ASoC: SOF: Intel: pci-tng: revert invalid bar size setting

Commit Message

Peter Ujfalusi March 7, 2023, 9:53 a.m. UTC

From: Pierre-Louis Bossart <[e-mail]>

The logic for the ioremap is to find the resource index 3 (IRAM) and
infer the BAR address by subtracting the IRAM offset. The BAR size
defined in hardware specifications is 2MB.

The commit 5947b2726beb6 ("ASoC: SOF: Intel: Check the bar size before
remapping") tried to find the BAR size by querying the resource length
instead of a pre-canned value, but by requesting the size for index 3
it only gets the size of the IRAM. That's obviously wrong and prevents
the probe from proceeding.

This commit attempted to fix an issue in a fuzzing/simulated
environment but created another on actual devices, so the best course
of action is to revert that change.

Reported-by: Ferry Toth <[e-mail]>
Tested-by: Ferry Toth <[e-mail]> (Intel Edison-Arduino)
Link: https://github.com/thesofproject/linux/issues/3901
Signed-off-by: Pierre-Louis Bossart <[e-mail]>
Reviewed-by: Péter Ujfalusi <[e-mail]>
Reviewed-by: Ranjani Sridharan <[e-mail]>
Signed-off-by: Peter Ujfalusi <[e-mail]>
---
 sound/soc/sof/intel/pci-tng.c | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

Comments

Mark Brown March 8, 2023, 1:52 p.m. UTC | #1

On Tue, 07 Mar 2023 11:53:41 +0200, Peter Ujfalusi wrote:
> The logic for the ioremap is to find the resource index 3 (IRAM) and
> infer the BAR address by subtracting the IRAM offset. The BAR size
> defined in hardware specifications is 2MB.
> 
> The commit 5947b2726beb6 ("ASoC: SOF: Intel: Check the bar size before
> remapping") tried to find the BAR size by querying the resource length
> instead of a pre-canned value, but by requesting the size for index 3
> it only gets the size of the IRAM. That's obviously wrong and prevents
> the probe from proceeding.
> 
> [...]

Applied to

   https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound.git for-next

Thanks!

[1/1] ASoC: SOF: Intel: pci-tng: revert invalid bar size setting
      commit: ca09e2a351fbc7836ba9418304ff0c3e72addfe0

All being well this means that it will be integrated into the linux-next
tree (usually sometime in the next 24 hours) and sent to Linus during
the next merge window (or sooner if it is a bug fix), however if
problems are discovered then the patch may be dropped or reverted.

You may get further e-mails resulting from automated or manual testing
and review of the tree, please engage with people reporting problems and
send followup patches addressing any issues that are reported if needed.

If any updates are required or you are submitting further changes they
should be sent as incremental updates against current git, existing
patches will not be replaced.

Please add any relevant lists and maintainers to the CCs when replying
to this mail.

Thanks,
Mark

Patch

diff --git a/sound/soc/sof/intel/pci-tng.c b/sound/soc/sof/intel/pci-tng.c
index 5b2b409752c5..8c22a00266c0 100644
--- a/sound/soc/sof/intel/pci-tng.c
+++ b/sound/soc/sof/intel/pci-tng.c
@@ -75,11 +75,7 @@  static int tangier_pci_probe(struct snd_sof_dev *sdev)
 
 	/* LPE base */
 	base = pci_resource_start(pci, desc->resindex_lpe_base) - IRAM_OFFSET;
-	size = pci_resource_len(pci, desc->resindex_lpe_base);
-	if (size < PCI_BAR_SIZE) {
-		dev_err(sdev->dev, "error: I/O region is too small.\n");
-		return -ENODEV;
-	}
+	size = PCI_BAR_SIZE;
 
 	dev_dbg(sdev->dev, "LPE PHY base at 0x%x size 0x%x", base, size);
 	sdev->bar[DSP_BAR] = devm_ioremap(sdev->dev, base, size);