The bug is here:
if (!dai) {
The list iterator value 'dai' will *always* be set and non-NULL
by for_each_component_dais(), so it is incorrect to assume that
the iterator value will be NULL if the list is empty or no element
is found (In fact, it will be a bogus pointer to an invalid struct
object containing the HEAD). Otherwise it will bypass the check
'if (!dai) {' (never call dev_err() and never return -ENODEV;)
and lead to invalid memory access lately when calling
'rt5682_set_bclk1_ratio(dai, factor);'.
To fix the bug, just return rt5682_set_bclk1_ratio(dai, factor);
when found the 'dai', otherwise dev_err() and return -ENODEV;
Cc: stable@vger.kernel.org
Fixes: ebbfabc16d ("ASoC: rt5682: Add CCF usage for providing I2S clks")
Signed-off-by: Xiaomeng Tong <xiam0nd.tong@gmail.com>
Link: https://lore.kernel.org/r/20220327081002.12684-1-xiam0nd.tong@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
The CS35L41_NUM_OTP_ELEM is 100, but only 99 entries are defined in
the array otp_map_1/2[CS35L41_NUM_OTP_ELEM], this will trigger UBSAN
to report a shift-out-of-bounds warning in the cs35l41_otp_unpack()
since the last entry in the array will result in GENMASK(-1, 0).
UBSAN reports this problem:
UBSAN: shift-out-of-bounds in /home/hwang4/build/jammy/jammy/sound/soc/codecs/cs35l41-lib.c:836:8
shift exponent 64 is too large for 64-bit type 'long unsigned int'
CPU: 10 PID: 595 Comm: systemd-udevd Not tainted 5.15.0-23-generic #23
Hardware name: LENOVO \x02MFG_IN_GO/\x02MFG_IN_GO, BIOS N3GET19W (1.00 ) 03/11/2022
Call Trace:
<TASK>
show_stack+0x52/0x58
dump_stack_lvl+0x4a/0x5f
dump_stack+0x10/0x12
ubsan_epilogue+0x9/0x45
__ubsan_handle_shift_out_of_bounds.cold+0x61/0xef
? regmap_unlock_mutex+0xe/0x10
cs35l41_otp_unpack.cold+0x1c6/0x2b2 [snd_soc_cs35l41_lib]
cs35l41_hda_probe+0x24f/0x33a [snd_hda_scodec_cs35l41]
cs35l41_hda_i2c_probe+0x65/0x90 [snd_hda_scodec_cs35l41_i2c]
? cs35l41_hda_i2c_remove+0x20/0x20 [snd_hda_scodec_cs35l41_i2c]
i2c_device_probe+0x252/0x2b0
Fixes: 6450ef5590 ("ASoC: cs35l41: CS35L41 Boosted Smart Amplifier")
Reviewed-by: Lucas Tanure <tanureal@opensource.cirrus.com>
Acked-by: Charles Keepax <ckeepax@opensource.cirrus.com>
Signed-off-by: Hui Wang <hui.wang@canonical.com>
Link: https://lore.kernel.org/r/20220328123535.50000-2-hui.wang@canonical.com
Signed-off-by: Mark Brown <broonie@kernel.org>
As part of the ongoing i2c transition to the simple probe
("probe_new"), this patch uses i2c_match_id to retrieve the
driver_data for the probed device. The id parameter is thus no longer
necessary and the simple probe can be used instead.
This patch follows the model set by da7218_of_get_id().
Signed-off-by: Stephen Kitt <steve@sk2.org>
Reviewed-by: Adam Thomson <Adam.Thomson.Opensource@diasemi.com>
Link: https://lore.kernel.org/r/20220325171904.1223539-1-steve@sk2.org
Signed-off-by: Mark Brown <broonie@kernel.org>
The bug is here:
if (!dai) {
The list iterator value 'dai' will *always* be set and non-NULL
by for_each_component_dais(), so it is incorrect to assume that
the iterator value will be NULL if the list is empty or no element
is found (In fact, it will be a bogus pointer to an invalid struct
object containing the HEAD). Otherwise it will bypass the check
'if (!dai) {' (never call dev_err() and never return -ENODEV;)
and lead to invalid memory access lately when calling
'rt5682s_set_bclk1_ratio(dai, factor);'.
To fix the bug, just return rt5682s_set_bclk1_ratio(dai, factor);
when found the 'dai', otherwise dev_err() and return -ENODEV;
Cc: stable@vger.kernel.org
Fixes: bdd229ab26 ("ASoC: rt5682s: Add driver for ALC5682I-VS codec")
Signed-off-by: Xiaomeng Tong <xiam0nd.tong@gmail.com>
Link: https://lore.kernel.org/r/20220327081300.12962-1-xiam0nd.tong@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Both the I2C and SPI bus code register the component immediately after they
call wm8731_hw_init(), factor the code out into the the common function and
rename it to just be plain wm8731_init() while we're at it since it's not
just for hardware init any more. This refactoring means we need to move the
function after the declaration of the component driver.
Signed-off-by: Mark Brown <broonie@kernel.org>
Acked-by: Charles Keepax <ckeepax@opensource.cirrus.com>
Link: https://lore.kernel.org/r/20220325153121.1598494-3-broonie@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Pull sound fixes from Takashi Iwai:
"Just a few fixes that have been gathered since the previous pull:
- An additional fix for potential PCM deadlocks
- A series of HD-audio CS8409 codec patches for new models
- Other device specific fixes for HD-audio, ASoC mediatek, Intel,
fsl, rockchip"
* tag 'sound-fix-5.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
ALSA: pcm: Fix potential AB/BA lock with buffer_mutex and mmap_lock
ALSA: hda: Avoid unsol event during RPM suspending
ALSA: hda/realtek: Fix audio regression on Mi Notebook Pro 2020
ALSA: hda/cs8409: Add new Dolphin HW variants
ALSA: hda/cs8409: Disable HSBIAS_SENSE_EN for Cyborg
ALSA: hda/cs8409: Support new Warlock MLK Variants
ALSA: hda/cs8409: Fix Full Scale Volume setting for all variants
ALSA: hda/cs8409: Re-order quirk table into ascending order
ALSA: hda/cs8409: Fix Warlock to use mono mic configuration
ALSA: cs4236: fix an incorrect NULL check on list iterator
ALSA: hda/realtek: Enable headset mic on Lenovo P360
ASoC: SOF: Intel: Fix build error without SND_SOC_SOF_PCI_DEV
ALSA: hda/realtek: Add mute and micmut LED support for Zbook Fury 17 G9
ASoC: rockchip: i2s_tdm: Fixup config for SND_SOC_DAIFMT_DSP_A/B
ASoC: fsl-asoc-card: Fix jack_event() always return 0
ASoC: mediatek: mt6358: add missing EXPORT_SYMBOLs
Pull driver core updates from Greg KH:
"Here is the set of driver core changes for 5.18-rc1.
Not much here, primarily it was a bunch of cleanups and small updates:
- kobj_type cleanups for default_groups
- documentation updates
- firmware loader minor changes
- component common helper added and take advantage of it in many
drivers (the largest part of this pull request).
All of these have been in linux-next for a while with no reported
problems"
* tag 'driver-core-5.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core: (54 commits)
Documentation: update stable review cycle documentation
drivers/base/dd.c : Remove the initial value of the global variable
Documentation: update stable tree link
Documentation: add link to stable release candidate tree
devres: fix typos in comments
Documentation: add note block surrounding security patch note
samples/kobject: Use sysfs_emit instead of sprintf
base: soc: Make soc_device_match() simpler and easier to read
driver core: dd: fix return value of __setup handler
driver core: Refactor sysfs and drv/bus remove hooks
driver core: Refactor multiple copies of device cleanup
scripts: get_abi.pl: Fix typo in help message
kernfs: fix typos in comments
kernfs: remove unneeded #if 0 guard
ALSA: hda/realtek: Make use of the helper component_compare_dev_name
video: omapfb: dss: Make use of the helper component_compare_dev
power: supply: ab8500: Make use of the helper component_compare_dev
ASoC: codecs: wcd938x: Make use of the helper component_compare/release_of
iommu/mediatek: Make use of the helper component_compare/release_of
drm: of: Make use of the helper component_release_of
...
Pull sound updates from Takashi Iwai:
"It's been a fairly calm development cycle. There are a few last-minute
ALSA core fixes, most notably for covering PCM ioctl races, but the
most of rest are device-specific changes.
Below are some highlights:
ALSA core:
- Fixes for PCM ioctl races that may lead to UAF
- Fix for oversized allocations in PCM OSS layer
ASoC:
- Start of moving SoF to support multiple IPC mechanisms
- Use of NHLT ACPI table to reduce the amount of quirking required
for Intel systems
- Preliminary works forthcoming Intel AVS driver for legacy Intel DSP
firmwares
- Support for AMD PDM, Atmel PDMC, Awinic AW8738, i.MX cards with
TLV320AIC31xx, Intel machines with CS35L41 and ESSX8336, Mediatek
MT8181 wideband bluetooth, nVidia Tegra234, Qualcomm SC7280,
Renesas RZ/V2L, Texas Instruments TAS585M
HD-audio:
- Driver re-binding fix for HD-audio
- Updates for Intel ADL and Tegra234, various platform quirks for
Dell, HP, Lenovo, ASUS, Samsung and Clevo machines
USB-audio:
- Quirk updates for Scarlett2, RODE, Corsair devices"
* tag 'sound-5.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (486 commits)
ALSA: hda/realtek: Add alc256-samsung-headphone fixup
ALSA: pci: fix reading of swapped values from pcmreg in AC97 codec
ALSA: pcm: Add stream lock during PCM reset ioctl operations
ALSA: pcm: Fix races among concurrent prealloc proc writes
ALSA: pcm: Fix races among concurrent prepare and hw_params/hw_free calls
ALSA: pcm: Fix races among concurrent read/write and buffer changes
ALSA: pcm: Fix races among concurrent hw_params and hw_free calls
ASoC: atmel: mchp-pdmc: print the correct property name
MAINTAINERS: Add Shengjiu to maintainer list of sound/soc/fsl
ASoC: SOF: Add a new dai_get_clk topology IPC op
ASoC: SOF: topology: Add ops for setting up and tearing down pipelines
ASoC: SOF: expose sof_route_setup()
ASoC: SOF: Add dai_link_fixup PCM op for IPC3
ASoC: SOF: Add trigger PCM op for IPC3
ASoC: SOF: Define hw_params PCM op for IPC3
ASoC: SOF: Introduce IPC3 PCM hw_free op
ASoC: SOF: pcm: expose the sof_pcm_setup_connected_widgets() function
ASoC: SOF: Introduce IPC-specific PCM ops
ASoC: SOF: Add bytes_ext control IPC ops for IPC3
ASoC: SOF: Add bytes_get/put control IPC ops for IPC3
...
Pull spi updates from Mark Brown:
"The overwhelming bulk of this pull request is a change from Uwe
Kleine-König which changes the return type of the remove() function to
void as part of some wider work he's doing to do this for all bus
types, causing updates to most SPI device drivers. The branch with
that on has been cross merged with a couple of other trees which added
new SPI drivers this cycle, I'm not expecting any build issues
resulting from the change.
Otherwise it's been a relatively quiet release with some new device
support, a few minor features and the welcome completion of the
conversion of the subsystem to use GPIO descriptors rather than
numbers:
- Change return type of remove() to void.
- Completion of the conversion of SPI controller drivers to use GPIO
descriptors rather than numbers.
- Quite a few DT schema conversions.
- Support for multiple SPI devices on a bus in ACPI systems.
- Big overhaul of the PXA2xx SPI driver.
- Support for AMD AMDI0062, Intel Raptor Lake, Mediatek MT7986 and
MT8186, nVidia Tegra210 and Tegra234, Renesas RZ/V2L, Tesla FSD and
Sunplus SP7021"
[ And this is obviously where that spi change that snuck into the
regulator tree _should_ have been :^]
* tag 'spi-v5.18' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: (124 commits)
spi: fsi: Implement a timeout for polling status
spi: Fix erroneous sgs value with min_t()
spi: tegra20: Use of_device_get_match_data()
spi: mediatek: add ipm design support for MT7986
spi: Add compatible for MT7986
spi: sun4i: fix typos in comments
spi: mediatek: support tick_delay without enhance_timing
spi: Update clock-names property for arm pl022
spi: rockchip-sfc: fix platform_get_irq.cocci warning
spi: s3c64xx: Add spi port configuration for Tesla FSD SoC
spi: dt-bindings: samsung: Add fsd spi compatible
spi: topcliff-pch: Prevent usage of potentially stale DMA device
spi: tegra210-quad: combined sequence mode
spi: tegra210-quad: add acpi support
spi: npcm-fiu: Fix typo ("npxm")
spi: Fix Tegra QSPI example
spi: qup: replace spin_lock_irqsave by spin_lock in hard IRQ
spi: cadence: fix platform_get_irq.cocci warning
spi: Update NXP Flexspi maintainer details
dt-bindings: mfd: maxim,max77802: Convert to dtschema
...
ASoC: Updates for v5.18
Quite a quiet release for ASoC, lots of work on drivers and platforms
but nothing too groundbreaking but not much on the core itself:
- Start of moving SoF to support multiple IPC mechanisms.
- Use of NHLT ACPI table to reduce the amount of quirking required for
Intel systems.
- Some building blocks for use in forthcoming Intel AVS driver for
legacy Intel DSP firmwares.
- Support for AMD PDM, Atmel PDMC, Awinic AW8738, i.MX cards with
TLV320AIC31xx, Intel machines with CS35L41 and ESSX8336, Mediatek
MT8181 wideband bluetooth, nVidia Tegra234, Qualcomm SC7280, Renesas
RZ/V2L, Texas Instruments TAS585M
ASoC: Potential fixes for v5.17
Rather more fixes here than I'm comfortable with, we've had several
vendors noticing issues late in the release cycle all of which are valid
and reasonable fixes but it adds up to a much larger change set than I'd
like. Several of the AMD fixes look like cleanups from the subject
lines but are actually fixing user visible problems as well.
If you were to merge this for 5.18 rather than 5.17 it wouldn't be the
end of the world, stable will probably backport everything anyway.
Merge series from Stephan Gerhold <stephan@gerhold.net>:
This series adds a simple driver and DT schema for the Awinic AW8738
audio amplifier. It's fairly simple - the main difference to
simple-amplifier is that there is a "one-wire pulse control" that
allows configuring the amplifier to one of a few pre-defined modes.
This can be used to configure the speaker-guard function (primarily
the power limit for the amplifier).
DETECT_MODE and PLL_START must be zero while HP_PDN and ADC_PDN are
both 1. If this condition is broken it can discharge FILT+ and it
can then take up to 1 second for FILT+ to recharge.
There is no workaround required for this, simply avoiding settings
and sequences that would break the requirement. The driver already
meets the requirement.
But it is not obvious from reading the code that this requirement
exists, or what is ensuring it is met. So it would not currently be
obvious to someone changing the code that there is certain special
behaviour that must be maintained.
To avoid accidental breakage in the future:
- Add comments into the register definitions to warn about this so
that anyone changing the code around DETECT_MODE and PLL_START is
aware of this requirement.
- Add a comment where PLL_START is written to 1 to highlight the
requirement and why it is satisfied.
- Add a comment in cs42l42_setup_hs_type_detect() when DETECT_MODE is
initialized.
Signed-off-by: Richard Fitzgerald <rf@opensource.cirrus.com>
Link: https://lore.kernel.org/r/20220304144015.398656-1-rf@opensource.cirrus.com
Signed-off-by: Mark Brown <broonie@kernel.org>
The parts supported by this driver can have product-specific
firmware and tunings files. Typically these have been used on
embedded systems where the manufacturer is responsible for
installing the correct product-specific firmware files into
/lib/firmware. However, the linux-firmware repository places all
available firmwares into /lib/firmware and it is up to the driver to
select the correct product-specific firmware from that directory.
For example a product containing four smart amplifiers may provide
firmware specific for that product and each of the amplifiers may
have coefficient files containing tunings for their placement in the
mechanical design.
This change extends firmware (wmfw) and coefficient (bin) filenames
to be of the general form:
<cirrus/>part-dspN-fwtype<-system_name<-asoc_component_prefix>>.type
Where the cirrus subdirectory, system_name and asoc_component_prefix
are optional.
New files will be placed in the cirrus subdirectory to avoid
polluting the main /lib/firmware/ location. The generic name must be
searched in /lib/firmware before /lib/firmware/cirrus so that a
generic file in the new location does not override existing
product-specific files in the legacy location.
The search order for firmware files is:
- cirrus/part-dspN-fwtype-system_name-asoc_component_prefix.wmfw
- cirrus/part-dspN-fwtype-system_name.wmfw
- part-dspN-fwtype.wmfw
- cirrus/part-dspN-fwtype.wmfw
- Qualifications are added to the filename so that rightwards is more
specific.
- The system_name is provided by the codec driver.
- The asoc_component_prefix is used to identify tunings for individual
parts because it would already exist to disambiguate the controls
and it makes it obvious which firmware file applies to which device.
The optional coefficient file must have the same filename
construction as the discovered wmfw except:
- where the wmfw has only system_name then the bin file can
optionally include the asoc_component_prefix. This is to allow a
common wmfw for all amps but separate tunings per amp.
Signed-off-by: Simon Trimmer <simont@opensource.cirrus.com>
Acked-by: Charles Keepax <ckeepax@opensource.cirrus.com>
Link: https://lore.kernel.org/r/20220303155016.122125-1-simont@opensource.cirrus.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Changes:
1. Revise rt5682s_sar_power_mode and rt5682s_headset_detect to be more
rational.
2. Manually set to the jack-unplugging state via rt5682s_headset_detect
during going to suspend. Close unnecessary powers and prepare for
re-detecting the CBJ during resuming.
3. Simplize rt5682s_resume.
Signed-off-by: Derek Fang <derek.fang@realtek.com>
Link: https://lore.kernel.org/r/20220307102154.26065-1-derek.fang@realtek.com
Signed-off-by: Mark Brown <broonie@kernel.org>
The Awinic AW8738 is a simple audio amplifier using a single GPIO.
The main difference to simple-amplifier is that there is a "one-wire
pulse control" that allows configuring the amplifier to one of a few
pre-defined modes. This can be used to configure the speaker-guard
function (primarily the power limit for the amplifier).
Add a simple driver that allows setting it up in the device tree
with a specified mode number.
Signed-off-by: Jonathan Albrieux <jonathan.albrieux@gmail.com>
Co-developed-by: Stephan Gerhold <stephan@gerhold.net>
Signed-off-by: Stephan Gerhold <stephan@gerhold.net>
Link: https://lore.kernel.org/r/20220304102452.26856-3-stephan@gerhold.net
Signed-off-by: Mark Brown <broonie@kernel.org>
This patch fix the second dai driver's dai widget can't connect to the
endpoint. Because "bt-sco-pcm" and "bt-sco-pcm-wb" dai driver have the
same stream_name, so it will cause they have the same widget name.
Therefor it will just create only one route when do snd_soc_dapm_add_route
that only find the widget through the widget name.
Signed-off-by: Jiaxin Yu <jiaxin.yu@mediatek.com>
Link: https://lore.kernel.org/r/20220302013533.29068-1-jiaxin.yu@mediatek.com
Signed-off-by: Mark Brown <broonie@kernel.org>
pcm name can be "Analog" and "Alt Analog", cpcm->name can be
"Analog Codec DAI" and "Alt Analog Codec DAI". When pcm_name
is "Analog", "Analog Codec DAI" and "Alt Analog Codec DAI" are
both satisfy the 'if (strstr(cpcm->name, pcm_name))' condition,
which may cause the returned cpcm to be "Alt Analog Codec DAI".
Even if we get the pcm name by id, and "Analog Codec DAI" goes
into the loop before "Alt Analog Codec DAI", but I still think
we'd better have multiple insurances against unexpected return
values. After, we can correctly return the expected result
even if other relevant places are changed.
Signed-off-by: Meng Tang <tangmeng@uniontech.com>
Link: https://lore.kernel.org/r/20220302094351.3487-1-tangmeng@uniontech.com
Signed-off-by: Mark Brown <broonie@kernel.org>
