--- /dev/null
+From f128090491c3f5aacef91a863f8c52abf869c436 Mon Sep 17 00:00:00 2001
+From: Thomas Hebb <tommyhebb@gmail.com>
+Date: Mon, 30 Mar 2020 12:09:37 -0400
+Subject: ALSA: doc: Document PC Beep Hidden Register on Realtek ALC256
+
+From: Thomas Hebb <tommyhebb@gmail.com>
+
+commit f128090491c3f5aacef91a863f8c52abf869c436 upstream.
+
+This codec (among others) has a hidden set of audio routes, apparently
+designed to allow PC Beep output without a mixer widget on the output
+path, which are controlled by an undocumented Realtek vendor register.
+The default configuration of these routes means that certain inputs
+aren't accessible, necessitating driver control of the register.
+However, Realtek has provided no documentation of the register, instead
+opting to fix issues by providing magic numbers, most of which have been
+at least somewhat erroneous. These magic numbers then get copied by
+others into model-specific fixups, leading to a fragmented and buggy set
+of configurations.
+
+To get out of this situation, I've reverse engineered the register by
+flipping bits and observing how the codec's behavior changes. This
+commit documents my findings. It does not change any code.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Thomas Hebb <tommyhebb@gmail.com>
+Link: https://lore.kernel.org/r/bd69dfdeaf40ff31c4b7b797c829bb320031739c.1585584498.git.tommyhebb@gmail.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ Documentation/sound/hd-audio/index.rst | 1
+ Documentation/sound/hd-audio/realtek-pc-beep.rst | 129 +++++++++++++++++++++++
+ 2 files changed, 130 insertions(+)
+
+--- a/Documentation/sound/hd-audio/index.rst
++++ b/Documentation/sound/hd-audio/index.rst
+@@ -8,3 +8,4 @@ HD-Audio
+ models
+ controls
+ dp-mst
++ realtek-pc-beep
+--- /dev/null
++++ b/Documentation/sound/hd-audio/realtek-pc-beep.rst
+@@ -0,0 +1,129 @@
++===============================
++Realtek PC Beep Hidden Register
++===============================
++
++This file documents the "PC Beep Hidden Register", which is present in certain
++Realtek HDA codecs and controls a muxer and pair of passthrough mixers that can
++route audio between pins but aren't themselves exposed as HDA widgets. As far
++as I can tell, these hidden routes are designed to allow flexible PC Beep output
++for codecs that don't have mixer widgets in their output paths. Why it's easier
++to hide a mixer behind an undocumented vendor register than to just expose it
++as a widget, I have no idea.
++
++Register Description
++====================
++
++The register is accessed via processing coefficient 0x36 on NID 20h. Bits not
++identified below have no discernible effect on my machine, a Dell XPS 13 9350::
++
++ MSB LSB
++ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
++ | |h|S|L| | B |R| | Known bits
++ +=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
++ |0|0|1|1| 0x7 |0|0x0|1| 0x7 | Reset value
++ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
++
++1Ah input select (B): 2 bits
++ When zero, expose the PC Beep line (from the internal beep generator, when
++ enabled with the Set Beep Generation verb on NID 01h, or else from the
++ external PCBEEP pin) on the 1Ah pin node. When nonzero, expose the headphone
++ jack (or possibly Line In on some machines) input instead. If PC Beep is
++ selected, the 1Ah boost control has no effect.
++
++Amplify 1Ah loopback, left (L): 1 bit
++ Amplify the left channel of 1Ah before mixing it into outputs as specified
++ by h and S bits. Does not affect the level of 1Ah exposed to other widgets.
++
++Amplify 1Ah loopback, right (R): 1 bit
++ Amplify the right channel of 1Ah before mixing it into outputs as specified
++ by h and S bits. Does not affect the level of 1Ah exposed to other widgets.
++
++Loopback 1Ah to 21h [active low] (h): 1 bit
++ When zero, mix 1Ah (possibly with amplification, depending on L and R bits)
++ into 21h (headphone jack on my machine). Mixed signal respects the mute
++ setting on 21h.
++
++Loopback 1Ah to 14h (S): 1 bit
++ When one, mix 1Ah (possibly with amplification, depending on L and R bits)
++ into 14h (internal speaker on my machine). Mixed signal **ignores** the mute
++ setting on 14h and is present whenever 14h is configured as an output.
++
++Path diagrams
++=============
++
++1Ah input selection (DIV is the PC Beep divider set on NID 01h)::
++
++ <Beep generator> <PCBEEP pin> <Headphone jack>
++ | | |
++ +--DIV--+--!DIV--+ {1Ah boost control}
++ | |
++ +--(b == 0)--+--(b != 0)--+
++ |
++ >1Ah (Beep/Headphone Mic/Line In)<
++
++Loopback of 1Ah to 21h/14h::
++
++ <1Ah (Beep/Headphone Mic/Line In)>
++ |
++ {amplify if L/R}
++ |
++ +-----!h-----+-----S-----+
++ | |
++ {21h mute control} |
++ | |
++ >21h (Headphone)< >14h (Internal Speaker)<
++
++Background
++==========
++
++All Realtek HDA codecs have a vendor-defined widget with node ID 20h which
++provides access to a bank of registers that control various codec functions.
++Registers are read and written via the standard HDA processing coefficient
++verbs (Set/Get Coefficient Index, Set/Get Processing Coefficient). The node is
++named "Realtek Vendor Registers" in public datasheets' verb listings and,
++apart from that, is entirely undocumented.
++
++This particular register, exposed at coefficient 0x36 and named in commits from
++Realtek, is of note: unlike most registers, which seem to control detailed
++amplifier parameters not in scope of the HDA specification, it controls audio
++routing which could just as easily have been defined using standard HDA mixer
++and selector widgets.
++
++Specifically, it selects between two sources for the input pin widget with Node
++ID (NID) 1Ah: the widget's signal can come either from an audio jack (on my
++laptop, a Dell XPS 13 9350, it's the headphone jack, but comments in Realtek
++commits indicate that it might be a Line In on some machines) or from the PC
++Beep line (which is itself multiplexed between the codec's internal beep
++generator and external PCBEEP pin, depending on if the beep generator is
++enabled via verbs on NID 01h). Additionally, it can mix (with optional
++amplification) that signal onto the 21h and/or 14h output pins.
++
++The register's reset value is 0x3717, corresponding to PC Beep on 1Ah that is
++then amplified and mixed into both the headphones and the speakers. Not only
++does this violate the HDA specification, which says that "[a vendor defined
++beep input pin] connection may be maintained *only* while the Link reset
++(**RST#**) is asserted", it means that we cannot ignore the register if we care
++about the input that 1Ah would otherwise expose or if the PCBEEP trace is
++poorly shielded and picks up chassis noise (both of which are the case on my
++machine).
++
++Unfortunately, there are lots of ways to get this register configuration wrong.
++Linux, it seems, has gone through most of them. For one, the register resets
++after S3 suspend: judging by existing code, this isn't the case for all vendor
++registers, and it's led to some fixes that improve behavior on cold boot but
++don't last after suspend. Other fixes have successfully switched the 1Ah input
++away from PC Beep but have failed to disable both loopback paths. On my
++machine, this means that the headphone input is amplified and looped back to
++the headphone output, which uses the exact same pins! As you might expect, this
++causes terrible headphone noise, the character of which is controlled by the
++1Ah boost control. (If you've seen instructions online to fix XPS 13 headphone
++noise by changing "Headphone Mic Boost" in ALSA, now you know why.)
++
++The information here has been obtained through black-box reverse engineering of
++the ALC256 codec's behavior and is not guaranteed to be correct. It likely
++also applies for the ALC255, ALC257, ALC235, and ALC236, since those codecs
++seem to be close relatives of the ALC256. (They all share one initialization
++function.) Additionally, other codecs like the ALC225 and ALC285 also have this
++register, judging by existing fixups in ``patch_realtek.c``, but specific
++data (e.g. node IDs, bit positions, pin mappings) for those codecs may differ
++from what I've described here.
--- /dev/null
+From 3c6fd1f07ed03a04debbb9a9d782205f1ef5e2ab Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Wed, 8 Apr 2020 16:04:49 +0200
+Subject: ALSA: hda: Add driver blacklist
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 3c6fd1f07ed03a04debbb9a9d782205f1ef5e2ab upstream.
+
+The recent AMD platform exposes an HD-audio bus but without any actual
+codecs, which is internally tied with a USB-audio device, supposedly.
+It results in "no codecs" error of HD-audio bus driver, and it's
+nothing but a waste of resources.
+
+This patch introduces a static blacklist table for skipping such a
+known bogus PCI SSID entry. As of writing this patch, the known SSIDs
+are:
+* 1043:874f - ASUS ROG Zenith II / Strix
+* 1462:cb59 - MSI TRX40 Creator
+* 1462:cb60 - MSI TRX40
+
+BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=206543
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20200408140449.22319-2-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/hda_intel.c | 16 ++++++++++++++++
+ 1 file changed, 16 insertions(+)
+
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -2024,6 +2024,17 @@ static void pcm_mmap_prepare(struct snd_
+ #endif
+ }
+
++/* Blacklist for skipping the whole probe:
++ * some HD-audio PCI entries are exposed without any codecs, and such devices
++ * should be ignored from the beginning.
++ */
++static const struct snd_pci_quirk driver_blacklist[] = {
++ SND_PCI_QUIRK(0x1043, 0x874f, "ASUS ROG Zenith II / Strix", 0),
++ SND_PCI_QUIRK(0x1462, 0xcb59, "MSI TRX40 Creator", 0),
++ SND_PCI_QUIRK(0x1462, 0xcb60, "MSI TRX40", 0),
++ {}
++};
++
+ static const struct hda_controller_ops pci_hda_ops = {
+ .disable_msi_reset_irq = disable_msi_reset_irq,
+ .pcm_mmap_prepare = pcm_mmap_prepare,
+@@ -2059,6 +2070,11 @@ static int azx_probe(struct pci_dev *pci
+ bool schedule_probe;
+ int err;
+
++ if (snd_pci_quirk_lookup(pci, driver_blacklist)) {
++ dev_info(&pci->dev, "Skipping the blacklisted device\n");
++ return -ENODEV;
++ }
++
+ if (dev >= SNDRV_CARDS)
+ return -ENODEV;
+ if (!enable[dev]) {
--- /dev/null
+From 0ad3f0b384d58f3bd1f4fb87d0af5b8f6866f41a Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Tue, 7 Apr 2020 10:44:01 +0200
+Subject: ALSA: hda: Fix potential access overflow in beep helper
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 0ad3f0b384d58f3bd1f4fb87d0af5b8f6866f41a upstream.
+
+The beep control helper function blindly stores the values in two
+stereo channels no matter whether the actual control is mono or
+stereo. This is practically harmless, but it annoys the recently
+introduced sanity check, resulting in an error when the checker is
+enabled.
+
+This patch corrects the behavior to store only on the defined array
+member.
+
+Fixes: 0401e8548eac ("ALSA: hda - Move beep helper functions to hda_beep.c")
+BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=207139
+Reviewed-by: Jaroslav Kysela <perex@perex.cz>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20200407084402.25589-2-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/hda_beep.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/sound/pci/hda/hda_beep.c
++++ b/sound/pci/hda/hda_beep.c
+@@ -290,8 +290,12 @@ int snd_hda_mixer_amp_switch_get_beep(st
+ {
+ struct hda_codec *codec = snd_kcontrol_chip(kcontrol);
+ struct hda_beep *beep = codec->beep;
++ int chs = get_amp_channels(kcontrol);
++
+ if (beep && (!beep->enabled || !ctl_has_mute(kcontrol))) {
+- ucontrol->value.integer.value[0] =
++ if (chs & 1)
++ ucontrol->value.integer.value[0] = beep->enabled;
++ if (chs & 2)
+ ucontrol->value.integer.value[1] = beep->enabled;
+ return 0;
+ }
--- /dev/null
+From 476c02e0b4fd9071d158f6a1a1dfea1d36ee0ffd Mon Sep 17 00:00:00 2001
+From: Hui Wang <hui.wang@canonical.com>
+Date: Sun, 29 Mar 2020 16:20:18 +0800
+Subject: ALSA: hda/realtek - a fake key event is triggered by running shutup
+
+From: Hui Wang <hui.wang@canonical.com>
+
+commit 476c02e0b4fd9071d158f6a1a1dfea1d36ee0ffd upstream.
+
+On the Lenovo X1C7 machines, after we plug the headset, the rt_resume()
+and rt_suspend() of the codec driver will be called periodically, the
+driver can't stay in the rt_suspend state even users doen't use the
+sound card.
+
+Through debugging, I found when running rt_suspend(), it will call
+alc225_shutup(), in this function, it will change 3k pull down control
+by alc_update_coef_idx(codec, 0x4a, 0, 3 << 10), this will trigger a
+fake key event and that event will resume the codec, when codec
+suspend agin, it will trigger the fake key event one more time, this
+process will repeat.
+
+If disable the key event before changing the pull down control, it
+will not trigger fake key event. It also needs to restore the pull
+down control and re-enable the key event, otherwise the system can't
+get key event when codec is in rt_suspend state.
+
+Also move some functions ahead of alc225_shutup(), this can save the
+function declaration.
+
+Fixes: 76f7dec08fd6 (ALSA: hda/realtek - Add Headset Button supported for ThinkPad X1)
+Cc: Kailang Yang <kailang@realtek.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Hui Wang <hui.wang@canonical.com>
+Link: https://lore.kernel.org/r/20200329082018.20486-1-hui.wang@canonical.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_realtek.c | 170 ++++++++++++++++++++++++++----------------
+ 1 file changed, 107 insertions(+), 63 deletions(-)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -107,6 +107,7 @@ struct alc_spec {
+ unsigned int done_hp_init:1;
+ unsigned int no_shutup_pins:1;
+ unsigned int ultra_low_power:1;
++ unsigned int has_hs_key:1;
+
+ /* for PLL fix */
+ hda_nid_t pll_nid;
+@@ -2982,6 +2983,107 @@ static int alc269_parse_auto_config(stru
+ return alc_parse_auto_config(codec, alc269_ignore, ssids);
+ }
+
++static const struct hda_jack_keymap alc_headset_btn_keymap[] = {
++ { SND_JACK_BTN_0, KEY_PLAYPAUSE },
++ { SND_JACK_BTN_1, KEY_VOICECOMMAND },
++ { SND_JACK_BTN_2, KEY_VOLUMEUP },
++ { SND_JACK_BTN_3, KEY_VOLUMEDOWN },
++ {}
++};
++
++static void alc_headset_btn_callback(struct hda_codec *codec,
++ struct hda_jack_callback *jack)
++{
++ int report = 0;
++
++ if (jack->unsol_res & (7 << 13))
++ report |= SND_JACK_BTN_0;
++
++ if (jack->unsol_res & (1 << 16 | 3 << 8))
++ report |= SND_JACK_BTN_1;
++
++ /* Volume up key */
++ if (jack->unsol_res & (7 << 23))
++ report |= SND_JACK_BTN_2;
++
++ /* Volume down key */
++ if (jack->unsol_res & (7 << 10))
++ report |= SND_JACK_BTN_3;
++
++ jack->jack->button_state = report;
++}
++
++static void alc_disable_headset_jack_key(struct hda_codec *codec)
++{
++ struct alc_spec *spec = codec->spec;
++
++ if (!spec->has_hs_key)
++ return;
++
++ switch (codec->core.vendor_id) {
++ case 0x10ec0215:
++ case 0x10ec0225:
++ case 0x10ec0285:
++ case 0x10ec0295:
++ case 0x10ec0289:
++ case 0x10ec0299:
++ alc_write_coef_idx(codec, 0x48, 0x0);
++ alc_update_coef_idx(codec, 0x49, 0x0045, 0x0);
++ alc_update_coef_idx(codec, 0x44, 0x0045 << 8, 0x0);
++ break;
++ case 0x10ec0236:
++ case 0x10ec0256:
++ alc_write_coef_idx(codec, 0x48, 0x0);
++ alc_update_coef_idx(codec, 0x49, 0x0045, 0x0);
++ break;
++ }
++}
++
++static void alc_enable_headset_jack_key(struct hda_codec *codec)
++{
++ struct alc_spec *spec = codec->spec;
++
++ if (!spec->has_hs_key)
++ return;
++
++ switch (codec->core.vendor_id) {
++ case 0x10ec0215:
++ case 0x10ec0225:
++ case 0x10ec0285:
++ case 0x10ec0295:
++ case 0x10ec0289:
++ case 0x10ec0299:
++ alc_write_coef_idx(codec, 0x48, 0xd011);
++ alc_update_coef_idx(codec, 0x49, 0x007f, 0x0045);
++ alc_update_coef_idx(codec, 0x44, 0x007f << 8, 0x0045 << 8);
++ break;
++ case 0x10ec0236:
++ case 0x10ec0256:
++ alc_write_coef_idx(codec, 0x48, 0xd011);
++ alc_update_coef_idx(codec, 0x49, 0x007f, 0x0045);
++ break;
++ }
++}
++
++static void alc_fixup_headset_jack(struct hda_codec *codec,
++ const struct hda_fixup *fix, int action)
++{
++ struct alc_spec *spec = codec->spec;
++
++ switch (action) {
++ case HDA_FIXUP_ACT_PRE_PROBE:
++ spec->has_hs_key = 1;
++ snd_hda_jack_detect_enable_callback(codec, 0x55,
++ alc_headset_btn_callback);
++ snd_hda_jack_add_kctl(codec, 0x55, "Headset Jack", false,
++ SND_JACK_HEADSET, alc_headset_btn_keymap);
++ break;
++ case HDA_FIXUP_ACT_INIT:
++ alc_enable_headset_jack_key(codec);
++ break;
++ }
++}
++
+ static void alc269vb_toggle_power_output(struct hda_codec *codec, int power_up)
+ {
+ alc_update_coef_idx(codec, 0x04, 1 << 11, power_up ? (1 << 11) : 0);
+@@ -3372,6 +3474,8 @@ static void alc225_shutup(struct hda_cod
+
+ if (!hp_pin)
+ hp_pin = 0x21;
++
++ alc_disable_headset_jack_key(codec);
+ /* 3k pull low control for Headset jack. */
+ alc_update_coef_idx(codec, 0x4a, 0, 3 << 10);
+
+@@ -3411,6 +3515,9 @@ static void alc225_shutup(struct hda_cod
+ alc_update_coef_idx(codec, 0x4a, 3<<4, 2<<4);
+ msleep(30);
+ }
++
++ alc_update_coef_idx(codec, 0x4a, 3 << 10, 0);
++ alc_enable_headset_jack_key(codec);
+ }
+
+ static void alc_default_init(struct hda_codec *codec)
+@@ -5668,69 +5775,6 @@ static void alc285_fixup_invalidate_dacs
+ snd_hda_override_wcaps(codec, 0x03, 0);
+ }
+
+-static const struct hda_jack_keymap alc_headset_btn_keymap[] = {
+- { SND_JACK_BTN_0, KEY_PLAYPAUSE },
+- { SND_JACK_BTN_1, KEY_VOICECOMMAND },
+- { SND_JACK_BTN_2, KEY_VOLUMEUP },
+- { SND_JACK_BTN_3, KEY_VOLUMEDOWN },
+- {}
+-};
+-
+-static void alc_headset_btn_callback(struct hda_codec *codec,
+- struct hda_jack_callback *jack)
+-{
+- int report = 0;
+-
+- if (jack->unsol_res & (7 << 13))
+- report |= SND_JACK_BTN_0;
+-
+- if (jack->unsol_res & (1 << 16 | 3 << 8))
+- report |= SND_JACK_BTN_1;
+-
+- /* Volume up key */
+- if (jack->unsol_res & (7 << 23))
+- report |= SND_JACK_BTN_2;
+-
+- /* Volume down key */
+- if (jack->unsol_res & (7 << 10))
+- report |= SND_JACK_BTN_3;
+-
+- jack->jack->button_state = report;
+-}
+-
+-static void alc_fixup_headset_jack(struct hda_codec *codec,
+- const struct hda_fixup *fix, int action)
+-{
+-
+- switch (action) {
+- case HDA_FIXUP_ACT_PRE_PROBE:
+- snd_hda_jack_detect_enable_callback(codec, 0x55,
+- alc_headset_btn_callback);
+- snd_hda_jack_add_kctl(codec, 0x55, "Headset Jack", false,
+- SND_JACK_HEADSET, alc_headset_btn_keymap);
+- break;
+- case HDA_FIXUP_ACT_INIT:
+- switch (codec->core.vendor_id) {
+- case 0x10ec0215:
+- case 0x10ec0225:
+- case 0x10ec0285:
+- case 0x10ec0295:
+- case 0x10ec0289:
+- case 0x10ec0299:
+- alc_write_coef_idx(codec, 0x48, 0xd011);
+- alc_update_coef_idx(codec, 0x49, 0x007f, 0x0045);
+- alc_update_coef_idx(codec, 0x44, 0x007f << 8, 0x0045 << 8);
+- break;
+- case 0x10ec0236:
+- case 0x10ec0256:
+- alc_write_coef_idx(codec, 0x48, 0xd011);
+- alc_update_coef_idx(codec, 0x49, 0x007f, 0x0045);
+- break;
+- }
+- break;
+- }
+-}
+-
+ static void alc295_fixup_chromebook(struct hda_codec *codec,
+ const struct hda_fixup *fix, int action)
+ {
--- /dev/null
+From ca707b3f00b4f31a6e1eb37e8ae99f15f2bb1fe5 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Thu, 2 Apr 2020 19:43:11 +0200
+Subject: ALSA: hda/realtek - Add quirk for Lenovo Carbon X1 8th gen
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+commit ca707b3f00b4f31a6e1eb37e8ae99f15f2bb1fe5 upstream.
+
+The audio setup on the Lenovo Carbon X1 8th gen is the same as that on
+the Lenovo Carbon X1 7th gen, as such it needs the same
+ALC285_FIXUP_THINKPAD_HEADSET_JACK quirk.
+
+This fixes volume control of the speaker not working among other things.
+
+BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1820196
+Cc: stable@vger.kernel.org
+Suggested-by: Jaroslav Kysela <perex@perex.cz>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Reviewed-by: Jaroslav Kysela <perex@perex.cz>
+Link: https://lore.kernel.org/r/20200402174311.238614-1-hdegoede@redhat.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_realtek.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -7325,6 +7325,7 @@ static const struct snd_pci_quirk alc269
+ SND_PCI_QUIRK(0x17aa, 0x225d, "Thinkpad T480", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
+ SND_PCI_QUIRK(0x17aa, 0x2292, "Thinkpad X1 Yoga 7th", ALC285_FIXUP_THINKPAD_HEADSET_JACK),
+ SND_PCI_QUIRK(0x17aa, 0x2293, "Thinkpad X1 Carbon 7th", ALC285_FIXUP_THINKPAD_HEADSET_JACK),
++ SND_PCI_QUIRK(0x17aa, 0x22be, "Thinkpad X1 Carbon 8th", ALC285_FIXUP_THINKPAD_HEADSET_JACK),
+ SND_PCI_QUIRK(0x17aa, 0x30bb, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY),
+ SND_PCI_QUIRK(0x17aa, 0x30e2, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY),
+ SND_PCI_QUIRK(0x17aa, 0x310c, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION),
--- /dev/null
+From 1d3aa4a5516d2e4933fe3cca11d3349ef63bc547 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Wed, 8 Apr 2020 15:56:45 +0200
+Subject: ALSA: hda/realtek - Add quirk for MSI GL63
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 1d3aa4a5516d2e4933fe3cca11d3349ef63bc547 upstream.
+
+MSI GL63 laptop requires the similar quirk like other MSI models,
+ALC1220_FIXUP_CLEVO_P950. The board BIOS doesn't provide a PCI SSID
+for the device, hence we need to take the codec SSID (1462:1275)
+instead.
+
+BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=207157
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20200408135645.21896-1-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_realtek.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -2447,6 +2447,7 @@ static const struct snd_pci_quirk alc882
+ SND_PCI_QUIRK(0x1458, 0xa0b8, "Gigabyte AZ370-Gaming", ALC1220_FIXUP_GB_DUAL_CODECS),
+ SND_PCI_QUIRK(0x1458, 0xa0cd, "Gigabyte X570 Aorus Master", ALC1220_FIXUP_CLEVO_P950),
+ SND_PCI_QUIRK(0x1462, 0x1228, "MSI-GP63", ALC1220_FIXUP_CLEVO_P950),
++ SND_PCI_QUIRK(0x1462, 0x1275, "MSI-GL63", ALC1220_FIXUP_CLEVO_P950),
+ SND_PCI_QUIRK(0x1462, 0x1276, "MSI-GL73", ALC1220_FIXUP_CLEVO_P950),
+ SND_PCI_QUIRK(0x1462, 0x1293, "MSI-GP65", ALC1220_FIXUP_CLEVO_P950),
+ SND_PCI_QUIRK(0x1462, 0x7350, "MSI-7350", ALC889_FIXUP_CD),
--- /dev/null
+From f5a88b0accc24c4a9021247d7a3124f90aa4c586 Mon Sep 17 00:00:00 2001
+From: Kai-Heng Feng <kai.heng.feng@canonical.com>
+Date: Fri, 27 Mar 2020 12:46:25 +0800
+Subject: ALSA: hda/realtek: Enable mute LED on an HP system
+
+From: Kai-Heng Feng <kai.heng.feng@canonical.com>
+
+commit f5a88b0accc24c4a9021247d7a3124f90aa4c586 upstream.
+
+The system in question uses ALC285, and it uses GPIO 0x04 to control its
+mute LED.
+
+The mic mute LED can be controlled by GPIO 0x01, however the system uses
+DMIC so we should use that to control mic mute LED.
+
+Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20200327044626.29582-1-kai.heng.feng@canonical.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_realtek.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -4008,6 +4008,12 @@ static void alc269_fixup_hp_gpio_led(str
+ alc_fixup_hp_gpio_led(codec, action, 0x08, 0x10);
+ }
+
++static void alc285_fixup_hp_gpio_led(struct hda_codec *codec,
++ const struct hda_fixup *fix, int action)
++{
++ alc_fixup_hp_gpio_led(codec, action, 0x04, 0x00);
++}
++
+ static void alc286_fixup_hp_gpio_led(struct hda_codec *codec,
+ const struct hda_fixup *fix, int action)
+ {
+@@ -5923,6 +5929,7 @@ enum {
+ ALC294_FIXUP_ASUS_DUAL_SPK,
+ ALC285_FIXUP_THINKPAD_HEADSET_JACK,
+ ALC294_FIXUP_ASUS_HPE,
++ ALC285_FIXUP_HP_GPIO_LED,
+ };
+
+ static const struct hda_fixup alc269_fixups[] = {
+@@ -7061,6 +7068,10 @@ static const struct hda_fixup alc269_fix
+ .chained = true,
+ .chain_id = ALC294_FIXUP_ASUS_HEADSET_MIC
+ },
++ [ALC285_FIXUP_HP_GPIO_LED] = {
++ .type = HDA_FIXUP_FUNC,
++ .v.func = alc285_fixup_hp_gpio_led,
++ },
+ };
+
+ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+@@ -7208,6 +7219,7 @@ static const struct snd_pci_quirk alc269
+ SND_PCI_QUIRK(0x103c, 0x83b9, "HP Spectre x360", ALC269_FIXUP_HP_MUTE_LED_MIC3),
+ SND_PCI_QUIRK(0x103c, 0x8497, "HP Envy x360", ALC269_FIXUP_HP_MUTE_LED_MIC3),
+ SND_PCI_QUIRK(0x103c, 0x84e7, "HP Pavilion 15", ALC269_FIXUP_HP_MUTE_LED_MIC3),
++ SND_PCI_QUIRK(0x103c, 0x8736, "HP", ALC285_FIXUP_HP_GPIO_LED),
+ SND_PCI_QUIRK(0x1043, 0x103e, "ASUS X540SA", ALC256_FIXUP_ASUS_MIC),
+ SND_PCI_QUIRK(0x1043, 0x103f, "ASUS TX300", ALC282_FIXUP_ASUS_TX300),
+ SND_PCI_QUIRK(0x1043, 0x106d, "Asus K53BE", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
--- /dev/null
+From f36938aa7440f46a0a365f1cfde5f5985af2bef3 Mon Sep 17 00:00:00 2001
+From: Thomas Hebb <tommyhebb@gmail.com>
+Date: Mon, 30 Mar 2020 12:09:39 -0400
+Subject: ALSA: hda/realtek - Remove now-unnecessary XPS 13 headphone noise fixups
+
+From: Thomas Hebb <tommyhebb@gmail.com>
+
+commit f36938aa7440f46a0a365f1cfde5f5985af2bef3 upstream.
+
+patch_realtek.c has historically failed to properly configure the PC
+Beep Hidden Register for the ALC256 codec (among others). Depending on
+your kernel version, symptoms of this misconfiguration can range from
+chassis noise, picked up by a poorly-shielded PCBEEP trace, getting
+amplified and played on your internal speaker and/or headphones to loud
+feedback, which responds to the "Headphone Mic Boost" ALSA control,
+getting played through your headphones. For details of the problem, see
+the patch in this series titled "ALSA: hda/realtek - Set principled PC
+Beep configuration for ALC256", which fixes the configuration.
+
+These symptoms have been most noticed on the Dell XPS 13 9350 and 9360,
+popular laptops that use the ALC256. As a result, several model-specific
+fixups have been introduced to try and fix the problem, the most
+egregious of which locks the "Headphone Mic Boost" control as a hack to
+minimize noise from a feedback loop that shouldn't have been there in
+the first place.
+
+Now that the underlying issue has been fixed, remove all these fixups.
+Remaining fixups needed by the XPS 13 are all picked up by existing pin
+quirks.
+
+This change should, for the XPS 13 9350/9360
+
+ - Significantly increase volume and audio quality on headphones
+ - Eliminate headphone popping on suspend/resume
+ - Allow "Headphone Mic Boost" to be set again, making the headphone
+ jack fully usable as a microphone jack too.
+
+Fixes: 8c69729b4439 ("ALSA: hda - Fix headphone noise after Dell XPS 13 resume back from S3")
+Fixes: 423cd785619a ("ALSA: hda - Fix headphone noise on Dell XPS 13 9360")
+Fixes: e4c9fd10eb21 ("ALSA: hda - Apply headphone noise quirk for another Dell XPS 13 variant")
+Fixes: 1099f48457d0 ("ALSA: hda/realtek: Reduce the Headphone static noise on XPS 9350/9360")
+Cc: stable@vger.kernel.org
+Signed-off-by: Thomas Hebb <tommyhebb@gmail.com>
+Link: https://lore.kernel.org/r/b649a00edfde150cf6eebbb4390e15e0c2deb39a.1585584498.git.tommyhebb@gmail.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ Documentation/sound/hd-audio/models.rst | 2 -
+ sound/pci/hda/patch_realtek.c | 34 --------------------------------
+ 2 files changed, 36 deletions(-)
+
+--- a/Documentation/sound/hd-audio/models.rst
++++ b/Documentation/sound/hd-audio/models.rst
+@@ -216,8 +216,6 @@ alc298-dell-aio
+ ALC298 fixups on Dell AIO machines
+ alc275-dell-xps
+ ALC275 fixups on Dell XPS models
+-alc256-dell-xps13
+- ALC256 fixups on Dell XPS13
+ lenovo-spk-noise
+ Workaround for speaker noise on Lenovo machines
+ lenovo-hotkey
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -5491,17 +5491,6 @@ static void alc271_hp_gate_mic_jack(stru
+ }
+ }
+
+-static void alc256_fixup_dell_xps_13_headphone_noise2(struct hda_codec *codec,
+- const struct hda_fixup *fix,
+- int action)
+-{
+- if (action != HDA_FIXUP_ACT_PRE_PROBE)
+- return;
+-
+- snd_hda_codec_amp_stereo(codec, 0x1a, HDA_INPUT, 0, HDA_AMP_VOLMASK, 1);
+- snd_hda_override_wcaps(codec, 0x1a, get_wcaps(codec, 0x1a) & ~AC_WCAP_IN_AMP);
+-}
+-
+ static void alc269_fixup_limit_int_mic_boost(struct hda_codec *codec,
+ const struct hda_fixup *fix,
+ int action)
+@@ -5916,8 +5905,6 @@ enum {
+ ALC298_FIXUP_DELL1_MIC_NO_PRESENCE,
+ ALC298_FIXUP_DELL_AIO_MIC_NO_PRESENCE,
+ ALC275_FIXUP_DELL_XPS,
+- ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE,
+- ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE2,
+ ALC293_FIXUP_LENOVO_SPK_NOISE,
+ ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY,
+ ALC255_FIXUP_DELL_SPK_NOISE,
+@@ -6658,23 +6645,6 @@ static const struct hda_fixup alc269_fix
+ {}
+ }
+ },
+- [ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE] = {
+- .type = HDA_FIXUP_VERBS,
+- .v.verbs = (const struct hda_verb[]) {
+- /* Disable pass-through path for FRONT 14h */
+- {0x20, AC_VERB_SET_COEF_INDEX, 0x36},
+- {0x20, AC_VERB_SET_PROC_COEF, 0x1737},
+- {}
+- },
+- .chained = true,
+- .chain_id = ALC255_FIXUP_DELL1_MIC_NO_PRESENCE
+- },
+- [ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE2] = {
+- .type = HDA_FIXUP_FUNC,
+- .v.func = alc256_fixup_dell_xps_13_headphone_noise2,
+- .chained = true,
+- .chain_id = ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE
+- },
+ [ALC293_FIXUP_LENOVO_SPK_NOISE] = {
+ .type = HDA_FIXUP_FUNC,
+ .v.func = alc_fixup_disable_aamix,
+@@ -7172,17 +7142,14 @@ static const struct snd_pci_quirk alc269
+ SND_PCI_QUIRK(0x1028, 0x06de, "Dell", ALC293_FIXUP_DISABLE_AAMIX_MULTIJACK),
+ SND_PCI_QUIRK(0x1028, 0x06df, "Dell", ALC293_FIXUP_DISABLE_AAMIX_MULTIJACK),
+ SND_PCI_QUIRK(0x1028, 0x06e0, "Dell", ALC293_FIXUP_DISABLE_AAMIX_MULTIJACK),
+- SND_PCI_QUIRK(0x1028, 0x0704, "Dell XPS 13 9350", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE2),
+ SND_PCI_QUIRK(0x1028, 0x0706, "Dell Inspiron 7559", ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER),
+ SND_PCI_QUIRK(0x1028, 0x0725, "Dell Inspiron 3162", ALC255_FIXUP_DELL_SPK_NOISE),
+ SND_PCI_QUIRK(0x1028, 0x0738, "Dell Precision 5820", ALC269_FIXUP_NO_SHUTUP),
+- SND_PCI_QUIRK(0x1028, 0x075b, "Dell XPS 13 9360", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE2),
+ SND_PCI_QUIRK(0x1028, 0x075c, "Dell XPS 27 7760", ALC298_FIXUP_SPK_VOLUME),
+ SND_PCI_QUIRK(0x1028, 0x075d, "Dell AIO", ALC298_FIXUP_SPK_VOLUME),
+ SND_PCI_QUIRK(0x1028, 0x07b0, "Dell Precision 7520", ALC295_FIXUP_DISABLE_DAC3),
+ SND_PCI_QUIRK(0x1028, 0x0798, "Dell Inspiron 17 7000 Gaming", ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER),
+ SND_PCI_QUIRK(0x1028, 0x080c, "Dell WYSE", ALC225_FIXUP_DELL_WYSE_MIC_NO_PRESENCE),
+- SND_PCI_QUIRK(0x1028, 0x082a, "Dell XPS 13 9360", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE2),
+ SND_PCI_QUIRK(0x1028, 0x084b, "Dell", ALC274_FIXUP_DELL_AIO_LINEOUT_VERB),
+ SND_PCI_QUIRK(0x1028, 0x084e, "Dell", ALC274_FIXUP_DELL_AIO_LINEOUT_VERB),
+ SND_PCI_QUIRK(0x1028, 0x0871, "Dell Precision 3630", ALC255_FIXUP_DELL_HEADSET_MIC),
+@@ -7536,7 +7503,6 @@ static const struct hda_model_fixup alc2
+ {.id = ALC298_FIXUP_DELL1_MIC_NO_PRESENCE, .name = "alc298-dell1"},
+ {.id = ALC298_FIXUP_DELL_AIO_MIC_NO_PRESENCE, .name = "alc298-dell-aio"},
+ {.id = ALC275_FIXUP_DELL_XPS, .name = "alc275-dell-xps"},
+- {.id = ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE, .name = "alc256-dell-xps13"},
+ {.id = ALC293_FIXUP_LENOVO_SPK_NOISE, .name = "lenovo-spk-noise"},
+ {.id = ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY, .name = "lenovo-hotkey"},
+ {.id = ALC255_FIXUP_DELL_SPK_NOISE, .name = "dell-spk-noise"},
--- /dev/null
+From c44737449468a0bdc50e09ec75e530f208391561 Mon Sep 17 00:00:00 2001
+From: Thomas Hebb <tommyhebb@gmail.com>
+Date: Mon, 30 Mar 2020 12:09:38 -0400
+Subject: ALSA: hda/realtek - Set principled PC Beep configuration for ALC256
+
+From: Thomas Hebb <tommyhebb@gmail.com>
+
+commit c44737449468a0bdc50e09ec75e530f208391561 upstream.
+
+The Realtek PC Beep Hidden Register[1] is currently set by
+patch_realtek.c in two different places:
+
+In alc_fill_eapd_coef(), it's set to the value 0x5757, corresponding to
+non-beep input on 1Ah and no 1Ah loopback to either headphones or
+speakers. (Although, curiously, the loopback amp is still enabled.) This
+write was added fairly recently by commit e3743f431143 ("ALSA:
+hda/realtek - Dell headphone has noise on unmute for ALC236") and is a
+safe default. However, it happens in the wrong place:
+alc_fill_eapd_coef() runs on module load and cold boot but not on S3
+resume, meaning the register loses its value after suspend.
+
+Conversely, in alc256_init(), the register is updated to unset bit 13
+(disable speaker loopback) and set bit 5 (set non-beep input on 1Ah).
+Although this write does run on S3 resume, it's not quite enough to fix
+up the register's default value of 0x3717. What's missing is a set of
+bit 14 to disable headphone loopback. Without that, we end up with a
+feedback loop where the headphone jack is being driven by amplified
+samples of itself[2].
+
+This change eliminates the update in alc256_init() and replaces it with
+the 0x5757 write from alc_fill_eapd_coef(). Kailang says that 0x5757 is
+supposed to be the codec's default value, so using it will make
+debugging easier for Realtek.
+
+Affects the ALC255, ALC256, ALC257, ALC235, and ALC236 codecs.
+
+[1] Newly documented in Documentation/sound/hd-audio/realtek-pc-beep.rst
+
+[2] Setting the "Headphone Mic Boost" control from userspace changes
+this feedback loop and has been a widely-shared workaround for headphone
+noise on laptops like the Dell XPS 13 9350. This commit eliminates the
+feedback loop and makes the workaround unnecessary.
+
+Fixes: e1e8c1fdce8b ("ALSA: hda/realtek - Dell headphone has noise on unmute for ALC236")
+Cc: stable@vger.kernel.org
+Signed-off-by: Thomas Hebb <tommyhebb@gmail.com>
+Link: https://lore.kernel.org/r/bf22b417d1f2474b12011c2a39ed6cf8b06d3bf5.1585584498.git.tommyhebb@gmail.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_realtek.c | 15 +++++++++------
+ 1 file changed, 9 insertions(+), 6 deletions(-)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -368,7 +368,9 @@ static void alc_fill_eapd_coef(struct hd
+ case 0x10ec0215:
+ case 0x10ec0233:
+ case 0x10ec0235:
++ case 0x10ec0236:
+ case 0x10ec0255:
++ case 0x10ec0256:
+ case 0x10ec0257:
+ case 0x10ec0282:
+ case 0x10ec0283:
+@@ -380,11 +382,6 @@ static void alc_fill_eapd_coef(struct hd
+ case 0x10ec0300:
+ alc_update_coef_idx(codec, 0x10, 1<<9, 0);
+ break;
+- case 0x10ec0236:
+- case 0x10ec0256:
+- alc_write_coef_idx(codec, 0x36, 0x5757);
+- alc_update_coef_idx(codec, 0x10, 1<<9, 0);
+- break;
+ case 0x10ec0275:
+ alc_update_coef_idx(codec, 0xe, 0, 1<<0);
+ break;
+@@ -3371,7 +3368,13 @@ static void alc256_init(struct hda_codec
+ alc_update_coefex_idx(codec, 0x57, 0x04, 0x0007, 0x4); /* Hight power */
+ alc_update_coefex_idx(codec, 0x53, 0x02, 0x8000, 1 << 15); /* Clear bit */
+ alc_update_coefex_idx(codec, 0x53, 0x02, 0x8000, 0 << 15);
+- alc_update_coef_idx(codec, 0x36, 1 << 13, 1 << 5); /* Switch pcbeep path to Line in path*/
++ /*
++ * Expose headphone mic (or possibly Line In on some machines) instead
++ * of PC Beep on 1Ah, and disable 1Ah loopback for all outputs. See
++ * Documentation/sound/hd-audio/realtek-pc-beep.rst for details of
++ * this register.
++ */
++ alc_write_coef_idx(codec, 0x36, 0x5757);
+ }
+
+ static void alc256_shutup(struct hda_codec *codec)
--- /dev/null
+From c47914c00be346bc5b48c48de7b0da5c2d1a296c Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Tue, 7 Apr 2020 10:44:02 +0200
+Subject: ALSA: ice1724: Fix invalid access for enumerated ctl items
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit c47914c00be346bc5b48c48de7b0da5c2d1a296c upstream.
+
+The access to Analog Capture Source control value implemented in
+prodigy_hifi.c is wrong, as caught by the recently introduced sanity
+check; it should be accessing value.enumerated.item[] instead of
+value.integer.value[]. This patch corrects the wrong access pattern.
+
+Fixes: 6b8d6e5518e2 ("[ALSA] ICE1724: Added support for Audiotrak Prodigy 7.1 HiFi & HD2, Hercules Fortissimo IV")
+BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=207139
+Reviewed-by: Jaroslav Kysela <perex@perex.cz>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20200407084402.25589-3-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/ice1712/prodigy_hifi.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/sound/pci/ice1712/prodigy_hifi.c
++++ b/sound/pci/ice1712/prodigy_hifi.c
+@@ -536,7 +536,7 @@ static int wm_adc_mux_enum_get(struct sn
+ struct snd_ice1712 *ice = snd_kcontrol_chip(kcontrol);
+
+ mutex_lock(&ice->gpio_mutex);
+- ucontrol->value.integer.value[0] = wm_get(ice, WM_ADC_MUX) & 0x1f;
++ ucontrol->value.enumerated.item[0] = wm_get(ice, WM_ADC_MUX) & 0x1f;
+ mutex_unlock(&ice->gpio_mutex);
+ return 0;
+ }
+@@ -550,7 +550,7 @@ static int wm_adc_mux_enum_put(struct sn
+
+ mutex_lock(&ice->gpio_mutex);
+ oval = wm_get(ice, WM_ADC_MUX);
+- nval = (oval & 0xe0) | ucontrol->value.integer.value[0];
++ nval = (oval & 0xe0) | ucontrol->value.enumerated.item[0];
+ if (nval != oval) {
+ wm_put(ice, WM_ADC_MUX, nval);
+ change = 1;
--- /dev/null
+From ae769d3556644888c964635179ef192995f40793 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Fri, 3 Apr 2020 09:25:15 +0200
+Subject: ALSA: pcm: oss: Fix regression by buffer overflow fix
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit ae769d3556644888c964635179ef192995f40793 upstream.
+
+The recent fix for the OOB access in PCM OSS plugins (commit
+f2ecf903ef06: "ALSA: pcm: oss: Avoid plugin buffer overflow") caused a
+regression on OSS applications. The patch introduced the size check
+in client and slave size calculations to limit to each plugin's buffer
+size, but I overlooked that some code paths call those without
+allocating the buffer but just for estimation.
+
+This patch fixes the bug by skipping the size check for those code
+paths while keeping checking in the actual transfer calls.
+
+Fixes: f2ecf903ef06 ("ALSA: pcm: oss: Avoid plugin buffer overflow")
+Tested-and-reported-by: Jari Ruusu <jari.ruusu@gmail.com>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20200403072515.25539-1-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/core/oss/pcm_plugin.c | 32 ++++++++++++++++++++++++--------
+ 1 file changed, 24 insertions(+), 8 deletions(-)
+
+--- a/sound/core/oss/pcm_plugin.c
++++ b/sound/core/oss/pcm_plugin.c
+@@ -196,7 +196,9 @@ int snd_pcm_plugin_free(struct snd_pcm_p
+ return 0;
+ }
+
+-snd_pcm_sframes_t snd_pcm_plug_client_size(struct snd_pcm_substream *plug, snd_pcm_uframes_t drv_frames)
++static snd_pcm_sframes_t plug_client_size(struct snd_pcm_substream *plug,
++ snd_pcm_uframes_t drv_frames,
++ bool check_size)
+ {
+ struct snd_pcm_plugin *plugin, *plugin_prev, *plugin_next;
+ int stream;
+@@ -209,7 +211,7 @@ snd_pcm_sframes_t snd_pcm_plug_client_si
+ if (stream == SNDRV_PCM_STREAM_PLAYBACK) {
+ plugin = snd_pcm_plug_last(plug);
+ while (plugin && drv_frames > 0) {
+- if (drv_frames > plugin->buf_frames)
++ if (check_size && drv_frames > plugin->buf_frames)
+ drv_frames = plugin->buf_frames;
+ plugin_prev = plugin->prev;
+ if (plugin->src_frames)
+@@ -222,7 +224,7 @@ snd_pcm_sframes_t snd_pcm_plug_client_si
+ plugin_next = plugin->next;
+ if (plugin->dst_frames)
+ drv_frames = plugin->dst_frames(plugin, drv_frames);
+- if (drv_frames > plugin->buf_frames)
++ if (check_size && drv_frames > plugin->buf_frames)
+ drv_frames = plugin->buf_frames;
+ plugin = plugin_next;
+ }
+@@ -231,7 +233,9 @@ snd_pcm_sframes_t snd_pcm_plug_client_si
+ return drv_frames;
+ }
+
+-snd_pcm_sframes_t snd_pcm_plug_slave_size(struct snd_pcm_substream *plug, snd_pcm_uframes_t clt_frames)
++static snd_pcm_sframes_t plug_slave_size(struct snd_pcm_substream *plug,
++ snd_pcm_uframes_t clt_frames,
++ bool check_size)
+ {
+ struct snd_pcm_plugin *plugin, *plugin_prev, *plugin_next;
+ snd_pcm_sframes_t frames;
+@@ -252,14 +256,14 @@ snd_pcm_sframes_t snd_pcm_plug_slave_siz
+ if (frames < 0)
+ return frames;
+ }
+- if (frames > plugin->buf_frames)
++ if (check_size && frames > plugin->buf_frames)
+ frames = plugin->buf_frames;
+ plugin = plugin_next;
+ }
+ } else if (stream == SNDRV_PCM_STREAM_CAPTURE) {
+ plugin = snd_pcm_plug_last(plug);
+ while (plugin) {
+- if (frames > plugin->buf_frames)
++ if (check_size && frames > plugin->buf_frames)
+ frames = plugin->buf_frames;
+ plugin_prev = plugin->prev;
+ if (plugin->src_frames) {
+@@ -274,6 +278,18 @@ snd_pcm_sframes_t snd_pcm_plug_slave_siz
+ return frames;
+ }
+
++snd_pcm_sframes_t snd_pcm_plug_client_size(struct snd_pcm_substream *plug,
++ snd_pcm_uframes_t drv_frames)
++{
++ return plug_client_size(plug, drv_frames, false);
++}
++
++snd_pcm_sframes_t snd_pcm_plug_slave_size(struct snd_pcm_substream *plug,
++ snd_pcm_uframes_t clt_frames)
++{
++ return plug_slave_size(plug, clt_frames, false);
++}
++
+ static int snd_pcm_plug_formats(const struct snd_mask *mask,
+ snd_pcm_format_t format)
+ {
+@@ -630,7 +646,7 @@ snd_pcm_sframes_t snd_pcm_plug_write_tra
+ src_channels = dst_channels;
+ plugin = next;
+ }
+- return snd_pcm_plug_client_size(plug, frames);
++ return plug_client_size(plug, frames, true);
+ }
+
+ snd_pcm_sframes_t snd_pcm_plug_read_transfer(struct snd_pcm_substream *plug, struct snd_pcm_plugin_channel *dst_channels_final, snd_pcm_uframes_t size)
+@@ -640,7 +656,7 @@ snd_pcm_sframes_t snd_pcm_plug_read_tran
+ snd_pcm_sframes_t frames = size;
+ int err;
+
+- frames = snd_pcm_plug_slave_size(plug, frames);
++ frames = plug_slave_size(plug, frames, true);
+ if (frames < 0)
+ return frames;
+
--- /dev/null
+From 2a48218f8e23d47bd3e23cfdfb8aa9066f7dc3e6 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Wed, 8 Apr 2020 16:04:48 +0200
+Subject: ALSA: usb-audio: Add mixer workaround for TRX40 and co
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 2a48218f8e23d47bd3e23cfdfb8aa9066f7dc3e6 upstream.
+
+Some recent boards (supposedly with a new AMD platform) contain the
+USB audio class 2 device that is often tied with HD-audio. The device
+exposes an Input Gain Pad control (id=19, control=12) but this node
+doesn't behave correctly, returning an error for each inquiry of
+GET_MIN and GET_MAX that should have been mandatory.
+
+As a workaround, simply ignore this node by adding a usbmix_name_map
+table entry. The currently known devices are:
+* 0414:a002 - Gigabyte TRX40 Aorus Pro WiFi
+* 0b05:1916 - ASUS ROG Zenith II
+* 0b05:1917 - ASUS ROG Strix
+* 0db0:0d64 - MSI TRX40 Creator
+* 0db0:543d - MSI TRX40
+
+BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=206543
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20200408140449.22319-1-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/usb/mixer_maps.c | 28 ++++++++++++++++++++++++++++
+ 1 file changed, 28 insertions(+)
+
+--- a/sound/usb/mixer_maps.c
++++ b/sound/usb/mixer_maps.c
+@@ -349,6 +349,14 @@ static const struct usbmix_name_map dell
+ { 0 }
+ };
+
++/* Some mobos shipped with a dummy HD-audio show the invalid GET_MIN/GET_MAX
++ * response for Input Gain Pad (id=19, control=12). Skip it.
++ */
++static const struct usbmix_name_map asus_rog_map[] = {
++ { 19, NULL, 12 }, /* FU, Input Gain Pad */
++ {}
++};
++
+ /*
+ * Control map entries
+ */
+@@ -468,6 +476,26 @@ static struct usbmix_ctl_map usbmix_ctl_
+ .id = USB_ID(0x05a7, 0x1020),
+ .map = bose_companion5_map,
+ },
++ { /* Gigabyte TRX40 Aorus Pro WiFi */
++ .id = USB_ID(0x0414, 0xa002),
++ .map = asus_rog_map,
++ },
++ { /* ASUS ROG Zenith II */
++ .id = USB_ID(0x0b05, 0x1916),
++ .map = asus_rog_map,
++ },
++ { /* ASUS ROG Strix */
++ .id = USB_ID(0x0b05, 0x1917),
++ .map = asus_rog_map,
++ },
++ { /* MSI TRX40 Creator */
++ .id = USB_ID(0x0db0, 0x0d64),
++ .map = asus_rog_map,
++ },
++ { /* MSI TRX40 */
++ .id = USB_ID(0x0db0, 0x543d),
++ .map = asus_rog_map,
++ },
+ { 0 } /* terminator */
+ };
+
--- /dev/null
+From e34bca49e4953e5c2afc0425303199a5fd515f82 Mon Sep 17 00:00:00 2001
+From: Andrzej Pietrasiewicz <andrzej.p@collabora.com>
+Date: Mon, 27 Jan 2020 15:30:06 +0100
+Subject: media: hantro: Read be32 words starting at every fourth byte
+
+From: Andrzej Pietrasiewicz <andrzej.p@collabora.com>
+
+commit e34bca49e4953e5c2afc0425303199a5fd515f82 upstream.
+
+Since (luma/chroma)_qtable is an array of unsigned char, indexing it
+returns consecutive byte locations, but we are supposed to read the arrays
+in four-byte words. Consequently, we should be pointing
+get_unaligned_be32() at consecutive word locations instead.
+
+Signed-off-by: Andrzej Pietrasiewicz <andrzej.p@collabora.com>
+Reviewed-by: Ezequiel Garcia <ezequiel@collabora.com>
+Tested-by: Ezequiel Garcia <ezequiel@collabora.com>
+Cc: stable@vger.kernel.org
+Fixes: 00c30f42c7595f "media: rockchip vpu: remove some unused vars"
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/media/hantro/hantro_h1_jpeg_enc.c | 9 +++++++--
+ drivers/staging/media/hantro/rk3399_vpu_hw_jpeg_enc.c | 9 +++++++--
+ 2 files changed, 14 insertions(+), 4 deletions(-)
+
+--- a/drivers/staging/media/hantro/hantro_h1_jpeg_enc.c
++++ b/drivers/staging/media/hantro/hantro_h1_jpeg_enc.c
+@@ -67,12 +67,17 @@ hantro_h1_jpeg_enc_set_qtable(struct han
+ unsigned char *chroma_qtable)
+ {
+ u32 reg, i;
++ __be32 *luma_qtable_p;
++ __be32 *chroma_qtable_p;
++
++ luma_qtable_p = (__be32 *)luma_qtable;
++ chroma_qtable_p = (__be32 *)chroma_qtable;
+
+ for (i = 0; i < H1_JPEG_QUANT_TABLE_COUNT; i++) {
+- reg = get_unaligned_be32(&luma_qtable[i]);
++ reg = get_unaligned_be32(&luma_qtable_p[i]);
+ vepu_write_relaxed(vpu, reg, H1_REG_JPEG_LUMA_QUAT(i));
+
+- reg = get_unaligned_be32(&chroma_qtable[i]);
++ reg = get_unaligned_be32(&chroma_qtable_p[i]);
+ vepu_write_relaxed(vpu, reg, H1_REG_JPEG_CHROMA_QUAT(i));
+ }
+ }
+--- a/drivers/staging/media/hantro/rk3399_vpu_hw_jpeg_enc.c
++++ b/drivers/staging/media/hantro/rk3399_vpu_hw_jpeg_enc.c
+@@ -98,12 +98,17 @@ rk3399_vpu_jpeg_enc_set_qtable(struct ha
+ unsigned char *chroma_qtable)
+ {
+ u32 reg, i;
++ __be32 *luma_qtable_p;
++ __be32 *chroma_qtable_p;
++
++ luma_qtable_p = (__be32 *)luma_qtable;
++ chroma_qtable_p = (__be32 *)chroma_qtable;
+
+ for (i = 0; i < VEPU_JPEG_QUANT_TABLE_COUNT; i++) {
+- reg = get_unaligned_be32(&luma_qtable[i]);
++ reg = get_unaligned_be32(&luma_qtable_p[i]);
+ vepu_write_relaxed(vpu, reg, VEPU_REG_JPEG_LUMA_QUAT(i));
+
+- reg = get_unaligned_be32(&chroma_qtable[i]);
++ reg = get_unaligned_be32(&chroma_qtable_p[i]);
+ vepu_write_relaxed(vpu, reg, VEPU_REG_JPEG_CHROMA_QUAT(i));
+ }
+ }
--- /dev/null
+From 80264809ea0a3fd2ee8251f31a9eb85d2c3fc77e Mon Sep 17 00:00:00 2001
+From: Benoit Parrot <bparrot@ti.com>
+Date: Fri, 6 Mar 2020 14:08:39 +0100
+Subject: media: ti-vpe: cal: fix a kernel oops when unloading module
+
+From: Benoit Parrot <bparrot@ti.com>
+
+commit 80264809ea0a3fd2ee8251f31a9eb85d2c3fc77e upstream.
+
+After the switch to use v4l2_async_notifier_add_subdev() and
+v4l2_async_notifier_cleanup(), unloading the ti_cal module would cause a
+kernel oops.
+
+This was root cause to the fact that v4l2_async_notifier_cleanup() tries
+to kfree the asd pointer passed into v4l2_async_notifier_add_subdev().
+
+In our case the asd reference was from a statically allocated struct.
+So in effect v4l2_async_notifier_cleanup() was trying to free a pointer
+that was not kalloc.
+
+So here we switch to using a kzalloc struct instead of a static one.
+To achieve this we re-order some of the calls to prevent asd allocation
+from leaking.
+
+Fixes: d079f94c9046 ("media: platform: Switch to v4l2_async_notifier_add_subdev")
+Cc: stable@vger.kernel.org
+Signed-off-by: Benoit Parrot <bparrot@ti.com>
+Reviewed-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/platform/ti-vpe/cal.c | 13 ++++++++-----
+ 1 file changed, 8 insertions(+), 5 deletions(-)
+
+--- a/drivers/media/platform/ti-vpe/cal.c
++++ b/drivers/media/platform/ti-vpe/cal.c
+@@ -266,8 +266,6 @@ struct cal_ctx {
+ struct v4l2_subdev *sensor;
+ struct v4l2_fwnode_endpoint endpoint;
+
+- struct v4l2_async_subdev asd;
+-
+ struct v4l2_fh fh;
+ struct cal_dev *dev;
+ struct cc_data *cc;
+@@ -1648,7 +1646,6 @@ static int of_cal_create_instance(struct
+
+ parent = pdev->dev.of_node;
+
+- asd = &ctx->asd;
+ endpoint = &ctx->endpoint;
+
+ ep_node = NULL;
+@@ -1695,8 +1692,6 @@ static int of_cal_create_instance(struct
+ ctx_dbg(3, ctx, "can't get remote parent\n");
+ goto cleanup_exit;
+ }
+- asd->match_type = V4L2_ASYNC_MATCH_FWNODE;
+- asd->match.fwnode = of_fwnode_handle(sensor_node);
+
+ v4l2_fwnode_endpoint_parse(of_fwnode_handle(ep_node), endpoint);
+
+@@ -1726,9 +1721,17 @@ static int of_cal_create_instance(struct
+
+ v4l2_async_notifier_init(&ctx->notifier);
+
++ asd = kzalloc(sizeof(*asd), GFP_KERNEL);
++ if (!asd)
++ goto cleanup_exit;
++
++ asd->match_type = V4L2_ASYNC_MATCH_FWNODE;
++ asd->match.fwnode = of_fwnode_handle(sensor_node);
++
+ ret = v4l2_async_notifier_add_subdev(&ctx->notifier, asd);
+ if (ret) {
+ ctx_err(ctx, "Error adding asd\n");
++ kfree(asd);
+ goto cleanup_exit;
+ }
+
--- /dev/null
+From 1db56284b9da9056093681f28db48a09a243274b Mon Sep 17 00:00:00 2001
+From: Benoit Parrot <bparrot@ti.com>
+Date: Mon, 2 Mar 2020 14:56:52 +0100
+Subject: media: ti-vpe: cal: fix disable_irqs to only the intended target
+
+From: Benoit Parrot <bparrot@ti.com>
+
+commit 1db56284b9da9056093681f28db48a09a243274b upstream.
+
+disable_irqs() was mistakenly disabling all interrupts when called.
+This cause all port stream to stop even if only stopping one of them.
+
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Benoit Parrot <bparrot@ti.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/platform/ti-vpe/cal.c | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+--- a/drivers/media/platform/ti-vpe/cal.c
++++ b/drivers/media/platform/ti-vpe/cal.c
+@@ -537,16 +537,16 @@ static void enable_irqs(struct cal_ctx *
+
+ static void disable_irqs(struct cal_ctx *ctx)
+ {
++ u32 val;
++
+ /* Disable IRQ_WDMA_END 0/1 */
+- reg_write_field(ctx->dev,
+- CAL_HL_IRQENABLE_CLR(2),
+- CAL_HL_IRQ_CLEAR,
+- CAL_HL_IRQ_MASK(ctx->csi2_port));
++ val = 0;
++ set_field(&val, CAL_HL_IRQ_CLEAR, CAL_HL_IRQ_MASK(ctx->csi2_port));
++ reg_write(ctx->dev, CAL_HL_IRQENABLE_CLR(2), val);
+ /* Disable IRQ_WDMA_START 0/1 */
+- reg_write_field(ctx->dev,
+- CAL_HL_IRQENABLE_CLR(3),
+- CAL_HL_IRQ_CLEAR,
+- CAL_HL_IRQ_MASK(ctx->csi2_port));
++ val = 0;
++ set_field(&val, CAL_HL_IRQ_CLEAR, CAL_HL_IRQ_MASK(ctx->csi2_port));
++ reg_write(ctx->dev, CAL_HL_IRQENABLE_CLR(3), val);
+ /* Todo: Add VC_IRQ and CSI2_COMPLEXIO_IRQ handling */
+ reg_write(ctx->dev, CAL_CSI2_VC_IRQENABLE(1), 0);
+ }
--- /dev/null
+From 2632e7b618a7730969f9782593c29ca53553aa22 Mon Sep 17 00:00:00 2001
+From: Stanimir Varbanov <stanimir.varbanov@linaro.org>
+Date: Wed, 4 Mar 2020 11:09:49 +0100
+Subject: media: venus: firmware: Ignore secure call error on first resume
+
+From: Stanimir Varbanov <stanimir.varbanov@linaro.org>
+
+commit 2632e7b618a7730969f9782593c29ca53553aa22 upstream.
+
+With the latest cleanup in qcom scm driver the secure monitor
+call for setting the remote processor state returns EINVAL when
+it is called for the first time and after another scm call
+auth_and_reset. The error returned from scm call could be ignored
+because the state transition is already done in auth_and_reset.
+
+Acked-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Stanimir Varbanov <stanimir.varbanov@linaro.org>
+Cc: stable@vger.kernel.org
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/platform/qcom/venus/firmware.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+--- a/drivers/media/platform/qcom/venus/firmware.c
++++ b/drivers/media/platform/qcom/venus/firmware.c
+@@ -44,8 +44,14 @@ static void venus_reset_cpu(struct venus
+
+ int venus_set_hw_state(struct venus_core *core, bool resume)
+ {
+- if (core->use_tz)
+- return qcom_scm_set_remote_state(resume, 0);
++ int ret;
++
++ if (core->use_tz) {
++ ret = qcom_scm_set_remote_state(resume, 0);
++ if (resume && ret == -EINVAL)
++ ret = 0;
++ return ret;
++ }
+
+ if (resume)
+ venus_reset_cpu(core);
asoc-dapm-connect-virtual-mux-with-default-value.patch
asoc-dpcm-allow-start-or-stop-during-pause-for-backend.patch
asoc-topology-use-name_prefix-for-new-kcontrol.patch
+usb-gadget-f_fs-fix-use-after-free-issue-as-part-of-queue-failure.patch
+usb-gadget-composite-inform-controller-driver-of-self-powered.patch
+alsa-usb-audio-add-mixer-workaround-for-trx40-and-co.patch
+alsa-hda-add-driver-blacklist.patch
+alsa-hda-fix-potential-access-overflow-in-beep-helper.patch
+alsa-ice1724-fix-invalid-access-for-enumerated-ctl-items.patch
+alsa-pcm-oss-fix-regression-by-buffer-overflow-fix.patch
+alsa-hda-realtek-enable-mute-led-on-an-hp-system.patch
+alsa-hda-realtek-a-fake-key-event-is-triggered-by-running-shutup.patch
+alsa-doc-document-pc-beep-hidden-register-on-realtek-alc256.patch
+alsa-hda-realtek-set-principled-pc-beep-configuration-for-alc256.patch
+alsa-hda-realtek-remove-now-unnecessary-xps-13-headphone-noise-fixups.patch
+alsa-hda-realtek-add-quirk-for-lenovo-carbon-x1-8th-gen.patch
+alsa-hda-realtek-add-quirk-for-msi-gl63.patch
+media-venus-firmware-ignore-secure-call-error-on-first-resume.patch
+media-hantro-read-be32-words-starting-at-every-fourth-byte.patch
+media-ti-vpe-cal-fix-disable_irqs-to-only-the-intended-target.patch
+media-ti-vpe-cal-fix-a-kernel-oops-when-unloading-module.patch
--- /dev/null
+From 5e5caf4fa8d3039140b4548b6ab23dd17fce9b2c Mon Sep 17 00:00:00 2001
+From: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+Date: Mon, 3 Feb 2020 18:05:32 -0800
+Subject: usb: gadget: composite: Inform controller driver of self-powered
+
+From: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+
+commit 5e5caf4fa8d3039140b4548b6ab23dd17fce9b2c upstream.
+
+Different configuration/condition may draw different power. Inform the
+controller driver of the change so it can respond properly (e.g.
+GET_STATUS request). This fixes an issue with setting MaxPower from
+configfs. The composite driver doesn't check this value when setting
+self-powered.
+
+Cc: stable@vger.kernel.org
+Fixes: 88af8bbe4ef7 ("usb: gadget: the start of the configfs interface")
+Signed-off-by: Thinh Nguyen <thinhn@synopsys.com>
+Signed-off-by: Felipe Balbi <balbi@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/gadget/composite.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/drivers/usb/gadget/composite.c
++++ b/drivers/usb/gadget/composite.c
+@@ -861,6 +861,11 @@ static int set_config(struct usb_composi
+ else
+ power = min(power, 900U);
+ done:
++ if (power <= USB_SELF_POWER_VBUS_MAX_DRAW)
++ usb_gadget_set_selfpowered(gadget);
++ else
++ usb_gadget_clear_selfpowered(gadget);
++
+ usb_gadget_vbus_draw(gadget, power);
+ if (result >= 0 && cdev->delayed_status)
+ result = USB_GADGET_DELAYED_STATUS;
+@@ -2279,6 +2284,7 @@ void composite_suspend(struct usb_gadget
+
+ cdev->suspended = 1;
+
++ usb_gadget_set_selfpowered(gadget);
+ usb_gadget_vbus_draw(gadget, 2);
+ }
+
+@@ -2307,6 +2313,9 @@ void composite_resume(struct usb_gadget
+ else
+ maxpower = min(maxpower, 900U);
+
++ if (maxpower > USB_SELF_POWER_VBUS_MAX_DRAW)
++ usb_gadget_clear_selfpowered(gadget);
++
+ usb_gadget_vbus_draw(gadget, maxpower);
+ }
+
--- /dev/null
+From f63ec55ff904b2f2e126884fcad93175f16ab4bb Mon Sep 17 00:00:00 2001
+From: Sriharsha Allenki <sallenki@codeaurora.org>
+Date: Thu, 26 Mar 2020 17:26:20 +0530
+Subject: usb: gadget: f_fs: Fix use after free issue as part of queue failure
+
+From: Sriharsha Allenki <sallenki@codeaurora.org>
+
+commit f63ec55ff904b2f2e126884fcad93175f16ab4bb upstream.
+
+In AIO case, the request is freed up if ep_queue fails.
+However, io_data->req still has the reference to this freed
+request. In the case of this failure if there is aio_cancel
+call on this io_data it will lead to an invalid dequeue
+operation and a potential use after free issue.
+Fix this by setting the io_data->req to NULL when the request
+is freed as part of queue failure.
+
+Fixes: 2e4c7553cd6f ("usb: gadget: f_fs: add aio support")
+Signed-off-by: Sriharsha Allenki <sallenki@codeaurora.org>
+CC: stable <stable@vger.kernel.org>
+Reviewed-by: Peter Chen <peter.chen@nxp.com>
+Link: https://lore.kernel.org/r/20200326115620.12571-1-sallenki@codeaurora.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/gadget/function/f_fs.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/usb/gadget/function/f_fs.c
++++ b/drivers/usb/gadget/function/f_fs.c
+@@ -1120,6 +1120,7 @@ static ssize_t ffs_epfile_io(struct file
+
+ ret = usb_ep_queue(ep->ep, req, GFP_ATOMIC);
+ if (unlikely(ret)) {
++ io_data->req = NULL;
+ usb_ep_free_request(ep->ep, req);
+ goto error_lock;
+ }
projects / thirdparty / kernel / stable-queue.git / commitdiff
