Alsa-Devel Archive on lore.kernel.org
 help / color / mirror / Atom feed
From: Jarkko Nikula <jarkko.nikula@linux.intel.com>
To: alsa-devel@alsa-project.org
Cc: Wenkai Du <wenkai.du@intel.com>, Mark Brown <broonie@kernel.org>,
	Jarkko Nikula <jarkko.nikula@linux.intel.com>,
	Liam Girdwood <lgirdwood@gmail.com>
Subject: [PATCH] ASoC: Intel: Fix audio crash due to negative address offset
Date: Tue, 22 Apr 2014 16:38:54 +0300	[thread overview]
Message-ID: <1398173934-20095-1-git-send-email-jarkko.nikula@linux.intel.com> (raw)

From: Wenkai Du <wenkai.du@intel.com>

There were occasional ADSP crash during reboot testing:

[   11.883364] BUG: unable to handle kernel paging request at ffffc90121700000
[   11.883380] IP: [<ffffffffc024d8bc>] sst_module_insert_fixed_block+0x24f/0x26d [snd_soc_sst_dsp]
[   11.883397] PGD 7800b067 PUD 0
[   11.883405] Oops: 0002 [#1] SMP
[   11.886418] gsmi: Log Shutdown Reason 0x03

The virtual address, ffffc90121700000, was out of range. The virtual
address is calculated by adding LPE base address with an offset:

sst_memcpy32(dsp->addr.lpe + data->offset, data->data, data->size);

The offset is calculated in sst_byt_parse_module, by subtraction of
two virtual addresses dsp->addr.fw_ext and dsp->addr.lpe:

block_data.offset = block->ram_offset + (dsp->addr.fw_ext - dsp->addr.lpe);

These virtual addresses are assigned by kernel from ioremap:

sst->addr.lpe = ioremap(pdata->lpe_base, pdata->lpe_size);
sst->addr.fw_ext = ioremap(pdata->fw_base, pdata->fw_size);

In current driver code, offset is defined as unsigned int32:

struct sst_module_data {
...
	u32 offset;		/* offset in FW file */
};

Most of the time kernel assigned virtual addresses with addr.fw_ext
greater than addr.lpe. But sometimes it was the other way round.

Fix the problem by declaring offset as signed int32_t.

Signed-off-by: Wenkai Du <wenkai.du@intel.com>
Signed-off-by: Jarkko Nikula <jarkko.nikula@linux.intel.com>
---
 sound/soc/intel/sst-dsp-priv.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sound/soc/intel/sst-dsp-priv.h b/sound/soc/intel/sst-dsp-priv.h
index fe8e81aad646..30ca14a6a835 100644
--- a/sound/soc/intel/sst-dsp-priv.h
+++ b/sound/soc/intel/sst-dsp-priv.h
@@ -136,7 +136,7 @@ struct sst_module_data {
 	enum sst_data_type data_type;	/* type of module data */
 
 	u32 size;		/* size in bytes */
-	u32 offset;		/* offset in FW file */
+	int32_t offset;		/* offset in FW file */
 	u32 data_offset;	/* offset in ADSP memory space */
 	void *data;		/* module data */
 };
-- 
1.9.2

             reply	other threads:[~2014-04-22 13:39 UTC|newest]

Thread overview: 2+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2014-04-22 13:38 Jarkko Nikula [this message]
2014-04-22 18:23 ` [PATCH] ASoC: Intel: Fix audio crash due to negative address offset Mark Brown

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=1398173934-20095-1-git-send-email-jarkko.nikula@linux.intel.com \
    --to=jarkko.nikula@linux.intel.com \
    --cc=alsa-devel@alsa-project.org \
    --cc=broonie@kernel.org \
    --cc=lgirdwood@gmail.com \
    --cc=wenkai.du@intel.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox