Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

add audioinjector stereo soundcard #4

Open
wants to merge 2 commits into
base: release-4.4-rockpi4
Choose a base branch
from

Conversation

verplant23
Copy link

No description provided.

@chronopoulos
Copy link

i was able to compile and install the driver and overlay, but upon rebooting, i get the following in dmesg:

audioinjector-stereo sound-ext-card: ASoC: machine hw_params failed: -22

and aplay gives a similar error:

Playing WAVE 'LRMonoPhase4.wav' : Signed 16 bit Little Endian, Rate 48000 Hz, Stereo aplay: set_params:1363: Unable to install hw params: ACCESS: RW_INTERLEAVED FORMAT: S16_LE SUBFORMAT: STD SAMPLE_BITS: 16 FRAME_BITS: 32 CHANNELS: 2 RATE: 48000 PERIOD_TIME: 125000 PERIOD_SIZE: 6000 PERIOD_BYTES: 24000 PERIODS: 4 BUFFER_TIME: 500000 BUFFER_SIZE: 24000 BUFFER_BYTES: 96000 TICK_TIME: 0

do you see something different? i'm on 4.4.154-90-rockchip-ga14f6502e045

Copy link

@StephenInVamrs StephenInVamrs left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi, thanks for your PR for audio injector stereo soundcard.

There is one question. Since the file rockchip_linux_defconfig is organized with 'make savedefconfig', I hope you can modify that file.

@verplant23
Copy link
Author

mh there will be some errors because of different or unused
.cpu_dai_name
.platform_name
inside audioinjector-pi-soundcard.c

the errors inside dmesg:
audioinjector-stereo sound-ext-card: ASoC: CPU DAI (null) not registered
audioinjector-stereo sound-ext-card: snd_soc_register_card failed (-517)
but since u will get:
audioinjector-stereo sound-ext-card: wm8731-hifi <-> ff890000.i2s mapping ok

everything will be okay.

take a look inside /boot/overlays if the dtbo file is there....
don´t forget to activate i2c7 and the card inside hw_intfc.conf

check for modules loaded lsmod and if the card is recognized cat /proc/asound/cards

double check if the card is okay on a well working device

defconfig update
@verplant23
Copy link
Author

verplant23 commented Jun 9, 2020

@StephenInVamrs updated defconfig

@chronopoulos can´t reproduce your error. everything seems to work

@chronopoulos
Copy link

@verplant23 which kernel are you testing against? have you tried to output audio using aplay (or similar)? i just don't see how it even could work, given that your snd_soc_dai_link has "bcm2708-i2s.0" as its cpu_dai_name. shouldn't it be "rockchip-i2s.1" ?

@verplant23
Copy link
Author

mh take a look at ...

https://github.com/verplant23/kernel

This branch is 2 commits ahead of radxa:release-4.4-rockpi4.

Makefile tells you
VERSION = 4
PATCHLEVEL = 4
SUBLEVEL = 154

when you look at
.cpu_dai_name = "bcm2708-i2s.0",
.platform_name = "bcm2708-i2s.0",

these parameters don´t seem to fit correct...and i think the correct parameter will prefend dmesg error i reported above :
audioinjector-stereo sound-ext-card: ASoC: CPU DAI (null) not registered
audioinjector-stereo sound-ext-card: snd_soc_register_card failed (-517)

but for working device i think they are not too important.
take a look at the examples:

static struct snd_soc_dai_link snd_rpi_hifiberry_dacplus_dai[] = {

static struct snd_soc_dai_link snd_rpi_hifiberry_dac_dai[] = {

https://github.com/TinkerBoard/debian_kernel/blob/b0903b21232b1c300b09a26742046b9565d19ffe/sound/soc/rockchip/rpi-dac.c#L57

https://github.com/TinkerBoard/debian_kernel/blob/b0903b21232b1c300b09a26742046b9565d19ffe/sound/soc/rockchip/hifiberry_amp.c#L56

https://github.com/TinkerBoard/debian_kernel/blob/b0903b21232b1c300b09a26742046b9565d19ffe/sound/soc/rockchip/hifiberry_digi.c#L193

@chronopoulos
Copy link

but have these actually been tested to produce working audio (playback and capture)? i only have a WM8731 dev board, not the hifiberry boards, but for me this audioinjector driver doesn't work with aplay/arecord (i get a bunch of underruns, and no audio).

on the other hand, this other driver i'm working on produces good output, but no input yet. i found that it was necessary to set the cpu_dai_name and platform_name to "rockchip-i2s.1" (I2S port 1) to get this to work at all. now i'm trying to figure out what's wrong the the input stream (i get "arecord: pcm_read:2103: read error: Input/output error").

@verplant23
Copy link
Author

have to look for the input. i didn´t used it for now.
**** Liste der Hardware-Geräte (PLAYBACK) ****
Karte 0: audioinjectorpi [audioinjector-pi-soundcard], Gerät 0: AudioInjector audio wm8731-hifi-0 []
Sub-Geräte: 1/1
Sub-Gerät #0: subdevice #0

aplay -L
default
Playback/recording through the PulseAudio sound server
null
Discard all samples (playback) or generate zero samples (capture)
samplerate
Rate Converter Plugin Using Samplerate Library
speexrate
Rate Converter Plugin Using Speex Resampler
jack
JACK Audio Connection Kit
oss
Open Sound System
pulse
PulseAudio Sound Server
upmix
Plugin for channel upmix (4,6,8)
vdownmix
Plugin for channel downmix (stereo) with a simple spacialization
sysdefault:CARD=audioinjectorpi
audioinjector-pi-soundcard,
Default Audio Device
dmix:CARD=audioinjectorpi,DEV=0
audioinjector-pi-soundcard,
Direct sample mixing device
dsnoop:CARD=audioinjectorpi,DEV=0
audioinjector-pi-soundcard,
Direct sample snooping device
hw:CARD=audioinjectorpi,DEV=0
audioinjector-pi-soundcard,
Direct hardware device without any conversions
plughw:CARD=audioinjectorpi,DEV=0
audioinjector-pi-soundcard,
Hardware device with all software conversions
usbstream:CARD=audioinjectorpi
audioinjector-pi-soundcard
USB Stream Output

alsacap -C 0
*** Scanning for playback devices on card 0 ***
Card 0, ID audioinjectorpi', name audioinjector-pi-soundcard'
Device 0, ID AudioInjector audio wm8731-hifi-0', name ', 1 subdevices (1 available)
2 channels, sampling rate 8000..96000 Hz
Sample formats: S16_LE, S24_LE
Subdevice 0, name `subdevice #0'

alsacap -R -C 0
*** Scanning for recording devices on card 0 ***
Card 0, ID audioinjectorpi', name audioinjector-pi-soundcard'
Device 0, ID AudioInjector audio wm8731-hifi-0', name ', 1 subdevices (1 available)
2 channels, sampling rate 8000..96000 Hz
Sample formats: S16_LE, S24_LE
Subdevice 0, name `subdevice #0'

@chronopoulos
Copy link

and if you try to play an audio file, e.g.

aplay -D hw:0,0 filename.wav

what happens? do you hear audio?

@verplant23
Copy link
Author

verplant23 commented Jun 11, 2020 via email

@tuyaliang
Copy link

How to enable radxa zero dwc2 function?

StephenInVamrs pushed a commit that referenced this pull request Jan 14, 2022
up_read() may wakeup some tasks, so do not call up_read() in scheduler,
or it will cause deadlock as below:

Thread #4 5 (Name: cpu3, state: debug-request) (Suspended : Container)
        queued_spin_lock_slowpath() at qspinlock.c:369 0xffffff8008119120
        queued_spin_lock() at qspinlock.h:88 0xffffff8008f0a470
        do_raw_spin_lock() at spinlock.h:180 0xffffff8008f0a470
        __raw_spin_lock() at spinlock_api_smp.h:143 0xffffff8008f0a470
        _raw_spin_lock() at spinlock.c:144 0xffffff8008f0a470
        rq_lock() at sched.h:1,244 0xffffff80080f2f4c
        ttwu_queue() at core.c:2,442 0xffffff80080f2f4c
        try_to_wake_up() at core.c:2,658 0xffffff80080eb998
        wake_up_q() at core.c:450 0xffffff80080eb6a8
        rwsem_wake() at rwsem-xadd.c:703 0xffffff800811a44c
        __up_read() at rwsem.h:107 0xffffff8008118930
        up_read() at rwsem.c:122 0xffffff8008118930
        cpufreq_task_boost() at cpufreq_interactive.c:1,449 0xffffff8008a4bdb4
        enqueue_task_fair() at fair.c:5,285 0xffffff80080f7814
        enqueue_task() at core.c:1,324 0xffffff80080ec15c
        activate_task() at core.c:1,346 0xffffff80080ec15c
        ttwu_activate() at core.c:2,240 0xffffff80080f2fc0
        ttwu_do_activate() at core.c:2,299 0xffffff80080f2fc0
        ttwu_queue() at core.c:2,444 0xffffff80080f2fc0
        try_to_wake_up() at core.c:2,658 0xffffff80080eb998
        wake_up_q() at core.c:450 0xffffff80080eb6a8
        futex_wake() at futex.c:1,636 0xffffff8008159e78
        do_futex() at futex.c:3,714 0xffffff8008158fb0
        __do_sys_futex() at futex.c:3,770 0xffffff800815bd98
        __se_sys_futex() at futex.c:3,738 0xffffff800815bd98
        __arm64_sys_futex() at futex.c:3,738 0xffffff800815bd98
        __invoke_syscall() at syscall.c:36 0xffffff8008098d6c
        invoke_syscall() at syscall.c:48 0xffffff8008098d6c
        el0_svc_common() at syscall.c:117 0xffffff8008098d6c
        el0_svc_handler() at syscall.c:163 0xffffff8008098ccc
        el0_svc() at entry.S:940 0xffffff8008083d08

Fixes: 205ed4e (cpufreq: interactive: introduce boost cpufreq interface for task)

Change-Id: I9607faa5ede3a662e7f2f55da29b08fc328f4d43
Signed-off-by: Liang Chen <[email protected]>
RadxaStephen pushed a commit that referenced this pull request Oct 27, 2022
This patch add support for DMA-based digital loopback.

BACKGROUND
Audio Products with AEC require loopback for echo cancellation.
the hardware LP is not always available on some products, maybe
the HW limitation(such as internal acodec) or HW Cost-down.

This patch add support software DLP for such products.

Enable:

  CONFIG_SND_SOC_ROCKCHIP_DLP

  &i2s {
      rockchip,digital-loopback;
  };

Mode List:

  amixer contents
  numid=2,iface=MIXER,name='Software Digital Loopback Mode'
    ; type=ENUMERATED,access=rw------,values=1,items=7
    ; Item #0 'Disabled'
    ; Item #1 '2CH: 1 Loopback + 1 Mic'
    ; Item #2 '2CH: 1 Mic + 1 Loopback'
    ; Item #3 '2CH: 1 Mic + 1 Loopback-mixed'
    ; Item #4 '2CH: 2 Loopbacks'
    ; Item #5 '4CH: 2 Mics + 2 Loopbacks'
    ; Item #6 '4CH: 2 Mics + 1 Loopback-mixed'
    : values=0

Testenv:

wired SDO0 --> SDI0 directly to get external digital loopback
as reference.

Testcase: dlp.sh

  /#!/bin/sh

  item=0
  id=`amixer contents | grep "Software Digital Loopback" | \
      awk -F ',' '{print $1}'`

  items=`amixer contents | grep -A 1 "Software Digital Loopback" | \
         grep items | awk -F 'items=' '{print $2}'`

  echo "Software Digital Loopback: $id, items: $items"

  mode_chs() {
          case $1 in
          [0-4])
                  echo "2"
                  ;;
          [5-6])
                  echo "4"
                  ;;
          *)
                  echo "2"
                  ;;
          esac
  }

  while true
  do
          ch=`mode_chs $item`
          amixer -c 0 cset $id $item
          arecord -D hw:0,0 --period-size=1024 --buffer-size=4096 -r 48000 -c $ch -f s16_le \
                  -d 15 sine/dlp_$item.wav &
          sleep 2
          for i in $(seq 1 10)
          do
                  aplay -D hw:0,0 --period-size=1024 --buffer-size=8192 $((ch))ch.wav -d 1
          done
          pid=$(ps | egrep "aplay|arecord" | grep -v grep | awk '{print $1}' | sort -r)
          for p in $pid
          do
                  wait $p 2>/dev/null
          done
          item=$((item+1))
          if [ $item -ge $items ]; then
                  sleep 1
                  break
          fi
  done
  echo "Done"

Result:

do shell test and verify dlp_x.wav:

* Alignment: ~1 samples shift (loopback <-> mics).
* Integrity: no giltch, no data lost.
* AEC: align loopback and mics sample and do simple AEC, get clean
  waveform.

Logs:
...
numid=2,iface=MIXER,name='Software Digital Loopback Mode'
  ; type=ENUMERATED,access=rw------,values=1,items=7
  ; Item #0 'Disabled'
  ; Item #1 '2CH: 1 Loopback + 1 Mic'
  ; Item #2 '2CH: 1 Mic + 1 Loopback'
  ; Item #3 '2CH: 1 Mic + 1 Loopback-mixed'
  ; Item #4 '2CH: 2 Loopbacks'
  ; Item #5 '4CH: 2 Mics + 2 Loopbacks'
  ; Item #6 '4CH: 2 Mics + 1 Loopback-mixed'
  : values=2
Recording WAVE 'sine/dlp_2.wav' : Signed 16 bit Little Endian, Rate 48000 Hz, Stereo
Playing WAVE '2ch.wav' : Signed 16 bit Little Endian, Rate 48000 Hz, Stereo
Playing WAVE '2ch.wav' : Signed 16 bit Little Endian, Rate 48000 Hz, Stereo
Playing WAVE '2ch.wav' : Signed 16 bit Little Endian, Rate 48000 Hz, Stereo
Playing WAVE '2ch.wav' : Signed 16 bit Little Endian, Rate 48000 Hz, Stereo
Playing WAVE '2ch.wav' : Signed 16 bit Little Endian, Rate 48000 Hz, Stereo
Playing WAVE '2ch.wav' : Signed 16 bit Little Endian, Rate 48000 Hz, Stereo
Playing WAVE '2ch.wav' : Signed 16 bit Little Endian, Rate 48000 Hz, Stereo
Playing WAVE '2ch.wav' : Signed 16 bit Little Endian, Rate 48000 Hz, Stereo
Playing WAVE '2ch.wav' : Signed 16 bit Little Endian, Rate 48000 Hz, Stereo
Playing WAVE '2ch.wav' : Signed 16 bit Little Endian, Rate 48000 Hz, Stereo
...
numid=2,iface=MIXER,name='Software Digital Loopback Mode'
  ; type=ENUMERATED,access=rw------,values=1,items=7
  ; Item #0 'Disabled'
  ; Item #1 '2CH: 1 Loopback + 1 Mic'
  ; Item #2 '2CH: 1 Mic + 1 Loopback'
  ; Item #3 '2CH: 1 Mic + 1 Loopback-mixed'
  ; Item #4 '2CH: 2 Loopbacks'
  ; Item #5 '4CH: 2 Mics + 2 Loopbacks'
  ; Item #6 '4CH: 2 Mics + 1 Loopback-mixed'
  : values=6
Recording WAVE 'sine/dlp_6.wav' : Signed 16 bit Little Endian, Rate 48000 Hz, Channels 4
Playing WAVE '4ch.wav' : Signed 16 bit Little Endian, Rate 48000 Hz, Channels 4
Playing WAVE '4ch.wav' : Signed 16 bit Little Endian, Rate 48000 Hz, Channels 4
Playing WAVE '4ch.wav' : Signed 16 bit Little Endian, Rate 48000 Hz, Channels 4
Playing WAVE '4ch.wav' : Signed 16 bit Little Endian, Rate 48000 Hz, Channels 4
Playing WAVE '4ch.wav' : Signed 16 bit Little Endian, Rate 48000 Hz, Channels 4
Playing WAVE '4ch.wav' : Signed 16 bit Little Endian, Rate 48000 Hz, Channels 4
Playing WAVE '4ch.wav' : Signed 16 bit Little Endian, Rate 48000 Hz, Channels 4
Playing WAVE '4ch.wav' : Signed 16 bit Little Endian, Rate 48000 Hz, Channels 4
Playing WAVE '4ch.wav' : Signed 16 bit Little Endian, Rate 48000 Hz, Channels 4
Playing WAVE '4ch.wav' : Signed 16 bit Little Endian, Rate 48000 Hz, Channels 4
Done

Signed-off-by: Sugar Zhang <[email protected]>
Change-Id: I5772f0694f7a14a0f0bd1f0777b6c4cdbd781a64
RadxaStephen pushed a commit that referenced this pull request Oct 27, 2022
[    3.193377] ------------[ cut here ]------------
[    3.193394] WARNING: CPU: 2 PID: 1 at drivers/regulator/core.c:2159 _regulator_put+0x34/0xc8
[    3.193400] Modules linked in:
[    3.193410] CPU: 2 PID: 1 Comm: swapper/0 Tainted: G        W         5.10.110 #4
[    3.193416] Hardware name: Rockchip RK3568 EVB1 DDR4 V10 Board (DT)
[    3.193423] pstate: 80c00009 (Nzcv daif +PAN +UAO -TCO BTYPE=--)
[    3.193430] pc : _regulator_put+0x34/0xc8
[    3.193437] lr : regulator_put+0x3c/0x54
[    3.193441] sp : ffffffc011e7bad0
[    3.193446] x29: ffffffc011e7bad0 x28: 0000000000000000
[    3.193455] x27: ffffffc011490440 x26: 0000000000000000
[    3.193464] x25: ffffffc011ca2880 x24: ffffffc0112a07f6
[    3.193473] x23: ffffff8004d71700 x22: 0000000000000008
[    3.193481] x21: 0000000000000002 x20: ffffff8004d71b00
[    3.193490] x19: ffffff8004d71b00 x18: ffffff80028f5550
[    3.193500] x17: 0000000000000000 x16: 0000000000000000
[    3.193509] x15: ffffff80026b8610 x14: ffffff80028f5488
[    3.193518] x13: 0000000000000016 x12: 0000000000000018
[    3.193527] x11: 0000000000000018 x10: ffffff80026b8630
[    3.193536] x9 : ffffffc0105d7eec x8 : ffffff80026b8610
[    3.193544] x7 : ffffffc011e7b998 x6 : 0000000000000001
[    3.193553] x5 : ffffff8002718000 x4 : 0000000000000000
[    3.193562] x3 : 0000000000000000 x2 : 0000000000000000
[    3.193571] x1 : ffffff8002718000 x0 : 0000000000000001
[    3.193579] Call trace:
[    3.193587]  _regulator_put+0x34/0xc8
[    3.193593]  regulator_put+0x3c/0x54
[    3.193600]  regulator_bulk_free+0x54/0x5c
[    3.193607]  devm_regulator_bulk_release+0x28/0x34
[    3.193616]  release_nodes+0x1f4/0x224
[    3.193622]  devres_release_all+0x5c/0x60
[    3.193630]  really_probe+0x218/0x46c
[    3.193637]  driver_probe_device+0x138/0x148
[    3.193644]  device_driver_attach+0x50/0x7c
[    3.193651]  __driver_attach+0x150/0x154
[    3.193657]  bus_for_each_dev+0x7c/0xc8
[    3.193664]  driver_attach+0x30/0x3c
[    3.193670]  bus_add_driver+0x1b4/0x1fc
[    3.193676]  driver_register+0xc0/0xf8
[    3.193684]  i2c_register_driver+0x70/0xb4
[    3.193692]  sensor_mod_init+0x28/0x34
[    3.193699]  do_one_initcall+0xa0/0x1e8
[    3.193707]  kernel_init_freeable+0x2a4/0x2ac
[    3.193714]  kernel_init+0x20/0x11c

Signed-off-by: Zefa Chen <[email protected]>
Change-Id: I7ce7fc064ddb5bbe717245f1aaf83fccafd3db02
DsoTsin pushed a commit to Tsinworks/kernel-radxa-horizon that referenced this pull request Aug 1, 2023
Example: RK3588

Use I2S2_2CH as Clk-Gen to serve TDM_MULTI_LANES

I2S2_2CH ----> BCLK,I2S_LRCK --------> I2S0_8CH_TX (Slave TRCM-TXONLY)
    |
    |--------> BCLK,TDM_SYNC --------> TDM Device (Slave)

Note:

I2S2_2CH_MCLK: BCLK
I2S2_2CH_SCLK: I2S_LRCK (GPIO2_B7)
I2S2_2CH_LRCK: TDM_SYNC (GPIO2_C0)

DT:

&i2s0_8ch {
       status = "okay";
       assigned-clocks = <&cru I2S0_8CH_MCLKOUT>;
       assigned-clock-parents = <&cru MCLK_I2S0_8CH_TX>;
       i2s-lrck-gpio = <&gpio1 RK_PC5 GPIO_ACTIVE_HIGH>;
       tdm-fsync-gpio = <&gpio1 RK_PC2 GPIO_ACTIVE_HIGH>;
       rockchip,tdm-multi-lanes;
       rockchip,tdm-tx-lanes = <2>; //e.g. TDM16 x 2
       rockchip,tdm-rx-lanes = <2>; //e.g. TDM16 x 2
       rockchip,clk-src = <&i2s2_2ch>;
       pinctrl-names = "default";
       pinctrl-0 = <&i2s0_lrck
                    &i2s0_sclk
                    &i2s0_sdi0
                    &i2s0_sdi1
                    &i2s0_sdo0
                    &i2s0_sdo1>;
};

&i2s2_2ch {
       status = "okay";
       assigned-clocks = <&cru I2S2_2CH_MCLKOUT>;
       assigned-clock-parents = <&cru MCLK_I2S2_2CH>;
       pinctrl-names = "default";
       pinctrl-0 = <&i2s2m0_mclk
                    &i2s2m0_lrck
                    &i2s2m0_sclk>;
};

Usage: TDM16 x 2 Playback

amixer contents

numid=3,iface=MIXER,name='Receive SDIx Select'
  ; type=ENUMERATED,access=rw------,values=1,items=5
  ; Item #0 'Auto'
  ; Item radxa#1 'SDIx1'
  ; Item radxa#2 'SDIx2'
  ; Item radxa#3 'SDIx3'
  ; Item radxa#4 'SDIx4'
  : values=0
numid=2,iface=MIXER,name='Transmit SDOx Select'
  ; type=ENUMERATED,access=rw------,values=1,items=5
  ; Item #0 'Auto'
  ; Item radxa#1 'SDOx1'
  ; Item radxa#2 'SDOx2'
  ; Item radxa#3 'SDOx3'
  ; Item radxa#4 'SDOx4'
  : values=0

/# amixer sset "Transmit SDOx Select" "SDOx2"
Simple mixer control 'Transmit SDOx Select',0
  Capabilities: enum
  Items: 'Auto' 'SDOx1' 'SDOx2' 'SDOx3' 'SDOx4'
  Item0: 'SDOx2'

/# aplay -D hw:0,0 --period-size=1024 --buffer-size=4096 -r 48000 \
   -c 32 -f s32_le /dev/zero

Signed-off-by: Sugar Zhang <[email protected]>
Change-Id: I6996e05c73a9d68bbeb9562eb6e68e4c99b52d85
DsoTsin pushed a commit to Tsinworks/kernel-radxa-horizon that referenced this pull request Aug 1, 2023
…kernel/git/kvmarm/kvmarm into HEAD

KVM/arm64 fixes for 6.4, take radxa#4

- Correctly save/restore PMUSERNR_EL0 when host userspace is using
  PMU counters directly

- Fix GICv2 emulation on GICv3 after the locking rework

- Don't use smp_processor_id() in kvm_pmu_probe_armpmu(), and
  document why...
DsoTsin pushed a commit to Tsinworks/kernel-radxa-horizon that referenced this pull request Sep 6, 2023
Example: RK3588

Use I2S2_2CH as Clk-Gen to serve TDM_MULTI_LANES

I2S2_2CH ----> BCLK,I2S_LRCK --------> I2S0_8CH_TX (Slave TRCM-TXONLY)
    |
    |--------> BCLK,TDM_SYNC --------> TDM Device (Slave)

Note:

I2S2_2CH_MCLK: BCLK
I2S2_2CH_SCLK: I2S_LRCK (GPIO2_B7)
I2S2_2CH_LRCK: TDM_SYNC (GPIO2_C0)

DT:

&i2s0_8ch {
       status = "okay";
       assigned-clocks = <&cru I2S0_8CH_MCLKOUT>;
       assigned-clock-parents = <&cru MCLK_I2S0_8CH_TX>;
       i2s-lrck-gpio = <&gpio1 RK_PC5 GPIO_ACTIVE_HIGH>;
       tdm-fsync-gpio = <&gpio1 RK_PC2 GPIO_ACTIVE_HIGH>;
       rockchip,tdm-multi-lanes;
       rockchip,tdm-tx-lanes = <2>; //e.g. TDM16 x 2
       rockchip,tdm-rx-lanes = <2>; //e.g. TDM16 x 2
       rockchip,clk-src = <&i2s2_2ch>;
       pinctrl-names = "default";
       pinctrl-0 = <&i2s0_lrck
                    &i2s0_sclk
                    &i2s0_sdi0
                    &i2s0_sdi1
                    &i2s0_sdo0
                    &i2s0_sdo1>;
};

&i2s2_2ch {
       status = "okay";
       assigned-clocks = <&cru I2S2_2CH_MCLKOUT>;
       assigned-clock-parents = <&cru MCLK_I2S2_2CH>;
       pinctrl-names = "default";
       pinctrl-0 = <&i2s2m0_mclk
                    &i2s2m0_lrck
                    &i2s2m0_sclk>;
};

Usage: TDM16 x 2 Playback

amixer contents

numid=3,iface=MIXER,name='Receive SDIx Select'
  ; type=ENUMERATED,access=rw------,values=1,items=5
  ; Item #0 'Auto'
  ; Item radxa#1 'SDIx1'
  ; Item radxa#2 'SDIx2'
  ; Item radxa#3 'SDIx3'
  ; Item radxa#4 'SDIx4'
  : values=0
numid=2,iface=MIXER,name='Transmit SDOx Select'
  ; type=ENUMERATED,access=rw------,values=1,items=5
  ; Item #0 'Auto'
  ; Item radxa#1 'SDOx1'
  ; Item radxa#2 'SDOx2'
  ; Item radxa#3 'SDOx3'
  ; Item radxa#4 'SDOx4'
  : values=0

/# amixer sset "Transmit SDOx Select" "SDOx2"
Simple mixer control 'Transmit SDOx Select',0
  Capabilities: enum
  Items: 'Auto' 'SDOx1' 'SDOx2' 'SDOx3' 'SDOx4'
  Item0: 'SDOx2'

/# aplay -D hw:0,0 --period-size=1024 --buffer-size=4096 -r 48000 \
   -c 32 -f s32_le /dev/zero

Signed-off-by: Sugar Zhang <[email protected]>
Change-Id: I6996e05c73a9d68bbeb9562eb6e68e4c99b52d85
RadxaStephen pushed a commit that referenced this pull request Aug 3, 2024
[ Upstream commit 1b0e814 ]

Commit 3e3b5df ("NFC: reorder the logic in nfc_{un,}register_device")
assumes the device_is_registered() in function nfc_dev_up() will help
to check when the rfkill is unregistered. However, this check only
take effect when device_del(&dev->dev) is done in nfc_unregister_device().
Hence, the rfkill object is still possible be dereferenced.

The crash trace in latest kernel (5.18-rc2):

[   68.760105] ==================================================================
[   68.760330] BUG: KASAN: use-after-free in __lock_acquire+0x3ec1/0x6750
[   68.760756] Read of size 8 at addr ffff888009c93018 by task fuzz/313
[   68.760756]
[   68.760756] CPU: 0 PID: 313 Comm: fuzz Not tainted 5.18.0-rc2 #4
[   68.760756] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
[   68.760756] Call Trace:
[   68.760756]  <TASK>
[   68.760756]  dump_stack_lvl+0x57/0x7d
[   68.760756]  print_report.cold+0x5e/0x5db
[   68.760756]  ? __lock_acquire+0x3ec1/0x6750
[   68.760756]  kasan_report+0xbe/0x1c0
[   68.760756]  ? __lock_acquire+0x3ec1/0x6750
[   68.760756]  __lock_acquire+0x3ec1/0x6750
[   68.760756]  ? lockdep_hardirqs_on_prepare+0x410/0x410
[   68.760756]  ? register_lock_class+0x18d0/0x18d0
[   68.760756]  lock_acquire+0x1ac/0x4f0
[   68.760756]  ? rfkill_blocked+0xe/0x60
[   68.760756]  ? lockdep_hardirqs_on_prepare+0x410/0x410
[   68.760756]  ? mutex_lock_io_nested+0x12c0/0x12c0
[   68.760756]  ? nla_get_range_signed+0x540/0x540
[   68.760756]  ? _raw_spin_lock_irqsave+0x4e/0x50
[   68.760756]  _raw_spin_lock_irqsave+0x39/0x50
[   68.760756]  ? rfkill_blocked+0xe/0x60
[   68.760756]  rfkill_blocked+0xe/0x60
[   68.760756]  nfc_dev_up+0x84/0x260
[   68.760756]  nfc_genl_dev_up+0x90/0xe0
[   68.760756]  genl_family_rcv_msg_doit+0x1f4/0x2f0
[   68.760756]  ? genl_family_rcv_msg_attrs_parse.constprop.0+0x230/0x230
[   68.760756]  ? security_capable+0x51/0x90
[   68.760756]  genl_rcv_msg+0x280/0x500
[   68.760756]  ? genl_get_cmd+0x3c0/0x3c0
[   68.760756]  ? lock_acquire+0x1ac/0x4f0
[   68.760756]  ? nfc_genl_dev_down+0xe0/0xe0
[   68.760756]  ? lockdep_hardirqs_on_prepare+0x410/0x410
[   68.760756]  netlink_rcv_skb+0x11b/0x340
[   68.760756]  ? genl_get_cmd+0x3c0/0x3c0
[   68.760756]  ? netlink_ack+0x9c0/0x9c0
[   68.760756]  ? netlink_deliver_tap+0x136/0xb00
[   68.760756]  genl_rcv+0x1f/0x30
[   68.760756]  netlink_unicast+0x430/0x710
[   68.760756]  ? memset+0x20/0x40
[   68.760756]  ? netlink_attachskb+0x740/0x740
[   68.760756]  ? __build_skb_around+0x1f4/0x2a0
[   68.760756]  netlink_sendmsg+0x75d/0xc00
[   68.760756]  ? netlink_unicast+0x710/0x710
[   68.760756]  ? netlink_unicast+0x710/0x710
[   68.760756]  sock_sendmsg+0xdf/0x110
[   68.760756]  __sys_sendto+0x19e/0x270
[   68.760756]  ? __ia32_sys_getpeername+0xa0/0xa0
[   68.760756]  ? fd_install+0x178/0x4c0
[   68.760756]  ? fd_install+0x195/0x4c0
[   68.760756]  ? kernel_fpu_begin_mask+0x1c0/0x1c0
[   68.760756]  __x64_sys_sendto+0xd8/0x1b0
[   68.760756]  ? lockdep_hardirqs_on+0xbf/0x130
[   68.760756]  ? syscall_enter_from_user_mode+0x1d/0x50
[   68.760756]  do_syscall_64+0x3b/0x90
[   68.760756]  entry_SYSCALL_64_after_hwframe+0x44/0xae
[   68.760756] RIP: 0033:0x7f67fb50e6b3
...
[   68.760756] RSP: 002b:00007f67fa91fe90 EFLAGS: 00000293 ORIG_RAX: 000000000000002c
[   68.760756] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f67fb50e6b3
[   68.760756] RDX: 000000000000001c RSI: 0000559354603090 RDI: 0000000000000003
[   68.760756] RBP: 00007f67fa91ff00 R08: 00007f67fa91fedc R09: 000000000000000c
[   68.760756] R10: 0000000000000000 R11: 0000000000000293 R12: 00007ffe824d496e
[   68.760756] R13: 00007ffe824d496f R14: 00007f67fa120000 R15: 0000000000000003

[   68.760756]  </TASK>
[   68.760756]
[   68.760756] Allocated by task 279:
[   68.760756]  kasan_save_stack+0x1e/0x40
[   68.760756]  __kasan_kmalloc+0x81/0xa0
[   68.760756]  rfkill_alloc+0x7f/0x280
[   68.760756]  nfc_register_device+0xa3/0x1a0
[   68.760756]  nci_register_device+0x77a/0xad0
[   68.760756]  nfcmrvl_nci_register_dev+0x20b/0x2c0
[   68.760756]  nfcmrvl_nci_uart_open+0xf2/0x1dd
[   68.760756]  nci_uart_tty_ioctl+0x2c3/0x4a0
[   68.760756]  tty_ioctl+0x764/0x1310
[   68.760756]  __x64_sys_ioctl+0x122/0x190
[   68.760756]  do_syscall_64+0x3b/0x90
[   68.760756]  entry_SYSCALL_64_after_hwframe+0x44/0xae
[   68.760756]
[   68.760756] Freed by task 314:
[   68.760756]  kasan_save_stack+0x1e/0x40
[   68.760756]  kasan_set_track+0x21/0x30
[   68.760756]  kasan_set_free_info+0x20/0x30
[   68.760756]  __kasan_slab_free+0x108/0x170
[   68.760756]  kfree+0xb0/0x330
[   68.760756]  device_release+0x96/0x200
[   68.760756]  kobject_put+0xf9/0x1d0
[   68.760756]  nfc_unregister_device+0x77/0x190
[   68.760756]  nfcmrvl_nci_unregister_dev+0x88/0xd0
[   68.760756]  nci_uart_tty_close+0xdf/0x180
[   68.760756]  tty_ldisc_kill+0x73/0x110
[   68.760756]  tty_ldisc_hangup+0x281/0x5b0
[   68.760756]  __tty_hangup.part.0+0x431/0x890
[   68.760756]  tty_release+0x3a8/0xc80
[   68.760756]  __fput+0x1f0/0x8c0
[   68.760756]  task_work_run+0xc9/0x170
[   68.760756]  exit_to_user_mode_prepare+0x194/0x1a0
[   68.760756]  syscall_exit_to_user_mode+0x19/0x50
[   68.760756]  do_syscall_64+0x48/0x90
[   68.760756]  entry_SYSCALL_64_after_hwframe+0x44/0xae

This patch just add the null out of dev->rfkill to make sure such
dereference cannot happen. This is safe since the device_lock() already
protect the check/write from data race.

Fixes: 3e3b5df ("NFC: reorder the logic in nfc_{un,}register_device")
Signed-off-by: Lin Ma <[email protected]>
Reviewed-by: Krzysztof Kozlowski <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants