {
 		pm_runtime_mark_last_busy(mas->dev);
 		pm_runtime_put_autosuspend(mas->dev);
 	}
@@ -1288,6 +1332,17 @@ static int spi_geni_transfer_one(struct spi_master *spi,
 	GENI_SE_DBG(mas->ipc, false, mas->dev,
 			"current xfer_timeout:%lu ms.\n", xfer_timeout);
 
+	/* Double check PM status, client might have not taken wakelock and
+	 * continue to queue more transfers. Post auto-suspend, system suspend
+	 * can keep driver to forced suspend, hence it's client's responsibility
+	 * to not allow system suspend to trigger.
+	 */
+	if (pm_runtime_status_suspended(mas->dev)) {
+		GENI_SE_ERR(mas->ipc, true, mas->dev,
+			"%s: device is PM suspended\n", __func__);
+		return -EACCES;
+	}
+
 	if (mas->cur_xfer_mode != GSI_DMA) {
 		reinit_completion(&mas->xfer_done);
 		ret = setup_fifo_xfer(xfer, mas, slv->mode, spi);
@@ -1764,10 +1819,12 @@ static int spi_geni_probe(struct platform_device *pdev)
 		dev_err(&pdev->dev, "Failed to register SPI master\n");
 		goto spi_geni_probe_unmap;
 	}
+	dev_info(&pdev->dev, "%s: completed\n", __func__);
 	return ret;
 spi_geni_probe_unmap:
 	devm_iounmap(&pdev->dev, geni_mas->base);
 spi_geni_probe_err:
+	dev_info(&pdev->dev, "%s: ret:%d\n", __func__, ret);
 	spi_master_put(spi);
 	return ret;
 }
@@ -1791,6 +1848,8 @@ static int spi_geni_runtime_suspend(struct device *dev)
 	struct spi_master *spi = get_spi_master(dev);
 	struct spi_geni_master *geni_mas = spi_master_get_devdata(spi);
 
+	GENI_SE_DBG(geni_mas->ipc, false, NULL, "%s:\n", __func__);
+
 	if (geni_mas->shared_ee)
 		goto exit_rt_suspend;
 
@@ -1813,6 +1872,8 @@ static int spi_geni_runtime_resume(struct device *dev)
 	struct spi_master *spi = get_spi_master(dev);
 	struct spi_geni_master *geni_mas = spi_master_get_devdata(spi);
 
+	GENI_SE_DBG(geni_mas->ipc, false, NULL, "%s:\n", __func__);
+
 	if (geni_mas->shared_ee)
 		goto exit_rt_resume;
 
@@ -1837,27 +1898,17 @@ static int spi_geni_resume(struct device *dev)
 static int spi_geni_suspend(struct device *dev)
 {
 	int ret = 0;
+	struct spi_master *spi = get_spi_master(dev);
+	struct spi_geni_master *geni_mas = spi_master_get_devdata(spi);
 
 	if (!pm_runtime_status_suspended(dev)) {
-		struct spi_master *spi = get_spi_master(dev);
+		GENI_SE_ERR(geni_mas->ipc, true, dev,
-		struct spi_geni_master *geni_mas = spi_master_get_devdata(spi);
+			":%s: runtime PM is active\n", __func__);
-
+		ret = -EBUSY;
-		if (list_empty(&spi->queue) && !spi->cur_msg) {
+		return ret;
-			GENI_SE_ERR(geni_mas->ipc, true, dev,
-					"%s: Force suspend", __func__);
-			ret = spi_geni_runtime_suspend(dev);
-			if (ret) {
-				GENI_SE_ERR(geni_mas->ipc, true, dev,
-					"Force suspend Failed:%d", ret);
-			} else {
-				pm_runtime_disable(dev);
-				pm_runtime_set_suspended(dev);
-				pm_runtime_enable(dev);
-			}
-		} else {
-			ret = -EBUSY;
-		}
 	}
+
+	GENI_SE_ERR(geni_mas->ipc, true, dev, ":%s: End\n", __func__);
 	return ret;
 }
 #else

drivers/thermal/cpu_cooling.c

@@ -5,6 +5,7 @@
  *  Copyright (C) 2012  Amit Daniel <amit.kachhap@linaro.org>
  *
  *  Copyright (C) 2014  Viresh Kumar <viresh.kumar@linaro.org>
+ *  Copyright (c) 2022  Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  *  This program is free software; you can redistribute it and/or modify
@@ -364,7 +365,7 @@ static int cpufreq_set_min_state(struct thermal_cooling_device *cdev,
 	unsigned int floor_freq;
 
 	if (state > cpufreq_cdev->max_level)
-		state = cpufreq_cdev->max_level;
+		return -EINVAL;
 
 	if (cpufreq_cdev->cpufreq_floor_state == state)
 		return 0;

drivers/thermal/devfreq_cooling.c

@@ -3,6 +3,7 @@
  *                  devfreq
  *
  * Copyright (C) 2014-2015 ARM Limited
+ * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
@@ -140,14 +141,14 @@ static int devfreq_cooling_set_min_state(struct thermal_cooling_device *cdev,
 	struct device *dev = df->dev.parent;
 	int ret;
 
+	if (state >= dfc->freq_table_size)
+		return -EINVAL;
+
 	if (state == dfc->cooling_min_state)
 		return 0;
 
 	dev_dbg(dev, "Setting cooling min state %lu\n", state);
 
-	if (state >= dfc->freq_table_size)
-		state = dfc->freq_table_size - 1;
-
 	ret = partition_enable_opps(dfc, dfc->cooling_state, state);
 	if (ret)
 		return ret;

drivers/thermal/qcom/qmi_cooling.c

@@ -1,6 +1,7 @@
 // SPDX-License-Identifier: GPL-2.0-only
 /*
  * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
  */
 
 #define pr_fmt(fmt) "%s:%s " fmt, KBUILD_MODNAME, __func__
@@ -270,12 +271,12 @@ static int qmi_set_cur_state(struct thermal_cooling_device *cdev,
 	if (!qmi_cdev)
 		return -EINVAL;
 
-	if (qmi_cdev->type == QMI_CDEV_MIN_LIMIT_TYPE)
-		return 0;
-
 	if (state > qmi_cdev->max_level)
 		return -EINVAL;
 
+	if (qmi_cdev->type == QMI_CDEV_MIN_LIMIT_TYPE)
+		return 0;
+
 	return qmi_set_cur_or_min_state(qmi_cdev, state);
 }
 
@@ -287,12 +288,12 @@ static int qmi_set_min_state(struct thermal_cooling_device *cdev,
 	if (!qmi_cdev)
 		return -EINVAL;
 
+	if (state > qmi_cdev->max_level)
+		return -EINVAL;
+
 	if (qmi_cdev->type == QMI_CDEV_MAX_LIMIT_TYPE)
 		return 0;
 
-	if (state > qmi_cdev->max_level)
-		state = qmi_cdev->max_level;
-
 	/* Convert state into QMI client expects for min state */
 	state = qmi_cdev->max_level - state;
 

drivers/thermal/qcom/rpm_smd_cooling_device.c

@@ -1,6 +1,7 @@
 // SPDX-License-Identifier: GPL-2.0-only
 /*
  * Copyright (c) 2018, 2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
  */
 
 #define pr_fmt(fmt) "%s:%s " fmt, KBUILD_MODNAME, __func__
@@ -95,7 +96,7 @@ static int rpm_smd_set_cur_state(struct thermal_cooling_device *cdev,
 	int ret = 0;
 
 	if (state > (RPM_SMD_TEMP_MAX_NR - 1))
-		state = RPM_SMD_TEMP_MAX_NR - 1;
+		return -EINVAL;
 
 	ret = rpm_smd_send_request_to_rpm(rpm_smd_dev, (unsigned int)state);
 	if (ret)

drivers/usb/gadget/function/f_fs.c

@@ -1094,7 +1094,12 @@ static ssize_t ffs_epfile_io(struct file *file, struct ffs_io_data *io_data)
 			 */
 			spin_lock_irq(&epfile->ffs->eps_lock);
 			interrupted = true;
-			if (ep->ep) {
+			/*
+			 * While we were acquiring lock endpoint got
+			 * disabled (disconnect) or changed
+			 (composition switch) ?
+			 */
+			if (epfile->ep == ep) {
 				usb_ep_dequeue(ep->ep, req);
 				spin_unlock_irq(&epfile->ffs->eps_lock);
 				wait_for_completion(&done);
@@ -1114,7 +1119,12 @@ static ssize_t ffs_epfile_io(struct file *file, struct ffs_io_data *io_data)
 
 		ret = -ENODEV;
 		spin_lock_irq(&epfile->ffs->eps_lock);
-		if (ep->ep)
+		/*
+		 * While we were acquiring lock endpoint got
+		 * disabled (disconnect) or changed
+		 * (composition switch) ?
+		 */
+		if (epfile->ep == ep)
 			ret = ep->status;
 		spin_unlock_irq(&epfile->ffs->eps_lock);
 		if (io_data->read && ret > 0)
@@ -3792,6 +3802,7 @@ static void ffs_func_unbind(struct usb_configuration *c,
 		if (ep->ep && ep->req)
 			usb_ep_free_request(ep->ep, ep->req);
 		ep->req = NULL;
+		ep->ep = NULL;
 		++ep;
 	}
 	spin_unlock_irqrestore(&func->ffs->eps_lock, flags);

drivers/usb/gadget/function/u_audio.c

@@ -89,7 +89,12 @@ static void u_audio_iso_complete(struct usb_ep *ep, struct usb_request *req)
 	struct snd_uac_chip *uac = prm->uac;
 
 	/* i/f shutting down */
-	if (!prm->ep_enabled || req->status == -ESHUTDOWN)
+	if (!prm->ep_enabled) {
+		usb_ep_free_request(ep, req);
+		return;
+	}
+
+	if (req->status == -ESHUTDOWN)
 		return;
 
 	/*
@@ -344,24 +349,29 @@ static inline void free_ep(struct uac_rtd_params *prm, struct usb_ep *ep)
 	if (!prm->ep_enabled)
 		return;
 
-	prm->ep_enabled = false;
-
 	audio_dev = uac->audio_dev;
 	params = &audio_dev->params;
 
 	for (i = 0; i < params->req_number; i++) {
 		if (prm->ureq[i].req) {
-			usb_ep_dequeue(ep, prm->ureq[i].req);
+			if (usb_ep_dequeue(ep, prm->ureq[i].req))
-			usb_ep_free_request(ep, prm->ureq[i].req);
+				usb_ep_free_request(ep, prm->ureq[i].req);
+			/*
+			 * If usb_ep_dequeue() cannot successfully dequeue the
+			 * request, the request will be freed by the completion
+			 * callback.
+			 */
+
 			prm->ureq[i].req = NULL;
 		}
 	}
 
+	prm->ep_enabled = false;
+
 	if (usb_ep_disable(ep))
 		dev_err(uac->card->dev, "%s:%d Error!\n", __func__, __LINE__);
 }
 
-
 int u_audio_start_capture(struct g_audio *audio_dev)
 {
 	struct snd_uac_chip *uac = audio_dev->uac;

include/net/cfg80211.h

@@ -56,6 +56,8 @@
 #define CFG80211_REKEY_DATA_KEK_LEN 1
 /* Indicate backport support for 6GHz band */
 #define CFG80211_6GHZ_BAND_SUPPORTED 1
+/* Indicate backport support for OCV feature flag*/
+#define CFG80211_OCV_CONFIGURATION_SUPPORT 1
 
 /**
  * DOC: Introduction

include/soc/qcom/socinfo.h

@@ -64,6 +64,10 @@
 	of_flat_dt_is_compatible(of_get_flat_dt_root(), "qcom,bengalp")
 #define early_machine_is_khaje()	\
 	of_flat_dt_is_compatible(of_get_flat_dt_root(), "qcom,khaje")
+#define early_machine_is_khajep()	\
+	of_flat_dt_is_compatible(of_get_flat_dt_root(), "qcom,khajep")
+#define early_machine_is_khajeq()	\
+	of_flat_dt_is_compatible(of_get_flat_dt_root(), "qcom,khajeq")
 #define early_machine_is_lagoon()	\
 	of_flat_dt_is_compatible(of_get_flat_dt_root(), "qcom,lagoon")
 #define early_machine_is_scuba()	\
@@ -128,6 +132,8 @@
 #define early_machine_is_bengal()	0
 #define early_machine_is_bengalp()	0
 #define early_machine_is_khaje()	0
+#define early_machine_is_khajep()	0
+#define early_machine_is_khajeq()	0
 #define early_machine_is_lagoon()	0
 #define early_machine_is_scuba()	0
 #define early_machine_is_scubaiot()	0
@@ -176,6 +182,8 @@ enum msm_cpu {
 	MSM_CPU_BENGAL,
 	MSM_CPU_BENGALP,
 	MSM_CPU_KHAJE,
+	MSM_CPU_KHAJEP,
+	MSM_CPU_KHAJEQ,
 	MSM_CPU_LAGOON,
 	MSM_CPU_SCUBA,
 	MSM_CPU_SCUBAIOT,

include/uapi/linux/nl80211.h

@@ -5428,6 +5428,9 @@ enum nl80211_feature_flags {
  * @NL80211_EXT_FEATURE_BEACON_PROTECTION: The driver supports Beacon protection
  *	and can receive key configuration for BIGTK using key indexes 6 and 7.
  *
+ * @NL80211_EXT_FEATURE_OPERATING_CHANNEL_VALIDATION: Driver supports Operating
+ *	Channel Validation (OCV) when using driver's SME for RSNA handshakes.
+ *
  * @NUM_NL80211_EXT_FEATURES: number of extended features.
  * @MAX_NL80211_EXT_FEATURES: highest extended feature index.
  */
@@ -5474,6 +5477,14 @@ enum nl80211_ext_feature_index {
 	NL80211_EXT_FEATURE_VLAN_OFFLOAD,
 	NL80211_EXT_FEATURE_AQL,
 	NL80211_EXT_FEATURE_BEACON_PROTECTION,
+	NL80211_EXT_FEATURE_CONTROL_PORT_NO_PREAUTH,
+	NL80211_EXT_FEATURE_PROTECTED_TWT,
+	NL80211_EXT_FEATURE_DEL_IBSS_STA,
+	NL80211_EXT_FEATURE_MULTICAST_REGISTRATIONS,
+	NL80211_EXT_FEATURE_BEACON_PROTECTION_CLIENT,
+	NL80211_EXT_FEATURE_SCAN_FREQ_KHZ,
+	NL80211_EXT_FEATURE_CONTROL_PORT_OVER_NL80211_TX_STATUS,
+	NL80211_EXT_FEATURE_OPERATING_CHANNEL_VALIDATION,
 
 	/* add new features before the definition below */
 	NUM_NL80211_EXT_FEATURES,