mirror of
https://github.com/torvalds/linux.git
synced 2026-11-07 06:17:02 +01:00
v7.4-rc1
4490 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
Linus Torvalds
|
e9954f3fbd |
sound fixes for 7.4-rc1
A collection of fixes across the sound subsystem since the initial
7.4 PR. Nothing particularly stands out, mostly driver- and
device-specific fixes along with a few race / UAF fixes and cleanups.
Here are some highlights:
* ALSA core:
- Fix potential race in PCM proc handling at disconnection
- Fix potential race in UMP sequencer callback at releasing
* HD-audio:
- Reject codec reset/reconfig on ASoC buses to prevent deadlock
- Force MSI for Hygon H34M51A board
- Usual Realtek quirks for ASUS and HP laptops/AiO
* USB-audio:
- Bound packet copies by PCM buffer size in generic and ua101 drivers
- Rate-limit URB submission errors at stream start
- Skip redundant probe-time interface setup on MSI ALC4080
- Device quirks for Novation UltraNova, MOTU MicroBook II, and RYDZ
Headphone
* ASoC:
- Fixes for runtime PM and IRQ handling in hdac_hda and SDCA
- SOF: Fix potential UAF at release, fix for Kconfig dependency
- Qualcomm: Fixes for sm8250 and q6apm/q6afe
- NXP / i.MX: Fix for pending work in hw_free
- Xilinx: Fix read-modify-write of AUD_CTRL in formatter_pcm
- Intel: Arrow Lake SoundWire match table additions (RT712, RT713 +
dual RT1320)
- AMD: DMI quirk for HP Laptop 14-em0xxx and memory leak fix in Raven
DMA close
- Various codec fixes for midas_wm1811, wm8994, cs35l56, cs42l56,
WSA881x/883x/884x, es8326/es8375/es9356, rt721/rt722, and
tlv320aic32x4
* Misc:
- OPL3: Fix races in timer initialization, shutdown, and voice cleanup
- Bounds checks and string helpers for AC97 and emu10k1
- Fix spu_memset() stride in legacy SH AICA driver
- Parameter handling fixes in pcmtest virtual driver
-----BEGIN PGP SIGNATURE-----
iQJCBAABCAAsFiEEIXTw5fNLNI7mMiVaLtJE4w1nLE8FAmrmFsAOHHRpd2FpQHN1
c2UuZGUACgkQLtJE4w1nLE8DzA//WKBXzuHaYoQCel0Ky0qbTjOsLJaI63D1+w6r
2SeeEjKIRhRVSGSuGvtMLKQ2IEFq9njhVCjnv9FK+bY2x4jrc6auSixOmXZNgplj
f39DlJjy4ZZ6N1M9LclbiHFPR7UuRlbgXqS6UR83ijapHGqTf5eWcL1RIHmiUZ3k
Xr6Yd2Q58u7sMRdwLIoXYum7VD/46iSTS/SQT5Iq8eQij7YVlVTglxUPTouCVWI7
rNm9TZe5VggJ77ADI2Fo3VRI+QhQU/BohZ7R155fpqroCvGKLmWppypkCqpxtc/u
DnVGI7Cq/TDoBh2u4GrtBhx+voyt84X2N1epJ6vZzp5VZc6cjBnKFynvsxuGH4ox
0hb9Syu70rUAtulJwefRuftXv/gl0coZJCS1NoPsoKy3pEBGHExjgBoCZv7oCNH9
chk4n7XFEb7yktN5bd6MG7yhdF1U6jwkpFyDphBTb992eaB0KTylx/JcmOzwxSun
MKcAq8jsigvoxfvjGhE1OugtOg0qgdNgW9vCD1xXwSaNRXFEGNoBHWE33Y4nq3GW
e5PqUkYI6k2cAVyosxS3N9h9H/5FfCQynC1VZECl7gdFKvhNgHVAFuVLzbQ/Hn8K
vYitKNrVdC07EubPuOyOiDqEMCqvtAv7acH11ABMkKdnqwbbi0MzZB15s1lt1vzh
er1a04E=
=zbju
-----END PGP SIGNATURE-----
Merge tag 'sound-fix-7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound
Pull sound fixes from Takashi Iwai:
"A collection of fixes across the sound subsystem. Nothing particularly
stands out, mostly driver- and device-specific fixes along with a few
race / UAF fixes and cleanups. Here are some highlights:
ALSA core:
- Fix potential race in PCM proc handling at disconnection
- Fix potential race in UMP sequencer callback at releasing
HD-audio:
- Reject codec reset/reconfig on ASoC buses to prevent deadlock
- Force MSI for Hygon H34M51A board
- Usual Realtek quirks for ASUS and HP laptops/AiO
USB-audio:
- Bound packet copies by PCM buffer size in generic and ua101 drivers
- Rate-limit URB submission errors at stream start
- Skip redundant probe-time interface setup on MSI ALC4080
- Device quirks for Novation UltraNova, MOTU MicroBook II, and RYDZ
Headphone
ASoC:
- Fixes for runtime PM and IRQ handling in hdac_hda and SDCA
- SOF: Fix potential UAF at release, fix for Kconfig dependency
- Qualcomm: Fixes for sm8250 and q6apm/q6afe
- NXP / i.MX: Fix for pending work in hw_free
- Xilinx: Fix read-modify-write of AUD_CTRL in formatter_pcm
- Intel: Arrow Lake SoundWire match table additions (RT712, RT713 +
dual RT1320)
- AMD: DMI quirk for HP Laptop 14-em0xxx and memory leak fix in Raven
DMA close
- Various codec fixes for midas_wm1811, wm8994, cs35l56, cs42l56,
WSA881x/883x/884x, es8326/es8375/es9356, rt721/rt722, and
tlv320aic32x4
Misc:
- OPL3: Fix races in timer initialization, shutdown, and voice
cleanup
- Bounds checks and string helpers for AC97 and emu10k1
- Fix spu_memset() stride in legacy SH AICA driver
- Parameter handling fixes in pcmtest virtual driver"
* tag 'sound-fix-7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (71 commits)
ASoC: SOF: Intel: hda: Stop the controller before freeing its DMA buffers
ASoC: imx-pcm-rpmsg: Flush pending work in hw_free
ASoC: xilinx: formatter_pcm: Fix read-modify-write of AUD_CTRL in hw_params
ASoC: hdac_hda: Keep runtime PM state in sync across codec remove/probe
ASoC: rt721: Remove invalid register defaults
ASoC: hdac_hda: Balance the runtime PM disable in codec remove
ASoC: hdac_hda: Restore the codec device type on unbind
ASoC: hdac_hda: Allocate the private data at codec driver bind
ASoC: qcom: sm8250: Limit RX digital gain to 0 dB
ALSA: hda: Reject codec reset on ASoC (ext_ops) buses
ALSA: usb-audio: add quirk for Novation UltraNova (1235:0011)
ALSA: usb-audio: Add correct datainterval in the quirks-table for Microbook II
ALSA: usb-audio: Skip probe-time interface setup for MSI MAG X570S ALC4080
ALSA: hda/realtek: Extend quirk for HP Pavilion All-in-One 27-ca1xxx
ALSA: pcmtest: Honor the enable parameter
ALSA: ua101: Bound packet copies by the PCM buffer size
ALSA: usb-audio: Bound packet copies by the PCM buffer size
ASoC: SDCA: re-enable IRQ on pm_runtime_force_suspend failure
ASoC: SDCA: drop pm_runtime reference on probe failure path
ASoC: SDCA: propagate sdw_slave_read_prop() failure in class_read_prop
...
|
||
|
Takashi Iwai
|
74f6055d0c |
ASoC: Fixes for v7.4
A moderately large collection of fixes and quirks that have come in during the merge window, everything here is driver specific and none of it unusually severe. -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQReagvpf3TrrA7BoYYv73Ows9A4iQUCauON8gAKCRAv73Ows9A4 iZm5AQCsGUaurJF/x2A5bcxt7eQay8hm6SZl4dQ1IBRZSjXwCAEA8GfpfWkrs1H0 OjjEhpZxvqsc2EToBBOQrtRYFqRKhQE= =hdcF -----END PGP SIGNATURE----- Merge tag 'asoc-fix-v7.4-merge-window' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v7.4 A moderately large collection of fixes and quirks that have come in during the merge window, everything here is driver specific and none of it unusually severe. |
||
|
Cen Zhang
|
9b30046de0 |
ALSA: ump: Drain sequencer callbacks before freeing their client
seq_ump_client_free() cancels group_notify_work while the endpoint still
publishes seq_ops and seq_client. A received Function Block update can
enter the sequencer callback after cancellation and queue the work again.
Even disabling the work cannot protect a callback that already loaded
seq_client and then resumes after the client has been freed.
A USB UMP endpoint can continue receiving while its sequencer binding
is removed. The following order uses the same endpoint and client:
Sequencer binding removal UMP input completion
------------------------- --------------------
cancel_work_sync()
load seq_ops and seq_client
delete sequencer client
clear endpoint binding
kfree(client)
schedule group_notify_work
read client->seq_client
Cover all calls through seq_ops with SRCU in the UMP core. Withdraw the
operations pointer and wait for those callbacks before canceling work
and deleting the client. No producer can then queue work after the final
cancellation, and both the client and callback code remain available
until the last in-flight callback returns.
Publish seq_ops with release/acquire ordering so the separately stored
seq_client is initialized before any callback uses it. Use SRCU because
sequencer notification delivery can sleep; no callback needs to change
its existing execution context or allocation behavior.
Fixes:
|
||
|
Linus Torvalds
|
75c1cb8178 |
sound updates for 7.4-rc1
The AI flood continues, which brought us a fairly busy development
cycle again with changes spread across the subsystem, ranging from
(lots of) core hardening to new platforms and codecs.
Here are some highlights.
* ALSA core:
- PCM: race fixes around channel-map controls, draining/unlink, drop
sync-stop handling, and DMA buffer delay sync
- Compress-offload: state and geometry validations, buffer leak fix,
and stream/card lifetime management
- Jack: module pinning during debugfs access, control removal race
fix, and early injection exposure
- Timer & sequencer: module pinning for user timers, RCU grace period
wait on port deletion, UMP bounds fixes
- Mark OSS sequencer emulation as deprecated
- RawMIDI: proper disconnect handling and input work drain cleanup
- Control: fixes for vmaster racy setups and control callback
serialization, UAF fix on card disconnect
* ASoC core:
- Continued framework refactoring, deployment of
auto_selectable_formats across codecs and platform DAIs
- Generic card cleanup: free jack GPIOs on card remove for simple-card
and audio-graph-card variants
- SDCA improvements: SimpleJack function type support, library
helpers, and non-ACPI build support
- Conversion of deprecated DMA API calls
* ASoC SOF:
- Support for compressed audio playback on SOF IPC4 with Intel TGL+
- AMD ACP 7.B / 7.F SoundWire and PDM controller support, ASP carveout
firmware loading
- Function topology support for Intel I2S machines
* ASoC platforms & codecs:
- Qualcomm: New QAIF driver for Shikra platform, WCD9378 SDCA codec,
Nord Ride/RRD and Motorola Edge 30 boards, LPASS macro cache
converted to maple tree
- New codec drivers: ESS ES9039Q2M, Nuvoton NAU83G60 amplifier, Senary
SN624x SoundWire SDCA codec
- MediaTek / Airoha: New Airoha AN7581 AFE and WM8960 machine drivers,
extensive clock and error-handling cleanups across MediaTek SoCs
- NVIDIA Tegra: WM8994 machine driver and CS35L45 MDSYNC support
- Realtek: RT766/RT767, RT721_U, RT718 variants, RT712 GPIO LED
control
- Cirrus Logic: CS35L45 MDSYNC support, CS35L56 regmap default tests
- TI: TAS2573 DSP support in TAS2781, TAS2783 SoundWire fixes
- Everest Semi: ES8326 standby / HPF controls, ES8389 / ES8375 resume
fixes
- Removal of obsolete ST-Ericsson Ux500 MOP500 machine driver
* HD-audio:
- ACPI controller runtime PM suspend/resume support
- Controller shutdown and unbind race fixes for unsol events and jack
polling
- HDMI: High Bit Rate (HBR) audio capability enabled, ELD proc and
converter bounds checks
- AW88399 side codec SSID-specific firmware naming and Lenovo Legion
R9000P enablement
- Realtek / Conexant / Cirrus / TI quirks for numerous laptops
(Lenovo, ASUS, HP, Acer, HONOR, Minisforum, MSI, etc.)
- Creative CA0132 Sound BlasterX AE-5 external RGB LED strip support
* USB-audio:
- Dedicated mixer driver for Audient EVO4
- Native Instruments Kore controller LCD support and keymap fix
- Pioneer DJ DDJ-SZ and Roland (OCTA-CAPTURE / QUAD-CAPTURE multirate,
TD-11) support
- UAC2/3 mixer unit matrix evaluation and bounds checking
- Hardening for LINE6 and caiaq drivers against malformed packets and
races
- Device-specific quirks for PreSonus, TASCAM, Logitech, Mayflower,
MOONDROP, Yamaha, etc.
Misc:
- Auto-cleanup conversion for snd_card_free() and devres migration
across dozens of legacy PCI, ISA, and Sparc drivers
- ALSA loopback (aloop) timer lifecycle fixes and new aloop selftest
- pcmtest driver fixes and kselftest updates
-----BEGIN PGP SIGNATURE-----
iQJCBAABCAAsFiEEIXTw5fNLNI7mMiVaLtJE4w1nLE8FAmraHJUOHHRpd2FpQHN1
c2UuZGUACgkQLtJE4w1nLE8lLA//X8tUgUjgWVmO+m95b3B14mcKqne5rFTKV1z0
tKLUO4AK03oSC025rri6ESpnMyTbAx9Zf40rr4qozvaRNLJS21YX1BB80UXVggxK
1aecfdREwT23SaHvZGpFUQWUmZo8FFgcCryFv0ZarjmYpF6SqZTjJEpBAZBTGp9v
p4KVMpFIhtymhe4VOpOKtgO+spFXgeYAaYAV2k3o2X4TOIE8nYFZKKMdby6imxay
tfZdRZ0MUCylluVJink+Z5ZIPNbH3I/QiezrBR/08UmsMX0KxlBO0+vAUrPYeeo8
SyZDjaeoRKowNBcH2Q93aOPphHA+1x17K07+pftptOAxbGspIjEBylfZrNHrHS8s
0xW4yIEjLX2nPioT/hMbsuc4aBHINUVJD6dMT2hws1JDLdkvmieMkRqnrIoDdC6V
nVVYELDzLfx8B38/UZUXTZC5JzkC8WNazH6EmVKKu8Yn0lLyzJJ8o6aV4QLfmlys
am6Bi5sks9uPbcSJ6XL9PXFwCsi+HSU2VOJLs3gPvzFAWnRRIHcQFsCL61Ll4qIs
AOMwDNLsbuVbm4RrOTSBteAuPZIJovRoWmVqd+bvLgfCk3kxA+aQC/OrltpQhaTo
hw0fSh+i34k5vxdrznOgH18w9xnFwnmQYnL4dqczAPAY5vCuFZixD56Ysvesoz/S
U/sityw=
=j/6p
-----END PGP SIGNATURE-----
Merge tag 'sound-7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound
Pull sound updates from Takashi Iwai:
"The AI flood continues, which brought us a fairly busy development
cycle again with changes spread across the subsystem, ranging from
(lots of) core hardening to new platforms and codecs.
Here are some highlights.
ALSA core:
- PCM: race fixes around channel-map controls, draining/unlink, drop
sync-stop handling, and DMA buffer delay sync
- Compress-offload: state and geometry validations, buffer leak fix,
and stream/card lifetime management
- Jack: module pinning during debugfs access, control removal race
fix, and early injection exposure
- Timer & sequencer: module pinning for user timers, RCU grace period
wait on port deletion, UMP bounds fixes
- Mark OSS sequencer emulation as deprecated
- RawMIDI: proper disconnect handling and input work drain cleanup
- Control: fixes for vmaster racy setups and control callback
serialization, UAF fix on card disconnect
ASoC core:
- Continued framework refactoring, deployment of
auto_selectable_formats across codecs and platform DAIs
- Generic card cleanup: free jack GPIOs on card remove for
simple-card and audio-graph-card variants
- SDCA improvements: SimpleJack function type support, library
helpers, and non-ACPI build support
- Conversion of deprecated DMA API calls
ASoC SOF:
- Support for compressed audio playback on SOF IPC4 with Intel TGL+
- AMD ACP 7.B / 7.F SoundWire and PDM controller support, ASP
carveout firmware loading
- Function topology support for Intel I2S machines
ASoC platforms & codecs:
- Qualcomm: New QAIF driver for Shikra platform, WCD9378 SDCA codec,
Nord Ride/RRD and Motorola Edge 30 boards, LPASS macro cache
converted to maple tree
- New codec drivers: ESS ES9039Q2M, Nuvoton NAU83G60 amplifier,
Senary SN624x SoundWire SDCA codec
- MediaTek / Airoha: New Airoha AN7581 AFE and WM8960 machine
drivers, extensive clock and error-handling cleanups across
MediaTek SoCs
- NVIDIA Tegra: WM8994 machine driver and CS35L45 MDSYNC support
- Realtek: RT766/RT767, RT721_U, RT718 variants, RT712 GPIO LED
control
- Cirrus Logic: CS35L45 MDSYNC support, CS35L56 regmap default tests
- TI: TAS2573 DSP support in TAS2781, TAS2783 SoundWire fixes
- Everest Semi: ES8326 standby / HPF controls, ES8389 / ES8375 resume
fixes
- Removal of obsolete ST-Ericsson Ux500 MOP500 machine driver
HD-audio:
- ACPI controller runtime PM suspend/resume support
- Controller shutdown and unbind race fixes for unsol events and jack
polling
- HDMI: High Bit Rate (HBR) audio capability enabled, ELD proc and
converter bounds checks
- AW88399 side codec SSID-specific firmware naming and Lenovo Legion
R9000P enablement
- Realtek / Conexant / Cirrus / TI quirks for numerous laptops
(Lenovo, ASUS, HP, Acer, HONOR, Minisforum, MSI, etc.)
- Creative CA0132 Sound BlasterX AE-5 external RGB LED strip support
USB-audio:
- Dedicated mixer driver for Audient EVO4
- Native Instruments Kore controller LCD support and keymap fix
- Pioneer DJ DDJ-SZ and Roland (OCTA-CAPTURE / QUAD-CAPTURE
multirate, TD-11) support
- UAC2/3 mixer unit matrix evaluation and bounds checking
- Hardening for LINE6 and caiaq drivers against malformed packets and
races
- Device-specific quirks for PreSonus, TASCAM, Logitech, Mayflower,
MOONDROP, Yamaha, etc.
Misc:
- Auto-cleanup conversion for snd_card_free() and devres migration
across dozens of legacy PCI, ISA, and Sparc drivers
- ALSA loopback (aloop) timer lifecycle fixes and new aloop selftest
- pcmtest driver fixes and kselftest updates"
* tag 'sound-7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (924 commits)
ALSA: hda/realtek: Add mute and mic-mute LEDs for HP ENVY 16 (103c:8be5)
selftests: ALSA: pcmtest: Compare all captured bytes in ni_capture
ALSA: usb-audio: Use strscpy() in append_ctl_name()
ALSA: caiaq: Use strscpy() in snd_usb_caiaq_input_init()
ALSA: hiface: Use scnprintf() in hiface_chip_create()
selftests/alsa: Check the aloop PCM Slave controls for a matching playback
ALSA: aloop: Update the PCM Slave controls for a matching playback
selftests: ALSA: pcmtest: Make room for the longest fill pattern
selftests: ALSA: pcmtest: Check the frame count of each transfer
ALSA: hda/realtek: Fix speakers on COLORFUL L1 Plus
ALSA: hda/realtek: enable AW88399 on Lenovo Legion R9000P AFR10
ALSA: line6: Handle period elapsed calls outside the locks
ALSA: emux: Stop voices before freeing zones in all cases
ALSA: emux: Fix UAF of soundfont zones at note-on
ALSA: mtpav: restore negation dropped in guard() conversion
ALSA: compress: reject restarting an ACTIVE task via origin_seqno
ALSA: compress: add missing OPEN-state gate to SET_METADATA
ALSA: compress: reject buffer geometry change on gapless next_track
ALSA: compress: fix buffer leak on failed SET_PARAMS
ALSA: hda/realtek: Enable jack detection on Minisforum AI X1
...
|
||
|
Linus Torvalds
|
5b0764a532 |
drm next for 7.4-rc1
rust:
- I/O tree shared with driver-core
- DMA tree shared with driver-core
- allow aux registration data closures to return covariant
sub-fields
- Implement Send and Sync for MapleTree
- add pci resource flags and IORESOURCE_MEM_64
drm/rust:
- add dma_fence abstraction
- init DRM registrations and their data in place
- drop unused flags argument to registration
vgaarb:
- rework API to pass a private ptr instead of pci device
sound:
- adapt to omapdrm changes
gem:
- add callback for handle count going to 0
gpusvm:
- share one HMM fault and keep single mappings inline
pagemap:
- Prevent CPU stalls during unbounded pagemap teardown
dma-fence:
- fix docs
vga_switcheroo:
- disconnect from fbcon
- update fbcon from within fbdev emulation
atomic:
- move DRM from state reset callbacks to atomic_create_state
- remove drm_simple_encoder_init
panic:
- split into core and helpers
buddy:
- improve dirty tracking
clients:
- improve vmap handling
- fbdev: Move helpers from drm_kms_helper.ko to drm_client_lib.ko
display:
- export HDMI SCDC status data via debugfs
- rework SCDC for better HDMI 2.0 support
- dp/mst: improve DPCD compliance
edid:
- parse AMD VSDB
- parse ALLM/VRR capabilities
- support detecting panel size
log:
- add drm_warn_ratelimited
sched:
- cleanup interface
- add missing locking
- fix run-queue cleanup
- fix locking
sysfb:
- remove obsolete quirk for Lenovo D330
- fix panel orientation for non-native display modes
- drop drm_class_device_register
colorop:
- provide DRM_COLOR_OP_FIXED_MATRIX
bridge:
- analogix: Support eDP lane mapping
- ti-sn65dsi83: Support LVDS Channel B on SN65DSI84
- Select DRM_PANEL_BRIDGE for various drivers that require it
- add chrontel ch7218a support
panel:
- panel-edp: Support MNE007QS3-F, TM140VDXP15, and KD116N36-30NB-A001
- samsung-s6d16d0: Use mipi_dsi_*_multi() functions
- support Ilitek ILI7836A OLED plus DT bindings
- support Novatek NT36532 plus DT bindings
- convert several drivers to managed cleanup
- fix Kconfig selections
- edp: Add support for BOE NV140FHM-T0A
- samsung: Share test-key helpers
- edp: Support CSOT MNE007QB1-1
- ebbg-ft8719: Fix MODULE_LICENSE() string; Improve initialization
- edp: NV140WU2-M70
- ilitek-ili9882t: Support Ilitek IL79600A plus DT bindings
- simple: Support Truly TFT320240-229-E plus DT bindings; Support BOE
DV215FHM-R01 plus DT bindings
- Refactor struct drm_panel to contain struct drm_bridge plus fallout in
various panel drivers
- Add support for BOE Novatek NT51021, Retroid Pocket 6,
Raydium RM69220 DDIC panels, Sharp LQ138P1JX61 eDP,
BOE NV140FHD-N43, AUO B140HAN04.0, AUO 0x0db3,
panels.
amdgpu:
- use AMD VSDB for freesync
- implement YUV-to-RGB with fixed-matrix colorop
- enable FRL for HDMI
- HDMI 2.1 freesync support
- HDMI 2.1 ALLM support
- HDMI 2.1 VRR support
- UALoE (UALink over Ethernet) support
- add syncobj_points to userq signal ioctl
- drop unused kunit tests
- NBIO/GC/MMHUB/SMU updates/fixes
- GPU spatial partitioning updates
- display kunit fixes
- userq fixes
- RGB quantization fixes
- DC RMCM refactor
- DP MST fixes
- USB4 fixes
- add new trace events
- Rework display instance handling
- stack frame size fixes for various compilers/configs
- VCN 4/5 reset fixes
- freesync updates
- cursor refactor
- Fix direct scanout alpha on some DRM_FORMATs
- Expand Mac reserved memory workaround
- Make runtime pm more fine grained
amdkfd:
- updates and fixes
- GC 10 CU occupancy support
radeon:
- eDP fix for DCE3.2 iMacs
xe:
- add drm_ras netlink error event support
- add memory page offlining support
- introduce error threshold to drm_ras
- fix stale GTT mappings on unmap
- reject page faults for non-page fault mode scratch VM
- enable CRI package and VRAM temperatures
- introduce cold reset recovery
- handle CRI+ power interval encoding
- VF migration for multi-queue
- handle exec queue teardown after hot unplug
- alerts and controller enabling modifications
- use IBCv3 on PTL
- VRAM health check
- report GT TDR and VM rebind faults using SIGID
- add multi_queue_active_lrca debugfs
- shrinker: Runtime PM reference for non-system memory
- guc: Add simple KLV decoder helpers
- debugfs: Expose per-engine idle status
- Keep walking on SVM eviction failure
- Nuke PTs only after unlinking contested VMAs
- limit sg segment size to PAGE_SIZE on Xen PV
- keep VF LMEM bar size low if no VFs
- CPU binds and ULLS on migration queue
- New PTL PCI ID
- Enable PXP for NVL-S
- Do not dma_fence_put zero fences in err_out path
- Refresh TTM LRU on SVM prefetch
- export device UID in sysfs
i915:
- rename GEN6_PCODE_DATA to match spec
- fix incorrect RCU teardown order
- fix potential UAF in command parsing
- avoid WARN splat during RPS boosting race
- use simpler min functions
- Fixes to make i915 work well with PREEMPT_RT
i915/display:
- Enable CMRR (Content Match Refresh Rate) in fixed-RR VRR path
- Switch DG2 MPLL to DPLL framework
- DP-HDMI PCON DSC fixes
- limit invalid joiner combinations
- CDCLK related fixes and refactor around PCODE integration
- Gate UHBR SST SDP splitting on sink caps
- add HDMI TMDS audio bandwidth check
- vswing/preemph override
- enable AS SDP Skip frames
- Handle negative configuration index on DP link caps for robustness
- Preparation for enabling SDR plane color pipeline
- An eDP quirk for HP Pavilion Plus
- Introduce PME (Power Management Event) support on display hotplug
- Handle VSC SDP revision 7 in unpack
msm:
- CI:
- Dropped sc7180 trogdor lazor from the CI
- Core:
- Fixed msm_ioremap for resources without a name
- Changed msm.separate_gpu_kms to default to auto selection
- GPU:
- Enable CLX (Current Limit eXtension) for gen8 to avoid
exceeding limits on CX/GX rails
- New GPUs: a830 (Pakala), a845 (Maili), a850 (Hawi),
x2-85 (Mahua)
- Fix VBIF halt mask on a306, which was preventing runpm
suspend
- Enable THP support for GEM buffers
- Add modparam to disable waiting on fences in shrinker
- Drop use of drm_prime_sg_to_page_array()
- a5xx: don't read the GPMU registers on GPUs without a GPMU
- a2xx/a3xx/a5xx: hangcheck progress detection
- a6xx: gmuwrapper runpm fix
- Calculate reported GMEM size based on active slices
- Split a6xx/a7xx/a8xx catalog
- DP:
- Picked up some preparation patches for the MST support
- Fixed reported status of the link training
- DPU:
- Fixed CRTC bandwidth computation
- Fixed DSC programming
- Fixed encoder disablement path
- DSI:
- Fixed VM leak in error path
- Indention fix
- MDP5:
- Added MSM8952 configuration
- Dropped incorrect cursor pipe on MSM8976/56
- HDMI:
- Small fixes
nouveau:
- improve runtime PM on R570 GSP firmware
- various fixes throughout the driver
- dispnv50: support 2.147 GHz pixel clock in GB20x
nova:
- add initial uapi concept
- add initial PRAMIN access support
- add GpuMm centralized memory manager
- add GPU VM and BAR1 support
- add GPU interrupts and GSP events support
- GSP messaging fixes
tyr:
- use bitfield!
- zero unsupported and newly added GPU info fields
- limit doorbell array to 17 entries
exynos:
- FIMD fixes
- Fix clock leak on resume error path.
- Fix Sparse warnings by adding missing __iomem annotation.
- VIDI cleanup
- Replace kmalloc() and copy_from_user() with memdup_user().
amdxdna:
- fix BO handling
- Support AIE2 rev 9
- Fix UAF access in scheduler fences
- Update workqueue interface
- expose busy time via fdinfo
ast:
- support 256-byte EDID
hyperv_drm:
- remove support for pre win10 hosts
komeda:
- fix GLB_CORE_ID usage
omap:
- report HDMI hotplug events to ASoC HDMI codec
panthor:
- provide gpu_cache_flush tracepoint
- improve dma_fence signalling latency
- improve locking
- export scheduling information via debugfs
- Validate user-space input against firmware limits
qaic:
- reject BOs that exceed maximum page count
- add missing include statements
verisilicon:
- fix hardware cursor offsets
vkms:
- implement YUV-to-RGB with fixed-matrix colorop
gma500:
- avoid unsupported ARGB formats in primary plane
hibmc:
- handle vblank interrupts correctly
ivpu:
- add DRM_IVPU_CAP_CMDQ_SET_PRIORITY
- support command-queue priority ioctl
- Simplify NULL-pointer handling in cleanup code
arcpgu:
- replace simple-display pipeline with regular atomic helpers
aspeed:
- replace simple-display pipeline with regular atomic helpers
gm12u320:
- replace simple-display pipeline with regular atomic helpers
imagination:
- various improvement to firmware interaction
- add job to pvr_job_submit_fw trace event
mali-dp:
- fix runtime PM leak
mcde:
- replace simple-display pipeline with regular atomic helpers
p111:
- replace simple-display pipeline with regular atomic helpers
- drop unsupported alpha formats from primary plane
rcar-du:
- support Renesas R-Car V4H DSC
- dsi: Support larger transfers with AXI memory
- Support RZ/G3L SoC
repaper:
- replace simple-display pipeline with regular atomic helpers
rockchip:
- dsi: improve PHY timings
ssd130x:
- support Solomon SSD1351 OLED plus DT bindings
- ssd133x: upgrade color format to RGB565
- ssd132x: Set correct hardware window when clearing screen
tve200:
- replace simple-display pipeline with regular atomic helpers
xen:
- replace simple-display pipeline with regular atomic helpers
v3d:
- improve job handling under perfmon
vc4:
- reliably reset V3D
- drop brcm,vc4-v3d compatible
virtio:
- fix damage handling
- Support ARGB8888 for virtio primary planes.
host1x:
- Support partitioning
imx:
- Replace simple-display with regular atomic helpers
mxsfb:
- Support bus formats plus DT bindings
tegra:
- improve syncobj handling on submit
panfrost:
- add Mali-G68 support
- improve GPU reset handling
rockchip:
- add HDMI 2.0 support to dw-hdmi-qp
- improve HPD handling
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEEKbZHaGwW9KfbeusDHTzWXnEhr4FAmrYXp8ACgkQDHTzWXnE
hr4FZQ//TTxnbkFAcyHBhLHLfGrUk2tyDdBR3RL+89PVR+K/XB4thjxQnS0IuF9I
NM9KB+Fa1PYOlnvKOAbKBqB8m4E+ATBmkzZ1nbY4DDvIPPZMTIF27yD5OJI/GoP7
zvDTgGLK3oeXCydjUM7R3jXD7gjJ4KOe82Um1TWxCmpwMU4P8/5u3/lzfz8Lxael
XLwnp1t/tjCWtxlrok1t3XjNkUv0PiGuA9YQvbXEV2wArguhNUcMtwFfBcuOCCf/
eo9k29l0/lJgg8oFAOiLXxQbjcDqbF2NzHZbrBAWaZ50Wkzx2xv/WRLog6NT/ziN
ScrdzVVgiAvhERaSmFT3eZxqy7g1pvHpej9KGsbqVqpxWdZeGMO9zSa52SqN62P6
YeqDr5IGyi6HAstcSSwtE/UByEftTGJfUDytASugzOZOFFvj4M0ITBT9ElYtdL2c
aSn/M30JFmV4i1C+jKFxteBJOqurF+p/CqdqxmHSz6sLcsgzHThMknGMoZYlIvUR
0xewU7BFjUz4dT1r2UI+5GGV8Yibt4keyi00CitL+KWhTGcsGz8eLYXwtzbAU3Lb
DlbV/gU77dHAI7yKz00BNLoVnRBRpzZRoPQmS0kRWpxHDu3WMksCLYNMQ1VL/DiC
PyYIFK77SC8k+CnzKYLwP27zzEIS4pNrncBlp41g/Fj4tyzf4gc=
=PWSa
-----END PGP SIGNATURE-----
Merge tag 'drm-next-2026-10-21' of https://gitlab.freedesktop.org/drm/kernel
Pull drm updates from Dave Airlie:
"Highlights:
- core: a lot of atomic refactoring in progress, panic got split into
a core/helpers model
- amdgpu: enables HDMI 2.1 FRL and other good things finally, UAlink
over Ethernet support
- xe: has a bunch of CRI support, ras error for bad vram, memory
offlining support.
- msm: enables a bunch more GPUs.
Otherwise it's a the usual mountain of stuff all over the place.
Details:
rust:
- I/O tree shared with driver-core
- DMA tree shared with driver-core
- allow aux registration data closures to return covariant sub-fields
- Implement Send and Sync for MapleTree
- add pci resource flags and IORESOURCE_MEM_64
drm/rust:
- add dma_fence abstraction
- init DRM registrations and their data in place
- drop unused flags argument to registration
vgaarb:
- rework API to pass a private ptr instead of pci device
sound:
- adapt to omapdrm changes
gem:
- add callback for handle count going to 0
gpusvm:
- share one HMM fault and keep single mappings inline
pagemap:
- Prevent CPU stalls during unbounded pagemap teardown
dma-fence:
- fix docs
vga_switcheroo:
- disconnect from fbcon
- update fbcon from within fbdev emulation
atomic:
- move DRM from state reset callbacks to atomic_create_state
- remove drm_simple_encoder_init
panic:
- split into core and helpers
buddy:
- improve dirty tracking
clients:
- improve vmap handling
- fbdev: Move helpers from drm_kms_helper.ko to drm_client_lib.ko
display:
- export HDMI SCDC status data via debugfs
- rework SCDC for better HDMI 2.0 support
- dp/mst: improve DPCD compliance
edid:
- parse AMD VSDB
- parse ALLM/VRR capabilities
- support detecting panel size
log:
- add drm_warn_ratelimited
sched:
- cleanup interface
- add missing locking
- fix run-queue cleanup
- fix locking
sysfb:
- remove obsolete quirk for Lenovo D330
- fix panel orientation for non-native display modes
- drop drm_class_device_register
colorop:
- provide DRM_COLOR_OP_FIXED_MATRIX
bridge:
- analogix: Support eDP lane mapping
- ti-sn65dsi83: Support LVDS Channel B on SN65DSI84
- Select DRM_PANEL_BRIDGE for various drivers that require it
- add chrontel ch7218a support
panel:
- panel-edp: Support MNE007QS3-F, TM140VDXP15, and KD116N36-30NB-A001
- samsung-s6d16d0: Use mipi_dsi_*_multi() functions
- support Ilitek ILI7836A OLED plus DT bindings
- support Novatek NT36532 plus DT bindings
- convert several drivers to managed cleanup
- fix Kconfig selections
- edp:
- Add support for BOE NV140FHM-T0A
- Support CSOT MNE007QB1-1
- NV140WU2-M70
- ebbg-ft8719: Fix MODULE_LICENSE() string; Improve initialization
- samsung: Share test-key helpers
- ilitek-ili9882t: Support Ilitek IL79600A plus DT bindings
- simple: Support Truly TFT320240-229-E plus DT bindings; Support BOE
DV215FHM-R01 plus DT bindings
- Refactor struct drm_panel to contain struct drm_bridge plus fallout
in various panel drivers
- Add support for BOE Novatek NT51021, Retroid Pocket 6, Raydium
RM69220 DDIC panels, Sharp LQ138P1JX61 eDP, BOE NV140FHD-N43, AUO
B140HAN04.0, AUO 0x0db3, panels.
amdgpu:
- use AMD VSDB for freesync
- implement YUV-to-RGB with fixed-matrix colorop
- enable FRL for HDMI
- HDMI 2.1 freesync support
- HDMI 2.1 ALLM support
- HDMI 2.1 VRR support
- UALoE (UALink over Ethernet) support
- add syncobj_points to userq signal ioctl
- drop unused kunit tests
- NBIO/GC/MMHUB/SMU updates/fixes
- GPU spatial partitioning updates
- display kunit fixes
- userq fixes
- RGB quantization fixes
- DC RMCM refactor
- DP MST fixes
- USB4 fixes
- add new trace events
- Rework display instance handling
- stack frame size fixes for various compilers/configs
- VCN 4/5 reset fixes
- freesync updates
- cursor refactor
- Fix direct scanout alpha on some DRM_FORMATs
- Expand Mac reserved memory workaround
- Make runtime pm more fine grained
amdkfd:
- updates and fixes
- GC 10 CU occupancy support
radeon:
- eDP fix for DCE3.2 iMacs
xe:
- add drm_ras netlink error event support
- add memory page offlining support
- introduce error threshold to drm_ras
- fix stale GTT mappings on unmap
- reject page faults for non-page fault mode scratch VM
- enable CRI package and VRAM temperatures
- introduce cold reset recovery
- handle CRI+ power interval encoding
- VF migration for multi-queue
- handle exec queue teardown after hot unplug
- alerts and controller enabling modifications
- use IBCv3 on PTL
- VRAM health check
- report GT TDR and VM rebind faults using SIGID
- add multi_queue_active_lrca debugfs
- shrinker: Runtime PM reference for non-system memory
- guc: Add simple KLV decoder helpers
- debugfs: Expose per-engine idle status
- Keep walking on SVM eviction failure
- Nuke PTs only after unlinking contested VMAs
- limit sg segment size to PAGE_SIZE on Xen PV
- keep VF LMEM bar size low if no VFs
- CPU binds and ULLS on migration queue
- New PTL PCI ID
- Enable PXP for NVL-S
- Do not dma_fence_put zero fences in err_out path
- Refresh TTM LRU on SVM prefetch
- export device UID in sysfs
i915:
- rename GEN6_PCODE_DATA to match spec
- fix incorrect RCU teardown order
- fix potential UAF in command parsing
- avoid WARN splat during RPS boosting race
- use simpler min functions
- Fixes to make i915 work well with PREEMPT_RT
i915/display:
- Enable CMRR (Content Match Refresh Rate) in fixed-RR VRR path
- Switch DG2 MPLL to DPLL framework
- DP-HDMI PCON DSC fixes
- limit invalid joiner combinations
- CDCLK related fixes and refactor around PCODE integration
- Gate UHBR SST SDP splitting on sink caps
- add HDMI TMDS audio bandwidth check
- vswing/preemph override
- enable AS SDP Skip frames
- Handle negative configuration index on DP link caps for robustness
- Preparation for enabling SDR plane color pipeline
- An eDP quirk for HP Pavilion Plus
- Introduce PME (Power Management Event) support on display hotplug
- Handle VSC SDP revision 7 in unpack
msm:
- CI:
- Dropped sc7180 trogdor lazor from the CI
- Core:
- Fixed msm_ioremap for resources without a name
- Changed msm.separate_gpu_kms to default to auto selection
- GPU:
- Enable CLX (Current Limit eXtension) for gen8 to avoid exceeding
limits on CX/GX rails
- New GPUs: a830 (Pakala), a845 (Maili), a850 (Hawi), x2-85
(Mahua)
- Fix VBIF halt mask on a306, which was preventing runpm suspend
- Enable THP support for GEM buffers
- Add modparam to disable waiting on fences in shrinker
- Drop use of drm_prime_sg_to_page_array()
- a5xx: don't read the GPMU registers on GPUs without a GPMU
- a2xx/a3xx/a5xx: hangcheck progress detection
- a6xx: gmuwrapper runpm fix
- Calculate reported GMEM size based on active slices
- Split a6xx/a7xx/a8xx catalog
- DP:
- Picked up some preparation patches for the MST support
- Fixed reported status of the link training
- DPU:
- Fixed CRTC bandwidth computation
- Fixed DSC programming
- Fixed encoder disablement path
- DSI:
- Fixed VM leak in error path
- Indention fix
- MDP5:
- Added MSM8952 configuration
- Dropped incorrect cursor pipe on MSM8976/56
- HDMI:
- Small fixes
nouveau:
- improve runtime PM on R570 GSP firmware
- various fixes throughout the driver
- dispnv50: support 2.147 GHz pixel clock in GB20x
nova:
- add initial uapi concept
- add initial PRAMIN access support
- add GpuMm centralized memory manager
- add GPU VM and BAR1 support
- add GPU interrupts and GSP events support
- GSP messaging fixes
tyr:
- use bitfield!
- zero unsupported and newly added GPU info fields
- limit doorbell array to 17 entries
exynos:
- FIMD fixes
- Fix clock leak on resume error path
- Fix Sparse warnings by adding missing __iomem annotation
- VIDI cleanup
- Replace kmalloc() and copy_from_user() with memdup_user()
amdxdna:
- fix BO handling
- Support AIE2 rev 9
- Fix UAF access in scheduler fences
- Update workqueue interface
- expose busy time via fdinfo
ast:
- support 256-byte EDID
hyperv_drm:
- remove support for pre win10 hosts
komeda:
- fix GLB_CORE_ID usage
omap:
- report HDMI hotplug events to ASoC HDMI codec
panthor:
- provide gpu_cache_flush tracepoint
- improve dma_fence signalling latency
- improve locking
- export scheduling information via debugfs
- Validate user-space input against firmware limits
qaic:
- reject BOs that exceed maximum page count
- add missing include statements
verisilicon:
- fix hardware cursor offsets
vkms:
- implement YUV-to-RGB with fixed-matrix colorop
gma500:
- avoid unsupported ARGB formats in primary plane
hibmc:
- handle vblank interrupts correctly
ivpu:
- add DRM_IVPU_CAP_CMDQ_SET_PRIORITY
- support command-queue priority ioctl
- Simplify NULL-pointer handling in cleanup code
arcpgu:
- replace simple-display pipeline with regular atomic helpers
aspeed:
- replace simple-display pipeline with regular atomic helpers
gm12u320:
- replace simple-display pipeline with regular atomic helpers
imagination:
- various improvement to firmware interaction
- add job to pvr_job_submit_fw trace event
mali-dp:
- fix runtime PM leak
mcde:
- replace simple-display pipeline with regular atomic helpers
p111:
- replace simple-display pipeline with regular atomic helpers
- drop unsupported alpha formats from primary plane
rcar-du:
- support Renesas R-Car V4H DSC
- dsi: Support larger transfers with AXI memory
- Support RZ/G3L SoC
repaper:
- replace simple-display pipeline with regular atomic helpers
rockchip:
- dsi: improve PHY timings
ssd130x:
- support Solomon SSD1351 OLED plus DT bindings
- ssd133x: upgrade color format to RGB565
- ssd132x: Set correct hardware window when clearing screen
tve200:
- replace simple-display pipeline with regular atomic helpers
xen:
- replace simple-display pipeline with regular atomic helpers
v3d:
- improve job handling under perfmon
vc4:
- reliably reset V3D
- drop brcm,vc4-v3d compatible
virtio:
- fix damage handling
- Support ARGB8888 for virtio primary planes.
host1x:
- Support partitioning
imx:
- Replace simple-display with regular atomic helpers
mxsfb:
- Support bus formats plus DT bindings
tegra:
- improve syncobj handling on submit
panfrost:
- add Mali-G68 support
- improve GPU reset handling
rockchip:
- add HDMI 2.0 support to dw-hdmi-qp
- improve HPD handling"
* tag 'drm-next-2026-10-21' of https://gitlab.freedesktop.org/drm/kernel: (2324 commits)
drm/adp: Switch to drm_atomic_helper_connector_create_state
drm/malidp: Convert to atomic_create_state
drm/vc4: Switch to drm_atomic_helper_connector_create_state
drm/sysfb: Switch to drm_atomic_helper_connector_create_state
drm/solomon: ssd130x: Switch to drm_atomic_helper_connector_create_state
drm/imx: ipuv3: Switch to drm_atomic_helper_connector_create_state
drm/hyperv: Switch to drm_atomic_helper_connector_create_state
drm/bridge: megachips: Switch to drm_atomic_helper_connector_create_state
drm/bridge: lontium-lt8912b: Switch to drm_atomic_helper_connector_create_state
drm/arm: komeda: Switch to drm_atomic_helper_connector_create_state
drm/appletbdrm: Fix incorrect error message on encoder attach failure
drm/sun4i: hdmi: Convert to drmm_connector_hdmi_init()
drm/rockchip: rk3066_hdmi: Advertise HDMI 1.4 capabilities
drm/bridge: lontium-lt9611: Advertise HDMI 1.4 capabilities
drm/bridge: ite-it66121: Advertise HDMI 1.2 capabilities
drm/bridge: ite-it6263: Advertise HDMI 1.3 capabilities
drm/bridge: ite-it6263: Drop redundant .mode_valid hook
drm/bridge: inno-hdmi: Advertise HDMI 1.2 capabilities
drm/bridge: adv7511: Advertise HDMI 1.2 capabilities
drm/sched: Document entity->stopped is protected by entity->lock
...
|
||
|
Cen Zhang
|
d74eb09af5 |
ALSA: pcm: Drain proc callbacks at device disconnect
Disconnecting an individual PCM leaves its proc files accessible until
snd_pcm_free_stream(). HDA codec-only sysfs unbind can take this path
while the controller and card remain registered. An open proc file pins
the card module, but does not hold a codec PCM reference.
With CONFIG_SND_VERBOSE_PROCFS, a prealloc write is buffered until file
release. Without an attached PCM runtime, its release can replace the
DMA buffer after final PCM cleanup has already freed the preallocation:
HDA codec unbind prealloc file release
---------------- ---------------------
hda_codec_driver_remove()
snd_hda_codec_disconnect_pcms()
snd_device_disconnect()
snd_pcm_dev_disconnect()
/* proc nodes remain */
snd_hda_codec_cleanup_for_unbind()
codec_release_pcms()
snd_device_free()
snd_pcm_free()
free preallocated buffer
snd_info_text_entry_release()
snd_pcm_lib_preallocate_proc_write()
replace DMA buffer
remove stream proc nodes
free substream
The later proc rundown can itself invoke this buffered write and leave
the replacement allocation without a final free. A concurrent release
can also overlap the earlier buffer cleanup.
Extract snd_info_disconnect_entry() from snd_info_free_entry() to remove
proc nodes and drain callbacks without freeing the info entry objects.
Use it for both stream directions at PCM disconnect. Finish the existing
PCM state and device disconnection under open_mutex, then drop that lock
before proc rundown: even an otherwise idle proc file can run its
buffered release callback, which takes open_mutex, during proc_remove().
Keep entry ownership and final cleanup unchanged, including the saved
OSS child entries. As with existing info entry teardown, callers must
serialize registration with disconnection and release.
Suggested-by: Takashi Iwai <tiwai@suse.de>
Assisted-by: LLM
Signed-off-by: Cen Zhang <zzzccc427@gmail.com>
Link: https://patch.msgid.link/pm-pmb-2439c851f82c443c3600-v7-2774a482b7f03e1fef60@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
|
||
|
Richard Fitzgerald
|
6cc7db9fdd |
ASoC: cs35l56: Wait for firmware timer expiry before system suspend
On CS35L5x firmware older than 3.13.7 (B0 silicon) and 4.7.16 (B2 silicon)
a SoundWire bus reset is not allowed within 250ms of the last firmware
timer start.
This is already avoided during runtime suspend by the various idle
timeouts. System suspend can happen at any time so needs special
protection. The driver cannot cancel the firmware timer, so it must wait
long enough for the timer to expire.
The delay is placed in the suspend stage because typically this has less
impact on end users than delays in resuming. The amp is in PS3 power
state when suspending and no new timers will be started in this state.
An extra 10ms is added to the delay to avoid a race on the exact instant
the firmware timer expires.
There is no need to have the delay for every driver instance. The timers
on each amp will expire in parallel, so the delay is only needed once.
A global flag is used so that the first instance to reach its suspend()
callback will delay and then clear the flag. The cs35l56_fw_idle_wait_lock
mutex is to ensure this is still safe if async_suspend was ever enabled
for SoundWire devices.
Fixes:
|
||
|
Marco Giunta
|
fc49516fbf |
ASoC: aw88399: pass firmware name as argument
Pass the ACF firmware filename as an argument to aw88399_request_firmware_file() instead of hardcoding AW88399_ACF_FILE. Both existing callers (ASoC and HDA) pass AW88399_ACF_FILE to preserve current behavior. Also add missing newlines to the log messages of the modified lines. This allows the HDA side codec driver to request per-model firmware files in the next patch. Tested-by: Xia Yun'an <imitoy@imitoy.top> Signed-off-by: Marco Giunta <marco_giunta@outlook.it> Signed-off-by: Takashi Iwai <tiwai@suse.de> Link: https://patch.msgid.link/SN6PR19MB2303DB0BF41797A38EB04CBFFC992@SN6PR19MB2303.namprd19.prod.outlook.com |
||
|
Takashi Iwai
|
31fd009c28 |
ASoC: Updates for v7.4
There's an awful lot of cleanup work in this pull request, lots from Bui
Duc Phuc, Pengpeng Hou, HyeongJun An and Chancel Liu cleaning up detail
issues in drivers in addition to Mormoto-san's ongoing framework work.
This time Morimoto-san's work included enabling auto_selectable_formats
so there's less manual configuration required for DAI links.
There's also been a huge amount of upstreaming activity from Qualcomm,
some pain there but hopefully enough has now landed for things to be
smoother in future.
- Use auto_selectable_formats in most drivers to reduce the amount of
manual configuration required for DAI links.
- Support for compressed audio on SOF IPC4 systems.
- Support for AMD ACP 7.B and 7.F, AmLogic A9 and T7, Airoha AN7581,
ESS Technology ES9039Q2M, Intel Cherry Trail with RT5688, Nuvoton
NAU83G60, nVidia systems with WM8994, Qualcomm QAIF, Senary I2S, WCD9378
and various platforms, Realtek RT766 and RT767, Senary SN624x
I also mistakenly merged some SPI changes in here then applied more
patches on top before I noticed (it looks like this was b4's base
selection logic picking a bad base for some ASoC work), highlights there
are:
- Improvements for spidev_test to cover additional use cases, plus be a
bit easier to use.
- Push more Tegra210 QSPI handling into interrupt context for
performance improvements.
- Support for Qualcomm QPIC SNAND v2 and RealTek RTD1625 NOR.
- Documentation clarifications.
- Fixes for some runtime PM and error handling issues.
- Support for R-Car Gen5.
(this should also be going in via my SPI pull request)
-----BEGIN PGP SIGNATURE-----
iHUEABYKAB0WIQReagvpf3TrrA7BoYYv73Ows9A4iQUCatYeBwAKCRAv73Ows9A4
iZGkAP42Kan4kjk94MkmNDLX76vzffRYznFmexPQGrFqwkzt/gD+Kd5NDbDs5U4m
D5rPlU6xLbRAl+8VztbWX2lhTWZPKwA=
=MEqI
-----END PGP SIGNATURE-----
Merge tag 'asoc-v7.4' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus
ASoC: Updates for v7.4
There's an awful lot of cleanup work in this pull request, lots from Bui
Duc Phuc, Pengpeng Hou, HyeongJun An and Chancel Liu cleaning up detail
issues in drivers in addition to Mormoto-san's ongoing framework work.
This time Morimoto-san's work included enabling auto_selectable_formats
so there's less manual configuration required for DAI links.
There's also been a huge amount of upstreaming activity from Qualcomm,
some pain there but hopefully enough has now landed for things to be
smoother in future.
- Use auto_selectable_formats in most drivers to reduce the amount of
manual configuration required for DAI links.
- Support for compressed audio on SOF IPC4 systems.
- Support for AMD ACP 7.B and 7.F, AmLogic A9 and T7, Airoha AN7581,
ESS Technology ES9039Q2M, Intel Cherry Trail with RT5688, Nuvoton
NAU83G60, nVidia systems with WM8994, Qualcomm QAIF, Senary I2S, WCD9378
and various platforms, Realtek RT766 and RT767, Senary SN624x
I also mistakenly merged some SPI changes in here then applied more
patches on top before I noticed (it looks like this was b4's base
selection logic picking a bad base for some ASoC work), highlights there
are:
- Improvements for spidev_test to cover additional use cases, plus be a
bit easier to use.
- Push more Tegra210 QSPI handling into interrupt context for
performance improvements.
- Support for Qualcomm QPIC SNAND v2 and RealTek RTD1625 NOR.
- Documentation clarifications.
- Fixes for some runtime PM and error handling issues.
- Support for R-Car Gen5.
(this should also be going in via my SPI pull request)
|
||
|
Cen Zhang
|
f0780cfa6a |
ALSA: oss: Keep emulation modules loaded until object teardown
OSS proc entries and notifier callbacks can remain in use without an
open OSS device file. Normal snd-pcm-oss removal can therefore delete
an existing PCM's OSS proc entry while late HDA codec binding repeats
snd_card_register() on the same live card:
OSS PCM module unload Card registration
--------------------- -----------------
snd_info_free_entry(entry)
proc_remove(entry->p)
clear entry->p
snd_info_card_register()
republish linked entry
unlink and free entry
The new proc node retains a pointer to freed storage. Mixer OSS removal
can likewise release an adapter while a card notification still uses it.
Hold a snd-pcm-oss module reference for each PCM registered with its
notifier and a snd-mixer-oss reference for each card adapter. Release
them at final unregister or FREE, after proc and adapter cleanup. Normal
module unload can no longer initiate removal while these objects exist.
Track PCM OSS registration with a separate bool registered. Unlike
oss.reg, this state also covers unmapped PCMs and remains set across
DISCONNECT until final unregister. BUILD-state and creation-error cleanup
must not drop a reference when registration never acquired one. The PCM
notifier's register_mutex serialization keeps the final put ahead of
notifier removal and module teardown until dispatch has finished.
For mixer OSS, serialize callback publication, dispatch and withdrawal
in the core so module exit waits for callbacks, including one dropping
the last reference, to return. Keep card enumeration in the OSS module,
with card references released after dispatch drops the mutex. Ignore
duplicate REGISTER notifications so a delayed registration cannot
replace an adapter retained across DISCONNECT and leak its module pin.
Partial HDA codec teardown can still remove an individual PCM while the
card remains registered; its object-lifetime handling is separate.
Fixes:
|
||
|
Takashi Iwai
|
a19bf815f4 |
ALSA: jack: Expose injection debugfs at device register phase
Currently we add debugfs interfaces for jack injection (with CONFIG_SND_JACK_INJECTION_DEBUG) at creating jack kctls in snd_jack_kctl_add(). This means that those debugfs interfaces are already exposed to user-space at the early probe phase -- that is, it allows user-space already fiddling with it, while other components are still being initialized and hidden until snd_card_register(). Depending on the driver implementation, such behavior can be an unpleasant surprise. For aligning the device exposure behavior, move the debugfs registration at the device register phase, too. snd_jack_kctl_add() may still add the corresponding debugfs interfaces (for the dynamically added jacks, if any), but it's done only conditionally after the card has been registered. Reviewed-by: Cen Zhang <zzzccc427@gmail.com> Signed-off-by: Takashi Iwai <tiwai@suse.de> Link: https://patch.msgid.link/20261016140653.4406-1-tiwai@suse.de |
||
|
Mark Brown
|
5c92a5c561
|
ASoC: soc-component: move snd_soc_component_xxx() to soc-component.c
Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> says: I'm now posting ASoC Capsuling patches. Current status, and this patch-set postion is below. This patch-set moves Component related functions to soc-component.c x: done o: This patch-set [x] move DAI functions [x] add new DAI functions [o] move Component functions [ ] move Card functions [ ] add new Component functions [ ] rename DAI/Component list [ ] move Card functions [ ] add new Card functions [ ] adjust Test [ ] use new Card register [ ] use new functions on all drivers [ ] Capsule DAI/Component/Card Link: https://patch.msgid.link/87pkxdyoml.wl-kuninori.morimoto.gx@renesas.com |
||
|
Kuninori Morimoto
|
19224d29ff
|
ASoC: soc-component: rename snd_soc_component_async_complete()
snd_soc_component_async_complete() is regmap related function. Let's add _regmap_ on function name. It renames function name - snd_soc_component_async_complete() + snd_soc_component_regmap_async_complete() Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Reviewed-by: Alvin Šipraga <alvin.sipraga@analog.com> Link: https://patch.msgid.link/877bjlyokw.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown <broonie@kernel.org> |
||
|
Kuninori Morimoto
|
1fec554d55
|
ASoC: soc-component: move snd_soc_lookup_component() to soc-component.c
struct snd_soc_component will be capsuled soon, its member will not be able to access from non soc-component.c. Move snd_soc_lookup_component() to soc-component.c It renames function name snd_soc_lookup_component_nolocked() -> snd_soc_component_lookup_nolock() snd_soc_lookup_component() -> snd_soc_component_lookup() snd_soc_lookup_component_by_name() -> snd_soc_component_lookup_by_name() Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Reviewed-by: Alvin Šipraga <alvin.sipraga@analog.com> Link: https://patch.msgid.link/878q41yokz.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown <broonie@kernel.org> |
||
|
Kuninori Morimoto
|
614749f16e
|
ASoC: soc-component: move snd_soc_component_active() to soc-component.c
struct snd_soc_component will be capsuled soon, its member will not be able to access from non soc-component.c. Move snd_soc_component_active() to soc-component.c Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Reviewed-by: Alvin Šipraga <alvin.sipraga@analog.com> Link: https://patch.msgid.link/87bj8xyol6.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown <broonie@kernel.org> |
||
|
Kuninori Morimoto
|
3f78fa3893
|
ASoC: soc-component: move snd_soc_component_cache_sync() to soc-component.c
struct snd_soc_component will be capsuled soon, its member will not be able to access from non soc-component.c. Move snd_soc_component_cache_sync() to soc-component.c It renames function name - snd_soc_component_cache_sync() + snd_soc_component_regmap_cache_sync() Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Reviewed-by: Alvin Šipraga <alvin.sipraga@analog.com> Link: https://patch.msgid.link/87cxtdyol9.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown <broonie@kernel.org> |
||
|
Kuninori Morimoto
|
5c90483441
|
ASoC: soc-component: move snd_soc_component_to_dapm() to soc-component.c
struct snd_soc_component will be capsuled soon, its member will not be able to access from non soc-component.c. Move snd_soc_component_to_dapm() to soc-component.c Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Reviewed-by: Alvin Šipraga <alvin.sipraga@analog.com> Link: https://patch.msgid.link/87ecdtyolc.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown <broonie@kernel.org> |
||
|
Kuninori Morimoto
|
8b1121c5df
|
ASoC: soc-component: move soc_{probe/remove}_component() to soc-component.c
struct snd_soc_component will be capsuled soon, its member will not be
able to access from non soc-component.c.
Move soc_{probe/remove}_component() to soc-component.c
It renames function name
- soc_{probe/remove}_component()
+ snd_soc_component_{probe/remove}()
Then soc-component.c had original snd_soc_component_{probe/remove}() which
is wrapper function. These wil be deployed internally.
Releted fucntions also be moved. It renames function name.
soc_set_name_prefix() -> snd_soc_component_set_name_prefix()
soc_init_component_debugfs() -> snd_soc_component_debugfs_init()
soc_cleanup_component_debugfs() -> snd_soc_component_debugfs_cleanup()
Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Reviewed-by: Alvin Šipraga <alvin.sipraga@analog.com>
Link: https://patch.msgid.link/87fqy9yoli.wl-kuninori.morimoto.gx@renesas.com
Signed-off-by: Mark Brown <broonie@kernel.org>
|
||
|
Kuninori Morimoto
|
ee0daa7a31
|
ASoC: soc-component: move snd_soc_component_fixup_controls()
snd_soc_component_xxx_controls() are located between _probe() and _remove() in soc-component.c, and are located in scattered positions in soc-component.h. Fixup them. Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Reviewed-by: Alvin Šipraga <alvin.sipraga@analog.com> Link: https://patch.msgid.link/87jynlyolt.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown <broonie@kernel.org> |
||
|
Kuninori Morimoto
|
ed2c53c841
|
ASoC: soc-component: move snd_soc_add_component_controls()
snd_soc_add_component_controls() is Component related function. And its parameter will be capsuled soon, will be not enable to access from soc-core.c. Move it to soc-component.c It renames function name - snd_soc_add_component_controls() + snd_soc_component_add_controls() Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Reviewed-by: Alvin Šipraga <alvin.sipraga@analog.com> Link: https://patch.msgid.link/87ld81yolw.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown <broonie@kernel.org> |
||
|
Kuninori Morimoto
|
0ce431a9fc
|
ASoC: soc-component: replace bool member to bit field
soc-component has meny bit fields (A), no need to have bool member (B).
Let's makes it as bit field, too
struct snd_soc_component_driver {
...
^ unsigned int module_get_upon_open:1;
(A) unsigned int idle_bias_on:1;
| unsigned int suspend_bias_off:1;
| ...
v unsigned int legacy_dai_naming:1;
...
(B) bool use_dai_pcm_id;
...
}
Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Reviewed-by: Alvin Šipraga <alvin.sipraga@analog.com>
Link: https://patch.msgid.link/87mrshyom0.wl-kuninori.morimoto.gx@renesas.com
Signed-off-by: Mark Brown <broonie@kernel.org>
|
||
|
Kuninori Morimoto
|
3901d17c97
|
ASoC: soc-component: tidyup be_hw_params_fixup() define position
be_hw_params_fixup() is one of snd_soc_component_driver callback function, but is defined as alone in a remote location. Let's move it to the same place as other callbacks. Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Reviewed-by: Alvin Šipraga <alvin.sipraga@analog.com> Link: https://patch.msgid.link/87o6cxyom4.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown <broonie@kernel.org> |
||
|
Mark Brown
|
f500b6437f
|
ASoC: Series of loose fixes
Amadeusz Sławiński <amade@asmblr.net> says: Following current fashion of poking code with LLM to see what issues it finds. Some are minor, other more likely to cause some real issues like the one with snd_soc_limit_volume() returning positive value, while callers do simple if (ret) check. Link: https://patch.msgid.link/20261014200608.118770-1-amade@asmblr.net |
||
|
Amadeusz Sławiński
|
9df30adce8
|
ASoC: soc-component: Fix return type of snd_soc_pcm_component_pointer()
Both caller and pointer callback expect the return value to be
snd_pcm_uframes_t, however it was defined incorrectly leading to
potential truncation of returned value.
Fixes:
|
||
|
Takashi Iwai
|
6904743ab7 |
ALSA: core: Serialize snd_refcount put and sync
When a thread tries to sync-and-destroy the resource with
snd_refcount_sync(), it might lead to a UAF in a very slight time
window. Namely, snd_refount_put() calls wake_up() after
atomic_dec_and_test(), but wait_event() in snd_refcount_sync() checks
the condition via atomic_test() without serialization, hence the
thread that called snd_refcount_sync() can continue immediately to
release the resource before another thread calls wake_up().
For avoiding the race above, introduce the spinlock and take it at
snd_refcount_put() and snd_refcount_sync() in order to serialize the
operations.
Fixes:
|
||
|
Mark Brown
|
18123081c0
|
ASoC: qcom: Add QAIF driver for Shikra audio platform
Harendra Gautam <harendra.gautam@oss.qualcomm.com> says:
This series introduces the Qualcomm Audio Interface (QAIF) driver for
the Shikra audio platform.
Hardware IP Overview
====================
QAIF (Qualcomm Audio Interface) is a fully configurable DMA-based audio
subsystem used to transmit and receive audio data over serial audio
interfaces (PCM, TDM, MI2S) and to provide a DMA interface for internal
codec connections. It manages two independent data paths:
AIF (Audio Interface): multiple multi-lane Unified Audio Interfaces,
each supporting up to 8 independent data lanes. Each lane is individually
configurable as TX (output/speaker) or RX (input/mic). All lanes of an
interface share a single bit clock and frame sync. Supported modes are
PCM (short/long sync), TDM, and MI2S (stereo/mono). Per-interface
configuration includes sync source (master/slave), sync mode, sync delay,
sync inversion, slot width (8/16/24/32-bit), sample width, active slot
masks (up to 32 slots), bits-per-lane frame size, lane enable/direction
masks, loopback, output-enable control, and full-cycle path support for
long chip-to-chip connections.
CIF (Codec Interface): multiple RDDMA (playback) and WRDMA (capture)
channels connecting to an internal codec over a parallel bus. Each channel
supports active-channel enable mask (up to 16 channels), frame-sync
selection, frame-sync delay, frame-sync output gating, dynamic clock
gating, and 16-bit packing/unpacking.
Note on RX/TX naming convention: in QAIF, TX refers to the output
(speaker/playback) direction and RX refers to the input (mic/capture)
direction. This applies to both AIF lane directions and CIF slot/mask
properties.
DMA Engine: RDDMA fetches audio from DDR/TCM/LPM into a shared SRAM
latency buffer (SHRAM) and drains it to the interface. WRDMA collects
data from the interface into SHRAM and writes it to memory. Each DMA
owns a private SHRAM region defined by start address and length registers.
Burst sizes of 1/2/4/8/16 beats (64-bit) are supported with up to 4
outstanding transactions per DMA. Two QSB master ports (QXM0 for TCM,
QXM1 for DDR/LPM) provide the memory interface.
Execution Environments (EE): Resources (DMAs, audio interfaces,
interface groups) are partitioned among up to 5 EEs via map registers.
Each EE owns a set of DMAs, audio interfaces, and interface groups, and
receives its own independent interrupt output. The interrupt hierarchy
has a two-level structure: a summary register identifies the event class
(DMA period, underflow/overflow, error response, audio interface
underflow/overflow, group done, rate detector, VFR), and per-resource
status registers identify the specific channel.
Interface Grouping (Bonding): Multiple AIF and CIF interfaces can be
bonded into a group to start synchronously and align their DMA period
interrupts within half a frame duration using the RDDMA padding feature.
Up to 6 groups are supported.
Rate Detector: Two rate detector blocks measure the frequency of
incoming frame sync or word select signals and generate interrupts on
rate change, undetected rate, or sync timeout.
Block Diagram
=============
System Memory (DDR / LPM / TCM)
+---------------------------------+
| Circular Buffers (ping-pong) |
+----------+----------+-----------+
| ^
64-bit AXI 64-bit AXI
| |
+----------v----------+-----------+
| QSB Master Ports |
| +----------+ +----------+ |
| | QXM0 | | QXM1 | |
| +----+-----+ +-----+----+ |
+-------|--------------|----------+
| |
+-------v--------------v----------+
| Shared RAM (SHRAM) |
| +------------+ +------------+ |
| | QXM0 Read | | QXM0 Write | |
| | SHRAM | | SHRAM | |
| +------------+ +------------+ |
| +------------+ +------------+ |
| | QXM1 Read | | QXM1 Write | |
| | SHRAM | | SHRAM | |
| +------------+ +------------+ |
+---+--------+--------+-------+---+
| | | |
+---v--+ +--v---+ +--v---+ +-v----+
|RDDMA | |RDDMA | |WRDMA | |WRDMA |
| AIF | | CIF | | AIF | | CIF |
|[0..n]| |[0..n]| |[0..n]| |[0..n]|
+--+---+ +--+---+ +--+---+ +-+----+
| | ^ ^
| TX | TX | RX | RX
v v | |
+--+--------------------+ +----+----------+
| Unified Audio Intf | | Codec DMA |
| (AIF 0..12) | | Interface |
| | | (CIF) |
| AUD_INTFa block: | | |
| - Serializer (TX) | | RDDMA: DDR -> |
| - De-serializer (RX) | | internal |
| - Sync gen/detect | | codec |
| - Up to 8 data lanes | | WRDMA: codec |
| - PCM / TDM / MI2S | | -> DDR |
| - Near Pad Logic | | Up to 16 ch |
+--+--------------------+ +----+----------+
| Lane 0..7 (TX/RX) | Parallel bus
| Bit clk + Frame sync | + Frame sync
v v
+--+--------+ +------+------+
| External | | Internal |
| Serial | | Digital |
| Peripherals| | Codec |
| (PCM/TDM/ | | (Bolero/ |
| MI2S) | | WCD) |
+-----------+ +-------------+
Software Design
===============
The driver follows the standard ALSA SoC split:
qaif-cpu.c: CPU DAI component. Manages clocks, implements DAI ops
(startup/shutdown/hw_params/trigger) for both AIF and CIF
paths using direct regmap_update_bits() calls with address macros from
qaif-reg.h, registers an of_xlate_dai_name callback so that sound-dai
references using non-sequential DAI IDs resolve correctly, parses
per-interface AIF configuration from DT child nodes, and provides
runtime PM suspend/resume via pm_runtime_force_suspend/resume for
power collapse. AIF child nodes use standard properties (dai-format,
dai-tdm-slot-*, qcom,qaif-aif-lane-map) without a compatible string;
the protocol is identified by dai-format and set_fmt() is called by
the machine driver.
qaif-platform.c: PCM platform component. Handles DMA buffer allocation
(dma_alloc_pages()), PCM ops (open/close/hw_params/hw_free/prepare/trigger/
pointer/mmap/copy), and table-driven two-level IRQ dispatch with
period-elapsed notification.
qaif-shikra.c: Shikra SoC-specific variant descriptor. Provides
register base addresses, DMA channel counts, SHRAM geometry, clock
names and the DAI driver array. This abstraction keeps the core driver
portable across future QAIF integrations.
qaif.h / qaif-reg.h: Shared data structures, constants and the complete
MMIO register address map consumed by both the CPU and platform drivers.
soc-core.c: This series adds snd_soc_of_xlate_dai_name() as a generic
ASoC helper that resolves a sound-dai phandle argument to a DAI name by
searching the component DAI list by ID. Both lpass-cpu.c and qaif-cpu.c
assign it directly as .of_xlate_dai_name, removing their private
implementations.
The series is split by functionality to aid review -- register map and
data structures first, then CPU DAI ops with regmap and DT parsing, the
of_xlate helper, PCM ops, IRQ handling and finally the Shikra variant
glue.
Link: https://patch.msgid.link/20261013-b4-qaif-shikra-audio-v9-0-f3022e28f2fd@oss.qualcomm.com
|
||
|
Harendra Gautam
|
02298cc296
|
ASoC: soc-core: Add snd_soc_of_xlate_dai_name() generic helper
Some ASoC CPU DAI drivers need to resolve a sound-dai phandle argument to a DAI name by matching the argument against the component's DAI IDs. lpass-cpu carries a local implementation of this lookup. Add snd_soc_of_xlate_dai_name() to soc-core.c as a generic helper that can be assigned directly to the .of_xlate_dai_name component driver callback. It iterates the component's DAI list using for_each_component_dais() and matches by DAI ID. Signed-off-by: Harendra Gautam <harendra.gautam@oss.qualcomm.com> Link: https://patch.msgid.link/20261013-b4-qaif-shikra-audio-v9-5-f3022e28f2fd@oss.qualcomm.com Signed-off-by: Mark Brown <broonie@kernel.org> |
||
|
Takashi Iwai
|
91d0048a97 |
ALSA: pcm: Add refcount for races between drain and unlink
We added a workaround for the case where a linked substream gets unlinked during the drain operation by another substream of the same linked group in the commit |
||
|
Mark Brown
|
ac32e27bac | Merge asoc/for-7.4 into asoc-next | ||
|
Cen Zhang
|
6215cf3ff5 |
ALSA: vmaster: Serialize hook registration with control callbacks
An HDA virtual-master hook must have its private argument initialized
before a control callback can invoke it. snd_hda_add_vmaster_hook()
installs the trampoline through snd_ctl_add_vmaster_hook(), which stores
master->hook before master->hook_private_data without serialization.
When a codec with a vmaster mute hook binds to an already registered
card, snd_hda_gen_build_controls() publishes and initializes the Master
Playback Switch before installing the hook. A native write that changes
the switch can then run in the following order:
1. The codec bind path publishes and initializes the master control in
__snd_hda_add_vmaster(), then calls snd_hda_add_vmaster_hook().
2. The hook setter stores master->hook, but has not yet stored its
private argument.
3. SNDRV_CTL_IOCTL_ELEM_WRITE takes controls_rwsem and calls
master_put() while the setter remains between those stores.
4. master_put() sees the callback and invokes vmaster_hook() with a
NULL argument. The trampoline dereferences it before the setter
can complete publication.
The write lock held by snd_ctl_elem_write() does not exclude the hook
setter, so this can cause a NULL pointer dereference. Take the same
controls_rwsem for writing inside snd_ctl_add_vmaster_hook() so the
callback and its argument are installed together with respect to
native control callbacks. Pass the card into the helper and update
the HDA caller, keeping the lock in the ALSA core. Release it when
registration returns, before the caller synchronizes the hook.
KASAN report as below:
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
CPU: 1 UID: 0 PID: 499 Comm: alsa-vmaster-tr Not tainted 7.2.0-rc6-pmb-bt-functional-v1+ #1 PREEMPT(lazy)
Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:vmaster_hook+0x35/0xb0
Code: f5 53 48 89 fb 48 83 ec 08 e8 57 f0 9a fc eb 50 e8 50 f0 9a fc 48 8d 7b 08 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 75 59 48 8d 7b 10 48 8b 43 08 48 ba 00 00 00 00 00 fc
RSP: 0018:ffff888117647cd0 EFLAGS: 00010212
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff84e9ff50
RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000008
RBP: 0000000000000001 R08: 0000000000000001 R09: 0000000000000001
R10: ffffffff89427457 R11: ffff888115ad1d00 R12: ffffffff84e9ff30
R13: ffff888114943ca0 R14: 0000000000000000 R15: 0000000000000001
FS: 00007fe8167b3780(0000) GS:ffff88826b7e3000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000557c8c2842a8 CR3: 000000011579f005 CR4: 0000000000770ef0
PKRU: 55555554
Call Trace:
<TASK>
master_put+0x20e/0x2b0
snd_ctl_elem_write+0x37f/0x5e0
snd_ctl_ioctl+0x997/0xdd0
? __pfx_snd_ctl_ioctl+0x10/0x10
? srso_alias_return_thunk+0x5/0xfbef5
? selinux_file_ioctl+0xaa/0x280
? __pfx_snd_ctl_ioctl+0x10/0x10
__x64_sys_ioctl+0x163/0x1d0
do_syscall_64+0x115/0x6a0
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fe8168c291b
Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00
RSP: 002b:00007fffab0cb150 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fe8168c291b
RDX: 00007fffab0cb310 RSI: 00000000c4c85513 RDI: 0000000000000003
RBP: 00007fffab0cb310 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 00007fffab0cb1c0 R14: 0000000000000001 R15: 0000557c4f71fd10
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
Fixes:
|
||
|
Takashi Iwai
|
a08e335c19 |
Revert "ALSA: hda/tas2781: Enable bass speakers support"
This reverts commit
|
||
|
Mark Brown
|
bce34abda5
|
ASoC: tegra: Support auxiliary devices
Svyatoslav Ryhel <clamor95@gmail.com> says: Add support for auxiliary devices, such as amplifiers, sound-muxes or dsp, to be added to the sound card. Link: https://patch.msgid.link/20261013180253.477605-1-clamor95@gmail.com |
||
|
Mark Brown
|
4f173a0fee
|
ASoC: core: Create new components in sane state
Cezary Rojewski <cezary.rojewski@intel.com> says: There is a gap between snd_soc_component_alloc() and snd_soc_register_component(). A driver that obtains a component object through snd_soc_component_alloc() receives an object in uninitialized state. soc_component_initialize() is the function responsible for bringing it into a sane one but it is not accessible by the framework users. Example of the uninitialized members are the lists e.g.: comp->dai_list. The framework shall prevent manipulation of uninitialized components. Introduce snd_soc_component_new() which acts as a constructor: allocates and initializes the component object before returning it to the caller. Given the quite recent discussion related to all things component-register [1], decided to stick to the "register" wording and renamed soc_component_add() to snd_soc_component_register(). With that, register/unregister pattern is kept. At the same time, the update brings a clear division between: 1) snd_soc_component_register(component..) 2) snd_soc_register_component(dev..) A driver uses 1) when operating on pre-constructed component object explicitly and 2) when they want the ASoC framework to do everything for them. Parameter "name" is added to the ctor parameter list as it is one of the fields that is always initialized, see the 'if (!component->name)' within soc_component_initialize(). Private data on the other hand is not so opted out of including it. And thus snd_soc_component_set_priv() remains intact. [1]: https://lore.kernel.org/all/87y0f2rz8l.wl-kuninori.morimoto.gx@renesas.com/ Link: https://patch.msgid.link/20261007133353.455185-1-cezary.rojewski@intel.com |
||
|
Cezary Rojewski
|
146caaa16f
|
ASoC: core: Remove unused component-register members
With the new component constructor, functions snd_soc_component_alloc(), snd_soc_component_set_name() and soc_component_initialize() become unused. Remove them and drop the generic macro as there is only one snd_soc_register_component() function. Cc: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Signed-off-by: Cezary Rojewski <cezary.rojewski@intel.com> Link: https://patch.msgid.link/20261007133353.455185-8-cezary.rojewski@intel.com Signed-off-by: Mark Brown <broonie@kernel.org> |
||
|
Cezary Rojewski
|
4e2db62172
|
ASoC: core: Rename and export soc_component_add()
To keep the register/unregister pattern intact, rename to the function before exporting it. This concludes the registration update, leaving the following two options available to the callers: 1) snd_soc_component_register(component..) 2) snd_soc_register_component(dev..) A driver uses 1) when attempting to register a pre-constructed component object explicitly and 2) when they want the ASoC framework to do the entire job for them. Cc: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Signed-off-by: Cezary Rojewski <cezary.rojewski@intel.com> Link: https://patch.msgid.link/20261007133353.455185-3-cezary.rojewski@intel.com Signed-off-by: Mark Brown <broonie@kernel.org> |
||
|
Cezary Rojewski
|
0f2bec6921
|
ASoC: core: Add component constructor
There is a gap between snd_soc_component_alloc() and snd_soc_register_component(). A driver that obtains a component object through snd_soc_component_alloc() receives an object in uninitialized state. soc_component_initialize() is the function responsible for bringing it into a sane one but it is not accessible by the framework users. The framework shall prevent manipulation of uninitialized components. Introduce snd_soc_component_new() which acts as a constructor: allocates and initializes the component object before returning it to the caller. Cc: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Signed-off-by: Cezary Rojewski <cezary.rojewski@intel.com> Link: https://patch.msgid.link/20261007133353.455185-2-cezary.rojewski@intel.com Signed-off-by: Mark Brown <broonie@kernel.org> |
||
|
Takashi Iwai
|
16e585b72f |
Merge branch 'for-linus' into for-next
Signed-off-by: Takashi Iwai <tiwai@suse.de> |
||
|
Dave Airlie
|
a486b8b80d |
Linux 7.3-rc6
-----BEGIN PGP SIGNATURE----- iQFSBAABCgA8FiEEq68RxlopcLEwq+PEeb4+QwBBGIYFAmrCuuUeHHRvcnZhbGRz QGxpbnV4LWZvdW5kYXRpb24ub3JnAAoJEHm+PkMAQRiGfEQIAKPMeNxF+q9oTZRD RpIstLSujzELIrCYuvZYGkSQElb8XA+Jor9+DeXF+zP4dkcpLri1BjY+WJojF0ng 6S3qiMQ7T8Z6KW72c5oI/U4IYs8G2D44EZS4e0CPjh+jbvwXEyvft5+TxVnmdIbo cx1DpHzaKWx7swvnknKaLLNSmVBE2Nm0CqCyLf7dUAPvSLTlaC94tJwN21ZjvLlv LIf4GO6J0lAV6ldO8UvTkkVy+cye3iCgZ1xhFnq3MsCqBaIUveff8o9o9xrx4j0x lxSynWezHKzFSZ2+hAL8yx44RdOqKBK1vLVFVDvWXPxKS0+irlcEvh/zSj6V45Ow 7Kcz6nM= =IxpV -----END PGP SIGNATURE----- BackMerge tag 'v7.3-rc6' into drm-next Linux 7.3-rc6 This was requested by Thomas to have a new base to start some branch from Signed-off-by: Dave Airlie <airlied@redhat.com> |
||
|
Takashi Iwai
|
af027278d8 |
ALSA: hda: Make hdac_device.registered a plain bool
The registered field of hdac_device is a bitfield sharing the same word with other bitfields like lazy_cache, and those are updated in a non-atomic read-modify-write manner without any lock. Meanwhile, the registered flag is read from the unsolicited event worker concurrently, so the concurrent updates of the neighboring bitfields may race with it. Convert it to a plain bool for avoiding such a subtle race. Also replace the assignments of 0/1 with false/true accordingly. Assisted-by: LLM Signed-off-by: Takashi Iwai <tiwai@suse.de> Link: https://patch.msgid.link/20261007215650.159871-4-tiwai@suse.de |
||
|
Takashi Iwai
|
f3607b6952 |
ALSA: hda: Stop unsol events and jack polling before codec unbind
At unbinding a codec driver, hda_codec_driver_remove() calls the codec's remove callback that releases the driver resources, followed by snd_hda_codec_cleanup_for_unbind(). Meanwhile, the unsolicited events are processed asynchronously in bus->unsol_work, and snd_hdac_bus_process_unsol_events() checks only codec->registered flag before calling the driver's unsol_event callback without the lock. Since codec->registered is cleared only in snd_hda_codec_cleanup_for_unbind(), and there is no flush of the unsol work at unbinding, the unsol event handler may run concurrently during the running remove callback, which may lead to a UAF. The same problem applies to the jack polling work, which is canceled only after the remove callback. For addressing those races, introduce a new flag unsol_disabled to hdac_device, to be checked it in the unsol event worker, while a new helper snd_hdac_device_disable_unsol() sets this flag and flushes the pending unsol work. The helper is called at hda_codec_driver_remove() together with the cancel of jackpoll_work to assure that no asynchronous jack handling can run. The flag is cleared again at probing the codec driver, while the events are still blocked by the registered flag until the codec gets registered. Reported-by: Sashiko <sashiko-bot@kernel.org> Assisted-by: LLM Signed-off-by: Takashi Iwai <tiwai@suse.de> Link: https://patch.msgid.link/20261007215650.159871-2-tiwai@suse.de |
||
|
Takashi Iwai
|
5676e013f1 |
ALSA: hda: Use linked list for jack table
So far we've used snd_array infrastructure for managing the
hda_jack_tbl elements, but it turned out that this may lead to a UAF
when a different order of destruction procedure is applied; namely,
each hda_jack_tbl object creates a snd_jack object and sets the
private_data pointing to the hda_jack_tbl, and private_free to release
it. It looks harmless, but since snd_array may reallocate the whole
table at growing, the formerly referred jack pointer may become stale.
Fortunately, currently there is no call pattern that triggers this
issue, so it's only hypothetical, but we should address it in anyway.
There are several ways to address this, and at this time, we rather
redesign the hda_jack_tbl allocations: instead of snd_array(), do a
normal kmalloc() + linked list. There will be more kmalloc calls than
the original code, but as the number of jacks are usually at most
handful, it must not be a problem. This change allows us the
persistent jack pointer, so no stale pointer access can happen any
longer.
This also fixes another reported issue about the stale jack pointer
reference in snd_hda_jack_tbl_new(), too.
Fixes:
|
||
|
Richard Fitzgerald
|
86c8360c97 |
ASoC: cs35l56: Add DAI for SDCA OT25 stream
Add a DAI for the SDCA OT25 stream on SoundWire DP4. The SDCA-defined OT25 stream is an amp reference feedback, typically used for AEC. The firmware outputs this on DP4. The firmware owns all control registers for this stream so there are no mixer controls or any other configuration options. Signed-off-by: Richard Fitzgerald <rf@opensource.cirrus.com> Link: https://patch.msgid.link/20261005155235.1386525-2-rf@opensource.cirrus.com Signed-off-by: Mark Brown <broonie@kernel.org> |
||
|
Mark Brown
|
fed620a78a |
ALSA compress / ASoC compress / SOF: Compressed audio support with IPC4
Peter Ujfalusi <peter.ujfalusi@linux.intel.com> says: This series adds compressed audio support for SOF with IPC4 firmware. Supported formats are PCM, MP3, AAC and VORBIS, the feature set is PAUSE_PUSH/RELEASE, DRAIN and position reporting. Patches 1-5 are prerequisites in the ALSA compress core and in soc-compress.c. These are core fixes rather than driver level workarounds on purpose. The other users of compressed DPCM have DSP internal ports on their BEs, driven by code they own. An Intel/SOF BE ends at a third party CODEC driver which is shared with the non DPCM case and has no reason to know that the FE is compressed. That set of CODECs is open ended, so teaching each of them to cope with a compressed FE does not scale. The core has to hand a BE the same substream state whether the FE is a PCM or a compressed one. Two of these patches change behaviour for the existing users of compressed DPCM, so they would need a look from Qualcomm and NXP: - "ASoC: soc-compress: Implement trigger FE-BE sequencing as with normal PCMs" makes the FE/BE trigger order follow dai_link->trigger[], the way dpcm_fe_dai_do_trigger() does it. Neither sound/soc/qcom/ nor sound/soc/fsl/ sets it, so both default to SND_SOC_DPCM_TRIGGER_PRE: START keeps the current order, but STOP, SUSPEND and PAUSE_PUSH now trigger the BE before the FE. - "ASoC: soc-compress: Stop running dpcm on free" sends a STOP trigger from soc_compr_free_fe() if the DPCM is still in START state, which is the case when the last trigger the stream received was a DRAIN. Patches 6-20 implement the IPC4 compressed support, patch 21 is a Kconfig cleanup. The last two patches enable the feature, in Kconfig for TGL and later and in the topology parser, so the compressed device type only becomes usable once the code behind it is in place. Testing: - IPC4: Arrow Lake, compressed playback on speaker and headphone (cs42l43), MP3, AAC and VORBIS. - IPC3: tested by NXP. This does not cover the STOP on free path above, as they do not implement DRAIN. Link: https://patch.msgid.link/20261007084955.1256-1-peter.ujfalusi@linux.intel.com |
||
|
Peter Ujfalusi
|
176f4f8934 |
ASoC: SOF: ipc4: Handle compressed drain done notification from firmware
The decoder module sends a drain done notification when the last chunk of the stream after the EOS from host has been decoded. The notification is a module notification with 0xc0c0 as magic number in event_id upper 16 bit. Call sof_ipc4_compr_drain_done() when the notification arrives to handle it. Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com> Reviewed-by: Liam Girdwood <liam.r.girdwood@intel.com> Link: https://patch.msgid.link/20261007084955.1256-26-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown <broonie@kernel.org> |
||
|
Peter Ujfalusi
|
9fdc525713 |
ASoC: SOF: ipc4/ipc4-loader: Add SOF_INFO and CODEC_INFO to fw_config_params
SOF_INFO (id == 35) tuple holds tuple structured information about SOF features. The first entry in SOF_INFO is the SOF_CODEC_INFO (id == 0) which contains information about the supported codecs for decode/encode in the booted firmware. If present in the fw_config payload, make a copy of it and store it sof_ipc4_fw_data->codec_info to be used by the compressed code. Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com> Reviewed-by: Liam Girdwood <liam.r.girdwood@intel.com> Link: https://patch.msgid.link/20261007084955.1256-20-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown <broonie@kernel.org> |
||
|
Peter Ujfalusi
|
b7822e6cf3 |
ASoC: SOF: ipc4: Add definition of module data in init_ext object type
The object array of the MODULE_INIT message can carry different types of objects, identified by SOF_IPC4_MOD_INIT_EXT_OBJ_ID in the object header. Add the SOF_IPC4_MOD_INIT_DATA_ID_MODULE_DATA type to pass module specific initialization data to a module. Unlike the existing DP_DATA object, its content is opaque to the driver and its size is variable, defined by the module itself. It is going to be used to configure the decoder and encoder process modules. Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com> Reviewed-by: Liam Girdwood <liam.r.girdwood@intel.com> Link: https://patch.msgid.link/20261007084955.1256-17-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown <broonie@kernel.org> |
||
|
Peter Ujfalusi
|
b04c9229ee |
ALSA: compress: stop active streams on disconnect
Track open compressed streams per device so disconnect can stop active streams and wake waiters before snd_unregister_device(). This aligns compressed stream teardown with PCM disconnect behavior and prevents active userspace streams from running into unregister races. Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com> Reviewed-by: Liam Girdwood <liam.r.girdwood@intel.com> Reviewed-by: Takashi Iwai <tiwai@suse.de> Link: https://patch.msgid.link/20261007084955.1256-4-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown <broonie@kernel.org> |
||
|
Brian Norris
|
eb6237f649 |
ALSA: hda: Discard pm_runtime_put_autosuspend() return value
snd_hdac_power_down() and snd_hdac_power_down_pm() are defined to return
an int, but their return values are never used by any caller.
snd_hdac_power_down() also passes the return value of
pm_runtime_put_autosuspend() to the caller, which is not very useful.
Returning an error code from pm_runtime_put_autosuspend() merely means
that it has not queued up a timer or work item to check whether or not
the device can be suspended and there are many perfectly valid
situations in which that can happen, like after writing "on" to the
device's runtime PM "control" attribute in sysfs for one example.
Modify snd_hdac_power_down() to discard the pm_runtime_put_autosuspend()
return value and change the return types of snd_hdac_power_down() and
snd_hdac_power_down_pm() to void.
No intentional functional impact.
This will facilitate a planned change of the
pm_runtime_put_autosuspend() return type to void in the future, similar
to commit
|
||
|
Mark Brown
|
6158ac6cbe |
ASoC: aw88399: fix BSTS check using vendor driver logic
Marco Giunta <marco_giunta@outlook.it> says: The aw88399 sysst check requires BSTS (boost finished) to assert during startup. On hardware where the boost converter is bypassed via external power supply (EN_HVBAT in BSTCTRL10, i.e. register 0x69 bit 2), BSTS never asserts and init fails. The vendor's generic Android driver (aw883xx, [1]) handles this by reading EN_HVBAT and conditionally skipping the BSTS check. When the original aw88399 driver was ported to the in-tree ASoC driver, this logic was not included. During the development of the HDA side codec driver, I worked around this with a per-instance bsts_unreliable flag set from the HDA scodec driver's per-model quirk table. While functional, this approach requires every new device where the boost converter is bypassed to carry a quirk entry, and prevents users from testing the driver on such devices via the model= alc269 module parameter without a custom kernel to add the entry. This series adds the correct hardware-based check from the vendor driver (patch 1) and removes the now-unnecessary workaround (patch 2), simplifying the code and removing a barrier to testing on new devices. [1] https://www.awinic.com/en/driver/AW88399QNR/594 Link: https://patch.msgid.link/SN6PR19MB230304C2E75499FE23B53885FC8F2@SN6PR19MB2303.namprd19.prod.outlook.com |
||
|
Marco Giunta
|
c5f6155364 |
ASoC: aw88399: remove bsts_unreliable workaround
Now that the shared library correctly skips the BSTS check when the boost converter is bypassed, the per-instance bsts_unreliable flag added as a workaround in the HDA side codec driver is unnecessary. Remove it from the library, the HDA driver, and the shared header. This also simplifies testing the HDA side codec driver on new devices, as new models no longer need a quirk entry to bypass the BSTS check. Users can test via the model= module parameter in alc269 without a custom kernel. Signed-off-by: Marco Giunta <marco_giunta@outlook.it> Link: https://patch.msgid.link/SN6PR19MB2303CC64AF7DEC3C5C98A512FC8F2@SN6PR19MB2303.namprd19.prod.outlook.com Signed-off-by: Mark Brown <broonie@kernel.org> |