February 2016 - Alsa-devel - mailman.alsa-project.org

[alsa-devel] [PATCH] ASoC: fsl_ssi: remove explicit register defaults
by Maciej S. Szmigiero 01 Feb '16

01 Feb '16

There is no guarantee that on fsl_ssi module load SSI registers will have their power-on-reset values. In fact, if the driver is reloaded the values in registers will be whatever they were set to previously. However, the cache needs to be fully populated at probe time to avoid non-atomic allocations during register access. Special case here is imx21-class SSI, since according to datasheet it don't have SACC{ST,EN,DIS} regs. This fixes hard lockup on fsl_ssi module reload, at least in AC'97 mode. Fixes: 05cf237972fe ("ASoC: fsl_ssi: Add driver suspend and resume to support MEGA Fast") Signed-off-by: Maciej S. Szmigiero <mail(a)maciej.szmigiero.name> --- sound/soc/fsl/fsl_ssi.c | 42 ++++++++++++++++++++++-------------------- 1 file changed, 22 insertions(+), 20 deletions(-) This replaces "ASoC: fsl_ssi: remove register defaults" submission. It may be good to delay merging this until commit d51fe1f393a6 ("regmap: pass buffer size to regmap_raw_read() in regcache_hw_init()") reaches ASoC tree since without that regmap fix fsl_ssi will report error at probe time. diff --git a/sound/soc/fsl/fsl_ssi.c b/sound/soc/fsl/fsl_ssi.c index 40dfd8a36484..ed8de1035cda 100644 --- a/sound/soc/fsl/fsl_ssi.c +++ b/sound/soc/fsl/fsl_ssi.c @@ -112,20 +112,6 @@ struct fsl_ssi_rxtx_reg_val { struct fsl_ssi_reg_val tx; }; -static const struct reg_default fsl_ssi_reg_defaults[] = { - {CCSR_SSI_SCR, 0x00000000}, - {CCSR_SSI_SIER, 0x00003003}, - {CCSR_SSI_STCR, 0x00000200}, - {CCSR_SSI_SRCR, 0x00000200}, - {CCSR_SSI_STCCR, 0x00040000}, - {CCSR_SSI_SRCCR, 0x00040000}, - {CCSR_SSI_SACNT, 0x00000000}, - {CCSR_SSI_STMSK, 0x00000000}, - {CCSR_SSI_SRMSK, 0x00000000}, - {CCSR_SSI_SACCEN, 0x00000000}, - {CCSR_SSI_SACCDIS, 0x00000000}, -}; - static bool fsl_ssi_readable_reg(struct device *dev, unsigned int reg) { switch (reg) { @@ -190,8 +176,7 @@ static const struct regmap_config fsl_ssi_regconfig = { .val_bits = 32, .reg_stride = 4, .val_format_endian = REGMAP_ENDIAN_NATIVE, - .reg_defaults = fsl_ssi_reg_defaults, - .num_reg_defaults = ARRAY_SIZE(fsl_ssi_reg_defaults), + .num_reg_defaults_raw = CCSR_SSI_SACCDIS / sizeof(uint32_t) + 1, .readable_reg = fsl_ssi_readable_reg, .volatile_reg = fsl_ssi_volatile_reg, .precious_reg = fsl_ssi_precious_reg, @@ -201,6 +186,7 @@ static const struct regmap_config fsl_ssi_regconfig = { struct fsl_ssi_soc_data { bool imx; + bool imx21regs; /* imx21-class SSI - no SACC{ST,EN,DIS} regs */ bool offline_config; u32 sisr_write_mask; }; @@ -303,6 +289,7 @@ static struct fsl_ssi_soc_data fsl_ssi_mpc8610 = { static struct fsl_ssi_soc_data fsl_ssi_imx21 = { .imx = true, + .imx21regs = true, .offline_config = true, .sisr_write_mask = 0, }; @@ -586,8 +573,12 @@ static void fsl_ssi_setup_ac97(struct fsl_ssi_private *ssi_private) */ regmap_write(regs, CCSR_SSI_SACNT, CCSR_SSI_SACNT_AC97EN | CCSR_SSI_SACNT_FV); - regmap_write(regs, CCSR_SSI_SACCDIS, 0xff); - regmap_write(regs, CCSR_SSI_SACCEN, 0x300); + + /* no SACC{ST,EN,DIS} regs on imx21-class SSI */ + if (!ssi_private->soc->imx21regs) { + regmap_write(regs, CCSR_SSI_SACCDIS, 0xff); + regmap_write(regs, CCSR_SSI_SACCEN, 0x300); + } /* * Enable SSI, Transmit and Receive. AC97 has to communicate with the @@ -1397,6 +1388,7 @@ static int fsl_ssi_probe(struct platform_device *pdev) struct resource *res; void __iomem *iomem; char name[64]; + struct regmap_config regconfig = fsl_ssi_regconfig; of_id = of_match_device(fsl_ssi_ids, &pdev->dev); if (!of_id || !of_id->data) @@ -1444,15 +1436,25 @@ static int fsl_ssi_probe(struct platform_device *pdev) return PTR_ERR(iomem); ssi_private->ssi_phys = res->start; + if (ssi_private->soc->imx21regs) { + /* + * According to datasheet imx21-class SSI + * don't have SACC{ST,EN,DIS} regs. + */ + regconfig.max_register = CCSR_SSI_SRMSK; + regconfig.num_reg_defaults_raw = + CCSR_SSI_SRMSK / sizeof(uint32_t) + 1; + } + ret = of_property_match_string(np, "clock-names", "ipg"); if (ret < 0) { ssi_private->has_ipg_clk_name = false; ssi_private->regs = devm_regmap_init_mmio(&pdev->dev, iomem, - &fsl_ssi_regconfig); + &regconfig); } else { ssi_private->has_ipg_clk_name = true; ssi_private->regs = devm_regmap_init_mmio_clk(&pdev->dev, - "ipg", iomem, &fsl_ssi_regconfig); + "ipg", iomem, &regconfig); } if (IS_ERR(ssi_private->regs)) { dev_err(&pdev->dev, "Failed to init register map\n");

3 10

[alsa-devel] [PATCH REBASE 4.5 00/31] Sharing media resources across ALSA and au0828 drivers
by Shuah Khan 01 Feb '16

01 Feb '16

Please note that I am sending just the 4 patches that changed during series rebase to Linux 4.5. The rebase was pain free. media_device_init() type change required changes to patches 18 and 26. I re-tested the series and everything looks good. [PATCH 16/31] media: au0828 video remove au0828_enable_analog_tuner() [PATCH 18/31] media: au0828 change to use Managed Media Controller API [PATCH 22/31] media: dvb-core create tuner to demod pad link in disabled state [PATCH v3 26/31] sound/usb: Update ALSA driver to use Managed Media Controller API Links: PATCH Series that contains all 31 patches: https://lkml.org/lkml/2016/1/6/668 ALSA patches went through reviews and links to PATCH V3 (ALSA): https://lkml.org/lkml/2016/1/18/556 https://lkml.org/lkml/2016/1/18/557 https://lkml.org/lkml/2016/1/18/558 Compile warns patches: https://lkml.org/lkml/2016/1/19/520 https://lkml.org/lkml/2016/1/19/518 https://lkml.org/lkml/2016/1/19/519 Mauro and Takashi: Please let me know if you would rather see the entire patch series generated for 4.5-rc1 and sent out in a complete series instead of just the rebased patches. Mauro Carvalho Chehab (1): uapi/media.h: Declare interface types for ALSA Shuah Khan (30): media: Add ALSA Media Controller function entities media: Media Controller register/unregister entity_notify API media: Media Controller enable/disable source handler API media: Media Controller fix to not let stream_count go negative media: Media Controller export non locking __media_entity_setup_link() media: Media Controller non-locking __media_entity_pipeline_start/stop() media: v4l-core add v4l_enable/disable_media_tuner() helper functions media: v4l2-core add v4l_vb2q_enable_media_tuner() helper media: Move au8522_media_pads enum to au8522.h from au8522_priv.h media: au8522 change to create MC pad for ALSA Audio Out media: au0828 Use au8522_media_pads enum for pad defines media: au0828 fix au0828_create_media_graph() entity checks media: Change v4l-core to check for tuner availability media: dvb-frontend invoke enable/disable_source handlers media: au0828 video remove au0828_enable_analog_tuner() media: au0828 video change to use v4l_enable_media_tuner() media: au0828 change to use Managed Media Controller API media: au0828 handle media_init and media_register window media: au0828 change to register/unregister entity_notify hook media: au0828 create tuner to decoder link in deactivated state media: dvb-core create tuner to demod pad link in disabled state media: au0828 implement enable_source and disable_source handlers media: au0828 fix null pointer reference in au0828_create_media_graph() media: au0828 fix to not call media_device_unregister_entity_notify() sound/usb: Update ALSA driver to use Managed Media Controller API sound/usb: Create media mixer function and control interface entities media: au0828 create link between ALSA Mixer and decoder media: track media device unregister in progress sound/usb: Check media device unregister progress state media: au0828 change to check media device unregister progress state drivers/media/dvb-core/dvb_frontend.c | 139 ++--------- drivers/media/dvb-core/dvb_frontend.h | 3 + drivers/media/dvb-core/dvbdev.c | 4 +- drivers/media/dvb-frontends/au8522.h | 8 + drivers/media/dvb-frontends/au8522_decoder.c | 1 + drivers/media/dvb-frontends/au8522_priv.h | 8 - drivers/media/media-device.c | 66 +++++- drivers/media/media-entity.c | 65 +++-- drivers/media/usb/au0828/au0828-core.c | 340 +++++++++++++++++++++++---- drivers/media/usb/au0828/au0828-video.c | 75 +----- drivers/media/usb/au0828/au0828.h | 9 + drivers/media/v4l2-core/v4l2-dev.c | 48 ++++ drivers/media/v4l2-core/v4l2-fh.c | 1 + drivers/media/v4l2-core/v4l2-ioctl.c | 29 +++ drivers/media/v4l2-core/videobuf2-core.c | 4 + include/media/media-device.h | 61 +++++ include/media/media-entity.h | 12 + include/media/v4l2-dev.h | 5 + include/uapi/linux/media.h | 17 +- sound/usb/Kconfig | 4 + sound/usb/Makefile | 2 + sound/usb/card.c | 16 ++ sound/usb/card.h | 1 + sound/usb/media.c | 299 +++++++++++++++++++++++ sound/usb/media.h | 76 ++++++ sound/usb/mixer.h | 1 + sound/usb/pcm.c | 28 ++- sound/usb/quirks-table.h | 1 + sound/usb/quirks.c | 5 + sound/usb/stream.c | 1 + sound/usb/usbaudio.h | 2 + 31 files changed, 1070 insertions(+), 261 deletions(-) create mode 100644 sound/usb/media.c create mode 100644 sound/usb/media.h -- 2.5.0

3 10

[alsa-devel] [PATCH] topology: fix debug output to print correct "max" value.
by Liam Girdwood 01 Feb '16

01 Feb '16

Debug log is printing num_regs instead of max in the max section. Signed-off-by: Liam Girdwood <liam.r.girdwood(a)linux.intel.com> --- src/topology/ctl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/topology/ctl.c b/src/topology/ctl.c index 1c073f7..c250227 100644 --- a/src/topology/ctl.c +++ b/src/topology/ctl.c @@ -350,7 +350,7 @@ int tplg_parse_control_bytes(snd_tplg_t *tplg, return -EINVAL; be->max = atoi(val); - tplg_dbg("\t%s: %d\n", id, be->num_regs); + tplg_dbg("\t%s: %d\n", id, be->max); continue; } -- 2.5.0

2 1

[alsa-devel] [PATCH v2 1/3] [ALSA] portman2x4 - whitespace fixes
by Sudip Mukherjee 01 Feb '16

01 Feb '16

checkpatch was complaining about trailing whitespace, multiple blank lines and space before tabs. This patch takes care of these issues related to whitespace changes and there was no other change. Signed-off-by: Sudip Mukherjee <sudip(a)vectorindia.org> --- v2: combined 3 patches of v1 series into this patch. sound/drivers/portman2x4.c | 77 ++++++++++++++++++++++------------------------ 1 file changed, 37 insertions(+), 40 deletions(-) diff --git a/sound/drivers/portman2x4.c b/sound/drivers/portman2x4.c index 464385a..65b0650 100644 --- a/sound/drivers/portman2x4.c +++ b/sound/drivers/portman2x4.c @@ -57,7 +57,7 @@ static int index[SNDRV_CARDS] = SNDRV_DEFAULT_IDX; static char *id[SNDRV_CARDS] = SNDRV_DEFAULT_STR; static bool enable[SNDRV_CARDS] = SNDRV_DEFAULT_ENABLE_PNP; -static struct platform_device *platform_devices[SNDRV_CARDS]; +static struct platform_device *platform_devices[SNDRV_CARDS]; static int device_count; module_param_array(index, int, NULL, S_IRUGO); @@ -105,7 +105,7 @@ static int portman_create(struct snd_card *card, *rchip = NULL; pm = kzalloc(sizeof(struct portman), GFP_KERNEL); - if (pm == NULL) + if (pm == NULL) return -ENOMEM; /* Init chip specific data */ @@ -123,24 +123,24 @@ static int portman_create(struct snd_card *card, *********************************************************************/ /* Standard PC parallel port status register equates. */ -#define PP_STAT_BSY 0x80 /* Busy status. Inverted. */ -#define PP_STAT_ACK 0x40 /* Acknowledge. Non-Inverted. */ -#define PP_STAT_POUT 0x20 /* Paper Out. Non-Inverted. */ -#define PP_STAT_SEL 0x10 /* Select. Non-Inverted. */ -#define PP_STAT_ERR 0x08 /* Error. Non-Inverted. */ +#define PP_STAT_BSY 0x80 /* Busy status. Inverted. */ +#define PP_STAT_ACK 0x40 /* Acknowledge. Non-Inverted. */ +#define PP_STAT_POUT 0x20 /* Paper Out. Non-Inverted. */ +#define PP_STAT_SEL 0x10 /* Select. Non-Inverted. */ +#define PP_STAT_ERR 0x08 /* Error. Non-Inverted. */ /* Standard PC parallel port command register equates. */ -#define PP_CMD_IEN 0x10 /* IRQ Enable. Non-Inverted. */ -#define PP_CMD_SELI 0x08 /* Select Input. Inverted. */ -#define PP_CMD_INIT 0x04 /* Init Printer. Non-Inverted. */ -#define PP_CMD_FEED 0x02 /* Auto Feed. Inverted. */ +#define PP_CMD_IEN 0x10 /* IRQ Enable. Non-Inverted. */ +#define PP_CMD_SELI 0x08 /* Select Input. Inverted. */ +#define PP_CMD_INIT 0x04 /* Init Printer. Non-Inverted. */ +#define PP_CMD_FEED 0x02 /* Auto Feed. Inverted. */ #define PP_CMD_STB 0x01 /* Strobe. Inverted. */ /* Parallel Port Command Register as implemented by PCP2x4. */ -#define INT_EN PP_CMD_IEN /* Interrupt enable. */ +#define INT_EN PP_CMD_IEN /* Interrupt enable. */ #define STROBE PP_CMD_STB /* Command strobe. */ -/* The parallel port command register field (b1..b3) selects the +/* The parallel port command register field (b1..b3) selects the * various "registers" within the PC/P 2x4. These are the internal * address of these "registers" that must be written to the parallel * port command register. @@ -148,7 +148,7 @@ static int portman_create(struct snd_card *card, #define RXDATA0 (0 << 1) /* PCP RxData channel 0. */ #define RXDATA1 (1 << 1) /* PCP RxData channel 1. */ #define GEN_CTL (2 << 1) /* PCP General Control Register. */ -#define SYNC_CTL (3 << 1) /* PCP Sync Control Register. */ +#define SYNC_CTL (3 << 1) /* PCP Sync Control Register. */ #define TXDATA0 (4 << 1) /* PCP TxData channel 0. */ #define TXDATA1 (5 << 1) /* PCP TxData channel 1. */ #define TXDATA2 (6 << 1) /* PCP TxData channel 2. */ @@ -218,7 +218,7 @@ static inline void portman_write_data(struct portman *pm, u8 value) parport_write_data(pm->pardev->port, value); } -static void portman_write_midi(struct portman *pm, +static void portman_write_midi(struct portman *pm, int port, u8 mididata) { int command = ((port + 4) << 1); @@ -234,20 +234,20 @@ static void portman_write_midi(struct portman *pm, */ command |= INT_EN; - /* Disable interrupts so that the process is not interrupted, then - * write the address associated with the current Tx channel to the + /* Disable interrupts so that the process is not interrupted, then + * write the address associated with the current Tx channel to the * PP Command Reg. Do not set the Strobe signal yet. */ do { portman_write_command(pm, command); - /* While the address lines settle, write parallel output data to + /* While the address lines settle, write parallel output data to * PP Data Reg. This has no effect until Strobe signal is asserted. */ portman_write_data(pm, mididata); - + /* If PCP channel's TxEmpty is set (TxEmpty is read through the PP * Status Register), then go write data. Else go back and wait. */ @@ -284,7 +284,6 @@ static void portman_write_midi(struct portman *pm, /* Data sent. */ } - /* * Read MIDI byte from port * Attempt to read input byte from specified hardware input port (0..). @@ -357,7 +356,6 @@ static int portman_read_midi(struct portman *pm, int port) portman_write_data(pm, 1); /* Cause rising edge, which shifts data. */ portman_write_data(pm, 0); /* Return data clock low. */ - /* De-assert Strobe and return data. */ portman_write_command(pm, cmdout); /* Output saved address+IE. */ @@ -370,11 +368,12 @@ static int portman_read_midi(struct portman *pm, int port) /* * Checks if any input data on the given channel is available - * Checks RxAvail + * Checks RxAvail */ static int portman_data_avail(struct portman *pm, int channel) { int command = INT_EN; + switch (channel) { case 0: command |= RXDATA0; @@ -393,7 +392,6 @@ static int portman_data_avail(struct portman *pm, int channel) return 0; } - /* * Flushes any input */ @@ -456,7 +454,7 @@ static int portman_probe(struct parport *p) * hardware handshake lines to midi box: * * Strobe = 0 - * Interrupt Enable = 0 + * Interrupt Enable = 0 */ /* 2 */ parport_write_control(p, 0); @@ -481,7 +479,7 @@ static int portman_probe(struct parport *p) /* 7 */ parport_write_control(p, 0); /* Reset Strobe=0. */ - /* Check if Tx circuitry is functioning properly. If initialized + /* Check if Tx circuitry is functioning properly. If initialized * unit TxEmpty is false, send out char and see if if goes true. */ /* 8 */ @@ -567,12 +565,12 @@ static int snd_portman_rawmidi_create(struct snd_card *card) struct snd_rawmidi *rmidi; struct snd_rawmidi_substream *substream; int err; - - err = snd_rawmidi_new(card, CARD_NAME, 0, - PORTMAN_NUM_OUTPUT_PORTS, - PORTMAN_NUM_INPUT_PORTS, + + err = snd_rawmidi_new(card, CARD_NAME, 0, + PORTMAN_NUM_OUTPUT_PORTS, + PORTMAN_NUM_INPUT_PORTS, &rmidi); - if (err < 0) + if (err < 0) return err; rmidi->private_data = pm; @@ -584,9 +582,9 @@ static int snd_portman_rawmidi_create(struct snd_card *card) pm->rmidi = rmidi; /* register rawmidi ops */ - snd_rawmidi_set_ops(rmidi, SNDRV_RAWMIDI_STREAM_OUTPUT, + snd_rawmidi_set_ops(rmidi, SNDRV_RAWMIDI_STREAM_OUTPUT, &snd_portman_midi_output); - snd_rawmidi_set_ops(rmidi, SNDRV_RAWMIDI_STREAM_INPUT, + snd_rawmidi_set_ops(rmidi, SNDRV_RAWMIDI_STREAM_INPUT, &snd_portman_midi_input); /* name substreams */ @@ -621,7 +619,7 @@ static void snd_portman_interrupt(void *userdata) /* While any input data is waiting */ while ((portman_read_status(pm) & INT_REQ) == INT_REQ) { - /* If data available on channel 0, + /* If data available on channel 0, read it and stuff it into the queue. */ if (portman_data_avail(pm, 0)) { /* Read Midi */ @@ -632,7 +630,7 @@ static void snd_portman_interrupt(void *userdata) &midivalue, 1); } - /* If data available on channel 1, + /* If data available on channel 1, read it and stuff it into the queue. */ if (portman_data_avail(pm, 1)) { /* Read Midi */ @@ -658,7 +656,7 @@ static int snd_portman_probe_port(struct parport *p) 0, NULL); if (!pardev) return -EIO; - + if (parport_claim(pardev)) { parport_unregister_device(pardev); return -EIO; @@ -742,7 +740,7 @@ static int snd_portman_probe(struct platform_device *pdev) if (dev >= SNDRV_CARDS) return -ENODEV; - if (!enable[dev]) + if (!enable[dev]) return -ENOENT; if ((err = snd_portman_probe_port(p)) < 0) @@ -756,7 +754,7 @@ static int snd_portman_probe(struct platform_device *pdev) } strcpy(card->driver, DRIVER_NAME); strcpy(card->shortname, CARD_NAME); - sprintf(card->longname, "%s at 0x%lx, irq %i", + sprintf(card->longname, "%s at 0x%lx, irq %i", card->shortname, p->base, p->irq); pardev = parport_register_device(p, /* port */ @@ -779,7 +777,7 @@ static int snd_portman_probe(struct platform_device *pdev) } card->private_data = pm; card->private_free = snd_portman_card_private_free; - + if ((err = snd_portman_rawmidi_create(card)) < 0) { snd_printd("Creating Rawmidi component failed\n"); goto __err; @@ -823,7 +821,6 @@ static int snd_portman_remove(struct platform_device *pdev) return 0; } - static struct platform_driver snd_portman_driver = { .probe = snd_portman_probe, .remove = snd_portman_remove, @@ -844,7 +841,7 @@ static void snd_portman_unregister_all(void) platform_device_unregister(platform_devices[i]); platform_devices[i] = NULL; } - } + } platform_driver_unregister(&snd_portman_driver); parport_unregister_driver(&portman_parport_driver); } -- 1.9.1

2 4

[alsa-devel] [sound:topic/core-fixes 20/20] ERROR: "__snd_rawmidi_transmit_ack" [sound/core/seq/snd-seq-virmidi.ko] undefined!
by kbuild test robot 01 Feb '16

01 Feb '16

tree: https://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound.git topic/core-fixes head: 9e8e5e25fabf400957a5e1f51ae8107ac949403f commit: 9e8e5e25fabf400957a5e1f51ae8107ac949403f [20/20] ALSA: rawmidi: Make snd_rawmidi_transmit() race-free config: i386-randconfig-s1-201605 (attached as .config) reproduce: git checkout 9e8e5e25fabf400957a5e1f51ae8107ac949403f # save the attached .config to linux build tree make ARCH=i386 All errors (new ones prefixed by >>): >> ERROR: "__snd_rawmidi_transmit_ack" [sound/core/seq/snd-seq-virmidi.ko] undefined! --- 0-DAY kernel test infrastructure Open Source Technology Center https://lists.01.org/pipermail/kbuild-all Intel Corporation

2 1

[alsa-devel] sound: use-after-free in snd_seq_deliver_single_event
by Dmitry Vyukov 01 Feb '16

01 Feb '16

Hello, The following program triggers use-after-free in snd_seq_deliver_single_event (run in a tight parallel loop): // autogenerated by syzkaller (http://github.com/google/syzkaller) #include <pthread.h> #include <stdint.h> #include <string.h> #include <sys/syscall.h> #include <unistd.h> #ifndef SYS_mmap #define SYS_mmap 9 #endif #ifndef SYS_syz_open_dev #define SYS_syz_open_dev 1000001 #endif #ifndef SYS_ioctl #define SYS_ioctl 16 #endif #ifndef SYS_getpgrp #define SYS_getpgrp 111 #endif #ifndef SYS_migrate_pages #define SYS_migrate_pages 256 #endif #ifndef SYS_read #define SYS_read 0 #endif #ifndef SYS_write #define SYS_write 1 #endif #ifndef SYS_dup3 #define SYS_dup3 292 #endif long r[59]; void* thr(void* arg) { switch ((long)arg) { case 0: r[0] = syscall(SYS_mmap, 0x20000000ul, 0x47000ul, 0x3ul, 0x32ul, 0xfffffffffffffffful, 0x0ul); break; case 1: memcpy((void*)0x20000000, "\x2f\x64\x65\x76\x2f\x73\x65\x71\x75\x65\x6e\x63\x65\x72", 14); r[2] = syscall(SYS_open, "/dev/sequencer", 0x2ul, 0, 0, 0); break; case 2: r[3] = syscall(SYS_mmap, 0x20047000ul, 0x1000ul, 0x3ul, 0x32ul, 0xfffffffffffffffful, 0x0ul); break; case 3: r[4] = syscall(SYS_ioctl, r[2], 0x540ful, 0x20047ffcul, 0, 0, 0); if (r[4] != -1) r[5] = *(uint32_t*)0x20047ffc; break; case 4: r[6] = syscall(SYS_getpgrp, r[5], 0, 0, 0, 0, 0); break; case 5: r[7] = syscall(SYS_mmap, 0x20047000ul, 0x1000ul, 0x3ul, 0x32ul, 0xfffffffffffffffful, 0x0ul); break; case 6: r[8] = syscall(SYS_mmap, 0x20047000ul, 0x1000ul, 0x3ul, 0x32ul, 0xfffffffffffffffful, 0x0ul); break; case 7: *(uint64_t*)0x20047000 = (uint64_t)0x5; *(uint64_t*)0x20047000 = (uint64_t)0xfffffffffffffff8; r[11] = syscall(SYS_migrate_pages, r[6], 0xfful, 0x20047000ul, 0x20047000ul, 0, 0); break; case 8: memcpy((void*)0x20043684, "\x2f\x64\x65\x76\x2f\x64\x6d\x6d\x69\x64\x69\x23", 12); r[13] = syscall(SYS_open, "/dev/dmmidi2", 0x8a000ul, 0, 0, 0); break; case 9: r[14] = syscall(SYS_read, r[13], 0x20045000ul, 0x36ul, 0, 0, 0); break; case 10: *(uint8_t*)0x2000042c = (uint8_t)0x0; *(uint8_t*)0x2000042d = (uint8_t)0x9cf; *(uint8_t*)0x2000042e = (uint8_t)0x9; *(uint8_t*)0x2000042f = (uint8_t)0x0; *(uint64_t*)0x20000444 = (uint64_t)0x0; *(uint64_t*)0x2000044c = (uint64_t)0x989680; *(uint8_t*)0x20000454 = (uint8_t)0x2; *(uint8_t*)0x20000455 = (uint8_t)0x100000000; *(uint8_t*)0x20000456 = (uint8_t)0x8d; *(uint8_t*)0x20000457 = (uint8_t)0x7; *(uint8_t*)0x20000464 = (uint8_t)0x51b2; *(uint8_t*)0x20000465 = (uint8_t)0xfffffffffffff15a; *(uint8_t*)0x20000466 = (uint8_t)0x4; *(uint8_t*)0x20000467 = (uint8_t)0x4; *(uint32_t*)0x20000468 = (uint32_t)0xffffffff; *(uint8_t*)0x2000046c = (uint8_t)0x5; *(uint8_t*)0x2000046d = (uint8_t)0xfffffffffffffff8; *(uint8_t*)0x2000046e = (uint8_t)0x401; *(uint8_t*)0x2000046f = (uint8_t)0x5; *(uint64_t*)0x20000484 = (uint64_t)0x4; *(uint64_t*)0x2000048c = (uint64_t)0x0; *(uint8_t*)0x20000494 = (uint8_t)0xc2c1; *(uint8_t*)0x20000495 = (uint8_t)0x1; *(uint8_t*)0x20000496 = (uint8_t)0x6b; *(uint8_t*)0x20000497 = (uint8_t)0x6; *(uint8_t*)0x200004a0 = (uint8_t)0xfffffffffffffffa; *(uint8_t*)0x200004a1 = (uint8_t)0x81; *(uint8_t*)0x200004a2 = (uint8_t)0x0; *(uint8_t*)0x200004a3 = (uint8_t)0xa6; *(uint8_t*)0x200004a4 = (uint8_t)0x400; *(uint8_t*)0x200004a5 = (uint8_t)0x3ff; *(uint8_t*)0x200004a6 = (uint8_t)0x8; *(uint8_t*)0x200004a7 = (uint8_t)0x3; *(uint64_t*)0x200004bc = (uint64_t)0x0; *(uint64_t*)0x200004c4 = (uint64_t)0x0; *(uint8_t*)0x200004cc = (uint8_t)0x9e; *(uint8_t*)0x200004cd = (uint8_t)0x7ff; *(uint8_t*)0x200004ce = (uint8_t)0x7fff; *(uint8_t*)0x200004cf = (uint8_t)0x9; *(uint8_t*)0x200004e0 = (uint8_t)0xa; *(uint32_t*)0x200004e4 = (uint32_t)0x6; *(uint32_t*)0x200004e8 = (uint32_t)0xffffffff; r[57] = syscall(SYS_write, r[2], 0x2000042cul, 0x78ul, 0, 0, 0); break; case 11: r[58] = syscall(SYS_dup3, r[13], r[2], 0x80000ul, 0, 0, 0); break; } return 0; } int main() { long i; pthread_t th[12]; memset(r, -1, sizeof(r)); for (i = 0; i < 12; i++) { pthread_create(&th[i], 0, thr, (void*)i); usleep(10000); } for (i = 0; i < 12; i++) { pthread_create(&th[i], 0, thr, (void*)i); if (i % 2 == 0) usleep(10000); } usleep(100000); return 0; } ================================================================== BUG: KASAN: use-after-free in do_raw_spin_lock+0x281/0x2b0 at addr ffff88002abf1654 Read of size 4 by task syz-executor/13987 ============================================================================= BUG kmalloc-96 (Not tainted): kasan: bad access detected ----------------------------------------------------------------------------- INFO: Allocated in snd_midi_event_new+0x73/0x200 age=10 cpu=0 pid=13996 [< none >] ___slab_alloc+0x564/0x5b0 mm/slub.c:2470 [< none >] __slab_alloc+0x66/0xc0 mm/slub.c:2499 [< inline >] slab_alloc_node mm/slub.c:2562 [< inline >] slab_alloc mm/slub.c:2604 [< none >] kmem_cache_alloc_trace+0x25c/0x300 mm/slub.c:2621 [< inline >] kmalloc include/linux/slab.h:463 [< inline >] kzalloc include/linux/slab.h:607 [< none >] snd_midi_event_new+0x73/0x200 sound/core/seq/seq_midi_event.c:120 [< none >] snd_virmidi_input_open+0xfd/0x380 sound/core/seq/seq_virmidi.c:214 [< none >] open_substream+0x3eb/0x780 sound/core/rawmidi.c:269 [< none >] rawmidi_open_priv+0x144/0x300 sound/core/rawmidi.c:312 [< none >] snd_rawmidi_open+0x3fb/0xa90 sound/core/rawmidi.c:416 [< none >] soundcore_open+0x30f/0x640 sound/sound_core.c:639 [< none >] chrdev_open+0x22a/0x4c0 fs/char_dev.c:388 [< none >] do_dentry_open+0x6a2/0xcb0 fs/open.c:736 [< none >] vfs_open+0x17b/0x1f0 fs/open.c:853 [< inline >] do_last fs/namei.c:3254 [< none >] path_openat+0xde9/0x5e30 fs/namei.c:3386 [< none >] do_filp_open+0x18e/0x250 fs/namei.c:3421 [< none >] do_sys_open+0x1fc/0x420 fs/open.c:1022 [< inline >] SYSC_open fs/open.c:1040 [< none >] SyS_open+0x2d/0x40 fs/open.c:1035 INFO: Freed in snd_midi_event_free+0x43/0x60 age=17 cpu=0 pid=13996 [< none >] __slab_free+0x1fc/0x320 mm/slub.c:2680 [< inline >] slab_free mm/slub.c:2835 [< none >] kfree+0x2ac/0x2c0 mm/slub.c:3664 [< none >] snd_midi_event_free+0x43/0x60 sound/core/seq/seq_midi_event.c:142 [< none >] snd_virmidi_input_close+0x87/0x120 sound/core/seq/seq_virmidi.c:261 [< none >] close_substream.part.14+0xda/0x540 sound/core/rawmidi.c:486 [< inline >] close_substream sound/core/rawmidi.c:514 [< none >] rawmidi_release_priv+0x1e4/0x250 sound/core/rawmidi.c:504 [< none >] snd_rawmidi_release+0x62/0xf0 sound/core/rawmidi.c:539 [< none >] __fput+0x236/0x780 fs/file_table.c:208 [< none >] ____fput+0x15/0x20 fs/file_table.c:244 [< none >] task_work_run+0x170/0x210 kernel/task_work.c:115 [< inline >] exit_task_work include/linux/task_work.h:21 [< none >] do_exit+0x8b5/0x2cb0 kernel/exit.c:748 [< none >] do_group_exit+0x108/0x330 kernel/exit.c:878 [< none >] get_signal+0x5e4/0x14f0 kernel/signal.c:2307 [< none >] do_signal+0x83/0x1c90 arch/x86/kernel/signal.c:712 [< none >] exit_to_usermode_loop+0x1a5/0x210 arch/x86/entry/common.c:247 [< inline >] prepare_exit_to_usermode arch/x86/entry/common.c:282 [< none >] syscall_return_slowpath+0x2ba/0x340 arch/x86/entry/common.c:344 INFO: Slab 0xffffea0000aafc00 objects=28 used=11 fp=0xffff88002abf0470 flags=0x1fffc0000004080 INFO: Object 0xffff88002abf1630 @offset=5680 fp=0xffff88002abf06a8 CPU: 1 PID: 13987 Comm: syz-executor Tainted: G B 4.5.0-rc1+ #305 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 00000000ffffffff ffff880061aaf7d8 ffffffff82be11ad ffff88003e804900 ffff88002abf1630 ffff88002abf0000 ffff880061aaf808 ffffffff8175b454 ffff88003e804900 ffffea0000aafc00 ffff88002abf1630 000000000000000a Call Trace: [<ffffffff81764e3e>] __asan_report_load4_noabort+0x3e/0x40 mm/kasan/report.c:294 [< inline >] debug_spin_lock_before kernel/locking/spinlock_debug.c:83 [<ffffffff814663d1>] do_raw_spin_lock+0x281/0x2b0 kernel/locking/spinlock_debug.c:135 [< inline >] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:119 [<ffffffff86652b67>] _raw_spin_lock_irqsave+0xa7/0xd0 kernel/locking/spinlock.c:159 [<ffffffff852bb6a7>] snd_midi_event_decode+0x1f7/0x5c0 sound/core/seq/seq_midi_event.c:391 [< inline >] snd_virmidi_dev_receive_event sound/core/seq/seq_virmidi.c:95 [<ffffffff852ce754>] snd_virmidi_event_input+0x214/0x310 sound/core/seq/seq_virmidi.c:133 [<ffffffff852a7934>] snd_seq_deliver_single_event.constprop.11+0x3f4/0x740 sound/core/seq/seq_clientmgr.c:634 [<ffffffff852a7da2>] snd_seq_deliver_event+0x122/0x800 sound/core/seq/seq_clientmgr.c:828 [<ffffffff852a9186>] snd_seq_kernel_client_dispatch+0x126/0x170 sound/core/seq/seq_clientmgr.c:2401 [< inline >] snd_seq_oss_dispatch sound/core/seq/oss/seq_oss_device.h:151 [<ffffffff852ca423>] snd_seq_oss_midi_reset+0x303/0x4a0 sound/core/seq/oss/seq_oss_midi.c:481 [<ffffffff852bd490>] snd_seq_oss_reset+0x130/0x260 sound/core/seq/oss/seq_oss_init.c:469 [<ffffffff852bd631>] snd_seq_oss_release+0x71/0x130 sound/core/seq/oss/seq_oss_init.c:425 [<ffffffff852bbcca>] odev_release+0x5a/0x80 sound/core/seq/oss/seq_oss.c:155 [<ffffffff817c0156>] __fput+0x236/0x780 fs/file_table.c:208 [<ffffffff817c0725>] ____fput+0x15/0x20 fs/file_table.c:244 [<ffffffff813b14e0>] task_work_run+0x170/0x210 kernel/task_work.c:115 [< inline >] tracehook_notify_resume include/linux/tracehook.h:191 [<ffffffff810066b1>] exit_to_usermode_loop+0x1d1/0x210 arch/x86/entry/common.c:251 [< inline >] prepare_exit_to_usermode arch/x86/entry/common.c:282 [<ffffffff810084ea>] syscall_return_slowpath+0x2ba/0x340 arch/x86/entry/common.c:344 [<ffffffff86653322>] int_ret_from_sys_call+0x25/0x9f arch/x86/entry/entry_64.S:281 ================================================================== general protection fault: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN Modules linked in: CPU: 1 PID: 14982 Comm: syz-executor Tainted: G W 4.5.0-rc1+ #305 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 task: ffff88005e362f80 ti: ffff88005fba8000 task.ti: ffff88005fba8000 RIP: 0010:[<ffffffff852ce6d5>] [<ffffffff852ce6d5>] snd_virmidi_event_input+0x195/0x310 RSP: 0018:ffff88005fbaf608 EFLAGS: 00010202 RAX: 1bd5a00000000023 RBX: dead000000000100 RCX: 0000000000000002 RDX: 0000000000000004 RSI: 0000000000000100 RDI: dead00000000011c RBP: ffff88005fbaf6b8 R08: 0000000000000001 R09: 0000000000000000 R10: ffff88005e362f80 R11: ffff8800009fe110 R12: dffffc0000000000 R13: ffff88005fbaf900 R14: ffff8800009fe130 R15: 1ffff1000bf75ec6 FS: 00007fb93c201700(0000) GS:ffff88003ed00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b CR2: 0000000020045000 CR3: 000000005f9bd000 CR4: 00000000000006e0 Stack: ffff8800009fe0f8 ffffed000bf75f20 ffff88005fbaf901 0000000000000000 ffff88003639fa50 0000000041b58ab3 ffffffff879486ce ffffffff852ce540 ffff88003639fa28 0000000000000000 ffff88003639fa38 ffff88005fbaf678 Call Trace: [<ffffffff852a7934>] snd_seq_deliver_single_event.constprop.11+0x3f4/0x740 sound/core/seq/seq_clientmgr.c:634 [<ffffffff852a7da2>] snd_seq_deliver_event+0x122/0x800 sound/core/seq/seq_clientmgr.c:828 [<ffffffff852a9186>] snd_seq_kernel_client_dispatch+0x126/0x170 sound/core/seq/seq_clientmgr.c:2401 [< inline >] snd_seq_oss_dispatch sound/core/seq/oss/seq_oss_device.h:151 [<ffffffff852ca527>] snd_seq_oss_midi_reset+0x407/0x4a0 sound/core/seq/oss/seq_oss_midi.c:475 [<ffffffff852bd490>] snd_seq_oss_reset+0x130/0x260 sound/core/seq/oss/seq_oss_init.c:469 [<ffffffff852bd631>] snd_seq_oss_release+0x71/0x130 sound/core/seq/oss/seq_oss_init.c:425 [<ffffffff852bbcca>] odev_release+0x5a/0x80 sound/core/seq/oss/seq_oss.c:155 [<ffffffff817c0156>] __fput+0x236/0x780 fs/file_table.c:208 [<ffffffff817c0725>] ____fput+0x15/0x20 fs/file_table.c:244 [<ffffffff813b14e0>] task_work_run+0x170/0x210 kernel/task_work.c:115 [< inline >] exit_task_work include/linux/task_work.h:21 [<ffffffff8135ca55>] do_exit+0x8b5/0x2cb0 kernel/exit.c:748 [<ffffffff8135efc8>] do_group_exit+0x108/0x330 kernel/exit.c:878 [<ffffffff81382144>] get_signal+0x5e4/0x14f0 kernel/signal.c:2307 [<ffffffff811a0db3>] do_signal+0x83/0x1c90 arch/x86/kernel/signal.c:712 [<ffffffff81006685>] exit_to_usermode_loop+0x1a5/0x210 arch/x86/entry/common.c:247 [< inline >] prepare_exit_to_usermode arch/x86/entry/common.c:282 [<ffffffff810084ea>] syscall_return_slowpath+0x2ba/0x340 arch/x86/entry/common.c:344 [<ffffffff86653322>] int_ret_from_sys_call+0x25/0x9f arch/x86/entry/entry_64.S:281 Code: 3c 20 00 0f 85 31 01 00 00 48 8b 1b 49 39 de 0f 84 d9 00 00 00 e8 ec bb 29 fc 48 8d 7b 1c 48 89 f8 48 89 fa 48 c1 e8 03 83 e2 07 <42> 0f b6 04 20 38 d0 7f 08 84 c0 0f 85 3d 01 00 00 f6 43 1c 01 RIP [< inline >] snd_virmidi_dev_receive_event sound/core/seq/seq_virmidi.c:88 RIP [<ffffffff852ce6d5>] snd_virmidi_event_input+0x195/0x310 sound/core/seq/seq_virmidi.c:133 RSP <ffff88005fbaf608> ---[ end trace 35fa82e449e91fba ]--- Fixing recursive fault but reboot is needed! On commit 26cd83670f2f5a3d5b5514a1f7d96567cdb9558b.

3 7

Re: [alsa-devel] sound: WARNING in snd_rawmidi_transmit_ack
by Takashi Iwai 01 Feb '16

01 Feb '16

On Wed, 27 Jan 2016 13:31:05 +0100, Dmitry Vyukov wrote: > > On Tue, Jan 26, 2016 at 3:51 PM, Takashi Iwai <tiwai(a)suse.de> wrote: > > On Sun, 24 Jan 2016 17:29:12 +0100, > > Dmitry Vyukov wrote: > >> > >> Hello, > >> > >> The following program triggers WARNING in snd_rawmidi_transmit_ack: > >> > >> ------------[ cut here ]------------ > >> WARNING: CPU: 1 PID: 20739 at sound/core/rawmidi.c:1136 > >> snd_rawmidi_transmit_ack+0x275/0x400() > >> Modules linked in: > >> CPU: 1 PID: 20739 Comm: syz-executor Tainted: G W 4.4.0+ #276 > >> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 > >> 00000000ffffffff ffff8800346af8d8 ffffffff82999e2d 0000000000000000 > >> ffff88002fea97c0 ffffffff86d3f920 ffff8800346af918 ffffffff81352089 > >> ffffffff84f80bd5 ffffffff86d3f920 0000000000000470 ffff8800600b9b68 > >> Call Trace: > >> [< inline >] __dump_stack lib/dump_stack.c:15 > >> [<ffffffff82999e2d>] dump_stack+0x6f/0xa2 lib/dump_stack.c:50 > >> [<ffffffff81352089>] warn_slowpath_common+0xd9/0x140 kernel/panic.c:482 > >> [<ffffffff813522b9>] warn_slowpath_null+0x29/0x30 kernel/panic.c:515 > >> [<ffffffff84f80bd5>] snd_rawmidi_transmit_ack+0x275/0x400 > >> sound/core/rawmidi.c:1136 > >> [<ffffffff84fdb3c1>] snd_virmidi_output_trigger+0x4b1/0x5a0 > >> sound/core/seq/seq_virmidi.c:163 > >> [< inline >] snd_rawmidi_output_trigger sound/core/rawmidi.c:150 > >> [<ffffffff84f87ed9>] snd_rawmidi_kernel_write1+0x549/0x780 > >> sound/core/rawmidi.c:1223 > >> [<ffffffff84f89fd3>] snd_rawmidi_write+0x543/0xb30 sound/core/rawmidi.c:1273 > >> [<ffffffff817b0323>] __vfs_write+0x113/0x480 fs/read_write.c:528 > >> [<ffffffff817b1db7>] vfs_write+0x167/0x4a0 fs/read_write.c:577 > >> [< inline >] SYSC_write fs/read_write.c:624 > >> [<ffffffff817b50a1>] SyS_write+0x111/0x220 fs/read_write.c:616 > >> [<ffffffff86336c36>] entry_SYSCALL_64_fastpath+0x16/0x7a > >> arch/x86/entry/entry_64.S:185 > >> ---[ end trace 93509ba74cc3e259 ]--- > >> > >> > >> // autogenerated by syzkaller (http://github.com/google/syzkaller) > >> #include <pthread.h> > >> #include <stdint.h> > >> #include <string.h> > >> #include <sys/syscall.h> > >> #include <unistd.h> > >> #include <fcntl.h> > >> > >> long r[11]; > >> > >> void* thr(void* arg) > >> { > >> switch ((long)arg) { > >> case 0: > >> r[0] = syscall(SYS_mmap, 0x20000000ul, 0x10000ul, 0x3ul, 0x32ul, > >> 0xfffffffffffffffful, 0x0ul); > >> break; > >> case 1: > >> r[1] = syscall(SYS_open, "/dev/dmmidi2", O_RDWR, 0); > >> break; > >> case 2: > >> *(uint32_t*)0x20006fda = (uint32_t)0x28; > >> *(uint32_t*)0x20006fde = (uint32_t)0x7; > >> *(uint64_t*)0x20006fe2 = (uint64_t)0x0; > >> *(uint64_t*)0x20006fea = (uint64_t)0x7; > >> *(uint64_t*)0x20006ff2 = (uint64_t)0x8; > >> *(uint16_t*)0x20006ffa = (uint16_t)0xfffffffffffffff8; > >> r[8] = syscall(SYS_write, r[1], 0x20006fdaul, 0x28ul, 0, 0, 0); > >> break; > >> case 3: > >> memcpy((void*)0x20007000, > >> "\x3c\x3f\xbc\xd7\x07\xee\x01\x21\x84\x26\x11\x6d\xc6\xc3" > >> "\xac\x7f\x14\xa3\x15\xda\xa1\x34\x67\xe9\xb6\xf8\xa8\xdd" > >> "\xb5\xe0\x2a\x64\x6e\x04\x7c\x40\xdb\x64\x4f\x53\x41\x90" > >> "\x02\x3b\x48\xba\xf6\xd7\x32\xe5\x11\x3f\xe5\xc5\xf2\x5f" > >> "\x4e\x6f\x5b\xe9\x0e\x76\x1a\x72\x77\x68\xad\xd3\x1b\x8d" > >> "\x8f\x71\x2f\x40\xde\xf4\xbf\x78\x48\xc2\xc3\xe5\xe9\x11" > >> "\x11\xd2\x9a\x91\x94\x81\x57\x22\xef\x2a\x5b\xe2\x9e\xce" > >> "\x3f\xa6\x07\x54\xd4\xb6\x1f\x30\xfd\x09\x35\x54\xcc\x78" > >> "\x12\x37\x59\xf7\x5c\x51\xd2\x47\xb8\x40\x98\x2b\xb4\x8d" > >> "\xbf\xd5\x34\x26\xcd\xb5\xe4\x98\x2d\x0e\xb1\x71\x0f\x12" > >> "\x06\xb0\x2c\x78\x74\xba\x3d\x32\x9c\x72\x96\x0d\x91\x50" > >> "\x9a\xe3\xbc\x4f\x1e\x26\xb2\xe3\xb2\xa2\x68\x6f\x10\xb5" > >> "\xc1\x7f\xfc\xfd\xf0\xe6\xd9\x0c\xa0\xa7\x54\x2c\x62\x0d" > >> "\xee\x04\x5b\x9d\x73\xf4\xcc\x29\x37\x01\xc2\x35\x8d\x3c" > >> "\x8a\x2f\xe3\xf5\x55\x42\x77\x55\x2d\x49\x6f\x46\xf7\x34" > >> "\xb1\x5f\xe7\x98\x55\xb5\x7c\x4e\xd7\x47\x18\xd1\xf9\xf2" > >> "\xd2\xfe\x47\xff\x22\x04\xa9\x32\xe9\xd6\x28\xda\xe1\x85" > >> "\xcb\xc5\xe6\xc1\xca\x9e\x3f\x1f\x80\xe6", > >> 248); > >> r[10] = syscall(SYS_write, r[1], 0x20007000ul, 0xf8ul, 0, 0, 0); > >> break; > >> } > >> return 0; > >> } > >> > >> int main() > >> { > >> long i; > >> pthread_t th[4]; > >> > >> memset(r, -1, sizeof(r)); > >> for (i = 0; i < 4; i++) { > >> pthread_create(&th[i], 0, thr, (void*)i); > >> usleep(10000); > >> } > >> for (i = 0; i < 4; i++) { > >> pthread_create(&th[i], 0, thr, (void*)i); > >> if (i % 2 == 0) > >> usleep(10000); > >> } > >> usleep(100000); > >> return 0; > >> } > >> > >> On commit 30f05309bde49295e02e45c7e615f73aa4e0ccc2. > > > > Could you check the patch below? It's untested yet in my side due to > > other bugs... > > No, I still see the same warning. > Please try to reproduce it locally and test. This wasn't triggered on my machine. How did you start the test program? Meanwhile below is another patch to be applied in addition to the previous fix. There is a possible race in calling snd_rawmidi_transmit(), and this may result in such a warning. Takashi --- From: Takashi Iwai <tiwai(a)suse.de> Subject: [PATCH] ALSA: rawmidi: Make snd_rawmidi_transmit() race-free Signed-off-by: Takashi Iwai <tiwai(a)suse.de> --- sound/core/rawmidi.c | 95 ++++++++++++++++++++++++++++++++++------------------ 1 file changed, 62 insertions(+), 33 deletions(-) diff --git a/sound/core/rawmidi.c b/sound/core/rawmidi.c index a7759846fbaa..3a27944c821c 100644 --- a/sound/core/rawmidi.c +++ b/sound/core/rawmidi.c @@ -1054,24 +1054,9 @@ int snd_rawmidi_transmit_empty(struct snd_rawmidi_substream *substream) } EXPORT_SYMBOL(snd_rawmidi_transmit_empty); -/** - * snd_rawmidi_transmit_peek - copy data from the internal buffer - * @substream: the rawmidi substream - * @buffer: the buffer pointer - * @count: data size to transfer - * - * Copies data from the internal output buffer to the given buffer. - * - * Call this in the interrupt handler when the midi output is ready, - * and call snd_rawmidi_transmit_ack() after the transmission is - * finished. - * - * Return: The size of copied data, or a negative error code on failure. - */ -int snd_rawmidi_transmit_peek(struct snd_rawmidi_substream *substream, +static int rawmidi_transmit_peek(struct snd_rawmidi_substream *substream, unsigned char *buffer, int count) { - unsigned long flags; int result, count1; struct snd_rawmidi_runtime *runtime = substream->runtime; @@ -1081,7 +1066,6 @@ int snd_rawmidi_transmit_peek(struct snd_rawmidi_substream *substream, return -EINVAL; } result = 0; - spin_lock_irqsave(&runtime->lock, flags); if (runtime->avail >= runtime->buffer_size) { /* warning: lowlevel layer MUST trigger down the hardware */ goto __skip; @@ -1106,25 +1090,39 @@ int snd_rawmidi_transmit_peek(struct snd_rawmidi_substream *substream, } } __skip: - spin_unlock_irqrestore(&runtime->lock, flags); return result; } -EXPORT_SYMBOL(snd_rawmidi_transmit_peek); /** - * snd_rawmidi_transmit_ack - acknowledge the transmission + * snd_rawmidi_transmit_peek - copy data from the internal buffer * @substream: the rawmidi substream - * @count: the transferred count + * @buffer: the buffer pointer + * @count: data size to transfer * - * Advances the hardware pointer for the internal output buffer with - * the given size and updates the condition. - * Call after the transmission is finished. + * Copies data from the internal output buffer to the given buffer. * - * Return: The advanced size if successful, or a negative error code on failure. + * Call this in the interrupt handler when the midi output is ready, + * and call snd_rawmidi_transmit_ack() after the transmission is + * finished. + * + * Return: The size of copied data, or a negative error code on failure. */ -int snd_rawmidi_transmit_ack(struct snd_rawmidi_substream *substream, int count) +int snd_rawmidi_transmit_peek(struct snd_rawmidi_substream *substream, + unsigned char *buffer, int count) { + struct snd_rawmidi_runtime *runtime = substream->runtime; + int result; unsigned long flags; + + spin_lock_irqsave(&runtime->lock, flags); + result = rawmidi_transmit_peek(substream, buffer, count); + spin_unlock_irqrestore(&runtime->lock, flags); + return result; +} +EXPORT_SYMBOL(snd_rawmidi_transmit_peek); + +static int rawmidi_transmit_ack(struct snd_rawmidi_substream *substream, int count) +{ struct snd_rawmidi_runtime *runtime = substream->runtime; if (runtime->buffer == NULL) { @@ -1132,7 +1130,6 @@ int snd_rawmidi_transmit_ack(struct snd_rawmidi_substream *substream, int count) "snd_rawmidi_transmit_ack: output is not active!!!\n"); return -EINVAL; } - spin_lock_irqsave(&runtime->lock, flags); snd_BUG_ON(runtime->avail + count > runtime->buffer_size); runtime->hw_ptr += count; runtime->hw_ptr %= runtime->buffer_size; @@ -1142,9 +1139,31 @@ int snd_rawmidi_transmit_ack(struct snd_rawmidi_substream *substream, int count) if (runtime->drain || snd_rawmidi_ready(substream)) wake_up(&runtime->sleep); } - spin_unlock_irqrestore(&runtime->lock, flags); return count; } + +/** + * snd_rawmidi_transmit_ack - acknowledge the transmission + * @substream: the rawmidi substream + * @count: the transferred count + * + * Advances the hardware pointer for the internal output buffer with + * the given size and updates the condition. + * Call after the transmission is finished. + * + * Return: The advanced size if successful, or a negative error code on failure. + */ +int snd_rawmidi_transmit_ack(struct snd_rawmidi_substream *substream, int count) +{ + struct snd_rawmidi_runtime *runtime = substream->runtime; + int result; + unsigned long flags; + + spin_lock_irqsave(&runtime->lock, flags); + result = rawmidi_transmit_ack(substream, count); + spin_unlock_irqrestore(&runtime->lock, flags); + return result; +} EXPORT_SYMBOL(snd_rawmidi_transmit_ack); /** @@ -1160,12 +1179,22 @@ EXPORT_SYMBOL(snd_rawmidi_transmit_ack); int snd_rawmidi_transmit(struct snd_rawmidi_substream *substream, unsigned char *buffer, int count) { + struct snd_rawmidi_runtime *runtime = substream->runtime; + int result; + unsigned long flags; + + spin_lock_irqsave(&runtime->lock, flags); if (!substream->opened) - return -EBADFD; - count = snd_rawmidi_transmit_peek(substream, buffer, count); - if (count < 0) - return count; - return snd_rawmidi_transmit_ack(substream, count); + result = -EBADFD; + else { + count = rawmidi_transmit_peek(substream, buffer, count); + if (count <= 0) + result = count; + else + result = rawmidi_transmit_ack(substream, count); + } + spin_unlock_irqrestore(&runtime->lock, flags); + return result; } EXPORT_SYMBOL(snd_rawmidi_transmit); -- 2.7.0

2 1

Re: [alsa-devel] [PATCH] ASoC: nau8825: reduce stanby power consumption
by John Hsu 01 Feb '16

01 Feb '16

Hi Mark, This power patch modifies some widgets to fix power saving issue when standby. But we want to submit a depop patch to fine tune widgets and fix the pop noise now. It has overlap with the power patch. Can we make the depop patch based on the power patch? Could you give us advice how to make submit patch in this case? Thank you very much. BR. John On 1/15/2016 11:53 PM, AC30 KCHsu0 wrote: > Fix unnecessary widget power up when standby; And decrease internal clock frequency to save power. > > Signed-off-by: John Hsu <KCHSU0(a)nuvoton.com> > --- > sound/soc/codecs/nau8825.c | 49 +++++++++++++++++++++++++++++++++------------- > 1 file changed, 35 insertions(+), 14 deletions(-) > > diff --git a/sound/soc/codecs/nau8825.c b/sound/soc/codecs/nau8825.c index 52882e4..f9752cc 100644 > --- a/sound/soc/codecs/nau8825.c > +++ b/sound/soc/codecs/nau8825.c > @@ -262,6 +262,29 @@ static int nau8825_playback_event(struct snd_soc_dapm_widget *w, > return 0; > } > > +static int nau8825_dacr_event(struct snd_soc_dapm_widget *w, > + struct snd_kcontrol *kcontrol, int event) { > + struct snd_soc_codec *codec = snd_soc_dapm_to_codec(w->dapm); > + struct nau8825 *nau8825 = snd_soc_codec_get_drvdata(codec); > + > + switch (event) { > + case SND_SOC_DAPM_POST_PMU: > + regmap_update_bits(nau8825->regmap, NAU8825_REG_ENA_CTRL, > + NAU8825_ENABLE_DACR, NAU8825_ENABLE_DACR); > + break; > + case SND_SOC_DAPM_POST_PMD: > + if (!nau8825->irq) > + regmap_update_bits(nau8825->regmap, > + NAU8825_REG_ENA_CTRL, NAU8825_ENABLE_DACR, 0); > + break; > + default: > + return -EINVAL; > + } > + > + return 0; > +} > + > > static const char * const nau8825_adc_decimation[] = { > "32", "64", "128", "256" > @@ -337,16 +360,17 @@ static const struct snd_soc_dapm_widget nau8825_dapm_widgets[] = { > 0), > > /* ADC for button press detection */ > - SND_SOC_DAPM_ADC("SAR", NULL, NAU8825_REG_SAR_CTRL, > - NAU8825_SAR_ADC_EN_SFT, 0), > + SND_SOC_DAPM_SUPPLY("SAR", NAU8825_REG_SAR_CTRL, > + NAU8825_SAR_ADC_EN_SFT, 0, NULL, 0), > > SND_SOC_DAPM_DAC("ADACL", NULL, NAU8825_REG_RDAC, 12, 0), > SND_SOC_DAPM_DAC("ADACR", NULL, NAU8825_REG_RDAC, 13, 0), > SND_SOC_DAPM_SUPPLY("ADACL Clock", NAU8825_REG_RDAC, 8, 0, NULL, 0), > SND_SOC_DAPM_SUPPLY("ADACR Clock", NAU8825_REG_RDAC, 9, 0, NULL, 0), > > - SND_SOC_DAPM_DAC("DDACR", NULL, NAU8825_REG_ENA_CTRL, > - NAU8825_ENABLE_DACR_SFT, 0), > + SND_SOC_DAPM_DAC_E("DDACR", NULL, SND_SOC_NOPM, 0, 0, > + nau8825_dacr_event, SND_SOC_DAPM_POST_PMU | > + SND_SOC_DAPM_POST_PMD), > SND_SOC_DAPM_DAC("DDACL", NULL, NAU8825_REG_ENA_CTRL, > NAU8825_ENABLE_DACL_SFT, 0), > SND_SOC_DAPM_SUPPLY("DDAC Clock", NAU8825_REG_ENA_CTRL, 6, 0, NULL, 0), @@ -878,13 +902,6 @@ static int nau8825_codec_probe(struct snd_soc_codec *codec) > > nau8825->dapm = dapm; > > - /* The interrupt clock is gated by x1[10:8], > - * one of them needs to be enabled all the time for > - * interrupts to happen. > - */ > - snd_soc_dapm_force_enable_pin(dapm, "DDACR"); > - snd_soc_dapm_sync(dapm); > - > /* Unmask interruptions. Handler uses dapm object so we can enable > * interruptions only after dapm is fully initialized. > */ > @@ -1075,6 +1092,12 @@ static int nau8825_configure_sysclk(struct nau8825 *nau8825, int clk_id, > NAU8825_DCO_EN); > regmap_update_bits(regmap, NAU8825_REG_CLK_DIVIDER, > NAU8825_CLK_SRC_MASK, NAU8825_CLK_SRC_VCO); > + regmap_update_bits(regmap, NAU8825_REG_CLK_DIVIDER, > + NAU8825_CLK_MCLK_SRC_MASK, 0xf); > + regmap_update_bits(regmap, NAU8825_REG_FLL1, > + NAU8825_FLL_RATIO_MASK, 0x10); > + regmap_update_bits(regmap, NAU8825_REG_FLL6, > + NAU8825_SDM_EN, NAU8825_SDM_EN); > if (nau8825->mclk_freq) { > clk_disable_unprepare(nau8825->mclk); > nau8825->mclk_freq = 0; > @@ -1309,9 +1332,7 @@ static int nau8825_setup_irq(struct nau8825 *nau8825) > /* Enable internal VCO needed for interruptions */ > nau8825_configure_sysclk(nau8825, NAU8825_CLK_INTERNAL, 0); > > - /* Enable DDACR needed for interrupts > - * It is the same as force_enable_pin("DDACR") we do later > - */ > + /* Enable DDACR needed for interrupts */ > regmap_update_bits(regmap, NAU8825_REG_ENA_CTRL, > NAU8825_ENABLE_DACR, NAU8825_ENABLE_DACR); > > -- > 2.6.4 > > . > >

1 0