merge origin

6 files changed, 160 insertions, 138 deletions

diff --git a/ALSA-hda-realtek-Fix-speaker-output-regression-on-Thinkpad.patch b/ALSA-hda-realtek-Fix-speaker-output-regression-on-Thinkpad.patch
deleted file mode 100644
index 6bf0997a1..000000000
--- a/ALSA-hda-realtek-Fix-speaker-output-regression-on-Thinkpad.patch
+++ /dev/null
@@ -1,59 +0,0 @@
-From 54947cd64c1b8290f64bb2958e343c07270e3a58 Mon Sep 17 00:00:00 2001
-From: Takashi Iwai <tiwai@suse.de>
-Date: Mon, 3 Dec 2018 10:44:15 +0100
-Subject: [PATCH] ALSA: hda/realtek - Fix speaker output regression on Thinkpad
- T570
-
-We've got a regression report for some Thinkpad models (at least
-T570s) which shows the too low speaker output volume.  The bisection
-leaded to the commit 61fcf8ece9b6 ("ALSA: hda/realtek - Enable Thinkpad
-Dock device for ALC298 platform"), and it's basically adding the two
-pin configurations for the dock, and looks harmless.
-
-The real culprit seems, though, that the DAC assignment for the
-speaker pin is implicitly assumed on these devices, i.e. pin NID 0x14
-to be coupled with DAC NID 0x03.  When more pins are configured by the
-commit above, the auto-parser changes the DAC assignment, and this
-resulted in the regression.
-
-As a workaround, just provide the fixed pin / DAC mapping table for
-this Thinkpad fixup function.  It's no generic solution, but the
-problem itself is pretty much device-specific, so must be good
-enough.
-
-Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1554304
-Fixes: 61fcf8ece9b6 ("ALSA: hda/realtek - Enable Thinkpad Dock device for ALC298 platform")
-Cc: <stable@vger.kernel.org>
-Reported-and-tested-by: Jeremy Cline <jcline@redhat.com>
-Signed-off-by: Takashi Iwai <tiwai@suse.de>
-Signed-off-by: Jeremy Cline <jcline@redhat.com>
----
- sound/pci/hda/patch_realtek.c | 9 +++++++++
- 1 file changed, 9 insertions(+)
-
-diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
-index 06f93032d0cc..802f1f1b3a19 100644
---- a/sound/pci/hda/patch_realtek.c
-+++ b/sound/pci/hda/patch_realtek.c
-@@ -4988,9 +4988,18 @@ static void alc_fixup_tpt470_dock(struct hda_codec *codec,
- 		{ 0x19, 0x21a11010 }, /* dock mic */
- 		{ }
- 	};
-+	/* Assure the speaker pin to be coupled with DAC NID 0x03; otherwise
-+	 * the speaker output becomes too low by some reason on Thinkpads with
-+	 * ALC298 codec
-+	 */
-+	static hda_nid_t preferred_pairs[] = {
-+		0x14, 0x03, 0x17, 0x02, 0x21, 0x02,
-+		0
-+	};
- 	struct alc_spec *spec = codec->spec;
- 
- 	if (action == HDA_FIXUP_ACT_PRE_PROBE) {
-+		spec->gen.preferred_dacs = preferred_pairs;
- 		spec->parse_flags = HDA_PINCFG_NO_HP_FIXUP;
- 		snd_hda_apply_pincfgs(codec, pincfgs);
- 	} else if (action == HDA_FIXUP_ACT_INIT) {
--- 
-2.19.2
-
diff --git a/alsa-usb-audio-fix-UAF-decrement-if-card-has-no-live.patch b/alsa-usb-audio-fix-UAF-decrement-if-card-has-no-live.patch
deleted file mode 100644
index 6dc9fa5d0..000000000
--- a/alsa-usb-audio-fix-UAF-decrement-if-card-has-no-live.patch
+++ /dev/null
@@ -1,49 +0,0 @@
-From 5f8cf712582617d523120df67d392059eaf2fc4b Mon Sep 17 00:00:00 2001
-From: Hui Peng <benquike@gmail.com>
-Date: Mon, 3 Dec 2018 16:09:34 +0100
-Subject: ALSA: usb-audio: Fix UAF decrement if card has no live interfaces in
- card.c
-
-If a USB sound card reports 0 interfaces, an error condition is triggered
-and the function usb_audio_probe errors out. In the error path, there was a
-use-after-free vulnerability where the memory object of the card was first
-freed, followed by a decrement of the number of active chips. Moving the
-decrement above the atomic_dec fixes the UAF.
-
-[ The original problem was introduced in 3.1 kernel, while it was
-  developed in a different form.  The Fixes tag below indicates the
-  original commit but it doesn't mean that the patch is applicable
-  cleanly. -- tiwai ]
-
-Fixes: 362e4e49abe5 ("ALSA: usb-audio - clear chip->probing on error exit")
-Reported-by: Hui Peng <benquike@gmail.com>
-Reported-by: Mathias Payer <mathias.payer@nebelwelt.net>
-Signed-off-by: Hui Peng <benquike@gmail.com>
-Signed-off-by: Mathias Payer <mathias.payer@nebelwelt.net>
-Cc: <stable@vger.kernel.org>
-Signed-off-by: Takashi Iwai <tiwai@suse.de>
----
- sound/usb/card.c | 5 ++++-
- 1 file changed, 4 insertions(+), 1 deletion(-)
-
-diff --git a/sound/usb/card.c b/sound/usb/card.c
-index 2bfe4e80a6b9..a105947eaf55 100644
---- a/sound/usb/card.c
-+++ b/sound/usb/card.c
-@@ -682,9 +682,12 @@ static int usb_audio_probe(struct usb_interface *intf,
- 
-  __error:
- 	if (chip) {
-+		/* chip->active is inside the chip->card object,
-+		 * decrement before memory is possibly returned.
-+		 */
-+		atomic_dec(&chip->active);
- 		if (!chip->num_interfaces)
- 			snd_card_free(chip->card);
--		atomic_dec(&chip->active);
- 	}
- 	mutex_unlock(&register_mutex);
- 	return err;
--- 
-cgit 1.2-0.3.lf.el7
-
diff --git a/asus-fx503-keyb.patch b/asus-fx503-keyb.patch
index ae1b4076f..c0a8fab4f 100644
--- a/asus-fx503-keyb.patch
+++ b/asus-fx503-keyb.patch
@@ -1,4 +1,4 @@
-From 330c27ee59fb76db02c671ac4cb32914565aa609 Mon Sep 17 00:00:00 2001
+From c1dfbd7a588e43be466d12c3636f5670aef04847 Mon Sep 17 00:00:00 2001
 From: Hans de Goede <hdegoede@redhat.com>
 Date: Fri, 23 Nov 2018 13:31:00 +0100
 Subject: [PATCH 1/2] HID: asus: Add event handler to catch unmapped Asus
@@ -16,21 +16,22 @@ and add them to the asus_input_mapping() function.
 
 Signed-off-by: Hans de Goede <hdegoede@redhat.com>
 ---
- drivers/hid/hid-asus.c | 12 ++++++++++++
- 1 file changed, 12 insertions(+)
+ drivers/hid/hid-asus.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
 
 diff --git a/drivers/hid/hid-asus.c b/drivers/hid/hid-asus.c
-index a1fa2fc8c9b5..043120cc4b97 100644
+index a1fa2fc8c9b5..61fb5a43c1cb 100644
 --- a/drivers/hid/hid-asus.c
 +++ b/drivers/hid/hid-asus.c
-@@ -241,6 +241,17 @@ static int asus_report_input(struct asus_drvdata *drvdat, u8 *data, int size)
+@@ -241,6 +241,18 @@ static int asus_report_input(struct asus_drvdata *drvdat, u8 *data, int size)
  	return 1;
  }
  
 +static int asus_event(struct hid_device *hdev, struct hid_field *field,
 +		      struct hid_usage *usage, __s32 value)
 +{
-+	if ((usage->hid & HID_USAGE_PAGE) == 0xff310000 && !usage->type) {
++	if ((usage->hid & HID_USAGE_PAGE) == 0xff310000 &&
++	    (usage->hid & HID_USAGE) != 0x00 && !usage->type) {
 +		hid_warn(hdev, "Unmapped Asus vendor usagepage code 0x%02x\n",
 +			 usage->hid & HID_USAGE);
 +	}
@@ -41,7 +42,7 @@ index a1fa2fc8c9b5..043120cc4b97 100644
  static int asus_raw_event(struct hid_device *hdev,
  		struct hid_report *report, u8 *data, int size)
  {
-@@ -832,6 +843,7 @@ static struct hid_driver asus_driver = {
+@@ -832,6 +844,7 @@ static struct hid_driver asus_driver = {
  #ifdef CONFIG_PM
  	.reset_resume           = asus_reset_resume,
  #endif
@@ -50,40 +51,64 @@ index a1fa2fc8c9b5..043120cc4b97 100644
  };
  module_hid_driver(asus_driver);
 -- 
-2.19.1
+2.19.2
 
-From 71256aaf9979072c9bd99fb08db586731e3ccf55 Mon Sep 17 00:00:00 2001
+From 53cb4c986eaedd2cfa161932b36d80c70d947e9e Mon Sep 17 00:00:00 2001
 From: Hans de Goede <hdegoede@redhat.com>
 Date: Fri, 23 Nov 2018 13:44:27 +0100
-Subject: [PATCH 2/2] HID: asus: Add USB-id for the ASUS FX503VD laptop
+Subject: [PATCH 2/2] HID: asus: Add support for the ASUS FX503VD laptop
 
 The ASUS FX503VD laptop uses an USB keyboard with several hotkeys
 which use the Asus Vendor specific UsagePage.
 
-At the USB-id for this keyboard to the hid-asus driver so that these
-custom usages get properly mapped.
+This uses two usage-codes within the page which have not been seen
+before, 0x7c for its mic-mute hotkey and 0x99 for Fn+F5 which has
+a "fan" symbol as hotkey symbol on the keyb. we map this to KEY_PROG4
+(PROG1-PROG3 are already used).
+
+This commit adds the mappings for the 2 new usage codes and the USB-ids
+for this keyboard to the hid-asus driver.
 
 Signed-off-by: Hans de Goede <hdegoede@redhat.com>
 ---
- drivers/hid/hid-asus.c | 2 ++
+ drivers/hid/hid-asus.c | 7 +++++++
  drivers/hid/hid-ids.h  | 1 +
- 2 files changed, 3 insertions(+)
+ 2 files changed, 8 insertions(+)
 
 diff --git a/drivers/hid/hid-asus.c b/drivers/hid/hid-asus.c
-index 043120cc4b97..6e9470e00c69 100644
+index 61fb5a43c1cb..ab8bd40a77ed 100644
 --- a/drivers/hid/hid-asus.c
 +++ b/drivers/hid/hid-asus.c
-@@ -806,6 +806,8 @@ static __u8 *asus_report_fixup(struct hid_device *hdev, __u8 *rdesc,
- }
+@@ -522,6 +522,7 @@ static int asus_input_mapping(struct hid_device *hdev,
+ 		case 0x20: asus_map_key_clear(KEY_BRIGHTNESSUP);		break;
+ 		case 0x35: asus_map_key_clear(KEY_DISPLAY_OFF);		break;
+ 		case 0x6c: asus_map_key_clear(KEY_SLEEP);		break;
++		case 0x7c: asus_map_key_clear(KEY_MICMUTE);		break;
+ 		case 0x82: asus_map_key_clear(KEY_CAMERA);		break;
+ 		case 0x88: asus_map_key_clear(KEY_RFKILL);			break;
+ 		case 0xb5: asus_map_key_clear(KEY_CALC);			break;
+@@ -540,6 +541,9 @@ static int asus_input_mapping(struct hid_device *hdev,
+ 		/* Fn+Space Power4Gear Hybrid */
+ 		case 0x5c: asus_map_key_clear(KEY_PROG3);		break;
  
- static const struct hid_device_id asus_devices[] = {
++		/* Fn+F5 "fan" symbol on FX503VD */
++		case 0x99: asus_map_key_clear(KEY_PROG4);		break;
++
+ 		default:
+ 			/* ASUS lazily declares 256 usages, ignore the rest,
+ 			 * as some make the keyboard appear as a pointer device. */
+@@ -817,6 +821,9 @@ static const struct hid_device_id asus_devices[] = {
+ 		USB_DEVICE_ID_ASUSTEK_ROG_KEYBOARD2), QUIRK_USE_KBD_BACKLIGHT },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_ASUSTEK,
+ 		USB_DEVICE_ID_ASUSTEK_ROG_KEYBOARD3), QUIRK_G752_KEYBOARD },
 +	{ HID_USB_DEVICE(USB_VENDOR_ID_ASUSTEK,
-+		USB_DEVICE_ID_ASUSTEK_FX503VD_KEYBOARD) },
- 	{ HID_I2C_DEVICE(USB_VENDOR_ID_ASUSTEK,
- 		USB_DEVICE_ID_ASUSTEK_I2C_KEYBOARD), I2C_KEYBOARD_QUIRKS},
- 	{ HID_I2C_DEVICE(USB_VENDOR_ID_ASUSTEK,
++		USB_DEVICE_ID_ASUSTEK_FX503VD_KEYBOARD),
++	  QUIRK_USE_KBD_BACKLIGHT },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_ASUSTEK,
+ 		USB_DEVICE_ID_ASUSTEK_T100TA_KEYBOARD),
+ 	  QUIRK_T100_KEYBOARD | QUIRK_NO_CONSUMER_USAGES },
 diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
-index c0d668944dbe..5ae1db6fa5c8 100644
+index ed35c9a9a110..4206428c0ba2 100644
 --- a/drivers/hid/hid-ids.h
 +++ b/drivers/hid/hid-ids.h
 @@ -190,6 +190,7 @@
@@ -95,5 +120,5 @@ index c0d668944dbe..5ae1db6fa5c8 100644
  #define USB_VENDOR_ID_ATEN		0x0557
  #define USB_DEVICE_ID_ATEN_UC100KM	0x2004
 -- 
-2.19.1
+2.19.2
 
diff --git a/bcm2837-fix-eth-leds.patch b/bcm2837-fix-eth-leds.patch
new file mode 100644
index 000000000..02679141a
--- /dev/null
+++ b/bcm2837-fix-eth-leds.patch
@@ -0,0 +1,45 @@
+From 6ef5bd6cfd5da9fe67aea031fd0a66ff77d64ad6 Mon Sep 17 00:00:00 2001
+From: Stefan Wahren <stefan.wahren@i2se.com>
+Date: Sat, 1 Sep 2018 20:16:22 +0200
+Subject: ARM: dts: bcm283x-rpi-lan7515: Enable Ethernet LEDs
+
+Since the LAN7515 on Raspberry Pi 3B+ doesn't have an EEPROM and the OTP
+is empty, we need to enable the Ethernet LEDs via Device Tree.
+
+Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
+---
+ arch/arm/boot/dts/bcm283x-rpi-lan7515.dtsi | 14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+diff --git a/arch/arm/boot/dts/bcm283x-rpi-lan7515.dtsi b/arch/arm/boot/dts/bcm283x-rpi-lan7515.dtsi
+index 9403da0990d0..70bece63f9a7 100644
+--- a/arch/arm/boot/dts/bcm283x-rpi-lan7515.dtsi
++++ b/arch/arm/boot/dts/bcm283x-rpi-lan7515.dtsi
+@@ -1,4 +1,6 @@
+ // SPDX-License-Identifier: GPL-2.0
++#include <dt-bindings/net/microchip-lan78xx.h>
++
+ / {
+ 	aliases {
+ 		ethernet0 = &ethernet;
+@@ -21,6 +23,18 @@
+ 			ethernet: ethernet@1 {
+ 				compatible = "usb424,7800";
+ 				reg = <1>;
++
++				mdio {
++					#address-cells = <0x1>;
++					#size-cells = <0x0>;
++					eth_phy: ethernet-phy@1 {
++						reg = <1>;
++						microchip,led-modes = <
++							LAN78XX_LINK_1000_ACTIVITY
++							LAN78XX_LINK_10_100_ACTIVITY
++						>;
++					};
++				};
+ 			};
+ 		};
+ 	};
+-- 
+cgit 1.2-0.3.lf.el7
diff --git a/bcm2837-fix-wifi-gpio-polarity.patch b/bcm2837-fix-wifi-gpio-polarity.patch
new file mode 100644
index 000000000..96055f78a
--- /dev/null
+++ b/bcm2837-fix-wifi-gpio-polarity.patch
@@ -0,0 +1,51 @@
+From e25b6783c7b1bb79103d4617336879423f86b05e Mon Sep 17 00:00:00 2001
+From: Stefan Wahren <stefan.wahren@i2se.com>
+Date: Mon, 3 Dec 2018 19:37:08 +0100
+Subject: ARM: dts: bcm2837: Fix polarity of wifi reset GPIOs
+
+The commit b1b8f45b3130 ("ARM: dts: bcm2837: Add missing GPIOs of Expander")
+introduced a wifi power sequence. Unfortunately the polarity of the reset
+GPIOs were wrong and broke the wifi support on Raspberry Pi 3 B and
+later in 3 B+. This wasn't discovered before since the power sequence
+takes only effect in case the relevant MMC driver is compiled as a module.
+
+Fixes: b1b8f45b3130 ("ARM: dts: bcm2837: Add missing GPIOs of Expander")
+Cc: stable@vger.kernel.org
+Reported-by: Matthias Lueschner <lueschem@gmail.com>
+Link: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=911443
+Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
+Reviewed-by: Eric Anholt <eric@anholt.net>
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+---
+ arch/arm/boot/dts/bcm2837-rpi-3-b-plus.dts | 2 +-
+ arch/arm/boot/dts/bcm2837-rpi-3-b.dts      | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/bcm2837-rpi-3-b-plus.dts b/arch/arm/boot/dts/bcm2837-rpi-3-b-plus.dts
+index 4adb85e66be3..93762244be7f 100644
+--- a/arch/arm/boot/dts/bcm2837-rpi-3-b-plus.dts
++++ b/arch/arm/boot/dts/bcm2837-rpi-3-b-plus.dts
+@@ -31,7 +31,7 @@
+ 
+ 	wifi_pwrseq: wifi-pwrseq {
+ 		compatible = "mmc-pwrseq-simple";
+-		reset-gpios = <&expgpio 1 GPIO_ACTIVE_HIGH>;
++		reset-gpios = <&expgpio 1 GPIO_ACTIVE_LOW>;
+ 	};
+ };
+ 
+diff --git a/arch/arm/boot/dts/bcm2837-rpi-3-b.dts b/arch/arm/boot/dts/bcm2837-rpi-3-b.dts
+index c318bcbc6ba7..89e6fd547c75 100644
+--- a/arch/arm/boot/dts/bcm2837-rpi-3-b.dts
++++ b/arch/arm/boot/dts/bcm2837-rpi-3-b.dts
+@@ -26,7 +26,7 @@
+ 
+ 	wifi_pwrseq: wifi-pwrseq {
+ 		compatible = "mmc-pwrseq-simple";
+-		reset-gpios = <&expgpio 1 GPIO_ACTIVE_HIGH>;
++		reset-gpios = <&expgpio 1 GPIO_ACTIVE_LOW>;
+ 	};
+ };
+ 
+-- 
+cgit 1.2-0.3.lf.el7
diff --git a/kernel.spec b/kernel.spec
index 8d8a2c3c9..9bd616ced 100644
--- a/kernel.spec
+++ b/kernel.spec
@@ -616,6 +616,12 @@ Patch332: raspberrypi-Fix-firmware-calls-with-large-buffers.patch
 # https://patchwork.kernel.org/patch/10677591/
 Patch333: hwmon-rpi-Fix-initial-notify.patch
 
+# From 4.20, fix RPi3B+ eth leds
+Patch334: bcm2837-fix-eth-leds.patch
+
+# From 4.20, fix wifi gpio polarity
+Patch335: bcm2837-fix-wifi-gpio-polarity.patch
+
 # Patches enabling device specific brcm firmware nvram
 # https://www.spinics.net/lists/linux-wireless/msg178827.html
 Patch340: brcmfmac-Remove-firmware-loading-code-duplication.patch
@@ -644,12 +650,6 @@ Patch510: iio-accel-kxcjk1013-Add-more-hardware-ids.patch
 # rhbz 1645070 patch queued upstream for merging into 4.21
 Patch516: asus-fx503-keyb.patch
 
-# rbhz 1554304 patch in the sound tree and Cc'd for stable
-Patch517: ALSA-hda-realtek-Fix-speaker-output-regression-on-Thinkpad.patch
-
-# CVE-2018-19824 rhbz 1655816 1655817
-Patch518: alsa-usb-audio-fix-UAF-decrement-if-card-has-no-live.patch
-
 # END OF PATCH DEFINITIONS
 
 %endif
@@ -1904,6 +1904,15 @@ fi
 #
 #
 %changelog
+* Fri Dec 14 2018 Peter Robinson <pbrobinson@fedoraproject.org> 4.19.9-201
+- Fix Raspberry Pi issues affecting WiFi (rhbz 1652093)
+
+* Thu Dec 13 2018 Jeremy Cline <jcline@redhat.com> - 4.19.9-200
+- Linux v4.19.9
+
+* Tue Dec 11 2018 Hans de Goede <hdegoede@redhat.com>
+- Really fix non functional hotkeys on Asus FX503VD (#1645070)
+
 * Mon Dec 10 2018 Jeremy Cline <jcline@redhat.com> - 4.19.8-200
 - Linux v4.19.8