[ Upstream commit 7dd7f39fce0022b386ef1ea5ffef92ecc7dfc6af ]
hda_generic_machine_select() appends -idisp to the tplg filename by
allocating a new string with devm_kasprintf(), then stores the string
right back into the global variable snd_soc_acpi_intel_hda_machines.
When the module is unloaded, this memory is freed, resulting in a global
variable pointing to freed memory. Reloading the module then triggers
a use-after-free:
BUG: KFENCE: use-after-free read in string+0x48/0xe0
Use-after-free read at 0x00000000967e0109 (in kfence-#99):
string+0x48/0xe0
vsnprintf+0x329/0x6e0
devm_kvasprintf+0x54/0xb0
devm_kasprintf+0x58/0x80
hda_machine_select.cold+0x198/0x17a2 [snd_sof_intel_hda_generic]
sof_probe_work+0x7f/0x600 [snd_sof]
process_one_work+0x17b/0x330
worker_thread+0x2ce/0x3f0
kthread+0xcf/0x100
ret_from_fork+0x31/0x50
ret_from_fork_asm+0x1a/0x30
kfence-#99: 0x00000000198a940f-0x00000000ace47d9d, size=64, cache=kmalloc-64
allocated by task 333 on cpu 8 at 17.798069s (130.453553s ago):
devm_kmalloc+0x52/0x120
devm_kvasprintf+0x66/0xb0
devm_kasprintf+0x58/0x80
hda_machine_select.cold+0x198/0x17a2 [snd_sof_intel_hda_generic]
sof_probe_work+0x7f/0x600 [snd_sof]
process_one_work+0x17b/0x330
worker_thread+0x2ce/0x3f0
kthread+0xcf/0x100
ret_from_fork+0x31/0x50
ret_from_fork_asm+0x1a/0x30
freed by task 1543 on cpu 4 at 141.586686s (6.665010s ago):
release_nodes+0x43/0xb0
devres_release_all+0x90/0xf0
device_unbind_cleanup+0xe/0x70
device_release_driver_internal+0x1c1/0x200
driver_detach+0x48/0x90
bus_remove_driver+0x6d/0xf0
pci_unregister_driver+0x42/0xb0
__do_sys_delete_module+0x1d1/0x310
do_syscall_64+0x82/0x190
entry_SYSCALL_64_after_hwframe+0x76/0x7e
Fix it by copying the match array with devm_kmemdup_array() before we
modify it.
Fixes: 5458411d75 ("ASoC: SOF: Intel: hda: refactoring topology name fixup for HDA mach")
Suggested-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Acked-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Signed-off-by: Tavian Barnes <tavianator@tavianator.com>
Link: https://patch.msgid.link/570b15570b274520a0d9052f4e0f064a29c950ef.1747229716.git.tavianator@tavianator.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Add an new variable bt_link_mask to snd_soc_acpi_mach_params structure.
SSP port mask of BT offload found in NHLT table will be sent to
machine driver to setup BE dai link with correct SSP port number.
This patch only detects and enables the BT dailink. The functionality
will only be unlocked with a topology file that makes a reference to
that BT dailink. For backwards-compatibility reasons, this topology
will not be used by default. Chromebooks and Linux users willing to
experiment shall use the tplg_name kernel parameter to force the use
of an enhanced topology.
Signed-off-by: Brent Lu <brent.lu@intel.com>
Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Signed-off-by: Bard Liao <yung-chuan.liao@linux.intel.com>
Link: https://patch.msgid.link/20240827123215.258859-9-yung-chuan.liao@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Commit 8efcd48646 ("ASoC: Intel: sof_rt5682: use common module for
sof_card_private initialization") migrated the pin assignment in the
context struct up to soc-acpi-intel-ssp-common.c. This uses a lookup
table to see if a device has a amp/codec before assigning the pin. The
issue here arises when combination parts that serve both (with 2 ports)
are used.
sysfs: cannot create duplicate filename '/devices/pci0000:00/0000:00:1f.3/adl_rt5682_def/SSP0-Codec'
CPU: 1 PID: 2079 Comm: udevd Tainted: G U 6.6.36-03391-g744739e00023 #1 3be1a2880a0970f65545a957db7d08ef4b3e2c0d
Hardware name: Google Anraggar/Anraggar, BIOS Google_Anraggar.15217.552.0 05/07/2024
Call Trace:
<TASK>
dump_stack_lvl+0x69/0xa0
sysfs_warn_dup+0x5b/0x70
sysfs_create_dir_ns+0xb0/0x100
kobject_add_internal+0x133/0x3c0
kobject_add+0x66/0xb0
? device_add+0x65/0x780
device_add+0x164/0x780
snd_soc_add_pcm_runtimes+0x2fa/0x800
snd_soc_bind_card+0x35e/0xc20
devm_snd_soc_register_card+0x48/0x90
platform_probe+0x7b/0xb0
really_probe+0xf7/0x2a0
...
kobject: kobject_add_internal failed for SSP0-Codec with -EEXIST, don't try to register things with the same name in the same directory.
The issue is that the ALC5650 was only defined in the codec table and
not the amp table which left the pin unassigned but the dai link was
still created by the machine driver.
Also patch the suffix filename code for the topology to prevent double
suffix names as a result of this change.
Fixes: 8efcd48646 ("ASoC: Intel: sof_rt5682: use common module for sof_card_private initialization")
Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
Signed-off-by: Curtis Malainey <cujomalainey@chromium.org>
Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Link: https://patch.msgid.link/20240716084012.299257-1-pierre-louis.bossart@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Pull soundwire updates from Vinod Koul:
- cleanup and conversion for soundwire sysfs groups
- intel support for ace2x bits, auxdevice pm improvements
- qcom multi link device support
* tag 'soundwire-6.10-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/soundwire: (33 commits)
soundwire: intel_ace2.x: add support for DOAISE property
soundwire: intel_ace2.x: add support for DODSE property
soundwire: intel_ace2x: use DOAIS and DODS settings from firmware
soundwire: intel_ace2x: cleanup DOAIS/DODS settings
soundwire: intel_ace2x: simplify check_wake()
soundwire: intel_ace2x: fix wakeup handling
soundwire: intel_init: resume all devices on exit.
soundwire: intel: export intel_resume_child_device
soundwire: intel_auxdevice: use pm_runtime_resume() instead of pm_request_resume()
ASoC: SOF: Intel: hda: disable SoundWire interrupt later
soundwire: qcom: allow multi-link on newer devices
soundwire: intel_ace2x: use legacy formula for intel_alh_id
soundwire: reconcile dp0_prop and dpn_prop
soundwire: intel_ace2x: set the clock source
soundwire: intel_ace2.x: power-up first before setting SYNCPRD
soundwire: intel_ace2x: move and extend clock selection
soundwire: intel: add support for MeteorLake additional clocks
soundwire: intel: add more values for SYNCPRD
soundwire: bus: extend base clock checks to 96 MHz
soundwire: cadence: show the bus frequency and frame shape
...
Merge series from Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>:
This patchset does not change any functionality. It only clarifies the
Copyright information in ASoC/HDAudio contributions, where an "All
rights reserved" notice was mistakenly added in a number of files over
the years, likely due to copy/paste. The Intel template never included
this statement.
Merge series from Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>:
The SoundWire BPT support will rely on the HDaudio DMA. This exposes a
circular dependency module dependency which has to be resolved by
splitting common parts used by HDaudio and SoundWire parts, and
'generic' parts used by HDaudio only.
This patchset does not change any functionality, it just moves code
around, exposes symbols that are used in the new module. The code has
been in use for more than one kernel cycle already so it really
shouldn't break any existing platforms.
The main issue with such code moves is that it makes backports or
fixes more complicated. That's the main reason why we held back these
patches until we were reasonably confident on the maturity of MTL and
LNL drivers.
The existing code relies on the 'HDA_COMMON' module and namespace. We
need to start splitting top-level parts from the low-level ones,
otherwise we will not be able to reuse the low-level parts DMA support
for SoundWire/BPT.
In the end the dependencies will be:
+----------------------------------------------+
| |
| v
sof-pci-intel-xxx --> sof-intel-hda ------------> sof-hda-common
| ^
| |
+-> soundwire_intel --> sof_hda_sdw_bpt
This patch adds the initial split between the sof-pci-intel-xxx
modules and the common parts, in a follow-up patch we will further
split the HDA_COMMON parts
Since the PCI modules are not all independent, i.e. the CNL parts are
also used in JSL and TGL, additional Kconfig and namespace modules
were added.
Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
Link: https://lore.kernel.org/r/20240503135221.229202-4-pierre-louis.bossart@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Most of the SoundWire support issues come from bad ACPI information,
or configuration reported by ACPI that are not supported by the SOF
driver/topology. The users see a "No SoundWire machine driver found"
message without any details, and the fallback to HDaudio w/ HDMI is
used.
We can reduce our support load with a clear dev_info() log that will
give us a clear hint on the mismatch and why a machine driver/topology
were not found.
Example log on a MTL device:
[ 13.158599] sof-audio-pci-intel-mtl 0000:00:1f.3: No SoundWire machine driver found for the ACPI-reported configuration:
[ 13.158603] sof-audio-pci-intel-mtl 0000:00:1f.3: link 0 mfg_id 0x025d part_id 0x0713 version 0x3
[ 13.158606] sof-audio-pci-intel-mtl 0000:00:1f.3: link 1 mfg_id 0x025d part_id 0x1316 version 0x3
[ 13.158608] sof-audio-pci-intel-mtl 0000:00:1f.3: link 2 mfg_id 0x025d part_id 0x1316 version 0x3
In parallel, we will also provide an update to `alsa-info` to log all
SoundWire peripherals found in ACPI tables.
Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
Link: https://lore.kernel.org/r/20240426153902.39560-5-pierre-louis.bossart@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
The SoundWire interrupts can be masked at two levels
a) in the Cadence IP
b) at the HDaudio controller level
We have an existing mechanism with cancel_work_sync() and status flags
to make sure all existing interrupts are handled in the Cadence IP,
and likewise no new interrupts can be generated before turning off the
links.
However on remove we first use the higher-level mask at the controller
level, which is a sledgehammer preventing interrupts from all
links. This is very racy and not necessary. We can disable the
SoundWire interrupts after all the cleanups are done without any loss
of functionality.
Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Signed-off-by: Bard Liao <yung-chuan.liao@linux.intel.com>
Acked-by: Mark Brown <broonie@kernel.org>
Link: https://lore.kernel.org/r/20240410023438.487017-2-yung-chuan.liao@linux.intel.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
The node_id for multi-gateway ALH DAI's get overwritten with the
group_id during the DAI copier's ipc_prepare op. So, save the ALH
dai_index during the BE DAI hw_params in the dai_index field of struct
ipc4_copier and use that to set the device ID in the configuration blob.
This will avoid errors during copier init after an xrun.
Note that the dai_index is typically set in topology for DMIC/SSP, but
it's not used for ALH. Reclaiming this dai_index field to store the
node_id does not generate a conflict with topology-defined values.
Reviewed-by: Rander Wang <rander.wang@intel.com>
Reviewed-by: Péter Ujfalusi <peter.ujfalusi@linux.intel.com>
Signed-off-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Link: https://msgid.link/r/20240402151828.175002-18-pierre-louis.bossart@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
ASoC: Updates for v6.7
This is quite a large set of changes but mostly due to API cleanups and
in driver specific ways rather than due to anything subsystem wide.
Highlights include:
- Standardisation of API prefixes on snd_soc_, removing asoc_.
- GPIO API usage improvements.
- Support for HDA patches.
- Lots of work on SOF, including crash dump support.
- Support for AMD platforms with es83xx, Awinc AT87390, many Intel
platforms, many Mediatek platforms, Qualcomm SM6115, Richtek RTQ9128
and Texas Instruments TAS575x.
[ the merge conflicts around SOF Intel HD-audio and CS35L41 subcodec
drivers are resolved here -- tiwai ]
Merge series from Peter Ujfalusi <peter.ujfalusi@linux.intel.com>:
When a firmware crashes it creats a panic information into a telemetry
slot. The panic format is defined by Zephyr, includes stack and
additional information to help to identify the reason for the crash.
Part of the firmware exception handling the firmware also sends an
EXCEPTION_CAUGHT notification.
This series implements the kernel side handling of the exception: print
information into the kernel log export the whole telemetry slot to user
space for tools extract additional information from the panic dump.
Clang warns (or errors with CONFIG_WERROR):
sound/soc/sof/intel/hda.c:423:6: error: variable 'chip' is uninitialized when used here [-Werror,-Wuninitialized]
423 | if (chip && chip->check_sdw_wakeen_irq)
| ^~~~
sound/soc/sof/intel/hda.c:418:39: note: initialize the variable 'chip' to silence this warning
418 | const struct sof_intel_dsp_desc *chip;
| ^
| = NULL
1 error generated.
Add the missing initialization, following the pattern of the other irq
functions.
Fixes: 9362ab78f1 ("ASoC: SOF: Intel: add abstraction for SoundWire wake-ups")
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Acked-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Link: https://lore.kernel.org/r/20230809-intel-hda-missing-chip-init-v1-1-61557ca6fa8a@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Merge series from Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>:
This patchset first fixes a number of errors made in the hda-mlink
support, then adds Lunar Lake definitions. The main contribution is
the hda-dai changes where the HDaudio DMA is now used for SSP, DMIC
and SoundWire. In previous hardware the GPDMA (aka DesignWare) was
used and controlled by the audio firmware. The volume of code is
minimized with the abstraction added in previous kernel cycles.
Due to cross-dependencies between ASoC and SoundWire trees, the full
support for jack detection will be deferred to the next kernel
cycle. There's not much point to ask for a sync of the two trees to
support one patch for each tree - we are at -rc5 already.
Tavian Barnes
Bard Liao
Brent Lu
Curtis Malainey
Mark Brown
Pierre-Louis Bossart
Linus Torvalds
Peter Ujfalusi
Ranjani Sridharan
Takashi Iwai
Maarten Lankhorst
Rander Wang
Nathan Chancellor