--- /dev/null
+From f0ac20c3f6137910c8a927953e8a92f5b3716166 Mon Sep 17 00:00:00 2001
+From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
+Date: Tue, 11 Feb 2020 10:07:43 +0100
+Subject: ACPI: EC: Fix flushing of pending work
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+commit f0ac20c3f6137910c8a927953e8a92f5b3716166 upstream.
+
+Commit 016b87ca5c8c ("ACPI: EC: Rework flushing of pending work")
+introduced a subtle bug into the flushing of pending EC work while
+suspended to idle, which may cause the EC driver to fail to
+re-enable the EC GPE after handling a non-wakeup event (like a
+battery status change event, for example).
+
+The problem is that the work item flushed by flush_scheduled_work()
+in __acpi_ec_flush_work() may disable the EC GPE and schedule another
+work item expected to re-enable it, but that new work item is not
+flushed, so __acpi_ec_flush_work() returns with the EC GPE disabled
+and the CPU running it goes into an idle state subsequently. If all
+of the other CPUs are in idle states at that point, the EC GPE won't
+be re-enabled until at least one CPU is woken up by another interrupt
+source, so system wakeup events that would normally come from the EC
+then don't work.
+
+This is reproducible on a Dell XPS13 9360 in my office which
+sometimes stops reacting to power button and lid events (triggered
+by the EC on that machine) after switching from AC power to battery
+power or vice versa while suspended to idle (each of those switches
+causes the EC GPE to trigger for several times in a row, but they
+are not system wakeup events).
+
+To avoid this problem, it is necessary to drain the workqueue
+entirely in __acpi_ec_flush_work(), but that cannot be done with
+respect to system_wq, because work items may be added to it from
+other places while __acpi_ec_flush_work() is running. For this
+reason, make the EC driver use a dedicated workqueue for EC events
+processing (let that workqueue be ordered so that EC events are
+processed sequentially) and use drain_workqueue() on it in
+__acpi_ec_flush_work().
+
+Fixes: 016b87ca5c8c ("ACPI: EC: Rework flushing of pending work")
+Cc: 5.4+ <stable@vger.kernel.org> # 5.4+
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/acpi/ec.c | 44 ++++++++++++++++++++++++++------------------
+ 1 file changed, 26 insertions(+), 18 deletions(-)
+
+--- a/drivers/acpi/ec.c
++++ b/drivers/acpi/ec.c
+@@ -179,6 +179,7 @@ EXPORT_SYMBOL(first_ec);
+
+ static struct acpi_ec *boot_ec;
+ static bool boot_ec_is_ecdt = false;
++static struct workqueue_struct *ec_wq;
+ static struct workqueue_struct *ec_query_wq;
+
+ static int EC_FLAGS_QUERY_HANDSHAKE; /* Needs QR_EC issued when SCI_EVT set */
+@@ -469,7 +470,7 @@ static void acpi_ec_submit_query(struct
+ ec_dbg_evt("Command(%s) submitted/blocked",
+ acpi_ec_cmd_string(ACPI_EC_COMMAND_QUERY));
+ ec->nr_pending_queries++;
+- schedule_work(&ec->work);
++ queue_work(ec_wq, &ec->work);
+ }
+ }
+
+@@ -535,7 +536,7 @@ static void acpi_ec_enable_event(struct
+ #ifdef CONFIG_PM_SLEEP
+ static void __acpi_ec_flush_work(void)
+ {
+- flush_scheduled_work(); /* flush ec->work */
++ drain_workqueue(ec_wq); /* flush ec->work */
+ flush_workqueue(ec_query_wq); /* flush queries */
+ }
+
+@@ -556,8 +557,8 @@ static void acpi_ec_disable_event(struct
+
+ void acpi_ec_flush_work(void)
+ {
+- /* Without ec_query_wq there is nothing to flush. */
+- if (!ec_query_wq)
++ /* Without ec_wq there is nothing to flush. */
++ if (!ec_wq)
+ return;
+
+ __acpi_ec_flush_work();
+@@ -2115,25 +2116,33 @@ static struct acpi_driver acpi_ec_driver
+ .drv.pm = &acpi_ec_pm,
+ };
+
+-static inline int acpi_ec_query_init(void)
++static void acpi_ec_destroy_workqueues(void)
+ {
+- if (!ec_query_wq) {
+- ec_query_wq = alloc_workqueue("kec_query", 0,
+- ec_max_queries);
+- if (!ec_query_wq)
+- return -ENODEV;
++ if (ec_wq) {
++ destroy_workqueue(ec_wq);
++ ec_wq = NULL;
+ }
+- return 0;
+-}
+-
+-static inline void acpi_ec_query_exit(void)
+-{
+ if (ec_query_wq) {
+ destroy_workqueue(ec_query_wq);
+ ec_query_wq = NULL;
+ }
+ }
+
++static int acpi_ec_init_workqueues(void)
++{
++ if (!ec_wq)
++ ec_wq = alloc_ordered_workqueue("kec", 0);
++
++ if (!ec_query_wq)
++ ec_query_wq = alloc_workqueue("kec_query", 0, ec_max_queries);
++
++ if (!ec_wq || !ec_query_wq) {
++ acpi_ec_destroy_workqueues();
++ return -ENODEV;
++ }
++ return 0;
++}
++
+ static const struct dmi_system_id acpi_ec_no_wakeup[] = {
+ {
+ .ident = "Thinkpad X1 Carbon 6th",
+@@ -2164,8 +2173,7 @@ int __init acpi_ec_init(void)
+ int result;
+ int ecdt_fail, dsdt_fail;
+
+- /* register workqueue for _Qxx evaluations */
+- result = acpi_ec_query_init();
++ result = acpi_ec_init_workqueues();
+ if (result)
+ return result;
+
+@@ -2196,6 +2204,6 @@ static void __exit acpi_ec_exit(void)
+ {
+
+ acpi_bus_unregister_driver(&acpi_ec_driver);
+- acpi_ec_query_exit();
++ acpi_ec_destroy_workqueues();
+ }
+ #endif /* 0 */
--- /dev/null
+From e3728b50cd9be7d4b1469447cdf1feb93e3b7adb Mon Sep 17 00:00:00 2001
+From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
+Date: Tue, 11 Feb 2020 10:11:02 +0100
+Subject: ACPI: PM: s2idle: Avoid possible race related to the EC GPE
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+commit e3728b50cd9be7d4b1469447cdf1feb93e3b7adb upstream.
+
+It is theoretically possible for the ACPI EC GPE to be set after the
+s2idle_ops->wake() called from s2idle_loop() has returned and before
+the subsequent pm_wakeup_pending() check is carried out. If that
+happens, the resulting wakeup event will cause the system to resume
+even though it may be a spurious one.
+
+To avoid that race, first make the ->wake() callback in struct
+platform_s2idle_ops return a bool value indicating whether or not
+to let the system resume and rearrange s2idle_loop() to use that
+value instad of the direct pm_wakeup_pending() call if ->wake() is
+present.
+
+Next, rework acpi_s2idle_wake() to process EC events and check
+pm_wakeup_pending() before re-arming the SCI for system wakeup
+to prevent it from triggering prematurely and add comments to
+that function to explain the rationale for the new code flow.
+
+Fixes: 56b991849009 ("PM: sleep: Simplify suspend-to-idle control flow")
+Cc: 5.4+ <stable@vger.kernel.org> # 5.4+
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/acpi/sleep.c | 46 ++++++++++++++++++++++++++++++++--------------
+ include/linux/suspend.h | 2 +-
+ kernel/power/suspend.c | 9 +++++----
+ 3 files changed, 38 insertions(+), 19 deletions(-)
+
+--- a/drivers/acpi/sleep.c
++++ b/drivers/acpi/sleep.c
+@@ -987,21 +987,28 @@ static void acpi_s2idle_sync(void)
+ acpi_os_wait_events_complete(); /* synchronize Notify handling */
+ }
+
+-static void acpi_s2idle_wake(void)
++static bool acpi_s2idle_wake(void)
+ {
+- /*
+- * If IRQD_WAKEUP_ARMED is set for the SCI at this point, the SCI has
+- * not triggered while suspended, so bail out.
+- */
+- if (!acpi_sci_irq_valid() ||
+- irqd_is_wakeup_armed(irq_get_irq_data(acpi_sci_irq)))
+- return;
+-
+- /*
+- * If there are EC events to process, the wakeup may be a spurious one
+- * coming from the EC.
+- */
+- if (acpi_ec_dispatch_gpe()) {
++ if (!acpi_sci_irq_valid())
++ return pm_wakeup_pending();
++
++ while (pm_wakeup_pending()) {
++ /*
++ * If IRQD_WAKEUP_ARMED is set for the SCI at this point, the
++ * SCI has not triggered while suspended, so bail out (the
++ * wakeup is pending anyway and the SCI is not the source of
++ * it).
++ */
++ if (irqd_is_wakeup_armed(irq_get_irq_data(acpi_sci_irq)))
++ return true;
++
++ /*
++ * If there are no EC events to process, the wakeup is regarded
++ * as a genuine one.
++ */
++ if (!acpi_ec_dispatch_gpe())
++ return true;
++
+ /*
+ * Cancel the wakeup and process all pending events in case
+ * there are any wakeup ones in there.
+@@ -1014,8 +1021,19 @@ static void acpi_s2idle_wake(void)
+
+ acpi_s2idle_sync();
+
++ /*
++ * The SCI is in the "suspended" state now and it cannot produce
++ * new wakeup events till the rearming below, so if any of them
++ * are pending here, they must be resulting from the processing
++ * of EC events above or coming from somewhere else.
++ */
++ if (pm_wakeup_pending())
++ return true;
++
+ rearm_wake_irq(acpi_sci_irq);
+ }
++
++ return false;
+ }
+
+ static void acpi_s2idle_restore_early(void)
+--- a/include/linux/suspend.h
++++ b/include/linux/suspend.h
+@@ -191,7 +191,7 @@ struct platform_s2idle_ops {
+ int (*begin)(void);
+ int (*prepare)(void);
+ int (*prepare_late)(void);
+- void (*wake)(void);
++ bool (*wake)(void);
+ void (*restore_early)(void);
+ void (*restore)(void);
+ void (*end)(void);
+--- a/kernel/power/suspend.c
++++ b/kernel/power/suspend.c
+@@ -131,11 +131,12 @@ static void s2idle_loop(void)
+ * to avoid them upfront.
+ */
+ for (;;) {
+- if (s2idle_ops && s2idle_ops->wake)
+- s2idle_ops->wake();
+-
+- if (pm_wakeup_pending())
++ if (s2idle_ops && s2idle_ops->wake) {
++ if (s2idle_ops->wake())
++ break;
++ } else if (pm_wakeup_pending()) {
+ break;
++ }
+
+ pm_wakeup_clear(false);
+
--- /dev/null
+From fdde0ff8590b4c1c41b3227f5ac4265fccccb96b Mon Sep 17 00:00:00 2001
+From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
+Date: Tue, 11 Feb 2020 17:53:52 +0100
+Subject: ACPI: PM: s2idle: Prevent spurious SCIs from waking up the system
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+commit fdde0ff8590b4c1c41b3227f5ac4265fccccb96b upstream.
+
+If the platform triggers a spurious SCI even though the status bit
+is not set for any GPE when the system is suspended to idle, it will
+be treated as a genuine wakeup, so avoid that by checking if any GPEs
+are active at all before returning 'true' from acpi_s2idle_wake().
+
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=206413
+Fixes: 56b991849009 ("PM: sleep: Simplify suspend-to-idle control flow")
+Reported-by: Tsuchiya Yuto <kitakar@gmail.com>
+Cc: 5.4+ <stable@vger.kernel.org> # 5.4+
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/acpi/sleep.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+--- a/drivers/acpi/sleep.c
++++ b/drivers/acpi/sleep.c
+@@ -1003,10 +1003,16 @@ static bool acpi_s2idle_wake(void)
+ return true;
+
+ /*
+- * If there are no EC events to process, the wakeup is regarded
+- * as a genuine one.
++ * If there are no EC events to process and at least one of the
++ * other enabled GPEs is active, the wakeup is regarded as a
++ * genuine one.
++ *
++ * Note that the checks below must be carried out in this order
++ * to avoid returning prematurely due to a change of the EC GPE
++ * status bit from unset to set between the checks with the
++ * status bits of all the other GPEs unset.
+ */
+- if (!acpi_ec_dispatch_gpe())
++ if (acpi_any_gpe_status_set() && !acpi_ec_dispatch_gpe())
+ return true;
+
+ /*
--- /dev/null
+From ea128834dd76f9a72a35d011c651fa96658f06a7 Mon Sep 17 00:00:00 2001
+From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
+Date: Tue, 11 Feb 2020 17:52:32 +0100
+Subject: ACPICA: Introduce acpi_any_gpe_status_set()
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+commit ea128834dd76f9a72a35d011c651fa96658f06a7 upstream.
+
+Introduce a new helper function, acpi_any_gpe_status_set(), for
+checking the status bits of all enabled GPEs in one go.
+
+It is needed to distinguish spurious SCIs from genuine ones when
+deciding whether or not to wake up the system from suspend-to-idle.
+
+Cc: 5.4+ <stable@vger.kernel.org> # 5.4+
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/acpi/acpica/achware.h | 2 +
+ drivers/acpi/acpica/evxfgpe.c | 32 ++++++++++++++++++
+ drivers/acpi/acpica/hwgpe.c | 71 ++++++++++++++++++++++++++++++++++++++++++
+ include/acpi/acpixf.h | 1
+ 4 files changed, 106 insertions(+)
+
+--- a/drivers/acpi/acpica/achware.h
++++ b/drivers/acpi/acpica/achware.h
+@@ -101,6 +101,8 @@ acpi_status acpi_hw_enable_all_runtime_g
+
+ acpi_status acpi_hw_enable_all_wakeup_gpes(void);
+
++u8 acpi_hw_check_all_gpes(void);
++
+ acpi_status
+ acpi_hw_enable_runtime_gpe_block(struct acpi_gpe_xrupt_info *gpe_xrupt_info,
+ struct acpi_gpe_block_info *gpe_block,
+--- a/drivers/acpi/acpica/evxfgpe.c
++++ b/drivers/acpi/acpica/evxfgpe.c
+@@ -795,6 +795,38 @@ acpi_status acpi_enable_all_wakeup_gpes(
+
+ ACPI_EXPORT_SYMBOL(acpi_enable_all_wakeup_gpes)
+
++/******************************************************************************
++ *
++ * FUNCTION: acpi_any_gpe_status_set
++ *
++ * PARAMETERS: None
++ *
++ * RETURN: Whether or not the status bit is set for any GPE
++ *
++ * DESCRIPTION: Check the status bits of all enabled GPEs and return TRUE if any
++ * of them is set or FALSE otherwise.
++ *
++ ******************************************************************************/
++u32 acpi_any_gpe_status_set(void)
++{
++ acpi_status status;
++ u8 ret;
++
++ ACPI_FUNCTION_TRACE(acpi_any_gpe_status_set);
++
++ status = acpi_ut_acquire_mutex(ACPI_MTX_EVENTS);
++ if (ACPI_FAILURE(status)) {
++ return (FALSE);
++ }
++
++ ret = acpi_hw_check_all_gpes();
++ (void)acpi_ut_release_mutex(ACPI_MTX_EVENTS);
++
++ return (ret);
++}
++
++ACPI_EXPORT_SYMBOL(acpi_any_gpe_status_set)
++
+ /*******************************************************************************
+ *
+ * FUNCTION: acpi_install_gpe_block
+--- a/drivers/acpi/acpica/hwgpe.c
++++ b/drivers/acpi/acpica/hwgpe.c
+@@ -446,6 +446,53 @@ acpi_hw_enable_wakeup_gpe_block(struct a
+
+ /******************************************************************************
+ *
++ * FUNCTION: acpi_hw_get_gpe_block_status
++ *
++ * PARAMETERS: gpe_xrupt_info - GPE Interrupt info
++ * gpe_block - Gpe Block info
++ *
++ * RETURN: Success
++ *
++ * DESCRIPTION: Produce a combined GPE status bits mask for the given block.
++ *
++ ******************************************************************************/
++
++static acpi_status
++acpi_hw_get_gpe_block_status(struct acpi_gpe_xrupt_info *gpe_xrupt_info,
++ struct acpi_gpe_block_info *gpe_block,
++ void *ret_ptr)
++{
++ struct acpi_gpe_register_info *gpe_register_info;
++ u64 in_enable, in_status;
++ acpi_status status;
++ u8 *ret = ret_ptr;
++ u32 i;
++
++ /* Examine each GPE Register within the block */
++
++ for (i = 0; i < gpe_block->register_count; i++) {
++ gpe_register_info = &gpe_block->register_info[i];
++
++ status = acpi_hw_read(&in_enable,
++ &gpe_register_info->enable_address);
++ if (ACPI_FAILURE(status)) {
++ continue;
++ }
++
++ status = acpi_hw_read(&in_status,
++ &gpe_register_info->status_address);
++ if (ACPI_FAILURE(status)) {
++ continue;
++ }
++
++ *ret |= in_enable & in_status;
++ }
++
++ return (AE_OK);
++}
++
++/******************************************************************************
++ *
+ * FUNCTION: acpi_hw_disable_all_gpes
+ *
+ * PARAMETERS: None
+@@ -510,4 +557,28 @@ acpi_status acpi_hw_enable_all_wakeup_gp
+ return_ACPI_STATUS(status);
+ }
+
++/******************************************************************************
++ *
++ * FUNCTION: acpi_hw_check_all_gpes
++ *
++ * PARAMETERS: None
++ *
++ * RETURN: Combined status of all GPEs
++ *
++ * DESCRIPTION: Check all enabled GPEs in all GPE blocks and return TRUE if the
++ * status bit is set for at least one of them of FALSE otherwise.
++ *
++ ******************************************************************************/
++
++u8 acpi_hw_check_all_gpes(void)
++{
++ u8 ret = 0;
++
++ ACPI_FUNCTION_TRACE(acpi_hw_check_all_gpes);
++
++ (void)acpi_ev_walk_gpe_list(acpi_hw_get_gpe_block_status, &ret);
++
++ return (ret != 0);
++}
++
+ #endif /* !ACPI_REDUCED_HARDWARE */
+--- a/include/acpi/acpixf.h
++++ b/include/acpi/acpixf.h
+@@ -752,6 +752,7 @@ ACPI_HW_DEPENDENT_RETURN_UINT32(u32 acpi
+ ACPI_HW_DEPENDENT_RETURN_STATUS(acpi_status acpi_disable_all_gpes(void))
+ ACPI_HW_DEPENDENT_RETURN_STATUS(acpi_status acpi_enable_all_runtime_gpes(void))
+ ACPI_HW_DEPENDENT_RETURN_STATUS(acpi_status acpi_enable_all_wakeup_gpes(void))
++ACPI_HW_DEPENDENT_RETURN_UINT32(u32 acpi_any_gpe_status_set(void))
+
+ ACPI_HW_DEPENDENT_RETURN_STATUS(acpi_status
+ acpi_get_gpe_device(u32 gpe_index,
--- /dev/null
+From 2b3b6497c38d123934de68ea82a247b557d95290 Mon Sep 17 00:00:00 2001
+From: Kailang Yang <kailang@realtek.com>
+Date: Mon, 10 Feb 2020 16:15:14 +0800
+Subject: ALSA: hda/realtek - Add more codec supported Headset Button
+
+From: Kailang Yang <kailang@realtek.com>
+
+commit 2b3b6497c38d123934de68ea82a247b557d95290 upstream.
+
+Add supported Headset Button for ALC215/ALC285/ALC289.
+
+Signed-off-by: Kailang Yang <kailang@realtek.com>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/948f70b4488f4cc2b629a39ce4e4be33@realtek.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_realtek.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -5701,8 +5701,11 @@ static void alc_fixup_headset_jack(struc
+ break;
+ case HDA_FIXUP_ACT_INIT:
+ switch (codec->core.vendor_id) {
++ case 0x10ec0215:
+ case 0x10ec0225:
++ case 0x10ec0285:
+ case 0x10ec0295:
++ case 0x10ec0289:
+ case 0x10ec0299:
+ alc_write_coef_idx(codec, 0x48, 0xd011);
+ alc_update_coef_idx(codec, 0x49, 0x007f, 0x0045);
--- /dev/null
+From 7dafba3762d6c0083ded00a48f8c1a158bc86717 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Wed, 12 Feb 2020 09:10:47 +0100
+Subject: ALSA: hda/realtek - Fix silent output on MSI-GL73
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 7dafba3762d6c0083ded00a48f8c1a158bc86717 upstream.
+
+MSI-GL73 laptop with ALC1220 codec requires a similar workaround for
+Clevo laptops to enforce the DAC/mixer connection path. Set up a
+quirk entry for that.
+
+BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=204159
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20200212081047.27727-1-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_realtek.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -2447,6 +2447,7 @@ static const struct snd_pci_quirk alc882
+ SND_PCI_QUIRK(0x1071, 0x8258, "Evesham Voyaeger", ALC882_FIXUP_EAPD),
+ SND_PCI_QUIRK(0x1458, 0xa002, "Gigabyte EP45-DS3/Z87X-UD3H", ALC889_FIXUP_FRONT_HP_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1458, 0xa0b8, "Gigabyte AZ370-Gaming", ALC1220_FIXUP_GB_DUAL_CODECS),
++ SND_PCI_QUIRK(0x1462, 0x1276, "MSI-GL73", ALC1220_FIXUP_CLEVO_P950),
+ SND_PCI_QUIRK(0x1462, 0x7350, "MSI-7350", ALC889_FIXUP_CD),
+ SND_PCI_QUIRK(0x1462, 0xda57, "MSI Z270-Gaming", ALC1220_FIXUP_GB_DUAL_CODECS),
+ SND_PCI_QUIRK_VENDOR(0x1462, "MSI", ALC882_FIXUP_GPIO3),
--- /dev/null
+From 0fbb027b44e79700da80e4b8bd1c1914d4796af6 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Thu, 13 Feb 2020 07:03:49 +0100
+Subject: ALSA: pcm: Fix double hw_free calls
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 0fbb027b44e79700da80e4b8bd1c1914d4796af6 upstream.
+
+The commit 66f2d19f8116 ("ALSA: pcm: Fix memory leak at closing a
+stream without hw_free") tried to fix the regression wrt the missing
+hw_free call at closing without SNDRV_PCM_IOCTL_HW_FREE ioctl.
+However, the code change dropped mistakenly the state check, resulting
+in calling hw_free twice when SNDRV_PCM_IOCTL_HW_FRE got called
+beforehand. For most drivers, this is almost harmless, but the
+drivers like SOF show another regression now.
+
+This patch adds the state condition check before calling do_hw_free()
+at releasing the stream for avoiding the double hw_free calls.
+
+Fixes: 66f2d19f8116 ("ALSA: pcm: Fix memory leak at closing a stream without hw_free")
+Reported-by: Bard Liao <yung-chuan.liao@linux.intel.com>
+Reported-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Tested-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/s5hd0ajyprg.wl-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/core/pcm_native.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/sound/core/pcm_native.c
++++ b/sound/core/pcm_native.c
+@@ -2474,7 +2474,8 @@ void snd_pcm_release_substream(struct sn
+
+ snd_pcm_drop(substream);
+ if (substream->hw_opened) {
+- do_hw_free(substream);
++ if (substream->runtime->status->state != SNDRV_PCM_STATE_OPEN)
++ do_hw_free(substream);
+ substream->ops->close(substream);
+ substream->hw_opened = 0;
+ }
--- /dev/null
+From 9f35a31283775e6f6af73fb2c95c686a4c0acac7 Mon Sep 17 00:00:00 2001
+From: Alexander Tsoy <alexander@tsoy.me>
+Date: Thu, 13 Feb 2020 02:54:50 +0300
+Subject: ALSA: usb-audio: Add clock validity quirk for Denon MC7000/MCX8000
+
+From: Alexander Tsoy <alexander@tsoy.me>
+
+commit 9f35a31283775e6f6af73fb2c95c686a4c0acac7 upstream.
+
+It should be safe to ignore clock validity check result if the following
+conditions are met:
+ - only one single sample rate is supported;
+ - the terminal is directly connected to the clock source;
+ - the clock type is internal.
+
+This is to deal with some Denon DJ controllers that always reports that
+clock is invalid.
+
+Tested-by: Tobias Oszlanyi <toszlanyi@yahoo.de>
+Signed-off-by: Alexander Tsoy <alexander@tsoy.me>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20200212235450.697348-1-alexander@tsoy.me
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/usb/clock.c | 91 ++++++++++++++++++++++++++++++++++++-----------------
+ sound/usb/clock.h | 4 +-
+ sound/usb/format.c | 3 -
+ 3 files changed, 66 insertions(+), 32 deletions(-)
+
+--- a/sound/usb/clock.c
++++ b/sound/usb/clock.c
+@@ -151,8 +151,34 @@ static int uac_clock_selector_set_val(st
+ return ret;
+ }
+
++/*
++ * Assume the clock is valid if clock source supports only one single sample
++ * rate, the terminal is connected directly to it (there is no clock selector)
++ * and clock type is internal. This is to deal with some Denon DJ controllers
++ * that always reports that clock is invalid.
++ */
++static bool uac_clock_source_is_valid_quirk(struct snd_usb_audio *chip,
++ struct audioformat *fmt,
++ int source_id)
++{
++ if (fmt->protocol == UAC_VERSION_2) {
++ struct uac_clock_source_descriptor *cs_desc =
++ snd_usb_find_clock_source(chip->ctrl_intf, source_id);
++
++ if (!cs_desc)
++ return false;
++
++ return (fmt->nr_rates == 1 &&
++ (fmt->clock & 0xff) == cs_desc->bClockID &&
++ (cs_desc->bmAttributes & 0x3) !=
++ UAC_CLOCK_SOURCE_TYPE_EXT);
++ }
++
++ return false;
++}
++
+ static bool uac_clock_source_is_valid(struct snd_usb_audio *chip,
+- int protocol,
++ struct audioformat *fmt,
+ int source_id)
+ {
+ int err;
+@@ -160,7 +186,7 @@ static bool uac_clock_source_is_valid(st
+ struct usb_device *dev = chip->dev;
+ u32 bmControls;
+
+- if (protocol == UAC_VERSION_3) {
++ if (fmt->protocol == UAC_VERSION_3) {
+ struct uac3_clock_source_descriptor *cs_desc =
+ snd_usb_find_clock_source_v3(chip->ctrl_intf, source_id);
+
+@@ -194,10 +220,14 @@ static bool uac_clock_source_is_valid(st
+ return false;
+ }
+
+- return data ? true : false;
++ if (data)
++ return true;
++ else
++ return uac_clock_source_is_valid_quirk(chip, fmt, source_id);
+ }
+
+-static int __uac_clock_find_source(struct snd_usb_audio *chip, int entity_id,
++static int __uac_clock_find_source(struct snd_usb_audio *chip,
++ struct audioformat *fmt, int entity_id,
+ unsigned long *visited, bool validate)
+ {
+ struct uac_clock_source_descriptor *source;
+@@ -217,7 +247,7 @@ static int __uac_clock_find_source(struc
+ source = snd_usb_find_clock_source(chip->ctrl_intf, entity_id);
+ if (source) {
+ entity_id = source->bClockID;
+- if (validate && !uac_clock_source_is_valid(chip, UAC_VERSION_2,
++ if (validate && !uac_clock_source_is_valid(chip, fmt,
+ entity_id)) {
+ usb_audio_err(chip,
+ "clock source %d is not valid, cannot use\n",
+@@ -248,8 +278,9 @@ static int __uac_clock_find_source(struc
+ }
+
+ cur = ret;
+- ret = __uac_clock_find_source(chip, selector->baCSourceID[ret - 1],
+- visited, validate);
++ ret = __uac_clock_find_source(chip, fmt,
++ selector->baCSourceID[ret - 1],
++ visited, validate);
+ if (!validate || ret > 0 || !chip->autoclock)
+ return ret;
+
+@@ -260,8 +291,9 @@ static int __uac_clock_find_source(struc
+ if (i == cur)
+ continue;
+
+- ret = __uac_clock_find_source(chip, selector->baCSourceID[i - 1],
+- visited, true);
++ ret = __uac_clock_find_source(chip, fmt,
++ selector->baCSourceID[i - 1],
++ visited, true);
+ if (ret < 0)
+ continue;
+
+@@ -281,14 +313,16 @@ static int __uac_clock_find_source(struc
+ /* FIXME: multipliers only act as pass-thru element for now */
+ multiplier = snd_usb_find_clock_multiplier(chip->ctrl_intf, entity_id);
+ if (multiplier)
+- return __uac_clock_find_source(chip, multiplier->bCSourceID,
+- visited, validate);
++ return __uac_clock_find_source(chip, fmt,
++ multiplier->bCSourceID,
++ visited, validate);
+
+ return -EINVAL;
+ }
+
+-static int __uac3_clock_find_source(struct snd_usb_audio *chip, int entity_id,
+- unsigned long *visited, bool validate)
++static int __uac3_clock_find_source(struct snd_usb_audio *chip,
++ struct audioformat *fmt, int entity_id,
++ unsigned long *visited, bool validate)
+ {
+ struct uac3_clock_source_descriptor *source;
+ struct uac3_clock_selector_descriptor *selector;
+@@ -307,7 +341,7 @@ static int __uac3_clock_find_source(stru
+ source = snd_usb_find_clock_source_v3(chip->ctrl_intf, entity_id);
+ if (source) {
+ entity_id = source->bClockID;
+- if (validate && !uac_clock_source_is_valid(chip, UAC_VERSION_3,
++ if (validate && !uac_clock_source_is_valid(chip, fmt,
+ entity_id)) {
+ usb_audio_err(chip,
+ "clock source %d is not valid, cannot use\n",
+@@ -338,7 +372,8 @@ static int __uac3_clock_find_source(stru
+ }
+
+ cur = ret;
+- ret = __uac3_clock_find_source(chip, selector->baCSourceID[ret - 1],
++ ret = __uac3_clock_find_source(chip, fmt,
++ selector->baCSourceID[ret - 1],
+ visited, validate);
+ if (!validate || ret > 0 || !chip->autoclock)
+ return ret;
+@@ -350,8 +385,9 @@ static int __uac3_clock_find_source(stru
+ if (i == cur)
+ continue;
+
+- ret = __uac3_clock_find_source(chip, selector->baCSourceID[i - 1],
+- visited, true);
++ ret = __uac3_clock_find_source(chip, fmt,
++ selector->baCSourceID[i - 1],
++ visited, true);
+ if (ret < 0)
+ continue;
+
+@@ -372,7 +408,8 @@ static int __uac3_clock_find_source(stru
+ multiplier = snd_usb_find_clock_multiplier_v3(chip->ctrl_intf,
+ entity_id);
+ if (multiplier)
+- return __uac3_clock_find_source(chip, multiplier->bCSourceID,
++ return __uac3_clock_find_source(chip, fmt,
++ multiplier->bCSourceID,
+ visited, validate);
+
+ return -EINVAL;
+@@ -389,18 +426,18 @@ static int __uac3_clock_find_source(stru
+ *
+ * Returns the clock source UnitID (>=0) on success, or an error.
+ */
+-int snd_usb_clock_find_source(struct snd_usb_audio *chip, int protocol,
+- int entity_id, bool validate)
++int snd_usb_clock_find_source(struct snd_usb_audio *chip,
++ struct audioformat *fmt, bool validate)
+ {
+ DECLARE_BITMAP(visited, 256);
+ memset(visited, 0, sizeof(visited));
+
+- switch (protocol) {
++ switch (fmt->protocol) {
+ case UAC_VERSION_2:
+- return __uac_clock_find_source(chip, entity_id, visited,
++ return __uac_clock_find_source(chip, fmt, fmt->clock, visited,
+ validate);
+ case UAC_VERSION_3:
+- return __uac3_clock_find_source(chip, entity_id, visited,
++ return __uac3_clock_find_source(chip, fmt, fmt->clock, visited,
+ validate);
+ default:
+ return -EINVAL;
+@@ -501,8 +538,7 @@ static int set_sample_rate_v2v3(struct s
+ * automatic clock selection if the current clock is not
+ * valid.
+ */
+- clock = snd_usb_clock_find_source(chip, fmt->protocol,
+- fmt->clock, true);
++ clock = snd_usb_clock_find_source(chip, fmt, true);
+ if (clock < 0) {
+ /* We did not find a valid clock, but that might be
+ * because the current sample rate does not match an
+@@ -510,8 +546,7 @@ static int set_sample_rate_v2v3(struct s
+ * and we will do another validation after setting the
+ * rate.
+ */
+- clock = snd_usb_clock_find_source(chip, fmt->protocol,
+- fmt->clock, false);
++ clock = snd_usb_clock_find_source(chip, fmt, false);
+ if (clock < 0)
+ return clock;
+ }
+@@ -577,7 +612,7 @@ static int set_sample_rate_v2v3(struct s
+
+ validation:
+ /* validate clock after rate change */
+- if (!uac_clock_source_is_valid(chip, fmt->protocol, clock))
++ if (!uac_clock_source_is_valid(chip, fmt, clock))
+ return -ENXIO;
+ return 0;
+ }
+--- a/sound/usb/clock.h
++++ b/sound/usb/clock.h
+@@ -6,7 +6,7 @@ int snd_usb_init_sample_rate(struct snd_
+ struct usb_host_interface *alts,
+ struct audioformat *fmt, int rate);
+
+-int snd_usb_clock_find_source(struct snd_usb_audio *chip, int protocol,
+- int entity_id, bool validate);
++int snd_usb_clock_find_source(struct snd_usb_audio *chip,
++ struct audioformat *fmt, bool validate);
+
+ #endif /* __USBAUDIO_CLOCK_H */
+--- a/sound/usb/format.c
++++ b/sound/usb/format.c
+@@ -322,8 +322,7 @@ static int parse_audio_format_rates_v2v3
+ struct usb_device *dev = chip->dev;
+ unsigned char tmp[2], *data;
+ int nr_triplets, data_size, ret = 0, ret_l6;
+- int clock = snd_usb_clock_find_source(chip, fp->protocol,
+- fp->clock, false);
++ int clock = snd_usb_clock_find_source(chip, fp, false);
+
+ if (clock < 0) {
+ dev_err(&dev->dev,
--- /dev/null
+From 93f9d1a4ac5930654c17412e3911b46ece73755a Mon Sep 17 00:00:00 2001
+From: Arvind Sankar <nivedita@alum.mit.edu>
+Date: Tue, 11 Feb 2020 11:22:35 -0500
+Subject: ALSA: usb-audio: Apply sample rate quirk for Audioengine D1
+
+From: Arvind Sankar <nivedita@alum.mit.edu>
+
+commit 93f9d1a4ac5930654c17412e3911b46ece73755a upstream.
+
+The Audioengine D1 (0x2912:0x30c8) does support reading the sample rate,
+but it returns the rate in byte-reversed order.
+
+When setting sampling rate, the driver produces these warning messages:
+[168840.944226] usb 3-2.2: current rate 4500480 is different from the runtime rate 44100
+[168854.930414] usb 3-2.2: current rate 8436480 is different from the runtime rate 48000
+[168905.185825] usb 3-2.1.2: current rate 30465 is different from the runtime rate 96000
+
+As can be seen from the hexadecimal conversion, the current rate read
+back is byte-reversed from the rate that was set.
+
+44100 == 0x00ac44, 4500480 == 0x44ac00
+48000 == 0x00bb80, 8436480 == 0x80bb00
+96000 == 0x017700, 30465 == 0x007701
+
+Rather than implementing a new quirk to reverse the order, just skip
+checking the rate to avoid spamming the log.
+
+Signed-off-by: Arvind Sankar <nivedita@alum.mit.edu>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20200211162235.1639889-1-nivedita@alum.mit.edu
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/usb/quirks.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/usb/quirks.c
++++ b/sound/usb/quirks.c
+@@ -1402,6 +1402,7 @@ bool snd_usb_get_sample_rate_quirk(struc
+ case USB_ID(0x1395, 0x740a): /* Sennheiser DECT */
+ case USB_ID(0x1901, 0x0191): /* GE B850V3 CP2114 audio interface */
+ case USB_ID(0x21B4, 0x0081): /* AudioQuest DragonFly */
++ case USB_ID(0x2912, 0x30c8): /* Audioengine D1 */
+ return true;
+ }
+
--- /dev/null
+From d75a170fd848f037a1e28893ad10be7a4c51f8a6 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Tue, 11 Feb 2020 17:05:21 +0100
+Subject: ALSA: usb-audio: Fix UAC2/3 effect unit parsing
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit d75a170fd848f037a1e28893ad10be7a4c51f8a6 upstream.
+
+We've got a regression report about M-Audio Fast Track C400 device,
+and the git bisection resulted in the commit e0ccdef92653 ("ALSA:
+usb-audio: Clean up check_input_term()"). This commit was about the
+rewrite of the input terminal parser, and it's not too obvious from
+the change what really broke. The answer is: it's the interpretation
+of UAC2/3 effect units.
+
+In the original code, UAC2 effect unit is as if through UAC1
+processing unit because both UAC1 PU and UAC2/3 EU share the same
+number (0x07). The old code went through a complex switch-case
+fallthrough, finally bailing out in the middle:
+
+ if (protocol == UAC_VERSION_2 &&
+ hdr[2] == UAC2_EFFECT_UNIT) {
+ /* UAC2/UAC1 unit IDs overlap here in an
+ * uncompatible way. Ignore this unit for now.
+ */
+ return 0;
+ }
+
+... and this special handling was missing in the new code; the new
+code treats UAC2/3 effect unit as if it were equivalent with the
+processing unit.
+
+Actually, the old code was too confusing. The effect unit has an
+incompatible unit description with the processing unit, so we
+shouldn't have dealt with EU in the same way.
+
+This patch addresses the regression by changing the effect unit
+handling to the own parser function. The own parser function makes
+the clear distinct with PU, so it improves the readability, too.
+
+The EU parser just sets the type and the id like the old kernels.
+Once when the proper effect unit support is added, we can revisit this
+parser function, but for now, let's keep this simple setup as is.
+
+Fixes: e0ccdef92653 ("ALSA: usb-audio: Clean up check_input_term()")
+Cc: <stable@vger.kernel.org>
+BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=206147
+Link: https://lore.kernel.org/r/20200211160521.31990-1-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/usb/mixer.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+--- a/sound/usb/mixer.c
++++ b/sound/usb/mixer.c
+@@ -897,6 +897,15 @@ static int parse_term_proc_unit(struct m
+ return 0;
+ }
+
++static int parse_term_effect_unit(struct mixer_build *state,
++ struct usb_audio_term *term,
++ void *p1, int id)
++{
++ term->type = UAC3_EFFECT_UNIT << 16; /* virtual type */
++ term->id = id;
++ return 0;
++}
++
+ static int parse_term_uac2_clock_source(struct mixer_build *state,
+ struct usb_audio_term *term,
+ void *p1, int id)
+@@ -981,8 +990,7 @@ static int __check_input_term(struct mix
+ UAC3_PROCESSING_UNIT);
+ case PTYPE(UAC_VERSION_2, UAC2_EFFECT_UNIT):
+ case PTYPE(UAC_VERSION_3, UAC3_EFFECT_UNIT):
+- return parse_term_proc_unit(state, term, p1, id,
+- UAC3_EFFECT_UNIT);
++ return parse_term_effect_unit(state, term, p1, id);
+ case PTYPE(UAC_VERSION_1, UAC1_EXTENSION_UNIT):
+ case PTYPE(UAC_VERSION_2, UAC2_EXTENSION_UNIT_V2):
+ case PTYPE(UAC_VERSION_3, UAC3_EXTENSION_UNIT):
--- /dev/null
+From b8a3d819f872e0a3a0a6db0dbbcd48071042fb98 Mon Sep 17 00:00:00 2001
+From: Gaurav Agrawal <agrawalgaurav@gnome.org>
+Date: Thu, 13 Feb 2020 17:06:10 -0800
+Subject: Input: synaptics - enable SMBus on ThinkPad L470
+
+From: Gaurav Agrawal <agrawalgaurav@gnome.org>
+
+commit b8a3d819f872e0a3a0a6db0dbbcd48071042fb98 upstream.
+
+Add touchpad LEN2044 to the list, as it is capable of working with
+psmouse.synaptics_intertouch=1
+
+Signed-off-by: Gaurav Agrawal <agrawalgaurav@gnome.org>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/CADdtggVzVJq5gGNmFhKSz2MBwjTpdN5YVOdr4D3Hkkv=KZRc9g@mail.gmail.com
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/input/mouse/synaptics.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/input/mouse/synaptics.c
++++ b/drivers/input/mouse/synaptics.c
+@@ -180,6 +180,7 @@ static const char * const smbus_pnp_ids[
+ "LEN0097", /* X280 -> ALPS trackpoint */
+ "LEN009b", /* T580 */
+ "LEN200f", /* T450s */
++ "LEN2044", /* L470 */
+ "LEN2054", /* E480 */
+ "LEN2055", /* E580 */
+ "SYN3052", /* HP EliteBook 840 G4 */
--- /dev/null
+From 5179a9dfa9440c1781816e2c9a183d1d2512dc61 Mon Sep 17 00:00:00 2001
+From: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+Date: Thu, 13 Feb 2020 17:07:47 -0800
+Subject: Input: synaptics - remove the LEN0049 dmi id from topbuttonpad list
+
+From: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+
+commit 5179a9dfa9440c1781816e2c9a183d1d2512dc61 upstream.
+
+The Yoga 11e is using LEN0049, but it doesn't have a trackstick.
+
+Thus, there is no need to create a software top buttons row.
+
+However, it seems that the device works under SMBus, so keep it as part
+of the smbus_pnp_ids.
+
+Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/20200115013023.9710-1-benjamin.tissoires@redhat.com
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/input/mouse/synaptics.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/input/mouse/synaptics.c
++++ b/drivers/input/mouse/synaptics.c
+@@ -146,7 +146,6 @@ static const char * const topbuttonpad_p
+ "LEN0042", /* Yoga */
+ "LEN0045",
+ "LEN0047",
+- "LEN0049",
+ "LEN2000", /* S540 */
+ "LEN2001", /* Edge E431 */
+ "LEN2002", /* Edge E531 */
+@@ -166,6 +165,7 @@ static const char * const smbus_pnp_ids[
+ /* all of the topbuttonpad_pnp_ids are valid, we just add some extras */
+ "LEN0048", /* X1 Carbon 3 */
+ "LEN0046", /* X250 */
++ "LEN0049", /* Yoga 11e */
+ "LEN004a", /* W541 */
+ "LEN005b", /* P50 */
+ "LEN005e", /* T560 */
--- /dev/null
+From bf502391353b928e63096127e5fd8482080203f5 Mon Sep 17 00:00:00 2001
+From: Lyude Paul <lyude@redhat.com>
+Date: Thu, 13 Feb 2020 16:59:15 -0800
+Subject: Input: synaptics - switch T470s to RMI4 by default
+
+From: Lyude Paul <lyude@redhat.com>
+
+commit bf502391353b928e63096127e5fd8482080203f5 upstream.
+
+This supports RMI4 and everything seems to work, including the touchpad
+buttons. So, let's enable this by default.
+
+Signed-off-by: Lyude Paul <lyude@redhat.com>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/20200204194322.112638-1-lyude@redhat.com
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/input/mouse/synaptics.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/input/mouse/synaptics.c
++++ b/drivers/input/mouse/synaptics.c
+@@ -169,6 +169,7 @@ static const char * const smbus_pnp_ids[
+ "LEN004a", /* W541 */
+ "LEN005b", /* P50 */
+ "LEN005e", /* T560 */
++ "LEN006c", /* T470s */
+ "LEN0071", /* T480 */
+ "LEN0072", /* X1 Carbon Gen 5 (2017) - Elan/ALPS trackpoint */
+ "LEN0073", /* X1 Carbon G5 (Elantech) */
--- /dev/null
+From 1e95081cb5b4cf77065d37866f57cf3c90a3df78 Mon Sep 17 00:00:00 2001
+From: Pavel Begunkov <asml.silence@gmail.com>
+Date: Thu, 6 Feb 2020 19:51:16 +0300
+Subject: io_uring: fix deferred req iovec leak
+
+From: Pavel Begunkov <asml.silence@gmail.com>
+
+commit 1e95081cb5b4cf77065d37866f57cf3c90a3df78 upstream.
+
+After defer, a request will be prepared, that includes allocating iovec
+if needed, and then submitted through io_wq_submit_work() but not custom
+handler (e.g. io_rw_async()/io_sendrecv_async()). However, it'll leak
+iovec, as it's in io-wq and the code goes as follows:
+
+io_read() {
+ if (!io_wq_current_is_worker())
+ kfree(iovec);
+}
+
+Put all deallocation logic in io_{read,write,send,recv}(), which will
+leave the memory, if going async with -EAGAIN.
+
+It also fixes a leak after failed io_alloc_async_ctx() in
+io_{recv,send}_msg().
+
+Cc: stable@vger.kernel.org # 5.5
+Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/io_uring.c | 47 ++++++++++++-----------------------------------
+ 1 file changed, 12 insertions(+), 35 deletions(-)
+
+--- a/fs/io_uring.c
++++ b/fs/io_uring.c
+@@ -1786,17 +1786,6 @@ static int io_alloc_async_ctx(struct io_
+ return req->io == NULL;
+ }
+
+-static void io_rw_async(struct io_wq_work **workptr)
+-{
+- struct io_kiocb *req = container_of(*workptr, struct io_kiocb, work);
+- struct iovec *iov = NULL;
+-
+- if (req->io->rw.iov != req->io->rw.fast_iov)
+- iov = req->io->rw.iov;
+- io_wq_submit_work(workptr);
+- kfree(iov);
+-}
+-
+ static int io_setup_async_rw(struct io_kiocb *req, ssize_t io_size,
+ struct iovec *iovec, struct iovec *fast_iov,
+ struct iov_iter *iter)
+@@ -1810,7 +1799,6 @@ static int io_setup_async_rw(struct io_k
+
+ io_req_map_rw(req, io_size, iovec, fast_iov, iter);
+ }
+- req->work.func = io_rw_async;
+ return 0;
+ }
+
+@@ -1897,8 +1885,7 @@ copy_iov:
+ }
+ }
+ out_free:
+- if (!io_wq_current_is_worker())
+- kfree(iovec);
++ kfree(iovec);
+ return ret;
+ }
+
+@@ -2003,8 +1990,7 @@ copy_iov:
+ }
+ }
+ out_free:
+- if (!io_wq_current_is_worker())
+- kfree(iovec);
++ kfree(iovec);
+ return ret;
+ }
+
+@@ -2174,19 +2160,6 @@ static int io_sync_file_range(struct io_
+ return 0;
+ }
+
+-#if defined(CONFIG_NET)
+-static void io_sendrecv_async(struct io_wq_work **workptr)
+-{
+- struct io_kiocb *req = container_of(*workptr, struct io_kiocb, work);
+- struct iovec *iov = NULL;
+-
+- if (req->io->rw.iov != req->io->rw.fast_iov)
+- iov = req->io->msg.iov;
+- io_wq_submit_work(workptr);
+- kfree(iov);
+-}
+-#endif
+-
+ static int io_sendmsg_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
+ {
+ #if defined(CONFIG_NET)
+@@ -2254,17 +2227,19 @@ static int io_sendmsg(struct io_kiocb *r
+ if (force_nonblock && ret == -EAGAIN) {
+ if (req->io)
+ return -EAGAIN;
+- if (io_alloc_async_ctx(req))
++ if (io_alloc_async_ctx(req)) {
++ if (kmsg && kmsg->iov != kmsg->fast_iov)
++ kfree(kmsg->iov);
+ return -ENOMEM;
++ }
+ memcpy(&req->io->msg, &io.msg, sizeof(io.msg));
+- req->work.func = io_sendrecv_async;
+ return -EAGAIN;
+ }
+ if (ret == -ERESTARTSYS)
+ ret = -EINTR;
+ }
+
+- if (!io_wq_current_is_worker() && kmsg && kmsg->iov != kmsg->fast_iov)
++ if (kmsg && kmsg->iov != kmsg->fast_iov)
+ kfree(kmsg->iov);
+ io_cqring_add_event(req, ret);
+ if (ret < 0)
+@@ -2346,17 +2321,19 @@ static int io_recvmsg(struct io_kiocb *r
+ if (force_nonblock && ret == -EAGAIN) {
+ if (req->io)
+ return -EAGAIN;
+- if (io_alloc_async_ctx(req))
++ if (io_alloc_async_ctx(req)) {
++ if (kmsg && kmsg->iov != kmsg->fast_iov)
++ kfree(kmsg->iov);
+ return -ENOMEM;
++ }
+ memcpy(&req->io->msg, &io.msg, sizeof(io.msg));
+- req->work.func = io_sendrecv_async;
+ return -EAGAIN;
+ }
+ if (ret == -ERESTARTSYS)
+ ret = -EINTR;
+ }
+
+- if (!io_wq_current_is_worker() && kmsg && kmsg->iov != kmsg->fast_iov)
++ if (kmsg && kmsg->iov != kmsg->fast_iov)
+ kfree(kmsg->iov);
+ io_cqring_add_event(req, ret);
+ if (ret < 0)
--- /dev/null
+From 5f798beaf35d79355cbf18019c1993a84475a2c3 Mon Sep 17 00:00:00 2001
+From: Pavel Begunkov <asml.silence@gmail.com>
+Date: Sat, 8 Feb 2020 13:28:02 +0300
+Subject: io_uring: fix double prep iovec leak
+
+From: Pavel Begunkov <asml.silence@gmail.com>
+
+commit 5f798beaf35d79355cbf18019c1993a84475a2c3 upstream.
+
+Requests may be prepared multiple times with ->io allocated (i.e. async
+prepared). Preparation functions don't handle it and forget about
+previously allocated resources. This may happen in case of:
+- spurious defer_check
+- non-head (i.e. async prepared) request executed in sync (via nxt).
+
+Make the handlers check, whether they already allocated resources, which
+is true IFF REQ_F_NEED_CLEANUP is set.
+
+Cc: stable@vger.kernel.org # 5.5
+Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/io_uring.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+--- a/fs/io_uring.c
++++ b/fs/io_uring.c
+@@ -1816,7 +1816,8 @@ static int io_read_prep(struct io_kiocb
+ if (unlikely(!(req->file->f_mode & FMODE_READ)))
+ return -EBADF;
+
+- if (!req->io)
++ /* either don't need iovec imported or already have it */
++ if (!req->io || req->flags & REQ_F_NEED_CLEANUP)
+ return 0;
+
+ io = req->io;
+@@ -1903,7 +1904,8 @@ static int io_write_prep(struct io_kiocb
+ if (unlikely(!(req->file->f_mode & FMODE_WRITE)))
+ return -EBADF;
+
+- if (!req->io)
++ /* either don't need iovec imported or already have it */
++ if (!req->io || req->flags & REQ_F_NEED_CLEANUP)
+ return 0;
+
+ io = req->io;
+@@ -2649,6 +2651,9 @@ static int io_poll_wake(struct wait_queu
+ /* for instances that support it check for an event match first: */
+ if (mask && !(mask & poll->events))
+ return 0;
++ /* iovec is already imported */
++ if (req->flags & REQ_F_NEED_CLEANUP)
++ return 0;
+
+ list_del_init(&poll->wait.entry);
+
+@@ -3151,6 +3156,9 @@ static int io_req_defer(struct io_kiocb
+ /* Still need defer if there is pending req in defer list. */
+ if (!req_need_defer(req) && list_empty(&ctx->defer_list))
+ return 0;
++ /* iovec is already imported */
++ if (req->flags & REQ_F_NEED_CLEANUP)
++ return 0;
+
+ if (!req->io && io_alloc_async_ctx(req))
+ return -EAGAIN;
--- /dev/null
+From faac996ccd5da95bc56b91aa80f2643c2d0a1c56 Mon Sep 17 00:00:00 2001
+From: Jens Axboe <axboe@kernel.dk>
+Date: Fri, 7 Feb 2020 15:45:22 -0700
+Subject: io_uring: retry raw bdev writes if we hit -EOPNOTSUPP
+
+From: Jens Axboe <axboe@kernel.dk>
+
+commit faac996ccd5da95bc56b91aa80f2643c2d0a1c56 upstream.
+
+For non-blocking issue, we set IOCB_NOWAIT in the kiocb. However, on a
+raw block device, this yields an -EOPNOTSUPP return, as non-blocking
+writes aren't supported. Turn this -EOPNOTSUPP into -EAGAIN, so we retry
+from blocking context with IOCB_NOWAIT cleared.
+
+Cc: stable@vger.kernel.org # 5.5
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/io_uring.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/fs/io_uring.c
++++ b/fs/io_uring.c
+@@ -1980,6 +1980,12 @@ static int io_write(struct io_kiocb *req
+ ret2 = call_write_iter(req->file, kiocb, &iter);
+ else
+ ret2 = loop_rw_iter(WRITE, req->file, kiocb, &iter);
++ /*
++ * Raw bdev writes will -EOPNOTSUPP for IOCB_NOWAIT. Just
++ * retry them without IOCB_NOWAIT.
++ */
++ if (ret2 == -EOPNOTSUPP && (kiocb->ki_flags & IOCB_NOWAIT))
++ ret2 = -EAGAIN;
+ if (!force_nonblock || ret2 != -EAGAIN) {
+ kiocb_done(kiocb, ret2, nxt, req->in_async);
+ } else {
projects / thirdparty / kernel / stable-queue.git / commitdiff
