--- /dev/null
+From 3f74249057827c5f6676c41c18f6be12ce1469ce Mon Sep 17 00:00:00 2001
+From: Hui Wang <hui.wang@canonical.com>
+Date: Mon, 14 Sep 2020 14:51:18 +0800
+Subject: ALSA: hda/realtek - Couldn't detect Mic if booting with headset plugged
+
+From: Hui Wang <hui.wang@canonical.com>
+
+commit 3f74249057827c5f6676c41c18f6be12ce1469ce upstream.
+
+We found a Mic detection issue on many Lenovo laptops, those laptops
+belong to differnt models and they have different audio design like
+internal mic connects to the codec or PCH, they all have this problem,
+the problem is if plugging a headset before powerup/reboot the
+machine, after booting up, the headphone could be detected but Mic
+couldn't. If we plug out and plug in the headset, both headphone and
+Mic could be detected then.
+
+Through debugging we found the codec on those laptops are same, it is
+alc257, and if we don't disable the 3k pulldown in alc256_shutup(),
+the issue will be fixed. So far there is no pop noise or power
+consumption regression on those laptops after this change.
+
+Cc: Kailang Yang <kailang@realtek.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Hui Wang <hui.wang@canonical.com>
+Link: https://lore.kernel.org/r/20200914065118.19238-1-hui.wang@canonical.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_realtek.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -3419,7 +3419,11 @@ static void alc256_shutup(struct hda_cod
+
+ /* 3k pull low control for Headset jack. */
+ /* NOTE: call this before clearing the pin, otherwise codec stalls */
+- alc_update_coef_idx(codec, 0x46, 0, 3 << 12);
++ /* If disable 3k pulldown control for alc257, the Mic detection will not work correctly
++ * when booting with headset plugged. So skip setting it for the codec alc257
++ */
++ if (codec->core.vendor_id != 0x10ec0257)
++ alc_update_coef_idx(codec, 0x46, 0, 3 << 12);
+
+ if (!spec->no_shutup_pins)
+ snd_hda_codec_write(codec, hp_pin, 0,
--- /dev/null
+From f73bbf639b32acb6b409e188fdde5644b301978f Mon Sep 17 00:00:00 2001
+From: Kai-Heng Feng <kai.heng.feng@canonical.com>
+Date: Mon, 14 Sep 2020 15:02:29 +0800
+Subject: ALSA: hda/realtek: Enable front panel headset LED on Lenovo ThinkStation P520
+
+From: Kai-Heng Feng <kai.heng.feng@canonical.com>
+
+commit f73bbf639b32acb6b409e188fdde5644b301978f upstream.
+
+On Lenovo P520, the front panel headset LED isn't lit up right now.
+
+Realtek states that the LED needs to be enabled by ALC233's GPIO2, so
+let's do it accordingly to light the LED up.
+
+Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
+Acked-by: Hui Wang <hui.wang@canonical.com>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20200914070231.13192-1-kai.heng.feng@canonical.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_realtek.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -6066,6 +6066,7 @@ static void alc_fixup_thinkpad_acpi(stru
+ #include "hp_x360_helper.c"
+
+ enum {
++ ALC269_FIXUP_GPIO2,
+ ALC269_FIXUP_SONY_VAIO,
+ ALC275_FIXUP_SONY_VAIO_GPIO2,
+ ALC269_FIXUP_DELL_M101Z,
+@@ -6247,6 +6248,10 @@ enum {
+ };
+
+ static const struct hda_fixup alc269_fixups[] = {
++ [ALC269_FIXUP_GPIO2] = {
++ .type = HDA_FIXUP_FUNC,
++ .v.func = alc_fixup_gpio2,
++ },
+ [ALC269_FIXUP_SONY_VAIO] = {
+ .type = HDA_FIXUP_PINCTLS,
+ .v.pins = (const struct hda_pintbl[]) {
+@@ -7066,6 +7071,8 @@ static const struct hda_fixup alc269_fix
+ [ALC233_FIXUP_LENOVO_MULTI_CODECS] = {
+ .type = HDA_FIXUP_FUNC,
+ .v.func = alc233_alc662_fixup_lenovo_dual_codecs,
++ .chained = true,
++ .chain_id = ALC269_FIXUP_GPIO2
+ },
+ [ALC233_FIXUP_ACER_HEADSET_MIC] = {
+ .type = HDA_FIXUP_VERBS,
--- /dev/null
+From 315c7ad7a701baba28c628c4c5426b3d9617ceed Mon Sep 17 00:00:00 2001
+From: Joakim Tjernlund <joakim.tjernlund@infinera.com>
+Date: Thu, 10 Sep 2020 10:53:28 +0200
+Subject: ALSA: usb-audio: Add delay quirk for H570e USB headsets
+
+From: Joakim Tjernlund <joakim.tjernlund@infinera.com>
+
+commit 315c7ad7a701baba28c628c4c5426b3d9617ceed upstream.
+
+Needs the same delay as H650e
+
+Signed-off-by: Joakim Tjernlund <joakim.tjernlund@infinera.com>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/20200910085328.19188-1-joakim.tjernlund@infinera.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/usb/quirks.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/sound/usb/quirks.c
++++ b/sound/usb/quirks.c
+@@ -1668,12 +1668,13 @@ void snd_usb_ctl_msg_quirk(struct usb_de
+ && (requesttype & USB_TYPE_MASK) == USB_TYPE_CLASS)
+ msleep(20);
+
+- /* Zoom R16/24, Logitech H650e, Jabra 550a, Kingston HyperX needs a tiny
+- * delay here, otherwise requests like get/set frequency return as
+- * failed despite actually succeeding.
++ /* Zoom R16/24, Logitech H650e/H570e, Jabra 550a, Kingston HyperX
++ * needs a tiny delay here, otherwise requests like get/set
++ * frequency return as failed despite actually succeeding.
+ */
+ if ((chip->usb_id == USB_ID(0x1686, 0x00dd) ||
+ chip->usb_id == USB_ID(0x046d, 0x0a46) ||
++ chip->usb_id == USB_ID(0x046d, 0x0a56) ||
+ chip->usb_id == USB_ID(0x0b0e, 0x0349) ||
+ chip->usb_id == USB_ID(0x0951, 0x16ad)) &&
+ (requesttype & USB_TYPE_MASK) == USB_TYPE_CLASS)
--- /dev/null
+From a1cd6c2ae47ee10ff21e62475685d5b399e2ed4a Mon Sep 17 00:00:00 2001
+From: Mikulas Patocka <mpatocka@redhat.com>
+Date: Fri, 25 Sep 2020 21:19:24 -0700
+Subject: arch/x86/lib/usercopy_64.c: fix __copy_user_flushcache() cache writeback
+
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+commit a1cd6c2ae47ee10ff21e62475685d5b399e2ed4a upstream.
+
+If we copy less than 8 bytes and if the destination crosses a cache
+line, __copy_user_flushcache would invalidate only the first cache line.
+
+This patch makes it invalidate the second cache line as well.
+
+Fixes: 0aed55af88345b ("x86, uaccess: introduce copy_from_iter_flushcache for pmem / cache-bypass operations")
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Reviewed-by: Dan Williams <dan.j.wiilliams@intel.com>
+Cc: Jan Kara <jack@suse.cz>
+Cc: Jeff Moyer <jmoyer@redhat.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Christoph Hellwig <hch@lst.de>
+Cc: Toshi Kani <toshi.kani@hpe.com>
+Cc: "H. Peter Anvin" <hpa@zytor.com>
+Cc: Al Viro <viro@zeniv.linux.org.uk>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Matthew Wilcox <mawilcox@microsoft.com>
+Cc: Ross Zwisler <ross.zwisler@linux.intel.com>
+Cc: Ingo Molnar <mingo@elte.hu>
+Cc: <stable@vger.kernel.org>
+Link: https://lkml.kernel.org/r/alpine.LRH.2.02.2009161451140.21915@file01.intranet.prod.int.rdu2.redhat.com
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/lib/usercopy_64.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/x86/lib/usercopy_64.c
++++ b/arch/x86/lib/usercopy_64.c
+@@ -120,7 +120,7 @@ long __copy_user_flushcache(void *dst, c
+ */
+ if (size < 8) {
+ if (!IS_ALIGNED(dest, 4) || size != 4)
+- clean_cache_range(dst, 1);
++ clean_cache_range(dst, size);
+ } else {
+ if (!IS_ALIGNED(dest, 8)) {
+ dest = ALIGN(dest, boot_cpu_data.x86_clflush_size);
--- /dev/null
+From 1e1b6d63d6340764e00356873e5794225a2a03ea Mon Sep 17 00:00:00 2001
+From: Nick Desaulniers <ndesaulniers@google.com>
+Date: Fri, 25 Sep 2020 21:19:18 -0700
+Subject: lib/string.c: implement stpcpy
+
+From: Nick Desaulniers <ndesaulniers@google.com>
+
+commit 1e1b6d63d6340764e00356873e5794225a2a03ea upstream.
+
+LLVM implemented a recent "libcall optimization" that lowers calls to
+`sprintf(dest, "%s", str)` where the return value is used to
+`stpcpy(dest, str) - dest`.
+
+This generally avoids the machinery involved in parsing format strings.
+`stpcpy` is just like `strcpy` except it returns the pointer to the new
+tail of `dest`. This optimization was introduced into clang-12.
+
+Implement this so that we don't observe linkage failures due to missing
+symbol definitions for `stpcpy`.
+
+Similar to last year's fire drill with: commit 5f074f3e192f
+("lib/string.c: implement a basic bcmp")
+
+The kernel is somewhere between a "freestanding" environment (no full
+libc) and "hosted" environment (many symbols from libc exist with the
+same type, function signature, and semantics).
+
+As Peter Anvin notes, there's not really a great way to inform the
+compiler that you're targeting a freestanding environment but would like
+to opt-in to some libcall optimizations (see pr/47280 below), rather
+than opt-out.
+
+Arvind notes, -fno-builtin-* behaves slightly differently between GCC
+and Clang, and Clang is missing many __builtin_* definitions, which I
+consider a bug in Clang and am working on fixing.
+
+Masahiro summarizes the subtle distinction between compilers justly:
+ To prevent transformation from foo() into bar(), there are two ways in
+ Clang to do that; -fno-builtin-foo, and -fno-builtin-bar. There is
+ only one in GCC; -fno-buitin-foo.
+
+(Any difference in that behavior in Clang is likely a bug from a missing
+__builtin_* definition.)
+
+Masahiro also notes:
+ We want to disable optimization from foo() to bar(),
+ but we may still benefit from the optimization from
+ foo() into something else. If GCC implements the same transform, we
+ would run into a problem because it is not -fno-builtin-bar, but
+ -fno-builtin-foo that disables that optimization.
+
+ In this regard, -fno-builtin-foo would be more future-proof than
+ -fno-built-bar, but -fno-builtin-foo is still potentially overkill. We
+ may want to prevent calls from foo() being optimized into calls to
+ bar(), but we still may want other optimization on calls to foo().
+
+It seems that compilers today don't quite provide the fine grain control
+over which libcall optimizations pseudo-freestanding environments would
+prefer.
+
+Finally, Kees notes that this interface is unsafe, so we should not
+encourage its use. As such, I've removed the declaration from any
+header, but it still needs to be exported to avoid linkage errors in
+modules.
+
+Reported-by: Sami Tolvanen <samitolvanen@google.com>
+Suggested-by: Andy Lavr <andy.lavr@gmail.com>
+Suggested-by: Arvind Sankar <nivedita@alum.mit.edu>
+Suggested-by: Joe Perches <joe@perches.com>
+Suggested-by: Kees Cook <keescook@chromium.org>
+Suggested-by: Masahiro Yamada <masahiroy@kernel.org>
+Suggested-by: Rasmus Villemoes <linux@rasmusvillemoes.dk>
+Signed-off-by: Nick Desaulniers <ndesaulniers@google.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Tested-by: Nathan Chancellor <natechancellor@gmail.com>
+Cc: <stable@vger.kernel.org>
+Link: https://lkml.kernel.org/r/20200914161643.938408-1-ndesaulniers@google.com
+Link: https://bugs.llvm.org/show_bug.cgi?id=47162
+Link: https://bugs.llvm.org/show_bug.cgi?id=47280
+Link: https://github.com/ClangBuiltLinux/linux/issues/1126
+Link: https://man7.org/linux/man-pages/man3/stpcpy.3.html
+Link: https://pubs.opengroup.org/onlinepubs/9699919799/functions/stpcpy.html
+Link: https://reviews.llvm.org/D85963
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ lib/string.c | 24 ++++++++++++++++++++++++
+ 1 file changed, 24 insertions(+)
+
+--- a/lib/string.c
++++ b/lib/string.c
+@@ -272,6 +272,30 @@ ssize_t strscpy_pad(char *dest, const ch
+ }
+ EXPORT_SYMBOL(strscpy_pad);
+
++/**
++ * stpcpy - copy a string from src to dest returning a pointer to the new end
++ * of dest, including src's %NUL-terminator. May overrun dest.
++ * @dest: pointer to end of string being copied into. Must be large enough
++ * to receive copy.
++ * @src: pointer to the beginning of string being copied from. Must not overlap
++ * dest.
++ *
++ * stpcpy differs from strcpy in a key way: the return value is a pointer
++ * to the new %NUL-terminating character in @dest. (For strcpy, the return
++ * value is a pointer to the start of @dest). This interface is considered
++ * unsafe as it doesn't perform bounds checking of the inputs. As such it's
++ * not recommended for usage. Instead, its definition is provided in case
++ * the compiler lowers other libcalls to stpcpy.
++ */
++char *stpcpy(char *__restrict__ dest, const char *__restrict__ src);
++char *stpcpy(char *__restrict__ dest, const char *__restrict__ src)
++{
++ while ((*dest++ = *src++) != '\0')
++ /* nothing */;
++ return --dest;
++}
++EXPORT_SYMBOL(stpcpy);
++
+ #ifndef __HAVE_ARCH_STRCAT
+ /**
+ * strcat - Append one %NUL-terminated string to another
--- /dev/null
+From 7f04839ec4483563f38062b4dd90253e45447198 Mon Sep 17 00:00:00 2001
+From: James Smart <james.smart@broadcom.com>
+Date: Fri, 11 Sep 2020 13:01:47 -0700
+Subject: scsi: lpfc: Fix initial FLOGI failure due to BBSCN not supported
+
+From: James Smart <james.smart@broadcom.com>
+
+commit 7f04839ec4483563f38062b4dd90253e45447198 upstream.
+
+Initial FLOGIs are failing with the following message:
+
+ lpfc 0000:13:00.1: 1:(0):0820 FLOGI Failed (x300). BBCredit Not Supported
+
+In a prior patch, the READ_SPARAM command was re-ordered to post after
+CONFIG_LINK as the driver is expected to update the driver's copy of the
+service parameters for the FLOGI payload. If the bb-credit recovery feature
+is enabled, this is fine. But on adapters were bb-credit recovery isn't
+enabled, it would cause the FLOGI to fail.
+
+Fix by restoring the original command order (READ_SPARAM before
+CONFIG_LINK), and after issuing CONFIG_LINK, detect bb-credit recovery
+support and reissuing READ_SPARAM to obtain the updated service parameters
+(effectively adding in the fix command order).
+
+[mkp: corrected SHA]
+
+Link: https://lore.kernel.org/r/20200911200147.110826-1-james.smart@broadcom.com
+Fixes: 835214f5d5f5 ("scsi: lpfc: Fix broken Credit Recovery after driver load")
+CC: <stable@vger.kernel.org> # v5.7+
+Co-developed-by: Dick Kennedy <dick.kennedy@broadcom.com>
+Signed-off-by: Dick Kennedy <dick.kennedy@broadcom.com>
+Signed-off-by: James Smart <james.smart@broadcom.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/lpfc/lpfc_hbadisc.c | 76 ++++++++++++++++++++++++++-------------
+ 1 file changed, 52 insertions(+), 24 deletions(-)
+
+--- a/drivers/scsi/lpfc/lpfc_hbadisc.c
++++ b/drivers/scsi/lpfc/lpfc_hbadisc.c
+@@ -71,6 +71,7 @@ static void lpfc_disc_timeout_handler(st
+ static void lpfc_disc_flush_list(struct lpfc_vport *vport);
+ static void lpfc_unregister_fcfi_cmpl(struct lpfc_hba *, LPFC_MBOXQ_t *);
+ static int lpfc_fcf_inuse(struct lpfc_hba *);
++static void lpfc_mbx_cmpl_read_sparam(struct lpfc_hba *, LPFC_MBOXQ_t *);
+
+ void
+ lpfc_terminate_rport_io(struct fc_rport *rport)
+@@ -1138,11 +1139,13 @@ out:
+ return;
+ }
+
+-
+ void
+ lpfc_mbx_cmpl_local_config_link(struct lpfc_hba *phba, LPFC_MBOXQ_t *pmb)
+ {
+ struct lpfc_vport *vport = pmb->vport;
++ LPFC_MBOXQ_t *sparam_mb;
++ struct lpfc_dmabuf *sparam_mp;
++ int rc;
+
+ if (pmb->u.mb.mbxStatus)
+ goto out;
+@@ -1167,12 +1170,42 @@ lpfc_mbx_cmpl_local_config_link(struct l
+ }
+
+ /* Start discovery by sending a FLOGI. port_state is identically
+- * LPFC_FLOGI while waiting for FLOGI cmpl. Check if sending
+- * the FLOGI is being deferred till after MBX_READ_SPARAM completes.
++ * LPFC_FLOGI while waiting for FLOGI cmpl.
+ */
+ if (vport->port_state != LPFC_FLOGI) {
+- if (!(phba->hba_flag & HBA_DEFER_FLOGI))
++ /* Issue MBX_READ_SPARAM to update CSPs before FLOGI if
++ * bb-credit recovery is in place.
++ */
++ if (phba->bbcredit_support && phba->cfg_enable_bbcr &&
++ !(phba->link_flag & LS_LOOPBACK_MODE)) {
++ sparam_mb = mempool_alloc(phba->mbox_mem_pool,
++ GFP_KERNEL);
++ if (!sparam_mb)
++ goto sparam_out;
++
++ rc = lpfc_read_sparam(phba, sparam_mb, 0);
++ if (rc) {
++ mempool_free(sparam_mb, phba->mbox_mem_pool);
++ goto sparam_out;
++ }
++ sparam_mb->vport = vport;
++ sparam_mb->mbox_cmpl = lpfc_mbx_cmpl_read_sparam;
++ rc = lpfc_sli_issue_mbox(phba, sparam_mb, MBX_NOWAIT);
++ if (rc == MBX_NOT_FINISHED) {
++ sparam_mp = (struct lpfc_dmabuf *)
++ sparam_mb->ctx_buf;
++ lpfc_mbuf_free(phba, sparam_mp->virt,
++ sparam_mp->phys);
++ kfree(sparam_mp);
++ sparam_mb->ctx_buf = NULL;
++ mempool_free(sparam_mb, phba->mbox_mem_pool);
++ goto sparam_out;
++ }
++
++ phba->hba_flag |= HBA_DEFER_FLOGI;
++ } else {
+ lpfc_initial_flogi(vport);
++ }
+ } else {
+ if (vport->fc_flag & FC_PT2PT)
+ lpfc_disc_start(vport);
+@@ -1184,6 +1217,7 @@ out:
+ "0306 CONFIG_LINK mbxStatus error x%x "
+ "HBA state x%x\n",
+ pmb->u.mb.mbxStatus, vport->port_state);
++sparam_out:
+ mempool_free(pmb, phba->mbox_mem_pool);
+
+ lpfc_linkdown(phba);
+@@ -3239,21 +3273,6 @@ lpfc_mbx_process_link_up(struct lpfc_hba
+ lpfc_linkup(phba);
+ sparam_mbox = NULL;
+
+- if (!(phba->hba_flag & HBA_FCOE_MODE)) {
+- cfglink_mbox = mempool_alloc(phba->mbox_mem_pool, GFP_KERNEL);
+- if (!cfglink_mbox)
+- goto out;
+- vport->port_state = LPFC_LOCAL_CFG_LINK;
+- lpfc_config_link(phba, cfglink_mbox);
+- cfglink_mbox->vport = vport;
+- cfglink_mbox->mbox_cmpl = lpfc_mbx_cmpl_local_config_link;
+- rc = lpfc_sli_issue_mbox(phba, cfglink_mbox, MBX_NOWAIT);
+- if (rc == MBX_NOT_FINISHED) {
+- mempool_free(cfglink_mbox, phba->mbox_mem_pool);
+- goto out;
+- }
+- }
+-
+ sparam_mbox = mempool_alloc(phba->mbox_mem_pool, GFP_KERNEL);
+ if (!sparam_mbox)
+ goto out;
+@@ -3274,7 +3293,20 @@ lpfc_mbx_process_link_up(struct lpfc_hba
+ goto out;
+ }
+
+- if (phba->hba_flag & HBA_FCOE_MODE) {
++ if (!(phba->hba_flag & HBA_FCOE_MODE)) {
++ cfglink_mbox = mempool_alloc(phba->mbox_mem_pool, GFP_KERNEL);
++ if (!cfglink_mbox)
++ goto out;
++ vport->port_state = LPFC_LOCAL_CFG_LINK;
++ lpfc_config_link(phba, cfglink_mbox);
++ cfglink_mbox->vport = vport;
++ cfglink_mbox->mbox_cmpl = lpfc_mbx_cmpl_local_config_link;
++ rc = lpfc_sli_issue_mbox(phba, cfglink_mbox, MBX_NOWAIT);
++ if (rc == MBX_NOT_FINISHED) {
++ mempool_free(cfglink_mbox, phba->mbox_mem_pool);
++ goto out;
++ }
++ } else {
+ vport->port_state = LPFC_VPORT_UNKNOWN;
+ /*
+ * Add the driver's default FCF record at FCF index 0 now. This
+@@ -3331,10 +3363,6 @@ lpfc_mbx_process_link_up(struct lpfc_hba
+ }
+ /* Reset FCF roundrobin bmask for new discovery */
+ lpfc_sli4_clear_fcf_rr_bmask(phba);
+- } else {
+- if (phba->bbcredit_support && phba->cfg_enable_bbcr &&
+- !(phba->link_flag & LS_LOOPBACK_MODE))
+- phba->hba_flag |= HBA_DEFER_FLOGI;
+ }
+
+ /* Prepare for LINK up registrations */
kvm-x86-reset-mmu-context-if-guest-toggles-cr4.smap-.patch
kvm-svm-add-a-dedicated-invd-intercept-routine.patch
mm-validate-pmd-after-splitting.patch
+arch-x86-lib-usercopy_64.c-fix-__copy_user_flushcache-cache-writeback.patch
+x86-irq-make-run_on_irqstack_cond-typesafe.patch
+x86-ioapic-unbreak-check_timer.patch
+scsi-lpfc-fix-initial-flogi-failure-due-to-bbscn-not-supported.patch
+alsa-usb-audio-add-delay-quirk-for-h570e-usb-headsets.patch
+alsa-hda-realtek-couldn-t-detect-mic-if-booting-with-headset-plugged.patch
+alsa-hda-realtek-enable-front-panel-headset-led-on-lenovo-thinkstation-p520.patch
+lib-string.c-implement-stpcpy.patch
--- /dev/null
+From 86a82ae0b5095ea24c55898a3f025791e7958b21 Mon Sep 17 00:00:00 2001
+From: Thomas Gleixner <tglx@linutronix.de>
+Date: Wed, 23 Sep 2020 17:46:20 +0200
+Subject: x86/ioapic: Unbreak check_timer()
+
+From: Thomas Gleixner <tglx@linutronix.de>
+
+commit 86a82ae0b5095ea24c55898a3f025791e7958b21 upstream.
+
+Several people reported in the kernel bugzilla that between v4.12 and v4.13
+the magic which works around broken hardware and BIOSes to find the proper
+timer interrupt delivery mode stopped working for some older affected
+platforms which need to fall back to ExtINT delivery mode.
+
+The reason is that the core code changed to keep track of the masked and
+disabled state of an interrupt line more accurately to avoid the expensive
+hardware operations.
+
+That broke an assumption in i8259_make_irq() which invokes
+
+ disable_irq_nosync();
+ irq_set_chip_and_handler();
+ enable_irq();
+
+Up to v4.12 this worked because enable_irq() unconditionally unmasked the
+interrupt line, but after the state tracking improvements this is not
+longer the case because the IO/APIC uses lazy disabling. So the line state
+is unmasked which means that enable_irq() does not call into the new irq
+chip to unmask it.
+
+In principle this is a shortcoming of the core code, but it's more than
+unclear whether the core code should try to reset state. At least this
+cannot be done unconditionally as that would break other existing use cases
+where the chip type is changed, e.g. when changing the trigger type, but
+the callers expect the state to be preserved.
+
+As the way how check_timer() is switching the delivery modes is truly
+unique, the obvious fix is to simply unmask the i8259 manually after
+changing the mode to ExtINT delivery and switching the irq chip to the
+legacy PIC.
+
+Note, that the fixes tag is not really precise, but identifies the commit
+which broke the assumptions in the IO/APIC and i8259 code and that's the
+kernel version to which this needs to be backported.
+
+Fixes: bf22ff45bed6 ("genirq: Avoid unnecessary low level irq function calls")
+Reported-by: p_c_chan@hotmail.com
+Reported-by: ecm4@mail.com
+Reported-by: perdigao1@yahoo.com
+Reported-by: matzes@users.sourceforge.net
+Reported-by: rvelascog@gmail.com
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Tested-by: p_c_chan@hotmail.com
+Tested-by: matzes@users.sourceforge.net
+Cc: stable@vger.kernel.org
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=197769
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/kernel/apic/io_apic.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/arch/x86/kernel/apic/io_apic.c
++++ b/arch/x86/kernel/apic/io_apic.c
+@@ -2243,6 +2243,7 @@ static inline void __init check_timer(vo
+ legacy_pic->init(0);
+ legacy_pic->make_irq(0);
+ apic_write(APIC_LVT0, APIC_DM_EXTINT);
++ legacy_pic->unmask(0);
+
+ unlock_ExtINT_logic();
+
--- /dev/null
+From a7b3474cbb2864d5500d5e4f48dd57c903975cab Mon Sep 17 00:00:00 2001
+From: Thomas Gleixner <tglx@linutronix.de>
+Date: Tue, 22 Sep 2020 09:58:52 +0200
+Subject: x86/irq: Make run_on_irqstack_cond() typesafe
+
+From: Thomas Gleixner <tglx@linutronix.de>
+
+commit a7b3474cbb2864d5500d5e4f48dd57c903975cab upstream.
+
+Sami reported that run_on_irqstack_cond() requires the caller to cast
+functions to mismatching types, which trips indirect call Control-Flow
+Integrity (CFI) in Clang.
+
+Instead of disabling CFI on that function, provide proper helpers for
+the three call variants. The actual ASM code stays the same as that is
+out of reach.
+
+ [ bp: Fix __run_on_irqstack() prototype to match. ]
+
+Fixes: 931b94145981 ("x86/entry: Provide helpers for executing on the irqstack")
+Reported-by: Nathan Chancellor <natechancellor@gmail.com>
+Reported-by: Sami Tolvanen <samitolvanen@google.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Tested-by: Sami Tolvanen <samitolvanen@google.com>
+Cc: <stable@vger.kernel.org>
+Link: https://github.com/ClangBuiltLinux/linux/issues/1052
+Link: https://lkml.kernel.org/r/87pn6eb5tv.fsf@nanos.tec.linutronix.de
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/entry/common.c | 2 -
+ arch/x86/entry/entry_64.S | 2 +
+ arch/x86/include/asm/idtentry.h | 2 -
+ arch/x86/include/asm/irq_stack.h | 70 ++++++++++++++++++++++++++++++++++-----
+ arch/x86/kernel/irq.c | 2 -
+ arch/x86/kernel/irq_64.c | 2 -
+ 6 files changed, 68 insertions(+), 12 deletions(-)
+
+--- a/arch/x86/entry/common.c
++++ b/arch/x86/entry/common.c
+@@ -814,7 +814,7 @@ __visible noinstr void xen_pv_evtchn_do_
+ old_regs = set_irq_regs(regs);
+
+ instrumentation_begin();
+- run_on_irqstack_cond(__xen_pv_evtchn_do_upcall, NULL, regs);
++ run_on_irqstack_cond(__xen_pv_evtchn_do_upcall, regs);
+ instrumentation_begin();
+
+ set_irq_regs(old_regs);
+--- a/arch/x86/entry/entry_64.S
++++ b/arch/x86/entry/entry_64.S
+@@ -687,6 +687,8 @@ SYM_CODE_END(.Lbad_gs)
+ * rdx: Function argument (can be NULL if none)
+ */
+ SYM_FUNC_START(asm_call_on_stack)
++SYM_INNER_LABEL(asm_call_sysvec_on_stack, SYM_L_GLOBAL)
++SYM_INNER_LABEL(asm_call_irq_on_stack, SYM_L_GLOBAL)
+ /*
+ * Save the frame pointer unconditionally. This allows the ORC
+ * unwinder to handle the stack switch.
+--- a/arch/x86/include/asm/idtentry.h
++++ b/arch/x86/include/asm/idtentry.h
+@@ -246,7 +246,7 @@ __visible noinstr void func(struct pt_re
+ instrumentation_begin(); \
+ irq_enter_rcu(); \
+ kvm_set_cpu_l1tf_flush_l1d(); \
+- run_on_irqstack_cond(__##func, regs, regs); \
++ run_sysvec_on_irqstack_cond(__##func, regs); \
+ irq_exit_rcu(); \
+ instrumentation_end(); \
+ idtentry_exit_cond_rcu(regs, rcu_exit); \
+--- a/arch/x86/include/asm/irq_stack.h
++++ b/arch/x86/include/asm/irq_stack.h
+@@ -3,6 +3,7 @@
+ #define _ASM_X86_IRQ_STACK_H
+
+ #include <linux/ptrace.h>
++#include <linux/irq.h>
+
+ #include <asm/processor.h>
+
+@@ -12,20 +13,50 @@ static __always_inline bool irqstack_act
+ return __this_cpu_read(irq_count) != -1;
+ }
+
+-void asm_call_on_stack(void *sp, void *func, void *arg);
++void asm_call_on_stack(void *sp, void (*func)(void), void *arg);
++void asm_call_sysvec_on_stack(void *sp, void (*func)(struct pt_regs *regs),
++ struct pt_regs *regs);
++void asm_call_irq_on_stack(void *sp, void (*func)(struct irq_desc *desc),
++ struct irq_desc *desc);
+
+-static __always_inline void __run_on_irqstack(void *func, void *arg)
++static __always_inline void __run_on_irqstack(void (*func)(void))
+ {
+ void *tos = __this_cpu_read(hardirq_stack_ptr);
+
+ __this_cpu_add(irq_count, 1);
+- asm_call_on_stack(tos - 8, func, arg);
++ asm_call_on_stack(tos - 8, func, NULL);
++ __this_cpu_sub(irq_count, 1);
++}
++
++static __always_inline void
++__run_sysvec_on_irqstack(void (*func)(struct pt_regs *regs),
++ struct pt_regs *regs)
++{
++ void *tos = __this_cpu_read(hardirq_stack_ptr);
++
++ __this_cpu_add(irq_count, 1);
++ asm_call_sysvec_on_stack(tos - 8, func, regs);
++ __this_cpu_sub(irq_count, 1);
++}
++
++static __always_inline void
++__run_irq_on_irqstack(void (*func)(struct irq_desc *desc),
++ struct irq_desc *desc)
++{
++ void *tos = __this_cpu_read(hardirq_stack_ptr);
++
++ __this_cpu_add(irq_count, 1);
++ asm_call_irq_on_stack(tos - 8, func, desc);
+ __this_cpu_sub(irq_count, 1);
+ }
+
+ #else /* CONFIG_X86_64 */
+ static inline bool irqstack_active(void) { return false; }
+-static inline void __run_on_irqstack(void *func, void *arg) { }
++static inline void __run_on_irqstack(void (*func)(void)) { }
++static inline void __run_sysvec_on_irqstack(void (*func)(struct pt_regs *regs),
++ struct pt_regs *regs) { }
++static inline void __run_irq_on_irqstack(void (*func)(struct irq_desc *desc),
++ struct irq_desc *desc) { }
+ #endif /* !CONFIG_X86_64 */
+
+ static __always_inline bool irq_needs_irq_stack(struct pt_regs *regs)
+@@ -37,17 +68,40 @@ static __always_inline bool irq_needs_ir
+ return !user_mode(regs) && !irqstack_active();
+ }
+
+-static __always_inline void run_on_irqstack_cond(void *func, void *arg,
++
++static __always_inline void run_on_irqstack_cond(void (*func)(void),
+ struct pt_regs *regs)
+ {
+- void (*__func)(void *arg) = func;
++ lockdep_assert_irqs_disabled();
++
++ if (irq_needs_irq_stack(regs))
++ __run_on_irqstack(func);
++ else
++ func();
++}
++
++static __always_inline void
++run_sysvec_on_irqstack_cond(void (*func)(struct pt_regs *regs),
++ struct pt_regs *regs)
++{
++ lockdep_assert_irqs_disabled();
+
++ if (irq_needs_irq_stack(regs))
++ __run_sysvec_on_irqstack(func, regs);
++ else
++ func(regs);
++}
++
++static __always_inline void
++run_irq_on_irqstack_cond(void (*func)(struct irq_desc *desc), struct irq_desc *desc,
++ struct pt_regs *regs)
++{
+ lockdep_assert_irqs_disabled();
+
+ if (irq_needs_irq_stack(regs))
+- __run_on_irqstack(__func, arg);
++ __run_irq_on_irqstack(func, desc);
+ else
+- __func(arg);
++ func(desc);
+ }
+
+ #endif
+--- a/arch/x86/kernel/irq.c
++++ b/arch/x86/kernel/irq.c
+@@ -227,7 +227,7 @@ static __always_inline void handle_irq(s
+ struct pt_regs *regs)
+ {
+ if (IS_ENABLED(CONFIG_X86_64))
+- run_on_irqstack_cond(desc->handle_irq, desc, regs);
++ run_irq_on_irqstack_cond(desc->handle_irq, desc, regs);
+ else
+ __handle_irq(desc, regs);
+ }
+--- a/arch/x86/kernel/irq_64.c
++++ b/arch/x86/kernel/irq_64.c
+@@ -74,5 +74,5 @@ int irq_init_percpu_irqstack(unsigned in
+
+ void do_softirq_own_stack(void)
+ {
+- run_on_irqstack_cond(__do_softirq, NULL, NULL);
++ run_on_irqstack_cond(__do_softirq, NULL);
+ }
projects / thirdparty / kernel / stable-queue.git / commitdiff
