--- /dev/null
+From 3deef52ce10514ccdebba8e8ab85f9cebd0eb3f7 Mon Sep 17 00:00:00 2001
+From: Kai-Heng Feng <kai.heng.feng@canonical.com>
+Date: Thu, 29 Nov 2018 08:57:37 +0000
+Subject: ALSA: hda: Add support for AMD Stoney Ridge
+
+From: Kai-Heng Feng <kai.heng.feng@canonical.com>
+
+commit 3deef52ce10514ccdebba8e8ab85f9cebd0eb3f7 upstream.
+
+It's similar to other AMD audio devices, it also supports D3, which can
+save some power drain.
+
+Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/hda_intel.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -2585,6 +2585,10 @@ static const struct pci_device_id azx_id
+ /* AMD Hudson */
+ { PCI_DEVICE(0x1022, 0x780d),
+ .driver_data = AZX_DRIVER_GENERIC | AZX_DCAPS_PRESET_ATI_SB },
++ /* AMD Stoney */
++ { PCI_DEVICE(0x1022, 0x157a),
++ .driver_data = AZX_DRIVER_GENERIC | AZX_DCAPS_PRESET_ATI_SB |
++ AZX_DCAPS_PM_RUNTIME },
+ /* AMD Raven */
+ { PCI_DEVICE(0x1022, 0x15e3),
+ .driver_data = AZX_DRIVER_GENERIC | AZX_DCAPS_PRESET_ATI_SB |
--- /dev/null
+From 705b65f107470499442240ff7afee5021a7002a6 Mon Sep 17 00:00:00 2001
+From: Chris Chiu <chiu@endlessm.com>
+Date: Wed, 5 Dec 2018 14:48:54 +0800
+Subject: ALSA: hda/realtek - Add support for Acer Aspire C24-860 headset mic
+
+From: Chris Chiu <chiu@endlessm.com>
+
+commit 705b65f107470499442240ff7afee5021a7002a6 upstream.
+
+The Acer AIO Aspire C24-860 with ALC286 can't detect the headset
+microphone. Just like another Acer AIO U27-880, it needs a different
+pin value for 0x18 and the headset fixup to make headset mic work.
+
+Signed-off-by: Jian-Hong Pan <jian-hong@endlessm.com>
+Signed-off-by: Daniel Drake <drake@endlessm.com>
+Signed-off-by: Chris Chiu <chiu@endlessm.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_realtek.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -6420,6 +6420,7 @@ static const struct snd_pci_quirk alc269
+ SND_PCI_QUIRK(0x1025, 0x0762, "Acer Aspire E1-472", ALC271_FIXUP_HP_GATE_MIC_JACK_E1_572),
+ SND_PCI_QUIRK(0x1025, 0x0775, "Acer Aspire E1-572", ALC271_FIXUP_HP_GATE_MIC_JACK_E1_572),
+ SND_PCI_QUIRK(0x1025, 0x079b, "Acer Aspire V5-573G", ALC282_FIXUP_ASPIRE_V5_PINS),
++ SND_PCI_QUIRK(0x1025, 0x102b, "Acer Aspire C24-860", ALC286_FIXUP_ACER_AIO_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1025, 0x106d, "Acer Cloudbook 14", ALC283_FIXUP_CHROME_BOOK),
+ SND_PCI_QUIRK(0x1028, 0x0470, "Dell M101z", ALC269_FIXUP_DELL_M101Z),
+ SND_PCI_QUIRK(0x1028, 0x054b, "Dell XPS one 2710", ALC275_FIXUP_DELL_XPS),
--- /dev/null
+From 33aaebd48ae2d2c78fef5063a0381e17db19b060 Mon Sep 17 00:00:00 2001
+From: Chris Chiu <chiu@endlessm.com>
+Date: Wed, 5 Dec 2018 14:48:53 +0800
+Subject: ALSA: hda/realtek: ALC286 mic and headset-mode fixups for Acer Aspire U27-880
+
+From: Chris Chiu <chiu@endlessm.com>
+
+commit 33aaebd48ae2d2c78fef5063a0381e17db19b060 upstream.
+
+Acer Aspire U27-880(AIO) with ALC286 codec can not detect headset mic
+and internal mic not working either. It needs the similar quirk like
+Sony laptops to fix headphone jack sensing and enables use of the
+internal microphone.
+
+Unfortunately jack sensing for the headset mic is still not working.
+
+Signed-off-by: Jian-Hong Pan <jian-hong@endlessm.com>
+Signed-off-by: Daniel Drake <drake@endlessm.com>
+Signed-off-by: Chris Chiu <chiu@endlessm.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_realtek.c | 14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -5519,6 +5519,7 @@ enum {
+ ALC221_FIXUP_HP_HEADSET_MIC,
+ ALC285_FIXUP_LENOVO_HEADPHONE_NOISE,
+ ALC295_FIXUP_HP_AUTO_MUTE,
++ ALC286_FIXUP_ACER_AIO_MIC_NO_PRESENCE,
+ };
+
+ static const struct hda_fixup alc269_fixups[] = {
+@@ -6396,6 +6397,15 @@ static const struct hda_fixup alc269_fix
+ .type = HDA_FIXUP_FUNC,
+ .v.func = alc_fixup_auto_mute_via_amp,
+ },
++ [ALC286_FIXUP_ACER_AIO_MIC_NO_PRESENCE] = {
++ .type = HDA_FIXUP_PINS,
++ .v.pins = (const struct hda_pintbl[]) {
++ { 0x18, 0x01a1913c }, /* use as headset mic, without its own jack detect */
++ { }
++ },
++ .chained = true,
++ .chain_id = ALC269_FIXUP_HEADSET_MIC
++ },
+ };
+
+ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+@@ -7074,6 +7084,10 @@ static const struct snd_hda_pin_quirk al
+ {0x14, 0x90170110},
+ {0x19, 0x04a11040},
+ {0x21, 0x04211020}),
++ SND_HDA_PIN_QUIRK(0x10ec0286, 0x1025, "Acer", ALC286_FIXUP_ACER_AIO_MIC_NO_PRESENCE,
++ {0x12, 0x90a60130},
++ {0x17, 0x90170110},
++ {0x21, 0x02211020}),
+ SND_HDA_PIN_QUIRK(0x10ec0288, 0x1028, "Dell", ALC288_FIXUP_DELL1_MIC_NO_PRESENCE,
+ {0x12, 0x90a60120},
+ {0x14, 0x90170110},
--- /dev/null
+From 9f8aefed9623a91dec54eab8908f3810b7f8d73a Mon Sep 17 00:00:00 2001
+From: Chris Chiu <chiu@endlessm.com>
+Date: Wed, 5 Dec 2018 14:48:55 +0800
+Subject: ALSA: hda/realtek: Fix mic issue on Acer AIO Veriton Z4660G
+
+From: Chris Chiu <chiu@endlessm.com>
+
+commit 9f8aefed9623a91dec54eab8908f3810b7f8d73a upstream.
+
+Acer AIO Veriton Z4660G with ALC286 codec has issue with the input
+from external microphones connecting via 'Front Mic' jack. The fixup
+ALC286_FIXUP_ACER_AIO_MIC_NO_PRESENCE enables the jack sensing of
+the headset and fix the audio input issue of external microphone.
+
+Signed-off-by: Jian-Hong Pan <jian-hong@endlessm.com>
+Signed-off-by: Daniel Drake <drake@endlessm.com>
+Signed-off-by: Chris Chiu <chiu@endlessm.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_realtek.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -6422,6 +6422,7 @@ static const struct snd_pci_quirk alc269
+ SND_PCI_QUIRK(0x1025, 0x079b, "Acer Aspire V5-573G", ALC282_FIXUP_ASPIRE_V5_PINS),
+ SND_PCI_QUIRK(0x1025, 0x102b, "Acer Aspire C24-860", ALC286_FIXUP_ACER_AIO_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1025, 0x106d, "Acer Cloudbook 14", ALC283_FIXUP_CHROME_BOOK),
++ SND_PCI_QUIRK(0x1025, 0x1291, "Acer Veriton Z4660G", ALC286_FIXUP_ACER_AIO_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1028, 0x0470, "Dell M101z", ALC269_FIXUP_DELL_M101Z),
+ SND_PCI_QUIRK(0x1028, 0x054b, "Dell XPS one 2710", ALC275_FIXUP_DELL_XPS),
+ SND_PCI_QUIRK(0x1028, 0x05bd, "Dell Latitude E6440", ALC292_FIXUP_DELL_E7X),
--- /dev/null
+From b72f936f6b325f4fde06b02e4b6ab682f6f2e73f Mon Sep 17 00:00:00 2001
+From: Chris Chiu <chiu@endlessm.com>
+Date: Wed, 5 Dec 2018 14:48:56 +0800
+Subject: ALSA: hda/realtek: Fix mic issue on Acer AIO Veriton Z4860G/Z6860G
+
+From: Chris Chiu <chiu@endlessm.com>
+
+commit b72f936f6b325f4fde06b02e4b6ab682f6f2e73f upstream.
+
+Acer AIO Veriton Z4860G/Z6860G with the same ALC286 codec has issues
+with the input from external microphone. The issue can be fixed by
+the fixup ALC286_FIXUP_ACER_AIO_MIC_NO_PRESENCE for Veriton Z4660G.
+
+Signed-off-by: Jian-Hong Pan <jian-hong@endlessm.com>
+Signed-off-by: Daniel Drake <drake@endlessm.com>
+Signed-off-by: Chris Chiu <chiu@endlessm.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_realtek.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -6422,6 +6422,8 @@ static const struct snd_pci_quirk alc269
+ SND_PCI_QUIRK(0x1025, 0x079b, "Acer Aspire V5-573G", ALC282_FIXUP_ASPIRE_V5_PINS),
+ SND_PCI_QUIRK(0x1025, 0x102b, "Acer Aspire C24-860", ALC286_FIXUP_ACER_AIO_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1025, 0x106d, "Acer Cloudbook 14", ALC283_FIXUP_CHROME_BOOK),
++ SND_PCI_QUIRK(0x1025, 0x128f, "Acer Veriton Z6860G", ALC286_FIXUP_ACER_AIO_MIC_NO_PRESENCE),
++ SND_PCI_QUIRK(0x1025, 0x1290, "Acer Veriton Z4860G", ALC286_FIXUP_ACER_AIO_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1025, 0x1291, "Acer Veriton Z4660G", ALC286_FIXUP_ACER_AIO_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1028, 0x0470, "Dell M101z", ALC269_FIXUP_DELL_M101Z),
+ SND_PCI_QUIRK(0x1028, 0x054b, "Dell XPS one 2710", ALC275_FIXUP_DELL_XPS),
--- /dev/null
+From 54947cd64c1b8290f64bb2958e343c07270e3a58 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Mon, 3 Dec 2018 10:44:15 +0100
+Subject: ALSA: hda/realtek - Fix speaker output regression on Thinkpad T570
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 54947cd64c1b8290f64bb2958e343c07270e3a58 upstream.
+
+We've got a regression report for some Thinkpad models (at least
+T570s) which shows the too low speaker output volume. The bisection
+leaded to the commit 61fcf8ece9b6 ("ALSA: hda/realtek - Enable Thinkpad
+Dock device for ALC298 platform"), and it's basically adding the two
+pin configurations for the dock, and looks harmless.
+
+The real culprit seems, though, that the DAC assignment for the
+speaker pin is implicitly assumed on these devices, i.e. pin NID 0x14
+to be coupled with DAC NID 0x03. When more pins are configured by the
+commit above, the auto-parser changes the DAC assignment, and this
+resulted in the regression.
+
+As a workaround, just provide the fixed pin / DAC mapping table for
+this Thinkpad fixup function. It's no generic solution, but the
+problem itself is pretty much device-specific, so must be good
+enough.
+
+Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1554304
+Fixes: 61fcf8ece9b6 ("ALSA: hda/realtek - Enable Thinkpad Dock device for ALC298 platform")
+Cc: <stable@vger.kernel.org>
+Reported-and-tested-by: Jeremy Cline <jcline@redhat.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_realtek.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -4988,9 +4988,18 @@ static void alc_fixup_tpt470_dock(struct
+ { 0x19, 0x21a11010 }, /* dock mic */
+ { }
+ };
++ /* Assure the speaker pin to be coupled with DAC NID 0x03; otherwise
++ * the speaker output becomes too low by some reason on Thinkpads with
++ * ALC298 codec
++ */
++ static hda_nid_t preferred_pairs[] = {
++ 0x14, 0x03, 0x17, 0x02, 0x21, 0x02,
++ 0
++ };
+ struct alc_spec *spec = codec->spec;
+
+ if (action == HDA_FIXUP_ACT_PRE_PROBE) {
++ spec->gen.preferred_dacs = preferred_pairs;
+ spec->parse_flags = HDA_PINCFG_NO_HP_FIXUP;
+ snd_hda_apply_pincfgs(codec, pincfgs);
+ } else if (action == HDA_FIXUP_ACT_INIT) {
--- /dev/null
+From b51abed8355e5556886623b2772fa6b7598d2282 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Thu, 29 Nov 2018 08:02:49 +0100
+Subject: ALSA: pcm: Call snd_pcm_unlink() conditionally at closing
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit b51abed8355e5556886623b2772fa6b7598d2282 upstream.
+
+Currently the PCM core calls snd_pcm_unlink() always unconditionally
+at closing a stream. However, since snd_pcm_unlink() invokes the
+global rwsem down, the lock can be easily contended. More badly, when
+a thread runs in a high priority RT-FIFO, it may stall at spinning.
+
+Basically the call of snd_pcm_unlink() is required only for the linked
+streams that are already rare occasion. For normal use cases, this
+code path is fairly superfluous.
+
+As an optimization (and also as a workaround for the RT problem
+above in normal situations without linked streams), this patch adds a
+check before calling snd_pcm_unlink() and calls it only when needed.
+
+Reported-by: Chanho Min <chanho.min@lge.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/core/pcm_native.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/sound/core/pcm_native.c
++++ b/sound/core/pcm_native.c
+@@ -2370,7 +2370,8 @@ int snd_pcm_hw_constraints_complete(stru
+
+ static void pcm_release_private(struct snd_pcm_substream *substream)
+ {
+- snd_pcm_unlink(substream);
++ if (snd_pcm_stream_linked(substream))
++ snd_pcm_unlink(substream);
+ }
+
+ void snd_pcm_release_substream(struct snd_pcm_substream *substream)
--- /dev/null
+From 5363857b916c1f48027e9b96ee8be8376bf20811 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Thu, 29 Nov 2018 12:05:19 +0100
+Subject: ALSA: pcm: Fix interval evaluation with openmin/max
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 5363857b916c1f48027e9b96ee8be8376bf20811 upstream.
+
+As addressed in alsa-lib (commit b420056604f0), we need to fix the
+case where the evaluation of PCM interval "(x x+1]" leading to
+-EINVAL. After applying rules, such an interval may be translated as
+"(x x+1)".
+
+Fixes: ff2d6acdf6f1 ("ALSA: pcm: Fix snd_interval_refine first/last with open min/max")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/sound/pcm_params.h | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/include/sound/pcm_params.h
++++ b/include/sound/pcm_params.h
+@@ -254,11 +254,13 @@ static inline int snd_interval_empty(con
+ static inline int snd_interval_single(const struct snd_interval *i)
+ {
+ return (i->min == i->max ||
+- (i->min + 1 == i->max && i->openmax));
++ (i->min + 1 == i->max && (i->openmin || i->openmax)));
+ }
+
+ static inline int snd_interval_value(const struct snd_interval *i)
+ {
++ if (i->openmin && !i->openmax)
++ return i->max;
+ return i->min;
+ }
+
--- /dev/null
+From b888a5f713e4d17faaaff24316585a4eb07f35b7 Mon Sep 17 00:00:00 2001
+From: Chanho Min <chanho.min@lge.com>
+Date: Mon, 26 Nov 2018 14:36:37 +0900
+Subject: ALSA: pcm: Fix starvation on down_write_nonblock()
+
+From: Chanho Min <chanho.min@lge.com>
+
+commit b888a5f713e4d17faaaff24316585a4eb07f35b7 upstream.
+
+Commit 67ec1072b053 ("ALSA: pcm: Fix rwsem deadlock for non-atomic PCM
+stream") fixes deadlock for non-atomic PCM stream. But, This patch
+causes antother stuck.
+If writer is RT thread and reader is a normal thread, the reader
+thread will be difficult to get scheduled. It may not give chance to
+release readlocks and writer gets stuck for a long time if they are
+pinned to single cpu.
+
+The deadlock described in the previous commit is because the linux
+rwsem queues like a FIFO. So, we might need non-FIFO writelock, not
+non-block one.
+
+My suggestion is that the writer gives reader a chance to be scheduled
+by using the minimum msleep() instaed of spinning without blocking by
+writer. Also, The *_nonblock may be changed to *_nonfifo appropriately
+to this concept.
+In terms of performance, when trylock is failed, this minimum periodic
+msleep will have the same performance as the tick-based
+schedule()/wake_up_q().
+
+[ Although this has a fairly high performance penalty, the relevant
+ code path became already rare due to the previous commit ("ALSA:
+ pcm: Call snd_pcm_unlink() conditionally at closing"). That is, now
+ this unconditional msleep appears only when using linked streams,
+ and this must be a rare case. So we accept this as a quick
+ workaround until finding a more suitable one -- tiwai ]
+
+Fixes: 67ec1072b053 ("ALSA: pcm: Fix rwsem deadlock for non-atomic PCM stream")
+Suggested-by: Wonmin Jung <wonmin.jung@lge.com>
+Signed-off-by: Chanho Min <chanho.min@lge.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/core/pcm_native.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+--- a/sound/core/pcm_native.c
++++ b/sound/core/pcm_native.c
+@@ -36,6 +36,7 @@
+ #include <sound/timer.h>
+ #include <sound/minors.h>
+ #include <linux/uio.h>
++#include <linux/delay.h>
+
+ #include "pcm_local.h"
+
+@@ -91,12 +92,12 @@ static DECLARE_RWSEM(snd_pcm_link_rwsem)
+ * and this may lead to a deadlock when the code path takes read sem
+ * twice (e.g. one in snd_pcm_action_nonatomic() and another in
+ * snd_pcm_stream_lock()). As a (suboptimal) workaround, let writer to
+- * spin until it gets the lock.
++ * sleep until all the readers are completed without blocking by writer.
+ */
+-static inline void down_write_nonblock(struct rw_semaphore *lock)
++static inline void down_write_nonfifo(struct rw_semaphore *lock)
+ {
+ while (!down_write_trylock(lock))
+- cond_resched();
++ msleep(1);
+ }
+
+ #define PCM_LOCK_DEFAULT 0
+@@ -1967,7 +1968,7 @@ static int snd_pcm_link(struct snd_pcm_s
+ res = -ENOMEM;
+ goto _nolock;
+ }
+- down_write_nonblock(&snd_pcm_link_rwsem);
++ down_write_nonfifo(&snd_pcm_link_rwsem);
+ write_lock_irq(&snd_pcm_link_rwlock);
+ if (substream->runtime->status->state == SNDRV_PCM_STATE_OPEN ||
+ substream->runtime->status->state != substream1->runtime->status->state ||
+@@ -2014,7 +2015,7 @@ static int snd_pcm_unlink(struct snd_pcm
+ struct snd_pcm_substream *s;
+ int res = 0;
+
+- down_write_nonblock(&snd_pcm_link_rwsem);
++ down_write_nonfifo(&snd_pcm_link_rwsem);
+ write_lock_irq(&snd_pcm_link_rwlock);
+ if (!snd_pcm_stream_linked(substream)) {
+ res = -EALREADY;
--- /dev/null
+From 44ff57e685f96d0cb9540004cc9d1d880e7a4315 Mon Sep 17 00:00:00 2001
+From: Tony Das <tdas444@gmail.com>
+Date: Wed, 28 Nov 2018 20:16:37 +0000
+Subject: ALSA: usb-audio: Add SMSL D1 to quirks for native DSD support
+
+From: Tony Das <tdas444@gmail.com>
+
+commit 44ff57e685f96d0cb9540004cc9d1d880e7a4315 upstream.
+
+This patch adds quirk VID/PID IDs for the SMSL D1 in order to enable
+Native DSD support.
+
+[ Moved the added entry in numerical order -- tiwai ]
+
+Signed-off-by: Tony Das <tdas444@gmail.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/usb/quirks.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/usb/quirks.c
++++ b/sound/usb/quirks.c
+@@ -1373,6 +1373,7 @@ u64 snd_usb_interface_dsd_format_quirks(
+ return SNDRV_PCM_FMTBIT_DSD_U32_BE;
+ break;
+
++ case USB_ID(0x152a, 0x85de): /* SMSL D1 DAC */
+ case USB_ID(0x16d0, 0x09dd): /* Encore mDSD */
+ case USB_ID(0x0d8c, 0x0316): /* Hegel HD12 DSD */
+ case USB_ID(0x16b0, 0x06b2): /* NuPrime DAC-10 */
--- /dev/null
+From 5f8cf712582617d523120df67d392059eaf2fc4b Mon Sep 17 00:00:00 2001
+From: Hui Peng <benquike@gmail.com>
+Date: Mon, 3 Dec 2018 16:09:34 +0100
+Subject: ALSA: usb-audio: Fix UAF decrement if card has no live interfaces in card.c
+
+From: Hui Peng <benquike@gmail.com>
+
+commit 5f8cf712582617d523120df67d392059eaf2fc4b upstream.
+
+If a USB sound card reports 0 interfaces, an error condition is triggered
+and the function usb_audio_probe errors out. In the error path, there was a
+use-after-free vulnerability where the memory object of the card was first
+freed, followed by a decrement of the number of active chips. Moving the
+decrement above the atomic_dec fixes the UAF.
+
+[ The original problem was introduced in 3.1 kernel, while it was
+ developed in a different form. The Fixes tag below indicates the
+ original commit but it doesn't mean that the patch is applicable
+ cleanly. -- tiwai ]
+
+Fixes: 362e4e49abe5 ("ALSA: usb-audio - clear chip->probing on error exit")
+Reported-by: Hui Peng <benquike@gmail.com>
+Reported-by: Mathias Payer <mathias.payer@nebelwelt.net>
+Signed-off-by: Hui Peng <benquike@gmail.com>
+Signed-off-by: Mathias Payer <mathias.payer@nebelwelt.net>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/usb/card.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/sound/usb/card.c
++++ b/sound/usb/card.c
+@@ -682,9 +682,12 @@ static int usb_audio_probe(struct usb_in
+
+ __error:
+ if (chip) {
++ /* chip->active is inside the chip->card object,
++ * decrement before memory is possibly returned.
++ */
++ atomic_dec(&chip->active);
+ if (!chip->num_interfaces)
+ snd_card_free(chip->card);
+- atomic_dec(&chip->active);
+ }
+ mutex_unlock(®ister_mutex);
+ return err;
ibmvnic-update-driver-queues-after-change-in-ring-si.patch
team-no-need-to-do-team_notify_peers-or-team_mcast_r.patch
net-amd-add-missing-of_node_put.patch
+usb-quirk-add-no-lpm-quirk-on-sandisk-ultra-flair-device.patch
+usb-appledisplay-add-27-apple-cinema-display.patch
+usb-check-usb_get_extra_descriptor-for-proper-size.patch
+usb-serial-console-fix-reported-terminal-settings.patch
+alsa-usb-audio-add-smsl-d1-to-quirks-for-native-dsd-support.patch
+alsa-usb-audio-fix-uaf-decrement-if-card-has-no-live-interfaces-in-card.c.patch
+alsa-hda-add-support-for-amd-stoney-ridge.patch
+alsa-pcm-fix-starvation-on-down_write_nonblock.patch
+alsa-pcm-call-snd_pcm_unlink-conditionally-at-closing.patch
+alsa-pcm-fix-interval-evaluation-with-openmin-max.patch
+alsa-hda-realtek-fix-speaker-output-regression-on-thinkpad-t570.patch
+alsa-hda-realtek-alc286-mic-and-headset-mode-fixups-for-acer-aspire-u27-880.patch
+alsa-hda-realtek-add-support-for-acer-aspire-c24-860-headset-mic.patch
+alsa-hda-realtek-fix-mic-issue-on-acer-aio-veriton-z4660g.patch
+alsa-hda-realtek-fix-mic-issue-on-acer-aio-veriton-z4860g-z6860g.patch
--- /dev/null
+From d7859905301880ad3e16272399d26900af3ac496 Mon Sep 17 00:00:00 2001
+From: Alexander Theissen <alex.theissen@me.com>
+Date: Tue, 4 Dec 2018 23:43:35 +0100
+Subject: usb: appledisplay: Add 27" Apple Cinema Display
+
+From: Alexander Theissen <alex.theissen@me.com>
+
+commit d7859905301880ad3e16272399d26900af3ac496 upstream.
+
+Add another Apple Cinema Display to the list of supported displays.
+
+Signed-off-by: Alexander Theissen <alex.theissen@me.com>
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/misc/appledisplay.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/usb/misc/appledisplay.c
++++ b/drivers/usb/misc/appledisplay.c
+@@ -51,6 +51,7 @@ static const struct usb_device_id appled
+ { APPLEDISPLAY_DEVICE(0x921c) },
+ { APPLEDISPLAY_DEVICE(0x921d) },
+ { APPLEDISPLAY_DEVICE(0x9222) },
++ { APPLEDISPLAY_DEVICE(0x9226) },
+ { APPLEDISPLAY_DEVICE(0x9236) },
+
+ /* Terminating entry */
--- /dev/null
+From 704620afc70cf47abb9d6a1a57f3825d2bca49cf Mon Sep 17 00:00:00 2001
+From: Mathias Payer <mathias.payer@nebelwelt.net>
+Date: Wed, 5 Dec 2018 21:19:59 +0100
+Subject: USB: check usb_get_extra_descriptor for proper size
+
+From: Mathias Payer <mathias.payer@nebelwelt.net>
+
+commit 704620afc70cf47abb9d6a1a57f3825d2bca49cf upstream.
+
+When reading an extra descriptor, we need to properly check the minimum
+and maximum size allowed, to prevent from invalid data being sent by a
+device.
+
+Reported-by: Hui Peng <benquike@gmail.com>
+Reported-by: Mathias Payer <mathias.payer@nebelwelt.net>
+Co-developed-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Hui Peng <benquike@gmail.com>
+Signed-off-by: Mathias Payer <mathias.payer@nebelwelt.net>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: stable <stable@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/core/hub.c | 2 +-
+ drivers/usb/core/usb.c | 6 +++---
+ drivers/usb/host/hwa-hc.c | 2 +-
+ include/linux/usb.h | 4 ++--
+ 4 files changed, 7 insertions(+), 7 deletions(-)
+
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -2250,7 +2250,7 @@ static int usb_enumerate_device_otg(stru
+ /* descriptor may appear anywhere in config */
+ err = __usb_get_extra_descriptor(udev->rawdescriptors[0],
+ le16_to_cpu(udev->config[0].desc.wTotalLength),
+- USB_DT_OTG, (void **) &desc);
++ USB_DT_OTG, (void **) &desc, sizeof(*desc));
+ if (err || !(desc->bmAttributes & USB_OTG_HNP))
+ return 0;
+
+--- a/drivers/usb/core/usb.c
++++ b/drivers/usb/core/usb.c
+@@ -832,14 +832,14 @@ EXPORT_SYMBOL_GPL(usb_get_current_frame_
+ */
+
+ int __usb_get_extra_descriptor(char *buffer, unsigned size,
+- unsigned char type, void **ptr)
++ unsigned char type, void **ptr, size_t minsize)
+ {
+ struct usb_descriptor_header *header;
+
+ while (size >= sizeof(struct usb_descriptor_header)) {
+ header = (struct usb_descriptor_header *)buffer;
+
+- if (header->bLength < 2) {
++ if (header->bLength < 2 || header->bLength > size) {
+ printk(KERN_ERR
+ "%s: bogus descriptor, type %d length %d\n",
+ usbcore_name,
+@@ -848,7 +848,7 @@ int __usb_get_extra_descriptor(char *buf
+ return -1;
+ }
+
+- if (header->bDescriptorType == type) {
++ if (header->bDescriptorType == type && header->bLength >= minsize) {
+ *ptr = header;
+ return 0;
+ }
+--- a/drivers/usb/host/hwa-hc.c
++++ b/drivers/usb/host/hwa-hc.c
+@@ -640,7 +640,7 @@ static int hwahc_security_create(struct
+ top = itr + itr_size;
+ result = __usb_get_extra_descriptor(usb_dev->rawdescriptors[index],
+ le16_to_cpu(usb_dev->actconfig->desc.wTotalLength),
+- USB_DT_SECURITY, (void **) &secd);
++ USB_DT_SECURITY, (void **) &secd, sizeof(*secd));
+ if (result == -1) {
+ dev_warn(dev, "BUG? WUSB host has no security descriptors\n");
+ return 0;
+--- a/include/linux/usb.h
++++ b/include/linux/usb.h
+@@ -407,11 +407,11 @@ struct usb_host_bos {
+ };
+
+ int __usb_get_extra_descriptor(char *buffer, unsigned size,
+- unsigned char type, void **ptr);
++ unsigned char type, void **ptr, size_t min);
+ #define usb_get_extra_descriptor(ifpoint, type, ptr) \
+ __usb_get_extra_descriptor((ifpoint)->extra, \
+ (ifpoint)->extralen, \
+- type, (void **)ptr)
++ type, (void **)ptr, sizeof(**(ptr)))
+
+ /* ----------------------------------------------------------------------- */
+
--- /dev/null
+From 2f2dde6ba89b1ef1fe23c1138131b315d9aa4019 Mon Sep 17 00:00:00 2001
+From: Harry Pan <harry.pan@intel.com>
+Date: Thu, 29 Nov 2018 00:40:41 +0800
+Subject: usb: quirk: add no-LPM quirk on SanDisk Ultra Flair device
+
+From: Harry Pan <harry.pan@intel.com>
+
+commit 2f2dde6ba89b1ef1fe23c1138131b315d9aa4019 upstream.
+
+Some lower volume SanDisk Ultra Flair in 16GB, which the VID:PID is
+in 0781:5591, will aggressively request LPM of U1/U2 during runtime,
+when using this thumb drive as the OS installation key we found the
+device will generate failure during U1 exit path making it dropped
+from the USB bus, this causes a corrupted installation in system at
+the end.
+
+i.e.,
+[ 166.918296] hub 2-0:1.0: state 7 ports 7 chg 0000 evt 0004
+[ 166.918327] usb usb2-port2: link state change
+[ 166.918337] usb usb2-port2: do warm reset
+[ 166.970039] usb usb2-port2: not warm reset yet, waiting 50ms
+[ 167.022040] usb usb2-port2: not warm reset yet, waiting 200ms
+[ 167.276043] usb usb2-port2: status 02c0, change 0041, 5.0 Gb/s
+[ 167.276050] usb 2-2: USB disconnect, device number 2
+[ 167.276058] usb 2-2: unregistering device
+[ 167.276060] usb 2-2: unregistering interface 2-2:1.0
+[ 167.276170] xhci_hcd 0000:00:15.0: shutdown urb ffffa3c7cc695cc0 ep1in-bulk
+[ 167.284055] sd 0:0:0:0: [sda] tag#0 FAILED Result: hostbyte=DID_NO_CONNECT driverbyte=DRIVER_OK
+[ 167.284064] sd 0:0:0:0: [sda] tag#0 CDB: Read(10) 28 00 00 33 04 90 00 01 00 00
+...
+
+Analyzed the USB trace in the link layer we realized it is because
+of the 6-ms timer of tRecoveryConfigurationTimeout which documented
+on the USB 3.2 Revision 1.0, the section 7.5.10.4.2 of "Exit from
+Recovery.Configuration"; device initiates U1 exit -> Recovery.Active
+-> Recovery.Configuration, then the host timer timeout makes the link
+transits to eSS.Inactive -> Rx.Detect follows by a Warm Reset.
+
+Interestingly, the other higher volume of SanDisk Ultra Flair sharing
+the same VID:PID, such as 64GB, would not request LPM during runtime,
+it sticks at U0 always, thus disabling LPM does not affect those thumb
+drives at all.
+
+The same odd occures in SanDisk Ultra Fit 16GB, VID:PID in 0781:5583.
+
+Signed-off-by: Harry Pan <harry.pan@intel.com>
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/core/quirks.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -333,6 +333,10 @@ static const struct usb_device_id usb_qu
+ /* Midiman M-Audio Keystation 88es */
+ { USB_DEVICE(0x0763, 0x0192), .driver_info = USB_QUIRK_RESET_RESUME },
+
++ /* SanDisk Ultra Fit and Ultra Flair */
++ { USB_DEVICE(0x0781, 0x5583), .driver_info = USB_QUIRK_NO_LPM },
++ { USB_DEVICE(0x0781, 0x5591), .driver_info = USB_QUIRK_NO_LPM },
++
+ /* M-Systems Flash Disk Pioneers */
+ { USB_DEVICE(0x08ec, 0x1000), .driver_info = USB_QUIRK_RESET_RESUME },
+
--- /dev/null
+From f51ccf46217c28758b1f3b5bc0ccfc00eca658b2 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Tue, 4 Dec 2018 17:00:36 +0100
+Subject: USB: serial: console: fix reported terminal settings
+
+From: Johan Hovold <johan@kernel.org>
+
+commit f51ccf46217c28758b1f3b5bc0ccfc00eca658b2 upstream.
+
+The USB-serial console implementation has never reported the actual
+terminal settings used. Despite storing the corresponding cflags in its
+struct console, these were never honoured on later tty open() where the
+tty termios would be left initialised to the driver defaults.
+
+Unlike the serial console implementation, the USB-serial code calls
+subdriver open() already at console setup. While calling set_termios()
+and write() before open() looks like it could work for some USB-serial
+drivers, others definitely do not expect this, so modelling this after
+serial core is going to be intrusive, if at all possible.
+
+Instead, use a (renamed) tty helper to save the termios data used at
+console setup so that the tty termios reflects the actual terminal
+settings after a subsequent tty open().
+
+Note that the calls to tty_init_termios() (tty_driver_install()) and
+tty_save_termios() are serialised using the disconnect mutex.
+
+This specifically fixes a regression that was triggered by a recent
+change adding software flow control to the pl2303 driver: a getty trying
+to disable flow control while leaving the baud rate unchanged would now
+also set the baud rate to the driver default (prior to the flow-control
+change this had been a noop).
+
+Fixes: 7041d9c3f01b ("USB: serial: pl2303: add support for tx xon/xoff flow control")
+Cc: stable <stable@vger.kernel.org> # 4.18
+Cc: Florian Zumbiehl <florz@florz.de>
+Reported-by: Jarkko Nikula <jarkko.nikula@linux.intel.com>
+Tested-by: Jarkko Nikula <jarkko.nikula@linux.intel.com>
+Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/tty_io.c | 11 +++++++++--
+ drivers/usb/serial/console.c | 2 +-
+ include/linux/tty.h | 1 +
+ 3 files changed, 11 insertions(+), 3 deletions(-)
+
+--- a/drivers/tty/tty_io.c
++++ b/drivers/tty/tty_io.c
+@@ -1372,7 +1372,13 @@ err_release_lock:
+ return ERR_PTR(retval);
+ }
+
+-static void tty_free_termios(struct tty_struct *tty)
++/**
++ * tty_save_termios() - save tty termios data in driver table
++ * @tty: tty whose termios data to save
++ *
++ * Locking: Caller guarantees serialisation with tty_init_termios().
++ */
++void tty_save_termios(struct tty_struct *tty)
+ {
+ struct ktermios *tp;
+ int idx = tty->index;
+@@ -1391,6 +1397,7 @@ static void tty_free_termios(struct tty_
+ }
+ *tp = tty->termios;
+ }
++EXPORT_SYMBOL_GPL(tty_save_termios);
+
+ /**
+ * tty_flush_works - flush all works of a tty/pty pair
+@@ -1490,7 +1497,7 @@ static void release_tty(struct tty_struc
+ WARN_ON(!mutex_is_locked(&tty_mutex));
+ if (tty->ops->shutdown)
+ tty->ops->shutdown(tty);
+- tty_free_termios(tty);
++ tty_save_termios(tty);
+ tty_driver_remove_tty(tty->driver, tty);
+ tty->port->itty = NULL;
+ if (tty->link)
+--- a/drivers/usb/serial/console.c
++++ b/drivers/usb/serial/console.c
+@@ -101,7 +101,6 @@ static int usb_console_setup(struct cons
+ cflag |= PARENB;
+ break;
+ }
+- co->cflag = cflag;
+
+ /*
+ * no need to check the index here: if the index is wrong, console
+@@ -164,6 +163,7 @@ static int usb_console_setup(struct cons
+ serial->type->set_termios(tty, port, &dummy);
+
+ tty_port_tty_set(&port->port, NULL);
++ tty_save_termios(tty);
+ tty_kref_put(tty);
+ }
+ tty_port_set_initialized(&port->port, 1);
+--- a/include/linux/tty.h
++++ b/include/linux/tty.h
+@@ -556,6 +556,7 @@ extern struct tty_struct *tty_init_dev(s
+ extern void tty_release_struct(struct tty_struct *tty, int idx);
+ extern int tty_release(struct inode *inode, struct file *filp);
+ extern void tty_init_termios(struct tty_struct *tty);
++extern void tty_save_termios(struct tty_struct *tty);
+ extern int tty_standard_install(struct tty_driver *driver,
+ struct tty_struct *tty);
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
