linux-kernel - Re: Nokia N900 - audio TPA6130A2 problems

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 16 Mar 2016 20:32:57 +0200
From:	Grygorii Strashko <grygorii.strashko@...com>
To:	Ivaylo Dimitrov <ivo.g.dimitrov.75@...il.com>,
	Sebastian Reichel <sre@...nel.org>,
	Pali Rohár <pali.rohar@...il.com>
CC:	Peter Ujfalusi <peter.ujfalusi@...com>,
	Jarkko Nikula <jarkko.nikula@...mer.com>,
	Tony Lindgren <tony@...mide.com>,
	Lars-Peter Clausen <lars@...afoo.de>,
	<linux-kernel@...r.kernel.org>, <linux-omap@...r.kernel.org>,
	Pavel Machek <pavel@....cz>,
	Aaro Koskinen <aaro.koskinen@....fi>,
	Nishanth Menon <nm@...com>, <merlijn@...zup.org>
Subject: Re: Nokia N900 - audio TPA6130A2 problems

On 03/16/2016 08:21 PM, Ivaylo Dimitrov wrote:
> Hi,
> 
> On 16.03.2016 16:47, Sebastian Reichel wrote:
>> Hi,
>>
>> On Wed, Mar 16, 2016 at 02:33:19PM +0100, Pali Rohár wrote:
>>> Hi! We found out that tpa6130a2 device is being initialized before
>>> i2c_2 bus is initialized. So that is reason why tpa6130a2 fails...
>>
>> What do you mean by initialize? A call to tpa6130a2_probe()? In that
>> case I wonder about client->adapter. Is it NULL?
>>
> 
> This is (a part of) the log when tpa6130a2 fails to initialize:
> 
> Jan  1 08:03:07 Nokia-N900 kernel: [    1.928344] twl 1-0048: PIH (irq 
> 23) chaining IRQs 340..348
> Jan  1 08:03:07 Nokia-N900 kernel: [    1.934326] twl 1-0048: power (irq 
> 345) chaining IRQs 348..355
> Jan  1 08:03:07 Nokia-N900 kernel: [    2.498504] twl4030_gpio 
> twl4030-gpio: gpio (irq 340) chaining IRQs 356..373
> Jan  1 08:03:07 Nokia-N900 kernel: [    2.858215] twl4030_usb 
> 48070000.i2c:twl@48:twl4030-usb: Initialized TWL4030 USB module
> Jan  1 08:03:07 Nokia-N900 kernel: [    2.888702] input: 
> twl4030_pwrbutton as 
> /devices/platform/68000000.ocp/48070000.i2c/i2c-1/1-0048/48070000.i2c:twl@48:pwrbutton/input/input0 
> 
> Jan  1 08:03:07 Nokia-N900 kernel: [    2.903594] input: TWL4030 Keypad 
> as 
> /devices/platform/68000000.ocp/48070000.i2c/i2c-1/1-0048/48070000.i2c:twl@48:keypad/input/input1 
> 
> Jan  1 08:03:07 Nokia-N900 kernel: [    3.148040] 
> 48070000.i2c:twl@48:madc supply vusb3v1 not found, using dummy regulator
> Jan  1 08:03:07 Nokia-N900 kernel: [    6.997985] omap_i2c 48070000.i2c: 
> bus 1 rev3.3 at 2200 kHz
> Jan  1 08:03:07 Nokia-N900 kernel: [    7.010528] tpa6130a2 2-0060: 
> Write failed
> Jan  1 08:03:07 Nokia-N900 kernel: [    7.015563] omap_i2c 48072000.i2c: 
> bus 2 rev3.3 at 100 kHz
> Jan  1 08:03:07 Nokia-N900 kernel: [    7.023742] omap_i2c 48060000.i2c: 
> bus 3 rev3.3 at 400 kHz
> 
> Now, it is either tpa6130a2 probe() is called before i2c-2 is
> initialized or i2c driver first probes devices on the bus and only then
> logs successful probe ("omap_i2c 48072000.i2c: bus 2 rev3.3 at 100 kHz")
> in our case.

No-no :) take a look on i2c-omap.c

	r = i2c_add_numbered_adapter(adap); 

^^^^ here you see messages from tpa6130a2 (create i2c devices & probe if drivers are ready)

	if (r) {
		dev_err(omap->dev, "failure adding adapter\n");
		goto err_unuse_clocks;
	}

	dev_info(omap->dev, "bus %d rev%d.%d at %d kHz\n", adap->nr,
		 major, minor, omap->speed);

^^^^ and here "omap_i2c 48072000.i2c:  bus 2 rev3.3 at 100 kHz"

so everything is ok with probe order

> 
>> ---------------
>>
>> I just had another look at the driver and I think there is a race
>> condition for tpa6130a2_add_controls() and tpa6130a2_stereo_enable().
>>
>> As far as I can see both functions check for "tpa6130a2_client !=
>> NULL". tpa6130a2_client is set before the probe function has finished,
>> though. Simplified probe:
>>
>> ...
>> tpa6130a2_client = client;
>> set_default_regs();
>> acquire_power_gpio();
>> acquire_regulator();
>> tpa6130a2_power(1); // needs tpa6130a2_client
>> check_device();
>> tpa6130a2_power(0); // needs tpa6130a2_client
>> ...
>>
>> If tpa6130a2_add_controls() or tpa6130a2_stereo_enable() is called
>> after tpa6130a2 probe has started, but before probe has completed,
>> tpa6130a2_client is set, but not yet initialized. The race condition
>> can be fixed easily by moving the tpa6130a2_client assignment directly
>> after the regulator acquisition.
>>



-- 
regards,
-grygorii