Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 95495cdf authored by Greg Kroah-Hartman's avatar Greg Kroah-Hartman
Browse files

Merge 4.14.177 into android-4.14-stable



Changes in 4.14.177
	bus: sunxi-rsb: Return correct data when mixing 16-bit and 8-bit reads
	net: vxge: fix wrong __VA_ARGS__ usage
	hinic: fix a bug of waitting for IO stopped
	hinic: fix wrong para of wait_for_completion_timeout
	cxgb4/ptp: pass the sign of offset delta in FW CMD
	qlcnic: Fix bad kzalloc null test
	i2c: st: fix missing struct parameter description
	null_blk: Fix the null_add_dev() error path
	null_blk: Handle null_add_dev() failures properly
	null_blk: fix spurious IO errors after failed past-wp access
	x86: Don't let pgprot_modify() change the page encryption bit
	block: keep bdi->io_pages in sync with max_sectors_kb for stacked devices
	irqchip/versatile-fpga: Handle chained IRQs properly
	sched: Avoid scale real weight down to zero
	selftests/x86/ptrace_syscall_32: Fix no-vDSO segfault
	PCI/switchtec: Fix init_completion race condition with poll_wait()
	libata: Remove extra scsi_host_put() in ata_scsi_add_hosts()
	gfs2: Don't demote a glock until its revokes are written
	x86/boot: Use unsigned comparison for addresses
	efi/x86: Ignore the memory attributes table on i386
	genirq/irqdomain: Check pointer in irq_domain_alloc_irqs_hierarchy()
	block: Fix use-after-free issue accessing struct io_cq
	usb: dwc3: core: add support for disabling SS instances in park mode
	irqchip/gic-v4: Provide irq_retrigger to avoid circular locking dependency
	locking/lockdep: Avoid recursion in lockdep_count_{for,back}ward_deps()
	block, bfq: fix use-after-free in bfq_idle_slice_timer_body
	btrfs: remove a BUG_ON() from merge_reloc_roots()
	btrfs: track reloc roots based on their commit root bytenr
	uapi: rename ext2_swab() to swab() and share globally in swab.h
	misc: rtsx: set correct pcr_ops for rts522A
	slub: improve bit diffusion for freelist ptr obfuscation
	ASoC: fix regwmask
	ASoC: dapm: connect virtual mux with default value
	ASoC: dpcm: allow start or stop during pause for backend
	ASoC: topology: use name_prefix for new kcontrol
	usb: gadget: f_fs: Fix use after free issue as part of queue failure
	usb: gadget: composite: Inform controller driver of self-powered
	ALSA: usb-audio: Add mixer workaround for TRX40 and co
	ALSA: hda: Add driver blacklist
	ALSA: hda: Fix potential access overflow in beep helper
	ALSA: ice1724: Fix invalid access for enumerated ctl items
	ALSA: pcm: oss: Fix regression by buffer overflow fix
	ALSA: doc: Document PC Beep Hidden Register on Realtek ALC256
	ALSA: hda/realtek - Set principled PC Beep configuration for ALC256
	media: ti-vpe: cal: fix disable_irqs to only the intended target
	acpi/x86: ignore unspecified bit positions in the ACPI global lock field
	thermal: devfreq_cooling: inline all stubs for CONFIG_DEVFREQ_THERMAL=n
	nvme-fc: Revert "add module to ops template to allow module references"
	PCI/ASPM: Clear the correct bits when enabling L1 substates
	PCI: endpoint: Fix for concurrent memory allocation in OB address region
	KEYS: reaching the keys quotas correctly
	irqchip/versatile-fpga: Apply clear-mask earlier
	MIPS: OCTEON: irq: Fix potential NULL pointer dereference
	ath9k: Handle txpower changes even when TPC is disabled
	signal: Extend exec_id to 64bits
	x86/entry/32: Add missing ASM_CLAC to general_protection entry
	KVM: nVMX: Properly handle userspace interrupt window request
	KVM: s390: vsie: Fix region 1 ASCE sanity shadow address checks
	KVM: s390: vsie: Fix delivery of addressing exceptions
	KVM: x86: Allocate new rmap and large page tracking when moving memslot
	KVM: VMX: Always VMCLEAR in-use VMCSes during crash with kexec support
	KVM: VMX: fix crash cleanup when KVM wasn't used
	CIFS: Fix bug which the return value by asynchronous read is error
	btrfs: drop block from cache on error in relocation
	crypto: mxs-dcp - fix scatterlist linearization for hash
	ALSA: hda: Initialize power_state field properly
	net: rtnl_configure_link: fix dev flags changes arg to __dev_notify_flags
	powerpc/pseries: Drop pointless static qualifier in vpa_debugfs_init()
	x86/speculation: Remove redundant arch_smt_update() invocation
	tools: gpio: Fix out-of-tree build regression
	mm: Use fixed constant in page_frag_alloc instead of size + 1
	dm verity fec: fix memory leak in verity_fec_dtr
	scsi: zfcp: fix missing erp_lock in port recovery trigger for point-to-point
	arm64: armv8_deprecated: Fix undef_hook mask for thumb setend
	rtc: omap: Use define directive for PIN_CONFIG_ACTIVE_HIGH
	NFS: Fix a page leak in nfs_destroy_unlinked_subrequests()
	ext4: fix a data race at inode->i_blocks
	fs/filesystems.c: downgrade user-reachable WARN_ONCE() to pr_warn_once()
	ocfs2: no need try to truncate file beyond i_size
	perf tools: Support Python 3.8+ in Makefile
	s390/diag: fix display of diagnose call statistics
	Input: i8042 - add Acer Aspire 5738z to nomux list
	kmod: make request_module() return an error when autoloading is disabled
	cpufreq: powernv: Fix use-after-free
	hfsplus: fix crash and filesystem corruption when deleting files
	libata: Return correct status in sata_pmp_eh_recover_pm() when ATA_DFLAG_DETACH is set
	powerpc/powernv/idle: Restore AMR/UAMOR/AMOR after idle
	powerpc/64/tm: Don't let userspace set regs->trap via sigreturn
	powerpc/hash64/devmap: Use H_PAGE_THP_HUGE when setting up huge devmap PTE entries
	powerpc/xive: Use XIVE_BAD_IRQ instead of zero to catch non configured IPIs
	powerpc/kprobes: Ignore traps that happened in real mode
	scsi: mpt3sas: Fix kernel panic observed on soft HBA unplug
	powerpc: Add attributes for setjmp/longjmp
	powerpc: Make setjmp/longjmp signature standard
	Btrfs: fix crash during unmount due to race with delayed inode workers
	btrfs: use nofs allocations for running delayed items
	dm zoned: remove duplicate nr_rnd_zones increase in dmz_init_zone()
	crypto: caam - update xts sector size for large input length
	drm/dp_mst: Fix clearing payload state on topology disable
	drm: Remove PageReserved manipulation from drm_pci_alloc
	ftrace/kprobe: Show the maxactive number on kprobe_events
	ipmi: fix hung processes in __get_guid()
	powerpc/fsl_booke: Avoid creating duplicate tlb1 entry
	misc: echo: Remove unnecessary parentheses and simplify check for zero
	mfd: dln2: Fix sanity checking for endpoints
	amd-xgbe: Use __napi_schedule() in BH context
	hsr: check protocol version in hsr_newlink()
	net: ipv4: devinet: Fix crash when add/del multicast IP with autojoin
	net: ipv6: do not consider routes via gateways for anycast address check
	net: qrtr: send msgs from local of same id as broadcast
	net: revert default NAPI poll timeout to 2 jiffies
	net: stmmac: dwmac-sunxi: Provide TX and RX fifo sizes
	scsi: ufs: Fix ufshcd_hold() caused scheduling while atomic
	jbd2: improve comments about freeing data buffers whose page mapping is NULL
	pwm: pca9685: Fix PWM/GPIO inter-operation
	ext4: fix incorrect group count in ext4_fill_super error message
	ext4: fix incorrect inodes per group in error message
	ASoC: Intel: mrfld: fix incorrect check on p->sink
	ASoC: Intel: mrfld: return error codes when an error occurs
	ALSA: usb-audio: Don't override ignore_ctl_error value from the map
	tracing: Fix the race between registering 'snapshot' event trigger and triggering 'snapshot' operation
	btrfs: check commit root generation in should_ignore_root
	mac80211_hwsim: Use kstrndup() in place of kasprintf()
	ext4: do not zeroout extents beyond i_disksize
	dm flakey: check for null arg_name in parse_features()
	kvm: x86: Host feature SSBD doesn't imply guest feature SPEC_CTRL_SSBD
	scsi: target: remove boilerplate code
	scsi: target: fix hang when multiple threads try to destroy the same iscsi session
	x86/microcode/AMD: Increase microcode PATCH_MAX_SIZE
	x86/intel_rdt: Enumerate L2 Code and Data Prioritization (CDP) feature
	x86/intel_rdt: Add two new resources for L2 Code and Data Prioritization (CDP)
	x86/intel_rdt: Enable L2 CDP in MSR IA32_L2_QOS_CFG
	x86/resctrl: Preserve CDP enable over CPU hotplug
	x86/resctrl: Fix invalid attempt at removing the default resource group
	mm/vmalloc.c: move 'area->pages' after if statement
	objtool: Fix switch table detection in .text.unlikely
	scsi: sg: add sg_remove_request in sg_common_write
	ext4: use non-movable memory for superblock readahead
	arm, bpf: Fix bugs with ALU64 {RSH, ARSH} BPF_K shift by 0
	netfilter: nf_tables: report EOPNOTSUPP on unsupported flags/object type
	irqchip/mbigen: Free msi_desc on device teardown
	ALSA: hda: Don't release card at firmware loading error
	lib/raid6: use vdupq_n_u8 to avoid endianness warnings
	video: fbdev: sis: Remove unnecessary parentheses and commented code
	drm: NULL pointer dereference [null-pointer-deref] (CWE 476) problem
	clk: Fix debugfs_create_*() usage
	Revert "gpio: set up initial state from .get_direction()"
	arm64: perf: remove unsupported events for Cortex-A73
	arm64: traps: Don't print stack or raw PC/LR values in backtraces
	arch_topology: Fix section miss match warning due to free_raw_capacity()
	wil6210: increase firmware ready timeout
	wil6210: fix temperature debugfs
	scsi: ufs: make sure all interrupts are processed
	scsi: ufs: ufs-qcom: remove broken hci version quirk
	wil6210: rate limit wil_rx_refill error
	rpmsg: glink: use put_device() if device_register fail
	rtc: pm8xxx: Fix issue in RTC write path
	rpmsg: glink: Fix missing mutex_init() in qcom_glink_alloc_channel()
	rpmsg: glink: smem: Ensure ordering during tx
	wil6210: fix PCIe bus mastering in case of interface down
	wil6210: add block size checks during FW load
	wil6210: fix length check in __wmi_send
	wil6210: abort properly in cfg suspend
	soc: qcom: smem: Use le32_to_cpu for comparison
	of: fix missing kobject init for !SYSFS && OF_DYNAMIC config
	rbd: avoid a deadlock on header_rwsem when flushing notifies
	rbd: call rbd_dev_unprobe() after unwatching and flushing notifies
	of: unittest: kmemleak in of_unittest_platform_populate()
	clk: at91: usb: continue if clk_hw_round_rate() return zero
	power: supply: bq27xxx_battery: Silence deferred-probe error
	clk: tegra: Fix Tegra PMC clock out parents
	soc: imx: gpc: fix power up sequencing
	rtc: 88pm860x: fix possible race condition
	NFSv4/pnfs: Return valid stateids in nfs_layout_find_inode_by_stateid()
	NFS: direct.c: Fix memory leak of dreq when nfs_get_lock_context fails
	s390/cpuinfo: fix wrong output when CPU0 is offline
	powerpc/maple: Fix declaration made after definition
	ext4: do not commit super on read-only bdev
	include/linux/swapops.h: correct guards for non_swap_entry()
	percpu_counter: fix a data race at vm_committed_as
	compiler.h: fix error in BUILD_BUG_ON() reporting
	KVM: s390: vsie: Fix possible race when shadowing region 3 tables
	x86: ACPI: fix CPU hotplug deadlock
	drm/amdkfd: kfree the wrong pointer
	NFS: Fix memory leaks in nfs_pageio_stop_mirroring()
	iommu/vt-d: Fix mm reference leak
	ext2: fix empty body warnings when -Wextra is used
	ext2: fix debug reference to ext2_xattr_cache
	libnvdimm: Out of bounds read in __nd_ioctl()
	iommu/amd: Fix the configuration of GCR3 table root pointer
	net: dsa: bcm_sf2: Fix overflow checks
	fbdev: potential information leak in do_fb_ioctl()
	tty: evh_bytechan: Fix out of bounds accesses
	locktorture: Print ratio of acquisitions, not failures
	mtd: lpddr: Fix a double free in probe()
	mtd: phram: fix a double free issue in error path
	KEYS: Use individual pages in big_key for crypto buffers
	KEYS: Don't write out to userspace while holding key semaphore
	Linux 4.14.177

Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@google.com>
Change-Id: I5eb89921eb63ee9e92a031fc6f3a10d9e2616358
parents f20eb0ba 050272a0
Loading
Loading
Loading
Loading
+1 −0
Original line number Diff line number Diff line
@@ -8,3 +8,4 @@ HD-Audio
   models
   controls
   dp-mst
   realtek-pc-beep
+129 −0
Original line number Diff line number Diff line
===============================
Realtek PC Beep Hidden Register
===============================

This file documents the "PC Beep Hidden Register", which is present in certain
Realtek HDA codecs and controls a muxer and pair of passthrough mixers that can
route audio between pins but aren't themselves exposed as HDA widgets. As far
as I can tell, these hidden routes are designed to allow flexible PC Beep output
for codecs that don't have mixer widgets in their output paths. Why it's easier
to hide a mixer behind an undocumented vendor register than to just expose it
as a widget, I have no idea.

Register Description
====================

The register is accessed via processing coefficient 0x36 on NID 20h. Bits not
identified below have no discernible effect on my machine, a Dell XPS 13 9350::

  MSB                           LSB
  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  | |h|S|L|         | B |R|       | Known bits
  +=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
  |0|0|1|1|  0x7  |0|0x0|1|  0x7  | Reset value
  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

1Ah input select (B): 2 bits
  When zero, expose the PC Beep line (from the internal beep generator, when
  enabled with the Set Beep Generation verb on NID 01h, or else from the
  external PCBEEP pin) on the 1Ah pin node. When nonzero, expose the headphone
  jack (or possibly Line In on some machines) input instead. If PC Beep is
  selected, the 1Ah boost control has no effect.

Amplify 1Ah loopback, left (L): 1 bit
  Amplify the left channel of 1Ah before mixing it into outputs as specified
  by h and S bits. Does not affect the level of 1Ah exposed to other widgets.

Amplify 1Ah loopback, right (R): 1 bit
  Amplify the right channel of 1Ah before mixing it into outputs as specified
  by h and S bits. Does not affect the level of 1Ah exposed to other widgets.

Loopback 1Ah to 21h [active low] (h): 1 bit
  When zero, mix 1Ah (possibly with amplification, depending on L and R bits)
  into 21h (headphone jack on my machine). Mixed signal respects the mute
  setting on 21h.

Loopback 1Ah to 14h (S): 1 bit
  When one, mix 1Ah (possibly with amplification, depending on L and R bits)
  into 14h (internal speaker on my machine). Mixed signal **ignores** the mute
  setting on 14h and is present whenever 14h is configured as an output.

Path diagrams
=============

1Ah input selection (DIV is the PC Beep divider set on NID 01h)::

  <Beep generator>   <PCBEEP pin>    <Headphone jack>
          |                |                |
          +--DIV--+--!DIV--+       {1Ah boost control}
                  |                         |
                  +--(b == 0)--+--(b != 0)--+
                               |
               >1Ah (Beep/Headphone Mic/Line In)<

Loopback of 1Ah to 21h/14h::

               <1Ah (Beep/Headphone Mic/Line In)>
                               |
                        {amplify if L/R}
                               |
                  +-----!h-----+-----S-----+
                  |                        |
          {21h mute control}               |
                  |                        |
          >21h (Headphone)<     >14h (Internal Speaker)<

Background
==========

All Realtek HDA codecs have a vendor-defined widget with node ID 20h which
provides access to a bank of registers that control various codec functions.
Registers are read and written via the standard HDA processing coefficient
verbs (Set/Get Coefficient Index, Set/Get Processing Coefficient). The node is
named "Realtek Vendor Registers" in public datasheets' verb listings and,
apart from that, is entirely undocumented.

This particular register, exposed at coefficient 0x36 and named in commits from
Realtek, is of note: unlike most registers, which seem to control detailed
amplifier parameters not in scope of the HDA specification, it controls audio
routing which could just as easily have been defined using standard HDA mixer
and selector widgets.

Specifically, it selects between two sources for the input pin widget with Node
ID (NID) 1Ah: the widget's signal can come either from an audio jack (on my
laptop, a Dell XPS 13 9350, it's the headphone jack, but comments in Realtek
commits indicate that it might be a Line In on some machines) or from the PC
Beep line (which is itself multiplexed between the codec's internal beep
generator and external PCBEEP pin, depending on if the beep generator is
enabled via verbs on NID 01h). Additionally, it can mix (with optional
amplification) that signal onto the 21h and/or 14h output pins.

The register's reset value is 0x3717, corresponding to PC Beep on 1Ah that is
then amplified and mixed into both the headphones and the speakers. Not only
does this violate the HDA specification, which says that "[a vendor defined
beep input pin] connection may be maintained *only* while the Link reset
(**RST#**) is asserted", it means that we cannot ignore the register if we care
about the input that 1Ah would otherwise expose or if the PCBEEP trace is
poorly shielded and picks up chassis noise (both of which are the case on my
machine).

Unfortunately, there are lots of ways to get this register configuration wrong.
Linux, it seems, has gone through most of them. For one, the register resets
after S3 suspend: judging by existing code, this isn't the case for all vendor
registers, and it's led to some fixes that improve behavior on cold boot but
don't last after suspend. Other fixes have successfully switched the 1Ah input
away from PC Beep but have failed to disable both loopback paths. On my
machine, this means that the headphone input is amplified and looped back to
the headphone output, which uses the exact same pins! As you might expect, this
causes terrible headphone noise, the character of which is controlled by the
1Ah boost control. (If you've seen instructions online to fix XPS 13 headphone
noise by changing "Headphone Mic Boost" in ALSA, now you know why.)

The information here has been obtained through black-box reverse engineering of
the ALC256 codec's behavior and is not guaranteed to be correct. It likely
also applies for the ALC255, ALC257, ALC235, and ALC236, since those codecs
seem to be close relatives of the ALC256. (They all share one initialization
function.) Additionally, other codecs like the ALC225 and ALC285 also have this
register, judging by existing fixups in ``patch_realtek.c``, but specific
data (e.g. node IDs, bit positions, pin mappings) for those codecs may differ
from what I've described here.
+1 −1
Original line number Diff line number Diff line
# SPDX-License-Identifier: GPL-2.0
VERSION = 4
PATCHLEVEL = 14
SUBLEVEL = 176
SUBLEVEL = 177
EXTRAVERSION =
NAME = Petit Gorille

+10 −2
Original line number Diff line number Diff line
@@ -796,7 +796,11 @@ static inline void emit_a32_rsh_i64(const u8 dst[], bool dstk,
	}

	/* Do LSR operation */
	if (val < 32) {
	if (val == 0) {
		/* An immediate value of 0 encodes a shift amount of 32
		 * for LSR. To shift by 0, don't do anything.
		 */
	} else if (val < 32) {
		emit(ARM_MOV_SI(tmp2[1], rd, SRTYPE_LSR, val), ctx);
		emit(ARM_ORR_SI(rd, tmp2[1], rm, SRTYPE_ASL, 32 - val), ctx);
		emit(ARM_MOV_SI(rm, rm, SRTYPE_LSR, val), ctx);
@@ -829,7 +833,11 @@ static inline void emit_a32_arsh_i64(const u8 dst[], bool dstk,
	}

	/* Do ARSH operation */
	if (val < 32) {
	if (val == 0) {
		/* An immediate value of 0 encodes a shift amount of 32
		 * for ASR. To shift by 0, don't do anything.
		 */
	} else if (val < 32) {
		emit(ARM_MOV_SI(tmp2[1], rd, SRTYPE_LSR, val), ctx);
		emit(ARM_ORR_SI(rd, tmp2[1], rm, SRTYPE_ASL, 32 - val), ctx);
		emit(ARM_MOV_SI(rm, rm, SRTYPE_ASR, val), ctx);
+1 −1
Original line number Diff line number Diff line
@@ -607,7 +607,7 @@ static struct undef_hook setend_hooks[] = {
	},
	{
		/* Thumb mode */
		.instr_mask	= 0x0000fff7,
		.instr_mask	= 0xfffffff7,
		.instr_val	= 0x0000b650,
		.pstate_mask	= (COMPAT_PSR_T_BIT | COMPAT_PSR_MODE_MASK),
		.pstate_val	= (COMPAT_PSR_T_BIT | COMPAT_PSR_MODE_USR),
Loading