Unverified Commit 7e68ba28 authored by Srinivas Kandagatla's avatar Srinivas Kandagatla Committed by Mark Brown
Browse files

ASoC: qcom: q6apm-dai: Allocate an extra page for PCM buffers 



Some Old DSP firmware versions use 32-bit address arithmetic and size for
validating the PCM buffer address range. If a buffer is allocated near
the top of the 32-bit address space, arithmetic calculations involving
the end address can overflow and fail checks.

Work around this by increasing the preallocated PCM buffer size by one
page. The DSP is still passed the usable buffer size, excluding the extra
page, which prevents the firmware from seeing an end address that crosses
the 32-bit boundary.

This was not hit before because PCM buffer allocation and DSP-side
mapping happened at different points, and the size mapped on the DSP was
usually nperiods * period_size. Therefore the mapped size was unlikely to
match the full preallocated buffer size exactly, although the issue was
still possible. With early buffer mapping on the DSP, the full
preallocated buffer is mapped during PCM creation, making the failure
reproducible at boot.

Fixes: 8ea6e25c ("ASoC: qcom: q6apm: Add support for early buffer mapping on DSP")
Cc: Stable@vger.kernel.org
Reported-by: default avatarJens Glathe <jens.glathe@oldschoolsolutions.biz>
Closes: https://lore.kernel.org/all/7f10abbd-fb78-4c3a-ab90-7ca78239891a@oldschoolsolutions.biz/


Signed-off-by: default avatarSrinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
Tested-by: default avatarJens Glathe <jens.glathe@oldschoolsolutions.biz>
Link: https://patch.msgid.link/20260514090607.2435484-1-srinivas.kandagatla@oss.qualcomm.com


Signed-off-by: default avatarMark Brown <broonie@kernel.org>
parent 0d435a7e

sound/soc/qcom/qdsp6/q6apm-dai.c

+6 −1
Original line number Diff line number Diff line
@@ -497,7 +497,12 @@ static int q6apm_dai_pcm_new(struct snd_soc_component *component, struct snd_soc 
{

	struct snd_soc_dai *cpu_dai = snd_soc_rtd_to_cpu(rtd, 0);

	struct snd_pcm *pcm = rtd->pcm;

	int size = BUFFER_BYTES_MAX;

	/*

	 * Allocate one extra page as a workaround for a DSP bug where 32-bit

	 * address arithmetic can overflow when the buffer is placed near the

	 * end of the addressable range.

	 */

	int size = BUFFER_BYTES_MAX + PAGE_SIZE;

	int graph_id, ret;

	struct snd_pcm_substream *substream;