- Alsa-devel - mailman.alsa-project.org

[PATCH] ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF
by Takashi Iwai 13 Jan '23

13 Jan '23

From: Clement Lecigne <clecigne(a)google.com> Takes rwsem lock inside snd_ctl_elem_read instead of snd_ctl_elem_read_user like it was done for write in commit 1fa4445f9adf1 ("ALSA: control - introduce snd_ctl_notify_one() helper"). Doing this way we are also fixing the following locking issue happening in the compat path which can be easily triggered and turned into an use-after-free. 64-bits: snd_ctl_ioctl snd_ctl_elem_read_user [takes controls_rwsem] snd_ctl_elem_read [lock properly held, all good] [drops controls_rwsem] 32-bits: snd_ctl_ioctl_compat snd_ctl_elem_write_read_compat ctl_elem_write_read snd_ctl_elem_read [missing lock, not good] CVE-2023-0266 was assigned for this issue. Cc: stable(a)kernel.org # 5.13+ Signed-off-by: Clement Lecigne <clecigne(a)google.com> Signed-off-by: Takashi Iwai <tiwai(a)suse.de> --- Note: the fixes for older stable trees will be submitted in another patch sound/core/control.c | 24 +++++++++++++++--------- 1 file changed, 15 insertions(+), 9 deletions(-) diff --git a/sound/core/control.c b/sound/core/control.c index 50e7ba66f187..82aa1af1d1d8 100644 --- a/sound/core/control.c +++ b/sound/core/control.c @@ -1203,14 +1203,19 @@ static int snd_ctl_elem_read(struct snd_card *card, const u32 pattern = 0xdeadbeef; int ret; + down_read(&card->controls_rwsem); kctl = snd_ctl_find_id(card, &control->id); - if (kctl == NULL) - return -ENOENT; + if (kctl == NULL) { + ret = -ENOENT; + goto unlock; + } index_offset = snd_ctl_get_ioff(kctl, &control->id); vd = &kctl->vd[index_offset]; - if (!(vd->access & SNDRV_CTL_ELEM_ACCESS_READ) || kctl->get == NULL) - return -EPERM; + if (!(vd->access & SNDRV_CTL_ELEM_ACCESS_READ) || kctl->get == NULL) { + ret = -EPERM; + goto unlock; + } snd_ctl_build_ioff(&control->id, kctl, index_offset); @@ -1220,7 +1225,7 @@ static int snd_ctl_elem_read(struct snd_card *card, info.id = control->id; ret = __snd_ctl_elem_info(card, kctl, &info, NULL); if (ret < 0) - return ret; + goto unlock; #endif if (!snd_ctl_skip_validation(&info)) @@ -1230,7 +1235,7 @@ static int snd_ctl_elem_read(struct snd_card *card, ret = kctl->get(kctl, control); snd_power_unref(card); if (ret < 0) - return ret; + goto unlock; if (!snd_ctl_skip_validation(&info) && sanity_check_elem_value(card, control, &info, pattern) < 0) { dev_err(card->dev, @@ -1238,8 +1243,11 @@ static int snd_ctl_elem_read(struct snd_card *card, control->id.iface, control->id.device, control->id.subdevice, control->id.name, control->id.index); - return -EINVAL; + ret = -EINVAL; + goto unlock; } +unlock: + up_read(&card->controls_rwsem); return ret; } @@ -1253,9 +1261,7 @@ static int snd_ctl_elem_read_user(struct snd_card *card, if (IS_ERR(control)) return PTR_ERR(control); - down_read(&card->controls_rwsem); result = snd_ctl_elem_read(card, control); - up_read(&card->controls_rwsem); if (result < 0) goto error; -- 2.35.3

2 1

question about byte alignment (snd_pcm_hw_constraint_msbits and SNDRV_PCM_FMTBIT_S32_LE)
by Gagan Sidhu 13 Jan '23

13 Jan '23

1 0

[PATCH v2 0/5] ASoC: samsung: fsd: audio support for FSD SoC
by Padmanabhan Rajanbabu 13 Jan '23

13 Jan '23

The intention of this patch series is to enable audio support on FSD SoC. Changes in v2: 1. New compatible added in Exynos I2S driver for FSD platform. 2. Added Fixup support for Exynos I2S CPU DAI. 3. Migration of manual PSR, OPCLK configuration to Exynos CPU DAI driver as fixup. 4. Migrated from dedicated sound card to simple audio card. 5. Support added for tlv320aic3x-i2c codec on FSD platform. Changes in v1: 1. Add TDM support on samsung I2S interface. 2. Allow sound card to directly configure I2S prescaler divider instead of calculating it from frame clock. 3. The sound card support for FSD SoC which utilizes samsung I2S interface as CPU DAI. Padmanabhan Rajanbabu (5): ASoC: samsung-i2s: add FSD compatibile string ASoC: samsung: i2s: add support for FSD I2S arm64: dts: fsd: Add I2S DAI node for Tesla FSD arm64: dts: fsd: Add codec node for Tesla FSD arm64: dts: fsd: Add sound card node for Tesla FSD .../bindings/sound/samsung-i2s.yaml | 4 ++ arch/arm64/boot/dts/tesla/fsd-evb.dts | 59 +++++++++++++++++++ arch/arm64/boot/dts/tesla/fsd-pinctrl.dtsi | 14 +++++ arch/arm64/boot/dts/tesla/fsd.dtsi | 34 +++++++++++ sound/soc/samsung/i2s.c | 57 ++++++++++++++++++ 5 files changed, 168 insertions(+) -- 2.17.1

4 19

[PATCH 0/6] ALSA: fireface: support knob control event for Fireface 400
by Takashi Sakamoto 13 Jan '23

13 Jan '23

Hi, Fireface 400 uses asynchronous transaction mechanism to deliver event of hardware knob control as well as received MIDI messages. Current implementation doesn't distinguish them, thus all arrived messages are processed for MIDI message. This patchset adds the parser to distinguish them, and deliver knob control event to user space via ALSA hwdep character device. The implementation works well as long as I tested with the patches for libhitaki library: https://github.com/alsa-project/libhitaki/tree/topic/ff/400-msg I note that Fireface 400 transmits no asynchronous transaction when it is not configured by block write transaction to offset 0x000080100514, which turn off HOST led from red. Takashi Sakamoto (6): ALSA: fireface: rename callback functions ALSA: fireface: pick up time stamp for request subaction of asynchronous transaction ALSA: fireface: add helper function to parse MIDI messages transmitted by Fireface 400 ALSA: fireface: update UAPI for data of knob control ALSA: fireface: add local framework to message parser ALSA: fireface: implement message parser for Fireface 400 include/uapi/sound/firewire.h | 24 +++ sound/firewire/fireface/ff-hwdep.c | 41 ++-- sound/firewire/fireface/ff-protocol-former.c | 186 +++++++++++++++---- sound/firewire/fireface/ff-protocol-latter.c | 6 +- sound/firewire/fireface/ff-transaction.c | 17 +- sound/firewire/fireface/ff.c | 10 + sound/firewire/fireface/ff.h | 9 +- 7 files changed, 239 insertions(+), 54 deletions(-) -- 2.37.2

2 7

[PATCH] ALSA: usb-audio: Fix possible NULL pointer dereference in snd_usb_pcm_has_fixed_rate()
by Jaroslav Kysela 13 Jan '23

13 Jan '23

The subs function argument may be NULL, so do not use it before the NULL check. Fixes: 291e9da91403 ("ALSA: usb-audio: Always initialize fixed_rate in snd_usb_find_implicit_fb_sync_format()") Reported-by: coverity-bot <keescook(a)chromium.org> Link: https://lore.kernel.org/alsa-devel/202301121424.4A79A485@keescook/ Signed-off-by: Jaroslav Kysela <perex(a)perex.cz> --- sound/usb/pcm.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c index 1f72960d0d53..d959da7a1afb 100644 --- a/sound/usb/pcm.c +++ b/sound/usb/pcm.c @@ -160,11 +160,12 @@ find_substream_format(struct snd_usb_substream *subs, bool snd_usb_pcm_has_fixed_rate(struct snd_usb_substream *subs) { const struct audioformat *fp; - struct snd_usb_audio *chip = subs->stream->chip; + struct snd_usb_audio *chip; int rate = -1; if (!subs) return false; + chip = subs->stream->chip; if (!(chip->quirk_flags & QUIRK_FLAG_FIXED_RATE)) return false; list_for_each_entry(fp, &subs->fmt_list, list) { -- 2.39.0

2 1

[PATCH] Support for MAX98090/91 codec in iMX8MM evk
by Hardevsinh Palaniya 13 Jan '23

13 Jan '23

From: Hardevsinh Palaniya <hardevsinh.palaniya(a)siliconsignals.io> Date: Sat, 7 Jan 2023 17:08:28 +0530 Subject: [PATCH] Support for MAX98090/91 codec in iMX8MM evk - Adding node for MAX98090/91 in dts imx8mm-evk.dtsi - Adding tristate option in <sound/soc/codecs/Kconfig> Signed-off-by: Hardevsinh Palaniya <hardevsinh.palaniya(a)siliconsignals.io> diff --git a/arch/arm64/boot/dts/freescale/imx8mm-evk.dtsi b/arch/arm64/boot/dts/freescale/imx8mm-evk.dtsi index e0b604ac0da4..58ff63cbc930 100644 --- a/arch/arm64/boot/dts/freescale/imx8mm-evk.dtsi +++ b/arch/arm64/boot/dts/freescale/imx8mm-evk.dtsi @@ -132,6 +132,32 @@ simple-audio-card,codec { clocks = <&clk IMX8MM_CLK_SAI3_ROOT>; }; }; + + sound-max98090 { + compatible = "simple-audio-card"; + simple-audio-card,name = "max98090-audio"; + simple-audio-card,format = "i2s"; + simple-audio-card,frame-master = <&cpudai>; + simple-audio-card,bitclock-master = <&cpudai>; + simple-audio-card,widgets = "Speakers", "Speakers"; + simple-audio-card,routing = + "Speakers", "SPKR", + "Speakers", "SPKL", + "IN1", "MICBIAS", + "MIC1","IN1", + "MIC2","IN1"; + + cpudai: simple-audio-card,cpu { + sound-dai = <&sai5>; + dai-tdm-slot-num = <2>; + dai-tdm-slot-width = <32>; + }; + + simple-audio-card,codec { + sound-dai = <&max98090>; + clocks = <&clk IMX8MM_CLK_SAI5_ROOT>; + }; + }; }; &A53_0 { @@ -339,6 +365,14 @@ &i2c3 { pinctrl-0 = <&pinctrl_i2c3>; status = "okay"; + max98090: max98090@10 { + #sound-dai-cells = <0>; + compatible = "maxim,max98090"; + reg = <0x10>; + clocks = <&clk IMX8MM_CLK_SAI5_ROOT>; + clock-names = "mclk"; + }; + pca6416: gpio@20 { compatible = "ti,tca6416"; reg = <0x20>; @@ -391,6 +425,20 @@ &sai3 { status = "okay"; }; +&sai5 { + pinctrl-names = "default"; + pinctrl-0 = <&pinctrl_sai5>; + assigned-clocks = <&clk IMX8MM_CLK_SAI5>; + assigned-clock-parents = <&clk IMX8MM_AUDIO_PLL1_OUT>; + assigned-clock-rates = <24576000>; + clocks = <&clk IMX8MM_CLK_SAI5_IPG>, <&clk IMX8MM_CLK_DUMMY>, + <&clk IMX8MM_CLK_SAI5_ROOT>, <&clk IMX8MM_CLK_DUMMY>, + <&clk IMX8MM_CLK_DUMMY>, <&clk IMX8MM_AUDIO_PLL1_OUT>, + <&clk IMX8MM_AUDIO_PLL2_OUT>; + clock-names = "bus", "mclk0", "mclk1", "mclk2", "mclk3", "pll8k", "pll11k"; + status = "okay"; +}; + &snvs_pwrkey { status = "okay"; }; @@ -552,6 +600,16 @@ MX8MM_IOMUXC_SAI3_TXD_SAI3_TX_DATA0 0xd6 >; }; + pinctrl_sai5: sai5grp { + fsl,pins = < + MX8MM_IOMUXC_SAI5_MCLK_SAI5_MCLK 0xd6 + MX8MM_IOMUXC_SAI5_RXD2_SAI5_TX_BCLK 0xd6 + MX8MM_IOMUXC_SAI5_RXD1_SAI5_TX_SYNC 0xd6 + MX8MM_IOMUXC_SAI5_RXD0_SAI5_RX_DATA0 0xd6 + MX8MM_IOMUXC_SAI5_RXD3_SAI5_TX_DATA0 0xd6 + >; + } + pinctrl_typec1: typec1grp { fsl,pins = < MX8MM_IOMUXC_SD1_STROBE_GPIO2_IO11 0x159 diff --git a/sound/soc/codecs/Kconfig b/sound/soc/codecs/Kconfig index 0f9d71490075..efef2df362a4 100644 --- a/sound/soc/codecs/Kconfig +++ b/sound/soc/codecs/Kconfig @@ -1009,7 +1009,7 @@ config SND_SOC_MAX98088 depends on I2C config SND_SOC_MAX98090 - tristate + tristate "Maxim MAX98090/1, Stereo Audio Codec" depends on I2C config SND_SOC_MAX98095 -- 2.25.1

3 6

[syzbot] KASAN: use-after-free Read in snd_pcm_post_stop
by syzbot 13 Jan '23

13 Jan '23

Hello, syzbot found the following issue on: HEAD commit: 0a093b2893c7 Add linux-next specific files for 20230112 git tree: linux-next console+strace: https://syzkaller.appspot.com/x/log.txt?x=123b545e480000 kernel config: https://syzkaller.appspot.com/x/.config?x=835f3591019836d5 dashboard link: https://syzkaller.appspot.com/bug?extid=e29d28728f38190cecfc compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 syz repro: https://syzkaller.appspot.com/x/repro.syz?x=17530902480000 C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1206692c480000 Downloadable assets: disk image: https://storage.googleapis.com/syzbot-assets/8111a570d6cb/disk-0a093b28.raw… vmlinux: https://storage.googleapis.com/syzbot-assets/ecc135b7fc9a/vmlinux-0a093b28.… kernel image: https://storage.googleapis.com/syzbot-assets/ca8d73b446ea/bzImage-0a093b28.… IMPORTANT: if you fix the issue, please add the following tag to the commit: Reported-by: syzbot+e29d28728f38190cecfc(a)syzkaller.appspotmail.com ================================================================== BUG: KASAN: use-after-free in __wake_up_common+0x637/0x650 kernel/sched/wait.c:100 Read of size 8 at addr ffff88801eb938f0 by task syz-executor234/5078 CPU: 0 PID: 5078 Comm: syz-executor234 Not tainted 6.2.0-rc3-next-20230112-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xd1/0x138 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:306 [inline] print_report+0x15e/0x45d mm/kasan/report.c:417 kasan_report+0xc0/0xf0 mm/kasan/report.c:517 __wake_up_common+0x637/0x650 kernel/sched/wait.c:100 __wake_up_common_lock+0xd4/0x140 kernel/sched/wait.c:138 snd_pcm_post_stop+0x91/0x1f0 sound/core/pcm_native.c:1522 snd_pcm_action_single+0xf4/0x130 sound/core/pcm_native.c:1283 snd_pcm_action+0x6e/0x90 sound/core/pcm_native.c:1364 snd_pcm_stop sound/core/pcm_native.c:1543 [inline] snd_pcm_drop+0x165/0x2b0 sound/core/pcm_native.c:2227 snd_pcm_kernel_ioctl+0x243/0x2e0 sound/core/pcm_native.c:3456 snd_pcm_oss_sync+0x230/0x810 sound/core/oss/pcm_oss.c:1746 snd_pcm_oss_release+0x27a/0x300 sound/core/oss/pcm_oss.c:2590 __fput+0x27c/0xa90 fs/file_table.c:321 task_work_run+0x16f/0x270 kernel/task_work.c:179 exit_task_work include/linux/task_work.h:38 [inline] do_exit+0xb17/0x2a90 kernel/exit.c:867 do_group_exit+0xd4/0x2a0 kernel/exit.c:1012 get_signal+0x225f/0x24f0 kernel/signal.c:2859 arch_do_signal_or_restart+0x79/0x5c0 arch/x86/kernel/signal.c:306 exit_to_user_mode_loop kernel/entry/common.c:168 [inline] exit_to_user_mode_prepare+0x11f/0x240 kernel/entry/common.c:204 __syscall_exit_to_user_mode_work kernel/entry/common.c:286 [inline] syscall_exit_to_user_mode+0x1d/0x50 kernel/entry/common.c:297 do_syscall_64+0x46/0xb0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f864105c209 Code: Unable to access opcode bytes at 0x7f864105c1df. RSP: 002b:00007fff6e56b898 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 RAX: fffffffffffffe00 RBX: 0000000000000004 RCX: 00007f864105c209 RDX: 0000000000002020 RSI: 00000000200021c0 RDI: 0000000000000006 RBP: 0000000000000000 R08: 00007fff6e56ba38 R09: 00007fff6e56ba38 R10: 000000000000000d R11: 0000000000000246 R12: 00007f864101f800 R13: 431bde82d7b634db R14: 0000000000000000 R15: 0000000000000000 </TASK> Allocated by task 5078: kasan_save_stack+0x22/0x40 mm/kasan/common.c:45 kasan_set_track+0x25/0x30 mm/kasan/common.c:52 __kasan_slab_alloc+0x7f/0x90 mm/kasan/common.c:325 kasan_slab_alloc include/linux/kasan.h:186 [inline] slab_post_alloc_hook mm/slab.h:769 [inline] kmem_cache_alloc_bulk+0x3aa/0x730 mm/slub.c:4033 __io_alloc_req_refill+0xcc/0x40b io_uring/io_uring.c:1062 io_alloc_req_refill io_uring/io_uring.h:348 [inline] io_submit_sqes.cold+0x7c/0xc2 io_uring/io_uring.c:2407 __do_sys_io_uring_enter+0x9e4/0x2c10 io_uring/io_uring.c:3429 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd Freed by task 1002: kasan_save_stack+0x22/0x40 mm/kasan/common.c:45 kasan_set_track+0x25/0x30 mm/kasan/common.c:52 kasan_save_free_info+0x2e/0x40 mm/kasan/generic.c:518 ____kasan_slab_free mm/kasan/common.c:236 [inline] ____kasan_slab_free+0x160/0x1c0 mm/kasan/common.c:200 kasan_slab_free include/linux/kasan.h:162 [inline] slab_free_hook mm/slub.c:1781 [inline] slab_free_freelist_hook+0x8b/0x1c0 mm/slub.c:1807 slab_free mm/slub.c:3787 [inline] kmem_cache_free+0xec/0x4e0 mm/slub.c:3809 io_req_caches_free+0x1a9/0x1e6 io_uring/io_uring.c:2737 io_ring_exit_work+0x2e7/0xc80 io_uring/io_uring.c:2967 process_one_work+0x9bf/0x1750 kernel/workqueue.c:2293 worker_thread+0x669/0x1090 kernel/workqueue.c:2440 kthread+0x2e8/0x3a0 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308 The buggy address belongs to the object at ffff88801eb938c0 which belongs to the cache io_kiocb of size 216 The buggy address is located 48 bytes inside of 216-byte region [ffff88801eb938c0, ffff88801eb93998) The buggy address belongs to the physical page: page:ffffea00007ae4c0 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1eb93 flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000200 ffff88801bc32dc0 dead000000000122 0000000000000000 raw: 0000000000000000 00000000800c000c 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 5078, tgid 5078 (syz-executor234), ts 58909389529, free_ts 58908987546 prep_new_page mm/page_alloc.c:2549 [inline] get_page_from_freelist+0x11bb/0x2d50 mm/page_alloc.c:4324 __alloc_pages+0x1cb/0x5c0 mm/page_alloc.c:5590 alloc_pages+0x1aa/0x270 mm/mempolicy.c:2281 alloc_slab_page mm/slub.c:1851 [inline] allocate_slab+0x25f/0x350 mm/slub.c:1998 new_slab mm/slub.c:2051 [inline] ___slab_alloc+0xa91/0x1400 mm/slub.c:3193 __kmem_cache_alloc_bulk mm/slub.c:3951 [inline] kmem_cache_alloc_bulk+0x23d/0x730 mm/slub.c:4026 __io_alloc_req_refill+0xcc/0x40b io_uring/io_uring.c:1062 io_alloc_req_refill io_uring/io_uring.h:348 [inline] io_submit_sqes.cold+0x7c/0xc2 io_uring/io_uring.c:2407 __do_sys_io_uring_enter+0x9e4/0x2c10 io_uring/io_uring.c:3429 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd page last free stack trace: reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1451 [inline] free_pcp_prepare+0x4d0/0x910 mm/page_alloc.c:1501 free_unref_page_prepare mm/page_alloc.c:3387 [inline] free_unref_page+0x1d/0x490 mm/page_alloc.c:3482 skb_free_frag include/linux/skbuff.h:3193 [inline] skb_free_head+0x96/0x110 net/core/skbuff.c:818 skb_release_data+0x5f4/0x870 net/core/skbuff.c:849 skb_release_all net/core/skbuff.c:914 [inline] __kfree_skb+0x4f/0x70 net/core/skbuff.c:928 tcp_rcv_established+0x15fd/0x2270 net/ipv4/tcp_input.c:5927 tcp_v4_do_rcv+0x663/0x9d0 net/ipv4/tcp_ipv4.c:1721 tcp_v4_rcv+0x2eab/0x3280 net/ipv4/tcp_ipv4.c:2142 ip_protocol_deliver_rcu+0x9f/0x480 net/ipv4/ip_input.c:205 ip_local_deliver_finish+0x2ec/0x4f0 net/ipv4/ip_input.c:233 NF_HOOK include/linux/netfilter.h:302 [inline] NF_HOOK include/linux/netfilter.h:296 [inline] ip_local_deliver+0x1ae/0x200 net/ipv4/ip_input.c:254 dst_input include/net/dst.h:454 [inline] ip_sublist_rcv_finish+0x9a/0x2c0 net/ipv4/ip_input.c:580 ip_list_rcv_finish.constprop.0+0x4f9/0x6c0 net/ipv4/ip_input.c:630 ip_sublist_rcv net/ipv4/ip_input.c:638 [inline] ip_list_rcv+0x347/0x4a0 net/ipv4/ip_input.c:673 __netif_receive_skb_list_ptype net/core/dev.c:5525 [inline] __netif_receive_skb_list_core+0x548/0x8f0 net/core/dev.c:5573 __netif_receive_skb_list net/core/dev.c:5625 [inline] netif_receive_skb_list_internal+0x75f/0xdc0 net/core/dev.c:5716 Memory state around the buggy address: ffff88801eb93780: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88801eb93800: fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc fc >ffff88801eb93880: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb ^ ffff88801eb93900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88801eb93980: fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc fc ================================================================== --- This report is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller(a)googlegroups.com. syzbot will keep track of this issue. See: https://goo.gl/tpsmEJ#status for how to communicate with syzbot. syzbot can test patches for this issue, for details see: https://goo.gl/tpsmEJ#testing-patches

1 0

[PATCH V9 0/5] ASoC: codecs: Add Awinic AW883XX audio amplifier driver
by wangweidong.a＠awinic.com 13 Jan '23

13 Jan '23

From: Weidong Wang <wangweidong.a(a)awinic.com> The Awinic AW883XX is an I2S/TDM input, high efficiency digital Smart K audio amplifier with an integrated 10.25V smart boost convert Add a DT schema for describing Awinic AW883xx audio amplifiers. They are controlled using I2C v8 -> v9: Delete extra empty lines Use devm_kzalloc instead of kzalloc Structure members applied with devm_kzalloc are not initialized to NULL DAMP is used for power management In Kcontrol, out-of-range values return -EINVAL Delete switch Kcontrol Use devm_snd_soc_unregister_component instead of snd_soc_unregister_component Use aw88395 instead of aw883xx in awinic,aw88395.yaml file Add the sound-dai-cells in awinic,aw88395.yaml file Use unevaluatedProperties: false in awinic,aw88395.yaml file Weidong Wang (5): ASoC: codecs: Add i2c and codec registration for aw883xx and their associated operation functions ASoC: codecs: Aw883xx function for ACF file parse and check ASoC: codecs: Aw883xx common function for ALSA Audio Driver ASoC: codecs: Aw883xx chip register file, data type file and Kconfig Makefile ASoC: dt-bindings: Add schema for "awinic,aw883xx" .../bindings/sound/awinic,aw883xx.yaml | 53 + sound/soc/codecs/Kconfig | 10 + sound/soc/codecs/Makefile | 6 + sound/soc/codecs/aw883xx/aw883xx.c | 579 ++++++ sound/soc/codecs/aw883xx/aw883xx.h | 58 + sound/soc/codecs/aw883xx/aw883xx_bin_parse.c | 1067 ++++++++++ sound/soc/codecs/aw883xx/aw883xx_bin_parse.h | 92 + sound/soc/codecs/aw883xx/aw883xx_data_type.h | 142 ++ sound/soc/codecs/aw883xx/aw883xx_device.c | 1756 +++++++++++++++++ sound/soc/codecs/aw883xx/aw883xx_device.h | 196 ++ .../soc/codecs/aw883xx/aw883xx_pid_2049_reg.h | 383 ++++ 11 files changed, 4342 insertions(+) create mode 100644 Documentation/devicetree/bindings/sound/awinic,aw883xx.yaml create mode 100644 sound/soc/codecs/aw883xx/aw883xx.c create mode 100644 sound/soc/codecs/aw883xx/aw883xx.h create mode 100644 sound/soc/codecs/aw883xx/aw883xx_bin_parse.c create mode 100644 sound/soc/codecs/aw883xx/aw883xx_bin_parse.h create mode 100644 sound/soc/codecs/aw883xx/aw883xx_data_type.h create mode 100644 sound/soc/codecs/aw883xx/aw883xx_device.c create mode 100644 sound/soc/codecs/aw883xx/aw883xx_device.h create mode 100644 sound/soc/codecs/aw883xx/aw883xx_pid_2049_reg.h base-commit: 1f5abbd77e2c1787e74b7c2caffac97def78ba52 -- 2.39.0

4 12

[RFC PATCH 00/14] Introduce QC USB SND audio offloading support
by Wesley Cheng 13 Jan '23

13 Jan '23

Several Qualcomm based chipsets can support USB audio offloading to a dedicated audio DSP, which can take over issuing transfers to the USB host controller. The intention is to reduce the load on the main processors in the SoC, and allow them to be placed into lower power modes. There are several parts to this design: 1. Adding ASoC binding layer 2. Create a USB backend for Q6DSP 3. Introduce XHCI interrupter support 4. Create vendor ops for the USB SND driver Adding ASoC binding layer: soc-usb: Intention is to treat a USB port similar to a headphone jack. The port is always present on the device, but cable/pin status can be enabled/disabled. Expose mechanisms for USB backend ASoC drivers to communicate with USB SND. Create a USB backend for Q6DSP: q6usb: Basic backend driver that will be responsible for maintaining the resources needed to initiate a playback stream using the Q6DSP. Will be the entity that checks to make sure the connected USB audio device supports the requested PCM format. If it does not, the PCM open call will fail, and userpsace ALSA can take action accordingly. Introduce XHCI interrupter support: XHCI HCD supports multiple interrupters, which allows for events to be routed to different event rings. This is determined by "Interrupter Target" field specified in Section "6.4.1.1 Normal TRB" of the XHCI specification. Events in the offloading case will be routed to an event ring that is assigned to the audio DSP. Create vendor ops for the USB SND driver: qc_audio_offload: This particular driver has several components associated with it: - QMI stream request handler - XHCI interrupter and resource management - audio DSP memory management When the audio DSP wants to enable a playback stream, the request is first received by the ASoC platform sound card. Depending on the selected route, ASoC will bring up the individual DAIs in the path. The Q6USB backend DAI will send an AFE port start command (with enabling the USB playback path), and the audio DSP will handle the request accordingly. Part of the AFE USB port start handling will have an exchange of control messages using the QMI protocol. The qc_audio_offload driver will populate the buffer information: - Event ring base address - EP transfer ring base address and pass it along to the audio DSP. All endpoint management will now be handed over to the DSP, and the main processor is not involved in transfers. Overall, implementing this feature will still expose separate sound card and PCM devices for both the platorm card and USB audio device: 0 [SM8250MTPWCD938]: sm8250 - SM8250-MTP-WCD9380-WSA8810-VA-D SM8250-MTP-WCD9380-WSA8810-VA-DMIC 1 [Audio ]: USB-Audio - USB Audio Generic USB Audio at usb-xhci-hcd.1.auto-1.4, high speed This is to ensure that userspace ALSA entities can decide which route to take when executing the audio playback. In the above, if card#1 is selected, then USB audio data will take the legacy path over the USB PCM drivers, etc... This feature was validated using: - tinymix: set/enable the multimedia path to route to USB backend - tinyplay: issue playback on platform card Wesley Cheng (14): ASoC: Add SOC USB APIs for adding an USB backend ASoC: qcom: qdsp6: Introduce USB AFE port to q6dsp ASoC: qcom: Add USB backend ASoC driver for Q6 sound: usb: card: Introduce USB SND vendor op callbacks sound: usb: Export USB SND APIs for modules usb: core: hcd: Introduce USB HCD APIs for interrupter management usb: host: xhci: Add XHCI secondary interrupter support usb: dwc3: Add DT parameter to specify maximum number of interrupters sound: usb: Introduce QC USB SND offloading support sound: usb: card: Check for support for requested audio format sound: soc: soc-usb: Add PCM format check API for USB backend sound: soc: qcom: qusb6: Ensure PCM format is supported by USB audio device ASoC: dt-bindings: Add Q6USB backend bindings ASoC: dt-bindings: Update example for enabling USB offload on SM8250 .../bindings/sound/qcom,q6usb-dais.yaml | 55 + .../bindings/sound/qcom,sm8250.yaml | 13 + drivers/usb/core/hcd.c | 86 + drivers/usb/dwc3/core.c | 12 + drivers/usb/dwc3/core.h | 2 + drivers/usb/dwc3/host.c | 5 +- drivers/usb/host/xhci-mem.c | 219 ++- drivers/usb/host/xhci-plat.c | 2 + drivers/usb/host/xhci.c | 169 +- drivers/usb/host/xhci.h | 15 + .../sound/qcom,q6dsp-lpass-ports.h | 1 + include/linux/usb.h | 7 + include/linux/usb/hcd.h | 16 +- include/sound/q6usboffload.h | 20 + include/sound/soc-usb.h | 34 + sound/soc/Makefile | 2 +- sound/soc/qcom/Kconfig | 4 + sound/soc/qcom/qdsp6/Makefile | 1 + sound/soc/qcom/qdsp6/q6afe-dai.c | 47 + sound/soc/qcom/qdsp6/q6afe.c | 183 ++ sound/soc/qcom/qdsp6/q6afe.h | 46 +- sound/soc/qcom/qdsp6/q6dsp-lpass-ports.c | 23 + sound/soc/qcom/qdsp6/q6dsp-lpass-ports.h | 1 + sound/soc/qcom/qdsp6/q6routing.c | 8 + sound/soc/qcom/qdsp6/q6usb.c | 239 +++ sound/soc/soc-usb.c | 79 + sound/usb/Kconfig | 14 + sound/usb/Makefile | 2 +- sound/usb/card.c | 43 + sound/usb/card.h | 10 + sound/usb/endpoint.c | 2 + sound/usb/helper.c | 1 + sound/usb/pcm.c | 9 +- sound/usb/pcm.h | 12 + sound/usb/qcom/Makefile | 2 + sound/usb/qcom/qc_audio_offload.c | 1610 +++++++++++++++++ sound/usb/qcom/usb_audio_qmi_v01.c | 892 +++++++++ sound/usb/qcom/usb_audio_qmi_v01.h | 162 ++ 38 files changed, 3998 insertions(+), 50 deletions(-) create mode 100644 Documentation/devicetree/bindings/sound/qcom,q6usb-dais.yaml create mode 100644 include/sound/q6usboffload.h create mode 100644 include/sound/soc-usb.h create mode 100644 sound/soc/qcom/qdsp6/q6usb.c create mode 100644 sound/soc/soc-usb.c create mode 100644 sound/usb/qcom/Makefile create mode 100644 sound/usb/qcom/qc_audio_offload.c create mode 100644 sound/usb/qcom/usb_audio_qmi_v01.c create mode 100644 sound/usb/qcom/usb_audio_qmi_v01.h

12 84

Re: [PATCH 0/8] arm64: dts: renesas: Simple-Card / Audio-Graph-Card/Card2 dts for ULCB/KF
by Geert Uytterhoeven 13 Jan '23

13 Jan '23

Hi Morimoto-san, CC DT/ASoC On Wed, Dec 14, 2022 at 2:47 AM Kuninori Morimoto <kuninori.morimoto.gx(a)renesas.com> wrote: > ALSA SoC is now supporting generic Sound Card driver such as > Simple-Card / Audio-Graph-Card/Card2, and it supports > "normal connection" and "special connections". > I'm its maintainer, thus I need/want to test these. > > I have been tested these by using my local patches to switching card, > but maintenance it locally is not useful for me, and users who want to > know the sample DT settings. > > And I have noticed that some local patch had bug, but no one noticed > about it (of course :) > > ULCB/KF is very good board to test these. > So, I want to upstream these. > > One note here is that this patch *should not* have effect to > existing normal users, but useful for test user. > So, this patch-set adds "3 card" x "2 use case" dtsi file, > and ulcb/ulcb-kf "include" one of them which doesn't change anything. > test user can switch to other card or other use case by changing > "include" dtsi. > > [1/8][2/8] are small tidyup patches for all SoC sound. Thanks for your series! I really wanted to review this earlier, but I am held back by my lack of understanding of the audio subsystem and the audio bindings. It is also not clear to me what really is hardware description (i.e. to be described in DT), and what is software policy (i.e. not to be described in DT)... Hence I have lots of questions ("A fool can ask more questions in a minute than a wise man can answer in an hour." ;-) What is the difference between "Simple Audio Card", "Audio Graph Card", and "Audio Graph Card2"? Why do we need to support all three of them? How come we can have no #sound-dai-cells, #sound-dai-cells = <0>, and #sound-dai-cells = <1>, for the same hardware? What is the real difference between Single DAI and Multi DAI? Why do we need to support both? > Kuninori Morimoto (8): > ARM: dts: renesas: #sound-dai-cells is used when simple-card > arm64: dts: renesas: #sound-dai-cells is used when simple-card > arm64: dts: renesas: add ulcb{-kf} Audio Graph Card dtsi > arm64: dts: renesas: add ulcb{-kf} Audio Graph Card2 dtsi > arm64: dts: renesas: add ulcb{-kf} Simple Audio Card dtsi The above three all describe the same hardware configuration? > arm64: dts: renesas: add ulcb{-kf} Audio Graph Card2 dtsi MIX + TDM Split dtsi > arm64: dts: renesas: add ulcb{-kf} Audio Graph Card dtsi MIX + TDM Split dtsi > arm64: dts: renesas: add ulcb{-kf} Simple Audio Card MIX + TDM Split dtsi Is MIX and TDM Split a different hardware configuration, or software policy? Thanks! > arch/arm/boot/dts/r8a7742.dtsi | 2 +- > arch/arm/boot/dts/r8a7743.dtsi | 2 +- > arch/arm/boot/dts/r8a7744.dtsi | 2 +- > arch/arm/boot/dts/r8a7745.dtsi | 2 +- > arch/arm/boot/dts/r8a7778.dtsi | 2 +- > arch/arm/boot/dts/r8a7790.dtsi | 2 +- > arch/arm/boot/dts/r8a7791.dtsi | 2 +- > arch/arm/boot/dts/r8a7793.dtsi | 2 +- > arch/arm/boot/dts/r8a7794.dtsi | 2 +- > arch/arm64/boot/dts/renesas/r8a774a1.dtsi | 2 +- > arch/arm64/boot/dts/renesas/r8a774b1.dtsi | 2 +- > arch/arm64/boot/dts/renesas/r8a774c0.dtsi | 2 +- > arch/arm64/boot/dts/renesas/r8a774e1.dtsi | 2 +- > arch/arm64/boot/dts/renesas/r8a77951.dtsi | 2 +- > arch/arm64/boot/dts/renesas/r8a77960.dtsi | 2 +- > arch/arm64/boot/dts/renesas/r8a77961.dtsi | 2 +- > arch/arm64/boot/dts/renesas/r8a77965.dtsi | 2 +- > arch/arm64/boot/dts/renesas/r8a77990.dtsi | 2 +- > arch/arm64/boot/dts/renesas/r8a77995.dtsi | 2 +- > .../boot/dts/renesas/salvator-common.dtsi | 3 - > .../ulcb-audio-graph-card-mix+split.dtsi | 89 +++++++++ > .../dts/renesas/ulcb-audio-graph-card.dtsi | 85 +++++++++ > .../ulcb-audio-graph-card2-mix+split.dtsi | 111 +++++++++++ > .../dts/renesas/ulcb-audio-graph-card2.dtsi | 26 +++ > .../ulcb-kf-audio-graph-card-mix+split.dtsi | 162 ++++++++++++++++ > .../dts/renesas/ulcb-kf-audio-graph-card.dtsi | 88 +++++++++ > .../ulcb-kf-audio-graph-card2-mix+split.dtsi | 177 ++++++++++++++++++ > .../renesas/ulcb-kf-audio-graph-card2.dtsi | 30 +++ > .../ulcb-kf-simple-audio-card-mix+split.dtsi | 137 ++++++++++++++ > .../renesas/ulcb-kf-simple-audio-card.dtsi | 85 +++++++++ > arch/arm64/boot/dts/renesas/ulcb-kf.dtsi | 66 ++----- > .../ulcb-simple-audio-card-mix+split.dtsi | 86 +++++++++ > .../dts/renesas/ulcb-simple-audio-card.dtsi | 89 +++++++++ > arch/arm64/boot/dts/renesas/ulcb.dtsi | 60 ++---- > 34 files changed, 1212 insertions(+), 120 deletions(-) > create mode 100644 arch/arm64/boot/dts/renesas/ulcb-audio-graph-card-mix+split.dtsi > create mode 100644 arch/arm64/boot/dts/renesas/ulcb-audio-graph-card.dtsi > create mode 100644 arch/arm64/boot/dts/renesas/ulcb-audio-graph-card2-mix+split.dtsi > create mode 100644 arch/arm64/boot/dts/renesas/ulcb-audio-graph-card2.dtsi > create mode 100644 arch/arm64/boot/dts/renesas/ulcb-kf-audio-graph-card-mix+split.dtsi > create mode 100644 arch/arm64/boot/dts/renesas/ulcb-kf-audio-graph-card.dtsi > create mode 100644 arch/arm64/boot/dts/renesas/ulcb-kf-audio-graph-card2-mix+split.dtsi > create mode 100644 arch/arm64/boot/dts/renesas/ulcb-kf-audio-graph-card2.dtsi > create mode 100644 arch/arm64/boot/dts/renesas/ulcb-kf-simple-audio-card-mix+split.dtsi > create mode 100644 arch/arm64/boot/dts/renesas/ulcb-kf-simple-audio-card.dtsi > create mode 100644 arch/arm64/boot/dts/renesas/ulcb-simple-audio-card-mix+split.dtsi > create mode 100644 arch/arm64/boot/dts/renesas/ulcb-simple-audio-card.dtsi Gr{oetje,eeting}s, Geert -- Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert(a)linux-m68k.org In personal conversations with technical people, I call myself a hacker. But when I'm talking to journalists I just say "programmer" or something like that. -- Linus Torvalds

2 3