kernel.git/drivers/usb/gadget/function/u_audio.c, branch linux-5.14.y

usb: gadget: u_audio: EP-OUT bInterval in fback frequency

2021-09-30T08:12:53Z

commit f5dfd98a80ff8d50cf4ae2820857d7f5a46cbab9 upstream. The patch increases the bitshift in feedback frequency calculation with EP-OUT bInterval value. Tests have revealed that Win10 and OSX UAC2 drivers require the feedback frequency to be based on the actual packet interval instead of on the USB2 microframe. Otherwise they ignore the feedback value. Linux snd-usb-audio driver detects the applied bitshift automatically. Tested-by: Henrik Enquist Signed-off-by: Pavel Hofman Cc: stable Link: https://lore.kernel.org/r/20210906130822.12256-1-pavel.hofman@ivitera.com Signed-off-by: Greg Kroah-Hartman

usb: gadget: u_audio: fix race condition on endpoint stop

2021-08-27T14:07:23Z

If the endpoint completion callback is call right after the ep_enabled flag is cleared and before usb_ep_dequeue() is call, we could do a double free on the request and the associated buffer. Fix this by clearing ep_enabled after all the endpoint requests have been dequeued. Fixes: 7de8681be2cd ("usb: gadget: u_audio: Free requests only after callback") Cc: stable Reported-by: Thinh Nguyen Signed-off-by: Jerome Brunet Link: https://lore.kernel.org/r/20210827092927.366482-1-jbrunet@baylibre.com Signed-off-by: Greg Kroah-Hartman

usb: gadget: f_uac2: fixup feedback endpoint stop

2021-08-27T14:06:53Z

When the uac2 function is stopped, there seems to be an issue reported on some platforms (Intel Merrifield at least) BUG: kernel NULL pointer dereference, address: 0000000000000008 ... RIP: 0010:dwc3_gadget_del_and_unmap_request+0x19/0xe0 ... Call Trace: dwc3_remove_requests.constprop.0+0x12f/0x170 __dwc3_gadget_ep_disable+0x7a/0x160 dwc3_gadget_ep_disable+0x3d/0xd0 usb_ep_disable+0x1c/0x70 u_audio_stop_capture+0x79/0x120 [u_audio] afunc_set_alt+0x73/0x80 [usb_f_uac2] composite_setup+0x224/0x1b90 [libcomposite] The issue happens only when the gadget is using the sync type "async", not "adaptive". This indicates that problem is coming from the feedback endpoint, which is only used with async synchronization mode. The problem is that request is freed regardless of usb_ep_dequeue(), which ends up badly if the request is not actually dequeued yet. Update the feedback endpoint free function to release the endpoint the same way it is done for the data endpoint, which takes care of the problem. Fixes: 24f779dac8f3 ("usb: gadget: f_uac2/u_audio: add feedback endpoint support") Reported-by: Ferry Toth Tested-by: Ferry Toth Acked-by: Felipe Balbi Signed-off-by: Jerome Brunet Link: https://lore.kernel.org/r/20210827075853.266912-1-jbrunet@baylibre.com Signed-off-by: Greg Kroah-Hartman

usb: gadget: u_audio: add real feedback implementation

2021-06-09T09:26:49Z

This adds interface between userspace and feedback endpoint to report real feedback frequency to the Host. Current implementation adds new userspace interface ALSA mixer control "Capture Pitch 1000000" (similar to aloop driver's "PCM Rate Shift 100000" mixer control) Value in PPM is chosen to have correction value agnostic of the actual HW rate, which the application is not necessarily dealing with, while still retaining a good enough precision to allow smooth clock correction on the playback side, if necessary. Similar to sound/usb/endpoint.c, a slow down is allowed up to 25%. This has no impact on the required bandwidth. Speedup correction has an impact on the bandwidth reserved for the isochronous endpoint. The default allowed speedup is 500ppm. This seems to be more than enough but, if necessary, this is configurable through a module parameter. The reserved bandwidth is rounded up to the next packet size. Usage of this new control is easy to implement in existing userspace tools like alsaloop from alsa-utils. Signed-off-by: Ruslan Bilovol Signed-off-by: Jerome Brunet Link: https://lore.kernel.org/r/20210603220104.1216001-4-jbrunet@baylibre.com Signed-off-by: Greg Kroah-Hartman

usb: gadget: f_uac2/u_audio: add feedback endpoint support

2021-06-09T09:26:49Z

As per USB and UAC2 specs, asynchronous audio sink endpoint requires explicit synchronization mechanism (Isochronous Feedback Endpoint) Implement feedback companion endpoint for ISO OUT endpoint This patch adds all required infrastructure and USB requests handling for feedback endpoint. Syncrhonization itself is still dummy (feedback ep always reports 'nomimal frequency' e.g. no adjustement is needed). This satisfies hosts that require feedback endpoint (like Win10) and poll it periodically Actual synchronization mechanism should be implemented separately Signed-off-by: Ruslan Bilovol Signed-off-by: Jerome Brunet Link: https://lore.kernel.org/r/20210603220104.1216001-2-jbrunet@baylibre.com Signed-off-by: Greg Kroah-Hartman

usb: gadget: u_audio: convert to strscpy

2021-03-23T11:56:08Z

Usage of strlcpy in Linux Kernel has been recently deprecated [1], convert driver to strscpy [1] https://lore.kernel.org/lkml/CAHk-=wgfRnXz0W3D37d01q3JFkr_i_uTL=V6A6G1oUZcprmknw@mail.gmail.com/ Signed-off-by: Ruslan Bilovol Link: https://lore.kernel.org/r/1614603943-11668-2-git-send-email-ruslan.bilovol@gmail.com Signed-off-by: Greg Kroah-Hartman

usb: gadget: u_audio: clean up locking

2021-01-18T17:43:09Z

snd_pcm_stream_lock() is held when the ALSA .trigger() callback is called. The lock of 'struct uac_rtd_params' is not necessary since all its locking operation are done under the snd_pcm_stream_lock() too. Also, usb_request .complete() is called with irqs disabled, so saving and restoring the irqs is not necessary. Acked-by: Felipe Balbi Signed-off-by: Jerome Brunet Link: https://lore.kernel.org/r/20210118084931.322861-1-jbrunet@baylibre.com Signed-off-by: Greg Kroah-Hartman

usb: gadget: u_audio: remove struct uac_req

2021-01-18T17:43:09Z

'struct uac_req' purpose is to link 'struct usb_request' to the corresponding 'struct uac_rtd_params'. However member req is never used. Using the context of the usb request, we can keep track of the corresponding 'struct uac_rtd_params' just as well, without allocating extra memory. Acked-by: Felipe Balbi Signed-off-by: Jerome Brunet Link: https://lore.kernel.org/r/20210118084642.322510-4-jbrunet@baylibre.com Signed-off-by: Greg Kroah-Hartman

usb: gadget: u_audio: factorize ssize to alsa fmt conversion

2021-01-18T17:43:09Z

Factorize format related code common to the capture and playback path. Acked-by: Felipe Balbi Signed-off-by: Jerome Brunet Link: https://lore.kernel.org/r/20210118084642.322510-3-jbrunet@baylibre.com Signed-off-by: Greg Kroah-Hartman

usb: gadget: u_audio: Free requests only after callback

2021-01-18T17:43:09Z

As per the kernel doc for usb_ep_dequeue(), it states that "this routine is asynchronous, that is, it may return before the completion routine runs". And indeed since v5.0 the dwc3 gadget driver updated its behavior to place dequeued requests on to a cancelled list to be given back later after the endpoint is stopped. The free_ep() was incorrectly assuming that a request was ready to be freed after calling dequeue which results in a use-after-free in dwc3 when it traverses its cancelled list. Fix this by moving the usb_ep_free_request() call to the callback itself in case the ep is disabled. Fixes: eb9fecb9e69b0 ("usb: gadget: f_uac2: split out audio core") Reported-and-tested-by: Ferry Toth Reviewed-and-tested-by: Peter Chen Acked-by: Felipe Balbi Signed-off-by: Jack Pham Signed-off-by: Jerome Brunet Link: https://lore.kernel.org/r/20210118084642.322510-2-jbrunet@baylibre.com Signed-off-by: Greg Kroah-Hartman