September 2021 - Alsa-devel - mailman.alsa-project.org

Behringer UFX1604 and UFX1204 unneeded implicit feedback
by Geraldo Nascimento 30 Sep '21

30 Sep '21

Hello Takashi and everyone, Behringer UFX1204 and UFX1604 have sync endpoints and we set up implicit feedback sync on them. This is against the UAC spec. We've already fixed a major source of noise by explictly setting up the Clock Selector. Therefore in my humble opinion we should now disable implicit feedback sync for those two devices. What do you think? Thank you, Geraldo Nascimento

3 3

[PATCH] Fixes HP Spectre x360 15-eb1xxx speakers
by Davide Baldo 30 Sep '21

30 Sep '21

First kernel contribution, I only tested this patch myself on a 5.14.7. There is probably some way to fix the remaining issues, but I need some guidance on how I could test the different pinouts since hdajackretask hangs the audio card and I can't test out combinations. In the meantime this commit fix the most serius problem: silent speakers. In laptop 'HP Spectre x360 Convertible 15-eb1xxx/8811' both front and rear speakers are silent, this patch fixes that by overriding the pin layout and by initializing the amplifier which needs a GPIO pin to be set to 1 then 0, similar to the existing HP Spectre x360 14 model. This patch also correctly map the mute LED but since there is no microphone on/off switch exposed by the alsa subsystem it never turns on by itself. There are still known audio issues in this laptop: headset microphone doesn't work, the button to mute/unmute microphone is not yet mapped, the LED of the mute/unmute speakers doesn't seems to be exposed via GPIO and never turns on. Signed-off-by: Davide Baldo <davide(a)baldo.me> --- sound/pci/hda/patch_realtek.c | 41 ++++++++++++++++++++++++++++++++++- 1 file changed, 40 insertions(+), 1 deletion(-) diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c index 70516527ebce..90f845976793 100644 --- a/sound/pci/hda/patch_realtek.c +++ b/sound/pci/hda/patch_realtek.c @@ -6414,6 +6414,38 @@ static void alc_fixup_no_int_mic(struct hda_codec *codec, } } +/* GPIO1 = amplifier on/off + * GPIO3 = mic mute LED + */ +static void alc285_fixup_hp_spectre_x360_eb1(struct hda_codec *codec, + const struct hda_fixup *fix, int action) +{ + struct alc_spec *spec = codec->spec; + static const struct hda_pintbl pincfgs[] = { + { 0x14, 0x90170110 }, /* front speakers */ + { } + }; + + //enable micmute led + alc_fixup_hp_gpio_led(codec, action, 0x00, 0x04); + spec->micmute_led_polarity = 1; + + switch (action) { + case HDA_FIXUP_ACT_PRE_PROBE: + /* needed for amp of back speakers */ + spec->gpio_mask |= 0x01; + spec->gpio_dir |= 0x01; + snd_hda_apply_pincfgs(codec, pincfgs); + break; + case HDA_FIXUP_ACT_INIT: + /* need to toggle GPIO to enable the amp of back speakers */ + alc_update_gpio_data(codec, 0x01, true); + msleep(100); + alc_update_gpio_data(codec, 0x01, false); + break; + } +} + static void alc285_fixup_hp_spectre_x360(struct hda_codec *codec, const struct hda_fixup *fix, int action) { @@ -6534,6 +6566,7 @@ enum { ALC269_FIXUP_HP_DOCK_GPIO_MIC1_LED, ALC280_FIXUP_HP_9480M, ALC245_FIXUP_HP_X360_AMP, + ALC285_FIXUP_HP_SPECTRE_X360_EB1, ALC288_FIXUP_DELL_HEADSET_MODE, ALC288_FIXUP_DELL1_MIC_NO_PRESENCE, ALC288_FIXUP_DELL_XPS_13, @@ -6658,7 +6691,7 @@ enum { ALC287_FIXUP_IDEAPAD_BASS_SPK_AMP, ALC623_FIXUP_LENOVO_THINKSTATION_P340, ALC255_FIXUP_ACER_HEADPHONE_AND_MIC, - ALC236_FIXUP_HP_LIMIT_INT_MIC_BOOST, + ALC236_FIXUP_HP_LIMIT_INT_MIC_BOOST }; static const struct hda_fixup alc269_fixups[] = { @@ -8222,6 +8255,10 @@ static const struct hda_fixup alc269_fixups[] = { .type = HDA_FIXUP_FUNC, .v.func = alc285_fixup_hp_spectre_x360, }, + [ALC285_FIXUP_HP_SPECTRE_X360_EB1] = { + .type = HDA_FIXUP_FUNC, + .v.func = alc285_fixup_hp_spectre_x360_eb1 + }, [ALC287_FIXUP_IDEAPAD_BASS_SPK_AMP] = { .type = HDA_FIXUP_FUNC, .v.func = alc285_fixup_ideapad_s740_coef, @@ -8415,6 +8452,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { SND_PCI_QUIRK(0x103c, 0x84da, "HP OMEN dc0019-ur", ALC295_FIXUP_HP_OMEN), SND_PCI_QUIRK(0x103c, 0x84e7, "HP Pavilion 15", ALC269_FIXUP_HP_MUTE_LED_MIC3), SND_PCI_QUIRK(0x103c, 0x8519, "HP Spectre x360 15-df0xxx", ALC285_FIXUP_HP_SPECTRE_X360), + SND_PCI_QUIRK(0x103c, 0x8811, "HP Spectre x360 15-eb1xxx", ALC285_FIXUP_HP_SPECTRE_X360_EB1), SND_PCI_QUIRK(0x103c, 0x861f, "HP Elite Dragonfly G1", ALC285_FIXUP_HP_GPIO_AMP_INIT), SND_PCI_QUIRK(0x103c, 0x869d, "HP", ALC236_FIXUP_HP_MUTE_LED), SND_PCI_QUIRK(0x103c, 0x86c7, "HP Envy AiO 32", ALC274_FIXUP_HP_ENVY_GPIO), @@ -8858,6 +8896,7 @@ static const struct hda_model_fixup alc269_fixup_models[] = { {.id = ALC245_FIXUP_HP_X360_AMP, .name = "alc245-hp-x360-amp"}, {.id = ALC295_FIXUP_HP_OMEN, .name = "alc295-hp-omen"}, {.id = ALC285_FIXUP_HP_SPECTRE_X360, .name = "alc285-hp-spectre-x360"}, + {.id = ALC285_FIXUP_HP_SPECTRE_X360_EB1, .name = "alc285-hp-spectre-x360-eb1"}, {.id = ALC287_FIXUP_IDEAPAD_BASS_SPK_AMP, .name = "alc287-ideapad-bass-spk-amp"}, {.id = ALC623_FIXUP_LENOVO_THINKSTATION_P340, .name = "alc623-lenovo-thinkstation-p340"}, {.id = ALC255_FIXUP_ACER_HEADPHONE_AND_MIC, .name = "alc255-acer-headphone-and-mic"}, -- 2.32.0

3 5

[PATCH] ALSA: seq: Fix a potential UAF by wrong private_free call order
by Takashi Iwai 30 Sep '21

30 Sep '21

John Keeping reported and posted a patch for a potential UAF in rawmidi sequencer destruction: the snd_rawmidi_dev_seq_free() may be called after the associated rawmidi object got already freed. After a deeper look, it turned out that the bug is rather the incorrect private_free call order for a snd_seq_device. The snd_seq_device private_free gets called at the release callback of the sequencer device object, while this was rather expected to be executed at the snd_device call chains that runs at the beginning of the whole card-free procedure. It's been broken since the rewrite of sequencer-device binding (although it hasn't surfaced because the sequencer device release happens usually right along with the card device release). This patch corrects the private_free call to be done in the right place, at snd_seq_device_dev_free(). Fixes: 7c37ae5c625a ("ALSA: seq: Rewrite sequencer device binding with standard bus") Reported-and-tested-by: John Keeping <john(a)metanate.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai(a)suse.de> --- sound/core/seq_device.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/sound/core/seq_device.c b/sound/core/seq_device.c index 382275c5b193..7f3fd8eb016f 100644 --- a/sound/core/seq_device.c +++ b/sound/core/seq_device.c @@ -156,6 +156,8 @@ static int snd_seq_device_dev_free(struct snd_device *device) struct snd_seq_device *dev = device->device_data; cancel_autoload_drivers(); + if (dev->private_free) + dev->private_free(dev); put_device(&dev->dev); return 0; } @@ -183,11 +185,7 @@ static int snd_seq_device_dev_disconnect(struct snd_device *device) static void snd_seq_dev_release(struct device *dev) { - struct snd_seq_device *sdev = to_seq_dev(dev); - - if (sdev->private_free) - sdev->private_free(sdev); - kfree(sdev); + kfree(to_seq_dev(dev)); } /* -- 2.26.2

1 0

[PATCH] ALSA: rawmidi: Fix potential UAF from sequencer destruction
by John Keeping 30 Sep '21

30 Sep '21

If the sequencer device outlives the rawmidi device, then snd_rawmidi_dev_seq_free() will run after release_rawmidi_device() has freed the snd_rawmidi structure. This can easily be reproduced with CONFIG_DEBUG_KOBJECT_RELEASE. Keep a reference to the rawmidi device until the sequencer has been destroyed in order to avoid this. Signed-off-by: John Keeping <john(a)metanate.com> --- sound/core/rawmidi.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/sound/core/rawmidi.c b/sound/core/rawmidi.c index 6f30231bdb88..b015f5f69175 100644 --- a/sound/core/rawmidi.c +++ b/sound/core/rawmidi.c @@ -1860,6 +1860,7 @@ static void snd_rawmidi_dev_seq_free(struct snd_seq_device *device) struct snd_rawmidi *rmidi = device->private_data; rmidi->seq_dev = NULL; + put_device(&rmidi->dev); } #endif @@ -1936,6 +1937,9 @@ static int snd_rawmidi_dev_register(struct snd_device *device) #if IS_ENABLED(CONFIG_SND_SEQUENCER) if (!rmidi->ops || !rmidi->ops->dev_register) { /* own registration mechanism */ if (snd_seq_device_new(rmidi->card, rmidi->device, SNDRV_SEQ_DEV_ID_MIDISYNTH, 0, &rmidi->seq_dev) >= 0) { + /* Ensure we outlive the sequencer (see snd_rawmidi_dev_seq_free). */ + get_device(&rmidi->dev); + rmidi->seq_dev->private_data = rmidi; rmidi->seq_dev->private_free = snd_rawmidi_dev_seq_free; sprintf(rmidi->seq_dev->name, "MIDI %d-%d", rmidi->card->number, rmidi->device); -- 2.33.0

2 8

[PATCH] ASoC: dpcm: fix race condition to dpcm links in dpcm_be_dai_trigger
by Gyeongtaek Lee 30 Sep '21

30 Sep '21

If routing change and underrun stop is run at the same time, data abort can be occurred by the following sequence. CPU0: Processing underrun CPU1: Processing routing change dpcm_be_dai_trigger(): dpcm_be_disconnect(): for_each_dpcm_be(fe, stream, dpcm) { spin_lock_irqsave(&fe->card->dpcm_lock, flags); list_del(&dpcm->list_be); list_del(&dpcm->list_fe); spin_unlock_irqrestore(&fe->card->dpcm_lock, flags); kfree(dpcm); struct snd_soc_pcm_runtime *be = dpcm->be; <-- Accessing freed memory To prevent this situation, dpcm_lock is needed during accessing the lists for dpcm links. Signed-off-by: Gyeongtaek Lee <gt82.lee(a)samsung.com> Cc: stable(a)vger.kernel.org --- sound/soc/soc-pcm.c | 53 ++++++++++++++++++++++++++++++++++++++++++--- 1 file changed, 50 insertions(+), 3 deletions(-) diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c index 48f71bb81a2f..df2cd4c0dabe 100644 --- a/sound/soc/soc-pcm.c +++ b/sound/soc/soc-pcm.c @@ -1993,17 +1993,63 @@ static int dpcm_fe_dai_hw_params(struct snd_pcm_substream *substream, return ret; } +struct dpcm_be_list { + unsigned int num; + struct snd_soc_pcm_runtime *be[]; +}; + +static int dpcm_create_be_list(struct snd_soc_pcm_runtime *fe, int stream, + struct dpcm_be_list **be_list) +{ + struct snd_soc_dpcm *dpcm; + struct dpcm_be_list *be; + int size = 0; + int ret = 0; + unsigned long flags; + + spin_lock_irqsave(&fe->card->dpcm_lock, flags); + + for_each_dpcm_be(fe, stream, dpcm) + size++; + + be = kzalloc(struct_size(be, be, size), GFP_ATOMIC); + if (!be) { + ret = -ENOMEM; + } else { + unsigned int i = 0; + + for_each_dpcm_be(fe, stream, dpcm) + be->be[i++] = dpcm->be; + + *be_list = be; + } + + spin_unlock_irqrestore(&fe->card->dpcm_lock, flags); + + return ret; +} + +static void dpcm_free_be_list(struct dpcm_be_list *be_list) +{ + kfree(be_list); +} + int dpcm_be_dai_trigger(struct snd_soc_pcm_runtime *fe, int stream, int cmd) { struct snd_soc_pcm_runtime *be; - struct snd_soc_dpcm *dpcm; + struct dpcm_be_list *be_list; int ret = 0; + int i; - for_each_dpcm_be(fe, stream, dpcm) { + ret = dpcm_create_be_list(fe, stream, &be_list); + if (ret < 0) + return ret; + + for(i = 0; i < be_list->num; i++) { struct snd_pcm_substream *be_substream; - be = dpcm->be; + be = be_list->be[i]; be_substream = snd_soc_dpcm_get_substream(be, stream); /* is this op for this BE ? */ @@ -2092,6 +2138,7 @@ int dpcm_be_dai_trigger(struct snd_soc_pcm_runtime *fe, int stream, if (ret < 0) dev_err(fe->dev, "ASoC: %s() failed at %s (%d)\n", __func__, be->dai_link->name, ret); + dpcm_free_be_list(be_list); return ret; } EXPORT_SYMBOL_GPL(dpcm_be_dai_trigger); base-commit: 4ac6d90867a4de2e12117e755dbd76e08d88697f -- 2.21.0

2 3

Re: [PATCH] ASoC: dt-bindings: rt5682s: fix the device-tree schema errors
by David Heidelberg 30 Sep '21

30 Sep '21

Our CI seems to be happy again. Thanks Reviewed-by: David Heidelberg <david(a)ixit.cz> Best regards David Heidelberg

1 0

[PATCH] ASoC: wm_adsp: Fix compilation when debugfs is disabled
by Simon Trimmer 29 Sep '21

29 Sep '21

Guard the use of component->debufs_root against CONFIG_DEBUG_FS Reported-by: kernel test robot <lkp(a)intel.com> Signed-off-by: Simon Trimmer <simont(a)opensource.cirrus.com> --- sound/soc/codecs/wm_adsp.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/sound/soc/codecs/wm_adsp.c b/sound/soc/codecs/wm_adsp.c index f17c749c24c3..03cfaa82b031 100644 --- a/sound/soc/codecs/wm_adsp.c +++ b/sound/soc/codecs/wm_adsp.c @@ -1028,7 +1028,9 @@ int wm_adsp2_component_probe(struct wm_adsp *dsp, struct snd_soc_component *comp snprintf(preload, ARRAY_SIZE(preload), "%s Preload", dsp->cs_dsp.name); snd_soc_component_disable_pin(component, preload); +#if IS_ENABLED(CONFIG_DEBUG_FS) cs_dsp_init_debugfs(&dsp->cs_dsp, component->debugfs_root); +#endif dsp->component = component; -- 2.33.0

2 3

[PATCH] ASoC: ux500: mop500: Constify static snd_soc_ops
by Rikard Falkeborn 29 Sep '21

29 Sep '21

The struct mop500_ab8500_ops is only assigned to the ops field in the snd_soc_dai_link struct which is a pointer to const struct snd_soc_ops. Make it const to allow the compiler to put it in read-only memory. Signed-off-by: Rikard Falkeborn <rikard.falkeborn(a)gmail.com> --- sound/soc/ux500/mop500_ab8500.c | 2 +- sound/soc/ux500/mop500_ab8500.h | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/sound/soc/ux500/mop500_ab8500.c b/sound/soc/ux500/mop500_ab8500.c index 2c39c7a2fd7d..3e654e708f78 100644 --- a/sound/soc/ux500/mop500_ab8500.c +++ b/sound/soc/ux500/mop500_ab8500.c @@ -348,7 +348,7 @@ static int mop500_ab8500_hw_free(struct snd_pcm_substream *substream) return 0; } -struct snd_soc_ops mop500_ab8500_ops[] = { +const struct snd_soc_ops mop500_ab8500_ops[] = { { .hw_params = mop500_ab8500_hw_params, .hw_free = mop500_ab8500_hw_free, diff --git a/sound/soc/ux500/mop500_ab8500.h b/sound/soc/ux500/mop500_ab8500.h index 8138a4e9aaf5..087ef246d87d 100644 --- a/sound/soc/ux500/mop500_ab8500.h +++ b/sound/soc/ux500/mop500_ab8500.h @@ -11,7 +11,7 @@ #ifndef MOP500_AB8500_H #define MOP500_AB8500_H -extern struct snd_soc_ops mop500_ab8500_ops[]; +extern const struct snd_soc_ops mop500_ab8500_ops[]; int mop500_ab8500_machine_init(struct snd_soc_pcm_runtime *rtd); void mop500_ab8500_remove(struct snd_soc_card *card); -- 2.33.0

2 1

[PATCH] ASoC: ti: Constify static snd_soc_ops
by Rikard Falkeborn 29 Sep '21

29 Sep '21

These are only assigned to the ops field in the snd_soc_dai_link struct which is a pointer to const struct snd_soc_ops. Make them const to allow the compiler to put them in read-only memory. Signed-off-by: Rikard Falkeborn <rikard.falkeborn(a)gmail.com> --- sound/soc/ti/davinci-evm.c | 2 +- sound/soc/ti/omap-abe-twl6040.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/sound/soc/ti/davinci-evm.c b/sound/soc/ti/davinci-evm.c index b043a0070d20..68d69e32681a 100644 --- a/sound/soc/ti/davinci-evm.c +++ b/sound/soc/ti/davinci-evm.c @@ -73,7 +73,7 @@ static int evm_hw_params(struct snd_pcm_substream *substream, return 0; } -static struct snd_soc_ops evm_ops = { +static const struct snd_soc_ops evm_ops = { .startup = evm_startup, .shutdown = evm_shutdown, .hw_params = evm_hw_params, diff --git a/sound/soc/ti/omap-abe-twl6040.c b/sound/soc/ti/omap-abe-twl6040.c index 2e3d1eea77c1..da809c7f25a4 100644 --- a/sound/soc/ti/omap-abe-twl6040.c +++ b/sound/soc/ti/omap-abe-twl6040.c @@ -96,7 +96,7 @@ static int omap_abe_dmic_hw_params(struct snd_pcm_substream *substream, return 0; } -static struct snd_soc_ops omap_abe_dmic_ops = { +static const struct snd_soc_ops omap_abe_dmic_ops = { .hw_params = omap_abe_dmic_hw_params, }; -- 2.33.0

2 1

[PATCH] ASoC: rt5682s Minor modifications to look more sensibly
by derek.fang＠realtek.com 29 Sep '21

29 Sep '21

From: Derek Fang <derek.fang(a)realtek.com> These modifications wouldn't affect the driver's behavior, but the code could look more sensibly. 1. Remove the volatile reg (0x0000) in reg_default. 2. Use dev_dbg instead of pr_debug. 3. Revise the macro RT5682S_PLLB_SRC_MASK to 0x1 because the mux is only two-source. Signed-off-by: Derek Fang <derek.fang(a)realtek.com> --- sound/soc/codecs/rt5682s.c | 3 +-- sound/soc/codecs/rt5682s.h | 2 +- 2 files changed, 2 insertions(+), 3 deletions(-) diff --git a/sound/soc/codecs/rt5682s.c b/sound/soc/codecs/rt5682s.c index d3e965b2e707..122adeb7beb1 100644 --- a/sound/soc/codecs/rt5682s.c +++ b/sound/soc/codecs/rt5682s.c @@ -72,7 +72,6 @@ static void rt5682s_apply_patch_list(struct rt5682s_priv *rt5682s, } const struct reg_default rt5682s_reg[] = { - {0x0000, 0x0001}, {0x0002, 0x8080}, {0x0003, 0x0001}, {0x0005, 0x0000}, @@ -769,7 +768,7 @@ static int rt5682s_headset_detect(struct snd_soc_component *component, int jack_ count++; } while (val == 0 && count < 50); - pr_debug("%s, val=%d, count=%d\n", __func__, val, count); + dev_dbg(component->dev, "%s, val=%d, count=%d\n", __func__, val, count); switch (val) { case 0x1: diff --git a/sound/soc/codecs/rt5682s.h b/sound/soc/codecs/rt5682s.h index 7c755e5efb81..55f1febb81e9 100644 --- a/sound/soc/codecs/rt5682s.h +++ b/sound/soc/codecs/rt5682s.h @@ -1094,7 +1094,7 @@ #define RT5682S_PLLA_K_BP_SFT 6 /* PLL M/N/K Code Control 7 (0x009e) */ -#define RT5682S_PLLB_SRC_MASK (0x3 << 0) +#define RT5682S_PLLB_SRC_MASK (0x1) #define RT5682S_PLLB_SRC_DFIN (0x1) #define RT5682S_PLLB_SRC_PLLA (0x0) -- 2.17.1

2 1