add audioinjector stereo soundcard #4
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
i was able to compile and install the driver and overlay, but upon rebooting, i get the following in dmesg:
and aplay gives a similar error:
do you see something different? i'm on 4.4.154-90-rockchip-ga14f6502e045 |
|
mh there will be some errors because of different or unused the errors inside dmesg: everything will be okay. take a look inside /boot/overlays if the dtbo file is there.... check for modules loaded lsmod and if the card is recognized cat /proc/asound/cards double check if the card is okay on a well working device |
defconfig update
|
@StephenInVamrs updated defconfig @chronopoulos can´t reproduce your error. everything seems to work |
|
@verplant23 which kernel are you testing against? have you tried to output audio using |
|
mh take a look at ... https://github.com/verplant23/kernel This branch is 2 commits ahead of radxa:release-4.4-rockpi4. Makefile tells you when you look at these parameters don´t seem to fit correct...and i think the correct parameter will prefend dmesg error i reported above : but for working device i think they are not too important. kernel/sound/soc/rockchip/hifiberry_dacplus.c Line 296 in b04eccb kernel/sound/soc/rockchip/hifiberry_dac.c Line 59 in b04eccb |
|
but have these actually been tested to produce working audio (playback and capture)? i only have a WM8731 dev board, not the hifiberry boards, but for me this audioinjector driver doesn't work with aplay/arecord (i get a bunch of underruns, and no audio). on the other hand, this other driver i'm working on produces good output, but no input yet. i found that it was necessary to set the cpu_dai_name and platform_name to "rockchip-i2s.1" (I2S port 1) to get this to work at all. now i'm trying to figure out what's wrong the the input stream (i get "arecord: pcm_read:2103: read error: Input/output error"). |
|
have to look for the input. i didn´t used it for now. aplay -L alsacap -C 0 alsacap -R -C 0 |
|
and if you try to play an audio file, e.g.
what happens? do you hear audio? |
|
Yes
Mit freundlichen Grüßen - King regards
Steffen Heilmann
Chris Chronopoulos <[email protected]> schrieb am Do., 11. Juni
2020, 08:50:
… and if you try to play an audio file, e.g.
aplay -D hw:0,0 filename.wav
what happens? do you hear audio?
—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
<#4 (comment)>, or
unsubscribe
<https://github.com/notifications/unsubscribe-auth/AGMVMMPUT2VZ6EMPTII64UTRWB5DTANCNFSM4NSIODUQ>
.
|
|
How to enable radxa zero dwc2 function? |
StephenInVamrs
pushed a commit
that referenced
this pull request
Jan 14, 2022
up_read() may wakeup some tasks, so do not call up_read() in scheduler, or it will cause deadlock as below: Thread #4 5 (Name: cpu3, state: debug-request) (Suspended : Container) queued_spin_lock_slowpath() at qspinlock.c:369 0xffffff8008119120 queued_spin_lock() at qspinlock.h:88 0xffffff8008f0a470 do_raw_spin_lock() at spinlock.h:180 0xffffff8008f0a470 __raw_spin_lock() at spinlock_api_smp.h:143 0xffffff8008f0a470 _raw_spin_lock() at spinlock.c:144 0xffffff8008f0a470 rq_lock() at sched.h:1,244 0xffffff80080f2f4c ttwu_queue() at core.c:2,442 0xffffff80080f2f4c try_to_wake_up() at core.c:2,658 0xffffff80080eb998 wake_up_q() at core.c:450 0xffffff80080eb6a8 rwsem_wake() at rwsem-xadd.c:703 0xffffff800811a44c __up_read() at rwsem.h:107 0xffffff8008118930 up_read() at rwsem.c:122 0xffffff8008118930 cpufreq_task_boost() at cpufreq_interactive.c:1,449 0xffffff8008a4bdb4 enqueue_task_fair() at fair.c:5,285 0xffffff80080f7814 enqueue_task() at core.c:1,324 0xffffff80080ec15c activate_task() at core.c:1,346 0xffffff80080ec15c ttwu_activate() at core.c:2,240 0xffffff80080f2fc0 ttwu_do_activate() at core.c:2,299 0xffffff80080f2fc0 ttwu_queue() at core.c:2,444 0xffffff80080f2fc0 try_to_wake_up() at core.c:2,658 0xffffff80080eb998 wake_up_q() at core.c:450 0xffffff80080eb6a8 futex_wake() at futex.c:1,636 0xffffff8008159e78 do_futex() at futex.c:3,714 0xffffff8008158fb0 __do_sys_futex() at futex.c:3,770 0xffffff800815bd98 __se_sys_futex() at futex.c:3,738 0xffffff800815bd98 __arm64_sys_futex() at futex.c:3,738 0xffffff800815bd98 __invoke_syscall() at syscall.c:36 0xffffff8008098d6c invoke_syscall() at syscall.c:48 0xffffff8008098d6c el0_svc_common() at syscall.c:117 0xffffff8008098d6c el0_svc_handler() at syscall.c:163 0xffffff8008098ccc el0_svc() at entry.S:940 0xffffff8008083d08 Fixes: 205ed4e (cpufreq: interactive: introduce boost cpufreq interface for task) Change-Id: I9607faa5ede3a662e7f2f55da29b08fc328f4d43 Signed-off-by: Liang Chen <[email protected]>
RadxaStephen
pushed a commit
that referenced
this pull request
Oct 27, 2022
This patch add support for DMA-based digital loopback.
BACKGROUND
Audio Products with AEC require loopback for echo cancellation.
the hardware LP is not always available on some products, maybe
the HW limitation(such as internal acodec) or HW Cost-down.
This patch add support software DLP for such products.
Enable:
CONFIG_SND_SOC_ROCKCHIP_DLP
&i2s {
rockchip,digital-loopback;
};
Mode List:
amixer contents
numid=2,iface=MIXER,name='Software Digital Loopback Mode'
; type=ENUMERATED,access=rw------,values=1,items=7
; Item #0 'Disabled'
; Item #1 '2CH: 1 Loopback + 1 Mic'
; Item #2 '2CH: 1 Mic + 1 Loopback'
; Item #3 '2CH: 1 Mic + 1 Loopback-mixed'
; Item #4 '2CH: 2 Loopbacks'
; Item #5 '4CH: 2 Mics + 2 Loopbacks'
; Item #6 '4CH: 2 Mics + 1 Loopback-mixed'
: values=0
Testenv:
wired SDO0 --> SDI0 directly to get external digital loopback
as reference.
Testcase: dlp.sh
/#!/bin/sh
item=0
id=`amixer contents | grep "Software Digital Loopback" | \
awk -F ',' '{print $1}'`
items=`amixer contents | grep -A 1 "Software Digital Loopback" | \
grep items | awk -F 'items=' '{print $2}'`
echo "Software Digital Loopback: $id, items: $items"
mode_chs() {
case $1 in
[0-4])
echo "2"
;;
[5-6])
echo "4"
;;
*)
echo "2"
;;
esac
}
while true
do
ch=`mode_chs $item`
amixer -c 0 cset $id $item
arecord -D hw:0,0 --period-size=1024 --buffer-size=4096 -r 48000 -c $ch -f s16_le \
-d 15 sine/dlp_$item.wav &
sleep 2
for i in $(seq 1 10)
do
aplay -D hw:0,0 --period-size=1024 --buffer-size=8192 $((ch))ch.wav -d 1
done
pid=$(ps | egrep "aplay|arecord" | grep -v grep | awk '{print $1}' | sort -r)
for p in $pid
do
wait $p 2>/dev/null
done
item=$((item+1))
if [ $item -ge $items ]; then
sleep 1
break
fi
done
echo "Done"
Result:
do shell test and verify dlp_x.wav:
* Alignment: ~1 samples shift (loopback <-> mics).
* Integrity: no giltch, no data lost.
* AEC: align loopback and mics sample and do simple AEC, get clean
waveform.
Logs:
...
numid=2,iface=MIXER,name='Software Digital Loopback Mode'
; type=ENUMERATED,access=rw------,values=1,items=7
; Item #0 'Disabled'
; Item #1 '2CH: 1 Loopback + 1 Mic'
; Item #2 '2CH: 1 Mic + 1 Loopback'
; Item #3 '2CH: 1 Mic + 1 Loopback-mixed'
; Item #4 '2CH: 2 Loopbacks'
; Item #5 '4CH: 2 Mics + 2 Loopbacks'
; Item #6 '4CH: 2 Mics + 1 Loopback-mixed'
: values=2
Recording WAVE 'sine/dlp_2.wav' : Signed 16 bit Little Endian, Rate 48000 Hz, Stereo
Playing WAVE '2ch.wav' : Signed 16 bit Little Endian, Rate 48000 Hz, Stereo
Playing WAVE '2ch.wav' : Signed 16 bit Little Endian, Rate 48000 Hz, Stereo
Playing WAVE '2ch.wav' : Signed 16 bit Little Endian, Rate 48000 Hz, Stereo
Playing WAVE '2ch.wav' : Signed 16 bit Little Endian, Rate 48000 Hz, Stereo
Playing WAVE '2ch.wav' : Signed 16 bit Little Endian, Rate 48000 Hz, Stereo
Playing WAVE '2ch.wav' : Signed 16 bit Little Endian, Rate 48000 Hz, Stereo
Playing WAVE '2ch.wav' : Signed 16 bit Little Endian, Rate 48000 Hz, Stereo
Playing WAVE '2ch.wav' : Signed 16 bit Little Endian, Rate 48000 Hz, Stereo
Playing WAVE '2ch.wav' : Signed 16 bit Little Endian, Rate 48000 Hz, Stereo
Playing WAVE '2ch.wav' : Signed 16 bit Little Endian, Rate 48000 Hz, Stereo
...
numid=2,iface=MIXER,name='Software Digital Loopback Mode'
; type=ENUMERATED,access=rw------,values=1,items=7
; Item #0 'Disabled'
; Item #1 '2CH: 1 Loopback + 1 Mic'
; Item #2 '2CH: 1 Mic + 1 Loopback'
; Item #3 '2CH: 1 Mic + 1 Loopback-mixed'
; Item #4 '2CH: 2 Loopbacks'
; Item #5 '4CH: 2 Mics + 2 Loopbacks'
; Item #6 '4CH: 2 Mics + 1 Loopback-mixed'
: values=6
Recording WAVE 'sine/dlp_6.wav' : Signed 16 bit Little Endian, Rate 48000 Hz, Channels 4
Playing WAVE '4ch.wav' : Signed 16 bit Little Endian, Rate 48000 Hz, Channels 4
Playing WAVE '4ch.wav' : Signed 16 bit Little Endian, Rate 48000 Hz, Channels 4
Playing WAVE '4ch.wav' : Signed 16 bit Little Endian, Rate 48000 Hz, Channels 4
Playing WAVE '4ch.wav' : Signed 16 bit Little Endian, Rate 48000 Hz, Channels 4
Playing WAVE '4ch.wav' : Signed 16 bit Little Endian, Rate 48000 Hz, Channels 4
Playing WAVE '4ch.wav' : Signed 16 bit Little Endian, Rate 48000 Hz, Channels 4
Playing WAVE '4ch.wav' : Signed 16 bit Little Endian, Rate 48000 Hz, Channels 4
Playing WAVE '4ch.wav' : Signed 16 bit Little Endian, Rate 48000 Hz, Channels 4
Playing WAVE '4ch.wav' : Signed 16 bit Little Endian, Rate 48000 Hz, Channels 4
Playing WAVE '4ch.wav' : Signed 16 bit Little Endian, Rate 48000 Hz, Channels 4
Done
Signed-off-by: Sugar Zhang <[email protected]>
Change-Id: I5772f0694f7a14a0f0bd1f0777b6c4cdbd781a64
RadxaStephen
pushed a commit
that referenced
this pull request
Oct 27, 2022
[ 3.193377] ------------[ cut here ]------------ [ 3.193394] WARNING: CPU: 2 PID: 1 at drivers/regulator/core.c:2159 _regulator_put+0x34/0xc8 [ 3.193400] Modules linked in: [ 3.193410] CPU: 2 PID: 1 Comm: swapper/0 Tainted: G W 5.10.110 #4 [ 3.193416] Hardware name: Rockchip RK3568 EVB1 DDR4 V10 Board (DT) [ 3.193423] pstate: 80c00009 (Nzcv daif +PAN +UAO -TCO BTYPE=--) [ 3.193430] pc : _regulator_put+0x34/0xc8 [ 3.193437] lr : regulator_put+0x3c/0x54 [ 3.193441] sp : ffffffc011e7bad0 [ 3.193446] x29: ffffffc011e7bad0 x28: 0000000000000000 [ 3.193455] x27: ffffffc011490440 x26: 0000000000000000 [ 3.193464] x25: ffffffc011ca2880 x24: ffffffc0112a07f6 [ 3.193473] x23: ffffff8004d71700 x22: 0000000000000008 [ 3.193481] x21: 0000000000000002 x20: ffffff8004d71b00 [ 3.193490] x19: ffffff8004d71b00 x18: ffffff80028f5550 [ 3.193500] x17: 0000000000000000 x16: 0000000000000000 [ 3.193509] x15: ffffff80026b8610 x14: ffffff80028f5488 [ 3.193518] x13: 0000000000000016 x12: 0000000000000018 [ 3.193527] x11: 0000000000000018 x10: ffffff80026b8630 [ 3.193536] x9 : ffffffc0105d7eec x8 : ffffff80026b8610 [ 3.193544] x7 : ffffffc011e7b998 x6 : 0000000000000001 [ 3.193553] x5 : ffffff8002718000 x4 : 0000000000000000 [ 3.193562] x3 : 0000000000000000 x2 : 0000000000000000 [ 3.193571] x1 : ffffff8002718000 x0 : 0000000000000001 [ 3.193579] Call trace: [ 3.193587] _regulator_put+0x34/0xc8 [ 3.193593] regulator_put+0x3c/0x54 [ 3.193600] regulator_bulk_free+0x54/0x5c [ 3.193607] devm_regulator_bulk_release+0x28/0x34 [ 3.193616] release_nodes+0x1f4/0x224 [ 3.193622] devres_release_all+0x5c/0x60 [ 3.193630] really_probe+0x218/0x46c [ 3.193637] driver_probe_device+0x138/0x148 [ 3.193644] device_driver_attach+0x50/0x7c [ 3.193651] __driver_attach+0x150/0x154 [ 3.193657] bus_for_each_dev+0x7c/0xc8 [ 3.193664] driver_attach+0x30/0x3c [ 3.193670] bus_add_driver+0x1b4/0x1fc [ 3.193676] driver_register+0xc0/0xf8 [ 3.193684] i2c_register_driver+0x70/0xb4 [ 3.193692] sensor_mod_init+0x28/0x34 [ 3.193699] do_one_initcall+0xa0/0x1e8 [ 3.193707] kernel_init_freeable+0x2a4/0x2ac [ 3.193714] kernel_init+0x20/0x11c Signed-off-by: Zefa Chen <[email protected]> Change-Id: I7ce7fc064ddb5bbe717245f1aaf83fccafd3db02
DsoTsin
pushed a commit
to Tsinworks/kernel-radxa-horizon
that referenced
this pull request
Aug 1, 2023
Example: RK3588
Use I2S2_2CH as Clk-Gen to serve TDM_MULTI_LANES
I2S2_2CH ----> BCLK,I2S_LRCK --------> I2S0_8CH_TX (Slave TRCM-TXONLY)
|
|--------> BCLK,TDM_SYNC --------> TDM Device (Slave)
Note:
I2S2_2CH_MCLK: BCLK
I2S2_2CH_SCLK: I2S_LRCK (GPIO2_B7)
I2S2_2CH_LRCK: TDM_SYNC (GPIO2_C0)
DT:
&i2s0_8ch {
status = "okay";
assigned-clocks = <&cru I2S0_8CH_MCLKOUT>;
assigned-clock-parents = <&cru MCLK_I2S0_8CH_TX>;
i2s-lrck-gpio = <&gpio1 RK_PC5 GPIO_ACTIVE_HIGH>;
tdm-fsync-gpio = <&gpio1 RK_PC2 GPIO_ACTIVE_HIGH>;
rockchip,tdm-multi-lanes;
rockchip,tdm-tx-lanes = <2>; //e.g. TDM16 x 2
rockchip,tdm-rx-lanes = <2>; //e.g. TDM16 x 2
rockchip,clk-src = <&i2s2_2ch>;
pinctrl-names = "default";
pinctrl-0 = <&i2s0_lrck
&i2s0_sclk
&i2s0_sdi0
&i2s0_sdi1
&i2s0_sdo0
&i2s0_sdo1>;
};
&i2s2_2ch {
status = "okay";
assigned-clocks = <&cru I2S2_2CH_MCLKOUT>;
assigned-clock-parents = <&cru MCLK_I2S2_2CH>;
pinctrl-names = "default";
pinctrl-0 = <&i2s2m0_mclk
&i2s2m0_lrck
&i2s2m0_sclk>;
};
Usage: TDM16 x 2 Playback
amixer contents
numid=3,iface=MIXER,name='Receive SDIx Select'
; type=ENUMERATED,access=rw------,values=1,items=5
; Item #0 'Auto'
; Item radxa#1 'SDIx1'
; Item radxa#2 'SDIx2'
; Item radxa#3 'SDIx3'
; Item radxa#4 'SDIx4'
: values=0
numid=2,iface=MIXER,name='Transmit SDOx Select'
; type=ENUMERATED,access=rw------,values=1,items=5
; Item #0 'Auto'
; Item radxa#1 'SDOx1'
; Item radxa#2 'SDOx2'
; Item radxa#3 'SDOx3'
; Item radxa#4 'SDOx4'
: values=0
/# amixer sset "Transmit SDOx Select" "SDOx2"
Simple mixer control 'Transmit SDOx Select',0
Capabilities: enum
Items: 'Auto' 'SDOx1' 'SDOx2' 'SDOx3' 'SDOx4'
Item0: 'SDOx2'
/# aplay -D hw:0,0 --period-size=1024 --buffer-size=4096 -r 48000 \
-c 32 -f s32_le /dev/zero
Signed-off-by: Sugar Zhang <[email protected]>
Change-Id: I6996e05c73a9d68bbeb9562eb6e68e4c99b52d85
DsoTsin
pushed a commit
to Tsinworks/kernel-radxa-horizon
that referenced
this pull request
Aug 1, 2023
…kernel/git/kvmarm/kvmarm into HEAD KVM/arm64 fixes for 6.4, take radxa#4 - Correctly save/restore PMUSERNR_EL0 when host userspace is using PMU counters directly - Fix GICv2 emulation on GICv3 after the locking rework - Don't use smp_processor_id() in kvm_pmu_probe_armpmu(), and document why...
DsoTsin
pushed a commit
to Tsinworks/kernel-radxa-horizon
that referenced
this pull request
Sep 6, 2023
Example: RK3588
Use I2S2_2CH as Clk-Gen to serve TDM_MULTI_LANES
I2S2_2CH ----> BCLK,I2S_LRCK --------> I2S0_8CH_TX (Slave TRCM-TXONLY)
|
|--------> BCLK,TDM_SYNC --------> TDM Device (Slave)
Note:
I2S2_2CH_MCLK: BCLK
I2S2_2CH_SCLK: I2S_LRCK (GPIO2_B7)
I2S2_2CH_LRCK: TDM_SYNC (GPIO2_C0)
DT:
&i2s0_8ch {
status = "okay";
assigned-clocks = <&cru I2S0_8CH_MCLKOUT>;
assigned-clock-parents = <&cru MCLK_I2S0_8CH_TX>;
i2s-lrck-gpio = <&gpio1 RK_PC5 GPIO_ACTIVE_HIGH>;
tdm-fsync-gpio = <&gpio1 RK_PC2 GPIO_ACTIVE_HIGH>;
rockchip,tdm-multi-lanes;
rockchip,tdm-tx-lanes = <2>; //e.g. TDM16 x 2
rockchip,tdm-rx-lanes = <2>; //e.g. TDM16 x 2
rockchip,clk-src = <&i2s2_2ch>;
pinctrl-names = "default";
pinctrl-0 = <&i2s0_lrck
&i2s0_sclk
&i2s0_sdi0
&i2s0_sdi1
&i2s0_sdo0
&i2s0_sdo1>;
};
&i2s2_2ch {
status = "okay";
assigned-clocks = <&cru I2S2_2CH_MCLKOUT>;
assigned-clock-parents = <&cru MCLK_I2S2_2CH>;
pinctrl-names = "default";
pinctrl-0 = <&i2s2m0_mclk
&i2s2m0_lrck
&i2s2m0_sclk>;
};
Usage: TDM16 x 2 Playback
amixer contents
numid=3,iface=MIXER,name='Receive SDIx Select'
; type=ENUMERATED,access=rw------,values=1,items=5
; Item #0 'Auto'
; Item radxa#1 'SDIx1'
; Item radxa#2 'SDIx2'
; Item radxa#3 'SDIx3'
; Item radxa#4 'SDIx4'
: values=0
numid=2,iface=MIXER,name='Transmit SDOx Select'
; type=ENUMERATED,access=rw------,values=1,items=5
; Item #0 'Auto'
; Item radxa#1 'SDOx1'
; Item radxa#2 'SDOx2'
; Item radxa#3 'SDOx3'
; Item radxa#4 'SDOx4'
: values=0
/# amixer sset "Transmit SDOx Select" "SDOx2"
Simple mixer control 'Transmit SDOx Select',0
Capabilities: enum
Items: 'Auto' 'SDOx1' 'SDOx2' 'SDOx3' 'SDOx4'
Item0: 'SDOx2'
/# aplay -D hw:0,0 --period-size=1024 --buffer-size=4096 -r 48000 \
-c 32 -f s32_le /dev/zero
Signed-off-by: Sugar Zhang <[email protected]>
Change-Id: I6996e05c73a9d68bbeb9562eb6e68e4c99b52d85
RadxaStephen
pushed a commit
that referenced
this pull request
Aug 3, 2024
[ Upstream commit 1b0e814 ] Commit 3e3b5df ("NFC: reorder the logic in nfc_{un,}register_device") assumes the device_is_registered() in function nfc_dev_up() will help to check when the rfkill is unregistered. However, this check only take effect when device_del(&dev->dev) is done in nfc_unregister_device(). Hence, the rfkill object is still possible be dereferenced. The crash trace in latest kernel (5.18-rc2): [ 68.760105] ================================================================== [ 68.760330] BUG: KASAN: use-after-free in __lock_acquire+0x3ec1/0x6750 [ 68.760756] Read of size 8 at addr ffff888009c93018 by task fuzz/313 [ 68.760756] [ 68.760756] CPU: 0 PID: 313 Comm: fuzz Not tainted 5.18.0-rc2 #4 [ 68.760756] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 [ 68.760756] Call Trace: [ 68.760756] <TASK> [ 68.760756] dump_stack_lvl+0x57/0x7d [ 68.760756] print_report.cold+0x5e/0x5db [ 68.760756] ? __lock_acquire+0x3ec1/0x6750 [ 68.760756] kasan_report+0xbe/0x1c0 [ 68.760756] ? __lock_acquire+0x3ec1/0x6750 [ 68.760756] __lock_acquire+0x3ec1/0x6750 [ 68.760756] ? lockdep_hardirqs_on_prepare+0x410/0x410 [ 68.760756] ? register_lock_class+0x18d0/0x18d0 [ 68.760756] lock_acquire+0x1ac/0x4f0 [ 68.760756] ? rfkill_blocked+0xe/0x60 [ 68.760756] ? lockdep_hardirqs_on_prepare+0x410/0x410 [ 68.760756] ? mutex_lock_io_nested+0x12c0/0x12c0 [ 68.760756] ? nla_get_range_signed+0x540/0x540 [ 68.760756] ? _raw_spin_lock_irqsave+0x4e/0x50 [ 68.760756] _raw_spin_lock_irqsave+0x39/0x50 [ 68.760756] ? rfkill_blocked+0xe/0x60 [ 68.760756] rfkill_blocked+0xe/0x60 [ 68.760756] nfc_dev_up+0x84/0x260 [ 68.760756] nfc_genl_dev_up+0x90/0xe0 [ 68.760756] genl_family_rcv_msg_doit+0x1f4/0x2f0 [ 68.760756] ? genl_family_rcv_msg_attrs_parse.constprop.0+0x230/0x230 [ 68.760756] ? security_capable+0x51/0x90 [ 68.760756] genl_rcv_msg+0x280/0x500 [ 68.760756] ? genl_get_cmd+0x3c0/0x3c0 [ 68.760756] ? lock_acquire+0x1ac/0x4f0 [ 68.760756] ? nfc_genl_dev_down+0xe0/0xe0 [ 68.760756] ? lockdep_hardirqs_on_prepare+0x410/0x410 [ 68.760756] netlink_rcv_skb+0x11b/0x340 [ 68.760756] ? genl_get_cmd+0x3c0/0x3c0 [ 68.760756] ? netlink_ack+0x9c0/0x9c0 [ 68.760756] ? netlink_deliver_tap+0x136/0xb00 [ 68.760756] genl_rcv+0x1f/0x30 [ 68.760756] netlink_unicast+0x430/0x710 [ 68.760756] ? memset+0x20/0x40 [ 68.760756] ? netlink_attachskb+0x740/0x740 [ 68.760756] ? __build_skb_around+0x1f4/0x2a0 [ 68.760756] netlink_sendmsg+0x75d/0xc00 [ 68.760756] ? netlink_unicast+0x710/0x710 [ 68.760756] ? netlink_unicast+0x710/0x710 [ 68.760756] sock_sendmsg+0xdf/0x110 [ 68.760756] __sys_sendto+0x19e/0x270 [ 68.760756] ? __ia32_sys_getpeername+0xa0/0xa0 [ 68.760756] ? fd_install+0x178/0x4c0 [ 68.760756] ? fd_install+0x195/0x4c0 [ 68.760756] ? kernel_fpu_begin_mask+0x1c0/0x1c0 [ 68.760756] __x64_sys_sendto+0xd8/0x1b0 [ 68.760756] ? lockdep_hardirqs_on+0xbf/0x130 [ 68.760756] ? syscall_enter_from_user_mode+0x1d/0x50 [ 68.760756] do_syscall_64+0x3b/0x90 [ 68.760756] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 68.760756] RIP: 0033:0x7f67fb50e6b3 ... [ 68.760756] RSP: 002b:00007f67fa91fe90 EFLAGS: 00000293 ORIG_RAX: 000000000000002c [ 68.760756] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f67fb50e6b3 [ 68.760756] RDX: 000000000000001c RSI: 0000559354603090 RDI: 0000000000000003 [ 68.760756] RBP: 00007f67fa91ff00 R08: 00007f67fa91fedc R09: 000000000000000c [ 68.760756] R10: 0000000000000000 R11: 0000000000000293 R12: 00007ffe824d496e [ 68.760756] R13: 00007ffe824d496f R14: 00007f67fa120000 R15: 0000000000000003 [ 68.760756] </TASK> [ 68.760756] [ 68.760756] Allocated by task 279: [ 68.760756] kasan_save_stack+0x1e/0x40 [ 68.760756] __kasan_kmalloc+0x81/0xa0 [ 68.760756] rfkill_alloc+0x7f/0x280 [ 68.760756] nfc_register_device+0xa3/0x1a0 [ 68.760756] nci_register_device+0x77a/0xad0 [ 68.760756] nfcmrvl_nci_register_dev+0x20b/0x2c0 [ 68.760756] nfcmrvl_nci_uart_open+0xf2/0x1dd [ 68.760756] nci_uart_tty_ioctl+0x2c3/0x4a0 [ 68.760756] tty_ioctl+0x764/0x1310 [ 68.760756] __x64_sys_ioctl+0x122/0x190 [ 68.760756] do_syscall_64+0x3b/0x90 [ 68.760756] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 68.760756] [ 68.760756] Freed by task 314: [ 68.760756] kasan_save_stack+0x1e/0x40 [ 68.760756] kasan_set_track+0x21/0x30 [ 68.760756] kasan_set_free_info+0x20/0x30 [ 68.760756] __kasan_slab_free+0x108/0x170 [ 68.760756] kfree+0xb0/0x330 [ 68.760756] device_release+0x96/0x200 [ 68.760756] kobject_put+0xf9/0x1d0 [ 68.760756] nfc_unregister_device+0x77/0x190 [ 68.760756] nfcmrvl_nci_unregister_dev+0x88/0xd0 [ 68.760756] nci_uart_tty_close+0xdf/0x180 [ 68.760756] tty_ldisc_kill+0x73/0x110 [ 68.760756] tty_ldisc_hangup+0x281/0x5b0 [ 68.760756] __tty_hangup.part.0+0x431/0x890 [ 68.760756] tty_release+0x3a8/0xc80 [ 68.760756] __fput+0x1f0/0x8c0 [ 68.760756] task_work_run+0xc9/0x170 [ 68.760756] exit_to_user_mode_prepare+0x194/0x1a0 [ 68.760756] syscall_exit_to_user_mode+0x19/0x50 [ 68.760756] do_syscall_64+0x48/0x90 [ 68.760756] entry_SYSCALL_64_after_hwframe+0x44/0xae This patch just add the null out of dev->rfkill to make sure such dereference cannot happen. This is safe since the device_lock() already protect the check/write from data race. Fixes: 3e3b5df ("NFC: reorder the logic in nfc_{un,}register_device") Signed-off-by: Lin Ma <[email protected]> Reviewed-by: Krzysztof Kozlowski <[email protected]> Signed-off-by: David S. Miller <[email protected]> Signed-off-by: Sasha Levin <[email protected]>
RadxaStephen
pushed a commit
that referenced
this pull request
Nov 24, 2024
The bug can be triggered by sending an amdgpu_cs_wait_ioctl to the AMDGPU DRM driver on any ASICs with valid context. The bug was reported by Joonkyo Jung <[email protected]>. For example the following code: static void Syzkaller2(int fd) { union drm_amdgpu_ctx arg1; union drm_amdgpu_wait_cs arg2; arg1.in.op = AMDGPU_CTX_OP_ALLOC_CTX; ret = drmIoctl(fd, 0x140106442 /* amdgpu_ctx_ioctl */, &arg1); arg2.in.handle = 0x0; arg2.in.timeout = 0x2000000000000; arg2.in.ip_type = AMD_IP_VPE /* 0x9 */; arg2->in.ip_instance = 0x0; arg2.in.ring = 0x0; arg2.in.ctx_id = arg1.out.alloc.ctx_id; drmIoctl(fd, 0xc0206449 /* AMDGPU_WAIT_CS * /, &arg2); } The ioctl AMDGPU_WAIT_CS without previously submitted job could be assumed that the error should be returned, but the following commit 1decbf6 modified the logic and allowed to have sched_rq equal to NULL. As a result when there is no job the ioctl AMDGPU_WAIT_CS returns success. The change fixes null-ptr-deref in init entity and the stack below demonstrates the error condition: [ +0.000007] BUG: kernel NULL pointer dereference, address: 0000000000000028 [ +0.007086] #PF: supervisor read access in kernel mode [ +0.005234] #PF: error_code(0x0000) - not-present page [ +0.005232] PGD 0 P4D 0 [ +0.002501] Oops: 0000 [#1] PREEMPT SMP KASAN NOPTI [ +0.005034] CPU: 10 PID: 9229 Comm: amd_basic Tainted: G B W L 6.7.0+ #4 [ +0.007797] Hardware name: ASUS System Product Name/ROG STRIX B550-F GAMING (WI-FI), BIOS 1401 12/03/2020 [ +0.009798] RIP: 0010:drm_sched_entity_init+0x2d3/0x420 [gpu_sched] [ +0.006426] Code: 80 00 00 00 00 00 00 00 e8 1a 81 82 e0 49 89 9c 24 c0 00 00 00 4c 89 ef e8 4a 80 82 e0 49 8b 5d 00 48 8d 7b 28 e8 3d 80 82 e0 <48> 83 7b 28 00 0f 84 28 01 00 00 4d 8d ac 24 98 00 00 00 49 8d 5c [ +0.019094] RSP: 0018:ffffc90014c1fa40 EFLAGS: 00010282 [ +0.005237] RAX: 0000000000000001 RBX: 0000000000000000 RCX: ffffffff8113f3fa [ +0.007326] RDX: fffffbfff0a7889d RSI: 0000000000000008 RDI: ffffffff853c44e0 [ +0.007264] RBP: ffffc90014c1fa80 R08: 0000000000000001 R09: fffffbfff0a7889c [ +0.007266] R10: ffffffff853c44e7 R11: 0000000000000001 R12: ffff8881a719b010 [ +0.007263] R13: ffff88810d412748 R14: 0000000000000002 R15: 0000000000000000 [ +0.007264] FS: 00007ffff7045540(0000) GS:ffff8883cc900000(0000) knlGS:0000000000000000 [ +0.008236] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ +0.005851] CR2: 0000000000000028 CR3: 000000011912e000 CR4: 0000000000350ef0 [ +0.007175] Call Trace: [ +0.002561] <TASK> [ +0.002141] ? show_regs+0x6a/0x80 [ +0.003473] ? __die+0x25/0x70 [ +0.003124] ? page_fault_oops+0x214/0x720 [ +0.004179] ? preempt_count_sub+0x18/0xc0 [ +0.004093] ? __pfx_page_fault_oops+0x10/0x10 [ +0.004590] ? srso_return_thunk+0x5/0x5f [ +0.004000] ? vprintk_default+0x1d/0x30 [ +0.004063] ? srso_return_thunk+0x5/0x5f [ +0.004087] ? vprintk+0x5c/0x90 [ +0.003296] ? drm_sched_entity_init+0x2d3/0x420 [gpu_sched] [ +0.005807] ? srso_return_thunk+0x5/0x5f [ +0.004090] ? _printk+0xb3/0xe0 [ +0.003293] ? __pfx__printk+0x10/0x10 [ +0.003735] ? asm_sysvec_apic_timer_interrupt+0x1b/0x20 [ +0.005482] ? do_user_addr_fault+0x345/0x770 [ +0.004361] ? exc_page_fault+0x64/0xf0 [ +0.003972] ? asm_exc_page_fault+0x27/0x30 [ +0.004271] ? add_taint+0x2a/0xa0 [ +0.003476] ? drm_sched_entity_init+0x2d3/0x420 [gpu_sched] [ +0.005812] amdgpu_ctx_get_entity+0x3f9/0x770 [amdgpu] [ +0.009530] ? finish_task_switch.isra.0+0x129/0x470 [ +0.005068] ? __pfx_amdgpu_ctx_get_entity+0x10/0x10 [amdgpu] [ +0.010063] ? __kasan_check_write+0x14/0x20 [ +0.004356] ? srso_return_thunk+0x5/0x5f [ +0.004001] ? mutex_unlock+0x81/0xd0 [ +0.003802] ? srso_return_thunk+0x5/0x5f [ +0.004096] amdgpu_cs_wait_ioctl+0xf6/0x270 [amdgpu] [ +0.009355] ? __pfx_amdgpu_cs_wait_ioctl+0x10/0x10 [amdgpu] [ +0.009981] ? srso_return_thunk+0x5/0x5f [ +0.004089] ? srso_return_thunk+0x5/0x5f [ +0.004090] ? __srcu_read_lock+0x20/0x50 [ +0.004096] drm_ioctl_kernel+0x140/0x1f0 [drm] [ +0.005080] ? __pfx_amdgpu_cs_wait_ioctl+0x10/0x10 [amdgpu] [ +0.009974] ? __pfx_drm_ioctl_kernel+0x10/0x10 [drm] [ +0.005618] ? srso_return_thunk+0x5/0x5f [ +0.004088] ? __kasan_check_write+0x14/0x20 [ +0.004357] drm_ioctl+0x3da/0x730 [drm] [ +0.004461] ? __pfx_amdgpu_cs_wait_ioctl+0x10/0x10 [amdgpu] [ +0.009979] ? __pfx_drm_ioctl+0x10/0x10 [drm] [ +0.004993] ? srso_return_thunk+0x5/0x5f [ +0.004090] ? __kasan_check_write+0x14/0x20 [ +0.004356] ? srso_return_thunk+0x5/0x5f [ +0.004090] ? _raw_spin_lock_irqsave+0x99/0x100 [ +0.004712] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ +0.005063] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ +0.005477] ? srso_return_thunk+0x5/0x5f [ +0.004000] ? preempt_count_sub+0x18/0xc0 [ +0.004237] ? srso_return_thunk+0x5/0x5f [ +0.004090] ? _raw_spin_unlock_irqrestore+0x27/0x50 [ +0.005069] amdgpu_drm_ioctl+0x7e/0xe0 [amdgpu] [ +0.008912] __x64_sys_ioctl+0xcd/0x110 [ +0.003918] do_syscall_64+0x5f/0xe0 [ +0.003649] ? noist_exc_debug+0xe6/0x120 [ +0.004095] entry_SYSCALL_64_after_hwframe+0x6e/0x76 [ +0.005150] RIP: 0033:0x7ffff7b1a94f [ +0.003647] Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <41> 89 c0 3d 00 f0 ff ff 77 1f 48 8b 44 24 18 64 48 2b 04 25 28 00 [ +0.019097] RSP: 002b:00007fffffffe0a0 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ +0.007708] RAX: ffffffffffffffda RBX: 000055555558b360 RCX: 00007ffff7b1a94f [ +0.007176] RDX: 000055555558b360 RSI: 00000000c0206449 RDI: 0000000000000003 [ +0.007326] RBP: 00000000c0206449 R08: 000055555556ded0 R09: 000000007fffffff [ +0.007176] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fffffffe5d8 [ +0.007238] R13: 0000000000000003 R14: 000055555555cba8 R15: 00007ffff7ffd040 [ +0.007250] </TASK> v2: Reworked check to guard against null ptr deref and added helpful comments (Christian) Cc: Christian Koenig <[email protected]> Cc: Alex Deucher <[email protected]> Cc: Luben Tuikov <[email protected]> Cc: Bas Nieuwenhuizen <[email protected]> Cc: Joonkyo Jung <[email protected]> Cc: Dokyung Song <[email protected]> Cc: <[email protected]> Cc: <[email protected]> Signed-off-by: Vitaly Prosyak <[email protected]> Reviewed-by: Christian König <[email protected]> Fixes: 56e4496 ("drm/sched: Convert the GPU scheduler to variable number of run-queues") Link: https://patchwork.freedesktop.org/patch/msgid/[email protected] Signed-off-by: Christian König <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
No description provided.