February 2018 - Alsa-devel - mailman.alsa-project.org

[alsa-devel] [PATCH] ALSA: seq: Fix racy pool initializations
by Takashi Iwai 14 Feb '18

14 Feb '18

ALSA sequencer core initializes the event pool on demand by invoking snd_seq_pool_init() when the first write happens and the pool is empty. Meanwhile user can reset the pool size manually via ioctl concurrently, and this may lead to UAF or out-of-bound accesses since the function tries to vmalloc / vfree the buffer. A simple fix is to just wrap the snd_seq_pool_init() call with the recently introduced client->ioctl_mutex; as the calls for snd_seq_pool_init() from other side are always protected with this mutex, we can avoid the race. Reported-by: 范龙飞 <long7573(a)126.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai(a)suse.de> --- sound/core/seq/seq_clientmgr.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c index 60db32785f62..04d4db44fae5 100644 --- a/sound/core/seq/seq_clientmgr.c +++ b/sound/core/seq/seq_clientmgr.c @@ -1003,7 +1003,7 @@ static ssize_t snd_seq_write(struct file *file, const char __user *buf, { struct snd_seq_client *client = file->private_data; int written = 0, len; - int err = -EINVAL; + int err; struct snd_seq_event event; if (!(snd_seq_file_flags(file) & SNDRV_SEQ_LFLG_OUTPUT)) @@ -1018,11 +1018,15 @@ static ssize_t snd_seq_write(struct file *file, const char __user *buf, /* allocate the pool now if the pool is not allocated yet */ if (client->pool->size > 0 && !snd_seq_write_pool_allocated(client)) { - if (snd_seq_pool_init(client->pool) < 0) + mutex_lock(&client->ioctl_mutex); + err = snd_seq_pool_init(client->pool); + mutex_unlock(&client->ioctl_mutex); + if (err < 0) return -ENOMEM; } /* only process whole events */ + err = -EINVAL; while (count >= sizeof(struct snd_seq_event)) { /* Read in the event header from the user */ len = sizeof(event); -- 2.15.1

1 0

[alsa-devel] [PATCH v3 1/5] ALSA: emu10k1: remove reserved_page
by Maciej S. Szmigiero 14 Feb '18

14 Feb '18

The emu10k1-family chips need the first page (index 0) reserved in their page tables for some reason (every emu10k1 driver I've checked does this without much of an explanation). Using the first page for normal samples results in a broken playback. However, we already have a dummy page allocated - so called "silent page" and, in fact, had always been setting it as the first page in the chip page table because an initialization of every entry of the page table to point to a silent page happens after and overwrites the reserved_page allocation. So the only thing remaining to remove the reserved_page allocation is a trivial change to the page allocation logic to ignore the first page entry and start its allocations from the second entry (index 1). Signed-off-by: Maciej S. Szmigiero <mail(a)maciej.szmigiero.name> --- Changes from v1, v2: None in this patch. include/sound/emu10k1.h | 1 - sound/pci/emu10k1/emu10k1_main.c | 11 ----------- sound/pci/emu10k1/memory.c | 8 ++++++-- 3 files changed, 6 insertions(+), 14 deletions(-) diff --git a/include/sound/emu10k1.h b/include/sound/emu10k1.h index 4f42affe777c..db32b7de52e0 100644 --- a/include/sound/emu10k1.h +++ b/include/sound/emu10k1.h @@ -1718,7 +1718,6 @@ struct snd_emu10k1 { struct snd_dma_buffer p16v_buffer; struct snd_util_memhdr *memhdr; /* page allocation list */ - struct snd_emu10k1_memblk *reserved_page; /* reserved page */ struct list_head mapped_link_head; struct list_head mapped_order_link_head; diff --git a/sound/pci/emu10k1/emu10k1_main.c b/sound/pci/emu10k1/emu10k1_main.c index ccf4415a1c7b..a0a4d31ded53 100644 --- a/sound/pci/emu10k1/emu10k1_main.c +++ b/sound/pci/emu10k1/emu10k1_main.c @@ -1272,12 +1272,6 @@ static int snd_emu10k1_free(struct snd_emu10k1 *emu) release_firmware(emu->dock_fw); if (emu->irq >= 0) free_irq(emu->irq, emu); - /* remove reserved page */ - if (emu->reserved_page) { - snd_emu10k1_synth_free(emu, - (struct snd_util_memblk *)emu->reserved_page); - emu->reserved_page = NULL; - } snd_util_memhdr_free(emu->memhdr); if (emu->silent_page.area) snd_dma_free_pages(&emu->silent_page); @@ -1993,11 +1987,6 @@ int snd_emu10k1_create(struct snd_card *card, SPCS_GENERATIONSTATUS | 0x00001200 | 0x00000000 | SPCS_EMPHASIS_NONE | SPCS_COPYRIGHT; - emu->reserved_page = (struct snd_emu10k1_memblk *) - snd_emu10k1_synth_alloc(emu, 4096); - if (emu->reserved_page) - emu->reserved_page->map_locked = 1; - /* Clear silent pages and set up pointers */ memset(emu->silent_page.area, 0, PAGE_SIZE); silent_page = emu->silent_page.addr << emu->address_mode; diff --git a/sound/pci/emu10k1/memory.c b/sound/pci/emu10k1/memory.c index 4f1f69be1865..eaa61024ac7f 100644 --- a/sound/pci/emu10k1/memory.c +++ b/sound/pci/emu10k1/memory.c @@ -102,7 +102,7 @@ static void emu10k1_memblk_init(struct snd_emu10k1_memblk *blk) */ static int search_empty_map_area(struct snd_emu10k1 *emu, int npages, struct list_head **nextp) { - int page = 0, found_page = -ENOMEM; + int page = 1, found_page = -ENOMEM; int max_size = npages; int size; struct list_head *candidate = &emu->mapped_link_head; @@ -147,6 +147,10 @@ static int map_memblk(struct snd_emu10k1 *emu, struct snd_emu10k1_memblk *blk) page = search_empty_map_area(emu, blk->pages, &next); if (page < 0) /* not found */ return page; + if (page == 0) { + dev_err(emu->card->dev, "trying to map zero (reserved) page\n"); + return -EINVAL; + } /* insert this block in the proper position of mapped list */ list_add_tail(&blk->mapped_link, next); /* append this as a newest block in order list */ @@ -177,7 +181,7 @@ static int unmap_memblk(struct snd_emu10k1 *emu, struct snd_emu10k1_memblk *blk) q = get_emu10k1_memblk(p, mapped_link); start_page = q->mapped_page + q->pages; } else - start_page = 0; + start_page = 1; if ((p = blk->mapped_link.next) != &emu->mapped_link_head) { q = get_emu10k1_memblk(p, mapped_link); end_page = q->mapped_page;

2 1

[alsa-devel] [PATCH][RFC] ASoC: soc-utils: don't have .use_pmdown_time
by Kuninori Morimoto 14 Feb '18

14 Feb '18

From: Kuninori Morimoto <kuninori.morimoto.gx(a)renesas.com> snd_soc_runtime_ignore_pmdown_time() returns "ignore pmdown time" decision. Then, it collects each component driver's .use_pmdown_time settings by using AND operation. But, dummy codec has no reason to ignore/use pmdown time. Thus, it should has use_pmdown_time=0, it means it doesn't have decision right of "ignore pmdown time". Otherwise, dummy codec paired driver's pmdown_time settings doesn't have meaning. In other words, "ignore pmdown time" is determined irrespective of the value of paired driver's settings (= ignore will be 0 by dummy codec). Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx(a)renesas.com> --- sound/soc/soc-utils.c | 1 - 1 file changed, 1 deletion(-) diff --git a/sound/soc/soc-utils.c b/sound/soc/soc-utils.c index 2d9e98b..b70d524 100644 --- a/sound/soc/soc-utils.c +++ b/sound/soc/soc-utils.c @@ -290,7 +290,6 @@ static int dummy_dma_open(struct snd_pcm_substream *substream) static const struct snd_soc_component_driver dummy_codec = { .idle_bias_on = 1, - .use_pmdown_time = 1, .endianness = 1, .non_legacy_dai_naming = 1, }; -- 1.9.1

1 0

[alsa-devel] [PATCH v3 5/5] ALSA: emu10k1: add a IOMMU workaround
by Maciej S. Szmigiero 14 Feb '18

14 Feb '18

The Audigy 2 CA0102 chip (but most likely others from the emu10k1 family, too) has a problem that from time to time it likes to do few DMA reads a bit beyond its normal allocation and gets very confused if these reads get blocked by a IOMMU. For the first (reserved) page this happens multiple times at every playback, for various synth pages it happens randomly, rarely for PCM playback buffers and the page table memory itself. All these reads seem to follow a similar pattern, observed read offsets beyond the allocation end were 0x00, 0x40, 0x80 and 0xc0 (PCI cache line multiples), so it looks like the device tries to accesses up to 256 extra bytes. As a workaround let's widen these DMA allocations by an extra page if we detect that the device is behind a non-passthrough IOMMU (the DMA memory should be relatively plenty on IOMMU systems). Signed-off-by: Maciej S. Szmigiero <mail(a)maciej.szmigiero.name> --- Changes from v1: Apply this workaround also to PCM playback buffers since it seems they are affected, too. Changes from v2: Use a common snd_emu10k1_alloc_pages_maybe_wider() helper function, check if rounding the allocation size up to the nearest page size already covers the necessary extra memory space. include/sound/emu10k1.h | 3 +++ sound/pci/emu10k1/emu10k1_main.c | 49 ++++++++++++++++++++++++++++++++++++---- sound/pci/emu10k1/emupcm.c | 10 +++++++- sound/pci/emu10k1/memory.c | 40 +++++++++++++++++++++++++++++--- 4 files changed, 93 insertions(+), 9 deletions(-) diff --git a/include/sound/emu10k1.h b/include/sound/emu10k1.h index db32b7de52e0..5ebcc51c0a6a 100644 --- a/include/sound/emu10k1.h +++ b/include/sound/emu10k1.h @@ -1710,6 +1710,7 @@ struct snd_emu10k1 { unsigned int ecard_ctrl; /* ecard control bits */ unsigned int address_mode; /* address mode */ unsigned long dma_mask; /* PCI DMA mask */ + bool iommu_workaround; /* IOMMU workaround needed */ unsigned int delay_pcm_irq; /* in samples */ int max_cache_pages; /* max memory size / PAGE_SIZE */ struct snd_dma_buffer silent_page; /* silent page */ @@ -1877,6 +1878,8 @@ void snd_p16v_resume(struct snd_emu10k1 *emu); /* memory allocation */ struct snd_util_memblk *snd_emu10k1_alloc_pages(struct snd_emu10k1 *emu, struct snd_pcm_substream *substream); int snd_emu10k1_free_pages(struct snd_emu10k1 *emu, struct snd_util_memblk *blk); +int snd_emu10k1_alloc_pages_maybe_wider(struct snd_emu10k1 *emu, size_t size, + struct snd_dma_buffer *dmab); struct snd_util_memblk *snd_emu10k1_synth_alloc(struct snd_emu10k1 *emu, unsigned int size); int snd_emu10k1_synth_free(struct snd_emu10k1 *emu, struct snd_util_memblk *blk); int snd_emu10k1_synth_bzero(struct snd_emu10k1 *emu, struct snd_util_memblk *blk, int offset, int size); diff --git a/sound/pci/emu10k1/emu10k1_main.c b/sound/pci/emu10k1/emu10k1_main.c index 8decd2a7a404..18267de3a269 100644 --- a/sound/pci/emu10k1/emu10k1_main.c +++ b/sound/pci/emu10k1/emu10k1_main.c @@ -36,6 +36,7 @@ #include <linux/init.h> #include <linux/module.h> #include <linux/interrupt.h> +#include <linux/iommu.h> #include <linux/pci.h> #include <linux/slab.h> #include <linux/vmalloc.h> @@ -1758,6 +1759,38 @@ static struct snd_emu_chip_details emu_chip_details[] = { { } /* terminator */ }; +/* + * The chip (at least the Audigy 2 CA0102 chip, but most likely others, too) + * has a problem that from time to time it likes to do few DMA reads a bit + * beyond its normal allocation and gets very confused if these reads get + * blocked by a IOMMU. + * + * This behaviour has been observed for the first (reserved) page + * (for which it happens multiple times at every playback), often for various + * synth pages and sometimes for PCM playback buffers and the page table + * memory itself. + * + * As a workaround let's widen these DMA allocations by an extra page if we + * detect that the device is behind a non-passthrough IOMMU. + */ +static void snd_emu10k1_detect_iommu(struct snd_emu10k1 *emu) +{ + struct iommu_domain *domain; + + emu->iommu_workaround = false; + + if (!iommu_present(emu->card->dev->bus)) + return; + + domain = iommu_get_domain_for_dev(emu->card->dev); + if (domain && domain->type == IOMMU_DOMAIN_IDENTITY) + return; + + dev_notice(emu->card->dev, + "non-passthrough IOMMU detected, widening DMA allocations"); + emu->iommu_workaround = true; +} + int snd_emu10k1_create(struct snd_card *card, struct pci_dev *pci, unsigned short extin_mask, @@ -1770,6 +1803,7 @@ int snd_emu10k1_create(struct snd_card *card, struct snd_emu10k1 *emu; int idx, err; int is_audigy; + size_t page_table_size; unsigned int silent_page; const struct snd_emu_chip_details *c; static struct snd_device_ops ops = { @@ -1867,6 +1901,8 @@ int snd_emu10k1_create(struct snd_card *card, is_audigy = emu->audigy = c->emu10k2_chip; + snd_emu10k1_detect_iommu(emu); + /* set addressing mode */ emu->address_mode = is_audigy ? 0 : 1; /* set the DMA transfer mask */ @@ -1893,8 +1929,11 @@ int snd_emu10k1_create(struct snd_card *card, emu->port = pci_resource_start(pci, 0); emu->max_cache_pages = max_cache_bytes >> PAGE_SHIFT; - if (snd_dma_alloc_pages(SNDRV_DMA_TYPE_DEV, snd_dma_pci_data(pci), - (emu->address_mode ? 32 : 16) * 1024, &emu->ptb_pages) < 0) { + + page_table_size = sizeof(u32) * (emu->address_mode ? MAXPAGES1 : + MAXPAGES0); + if (snd_emu10k1_alloc_pages_maybe_wider(emu, page_table_size, + &emu->ptb_pages) < 0) { err = -ENOMEM; goto error; } @@ -1910,8 +1949,8 @@ int snd_emu10k1_create(struct snd_card *card, goto error; } - if (snd_dma_alloc_pages(SNDRV_DMA_TYPE_DEV, snd_dma_pci_data(pci), - EMUPAGESIZE, &emu->silent_page) < 0) { + if (snd_emu10k1_alloc_pages_maybe_wider(emu, EMUPAGESIZE, + &emu->silent_page) < 0) { err = -ENOMEM; goto error; } @@ -1995,7 +2034,7 @@ int snd_emu10k1_create(struct snd_card *card, 0x00000000 | SPCS_EMPHASIS_NONE | SPCS_COPYRIGHT; /* Clear silent pages and set up pointers */ - memset(emu->silent_page.area, 0, PAGE_SIZE); + memset(emu->silent_page.area, 0, emu->silent_page.bytes); silent_page = emu->silent_page.addr << emu->address_mode; for (idx = 0; idx < (emu->address_mode ? MAXPAGES1 : MAXPAGES0); idx++) ((u32 *)emu->ptb_pages.area)[idx] = cpu_to_le32(silent_page | idx); diff --git a/sound/pci/emu10k1/emupcm.c b/sound/pci/emu10k1/emupcm.c index 2683b9717215..cefe613ef7b7 100644 --- a/sound/pci/emu10k1/emupcm.c +++ b/sound/pci/emu10k1/emupcm.c @@ -411,12 +411,20 @@ static int snd_emu10k1_playback_hw_params(struct snd_pcm_substream *substream, struct snd_emu10k1 *emu = snd_pcm_substream_chip(substream); struct snd_pcm_runtime *runtime = substream->runtime; struct snd_emu10k1_pcm *epcm = runtime->private_data; + size_t alloc_size; int err; if ((err = snd_emu10k1_pcm_channel_alloc(epcm, params_channels(hw_params))) < 0) return err; - if ((err = snd_pcm_lib_malloc_pages(substream, params_buffer_bytes(hw_params))) < 0) + + alloc_size = params_buffer_bytes(hw_params); + if (emu->iommu_workaround) + alloc_size += EMUPAGESIZE; + err = snd_pcm_lib_malloc_pages(substream, alloc_size); + if (err < 0) return err; + if (emu->iommu_workaround && runtime->dma_bytes >= EMUPAGESIZE) + runtime->dma_bytes -= EMUPAGESIZE; if (err > 0) { /* change */ int mapped; if (epcm->memblk != NULL) diff --git a/sound/pci/emu10k1/memory.c b/sound/pci/emu10k1/memory.c index 1d0ce7356bbd..5865f3b90b34 100644 --- a/sound/pci/emu10k1/memory.c +++ b/sound/pci/emu10k1/memory.c @@ -377,6 +377,33 @@ int snd_emu10k1_free_pages(struct snd_emu10k1 *emu, struct snd_util_memblk *blk) return snd_emu10k1_synth_free(emu, blk); } +/* + * allocate DMA pages, widening the allocation if necessary + * + * See the comment above snd_emu10k1_detect_iommu() in emu10k1_main.c why + * this might be needed. + * + * If you modify this function check whether __synth_free_pages() also needs + * changes. + */ +int snd_emu10k1_alloc_pages_maybe_wider(struct snd_emu10k1 *emu, size_t size, + struct snd_dma_buffer *dmab) +{ + if (emu->iommu_workaround) { + size_t npages = (size + PAGE_SIZE - 1) / PAGE_SIZE; + size_t size_real = npages * PAGE_SIZE; + + /* + * The device has been observed to accesses up to 256 extra + * bytes, but use 1k to be safe. + */ + if (size_real < size + 1024) + size += PAGE_SIZE; + } + + return snd_dma_alloc_pages(SNDRV_DMA_TYPE_DEV, + snd_dma_pci_data(emu->pci), size, dmab); +} /* * memory allocation using multiple pages (for synth) @@ -472,7 +499,15 @@ static void __synth_free_pages(struct snd_emu10k1 *emu, int first_page, continue; dmab.area = emu->page_ptr_table[page]; dmab.addr = emu->page_addr_table[page]; + + /* + * please keep me in sync with logic in + * snd_emu10k1_alloc_pages_maybe_wider() + */ dmab.bytes = PAGE_SIZE; + if (emu->iommu_workaround) + dmab.bytes *= 2; + snd_dma_free_pages(&dmab); emu->page_addr_table[page] = 0; emu->page_ptr_table[page] = NULL; @@ -491,9 +526,8 @@ static int synth_alloc_pages(struct snd_emu10k1 *emu, struct snd_emu10k1_memblk get_single_page_range(emu->memhdr, blk, &first_page, &last_page); /* allocate kernel pages */ for (page = first_page; page <= last_page; page++) { - if (snd_dma_alloc_pages(SNDRV_DMA_TYPE_DEV, - snd_dma_pci_data(emu->pci), - PAGE_SIZE, &dmab) < 0) + if (snd_emu10k1_alloc_pages_maybe_wider(emu, PAGE_SIZE, + &dmab) < 0) goto __fail; if (!is_valid_page(emu, dmab.addr)) { snd_dma_free_pages(&dmab);

1 0

[alsa-devel] [PATCH v3 4/5] ALSA: emu10k1: make sure synth DMA pages are allocated with DMA functions
by Maciej S. Szmigiero 14 Feb '18

14 Feb '18

Commit a5003fc04113 ("[ALSA] emu10k1 - simplify page allocation for synth") switched from using the DMA allocator for synth DMA pages to manually calling alloc_page(). However, this usage has an implicit assumption that the DMA address space for the emu10k1-family chip is the same as the CPU physical address space which is not true for a system with a IOMMU. Since this made the synth part of the driver non-functional on such systems let's effectively revert that commit (while keeping the __synth_free_pages() simplification). Signed-off-by: Maciej S. Szmigiero <mail(a)maciej.szmigiero.name> --- Changes from v1: None in this patch. Changes from v2: Keep the __synth_free_pages() simplification. sound/pci/emu10k1/memory.c | 44 +++++++++++++++++++++++++++----------------- 1 file changed, 27 insertions(+), 17 deletions(-) diff --git a/sound/pci/emu10k1/memory.c b/sound/pci/emu10k1/memory.c index fcb04cbbc9ab..1d0ce7356bbd 100644 --- a/sound/pci/emu10k1/memory.c +++ b/sound/pci/emu10k1/memory.c @@ -461,10 +461,19 @@ static void get_single_page_range(struct snd_util_memhdr *hdr, static void __synth_free_pages(struct snd_emu10k1 *emu, int first_page, int last_page) { + struct snd_dma_buffer dmab; int page; + dmab.dev.type = SNDRV_DMA_TYPE_DEV; + dmab.dev.dev = snd_dma_pci_data(emu->pci); + for (page = first_page; page <= last_page; page++) { - free_page((unsigned long)emu->page_ptr_table[page]); + if (emu->page_ptr_table[page] == NULL) + continue; + dmab.area = emu->page_ptr_table[page]; + dmab.addr = emu->page_addr_table[page]; + dmab.bytes = PAGE_SIZE; + snd_dma_free_pages(&dmab); emu->page_addr_table[page] = 0; emu->page_ptr_table[page] = NULL; } @@ -476,30 +485,31 @@ static void __synth_free_pages(struct snd_emu10k1 *emu, int first_page, static int synth_alloc_pages(struct snd_emu10k1 *emu, struct snd_emu10k1_memblk *blk) { int page, first_page, last_page; + struct snd_dma_buffer dmab; emu10k1_memblk_init(blk); get_single_page_range(emu->memhdr, blk, &first_page, &last_page); /* allocate kernel pages */ for (page = first_page; page <= last_page; page++) { - /* first try to allocate from <4GB zone */ - struct page *p = alloc_page(GFP_KERNEL | GFP_DMA32 | - __GFP_NOWARN); - if (!p || (page_to_pfn(p) & ~(emu->dma_mask >> PAGE_SHIFT))) { - if (p) - __free_page(p); - /* try to allocate from <16MB zone */ - p = alloc_page(GFP_ATOMIC | GFP_DMA | - __GFP_NORETRY | /* no OOM-killer */ - __GFP_NOWARN); - } - if (!p) { - __synth_free_pages(emu, first_page, page - 1); - return -ENOMEM; + if (snd_dma_alloc_pages(SNDRV_DMA_TYPE_DEV, + snd_dma_pci_data(emu->pci), + PAGE_SIZE, &dmab) < 0) + goto __fail; + if (!is_valid_page(emu, dmab.addr)) { + snd_dma_free_pages(&dmab); + goto __fail; } - emu->page_addr_table[page] = page_to_phys(p); - emu->page_ptr_table[page] = page_address(p); + emu->page_addr_table[page] = dmab.addr; + emu->page_ptr_table[page] = dmab.area; } return 0; + +__fail: + /* release allocated pages */ + last_page = page - 1; + __synth_free_pages(emu, first_page, last_page); + + return -ENOMEM; } /*

1 0

[alsa-devel] [PATCH v3 3/5] ALSA: emu10k1: add optional debug printouts with DMA addresses
by Maciej S. Szmigiero 14 Feb '18

14 Feb '18

When we get a IOMMU page fault for a emu10k1 device it is very hard to discover which of chip many DMA allocations triggered it (since on a IOMMU system the DMA address space is often very different from the CPU one). Let's add optional debug printouts providing this information. These debug printouts are only enabled on an explicit request via the kernel dynamic debug mechanism. Signed-off-by: Maciej S. Szmigiero <mail(a)maciej.szmigiero.name> --- Changes from v1: Fix a sparse warning by changing a variable type in __{get,set}_ptb_entry from u32 to __le32, don't open code EMUPAGESIZE. Changes from v2: None in this patch. sound/pci/emu10k1/emu10k1_main.c | 8 ++++++++ sound/pci/emu10k1/memory.c | 15 +++++++++++---- 2 files changed, 19 insertions(+), 4 deletions(-) diff --git a/sound/pci/emu10k1/emu10k1_main.c b/sound/pci/emu10k1/emu10k1_main.c index 11e868f569d6..8decd2a7a404 100644 --- a/sound/pci/emu10k1/emu10k1_main.c +++ b/sound/pci/emu10k1/emu10k1_main.c @@ -1898,6 +1898,9 @@ int snd_emu10k1_create(struct snd_card *card, err = -ENOMEM; goto error; } + dev_dbg(card->dev, "page table address range is %.8lx:%.8lx\n", + (unsigned long)emu->ptb_pages.addr, + (unsigned long)(emu->ptb_pages.addr + emu->ptb_pages.bytes)); emu->page_ptr_table = vmalloc(emu->max_cache_pages * sizeof(void *)); emu->page_addr_table = vmalloc(emu->max_cache_pages * @@ -1912,6 +1915,11 @@ int snd_emu10k1_create(struct snd_card *card, err = -ENOMEM; goto error; } + dev_dbg(card->dev, "silent page range is %.8lx:%.8lx\n", + (unsigned long)emu->silent_page.addr, + (unsigned long)(emu->silent_page.addr + + emu->silent_page.bytes)); + emu->memhdr = snd_util_memhdr_new(emu->max_cache_pages * PAGE_SIZE); if (emu->memhdr == NULL) { err = -ENOMEM; diff --git a/sound/pci/emu10k1/memory.c b/sound/pci/emu10k1/memory.c index eaa61024ac7f..fcb04cbbc9ab 100644 --- a/sound/pci/emu10k1/memory.c +++ b/sound/pci/emu10k1/memory.c @@ -34,7 +34,10 @@ * aligned pages in others */ #define __set_ptb_entry(emu,page,addr) \ - (((u32 *)(emu)->ptb_pages.area)[page] = cpu_to_le32(((addr) << (emu->address_mode)) | (page))) + (((__le32 *)(emu)->ptb_pages.area)[page] = \ + cpu_to_le32(((addr) << (emu->address_mode)) | (page))) +#define __get_ptb_entry(emu, page) \ + (le32_to_cpu(((__le32 *)(emu)->ptb_pages.area)[page])) #define UNIT_PAGES (PAGE_SIZE / EMUPAGESIZE) #define MAX_ALIGN_PAGES0 (MAXPAGES0 / UNIT_PAGES) @@ -44,8 +47,7 @@ /* get offset address from aligned page */ #define aligned_page_offset(page) ((page) << PAGE_SHIFT) -#if PAGE_SIZE == 4096 -/* page size == EMUPAGESIZE */ +#if PAGE_SIZE == EMUPAGESIZE && !IS_ENABLED(CONFIG_DYNAMIC_DEBUG) /* fill PTB entrie(s) corresponding to page with addr */ #define set_ptb_entry(emu,page,addr) __set_ptb_entry(emu,page,addr) /* fill PTB entrie(s) corresponding to page with silence pointer */ @@ -58,6 +60,8 @@ static inline void set_ptb_entry(struct snd_emu10k1 *emu, int page, dma_addr_t a page *= UNIT_PAGES; for (i = 0; i < UNIT_PAGES; i++, page++) { __set_ptb_entry(emu, page, addr); + dev_dbg(emu->card->dev, "mapped page %d to entry %.8x\n", page, + (unsigned int)__get_ptb_entry(emu, page)); addr += EMUPAGESIZE; } } @@ -65,9 +69,12 @@ static inline void set_silent_ptb(struct snd_emu10k1 *emu, int page) { int i; page *= UNIT_PAGES; - for (i = 0; i < UNIT_PAGES; i++, page++) + for (i = 0; i < UNIT_PAGES; i++, page++) { /* do not increment ptr */ __set_ptb_entry(emu, page, emu->silent_page.addr); + dev_dbg(emu->card->dev, "mapped silent page %d to entry %.8x\n", + page, (unsigned int)__get_ptb_entry(emu, page)); + } } #endif /* PAGE_SIZE */

1 0

[alsa-devel] [PATCH v3 2/5] ALSA: emu10k1: use dma_set_mask_and_coherent()
by Maciej S. Szmigiero 14 Feb '18

14 Feb '18

We have been calling dma_set_mask() and then dma_set_coherent_mask() with the same value, but there is a dma_set_mask_and_coherent() function that does exactly that so let's use it instead. Signed-off-by: Maciej S. Szmigiero <mail(a)maciej.szmigiero.name> --- Changes from v1, v2: None in this patch. sound/pci/emu10k1/emu10k1_main.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/sound/pci/emu10k1/emu10k1_main.c b/sound/pci/emu10k1/emu10k1_main.c index a0a4d31ded53..11e868f569d6 100644 --- a/sound/pci/emu10k1/emu10k1_main.c +++ b/sound/pci/emu10k1/emu10k1_main.c @@ -1871,8 +1871,7 @@ int snd_emu10k1_create(struct snd_card *card, emu->address_mode = is_audigy ? 0 : 1; /* set the DMA transfer mask */ emu->dma_mask = emu->address_mode ? EMU10K1_DMA_MASK : AUDIGY_DMA_MASK; - if (dma_set_mask(&pci->dev, emu->dma_mask) < 0 || - dma_set_coherent_mask(&pci->dev, emu->dma_mask) < 0) { + if (dma_set_mask_and_coherent(&pci->dev, emu->dma_mask) < 0) { dev_err(card->dev, "architecture does not support PCI busmaster DMA with mask 0x%lx\n", emu->dma_mask);

1 0

[alsa-devel] [PATCH v2 5/5] ALSA: emu10k1: add a IOMMU workaround
by Maciej S. Szmigiero 14 Feb '18

14 Feb '18

The Audigy 2 CA0102 chip (but most likely others from the emu10k1 family, too) has a problem that from time to time it likes to do few DMA reads a bit beyond its normal allocation and gets very confused if these reads get blocked by a IOMMU. For the first (reserved) page this happens multiple times at every playback, for various synth pages it happens randomly, rarely for PCM playback buffers and the page table memory itself. All these reads seem to follow a similar pattern, observed read offsets beyond the allocation end were 0x00, 0x40, 0x80 and 0xc0 (PCI cache line multiples), so it looks like the device tries to accesses up to 256 extra bytes. As a workaround let's widen these DMA allocations by an extra page if we detect that the device is behind a non-passthrough IOMMU (the DMA memory should be relatively plenty on IOMMU systems). Signed-off-by: Maciej S. Szmigiero <mail(a)maciej.szmigiero.name> --- Changes from v1: Apply this workaround also to PCM playback buffers since it seems they are affected, too. include/sound/emu10k1.h | 1 + sound/pci/emu10k1/emu10k1_main.c | 50 +++++++++++++++++++++++++++++++++++++--- sound/pci/emu10k1/emupcm.c | 9 +++++++- sound/pci/emu10k1/memory.c | 16 ++++++++++--- 4 files changed, 69 insertions(+), 7 deletions(-) diff --git a/include/sound/emu10k1.h b/include/sound/emu10k1.h index db32b7de52e0..ba27abf65408 100644 --- a/include/sound/emu10k1.h +++ b/include/sound/emu10k1.h @@ -1710,6 +1710,7 @@ struct snd_emu10k1 { unsigned int ecard_ctrl; /* ecard control bits */ unsigned int address_mode; /* address mode */ unsigned long dma_mask; /* PCI DMA mask */ + bool iommu_workaround; /* IOMMU workaround needed */ unsigned int delay_pcm_irq; /* in samples */ int max_cache_pages; /* max memory size / PAGE_SIZE */ struct snd_dma_buffer silent_page; /* silent page */ diff --git a/sound/pci/emu10k1/emu10k1_main.c b/sound/pci/emu10k1/emu10k1_main.c index 8decd2a7a404..3638bff26d23 100644 --- a/sound/pci/emu10k1/emu10k1_main.c +++ b/sound/pci/emu10k1/emu10k1_main.c @@ -36,6 +36,7 @@ #include <linux/init.h> #include <linux/module.h> #include <linux/interrupt.h> +#include <linux/iommu.h> #include <linux/pci.h> #include <linux/slab.h> #include <linux/vmalloc.h> @@ -1758,6 +1759,38 @@ static struct snd_emu_chip_details emu_chip_details[] = { { } /* terminator */ }; +/* + * The chip (at least the Audigy 2 CA0102 chip, but most likely others, too) + * has a problem that from time to time it likes to do few DMA reads a bit + * beyond its normal allocation and gets very confused if these reads get + * blocked by a IOMMU. + * + * This behaviour has been observed for the first (reserved) page + * (for which it happens multiple times at every playback), often for various + * synth pages and sometimes for PCM playback buffers and the page table + * memory itself. + * + * As a workaround let's widen these DMA allocations by an extra page if we + * detect that the device is behind a non-passthrough IOMMU. + */ +static void snd_emu10k1_detect_iommu(struct snd_emu10k1 *emu) +{ + struct iommu_domain *domain; + + emu->iommu_workaround = false; + + if (!iommu_present(emu->card->dev->bus)) + return; + + domain = iommu_get_domain_for_dev(emu->card->dev); + if (domain && domain->type == IOMMU_DOMAIN_IDENTITY) + return; + + dev_notice(emu->card->dev, + "non-passthrough IOMMU detected, widening DMA allocations"); + emu->iommu_workaround = true; +} + int snd_emu10k1_create(struct snd_card *card, struct pci_dev *pci, unsigned short extin_mask, @@ -1770,6 +1803,7 @@ int snd_emu10k1_create(struct snd_card *card, struct snd_emu10k1 *emu; int idx, err; int is_audigy; + size_t page_table_size, silent_page_size; unsigned int silent_page; const struct snd_emu_chip_details *c; static struct snd_device_ops ops = { @@ -1867,6 +1901,8 @@ int snd_emu10k1_create(struct snd_card *card, is_audigy = emu->audigy = c->emu10k2_chip; + snd_emu10k1_detect_iommu(emu); + /* set addressing mode */ emu->address_mode = is_audigy ? 0 : 1; /* set the DMA transfer mask */ @@ -1893,8 +1929,13 @@ int snd_emu10k1_create(struct snd_card *card, emu->port = pci_resource_start(pci, 0); emu->max_cache_pages = max_cache_bytes >> PAGE_SHIFT; + + page_table_size = sizeof(u32) * (emu->address_mode ? MAXPAGES1 : + MAXPAGES0); + if (emu->iommu_workaround) + page_table_size += PAGE_SIZE; if (snd_dma_alloc_pages(SNDRV_DMA_TYPE_DEV, snd_dma_pci_data(pci), - (emu->address_mode ? 32 : 16) * 1024, &emu->ptb_pages) < 0) { + page_table_size, &emu->ptb_pages) < 0) { err = -ENOMEM; goto error; } @@ -1910,8 +1951,11 @@ int snd_emu10k1_create(struct snd_card *card, goto error; } + silent_page_size = EMUPAGESIZE; + if (emu->iommu_workaround) + silent_page_size *= 2; if (snd_dma_alloc_pages(SNDRV_DMA_TYPE_DEV, snd_dma_pci_data(pci), - EMUPAGESIZE, &emu->silent_page) < 0) { + silent_page_size, &emu->silent_page) < 0) { err = -ENOMEM; goto error; } @@ -1995,7 +2039,7 @@ int snd_emu10k1_create(struct snd_card *card, 0x00000000 | SPCS_EMPHASIS_NONE | SPCS_COPYRIGHT; /* Clear silent pages and set up pointers */ - memset(emu->silent_page.area, 0, PAGE_SIZE); + memset(emu->silent_page.area, 0, silent_page_size); silent_page = emu->silent_page.addr << emu->address_mode; for (idx = 0; idx < (emu->address_mode ? MAXPAGES1 : MAXPAGES0); idx++) ((u32 *)emu->ptb_pages.area)[idx] = cpu_to_le32(silent_page | idx); diff --git a/sound/pci/emu10k1/emupcm.c b/sound/pci/emu10k1/emupcm.c index 2683b9717215..80b3279692b8 100644 --- a/sound/pci/emu10k1/emupcm.c +++ b/sound/pci/emu10k1/emupcm.c @@ -411,12 +411,19 @@ static int snd_emu10k1_playback_hw_params(struct snd_pcm_substream *substream, struct snd_emu10k1 *emu = snd_pcm_substream_chip(substream); struct snd_pcm_runtime *runtime = substream->runtime; struct snd_emu10k1_pcm *epcm = runtime->private_data; + size_t alloc_size; int err; if ((err = snd_emu10k1_pcm_channel_alloc(epcm, params_channels(hw_params))) < 0) return err; - if ((err = snd_pcm_lib_malloc_pages(substream, params_buffer_bytes(hw_params))) < 0) + + alloc_size = params_buffer_bytes(hw_params); + if (emu->iommu_workaround) + alloc_size += EMUPAGESIZE; + if ((err = snd_pcm_lib_malloc_pages(substream, alloc_size)) < 0) return err; + if (emu->iommu_workaround && runtime->dma_bytes >= EMUPAGESIZE) + runtime->dma_bytes -= EMUPAGESIZE; if (err > 0) { /* change */ int mapped; if (epcm->memblk != NULL) diff --git a/sound/pci/emu10k1/memory.c b/sound/pci/emu10k1/memory.c index 5cdffe2d31e1..6a5371d10dcf 100644 --- a/sound/pci/emu10k1/memory.c +++ b/sound/pci/emu10k1/memory.c @@ -457,6 +457,16 @@ static void get_single_page_range(struct snd_util_memhdr *hdr, *last_page_ret = last_page; } +static size_t synth_get_alloc_size(struct snd_emu10k1 *emu) +{ + size_t alloc_size = PAGE_SIZE; + + if (emu->iommu_workaround) + alloc_size *= 2; + + return alloc_size; +} + /* * allocate kernel pages */ @@ -471,7 +481,7 @@ static int synth_alloc_pages(struct snd_emu10k1 *emu, struct snd_emu10k1_memblk for (page = first_page; page <= last_page; page++) { if (snd_dma_alloc_pages(SNDRV_DMA_TYPE_DEV, snd_dma_pci_data(emu->pci), - PAGE_SIZE, &dmab) < 0) + synth_get_alloc_size(emu), &dmab) < 0) goto __fail; if (!is_valid_page(emu, dmab.addr)) { snd_dma_free_pages(&dmab); @@ -488,7 +498,7 @@ static int synth_alloc_pages(struct snd_emu10k1 *emu, struct snd_emu10k1_memblk for (page = first_page; page <= last_page; page++) { dmab.area = emu->page_ptr_table[page]; dmab.addr = emu->page_addr_table[page]; - dmab.bytes = PAGE_SIZE; + dmab.bytes = synth_get_alloc_size(emu); snd_dma_free_pages(&dmab); emu->page_addr_table[page] = 0; emu->page_ptr_table[page] = NULL; @@ -513,7 +523,7 @@ static int synth_free_pages(struct snd_emu10k1 *emu, struct snd_emu10k1_memblk * continue; dmab.area = emu->page_ptr_table[page]; dmab.addr = emu->page_addr_table[page]; - dmab.bytes = PAGE_SIZE; + dmab.bytes = synth_get_alloc_size(emu); snd_dma_free_pages(&dmab); emu->page_addr_table[page] = 0; emu->page_ptr_table[page] = NULL;

2 4

[alsa-devel] [PATCH v2 1/2] ASoC: wm9712: Use empty struct initializer
by Fabio Estevam 13 Feb '18

13 Feb '18

From: Fabio Estevam <fabio.estevam(a)nxp.com> { 0 } only clears the first member of the structure. The first member of the snd_soc_dapm_update struct is a pointer, and writing 0 to a pointer results in the following sparse warning: sound/soc/codecs/wm9712.c:229:47: warning: Using plain integer as NULL pointer Use the empty struct initializer that clears all the struct members and fixes the sparse warning. Signed-off-by: Fabio Estevam <fabio.estevam(a)nxp.com> --- Changes since v1: - Fix typos in commit log sound/soc/codecs/wm9712.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sound/soc/codecs/wm9712.c b/sound/soc/codecs/wm9712.c index 7aeeeec..953d94d 100644 --- a/sound/soc/codecs/wm9712.c +++ b/sound/soc/codecs/wm9712.c @@ -226,7 +226,7 @@ static int wm9712_hp_mixer_put(struct snd_kcontrol *kcontrol, struct soc_mixer_control *mc = (struct soc_mixer_control *)kcontrol->private_value; unsigned int mixer, mask, shift, old; - struct snd_soc_dapm_update update = { 0 }; + struct snd_soc_dapm_update update = {}; bool change; mixer = mc->shift >> 8; -- 2.7.4

1 1

[alsa-devel] [PATCH v2 0/2] Add support for AK4458 DAC
by Cosmin-Gabriel Samoila 13 Feb '18

13 Feb '18

We support Normal Mode, TDM Mode and PM. Changes since V1: - support only i2c - i2c probe / remove/suspend/ resume moved into shared code - change enum array to separate variables - aggregate Volume control for Left and Right Channel - remove mux from DAPM - remove unused functions - remove unused controls - remove unused macros - use snd_soc_update_bits instead of soc_read + soc_write - use GPIOD - use SPDX identifier - use dac@10 instgitead of ak4458@10 - use explicit power_on/off functions - add __maybe_unused attribute - use probe_new for i2c_probe Cosmin-Gabriel Samoila (2): ASoC: codecs: Add support for AK4458 DAC driver ASoC: ak4458: Add bindings for AK4458 DAC Documentation/devicetree/bindings/sound/ak4458.txt | 23 + sound/soc/codecs/Kconfig | 6 + sound/soc/codecs/Makefile | 2 + sound/soc/codecs/ak4458.c | 684 +++++++++++++++++++++ sound/soc/codecs/ak4458.h | 75 +++ 5 files changed, 790 insertions(+) create mode 100644 Documentation/devicetree/bindings/sound/ak4458.txt create mode 100644 sound/soc/codecs/ak4458.c create mode 100644 sound/soc/codecs/ak4458.h -- 2.7.4

2 3