June 2018 - Alsa-devel - mailman.alsa-project.org

[alsa-devel] first and last audio sample timestamp
by Subhashini Rao Beerisetty 25 Jun '18

25 Jun '18

[ Please keep me in CC as I'm not subscribed to the list] Hi All, Hello all, I’m using aplay and arecord utilities for playback and capture. I need to capture the timestamps for the first and last audio samples that arrive at the driver level. For this I’m capturing the CLOCK_MONOTONIC_RAW timestamp at the .trigger(for playback & capture) callback in SNDRV_PCM_TRIGGER_START case – is it the correct timestamp for the first audio sample arrived at the driver level? Similarly does .trigger callbacks SNDRV_PCM_TRIGGER_STOP gives the last audio sample timestamp?

2 5

[alsa-devel] [PATCH] ASoC: dpcm: improve runtime update predictability
by Jerome Brunet 25 Jun '18

25 Jun '18

As it is, dpcm_runtime_update() performs the old path and new path update of a frontend before going on to the next frontend DAI. Depending the order of the FEs within the rtd list, the result of the update might be different. For example: * Frontend A connected to backend C, with a 48kHz playback * Frontend B connected to backend D, with a 44.1kHz playback * FE A appears before FE B in the rtd list of the card. If we reparent BE C to FE B (disconnecting BE D): * old path update of FE A will run first, and BE C will get hw_free() and shutdown() * new path update of FE B will run after and BE C, which is stopped, so it will be configured at 44.1kHz, as expected If we reparent BE D to FE A (disconnecting BE C): * new path update of FE A will run first but since BE D is still running at 44.1kHz, it won't be reconfigured (no call to startup() or hw_params()) * old path update of FE B runs after, nothing happens * In this case, we end up with a BE playing at 44.1kHz a stream which is supposed to be played at 48Khz (too slow) To improve this situation, this patch performs all the FE old paths update before going on to update the new paths. With this, the result should no longer depend on the order of the FE within the card rtd list. Please note that there might be a small performance penalty since dpcm_process_paths() is called twice per stream direction. Signed-off-by: Jerome Brunet <jbrunet(a)baylibre.com> --- sound/soc/soc-pcm.c | 165 +++++++++++++++++++++++++++------------------------- 1 file changed, 86 insertions(+), 79 deletions(-) diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c index 5e7ae47a9658..5c2534414478 100644 --- a/sound/soc/soc-pcm.c +++ b/sound/soc/soc-pcm.c @@ -2543,106 +2543,113 @@ static int dpcm_run_old_update(struct snd_soc_pcm_runtime *fe, int stream) return ret; } -/* Called by DAPM mixer/mux changes to update audio routing between PCMs and - * any DAI links. - */ -int soc_dpcm_runtime_update(struct snd_soc_card *card) +int soc_dpcm_fe_runtime_update(struct snd_soc_pcm_runtime *fe, int new) { - struct snd_soc_pcm_runtime *fe; - int old, new, paths; + struct snd_soc_dapm_widget_list *list; + int count, paths; - mutex_lock_nested(&card->mutex, SND_SOC_CARD_CLASS_RUNTIME); - list_for_each_entry(fe, &card->rtd_list, list) { - struct snd_soc_dapm_widget_list *list; + if (!fe->dai_link->dynamic) + return 0; - /* make sure link is FE */ - if (!fe->dai_link->dynamic) - continue; + /* only check active links */ + if (!fe->cpu_dai->active) + return 0; - /* only check active links */ - if (!fe->cpu_dai->active) - continue; + /* DAPM sync will call this to update DSP paths */ + dev_dbg(fe->dev, "ASoC: DPCM %s runtime update for FE %s\n", + new ? "new" : "old", fe->dai_link->name); - /* DAPM sync will call this to update DSP paths */ - dev_dbg(fe->dev, "ASoC: DPCM runtime update for FE %s\n", - fe->dai_link->name); + /* skip if FE doesn't have playback capability */ + if (!fe->cpu_dai->driver->playback.channels_min || + !fe->codec_dai->driver->playback.channels_min) + goto capture; - /* skip if FE doesn't have playback capability */ - if (!fe->cpu_dai->driver->playback.channels_min - || !fe->codec_dai->driver->playback.channels_min) - goto capture; - - /* skip if FE isn't currently playing */ - if (!fe->cpu_dai->playback_active - || !fe->codec_dai->playback_active) - goto capture; - - paths = dpcm_path_get(fe, SNDRV_PCM_STREAM_PLAYBACK, &list); - if (paths < 0) { - dev_warn(fe->dev, "ASoC: %s no valid %s path\n", - fe->dai_link->name, "playback"); - mutex_unlock(&card->mutex); - return paths; - } + /* skip if FE isn't currently playing */ + if (!fe->cpu_dai->playback_active || !fe->codec_dai->playback_active) + goto capture; - /* update any new playback paths */ - new = dpcm_process_paths(fe, SNDRV_PCM_STREAM_PLAYBACK, &list, 1); - if (new) { - dpcm_run_new_update(fe, SNDRV_PCM_STREAM_PLAYBACK); - dpcm_clear_pending_state(fe, SNDRV_PCM_STREAM_PLAYBACK); - dpcm_be_disconnect(fe, SNDRV_PCM_STREAM_PLAYBACK); - } + paths = dpcm_path_get(fe, SNDRV_PCM_STREAM_PLAYBACK, &list); + if (paths < 0) { + dev_warn(fe->dev, "ASoC: %s no valid %s path\n", + fe->dai_link->name, "playback"); + return paths; + } - /* update any old playback paths */ - old = dpcm_process_paths(fe, SNDRV_PCM_STREAM_PLAYBACK, &list, 0); - if (old) { + /* update any playback paths */ + count = dpcm_process_paths(fe, SNDRV_PCM_STREAM_PLAYBACK, &list, new); + if (count) { + if (new) + dpcm_run_new_update(fe, SNDRV_PCM_STREAM_PLAYBACK); + else dpcm_run_old_update(fe, SNDRV_PCM_STREAM_PLAYBACK); - dpcm_clear_pending_state(fe, SNDRV_PCM_STREAM_PLAYBACK); - dpcm_be_disconnect(fe, SNDRV_PCM_STREAM_PLAYBACK); - } - dpcm_path_put(&list); + dpcm_clear_pending_state(fe, SNDRV_PCM_STREAM_PLAYBACK); + dpcm_be_disconnect(fe, SNDRV_PCM_STREAM_PLAYBACK); + } + + dpcm_path_put(&list); + capture: - /* skip if FE doesn't have capture capability */ - if (!fe->cpu_dai->driver->capture.channels_min - || !fe->codec_dai->driver->capture.channels_min) - continue; + /* skip if FE doesn't have capture capability */ + if (!fe->cpu_dai->driver->capture.channels_min || + !fe->codec_dai->driver->capture.channels_min) + return 0; - /* skip if FE isn't currently capturing */ - if (!fe->cpu_dai->capture_active - || !fe->codec_dai->capture_active) - continue; + /* skip if FE isn't currently capturing */ + if (!fe->cpu_dai->capture_active || !fe->codec_dai->capture_active) + return 0; - paths = dpcm_path_get(fe, SNDRV_PCM_STREAM_CAPTURE, &list); - if (paths < 0) { - dev_warn(fe->dev, "ASoC: %s no valid %s path\n", - fe->dai_link->name, "capture"); - mutex_unlock(&card->mutex); - return paths; - } + paths = dpcm_path_get(fe, SNDRV_PCM_STREAM_CAPTURE, &list); + if (paths < 0) { + dev_warn(fe->dev, "ASoC: %s no valid %s path\n", + fe->dai_link->name, "capture"); + return paths; + } - /* update any new capture paths */ - new = dpcm_process_paths(fe, SNDRV_PCM_STREAM_CAPTURE, &list, 1); - if (new) { + /* update any old capture paths */ + count = dpcm_process_paths(fe, SNDRV_PCM_STREAM_CAPTURE, &list, new); + if (count) { + if (new) dpcm_run_new_update(fe, SNDRV_PCM_STREAM_CAPTURE); - dpcm_clear_pending_state(fe, SNDRV_PCM_STREAM_CAPTURE); - dpcm_be_disconnect(fe, SNDRV_PCM_STREAM_CAPTURE); - } - - /* update any old capture paths */ - old = dpcm_process_paths(fe, SNDRV_PCM_STREAM_CAPTURE, &list, 0); - if (old) { + else dpcm_run_old_update(fe, SNDRV_PCM_STREAM_CAPTURE); - dpcm_clear_pending_state(fe, SNDRV_PCM_STREAM_CAPTURE); - dpcm_be_disconnect(fe, SNDRV_PCM_STREAM_CAPTURE); - } - dpcm_path_put(&list); + dpcm_clear_pending_state(fe, SNDRV_PCM_STREAM_CAPTURE); + dpcm_be_disconnect(fe, SNDRV_PCM_STREAM_CAPTURE); } - mutex_unlock(&card->mutex); + dpcm_path_put(&list); + return 0; } + +/* Called by DAPM mixer/mux changes to update audio routing between PCMs and + * any DAI links. + */ +int soc_dpcm_runtime_update(struct snd_soc_card *card) +{ + struct snd_soc_pcm_runtime *fe; + int ret = 0; + + mutex_lock_nested(&card->mutex, SND_SOC_CARD_CLASS_RUNTIME); + /* shutdown all old paths first */ + list_for_each_entry(fe, &card->rtd_list, list) { + ret = soc_dpcm_fe_runtime_update(fe, 0); + if (ret) + goto out; + } + + /* bring new paths up */ + list_for_each_entry(fe, &card->rtd_list, list) { + ret = soc_dpcm_fe_runtime_update(fe, 1); + if (ret) + goto out; + } + +out: + mutex_unlock(&card->mutex); + return ret; +} int soc_dpcm_be_digital_mute(struct snd_soc_pcm_runtime *fe, int mute) { struct snd_soc_dpcm *dpcm; -- 2.14.4

3 2

[alsa-devel] [PATCH] ASoC: cx20442: Don't ignore regulator_get() errors.
by Janusz Krzysztofik 25 Jun '18

25 Jun '18

In its current shape, the driver just ignores errors returned by regulator_get() at component_probe(). This doesn't hurt on Amstrad Delta board as long as it registers the codec device at late_initcall, when the regulator which depends on basic-mmio-gpio device (probed as late as at dev_initcall) is already available. Otherwise the driver may end up trying to control a codec which is not powered up. Remove that dependency on initialization order by handling the error. If the regulator is not yet available and -ENODEV is returned, convert it to -EPROBE_DEFER to get another chance. Signed-off-by: Janusz Krzysztofik <jmkrzyszt(a)gmail.com> --- Created and tested on linux-4.18-rc1 sound/soc/codecs/cx20442.c | 23 +++++++++++++++++++++-- 1 file changed, 21 insertions(+), 2 deletions(-) diff --git a/sound/soc/codecs/cx20442.c b/sound/soc/codecs/cx20442.c index 07dd33b09596..ab174b5114dc 100644 --- a/sound/soc/codecs/cx20442.c +++ b/sound/soc/codecs/cx20442.c @@ -362,8 +362,27 @@ static int cx20442_component_probe(struct snd_soc_component *component) return -ENOMEM; cx20442->por = regulator_get(component->dev, "POR"); - if (IS_ERR(cx20442->por)) - dev_warn(component->dev, "failed to get the regulator"); + if (IS_ERR(cx20442->por)) { + int err = PTR_ERR(cx20442->por); + + dev_warn(component->dev, "failed to get POR supply (%d)", err); + /* + * When running on a non-dt platform and requested regulator + * is not available, regulator_get() never returns + * -EPROBE_DEFER as it is not able to justify if the regulator + * may still appear later. On the other hand, the board can + * still set full constraints flag at late_initcall in order + * to instruct regulator_get() to return a dummy one if + * sufficient. Hence, if we get -ENODEV here, let's convert + * it to -EPROBE_DEFER and wait for the board to decide or + * let Deferred Probe infrastructure handle this error. + */ + if (err == -ENODEV) + err = -EPROBE_DEFER; + kfree(cx20442); + return err; + } + cx20442->tty = NULL; snd_soc_component_set_drvdata(component, cx20442); -- 2.16.4

2 1

[alsa-devel] [PATCH 0/3] ASoC: make simple-card a bit more versatile
by Daniel Mack 25 Jun '18

25 Jun '18

In the process of porting some boards to DT, I noticed the simple-card driver is already capable of handling most cases just fine. The missing bits I've spotted are: * The clock that is passed in is only read, never set, which is not sufficient for boards that support several sampling rates with different base frequencies * The sysclk id that is passed to snd_soc_dai_set_sysclk() is hard-coded * There's currently no support for calling into snd_soc_dai_set_clkdiv() The following three patches fix all those and make simple-card a good match for the board I'm working with. Thanks, Daniel Daniel Mack (3): ASoC: simple-card: set cpu dai clk in hw_params ASoC: simple-card: make sysclk index configurable ASoC: simple-card: add support for clock divider setup .../devicetree/bindings/sound/simple-card.txt | 13 ++++++ include/sound/simple_card_utils.h | 19 ++++++++ sound/soc/generic/simple-card-utils.c | 50 ++++++++++++++++++++++ sound/soc/generic/simple-card.c | 49 +++++++++++++++++++-- 4 files changed, 127 insertions(+), 4 deletions(-) -- 2.14.3

4 27

[alsa-devel] [PATCH 1/2] ASoC: rt5651: Add support for external amplifier enable GPIO
by Hans de Goede 25 Jun '18

25 Jun '18

The rt5651 does not have a built-in speaker amplifier, so it is often used together with an external amplifier. On some boards the external amplifier's enable pin is driven through a GPIO, add support for this. Signed-off-by: Hans de Goede <hdegoede(a)redhat.com> --- sound/soc/codecs/rt5651.c | 43 +++++++++++++++++++++++++++++++++++++++ sound/soc/codecs/rt5651.h | 2 ++ 2 files changed, 45 insertions(+) diff --git a/sound/soc/codecs/rt5651.c b/sound/soc/codecs/rt5651.c index 6b5669f3e85d..e5db8883ee9f 100644 --- a/sound/soc/codecs/rt5651.c +++ b/sound/soc/codecs/rt5651.c @@ -19,6 +19,7 @@ #include <linux/platform_device.h> #include <linux/spi/spi.h> #include <linux/acpi.h> +#include <linux/gpio/consumer.h> #include <sound/core.h> #include <sound/pcm.h> #include <sound/pcm_params.h> @@ -717,6 +718,26 @@ static int rt5651_amp_power_event(struct snd_soc_dapm_widget *w, return 0; } +static int rt5651_ext_amp_power_event(struct snd_soc_dapm_widget *w, + struct snd_kcontrol *kcontrol, int event) +{ + struct snd_soc_component *component = snd_soc_dapm_to_component(w->dapm); + struct rt5651_priv *rt5651 = snd_soc_component_get_drvdata(component); + + switch (event) { + case SND_SOC_DAPM_POST_PMU: + gpiod_set_value_cansleep(rt5651->ext_amp_gpio, 1); + break; + case SND_SOC_DAPM_PRE_PMD: + gpiod_set_value_cansleep(rt5651->ext_amp_gpio, 0); + break; + default: + break; + } + + return 0; +} + static int rt5651_hp_event(struct snd_soc_dapm_widget *w, struct snd_kcontrol *kcontrol, int event) { @@ -1057,6 +1078,9 @@ static const struct snd_soc_dapm_widget rt5651_dapm_widgets[] = { SND_SOC_DAPM_SUPPLY("Amp Power", RT5651_PWR_ANLG1, RT5651_PWR_HA_BIT, 0, rt5651_amp_power_event, SND_SOC_DAPM_POST_PMU), + SND_SOC_DAPM_SUPPLY("Ext Amp Power", SND_SOC_NOPM, 0, 0, + rt5651_ext_amp_power_event, + SND_SOC_DAPM_PRE_PMD | SND_SOC_DAPM_POST_PMU), SND_SOC_DAPM_PGA_S("HP Amp", 1, SND_SOC_NOPM, 0, 0, rt5651_hp_event, SND_SOC_DAPM_PRE_PMD | SND_SOC_DAPM_POST_PMU), SND_SOC_DAPM_SWITCH("HPO L Playback", SND_SOC_NOPM, 0, 0, @@ -1272,8 +1296,10 @@ static const struct snd_soc_dapm_route rt5651_dapm_routes[] = { {"LOUT R Playback", "Switch", "LOUT MIX"}, {"LOUTL", NULL, "LOUT L Playback"}, {"LOUTL", NULL, "Amp Power"}, + {"LOUTL", NULL, "Ext Amp Power"}, {"LOUTR", NULL, "LOUT R Playback"}, {"LOUTR", NULL, "Amp Power"}, + {"LOUTR", NULL, "Ext Amp Power"}, {"PDML", NULL, "PDM L Mux"}, {"PDMR", NULL, "PDM R Mux"}, @@ -1857,6 +1883,23 @@ static int rt5651_probe(struct snd_soc_component *component) rt5651_apply_properties(component); + /* + * Needs to be done from component-probe() and not i2c-probe(), so that + * the platform driver can add GPIO mappings if necessary. + */ + rt5651->ext_amp_gpio = devm_gpiod_get_optional(component->dev, + "ext-amp-enable", + GPIOD_OUT_LOW); + if (IS_ERR(rt5651->ext_amp_gpio)) { + int err = PTR_ERR(rt5651->ext_amp_gpio); + + if (err != -EPROBE_DEFER) + dev_err(component->dev, "Failed to get ext-amp GPIO: %d\n", + err); + + return err; + } + return 0; } diff --git a/sound/soc/codecs/rt5651.h b/sound/soc/codecs/rt5651.h index 3a0968c53fde..267a71395bd7 100644 --- a/sound/soc/codecs/rt5651.h +++ b/sound/soc/codecs/rt5651.h @@ -12,6 +12,7 @@ #ifndef __RT5651_H__ #define __RT5651_H__ +#include <linux/gpio/consumer.h> #include <dt-bindings/sound/rt5651.h> /* Info */ @@ -2071,6 +2072,7 @@ struct rt5651_pll_code { struct rt5651_priv { struct snd_soc_component *component; struct regmap *regmap; + struct gpio_desc *ext_amp_gpio; struct snd_soc_jack *hp_jack; struct work_struct jack_detect_work; unsigned int jd_src; -- 2.17.1

2 4

[alsa-devel] [PATCH v2 1/2] ALSA: ac97: add bus binding for codecs
by Robert Jarzmik 25 Jun '18

25 Jun '18

Add the generic ac97 bus binding, especially for ac97 codecs discovered by ac97 hardware probing. Signed-off-by: Robert Jarzmik <robert.jarzmik(a)free.fr> --- .../devicetree/bindings/sound/ac97-bus.txt | 32 ++++++++++++++++++++++ 1 file changed, 32 insertions(+) create mode 100644 Documentation/devicetree/bindings/sound/ac97-bus.txt diff --git a/Documentation/devicetree/bindings/sound/ac97-bus.txt b/Documentation/devicetree/bindings/sound/ac97-bus.txt new file mode 100644 index 000000000000..103c428f2595 --- /dev/null +++ b/Documentation/devicetree/bindings/sound/ac97-bus.txt @@ -0,0 +1,32 @@ +Generic AC97 Device Properties + +This documents describes the devicetree bindings for an ac97 controller child +node describing ac97 codecs. + +Required properties: +-compatible : Must be "ac97,vendor_id1,vendor_id2 + The ids shall be the 4 characters hexadecimal encoding, such as + given by "%04x" formatting of printf +-reg : Must be the ac97 codec number, between 0 and 3 + +Example: +ac97: sound@40500000 { + compatible = "marvell,pxa270-ac97"; + reg = < 0x40500000 0x1000 >; + interrupts = <14>; + reset-gpios = <&gpio 95 GPIO_ACTIVE_HIGH>; + #sound-dai-cells = <1>; + pinctrl-names = "default"; + pinctrl-0 = < &pinctrl_ac97_default >; + clocks = <&clks CLK_AC97>, <&clks CLK_AC97CONF>; + clock-names = "AC97CLK", "AC97CONFCLK"; + + #address-cells = <1>; + #size-cells = <0>; + audio-codec@0 { + reg = <0>; + compatible = "ac97,574d,4c13"; + clocks = <&fixed_wm9713_clock>; + clock-names = "ac97_clk"; + } +}; -- 2.11.0

3 3

[alsa-devel] audio samples data flow from user mode to kernel mode
by Subhashini Rao Beerisetty 25 Jun '18

25 Jun '18

Hello All, I’m trying to understand how audio samples transferred between user mode to kernel mode during playback and capture. I’m using aplay & arecord alsa utilities for playback and capture. Let us take a PCM wav file of sample rate 48000 and it has a total number of samples 480000 (Approx.Duration in seconds=10). Size of each sample is 8 bytes(two channels). After invocation of aplay from user mode, how does these audio samples gets copied to kernel mode? Can someone explain me on this? Is it possible to capture the timestamps for the first and last audio samples that arrive at the driver level? Can I consider the .trigger(for playback & capture) callback in SNDRV_PCM_TRIGGER_START case is timestamp for the first audio sample? Similarly does .trigger callbacks SNDRV_PCM_TRIGGER_STOP gives the last audio sample timestamp? Thanks,

3 3

[alsa-devel] [PATCH 1/2] ALSA: timer: Fix UBSAN warning at SNDRV_TIMER_IOCTL_NEXT_DEVICE ioctl
by Takashi Iwai 25 Jun '18

25 Jun '18

The kernel may spew a WARNING about UBSAN undefined behavior at handling ALSA timer ioctl SNDRV_TIMER_IOCTL_NEXT_DEVICE: UBSAN: Undefined behaviour in sound/core/timer.c:1524:19 signed integer overflow: 2147483647 + 1 cannot be represented in type 'int' Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x122/0x1c8 lib/dump_stack.c:113 ubsan_epilogue+0x12/0x86 lib/ubsan.c:159 handle_overflow+0x1c2/0x21f lib/ubsan.c:190 __ubsan_handle_add_overflow+0x2a/0x31 lib/ubsan.c:198 snd_timer_user_next_device sound/core/timer.c:1524 [inline] __snd_timer_user_ioctl+0x204d/0x2520 sound/core/timer.c:1939 snd_timer_user_ioctl+0x67/0x95 sound/core/timer.c:1994 .... It happens only when a value with INT_MAX is passed, as we're incrementing it unconditionally. So the fix is trivial, check the value with INT_MAX. Although the bug itself is fairly harmless, it's better to fix it so that fuzzers won't hit this again later. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=200213 Reported-and-tested-by: Team OWL337 <icytxw(a)gmail.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai(a)suse.de> --- sound/core/timer.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sound/core/timer.c b/sound/core/timer.c index 665089c45560..b6f076bbc72d 100644 --- a/sound/core/timer.c +++ b/sound/core/timer.c @@ -1520,7 +1520,7 @@ static int snd_timer_user_next_device(struct snd_timer_id __user *_tid) } else { if (id.subdevice < 0) id.subdevice = 0; - else + else if (id.subdevice < INT_MAX) id.subdevice++; } } -- 2.17.1

1 1

[alsa-devel] [PATCH] ALSA: hda/realtek - Fix the problem of two front mics on more machines
by Hui Wang 25 Jun '18

25 Jun '18

We have 3 more Lenovo machines, they all have 2 front mics on them, so they need the fixup to change the location for one of two mics. Among these 3 Lenovo machines, one of them has the same pin cfg as the machine with subid 0x17aa3138, so use the pin cfg table to apply fixup for them. The rest machines don't share the same pin cfg, so far use the subid to apply fixup for them. Fixes: a3dafb2200bf ("ALSA: hda/realtek - adjust the location of one mic") Cc: <stable(a)vger.kernel.org> Signed-off-by: Hui Wang <hui.wang(a)canonical.com> --- sound/pci/hda/patch_realtek.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c index 4834847..418f27b 100644 --- a/sound/pci/hda/patch_realtek.c +++ b/sound/pci/hda/patch_realtek.c @@ -6594,8 +6594,9 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { SND_PCI_QUIRK(0x17aa, 0x30bb, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY), SND_PCI_QUIRK(0x17aa, 0x30e2, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY), SND_PCI_QUIRK(0x17aa, 0x310c, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION), + SND_PCI_QUIRK(0x17aa, 0x312a, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION), SND_PCI_QUIRK(0x17aa, 0x312f, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION), - SND_PCI_QUIRK(0x17aa, 0x3138, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION), + SND_PCI_QUIRK(0x17aa, 0x3136, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION), SND_PCI_QUIRK(0x17aa, 0x313c, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION), SND_PCI_QUIRK(0x17aa, 0x3902, "Lenovo E50-80", ALC269_FIXUP_DMIC_THINKPAD_ACPI), SND_PCI_QUIRK(0x17aa, 0x3977, "IdeaPad S210", ALC283_FIXUP_INT_MIC), @@ -6773,6 +6774,12 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = { {0x14, 0x90170110}, {0x19, 0x02a11030}, {0x21, 0x02211020}), + SND_HDA_PIN_QUIRK(0x10ec0235, 0x17aa, "Lenovo", ALC294_FIXUP_LENOVO_MIC_LOCATION, + {0x14, 0x90170110}, + {0x19, 0x02a11030}, + {0x1a, 0x02a11040}, + {0x1b, 0x01014020}, + {0x21, 0x0221101f}), SND_HDA_PIN_QUIRK(0x10ec0236, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE, {0x12, 0x90a60140}, {0x14, 0x90170110}, -- 2.7.4

2 1

[alsa-devel] UBSAN: Undefined behaviour in sound/core/timer.c
by air icy 24 Jun '18

24 Jun '18

Hi, This bug was found in Linux Kernel v4.18-rc2 1521 if (id.subdevice < 0) 1522 id.subdevice = 0; 1523 else 1524 id.subdevice++; 1525 } 1526 } $ cat report5 ================================================================================ UBSAN: Undefined behaviour in sound/core/timer.c:1524:19 signed integer overflow: 2147483647 + 1 cannot be represented in type 'int' CPU: 0 PID: 7737 Comm: syz-executor0 Not tainted 4.18.0-rc1 #2 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.10.2-0-g5f4c7b1-prebuilt.qemu-project.org 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x122/0x1c8 lib/dump_stack.c:113 ubsan_epilogue+0x12/0x86 lib/ubsan.c:159 handle_overflow+0x1c2/0x21f lib/ubsan.c:190 __ubsan_handle_add_overflow+0x2a/0x31 lib/ubsan.c:198 snd_timer_user_next_device sound/core/timer.c:1524 [inline] __snd_timer_user_ioctl+0x204d/0x2520 sound/core/timer.c:1939 snd_timer_user_ioctl+0x67/0x95 sound/core/timer.c:1994 vfs_ioctl fs/ioctl.c:46 [inline] do_vfs_ioctl+0x1e8/0x1340 fs/ioctl.c:686 ksys_ioctl+0x9c/0xb0 fs/ioctl.c:701 __do_sys_ioctl fs/ioctl.c:708 [inline] __se_sys_ioctl fs/ioctl.c:706 [inline] __x64_sys_ioctl+0x81/0xd0 fs/ioctl.c:706 do_syscall_64+0xb8/0x3a0 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x455a09 Code: 1d ba fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb b9 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007f9d190edc68 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007f9d190ee6d4 RCX: 0000000000455a09 RDX: 0000000020000200 RSI: 00000000c0145401 RDI: 0000000000000013 RBP: 000000000072bea0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff R13: 0000000000000359 R14: 00000000006fa0f8 R15: 0000000000000000 ================================================================================ SELinux: unrecognized netlink message: protocol=0 nlmsg_type=7 sclass=netlink_route_socket pig=7762 comm=syz-executor0 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=7 sclass=netlink_route_socket pig=7766 comm=syz-executor0 sr 1:0:0:0: [sr0] tag#0 FAILED Result: hostbyte=DID_OK driverbyte=DRIVER_SENSE sr 1:0:0:0: [sr0] tag#0 Sense Key : Illegal Request [current] sr 1:0:0:0: [sr0] tag#0 Add. Sense: Invalid command operation code sr 1:0:0:0: [sr0] tag#0 CDB: Write(10) 2a 00 00 00 00 00 00 00 40 00 print_req_error: critical target error, dev sr0, sector 0 ... sr 1:0:0:0: [sr0] tag#0 FAILED Result: hostbyte=DID_ERROR driverbyte=DRIVER_OK sr 1:0:0:0: [sr0] tag#0 CDB: Write(16) 8a d0 47 23 7d 8d 1b 64 4d f6 e2 4e sr 1:0:0:0: [sr0] tag#0 FAILED Result: hostbyte=DID_ERROR driverbyte=DRIVER_OK sr 1:0:0:0: [sr0] tag#0 CDB: Write(16) 8a d0 47 23 7d 8d 1b 64 4d f6 e2 4e audit: type=1326 audit(1529712149.140:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=kernel pid=8226 comm="syz-executor1" exe="/syz-executor1" sig=31 arch=c000003e syscall=202 compat=0 ip=0x455a09 code=0x0 This bug can be repro, if you need it, please tell me. bugzilla url: https://bugzilla.kernel.org/show_bug.cgi?id=200213 Thanks, Icytxw

2 3