May 2019 - Alsa-devel - mailman.alsa-project.org

[alsa-devel] [PATCH] ALSA: Use struct_size() helper
by Gustavo A. R. Silva 24 May '19

24 May '19

Make use of the struct_size() helper instead of an open-coded version in order to avoid any potential type mistakes, in particular in the context in which this code is being used. So, replace the following form: sizeof(struct rate_priv) + src_format->channels * sizeof(struct rate_channel) with: struct_size(data, channels, src_format->channels) This code was detected with the help of Coccinelle. Signed-off-by: Gustavo A. R. Silva <gustavo(a)embeddedor.com> --- sound/core/oss/rate.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/sound/core/oss/rate.c b/sound/core/oss/rate.c index 2fa9299a440d..7cd09cef6961 100644 --- a/sound/core/oss/rate.c +++ b/sound/core/oss/rate.c @@ -323,8 +323,8 @@ int snd_pcm_plugin_build_rate(struct snd_pcm_substream *plug, err = snd_pcm_plugin_build(plug, "rate conversion", src_format, dst_format, - sizeof(struct rate_priv) + - src_format->channels * sizeof(struct rate_channel), + struct_size(data, channels, + src_format->channels), &plugin); if (err < 0) return err; -- 2.21.0

2 1

Re: [alsa-devel] [PATCH] ASoC: fsl_esai: fix the channel swap issue after xrun
by S.j. Wang 24 May '19

24 May '19

Hi > On Thu, May 23, 2019 at 09:53:42AM +0000, S.j. Wang wrote: > > > > + /* > > > > + * Add fifo reset here, because the regcache_sync will > > > > + * write one more data to ETDR. > > > > + * Which will cause channel shift. > > > > > > Sounds like a bug to me...should fix it first by marking the data > > > registers as volatile. > > > > > The ETDR is a writable register, it is not volatile. Even we change it > > to Volatile, I don't think we can't avoid this issue. for the > > regcache_sync Just to write this register, it is correct behavior. > > Is that so? Quoting the comments of regcache_sync(): > "* regcache_sync - Sync the register cache with the hardware. > * > * @map: map to configure. > * > * Any registers that should not be synced should be marked as > * volatile." > > If regcache_sync() does sync volatile registers too as you said, I don't mind > having this FIFO reset WAR for now, though I think this mismatch between > the comments and the actual behavior then should get people's attention. > > Thank you ETDR is not volatile, if we mark it is volatile, is it correct? Bets regards Wang shengjiu

2 1

[alsa-devel] [PATCH] ASoC: Intel: Skylake: Use struct_size() helper
by Gustavo A. R. Silva 24 May '19

24 May '19

Make use of the struct_size() helper instead of an open-coded version in order to avoid any potential type mistakes, in particular in the context in which this code is being used. So, replace the following form: uuid_params->num_modules * sizeof(struct skl_mod_inst_map) + sizeof(uuid_params->num_modules) with: struct_size(params, u.map, uuid_params->num_modules) and so on... This code was detected with the help of Coccinelle. Signed-off-by: Gustavo A. R. Silva <gustavo(a)embeddedor.com> --- sound/soc/intel/skylake/skl-topology.c | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/sound/soc/intel/skylake/skl-topology.c b/sound/soc/intel/skylake/skl-topology.c index 389f1862bc43..c69d999d7bf1 100644 --- a/sound/soc/intel/skylake/skl-topology.c +++ b/sound/soc/intel/skylake/skl-topology.c @@ -941,9 +941,7 @@ static int skl_tplg_find_moduleid_from_uuid(struct skl *skl, if (bc->set_params == SKL_PARAM_BIND && bc->max) { uuid_params = (struct skl_kpb_params *)bc->params; - size = uuid_params->num_modules * - sizeof(struct skl_mod_inst_map) + - sizeof(uuid_params->num_modules); + size = struct_size(params, u.map, uuid_params->num_modules); params = devm_kzalloc(bus->dev, size, GFP_KERNEL); if (!params) @@ -3315,7 +3313,7 @@ static int skl_tplg_get_int_tkn(struct device *dev, struct snd_soc_tplg_vendor_value_elem *tkn_elem, struct skl *skl) { - int tkn_count = 0, ret, size; + int tkn_count = 0, ret; static int mod_idx, res_val_idx, intf_val_idx, dir, pin_idx; struct skl_module_res *res = NULL; struct skl_module_iface *fmt = NULL; @@ -3323,6 +3321,7 @@ static int skl_tplg_get_int_tkn(struct device *dev, static struct skl_astate_param *astate_table; static int astate_cfg_idx, count; int i; + size_t size; if (skl->modules) { mod = skl->modules[mod_idx]; @@ -3366,8 +3365,8 @@ static int skl_tplg_get_int_tkn(struct device *dev, return -EINVAL; } - size = tkn_elem->value * sizeof(struct skl_astate_param) + - sizeof(count); + size = struct_size(skl->cfg.astate_cfg, astate_table, + tkn_elem->value); skl->cfg.astate_cfg = devm_kzalloc(dev, size, GFP_KERNEL); if (!skl->cfg.astate_cfg) return -ENOMEM; -- 2.21.0

1 0

[alsa-devel] [PATCH] ASoC: dapm: Use struct_size() in krealloc()
by Gustavo A. R. Silva 23 May '19

23 May '19

One of the more common cases of allocation size calculations is finding the size of a structure that has a zero-sized array at the end, along with memory for some number of elements for that array. For example: struct foo { int stuff; struct boo entry[]; }; instance = krealloc(instance, sizeof(struct foo) + count * sizeof(struct boo), GFP_KERNEL); Instead of leaving these open-coded and prone to type mistakes, use the new struct_size() helper: instance = krealloc(instance, struct_size(instance, entry, count), GFP_KERNEL); This code was detected with the help of Coccinelle. Signed-off-by: Gustavo A. R. Silva <gustavo(a)embeddedor.com> --- sound/soc/soc-dapm.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c index b71ddaca70e5..511ed84b147b 100644 --- a/sound/soc/soc-dapm.c +++ b/sound/soc/soc-dapm.c @@ -487,7 +487,8 @@ static int dapm_kcontrol_add_widget(struct snd_kcontrol *kcontrol, n = 1; new_wlist = krealloc(data->wlist, - sizeof(*new_wlist) + sizeof(widget) * n, GFP_KERNEL); + struct_size(new_wlist, widgets, n), + GFP_KERNEL); if (!new_wlist) return -ENOMEM; -- 2.21.0

1 0

[alsa-devel] No sound on Asrock Z68 Extreme4
by Marcin Juszkiewicz 23 May '19

23 May '19

I recently moved my home machine to Asrock Z68 Extreme4 mainboard. Booted into Fedora 30 and found out that my speakers are not making any sound. alsa-info.sh output: http://alsa-project.org/db/?f=9c079d91b5f2278d3c3bd98518a6a717c86d31df Pulseaudio says that are no speakers connected and 'hdajacksensetest' says the same: 21:08 (0s) hrw@puchatek:~$ sudo hdajacksensetest Pin 0x14 (Green Line Out, Rear side): present = No Pin 0x15 (Black Line Out, Rear side): present = No Pin 0x16 (Orange Line Out, Rear side): present = No Pin 0x18 (Pink Mic, Rear side): present = No Pin 0x1a (Blue Line In, Rear side): present = No I noticed 'hdajackretask' tool but no idea how to use it properly. Any ideas?

1 0

[alsa-devel] [PATCH 1/1] ALSA: usb-audio: Fix UAF decrement if card has no live interfaces in card.c
by Suren Baghdasaryan 23 May '19

23 May '19

Commit 5f8cf712582617d523120df67d392059eaf2fc4b upstream. This is a backport to stable 3.18.y. Implementation in 3.18 differs using chip->probing flag instead of chip->active atomic but it still has the UAF issue. If a USB sound card reports 0 interfaces, an error condition is triggered and the function usb_audio_probe errors out. In the error path, there was a use-after-free vulnerability where the memory object of the card was first freed, followed by a decrement of the number of active chips. Moving the decrement above the atomic_dec fixes the UAF. [ The original problem was introduced in 3.1 kernel, while it was developed in a different form. The Fixes tag below indicates the original commit but it doesn't mean that the patch is applicable cleanly. -- tiwai ] Fixes: 362e4e49abe5 ("ALSA: usb-audio - clear chip->probing on error exit") Reported-by: Hui Peng <benquike(a)gmail.com> Reported-by: Mathias Payer <mathias.payer(a)nebelwelt.net> Signed-off-by: Hui Peng <benquike(a)gmail.com> Signed-off-by: Mathias Payer <mathias.payer(a)nebelwelt.net> Cc: <stable(a)vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai(a)suse.de> [surenb(a)google.com: resolve 3.18 differences] Signed-off-by: Suren Baghdasaryan <surenb(a)google.com> --- Analysis for 3.18 codebase: snd_usb_audio_create() sets card->device_data = chip snd_usb_audio_probe() calls snd_card_free() and then resets chip->probing snd_card_free() results in the following call chain: snd_card_free_when_closed() which waits on release_completion snd_card_do_free() calls snd_device_free_all() and signals release_completion snd_card_do_free() calls __snd_device_free() __snd_device_free() calls dev->ops->dev_free() == snd_usb_audio_dev_free() snd_usb_audio_dev_free() calls snd_usb_audio_free(chip) and frees "chip" chip->probing = 0 results in UAF sound/usb/card.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/sound/usb/card.c b/sound/usb/card.c index f7dbdc10bf77..59fb1ef3cd55 100644 --- a/sound/usb/card.c +++ b/sound/usb/card.c @@ -593,9 +593,12 @@ snd_usb_audio_probe(struct usb_device *dev, __error: if (chip) { + /* chip->probing is inside the chip->card object, + * reset before memory is possibly returned. + */ + chip->probing = 0; if (!chip->num_interfaces) snd_card_free(chip->card); - chip->probing = 0; } mutex_unlock(&register_mutex); __err_val: -- 2.21.0.1020.gf2820cf01a-goog

2 1

[alsa-devel] [PATCH] ASoC: core: lock client_mutex while removing link components
by Ranjani Sridharan 23 May '19

23 May '19

Removing link components results in topology unloading. So, acquire the client_mutex before removing components in soc_remove_link_components. This will prevent the lockdep warning seen when dai links are removed during topology removal. Signed-off-by: Ranjani Sridharan <ranjani.sridharan(a)linux.intel.com> --- sound/soc/soc-core.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c index ce8c057bcd5b..bbb52fbd195e 100644 --- a/sound/soc/soc-core.c +++ b/sound/soc/soc-core.c @@ -1010,12 +1010,14 @@ static void soc_remove_link_components(struct snd_soc_card *card, struct snd_soc_component *component; struct snd_soc_rtdcom_list *rtdcom; + mutex_lock(&client_mutex); for_each_rtdcom(rtd, rtdcom) { component = rtdcom->component; if (component->driver->remove_order == order) soc_remove_component(component); } + mutex_unlock(&client_mutex); } static void soc_remove_dai_links(struct snd_soc_card *card) -- 2.17.1

2 1

[alsa-devel] [PATCH] ASoC: qdsp6: q6core: Use struct_size() in kmemdup()
by Gustavo A. R. Silva 23 May '19

23 May '19

Make use of the struct_size() helper instead of an open-coded version in order to avoid any potential type mistakes, in particular in the context in which this code is being used. So, replace code of the following form: sizeof(*fwk) + fwk->num_services * sizeof(fwk->svc_api_info[0]); with: struct_size(fwk, svc_api_info, fwk->num_services) and so on... Notice that variables bytes and len are unnecessary, hence they are removed. This code was detected with the help of Coccinelle. Signed-off-by: Gustavo A. R. Silva <gustavo(a)embeddedor.com> --- sound/soc/qcom/qdsp6/q6core.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/sound/soc/qcom/qdsp6/q6core.c b/sound/soc/qcom/qdsp6/q6core.c index cdfc8ab6cfc0..ae314a652efe 100644 --- a/sound/soc/qcom/qdsp6/q6core.c +++ b/sound/soc/qcom/qdsp6/q6core.c @@ -98,13 +98,13 @@ static int q6core_callback(struct apr_device *adev, struct apr_resp_pkt *data) } case AVCS_CMDRSP_GET_FWK_VERSION: { struct avcs_cmdrsp_get_fwk_version *fwk; - int bytes; fwk = data->payload; - bytes = sizeof(*fwk) + fwk->num_services * - sizeof(fwk->svc_api_info[0]); - core->fwk_version = kmemdup(data->payload, bytes, GFP_ATOMIC); + core->fwk_version = kmemdup(data->payload, + struct_size(fwk, svc_api_info, + fwk->num_services), + GFP_ATOMIC); if (!core->fwk_version) return -ENOMEM; @@ -115,13 +115,13 @@ static int q6core_callback(struct apr_device *adev, struct apr_resp_pkt *data) } case AVCS_GET_VERSIONS_RSP: { struct avcs_cmdrsp_get_version *v; - int len; v = data->payload; - len = sizeof(*v) + v->num_services * sizeof(v->svc_api_info[0]); - - core->svc_version = kmemdup(data->payload, len, GFP_ATOMIC); + core->svc_version = kmemdup(data->payload, + struct_size(v, svc_api_info, + v->num_services), + GFP_ATOMIC); if (!core->svc_version) return -ENOMEM; -- 2.21.0

1 0

[alsa-devel] [PATCH 1/5] ASoC: madera: Add DT bindings for Cirrus Logic Madera codecs
by Charles Keepax 23 May '19

23 May '19

From: Richard Fitzgerald <rf(a)opensource.cirrus.com> The Cirrus Logic Madera codecs are a family of related codecs with extensive digital and analogue I/O, digital mixing and routing, signal processing and programmable DSPs. Signed-off-by: Richard Fitzgerald <rf(a)opensource.cirrus.com> Signed-off-by: Charles Keepax <ckeepax(a)opensource.cirrus.com> --- Documentation/devicetree/bindings/sound/madera.txt | 67 ++++++++++++++++++++++ MAINTAINERS | 1 + include/dt-bindings/sound/madera.h | 29 ++++++++++ 3 files changed, 97 insertions(+) create mode 100644 Documentation/devicetree/bindings/sound/madera.txt create mode 100644 include/dt-bindings/sound/madera.h diff --git a/Documentation/devicetree/bindings/sound/madera.txt b/Documentation/devicetree/bindings/sound/madera.txt new file mode 100644 index 0000000000000..1114fcf1aa4c2 --- /dev/null +++ b/Documentation/devicetree/bindings/sound/madera.txt @@ -0,0 +1,67 @@ +Cirrus Logic Madera class audio codecs + +This describes audio configuration bindings for these codecs. + +See also the core bindings for the parent MFD driver: +See Documentation/devicetree/bindings/mfd/madera.txt + +and defines for values used in these bindings: +include/dt-bindings/sound/madera.h + +These properties are all contained in the parent MFD node. + +Optional properties: + - cirrus,dmic-ref : Indicates how the MICBIAS pins have been externally + connected to DMICs on each input, one cell per input. + <IN1 IN2 IN3 ...> + A value of 0 indicates MICVDD and is the default, other values depend on the + codec: + For CS47L35 one of the CS47L35_DMIC_REF_xxx values + For all other codecs one of the MADERA_DMIC_REF_xxx values + Also see the datasheet for a description of the INn_DMIC_SUP field. + + - cirrus,inmode : A list of input mode settings for each input. A maximum of + 16 cells, with four cells per input in the order INnAL, INnAR INnBL INnBR. + For non-muxed inputs the first two cells for that input set the mode for + the left and right channel and the second two cells must be 0. + For muxed inputs the first two cells for that input set the mode of the + left and right A inputs and the second two cells set the mode of the left + and right B inputs. + Valid mode values are one of the MADERA_INMODE_xxx. If the array is shorter + than the number of inputs the unspecified inputs default to + MADERA_INMODE_DIFF. + + - cirrus,out-mono : Mono bit for each output, must contain six cells if + specified. A non-zero value indicates the corresponding output is mono. + + - cirrus,max-channels-clocked : Maximum number of channels that I2S clocks + will be generated for. Useful when clock master for systems where the I2S + bus has multiple data lines. + One cell for each AIF, use a value of zero for AIFs that should be handled + normally. + + - cirrus,pdm-fmt : PDM speaker data format, must contain 2 cells + (OUT5 and OUT6). See the PDM_SPKn_FMT field in the datasheet for a + description of this value. + The second cell is ignored for codecs that do not have OUT6. + + - cirrus,pdm-mute : PDM mute format, must contain 2 cells + (OUT5 and OUT6). See the PDM_SPKn_CTRL_1 register in the datasheet for a + description of this value. + The second cell is ignored for codecs that do not have OUT6. + +Example: + +cs47l35@0 { + compatible = "cirrus,cs47l35"; + + cirrus,dmic-ref = <0 0 CS47L35_DMIC_REF_MICBIAS1B 0>; + cirrus,inmode = < + MADERA_INMODE_DMIC MADERA_INMODE_DMIC /* IN1A digital */ + MADERA_INMODE_SE MADERA_INMODE_SE /* IN1B single-ended */ + MADERA_INMODE_DIFF MADERA_INMODE_DIFF /* IN2 differential */ + 0 0 /* not used on this codec */ + >; + cirrus,out-mono = <0 0 0 0 0 0>; + cirrus,max-channels-clocked = <2 0 0>; +}; diff --git a/MAINTAINERS b/MAINTAINERS index 5cfbea4ce5750..642cb5610dd50 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -3915,6 +3915,7 @@ W: https://github.com/CirrusLogic/linux-drivers/wiki S: Supported F: Documentation/devicetree/bindings/mfd/madera.txt F: Documentation/devicetree/bindings/pinctrl/cirrus,madera-pinctrl.txt +F: include/dt-bindings/sound/madera* F: include/linux/irqchip/irq-madera* F: include/linux/mfd/madera/* F: drivers/gpio/gpio-madera* diff --git a/include/dt-bindings/sound/madera.h b/include/dt-bindings/sound/madera.h new file mode 100644 index 0000000000000..9ff4eae5259b0 --- /dev/null +++ b/include/dt-bindings/sound/madera.h @@ -0,0 +1,29 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +/* + * Device Tree defines for Madera codecs + * + * Copyright (C) 2016-2017 Cirrus Logic, Inc. and + * Cirrus Logic International Semiconductor Ltd. + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License version 2 as + * published by the Free Software Foundation. + */ + +#ifndef DT_BINDINGS_SOUND_MADERA_H +#define DT_BINDINGS_SOUND_MADERA_H + +#define MADERA_INMODE_DIFF 0 +#define MADERA_INMODE_SE 1 +#define MADERA_INMODE_DMIC 2 + +#define MADERA_DMIC_REF_MICVDD 0 +#define MADERA_DMIC_REF_MICBIAS1 1 +#define MADERA_DMIC_REF_MICBIAS2 2 +#define MADERA_DMIC_REF_MICBIAS3 3 + +#define CS47L35_DMIC_REF_MICBIAS1B 1 +#define CS47L35_DMIC_REF_MICBIAS2A 2 +#define CS47L35_DMIC_REF_MICBIAS2B 3 + +#endif -- 2.11.0

1 2

[alsa-devel] [PATCH] ASoC: Mediatek: MT8183: enable dev runtime suspend and resume
by Jiaxin Yu 23 May '19

23 May '19

System suspend will power off audio, so we need regcache sync when system resume. Remove pm_runtime_get_sync in dev probe and pm_runtime_put_sync in dev remove.So that audio dev can triggle runitme suspend and resume. Signed-off-by: Jiaxin Yu <jiaxin.yu(a)mediatek.com> --- Hi, This patch is based on for-next and test passed. --- sound/soc/mediatek/mt8183/mt8183-afe-pcm.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/sound/soc/mediatek/mt8183/mt8183-afe-pcm.c b/sound/soc/mediatek/mt8183/mt8183-afe-pcm.c index 56c3732..4a31106 100644 --- a/sound/soc/mediatek/mt8183/mt8183-afe-pcm.c +++ b/sound/soc/mediatek/mt8183/mt8183-afe-pcm.c @@ -1142,8 +1142,6 @@ static int mt8183_afe_pcm_dev_probe(struct platform_device *pdev) regcache_cache_only(afe->regmap, true); regcache_mark_dirty(afe->regmap); - pm_runtime_get_sync(&pdev->dev); - /* init memif */ afe->memif_size = MT8183_MEMIF_NUM; afe->memif = devm_kcalloc(dev, afe->memif_size, sizeof(*afe->memif), @@ -1235,11 +1233,10 @@ static int mt8183_afe_pcm_dev_probe(struct platform_device *pdev) static int mt8183_afe_pcm_dev_remove(struct platform_device *pdev) { - pm_runtime_put_sync(&pdev->dev); - pm_runtime_disable(&pdev->dev); if (!pm_runtime_status_suspended(&pdev->dev)) mt8183_afe_runtime_suspend(&pdev->dev); + return 0; } -- 1.8.1.1.dirty

2 2