In the current PCM design, the read/write syscalls (as well as the
equivalent ioctls) are allowed before the PCM stream is running, that
is, at PCM PREPARED state.  Meanwhile, we also allow to re-issue
hw_params and hw_free ioctl calls at the PREPARED state that may
change or free the buffers, too.  The problem is that there is no
protection against those mix-ups.

This patch applies the previously introduced runtime->buffer_mutex to
the read/write operations so that the concurrent hw_params or hw_free
call can no longer interfere during the operation.  The mutex is
unlocked before scheduling, so we don't take it too long.

Cc: <stable@vger.kernel.org>
Reviewed-by: Jaroslav Kysela <perex@perex.cz>
Link: https://lore.kernel.org/r/20220322170720.3529-3-tiwai@suse.deSigned-off-by: Takashi Iwai <tiwai@suse.de>

Currently we have neither proper check nor protection against the
concurrent calls of PCM hw_params and hw_free ioctls, which may result
in a UAF.  Since the existing PCM stream lock can't be used for
protecting the whole ioctl operations, we need a new mutex to protect
those racy calls.

This patch introduced a new mutex, runtime->buffer_mutex, and applies
it to both hw_params and hw_free ioctl code paths.  Along with it, the
both functions are slightly modified (the mmap_count check is moved
into the state-check block) for code simplicity.
Reported-by: Hu Jiahui <kirin.say@gmail.com>
Cc: <stable@vger.kernel.org>
Reviewed-by: Jaroslav Kysela <perex@perex.cz>
Link: https://lore.kernel.org/r/20220322170720.3529-2-tiwai@suse.deSigned-off-by: Takashi Iwai <tiwai@suse.de>

Merge tag 'asoc-v5.18' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus

ASoC: Updates for v5.18

Quite a quiet release for ASoC, lots of work on drivers and platforms
but nothing too groundbreaking but not much on the core itself:

 - Start of moving SoF to support multiple IPC mechanisms.
 - Use of NHLT ACPI table to reduce the amount of quirking required for
   Intel systems.
 - Some building blocks for use in forthcoming Intel AVS driver for
   legacy Intel DSP firmwares.
 - Support for AMD PDM, Atmel PDMC, Awinic AW8738, i.MX cards with
   TLV320AIC31xx, Intel machines with CS35L41 and ESSX8336, Mediatek
   MT8181 wideband bluetooth, nVidia Tegra234, Qualcomm SC7280, Renesas
   RZ/V2L, Texas Instruments TAS585M

Pull 5.18 development branch
Signed-off-by: Takashi Iwai <tiwai@suse.de>

Merge series from Ranjani Sridharan <ranjani.sridharan@linux.intel.com>:

This series is a continuation to the SOF IPC abstraction work to support
the new IPC version introduced in the SOF firmware. It makes the top-level
control IO, PCM and PM code IPC-agnostic. Other than the first patch,
the rest are purely for abstraction and include no changes in
functionality.

The correct property is 'microchip,mic-pos', not 'mchp,mic-pos', so
replace all occurences of 'mchp,mic-pos' with 'microchip,mic-pos'.
Fix a multi-line comment format while we are at it.

Fixes: 50291652 ("ASoC: atmel: mchp-pdmc: add PDMC driver")
Signed-off-by: Codrin Ciubotariu <codrin.ciubotariu@microchip.com>
Link: https://lore.kernel.org/r/20220318092609.130901-1-codrin.ciubotariu@microchip.comSigned-off-by: Mark Brown <broonie@kernel.org>

Shengjiu has been actively working on latest FSL platforms and
keeping upstream effort as well, while I have been working on
other subsystem lately and cannot guarantee audio patch review
in the near term. So replacing with him in the maintainer list.
Signed-off-by: Nicolin Chen <nicoleotsuka@gmail.com>
Reviewed-by: Fabio Estevam <festevam@gmail.com>
Acked-by: Shengjiu Wang <shengjiu.wang@gmail.com>
Link: https://lore.kernel.org/r/20220317041806.28230-1-nicoleotsuka@gmail.comSigned-off-by: Mark Brown <broonie@kernel.org>

This will help make the code for getting the mclk and bclk IPC specific.
Add the implementation for IPC3 as well.
Signed-off-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
Reviewed-by: Rander Wang <rander.wang@intel.com>
Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
Link: https://lore.kernel.org/r/20220317175044.1752400-20-ranjani.sridharan@linux.intel.comSigned-off-by: Mark Brown <broonie@kernel.org>

Introduce two new ops, set_up_all_pipelines and tear_down_all_pipelines
in struct ipc_tplg_ops and define these for IPC3.
Signed-off-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
Reviewed-by: Péter Ujfalusi <peter.ujfalusi@linux.intel.com>
Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
Link: https://lore.kernel.org/r/20220317175044.1752400-19-ranjani.sridharan@linux.intel.comSigned-off-by: Mark Brown <broonie@kernel.org>

This will be used in IPC3-specific code.
Signed-off-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
Reviewed-by: Péter Ujfalusi <peter.ujfalusi@linux.intel.com>
Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Link: https://lore.kernel.org/r/20220317175044.1752400-18-ranjani.sridharan@linux.intel.comSigned-off-by: Mark Brown <broonie@kernel.org>

Define the dai_link_fixup PCM op for IPC3 and use it
Signed-off-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
Reviewed-by: Péter Ujfalusi <peter.ujfalusi@linux.intel.com>
Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
Link: https://lore.kernel.org/r/20220317175044.1752400-17-ranjani.sridharan@linux.intel.comSigned-off-by: Mark Brown <broonie@kernel.org>

Add the trigger PCM op for IPC3 and use it.
Signed-off-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
Reviewed-by: Péter Ujfalusi <peter.ujfalusi@linux.intel.com>
Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Link: https://lore.kernel.org/r/20220317175044.1752400-16-ranjani.sridharan@linux.intel.comSigned-off-by: Mark Brown <broonie@kernel.org>

Add the hw_params op for IPC3 and use it.
Signed-off-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
Reviewed-by: Péter Ujfalusi <peter.ujfalusi@linux.intel.com>
Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Link: https://lore.kernel.org/r/20220317175044.1752400-15-ranjani.sridharan@linux.intel.comSigned-off-by: Mark Brown <broonie@kernel.org>

Add the IPC3 PCM ops, define the hw_free op and modify all users to use
the op.
Signed-off-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
Reviewed-by: Péter Ujfalusi <peter.ujfalusi@linux.intel.com>
Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
Link: https://lore.kernel.org/r/20220317175044.1752400-14-ranjani.sridharan@linux.intel.comSigned-off-by: Mark Brown <broonie@kernel.org>

It will be used in IPC-specific code.
Signed-off-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
Reviewed-by: Péter Ujfalusi <peter.ujfalusi@linux.intel.com>
Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Link: https://lore.kernel.org/r/20220317175044.1752400-13-ranjani.sridharan@linux.intel.comSigned-off-by: Mark Brown <broonie@kernel.org>

Introduce the IPC-specific PCM ops that will be used to abstract the
PCM related IPC's.
Signed-off-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
Reviewed-by: Péter Ujfalusi <peter.ujfalusi@linux.intel.com>
Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Link: https://lore.kernel.org/r/20220317175044.1752400-12-ranjani.sridharan@linux.intel.comSigned-off-by: Mark Brown <broonie@kernel.org>

Define and set the get/put/volatile_get control IPC ops for byte
controls for IPC3.
Signed-off-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
Reviewed-by: Péter Ujfalusi <peter.ujfalusi@linux.intel.com>
Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Link: https://lore.kernel.org/r/20220317175044.1752400-11-ranjani.sridharan@linux.intel.comSigned-off-by: Mark Brown <broonie@kernel.org>

Define and set the bytes_get/put IPC control ops for IPC3.
Signed-off-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
Reviewed-by: Péter Ujfalusi <peter.ujfalusi@linux.intel.com>
Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Link: https://lore.kernel.org/r/20220317175044.1752400-10-ranjani.sridharan@linux.intel.comSigned-off-by: Mark Brown <broonie@kernel.org>

Define and set the enum_get/put control IPC ops for IPC3.
Signed-off-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
Reviewed-by: Péter Ujfalusi <peter.ujfalusi@linux.intel.com>
Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Link: https://lore.kernel.org/r/20220317175044.1752400-9-ranjani.sridharan@linux.intel.comSigned-off-by: Mark Brown <broonie@kernel.org>

Add the switch_get/put control IPC ops for IPC3.
Signed-off-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
Reviewed-by: Péter Ujfalusi <peter.ujfalusi@linux.intel.com>
Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Link: https://lore.kernel.org/r/20220317175044.1752400-8-ranjani.sridharan@linux.intel.comSigned-off-by: Mark Brown <broonie@kernel.org>

Define and set the volume_get/put control IPC ops for IPC3.
Signed-off-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
Reviewed-by: Péter Ujfalusi <peter.ujfalusi@linux.intel.com>
Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Link: https://lore.kernel.org/r/20220317175044.1752400-7-ranjani.sridharan@linux.intel.comSigned-off-by: Mark Brown <broonie@kernel.org>

Define the topology control IPC ops for IPC3, implement the
control_notify op and use it.
Signed-off-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
Reviewed-by: Péter Ujfalusi <peter.ujfalusi@linux.intel.com>
Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Link: https://lore.kernel.org/r/20220317175044.1752400-6-ranjani.sridharan@linux.intel.comSigned-off-by: Mark Brown <broonie@kernel.org>

Introduce IPC-specific ops for kcontrol IO in struct ipc_tplg_ops.
Signed-off-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
Reviewed-by: Péter Ujfalusi <peter.ujfalusi@linux.intel.com>
Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Link: https://lore.kernel.org/r/20220317175044.1752400-5-ranjani.sridharan@linux.intel.comSigned-off-by: Mark Brown <broonie@kernel.org>

Add a new set of IPC ops for PM with the ctx_save and ctx_restore ops
for suspend/resume and implement the ops for IPC3.
Signed-off-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
Reviewed-by: Péter Ujfalusi <peter.ujfalusi@linux.intel.com>
Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Link: https://lore.kernel.org/r/20220317175044.1752400-4-ranjani.sridharan@linux.intel.comSigned-off-by: Mark Brown <broonie@kernel.org>

Add 3 new topology IPC ops for widget_setup, widget_free and dai_config
in order to make the pipeline management code IPC agnostic and implement
the ops for IPC3.

Use the newly introduced tplg dai_config op to configure the DAI during
BE DAI hw_params and hw_free.

Also, in preparation for IPC4, modify BE hw_params callback to skip
setting up the DAI widget. All widgets will be set up during FW
hw_params and the DAI_CONFIG IPC should be sent only if the widget
use_count is > 0. With setting up/freeing removed from the BE hw_params,
remove the configured flag as it is no longer needed.
Signed-off-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
Reviewed-by: Péter Ujfalusi <peter.ujfalusi@linux.intel.com>
Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
Link: https://lore.kernel.org/r/20220317175044.1752400-3-ranjani.sridharan@linux.intel.comSigned-off-by: Mark Brown <broonie@kernel.org>

For dynamic pipelines, We set up the DAI widget during BE DAI hw_params
and this results in it getting set up before the scheduler widget for the
pipeline it belongs to is set up. Move the scheduler widget set up into
sof_widget_setup() to ensure that the scheduler widget is always the first
widget in a pipeline to be set up and the last one to get freed after all
the other widgets have been freed.

Fixes: 5fcdbb2d ('ASoC: SOF: Add support for dynamic pipelines')
Signed-off-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
Reviewed-by: Péter Ujfalusi <peter.ujfalusi@linux.intel.com>
Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Link: https://lore.kernel.org/r/20220317175044.1752400-2-ranjani.sridharan@linux.intel.comSigned-off-by: Mark Brown <broonie@kernel.org>

When the parameter changes fails, we don't need to keep the old
temporary buffers.  Release those (and plugin instances) upon errors
for reducing dead memory footprint.  Since we always call it at the
exit of snd_pcm_oss_changes_params_locked(), the explicit calls of
snd_pcm_oss_plugin_clear() can be dropped, too.

Along with it, unify the buffer-free calls to a single helper and call
it from the needed places.

Link: https://lore.kernel.org/r/20220318082157.29769-1-tiwai@suse.deSigned-off-by: Takashi Iwai <tiwai@suse.de>

We've got syzbot reports hitting INT_MAX overflow at vmalloc()
allocation that is called from snd_pcm_plug_alloc().  Although we
apply the restrictions to input parameters, it's based only on the
hw_params of the underlying PCM device.  Since the PCM OSS layer
allocates a temporary buffer for the data conversion, the size may
become unexpectedly large when more channels or higher rates is given;
in the reported case, it went over INT_MAX, hence it hits WARN_ON().

This patch is an attempt to avoid such an overflow and an allocation
for too large buffers.  First off, it adds the limit of 1MB as the
upper bound for period bytes.  This must be large enough for all use
cases, and we really don't want to handle a larger temporary buffer
than this size.  The size check is performed at two places, where the
original period bytes is calculated and where the plugin buffer size
is calculated.

In addition, the driver uses array_size() and array3_size() for
multiplications to catch overflows for the converted period size and
buffer bytes.

Reported-by: syzbot+72732c532ac1454eeee9@syzkaller.appspotmail.com
Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/00000000000085b1b305da5a66f3@google.com
Link: https://lore.kernel.org/r/20220318082036.29699-1-tiwai@suse.deSigned-off-by: Takashi Iwai <tiwai@suse.de>

Signed-off-by: Elijah Harding <eharding830@gmail.com>
Link: https://lore.kernel.org/r/20220318015201.30871-1-eharding830@gmail.comSigned-off-by: Takashi Iwai <tiwai@suse.de>

Commit 07bcab93 ("ALSA: hda/realtek: Add support for HP Laptops")
breaks mute and micmute LEDs because it changed the LED quirk from
ALC285_FIXUP_HP_GPIO_LED to ALC245_FIXUP_HP_GPIO_LED, so change it back
here.

Also reorder the chain of quirks to ensure LED quirk is the last one
being applied.

Fixes: 07bcab93 ("ALSA: hda/realtek: Add support for HP Laptops")
Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
Link: https://lore.kernel.org/r/20220317221134.566358-1-kai.heng.feng@canonical.comSigned-off-by: Takashi Iwai <tiwai@suse.de>

There are some new registers added on i.MX8ULP, they are
the SPDIF transmit Professional C channel registers,
192bit SPDIF receive C channel registers, and 192bit SPDIF
transmit C channel registers.

There are two output lines, SPDIF_OUT1 and SPDIF_OUT2, the
original REG_SPDIF_STCSCH and REG_SPDIF_STCSCL are used for
SPDIF_OUT1, the new REG_SPDIF_STCSPH and REG_SPDIF_STCSPL
are used for SPDIF_OUT2, the 192bit SPDIF C channel registers
are used for both.
Signed-off-by: Shengjiu Wang <shengjiu.wang@nxp.com>
Link: https://lore.kernel.org/r/1647408538-2982-1-git-send-email-shengjiu.wang@nxp.comSigned-off-by: Mark Brown <broonie@kernel.org>

fix memdup.cocci warning:
sound/soc/sof/topology.c:876:19-26: WARNING opportunity for kmemdup

Generated by: scripts/coccinelle/api/memdup.cocci
Signed-off-by: Yihao Han <hanyihao@vivo.com>
Acked-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Link: https://lore.kernel.org/r/20220317093841.3414-1-hanyihao@vivo.comSigned-off-by: Mark Brown <broonie@kernel.org>

Merge series from Ranjani Sridharan <ranjani.sridharan@linux.intel.com>:

This patchset makes the topology parsing layer in the SOF driver
IPC-agnostic in preparation for supporting the new IPC version
introduced in the SOF firmware. These patches purely contain abstraction
changes for the current IPC version (IPC3) supported and do not introduce
any functional changes.

Use of_device_get_match_data() to simplify the code.
Reported-by: Zeal Robot <zealci@zte.com.cn>
Signed-off-by: Minghao Chi <chi.minghao@zte.com.cn>
Link: https://lore.kernel.org/r/20220315023226.2118354-1-chi.minghao@zte.com.cnSigned-off-by: Mark Brown <broonie@kernel.org>

Update power domains exit function calling from runtime resume
to remove function which was wrongly placed and causing crash in
device suspend and resume.

Fixes: 9e3d83c5 ("ASoC: codecs: Add power domains support in digital macro codecs")
Signed-off-by: Srinivasa Rao Mandadapu <quic_srivasam@quicinc.com>
Co-developed-by: Venkata Prasad Potturu <quic_potturu@quicinc.com>
Signed-off-by: Venkata Prasad Potturu <quic_potturu@quicinc.com>
Link: https://lore.kernel.org/r/1647355531-4150-1-git-send-email-quic_srivasam@quicinc.comSigned-off-by: Mark Brown <broonie@kernel.org>

This is essentially a revert of the commit dc865fb9 ("ASoC: sti:
Use snd_pcm_stop_xrun() helper"), which converted the manual
snd_pcm_stop() calls with snd_pcm_stop_xrun().

The commit above introduced a deadlock as snd_pcm_stop_xrun() itself
takes the PCM stream lock while the caller already holds it.  Since
the conversion was done only for consistency reason and the open-call
with snd_pcm_stop() to the XRUN state is a correct usage, let's revert
the commit back as the fix.

Fixes: dc865fb9 ("ASoC: sti: Use snd_pcm_stop_xrun() helper")
Reported-by: Daniel Palmer <daniel@0x0f.com>
Cc: Arnaud POULIQUEN <arnaud.pouliquen@st.com>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20220315091319.3351522-1-daniel@0x0f.comSigned-off-by: Takashi Iwai <tiwai@suse.de>
Reviewed-by: Arnaud Pouliquen <arnaud.pouliquen@foss.st.com>
Link: https://lore.kernel.org/r/20220315164158.19804-1-tiwai@suse.deSigned-off-by: Mark Brown <broonie@kernel.org>

PCM buffers might be allocated dynamically when the buffer
preallocation failed or a larger buffer is requested, and it's not
guaranteed that substream->dma_buffer points to the actually used
buffer.  The driver needs to refer to substream->runtime->dma_addr
instead for the buffer address.

Fixes: cab396d8 ("ASoC: amd: add ACP5x pcm dma driver ops")
Signed-off-by: Meng Tang <tangmeng@uniontech.com>
Link: https://lore.kernel.org/r/20220316091303.9745-1-tangmeng@uniontech.comSigned-off-by: Mark Brown <broonie@kernel.org>

The device_node pointer is returned by of_parse_phandle()  with refcount
incremented. We should use of_node_put() on it when done.
This is similar to commit 64b92de9
("ASoC: wcd9335: fix a leaked reference by adding missing of_node_put")

Fixes: a61f3b4f ("ASoC: wcd934x: add support to wcd9340/wcd9341 codec")
Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
Link: https://lore.kernel.org/r/20220316083631.14103-1-linmq006@gmail.comSigned-off-by: Mark Brown <broonie@kernel.org>

The device_node pointer is returned by of_parse_phandle()  with refcount
incremented. We should use of_node_put() on it when done.

This function only calls of_node_put() in the regular path.
And it will cause refcount leak in error path.

Fixes: 082482a5 ("ASoC: mediatek: mt8195: release device_node after snd_soc_register_card")
Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
Link: https://lore.kernel.org/r/20220316084623.24238-1-linmq006@gmail.comSigned-off-by: Mark Brown <broonie@kernel.org>

It will be safe when getting the calibration params after power-on.
All powers are ready to read the calibration params from EFUSE.
Signed-off-by: Shuming Fan <shumingf@realtek.com>
Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Link: https://lore.kernel.org/r/20220315093740.12008-1-shumingf@realtek.comSigned-off-by: Mark Brown <broonie@kernel.org>