October 2020 - Alsa-devel - mailman.alsa-project.org

[PATCH] ASoC: qcom: sm8250: Fix array out of bounds access
by Srinivas Kandagatla 28 Oct '20

28 Oct '20

Static analysis Coverity had detected a potential array out-of-bounds write issue due to the fact that MAX AFE port Id was set to 16 instead of using AFE_PORT_MAX macro. Fix this by properly using AFE_PORT_MAX macro. Fixes: aa2e2785545a ("ASoC: qcom: sm8250: add sound card qrb5165-rb5 support") Reported-by: Colin Ian King <colin.king(a)canonical.com> Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla(a)linaro.org> --- sound/soc/qcom/sm8250.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/sound/soc/qcom/sm8250.c b/sound/soc/qcom/sm8250.c index 7d43de6d909f..52c40512102f 100644 --- a/sound/soc/qcom/sm8250.c +++ b/sound/soc/qcom/sm8250.c @@ -13,12 +13,11 @@ #define DRIVER_NAME "sm8250" #define MI2S_BCLK_RATE 1536000 -#define MAX_SDW_STREAMS 16 struct sm8250_snd_data { - bool stream_prepared[MAX_SDW_STREAMS]; + bool stream_prepared[AFE_PORT_MAX]; struct snd_soc_card *card; - struct sdw_stream_runtime *sruntime[MAX_SDW_STREAMS]; + struct sdw_stream_runtime *sruntime[AFE_PORT_MAX]; }; static int sm8250_be_hw_params_fixup(struct snd_soc_pcm_runtime *rtd, -- 2.21.0

3 2

[PATCH 1/2] ASoC: codecs: wcd934x: Set digital gain range correctly
by Srinivas Kandagatla 28 Oct '20

28 Oct '20

digital gain range is -84dB min to 40dB max, however this was not correctly specified in the range. Fix this by with correct range! Fixes: 1cde8b822332 ("ASoC: wcd934x: add basic controls") Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla(a)linaro.org> --- sound/soc/codecs/wcd934x.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sound/soc/codecs/wcd934x.c b/sound/soc/codecs/wcd934x.c index 35697b072367..40f682f5dab8 100644 --- a/sound/soc/codecs/wcd934x.c +++ b/sound/soc/codecs/wcd934x.c @@ -551,7 +551,7 @@ struct wcd_iir_filter_ctl { struct soc_bytes_ext bytes_ext; }; -static const DECLARE_TLV_DB_SCALE(digital_gain, 0, 1, 0); +static const DECLARE_TLV_DB_SCALE(digital_gain, -8400, 100, -8400); static const DECLARE_TLV_DB_SCALE(line_gain, 0, 7, 1); static const DECLARE_TLV_DB_SCALE(analog_gain, 0, 25, 1); static const DECLARE_TLV_DB_SCALE(ear_pa_gain, 0, 150, 0); -- 2.21.0

2 2

[PATCH v3 0/3] HDA controller PM and codec PM cleanups
by Kai-Heng Feng 28 Oct '20

28 Oct '20

While working on the issue "ALSA: hda: fix jack detection with Realtek codecs when in D3", I've found using pm_runtime_force_{suspend,resume}() have surprising behavior, specifically, pm_runtime_need_not_resume() uses pm_runtime_need_not_resume() to avoid calling resume callback, so jackpoll was used to really power up the codec. We can use direct-complete to do the keep the codec suspended throughout the system PM flow, namely, keep the codec suspended all the way, unless the codec needs to be woken up after resume. For HDA controller, PCI core may enable direct-complete for it if conditions are met. So make runtime and system PM distinctive to always apply correct wake up setting. At least point, hopefully all runtime PM issues are solved, let's enable runtime PM by default again. v3: - Drop "ALSA: hda: Stop mangling PCI IRQ" Kai-Heng Feng (3): ALSA: hda: Refactor codec PM to use direct-complete optimization ALSA: hda: Separate runtime and system suspend ALSA: hda: Reinstate runtime_allow() for all hda controllers sound/pci/hda/hda_codec.c | 45 +++++++++++++++--------- sound/pci/hda/hda_controller.h | 3 +- sound/pci/hda/hda_intel.c | 63 +++++++++++++++++++--------------- 3 files changed, 66 insertions(+), 45 deletions(-) -- 2.17.1

2 4

re: ASoC: qcom: sm8250: add sound card qrb5165-rb5 support
by Colin Ian King 28 Oct '20

28 Oct '20

Hi, Static analysis on linux-next with Coverity had detected a potential array out-of-bounds write issue in the following commit: commit aa2e2785545aab21b6cb2e23f111ae0751cbcca7 Author: Srinivas Kandagatla <srinivas.kandagatla(a)linaro.org> Date: Mon Oct 26 17:09:47 2020 +0000 ASoC: qcom: sm8250: add sound card qrb5165-rb5 support The analysis is as follows: 139 static int sm8250_snd_hw_free(struct snd_pcm_substream *substream) 140 { 141 struct snd_soc_pcm_runtime *rtd = substream->private_data; 142 struct sm8250_snd_data *data = snd_soc_card_get_drvdata(rtd->card); 143 struct snd_soc_dai *cpu_dai = asoc_rtd_to_cpu(rtd, 0); 144 struct sdw_stream_runtime *sruntime = data->sruntime[cpu_dai->id]; 145 1. Switch case value 105. 146 switch (cpu_dai->id) { 2. equality_cond: Jumping to case 105. 147 case WSA_CODEC_DMA_RX_0: 148 case WSA_CODEC_DMA_RX_1: Out-of-bounds write (OVERRUN) 3. Condition sruntime, taking true branch. 4. Condition data->stream_prepared[cpu_dai->id], taking true branch. 149 if (sruntime && data->stream_prepared[cpu_dai->id]) { 150 sdw_disable_stream(sruntime); 151 sdw_deprepare_stream(sruntime); Out-of-bounds write (OVERRUN) 5. overrun-local: Overrunning array data->stream_prepared of 16 bytes at byte offset 105 using index cpu_dai->id (which evaluates to 105). 152 data->stream_prepared[cpu_dai->id] = false; 153 } 154 break; 155 default: 156 break; 157 } 158 159 return 0; 160 } So cpu_dia->id is 105 in this case statement, and yet data->steam_prepared is an array of 16 elements, so this looks suspect. Colin

2 1

HP AIO Headset Mic issue
by Kailang 28 Oct '20

28 Oct '20

Hi Takashi, HP AIO had headset Mic can't be detected by boot time. Attach patch will fix it. Many Thanks. Kailang

2 1

[PATCH 1/2] ASoC: dt-bindings: fsl_aud2htx: Add binding doc for aud2htx module
by Shengjiu Wang 28 Oct '20

28 Oct '20

AUD2HTX (Audio Subsystem TO HDMI TX Subsystem) is a new IP module found on i.MX8MP. Signed-off-by: Shengjiu Wang <shengjiu.wang(a)nxp.com> --- .../bindings/sound/fsl,aud2htx.yaml | 67 +++++++++++++++++++ 1 file changed, 67 insertions(+) create mode 100644 Documentation/devicetree/bindings/sound/fsl,aud2htx.yaml diff --git a/Documentation/devicetree/bindings/sound/fsl,aud2htx.yaml b/Documentation/devicetree/bindings/sound/fsl,aud2htx.yaml new file mode 100644 index 000000000000..18548d0889a8 --- /dev/null +++ b/Documentation/devicetree/bindings/sound/fsl,aud2htx.yaml @@ -0,0 +1,67 @@ +# SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause) +%YAML 1.2 +--- +$id: http://devicetree.org/schemas/sound/fsl,aud2htx.yaml# +$schema: http://devicetree.org/meta-schemas/core.yaml# + +title: NXP Audio Subsystem to HDMI RTX Subsystem Controller + +maintainers: + - Shengjiu Wang <shengjiu.wang(a)nxp.com> + +properties: + $nodename: + pattern: "^aud2htx@.*" + + compatible: + const: fsl,imx8mp-aud2htx + + reg: + maxItems: 1 + + interrupts: + maxItems: 1 + + clocks: + items: + - description: Peripheral clock + + clock-names: + items: + - const: bus + + dmas: + items: + - description: DMA controller phandle and request line for TX + + dma-names: + items: + - const: tx + + power-domains: + maxItems: 1 + +required: + - compatible + - reg + - interrupts + - clocks + - clock-names + - dmas + - dma-names + +examples: + - | + #include <dt-bindings/interrupt-controller/arm-gic.h> + #include <dt-bindings/clock/imx8mp-clock.h> + + aud2htx: aud2htx@30cb0000 { + compatible = "fsl,imx8mp-aud2htx"; + reg = <0x30cb0000 0x10000>; + interrupts = <GIC_SPI 130 IRQ_TYPE_LEVEL_HIGH>; + clocks = <&audiomix_clk IMX8MP_CLK_AUDIOMIX_AUD2HTX_IPG>; + clock-names = "bus"; + dmas = <&sdma2 26 2 0>; + dma-names = "tx"; + power-domains = <&audiomix_pd>; + }; -- 2.27.0

4 5

Out of bounds array reference aplay.c playbackv_go function
by GitHub issues - opened 27 Oct '20

27 Oct '20

alsa-project/alsa-utils issue #70 was opened from ygator: I was looking through the aplay source file and came across an out of bounds reference. The reason I was looking through the code is that I am using an i2s amp and there is this code: `/usr/bin/aplay -D default -t raw -r 44100 -c 2 -f S16_LE /dev/zero /dev/zero` The reason for it is: > We've added an extra helper systemd script that will play quiet audio when the I2S peripheral isn't in use. This removes popping when playback starts or stops. It uses a tiny amount of CPU time (on a Pi Zero, 5%, on a Pi 2 or 3 its negligible). I thought there must be a way to just open the device and not have to use any CPU time actually playing nothing. If anyone knows if this is possible then let me know. Thanks. Any way back to the out of bounds. In the function playbackv_go function of aplay.c there is a call to perror(names[channel]). However, instead of channel being equal to zero it is equal to channels which is 1 + the number of names being passed to the function. > while (count > 0 && !in_aborting) { size_t c = 0; size_t expected = count / channels; if (expected > vsize) expected = vsize; do { **channel = 0; // Code to fix out of bound** r = safe_read(fds[0], bufs[0], expected); if (r < 0) { **perror(names[channel]); // Out of bounds reference** prg_exit(EXIT_FAILURE); } for (channel = 1; channel < channels; ++channel) { if (safe_read(fds[channel], bufs[channel], r) != r) { perror(names[channel]); prg_exit(EXIT_FAILURE); } } if (r == 0) break; c += r; } while (c < expected); Issue URL : https://github.com/alsa-project/alsa-utils/issues/70 Repository URL: https://github.com/alsa-project/alsa-utils

1 0

[PATCH] drm/vc4: hdmi: Avoid sleeping in atomic context
by Maxime Ripard 27 Oct '20

27 Oct '20

When running the trigger hook, ALSA by default will take a spinlock, and thus will run the trigger hook in atomic context. However, our HDMI driver will send the infoframes as part of the trigger hook, and part of that process is to wait for a bit to be cleared for up to 100ms. To be nicer to the system, that wait has some usleep_range that interact poorly with the atomic context. There's several ways we can fix this, but the more obvious one is to make ALSA take a mutex instead by setting the nonatomic flag on the DAI link. That doesn't work though, since now the cyclic callback installed by the dmaengine helpers in ALSA will take a mutex, while that callback is run by dmaengine's virt-chan code in a tasklet where sleeping is not allowed either. Given the delay we need to poll the bit for, changing the usleep_range for a udelay and keep running it from a context where interrupts are disabled is not really a good option either. However, we can move the infoframe setup code in the hw_params hook, like is usually done in other HDMI controllers, that isn't protected by a spinlock and thus where we can sleep. Infoframes will be sent on a regular basis anyway, and since hw_params is where the audio parameters that end up in the infoframes are setup, this also makes a bit more sense. Fixes: bb7d78568814 ("drm/vc4: Add HDMI audio support") Suggested-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Maxime Ripard <maxime(a)cerno.tech> --- drivers/gpu/drm/vc4/vc4_hdmi.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/vc4/vc4_hdmi.c b/drivers/gpu/drm/vc4/vc4_hdmi.c index 74da7c00ecd0..ec3ba3ecd32a 100644 --- a/drivers/gpu/drm/vc4/vc4_hdmi.c +++ b/drivers/gpu/drm/vc4/vc4_hdmi.c @@ -1077,6 +1077,7 @@ static int vc4_hdmi_audio_hw_params(struct snd_pcm_substream *substream, struct snd_soc_dai *dai) { struct vc4_hdmi *vc4_hdmi = dai_to_hdmi(dai); + struct drm_encoder *encoder = &vc4_hdmi->encoder.base.base; struct device *dev = &vc4_hdmi->pdev->dev; u32 audio_packet_config, channel_mask; u32 channel_map; @@ -1136,6 +1137,8 @@ static int vc4_hdmi_audio_hw_params(struct snd_pcm_substream *substream, HDMI_WRITE(HDMI_AUDIO_PACKET_CONFIG, audio_packet_config); vc4_hdmi_set_n_cts(vc4_hdmi); + vc4_hdmi_set_audio_infoframe(encoder); + return 0; } @@ -1143,11 +1146,9 @@ static int vc4_hdmi_audio_trigger(struct snd_pcm_substream *substream, int cmd, struct snd_soc_dai *dai) { struct vc4_hdmi *vc4_hdmi = dai_to_hdmi(dai); - struct drm_encoder *encoder = &vc4_hdmi->encoder.base.base; switch (cmd) { case SNDRV_PCM_TRIGGER_START: - vc4_hdmi_set_audio_infoframe(encoder); vc4_hdmi->audio.streaming = true; if (vc4_hdmi->variant->phy_rng_enable) -- 2.26.2

3 3

dapm, device tree, clock control - questions
by Eliot Blennerhassett 27 Oct '20

27 Oct '20

Greetings, First the basic questions, so you can quickly stop reading if this is not your thing. Background details follow. Specific answers, or pointers to relevant reading both appreciated. 1) How do I force a DAI clock to keep running even when no audio is streaming? Can I do this with DT, or some runtime switch? OR how do I disable dapm so everything is powered on all the time? 2) Two devices: one DAC, one dumb digital audio transmitter both connected to same serial audio data - how to model the second one in DT (or not)? it has some settings needed after clock starts, must keep clock running. I have host CPU imx8mm DAI is sound/soc/fsl/fsl_sai.c The codec is sound/soc/codecs/ak4458.c The digital audio transmitter is CS8406 (no driver yet?). Both the above are connected to the same DAI signals (MCLK, TXC, TXFS, TXD) CS8406 needs MCLK before it can be configured, and loses config if clock stops. Currently it is configured via I2C from userspace, but this is completely unaware of stream stop/start. Is there a way to hook into stream state events so that this setup can be done after the MCLK starts before audio starts? I desire for no discontinuity in analog or digital outputs as streams stop and start. I have read Documentation/sound/soc/dapm.rst and its brothers. Documentation/devicetree/* is there elsewhere I should read to get a newbies intro to this stuff? It must be about 8 years since I did any ALSA development, and then I wasn't in the ASoC space, so quite a learning curve here. many thanks -- Eliot

1 1

[PATCH v2] ASoC: qcom: qdsp6: make use of devm_of_platform_populate
by Srinivas Kandagatla 27 Oct '20

27 Oct '20

make use of devm_of_platform_populate to remove some redundant code! Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla(a)linaro.org> --- Changes since v1: rebased on top of sound-next sound/soc/qcom/qdsp6/q6adm.c | 10 +--------- sound/soc/qcom/qdsp6/q6afe.c | 10 +--------- sound/soc/qcom/qdsp6/q6asm.c | 10 +--------- 3 files changed, 3 insertions(+), 27 deletions(-) diff --git a/sound/soc/qcom/qdsp6/q6adm.c b/sound/soc/qcom/qdsp6/q6adm.c index 72f29720398c..1855b805eba2 100644 --- a/sound/soc/qcom/qdsp6/q6adm.c +++ b/sound/soc/qcom/qdsp6/q6adm.c @@ -601,14 +601,7 @@ static int q6adm_probe(struct apr_device *adev) INIT_LIST_HEAD(&adm->copps_list); spin_lock_init(&adm->copps_list_lock); - return of_platform_populate(dev->of_node, NULL, NULL, dev); -} - -static int q6adm_remove(struct apr_device *adev) -{ - of_platform_depopulate(&adev->dev); - - return 0; + return devm_of_platform_populate(dev); } #ifdef CONFIG_OF @@ -621,7 +614,6 @@ MODULE_DEVICE_TABLE(of, q6adm_device_id); static struct apr_driver qcom_q6adm_driver = { .probe = q6adm_probe, - .remove = q6adm_remove, .callback = q6adm_callback, .driver = { .name = "qcom-q6adm", diff --git a/sound/soc/qcom/qdsp6/q6afe.c b/sound/soc/qcom/qdsp6/q6afe.c index 0ca1e4aae518..daa58b5f941e 100644 --- a/sound/soc/qcom/qdsp6/q6afe.c +++ b/sound/soc/qcom/qdsp6/q6afe.c @@ -1740,14 +1740,7 @@ static int q6afe_probe(struct apr_device *adev) dev_set_drvdata(dev, afe); - return of_platform_populate(dev->of_node, NULL, NULL, dev); -} - -static int q6afe_remove(struct apr_device *adev) -{ - of_platform_depopulate(&adev->dev); - - return 0; + return devm_of_platform_populate(dev); } #ifdef CONFIG_OF @@ -1760,7 +1753,6 @@ MODULE_DEVICE_TABLE(of, q6afe_device_id); static struct apr_driver qcom_q6afe_driver = { .probe = q6afe_probe, - .remove = q6afe_remove, .callback = q6afe_callback, .driver = { .name = "qcom-q6afe", diff --git a/sound/soc/qcom/qdsp6/q6asm.c b/sound/soc/qcom/qdsp6/q6asm.c index c547c560cb24..a6618efe22f2 100644 --- a/sound/soc/qcom/qdsp6/q6asm.c +++ b/sound/soc/qcom/qdsp6/q6asm.c @@ -1727,14 +1727,7 @@ static int q6asm_probe(struct apr_device *adev) spin_lock_init(&q6asm->slock); dev_set_drvdata(dev, q6asm); - return of_platform_populate(dev->of_node, NULL, NULL, dev); -} - -static int q6asm_remove(struct apr_device *adev) -{ - of_platform_depopulate(&adev->dev); - - return 0; + return devm_of_platform_populate(dev); } #ifdef CONFIG_OF @@ -1747,7 +1740,6 @@ MODULE_DEVICE_TABLE(of, q6asm_device_id); static struct apr_driver qcom_q6asm_driver = { .probe = q6asm_probe, - .remove = q6asm_remove, .callback = q6asm_srvc_callback, .driver = { .name = "qcom-q6asm", -- 2.21.0

2 1