- Alsa-devel - mailman.alsa-project.org

[PATCH AUTOSEL 5.19 13/48] ASoC: SOF: Intel: hda-ipc: Do not process IPC reply before firmware boot
by Sasha Levin 14 Aug '22

14 Aug '22

From: Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> [ Upstream commit 499cc881b09c8283ab5e75b0d6d21cb427722161 ] It is not yet clear, but it is possible to create a firmware so broken that it will send a reply message before a FW_READY message (it is not yet clear if FW_READY will arrive later). Since the reply_data is allocated only after the FW_READY message, this will lead to a NULL pointer dereference if not filtered out. The issue was reported with IPC4 firmware but the same condition is present for IPC3. Reported-by: Kai Vehmanen <kai.vehmanen(a)linux.intel.com> Signed-off-by: Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> Reviewed-by: Ranjani Sridharan <ranjani.sridharan(a)linux.intel.com> Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart(a)linux.intel.com> Link: https://lore.kernel.org/r/20220712122357.31282-3-peter.ujfalusi@linux.intel… Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- sound/soc/sof/intel/hda-ipc.c | 39 ++++++++++++++++++++++------------- 1 file changed, 25 insertions(+), 14 deletions(-) diff --git a/sound/soc/sof/intel/hda-ipc.c b/sound/soc/sof/intel/hda-ipc.c index f08011249955..65e688f749ea 100644 --- a/sound/soc/sof/intel/hda-ipc.c +++ b/sound/soc/sof/intel/hda-ipc.c @@ -148,17 +148,23 @@ irqreturn_t hda_dsp_ipc4_irq_thread(int irq, void *context) if (primary & SOF_IPC4_MSG_DIR_MASK) { /* Reply received */ - struct sof_ipc4_msg *data = sdev->ipc->msg.reply_data; + if (likely(sdev->fw_state == SOF_FW_BOOT_COMPLETE)) { + struct sof_ipc4_msg *data = sdev->ipc->msg.reply_data; - data->primary = primary; - data->extension = extension; + data->primary = primary; + data->extension = extension; - spin_lock_irq(&sdev->ipc_lock); + spin_lock_irq(&sdev->ipc_lock); - snd_sof_ipc_get_reply(sdev); - snd_sof_ipc_reply(sdev, data->primary); + snd_sof_ipc_get_reply(sdev); + snd_sof_ipc_reply(sdev, data->primary); - spin_unlock_irq(&sdev->ipc_lock); + spin_unlock_irq(&sdev->ipc_lock); + } else { + dev_dbg_ratelimited(sdev->dev, + "IPC reply before FW_READY: %#x|%#x\n", + primary, extension); + } } else { /* Notification received */ @@ -225,16 +231,21 @@ irqreturn_t hda_dsp_ipc_irq_thread(int irq, void *context) * place, the message might not yet be marked as expecting a * reply. */ - spin_lock_irq(&sdev->ipc_lock); + if (likely(sdev->fw_state == SOF_FW_BOOT_COMPLETE)) { + spin_lock_irq(&sdev->ipc_lock); - /* handle immediate reply from DSP core */ - hda_dsp_ipc_get_reply(sdev); - snd_sof_ipc_reply(sdev, msg); + /* handle immediate reply from DSP core */ + hda_dsp_ipc_get_reply(sdev); + snd_sof_ipc_reply(sdev, msg); - /* set the done bit */ - hda_dsp_ipc_dsp_done(sdev); + /* set the done bit */ + hda_dsp_ipc_dsp_done(sdev); - spin_unlock_irq(&sdev->ipc_lock); + spin_unlock_irq(&sdev->ipc_lock); + } else { + dev_dbg_ratelimited(sdev->dev, "IPC reply before FW_READY: %#x\n", + msg); + } ipc_irq = true; } -- 2.35.1

1 0

[PATCH AUTOSEL 5.19 12/48] ASoC: SOF: Intel: cnl: Do not process IPC reply before firmware boot
by Sasha Levin 14 Aug '22

14 Aug '22

From: Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> [ Upstream commit acacd9eefd0def5a83244d88e5483b5f38ee7287 ] It is not yet clear, but it is possible to create a firmware so broken that it will send a reply message before a FW_READY message (it is not yet clear if FW_READY will arrive later). Since the reply_data is allocated only after the FW_READY message, this will lead to a NULL pointer dereference if not filtered out. The issue was reported with IPC4 firmware but the same condition is present for IPC3. Reported-by: Kai Vehmanen <kai.vehmanen(a)linux.intel.com> Signed-off-by: Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> Reviewed-by: Ranjani Sridharan <ranjani.sridharan(a)linux.intel.com> Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart(a)linux.intel.com> Link: https://lore.kernel.org/r/20220712122357.31282-2-peter.ujfalusi@linux.intel… Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- sound/soc/sof/intel/cnl.c | 37 ++++++++++++++++++++++++------------- 1 file changed, 24 insertions(+), 13 deletions(-) diff --git a/sound/soc/sof/intel/cnl.c b/sound/soc/sof/intel/cnl.c index cd6e5f8a5eb4..6c98f65635fc 100644 --- a/sound/soc/sof/intel/cnl.c +++ b/sound/soc/sof/intel/cnl.c @@ -60,17 +60,23 @@ irqreturn_t cnl_ipc4_irq_thread(int irq, void *context) if (primary & SOF_IPC4_MSG_DIR_MASK) { /* Reply received */ - struct sof_ipc4_msg *data = sdev->ipc->msg.reply_data; + if (likely(sdev->fw_state == SOF_FW_BOOT_COMPLETE)) { + struct sof_ipc4_msg *data = sdev->ipc->msg.reply_data; - data->primary = primary; - data->extension = extension; + data->primary = primary; + data->extension = extension; - spin_lock_irq(&sdev->ipc_lock); + spin_lock_irq(&sdev->ipc_lock); - snd_sof_ipc_get_reply(sdev); - snd_sof_ipc_reply(sdev, data->primary); + snd_sof_ipc_get_reply(sdev); + snd_sof_ipc_reply(sdev, data->primary); - spin_unlock_irq(&sdev->ipc_lock); + spin_unlock_irq(&sdev->ipc_lock); + } else { + dev_dbg_ratelimited(sdev->dev, + "IPC reply before FW_READY: %#x|%#x\n", + primary, extension); + } } else { /* Notification received */ notification_data.primary = primary; @@ -124,15 +130,20 @@ irqreturn_t cnl_ipc_irq_thread(int irq, void *context) CNL_DSP_REG_HIPCCTL, CNL_DSP_REG_HIPCCTL_DONE, 0); - spin_lock_irq(&sdev->ipc_lock); + if (likely(sdev->fw_state == SOF_FW_BOOT_COMPLETE)) { + spin_lock_irq(&sdev->ipc_lock); - /* handle immediate reply from DSP core */ - hda_dsp_ipc_get_reply(sdev); - snd_sof_ipc_reply(sdev, msg); + /* handle immediate reply from DSP core */ + hda_dsp_ipc_get_reply(sdev); + snd_sof_ipc_reply(sdev, msg); - cnl_ipc_dsp_done(sdev); + cnl_ipc_dsp_done(sdev); - spin_unlock_irq(&sdev->ipc_lock); + spin_unlock_irq(&sdev->ipc_lock); + } else { + dev_dbg_ratelimited(sdev->dev, "IPC reply before FW_READY: %#x\n", + msg); + } ipc_irq = true; } -- 2.35.1

1 0

[PATCH AUTOSEL 5.19 10/48] ALSA: hda: Fix page fault in snd_hda_codec_shutdown()
by Sasha Levin 14 Aug '22

14 Aug '22

From: Cezary Rojewski <cezary.rojewski(a)intel.com> [ Upstream commit 980b3a8790b402e959a6d773b38b771019682be1 ] If early probe of HDAudio bus driver fails e.g.: due to missing firmware file, snd_hda_codec_shutdown() ends in manipulating uninitialized codec->pcm_list_head causing page fault. Iinitialization of HDAudio codec in ASoC is split in two: - snd_hda_codec_device_init() - snd_hda_codec_device_new() snd_hda_codec_device_init() is called during probe_codecs() by HDAudio bus driver while snd_hda_codec_device_new() is called by codec-component's ->probe(). The second call will not happen until all components required by related sound card are present within the ASoC framework. With firmware failing to load during the PCI's deferred initialization i.e.: probe_work(), no platform components are ever registered. HDAudio codec enumeration is done at that point though, so the codec components became registered to ASoC framework, calling snd_hda_codec_device_init() in the process. Now, during platform reboot snd_hda_codec_shutdown() is called for every codec found on the HDAudio bus causing oops if any of them has not completed both of their initialization steps. Relocating field initialization fixes the issue. Signed-off-by: Cezary Rojewski <cezary.rojewski(a)intel.com> Link: https://lore.kernel.org/r/20220706120230.427296-7-cezary.rojewski@intel.com Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- sound/pci/hda/hda_codec.c | 41 +++++++++++++++++++-------------------- 1 file changed, 20 insertions(+), 21 deletions(-) diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c index 7579a6982f47..d0cdb24ef3f3 100644 --- a/sound/pci/hda/hda_codec.c +++ b/sound/pci/hda/hda_codec.c @@ -931,8 +931,28 @@ snd_hda_codec_device_init(struct hda_bus *bus, unsigned int codec_addr, } codec->bus = bus; + codec->depop_delay = -1; + codec->fixup_id = HDA_FIXUP_ID_NOT_SET; + codec->core.dev.release = snd_hda_codec_dev_release; + codec->core.exec_verb = codec_exec_verb; codec->core.type = HDA_DEV_LEGACY; + mutex_init(&codec->spdif_mutex); + mutex_init(&codec->control_mutex); + snd_array_init(&codec->mixers, sizeof(struct hda_nid_item), 32); + snd_array_init(&codec->nids, sizeof(struct hda_nid_item), 32); + snd_array_init(&codec->init_pins, sizeof(struct hda_pincfg), 16); + snd_array_init(&codec->driver_pins, sizeof(struct hda_pincfg), 16); + snd_array_init(&codec->cvt_setups, sizeof(struct hda_cvt_setup), 8); + snd_array_init(&codec->spdif_out, sizeof(struct hda_spdif_out), 16); + snd_array_init(&codec->jacktbl, sizeof(struct hda_jack_tbl), 16); + snd_array_init(&codec->verbs, sizeof(struct hda_verb *), 8); + INIT_LIST_HEAD(&codec->conn_list); + INIT_LIST_HEAD(&codec->pcm_list_head); + INIT_DELAYED_WORK(&codec->jackpoll_work, hda_jackpoll_work); + refcount_set(&codec->pcm_ref, 1); + init_waitqueue_head(&codec->remove_sleep); + return codec; } EXPORT_SYMBOL_GPL(snd_hda_codec_device_init); @@ -980,29 +1000,8 @@ int snd_hda_codec_device_new(struct hda_bus *bus, struct snd_card *card, if (snd_BUG_ON(codec_addr > HDA_MAX_CODEC_ADDRESS)) return -EINVAL; - codec->core.dev.release = snd_hda_codec_dev_release; - codec->core.exec_verb = codec_exec_verb; - codec->card = card; codec->addr = codec_addr; - mutex_init(&codec->spdif_mutex); - mutex_init(&codec->control_mutex); - snd_array_init(&codec->mixers, sizeof(struct hda_nid_item), 32); - snd_array_init(&codec->nids, sizeof(struct hda_nid_item), 32); - snd_array_init(&codec->init_pins, sizeof(struct hda_pincfg), 16); - snd_array_init(&codec->driver_pins, sizeof(struct hda_pincfg), 16); - snd_array_init(&codec->cvt_setups, sizeof(struct hda_cvt_setup), 8); - snd_array_init(&codec->spdif_out, sizeof(struct hda_spdif_out), 16); - snd_array_init(&codec->jacktbl, sizeof(struct hda_jack_tbl), 16); - snd_array_init(&codec->verbs, sizeof(struct hda_verb *), 8); - INIT_LIST_HEAD(&codec->conn_list); - INIT_LIST_HEAD(&codec->pcm_list_head); - refcount_set(&codec->pcm_ref, 1); - init_waitqueue_head(&codec->remove_sleep); - - INIT_DELAYED_WORK(&codec->jackpoll_work, hda_jackpoll_work); - codec->depop_delay = -1; - codec->fixup_id = HDA_FIXUP_ID_NOT_SET; #ifdef CONFIG_PM codec->power_jiffies = jiffies; -- 2.35.1

1 0

[PATCH AUTOSEL 5.19 09/48] ASoC: Intel: avs: Set max DMA segment size
by Sasha Levin 14 Aug '22

14 Aug '22

From: Amadeusz Sławiński <amadeuszx.slawinski(a)linux.intel.com> [ Upstream commit 8544eebc78c96f1834a46b26ade3e7ebe785d10c ] Apparently it is possible for code to allocate large buffers which may cause warnings as reported in [1]. This was fixed for HDA, SOF and skylake in patchset [2], fix it also for avs driver. [1] https://github.com/thesofproject/linux/issues/3430 [2] https://lore.kernel.org/all/20220215132756.31236-1-tiwai@suse.de/ Signed-off-by: Amadeusz Sławiński <amadeuszx.slawinski(a)linux.intel.com> Signed-off-by: Cezary Rojewski <cezary.rojewski(a)intel.com> Link: https://lore.kernel.org/r/20220707124153.1858249-8-cezary.rojewski@intel.com Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- sound/soc/intel/avs/core.c | 1 + 1 file changed, 1 insertion(+) diff --git a/sound/soc/intel/avs/core.c b/sound/soc/intel/avs/core.c index 3a0997c3af2b..cf373969bb69 100644 --- a/sound/soc/intel/avs/core.c +++ b/sound/soc/intel/avs/core.c @@ -445,6 +445,7 @@ static int avs_pci_probe(struct pci_dev *pci, const struct pci_device_id *id) dma_set_mask(dev, DMA_BIT_MASK(32)); dma_set_coherent_mask(dev, DMA_BIT_MASK(32)); } + dma_set_max_seg_size(dev, UINT_MAX); ret = avs_hdac_bus_init_streams(bus); if (ret < 0) { -- 2.35.1

1 0

[PATCH] soundwire: qcom: Check device status before reading devid
by Srinivas Kandagatla 13 Aug '22

13 Aug '22

As per hardware datasheet its recommended that we check the device status before reading devid assigned by auto-enumeration. Without this patch we see SoundWire devices with invalid enumeration addresses on the bus. Cc: stable(a)vger.kernel.org Fixes: a6e6581942ca ("soundwire: qcom: add auto enumeration support") Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla(a)linaro.org> --- drivers/soundwire/qcom.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/soundwire/qcom.c b/drivers/soundwire/qcom.c index dbf793e7e5d7..9df970eeca45 100644 --- a/drivers/soundwire/qcom.c +++ b/drivers/soundwire/qcom.c @@ -480,6 +480,10 @@ static int qcom_swrm_enumerate(struct sdw_bus *bus) char *buf1 = (char *)&val1, *buf2 = (char *)&val2; for (i = 1; i <= SDW_MAX_DEVICES; i++) { + /* do not continue if the status is Not Present */ + if (!ctrl->status[i]) + continue; + /*SCP_Devid5 - Devid 4*/ ctrl->reg_read(ctrl, SWRM_ENUMERATOR_SLAVE_DEV_ID_1(i), &val1); -- 2.25.1

3 3

snd_pcm_readi(),return -11,Resource temporarily unavailable
by GitHub issues - opened 13 Aug '22

13 Aug '22

alsa-project/alsa-lib issue #259 was opened from xukawendi: i called the function snd_pcm_readi() to capture pcm data, but the function returns -11,and the snd_strerror(-11) shows "Resource temporarily unavailable",How can I resolve this problem? Issue URL : https://github.com/alsa-project/alsa-lib/issues/259 Repository URL: https://github.com/alsa-project/alsa-lib

1 0

[PATCH v2 0/5] iio/hwmon/mfd/leds/net/power/ASoC: dt-bindings: few stale maintainers cleanup
by Krzysztof Kozlowski 12 Aug '22

12 Aug '22

Hi, Changes since v1 ================ 1. Patch #5: Drop also Ricardo Rivera-Matos and assign TI bindings to Andrew Davis 2. Add acks. A question ========== Several of the bindings here had only one maintainer and history does not always point to a new one (although I did not perform extensive digging). I added subsystem maintainer, because dtschema requires an entry with valid email address. This is not the best choice as simply subsystem maintainer might not have the actual device (or its datasheets or any interest in it). Maybe we could add some "orphaned" entry in such case? Best regards, Krzysztof Krzysztof Kozlowski (5): dt-bindings: iio: Drop Joachim Eastwood dt-bindings: iio: Drop Bogdan Pricop dt-bindings: Drop Beniamin Bia and Stefan Popa dt-bindings: Drop Robert Jones dt-bindings: Drop Dan Murphy and Ricardo Rivera-Matos Documentation/devicetree/bindings/hwmon/adi,adm1177.yaml | 1 - Documentation/devicetree/bindings/iio/accel/fsl,mma7455.yaml | 1 - Documentation/devicetree/bindings/iio/adc/adi,ad7091r5.yaml | 2 +- Documentation/devicetree/bindings/iio/adc/adi,ad7606.yaml | 3 +-- Documentation/devicetree/bindings/iio/adc/nxp,lpc1850-adc.yaml | 2 +- Documentation/devicetree/bindings/iio/adc/ti,adc108s102.yaml | 2 +- Documentation/devicetree/bindings/iio/adc/ti,ads124s08.yaml | 2 +- .../devicetree/bindings/iio/amplifiers/adi,hmc425a.yaml | 1 - Documentation/devicetree/bindings/iio/imu/nxp,fxos8700.yaml | 2 +- .../devicetree/bindings/leds/leds-class-multicolor.yaml | 2 +- Documentation/devicetree/bindings/leds/leds-lp50xx.yaml | 2 +- Documentation/devicetree/bindings/mfd/gateworks-gsc.yaml | 1 - Documentation/devicetree/bindings/net/ti,dp83822.yaml | 2 +- Documentation/devicetree/bindings/net/ti,dp83867.yaml | 2 +- Documentation/devicetree/bindings/net/ti,dp83869.yaml | 2 +- Documentation/devicetree/bindings/power/supply/bq2515x.yaml | 3 +-- Documentation/devicetree/bindings/power/supply/bq256xx.yaml | 2 +- Documentation/devicetree/bindings/power/supply/bq25980.yaml | 3 +-- Documentation/devicetree/bindings/sound/tas2562.yaml | 2 +- Documentation/devicetree/bindings/sound/tlv320adcx140.yaml | 2 +- 20 files changed, 16 insertions(+), 23 deletions(-) -- 2.34.1

3 8

Include <sys/soundcard.h> instead of <linux/soundcard.h>
by GitHub pull_request - opened 12 Aug '22

12 Aug '22

alsa-project/alsa-oss pull request #3 was opened from davidebeatrici: The `linux` folder strictly contains kernel headers, including OSSv3's. A distribution may package the OSS development header(s) separately. Request URL : https://github.com/alsa-project/alsa-oss/pull/3 Patch URL : https://github.com/alsa-project/alsa-oss/pull/3.patch Repository URL: https://github.com/alsa-project/alsa-oss

1 0

snd_pcm_sw_params_set_xfer_align() is deprecated
by GitHub issues - opened 12 Aug '22

12 Aug '22

alsa-project/alsa-oss issue #2 was opened from davidebeatrici: ```c pcm.c: In function 'oss_dsp_sw_params': pcm.c:376:17: warning: 'snd_pcm_sw_params_set_xfer_align' is deprecated [-Wdeprecated-declarations] 376 | snd_pcm_sw_params_set_xfer_align(pcm, sw, 1); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ In file included from /usr/include/alsa/asoundlib.h:54, from pcm.c:40: /usr/include/alsa/pcm.h:1368:5: note: declared here 1368 | int snd_pcm_sw_params_set_xfer_align(snd_pcm_t *pcm, snd_pcm_sw_params_t *params, snd_pcm_uframes_t val) __attribute__((deprecated)); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ``` Issue URL : https://github.com/alsa-project/alsa-oss/issues/2 Repository URL: https://github.com/alsa-project/alsa-oss

1 0

[PATCH v8 2/2] ASoC: sun50i-dmic: dt-bindings: add DT bindings for DMIC controller
by Ban Tao 11 Aug '22

11 Aug '22

DT binding documentation for this new ASoC driver. Signed-off-by: Ban Tao <fengzheng923(a)gmail.com> Reviewed-by: Rob Herring <robh(a)kernel.org> Reviewed-by: Maxime Ripard <maxime(a)cerno.tech> --- v1->v2: 1.Fix some build errors. v2->v3: 1.Fix some build errors. v3->v4: 1.None. v4->v5: 1.Add interrupt. 2.Keep clock and reset index. v5->v6: 1.None. v6->v7: 1.None. v7->v8: 1.Fix some build errors. --- .../bindings/sound/allwinner,sun50i-h6-dmic.yaml | 79 ++++++++++++++++++++++ 1 file changed, 79 insertions(+) create mode 100644 Documentation/devicetree/bindings/sound/allwinner,sun50i-h6-dmic.yaml diff --git a/Documentation/devicetree/bindings/sound/allwinner,sun50i-h6-dmic.yaml b/Documentation/devicetree/bindings/sound/allwinner,sun50i-h6-dmic.yaml new file mode 100644 index 0000000..0cfc07f --- /dev/null +++ b/Documentation/devicetree/bindings/sound/allwinner,sun50i-h6-dmic.yaml @@ -0,0 +1,79 @@ +# SPDX-License-Identifier: (GPL-2.0+ OR BSD-2-Clause) +%YAML 1.2 +--- +$id: http://devicetree.org/schemas/sound/allwinner,sun50i-h6-dmic.yaml# +$schema: http://devicetree.org/meta-schemas/core.yaml# + +title: Allwinner H6 DMIC Device Tree Bindings + +maintainers: + - Ban Tao <fengzheng923(a)gmail.com> + +properties: + "#sound-dai-cells": + const: 0 + + compatible: + const: allwinner,sun50i-h6-dmic + + reg: + maxItems: 1 + + interrupts: + maxItems: 1 + + clocks: + items: + - description: Bus Clock + - description: Module Clock + + clock-names: + items: + - const: bus + - const: mod + + dmas: + items: + - description: RX DMA Channel + + dma-names: + items: + - const: rx + + resets: + maxItems: 1 + +required: + - "#sound-dai-cells" + - compatible + - reg + - interrupts + - clocks + - clock-names + - dmas + - dma-names + - resets + +additionalProperties: false + +examples: + - | + #include <dt-bindings/interrupt-controller/arm-gic.h> + #include <dt-bindings/interrupt-controller/irq.h> + + #include <dt-bindings/clock/sun50i-h6-ccu.h> + #include <dt-bindings/reset/sun50i-h6-ccu.h> + + dmic: dmic@5095000 { + #sound-dai-cells = <0>; + compatible = "allwinner,sun50i-h6-dmic"; + reg = <0x05095000 0x400>; + interrupts = <GIC_SPI 22 IRQ_TYPE_LEVEL_HIGH>; + clocks = <&ccu CLK_BUS_DMIC>, <&ccu CLK_DMIC>; + clock-names = "bus", "mod"; + dmas = <&dma 7>; + dma-names = "rx"; + resets = <&ccu RST_BUS_DMIC>; + }; + +... -- 2.7.4

1 0