From: Greg Kroah-Hartman Date: Mon, 18 Mar 2019 08:19:37 +0000 (+0100) Subject: 4.19-stable patches X-Git-Tag: v5.0.3~4 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=1c5c96030064a5a461b9156bf0113604ad0e3302;p=thirdparty%2Fkernel%2Fstable-queue.git 4.19-stable patches added patches: alsa-bebob-use-more-identical-mod_alias-for-saffire-pro-10-i-o-against-liquid-saffire-56.patch alsa-firewire-motu-fix-construction-of-pcm-frame-for-capture-direction.patch alsa-hda-add-more-quirks-for-hp-z2-g4-and-hp-z240.patch alsa-hda-extend-i915-component-bind-timeout.patch alsa-hda-realtek-enable-audio-jacks-of-asus-ux362fa-with-alc294.patch alsa-hda-realtek-enable-headset-mic-of-acer-travelmate-x514-51t-with-alc255.patch alsa-hda-realtek-reduce-click-noise-on-dell-precision-5820-headphone.patch drm-block-fb-changes-for-async-plane-updates.patch i40e-report-correct-statistics-when-xdp-is-enabled.patch it-s-wrong-to-add-len-to-sector_nr-in-raid10-reshape-twice.patch perf-x86-fixup-typo-in-stub-functions.patch perf-x86-intel-fix-memory-corruption.patch perf-x86-intel-make-dev_attr_allow_tsx_force_abort-static.patch staging-erofs-fix-race-when-the-managed-cache-is-enabled.patch vhost-vsock-fix-vhost-vsock-cid-hashing-inconsistent.patch --- diff --git a/queue-4.19/alsa-bebob-use-more-identical-mod_alias-for-saffire-pro-10-i-o-against-liquid-saffire-56.patch b/queue-4.19/alsa-bebob-use-more-identical-mod_alias-for-saffire-pro-10-i-o-against-liquid-saffire-56.patch new file mode 100644 index 00000000000..7d89808aced --- /dev/null +++ b/queue-4.19/alsa-bebob-use-more-identical-mod_alias-for-saffire-pro-10-i-o-against-liquid-saffire-56.patch @@ -0,0 +1,180 @@ +From 7dc661bd8d3261053b69e4e2d0050cd1ee540fc1 Mon Sep 17 00:00:00 2001 +From: Takashi Sakamoto +Date: Tue, 26 Feb 2019 13:38:16 +0900 +Subject: ALSA: bebob: use more identical mod_alias for Saffire Pro 10 I/O against Liquid Saffire 56 + +From: Takashi Sakamoto + +commit 7dc661bd8d3261053b69e4e2d0050cd1ee540fc1 upstream. + +ALSA bebob driver has an entry for Focusrite Saffire Pro 10 I/O. The +entry matches vendor_id in root directory and model_id in unit +directory of configuration ROM for IEEE 1394 bus. + +On the other hand, configuration ROM of Focusrite Liquid Saffire 56 +has the same vendor_id and model_id. This device is an application of +TCAT Dice (TCD2220 a.k.a Dice Jr.) however ALSA bebob driver can be +bound to it randomly instead of ALSA dice driver. At present, drivers +in ALSA firewire stack can not handle this situation appropriately. + +This commit uses more identical mod_alias for Focusrite Saffire Pro 10 +I/O in ALSA bebob driver. + +$ python2 crpp < /sys/bus/firewire/devices/fw1/config_rom + ROM header and bus information block + ----------------------------------------------------------------- +400 042a829d bus_info_length 4, crc_length 42, crc 33437 +404 31333934 bus_name "1394" +408 f0649222 irmc 1, cmc 1, isc 1, bmc 1, pmc 0, cyc_clk_acc 100, + max_rec 9 (1024), max_rom 2, gen 2, spd 2 (S400) +40c 00130e01 company_id 00130e | +410 000606e0 device_id 01000606e0 | EUI-64 00130e01000606e0 + + root directory + ----------------------------------------------------------------- +414 0009d31c directory_length 9, crc 54044 +418 04000014 hardware version +41c 0c0083c0 node capabilities per IEEE 1394 +420 0300130e vendor +424 81000012 --> descriptor leaf at 46c +428 17000006 model +42c 81000016 --> descriptor leaf at 484 +430 130120c2 version +434 d1000002 --> unit directory at 43c +438 d4000006 --> dependent info directory at 450 + + unit directory at 43c + ----------------------------------------------------------------- +43c 0004707c directory_length 4, crc 28796 +440 1200a02d specifier id: 1394 TA +444 13010001 version: AV/C +448 17000006 model +44c 81000013 --> descriptor leaf at 498 + + dependent info directory at 450 + ----------------------------------------------------------------- +450 000637c7 directory_length 6, crc 14279 +454 120007f5 specifier id +458 13000001 version +45c 3affffc7 (immediate value) +460 3b100000 (immediate value) +464 3cffffc7 (immediate value) +468 3d600000 (immediate value) + + descriptor leaf at 46c + ----------------------------------------------------------------- +46c 00056f3b leaf_length 5, crc 28475 +470 00000000 textual descriptor +474 00000000 minimal ASCII +478 466f6375 "Focu" +47c 73726974 "srit" +480 65000000 "e" + + descriptor leaf at 484 + ----------------------------------------------------------------- +484 0004a165 leaf_length 4, crc 41317 +488 00000000 textual descriptor +48c 00000000 minimal ASCII +490 50726f31 "Pro1" +494 30494f00 "0IO" + + descriptor leaf at 498 + ----------------------------------------------------------------- +498 0004a165 leaf_length 4, crc 41317 +49c 00000000 textual descriptor +4a0 00000000 minimal ASCII +4a4 50726f31 "Pro1" +4a8 30494f00 "0IO" + +$ python2 crpp < /sys/bus/firewire/devices/fw1/config_rom + ROM header and bus information block + ----------------------------------------------------------------- +400 040442e4 bus_info_length 4, crc_length 4, crc 17124 +404 31333934 bus_name "1394" +408 e0ff8112 irmc 1, cmc 1, isc 1, bmc 0, pmc 0, cyc_clk_acc 255, + max_rec 8 (512), max_rom 1, gen 1, spd 2 (S400) +40c 00130e04 company_id 00130e | +410 018001e9 device_id 04018001e9 | EUI-64 00130e04018001e9 + + root directory + ----------------------------------------------------------------- +414 00065612 directory_length 6, crc 22034 +418 0300130e vendor +41c 8100000a --> descriptor leaf at 444 +420 17000006 model +424 8100000e --> descriptor leaf at 45c +428 0c0087c0 node capabilities per IEEE 1394 +42c d1000001 --> unit directory at 430 + + unit directory at 430 + ----------------------------------------------------------------- +430 000418a0 directory_length 4, crc 6304 +434 1200130e specifier id +438 13000001 version +43c 17000006 model +440 8100000f --> descriptor leaf at 47c + + descriptor leaf at 444 + ----------------------------------------------------------------- +444 00056f3b leaf_length 5, crc 28475 +448 00000000 textual descriptor +44c 00000000 minimal ASCII +450 466f6375 "Focu" +454 73726974 "srit" +458 65000000 "e" + + descriptor leaf at 45c + ----------------------------------------------------------------- +45c 000762c6 leaf_length 7, crc 25286 +460 00000000 textual descriptor +464 00000000 minimal ASCII +468 4c495155 "LIQU" +46c 49445f53 "ID_S" +470 41464649 "AFFI" +474 52455f35 "RE_5" +478 36000000 "6" + + descriptor leaf at 47c + ----------------------------------------------------------------- +47c 000762c6 leaf_length 7, crc 25286 +480 00000000 textual descriptor +484 00000000 minimal ASCII +488 4c495155 "LIQU" +48c 49445f53 "ID_S" +490 41464649 "AFFI" +494 52455f35 "RE_5" +498 36000000 "6" + +Cc: # v3.16+ +Fixes: 25784ec2d034 ("ALSA: bebob: Add support for Focusrite Saffire/SaffirePro series") +Signed-off-by: Takashi Sakamoto +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/firewire/bebob/bebob.c | 14 +++++++++++++- + 1 file changed, 13 insertions(+), 1 deletion(-) + +--- a/sound/firewire/bebob/bebob.c ++++ b/sound/firewire/bebob/bebob.c +@@ -474,7 +474,19 @@ static const struct ieee1394_device_id b + /* Focusrite, SaffirePro 26 I/O */ + SND_BEBOB_DEV_ENTRY(VEN_FOCUSRITE, 0x00000003, &saffirepro_26_spec), + /* Focusrite, SaffirePro 10 I/O */ +- SND_BEBOB_DEV_ENTRY(VEN_FOCUSRITE, 0x00000006, &saffirepro_10_spec), ++ { ++ // The combination of vendor_id and model_id is the same as the ++ // same as the one of Liquid Saffire 56. ++ .match_flags = IEEE1394_MATCH_VENDOR_ID | ++ IEEE1394_MATCH_MODEL_ID | ++ IEEE1394_MATCH_SPECIFIER_ID | ++ IEEE1394_MATCH_VERSION, ++ .vendor_id = VEN_FOCUSRITE, ++ .model_id = 0x000006, ++ .specifier_id = 0x00a02d, ++ .version = 0x010001, ++ .driver_data = (kernel_ulong_t)&saffirepro_10_spec, ++ }, + /* Focusrite, Saffire(no label and LE) */ + SND_BEBOB_DEV_ENTRY(VEN_FOCUSRITE, MODEL_FOCUSRITE_SAFFIRE_BOTH, + &saffire_spec), diff --git a/queue-4.19/alsa-firewire-motu-fix-construction-of-pcm-frame-for-capture-direction.patch b/queue-4.19/alsa-firewire-motu-fix-construction-of-pcm-frame-for-capture-direction.patch new file mode 100644 index 00000000000..61d4031146e --- /dev/null +++ b/queue-4.19/alsa-firewire-motu-fix-construction-of-pcm-frame-for-capture-direction.patch @@ -0,0 +1,47 @@ +From f97a0944a72b26a2bece72516294e112a890f98a Mon Sep 17 00:00:00 2001 +From: Takashi Sakamoto +Date: Tue, 26 Feb 2019 13:38:37 +0900 +Subject: ALSA: firewire-motu: fix construction of PCM frame for capture direction +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Takashi Sakamoto + +commit f97a0944a72b26a2bece72516294e112a890f98a upstream. + +In data blocks of common isochronous packet for MOTU devices, PCM +frames are multiplexed in a shape of '24 bit * 4 Audio Pack', described +in IEC 61883-6. The frames are not aligned to quadlet. + +For capture PCM substream, ALSA firewire-motu driver constructs PCM +frames by reading data blocks byte-by-byte. However this operation +includes bug for lower byte of the PCM sample. This brings invalid +content of the PCM samples. + +This commit fixes the bug. + +Reported-by: Peter Sjöberg +Cc: # v4.12+ +Fixes: 4641c9394010 ("ALSA: firewire-motu: add MOTU specific protocol layer") +Signed-off-by: Takashi Sakamoto +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/firewire/motu/amdtp-motu.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/sound/firewire/motu/amdtp-motu.c ++++ b/sound/firewire/motu/amdtp-motu.c +@@ -136,7 +136,9 @@ static void read_pcm_s32(struct amdtp_st + byte = (u8 *)buffer + p->pcm_byte_offset; + + for (c = 0; c < channels; ++c) { +- *dst = (byte[0] << 24) | (byte[1] << 16) | byte[2]; ++ *dst = (byte[0] << 24) | ++ (byte[1] << 16) | ++ (byte[2] << 8); + byte += 3; + dst++; + } diff --git a/queue-4.19/alsa-hda-add-more-quirks-for-hp-z2-g4-and-hp-z240.patch b/queue-4.19/alsa-hda-add-more-quirks-for-hp-z2-g4-and-hp-z240.patch new file mode 100644 index 00000000000..64548ab3d83 --- /dev/null +++ b/queue-4.19/alsa-hda-add-more-quirks-for-hp-z2-g4-and-hp-z240.patch @@ -0,0 +1,53 @@ +From 167897f4b32c2bc18b3b6183029a33fb420a114e Mon Sep 17 00:00:00 2001 +From: Jaroslav Kysela +Date: Wed, 13 Mar 2019 13:40:15 +0100 +Subject: ALSA: hda - add more quirks for HP Z2 G4 and HP Z240 + +From: Jaroslav Kysela + +commit 167897f4b32c2bc18b3b6183029a33fb420a114e upstream. + +Apply the HP_MIC_NO_PRESENCE fixups for the more HP Z2 G4 and +HP Z240 models. + +Reported-by: Jeff Burrell +Signed-off-by: Jaroslav Kysela +Cc: +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_conexant.c | 3 +++ + sound/pci/hda/patch_realtek.c | 6 ++++-- + 2 files changed, 7 insertions(+), 2 deletions(-) + +--- a/sound/pci/hda/patch_conexant.c ++++ b/sound/pci/hda/patch_conexant.c +@@ -936,6 +936,9 @@ static const struct snd_pci_quirk cxt506 + SND_PCI_QUIRK(0x103c, 0x8299, "HP 800 G3 SFF", CXT_FIXUP_HP_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x103c, 0x829a, "HP 800 G3 DM", CXT_FIXUP_HP_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x103c, 0x8455, "HP Z2 G4", CXT_FIXUP_HP_MIC_NO_PRESENCE), ++ SND_PCI_QUIRK(0x103c, 0x8456, "HP Z2 G4 SFF", CXT_FIXUP_HP_MIC_NO_PRESENCE), ++ SND_PCI_QUIRK(0x103c, 0x8457, "HP Z2 G4 mini", CXT_FIXUP_HP_MIC_NO_PRESENCE), ++ SND_PCI_QUIRK(0x103c, 0x8458, "HP Z2 G4 mini premium", CXT_FIXUP_HP_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1043, 0x138d, "Asus", CXT_FIXUP_HEADPHONE_MIC_PIN), + SND_PCI_QUIRK(0x152d, 0x0833, "OLPC XO-1.5", CXT_FIXUP_OLPC_XO), + SND_PCI_QUIRK(0x17aa, 0x20f2, "Lenovo T400", CXT_PINCFG_LENOVO_TP410), +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -6670,11 +6670,13 @@ static const struct snd_pci_quirk alc269 + SND_PCI_QUIRK(0x103c, 0x2336, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), + SND_PCI_QUIRK(0x103c, 0x2337, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), + SND_PCI_QUIRK(0x103c, 0x221c, "HP EliteBook 755 G2", ALC280_FIXUP_HP_HEADSET_MIC), ++ SND_PCI_QUIRK(0x103c, 0x802e, "HP Z240 SFF", ALC221_FIXUP_HP_MIC_NO_PRESENCE), ++ SND_PCI_QUIRK(0x103c, 0x802f, "HP Z240", ALC221_FIXUP_HP_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x103c, 0x820d, "HP Pavilion 15", ALC269_FIXUP_HP_MUTE_LED_MIC3), + SND_PCI_QUIRK(0x103c, 0x8256, "HP", ALC221_FIXUP_HP_FRONT_MIC), + SND_PCI_QUIRK(0x103c, 0x827e, "HP x360", ALC295_FIXUP_HP_X360), +- SND_PCI_QUIRK(0x103c, 0x82bf, "HP", ALC221_FIXUP_HP_MIC_NO_PRESENCE), +- SND_PCI_QUIRK(0x103c, 0x82c0, "HP", ALC221_FIXUP_HP_MIC_NO_PRESENCE), ++ SND_PCI_QUIRK(0x103c, 0x82bf, "HP G3 mini", ALC221_FIXUP_HP_MIC_NO_PRESENCE), ++ SND_PCI_QUIRK(0x103c, 0x82c0, "HP G3 mini premium", ALC221_FIXUP_HP_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x103c, 0x83b9, "HP Spectre x360", ALC269_FIXUP_HP_MUTE_LED_MIC3), + SND_PCI_QUIRK(0x1043, 0x103e, "ASUS X540SA", ALC256_FIXUP_ASUS_MIC), + SND_PCI_QUIRK(0x1043, 0x103f, "ASUS TX300", ALC282_FIXUP_ASUS_TX300), diff --git a/queue-4.19/alsa-hda-extend-i915-component-bind-timeout.patch b/queue-4.19/alsa-hda-extend-i915-component-bind-timeout.patch new file mode 100644 index 00000000000..82eeae5798e --- /dev/null +++ b/queue-4.19/alsa-hda-extend-i915-component-bind-timeout.patch @@ -0,0 +1,43 @@ +From cfc35f9c128cea8fce6a5513b1de50d36f3b209f Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Mon, 25 Feb 2019 16:49:27 +0100 +Subject: ALSA: hda: Extend i915 component bind timeout + +From: Takashi Iwai + +commit cfc35f9c128cea8fce6a5513b1de50d36f3b209f upstream. + +I set 10 seconds for the timeout of the i915 audio component binding +with a hope that recent machines are fast enough to handle all probe +tasks in that period, but I was too optimistic. The binding may take +longer than that, and this caused a problem on the machine with both +audio and graphics driver modules loaded in parallel, as Paul Menzel +experienced. This problem haven't hit so often just because the KMS +driver is loaded in initrd on most machines. + +As a simple workaround, extend the timeout to 60 seconds. + +Fixes: f9b54e1961c7 ("ALSA: hda/i915: Allow delayed i915 audio component binding") +Reported-by: Paul Menzel +Cc: +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/hda/hdac_i915.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/sound/hda/hdac_i915.c ++++ b/sound/hda/hdac_i915.c +@@ -144,9 +144,9 @@ int snd_hdac_i915_init(struct hdac_bus * + return -ENODEV; + if (!acomp->ops) { + request_module("i915"); +- /* 10s timeout */ ++ /* 60s timeout */ + wait_for_completion_timeout(&bind_complete, +- msecs_to_jiffies(10 * 1000)); ++ msecs_to_jiffies(60 * 1000)); + } + if (!acomp->ops) { + dev_info(bus->dev, "couldn't bind with audio component\n"); diff --git a/queue-4.19/alsa-hda-realtek-enable-audio-jacks-of-asus-ux362fa-with-alc294.patch b/queue-4.19/alsa-hda-realtek-enable-audio-jacks-of-asus-ux362fa-with-alc294.patch new file mode 100644 index 00000000000..60057e47b2a --- /dev/null +++ b/queue-4.19/alsa-hda-realtek-enable-audio-jacks-of-asus-ux362fa-with-alc294.patch @@ -0,0 +1,50 @@ +From 8bb37a2a4d7c02affef554f5dc05f6d2e39c31f9 Mon Sep 17 00:00:00 2001 +From: Jian-Hong Pan +Date: Thu, 21 Feb 2019 17:00:18 +0800 +Subject: ALSA: hda/realtek: Enable audio jacks of ASUS UX362FA with ALC294 + +From: Jian-Hong Pan + +commit 8bb37a2a4d7c02affef554f5dc05f6d2e39c31f9 upstream. + +The ASUS UX362FA with ALC294 cannot detect the headset MIC and outputs +through the internal speaker and the headphone. This issue can be fixed +by the quirk in the commit 4e0511067 ALSA: hda/realtek: Enable audio +jacks of ASUS UX533FD with ALC294. + +Besides, ASUS UX362FA and UX533FD have the same audio initial pin config +values. So, this patch replaces SND_PCI_QUIRK of UX533FD with a new +SND_HDA_PIN_QUIRK which benefits both UX362FA and UX533FD. + +Fixes: 4e051106730d ("ALSA: hda/realtek: Enable audio jacks of ASUS UX533FD with ALC294") +Signed-off-by: Jian-Hong Pan +Signed-off-by: Ming Shuo Chiu +Cc: +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_realtek.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -6692,7 +6692,6 @@ static const struct snd_pci_quirk alc269 + SND_PCI_QUIRK(0x1043, 0x12e0, "ASUS X541SA", ALC256_FIXUP_ASUS_MIC), + SND_PCI_QUIRK(0x1043, 0x13b0, "ASUS Z550SA", ALC256_FIXUP_ASUS_MIC), + SND_PCI_QUIRK(0x1043, 0x1427, "Asus Zenbook UX31E", ALC269VB_FIXUP_ASUS_ZENBOOK), +- SND_PCI_QUIRK(0x1043, 0x14a1, "ASUS UX533FD", ALC294_FIXUP_ASUS_SPK), + SND_PCI_QUIRK(0x1043, 0x1517, "Asus Zenbook UX31A", ALC269VB_FIXUP_ASUS_ZENBOOK_UX31A), + SND_PCI_QUIRK(0x1043, 0x16e3, "ASUS UX50", ALC269_FIXUP_STEREO_DMIC), + SND_PCI_QUIRK(0x1043, 0x1a13, "Asus G73Jw", ALC269_FIXUP_ASUS_G73JW), +@@ -7308,6 +7307,10 @@ static const struct snd_hda_pin_quirk al + SND_HDA_PIN_QUIRK(0x10ec0294, 0x1043, "ASUS", ALC294_FIXUP_ASUS_SPK, + {0x12, 0x90a60130}, + {0x17, 0x90170110}, ++ {0x21, 0x03211020}), ++ SND_HDA_PIN_QUIRK(0x10ec0294, 0x1043, "ASUS", ALC294_FIXUP_ASUS_SPK, ++ {0x12, 0x90a60130}, ++ {0x17, 0x90170110}, + {0x21, 0x04211020}), + SND_HDA_PIN_QUIRK(0x10ec0295, 0x1028, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE, + ALC295_STANDARD_PINS, diff --git a/queue-4.19/alsa-hda-realtek-enable-headset-mic-of-acer-travelmate-x514-51t-with-alc255.patch b/queue-4.19/alsa-hda-realtek-enable-headset-mic-of-acer-travelmate-x514-51t-with-alc255.patch new file mode 100644 index 00000000000..6abf9655630 --- /dev/null +++ b/queue-4.19/alsa-hda-realtek-enable-headset-mic-of-acer-travelmate-x514-51t-with-alc255.patch @@ -0,0 +1,59 @@ +From cbc05fd6708c1744ee6a61cb4c461ff956d30524 Mon Sep 17 00:00:00 2001 +From: Jian-Hong Pan +Date: Wed, 13 Mar 2019 17:33:24 +0800 +Subject: ALSA: hda/realtek: Enable headset MIC of Acer TravelMate X514-51T with ALC255 + +From: Jian-Hong Pan + +commit cbc05fd6708c1744ee6a61cb4c461ff956d30524 upstream. + +The Acer TravelMate X514-51T with ALC255 cannot detect the headset MIC +until ALC255_FIXUP_ACER_HEADSET_MIC quirk applied. Although, the +internal DMIC uses another module - snd_soc_skl as the driver. We still +need the NID 0x1a in the quirk to enable the headset MIC. + +Signed-off-by: Jian-Hong Pan +Signed-off-by: Kailang Yang +Cc: +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_realtek.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -5612,6 +5612,7 @@ enum { + ALC294_FIXUP_ASUS_SPK, + ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE, + ALC285_FIXUP_LENOVO_PC_BEEP_IN_NOISE, ++ ALC255_FIXUP_ACER_HEADSET_MIC, + }; + + static const struct hda_fixup alc269_fixups[] = { +@@ -6556,6 +6557,16 @@ static const struct hda_fixup alc269_fix + .chained = true, + .chain_id = ALC285_FIXUP_LENOVO_HEADPHONE_NOISE + }, ++ [ALC255_FIXUP_ACER_HEADSET_MIC] = { ++ .type = HDA_FIXUP_PINS, ++ .v.pins = (const struct hda_pintbl[]) { ++ { 0x19, 0x03a11130 }, ++ { 0x1a, 0x90a60140 }, /* use as internal mic */ ++ { } ++ }, ++ .chained = true, ++ .chain_id = ALC255_FIXUP_HEADSET_MODE_NO_HP_MIC ++ }, + }; + + static const struct snd_pci_quirk alc269_fixup_tbl[] = { +@@ -6575,6 +6586,7 @@ static const struct snd_pci_quirk alc269 + SND_PCI_QUIRK(0x1025, 0x128f, "Acer Veriton Z6860G", ALC286_FIXUP_ACER_AIO_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1025, 0x1290, "Acer Veriton Z4860G", ALC286_FIXUP_ACER_AIO_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1025, 0x1291, "Acer Veriton Z4660G", ALC286_FIXUP_ACER_AIO_MIC_NO_PRESENCE), ++ SND_PCI_QUIRK(0x1025, 0x1330, "Acer TravelMate X514-51T", ALC255_FIXUP_ACER_HEADSET_MIC), + SND_PCI_QUIRK(0x1028, 0x0470, "Dell M101z", ALC269_FIXUP_DELL_M101Z), + SND_PCI_QUIRK(0x1028, 0x054b, "Dell XPS one 2710", ALC275_FIXUP_DELL_XPS), + SND_PCI_QUIRK(0x1028, 0x05bd, "Dell Latitude E6440", ALC292_FIXUP_DELL_E7X), diff --git a/queue-4.19/alsa-hda-realtek-reduce-click-noise-on-dell-precision-5820-headphone.patch b/queue-4.19/alsa-hda-realtek-reduce-click-noise-on-dell-precision-5820-headphone.patch new file mode 100644 index 00000000000..4935d2f1660 --- /dev/null +++ b/queue-4.19/alsa-hda-realtek-reduce-click-noise-on-dell-precision-5820-headphone.patch @@ -0,0 +1,208 @@ +From c0ca5eced22215c1e03e3ad479f8fab0bbb30772 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Wed, 20 Feb 2019 16:15:45 +0100 +Subject: ALSA: hda/realtek - Reduce click noise on Dell Precision 5820 headphone + +From: Takashi Iwai + +commit c0ca5eced22215c1e03e3ad479f8fab0bbb30772 upstream. + +Dell Precision 5820 with ALC3234 codec (which is equivalent with +ALC255) shows click noises at (runtime) PM resume on the headphone. +The biggest source of the noise comes from the cleared headphone pin +control at resume, which is done via the standard shutup procedure. + +Although we have an override of the standard shutup callback to +replace with NOP, this would skip other needed stuff (e.g. the pull +down of headset power). So, instead, this "fixes" the behavior of +alc_fixup_no_shutup() by introducing spec->no_shutup_pins flag. +When this flag is set, Realtek codec won't call the standard +snd_hda_shutup_pins() & co. Now alc_fixup_no_shutup() just sets this +flag instead of overriding spec->shutup callback itself. This allows +us to apply the similar fix for other entries easily if needed in +future. + +Cc: +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_realtek.c | 57 +++++++++++++++++++++++++----------------- + 1 file changed, 34 insertions(+), 23 deletions(-) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -118,6 +118,7 @@ struct alc_spec { + unsigned int has_alc5505_dsp:1; + unsigned int no_depop_delay:1; + unsigned int done_hp_init:1; ++ unsigned int no_shutup_pins:1; + + /* for PLL fix */ + hda_nid_t pll_nid; +@@ -476,6 +477,14 @@ static void alc_auto_setup_eapd(struct h + set_eapd(codec, *p, on); + } + ++static void alc_shutup_pins(struct hda_codec *codec) ++{ ++ struct alc_spec *spec = codec->spec; ++ ++ if (!spec->no_shutup_pins) ++ snd_hda_shutup_pins(codec); ++} ++ + /* generic shutup callback; + * just turning off EAPD and a little pause for avoiding pop-noise + */ +@@ -486,7 +495,7 @@ static void alc_eapd_shutup(struct hda_c + alc_auto_setup_eapd(codec, false); + if (!spec->no_depop_delay) + msleep(200); +- snd_hda_shutup_pins(codec); ++ alc_shutup_pins(codec); + } + + /* generic EAPD initialization */ +@@ -814,7 +823,7 @@ static inline void alc_shutup(struct hda + if (spec && spec->shutup) + spec->shutup(codec); + else +- snd_hda_shutup_pins(codec); ++ alc_shutup_pins(codec); + } + + static void alc_reboot_notify(struct hda_codec *codec) +@@ -2950,7 +2959,7 @@ static void alc269_shutup(struct hda_cod + (alc_get_coef0(codec) & 0x00ff) == 0x018) { + msleep(150); + } +- snd_hda_shutup_pins(codec); ++ alc_shutup_pins(codec); + } + + static struct coef_fw alc282_coefs[] = { +@@ -3053,14 +3062,15 @@ static void alc282_shutup(struct hda_cod + if (hp_pin_sense) + msleep(85); + +- snd_hda_codec_write(codec, hp_pin, 0, +- AC_VERB_SET_PIN_WIDGET_CONTROL, 0x0); ++ if (!spec->no_shutup_pins) ++ snd_hda_codec_write(codec, hp_pin, 0, ++ AC_VERB_SET_PIN_WIDGET_CONTROL, 0x0); + + if (hp_pin_sense) + msleep(100); + + alc_auto_setup_eapd(codec, false); +- snd_hda_shutup_pins(codec); ++ alc_shutup_pins(codec); + alc_write_coef_idx(codec, 0x78, coef78); + } + +@@ -3166,15 +3176,16 @@ static void alc283_shutup(struct hda_cod + if (hp_pin_sense) + msleep(100); + +- snd_hda_codec_write(codec, hp_pin, 0, +- AC_VERB_SET_PIN_WIDGET_CONTROL, 0x0); ++ if (!spec->no_shutup_pins) ++ snd_hda_codec_write(codec, hp_pin, 0, ++ AC_VERB_SET_PIN_WIDGET_CONTROL, 0x0); + + alc_update_coef_idx(codec, 0x46, 0, 3 << 12); + + if (hp_pin_sense) + msleep(100); + alc_auto_setup_eapd(codec, false); +- snd_hda_shutup_pins(codec); ++ alc_shutup_pins(codec); + alc_write_coef_idx(codec, 0x43, 0x9614); + } + +@@ -3240,14 +3251,15 @@ static void alc256_shutup(struct hda_cod + /* NOTE: call this before clearing the pin, otherwise codec stalls */ + alc_update_coef_idx(codec, 0x46, 0, 3 << 12); + +- snd_hda_codec_write(codec, hp_pin, 0, +- AC_VERB_SET_PIN_WIDGET_CONTROL, 0x0); ++ if (!spec->no_shutup_pins) ++ snd_hda_codec_write(codec, hp_pin, 0, ++ AC_VERB_SET_PIN_WIDGET_CONTROL, 0x0); + + if (hp_pin_sense) + msleep(100); + + alc_auto_setup_eapd(codec, false); +- snd_hda_shutup_pins(codec); ++ alc_shutup_pins(codec); + } + + static void alc225_init(struct hda_codec *codec) +@@ -3334,7 +3346,7 @@ static void alc225_shutup(struct hda_cod + msleep(100); + + alc_auto_setup_eapd(codec, false); +- snd_hda_shutup_pins(codec); ++ alc_shutup_pins(codec); + } + + static void alc_default_init(struct hda_codec *codec) +@@ -3388,14 +3400,15 @@ static void alc_default_shutup(struct hd + if (hp_pin_sense) + msleep(85); + +- snd_hda_codec_write(codec, hp_pin, 0, +- AC_VERB_SET_PIN_WIDGET_CONTROL, 0x0); ++ if (!spec->no_shutup_pins) ++ snd_hda_codec_write(codec, hp_pin, 0, ++ AC_VERB_SET_PIN_WIDGET_CONTROL, 0x0); + + if (hp_pin_sense) + msleep(100); + + alc_auto_setup_eapd(codec, false); +- snd_hda_shutup_pins(codec); ++ alc_shutup_pins(codec); + } + + static void alc294_hp_init(struct hda_codec *codec) +@@ -3412,8 +3425,9 @@ static void alc294_hp_init(struct hda_co + + msleep(100); + +- snd_hda_codec_write(codec, hp_pin, 0, +- AC_VERB_SET_PIN_WIDGET_CONTROL, 0x0); ++ if (!spec->no_shutup_pins) ++ snd_hda_codec_write(codec, hp_pin, 0, ++ AC_VERB_SET_PIN_WIDGET_CONTROL, 0x0); + + alc_update_coef_idx(codec, 0x6f, 0x000f, 0);/* Set HP depop to manual mode */ + alc_update_coefex_idx(codec, 0x58, 0x00, 0x8000, 0x8000); /* HP depop procedure start */ +@@ -5007,16 +5021,12 @@ static void alc_fixup_auto_mute_via_amp( + } + } + +-static void alc_no_shutup(struct hda_codec *codec) +-{ +-} +- + static void alc_fixup_no_shutup(struct hda_codec *codec, + const struct hda_fixup *fix, int action) + { + if (action == HDA_FIXUP_ACT_PRE_PROBE) { + struct alc_spec *spec = codec->spec; +- spec->shutup = alc_no_shutup; ++ spec->no_shutup_pins = 1; + } + } + +@@ -6596,6 +6606,7 @@ static const struct snd_pci_quirk alc269 + SND_PCI_QUIRK(0x1028, 0x0704, "Dell XPS 13 9350", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE), + SND_PCI_QUIRK(0x1028, 0x0706, "Dell Inspiron 7559", ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER), + SND_PCI_QUIRK(0x1028, 0x0725, "Dell Inspiron 3162", ALC255_FIXUP_DELL_SPK_NOISE), ++ SND_PCI_QUIRK(0x1028, 0x0738, "Dell Precision 5820", ALC269_FIXUP_NO_SHUTUP), + SND_PCI_QUIRK(0x1028, 0x075b, "Dell XPS 13 9360", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE), + SND_PCI_QUIRK(0x1028, 0x075c, "Dell XPS 27 7760", ALC298_FIXUP_SPK_VOLUME), + SND_PCI_QUIRK(0x1028, 0x075d, "Dell AIO", ALC298_FIXUP_SPK_VOLUME), diff --git a/queue-4.19/drm-block-fb-changes-for-async-plane-updates.patch b/queue-4.19/drm-block-fb-changes-for-async-plane-updates.patch new file mode 100644 index 00000000000..6bf4ede0665 --- /dev/null +++ b/queue-4.19/drm-block-fb-changes-for-async-plane-updates.patch @@ -0,0 +1,87 @@ +From 25dc194b34dd5919dd07b8873ee338182e15df9d Mon Sep 17 00:00:00 2001 +From: Nicholas Kazlauskas +Date: Mon, 7 Jan 2019 12:41:46 -0500 +Subject: drm: Block fb changes for async plane updates + +From: Nicholas Kazlauskas + +commit 25dc194b34dd5919dd07b8873ee338182e15df9d upstream. + +The prepare_fb call always happens on new_plane_state. + +The drm_atomic_helper_cleanup_planes checks to see if +plane state pointer has changed when deciding to call cleanup_fb on +either the new_plane_state or the old_plane_state. + +For a non-async atomic commit the state pointer is swapped, so this +helper calls prepare_fb on the new_plane_state and cleanup_fb on the +old_plane_state. This makes sense, since we want to prepare the +framebuffer we are going to use and cleanup the the framebuffer we are +no longer using. + +For the async atomic update helpers this differs. The async atomic +update helpers perform in-place updates on the existing state. They call +drm_atomic_helper_cleanup_planes but the state pointer is not swapped. +This means that prepare_fb is called on the new_plane_state and +cleanup_fb is called on the new_plane_state (not the old). + +In the case where old_plane_state->fb == new_plane_state->fb then +there should be no behavioral difference between an async update +and a non-async commit. But there are issues that arise when +old_plane_state->fb != new_plane_state->fb. + +The first is that the new_plane_state->fb is immediately cleaned up +after it has been prepared, so we're using a fb that we shouldn't +be. + +The second occurs during a sequence of async atomic updates and +non-async regular atomic commits. Suppose there are two framebuffers +being interleaved in a double-buffering scenario, fb1 and fb2: + +- Async update, oldfb = NULL, newfb = fb1, prepare fb1, cleanup fb1 +- Async update, oldfb = fb1, newfb = fb2, prepare fb2, cleanup fb2 +- Non-async commit, oldfb = fb2, newfb = fb1, prepare fb1, cleanup fb2 + +We call cleanup_fb on fb2 twice in this example scenario, and any +further use will result in use-after-free. + +The simple fix to this problem is to block framebuffer changes +in the drm_atomic_helper_async_check function for now. + +v2: Move check by itself, add a FIXME (Daniel) + +Cc: Daniel Vetter +Cc: Harry Wentland +Cc: Andrey Grodzovsky +Cc: # v4.14+ +Fixes: fef9df8b5945 ("drm/atomic: initial support for asynchronous plane update") +Signed-off-by: Nicholas Kazlauskas +Acked-by: Andrey Grodzovsky +Acked-by: Harry Wentland +Reviewed-by: Daniel Vetter +Signed-off-by: Harry Wentland +Link: https://patchwork.freedesktop.org/patch/275364/ +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/drm_atomic_helper.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +--- a/drivers/gpu/drm/drm_atomic_helper.c ++++ b/drivers/gpu/drm/drm_atomic_helper.c +@@ -1573,6 +1573,15 @@ int drm_atomic_helper_async_check(struct + if (old_plane_state->fb != new_plane_state->fb) + return -EINVAL; + ++ /* ++ * FIXME: Since prepare_fb and cleanup_fb are always called on ++ * the new_plane_state for async updates we need to block framebuffer ++ * changes. This prevents use of a fb that's been cleaned up and ++ * double cleanups from occuring. ++ */ ++ if (old_plane_state->fb != new_plane_state->fb) ++ return -EINVAL; ++ + funcs = plane->helper_private; + if (!funcs->atomic_async_update) + return -EINVAL; diff --git a/queue-4.19/i40e-report-correct-statistics-when-xdp-is-enabled.patch b/queue-4.19/i40e-report-correct-statistics-when-xdp-is-enabled.patch new file mode 100644 index 00000000000..ee97b9c5259 --- /dev/null +++ b/queue-4.19/i40e-report-correct-statistics-when-xdp-is-enabled.patch @@ -0,0 +1,82 @@ +From cdec2141c24ef177d929765c5a6f95549c266fb3 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Bj=C3=B6rn=20T=C3=B6pel?= +Date: Fri, 24 Aug 2018 13:21:59 +0200 +Subject: i40e: report correct statistics when XDP is enabled +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Björn Töpel + +commit cdec2141c24ef177d929765c5a6f95549c266fb3 upstream. + +When XDP is enabled, the driver will report incorrect +statistics. Received frames will reported as transmitted frames. + +This commits fixes the i40e implementation of ndo_get_stats64 (struct +net_device_ops), so that iproute2 will report correct statistics +(e.g. when running "ip -stats link show dev eth0") even when XDP is +enabled. + +Reported-by: Jesper Dangaard Brouer +Fixes: 74608d17fe29 ("i40e: add support for XDP_TX action") +Signed-off-by: Björn Töpel +Tested-by: Andrew Bowers +Signed-off-by: Jeff Kirsher +Cc: Emeric Brun +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/ethernet/intel/i40e/i40e_main.c | 24 +++++++++++++----------- + 1 file changed, 13 insertions(+), 11 deletions(-) + +--- a/drivers/net/ethernet/intel/i40e/i40e_main.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c +@@ -424,9 +424,9 @@ static void i40e_get_netdev_stats_struct + struct rtnl_link_stats64 *stats) + { + struct i40e_netdev_priv *np = netdev_priv(netdev); +- struct i40e_ring *tx_ring, *rx_ring; + struct i40e_vsi *vsi = np->vsi; + struct rtnl_link_stats64 *vsi_stats = i40e_get_vsi_stats_struct(vsi); ++ struct i40e_ring *ring; + int i; + + if (test_bit(__I40E_VSI_DOWN, vsi->state)) +@@ -440,24 +440,26 @@ static void i40e_get_netdev_stats_struct + u64 bytes, packets; + unsigned int start; + +- tx_ring = READ_ONCE(vsi->tx_rings[i]); +- if (!tx_ring) ++ ring = READ_ONCE(vsi->tx_rings[i]); ++ if (!ring) + continue; +- i40e_get_netdev_stats_struct_tx(tx_ring, stats); ++ i40e_get_netdev_stats_struct_tx(ring, stats); + +- rx_ring = &tx_ring[1]; ++ if (i40e_enabled_xdp_vsi(vsi)) { ++ ring++; ++ i40e_get_netdev_stats_struct_tx(ring, stats); ++ } + ++ ring++; + do { +- start = u64_stats_fetch_begin_irq(&rx_ring->syncp); +- packets = rx_ring->stats.packets; +- bytes = rx_ring->stats.bytes; +- } while (u64_stats_fetch_retry_irq(&rx_ring->syncp, start)); ++ start = u64_stats_fetch_begin_irq(&ring->syncp); ++ packets = ring->stats.packets; ++ bytes = ring->stats.bytes; ++ } while (u64_stats_fetch_retry_irq(&ring->syncp, start)); + + stats->rx_packets += packets; + stats->rx_bytes += bytes; + +- if (i40e_enabled_xdp_vsi(vsi)) +- i40e_get_netdev_stats_struct_tx(&rx_ring[1], stats); + } + rcu_read_unlock(); + diff --git a/queue-4.19/it-s-wrong-to-add-len-to-sector_nr-in-raid10-reshape-twice.patch b/queue-4.19/it-s-wrong-to-add-len-to-sector_nr-in-raid10-reshape-twice.patch new file mode 100644 index 00000000000..1a9af233782 --- /dev/null +++ b/queue-4.19/it-s-wrong-to-add-len-to-sector_nr-in-raid10-reshape-twice.patch @@ -0,0 +1,33 @@ +From b761dcf1217760a42f7897c31dcb649f59b2333e Mon Sep 17 00:00:00 2001 +From: Xiao Ni +Date: Fri, 8 Mar 2019 23:52:05 +0800 +Subject: It's wrong to add len to sector_nr in raid10 reshape twice + +From: Xiao Ni + +commit b761dcf1217760a42f7897c31dcb649f59b2333e upstream. + +In reshape_request it already adds len to sector_nr already. It's wrong to add len to +sector_nr again after adding pages to bio. If there is bad block it can't copy one chunk +at a time, it needs to goto read_more. Now the sector_nr is wrong. It can cause data +corruption. + +Cc: stable@vger.kernel.org # v3.16+ +Signed-off-by: Xiao Ni +Signed-off-by: Song Liu +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/raid10.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/drivers/md/raid10.c ++++ b/drivers/md/raid10.c +@@ -4630,7 +4630,6 @@ read_more: + atomic_inc(&r10_bio->remaining); + read_bio->bi_next = NULL; + generic_make_request(read_bio); +- sector_nr += nr_sectors; + sectors_done += nr_sectors; + if (sector_nr <= last) + goto read_more; diff --git a/queue-4.19/perf-x86-fixup-typo-in-stub-functions.patch b/queue-4.19/perf-x86-fixup-typo-in-stub-functions.patch new file mode 100644 index 00000000000..8b90f1795c1 --- /dev/null +++ b/queue-4.19/perf-x86-fixup-typo-in-stub-functions.patch @@ -0,0 +1,56 @@ +From f764c58b7faa26f5714e6907f892abc2bc0de4f8 Mon Sep 17 00:00:00 2001 +From: Peter Zijlstra +Date: Fri, 15 Mar 2019 09:14:10 +0100 +Subject: perf/x86: Fixup typo in stub functions +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Peter Zijlstra + +commit f764c58b7faa26f5714e6907f892abc2bc0de4f8 upstream. + +Guenter reported a build warning for CONFIG_CPU_SUP_INTEL=n: + + > With allmodconfig-CONFIG_CPU_SUP_INTEL, this patch results in: + > + > In file included from arch/x86/events/amd/core.c:8:0: + > arch/x86/events/amd/../perf_event.h:1036:45: warning: ‘struct cpu_hw_event’ declared inside parameter list will not be visible outside of this definition or declaration + > static inline int intel_cpuc_prepare(struct cpu_hw_event *cpuc, int cpu) + +While harmless (an unsed pointer is an unused pointer, no matter the type) +it needs fixing. + +Reported-by: Guenter Roeck +Signed-off-by: Peter Zijlstra (Intel) +Cc: Greg Kroah-Hartman +Cc: Linus Torvalds +Cc: Peter Zijlstra +Cc: Thomas Gleixner +Cc: stable@vger.kernel.org +Fixes: d01b1f96a82e ("perf/x86/intel: Make cpuc allocations consistent") +Link: http://lkml.kernel.org/r/20190315081410.GR5996@hirez.programming.kicks-ass.net +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/events/perf_event.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/x86/events/perf_event.h ++++ b/arch/x86/events/perf_event.h +@@ -1030,12 +1030,12 @@ static inline int intel_pmu_init(void) + return 0; + } + +-static inline int intel_cpuc_prepare(struct cpu_hw_event *cpuc, int cpu) ++static inline int intel_cpuc_prepare(struct cpu_hw_events *cpuc, int cpu) + { + return 0; + } + +-static inline void intel_cpuc_finish(struct cpu_hw_event *cpuc) ++static inline void intel_cpuc_finish(struct cpu_hw_events *cpuc) + { + } + diff --git a/queue-4.19/perf-x86-intel-fix-memory-corruption.patch b/queue-4.19/perf-x86-intel-fix-memory-corruption.patch new file mode 100644 index 00000000000..d0eded4ab5b --- /dev/null +++ b/queue-4.19/perf-x86-intel-fix-memory-corruption.patch @@ -0,0 +1,50 @@ +From ede271b059463731cbd6dffe55ffd70d7dbe8392 Mon Sep 17 00:00:00 2001 +From: Peter Zijlstra +Date: Thu, 14 Mar 2019 14:01:14 +0100 +Subject: perf/x86/intel: Fix memory corruption + +From: Peter Zijlstra + +commit ede271b059463731cbd6dffe55ffd70d7dbe8392 upstream. + +Through: + + validate_event() + x86_pmu.get_event_constraints(.idx=-1) + tfa_get_event_constraints() + dyn_constraint() + +cpuc->constraint_list[-1] is used, which is an obvious out-of-bound access. + +In this case, simply skip the TFA constraint code, there is no event +constraint with just PMC3, therefore the code will never result in the +empty set. + +Fixes: 400816f60c54 ("perf/x86/intel: Implement support for TSX Force Abort") +Reported-by: Tony Jones +Reported-by: "DSouza, Nelson" +Signed-off-by: Peter Zijlstra (Intel) +Signed-off-by: Thomas Gleixner +Tested-by: Tony Jones +Tested-by: "DSouza, Nelson" +Cc: eranian@google.com +Cc: jolsa@redhat.com +Cc: stable@kernel.org +Link: https://lkml.kernel.org/r/20190314130705.441549378@infradead.org +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/events/intel/core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/x86/events/intel/core.c ++++ b/arch/x86/events/intel/core.c +@@ -3282,7 +3282,7 @@ tfa_get_event_constraints(struct cpu_hw_ + /* + * Without TFA we must not use PMC3. + */ +- if (!allow_tsx_force_abort && test_bit(3, c->idxmsk)) { ++ if (!allow_tsx_force_abort && test_bit(3, c->idxmsk) && idx >= 0) { + c = dyn_constraint(cpuc, c, idx); + c->idxmsk64 &= ~(1ULL << 3); + c->weight--; diff --git a/queue-4.19/perf-x86-intel-make-dev_attr_allow_tsx_force_abort-static.patch b/queue-4.19/perf-x86-intel-make-dev_attr_allow_tsx_force_abort-static.patch new file mode 100644 index 00000000000..7294636c6ef --- /dev/null +++ b/queue-4.19/perf-x86-intel-make-dev_attr_allow_tsx_force_abort-static.patch @@ -0,0 +1,38 @@ +From c634dc6bdedeb0b2c750fc611612618a85639ab2 Mon Sep 17 00:00:00 2001 +From: kbuild test robot +Date: Thu, 14 Mar 2019 02:42:43 +0800 +Subject: perf/x86/intel: Make dev_attr_allow_tsx_force_abort static + +From: kbuild test robot + +commit c634dc6bdedeb0b2c750fc611612618a85639ab2 upstream. + +Fixes: 400816f60c54 ("perf/x86/intel: Implement support for TSX Force Abort") +Signed-off-by: kbuild test robot +Signed-off-by: Thomas Gleixner +Cc: "Peter Zijlstra (Intel)" +Cc: kbuild-all@01.org +Cc: Borislav Petkov +Cc: "H. Peter Anvin" +Cc: Kan Liang +Cc: Jiri Olsa +Cc: Andi Kleen +Cc: stable@vger.kernel.org +Link: https://lkml.kernel.org/r/20190313184243.GA10820@lkp-sb-ep06 +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/events/intel/core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/x86/events/intel/core.c ++++ b/arch/x86/events/intel/core.c +@@ -3989,7 +3989,7 @@ static struct attribute *intel_pmu_caps_ + NULL + }; + +-DEVICE_BOOL_ATTR(allow_tsx_force_abort, 0644, allow_tsx_force_abort); ++static DEVICE_BOOL_ATTR(allow_tsx_force_abort, 0644, allow_tsx_force_abort); + + static struct attribute *intel_pmu_attrs[] = { + &dev_attr_freeze_on_smi.attr, diff --git a/queue-4.19/series b/queue-4.19/series index f1ae16862c2..1ab06954469 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -35,3 +35,18 @@ net-smc-fix-smc_poll-in-smc_init-state.patch missing-barriers-in-some-of-unix_sock-addr-and-path-accesses.patch net-sched-flower-insert-new-filter-to-idr-after-setting-its-mask.patch f2fs-wait-on-atomic-writes-to-count-f2fs_cp_wb_data.patch +perf-x86-fixup-typo-in-stub-functions.patch +alsa-bebob-use-more-identical-mod_alias-for-saffire-pro-10-i-o-against-liquid-saffire-56.patch +alsa-firewire-motu-fix-construction-of-pcm-frame-for-capture-direction.patch +alsa-hda-extend-i915-component-bind-timeout.patch +alsa-hda-add-more-quirks-for-hp-z2-g4-and-hp-z240.patch +alsa-hda-realtek-enable-audio-jacks-of-asus-ux362fa-with-alc294.patch +alsa-hda-realtek-reduce-click-noise-on-dell-precision-5820-headphone.patch +alsa-hda-realtek-enable-headset-mic-of-acer-travelmate-x514-51t-with-alc255.patch +perf-x86-intel-fix-memory-corruption.patch +perf-x86-intel-make-dev_attr_allow_tsx_force_abort-static.patch +it-s-wrong-to-add-len-to-sector_nr-in-raid10-reshape-twice.patch +drm-block-fb-changes-for-async-plane-updates.patch +staging-erofs-fix-race-when-the-managed-cache-is-enabled.patch +i40e-report-correct-statistics-when-xdp-is-enabled.patch +vhost-vsock-fix-vhost-vsock-cid-hashing-inconsistent.patch diff --git a/queue-4.19/staging-erofs-fix-race-when-the-managed-cache-is-enabled.patch b/queue-4.19/staging-erofs-fix-race-when-the-managed-cache-is-enabled.patch new file mode 100644 index 00000000000..f016c70e081 --- /dev/null +++ b/queue-4.19/staging-erofs-fix-race-when-the-managed-cache-is-enabled.patch @@ -0,0 +1,226 @@ +From 51232df5e4b268936beccde5248f312a316800be Mon Sep 17 00:00:00 2001 +From: Gao Xiang +Date: Fri, 23 Nov 2018 01:16:00 +0800 +Subject: staging: erofs: fix race when the managed cache is enabled + +From: Gao Xiang + +commit 51232df5e4b268936beccde5248f312a316800be upstream. + +When the managed cache is enabled, the last reference count +of a workgroup must be used for its workstation. + +Otherwise, it could lead to incorrect (un)freezes in +the reclaim path, and it would be harmful. + +A typical race as follows: + +Thread 1 (In the reclaim path) Thread 2 +workgroup_freeze(grp, 1) refcnt = 1 +... +workgroup_unfreeze(grp, 1) refcnt = 1 + workgroup_get(grp) refcnt = 2 (x) +workgroup_put(grp) refcnt = 1 (x) + ...unexpected behaviors + +* grp is detached but still used, which violates cache-managed + freeze constraint. + +Reviewed-by: Chao Yu +Signed-off-by: Gao Xiang +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/erofs/internal.h | 1 + drivers/staging/erofs/utils.c | 139 ++++++++++++++++++++++++++++----------- + 2 files changed, 101 insertions(+), 39 deletions(-) + +--- a/drivers/staging/erofs/internal.h ++++ b/drivers/staging/erofs/internal.h +@@ -260,6 +260,7 @@ repeat: + } + + #define __erofs_workgroup_get(grp) atomic_inc(&(grp)->refcount) ++#define __erofs_workgroup_put(grp) atomic_dec(&(grp)->refcount) + + extern int erofs_workgroup_put(struct erofs_workgroup *grp); + +--- a/drivers/staging/erofs/utils.c ++++ b/drivers/staging/erofs/utils.c +@@ -87,12 +87,21 @@ int erofs_register_workgroup(struct supe + grp = (void *)((unsigned long)grp | + 1UL << RADIX_TREE_EXCEPTIONAL_SHIFT); + +- err = radix_tree_insert(&sbi->workstn_tree, +- grp->index, grp); ++ /* ++ * Bump up reference count before making this workgroup ++ * visible to other users in order to avoid potential UAF ++ * without serialized by erofs_workstn_lock. ++ */ ++ __erofs_workgroup_get(grp); + +- if (!err) { +- __erofs_workgroup_get(grp); +- } ++ err = radix_tree_insert(&sbi->workstn_tree, ++ grp->index, grp); ++ if (unlikely(err)) ++ /* ++ * it's safe to decrease since the workgroup isn't visible ++ * and refcount >= 2 (cannot be freezed). ++ */ ++ __erofs_workgroup_put(grp); + + erofs_workstn_unlock(sbi); + radix_tree_preload_end(); +@@ -101,19 +110,99 @@ int erofs_register_workgroup(struct supe + + extern void erofs_workgroup_free_rcu(struct erofs_workgroup *grp); + ++static void __erofs_workgroup_free(struct erofs_workgroup *grp) ++{ ++ atomic_long_dec(&erofs_global_shrink_cnt); ++ erofs_workgroup_free_rcu(grp); ++} ++ + int erofs_workgroup_put(struct erofs_workgroup *grp) + { + int count = atomic_dec_return(&grp->refcount); + + if (count == 1) + atomic_long_inc(&erofs_global_shrink_cnt); +- else if (!count) { +- atomic_long_dec(&erofs_global_shrink_cnt); +- erofs_workgroup_free_rcu(grp); +- } ++ else if (!count) ++ __erofs_workgroup_free(grp); + return count; + } + ++#ifdef EROFS_FS_HAS_MANAGED_CACHE ++/* for cache-managed case, customized reclaim paths exist */ ++static void erofs_workgroup_unfreeze_final(struct erofs_workgroup *grp) ++{ ++ erofs_workgroup_unfreeze(grp, 0); ++ __erofs_workgroup_free(grp); ++} ++ ++bool erofs_try_to_release_workgroup(struct erofs_sb_info *sbi, ++ struct erofs_workgroup *grp, ++ bool cleanup) ++{ ++ void *entry; ++ ++ /* ++ * for managed cache enabled, the refcount of workgroups ++ * themselves could be < 0 (freezed). So there is no guarantee ++ * that all refcount > 0 if managed cache is enabled. ++ */ ++ if (!erofs_workgroup_try_to_freeze(grp, 1)) ++ return false; ++ ++ /* ++ * note that all cached pages should be unlinked ++ * before delete it from the radix tree. ++ * Otherwise some cached pages of an orphan old workgroup ++ * could be still linked after the new one is available. ++ */ ++ if (erofs_try_to_free_all_cached_pages(sbi, grp)) { ++ erofs_workgroup_unfreeze(grp, 1); ++ return false; ++ } ++ ++ /* ++ * it is impossible to fail after the workgroup is freezed, ++ * however in order to avoid some race conditions, add a ++ * DBG_BUGON to observe this in advance. ++ */ ++ entry = radix_tree_delete(&sbi->workstn_tree, grp->index); ++ DBG_BUGON((void *)((unsigned long)entry & ++ ~RADIX_TREE_EXCEPTIONAL_ENTRY) != grp); ++ ++ /* ++ * if managed cache is enable, the last refcount ++ * should indicate the related workstation. ++ */ ++ erofs_workgroup_unfreeze_final(grp); ++ return true; ++} ++ ++#else ++/* for nocache case, no customized reclaim path at all */ ++bool erofs_try_to_release_workgroup(struct erofs_sb_info *sbi, ++ struct erofs_workgroup *grp, ++ bool cleanup) ++{ ++ int cnt = atomic_read(&grp->refcount); ++ void *entry; ++ ++ DBG_BUGON(cnt <= 0); ++ DBG_BUGON(cleanup && cnt != 1); ++ ++ if (cnt > 1) ++ return false; ++ ++ entry = radix_tree_delete(&sbi->workstn_tree, grp->index); ++ DBG_BUGON((void *)((unsigned long)entry & ++ ~RADIX_TREE_EXCEPTIONAL_ENTRY) != grp); ++ ++ /* (rarely) could be grabbed again when freeing */ ++ erofs_workgroup_put(grp); ++ return true; ++} ++ ++#endif ++ + unsigned long erofs_shrink_workstation(struct erofs_sb_info *sbi, + unsigned long nr_shrink, + bool cleanup) +@@ -130,43 +219,15 @@ repeat: + batch, first_index, PAGEVEC_SIZE); + + for (i = 0; i < found; ++i) { +- int cnt; + struct erofs_workgroup *grp = (void *) + ((unsigned long)batch[i] & + ~RADIX_TREE_EXCEPTIONAL_ENTRY); + + first_index = grp->index + 1; + +- cnt = atomic_read(&grp->refcount); +- BUG_ON(cnt <= 0); +- +- if (cleanup) +- BUG_ON(cnt != 1); +- +-#ifndef EROFS_FS_HAS_MANAGED_CACHE +- else if (cnt > 1) +-#else +- if (!erofs_workgroup_try_to_freeze(grp, 1)) +-#endif +- continue; +- +- if (radix_tree_delete(&sbi->workstn_tree, +- grp->index) != grp) { +-#ifdef EROFS_FS_HAS_MANAGED_CACHE +-skip: +- erofs_workgroup_unfreeze(grp, 1); +-#endif ++ /* try to shrink each valid workgroup */ ++ if (!erofs_try_to_release_workgroup(sbi, grp, cleanup)) + continue; +- } +- +-#ifdef EROFS_FS_HAS_MANAGED_CACHE +- if (erofs_try_to_free_all_cached_pages(sbi, grp)) +- goto skip; +- +- erofs_workgroup_unfreeze(grp, 1); +-#endif +- /* (rarely) grabbed again when freeing */ +- erofs_workgroup_put(grp); + + ++freed; + if (unlikely(!--nr_shrink)) diff --git a/queue-4.19/vhost-vsock-fix-vhost-vsock-cid-hashing-inconsistent.patch b/queue-4.19/vhost-vsock-fix-vhost-vsock-cid-hashing-inconsistent.patch new file mode 100644 index 00000000000..3874078ae7d --- /dev/null +++ b/queue-4.19/vhost-vsock-fix-vhost-vsock-cid-hashing-inconsistent.patch @@ -0,0 +1,59 @@ +From 7fbe078c37aba3088359c9256c1a1d0c3e39ee81 Mon Sep 17 00:00:00 2001 +From: Zha Bin +Date: Tue, 8 Jan 2019 16:07:03 +0800 +Subject: vhost/vsock: fix vhost vsock cid hashing inconsistent + +From: Zha Bin + +commit 7fbe078c37aba3088359c9256c1a1d0c3e39ee81 upstream. + +The vsock core only supports 32bit CID, but the Virtio-vsock spec define +CID (dst_cid and src_cid) as u64 and the upper 32bits is reserved as +zero. This inconsistency causes one bug in vhost vsock driver. The +scenarios is: + + 0. A hash table (vhost_vsock_hash) is used to map an CID to a vsock + object. And hash_min() is used to compute the hash key. hash_min() is + defined as: + (sizeof(val) <= 4 ? hash_32(val, bits) : hash_long(val, bits)). + That means the hash algorithm has dependency on the size of macro + argument 'val'. + 0. In function vhost_vsock_set_cid(), a 64bit CID is passed to + hash_min() to compute the hash key when inserting a vsock object into + the hash table. + 0. In function vhost_vsock_get(), a 32bit CID is passed to hash_min() + to compute the hash key when looking up a vsock for an CID. + +Because the different size of the CID, hash_min() returns different hash +key, thus fails to look up the vsock object for an CID. + +To fix this bug, we keep CID as u64 in the IOCTLs and virtio message +headers, but explicitly convert u64 to u32 when deal with the hash table +and vsock core. + +Fixes: 834e772c8db0 ("vhost/vsock: fix use-after-free in network stack callers") +Link: https://github.com/stefanha/virtio/blob/vsock/trunk/content.tex +Signed-off-by: Zha Bin +Reviewed-by: Liu Jiang +Reviewed-by: Stefan Hajnoczi +Acked-by: Jason Wang +Signed-off-by: David S. Miller +Signed-off-by: Shengjing Zhu +Signed-off-by: Greg Kroah-Hartman + + +--- + drivers/vhost/vsock.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/vhost/vsock.c ++++ b/drivers/vhost/vsock.c +@@ -642,7 +642,7 @@ static int vhost_vsock_set_cid(struct vh + hash_del_rcu(&vsock->hash); + + vsock->guest_cid = guest_cid; +- hash_add_rcu(vhost_vsock_hash, &vsock->hash, guest_cid); ++ hash_add_rcu(vhost_vsock_hash, &vsock->hash, vsock->guest_cid); + spin_unlock_bh(&vhost_vsock_lock); + + return 0;