October 2017 - Alsa-devel - mailman.alsa-project.org

[alsa-devel] [PATCH] ASoC: rsnd: stop all working stream when .remove
by Kuninori Morimoto 11 Oct '17

11 Oct '17

From: Kuninori Morimoto <kuninori.morimoto.gx(a)renesas.com> Driver should stop all working stream when .remove timing. Current Renesas sound driver is assuming that all stream was stopped when .remove but it was wrong. This patch stops all working stream when .remove, otherwise kernel will get damage for example in below case. Special thanks to Truong, Hiep > cd /sys/bus/platform/drivers/rcar_sound > aplay xxx.wav & > echo ec500000.sound > unbind Reported-by: Hiep Cao Minh <cm-hiep(a)jinso.co.jp> Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx(a)renesas.com> --- sound/soc/sh/rcar/core.c | 68 ++++++++++++++++++++++++++++++++++-------------- 1 file changed, 48 insertions(+), 20 deletions(-) diff --git a/sound/soc/sh/rcar/core.c b/sound/soc/sh/rcar/core.c index 1071332..1bf472f 100644 --- a/sound/soc/sh/rcar/core.c +++ b/sound/soc/sh/rcar/core.c @@ -197,12 +197,6 @@ void rsnd_mod_interrupt(struct rsnd_mod *mod, } } -int rsnd_io_is_working(struct rsnd_dai_stream *io) -{ - /* see rsnd_dai_stream_init/quit() */ - return !!io->substream; -} - int rsnd_runtime_channel_original(struct rsnd_dai_stream *io) { struct snd_pcm_runtime *runtime = rsnd_io_to_runtime(io); @@ -610,20 +604,24 @@ struct rsnd_dai_stream *rsnd_rdai_to_io(struct rsnd_dai *rdai, return &rdai->capture; } -static int rsnd_soc_dai_trigger(struct snd_pcm_substream *substream, int cmd, - struct snd_soc_dai *dai) +int rsnd_io_is_working(struct rsnd_dai_stream *io) +{ + /* see rsnd_dai_stream_init/quit() */ + return !!io->substream; +} + +#define rsnd_io_start(priv, io, sub) rsnd_io_operation(priv, io, sub) +#define rsnd_io_stop(priv, io) rsnd_io_operation(priv, io, NULL) +static int rsnd_io_operation(struct rsnd_priv *priv, + struct rsnd_dai_stream *io, + struct snd_pcm_substream *substream) { - struct rsnd_priv *priv = rsnd_dai_to_priv(dai); - struct rsnd_dai *rdai = rsnd_dai_to_rdai(dai); - struct rsnd_dai_stream *io = rsnd_rdai_to_io(rdai, substream); int ret; unsigned long flags; spin_lock_irqsave(&priv->lock, flags); - switch (cmd) { - case SNDRV_PCM_TRIGGER_START: - case SNDRV_PCM_TRIGGER_RESUME: + if (substream) { rsnd_dai_stream_init(io, substream); ret = rsnd_dai_call(init, io, priv); @@ -638,9 +636,7 @@ static int rsnd_soc_dai_trigger(struct snd_pcm_substream *substream, int cmd, if (ret < 0) goto dai_trigger_end; - break; - case SNDRV_PCM_TRIGGER_STOP: - case SNDRV_PCM_TRIGGER_SUSPEND: + } else { ret = rsnd_dai_call(irq, io, priv, 0); ret |= rsnd_dai_call(stop, io, priv); @@ -648,9 +644,6 @@ static int rsnd_soc_dai_trigger(struct snd_pcm_substream *substream, int cmd, ret |= rsnd_dai_call(quit, io, priv); rsnd_dai_stream_quit(io); - break; - default: - ret = -EINVAL; } dai_trigger_end: @@ -659,6 +652,30 @@ static int rsnd_soc_dai_trigger(struct snd_pcm_substream *substream, int cmd, return ret; } +static int rsnd_soc_dai_trigger(struct snd_pcm_substream *substream, int cmd, + struct snd_soc_dai *dai) +{ + struct rsnd_priv *priv = rsnd_dai_to_priv(dai); + struct rsnd_dai *rdai = rsnd_dai_to_rdai(dai); + struct rsnd_dai_stream *io = rsnd_rdai_to_io(rdai, substream); + int ret; + + switch (cmd) { + case SNDRV_PCM_TRIGGER_START: + case SNDRV_PCM_TRIGGER_RESUME: + ret = rsnd_io_start(priv, io, substream); + break; + case SNDRV_PCM_TRIGGER_STOP: + case SNDRV_PCM_TRIGGER_SUSPEND: + ret = rsnd_io_stop(priv, io); + break; + default: + ret = -EINVAL; + } + + return ret; +} + static int rsnd_soc_dai_set_fmt(struct snd_soc_dai *dai, unsigned int fmt) { struct rsnd_dai *rdai = rsnd_dai_to_rdai(dai); @@ -1477,6 +1494,17 @@ static int rsnd_remove(struct platform_device *pdev) }; int ret = 0, i; + /* + * Stop all working io + */ + for_each_rsnd_dai(rdai, priv, i) { + if (rsnd_io_is_working(&rdai->playback)) + rsnd_io_stop(priv, &rdai->playback); + + if (rsnd_io_is_working(&rdai->capture)) + rsnd_io_stop(priv, &rdai->capture); + } + pm_runtime_disable(&pdev->dev); for_each_rsnd_dai(rdai, priv, i) { -- 1.9.1

3 21

[alsa-devel] [PATCH 0/3] ALSA: add snd_card_disconnect_sync()
by Kuninori Morimoto 11 Oct '17

11 Oct '17

Hi Takashi-san, Mark Current ALSA (SoC) might be kernel panic if user unbinds sound driver during playback. > aplay xxx.wav & > echo xxxx > /sys/bus/platform/drivers/xxxx/unbind Main issue is we *can't* skip unbind with return -Exxx, because unbind operation doesn't checks return value from each driver. Thus, we *must* stop driver immediately when unbind. 1) is for ALSA 2) is for ALSA SoC 3) is for Renesas sound driver. I think almost all driver want to have 3) type patch on .remove but this patch-set doesn't care at this point. Please let me know if they should have it. Takashi Iwai (1): 1) ALSA: add snd_card_disconnect_sync() Kuninori Morimoto (2): 2) ASoC: add snd_soc_card_disconnect_sync() 3) ASoC: rsnd: call snd_soc_card_disconnect_sync() when remove include/sound/core.h | 2 ++ include/sound/soc.h | 2 ++ sound/core/init.c | 18 ++++++++++++++++++ sound/core/pcm.c | 4 ++++ sound/soc/sh/rcar/core.c | 2 ++ sound/soc/soc-core.c | 10 ++++++++++ 6 files changed, 38 insertions(+) -- 1.9.1 Best regards --- Kuninori Morimoto

1 0

[alsa-devel] [PATCH 0/3] ALSA: add snd_card_disconnect_sync()
by Kuninori Morimoto 11 Oct '17

11 Oct '17

Hi Takashi-san, Mark Current ALSA (SoC) might be kernel panic if user unbinds sound driver during playback. > aplay xxx.wav & > echo xxxx > /sys/bus/platform/drivers/xxxx/unbind Main issue is we *can't* skip unbind with return -Exxx, because unbind operation doesn't checks return value from each driver. Thus, we *must* stop driver immediately when unbind. 1) is for ALSA 2) is for ALSA SoC 3) is for Renesas sound driver. I think almost all driver want to have 3) type patch on .remove but this patch-set doesn't care at this point. Please let me know if they should have it. Takashi Iwai (1): 1) ALSA: add snd_card_disconnect_sync() Kuninori Morimoto (2): 2) ASoC: add snd_soc_card_disconnect_sync() 3) ASoC: rsnd: call snd_soc_card_disconnect_sync() when remove include/sound/core.h | 2 ++ include/sound/soc.h | 2 ++ sound/core/init.c | 18 ++++++++++++++++++ sound/core/pcm.c | 4 ++++ sound/soc/sh/rcar/core.c | 2 ++ sound/soc/soc-core.c | 10 ++++++++++ 6 files changed, 38 insertions(+) -- 1.9.1 Best regards --- Kuninori Morimoto

1 0

[alsa-devel] [PATCH 0/9] sound: Add sanity checks for invalid EPs
by Takashi Iwai 10 Oct '17

10 Oct '17

Hi, this is a patchset to cover the codes that may submit URBs containing invalid EPs without validation, which result in the kernel warning from the USB core. The first patch adds a new helper for simplifying the EP check, and the rest applies it at needed places. USB devs: could you check the first patch? I tried usb_find_common_endpoints() and friends at first, but it made the code more complex in the end, because we're dealing with the fixed endpoints and the validation is required for them. The original issues were spotted by syzkaller, and I put a few others for covering more similar cases. thanks, Takashi === Takashi Iwai (9): usb: core: Add a helper function to check the validity of EP type in URB ALSA: bcd2000: Add a sanity check for invalid EPs ALSA: caiaq: Add a sanity check for invalid EPs ALSA: line6: Add a sanity check for invalid EPs ALSA: usb-audio: Add sanity checks for invalid EPs ALSA: usx2y: Add sanity checks for invalid EPs ALSA: hiface: Add sanity checks for invalid EPs ALSA: caiaq: Add yet more sanity checks for invalid EPs ALSA: line6: Add yet more sanity checks for invalid EPs drivers/usb/core/urb.c | 28 +++++++++++++++++++++++++--- include/linux/usb.h | 2 ++ sound/usb/bcd2000/bcd2000.c | 7 +++++++ sound/usb/caiaq/device.c | 7 +++++++ sound/usb/caiaq/input.c | 9 +++++++++ sound/usb/hiface/pcm.c | 9 +++++++-- sound/usb/line6/driver.c | 30 ++++++++++++++++++++++-------- sound/usb/line6/midi.c | 17 +++++++++++------ sound/usb/midi.c | 38 ++++++++++++++++++++++++++++++-------- sound/usb/usx2y/usbusx2y.c | 8 ++++++++ sound/usb/usx2y/usbusx2yaudio.c | 3 +++ 11 files changed, 131 insertions(+), 27 deletions(-) -- 2.14.2

3 14

[alsa-devel] [PATCH 6/8] Documentation: fix sound related doc refs
by Tom Saeger 10 Oct '17

10 Oct '17

Make sound doc refs valid. Signed-off-by: Tom Saeger <tom.saeger(a)oracle.com> --- Documentation/sound/hd-audio/notes.rst | 2 +- Documentation/sound/kernel-api/writing-an-alsa-driver.rst | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/Documentation/sound/hd-audio/notes.rst b/Documentation/sound/hd-audio/notes.rst index f59c3cdbfaf4..9f7347830ba4 100644 --- a/Documentation/sound/hd-audio/notes.rst +++ b/Documentation/sound/hd-audio/notes.rst @@ -192,7 +192,7 @@ preset model instead of PCI (and codec-) SSID look-up. What ``model`` option values are available depends on the codec chip. Check your codec chip from the codec proc file (see "Codec Proc-File" section below). It will show the vendor/product name of your codec -chip. Then, see Documentation/sound/HD-Audio-Models.rst file, +chip. Then, see Documentation/sound/hd-audio/models.rst file, the section of HD-audio driver. You can find a list of codecs and ``model`` options belonging to each codec. For example, for Realtek ALC262 codec chip, pass ``model=ultra`` for devices that are compatible diff --git a/Documentation/sound/kernel-api/writing-an-alsa-driver.rst b/Documentation/sound/kernel-api/writing-an-alsa-driver.rst index 58ffa3f5bda7..a0b268466cb1 100644 --- a/Documentation/sound/kernel-api/writing-an-alsa-driver.rst +++ b/Documentation/sound/kernel-api/writing-an-alsa-driver.rst @@ -2498,7 +2498,7 @@ Mic boost Mic-boost switch is set as “Mic Boost” or “Mic Boost (6dB)”. More precise information can be found in -``Documentation/sound/alsa/ControlNames.txt``. +``Documentation/sound/designs/control-names.rst``. Access Flags ------------ -- 2.14.2

2 1

[alsa-devel] [PATCH 3/8] Documentation: fix input related doc refs
by Tom Saeger 10 Oct '17

10 Oct '17

Make `input` document refs valid including: - joystick - joystick-parport Signed-off-by: Tom Saeger <tom.saeger(a)oracle.com> --- Documentation/admin-guide/kernel-parameters.txt | 10 +++++----- Documentation/hid/hiddev.txt | 2 +- Documentation/input/devices/xpad.rst | 3 ++- Documentation/sound/cards/joystick.rst | 2 +- 4 files changed, 9 insertions(+), 8 deletions(-) diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt index e857bbbc8575..411b41127eee 100644 --- a/Documentation/admin-guide/kernel-parameters.txt +++ b/Documentation/admin-guide/kernel-parameters.txt @@ -314,7 +314,7 @@ amijoy.map= [HW,JOY] Amiga joystick support Map of devices attached to JOY0DAT and JOY1DAT Format: <a>,<b> - See also Documentation/input/joystick.txt + See also Documentation/input/joydev/joystick.rst analog.map= [HW,JOY] Analog joystick and gamepad support Specifies type or capabilities of an analog joystick @@ -724,7 +724,7 @@ db9.dev[2|3]= [HW,JOY] Multisystem joystick support via parallel port (one device per port) Format: <port#>,<type> - See also Documentation/input/joystick-parport.txt + See also Documentation/input/devices/joystick-parport.rst ddebug_query= [KNL,DYNAMIC_DEBUG] Enable debug messages at early boot time. See @@ -1220,7 +1220,7 @@ [HW,JOY] Multisystem joystick and NES/SNES/PSX pad support via parallel port (up to 5 devices per port) Format: <port#>,<pad1>,<pad2>,<pad3>,<pad4>,<pad5> - See also Documentation/input/joystick-parport.txt + See also Documentation/input/devices/joystick-parport.rst gamma= [HW,DRM] @@ -1766,7 +1766,7 @@ ivrs_acpihid[00:14.5]=AMD0020:0 js= [HW,JOY] Analog joystick - See Documentation/input/joystick.txt. + See Documentation/input/joydev/joystick.rst. nokaslr [KNL] When CONFIG_RANDOMIZE_BASE is set, this disables @@ -4199,7 +4199,7 @@ TurboGraFX parallel port interface Format: <port#>,<js1>,<js2>,<js3>,<js4>,<js5>,<js6>,<js7> - See also Documentation/input/joystick-parport.txt + See also Documentation/input/devices/joystick-parport.rst udbg-immortal [PPC] When debugging early kernel crashes that happen after console_init() and before a proper diff --git a/Documentation/hid/hiddev.txt b/Documentation/hid/hiddev.txt index 6e8c9f1d2f22..638448707aa2 100644 --- a/Documentation/hid/hiddev.txt +++ b/Documentation/hid/hiddev.txt @@ -12,7 +12,7 @@ To support these disparate requirements, the Linux USB system provides HID events to two separate interfaces: * the input subsystem, which converts HID events into normal input device interfaces (such as keyboard, mouse and joystick) and a -normalised event interface - see Documentation/input/input.txt +normalised event interface - see Documentation/input/input.rst * the hiddev interface, which provides fairly raw HID events The data flow for a HID event produced by a device is something like diff --git a/Documentation/input/devices/xpad.rst b/Documentation/input/devices/xpad.rst index 5a709ab77c8d..b8bd65962dd8 100644 --- a/Documentation/input/devices/xpad.rst +++ b/Documentation/input/devices/xpad.rst @@ -230,4 +230,5 @@ Historic Edits 2005-03-19 - Dominic Cerquetti <binary1230(a)yahoo.com> - added stuff for dance pads, new d-pad->axes mappings -Later changes may be viewed with 'git log Documentation/input/xpad.txt' +Later changes may be viewed with +'git log --follow Documentation/input/devices/xpad.rst' diff --git a/Documentation/sound/cards/joystick.rst b/Documentation/sound/cards/joystick.rst index a6e468c81d02..488946fc1079 100644 --- a/Documentation/sound/cards/joystick.rst +++ b/Documentation/sound/cards/joystick.rst @@ -11,7 +11,7 @@ General First of all, you need to enable GAMEPORT support on Linux kernel for using a joystick with the ALSA driver. For the details of gameport -support, refer to Documentation/input/joystick.txt. +support, refer to Documentation/input/joydev/joystick.rst. The joystick support of ALSA drivers is different between ISA and PCI cards. In the case of ISA (PnP) cards, it's usually handled by the -- 2.14.2

2 1

[alsa-devel] [RESEND PATCH] ASoC: codecs: msm8916-wcd-digital: fix RX2 MIX1 and RX3 MIX1
by Jean-François Têtu 10 Oct '17

10 Oct '17

The kcontrol for the third input (rxN_mix1_inp3) of both RX2 and RX3 mixers are not using the correct control register. This simple patch fixes this. Signed-off-by: Jean-François Têtu <jean-francois.tetu(a)savoirfairelinux.com> --- sound/soc/codecs/msm8916-wcd-digital.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/sound/soc/codecs/msm8916-wcd-digital.c b/sound/soc/codecs/msm8916-wcd-digital.c index 66df8f810f0d..a10a724eb448 100644 --- a/sound/soc/codecs/msm8916-wcd-digital.c +++ b/sound/soc/codecs/msm8916-wcd-digital.c @@ -238,7 +238,7 @@ static const struct soc_enum rx_mix2_inp1_chain_enum = SOC_ENUM_SINGLE( static const struct soc_enum rx2_mix1_inp_enum[] = { SOC_ENUM_SINGLE(LPASS_CDC_CONN_RX2_B1_CTL, 0, 6, rx_mix1_text), SOC_ENUM_SINGLE(LPASS_CDC_CONN_RX2_B1_CTL, 3, 6, rx_mix1_text), - SOC_ENUM_SINGLE(LPASS_CDC_CONN_RX2_B1_CTL, 0, 6, rx_mix1_text), + SOC_ENUM_SINGLE(LPASS_CDC_CONN_RX2_B2_CTL, 0, 6, rx_mix1_text), }; /* RX2 MIX2 */ @@ -249,7 +249,7 @@ static const struct soc_enum rx2_mix2_inp1_chain_enum = SOC_ENUM_SINGLE( static const struct soc_enum rx3_mix1_inp_enum[] = { SOC_ENUM_SINGLE(LPASS_CDC_CONN_RX3_B1_CTL, 0, 6, rx_mix1_text), SOC_ENUM_SINGLE(LPASS_CDC_CONN_RX3_B1_CTL, 3, 6, rx_mix1_text), - SOC_ENUM_SINGLE(LPASS_CDC_CONN_RX3_B1_CTL, 0, 6, rx_mix1_text), + SOC_ENUM_SINGLE(LPASS_CDC_CONN_RX3_B2_CTL, 0, 6, rx_mix1_text), }; /* DEC */ -- 2.14.2

2 2

[alsa-devel] usb/sound: use-after-free in snd_usb_mixer_interrupt
by Andrey Konovalov 10 Oct '17

10 Oct '17

Hi! I've got the following report while fuzzing the kernel with syzkaller. On commit 8a5776a5f49812d29fe4b2d0a2d71675c3facf3f (4.14-rc4). gadgetfs: bound to dummy_udc driver usb 1-1: new full-speed USB device number 2 using dummy_hcd gadgetfs: connected gadgetfs: disconnected gadgetfs: connected usb 1-1: config 1 has an invalid interface number: 1 but max is 0 usb 1-1: config 1 has 2 interfaces, different from the descriptor's value: 1 usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 usb 1-1: too many endpoints for config 1 interface 1 altsetting 174: 131, using maximum allowed: 30 usb 1-1: config 1 interface 1 altsetting 174 has 0 endpoint descriptors, different from the interface de scriptor's value: 131 usb 1-1: config 1 interface 1 has no altsetting 0 usb 1-1: New USB device found, idVendor=0dba, idProduct=1000 usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=252 usb 1-1: SerialNumber: a gadgetfs: configuration #1 hub 1-1:1.0: USB hub found hub 1-1:1.0: config failed, can't read hub descriptor (err -22) snd-usb-audio: probe of 1-1:1.0 failed with error -22 ================================================================== BUG: KASAN: use-after-free in snd_usb_mixer_interrupt+0x604/0x6f0 Read of size 8 at addr ffff8800636f8900 by task swapper/1/0 CPU: 1 PID: 0 Comm: swapper/1 Not tainted 4.14.0-rc4-43418-g43a3f84d2109-dirty #391 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 Call Trace: <IRQ> __dump_stack lib/dump_stack.c:16 dump_stack+0x292/0x395 lib/dump_stack.c:52 print_address_description+0x78/0x280 mm/kasan/report.c:252 kasan_report_error mm/kasan/report.c:351 kasan_report+0x23d/0x350 mm/kasan/report.c:409 __asan_report_load8_noabort+0x19/0x20 mm/kasan/report.c:430 snd_usb_mixer_interrupt+0x604/0x6f0 sound/usb/mixer.c:2490 __usb_hcd_giveback_urb+0x2e0/0x650 drivers/usb/core/hcd.c:1779 usb_hcd_giveback_urb+0x337/0x420 drivers/usb/core/hcd.c:1845 dummy_timer+0xba9/0x39f0 drivers/usb/gadget/udc/dummy_hcd.c:1965 call_timer_fn+0x2a2/0x940 kernel/time/timer.c:1281 expire_timers kernel/time/timer.c:1320 __run_timers+0x87f/0xd40 kernel/time/timer.c:1620 run_timer_softirq+0x83/0x140 kernel/time/timer.c:1646 __do_softirq+0x2ee/0xc0f kernel/softirq.c:284 invoke_softirq kernel/softirq.c:364 irq_exit+0x171/0x1a0 kernel/softirq.c:405 exiting_irq ./arch/x86/include/asm/apic.h:638 smp_apic_timer_interrupt+0x2b9/0x8d0 arch/x86/kernel/apic/apic.c:1048 apic_timer_interrupt+0x9d/0xb0 </IRQ> RIP: 0010:native_safe_halt+0x6/0x10 ./arch/x86/include/asm/irqflags.h:53 RSP: 0018:ffff88006bac7b90 EFLAGS: 00000282 ORIG_RAX: ffffffffffffff10 RAX: dffffc0000000020 RBX: 1ffff1000d758f76 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff88006baa3a64 RBP: ffff88006bac7b90 R08: ffffffff813d5301 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 1ffff1000d758f82 R13: ffff88006bac7cd0 R14: ffffffff8881ecc8 R15: 0000000000000000 arch_safe_halt ./arch/x86/include/asm/paravirt.h:93 default_idle+0x127/0x690 arch/x86/kernel/process.c:341 arch_cpu_idle+0xf/0x20 arch/x86/kernel/process.c:332 default_idle_call+0x3b/0x60 kernel/sched/idle.c:98 cpuidle_idle_call kernel/sched/idle.c:156 do_idle+0x33a/0x410 kernel/sched/idle.c:246 cpu_startup_entry+0x1d/0x20 kernel/sched/idle.c:351 start_secondary+0x3de/0x500 arch/x86/kernel/smpboot.c:278 secondary_startup_64+0xa5/0xa5 arch/x86/kernel/head_64.S:235 Allocated by task 1484: save_stack_trace+0x1b/0x20 arch/x86/kernel/stacktrace.c:59 save_stack+0x43/0xd0 mm/kasan/kasan.c:447 set_track mm/kasan/kasan.c:459 kasan_kmalloc+0xad/0xe0 mm/kasan/kasan.c:551 kmem_cache_alloc_trace+0x11e/0x2d0 mm/slub.c:2772 kmalloc ./include/linux/slab.h:493 kzalloc ./include/linux/slab.h:666 snd_usb_create_mixer+0x145/0x1010 sound/usb/mixer.c:2540 create_standard_mixer_quirk+0x58/0x80 sound/usb/quirks.c:516 snd_usb_create_quirk+0x92/0x100 sound/usb/quirks.c:560 create_composite_quirk+0x1c4/0x3e0 sound/usb/quirks.c:59 snd_usb_create_quirk+0x92/0x100 sound/usb/quirks.c:560 usb_audio_probe+0x1040/0x2c10 sound/usb/card.c:618 usb_probe_interface+0x35d/0x8e0 drivers/usb/core/driver.c:361 really_probe drivers/base/dd.c:413 driver_probe_device+0x610/0xa00 drivers/base/dd.c:557 __device_attach_driver+0x230/0x290 drivers/base/dd.c:653 bus_for_each_drv+0x161/0x210 drivers/base/bus.c:463 __device_attach+0x26e/0x3d0 drivers/base/dd.c:710 device_initial_probe+0x1f/0x30 drivers/base/dd.c:757 bus_probe_device+0x1eb/0x290 drivers/base/bus.c:523 device_add+0xd0b/0x1660 drivers/base/core.c:1835 usb_set_configuration+0x104e/0x1870 drivers/usb/core/message.c:1932 generic_probe+0x73/0xe0 drivers/usb/core/generic.c:174 usb_probe_device+0xaf/0xe0 drivers/usb/core/driver.c:266 really_probe drivers/base/dd.c:413 driver_probe_device+0x610/0xa00 drivers/base/dd.c:557 __device_attach_driver+0x230/0x290 drivers/base/dd.c:653 bus_for_each_drv+0x161/0x210 drivers/base/bus.c:463 __device_attach+0x26e/0x3d0 drivers/base/dd.c:710 device_initial_probe+0x1f/0x30 drivers/base/dd.c:757 bus_probe_device+0x1eb/0x290 drivers/base/bus.c:523 device_add+0xd0b/0x1660 drivers/base/core.c:1835 usb_new_device+0x7b8/0x1020 drivers/usb/core/hub.c:2457 hub_port_connect drivers/usb/core/hub.c:4903 hub_port_connect_change drivers/usb/core/hub.c:5009 port_event drivers/usb/core/hub.c:5115 hub_event+0x194d/0x3740 drivers/usb/core/hub.c:5195 process_one_work+0xc7f/0x1db0 kernel/workqueue.c:2119 worker_thread+0x221/0x1850 kernel/workqueue.c:2253 kthread+0x3a1/0x470 kernel/kthread.c:231 ret_from_fork+0x2a/0x40 arch/x86/entry/entry_64.S:431 Freed by task 1484: save_stack_trace+0x1b/0x20 arch/x86/kernel/stacktrace.c:59 save_stack+0x43/0xd0 mm/kasan/kasan.c:447 set_track mm/kasan/kasan.c:459 kasan_slab_free+0x72/0xc0 mm/kasan/kasan.c:524 slab_free_hook mm/slub.c:1390 slab_free_freelist_hook mm/slub.c:1412 slab_free mm/slub.c:2988 kfree+0xf6/0x2f0 mm/slub.c:3919 snd_usb_mixer_free+0x11a/0x160 sound/usb/mixer.c:2244 snd_usb_mixer_dev_free+0x36/0x50 sound/usb/mixer.c:2250 __snd_device_free+0x1ff/0x380 sound/core/device.c:91 snd_device_free_all+0x8f/0xe0 sound/core/device.c:244 snd_card_do_free sound/core/init.c:461 release_card_device+0x47/0x170 sound/core/init.c:181 device_release+0x13f/0x210 drivers/base/core.c:814 kobject_cleanup lib/kobject.c:648 kobject_release lib/kobject.c:677 kref_put ./include/linux/kref.h:70 kobject_put+0x145/0x240 lib/kobject.c:694 put_device+0x25/0x30 drivers/base/core.c:1931 snd_card_free_when_closed sound/core/init.c:489 snd_card_free+0x156/0x220 sound/core/init.c:514 usb_audio_probe+0x1e36/0x2c10 sound/usb/card.c:648 usb_probe_interface+0x35d/0x8e0 drivers/usb/core/driver.c:361 really_probe drivers/base/dd.c:413 driver_probe_device+0x610/0xa00 drivers/base/dd.c:557 __device_attach_driver+0x230/0x290 drivers/base/dd.c:653 bus_for_each_drv+0x161/0x210 drivers/base/bus.c:463 __device_attach+0x26e/0x3d0 drivers/base/dd.c:710 device_initial_probe+0x1f/0x30 drivers/base/dd.c:757 bus_probe_device+0x1eb/0x290 drivers/base/bus.c:523 device_add+0xd0b/0x1660 drivers/base/core.c:1835 usb_set_configuration+0x104e/0x1870 drivers/usb/core/message.c:1932 generic_probe+0x73/0xe0 drivers/usb/core/generic.c:174 usb_probe_device+0xaf/0xe0 drivers/usb/core/driver.c:266 really_probe drivers/base/dd.c:413 driver_probe_device+0x610/0xa00 drivers/base/dd.c:557 __device_attach_driver+0x230/0x290 drivers/base/dd.c:653 bus_for_each_drv+0x161/0x210 drivers/base/bus.c:463 __device_attach+0x26e/0x3d0 drivers/base/dd.c:710 device_initial_probe+0x1f/0x30 drivers/base/dd.c:757 bus_probe_device+0x1eb/0x290 drivers/base/bus.c:523 device_add+0xd0b/0x1660 drivers/base/core.c:1835 usb_new_device+0x7b8/0x1020 drivers/usb/core/hub.c:2457 hub_port_connect drivers/usb/core/hub.c:4903 hub_port_connect_change drivers/usb/core/hub.c:5009 port_event drivers/usb/core/hub.c:5115 hub_event+0x194d/0x3740 drivers/usb/core/hub.c:5195 process_one_work+0xc7f/0x1db0 kernel/workqueue.c:2119 worker_thread+0x221/0x1850 kernel/workqueue.c:2253 kthread+0x3a1/0x470 kernel/kthread.c:231 ret_from_fork+0x2a/0x40 arch/x86/entry/entry_64.S:431 The buggy address belongs to the object at ffff8800636f8900 which belongs to the cache kmalloc-192 of size 192 The buggy address is located 0 bytes inside of 192-byte region [ffff8800636f8900, ffff8800636f89c0) The buggy address belongs to the page: page:ffffea00018dbe00 count:1 mapcount:0 mapping: (null) index:0x0 flags: 0x100000000000100(slab) raw: 0100000000000100 0000000000000000 0000000000000000 0000000180100010 raw: ffffea00018dbc00 0000000400000004 ffff88006c003380 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8800636f8800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff8800636f8880: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc >ffff8800636f8900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff8800636f8980: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ffff8800636f8a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ==================================================================

2 3

[alsa-devel] [PATCH] ALSA: seq: Add sanity check for user-space pointer delivery
by Takashi Iwai 10 Oct '17

10 Oct '17

The sequencer event may contain a user-space pointer with its SNDRV_SEQ_EXT_USRPTR bit, and we assure that its delivery is limited with non-atomic mode. Otherwise the copy_from_user() may hit the fault and cause a problem. Although the core code doesn't set such a flag (only set at snd_seq_write()), any wild driver may set it mistakenly and lead to an unexpected crash. This patch adds a sanity check of such events at the delivery core code to filter out the invalid invocation in the atomic mode. Signed-off-by: Takashi Iwai <tiwai(a)suse.de> --- sound/core/seq/seq_clientmgr.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c index 6c9cba2166d9..84759d9c54bf 100644 --- a/sound/core/seq/seq_clientmgr.c +++ b/sound/core/seq/seq_clientmgr.c @@ -802,6 +802,10 @@ static int snd_seq_deliver_event(struct snd_seq_client *client, struct snd_seq_e return -EMLINK; } + if (snd_seq_ev_is_variable(event) && + snd_BUG_ON(atomic && (event->data.ext.len & SNDRV_SEQ_EXT_USRPTR))) + return -EINVAL; + if (event->queue == SNDRV_SEQ_ADDRESS_SUBSCRIBERS || event->dest.client == SNDRV_SEQ_ADDRESS_SUBSCRIBERS) result = deliver_to_subscribers(client, event, atomic, hop); -- 2.14.2

1 0

[alsa-devel] [PATCH 1/2] ASoC: dapm: add initialization for w_param_text pointer
by Arnd Bergmann 10 Oct '17

10 Oct '17

We now allocate the array conditionally, but we always pass the pointer to the new snd_soc_dapm_free_kcontrol() function, which introduces a warning for the case that it is not initialized: sound/soc/soc-dapm.c: In function 'snd_soc_dapm_new_pcm': sound/soc/soc-dapm.c:3940:2: error: 'w_param_text' may be used uninitialized in this function [-Werror=maybe-uninitialized] As snd_soc_dapm_free_kcontrol() is global, it doesn't get inlined and gcc fails to notice that we don't actually access the array in that case, so the code is actually safe. Adding an initialization for the array pointer shuts up the warning. Fixes: 19ad683abc85 ("ASoC: dapm: Avoid creating kcontrol for params") Signed-off-by: Arnd Bergmann <arnd(a)arndb.de> --- sound/soc/soc-dapm.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c index ceec185c871f..19babdae1a06 100644 --- a/sound/soc/soc-dapm.c +++ b/sound/soc/soc-dapm.c @@ -3905,6 +3905,8 @@ int snd_soc_dapm_new_pcm(struct snd_soc_card *card, ret = -ENOMEM; goto param_fail; } + } else { + w_param_text = NULL; } dev_dbg(card->dev, "ASoC: adding %s widget\n", link_name); -- 2.9.0

2 3

[alsa-devel] [PATCH 0/2 v2] ASoC: soc-core: add missing component functions
by Kuninori Morimoto 10 Oct '17

10 Oct '17

Hi Mark These are v2 of one of "replace to component" patch set. These add missing functions which exist in "platforms" but not exist in "component". Kuninori Morimoto (3): ASoC: soc-core: add component lookup functions ASoC: soc-core: add snd_soc_add_component() ASoC: soc-core: remove unnecessary message from snd_soc_register_component() include/sound/soc.h | 7 +++++++ sound/soc/soc-core.c | 58 ++++++++++++++++++++++++++++++++++++++++++---------- 2 files changed, 54 insertions(+), 11 deletions(-) -- 1.9.1

2 4

[alsa-devel] [bug report] ASoC: Intel: Refactor common IPC/mailbox code into generic APIs
by Dan Carpenter 10 Oct '17

10 Oct '17

Hello Jin Yao, The patch a33c1ec5cf82: "ASoC: Intel: Refactor common IPC/mailbox code into generic APIs" from Apr 7, 2015, leads to the following static checker warning: sound/soc/intel/common/sst-ipc.c:242 sst_ipc_reply_find_msg() error: uninitialized symbol 'mask'. sound/soc/intel/common/sst-ipc.c 226 struct ipc_message *sst_ipc_reply_find_msg(struct sst_generic_ipc *ipc, 227 u64 header) 228 { 229 struct ipc_message *msg; 230 u64 mask; 231 232 if (ipc->ops.reply_msg_match != NULL) 233 header = ipc->ops.reply_msg_match(header, &mask); What should "mask" be initialized to if ops.reply_msg_match is NULL? 234 235 if (list_empty(&ipc->rx_list)) { 236 dev_err(ipc->dev, "error: rx list empty but received 0x%llx\n", 237 header); 238 return NULL; 239 } 240 241 list_for_each_entry(msg, &ipc->rx_list, list) { 242 if ((msg->header & mask) == header) ^^^^^^^^^^^^^^^^^^ Used uninitialized here. 243 return msg; 244 } 245 246 return NULL; 247 } regards, dan carpenter

1 0

[alsa-devel] [pull] amdgpu pre-reqs for stoney ACP audio support
by Alex Deucher 10 Oct '17

10 Oct '17

Hi Dave, Mark, This branch against Linus' master contains the 3 pre-requisite patches for Stoney ACP audio. Mark needs these patches to apply the rest of the Stoney ACP patch set on the audio side. Please pull. Thanks! The following changes since commit 68ebe3cbe786a954481d6ded0dc83f7d551640bf: Merge tag 'nfs-for-4.14-3' of git://git.linux-nfs.org/projects/trondmy/linux-nfs (2017-10-09 10:55:37 -0700) are available in the git repository at: git://people.freedesktop.org/~agd5f/linux linus-acp-prereq for you to fetch changes up to 1e4448648333a8fb7830a7a4b76c86e160a79b1e: drm/amdgpu Moving amdgpu asic types to a separate file (2017-10-09 17:54:24 -0400) ---------------------------------------------------------------- Akshu Agrawal (1): drm/amdgpu Moving amdgpu asic types to a separate file Vijendar Mukunda (2): drm/amd/amdgpu: Added asic_type as ACP DMA driver platform data ASoC: AMD: Added asic_type as ACP DMA driver platform data drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c | 2 ++ drivers/gpu/drm/amd/include/amd_shared.h | 29 ++---------------- include/drm/amd_asic_type.h | 52 ++++++++++++++++++++++++++++++++ sound/soc/amd/acp-pcm-dma.c | 8 ++--- sound/soc/amd/acp.h | 7 +++++ 5 files changed, 65 insertions(+), 33 deletions(-) create mode 100644 include/drm/amd_asic_type.h

1 0

[alsa-devel] [PATCH v2] ALSA: seq: resize buffer for overflow
by Mark Salyzyn 09 Oct '17

09 Oct '17

Can not replicate, issue discovered in fuzzing. Stack trace below. No functional or performance testing done regarding the fix. Trap at (reformatted): snd_seq_oss_readq_puts(struct seq_oss_readq *q, int dev, unsigned char *data, int len) { union evrec rec; int result; memset(&rec, 0, sizeof(rec)); rec.c[0] = SEQ_MIDIPUTC; rec.c[2] = dev; while (len-- > 0) { rec.c[1] = *data++; // data is RBX HERE 'data' pointer just passed a page boundary, so the buffer supplied was short. Caller must have been handed an ev->type equal to SNDDRV_SEQ_EVENT_SYSEX, which resulted in handing off ev->data.ext.ptr[ev->data.ext.len] buffer. Intuited that the source of the event and buffer was referenced in snd_midi_event_encode_byte() passing a larger length than the allocated buffer. BUG: unable to handle kernel paging request at ffffc900008ab000 IP: [<ffffffff82e2fc05>] snd_seq_oss_readq_puts+0xd5/0x170 sound/core/seq/oss/seq_oss_readq.c:112 PGD 1da091067 PUD 1da092067 Oops: 0000 [#1] PREEMPT SMP KASAN Dumping ftrace buffer: (ftrace buffer empty) Modules linked in: CPU: 1 PID: 3264 Comm: XXXXXXXX Hardware name: XXXXXXXXXX task: ffff8801cdd9e000 task.stack: ffff8801ce648000 RIP: 0010:[<ffffffff82e2fc05>] [<ffffffff82e2fc05>] snd_seq_oss_readq_puts+0xd5/0x170 sound/core/seq/oss/seq_oss_readq.c:112 RSP: 0018:ffff8801ce64f1c0 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffffc900008ab000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffffffff858e5780 RBP: ffff8801ce64f260 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 1ffff10039cc9df2 R12: 000000003fffffa4 R13: dffffc0000000000 R14: ffff8801ce64f238 R15: ffffc900008ab001 FS: 00007fe3d3d9e700(0000) GS:ffff8801db300000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffc900008ab000 CR3: 00000001d19b7000 CR4: 00000000001406e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Stack: 1ffff10039cc9e3b ffff8801ce64f1f8 ffff8801d0b9aa00 0000000041b58ab3 ffffffff841daf3c ffffffff82e2fb30 0000000000000286 0000000000000005 ffffffff838aa5d5 ffffffff861962c0 dffffc0000000000 ffff8801ce64f260 Call Trace: [<ffffffff82e2ebbe>] send_midi_event sound/core/seq/oss/seq_oss_midi.c:616 [inline] [<ffffffff82e2ebbe>] snd_seq_oss_midi_input+0x8ce/0xa70 sound/core/seq/oss/seq_oss_midi.c:535 [<ffffffff82e2758d>] snd_seq_oss_event_input+0x15d/0x220 sound/core/seq/oss/seq_oss_event.c:439 [<ffffffff82e0b650>] snd_seq_deliver_single_event.constprop.11+0x310/0x7c0 sound/core/seq/seq_clientmgr.c:621 [<ffffffff82e0be16>] deliver_to_subscribers sound/core/seq/seq_clientmgr.c:676 [inline] [<ffffffff82e0be16>] snd_seq_deliver_event+0x316/0x740 sound/core/seq/seq_clientmgr.c:807 [<ffffffff82e0cf9e>] snd_seq_kernel_client_dispatch+0x11e/0x150 sound/core/seq/seq_clientmgr.c:2314 [<ffffffff82e31775>] dummy_input+0x235/0x320 sound/core/seq/seq_dummy.c:104 [<ffffffff82e0b650>] snd_seq_deliver_single_event.constprop.11+0x310/0x7c0 sound/core/seq/seq_clientmgr.c:621 [<ffffffff82e0bc2d>] snd_seq_deliver_event+0x12d/0x740 sound/core/seq/seq_clientmgr.c:818 [<ffffffff82e0d0ed>] snd_seq_dispatch_event+0x11d/0x520 sound/core/seq/seq_clientmgr.c:892 [<ffffffff82e1117e>] snd_seq_check_queue.part.3+0x38e/0x510 sound/core/seq/seq_queue.c:285 [<ffffffff82e11d8d>] snd_seq_check_queue sound/core/seq/seq_queue.c:357 [inline] [<ffffffff82e11d8d>] snd_seq_enqueue_event+0x32d/0x3d0 sound/core/seq/seq_queue.c:363 [<ffffffff82e0c444>] snd_seq_client_enqueue_event+0x204/0x3e0 sound/core/seq/seq_clientmgr.c:951 [<ffffffff82e0cc55>] kernel_client_enqueue.part.10+0xb5/0xd0 sound/core/seq/seq_clientmgr.c:2251 [<ffffffff82e0cd3f>] kernel_client_enqueue sound/core/seq/seq_clientmgr.c:2241 [inline] [<ffffffff82e0cd3f>] snd_seq_kernel_client_enqueue_blocking+0xcf/0x110 sound/core/seq/seq_clientmgr.c:2279 [<ffffffff82e27f68>] insert_queue sound/core/seq/oss/seq_oss_rw.c:189 [inline] [<ffffffff82e27f68>] snd_seq_oss_write+0x538/0x850 sound/core/seq/oss/seq_oss_rw.c:148 [<ffffffff82e1fab4>] odev_write+0x64/0x90 sound/core/seq/oss/seq_oss.c:177 [<ffffffff8156ab43>] __vfs_write+0x103/0x680 fs/read_write.c:510 [<ffffffff8156ec70>] vfs_write+0x170/0x4e0 fs/read_write.c:560 [<ffffffff81572669>] SYSC_write fs/read_write.c:607 [inline] [<ffffffff81572669>] SyS_write+0xd9/0x1b0 fs/read_write.c:599 [<ffffffff838aad85>] entry_SYSCALL_64_fastpath+0x23/0xc6 Code: 4d 9a eb 4e e8 2d aa 53 fe 4c 8d 7b 01 48 89 d8 48 89 d9 48 c1 e8 03 83 e1 07 42 0f b6 04 28 38 c8 7f 08 84 c0 0f 85 80 00 00 00 <41> 0f b6 47 ff 41 83 ec 01 48 8b b5 68 ff ff ff 48 8b bd 70 ff RIP [<ffffffff82e2fc05>] snd_seq_oss_readq_puts+0xd5/0x170 sound/core/seq/oss/seq_oss_readq.c:112 RSP <ffff8801ce64f1c0> CR2: ffffc900008ab000 Signed-off-by: Mark Salyzyn <salyzyn(a)android.com> v2: removed nested locks in snd_midi_event_resize_buffer --- sound/core/seq/seq_midi_event.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/sound/core/seq/seq_midi_event.c b/sound/core/seq/seq_midi_event.c index 90bbbdbeba03..ed3206ef0cd4 100644 --- a/sound/core/seq/seq_midi_event.c +++ b/sound/core/seq/seq_midi_event.c @@ -192,8 +192,7 @@ EXPORT_SYMBOL(snd_midi_event_no_status); /* * resize buffer */ -#if 0 -int snd_midi_event_resize_buffer(struct snd_midi_event *dev, int bufsize) +static int snd_midi_event_resize_buffer(struct snd_midi_event *dev, int bufsize) { unsigned char *new_buf, *old_buf; unsigned long flags; @@ -203,16 +202,13 @@ int snd_midi_event_resize_buffer(struct snd_midi_event *dev, int bufsize) new_buf = kmalloc(bufsize, GFP_KERNEL); if (new_buf == NULL) return -ENOMEM; - spin_lock_irqsave(&dev->lock, flags); old_buf = dev->buf; dev->buf = new_buf; dev->bufsize = bufsize; reset_encode(dev); - spin_unlock_irqrestore(&dev->lock, flags); kfree(old_buf); return 0; } -#endif /* 0 */ /* * read bytes and encode to sequencer event if finished @@ -297,6 +293,8 @@ int snd_midi_event_encode_byte(struct snd_midi_event *dev, int c, } else if (dev->type == ST_SYSEX) { if (c == MIDI_CMD_COMMON_SYSEX_END || dev->read >= dev->bufsize) { + if (dev->read > dev->bufsize) + snd_midi_event_resize_buffer(dev, dev->read); ev->flags &= ~SNDRV_SEQ_EVENT_LENGTH_MASK; ev->flags |= SNDRV_SEQ_EVENT_LENGTH_VARIABLE; ev->type = SNDRV_SEQ_EVENT_SYSEX; -- 2.14.2.920.gcf0c67979c-goog

2 2

[alsa-devel] usb/sound/line6: trying to register non-static key in podhd_disconnect
by Andrey Konovalov 09 Oct '17

09 Oct '17

Hi! I've got the following report while fuzzing the kernel with syzkaller. On commit e19b205be43d11bff638cad4487008c48d21c103 (4.14-rc2). INFO: trying to register non-static key. the code is fine but needs lockdep annotation. turning off the locking correctness validator. CPU: 1 PID: 1845 Comm: kworker/1:2 Not tainted 4.14.0-rc2-42613-g1488251d1a98 #238 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 Workqueue: usb_hub_wq hub_event Call Trace: __dump_stack lib/dump_stack.c:16 dump_stack+0x292/0x395 lib/dump_stack.c:52 register_lock_class+0x6c4/0x1a00 kernel/locking/lockdep.c:769 __lock_acquire+0x27e/0x4550 kernel/locking/lockdep.c:3385 lock_acquire+0x259/0x620 kernel/locking/lockdep.c:4002 del_timer_sync+0x12c/0x280 kernel/time/timer.c:1237 podhd_disconnect+0x8c/0x160 sound/usb/line6/podhd.c:299 line6_probe+0x844/0x1310 sound/usb/line6/driver.c:783 podhd_probe+0x64/0x70 sound/usb/line6/podhd.c:474 usb_probe_interface+0x35d/0x8e0 drivers/usb/core/driver.c:361 really_probe drivers/base/dd.c:413 driver_probe_device+0x610/0xa00 drivers/base/dd.c:557 __device_attach_driver+0x230/0x290 drivers/base/dd.c:653 bus_for_each_drv+0x161/0x210 drivers/base/bus.c:463 __device_attach+0x26e/0x3d0 drivers/base/dd.c:710 device_initial_probe+0x1f/0x30 drivers/base/dd.c:757 bus_probe_device+0x1eb/0x290 drivers/base/bus.c:523 device_add+0xd0b/0x1660 drivers/base/core.c:1835 usb_set_configuration+0x104e/0x1870 drivers/usb/core/message.c:1932 generic_probe+0x73/0xe0 drivers/usb/core/generic.c:174 usb_probe_device+0xaf/0xe0 drivers/usb/core/driver.c:266 really_probe drivers/base/dd.c:413 driver_probe_device+0x610/0xa00 drivers/base/dd.c:557 __device_attach_driver+0x230/0x290 drivers/base/dd.c:653 bus_for_each_drv+0x161/0x210 drivers/base/bus.c:463 __device_attach+0x26e/0x3d0 drivers/base/dd.c:710 device_initial_probe+0x1f/0x30 drivers/base/dd.c:757 bus_probe_device+0x1eb/0x290 drivers/base/bus.c:523 device_add+0xd0b/0x1660 drivers/base/core.c:1835 usb_new_device+0x7b8/0x1020 drivers/usb/core/hub.c:2457 hub_port_connect drivers/usb/core/hub.c:4903 hub_port_connect_change drivers/usb/core/hub.c:5009 port_event drivers/usb/core/hub.c:5115 hub_event+0x194d/0x3740 drivers/usb/core/hub.c:5195 process_one_work+0xc7f/0x1db0 kernel/workqueue.c:2119 worker_thread+0x221/0x1850 kernel/workqueue.c:2253 kthread+0x3a1/0x470 kernel/kthread.c:231 ret_from_fork+0x2a/0x40 arch/x86/entry/entry_64.S:431

2 7

[alsa-devel] [PATCH] ASoC: Intel: cht_bsw_max98090: remove useless code, align with ChromeOS driver
by Pierre-Louis Bossart 09 Oct '17

09 Oct '17

Remove dead code which was missed in previous changes. This is not visible with git diff but there is a test+return on the same condition just above. Also reuse local variable instead of fetching the jack information twice. Tested on Acer R11 (cyan) Fixes: 3bbda5a38601 ('ASoC: Intel: cht_bsw_max98090_ti: Fix jack initialization') Cc: Thierry Escande <thierry.escande(a)collabora.com> Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart(a)linux.intel.com> --- sound/soc/intel/boards/cht_bsw_max98090_ti.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/sound/soc/intel/boards/cht_bsw_max98090_ti.c b/sound/soc/intel/boards/cht_bsw_max98090_ti.c index 74c047a4b05c..119da5503fee 100644 --- a/sound/soc/intel/boards/cht_bsw_max98090_ti.c +++ b/sound/soc/intel/boards/cht_bsw_max98090_ti.c @@ -219,10 +219,6 @@ static int cht_codec_init(struct snd_soc_pcm_runtime *runtime) return ret; } - - if (ctx->ts3a227e_present) - snd_soc_jack_notifier_register(jack, &cht_jack_nb); - ret = snd_soc_jack_add_gpiods(runtime->card->dev->parent, jack, ARRAY_SIZE(hs_jack_gpios), hs_jack_gpios); @@ -323,7 +319,7 @@ static int cht_max98090_headset_init(struct snd_soc_component *component) return ret; } - return ts3a227e_enable_jack_detect(component, &ctx->jack); + return ts3a227e_enable_jack_detect(component, jack); } static const struct snd_soc_ops cht_aif1_ops = { -- 2.11.0

3 2

[alsa-devel] [BUG] sound/core/seq: A possible sleep-in-atomic bug in snd_virmidi_dev_receive_event
by Jia-Ju Bai 09 Oct '17

09 Oct '17

According to seq_virmidi.c, the driver may sleep under a read spinlock. The function call path is: snd_virmidi_dev_receive_event (acquire the spinlock) snd_seq_dump_var_event copy_from_user --> may sleep This bug is found by my static analysis tool and my code review. Thanks, Jia-Ju Bai

2 1

[alsa-devel] Applied "ASoC: cygnus: Remove unnecessary active_slots check" to the asoc tree
by Mark Brown 09 Oct '17

09 Oct '17

The patch ASoC: cygnus: Remove unnecessary active_slots check has been applied to the asoc tree at git://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound.git All being well this means that it will be integrated into the linux-next tree (usually sometime in the next 24 hours) and sent to Linus during the next merge window (or sooner if it is a bug fix), however if problems are discovered then the patch may be dropped or reverted. You may get further e-mails resulting from automated or manual testing and review of the tree, please engage with people reporting problems and send followup patches addressing any issues that are reported if needed. If any updates are required or you are submitting further changes they should be sent as incremental updates against current git, existing patches will not be replaced. Please add any relevant lists and maintainers to the CCs when replying to this mail. Thanks, Mark >From 4c75968a1bbfb3f190e2e624c83929451e4730ac Mon Sep 17 00:00:00 2001 From: Christos Gkekas <chris.gekas(a)gmail.com> Date: Sun, 8 Oct 2017 19:20:30 +0100 Subject: [PATCH] ASoC: cygnus: Remove unnecessary active_slots check Variable active_slots is unsigned so checking whether it is less than zero is not necessary. Signed-off-by: Christos Gkekas <chris.gekas(a)gmail.com> Signed-off-by: Mark Brown <broonie(a)kernel.org> --- sound/soc/bcm/cygnus-ssp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sound/soc/bcm/cygnus-ssp.c b/sound/soc/bcm/cygnus-ssp.c index cd8aef8ed8a5..abafadc0b534 100644 --- a/sound/soc/bcm/cygnus-ssp.c +++ b/sound/soc/bcm/cygnus-ssp.c @@ -986,7 +986,7 @@ static int cygnus_set_dai_tdm_slot(struct snd_soc_dai *cpu_dai, active_slots = hweight32(tx_mask); - if ((active_slots < 0) || (active_slots > 16)) + if (active_slots > 16) return -EINVAL; /* Slot value must be even */ -- 2.14.1

1 0

[alsa-devel] [PATCH] ASoC: img-parallel-out: Check pm_runtime_get_sync return code
by Ed Blake 09 Oct '17

09 Oct '17

Check the the pm_runtime_get_sync return code and return if an error. Signed-off-by: Ed Blake <ed.blake(a)sondrel.com> --- sound/soc/img/img-parallel-out.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/sound/soc/img/img-parallel-out.c b/sound/soc/img/img-parallel-out.c index 2fc8a6372206..acc005217be0 100644 --- a/sound/soc/img/img-parallel-out.c +++ b/sound/soc/img/img-parallel-out.c @@ -153,6 +153,7 @@ static int img_prl_out_set_fmt(struct snd_soc_dai *dai, unsigned int fmt) { struct img_prl_out *prl = snd_soc_dai_get_drvdata(dai); u32 reg, control_set = 0; + int ret; switch (fmt & SND_SOC_DAIFMT_INV_MASK) { case SND_SOC_DAIFMT_NB_NF: @@ -164,7 +165,10 @@ static int img_prl_out_set_fmt(struct snd_soc_dai *dai, unsigned int fmt) return -EINVAL; } - pm_runtime_get_sync(prl->dev); + ret = pm_runtime_get_sync(prl->dev); + if (ret < 0) + return ret; + reg = img_prl_out_readl(prl, IMG_PRL_OUT_CTL); reg = (reg & ~IMG_PRL_OUT_CTL_EDGE_MASK) | control_set; img_prl_out_writel(prl, reg, IMG_PRL_OUT_CTL); -- 2.11.0

2 1

[alsa-devel] [PATCH v2 0/2] ASoC: img-i2s-in: Add power management
by Ed Blake 09 Oct '17

09 Oct '17

This patch set adds power managment to the img-i2s-in driver. The first patch adds system PM suspend / resume handling and the second patch adds runtime PM. Changes in v2: - Changed from ASoC specific pm callbacks to device ones - Errors returned from pm_runtime_get_sync are now handled Ed Blake (2): ASoC: img-i2s-in: Add suspend / resume handling ASoC: img-i2s-in: Add runtime PM sound/soc/img/img-i2s-in.c | 130 ++++++++++++++++++++++++++++++++++++++++----- 1 file changed, 118 insertions(+), 12 deletions(-) -- 2.11.0

2 4

[alsa-devel] [PATCH v2 0/2] ASoC: img-i2s-out: Add power management
by Ed Blake 09 Oct '17

09 Oct '17

This patch set adds power managment to the img-i2s-out driver. The first patch adds system PM suspend / resume handling and the second patch adds control of the sys clock to runtime PM. Changes in v2: - Changed from ASoC specific pm callbacks to device ones - Errors returned from pm_runtime_get_sync are now handled Ed Blake (2): ASoC: img-i2s-out: Add suspend / resume handling ASoC: img-i2s-out: Add control of sys clock to runtime PM sound/soc/img/img-i2s-out.c | 108 ++++++++++++++++++++++++++++++++++---------- 1 file changed, 85 insertions(+), 23 deletions(-) -- 2.11.0

2 4

[alsa-devel] [PATCH v2 0/2] ASoC: img-spdif-in: Add power management
by Ed Blake 09 Oct '17

09 Oct '17

This patch set adds power managment to the img-spdif-in driver. The first patch adds system PM suspend / resume handling and the second patch adds runtime PM. Changes in v2: - Changed from ASoC specific pm callbacks to device ones Ed Blake (2): ASoC: img-spdif-in: Add suspend / resume handling ASoC: img-spdif-in: Add runtime PM sound/soc/img/img-spdif-in.c | 110 ++++++++++++++++++++++++++++++++++++++----- 1 file changed, 99 insertions(+), 11 deletions(-) -- 2.11.0

2 4

[alsa-devel] [PATCH v2 0/2] dma: img-spdif-out: Add power management
by Ed Blake 09 Oct '17

09 Oct '17

This patch set adds power managment to the img-spdif-out driver. The first patch adds system PM suspend / resume handling and the second patch adds control of the sys clock to runtime PM. Changes in v2: - Changed from ASoC specific pm callbacks to device ones Ed Blake (2): ASoC: img-spdif-out: Add suspend / resume handling ASoC: img-spdif-out: Add control of sys clock to runtime PM sound/soc/img/img-spdif-out.c | 73 +++++++++++++++++++++++++++++++++++-------- 1 file changed, 60 insertions(+), 13 deletions(-) -- 2.11.0

2 3

[alsa-devel] [PATCH 0/3] dma: img-spdif-out: Add power management
by Ed Blake 09 Oct '17

09 Oct '17

This patch set adds power managment to the img-spdif-out driver. The first patch renames existing 'suspend' and 'resume' functions to 'runtime_suspend' and 'runtime_resume', which is what they actually are, the second patch adds system PM suspend / resume handling and the third patch adds control of the sys clock to runtime PM. Ed Blake (3): ASoC: img-spdif-out: Rename suspend / resume funcs ASoC: img-spdif-out: Add suspend / resume handling ASoC: img-spdif-out: Add control of sys clock to runtime PM sound/soc/img/img-spdif-out.c | 89 +++++++++++++++++++++++++++++++++---------- 1 file changed, 68 insertions(+), 21 deletions(-) -- 1.9.1

2 7

[alsa-devel] [PATCH] sound/soc: fix typos in Kconfig (trivial)
by Nik Nyby 09 Oct '17

09 Oct '17

This fixes a few typos in the snd_designware description. Signed-off-by: Nik Nyby <nikolas(a)gnu.org> --- sound/soc/dwc/Kconfig | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/sound/soc/dwc/Kconfig b/sound/soc/dwc/Kconfig index c6fd95fa5ca6..aa0c6ec4d93c 100644 --- a/sound/soc/dwc/Kconfig +++ b/sound/soc/dwc/Kconfig @@ -4,8 +4,8 @@ config SND_DESIGNWARE_I2S select SND_SOC_GENERIC_DMAENGINE_PCM help Say Y or M if you want to add support for I2S driver for - Synopsys desigwnware I2S device. The device supports upto - maximum of 8 channels each for play and record. + Synopsys designware I2S device. The device supports up to + a maximum of 8 channels each for play and record. config SND_DESIGNWARE_PCM bool "PCM PIO extension for I2S driver" -- 2.14.2

2 2

[alsa-devel] [PATCH v3] ASoC: dapm: Avoid creating kcontrol for params
by yesanishhere＠gmail.com 09 Oct '17

09 Oct '17

From: anish kumar <yesanishhere(a)gmail.com> Currently in codec to codec dai link if there are multiple params defined then dapm can use created kcontrol to decide which param to apply at runtime. However, in case there is only single param configuration then there is no point in creating the kcontrol and also there is no point in allocating memory for kcontrol. In the snd_soc_dapm_new_pcm function, there is memory allocation happening for kcontrol which is later used or not used based on num_param. It is better to not allocate memory when there is only a single configuration. This change is to remedy that anomaly. Signed-off-by: anish kumar <yesanishhere(a)gmail.com> --- Changes in this version: - Fixed the coding guideline comment from charles. Changes in v2: - Review comments from charles to move common function of error handling in seperate function. Changes in v1: - Included the review comments from charles regarding releasing memory in error path. sound/soc/soc-dapm.c | 140 +++++++++++++++++++++++++++++++-------------------- 1 file changed, 86 insertions(+), 54 deletions(-) diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c index d55cac6..dbf3838 100644 --- a/sound/soc/soc-dapm.c +++ b/sound/soc/soc-dapm.c @@ -3778,18 +3778,27 @@ static int snd_soc_dapm_dai_link_put(struct snd_kcontrol *kcontrol, return 0; } -int snd_soc_dapm_new_pcm(struct snd_soc_card *card, - const struct snd_soc_pcm_stream *params, - unsigned int num_params, - struct snd_soc_dapm_widget *source, - struct snd_soc_dapm_widget *sink) +void +snd_soc_dapm_free_kcontrol(struct snd_soc_card *card, + unsigned long *private_value, + int num_params, + const char **w_param_text) +{ + int count; + + devm_kfree(card->dev, (void *)*private_value); + for (count = 0 ; count < num_params; count++) + devm_kfree(card->dev, (void *)w_param_text[count]); + devm_kfree(card->dev, w_param_text); +} + +static struct snd_kcontrol_new * +snd_soc_dapm_alloc_kcontrol(struct snd_soc_card *card, + char *link_name, + const struct snd_soc_pcm_stream *params, + int num_params, const char **w_param_text, + unsigned long *private_value) { - struct snd_soc_dapm_widget template; - struct snd_soc_dapm_widget *w; - char *link_name; - int ret, count; - unsigned long private_value; - const char **w_param_text; struct soc_enum w_param_enum[] = { SOC_ENUM_SINGLE(0, 0, 0, NULL), }; @@ -3798,19 +3807,9 @@ int snd_soc_dapm_new_pcm(struct snd_soc_card *card, snd_soc_dapm_dai_link_get, snd_soc_dapm_dai_link_put), }; + struct snd_kcontrol_new *kcontrol_news; const struct snd_soc_pcm_stream *config = params; - - w_param_text = devm_kcalloc(card->dev, num_params, - sizeof(char *), GFP_KERNEL); - if (!w_param_text) - return -ENOMEM; - - link_name = devm_kasprintf(card->dev, GFP_KERNEL, "%s-%s", - source->name, sink->name); - if (!link_name) { - ret = -ENOMEM; - goto outfree_w_param; - } + int count; for (count = 0 ; count < num_params; count++) { if (!config->stream_name) { @@ -3827,47 +3826,86 @@ int snd_soc_dapm_new_pcm(struct snd_soc_card *card, strlen(config->stream_name) + 1, GFP_KERNEL); } - if (!w_param_text[count]) { - ret = -ENOMEM; - goto outfree_link_name; - } + if (!w_param_text[count]) + goto outfree_w_param; config++; } + w_param_enum[0].items = num_params; w_param_enum[0].texts = w_param_text; - memset(&template, 0, sizeof(template)); - template.reg = SND_SOC_NOPM; - template.id = snd_soc_dapm_dai_link; - template.name = link_name; - template.event = snd_soc_dai_link_event; - template.event_flags = SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_POST_PMU | - SND_SOC_DAPM_PRE_PMD; - template.num_kcontrols = 1; - /* duplicate w_param_enum on heap so that memory persists */ - private_value = + *private_value = (unsigned long) devm_kmemdup(card->dev, (void *)(kcontrol_dai_link[0].private_value), sizeof(struct soc_enum), GFP_KERNEL); - if (!private_value) { + if (!*private_value) { dev_err(card->dev, "ASoC: Failed to create control for %s widget\n", link_name); - ret = -ENOMEM; - goto outfree_link_name; + goto outfree_w_param; } - kcontrol_dai_link[0].private_value = private_value; + kcontrol_dai_link[0].private_value = *private_value; /* duplicate kcontrol_dai_link on heap so that memory persists */ - template.kcontrol_news = - devm_kmemdup(card->dev, &kcontrol_dai_link[0], + kcontrol_news = devm_kmemdup(card->dev, &kcontrol_dai_link[0], sizeof(struct snd_kcontrol_new), GFP_KERNEL); - if (!template.kcontrol_news) { + if (!kcontrol_news) { dev_err(card->dev, "ASoC: Failed to create control for %s widget\n", link_name); - ret = -ENOMEM; - goto outfree_private_value; + goto outfree_w_param; } + return kcontrol_news; +outfree_w_param: + snd_soc_dapm_free_kcontrol(card, private_value, num_params, w_param_text); + return NULL; +} + +int snd_soc_dapm_new_pcm(struct snd_soc_card *card, + const struct snd_soc_pcm_stream *params, + unsigned int num_params, + struct snd_soc_dapm_widget *source, + struct snd_soc_dapm_widget *sink) +{ + struct snd_soc_dapm_widget template; + struct snd_soc_dapm_widget *w; + const char **w_param_text; + unsigned long private_value; + char *link_name; + int ret; + + link_name = devm_kasprintf(card->dev, GFP_KERNEL, "%s-%s", + source->name, sink->name); + if (!link_name) + return -ENOMEM; + + memset(&template, 0, sizeof(template)); + template.reg = SND_SOC_NOPM; + template.id = snd_soc_dapm_dai_link; + template.name = link_name; + template.event = snd_soc_dai_link_event; + template.event_flags = SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_POST_PMU | + SND_SOC_DAPM_PRE_PMD; + template.kcontrol_news = NULL; + + /* allocate memory for control, only in case of multiple configs */ + if (num_params > 1) { + w_param_text = devm_kcalloc(card->dev, num_params, + sizeof(char *), GFP_KERNEL); + if (!w_param_text) { + ret = -ENOMEM; + goto param_fail; + } + + template.num_kcontrols = 1; + template.kcontrol_news = + snd_soc_dapm_alloc_kcontrol(card, + link_name, params, num_params, + w_param_text, &private_value); + if (!template.kcontrol_news) { + ret = -ENOMEM; + goto param_fail; + } + } dev_dbg(card->dev, "ASoC: adding %s widget\n", link_name); w = snd_soc_dapm_new_control_unlocked(&card->dapm, &template); @@ -3899,15 +3937,9 @@ int snd_soc_dapm_new_pcm(struct snd_soc_card *card, devm_kfree(card->dev, w); outfree_kcontrol_news: devm_kfree(card->dev, (void *)template.kcontrol_news); -outfree_private_value: - devm_kfree(card->dev, (void *)private_value); -outfree_link_name: + snd_soc_dapm_free_kcontrol(card, &private_value, num_params, w_param_text); +param_fail: devm_kfree(card->dev, link_name); - for (count = 0 ; count < num_params; count++) - devm_kfree(card->dev, (void *)w_param_text[count]); -outfree_w_param: - devm_kfree(card->dev, w_param_text); - return ret; } -- 2.5.4 (Apple Git-61)

4 5

[alsa-devel] [PATCH] sound/pci/riptide or drivers/base/firmware: Fix a possible sleep-in-atomic bug
by Jia-Ju Bai 09 Oct '17

09 Oct '17

The riptide driver may sleep under a spinlock, and the function call path is: snd_riptide_prepare (acquire the spinlock) setsampleformat sendcmd riptide_reset try_to_load_firmware request_firmware _request_firmware (drivers/base/firmware_class.c) _request_firmware_prepare kzalloc(GFP_KERNEL) --> may sleep To fix it, GFP_KERNEL is replaced with GFP_ATOMIC in _request_firmware_prepare. This bug is found by my static analysis tool and my code review. Signed-off-by: Jia-Ju Bai <baijiaju1990(a)163.com> --- drivers/base/firmware_class.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/base/firmware_class.c b/drivers/base/firmware_class.c index 4b57cf5..d89f676 100644 --- a/drivers/base/firmware_class.c +++ b/drivers/base/firmware_class.c @@ -1138,7 +1138,7 @@ static inline void kill_pending_fw_fallback_reqs(bool only_kill_custom) { } struct firmware_buf *buf; int ret; - *firmware_p = firmware = kzalloc(sizeof(*firmware), GFP_KERNEL); + *firmware_p = firmware = kzalloc(sizeof(*firmware), GFP_ATOMIC); if (!firmware) { dev_err(device, "%s: kmalloc(struct firmware) failed\n", __func__); -- 1.7.9.5

2 2

[alsa-devel] [PATCH] opl3: Fix a possible sleep-in-atomic bug in snd_opl3_find_patch
by Jia-Ju Bai 09 Oct '17

09 Oct '17

The driver may sleep under a spinlock, and the function call path is: snd_opl3_note_on (acquire the spinlock) snd_opl3_find_patch kzalloc(GFP_KERNEL) --> may sleep To fix it, GFP_KERNEL is replaced with GFP_ATOMIC. This bug is found by my static analysis tool and my code review. Signed-off-by: Jia-Ju Bai <baijiaju1990(a)163.com> --- sound/drivers/opl3/opl3_synth.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sound/drivers/opl3/opl3_synth.c b/sound/drivers/opl3/opl3_synth.c index ddcc1a3..2e1cb2b 100644 --- a/sound/drivers/opl3/opl3_synth.c +++ b/sound/drivers/opl3/opl3_synth.c @@ -325,7 +325,7 @@ struct fm_patch *snd_opl3_find_patch(struct snd_opl3 *opl3, int prog, int bank, if (!create_patch) return NULL; - patch = kzalloc(sizeof(*patch), GFP_KERNEL); + patch = kzalloc(sizeof(*patch), GFP_ATOMIC); if (!patch) return NULL; patch->prog = prog; -- 1.7.9.5

2 2

[alsa-devel] [PATCH] ASoC: cygnus: Remove unnecessary active_slots check
by Christos Gkekas 08 Oct '17

08 Oct '17

Variable active_slots is unsigned so checking whether it is less than zero is not necessary. Signed-off-by: Christos Gkekas <chris.gekas(a)gmail.com> --- sound/soc/bcm/cygnus-ssp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sound/soc/bcm/cygnus-ssp.c b/sound/soc/bcm/cygnus-ssp.c index 15c438f..cb46128 100644 --- a/sound/soc/bcm/cygnus-ssp.c +++ b/sound/soc/bcm/cygnus-ssp.c @@ -998,7 +998,7 @@ static int cygnus_set_dai_tdm_slot(struct snd_soc_dai *cpu_dai, active_slots = hweight32(tx_mask); - if ((active_slots < 0) || (active_slots > 16)) + if (active_slots > 16) return -EINVAL; /* Slot value must be even */ -- 2.7.4

1 0

[alsa-devel] [BUG] haswell: A possible sleep-in-atomic bug in hsw_irq_thread
by Jia-Ju Bai 08 Oct '17

08 Oct '17

According to sst-haswell-ipc.c, the driver may sleep under a spinlock, and the function call path is: hsw_irq_thread (acquire the spinlock) hsw_process_notification hsw_log_message mutex_lock --> may sleep This bug is found by my static analysis tool and my code review. Thanks, Jia-Ju Bai

1 0

[alsa-devel] [PATCH] ALSA: seq: resize buffer for overflow
by Mark Salyzyn 06 Oct '17

06 Oct '17

Can not replicate, issue discovered in fuzzing. Stack trace below. No functional or performance testing done regarding the fix. Trap at (reformatted): snd_seq_oss_readq_puts(struct seq_oss_readq *q, int dev, unsigned char *data, int len) { union evrec rec; int result; memset(&rec, 0, sizeof(rec)); rec.c[0] = SEQ_MIDIPUTC; rec.c[2] = dev; while (len-- > 0) { rec.c[1] = *data++; // data is RBX HERE 'data' pointer just passed a page boundary, so the buffer supplied was short. Caller must have been handed an ev->type equal to SNDDRV_SEQ_EVENT_SYSEX, which resulted in handing off ev->data.ext.ptr[ev->data.ext.len] buffer. Intuited that the source of the event and buffer was referenced in snd_midi_event_encode_byte() passing a larger length than the allocated buffer. BUG: unable to handle kernel paging request at ffffc900008ab000 IP: [<ffffffff82e2fc05>] snd_seq_oss_readq_puts+0xd5/0x170 sound/core/seq/oss/seq_oss_readq.c:112 PGD 1da091067 PUD 1da092067 Oops: 0000 [#1] PREEMPT SMP KASAN Dumping ftrace buffer: (ftrace buffer empty) Modules linked in: CPU: 1 PID: 3264 Comm: XXXXXXXX Hardware name: XXXXXXXXXX task: ffff8801cdd9e000 task.stack: ffff8801ce648000 RIP: 0010:[<ffffffff82e2fc05>] [<ffffffff82e2fc05>] snd_seq_oss_readq_puts+0xd5/0x170 sound/core/seq/oss/seq_oss_readq.c:112 RSP: 0018:ffff8801ce64f1c0 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffffc900008ab000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffffffff858e5780 RBP: ffff8801ce64f260 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 1ffff10039cc9df2 R12: 000000003fffffa4 R13: dffffc0000000000 R14: ffff8801ce64f238 R15: ffffc900008ab001 FS: 00007fe3d3d9e700(0000) GS:ffff8801db300000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffc900008ab000 CR3: 00000001d19b7000 CR4: 00000000001406e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Stack: 1ffff10039cc9e3b ffff8801ce64f1f8 ffff8801d0b9aa00 0000000041b58ab3 ffffffff841daf3c ffffffff82e2fb30 0000000000000286 0000000000000005 ffffffff838aa5d5 ffffffff861962c0 dffffc0000000000 ffff8801ce64f260 Call Trace: [<ffffffff82e2ebbe>] send_midi_event sound/core/seq/oss/seq_oss_midi.c:616 [inline] [<ffffffff82e2ebbe>] snd_seq_oss_midi_input+0x8ce/0xa70 sound/core/seq/oss/seq_oss_midi.c:535 [<ffffffff82e2758d>] snd_seq_oss_event_input+0x15d/0x220 sound/core/seq/oss/seq_oss_event.c:439 [<ffffffff82e0b650>] snd_seq_deliver_single_event.constprop.11+0x310/0x7c0 sound/core/seq/seq_clientmgr.c:621 [<ffffffff82e0be16>] deliver_to_subscribers sound/core/seq/seq_clientmgr.c:676 [inline] [<ffffffff82e0be16>] snd_seq_deliver_event+0x316/0x740 sound/core/seq/seq_clientmgr.c:807 [<ffffffff82e0cf9e>] snd_seq_kernel_client_dispatch+0x11e/0x150 sound/core/seq/seq_clientmgr.c:2314 [<ffffffff82e31775>] dummy_input+0x235/0x320 sound/core/seq/seq_dummy.c:104 [<ffffffff82e0b650>] snd_seq_deliver_single_event.constprop.11+0x310/0x7c0 sound/core/seq/seq_clientmgr.c:621 [<ffffffff82e0bc2d>] snd_seq_deliver_event+0x12d/0x740 sound/core/seq/seq_clientmgr.c:818 [<ffffffff82e0d0ed>] snd_seq_dispatch_event+0x11d/0x520 sound/core/seq/seq_clientmgr.c:892 [<ffffffff82e1117e>] snd_seq_check_queue.part.3+0x38e/0x510 sound/core/seq/seq_queue.c:285 [<ffffffff82e11d8d>] snd_seq_check_queue sound/core/seq/seq_queue.c:357 [inline] [<ffffffff82e11d8d>] snd_seq_enqueue_event+0x32d/0x3d0 sound/core/seq/seq_queue.c:363 [<ffffffff82e0c444>] snd_seq_client_enqueue_event+0x204/0x3e0 sound/core/seq/seq_clientmgr.c:951 [<ffffffff82e0cc55>] kernel_client_enqueue.part.10+0xb5/0xd0 sound/core/seq/seq_clientmgr.c:2251 [<ffffffff82e0cd3f>] kernel_client_enqueue sound/core/seq/seq_clientmgr.c:2241 [inline] [<ffffffff82e0cd3f>] snd_seq_kernel_client_enqueue_blocking+0xcf/0x110 sound/core/seq/seq_clientmgr.c:2279 [<ffffffff82e27f68>] insert_queue sound/core/seq/oss/seq_oss_rw.c:189 [inline] [<ffffffff82e27f68>] snd_seq_oss_write+0x538/0x850 sound/core/seq/oss/seq_oss_rw.c:148 [<ffffffff82e1fab4>] odev_write+0x64/0x90 sound/core/seq/oss/seq_oss.c:177 [<ffffffff8156ab43>] __vfs_write+0x103/0x680 fs/read_write.c:510 [<ffffffff8156ec70>] vfs_write+0x170/0x4e0 fs/read_write.c:560 [<ffffffff81572669>] SYSC_write fs/read_write.c:607 [inline] [<ffffffff81572669>] SyS_write+0xd9/0x1b0 fs/read_write.c:599 [<ffffffff838aad85>] entry_SYSCALL_64_fastpath+0x23/0xc6 Code: 4d 9a eb 4e e8 2d aa 53 fe 4c 8d 7b 01 48 89 d8 48 89 d9 48 c1 e8 03 83 e1 07 42 0f b6 04 28 38 c8 7f 08 84 c0 0f 85 80 00 00 00 <41> 0f b6 47 ff 41 83 ec 01 48 8b b5 68 ff ff ff 48 8b bd 70 ff RIP [<ffffffff82e2fc05>] snd_seq_oss_readq_puts+0xd5/0x170 sound/core/seq/oss/seq_oss_readq.c:112 RSP <ffff8801ce64f1c0> CR2: ffffc900008ab000 Signed-off-by: Mark Salyzyn <salyzyn(a)android.com> --- sound/core/seq/seq_midi_event.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/sound/core/seq/seq_midi_event.c b/sound/core/seq/seq_midi_event.c index 90bbbdbeba03..cbc501fd47c2 100644 --- a/sound/core/seq/seq_midi_event.c +++ b/sound/core/seq/seq_midi_event.c @@ -192,8 +192,7 @@ EXPORT_SYMBOL(snd_midi_event_no_status); /* * resize buffer */ -#if 0 -int snd_midi_event_resize_buffer(struct snd_midi_event *dev, int bufsize) +static int snd_midi_event_resize_buffer(struct snd_midi_event *dev, int bufsize) { unsigned char *new_buf, *old_buf; unsigned long flags; @@ -212,7 +211,6 @@ int snd_midi_event_resize_buffer(struct snd_midi_event *dev, int bufsize) kfree(old_buf); return 0; } -#endif /* 0 */ /* * read bytes and encode to sequencer event if finished @@ -297,6 +295,8 @@ int snd_midi_event_encode_byte(struct snd_midi_event *dev, int c, } else if (dev->type == ST_SYSEX) { if (c == MIDI_CMD_COMMON_SYSEX_END || dev->read >= dev->bufsize) { + if (dev->read > dev->bufsize) + snd_midi_event_resize_buffer(dev, dev->read); ev->flags &= ~SNDRV_SEQ_EVENT_LENGTH_MASK; ev->flags |= SNDRV_SEQ_EVENT_LENGTH_VARIABLE; ev->type = SNDRV_SEQ_EVENT_SYSEX; -- 2.14.2.920.gcf0c67979c-goog

1 0

Re: [alsa-devel] [PATCH] alsactl: Move systemd unit start-up from basic.target to sound.target
by Takashi Iwai 06 Oct '17

06 Oct '17

On Tue, 26 Sep 2017 20:36:12 +0200, Chris Mayo wrote: > > Ensures soundcard is ready before restoring state. > > sound.target added to systemd in v18: > https://cgit.freedesktop.org/systemd/systemd/commit/?id=88dfa2938af > > Simplify dependencies: > - After=alsa-state.service is not needed because both units test for > @daemonswitch@ with opposite outcomes. > > - After=sysinit.target is automatically added by systemd. > > First proposed by Tom Yan. > > Signed-off-by: Chris Mayo <aklhfex(a)gmail.com> > --- > > I need this because my Sound Blaster Titanium is not ready by the time > basic.target is reached. > > It was proposed last year by Tom Yan but looks like it didn't get in > because requested config checks and documentation didn't materialise. > https://www.spinics.net/lists/alsa-devel/msg45537.html > > I've added those (PKG_CHECK_MODULES outputs a message at configure time). > > I've left ConditionPathExistsGlob=/dev/snd/control* in > alsa-restore.service because although it would normally be started by the > udev rule and sound.target there's no guarantee that is how it was started. Thanks, this looks like a sensitive change. Applied now. Takashi

1 0

[alsa-devel] [PATCH] ALSA: usb-audio: Add sample rate quirk for Plantronics P610
by Kai-Heng Feng 06 Oct '17

06 Oct '17

Like other Plantronics devices, P610 does not support sample rate reading. Apply sample rate quirk to it. BugLink: https://bugs.launchpad.net/bugs/1719853 Signed-off-by: Kai-Heng Feng <kai.heng.feng(a)canonical.com> --- sound/usb/quirks.c | 1 + 1 file changed, 1 insertion(+) diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c index b8cb57aeec77..9ddaae3784f5 100644 --- a/sound/usb/quirks.c +++ b/sound/usb/quirks.c @@ -1138,6 +1138,7 @@ bool snd_usb_get_sample_rate_quirk(struct snd_usb_audio *chip) case USB_ID(0x047F, 0x0415): /* Plantronics BT-300 */ case USB_ID(0x047F, 0xAA05): /* Plantronics DA45 */ case USB_ID(0x047F, 0xC022): /* Plantronics C310 */ + case USB_ID(0x047F, 0xC02F): /* Plantronics P610 */ case USB_ID(0x047F, 0xC036): /* Plantronics C520-M */ case USB_ID(0x04D8, 0xFEEA): /* Benchmark DAC1 Pre */ case USB_ID(0x0556, 0x0014): /* Phoenix Audio TMX320VC */ -- 2.14.1

2 3

[alsa-devel] [asoc:topic/dapm 4/4] sound//soc/soc-dapm.c:3940:2: warning: 'w_param_text' may be used uninitialized in this function
by kbuild test robot 05 Oct '17

05 Oct '17

tree: https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound.git topic/dapm head: 19ad683abc8534cd755403381c73c0ddce7b9f6d commit: 19ad683abc8534cd755403381c73c0ddce7b9f6d [4/4] ASoC: dapm: Avoid creating kcontrol for params config: i386-randconfig-x079-201740 (attached as .config) compiler: gcc-6 (Debian 6.2.0-3) 6.2.0 20160901 reproduce: git checkout 19ad683abc8534cd755403381c73c0ddce7b9f6d # save the attached .config to linux build tree make ARCH=i386 Note: it may well be a FALSE warning. FWIW you are at least aware of it now. http://gcc.gnu.org/wiki/Better_Uninitialized_Warnings All warnings (new ones prefixed by >>): sound//soc/soc-dapm.c: In function 'snd_soc_dapm_new_pcm': >> sound//soc/soc-dapm.c:3940:2: warning: 'w_param_text' may be used uninitialized in this function [-Wmaybe-uninitialized] snd_soc_dapm_free_kcontrol(card, &private_value, num_params, w_param_text); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ vim +/w_param_text +3940 sound//soc/soc-dapm.c 3862 3863 int snd_soc_dapm_new_pcm(struct snd_soc_card *card, 3864 const struct snd_soc_pcm_stream *params, 3865 unsigned int num_params, 3866 struct snd_soc_dapm_widget *source, 3867 struct snd_soc_dapm_widget *sink) 3868 { 3869 struct snd_soc_dapm_widget template; 3870 struct snd_soc_dapm_widget *w; 3871 const char **w_param_text; 3872 unsigned long private_value; 3873 char *link_name; 3874 int ret; 3875 3876 link_name = devm_kasprintf(card->dev, GFP_KERNEL, "%s-%s", 3877 source->name, sink->name); 3878 if (!link_name) 3879 return -ENOMEM; 3880 3881 memset(&template, 0, sizeof(template)); 3882 template.reg = SND_SOC_NOPM; 3883 template.id = snd_soc_dapm_dai_link; 3884 template.name = link_name; 3885 template.event = snd_soc_dai_link_event; 3886 template.event_flags = SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_POST_PMU | 3887 SND_SOC_DAPM_PRE_PMD; 3888 template.kcontrol_news = NULL; 3889 3890 /* allocate memory for control, only in case of multiple configs */ 3891 if (num_params > 1) { 3892 w_param_text = devm_kcalloc(card->dev, num_params, 3893 sizeof(char *), GFP_KERNEL); 3894 if (!w_param_text) { 3895 ret = -ENOMEM; 3896 goto param_fail; 3897 } 3898 3899 template.num_kcontrols = 1; 3900 template.kcontrol_news = 3901 snd_soc_dapm_alloc_kcontrol(card, 3902 link_name, params, num_params, 3903 w_param_text, &private_value); 3904 if (!template.kcontrol_news) { 3905 ret = -ENOMEM; 3906 goto param_fail; 3907 } 3908 } 3909 dev_dbg(card->dev, "ASoC: adding %s widget\n", link_name); 3910 3911 w = snd_soc_dapm_new_control_unlocked(&card->dapm, &template); 3912 if (IS_ERR(w)) { 3913 ret = PTR_ERR(w); 3914 /* Do not nag about probe deferrals */ 3915 if (ret != -EPROBE_DEFER) 3916 dev_err(card->dev, 3917 "ASoC: Failed to create %s widget (%d)\n", 3918 link_name, ret); 3919 goto outfree_kcontrol_news; 3920 } 3921 if (!w) { 3922 dev_err(card->dev, "ASoC: Failed to create %s widget\n", 3923 link_name); 3924 ret = -ENOMEM; 3925 goto outfree_kcontrol_news; 3926 } 3927 3928 w->params = params; 3929 w->num_params = num_params; 3930 3931 ret = snd_soc_dapm_add_path(&card->dapm, source, w, NULL, NULL); 3932 if (ret) 3933 goto outfree_w; 3934 return snd_soc_dapm_add_path(&card->dapm, w, sink, NULL, NULL); 3935 3936 outfree_w: 3937 devm_kfree(card->dev, w); 3938 outfree_kcontrol_news: 3939 devm_kfree(card->dev, (void *)template.kcontrol_news); > 3940 snd_soc_dapm_free_kcontrol(card, &private_value, num_params, w_param_text); 3941 param_fail: 3942 devm_kfree(card->dev, link_name); 3943 return ret; 3944 } 3945 --- 0-DAY kernel test infrastructure Open Source Technology Center https://lists.01.org/pipermail/kbuild-all Intel Corporation

1 0

[alsa-devel] [PATCH 00/18] use ARRAY_SIZE macro
by Jérémy Lefaure 05 Oct '17

05 Oct '17

Hi everyone, Using ARRAY_SIZE improves the code readability. I used coccinelle (I made a change to the array_size.cocci file [1]) to find several places where ARRAY_SIZE could be used instead of other macros or sizeof division. I tried to divide the changes into a patch per subsystem (excepted for staging). If one of the patch should be split into several patches, let me know. In order to reduce the size of the To: and Cc: lines, each patch of the series is sent only to the maintainers and lists concerned by the patch. This cover letter is sent to every list concerned by this series. This series is based on linux-next next-20170929. Each patch has been tested by building the relevant files with W=1. This series contains the following patches: [PATCH 01/18] sound: use ARRAY_SIZE [PATCH 02/18] tracing/filter: use ARRAY_SIZE [PATCH 03/18] media: use ARRAY_SIZE [PATCH 04/18] IB/mlx5: Use ARRAY_SIZE [PATCH 05/18] net: use ARRAY_SIZE [PATCH 06/18] drm: use ARRAY_SIZE [PATCH 07/18] scsi: bfa: use ARRAY_SIZE [PATCH 08/18] ecryptfs: use ARRAY_SIZE [PATCH 09/18] nfsd: use ARRAY_SIZE [PATCH 10/18] orangefs: use ARRAY_SIZE [PATCH 11/18] dm space map metadata: use ARRAY_SIZE [PATCH 12/18] x86: use ARRAY_SIZE [PATCH 13/18] tpm: use ARRAY_SIZE [PATCH 14/18] ipmi: use ARRAY_SIZE [PATCH 15/18] acpi: use ARRAY_SIZE [PATCH 16/18] media: staging: atomisp: use ARRAY_SIZE [PATCH 17/18] staging: rtl8723bs: use ARRAY_SIZE [PATCH 18/18] staging: rtlwifi: use ARRAY_SIZE [1]: https://lkml.org/lkml/2017/9/13/689

9 12

[alsa-devel] [PATCH] ALSA: sh: aica: Convert timers to use timer_setup()
by Kees Cook 05 Oct '17

05 Oct '17

In preparation for unconditionally passing the struct timer_list pointer to all timer callbacks, switch to using the new timer_setup() and from_timer() to pass the timer pointer explicitly. This requires adding a pointer to hold the timer's target substream, as there won't be a way to pass this in the future. Cc: Jaroslav Kysela <perex(a)perex.cz> Cc: Takashi Iwai <tiwai(a)suse.com> Cc: Bhumika Goyal <bhumirks(a)gmail.com> Cc: Mark Brown <broonie(a)kernel.org> Cc: alsa-devel(a)alsa-project.org Cc: Thomas Gleixner <tglx(a)linutronix.de> Signed-off-by: Kees Cook <keescook(a)chromium.org> --- This requires commit 686fef928bba ("timer: Prepare to change timer callback argument type") in v4.14-rc3, but should be otherwise stand-alone. --- sound/sh/aica.c | 20 +++++++++----------- 1 file changed, 9 insertions(+), 11 deletions(-) diff --git a/sound/sh/aica.c b/sound/sh/aica.c index fdc680ae8aa0..2b26311405a4 100644 --- a/sound/sh/aica.c +++ b/sound/sh/aica.c @@ -299,14 +299,14 @@ static void run_spu_dma(struct work_struct *work) } } -static void aica_period_elapsed(unsigned long timer_var) +static void aica_period_elapsed(struct timer_list *t) { + struct snd_card_aica *dreamcastcard = from_timer(dreamcastcard, + t, timer); + struct snd_pcm_substream *substream = dreamcastcard->timer_substream; /*timer function - so cannot sleep */ int play_period; struct snd_pcm_runtime *runtime; - struct snd_pcm_substream *substream; - struct snd_card_aica *dreamcastcard; - substream = (struct snd_pcm_substream *) timer_var; runtime = substream->runtime; dreamcastcard = substream->pcm->private_data; /* Have we played out an additional period? */ @@ -336,12 +336,12 @@ static void spu_begin_dma(struct snd_pcm_substream *substream) /*get the queue to do the work */ schedule_work(&(dreamcastcard->spu_dma_work)); /* Timer may already be running */ - if (unlikely(dreamcastcard->timer.data)) { + if (unlikely(dreamcastcard->timer_substream)) { mod_timer(&dreamcastcard->timer, jiffies + 4); return; } - setup_timer(&dreamcastcard->timer, aica_period_elapsed, - (unsigned long) substream); + timer_setup(&dreamcastcard->timer, aica_period_elapsed, 0); + dreamcastcard->timer_substream = substream; mod_timer(&dreamcastcard->timer, jiffies + 4); } @@ -379,7 +379,7 @@ static int snd_aicapcm_pcm_close(struct snd_pcm_substream { struct snd_card_aica *dreamcastcard = substream->pcm->private_data; flush_work(&(dreamcastcard->spu_dma_work)); - if (dreamcastcard->timer.data) + if (dreamcastcard->timer_substream) del_timer(&dreamcastcard->timer); kfree(dreamcastcard->channel); spu_disable(); @@ -600,7 +600,7 @@ static int snd_aica_probe(struct platform_device *devptr) { int err; struct snd_card_aica *dreamcastcard; - dreamcastcard = kmalloc(sizeof(struct snd_card_aica), GFP_KERNEL); + dreamcastcard = kzalloc(sizeof(struct snd_card_aica), GFP_KERNEL); if (unlikely(!dreamcastcard)) return -ENOMEM; err = snd_card_new(&devptr->dev, index, SND_AICA_DRIVER, @@ -619,8 +619,6 @@ static int snd_aica_probe(struct platform_device *devptr) err = snd_aicapcmchip(dreamcastcard, 0); if (unlikely(err < 0)) goto freedreamcast; - dreamcastcard->timer.data = 0; - dreamcastcard->channel = NULL; /* Add basic controls */ err = add_aicamixer_controls(dreamcastcard); if (unlikely(err < 0)) -- 2.7.4 -- Kees Cook Pixel Security

2 3

[alsa-devel] [PATCH 0/2] ASoC: img-i2s-in: Add power management
by Ed Blake 05 Oct '17

05 Oct '17

This patch set adds power managment to the img-i2s-in driver. The first patch adds system PM suspend / resume handling and the second patch adds runtime PM. Ed Blake (2): ASoC: img-i2s-in: Add suspend / resume handling ASoC: img-i2s-in: Add runtime PM sound/soc/img/img-i2s-in.c | 126 ++++++++++++++++++++++++++++++++++++++++----- 1 file changed, 114 insertions(+), 12 deletions(-) -- 1.9.1

2 7

[alsa-devel] [PATCH] conf: HdmiLpeAudio: remove the "front" pcm definition
by Tanu Kaskinen 05 Oct '17

05 Oct '17

PulseAudio assumes that the "front" pcm device always refers to an analog device, not HDMI. While that assumption is not really valid, the reality is that without that assumption PulseAudio can't know whether "front" and "hdmi" refer to a different or the same device. The HDMI LPE driver doesn't allow audio streaming while the HDMI cable is unplugged, so PulseAudio has to know when it's plugged in and when it's not. If both "front" and "hdmi" devices exist, PulseAudio will notice that HDMI is unplugged, but it doesn't know that "front" refers to the same device, and PulseAudio will try to use the "front" device with bad consequences. The kernel driver's refusal to stream any audio makes PulseAudio enter an infinite loop and then the kernel kills PulseAudio, because it consumes too much CPU time in a realtime thread. While the looping in PulseAudio could probably be fixed, that wouldn't change the fact that PulseAudio thinks that there is an analog device. I believe it's best to avoid having the same device as both "front" and "hdmi" in alsa-lib. I removed also the surround configuration includes. I don't think they had any effect anyway, so I wonder why they were there in the first place. BugLink: https://bugs.freedesktop.org/show_bug.cgi?id=100488 --- src/conf/cards/HdmiLpeAudio.conf | 24 ------------------------ 1 file changed, 24 deletions(-) diff --git a/src/conf/cards/HdmiLpeAudio.conf b/src/conf/cards/HdmiLpeAudio.conf index 9fa30da0..a1e493da 100644 --- a/src/conf/cards/HdmiLpeAudio.conf +++ b/src/conf/cards/HdmiLpeAudio.conf @@ -2,30 +2,6 @@ # Configuration for the Intel HDMI/DP LPE audio # -<confdir:pcm/front.conf> - -HdmiLpeAudio.pcm.front.0 { - @args [ CARD ] - @args.CARD { - type string - } - type softvol - slave.pcm { - type hw - card $CARD - } - control { - name "PCM Playback Volume" - card $CARD - } -} - -<confdir:pcm/surround40.conf> -<confdir:pcm/surround21.conf> -<confdir:pcm/surround41.conf> -<confdir:pcm/surround50.conf> -<confdir:pcm/surround51.conf> - <confdir:pcm/hdmi.conf> HdmiLpeAudio.pcm.hdmi.0 { -- 2.14.2

2 3

[alsa-devel] SEGFault when optininal snd_ctl_ext_callback::read_event() not set
by Wischer, Timo (ADITG/ESB) 05 Oct '17

05 Oct '17

Hi all, snd_ctl_ext_callback::read_event() callback is mentioned as optional (see http://git.alsa-project.org/?p=alsa-lib.git;a=blob;f=include/control_extern…) but there is no NULL check and the NULL pointer will be called if the read_event function callback pointer is not set. (see http://git.alsa-project.org/?p=alsa-lib.git;a=blob;f=src/control/control_ex…) I think a default function has to be provided which will be called when the callback is not set or the read_event() callback should not be marked as optional. What is your opinion? Best regards Timo Wischer Advanced Driver Information Technology GmbH Engineering Software Base (ADITG/ESB) Robert-Bosch-Str. 200 31139 Hildesheim Germany Tel. +49 5121 49 6938 Fax +49 5121 49 6999 twischer(a)de.adit-jv.com ADIT is a joint venture company of Robert Bosch GmbH/Robert Bosch Car Multimedia GmbH and DENSO Corporation Sitz: Hildesheim, Registergericht: Amtsgericht Hildesheim HRB 3438 Geschäftsführung: Wilhelm Grabow, Ken Yaguchi

2 3

[alsa-devel] notifying userspace of hwparams change
by Tim Harvey 05 Oct '17

05 Oct '17

Greetings, I've got an HDMI receiver chip I'm working on a driver for which provides the audio signal from the HDMI source. An HDMI source can be a variety of sample-rates, channels, widths, and formats. If I understand correctly I need to register the device as supporting all the possible rates/channels/formats then constrain these to what is actually available at the time in the startup callback with snd_pcm_hw_contstraint_minmax and snd_pcm_hw_constraint_mask. How do I notify userspace when the chip tells me that the HDMI audio source rate/channels/format has changed? I know on the Video side the driver sends a V4L2_EVENT_SOURCE_CHANGE event to userspace when input format/resolution has changed so that userspace can stop streaming, call VIDIOC_QUERY_DV_TIMINGS and then VIDIOC_S_DV_TIMINGS with new timings. Regards, Tim

2 1

[alsa-devel] [PATCH] ALSA: core: Add new ACCESS_TLV flag for coefficient TLV controls
by Charles Keepax 05 Oct '17

05 Oct '17

ASoC can use the TLV mechanism to pass coefficient data for controls that exceed the normal 512 byte limit. However, there is no mechanism to inform user-space the control expects data through the TLV mechanism. Currently amixer uses a combination of the absense of non-TLV read/write permissions and the type being BYTES. This is not ideal as it is not a clear signal and prevents controls that might support both access mechanisms. Add a specific flag SNDRV_CTL_ELEM_ACCESS_TLV_COEFF to let user-space know when it is dealing with a TLV control that is being used to pass actual coefficient data. Then add this flag to the controls generated by the current users of these types of controls. Signed-off-by: Charles Keepax <ckeepax(a)opensource.cirrus.com> --- Hi, This builds on work done by Sakamoto-san [1] and the changes mentioned to amixer in the commit message are found in [2]. I think something like this should probably be added, what I am less clear on is where we go from here? Sakamoto-san's original patches also added a tag type SNDRV_CTL_TVLT_COEFF, to keep the data matching the normal format found in TLV controls. The trouble is neither of the two users really follow this convention at the moment. The ADSP code just takes the data as is with no additional headers and the Skylake code does have a tag and a length as part of the data passed through the TLV however the tag part looks like it is used for some internal purpose, so I am far from clear it would support a fixed value to identify the data without some changes as well. Changing the ADSP code is probably acceptable since we have had very few users in the field, and since this work has been done improvements in the firmware tool chains mean most firmwares are created with much smaller dedicated purpose controls rather than the large block ones that were initially the reason for using these controls on our side. Finally, since [3] tinymix has been updated to add some TLV information into control writes/reads which will break the ADSP code once it trickles down to users. So I would be keen to discuss this at this years conference and decide how we are going to handle these controls? As Mark says [4] maybe we should see if there is a better approach we should all migrate across to? Thanks, Charles [1] https://patchwork.kernel.org/patch/9304649/ [2] https://patchwork.kernel.org/patch/8147001/ [3] https://github.com/tinyalsa/tinyalsa/commit/3f813e47784674a3909fe1277bc10b7… [4] http://mailman.alsa-project.org/pipermail/alsa-devel/2017-September/125743.… include/sound/soc.h | 3 ++- include/uapi/sound/asound.h | 1 + sound/core/control.c | 1 + sound/soc/codecs/wm_adsp.c | 3 ++- sound/soc/intel/skylake/skl-topology.c | 1 + sound/soc/soc-ops.c | 3 +++ 6 files changed, 10 insertions(+), 2 deletions(-) diff --git a/include/sound/soc.h b/include/sound/soc.h index d776cdee30d7..d82297a95caf 100644 --- a/include/sound/soc.h +++ b/include/sound/soc.h @@ -323,7 +323,8 @@ #define SND_SOC_BYTES_TLV(xname, xcount, xhandler_get, xhandler_put) \ { .iface = SNDRV_CTL_ELEM_IFACE_MIXER, .name = xname, \ .access = SNDRV_CTL_ELEM_ACCESS_TLV_READWRITE | \ - SNDRV_CTL_ELEM_ACCESS_TLV_CALLBACK, \ + SNDRV_CTL_ELEM_ACCESS_TLV_CALLBACK | \ + SNDRV_CTL_ELEM_ACCESS_TLV_COEFF, \ .tlv.c = (snd_soc_bytes_tlv_callback), \ .info = snd_soc_bytes_info_ext, \ .private_value = (unsigned long)&(struct soc_bytes_ext) \ diff --git a/include/uapi/sound/asound.h b/include/uapi/sound/asound.h index 1949923a40bf..4bf0b2f835e9 100644 --- a/include/uapi/sound/asound.h +++ b/include/uapi/sound/asound.h @@ -853,6 +853,7 @@ typedef int __bitwise snd_ctl_elem_iface_t; #define SNDRV_CTL_ELEM_ACCESS_TLV_WRITE (1<<5) /* TLV write is possible */ #define SNDRV_CTL_ELEM_ACCESS_TLV_READWRITE (SNDRV_CTL_ELEM_ACCESS_TLV_READ|SNDRV_CTL_ELEM_ACCESS_TLV_WRITE) #define SNDRV_CTL_ELEM_ACCESS_TLV_COMMAND (1<<6) /* TLV command is possible */ +#define SNDRV_CTL_ELEM_ACCESS_TLV_COEFF (1<<7) /* Coefficient data is accepted */ #define SNDRV_CTL_ELEM_ACCESS_INACTIVE (1<<8) /* control does actually nothing, but may be updated */ #define SNDRV_CTL_ELEM_ACCESS_LOCK (1<<9) /* write lock */ #define SNDRV_CTL_ELEM_ACCESS_OWNER (1<<10) /* write lock owner */ diff --git a/sound/core/control.c b/sound/core/control.c index 56b3e2d49c82..e7a74d48633b 100644 --- a/sound/core/control.c +++ b/sound/core/control.c @@ -266,6 +266,7 @@ struct snd_kcontrol *snd_ctl_new1(const struct snd_kcontrol_new *ncontrol, SNDRV_CTL_ELEM_ACCESS_INACTIVE | SNDRV_CTL_ELEM_ACCESS_TLV_READWRITE | SNDRV_CTL_ELEM_ACCESS_TLV_COMMAND | + SNDRV_CTL_ELEM_ACCESS_TLV_COEFF | SNDRV_CTL_ELEM_ACCESS_TLV_CALLBACK); err = snd_ctl_new(&kctl, count, access, NULL); diff --git a/sound/soc/codecs/wm_adsp.c b/sound/soc/codecs/wm_adsp.c index 65c059b5ffd7..1d7fe0d8a18a 100644 --- a/sound/soc/codecs/wm_adsp.c +++ b/sound/soc/codecs/wm_adsp.c @@ -1156,7 +1156,8 @@ static unsigned int wmfw_convert_flags(unsigned int in, unsigned int len) wr = SNDRV_CTL_ELEM_ACCESS_TLV_WRITE; vol = SNDRV_CTL_ELEM_ACCESS_VOLATILE; - out = SNDRV_CTL_ELEM_ACCESS_TLV_CALLBACK; + out = SNDRV_CTL_ELEM_ACCESS_TLV_CALLBACK | + SNDRV_CTL_ELEM_ACCESS_TLV_COEFF; } else { rd = SNDRV_CTL_ELEM_ACCESS_READ; wr = SNDRV_CTL_ELEM_ACCESS_WRITE; diff --git a/sound/soc/intel/skylake/skl-topology.c b/sound/soc/intel/skylake/skl-topology.c index 27bcb62568fb..01b01c6a2bf3 100644 --- a/sound/soc/intel/skylake/skl-topology.c +++ b/sound/soc/intel/skylake/skl-topology.c @@ -2870,6 +2870,7 @@ static int skl_tplg_control_load(struct snd_soc_component *cmpnt, tplg_bc = container_of(hdr, struct snd_soc_tplg_bytes_control, hdr); if (kctl->access & SNDRV_CTL_ELEM_ACCESS_TLV_CALLBACK) { + kctl->access |= SNDRV_CTL_ELEM_ACCESS_TLV_COEFF; sb = (struct soc_bytes_ext *)kctl->private_value; if (tplg_bc->priv.size) return skl_init_algo_data( diff --git a/sound/soc/soc-ops.c b/sound/soc/soc-ops.c index 500f98c730b9..5ac2afe12b5d 100644 --- a/sound/soc/soc-ops.c +++ b/sound/soc/soc-ops.c @@ -776,6 +776,9 @@ int snd_soc_bytes_tlv_callback(struct snd_kcontrol *kcontrol, int op_flag, unsigned int count = size < params->max ? size : params->max; int ret = -ENXIO; + if (!(kcontrol->vd[0].access & SNDRV_CTL_ELEM_ACCESS_TLV_COEFF)) + return -ENXIO; + switch (op_flag) { case SNDRV_CTL_TLV_OP_READ: if (params->get) -- 2.11.0

2 2

[alsa-devel] [PATCH] sound/pci/asihpi: Convert timers to use timer_setup()
by Kees Cook 05 Oct '17

05 Oct '17

In preparation for unconditionally passing the struct timer_list pointer to all timer callbacks, switch to using the new timer_setup() and from_timer() to pass the timer pointer explicitly. Cc: Jaroslav Kysela <perex(a)perex.cz> Cc: Takashi Iwai <tiwai(a)suse.com> Cc: alsa-devel(a)alsa-project.org Cc: Thomas Gleixner <tglx(a)linutronix.de> Signed-off-by: Kees Cook <keescook(a)chromium.org> --- This requires commit 686fef928bba ("timer: Prepare to change timer callback argument type") in v4.14-rc3, but should be otherwise stand-alone. --- sound/pci/asihpi/asihpi.c | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-) diff --git a/sound/pci/asihpi/asihpi.c b/sound/pci/asihpi/asihpi.c index 70d023a85bf5..614322171c79 100644 --- a/sound/pci/asihpi/asihpi.c +++ b/sound/pci/asihpi/asihpi.c @@ -749,9 +749,9 @@ static inline unsigned int modulo_min(unsigned int a, unsigned int b, /** Timer function, equivalent to interrupt service routine for cards */ -static void snd_card_asihpi_timer_function(unsigned long data) +static void snd_card_asihpi_timer_function(struct timer_list *t) { - struct snd_card_asihpi_pcm *dpcm = (struct snd_card_asihpi_pcm *)data; + struct snd_card_asihpi_pcm *dpcm = from_timer(dpcm, t, timer); struct snd_pcm_substream *substream = dpcm->substream; struct snd_card_asihpi *card = snd_pcm_substream_chip(substream); struct snd_pcm_runtime *runtime; @@ -948,7 +948,7 @@ static void snd_card_asihpi_int_task(unsigned long data) asihpi = (struct snd_card_asihpi *)a->snd_card->private_data; if (asihpi->llmode_streampriv) snd_card_asihpi_timer_function( - (unsigned long)asihpi->llmode_streampriv); + &asihpi->llmode_streampriv->timer); } static void snd_card_asihpi_isr(struct hpi_adapter *a) @@ -1059,8 +1059,7 @@ static int snd_card_asihpi_playback_open(struct snd_pcm_substream *substream) If internal and other stream playing, can't switch */ - setup_timer(&dpcm->timer, snd_card_asihpi_timer_function, - (unsigned long) dpcm); + timer_setup(&dpcm->timer, snd_card_asihpi_timer_function, 0); dpcm->substream = substream; runtime->private_data = dpcm; runtime->private_free = snd_card_asihpi_runtime_free; @@ -1240,8 +1239,7 @@ static int snd_card_asihpi_capture_open(struct snd_pcm_substream *substream) if (err) return -EIO; - setup_timer(&dpcm->timer, snd_card_asihpi_timer_function, - (unsigned long) dpcm); + timer_setup(&dpcm->timer, snd_card_asihpi_timer_function, 0); dpcm->substream = substream; runtime->private_data = dpcm; runtime->private_free = snd_card_asihpi_runtime_free; -- 2.7.4 -- Kees Cook Pixel Security

1 0

[alsa-devel] [PATCH] sound/core: Convert timers to use timer_setup()
by Kees Cook 05 Oct '17

05 Oct '17

In preparation for unconditionally passing the struct timer_list pointer to all timer callbacks, switch to using the new timer_setup() and from_timer() to pass the timer pointer explicitly. This adds a pointer back to struct snd_timer. Cc: Jaroslav Kysela <perex(a)perex.cz> Cc: Takashi Iwai <tiwai(a)suse.com> Cc: Ingo Molnar <mingo(a)kernel.org> Cc: Dan Carpenter <dan.carpenter(a)oracle.com> Cc: alsa-devel(a)alsa-project.org Cc: Thomas Gleixner <tglx(a)linutronix.de> Signed-off-by: Kees Cook <keescook(a)chromium.org> --- This requires commit 686fef928bba ("timer: Prepare to change timer callback argument type") in v4.14-rc3, but should be otherwise stand-alone. --- sound/core/timer.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/sound/core/timer.c b/sound/core/timer.c index 6cdd04a45962..09acaf2b2e57 100644 --- a/sound/core/timer.c +++ b/sound/core/timer.c @@ -1028,15 +1028,17 @@ EXPORT_SYMBOL(snd_timer_global_register); struct snd_timer_system_private { struct timer_list tlist; + struct snd_timer *snd_timer; unsigned long last_expires; unsigned long last_jiffies; unsigned long correction; }; -static void snd_timer_s_function(unsigned long data) +static void snd_timer_s_function(struct timer_list *t) { - struct snd_timer *timer = (struct snd_timer *)data; - struct snd_timer_system_private *priv = timer->private_data; + struct snd_timer_system_private *priv = from_timer(priv, t, + tlist); + struct snd_timer *timer = priv->snd_timer; unsigned long jiff = jiffies; if (time_after(jiff, priv->last_expires)) priv->correction += (long)jiff - (long)priv->last_expires; @@ -1118,7 +1120,8 @@ static int snd_timer_register_system(void) snd_timer_free(timer); return -ENOMEM; } - setup_timer(&priv->tlist, snd_timer_s_function, (unsigned long) timer); + priv->snd_timer = timer; + timer_setup(&priv->tlist, snd_timer_s_function, 0); timer->private_data = priv; timer->private_free = snd_timer_free_system; return snd_timer_global_register(timer); -- 2.7.4 -- Kees Cook Pixel Security

1 0

[alsa-devel] [PATCH] ASoC: fsi: Use of_device_get_match_data() helper
by Geert Uytterhoeven 04 Oct '17

04 Oct '17

Use the of_device_get_match_data() helper instead of open coding. Note that when used with DT, there's always a valid match. Signed-off-by: Geert Uytterhoeven <geert+renesas(a)glider.be> --- sound/soc/sh/fsi.c | 11 +++-------- 1 file changed, 3 insertions(+), 8 deletions(-) diff --git a/sound/soc/sh/fsi.c b/sound/soc/sh/fsi.c index 6d3c7706d93fbc10..c3aaf4788557c4e1 100644 --- a/sound/soc/sh/fsi.c +++ b/sound/soc/sh/fsi.c @@ -1932,14 +1932,9 @@ static int fsi_probe(struct platform_device *pdev) core = NULL; if (np) { - const struct of_device_id *of_id; - - of_id = of_match_device(fsi_of_match, &pdev->dev); - if (of_id) { - core = of_id->data; - fsi_of_parse("fsia", np, &info.port_a, &pdev->dev); - fsi_of_parse("fsib", np, &info.port_b, &pdev->dev); - } + core = of_device_get_match_data(&pdev->dev); + fsi_of_parse("fsia", np, &info.port_a, &pdev->dev); + fsi_of_parse("fsib", np, &info.port_b, &pdev->dev); } else { const struct platform_device_id *id_entry = pdev->id_entry; if (id_entry) -- 2.7.4

2 1

[alsa-devel] usb/sound/bcd2000: warning in bcd2000_init_device
by Andrey Konovalov 04 Oct '17

04 Oct '17

Hi! I've got the following report while fuzzing the kernel with syzkaller. On commit e19b205be43d11bff638cad4487008c48d21c103 (4.14-rc2). It seems that there's no check of the endpoint type. usb 1-1: BOGUS urb xfer, pipe 1 != type 3 ------------[ cut here ]------------ WARNING: CPU: 0 PID: 1846 at drivers/usb/core/urb.c:449 usb_submit_urb+0xf8a/0x11d0 Modules linked in: CPU: 0 PID: 1846 Comm: kworker/0:2 Not tainted 4.14.0-rc2-42613-g1488251d1a98 #238 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 Workqueue: usb_hub_wq hub_event task: ffff880064296300 task.stack: ffff8800643b0000 RIP: 0010:usb_submit_urb+0xf8a/0x11d0 drivers/usb/core/urb.c:448 RSP: 0018:ffff8800643b6140 EFLAGS: 00010286 RAX: 0000000000000029 RBX: ffff880063842400 RCX: 0000000000000000 RDX: 0000000000000029 RSI: ffffffff85a58800 RDI: ffffed000c876c1a RBP: ffff8800643b6240 R08: 1ffff1000c876ac0 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 1ffff1000c876c2f R13: 0000000000000003 R14: 0000000000000001 R15: ffff88006325c768 FS: 0000000000000000(0000) GS:ffff88006c800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fa2a51c0000 CR3: 000000006acc8000 CR4: 00000000000006f0 Call Trace: bcd2000_init_device sound/usb/bcd2000/bcd2000.c:289 bcd2000_init_midi sound/usb/bcd2000/bcd2000.c:345 bcd2000_probe+0xe64/0x19e0 sound/usb/bcd2000/bcd2000.c:406 usb_probe_interface+0x35d/0x8e0 drivers/usb/core/driver.c:361 really_probe drivers/base/dd.c:413 driver_probe_device+0x610/0xa00 drivers/base/dd.c:557 __device_attach_driver+0x230/0x290 drivers/base/dd.c:653 bus_for_each_drv+0x161/0x210 drivers/base/bus.c:463 __device_attach+0x26e/0x3d0 drivers/base/dd.c:710 device_initial_probe+0x1f/0x30 drivers/base/dd.c:757 bus_probe_device+0x1eb/0x290 drivers/base/bus.c:523 device_add+0xd0b/0x1660 drivers/base/core.c:1835 usb_set_configuration+0x104e/0x1870 drivers/usb/core/message.c:1932 generic_probe+0x73/0xe0 drivers/usb/core/generic.c:174 usb_probe_device+0xaf/0xe0 drivers/usb/core/driver.c:266 really_probe drivers/base/dd.c:413 driver_probe_device+0x610/0xa00 drivers/base/dd.c:557 __device_attach_driver+0x230/0x290 drivers/base/dd.c:653 bus_for_each_drv+0x161/0x210 drivers/base/bus.c:463 __device_attach+0x26e/0x3d0 drivers/base/dd.c:710 device_initial_probe+0x1f/0x30 drivers/base/dd.c:757 bus_probe_device+0x1eb/0x290 drivers/base/bus.c:523 device_add+0xd0b/0x1660 drivers/base/core.c:1835 usb_new_device+0x7b8/0x1020 drivers/usb/core/hub.c:2457 hub_port_connect drivers/usb/core/hub.c:4903 hub_port_connect_change drivers/usb/core/hub.c:5009 port_event drivers/usb/core/hub.c:5115 hub_event+0x194d/0x3740 drivers/usb/core/hub.c:5195 process_one_work+0xc7f/0x1db0 kernel/workqueue.c:2119 worker_thread+0x221/0x1850 kernel/workqueue.c:2253 kthread+0x3a1/0x470 kernel/kthread.c:231 ret_from_fork+0x2a/0x40 arch/x86/entry/entry_64.S:431 Code: 48 8b 85 30 ff ff ff 48 8d b8 98 00 00 00 e8 6e 91 8b ff 45 89 e8 44 89 f1 4c 89 fa 48 89 c6 48 c7 c7 c0 5a c8 85 e8 10 50 dd fd <0f> ff e9 9b f7 ff ff e8 ba cf 26 fe e9 80 f7 ff ff e8 a0 a5 f4 ---[ end trace bad127706d5fe2d6 ]---

5 15

[alsa-devel] [PATCH v2] ASoC: codecs: msm8916-wcd-analog: configure micbias in mbhc setup
by Damien Riegel 04 Oct '17

04 Oct '17

The very first time a headset is plugged in, detection is unreliable because bias hasn't been configured yet, it's done once a mechanical insertion interrupt has been triggered, so following insertions (and thus detections) are not affected. To fix the very first detection, the bias must also be configured in the function that setup the MBHC. Move pm8916_wcd_setup_mbhc after pm8916_mbhc_configure_bias to avoid a forward declaration. Signed-off-by: Damien Riegel <damien.riegel(a)savoirfairelinux.com> --- Changes in v2: - squash the two patches in one patch only sound/soc/codecs/msm8916-wcd-analog.c | 94 +++++++++++++++++++---------------- 1 file changed, 50 insertions(+), 44 deletions(-) diff --git a/sound/soc/codecs/msm8916-wcd-analog.c b/sound/soc/codecs/msm8916-wcd-analog.c index f562f2d86907..71494e9dbdcb 100644 --- a/sound/soc/codecs/msm8916-wcd-analog.c +++ b/sound/soc/codecs/msm8916-wcd-analog.c @@ -443,50 +443,6 @@ static int pm8916_wcd_analog_enable_micbias_int1(struct wcd->micbias1_cap_mode); } -static void pm8916_wcd_setup_mbhc(struct pm8916_wcd_analog_priv *wcd) -{ - struct snd_soc_codec *codec = wcd->codec; - u32 plug_type = 0; - u32 int_en_mask; - - snd_soc_write(codec, CDC_A_MBHC_DET_CTL_1, - CDC_A_MBHC_DET_CTL_L_DET_EN | - CDC_A_MBHC_DET_CTL_MECH_DET_TYPE_INSERTION | - CDC_A_MBHC_DET_CTL_MIC_CLAMP_CTL_AUTO | - CDC_A_MBHC_DET_CTL_MBHC_BIAS_EN); - - if (wcd->hphl_jack_type_normally_open) - plug_type |= CDC_A_HPHL_PLUG_TYPE_NO; - - if (wcd->gnd_jack_type_normally_open) - plug_type |= CDC_A_GND_PLUG_TYPE_NO; - - snd_soc_write(codec, CDC_A_MBHC_DET_CTL_2, - CDC_A_MBHC_DET_CTL_HS_L_DET_PULL_UP_CTRL_I_3P0 | - CDC_A_MBHC_DET_CTL_HS_L_DET_COMPA_CTRL_V0P9_VDD | - plug_type | - CDC_A_MBHC_DET_CTL_HPHL_100K_TO_GND_EN); - - - snd_soc_write(codec, CDC_A_MBHC_DBNC_TIMER, - CDC_A_MBHC_DBNC_TIMER_INSREM_DBNC_T_256_MS | - CDC_A_MBHC_DBNC_TIMER_BTN_DBNC_T_16MS); - - /* enable MBHC clock */ - snd_soc_update_bits(codec, CDC_D_CDC_DIG_CLK_CTL, - DIG_CLK_CTL_D_MBHC_CLK_EN_MASK, - DIG_CLK_CTL_D_MBHC_CLK_EN); - - int_en_mask = MBHC_SWITCH_INT; - if (wcd->mbhc_btn_enabled) - int_en_mask |= MBHC_BUTTON_PRESS_DET | MBHC_BUTTON_RELEASE_DET; - - snd_soc_update_bits(codec, CDC_D_INT_EN_CLR, int_en_mask, 0); - snd_soc_update_bits(codec, CDC_D_INT_EN_SET, int_en_mask, int_en_mask); - wcd->mbhc_btn0_released = false; - wcd->detect_accessory_type = true; -} - static int pm8916_mbhc_configure_bias(struct pm8916_wcd_analog_priv *priv, bool micbias2_enabled) { @@ -534,6 +490,56 @@ static int pm8916_mbhc_configure_bias(struct pm8916_wcd_analog_priv *priv, return 0; } +static void pm8916_wcd_setup_mbhc(struct pm8916_wcd_analog_priv *wcd) +{ + struct snd_soc_codec *codec = wcd->codec; + bool micbias_enabled = false; + u32 plug_type = 0; + u32 int_en_mask; + + snd_soc_write(codec, CDC_A_MBHC_DET_CTL_1, + CDC_A_MBHC_DET_CTL_L_DET_EN | + CDC_A_MBHC_DET_CTL_MECH_DET_TYPE_INSERTION | + CDC_A_MBHC_DET_CTL_MIC_CLAMP_CTL_AUTO | + CDC_A_MBHC_DET_CTL_MBHC_BIAS_EN); + + if (wcd->hphl_jack_type_normally_open) + plug_type |= CDC_A_HPHL_PLUG_TYPE_NO; + + if (wcd->gnd_jack_type_normally_open) + plug_type |= CDC_A_GND_PLUG_TYPE_NO; + + snd_soc_write(codec, CDC_A_MBHC_DET_CTL_2, + CDC_A_MBHC_DET_CTL_HS_L_DET_PULL_UP_CTRL_I_3P0 | + CDC_A_MBHC_DET_CTL_HS_L_DET_COMPA_CTRL_V0P9_VDD | + plug_type | + CDC_A_MBHC_DET_CTL_HPHL_100K_TO_GND_EN); + + + snd_soc_write(codec, CDC_A_MBHC_DBNC_TIMER, + CDC_A_MBHC_DBNC_TIMER_INSREM_DBNC_T_256_MS | + CDC_A_MBHC_DBNC_TIMER_BTN_DBNC_T_16MS); + + /* enable MBHC clock */ + snd_soc_update_bits(codec, CDC_D_CDC_DIG_CLK_CTL, + DIG_CLK_CTL_D_MBHC_CLK_EN_MASK, + DIG_CLK_CTL_D_MBHC_CLK_EN); + + if (snd_soc_read(codec, CDC_A_MICB_2_EN) & CDC_A_MICB_2_EN_ENABLE) + micbias_enabled = true; + + pm8916_mbhc_configure_bias(wcd, micbias_enabled); + + int_en_mask = MBHC_SWITCH_INT; + if (wcd->mbhc_btn_enabled) + int_en_mask |= MBHC_BUTTON_PRESS_DET | MBHC_BUTTON_RELEASE_DET; + + snd_soc_update_bits(codec, CDC_D_INT_EN_CLR, int_en_mask, 0); + snd_soc_update_bits(codec, CDC_D_INT_EN_SET, int_en_mask, int_en_mask); + wcd->mbhc_btn0_released = false; + wcd->detect_accessory_type = true; +} + static int pm8916_wcd_analog_enable_micbias_int2(struct snd_soc_dapm_widget *w, struct snd_kcontrol -- 2.14.1

3 4

[alsa-devel] [PATCH] ASoC: rockchip: Allocate enough memory so we don't overflow routes
by Douglas Anderson 04 Oct '17

04 Oct '17

In the recent commit d9f9c167edae ("ASoC: rockchip: Init dapm routes dynamically") we improperly allocated memory for the card->dapm_routes causing us to overflow the allocation on every boot. Oops. Let's allocate the correct amount of memory. We'll also add a check to make sure that we don't overrun memory even if we encounter some sort of weird device tree. Fixes: d9f9c167edae ("ASoC: rockchip: Init dapm routes dynamically") Signed-off-by: Douglas Anderson <dianders(a)chromium.org> --- sound/soc/rockchip/rk3399_gru_sound.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/sound/soc/rockchip/rk3399_gru_sound.c b/sound/soc/rockchip/rk3399_gru_sound.c index 30eed83e8a13..d64fbbd50544 100644 --- a/sound/soc/rockchip/rk3399_gru_sound.c +++ b/sound/soc/rockchip/rk3399_gru_sound.c @@ -494,13 +494,17 @@ static int rockchip_sound_of_parse_dais(struct device *dev, struct snd_soc_dai_link *dai; struct snd_soc_dapm_route *routes; int i, index; + int num_routes; card->dai_link = devm_kzalloc(dev, sizeof(rockchip_dais), GFP_KERNEL); if (!card->dai_link) return -ENOMEM; - routes = devm_kzalloc(dev, sizeof(rockchip_routes), + num_routes = 0; + for (i = 0; i < ARRAY_SIZE(rockchip_routes); i++) + num_routes += rockchip_routes[i].num_routes; + routes = devm_kzalloc(dev, num_routes * sizeof(*routes), GFP_KERNEL); if (!routes) return -ENOMEM; @@ -538,6 +542,12 @@ static int rockchip_sound_of_parse_dais(struct device *dev, dai->platform_of_node = np_cpu; dai->cpu_of_node = np_cpu; + if (card->num_dapm_routes + rockchip_routes[index].num_routes > + num_routes) { + dev_err(dev, "Too many routes\n"); + return -EINVAL; + } + memcpy(routes + card->num_dapm_routes, rockchip_routes[index].routes, rockchip_routes[index].num_routes * sizeof(*routes)); -- 2.14.2.822.g60be5d43e6-goog

2 1

[alsa-devel] [PATCH 0/3] ASoC: img-i2s-out: Add power management
by Ed Blake 04 Oct '17

04 Oct '17

This patch set adds power managment to the img-i2s-out driver. The first patch renames existing 'suspend' and 'resume' functions to 'runtime_suspend' and 'runtime_resume', which is what they actually are, the second patch adds system PM suspend / resume handling and the third patch adds control of the sys clock to runtime PM. Ed Blake (3): ASoC: img-i2s-out: Rename suspend / resume funcs ASoC: img-i2s-out: Add suspend / resume handling ASoC: img-i2s-out: Add control of sys clock to runtime PM sound/soc/img/img-i2s-out.c | 116 +++++++++++++++++++++++++++++++++----------- 1 file changed, 87 insertions(+), 29 deletions(-) -- 1.9.1

2 4

[alsa-devel] [PATCH] ASoC: img-parallel-out: Add pm_runtime_get/put to set_fmt callback
by Ed Blake 04 Oct '17

04 Oct '17

Add pm_runtime_get_sync and pm_runtime_put calls to set_fmt callback function. This fixes a bus error during boot when CONFIG_SUSPEND is defined when this function gets called while the device is runtime disabled and device registers are accessed while the clock is disabled. Signed-off-by: Ed Blake <ed.blake(a)sondrel.com> --- sound/soc/img/img-parallel-out.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/sound/soc/img/img-parallel-out.c b/sound/soc/img/img-parallel-out.c index 23b0f0f..2fc8a63 100644 --- a/sound/soc/img/img-parallel-out.c +++ b/sound/soc/img/img-parallel-out.c @@ -164,9 +164,11 @@ static int img_prl_out_set_fmt(struct snd_soc_dai *dai, unsigned int fmt) return -EINVAL; } + pm_runtime_get_sync(prl->dev); reg = img_prl_out_readl(prl, IMG_PRL_OUT_CTL); reg = (reg & ~IMG_PRL_OUT_CTL_EDGE_MASK) | control_set; img_prl_out_writel(prl, reg, IMG_PRL_OUT_CTL); + pm_runtime_put(prl->dev); return 0; } -- 1.9.1

2 2

[alsa-devel] [PATCH] ASoC: codecs: msm8916-wcd-analog: fix micbias level
by Jean-François Têtu 04 Oct '17

04 Oct '17

The macro used to set the microphone bias level causes the snd_soc_write() call to overwrite other fields in the CDC_A_MICB_1_VAL register. The macro also does not return the proper level value to use. This fixes this by preserving all bits from the register that are not the level while setting the level. Signed-off-by: Jean-François Têtu <jean-francois.tetu(a)savoirfairelinux.com> --- sound/soc/codecs/msm8916-wcd-analog.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/sound/soc/codecs/msm8916-wcd-analog.c b/sound/soc/codecs/msm8916-wcd-analog.c index f562f2d..e1534fe 100644 --- a/sound/soc/codecs/msm8916-wcd-analog.c +++ b/sound/soc/codecs/msm8916-wcd-analog.c @@ -104,7 +104,7 @@ #define CDC_A_MICB_1_VAL (0xf141) #define MICB_MIN_VAL 1600 #define MICB_STEP_SIZE 50 -#define MICB_VOLTAGE_REGVAL(v) ((v - MICB_MIN_VAL)/MICB_STEP_SIZE) +#define MICB_VOLTAGE_REGVAL(v) (((v - MICB_MIN_VAL)/MICB_STEP_SIZE) << 3) #define MICB_1_VAL_MICB_OUT_VAL_MASK GENMASK(7, 3) #define MICB_1_VAL_MICB_OUT_VAL_V2P70V ((0x16) << 3) #define MICB_1_VAL_MICB_OUT_VAL_V1P80V ((0x4) << 3) @@ -349,8 +349,9 @@ static void pm8916_wcd_analog_micbias_enable(struct snd_soc_codec *codec) | MICB_1_CTL_EXT_PRECHARG_EN_ENABLE); if (wcd->micbias_mv) { - snd_soc_write(codec, CDC_A_MICB_1_VAL, - MICB_VOLTAGE_REGVAL(wcd->micbias_mv)); + snd_soc_update_bits(codec, CDC_A_MICB_1_VAL, + MICB_1_VAL_MICB_OUT_VAL_MASK, + MICB_VOLTAGE_REGVAL(wcd->micbias_mv)); /* * Special headset needs MICBIAS as 2.7V so wait for * 50 msec for the MICBIAS to reach 2.7 volts. -- 2.7.4

3 2