This adds the VID/PID combination for the Xbox One version of the Mad
Catz FightStick TE 2.

The functionality that this provides is about on par with what the
Windows drivers for the stick manage to deliver.

What works:
- Digital stick
- 6 main buttons
- Xbox button
- The two buttons on the back
- The locking buttons (preventing accidental Xbox button press)

What doesn't work:
- Two of the main buttons (don't work on Windows either)
- The "Haptic" button setting does not have an effect (not sure if it
  works on Windows)

I added the MAP_TRIGGERS_TO_BUTTONS option but in my (limited) testing
there was no practical difference with or without. The FightStick does
not have triggers though so adding it makes sense.
Signed-off-by: NSilvan Jegen <s.jegen@gmail.com>
Signed-off-by: NDmitry Torokhov <dmitry.torokhov@gmail.com>

The gtco driver expects at least one valid endpoint. If given malicious
descriptors that specify 0 for the number of endpoints, it will crash in
the probe function. Ensure there is at least one endpoint on the interface
before using it.

Also let's fix a minor coding style issue.

The full correct report of this issue can be found in the public
Red Hat Bugzilla:

https://bugzilla.redhat.com/show_bug.cgi?id=1283385Reported-by: NRalf Spenneberg <ralf@spenneberg.net>
Signed-off-by: NVladis Dronov <vdronov@redhat.com>
Cc: stable@vger.kernel.org
Signed-off-by: NDmitry Torokhov <dmitry.torokhov@gmail.com>

During the initialisation the driver uses a buffer on the stack for DMA.
That violates the cache coherency rules. The fix is to allocate the buffer
with kmalloc().
Signed-off-by: NOliver Neukum <ONeukum@suse.com>
Signed-off-by: NDmitry Torokhov <dmitry.torokhov@gmail.com>

The ati_remote2 driver expects at least two interfaces with one
endpoint each. If given malicious descriptor that specify one
interface or no endpoints, it will crash in the probe function.
Ensure there is at least two interfaces and one endpoint for each
interface before using it.

The full disclosure: http://seclists.org/bugtraq/2016/Mar/90Reported-by: NRalf Spenneberg <ralf@spenneberg.net>
Signed-off-by: NVladis Dronov <vdronov@redhat.com>
Cc: stable@vger.kernel.org
Signed-off-by: NDmitry Torokhov <dmitry.torokhov@gmail.com>

Looks like the fimware 8.2 still has the extra buttons spurious release
bug.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=114321
Cc: stable@vger.kernel.org
Signed-off-by: NBenjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: NDmitry Torokhov <dmitry.torokhov@gmail.com>

Originally the irq_mask member of rmi_function was a pointer. Then it was
switched to being a zero length array. However, the checks for a NULL
pointer where not removed.
Signed-off-by: NAndrew Duggan <aduggan@synaptics.com>
Signed-off-by: NDmitry Torokhov <dmitry.torokhov@gmail.com>

The Windows driver's settings dialog contains a visualization of the
regions for the hardware edge scrolling capability, which uses a
temporarily-enabled limited-resolution absolute mode.

This patch enables this during normal operation, and combines the
absolute packets with the existing relative packets to provide
accurate absolute position and touch reporting.

It also adds documentation for all known gesture packets and
initialization commands.
Reviewed-by: NChris Diamand <chris@diamand.org>
Signed-off-by: NRichard Pospesel <pospeselr@gmail.com>
Signed-off-by: NDmitry Torokhov <dmitry.torokhov@gmail.com>

A malicious device missing interface can make the driver oops.
Add sanity checking.
Signed-off-by: NOliver Neukum <ONeukum@suse.com>
CC: stable@vger.kernel.org
Signed-off-by: NDmitry Torokhov <dmitry.torokhov@gmail.com>

Add hw_version sysfs attribute for retrieving hardware information
from firmware.
Signed-off-by: NSangwon Jee <jeesw@melfas.com>
Signed-off-by: NDmitry Torokhov <dmitry.torokhov@gmail.com>

There is a typo so we have && instead of &.

Fixes: ff8f8370 ('Input: synaptics-rmi4 - add support for 2D sensors and F11')
Signed-off-by: NDan Carpenter <dan.carpenter@oracle.com>
Acked-by: NAndrew Duggan <aduggan@synaptics.com>
Signed-off-by: NDmitry Torokhov <dmitry.torokhov@gmail.com>

The powermate driver expects at least one valid USB endpoint in its
probe function.  If given malicious descriptors that specify 0 for
the number of endpoints, it will crash.  Validate the number of
endpoints on the interface before using them.

The full report for this issue can be found here:
http://seclists.org/bugtraq/2016/Mar/85Reported-by: NRalf Spenneberg <ralf@spenneberg.net>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: NJosh Boyer <jwboyer@fedoraproject.org>
Signed-off-by: NDmitry Torokhov <dmitry.torokhov@gmail.com>

On error syscon_regmap_lookup_by_phandle() returns ERR_PTR() value,
which makes a check for NULL invalid and may lead to oops on error
path.
Signed-off-by: NVladimir Zapolskiy <vz@mleia.com>
Signed-off-by: NDmitry Torokhov <dmitry.torokhov@gmail.com>

After the GMBUS transfer times out, we set force_bit=1 and
return -EAGAIN expecting the i2c core to call the .master_xfer
hook again so that we will retry the same transfer via bit-banging.
This is in case the gmbus hardware is somehow faulty.

Unfortunately we left adapter->retries to 0, meaning the i2c core
didn't actually do the retry. Let's tell the core we want one retry
when we return -EAGAIN.

Note that i2c-algo-bit also uses this retry count for some internal
retries, so we'll end up increasing those a bit as well.

Cc: Jani Nikula <jani.nikula@intel.com>
Cc: drm-intel-fixes@lists.freedesktop.org
Fixes: bffce907 ("drm/i915: abstract i2c bit banging fallback in gmbus xfer")
Signed-off-by: NVille Syrjälä <ville.syrjala@linux.intel.com>
Link: http://patchwork.freedesktop.org/patch/msgid/1457366220-29409-2-git-send-email-ville.syrjala@linux.intel.comReviewed-by: NJani Nikula <jani.nikula@intel.com>
(cherry picked from commit 8b1f165a)
Signed-off-by: NJani Nikula <jani.nikula@intel.com>

Add devicetree binding for SPI devices.
Signed-off-by: NAndrew Duggan <aduggan@synaptics.com>
Acked-by: NRob Herring <robh@kernel.org>
Tested-by: NBenjamin Tissoires <benjamin.tissoires@redhat.com>
Tested-by: NLinus Walleij <linus.walleij@linaro.org>
Tested-by: NBjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: NDmitry Torokhov <dmitry.torokhov@gmail.com>

Add the transport driver for devices using RMI4 over SPI.
Signed-off-by: NAndrew Duggan <aduggan@synaptics.com>
Tested-by: NBenjamin Tissoires <benjamin.tissoires@redhat.com>
Tested-by: NLinus Walleij <linus.walleij@linaro.org>
Tested-by: NBjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: NDmitry Torokhov <dmitry.torokhov@gmail.com>

RMI4 F30 supports input from clickpad buttons and controls LEDs located
on the touchpad PCB. This patch adds support of the clickpad buttons and
defers supporting LEDs for the future.
Signed-off-by: NAndrew Duggan <aduggan@synaptics.com>
Signed-off-by: NBenjamin Tissoires <benjamin.tissoires@redhat.com>
Tested-by: NBenjamin Tissoires <benjamin.tissoires@redhat.com>
Tested-by: NLinus Walleij <linus.walleij@linaro.org>
Tested-by: NBjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: NDmitry Torokhov <dmitry.torokhov@gmail.com>

Function 12 implements 2D touch position sensor for newer Synaptics touch
devices. It replaces F11 and no device will contain both functions.
Signed-off-by: NAndrew Duggan <aduggan@synaptics.com>
Signed-off-by: NChristopher Heiny <cheiny@synaptics.com>
Tested-by: NBenjamin Tissoires <benjamin.tissoires@redhat.com>
Tested-by: NLinus Walleij <linus.walleij@linaro.org>
Tested-by: NBjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: NDmitry Torokhov <dmitry.torokhov@gmail.com>

2D sensors have several parameter which can be set in the platform data.
This patch adds support for getting those values from devicetree.
Signed-off-by: NAndrew Duggan <aduggan@synaptics.com>
Tested-by: NBenjamin Tissoires <benjamin.tissoires@redhat.com>
Tested-by: NLinus Walleij <linus.walleij@linaro.org>
Tested-by: NBjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: NDmitry Torokhov <dmitry.torokhov@gmail.com>

RMI4 currently defines two functions for reporting data for 2D sensors
(F11 and F12). This patch adds the common functionality which is shared
by devices with 2D reporting along with implementing functionality for
F11.
Signed-off-by: NAndrew Duggan <aduggan@synaptics.com>
Signed-off-by: NChristopher Heiny <cheiny@synaptics.com>
Tested-by: NBenjamin Tissoires <benjamin.tissoires@redhat.com>
Tested-by: NLinus Walleij <linus.walleij@linaro.org>
Tested-by: NBjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: NDmitry Torokhov <dmitry.torokhov@gmail.com>

Add devicetree binding for I2C devices and add bindings for optional
parameters in the function drivers. Parameters for function drivers are
defined in child nodes for each of the functions.
Signed-off-by: NAndrew Duggan <aduggan@synaptics.com>
Acked-by: NRob Herring <robh@kernel.org>
Tested-by: NBenjamin Tissoires <benjamin.tissoires@redhat.com>
Tested-by: NLinus Walleij <linus.walleij@linaro.org>
Tested-by: NBjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: NDmitry Torokhov <dmitry.torokhov@gmail.com>

Add the transport driver for devices using RMI4 over I2C.
Signed-off-by: NAndrew Duggan <aduggan@synaptics.com>
Signed-off-by: NChristopher Heiny <cheiny@synaptics.com>
Tested-by: NBenjamin Tissoires <benjamin.tissoires@redhat.com>
Tested-by: NLinus Walleij <linus.walleij@linaro.org>
Tested-by: NBjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: NDmitry Torokhov <dmitry.torokhov@gmail.com>

Synaptics uses the Register Mapped Interface (RMI) protocol as a
communications interface for their devices. This driver adds the core
functionality needed to interface with RMI4 devices.

RMI devices can be connected to the host via several transport protocols
and can supports a wide variety of functionality defined by RMI functions.
Support for transport protocols and RMI functions are implemented in
individual drivers. The RMI4 core driver uses a bus architecture to
facilitate the various combinations of transport and function drivers
needed by a particular device.
Signed-off-by: NAndrew Duggan <aduggan@synaptics.com>
Signed-off-by: NChristopher Heiny <cheiny@synaptics.com>
Tested-by: NBenjamin Tissoires <benjamin.tissoires@redhat.com>
Tested-by: NLinus Walleij <linus.walleij@linaro.org>
Tested-by: NBjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: NDmitry Torokhov <dmitry.torokhov@gmail.com>

The legacy media controller userspace API exposes entity types that
carry both type and function information. The new API replaces the type
with a function. It preserves backward compatibility by defining legacy
functions for the existing types and using them in drivers.

This works fine, as long as newer entity functions won't be added.

Unfortunately, some tools, like media-ctl with --print-dot argument
rely on the now legacy MEDIA_ENT_T_V4L2_SUBDEV and MEDIA_ENT_T_DEVNODE
numeric ranges to identify what entities will be shown.

Also, if the entity doesn't match those ranges, it will ignore the
major/minor information on devnodes, and won't be getting the devnode
name via udev or sysfs.

As we're now adding devices outside the old range, the legacy ioctl
needs to map the new entity functions into a type at the old range,
or otherwise we'll have a regression.

Detected on all released media-ctl versions (e. g. versions <= 1.10).

Fix this by deriving the type from the function to emulate the legacy
API if the function isn't in the legacy functions range.
Reported-by: NLaurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@osg.samsung.com>

When computing the residue we need two pieces of information: the current
descriptor and the remaining data of the current descriptor. To get
that information, we need to read consecutively two registers but we
can't do it in an atomic way. For that reason, we have to check manually
that current descriptor has not changed.
Signed-off-by: NLudovic Desroches <ludovic.desroches@atmel.com>
Suggested-by: NCyrille Pitchen <cyrille.pitchen@atmel.com>
Reported-by: NDavid Engraf <david.engraf@sysgo.com>
Tested-by: NDavid Engraf <david.engraf@sysgo.com>
Fixes: e1f7c9ee ("dmaengine: at_xdmac: creation of the atmel
eXtended DMA Controller driver")
Cc: stable@vger.kernel.org #4.1 and later
Signed-off-by: NVinod Koul <vinod.koul@intel.com>

adding unmap of sources and destinations while doing dequeue.
Signed-off-by: NXuelin Shi <xuelin.shi@nxp.com>
Signed-off-by: NVinod Koul <vinod.koul@intel.com>

This fixes BUG triggered when fwnode->secondary is not NULL,
but has ERR_PTR(-ENODEV) instead.

BUG: unable to handle kernel paging request at ffffffffffffffed
IP: [<ffffffff81677b86>] __fwnode_property_read_string+0x26/0x160
PGD 200e067 PUD 2010067 PMD 0
Oops: 0000 [#1] SMP KASAN
Modules linked in: dwc3_pci(+) dwc3
CPU: 0 PID: 1138 Comm: modprobe Not tainted 4.5.0-rc5+ #61
task: ffff88015aaf5b00 ti: ffff88007b958000 task.ti: ffff88007b958000
RIP: 0010:[<ffffffff81677b86>]  [<ffffffff81677b86>] __fwnode_property_read_string+0x26/0x160
RSP: 0018:ffff88007b95eff8  EFLAGS: 00010246
RAX: fffffbfffffffffd RBX: ffffffffffffffed RCX: ffff88015999cd37
RDX: dffffc0000000000 RSI: ffffffff81e11bc0 RDI: ffffffffffffffed
RBP: ffff88007b95f020 R08: 0000000000000000 R09: 0000000000000000
R10: ffff88007b90f7cf R11: 0000000000000000 R12: ffff88007b95f0a0
R13: 00000000fffffffa R14: ffffffff81e11bc0 R15: ffff880159ea37a0
FS:  00007ff35f46c700(0000) GS:ffff88015b800000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
CR2: ffffffffffffffed CR3: 000000007b8be000 CR4: 00000000001006f0
Stack:
 ffff88015999cd20 ffffffff81e11bc0 ffff88007b95f0a0 ffff88007b383dd8
 ffff880159ea37a0 ffff88007b95f048 ffffffff81677d03 ffff88007b952460
 ffffffff81e11bc0 ffff88007b95f0a0 ffff88007b95f070 ffffffff81677d40
Call Trace:
 [<ffffffff81677d03>] fwnode_property_read_string+0x43/0x50
 [<ffffffff81677d40>] device_property_read_string+0x30/0x40
...

Fixes: 362c0b30 (device property: Fallback to secondary fwnode if primary misses the property)
Signed-off-by: NHeikki Krogerus <heikki.krogerus@linux.intel.com>
Signed-off-by: NRafael J. Wysocki <rafael.j.wysocki@intel.com>

ACPICA commit eade8f78f2aa21e8eabc3380a5728db47273bcf1

Revert commit ae90fbf5 (ACPICA: Parser: Fix for SuperName method
invocation).

Support for method invocations as part of super_name will be
removed from the ACPI specification, since no AML interpreter
supports it.

Fixes: ae90fbf5 (ACPICA: Parser: Fix for SuperName method invocation)
Link: https://github.com/acpica/acpica/commit/eade8f78Signed-off-by: NBob Moore <robert.moore@intel.com>
Signed-off-by: NLv Zheng <lv.zheng@intel.com>
Signed-off-by: NRafael J. Wysocki <rafael.j.wysocki@intel.com>

Add device tree support for the I2C and SPI variant of AD7879(-1).
This allows to specify the touchscreen controller as a I2C client
node or SPI slave device. Most of the options available in platform
data are also available as device tree properties, the only exception
being GPIO capabilities, which can not be activated through device
tree currently.
Signed-off-by: NStefan Agner <stefan@agner.ch>
Acked-by: NRob Herring <robh@kernel.org>
Acked-by: NMichael Hennerich <michael.hennerich@analog.com>
Signed-off-by: NDmitry Torokhov <dmitry.torokhov@gmail.com>

The X/Y position measurements read from the controller are interpreted
wrong. The first measurement X+ contains the Y position, and the second
measurement Y+ the X position (see also Table 11 Register Table in the
data sheet).

The problem is already known and a swap option has been introduced:
commit 6680884a ("Input: ad7879 - add option to correct xy axis")

However, the meaning of the new boolean is inverted since the underlying
values are already swapped. Let ts->swap_xy set to true actually be the
swapped configuration of the two axis.
Signed-off-by: NStefan Agner <stefan@agner.ch>
Acked-by: NMichael Hennerich <michael.hennerich@analog.com>
Signed-off-by: NDmitry Torokhov <dmitry.torokhov@gmail.com>

The header file is used by the SPI and I2C variant of the driver.
Therefore, move it to a more generic place under platform_data.
Signed-off-by: NStefan Agner <stefan@agner.ch>
Signed-off-by: NDmitry Torokhov <dmitry.torokhov@gmail.com>

This reverts commit 39d42750.

This caused a regression on some older hardware.

bug:
https://bugzilla.kernel.org/show_bug.cgi?id=113891Signed-off-by: NAlex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org

When I fixed the dp rate selection in:
3b73b168cffd9c392584d3f665021fa2190f8612
drm/amdgpu: fix dp link rate selection (v2)
I accidently dropped the special handling for NUTMEG
DP bridge chips.  They require a fixed link rate.
Reviewed-by: NChristian König <christian.koenig@amd.com>
Reviewed-by: NKen Wang <Qingqing.Wang@amd.com>
Reviewed-by: NHarry Wentland <harry.wentland@amd.com>
Signed-off-by: NAlex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org

When I fixed the dp rate selection in:
092c96a8
drm/radeon: fix dp link rate selection (v2)
I accidently dropped the special handling for NUTMEG
DP bridge chips.  They require a fixed link rate.
Reviewed-by: NChristian König <christian.koenig@amd.com>
Reviewed-by: NKen Wang <Qingqing.Wang@amd.com>
Reviewed-by: NHarry Wentland <harry.wentland@amd.com>
Tested-by: NKen Moffat <zarniwhoop@ntlworld.com>
Signed-off-by: NAlex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org

Choose between atomic or non atomic connector dpms helper. If tda998x
is connected to a drm driver that does not support atomic modeset
calling drm_atomic_helper_connector_dpms() causes a crash when the
connectors atomic state is not initialized. The patch implements a
driver specific connector dpms helper that calls
drm_atomic_helper_connector_dpms() if driver supports DRIVER_ATOMIC
and otherwise it calls the legacy drm_helper_connector_dpms().

Fixes commit 9736e988 ("drm/i2c: tda998x: Add support for atomic
modesetting").
Signed-off-by: NJyri Sarha <jsarha@ti.com>
Signed-off-by: NDave Airlie <airlied@redhat.com>

This partially reverts commit d56f57ac ("drm/gma500: Move to private
save/restore hooks") which removed these lines by mistake.
Reported-by: NSebastian Herbszt <herbszt@gmx.de>
Acked-by: NDaniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: NThierry Reding <treding@nvidia.com>
Tested-by: NThomas Hellstrom <thellstrom@vmware.com>
Tested-by: NSebastian Herbszt <herbszt@gmx.de>
Signed-off-by: NDave Airlie <airlied@redhat.com>

This reverts commit dbb17a21.

It turns out that commit can cause problems for systems with multiple
GPUs, and causes X to hang on at least a HP Pavilion dv7 with hybrid
graphics.

This got noticed originally in 4.4.4, where this patch had already
gotten back-ported, but 4.5-rc7 was verified to have the same problem.

Alexander Deucher says:
 "It looks like you have a muxed system so I suspect what's happening is
  that one of the display is being reported as connected for both the
  IGP and the dGPU and then the desktop environment gets confused or
  there some sort problem in the detect functions since the mux is not
  switched to the dGPU.  I don't see an easy fix unless Dave has any
  ideas.  I'd say just revert for now"
Reported-by: NJörg-Volker Peetz <jvpeetz@web.de>
Acked-by: NAlexander Deucher <Alexander.Deucher@amd.com>
Cc: Dave Airlie <airlied@gmail.com>
Cc: stable@kernel.org  # wherever dbb17a21 got back-ported
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Add missing rtnl_unlock() in the error path of ppp_create_interface().

Fixes: 58a89eca ("ppp: fix lockdep splat in ppp_dev_uninit()")
Signed-off-by: NGuillaume Nault <g.nault@alphalink.fr>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

usbnet_link_change will call schedule_work and should be
avoided if bind is failing. Otherwise we will end up with
scheduled work referring to a netdev which has gone away.

Instead of making the call conditional, we can just defer
it to usbnet_probe, using the driver_info flag made for
this purpose.

Fixes: 8a34b0ae ("usbnet: cdc_ncm: apply usbnet_link_change")
Reported-by: NAndrey Konovalov <andreyknvl@gmail.com>
Suggested-by: NLinus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: NBjørn Mork <bjorn@mork.no>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

It will always be passed if the soc is tested the loopback cases. This
patch will fix this bug.
Signed-off-by: NKejian Yan <yankejian@huawei.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

According to Documentation/power/devices.txt

The driver should not use device_set_wakeup_enable() which is the policy
for user to decide.

Using device_init_wakeup() to initialize dev->power.should_wakeup and
dev->power.can_wakeup on driver initialization.

And use device_may_wakeup() on suspend to decide if WoL function should
be enabled on NIC.
Reported-by: NDiego Viola <diego.viola@gmail.com>
Signed-off-by: NGuo-Fu Tseng <cooldavid@cooldavid.org>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>