When the codec device is unregistered / freed, it may release the
resource while being used in an unsolicited event like the jack
detection work. This leads to use-after-free.
The fix here is to unregister the device at first, i.e. removing the
codec from the list, then flushing the pending works to assure that
all unsol events are gone. After this point, we're free from
accessing the codec via unsol events, thus can release the resources
gracefully.
The issue was spotted originally by Intel CI, but it couldn't be
reproduced reliably by its nature. So let's hope this fix really
addresses the whole issues.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=196045
Reported-by: Martin Peres <martin.peres@free.fr>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
HD-audio driver uses regmap cache bypass feature for reading a raw
value without the cache. But this is racy since both the cached and
the uncached reads may occur concurrently. The former is done via the
normal control API access while the latter comes from the proc file
read.
Even though the regmap itself has the protection against the
concurrent accesses, the flag set/reset is done without the
protection, so it may lead to inconsistent state of bypass flag that
doesn't match with the current read and occasionally result in a
kernel WARNING like:
WARNING: CPU: 3 PID: 2731 at drivers/base/regmap/regcache.c:499 regcache_cache_only+0x78/0x93
One way to work around such a problem is to wrap with a mutex. But in
this case, the solution is simpler: for the uncached read, we just
skip the regmap and directly calls its accessor. The verb execution
there is protected by itself, so basically it's safe to call
individually.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=116171
Signed-off-by: Takashi Iwai <tiwai@suse.de>
HD-audio driver has a mechanism to trigger the runtime resume
automatically at accessing the verbs. This auto-resume, however,
causes the mutex deadlock when invoked from the regmap handler since
the regmap keeps the mutex while auto-resuming. For avoiding that,
there is some tricky check in the HDA regmap handler to return -EAGAIN
error to back-off when the codec is powered down. Then the caller of
regmap r/w will retry after properly turning on the codec power.
This works in most cases, but there seems a slight race between the
codec power check and the actual on-demand auto-resume trigger. This
resulted in the lockdep splat, eventually leading to a real deadlock.
This patch tries to address the race window by getting the runtime PM
refcount at the check time using pm_runtime_get_if_in_use(). With
this call, we can keep the power on only when the codec has been
already turned on, and back off if not.
For keeping the code consistency, the code touching the runtime PM is
stored in hdac_device.c although it's used only locally in
hdac_regmap.c.
Reported-by: Jiri Slaby <jslaby@suse.cz>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Give some readable comment in kernel doc style for each exported
function, as I promised in the previous meetings. While we're at it,
fix the wrong comments, too.
Signed-off-by: Takashi Iwai <tiwai@suse.de>
This patch provide a new common helper function,
snd_hdac_codec_modalias(), to give the codec modalias name string.
This function will be used by multiple places in the later patches.
Reviewed-by: Vinod Koul <vinod.koul@intel.com>
Tested-by: Subhransu S Prusty <subhransu.s.prusty@intel.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
A few multiple codec drivers do renaming the chip_name string but all
these are open-coded and some of them have even no error check. Let's
make common helpers to do it properly.
Signed-off-by: Takashi Iwai <tiwai@suse.de>
The current codec helpers are local to hda code and needs to be moved to
core so that other users can use it.
The helpers to read/write the codec and to check the
power state of widgets is copied
Signed-off-by: Subhransu S. Prusty <subhransu.s.prusty@intel.com>
Signed-off-by: Vinod Koul <vinod.koul@intel.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
When snd_hdac_refresh_widget_sysfs() is called before the first
hda_widget_sysfs_init(), the next call overrides and eventually
fails. This results in unexpected Oops, something like:
BUG: unable to handle kernel NULL pointer dereference at 00000000000000c8
IP: [<ffffffff8180e2a3>] hdmi_chmap_ctl_info+0x23/0x40
The fix is to add a check of the existing sysfs tree. Also, for more
safety, this patch adds the checks of device_is_registered() in
snd-hdac_refresh_wdiget_sysfs(), too.
Fixes: fa4f18b4f4 ('ALSA: hda - Refresh widgets sysfs at probing Haswell+ HDMI codecs')
Bugizlla: https://bugzilla.kernel.org/show_bug.cgi?id=103431
Reported-by: Andreas Reis <andreas.reis@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Some codecs like Intel HDMI by default do not show up all the pins, they
have to be manually enabled, so we need to refresh the codec widgets and
then recreate the sysfs tree. So add new API snd_hdac_refresh_widget_sysfs()
to do this. It should be be used by codec driver after sending magic verbs
to codec
Signed-off-by: Vinod Koul <vinod.koul@intel.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
This patch changes the return type of snd_hdac_power_up/down() and
variants to pass the error code from the underlying
pm_runtime_get/put() calls. Currently they are ignored, but in most
places, these should be handled properly.
As an example, the regmap handler is updated to check the return value
and accesses the register only when the wakeup succeeds.
Signed-off-by: Takashi Iwai <tiwai@suse.de>
A flag "link_power_control" is added to indicate whether a codec needs to
control the link power. And a new bus ops link_power() is defined for the
codec to request to enable/disable the link power.
Signed-off-by: Mengdong Lin <mengdong.lin@intel.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Although some races in runtime PM refcount was fixed by the commit
[664c715573c2: ALSA: hda - Work around races of power up/down with
runtime PM], there is still a race in the following case:
CPU0: CPU1 :
runtime suspend:
codec->in_pm = 1
snd_hdac_power_up_pm():
pm_runtime_get_sync() skipped
suspend finished:
codec->in_pm = 0
snd_hdac_power_down_pm():
pm_runtime_put_*() is called!
For avoiding this situation, increment in_pm flag atomically when it's
non-zero, and decrement accordingly, to ensure that in_pm is set
consistently for the whole concurrent operations.
Also, since atomic_inc_not_zero() and atomic_dec_if_positive() are
lengthy inline functions, move snd_hdac_power_up_pm() and _down_pm()
to sound/hda/hdac_device.c as no inline functions.
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Currently, snd_hdac_power_up()/down() helpers checks whether the codec
is being in pm (suspend/resume), and skips the call of runtime get/put
during it. This is needed as there are lots of power up/down
sequences called in the paths that are also used in the PM itself. An
example is found in hda_codec.c::codec_exec_verb(), where this can
power up the codec while it may be called again in its power up
sequence, too.
The above works in most cases, but sometimes we really want to wait
for the real power up. For example, the control element get/put may
want explicit power up so that the value change is assured to reach to
the hardware. Using the current snd_hdac_power_up(), however,
results in a race, e.g. when it's called during the runtime suspend is
being performed. In the worst case, as found in patch_ca0132.c, it
can even lead to the deadlock because the code assumes the power up
while it was skipped due to the check above.
For dealing with such cases, this patch makes snd_hdac_power_up() and
_down() to two variants: with and without in_pm flag check. The
version with pm flag check is named as snd_hdac_power_up_pm() while
the version without pm flag check is still kept as
snd_hdac_power_up(). (Just because the usage of the former is fewer.)
Then finally, the patch replaces each call potentially done in PM with
the new _pm() variant.
In theory, we can implement a unified version -- if we can distinguish
the current context whether it's in the pm path. But such an
implementation is cumbersome, so leave the code like this a bit messy
way for now...
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=96271
Signed-off-by: Takashi Iwai <tiwai@suse.de>
This merges the support of regmap in HD-audio infrastructure.
Many in-house cache codes in HD-audio driver are relaced with the
more standard regmap base now.
Signed-off-by: Takashi Iwai <tiwai@suse.de>
A regression was introduced in 7639a06c23c7d4cda3: if AC_PAR_SUBSYSTEM_ID
reads as zero, one should retry using AC_VERB_GET_SUBSYSTEM_ID.
This seems to hit many codecs (my own laptop included), and causes
quirks for some machines not to apply correctly.
Reported-by: TienFu Chen <tienfu.chen@canonical.com>
Signed-off-by: David Henningsson <david.henningsson@canonical.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
The amp hash table was used for recording the cached reads of some
capability values like pin caps or amp caps. Now all these are moved
to regmap as well.
One addition to the regmap helper is codec->caps_overwriting flag.
This is set in snd_hdac_override_parm(), and the regmap helper accepts
any register while this flag is set, so that it can overwrite even the
read-only verb like AC_VERB_PARAMETERS. The flag is cleared
immediately in snd_hdac_override_parm(), as it's a once-off flag.
Along with these changes, the no longer needed amp hash and relevant
fields are removed from hda_codec struct now.
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Sometimes we need the uncached reads, e.g. for refreshing the tree.
This patch provides the helper function for that and uses it for
refreshing widgets, reading subtrees and the whole proc reads.
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Let's start converting the access functions to regmap.
The first one is the simplest, just converting the codec parameter
read helper function snd_hda_param_read().
Signed-off-by: Takashi Iwai <tiwai@suse.de>
When the driver is unloaded before the codec is bound, it still keeps
the runtime PM refcount up, and results in the unbalance. This patch
covers these cases by introducing a flag indicating the runtime PM
initialization and handling the codec registration procedure more
properly. It also fixes the missing input beep device as a gratis,
too.
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Add an overriding exec_verb op to struct hdac_device so that the call
via snd_hdac_exec_verb() can switch to a different route depending on
the setup. The codec driver sets this field so that it can handle the
errors or applying quirks appropriately. Furthermore, this mechanism
will be used for smooth transition for the regmap support in later
patches.
Signed-off-by: Takashi Iwai <tiwai@suse.de>
This patch changes the sysfs files assigned to the codec device on the
bus which were formerly identical with hwdep sysfs files. Now it
shows only a few core parameter, vendor_id, subsystem_id, revision_id,
afg, mfg, vendor_name and chip_name.
In addition, now a widget tree is added to the bus device sysfs
directory for showing the widget topology and attributes. It's just a
flat tree consisting of subdirectories named as the widget NID
including various attributes like widget capability bits. The AFG
(usually NID 0x01) is always found there, and it contains always
amp_in_caps, amp_out_caps and power_caps files. Each of these
attributes show a single value. The rest are the widget nodes
belonging to that AFG. Note that the child node might not start from
0x02 but from another value like 0x0a.
Each child node may contain caps, pin_caps, amp_in_caps, amp_out_caps,
power_caps and connections files. The caps (representing the widget
capability bits) always contain a value. The rest may contain
value(s) if the attribute exists on the node. Only connections file
show multiple values while other attributes have zero or one single
value.
An example of ls -R output is like below:
% ls -R /sys/bus/hdaudio/devices/hdaudioC0D0/
/sys/bus/hdaudio/devices/hdaudioC0D0/widgets/:
01/ 04/ 07/ 0a/ 0d/ 10/ 13/ 16/ 19/ 1c/ 1f/ 22/
02/ 05/ 08/ 0b/ 0e/ 11/ 14/ 17/ 1a/ 1d/ 20/ 23/
03/ 06/ 09/ 0c/ 0f/ 12/ 15/ 18/ 1b/ 1e/ 21/
/sys/bus/hdaudio/devices/hdaudioC0D0/widgets/01:
amp_in_caps amp_out_caps power_caps
/sys/bus/hdaudio/devices/hdaudioC0D0/widgets/02:
amp_in_caps amp_out_caps caps connections pin_caps pin_cfg
power_caps
/sys/bus/hdaudio/devices/hdaudioC0D0/widgets/03:
.....
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Now some codes and functionalities of hda_codec struct are moved to
hdac_device struct. A few basic attributes like the codec address,
vendor ID number, FG numbers, etc are moved to hdac_device, and they
are accessed like codec->core.addr. The basic verb exec functions are
moved, too.
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Takashi Iwai