sound/soc/qcom/sdm845.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
During the migration of Soundwire runtime stream allocation from
the Qualcomm Soundwire controller to SoC's soundcard drivers the sdm845
soundcard was forgotten.
At this point any playback attempt or audio daemon startup, for instance
on sdm845-db845c (Qualcomm RB3 board), will result in stream pointer
NULL dereference:
Unable to handle kernel NULL pointer dereference at virtual
address 0000000000000020
Mem abort info:
ESR = 0x0000000096000004
EC = 0x25: DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
FSC = 0x04: level 0 translation fault
Data abort info:
ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000
CM = 0, WnR = 0, TnD = 0, TagAccess = 0
GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
user pgtable: 4k pages, 48-bit VAs, pgdp=0000000101ecf000
[0000000000000020] pgd=0000000000000000, p4d=0000000000000000
Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP
Modules linked in: ...
CPU: 5 UID: 0 PID: 1198 Comm: aplay
Not tainted 6.12.0-rc2-qcomlt-arm64-00059-g9d78f315a362-dirty #18
Hardware name: Thundercomm Dragonboard 845c (DT)
pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : sdw_stream_add_slave+0x44/0x380 [soundwire_bus]
lr : sdw_stream_add_slave+0x44/0x380 [soundwire_bus]
sp : ffff80008a2035c0
x29: ffff80008a2035c0 x28: ffff80008a203978 x27: 0000000000000000
x26: 00000000000000c0 x25: 0000000000000000 x24: ffff1676025f4800
x23: ffff167600ff1cb8 x22: ffff167600ff1c98 x21: 0000000000000003
x20: ffff167607316000 x19: ffff167604e64e80 x18: 0000000000000000
x17: 0000000000000000 x16: ffffcec265074160 x15: 0000000000000000
x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000
x11: 0000000000000000 x10: 0000000000000000 x9 : 0000000000000000
x8 : 0000000000000000 x7 : 0000000000000000 x6 : ffff167600ff1cec
x5 : ffffcec22cfa2010 x4 : 0000000000000000 x3 : 0000000000000003
x2 : ffff167613f836c0 x1 : 0000000000000000 x0 : ffff16761feb60b8
Call trace:
sdw_stream_add_slave+0x44/0x380 [soundwire_bus]
wsa881x_hw_params+0x68/0x80 [snd_soc_wsa881x]
snd_soc_dai_hw_params+0x3c/0xa4
__soc_pcm_hw_params+0x230/0x660
dpcm_be_dai_hw_params+0x1d0/0x3f8
dpcm_fe_dai_hw_params+0x98/0x268
snd_pcm_hw_params+0x124/0x460
snd_pcm_common_ioctl+0x998/0x16e8
snd_pcm_ioctl+0x34/0x58
__arm64_sys_ioctl+0xac/0xf8
invoke_syscall+0x48/0x104
el0_svc_common.constprop.0+0x40/0xe0
do_el0_svc+0x1c/0x28
el0_svc+0x34/0xe0
el0t_64_sync_handler+0x120/0x12c
el0t_64_sync+0x190/0x194
Code: aa0403fb f9418400 9100e000 9400102f (f8420f22)
---[ end trace 0000000000000000 ]---
0000000000006108 <sdw_stream_add_slave>:
6108: d503233f paciasp
610c: a9b97bfd stp x29, x30, [sp, #-112]!
6110: 910003fd mov x29, sp
6114: a90153f3 stp x19, x20, [sp, #16]
6118: a9025bf5 stp x21, x22, [sp, #32]
611c: aa0103f6 mov x22, x1
6120: 2a0303f5 mov w21, w3
6124: a90363f7 stp x23, x24, [sp, #48]
6128: aa0003f8 mov x24, x0
612c: aa0203f7 mov x23, x2
6130: a9046bf9 stp x25, x26, [sp, #64]
6134: aa0403f9 mov x25, x4 <-- x4 copied to x25
6138: a90573fb stp x27, x28, [sp, #80]
613c: aa0403fb mov x27, x4
6140: f9418400 ldr x0, [x0, #776]
6144: 9100e000 add x0, x0, #0x38
6148: 94000000 bl 0 <mutex_lock>
614c: f8420f22 ldr x2, [x25, #32]! <-- offset 0x44
^^^
This is 0x6108 + offset 0x44 from the beginning of sdw_stream_add_slave()
where data abort happens.
wsa881x_hw_params() is called with stream = NULL and passes it further
in register x4 (5th argument) to sdw_stream_add_slave() without any checks.
Value from x4 is copied to x25 and finally it aborts on trying to load
a value from address in x25 plus offset 32 (in dec) which corresponds
to master_list member in struct sdw_stream_runtime:
struct sdw_stream_runtime {
const char * name; /* 0 8 */
struct sdw_stream_params params; /* 8 12 */
enum sdw_stream_state state; /* 20 4 */
enum sdw_stream_type type; /* 24 4 */
/* XXX 4 bytes hole, try to pack */
here-> struct list_head master_list; /* 32 16 */
int m_rt_count; /* 48 4 */
/* size: 56, cachelines: 1, members: 6 */
/* sum members: 48, holes: 1, sum holes: 4 */
/* padding: 4 */
/* last cacheline: 56 bytes */
Fix this by adding required calls to qcom_snd_sdw_startup() and
sdw_release_stream() to startup and shutdown routines which restores
the previous correct behaviour when ->set_stream() method is called to
set a valid stream runtime pointer on playback startup.
Reproduced and then fix was tested on db845c RB3 board.
Reported-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Cc: stable@vger.kernel.org
Fixes: 15c7fab0e047 ("ASoC: qcom: Move Soundwire runtime stream alloc to soundcards")
Cc: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Cc: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Cc: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Cc: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Signed-off-by: Alexey Klimov <alexey.klimov@linaro.org>
---
sound/soc/qcom/sdm845.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/sound/soc/qcom/sdm845.c b/sound/soc/qcom/sdm845.c
index 75701546b6ea..a479d7e5b7fb 100644
--- a/sound/soc/qcom/sdm845.c
+++ b/sound/soc/qcom/sdm845.c
@@ -15,6 +15,7 @@
#include <uapi/linux/input-event-codes.h>
#include "common.h"
#include "qdsp6/q6afe.h"
+#include "sdw.h"
#include "../codecs/rt5663.h"
#define DRIVER_NAME "sdm845"
@@ -416,7 +417,7 @@ static int sdm845_snd_startup(struct snd_pcm_substream *substream)
pr_err("%s: invalid dai id 0x%x\n", __func__, cpu_dai->id);
break;
}
- return 0;
+ return qcom_snd_sdw_startup(substream);
}
static void sdm845_snd_shutdown(struct snd_pcm_substream *substream)
@@ -425,6 +426,7 @@ static void sdm845_snd_shutdown(struct snd_pcm_substream *substream)
struct snd_soc_card *card = rtd->card;
struct sdm845_snd_data *data = snd_soc_card_get_drvdata(card);
struct snd_soc_dai *cpu_dai = snd_soc_rtd_to_cpu(rtd, 0);
+ struct sdw_stream_runtime *sruntime = data->sruntime[cpu_dai->id];
switch (cpu_dai->id) {
case PRIMARY_MI2S_RX:
@@ -463,6 +465,9 @@ static void sdm845_snd_shutdown(struct snd_pcm_substream *substream)
pr_err("%s: invalid dai id 0x%x\n", __func__, cpu_dai->id);
break;
}
+
+ data->sruntime[cpu_dai->id] = NULL;
+ sdw_release_stream(sruntime);
}
static int sdm845_snd_prepare(struct snd_pcm_substream *substream)
--
2.45.2On Wed, 09 Oct 2024 22:39:22 +0100, Alexey Klimov wrote:
> During the migration of Soundwire runtime stream allocation from
> the Qualcomm Soundwire controller to SoC's soundcard drivers the sdm845
> soundcard was forgotten.
>
> At this point any playback attempt or audio daemon startup, for instance
> on sdm845-db845c (Qualcomm RB3 board), will result in stream pointer
> NULL dereference:
>
> [...]
Applied to
https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound.git for-next
Thanks!
[1/1] ASoC: qcom: sdm845: add missing soundwire runtime stream alloc
commit: d0e806b0cc6260b59c65e606034a63145169c04c
All being well this means that it will be integrated into the linux-next
tree (usually sometime in the next 24 hours) and sent to Linus during
the next merge window (or sooner if it is a bug fix), however if
problems are discovered then the patch may be dropped or reverted.
You may get further e-mails resulting from automated or manual testing
and review of the tree, please engage with people reporting problems and
send followup patches addressing any issues that are reported if needed.
If any updates are required or you are submitting further changes they
should be sent as incremental updates against current git, existing
patches will not be replaced.
Please add any relevant lists and maintainers to the CCs when replying
to this mail.
Thanks,
Mark
On 09/10/2024 22:39, Alexey Klimov wrote:
> During the migration of Soundwire runtime stream allocation from
> the Qualcomm Soundwire controller to SoC's soundcard drivers the sdm845
> soundcard was forgotten.
>
> At this point any playback attempt or audio daemon startup, for instance
> on sdm845-db845c (Qualcomm RB3 board), will result in stream pointer
> NULL dereference:
>
> Unable to handle kernel NULL pointer dereference at virtual
> address 0000000000000020
> Mem abort info:
> ESR = 0x0000000096000004
> EC = 0x25: DABT (current EL), IL = 32 bits
> SET = 0, FnV = 0
> EA = 0, S1PTW = 0
> FSC = 0x04: level 0 translation fault
> Data abort info:
> ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000
> CM = 0, WnR = 0, TnD = 0, TagAccess = 0
> GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
> user pgtable: 4k pages, 48-bit VAs, pgdp=0000000101ecf000
> [0000000000000020] pgd=0000000000000000, p4d=0000000000000000
> Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP
> Modules linked in: ...
> CPU: 5 UID: 0 PID: 1198 Comm: aplay
> Not tainted 6.12.0-rc2-qcomlt-arm64-00059-g9d78f315a362-dirty #18
> Hardware name: Thundercomm Dragonboard 845c (DT)
> pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
> pc : sdw_stream_add_slave+0x44/0x380 [soundwire_bus]
> lr : sdw_stream_add_slave+0x44/0x380 [soundwire_bus]
> sp : ffff80008a2035c0
> x29: ffff80008a2035c0 x28: ffff80008a203978 x27: 0000000000000000
> x26: 00000000000000c0 x25: 0000000000000000 x24: ffff1676025f4800
> x23: ffff167600ff1cb8 x22: ffff167600ff1c98 x21: 0000000000000003
> x20: ffff167607316000 x19: ffff167604e64e80 x18: 0000000000000000
> x17: 0000000000000000 x16: ffffcec265074160 x15: 0000000000000000
> x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000
> x11: 0000000000000000 x10: 0000000000000000 x9 : 0000000000000000
> x8 : 0000000000000000 x7 : 0000000000000000 x6 : ffff167600ff1cec
> x5 : ffffcec22cfa2010 x4 : 0000000000000000 x3 : 0000000000000003
> x2 : ffff167613f836c0 x1 : 0000000000000000 x0 : ffff16761feb60b8
> Call trace:
> sdw_stream_add_slave+0x44/0x380 [soundwire_bus]
> wsa881x_hw_params+0x68/0x80 [snd_soc_wsa881x]
> snd_soc_dai_hw_params+0x3c/0xa4
> __soc_pcm_hw_params+0x230/0x660
> dpcm_be_dai_hw_params+0x1d0/0x3f8
> dpcm_fe_dai_hw_params+0x98/0x268
> snd_pcm_hw_params+0x124/0x460
> snd_pcm_common_ioctl+0x998/0x16e8
> snd_pcm_ioctl+0x34/0x58
> __arm64_sys_ioctl+0xac/0xf8
> invoke_syscall+0x48/0x104
> el0_svc_common.constprop.0+0x40/0xe0
> do_el0_svc+0x1c/0x28
> el0_svc+0x34/0xe0
> el0t_64_sync_handler+0x120/0x12c
> el0t_64_sync+0x190/0x194
> Code: aa0403fb f9418400 9100e000 9400102f (f8420f22)
> ---[ end trace 0000000000000000 ]---
>
> 0000000000006108 <sdw_stream_add_slave>:
> 6108: d503233f paciasp
> 610c: a9b97bfd stp x29, x30, [sp, #-112]!
> 6110: 910003fd mov x29, sp
> 6114: a90153f3 stp x19, x20, [sp, #16]
> 6118: a9025bf5 stp x21, x22, [sp, #32]
> 611c: aa0103f6 mov x22, x1
> 6120: 2a0303f5 mov w21, w3
> 6124: a90363f7 stp x23, x24, [sp, #48]
> 6128: aa0003f8 mov x24, x0
> 612c: aa0203f7 mov x23, x2
> 6130: a9046bf9 stp x25, x26, [sp, #64]
> 6134: aa0403f9 mov x25, x4 <-- x4 copied to x25
> 6138: a90573fb stp x27, x28, [sp, #80]
> 613c: aa0403fb mov x27, x4
> 6140: f9418400 ldr x0, [x0, #776]
> 6144: 9100e000 add x0, x0, #0x38
> 6148: 94000000 bl 0 <mutex_lock>
> 614c: f8420f22 ldr x2, [x25, #32]! <-- offset 0x44
> ^^^
> This is 0x6108 + offset 0x44 from the beginning of sdw_stream_add_slave()
> where data abort happens.
> wsa881x_hw_params() is called with stream = NULL and passes it further
> in register x4 (5th argument) to sdw_stream_add_slave() without any checks.
> Value from x4 is copied to x25 and finally it aborts on trying to load
> a value from address in x25 plus offset 32 (in dec) which corresponds
> to master_list member in struct sdw_stream_runtime:
>
> struct sdw_stream_runtime {
> const char * name; /* 0 8 */
> struct sdw_stream_params params; /* 8 12 */
> enum sdw_stream_state state; /* 20 4 */
> enum sdw_stream_type type; /* 24 4 */
> /* XXX 4 bytes hole, try to pack */
> here-> struct list_head master_list; /* 32 16 */
> int m_rt_count; /* 48 4 */
> /* size: 56, cachelines: 1, members: 6 */
> /* sum members: 48, holes: 1, sum holes: 4 */
> /* padding: 4 */
> /* last cacheline: 56 bytes */
>
> Fix this by adding required calls to qcom_snd_sdw_startup() and
> sdw_release_stream() to startup and shutdown routines which restores
> the previous correct behaviour when ->set_stream() method is called to
> set a valid stream runtime pointer on playback startup.
>
> Reproduced and then fix was tested on db845c RB3 board.
>
> Reported-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
> Cc: stable@vger.kernel.org
> Fixes: 15c7fab0e047 ("ASoC: qcom: Move Soundwire runtime stream alloc to soundcards")
> Cc: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
> Cc: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
> Cc: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
> Cc: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
> Signed-off-by: Alexey Klimov <alexey.klimov@linaro.org>
thanks for fixing this,
Reviewed-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
--srini
> ---
> sound/soc/qcom/sdm845.c | 7 ++++++-
> 1 file changed, 6 insertions(+), 1 deletion(-)
>
> diff --git a/sound/soc/qcom/sdm845.c b/sound/soc/qcom/sdm845.c
> index 75701546b6ea..a479d7e5b7fb 100644
> --- a/sound/soc/qcom/sdm845.c
> +++ b/sound/soc/qcom/sdm845.c
> @@ -15,6 +15,7 @@
> #include <uapi/linux/input-event-codes.h>
> #include "common.h"
> #include "qdsp6/q6afe.h"
> +#include "sdw.h"
> #include "../codecs/rt5663.h"
>
> #define DRIVER_NAME "sdm845"
> @@ -416,7 +417,7 @@ static int sdm845_snd_startup(struct snd_pcm_substream *substream)
> pr_err("%s: invalid dai id 0x%x\n", __func__, cpu_dai->id);
> break;
> }
> - return 0;
> + return qcom_snd_sdw_startup(substream);
> }
>
> static void sdm845_snd_shutdown(struct snd_pcm_substream *substream)
> @@ -425,6 +426,7 @@ static void sdm845_snd_shutdown(struct snd_pcm_substream *substream)
> struct snd_soc_card *card = rtd->card;
> struct sdm845_snd_data *data = snd_soc_card_get_drvdata(card);
> struct snd_soc_dai *cpu_dai = snd_soc_rtd_to_cpu(rtd, 0);
> + struct sdw_stream_runtime *sruntime = data->sruntime[cpu_dai->id];
>
> switch (cpu_dai->id) {
> case PRIMARY_MI2S_RX:
> @@ -463,6 +465,9 @@ static void sdm845_snd_shutdown(struct snd_pcm_substream *substream)
> pr_err("%s: invalid dai id 0x%x\n", __func__, cpu_dai->id);
> break;
> }
> +
> + data->sruntime[cpu_dai->id] = NULL;
> + sdw_release_stream(sruntime);
> }
>
> static int sdm845_snd_prepare(struct snd_pcm_substream *substream)
On 09/10/2024 23:39, Alexey Klimov wrote:
> During the migration of Soundwire runtime stream allocation from
> the Qualcomm Soundwire controller to SoC's soundcard drivers the sdm845
> soundcard was forgotten.
>
> At this point any playback attempt or audio daemon startup, for instance
> on sdm845-db845c (Qualcomm RB3 board), will result in stream pointer
> NULL dereference:
...
>
> Reproduced and then fix was tested on db845c RB3 board.
>
> Reported-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
> Cc: stable@vger.kernel.org
> Fixes: 15c7fab0e047 ("ASoC: qcom: Move Soundwire runtime stream alloc to soundcards")
> Cc: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
> Cc: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
> Cc: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
> Cc: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
> Signed-off-by: Alexey Klimov <alexey.klimov@linaro.org>
> ---
We should fix this everywhere, not only sdm845. I'll look at remaining
sc7280.
> sound/soc/qcom/sdm845.c | 7 ++++++-
> 1 file changed, 6 insertions(+), 1 deletion(-)
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Best regards,
Krzysztof
On Thu Oct 10, 2024 at 6:18 AM BST, Krzysztof Kozlowski wrote:
> On 09/10/2024 23:39, Alexey Klimov wrote:
> > During the migration of Soundwire runtime stream allocation from
> > the Qualcomm Soundwire controller to SoC's soundcard drivers the sdm845
> > soundcard was forgotten.
> >
> > At this point any playback attempt or audio daemon startup, for instance
> > on sdm845-db845c (Qualcomm RB3 board), will result in stream pointer
> > NULL dereference:
>
> ...
>
> >
> > Reproduced and then fix was tested on db845c RB3 board.
> >
> > Reported-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
> > Cc: stable@vger.kernel.org
> > Fixes: 15c7fab0e047 ("ASoC: qcom: Move Soundwire runtime stream alloc to soundcards")
> > Cc: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
> > Cc: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
> > Cc: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
> > Cc: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
> > Signed-off-by: Alexey Klimov <alexey.klimov@linaro.org>
> > ---
>
> We should fix this everywhere, not only sdm845. I'll look at remaining
> sc7280.
What about sc7180? Or is sc7180 one the platforms where soundwire is not used
and DSP is not involved?
Anyway, I don't have hw to test sc7180 or sc7280.
Thank you,
Alexey
Hi Alexey,
On Wed, Oct 9, 2024 at 4:39 PM Alexey Klimov <alexey.klimov@linaro.org> wrote:
>
> During the migration of Soundwire runtime stream allocation from
> the Qualcomm Soundwire controller to SoC's soundcard drivers the sdm845
> soundcard was forgotten.
>
> At this point any playback attempt or audio daemon startup, for instance
> on sdm845-db845c (Qualcomm RB3 board), will result in stream pointer
> NULL dereference:
>
> Unable to handle kernel NULL pointer dereference at virtual
> address 0000000000000020
> Mem abort info:
> ESR = 0x0000000096000004
> EC = 0x25: DABT (current EL), IL = 32 bits
> SET = 0, FnV = 0
> EA = 0, S1PTW = 0
> FSC = 0x04: level 0 translation fault
> Data abort info:
> ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000
> CM = 0, WnR = 0, TnD = 0, TagAccess = 0
> GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
> user pgtable: 4k pages, 48-bit VAs, pgdp=0000000101ecf000
> [0000000000000020] pgd=0000000000000000, p4d=0000000000000000
> Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP
> Modules linked in: ...
> CPU: 5 UID: 0 PID: 1198 Comm: aplay
> Not tainted 6.12.0-rc2-qcomlt-arm64-00059-g9d78f315a362-dirty #18
> Hardware name: Thundercomm Dragonboard 845c (DT)
> pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
> pc : sdw_stream_add_slave+0x44/0x380 [soundwire_bus]
> lr : sdw_stream_add_slave+0x44/0x380 [soundwire_bus]
> sp : ffff80008a2035c0
> x29: ffff80008a2035c0 x28: ffff80008a203978 x27: 0000000000000000
> x26: 00000000000000c0 x25: 0000000000000000 x24: ffff1676025f4800
> x23: ffff167600ff1cb8 x22: ffff167600ff1c98 x21: 0000000000000003
> x20: ffff167607316000 x19: ffff167604e64e80 x18: 0000000000000000
> x17: 0000000000000000 x16: ffffcec265074160 x15: 0000000000000000
> x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000
> x11: 0000000000000000 x10: 0000000000000000 x9 : 0000000000000000
> x8 : 0000000000000000 x7 : 0000000000000000 x6 : ffff167600ff1cec
> x5 : ffffcec22cfa2010 x4 : 0000000000000000 x3 : 0000000000000003
> x2 : ffff167613f836c0 x1 : 0000000000000000 x0 : ffff16761feb60b8
> Call trace:
> sdw_stream_add_slave+0x44/0x380 [soundwire_bus]
> wsa881x_hw_params+0x68/0x80 [snd_soc_wsa881x]
> snd_soc_dai_hw_params+0x3c/0xa4
> __soc_pcm_hw_params+0x230/0x660
> dpcm_be_dai_hw_params+0x1d0/0x3f8
> dpcm_fe_dai_hw_params+0x98/0x268
> snd_pcm_hw_params+0x124/0x460
> snd_pcm_common_ioctl+0x998/0x16e8
> snd_pcm_ioctl+0x34/0x58
> __arm64_sys_ioctl+0xac/0xf8
> invoke_syscall+0x48/0x104
> el0_svc_common.constprop.0+0x40/0xe0
> do_el0_svc+0x1c/0x28
> el0_svc+0x34/0xe0
> el0t_64_sync_handler+0x120/0x12c
> el0t_64_sync+0x190/0x194
> Code: aa0403fb f9418400 9100e000 9400102f (f8420f22)
> ---[ end trace 0000000000000000 ]---
>
> 0000000000006108 <sdw_stream_add_slave>:
> 6108: d503233f paciasp
> 610c: a9b97bfd stp x29, x30, [sp, #-112]!
> 6110: 910003fd mov x29, sp
> 6114: a90153f3 stp x19, x20, [sp, #16]
> 6118: a9025bf5 stp x21, x22, [sp, #32]
> 611c: aa0103f6 mov x22, x1
> 6120: 2a0303f5 mov w21, w3
> 6124: a90363f7 stp x23, x24, [sp, #48]
> 6128: aa0003f8 mov x24, x0
> 612c: aa0203f7 mov x23, x2
> 6130: a9046bf9 stp x25, x26, [sp, #64]
> 6134: aa0403f9 mov x25, x4 <-- x4 copied to x25
> 6138: a90573fb stp x27, x28, [sp, #80]
> 613c: aa0403fb mov x27, x4
> 6140: f9418400 ldr x0, [x0, #776]
> 6144: 9100e000 add x0, x0, #0x38
> 6148: 94000000 bl 0 <mutex_lock>
> 614c: f8420f22 ldr x2, [x25, #32]! <-- offset 0x44
> ^^^
> This is 0x6108 + offset 0x44 from the beginning of sdw_stream_add_slave()
> where data abort happens.
> wsa881x_hw_params() is called with stream = NULL and passes it further
> in register x4 (5th argument) to sdw_stream_add_slave() without any checks.
> Value from x4 is copied to x25 and finally it aborts on trying to load
> a value from address in x25 plus offset 32 (in dec) which corresponds
> to master_list member in struct sdw_stream_runtime:
>
> struct sdw_stream_runtime {
> const char * name; /* 0 8 */
> struct sdw_stream_params params; /* 8 12 */
> enum sdw_stream_state state; /* 20 4 */
> enum sdw_stream_type type; /* 24 4 */
> /* XXX 4 bytes hole, try to pack */
> here-> struct list_head master_list; /* 32 16 */
> int m_rt_count; /* 48 4 */
> /* size: 56, cachelines: 1, members: 6 */
> /* sum members: 48, holes: 1, sum holes: 4 */
> /* padding: 4 */
> /* last cacheline: 56 bytes */
>
> Fix this by adding required calls to qcom_snd_sdw_startup() and
> sdw_release_stream() to startup and shutdown routines which restores
> the previous correct behaviour when ->set_stream() method is called to
> set a valid stream runtime pointer on playback startup.
>
> Reproduced and then fix was tested on db845c RB3 board.
>
> Reported-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
> Cc: stable@vger.kernel.org
> Fixes: 15c7fab0e047 ("ASoC: qcom: Move Soundwire runtime stream alloc to soundcards")
> Cc: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
> Cc: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
> Cc: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
> Cc: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
> Signed-off-by: Alexey Klimov <alexey.klimov@linaro.org>
> ---
> sound/soc/qcom/sdm845.c | 7 ++++++-
> 1 file changed, 6 insertions(+), 1 deletion(-)
>
> diff --git a/sound/soc/qcom/sdm845.c b/sound/soc/qcom/sdm845.c
> index 75701546b6ea..a479d7e5b7fb 100644
> --- a/sound/soc/qcom/sdm845.c
> +++ b/sound/soc/qcom/sdm845.c
> @@ -15,6 +15,7 @@
> #include <uapi/linux/input-event-codes.h>
> #include "common.h"
> #include "qdsp6/q6afe.h"
> +#include "sdw.h"
> #include "../codecs/rt5663.h"
>
> #define DRIVER_NAME "sdm845"
> @@ -416,7 +417,7 @@ static int sdm845_snd_startup(struct snd_pcm_substream *substream)
> pr_err("%s: invalid dai id 0x%x\n", __func__, cpu_dai->id);
> break;
> }
> - return 0;
> + return qcom_snd_sdw_startup(substream);
> }
>
> static void sdm845_snd_shutdown(struct snd_pcm_substream *substream)
> @@ -425,6 +426,7 @@ static void sdm845_snd_shutdown(struct snd_pcm_substream *substream)
> struct snd_soc_card *card = rtd->card;
> struct sdm845_snd_data *data = snd_soc_card_get_drvdata(card);
> struct snd_soc_dai *cpu_dai = snd_soc_rtd_to_cpu(rtd, 0);
> + struct sdw_stream_runtime *sruntime = data->sruntime[cpu_dai->id];
>
> switch (cpu_dai->id) {
> case PRIMARY_MI2S_RX:
> @@ -463,6 +465,9 @@ static void sdm845_snd_shutdown(struct snd_pcm_substream *substream)
> pr_err("%s: invalid dai id 0x%x\n", __func__, cpu_dai->id);
> break;
> }
> +
> + data->sruntime[cpu_dai->id] = NULL;
> + sdw_release_stream(sruntime);
> }
>
> static int sdm845_snd_prepare(struct snd_pcm_substream *substream)
> --
> 2.45.2
>
>
Thank you so much for tracking this down! Was experiencing the same
thing on my Lenovo Yoga C630, and testing with this patch, I no longer
see the null pointer and also have working audio.
Tested-by: Steev Klimaszewski <steev@kali.org> # Lenovo Yoga C630
Hi Steev, On Thu Oct 10, 2024 at 1:33 AM BST, Steev Klimaszewski wrote: > Hi Alexey, > > > > Thank you so much for tracking this down! Was experiencing the same > thing on my Lenovo Yoga C630, and testing with this patch, I no longer > see the null pointer and also have working audio. > > Tested-by: Steev Klimaszewski <steev@kali.org> # Lenovo Yoga C630 Thank you for testing! I didn't know that this affected more than one board but I was told that it was long-standing bug. Best regards, Alexey
© 2016 - 2024 Red Hat, Inc.