--- /dev/null
+From 7dc661bd8d3261053b69e4e2d0050cd1ee540fc1 Mon Sep 17 00:00:00 2001
+From: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+Date: Tue, 26 Feb 2019 13:38:16 +0900
+Subject: ALSA: bebob: use more identical mod_alias for Saffire Pro 10 I/O against Liquid Saffire 56
+
+From: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+
+commit 7dc661bd8d3261053b69e4e2d0050cd1ee540fc1 upstream.
+
+ALSA bebob driver has an entry for Focusrite Saffire Pro 10 I/O. The
+entry matches vendor_id in root directory and model_id in unit
+directory of configuration ROM for IEEE 1394 bus.
+
+On the other hand, configuration ROM of Focusrite Liquid Saffire 56
+has the same vendor_id and model_id. This device is an application of
+TCAT Dice (TCD2220 a.k.a Dice Jr.) however ALSA bebob driver can be
+bound to it randomly instead of ALSA dice driver. At present, drivers
+in ALSA firewire stack can not handle this situation appropriately.
+
+This commit uses more identical mod_alias for Focusrite Saffire Pro 10
+I/O in ALSA bebob driver.
+
+$ python2 crpp < /sys/bus/firewire/devices/fw1/config_rom
+ ROM header and bus information block
+ -----------------------------------------------------------------
+400 042a829d bus_info_length 4, crc_length 42, crc 33437
+404 31333934 bus_name "1394"
+408 f0649222 irmc 1, cmc 1, isc 1, bmc 1, pmc 0, cyc_clk_acc 100,
+ max_rec 9 (1024), max_rom 2, gen 2, spd 2 (S400)
+40c 00130e01 company_id 00130e |
+410 000606e0 device_id 01000606e0 | EUI-64 00130e01000606e0
+
+ root directory
+ -----------------------------------------------------------------
+414 0009d31c directory_length 9, crc 54044
+418 04000014 hardware version
+41c 0c0083c0 node capabilities per IEEE 1394
+420 0300130e vendor
+424 81000012 --> descriptor leaf at 46c
+428 17000006 model
+42c 81000016 --> descriptor leaf at 484
+430 130120c2 version
+434 d1000002 --> unit directory at 43c
+438 d4000006 --> dependent info directory at 450
+
+ unit directory at 43c
+ -----------------------------------------------------------------
+43c 0004707c directory_length 4, crc 28796
+440 1200a02d specifier id: 1394 TA
+444 13010001 version: AV/C
+448 17000006 model
+44c 81000013 --> descriptor leaf at 498
+
+ dependent info directory at 450
+ -----------------------------------------------------------------
+450 000637c7 directory_length 6, crc 14279
+454 120007f5 specifier id
+458 13000001 version
+45c 3affffc7 (immediate value)
+460 3b100000 (immediate value)
+464 3cffffc7 (immediate value)
+468 3d600000 (immediate value)
+
+ descriptor leaf at 46c
+ -----------------------------------------------------------------
+46c 00056f3b leaf_length 5, crc 28475
+470 00000000 textual descriptor
+474 00000000 minimal ASCII
+478 466f6375 "Focu"
+47c 73726974 "srit"
+480 65000000 "e"
+
+ descriptor leaf at 484
+ -----------------------------------------------------------------
+484 0004a165 leaf_length 4, crc 41317
+488 00000000 textual descriptor
+48c 00000000 minimal ASCII
+490 50726f31 "Pro1"
+494 30494f00 "0IO"
+
+ descriptor leaf at 498
+ -----------------------------------------------------------------
+498 0004a165 leaf_length 4, crc 41317
+49c 00000000 textual descriptor
+4a0 00000000 minimal ASCII
+4a4 50726f31 "Pro1"
+4a8 30494f00 "0IO"
+
+$ python2 crpp < /sys/bus/firewire/devices/fw1/config_rom
+ ROM header and bus information block
+ -----------------------------------------------------------------
+400 040442e4 bus_info_length 4, crc_length 4, crc 17124
+404 31333934 bus_name "1394"
+408 e0ff8112 irmc 1, cmc 1, isc 1, bmc 0, pmc 0, cyc_clk_acc 255,
+ max_rec 8 (512), max_rom 1, gen 1, spd 2 (S400)
+40c 00130e04 company_id 00130e |
+410 018001e9 device_id 04018001e9 | EUI-64 00130e04018001e9
+
+ root directory
+ -----------------------------------------------------------------
+414 00065612 directory_length 6, crc 22034
+418 0300130e vendor
+41c 8100000a --> descriptor leaf at 444
+420 17000006 model
+424 8100000e --> descriptor leaf at 45c
+428 0c0087c0 node capabilities per IEEE 1394
+42c d1000001 --> unit directory at 430
+
+ unit directory at 430
+ -----------------------------------------------------------------
+430 000418a0 directory_length 4, crc 6304
+434 1200130e specifier id
+438 13000001 version
+43c 17000006 model
+440 8100000f --> descriptor leaf at 47c
+
+ descriptor leaf at 444
+ -----------------------------------------------------------------
+444 00056f3b leaf_length 5, crc 28475
+448 00000000 textual descriptor
+44c 00000000 minimal ASCII
+450 466f6375 "Focu"
+454 73726974 "srit"
+458 65000000 "e"
+
+ descriptor leaf at 45c
+ -----------------------------------------------------------------
+45c 000762c6 leaf_length 7, crc 25286
+460 00000000 textual descriptor
+464 00000000 minimal ASCII
+468 4c495155 "LIQU"
+46c 49445f53 "ID_S"
+470 41464649 "AFFI"
+474 52455f35 "RE_5"
+478 36000000 "6"
+
+ descriptor leaf at 47c
+ -----------------------------------------------------------------
+47c 000762c6 leaf_length 7, crc 25286
+480 00000000 textual descriptor
+484 00000000 minimal ASCII
+488 4c495155 "LIQU"
+48c 49445f53 "ID_S"
+490 41464649 "AFFI"
+494 52455f35 "RE_5"
+498 36000000 "6"
+
+Cc: <stable@vger.kernel.org> # v3.16+
+Fixes: 25784ec2d034 ("ALSA: bebob: Add support for Focusrite Saffire/SaffirePro series")
+Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/firewire/bebob/bebob.c | 14 +++++++++++++-
+ 1 file changed, 13 insertions(+), 1 deletion(-)
+
+--- a/sound/firewire/bebob/bebob.c
++++ b/sound/firewire/bebob/bebob.c
+@@ -474,7 +474,19 @@ static const struct ieee1394_device_id b
+ /* Focusrite, SaffirePro 26 I/O */
+ SND_BEBOB_DEV_ENTRY(VEN_FOCUSRITE, 0x00000003, &saffirepro_26_spec),
+ /* Focusrite, SaffirePro 10 I/O */
+- SND_BEBOB_DEV_ENTRY(VEN_FOCUSRITE, 0x00000006, &saffirepro_10_spec),
++ {
++ // The combination of vendor_id and model_id is the same as the
++ // same as the one of Liquid Saffire 56.
++ .match_flags = IEEE1394_MATCH_VENDOR_ID |
++ IEEE1394_MATCH_MODEL_ID |
++ IEEE1394_MATCH_SPECIFIER_ID |
++ IEEE1394_MATCH_VERSION,
++ .vendor_id = VEN_FOCUSRITE,
++ .model_id = 0x000006,
++ .specifier_id = 0x00a02d,
++ .version = 0x010001,
++ .driver_data = (kernel_ulong_t)&saffirepro_10_spec,
++ },
+ /* Focusrite, Saffire(no label and LE) */
+ SND_BEBOB_DEV_ENTRY(VEN_FOCUSRITE, MODEL_FOCUSRITE_SAFFIRE_BOTH,
+ &saffire_spec),
--- /dev/null
+From f97a0944a72b26a2bece72516294e112a890f98a Mon Sep 17 00:00:00 2001
+From: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+Date: Tue, 26 Feb 2019 13:38:37 +0900
+Subject: ALSA: firewire-motu: fix construction of PCM frame for capture direction
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+
+commit f97a0944a72b26a2bece72516294e112a890f98a upstream.
+
+In data blocks of common isochronous packet for MOTU devices, PCM
+frames are multiplexed in a shape of '24 bit * 4 Audio Pack', described
+in IEC 61883-6. The frames are not aligned to quadlet.
+
+For capture PCM substream, ALSA firewire-motu driver constructs PCM
+frames by reading data blocks byte-by-byte. However this operation
+includes bug for lower byte of the PCM sample. This brings invalid
+content of the PCM samples.
+
+This commit fixes the bug.
+
+Reported-by: Peter Sjöberg <autopeter@gmail.com>
+Cc: <stable@vger.kernel.org> # v4.12+
+Fixes: 4641c9394010 ("ALSA: firewire-motu: add MOTU specific protocol layer")
+Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/firewire/motu/amdtp-motu.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/sound/firewire/motu/amdtp-motu.c
++++ b/sound/firewire/motu/amdtp-motu.c
+@@ -136,7 +136,9 @@ static void read_pcm_s32(struct amdtp_st
+ byte = (u8 *)buffer + p->pcm_byte_offset;
+
+ for (c = 0; c < channels; ++c) {
+- *dst = (byte[0] << 24) | (byte[1] << 16) | byte[2];
++ *dst = (byte[0] << 24) |
++ (byte[1] << 16) |
++ (byte[2] << 8);
+ byte += 3;
+ dst++;
+ }
--- /dev/null
+From 167897f4b32c2bc18b3b6183029a33fb420a114e Mon Sep 17 00:00:00 2001
+From: Jaroslav Kysela <perex@perex.cz>
+Date: Wed, 13 Mar 2019 13:40:15 +0100
+Subject: ALSA: hda - add more quirks for HP Z2 G4 and HP Z240
+
+From: Jaroslav Kysela <perex@perex.cz>
+
+commit 167897f4b32c2bc18b3b6183029a33fb420a114e upstream.
+
+Apply the HP_MIC_NO_PRESENCE fixups for the more HP Z2 G4 and
+HP Z240 models.
+
+Reported-by: Jeff Burrell <jeff.burrell@hp.com>
+Signed-off-by: Jaroslav Kysela <perex@perex.cz>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_conexant.c | 3 +++
+ sound/pci/hda/patch_realtek.c | 6 ++++--
+ 2 files changed, 7 insertions(+), 2 deletions(-)
+
+--- a/sound/pci/hda/patch_conexant.c
++++ b/sound/pci/hda/patch_conexant.c
+@@ -936,6 +936,9 @@ static const struct snd_pci_quirk cxt506
+ SND_PCI_QUIRK(0x103c, 0x8299, "HP 800 G3 SFF", CXT_FIXUP_HP_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x103c, 0x829a, "HP 800 G3 DM", CXT_FIXUP_HP_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x103c, 0x8455, "HP Z2 G4", CXT_FIXUP_HP_MIC_NO_PRESENCE),
++ SND_PCI_QUIRK(0x103c, 0x8456, "HP Z2 G4 SFF", CXT_FIXUP_HP_MIC_NO_PRESENCE),
++ SND_PCI_QUIRK(0x103c, 0x8457, "HP Z2 G4 mini", CXT_FIXUP_HP_MIC_NO_PRESENCE),
++ SND_PCI_QUIRK(0x103c, 0x8458, "HP Z2 G4 mini premium", CXT_FIXUP_HP_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1043, 0x138d, "Asus", CXT_FIXUP_HEADPHONE_MIC_PIN),
+ SND_PCI_QUIRK(0x152d, 0x0833, "OLPC XO-1.5", CXT_FIXUP_OLPC_XO),
+ SND_PCI_QUIRK(0x17aa, 0x20f2, "Lenovo T400", CXT_PINCFG_LENOVO_TP410),
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -6670,11 +6670,13 @@ static const struct snd_pci_quirk alc269
+ SND_PCI_QUIRK(0x103c, 0x2336, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+ SND_PCI_QUIRK(0x103c, 0x2337, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+ SND_PCI_QUIRK(0x103c, 0x221c, "HP EliteBook 755 G2", ALC280_FIXUP_HP_HEADSET_MIC),
++ SND_PCI_QUIRK(0x103c, 0x802e, "HP Z240 SFF", ALC221_FIXUP_HP_MIC_NO_PRESENCE),
++ SND_PCI_QUIRK(0x103c, 0x802f, "HP Z240", ALC221_FIXUP_HP_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x103c, 0x820d, "HP Pavilion 15", ALC269_FIXUP_HP_MUTE_LED_MIC3),
+ SND_PCI_QUIRK(0x103c, 0x8256, "HP", ALC221_FIXUP_HP_FRONT_MIC),
+ SND_PCI_QUIRK(0x103c, 0x827e, "HP x360", ALC295_FIXUP_HP_X360),
+- SND_PCI_QUIRK(0x103c, 0x82bf, "HP", ALC221_FIXUP_HP_MIC_NO_PRESENCE),
+- SND_PCI_QUIRK(0x103c, 0x82c0, "HP", ALC221_FIXUP_HP_MIC_NO_PRESENCE),
++ SND_PCI_QUIRK(0x103c, 0x82bf, "HP G3 mini", ALC221_FIXUP_HP_MIC_NO_PRESENCE),
++ SND_PCI_QUIRK(0x103c, 0x82c0, "HP G3 mini premium", ALC221_FIXUP_HP_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x103c, 0x83b9, "HP Spectre x360", ALC269_FIXUP_HP_MUTE_LED_MIC3),
+ SND_PCI_QUIRK(0x1043, 0x103e, "ASUS X540SA", ALC256_FIXUP_ASUS_MIC),
+ SND_PCI_QUIRK(0x1043, 0x103f, "ASUS TX300", ALC282_FIXUP_ASUS_TX300),
--- /dev/null
+From cfc35f9c128cea8fce6a5513b1de50d36f3b209f Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Mon, 25 Feb 2019 16:49:27 +0100
+Subject: ALSA: hda: Extend i915 component bind timeout
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit cfc35f9c128cea8fce6a5513b1de50d36f3b209f upstream.
+
+I set 10 seconds for the timeout of the i915 audio component binding
+with a hope that recent machines are fast enough to handle all probe
+tasks in that period, but I was too optimistic. The binding may take
+longer than that, and this caused a problem on the machine with both
+audio and graphics driver modules loaded in parallel, as Paul Menzel
+experienced. This problem haven't hit so often just because the KMS
+driver is loaded in initrd on most machines.
+
+As a simple workaround, extend the timeout to 60 seconds.
+
+Fixes: f9b54e1961c7 ("ALSA: hda/i915: Allow delayed i915 audio component binding")
+Reported-by: Paul Menzel <pmenzel+alsa-devel@molgen.mpg.de>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/hda/hdac_i915.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/sound/hda/hdac_i915.c
++++ b/sound/hda/hdac_i915.c
+@@ -144,9 +144,9 @@ int snd_hdac_i915_init(struct hdac_bus *
+ return -ENODEV;
+ if (!acomp->ops) {
+ request_module("i915");
+- /* 10s timeout */
++ /* 60s timeout */
+ wait_for_completion_timeout(&bind_complete,
+- msecs_to_jiffies(10 * 1000));
++ msecs_to_jiffies(60 * 1000));
+ }
+ if (!acomp->ops) {
+ dev_info(bus->dev, "couldn't bind with audio component\n");
--- /dev/null
+From 8bb37a2a4d7c02affef554f5dc05f6d2e39c31f9 Mon Sep 17 00:00:00 2001
+From: Jian-Hong Pan <jian-hong@endlessm.com>
+Date: Thu, 21 Feb 2019 17:00:18 +0800
+Subject: ALSA: hda/realtek: Enable audio jacks of ASUS UX362FA with ALC294
+
+From: Jian-Hong Pan <jian-hong@endlessm.com>
+
+commit 8bb37a2a4d7c02affef554f5dc05f6d2e39c31f9 upstream.
+
+The ASUS UX362FA with ALC294 cannot detect the headset MIC and outputs
+through the internal speaker and the headphone. This issue can be fixed
+by the quirk in the commit 4e0511067 ALSA: hda/realtek: Enable audio
+jacks of ASUS UX533FD with ALC294.
+
+Besides, ASUS UX362FA and UX533FD have the same audio initial pin config
+values. So, this patch replaces SND_PCI_QUIRK of UX533FD with a new
+SND_HDA_PIN_QUIRK which benefits both UX362FA and UX533FD.
+
+Fixes: 4e051106730d ("ALSA: hda/realtek: Enable audio jacks of ASUS UX533FD with ALC294")
+Signed-off-by: Jian-Hong Pan <jian-hong@endlessm.com>
+Signed-off-by: Ming Shuo Chiu <chiu@endlessm.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_realtek.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -6692,7 +6692,6 @@ static const struct snd_pci_quirk alc269
+ SND_PCI_QUIRK(0x1043, 0x12e0, "ASUS X541SA", ALC256_FIXUP_ASUS_MIC),
+ SND_PCI_QUIRK(0x1043, 0x13b0, "ASUS Z550SA", ALC256_FIXUP_ASUS_MIC),
+ SND_PCI_QUIRK(0x1043, 0x1427, "Asus Zenbook UX31E", ALC269VB_FIXUP_ASUS_ZENBOOK),
+- SND_PCI_QUIRK(0x1043, 0x14a1, "ASUS UX533FD", ALC294_FIXUP_ASUS_SPK),
+ SND_PCI_QUIRK(0x1043, 0x1517, "Asus Zenbook UX31A", ALC269VB_FIXUP_ASUS_ZENBOOK_UX31A),
+ SND_PCI_QUIRK(0x1043, 0x16e3, "ASUS UX50", ALC269_FIXUP_STEREO_DMIC),
+ SND_PCI_QUIRK(0x1043, 0x1a13, "Asus G73Jw", ALC269_FIXUP_ASUS_G73JW),
+@@ -7308,6 +7307,10 @@ static const struct snd_hda_pin_quirk al
+ SND_HDA_PIN_QUIRK(0x10ec0294, 0x1043, "ASUS", ALC294_FIXUP_ASUS_SPK,
+ {0x12, 0x90a60130},
+ {0x17, 0x90170110},
++ {0x21, 0x03211020}),
++ SND_HDA_PIN_QUIRK(0x10ec0294, 0x1043, "ASUS", ALC294_FIXUP_ASUS_SPK,
++ {0x12, 0x90a60130},
++ {0x17, 0x90170110},
+ {0x21, 0x04211020}),
+ SND_HDA_PIN_QUIRK(0x10ec0295, 0x1028, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE,
+ ALC295_STANDARD_PINS,
--- /dev/null
+From cbc05fd6708c1744ee6a61cb4c461ff956d30524 Mon Sep 17 00:00:00 2001
+From: Jian-Hong Pan <jian-hong@endlessm.com>
+Date: Wed, 13 Mar 2019 17:33:24 +0800
+Subject: ALSA: hda/realtek: Enable headset MIC of Acer TravelMate X514-51T with ALC255
+
+From: Jian-Hong Pan <jian-hong@endlessm.com>
+
+commit cbc05fd6708c1744ee6a61cb4c461ff956d30524 upstream.
+
+The Acer TravelMate X514-51T with ALC255 cannot detect the headset MIC
+until ALC255_FIXUP_ACER_HEADSET_MIC quirk applied. Although, the
+internal DMIC uses another module - snd_soc_skl as the driver. We still
+need the NID 0x1a in the quirk to enable the headset MIC.
+
+Signed-off-by: Jian-Hong Pan <jian-hong@endlessm.com>
+Signed-off-by: Kailang Yang <kailang@realtek.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_realtek.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -5612,6 +5612,7 @@ enum {
+ ALC294_FIXUP_ASUS_SPK,
+ ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE,
+ ALC285_FIXUP_LENOVO_PC_BEEP_IN_NOISE,
++ ALC255_FIXUP_ACER_HEADSET_MIC,
+ };
+
+ static const struct hda_fixup alc269_fixups[] = {
+@@ -6556,6 +6557,16 @@ static const struct hda_fixup alc269_fix
+ .chained = true,
+ .chain_id = ALC285_FIXUP_LENOVO_HEADPHONE_NOISE
+ },
++ [ALC255_FIXUP_ACER_HEADSET_MIC] = {
++ .type = HDA_FIXUP_PINS,
++ .v.pins = (const struct hda_pintbl[]) {
++ { 0x19, 0x03a11130 },
++ { 0x1a, 0x90a60140 }, /* use as internal mic */
++ { }
++ },
++ .chained = true,
++ .chain_id = ALC255_FIXUP_HEADSET_MODE_NO_HP_MIC
++ },
+ };
+
+ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+@@ -6575,6 +6586,7 @@ static const struct snd_pci_quirk alc269
+ SND_PCI_QUIRK(0x1025, 0x128f, "Acer Veriton Z6860G", ALC286_FIXUP_ACER_AIO_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1025, 0x1290, "Acer Veriton Z4860G", ALC286_FIXUP_ACER_AIO_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1025, 0x1291, "Acer Veriton Z4660G", ALC286_FIXUP_ACER_AIO_MIC_NO_PRESENCE),
++ SND_PCI_QUIRK(0x1025, 0x1330, "Acer TravelMate X514-51T", ALC255_FIXUP_ACER_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1028, 0x0470, "Dell M101z", ALC269_FIXUP_DELL_M101Z),
+ SND_PCI_QUIRK(0x1028, 0x054b, "Dell XPS one 2710", ALC275_FIXUP_DELL_XPS),
+ SND_PCI_QUIRK(0x1028, 0x05bd, "Dell Latitude E6440", ALC292_FIXUP_DELL_E7X),
--- /dev/null
+From c0ca5eced22215c1e03e3ad479f8fab0bbb30772 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Wed, 20 Feb 2019 16:15:45 +0100
+Subject: ALSA: hda/realtek - Reduce click noise on Dell Precision 5820 headphone
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit c0ca5eced22215c1e03e3ad479f8fab0bbb30772 upstream.
+
+Dell Precision 5820 with ALC3234 codec (which is equivalent with
+ALC255) shows click noises at (runtime) PM resume on the headphone.
+The biggest source of the noise comes from the cleared headphone pin
+control at resume, which is done via the standard shutup procedure.
+
+Although we have an override of the standard shutup callback to
+replace with NOP, this would skip other needed stuff (e.g. the pull
+down of headset power). So, instead, this "fixes" the behavior of
+alc_fixup_no_shutup() by introducing spec->no_shutup_pins flag.
+When this flag is set, Realtek codec won't call the standard
+snd_hda_shutup_pins() & co. Now alc_fixup_no_shutup() just sets this
+flag instead of overriding spec->shutup callback itself. This allows
+us to apply the similar fix for other entries easily if needed in
+future.
+
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_realtek.c | 57 +++++++++++++++++++++++++-----------------
+ 1 file changed, 34 insertions(+), 23 deletions(-)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -118,6 +118,7 @@ struct alc_spec {
+ unsigned int has_alc5505_dsp:1;
+ unsigned int no_depop_delay:1;
+ unsigned int done_hp_init:1;
++ unsigned int no_shutup_pins:1;
+
+ /* for PLL fix */
+ hda_nid_t pll_nid;
+@@ -476,6 +477,14 @@ static void alc_auto_setup_eapd(struct h
+ set_eapd(codec, *p, on);
+ }
+
++static void alc_shutup_pins(struct hda_codec *codec)
++{
++ struct alc_spec *spec = codec->spec;
++
++ if (!spec->no_shutup_pins)
++ snd_hda_shutup_pins(codec);
++}
++
+ /* generic shutup callback;
+ * just turning off EAPD and a little pause for avoiding pop-noise
+ */
+@@ -486,7 +495,7 @@ static void alc_eapd_shutup(struct hda_c
+ alc_auto_setup_eapd(codec, false);
+ if (!spec->no_depop_delay)
+ msleep(200);
+- snd_hda_shutup_pins(codec);
++ alc_shutup_pins(codec);
+ }
+
+ /* generic EAPD initialization */
+@@ -814,7 +823,7 @@ static inline void alc_shutup(struct hda
+ if (spec && spec->shutup)
+ spec->shutup(codec);
+ else
+- snd_hda_shutup_pins(codec);
++ alc_shutup_pins(codec);
+ }
+
+ static void alc_reboot_notify(struct hda_codec *codec)
+@@ -2950,7 +2959,7 @@ static void alc269_shutup(struct hda_cod
+ (alc_get_coef0(codec) & 0x00ff) == 0x018) {
+ msleep(150);
+ }
+- snd_hda_shutup_pins(codec);
++ alc_shutup_pins(codec);
+ }
+
+ static struct coef_fw alc282_coefs[] = {
+@@ -3053,14 +3062,15 @@ static void alc282_shutup(struct hda_cod
+ if (hp_pin_sense)
+ msleep(85);
+
+- snd_hda_codec_write(codec, hp_pin, 0,
+- AC_VERB_SET_PIN_WIDGET_CONTROL, 0x0);
++ if (!spec->no_shutup_pins)
++ snd_hda_codec_write(codec, hp_pin, 0,
++ AC_VERB_SET_PIN_WIDGET_CONTROL, 0x0);
+
+ if (hp_pin_sense)
+ msleep(100);
+
+ alc_auto_setup_eapd(codec, false);
+- snd_hda_shutup_pins(codec);
++ alc_shutup_pins(codec);
+ alc_write_coef_idx(codec, 0x78, coef78);
+ }
+
+@@ -3166,15 +3176,16 @@ static void alc283_shutup(struct hda_cod
+ if (hp_pin_sense)
+ msleep(100);
+
+- snd_hda_codec_write(codec, hp_pin, 0,
+- AC_VERB_SET_PIN_WIDGET_CONTROL, 0x0);
++ if (!spec->no_shutup_pins)
++ snd_hda_codec_write(codec, hp_pin, 0,
++ AC_VERB_SET_PIN_WIDGET_CONTROL, 0x0);
+
+ alc_update_coef_idx(codec, 0x46, 0, 3 << 12);
+
+ if (hp_pin_sense)
+ msleep(100);
+ alc_auto_setup_eapd(codec, false);
+- snd_hda_shutup_pins(codec);
++ alc_shutup_pins(codec);
+ alc_write_coef_idx(codec, 0x43, 0x9614);
+ }
+
+@@ -3240,14 +3251,15 @@ static void alc256_shutup(struct hda_cod
+ /* NOTE: call this before clearing the pin, otherwise codec stalls */
+ alc_update_coef_idx(codec, 0x46, 0, 3 << 12);
+
+- snd_hda_codec_write(codec, hp_pin, 0,
+- AC_VERB_SET_PIN_WIDGET_CONTROL, 0x0);
++ if (!spec->no_shutup_pins)
++ snd_hda_codec_write(codec, hp_pin, 0,
++ AC_VERB_SET_PIN_WIDGET_CONTROL, 0x0);
+
+ if (hp_pin_sense)
+ msleep(100);
+
+ alc_auto_setup_eapd(codec, false);
+- snd_hda_shutup_pins(codec);
++ alc_shutup_pins(codec);
+ }
+
+ static void alc225_init(struct hda_codec *codec)
+@@ -3334,7 +3346,7 @@ static void alc225_shutup(struct hda_cod
+ msleep(100);
+
+ alc_auto_setup_eapd(codec, false);
+- snd_hda_shutup_pins(codec);
++ alc_shutup_pins(codec);
+ }
+
+ static void alc_default_init(struct hda_codec *codec)
+@@ -3388,14 +3400,15 @@ static void alc_default_shutup(struct hd
+ if (hp_pin_sense)
+ msleep(85);
+
+- snd_hda_codec_write(codec, hp_pin, 0,
+- AC_VERB_SET_PIN_WIDGET_CONTROL, 0x0);
++ if (!spec->no_shutup_pins)
++ snd_hda_codec_write(codec, hp_pin, 0,
++ AC_VERB_SET_PIN_WIDGET_CONTROL, 0x0);
+
+ if (hp_pin_sense)
+ msleep(100);
+
+ alc_auto_setup_eapd(codec, false);
+- snd_hda_shutup_pins(codec);
++ alc_shutup_pins(codec);
+ }
+
+ static void alc294_hp_init(struct hda_codec *codec)
+@@ -3412,8 +3425,9 @@ static void alc294_hp_init(struct hda_co
+
+ msleep(100);
+
+- snd_hda_codec_write(codec, hp_pin, 0,
+- AC_VERB_SET_PIN_WIDGET_CONTROL, 0x0);
++ if (!spec->no_shutup_pins)
++ snd_hda_codec_write(codec, hp_pin, 0,
++ AC_VERB_SET_PIN_WIDGET_CONTROL, 0x0);
+
+ alc_update_coef_idx(codec, 0x6f, 0x000f, 0);/* Set HP depop to manual mode */
+ alc_update_coefex_idx(codec, 0x58, 0x00, 0x8000, 0x8000); /* HP depop procedure start */
+@@ -5007,16 +5021,12 @@ static void alc_fixup_auto_mute_via_amp(
+ }
+ }
+
+-static void alc_no_shutup(struct hda_codec *codec)
+-{
+-}
+-
+ static void alc_fixup_no_shutup(struct hda_codec *codec,
+ const struct hda_fixup *fix, int action)
+ {
+ if (action == HDA_FIXUP_ACT_PRE_PROBE) {
+ struct alc_spec *spec = codec->spec;
+- spec->shutup = alc_no_shutup;
++ spec->no_shutup_pins = 1;
+ }
+ }
+
+@@ -6596,6 +6606,7 @@ static const struct snd_pci_quirk alc269
+ SND_PCI_QUIRK(0x1028, 0x0704, "Dell XPS 13 9350", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE),
+ SND_PCI_QUIRK(0x1028, 0x0706, "Dell Inspiron 7559", ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER),
+ SND_PCI_QUIRK(0x1028, 0x0725, "Dell Inspiron 3162", ALC255_FIXUP_DELL_SPK_NOISE),
++ SND_PCI_QUIRK(0x1028, 0x0738, "Dell Precision 5820", ALC269_FIXUP_NO_SHUTUP),
+ SND_PCI_QUIRK(0x1028, 0x075b, "Dell XPS 13 9360", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE),
+ SND_PCI_QUIRK(0x1028, 0x075c, "Dell XPS 27 7760", ALC298_FIXUP_SPK_VOLUME),
+ SND_PCI_QUIRK(0x1028, 0x075d, "Dell AIO", ALC298_FIXUP_SPK_VOLUME),
--- /dev/null
+From 25dc194b34dd5919dd07b8873ee338182e15df9d Mon Sep 17 00:00:00 2001
+From: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
+Date: Mon, 7 Jan 2019 12:41:46 -0500
+Subject: drm: Block fb changes for async plane updates
+
+From: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
+
+commit 25dc194b34dd5919dd07b8873ee338182e15df9d upstream.
+
+The prepare_fb call always happens on new_plane_state.
+
+The drm_atomic_helper_cleanup_planes checks to see if
+plane state pointer has changed when deciding to call cleanup_fb on
+either the new_plane_state or the old_plane_state.
+
+For a non-async atomic commit the state pointer is swapped, so this
+helper calls prepare_fb on the new_plane_state and cleanup_fb on the
+old_plane_state. This makes sense, since we want to prepare the
+framebuffer we are going to use and cleanup the the framebuffer we are
+no longer using.
+
+For the async atomic update helpers this differs. The async atomic
+update helpers perform in-place updates on the existing state. They call
+drm_atomic_helper_cleanup_planes but the state pointer is not swapped.
+This means that prepare_fb is called on the new_plane_state and
+cleanup_fb is called on the new_plane_state (not the old).
+
+In the case where old_plane_state->fb == new_plane_state->fb then
+there should be no behavioral difference between an async update
+and a non-async commit. But there are issues that arise when
+old_plane_state->fb != new_plane_state->fb.
+
+The first is that the new_plane_state->fb is immediately cleaned up
+after it has been prepared, so we're using a fb that we shouldn't
+be.
+
+The second occurs during a sequence of async atomic updates and
+non-async regular atomic commits. Suppose there are two framebuffers
+being interleaved in a double-buffering scenario, fb1 and fb2:
+
+- Async update, oldfb = NULL, newfb = fb1, prepare fb1, cleanup fb1
+- Async update, oldfb = fb1, newfb = fb2, prepare fb2, cleanup fb2
+- Non-async commit, oldfb = fb2, newfb = fb1, prepare fb1, cleanup fb2
+
+We call cleanup_fb on fb2 twice in this example scenario, and any
+further use will result in use-after-free.
+
+The simple fix to this problem is to block framebuffer changes
+in the drm_atomic_helper_async_check function for now.
+
+v2: Move check by itself, add a FIXME (Daniel)
+
+Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
+Cc: Harry Wentland <harry.wentland@amd.com>
+Cc: Andrey Grodzovsky <andrey.grodzovsky@amd.com>
+Cc: <stable@vger.kernel.org> # v4.14+
+Fixes: fef9df8b5945 ("drm/atomic: initial support for asynchronous plane update")
+Signed-off-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
+Acked-by: Andrey Grodzovsky <andrey.grodzovsky@amd.com>
+Acked-by: Harry Wentland <harry.wentland@amd.com>
+Reviewed-by: Daniel Vetter <daniel@ffwll.ch>
+Signed-off-by: Harry Wentland <harry.wentland@amd.com>
+Link: https://patchwork.freedesktop.org/patch/275364/
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/drm_atomic_helper.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/drivers/gpu/drm/drm_atomic_helper.c
++++ b/drivers/gpu/drm/drm_atomic_helper.c
+@@ -1573,6 +1573,15 @@ int drm_atomic_helper_async_check(struct
+ if (old_plane_state->fb != new_plane_state->fb)
+ return -EINVAL;
+
++ /*
++ * FIXME: Since prepare_fb and cleanup_fb are always called on
++ * the new_plane_state for async updates we need to block framebuffer
++ * changes. This prevents use of a fb that's been cleaned up and
++ * double cleanups from occuring.
++ */
++ if (old_plane_state->fb != new_plane_state->fb)
++ return -EINVAL;
++
+ funcs = plane->helper_private;
+ if (!funcs->atomic_async_update)
+ return -EINVAL;
--- /dev/null
+From cdec2141c24ef177d929765c5a6f95549c266fb3 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Bj=C3=B6rn=20T=C3=B6pel?= <bjorn.topel@intel.com>
+Date: Fri, 24 Aug 2018 13:21:59 +0200
+Subject: i40e: report correct statistics when XDP is enabled
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Björn Töpel <bjorn.topel@intel.com>
+
+commit cdec2141c24ef177d929765c5a6f95549c266fb3 upstream.
+
+When XDP is enabled, the driver will report incorrect
+statistics. Received frames will reported as transmitted frames.
+
+This commits fixes the i40e implementation of ndo_get_stats64 (struct
+net_device_ops), so that iproute2 will report correct statistics
+(e.g. when running "ip -stats link show dev eth0") even when XDP is
+enabled.
+
+Reported-by: Jesper Dangaard Brouer <brouer@redhat.com>
+Fixes: 74608d17fe29 ("i40e: add support for XDP_TX action")
+Signed-off-by: Björn Töpel <bjorn.topel@intel.com>
+Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Cc: Emeric Brun <ebrun@haproxy.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/ethernet/intel/i40e/i40e_main.c | 24 +++++++++++++-----------
+ 1 file changed, 13 insertions(+), 11 deletions(-)
+
+--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
+@@ -424,9 +424,9 @@ static void i40e_get_netdev_stats_struct
+ struct rtnl_link_stats64 *stats)
+ {
+ struct i40e_netdev_priv *np = netdev_priv(netdev);
+- struct i40e_ring *tx_ring, *rx_ring;
+ struct i40e_vsi *vsi = np->vsi;
+ struct rtnl_link_stats64 *vsi_stats = i40e_get_vsi_stats_struct(vsi);
++ struct i40e_ring *ring;
+ int i;
+
+ if (test_bit(__I40E_VSI_DOWN, vsi->state))
+@@ -440,24 +440,26 @@ static void i40e_get_netdev_stats_struct
+ u64 bytes, packets;
+ unsigned int start;
+
+- tx_ring = READ_ONCE(vsi->tx_rings[i]);
+- if (!tx_ring)
++ ring = READ_ONCE(vsi->tx_rings[i]);
++ if (!ring)
+ continue;
+- i40e_get_netdev_stats_struct_tx(tx_ring, stats);
++ i40e_get_netdev_stats_struct_tx(ring, stats);
+
+- rx_ring = &tx_ring[1];
++ if (i40e_enabled_xdp_vsi(vsi)) {
++ ring++;
++ i40e_get_netdev_stats_struct_tx(ring, stats);
++ }
+
++ ring++;
+ do {
+- start = u64_stats_fetch_begin_irq(&rx_ring->syncp);
+- packets = rx_ring->stats.packets;
+- bytes = rx_ring->stats.bytes;
+- } while (u64_stats_fetch_retry_irq(&rx_ring->syncp, start));
++ start = u64_stats_fetch_begin_irq(&ring->syncp);
++ packets = ring->stats.packets;
++ bytes = ring->stats.bytes;
++ } while (u64_stats_fetch_retry_irq(&ring->syncp, start));
+
+ stats->rx_packets += packets;
+ stats->rx_bytes += bytes;
+
+- if (i40e_enabled_xdp_vsi(vsi))
+- i40e_get_netdev_stats_struct_tx(&rx_ring[1], stats);
+ }
+ rcu_read_unlock();
+
--- /dev/null
+From b761dcf1217760a42f7897c31dcb649f59b2333e Mon Sep 17 00:00:00 2001
+From: Xiao Ni <xni@redhat.com>
+Date: Fri, 8 Mar 2019 23:52:05 +0800
+Subject: It's wrong to add len to sector_nr in raid10 reshape twice
+
+From: Xiao Ni <xni@redhat.com>
+
+commit b761dcf1217760a42f7897c31dcb649f59b2333e upstream.
+
+In reshape_request it already adds len to sector_nr already. It's wrong to add len to
+sector_nr again after adding pages to bio. If there is bad block it can't copy one chunk
+at a time, it needs to goto read_more. Now the sector_nr is wrong. It can cause data
+corruption.
+
+Cc: stable@vger.kernel.org # v3.16+
+Signed-off-by: Xiao Ni <xni@redhat.com>
+Signed-off-by: Song Liu <songliubraving@fb.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/raid10.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/drivers/md/raid10.c
++++ b/drivers/md/raid10.c
+@@ -4630,7 +4630,6 @@ read_more:
+ atomic_inc(&r10_bio->remaining);
+ read_bio->bi_next = NULL;
+ generic_make_request(read_bio);
+- sector_nr += nr_sectors;
+ sectors_done += nr_sectors;
+ if (sector_nr <= last)
+ goto read_more;
--- /dev/null
+From f764c58b7faa26f5714e6907f892abc2bc0de4f8 Mon Sep 17 00:00:00 2001
+From: Peter Zijlstra <peterz@infradead.org>
+Date: Fri, 15 Mar 2019 09:14:10 +0100
+Subject: perf/x86: Fixup typo in stub functions
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Peter Zijlstra <peterz@infradead.org>
+
+commit f764c58b7faa26f5714e6907f892abc2bc0de4f8 upstream.
+
+Guenter reported a build warning for CONFIG_CPU_SUP_INTEL=n:
+
+ > With allmodconfig-CONFIG_CPU_SUP_INTEL, this patch results in:
+ >
+ > In file included from arch/x86/events/amd/core.c:8:0:
+ > arch/x86/events/amd/../perf_event.h:1036:45: warning: ‘struct cpu_hw_event’ declared inside parameter list will not be visible outside of this definition or declaration
+ > static inline int intel_cpuc_prepare(struct cpu_hw_event *cpuc, int cpu)
+
+While harmless (an unsed pointer is an unused pointer, no matter the type)
+it needs fixing.
+
+Reported-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: stable@vger.kernel.org
+Fixes: d01b1f96a82e ("perf/x86/intel: Make cpuc allocations consistent")
+Link: http://lkml.kernel.org/r/20190315081410.GR5996@hirez.programming.kicks-ass.net
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/events/perf_event.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/x86/events/perf_event.h
++++ b/arch/x86/events/perf_event.h
+@@ -1030,12 +1030,12 @@ static inline int intel_pmu_init(void)
+ return 0;
+ }
+
+-static inline int intel_cpuc_prepare(struct cpu_hw_event *cpuc, int cpu)
++static inline int intel_cpuc_prepare(struct cpu_hw_events *cpuc, int cpu)
+ {
+ return 0;
+ }
+
+-static inline void intel_cpuc_finish(struct cpu_hw_event *cpuc)
++static inline void intel_cpuc_finish(struct cpu_hw_events *cpuc)
+ {
+ }
+
--- /dev/null
+From ede271b059463731cbd6dffe55ffd70d7dbe8392 Mon Sep 17 00:00:00 2001
+From: Peter Zijlstra <peterz@infradead.org>
+Date: Thu, 14 Mar 2019 14:01:14 +0100
+Subject: perf/x86/intel: Fix memory corruption
+
+From: Peter Zijlstra <peterz@infradead.org>
+
+commit ede271b059463731cbd6dffe55ffd70d7dbe8392 upstream.
+
+Through:
+
+ validate_event()
+ x86_pmu.get_event_constraints(.idx=-1)
+ tfa_get_event_constraints()
+ dyn_constraint()
+
+cpuc->constraint_list[-1] is used, which is an obvious out-of-bound access.
+
+In this case, simply skip the TFA constraint code, there is no event
+constraint with just PMC3, therefore the code will never result in the
+empty set.
+
+Fixes: 400816f60c54 ("perf/x86/intel: Implement support for TSX Force Abort")
+Reported-by: Tony Jones <tonyj@suse.com>
+Reported-by: "DSouza, Nelson" <nelson.dsouza@intel.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Tested-by: Tony Jones <tonyj@suse.com>
+Tested-by: "DSouza, Nelson" <nelson.dsouza@intel.com>
+Cc: eranian@google.com
+Cc: jolsa@redhat.com
+Cc: stable@kernel.org
+Link: https://lkml.kernel.org/r/20190314130705.441549378@infradead.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/events/intel/core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/x86/events/intel/core.c
++++ b/arch/x86/events/intel/core.c
+@@ -3282,7 +3282,7 @@ tfa_get_event_constraints(struct cpu_hw_
+ /*
+ * Without TFA we must not use PMC3.
+ */
+- if (!allow_tsx_force_abort && test_bit(3, c->idxmsk)) {
++ if (!allow_tsx_force_abort && test_bit(3, c->idxmsk) && idx >= 0) {
+ c = dyn_constraint(cpuc, c, idx);
+ c->idxmsk64 &= ~(1ULL << 3);
+ c->weight--;
--- /dev/null
+From c634dc6bdedeb0b2c750fc611612618a85639ab2 Mon Sep 17 00:00:00 2001
+From: kbuild test robot <lkp@intel.com>
+Date: Thu, 14 Mar 2019 02:42:43 +0800
+Subject: perf/x86/intel: Make dev_attr_allow_tsx_force_abort static
+
+From: kbuild test robot <lkp@intel.com>
+
+commit c634dc6bdedeb0b2c750fc611612618a85639ab2 upstream.
+
+Fixes: 400816f60c54 ("perf/x86/intel: Implement support for TSX Force Abort")
+Signed-off-by: kbuild test robot <lkp@intel.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Cc: "Peter Zijlstra (Intel)" <peterz@infradead.org>
+Cc: kbuild-all@01.org
+Cc: Borislav Petkov <bp@alien8.de>
+Cc: "H. Peter Anvin" <hpa@zytor.com>
+Cc: Kan Liang <kan.liang@linux.intel.com>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: Andi Kleen <ak@linux.intel.com>
+Cc: stable@vger.kernel.org
+Link: https://lkml.kernel.org/r/20190313184243.GA10820@lkp-sb-ep06
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/events/intel/core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/x86/events/intel/core.c
++++ b/arch/x86/events/intel/core.c
+@@ -3989,7 +3989,7 @@ static struct attribute *intel_pmu_caps_
+ NULL
+ };
+
+-DEVICE_BOOL_ATTR(allow_tsx_force_abort, 0644, allow_tsx_force_abort);
++static DEVICE_BOOL_ATTR(allow_tsx_force_abort, 0644, allow_tsx_force_abort);
+
+ static struct attribute *intel_pmu_attrs[] = {
+ &dev_attr_freeze_on_smi.attr,
missing-barriers-in-some-of-unix_sock-addr-and-path-accesses.patch
net-sched-flower-insert-new-filter-to-idr-after-setting-its-mask.patch
f2fs-wait-on-atomic-writes-to-count-f2fs_cp_wb_data.patch
+perf-x86-fixup-typo-in-stub-functions.patch
+alsa-bebob-use-more-identical-mod_alias-for-saffire-pro-10-i-o-against-liquid-saffire-56.patch
+alsa-firewire-motu-fix-construction-of-pcm-frame-for-capture-direction.patch
+alsa-hda-extend-i915-component-bind-timeout.patch
+alsa-hda-add-more-quirks-for-hp-z2-g4-and-hp-z240.patch
+alsa-hda-realtek-enable-audio-jacks-of-asus-ux362fa-with-alc294.patch
+alsa-hda-realtek-reduce-click-noise-on-dell-precision-5820-headphone.patch
+alsa-hda-realtek-enable-headset-mic-of-acer-travelmate-x514-51t-with-alc255.patch
+perf-x86-intel-fix-memory-corruption.patch
+perf-x86-intel-make-dev_attr_allow_tsx_force_abort-static.patch
+it-s-wrong-to-add-len-to-sector_nr-in-raid10-reshape-twice.patch
+drm-block-fb-changes-for-async-plane-updates.patch
+staging-erofs-fix-race-when-the-managed-cache-is-enabled.patch
+i40e-report-correct-statistics-when-xdp-is-enabled.patch
+vhost-vsock-fix-vhost-vsock-cid-hashing-inconsistent.patch
--- /dev/null
+From 51232df5e4b268936beccde5248f312a316800be Mon Sep 17 00:00:00 2001
+From: Gao Xiang <gaoxiang25@huawei.com>
+Date: Fri, 23 Nov 2018 01:16:00 +0800
+Subject: staging: erofs: fix race when the managed cache is enabled
+
+From: Gao Xiang <gaoxiang25@huawei.com>
+
+commit 51232df5e4b268936beccde5248f312a316800be upstream.
+
+When the managed cache is enabled, the last reference count
+of a workgroup must be used for its workstation.
+
+Otherwise, it could lead to incorrect (un)freezes in
+the reclaim path, and it would be harmful.
+
+A typical race as follows:
+
+Thread 1 (In the reclaim path) Thread 2
+workgroup_freeze(grp, 1) refcnt = 1
+...
+workgroup_unfreeze(grp, 1) refcnt = 1
+ workgroup_get(grp) refcnt = 2 (x)
+workgroup_put(grp) refcnt = 1 (x)
+ ...unexpected behaviors
+
+* grp is detached but still used, which violates cache-managed
+ freeze constraint.
+
+Reviewed-by: Chao Yu <yuchao0@huawei.com>
+Signed-off-by: Gao Xiang <gaoxiang25@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/erofs/internal.h | 1
+ drivers/staging/erofs/utils.c | 139 ++++++++++++++++++++++++++++-----------
+ 2 files changed, 101 insertions(+), 39 deletions(-)
+
+--- a/drivers/staging/erofs/internal.h
++++ b/drivers/staging/erofs/internal.h
+@@ -260,6 +260,7 @@ repeat:
+ }
+
+ #define __erofs_workgroup_get(grp) atomic_inc(&(grp)->refcount)
++#define __erofs_workgroup_put(grp) atomic_dec(&(grp)->refcount)
+
+ extern int erofs_workgroup_put(struct erofs_workgroup *grp);
+
+--- a/drivers/staging/erofs/utils.c
++++ b/drivers/staging/erofs/utils.c
+@@ -87,12 +87,21 @@ int erofs_register_workgroup(struct supe
+ grp = (void *)((unsigned long)grp |
+ 1UL << RADIX_TREE_EXCEPTIONAL_SHIFT);
+
+- err = radix_tree_insert(&sbi->workstn_tree,
+- grp->index, grp);
++ /*
++ * Bump up reference count before making this workgroup
++ * visible to other users in order to avoid potential UAF
++ * without serialized by erofs_workstn_lock.
++ */
++ __erofs_workgroup_get(grp);
+
+- if (!err) {
+- __erofs_workgroup_get(grp);
+- }
++ err = radix_tree_insert(&sbi->workstn_tree,
++ grp->index, grp);
++ if (unlikely(err))
++ /*
++ * it's safe to decrease since the workgroup isn't visible
++ * and refcount >= 2 (cannot be freezed).
++ */
++ __erofs_workgroup_put(grp);
+
+ erofs_workstn_unlock(sbi);
+ radix_tree_preload_end();
+@@ -101,19 +110,99 @@ int erofs_register_workgroup(struct supe
+
+ extern void erofs_workgroup_free_rcu(struct erofs_workgroup *grp);
+
++static void __erofs_workgroup_free(struct erofs_workgroup *grp)
++{
++ atomic_long_dec(&erofs_global_shrink_cnt);
++ erofs_workgroup_free_rcu(grp);
++}
++
+ int erofs_workgroup_put(struct erofs_workgroup *grp)
+ {
+ int count = atomic_dec_return(&grp->refcount);
+
+ if (count == 1)
+ atomic_long_inc(&erofs_global_shrink_cnt);
+- else if (!count) {
+- atomic_long_dec(&erofs_global_shrink_cnt);
+- erofs_workgroup_free_rcu(grp);
+- }
++ else if (!count)
++ __erofs_workgroup_free(grp);
+ return count;
+ }
+
++#ifdef EROFS_FS_HAS_MANAGED_CACHE
++/* for cache-managed case, customized reclaim paths exist */
++static void erofs_workgroup_unfreeze_final(struct erofs_workgroup *grp)
++{
++ erofs_workgroup_unfreeze(grp, 0);
++ __erofs_workgroup_free(grp);
++}
++
++bool erofs_try_to_release_workgroup(struct erofs_sb_info *sbi,
++ struct erofs_workgroup *grp,
++ bool cleanup)
++{
++ void *entry;
++
++ /*
++ * for managed cache enabled, the refcount of workgroups
++ * themselves could be < 0 (freezed). So there is no guarantee
++ * that all refcount > 0 if managed cache is enabled.
++ */
++ if (!erofs_workgroup_try_to_freeze(grp, 1))
++ return false;
++
++ /*
++ * note that all cached pages should be unlinked
++ * before delete it from the radix tree.
++ * Otherwise some cached pages of an orphan old workgroup
++ * could be still linked after the new one is available.
++ */
++ if (erofs_try_to_free_all_cached_pages(sbi, grp)) {
++ erofs_workgroup_unfreeze(grp, 1);
++ return false;
++ }
++
++ /*
++ * it is impossible to fail after the workgroup is freezed,
++ * however in order to avoid some race conditions, add a
++ * DBG_BUGON to observe this in advance.
++ */
++ entry = radix_tree_delete(&sbi->workstn_tree, grp->index);
++ DBG_BUGON((void *)((unsigned long)entry &
++ ~RADIX_TREE_EXCEPTIONAL_ENTRY) != grp);
++
++ /*
++ * if managed cache is enable, the last refcount
++ * should indicate the related workstation.
++ */
++ erofs_workgroup_unfreeze_final(grp);
++ return true;
++}
++
++#else
++/* for nocache case, no customized reclaim path at all */
++bool erofs_try_to_release_workgroup(struct erofs_sb_info *sbi,
++ struct erofs_workgroup *grp,
++ bool cleanup)
++{
++ int cnt = atomic_read(&grp->refcount);
++ void *entry;
++
++ DBG_BUGON(cnt <= 0);
++ DBG_BUGON(cleanup && cnt != 1);
++
++ if (cnt > 1)
++ return false;
++
++ entry = radix_tree_delete(&sbi->workstn_tree, grp->index);
++ DBG_BUGON((void *)((unsigned long)entry &
++ ~RADIX_TREE_EXCEPTIONAL_ENTRY) != grp);
++
++ /* (rarely) could be grabbed again when freeing */
++ erofs_workgroup_put(grp);
++ return true;
++}
++
++#endif
++
+ unsigned long erofs_shrink_workstation(struct erofs_sb_info *sbi,
+ unsigned long nr_shrink,
+ bool cleanup)
+@@ -130,43 +219,15 @@ repeat:
+ batch, first_index, PAGEVEC_SIZE);
+
+ for (i = 0; i < found; ++i) {
+- int cnt;
+ struct erofs_workgroup *grp = (void *)
+ ((unsigned long)batch[i] &
+ ~RADIX_TREE_EXCEPTIONAL_ENTRY);
+
+ first_index = grp->index + 1;
+
+- cnt = atomic_read(&grp->refcount);
+- BUG_ON(cnt <= 0);
+-
+- if (cleanup)
+- BUG_ON(cnt != 1);
+-
+-#ifndef EROFS_FS_HAS_MANAGED_CACHE
+- else if (cnt > 1)
+-#else
+- if (!erofs_workgroup_try_to_freeze(grp, 1))
+-#endif
+- continue;
+-
+- if (radix_tree_delete(&sbi->workstn_tree,
+- grp->index) != grp) {
+-#ifdef EROFS_FS_HAS_MANAGED_CACHE
+-skip:
+- erofs_workgroup_unfreeze(grp, 1);
+-#endif
++ /* try to shrink each valid workgroup */
++ if (!erofs_try_to_release_workgroup(sbi, grp, cleanup))
+ continue;
+- }
+-
+-#ifdef EROFS_FS_HAS_MANAGED_CACHE
+- if (erofs_try_to_free_all_cached_pages(sbi, grp))
+- goto skip;
+-
+- erofs_workgroup_unfreeze(grp, 1);
+-#endif
+- /* (rarely) grabbed again when freeing */
+- erofs_workgroup_put(grp);
+
+ ++freed;
+ if (unlikely(!--nr_shrink))
--- /dev/null
+From 7fbe078c37aba3088359c9256c1a1d0c3e39ee81 Mon Sep 17 00:00:00 2001
+From: Zha Bin <zhabin@linux.alibaba.com>
+Date: Tue, 8 Jan 2019 16:07:03 +0800
+Subject: vhost/vsock: fix vhost vsock cid hashing inconsistent
+
+From: Zha Bin <zhabin@linux.alibaba.com>
+
+commit 7fbe078c37aba3088359c9256c1a1d0c3e39ee81 upstream.
+
+The vsock core only supports 32bit CID, but the Virtio-vsock spec define
+CID (dst_cid and src_cid) as u64 and the upper 32bits is reserved as
+zero. This inconsistency causes one bug in vhost vsock driver. The
+scenarios is:
+
+ 0. A hash table (vhost_vsock_hash) is used to map an CID to a vsock
+ object. And hash_min() is used to compute the hash key. hash_min() is
+ defined as:
+ (sizeof(val) <= 4 ? hash_32(val, bits) : hash_long(val, bits)).
+ That means the hash algorithm has dependency on the size of macro
+ argument 'val'.
+ 0. In function vhost_vsock_set_cid(), a 64bit CID is passed to
+ hash_min() to compute the hash key when inserting a vsock object into
+ the hash table.
+ 0. In function vhost_vsock_get(), a 32bit CID is passed to hash_min()
+ to compute the hash key when looking up a vsock for an CID.
+
+Because the different size of the CID, hash_min() returns different hash
+key, thus fails to look up the vsock object for an CID.
+
+To fix this bug, we keep CID as u64 in the IOCTLs and virtio message
+headers, but explicitly convert u64 to u32 when deal with the hash table
+and vsock core.
+
+Fixes: 834e772c8db0 ("vhost/vsock: fix use-after-free in network stack callers")
+Link: https://github.com/stefanha/virtio/blob/vsock/trunk/content.tex
+Signed-off-by: Zha Bin <zhabin@linux.alibaba.com>
+Reviewed-by: Liu Jiang <gerry@linux.alibaba.com>
+Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
+Acked-by: Jason Wang <jasowang@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Shengjing Zhu <i@zhsj.me>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+
+---
+ drivers/vhost/vsock.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/vhost/vsock.c
++++ b/drivers/vhost/vsock.c
+@@ -642,7 +642,7 @@ static int vhost_vsock_set_cid(struct vh
+ hash_del_rcu(&vsock->hash);
+
+ vsock->guest_cid = guest_cid;
+- hash_add_rcu(vhost_vsock_hash, &vsock->hash, guest_cid);
++ hash_add_rcu(vhost_vsock_hash, &vsock->hash, vsock->guest_cid);
+ spin_unlock_bh(&vhost_vsock_lock);
+
+ return 0;
projects / thirdparty / kernel / stable-queue.git / commitdiff
