linux-kernel - Re: [PATCH 3/3] ALSA: qc_audio_offload: try to reduce address space confusion

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-Id: <DCKW943MHDZO.3QJRSTIXDW1C4@fairphone.com>
Date: Fri, 05 Sep 2025 15:17:20 +0200
From: "Luca Weiss" <luca.weiss@...rphone.com>
To: "Arnd Bergmann" <arnd@...db.de>, "Takashi Iwai" <tiwai@...e.de>
Cc: "Arnd Bergmann" <arnd@...nel.org>, "Mark Brown" <broonie@...nel.org>,
 "Wesley Cheng" <quic_wcheng@...cinc.com>, "Jaroslav Kysela"
 <perex@...ex.cz>, "Takashi Iwai" <tiwai@...e.com>, "Greg Kroah-Hartman"
 <gregkh@...uxfoundation.org>, "Dan Carpenter" <dan.carpenter@...aro.org>,
 <linux-sound@...r.kernel.org>, <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH 3/3] ALSA: qc_audio_offload: try to reduce address space
 confusion

Hi Arnd,

On Fri Sep 5, 2025 at 2:08 PM CEST, Arnd Bergmann wrote:
> On Fri, Sep 5, 2025, at 13:47, Luca Weiss wrote:
>> On Fri Aug 1, 2025 at 2:49 PM CEST, Takashi Iwai wrote:
>>> On Fri, 01 Aug 2025 14:35:27 +0200,
>>>> On Fri Aug 1, 2025 at 2:31 PM CEST, Takashi Iwai wrote:
>>>> > On Fri, 01 Aug 2025 13:31:42 +0200,
>>>> >> On Tue May 13, 2025 at 2:34 PM CEST, Arnd Bergmann wrote:
>>>> >> >
>>>> >> > Make this more explicit by pulling the conversion out first
>>>> >> > and warning if it is not part of the linear map, and using the
>>>> >> > actual physical address to map into the iommu in place of the
>>>> >> > dma address that may already be iommu-mapped into the usb host.
>>>> >> 
>>>> >> This patch is breaking USB audio offloading on Qualcomm devices on 6.16,
>>>> >> as tested on sm6350 and sc7280-based smartphones.
>>>> >> 
>>>> >> Let me know if I can be of any help to resolve this.
>>>> >
>>>> > I guess just dropping WARN_ON() would help?
>>>> >
>>>> > As far as I read the code, pa argument isn't used at all in
>>>> > uaudio_iommu_map() unless as sgt is NULL.  In this case, sgt is never
>>>> > NULL, hence the pa argument is just a placeholder.
>>>> > That said, the whole xfer_buf_pa (and its sanity check) can be dropped
>>>> > there.
>>>> 
>>>> Just the WARN splat is not the problem, it's actually failing
>>>> afterwards. Without the patch it works as expected.
>>>
>>> That is, replace WARN_ON() with 0.
>>>
>>> 	if (0 /*WARN_ON(!page_is_ram(PFN_DOWN(xfer_buf_pa)))*/) {
>>> 		ret = -ENXIO;
>>> 		goto unmap_sync;
>>> 	}
>>
>> Yes, that appears to work fine as well. Playback works again.
>>
>
> This does mean that the address returned from xfer_buf is not
> a kernel address in the virtual map though, and converting it
> through virt_to_phys() makes the pa undefined for
> uaudio_iommu_map(). Can you print what that pa value
> is that you get here, and where that sits in the address space?

Adding a debug print gives me the following below.

  dev_err(uaudio_qdev->data->dev, "xfer_buf_pa=%llx\n", xfer_buf_pa);

Not sure what exactly you mean with "where that sits in the address
space" and how I can figure that out.

[  130.124938] q6usb-dai 3000000.remoteproc:glink-edge:apr:service@4:usbd: xfer_buf_pa=ffffba0486ea6000
[  130.141583] q6usb-dai 3000000.remoteproc:glink-edge:apr:service@4:usbd: xfer_buf_pa=ffffba0484be5000
[  130.145826] q6usb-dai 3000000.remoteproc:glink-edge:apr:service@4:usbd: xfer_buf_pa=ffffba0484bfd000
[  130.150031] q6usb-dai 3000000.remoteproc:glink-edge:apr:service@4:usbd: xfer_buf_pa=ffffba0484c0d000
[  130.155437] q6usb-dai 3000000.remoteproc:glink-edge:apr:service@4:usbd: xfer_buf_pa=ffffba0484ec5000
[  130.159573] q6usb-dai 3000000.remoteproc:glink-edge:apr:service@4:usbd: xfer_buf_pa=ffffba0484f0d000
[  130.164778] q6usb-dai 3000000.remoteproc:glink-edge:apr:service@4:usbd: xfer_buf_pa=ffffba0484f2d000
[  130.180878] q6usb-dai 3000000.remoteproc:glink-edge:apr:service@4:usbd: xfer_buf_pa=ffffba0484fe5000
[  130.185178] q6usb-dai 3000000.remoteproc:glink-edge:apr:service@4:usbd: xfer_buf_pa=ffffba0485005000
[  130.189393] q6usb-dai 3000000.remoteproc:glink-edge:apr:service@4:usbd: xfer_buf_pa=ffffba048507d000
[  130.194323] q6usb-dai 3000000.remoteproc:glink-edge:apr:service@4:usbd: xfer_buf_pa=ffffba04850e5000
[  130.198375] q6usb-dai 3000000.remoteproc:glink-edge:apr:service@4:usbd: xfer_buf_pa=ffffba048561d000
[  130.202280] q6usb-dai 3000000.remoteproc:glink-edge:apr:service@4:usbd: xfer_buf_pa=ffffba0485655000
[  130.215915] q6usb-dai 3000000.remoteproc:glink-edge:apr:service@4:usbd: xfer_buf_pa=ffffba04856a5000
[  130.219701] q6usb-dai 3000000.remoteproc:glink-edge:apr:service@4:usbd: xfer_buf_pa=ffffba0486f15000
[  130.223351] q6usb-dai 3000000.remoteproc:glink-edge:apr:service@4:usbd: xfer_buf_pa=ffffba04870b5000
[  130.227881] q6usb-dai 3000000.remoteproc:glink-edge:apr:service@4:usbd: xfer_buf_pa=ffffba04871bd000
[  130.231780] q6usb-dai 3000000.remoteproc:glink-edge:apr:service@4:usbd: xfer_buf_pa=ffffba04871dd000
[  130.235432] q6usb-dai 3000000.remoteproc:glink-edge:apr:service@4:usbd: xfer_buf_pa=ffffba04871f5000
[  130.249669] q6usb-dai 3000000.remoteproc:glink-edge:apr:service@4:usbd: xfer_buf_pa=ffffba0487525000
[  130.253451] q6usb-dai 3000000.remoteproc:glink-edge:apr:service@4:usbd: xfer_buf_pa=ffffba048755d000
[  130.257113] q6usb-dai 3000000.remoteproc:glink-edge:apr:service@4:usbd: xfer_buf_pa=ffffba048758d000
[  130.261473] q6usb-dai 3000000.remoteproc:glink-edge:apr:service@4:usbd: xfer_buf_pa=ffffba04875c5000
[  130.265226] q6usb-dai 3000000.remoteproc:glink-edge:apr:service@4:usbd: xfer_buf_pa=ffffba04875d5000
[  130.268856] q6usb-dai 3000000.remoteproc:glink-edge:apr:service@4:usbd: xfer_buf_pa=ffffba04875de000
[  130.283635] q6usb-dai 3000000.remoteproc:glink-edge:apr:service@4:usbd: xfer_buf_pa=ffffba0486ed3000
[  130.287445] q6usb-dai 3000000.remoteproc:glink-edge:apr:service@4:usbd: xfer_buf_pa=ffffba0486eca000
[  130.291147] q6usb-dai 3000000.remoteproc:glink-edge:apr:service@4:usbd: xfer_buf_pa=ffffba04875e7000
[  130.295957] q6usb-dai 3000000.remoteproc:glink-edge:apr:service@4:usbd: xfer_buf_pa=ffffba04875f0000
[  130.299995] q6usb-dai 3000000.remoteproc:glink-edge:apr:service@4:usbd: xfer_buf_pa=ffffba0489fd5000
[  130.303607] q6usb-dai 3000000.remoteproc:glink-edge:apr:service@4:usbd: xfer_buf_pa=ffffba0489fde000
[  130.317503] q6usb-dai 3000000.remoteproc:glink-edge:apr:service@4:usbd: xfer_buf_pa=ffffba0489fe7000
[  130.321291] q6usb-dai 3000000.remoteproc:glink-edge:apr:service@4:usbd: xfer_buf_pa=ffffba0489ff0000
[  130.324979] q6usb-dai 3000000.remoteproc:glink-edge:apr:service@4:usbd: xfer_buf_pa=ffffba048a005000
[  130.329604] q6usb-dai 3000000.remoteproc:glink-edge:apr:service@4:usbd: xfer_buf_pa=ffffba048a00e000
[  130.333397] q6usb-dai 3000000.remoteproc:glink-edge:apr:service@4:usbd: xfer_buf_pa=ffffba048a01d000
[  130.337089] q6usb-dai 3000000.remoteproc:glink-edge:apr:service@4:usbd: xfer_buf_pa=ffffba048a026000

Regards
Luca