April 2022 - Sound-open-firmware - mailman.alsa-project.org

[Sound-open-firmware] [PATCH v7 0/1] firmware: mtk: add adsp ipc protocol for SOF
by Allen-KH Cheng 25 May '22

25 May '22

This patch provides mediatek adsp ipc support for SOF. ADSP IPC protocol offers (send/recv) interfaces using mediatek-mailbox APIs. This patch was tested and confirmed to with SOF fw on MT8195 cherry board. Based on matthias.bgg/linux.git, v5.18-next/soc changes since v6: - rebase to matthias.bgg/linux.git, v5.18-next/soc - Prefer "GPL" over "GPL v2" for MODULE_LICENSE changes since v5: - fix WARNING: modpost: missing MODULE_LICENSE() in drivers/mailbox /mtk-adsp-mailbox.o. Add MODULE_LICENSE in the last line. - Due to WARNING: Missing or malformed SPDX-License-Identifier tag in line 1 in checkpatch, we don't remove SPDX-License in line 1. changes since v4: - add error message for wrong mbox chan changes since v3: - rebase on v5.16-rc8 - update reviewers changes since v2: - add out tag for two memory free phases changes since v1: - add comments for mtk_adsp_ipc_send and mtk_adsp_ipc_recv - remove useless MODULE_LICENSE - change label name to out_free Allen-KH Cheng (1): firmware: mediatek: add adsp ipc protocol interface drivers/firmware/Kconfig | 1 + drivers/firmware/Makefile | 1 + drivers/firmware/mediatek/Kconfig | 9 + drivers/firmware/mediatek/Makefile | 2 + drivers/firmware/mediatek/mtk-adsp-ipc.c | 161 ++++++++++++++++++ .../linux/firmware/mediatek/mtk-adsp-ipc.h | 65 +++++++ 6 files changed, 239 insertions(+) create mode 100644 drivers/firmware/mediatek/Kconfig create mode 100644 drivers/firmware/mediatek/Makefile create mode 100644 drivers/firmware/mediatek/mtk-adsp-ipc.c create mode 100644 include/linux/firmware/mediatek/mtk-adsp-ipc.h -- 2.18.0

3 4

[Sound-open-firmware] [PATCH -next] ASoC: SOF: sof-pci-dev: fix missing pci_release_regions() on error in sof_pci_probe()
by Yang Yingliang 29 Apr '22

29 Apr '22

Fix the missing pci_release_regions() before return from sof_pci_probe() in the error handling case. Fixes: 4bfbbb76e82e ("ASOC: SOF: pci: add ipc_type override for Intel IPC4 tests") Reported-by: Hulk Robot <hulkci(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- sound/soc/sof/sof-pci-dev.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/sound/soc/sof/sof-pci-dev.c b/sound/soc/sof/sof-pci-dev.c index cd90da7c92c2..3b0978b02f9f 100644 --- a/sound/soc/sof/sof-pci-dev.c +++ b/sound/soc/sof/sof-pci-dev.c @@ -217,12 +217,14 @@ int sof_pci_probe(struct pci_dev *pci, const struct pci_device_id *pci_id) desc->ipc_default, sof_pci_ipc_type); if (sof_pci_ipc_type >= SOF_IPC_TYPE_COUNT) { dev_err(dev, "invalid request value %d\n", sof_pci_ipc_type); - return -EINVAL; + ret = -EINVAL; + goto out; } if (!(BIT(sof_pci_ipc_type) & desc->ipc_supported_mask)) { dev_err(dev, "invalid request value %d, supported mask is %#x\n", sof_pci_ipc_type, desc->ipc_supported_mask); - return -EINVAL; + ret = -EINVAL; + goto out; } sof_pdata->ipc_type = sof_pci_ipc_type; } @@ -291,6 +293,8 @@ int sof_pci_probe(struct pci_dev *pci, const struct pci_device_id *pci_id) /* call sof helper for DSP hardware probe */ ret = snd_sof_device_probe(dev, sof_pdata); + +out: if (ret) pci_release_regions(pci); -- 2.25.1

2 1

[Sound-open-firmware] [PATCH v2] ASoC: SOF: mediatek: Fix allyesconfig build error
by Tinghan Shen 28 Apr '22

28 Apr '22

ld: sound/soc/sof/mediatek/mt8186/mt8186-clk.o:(.opd+0x18): multiple definition of `adsp_clock_on'; sound/soc/sof/mediatek/mt8195/mt8195-clk.o:(.opd+0x60): first defined here ld: sound/soc/sof/mediatek/mt8186/mt8186-clk.o: in function `.adsp_clock_on': ld: sound/soc/sof/mediatek/mt8186/mt8186-clk.o:(.opd+0x30): multiple definition of `adsp_clock_off'; sound/soc/sof/mediatek/mt8195/mt8195-clk.o:(.opd+0x78): first defined here ld: sound/soc/sof/mediatek/mt8186/mt8186-clk.o: in function `.adsp_clock_off': ld: sound/soc/sof/mediatek/mt8186/mt8186-loader.o:(.opd+0x0): multiple definition of `sof_hifixdsp_boot_sequence'; sound/soc/sof/mediatek/mt8195/mt8195-loader.o:(.opd+0x0): first defined here ld: sound/soc/sof/mediatek/mt8186/mt8186-loader.o: in function `.sof_hifixdsp_boot_sequence': ld: sound/soc/sof/mediatek/mt8186/mt8186-loader.o:(.opd+0x18): multiple definition of `sof_hifixdsp_shutdown'; sound/soc/sof/mediatek/mt8195/mt8195-loader.o:(.opd+0x18): first defined here ld: sound/soc/sof/mediatek/mt8186/mt8186-loader.o: in function `.sof_hifixdsp_shutdown': Fixes: 570c14dc92d5 ("ASoC: SOF: mediatek: Add mt8186 sof fw loader and dsp ops") Fixes: 210b3ab932f7 ("ASoC: SOF: mediatek: Add mt8186 dsp clock support") Signed-off-by: Tinghan Shen <tinghan.shen(a)mediatek.com> --- Changes since v1: Rebase on Mark's for-next and update "Fixes" commit id --- sound/soc/sof/mediatek/mt8186/mt8186-clk.c | 4 ++-- sound/soc/sof/mediatek/mt8186/mt8186-clk.h | 4 ++-- sound/soc/sof/mediatek/mt8186/mt8186-loader.c | 4 ++-- sound/soc/sof/mediatek/mt8186/mt8186.c | 18 +++++++++--------- sound/soc/sof/mediatek/mt8186/mt8186.h | 4 ++-- 5 files changed, 17 insertions(+), 17 deletions(-) diff --git a/sound/soc/sof/mediatek/mt8186/mt8186-clk.c b/sound/soc/sof/mediatek/mt8186/mt8186-clk.c index 5f805981b8e6..22220fd50b62 100644 --- a/sound/soc/sof/mediatek/mt8186/mt8186-clk.c +++ b/sound/soc/sof/mediatek/mt8186/mt8186-clk.c @@ -74,7 +74,7 @@ static void adsp_disable_all_clock(struct snd_sof_dev *sdev) clk_disable_unprepare(priv->clk[CLK_TOP_AUDIODSP]); } -int adsp_clock_on(struct snd_sof_dev *sdev) +int mt8186_adsp_clock_on(struct snd_sof_dev *sdev) { struct device *dev = sdev->dev; int ret; @@ -92,7 +92,7 @@ int adsp_clock_on(struct snd_sof_dev *sdev) return 0; } -void adsp_clock_off(struct snd_sof_dev *sdev) +void mt8186_adsp_clock_off(struct snd_sof_dev *sdev) { snd_sof_dsp_write(sdev, DSP_REG_BAR, ADSP_CK_EN, 0); snd_sof_dsp_write(sdev, DSP_REG_BAR, ADSP_UART_CTRL, 0); diff --git a/sound/soc/sof/mediatek/mt8186/mt8186-clk.h b/sound/soc/sof/mediatek/mt8186/mt8186-clk.h index fa174dfceff0..89c23caf0fee 100644 --- a/sound/soc/sof/mediatek/mt8186/mt8186-clk.h +++ b/sound/soc/sof/mediatek/mt8186/mt8186-clk.h @@ -19,6 +19,6 @@ enum adsp_clk_id { }; int mt8186_adsp_init_clock(struct snd_sof_dev *sdev); -int adsp_clock_on(struct snd_sof_dev *sdev); -void adsp_clock_off(struct snd_sof_dev *sdev); +int mt8186_adsp_clock_on(struct snd_sof_dev *sdev); +void mt8186_adsp_clock_off(struct snd_sof_dev *sdev); #endif diff --git a/sound/soc/sof/mediatek/mt8186/mt8186-loader.c b/sound/soc/sof/mediatek/mt8186/mt8186-loader.c index 6ab4921b1010..548b12c33d8a 100644 --- a/sound/soc/sof/mediatek/mt8186/mt8186-loader.c +++ b/sound/soc/sof/mediatek/mt8186/mt8186-loader.c @@ -11,7 +11,7 @@ #include "mt8186.h" #include "../../ops.h" -void sof_hifixdsp_boot_sequence(struct snd_sof_dev *sdev, u32 boot_addr) +void mt8186_sof_hifixdsp_boot_sequence(struct snd_sof_dev *sdev, u32 boot_addr) { /* set RUNSTALL to stop core */ snd_sof_dsp_update_bits(sdev, DSP_REG_BAR, ADSP_HIFI_IO_CONFIG, @@ -39,7 +39,7 @@ void sof_hifixdsp_boot_sequence(struct snd_sof_dev *sdev, u32 boot_addr) RUNSTALL, 0); } -void sof_hifixdsp_shutdown(struct snd_sof_dev *sdev) +void mt8186_sof_hifixdsp_shutdown(struct snd_sof_dev *sdev) { /* set RUNSTALL to stop core */ snd_sof_dsp_update_bits(sdev, DSP_REG_BAR, ADSP_HIFI_IO_CONFIG, diff --git a/sound/soc/sof/mediatek/mt8186/mt8186.c b/sound/soc/sof/mediatek/mt8186/mt8186.c index c8faa63497c6..6d574fd4492e 100644 --- a/sound/soc/sof/mediatek/mt8186/mt8186.c +++ b/sound/soc/sof/mediatek/mt8186/mt8186.c @@ -211,7 +211,7 @@ static int mt8186_run(struct snd_sof_dev *sdev) adsp_bootup_addr = SRAM_PHYS_BASE_FROM_DSP_VIEW; dev_dbg(sdev->dev, "HIFIxDSP boot from base : 0x%08X\n", adsp_bootup_addr); - sof_hifixdsp_boot_sequence(sdev, adsp_bootup_addr); + mt8186_sof_hifixdsp_boot_sequence(sdev, adsp_bootup_addr); return 0; } @@ -284,9 +284,9 @@ static int mt8186_dsp_probe(struct snd_sof_dev *sdev) return ret; } - ret = adsp_clock_on(sdev); + ret = mt8186_adsp_clock_on(sdev); if (ret) { - dev_err(sdev->dev, "adsp_clock_on fail!\n"); + dev_err(sdev->dev, "mt8186_adsp_clock_on fail!\n"); return ret; } @@ -297,18 +297,18 @@ static int mt8186_dsp_probe(struct snd_sof_dev *sdev) static int mt8186_dsp_remove(struct snd_sof_dev *sdev) { - sof_hifixdsp_shutdown(sdev); + mt8186_sof_hifixdsp_shutdown(sdev); adsp_sram_power_off(sdev); - adsp_clock_off(sdev); + mt8186_adsp_clock_off(sdev); return 0; } static int mt8186_dsp_suspend(struct snd_sof_dev *sdev, u32 target_state) { - sof_hifixdsp_shutdown(sdev); + mt8186_sof_hifixdsp_shutdown(sdev); adsp_sram_power_off(sdev); - adsp_clock_off(sdev); + mt8186_adsp_clock_off(sdev); return 0; } @@ -317,9 +317,9 @@ static int mt8186_dsp_resume(struct snd_sof_dev *sdev) { int ret; - ret = adsp_clock_on(sdev); + ret = mt8186_adsp_clock_on(sdev); if (ret) { - dev_err(sdev->dev, "adsp_clock_on fail!\n"); + dev_err(sdev->dev, "mt8186_adsp_clock_on fail!\n"); return ret; } diff --git a/sound/soc/sof/mediatek/mt8186/mt8186.h b/sound/soc/sof/mediatek/mt8186/mt8186.h index df52ae9659e4..98b2965e5ba6 100644 --- a/sound/soc/sof/mediatek/mt8186/mt8186.h +++ b/sound/soc/sof/mediatek/mt8186/mt8186.h @@ -75,6 +75,6 @@ struct snd_sof_dev; #define SIZE_SHARED_DRAM_UL 0x40000 /*Shared buffer for Uplink*/ #define TOTAL_SIZE_SHARED_DRAM_FROM_TAIL (SIZE_SHARED_DRAM_DL + SIZE_SHARED_DRAM_UL) -void sof_hifixdsp_boot_sequence(struct snd_sof_dev *sdev, u32 boot_addr); -void sof_hifixdsp_shutdown(struct snd_sof_dev *sdev); +void mt8186_sof_hifixdsp_boot_sequence(struct snd_sof_dev *sdev, u32 boot_addr); +void mt8186_sof_hifixdsp_shutdown(struct snd_sof_dev *sdev); #endif -- 2.18.0

3 2

[Sound-open-firmware] [bug report] ASoC: SOF: Intel: hda: Revisit IMR boot sequence
by Dan Carpenter 27 Apr '22

27 Apr '22

Hello Peter Ujfalusi, The patch 2a68ff846164: "ASoC: SOF: Intel: hda: Revisit IMR boot sequence" from Apr 21, 2022, leads to the following Smatch static checker warning: sound/soc/sof/intel/hda-loader.c:397 hda_dsp_cl_boot_firmware() info: return a literal instead of 'ret' sound/soc/sof/intel/hda-loader.c 381 int hda_dsp_cl_boot_firmware(struct snd_sof_dev *sdev) 382 { 383 struct sof_intel_hda_dev *hda = sdev->pdata->hw_pdata; 384 struct snd_sof_pdata *plat_data = sdev->pdata; 385 const struct sof_dev_desc *desc = plat_data->desc; 386 const struct sof_intel_dsp_desc *chip_info; 387 struct hdac_ext_stream *hext_stream; 388 struct firmware stripped_firmware; 389 struct snd_dma_buffer dmab; 390 int ret, ret1, i; 391 392 if (hda->imrboot_supported && !sdev->first_boot) { 393 dev_dbg(sdev->dev, "IMR restore supported, booting from IMR directly\n"); 394 hda->boot_iteration = 0; 395 ret = hda_dsp_boot_imr(sdev); 396 if (ret >= 0) --> 397 return ret; The hda_dsp_boot_imr() has some similar stuff where it checks for positive returns. As far as I can see, this code never returns positive values. Normally kernel code returns zero on success and negative error codes on failure. When code returns non-standard things then it really should be documented what the positive returns mean. Nothing complicated, just add a comment at the start of the function. The TLDR back story of this Smatch check is that it's not published but it regularly finds bugs. The issue is that it's more readable, plus it looks more deliberate and intentional to write: if (!ret) return 0; instead of: if (!ret) return ret; With the latter format, the bug is that people intended to write: if (ret) return ret; Obviously this kind of bug would get caught in testing, but testing is often impossible in the kernel because it depends on hardware availability. 398 399 dev_warn(sdev->dev, "IMR restore failed, trying to cold boot\n"); 400 } 401 402 chip_info = desc->chip_info; 403 regards, dan carpenter

2 1

[Sound-open-firmware] out-of-bounds access in sound/soc/sof/topology.c
by Sergey Senozhatsky 27 Apr '22

27 Apr '22

Hi, I'm running 5.10.111 LTS, so if this has been fixed already then we definitely want to cherry pick the fix for -stable. Anonymous union in this struct is of zero size /* generic control data */ struct sof_ipc_ctrl_data { struct sof_ipc_reply rhdr; uint32_t comp_id; /* control access and data type */ uint32_t type; /**< enum sof_ipc_ctrl_type */ uint32_t cmd; /**< enum sof_ipc_ctrl_cmd */ uint32_t index; /**< control index for comps > 1 control */ /* control data - can either be appended or DMAed from host */ struct sof_ipc_host_buffer buffer; uint32_t num_elems; /**< in array elems or bytes for data type */ uint32_t elems_remaining; /**< elems remaining if sent in parts */ uint32_t msg_index; /**< for large messages sent in parts */ /* reserved for future use */ uint32_t reserved[6]; /* control data - add new types if needed */ union { /* channel values can be used by volume type controls */ struct sof_ipc_ctrl_value_chan chanv[0]; /* component values used by routing controls like mux, mixer */ struct sof_ipc_ctrl_value_comp compv[0]; /* data can be used by binary controls */ struct sof_abi_hdr data[0]; }; } __packed; sof_ipc_ctrl_value_chan and sof_ipc_ctrl_value_comp are of the same size - 8 bytes, while sof_abi_hdr is much larger - _at least_ 32 bytes (`__u32 data[0]` in sof_abi_hdr suggest that there should be more payload after header). But they all contribute 0 to sizeof(sof_ipc_ctrl_data). Now control data allocations looks as follows scontrol->size = struct_size(scontrol->control_data, chanv, le32_to_cpu(mc->num_channels)); scontrol->control_data = kzalloc(scontrol->size, GFP_KERNEL); Which is sizeof(sof_ipc_ctrl_data) + mc->num_channels * sizeof(sof_ipc_ctrl_value_chan) For some reason it uses sizeof(sof_ipc_ctrl_value_chan), which is not the largest member of the union. And this is where the problem is: in order to make control->data.FOO loads and stores legal we need mc->num_channels to be of at least 4. So that sizeof(sof_ipc_ctrl_data) + mc->num_channels * sizeof(sof_ipc_ctrl_value_chan) 92 + 4 * 8 will be the same as sizeof(sof_ipc_ctrl_data) + sizeof(sof_abi_hdr). 92 + 32 Otherwise scontrol->control_data->data.FOO will access nearby/foreign slab object. And there is at least one such memory access. In sof_get_control_data(). wdata[i].pdata = wdata[i].control->control_data->data; *size += wdata[i].pdata->size; pdata->size is at offset 8, but if, say, mc->num_channels == 1 then we allocate only 8 bytes for pdata, so pdata->size is 4 bytes outside of allocated slab object. Thoughts?

4 8

[Sound-open-firmware] [PATCH] ASoC: SOF: mediatek: Fix allyesconfig build error
by Tinghan Shen 27 Apr '22

27 Apr '22

ld: sound/soc/sof/mediatek/mt8186/mt8186-clk.o:(.opd+0x18): multiple definition of `adsp_clock_on'; sound/soc/sof/mediatek/mt8195/mt8195-clk.o:(.opd+0x60): first defined here ld: sound/soc/sof/mediatek/mt8186/mt8186-clk.o: in function `.adsp_clock_on': ld: sound/soc/sof/mediatek/mt8186/mt8186-clk.o:(.opd+0x30): multiple definition of `adsp_clock_off'; sound/soc/sof/mediatek/mt8195/mt8195-clk.o:(.opd+0x78): first defined here ld: sound/soc/sof/mediatek/mt8186/mt8186-clk.o: in function `.adsp_clock_off': ld: sound/soc/sof/mediatek/mt8186/mt8186-loader.o:(.opd+0x0): multiple definition of `sof_hifixdsp_boot_sequence'; sound/soc/sof/mediatek/mt8195/mt8195-loader.o:(.opd+0x0): first defined here ld: sound/soc/sof/mediatek/mt8186/mt8186-loader.o: in function `.sof_hifixdsp_boot_sequence': ld: sound/soc/sof/mediatek/mt8186/mt8186-loader.o:(.opd+0x18): multiple definition of `sof_hifixdsp_shutdown'; sound/soc/sof/mediatek/mt8195/mt8195-loader.o:(.opd+0x18): first defined here ld: sound/soc/sof/mediatek/mt8186/mt8186-loader.o: in function `.sof_hifixdsp_shutdown': Fixes: 91316c3dbe48 ("ASoC: SOF: mediatek: Add mt8186 sof fw loader and dsp ops") Fixes: 83e1b65ad2ac ("ASoC: SOF: mediatek: Add mt8186 dsp clock support") Signed-off-by: Tinghan Shen <tinghan.shen(a)mediatek.com> --- sound/soc/sof/mediatek/mt8186/mt8186-clk.c | 4 ++-- sound/soc/sof/mediatek/mt8186/mt8186-clk.h | 4 ++-- sound/soc/sof/mediatek/mt8186/mt8186-loader.c | 4 ++-- sound/soc/sof/mediatek/mt8186/mt8186.c | 18 +++++++++--------- sound/soc/sof/mediatek/mt8186/mt8186.h | 4 ++-- 5 files changed, 17 insertions(+), 17 deletions(-) diff --git a/sound/soc/sof/mediatek/mt8186/mt8186-clk.c b/sound/soc/sof/mediatek/mt8186/mt8186-clk.c index 5f805981b8e6..22220fd50b62 100644 --- a/sound/soc/sof/mediatek/mt8186/mt8186-clk.c +++ b/sound/soc/sof/mediatek/mt8186/mt8186-clk.c @@ -74,7 +74,7 @@ static void adsp_disable_all_clock(struct snd_sof_dev *sdev) clk_disable_unprepare(priv->clk[CLK_TOP_AUDIODSP]); } -int adsp_clock_on(struct snd_sof_dev *sdev) +int mt8186_adsp_clock_on(struct snd_sof_dev *sdev) { struct device *dev = sdev->dev; int ret; @@ -92,7 +92,7 @@ int adsp_clock_on(struct snd_sof_dev *sdev) return 0; } -void adsp_clock_off(struct snd_sof_dev *sdev) +void mt8186_adsp_clock_off(struct snd_sof_dev *sdev) { snd_sof_dsp_write(sdev, DSP_REG_BAR, ADSP_CK_EN, 0); snd_sof_dsp_write(sdev, DSP_REG_BAR, ADSP_UART_CTRL, 0); diff --git a/sound/soc/sof/mediatek/mt8186/mt8186-clk.h b/sound/soc/sof/mediatek/mt8186/mt8186-clk.h index fa174dfceff0..89c23caf0fee 100644 --- a/sound/soc/sof/mediatek/mt8186/mt8186-clk.h +++ b/sound/soc/sof/mediatek/mt8186/mt8186-clk.h @@ -19,6 +19,6 @@ enum adsp_clk_id { }; int mt8186_adsp_init_clock(struct snd_sof_dev *sdev); -int adsp_clock_on(struct snd_sof_dev *sdev); -void adsp_clock_off(struct snd_sof_dev *sdev); +int mt8186_adsp_clock_on(struct snd_sof_dev *sdev); +void mt8186_adsp_clock_off(struct snd_sof_dev *sdev); #endif diff --git a/sound/soc/sof/mediatek/mt8186/mt8186-loader.c b/sound/soc/sof/mediatek/mt8186/mt8186-loader.c index 6ab4921b1010..548b12c33d8a 100644 --- a/sound/soc/sof/mediatek/mt8186/mt8186-loader.c +++ b/sound/soc/sof/mediatek/mt8186/mt8186-loader.c @@ -11,7 +11,7 @@ #include "mt8186.h" #include "../../ops.h" -void sof_hifixdsp_boot_sequence(struct snd_sof_dev *sdev, u32 boot_addr) +void mt8186_sof_hifixdsp_boot_sequence(struct snd_sof_dev *sdev, u32 boot_addr) { /* set RUNSTALL to stop core */ snd_sof_dsp_update_bits(sdev, DSP_REG_BAR, ADSP_HIFI_IO_CONFIG, @@ -39,7 +39,7 @@ void sof_hifixdsp_boot_sequence(struct snd_sof_dev *sdev, u32 boot_addr) RUNSTALL, 0); } -void sof_hifixdsp_shutdown(struct snd_sof_dev *sdev) +void mt8186_sof_hifixdsp_shutdown(struct snd_sof_dev *sdev) { /* set RUNSTALL to stop core */ snd_sof_dsp_update_bits(sdev, DSP_REG_BAR, ADSP_HIFI_IO_CONFIG, diff --git a/sound/soc/sof/mediatek/mt8186/mt8186.c b/sound/soc/sof/mediatek/mt8186/mt8186.c index c8faa63497c6..6d574fd4492e 100644 --- a/sound/soc/sof/mediatek/mt8186/mt8186.c +++ b/sound/soc/sof/mediatek/mt8186/mt8186.c @@ -211,7 +211,7 @@ static int mt8186_run(struct snd_sof_dev *sdev) adsp_bootup_addr = SRAM_PHYS_BASE_FROM_DSP_VIEW; dev_dbg(sdev->dev, "HIFIxDSP boot from base : 0x%08X\n", adsp_bootup_addr); - sof_hifixdsp_boot_sequence(sdev, adsp_bootup_addr); + mt8186_sof_hifixdsp_boot_sequence(sdev, adsp_bootup_addr); return 0; } @@ -284,9 +284,9 @@ static int mt8186_dsp_probe(struct snd_sof_dev *sdev) return ret; } - ret = adsp_clock_on(sdev); + ret = mt8186_adsp_clock_on(sdev); if (ret) { - dev_err(sdev->dev, "adsp_clock_on fail!\n"); + dev_err(sdev->dev, "mt8186_adsp_clock_on fail!\n"); return ret; } @@ -297,18 +297,18 @@ static int mt8186_dsp_probe(struct snd_sof_dev *sdev) static int mt8186_dsp_remove(struct snd_sof_dev *sdev) { - sof_hifixdsp_shutdown(sdev); + mt8186_sof_hifixdsp_shutdown(sdev); adsp_sram_power_off(sdev); - adsp_clock_off(sdev); + mt8186_adsp_clock_off(sdev); return 0; } static int mt8186_dsp_suspend(struct snd_sof_dev *sdev, u32 target_state) { - sof_hifixdsp_shutdown(sdev); + mt8186_sof_hifixdsp_shutdown(sdev); adsp_sram_power_off(sdev); - adsp_clock_off(sdev); + mt8186_adsp_clock_off(sdev); return 0; } @@ -317,9 +317,9 @@ static int mt8186_dsp_resume(struct snd_sof_dev *sdev) { int ret; - ret = adsp_clock_on(sdev); + ret = mt8186_adsp_clock_on(sdev); if (ret) { - dev_err(sdev->dev, "adsp_clock_on fail!\n"); + dev_err(sdev->dev, "mt8186_adsp_clock_on fail!\n"); return ret; } diff --git a/sound/soc/sof/mediatek/mt8186/mt8186.h b/sound/soc/sof/mediatek/mt8186/mt8186.h index df52ae9659e4..98b2965e5ba6 100644 --- a/sound/soc/sof/mediatek/mt8186/mt8186.h +++ b/sound/soc/sof/mediatek/mt8186/mt8186.h @@ -75,6 +75,6 @@ struct snd_sof_dev; #define SIZE_SHARED_DRAM_UL 0x40000 /*Shared buffer for Uplink*/ #define TOTAL_SIZE_SHARED_DRAM_FROM_TAIL (SIZE_SHARED_DRAM_DL + SIZE_SHARED_DRAM_UL) -void sof_hifixdsp_boot_sequence(struct snd_sof_dev *sdev, u32 boot_addr); -void sof_hifixdsp_shutdown(struct snd_sof_dev *sdev); +void mt8186_sof_hifixdsp_boot_sequence(struct snd_sof_dev *sdev, u32 boot_addr); +void mt8186_sof_hifixdsp_shutdown(struct snd_sof_dev *sdev); #endif -- 2.18.0

1 0

[Sound-open-firmware] [PATCH v1 0/4] Add support of MediaTek mt8186 to SOF
by Tinghan Shen 25 Apr '22

25 Apr '22

Add support of MediaTek mt8186 SoC DSP to SOF. This series is taken from thesofproject/linux/tree/topic/sof-dev-rebase. Tinghan Shen (4): ASoC: SOF: mediatek: Add mt8186 hardware support ASoC: SOF: mediatek: Add mt8186 sof fw loader and dsp ops ASoC: SOF: mediatek: Add mt8186 dsp clock support ASoC: SOF: mediatek: Add DSP system PM callback for mt8186 sound/soc/sof/mediatek/Kconfig | 9 + sound/soc/sof/mediatek/Makefile | 1 + sound/soc/sof/mediatek/adsp_helper.h | 8 + sound/soc/sof/mediatek/mt8186/Makefile | 4 + sound/soc/sof/mediatek/mt8186/mt8186-clk.c | 101 +++++ sound/soc/sof/mediatek/mt8186/mt8186-clk.h | 24 + sound/soc/sof/mediatek/mt8186/mt8186-loader.c | 53 +++ sound/soc/sof/mediatek/mt8186/mt8186.c | 413 ++++++++++++++++++ sound/soc/sof/mediatek/mt8186/mt8186.h | 80 ++++ 9 files changed, 693 insertions(+) create mode 100644 sound/soc/sof/mediatek/mt8186/Makefile create mode 100644 sound/soc/sof/mediatek/mt8186/mt8186-clk.c create mode 100644 sound/soc/sof/mediatek/mt8186/mt8186-clk.h create mode 100644 sound/soc/sof/mediatek/mt8186/mt8186-loader.c create mode 100644 sound/soc/sof/mediatek/mt8186/mt8186.c create mode 100644 sound/soc/sof/mediatek/mt8186/mt8186.h -- 2.18.0

2 5

[Sound-open-firmware] [PATCH] ASoC: SOF: using pm_runtime_resume_and_get to simplify the code
by cgel.zte＠gmail.com 20 Apr '22

20 Apr '22

From: Minghao Chi <chi.minghao(a)zte.com.cn> Using pm_runtime_resume_and_get() to replace pm_runtime_get_sync and pm_runtime_put_noidle. This change is just to simplify the code, no actual functional changes. Reported-by: Zeal Robot <zealci(a)zte.com.cn> Signed-off-by: Minghao Chi <chi.minghao(a)zte.com.cn> --- sound/soc/sof/sof-client-probes.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/sound/soc/sof/sof-client-probes.c b/sound/soc/sof/sof-client-probes.c index 797dedb26163..c4c6e03c8133 100644 --- a/sound/soc/sof/sof-client-probes.c +++ b/sound/soc/sof/sof-client-probes.c @@ -503,10 +503,9 @@ static ssize_t sof_probes_dfs_points_read(struct file *file, char __user *to, if (!buf) return -ENOMEM; - ret = pm_runtime_get_sync(dev); + ret = pm_runtime_resume_and_get(dev); if (ret < 0 && ret != -EACCES) { dev_err_ratelimited(dev, "debugfs read failed to resume %d\n", ret); - pm_runtime_put_noidle(dev); goto exit; } @@ -568,10 +567,9 @@ sof_probes_dfs_points_write(struct file *file, const char __user *from, desc = (struct sof_probe_point_desc *)tkns; - ret = pm_runtime_get_sync(dev); + ret = pm_runtime_resume_and_get(dev); if (ret < 0 && ret != -EACCES) { dev_err_ratelimited(dev, "debugfs write failed to resume %d\n", ret); - pm_runtime_put_noidle(dev); goto exit; } @@ -621,10 +619,9 @@ sof_probes_dfs_points_remove_write(struct file *file, const char __user *from, goto exit; } - ret = pm_runtime_get_sync(dev); + ret = pm_runtime_resume_and_get(dev); if (ret < 0) { dev_err_ratelimited(dev, "debugfs write failed to resume %d\n", ret); - pm_runtime_put_noidle(dev); goto exit; } -- 2.25.1

3 2

Re: [Sound-open-firmware] [PATCH] ASoC: SOF: Kconfig: Make SND_SOC_SOF_HDA_PROBES tristate
by Mark Brown 20 Apr '22

20 Apr '22

On Thu, 7 Apr 2022 16:38:13 +0100, Richard Fitzgerald wrote: > SND_SOC_SOF_HDA_PROBES must be tristate because the code it builds > depends on code that is tristate. > > If SND_SOC_SOF_HDA_PROBES is bool it leads to the following build > inconsistency: > > SND_SOC_SOF_HDA_COMMON=m > which selects SND_SOC_SOF_HDA_PROBES > but since this is a bool SND_SOC_SOF_HDA_PROBES=y > > [...] Applied to https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound.git for-next Thanks! [1/1] ASoC: SOF: Kconfig: Make SND_SOC_SOF_HDA_PROBES tristate commit: e18610eaa66a1849aaa00ca43d605fb1a6fed800 All being well this means that it will be integrated into the linux-next tree (usually sometime in the next 24 hours) and sent to Linus during the next merge window (or sooner if it is a bug fix), however if problems are discovered then the patch may be dropped or reverted. You may get further e-mails resulting from automated or manual testing and review of the tree, please engage with people reporting problems and send followup patches addressing any issues that are reported if needed. If any updates are required or you are submitting further changes they should be sent as incremental updates against current git, existing patches will not be replaced. Please add any relevant lists and maintainers to the CCs when replying to this mail. Thanks, Mark

1 0

Re: [Sound-open-firmware] [PATCH] ASoC: SOF: using pm_runtime_resume_and_get to simplify the code
by Pierre-Louis Bossart 20 Apr '22

20 Apr '22

On 4/20/22 10:23, Mark Brown wrote: > On Wed, Apr 20, 2022 at 08:28:31AM -0500, Pierre-Louis Bossart wrote: >> On 4/19/22 22:03, cgel.zte(a)gmail.com wrote: >>> From: Minghao Chi <chi.minghao(a)zte.com.cn> > >>> Using pm_runtime_resume_and_get() to replace pm_runtime_get_sync and >>> pm_runtime_put_noidle. This change is just to simplify the code, no >>> actual functional changes. > >> Well, maybe that's a simplification, but we've been using the same pattern for years now. > >> Is there really a clear direction to use this new function? > > It seems like a much better pattern and there's been a steady stream of > conversion patches. The whole get/idle thing is pretty much just sharp > edges. > >> the overwhelming majority of drivers in sound/soc still rely on the pm_runtime_get_sync (111 v. 7). > > We'll get there I'm sure. ok, I'll send follow-up patches for the remaining code. For this patch: Acked-by: Pierre-Louis Bossart <pierre-louis.bossart(a)linux.intel.com>

1 0

[Sound-open-firmware] [PATCH 5.4 330/475] ASoC: SOF: Intel: Fix NULL ptr dereference when ENOMEM
by Greg Kroah-Hartman 14 Apr '22

14 Apr '22

From: Ammar Faizi <ammarfaizi2(a)gnuweeb.org> commit b7fb0ae09009d076964afe4c1a2bde1ee2bd88a9 upstream. Do not call snd_dma_free_pages() when snd_dma_alloc_pages() returns -ENOMEM because it leads to a NULL pointer dereference bug. The dmesg says: [ T1387] sof-audio-pci-intel-tgl 0000:00:1f.3: error: memory alloc failed: -12 [ T1387] BUG: kernel NULL pointer dereference, address: 0000000000000000 [ T1387] #PF: supervisor read access in kernel mode [ T1387] #PF: error_code(0x0000) - not-present page [ T1387] PGD 0 P4D 0 [ T1387] Oops: 0000 [#1] PREEMPT SMP NOPTI [ T1387] CPU: 6 PID: 1387 Comm: alsa-sink-HDA A Tainted: G W 5.17.0-rc4-superb-owl-00055-g80d47f5de5e3 [ T1387] Hardware name: HP HP Laptop 14s-dq2xxx/87FD, BIOS F.15 09/15/2021 [ T1387] RIP: 0010:dma_free_noncontiguous+0x37/0x80 [ T1387] Code: [... snip ...] [ T1387] RSP: 0000:ffffc90002b87770 EFLAGS: 00010246 [ T1387] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ T1387] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff888101db30d0 [ T1387] RBP: 00000000fffffff4 R08: 0000000000000000 R09: 0000000000000000 [ T1387] R10: 0000000000000000 R11: ffffc90002b874d0 R12: 0000000000000001 [ T1387] R13: 0000000000058000 R14: ffff888105260c68 R15: ffff888105260828 [ T1387] FS: 00007f42e2ffd640(0000) GS:ffff888466b80000(0000) knlGS:0000000000000000 [ T1387] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ T1387] CR2: 0000000000000000 CR3: 000000014acf0003 CR4: 0000000000770ee0 [ T1387] PKRU: 55555554 [ T1387] Call Trace: [ T1387] <TASK> [ T1387] cl_stream_prepare+0x10a/0x120 [snd_sof_intel_hda_common 146addf995b9279ae7f509621078cccbe4f875e1] [... snip ...] [ T1387] </TASK> Cc: Daniel Baluta <daniel.baluta(a)nxp.com> Cc: Jaroslav Kysela <perex(a)perex.cz> Cc: Kai Vehmanen <kai.vehmanen(a)linux.intel.com> Cc: Keyon Jie <yang.jie(a)linux.intel.com> Cc: Liam Girdwood <lgirdwood(a)gmail.com> Cc: Mark Brown <broonie(a)kernel.org> Cc: Rander Wang <rander.wang(a)intel.com> Cc: Ranjani Sridharan <ranjani.sridharan(a)linux.intel.com> Cc: Takashi Iwai <tiwai(a)suse.com> Cc: sound-open-firmware(a)alsa-project.org Cc: alsa-devel(a)alsa-project.org Cc: linux-kernel(a)vger.kernel.org Cc: stable(a)vger.kernel.org # v5.2+ Fixes: d16046ffa6de040bf580a64d5f4d0aa18258a854 ("ASoC: SOF: Intel: Add Intel specific HDA firmware loader") Link: https://lore.kernel.org/lkml/20220224145124.15985-1-ammarfaizi2@gnuweeb.org/ # v1 Link: https://lore.kernel.org/lkml/20220224180850.34592-1-ammarfaizi2@gnuweeb.org/ # v2 Link: https://lore.kernel.org/lkml/20220224182818.40301-1-ammarfaizi2@gnuweeb.org/ # v3 Reviewed-by: Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart(a)linux.intel.com> Signed-off-by: Ammar Faizi <ammarfaizi2(a)gnuweeb.org> Link: https://lore.kernel.org/r/20220224185836.44907-1-ammarfaizi2@gnuweeb.org Signed-off-by: Mark Brown <broonie(a)kernel.org> [ammarfaizi2: Backport to Linux 5.4 LTS] Signed-off-by: Ammar Faizi <ammarfaizi2(a)gnuweeb.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- sound/soc/sof/intel/hda-loader.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) --- a/sound/soc/sof/intel/hda-loader.c +++ b/sound/soc/sof/intel/hda-loader.c @@ -50,7 +50,7 @@ static int cl_stream_prepare(struct snd_ ret = snd_dma_alloc_pages(SNDRV_DMA_TYPE_DEV_SG, &pci->dev, size, dmab); if (ret < 0) { dev_err(sdev->dev, "error: memory alloc failed: %x\n", ret); - goto error; + goto out_put; } hstream->period_bytes = 0;/* initialize period_bytes */ @@ -60,16 +60,17 @@ static int cl_stream_prepare(struct snd_ ret = hda_dsp_stream_hw_params(sdev, dsp_stream, dmab, NULL); if (ret < 0) { dev_err(sdev->dev, "error: hdac prepare failed: %x\n", ret); - goto error; + goto out_free; } hda_dsp_stream_spib_config(sdev, dsp_stream, HDA_DSP_SPIB_ENABLE, size); return hstream->stream_tag; -error: - hda_dsp_stream_put(sdev, direction, hstream->stream_tag); +out_free: snd_dma_free_pages(dmab); +out_put: + hda_dsp_stream_put(sdev, direction, hstream->stream_tag); return ret; }

1 0

Re: [Sound-open-firmware] [PATCH] ASoC: SOF: Intel: Check the bar size before remapping
by Mark Brown 13 Apr '22

13 Apr '22

On Sat, 9 Apr 2022 22:39:50 +0800, Zheyu Ma wrote: > The driver should use the pci_resource_len() to get the actual length of > pci bar, and compare it with the expect value. If the bar size is too > small (such as a broken device), the driver should return an error. > > Applied to https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound.git for-next Thanks! [1/1] ASoC: SOF: Intel: Check the bar size before remapping commit: 5947b2726beb61fe7911580f239222ec9c4f6967 All being well this means that it will be integrated into the linux-next tree (usually sometime in the next 24 hours) and sent to Linus during the next merge window (or sooner if it is a bug fix), however if problems are discovered then the patch may be dropped or reverted. You may get further e-mails resulting from automated or manual testing and review of the tree, please engage with people reporting problems and send followup patches addressing any issues that are reported if needed. If any updates are required or you are submitting further changes they should be sent as incremental updates against current git, existing patches will not be replaced. Please add any relevant lists and maintainers to the CCs when replying to this mail. Thanks, Mark

1 0

Re: [Sound-open-firmware] [PATCH] ASoC: SOF: Intel: Check the bar size before remapping
by Pierre-Louis Bossart 12 Apr '22

12 Apr '22

On 4/9/22 09:39, Zheyu Ma wrote: > The driver should use the pci_resource_len() to get the actual length of > pci bar, and compare it with the expect value. If the bar size is too > small (such as a broken device), the driver should return an error. > > Signed-off-by: Zheyu Ma <zheyuma97(a)gmail.com> > --- > sound/soc/sof/intel/pci-tng.c | 6 +++++- > 1 file changed, 5 insertions(+), 1 deletion(-) > > diff --git a/sound/soc/sof/intel/pci-tng.c b/sound/soc/sof/intel/pci-tng.c > index 6efef225973f..7d502cc3ca80 100644 > --- a/sound/soc/sof/intel/pci-tng.c > +++ b/sound/soc/sof/intel/pci-tng.c > @@ -75,7 +75,11 @@ static int tangier_pci_probe(struct snd_sof_dev *sdev) > > /* LPE base */ > base = pci_resource_start(pci, desc->resindex_lpe_base) - IRAM_OFFSET; > - size = PCI_BAR_SIZE; > + size = pci_resource_len(pci, desc->resindex_lpe_base); > + if (size < PCI_BAR_SIZE) { > + dev_err(sdev->dev, "error: I/O region is too small.\n"); > + return -ENODEV; > + } May I ask how you found this issue? I am not clear on why there's a patch dedicated for a single device, but the same pattern in hda.c and in the HDaudio legacy driver exists. > > dev_dbg(sdev->dev, "LPE PHY base at 0x%x size 0x%x", base, size); > sdev->bar[DSP_BAR] = devm_ioremap(sdev->dev, base, size);

2 1

Re: [Sound-open-firmware] [PATCH v7 0/1] firmware: mtk: add adsp ipc protocol for SOF
by allen-kh.cheng 08 Apr '22

08 Apr '22

Hi Daniel, On Thu, 2022-04-07 at 15:27 +0100, Daniel Golle wrote: > On Thu, Apr 07, 2022 at 09:03:37PM +0800, Allen-KH Cheng wrote: > > This patch provides mediatek adsp ipc support for SOF. > > ADSP IPC protocol offers (send/recv) interfaces using > > mediatek-mailbox APIs. > > > > This patch was tested and confirmed to with SOF fw on MT8195 > > cherry board. > > ... confirmed to **work** with ... > is probably what you meant to write here. > > Yes, thanks for your reminder. It appears that for some reason I forgot to add this part. We had tested ADSP IPC protocol with SOF in github.com/thesofproject/sof/tree/mt8195/v0.4. The other mailbox control is patchwork.kernel.org/patch/12728222/ Thanks, Allen > > > > Based on matthias.bgg/linux.git, v5.18-next/soc > > changes since v6: > > - rebase to matthias.bgg/linux.git, v5.18-next/soc > > - Prefer "GPL" over "GPL v2" for MODULE_LICENSE > > > > changes since v5: > > - fix WARNING: modpost: missing MODULE_LICENSE() in drivers/mailbox > > /mtk-adsp-mailbox.o. Add MODULE_LICENSE in the last line. > > - Due to WARNING: Missing or malformed SPDX-License-Identifier tag > > in line 1 in checkpatch, we don't remove SPDX-License in line 1. > > > > changes since v4: > > - add error message for wrong mbox chan > > > > changes since v3: > > - rebase on v5.16-rc8 > > - update reviewers > > > > changes since v2: > > - add out tag for two memory free phases > > > > changes since v1: > > - add comments for mtk_adsp_ipc_send and mtk_adsp_ipc_recv > > - remove useless MODULE_LICENSE > > - change label name to out_free > > > > > > Allen-KH Cheng (1): > > firmware: mediatek: add adsp ipc protocol interface > > > > drivers/firmware/Kconfig | 1 + > > drivers/firmware/Makefile | 1 + > > drivers/firmware/mediatek/Kconfig | 9 + > > drivers/firmware/mediatek/Makefile | 2 + > > drivers/firmware/mediatek/mtk-adsp-ipc.c | 161 > > ++++++++++++++++++ > > .../linux/firmware/mediatek/mtk-adsp-ipc.h | 65 +++++++ > > 6 files changed, 239 insertions(+) > > create mode 100644 drivers/firmware/mediatek/Kconfig > > create mode 100644 drivers/firmware/mediatek/Makefile > > create mode 100644 drivers/firmware/mediatek/mtk-adsp-ipc.c > > create mode 100644 include/linux/firmware/mediatek/mtk-adsp-ipc.h > > > > -- > > 2.18.0 > >

1 0

Re: [Sound-open-firmware] [PATCH] ASoC: SOF: topology: Avoid open coded arithmetic in memory allocation
by Mark Brown 07 Apr '22

07 Apr '22

On Sun, 20 Mar 2022 07:22:26 +0100, Christophe JAILLET wrote: > Use kcalloc() instead of kzalloc()+open coded multiplication. > This is safer and saves a few lines of code. > > Applied to https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound.git for-next Thanks! [1/1] ASoC: SOF: topology: Avoid open coded arithmetic in memory allocation commit: 0a480df0b87a75b315cc6eef62bfb597111ee630 All being well this means that it will be integrated into the linux-next tree (usually sometime in the next 24 hours) and sent to Linus during the next merge window (or sooner if it is a bug fix), however if problems are discovered then the patch may be dropped or reverted. You may get further e-mails resulting from automated or manual testing and review of the tree, please engage with people reporting problems and send followup patches addressing any issues that are reported if needed. If any updates are required or you are submitting further changes they should be sent as incremental updates against current git, existing patches will not be replaced. Please add any relevant lists and maintainers to the CCs when replying to this mail. Thanks, Mark

1 0

Re: [Sound-open-firmware] [PATCH v1] ASoC: Intel: sof_rt5682: Add support for max98360a speaker amp on SSP2
by Mark Brown 07 Apr '22

07 Apr '22

On Thu, 24 Mar 2022 16:47:08 +0800, Ajye Huang wrote: > Follow Intel's design to replace max98360a amp SSP2 reather than SSP1 > by judging DMI_OEM_STRING in sof_rt5682_quirk_table struct. > And reusing max98357's topology since DAI setting could be leveraged. > > Applied to https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound.git for-next Thanks! [1/1] ASoC: Intel: sof_rt5682: Add support for max98360a speaker amp on SSP2 commit: fcd1e39cca6e3a262f2badfcd5edd76c910ad3bc All being well this means that it will be integrated into the linux-next tree (usually sometime in the next 24 hours) and sent to Linus during the next merge window (or sooner if it is a bug fix), however if problems are discovered then the patch may be dropped or reverted. You may get further e-mails resulting from automated or manual testing and review of the tree, please engage with people reporting problems and send followup patches addressing any issues that are reported if needed. If any updates are required or you are submitting further changes they should be sent as incremental updates against current git, existing patches will not be replaced. Please add any relevant lists and maintainers to the CCs when replying to this mail. Thanks, Mark

1 0

[Sound-open-firmware] [PATCH 5.10 537/599] ASoC: SOF: Intel: Fix NULL ptr dereference when ENOMEM
by Greg Kroah-Hartman 05 Apr '22

05 Apr '22

From: Ammar Faizi <ammarfaizi2(a)gnuweeb.org> commit b7fb0ae09009d076964afe4c1a2bde1ee2bd88a9 upstream. Do not call snd_dma_free_pages() when snd_dma_alloc_pages() returns -ENOMEM because it leads to a NULL pointer dereference bug. The dmesg says: [ T1387] sof-audio-pci-intel-tgl 0000:00:1f.3: error: memory alloc failed: -12 [ T1387] BUG: kernel NULL pointer dereference, address: 0000000000000000 [ T1387] #PF: supervisor read access in kernel mode [ T1387] #PF: error_code(0x0000) - not-present page [ T1387] PGD 0 P4D 0 [ T1387] Oops: 0000 [#1] PREEMPT SMP NOPTI [ T1387] CPU: 6 PID: 1387 Comm: alsa-sink-HDA A Tainted: G W 5.17.0-rc4-superb-owl-00055-g80d47f5de5e3 [ T1387] Hardware name: HP HP Laptop 14s-dq2xxx/87FD, BIOS F.15 09/15/2021 [ T1387] RIP: 0010:dma_free_noncontiguous+0x37/0x80 [ T1387] Code: [... snip ...] [ T1387] RSP: 0000:ffffc90002b87770 EFLAGS: 00010246 [ T1387] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ T1387] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff888101db30d0 [ T1387] RBP: 00000000fffffff4 R08: 0000000000000000 R09: 0000000000000000 [ T1387] R10: 0000000000000000 R11: ffffc90002b874d0 R12: 0000000000000001 [ T1387] R13: 0000000000058000 R14: ffff888105260c68 R15: ffff888105260828 [ T1387] FS: 00007f42e2ffd640(0000) GS:ffff888466b80000(0000) knlGS:0000000000000000 [ T1387] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ T1387] CR2: 0000000000000000 CR3: 000000014acf0003 CR4: 0000000000770ee0 [ T1387] PKRU: 55555554 [ T1387] Call Trace: [ T1387] <TASK> [ T1387] cl_stream_prepare+0x10a/0x120 [snd_sof_intel_hda_common 146addf995b9279ae7f509621078cccbe4f875e1] [... snip ...] [ T1387] </TASK> Cc: Daniel Baluta <daniel.baluta(a)nxp.com> Cc: Jaroslav Kysela <perex(a)perex.cz> Cc: Kai Vehmanen <kai.vehmanen(a)linux.intel.com> Cc: Keyon Jie <yang.jie(a)linux.intel.com> Cc: Liam Girdwood <lgirdwood(a)gmail.com> Cc: Mark Brown <broonie(a)kernel.org> Cc: Rander Wang <rander.wang(a)intel.com> Cc: Ranjani Sridharan <ranjani.sridharan(a)linux.intel.com> Cc: Takashi Iwai <tiwai(a)suse.com> Cc: sound-open-firmware(a)alsa-project.org Cc: alsa-devel(a)alsa-project.org Cc: linux-kernel(a)vger.kernel.org Cc: stable(a)vger.kernel.org # v5.2+ Fixes: d16046ffa6de040bf580a64d5f4d0aa18258a854 ("ASoC: SOF: Intel: Add Intel specific HDA firmware loader") Link: https://lore.kernel.org/lkml/20220224145124.15985-1-ammarfaizi2@gnuweeb.org/ # v1 Link: https://lore.kernel.org/lkml/20220224180850.34592-1-ammarfaizi2@gnuweeb.org/ # v2 Link: https://lore.kernel.org/lkml/20220224182818.40301-1-ammarfaizi2@gnuweeb.org/ # v3 Reviewed-by: Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart(a)linux.intel.com> Signed-off-by: Ammar Faizi <ammarfaizi2(a)gnuweeb.org> Link: https://lore.kernel.org/r/20220224185836.44907-1-ammarfaizi2@gnuweeb.org Signed-off-by: Mark Brown <broonie(a)kernel.org> [ammarfaizi2: Backport to Linux 5.10 LTS] Signed-off-by: Ammar Faizi <ammarfaizi2(a)gnuweeb.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- sound/soc/sof/intel/hda-loader.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) --- a/sound/soc/sof/intel/hda-loader.c +++ b/sound/soc/sof/intel/hda-loader.c @@ -47,7 +47,7 @@ static struct hdac_ext_stream *cl_stream ret = snd_dma_alloc_pages(SNDRV_DMA_TYPE_DEV_SG, &pci->dev, size, dmab); if (ret < 0) { dev_err(sdev->dev, "error: memory alloc failed: %x\n", ret); - goto error; + goto out_put; } hstream->period_bytes = 0;/* initialize period_bytes */ @@ -58,22 +58,23 @@ static struct hdac_ext_stream *cl_stream ret = hda_dsp_iccmax_stream_hw_params(sdev, dsp_stream, dmab, NULL); if (ret < 0) { dev_err(sdev->dev, "error: iccmax stream prepare failed: %x\n", ret); - goto error; + goto out_free; } } else { ret = hda_dsp_stream_hw_params(sdev, dsp_stream, dmab, NULL); if (ret < 0) { dev_err(sdev->dev, "error: hdac prepare failed: %x\n", ret); - goto error; + goto out_free; } hda_dsp_stream_spib_config(sdev, dsp_stream, HDA_DSP_SPIB_ENABLE, size); } return dsp_stream; -error: - hda_dsp_stream_put(sdev, direction, hstream->stream_tag); +out_free: snd_dma_free_pages(dmab); +out_put: + hda_dsp_stream_put(sdev, direction, hstream->stream_tag); return ERR_PTR(ret); }

1 0

[Sound-open-firmware] [PATCH 5.15 128/913] ASoC: SOF: Intel: Fix NULL ptr dereference when ENOMEM
by Greg Kroah-Hartman 05 Apr '22

05 Apr '22

From: Ammar Faizi <ammarfaizi2(a)gnuweeb.org> commit b7fb0ae09009d076964afe4c1a2bde1ee2bd88a9 upstream. Do not call snd_dma_free_pages() when snd_dma_alloc_pages() returns -ENOMEM because it leads to a NULL pointer dereference bug. The dmesg says: [ T1387] sof-audio-pci-intel-tgl 0000:00:1f.3: error: memory alloc failed: -12 [ T1387] BUG: kernel NULL pointer dereference, address: 0000000000000000 [ T1387] #PF: supervisor read access in kernel mode [ T1387] #PF: error_code(0x0000) - not-present page [ T1387] PGD 0 P4D 0 [ T1387] Oops: 0000 [#1] PREEMPT SMP NOPTI [ T1387] CPU: 6 PID: 1387 Comm: alsa-sink-HDA A Tainted: G W 5.17.0-rc4-superb-owl-00055-g80d47f5de5e3 [ T1387] Hardware name: HP HP Laptop 14s-dq2xxx/87FD, BIOS F.15 09/15/2021 [ T1387] RIP: 0010:dma_free_noncontiguous+0x37/0x80 [ T1387] Code: [... snip ...] [ T1387] RSP: 0000:ffffc90002b87770 EFLAGS: 00010246 [ T1387] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ T1387] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff888101db30d0 [ T1387] RBP: 00000000fffffff4 R08: 0000000000000000 R09: 0000000000000000 [ T1387] R10: 0000000000000000 R11: ffffc90002b874d0 R12: 0000000000000001 [ T1387] R13: 0000000000058000 R14: ffff888105260c68 R15: ffff888105260828 [ T1387] FS: 00007f42e2ffd640(0000) GS:ffff888466b80000(0000) knlGS:0000000000000000 [ T1387] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ T1387] CR2: 0000000000000000 CR3: 000000014acf0003 CR4: 0000000000770ee0 [ T1387] PKRU: 55555554 [ T1387] Call Trace: [ T1387] <TASK> [ T1387] cl_stream_prepare+0x10a/0x120 [snd_sof_intel_hda_common 146addf995b9279ae7f509621078cccbe4f875e1] [... snip ...] [ T1387] </TASK> Cc: Daniel Baluta <daniel.baluta(a)nxp.com> Cc: Jaroslav Kysela <perex(a)perex.cz> Cc: Kai Vehmanen <kai.vehmanen(a)linux.intel.com> Cc: Keyon Jie <yang.jie(a)linux.intel.com> Cc: Liam Girdwood <lgirdwood(a)gmail.com> Cc: Mark Brown <broonie(a)kernel.org> Cc: Rander Wang <rander.wang(a)intel.com> Cc: Ranjani Sridharan <ranjani.sridharan(a)linux.intel.com> Cc: Takashi Iwai <tiwai(a)suse.com> Cc: sound-open-firmware(a)alsa-project.org Cc: alsa-devel(a)alsa-project.org Cc: linux-kernel(a)vger.kernel.org Cc: stable(a)vger.kernel.org # v5.2+ Fixes: d16046ffa6de040bf580a64d5f4d0aa18258a854 ("ASoC: SOF: Intel: Add Intel specific HDA firmware loader") Link: https://lore.kernel.org/lkml/20220224145124.15985-1-ammarfaizi2@gnuweeb.org/ # v1 Link: https://lore.kernel.org/lkml/20220224180850.34592-1-ammarfaizi2@gnuweeb.org/ # v2 Link: https://lore.kernel.org/lkml/20220224182818.40301-1-ammarfaizi2@gnuweeb.org/ # v3 Reviewed-by: Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart(a)linux.intel.com> Signed-off-by: Ammar Faizi <ammarfaizi2(a)gnuweeb.org> Link: https://lore.kernel.org/r/20220224185836.44907-1-ammarfaizi2@gnuweeb.org Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- sound/soc/sof/intel/hda-loader.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) --- a/sound/soc/sof/intel/hda-loader.c +++ b/sound/soc/sof/intel/hda-loader.c @@ -48,7 +48,7 @@ static struct hdac_ext_stream *cl_stream ret = snd_dma_alloc_pages(SNDRV_DMA_TYPE_DEV_SG, &pci->dev, size, dmab); if (ret < 0) { dev_err(sdev->dev, "error: memory alloc failed: %d\n", ret); - goto error; + goto out_put; } hstream->period_bytes = 0;/* initialize period_bytes */ @@ -59,22 +59,23 @@ static struct hdac_ext_stream *cl_stream ret = hda_dsp_iccmax_stream_hw_params(sdev, dsp_stream, dmab, NULL); if (ret < 0) { dev_err(sdev->dev, "error: iccmax stream prepare failed: %d\n", ret); - goto error; + goto out_free; } } else { ret = hda_dsp_stream_hw_params(sdev, dsp_stream, dmab, NULL); if (ret < 0) { dev_err(sdev->dev, "error: hdac prepare failed: %d\n", ret); - goto error; + goto out_free; } hda_dsp_stream_spib_config(sdev, dsp_stream, HDA_DSP_SPIB_ENABLE, size); } return dsp_stream; -error: - hda_dsp_stream_put(sdev, direction, hstream->stream_tag); +out_free: snd_dma_free_pages(dmab); +out_put: + hda_dsp_stream_put(sdev, direction, hstream->stream_tag); return ERR_PTR(ret); }

1 0

[Sound-open-firmware] [PATCH 5.16 0134/1017] ASoC: SOF: Intel: Fix NULL ptr dereference when ENOMEM
by Greg Kroah-Hartman 05 Apr '22

05 Apr '22

From: Ammar Faizi <ammarfaizi2(a)gnuweeb.org> commit b7fb0ae09009d076964afe4c1a2bde1ee2bd88a9 upstream. Do not call snd_dma_free_pages() when snd_dma_alloc_pages() returns -ENOMEM because it leads to a NULL pointer dereference bug. The dmesg says: [ T1387] sof-audio-pci-intel-tgl 0000:00:1f.3: error: memory alloc failed: -12 [ T1387] BUG: kernel NULL pointer dereference, address: 0000000000000000 [ T1387] #PF: supervisor read access in kernel mode [ T1387] #PF: error_code(0x0000) - not-present page [ T1387] PGD 0 P4D 0 [ T1387] Oops: 0000 [#1] PREEMPT SMP NOPTI [ T1387] CPU: 6 PID: 1387 Comm: alsa-sink-HDA A Tainted: G W 5.17.0-rc4-superb-owl-00055-g80d47f5de5e3 [ T1387] Hardware name: HP HP Laptop 14s-dq2xxx/87FD, BIOS F.15 09/15/2021 [ T1387] RIP: 0010:dma_free_noncontiguous+0x37/0x80 [ T1387] Code: [... snip ...] [ T1387] RSP: 0000:ffffc90002b87770 EFLAGS: 00010246 [ T1387] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ T1387] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff888101db30d0 [ T1387] RBP: 00000000fffffff4 R08: 0000000000000000 R09: 0000000000000000 [ T1387] R10: 0000000000000000 R11: ffffc90002b874d0 R12: 0000000000000001 [ T1387] R13: 0000000000058000 R14: ffff888105260c68 R15: ffff888105260828 [ T1387] FS: 00007f42e2ffd640(0000) GS:ffff888466b80000(0000) knlGS:0000000000000000 [ T1387] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ T1387] CR2: 0000000000000000 CR3: 000000014acf0003 CR4: 0000000000770ee0 [ T1387] PKRU: 55555554 [ T1387] Call Trace: [ T1387] <TASK> [ T1387] cl_stream_prepare+0x10a/0x120 [snd_sof_intel_hda_common 146addf995b9279ae7f509621078cccbe4f875e1] [... snip ...] [ T1387] </TASK> Cc: Daniel Baluta <daniel.baluta(a)nxp.com> Cc: Jaroslav Kysela <perex(a)perex.cz> Cc: Kai Vehmanen <kai.vehmanen(a)linux.intel.com> Cc: Keyon Jie <yang.jie(a)linux.intel.com> Cc: Liam Girdwood <lgirdwood(a)gmail.com> Cc: Mark Brown <broonie(a)kernel.org> Cc: Rander Wang <rander.wang(a)intel.com> Cc: Ranjani Sridharan <ranjani.sridharan(a)linux.intel.com> Cc: Takashi Iwai <tiwai(a)suse.com> Cc: sound-open-firmware(a)alsa-project.org Cc: alsa-devel(a)alsa-project.org Cc: linux-kernel(a)vger.kernel.org Cc: stable(a)vger.kernel.org # v5.2+ Fixes: d16046ffa6de040bf580a64d5f4d0aa18258a854 ("ASoC: SOF: Intel: Add Intel specific HDA firmware loader") Link: https://lore.kernel.org/lkml/20220224145124.15985-1-ammarfaizi2@gnuweeb.org/ # v1 Link: https://lore.kernel.org/lkml/20220224180850.34592-1-ammarfaizi2@gnuweeb.org/ # v2 Link: https://lore.kernel.org/lkml/20220224182818.40301-1-ammarfaizi2@gnuweeb.org/ # v3 Reviewed-by: Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart(a)linux.intel.com> Signed-off-by: Ammar Faizi <ammarfaizi2(a)gnuweeb.org> Link: https://lore.kernel.org/r/20220224185836.44907-1-ammarfaizi2@gnuweeb.org Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- sound/soc/sof/intel/hda-loader.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) --- a/sound/soc/sof/intel/hda-loader.c +++ b/sound/soc/sof/intel/hda-loader.c @@ -48,7 +48,7 @@ static struct hdac_ext_stream *cl_stream ret = snd_dma_alloc_pages(SNDRV_DMA_TYPE_DEV_SG, &pci->dev, size, dmab); if (ret < 0) { dev_err(sdev->dev, "error: memory alloc failed: %d\n", ret); - goto error; + goto out_put; } hstream->period_bytes = 0;/* initialize period_bytes */ @@ -59,22 +59,23 @@ static struct hdac_ext_stream *cl_stream ret = hda_dsp_iccmax_stream_hw_params(sdev, dsp_stream, dmab, NULL); if (ret < 0) { dev_err(sdev->dev, "error: iccmax stream prepare failed: %d\n", ret); - goto error; + goto out_free; } } else { ret = hda_dsp_stream_hw_params(sdev, dsp_stream, dmab, NULL); if (ret < 0) { dev_err(sdev->dev, "error: hdac prepare failed: %d\n", ret); - goto error; + goto out_free; } hda_dsp_stream_spib_config(sdev, dsp_stream, HDA_DSP_SPIB_ENABLE, size); } return dsp_stream; -error: - hda_dsp_stream_put(sdev, direction, hstream->stream_tag); +out_free: snd_dma_free_pages(dmab); +out_put: + hda_dsp_stream_put(sdev, direction, hstream->stream_tag); return ERR_PTR(ret); }

1 0

[Sound-open-firmware] [PATCH 5.17 0128/1126] ASoC: SOF: Intel: Fix NULL ptr dereference when ENOMEM
by Greg Kroah-Hartman 05 Apr '22

05 Apr '22

From: Ammar Faizi <ammarfaizi2(a)gnuweeb.org> commit b7fb0ae09009d076964afe4c1a2bde1ee2bd88a9 upstream. Do not call snd_dma_free_pages() when snd_dma_alloc_pages() returns -ENOMEM because it leads to a NULL pointer dereference bug. The dmesg says: [ T1387] sof-audio-pci-intel-tgl 0000:00:1f.3: error: memory alloc failed: -12 [ T1387] BUG: kernel NULL pointer dereference, address: 0000000000000000 [ T1387] #PF: supervisor read access in kernel mode [ T1387] #PF: error_code(0x0000) - not-present page [ T1387] PGD 0 P4D 0 [ T1387] Oops: 0000 [#1] PREEMPT SMP NOPTI [ T1387] CPU: 6 PID: 1387 Comm: alsa-sink-HDA A Tainted: G W 5.17.0-rc4-superb-owl-00055-g80d47f5de5e3 [ T1387] Hardware name: HP HP Laptop 14s-dq2xxx/87FD, BIOS F.15 09/15/2021 [ T1387] RIP: 0010:dma_free_noncontiguous+0x37/0x80 [ T1387] Code: [... snip ...] [ T1387] RSP: 0000:ffffc90002b87770 EFLAGS: 00010246 [ T1387] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ T1387] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff888101db30d0 [ T1387] RBP: 00000000fffffff4 R08: 0000000000000000 R09: 0000000000000000 [ T1387] R10: 0000000000000000 R11: ffffc90002b874d0 R12: 0000000000000001 [ T1387] R13: 0000000000058000 R14: ffff888105260c68 R15: ffff888105260828 [ T1387] FS: 00007f42e2ffd640(0000) GS:ffff888466b80000(0000) knlGS:0000000000000000 [ T1387] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ T1387] CR2: 0000000000000000 CR3: 000000014acf0003 CR4: 0000000000770ee0 [ T1387] PKRU: 55555554 [ T1387] Call Trace: [ T1387] <TASK> [ T1387] cl_stream_prepare+0x10a/0x120 [snd_sof_intel_hda_common 146addf995b9279ae7f509621078cccbe4f875e1] [... snip ...] [ T1387] </TASK> Cc: Daniel Baluta <daniel.baluta(a)nxp.com> Cc: Jaroslav Kysela <perex(a)perex.cz> Cc: Kai Vehmanen <kai.vehmanen(a)linux.intel.com> Cc: Keyon Jie <yang.jie(a)linux.intel.com> Cc: Liam Girdwood <lgirdwood(a)gmail.com> Cc: Mark Brown <broonie(a)kernel.org> Cc: Rander Wang <rander.wang(a)intel.com> Cc: Ranjani Sridharan <ranjani.sridharan(a)linux.intel.com> Cc: Takashi Iwai <tiwai(a)suse.com> Cc: sound-open-firmware(a)alsa-project.org Cc: alsa-devel(a)alsa-project.org Cc: linux-kernel(a)vger.kernel.org Cc: stable(a)vger.kernel.org # v5.2+ Fixes: d16046ffa6de040bf580a64d5f4d0aa18258a854 ("ASoC: SOF: Intel: Add Intel specific HDA firmware loader") Link: https://lore.kernel.org/lkml/20220224145124.15985-1-ammarfaizi2@gnuweeb.org/ # v1 Link: https://lore.kernel.org/lkml/20220224180850.34592-1-ammarfaizi2@gnuweeb.org/ # v2 Link: https://lore.kernel.org/lkml/20220224182818.40301-1-ammarfaizi2@gnuweeb.org/ # v3 Reviewed-by: Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart(a)linux.intel.com> Signed-off-by: Ammar Faizi <ammarfaizi2(a)gnuweeb.org> Link: https://lore.kernel.org/r/20220224185836.44907-1-ammarfaizi2@gnuweeb.org Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- sound/soc/sof/intel/hda-loader.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) --- a/sound/soc/sof/intel/hda-loader.c +++ b/sound/soc/sof/intel/hda-loader.c @@ -47,7 +47,7 @@ static struct hdac_ext_stream *cl_stream ret = snd_dma_alloc_pages(SNDRV_DMA_TYPE_DEV_SG, &pci->dev, size, dmab); if (ret < 0) { dev_err(sdev->dev, "error: memory alloc failed: %d\n", ret); - goto error; + goto out_put; } hstream->period_bytes = 0;/* initialize period_bytes */ @@ -58,22 +58,23 @@ static struct hdac_ext_stream *cl_stream ret = hda_dsp_iccmax_stream_hw_params(sdev, dsp_stream, dmab, NULL); if (ret < 0) { dev_err(sdev->dev, "error: iccmax stream prepare failed: %d\n", ret); - goto error; + goto out_free; } } else { ret = hda_dsp_stream_hw_params(sdev, dsp_stream, dmab, NULL); if (ret < 0) { dev_err(sdev->dev, "error: hdac prepare failed: %d\n", ret); - goto error; + goto out_free; } hda_dsp_stream_spib_config(sdev, dsp_stream, HDA_DSP_SPIB_ENABLE, size); } return dsp_stream; -error: - hda_dsp_stream_put(sdev, direction, hstream->stream_tag); +out_free: snd_dma_free_pages(dmab); +out_put: + hda_dsp_stream_put(sdev, direction, hstream->stream_tag); return ERR_PTR(ret); }

1 0

Re: [Sound-open-firmware] [PATCH v1] ASoC: Intel: sof_rt5682: Add support for max98360a speaker amp on SSP2
by Pierre-Louis Bossart 04 Apr '22

04 Apr '22

On 3/24/22 03:47, Ajye Huang wrote: > Follow Intel's design to replace max98360a amp SSP2 reather than SSP1 > by judging DMI_OEM_STRING in sof_rt5682_quirk_table struct. > And reusing max98357's topology since DAI setting could be leveraged. > > Signed-off-by: Ajye Huang <ajye_huang(a)compal.corp-partner.google.com> Acked-by: Pierre-Louis Bossart <pierre-louis.bossart(a)linux.intel.com> > --- > sound/soc/intel/boards/sof_rt5682.c | 13 +++++++++++++ > sound/soc/sof/sof-pci-dev.c | 9 ++++++++- > 2 files changed, 21 insertions(+), 1 deletion(-) > > diff --git a/sound/soc/intel/boards/sof_rt5682.c b/sound/soc/intel/boards/sof_rt5682.c > index ebec4d15edaa..7126fcb63d90 100644 > --- a/sound/soc/intel/boards/sof_rt5682.c > +++ b/sound/soc/intel/boards/sof_rt5682.c > @@ -212,6 +212,19 @@ static const struct dmi_system_id sof_rt5682_quirk_table[] = { > SOF_SSP_BT_OFFLOAD_PRESENT), > > }, > + { > + .callback = sof_rt5682_quirk_cb, > + .matches = { > + DMI_MATCH(DMI_PRODUCT_FAMILY, "Google_Brya"), > + DMI_MATCH(DMI_OEM_STRING, "AUDIO-MAX98360_ALC5682I_I2S_AMP_SSP2"), > + }, > + .driver_data = (void *)(SOF_RT5682_MCLK_EN | > + SOF_RT5682_SSP_CODEC(0) | > + SOF_SPEAKER_AMP_PRESENT | > + SOF_MAX98360A_SPEAKER_AMP_PRESENT | > + SOF_RT5682_SSP_AMP(2) | > + SOF_RT5682_NUM_HDMIDEV(4)), > + }, > {} > }; > > diff --git a/sound/soc/sof/sof-pci-dev.c b/sound/soc/sof/sof-pci-dev.c > index 4c9596742844..12f5cff22448 100644 > --- a/sound/soc/sof/sof-pci-dev.c > +++ b/sound/soc/sof/sof-pci-dev.c > @@ -83,7 +83,14 @@ static const struct dmi_system_id sof_tplg_table[] = { > }, > .driver_data = "sof-adl-max98357a-rt5682-2way.tplg", > }, > - > + { > + .callback = sof_tplg_cb, > + .matches = { > + DMI_MATCH(DMI_PRODUCT_FAMILY, "Google_Brya"), > + DMI_MATCH(DMI_OEM_STRING, "AUDIO-MAX98360_ALC5682I_I2S_AMP_SSP2"), > + }, > + .driver_data = "sof-adl-max98357a-rt5682.tplg", > + }, > {} > }; >

1 0

Re: [Sound-open-firmware] [PATCH for-stable] ASoC: SOF: Intel: Fix NULL ptr dereference when ENOMEM
by Greg Kroah-Hartman 03 Apr '22

03 Apr '22

On Sat, Apr 02, 2022 at 11:30:26PM +0700, Ammar Faizi wrote: > > Hello Greg, > > commit b7fb0ae09009d076964afe4c1a2bde1ee2bd88a9 upstream. > > Please take these two backport patches: > 1. For Linux 5.4 LTS. > 2. For Linux 5.10 LTS. > > Both will be sent as a reply to this email. > > Thank you! > > ===== > > 5.4 failed report: > https://lore.kernel.org/stable/164889915082249@kroah.com/ > > > 5.10 failed report: > https://lore.kernel.org/stable/164889914960214@kroah.com/ > > -- > Ammar Faizi > Both now queued up, thanks! greg k-h

1 0

[Sound-open-firmware] Patch "ASoC: SOF: Intel: Fix NULL ptr dereference when ENOMEM" has been added to the 5.10-stable tree
by gregkh＠linuxfoundation.org 03 Apr '22

03 Apr '22

This is a note to let you know that I've just added the patch titled ASoC: SOF: Intel: Fix NULL ptr dereference when ENOMEM to the 5.10-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum… The filename of the patch is: asoc-sof-intel-fix-null-ptr-dereference-when-enomem.patch and it can be found in the queue-5.10 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable(a)vger.kernel.org> know about it. >From b7fb0ae09009d076964afe4c1a2bde1ee2bd88a9 Mon Sep 17 00:00:00 2001 From: Ammar Faizi <ammarfaizi2(a)gnuweeb.org> Date: Fri, 25 Feb 2022 01:58:36 +0700 Subject: ASoC: SOF: Intel: Fix NULL ptr dereference when ENOMEM From: Ammar Faizi <ammarfaizi2(a)gnuweeb.org> commit b7fb0ae09009d076964afe4c1a2bde1ee2bd88a9 upstream. Do not call snd_dma_free_pages() when snd_dma_alloc_pages() returns -ENOMEM because it leads to a NULL pointer dereference bug. The dmesg says: [ T1387] sof-audio-pci-intel-tgl 0000:00:1f.3: error: memory alloc failed: -12 [ T1387] BUG: kernel NULL pointer dereference, address: 0000000000000000 [ T1387] #PF: supervisor read access in kernel mode [ T1387] #PF: error_code(0x0000) - not-present page [ T1387] PGD 0 P4D 0 [ T1387] Oops: 0000 [#1] PREEMPT SMP NOPTI [ T1387] CPU: 6 PID: 1387 Comm: alsa-sink-HDA A Tainted: G W 5.17.0-rc4-superb-owl-00055-g80d47f5de5e3 [ T1387] Hardware name: HP HP Laptop 14s-dq2xxx/87FD, BIOS F.15 09/15/2021 [ T1387] RIP: 0010:dma_free_noncontiguous+0x37/0x80 [ T1387] Code: [... snip ...] [ T1387] RSP: 0000:ffffc90002b87770 EFLAGS: 00010246 [ T1387] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ T1387] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff888101db30d0 [ T1387] RBP: 00000000fffffff4 R08: 0000000000000000 R09: 0000000000000000 [ T1387] R10: 0000000000000000 R11: ffffc90002b874d0 R12: 0000000000000001 [ T1387] R13: 0000000000058000 R14: ffff888105260c68 R15: ffff888105260828 [ T1387] FS: 00007f42e2ffd640(0000) GS:ffff888466b80000(0000) knlGS:0000000000000000 [ T1387] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ T1387] CR2: 0000000000000000 CR3: 000000014acf0003 CR4: 0000000000770ee0 [ T1387] PKRU: 55555554 [ T1387] Call Trace: [ T1387] <TASK> [ T1387] cl_stream_prepare+0x10a/0x120 [snd_sof_intel_hda_common 146addf995b9279ae7f509621078cccbe4f875e1] [... snip ...] [ T1387] </TASK> Cc: Daniel Baluta <daniel.baluta(a)nxp.com> Cc: Jaroslav Kysela <perex(a)perex.cz> Cc: Kai Vehmanen <kai.vehmanen(a)linux.intel.com> Cc: Keyon Jie <yang.jie(a)linux.intel.com> Cc: Liam Girdwood <lgirdwood(a)gmail.com> Cc: Mark Brown <broonie(a)kernel.org> Cc: Rander Wang <rander.wang(a)intel.com> Cc: Ranjani Sridharan <ranjani.sridharan(a)linux.intel.com> Cc: Takashi Iwai <tiwai(a)suse.com> Cc: sound-open-firmware(a)alsa-project.org Cc: alsa-devel(a)alsa-project.org Cc: linux-kernel(a)vger.kernel.org Cc: stable(a)vger.kernel.org # v5.2+ Fixes: d16046ffa6de040bf580a64d5f4d0aa18258a854 ("ASoC: SOF: Intel: Add Intel specific HDA firmware loader") Link: https://lore.kernel.org/lkml/20220224145124.15985-1-ammarfaizi2@gnuweeb.org/ # v1 Link: https://lore.kernel.org/lkml/20220224180850.34592-1-ammarfaizi2@gnuweeb.org/ # v2 Link: https://lore.kernel.org/lkml/20220224182818.40301-1-ammarfaizi2@gnuweeb.org/ # v3 Reviewed-by: Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart(a)linux.intel.com> Signed-off-by: Ammar Faizi <ammarfaizi2(a)gnuweeb.org> Link: https://lore.kernel.org/r/20220224185836.44907-1-ammarfaizi2@gnuweeb.org Signed-off-by: Mark Brown <broonie(a)kernel.org> [ammarfaizi2: Backport to Linux 5.10 LTS] Signed-off-by: Ammar Faizi <ammarfaizi2(a)gnuweeb.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- sound/soc/sof/intel/hda-loader.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) --- a/sound/soc/sof/intel/hda-loader.c +++ b/sound/soc/sof/intel/hda-loader.c @@ -47,7 +47,7 @@ static struct hdac_ext_stream *cl_stream ret = snd_dma_alloc_pages(SNDRV_DMA_TYPE_DEV_SG, &pci->dev, size, dmab); if (ret < 0) { dev_err(sdev->dev, "error: memory alloc failed: %x\n", ret); - goto error; + goto out_put; } hstream->period_bytes = 0;/* initialize period_bytes */ @@ -58,22 +58,23 @@ static struct hdac_ext_stream *cl_stream ret = hda_dsp_iccmax_stream_hw_params(sdev, dsp_stream, dmab, NULL); if (ret < 0) { dev_err(sdev->dev, "error: iccmax stream prepare failed: %x\n", ret); - goto error; + goto out_free; } } else { ret = hda_dsp_stream_hw_params(sdev, dsp_stream, dmab, NULL); if (ret < 0) { dev_err(sdev->dev, "error: hdac prepare failed: %x\n", ret); - goto error; + goto out_free; } hda_dsp_stream_spib_config(sdev, dsp_stream, HDA_DSP_SPIB_ENABLE, size); } return dsp_stream; -error: - hda_dsp_stream_put(sdev, direction, hstream->stream_tag); +out_free: snd_dma_free_pages(dmab); +out_put: + hda_dsp_stream_put(sdev, direction, hstream->stream_tag); return ERR_PTR(ret); } Patches currently in stable-queue which might be from ammarfaizi2(a)gnuweeb.org are queue-5.10/asoc-sof-intel-fix-null-ptr-dereference-when-enomem.patch

1 0

[Sound-open-firmware] Patch "ASoC: SOF: Intel: Fix NULL ptr dereference when ENOMEM" has been added to the 5.4-stable tree
by gregkh＠linuxfoundation.org 03 Apr '22

03 Apr '22

This is a note to let you know that I've just added the patch titled ASoC: SOF: Intel: Fix NULL ptr dereference when ENOMEM to the 5.4-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum… The filename of the patch is: asoc-sof-intel-fix-null-ptr-dereference-when-enomem.patch and it can be found in the queue-5.4 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable(a)vger.kernel.org> know about it. >From b7fb0ae09009d076964afe4c1a2bde1ee2bd88a9 Mon Sep 17 00:00:00 2001 From: Ammar Faizi <ammarfaizi2(a)gnuweeb.org> Date: Fri, 25 Feb 2022 01:58:36 +0700 Subject: ASoC: SOF: Intel: Fix NULL ptr dereference when ENOMEM From: Ammar Faizi <ammarfaizi2(a)gnuweeb.org> commit b7fb0ae09009d076964afe4c1a2bde1ee2bd88a9 upstream. Do not call snd_dma_free_pages() when snd_dma_alloc_pages() returns -ENOMEM because it leads to a NULL pointer dereference bug. The dmesg says: [ T1387] sof-audio-pci-intel-tgl 0000:00:1f.3: error: memory alloc failed: -12 [ T1387] BUG: kernel NULL pointer dereference, address: 0000000000000000 [ T1387] #PF: supervisor read access in kernel mode [ T1387] #PF: error_code(0x0000) - not-present page [ T1387] PGD 0 P4D 0 [ T1387] Oops: 0000 [#1] PREEMPT SMP NOPTI [ T1387] CPU: 6 PID: 1387 Comm: alsa-sink-HDA A Tainted: G W 5.17.0-rc4-superb-owl-00055-g80d47f5de5e3 [ T1387] Hardware name: HP HP Laptop 14s-dq2xxx/87FD, BIOS F.15 09/15/2021 [ T1387] RIP: 0010:dma_free_noncontiguous+0x37/0x80 [ T1387] Code: [... snip ...] [ T1387] RSP: 0000:ffffc90002b87770 EFLAGS: 00010246 [ T1387] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ T1387] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff888101db30d0 [ T1387] RBP: 00000000fffffff4 R08: 0000000000000000 R09: 0000000000000000 [ T1387] R10: 0000000000000000 R11: ffffc90002b874d0 R12: 0000000000000001 [ T1387] R13: 0000000000058000 R14: ffff888105260c68 R15: ffff888105260828 [ T1387] FS: 00007f42e2ffd640(0000) GS:ffff888466b80000(0000) knlGS:0000000000000000 [ T1387] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ T1387] CR2: 0000000000000000 CR3: 000000014acf0003 CR4: 0000000000770ee0 [ T1387] PKRU: 55555554 [ T1387] Call Trace: [ T1387] <TASK> [ T1387] cl_stream_prepare+0x10a/0x120 [snd_sof_intel_hda_common 146addf995b9279ae7f509621078cccbe4f875e1] [... snip ...] [ T1387] </TASK> Cc: Daniel Baluta <daniel.baluta(a)nxp.com> Cc: Jaroslav Kysela <perex(a)perex.cz> Cc: Kai Vehmanen <kai.vehmanen(a)linux.intel.com> Cc: Keyon Jie <yang.jie(a)linux.intel.com> Cc: Liam Girdwood <lgirdwood(a)gmail.com> Cc: Mark Brown <broonie(a)kernel.org> Cc: Rander Wang <rander.wang(a)intel.com> Cc: Ranjani Sridharan <ranjani.sridharan(a)linux.intel.com> Cc: Takashi Iwai <tiwai(a)suse.com> Cc: sound-open-firmware(a)alsa-project.org Cc: alsa-devel(a)alsa-project.org Cc: linux-kernel(a)vger.kernel.org Cc: stable(a)vger.kernel.org # v5.2+ Fixes: d16046ffa6de040bf580a64d5f4d0aa18258a854 ("ASoC: SOF: Intel: Add Intel specific HDA firmware loader") Link: https://lore.kernel.org/lkml/20220224145124.15985-1-ammarfaizi2@gnuweeb.org/ # v1 Link: https://lore.kernel.org/lkml/20220224180850.34592-1-ammarfaizi2@gnuweeb.org/ # v2 Link: https://lore.kernel.org/lkml/20220224182818.40301-1-ammarfaizi2@gnuweeb.org/ # v3 Reviewed-by: Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart(a)linux.intel.com> Signed-off-by: Ammar Faizi <ammarfaizi2(a)gnuweeb.org> Link: https://lore.kernel.org/r/20220224185836.44907-1-ammarfaizi2@gnuweeb.org Signed-off-by: Mark Brown <broonie(a)kernel.org> [ammarfaizi2: Backport to Linux 5.4 LTS] Signed-off-by: Ammar Faizi <ammarfaizi2(a)gnuweeb.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- sound/soc/sof/intel/hda-loader.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) --- a/sound/soc/sof/intel/hda-loader.c +++ b/sound/soc/sof/intel/hda-loader.c @@ -50,7 +50,7 @@ static int cl_stream_prepare(struct snd_ ret = snd_dma_alloc_pages(SNDRV_DMA_TYPE_DEV_SG, &pci->dev, size, dmab); if (ret < 0) { dev_err(sdev->dev, "error: memory alloc failed: %x\n", ret); - goto error; + goto out_put; } hstream->period_bytes = 0;/* initialize period_bytes */ @@ -60,16 +60,17 @@ static int cl_stream_prepare(struct snd_ ret = hda_dsp_stream_hw_params(sdev, dsp_stream, dmab, NULL); if (ret < 0) { dev_err(sdev->dev, "error: hdac prepare failed: %x\n", ret); - goto error; + goto out_free; } hda_dsp_stream_spib_config(sdev, dsp_stream, HDA_DSP_SPIB_ENABLE, size); return hstream->stream_tag; -error: - hda_dsp_stream_put(sdev, direction, hstream->stream_tag); +out_free: snd_dma_free_pages(dmab); +out_put: + hda_dsp_stream_put(sdev, direction, hstream->stream_tag); return ret; } Patches currently in stable-queue which might be from ammarfaizi2(a)gnuweeb.org are queue-5.4/asoc-sof-intel-fix-null-ptr-dereference-when-enomem.patch

1 0

[Sound-open-firmware] Patch "ASoC: SOF: Intel: Fix NULL ptr dereference when ENOMEM" has been added to the 5.15-stable tree
by gregkh＠linuxfoundation.org 02 Apr '22

02 Apr '22

This is a note to let you know that I've just added the patch titled ASoC: SOF: Intel: Fix NULL ptr dereference when ENOMEM to the 5.15-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum… The filename of the patch is: asoc-sof-intel-fix-null-ptr-dereference-when-enomem.patch and it can be found in the queue-5.15 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable(a)vger.kernel.org> know about it. >From b7fb0ae09009d076964afe4c1a2bde1ee2bd88a9 Mon Sep 17 00:00:00 2001 From: Ammar Faizi <ammarfaizi2(a)gnuweeb.org> Date: Fri, 25 Feb 2022 01:58:36 +0700 Subject: ASoC: SOF: Intel: Fix NULL ptr dereference when ENOMEM From: Ammar Faizi <ammarfaizi2(a)gnuweeb.org> commit b7fb0ae09009d076964afe4c1a2bde1ee2bd88a9 upstream. Do not call snd_dma_free_pages() when snd_dma_alloc_pages() returns -ENOMEM because it leads to a NULL pointer dereference bug. The dmesg says: [ T1387] sof-audio-pci-intel-tgl 0000:00:1f.3: error: memory alloc failed: -12 [ T1387] BUG: kernel NULL pointer dereference, address: 0000000000000000 [ T1387] #PF: supervisor read access in kernel mode [ T1387] #PF: error_code(0x0000) - not-present page [ T1387] PGD 0 P4D 0 [ T1387] Oops: 0000 [#1] PREEMPT SMP NOPTI [ T1387] CPU: 6 PID: 1387 Comm: alsa-sink-HDA A Tainted: G W 5.17.0-rc4-superb-owl-00055-g80d47f5de5e3 [ T1387] Hardware name: HP HP Laptop 14s-dq2xxx/87FD, BIOS F.15 09/15/2021 [ T1387] RIP: 0010:dma_free_noncontiguous+0x37/0x80 [ T1387] Code: [... snip ...] [ T1387] RSP: 0000:ffffc90002b87770 EFLAGS: 00010246 [ T1387] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ T1387] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff888101db30d0 [ T1387] RBP: 00000000fffffff4 R08: 0000000000000000 R09: 0000000000000000 [ T1387] R10: 0000000000000000 R11: ffffc90002b874d0 R12: 0000000000000001 [ T1387] R13: 0000000000058000 R14: ffff888105260c68 R15: ffff888105260828 [ T1387] FS: 00007f42e2ffd640(0000) GS:ffff888466b80000(0000) knlGS:0000000000000000 [ T1387] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ T1387] CR2: 0000000000000000 CR3: 000000014acf0003 CR4: 0000000000770ee0 [ T1387] PKRU: 55555554 [ T1387] Call Trace: [ T1387] <TASK> [ T1387] cl_stream_prepare+0x10a/0x120 [snd_sof_intel_hda_common 146addf995b9279ae7f509621078cccbe4f875e1] [... snip ...] [ T1387] </TASK> Cc: Daniel Baluta <daniel.baluta(a)nxp.com> Cc: Jaroslav Kysela <perex(a)perex.cz> Cc: Kai Vehmanen <kai.vehmanen(a)linux.intel.com> Cc: Keyon Jie <yang.jie(a)linux.intel.com> Cc: Liam Girdwood <lgirdwood(a)gmail.com> Cc: Mark Brown <broonie(a)kernel.org> Cc: Rander Wang <rander.wang(a)intel.com> Cc: Ranjani Sridharan <ranjani.sridharan(a)linux.intel.com> Cc: Takashi Iwai <tiwai(a)suse.com> Cc: sound-open-firmware(a)alsa-project.org Cc: alsa-devel(a)alsa-project.org Cc: linux-kernel(a)vger.kernel.org Cc: stable(a)vger.kernel.org # v5.2+ Fixes: d16046ffa6de040bf580a64d5f4d0aa18258a854 ("ASoC: SOF: Intel: Add Intel specific HDA firmware loader") Link: https://lore.kernel.org/lkml/20220224145124.15985-1-ammarfaizi2@gnuweeb.org/ # v1 Link: https://lore.kernel.org/lkml/20220224180850.34592-1-ammarfaizi2@gnuweeb.org/ # v2 Link: https://lore.kernel.org/lkml/20220224182818.40301-1-ammarfaizi2@gnuweeb.org/ # v3 Reviewed-by: Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart(a)linux.intel.com> Signed-off-by: Ammar Faizi <ammarfaizi2(a)gnuweeb.org> Link: https://lore.kernel.org/r/20220224185836.44907-1-ammarfaizi2@gnuweeb.org Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- sound/soc/sof/intel/hda-loader.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) --- a/sound/soc/sof/intel/hda-loader.c +++ b/sound/soc/sof/intel/hda-loader.c @@ -48,7 +48,7 @@ static struct hdac_ext_stream *cl_stream ret = snd_dma_alloc_pages(SNDRV_DMA_TYPE_DEV_SG, &pci->dev, size, dmab); if (ret < 0) { dev_err(sdev->dev, "error: memory alloc failed: %d\n", ret); - goto error; + goto out_put; } hstream->period_bytes = 0;/* initialize period_bytes */ @@ -59,22 +59,23 @@ static struct hdac_ext_stream *cl_stream ret = hda_dsp_iccmax_stream_hw_params(sdev, dsp_stream, dmab, NULL); if (ret < 0) { dev_err(sdev->dev, "error: iccmax stream prepare failed: %d\n", ret); - goto error; + goto out_free; } } else { ret = hda_dsp_stream_hw_params(sdev, dsp_stream, dmab, NULL); if (ret < 0) { dev_err(sdev->dev, "error: hdac prepare failed: %d\n", ret); - goto error; + goto out_free; } hda_dsp_stream_spib_config(sdev, dsp_stream, HDA_DSP_SPIB_ENABLE, size); } return dsp_stream; -error: - hda_dsp_stream_put(sdev, direction, hstream->stream_tag); +out_free: snd_dma_free_pages(dmab); +out_put: + hda_dsp_stream_put(sdev, direction, hstream->stream_tag); return ERR_PTR(ret); } Patches currently in stable-queue which might be from ammarfaizi2(a)gnuweeb.org are queue-5.15/asoc-sof-intel-fix-null-ptr-dereference-when-enomem.patch

1 0

[Sound-open-firmware] Patch "ASoC: SOF: Intel: Fix NULL ptr dereference when ENOMEM" has been added to the 5.16-stable tree
by gregkh＠linuxfoundation.org 02 Apr '22

02 Apr '22

This is a note to let you know that I've just added the patch titled ASoC: SOF: Intel: Fix NULL ptr dereference when ENOMEM to the 5.16-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum… The filename of the patch is: asoc-sof-intel-fix-null-ptr-dereference-when-enomem.patch and it can be found in the queue-5.16 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable(a)vger.kernel.org> know about it. >From b7fb0ae09009d076964afe4c1a2bde1ee2bd88a9 Mon Sep 17 00:00:00 2001 From: Ammar Faizi <ammarfaizi2(a)gnuweeb.org> Date: Fri, 25 Feb 2022 01:58:36 +0700 Subject: ASoC: SOF: Intel: Fix NULL ptr dereference when ENOMEM From: Ammar Faizi <ammarfaizi2(a)gnuweeb.org> commit b7fb0ae09009d076964afe4c1a2bde1ee2bd88a9 upstream. Do not call snd_dma_free_pages() when snd_dma_alloc_pages() returns -ENOMEM because it leads to a NULL pointer dereference bug. The dmesg says: [ T1387] sof-audio-pci-intel-tgl 0000:00:1f.3: error: memory alloc failed: -12 [ T1387] BUG: kernel NULL pointer dereference, address: 0000000000000000 [ T1387] #PF: supervisor read access in kernel mode [ T1387] #PF: error_code(0x0000) - not-present page [ T1387] PGD 0 P4D 0 [ T1387] Oops: 0000 [#1] PREEMPT SMP NOPTI [ T1387] CPU: 6 PID: 1387 Comm: alsa-sink-HDA A Tainted: G W 5.17.0-rc4-superb-owl-00055-g80d47f5de5e3 [ T1387] Hardware name: HP HP Laptop 14s-dq2xxx/87FD, BIOS F.15 09/15/2021 [ T1387] RIP: 0010:dma_free_noncontiguous+0x37/0x80 [ T1387] Code: [... snip ...] [ T1387] RSP: 0000:ffffc90002b87770 EFLAGS: 00010246 [ T1387] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ T1387] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff888101db30d0 [ T1387] RBP: 00000000fffffff4 R08: 0000000000000000 R09: 0000000000000000 [ T1387] R10: 0000000000000000 R11: ffffc90002b874d0 R12: 0000000000000001 [ T1387] R13: 0000000000058000 R14: ffff888105260c68 R15: ffff888105260828 [ T1387] FS: 00007f42e2ffd640(0000) GS:ffff888466b80000(0000) knlGS:0000000000000000 [ T1387] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ T1387] CR2: 0000000000000000 CR3: 000000014acf0003 CR4: 0000000000770ee0 [ T1387] PKRU: 55555554 [ T1387] Call Trace: [ T1387] <TASK> [ T1387] cl_stream_prepare+0x10a/0x120 [snd_sof_intel_hda_common 146addf995b9279ae7f509621078cccbe4f875e1] [... snip ...] [ T1387] </TASK> Cc: Daniel Baluta <daniel.baluta(a)nxp.com> Cc: Jaroslav Kysela <perex(a)perex.cz> Cc: Kai Vehmanen <kai.vehmanen(a)linux.intel.com> Cc: Keyon Jie <yang.jie(a)linux.intel.com> Cc: Liam Girdwood <lgirdwood(a)gmail.com> Cc: Mark Brown <broonie(a)kernel.org> Cc: Rander Wang <rander.wang(a)intel.com> Cc: Ranjani Sridharan <ranjani.sridharan(a)linux.intel.com> Cc: Takashi Iwai <tiwai(a)suse.com> Cc: sound-open-firmware(a)alsa-project.org Cc: alsa-devel(a)alsa-project.org Cc: linux-kernel(a)vger.kernel.org Cc: stable(a)vger.kernel.org # v5.2+ Fixes: d16046ffa6de040bf580a64d5f4d0aa18258a854 ("ASoC: SOF: Intel: Add Intel specific HDA firmware loader") Link: https://lore.kernel.org/lkml/20220224145124.15985-1-ammarfaizi2@gnuweeb.org/ # v1 Link: https://lore.kernel.org/lkml/20220224180850.34592-1-ammarfaizi2@gnuweeb.org/ # v2 Link: https://lore.kernel.org/lkml/20220224182818.40301-1-ammarfaizi2@gnuweeb.org/ # v3 Reviewed-by: Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart(a)linux.intel.com> Signed-off-by: Ammar Faizi <ammarfaizi2(a)gnuweeb.org> Link: https://lore.kernel.org/r/20220224185836.44907-1-ammarfaizi2@gnuweeb.org Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- sound/soc/sof/intel/hda-loader.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) --- a/sound/soc/sof/intel/hda-loader.c +++ b/sound/soc/sof/intel/hda-loader.c @@ -48,7 +48,7 @@ static struct hdac_ext_stream *cl_stream ret = snd_dma_alloc_pages(SNDRV_DMA_TYPE_DEV_SG, &pci->dev, size, dmab); if (ret < 0) { dev_err(sdev->dev, "error: memory alloc failed: %d\n", ret); - goto error; + goto out_put; } hstream->period_bytes = 0;/* initialize period_bytes */ @@ -59,22 +59,23 @@ static struct hdac_ext_stream *cl_stream ret = hda_dsp_iccmax_stream_hw_params(sdev, dsp_stream, dmab, NULL); if (ret < 0) { dev_err(sdev->dev, "error: iccmax stream prepare failed: %d\n", ret); - goto error; + goto out_free; } } else { ret = hda_dsp_stream_hw_params(sdev, dsp_stream, dmab, NULL); if (ret < 0) { dev_err(sdev->dev, "error: hdac prepare failed: %d\n", ret); - goto error; + goto out_free; } hda_dsp_stream_spib_config(sdev, dsp_stream, HDA_DSP_SPIB_ENABLE, size); } return dsp_stream; -error: - hda_dsp_stream_put(sdev, direction, hstream->stream_tag); +out_free: snd_dma_free_pages(dmab); +out_put: + hda_dsp_stream_put(sdev, direction, hstream->stream_tag); return ERR_PTR(ret); } Patches currently in stable-queue which might be from ammarfaizi2(a)gnuweeb.org are queue-5.16/asoc-sof-intel-fix-null-ptr-dereference-when-enomem.patch

1 0

[Sound-open-firmware] Patch "ASoC: SOF: Intel: Fix NULL ptr dereference when ENOMEM" has been added to the 5.17-stable tree
by gregkh＠linuxfoundation.org 02 Apr '22

02 Apr '22

This is a note to let you know that I've just added the patch titled ASoC: SOF: Intel: Fix NULL ptr dereference when ENOMEM to the 5.17-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum… The filename of the patch is: asoc-sof-intel-fix-null-ptr-dereference-when-enomem.patch and it can be found in the queue-5.17 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable(a)vger.kernel.org> know about it. >From b7fb0ae09009d076964afe4c1a2bde1ee2bd88a9 Mon Sep 17 00:00:00 2001 From: Ammar Faizi <ammarfaizi2(a)gnuweeb.org> Date: Fri, 25 Feb 2022 01:58:36 +0700 Subject: ASoC: SOF: Intel: Fix NULL ptr dereference when ENOMEM From: Ammar Faizi <ammarfaizi2(a)gnuweeb.org> commit b7fb0ae09009d076964afe4c1a2bde1ee2bd88a9 upstream. Do not call snd_dma_free_pages() when snd_dma_alloc_pages() returns -ENOMEM because it leads to a NULL pointer dereference bug. The dmesg says: [ T1387] sof-audio-pci-intel-tgl 0000:00:1f.3: error: memory alloc failed: -12 [ T1387] BUG: kernel NULL pointer dereference, address: 0000000000000000 [ T1387] #PF: supervisor read access in kernel mode [ T1387] #PF: error_code(0x0000) - not-present page [ T1387] PGD 0 P4D 0 [ T1387] Oops: 0000 [#1] PREEMPT SMP NOPTI [ T1387] CPU: 6 PID: 1387 Comm: alsa-sink-HDA A Tainted: G W 5.17.0-rc4-superb-owl-00055-g80d47f5de5e3 [ T1387] Hardware name: HP HP Laptop 14s-dq2xxx/87FD, BIOS F.15 09/15/2021 [ T1387] RIP: 0010:dma_free_noncontiguous+0x37/0x80 [ T1387] Code: [... snip ...] [ T1387] RSP: 0000:ffffc90002b87770 EFLAGS: 00010246 [ T1387] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ T1387] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff888101db30d0 [ T1387] RBP: 00000000fffffff4 R08: 0000000000000000 R09: 0000000000000000 [ T1387] R10: 0000000000000000 R11: ffffc90002b874d0 R12: 0000000000000001 [ T1387] R13: 0000000000058000 R14: ffff888105260c68 R15: ffff888105260828 [ T1387] FS: 00007f42e2ffd640(0000) GS:ffff888466b80000(0000) knlGS:0000000000000000 [ T1387] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ T1387] CR2: 0000000000000000 CR3: 000000014acf0003 CR4: 0000000000770ee0 [ T1387] PKRU: 55555554 [ T1387] Call Trace: [ T1387] <TASK> [ T1387] cl_stream_prepare+0x10a/0x120 [snd_sof_intel_hda_common 146addf995b9279ae7f509621078cccbe4f875e1] [... snip ...] [ T1387] </TASK> Cc: Daniel Baluta <daniel.baluta(a)nxp.com> Cc: Jaroslav Kysela <perex(a)perex.cz> Cc: Kai Vehmanen <kai.vehmanen(a)linux.intel.com> Cc: Keyon Jie <yang.jie(a)linux.intel.com> Cc: Liam Girdwood <lgirdwood(a)gmail.com> Cc: Mark Brown <broonie(a)kernel.org> Cc: Rander Wang <rander.wang(a)intel.com> Cc: Ranjani Sridharan <ranjani.sridharan(a)linux.intel.com> Cc: Takashi Iwai <tiwai(a)suse.com> Cc: sound-open-firmware(a)alsa-project.org Cc: alsa-devel(a)alsa-project.org Cc: linux-kernel(a)vger.kernel.org Cc: stable(a)vger.kernel.org # v5.2+ Fixes: d16046ffa6de040bf580a64d5f4d0aa18258a854 ("ASoC: SOF: Intel: Add Intel specific HDA firmware loader") Link: https://lore.kernel.org/lkml/20220224145124.15985-1-ammarfaizi2@gnuweeb.org/ # v1 Link: https://lore.kernel.org/lkml/20220224180850.34592-1-ammarfaizi2@gnuweeb.org/ # v2 Link: https://lore.kernel.org/lkml/20220224182818.40301-1-ammarfaizi2@gnuweeb.org/ # v3 Reviewed-by: Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart(a)linux.intel.com> Signed-off-by: Ammar Faizi <ammarfaizi2(a)gnuweeb.org> Link: https://lore.kernel.org/r/20220224185836.44907-1-ammarfaizi2@gnuweeb.org Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- sound/soc/sof/intel/hda-loader.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) --- a/sound/soc/sof/intel/hda-loader.c +++ b/sound/soc/sof/intel/hda-loader.c @@ -47,7 +47,7 @@ static struct hdac_ext_stream *cl_stream ret = snd_dma_alloc_pages(SNDRV_DMA_TYPE_DEV_SG, &pci->dev, size, dmab); if (ret < 0) { dev_err(sdev->dev, "error: memory alloc failed: %d\n", ret); - goto error; + goto out_put; } hstream->period_bytes = 0;/* initialize period_bytes */ @@ -58,22 +58,23 @@ static struct hdac_ext_stream *cl_stream ret = hda_dsp_iccmax_stream_hw_params(sdev, dsp_stream, dmab, NULL); if (ret < 0) { dev_err(sdev->dev, "error: iccmax stream prepare failed: %d\n", ret); - goto error; + goto out_free; } } else { ret = hda_dsp_stream_hw_params(sdev, dsp_stream, dmab, NULL); if (ret < 0) { dev_err(sdev->dev, "error: hdac prepare failed: %d\n", ret); - goto error; + goto out_free; } hda_dsp_stream_spib_config(sdev, dsp_stream, HDA_DSP_SPIB_ENABLE, size); } return dsp_stream; -error: - hda_dsp_stream_put(sdev, direction, hstream->stream_tag); +out_free: snd_dma_free_pages(dmab); +out_put: + hda_dsp_stream_put(sdev, direction, hstream->stream_tag); return ERR_PTR(ret); } Patches currently in stable-queue which might be from ammarfaizi2(a)gnuweeb.org are queue-5.17/asoc-sof-intel-fix-null-ptr-dereference-when-enomem.patch

1 0