atmel mxt1188s firmware update
ALSA: usb-audio: Fix the mixer control range limiting issue

- mixer_ctl_set() function is limiting the volume level
  to particular range. This results in incorrect initial
  volume setting for that device.
- In USB mixer while calculating the dBmin/dBmax values
  resolution factor is hardcoded to 256 which results in
  populating the wrong values for dBmin/dBmax.
- Fix is to use appropriate resolution factor while
  calculating the dBmin/dBmax values.

CRs-Fixed: 515012
Prev-Change-Id: I502355af66f850bb65380c27333c3341fa43a947
Signed-off-by: Deepa Madiregama <dmadireg@codeaurora.org>

Change-Id: I79c14014ad6828a802f6978b796d8a4a91c87e46
ASoC: msm: qdsp6: Fix pop noise seen with touch tone during playback

Issue: When a session is opened for playback of the touch tone and
	routed through the COPP, the PBE and IIR params are being
	reconfigured in the COPP every time a session is open.

Rootcause:Configuring the PBE/IIR in the COPP every time a session
           is open.
Fix: Configuring the PBE and IIR param in the COPP one time a session
      is open

CRs-Fixed: 541722
Prev-Change-Id: If0d1a8c6893a94186e1c6c2a75432d2f4a89f842
Signed-off-by: Satish Kamuju <skamuj@codeaurora.org>

Change-Id: If51d472b554e358f2eada257b7cebb97682683b0

Conflicts:
	sound/soc/msm/qdsp6/q6adm.c
ALSA: pcm: check for integer overflow during multiplication

Channel info data structure is parsed from userspace and if
user does not set the no. of channels correctly, it could lead
to security vulnerability if we don't check for overflow when the
no. of channels is multiplied with pcm bit width. Add a condition
to check for overflow during multiplication.

CRs-fixed: 537818
Prev-Change-Id: Ia3c31406dd8b7627ea704c076643c0348582da28
Signed-off-by: Phani Kumar Uppalapati <phaniu@codeaurora.org>

Change-Id: I577e28017baae43f0ca49141916381c7e791a281
ASoC: msm: qdsp6v2: Copy frame data based on frame length

Copying data based on count will result in copying
uninitialized data to userspace which can potentially
disclose sensitive data. Fix by copying data based on
frame instead.

CRs-Fixed: 552528, 552531
Prev-Change-Id: I307b285ef2aefe00b953cf650582e9ff7e03ceb1
Signed-off-by: Shiv Maliyappanahalli <smaliyap@codeaurora.org>

Conflicts:

	sound/soc/msm/qdsp6v2/msm-pcm-voip-v2.c

Change-Id: Ie468d0ccdbd6e253af9bbc7731559856fa302e6e
ALSA: core: Fix crash by avoiding appl_ptr crossing 32-bit boundary

Incase of A2DP usecase using proxy driver, appl_ptr has
boundary value as 0x60000000 frames in sw_params for stereo(2 channels).
When this value crosses 0x40000000, then userspace calculating
appl_ptr at bytes results in crossing 32-bit value 0x100000000,
and points to 0x0 offset which can result in crash or pop.
To avoid above scenario, set the sw_params appl_ptr boundary value
within 0x40000000. Added proper check at sw_params update
to set this value correctly within 32-bit boundary(frames).

Prev-Change-Id: I537a04156699d90549a0a468ae19539ecd552d3b
CRs-Fixed: 483203
Signed-off-by: Laxminath Kasam <lkasam@codeaurora.org>

Change-Id: Ife1e9debfce7cc62c88ca9587006f0e4e44a7a64
ASoC: msm: qdsp6v2: Fix buffer overflow in voice driver

Userspace registers calibration data with acdb driver
through ioctls. Voice driver registers the calibration
data with CVD by querying acdb data from acdb driver and
copies the calibration data in apr message.

The size of the calibration data can be controlled by userspace
and can result in buffer overflow if the calibration size is
greater than the destination buffer size.
Reject acdb data if the size is greater than the size of
destination buffer.

Prev-Change-Id: I1b495390d67907afc608ed8233bf916777d38e11
CRs-fixed: 548872
Signed-off-by: Shiv Maliyappanahalli <smaliyap@codeaurora.org>

Conflicts:

	sound/soc/msm/qdsp6v2/q6voice.c

Change-Id: Ic50d948134a72ab416be1a46ba59e33beb04827d
fix derp