--- /dev/null
+From 2b987fe84429361c7f189568c476d1bd00d2ff7e Mon Sep 17 00:00:00 2001
+From: Chris Chiu <chris.chiu@canonical.com>
+Date: Fri, 1 Oct 2021 14:28:56 +0800
+Subject: ALSA: hda - Enable headphone mic on Dell Latitude laptops with ALC3254
+
+From: Chris Chiu <chris.chiu@canonical.com>
+
+commit 2b987fe84429361c7f189568c476d1bd00d2ff7e upstream.
+
+The headphone mic is not working on Dell Latitude laptops with ALC3254.
+The codec vendor id is 0x10ec0295 and share the same pincfg as defined
+in ALC295_STANDARD_PINS. So the ALC269_FIXUP_DELL1_MIC_NO_PRESENCE will
+be applied per alc269_pin_fixup_tbl[] but actually the headphone mic is
+using NID 0x1b instead of 0x1a. The ALC269_FIXUP_DELL4_MIC_NO_PRESENCE
+need to be applied instead.
+
+Use ALC269_FIXUP_DELL4_MIC_NO_PRESENCE for particular models before
+a generic fixup comes out.
+
+Signed-off-by: Chris Chiu <chris.chiu@canonical.com>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20211001062856.1037901-1-chris.chiu@canonical.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/pci/hda/patch_realtek.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -8392,6 +8392,8 @@ static const struct snd_pci_quirk alc269
+ SND_PCI_QUIRK(0x1028, 0x0a58, "Dell", ALC255_FIXUP_DELL_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1028, 0x0a61, "Dell XPS 15 9510", ALC289_FIXUP_DUAL_SPK),
+ SND_PCI_QUIRK(0x1028, 0x0a62, "Dell Precision 5560", ALC289_FIXUP_DUAL_SPK),
++ SND_PCI_QUIRK(0x1028, 0x0a9d, "Dell Latitude 5430", ALC269_FIXUP_DELL4_MIC_NO_PRESENCE),
++ SND_PCI_QUIRK(0x1028, 0x0a9e, "Dell Latitude 5430", ALC269_FIXUP_DELL4_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1028, 0x164a, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1028, 0x164b, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x103c, 0x1586, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC2),
--- /dev/null
+From cc03069a397005da24f6783835c274d5aedf6043 Mon Sep 17 00:00:00 2001
+From: Werner Sembach <wse@tuxedocomputers.com>
+Date: Fri, 1 Oct 2021 15:31:11 +0200
+Subject: ALSA: hda/realtek: Add quirk for Clevo X170KM-G
+
+From: Werner Sembach <wse@tuxedocomputers.com>
+
+commit cc03069a397005da24f6783835c274d5aedf6043 upstream.
+
+This applies a SND_PCI_QUIRK(...) to the Clevo X170KM-G barebone. This
+fixes the issue of the devices internal Speaker not working.
+
+Signed-off-by: Werner Sembach <wse@tuxedocomputers.com>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20211001133111.428249-3-wse@tuxedocomputers.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/pci/hda/patch_realtek.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -2550,6 +2550,7 @@ static const struct snd_pci_quirk alc882
+ SND_PCI_QUIRK(0x1558, 0x67e5, "Clevo PC70D[PRS](?:-D|-G)?", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
+ SND_PCI_QUIRK(0x1558, 0x70d1, "Clevo PC70[ER][CDF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
+ SND_PCI_QUIRK(0x1558, 0x7714, "Clevo X170SM", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
++ SND_PCI_QUIRK(0x1558, 0x7715, "Clevo X170KM-G", ALC1220_FIXUP_CLEVO_PB51ED),
+ SND_PCI_QUIRK(0x1558, 0x9501, "Clevo P950HR", ALC1220_FIXUP_CLEVO_P950),
+ SND_PCI_QUIRK(0x1558, 0x9506, "Clevo P955HQ", ALC1220_FIXUP_CLEVO_P950),
+ SND_PCI_QUIRK(0x1558, 0x950a, "Clevo P955H[PR]", ALC1220_FIXUP_CLEVO_P950),
--- /dev/null
+From dd6dd6e3c791db7fdbc5433ec7e450717aa3a0ce Mon Sep 17 00:00:00 2001
+From: Werner Sembach <wse@tuxedocomputers.com>
+Date: Wed, 6 Oct 2021 15:04:15 +0200
+Subject: ALSA: hda/realtek: Add quirk for TongFang PHxTxX1
+
+From: Werner Sembach <wse@tuxedocomputers.com>
+
+commit dd6dd6e3c791db7fdbc5433ec7e450717aa3a0ce upstream.
+
+This applies a SND_PCI_QUIRK(...) to the TongFang PHxTxX1 barebone. This
+fixes the issue of the internal Microphone not working after booting
+another OS.
+
+When booting a certain another OS this barebone keeps some coeff settings
+even after a cold shutdown. These coeffs prevent the microphone detection
+from working in Linux, making the Laptop think that there is always an
+external microphone plugged-in and therefore preventing the use of the
+internal one.
+
+The relevant indexes and values where gathered by naively diff-ing and
+reading a working and a non-working coeff dump.
+
+Signed-off-by: Werner Sembach <wse@tuxedocomputers.com>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20211006130415.538243-1-wse@tuxedocomputers.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/pci/hda/patch_realtek.c | 26 +++++++++++++++++++++++++-
+ 1 file changed, 25 insertions(+), 1 deletion(-)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -6399,6 +6399,24 @@ static void alc287_fixup_legion_15imhg05
+ /* for alc285_fixup_ideapad_s740_coef() */
+ #include "ideapad_s740_helper.c"
+
++static void alc256_fixup_tongfang_reset_persistent_settings(struct hda_codec *codec,
++ const struct hda_fixup *fix,
++ int action)
++{
++ /*
++ * A certain other OS sets these coeffs to different values. On at least one TongFang
++ * barebone these settings might survive even a cold reboot. So to restore a clean slate the
++ * values are explicitly reset to default here. Without this, the external microphone is
++ * always in a plugged-in state, while the internal microphone is always in an unplugged
++ * state, breaking the ability to use the internal microphone.
++ */
++ alc_write_coef_idx(codec, 0x24, 0x0000);
++ alc_write_coef_idx(codec, 0x26, 0x0000);
++ alc_write_coef_idx(codec, 0x29, 0x3000);
++ alc_write_coef_idx(codec, 0x37, 0xfe05);
++ alc_write_coef_idx(codec, 0x45, 0x5089);
++}
++
+ enum {
+ ALC269_FIXUP_GPIO2,
+ ALC269_FIXUP_SONY_VAIO,
+@@ -6612,7 +6630,8 @@ enum {
+ ALC287_FIXUP_LEGION_15IMHG05_SPEAKERS,
+ ALC287_FIXUP_LEGION_15IMHG05_AUTOMUTE,
+ ALC287_FIXUP_YOGA7_14ITL_SPEAKERS,
+- ALC287_FIXUP_13S_GEN2_SPEAKERS
++ ALC287_FIXUP_13S_GEN2_SPEAKERS,
++ ALC256_FIXUP_TONGFANG_RESET_PERSISTENT_SETTINGS,
+ };
+
+ static const struct hda_fixup alc269_fixups[] = {
+@@ -8304,6 +8323,10 @@ static const struct hda_fixup alc269_fix
+ .chained = true,
+ .chain_id = ALC269_FIXUP_HEADSET_MODE,
+ },
++ [ALC256_FIXUP_TONGFANG_RESET_PERSISTENT_SETTINGS] = {
++ .type = HDA_FIXUP_FUNC,
++ .v.func = alc256_fixup_tongfang_reset_persistent_settings,
++ },
+ };
+
+ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+@@ -8733,6 +8756,7 @@ static const struct snd_pci_quirk alc269
+ SND_PCI_QUIRK(0x1b7d, 0xa831, "Ordissimo EVE2 ", ALC269VB_FIXUP_ORDISSIMO_EVE2), /* Also known as Malata PC-B1303 */
+ SND_PCI_QUIRK(0x1c06, 0x2013, "Lemote A1802", ALC269_FIXUP_LEMOTE_A1802),
+ SND_PCI_QUIRK(0x1c06, 0x2015, "Lemote A190X", ALC269_FIXUP_LEMOTE_A190X),
++ SND_PCI_QUIRK(0x1d05, 0x1132, "TongFang PHxTxX1", ALC256_FIXUP_TONGFANG_RESET_PERSISTENT_SETTINGS),
+ SND_PCI_QUIRK(0x1d72, 0x1602, "RedmiBook", ALC255_FIXUP_XIAOMI_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1d72, 0x1701, "XiaomiNotebook Pro", ALC298_FIXUP_DELL1_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1d72, 0x1901, "RedmiBook 14", ALC256_FIXUP_ASUS_HEADSET_MIC),
--- /dev/null
+From 5aec98913095ed3b4424ed6c5fdeb6964e9734da Mon Sep 17 00:00:00 2001
+From: Kailang Yang <kailang@realtek.com>
+Date: Tue, 5 Oct 2021 14:35:14 +0800
+Subject: ALSA: hda/realtek - ALC236 headset MIC recording issue
+
+From: Kailang Yang <kailang@realtek.com>
+
+commit 5aec98913095ed3b4424ed6c5fdeb6964e9734da upstream.
+
+In power save mode, the recording voice from headset mic will 2s more delay.
+Add this patch will solve this issue.
+
+[ minor coding style fix by tiwai ]
+
+Signed-off-by: Kailang Yang <kailang@realtek.com>
+Tested-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/ccb0cdd5bbd7486eabbd8d987d384cb0@realtek.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/pci/hda/patch_realtek.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -527,6 +527,8 @@ static void alc_shutup_pins(struct hda_c
+ struct alc_spec *spec = codec->spec;
+
+ switch (codec->core.vendor_id) {
++ case 0x10ec0236:
++ case 0x10ec0256:
+ case 0x10ec0283:
+ case 0x10ec0286:
+ case 0x10ec0288:
+@@ -3532,7 +3534,8 @@ static void alc256_shutup(struct hda_cod
+ /* If disable 3k pulldown control for alc257, the Mic detection will not work correctly
+ * when booting with headset plugged. So skip setting it for the codec alc257
+ */
+- if (codec->core.vendor_id != 0x10ec0257)
++ if (spec->codec_variant != ALC269_TYPE_ALC257 &&
++ spec->codec_variant != ALC269_TYPE_ALC256)
+ alc_update_coef_idx(codec, 0x46, 0, 3 << 12);
+
+ if (!spec->no_shutup_pins)
--- /dev/null
+From 1f8d398e1cd8813f8ec16d55c086e8270a9c18ab Mon Sep 17 00:00:00 2001
+From: Werner Sembach <wse@tuxedocomputers.com>
+Date: Fri, 1 Oct 2021 15:31:10 +0200
+Subject: ALSA: hda/realtek: Complete partial device name to avoid ambiguity
+
+From: Werner Sembach <wse@tuxedocomputers.com>
+
+commit 1f8d398e1cd8813f8ec16d55c086e8270a9c18ab upstream.
+
+The string "Clevo X170" is not enough to unambiguously identify the correct
+device.
+
+Fixing it so another Clevo barebone name starting with "X170" can be added
+without causing confusion.
+
+Signed-off-by: Werner Sembach <wse@tuxedocomputers.com>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20211001133111.428249-2-wse@tuxedocomputers.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/pci/hda/patch_realtek.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -2549,7 +2549,7 @@ static const struct snd_pci_quirk alc882
+ SND_PCI_QUIRK(0x1558, 0x67e1, "Clevo PB71[DE][CDF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
+ SND_PCI_QUIRK(0x1558, 0x67e5, "Clevo PC70D[PRS](?:-D|-G)?", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
+ SND_PCI_QUIRK(0x1558, 0x70d1, "Clevo PC70[ER][CDF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
+- SND_PCI_QUIRK(0x1558, 0x7714, "Clevo X170", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
++ SND_PCI_QUIRK(0x1558, 0x7714, "Clevo X170SM", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
+ SND_PCI_QUIRK(0x1558, 0x9501, "Clevo P950HR", ALC1220_FIXUP_CLEVO_P950),
+ SND_PCI_QUIRK(0x1558, 0x9506, "Clevo P955HQ", ALC1220_FIXUP_CLEVO_P950),
+ SND_PCI_QUIRK(0x1558, 0x950a, "Clevo P955H[PR]", ALC1220_FIXUP_CLEVO_P950),
--- /dev/null
+From eb676622846b34a751e2ff9b5910a5322a4e0000 Mon Sep 17 00:00:00 2001
+From: John Liu <johnliu55tw@gmail.com>
+Date: Thu, 30 Sep 2021 13:53:16 +0200
+Subject: ALSA: hda/realtek: Enable 4-speaker output for Dell Precision 5560 laptop
+
+From: John Liu <johnliu55tw@gmail.com>
+
+commit eb676622846b34a751e2ff9b5910a5322a4e0000 upstream.
+
+The Dell Precision 5560 laptop appears to use the 4-speakers-on-ALC289
+audio just like its sibling product XPS 9510, so it requires the same
+quirk to enable woofer output. Tested on my Dell Precision 5560.
+
+Signed-off-by: John Liu <johnliu55tw@gmail.com>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20210930115316.659-1-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/pci/hda/patch_realtek.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -8391,6 +8391,7 @@ static const struct snd_pci_quirk alc269
+ SND_PCI_QUIRK(0x1028, 0x0a30, "Dell", ALC236_FIXUP_DELL_AIO_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1028, 0x0a58, "Dell", ALC255_FIXUP_DELL_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1028, 0x0a61, "Dell XPS 15 9510", ALC289_FIXUP_DUAL_SPK),
++ SND_PCI_QUIRK(0x1028, 0x0a62, "Dell Precision 5560", ALC289_FIXUP_DUAL_SPK),
+ SND_PCI_QUIRK(0x1028, 0x164a, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1028, 0x164b, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x103c, 0x1586, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC2),
--- /dev/null
+From 023a062f238129e8a542b5163c4350ceb076283e Mon Sep 17 00:00:00 2001
+From: Cameron Berkenpas <cam@neo-zeon.de>
+Date: Sun, 10 Oct 2021 15:54:11 -0700
+Subject: ALSA: hda/realtek: Fix for quirk to enable speaker output on the Lenovo 13s Gen2
+
+From: Cameron Berkenpas <cam@neo-zeon.de>
+
+commit 023a062f238129e8a542b5163c4350ceb076283e upstream.
+
+The previous patch's HDA verb initialization for the Lenovo 13s
+sequence was slightly off. This updated verb sequence has been tested
+and confirmed working.
+
+Fixes: ad7cc2d41b7a ("ALSA: hda/realtek: Quirks to enable speaker output for Lenovo Legion 7i 15IMHG05, Yoga 7i 14ITL5/15ITL5, and 13s Gen2 laptops.")
+BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=208555
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Cameron Berkenpas <cam@neo-zeon.de>
+Link: https://lore.kernel.org/r/20211010225410.23423-1-cam@neo-zeon.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/pci/hda/patch_realtek.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -8306,7 +8306,7 @@ static const struct hda_fixup alc269_fix
+ .v.verbs = (const struct hda_verb[]) {
+ { 0x20, AC_VERB_SET_COEF_INDEX, 0x24 },
+ { 0x20, AC_VERB_SET_PROC_COEF, 0x41 },
+- { 0x20, AC_VERB_SET_PROC_COEF, 0xb020 },
++ { 0x20, AC_VERB_SET_COEF_INDEX, 0x26 },
+ { 0x20, AC_VERB_SET_PROC_COEF, 0x2 },
+ { 0x20, AC_VERB_SET_PROC_COEF, 0x0 },
+ { 0x20, AC_VERB_SET_PROC_COEF, 0x0 },
--- /dev/null
+From a3fd1a986e499a06ac5ef95c3a39aa4611e7444c Mon Sep 17 00:00:00 2001
+From: Hui Wang <hui.wang@canonical.com>
+Date: Tue, 12 Oct 2021 19:47:48 +0800
+Subject: ALSA: hda/realtek: Fix the mic type detection issue for ASUS G551JW
+
+From: Hui Wang <hui.wang@canonical.com>
+
+commit a3fd1a986e499a06ac5ef95c3a39aa4611e7444c upstream.
+
+We need to define the codec pin 0x1b to be the mic, but somehow
+the mic doesn't support hot plugging detection, and Windows also has
+this issue, so we set it to phantom headset-mic.
+
+Also the determine_headset_type() often returns the omtp type by a
+mistake when we plug a ctia headset, this makes the mic can't record
+sound at all. Because most of the headset are ctia type nowadays and
+some machines have the fixed ctia type audio jack, it is possible this
+machine has the fixed ctia jack too. Here we set this mic jack to
+fixed ctia type, this could avoid the mic type detection mistake and
+make the ctia headset work stable.
+
+BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=214537
+Reported-and-tested-by: msd <msd.mmq@gmail.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Hui Wang <hui.wang@canonical.com>
+Link: https://lore.kernel.org/r/20211012114748.5238-1-hui.wang@canonical.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/pci/hda/patch_realtek.c | 27 +++++++++++++++++++++++++++
+ 1 file changed, 27 insertions(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -10129,6 +10129,9 @@ enum {
+ ALC671_FIXUP_HP_HEADSET_MIC2,
+ ALC662_FIXUP_ACER_X2660G_HEADSET_MODE,
+ ALC662_FIXUP_ACER_NITRO_HEADSET_MODE,
++ ALC668_FIXUP_ASUS_NO_HEADSET_MIC,
++ ALC668_FIXUP_HEADSET_MIC,
++ ALC668_FIXUP_MIC_DET_COEF,
+ };
+
+ static const struct hda_fixup alc662_fixups[] = {
+@@ -10512,6 +10515,29 @@ static const struct hda_fixup alc662_fix
+ .chained = true,
+ .chain_id = ALC662_FIXUP_USI_FUNC
+ },
++ [ALC668_FIXUP_ASUS_NO_HEADSET_MIC] = {
++ .type = HDA_FIXUP_PINS,
++ .v.pins = (const struct hda_pintbl[]) {
++ { 0x1b, 0x04a1112c },
++ { }
++ },
++ .chained = true,
++ .chain_id = ALC668_FIXUP_HEADSET_MIC
++ },
++ [ALC668_FIXUP_HEADSET_MIC] = {
++ .type = HDA_FIXUP_FUNC,
++ .v.func = alc269_fixup_headset_mic,
++ .chained = true,
++ .chain_id = ALC668_FIXUP_MIC_DET_COEF
++ },
++ [ALC668_FIXUP_MIC_DET_COEF] = {
++ .type = HDA_FIXUP_VERBS,
++ .v.verbs = (const struct hda_verb[]) {
++ { 0x20, AC_VERB_SET_COEF_INDEX, 0x15 },
++ { 0x20, AC_VERB_SET_PROC_COEF, 0x0d60 },
++ {}
++ },
++ },
+ };
+
+ static const struct snd_pci_quirk alc662_fixup_tbl[] = {
+@@ -10547,6 +10573,7 @@ static const struct snd_pci_quirk alc662
+ SND_PCI_QUIRK(0x1043, 0x15a7, "ASUS UX51VZH", ALC662_FIXUP_BASS_16),
+ SND_PCI_QUIRK(0x1043, 0x177d, "ASUS N551", ALC668_FIXUP_ASUS_Nx51),
+ SND_PCI_QUIRK(0x1043, 0x17bd, "ASUS N751", ALC668_FIXUP_ASUS_Nx51),
++ SND_PCI_QUIRK(0x1043, 0x185d, "ASUS G551JW", ALC668_FIXUP_ASUS_NO_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1043, 0x1963, "ASUS X71SL", ALC662_FIXUP_ASUS_MODE8),
+ SND_PCI_QUIRK(0x1043, 0x1b73, "ASUS N55SF", ALC662_FIXUP_BASS_16),
+ SND_PCI_QUIRK(0x1043, 0x1bf3, "ASUS N76VZ", ALC662_FIXUP_BASS_MODE4_CHMAP),
--- /dev/null
+From 228af5a4fa3a8293bd8b7ac5cf59548ee29627bf Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Sun, 10 Oct 2021 09:55:46 +0200
+Subject: ALSA: pcm: Workaround for a wrong offset in SYNC_PTR compat ioctl
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 228af5a4fa3a8293bd8b7ac5cf59548ee29627bf upstream.
+
+Michael Forney reported an incorrect padding type that was defined in
+the commit 80fe7430c708 ("ALSA: add new 32-bit layout for
+snd_pcm_mmap_status/control") for PCM control mmap data.
+His analysis is correct, and this caused the misplacements of PCM
+control data on 32bit arch and 32bit compat mode.
+
+The bug is that the __pad2 definition in __snd_pcm_mmap_control64
+struct was wrongly with __pad_before_uframe, which should have been
+__pad_after_uframe instead. This struct is used in SYNC_PTR ioctl and
+control mmap. Basically this bug leads to two problems:
+
+- The offset of avail_min field becomes wrong, it's placed right after
+ appl_ptr without padding on little-endian
+
+- When appl_ptr and avail_min are read as 64bit values in kernel side,
+ the values become either zero or corrupted (mixed up)
+
+One good news is that, because both user-space and kernel
+misunderstand the wrong offset, at least, 32bit application running on
+32bit kernel works as is. Also, 64bit applications are unaffected
+because the padding size is zero. The remaining problem is the 32bit
+compat mode; as mentioned in the above, avail_min is placed right
+after appl_ptr on little-endian archs, 64bit kernel reads bogus values
+for appl_ptr updates, which may lead to streaming bugs like jumping,
+XRUN or whatever unexpected.
+(However, we haven't heard any serious bug reports due to this over
+years, so practically seen, it's fairly safe to assume that the impact
+by this bug is limited.)
+
+Ideally speaking, we should correct the wrong mmap status control
+definition. But this would cause again incompatibility with the
+existing binaries, and fixing it (e.g. by renumbering ioctls) would be
+really messy.
+
+So, as of this patch, we only correct the behavior of 32bit compat
+mode and keep the rest as is. Namely, the SYNC_PTR ioctl is now
+handled differently in compat mode to read/write the 32bit values at
+the right offsets. The control mmap of 32bit apps on 64bit kernels
+has been already disabled (which is likely rather an overlook, but
+this worked fine at this time :), so covering SYNC_PTR ioctl should
+suffice as a fallback.
+
+Fixes: 80fe7430c708 ("ALSA: add new 32-bit layout for snd_pcm_mmap_status/control")
+Reported-by: Michael Forney <mforney@mforney.org>
+Reviewed-by: Arnd Bergmann <arnd@arndb.de>
+Cc: <stable@vger.kernel.org>
+Cc: Rich Felker <dalias@libc.org>
+Link: https://lore.kernel.org/r/29QBMJU8DE71E.2YZSH8IHT5HMH@mforney.org
+Link: https://lore.kernel.org/r/20211010075546.23220-1-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/core/pcm_compat.c | 72 +++++++++++++++++++++++++++++++++++++++++++++++-
+ 1 file changed, 71 insertions(+), 1 deletion(-)
+
+--- a/sound/core/pcm_compat.c
++++ b/sound/core/pcm_compat.c
+@@ -466,6 +466,76 @@ static int snd_pcm_ioctl_sync_ptr_x32(st
+ }
+ #endif /* CONFIG_X86_X32 */
+
++#ifdef __BIG_ENDIAN
++typedef char __pad_before_u32[4];
++typedef char __pad_after_u32[0];
++#else
++typedef char __pad_before_u32[0];
++typedef char __pad_after_u32[4];
++#endif
++
++/* PCM 2.0.15 API definition had a bug in mmap control; it puts the avail_min
++ * at the wrong offset due to a typo in padding type.
++ * The bug hits only 32bit.
++ * A workaround for incorrect read/write is needed only in 32bit compat mode.
++ */
++struct __snd_pcm_mmap_control64_buggy {
++ __pad_before_u32 __pad1;
++ __u32 appl_ptr;
++ __pad_before_u32 __pad2; /* SiC! here is the bug */
++ __pad_before_u32 __pad3;
++ __u32 avail_min;
++ __pad_after_uframe __pad4;
++};
++
++static int snd_pcm_ioctl_sync_ptr_buggy(struct snd_pcm_substream *substream,
++ struct snd_pcm_sync_ptr __user *_sync_ptr)
++{
++ struct snd_pcm_runtime *runtime = substream->runtime;
++ struct snd_pcm_sync_ptr sync_ptr;
++ struct __snd_pcm_mmap_control64_buggy *sync_cp;
++ volatile struct snd_pcm_mmap_status *status;
++ volatile struct snd_pcm_mmap_control *control;
++ int err;
++
++ memset(&sync_ptr, 0, sizeof(sync_ptr));
++ sync_cp = (struct __snd_pcm_mmap_control64_buggy *)&sync_ptr.c.control;
++ if (get_user(sync_ptr.flags, (unsigned __user *)&(_sync_ptr->flags)))
++ return -EFAULT;
++ if (copy_from_user(sync_cp, &(_sync_ptr->c.control), sizeof(*sync_cp)))
++ return -EFAULT;
++ status = runtime->status;
++ control = runtime->control;
++ if (sync_ptr.flags & SNDRV_PCM_SYNC_PTR_HWSYNC) {
++ err = snd_pcm_hwsync(substream);
++ if (err < 0)
++ return err;
++ }
++ snd_pcm_stream_lock_irq(substream);
++ if (!(sync_ptr.flags & SNDRV_PCM_SYNC_PTR_APPL)) {
++ err = pcm_lib_apply_appl_ptr(substream, sync_cp->appl_ptr);
++ if (err < 0) {
++ snd_pcm_stream_unlock_irq(substream);
++ return err;
++ }
++ } else {
++ sync_cp->appl_ptr = control->appl_ptr;
++ }
++ if (!(sync_ptr.flags & SNDRV_PCM_SYNC_PTR_AVAIL_MIN))
++ control->avail_min = sync_cp->avail_min;
++ else
++ sync_cp->avail_min = control->avail_min;
++ sync_ptr.s.status.state = status->state;
++ sync_ptr.s.status.hw_ptr = status->hw_ptr;
++ sync_ptr.s.status.tstamp = status->tstamp;
++ sync_ptr.s.status.suspended_state = status->suspended_state;
++ sync_ptr.s.status.audio_tstamp = status->audio_tstamp;
++ snd_pcm_stream_unlock_irq(substream);
++ if (copy_to_user(_sync_ptr, &sync_ptr, sizeof(sync_ptr)))
++ return -EFAULT;
++ return 0;
++}
++
+ /*
+ */
+ enum {
+@@ -535,7 +605,7 @@ static long snd_pcm_ioctl_compat(struct
+ if (in_x32_syscall())
+ return snd_pcm_ioctl_sync_ptr_x32(substream, argp);
+ #endif /* CONFIG_X86_X32 */
+- return snd_pcm_common_ioctl(file, substream, cmd, argp);
++ return snd_pcm_ioctl_sync_ptr_buggy(substream, argp);
+ case SNDRV_PCM_IOCTL_HW_REFINE32:
+ return snd_pcm_ioctl_hw_params_compat(substream, 1, argp);
+ case SNDRV_PCM_IOCTL_HW_PARAMS32:
--- /dev/null
+From 1f8763c59c4ec6254d629fe77c0a52220bd907aa Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Thu, 30 Sep 2021 13:41:14 +0200
+Subject: ALSA: seq: Fix a potential UAF by wrong private_free call order
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 1f8763c59c4ec6254d629fe77c0a52220bd907aa upstream.
+
+John Keeping reported and posted a patch for a potential UAF in
+rawmidi sequencer destruction: the snd_rawmidi_dev_seq_free() may be
+called after the associated rawmidi object got already freed.
+After a deeper look, it turned out that the bug is rather the
+incorrect private_free call order for a snd_seq_device. The
+snd_seq_device private_free gets called at the release callback of the
+sequencer device object, while this was rather expected to be executed
+at the snd_device call chains that runs at the beginning of the whole
+card-free procedure. It's been broken since the rewrite of
+sequencer-device binding (although it hasn't surfaced because the
+sequencer device release happens usually right along with the card
+device release).
+
+This patch corrects the private_free call to be done in the right
+place, at snd_seq_device_dev_free().
+
+Fixes: 7c37ae5c625a ("ALSA: seq: Rewrite sequencer device binding with standard bus")
+Reported-and-tested-by: John Keeping <john@metanate.com>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20210930114114.8645-1-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/core/seq_device.c | 8 +++-----
+ 1 file changed, 3 insertions(+), 5 deletions(-)
+
+--- a/sound/core/seq_device.c
++++ b/sound/core/seq_device.c
+@@ -147,6 +147,8 @@ static int snd_seq_device_dev_free(struc
+ struct snd_seq_device *dev = device->device_data;
+
+ cancel_autoload_drivers();
++ if (dev->private_free)
++ dev->private_free(dev);
+ put_device(&dev->dev);
+ return 0;
+ }
+@@ -174,11 +176,7 @@ static int snd_seq_device_dev_disconnect
+
+ static void snd_seq_dev_release(struct device *dev)
+ {
+- struct snd_seq_device *sdev = to_seq_dev(dev);
+-
+- if (sdev->private_free)
+- sdev->private_free(sdev);
+- kfree(sdev);
++ kfree(to_seq_dev(dev));
+ }
+
+ /*
--- /dev/null
+From 48827e1d6af58f219e89c7ec08dccbca28c7694e Mon Sep 17 00:00:00 2001
+From: Jonas Hahnfeld <hahnjo@hahnjo.de>
+Date: Tue, 12 Oct 2021 22:09:07 +0200
+Subject: ALSA: usb-audio: Add quirk for VF0770
+
+From: Jonas Hahnfeld <hahnjo@hahnjo.de>
+
+commit 48827e1d6af58f219e89c7ec08dccbca28c7694e upstream.
+
+The device advertises 8 formats, but only a rate of 48kHz is honored
+by the hardware and 24 bits give chopped audio, so only report the
+one working combination. This fixes out-of-the-box audio experience
+with PipeWire which otherwise attempts to choose S24_3LE (while
+PulseAudio defaulted to S16_LE).
+
+Signed-off-by: Jonas Hahnfeld <hahnjo@hahnjo.de>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20211012200906.3492-1-hahnjo@hahnjo.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/usb/quirks-table.h | 42 ++++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 42 insertions(+)
+
+--- a/sound/usb/quirks-table.h
++++ b/sound/usb/quirks-table.h
+@@ -78,6 +78,48 @@
+ { USB_DEVICE_VENDOR_SPEC(0x041e, 0x3f19) },
+
+ /*
++ * Creative Technology, Ltd Live! Cam Sync HD [VF0770]
++ * The device advertises 8 formats, but only a rate of 48kHz is honored by the
++ * hardware and 24 bits give chopped audio, so only report the one working
++ * combination.
++ */
++{
++ USB_DEVICE(0x041e, 0x4095),
++ .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
++ .ifnum = QUIRK_ANY_INTERFACE,
++ .type = QUIRK_COMPOSITE,
++ .data = &(const struct snd_usb_audio_quirk[]) {
++ {
++ .ifnum = 2,
++ .type = QUIRK_AUDIO_STANDARD_MIXER,
++ },
++ {
++ .ifnum = 3,
++ .type = QUIRK_AUDIO_FIXED_ENDPOINT,
++ .data = &(const struct audioformat) {
++ .formats = SNDRV_PCM_FMTBIT_S16_LE,
++ .channels = 2,
++ .fmt_bits = 16,
++ .iface = 3,
++ .altsetting = 4,
++ .altset_idx = 4,
++ .endpoint = 0x82,
++ .ep_attr = 0x05,
++ .rates = SNDRV_PCM_RATE_48000,
++ .rate_min = 48000,
++ .rate_max = 48000,
++ .nr_rates = 1,
++ .rate_table = (unsigned int[]) { 48000 },
++ },
++ },
++ {
++ .ifnum = -1
++ },
++ },
++ },
++},
++
++/*
+ * HP Wireless Audio
+ * When not ignored, causes instability issues for some users, forcing them to
+ * skip the entire module.
projects / thirdparty / kernel / stable-queue.git / commitdiff
