From c0317c0e87094f5b5782b6fdef5ae0a4b150496c Mon Sep 17 00:00:00 2001 From: Wang Wensheng Date: Wed, 3 Nov 2021 03:35:17 +0000 Subject: [PATCH 01/18] ALSA: timer: Fix use-after-free problem When the timer instance was add into ack_list but was not currently in process, the user could stop it via snd_timer_stop1() without delete it from the ack_list. Then the user could free the timer instance and when it was actually processed UAF occurred. This issue could be reproduced via testcase snd_timer01 in ltp - running several instances of that testcase at the same time. What I actually met was that the ack_list of the timer broken and the kernel went into deadloop with irqoff. That could be detected by hardlockup detector on board or when we run it on qemu, we could use gdb to dump the ack_list when the console has no response. To fix this issue, we delete the timer instance from ack_list and active_list unconditionally in snd_timer_stop1(). Signed-off-by: Wang Wensheng Suggested-by: Takashi Iwai Cc: Link: https://lore.kernel.org/r/20211103033517.80531-1-wangwensheng4@huawei.com Signed-off-by: Takashi Iwai --- sound/core/timer.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/sound/core/timer.c b/sound/core/timer.c index 92b7008fcdb8..4f9bab931951 100644 --- a/sound/core/timer.c +++ b/sound/core/timer.c @@ -624,13 +624,13 @@ static int snd_timer_stop1(struct snd_timer_instance *timeri, bool stop) if (!timer) return -EINVAL; spin_lock_irqsave(&timer->lock, flags); + list_del_init(&timeri->ack_list); + list_del_init(&timeri->active_list); if (!(timeri->flags & (SNDRV_TIMER_IFLG_RUNNING | SNDRV_TIMER_IFLG_START))) { result = -EBUSY; goto unlock; } - list_del_init(&timeri->ack_list); - list_del_init(&timeri->active_list); if (timer->card && timer->card->shutdown) goto unlock; if (stop) { From 1278cc5ac2f96bab50dd55c8c05e0a6a77ce323e Mon Sep 17 00:00:00 2001 From: Jeremy Soller Date: Tue, 2 Nov 2021 11:21:04 -0600 Subject: [PATCH 02/18] ALSA: hda/realtek: Headset fixup for Clevo NH77HJQ On Clevo NH77HJ, NH77HP, and their 15" variants, there is a headset microphone input attached to 0x19 that does not have a jack detect. In order to get it working, the pin configuration needs to be set correctly, and a new ALC256_FIXUP_SYSTEM76_MIC_NO_PRESENCE fixup is applied. This is similar to the existing System76 quirk for ALC293, but for ALC256. Signed-off-by: Jeremy Soller Signed-off-by: Tim Crawford Cc: Link: https://lore.kernel.org/r/20211102172104.10610-1-tcrawford@system76.com Signed-off-by: Takashi Iwai --- sound/pci/hda/patch_realtek.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c index 8a3e2fe42106..e6b266416393 100644 --- a/sound/pci/hda/patch_realtek.c +++ b/sound/pci/hda/patch_realtek.c @@ -6739,6 +6739,7 @@ enum { ALC287_FIXUP_YOGA7_14ITL_SPEAKERS, ALC287_FIXUP_13S_GEN2_SPEAKERS, ALC256_FIXUP_TONGFANG_RESET_PERSISTENT_SETTINGS, + ALC256_FIXUP_SYSTEM76_MIC_NO_PRESENCE, }; static const struct hda_fixup alc269_fixups[] = { @@ -8450,6 +8451,15 @@ static const struct hda_fixup alc269_fixups[] = { .type = HDA_FIXUP_FUNC, .v.func = alc245_fixup_hp_gpio_led, }, + [ALC256_FIXUP_SYSTEM76_MIC_NO_PRESENCE] = { + .type = HDA_FIXUP_PINS, + .v.pins = (const struct hda_pintbl[]) { + { 0x19, 0x03a11120 }, /* use as headset mic, without its own jack detect */ + { } + }, + .chained = true, + .chain_id = ALC269_FIXUP_HEADSET_MODE_NO_HP_MIC, + }, }; static const struct snd_pci_quirk alc269_fixup_tbl[] = { @@ -8750,11 +8760,15 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { SND_PCI_QUIRK(0x1558, 0x40a1, "Clevo NL40GU", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), SND_PCI_QUIRK(0x1558, 0x40c1, "Clevo NL40[CZ]U", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), SND_PCI_QUIRK(0x1558, 0x40d1, "Clevo NL41DU", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1558, 0x5015, "Clevo NH5[58]H[HJK]Q", ALC256_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1558, 0x5017, "Clevo NH7[79]H[HJK]Q", ALC256_FIXUP_SYSTEM76_MIC_NO_PRESENCE), SND_PCI_QUIRK(0x1558, 0x50a3, "Clevo NJ51GU", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), SND_PCI_QUIRK(0x1558, 0x50b3, "Clevo NK50S[BEZ]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), SND_PCI_QUIRK(0x1558, 0x50b6, "Clevo NK50S5", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), SND_PCI_QUIRK(0x1558, 0x50b8, "Clevo NK50SZ", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), SND_PCI_QUIRK(0x1558, 0x50d5, "Clevo NP50D5", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1558, 0x50e1, "Clevo NH5[58]HPQ", ALC256_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1558, 0x50e2, "Clevo NH7[79]HPQ", ALC256_FIXUP_SYSTEM76_MIC_NO_PRESENCE), SND_PCI_QUIRK(0x1558, 0x50f0, "Clevo NH50A[CDF]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), SND_PCI_QUIRK(0x1558, 0x50f2, "Clevo NH50E[PR]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), SND_PCI_QUIRK(0x1558, 0x50f3, "Clevo NH58DPQ", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), From bf868be7a26afce32168fd175102ae0b70c32e1f Mon Sep 17 00:00:00 2001 From: Takashi Sakamoto Date: Thu, 4 Nov 2021 20:06:27 +0900 Subject: [PATCH 03/18] ALSA: firewire-motu: add support for MOTU Traveler mk3 Mark of the Unicorn (MOTU) shipped Traveler mk3 as one of models in third generation of its FireWire series, and discontinued it already. The model consists of below ICs: * Texas Instruments TSB41AB2 * Phillips Semiconductors PDI1394L40 * Altera cyclone EP1C3 * Texas Instruments TMS320VC5402 It supports sampling transfer frequency up to 192.0 kHz. The packet format differs depending on both of current sampling transfer frequency and whether to enable ADAT channels in rx/tx packets. The model supports transmission of PCM frames as well as MIDI messages. The model supports command mechanism to configure internal DSP. Hardware meter information is available in the first 2 chunks of each data block of tx packet. This commit adds support for it. $ cd linux-firewire-tools/src $ python crpp < /sys/bus/firewire/devices/fw1/config_rom ROM header and bus information block ----------------------------------------------------------------- 400 0410af0a bus_info_length 4, crc_length 16, crc 44810 404 31333934 bus_name "1394" 408 20ff7000 irmc 0, cmc 0, isc 1, bmc 0, cyc_clk_acc 255, max_rec 7 (256) 40c 0001f200 company_id 0001f2 | 410 00090911 device_id 0000090911 | EUI-64 0001f20000090911 root directory ----------------------------------------------------------------- 414 0004ef04 directory_length 4, crc 61188 418 030001f2 vendor 41c 0c0083c0 node capabilities per IEEE 1394 420 d1000002 --> unit directory at 428 424 8d000005 --> eui-64 leaf at 438 unit directory at 428 ----------------------------------------------------------------- 428 00031733 directory_length 3, crc 5939 42c 120001f2 specifier id 430 1300001b version 434 17102800 model eui-64 leaf at 438 ----------------------------------------------------------------- 438 00028484 leaf_length 2, crc 33924 43c 0001f200 company_id 0001f2 | 440 00090911 device_id 0000090911 | EUI-64 0001f20000090911 Signed-off-by: Takashi Sakamoto Link: https://lore.kernel.org/r/20211104110627.94469-1-o-takashi@sakamocchi.jp Signed-off-by: Takashi Iwai --- sound/firewire/motu/motu-protocol-v3.c | 22 +++++++++++++++++++--- sound/firewire/motu/motu.c | 1 + sound/firewire/motu/motu.h | 1 + 3 files changed, 21 insertions(+), 3 deletions(-) diff --git a/sound/firewire/motu/motu-protocol-v3.c b/sound/firewire/motu/motu-protocol-v3.c index 05608e8ca0bc..1371f38505d0 100644 --- a/sound/firewire/motu/motu-protocol-v3.c +++ b/sound/firewire/motu/motu-protocol-v3.c @@ -16,6 +16,7 @@ #define V3_CLOCK_SRC_INTERNAL 0x00 #define V3_CLOCK_SRC_WORD_ON_BNC 0x01 #define V3_CLOCK_SRC_SPH 0x02 +#define V3_CLOCK_SRC_AESEBU_ON_XLR 0x08 #define V3_CLOCK_SRC_SPDIF_ON_COAX 0x10 #define V3_CLOCK_SRC_OPT_IFACE_A 0x18 #define V3_CLOCK_SRC_OPT_IFACE_B 0x19 @@ -126,6 +127,9 @@ int snd_motu_protocol_v3_get_clock_source(struct snd_motu *motu, case V3_CLOCK_SRC_SPH: *src = SND_MOTU_CLOCK_SOURCE_SPH; break; + case V3_CLOCK_SRC_AESEBU_ON_XLR: + *src = SND_MOTU_CLOCK_SOURCE_AESEBU_ON_XLR; + break; case V3_CLOCK_SRC_SPDIF_ON_COAX: *src = SND_MOTU_CLOCK_SOURCE_SPDIF_ON_COAX; break; @@ -185,7 +189,7 @@ int snd_motu_protocol_v3_switch_fetching_mode(struct snd_motu *motu, sizeof(reg)); } -static int detect_packet_formats_828mk3(struct snd_motu *motu, u32 data) +static int detect_packet_formats_dual_opt_iface(struct snd_motu *motu, u32 data) { if (data & V3_ENABLE_OPT_IN_IFACE_A) { if (data & V3_NO_ADAT_OPT_IN_IFACE_A) { @@ -255,8 +259,10 @@ int snd_motu_protocol_v3_cache_packet_formats(struct snd_motu *motu) motu->spec->rx_fixed_pcm_chunks, sizeof(motu->rx_packet_formats.pcm_chunks)); - if (motu->spec == &snd_motu_spec_828mk3_fw || motu->spec == &snd_motu_spec_828mk3_hybrid) - return detect_packet_formats_828mk3(motu, data); + if (motu->spec == &snd_motu_spec_828mk3_fw || + motu->spec == &snd_motu_spec_828mk3_hybrid || + motu->spec == &snd_motu_spec_traveler_mk3) + return detect_packet_formats_dual_opt_iface(motu, data); else return 0; } @@ -281,6 +287,16 @@ const struct snd_motu_spec snd_motu_spec_828mk3_hybrid = { .rx_fixed_pcm_chunks = {14, 14, 14}, // Additional 4 dummy chunks at higher rate. }; +const struct snd_motu_spec snd_motu_spec_traveler_mk3 = { + .name = "TravelerMk3", + .protocol_version = SND_MOTU_PROTOCOL_V3, + .flags = SND_MOTU_SPEC_RX_MIDI_3RD_Q | + SND_MOTU_SPEC_TX_MIDI_3RD_Q | + SND_MOTU_SPEC_COMMAND_DSP, + .tx_fixed_pcm_chunks = {18, 14, 10}, + .rx_fixed_pcm_chunks = {14, 14, 10}, +}; + const struct snd_motu_spec snd_motu_spec_ultralite_mk3 = { .name = "UltraLiteMk3", .protocol_version = SND_MOTU_PROTOCOL_V3, diff --git a/sound/firewire/motu/motu.c b/sound/firewire/motu/motu.c index 5fc7ae475537..080728dd278f 100644 --- a/sound/firewire/motu/motu.c +++ b/sound/firewire/motu/motu.c @@ -169,6 +169,7 @@ static const struct ieee1394_device_id motu_id_table[] = { SND_MOTU_DEV_ENTRY(0x00000f, &snd_motu_spec_8pre), SND_MOTU_DEV_ENTRY(0x000015, &snd_motu_spec_828mk3_fw), // FireWire only. SND_MOTU_DEV_ENTRY(0x000019, &snd_motu_spec_ultralite_mk3), // FireWire only. + SND_MOTU_DEV_ENTRY(0x00001b, &snd_motu_spec_traveler_mk3), SND_MOTU_DEV_ENTRY(0x000030, &snd_motu_spec_ultralite_mk3), // Hybrid. SND_MOTU_DEV_ENTRY(0x000035, &snd_motu_spec_828mk3_hybrid), // Hybrid. SND_MOTU_DEV_ENTRY(0x000033, &snd_motu_spec_audio_express), diff --git a/sound/firewire/motu/motu.h b/sound/firewire/motu/motu.h index 79704ae6a73e..6ad1feab478b 100644 --- a/sound/firewire/motu/motu.h +++ b/sound/firewire/motu/motu.h @@ -138,6 +138,7 @@ extern const struct snd_motu_spec snd_motu_spec_8pre; extern const struct snd_motu_spec snd_motu_spec_828mk3_fw; extern const struct snd_motu_spec snd_motu_spec_828mk3_hybrid; +extern const struct snd_motu_spec snd_motu_spec_traveler_mk3; extern const struct snd_motu_spec snd_motu_spec_ultralite_mk3; extern const struct snd_motu_spec snd_motu_spec_audio_express; extern const struct snd_motu_spec snd_motu_spec_4pre; From 2a5bb694488bb6593066d46881bfd9d07edd1628 Mon Sep 17 00:00:00 2001 From: Jaroslav Kysela Date: Thu, 4 Nov 2021 16:57:26 +0100 Subject: [PATCH 04/18] ALSA: hda/realtek: Add a quirk for Acer Spin SP513-54N Another model requires ALC255_FIXUP_ACER_MIC_NO_PRESENCE fixup. BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=211853 Signed-off-by: Jaroslav Kysela Cc: Link: https://lore.kernel.org/r/20211104155726.2090997-1-perex@perex.cz Signed-off-by: Takashi Iwai --- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+) diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c index e6b266416393..3601749f2df6 100644 --- a/sound/pci/hda/patch_realtek.c +++ b/sound/pci/hda/patch_realtek.c @@ -8496,6 +8496,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { SND_PCI_QUIRK(0x1025, 0x1308, "Acer Aspire Z24-890", ALC286_FIXUP_ACER_AIO_HEADSET_MIC), SND_PCI_QUIRK(0x1025, 0x132a, "Acer TravelMate B114-21", ALC233_FIXUP_ACER_HEADSET_MIC), SND_PCI_QUIRK(0x1025, 0x1330, "Acer TravelMate X514-51T", ALC255_FIXUP_ACER_HEADSET_MIC), + SND_PCI_QUIRK(0x1025, 0x141f, "Acer Spin SP513-54N", ALC255_FIXUP_ACER_MIC_NO_PRESENCE), SND_PCI_QUIRK(0x1025, 0x142b, "Acer Swift SF314-42", ALC255_FIXUP_ACER_MIC_NO_PRESENCE), SND_PCI_QUIRK(0x1025, 0x1430, "Acer TravelMate B311R-31", ALC256_FIXUP_ACER_MIC_NO_PRESENCE), SND_PCI_QUIRK(0x1025, 0x1466, "Acer Aspire A515-56", ALC255_FIXUP_ACER_HEADPHONE_AND_MIC), From 7599acb7b9a1e33a410e33f13791647fba94e84f Mon Sep 17 00:00:00 2001 From: Takashi Iwai Date: Thu, 4 Nov 2021 19:08:46 +0100 Subject: [PATCH 05/18] Revert "ALSA: memalloc: Convert x86 SG-buffer handling with non-contiguous type" This reverts commit 2d9ea39917a4e4293bc2caea902c7059a330b611. We've got a regression report showing that the audio got broken the device over AMD IOMMU. The conversion assumed the wrong pointer / page mapping for the indirect mapping case, and we need to correct this urgently, so let's revert it for now. Fixes: 2d9ea39917a4 ("ALSA: memalloc: Convert x86 SG-buffer handling with non-contiguous type") Reported-and-tested-by: Alex Xu (Hello71) Link: https://lore.kernel.org/r/20211104180846.16340-1-tiwai@suse.de Signed-off-by: Takashi Iwai --- include/sound/memalloc.h | 14 +-- sound/core/Makefile | 1 + sound/core/memalloc.c | 51 +--------- sound/core/sgbuf.c | 201 +++++++++++++++++++++++++++++++++++++++ 4 files changed, 213 insertions(+), 54 deletions(-) create mode 100644 sound/core/sgbuf.c diff --git a/include/sound/memalloc.h b/include/sound/memalloc.h index 653dfffb3ac8..1051b84e8579 100644 --- a/include/sound/memalloc.h +++ b/include/sound/memalloc.h @@ -36,6 +36,13 @@ struct snd_dma_device { #define SNDRV_DMA_TYPE_CONTINUOUS 1 /* continuous no-DMA memory */ #define SNDRV_DMA_TYPE_DEV 2 /* generic device continuous */ #define SNDRV_DMA_TYPE_DEV_WC 5 /* continuous write-combined */ +#ifdef CONFIG_SND_DMA_SGBUF +#define SNDRV_DMA_TYPE_DEV_SG 3 /* generic device SG-buffer */ +#define SNDRV_DMA_TYPE_DEV_WC_SG 6 /* SG write-combined */ +#else +#define SNDRV_DMA_TYPE_DEV_SG SNDRV_DMA_TYPE_DEV /* no SG-buf support */ +#define SNDRV_DMA_TYPE_DEV_WC_SG SNDRV_DMA_TYPE_DEV_WC +#endif #ifdef CONFIG_GENERIC_ALLOCATOR #define SNDRV_DMA_TYPE_DEV_IRAM 4 /* generic device iram-buffer */ #else @@ -44,13 +51,6 @@ struct snd_dma_device { #define SNDRV_DMA_TYPE_VMALLOC 7 /* vmalloc'ed buffer */ #define SNDRV_DMA_TYPE_NONCONTIG 8 /* non-coherent SG buffer */ #define SNDRV_DMA_TYPE_NONCOHERENT 9 /* non-coherent buffer */ -#ifdef CONFIG_SND_DMA_SGBUF -#define SNDRV_DMA_TYPE_DEV_SG SNDRV_DMA_TYPE_NONCONTIG -#define SNDRV_DMA_TYPE_DEV_WC_SG 6 /* SG write-combined */ -#else -#define SNDRV_DMA_TYPE_DEV_SG SNDRV_DMA_TYPE_DEV /* no SG-buf support */ -#define SNDRV_DMA_TYPE_DEV_WC_SG SNDRV_DMA_TYPE_DEV_WC -#endif /* * info for buffer allocation diff --git a/sound/core/Makefile b/sound/core/Makefile index 350d704ced98..79e1407cd0de 100644 --- a/sound/core/Makefile +++ b/sound/core/Makefile @@ -19,6 +19,7 @@ snd-$(CONFIG_SND_JACK) += ctljack.o jack.o snd-pcm-y := pcm.o pcm_native.o pcm_lib.o pcm_misc.o \ pcm_memory.o memalloc.o snd-pcm-$(CONFIG_SND_PCM_TIMER) += pcm_timer.o +snd-pcm-$(CONFIG_SND_DMA_SGBUF) += sgbuf.o snd-pcm-$(CONFIG_SND_PCM_ELD) += pcm_drm_eld.o snd-pcm-$(CONFIG_SND_PCM_IEC958) += pcm_iec958.o diff --git a/sound/core/memalloc.c b/sound/core/memalloc.c index 99cd0f67daa1..ea778f868cf3 100644 --- a/sound/core/memalloc.c +++ b/sound/core/memalloc.c @@ -560,50 +560,6 @@ static const struct snd_malloc_ops snd_dma_noncontig_ops = { .get_chunk_size = snd_dma_vmalloc_get_chunk_size, }; -/* x86-specific SG-buffer with WC pages */ -#ifdef CONFIG_SND_DMA_SGBUF -#define vmalloc_to_virt(v) (unsigned long)page_to_virt(vmalloc_to_page(v)) - -static void *snd_dma_sg_wc_alloc(struct snd_dma_buffer *dmab, size_t size) -{ - void *p = snd_dma_noncontig_alloc(dmab, size); - size_t ofs; - - if (!p) - return NULL; - for (ofs = 0; ofs < size; ofs += PAGE_SIZE) - set_memory_uc(vmalloc_to_virt(p + ofs), 1); - return p; -} - -static void snd_dma_sg_wc_free(struct snd_dma_buffer *dmab) -{ - size_t ofs; - - for (ofs = 0; ofs < dmab->bytes; ofs += PAGE_SIZE) - set_memory_wb(vmalloc_to_virt(dmab->area + ofs), 1); - snd_dma_noncontig_free(dmab); -} - -static int snd_dma_sg_wc_mmap(struct snd_dma_buffer *dmab, - struct vm_area_struct *area) -{ - area->vm_page_prot = pgprot_writecombine(area->vm_page_prot); - /* FIXME: dma_mmap_noncontiguous() works? */ - return -ENOENT; /* continue with the default mmap handler */ -} - -const struct snd_malloc_ops snd_dma_sg_wc_ops = { - .alloc = snd_dma_sg_wc_alloc, - .free = snd_dma_sg_wc_free, - .mmap = snd_dma_sg_wc_mmap, - .sync = snd_dma_noncontig_sync, - .get_addr = snd_dma_vmalloc_get_addr, - .get_page = snd_dma_vmalloc_get_page, - .get_chunk_size = snd_dma_vmalloc_get_chunk_size, -}; -#endif /* CONFIG_SND_DMA_SGBUF */ - /* * Non-coherent pages allocator */ @@ -663,13 +619,14 @@ static const struct snd_malloc_ops *dma_ops[] = { [SNDRV_DMA_TYPE_DEV_WC] = &snd_dma_wc_ops, [SNDRV_DMA_TYPE_NONCONTIG] = &snd_dma_noncontig_ops, [SNDRV_DMA_TYPE_NONCOHERENT] = &snd_dma_noncoherent_ops, -#ifdef CONFIG_SND_DMA_SGBUF - [SNDRV_DMA_TYPE_DEV_WC_SG] = &snd_dma_sg_wc_ops, -#endif #ifdef CONFIG_GENERIC_ALLOCATOR [SNDRV_DMA_TYPE_DEV_IRAM] = &snd_dma_iram_ops, #endif /* CONFIG_GENERIC_ALLOCATOR */ #endif /* CONFIG_HAS_DMA */ +#ifdef CONFIG_SND_DMA_SGBUF + [SNDRV_DMA_TYPE_DEV_SG] = &snd_dma_sg_ops, + [SNDRV_DMA_TYPE_DEV_WC_SG] = &snd_dma_sg_ops, +#endif }; static const struct snd_malloc_ops *snd_dma_get_ops(struct snd_dma_buffer *dmab) diff --git a/sound/core/sgbuf.c b/sound/core/sgbuf.c new file mode 100644 index 000000000000..8352a5cdb19f --- /dev/null +++ b/sound/core/sgbuf.c @@ -0,0 +1,201 @@ +// SPDX-License-Identifier: GPL-2.0-or-later +/* + * Scatter-Gather buffer + * + * Copyright (c) by Takashi Iwai + */ + +#include +#include +#include +#include +#include +#include "memalloc_local.h" + +struct snd_sg_page { + void *buf; + dma_addr_t addr; +}; + +struct snd_sg_buf { + int size; /* allocated byte size */ + int pages; /* allocated pages */ + int tblsize; /* allocated table size */ + struct snd_sg_page *table; /* address table */ + struct page **page_table; /* page table (for vmap/vunmap) */ + struct device *dev; +}; + +/* table entries are align to 32 */ +#define SGBUF_TBL_ALIGN 32 +#define sgbuf_align_table(tbl) ALIGN((tbl), SGBUF_TBL_ALIGN) + +static void snd_dma_sg_free(struct snd_dma_buffer *dmab) +{ + struct snd_sg_buf *sgbuf = dmab->private_data; + struct snd_dma_buffer tmpb; + int i; + + if (!sgbuf) + return; + + vunmap(dmab->area); + dmab->area = NULL; + + tmpb.dev.type = SNDRV_DMA_TYPE_DEV; + if (dmab->dev.type == SNDRV_DMA_TYPE_DEV_WC_SG) + tmpb.dev.type = SNDRV_DMA_TYPE_DEV_WC; + tmpb.dev.dev = sgbuf->dev; + for (i = 0; i < sgbuf->pages; i++) { + if (!(sgbuf->table[i].addr & ~PAGE_MASK)) + continue; /* continuous pages */ + tmpb.area = sgbuf->table[i].buf; + tmpb.addr = sgbuf->table[i].addr & PAGE_MASK; + tmpb.bytes = (sgbuf->table[i].addr & ~PAGE_MASK) << PAGE_SHIFT; + snd_dma_free_pages(&tmpb); + } + + kfree(sgbuf->table); + kfree(sgbuf->page_table); + kfree(sgbuf); + dmab->private_data = NULL; +} + +#define MAX_ALLOC_PAGES 32 + +static void *snd_dma_sg_alloc(struct snd_dma_buffer *dmab, size_t size) +{ + struct snd_sg_buf *sgbuf; + unsigned int i, pages, chunk, maxpages; + struct snd_dma_buffer tmpb; + struct snd_sg_page *table; + struct page **pgtable; + int type = SNDRV_DMA_TYPE_DEV; + pgprot_t prot = PAGE_KERNEL; + void *area; + + dmab->private_data = sgbuf = kzalloc(sizeof(*sgbuf), GFP_KERNEL); + if (!sgbuf) + return NULL; + if (dmab->dev.type == SNDRV_DMA_TYPE_DEV_WC_SG) { + type = SNDRV_DMA_TYPE_DEV_WC; +#ifdef pgprot_noncached + prot = pgprot_noncached(PAGE_KERNEL); +#endif + } + sgbuf->dev = dmab->dev.dev; + pages = snd_sgbuf_aligned_pages(size); + sgbuf->tblsize = sgbuf_align_table(pages); + table = kcalloc(sgbuf->tblsize, sizeof(*table), GFP_KERNEL); + if (!table) + goto _failed; + sgbuf->table = table; + pgtable = kcalloc(sgbuf->tblsize, sizeof(*pgtable), GFP_KERNEL); + if (!pgtable) + goto _failed; + sgbuf->page_table = pgtable; + + /* allocate pages */ + maxpages = MAX_ALLOC_PAGES; + while (pages > 0) { + chunk = pages; + /* don't be too eager to take a huge chunk */ + if (chunk > maxpages) + chunk = maxpages; + chunk <<= PAGE_SHIFT; + if (snd_dma_alloc_pages_fallback(type, dmab->dev.dev, + chunk, &tmpb) < 0) { + if (!sgbuf->pages) + goto _failed; + size = sgbuf->pages * PAGE_SIZE; + break; + } + chunk = tmpb.bytes >> PAGE_SHIFT; + for (i = 0; i < chunk; i++) { + table->buf = tmpb.area; + table->addr = tmpb.addr; + if (!i) + table->addr |= chunk; /* mark head */ + table++; + *pgtable++ = virt_to_page(tmpb.area); + tmpb.area += PAGE_SIZE; + tmpb.addr += PAGE_SIZE; + } + sgbuf->pages += chunk; + pages -= chunk; + if (chunk < maxpages) + maxpages = chunk; + } + + sgbuf->size = size; + area = vmap(sgbuf->page_table, sgbuf->pages, VM_MAP, prot); + if (!area) + goto _failed; + return area; + + _failed: + snd_dma_sg_free(dmab); /* free the table */ + return NULL; +} + +static dma_addr_t snd_dma_sg_get_addr(struct snd_dma_buffer *dmab, + size_t offset) +{ + struct snd_sg_buf *sgbuf = dmab->private_data; + dma_addr_t addr; + + addr = sgbuf->table[offset >> PAGE_SHIFT].addr; + addr &= ~((dma_addr_t)PAGE_SIZE - 1); + return addr + offset % PAGE_SIZE; +} + +static struct page *snd_dma_sg_get_page(struct snd_dma_buffer *dmab, + size_t offset) +{ + struct snd_sg_buf *sgbuf = dmab->private_data; + unsigned int idx = offset >> PAGE_SHIFT; + + if (idx >= (unsigned int)sgbuf->pages) + return NULL; + return sgbuf->page_table[idx]; +} + +static unsigned int snd_dma_sg_get_chunk_size(struct snd_dma_buffer *dmab, + unsigned int ofs, + unsigned int size) +{ + struct snd_sg_buf *sg = dmab->private_data; + unsigned int start, end, pg; + + start = ofs >> PAGE_SHIFT; + end = (ofs + size - 1) >> PAGE_SHIFT; + /* check page continuity */ + pg = sg->table[start].addr >> PAGE_SHIFT; + for (;;) { + start++; + if (start > end) + break; + pg++; + if ((sg->table[start].addr >> PAGE_SHIFT) != pg) + return (start << PAGE_SHIFT) - ofs; + } + /* ok, all on continuous pages */ + return size; +} + +static int snd_dma_sg_mmap(struct snd_dma_buffer *dmab, + struct vm_area_struct *area) +{ + if (dmab->dev.type == SNDRV_DMA_TYPE_DEV_WC_SG) + area->vm_page_prot = pgprot_writecombine(area->vm_page_prot); + return -ENOENT; /* continue with the default mmap handler */ +} + +const struct snd_malloc_ops snd_dma_sg_ops = { + .alloc = snd_dma_sg_alloc, + .free = snd_dma_sg_free, + .get_addr = snd_dma_sg_get_addr, + .get_page = snd_dma_sg_get_page, + .get_chunk_size = snd_dma_sg_get_chunk_size, + .mmap = snd_dma_sg_mmap, +}; From dce9446192439eaac81c21f517325fb473735e53 Mon Sep 17 00:00:00 2001 From: Takashi Iwai Date: Fri, 5 Nov 2021 11:21:03 +0100 Subject: [PATCH 06/18] ALSA: memalloc: Catch call with NULL snd_dma_buffer pointer Although we've covered all calls with NULL dma buffer pointer, so far, there may be still some else in the wild. For catching such a case more easily, add a WARN_ON_ONCE() in snd_dma_get_ops(). Fixes: 37af81c5998f ("ALSA: core: Abstract memory alloc helpers") Link: https://lore.kernel.org/r/20211105102103.28148-1-tiwai@suse.de Signed-off-by: Takashi Iwai --- sound/core/memalloc.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/sound/core/memalloc.c b/sound/core/memalloc.c index ea778f868cf3..ea9698cea2e3 100644 --- a/sound/core/memalloc.c +++ b/sound/core/memalloc.c @@ -631,6 +631,8 @@ static const struct snd_malloc_ops *dma_ops[] = { static const struct snd_malloc_ops *snd_dma_get_ops(struct snd_dma_buffer *dmab) { + if (WARN_ON_ONCE(!dmab)) + return NULL; if (WARN_ON_ONCE(dmab->dev.type <= SNDRV_DMA_TYPE_UNKNOWN || dmab->dev.type >= ARRAY_SIZE(dma_ops))) return NULL; From ffdd98277f0a1d15a67a74ae09bee713df4c0dbc Mon Sep 17 00:00:00 2001 From: Takashi Iwai Date: Fri, 5 Nov 2021 10:15:17 +0100 Subject: [PATCH 07/18] ALSA: timer: Unconditionally unlink slave instances, too Like the previous fix (commit c0317c0e8709 "ALSA: timer: Fix use-after-free problem"), we have to unlink slave timer instances immediately at snd_timer_stop(), too. Otherwise it may leave a stale entry in the list if the slave instance is freed before actually running. Cc: Link: https://lore.kernel.org/r/20211105091517.21733-1-tiwai@suse.de Signed-off-by: Takashi Iwai --- sound/core/timer.c | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) diff --git a/sound/core/timer.c b/sound/core/timer.c index 4f9bab931951..b3214baa8919 100644 --- a/sound/core/timer.c +++ b/sound/core/timer.c @@ -665,23 +665,22 @@ static int snd_timer_stop1(struct snd_timer_instance *timeri, bool stop) static int snd_timer_stop_slave(struct snd_timer_instance *timeri, bool stop) { unsigned long flags; + bool running; spin_lock_irqsave(&slave_active_lock, flags); - if (!(timeri->flags & SNDRV_TIMER_IFLG_RUNNING)) { - spin_unlock_irqrestore(&slave_active_lock, flags); - return -EBUSY; - } + running = timeri->flags & SNDRV_TIMER_IFLG_RUNNING; timeri->flags &= ~SNDRV_TIMER_IFLG_RUNNING; if (timeri->timer) { spin_lock(&timeri->timer->lock); list_del_init(&timeri->ack_list); list_del_init(&timeri->active_list); - snd_timer_notify1(timeri, stop ? SNDRV_TIMER_EVENT_STOP : - SNDRV_TIMER_EVENT_PAUSE); + if (running) + snd_timer_notify1(timeri, stop ? SNDRV_TIMER_EVENT_STOP : + SNDRV_TIMER_EVENT_PAUSE); spin_unlock(&timeri->timer->lock); } spin_unlock_irqrestore(&slave_active_lock, flags); - return 0; + return running ? 0 : -EBUSY; } /* From 4fad4fb9871b43389e4f4bead18ec693064697bb Mon Sep 17 00:00:00 2001 From: Takashi Iwai Date: Sun, 7 Nov 2021 09:33:39 +0100 Subject: [PATCH 08/18] ALSA: hda/realtek: Add quirk for ASUS UX550VE ASUS UX550VE (SSID 1043:1970) requires a similar workaround for managing the routing of the 4 speakers like some other ASUS models. Add a corresponding quirk entry for fixing it. BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=212641 Cc: Link: https://lore.kernel.org/r/20211107083339.18013-1-tiwai@suse.de Signed-off-by: Takashi Iwai --- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+) diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c index 3601749f2df6..a6098c942aeb 100644 --- a/sound/pci/hda/patch_realtek.c +++ b/sound/pci/hda/patch_realtek.c @@ -8698,6 +8698,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { SND_PCI_QUIRK(0x1043, 0x18b1, "Asus MJ401TA", ALC256_FIXUP_ASUS_HEADSET_MIC), SND_PCI_QUIRK(0x1043, 0x18f1, "Asus FX505DT", ALC256_FIXUP_ASUS_HEADSET_MIC), SND_PCI_QUIRK(0x1043, 0x194e, "ASUS UX563FD", ALC294_FIXUP_ASUS_HPE), + SND_PCI_QUIRK(0x1043, 0x1970, "ASUS UX550VE", ALC289_FIXUP_ASUS_GA401), SND_PCI_QUIRK(0x1043, 0x1982, "ASUS B1400CEPE", ALC256_FIXUP_ASUS_HPE), SND_PCI_QUIRK(0x1043, 0x19ce, "ASUS B9450FA", ALC294_FIXUP_ASUS_HPE), SND_PCI_QUIRK(0x1043, 0x19e1, "ASUS UX581LV", ALC295_FIXUP_ASUS_MIC_NO_PRESENCE), From 8e537d5dec34cac746dd6abf6a83e5de3aa471fc Mon Sep 17 00:00:00 2001 From: Takashi Iwai Date: Sun, 7 Nov 2021 17:39:11 +0100 Subject: [PATCH 09/18] ALSA: PCM: Fix NULL dereference at mmap checks The recent refactoring of mmap handling caused Oops on some devices that don't use the standard memory allocations. This patch addresses it by allowing snd_dma_buffer_mmap() helper to receive the NULL pointer dmab argument (and return an error appropriately). Fixes: a202bd1ad86d ("ALSA: core: Move mmap handler into memalloc ops") Cc: Link: https://lore.kernel.org/r/20211107163911.13534-1-tiwai@suse.de Signed-off-by: Takashi Iwai --- sound/core/memalloc.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/sound/core/memalloc.c b/sound/core/memalloc.c index ea9698cea2e3..ad4a76b47b92 100644 --- a/sound/core/memalloc.c +++ b/sound/core/memalloc.c @@ -183,8 +183,11 @@ EXPORT_SYMBOL_GPL(snd_devm_alloc_dir_pages); int snd_dma_buffer_mmap(struct snd_dma_buffer *dmab, struct vm_area_struct *area) { - const struct snd_malloc_ops *ops = snd_dma_get_ops(dmab); + const struct snd_malloc_ops *ops; + if (!dmab) + return -ENOENT; + ops = snd_dma_get_ops(dmab); if (ops && ops->mmap) return ops->mmap(dmab, area); else From 411ac2982cb6748e2919893b1c80331d861784a8 Mon Sep 17 00:00:00 2001 From: Takashi Sakamoto Date: Sun, 7 Nov 2021 20:06:44 +0900 Subject: [PATCH 10/18] ALSA: firewire-motu: add support for MOTU Track 16 Mark of the Unicorn designed Track 16 2011 as one of models in third generation of its FireWire series. The model is already discontinued. It consists of below ICs: * Texas Instruments TSB41AB1 * Microchip (SMSC) USB3300 * Xilinx Spartan-3A FPGA, XC3S700A * Texas Instruments TMS320C6722 * Microchip (Atmel) AT91SAM SAM7S512 It supports sampling transfer frequency up to 192.0 kHz. The packet format differs depending on both of current sampling transfer frequency and the type of signal in optical interfaces. The model supports transmission of PCM frames as well as MIDI messages. The model supports command mechanism to configure internal DSP. Hardware meter information is available in the first 2 chunks of each data block of tx packet. This commit adds support for it. $ cd linux-firewire-tools/src $ python crpp < /sys/bus/firewire/devices/fw1/config_rom ROM header and bus information block ----------------------------------------------------------------- 400 04107d95 bus_info_length 4, crc_length 16, crc 32149 404 31333934 bus_name "1394" 408 20ff7000 irmc 0, cmc 0, isc 1, bmc 0, cyc_clk_acc 255, max_rec 7 (256) 40c 0001f200 company_id 0001f2 | 410 000a83c4 device_id 00000a83c4 | EUI-64 0001f200000a83c4 root directory ----------------------------------------------------------------- 414 0004ef04 directory_length 4, crc 61188 418 030001f2 vendor 41c 0c0083c0 node capabilities per IEEE 1394 420 d1000002 --> unit directory at 428 424 8d000005 --> eui-64 leaf at 438 unit directory at 428 ----------------------------------------------------------------- 428 00035b04 directory_length 3, crc 23300 42c 120001f2 specifier id 430 13000039 version 434 17102800 model eui-64 leaf at 438 ----------------------------------------------------------------- 438 0002b25f leaf_length 2, crc 45663 43c 0001f200 company_id 0001f2 | 440 000a83c4 device_id 00000a83c4 | EUI-64 0001f200000a83c4 Signed-off-by: Takashi Sakamoto Link: https://lore.kernel.org/r/20211107110644.23511-1-o-takashi@sakamocchi.jp Signed-off-by: Takashi Iwai --- sound/firewire/Kconfig | 3 +++ sound/firewire/motu/motu-protocol-v3.c | 17 ++++++++++++++--- sound/firewire/motu/motu.c | 1 + sound/firewire/motu/motu.h | 1 + 4 files changed, 19 insertions(+), 3 deletions(-) diff --git a/sound/firewire/Kconfig b/sound/firewire/Kconfig index fd109bea4c53..22b6c779682a 100644 --- a/sound/firewire/Kconfig +++ b/sound/firewire/Kconfig @@ -169,6 +169,7 @@ config SND_FIREWIRE_MOTU * 828 * 896 * 828mk2 + * 896hd * Traveler * Ultralite * 8pre @@ -176,7 +177,9 @@ config SND_FIREWIRE_MOTU * 828mk3 (Hybrid) * Ultralite mk3 (FireWire only) * Ultralite mk3 (Hybrid) + * Traveler mk3 * Audio Express + * Track 16 * 4pre To compile this driver as a module, choose M here: the module diff --git a/sound/firewire/motu/motu-protocol-v3.c b/sound/firewire/motu/motu-protocol-v3.c index 1371f38505d0..8a0426920a76 100644 --- a/sound/firewire/motu/motu-protocol-v3.c +++ b/sound/firewire/motu/motu-protocol-v3.c @@ -189,7 +189,7 @@ int snd_motu_protocol_v3_switch_fetching_mode(struct snd_motu *motu, sizeof(reg)); } -static int detect_packet_formats_dual_opt_iface(struct snd_motu *motu, u32 data) +static int detect_packet_formats_with_opt_ifaces(struct snd_motu *motu, u32 data) { if (data & V3_ENABLE_OPT_IN_IFACE_A) { if (data & V3_NO_ADAT_OPT_IN_IFACE_A) { @@ -261,8 +261,9 @@ int snd_motu_protocol_v3_cache_packet_formats(struct snd_motu *motu) if (motu->spec == &snd_motu_spec_828mk3_fw || motu->spec == &snd_motu_spec_828mk3_hybrid || - motu->spec == &snd_motu_spec_traveler_mk3) - return detect_packet_formats_dual_opt_iface(motu, data); + motu->spec == &snd_motu_spec_traveler_mk3 || + motu->spec == &snd_motu_spec_track16) + return detect_packet_formats_with_opt_ifaces(motu, data); else return 0; } @@ -317,6 +318,16 @@ const struct snd_motu_spec snd_motu_spec_audio_express = { .rx_fixed_pcm_chunks = {10, 10, 0}, }; +const struct snd_motu_spec snd_motu_spec_track16 = { + .name = "Track16", + .protocol_version = SND_MOTU_PROTOCOL_V3, + .flags = SND_MOTU_SPEC_RX_MIDI_3RD_Q | + SND_MOTU_SPEC_TX_MIDI_3RD_Q | + SND_MOTU_SPEC_COMMAND_DSP, + .tx_fixed_pcm_chunks = {14, 14, 14}, + .rx_fixed_pcm_chunks = {6, 6, 6}, +}; + const struct snd_motu_spec snd_motu_spec_4pre = { .name = "4pre", .protocol_version = SND_MOTU_PROTOCOL_V3, diff --git a/sound/firewire/motu/motu.c b/sound/firewire/motu/motu.c index 080728dd278f..f8b7fe38751c 100644 --- a/sound/firewire/motu/motu.c +++ b/sound/firewire/motu/motu.c @@ -173,6 +173,7 @@ static const struct ieee1394_device_id motu_id_table[] = { SND_MOTU_DEV_ENTRY(0x000030, &snd_motu_spec_ultralite_mk3), // Hybrid. SND_MOTU_DEV_ENTRY(0x000035, &snd_motu_spec_828mk3_hybrid), // Hybrid. SND_MOTU_DEV_ENTRY(0x000033, &snd_motu_spec_audio_express), + SND_MOTU_DEV_ENTRY(0x000039, &snd_motu_spec_track16), SND_MOTU_DEV_ENTRY(0x000045, &snd_motu_spec_4pre), { } }; diff --git a/sound/firewire/motu/motu.h b/sound/firewire/motu/motu.h index 6ad1feab478b..4189f2192284 100644 --- a/sound/firewire/motu/motu.h +++ b/sound/firewire/motu/motu.h @@ -141,6 +141,7 @@ extern const struct snd_motu_spec snd_motu_spec_828mk3_hybrid; extern const struct snd_motu_spec snd_motu_spec_traveler_mk3; extern const struct snd_motu_spec snd_motu_spec_ultralite_mk3; extern const struct snd_motu_spec snd_motu_spec_audio_express; +extern const struct snd_motu_spec snd_motu_spec_track16; extern const struct snd_motu_spec snd_motu_spec_4pre; int amdtp_motu_init(struct amdtp_stream *s, struct fw_unit *unit, From 43d35ccc36dad52377dd349b2e3ea803b72c3906 Mon Sep 17 00:00:00 2001 From: Takashi Iwai Date: Mon, 8 Nov 2021 15:57:52 +0100 Subject: [PATCH 11/18] ALSA: pci: rme: Fix unaligned buffer addresses The recent fix for setting up the DMA buffer type on RME drivers tried to address the non-standard memory managements and changed the DMA buffer information to the standard snd_dma_buffer object that is allocated at the probe time. However, I overlooked that the RME drivers handle the buffer addresses based on 64k alignment, and the previous conversion broke that silently. This patch is an attempt to fix the regression. The snd_dma_buffer objects are copied to the original data with the correction to the aligned accesses, and those are passed to snd_pcm_set_runtime_buffer() helpers instead. The original snd_dma_buffer objects are managed by devres, hence they'll be released automagically. Fixes: 0899a7a23047 ("ALSA: pci: rme: Set up buffer type properly") Cc: Link: https://lore.kernel.org/r/20211108145752.30572-1-tiwai@suse.de Signed-off-by: Takashi Iwai --- sound/pci/rme9652/hdsp.c | 41 +++++++++++++++++++++---------------- sound/pci/rme9652/rme9652.c | 41 +++++++++++++++++++++---------------- 2 files changed, 46 insertions(+), 36 deletions(-) diff --git a/sound/pci/rme9652/hdsp.c b/sound/pci/rme9652/hdsp.c index 75aa2ea733a5..96c12dfb24cf 100644 --- a/sound/pci/rme9652/hdsp.c +++ b/sound/pci/rme9652/hdsp.c @@ -468,8 +468,11 @@ struct hdsp { unsigned char ss_out_channels; u32 io_loopback; /* output loopback channel states*/ - struct snd_dma_buffer *capture_dma_buf; - struct snd_dma_buffer *playback_dma_buf; + /* DMA buffers; those are copied instances from the original snd_dma_buf + * objects (which are managed via devres) for the address alignments + */ + struct snd_dma_buffer capture_dma_buf; + struct snd_dma_buffer playback_dma_buf; unsigned char *capture_buffer; /* suitably aligned address */ unsigned char *playback_buffer; /* suitably aligned address */ @@ -3764,30 +3767,32 @@ static void snd_hdsp_proc_init(struct hdsp *hdsp) static int snd_hdsp_initialize_memory(struct hdsp *hdsp) { - unsigned long pb_bus, cb_bus; + struct snd_dma_buffer *capture_dma, *playback_dma; - hdsp->capture_dma_buf = - snd_hammerfall_get_buffer(hdsp->pci, HDSP_DMA_AREA_BYTES); - hdsp->playback_dma_buf = - snd_hammerfall_get_buffer(hdsp->pci, HDSP_DMA_AREA_BYTES); - if (!hdsp->capture_dma_buf || !hdsp->playback_dma_buf) { + capture_dma = snd_hammerfall_get_buffer(hdsp->pci, HDSP_DMA_AREA_BYTES); + playback_dma = snd_hammerfall_get_buffer(hdsp->pci, HDSP_DMA_AREA_BYTES); + if (!capture_dma || !playback_dma) { dev_err(hdsp->card->dev, "%s: no buffers available\n", hdsp->card_name); return -ENOMEM; } - /* Align to bus-space 64K boundary */ + /* copy to the own data for alignment */ + hdsp->capture_dma_buf = *capture_dma; + hdsp->playback_dma_buf = *playback_dma; - cb_bus = ALIGN(hdsp->capture_dma_buf->addr, 0x10000ul); - pb_bus = ALIGN(hdsp->playback_dma_buf->addr, 0x10000ul); + /* Align to bus-space 64K boundary */ + hdsp->capture_dma_buf.addr = ALIGN(capture_dma->addr, 0x10000ul); + hdsp->playback_dma_buf.addr = ALIGN(playback_dma->addr, 0x10000ul); /* Tell the card where it is */ + hdsp_write(hdsp, HDSP_inputBufferAddress, hdsp->capture_dma_buf.addr); + hdsp_write(hdsp, HDSP_outputBufferAddress, hdsp->playback_dma_buf.addr); - hdsp_write(hdsp, HDSP_inputBufferAddress, cb_bus); - hdsp_write(hdsp, HDSP_outputBufferAddress, pb_bus); - - hdsp->capture_buffer = hdsp->capture_dma_buf->area + (cb_bus - hdsp->capture_dma_buf->addr); - hdsp->playback_buffer = hdsp->playback_dma_buf->area + (pb_bus - hdsp->playback_dma_buf->addr); + hdsp->capture_dma_buf.area += hdsp->capture_dma_buf.addr - capture_dma->addr; + hdsp->playback_dma_buf.area += hdsp->playback_dma_buf.addr - playback_dma->addr; + hdsp->capture_buffer = hdsp->capture_dma_buf.area; + hdsp->playback_buffer = hdsp->playback_dma_buf.area; return 0; } @@ -4507,7 +4512,7 @@ static int snd_hdsp_playback_open(struct snd_pcm_substream *substream) snd_pcm_set_sync(substream); runtime->hw = snd_hdsp_playback_subinfo; - snd_pcm_set_runtime_buffer(substream, hdsp->playback_dma_buf); + snd_pcm_set_runtime_buffer(substream, &hdsp->playback_dma_buf); hdsp->playback_pid = current->pid; hdsp->playback_substream = substream; @@ -4583,7 +4588,7 @@ static int snd_hdsp_capture_open(struct snd_pcm_substream *substream) snd_pcm_set_sync(substream); runtime->hw = snd_hdsp_capture_subinfo; - snd_pcm_set_runtime_buffer(substream, hdsp->capture_dma_buf); + snd_pcm_set_runtime_buffer(substream, &hdsp->capture_dma_buf); hdsp->capture_pid = current->pid; hdsp->capture_substream = substream; diff --git a/sound/pci/rme9652/rme9652.c b/sound/pci/rme9652/rme9652.c index e76f737ac9e8..7755e19aa776 100644 --- a/sound/pci/rme9652/rme9652.c +++ b/sound/pci/rme9652/rme9652.c @@ -208,8 +208,11 @@ struct snd_rme9652 { unsigned char ds_channels; unsigned char ss_channels; /* different for hammerfall/hammerfall-light */ - struct snd_dma_buffer *playback_dma_buf; - struct snd_dma_buffer *capture_dma_buf; + /* DMA buffers; those are copied instances from the original snd_dma_buf + * objects (which are managed via devres) for the address alignments + */ + struct snd_dma_buffer playback_dma_buf; + struct snd_dma_buffer capture_dma_buf; unsigned char *capture_buffer; /* suitably aligned address */ unsigned char *playback_buffer; /* suitably aligned address */ @@ -1719,30 +1722,32 @@ static void snd_rme9652_card_free(struct snd_card *card) static int snd_rme9652_initialize_memory(struct snd_rme9652 *rme9652) { - unsigned long pb_bus, cb_bus; + struct snd_dma_buffer *capture_dma, *playback_dma; - rme9652->capture_dma_buf = - snd_hammerfall_get_buffer(rme9652->pci, RME9652_DMA_AREA_BYTES); - rme9652->playback_dma_buf = - snd_hammerfall_get_buffer(rme9652->pci, RME9652_DMA_AREA_BYTES); - if (!rme9652->capture_dma_buf || !rme9652->playback_dma_buf) { + capture_dma = snd_hammerfall_get_buffer(rme9652->pci, RME9652_DMA_AREA_BYTES); + playback_dma = snd_hammerfall_get_buffer(rme9652->pci, RME9652_DMA_AREA_BYTES); + if (!capture_dma || !playback_dma) { dev_err(rme9652->card->dev, "%s: no buffers available\n", rme9652->card_name); return -ENOMEM; } - /* Align to bus-space 64K boundary */ + /* copy to the own data for alignment */ + rme9652->capture_dma_buf = *capture_dma; + rme9652->playback_dma_buf = *playback_dma; - cb_bus = ALIGN(rme9652->capture_dma_buf->addr, 0x10000ul); - pb_bus = ALIGN(rme9652->playback_dma_buf->addr, 0x10000ul); + /* Align to bus-space 64K boundary */ + rme9652->capture_dma_buf.addr = ALIGN(capture_dma->addr, 0x10000ul); + rme9652->playback_dma_buf.addr = ALIGN(playback_dma->addr, 0x10000ul); /* Tell the card where it is */ + rme9652_write(rme9652, RME9652_rec_buffer, rme9652->capture_dma_buf.addr); + rme9652_write(rme9652, RME9652_play_buffer, rme9652->playback_dma_buf.addr); - rme9652_write(rme9652, RME9652_rec_buffer, cb_bus); - rme9652_write(rme9652, RME9652_play_buffer, pb_bus); - - rme9652->capture_buffer = rme9652->capture_dma_buf->area + (cb_bus - rme9652->capture_dma_buf->addr); - rme9652->playback_buffer = rme9652->playback_dma_buf->area + (pb_bus - rme9652->playback_dma_buf->addr); + rme9652->capture_dma_buf.area += rme9652->capture_dma_buf.addr - capture_dma->addr; + rme9652->playback_dma_buf.area += rme9652->playback_dma_buf.addr - playback_dma->addr; + rme9652->capture_buffer = rme9652->capture_dma_buf.area; + rme9652->playback_buffer = rme9652->playback_dma_buf.area; return 0; } @@ -2259,7 +2264,7 @@ static int snd_rme9652_playback_open(struct snd_pcm_substream *substream) snd_pcm_set_sync(substream); runtime->hw = snd_rme9652_playback_subinfo; - snd_pcm_set_runtime_buffer(substream, rme9652->playback_dma_buf); + snd_pcm_set_runtime_buffer(substream, &rme9652->playback_dma_buf); if (rme9652->capture_substream == NULL) { rme9652_stop(rme9652); @@ -2318,7 +2323,7 @@ static int snd_rme9652_capture_open(struct snd_pcm_substream *substream) snd_pcm_set_sync(substream); runtime->hw = snd_rme9652_capture_subinfo; - snd_pcm_set_runtime_buffer(substream, rme9652->capture_dma_buf); + snd_pcm_set_runtime_buffer(substream, &rme9652->capture_dma_buf); if (rme9652->playback_substream == NULL) { rme9652_stop(rme9652); From ad4f93ca41388f36ec40ec9c1d97b52177f25fa3 Mon Sep 17 00:00:00 2001 From: Takashi Iwai Date: Mon, 8 Nov 2021 16:10:59 +0100 Subject: [PATCH 12/18] ALSA: memalloc: Use proper SG helpers for noncontig allocations The recently introduced non-contiguous page allocation support helpers are using the simplified code to calculate the page and DMA address based on the vmalloc helpers, but this isn't quite right as the vmap is valid only for the direct DMA. This patch corrects those accessors to use the proper SG helpers instead. Fixes: a25684a95646 ("ALSA: memalloc: Support for non-contiguous page allocation") Tested-by: Alex Xu (Hello71) Link: https://lore.kernel.org/r/20211108151059.31898-1-tiwai@suse.de Signed-off-by: Takashi Iwai --- sound/core/memalloc.c | 64 +++++++++++++++++++++++++++++++++++++++++-- 1 file changed, 61 insertions(+), 3 deletions(-) diff --git a/sound/core/memalloc.c b/sound/core/memalloc.c index ad4a76b47b92..8c362bb5b81a 100644 --- a/sound/core/memalloc.c +++ b/sound/core/memalloc.c @@ -552,15 +552,73 @@ static void snd_dma_noncontig_sync(struct snd_dma_buffer *dmab, } } +static inline void snd_dma_noncontig_iter_set(struct snd_dma_buffer *dmab, + struct sg_page_iter *piter, + size_t offset) +{ + struct sg_table *sgt = dmab->private_data; + + __sg_page_iter_start(piter, sgt->sgl, sgt->orig_nents, + offset >> PAGE_SHIFT); +} + +static dma_addr_t snd_dma_noncontig_get_addr(struct snd_dma_buffer *dmab, + size_t offset) +{ + struct sg_dma_page_iter iter; + + snd_dma_noncontig_iter_set(dmab, &iter.base, offset); + __sg_page_iter_dma_next(&iter); + return sg_page_iter_dma_address(&iter) + offset % PAGE_SIZE; +} + +static struct page *snd_dma_noncontig_get_page(struct snd_dma_buffer *dmab, + size_t offset) +{ + struct sg_page_iter iter; + + snd_dma_noncontig_iter_set(dmab, &iter, offset); + __sg_page_iter_next(&iter); + return sg_page_iter_page(&iter); +} + +static unsigned int +snd_dma_noncontig_get_chunk_size(struct snd_dma_buffer *dmab, + unsigned int ofs, unsigned int size) +{ + struct sg_dma_page_iter iter; + unsigned int start, end; + unsigned long addr; + + start = ALIGN_DOWN(ofs, PAGE_SIZE); + end = ofs + size - 1; /* the last byte address */ + snd_dma_noncontig_iter_set(dmab, &iter.base, start); + if (!__sg_page_iter_dma_next(&iter)) + return 0; + /* check page continuity */ + addr = sg_page_iter_dma_address(&iter); + for (;;) { + start += PAGE_SIZE; + if (start > end) + break; + addr += PAGE_SIZE; + if (!__sg_page_iter_dma_next(&iter) || + sg_page_iter_dma_address(&iter) != addr) + return start - ofs; + } + /* ok, all on continuous pages */ + return size; +} + static const struct snd_malloc_ops snd_dma_noncontig_ops = { .alloc = snd_dma_noncontig_alloc, .free = snd_dma_noncontig_free, .mmap = snd_dma_noncontig_mmap, .sync = snd_dma_noncontig_sync, /* re-use vmalloc helpers for get_* ops */ - .get_addr = snd_dma_vmalloc_get_addr, - .get_page = snd_dma_vmalloc_get_page, - .get_chunk_size = snd_dma_vmalloc_get_chunk_size, + .get_addr = snd_dma_noncontig_get_addr, + .get_page = snd_dma_noncontig_get_page, + .get_chunk_size = snd_dma_noncontig_get_chunk_size, }; /* From d159037abbe3412285c271bdfb9cdf19e62678ff Mon Sep 17 00:00:00 2001 From: Austin Kim Date: Tue, 9 Nov 2021 00:37:42 +0000 Subject: [PATCH 13/18] ALSA: synth: missing check for possible NULL after the call to kstrdup If kcalloc() return NULL due to memory starvation, it is possible for kstrdup() to return NULL in similar case. So add null check after the call to kstrdup() is made. [ minor coding-style fix by tiwai ] Signed-off-by: Austin Kim Cc: Link: https://lore.kernel.org/r/20211109003742.GA5423@raspberrypi Signed-off-by: Takashi Iwai --- sound/synth/emux/emux.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sound/synth/emux/emux.c b/sound/synth/emux/emux.c index 49d1976a132c..5ed8e36d2e04 100644 --- a/sound/synth/emux/emux.c +++ b/sound/synth/emux/emux.c @@ -88,7 +88,7 @@ int snd_emux_register(struct snd_emux *emu, struct snd_card *card, int index, ch emu->name = kstrdup(name, GFP_KERNEL); emu->voices = kcalloc(emu->max_voices, sizeof(struct snd_emux_voice), GFP_KERNEL); - if (emu->voices == NULL) + if (emu->name == NULL || emu->voices == NULL) return -ENOMEM; /* create soundfont list */ From 4ddac46031c1b341f2d3466243ac280f589ca41b Mon Sep 17 00:00:00 2001 From: Takashi Iwai Date: Wed, 10 Nov 2021 07:31:00 +0100 Subject: [PATCH 14/18] ALSA: memalloc: Remove a stale comment The comment about the reused vmalloc helpers is no longer valid after the recent change for the noncontig allocator. Drop the stale comment. Fixes: ad4f93ca4138 ("ALSA: memalloc: Use proper SG helpers for noncontig allocations") Link: https://lore.kernel.org/r/20211110063100.21359-1-tiwai@suse.de Signed-off-by: Takashi Iwai --- sound/core/memalloc.c | 1 - 1 file changed, 1 deletion(-) diff --git a/sound/core/memalloc.c b/sound/core/memalloc.c index 8c362bb5b81a..9fc971a704a9 100644 --- a/sound/core/memalloc.c +++ b/sound/core/memalloc.c @@ -615,7 +615,6 @@ static const struct snd_malloc_ops snd_dma_noncontig_ops = { .free = snd_dma_noncontig_free, .mmap = snd_dma_noncontig_mmap, .sync = snd_dma_noncontig_sync, - /* re-use vmalloc helpers for get_* ops */ .get_addr = snd_dma_noncontig_get_addr, .get_page = snd_dma_noncontig_get_page, .get_chunk_size = snd_dma_noncontig_get_chunk_size, From c058493df7edcef8f48c1494d9a84218519f966b Mon Sep 17 00:00:00 2001 From: Kai-Heng Feng Date: Wed, 10 Nov 2021 22:40:32 +0800 Subject: [PATCH 15/18] ALSA: hda/realtek: Add quirk for HP EliteBook 840 G7 mute LED The mute and micmute LEDs don't work on HP EliteBook 840 G7. The same quirk for other HP laptops can let LEDs work, so apply it. Signed-off-by: Kai-Heng Feng Cc: Link: https://lore.kernel.org/r/20211110144033.118451-1-kai.heng.feng@canonical.com Signed-off-by: Takashi Iwai --- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+) diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c index a6098c942aeb..2f1727faec69 100644 --- a/sound/pci/hda/patch_realtek.c +++ b/sound/pci/hda/patch_realtek.c @@ -8636,6 +8636,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { SND_PCI_QUIRK(0x103c, 0x8716, "HP Elite Dragonfly G2 Notebook PC", ALC285_FIXUP_HP_GPIO_AMP_INIT), SND_PCI_QUIRK(0x103c, 0x8720, "HP EliteBook x360 1040 G8 Notebook PC", ALC285_FIXUP_HP_GPIO_AMP_INIT), SND_PCI_QUIRK(0x103c, 0x8724, "HP EliteBook 850 G7", ALC285_FIXUP_HP_GPIO_LED), + SND_PCI_QUIRK(0x103c, 0x8728, "HP EliteBook 840 G7", ALC285_FIXUP_HP_GPIO_LED), SND_PCI_QUIRK(0x103c, 0x8729, "HP", ALC285_FIXUP_HP_GPIO_LED), SND_PCI_QUIRK(0x103c, 0x8730, "HP ProBook 445 G7", ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF), SND_PCI_QUIRK(0x103c, 0x8736, "HP", ALC285_FIXUP_HP_GPIO_AMP_INIT), From 39173303c83859723dab32c2abfb97296d6af3bf Mon Sep 17 00:00:00 2001 From: Takashi Iwai Date: Wed, 10 Nov 2021 20:46:33 +0100 Subject: [PATCH 16/18] ALSA: hda: Free card instance properly at probe errors The recent change in hda-intel driver to allow repeated probes surfaced a problem that has been hidden until; the probe process in the work calls azx_free() at the error path, and this skips the card free process that eventually releases codec instances. As a result, we get a kernel WARNING like: snd_hda_intel 0000:00:1f.3: Cannot probe codecs, giving up ------------[ cut here ]------------ WARNING: CPU: 14 PID: 186 at sound/hda/hdac_bus.c:73 .... For fixing this, we need to call snd_card_free() instead of azx_free(). Additionally, the device drvdata has to be cleared, as the driver binding itself is still active. Then the PM and other driver callbacks will ignore the procedure. Fixes: c0f1886de7e1 ("ALSA: hda: intel: Allow repeatedly probing on codec configuration errors") Reported-and-tested-by: Scott Branden Cc: Link: https://lore.kernel.org/r/063e2397-7edb-5f48-7b0d-618b938d9dd8@broadcom.com Link: https://lore.kernel.org/r/20211110194633.19098-1-tiwai@suse.de Signed-off-by: Takashi Iwai --- sound/pci/hda/hda_intel.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c index 7762718cf429..90e9263ac0bd 100644 --- a/sound/pci/hda/hda_intel.c +++ b/sound/pci/hda/hda_intel.c @@ -2327,7 +2327,8 @@ static int azx_probe_continue(struct azx *chip) out_free: if (err < 0) { - azx_free(chip); + pci_set_drvdata(pci, NULL); + snd_card_free(chip->card); return err; } From e81478bbe7a1a062eeb5cd97cf00152a13ab8652 Mon Sep 17 00:00:00 2001 From: Kai Vehmanen Date: Wed, 10 Nov 2021 23:03:07 +0200 Subject: [PATCH 17/18] ALSA: hda: fix general protection fault in azx_runtime_idle Fix a corner case between PCI device driver remove callback and runtime PM idle callback. Following sequence of events can happen: - at azx_create, context is allocated with devm_kzalloc() and stored as pci_set_drvdata() - user-space requests to unbind audio driver - dd.c:__device_release_driver() calls PCI remove - pci-driver.c:pci_device_remove() calls the audio driver azx_remove() callback and this is completed - pci-driver.c:pm_runtime_put_sync() leads to a call to rpm_idle() which again calls azx_runtime_idle() - the azx context object, as returned by dev_get_drvdata(), is no longer valid -> access fault in azx_runtime_idle when executing struct snd_card *card = dev_get_drvdata(dev); chip = card->private_data; if (chip->disabled || hda->init_failed) This was discovered by i915_module_load test with 5.15.0 based linux-next tree. Example log caught by i915_module_load test with linux-next https://intel-gfx-ci.01.org/tree/linux-next/ <4> [264.038232] general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b73f0: 0000 [#1] PREEMPT SMP NOPTI <4> [264.038248] CPU: 0 PID: 5374 Comm: i915_module_loa Not tainted 5.15.0-next-20211109-gc8109c2ba35e-next-20211109 #1 [...] <4> [264.038267] RIP: 0010:azx_runtime_idle+0x12/0x60 [snd_hda_intel] [...] <4> [264.038355] Call Trace: <4> [264.038359] <4> [264.038362] __rpm_callback+0x3d/0x110 <4> [264.038371] rpm_idle+0x27f/0x380 <4> [264.038376] __pm_runtime_idle+0x3b/0x100 <4> [264.038382] pci_device_remove+0x6d/0xa0 <4> [264.038388] device_release_driver_internal+0xef/0x1e0 <4> [264.038395] unbind_store+0xeb/0x120 <4> [264.038400] kernfs_fop_write_iter+0x11a/0x1c0 Fix the issue by setting drvdata to NULL at end of azx_remove(). Signed-off-by: Kai Vehmanen Link: https://lore.kernel.org/r/20211110210307.1172004-1-kai.vehmanen@linux.intel.com Signed-off-by: Takashi Iwai --- sound/pci/hda/hda_intel.c | 1 + 1 file changed, 1 insertion(+) diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c index 90e9263ac0bd..fe51163f2d82 100644 --- a/sound/pci/hda/hda_intel.c +++ b/sound/pci/hda/hda_intel.c @@ -2365,6 +2365,7 @@ static void azx_remove(struct pci_dev *pci) cancel_delayed_work_sync(&hda->probe_work); device_lock(&pci->dev); + pci_set_drvdata(pci, NULL); snd_card_free(card); } } From 0ca37273ee0a0b0dc0ef039421fbd16329ee2870 Mon Sep 17 00:00:00 2001 From: Takashi Sakamoto Date: Thu, 11 Nov 2021 19:30:15 +0900 Subject: [PATCH 18/18] ALSA: fireworks: add support for Loud Onyx 1200f quirk Loud Technologies shipped Onyx 1200f 2008 in its Mackie brand and already discontinued. The model uses component of Fireworks board module as its communication and DSP function. The latest firmware (v4.6.0) has a quirk that tx packet includes wrong value (0x1f) in its dbs field at middle and higher sampling transfer frequency. It brings ALSA fireworks driver discontinuity of data block counter. This commit fixes it by assuming it as a quirk of firmware version 4.6.0. $ cd linux-firewire-tools/src $ python crpp < /sys/bus/firewire/devices/fw1/config_rom ROM header and bus information block ----------------------------------------------------------------- 400 0404b9ef bus_info_length 4, crc_length 4, crc 47599 404 31333934 bus_name "1394" 408 e064a212 irmc 1, cmc 1, isc 1, bmc 0, pmc 0, cyc_clk_acc 100, max_rec 10 (2048), max_rom 2, gen 1, spd 2 (S400) 40c 000ff209 company_id 000ff2 | 410 62550ce0 device_id 0962550ce0 | EUI-64 000ff20962550ce0 root directory ----------------------------------------------------------------- 414 0008088e directory_length 8, crc 2190 418 03000ff2 vendor 41c 8100000f --> descriptor leaf at 458 420 1701200f model 424 81000018 --> descriptor leaf at 484 428 0c008380 node capabilities 42c 8d000003 --> eui-64 leaf at 438 430 d1000005 --> unit directory at 444 434 08000ff2 (immediate value) eui-64 leaf at 438 ----------------------------------------------------------------- 438 000281ae leaf_length 2, crc 33198 43c 000ff209 company_id 000ff2 | 440 62550ce0 device_id 0962550ce0 | EUI-64 000ff20962550ce0 unit directory at 444 ----------------------------------------------------------------- 444 00045d94 directory_length 4, crc 23956 448 1200a02d specifier id: 1394 TA 44c 13010000 version 450 1701200f model 454 8100000c --> descriptor leaf at 484 descriptor leaf at 458 ----------------------------------------------------------------- 458 000a199d leaf_length 10, crc 6557 45c 00000000 textual descriptor 460 00000000 minimal ASCII 464 4d61636b "Mack" 468 69650000 "ie" 46c 00000000 470 00000000 474 00000000 478 00000000 47c 00000000 480 00000000 descriptor leaf at 484 ----------------------------------------------------------------- 484 000a0964 leaf_length 10, crc 2404 488 00000000 textual descriptor 48c 00000000 minimal ASCII 490 4f6e7978 "Onyx" 494 20313230 " 120" 498 30460000 "0F" 49c 00000000 4a0 00000000 4a4 00000000 4a8 00000000 4ac 00000000 Signed-off-by: Takashi Sakamoto Link: https://lore.kernel.org/r/20211111103015.7498-1-o-takashi@sakamocchi.jp Signed-off-by: Takashi Iwai --- sound/firewire/fireworks/fireworks_stream.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/sound/firewire/fireworks/fireworks_stream.c b/sound/firewire/fireworks/fireworks_stream.c index ac66f08acd6b..53dbd4d4b0d0 100644 --- a/sound/firewire/fireworks/fireworks_stream.c +++ b/sound/firewire/fireworks/fireworks_stream.c @@ -50,8 +50,9 @@ static int init_stream(struct snd_efw *efw, struct amdtp_stream *stream) efw->firmware_version == 0x5070300 || efw->firmware_version == 0x5080000)) efw->tx_stream.flags |= CIP_UNALIGHED_DBC; - // AudioFire9 always reports wrong dbs. - if (efw->is_af9) + // AudioFire9 always reports wrong dbs. Onyx 1200F with the latest firmware (v4.6.0) + // also report wrong dbs at 88.2 kHz or greater. + if (efw->is_af9 || efw->firmware_version == 0x4060000) efw->tx_stream.flags |= CIP_WRONG_DBS; // Firmware version 5.5 reports fixed interval for dbc. if (efw->firmware_version == 0x5050000)