The SNDRV_RAWMIDI_STREAM_{OUTPUT,INPUT} ioctls may reallocate
runtime->buffer while other kernel threads are accessing it. If the
underlying krealloc() call frees the original buffer, then this can turn
into a use-after-free.
Most of these accesses happen while the thread is holding runtime->lock,
and can be fixed by just holding the same lock while replacing
runtime->buffer, however we can't hold this spinlock while
snd_rawmidi_kernel_{read1,write1} are copying to/from userspace. We
need to add and acquire a new mutex to prevent this from happening
concurrently with reallocation. We hold this mutex during the entire
reallocation process, to also prevent multiple concurrent reallocations
leading to a double-free.
Signed-off-by: Daniel Rosenberg <drosen@google.com>
bug: 64315347
Change-Id: I05764d4f1a38f373eb7c0ac1c98607ee5ff0eded
[dcagle@codeaurora.org: Resolve trivial merge conflict]
Git-repo: https://android.googlesource.com/kernel/msm
Git-commit: d7193540482d11ff0ad3a07fc18717811641c6eb
Signed-off-by: Dennis Cagle <dcagle@codeaurora.org>
Add one signal enum to indicate that it's the internal WDSP
boot timeout case.
Change-Id: I978745274f6f584cfd693cb5a34ace25cd92dac3
Signed-off-by: Walter Yang <yandongy@codeaurora.org>
Userspace triggers signal to collect WDSP dumps for debug use.
Add the signal for debug dump.
CRs-Fixed: 2146735
Change-Id: I5d0a122e07898e604305bf58fd47d4814d10ca17
Signed-off-by: Walter Yang <yandongy@codeaurora.org>
* 4.9/tmp-ffc9972:
Linux 4.9.62
x86/oprofile/ppro: Do not use __this_cpu*() in preemptible context
x86/smpboot: Make optimization of delay calibration work correctly
can: c_can: don't indicate triple sampling support for D_CAN
can: ifi: Fix transmitter delay calculation
can: sun4i: handle overrun in RX FIFO
drm/bridge: adv7511: Re-write the i2c address before EDID probing
drm/bridge: adv7511: Reuse __adv7511_power_on/off() when probing EDID
drm/bridge: adv7511: Rework adv7511_power_on/off() so they can be reused internally
drm/vmwgfx: Fix Ubuntu 17.10 Wayland black screen issue
rbd: use GFP_NOIO for parent stat and data requests
Input: elan_i2c - add ELAN060C to the ACPI table
MIPS: AR7: Ensure that serial ports are properly set up
MIPS: AR7: Defer registration of GPIO
MIPS: BMIPS: Fix missing cbr address
ASoC: sun4i-spdif: remove legacy dapm components
tools: firmware: check for distro fallback udev cancel rule
selftests: firmware: send expected errors to /dev/null
MIPS: SMP: Fix deadlock & online race
MIPS: Fix race on setting and getting cpu_online_mask
MIPS: SMP: Use a completion event to signal CPU up
MIPS: Fix CM region target definitions
MIPS: microMIPS: Fix incorrect mask in insn_table_MM
drm/i915: Do not rely on wm preservation for ILK watermarks
ALSA: seq: Avoid invalid lockdep class warning
ALSA: seq: Fix OSS sysex delivery in OSS emulation
ARM: 8720/1: ensure dump_instr() checks addr_limit
KEYS: fix NULL pointer dereference during ASN.1 parsing [ver #2]
crypto: x86/sha256-mb - fix panic due to unaligned access
crypto: x86/sha1-mb - fix panic due to unaligned access
crypto: ccm - preserve the IV buffer
workqueue: Fix NULL pointer dereference
x86/uaccess, sched/preempt: Verify access_ok() context
platform/x86: hp-wmi: Do not shadow error values
platform/x86: hp-wmi: Fix error value for hp_wmi_tablet_state
KEYS: trusted: fix writing past end of buffer in trusted_read()
KEYS: trusted: sanitize all key material
cdc_ncm: Set NTB format again after altsetting switch for Huawei devices
platform/x86: hp-wmi: Fix detection for dock and tablet mode
net: dsa: select NET_SWITCHDEV
clk: mvebu: adjust AP806 CPU clock frequencies to production chip
IB/rxe: Fix reference leaks in memory key invalidation code
wcn36xx: Don't use the destroyed hal_mutex
s390/qeth: issue STARTLAN as first IPA command
s390/qeth: fix retrieval of vipa and proxy-arp addresses
ARM: dts: STiH410-family: fix wrong parent clock frequency
IB/ipoib: Change list_del to list_del_init in the tx object
sched/cputime, powerpc32: Fix stale scaled stime on context switch
Input: mpr121 - set missing event capability
Input: mpr121 - handle multiple bits change of status register
s390/topology: make "topology=off" parameter work
EDAC, amd64: Save and return err code from probe_one_instance()
IPsec: do not ignore crypto err in ah4 input
apparmor: fix undefined reference to `aa_g_hash_policy'
rt2800usb: mark tx failure on timeout
brcmfmac: setup wiphy bands after registering it first
netfilter: nft_meta: deal with PACKET_LOOPBACK in netdev family
usb: hcd: initialize hcd->flags to 0 when rm hcd
libertas: fix improper return value
serial: sh-sci: Fix register offsets for the IRDA serial port
phy: increase size of MII_BUS_ID_SIZE and bus_id
dt-bindings: Add vendor prefix for LEGO
dt-bindings: Add LEGO MINDSTORMS EV3 compatible specification
iio: proximity: sx9500: claim direct mode during raw proximity reads
iio: magnetometer: mag3110: claim direct mode during raw writes
iio: pressure: ms5611: claim direct mode during oversampling changes
iio: trigger: free trigger resource correctly
drm: mali-dp: fix Lx_CONTROL register fields clobber
crypto: vmx - disable preemption to enable vsx in aes_ctr.c
arm64: dma-mapping: Only swizzle DMA ops for IOMMU_DOMAIN_DMA
ARM: omap2plus_defconfig: Fix probe errors on UARTs 5 and 6
cxl: Force psl data-cache flush during device shutdown
powerpc/corenet: explicitly disable the SDHC controller on kmcoge4
pinctrl: baytrail: Fix debugfs offset output
iommu/arm-smmu-v3: Clear prior settings when updating STEs
KVM: PPC: Book 3S: XICS: correct the real mode ICP rejecting counter
drm: drm_minor_register(): Clean up debugfs on failure
clk: samsung: exynos5433: Add IDs for PHYCLK_MIPIDPHY0_* clocks
PM / OPP: Error out on failing to add static OPPs for v1 bindings
EDAC, amd64: Add x86cpuid sanity check during init
dt-bindings: clockgen: Add compatible string for LS1012A
ARM: dts: imx53-qsb-common: fix FEC pinmux config
xen/netback: set default upper limit of tx/rx queues to 8
sched/core: Add missing update_rq_clock() call in sched_move_task()
PCI: mvebu: Handle changes to the bridge windows while enabled
video: fbdev: pmag-ba-fb: Remove bad `__init' annotation
adv7604: Initialize drive strength to default when using DT
Conflicts:
arch/arm64/mm/dma-mapping.c
Change-Id: I43c1e1ca95b7f96e265c404254545304816344ea
Signed-off-by: Kyle Yan <kyan@codeaurora.org>
commit 3510c7aa069aa83a2de6dab2b41401a198317bdc upstream.
The recent fix for adding rwsem nesting annotation was using the given
"hop" argument as the lock subclass key. Although the idea itself
works, it may trigger a kernel warning like:
BUG: looking up invalid subclass: 8
....
since the lockdep has a smaller number of subclasses (8) than we
currently allow for the hops there (10).
The current definition is merely a sanity check for avoiding the too
deep delivery paths, and the 8 hops are already enough. So, as a
quick fix, just follow the max hops as same as the max lockdep
subclasses.
Fixes: 1f20f9ff57ca ("ALSA: seq: Fix nested rwsem annotation for lockdep splat")
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* 4.9/tmp-86f97ab:
Linux 4.9.57
KVM: nVMX: update last_nonleaf_level when initializing nested EPT
x86/alternatives: Fix alt_max_short macro to really be a max()
USB: serial: console: fix use-after-free after failed setup
USB: serial: qcserial: add Dell DW5818, DW5819
USB: serial: option: add support for TP-Link LTE module
USB: serial: cp210x: add support for ELV TFD500
USB: serial: ftdi_sio: add id for Cypress WICED dev board
bio_copy_user_iov(): don't ignore ->iov_offset
more bio_map_user_iov() leak fixes
fix unbalanced page refcounting in bio_map_user_iov
direct-io: Prevent NULL pointer access in submit_page_section
usb: gadget: composite: Fix use-after-free in usb_composite_overwrite_options
usb: gadget: configfs: Fix memory leak of interface directory data
drm/i915/bios: parse DDI ports also for CHV for HDMI DDC pin and DP AUX channel
drm/i915: Read timings from the correct transcoder in intel_crtc_mode_get()
drm/i915/edp: Get the Panel Power Off timestamp after panel is off
ALSA: line6: Fix leftover URB at error-path during probe
ALSA: line6: Fix missing initialization before error path
ALSA: caiaq: Fix stray URB at probe error path
ALSA: seq: Fix copy_from_user() call inside lock
ALSA: seq: Fix use-after-free at creating a port
ALSA: usb-audio: Kill stray URB at exiting
fs/mpage.c: fix mpage_writepage() for pages with buffers
device property: Track owner device of device property
iommu/amd: Finish TLB flush in amd_iommu_unmap()
pinctrl/amd: Fix build dependency on pinmux code
usb: renesas_usbhs: Fix DMAC sequence for receiving zero-length packet
KVM: nVMX: fix guest CR4 loading when emulating L2 to L1 exit
KVM: MMU: always terminate page walks at level 1
crypto: shash - Fix zero-length shash ahash digest crash
HID: usbhid: fix out-of-bounds bug
dmaengine: ti-dma-crossbar: Fix possible race condition with dma_inuse
dmaengine: edma: Align the memcpy acnt array size with the transfer
MIPS: math-emu: Remove pr_err() calls from fpu_emu()
USB: dummy-hcd: Fix deadlock caused by disconnect detection
rcu: Allow for page faults in NMI handlers
nl80211: Define policy for packet pattern attributes
CIFS: Reconnect expired SMB sessions
ext4: in ext4_seek_{hole,data}, return -ENXIO for negative offsets
Change-Id: I64affb40416c282aa1421e22e4320d5b99670af9
Signed-off-by: Kyle Yan <kyan@codeaurora.org>
commit 5803b023881857db32ffefa0d269c90280a67ee0 upstream.
The event handler in the virmidi sequencer code takes a read-lock for
the linked list traverse, while it's calling snd_seq_dump_var_event()
in the loop. The latter function may expand the user-space data
depending on the event type. It eventually invokes copy_from_user(),
which might be a potential dead-lock.
The sequencer core guarantees that the user-space data is passed only
with atomic=0 argument, but snd_virmidi_dev_receive_event() ignores it
and always takes read-lock(). For avoiding the problem above, this
patch introduces rwsem for non-atomic case, while keeping rwlock for
atomic case.
Also while we're at it: the superfluous irq flags is dropped in
snd_virmidi_input_open().
Reported-by: Jia-Ju Bai <baijiaju1990@163.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Drivers can implement 'struct snd_pcm_ops.ioctl' to handle some requests
from ALSA PCM core. These requests are internal purpose in kernel land.
Usually common set of operations are used for it.
SNDRV_PCM_IOCTL1_INFO is one of the requests. According to code comment,
it has been obsoleted in the old days.
We can see old releases in ftp.alsa-project.org. The command was firstly
introduced in v0.5.0 release as SND_PCM_IOCTL1_INFO, to allow drivers to
fill data of 'struct snd_pcm_channel_info' type. In v0.9.0 release,
this was obsoleted by the other commands for ioctl(2) such as
SNDRV_PCM_IOCTL_CHANNEL_INFO.
This commit removes the long-abandoned command, bye.
CRs-fixed: 2112663
Change-Id: I17d9c0a759fce81d3dc9b9375f5d5f35dac583b8
Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Git-commit: e11f0f90a626f93899687b1cc909ee37dd6c5809
Git-repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git
Signed-off-by: Karthikeyan Mani <kmani@codeaurora.org>
Move audio drivers outside kernel because they will be
rewritten to load as DLKM.
Change-Id: Id5cbb558240a1095ce23a93faed3b4fa16051acc
Signed-off-by: Asish Bhattacharya <asishb@codeaurora.org>
Current (V1) version of SM ECNS is no longer supported
by underlying hardware. Replacing it with V2 version.
Change-Id: I16d6c4a37045079c1bcdef68486088a4e3c3e4dd
Signed-off-by: Vikram Panduranga <vpandura@codeaurora.org>
Add APIs to get AVCS service version info.
CRs-Fixed: 2082133
Change-Id: I9d65d5013153e45cf9517b3334d00d196173628c
Signed-off-by: Tanya Dixit <tdixit@codeaurora.org>
Add APIs to query for the AVS framework and services versions. Cache
the information retrieved for use by HLOS services.
CRs-Fixed: 2018143
Signed-off-by: Siena Richard <sienar@codeaurora.org>
Change-Id: I6c262e7302a9b69f5fdd22762122a8db72c8c274
This reverts commit e5c7d7c1c6.
This change is no longer required as the wrapper available in upstream
snd_soc_dapm_kcontrol_widget() can be used for the same purpose of
accessing the parent widget for a given kcontrol.
Change-Id: I6af4b6cab1f51e3e9321573a08777dbedce62243
Signed-off-by: Banajit Goswami <bgoswami@codeaurora.org>
spi data read and write are handled by WDSP_EVENT_GETOPS
and can be removed from being exported, rather make them
static.
CRs-Fixed: 2068106
Change-Id: I815f0e7c2ac02236e23c7d1b98929dad93e48d6d
Signed-off-by: Karthikeyan Mani <kmani@codeaurora.org>
Add support to build, load and unload wcd9335 and
wcd934x codec modules separately from the kernel.
CRs-fixed: 2068879
Change-Id: I15f0b495691b7708894b512efedf677bf0f7d871
Signed-off-by: Karthikeyan Mani <kmani@codeaurora.org>
Add functionality to handle the WDSP_EVENT_GETOPS event and provide
the required operations to the manager driver. This is helpful for
manager or other components to call into the operations to request
functionality from this component.
Change-Id: I49232e11cbfca89f6ff8ac711c12ae6a39dcbd00
Signed-off-by: Bhalchandra Gajare <gajare@codeaurora.org>
Add support in the wcd dsp manager driver to provide interface
to components to get operations from other components. This can
be used when components need to communicate amongst themselves
without intervention from manager driver.
Change-Id: Idddb60f0c8d6179046879bc358c840936c61299f
Signed-off-by: Bhalchandra Gajare <gajare@codeaurora.org>
Different COPPs can be mixed into one POPP when recording
data. Use ADM_CMD_SET_PSPD_MTMX_STRTR_PARAMS_V5 cmd to support
this requirement.
Change-Id: If079b586fafe84f7dec7732c7037af2f59f063c7
Signed-off-by: Meng Wang <mwang@codeaurora.org>
Add DSP transcode loopback. Userspace can use this driver
to support TX to RX audio HW DSP loopback.
CRs-Fixed: 2049714
Change-Id: Ie83f5ca2c626c8fffbec4624f3e35c6c179d4c8c
Signed-off-by: Siddartha Shaik <sshaik@codeaurora.org>
Transcode loopback api can be used by client to configure
compress loopback.
CRs-fixed: 2049714
Change-Id: I7286fbdfa89375d517f3dad7d04e1d2a360d6f7e
Signed-off-by: Siddartha Shaik <sshaik@codeaurora.org>
Add support for IEC61937 which is an audio packaging
standard used for compressed HDMI pass-through. Any
audio format can be sent through HDMI pass-through
formatted as IEC61937.
Change-Id: I09821add306e2aeae6530cecbac189471a55e589
Signed-off-by: Ben Romberger <bromberg@codeaurora.org>
Add support to handle new ADSP ASM stream event APIs for
different applications.
Change-Id: Id1e7b9b2841449ceb70099722d834b51c198f04e
Signed-off-by: Kuirong Wang <kuirongw@codeaurora.org>
Signed-off-by: Vidyakumar Athota <vathota@codeaurora.org>
Implement FIFO queue for multiple callback events. Events are
cleaned at stream close.
Change-Id: Id738326a20613d2f939e45204b2d46448a5b4759
Signed-off-by: Xiaojun Sang <xsang@codeaurora.org>
ASM driver changes to apply DSP clock recovery.
Clients can issue clock recovery command with a positive value
to advance the clock or a negative value to delay the clock.
CRs-Fixed: 2036899
Change-Id: If2f10368afafe203ebdea219edcc2227cd381801
Signed-off-by: Manish Dewangan <manish@codeaurora.org>
Eagle driver is not in use any more.
Remove the code and associated calls
to it.
CRs-Fixed: 1103106
Change-Id: Ice5333861beda9538f0783b70b3267523d16fd2b
Signed-off-by: Alexy Joseph <alexyj@codeaurora.org>
Signed-off-by: Banajit Goswami <bgoswami@codeaurora.org>
Add mixer control to swap the speaker channels.
Use MFC module to update the channel mapping.
When playback is started with speaker device and
device orientation changes, swapping L/R channel
mixer control command is sent to DSP with the MFC
module.
CRs-Fixed: 1026248
Change-Id: I1d80ecc7f1e3cfb8f8cdf71c384e92a07023be5c
Signed-off-by: kunleiz <kunleiz@codeaurora.org>
Signed-off-by: Banajit Goswami <bgoswami@codeaurora.org>
Add TrueHD audio format for compressed HDMI pass-through
Change-Id: Id8a0b8c3a01c881ae284f13c2c0a36959c2413ac
Signed-off-by: Ben Romberger <bromberg@codeaurora.org>
Add support for ADSP Stream Cmd and Callback for PCM
and compress driver. Mixer controls are added as interface
for ADSP stream cmd and callback event.
CRs-Fixed: 2023802
Change-Id: Ib2de5aebe257332171c3b1ebe3d26b3422d61c97
Signed-off-by: Xiaojun Sang <xsang@codeaurora.org>
During gapless playback, next track open write
command is triggered to DSP. At the same time,
for current track, volume change or some PP command
is triggered to DSP. Due to race condition, the track
open write fails since the second command is
triggered asynchronously. Use separate cmd state
for PP command to handle this.
CRs-Fixed: 1080766
Change-Id: Ia80766394e4933800b72be2bf3296cd5de4e3159
Signed-off-by: Laxminath Kasam <lkasam@codeaurora.org>
Voice-svc is not used anymore, clean up related files and codes.
CRs-Fixed: 2001770
Change-Id: I39c339c76ad718742eb02ef1fddf5f54a6dd0840
Signed-off-by: Xiaoyu Ye <benyxy@codeaurora.org>
ASM driver changes to configure clock recovery mode.
Based on the configure mode, DSP decides whether to enable
clock recovery or not.
CRs-Fixed: 1112258
Change-Id: Ia6a6c33ce7b478af8d2397c20fcc6281d96ec3ce
Signed-off-by: Manish Dewangan <manish@codeaurora.org>
ASM driver changes to configure render mode.
Based on configured render mode DSP decides to whether to use
Audio Master Mode or STC Master mode for rendering.
CRs-Fixed: 1112258
Change-Id: I01c7a172b899fd7e950f216732d12a2cb2c737e9
Signed-off-by: Manish Dewangan <manish@codeaurora.org>
Add support for 352800 sampling rates and 32 bps for the TDM.
Add support for PCM compress passthough mode with mixer controls.
CRs-fixed: 1116515
Change-Id: Iab059a5a6b6ce8f57717023467677a399a60032e
Signed-off-by: Josh Kirsch <jkirsch@codeaurora.org>
Signed-off-by: Karthikeyan Mani <kmani@codeaurora.org>
Afe driver changes to query avtimer vs device drift.
Drift obtained can be used to pull the device pll so
that avtimer and device are in sync.
CRs-Fixed: 1112258
Change-Id: I4d4ddb0dbc06270553d583f266a44ddbe9412d1a
Signed-off-by: Manish Dewangan <manish@codeaurora.org>
Add mixer control to set the endianness of the playback/capture
USB device.
CRs-Fixed: 2003737
Change-Id: I99102c3bb64e321fb3e5df38428e63a406f91d7e
Signed-off-by: Haynes Mathew George <hgeorge@codeaurora.org>
Add support for multi-copps for multiple BEs with independent
calibration data. This allows for more accurate calibration of device
copps.
CRs-fixed: 1110411
Change-Id: I72ce501408a474eb620a088172e3c4d789ab5ef0
Signed-off-by: Siena Richard <sienar@codeaurora.org>
Signed-off-by: Banajit Goswami <bgoswami@codeaurora.org>
Enhance LSM code to support maximum configuration of 48khz, 24bit
and 4 channel.
Change-Id: I03895c983527d87389ca69e85235b1def5b4a2fa
Signed-off-by: Chaithanya Krishna Bacharaju <chaithan@codeaurora.org>
Signed-off-by: Revathi Uddaraju <revathiu@codeaurora.org>
Add support to parse LSM_SESSION_EVENT_DETECTION_STATUS_V3
in cases where event status requires timestamp corresponding
to detection.
Framework mode config is set to timestamp mode in cases where
LSM_SESSION_EVENT_DETECTION_STATUS_V3 is required.
Change-Id: Id0da3b24d55ac56ff6b61372ede9c63f50b2f4d4
Signed-off-by: Chaithanya Krishna Bacharaju <chaithan@codeaurora.org>
Signed-off-by: Revathi Uddaraju <revathiu@codeaurora.org>
Signed-off-by: Banajit Goswami <bgoswami@codeaurora.org>
Microphone2 and SND_JACK_BTN_5 enum are same, resulting
in SND_JACK_BTN_5 event getting triggered when ANC headset
is plugged into the device. Use unique values in
sound jack type enum.
Change-Id: I668e50afcad11b1f62f511f4241f79bad858c7d2
Signed-off-by: Sudheer Papothi <spapothi@codeaurora.org>
LSM will connect to ADM to apply preprocessing and improve
detection performance. LSM can also directly connect to AFE
similar to the existing mechanism.
MAD polling will be disabled in case of LSM connects to ADM.
Add EC reference end channel, bit format and sample rate control
to configure far end params for Echo Cancellation.
Change-Id: I4684ae346884d656e95350b7a63929b91a843512
Signed-off-by: Chaithanya Krishna Bacharaju <chaithan@codeaurora.org>
Signed-off-by: Revathi Uddaraju <revathiu@codeaurora.org>
Polling needs to be disabled when LSM connects to ADM.
Add interface to enable or disable polling through
set_params. Add support to set port.
Change-Id: If027418a6d8a1ea48dcb6a0c146f68e7dd7a2664
Signed-off-by: Chaithanya Krishna Bacharaju <chaithan@codeaurora.org>
Signed-off-by: Revathi Uddaraju <revathiu@codeaurora.org>
Add changes to support aptx decoder in offload mode.
Add support to set BT device address and add new mixer control
to set license key.
CRs-Fixed: 1106128
Change-Id: Idd4ec8ab829883ef4848be8b686e24101ccbed60
Signed-off-by: Dhanalakshmi Siddani <dsiddani@codeaurora.org>
The timestamp API is called even when timestamp flag is not set.
Correct the read API calls based on timestamp flag.
CRs-fixed: 1107319
Change-Id: Ic40b166e9ddd42f20fecadcd4eafe187b3ff8785
Signed-off-by: Satish Babu Patakokila <sbpata@codeaurora.org>
Allow MIC channel selection as the primary channel requested
by the application on Multichannel Echo Cancellation module.
CRs-fixed: 1102004
Change-Id: I94ba0f3171b4c7ebcc9936ca4f192f68de7be034
Signed-off-by: Rahul Sharma <sharah@codeaurora.org>
Signed-off-by: Derek Chen <chenche@codeaurora.org>
