linux-kernel - [PATCH] ASoC: qcom: Fix number of HDMI RDMA channels on sc7180

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 15 Jan 2021 12:33:29 -0800
From:   Stephen Boyd <swboyd@...omium.org>
To:     Mark Brown <broonie@...nel.org>
Cc:     linux-kernel@...r.kernel.org, Liam Girdwood <lgirdwood@...il.com>,
        Banajit Goswami <bgoswami@...eaurora.org>,
        linux-arm-msm@...r.kernel.org, Patrick Lai <plai@...eaurora.org>,
        alsa-devel@...a-project.org,
        V Sujith Kumar Reddy <vsujithk@...eaurora.org>,
        Srinivasa Rao <srivasam@...eaurora.org>,
        Srinivas Kandagatla <srinivas.kandagatla@...aro.org>,
        Cheng-Yi Chiang <cychiang@...omium.org>
Subject: [PATCH] ASoC: qcom: Fix number of HDMI RDMA channels on sc7180

Suspending/resuming with an HDMI dongle attached leads to crashes from
an audio regmap.

 Unable to handle kernel paging request at virtual address ffffffc018068000
 Mem abort info:
   ESR = 0x96000047
   EC = 0x25: DABT (current EL), IL = 32 bits
   SET = 0, FnV = 0
   EA = 0, S1PTW = 0
 Data abort info:
   ISV = 0, ISS = 0x00000047
   CM = 0, WnR = 1
 swapper pgtable: 4k pages, 39-bit VAs, pgdp=0000000081b12000
 [ffffffc018068000] pgd=0000000275d14003, pud=0000000275d14003, pmd=000000026365d003, pte=0000000000000000
 Internal error: Oops: 96000047 [#1] PREEMPT SMP
 Call trace:
  regmap_mmio_write32le+0x2c/0x40
  regmap_mmio_write+0x48/0x6c
  _regmap_bus_reg_write+0x34/0x44
  _regmap_write+0x100/0x150
  regcache_default_sync+0xc0/0x138
  regcache_sync+0x188/0x26c
  lpass_platform_pcmops_resume+0x48/0x54 [snd_soc_lpass_platform]
  snd_soc_component_resume+0x28/0x40
  soc_resume_deferred+0x6c/0x178
  process_one_work+0x208/0x3c8
  worker_thread+0x23c/0x3e8
  kthread+0x144/0x178
  ret_from_fork+0x10/0x18
 Code: d503201f d50332bf f94002a8 8b344108 (b9000113)

I can reliably reproduce this problem by running 'tail' on the registers
file in debugfs for the hdmi regmap.

 # tail /sys/kernel/debug/regmap/62d87000.lpass-lpass_hdmi/registers
 [   84.658733] Unable to handle kernel paging request at virtual address ffffffd0128e800c

This crash happens because we're trying to read registers from the
regmap beyond the length of the mapping created by ioremap().

The number of hdmi_rdma_channels determines the size of the regmap via
this code in sound/soc/qcom/lpass-cpu.c:

  lpass_hdmi_regmap_config.max_register = LPAIF_HDMI_RDMAPER_REG(variant, variant->hdmi_rdma_channels);

According to debugfs the size of the regmap is 0x68010 but according to
the DTS file posted in [1] the size is only 0x68000 (see the first reg
property of the lpass_cpu node). Let's change the number of channels to
be 3 instead of 4 so the math works out to have a max register of
0x67010, nicely fitting inside of the region size of 0x68000.

Note: I tried to bump up the size of the register region to the next
page to include the 0x68010 register but then the tail command caused
SErrors with an async abort, implying that the register region doesn't
exist or it isn't clocked because the bus is telling us that the
register read failed. I reduce the number of channels and played audio
through the HDMI channel and it kept working so I think this is correct.

Fixes: 2ad63dc8df6b ("ASoC: qcom: sc7180: Add support for audio over DP")
Link: https://lore.kernel.org/r/1601448168-18396-2-git-send-email-srivasam@codeaurora.org [1]
Cc: V Sujith Kumar Reddy <vsujithk@...eaurora.org>
Cc: Srinivasa Rao <srivasam@...eaurora.org>
Cc: Srinivas Kandagatla <srinivas.kandagatla@...aro.org>
Cc: Cheng-Yi Chiang <cychiang@...omium.org>
Signed-off-by: Stephen Boyd <swboyd@...omium.org>
---
 sound/soc/qcom/lpass-sc7180.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sound/soc/qcom/lpass-sc7180.c b/sound/soc/qcom/lpass-sc7180.c
index 85db650c2169..3127b6022ea3 100644
--- a/sound/soc/qcom/lpass-sc7180.c
+++ b/sound/soc/qcom/lpass-sc7180.c
@@ -174,7 +174,7 @@ static struct lpass_variant sc7180_data = {
 	.rdma_channels		= 5,
 	.hdmi_rdma_reg_base		= 0x64000,
 	.hdmi_rdma_reg_stride	= 0x1000,
-	.hdmi_rdma_channels		= 4,
+	.hdmi_rdma_channels		= 3,
 	.dmactl_audif_start	= 1,
 	.wrdma_reg_base		= 0x18000,
 	.wrdma_reg_stride	= 0x1000,

base-commit: 5c8fe583cce542aa0b84adc939ce85293de36e5e
-- 
https://chromeos.dev