Bug 154259 - [sound][snd_emu10kx][patch] Fix data type overflow (signed/unsigned mismatch) in args of bus_dma_tag_create
Summary: [sound][snd_emu10kx][patch] Fix data type overflow (signed/unsigned mismatch)...
Status: Closed FIXED
Alias: None
Product: Base System
Classification: Unclassified
Component: kern (show other bugs)
Version: 9.0-CURRENT
Hardware: Any Any
: Normal Affects Only Me
Assignee: freebsd-multimedia (Nobody)
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2011-01-24 12:40 UTC by Vladyslav Movchan
Modified: 2011-02-12 14:29 UTC (History)
0 users

See Also:


Attachments
file.diff (1.14 KB, patch)
2011-01-24 12:40 UTC, Vladyslav Movchan
no flags Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Vladyslav Movchan 2011-01-24 12:40:10 UTC
If you use snd_emu10k1 or snd_emu10kx drivers on amd64 system there is a chance that you hear high frequency noise / buzz instead of sound. It is much higher probability to reproduce this problem if you use any of drivers mentioned above as separate kernel modules loaded at the end of boot process, then if you compile this devices into kernel.

This problem was mentioned several times in mail lists (but without solution):
http://lists.freebsd.org/pipermail/freebsd-multimedia/2010-April/010928.html
http://lists.freebsd.org/pipermail/freebsd-stable/2010-July/057687.html

This problem caused by data type overflow (signed/unsigned mismatch) in one of arguments of bus_dma_tag_create() during data type conversion:
lowaddr argument set as "1 << 31" and because of "1" is signed (by default) "1 << 31" (10000000000000000000000000000000 in binary) become 18446744071562067968 (1111111111111111111111111111111110000000000000000000000000000000 in binary) when it is converted to bus_addr_t data type (what is typedef-ed to uint64_t).

As result address range (for DMA) will not be limited to 0-2Gb (only range that hardware is possible to address), and when driver will be forced to use addresses higher than 2Gb you hear noise instead of sound. 

If you are using snd_emu10kx and selected "Boot FreeBSD with verbose logging" in loader prompt, then you are able to see wrong mappings in logs:

Jan 23 22:37:28 ground kernel: emu10kx: setmap (43390000, 1000), nseg=1, error=0
Jan 23 22:37:28 ground kernel: emu10kx: setmap (119cf0000, 1000), nseg=1, error=0
Jan 23 22:37:28 ground kernel: emu10kx: setmap (12f3d0000, 1000), nseg=1, error=0
Jan 23 22:37:28 ground kernel: emu10kx: setmap (be830000, 1000), nseg=1, error=0

Second, third and fourth lines shows mappings above 2Gb, what should not happened.


PS: I suppose it is necessary to have more than 2 Gb of ram installed on amd64 machine to be able to reproduce this problem (I have 6Gb on test system).

Also I was not able to reproduce original problem on i386 with 4Gb of ram installed. Looks like it is related to amd64 only.

This problem is related to snd_emu10k1 and snd_emu10kx drivers. Problem was reproduced by me and fix was tested for both drivers.

Fix: Attached patch fixed this problem for me (both drivers tested)

Patch attached with submission follows:
How-To-Repeat: Use snd_emu10k1 or snd_emu10kx as module, load it at the end of boot process. If you are still able play music correctly - do 

kldunload  /boot/kernel/snd_emu10kx.ko;
kldload /boot/kernel/snd_emu10kx.ko;
mpg123 test.mp3;

several iterations of kldunload / kldload usually enough to hear high frequency noise instead of music.
Comment 1 Mark Linimon freebsd_committer freebsd_triage 2011-01-26 11:08:37 UTC
Responsible Changed
From-To: freebsd-bugs->freebsd-multimedia

Over to maintainer(s).
Comment 2 dfilter service freebsd_committer freebsd_triage 2011-02-09 11:29:09 UTC
Author: marius
Date: Wed Feb  9 11:28:57 2011
New Revision: 218478
URL: http://svn.freebsd.org/changeset/base/218478

Log:
  Correct signedness and off-by-one issues in parameters used for DMA tag
  creation.
  
  PR:		154259
  Submitted by:	Vladislav Movchan (partially)
  MFC after:	3 days

Modified:
  head/sys/dev/sound/pci/emu10k1.c
  head/sys/dev/sound/pci/emu10kx.c

Modified: head/sys/dev/sound/pci/emu10k1.c
==============================================================================
--- head/sys/dev/sound/pci/emu10k1.c	Wed Feb  9 10:06:31 2011	(r218477)
+++ head/sys/dev/sound/pci/emu10k1.c	Wed Feb  9 11:28:57 2011	(r218478)
@@ -2017,7 +2017,7 @@ emu_pci_attach(device_t dev)
 
 	if (bus_dma_tag_create(/*parent*/bus_get_dma_tag(dev), /*alignment*/2,
 		/*boundary*/0,
-		/*lowaddr*/1 << 31, /* can only access 0-2gb */
+		/*lowaddr*/(1U << 31) - 1, /* can only access 0-2gb */
 		/*highaddr*/BUS_SPACE_MAXADDR,
 		/*filter*/NULL, /*filterarg*/NULL,
 		/*maxsize*/sc->bufsz, /*nsegments*/1, /*maxsegz*/0x3ffff,

Modified: head/sys/dev/sound/pci/emu10kx.c
==============================================================================
--- head/sys/dev/sound/pci/emu10kx.c	Wed Feb  9 10:06:31 2011	(r218477)
+++ head/sys/dev/sound/pci/emu10kx.c	Wed Feb  9 11:28:57 2011	(r218478)
@@ -2700,7 +2700,7 @@ emu_init(struct emu_sc_info *sc)
 
 	if (bus_dma_tag_create( /* parent */ bus_get_dma_tag(sc->dev),
 	     /* alignment */ 2, /* boundary */ 0,
-	     /* lowaddr */ 1 << 31,	/* can only access 0-2gb */
+	     /* lowaddr */ (1U << 31) - 1,	/* can only access 0-2gb */
 	     /* highaddr */ BUS_SPACE_MAXADDR,
 	     /* filter */ NULL, /* filterarg */ NULL,
 	     /* maxsize */ EMU_MAX_BUFSZ, /* nsegments */ 1, /* maxsegz */ 0x3ffff,
_______________________________________________
svn-src-all@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscribe@freebsd.org"
Comment 3 dfilter service freebsd_committer freebsd_triage 2011-02-12 13:41:12 UTC
Author: marius
Date: Sat Feb 12 13:41:00 2011
New Revision: 218606
URL: http://svn.freebsd.org/changeset/base/218606

Log:
  MFC: r218478
  
  Correct signedness and off-by-one issues in parameters used for DMA tag
  creation.
  
  PR:		154259
  Submitted by:	Vladislav Movchan (partially)

Modified:
  stable/8/sys/dev/sound/pci/emu10k1.c
  stable/8/sys/dev/sound/pci/emu10kx.c
Directory Properties:
  stable/8/sys/   (props changed)
  stable/8/sys/amd64/include/xen/   (props changed)
  stable/8/sys/cddl/contrib/opensolaris/   (props changed)
  stable/8/sys/contrib/dev/acpica/   (props changed)
  stable/8/sys/contrib/pf/   (props changed)

Modified: stable/8/sys/dev/sound/pci/emu10k1.c
==============================================================================
--- stable/8/sys/dev/sound/pci/emu10k1.c	Sat Feb 12 13:28:50 2011	(r218605)
+++ stable/8/sys/dev/sound/pci/emu10k1.c	Sat Feb 12 13:41:00 2011	(r218606)
@@ -2017,7 +2017,7 @@ emu_pci_attach(device_t dev)
 
 	if (bus_dma_tag_create(/*parent*/bus_get_dma_tag(dev), /*alignment*/2,
 		/*boundary*/0,
-		/*lowaddr*/1 << 31, /* can only access 0-2gb */
+		/*lowaddr*/(1U << 31) - 1, /* can only access 0-2gb */
 		/*highaddr*/BUS_SPACE_MAXADDR,
 		/*filter*/NULL, /*filterarg*/NULL,
 		/*maxsize*/sc->bufsz, /*nsegments*/1, /*maxsegz*/0x3ffff,

Modified: stable/8/sys/dev/sound/pci/emu10kx.c
==============================================================================
--- stable/8/sys/dev/sound/pci/emu10kx.c	Sat Feb 12 13:28:50 2011	(r218605)
+++ stable/8/sys/dev/sound/pci/emu10kx.c	Sat Feb 12 13:41:00 2011	(r218606)
@@ -2700,7 +2700,7 @@ emu_init(struct emu_sc_info *sc)
 
 	if (bus_dma_tag_create( /* parent */ bus_get_dma_tag(sc->dev),
 	     /* alignment */ 2, /* boundary */ 0,
-	     /* lowaddr */ 1 << 31,	/* can only access 0-2gb */
+	     /* lowaddr */ (1U << 31) - 1,	/* can only access 0-2gb */
 	     /* highaddr */ BUS_SPACE_MAXADDR,
 	     /* filter */ NULL, /* filterarg */ NULL,
 	     /* maxsize */ EMU_MAX_BUFSZ, /* nsegments */ 1, /* maxsegz */ 0x3ffff,
_______________________________________________
svn-src-all@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscribe@freebsd.org"
Comment 4 dfilter service freebsd_committer freebsd_triage 2011-02-12 13:41:12 UTC
Author: marius
Date: Sat Feb 12 13:41:02 2011
New Revision: 218607
URL: http://svn.freebsd.org/changeset/base/218607

Log:
  MFC: r218478
  
  Correct signedness and off-by-one issues in parameters used for DMA tag
  creation.
  
  PR:		154259
  Submitted by:	Vladislav Movchan (partially)

Modified:
  stable/7/sys/dev/sound/pci/emu10k1.c
  stable/7/sys/dev/sound/pci/emu10kx.c
Directory Properties:
  stable/7/sys/   (props changed)
  stable/7/sys/cddl/contrib/opensolaris/   (props changed)
  stable/7/sys/contrib/dev/acpica/   (props changed)
  stable/7/sys/contrib/pf/   (props changed)

Modified: stable/7/sys/dev/sound/pci/emu10k1.c
==============================================================================
--- stable/7/sys/dev/sound/pci/emu10k1.c	Sat Feb 12 13:41:00 2011	(r218606)
+++ stable/7/sys/dev/sound/pci/emu10k1.c	Sat Feb 12 13:41:02 2011	(r218607)
@@ -2012,7 +2012,7 @@ emu_pci_attach(device_t dev)
 
 	if (bus_dma_tag_create(/*parent*/bus_get_dma_tag(dev), /*alignment*/2,
 		/*boundary*/0,
-		/*lowaddr*/1 << 31, /* can only access 0-2gb */
+		/*lowaddr*/(1U << 31) - 1, /* can only access 0-2gb */
 		/*highaddr*/BUS_SPACE_MAXADDR,
 		/*filter*/NULL, /*filterarg*/NULL,
 		/*maxsize*/sc->bufsz, /*nsegments*/1, /*maxsegz*/0x3ffff,

Modified: stable/7/sys/dev/sound/pci/emu10kx.c
==============================================================================
--- stable/7/sys/dev/sound/pci/emu10kx.c	Sat Feb 12 13:41:00 2011	(r218606)
+++ stable/7/sys/dev/sound/pci/emu10kx.c	Sat Feb 12 13:41:02 2011	(r218607)
@@ -2696,7 +2696,7 @@ emu_init(struct emu_sc_info *sc)
 
 	if (bus_dma_tag_create( /* parent */ bus_get_dma_tag(sc->dev),
 	     /* alignment */ 2, /* boundary */ 0,
-	     /* lowaddr */ 1 << 31,	/* can only access 0-2gb */
+	     /* lowaddr */ (1U << 31) - 1,	/* can only access 0-2gb */
 	     /* highaddr */ BUS_SPACE_MAXADDR,
 	     /* filter */ NULL, /* filterarg */ NULL,
 	     /* maxsize */ EMU_MAX_BUFSZ, /* nsegments */ 1, /* maxsegz */ 0x3ffff,
_______________________________________________
svn-src-all@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscribe@freebsd.org"
Comment 5 Marius Strobl freebsd_committer freebsd_triage 2011-02-12 14:28:57 UTC
State Changed
From-To: open->closed

Close; this PR was fully handled.