May 2025 - Alsa-devel - mailman.alsa-project.org

[PATCH v4 0/5] Add DisplayPort sound support for Fairphone 5 smartphone
by Luca Weiss 09 Jun '25

09 Jun '25

Add the necessary sound card bits and some dts additions to enable sound over DisplayPort-over-USB-C, e.g. to a connected TV or monitor. The UCM files can be found here: https://gitlab.postmarketos.org/postmarketOS/pmaports/-/tree/master/device/… This series - in spirit - depends on the series enabling DisplayPort in the first place, but can land pretty independently, especially the ASoC bits: https://lore.kernel.org/linux-arm-msm/20250312-fp5-pmic-glink-dp-v2-0-a5592… The ASoC bits depend on the patches for USB audio offloading merged through Greg's tree so this cannot easily be applied for v6.16 through the sound tree. Either it waits for v6.17 or also goes through Greg's tree. Signed-off-by: Luca Weiss <luca.weiss(a)fairphone.com> --- Changes in v4: - Use "sm4250" for qcom,qrb4210-rb2-sndcard (Srinivas) - Expand cover letter to mention dependencies for ASoC patches - Pick up tags - Link to v3: https://lore.kernel.org/r/20250425-fp5-dp-sound-v3-0-7cb45180091b@fairphone… Changes in v3: - Simplify return qcom_snd_wcd_jack_setup in machine driver - Pick up tags - Link to v2: https://lore.kernel.org/r/20250418-fp5-dp-sound-v2-0-05d65f084b05@fairphone… Changes in v2: - Revamp series based on comments on v1, doesn't have much too much in common anymore - Use sm8250 instead of sc8280xp sndcard file, so port other required changes from sc8280xp.c to sm8250.c - This also changes the sound card compatible to from qcom,qcm6490-sndcard to fairphone,fp5-sndcard - Link to v1: https://lore.kernel.org/r/20240809-fp5-dp-sound-v1-0-d7ba2c24f6b9@fairphone… --- Luca Weiss (5): ASoC: dt-bindings: qcom,sm8250: Add Fairphone 5 sound card ASoC: qcom: sm8250: set card driver name from match data ASoC: qcom: sm8250: add DisplayPort Jack support ASoC: qcom: sm8250: Add Fairphone 5 soundcard compatible arm64: dts: qcom: qcm6490-fairphone-fp5: Add DisplayPort sound support .../devicetree/bindings/sound/qcom,sm8250.yaml | 1 + arch/arm64/boot/dts/qcom/qcm6490-fairphone-fp5.dts | 31 ++++++++++++++++++++++ sound/soc/qcom/sm8250.c | 27 ++++++++++--------- 3 files changed, 47 insertions(+), 12 deletions(-) --- base-commit: f819a667fa466d3b96b542b147053b6873f18ea1 change-id: 20240809-fp5-dp-sound-b3768f3019bd Best regards, -- Luca Weiss <luca.weiss(a)fairphone.com>

5 10

[PATCH v3 0/5] Add DisplayPort sound support for Fairphone 5 smartphone
by Luca Weiss 09 Jun '25

09 Jun '25

Add the necessary sound card bits and some dts additions to enable sound over DisplayPort-over-USB-C, e.g. to a connected TV or monitor. The UCM files can be found here: https://gitlab.postmarketos.org/postmarketOS/pmaports/-/tree/master/device/… This series - in spirit - depends on the series enabling DisplayPort in the first place, but can land pretty independently, especially the ASoC bits: https://lore.kernel.org/linux-arm-msm/20250312-fp5-pmic-glink-dp-v2-0-a5592… Signed-off-by: Luca Weiss <luca.weiss(a)fairphone.com> --- Changes in v3: - Simplify return qcom_snd_wcd_jack_setup in machine driver - Pick up tags - Link to v2: https://lore.kernel.org/r/20250418-fp5-dp-sound-v2-0-05d65f084b05@fairphone… Changes in v2: - Revamp series based on comments on v1, doesn't have much too much in common anymore - Use sm8250 instead of sc8280xp sndcard file, so port other required changes from sc8280xp.c to sm8250.c - This also changes the sound card compatible to from qcom,qcm6490-sndcard to fairphone,fp5-sndcard - Link to v1: https://lore.kernel.org/r/20240809-fp5-dp-sound-v1-0-d7ba2c24f6b9@fairphone… --- Luca Weiss (5): ASoC: dt-bindings: qcom,sm8250: Add Fairphone 5 sound card ASoC: qcom: sm8250: set card driver name from match data ASoC: qcom: sm8250: add DisplayPort Jack support ASoC: qcom: sm8250: Add Fairphone 5 soundcard compatible arm64: dts: qcom: qcm6490-fairphone-fp5: Add DisplayPort sound support .../devicetree/bindings/sound/qcom,sm8250.yaml | 1 + arch/arm64/boot/dts/qcom/qcm6490-fairphone-fp5.dts | 31 ++++++++++++++++++++++ sound/soc/qcom/sm8250.c | 27 ++++++++++--------- 3 files changed, 47 insertions(+), 12 deletions(-) --- base-commit: 7f1dd4e6634d085f3c9652d4e0f1903659fb96f9 change-id: 20240809-fp5-dp-sound-b3768f3019bd Best regards, -- Luca Weiss <luca.weiss(a)fairphone.com>

6 16

[PATCH v1] ASoC: tas2781: Drop the unnecessary symbol imply
by Shenghao Ding 09 Jun '25

09 Jun '25

The unnecessary symbols for imply are SND_SOC_TAS2781_COMLIB, SND_SOC_TAS2781_COMLIB_I2C, and SND_SOC_TAS2781_FMWLIB. They all used for library compiling. All the symbols in the imply are used for codec driver compiling. Signed-off-by: Shenghao Ding <shenghao-ding(a)ti.com> --- sound/soc/codecs/Kconfig | 3 --- 1 file changed, 3 deletions(-) diff --git a/sound/soc/codecs/Kconfig b/sound/soc/codecs/Kconfig index 8fe795504dbb..0e70064bc90c 100644 --- a/sound/soc/codecs/Kconfig +++ b/sound/soc/codecs/Kconfig @@ -262,9 +262,6 @@ config SND_SOC_ALL_CODECS imply SND_SOC_TAS2764 imply SND_SOC_TAS2770 imply SND_SOC_TAS2780 - imply SND_SOC_TAS2781_COMLIB - imply SND_SOC_TAS2781_COMLIB_I2C - imply SND_SOC_TAS2781_FMWLIB imply SND_SOC_TAS2781_I2C imply SND_SOC_TAS5086 imply SND_SOC_TAS571X -- 2.43.0

2 1

[PATCH] ALSA: hda: Add new pci id for AMD GPU display HD audio controller
by Vijendar Mukunda 02 Jun '25

02 Jun '25

Add new pci id for AMD GPU display HD audio controller(device id- 0xab40). Signed-off-by: Vijendar Mukunda <Vijendar.Mukunda(a)amd.com> --- sound/pci/hda/hda_intel.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c index 512fb22f5e5e..3f8b2bf6eab5 100644 --- a/sound/pci/hda/hda_intel.c +++ b/sound/pci/hda/hda_intel.c @@ -2715,6 +2715,9 @@ static const struct pci_device_id azx_ids[] = { { PCI_VDEVICE(ATI, 0xab38), .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS | AZX_DCAPS_PM_RUNTIME }, + { PCI_VDEVICE(ATI, 0xab40), + .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS | + AZX_DCAPS_PM_RUNTIME }, /* GLENFLY */ { PCI_DEVICE(PCI_VENDOR_ID_GLENFLY, PCI_ANY_ID), .class = PCI_CLASS_MULTIMEDIA_HD_AUDIO << 8, -- 2.45.2

3 3

[PATCH v1] ALSA: hda/tas2781: Add compatible for hardware id TIAS2781 and TXNW2781
by Baojun Xu 31 May '25

31 May '25

TIAS2781 is unofficial hardware id in acpi for tas2781 in HDA, has been used for several projects. TXNW is the official hardware id for TI, will be used in new projects, including device on SPI bus. This patch will support both TIAS2781 and TXNW2781 in acpi with tas2781 under HDA. Signed-off-by: Baojun Xu <baojun.xu(a)ti.com> --- sound/pci/hda/patch_realtek.c | 21 +++++++++++++++++---- sound/pci/hda/tas2781_hda_i2c.c | 10 +++++++--- 2 files changed, 24 insertions(+), 7 deletions(-) diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c index cd0d7ba73..ff32ac25d 100644 --- a/sound/pci/hda/patch_realtek.c +++ b/sound/pci/hda/patch_realtek.c @@ -7323,7 +7323,7 @@ static void alc285_fixup_asus_ga403u(struct hda_codec *cdc, const struct hda_fix alc_fixup_inv_dmic(cdc, fix, action); } -static void tas2781_fixup_i2c(struct hda_codec *cdc, +static void tas2781_fixup_tias_i2c(struct hda_codec *cdc, const struct hda_fixup *fix, int action) { comp_generic_fixup(cdc, action, "i2c", "TIAS2781", "-%s:00", 1); @@ -7334,6 +7334,12 @@ static void tas2781_fixup_spi(struct hda_codec *cdc, const struct hda_fixup *fix comp_generic_fixup(cdc, action, "spi", "TXNW2781", "-%s:00-tas2781-hda.%d", 2); } +static void tas2781_fixup_txnw_i2c(struct hda_codec *cdc, + const struct hda_fixup *fix, int action) +{ + comp_generic_fixup(cdc, action, "i2c", "TXNW2781", "-%s:00-tas2781-hda.%d", 1); +} + static void yoga7_14arb7_fixup_i2c(struct hda_codec *cdc, const struct hda_fixup *fix, int action) { @@ -8001,6 +8007,7 @@ enum { ALC287_FIXUP_CS35L41_I2C_2_THINKPAD_ACPI, ALC287_FIXUP_TAS2781_I2C, ALC245_FIXUP_TAS2781_SPI_2, + ALC287_FIXUP_TXNW2781_I2C, ALC287_FIXUP_YOGA7_14ARB7_I2C, ALC245_FIXUP_HP_MUTE_LED_COEFBIT, ALC245_FIXUP_HP_MUTE_LED_V1_COEFBIT, @@ -10251,7 +10258,7 @@ static const struct hda_fixup alc269_fixups[] = { }, [ALC287_FIXUP_TAS2781_I2C] = { .type = HDA_FIXUP_FUNC, - .v.func = tas2781_fixup_i2c, + .v.func = tas2781_fixup_tias_i2c, .chained = true, .chain_id = ALC285_FIXUP_THINKPAD_HEADSET_JACK, }, @@ -10261,6 +10268,12 @@ static const struct hda_fixup alc269_fixups[] = { .chained = true, .chain_id = ALC285_FIXUP_HP_GPIO_LED, }, + [ALC287_FIXUP_TXNW2781_I2C] = { + .type = HDA_FIXUP_FUNC, + .v.func = tas2781_fixup_txnw_i2c, + .chained = true, + .chain_id = ALC285_FIXUP_THINKPAD_HEADSET_JACK, + }, [ALC287_FIXUP_YOGA7_14ARB7_I2C] = { .type = HDA_FIXUP_FUNC, .v.func = yoga7_14arb7_fixup_i2c, @@ -11318,8 +11331,8 @@ static const struct hda_quirk alc269_fixup_tbl[] = { SND_PCI_QUIRK(0x17aa, 0x3902, "Lenovo E50-80", ALC269_FIXUP_DMIC_THINKPAD_ACPI), SND_PCI_QUIRK(0x17aa, 0x390d, "Lenovo Yoga Pro 7 14ASP10", ALC287_FIXUP_YOGA9_14IAP7_BASS_SPK_PIN), SND_PCI_QUIRK(0x17aa, 0x3913, "Lenovo 145", ALC236_FIXUP_LENOVO_INV_DMIC), - SND_PCI_QUIRK(0x17aa, 0x391f, "Yoga S990-16 pro Quad YC Quad", ALC287_FIXUP_TAS2781_I2C), - SND_PCI_QUIRK(0x17aa, 0x3920, "Yoga S990-16 pro Quad VECO Quad", ALC287_FIXUP_TAS2781_I2C), + SND_PCI_QUIRK(0x17aa, 0x391f, "Yoga S990-16 pro Quad YC Quad", ALC287_FIXUP_TXNW2781_I2C), + SND_PCI_QUIRK(0x17aa, 0x3920, "Yoga S990-16 pro Quad VECO Quad", ALC287_FIXUP_TXNW2781_I2C), SND_PCI_QUIRK(0x17aa, 0x3977, "IdeaPad S210", ALC283_FIXUP_INT_MIC), SND_PCI_QUIRK(0x17aa, 0x3978, "Lenovo B50-70", ALC269_FIXUP_DMIC_THINKPAD_ACPI), SND_PCI_QUIRK(0x17aa, 0x3bf8, "Quanta FL1", ALC269_FIXUP_PCM_44K), diff --git a/sound/pci/hda/tas2781_hda_i2c.c b/sound/pci/hda/tas2781_hda_i2c.c index d91eed9f7..48c7af191 100644 --- a/sound/pci/hda/tas2781_hda_i2c.c +++ b/sound/pci/hda/tas2781_hda_i2c.c @@ -583,16 +583,19 @@ static int tas2781_hda_i2c_probe(struct i2c_client *clt) if (!tas_hda->priv) return -ENOMEM; + hda_priv->save_calibration = tas2781_save_calibration; + tas_hda->priv->global_addr = TAS2781_GLOBAL_ADDR; if (strstr(dev_name(&clt->dev), "TIAS2781")) { device_name = "TIAS2781"; - hda_priv->save_calibration = tas2781_save_calibration; - tas_hda->priv->global_addr = TAS2781_GLOBAL_ADDR; + } else if (strstr(dev_name(&clt->dev), "TXNW2781:00-tas2781-hda.0")) { + device_name = "TXNW2781"; } else if (strstr(dev_name(&clt->dev), "INT8866")) { device_name = "INT8866"; hda_priv->save_calibration = tas2563_save_calibration; tas_hda->priv->global_addr = TAS2563_GLOBAL_ADDR; - } else + } else { return -ENODEV; + } tas_hda->priv->irq = clt->irq; ret = tas2781_read_acpi(tas_hda->priv, device_name); @@ -723,6 +726,7 @@ static const struct i2c_device_id tas2781_hda_i2c_id[] = { static const struct acpi_device_id tas2781_acpi_hda_match[] = { {"TIAS2781", 0 }, + {"TXNW2781", 0 }, {"INT8866", 0 }, {} }; -- 2.43.0

2 1

[PATCH AUTOSEL 5.10 08/10] ASoC: tegra210_ahub: Add check to of_device_get_match_data()
by Sasha Levin 30 May '25

30 May '25

From: Yuanjun Gong <ruc_gongyuanjun(a)163.com> [ Upstream commit 04cb269c204398763a620d426cbee43064854000 ] In tegra_ahub_probe(), check the result of function of_device_get_match_data(), return an error code in case it fails. Signed-off-by: Yuanjun Gong <ruc_gongyuanjun(a)163.com> Link: https://patch.msgid.link/20250513123744.3041724-1-ruc_gongyuanjun@163.com Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- **YES** This commit should be backported to stable kernel trees. **Extensive Analysis:** **1. Nature of the Bug Fix:** This commit fixes a critical null pointer dereference vulnerability in the tegra210_ahub driver. The code calls `of_device_get_match_data(&pdev->dev)` but never validates the return value before using `ahub->soc_data`. Looking at the kernel tree, we can see that immediately after the assignment, the code accesses `ahub->soc_data->regmap_config` and later `ahub->soc_data->cmpnt_drv`, `ahub->soc_data->dai_drv`, and `ahub->soc_data->num_dais` without any null checking. **2. Severity and Impact:** - **High severity**: A null pointer dereference in the kernel probe function can cause kernel panic - **User impact**: Systems using Tegra210 audio hardware could crash during device initialization - **Subsystem criticality**: Audio subsystem failure affects multimedia functionality **3. Code Analysis:** The fix is minimal and surgical: ```c ahub->soc_data = of_device_get_match_data(&pdev->dev); +if (!ahub->soc_data) + return -ENODEV; ``` This follows established kernel patterns and returns an appropriate error code (-ENODEV) when device match data cannot be found. **4. Consistency with Similar Fixes:** Examining the kernel tree reveals that other Tegra drivers have already been fixed with identical patterns: - `tegra30_ahub.c` already has this null check (returns -EINVAL) - `tegra30_i2s.c` already has this null check (returns -ENODEV) This indicates that tegra210_ahub was an oversight that should be corrected for consistency and safety. **5. Historical Reference Analysis:** While the provided historical commits all have "Backport Status: NO", they were primarily code cleanup and API migration commits (switching to `of_device_get_match_data`), not security/stability fixes. This commit is fundamentally different - it's a critical bug fix that prevents kernel crashes. **6. Stable Tree Criteria Compliance:** - ✅ **Important bugfix**: Prevents kernel panic - ✅ **Minimal risk**: Two-line addition with well-established pattern - ✅ **Small and contained**: No architectural changes - ✅ **Clear purpose**: Prevents null pointer dereference - ✅ **Subsystem confined**: Only affects tegra210_ahub driver **7. Risk Assessment:** - **Regression risk**: Extremely low - only adds a safety check - **Side effects**: None - failure case now returns clean error instead of crashing - **Testing impact**: Improves robustness without changing successful code paths **Conclusion:** This is a textbook example of a commit that should be backported to stable trees. It fixes a critical null pointer dereference that can cause kernel panics, uses minimal code changes following established patterns, and has virtually no risk of introducing regressions. The fix brings tegra210_ahub in line with other Tegra drivers that already have this protection. sound/soc/tegra/tegra210_ahub.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/sound/soc/tegra/tegra210_ahub.c b/sound/soc/tegra/tegra210_ahub.c index 1b2f7cb8c6adc..686c8ff46ec8a 100644 --- a/sound/soc/tegra/tegra210_ahub.c +++ b/sound/soc/tegra/tegra210_ahub.c @@ -607,6 +607,8 @@ static int tegra_ahub_probe(struct platform_device *pdev) return -ENOMEM; ahub->soc_data = of_device_get_match_data(&pdev->dev); + if (!ahub->soc_data) + return -ENODEV; platform_set_drvdata(pdev, ahub); -- 2.39.5

1 0

[PATCH AUTOSEL 5.10 04/10] ASoC: tas2770: Power cycle amp on ISENSE/VSENSE change
by Sasha Levin 30 May '25

30 May '25

From: Hector Martin <marcan(a)marcan.st> [ Upstream commit f529c91be8a34ac12e7599bf87c65b6f4a2c9f5c ] The ISENSE/VSENSE blocks are only powered up when the amplifier transitions from shutdown to active. This means that if those controls are flipped on while the amplifier is already playing back audio, they will have no effect. Fix this by forcing a power cycle around transitions in those controls. Reviewed-by: Neal Gompa <neal(a)gompa.dev> Signed-off-by: Hector Martin <marcan(a)marcan.st> Signed-off-by: James Calligeros <jcalligeros99(a)gmail.com> Link: https://patch.msgid.link/20250406-apple-codec-changes-v5-1-50a00ec850a3@gma… Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- **YES** This commit should be backported to stable kernel trees based on my analysis of both the commit message and code changes. Here's my extensive explanation: ## Bug Fix Analysis This commit addresses a specific functional bug in the tas2770 audio codec driver where ISENSE/VSENSE controls don't work properly when changed during active playback. The commit message clearly states: "if those controls are flipped on while the amplifier is already playing back audio, they will have no effect." ## Code Changes Analysis The fix is contained and minimal, involving three key changes to `sound/soc/codecs/tas2770.c`: 1. **Addition of `sense_event` function (lines +21 to +43)**: This function implements a power cycling mechanism that forces the amplifier through a shutdown state when ISENSE/VSENSE controls are changed. This ensures the changes take effect regardless of playback state. 2. **Modified DAPM widget definitions (lines +45 to +48)**: The ISENSE and VSENSE switches are changed from simple `SND_SOC_DAPM_SWITCH` to `SND_SOC_DAPM_SWITCH_E` with event handling, connecting them to the new `sense_event` function. 3. **Event triggers**: The widgets respond to `SND_SOC_DAPM_PRE_REG` and `SND_SOC_DAPM_POST_REG` events to perform the power cycling around register changes. ## Why This Should Be Backported 1. **User-Affecting Bug**: This fixes a real functional issue where audio controls don't work as expected during playback, which directly impacts user experience. 2. **Small and Contained**: The fix is confined to a single driver file (`tas2770.c`) and doesn't affect other subsystems. The changes are surgical and targeted. 3. **Low Risk**: The fix follows established ASoC patterns using standard DAPM event handling. Similar power cycling approaches are used throughout the ASoC subsystem. 4. **No New Features**: This purely fixes existing functionality rather than adding new features. 5. **Comparison with Similar Commits**: Looking at the provided examples, this commit is very similar to "Similar Commit #2" and "Similar Commit #5" which were both marked as backportable (YES). Like commit #2, it fixes incorrect hardware behavior with a small register/control change. Like commit #5, it addresses power state management issues in audio hardware. 6. **Hardware-Specific Fix**: The commit addresses a hardware limitation specific to the tas2770 chip where ISENSE/VSENSE blocks are only powered up during shutdown-to-active transitions. This is documented in the commit message and is a legitimate hardware workaround. The fix ensures that software speaker protection functionality works correctly by guaranteeing that IVSENSE controls are functional, which is critical for protecting audio hardware from damage. sound/soc/codecs/tas2770.c | 30 ++++++++++++++++++++++++++++-- 1 file changed, 28 insertions(+), 2 deletions(-) diff --git a/sound/soc/codecs/tas2770.c b/sound/soc/codecs/tas2770.c index 1928c1616a52d..629cc24d51c3d 100644 --- a/sound/soc/codecs/tas2770.c +++ b/sound/soc/codecs/tas2770.c @@ -158,11 +158,37 @@ static const struct snd_kcontrol_new isense_switch = static const struct snd_kcontrol_new vsense_switch = SOC_DAPM_SINGLE("Switch", TAS2770_PWR_CTRL, 2, 1, 1); +static int sense_event(struct snd_soc_dapm_widget *w, + struct snd_kcontrol *kcontrol, int event) +{ + struct snd_soc_component *component = snd_soc_dapm_to_component(w->dapm); + struct tas2770_priv *tas2770 = snd_soc_component_get_drvdata(component); + + /* + * Powering up ISENSE/VSENSE requires a trip through the shutdown state. + * Do that here to ensure that our changes are applied properly, otherwise + * we might end up with non-functional IVSENSE if playback started earlier, + * which would break software speaker protection. + */ + switch (event) { + case SND_SOC_DAPM_PRE_REG: + return snd_soc_component_update_bits(component, TAS2770_PWR_CTRL, + TAS2770_PWR_CTRL_MASK, + TAS2770_PWR_CTRL_SHUTDOWN); + case SND_SOC_DAPM_POST_REG: + return tas2770_update_pwr_ctrl(tas2770); + default: + return 0; + } +} + static const struct snd_soc_dapm_widget tas2770_dapm_widgets[] = { SND_SOC_DAPM_AIF_IN("ASI1", "ASI1 Playback", 0, SND_SOC_NOPM, 0, 0), SND_SOC_DAPM_MUX("ASI1 Sel", SND_SOC_NOPM, 0, 0, &tas2770_asi1_mux), - SND_SOC_DAPM_SWITCH("ISENSE", TAS2770_PWR_CTRL, 3, 1, &isense_switch), - SND_SOC_DAPM_SWITCH("VSENSE", TAS2770_PWR_CTRL, 2, 1, &vsense_switch), + SND_SOC_DAPM_SWITCH_E("ISENSE", TAS2770_PWR_CTRL, 3, 1, &isense_switch, + sense_event, SND_SOC_DAPM_PRE_REG | SND_SOC_DAPM_POST_REG), + SND_SOC_DAPM_SWITCH_E("VSENSE", TAS2770_PWR_CTRL, 2, 1, &vsense_switch, + sense_event, SND_SOC_DAPM_PRE_REG | SND_SOC_DAPM_POST_REG), SND_SOC_DAPM_DAC_E("DAC", NULL, SND_SOC_NOPM, 0, 0, tas2770_dac_event, SND_SOC_DAPM_POST_PMU | SND_SOC_DAPM_PRE_PMD), SND_SOC_DAPM_OUTPUT("OUT"), -- 2.39.5

1 0

[PATCH AUTOSEL 5.15 09/11] ASoC: tegra210_ahub: Add check to of_device_get_match_data()
by Sasha Levin 30 May '25

30 May '25

From: Yuanjun Gong <ruc_gongyuanjun(a)163.com> [ Upstream commit 04cb269c204398763a620d426cbee43064854000 ] In tegra_ahub_probe(), check the result of function of_device_get_match_data(), return an error code in case it fails. Signed-off-by: Yuanjun Gong <ruc_gongyuanjun(a)163.com> Link: https://patch.msgid.link/20250513123744.3041724-1-ruc_gongyuanjun@163.com Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- **YES** This commit should be backported to stable kernel trees. **Extensive Analysis:** **1. Nature of the Bug Fix:** This commit fixes a critical null pointer dereference vulnerability in the tegra210_ahub driver. The code calls `of_device_get_match_data(&pdev->dev)` but never validates the return value before using `ahub->soc_data`. Looking at the kernel tree, we can see that immediately after the assignment, the code accesses `ahub->soc_data->regmap_config` and later `ahub->soc_data->cmpnt_drv`, `ahub->soc_data->dai_drv`, and `ahub->soc_data->num_dais` without any null checking. **2. Severity and Impact:** - **High severity**: A null pointer dereference in the kernel probe function can cause kernel panic - **User impact**: Systems using Tegra210 audio hardware could crash during device initialization - **Subsystem criticality**: Audio subsystem failure affects multimedia functionality **3. Code Analysis:** The fix is minimal and surgical: ```c ahub->soc_data = of_device_get_match_data(&pdev->dev); +if (!ahub->soc_data) + return -ENODEV; ``` This follows established kernel patterns and returns an appropriate error code (-ENODEV) when device match data cannot be found. **4. Consistency with Similar Fixes:** Examining the kernel tree reveals that other Tegra drivers have already been fixed with identical patterns: - `tegra30_ahub.c` already has this null check (returns -EINVAL) - `tegra30_i2s.c` already has this null check (returns -ENODEV) This indicates that tegra210_ahub was an oversight that should be corrected for consistency and safety. **5. Historical Reference Analysis:** While the provided historical commits all have "Backport Status: NO", they were primarily code cleanup and API migration commits (switching to `of_device_get_match_data`), not security/stability fixes. This commit is fundamentally different - it's a critical bug fix that prevents kernel crashes. **6. Stable Tree Criteria Compliance:** - ✅ **Important bugfix**: Prevents kernel panic - ✅ **Minimal risk**: Two-line addition with well-established pattern - ✅ **Small and contained**: No architectural changes - ✅ **Clear purpose**: Prevents null pointer dereference - ✅ **Subsystem confined**: Only affects tegra210_ahub driver **7. Risk Assessment:** - **Regression risk**: Extremely low - only adds a safety check - **Side effects**: None - failure case now returns clean error instead of crashing - **Testing impact**: Improves robustness without changing successful code paths **Conclusion:** This is a textbook example of a commit that should be backported to stable trees. It fixes a critical null pointer dereference that can cause kernel panics, uses minimal code changes following established patterns, and has virtually no risk of introducing regressions. The fix brings tegra210_ahub in line with other Tegra drivers that already have this protection. sound/soc/tegra/tegra210_ahub.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/sound/soc/tegra/tegra210_ahub.c b/sound/soc/tegra/tegra210_ahub.c index 1b2f7cb8c6adc..686c8ff46ec8a 100644 --- a/sound/soc/tegra/tegra210_ahub.c +++ b/sound/soc/tegra/tegra210_ahub.c @@ -607,6 +607,8 @@ static int tegra_ahub_probe(struct platform_device *pdev) return -ENOMEM; ahub->soc_data = of_device_get_match_data(&pdev->dev); + if (!ahub->soc_data) + return -ENODEV; platform_set_drvdata(pdev, ahub); -- 2.39.5

1 0

[PATCH AUTOSEL 5.15 04/11] ASoC: tas2770: Power cycle amp on ISENSE/VSENSE change
by Sasha Levin 30 May '25

30 May '25

From: Hector Martin <marcan(a)marcan.st> [ Upstream commit f529c91be8a34ac12e7599bf87c65b6f4a2c9f5c ] The ISENSE/VSENSE blocks are only powered up when the amplifier transitions from shutdown to active. This means that if those controls are flipped on while the amplifier is already playing back audio, they will have no effect. Fix this by forcing a power cycle around transitions in those controls. Reviewed-by: Neal Gompa <neal(a)gompa.dev> Signed-off-by: Hector Martin <marcan(a)marcan.st> Signed-off-by: James Calligeros <jcalligeros99(a)gmail.com> Link: https://patch.msgid.link/20250406-apple-codec-changes-v5-1-50a00ec850a3@gma… Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- **YES** This commit should be backported to stable kernel trees based on my analysis of both the commit message and code changes. Here's my extensive explanation: ## Bug Fix Analysis This commit addresses a specific functional bug in the tas2770 audio codec driver where ISENSE/VSENSE controls don't work properly when changed during active playback. The commit message clearly states: "if those controls are flipped on while the amplifier is already playing back audio, they will have no effect." ## Code Changes Analysis The fix is contained and minimal, involving three key changes to `sound/soc/codecs/tas2770.c`: 1. **Addition of `sense_event` function (lines +21 to +43)**: This function implements a power cycling mechanism that forces the amplifier through a shutdown state when ISENSE/VSENSE controls are changed. This ensures the changes take effect regardless of playback state. 2. **Modified DAPM widget definitions (lines +45 to +48)**: The ISENSE and VSENSE switches are changed from simple `SND_SOC_DAPM_SWITCH` to `SND_SOC_DAPM_SWITCH_E` with event handling, connecting them to the new `sense_event` function. 3. **Event triggers**: The widgets respond to `SND_SOC_DAPM_PRE_REG` and `SND_SOC_DAPM_POST_REG` events to perform the power cycling around register changes. ## Why This Should Be Backported 1. **User-Affecting Bug**: This fixes a real functional issue where audio controls don't work as expected during playback, which directly impacts user experience. 2. **Small and Contained**: The fix is confined to a single driver file (`tas2770.c`) and doesn't affect other subsystems. The changes are surgical and targeted. 3. **Low Risk**: The fix follows established ASoC patterns using standard DAPM event handling. Similar power cycling approaches are used throughout the ASoC subsystem. 4. **No New Features**: This purely fixes existing functionality rather than adding new features. 5. **Comparison with Similar Commits**: Looking at the provided examples, this commit is very similar to "Similar Commit #2" and "Similar Commit #5" which were both marked as backportable (YES). Like commit #2, it fixes incorrect hardware behavior with a small register/control change. Like commit #5, it addresses power state management issues in audio hardware. 6. **Hardware-Specific Fix**: The commit addresses a hardware limitation specific to the tas2770 chip where ISENSE/VSENSE blocks are only powered up during shutdown-to-active transitions. This is documented in the commit message and is a legitimate hardware workaround. The fix ensures that software speaker protection functionality works correctly by guaranteeing that IVSENSE controls are functional, which is critical for protecting audio hardware from damage. sound/soc/codecs/tas2770.c | 30 ++++++++++++++++++++++++++++-- 1 file changed, 28 insertions(+), 2 deletions(-) diff --git a/sound/soc/codecs/tas2770.c b/sound/soc/codecs/tas2770.c index 4e71dc1cf588f..48bef7e5e4002 100644 --- a/sound/soc/codecs/tas2770.c +++ b/sound/soc/codecs/tas2770.c @@ -158,11 +158,37 @@ static const struct snd_kcontrol_new isense_switch = static const struct snd_kcontrol_new vsense_switch = SOC_DAPM_SINGLE("Switch", TAS2770_PWR_CTRL, 2, 1, 1); +static int sense_event(struct snd_soc_dapm_widget *w, + struct snd_kcontrol *kcontrol, int event) +{ + struct snd_soc_component *component = snd_soc_dapm_to_component(w->dapm); + struct tas2770_priv *tas2770 = snd_soc_component_get_drvdata(component); + + /* + * Powering up ISENSE/VSENSE requires a trip through the shutdown state. + * Do that here to ensure that our changes are applied properly, otherwise + * we might end up with non-functional IVSENSE if playback started earlier, + * which would break software speaker protection. + */ + switch (event) { + case SND_SOC_DAPM_PRE_REG: + return snd_soc_component_update_bits(component, TAS2770_PWR_CTRL, + TAS2770_PWR_CTRL_MASK, + TAS2770_PWR_CTRL_SHUTDOWN); + case SND_SOC_DAPM_POST_REG: + return tas2770_update_pwr_ctrl(tas2770); + default: + return 0; + } +} + static const struct snd_soc_dapm_widget tas2770_dapm_widgets[] = { SND_SOC_DAPM_AIF_IN("ASI1", "ASI1 Playback", 0, SND_SOC_NOPM, 0, 0), SND_SOC_DAPM_MUX("ASI1 Sel", SND_SOC_NOPM, 0, 0, &tas2770_asi1_mux), - SND_SOC_DAPM_SWITCH("ISENSE", TAS2770_PWR_CTRL, 3, 1, &isense_switch), - SND_SOC_DAPM_SWITCH("VSENSE", TAS2770_PWR_CTRL, 2, 1, &vsense_switch), + SND_SOC_DAPM_SWITCH_E("ISENSE", TAS2770_PWR_CTRL, 3, 1, &isense_switch, + sense_event, SND_SOC_DAPM_PRE_REG | SND_SOC_DAPM_POST_REG), + SND_SOC_DAPM_SWITCH_E("VSENSE", TAS2770_PWR_CTRL, 2, 1, &vsense_switch, + sense_event, SND_SOC_DAPM_PRE_REG | SND_SOC_DAPM_POST_REG), SND_SOC_DAPM_DAC_E("DAC", NULL, SND_SOC_NOPM, 0, 0, tas2770_dac_event, SND_SOC_DAPM_POST_PMU | SND_SOC_DAPM_PRE_PMD), SND_SOC_DAPM_OUTPUT("OUT"), -- 2.39.5

1 0

[PATCH AUTOSEL 6.1 11/13] ASoC: tegra210_ahub: Add check to of_device_get_match_data()
by Sasha Levin 30 May '25

30 May '25

From: Yuanjun Gong <ruc_gongyuanjun(a)163.com> [ Upstream commit 04cb269c204398763a620d426cbee43064854000 ] In tegra_ahub_probe(), check the result of function of_device_get_match_data(), return an error code in case it fails. Signed-off-by: Yuanjun Gong <ruc_gongyuanjun(a)163.com> Link: https://patch.msgid.link/20250513123744.3041724-1-ruc_gongyuanjun@163.com Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- **YES** This commit should be backported to stable kernel trees. **Extensive Analysis:** **1. Nature of the Bug Fix:** This commit fixes a critical null pointer dereference vulnerability in the tegra210_ahub driver. The code calls `of_device_get_match_data(&pdev->dev)` but never validates the return value before using `ahub->soc_data`. Looking at the kernel tree, we can see that immediately after the assignment, the code accesses `ahub->soc_data->regmap_config` and later `ahub->soc_data->cmpnt_drv`, `ahub->soc_data->dai_drv`, and `ahub->soc_data->num_dais` without any null checking. **2. Severity and Impact:** - **High severity**: A null pointer dereference in the kernel probe function can cause kernel panic - **User impact**: Systems using Tegra210 audio hardware could crash during device initialization - **Subsystem criticality**: Audio subsystem failure affects multimedia functionality **3. Code Analysis:** The fix is minimal and surgical: ```c ahub->soc_data = of_device_get_match_data(&pdev->dev); +if (!ahub->soc_data) + return -ENODEV; ``` This follows established kernel patterns and returns an appropriate error code (-ENODEV) when device match data cannot be found. **4. Consistency with Similar Fixes:** Examining the kernel tree reveals that other Tegra drivers have already been fixed with identical patterns: - `tegra30_ahub.c` already has this null check (returns -EINVAL) - `tegra30_i2s.c` already has this null check (returns -ENODEV) This indicates that tegra210_ahub was an oversight that should be corrected for consistency and safety. **5. Historical Reference Analysis:** While the provided historical commits all have "Backport Status: NO", they were primarily code cleanup and API migration commits (switching to `of_device_get_match_data`), not security/stability fixes. This commit is fundamentally different - it's a critical bug fix that prevents kernel crashes. **6. Stable Tree Criteria Compliance:** - ✅ **Important bugfix**: Prevents kernel panic - ✅ **Minimal risk**: Two-line addition with well-established pattern - ✅ **Small and contained**: No architectural changes - ✅ **Clear purpose**: Prevents null pointer dereference - ✅ **Subsystem confined**: Only affects tegra210_ahub driver **7. Risk Assessment:** - **Regression risk**: Extremely low - only adds a safety check - **Side effects**: None - failure case now returns clean error instead of crashing - **Testing impact**: Improves robustness without changing successful code paths **Conclusion:** This is a textbook example of a commit that should be backported to stable trees. It fixes a critical null pointer dereference that can cause kernel panics, uses minimal code changes following established patterns, and has virtually no risk of introducing regressions. The fix brings tegra210_ahub in line with other Tegra drivers that already have this protection. sound/soc/tegra/tegra210_ahub.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/sound/soc/tegra/tegra210_ahub.c b/sound/soc/tegra/tegra210_ahub.c index dfdcb4580cd75..4be5683504154 100644 --- a/sound/soc/tegra/tegra210_ahub.c +++ b/sound/soc/tegra/tegra210_ahub.c @@ -1369,6 +1369,8 @@ static int tegra_ahub_probe(struct platform_device *pdev) return -ENOMEM; ahub->soc_data = of_device_get_match_data(&pdev->dev); + if (!ahub->soc_data) + return -ENODEV; platform_set_drvdata(pdev, ahub); -- 2.39.5

1 0