From: Greg Kroah-Hartman Date: Sat, 1 Aug 2020 11:47:35 +0000 (+0200) Subject: 5.7-stable patches X-Git-Tag: v5.7.13~58 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=86d1fa00540e5dc6cfc5285018958ef6da834fb4;p=thirdparty%2Fkernel%2Fstable-queue.git 5.7-stable patches added patches: 9p-trans_fd-fix-concurrency-del-of-req_list-in-p9_fd_cancelled-p9_read_work.patch alsa-hda-hdmi-fix-keep_power-assignment-for-non-component-devices.patch alsa-hda-realtek-enable-headset-mic-of-asus-rog-zephyrus-g15-ga502-series-with-alc289.patch alsa-hda-realtek-fix-add-a-ultra_low_power-function-for-intel-reference-board-alc256.patch alsa-hda-realtek-fixed-hp-right-speaker-no-sound.patch alsa-hda-realtek-typo_fix-enable-headset-mic-of-asus-rog-zephyrus-g14-ga401-series-with-alc289.patch alsa-hda-workaround-for-spurious-wakeups-on-some-intel-platforms.patch alsa-usb-audio-add-implicit-feedback-quirk-for-ssl2.patch ib-rdmavt-fix-rq-counting-issues-causing-use-of-an-invalid-rwqe.patch rdma-mlx5-fix-prefetch-memory-leak-if-get_prefetchable_mr-fails.patch revert-1320a4052ea1-audit-trigger-accompanying-records-when-no-rules-present.patch vhost-scsi-fix-up-req-type-endian-ness.patch --- diff --git a/queue-5.7/9p-trans_fd-fix-concurrency-del-of-req_list-in-p9_fd_cancelled-p9_read_work.patch b/queue-5.7/9p-trans_fd-fix-concurrency-del-of-req_list-in-p9_fd_cancelled-p9_read_work.patch new file mode 100644 index 00000000000..8b16ed4e664 --- /dev/null +++ b/queue-5.7/9p-trans_fd-fix-concurrency-del-of-req_list-in-p9_fd_cancelled-p9_read_work.patch @@ -0,0 +1,64 @@ +From 74d6a5d5662975aed7f25952f62efbb6f6dadd29 Mon Sep 17 00:00:00 2001 +From: Wang Hai +Date: Fri, 12 Jun 2020 17:08:33 +0800 +Subject: 9p/trans_fd: Fix concurrency del of req_list in p9_fd_cancelled/p9_read_work + +From: Wang Hai + +commit 74d6a5d5662975aed7f25952f62efbb6f6dadd29 upstream. + +p9_read_work and p9_fd_cancelled may be called concurrently. +In some cases, req->req_list may be deleted by both p9_read_work +and p9_fd_cancelled. + +We can fix it by ignoring replies associated with a cancelled +request and ignoring cancelled request if message has been received +before lock. + +Link: http://lkml.kernel.org/r/20200612090833.36149-1-wanghai38@huawei.com +Fixes: 60ff779c4abb ("9p: client: remove unused code and any reference to "cancelled" function") +Cc: # v3.12+ +Reported-by: syzbot+77a25acfa0382e06ab23@syzkaller.appspotmail.com +Signed-off-by: Wang Hai +Signed-off-by: Dominique Martinet +Signed-off-by: Greg Kroah-Hartman + +--- + net/9p/trans_fd.c | 15 ++++++++++++++- + 1 file changed, 14 insertions(+), 1 deletion(-) + +--- a/net/9p/trans_fd.c ++++ b/net/9p/trans_fd.c +@@ -362,6 +362,10 @@ static void p9_read_work(struct work_str + if (m->rreq->status == REQ_STATUS_SENT) { + list_del(&m->rreq->req_list); + p9_client_cb(m->client, m->rreq, REQ_STATUS_RCVD); ++ } else if (m->rreq->status == REQ_STATUS_FLSHD) { ++ /* Ignore replies associated with a cancelled request. */ ++ p9_debug(P9_DEBUG_TRANS, ++ "Ignore replies associated with a cancelled request\n"); + } else { + spin_unlock(&m->client->lock); + p9_debug(P9_DEBUG_ERROR, +@@ -703,11 +707,20 @@ static int p9_fd_cancelled(struct p9_cli + { + p9_debug(P9_DEBUG_TRANS, "client %p req %p\n", client, req); + ++ spin_lock(&client->lock); ++ /* Ignore cancelled request if message has been received ++ * before lock. ++ */ ++ if (req->status == REQ_STATUS_RCVD) { ++ spin_unlock(&client->lock); ++ return 0; ++ } ++ + /* we haven't received a response for oldreq, + * remove it from the list. + */ +- spin_lock(&client->lock); + list_del(&req->req_list); ++ req->status = REQ_STATUS_FLSHD; + spin_unlock(&client->lock); + p9_req_put(req); + diff --git a/queue-5.7/alsa-hda-hdmi-fix-keep_power-assignment-for-non-component-devices.patch b/queue-5.7/alsa-hda-hdmi-fix-keep_power-assignment-for-non-component-devices.patch new file mode 100644 index 00000000000..21524680e3c --- /dev/null +++ b/queue-5.7/alsa-hda-hdmi-fix-keep_power-assignment-for-non-component-devices.patch @@ -0,0 +1,56 @@ +From c2c3657f0aedb8736a0fb7b2b1985adfb86e7802 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Tue, 28 Jul 2020 10:20:33 +0200 +Subject: ALSA: hda/hdmi: Fix keep_power assignment for non-component devices + +From: Takashi Iwai + +commit c2c3657f0aedb8736a0fb7b2b1985adfb86e7802 upstream. + +It's been reported that, when neither nouveau nor Nvidia graphics +driver is used, the screen starts flickering. And, after comparing +between the working case (stable 4.4.x) and the broken case, it turned +out that the problem comes from the audio component binding. The +Nvidia and AMD audio binding code clears the bus->keep_power flag +whenever snd_hdac_acomp_init() succeeds. But this doesn't mean that +the component is actually bound, but it merely indicates that it's +ready for binding. So, when both nouveau and Nvidia are blacklisted +or not ready, the driver keeps running without the audio component but +also with bus->keep_power = false. This made the driver runtime PM +kicked in and powering down when unused, which results in flickering +in the graphics side, as it seems. + +For fixing the bug, this patch moves the bus->keep_power flag change +into generic_acomp_notifier_set() that is the function called from the +master_bind callback of component ops; i.e. it's guaranteed that the +binding succeeded. + +BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=208609 +Fixes: 5a858e79c911 ("ALSA: hda - Disable audio component for legacy Nvidia HDMI codecs") +Cc: +Link: https://lore.kernel.org/r/20200728082033.23933-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_hdmi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/pci/hda/patch_hdmi.c ++++ b/sound/pci/hda/patch_hdmi.c +@@ -2439,6 +2439,7 @@ static void generic_acomp_notifier_set(s + mutex_lock(&spec->bind_lock); + spec->use_acomp_notifier = use_acomp; + spec->codec->relaxed_resume = use_acomp; ++ spec->codec->bus->keep_power = 0; + /* reprogram each jack detection logic depending on the notifier */ + for (i = 0; i < spec->num_pins; i++) + reprogram_jack_detect(spec->codec, +@@ -2533,7 +2534,6 @@ static void generic_acomp_init(struct hd + if (!snd_hdac_acomp_init(&codec->bus->core, &spec->drm_audio_ops, + match_bound_vga, 0)) { + spec->acomp_registered = true; +- codec->bus->keep_power = 0; + } + } + diff --git a/queue-5.7/alsa-hda-realtek-enable-headset-mic-of-asus-rog-zephyrus-g15-ga502-series-with-alc289.patch b/queue-5.7/alsa-hda-realtek-enable-headset-mic-of-asus-rog-zephyrus-g15-ga502-series-with-alc289.patch new file mode 100644 index 00000000000..f1a7e14b5b7 --- /dev/null +++ b/queue-5.7/alsa-hda-realtek-enable-headset-mic-of-asus-rog-zephyrus-g15-ga502-series-with-alc289.patch @@ -0,0 +1,57 @@ +From 4b43d05a1978a93a19374c6e6b817c9c1ff4ba4b Mon Sep 17 00:00:00 2001 +From: Armas Spann +Date: Fri, 24 Jul 2020 16:06:16 +0200 +Subject: ALSA: hda/realtek: enable headset mic of ASUS ROG Zephyrus G15(GA502) series with ALC289 + +From: Armas Spann + +commit 4b43d05a1978a93a19374c6e6b817c9c1ff4ba4b upstream. + +This patch adds support for headset mic to the ASUS ROG Zephyrus +G15(GA502) notebook series by adding the corresponding +vendor/pci_device id, as well as adding a new fixup for the used +realtek ALC289. The fixup stets the correct pin to get the headset mic +correctly recognized on audio-jack. + +Signed-off-by: Armas Spann +Cc: +Link: https://lore.kernel.org/r/20200724140616.298892-1-zappel@retarded.farm +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_realtek.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -6118,6 +6118,7 @@ enum { + ALC269VC_FIXUP_ACER_HEADSET_MIC, + ALC269VC_FIXUP_ACER_MIC_NO_PRESENCE, + ALC289_FIXUP_ASUS_G401, ++ ALC289_FIXUP_ASUS_GA502, + ALC256_FIXUP_ACER_MIC_NO_PRESENCE, + }; + +@@ -7335,6 +7336,13 @@ static const struct hda_fixup alc269_fix + { } + }, + }, ++ [ALC289_FIXUP_ASUS_GA502] = { ++ .type = HDA_FIXUP_PINS, ++ .v.pins = (const struct hda_pintbl[]) { ++ { 0x19, 0x03a11020 }, /* headset mic with jack detect */ ++ { } ++ }, ++ }, + [ALC256_FIXUP_ACER_MIC_NO_PRESENCE] = { + .type = HDA_FIXUP_PINS, + .v.pins = (const struct hda_pintbl[]) { +@@ -7526,6 +7534,7 @@ static const struct snd_pci_quirk alc269 + SND_PCI_QUIRK(0x1043, 0x1bbd, "ASUS Z550MA", ALC255_FIXUP_ASUS_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1043, 0x1c23, "Asus X55U", ALC269_FIXUP_LIMIT_INT_MIC_BOOST), + SND_PCI_QUIRK(0x1043, 0x1ccd, "ASUS X555UB", ALC256_FIXUP_ASUS_MIC), ++ SND_PCI_QUIRK(0x1043, 0x1e11, "ASUS Zephyrus G15", ALC289_FIXUP_ASUS_GA502), + SND_PCI_QUIRK(0x1043, 0x1f11, "ASUS Zephyrus G14", ALC289_FIXUP_ASUS_G401), + SND_PCI_QUIRK(0x1043, 0x3030, "ASUS ZN270IE", ALC256_FIXUP_ASUS_AIO_GPIO2), + SND_PCI_QUIRK(0x1043, 0x831a, "ASUS P901", ALC269_FIXUP_STEREO_DMIC), diff --git a/queue-5.7/alsa-hda-realtek-fix-add-a-ultra_low_power-function-for-intel-reference-board-alc256.patch b/queue-5.7/alsa-hda-realtek-fix-add-a-ultra_low_power-function-for-intel-reference-board-alc256.patch new file mode 100644 index 00000000000..5b123739615 --- /dev/null +++ b/queue-5.7/alsa-hda-realtek-fix-add-a-ultra_low_power-function-for-intel-reference-board-alc256.patch @@ -0,0 +1,32 @@ +From 6fa38ef1534e7e9320aa15e329eb1404ab2f70ac Mon Sep 17 00:00:00 2001 +From: PeiSen Hou +Date: Mon, 27 Jul 2020 13:56:47 +0200 +Subject: ALSA: hda/realtek: Fix add a "ultra_low_power" function for intel reference board (alc256) + +From: PeiSen Hou + +commit 6fa38ef1534e7e9320aa15e329eb1404ab2f70ac upstream. + +Intel requires to enable power saving mode for intel reference board (alc256) + +Signed-off-by: PeiSen Hou +Cc: +Link: https://lore.kernel.org/r/20200727115647.10967-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_realtek.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -7555,7 +7555,7 @@ static const struct snd_pci_quirk alc269 + SND_PCI_QUIRK(0x10cf, 0x1629, "Lifebook U7x7", ALC255_FIXUP_LIFEBOOK_U7x7_HEADSET_MIC), + SND_PCI_QUIRK(0x10cf, 0x1845, "Lifebook U904", ALC269_FIXUP_LIFEBOOK_EXTMIC), + SND_PCI_QUIRK(0x10ec, 0x10f2, "Intel Reference board", ALC700_FIXUP_INTEL_REFERENCE), +- SND_PCI_QUIRK(0x10ec, 0x1230, "Intel Reference board", ALC225_FIXUP_HEADSET_JACK), ++ SND_PCI_QUIRK(0x10ec, 0x1230, "Intel Reference board", ALC295_FIXUP_CHROME_BOOK), + SND_PCI_QUIRK(0x10f7, 0x8338, "Panasonic CF-SZ6", ALC269_FIXUP_HEADSET_MODE), + SND_PCI_QUIRK(0x144d, 0xc109, "Samsung Ativ book 9 (NP900X3G)", ALC269_FIXUP_INV_DMIC), + SND_PCI_QUIRK(0x144d, 0xc169, "Samsung Notebook 9 Pen (NP930SBE-K01US)", ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET), diff --git a/queue-5.7/alsa-hda-realtek-fixed-hp-right-speaker-no-sound.patch b/queue-5.7/alsa-hda-realtek-fixed-hp-right-speaker-no-sound.patch new file mode 100644 index 00000000000..787c91f67b7 --- /dev/null +++ b/queue-5.7/alsa-hda-realtek-fixed-hp-right-speaker-no-sound.patch @@ -0,0 +1,72 @@ +From 5649625344fe1f4695eace7c37d011e317bf66d5 Mon Sep 17 00:00:00 2001 +From: Kailang Yang +Date: Wed, 29 Jul 2020 15:09:27 +0800 +Subject: ALSA: hda/realtek - Fixed HP right speaker no sound + +From: Kailang Yang + +commit 5649625344fe1f4695eace7c37d011e317bf66d5 upstream. + +HP NB right speaker had no sound output. +This platform was connected to I2S Amp for speaker out.(None Realtek I2S Amp IC) +EC need to check codec GPIO1 pin to initial I2S Amp. + +Signed-off-by: Kailang Yang +Cc: +Link: https://lore.kernel.org/r/01285f623ac7447187482fb4a8ecaa7c@realtek.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_realtek.c | 19 ++++++++++++++++++- + 1 file changed, 18 insertions(+), 1 deletion(-) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -5940,6 +5940,16 @@ static void alc_fixup_disable_mic_vref(s + snd_hda_codec_set_pin_target(codec, 0x19, PIN_VREFHIZ); + } + ++static void alc285_fixup_hp_gpio_amp_init(struct hda_codec *codec, ++ const struct hda_fixup *fix, int action) ++{ ++ if (action != HDA_FIXUP_ACT_INIT) ++ return; ++ ++ msleep(100); ++ alc_write_coef_idx(codec, 0x65, 0x0); ++} ++ + /* for hda_fixup_thinkpad_acpi() */ + #include "thinkpad_helper.c" + +@@ -6120,6 +6130,7 @@ enum { + ALC289_FIXUP_ASUS_GA401, + ALC289_FIXUP_ASUS_GA502, + ALC256_FIXUP_ACER_MIC_NO_PRESENCE, ++ ALC285_FIXUP_HP_GPIO_AMP_INIT, + }; + + static const struct hda_fixup alc269_fixups[] = { +@@ -7352,6 +7363,12 @@ static const struct hda_fixup alc269_fix + .chained = true, + .chain_id = ALC256_FIXUP_ASUS_HEADSET_MODE + }, ++ [ALC285_FIXUP_HP_GPIO_AMP_INIT] = { ++ .type = HDA_FIXUP_FUNC, ++ .v.func = alc285_fixup_hp_gpio_amp_init, ++ .chained = true, ++ .chain_id = ALC285_FIXUP_HP_GPIO_LED ++ }, + }; + + static const struct snd_pci_quirk alc269_fixup_tbl[] = { +@@ -7502,7 +7519,7 @@ static const struct snd_pci_quirk alc269 + SND_PCI_QUIRK(0x103c, 0x84e7, "HP Pavilion 15", ALC269_FIXUP_HP_MUTE_LED_MIC3), + SND_PCI_QUIRK(0x103c, 0x869d, "HP", ALC236_FIXUP_HP_MUTE_LED), + SND_PCI_QUIRK(0x103c, 0x8729, "HP", ALC285_FIXUP_HP_GPIO_LED), +- SND_PCI_QUIRK(0x103c, 0x8736, "HP", ALC285_FIXUP_HP_GPIO_LED), ++ SND_PCI_QUIRK(0x103c, 0x8736, "HP", ALC285_FIXUP_HP_GPIO_AMP_INIT), + SND_PCI_QUIRK(0x103c, 0x877a, "HP", ALC285_FIXUP_HP_MUTE_LED), + SND_PCI_QUIRK(0x103c, 0x877d, "HP", ALC236_FIXUP_HP_MUTE_LED), + SND_PCI_QUIRK(0x1043, 0x103e, "ASUS X540SA", ALC256_FIXUP_ASUS_MIC), diff --git a/queue-5.7/alsa-hda-realtek-typo_fix-enable-headset-mic-of-asus-rog-zephyrus-g14-ga401-series-with-alc289.patch b/queue-5.7/alsa-hda-realtek-typo_fix-enable-headset-mic-of-asus-rog-zephyrus-g14-ga401-series-with-alc289.patch new file mode 100644 index 00000000000..944759c6a2f --- /dev/null +++ b/queue-5.7/alsa-hda-realtek-typo_fix-enable-headset-mic-of-asus-rog-zephyrus-g14-ga401-series-with-alc289.patch @@ -0,0 +1,51 @@ +From 293a92c1d9913248b9987b68f3a5d6d2f0aae62b Mon Sep 17 00:00:00 2001 +From: Armas Spann +Date: Fri, 24 Jul 2020 16:08:37 +0200 +Subject: ALSA: hda/realtek: typo_fix: enable headset mic of ASUS ROG Zephyrus G14(GA401) series with ALC289 + +From: Armas Spann + +commit 293a92c1d9913248b9987b68f3a5d6d2f0aae62b upstream. + +This patch fixes a small typo I accidently submitted with the initial patch. The board should be named GA401 not G401. + +Fixes: ff53664daff2 ("ALSA: hda/realtek: enable headset mic of ASUS ROG Zephyrus G14(G401) series with ALC289") +Signed-off-by: Armas Spann +Cc: +Link: https://lore.kernel.org/r/20200724140837.302763-1-zappel@retarded.farm +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_realtek.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -6117,7 +6117,7 @@ enum { + ALC269VC_FIXUP_ACER_VCOPPERBOX_PINS, + ALC269VC_FIXUP_ACER_HEADSET_MIC, + ALC269VC_FIXUP_ACER_MIC_NO_PRESENCE, +- ALC289_FIXUP_ASUS_G401, ++ ALC289_FIXUP_ASUS_GA401, + ALC289_FIXUP_ASUS_GA502, + ALC256_FIXUP_ACER_MIC_NO_PRESENCE, + }; +@@ -7329,7 +7329,7 @@ static const struct hda_fixup alc269_fix + .chained = true, + .chain_id = ALC269_FIXUP_HEADSET_MIC + }, +- [ALC289_FIXUP_ASUS_G401] = { ++ [ALC289_FIXUP_ASUS_GA401] = { + .type = HDA_FIXUP_PINS, + .v.pins = (const struct hda_pintbl[]) { + { 0x19, 0x03a11020 }, /* headset mic with jack detect */ +@@ -7535,7 +7535,7 @@ static const struct snd_pci_quirk alc269 + SND_PCI_QUIRK(0x1043, 0x1c23, "Asus X55U", ALC269_FIXUP_LIMIT_INT_MIC_BOOST), + SND_PCI_QUIRK(0x1043, 0x1ccd, "ASUS X555UB", ALC256_FIXUP_ASUS_MIC), + SND_PCI_QUIRK(0x1043, 0x1e11, "ASUS Zephyrus G15", ALC289_FIXUP_ASUS_GA502), +- SND_PCI_QUIRK(0x1043, 0x1f11, "ASUS Zephyrus G14", ALC289_FIXUP_ASUS_G401), ++ SND_PCI_QUIRK(0x1043, 0x1f11, "ASUS Zephyrus G14", ALC289_FIXUP_ASUS_GA401), + SND_PCI_QUIRK(0x1043, 0x3030, "ASUS ZN270IE", ALC256_FIXUP_ASUS_AIO_GPIO2), + SND_PCI_QUIRK(0x1043, 0x831a, "ASUS P901", ALC269_FIXUP_STEREO_DMIC), + SND_PCI_QUIRK(0x1043, 0x834a, "ASUS S101", ALC269_FIXUP_STEREO_DMIC), diff --git a/queue-5.7/alsa-hda-workaround-for-spurious-wakeups-on-some-intel-platforms.patch b/queue-5.7/alsa-hda-workaround-for-spurious-wakeups-on-some-intel-platforms.patch new file mode 100644 index 00000000000..fc884d1b72f --- /dev/null +++ b/queue-5.7/alsa-hda-workaround-for-spurious-wakeups-on-some-intel-platforms.patch @@ -0,0 +1,87 @@ +From a6630529aecb5a3e84370c376ed658e892e6261e Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Mon, 27 Jul 2020 18:44:43 +0200 +Subject: ALSA: hda: Workaround for spurious wakeups on some Intel platforms + +From: Takashi Iwai + +commit a6630529aecb5a3e84370c376ed658e892e6261e upstream. + +We've received a regression report on Intel HD-audio controller that +wakes up immediately after S3 suspend. The bisection leads to the +commit c4c8dd6ef807 ("ALSA: hda: Skip controller resume if not +needed"). This commit replaces the system-suspend to use +pm_runtime_force_suspend() instead of the direct call of +__azx_runtime_suspend(). However, by some really mysterious reason, +pm_runtime_force_suspend() causes a spurious wakeup (although it calls +the same __azx_runtime_suspend() internally). + +As an ugly workaround for now, revert the behavior to call +__azx_runtime_suspend() and __azx_runtime_resume() for those old Intel +platforms that may exhibit such a problem, while keeping the new +standard pm_runtime_force_suspend() and pm_runtime_force_resume() +pair for the remaining chips. + +Fixes: c4c8dd6ef807 ("ALSA: hda: Skip controller resume if not needed") +BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=208649 +Cc: +Link: https://lore.kernel.org/r/20200727164443.4233-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/hda_controller.h | 2 +- + sound/pci/hda/hda_intel.c | 17 ++++++++++++++--- + 2 files changed, 15 insertions(+), 4 deletions(-) + +--- a/sound/pci/hda/hda_controller.h ++++ b/sound/pci/hda/hda_controller.h +@@ -41,7 +41,7 @@ + /* 24 unused */ + #define AZX_DCAPS_COUNT_LPIB_DELAY (1 << 25) /* Take LPIB as delay */ + #define AZX_DCAPS_PM_RUNTIME (1 << 26) /* runtime PM support */ +-/* 27 unused */ ++#define AZX_DCAPS_SUSPEND_SPURIOUS_WAKEUP (1 << 27) /* Workaround for spurious wakeups after suspend */ + #define AZX_DCAPS_CORBRP_SELF_CLEAR (1 << 28) /* CORBRP clears itself after reset */ + #define AZX_DCAPS_NO_MSI64 (1 << 29) /* Stick to 32-bit MSIs */ + #define AZX_DCAPS_SEPARATE_STREAM_TAG (1 << 30) /* capture and playback use separate stream tag */ +--- a/sound/pci/hda/hda_intel.c ++++ b/sound/pci/hda/hda_intel.c +@@ -298,7 +298,8 @@ enum { + /* PCH for HSW/BDW; with runtime PM */ + /* no i915 binding for this as HSW/BDW has another controller for HDMI */ + #define AZX_DCAPS_INTEL_PCH \ +- (AZX_DCAPS_INTEL_PCH_BASE | AZX_DCAPS_PM_RUNTIME) ++ (AZX_DCAPS_INTEL_PCH_BASE | AZX_DCAPS_PM_RUNTIME |\ ++ AZX_DCAPS_SUSPEND_SPURIOUS_WAKEUP) + + /* HSW HDMI */ + #define AZX_DCAPS_INTEL_HASWELL \ +@@ -1028,7 +1029,14 @@ static int azx_suspend(struct device *de + chip = card->private_data; + bus = azx_bus(chip); + snd_power_change_state(card, SNDRV_CTL_POWER_D3hot); +- pm_runtime_force_suspend(dev); ++ /* An ugly workaround: direct call of __azx_runtime_suspend() and ++ * __azx_runtime_resume() for old Intel platforms that suffer from ++ * spurious wakeups after S3 suspend ++ */ ++ if (chip->driver_caps & AZX_DCAPS_SUSPEND_SPURIOUS_WAKEUP) ++ __azx_runtime_suspend(chip); ++ else ++ pm_runtime_force_suspend(dev); + if (bus->irq >= 0) { + free_irq(bus->irq, chip); + bus->irq = -1; +@@ -1057,7 +1065,10 @@ static int azx_resume(struct device *dev + if (azx_acquire_irq(chip, 1) < 0) + return -EIO; + +- pm_runtime_force_resume(dev); ++ if (chip->driver_caps & AZX_DCAPS_SUSPEND_SPURIOUS_WAKEUP) ++ __azx_runtime_resume(chip, false); ++ else ++ pm_runtime_force_resume(dev); + snd_power_change_state(card, SNDRV_CTL_POWER_D0); + + trace_azx_resume(chip); diff --git a/queue-5.7/alsa-usb-audio-add-implicit-feedback-quirk-for-ssl2.patch b/queue-5.7/alsa-usb-audio-add-implicit-feedback-quirk-for-ssl2.patch new file mode 100644 index 00000000000..f1da3a7c096 --- /dev/null +++ b/queue-5.7/alsa-usb-audio-add-implicit-feedback-quirk-for-ssl2.patch @@ -0,0 +1,33 @@ +From 3da87ec67a491b9633a82045896c076b794bf938 Mon Sep 17 00:00:00 2001 +From: Laurence Tratt +Date: Sun, 21 Jun 2020 08:50:05 +0100 +Subject: ALSA: usb-audio: Add implicit feedback quirk for SSL2 + +From: Laurence Tratt + +commit 3da87ec67a491b9633a82045896c076b794bf938 upstream. + +As expected, this requires the same quirk as the SSL2+ in order for the +clock to sync. This was suggested by, and tested on an SSL2, by Dmitry. + +Suggested-by: Dmitry +Signed-off-by: Laurence Tratt +Cc: +Link: https://lore.kernel.org/r/20200621075005.52mjjfc6dtdjnr3h@overdrive.tratt.net +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/usb/pcm.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/usb/pcm.c ++++ b/sound/usb/pcm.c +@@ -367,6 +367,7 @@ static int set_sync_ep_implicit_fb_quirk + ifnum = 0; + goto add_sync_ep_from_ifnum; + case USB_ID(0x07fd, 0x0008): /* MOTU M Series */ ++ case USB_ID(0x31e9, 0x0001): /* Solid State Logic SSL2 */ + case USB_ID(0x31e9, 0x0002): /* Solid State Logic SSL2+ */ + case USB_ID(0x0d9a, 0x00df): /* RTX6001 */ + ep = 0x81; diff --git a/queue-5.7/ib-rdmavt-fix-rq-counting-issues-causing-use-of-an-invalid-rwqe.patch b/queue-5.7/ib-rdmavt-fix-rq-counting-issues-causing-use-of-an-invalid-rwqe.patch new file mode 100644 index 00000000000..deaa3b3abd4 --- /dev/null +++ b/queue-5.7/ib-rdmavt-fix-rq-counting-issues-causing-use-of-an-invalid-rwqe.patch @@ -0,0 +1,162 @@ +From 54a485e9ec084da1a4b32dcf7749c7d760ed8aa5 Mon Sep 17 00:00:00 2001 +From: Mike Marciniszyn +Date: Tue, 28 Jul 2020 14:38:48 -0400 +Subject: IB/rdmavt: Fix RQ counting issues causing use of an invalid RWQE + +From: Mike Marciniszyn + +commit 54a485e9ec084da1a4b32dcf7749c7d760ed8aa5 upstream. + +The lookaside count is improperly initialized to the size of the +Receive Queue with the additional +1. In the traces below, the +RQ size is 384, so the count was set to 385. + +The lookaside count is then rarely refreshed. Note the high and +incorrect count in the trace below: + +rvt_get_rwqe: [hfi1_0] wqe ffffc900078e9008 wr_id 55c7206d75a0 qpn c + qpt 2 pid 3018 num_sge 1 head 1 tail 0, count 385 +rvt_get_rwqe: (hfi1_rc_rcv+0x4eb/0x1480 [hfi1] <- rvt_get_rwqe) ret=0x1 + +The head,tail indicate there is only one RWQE posted although the count +says 385 and we correctly return the element 0. + +The next call to rvt_get_rwqe with the decremented count: + +rvt_get_rwqe: [hfi1_0] wqe ffffc900078e9058 wr_id 0 qpn c + qpt 2 pid 3018 num_sge 0 head 1 tail 1, count 384 +rvt_get_rwqe: (hfi1_rc_rcv+0x4eb/0x1480 [hfi1] <- rvt_get_rwqe) ret=0x1 + +Note that the RQ is empty (head == tail) yet we return the RWQE at tail 1, +which is not valid because of the bogus high count. + +Best case, the RWQE has never been posted and the rc logic sees an RWQE +that is too small (all zeros) and puts the QP into an error state. + +In the worst case, a server slow at posting receive buffers might fool +rvt_get_rwqe() into fetching an old RWQE and corrupt memory. + +Fix by deleting the faulty initialization code and creating an +inline to fetch the posted count and convert all callers to use +new inline. + +Fixes: f592ae3c999f ("IB/rdmavt: Fracture single lock used for posting and processing RWQEs") +Link: https://lore.kernel.org/r/20200728183848.22226.29132.stgit@awfm-01.aw.intel.com +Reported-by: Zhaojuan Guo +Cc: # 5.4.x +Reviewed-by: Kaike Wan +Signed-off-by: Mike Marciniszyn +Tested-by: Honggang Li +Signed-off-by: Jason Gunthorpe +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/infiniband/sw/rdmavt/qp.c | 33 ++++----------------------------- + drivers/infiniband/sw/rdmavt/rc.c | 4 +--- + include/rdma/rdmavt_qp.h | 19 +++++++++++++++++++ + 3 files changed, 24 insertions(+), 32 deletions(-) + +--- a/drivers/infiniband/sw/rdmavt/qp.c ++++ b/drivers/infiniband/sw/rdmavt/qp.c +@@ -898,8 +898,6 @@ static void rvt_init_qp(struct rvt_dev_i + qp->s_tail_ack_queue = 0; + qp->s_acked_ack_queue = 0; + qp->s_num_rd_atomic = 0; +- if (qp->r_rq.kwq) +- qp->r_rq.kwq->count = qp->r_rq.size; + qp->r_sge.num_sge = 0; + atomic_set(&qp->s_reserved_used, 0); + } +@@ -2353,31 +2351,6 @@ bad_lkey: + } + + /** +- * get_count - count numbers of request work queue entries +- * in circular buffer +- * @rq: data structure for request queue entry +- * @tail: tail indices of the circular buffer +- * @head: head indices of the circular buffer +- * +- * Return - total number of entries in the circular buffer +- */ +-static u32 get_count(struct rvt_rq *rq, u32 tail, u32 head) +-{ +- u32 count; +- +- count = head; +- +- if (count >= rq->size) +- count = 0; +- if (count < tail) +- count += rq->size - tail; +- else +- count -= tail; +- +- return count; +-} +- +-/** + * get_rvt_head - get head indices of the circular buffer + * @rq: data structure for request queue entry + * @ip: the QP +@@ -2451,7 +2424,7 @@ int rvt_get_rwqe(struct rvt_qp *qp, bool + + if (kwq->count < RVT_RWQ_COUNT_THRESHOLD) { + head = get_rvt_head(rq, ip); +- kwq->count = get_count(rq, tail, head); ++ kwq->count = rvt_get_rq_count(rq, head, tail); + } + if (unlikely(kwq->count == 0)) { + ret = 0; +@@ -2486,7 +2459,9 @@ int rvt_get_rwqe(struct rvt_qp *qp, bool + * the number of remaining WQEs. + */ + if (kwq->count < srq->limit) { +- kwq->count = get_count(rq, tail, get_rvt_head(rq, ip)); ++ kwq->count = ++ rvt_get_rq_count(rq, ++ get_rvt_head(rq, ip), tail); + if (kwq->count < srq->limit) { + struct ib_event ev; + +--- a/drivers/infiniband/sw/rdmavt/rc.c ++++ b/drivers/infiniband/sw/rdmavt/rc.c +@@ -127,9 +127,7 @@ __be32 rvt_compute_aeth(struct rvt_qp *q + * not atomic, which is OK, since the fuzziness is + * resolved as further ACKs go out. + */ +- credits = head - tail; +- if ((int)credits < 0) +- credits += qp->r_rq.size; ++ credits = rvt_get_rq_count(&qp->r_rq, head, tail); + } + /* + * Binary search the credit table to find the code to +--- a/include/rdma/rdmavt_qp.h ++++ b/include/rdma/rdmavt_qp.h +@@ -278,6 +278,25 @@ struct rvt_rq { + spinlock_t lock ____cacheline_aligned_in_smp; + }; + ++/** ++ * rvt_get_rq_count - count numbers of request work queue entries ++ * in circular buffer ++ * @rq: data structure for request queue entry ++ * @head: head indices of the circular buffer ++ * @tail: tail indices of the circular buffer ++ * ++ * Return - total number of entries in the Receive Queue ++ */ ++ ++static inline u32 rvt_get_rq_count(struct rvt_rq *rq, u32 head, u32 tail) ++{ ++ u32 count = head - tail; ++ ++ if ((s32)count < 0) ++ count += rq->size; ++ return count; ++} ++ + /* + * This structure holds the information that the send tasklet needs + * to send a RDMA read response or atomic operation. diff --git a/queue-5.7/rdma-mlx5-fix-prefetch-memory-leak-if-get_prefetchable_mr-fails.patch b/queue-5.7/rdma-mlx5-fix-prefetch-memory-leak-if-get_prefetchable_mr-fails.patch new file mode 100644 index 00000000000..340ddd81fc3 --- /dev/null +++ b/queue-5.7/rdma-mlx5-fix-prefetch-memory-leak-if-get_prefetchable_mr-fails.patch @@ -0,0 +1,46 @@ +From 5351a56b1a4ceafd7a17ebfdf3cda430cdfd365d Mon Sep 17 00:00:00 2001 +From: Jason Gunthorpe +Date: Mon, 27 Jul 2020 12:57:12 +0300 +Subject: RDMA/mlx5: Fix prefetch memory leak if get_prefetchable_mr fails + +From: Jason Gunthorpe + +commit 5351a56b1a4ceafd7a17ebfdf3cda430cdfd365d upstream. + +destroy_prefetch_work() must always be called if the work is not going +to be queued. The num_sge also should have been set to i, not i-1 +which avoids the condition where it shouldn't have been called in the +first place. + +Cc: stable@vger.kernel.org +Fixes: fb985e278a30 ("RDMA/mlx5: Use SRCU properly in ODP prefetch") +Link: https://lore.kernel.org/r/20200727095712.495652-1-leon@kernel.org +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/infiniband/hw/mlx5/odp.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +--- a/drivers/infiniband/hw/mlx5/odp.c ++++ b/drivers/infiniband/hw/mlx5/odp.c +@@ -1798,9 +1798,7 @@ static bool init_prefetch_work(struct ib + work->frags[i].mr = + get_prefetchable_mr(pd, advice, sg_list[i].lkey); + if (!work->frags[i].mr) { +- work->num_sge = i - 1; +- if (i) +- destroy_prefetch_work(work); ++ work->num_sge = i; + return false; + } + +@@ -1866,6 +1864,7 @@ int mlx5_ib_advise_mr_prefetch(struct ib + srcu_key = srcu_read_lock(&dev->odp_srcu); + if (!init_prefetch_work(pd, advice, pf_flags, work, sg_list, num_sge)) { + srcu_read_unlock(&dev->odp_srcu, srcu_key); ++ destroy_prefetch_work(work); + return -EINVAL; + } + queue_work(system_unbound_wq, &work->work); diff --git a/queue-5.7/revert-1320a4052ea1-audit-trigger-accompanying-records-when-no-rules-present.patch b/queue-5.7/revert-1320a4052ea1-audit-trigger-accompanying-records-when-no-rules-present.patch new file mode 100644 index 00000000000..c5ac988ea39 --- /dev/null +++ b/queue-5.7/revert-1320a4052ea1-audit-trigger-accompanying-records-when-no-rules-present.patch @@ -0,0 +1,78 @@ +From 8ac68dc455d9d18241d44b96800d73229029ed34 Mon Sep 17 00:00:00 2001 +From: Paul Moore +Date: Tue, 28 Jul 2020 15:33:21 -0400 +Subject: revert: 1320a4052ea1 ("audit: trigger accompanying records when no rules present") + +From: Paul Moore + +commit 8ac68dc455d9d18241d44b96800d73229029ed34 upstream. + +Unfortunately the commit listed in the subject line above failed +to ensure that the task's audit_context was properly initialized/set +before enabling the "accompanying records". Depending on the +situation, the resulting audit_context could have invalid values in +some of it's fields which could cause a kernel panic/oops when the +task/syscall exists and the audit records are generated. + +We will revisit the original patch, with the necessary fixes, in a +future kernel but right now we just want to fix the kernel panic +with the least amount of added risk. + +Cc: stable@vger.kernel.org +Fixes: 1320a4052ea1 ("audit: trigger accompanying records when no rules present") +Reported-by: j2468h@googlemail.com +Signed-off-by: Paul Moore +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/audit.c | 1 - + kernel/audit.h | 8 -------- + kernel/auditsc.c | 3 +++ + 3 files changed, 3 insertions(+), 9 deletions(-) + +--- a/kernel/audit.c ++++ b/kernel/audit.c +@@ -1811,7 +1811,6 @@ struct audit_buffer *audit_log_start(str + } + + audit_get_stamp(ab->ctx, &t, &serial); +- audit_clear_dummy(ab->ctx); + audit_log_format(ab, "audit(%llu.%03lu:%u): ", + (unsigned long long)t.tv_sec, t.tv_nsec/1000000, serial); + +--- a/kernel/audit.h ++++ b/kernel/audit.h +@@ -290,13 +290,6 @@ extern int audit_signal_info_syscall(str + extern void audit_filter_inodes(struct task_struct *tsk, + struct audit_context *ctx); + extern struct list_head *audit_killed_trees(void); +- +-static inline void audit_clear_dummy(struct audit_context *ctx) +-{ +- if (ctx) +- ctx->dummy = 0; +-} +- + #else /* CONFIG_AUDITSYSCALL */ + #define auditsc_get_stamp(c, t, s) 0 + #define audit_put_watch(w) {} +@@ -330,7 +323,6 @@ static inline int audit_signal_info_sysc + } + + #define audit_filter_inodes(t, c) AUDIT_DISABLED +-#define audit_clear_dummy(c) {} + #endif /* CONFIG_AUDITSYSCALL */ + + extern char *audit_unpack_string(void **bufp, size_t *remain, size_t len); +--- a/kernel/auditsc.c ++++ b/kernel/auditsc.c +@@ -1406,6 +1406,9 @@ static void audit_log_proctitle(void) + struct audit_context *context = audit_context(); + struct audit_buffer *ab; + ++ if (!context || context->dummy) ++ return; ++ + ab = audit_log_start(context, GFP_KERNEL, AUDIT_PROCTITLE); + if (!ab) + return; /* audit_panic or being filtered */ diff --git a/queue-5.7/series b/queue-5.7/series index 5191c32f5d7..6966e503ac3 100644 --- a/queue-5.7/series +++ b/queue-5.7/series @@ -1,2 +1,14 @@ sunrpc-check-that-domain-table-is-empty-at-module-un.patch pci-aspm-disable-aspm-on-asmedia-asm1083-1085-pcie-to-pci-bridge.patch +alsa-usb-audio-add-implicit-feedback-quirk-for-ssl2.patch +alsa-hda-realtek-enable-headset-mic-of-asus-rog-zephyrus-g15-ga502-series-with-alc289.patch +alsa-hda-realtek-typo_fix-enable-headset-mic-of-asus-rog-zephyrus-g14-ga401-series-with-alc289.patch +alsa-hda-realtek-fix-add-a-ultra_low_power-function-for-intel-reference-board-alc256.patch +alsa-hda-realtek-fixed-hp-right-speaker-no-sound.patch +alsa-hda-workaround-for-spurious-wakeups-on-some-intel-platforms.patch +alsa-hda-hdmi-fix-keep_power-assignment-for-non-component-devices.patch +rdma-mlx5-fix-prefetch-memory-leak-if-get_prefetchable_mr-fails.patch +ib-rdmavt-fix-rq-counting-issues-causing-use-of-an-invalid-rwqe.patch +vhost-scsi-fix-up-req-type-endian-ness.patch +9p-trans_fd-fix-concurrency-del-of-req_list-in-p9_fd_cancelled-p9_read_work.patch +revert-1320a4052ea1-audit-trigger-accompanying-records-when-no-rules-present.patch diff --git a/queue-5.7/vhost-scsi-fix-up-req-type-endian-ness.patch b/queue-5.7/vhost-scsi-fix-up-req-type-endian-ness.patch new file mode 100644 index 00000000000..47523d0ffae --- /dev/null +++ b/queue-5.7/vhost-scsi-fix-up-req-type-endian-ness.patch @@ -0,0 +1,36 @@ +From 295c1b9852d000580786375304a9800bd9634d15 Mon Sep 17 00:00:00 2001 +From: "Michael S. Tsirkin" +Date: Fri, 10 Jul 2020 06:36:16 -0400 +Subject: vhost/scsi: fix up req type endian-ness + +From: Michael S. Tsirkin + +commit 295c1b9852d000580786375304a9800bd9634d15 upstream. + +vhost/scsi doesn't handle type conversion correctly +for request type when using virtio 1.0 and up for BE, +or cross-endian platforms. + +Fix it up using vhost_32_to_cpu. + +Cc: stable@vger.kernel.org +Signed-off-by: Michael S. Tsirkin +Acked-by: Jason Wang +Reviewed-by: Stefan Hajnoczi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/vhost/scsi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/vhost/scsi.c ++++ b/drivers/vhost/scsi.c +@@ -1215,7 +1215,7 @@ vhost_scsi_ctl_handle_vq(struct vhost_sc + continue; + } + +- switch (v_req.type) { ++ switch (vhost32_to_cpu(vq, v_req.type)) { + case VIRTIO_SCSI_T_TMF: + vc.req = &v_req.tmf; + vc.req_size = sizeof(struct virtio_scsi_ctrl_tmf_req);