From: Greg Kroah-Hartman Date: Tue, 14 Apr 2020 11:06:44 +0000 (+0200) Subject: 5.5-stable patches X-Git-Tag: v4.19.116~84 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=bc70ecb6a906362cd313162c1f8202160cb3a61f;p=thirdparty%2Fkernel%2Fstable-queue.git 5.5-stable patches added patches: alsa-doc-document-pc-beep-hidden-register-on-realtek-alc256.patch alsa-hda-add-driver-blacklist.patch alsa-hda-fix-potential-access-overflow-in-beep-helper.patch alsa-hda-realtek-a-fake-key-event-is-triggered-by-running-shutup.patch alsa-hda-realtek-add-quirk-for-lenovo-carbon-x1-8th-gen.patch alsa-hda-realtek-add-quirk-for-msi-gl63.patch alsa-hda-realtek-enable-mute-led-on-an-hp-system.patch alsa-hda-realtek-remove-now-unnecessary-xps-13-headphone-noise-fixups.patch alsa-hda-realtek-set-principled-pc-beep-configuration-for-alc256.patch alsa-ice1724-fix-invalid-access-for-enumerated-ctl-items.patch alsa-pcm-oss-fix-regression-by-buffer-overflow-fix.patch alsa-usb-audio-add-mixer-workaround-for-trx40-and-co.patch media-hantro-read-be32-words-starting-at-every-fourth-byte.patch media-ti-vpe-cal-fix-a-kernel-oops-when-unloading-module.patch media-ti-vpe-cal-fix-disable_irqs-to-only-the-intended-target.patch media-venus-cache-vb-payload-to-be-used-by-clock-scaling.patch media-venus-firmware-ignore-secure-call-error-on-first-resume.patch usb-gadget-composite-inform-controller-driver-of-self-powered.patch usb-gadget-f_fs-fix-use-after-free-issue-as-part-of-queue-failure.patch --- diff --git a/queue-5.5/alsa-doc-document-pc-beep-hidden-register-on-realtek-alc256.patch b/queue-5.5/alsa-doc-document-pc-beep-hidden-register-on-realtek-alc256.patch new file mode 100644 index 00000000000..e41459d05e7 --- /dev/null +++ b/queue-5.5/alsa-doc-document-pc-beep-hidden-register-on-realtek-alc256.patch @@ -0,0 +1,174 @@ +From f128090491c3f5aacef91a863f8c52abf869c436 Mon Sep 17 00:00:00 2001 +From: Thomas Hebb +Date: Mon, 30 Mar 2020 12:09:37 -0400 +Subject: ALSA: doc: Document PC Beep Hidden Register on Realtek ALC256 + +From: Thomas Hebb + +commit f128090491c3f5aacef91a863f8c52abf869c436 upstream. + +This codec (among others) has a hidden set of audio routes, apparently +designed to allow PC Beep output without a mixer widget on the output +path, which are controlled by an undocumented Realtek vendor register. +The default configuration of these routes means that certain inputs +aren't accessible, necessitating driver control of the register. +However, Realtek has provided no documentation of the register, instead +opting to fix issues by providing magic numbers, most of which have been +at least somewhat erroneous. These magic numbers then get copied by +others into model-specific fixups, leading to a fragmented and buggy set +of configurations. + +To get out of this situation, I've reverse engineered the register by +flipping bits and observing how the codec's behavior changes. This +commit documents my findings. It does not change any code. + +Cc: stable@vger.kernel.org +Signed-off-by: Thomas Hebb +Link: https://lore.kernel.org/r/bd69dfdeaf40ff31c4b7b797c829bb320031739c.1585584498.git.tommyhebb@gmail.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + Documentation/sound/hd-audio/index.rst | 1 + Documentation/sound/hd-audio/realtek-pc-beep.rst | 129 +++++++++++++++++++++++ + 2 files changed, 130 insertions(+) + +--- a/Documentation/sound/hd-audio/index.rst ++++ b/Documentation/sound/hd-audio/index.rst +@@ -8,3 +8,4 @@ HD-Audio + models + controls + dp-mst ++ realtek-pc-beep +--- /dev/null ++++ b/Documentation/sound/hd-audio/realtek-pc-beep.rst +@@ -0,0 +1,129 @@ ++=============================== ++Realtek PC Beep Hidden Register ++=============================== ++ ++This file documents the "PC Beep Hidden Register", which is present in certain ++Realtek HDA codecs and controls a muxer and pair of passthrough mixers that can ++route audio between pins but aren't themselves exposed as HDA widgets. As far ++as I can tell, these hidden routes are designed to allow flexible PC Beep output ++for codecs that don't have mixer widgets in their output paths. Why it's easier ++to hide a mixer behind an undocumented vendor register than to just expose it ++as a widget, I have no idea. ++ ++Register Description ++==================== ++ ++The register is accessed via processing coefficient 0x36 on NID 20h. Bits not ++identified below have no discernible effect on my machine, a Dell XPS 13 9350:: ++ ++ MSB LSB ++ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ ++ | |h|S|L| | B |R| | Known bits ++ +=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ ++ |0|0|1|1| 0x7 |0|0x0|1| 0x7 | Reset value ++ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ ++ ++1Ah input select (B): 2 bits ++ When zero, expose the PC Beep line (from the internal beep generator, when ++ enabled with the Set Beep Generation verb on NID 01h, or else from the ++ external PCBEEP pin) on the 1Ah pin node. When nonzero, expose the headphone ++ jack (or possibly Line In on some machines) input instead. If PC Beep is ++ selected, the 1Ah boost control has no effect. ++ ++Amplify 1Ah loopback, left (L): 1 bit ++ Amplify the left channel of 1Ah before mixing it into outputs as specified ++ by h and S bits. Does not affect the level of 1Ah exposed to other widgets. ++ ++Amplify 1Ah loopback, right (R): 1 bit ++ Amplify the right channel of 1Ah before mixing it into outputs as specified ++ by h and S bits. Does not affect the level of 1Ah exposed to other widgets. ++ ++Loopback 1Ah to 21h [active low] (h): 1 bit ++ When zero, mix 1Ah (possibly with amplification, depending on L and R bits) ++ into 21h (headphone jack on my machine). Mixed signal respects the mute ++ setting on 21h. ++ ++Loopback 1Ah to 14h (S): 1 bit ++ When one, mix 1Ah (possibly with amplification, depending on L and R bits) ++ into 14h (internal speaker on my machine). Mixed signal **ignores** the mute ++ setting on 14h and is present whenever 14h is configured as an output. ++ ++Path diagrams ++============= ++ ++1Ah input selection (DIV is the PC Beep divider set on NID 01h):: ++ ++ ++ | | | ++ +--DIV--+--!DIV--+ {1Ah boost control} ++ | | ++ +--(b == 0)--+--(b != 0)--+ ++ | ++ >1Ah (Beep/Headphone Mic/Line In)< ++ ++Loopback of 1Ah to 21h/14h:: ++ ++ <1Ah (Beep/Headphone Mic/Line In)> ++ | ++ {amplify if L/R} ++ | ++ +-----!h-----+-----S-----+ ++ | | ++ {21h mute control} | ++ | | ++ >21h (Headphone)< >14h (Internal Speaker)< ++ ++Background ++========== ++ ++All Realtek HDA codecs have a vendor-defined widget with node ID 20h which ++provides access to a bank of registers that control various codec functions. ++Registers are read and written via the standard HDA processing coefficient ++verbs (Set/Get Coefficient Index, Set/Get Processing Coefficient). The node is ++named "Realtek Vendor Registers" in public datasheets' verb listings and, ++apart from that, is entirely undocumented. ++ ++This particular register, exposed at coefficient 0x36 and named in commits from ++Realtek, is of note: unlike most registers, which seem to control detailed ++amplifier parameters not in scope of the HDA specification, it controls audio ++routing which could just as easily have been defined using standard HDA mixer ++and selector widgets. ++ ++Specifically, it selects between two sources for the input pin widget with Node ++ID (NID) 1Ah: the widget's signal can come either from an audio jack (on my ++laptop, a Dell XPS 13 9350, it's the headphone jack, but comments in Realtek ++commits indicate that it might be a Line In on some machines) or from the PC ++Beep line (which is itself multiplexed between the codec's internal beep ++generator and external PCBEEP pin, depending on if the beep generator is ++enabled via verbs on NID 01h). Additionally, it can mix (with optional ++amplification) that signal onto the 21h and/or 14h output pins. ++ ++The register's reset value is 0x3717, corresponding to PC Beep on 1Ah that is ++then amplified and mixed into both the headphones and the speakers. Not only ++does this violate the HDA specification, which says that "[a vendor defined ++beep input pin] connection may be maintained *only* while the Link reset ++(**RST#**) is asserted", it means that we cannot ignore the register if we care ++about the input that 1Ah would otherwise expose or if the PCBEEP trace is ++poorly shielded and picks up chassis noise (both of which are the case on my ++machine). ++ ++Unfortunately, there are lots of ways to get this register configuration wrong. ++Linux, it seems, has gone through most of them. For one, the register resets ++after S3 suspend: judging by existing code, this isn't the case for all vendor ++registers, and it's led to some fixes that improve behavior on cold boot but ++don't last after suspend. Other fixes have successfully switched the 1Ah input ++away from PC Beep but have failed to disable both loopback paths. On my ++machine, this means that the headphone input is amplified and looped back to ++the headphone output, which uses the exact same pins! As you might expect, this ++causes terrible headphone noise, the character of which is controlled by the ++1Ah boost control. (If you've seen instructions online to fix XPS 13 headphone ++noise by changing "Headphone Mic Boost" in ALSA, now you know why.) ++ ++The information here has been obtained through black-box reverse engineering of ++the ALC256 codec's behavior and is not guaranteed to be correct. It likely ++also applies for the ALC255, ALC257, ALC235, and ALC236, since those codecs ++seem to be close relatives of the ALC256. (They all share one initialization ++function.) Additionally, other codecs like the ALC225 and ALC285 also have this ++register, judging by existing fixups in ``patch_realtek.c``, but specific ++data (e.g. node IDs, bit positions, pin mappings) for those codecs may differ ++from what I've described here. diff --git a/queue-5.5/alsa-hda-add-driver-blacklist.patch b/queue-5.5/alsa-hda-add-driver-blacklist.patch new file mode 100644 index 00000000000..22d85349c9c --- /dev/null +++ b/queue-5.5/alsa-hda-add-driver-blacklist.patch @@ -0,0 +1,63 @@ +From 3c6fd1f07ed03a04debbb9a9d782205f1ef5e2ab Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Wed, 8 Apr 2020 16:04:49 +0200 +Subject: ALSA: hda: Add driver blacklist + +From: Takashi Iwai + +commit 3c6fd1f07ed03a04debbb9a9d782205f1ef5e2ab upstream. + +The recent AMD platform exposes an HD-audio bus but without any actual +codecs, which is internally tied with a USB-audio device, supposedly. +It results in "no codecs" error of HD-audio bus driver, and it's +nothing but a waste of resources. + +This patch introduces a static blacklist table for skipping such a +known bogus PCI SSID entry. As of writing this patch, the known SSIDs +are: +* 1043:874f - ASUS ROG Zenith II / Strix +* 1462:cb59 - MSI TRX40 Creator +* 1462:cb60 - MSI TRX40 + +BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=206543 +Cc: +Link: https://lore.kernel.org/r/20200408140449.22319-2-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/hda_intel.c | 16 ++++++++++++++++ + 1 file changed, 16 insertions(+) + +--- a/sound/pci/hda/hda_intel.c ++++ b/sound/pci/hda/hda_intel.c +@@ -2074,6 +2074,17 @@ static void pcm_mmap_prepare(struct snd_ + #endif + } + ++/* Blacklist for skipping the whole probe: ++ * some HD-audio PCI entries are exposed without any codecs, and such devices ++ * should be ignored from the beginning. ++ */ ++static const struct snd_pci_quirk driver_blacklist[] = { ++ SND_PCI_QUIRK(0x1043, 0x874f, "ASUS ROG Zenith II / Strix", 0), ++ SND_PCI_QUIRK(0x1462, 0xcb59, "MSI TRX40 Creator", 0), ++ SND_PCI_QUIRK(0x1462, 0xcb60, "MSI TRX40", 0), ++ {} ++}; ++ + static const struct hda_controller_ops pci_hda_ops = { + .disable_msi_reset_irq = disable_msi_reset_irq, + .pcm_mmap_prepare = pcm_mmap_prepare, +@@ -2090,6 +2101,11 @@ static int azx_probe(struct pci_dev *pci + bool schedule_probe; + int err; + ++ if (snd_pci_quirk_lookup(pci, driver_blacklist)) { ++ dev_info(&pci->dev, "Skipping the blacklisted device\n"); ++ return -ENODEV; ++ } ++ + if (dev >= SNDRV_CARDS) + return -ENODEV; + if (!enable[dev]) { diff --git a/queue-5.5/alsa-hda-fix-potential-access-overflow-in-beep-helper.patch b/queue-5.5/alsa-hda-fix-potential-access-overflow-in-beep-helper.patch new file mode 100644 index 00000000000..24d071131f4 --- /dev/null +++ b/queue-5.5/alsa-hda-fix-potential-access-overflow-in-beep-helper.patch @@ -0,0 +1,46 @@ +From 0ad3f0b384d58f3bd1f4fb87d0af5b8f6866f41a Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Tue, 7 Apr 2020 10:44:01 +0200 +Subject: ALSA: hda: Fix potential access overflow in beep helper + +From: Takashi Iwai + +commit 0ad3f0b384d58f3bd1f4fb87d0af5b8f6866f41a upstream. + +The beep control helper function blindly stores the values in two +stereo channels no matter whether the actual control is mono or +stereo. This is practically harmless, but it annoys the recently +introduced sanity check, resulting in an error when the checker is +enabled. + +This patch corrects the behavior to store only on the defined array +member. + +Fixes: 0401e8548eac ("ALSA: hda - Move beep helper functions to hda_beep.c") +BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=207139 +Reviewed-by: Jaroslav Kysela +Cc: +Link: https://lore.kernel.org/r/20200407084402.25589-2-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/hda_beep.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/sound/pci/hda/hda_beep.c ++++ b/sound/pci/hda/hda_beep.c +@@ -290,8 +290,12 @@ int snd_hda_mixer_amp_switch_get_beep(st + { + struct hda_codec *codec = snd_kcontrol_chip(kcontrol); + struct hda_beep *beep = codec->beep; ++ int chs = get_amp_channels(kcontrol); ++ + if (beep && (!beep->enabled || !ctl_has_mute(kcontrol))) { +- ucontrol->value.integer.value[0] = ++ if (chs & 1) ++ ucontrol->value.integer.value[0] = beep->enabled; ++ if (chs & 2) + ucontrol->value.integer.value[1] = beep->enabled; + return 0; + } diff --git a/queue-5.5/alsa-hda-realtek-a-fake-key-event-is-triggered-by-running-shutup.patch b/queue-5.5/alsa-hda-realtek-a-fake-key-event-is-triggered-by-running-shutup.patch new file mode 100644 index 00000000000..d881bfc7ad4 --- /dev/null +++ b/queue-5.5/alsa-hda-realtek-a-fake-key-event-is-triggered-by-running-shutup.patch @@ -0,0 +1,248 @@ +From 476c02e0b4fd9071d158f6a1a1dfea1d36ee0ffd Mon Sep 17 00:00:00 2001 +From: Hui Wang +Date: Sun, 29 Mar 2020 16:20:18 +0800 +Subject: ALSA: hda/realtek - a fake key event is triggered by running shutup + +From: Hui Wang + +commit 476c02e0b4fd9071d158f6a1a1dfea1d36ee0ffd upstream. + +On the Lenovo X1C7 machines, after we plug the headset, the rt_resume() +and rt_suspend() of the codec driver will be called periodically, the +driver can't stay in the rt_suspend state even users doen't use the +sound card. + +Through debugging, I found when running rt_suspend(), it will call +alc225_shutup(), in this function, it will change 3k pull down control +by alc_update_coef_idx(codec, 0x4a, 0, 3 << 10), this will trigger a +fake key event and that event will resume the codec, when codec +suspend agin, it will trigger the fake key event one more time, this +process will repeat. + +If disable the key event before changing the pull down control, it +will not trigger fake key event. It also needs to restore the pull +down control and re-enable the key event, otherwise the system can't +get key event when codec is in rt_suspend state. + +Also move some functions ahead of alc225_shutup(), this can save the +function declaration. + +Fixes: 76f7dec08fd6 (ALSA: hda/realtek - Add Headset Button supported for ThinkPad X1) +Cc: Kailang Yang +Cc: +Signed-off-by: Hui Wang +Link: https://lore.kernel.org/r/20200329082018.20486-1-hui.wang@canonical.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_realtek.c | 170 ++++++++++++++++++++++++++---------------- + 1 file changed, 107 insertions(+), 63 deletions(-) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -107,6 +107,7 @@ struct alc_spec { + unsigned int done_hp_init:1; + unsigned int no_shutup_pins:1; + unsigned int ultra_low_power:1; ++ unsigned int has_hs_key:1; + + /* for PLL fix */ + hda_nid_t pll_nid; +@@ -2982,6 +2983,107 @@ static int alc269_parse_auto_config(stru + return alc_parse_auto_config(codec, alc269_ignore, ssids); + } + ++static const struct hda_jack_keymap alc_headset_btn_keymap[] = { ++ { SND_JACK_BTN_0, KEY_PLAYPAUSE }, ++ { SND_JACK_BTN_1, KEY_VOICECOMMAND }, ++ { SND_JACK_BTN_2, KEY_VOLUMEUP }, ++ { SND_JACK_BTN_3, KEY_VOLUMEDOWN }, ++ {} ++}; ++ ++static void alc_headset_btn_callback(struct hda_codec *codec, ++ struct hda_jack_callback *jack) ++{ ++ int report = 0; ++ ++ if (jack->unsol_res & (7 << 13)) ++ report |= SND_JACK_BTN_0; ++ ++ if (jack->unsol_res & (1 << 16 | 3 << 8)) ++ report |= SND_JACK_BTN_1; ++ ++ /* Volume up key */ ++ if (jack->unsol_res & (7 << 23)) ++ report |= SND_JACK_BTN_2; ++ ++ /* Volume down key */ ++ if (jack->unsol_res & (7 << 10)) ++ report |= SND_JACK_BTN_3; ++ ++ jack->jack->button_state = report; ++} ++ ++static void alc_disable_headset_jack_key(struct hda_codec *codec) ++{ ++ struct alc_spec *spec = codec->spec; ++ ++ if (!spec->has_hs_key) ++ return; ++ ++ switch (codec->core.vendor_id) { ++ case 0x10ec0215: ++ case 0x10ec0225: ++ case 0x10ec0285: ++ case 0x10ec0295: ++ case 0x10ec0289: ++ case 0x10ec0299: ++ alc_write_coef_idx(codec, 0x48, 0x0); ++ alc_update_coef_idx(codec, 0x49, 0x0045, 0x0); ++ alc_update_coef_idx(codec, 0x44, 0x0045 << 8, 0x0); ++ break; ++ case 0x10ec0236: ++ case 0x10ec0256: ++ alc_write_coef_idx(codec, 0x48, 0x0); ++ alc_update_coef_idx(codec, 0x49, 0x0045, 0x0); ++ break; ++ } ++} ++ ++static void alc_enable_headset_jack_key(struct hda_codec *codec) ++{ ++ struct alc_spec *spec = codec->spec; ++ ++ if (!spec->has_hs_key) ++ return; ++ ++ switch (codec->core.vendor_id) { ++ case 0x10ec0215: ++ case 0x10ec0225: ++ case 0x10ec0285: ++ case 0x10ec0295: ++ case 0x10ec0289: ++ case 0x10ec0299: ++ alc_write_coef_idx(codec, 0x48, 0xd011); ++ alc_update_coef_idx(codec, 0x49, 0x007f, 0x0045); ++ alc_update_coef_idx(codec, 0x44, 0x007f << 8, 0x0045 << 8); ++ break; ++ case 0x10ec0236: ++ case 0x10ec0256: ++ alc_write_coef_idx(codec, 0x48, 0xd011); ++ alc_update_coef_idx(codec, 0x49, 0x007f, 0x0045); ++ break; ++ } ++} ++ ++static void alc_fixup_headset_jack(struct hda_codec *codec, ++ const struct hda_fixup *fix, int action) ++{ ++ struct alc_spec *spec = codec->spec; ++ ++ switch (action) { ++ case HDA_FIXUP_ACT_PRE_PROBE: ++ spec->has_hs_key = 1; ++ snd_hda_jack_detect_enable_callback(codec, 0x55, ++ alc_headset_btn_callback); ++ snd_hda_jack_add_kctl(codec, 0x55, "Headset Jack", false, ++ SND_JACK_HEADSET, alc_headset_btn_keymap); ++ break; ++ case HDA_FIXUP_ACT_INIT: ++ alc_enable_headset_jack_key(codec); ++ break; ++ } ++} ++ + static void alc269vb_toggle_power_output(struct hda_codec *codec, int power_up) + { + alc_update_coef_idx(codec, 0x04, 1 << 11, power_up ? (1 << 11) : 0); +@@ -3372,6 +3474,8 @@ static void alc225_shutup(struct hda_cod + + if (!hp_pin) + hp_pin = 0x21; ++ ++ alc_disable_headset_jack_key(codec); + /* 3k pull low control for Headset jack. */ + alc_update_coef_idx(codec, 0x4a, 0, 3 << 10); + +@@ -3411,6 +3515,9 @@ static void alc225_shutup(struct hda_cod + alc_update_coef_idx(codec, 0x4a, 3<<4, 2<<4); + msleep(30); + } ++ ++ alc_update_coef_idx(codec, 0x4a, 3 << 10, 0); ++ alc_enable_headset_jack_key(codec); + } + + static void alc_default_init(struct hda_codec *codec) +@@ -5668,69 +5775,6 @@ static void alc285_fixup_invalidate_dacs + snd_hda_override_wcaps(codec, 0x03, 0); + } + +-static const struct hda_jack_keymap alc_headset_btn_keymap[] = { +- { SND_JACK_BTN_0, KEY_PLAYPAUSE }, +- { SND_JACK_BTN_1, KEY_VOICECOMMAND }, +- { SND_JACK_BTN_2, KEY_VOLUMEUP }, +- { SND_JACK_BTN_3, KEY_VOLUMEDOWN }, +- {} +-}; +- +-static void alc_headset_btn_callback(struct hda_codec *codec, +- struct hda_jack_callback *jack) +-{ +- int report = 0; +- +- if (jack->unsol_res & (7 << 13)) +- report |= SND_JACK_BTN_0; +- +- if (jack->unsol_res & (1 << 16 | 3 << 8)) +- report |= SND_JACK_BTN_1; +- +- /* Volume up key */ +- if (jack->unsol_res & (7 << 23)) +- report |= SND_JACK_BTN_2; +- +- /* Volume down key */ +- if (jack->unsol_res & (7 << 10)) +- report |= SND_JACK_BTN_3; +- +- jack->jack->button_state = report; +-} +- +-static void alc_fixup_headset_jack(struct hda_codec *codec, +- const struct hda_fixup *fix, int action) +-{ +- +- switch (action) { +- case HDA_FIXUP_ACT_PRE_PROBE: +- snd_hda_jack_detect_enable_callback(codec, 0x55, +- alc_headset_btn_callback); +- snd_hda_jack_add_kctl(codec, 0x55, "Headset Jack", false, +- SND_JACK_HEADSET, alc_headset_btn_keymap); +- break; +- case HDA_FIXUP_ACT_INIT: +- switch (codec->core.vendor_id) { +- case 0x10ec0215: +- case 0x10ec0225: +- case 0x10ec0285: +- case 0x10ec0295: +- case 0x10ec0289: +- case 0x10ec0299: +- alc_write_coef_idx(codec, 0x48, 0xd011); +- alc_update_coef_idx(codec, 0x49, 0x007f, 0x0045); +- alc_update_coef_idx(codec, 0x44, 0x007f << 8, 0x0045 << 8); +- break; +- case 0x10ec0236: +- case 0x10ec0256: +- alc_write_coef_idx(codec, 0x48, 0xd011); +- alc_update_coef_idx(codec, 0x49, 0x007f, 0x0045); +- break; +- } +- break; +- } +-} +- + static void alc295_fixup_chromebook(struct hda_codec *codec, + const struct hda_fixup *fix, int action) + { diff --git a/queue-5.5/alsa-hda-realtek-add-quirk-for-lenovo-carbon-x1-8th-gen.patch b/queue-5.5/alsa-hda-realtek-add-quirk-for-lenovo-carbon-x1-8th-gen.patch new file mode 100644 index 00000000000..bb8b7a936d2 --- /dev/null +++ b/queue-5.5/alsa-hda-realtek-add-quirk-for-lenovo-carbon-x1-8th-gen.patch @@ -0,0 +1,38 @@ +From ca707b3f00b4f31a6e1eb37e8ae99f15f2bb1fe5 Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Thu, 2 Apr 2020 19:43:11 +0200 +Subject: ALSA: hda/realtek - Add quirk for Lenovo Carbon X1 8th gen + +From: Hans de Goede + +commit ca707b3f00b4f31a6e1eb37e8ae99f15f2bb1fe5 upstream. + +The audio setup on the Lenovo Carbon X1 8th gen is the same as that on +the Lenovo Carbon X1 7th gen, as such it needs the same +ALC285_FIXUP_THINKPAD_HEADSET_JACK quirk. + +This fixes volume control of the speaker not working among other things. + +BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1820196 +Cc: stable@vger.kernel.org +Suggested-by: Jaroslav Kysela +Signed-off-by: Hans de Goede +Reviewed-by: Jaroslav Kysela +Link: https://lore.kernel.org/r/20200402174311.238614-1-hdegoede@redhat.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_realtek.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -7325,6 +7325,7 @@ static const struct snd_pci_quirk alc269 + SND_PCI_QUIRK(0x17aa, 0x225d, "Thinkpad T480", ALC269_FIXUP_LIMIT_INT_MIC_BOOST), + SND_PCI_QUIRK(0x17aa, 0x2292, "Thinkpad X1 Yoga 7th", ALC285_FIXUP_THINKPAD_HEADSET_JACK), + SND_PCI_QUIRK(0x17aa, 0x2293, "Thinkpad X1 Carbon 7th", ALC285_FIXUP_THINKPAD_HEADSET_JACK), ++ SND_PCI_QUIRK(0x17aa, 0x22be, "Thinkpad X1 Carbon 8th", ALC285_FIXUP_THINKPAD_HEADSET_JACK), + SND_PCI_QUIRK(0x17aa, 0x30bb, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY), + SND_PCI_QUIRK(0x17aa, 0x30e2, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY), + SND_PCI_QUIRK(0x17aa, 0x310c, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION), diff --git a/queue-5.5/alsa-hda-realtek-add-quirk-for-msi-gl63.patch b/queue-5.5/alsa-hda-realtek-add-quirk-for-msi-gl63.patch new file mode 100644 index 00000000000..06060396bd5 --- /dev/null +++ b/queue-5.5/alsa-hda-realtek-add-quirk-for-msi-gl63.patch @@ -0,0 +1,34 @@ +From 1d3aa4a5516d2e4933fe3cca11d3349ef63bc547 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Wed, 8 Apr 2020 15:56:45 +0200 +Subject: ALSA: hda/realtek - Add quirk for MSI GL63 + +From: Takashi Iwai + +commit 1d3aa4a5516d2e4933fe3cca11d3349ef63bc547 upstream. + +MSI GL63 laptop requires the similar quirk like other MSI models, +ALC1220_FIXUP_CLEVO_P950. The board BIOS doesn't provide a PCI SSID +for the device, hence we need to take the codec SSID (1462:1275) +instead. + +BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=207157 +Cc: +Link: https://lore.kernel.org/r/20200408135645.21896-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_realtek.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -2447,6 +2447,7 @@ static const struct snd_pci_quirk alc882 + SND_PCI_QUIRK(0x1458, 0xa0b8, "Gigabyte AZ370-Gaming", ALC1220_FIXUP_GB_DUAL_CODECS), + SND_PCI_QUIRK(0x1458, 0xa0cd, "Gigabyte X570 Aorus Master", ALC1220_FIXUP_CLEVO_P950), + SND_PCI_QUIRK(0x1462, 0x1228, "MSI-GP63", ALC1220_FIXUP_CLEVO_P950), ++ SND_PCI_QUIRK(0x1462, 0x1275, "MSI-GL63", ALC1220_FIXUP_CLEVO_P950), + SND_PCI_QUIRK(0x1462, 0x1276, "MSI-GL73", ALC1220_FIXUP_CLEVO_P950), + SND_PCI_QUIRK(0x1462, 0x1293, "MSI-GP65", ALC1220_FIXUP_CLEVO_P950), + SND_PCI_QUIRK(0x1462, 0x7350, "MSI-7350", ALC889_FIXUP_CD), diff --git a/queue-5.5/alsa-hda-realtek-enable-mute-led-on-an-hp-system.patch b/queue-5.5/alsa-hda-realtek-enable-mute-led-on-an-hp-system.patch new file mode 100644 index 00000000000..c95e846d1aa --- /dev/null +++ b/queue-5.5/alsa-hda-realtek-enable-mute-led-on-an-hp-system.patch @@ -0,0 +1,67 @@ +From f5a88b0accc24c4a9021247d7a3124f90aa4c586 Mon Sep 17 00:00:00 2001 +From: Kai-Heng Feng +Date: Fri, 27 Mar 2020 12:46:25 +0800 +Subject: ALSA: hda/realtek: Enable mute LED on an HP system + +From: Kai-Heng Feng + +commit f5a88b0accc24c4a9021247d7a3124f90aa4c586 upstream. + +The system in question uses ALC285, and it uses GPIO 0x04 to control its +mute LED. + +The mic mute LED can be controlled by GPIO 0x01, however the system uses +DMIC so we should use that to control mic mute LED. + +Signed-off-by: Kai-Heng Feng +Cc: +Link: https://lore.kernel.org/r/20200327044626.29582-1-kai.heng.feng@canonical.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_realtek.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -4008,6 +4008,12 @@ static void alc269_fixup_hp_gpio_led(str + alc_fixup_hp_gpio_led(codec, action, 0x08, 0x10); + } + ++static void alc285_fixup_hp_gpio_led(struct hda_codec *codec, ++ const struct hda_fixup *fix, int action) ++{ ++ alc_fixup_hp_gpio_led(codec, action, 0x04, 0x00); ++} ++ + static void alc286_fixup_hp_gpio_led(struct hda_codec *codec, + const struct hda_fixup *fix, int action) + { +@@ -5923,6 +5929,7 @@ enum { + ALC294_FIXUP_ASUS_DUAL_SPK, + ALC285_FIXUP_THINKPAD_HEADSET_JACK, + ALC294_FIXUP_ASUS_HPE, ++ ALC285_FIXUP_HP_GPIO_LED, + }; + + static const struct hda_fixup alc269_fixups[] = { +@@ -7061,6 +7068,10 @@ static const struct hda_fixup alc269_fix + .chained = true, + .chain_id = ALC294_FIXUP_ASUS_HEADSET_MIC + }, ++ [ALC285_FIXUP_HP_GPIO_LED] = { ++ .type = HDA_FIXUP_FUNC, ++ .v.func = alc285_fixup_hp_gpio_led, ++ }, + }; + + static const struct snd_pci_quirk alc269_fixup_tbl[] = { +@@ -7208,6 +7219,7 @@ static const struct snd_pci_quirk alc269 + SND_PCI_QUIRK(0x103c, 0x83b9, "HP Spectre x360", ALC269_FIXUP_HP_MUTE_LED_MIC3), + SND_PCI_QUIRK(0x103c, 0x8497, "HP Envy x360", ALC269_FIXUP_HP_MUTE_LED_MIC3), + SND_PCI_QUIRK(0x103c, 0x84e7, "HP Pavilion 15", ALC269_FIXUP_HP_MUTE_LED_MIC3), ++ SND_PCI_QUIRK(0x103c, 0x8736, "HP", ALC285_FIXUP_HP_GPIO_LED), + SND_PCI_QUIRK(0x1043, 0x103e, "ASUS X540SA", ALC256_FIXUP_ASUS_MIC), + SND_PCI_QUIRK(0x1043, 0x103f, "ASUS TX300", ALC282_FIXUP_ASUS_TX300), + SND_PCI_QUIRK(0x1043, 0x106d, "Asus K53BE", ALC269_FIXUP_LIMIT_INT_MIC_BOOST), diff --git a/queue-5.5/alsa-hda-realtek-remove-now-unnecessary-xps-13-headphone-noise-fixups.patch b/queue-5.5/alsa-hda-realtek-remove-now-unnecessary-xps-13-headphone-noise-fixups.patch new file mode 100644 index 00000000000..7612c97edc9 --- /dev/null +++ b/queue-5.5/alsa-hda-realtek-remove-now-unnecessary-xps-13-headphone-noise-fixups.patch @@ -0,0 +1,142 @@ +From f36938aa7440f46a0a365f1cfde5f5985af2bef3 Mon Sep 17 00:00:00 2001 +From: Thomas Hebb +Date: Mon, 30 Mar 2020 12:09:39 -0400 +Subject: ALSA: hda/realtek - Remove now-unnecessary XPS 13 headphone noise fixups + +From: Thomas Hebb + +commit f36938aa7440f46a0a365f1cfde5f5985af2bef3 upstream. + +patch_realtek.c has historically failed to properly configure the PC +Beep Hidden Register for the ALC256 codec (among others). Depending on +your kernel version, symptoms of this misconfiguration can range from +chassis noise, picked up by a poorly-shielded PCBEEP trace, getting +amplified and played on your internal speaker and/or headphones to loud +feedback, which responds to the "Headphone Mic Boost" ALSA control, +getting played through your headphones. For details of the problem, see +the patch in this series titled "ALSA: hda/realtek - Set principled PC +Beep configuration for ALC256", which fixes the configuration. + +These symptoms have been most noticed on the Dell XPS 13 9350 and 9360, +popular laptops that use the ALC256. As a result, several model-specific +fixups have been introduced to try and fix the problem, the most +egregious of which locks the "Headphone Mic Boost" control as a hack to +minimize noise from a feedback loop that shouldn't have been there in +the first place. + +Now that the underlying issue has been fixed, remove all these fixups. +Remaining fixups needed by the XPS 13 are all picked up by existing pin +quirks. + +This change should, for the XPS 13 9350/9360 + + - Significantly increase volume and audio quality on headphones + - Eliminate headphone popping on suspend/resume + - Allow "Headphone Mic Boost" to be set again, making the headphone + jack fully usable as a microphone jack too. + +Fixes: 8c69729b4439 ("ALSA: hda - Fix headphone noise after Dell XPS 13 resume back from S3") +Fixes: 423cd785619a ("ALSA: hda - Fix headphone noise on Dell XPS 13 9360") +Fixes: e4c9fd10eb21 ("ALSA: hda - Apply headphone noise quirk for another Dell XPS 13 variant") +Fixes: 1099f48457d0 ("ALSA: hda/realtek: Reduce the Headphone static noise on XPS 9350/9360") +Cc: stable@vger.kernel.org +Signed-off-by: Thomas Hebb +Link: https://lore.kernel.org/r/b649a00edfde150cf6eebbb4390e15e0c2deb39a.1585584498.git.tommyhebb@gmail.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + Documentation/sound/hd-audio/models.rst | 2 - + sound/pci/hda/patch_realtek.c | 34 -------------------------------- + 2 files changed, 36 deletions(-) + +--- a/Documentation/sound/hd-audio/models.rst ++++ b/Documentation/sound/hd-audio/models.rst +@@ -216,8 +216,6 @@ alc298-dell-aio + ALC298 fixups on Dell AIO machines + alc275-dell-xps + ALC275 fixups on Dell XPS models +-alc256-dell-xps13 +- ALC256 fixups on Dell XPS13 + lenovo-spk-noise + Workaround for speaker noise on Lenovo machines + lenovo-hotkey +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -5491,17 +5491,6 @@ static void alc271_hp_gate_mic_jack(stru + } + } + +-static void alc256_fixup_dell_xps_13_headphone_noise2(struct hda_codec *codec, +- const struct hda_fixup *fix, +- int action) +-{ +- if (action != HDA_FIXUP_ACT_PRE_PROBE) +- return; +- +- snd_hda_codec_amp_stereo(codec, 0x1a, HDA_INPUT, 0, HDA_AMP_VOLMASK, 1); +- snd_hda_override_wcaps(codec, 0x1a, get_wcaps(codec, 0x1a) & ~AC_WCAP_IN_AMP); +-} +- + static void alc269_fixup_limit_int_mic_boost(struct hda_codec *codec, + const struct hda_fixup *fix, + int action) +@@ -5916,8 +5905,6 @@ enum { + ALC298_FIXUP_DELL1_MIC_NO_PRESENCE, + ALC298_FIXUP_DELL_AIO_MIC_NO_PRESENCE, + ALC275_FIXUP_DELL_XPS, +- ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE, +- ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE2, + ALC293_FIXUP_LENOVO_SPK_NOISE, + ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY, + ALC255_FIXUP_DELL_SPK_NOISE, +@@ -6658,23 +6645,6 @@ static const struct hda_fixup alc269_fix + {} + } + }, +- [ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE] = { +- .type = HDA_FIXUP_VERBS, +- .v.verbs = (const struct hda_verb[]) { +- /* Disable pass-through path for FRONT 14h */ +- {0x20, AC_VERB_SET_COEF_INDEX, 0x36}, +- {0x20, AC_VERB_SET_PROC_COEF, 0x1737}, +- {} +- }, +- .chained = true, +- .chain_id = ALC255_FIXUP_DELL1_MIC_NO_PRESENCE +- }, +- [ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE2] = { +- .type = HDA_FIXUP_FUNC, +- .v.func = alc256_fixup_dell_xps_13_headphone_noise2, +- .chained = true, +- .chain_id = ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE +- }, + [ALC293_FIXUP_LENOVO_SPK_NOISE] = { + .type = HDA_FIXUP_FUNC, + .v.func = alc_fixup_disable_aamix, +@@ -7172,17 +7142,14 @@ static const struct snd_pci_quirk alc269 + SND_PCI_QUIRK(0x1028, 0x06de, "Dell", ALC293_FIXUP_DISABLE_AAMIX_MULTIJACK), + SND_PCI_QUIRK(0x1028, 0x06df, "Dell", ALC293_FIXUP_DISABLE_AAMIX_MULTIJACK), + SND_PCI_QUIRK(0x1028, 0x06e0, "Dell", ALC293_FIXUP_DISABLE_AAMIX_MULTIJACK), +- SND_PCI_QUIRK(0x1028, 0x0704, "Dell XPS 13 9350", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE2), + SND_PCI_QUIRK(0x1028, 0x0706, "Dell Inspiron 7559", ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER), + SND_PCI_QUIRK(0x1028, 0x0725, "Dell Inspiron 3162", ALC255_FIXUP_DELL_SPK_NOISE), + SND_PCI_QUIRK(0x1028, 0x0738, "Dell Precision 5820", ALC269_FIXUP_NO_SHUTUP), +- SND_PCI_QUIRK(0x1028, 0x075b, "Dell XPS 13 9360", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE2), + SND_PCI_QUIRK(0x1028, 0x075c, "Dell XPS 27 7760", ALC298_FIXUP_SPK_VOLUME), + SND_PCI_QUIRK(0x1028, 0x075d, "Dell AIO", ALC298_FIXUP_SPK_VOLUME), + SND_PCI_QUIRK(0x1028, 0x07b0, "Dell Precision 7520", ALC295_FIXUP_DISABLE_DAC3), + SND_PCI_QUIRK(0x1028, 0x0798, "Dell Inspiron 17 7000 Gaming", ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER), + SND_PCI_QUIRK(0x1028, 0x080c, "Dell WYSE", ALC225_FIXUP_DELL_WYSE_MIC_NO_PRESENCE), +- SND_PCI_QUIRK(0x1028, 0x082a, "Dell XPS 13 9360", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE2), + SND_PCI_QUIRK(0x1028, 0x084b, "Dell", ALC274_FIXUP_DELL_AIO_LINEOUT_VERB), + SND_PCI_QUIRK(0x1028, 0x084e, "Dell", ALC274_FIXUP_DELL_AIO_LINEOUT_VERB), + SND_PCI_QUIRK(0x1028, 0x0871, "Dell Precision 3630", ALC255_FIXUP_DELL_HEADSET_MIC), +@@ -7536,7 +7503,6 @@ static const struct hda_model_fixup alc2 + {.id = ALC298_FIXUP_DELL1_MIC_NO_PRESENCE, .name = "alc298-dell1"}, + {.id = ALC298_FIXUP_DELL_AIO_MIC_NO_PRESENCE, .name = "alc298-dell-aio"}, + {.id = ALC275_FIXUP_DELL_XPS, .name = "alc275-dell-xps"}, +- {.id = ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE, .name = "alc256-dell-xps13"}, + {.id = ALC293_FIXUP_LENOVO_SPK_NOISE, .name = "lenovo-spk-noise"}, + {.id = ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY, .name = "lenovo-hotkey"}, + {.id = ALC255_FIXUP_DELL_SPK_NOISE, .name = "dell-spk-noise"}, diff --git a/queue-5.5/alsa-hda-realtek-set-principled-pc-beep-configuration-for-alc256.patch b/queue-5.5/alsa-hda-realtek-set-principled-pc-beep-configuration-for-alc256.patch new file mode 100644 index 00000000000..f720afbe4fd --- /dev/null +++ b/queue-5.5/alsa-hda-realtek-set-principled-pc-beep-configuration-for-alc256.patch @@ -0,0 +1,93 @@ +From c44737449468a0bdc50e09ec75e530f208391561 Mon Sep 17 00:00:00 2001 +From: Thomas Hebb +Date: Mon, 30 Mar 2020 12:09:38 -0400 +Subject: ALSA: hda/realtek - Set principled PC Beep configuration for ALC256 + +From: Thomas Hebb + +commit c44737449468a0bdc50e09ec75e530f208391561 upstream. + +The Realtek PC Beep Hidden Register[1] is currently set by +patch_realtek.c in two different places: + +In alc_fill_eapd_coef(), it's set to the value 0x5757, corresponding to +non-beep input on 1Ah and no 1Ah loopback to either headphones or +speakers. (Although, curiously, the loopback amp is still enabled.) This +write was added fairly recently by commit e3743f431143 ("ALSA: +hda/realtek - Dell headphone has noise on unmute for ALC236") and is a +safe default. However, it happens in the wrong place: +alc_fill_eapd_coef() runs on module load and cold boot but not on S3 +resume, meaning the register loses its value after suspend. + +Conversely, in alc256_init(), the register is updated to unset bit 13 +(disable speaker loopback) and set bit 5 (set non-beep input on 1Ah). +Although this write does run on S3 resume, it's not quite enough to fix +up the register's default value of 0x3717. What's missing is a set of +bit 14 to disable headphone loopback. Without that, we end up with a +feedback loop where the headphone jack is being driven by amplified +samples of itself[2]. + +This change eliminates the update in alc256_init() and replaces it with +the 0x5757 write from alc_fill_eapd_coef(). Kailang says that 0x5757 is +supposed to be the codec's default value, so using it will make +debugging easier for Realtek. + +Affects the ALC255, ALC256, ALC257, ALC235, and ALC236 codecs. + +[1] Newly documented in Documentation/sound/hd-audio/realtek-pc-beep.rst + +[2] Setting the "Headphone Mic Boost" control from userspace changes +this feedback loop and has been a widely-shared workaround for headphone +noise on laptops like the Dell XPS 13 9350. This commit eliminates the +feedback loop and makes the workaround unnecessary. + +Fixes: e1e8c1fdce8b ("ALSA: hda/realtek - Dell headphone has noise on unmute for ALC236") +Cc: stable@vger.kernel.org +Signed-off-by: Thomas Hebb +Link: https://lore.kernel.org/r/bf22b417d1f2474b12011c2a39ed6cf8b06d3bf5.1585584498.git.tommyhebb@gmail.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_realtek.c | 15 +++++++++------ + 1 file changed, 9 insertions(+), 6 deletions(-) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -368,7 +368,9 @@ static void alc_fill_eapd_coef(struct hd + case 0x10ec0215: + case 0x10ec0233: + case 0x10ec0235: ++ case 0x10ec0236: + case 0x10ec0255: ++ case 0x10ec0256: + case 0x10ec0257: + case 0x10ec0282: + case 0x10ec0283: +@@ -380,11 +382,6 @@ static void alc_fill_eapd_coef(struct hd + case 0x10ec0300: + alc_update_coef_idx(codec, 0x10, 1<<9, 0); + break; +- case 0x10ec0236: +- case 0x10ec0256: +- alc_write_coef_idx(codec, 0x36, 0x5757); +- alc_update_coef_idx(codec, 0x10, 1<<9, 0); +- break; + case 0x10ec0275: + alc_update_coef_idx(codec, 0xe, 0, 1<<0); + break; +@@ -3371,7 +3368,13 @@ static void alc256_init(struct hda_codec + alc_update_coefex_idx(codec, 0x57, 0x04, 0x0007, 0x4); /* Hight power */ + alc_update_coefex_idx(codec, 0x53, 0x02, 0x8000, 1 << 15); /* Clear bit */ + alc_update_coefex_idx(codec, 0x53, 0x02, 0x8000, 0 << 15); +- alc_update_coef_idx(codec, 0x36, 1 << 13, 1 << 5); /* Switch pcbeep path to Line in path*/ ++ /* ++ * Expose headphone mic (or possibly Line In on some machines) instead ++ * of PC Beep on 1Ah, and disable 1Ah loopback for all outputs. See ++ * Documentation/sound/hd-audio/realtek-pc-beep.rst for details of ++ * this register. ++ */ ++ alc_write_coef_idx(codec, 0x36, 0x5757); + } + + static void alc256_shutup(struct hda_codec *codec) diff --git a/queue-5.5/alsa-ice1724-fix-invalid-access-for-enumerated-ctl-items.patch b/queue-5.5/alsa-ice1724-fix-invalid-access-for-enumerated-ctl-items.patch new file mode 100644 index 00000000000..46c56c784f4 --- /dev/null +++ b/queue-5.5/alsa-ice1724-fix-invalid-access-for-enumerated-ctl-items.patch @@ -0,0 +1,46 @@ +From c47914c00be346bc5b48c48de7b0da5c2d1a296c Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Tue, 7 Apr 2020 10:44:02 +0200 +Subject: ALSA: ice1724: Fix invalid access for enumerated ctl items + +From: Takashi Iwai + +commit c47914c00be346bc5b48c48de7b0da5c2d1a296c upstream. + +The access to Analog Capture Source control value implemented in +prodigy_hifi.c is wrong, as caught by the recently introduced sanity +check; it should be accessing value.enumerated.item[] instead of +value.integer.value[]. This patch corrects the wrong access pattern. + +Fixes: 6b8d6e5518e2 ("[ALSA] ICE1724: Added support for Audiotrak Prodigy 7.1 HiFi & HD2, Hercules Fortissimo IV") +BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=207139 +Reviewed-by: Jaroslav Kysela +Cc: +Link: https://lore.kernel.org/r/20200407084402.25589-3-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/ice1712/prodigy_hifi.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/sound/pci/ice1712/prodigy_hifi.c ++++ b/sound/pci/ice1712/prodigy_hifi.c +@@ -536,7 +536,7 @@ static int wm_adc_mux_enum_get(struct sn + struct snd_ice1712 *ice = snd_kcontrol_chip(kcontrol); + + mutex_lock(&ice->gpio_mutex); +- ucontrol->value.integer.value[0] = wm_get(ice, WM_ADC_MUX) & 0x1f; ++ ucontrol->value.enumerated.item[0] = wm_get(ice, WM_ADC_MUX) & 0x1f; + mutex_unlock(&ice->gpio_mutex); + return 0; + } +@@ -550,7 +550,7 @@ static int wm_adc_mux_enum_put(struct sn + + mutex_lock(&ice->gpio_mutex); + oval = wm_get(ice, WM_ADC_MUX); +- nval = (oval & 0xe0) | ucontrol->value.integer.value[0]; ++ nval = (oval & 0xe0) | ucontrol->value.enumerated.item[0]; + if (nval != oval) { + wm_put(ice, WM_ADC_MUX, nval); + change = 1; diff --git a/queue-5.5/alsa-pcm-oss-fix-regression-by-buffer-overflow-fix.patch b/queue-5.5/alsa-pcm-oss-fix-regression-by-buffer-overflow-fix.patch new file mode 100644 index 00000000000..50e8fb56ed3 --- /dev/null +++ b/queue-5.5/alsa-pcm-oss-fix-regression-by-buffer-overflow-fix.patch @@ -0,0 +1,126 @@ +From ae769d3556644888c964635179ef192995f40793 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Fri, 3 Apr 2020 09:25:15 +0200 +Subject: ALSA: pcm: oss: Fix regression by buffer overflow fix + +From: Takashi Iwai + +commit ae769d3556644888c964635179ef192995f40793 upstream. + +The recent fix for the OOB access in PCM OSS plugins (commit +f2ecf903ef06: "ALSA: pcm: oss: Avoid plugin buffer overflow") caused a +regression on OSS applications. The patch introduced the size check +in client and slave size calculations to limit to each plugin's buffer +size, but I overlooked that some code paths call those without +allocating the buffer but just for estimation. + +This patch fixes the bug by skipping the size check for those code +paths while keeping checking in the actual transfer calls. + +Fixes: f2ecf903ef06 ("ALSA: pcm: oss: Avoid plugin buffer overflow") +Tested-and-reported-by: Jari Ruusu +Cc: +Link: https://lore.kernel.org/r/20200403072515.25539-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/core/oss/pcm_plugin.c | 32 ++++++++++++++++++++++++-------- + 1 file changed, 24 insertions(+), 8 deletions(-) + +--- a/sound/core/oss/pcm_plugin.c ++++ b/sound/core/oss/pcm_plugin.c +@@ -196,7 +196,9 @@ int snd_pcm_plugin_free(struct snd_pcm_p + return 0; + } + +-snd_pcm_sframes_t snd_pcm_plug_client_size(struct snd_pcm_substream *plug, snd_pcm_uframes_t drv_frames) ++static snd_pcm_sframes_t plug_client_size(struct snd_pcm_substream *plug, ++ snd_pcm_uframes_t drv_frames, ++ bool check_size) + { + struct snd_pcm_plugin *plugin, *plugin_prev, *plugin_next; + int stream; +@@ -209,7 +211,7 @@ snd_pcm_sframes_t snd_pcm_plug_client_si + if (stream == SNDRV_PCM_STREAM_PLAYBACK) { + plugin = snd_pcm_plug_last(plug); + while (plugin && drv_frames > 0) { +- if (drv_frames > plugin->buf_frames) ++ if (check_size && drv_frames > plugin->buf_frames) + drv_frames = plugin->buf_frames; + plugin_prev = plugin->prev; + if (plugin->src_frames) +@@ -222,7 +224,7 @@ snd_pcm_sframes_t snd_pcm_plug_client_si + plugin_next = plugin->next; + if (plugin->dst_frames) + drv_frames = plugin->dst_frames(plugin, drv_frames); +- if (drv_frames > plugin->buf_frames) ++ if (check_size && drv_frames > plugin->buf_frames) + drv_frames = plugin->buf_frames; + plugin = plugin_next; + } +@@ -231,7 +233,9 @@ snd_pcm_sframes_t snd_pcm_plug_client_si + return drv_frames; + } + +-snd_pcm_sframes_t snd_pcm_plug_slave_size(struct snd_pcm_substream *plug, snd_pcm_uframes_t clt_frames) ++static snd_pcm_sframes_t plug_slave_size(struct snd_pcm_substream *plug, ++ snd_pcm_uframes_t clt_frames, ++ bool check_size) + { + struct snd_pcm_plugin *plugin, *plugin_prev, *plugin_next; + snd_pcm_sframes_t frames; +@@ -252,14 +256,14 @@ snd_pcm_sframes_t snd_pcm_plug_slave_siz + if (frames < 0) + return frames; + } +- if (frames > plugin->buf_frames) ++ if (check_size && frames > plugin->buf_frames) + frames = plugin->buf_frames; + plugin = plugin_next; + } + } else if (stream == SNDRV_PCM_STREAM_CAPTURE) { + plugin = snd_pcm_plug_last(plug); + while (plugin) { +- if (frames > plugin->buf_frames) ++ if (check_size && frames > plugin->buf_frames) + frames = plugin->buf_frames; + plugin_prev = plugin->prev; + if (plugin->src_frames) { +@@ -274,6 +278,18 @@ snd_pcm_sframes_t snd_pcm_plug_slave_siz + return frames; + } + ++snd_pcm_sframes_t snd_pcm_plug_client_size(struct snd_pcm_substream *plug, ++ snd_pcm_uframes_t drv_frames) ++{ ++ return plug_client_size(plug, drv_frames, false); ++} ++ ++snd_pcm_sframes_t snd_pcm_plug_slave_size(struct snd_pcm_substream *plug, ++ snd_pcm_uframes_t clt_frames) ++{ ++ return plug_slave_size(plug, clt_frames, false); ++} ++ + static int snd_pcm_plug_formats(const struct snd_mask *mask, + snd_pcm_format_t format) + { +@@ -630,7 +646,7 @@ snd_pcm_sframes_t snd_pcm_plug_write_tra + src_channels = dst_channels; + plugin = next; + } +- return snd_pcm_plug_client_size(plug, frames); ++ return plug_client_size(plug, frames, true); + } + + snd_pcm_sframes_t snd_pcm_plug_read_transfer(struct snd_pcm_substream *plug, struct snd_pcm_plugin_channel *dst_channels_final, snd_pcm_uframes_t size) +@@ -640,7 +656,7 @@ snd_pcm_sframes_t snd_pcm_plug_read_tran + snd_pcm_sframes_t frames = size; + int err; + +- frames = snd_pcm_plug_slave_size(plug, frames); ++ frames = plug_slave_size(plug, frames, true); + if (frames < 0) + return frames; + diff --git a/queue-5.5/alsa-usb-audio-add-mixer-workaround-for-trx40-and-co.patch b/queue-5.5/alsa-usb-audio-add-mixer-workaround-for-trx40-and-co.patch new file mode 100644 index 00000000000..8c97387ea06 --- /dev/null +++ b/queue-5.5/alsa-usb-audio-add-mixer-workaround-for-trx40-and-co.patch @@ -0,0 +1,77 @@ +From 2a48218f8e23d47bd3e23cfdfb8aa9066f7dc3e6 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Wed, 8 Apr 2020 16:04:48 +0200 +Subject: ALSA: usb-audio: Add mixer workaround for TRX40 and co + +From: Takashi Iwai + +commit 2a48218f8e23d47bd3e23cfdfb8aa9066f7dc3e6 upstream. + +Some recent boards (supposedly with a new AMD platform) contain the +USB audio class 2 device that is often tied with HD-audio. The device +exposes an Input Gain Pad control (id=19, control=12) but this node +doesn't behave correctly, returning an error for each inquiry of +GET_MIN and GET_MAX that should have been mandatory. + +As a workaround, simply ignore this node by adding a usbmix_name_map +table entry. The currently known devices are: +* 0414:a002 - Gigabyte TRX40 Aorus Pro WiFi +* 0b05:1916 - ASUS ROG Zenith II +* 0b05:1917 - ASUS ROG Strix +* 0db0:0d64 - MSI TRX40 Creator +* 0db0:543d - MSI TRX40 + +BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=206543 +Cc: +Link: https://lore.kernel.org/r/20200408140449.22319-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/usb/mixer_maps.c | 28 ++++++++++++++++++++++++++++ + 1 file changed, 28 insertions(+) + +--- a/sound/usb/mixer_maps.c ++++ b/sound/usb/mixer_maps.c +@@ -349,6 +349,14 @@ static const struct usbmix_name_map dell + { 0 } + }; + ++/* Some mobos shipped with a dummy HD-audio show the invalid GET_MIN/GET_MAX ++ * response for Input Gain Pad (id=19, control=12). Skip it. ++ */ ++static const struct usbmix_name_map asus_rog_map[] = { ++ { 19, NULL, 12 }, /* FU, Input Gain Pad */ ++ {} ++}; ++ + /* + * Control map entries + */ +@@ -468,6 +476,26 @@ static struct usbmix_ctl_map usbmix_ctl_ + .id = USB_ID(0x05a7, 0x1020), + .map = bose_companion5_map, + }, ++ { /* Gigabyte TRX40 Aorus Pro WiFi */ ++ .id = USB_ID(0x0414, 0xa002), ++ .map = asus_rog_map, ++ }, ++ { /* ASUS ROG Zenith II */ ++ .id = USB_ID(0x0b05, 0x1916), ++ .map = asus_rog_map, ++ }, ++ { /* ASUS ROG Strix */ ++ .id = USB_ID(0x0b05, 0x1917), ++ .map = asus_rog_map, ++ }, ++ { /* MSI TRX40 Creator */ ++ .id = USB_ID(0x0db0, 0x0d64), ++ .map = asus_rog_map, ++ }, ++ { /* MSI TRX40 */ ++ .id = USB_ID(0x0db0, 0x543d), ++ .map = asus_rog_map, ++ }, + { 0 } /* terminator */ + }; + diff --git a/queue-5.5/media-hantro-read-be32-words-starting-at-every-fourth-byte.patch b/queue-5.5/media-hantro-read-be32-words-starting-at-every-fourth-byte.patch new file mode 100644 index 00000000000..2002c975115 --- /dev/null +++ b/queue-5.5/media-hantro-read-be32-words-starting-at-every-fourth-byte.patch @@ -0,0 +1,72 @@ +From e34bca49e4953e5c2afc0425303199a5fd515f82 Mon Sep 17 00:00:00 2001 +From: Andrzej Pietrasiewicz +Date: Mon, 27 Jan 2020 15:30:06 +0100 +Subject: media: hantro: Read be32 words starting at every fourth byte + +From: Andrzej Pietrasiewicz + +commit e34bca49e4953e5c2afc0425303199a5fd515f82 upstream. + +Since (luma/chroma)_qtable is an array of unsigned char, indexing it +returns consecutive byte locations, but we are supposed to read the arrays +in four-byte words. Consequently, we should be pointing +get_unaligned_be32() at consecutive word locations instead. + +Signed-off-by: Andrzej Pietrasiewicz +Reviewed-by: Ezequiel Garcia +Tested-by: Ezequiel Garcia +Cc: stable@vger.kernel.org +Fixes: 00c30f42c7595f "media: rockchip vpu: remove some unused vars" +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/media/hantro/hantro_h1_jpeg_enc.c | 9 +++++++-- + drivers/staging/media/hantro/rk3399_vpu_hw_jpeg_enc.c | 9 +++++++-- + 2 files changed, 14 insertions(+), 4 deletions(-) + +--- a/drivers/staging/media/hantro/hantro_h1_jpeg_enc.c ++++ b/drivers/staging/media/hantro/hantro_h1_jpeg_enc.c +@@ -67,12 +67,17 @@ hantro_h1_jpeg_enc_set_qtable(struct han + unsigned char *chroma_qtable) + { + u32 reg, i; ++ __be32 *luma_qtable_p; ++ __be32 *chroma_qtable_p; ++ ++ luma_qtable_p = (__be32 *)luma_qtable; ++ chroma_qtable_p = (__be32 *)chroma_qtable; + + for (i = 0; i < H1_JPEG_QUANT_TABLE_COUNT; i++) { +- reg = get_unaligned_be32(&luma_qtable[i]); ++ reg = get_unaligned_be32(&luma_qtable_p[i]); + vepu_write_relaxed(vpu, reg, H1_REG_JPEG_LUMA_QUAT(i)); + +- reg = get_unaligned_be32(&chroma_qtable[i]); ++ reg = get_unaligned_be32(&chroma_qtable_p[i]); + vepu_write_relaxed(vpu, reg, H1_REG_JPEG_CHROMA_QUAT(i)); + } + } +--- a/drivers/staging/media/hantro/rk3399_vpu_hw_jpeg_enc.c ++++ b/drivers/staging/media/hantro/rk3399_vpu_hw_jpeg_enc.c +@@ -98,12 +98,17 @@ rk3399_vpu_jpeg_enc_set_qtable(struct ha + unsigned char *chroma_qtable) + { + u32 reg, i; ++ __be32 *luma_qtable_p; ++ __be32 *chroma_qtable_p; ++ ++ luma_qtable_p = (__be32 *)luma_qtable; ++ chroma_qtable_p = (__be32 *)chroma_qtable; + + for (i = 0; i < VEPU_JPEG_QUANT_TABLE_COUNT; i++) { +- reg = get_unaligned_be32(&luma_qtable[i]); ++ reg = get_unaligned_be32(&luma_qtable_p[i]); + vepu_write_relaxed(vpu, reg, VEPU_REG_JPEG_LUMA_QUAT(i)); + +- reg = get_unaligned_be32(&chroma_qtable[i]); ++ reg = get_unaligned_be32(&chroma_qtable_p[i]); + vepu_write_relaxed(vpu, reg, VEPU_REG_JPEG_CHROMA_QUAT(i)); + } + } diff --git a/queue-5.5/media-ti-vpe-cal-fix-a-kernel-oops-when-unloading-module.patch b/queue-5.5/media-ti-vpe-cal-fix-a-kernel-oops-when-unloading-module.patch new file mode 100644 index 00000000000..013de4306c6 --- /dev/null +++ b/queue-5.5/media-ti-vpe-cal-fix-a-kernel-oops-when-unloading-module.patch @@ -0,0 +1,82 @@ +From 80264809ea0a3fd2ee8251f31a9eb85d2c3fc77e Mon Sep 17 00:00:00 2001 +From: Benoit Parrot +Date: Fri, 6 Mar 2020 14:08:39 +0100 +Subject: media: ti-vpe: cal: fix a kernel oops when unloading module + +From: Benoit Parrot + +commit 80264809ea0a3fd2ee8251f31a9eb85d2c3fc77e upstream. + +After the switch to use v4l2_async_notifier_add_subdev() and +v4l2_async_notifier_cleanup(), unloading the ti_cal module would cause a +kernel oops. + +This was root cause to the fact that v4l2_async_notifier_cleanup() tries +to kfree the asd pointer passed into v4l2_async_notifier_add_subdev(). + +In our case the asd reference was from a statically allocated struct. +So in effect v4l2_async_notifier_cleanup() was trying to free a pointer +that was not kalloc. + +So here we switch to using a kzalloc struct instead of a static one. +To achieve this we re-order some of the calls to prevent asd allocation +from leaking. + +Fixes: d079f94c9046 ("media: platform: Switch to v4l2_async_notifier_add_subdev") +Cc: stable@vger.kernel.org +Signed-off-by: Benoit Parrot +Reviewed-by: Tomi Valkeinen +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/platform/ti-vpe/cal.c | 13 ++++++++----- + 1 file changed, 8 insertions(+), 5 deletions(-) + +--- a/drivers/media/platform/ti-vpe/cal.c ++++ b/drivers/media/platform/ti-vpe/cal.c +@@ -266,8 +266,6 @@ struct cal_ctx { + struct v4l2_subdev *sensor; + struct v4l2_fwnode_endpoint endpoint; + +- struct v4l2_async_subdev asd; +- + struct v4l2_fh fh; + struct cal_dev *dev; + struct cc_data *cc; +@@ -1648,7 +1646,6 @@ static int of_cal_create_instance(struct + + parent = pdev->dev.of_node; + +- asd = &ctx->asd; + endpoint = &ctx->endpoint; + + ep_node = NULL; +@@ -1695,8 +1692,6 @@ static int of_cal_create_instance(struct + ctx_dbg(3, ctx, "can't get remote parent\n"); + goto cleanup_exit; + } +- asd->match_type = V4L2_ASYNC_MATCH_FWNODE; +- asd->match.fwnode = of_fwnode_handle(sensor_node); + + v4l2_fwnode_endpoint_parse(of_fwnode_handle(ep_node), endpoint); + +@@ -1726,9 +1721,17 @@ static int of_cal_create_instance(struct + + v4l2_async_notifier_init(&ctx->notifier); + ++ asd = kzalloc(sizeof(*asd), GFP_KERNEL); ++ if (!asd) ++ goto cleanup_exit; ++ ++ asd->match_type = V4L2_ASYNC_MATCH_FWNODE; ++ asd->match.fwnode = of_fwnode_handle(sensor_node); ++ + ret = v4l2_async_notifier_add_subdev(&ctx->notifier, asd); + if (ret) { + ctx_err(ctx, "Error adding asd\n"); ++ kfree(asd); + goto cleanup_exit; + } + diff --git a/queue-5.5/media-ti-vpe-cal-fix-disable_irqs-to-only-the-intended-target.patch b/queue-5.5/media-ti-vpe-cal-fix-disable_irqs-to-only-the-intended-target.patch new file mode 100644 index 00000000000..89201cc4c44 --- /dev/null +++ b/queue-5.5/media-ti-vpe-cal-fix-disable_irqs-to-only-the-intended-target.patch @@ -0,0 +1,49 @@ +From 1db56284b9da9056093681f28db48a09a243274b Mon Sep 17 00:00:00 2001 +From: Benoit Parrot +Date: Mon, 2 Mar 2020 14:56:52 +0100 +Subject: media: ti-vpe: cal: fix disable_irqs to only the intended target + +From: Benoit Parrot + +commit 1db56284b9da9056093681f28db48a09a243274b upstream. + +disable_irqs() was mistakenly disabling all interrupts when called. +This cause all port stream to stop even if only stopping one of them. + +Cc: stable +Signed-off-by: Benoit Parrot +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/platform/ti-vpe/cal.c | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +--- a/drivers/media/platform/ti-vpe/cal.c ++++ b/drivers/media/platform/ti-vpe/cal.c +@@ -537,16 +537,16 @@ static void enable_irqs(struct cal_ctx * + + static void disable_irqs(struct cal_ctx *ctx) + { ++ u32 val; ++ + /* Disable IRQ_WDMA_END 0/1 */ +- reg_write_field(ctx->dev, +- CAL_HL_IRQENABLE_CLR(2), +- CAL_HL_IRQ_CLEAR, +- CAL_HL_IRQ_MASK(ctx->csi2_port)); ++ val = 0; ++ set_field(&val, CAL_HL_IRQ_CLEAR, CAL_HL_IRQ_MASK(ctx->csi2_port)); ++ reg_write(ctx->dev, CAL_HL_IRQENABLE_CLR(2), val); + /* Disable IRQ_WDMA_START 0/1 */ +- reg_write_field(ctx->dev, +- CAL_HL_IRQENABLE_CLR(3), +- CAL_HL_IRQ_CLEAR, +- CAL_HL_IRQ_MASK(ctx->csi2_port)); ++ val = 0; ++ set_field(&val, CAL_HL_IRQ_CLEAR, CAL_HL_IRQ_MASK(ctx->csi2_port)); ++ reg_write(ctx->dev, CAL_HL_IRQENABLE_CLR(3), val); + /* Todo: Add VC_IRQ and CSI2_COMPLEXIO_IRQ handling */ + reg_write(ctx->dev, CAL_CSI2_VC_IRQENABLE(1), 0); + } diff --git a/queue-5.5/media-venus-cache-vb-payload-to-be-used-by-clock-scaling.patch b/queue-5.5/media-venus-cache-vb-payload-to-be-used-by-clock-scaling.patch new file mode 100644 index 00000000000..91f23c156b1 --- /dev/null +++ b/queue-5.5/media-venus-cache-vb-payload-to-be-used-by-clock-scaling.patch @@ -0,0 +1,143 @@ +From fd1ee315dcd4a0f913a74939eb88f6d9b0bd9250 Mon Sep 17 00:00:00 2001 +From: Stanimir Varbanov +Date: Thu, 13 Feb 2020 10:55:14 +0100 +Subject: media: venus: cache vb payload to be used by clock scaling + +From: Stanimir Varbanov + +commit fd1ee315dcd4a0f913a74939eb88f6d9b0bd9250 upstream. + +Instead of iterate over previously queued buffers in clock +scaling code do cache the payload in instance context structure +for later use when calculating new clock rate. + +This will avoid to use spin locks during buffer list iteration +in clock_scaling. + +This fixes following kernel Oops: + + Unable to handle kernel paging request at virtual address deacfffffffffd6c + Mem abort info: + ESR = 0x96000004 + EC = 0x25: DABT (current EL), IL = 32 bits + SET = 0, FnV = 0 + EA = 0, S1PTW = 0 + Data abort info: + ISV = 0, ISS = 0x00000004 + CM = 0, WnR = 0 + [deacfffffffffd6c] address between user and kernel address ranges + Internal error: Oops: 96000004 [#1] PREEMPT SMP + CPU: 7 PID: 5763 Comm: V4L2DecoderThre Tainted: G S W 5.4.11 #8 + pstate: 20400009 (nzCv daif +PAN -UAO) + pc : load_scale_v4+0x4c/0x2bc [venus_core] + lr : session_process_buf+0x18c/0x1c0 [venus_core] + sp : ffffffc01376b8d0 + x29: ffffffc01376b8d0 x28: ffffff80cf1b0220 + x27: ffffffc01376bba0 x26: ffffffd8f562b2d8 + x25: ffffff80cf1b0220 x24: 0000000000000005 + x23: ffffffd8f5620d98 x22: ffffff80ca01c800 + x21: ffffff80cf1b0000 x20: ffffff8149490080 + x19: ffffff8174b2c010 x18: 0000000000000000 + x17: 0000000000000000 x16: ffffffd96ee3a0dc + x15: 0000000000000026 x14: 0000000000000026 + x13: 00000000000055ac x12: 0000000000000001 + x11: deacfffffffffd6c x10: dead000000000100 + x9 : ffffff80ca01cf28 x8 : 0000000000000026 + x7 : 0000000000000000 x6 : ffffff80cdd899c0 + x5 : ffffff80cdd899c0 x4 : 0000000000000008 + x3 : ffffff80ca01cf28 x2 : ffffff80ca01cf28 + x1 : ffffff80d47ffc00 x0 : ffffff80cf1b0000 + Call trace: + load_scale_v4+0x4c/0x2bc [venus_core] + session_process_buf+0x18c/0x1c0 [venus_core] + venus_helper_vb2_buf_queue+0x7c/0xf0 [venus_core] + __enqueue_in_driver+0xe4/0xfc [videobuf2_common] + vb2_core_qbuf+0x15c/0x338 [videobuf2_common] + vb2_qbuf+0x78/0xb8 [videobuf2_v4l2] + v4l2_m2m_qbuf+0x80/0xf8 [v4l2_mem2mem] + v4l2_m2m_ioctl_qbuf+0x2c/0x38 [v4l2_mem2mem] + v4l_qbuf+0x48/0x58 + __video_do_ioctl+0x2b0/0x39c + video_usercopy+0x394/0x710 + video_ioctl2+0x38/0x48 + v4l2_ioctl+0x6c/0x80 + do_video_ioctl+0xb00/0x2874 + v4l2_compat_ioctl32+0x5c/0xcc + __se_compat_sys_ioctl+0x100/0x2074 + __arm64_compat_sys_ioctl+0x20/0x2c + el0_svc_common+0xa4/0x154 + el0_svc_compat_handler+0x2c/0x38 + el0_svc_compat+0x8/0x10 + Code: eb0a013f 54000200 aa1f03e8 d10e514b (b940016c) + ---[ end trace e11304b46552e0b9 ]--- + +Fixes: c0e284ccfeda ("media: venus: Update clock scaling") + +Cc: stable@vger.kernel.org # v5.5+ +Signed-off-by: Stanimir Varbanov +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/platform/qcom/venus/core.h | 1 + + drivers/media/platform/qcom/venus/helpers.c | 20 +++++++++++++------- + 2 files changed, 14 insertions(+), 7 deletions(-) + +--- a/drivers/media/platform/qcom/venus/core.h ++++ b/drivers/media/platform/qcom/venus/core.h +@@ -344,6 +344,7 @@ struct venus_inst { + unsigned int subscriptions; + int buf_count; + struct venus_ts_metadata tss[VIDEO_MAX_FRAME]; ++ unsigned long payloads[VIDEO_MAX_FRAME]; + u64 fps; + struct v4l2_fract timeperframe; + const struct venus_format *fmt_out; +--- a/drivers/media/platform/qcom/venus/helpers.c ++++ b/drivers/media/platform/qcom/venus/helpers.c +@@ -544,18 +544,13 @@ static int scale_clocks_v4(struct venus_ + struct venus_core *core = inst->core; + const struct freq_tbl *table = core->res->freq_tbl; + unsigned int num_rows = core->res->freq_tbl_size; +- struct v4l2_m2m_ctx *m2m_ctx = inst->m2m_ctx; + struct device *dev = core->dev; + unsigned long freq = 0, freq_core1 = 0, freq_core2 = 0; + unsigned long filled_len = 0; +- struct venus_buffer *buf, *n; +- struct vb2_buffer *vb; + int i, ret; + +- v4l2_m2m_for_each_src_buf_safe(m2m_ctx, buf, n) { +- vb = &buf->vb.vb2_buf; +- filled_len = max(filled_len, vb2_get_plane_payload(vb, 0)); +- } ++ for (i = 0; i < inst->num_input_bufs; i++) ++ filled_len = max(filled_len, inst->payloads[i]); + + if (inst->session_type == VIDC_SESSION_TYPE_DEC && !filled_len) + return 0; +@@ -1289,6 +1284,15 @@ int venus_helper_vb2_buf_prepare(struct + } + EXPORT_SYMBOL_GPL(venus_helper_vb2_buf_prepare); + ++static void cache_payload(struct venus_inst *inst, struct vb2_buffer *vb) ++{ ++ struct vb2_v4l2_buffer *vbuf = to_vb2_v4l2_buffer(vb); ++ unsigned int idx = vbuf->vb2_buf.index; ++ ++ if (vbuf->vb2_buf.type == V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE) ++ inst->payloads[idx] = vb2_get_plane_payload(vb, 0); ++} ++ + void venus_helper_vb2_buf_queue(struct vb2_buffer *vb) + { + struct vb2_v4l2_buffer *vbuf = to_vb2_v4l2_buffer(vb); +@@ -1300,6 +1304,8 @@ void venus_helper_vb2_buf_queue(struct v + + v4l2_m2m_buf_queue(m2m_ctx, vbuf); + ++ cache_payload(inst, vb); ++ + if (inst->session_type == VIDC_SESSION_TYPE_ENC && + !(inst->streamon_out && inst->streamon_cap)) + goto unlock; diff --git a/queue-5.5/media-venus-firmware-ignore-secure-call-error-on-first-resume.patch b/queue-5.5/media-venus-firmware-ignore-secure-call-error-on-first-resume.patch new file mode 100644 index 00000000000..d4989a875a4 --- /dev/null +++ b/queue-5.5/media-venus-firmware-ignore-secure-call-error-on-first-resume.patch @@ -0,0 +1,44 @@ +From 2632e7b618a7730969f9782593c29ca53553aa22 Mon Sep 17 00:00:00 2001 +From: Stanimir Varbanov +Date: Wed, 4 Mar 2020 11:09:49 +0100 +Subject: media: venus: firmware: Ignore secure call error on first resume + +From: Stanimir Varbanov + +commit 2632e7b618a7730969f9782593c29ca53553aa22 upstream. + +With the latest cleanup in qcom scm driver the secure monitor +call for setting the remote processor state returns EINVAL when +it is called for the first time and after another scm call +auth_and_reset. The error returned from scm call could be ignored +because the state transition is already done in auth_and_reset. + +Acked-by: Bjorn Andersson +Signed-off-by: Stanimir Varbanov +Cc: stable@vger.kernel.org +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/platform/qcom/venus/firmware.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +--- a/drivers/media/platform/qcom/venus/firmware.c ++++ b/drivers/media/platform/qcom/venus/firmware.c +@@ -44,8 +44,14 @@ static void venus_reset_cpu(struct venus + + int venus_set_hw_state(struct venus_core *core, bool resume) + { +- if (core->use_tz) +- return qcom_scm_set_remote_state(resume, 0); ++ int ret; ++ ++ if (core->use_tz) { ++ ret = qcom_scm_set_remote_state(resume, 0); ++ if (resume && ret == -EINVAL) ++ ret = 0; ++ return ret; ++ } + + if (resume) + venus_reset_cpu(core); diff --git a/queue-5.5/series b/queue-5.5/series index d01e2f6bb8f..759ee3e4034 100644 --- a/queue-5.5/series +++ b/queue-5.5/series @@ -82,3 +82,22 @@ asoc-fix-regwmask.patch asoc-dapm-connect-virtual-mux-with-default-value.patch asoc-dpcm-allow-start-or-stop-during-pause-for-backend.patch asoc-topology-use-name_prefix-for-new-kcontrol.patch +usb-gadget-f_fs-fix-use-after-free-issue-as-part-of-queue-failure.patch +usb-gadget-composite-inform-controller-driver-of-self-powered.patch +alsa-usb-audio-add-mixer-workaround-for-trx40-and-co.patch +alsa-hda-add-driver-blacklist.patch +alsa-hda-fix-potential-access-overflow-in-beep-helper.patch +alsa-ice1724-fix-invalid-access-for-enumerated-ctl-items.patch +alsa-pcm-oss-fix-regression-by-buffer-overflow-fix.patch +alsa-hda-realtek-enable-mute-led-on-an-hp-system.patch +alsa-hda-realtek-a-fake-key-event-is-triggered-by-running-shutup.patch +alsa-doc-document-pc-beep-hidden-register-on-realtek-alc256.patch +alsa-hda-realtek-set-principled-pc-beep-configuration-for-alc256.patch +alsa-hda-realtek-remove-now-unnecessary-xps-13-headphone-noise-fixups.patch +alsa-hda-realtek-add-quirk-for-lenovo-carbon-x1-8th-gen.patch +alsa-hda-realtek-add-quirk-for-msi-gl63.patch +media-venus-cache-vb-payload-to-be-used-by-clock-scaling.patch +media-venus-firmware-ignore-secure-call-error-on-first-resume.patch +media-hantro-read-be32-words-starting-at-every-fourth-byte.patch +media-ti-vpe-cal-fix-disable_irqs-to-only-the-intended-target.patch +media-ti-vpe-cal-fix-a-kernel-oops-when-unloading-module.patch diff --git a/queue-5.5/usb-gadget-composite-inform-controller-driver-of-self-powered.patch b/queue-5.5/usb-gadget-composite-inform-controller-driver-of-self-powered.patch new file mode 100644 index 00000000000..3810e92afcc --- /dev/null +++ b/queue-5.5/usb-gadget-composite-inform-controller-driver-of-self-powered.patch @@ -0,0 +1,57 @@ +From 5e5caf4fa8d3039140b4548b6ab23dd17fce9b2c Mon Sep 17 00:00:00 2001 +From: Thinh Nguyen +Date: Mon, 3 Feb 2020 18:05:32 -0800 +Subject: usb: gadget: composite: Inform controller driver of self-powered + +From: Thinh Nguyen + +commit 5e5caf4fa8d3039140b4548b6ab23dd17fce9b2c upstream. + +Different configuration/condition may draw different power. Inform the +controller driver of the change so it can respond properly (e.g. +GET_STATUS request). This fixes an issue with setting MaxPower from +configfs. The composite driver doesn't check this value when setting +self-powered. + +Cc: stable@vger.kernel.org +Fixes: 88af8bbe4ef7 ("usb: gadget: the start of the configfs interface") +Signed-off-by: Thinh Nguyen +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/gadget/composite.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +--- a/drivers/usb/gadget/composite.c ++++ b/drivers/usb/gadget/composite.c +@@ -861,6 +861,11 @@ static int set_config(struct usb_composi + else + power = min(power, 900U); + done: ++ if (power <= USB_SELF_POWER_VBUS_MAX_DRAW) ++ usb_gadget_set_selfpowered(gadget); ++ else ++ usb_gadget_clear_selfpowered(gadget); ++ + usb_gadget_vbus_draw(gadget, power); + if (result >= 0 && cdev->delayed_status) + result = USB_GADGET_DELAYED_STATUS; +@@ -2279,6 +2284,7 @@ void composite_suspend(struct usb_gadget + + cdev->suspended = 1; + ++ usb_gadget_set_selfpowered(gadget); + usb_gadget_vbus_draw(gadget, 2); + } + +@@ -2307,6 +2313,9 @@ void composite_resume(struct usb_gadget + else + maxpower = min(maxpower, 900U); + ++ if (maxpower > USB_SELF_POWER_VBUS_MAX_DRAW) ++ usb_gadget_clear_selfpowered(gadget); ++ + usb_gadget_vbus_draw(gadget, maxpower); + } + diff --git a/queue-5.5/usb-gadget-f_fs-fix-use-after-free-issue-as-part-of-queue-failure.patch b/queue-5.5/usb-gadget-f_fs-fix-use-after-free-issue-as-part-of-queue-failure.patch new file mode 100644 index 00000000000..b6aa121d518 --- /dev/null +++ b/queue-5.5/usb-gadget-f_fs-fix-use-after-free-issue-as-part-of-queue-failure.patch @@ -0,0 +1,38 @@ +From f63ec55ff904b2f2e126884fcad93175f16ab4bb Mon Sep 17 00:00:00 2001 +From: Sriharsha Allenki +Date: Thu, 26 Mar 2020 17:26:20 +0530 +Subject: usb: gadget: f_fs: Fix use after free issue as part of queue failure + +From: Sriharsha Allenki + +commit f63ec55ff904b2f2e126884fcad93175f16ab4bb upstream. + +In AIO case, the request is freed up if ep_queue fails. +However, io_data->req still has the reference to this freed +request. In the case of this failure if there is aio_cancel +call on this io_data it will lead to an invalid dequeue +operation and a potential use after free issue. +Fix this by setting the io_data->req to NULL when the request +is freed as part of queue failure. + +Fixes: 2e4c7553cd6f ("usb: gadget: f_fs: add aio support") +Signed-off-by: Sriharsha Allenki +CC: stable +Reviewed-by: Peter Chen +Link: https://lore.kernel.org/r/20200326115620.12571-1-sallenki@codeaurora.org +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/gadget/function/f_fs.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/gadget/function/f_fs.c ++++ b/drivers/usb/gadget/function/f_fs.c +@@ -1120,6 +1120,7 @@ static ssize_t ffs_epfile_io(struct file + + ret = usb_ep_queue(ep->ep, req, GFP_ATOMIC); + if (unlikely(ret)) { ++ io_data->req = NULL; + usb_ep_free_request(ep->ep, req); + goto error_lock; + }