| Message ID | 20240710061102.1323550-2-quic_varada@quicinc.com (mailing list archive) |
|---|---|
| State | Handled Elsewhere, archived |
| Headers | show |
| Series | Enable CPR for IPQ9574 | expand |
On 10.07.2024 8:10 AM, Varadarajan Narayanan wrote: > cpr3 code assumes that 'acc_desc' is available for SoCs > implementing CPR version 4 or less. However, IPQ9574 SoC > implements CPRv4 without ACC. This causes NULL pointer accesses > resulting in crashes. Hence, check if 'acc_desc' is populated > before using it. > > Signed-off-by: Varadarajan Narayanan <quic_varada@quicinc.com> > --- Does it not work if you drop this patch? In v15, drv->tcsr is left NULL (from kzalloc), unless data->acc_desc is present Konrad
On Wed, Jul 10, 2024 at 01:05:12PM +0200, Konrad Dybcio wrote: > On 10.07.2024 8:10 AM, Varadarajan Narayanan wrote: > > cpr3 code assumes that 'acc_desc' is available for SoCs > > implementing CPR version 4 or less. However, IPQ9574 SoC > > implements CPRv4 without ACC. This causes NULL pointer accesses > > resulting in crashes. Hence, check if 'acc_desc' is populated > > before using it. > > > > Signed-off-by: Varadarajan Narayanan <quic_varada@quicinc.com> > > --- > > Does it not work if you drop this patch? > > In v15, drv->tcsr is left NULL (from kzalloc), unless data->acc_desc > is present It crashed for me with NULL pointer access. Unable to handle kernel NULL pointer dereference at virtual address 0000000000000010 input: gpio-keys as /devices/platform/gpio-keys/input/input0 Mem abort info: ESR = 0x0000000096000004 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 clk: Disabling unused clocks FSC = 0x04: level 0 translation fault Data abort info: ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 CM = 0, WnR = 0, TnD = 0, TagAccess = 0 PM: genpd: Disabling unused power domains GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [0000000000000010] user address but active_mm is swapper Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP Modules linked in: CPU: 0 UID: 0 PID: 74 Comm: sugov:0 Not tainted 6.10.0-rc6-next-20240703-00018-g3dfa5a2e6f31-dirty #13 Hardware name: Qualcomm Technologies, Inc. IPQ9574/AP-AL02-C7 (DT) pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : cpr_commit_state+0x228/0x2a8 lr : cpr_commit_state+0x10c/0x2a8 sp : ffff800086163a90 x29: ffff800086163a90 x28: 0000000000000000 x27: 0000000000000000 x26: 0000000000000000 x25: ffff000006953080 x24: ffff000006913280 x23: 00000000000fa3e8 x22: 00000000000fa3e8 x21: 00000000000fa3e8 x20: 0000000000000003 x19: 00000000000fa3e8 x18: 0000000000000000 x17: 63682d6963687820 x16: 0000000000000000 x15: ffff00003fc8fd00 x14: 0000000000000000 x13: 0000000000000001 x12: ffff8000814e8c60 x11: 0000000000000000 x10: 00000000000009b0 x9 : 0000000000000000 x8 : ffff00003fc87f40 x7 : 0000000000000240 x6 : 0000000000000002 x5 : 000000000000007f x4 : 0000000000000000 x3 : 0000000000000000 x2 : 0000000000000000 x1 : 0000000000000000 x0 : 0000000000000000 Call trace: cpr_commit_state+0x228/0x2a8 cpr_set_performance_state+0x94/0xf4 _genpd_set_performance_state+0x190/0x1ac genpd_set_performance_state.isra.0+0xbc/0xdc genpd_dev_pm_set_performance_state+0x60/0xc0 dev_pm_domain_set_performance_state+0x24/0x3c _set_opp+0xb4/0x51c dev_pm_opp_set_opp+0x70/0xfc _set_required_opps.isra.0+0x74/0xd4 _set_opp+0x90/0x51c dev_pm_opp_set_rate+0x184/0x274 set_target+0x34/0x40 __cpufreq_driver_target+0x250/0x698 sugov_work+0x54/0x70 kthread_worker_fn+0xc4/0x174 kthread+0x110/0x114 ret_from_fork+0x10/0x20 Thanks Varada
diff --git a/drivers/pmdomain/qcom/cpr3.c b/drivers/pmdomain/qcom/cpr3.c index de24973978b7..d594bc79be1c 100644 --- a/drivers/pmdomain/qcom/cpr3.c +++ b/drivers/pmdomain/qcom/cpr3.c @@ -536,12 +536,15 @@ static void cpr_corner_restore(struct cpr_thread *thread, static void cpr_set_acc(struct cpr_drv *drv, int f) { const struct acc_desc *desc = drv->acc_desc; - struct reg_sequence *s = desc->settings; - int n = desc->num_regs_per_fuse; + struct reg_sequence *s; + int n; - if (!drv->tcsr) + if (!desc || !drv->tcsr) return; + s = desc->settings; + n = desc->num_regs_per_fuse; + if (!s || f == drv->fuse_level_set) return;
cpr3 code assumes that 'acc_desc' is available for SoCs implementing CPR version 4 or less. However, IPQ9574 SoC implements CPRv4 without ACC. This causes NULL pointer accesses resulting in crashes. Hence, check if 'acc_desc' is populated before using it. Signed-off-by: Varadarajan Narayanan <quic_varada@quicinc.com> --- v6: Changes done in the previous version of this patch got squashed into Konrad's V15 - https://lore.kernel.org/lkml/20240708-topic-cpr3h-v15-9-5bc8b8936489@linaro.org/ In v14, cpr_set_acc() was invoked from cpr_pre_voltage() or cpr_post_voltage(). Both of those functions invoked cpr_set_acc() only if drv->tcsr was not NULL (and that implied acc_desc != NULL). In v15, cpr_pre_voltage() & cpr_post_voltage() have been removed and cpr_set_acc() is called even though acc_desc is NULL resulting in NULL pointer access. Hence allow cpr_set_acc() to proceed only if acc_desc is set. v5: Add acc_desc check in a different way without breaking other SoC v4: Undo the acc_desc validation in probe function as that could affect other SoC. --- drivers/pmdomain/qcom/cpr3.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)