dts: unify dvb dts definition

PD#163384: dts: unify dvb dts definition

Change-Id: I323c9200d2441aa8d40f4972612f9ecfbf0edc5b
Signed-off-by: Cheng Tong <cheng.tong@amlogic.com>

vout: optimize invalid mode management for init

PD#166032: vout: optimize invalid mode management for init

Change-Id: I16d36b1745faf0adf8316837d3df2d061ea94dda
Signed-off-by: Evoke Zhang <evoke.zhang@amlogic.com>

osd: fix dfbshow can't show picture

PD#165698: osd: fix dfbshow can't show picture

Change-Id: I0f13537391c98f106a5154d498ef46af90aa7690
Signed-off-by: pengcheng chen <pengcheng.chen@amlogic.com>

Merge branch 'android-4.9' into amlogic-4.9-dev

ldim: add db load support

PD#166311: lcd: add ldim db load support

Change-Id: I71c8a6d3b07daae63d19dec128da3c71a6031cba
Signed-off-by: Weiming Liu <weiming.liu@amlogic.com>

osd: support hw vsync [1/1]

PD#163001: osd: support hw vsync

Change-Id: I1e7f158b8cbc9434165745f77274ae353cfae342
Signed-off-by: shuze.ma <shuze.ma@amlogic.com>

IR: add S905X small IR remote on T962E

PD#165963: IR: add S905X small IR remote on T962E

Change-Id: I3d3bf0abaf30c0dc8d0ce925afeeefff6af27923
Signed-off-by: Gongwei Chen <gongwei.chen@amlogic.com>

mm: remove total summary of pagetypeinfo

PD#166462:

This caused vts VtsKernelProcFileApi on Android P failed.

Change-Id: I332c7ec324e7f87b0f8e0adeeef15cfd93f9b077
Signed-off-by: tao zeng <tao.zeng@amlogic.com>

atv_demod: Add atv afc [1/2]

PD#166320: Add atv afc.

Change-Id: I7b5d8d6290f1e394900b09a1147e7db5ec6fecf4
Signed-off-by: nengwen.chen <nengwen.chen@amlogic.com>

dts: update p230 dts for attach mode

PD#163384: dts: update p230 dts for attach mode

Change-Id: Iac83d28e31883f812c05f7fcd0342b0f4f225475
Signed-off-by: Cheng Tong <cheng.tong@amlogic.com>

vbi: fix vbi cc error

PD#161806: vbi: fix cc nosync and disappearance problem

Add interface to read real-time data what vbi-hw write to memory.

Change-Id: Ie36a9826ecf3320f7a1a366bac7a6a4f15e6f7d2
Signed-off-by: Xuhua Zhang <xuhua.zhang@amlogic.com>

arm64: dts: g12a: fine-tune U220 OPP

PD#165143: fine-tune U220 OPP for stability.

Change-Id: I84d543519c9053db0060ba3d090c4ecc9f233fa8
Signed-off-by: Hong Guo <hong.guo@amlogic.com>

reboot: make system reboot when panic occurs

PD#166529: reboot: make system reboot when panic occurs

CONFIG_PANIC_TIMEOUT=0 means no reboot when panic occurs,
This will make VTS stuck forever, fix this by making
the default reboot timeout as 5s.

Change-Id: Ib8888a4f87c6c178891d7e7fed2f186a6bfed119
Signed-off-by: Yixun Lan <yixun.lan@amlogic.com>

dts: add defendkey function for G12A

PD#164929: G12A need to support defendkey

add defendkey function in all G12A dts

Change-Id: Id269d4c14f2c2a6ad0674191aff353122a13d558
Signed-off-by: Zhongfu Luo <zhongfu.luo@amlogic.com>

ethernet: fix wol_error when test eye_pattern

PD#166642: add eye pattern function for 4.9

Change-Id: If57f74262589c02e12cbff3f01745c70a687da9e
Signed-off-by: Zhuo Wang <zhuo.wang@amlogic.com>

defendkey: support secure upgrade check

PD#164929: G12A need to support defendkey

Change-Id: I3c805c4dda03a39156fb91b53cc55ee8930f9e03
Signed-off-by: Zhongfu Luo <zhongfu.luo@amlogic.com>

wifi: enable cfg80211 testmode for qca6174

PD#166420: enable cfg80211 testmode for qca6174

Change-Id: I65f6fa499e02fdc48bc23f1e7541fd8e7fee4850
Signed-off-by: libo <bo.li@amlogic.com>

hdmitx: fix no display under frac_mode

PD#166241: hdmitx: fix no display under frac_mode

1.update pll parameters
2.4k60hz444/rgb8bit doesn't frac_mode

Change-Id: I45c8bade4cd8f83a7b4d36aadbdbbaa9dfca32f1
Signed-off-by: Yi Zhou <yi.zhou@amlogic.com>

backlight: ldim: add remap function restrictions by ldim_func [2/2]

PD#166583: backlight: ldim: add remap function restrictions by ldim_func
also optimize iw7027 driver

Change-Id: I2a863d17d3cef521b6d7af016f4c47e29ef5b44b
Signed-off-by: Evoke Zhang <evoke.zhang@amlogic.com>

vpp: fix the vskip overflow when playing interlace video

PD#164722: vpp: fix the vskip overflow when playing interlace video

Change-Id: Id65e8c58aedf35da4762280ae19cf933f08786f9
Signed-off-by: Brian Zhu <brian.zhu@amlogic.com>

spicc: g12a: spicc0 pins_c debug

PD#166556: spicc: g12a: spicc0 pins_c debug

Change-Id: I4f5f118410617cc3de8a1132100a1f7e21bc9f66
Signed-off-by: Sunny Luo <sunny.luo@amlogic.com>

u221: disable cvbsout [2/2]

PD#165555: u221: disable cvbsout
s905y2 don't support cvbsout

Change-Id: If29a9c6e9fa38cafcbcf6e75f942fb03b2cd5e1b
Signed-off-by: Evoke Zhang <evoke.zhang@amlogic.com>

hdr: add hlg support

PD#166567: hdr: add hlg support

Change-Id: I00acc352ce534485c8950f979704f96880811faa
Signed-off-by: MingLiang Dong <mingliang.dong@amlogic.com>

tsync: do not operate tsync_mode_switch before first video toggled.

PD#165355: do not operate tsync_mode_switch before first video toggled.
Some stream in tunnel mode, first audio pts is large than
AV_DISCONTINUE_THREDHOLD_MAX(60s). In audio_hw it will check pcr and
apts diff, so large difference between pcr and apts will lead sync mode
from amster to vmaster
[ 2414.316223@3] vdec_init, dev_name:ammvdec_vp9,
vdec_type=VDEC_TYPE_STREAM_PARSER
[ 2414.326361@3] vp9: ver (201602101,0) decinfo: 1920x1080 rate=4000
[ 2414.326827@3] mem_start_virt failed
[ 2414.330600@3] init_pic_list ok, used_buf_num = 12
[ 2414.336555@2] set pts unstable
[ 2414.338121@2] success set parent hevc_p1_composite rate to 666666666
[ 2414.356287@0]
A-discontinue,pcr=1500,vpts=0,apts=1500,diff_pts=16209420,lugsp_5ts6
207920
[ 2414.359685@0] discontinue-tsync_mode:A->Vvptatr:S->adji
ffies=204004utsize 12179
[ 2414.366696@0] debugcnt=0x10,diff_pts=16209420,tsync_mode=0

Change-Id: I7e33abb5e6c27169ecec86fb6e4df33de6bd80cf
Signed-off-by: shuanglong.wang <shuanglong.wang@amlogic.com>

avsync: av not sync problem cased by vp9 trig

PD#161895: av not sync problem cased by vp9 trig

1)vp9 initialization stream do not post VIDEO_START event,
so do not post VIDEO_STOP in unregister when not post
VIDEO_START which occured in vp9 tirg reset codec operation.
2)AV audio master adjust pcr according apts diff in
tsync tsync_set_apts need to reopen which was commented in
the begining tree of 4.9 codec
3)summit as Tim's patch

Change-Id: I9fb62aecb27f75d1ea9dff938452e0dd4f11b901
Signed-off-by: shuanglong.wang <shuanglong.wang@amlogic.com>

di: fix nr4 param sys interface crash

PD#166354: di: fix nr4 param sys interface crash

1) nr4 param array access violation

Change-Id: Ia79bd0ef8118715c6f1a94c5427c2c4b715f8bf8
Signed-off-by: kele bai <kele.bai@amlogic.com>

hdmirx: improve the snow noise issue during timing switching

PD#166184: hdmirx: improve the snow noise issue during timing switching

Change-Id: If143d418758f3b0d4895a7ecab87cebe98d8c457
Signed-off-by: Lei Yang <lei.yang@amlogic.com>

osd: add afbc arb reset which caused screen blank

PD#166248: osd: afbc arb reset which caused screen blank

Change-Id: I35035a40a50d5123394d527c60df2abb58e10b9a
Signed-off-by: pengcheng chen <pengcheng.chen@amlogic.com>

audio: codec: add suspend and resume for ad82584f

PD#165897: audio: codec: add suspend and resume for ad82584f

Change-Id: I5a98b4d19f4cc411ea2f94ab62bd323658fb1c25
Signed-off-by: Xing Wang <xing.wang@amlogic.com>

lcd: add retry flow to ensure power on state

PD#166330: mipi panel status is incorrect sometimes when lcd enable

Change-Id: Iace4963e576752208815d672befa4e215f860097
Signed-off-by: Evoke Zhang <evoke.zhang@amlogic.com>

lcd: premote a common lcd_extern_i2c_probe

PD#164139: lcd: premote a common lcd_extern_i2c_probe

premote a common lcd_extern_i2c_probe() function,
so it will be shared by various display controller IC

Change-Id: I47638520f32a0865829a1fd776c3a9ca626798ba
Signed-off-by: Weiming Liu <weiming.liu@amlogic.com>

amvecm: fix G12A eye protect function unused

PD#165151: amvecm: fix G12A eye protect function unused

1. G12A use post matrix as wb adjust module
2. fix 905x eye protect function bug

Change-Id: Ic161cafbb455cf278283d20ef9d93f18c07f5811
Signed-off-by: MingLiang Dong <mingliang.dong@amlogic.com>

usb: phy2: analog tuning for aml-phy

PD#164286: usb: phy2: analog tuning for aml-phy

Packet lost occures with high probability in High Speed mode, This patch
re-configurate PHY parameters for improving this issue.

Change-Id: If51d300a01d8c30dce27454ad887a0d14f2d1e52
Signed-off-by: Jianxin Qin <jianxin.qin@amlogic.com>

script: amlogic: add code scan script

PD#166377: script: amlogic: add code scan script

Add code scan script.

Usage: ./script/amlogic/code_scan.sh [path]

Examples:
# scan all code
./script/amlogic/code_scan.sh

# scan specified directory
./script/amlogic/code_scan.sh drivers/amlogic

scan result is in src code's parent directory, named coverity_html

Change-Id: I069cd99d08014cc50a3bf127e199690649e196c8
Signed-off-by: Ao Xu <ao.xu@amlogic.com>

hdmirx: fixed the pink screen issue when connect with roku box

PD#165686: hdmirx: fixed the pink screen issue when connect with roku box

Change-Id: Ia1723b9e88bcf7dd0773bc301301e682d35a9c5c
Signed-off-by: yicheng shen <yicheng.shen@amlogic.com>

cec: add err initiator int for cec error [2/3]

PD#163965: cec: add err initiator int for cec error

Change-Id: I7a10f4d6a90d2e3a15ec3ed969735aadb230db43
Signed-off-by: hongmin hua <hongmin.hua@amlogic.com>

hdmitx: update hdmi phsycial size during hotplug [1/1]

PD#163001: update hdmi phsycial size during hotplug

Change-Id: I71e863c56abbe5ae8dd151de481b1465317cebf1
Signed-off-by: shuze.ma <shuze.ma@amlogic.com>

arm64: dts: txlx: adjust the position of saradc node

PD#165196: arm64: dts: txlx: adjust the position of saradc node

In order to compatible with the saradc driver in uboot, the node
must be placed in the /{}.

Change-Id: I135a89866249b23b89f466699ecdb8cd7f21db82
Signed-off-by: Xingyu Chen <xingyu.chen@amlogic.com>

hdmirx: add new atmos edid handle method

PD#164867: hdmirx: add new atmos edid handle method

Change-Id: I03865be263d195b3b38bf782bd52b992e2084c71
Signed-off-by: yicheng shen <yicheng.shen@amlogic.com>

arm64: cpufeature: Pass capability structure to ->enable callback

PD#166068: arm64: cpufeature: Pass capability structure to ->enable callback

Fix CPU-hotplug fail to bringup issue once stopped CPU.

From: Will Deacon <will.deacon@arm.com>

commit 0a0d111d40fd1dc588cc590fab6b55d86ddc71d3 upstream.

In order to invoke the CPU capability ->matches callback from the ->enable
callback for applying local-CPU workarounds, we need a handle on the
capability structure.

This patch passes a pointer to the capability structure to the ->enable
callback.

Change-Id: I2c002dfbba4e923d0e44ab085ede46e6f47c9755
Reviewed-by: Suzuki K Poulose <suzuki.poulose@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Mark Rutland <mark.rutland@arm.com> [v4.9 backport]
Tested-by: Greg Hackmann <ghackmann@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Yixun Lan <yixun.lan@amlogic.com>

arm64: cpufeature: __this_cpu_has_cap() shouldn't stop early

PD#166068: arm64: cpufeature: __this_cpu_has_cap() shouldn't stop early

From: James Morse <james.morse@arm.com>

Fix CPU-hotplug fail to bringup issue once stopped CPU.

commit edf298cfce47ab7279d03b5203ae2ef3a58e49db upstream.

this_cpu_has_cap() tests caps->desc not caps->matches, so it stops
walking the list when it finds a 'silent' feature, instead of
walking to the end of the list.

Prior to v4.6's 644c2ae198412 ("arm64: cpufeature: Test 'matches' pointer
to find the end of the list") we always tested desc to find the end of
a capability list. This was changed for dubious things like PAN_NOT_UAO.
v4.7's e3661b128e53e ("arm64: Allow a capability to be checked on
single CPU") added this_cpu_has_cap() using the old desc style test.

Change-Id: I29788b05eb636de777de5d4f423097804d465a7b
CC: Suzuki K Poulose <suzuki.poulose@arm.com>
Reviewed-by: Suzuki K Poulose <suzuki.poulose@arm.com>
Acked-by: Marc Zyngier <marc.zyngier@arm.com>
Signed-off-by: James Morse <james.morse@arm.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Mark Rutland <mark.rutland@arm.com> [v4.9 backport]
Tested-by: Greg Hackmann <ghackmann@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Yixun Lan <yixun.lan@amlogic.com>

hdr: fix the bug that sdr can't switch to hdr for g12a

PD#166004: hdr: fix the bug that sdr can't switch to hdr for g12a

Change-Id: Ia7c14f86d63aa8b00617c47abad14e2eab96d2f6
Signed-off-by: Jihong Sui <jihong.sui@amlogic.com>

arm64: dts: g12a: add cpufreq 1.92G.

PD#165143: cpufreq: add cpufreq 1.92G.

Change-Id: I8b9dddf8c4c138bf4b5763f707c174ad48e8a53a
Signed-off-by: Hong Guo <hong.guo@amlogic.com>

audio: add 16K mic aux and 32bit feature

PD#164543: audio: 16K mic aux and 32bit support[2/2]

Change-Id: I7e19374cae45821c6189c60eff4b1e2d872ba4c6
Signed-off-by: bin pang <bin.pang@amlogic.com>

arm64: dts: g12a: add default drive strength for i2c controllers

PD#165715: arm64: dts: g12a: add default drive strength for i2c controllers

Change-Id: I4d909e25d08fa29ac6ebdf756af76bef86bf0bf6
Signed-off-by: Jian Hu <jian.hu@amlogic.com>

atv_demod: Add atv color and sound system setting separately [7/8]

PD#165560: Add atv color and sound system setting separately.

Change-Id: I8279143706ddfd705bce95c3f40f701ae9af7829
Signed-off-by: nengwen.chen <nengwen.chen@amlogic.com>

thermal: fix thermal issue

PD#166068: thermal: fix cpu cooldev work issue and gpupp not match

Change-Id: I26f4626b309cad984e59f3c2f30eb60f1ec5121b
Signed-off-by: Huan Biao <huan.biao@amlogic.com>

ethernet: bypass wol_reg12 check when 10M

PD#166287: 10M wol_reg12 error

Change-Id: I1b9bd412786509d2a4889c58ef634f6391b54e9e
Signed-off-by: Zhuo Wang <zhuo.wang@amlogic.com>

dtv_demod: modified dtv demod

PD#165971: dtv_demod: modified dtv demod

1. change folder name(amldemod ->dtv_demod);
2. set status 0 when not support;

Change-Id: I96c23b0b333ee0967d5013ebc8915fdffa097433
Signed-off-by: Jihong Sui <jihong.sui@amlogic.com>

Merge "audio: add audio spdif format kcontrol [1/2]" into amlogic-4.9-dev

vpp: fix the bypass pps condition for non-linear scaler

PD#164896: vpp: fix the bypass pps condition for non-linear scaler

Change-Id: Ie4e30499b6fe12253da52194d2b89002faf28bd2
Signed-off-by: Brian Zhu <brian.zhu@amlogic.com>

hdmirx: optimize for cases do hdcp1.4 interaction very early

PD#165229: hdmirx: optimize for cases do hdcp1.4 interaction very early

Change-Id: I8b07c2f1be524eed47bde77681c3724b110db618
Signed-off-by: Hang Cheng <hang.cheng@amlogic.com>

dts: g12 socket: change max freq

PD#164108: change max freq to 2G Hz

Change-Id: I6ccb051485ee2ff04ddb6558a63340cd52151464
Signed-off-by: Sandy Luo <sandy.luo@amlogic.com>

audio: add audio spdif format kcontrol [1/2]

PD#165552: add audio spdif format kcontrol

1) remove drc control for ground noise
2) fast attrack for volume
3) add spdif format kcontrol

Change-Id: I3b4574170d808dd7fe955d249e3414880285eb3e
Signed-off-by: Zhe Wang <Zhe.Wang@amlogic.com>

debug: drop sscanf, use kstrto variant instead

PD#165796: debug: drop sscanf, use kstrto variant instead

kstrto is kernel reconmmend function which is more safe than sscanf
this will also fix the following checkpatch.pl warning

WARNING: Prefer kstrto<type> to single variable sscanf
+       ret = sscanf(buf, "%ld", &val);

Change-Id: I9a4673b9aa43c10f51a20778ba520461ee0a7984
Signed-off-by: Yixun Lan <yixun.lan@amlogic.com>

hdmirx: fix deadlock issue

PD#164867: fix deadlock issue

Revert "hdmirx: add new atmos edid handle method"

This reverts commit 6bf27f9a5a1777fe965f0d381296f886085a3c87.

Change-Id: Ica0d99c9b4b3f05ccb86c85693c5cc4d2871bd7a
Signed-off-by: Lei Qian <lei.qian@amlogic.com>

cvbs: cvbs performance for g12a Rev.B

PD#164108: cvbs performance for g12a Rev.B

Change-Id: If140535984762cf6d843878e78ab285e014868e7
Signed-off-by: Nian Jing <nian.jing@amlogic.com>

ethernet: chage u200 buildroot default as internal phy

PD#163830: ethernet: chage u200 buildroot default as internal phy

Change-Id: I1be5bfddae6fc0c43e3da5f604a80cca36cfad6e
Signed-off-by: wenbiao zhang <wenbiao.zhang@amlogic.com>

dtv_demod: modify dtv demod to adapter tuner

PD#165971: dtv_demod: Modify atv demod to adapter tuner

1. add get_strength;
2. call release when switch to not-support format;
3. chang DVBT/DVBC from DVBFE_ALGO_SW to DVBFE_ALGO_HW;

Change-Id: I5d58542dd1dded1579e950ec36c395d6a01e6cd7
Signed-off-by: Jihong Sui <jihong.sui@amlogic.com>

i2c: fix i2c clock-frequency inaccurate in fast-mode

PD#165568: i2c: fix i2c clock-frequency in fast-mode

1.When i2c controller used in U-boot,may affect i2c
  controller in Kernel,should clear i2c registers.
2.Add i2c default clock-frequency for axg.
3.Add i2c clock-frequency debug sysfs, for i2c-0:
  /sys/class/i2c-adapter/i2c-0/device/speed
4.change clock high/low = 1:2 to 2:3

Change-Id: I44ca7ecd8e2e7aec978f3240ff837121ae478ba7
Signed-off-by: Jian Hu <jian.hu@amlogic.com>

vdin: fix atv nosignal after snowon

PD#164655: dynamic config clamp for signal stable

Change-Id: I29c42053d2014b2ba17ab62b9a670b82b0d3550e
Signed-off-by: Nian Jing <nian.jing@amlogic.com>

pwm: fix min and max duty cycle

PD#165774: pwm: fix min and max duty cycle

When the duty equal 0% and 100%, there is one high or low
count ,the constant bit should be enabled;and constant
bit should be disabled for other duty_cycle.

Change-Id: I36eefee3613f113f6c30db076e41cd8223086c54
Signed-off-by: Jian Hu <jian.hu@amlogic.com>

cpuidle: enable cpu idle

PD#163959: G12A: enable cpu idle

Change-Id: If5493f037f51092358b8f1c4151655aafec6e379
Signed-off-by: Shunzhou Jiang <shunzhou.jiang@amlogic.com>

audio: add an interface for HDMI out disable [1/2]

PD#165284: add an interface control for audio hdmi out disable

1)add a gpio control switch for ARCIN and SPDIFIN
2)clean global value in audio driver
3)rewrite HDMITX audio control interface
4)remove HDMITX user space control SYSFS
  Forbidden user space control of HDMITX audio, must via AUDIO

Change-Id: Ifc69c8553df903631d80f414771d91966045f85f
Signed-off-by: qi.yuan <qi.yuan@amlogic.com>
Signed-off-by: Zongdong Jiao <zongdong.jiao@amlogic.com>
Signed-off-by: Zhe Wang <Zhe.Wang@amlogic.com>

ir: fix ir memory overflow issue

PD#164774: kernel panic after mtk_cfg80211_set_power_mgmt

two possible overflow cases:
1. dev->debug_current + len == dev->debug_buffer_size
2. len > dev->debug_buffer_size

for the first case(currently triggered case)
  the last byte of string pointed to by fmt, aka.'\0', will
overwrite the first byte of memory pointed to by header(in
function __register_sysctl_table), which is just the LSB of
ipv4_table[]'s base address. Leading to "Unable to handle
kernel paging request at virtual address xxxx" panic

for the second case
  a bunch of memory pointed to by header(in function
__register_sysctl_table) will be overwritten

Change-Id: I6bc42308323b7ffb52fe4d1fa9d22742a31e8b1f
Signed-off-by: jiamin ma <jiamin.ma@amlogic.com>

workqueue: add more debug when null pwq

PD#158184: print work and worker function when null pwq

Change-Id: I552c6585935e47abfb9593f4a2d2f1588906aaf8
Signed-off-by: jianxin.pan <jianxin.pan@amlogic.com>

tvafe: reset vdin asynchronous fifo in tvafe reset

PD#165571: fix greenscreen on repeatly power on/off

Change-Id: Iefa412c2c4f86ba525bfdebbf395d38d34b77a30
Signed-off-by: Nian Jing <nian.jing@amlogic.com>

debug: add watchdog trigger in sysrq

PD#165796: watchdog trigger to debug wdt related behavior
"echo x > /proc/sysrq-trigger" to trigger watchdog

Change-Id: Iddd92cd64c9a7ccdf452f23706b396eaf50ae448
Signed-off-by: jianxin.pan <jianxin.pan@amlogic.com>

debug: hard lockup detect

PD#165796: detect dead lock in isr and dead lock with irq disabled

Change-Id: I0aace28fd29e5aeb8c514f6ab1700ac1248f836c
Signed-off-by: jianxin.pan <jianxin.pan@amlogic.com>

hdmitx: remove setting BT2020 in 4k color deptch mode

PD#162864: hdmitx: remove setting BT2020 in 4k color deptch mode

some TVs flash when changing colormetry
such as bt2020 to bt709, or bt709 to bt601

Change-Id: I360dfc1ea3299d4ec75903d435530425afb4f546
Signed-off-by: Yi Zhou <yi.zhou@amlogic.com>

hdmirx: add new atmos edid handle method

PD#164867: hdmirx: add new atmos edid handle method

Change-Id: I4f6fa58ebfe106cedb9f814c92657f08dc6d2aaf
Signed-off-by: yicheng shen <yicheng.shen@amlogic.com>

Merge 4.9.99 into android-4.9

Changes in 4.9.99
perf/core: Fix the perf_cpu_time_max_percent check
percpu: include linux/sched.h for cond_resched()
bpf: map_get_next_key to return first key on NULL
arm/arm64: KVM: Add PSCI version selection API
crypto: talitos - fix IPsec cipher in length
serial: imx: ensure UCR3 and UFCR are setup correctly
USB: serial: option: Add support for Quectel EP06
ALSA: pcm: Check PCM state at xfern compat ioctl
ALSA: seq: Fix races at MIDI encoding in snd_virmidi_output_trigger()
ALSA: aloop: Mark paused device as inactive
ALSA: aloop: Add missing cable lock to ctl API callbacks
tracepoint: Do not warn on ENOMEM
Input: leds - fix out of bound access
Input: atmel_mxt_ts - add touchpad button mapping for Samsung Chromebook Pro
xfs: prevent creating negative-sized file via INSERT_RANGE
RDMA/cxgb4: release hw resources on device removal
RDMA/ucma: Allow resolving address w/o specifying source address
RDMA/mlx5: Protect from shift operand overflow
NET: usb: qmi_wwan: add support for ublox R410M PID 0x90b2
IB/mlx5: Use unlimited rate when static rate is not supported
IB/hfi1: Fix NULL pointer dereference when invalid num_vls is used
drm/vmwgfx: Fix a buffer object leak
drm/bridge: vga-dac: Fix edid memory leak
test_firmware: fix setting old custom fw path back on exit, second try
USB: serial: visor: handle potential invalid device configuration
USB: Accept bulk endpoints with 1024-byte maxpacket
USB: serial: option: reimplement interface masking
USB: serial: option: adding support for ublox R410M
usb: musb: host: fix potential NULL pointer dereference
usb: musb: trace: fix NULL pointer dereference in musb_g_tx()
platform/x86: asus-wireless: Fix NULL pointer dereference
s390/facilites: use stfle_fac_list array size for MAX_FACILITY_BIT
Linux 4.9.99

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>

Linux 4.9.99

s390/facilites: use stfle_fac_list array size for MAX_FACILITY_BIT

commit 6f5165e864d240d15675cc2fb5a369d57e1f60d0 upstream.

Use the actual size of the facility list array within the lowcore
structure for the MAX_FACILITY_BIT define instead of a comment which
states what this is good for. This makes it a bit harder to break
things.

Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

platform/x86: asus-wireless: Fix NULL pointer dereference

commit 9f0a93de9139c2b0a59299cd36b61564522458f8 upstream.

When the module is removed the led workqueue is destroyed in the remove
callback, before the led device is unregistered from the led subsystem.

This leads to a NULL pointer derefence when the led device is
unregistered automatically later as part of the module removal cleanup.
Bellow is the backtrace showing the problem.

  BUG: unable to handle kernel NULL pointer dereference at           (null)
  IP: __queue_work+0x8c/0x410
  PGD 0 P4D 0
  Oops: 0000 [#1] SMP NOPTI
  Modules linked in: ccm edac_mce_amd kvm_amd kvm irqbypass crct10dif_pclmul crc32_pclmul ghash_clmulni_intel pcbc aesni_intel aes_x86_64 joydev crypto_simd asus_nb_wmi glue_helper uvcvideo snd_hda_codec_conexant snd_hda_codec_generic snd_hda_codec_hdmi snd_hda_intel asus_wmi snd_hda_codec cryptd snd_hda_core sparse_keymap videobuf2_vmalloc arc4 videobuf2_memops snd_hwdep input_leds videobuf2_v4l2 ath9k psmouse videobuf2_core videodev ath9k_common snd_pcm ath9k_hw media fam15h_power ath k10temp snd_timer mac80211 i2c_piix4 r8169 mii mac_hid cfg80211 asus_wireless(-) snd soundcore wmi shpchp 8250_dw ip_tables x_tables amdkfd amd_iommu_v2 amdgpu radeon chash i2c_algo_bit drm_kms_helper syscopyarea serio_raw sysfillrect sysimgblt fb_sys_fops ahci ttm libahci drm video
  CPU: 3 PID: 2177 Comm: rmmod Not tainted 4.15.0-5-generic #6+dev94.b4287e5bem1-Endless
  Hardware name: ASUSTeK COMPUTER INC. X555DG/X555DG, BIOS 5.011 05/05/2015
  RIP: 0010:__queue_work+0x8c/0x410
  RSP: 0018:ffffbe8cc249fcd8 EFLAGS: 00010086
  RAX: ffff992ac6810800 RBX: 0000000000000000 RCX: 0000000000000008
  RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff992ac6400e18
  RBP: ffffbe8cc249fd18 R08: ffff992ac6400db0 R09: 0000000000000000
  R10: 0000000000000040 R11: ffff992ac6400dd8 R12: 0000000000002000
  R13: ffff992abd762e00 R14: ffff992abd763e38 R15: 000000000001ebe0
  FS:  00007f318203e700(0000) GS:ffff992aced80000(0000) knlGS:0000000000000000
  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
  CR2: 0000000000000000 CR3: 00000001c720e000 CR4: 00000000001406e0
  Call Trace:
   queue_work_on+0x38/0x40
   led_state_set+0x2c/0x40 [asus_wireless]
   led_set_brightness_nopm+0x14/0x40
   led_set_brightness+0x37/0x60
   led_trigger_set+0xfc/0x1d0
   led_classdev_unregister+0x32/0xd0
   devm_led_classdev_release+0x11/0x20
   release_nodes+0x109/0x1f0
   devres_release_all+0x3c/0x50
   device_release_driver_internal+0x16d/0x220
   driver_detach+0x3f/0x80
   bus_remove_driver+0x55/0xd0
   driver_unregister+0x2c/0x40
   acpi_bus_unregister_driver+0x15/0x20
   asus_wireless_driver_exit+0x10/0xb7c [asus_wireless]
   SyS_delete_module+0x1da/0x2b0
   entry_SYSCALL_64_fastpath+0x24/0x87
  RIP: 0033:0x7f3181b65fd7
  RSP: 002b:00007ffe74bcbe18 EFLAGS: 00000206 ORIG_RAX: 00000000000000b0
  RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f3181b65fd7
  RDX: 000000000000000a RSI: 0000000000000800 RDI: 0000555ea2559258
  RBP: 0000555ea25591f0 R08: 00007ffe74bcad91 R09: 000000000000000a
  R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000003
  R13: 00007ffe74bcae00 R14: 0000000000000000 R15: 0000555ea25591f0
  Code: 01 00 00 02 0f 85 7d 01 00 00 48 63 45 d4 48 c7 c6 00 f4 fa 87 49 8b 9d 08 01 00 00 48 03 1c c6 4c 89 f7 e8 87 fb ff ff 48 85 c0 <48> 8b 3b 0f 84 c5 01 00 00 48 39 f8 0f 84 bc 01 00 00 48 89 c7
  RIP: __queue_work+0x8c/0x410 RSP: ffffbe8cc249fcd8
  CR2: 0000000000000000
  ---[ end trace 7aa4f4a232e9c39c ]---

Unregistering the led device on the remove callback before destroying the
workqueue avoids this problem.

https://bugzilla.kernel.org/show_bug.cgi?id=196097

Reported-by: Dun Hum <bitter.taste@gmx.com>
Cc: stable@vger.kernel.org
Signed-off-by: João Paulo Rechi Vita <jprvita@endlessm.com>
Signed-off-by: Darren Hart (VMware) <dvhart@infradead.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

usb: musb: trace: fix NULL pointer dereference in musb_g_tx()

commit 9aea9b6cc78d2b99b23d84fb2e0bc6e464c6569e upstream.

The usb_request pointer could be NULL in musb_g_tx(), where the
tracepoint call would trigger the NULL pointer dereference failure when
parsing the members of the usb_request pointer.

Move the tracepoint call to where the usb_request pointer is already
checked to solve the issue.

Fixes: fc78003e5345 ("usb: musb: gadget: add usb-request tracepoints")
Cc: stable@vger.kernel.org # v4.8+
Signed-off-by: Bin Liu <b-liu@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

usb: musb: host: fix potential NULL pointer dereference

commit 2b63f1329df2cd814c1f8353fae4853ace6521d1 upstream.

musb_start_urb() doesn't check the pass-in parameter if it is NULL.  But
in musb_bulk_nak_timeout() the parameter passed to musb_start_urb() is
returned from first_qh(), which could be NULL.

So wrap the musb_start_urb() call here with a if condition check to
avoid the potential NULL pointer dereference.

Fixes: f283862f3b5c ("usb: musb: NAK timeout scheme on bulk TX endpoint")
Cc: stable@vger.kernel.org # v3.7+
Signed-off-by: Bin Liu <b-liu@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

USB: serial: option: adding support for ublox R410M

commit 4205cb01f6e9ef2ae6daa7be4e8ac1edeb4c9d64 upstream.

This patch adds support for ublox R410M PID 0x90b2 USB modem to option
driver, this module supports LTE Cat M1 / NB1.

Interface layout:
0: QCDM/DIAG
1: ADB
2: AT
3: RMNET

Signed-off-by: SZ Lin (林上智) <sz.lin@moxa.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

USB: serial: option: reimplement interface masking

commit c3a65808f04a8426481b63a4fbd9392f009f6330 upstream.

Reimplement interface masking using device flags stored directly in the
device-id table. This will make it easier to add and maintain device-id
entries by using a more compact and readable notation compared to the
current implementation (which manages pairs of masks in separate
blacklist structs).

Two convenience macros are used to flag an interface as either reserved
or as not supporting modem-control requests:

{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910_DUAL_MODEM),
  .driver_info = NCTRL(0) | RSVD(3) },

For now, we limit the highest maskable interface number to seven, which
allows for (up to 16) additional device flags to be added later should
need arise.

Note that this will likely need to be backported to stable in order to
make future device-id backports more manageable.

Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

USB: Accept bulk endpoints with 1024-byte maxpacket

commit fb5ee84ea72c5f1b6cabdd1c9d6e8648995ca7c6 upstream.

Some non-compliant high-speed USB devices have bulk endpoints with a
1024-byte maxpacket size.  Although such endpoints don't work with
xHCI host controllers, they do work with EHCI controllers.  We used to
accept these invalid sizes (with a warning), but we no longer do
because of an unintentional change introduced by commit aed9d65ac327
("USB: validate wMaxPacketValue entries in endpoint descriptors").

This patch restores the old behavior, so that people with these
peculiar devices can use them without patching their kernels by hand.

Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Suggested-by: Elvinas <elvinas@veikia.lt>
Fixes: aed9d65ac327 ("USB: validate wMaxPacketValue entries in endpoint descriptors")
CC: <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

USB: serial: visor: handle potential invalid device configuration

commit 4842ed5bfcb9daf6660537d70503c18d38dbdbb8 upstream.

If we get an invalid device configuration from a palm 3 type device, we
might incorrectly parse things, and we have the potential to crash in
"interesting" ways.

Fix this up by verifying the size of the configuration passed to us by
the device, and only if it is correct, will we handle it.

Note that this also fixes an information leak of slab data.

Reported-by: Andrey Konovalov <andreyknvl@google.com>
Reviewed-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[ johan: add comment about the info leak ]
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

test_firmware: fix setting old custom fw path back on exit, second try

commit e538409257d0217a9bc715686100a5328db75a15 upstream.

Commit 65c79230576 tried to clear the custom firmware path on exit by
writing a single space to the firmware_class.path parameter.  This
doesn't work because nothing strips this space from the value stored
and fw_get_filesystem_firmware() only ignores zero-length paths.

Instead, write a null byte.

Fixes: 0a8adf58475 ("test: add firmware_class loader test")
Fixes: 65c79230576 ("test_firmware: fix setting old custom fw path back on exit")
Signed-off-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
Acked-by: Luis R. Rodriguez <mcgrof@kernel.org>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

drm/bridge: vga-dac: Fix edid memory leak

commit 49ceda9de2da4d1827941d06701f3017c27c1855 upstream.

edid should be freed once it's finished being used.

Fixes: 56fe8b6f4991 ("drm/bridge: Add RGB to VGA bridge support")
Cc: Rob Herring <robh@kernel.org>
Cc: Sean Paul <seanpaul@chromium.org>
Cc: Maxime Ripard <maxime.ripard@free-electrons.com>
Cc: Archit Taneja <architt@codeaurora.org>
Cc: Andrzej Hajda <a.hajda@samsung.com>
Cc: Laurent Pinchart <Laurent.pinchart@ideasonboard.com>
Cc: <stable@vger.kernel.org> # v4.9+
Reviewed-by: Maxime Ripard <maxime.ripard@bootlin.com>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Sean Paul <seanpaul@chromium.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20180420190007.1572-1-seanpaul@chromium.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

drm/vmwgfx: Fix a buffer object leak

commit 13f149d47392782baafd96d54d4e65f3b5ca342f upstream.

A buffer object leak was introduced when fixing a premature buffer
object release. Fix this.

Cc: <stable@vger.kernel.org>
Fixes: 73a88250b709 ("Fix a destoy-while-held mutex problem.")
Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com>
Reviewed-by: Deepak Rawat <drawat@vmware.com>
Reviewed-by: Sinclair Yeh <syeh@vmware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

IB/hfi1: Fix NULL pointer dereference when invalid num_vls is used

commit 45d924571a5e1329580811f2419da61b07ac3613 upstream.

When an invalid num_vls is used as a module parameter, the code
execution follows an exception path where the macro dd_dev_err()
expects dd->pcidev->dev not to be NULL in hfi1_init_dd(). This
causes a NULL pointer dereference.

Fix hfi1_init_dd() by initializing dd->pcidev and dd->pcidev->dev
earlier in the code. If a dd exists, then dd->pcidev and
dd->pcidev->dev always exists.

BUG: unable to handle kernel NULL pointer dereference
at 00000000000000f0
IP: __dev_printk+0x15/0x90
Workqueue: events work_for_cpu_fn
RIP: 0010:__dev_printk+0x15/0x90
Call Trace:
 dev_err+0x6c/0x90
 ? hfi1_init_pportdata+0x38d/0x3f0 [hfi1]
 hfi1_init_dd+0xdd/0x2530 [hfi1]
 ? pci_conf1_read+0xb2/0xf0
 ? pci_read_config_word.part.9+0x64/0x80
 ? pci_conf1_write+0xb0/0xf0
 ? pcie_capability_clear_and_set_word+0x57/0x80
 init_one+0x141/0x490 [hfi1]
 local_pci_probe+0x3f/0xa0
 work_for_cpu_fn+0x10/0x20
 process_one_work+0x152/0x350
 worker_thread+0x1cf/0x3e0
 kthread+0xf5/0x130
 ? max_active_store+0x80/0x80
 ? kthread_bind+0x10/0x10
 ? do_syscall_64+0x6e/0x1a0
 ? SyS_exit_group+0x10/0x10
 ret_from_fork+0x35/0x40

Cc: <stable@vger.kernel.org> # 4.9.x
Reviewed-by: Mike Marciniszyn <mike.marciniszyn@intel.com>
Reviewed-by: Michael J. Ruhl <michael.j.ruhl@intel.com>
Signed-off-by: Sebastian Sanchez <sebastian.sanchez@intel.com>
Signed-off-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

IB/mlx5: Use unlimited rate when static rate is not supported

commit 4f32ac2e452c2180cd2df581cbadac183e27ecd0 upstream.

Before the change, if the user passed a static rate value different
than zero and the FW doesn't support static rate,
it would end up configuring rate of 2.5 GBps.

Fix this by using rate 0; unlimited, in cases where FW
doesn't support static rate configuration.

Cc: <stable@vger.kernel.org> # 3.10
Fixes: e126ba97dba9 ("mlx5: Add driver for Mellanox Connect-IB adapters")
Reviewed-by: Majd Dibbiny <majd@mellanox.com>
Signed-off-by: Danit Goldberg <danitg@mellanox.com>
Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

NET: usb: qmi_wwan: add support for ublox R410M PID 0x90b2

commit 9306b38e42cb266f98bff6f6f4c1c652aa79ba45 upstream.

This patch adds support for PID 0x90b2 of ublox R410M.

qmicli -d /dev/cdc-wdm0 --dms-get-manufacturer
[/dev/cdc-wdm0] Device manufacturer retrieved:
        Manufacturer: 'u-blox'

qmicli -d /dev/cdc-wdm0 --dms-get-model
[/dev/cdc-wdm0] Device model retrieved:
        Model: 'SARA-R410M-02B'

Signed-off-by: SZ Lin (林上智) <sz.lin@moxa.com>
Cc: stable <stable@vger.kernel.org>
Acked-by: Bjørn Mork <bjorn@mork.no>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

RDMA/mlx5: Protect from shift operand overflow

commit 002bf2282b2d7318e444dca9ffcb994afc5d5f15 upstream.

Ensure that user didn't supply values too large that can cause overflow.

UBSAN: Undefined behaviour in drivers/infiniband/hw/mlx5/qp.c:263:23
shift exponent -2147483648 is negative
CPU: 0 PID: 292 Comm: syzkaller612609 Not tainted 4.16.0-rc1+ #131
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.11.0-0-g63451fca13-prebuilt.qemu-project.org 04/01/2014 Call
Trace:
dump_stack+0xde/0x164
ubsan_epilogue+0xe/0x81
set_rq_size+0x7c2/0xa90
create_qp_common+0xc18/0x43c0
mlx5_ib_create_qp+0x379/0x1ca0
create_qp.isra.5+0xc94/0x2260
ib_uverbs_create_qp+0x21b/0x2a0
ib_uverbs_write+0xc2c/0x1010
vfs_write+0x1b0/0x550
SyS_write+0xc7/0x1a0
do_syscall_64+0x1aa/0x740
entry_SYSCALL_64_after_hwframe+0x26/0x9b
RIP: 0033:0x433569
RSP: 002b:00007ffc6e62f448 EFLAGS: 00000217 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00000000004002f8 RCX: 0000000000433569
RDX: 0000000000000070 RSI: 00000000200042c0 RDI: 0000000000000003
RBP: 00000000006d5018 R08: 00000000004002f8 R09: 00000000004002f8
R10: 00000000004002f8 R11: 0000000000000217 R12: 0000000000000000
R13: 000000000040c9f0 R14: 000000000040ca80 R15: 0000000000000006

Cc: <stable@vger.kernel.org> # 3.10
Fixes: e126ba97dba9 ("mlx5: Add driver for Mellanox Connect-IB adapters")
Cc: syzkaller <syzkaller@googlegroups.com>
Reported-by: Noa Osherovich <noaos@mellanox.com>
Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

RDMA/ucma: Allow resolving address w/o specifying source address

commit 09abfe7b5b2f442a85f4c4d59ecf582ad76088d7 upstream.

The RDMA CM will select a source device and address by consulting
the routing table if no source address is passed into
rdma_resolve_address().  Userspace will ask for this by passing an
all-zero source address in the RESOLVE_IP command.  Unfortunately
the new check for non-zero address size rejects this with EINVAL,
which breaks valid userspace applications.

Fix this by explicitly allowing a zero address family for the source.

Fixes: 2975d5de6428 ("RDMA/ucma: Check AF family prior resolving address")
Cc: <stable@vger.kernel.org>
Signed-off-by: Roland Dreier <roland@purestorage.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

RDMA/cxgb4: release hw resources on device removal

commit 26bff1bd74a4f7417509a83295614e9dab995b2a upstream.

The c4iw_rdev_close() logic was not releasing all the hw
resources (PBL and RQT memory) during the device removal
event (driver unload / system reboot). This can cause panic
in gen_pool_destroy().

The module remove function will wait for all the hw
resources to be released during the device removal event.

Fixes c12a67fe(iw_cxgb4: free EQ queue memory on last deref)
Signed-off-by: Raju Rangoju <rajur@chelsio.com>
Reviewed-by: Steve Wise <swise@opengridcomputing.com>
Cc: stable@vger.kernel.org
Signed-off-by: Doug Ledford <dledford@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

xfs: prevent creating negative-sized file via INSERT_RANGE

commit 7d83fb14258b9961920cd86f0b921caaeb3ebe85 upstream.

During the "insert range" fallocate operation, i_size grows by the
specified 'len' bytes.  XFS verifies that i_size + len < s_maxbytes, as
it should.  But this comparison is done using the signed 'loff_t', and
'i_size + len' can wrap around to a negative value, causing the check to
incorrectly pass, resulting in an inode with "negative" i_size.  This is
possible on 64-bit platforms, where XFS sets s_maxbytes = LLONG_MAX.
ext4 and f2fs don't run into this because they set a smaller s_maxbytes.

Fix it by using subtraction instead.

Reproducer:
    xfs_io -f file -c "truncate $(((1<<63)-1))" -c "finsert 0 4096"

Fixes: a904b1ca5751 ("xfs: Add support FALLOC_FL_INSERT_RANGE for fallocate")
Cc: <stable@vger.kernel.org> # v4.1+
Originally-From: Eric Biggers <ebiggers@google.com>
Signed-off-by: Eric Biggers <ebiggers@google.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
[darrick: fix signed integer addition overflow too]
Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Input: atmel_mxt_ts - add touchpad button mapping for Samsung Chromebook Pro

commit f372b81101e6895252298e563d634d5e44ae81e7 upstream.

This patch adds the correct platform data information for the Caroline
Chromebook, so that the mouse button does not get stuck in pressed state
after the first click.

The Samus button keymap and platform data definition are the correct
ones for Caroline, so they have been reused here.

Signed-off-by: Vittorio Gambaletta <linuxbugs@vittgam.net>
Signed-off-by: Salvatore Bellizzi <lkml@seppia.net>
Tested-by: Guenter Roeck <groeck@chromium.org>
Cc: stable@vger.kernel.org
[dtor: adjusted vendor spelling to match shipping firmware]
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Input: leds - fix out of bound access

commit 6bd6ae639683c0b41f46990d5c64ff9fbfa019dc upstream.

UI_SET_LEDBIT ioctl() causes the following KASAN splat when used with
led > LED_CHARGING:

[ 1274.663418] BUG: KASAN: slab-out-of-bounds in input_leds_connect+0x611/0x730 [input_leds]
[ 1274.663426] Write of size 8 at addr ffff88003377b2c0 by task ckb-next-daemon/5128

This happens because we were writing to the led structure before making
sure that it exists.

Reported-by: Tasos Sahanidis <tasos@tasossah.com>
Tested-by: Tasos Sahanidis <tasos@tasossah.com>
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

tracepoint: Do not warn on ENOMEM

commit d66a270be3310d7aa132fec0cea77d3d32a0ff75 upstream.

Tracepoint should only warn when a kernel API user does not respect the
required preconditions (e.g. same tracepoint enabled twice, or called
to remove a tracepoint that does not exist).

Silence warning in out-of-memory conditions, given that the error is
returned to the caller.

This ensures that out-of-memory error-injection testing does not trigger
warnings in tracepoint.c, which were seen by syzbot.

Link: https://lkml.kernel.org/r/001a114465e241a8720567419a72@google.com
Link: https://lkml.kernel.org/r/001a1140e0de15fc910567464190@google.com
Link: http://lkml.kernel.org/r/20180315124424.32319-1-mathieu.desnoyers@efficios.com
CC: Peter Zijlstra <peterz@infradead.org>
CC: Jiri Olsa <jolsa@redhat.com>
CC: Arnaldo Carvalho de Melo <acme@kernel.org>
CC: Alexander Shishkin <alexander.shishkin@linux.intel.com>
CC: Namhyung Kim <namhyung@kernel.org>
CC: stable@vger.kernel.org
Fixes: de7b2973903c6 ("tracepoint: Use struct pointer instead of name hash for reg/unreg tracepoints")
Reported-by: syzbot+9c0d616860575a73166a@syzkaller.appspotmail.com
Reported-by: syzbot+4e9ae7fa46233396f64d@syzkaller.appspotmail.com
Signed-off-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

ALSA: aloop: Add missing cable lock to ctl API callbacks

commit 76b3421b39bd610546931fc923edcf90c18fa395 upstream.

Some control API callbacks in aloop driver are too lazy to take the
loopback->cable_lock and it results in possible races of cable access
while it's being freed.  It eventually lead to a UAF, as reported by
fuzzer recently.

This patch covers such control API callbacks and add the proper mutex
locks.

Reported-by: DaeRyong Jeong <threeearcat@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

ALSA: aloop: Mark paused device as inactive

commit 306a4f3ca7f3c7dfa473ebd19d66e40e59d99734 upstream.

Show paused ALSA aloop device as inactive, i.e. the control
"PCM Slave Active" set as false. Notification sent upon state change.

This makes it possible for client capturing from aloop device to know if
data is expected. Without it the client expects data even if playback
is paused.

Signed-off-by: Robert Rosengren <robert.rosengren@axis.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

ALSA: seq: Fix races at MIDI encoding in snd_virmidi_output_trigger()

commit 8f22e52528cc372b218b5f100457469615c733ce upstream.

The sequencer virmidi code has an open race at its output trigger
callback: namely, virmidi keeps only one event packet for processing
while it doesn't protect for concurrent output trigger calls.

snd_virmidi_output_trigger() tries to process the previously
unfinished event before starting encoding the given MIDI stream, but
this is done without any lock.  Meanwhile, if another rawmidi stream
starts the output trigger, this proceeds further, and overwrites the
event package that is being processed in another thread.  This
eventually corrupts and may lead to the invalid memory access if the
event type is like SYSEX.

The fix is just to move the spinlock to cover both the pending event
and the new stream.

The bug was spotted by a new fuzzer, RaceFuzzer.

BugLink: http://lkml.kernel.org/r/20180426045223.GA15307@dragonet.kaist.ac.kr
Reported-by: DaeRyong Jeong <threeearcat@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

ALSA: pcm: Check PCM state at xfern compat ioctl

commit f13876e2c33a657a71bcbb10f767c0951b165020 upstream.

Since snd_pcm_ioctl_xfern_compat() has no PCM state check, it may go
further and hit the sanity check pcm_sanity_check() when the ioctl is
called right after open.  It may eventually spew a kernel warning, as
triggered by syzbot, depending on kconfig.

The lack of PCM state check there was just an oversight.  Although
it's no real crash, the spurious kernel warning is annoying, so let's
add the proper check.

Reported-by: syzbot+1dac3a4f6bc9c1c675d4@syzkaller.appspotmail.com
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

USB: serial: option: Add support for Quectel EP06

commit 71a0483d56e784b1e11f38f10d7e22d265dbe244 upstream.

The Quectel EP06 is a Cat. 6 LTE modem, and the interface mapping is as
follows:

0: Diag
1: NMEA
2: AT
3: Modem

Interface 4 is QMI and interface 5 is ADB, so they are blacklisted.

This patch should also be considered for -stable. The QMI-patch for this
modem is already in the -stable-queue.

v1->v2:
* Updated commit prefix (thanks Johan Hovold)
* Updated commit message slightly.

Signed-off-by: Kristian Evensen <kristian.evensen@gmail.com>
Acked-by: Johan Hovold <johan@kernel.org>
Cc: Bjørn Mork <bjorn@mork.no>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

serial: imx: ensure UCR3 and UFCR are setup correctly

commit 6df765dca378bddf994cfd2044acafa501bd800f upstream.

Commit e61c38d85b73 ("serial: imx: setup DCEDTE early and ensure DCD and
RI irqs to be off") has a flaw: While UCR3 and UFCR were modified using
read-modify-write before it switched to write register values
independent of the previous state. That's a good idea in principle (and
that's why I did it) but needs more care.

This patch reinstates read-modify-write for UFCR and for UCR3 ensures
that RXDMUXSEL and ADNIMP are set for post imx1.

Fixes: e61c38d85b73 ("serial: imx: setup DCEDTE early and ensure DCD and RI irqs to be off")
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Acked-by: Mika Penttilä <mika.penttila@nextfour.com>
Tested-by: Mika Penttilä <mika.penttila@nextfour.com>
Acked-by: Steve Twiss <stwiss.opensource@diasemi.com>
Tested-by: Steve Twiss <stwiss.opensource@diasemi.com>
Cc: Chris Ruehl <chris.ruehl@gtsys.com.hk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>