Add check in tasha_mad_input_put function to
return error on out of bounds access using
mad input value.
CRs-fixed: 1096799
Change-Id: Iddaa3fef362f7cb1919aa3bd8dd4b83133fe7c97
Signed-off-by: Karthikeyan Mani <kmani@codeaurora.org>
Add check in tomtom_mad_input_put function to
return error on out of bounds access using
mad input value.
CRs-fixed: 1096799
Change-Id: Ied86bf88301e555b25eaa190d2d786cdad691ccd
Signed-off-by: Karthikeyan Mani <kmani@codeaurora.org>
Add check in taiko_mad_input_put function to
return error on out of bounds access using
mad input value
CRs-fixed: 1096799
Change-Id: I75ce9e881cf05a50e874a555b2f8bd3286cdaed4
Signed-off-by: Karthikeyan Mani <kmani@codeaurora.org>
create_fixed_stream_quirk(), snd_usb_parse_audio_interface() and
create_uaxx_quirk() functions allocate the audioformat object by themselves
and free it upon error before returning. However, once the object is linked
to a stream, it's freed again in snd_usb_audio_pcm_free(), thus it'll be
double-freed, eventually resulting in a memory corruption.
This patch fixes these failures in the error paths by unlinking the audioformat
object before freeing it.
Based on a patch by Takashi Iwai <tiwai@suse.de>
[Note for stable backports:
this patch requires the commit 902eb7fd1e4a ('ALSA: usb-audio: Minor
code cleanup in create_fixed_stream_quirk()')]
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1283358
Reported-by: Ralf Spenneberg <ralf@spenneberg.net>
Cc: <stable@vger.kernel.org> # see the note above
Signed-off-by: Vladis Dronov <vdronov@redhat.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Change-Id: Ie36a8b7ce9e03e0db028251ed6ee78ee978ed4f3
Git-repo: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git
Git-commit: 836b34a935abc91e13e63053d0a83b24dfb5ea78
[rsiddoji@codeaurora.org : resolved some minor confilts ]
Signed-off-by: Ravi Kumar Siddojigari <rsiddoji@codeaurora.org>
Just a minor code cleanup: unify the error paths.
Change-Id: I2fe930c5d29c88285131f211b2f8e1ecfacd5205
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Git-repo: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git
Git-commit: 902eb7fd1e4af3ac69b9b30f8373f118c92b9729
Signed-off-by: Ravi Kumar Siddojigari <rsiddoji@codeaurora.org>
Update machine driver AFE API calls compatible
with adsp version AVS 2.6 and AVS 2.7
Update of mclk flag in suspend call.
Change-Id: Id0b300bcf585895cc659a1882710d825d0e7a808
Signed-off-by: Laxminath Kasam <lkasam@codeaurora.org>
Signed-off-by: Divya Narayanan Poojary <dnaray@codeaurora.org>
In Q6 asm and afe drivers, add API support
for AVS 2.7. Update compress driver to use
ASM volume gain compatible to verion used
Change-Id: I152a3410c99cfa37dca0eadb30b97f121f5d0a89
Signed-off-by: Laxminath Kasam <lkasam@codeaurora.org>
Signed-off-by: Divya Narayanan Poojary <dnaray@codeaurora.org>
Q6 core service provides API to query ADSP
version. Update the apr with get()/set()
to use this adsp version by platform/machine drivers
Change-Id: Icf480991b4b7847cd872ab7286ed1132facff0a4
Signed-off-by: Laxminath Kasam <lkasam@codeaurora.org>
Signed-off-by: Divya Narayanan Poojary <dnaray@codeaurora.org>
Timeout error is observed while waiting for
ADM_CMD_SET_PP_PARAMS_V5 command's response.
Fix the condition logic in wait_event_timeout()
to match the value set in adm_callback() when
response to ADM_CMD_SET_PP_PARAMS_V5 is received.
CRs-Fixed: 1030674
Change-Id: I711c860dc3de479eec0d22369d19615aef572ea1
Signed-off-by: Karthik Reddy Katta <a_katta@codeaurora.org>
validation of the codec variable passed to the snd_soc_read
and snd_soc_write functions are missing and can lead to DoS
as referred in CVE-2016-6690
Bug:28838221
Change-Id: I5020f77e252bade5e97efb592afb71fe1b18d952
Signed-off-by: Ravi Kumar Siddojigari <rsiddoji@codeaurora.org>
Signed-off-by: Srinivasa Rao Kuppala <srkupp@codeaurora.org>
Removed 20ms delay in RX chain PMD as it is not required.
This improves device switch and tear down latency.
CRs-Fixed: 1070432
Change-Id: Id6996dff163f390a662f628da710d8bb238f7fca
Signed-off-by: Rohit kumar <rohitkr@codeaurora.org>
Before accessing io mapped address, check if
qdsp6 is ready to avoid dataabort issue.
Change-Id: Ia65875cd1087520befa0d12f928dc3fd1478031a
Signed-off-by: Laxminath Kasam <lkasam@codeaurora.org>
Set token value with port index and copp id so that
correct wait queue handle can be deduced in the
callback of adm_set_stereo_to_custom_stereo command.
Change-Id: Ica4c1442c1143f46de2baa6eaf1890ad0cb4b742
Signed-off-by: Shiv Maliyappanahalli <smaliyap@codeaurora.org>
The params array is used without initialization, which may cause
security issues. Initialize it as all zero after the definition.
CRs-Fixed: 1062271
Change-Id: If462fe3d82f139d72547f82dc7eb564f83cb35bf
Signed-off-by: Walter Yang <yandongy@codeaurora.org>
Change all audio driver to use %pK instead
of %p. %pK hides addresses when the users doesn't
have kernel permissions. If address information
is needed echo 0 > /proc/sys/kernel/kptr_restrict.
CRs-Fixed: 1052832
Change-Id: I9ff5cf06b019c566973eb609bf5d37969b98d31d
Signed-off-by: Xiaojun Sang <xsang@codeaurora.org>
Change cpe driver to use %pK instead of %p.
%pK hides addresses when the users doesn't
have kernel permissions. If address information
is needed echo 0 > /proc/sys/kernel/kptr_restrict.
CRs-Fixed: 1052832
Change-Id: I741d9e5c5b415011348e862c3f1ee4fe28c3969f
Signed-off-by: Xiaojun Sang <xsang@codeaurora.org>
Initialize param length with user space argument and
check the condition for maximum length in
SND_AUDIOCODEC_EAC3 format.
CRs-Fixed: 1032820
Change-Id: I710c1f743d7502e93989e8cc487078366570e723
Signed-off-by: Surendar karka <sukark@codeaurora.org>
Schmitt trigger result is wrong if PA is enabled.
So, don't check for cross connection when PA is enabled.
CRs-Fixed: 1061507
Change-Id: Iad71abbed72aa40b5c839260f5c297a885f7d128
Signed-off-by: Yeleswarapu Nagaradhesh <nagaradh@codeaurora.org>
Cross connection sometimes gets detected late. The issue faced is
cable is reported as headset initially, cross connection is
detected later. But before confirming cross connection, playback
starts on headset, so checking for cross connection is not
confirmed. Cable remains reported as headset. So check for cross
connection just before reporting headset.
CRs-Fixed: 1028002
Change-Id: Ida4f277f13c9a193cd7c92063b99bcf1104f107e
Signed-off-by: Divya Ojha <dojha@codeaurora.org>
The overflow check is required to ensure that user space data
in kernel may not go beyond buffer boundary.
CRs-Fixed: 1064411
Change-Id: I54c28a8942cf1a6a47a4e8272f3159b35d753ead
Signed-off-by: Karthik Reddy Katta <a_katta@codeaurora.org>
dummy_codec is not initialized before use, which
could cause kernel panic. Initialize dummy_codec before use.
Change-Id: Iedf7a3accbd14138ab7ed9e4e36a98fd7ca9a839
Signed-off-by: Meng Wang <mwang@codeaurora.org>
In lsm-related driver files, some pointers are not set as NULL
after the memory is freed, which will leave many dangling pointers.
Set them to NULL explicitly to avoid potential risk.
CRs-Fixed: 880388
Change-Id: I44925240705608510266a51225cc02611637c571
Signed-off-by: Walter Yang <yandongy@codeaurora.org>
After SSR, observe tones heard with high volume.
compander and hph_mode mixer controls are reset
in post reset callback which will not be in
sync with userspace settings. Avoid reset of
compander and hph_mode controls in post reset
callback.
CRs-Fixed: 1010471
Change-Id: Iacb3e27a35027037613e82e483b10b635d492a75
Signed-off-by: Laxminath Kasam <lkasam@codeaurora.org>
Non DAP modules are disabled when DAP is enabled, and when DAP
is disabled they are suppose to move to a state as set in the
calibration data. Modules which dont have an explicit enable param
remain disabled even when DAP is disabled. Hence send an explicit
enable command to DSP for all modules followed by the
calibration data, this ensures correct state of all modules.
Change-Id: I6f8873bb11d96a20f6401eba5fe2979b6a14e11e
CRs-Fixed: 1049611
Signed-off-by: Ashish Jain <ashishj@codeaurora.org>
The stack object “r1” has a total size of 32 bytes. Its field
“event” and “val” both contain 4 bytes padding. These 8 bytes
padding bytes are sent to user without being initialized.
b/28980217
Git-commit: 9a47e9cff994f37f7f0dbd9ae23740d0f64f9fe6
Git-repo: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git
Signed-off-by: Kangjie Lu <kjlu@gatech.edu>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Dennis Cagle <d-cagle@codeaurora.org>
(cherry picked from commit 9a47e9cff994f37f7f0dbd9ae23740d0f64f9fe6)
Change-Id: I12949efac2aba669d302908704005fb94ba7efd7
The stack object “r1” has a total size of 32 bytes. Its field
“event” and “val” both contain 4 bytes padding. These 8 bytes
padding bytes are sent to user without being initialized.
b/28980217
Git-commit: e4ec8cc8039a7063e24204299b462bd1383184a5
Git-repo: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git
Signed-off-by: Kangjie Lu <kjlu@gatech.edu>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Dennis Cagle <d-cagle@codeaurora.org>
(cherry picked from commit e4ec8cc8039a7063e24204299b462bd1383184a5)
Change-Id: I53aa15632e941199010aae670cefb65c8fd56833
The stack object “tread” has a total size of 32 bytes. Its field
“event” and “val” both contain 4 bytes padding. These 8 bytes
padding bytes are sent to user without being initialized.
b/28980557
Git-commit: cec8f96e49d9be372fdb0c3836dcf31ec71e457e
Git-repo: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git
Signed-off-by: Kangjie Lu <kjlu@gatech.edu>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Dennis Cagle <d-cagle@codeaurora.org>
(cherry picked from commit cec8f96e49d9be372fdb0c3836dcf31ec71e457e)
Change-Id: I3b42ee147fd0883696f9783f0a38d5bef888a10a
ALSA timer ioctls have an open race and this may lead to a
use-after-free of timer instance object. A simplistic fix is to make
each ioctl exclusive. We have already tread_sem for controlling the
tread, and extend this as a global mutex to be applied to each ioctl.
The downside is, of course, the worse concurrency. But these ioctls
aren't to be parallel accessible, in anyway, so it should be fine to
serialize there.
b/28694392
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Tested-by: Dmitry Vyukov <dvyukov@google.com>
Cc: <stable@vger.kernel.org>
Git-commit: af368027a49a751d6ff4ee9e3f9961f35bb4fede
Git-repo: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Dennis Cagle <d-cagle@codeaurora.org>
(cherry picked from commit af368027a49a751d6ff4ee9e3f9961f35bb4fede)
Change-Id: I9d45e3d142b42d5dee6ae54c25e78504c871eef8
ALSA sequencer code has an open race between the timer setup ioctl and
the close of the client. This was triggered by syzkaller fuzzer, and
a use-after-free was caught there as a result.
This patch papers over it by adding a proper queue->timer_mutex lock
around the timer-related calls in the relevant code path.
b/28695438
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Tested-by: Dmitry Vyukov <dvyukov@google.com>
Cc: <stable@vger.kernel.org>
Git-commit: 3567eb6af614dac436c4b16a8d426f9faed639b3
Git-repo: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Dennis Cagle <d-cagle@codeaurora.org>
(cherry picked from commit 3567eb6af614dac436c4b16a8d426f9faed639b3)
Change-Id: I398dd27dcdd1241917fd6d127b2debffc2afd413
A slave timer instance might be still accessible in a racy way while
operating the master instance as it lacks of locking. Since the
master operation is mostly protected with timer->lock, we should cope
with it while changing the slave instance, too. Also, some linked
lists (active_list and ack_list) of slave instances aren't unlinked
immediately at stopping or closing, and this may lead to unexpected
accesses.
This patch tries to address these issues. It adds spin lock of
timer->lock (either from master or slave, which is equivalent) in a
few places. For avoiding a deadlock, we ensure that the global
slave_active_lock is always locked at first before each timer lock.
Also, ack and active_list of slave instances are properly unlinked at
snd_timer_stop() and snd_timer_close().
Last but not least, remove the superfluous call of _snd_timer_stop()
at removing slave links. This is a noop, and calling it may confuse
readers wrt locking. Further cleanup will follow in a later patch.
Actually we've got reports of use-after-free by syzkaller fuzzer, and
this hopefully fixes these issues.
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
(cherry picked from commit b5a663aa426f4884c71cd8580adae73f33570f0d)
Change-Id: I7e7e4e1ab476f93131111d60d8f4e6a1add43193
Signed-off-by: Dennis Cagle <d-cagle@codeaurora.org>
Consider sound card instantiate fails due to
audrx init failure. In such case, all dais/ctls
are de-registered and freed. But as part of it,
access to unregistered ctls for pcm_chmap and similar
controls result in crash. Ctls are freed at disconnection
but the disconnect is called only when it was registered.
CRs-Fixed: 1038054
Change-Id: Ief8817b4ec000c058d46aa021977b7c6003c0011
Signed-off-by: Laxminath Kasam <lkasam@codeaurora.org>
Add support for standalone enablement of ldo_h
in wcd9335 hardware. This is required to enable
certain audio TX use-cases.
CRs-fixed: 1032443
Change-Id: Iea068907241b42846d95d8e62e59409cdd29ca42
Signed-off-by: Phani Kumar Uppalapati <phaniu@codeaurora.org>
Signed-off-by: SoumyaManagoli <smanag@codeaurora.org>
A big negative data length value can bypass the current check,
update the condition to ensure that only valid data length is used
to copy the params.
CRs-Fixed: 1041130
Change-Id: I6e1a58e901e4c042acfb0ab0a6223dec2949aefe
Signed-off-by: Ashish Jain <ashishj@codeaurora.org>
For the audio get calibration ioctl compare the allocated
buffer size to the size of the header and cal type header
to ensure the buffer is big enough.
CRs-Fixed: 1038127
Change-Id: I851b4454e8420706ad3263d67e892720d46e5718
Signed-off-by: Ben Romberger <bromberg@codeaurora.org>
A big negative data length value can bypass the current check,
update the condition to ensure that only valid data length is used
to copy the params.
CRs-Fixed: 1041130
Change-Id: I6e1a58e901e4c042acfb0ab0a6223dec2949aefe
Signed-off-by: Ashish Jain <ashishj@codeaurora.org>
Supported sample rates list in tash_mad1 DAI is not matching with
the given minimum and maximum sample rates
Added additional supported sample rates
Change-Id: Ia44f8dc2f6ab4c59fae7de6d9cebe073bed3ed31
Signed-off-by: Pavan Chikkala <pavanc@codeaurora.org>
Supported sample rates list in tash_mad1 DAI is not matching with
the given minimum and maximum sample rates
Added additional supported sample rates
Change-Id: Ia44f8dc2f6ab4c59fae7de6d9cebe073bed3ed31
Signed-off-by: Pavan Chikkala <pavanc@codeaurora.org>
Parameter fragments and fragment_size are type of u32. U32_MAX is
the correct check.
CRs-Fixed: 1014726
Change-Id: Ia6d4755408646ac4a75724f3c6f2177651875da3
Signed-off-by: Xiaojun Sang <xsang@codeaurora.org>
Validate input data length to ensure only relevant data
is copied.
CRs-Fixed: 1027585
Change-Id: I67eb4f162f944bbf4d9e55fb8fe93759e6b8ff91
Signed-off-by: Ashish Jain <ashishj@codeaurora.org>
For 24 bit playback decoder is opened with 16 bits per sample, So
decoder output is 16 bit only.
Set bits per sample to 24 if codec format is SNDRV_PCM_FORMAT_S24_3LE.
Set bits per sample to 16 as default value in capture prepare use case.
CRs-Fixed: 1035154
Change-Id: I14271b17441308f8ec6dfaea566c01887d1233f4
Signed-off-by: Preetam Singh Ranawat <apranawat@codeaurora.org>
Signed-off-by: Ramjee Singh <ramjee@codeaurora.org>
Size of param buffer should be big enough to hold param length
of data and param payload.
CRs-Fixed: 1033525
Change-Id: I6fa58f87a7c7df5f0485ea5b368ea090eb8bedb4
Signed-off-by: Ashish Jain <ashishj@codeaurora.org>
Changes to support packed 24 bit (SNDRV_PCM_FORMAT_S24_3LE)
CRs-Fixed: 1011048
Change-Id: If81f3053629dc4f80a08392f392c7be735ad33c2
Signed-off-by: Manish Dewangan <manish@codeaurora.org>
Change all qdsp6v2 audio driver to use %pK instead
of %p. %pK hides addresses when the users doesn't
have kernel permissions. If address information
is needed echo 0 > /proc/sys/kernel/kptr_restrict.
Change-Id: I7baa9f127266726fecf9238167a1e0128a258847
Signed-off-by: Ben Romberger <bromberg@codeaurora.org>
Signed-off-by: Surendar karka <sukark@codeaurora.org>
Following commit ID's are propagated with this gerrit.
I3e3980e48ce19955b4230876887adfde5b44e8ea
I48b24d81e2047d4d4c299ca60cdbd299e172393e
Iae361cabf7b5194e12f5ddc8e32d60cf94bf28c3
I8b3271ee9af91b9e921957998e0fb074ffdebe86
I562f17363d7d38caece358a50d1e3f654d87491f
Change-Id: I1b8610f8333b91be5e2bf9ecacf916d4b25d3f54
Signed-off-by: Santosh Mardi <gsantosh@codeaurora.org>
For playing 24 bit through PCM driver with 40ms
buffers, bigger buffers are needed. The size (in bytes)
is 1920 (frames) x 4 (bytes per frame) x 8 (max channels).
Increase the maximum size of the buffer to fit the bigger
buffers.
Change-Id: I7a59fb18846903960c329ad163788f6791495830
Signed-off-by: Alexy Joseph <alexyj@codeaurora.org>
commit ba4bc32eaa39ba7687f0958ae90eec94da613b46 upstream.
An older patch to convert the API in the s3c i2s driver
ended up passing a const pointer into a function that takes
a non-const pointer, so we now get a warning:
sound/soc/samsung/s3c2412-i2s.c: In function 's3c2412_iis_dev_probe':
sound/soc/samsung/s3c2412-i2s.c:172:9: error: passing argument 3 of 's3c_i2sv2_register_component' discards 'const' qualifier from pointer target type [-Werror=discarded-qualifiers]
However, the s3c_i2sv2_register_component() function again
passes the pointer into another function taking a const, so
we just need to change its prototype.
Fixes: eca3b01d08 ("ASoC: switch over to use snd_soc_register_component() on s3c i2s")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Reviewed-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Willy Tarreau <w@1wt.eu>
commit 4a07083ed613644c96c34a7dd2853dc5d7c70902 upstream.
ALSA system timer backend stops the timer via del_timer() without sync
and leaves del_timer_sync() at the close instead. This is because of
the restriction by the design of ALSA timer: namely, the stop callback
may be called from the timer handler, and calling the sync shall lead
to a hangup. However, this also triggers a kernel BUG() when the
timer is rearmed immediately after stopping without sync:
kernel BUG at kernel/time/timer.c:966!
Call Trace:
<IRQ>
[<ffffffff8239c94e>] snd_timer_s_start+0x13e/0x1a0
[<ffffffff8239e1f4>] snd_timer_interrupt+0x504/0xec0
[<ffffffff8122fca0>] ? debug_check_no_locks_freed+0x290/0x290
[<ffffffff8239ec64>] snd_timer_s_function+0xb4/0x120
[<ffffffff81296b72>] call_timer_fn+0x162/0x520
[<ffffffff81296add>] ? call_timer_fn+0xcd/0x520
[<ffffffff8239ebb0>] ? snd_timer_interrupt+0xec0/0xec0
....
It's the place where add_timer() checks the pending timer. It's clear
that this may happen after the immediate restart without sync in our
cases.
So, the workaround here is just to use mod_timer() instead of
add_timer(). This looks like a band-aid fix, but it's a right move,
as snd_timer_interrupt() takes care of the continuous rearm of timer.
Reported-by: Jiri Slaby <jslaby@suse.cz>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Willy Tarreau <w@1wt.eu>
commit 4061db03dd71d195b9973ee466f6ed32f6a3fc16 upstream.
The clock measurement on the AC'97 audio card found in the IBM ThinkPad X41
will often fail, so add a quirk entry to fix it.
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=441087
Cc: <stable@vger.kernel.org>
Signed-off-by: Vittorio Gambaletta <linuxbugs@vittgam.net>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Willy Tarreau <w@1wt.eu>
Changes to support packed 24 bit (SNDRV_PCM_FORMAT_S24_3LE)
CRs-Fixed: 1011048
Change-Id: Id0718889e14c9f1f184899faa7159e126919537a
Signed-off-by: Manish Dewangan <manish@codeaurora.org>
Changes to support packed 24 bit (SNDRV_PCM_FORMAT_S24_3LE).
CRs-Fixed: 1011048
Change-Id: I5c49091d6bbff98ed8665446fffdba08446073cd
Signed-off-by: Manish Dewangan <manish@codeaurora.org>
Changes to support packed 24 bit (SNDRV_PCM_FORMAT_S24_3LE)
CRs-Fixed: 1011048
Change-Id: I2e72305bdbece822381b56a8a0c0cc9c7b8b0f0b
Signed-off-by: Manish Dewangan <manish@codeaurora.org>
Driver changes to use ASM_MEDIA_FMT_MULTI_CHANNEL_PCM_V3
command. This command supports playback/record of both 32 bit
(24 bit data in 32 bit word) and 24 bit packed. Update platform
drivers to this for SNDRV_PCM_FORMAT_S24_LE record and playback.
CRs-Fixed: 1011048
Change-Id: I6f98bf3402a737bc21daff33b13b137850a690ea
Signed-off-by: Manish Dewangan <manish@codeaurora.org>
Implement platform drivers to support shared memory based
pcm playback and capture
Change-Id: I882c67ae1c3d950b98bd002ac384cc3a7e77874a
CRs-Fixed: 992798
Signed-off-by: Haynes Mathew George <hgeorge@codeaurora.org>
Fix overwrite of updt_params allocated in heap, and stack overread
where param pointer is passed from user space.
CRs-Fixed: 989628
Change-Id: Ida8bdb7da2fcb97023dce3b6eafe4b899a51cb66
Signed-off-by: Weiyin Jiang <wjiang@codeaurora.org>
(cherry pick from commit b5a663aa426f4884c71cd8580adae73f33570f0d)
A slave timer instance might be still accessible in a racy way while
operating the master instance as it lacks of locking. Since the
master operation is mostly protected with timer->lock, we should cope
with it while changing the slave instance, too. Also, some linked
lists (active_list and ack_list) of slave instances aren't unlinked
immediately at stopping or closing, and this may lead to unexpected
accesses.
This patch tries to address these issues. It adds spin lock of
timer->lock (either from master or slave, which is equivalent) in a
few places. For avoiding a deadlock, we ensure that the global
slave_active_lock is always locked at first before each timer lock.
Also, ack and active_list of slave instances are properly unlinked at
snd_timer_stop() and snd_timer_close().
Last but not least, remove the superfluous call of _snd_timer_stop()
at removing slave links. This is a noop, and calling it may confuse
readers wrt locking. Further cleanup will follow in a later patch.
Actually we've got reports of use-after-free by syzkaller fuzzer, and
this hopefully fixes these issues.
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Bug: 26636060
Add check to avoid out of bound access.
Check return value of get_user api.
CRs-Fixed: 997025
Change-Id: Ibbace116ac206007fa1928555838285304737737
Signed-off-by: Ashish Jain <ashishj@codeaurora.org>
If clk_div2 is not set, it remains enabled even
when no session is running. Set the clk_div2 param
properly if mode is BOTH_VALID.
Change-Id: I26a6f6d2121a8f93410be4a128106ee0fc4212a2
Signed-off-by: Laxminath Kasam <lkasam@codeaurora.org>
Request device ungroup of speaker channels for independent
disable. It is possible that stereo speaker channels can be
disabled one after other, so remove them from group otherwise
speaker can be left in enabled state.
CRs-fixed: 1007465
Change-Id: I358ab4edcb85ec65b064ca28368ad744f2d36870
Signed-off-by: Phani Kumar Uppalapati <phaniu@codeaurora.org>
Add check to avoid out of bound access.
Check return value of get_user api.
CRs-Fixed: 997025
Change-Id: Ibbace116ac206007fa1928555838285304737737
Signed-off-by: Ashish Jain <ashishj@codeaurora.org>
pulled in the changes from the below commits.
Ia4329ac982eb2a29a2b925897cd87ca9711c30e3
Ic0ab015098035418458a5ba7c2ffad9df20f933c
Ia091228b5a6e6d3dced2bee6cd5fecf5632a62a0
Change-Id: Ie89d37060a73a190f752eebf226c630a903f0c1b
Signed-off-by: Santosh Mardi <gsantosh@codeaurora.org>
Following commit ID's are propagated with this gerrit.
I3e3980e48ce19955b4230876887adfde5b44e8ea
I48b24d81e2047d4d4c299ca60cdbd299e172393e
Iae361cabf7b5194e12f5ddc8e32d60cf94bf28c3
I8b3271ee9af91b9e921957998e0fb074ffdebe86
I562f17363d7d38caece358a50d1e3f654d87491f
Change-Id: I1b8610f8333b91be5e2bf9ecacf916d4b25d3f54
Signed-off-by: Santosh Mardi <gsantosh@codeaurora.org>
restore the cache values back of last state applied
in SSR recovery using snd_soc_cache_sync API. So
hardware codec configuration will be in sync with
userspace settings. And avoid any race condition
between the userspace updating dapm widgets and
SSR recovery updating any register value.
Change-Id: Ie2a986b5c6827b02aa3d5919cc69e7363155c45e
Signed-off-by: Laxminath Kasam <lkasam@codeaurora.org>
After enabling moisture detection and updating thresholds,
could see increase in codec power numbers during sleep.
So donot enable moisture detection.
CRs-Fixed: 991946
Change-Id: Iede49e4608a325c47ac2cd27cdb080730d822310
Signed-off-by: Yeleswarapu Nagaradhesh <nagaradh@codeaurora.org>
commit d0784829ae3b0beeb69b476f017d5c8a2eb95198 upstream.
"MBC Mode", "VSS Mode", "VSS HPF Mode" and "Enhanced EQ Mode" ctls in
wm8958 codec driver are enum, while the current driver accesses
wrongly via value.integer.value[]. They have to be via
value.enumerated.item[] instead.
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 8019c0b37cd5a87107808300a496388b777225bf upstream.
The DRC Mode like "AIF1DRC1 Mode" and EQ Mode like "AIF1.1 EQ Mode" in
wm8994 codec driver are enum ctls, while the current driver accesses
wrongly via value.integer.value[]. They have to be via
value.enumerated.item[] instead.
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 3a72494ac2a3bd229db941d51e7efe2f6ccd947b upstream.
The timer user status compat ioctl returned the bogus struct used for
64bit architectures instead of the 32bit one. This patch addresses
it to return the proper struct.
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit c1099c3294c2344110085a38c50e478a5992b368 upstream.
HDSPM driver contains a code issuing zero-division potentially in
system sample rate ctl code. This patch fixes it by not processing
a zero or invalid rate value as a divisor, as well as excluding the
invalid value to be passed via the given ctl element.
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 197b958c1e76a575d77038cc98b4bebc2134279f upstream.
The OSS sequencer client tries to drain the pending events at
releasing. Unfortunately, as spotted by syzkaller fuzzer, this may
lead to an unkillable process state when the event has been queued at
the far future. Since the process being released can't be signaled
any longer, it remains and waits for the echo-back event in that far
future.
Back to history, the draining feature was implemented at the time we
misinterpreted POSIX definition for blocking file operation.
Actually, such a behavior is superfluous at release, and we should
just release the device as is instead of keeping it up forever.
This patch just removes the draining call that may block the release
for too long time unexpectedly.
BugLink: http://lkml.kernel.org/r/CACT4Y+Y4kD-aBGj37rf-xBw9bH3GMU6P+MYg4W1e-s-paVD2pg@mail.gmail.com
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit b24e7ad1fdc22177eb3e51584e1cfcb45d818488 upstream.
X32 ABI takes the 64bit timespec, thus the timer user status ioctl becomes
incompatible with IA32. This results in NOTTY error when the ioctl is
issued.
Meanwhile, this struct in X32 is essentially identical with the one in
X86-64, so we can just bypassing to the existing code for this
specific compat ioctl.
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 2251fbbc1539f05b0b206b37a602d5776be37252 upstream.
Like the previous fixes for ctl and PCM, we need a fix for
incompatible X32 ABI regarding the rawmidi: namely, struct
snd_rawmidi_status has the timespec, and the size and the alignment on
X32 differ from IA32.
This patch fixes the incompatible ioctl for X32.
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 6236d8bb2afcfe71b88ecea554e0dc638090a45f upstream.
The X32 ABI takes the same alignment like x86-64, and this may result
in the incompatible struct size from ia32. Unfortunately, we hit this
in some control ABI: struct snd_ctl_elem_value differs between them
due to the position of 64bit variable array. This ends up with the
unknown ioctl (ENOTTY) error.
The fix is to add the compat entries for the new aligned struct.
Reported-and-tested-by: Steven Newbury <steve@snewbury.org.uk>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
For the targets not using boost and boost pin is kept
floating there will be high change that VDD_A53 will be
grounded and MSM will not be responsive
After discussing with PMIC systems team SBL team came up
with the work around to configure the boost register to some
pre defined values so that the issue is not reproduced.
As part of the codec init sequence the codec driver will
reset the analog part of the codec and as part of this sequence
the cofiguration done by the SBL will be defaulted.
This change will restore the 0x1C6 register if it has been configured
by SBL
Change-Id: I1a58b665b01e70bbb21b06665a8fb422d77a5ee7
Signed-off-by: Santosh Mardi <gsantosh@codeaurora.org>
Gain for TX decimator block needs to be set after the
corresponding decimator is enabled. Otherwise, gain will
not take affect. Apply the gain by reading from regmap cache
to the codec decimator hardware after decimator is enabled.
CRs-fixed: 982473
Change-Id: Ib2d189b56e58b038a343fc974e6e3b8ef29f982d
Signed-off-by: Phani Kumar Uppalapati <phaniu@codeaurora.org>
commit 13d5e5d4725c64ec06040d636832e78453f477b7 upstream.
The commit [7f0973e973cd: ALSA: seq: Fix lockdep warnings due to
double mutex locks] split the management of two linked lists (source
and destination) into two individual calls for avoiding the AB/BA
deadlock. However, this may leave the possible double deletion of one
of two lists when the counterpart is being deleted concurrently.
It ends up with a list corruption, as revealed by syzkaller fuzzer.
This patch fixes it by checking the list emptiness and skipping the
deletion and the following process.
BugLink: http://lkml.kernel.org/r/CACT4Y+bay9qsrz6dQu31EcGaH9XwfW7o3oBzSQUG9fMszoh=Sg@mail.gmail.com
Fixes: 7f0973e973cd ('ALSA: seq: Fix lockdep warnings due to 'double mutex locks)
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Tested-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit ed8b1d6d2c741ab26d60d499d7fbb7ac801f0f51 upstream.
A slave timer element also unlinks at snd_timer_stop() but it takes
only slave_active_lock. When a slave is assigned to a master,
however, this may become a race against the master's interrupt
handling, eventually resulting in a list corruption. The actual bug
could be seen with a syzkaller fuzzer test case in BugLink below.
As a fix, we need to take timeri->timer->lock when timer isn't NULL,
i.e. assigned to a master, while the assignment to a master itself is
protected by slave_active_lock.
BugLink: http://lkml.kernel.org/r/CACT4Y+Y_Bm+7epAb=8Wi=AaWd+DYS7qawX52qxdCfOfY49vozQ@mail.gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit ddce57a6f0a2d8d1bfacfa77f06043bc760403c2 upstream.
Currently the selected timer backend is referred at any moment from
the running PCM callbacks. When the backend is switched, it's
possible to lead to inconsistency from the running backend. This was
pointed by syzkaller fuzzer, and the commit [7ee96216c31a: ALSA:
dummy: Disable switching timer backend via sysfs] disabled the dynamic
switching for avoiding the crash.
This patch improves the handling of timer backend switching. It keeps
the reference to the selected backend during the whole operation of an
opened stream so that it won't be changed by other streams.
Together with this change, the hrtimer parameter is reenabled as
writable now.
NOTE: this patch also turned out to fix the still remaining race.
Namely, ops was still replaced dynamically at dummy_pcm_open:
static int dummy_pcm_open(struct snd_pcm_substream *substream)
{
....
dummy->timer_ops = &dummy_systimer_ops;
if (hrtimer)
dummy->timer_ops = &dummy_hrtimer_ops;
Since dummy->timer_ops is common among all streams, and when the
replacement happens during accesses of other streams, it may lead to a
crash. This was actually triggered by syzkaller fuzzer and KASAN.
This patch rewrites the code not to use the ops shared by all streams
any longer, too.
BugLink: http://lkml.kernel.org/r/CACT4Y+aZ+xisrpuM6cOXbL21DuM0yVxPYXf4cD4Md9uw0C3dBQ@mail.gmail.com
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit c44d9b1181cf34e0860c72cc8a00e0c47417aac0 upstream.
Some Sony VAIO AiO models (VGC-JS4EF and VGC-JS25G, both with PCI SSID
104d:9044) need the same quirk to make the speaker working properly.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=112031
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 117159f0b9d392fb433a7871426fad50317f06f7 upstream.
In snd_timer_notify1(), the wrong timer instance was passed for slave
ccallback function. This leads to the access to the wrong data when
an incompatible master is handled (e.g. the master is the sequencer
timer and the slave is a user timer), as spotted by syzkaller fuzzer.
This patch fixes that wrong assignment.
BugLink: http://lkml.kernel.org/r/CACT4Y+Y_Bm+7epAb=8Wi=AaWd+DYS7qawX52qxdCfOfY49vozQ@mail.gmail.com
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit f784beb75ce82f4136f8a0960d3ee872f7109e09 upstream.
Although ALSA timer code got hardening for races, it still causes
use-after-free error. This is however rather a corrupted linked list,
not actually the concurrent accesses. Namely, when timer start is
triggered twice, list_add_tail() is called twice, too. This ends
up with the link corruption and triggers KASAN error.
The simplest fix would be replacing list_add_tail() with
list_move_tail(), but fundamentally it's the problem that we don't
check the double start/stop correctly. So, the right fix here is to
add the proper checks to snd_timer_start() and snd_timer_stop() (and
their variants).
BugLink: http://lkml.kernel.org/r/CACT4Y+ZyPRoMQjmawbvmCEDrkBD2BQuH7R09=eOkf5ESK8kJAw@mail.gmail.com
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 094fd3be87b0f102589e2d5c3fa5d06b7e20496d upstream.
In ALSA timer core, the active timer instance is managed in
active_list linked list. Each element is added / removed dynamically
at timer start, stop and in timer interrupt. The problem is that
snd_timer_interrupt() has a thinko and leaves the element in
active_list when it's the last opened element. This eventually leads
to list corruption or use-after-free error.
This hasn't been revealed because we used to delete the list forcibly
in snd_timer_stop() in the past. However, the recent fix avoids the
double-stop behavior (in commit [f784beb75ce8: ALSA: timer: Fix link
corruption due to double start or stop]), and this leak hits reality.
This patch fixes the link management in snd_timer_interrupt(). Now it
simply unlinks no matter which stream is.
BugLink: http://lkml.kernel.org/r/CACT4Y+Yy2aukHP-EDp8-ziNqNNmb-NTf=jDWXMP7jB8HDa2vng@mail.gmail.com
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit c3b1681375dc6e71d89a3ae00cc3ce9e775a8917 upstream.
This is a minor code cleanup without any functional changes:
- Kill keep_flag argument from _snd_timer_stop(), as all callers pass
only it false.
- Remove redundant NULL check in _snd_timer_stop().
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 7f0973e973cd74aa40747c9d38844560cd184ee8 upstream.
The port subscription code uses double mutex locks for source and
destination ports, and this may become racy once when wrongly set up.
It leads to lockdep warning splat, typically triggered by fuzzer like
syzkaller, although the actual deadlock hasn't been seen, so far.
This patch simplifies the handling by reducing to two single locks, so
that no lockdep warning will be trigger any longer.
By splitting to two actions, a still-in-progress element shall be
added in one list while handling another. For ignoring this element,
a new check is added in deliver_to_subscribers().
Along with it, the code to add/remove the subscribers list element was
cleaned up and refactored.
BugLink: http://lkml.kernel.org/r/CACT4Y+aKQXV7xkBW9hpQbzaDO7LrUvohxWh-UwMxXjDy-yBD=A@mail.gmail.com
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Tested-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 2d1b5c08366acd46c35a2e9aba5d650cb5bf5c19 upstream.
The virmidi driver has an open race at closing its assigned rawmidi
device, and this may lead to use-after-free in
snd_seq_deliver_single_event().
Plug the hole by properly protecting the linked list deletion and
calling in the right order in snd_virmidi_input_close().
BugLink: http://lkml.kernel.org/r/CACT4Y+Zd66+w12fNN85-425cVQT=K23kWbhnCEcMB8s3us-Frw@mail.gmail.com
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Tested-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 2cdc7b636d55cbcf42e1e6c8accd85e62d3e9ae8 upstream.
ALSA sequencer may open/close and control ALSA timer instance
dynamically either via sequencer events or direct ioctls. These are
done mostly asynchronously, and it may call still some timer action
like snd_timer_start() while another is calling snd_timer_close().
Since the instance gets removed by snd_timer_close(), it may lead to
a use-after-free.
This patch tries to address such a race by protecting each
snd_timer_*() call via the existing spinlock and also by avoiding the
access to timer during close call.
BugLink: http://lkml.kernel.org/r/CACT4Y+Z6RzW5MBr-HUdV-8zwg71WQfKTdPpYGvOeS7v4cyurNQ@mail.gmail.com
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 5e82d2be6ee53275c72e964507518d7964c82753 upstream.
While performing hw_free, DPCM checks the BE state but leaves out
the suspend state. The suspend state needs to be checked as well,
as we might be suspended and then usermode closes rather than
resuming the audio stream.
This was found by a stress testing of system with playback in
loop and killed after few seconds running in background and second
script running suspend-resume test in loop
Signed-off-by: Vinod Koul <vinod.koul@intel.com>
Acked-by: Liam Girdwood <liam.r.girdwood@linux.intel.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit b248371628aad599a48540962f6b85a21a8a0c3f upstream.
There are potential deadlocks in PCM OSS emulation code while
accessing read/write and mmap concurrently. This comes from the
infamous mmap_sem usage in copy_from/to_user(). Namely,
snd_pcm_oss_write() ->
&runtime->oss.params_lock ->
copy_to_user() ->
&mm->mmap_sem
mmap() ->
&mm->mmap_sem ->
snd_pcm_oss_mmap() ->
&runtime->oss.params_lock
Since we can't avoid taking params_lock from mmap code path, use
trylock variant and aborts with -EAGAIN as a workaround of this AB/BA
deadlock.
BugLink: http://lkml.kernel.org/r/CACT4Y+bVrBKDG0G2_AcUgUQa+X91VKTeS4v+wN7BSHwHtqn3kQ@mail.gmail.com
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 81f577542af15640cbcb6ef68baa4caa610cbbfc upstream.
The rawmidi read and write functions manage runtime stream status
such as runtime->appl_ptr and runtime->avail. These point where to
copy the new data and how many bytes have been copied (or to be
read). The problem is that rawmidi read/write call copy_from_user()
or copy_to_user(), and the runtime spinlock is temporarily unlocked
and relocked while copying user-space. Since the current code
advances and updates the runtime status after the spin unlock/relock,
the copy and the update may be asynchronous, and eventually
runtime->avail might go to a negative value when many concurrent
accesses are done. This may lead to memory corruption in the end.
For fixing this race, in this patch, the status update code is
performed in the same lock before the temporary unlock. Also, the
spinlock is now taken more widely in snd_rawmidi_kernel_read1() for
protecting more properly during the whole operation.
BugLink: http://lkml.kernel.org/r/CACT4Y+b-dCmNf1GpgPKfDO0ih+uZCL2JV4__j-r1kdhPLSgQCQ@mail.gmail.com
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Tested-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit cc85f7a634cfaf9f0713c6aa06d08817424db37a upstream.
NULL user-space buffer can be passed even in a normal path, thus it's
not good to spew a kernel warning with stack trace at each time.
Just drop snd_BUG_ON() macro usage there.
BugLink: http://lkml.kernel.org/r/CACT4Y+YfVJ3L+q0i-4vyQVyyPD7V=OMX0PWPi29x9Bo3QaBLdw@mail.gmail.com
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 599151336638d57b98d92338aa59c048e3a3e97d upstream.
ALSA sequencer OSS emulation code has a sanity check for currently
opened devices, but there is a thinko there, eventually it spews
warnings and skips the operation wrongly like:
WARNING: CPU: 1 PID: 7573 at sound/core/seq/oss/seq_oss_synth.c:311
Fix this off-by-one error.
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 7ee96216c31aabe1eb42fb91ff50dae9fcd014b2 upstream.
ALSA dummy driver can switch the timer backend between system timer
and hrtimer via its hrtimer module option. This can be also switched
dynamically via sysfs, but it may lead to a memory corruption when
switching is done while a PCM stream is running; the stream instance
for the newly switched timer method tries to access the memory that
was allocated by another timer method although the sizes differ.
As the simplest fix, this patch just disables the switch via sysfs by
dropping the writable bit.
BugLink: http://lkml.kernel.org/r/CACT4Y+ZGEeEBntHW5WHn2GoeE0G_kRrCmUh6=dWyy-wfzvuJLg@mail.gmail.com
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 462b3f161beb62eeb290f4ec52f5ead29a2f8ac7 upstream.
Some architectures like PowerPC can handle the maximum struct size in
an ioctl only up to 13 bits, and struct snd_compr_codec_caps used by
SNDRV_COMPRESS_GET_CODEC_CAPS ioctl overflows this limit. This
problem was revealed recently by a powerpc change, as it's now treated
as a fatal build error.
This patch is a stop-gap for that: for architectures with less than 14
bit ioctl struct size, get rid of the handling of the relevant ioctl.
We should provide an alternative equivalent ioctl code later, but for
now just paper over it. Luckily, the compress API hasn't been used on
such architectures, so the impact must be effectively zero.
Reviewed-by: Mark Brown <broonie@kernel.org>
Acked-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 07d86ca93db7e5cdf4743564d98292042ec21af7 upstream.
The 'umidi' object will be free'd on the error path by snd_usbmidi_free()
when tearing down the rawmidi interface. So we shouldn't try to free it
in snd_usbmidi_create() after having registered the rawmidi interface.
Found by KASAN.
Signed-off-by: Andrey Konovalov <andreyknvl@gmail.com>
Acked-by: Clemens Ladisch <clemens@ladisch.de>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 5a4ff9ec8d6edd2ab1cfe8ce6a080d6e57cbea9a upstream.
TEAC UD-501/UD-503/NT-503 fail to switch properly between different
rate/format. Similar to 'Playback Design', this patch corrects the
invalid clock source error for TEAC products and avoids complete
freeze of the usb interface of 503 series.
Signed-off-by: Guillaume Fougnies <guillaume@eulerian.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Check if 'mbhc_cb' is NULL in wcd_mbhc_stop() before
dereferrencing.
CRs-Fixed: 972101
Change-Id: I3b2348bddb071e5bf7bc2e5d6885bb3c1ba2c195
Signed-off-by: Karthik Reddy Katta <a_katta@codeaurora.org>
Pop is observed during starting of the playback in
CLS-AB mode. Fix the pop issue by updating register
sequence properly.
Change-Id: Iff17245e8a2b14354cc99150a57394ce81ec29b8
Signed-off-by: Vidyakumar Athota <vathota@codeaurora.org>
Signed-off-by: Santosh Mardi <gsantosh@codeaurora.org>
Update codec driver in compliance with the codec device bring up
and tear down,
Also include the critical fixes in codec driver fixed.
Change-Id: I7a468a40f18315fe8a065f13b05e7410a8d54b4c
Signed-off-by: Santosh Mardi <gsantosh@codeaurora.org>
When clients are trying to send message while the worker thread is
processing existing messages, there is possibility that the message
queue can get corrupted. This can result into kernel crash. Fix to make
sure the message queue does not get corrupted.
CRs-fixed: 951194
Change-Id: I1eb5232d9d079ecc9d28b95737333c1198a8b20c
Signed-off-by: Bhalchandra Gajare <gajare@codeaurora.org>
commit a1068045883ed4a18363a4ebad0c3d55e473b716 upstream.
The detection of direction for compress was only taking into account codec
capabilities and not CPU ones. Fix this by checking the CPU side capabilities
as well
Tested-by: Ashish Panwar <ashish.panwar@intel.com>
Signed-off-by: Vinod Koul <vinod.koul@intel.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit e73694d871867cae8471d2350ce89acb38bc2b63 upstream.
For a sample rate of 12kHz the bclk was taken from the 44.1kHz table as
we test for a multiple of 8kHz. This patch fixes this issue by testing
for multiples of 4kHz instead.
Signed-off-by: Nikesh Oswal <Nikesh.Oswal@cirrus.com>
Signed-off-by: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit c0bcdbdff3ff73a54161fca3cb8b6cdbd0bb8762 upstream.
When a TLV ioctl with numid zero is handled, the driver may spew a
kernel warning with a stack trace at each call. The check was
intended obviously only for a kernel driver, but not for a user
interaction. Let's fix it.
This was spotted by syzkaller fuzzer.
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 2ba1fe7a06d3624f9a7586d672b55f08f7c670f3 upstream.
hrtimer_cancel() waits for the completion from the callback, thus it
must not be called inside the callback itself. This was already a
problem in the past with ALSA hrtimer driver, and the early commit
[fcfdebe70759: ALSA: hrtimer - Fix lock-up] tried to address it.
However, the previous fix is still insufficient: it may still cause a
lockup when the ALSA timer instance reprograms itself in its callback.
Then it invokes the start function even in snd_timer_interrupt() that
is called in hrtimer callback itself, results in a CPU stall. This is
no hypothetical problem but actually triggered by syzkaller fuzzer.
This patch tries to fix the issue again. Now we call
hrtimer_try_to_cancel() at both start and stop functions so that it
won't fall into a deadlock, yet giving some chance to cancel the queue
if the functions have been called outside the callback. The proper
hrtimer_cancel() is called in anyway at closing, so this should be
enough.
Reported-and-tested-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 43c54b8c7cfe22f868a751ba8a59abf1724160b1 upstream.
This reverts one hunk of
commit ef44a1ec6e ("ALSA: sound/core: use memdup_user()"), which
replaced a number of kmalloc followed by memcpy with memdup calls.
In this case, we are copying from a struct snd_pcm_hw_params32 to
a struct snd_pcm_hw_params, but the latter is 4 bytes longer than
the 32-bit version, so we need to separate kmalloc and copy calls.
This actually leads to an out-of-bounds memory access later on
in sound/soc/soc-pcm.c:soc_pcm_hw_params() (detected using KASan).
Fixes: ef44a1ec6e ('ALSA: sound/core: use memdup_user()')
Signed-off-by: Nicolas Boichat <drinkcat@chromium.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 9586495dc3011a80602329094e746dbce16cb1f1 upstream.
This reverts one hunk of
commit ef44a1ec6e ("ALSA: sound/core: use memdup_user()"), which
replaced a number of kmalloc followed by memcpy with memdup calls.
In this case, we are copying from a struct snd_seq_port_info32 to a
struct snd_seq_port_info, but the latter is 4 bytes longer than the
32-bit version, so we need to separate kmalloc and copy calls.
Fixes: ef44a1ec6e ('ALSA: sound/core: use memdup_user()')
Signed-off-by: Nicolas Boichat <drinkcat@chromium.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit ee8413b01045c74340aa13ad5bdf905de32be736 upstream.
ALSA timer instance object has a couple of linked lists and they are
unlinked unconditionally at snd_timer_stop(). Meanwhile
snd_timer_interrupt() unlinks it, but it calls list_del() which leaves
the element list itself unchanged. This ends up with unlinking twice,
and it was caught by syzkaller fuzzer.
The fix is to use list_del_init() variant properly there, too.
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Tested-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit af368027a49a751d6ff4ee9e3f9961f35bb4fede upstream.
ALSA timer ioctls have an open race and this may lead to a
use-after-free of timer instance object. A simplistic fix is to make
each ioctl exclusive. We have already tread_sem for controlling the
tread, and extend this as a global mutex to be applied to each ioctl.
The downside is, of course, the worse concurrency. But these ioctls
aren't to be parallel accessible, in anyway, so it should be fine to
serialize there.
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Tested-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit b5a663aa426f4884c71cd8580adae73f33570f0d upstream.
A slave timer instance might be still accessible in a racy way while
operating the master instance as it lacks of locking. Since the
master operation is mostly protected with timer->lock, we should cope
with it while changing the slave instance, too. Also, some linked
lists (active_list and ack_list) of slave instances aren't unlinked
immediately at stopping or closing, and this may lead to unexpected
accesses.
This patch tries to address these issues. It adds spin lock of
timer->lock (either from master or slave, which is equivalent) in a
few places. For avoiding a deadlock, we ensure that the global
slave_active_lock is always locked at first before each timer lock.
Also, ack and active_list of slave instances are properly unlinked at
snd_timer_stop() and snd_timer_close().
Last but not least, remove the superfluous call of _snd_timer_stop()
at removing slave links. This is a noop, and calling it may confuse
readers wrt locking. Further cleanup will follow in a later patch.
Actually we've got reports of use-after-free by syzkaller fuzzer, and
this hopefully fixes these issues.
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 3567eb6af614dac436c4b16a8d426f9faed639b3 upstream.
ALSA sequencer code has an open race between the timer setup ioctl and
the close of the client. This was triggered by syzkaller fuzzer, and
a use-after-free was caught there as a result.
This patch papers over it by adding a proper queue->timer_mutex lock
around the timer-related calls in the relevant code path.
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Tested-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 030e2c78d3a91dd0d27fef37e91950dde333eba1 upstream.
snd_seq_ioctl_remove_events() calls snd_seq_fifo_clear()
unconditionally even if there is no FIFO assigned, and this leads to
an Oops due to NULL dereference. The fix is just to add a proper NULL
check.
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Tested-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 9f660a1c43890c2cdd1f423fd73654e7ca08fe56 upstream.
Without this patch, internal speaker and line-out work,
but front headphone output jack stays silent on the
Mac Pro 4,1.
This code path also gets executed on the MacPro 5,1 due
to identical codec SSID, but i don't know if it has any
positive or adverse effects there or not.
(v2) Implement feedback from Takashi Iwai: Reuse
alc889_fixup_mbp_vref and just add a new nid
0x19 for the MacPro 4,1.
Signed-off-by: Mario Kleiner <mario.kleiner.de@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 3e6db33aaf1d42a30339f831ec4850570d6cc7a3 upstream.
It takes three minutes to enter into hibernation on some OEM SKL
machines and we see many codec spurious response after thaw() opertion.
This is because HDA is still in D0 state after freeze() call and
pci_pm_freeze/pci_pm_freeze_noirq() don't set D3 hot in pci_bus driver.
It seems bios still access HDA when system enter into freeze state,
HDA will receive codec response interrupt immediately after thaw() call.
Because of this unexpected interrupt, HDA enter into a abnormal
state and slow down the system enter into hibernation.
In this patch, we put HDA into D3 hot state in azx_freeze_noirq() and
put HDA into D0 state in azx_thaw_noirq().
V2: Only apply this fix to SKL+
Fix compile error when CONFIG_PM_SLEEP isn't defined
[Yet another fix for CONFIG_PM_SLEEP ifdef and the additional comment
by tiwai]
Signed-off-by: Xiong Zhang <xiong.y.zhang@intel.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 02f6ff90400d055f08b0ba0b5f0707630b6faed7 upstream.
On the internal mic of the Packard Bell DOTS, one channel
has an inverted signal. Add a quirk to fix this up.
BugLink: https://bugs.launchpad.net/bugs/1523232
Signed-off-by: David Henningsson <david.henningsson@canonical.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit a74a821624c0c75388a193337babd17a8c02c740 upstream.
rme96 driver needs to reset DAC depending on the sample rate, and this
results in resetting to the max volume suddenly. It's because of the
missing call of snd_rme96_apply_dac_volume().
However, calling this function right after the DAC reset still may not
work, and we need some delay before this call. Since the DAC reset
and the procedure after that are performed in the spinlock, we delay
the DAC volume restore at the end after the spinlock.
Reported-and-tested-by: Sylvain LABOISNE <maeda1@free.fr>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit c932b98c1e47312822d911c1bb76e81ef50e389c upstream.
HP ProBook 6550b needs the same pin fixup applied to other HP B-series
laptops with docks for making its headphone and dock headphone jacks
working properly. We just need to add the codec SSID to the list.
Bugzilla: https://bugzilla.kernel.org/attachment.cgi?id=191971
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Minor version for some of the CPE commands should be
of value "1". Update the minor versions appropriately
for some of the CPE commands.
Change-Id: I034bbe156aab57410aa629f531b9c1eec3489b4f
Signed-off-by: Banajit Goswami <bgoswami@codeaurora.org>
Currently class-H controller is not enabled when lineout is enabled
first and then headphone is enabled. Because of this mute is observed
on headphone during lineout and headphone concurrent scenarios. Fix
mute on headphone by enabling class H block during concurrency also.
Change-Id: Ibed962eaacf87c3eb55c569d2ae9c6363a63cace
Signed-off-by: Vidyakumar Athota <vathota@codeaurora.org>
The data channel for buffering has two endpoints, one on the MSM and
another on the codec. When codec endpoint is torn down, it waits for an
interrupt for channel teardown from hardware. But, since MSM endpoint is
still connected, the interrupt is never receieved and the codec wait
gets timed out. This adds delay in data channel teardown. Fix this issue
by making sure the MSM endpoint is torn down first and then the codec
endpoint gets torn down.
CRs-fixed: 940132
Change-Id: Ie6529e9269aa29fb3d312b816c3d83e9e3e6e10e
Signed-off-by: Bhalchandra Gajare <gajare@codeaurora.org>
The channel setup errors are not handled in some cases, add fix to
handle the errors gracefully for look ahead buffering.
CRs-fixed: 943741
Change-Id: Ifbaf8a05e0e1f4c7e099a1664e914d430345ee37
Signed-off-by: Bhalchandra Gajare <gajare@codeaurora.org>
Currently, it is possible there could be race condition when there are
multiple messages to be sent to CPE. Add changes to fix the possible
race conditions.
CRs-fixed: 946375
Change-Id: I6a290c00b08fa3afc64acf40cd339a0203f73d96
Signed-off-by: Bhalchandra Gajare <gajare@codeaurora.org>
Currently lsm client data is deallocated when q6lsm_open() fails
which can cause memory corruption if lsm client data is accessed
after freed. Fix this issue by deallocating the client data only
in msm_lsm_close().
Change-Id: If048c26a0ffd8a346a28622183cbf2ba1e7e5ff3
Signed-off-by: Vidyakumar Athota <vathota@codeaurora.org>
During subsystem restart, it is possible that while the underlying bus
is down, the irq driver has already performed its cleanup. In such case,
when CPE driver requests to cleanup its own irq, the irq driver attempts
to hold an lock that is already freed. Fix this issue by performing the
CPE driver irq cleanup after bus is up rather than when bus is down.
CRs-fixed: 948899
Change-Id: I2772e89bbdc855baa9fcf7a34a9c16f2f5c05c32
Signed-off-by: Bhalchandra Gajare <gajare@codeaurora.org>
After subsystem restart is completed, driver will try to restore the
internal clock state to state before subsystem restart. In some cases,
it is possible that the internal clock state is not restored properly.
This causes the internal clock to be off when it is expected to be
turned on. Fix this issue by making sure the clock states are restored
correctly post subsystem restart.
CRs-fixed: 948899
Change-Id: I0084287b2d3b62c7498bae423952e64dd0d6e0f4
Signed-off-by: Bhalchandra Gajare <gajare@codeaurora.org>
When CPE services notifies the client that response to any message is
received, it is possible that the client may send another message even
before the CPE services cleared the current message response as these
both are run in different thread contexts, this will cause the command
queue to be corrupted. Fix this issue by clearing internal state of CPE
services command queue before notifying clients the clients the result
of message transfer completion.
CRs-fixed: 946375
Change-Id: I4b31201747edd7fdee57294ff559ccb21e582608
Signed-off-by: Bhalchandra Gajare <gajare@codeaurora.org>
Reduce insert and remove debounce value on wcd9335 to 96msec
to improve device switch latency during audio playback usecase.
Change sets the insert and remove debounce to 96msec.
Change-Id: I62a4e29af050da3b6be4afc1267b1b03f786c63e
Signed-off-by: Sudheer Papothi <spapothi@codeaurora.org>
The buffer used for look-ahead-buffering is allocated during IOCTL from
userspace. It is possible that userspace can invoke this IOCTL multiple
times without invoking the IOCTL to de-allocate the buffer. This results
in out of memory issue for buffer allocation during stress testing. Fix
this issue by avoiding multiple buffer allocations.
CRs-fixed: 942452
Change-Id: Id9eb99dc2c8527fbbe1fe79fca1cdcea232c33da
Signed-off-by: Bhalchandra Gajare <gajare@codeaurora.org>
Currently worker thread in cpe service is created twice.
The second thread handler overwrites the first one. The first
thread is not freed when the service is cleaned up. The fix
prevents creation of the redundant thread.
CRs-Fixed: 949165
Change-Id: Idd76b76d4f7f25d2592ca7c336dbee77b6efc7eb
Signed-off-by: Walter Yang <yandongy@codeaurora.org>
HW MAD bypass feature is to facilitate input to CPE by avoiding
MAD in codec. This is done by routing DEC1 data to CPE. Add the
required changes to support this feature.
CRs-fixed: 938514
Change-Id: I7788b1475cd22bdea291bcae47f048131b220ce3
Signed-off-by: Venkata Narendra Kumar Gutta <vgutta@codeaurora.org>
Clear TX HOLD when ANC is enabled and decimator
10 to 13 are selected.
Change-Id: I18c1ddeacc59c1ae7d88daf371c84140c0459693
Signed-off-by: Phani Kumar Uppalapati <phaniu@codeaurora.org>
Change RX disconnect port sequence so as to avoid
slimbus underflow and audio mute issues during
playback.
Change-Id: I0260e61b78e3bcfe422896dc60b15af84be424a4
Signed-off-by: Phani Kumar Uppalapati <phaniu@codeaurora.org>
Since the underlying codec can have different memory map, it is possible
the starting offset and size for DRAM can be different as well. This
causes the collected dumps to be incorrect on some platforms. Fix the
ramdump collection to obtain DRAM offset and size from CPE services
which is aware of the codec being used.
CRs-fixed: 929517
Change-Id: I6a592d8f97da117d1e58154460cd0b8f3cbf62c7
Signed-off-by: Bhalchandra Gajare <gajare@codeaurora.org>
The DRAM size used for codec WCD9335 is incorrect, this is causing the
dumps to be wrong. Update the DRAM size for WCD9335 as per the memory
map.
CRs-fixed: 929517
Change-Id: Ie4815b4cedf429b0d7045b84381d945bde62d5ce
Signed-off-by: Bhalchandra Gajare <gajare@codeaurora.org>
commit a91e627e3f0ed820b11d86cdc04df38f65f33a70 upstream.
One of the many faults of the QinHeng CH345 USB MIDI interface chip is
that it does not handle received SysEx messages correctly -- every second
event packet has a wrong code index number, which is the one from the last
seen message, instead of 4. For example, the two messages "FE F0 01 02 03
04 05 06 07 08 09 0A 0B 0C 0D 0E F7" result in the following event
packets:
correct: CH345:
0F FE 00 00 0F FE 00 00
04 F0 01 02 04 F0 01 02
04 03 04 05 0F 03 04 05
04 06 07 08 04 06 07 08
04 09 0A 0B 0F 09 0A 0B
04 0C 0D 0E 04 0C 0D 0E
05 F7 00 00 05 F7 00 00
A class-compliant driver must interpret an event packet with CIN 15 as
having a single data byte, so the other two bytes would be ignored. The
message received by the host would then be missing two bytes out of six;
in this example, "F0 01 02 03 06 07 08 09 0C 0D 0E F7".
These corrupted SysEx event packages contain only data bytes, while the
CH345 uses event packets with a correct CIN value only for messages with
a status byte, so it is possible to distinguish between these two cases by
checking for the presence of this status byte.
(Other bugs in the CH345's input handling, such as the corruption resulting
from running status, cannot be worked around.)
Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 1ca8b201309d842642f221db7f02f71c0af5be2d upstream.
The CH345 USB MIDI chip has two output ports. However, they are
multiplexed through one pin, and the number of ports cannot be reduced
even for hardware that implements only one connector, so for those
devices, data sent to either port ends up on the same hardware output.
This becomes a problem when both ports are used at the same time, as
longer MIDI commands (such as SysEx messages) are likely to be
interrupted by messages from the other port, and thus to get lost.
It would not be possible for the driver to detect how many ports the
device actually has, except that in practice, _all_ devices built with
the CH345 have only one port. So we can just ignore the device's
descriptors, and hardcode one output port.
Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
When BUSID pin is connected to ground, wsa speaker should be
set as left. When it is connected to VDD, wsa speaker should
be set as right. Current setting is inversed.
Correct stereo wsa speaker left/right setting for 8976.
Change-Id: If2b44be202f084d76cd9e58307d36c3fce802e3f
Signed-off-by: Yeleswarapu Nagaradhesh <nagaradh@codeaurora.org>
Port fixes for TX pop and spkr gain updates for tasha.
Also add fix in WSA for retry when device re-enumeration.
Change-Id: I6573517a101a4e5b0c34ef07a78c7dd0a4f127e5
Signed-off-by: Laxminath Kasam <lkasam@codeaurora.org>
In device switch from bongo speaker to HPH, observe
pop in headset. Since the PA select bit is changed
to HPH before DAC disable when tearing down bongo
speaker, this can result in pop in headset. Move
the PA selection bit to be changed to HPH after
PA and DAC disable.
Change-Id: Idb4f96f03880563e4bb81b98f623b6b05f27da8e
Signed-off-by: Laxminath Kasam <lkasam@codeaurora.org>
After SSR, MICBIAS is not enabled as micb_ref is not correct.
So set micb_ref to zero post SSR.
Change-Id: Iaffa7a29799a9b3ed7a46da3cb11a2d4c47e45e9
Signed-off-by: Yeleswarapu Nagaradhesh <nagaradh@codeaurora.org>
From second detection onwards, buffered data has one extra
stale sample before the actual data even though CPE TX PP
(PingPong) buffer is properly disabled. Avoid this extra data
by clearing TX PP buffer memory after reading the complete buffer.
Change-Id: Id3183f64136e827641ab4d00450dbdb7806f00ab
Signed-off-by: Vidyakumar Athota <vathota@codeaurora.org>
Default FIFO watermark value is set as 8 bytes. Observed data skipping
randomly at higher sample rates with default watermark value. Increase
the watermark value to 16 bytes to avoid data loss.
Change-Id: Ic595f62f243b6087ceb2dc61089f957b6a6f8121
Signed-off-by: Vidyakumar Athota <vathota@codeaurora.org>
When userspace requests small duration of buffer then it is possible
that the buffer can overflow if only one buffer is queued at a time.
This is because of more channel setup time than buffer size duration.
Queue two buffers with slimbus before starting AFE port to avoid
data loss.
Change-Id: Iabb6f6b1d0e3ee8227ed8be26a64e7eb025e7018
Signed-off-by: Vidyakumar Athota <vathota@codeaurora.org>
Currently 16KHz is the maximum supported CPE data transfer
rate. Add support to transfer LAB(Look Ahead buffer) data
from CPE at maximum rate of 384KHz/32bit.
Change-Id: Ic4475d91ca2962c90f424816ef03df0a68ccdf92
Signed-off-by: Vidyakumar Athota <vathota@codeaurora.org>
CPE PP(ping-pong) buffer hardware block is added to support
higher data transfers from CPE in WCD9335 V2. Update codec
driver to enable CPE PP buffer path.
Change-Id: I030cef25d6eddc72a02859f6ee78f201efc3dd43
Signed-off-by: Vidyakumar Athota <vathota@codeaurora.org>
Currently only one CPE AFE output port is supported. Add
an API to get CPE AFE port ID from codec driver. Use that
port ID for LAB buffering.
Change-Id: I74fdeb1800a64ed775608967e4d315f28d48e9ef
Signed-off-by: Vidyakumar Athota <vathota@codeaurora.org>
Currenlty HW params fails to set 384KHz sample rate
due to unsupported sample rate. Change to add 384KHz
sample rate support to ALSA.
Change-Id: I381f7cdcc69e6cf9339cec53aab3fa295760c17c
Signed-off-by: Vidyakumar Athota <vathota@codeaurora.org>
In compressed driver streams might get stopped while
ioctl drain is started but not completed, since buffers
are drained in multiple stages when gapless mode is
enabled.
Check stream state before issuing wait commands to
prevent waiting for drain ack on stopped streams.
Change-Id: I606639c103a7aed90dd9a4561fa6dffc3d4c3822
Signed-off-by: Dhananjay Kumar <dhakumar@codeaurora.org>
Issue slim slave port disconnect command to tear
down the audio playback path and then wait for
the channel removal interrupt from the slimbus slave.
This is required because of the slim protocol (pull
mode) being used for 44.1KHz native audio playback.
If MSM side slimbus channels are closed first followed
by slim slave ports, it will lead to underflow errors
at the end of audio playback with 44.1KHz sample rate.
To avoid underflow errors, slim slave port disconnect
command is issued explicitly.
Change-Id: Ib7ae6f7c5301073f7a9cf51ec3536504b9cdd7c7
Signed-off-by: Laxminath Kasam <lkasam@codeaurora.org>
MCLK needs to be turned on for efuse sensing to be successful.
During post SSR codec bring up, make sure MCLK is restored
before efuse sensing, if audio use cases were running when
SSR happened.
Change-Id: I3a04775ebd88ca81804e472ffa20cb91a66ecaee
Signed-off-by: Banajit Goswami <bgoswami@codeaurora.org>
When device down is called, the work queue for temparature
reading should be cancelled. Without this, there might be
read/write happening while WSA881x device is still in
down (no clock) state.
Change-Id: Ib0a6a9e5f8b45c3952e6a7fe5889901971bf0f08
Signed-off-by: Banajit Goswami <bgoswami@codeaurora.org>
Signed-off-by: Laxminath Kasam <lkasam@codeaurora.org>
When SSR triggered on speaker in internal codec,
sometimes dapm fails to mark dapm widget dirty after SSR
for specific clips and speaker codec widgets fail
to powerup. As this widget associated with SPK DAC register
which is also changed in driver when SSR power down and
powerup, resulting in timing issue when this register
being read by DAPM. Change the routing to tie up the
speaker codec widgets path with virtual mux switch
and DAC widgets.
Change-Id: I691fed56818a099dc3893eedad6fcd7f9bc61107
Signed-off-by: Laxminath Kasam <lkasam@codeaurora.org>
When XO shutdown happens, workqueue scheduled for digital
power collapse is not triggered. In tasha suspend, put
digital core in power collapse if workqueue is pending.
Change-Id: I4ae9bad6b18dd54217fcad5ad60673ee726f4700
Signed-off-by: Laxminath Kasam <lkasam@codeaurora.org>
Re-align ANC(Active Noise Cancellation) coefficients per ANC block
to avoid click and pop during ANC headset device path bringup.
Change enables ANC re-alignment based on codec path.
Change-Id: I7af75942fc714a96e478f862b4c8ecacb3f20fdc
Signed-off-by: Sudheer Papothi <spapothi@codeaurora.org>
Update mbhc register table entry for moisture detection
to be zero for the targets which do not support moisture
detection. This prevents any impact due to moisture
detection.
Change-Id: I3e026e288788700ea2328ccbd12f79f5c40642ac
Signed-off-by: Phani Kumar Uppalapati <phaniu@codeaurora.org>
Update impedance detection sequence for cajon as per
the new method provided by hardware team.
Change-Id: Iab021752cb5e56bb64776c41bec6825cb4a0d0db
Signed-off-by: Simmi Pateriya <simmip@codeaurora.org>
Add debugfs nodes for CPE FTM.
The callback will load the instruction and execute it.
CPE status will be retrieved and be read by userspace.
New CPE service command validation is added to guarantee
the concurrency of CPE FTM and normal CPE SVA detection.
Change-Id: I0748e357a21d873af5a85bbb80e982db0323beb7
Signed-off-by: Walter Yang <yandongy@codeaurora.org>
Add support to control external audio switch thru
machine driver. This is to support msm8952 Polaris
devices.
Change-Id: I42e0779b1f18e4883006fdfa71d99da0d2519784
Signed-off-by: Sujeev Dias <sdias@codeaurora.org>
commit 4873867e5f2bd90faad861dd94865099fc3140f3 upstream.
from Designware I2S datasheet, tx/rx XRUN irq is cleared by
reading register TOR/ROR, rather than by writing into them.
Signed-off-by: Yitian Bu <yitian.bu@tangramtek.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 3c8f7710c1c44fb650bc29b6ef78ed8b60cfaa28 upstream.
The previous fix of pxa library support, which was introduced to fix the
library dependency, broke the previous SoC behavior, where a machine
code binding pxa2xx-ac97 with a coded relied on :
- sound/soc/pxa/pxa2xx-ac97.c
- sound/soc/codecs/XXX.c
For example, the mioa701_wm9713.c machine code is currently broken. The
"select ARM" statement wrongly selects the soc/arm/pxa2xx-ac97 for
compilation, as per an unfortunate fate SND_PXA2XX_AC97 is both declared
in sound/arm/Kconfig and sound/soc/pxa/Kconfig.
Fix this by ensuring that SND_PXA2XX_SOC correctly triggers the correct
pxa2xx-ac97 compilation.
Fixes: 846172dfe3 ("ASoC: fix SND_PXA2XX_LIB Kconfig warning")
Signed-off-by: Robert Jarzmik <robert.jarzmik@free.fr>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 225db5762dc1a35b26850477ffa06e5cd0097243 upstream.
When OSS emulation is loaded on ISA SB AWE32 chip, we get now kernel
warnings like:
WARNING: CPU: 0 PID: 2791 at fs/sysfs/dir.c:31 sysfs_warn_dup+0x51/0x80()
sysfs: cannot create duplicate filename '/devices/isa/sbawe.0/sound/card0/seq-oss-0-0'
It's because both emux synth and opl3 drivers try to register their
OSS device object with the same static index number 0. This hasn't
been a big problem until the recent rewrite of device management code
(that exposes sysfs at the same time), but it's been an obvious bug.
This patch works around it just by using a different index number of
emux synth object. There can be a more elegant way to fix, but it's
enough for now, as this code won't be touched so often, in anyway.
Reported-and-tested-by: Michael Shell <list1@michaelshell.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
changes to optimize wsa881x register writes that will help in
reducing cold start output latency during audio playback
usecase.
Change-Id: I5b316f77bfbd74ca01da491f263a9e9ae80ec63b
Signed-off-by: Sudheer Papothi <spapothi@codeaurora.org>
During playback close, ioctl call to prepare for same
session is triggered resulting in access to null pointer
access. Add null pointer check before access audio
client and private data in prepare functions.
Change-Id: I88dee5526b4308a710535d966aa7aeceee668e18
Signed-off-by: Laxminath Kasam <lkasam@codeaurora.org>
Mark few registers non-cache as they are supposed to be
volatile. This will avoid audio mute after SSR.
Change-Id: I44a99c2b609fbfbd6c9ce7fd2e4b1354ed03bc20
Signed-off-by: Laxminath Kasam <lkasam@codeaurora.org>
When no LSM session is active, return from msm_lsm_close
and avoid null pointer dereference.
Change-Id: I9f57c08e080497765eaefef0c031bbf956c02914
Signed-off-by: Laxminath Kasam <lkasam@codeaurora.org>
Update RX shutdown sequence so that port underflow/
overflows can be avoided when slim data protocol
is changed.
Change-Id: I3428623658633ca88e279bcb5c23025214586985
Signed-off-by: Yeleswarapu Nagaradhesh <nagaradh@codeaurora.org>
WCD9335 codec version 2.0 supports multiple headphone
modes namely LOHIFI, LOWPWR for audio playback. Add
support to configure codec registers for these modes
in version 2.0.
Change-Id: I62eb409868795ea3913f6e967429b76f45cde2f9
Signed-off-by: Phani Kumar Uppalapati <phaniu@codeaurora.org>
Update RX shutdown sequence so that codec
path gets tear down first followed by cpu dai.
This will avoid slim port underflow/overflows
when slim data protocol is changed.
Change-Id: I6e3582fa010d18d4e0ccfde319dfc4d81af1351f
Signed-off-by: Yeleswarapu Nagaradhesh <nagaradh@codeaurora.org>
To make power savings during sleep in tasha 2.0, add
required changes for setting codec registers for
rock bottom current. Apply RBSC(rock bottom sleep current)
settings only when no audio and no SVA usecase running.
Apply default value back when any of audio or SVA usecase
starts.
Change-Id: If8516b15cf38575ed2e1a1f6ebfdf49566bc8237
Signed-off-by: Laxminath Kasam <lkasam@codeaurora.org>
SIDO buck voltage can be dropped down to low voltage
when no audio usecase running. Update the sido buck
voltage to nominal or low voltage(svs) based on CPE
and audio usecases running.
Change-Id: Ie6caff7c264fa7f169098acf4e8fe1cc60c97d22
Signed-off-by: Laxminath Kasam <lkasam@codeaurora.org>
Xiaojun Sang
Karthikeyan Mani
Sharad Sangle
SoumyaManagoli
Vladis Dronov
Takashi Iwai
Laxminath Kasam
Ramlal Karra
Karthik Reddy Katta
Ravi Kumar Siddojigari
Rohit kumar
Shiv Maliyappanahalli
Linux Build Service Account
Walter Yang
Surendar karka
Yeleswarapu Nagaradhesh
dojha
Meng Wang
Pradosh Das
Ashish Jain
Kangjie Lu
Phani Kumar Uppalapati
Ben Romberger
Pavan Chikkala
Ramjee Singh
Manish Dewangan
Santosh Mardi
Alexy Joseph
Arnd Bergmann
Vittorio Gambaletta (VittGam)
Haynes Mathew George
Weiyin Jiang
Vinod Koul
Andrey Konovalov
Guillaume Fougnies
Bhalchandra Gajare
Nikesh Oswal
Sachin Pandhare
Nicolas Boichat
Mario Kleiner
Xiong Zhang
David Henningsson
Alexandra Yates
Banajit Goswami
Vidyakumar Athota
Sudheer Papothi
Venkata Narendra Kumar Gutta
Clemens Ladisch
Dhananjay Kumar
Simmi Pateriya
Sujeev Dias
Yitian Bu
Robert Jarzmik