/* * amdtp-tascam.c - a part of driver for TASCAM FireWire series * * Copyright (c) 2015 Takashi Sakamoto * * Licensed under the terms of the GNU General Public License, version 2. */ #include #include "tascam.h" #define AMDTP_FMT_TSCM_TX 0x1e #define AMDTP_FMT_TSCM_RX 0x3e struct amdtp_tscm { unsigned int pcm_channels; void (*transfer_samples)(struct amdtp_stream *s, struct snd_pcm_substream *pcm, __be32 *buffer, unsigned int frames); }; int amdtp_tscm_set_parameters(struct amdtp_stream *s, unsigned int rate) { struct amdtp_tscm *p = s->protocol; unsigned int data_channels; if (amdtp_stream_running(s)) return -EBUSY; data_channels = p->pcm_channels; /* Packets in in-stream have extra 2 data channels. */ if (s->direction == AMDTP_IN_STREAM) data_channels += 2; return amdtp_stream_set_parameters(s, rate, data_channels); } static void write_pcm_s32(struct amdtp_stream *s, struct snd_pcm_substream *pcm, __be32 *buffer, unsigned int frames) { struct amdtp_tscm *p = s->protocol; struct snd_pcm_runtime *runtime = pcm->runtime; unsigned int channels, remaining_frames, i, c; const u32 *src; channels = p->pcm_channels; src = (void *)runtime->dma_area + frames_to_bytes(runtime, s->pcm_buffer_pointer); remaining_frames = runtime->buffer_size - s->pcm_buffer_pointer; for (i = 0; i < frames; ++i) { for (c = 0; c < channels; ++c) { buffer[c] = cpu_to_be32(*src); src++; } buffer += s->data_block_quadlets; if (--remaining_frames == 0) src = (void *)runtime->dma_area; } } static void write_pcm_s16(struct amdtp_stream *s, struct snd_pcm_substream *pcm, __be32 *buffer, unsigned int frames) { struct amdtp_tscm *p = s->protocol; struct snd_pcm_runtime *runtime = pcm->runtime; unsigned int channels, remaining_frames, i, c; const u16 *src; channels = p->pcm_channels; src = (void *)runtime->dma_area + frames_to_bytes(runtime, s->pcm_buffer_pointer); remaining_frames = runtime->buffer_size - s->pcm_buffer_pointer; for (i = 0; i < frames; ++i) { for (c = 0; c < channels; ++c) { buffer[c] = cpu_to_be32(*src << 16); src++; } buffer += s->data_block_quadlets; if (--remaining_frames == 0) src = (void *)runtime->dma_area; } } static void read_pcm_s32(struct amdtp_stream *s, struct snd_pcm_substream *pcm, __be32 *buffer, unsigned int frames) { struct amdtp_tscm *p = s->protocol; struct snd_pcm_runtime *runtime = pcm->runtime; unsigned int channels, remaining_frames, i, c; u32 *dst; channels = p->pcm_channels; dst = (void *)runtime->dma_area + frames_to_bytes(runtime, s->pcm_buffer_pointer); remaining_frames = runtime->buffer_size - s->pcm_buffer_pointer; /* The first data channel is for event counter. */ buffer += 1; for (i = 0; i < frames; ++i) { for (c = 0; c < channels; ++c) { *dst = be32_to_cpu(buffer[c]); dst++; } buffer += s->data_block_quadlets; if (--remaining_frames == 0) dst = (void *)runtime->dma_area; } } static void write_pcm_silence(struct amdtp_stream *s, __be32 *buffer, unsigned int data_blocks) { struct amdtp_tscm *p = s->protocol; unsigned int channels, i, c; channels = p->pcm_channels; for (i = 0; i < data_blocks; ++i) { for (c = 0; c < channels; ++c) buffer[c] = 0x00000000; buffer += s->data_block_quadlets; } } int amdtp_tscm_add_pcm_hw_constraints(struct amdtp_stream *s, struct snd_pcm_runtime *runtime) { int err; /* * Our implementation allows this protocol to deliver 24 bit sample in * 32bit data channel. */ err = snd_pcm_hw_constraint_msbits(runtime, 0, 32, 24); if (err < 0) return err; return amdtp_stream_add_pcm_hw_constraints(s, runtime); } void amdtp_tscm_set_pcm_format(struct amdtp_stream *s, snd_pcm_format_t format) { struct amdtp_tscm *p = s->protocol; if (WARN_ON(amdtp_stream_pcm_running(s))) return; switch (format) { default: WARN_ON(1); /* fall through */ case SNDRV_PCM_FORMAT_S16: if (s->direction == AMDTP_OUT_STREAM) { p->transfer_samples = write_pcm_s16; break; } WARN_ON(1); /* fall through */ case SNDRV_PCM_FORMAT_S32: if (s->direction == AMDTP_OUT_STREAM) p->transfer_samples = write_pcm_s32; else p->transfer_samples = read_pcm_s32; break; } } static unsigned int process_tx_data_blocks(struct amdtp_stream *s, __be32 *buffer, unsigned int data_blocks, unsigned int *syt) { struct amdtp_tscm *p = (struct amdtp_tscm *)s->protocol; struct snd_pcm_substream *pcm; pcm = ACCESS_ONCE(s->pcm); if (data_blocks > 0 && pcm) p->transfer_samples(s, pcm, buffer, data_blocks); /* A place holder for control messages. */ return data_blocks; } static unsigned int process_rx_data_blocks(struct amdtp_stream *s, __be32 *buffer, unsigned int data_blocks, unsigned int *syt) { struct amdtp_tscm *p = (struct amdtp_tscm *)s->protocol; struct snd_pcm_substream *pcm; /* This field is not used. */ *syt = 0x0000; pcm = ACCESS_ONCE(s->pcm); if (pcm) p->transfer_samples(s, pcm, buffer, data_blocks); else write_pcm_silence(s, buffer, data_blocks); return data_blocks; } int amdtp_tscm_init(struct amdtp_stream *s, struct fw_unit *unit, enum amdtp_stream_direction dir, unsigned int pcm_channels) { amdtp_stream_process_data_blocks_t process_data_blocks; struct amdtp_tscm *p; unsigned int fmt; int err; if (dir == AMDTP_IN_STREAM) { fmt = AMDTP_FMT_TSCM_TX; process_data_blocks = process_tx_data_blocks; } else { fmt = AMDTP_FMT_TSCM_RX; process_data_blocks = process_rx_data_blocks; } err = amdtp_stream_init(s, unit, dir, CIP_NONBLOCKING | CIP_SKIP_DBC_ZERO_CHECK, fmt, process_data_blocks, sizeof(struct amdtp_tscm)); if (err < 0) return 0; /* Use fixed value for FDF field. */ s->fdf = 0x00; /* This protocol uses fixed number of data channels for PCM samples. */ p = s->protocol; p->pcm_channels = pcm_channels; return 0; } cgi/linux/net-next.git/diff/sound/firewire/tascam/tascam-midi.c?id=39cb2c9a316e77f6dfba96c543e55b6672d5a37e&id2=2c5d9555d6d937966d79d4c6529a5f7b9206e405'>diff)
drm/i915: Check for NULL i915_vma in intel_unpin_fb_obj()
I've seen this trigger twice now, where the i915_gem_object_to_ggtt() call in intel_unpin_fb_obj() returns NULL, resulting in an oops immediately afterwards as the (inlined) call to i915_vma_unpin_fence() tries to dereference it. It seems to be some race condition where the object is going away at shutdown time, since both times happened when shutting down the X server. The call chains were different: - VT ioctl(KDSETMODE, KD_TEXT): intel_cleanup_plane_fb+0x5b/0xa0 [i915] drm_atomic_helper_cleanup_planes+0x6f/0x90 [drm_kms_helper] intel_atomic_commit_tail+0x749/0xfe0 [i915] intel_atomic_commit+0x3cb/0x4f0 [i915] drm_atomic_commit+0x4b/0x50 [drm] restore_fbdev_mode+0x14c/0x2a0 [drm_kms_helper] drm_fb_helper_restore_fbdev_mode_unlocked+0x34/0x80 [drm_kms_helper] drm_fb_helper_set_par+0x2d/0x60 [drm_kms_helper] intel_fbdev_set_par+0x18/0x70 [i915] fb_set_var+0x236/0x460 fbcon_blank+0x30f/0x350 do_unblank_screen+0xd2/0x1a0 vt_ioctl+0x507/0x12a0 tty_ioctl+0x355/0xc30 do_vfs_ioctl+0xa3/0x5e0 SyS_ioctl+0x79/0x90 entry_SYSCALL_64_fastpath+0x13/0x94 - i915 unpin_work workqueue: intel_unpin_work_fn+0x58/0x140 [i915] process_one_work+0x1f1/0x480 worker_thread+0x48/0x4d0 kthread+0x101/0x140 and this patch purely papers over the issue by adding a NULL pointer check and a WARN_ON_ONCE() to avoid the oops that would then generally make the machine unresponsive. Other callers of i915_gem_object_to_ggtt() seem to also check for the returned pointer being NULL and warn about it, so this clearly has happened before in other places. [ Reported it originally to the i915 developers on Jan 8, applying the ugly workaround on my own now after triggering the problem for the second time with no feedback. This is likely to be the same bug reported as https://bugs.freedesktop.org/show_bug.cgi?id=98829 https://bugs.freedesktop.org/show_bug.cgi?id=99134 which has a patch for the underlying problem, but it hasn't gotten to me, so I'm applying the workaround. ] Cc: Daniel Vetter <daniel.vetter@intel.com> Cc: Jani Nikula <jani.nikula@linux.intel.com> Cc: Ville Syrjälä <ville.syrjala@linux.intel.com> Cc: Chris Wilson <chris@chris-wilson.co.uk> Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com> Cc: Imre Deak <imre.deak@intel.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'sound/firewire/tascam/tascam-midi.c')