Commit Graph

1039 Commits

Author SHA1 Message Date
Blagovest Kolenichev
6c02278dca Merge android-4.9.91 (bb94f9d) into msm-4.9
* refs/heads/tmp-bb94f9d:
  UPSTREAM: net: hns: Fix a skb used after free bug
  Linux 4.9.91
  bpf, x64: increase number of passes
  bpf: skip unnecessary capability check
  kbuild: disable clang's default use of -fmerge-all-constants
  selftests: x86: sysret_ss_attrs doesn't build on a PIE build
  x86/pkeys/selftests: Rename 'si_pkey' to 'siginfo_pkey'
  signal/testing: Don't look for __SI_FAULT in userspace
  selftests/x86/protection_keys: Fix syscall NR redefinition warnings
  selftests, x86, protection_keys: fix wrong offset in siginfo
  staging: lustre: ptlrpc: kfree used instead of kvfree
  iio: ABI: Fix name of timestamp sysfs file
  perf/x86/intel/uncore: Fix multi-domain PCI CHA enumeration bug on Skylake servers
  perf/x86/intel: Don't accidentally clear high bits in bdw_limit_period()
  perf stat: Fix CVS output format for non-supported counters
  perf/x86/intel/uncore: Fix Skylake UPI event format
  x86/entry/64: Don't use IST entry for #BP stack
  x86/boot/64: Verify alignment of the LOAD segment
  x86/build/64: Force the linker to use 2MB page size
  kvm/x86: fix icebp instruction handling
  selftests/x86/ptrace_syscall: Fix for yet more glibc interference
  tty: vt: fix up tabstops properly
  can: cc770: Fix use after free in cc770_tx_interrupt()
  can: cc770: Fix queue stall & dropped RTR reply
  can: cc770: Fix stalls on rt-linux, remove redundant IRQ ack
  can: ifi: Check core revision upon probe
  can: ifi: Repair the error handling
  staging: ncpfs: memory corruption in ncp_read_kernel()
  mtd: nand: fsl_ifc: Read ECCSTAT0 and ECCSTAT1 registers for IFC 2.0
  mtd: nand: fsl_ifc: Fix eccstat array overflow for IFC ver >= 2.0.0
  mtd: nand: fsl_ifc: Fix nand waitfunc return value
  mtdchar: fix usage of mtd_ooblayout_ecc()
  tracing: probeevent: Fix to support minus offset from symbol
  rtlwifi: rtl8723be: Fix loss of signal
  brcmfmac: fix P2P_DEVICE ethernet address generation
  libnvdimm, {btt, blk}: do integrity setup before add_disk()
  ACPI / watchdog: Fix off-by-one error at resource assignment
  acpi, numa: fix pxm to online numa node associations
  drm: udl: Properly check framebuffer mmap offsets
  drm/radeon: Don't turn off DP sink when disconnected
  drm/vmwgfx: Fix a destoy-while-held mutex problem.
  mm/shmem: do not wait for lock_page() in shmem_unused_huge_shrink()
  mm/thp: do not wait for lock_page() in deferred_split_scan()
  mm/khugepaged.c: convert VM_BUG_ON() to collapse fail
  x86/mm: implement free pmd/pte page interfaces
  mm/vmalloc: add interfaces to free unmapped page table
  nfsd: remove blocked locks on client teardown
  libata: Modify quirks for MX100 to limit NCQ_TRIM quirk to MU01 version
  libata: Make Crucial BX100 500GB LPM quirk apply to all firmware versions
  libata: Apply NOLPM quirk to Crucial M500 480 and 960GB SSDs
  libata: Enable queued TRIM for Samsung SSD 860
  libata: disable LPM for Crucial BX100 SSD 500GB drive
  libata: Apply NOLPM quirk to Crucial MX100 512GB SSDs
  libata: don't try to pass through NCQ commands to non-NCQ devices
  libata: remove WARN() for DMA or PIO command without data
  libata: fix length validation of ATAPI-relayed SCSI commands
  Bluetooth: btusb: Fix quirk for Atheros 1525/QCA6174
  clk: sunxi-ng: a31: Fix CLK_OUT_* clock ops
  clk: bcm2835: Protect sections updating shared registers
  clk: bcm2835: Fix ana->maskX definitions
  ahci: Add PCI-id for the Highpoint Rocketraid 644L card
  PCI: Add function 1 DMA alias quirk for Highpoint RocketRAID 644L
  mmc: dw_mmc: fix falling from idmac to PIO mode when dw_mci_reset occurs
  ALSA: hda/realtek - Always immediately update mute LED with pin VREF
  ALSA: aloop: Fix access to not-yet-ready substream via cable
  ALSA: aloop: Sync stale timer before release
  ALSA: usb-audio: Fix parsing descriptor of UAC2 processing unit
  iio: st_pressure: st_accel: pass correct platform data to init
  MIPS: ralink: Remove ralink_halt()

Change-Id: I65d15215fbd73a86b6834aad1d7280b8dc16b62b
Signed-off-by: Blagovest Kolenichev <bkolenichev@codeaurora.org>
2018-04-17 10:46:44 -07:00
Blagovest Kolenichev
dc9767ff92 Merge android-4.9.90 (dd1e37e) into msm-4.9
* refs/heads/tmp-dd1e37e:
  Linux 4.9.90
  usb: gadget: f_hid: fix: Move IN request allocation to set_alt()
  RDMA/ucma: Don't allow join attempts for unsupported AF family
  RDMA/ucma: Fix access to non-initialized CM_ID object
  clk: migrate the count of orphaned clocks at init
  IB/mlx5: Fix out-of-bounds read in create_raw_packet_qp_rq
  IB/mlx5: Fix integer overflows in mlx5_ib_create_srq
  dmaengine: ti-dma-crossbar: Fix event mapping for TPCC_EVT_MUX_60_63
  clk: si5351: Rename internal plls to avoid name collisions
  clk: axi-clkgen: Correctly handle nocount bit in recalc_rate()
  clk: Don't touch hardware when reparenting during registration
  nfsd4: permit layoutget of executable-only files
  ARM: dts: aspeed-evb: Add unit name to memory node
  RDMA/ocrdma: Fix permissions for OCRDMA_RESET_STATS
  ip6_vti: adjust vti mtu according to mtu of lower device
  iommu/vt-d: clean up pr_irq if request_threaded_irq fails
  pinctrl: rockchip: enable clock when reading pin direction register
  pinctrl: Really force states during suspend/resume
  coresight: Fix disabling of CoreSight TPIU
  pty: cancel pty slave port buf's work in tty_release
  drm/omap: DMM: Check for DMM readiness after successful transaction commit
  omapdrm: panel: fix compatible vendor string for td028ttec1
  vgacon: Set VGA struct resource types
  iser-target: avoid reinitializing rdma contexts for isert commands
  IB/umem: Fix use of npages/nmap fields
  RDMA/cma: Use correct size when writing netlink stats
  IB/ipoib: Avoid memory leak if the SA returns a different DGID
  mmc: avoid removing non-removable hosts during suspend
  drm/tilcdc: ensure nonatomic iowrite64 is not used
  dmaengine: zynqmp_dma: Fix race condition in the probe
  platform/chrome: Use proper protocol transfer function
  watchdog: Fix potential kref imbalance when opening watchdog
  cros_ec: fix nul-termination for firmware build info
  serial: 8250_dw: Disable clock on error
  qmi_wwan: set FLAG_SEND_ZLP to avoid network initiated disconnect
  media: [RESEND] media: dvb-frontends: Add delay to Si2168 restart
  ath10k: handling qos at STA side based on AP WMM enable/disable
  media: bt8xx: Fix err 'bt878_probe()'
  rtlwifi: rtl_pci: Fix the bug when inactiveps is enabled.
  RDMA/iwpm: Fix uninitialized error code in iwpm_send_mapinfo()
  drm/msm: fix leak in failed get_pages
  media: c8sectpfe: fix potential NULL pointer dereference in c8sectpfe_timer_interrupt
  Bluetooth: btqcomsmd: Fix skb double free corruption
  Bluetooth: hci_qca: Avoid setup failure on missing rampatch
  block/mq: Cure cpu hotplug lock inversion
  perf tests kmod-path: Don't fail if compressed modules aren't supported
  ath10k: fix out of bounds access to local buffer
  rtc: ds1374: wdt: Fix stop/start ioctl always returning -EINVAL
  rtc: ds1374: wdt: Fix issue with timeout scaling from secs to wdt ticks
  mm: hwpoison: call shake_page() after try_to_unmap() for mlocked page
  mm, vmstat: suppress pcp stats for unpopulated zones in zoneinfo
  mm: fix check for reclaimable pages in PF_MEMALLOC reclaim throttling
  cifs: small underflow in cnvrtDosUnixTm()
  net: hns: fix ethtool_get_strings overflow in hns driver
  pNFS: Fix a deadlock when coalescing writes and returning the layout
  sm501fb: don't return zero on failure path in sm501fb_start()
  video: fbdev: udlfb: Fix buffer on stack
  x86/xen: split xen_smp_prepare_boot_cpu()
  tcm_fileio: Prevent information leak for short reads
  ia64: fix module loading for gcc-5.4
  ACPI / power: Delay turning off unused power resources after suspend
  md/raid10: skip spare disk as 'first' disk
  IB/rxe: Don't clamp residual length to mtu
  Input: twl4030-pwrbutton - use correct device for irq request
  power: supply: pda_power: move from timer to delayed_work
  power: supply: isp1704: Fix unchecked return value of devm_kzalloc
  power: supply: bq24190_charger: Add disable-reset device-property
  bnx2x: Align RX buffers
  qed: Unlock on error in qed_vf_pf_acquire()
  vxlan: correctly handle ipv6.disable module parameter
  Bluetooth: hci_ldisc: Add protocol check to hci_uart_tx_wakeup()
  Bluetooth: hci_ldisc: Add protocol check to hci_uart_dequeue()
  soc/fsl/qe: round brg_freq to 1kHz granularity
  net: ethernet: ucc_geth: fix MEM_PART_MURAM mode
  ixgbevf: fix size of queue stats length
  jbd2: Fix lockdep splat with generic/270 test
  drm/nouveau/kms: Increase max retries in scanout position queries.
  drm/amdgpu: fix gpu reset crash
  ACPI / PMIC: xpower: Fix power_table addresses
  ipmi/watchdog: fix wdog hang on panic waiting for ipmi response
  platform/x86: asus-wmi: try to set als by default
  IB/hfi1: Fix softlockup issue
  IB/rdmavt: restore IRQs on error path in rvt_create_ah()
  ARM: DRA7: clockdomain: Change the CLKTRCTRL of CM_PCIE_CLKSTCTRL to SW_WKUP
  netfilter: x_tables: unlock on error in xt_find_table_lock()
  mmc: sdhci-of-esdhc: limit SD clock for ls1012a/ls1046a
  mac80211: Fix possible sband related NULL pointer de-reference
  ipvs: explicitly forbid ipv6 service/dest creation if ipv6 mod is disabled
  staging: wilc1000: fix unchecked return value
  staging: unisys: visorhba: fix s-Par to boot with option CONFIG_VMAP_STACK set to y
  gpio: gpio-wcove: fix GPIO IRQ status mask
  x86/KASLR: Fix kexec kernel boot crash when KASLR randomization fails
  mtip32xx: use runtime tag to initialize command header
  mfd: palmas: Reset the POWERHOLD mux during power off
  dt-bindings: mfd: axp20x: Add "xpowers,master-mode" property for AXP806 PMICs
  iio: hid-sensor: fix return of -EINVAL on invalid values in ret or value
  ACPICA: iasl: Fix IORT SMMU GSI disassembling
  mac80211: don't parse encrypted management frames in ieee80211_frame_acked
  orangefs: do not wait for timeout if umounting
  Btrfs: fix extent map leak during fallocate error path
  Btrfs: send, fix file hole not being preserved due to inline extent
  Btrfs: fix incorrect space accounting after failure to insert inline extent
  rndis_wlan: add return value validation
  libertas: check return value of alloc_workqueue
  mt7601u: check return value of alloc_skb
  iio: st_pressure: st_accel: Initialise sensor platform data properly
  NFS: don't try to cross a mountpount when there isn't one there.
  xprtrdma: Cancel refresh worker during buffer shutdown
  pNFS: Fix use after free issues in pnfs_do_read()
  infiniband/uverbs: Fix integer overflows
  scsi: mac_esp: Replace bogus memory barrier with spinlock
  platform/x86: intel-vbtn: add volume up and down
  netfilter: nft_dynset: continue to next expr if _OP_ADD succeeded
  qlcnic: fix unchecked return value
  wan: pc300too: abort path on failure
  tipc: check return value of nlmsg_new
  mmc: host: omap_hsmmc: checking for NULL instead of IS_ERR()
  netfilter: nf_ct_helper: permit cthelpers with different names via nfnetlink
  openvswitch: Delete conntrack entry clashing with an expectation.
  netfilter: xt_CT: fix refcnt leak on error path
  gpio: gpio-wcove: fix irq pending status bit width
  Fix Express lane queue creation.
  Fix driver usage of 128B WQEs when WQ_CREATE is V1.
  netvsc: Deal with rescinded channels correctly
  ibmvnic: Disable irq prior to close
  ASoC: Intel: Skylake: Uninitialized variable in probe_codec()
  IB/mlx5: Set correct SL in completion for RoCE
  IB/mlx5: Change vma from shared to private
  IB/mlx5: Take write semaphore when changing the vma struct
  IB/mlx4: Change vma from shared to private
  IB/mlx4: Take write semaphore when changing the vma struct
  HSI: ssi_protocol: double free in ssip_pn_xmit()
  IB/ipoib: Update broadcast object if PKey value was changed in index 0
  IB/ipoib: Fix deadlock between ipoib_stop and mcast join flow
  ALSA: hda - Fix headset microphone detection for ASUS N551 and N751
  e1000e: fix timing for 82579 Gigabit Ethernet controller
  tcp: remove poll() flakes with FastOpen
  NFS: Fix missing pg_cleanup after nfs_pageio_cond_complete()
  md/raid10: wait up frozen array in handle_write_completed
  iommu/omap: Register driver before setting IOMMU ops
  irqchip/mips-gic: Separate IPI reservation & usage tracking
  ARM: 8668/1: ftrace: Fix dynamic ftrace with DEBUG_RODATA and !FRAME_POINTER
  x86/reboot: Turn off KVM when halting a CPU
  mwifiex: don't leak 'chan_stats' on reset
  KVM: PPC: Book3S PR: Exit KVM on failed mapping
  scsi: virtio_scsi: Always try to read VPD pages
  iwlwifi: a000: fix memory offsets and lengths
  iwlwifi: split the handler and the wake parts of the notification infra
  clk: ns2: Correct SDIO bits
  ath: Fix updating radar flags for coutry code India
  powerpc/64s: Remove SAO feature from Power9 DD1
  spi: dw: Disable clock after unregistering the host
  tools/testing/nvdimm: fix nfit_test shutdown crash
  ASoC: Intel: Atom: update Thinkpad 10 quirk
  btrfs: fix a bogus warning when converting only data or metadata
  media/dvb-core: Race condition when writing to CAM
  net: ipv6: send unsolicited NA on admin up
  i2c: i2c-scmi: add a MS HID
  genirq: Use irqd_get_trigger_type to compare the trigger type for shared IRQs
  cpufreq/sh: Replace racy task affinity logic
  ACPI/processor: Replace racy task affinity logic
  ACPI/processor: Fix error handling in __acpi_processor_start()
  time: Change posix clocks ops interfaces to use timespec64
  Input: ar1021_i2c - fix too long name in driver's device table
  rtc: cmos: Do not assume irq 8 for rtc when there are no legacy irqs
  x86: i8259: export legacy_pic symbol
  power: supply: bq24190_charger: Limit over/under voltage fault logging
  regulator: anatop: set default voltage selector for pcie
  bonding: handle link transition from FAIL to UP correctly
  platform/x86: asus-nb-wmi: Add wapf4 quirk for the X302UA
  led: core: Clear LED_BLINK_SW flag in led_blink_set()
  Revert "led: core: Fix brightness setting when setting delay_off=0"
  staging: android: ashmem: Fix possible deadlock in ashmem_ioctl
  CIFS: Enable encryption during session setup phase
  SMB3: Validate negotiate request must always be signed
  ASoC: rsnd: check src mod pointer for rsnd_mod_id()
  tpm: fix potential buffer overruns caused by bit glitches on the bus
  BACKPORT, FROMLIST: crypto: arm64/speck - add NEON-accelerated implementation of Speck-XTS
  ANDROID: debugobjects: Make stack check warning more informative
  PM / OPP: list_del_rcu should be used in function _remove_opp_dev
  trace/sched: Fix compilation for 32 bit systems
  sched/fair: select the most energy-efficient CPU candidate on wake-up
  sched/fair: fix array out of bounds access in select_energy_cpu_idx()
  sched/fair: use min capacity when evaluating active cpus
  sched/fair: use min capacity when evaluating idle backup cpus
  sched/fair: use min capacity when evaluating placement energy costs
  sched/fair: introduce minimum capacity capping sched feature
  arm/topology: link arch_scale_min_freq_capacity to cpufreq
  arm64/topology: link arch_scale_min_freq_capacity to cpufreq
  sched: add arch_scale_min_freq_capacity to track minimum capacity caps
  cpufreq: add scaled minimum capacity tracking for policy changes
  arm64: enable max frequency capping
  arm: enable max frequency capping
  cpufreq: implement max frequency capping
  sched/fair: introduce an arch scaling function for max frequency capping
  cpufreq: remove max frequency capping from scale_freq_capacity()
  Revert "ANDROID: cpufreq: Max freq invariant scheduler load-tracking and cpu capacity support"
  Revert "ANDROID: arm: Enable max freq invariant scheduler load-tracking and capacity support"
  Revert "ANDROID: arm64: Enable max freq invariant scheduler load-tracking and capacity support"
  sched/fair: reduce rounding errors in energy computations
  sched/fair: re-factor energy_diff to use a single (extensible) energy_env
  sched/fair: cleanup select_energy_cpu_brute to be more consistent
  sched/fair: remove capacity tracking from energy_diff
  sched/fair: remove energy_diff tracepoint in preparation to re-factoring
  sched/fair: use *p to reference task_structs
  sched: EAS: Fix the calculation of group util in group_idle_state()

Conflicts:
	drivers/clk/clk.c
	drivers/gpu/drm/msm/msm_gem.c
	include/trace/events/sched.h
	kernel/sched/fair.c
	kernel/sched/features.h

Change-Id: I875b8c298dc6a8151abf740126a2d1881d498203
Signed-off-by: Blagovest Kolenichev <bkolenichev@codeaurora.org>
2018-04-17 10:46:05 -07:00
Takashi Iwai
dd62bc3058 Bluetooth: btusb: Fix quirk for Atheros 1525/QCA6174
commit f44cb4b19ed40b655c2d422c9021ab2c2625adb6 upstream.

The Atheros 1525/QCA6174 BT doesn't seem working properly on the
recent kernels, as it tries to load a wrong firmware
ar3k/AthrBT_0x00000200.dfu and it fails.

This seems to have been a problem for some time, and the known
workaround is to apply BTUSB_QCA_ROM quirk instead of BTUSB_ATH3012.

The device in question is:

T: Bus=01 Lev=01 Prnt=01 Port=09 Cnt=03 Dev#=  4 Spd=12   MxCh= 0
D: Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
P: Vendor=0cf3 ProdID=3004 Rev= 0.01
C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=81(I) Atr=03(Int.) MxPS=  16 Ivl=1ms
E: Ad=82(I) Atr=02(Bulk) MxPS=  64 Ivl=0ms
E: Ad=02(O) Atr=02(Bulk) MxPS=  64 Ivl=0ms
I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=83(I) Atr=01(Isoc) MxPS=   0 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS=   0 Ivl=1ms
I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=83(I) Atr=01(Isoc) MxPS=   9 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS=   9 Ivl=1ms
I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=83(I) Atr=01(Isoc) MxPS=  17 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS=  17 Ivl=1ms
I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=83(I) Atr=01(Isoc) MxPS=  25 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS=  25 Ivl=1ms
I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=83(I) Atr=01(Isoc) MxPS=  33 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS=  33 Ivl=1ms
I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=83(I) Atr=01(Isoc) MxPS=  49 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS=  49 Ivl=1ms

Bugzilla: http://bugzilla.opensuse.org/show_bug.cgi?id=1082504
Reported-by: Ivan Levshin <ivan.levshin@microfocus.com>
Tested-by: Ivan Levshin <ivan.levshin@microfocus.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-03-28 18:39:20 +02:00
Loic Poulain
dadb6c1a8d Bluetooth: btqcomsmd: Fix skb double free corruption
[ Upstream commit 67b8fbead4685b36d290a0ef91c6ddffc4920ec9 ]

In case of hci send frame failure, skb is still owned
by the caller (hci_core) and then should not be freed.

This fixes crash on dragonboard-410c when sending SCO
packet. skb is freed by both btqcomsmd and hci_core.

Fixes: 1511cc750c ("Bluetooth: Introduce Qualcomm WCNSS SMD based HCI driver")
Signed-off-by: Loic Poulain <loic.poulain@linaro.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-03-24 11:00:22 +01:00
Loic Poulain
f37dc00bac Bluetooth: hci_qca: Avoid setup failure on missing rampatch
[ Upstream commit ba8f3597900291a93604643017fff66a14546015 ]

Assuming that the original code idea was to enable in-band sleeping
only if the setup_rome method returns succes and run in 'standard'
mode otherwise, we should not return setup_rome return value which
makes qca_setup fail if no rampatch/nvm file found.

This fixes BT issue on the dragonboard-820C p4 which includes the
following QCA controller:
hci0: Product:0x00000008
hci0: Patch  :0x00000111
hci0: ROM    :0x00000302
hci0: SOC    :0x00000044

Since there is no rampatch for this controller revision, just make
it work as is.

Signed-off-by: Loic Poulain <loic.poulain@linaro.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-03-24 11:00:22 +01:00
Dean Jenkins
b5d95e85b2 Bluetooth: hci_ldisc: Add protocol check to hci_uart_tx_wakeup()
[ Upstream commit 2d6f1da168e1d62c47f7d50135ac4cbd8411dcb1 ]

Before attempting to schedule a work-item onto hu->write_work in
hci_uart_tx_wakeup(), check that the Data Link protocol layer is
still bound to the HCI UART driver.

Failure to perform this protocol check causes a race condition between
the work queue hu->write_work running hci_uart_write_work() and the
Data Link protocol layer being unbound (closed) in hci_uart_tty_close().

Note hci_uart_tty_close() does have a "cancel_work_sync(&hu->write_work)"
but it is ineffective because it cannot prevent work-items being added
to hu->write_work after cancel_work_sync() has run.

Therefore, add a check for HCI_UART_PROTO_READY into hci_uart_tx_wakeup()
which prevents scheduling of the work queue when HCI_UART_PROTO_READY
is in the clear state. However, note a small race condition remains
because the hci_uart_tx_wakeup() thread can run in parallel with the
hci_uart_tty_close() thread so it is possible that a schedule of
hu->write_work can occur when HCI_UART_PROTO_READY is cleared. A complete
solution needs locking of the threads which is implemented in a future
commit.

Signed-off-by: Dean Jenkins <Dean_Jenkins@mentor.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-03-24 11:00:19 +01:00
Dean Jenkins
bbb952d00c Bluetooth: hci_ldisc: Add protocol check to hci_uart_dequeue()
[ Upstream commit 048e1bd3a27fbeb84ccdff52e165370c1339a193 ]

Before attempting to dequeue a Data Link protocol encapsulated message,
check that the Data Link protocol is still bound to the HCI UART driver.
This makes the code consistent with the usage of the other proto
function pointers.

Therefore, add a check for HCI_UART_PROTO_READY into hci_uart_dequeue()
and return NULL if the Data Link protocol is not bound.

This is needed for robustness as there is a scheduling race condition.
hci_uart_write_work() is scheduled to run via work queue hu->write_work
from hci_uart_tx_wakeup(). Therefore, there is a delay between
scheduling hci_uart_write_work() to run and hci_uart_dequeue() running
whereby the Data Link protocol layer could become unbound during the
scheduling delay. In this case, without the check, the call to the
unbound Data Link protocol layer dequeue function can crash.

It is noted that hci_uart_tty_close() has a
"cancel_work_sync(&hu->write_work)" statement but this only reduces
the window of the race condition because it is possible for a new
work-item to be added to work queue hu->write_work after the call to
cancel_work_sync(). For example, Data Link layer retransmissions can
be added to the work queue after the cancel_work_sync() has finished.

Signed-off-by: Dean Jenkins <Dean_Jenkins@mentor.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-03-24 11:00:19 +01:00
Satish Kodishala
f542e4be35 Add support for 44.1/48/88.1/96KHz for Tx channel
Added support for 44.1/48/88.1/96KHz sample rates
for Tx channel to use for feedback. Set data format
to LPCM only for SCO Tx use case. Audio hal will
provide the information of feedback channel before
opening the port.

CRs-Fixed: 2205755
Change-Id: I122f1bf729de5f0f83607778d5dee4380baf94fc
Signed-off-by: Satish Kodishala <skodisha@codeaurora.org>
2018-03-19 20:01:39 -07:00
Blagovest Kolenichev
82ccf838e2 Merge android-4.9-o.82 (2d34d45) into msm-4.9
* refs/heads/tmp-2d34d45:
  Linux 4.9.82
  ftrace: Remove incorrect setting of glob search field
  mn10300/misalignment: Use SIGSEGV SEGV_MAPERR to report a failed user copy
  ovl: fix failure to fsync lower dir
  acpi, nfit: fix register dimm error handling
  ACPI: sbshc: remove raw pointer from printk() message
  drm/i915: Avoid PPS HW/SW state mismatch due to rounding
  btrfs: Handle btrfs_set_extent_delalloc failure in fixup worker
  lib/ubsan: add type mismatch handler for new GCC/Clang
  lib/ubsan.c: s/missaligned/misaligned/
  clocksource/drivers/stm32: Fix kernel panic with multiple timers
  pktcdvd: Fix pkt_setup_dev() error path
  pinctrl: intel: Initialize GPIO properly when used through irqchip
  EDAC, octeon: Fix an uninitialized variable warning
  xtensa: fix futex_atomic_cmpxchg_inatomic
  alpha: fix formating of stack content
  alpha: fix reboot on Avanti platform
  alpha: fix crash if pthread_create races with signal delivery
  signal/sh: Ensure si_signo is initialized in do_divide_error
  signal/openrisc: Fix do_unaligned_access to send the proper signal
  Bluetooth: btusb: Restore QCA Rome suspend/resume fix with a "rewritten" version
  Revert "Bluetooth: btusb: fix QCA Rome suspend/resume"
  Bluetooth: btsdio: Do not bind to non-removable BCM43341
  HID: quirks: Fix keyboard + touchpad on Toshiba Click Mini not working
  pipe: fix off-by-one error when checking buffer limits
  pipe: actually allow root to exceed the pipe buffer limits
  kernel/relay.c: revert "kernel/relay.c: fix potential memory leak"
  kernel/async.c: revert "async: simplify lowest_in_progress()"
  fs/proc/kcore.c: use probe_kernel_read() instead of memcpy()
  media: cxusb, dib0700: ignore XC2028_I2C_FLUSH
  media: ts2020: avoid integer overflows on 32 bit machines
  media: dvb-frontends: fix i2c access helpers for KASAN
  watchdog: imx2_wdt: restore previous timeout after suspend+resume
  ASoC: skl: Fix kernel warning due to zero NHTL entry
  ASoC: rockchip: i2s: fix playback after runtime resume
  KVM: arm/arm64: Handle CPU_PM_ENTER_FAILED
  KVM: nVMX: Fix races when sending nested PI while dest enters/leaves L2
  arm: KVM: Fix SMCCC handling of unimplemented SMC/HVC calls
  crypto: sha512-mb - initialize pending lengths correctly
  crypto: caam - fix endless loop when DECO acquire fails
  media: v4l2-compat-ioctl32.c: refactor compat ioctl32 logic
  media: v4l2-compat-ioctl32.c: don't copy back the result for certain errors
  media: v4l2-compat-ioctl32.c: drop pr_info for unknown buffer type
  media: v4l2-compat-ioctl32.c: copy clip list in put_v4l2_window32
  media: v4l2-compat-ioctl32: Copy v4l2_window->global_alpha
  media: v4l2-compat-ioctl32.c: make ctrl_is_pointer work for subdevs
  media: v4l2-compat-ioctl32.c: fix ctrl_is_pointer
  media: v4l2-compat-ioctl32.c: copy m.userptr in put_v4l2_plane32
  media: v4l2-compat-ioctl32.c: avoid sizeof(type)
  media: v4l2-compat-ioctl32.c: move 'helper' functions to __get/put_v4l2_format32
  media: v4l2-compat-ioctl32.c: fix the indentation
  media: v4l2-compat-ioctl32.c: add missing VIDIOC_PREPARE_BUF
  media: v4l2-ioctl.c: don't copy back the result for -ENOTTY
  nsfs: mark dentry with DCACHE_RCUACCESS
  crypto: poly1305 - remove ->setkey() method
  crypto: mcryptd - pass through absence of ->setkey()
  crypto: cryptd - pass through absence of ->setkey()
  crypto: hash - introduce crypto_hash_alg_has_setkey()
  ahci: Add Intel Cannon Lake PCH-H PCI ID
  ahci: Add PCI ids for Intel Bay Trail, Cherry Trail and Apollo Lake AHCI
  ahci: Annotate PCI ids for mobile Intel chipsets as such
  kernfs: fix regression in kernfs_fop_write caused by wrong type
  NFS: Fix a race between mmap() and O_DIRECT
  NFS: reject request for id_legacy key without auxdata
  NFS: commit direct writes even if they fail partially
  NFS: Add a cond_resched() to nfs_commit_release_pages()
  nfs/pnfs: fix nfs_direct_req ref leak when i/o falls back to the mds
  ubifs: Massage assert in ubifs_xattr_set() wrt. init_xattrs
  ubi: block: Fix locking for idr_alloc/idr_remove
  ubi: fastmap: Erase outdated anchor PEBs during attach
  mtd: nand: sunxi: Fix ECC strength choice
  mtd: nand: Fix nand_do_read_oob() return value
  mtd: nand: brcmnand: Disable prefetch by default
  mtd: cfi: convert inline functions to macros
  media: hdpvr: Fix an error handling path in hdpvr_probe()
  media: dvb-usb-v2: lmedm04: move ts2020 attach to dm04_lme2510_tuner
  media: dvb-usb-v2: lmedm04: Improve logic checking of warm start
  dccp: CVE-2017-8824: use-after-free in DCCP code
  sched/rt: Up the root domain ref count when passing it around via IPIs
  sched/rt: Use container_of() to get root domain in rto_push_irq_work_func()
  usb: gadget: uvc: Missing files for configfs interface
  posix-timer: Properly check sigevent->sigev_notify
  kaiser: fix compile error without vsyscall
  dmaengine: dmatest: fix container_of member in dmatest_callback
  CIFS: zero sensitive data when freeing
  cifs: Fix autonegotiate security settings mismatch
  cifs: Fix missing put_xid in cifs_file_strict_mmap
  powerpc/pseries: include linux/types.h in asm/hvcall.h

Conflicts:
	drivers/media/v4l2-core/v4l2-compat-ioctl32.c

Change-Id: Ibd9486e6f8be9673b381f86d69fafa081c8f2539
Signed-off-by: Blagovest Kolenichev <bkolenichev@codeaurora.org>
2018-02-27 01:11:43 -08:00
Hans de Goede
5795b076bd Bluetooth: btusb: Restore QCA Rome suspend/resume fix with a "rewritten" version
commit 61f5acea8737d9b717fcc22bb6679924f3c82b98 upstream.

Commit 7d06d5895c15 ("Revert "Bluetooth: btusb: fix QCA...suspend/resume"")
removed the setting of the BTUSB_RESET_RESUME quirk for QCA Rome devices,
instead favoring adding USB_QUIRK_RESET_RESUME quirks in usb/core/quirks.c.

This was done because the DIY BTUSB_RESET_RESUME reset-resume handling
has several issues (see the original commit message). An added advantage
of moving over to the USB-core reset-resume handling is that it also
disables autosuspend for these devices, which is similarly broken on these.

But there are 2 issues with this approach:
1) It leaves the broken DIY BTUSB_RESET_RESUME code in place for Realtek
   devices.
2) Sofar only 2 of the 10 QCA devices known to the btusb code have been
   added to usb/core/quirks.c and if we fix the Realtek case the same way
   we need to add an additional 14 entries. So in essence we need to
   duplicate a large part of the usb_device_id table in btusb.c in
   usb/core/quirks.c and manually keep them in sync.

This commit instead restores setting a reset-resume quirk for QCA devices
in the btusb.c code, avoiding the duplicate usb_device_id table problem.

This commit avoids the problems with the original DIY BTUSB_RESET_RESUME
code by simply setting the USB_QUIRK_RESET_RESUME quirk directly on the
usb_device.

This commit also moves the BTUSB_REALTEK case over to directly setting the
USB_QUIRK_RESET_RESUME on the usb_device and removes the now unused
BTUSB_RESET_RESUME code.

BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1514836
Fixes: 7d06d5895c15 ("Revert "Bluetooth: btusb: fix QCA...suspend/resume"")
Cc: Leif Liddy <leif.linux@gmail.com>
Cc: Matthias Kaehlcke <mka@chromium.org>
Cc: Brian Norris <briannorris@chromium.org>
Cc: Daniel Drake <drake@endlessm.com>
Cc: Kai-Heng Feng <kai.heng.feng@canonical.com>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-02-17 13:21:19 +01:00
Kai-Heng Feng
84bf682f53 Revert "Bluetooth: btusb: fix QCA Rome suspend/resume"
commit 7d06d5895c159f64c46560dc258e553ad8670fe0 upstream.

This reverts commit fd865802c66bc451dc515ed89360f84376ce1a56.

This commit causes a regression on some QCA ROME chips. The USB device
reset happens in btusb_open(), hence firmware loading gets interrupted.

Furthermore, this commit stops working after commit
("a0085f2510e8976614ad8f766b209448b385492f Bluetooth: btusb: driver to
enable the usb-wakeup feature"). Reset-resume quirk only gets enabled in
btusb_suspend() when it's not a wakeup source.

If we really want to reset the USB device, we need to do it before
btusb_open(). Let's handle it in drivers/usb/core/quirks.c.

Cc: Leif Liddy <leif.linux@gmail.com>
Cc: Matthias Kaehlcke <mka@chromium.org>
Cc: Brian Norris <briannorris@chromium.org>
Cc: Daniel Drake <drake@endlessm.com>
Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
Reviewed-by: Brian Norris <briannorris@chromium.org>
Tested-by: Brian Norris <briannorris@chromium.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-02-17 13:21:19 +01:00
Hans de Goede
6913d1b190 Bluetooth: btsdio: Do not bind to non-removable BCM43341
commit b4cdaba274247c9c841c6a682c08fa91fb3aa549 upstream.

BCM43341 devices soldered onto the PCB (non-removable) always (AFAICT)
use an UART connection for bluetooth. But they also advertise btsdio
support on their 3th sdio function, this causes 2 problems:

1) A non functioning BT HCI getting registered

2) Since the btsdio driver does not have suspend/resume callbacks,
mmc_sdio_pre_suspend will return -ENOSYS, causing mmc_pm_notify()
to react as if the SDIO-card is removed and since the slot is
marked as non-removable it will never get detected as inserted again.
Which results in wifi no longer working after a suspend/resume.

This commit fixes both by making btsdio ignore BCM43341 devices
when connected to a slot which is marked non-removable.

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-02-17 13:21:18 +01:00
Greg Kroah-Hartman
3b6c84bc64 Revert "Bluetooth: btusb: driver to enable the usb-wakeup feature"
This reverts commit 7336f5481f which is
commit a0085f2510e8976614ad8f766b209448b385492f upstream.

It causes problems with working systems, as noted by a number of the
ChromeOS developers.

Cc: Sukumar Ghorai <sukumar.ghorai@intel.com>
Cc: Amit K Bag <amit.k.bag@intel.com>
Cc: Oliver Neukum <oneukum@suse.com>
Cc: Marcel Holtmann <marcel@holtmann.org>
Cc: Matthias Kaehlcke <mka@chromium.org>
Reported-by: Guenter Roeck <linux@roeck-us.net>
Reported-by: Brian Norris <briannorris@chromium.org>
Acked-by: Brian Norris <briannorris@chromium.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-12-25 14:23:46 +01:00
Satish Kodishala
ead3f4e19b bt: Unset multi channel bit for 44.1/88.2Khz A2DP Rx
When opening port for 44.1/88.2KHz A2DP Rx, explicitly
unset multi channel bit. This is required because for SCO/A2DP
with other sample rates, we set the multi channel bit. The
bit remains set even after the channel is removed and until we
expliciltly unset again.

CRs-Fixed: 2161323
Change-Id: I6890647a51a07d7eefed4b8ce654a1578ad67061
Signed-off-by: Satish Kodishala <skodisha@codeaurora.org>
2017-12-22 23:51:07 +05:30
Sukumar Ghorai
7336f5481f Bluetooth: btusb: driver to enable the usb-wakeup feature
commit a0085f2510e8976614ad8f766b209448b385492f upstream.

BT-Controller connected as platform non-root-hub device and
usb-driver initialize such device with wakeup disabled,
Ref. usb_new_device().

At present wakeup-capability get enabled by hid-input device from usb
function driver(e.g. BT HID device) at runtime. Again some functional
driver does not set usb-wakeup capability(e.g LE HID device implement
as HID-over-GATT), and can't wakeup the host on USB.

Most of the device operation (such as mass storage) initiated from host
(except HID) and USB wakeup aligned with host resume procedure. For BT
device, usb-wakeup capability need to enable form btusc driver as a
generic solution for multiple profile use case and required for USB remote
wakeup (in-bus wakeup) while host is suspended. Also usb-wakeup feature
need to enable/disable with HCI interface up and down.

Signed-off-by: Sukumar Ghorai <sukumar.ghorai@intel.com>
Signed-off-by: Amit K Bag <amit.k.bag@intel.com>
Acked-by: Oliver Neukum <oneukum@suse.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Cc: Matthias Kaehlcke <mka@chromium.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-12-20 10:07:16 +01:00
Satish Kodishala
530e0b613c bt: Don't set multichannel bit for 44.1/88.2 A2DP Rx
We should not set multichannel bit for A2DP Rx when
sample rate is 44.1/88.2. Also, we should disconnect
port first before removing the channel. Configure
slimbus as push mode for 44.1/88.2.

CRs-Fixed: 2154512
Change-Id: Iaf41684824f40afb652532609ed5a0d799a6d011
Signed-off-by: Satish Kodishala <skodisha@codeaurora.org>
2017-12-08 22:23:47 -08:00
Sungjun Park
ea258e4000 bluetooth: Add 44.1/88.2/96 Khz for LDAC
To support high quality LDAC codec, codec dai is updated
with 44.1/88.2/96 Khz sampling rate. For 44.1/88.2 Khz
sampling rate for A2DP over slimbus, it requires to set
push/pull mode to fill audio gap in 48 Khz based slimbus
clock.

Change-Id: I984481d002c274199bf3d33accb519752bcdc4e8
Signed-off-by: Sungjun Park <sjpark@codeaurora.org>
2017-11-30 16:47:38 -08:00
Kyle Yan
01bff91034 Merge remote-tracking branch '4.9/tmp-8cca21f' into 4.9
* 4.9/tmp-8cca21f:
  Linux 4.9.65
  mm/pagewalk.c: report holes in hugetlb ranges
  coda: fix 'kernel memory exposure attempt' in fsync
  mm/page_alloc.c: broken deferred calculation
  ipmi: fix unsigned long underflow
  ocfs2: should wait dio before inode lock in ocfs2_setattr()
  ocfs2: fix cluster hang after a node dies
  dmaengine: dmatest: warn user when dma test times out
  serial: 8250_fintek: Fix finding base_port with activated SuperIO
  serial: omap: Fix EFR write on RTS deassertion
  ima: do not update security.ima if appraisal status is not INTEGRITY_PASS
  crypto: dh - Fix double free of ctx->p
  crypto: dh - fix memleak in setkey
  net/sctp: Always set scope_id in sctp_inet6_skb_msgname
  fealnx: Fix building error on MIPS
  sctp: do not peel off an assoc from one netns to another one
  af_netlink: ensure that NLMSG_DONE never fails in dumps
  vlan: fix a use-after-free in vlan_device_event()
  net: usb: asix: fill null-ptr-deref in asix_suspend
  qmi_wwan: Add missing skb_reset_mac_header-call
  net: qmi_wwan: fix divide by 0 on bad descriptors
  net: cdc_ether: fix divide by 0 on bad descriptors
  bonding: discard lowest hash bit for 802.3ad layer3+4
  netfilter/ipvs: clear ipvs_property flag when SKB net namespace changed
  tcp: do not mangle skb->cb[] in tcp_make_synack()
  net: vrf: correct FRA_L3MDEV encode type
  tcp_nv: fix division by zero in tcpnv_acked()
  Linux 4.9.64
  staging: greybus: spilib: fix use-after-free after deregistration
  brcmfmac: don't preset all channels as disabled
  x86/MCE/AMD: Always give panic severity for UC errors in kernel context
  USB: serial: garmin_gps: fix memory leak on probe errors
  USB: serial: garmin_gps: fix I/O after failed probe and remove
  USB: serial: qcserial: add pid/vid for Sierra Wireless EM7355 fw update
  usb: gadget: f_fs: Fix use-after-free in ffs_free_inst
  USB: Add delay-init quirk for Corsair K70 LUX keyboards
  USB: usbfs: compute urb->actual_length for isochronous
  crypto: dh - Don't permit 'key' or 'g' size longer than 'p'
  crypto: dh - Don't permit 'p' to be 0
  Revert "dt-bindings: Add LEGO MINDSTORMS EV3 compatible specification"
  Revert "dt-bindings: Add vendor prefix for LEGO"
  uapi: fix linux/rds.h userspace compilation errors
  uapi: fix linux/rds.h userspace compilation error
  Revert "uapi: fix linux/rds.h userspace compilation errors"
  Revert "crypto: xts - Add ECB dependency"
  MIPS: Netlogic: Exclude netlogic,xlp-pic code from XLR builds
  MIPS: traps: Ensure L1 & L2 ECC checking match for CM3 systems
  MIPS: init: Ensure reserved memory regions are not added to bootmem
  MIPS: init: Ensure bootmem does not corrupt reserved memory
  MIPS: End asm function prologue macros with .insn
  staging: greybus: add host device function pointer checks
  staging: wilc1000: Fix endian sparse warning
  staging: rtl8712: fixed little endian problem
  ixgbe: do not disable FEC from the driver
  ixgbe: add mask for 64 RSS queues
  ixgbe: Reduce I2C retry count on X550 devices
  ixgbe: Fix reporting of 100Mb capability
  ixgbe: handle close/suspend race with netif_device_detach/present
  ixgbe: fix AER error handling
  ixgbe: Configure advertised speeds correctly for KR/KX backplane
  arm64: dts: NS2: reserve memory for Nitro firmware
  ALSA: hda/realtek - Add new codec ID ALC299
  gpu: drm: mgag200: mgag200_main:- Handle error from pci_iomap
  backlight: adp5520: Fix error handling in adp5520_bl_probe()
  backlight: lcd: Fix race condition during register
  drm/omap: panel-sony-acx565akm.c: Add MODULE_ALIAS
  ALSA: vx: Fix possible transfer overflow
  ALSA: vx: Don't try to update capture stream before running
  power: supply: axp288_fuel_gauge: Read 12 bit values 2 registers at a time
  power: supply: axp288_fuel_gauge: Read 15 bit values 2 registers at a time
  rtc: rx8010: change lock mechanism
  scsi: lpfc: Clear the VendorVersion in the PLOGI/PLOGI ACC payload
  scsi: lpfc: Correct issue leading to oops during link reset
  scsi: lpfc: Correct host name in symbolic_name field
  scsi: lpfc: FCoE VPort enable-disable does not bring up the VPort
  scsi: lpfc: Add missing memory barrier
  x86/irq, trace: Add __irq_entry annotation to x86's platform IRQ handlers
  staging: rtl8188eu: fix incorrect ERROR tags from logs
  tcp: provide timestamps for partial writes
  scsi: ufs: add capability to keep auto bkops always enabled
  scsi: ufs-qcom: Fix module autoload
  igb: Fix hw_dbg logging in igb_update_flash_i210
  igb: close/suspend race in netif_device_detach
  igb: reset the PHY before reading the PHY ID
  drm/sti: sti_vtg: Handle return NULL error from devm_ioremap_nocache
  ata: SATA_MV should depend on HAS_DMA
  ata: SATA_HIGHBANK should depend on HAS_DMA
  ata: ATA_BMDMA should depend on HAS_DMA
  ARM: dts: omap5-uevm: Allow bootloader to configure USB Ethernet MAC
  ARM: dts: Fix omap3 off mode pull defines
  ARM: OMAP2+: Fix init for multiple quirks for the same SoC
  ARM: dts: Fix am335x and dm814x scm syscon to probe children
  ARM: dts: Fix compatible for ti81xx uarts for 8250
  fm10k: request reset when mbx->state changes
  extcon: palmas: Check the parent instance to prevent the NULL
  extcon: Remove potential problem when calling extcon_register_notifier()
  Bluetooth: btusb: fix QCA Rome suspend/resume
  arm: crypto: reduce priority of bit-sliced AES cipher
  media: dib0700: fix invalid dvb_detach argument
  media: imon: Fix null-ptr-deref in imon_probe
  Linux 4.9.63
  misc: panel: properly restore atomic counter on error path
  qla2xxx: Fix incorrect tcm_qla2xxx_free_cmd use during TMR ABORT (v2)
  target/iscsi: Fix iSCSI task reassignment handling
  brcmfmac: remove setting IBSS mode when stopping AP
  security/keys: add CONFIG_KEYS_COMPAT to Kconfig
  netfilter: nat: Revert "netfilter: nat: convert nat bysrc hash to rhashtable"
  netfilter: nat: avoid use of nf_conn_nat extension
  Revert "ARM: dts: imx53-qsb-common: fix FEC pinmux config"
  ALSA: seq: Cancel pending autoload work at unbinding device
  Input: ims-psu - check if CDC union descriptor is sane
  usb: usbtest: fix NULL pointer dereference
  mac80211: don't compare TKIP TX MIC key in reinstall prevention
  mac80211: use constant time comparison with keys
  mac80211: accept key reinstall without changing anything
  ppp: fix race in ppp device destruction
  net_sched: avoid matching qdisc with zero handle
  sctp: reset owner sk for data chunks on out queues when migrating a sock
  tun: allow positive return values on dev_get_valid_name() call
  ip6_gre: update dst pmtu if dev mtu has been updated by toobig in __gre6_xmit
  ip6_gre: only increase err_count for some certain type icmpv6 in ip6gre_err
  ipip: only increase err_count for some certain type icmp in ipip_err
  tap: double-free in error path in tap_open()
  net/unix: don't show information about sockets from other namespaces
  tcp/dccp: fix other lockdep splats accessing ireq_opt
  tcp/dccp: fix lockdep splat in inet_csk_route_req()
  sctp: full support for ipv6 ip_nonlocal_bind & IP_FREEBIND
  ipv6: flowlabel: do not leave opt->tot_len with garbage
  soreuseport: fix initialization race
  packet: avoid panic in packet_getsockopt()
  tcp/dccp: fix ireq->opt races
  sctp: add the missing sock_owned_by_user check in sctp_icmp_redirect
  tun: call dev_get_valid_name() before register_netdevice()
  l2tp: check ps->sock before running pppol2tp_session_ioctl()
  tcp: fix tcp_mtu_probe() vs highest_sack
  net: call cgroup_sk_alloc() earlier in sk_clone_lock()
  netlink: do not set cb_running if dump's start() errs
  ipv6: addrconf: increment ifp refcount before ipv6_del_addr()
  tun/tap: sanitize TUNSETSNDBUF input
  gso: fix payload length when gso_size is zero
  FROMLIST: binder: fix proc->files use-after-free

Conflicts:
	drivers/scsi/ufs/ufshcd.h
	include/net/netfilter/nf_conntrack.h

Change-Id: I38fd3aa5f077a7bde0a8de4ebe9dc9316075f199
Signed-off-by: Kyle Yan <kyan@codeaurora.org>
2017-11-29 13:12:37 -08:00
Linux Build Service Account
d587366749 Merge "Bluetooth: Fix for checking proper user-supplied buffers" 2017-11-28 15:06:47 -08:00
Balvinder Singh
c6f0381a64 Bluetooth: Fix for checking proper user-supplied buffers
During patch download procedure, size validation and zero
allocation of buffers are done to ensure values passed are
in permissible range.

CRs-fixed: 2082452
Change-Id: I16a46f8c8860296919bf11021143ae36f2964363
Signed-off-by: Balvinder Singh <bpsingh@codeaurora.org>
2017-11-27 18:30:40 +05:30
Leif Liddy
ee61d06653 Bluetooth: btusb: fix QCA Rome suspend/resume
commit fd865802c66bc451dc515ed89360f84376ce1a56 upstream.

There's been numerous reported instances where BTUSB_QCA_ROME
bluetooth controllers stop functioning upon resume from suspend. These
devices seem to be losing power during suspend. Patch will detect a status
change on resume and perform a reset.

Signed-off-by: Leif Liddy <leif.linux@gmail.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Cc: Kai Heng Feng <kai.heng.feng@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-11-21 09:23:21 +01:00
Balvinder Singh
370672f734 [Bluetooth] - Fix for checking proper user-supplied buffers
During patch download of devices, size validations & zero alloc
the buffers to ensure values passed are in range

CRs-fixed: 2084692
Change-Id: Ie1cd76fe68766d6d12d7262202e48c18ebe42274
Signed-off-by: Balvinder Singh <bpsingh@codeaurora.org>
2017-11-07 00:52:30 -08:00
Kyle Yan
aac1cbd0b0 Merge remote-tracking branch '4.9/tmp-fd67b2f' into msm-4.9
* 4.9/tmp-fd67b2f:
  Linux 4.9.58
  usb: dwc3: gadget: Correct ISOC DATA PIDs for short packets
  cpufreq: CPPC: add ACPI_PROCESSOR dependency
  EDAC, mce_amd: Print IPID and Syndrome on a separate line
  btmrvl: avoid double-disable_irq() race
  regulator: core: Resolve supplies before disabling unused regulators
  drm/nouveau/gr/gf100-: fix ccache error logging
  powerpc/perf: Add restrictions to PMC5 in power9 DD1
  nfsd/callback: Cleanup callback cred on shutdown
  hrtimer: Catch invalid clockids again
  target/iscsi: Fix unsolicited data seq_end_offset calculation
  IB/hfi1: Allocate context data on memory node
  IB/hfi1: Use static CTLE with Preset 6 for integrated HFIs
  uapi: fix linux/mroute6.h userspace compilation errors
  uapi: fix linux/rds.h userspace compilation errors
  ceph: clean up unsafe d_parent accesses in build_dentry_path
  ceph: fix bogus endianness change in ceph_ioctl_set_layout
  ceph: don't update_dentry_lease unless we actually got one
  i2c: at91: ensure state is restored after suspending
  qed: Read queue state before releasing buffer
  qed: Reserve doorbell BAR space for present CPUs
  qede: Prevent index problems in loopback test
  net: mvpp2: release reference to txq_cpu[] entry after unmapping
  drm/amdgpu: refuse to reserve io mem for split VRAM buffers
  ASoC: mediatek: add I2C dependency for CS42XX8
  scsi: scsi_dh_emc: return success in clariion_std_inquiry()
  slub: do not merge cache if slub_debug contains a never-merge flag
  ocfs2/dlmglue: prepare tracking logic to avoid recursive cluster lock
  mm/memory_hotplug: set magic number to page->freelist instead of page->lru.next
  crypto: xts - Add ECB dependency
  net/mlx4_core: Fix VF overwrite of module param which disables DMFS on new probed PFs
  sparc64: Migrate hvcons irq to panicked cpu
  md/linear: shutup lockdep warnning
  f2fs: do not wait for writeback in write_begin
  Btrfs: send, fix failure to rename top level inode due to name collision
  sched/fair: Update rq clock before changing a task's CPU affinity
  f2fs: do SSR for data when there is enough free space
  iio: adc: xilinx: Fix error handling
  netfilter: nf_ct_expect: Change __nf_ct_expect_check() return value.
  staging: vchiq_2835_arm: Make cache-line-size a required DT property
  net/mlx4_en: fix overflow in mlx4_en_init_timestamp()
  mac80211: fix power saving clients handling in iwlwifi
  qed: Don't use attention PTT for configuring BW
  ALSA: hda: Add Geminilake HDMI codec ID
  mac80211_hwsim: check HWSIM_ATTR_RADIO_NAME length
  initramfs: finish fput() before accessing any binary from initramfs
  irqchip/crossbar: Fix incorrect type of local variables
  watchdog: kempld: fix gcc-4.3 build
  locking/lockdep: Add nest_lock integrity test
  xen-netback: Use GFP_ATOMIC to allocate hash
  Revert "bsg-lib: don't free job in bsg_prepare_job"
  MIPS: Fix minimum alignment requirement of IRQ stack

Change-Id: I69d2e97df2f9c12da893aa57c6ebe748724edcf7
Signed-off-by: Kyle Yan <kyan@codeaurora.org>
2017-10-23 17:37:25 -07:00
Jeffy Chen
8a7a752441 btmrvl: avoid double-disable_irq() race
[ Upstream commit 9af02d86e11dc409e5c3de46e81c0a492ba58905 ]

It's much the same as what we did for mwifiex in:
b9da4d2 mwifiex: avoid double-disable_irq() race

"We have a race where the wakeup IRQ might be in flight while we're
calling mwifiex_disable_wake() from resume(). This can leave us
disabling the IRQ twice.

Let's disable the IRQ and enable it in case if we have double-disabled
it."

Signed-off-by: Jeffy Chen <jeffy.chen@rock-chips.com>
Reviewed-by: Brian Norris <briannorris@chromium.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-10-21 17:21:38 +02:00
Kyle Yan
e5f5ad181e Merge remote-tracking branch '4.9/tmp-f7d2974' into msm-4.9
* 4.9/tmp-f7d2974:
  Linux 4.9.50
  xfs: XFS_IS_REALTIME_INODE() should be false if no rt device present
  NFS: Sync the correct byte range during synchronous writes
  NFS: Fix 2 use after free issues in the I/O code
  ARM: 8692/1: mm: abort uaccess retries upon fatal signal
  ARM64: dts: marvell: armada-37xx: Fix GIC maintenance interrupt
  Bluetooth: Properly check L2CAP config option output buffer length
  ALSA: msnd: Optimize / harden DSP and MIDI loops
  locktorture: Fix potential memory leak with rw lock test
  mm/memory.c: fix mem_cgroup_oom_disable() call missing
  selftests/x86/fsgsbase: Test selectors 1, 2, and 3
  btrfs: resume qgroup rescan on rw remount
  nvme-fabrics: generate spec-compliant UUID NQNs
  mtd: nand: qcom: fix config error for BCH
  mtd: nand: qcom: fix read failure without complete bootchain
  mtd: nand: mxc: Fix mxc_v1 ooblayout
  ANDROID: commoncap: Begin to warn users of implicit PARANOID_NETWORK capability grants
  Linux 4.9.49
  drm/bridge: adv7511: Switch to using drm_kms_helper_hotplug_event()
  drm/bridge: adv7511: Use work_struct to defer hotplug handing to out of irq context
  scsi: sg: recheck MMAP_IO request length with lock held
  scsi: sg: protect against races between mmap() and SG_SET_RESERVED_SIZE
  cs5536: add support for IDE controller variant
  workqueue: Fix flag collision
  drm/nouveau/pci/msi: disable MSI on big-endian platforms by default
  s390/mm: avoid empty zero pages for KVM guests to avoid postcopy hangs
  MCB: add support for SC31 to mcb-lpc
  mwifiex: correct channel stat buffer overflows
  dlm: avoid double-free on error path in dlm_device_{register,unregister}
  iwlwifi: pci: add new PCI ID for 7265D
  Bluetooth: Add support of 13d3:3494 RTL8723BE device
  rtlwifi: rtl_pci_probe: Fix fail path of _rtl_pci_find_adapter
  Input: trackpoint - assume 3 buttons when buttons detection fails
  ath10k: fix memory leak in rx ring buffer allocation
  intel_th: pci: Add Cannon Lake PCH-LP support
  intel_th: pci: Add Cannon Lake PCH-H support
  driver core: bus: Fix a potential double free
  iio: adc: ti-ads1015: add adequate wait time to get correct conversion
  iio: adc: ti-ads1015: don't return invalid value from buffer setup callbacks
  iio: adc: ti-ads1015: avoid getting stale result after runtime resume
  iio: adc: ti-ads1015: enable conversion when CONFIG_PM is not set
  iio: adc: ti-ads1015: fix scale information for ADS1115
  iio: adc: ti-ads1015: fix incorrect data rate setting update
  staging/rts5208: fix incorrect shift to extract upper nybble
  USB: core: Avoid race of async_completed() w/ usbdev_release()
  USB: musb: fix external abort on suspend
  usb:xhci:Fix regression when ATI chipsets detected
  usb: Add device quirk for Logitech HD Pro Webcam C920-C
  USB: serial: option: add support for D-Link DWM-157 C1
  usb: quirks: add delay init quirk for Corsair Strafe RGB keyboard
  ANDROID: sdcardfs: Add missing break
  ANDROID: Sdcardfs: Move gid derivation under flag
  ANDROID: mnt: Fix freeing of mount data
  ANDROID: configs: require SYNC_FILE

Change-Id: I67da9ef4d1637a9fddbf7b96f6f59037faee9015
Signed-off-by: Kyle Yan <kyan@codeaurora.org>
2017-09-19 12:07:46 -07:00
Dmitry Tunin
7475626195 Bluetooth: Add support of 13d3:3494 RTL8723BE device
commit a81d72d2002d6a932bd83022cbf8c442b1b97512 upstream.

T: Bus=02 Lev=01 Prnt=01 Port=03 Cnt=03 Dev#= 4 Spd=12 MxCh= 0
D: Ver= 2.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1
P: Vendor=13d3 ProdID=3494 Rev= 2.00
S: Manufacturer=Realtek
S: Product=Bluetooth Radio
S: SerialNumber=00e04c000001
C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=500mA
I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms
E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms
E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms
I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms
E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms
I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms
E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms
I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms
E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms
I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms
E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms
I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms
E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms
I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms
E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms

Signed-off-by: Dmitry Tunin <hanipouspilot@gmail.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-09-09 17:39:40 +02:00
Satish Kodishala
d9ee8610eb Enable multi-channel bit for SCO Tx with water mark level 1
Enabling multi-channel bit for SCO Tx is required to fix
random 0s getting inserted. Set water mark level 1 for
SCO Tx only.

CRs-Fixed: 2094921
Change-Id: Ic26ef47478ed2ae8edb05aeaec182bb170c4f32d
Signed-off-by: Satish Kodishala <skodisha@codeaurora.org>
2017-08-20 12:32:50 +05:30
Rupesh Tatiya
fc057b5125 btfm: Correct the slimbus turn on/off sequence for FM ports
change sequence of FM slave port close to be called after
LPASS port close (remove hw_free),use watermark level of 8
for FM slave ports and don't reset the watermark to 0
upon port disable.

Change-Id: Ie785715c2b92dae6b46b346bebd45e044f54ea53
Signed-off-by: Rupesh Tatiya <rtatiya@codeaurora.org>
2017-08-14 18:56:21 -07:00
Satish Kodishala
8e4e962008 btfm: provide a way to query wcn3990 status
provide a way to query wcn3990 status. Audio hal
uses this to cleanup its stack when BT is turned off
or SCO is disconnected during SCO devices selection.

CRs-Fixed: 2061191
Change-Id: I3c10559c6ca34692c7f147b5cc2f0101b0bfbbf9
Signed-off-by: Satish Kodishala <skodisha@codeaurora.org>
2017-08-10 20:48:41 -07:00
Satish Kodishala
5095e40d4c btfm: Enable multichannel bit for SCO Rx
Enable multichannel bit for SCO Rx to fix random 0 bytes
insertion in SCO.

CRs-Fixed: 2063152
Change-Id: I6abe986251d042ef70701b614b8cef0ee1e30044
Signed-off-by: Satish Kodishala <skodisha@codeaurora.org>
2017-08-10 17:15:30 +05:30
Satish kumar sugasi
bcf528a84b btfm: cleanup slimbus device node in failure scenerios
Invokes unregister BTFM slimbus dev node entries in alsa
core driver in any failure cases  during slimbus probe

Change-Id: I4fec73fa1ad6b2cfb547c3c8086f74acdce12057
Signed-off-by: Satish kumar sugasi <ssugas@codeaurora.org>
2017-08-03 16:49:28 -07:00
Satish Kodishala
93194f83e4 btfm: Don't program multi channel registers in wcn3990 for SCO
For SCO use cases, we should not program multi chanel
registers. Programming this leading to silence randomly
in SCO Rx/Tx.

CRs-Fixed: 2048423
Change-Id: I5e41591fb81b5bd3cf9358819c0a62a5cfe60e13
Signed-off-by: Satish Kodishala <skodisha@codeaurora.org>
2017-07-23 18:42:40 -07:00
Rupesh Tatiya
03a5d4f931 btfm: Fix coding error with uninitialized variables
These errors might result in access of uninitialized memory leading to
kernel panic.

Change-Id: I24da5aecd15bd1918e9caf669ed341155a41d6a3
Signed-off-by: Rupesh Tatiya <rtatiya@codeaurora.org>
2017-07-23 18:42:08 -07:00
Satish Kodishala
75fa666567 btfm: Program multi channel registers in wcn3990 for Tx/Rx
For A2DP/SCO Rx, SCO/FM Tx use cases, we need to program
multi channel registers. Without this there would be
glitches and random silence during A2DP playback.

While at it, add the function name to the debug print macro.

CRs-Fixed: 2027268
Change-Id: Ia8e5fde48bb94e97346fe323e92dc32ed60b0e65
Signed-off-by: Satish Kodishala <skodisha@codeaurora.org>
2017-07-23 18:41:41 -07:00
Rupesh Tatiya
6fdd3f0ed0 btfm: set watermark level to 3 for wcn3990 slimbus FM slave ports
Without this, we hear silence or delay in sound during FM playback in
following use cases -
1. Switching between FM and media applications like YouTube
2. Changing volume during FM FTM

Change-Id: I51072ab70e6bc34e1ed10222ee289d987ed9ffbf
Signed-off-by: Rupesh Tatiya <rtatiya@codeaurora.org>
2017-07-23 18:41:07 -07:00
Rupesh Tatiya
795ac6ea83 btfm: Close 3990 FM tx ports first and keep overflow bit always set
Close data source ports i.e. wcn3990 tx ports before data sink ports i.e.
AFE for FM tx case. Also, do not set wcn3990 overflow/underflow registers
to 0 during channel disable path. This causes audio loss if audio focus
is lost during FM playback.

Change-Id: Id6c8ee145bf7feb8681851499ba36b708667b4ef
Signed-off-by: Rupesh Tatiya <rtatiya@codeaurora.org>
2017-07-23 18:40:28 -07:00
Sungjun Park
9b33e94e3a bluetooth: Fix slimbus shutdown sequence
During slimbus shutdown process, registered codec
driver callback has been implemented in wrong seqeunce.
So, it causes audio data overflow and impact on next
audio streaming. To correct the sequence, slimbus port
disable routine should be performed when WCN codec shutdown
callback is called.

Change-Id: Id6ef22c34066adbb5b28bc31e605776c467bf03c
Signed-off-by: Sungjun Park <sjpark@codeaurora.org>
2017-07-23 18:38:57 -07:00
Rupesh Tatiya
3815c79d45 Bluetooth: Enhance logging in btfm slim & audio codec drivers
Add dai name & slim port numbers for better logs for debugging. Remove
function name from pr_debug as it can be enabled by dynamic debugging.

Change-Id: If9c300e1fe22680e98dd29aadfd2bf3b8c2b5624
Signed-off-by: Rupesh Tatiya <rtatiya@codeaurora.org>
2017-06-08 09:39:01 -07:00
Kyle Yan
2bffbf18f4 Merge remote-tracking branch '4.9/tmp-33c4c2a' into 4.9
* 4.9/tmp-33c4c2a:
  Linux 4.9.29
  pstore: Shut down worker when unregistering
  pstore: Fix flags to enable dumps on powerpc
  libnvdimm, pfn: fix 'npfns' vs section alignment
  libnvdimm, pmem: fix a NULL pointer BUG in nd_pmem_notify
  libnvdimm, region: fix flush hint detection crash
  ipmi: Fix kernel panic at ipmi_ssif_thread()
  Bluetooth: hci_intel: add missing tty-device sanity check
  Bluetooth: hci_bcm: add missing tty-device sanity check
  Bluetooth: Fix user channel for 32bit userspace on 64bit kernel
  tty: pty: Fix ldisc flush after userspace become aware of the data already
  serial: omap: suspend device on probe errors
  serial: omap: fix runtime-pm handling on unbind
  serial: samsung: Use right device for DMA-mapping calls
  fscrypt: fix context consistency check when key(s) unavailable
  device-dax: fix cdev leak
  padata: free correct variable
  CIFS: add misssing SFM mapping for doublequote
  cifs: fix CIFS_IOC_GET_MNT_INFO oops
  CIFS: fix oplock break deadlocks
  cifs: fix CIFS_ENUMERATE_SNAPSHOTS oops
  cifs: fix leak in FSCTL_ENUM_SNAPS response handling
  CIFS: fix mapping of SFM_SPACE and SFM_PERIOD
  SMB3: Work around mount failure when using SMB3 dialect to Macs
  Set unicode flag on cifs echo request to avoid Mac error
  Fix match_prepath()
  mm: prevent potential recursive reclaim due to clearing PF_MEMALLOC
  fs/block_dev: always invalidate cleancache in invalidate_bdev()
  ceph: fix memory leak in __ceph_setxattr()
  fs/xattr.c: zero out memory copied to userspace in getxattr
  orangefs: do not check possibly stale size on truncate
  orangefs: do not set getattr_time on orangefs_lookup
  orangefs: clean up oversize xattr validation
  orangefs: fix bounds check for listxattr
  ext4: evict inline data when writing to memory map
  perf auxtrace: Fix no_size logic in addr_filter__resolve_kernel_syms()
  IB/hfi1: Prevent kernel QP post send hard lockups
  IB/mlx4: Reduce SRIOV multicast cleanup warning message to debug level
  IB/mlx4: Fix ib device initialization error flow
  IB/IPoIB: ibX: failed to create mcg debug file
  IB/core: For multicast functions, verify that LIDs are multicast LIDs
  IB/core: Fix sysfs registration error flow
  iov_iter: don't revert iov buffer if csum error
  vfio/type1: Remove locked page accounting workqueue
  dm thin: fix a memory leak when passing discard bio down
  dm rq: check blk_mq_register_dev() return value in dm_mq_init_request_queue()
  dm era: save spacemap metadata root after the pre-commit
  crypto: ccp - Change ISR handler method for a v5 CCP
  crypto: ccp - Change ISR handler method for a v3 CCP
  crypto: ccp - Disable interrupts early on unload
  crypto: ccp - Use only the relevant interrupt bits
  crypto: algif_aead - Require setkey before accept(2)
  block: fix blk_integrity_register to use template's interval_exp if not 0
  arm64: KVM: Fix decoding of Rt/Rt2 when trapping AArch32 CP accesses
  KVM: arm/arm64: fix races in kvm_psci_vcpu_on
  KVM: x86: fix user triggerable warning in kvm_apic_accept_events()
  perf/x86: Fix Broadwell-EP DRAM RAPL events
  um: Fix PTRACE_POKEUSER on x86_64
  x86, pmem: Fix cache flushing for iovec write < 8 bytes
  selftests/x86/ldt_gdt_32: Work around a glibc sigaction() bug
  x86/boot: Fix BSS corruption/overwrite bug in early x86 kernel startup
  usb: hub: Do not attempt to autosuspend disconnected devices
  usb: hub: Fix error loop seen after hub communication errors
  usb: Make sure usb/phy/of gets built-in
  usb: gadget: legacy gadgets are optional
  usb: misc: add missing continue in switch
  staging: comedi: jr3_pci: cope with jiffies wraparound
  staging: comedi: jr3_pci: fix possible null pointer dereference
  staging: gdm724x: gdm_mux: fix use-after-free on module unload
  staging: vt6656: use off stack for out buffer USB transfers.
  staging: vt6656: use off stack for in buffer USB transfers.
  USB: Revert "cdc-wdm: fix "out-of-sync" due to missing notifications"
  USB: Proper handling of Race Condition when two USB class drivers try to call init_usb_class simultaneously
  USB: serial: ftdi_sio: add device ID for Microsemi/Arrow SF2PLUS Dev Kit
  usb: host: xhci: print correct command ring address
  usb: xhci: bInterval quirk for TI TUSB73x0
  iscsi-target: Set session_fall_back_to_erl0 when forcing reinstatement
  target/fileio: Fix zero-length READ and WRITE handling
  target: Fix compare_and_write_callback handling for non GOOD status
  xen: adjust early dom0 p2m handling to xen hypervisor behavior
  ANDROID: sdcardfs: Move top to its own struct
  ANDROID: lowmemorykiller: account for unevictable pages
  ANDROID: usb: gadget: fix NULL pointer issue in mtp_read()
  ANDROID: usb: f_mtp: return error code if transfer error in receive_file_work function

Conflicts:
	drivers/usb/gadget/function/f_mtp.c

Change-Id: If59a6f49fe2f8f3ed93e2c53ce6c71b35eab4dbb
Signed-off-by: Kyle Yan <kyan@codeaurora.org>
2017-05-22 11:32:55 -07:00
Johan Hovold
6e7de39ef9 Bluetooth: hci_intel: add missing tty-device sanity check
commit dcb9cfaa5ea9aa0ec08aeb92582ccfe3e4c719a9 upstream.

Make sure to check the tty-device pointer before looking up the sibling
platform device to avoid dereferencing a NULL-pointer when the tty is
one end of a Unix98 pty.

Fixes: 74cdad37cd ("Bluetooth: hci_intel: Add runtime PM support")
Fixes: 1ab1f239bf ("Bluetooth: hci_intel: Add support for platform driver")
Cc: Loic Poulain <loic.poulain@intel.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-05-20 14:28:41 +02:00
Johan Hovold
f2f6d77fab Bluetooth: hci_bcm: add missing tty-device sanity check
commit 95065a61e9bf25fb85295127fba893200c2bbbd8 upstream.

Make sure to check the tty-device pointer before looking up the sibling
platform device to avoid dereferencing a NULL-pointer when the tty is
one end of a Unix98 pty.

Fixes: 0395ffc1ee ("Bluetooth: hci_bcm: Add PM for BCM devices")
Cc: Frederic Danis <frederic.danis@linux.intel.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-05-20 14:28:41 +02:00
Kyle Yan
90ed47f1fa Merge remote-tracking branch '4.9/tmp-47c0adf' into 4.9
* 4.9/tmp-47c0adf:
  Linux 4.9.15
  drivers: hv: Turn off write permission on the hypercall page
  fat: fix using uninitialized fields of fat_inode/fsinfo_inode
  mm: do not call mem_cgroup_free() from within mem_cgroup_alloc()
  thp: fix another corner case of munlock() vs. THPs
  x86/tlb: Fix tlb flushing when lguest clears PGE
  x86, mm: fix gup_pte_range() vs DAX mappings
  libceph: use BUG() instead of BUG_ON(1)
  drm/i915: Fix not finding the VBT when it overlaps with OPREGION_ASLE_EXT
  drm/i915: Avoid spurious WARNs about the wrong pipe in the PPS code
  drm: Cancel drm_fb_helper_resume_work on unload
  drm: Cancel drm_fb_helper_dirty_work on unload
  drm/i915/gvt: Disable access to stolen memory as a guest
  drm/atomic: fix an error code in mode_fixup()
  drm/imx: imx-tve: Do not set the regulator voltage
  dmaengine: imx-sdma - correct the dma transfer residue calculation
  drm/vmwgfx: Work around drm removal of control nodes
  drm/ttm: Make sure BOs being swapped out are cacheable
  drm/edid: Add EDID_QUIRK_FORCE_8BPC quirk for Rotel RSX-1058
  drm/ast: Fix AST2400 POST failure without BMC FW or VBIOS
  drm/ast: Call open_key before enable_mmio in POST code
  drm/ast: Fix test for VGA enabled
  drm/amdgpu: add more cases to DCE11 possible crtc mask setup
  mac80211: use driver-indicated transmitter STA only for data frames
  mac80211: don't handle filtered frames within a BA session
  mac80211: don't reorder frames with SN smaller than SSN
  mac80211: flush delayed work when entering suspend
  nfit, libnvdimm: fix interleave set cookie calculation
  xtensa: move parse_tag_fdt out of #ifdef CONFIG_BLK_DEV_INITRD
  pwm: pca9685: Fix period change with same duty cycle
  nlm: Ensure callback code also checks that the files match
  drivers/pci/hotplug: Fix initial state for empty slot
  drivers/pci/hotplug: Handle presence detection change properly
  target: Fix NULL dereference during LUN lookup + active I/O shutdown
  pci/hotplug/pnv-php: Disable surprise hotplug capability on conflicts
  pci/hotplug/pnv-php: Remove WARN_ON() in pnv_php_put_slot()
  ceph: remove req from unsafe list when unregistering it
  ktest: Fix child exit code processing
  memory/atmel-ebi: Fix ns <-> cycles conversions
  orangefs: Use RCU for destroy_inode
  fs: Better permission checking for submounts
  IB/srp: Fix race conditions related to task management
  IB/srp: Avoid that duplicate responses trigger a kernel bug
  IB/SRP: Avoid using IB_MR_TYPE_SG_GAPS
  IB/mlx5: Fix out-of-bound access
  IB/IPoIB: Add destination address when re-queue packet
  IB/ipoib: Fix deadlock between rmmod and set_mode
  mnt: Tuck mounts under others instead of creating shadow/side mounts.
  brcmfmac: fix incorrect event channel deduction
  cxl: fix nested locking hang during EEH hotplug
  cxl: Prevent read/write to AFU config space while AFU not configured
  net: mvpp2: fix DMA address calculation in mvpp2_txq_inc_put()
  s390: use correct input data address for setup_randomness
  s390: make setup_randomness work
  s390: TASK_SIZE for kernel threads
  s390/chsc: Add exception handler for CHSC instruction
  s390/kdump: Use "LINUX" ELF note name instead of "CORE"
  s390/dcssblk: fix device size calculation in dcssblk_direct_access()
  s390/qdio: clear DSCI prior to scanning multiple input queues
  Bluetooth: Add another AR3012 04ca:3018 device
  KVM: VMX: use correct vmcs_read/write for guest segment selector/base
  KVM: s390: Disable dirty log retrieval for UCONTROL guests
  serial: 8250_pci: Add MKS Tenta SCOM-0800 and SCOM-0801 cards
  tty: n_hdlc: get rid of racy n_hdlc.tbuf
  uid_sys_stats: change to use rt_mutex
  ANDROID: uid_sys_stats: account for fsync syscalls
  ANDROID: sched: add a counter to track fsync
  ANDROID: uid_sys_stats: fix negative write bytes.
  ANDROID: uid_sys_stats: allow writing same state
  ANDROID: uid_sys_stats: rename uid_cputime.c to uid_sys_stats.c
  ANDROID: uid_cputime: add per-uid IO usage accounting
  ANDROID: sched/walt: Fix missing locking in WALT port
  UPSTREAM: arm64: Allow hw watchpoint of length 3,5,6 and 7
  UPSTREAM: arm64: hw_breakpoint: Handle inexact watchpoint addresses
  UPSTREAM: arm64: Allow hw watchpoint at varied offset from base address
  UPSTREAM: hw_breakpoint: Allow watchpoint of length 3,5,6 and 7
  ANDROID: usb: gadget: f_accessory: Fix for UsbAccessory clean unbind.
  ANDROID: nf: IDLETIMER: Use fullsock when querying uid
  ANDROID: Replace spaces by '_' for some android filesystem tracepoints.

Conflicts:
	kernel/sched/core.c
	kernel/sched/fair.c

Change-Id: I31ee14ac15765dbb5fe53800d2c39224131287b0
Signed-off-by: Kyle Yan <kyan@codeaurora.org>
2017-03-15 13:38:21 -07:00
Dmitry Tunin
519b6cead2 Bluetooth: Add another AR3012 04ca:3018 device
commit 441ad62d6c3f131f1dbd7dcdd9cbe3f74dbd8501 upstream.

T:  Bus=01 Lev=01 Prnt=01 Port=07 Cnt=04 Dev#=  5 Spd=12  MxCh= 0
D:  Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
P:  Vendor=04ca ProdID=3018 Rev=00.01
C:  #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
I:  If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
I:  If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb

Signed-off-by: Dmitry Tunin <hanipouspilot@gmail.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-03-15 10:02:40 +08:00
Mahesh Kumar Sharma
41a4d38124 bluetooth: Add snapshot of bluetooth drivers
Add snapshot of bluetooth drivers from msm-4.4 branch
at the below commit level:

commit c03f0ace8a36 ("msm: ipa: enable suspend pipe for ODU")

Change-Id: Icd81508fdcfe35e76a4bf0b501483a997c66f4f4
Signed-off-by: Mahesh Kumar Sharma <smahesh@codeaurora.org>
2017-02-10 21:38:54 -08:00
Jacob Siverskog
6add49fff9 Bluetooth: btwilink: Fix probe return value
Probe functions should return 0 on success. This driver's probe
returns the value returned by hci_register_dev(), which is the hci
index. This works for systems with only one hci device (id = 0) but
for systems where the btwilink device ends up with an id larger than
0, things will start to fall apart.

Make the probe function return 0 on success.

Signed-off-by: Jacob Siverskog <jacob@teenage.engineering>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2016-10-20 10:14:49 +02:00
Jérôme de Bretagne
5e2bd93b8f Bluetooth: hci_bcm: Fix autosuspend PM for Lenovo ThinkPad 8
ACPI table for BCM2E55 of Lenovo ThinkPad 8 is not correct.
Set correctly IRQ polarity for this device, fixing the issue of bluetooth
never resuming after autosuspend PM.

Signed-off-by: Jérôme de Bretagne <jerome.debretagne@gmail.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2016-10-13 09:27:01 +02:00
Ethan Hsieh
c7e163fe28 Bluetooth: btusb: Fix atheros firmware download error
Move usb_autopm_get_interface() ahead of setup_on_usb() to prevent
device from sending usb control message in usb suspend mode.

The error message is as below:

[   83.944103] btusb 1-2:1.1: usb_suspend_interface: status 0
[   83.944107] btusb 1-2:1.0: usb_suspend_interface: status 0
[   83.960132] usb 1-2: usb auto-suspend, wakeup 0
[   83.976156] usb 1-2: usb_suspend_device: status 0
[   83.976162] usb 1-2: usb_suspend_both: status 0
[  298.689106] Bluetooth: hci0
[  298.689399] Bluetooth: hci0: Failed to access otp area (-113)

Signed-off-by: Ethan Hsieh <ethan.hsieh@canonical.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2016-10-07 09:46:56 +02:00
Amitkumar Karwar
1165df0ee4 Bluetooth: btusb: add entry for Marvell 8997 chipset
btusb_set_bdaddr_marvell() configures BD address for Marvell chipsets.
This patch adds new chipset 8997 in the list so that BD address feature
would be available for it.

Signed-off-by: Amitkumar Karwar <akarwar@marvell.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2016-10-06 11:52:29 +02:00
Linus Torvalds
687ee0ad4e Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next
Pull networking updates from David Miller:

 1) BBR TCP congestion control, from Neal Cardwell, Yuchung Cheng and
    co. at Google. https://lwn.net/Articles/701165/

 2) Do TCP Small Queues for retransmits, from Eric Dumazet.

 3) Support collect_md mode for all IPV4 and IPV6 tunnels, from Alexei
    Starovoitov.

 4) Allow cls_flower to classify packets in ip tunnels, from Amir Vadai.

 5) Support DSA tagging in older mv88e6xxx switches, from Andrew Lunn.

 6) Support GMAC protocol in iwlwifi mwm, from Ayala Beker.

 7) Support ndo_poll_controller in mlx5, from Calvin Owens.

 8) Move VRF processing to an output hook and allow l3mdev to be
    loopback, from David Ahern.

 9) Support SOCK_DESTROY for UDP sockets. Also from David Ahern.

10) Congestion control in RXRPC, from David Howells.

11) Support geneve RX offload in ixgbe, from Emil Tantilov.

12) When hitting pressure for new incoming TCP data SKBs, perform a
    partial rathern than a full purge of the OFO queue (which could be
    huge). From Eric Dumazet.

13) Convert XFRM state and policy lookups to RCU, from Florian Westphal.

14) Support RX network flow classification to igb, from Gangfeng Huang.

15) Hardware offloading of eBPF in nfp driver, from Jakub Kicinski.

16) New skbmod packet action, from Jamal Hadi Salim.

17) Remove some inefficiencies in snmp proc output, from Jia He.

18) Add FIB notifications to properly propagate route changes to
    hardware which is doing forwarding offloading. From Jiri Pirko.

19) New dsa driver for qca8xxx chips, from John Crispin.

20) Implement RFC7559 ipv6 router solicitation backoff, from Maciej
    Żenczykowski.

21) Add L3 mode to ipvlan, from Mahesh Bandewar.

22) Support 802.1ad in mlx4, from Moshe Shemesh.

23) Support hardware LRO in mediatek driver, from Nelson Chang.

24) Add TC offloading to mlx5, from Or Gerlitz.

25) Convert various drivers to ethtool ksettings interfaces, from
    Philippe Reynes.

26) TX max rate limiting for cxgb4, from Rahul Lakkireddy.

27) NAPI support for ath10k, from Rajkumar Manoharan.

28) Support XDP in mlx5, from Rana Shahout and Saeed Mahameed.

29) UDP replicast support in TIPC, from Richard Alpe.

30) Per-queue statistics for qed driver, from Sudarsana Reddy Kalluru.

31) Support BQL in thunderx driver, from Sunil Goutham.

32) TSO support in alx driver, from Tobias Regnery.

33) Add stream parser engine and use it in kcm.

34) Support async DHCP replies in ipconfig module, from Uwe
    Kleine-König.

35) DSA port fast aging for mv88e6xxx driver, from Vivien Didelot.

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next: (1715 commits)
  mlxsw: switchx2: Fix misuse of hard_header_len
  mlxsw: spectrum: Fix misuse of hard_header_len
  net/faraday: Stop NCSI device on shutdown
  net/ncsi: Introduce ncsi_stop_dev()
  net/ncsi: Rework the channel monitoring
  net/ncsi: Allow to extend NCSI request properties
  net/ncsi: Rework request index allocation
  net/ncsi: Don't probe on the reserved channel ID (0x1f)
  net/ncsi: Introduce NCSI_RESERVED_CHANNEL
  net/ncsi: Avoid unused-value build warning from ia64-linux-gcc
  net: Add netdev all_adj_list refcnt propagation to fix panic
  net: phy: Add Edge-rate driver for Microsemi PHYs.
  vmxnet3: Wake queue from reset work
  i40e: avoid NULL pointer dereference and recursive errors on early PCI error
  qed: Add RoCE ll2 & GSI support
  qed: Add support for memory registeration verbs
  qed: Add support for QP verbs
  qed: PD,PKEY and CQ verb support
  qed: Add support for RoCE hw init
  qede: Add qedr framework
  ...
2016-10-05 10:11:24 -07:00
Linus Torvalds
e6445f52d9 Merge tag 'usb-4.9-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb
Pull usb/phy/extcon updates from Greg KH:
 "Here is the big USB, and PHY, and extcon, patchsets for 4.9-rc1.

  Full details are in the shortlog, but generally a lot of new hardware
  support, usb gadget updates, and Wolfram's great cleanup of USB error
  message handling, making the kernel image a tad bit smaller.

  All of this has been in linux-next with no reported issues"

* tag 'usb-4.9-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (343 commits)
  Revert "usbtmc: convert to devm_kzalloc"
  USB: serial: cp210x: Add ID for a Juniper console
  usb: Kconfig: using select for USB_COMMON dependency
  bluetooth: bcm203x: don't print error when allocating urb fails
  mmc: host: vub300: don't print error when allocating urb fails
  usb: hub: change CLEAR_FEATURE to SET_FEATURE
  usb: core: Introduce a USB port LED trigger
  USB: bcma: drop Northstar PHY 2.0 initialization code
  usb: core: hcd: add missing header dependencies
  usb: musb: da8xx: fix error handling message in probe
  usb: musb: Fix session based PM for first invalid VBUS
  usb: musb: Fix PM runtime for disconnect after unconfigure
  musb: Export musb_root_disconnect for use in modules
  usb: misc: legousbtower: Fix NULL pointer deference
  cdc-acm: hardening against malicious devices
  Revert "usb: gadget: NCM: Protect dev->port_usb using dev->lock"
  include: extcon: Fix compilation error caused because of incomplete merge
  MAINTAINERS: add tree entry for USB Serial
  phy-twl4030-usb: initialize charging-related stuff via pm_runtime
  phy-twl4030-usb: better handle musb_mailbox() failure
  ...
2016-10-03 20:17:35 -07:00