When the cml_rt1011_rt5682_dailink[].codecs pointer is overridden by
a quirk with a devm allocated structure and the probe is deferred,
in the next probe we will see an use-after-free condition
(verified with KASAN). This can be avoided by using statically allocated
configurations - which simplifies the code quite a bit as well.
KASAN issue fixed.
[ 23.301373] cml_rt1011_rt5682 cml_rt1011_rt5682: sof_rt1011_quirk = f
[ 23.301875] ==================================================================
[ 23.302018] BUG: KASAN: use-after-free in snd_cml_rt1011_probe+0x23a/0x3d0 [snd_soc_cml_rt1011_rt5682]
[ 23.302178] Read of size 8 at addr ffff8881ec6acae0 by task kworker/0:2/105
[ 23.302320] CPU: 0 PID: 105 Comm: kworker/0:2 Not tainted 5.7.0-rc7-test+ #3
[ 23.302322] Hardware name: Google Helios/Helios, BIOS 01/21/2020
[ 23.302329] Workqueue: events deferred_probe_work_func
[ 23.302331] Call Trace:
[ 23.302339] dump_stack+0x76/0xa0
[ 23.302345] print_address_description.constprop.0.cold+0xd3/0x43e
[ 23.302351] ? _raw_spin_lock_irqsave+0x7b/0xd0
[ 23.302355] ? _raw_spin_trylock_bh+0xf0/0xf0
[ 23.302362] ? snd_cml_rt1011_probe+0x23a/0x3d0 [snd_soc_cml_rt1011_rt5682]
[ 23.302365] __kasan_report.cold+0x37/0x86
[ 23.302371] ? snd_cml_rt1011_probe+0x23a/0x3d0 [snd_soc_cml_rt1011_rt5682]
[ 23.302375] kasan_report+0x38/0x50
[ 23.302382] snd_cml_rt1011_probe+0x23a/0x3d0 [snd_soc_cml_rt1011_rt5682]
[ 23.302389] platform_drv_probe+0x66/0xc0
Fixes: 629ba12e99 ("ASoC: Intel: boards: split woofer and tweeter support")
Suggested-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
Signed-off-by: Fred Oh <fred.oh@linux.intel.com>
Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
Link: https://lore.kernel.org/r/20200625191308.3322-12-pierre-louis.bossart@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Speaker amplifier feedback is not modeled as being dependent on any
active output. Even when there is no playback happening, parts of the
graph, specifically the IV sense->speaker protection->output remains
active and this prevents the DSP from entering low-power states.
This patch suggests a machine driver level approach where the speaker
pins are enabled/disabled dynamically depending on stream start/stop
events. DPAM graph representations show the feedback loop is indeed
disabled and low-power states can be reached.
Signed-off-by: Dharageswari R <dharageswari.r@intel.com>
Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Reviewed-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
Link: https://lore.kernel.org/r/20200625191308.3322-8-pierre-louis.bossart@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
During the bring-up of new platforms, or to take care of specific
hardware reworks, it's useful to add a kernel parameter to override
the default DMI-based quirks.
For example, adding the following line in a .conf file in
/etc/modprobe.d/ will change the default quirk and log the changes if
dynamic debug is enabled.
options snd_soc_sof_sdw quirk=0x802
[ 735.025785] sof_sdw sof_sdw: Overriding quirk 0x10 => 0x802
[ 735.025787] sof_sdw sof_sdw: quirk realtek,jack-detect-source 2
[ 735.025790] sof_sdw sof_sdw: quirk SOF_RT715_DAI_ID_FIX enabled
Tested on ICL RVP with add-on board instead of default codec.
Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
Reviewed-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
Link: https://lore.kernel.org/r/20200625191308.3322-6-pierre-louis.bossart@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
While looking at reboot issues and module load/unload tests, I found
out some resources allocated in the dailink .init() callback are not
properly released - there is no existing mechanism in the soc-core to
do so.
The addition of a dailink .exit() callback seems to be the simplest
solution overall. It can be argued that the existing machine platform
device .remove() callback can also perform the necessary cleanups,
however as shown in the last two examples this might require a loop to
identify components whereas the dailink .exit() already has all the
necessary information to revert the actions done in the .init() step.
Changes since RFC:
Better commit messages and explanations
rt5682 cases with snd_soc_component_set_jack() called in the .exit()
Fred Oh (2):
ASoC: intel: sof_rt5682: move disabling jack to dai link's exit()
ASoC: intel: cml_rt1011_rt5682: disable jack in dailink .exit()
Pierre-Louis Bossart (3):
ASoC: soc-link: introduce exit() callback
ASoC: Intel: bdw-rt5677: fix module load/unload issues
ASoC: Intel: kbl-rt5660: use .exit() dailink callback to release gpiod
include/sound/soc-link.h | 1 +
include/sound/soc.h | 3 +++
sound/soc/intel/boards/bdw-rt5677.c | 18 ++++++++++++++--
sound/soc/intel/boards/cml_rt1011_rt5682.c | 8 ++++++++
sound/soc/intel/boards/kbl_rt5660.c | 17 +++++++++++++--
sound/soc/intel/boards/sof_rt5682.c | 24 ++++++++--------------
sound/soc/soc-core.c | 3 +++
sound/soc/soc-link.c | 6 ++++++
8 files changed, 60 insertions(+), 20 deletions(-)
base-commit: 39853b1438
--
2.20.1
The mainline code currently prevents modules from being removed.
The BE dailink .init() function calls devm_gpiod_get() using the codec
component device as argument. When the machine driver is removed, the
references to the gpiod are not released, and it's not possible to
remove the codec driver module - which is the only entity which could
free the gpiod.
This conceptual deadlock can be avoided by invoking gpiod_get() in the
.init() callback, and calling gpiod_put() in the exit() callback.
Tested on SAMUS Chromebook with SOF driver.
Suggested-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Reviewed-by: Guennadi Liakhovetski <guennadi.liakhovetski@linux.intel.com>
Reviewed-by: Curtis Malainey <curtis@malainey.com>
Link: https://lore.kernel.org/r/20200622154241.29053-3-pierre-louis.bossart@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Some machine drivers allocate or request resources with
snd_soc_link_init() phase of the card probe. These resources need to
be properly released when removing a card, and this patch suggests a
dual exit() callback.
The exit() is invoked in soc_remove_pcm_runtime(), which is not
completely symmetric with the init() invoked in soc_init_pcm_runtime().
Alternate solutions were considered, e.g. adding a .remove() callback
for the platform driver, but that's not symmetrical at all and would
be difficult to handle if there are more than one dailink implementing
an .init(). We looked also into using .remove_dai_link() callback, but
that would also be imbalanced.
Note that because of the error handling in snd_soc_bind_card(), which
jumps to probe_end, there is no way to guarantee the exit() is invoked
with resources allocated in the init(). Prior to releasing those
resources, implementations of the exit() callback shall check the
resources are valid.
Suggested-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Reviewed-by: Guennadi Liakhovetski <guennadi.liakhovetski@linux.intel.com>
Reviewed-by: Curtis Malainey <curtis@malainey.com>
Link: https://lore.kernel.org/r/20200622154241.29053-2-pierre-louis.bossart@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
component has io_mutex, but it had been used at
snd_soc_component_update_bits_legacy() only which does read and write.
static int snd_soc_component_update_bits_legacy(...)
{
...
=> mutex_lock(&component->io_mutex);
...
old = snd_soc_component_read(...);
...
ret = snd_soc_component_write(...);
...
=> mutex_unlock(&component->io_mutex);
...
}
It is pointless if it is not used with both read and write functions.
This patch uses io_mutex correctly with read/write.
Here, xxx_no_lock() is local functions.
static int snd_soc_component_read(...)
{
...
=> mutex_lock(&component->io_mutex);
val = soc_component_read_no_lock(...);
=> mutex_unlock(&component->io_mutex);
...
}
static int snd_soc_component_write(...)
{
...
=> mutex_lock(&component->io_mutex);
ret = soc_component_write_no_lock(...);
=> mutex_unlock(&component->io_mutex);
...
}
static int snd_soc_component_update_bits_legacy(...)
{
...
=> mutex_lock(&component->io_mutex);
...
old = soc_component_read_no_lock(...);
...
ret = soc_component_write_no_lock(...);
...
=> mutex_unlock(&component->io_mutex);
...
}
Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Link: https://lore.kernel.org/r/87r1uf4mfa.wl-kuninori.morimoto.gx@renesas.com
Signed-off-by: Mark Brown <broonie@kernel.org>
We had read/write function for Codec, Platform, etc,
but these has been merged into snd_soc_component_read/write().
Internally, it is using regmap or driver function.
In read case, each styles are like below
regmap
ret = regmap_read(..., reg, &val);
driver function
val = xxx->read(..., reg);
Because of this kind of different style, to keep same read style,
when we merged each read function into snd_soc_component_read(),
we created snd_soc_component_read32(), like below.
commit 738b49efe6 ("ASoC: add snd_soc_component_read32")
(1) val = snd_soc_component_read32(component, reg);
(2) ret = snd_soc_component_read(component, reg, &val);
Many drivers are using snd_soc_component_read32(), and
some drivers are using snd_soc_component_read() today.
In generally, we don't check read function successes,
because, we will have many other issues at initial timing
if read function didn't work.
Now we can use soc_component_err() when error case.
This means, it is easy to notice if error occurred.
This patch aggressively merge snd_soc_component_read() and _read32(),
and makes snd_soc_component_read/write() as generally style.
This patch do
1) merge snd_soc_component_read() and snd_soc_component_read32()
2) it uses soc_component_err() when error case (easy to notice)
3) keeps read32 for now by #define
4) update snd_soc_component_read() for all drivers
Because _read() user drivers are not too many, this patch changes
all user drivers.
Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Reviewed-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
Link: https://lore.kernel.org/r/87sgev4mfl.wl-kuninori.morimoto.gx@renesas.com
Signed-off-by: Mark Brown <broonie@kernel.org>
