dmg: prevent chunk buffer overflow (CVE-2014-0145)
[qemu/cris-port.git] / hw / audio / hda-codec.c
bloba67ca91ca76073146e67ca27147cba63cbcfbb11
1 /*
2 * Copyright (C) 2010 Red Hat, Inc.
4 * written by Gerd Hoffmann <kraxel@redhat.com>
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License as
8 * published by the Free Software Foundation; either version 2 or
9 * (at your option) version 3 of the License.
11 * This program is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 * GNU General Public License for more details.
16 * You should have received a copy of the GNU General Public License
17 * along with this program; if not, see <http://www.gnu.org/licenses/>.
20 #include "hw/hw.h"
21 #include "hw/pci/pci.h"
22 #include "intel-hda.h"
23 #include "intel-hda-defs.h"
24 #include "audio/audio.h"
26 /* -------------------------------------------------------------------------- */
28 typedef struct desc_param {
29 uint32_t id;
30 uint32_t val;
31 } desc_param;
33 typedef struct desc_node {
34 uint32_t nid;
35 const char *name;
36 const desc_param *params;
37 uint32_t nparams;
38 uint32_t config;
39 uint32_t pinctl;
40 uint32_t *conn;
41 uint32_t stindex;
42 } desc_node;
44 typedef struct desc_codec {
45 const char *name;
46 uint32_t iid;
47 const desc_node *nodes;
48 uint32_t nnodes;
49 } desc_codec;
51 static const desc_param* hda_codec_find_param(const desc_node *node, uint32_t id)
53 int i;
55 for (i = 0; i < node->nparams; i++) {
56 if (node->params[i].id == id) {
57 return &node->params[i];
60 return NULL;
63 static const desc_node* hda_codec_find_node(const desc_codec *codec, uint32_t nid)
65 int i;
67 for (i = 0; i < codec->nnodes; i++) {
68 if (codec->nodes[i].nid == nid) {
69 return &codec->nodes[i];
72 return NULL;
75 static void hda_codec_parse_fmt(uint32_t format, struct audsettings *as)
77 if (format & AC_FMT_TYPE_NON_PCM) {
78 return;
81 as->freq = (format & AC_FMT_BASE_44K) ? 44100 : 48000;
83 switch ((format & AC_FMT_MULT_MASK) >> AC_FMT_MULT_SHIFT) {
84 case 1: as->freq *= 2; break;
85 case 2: as->freq *= 3; break;
86 case 3: as->freq *= 4; break;
89 switch ((format & AC_FMT_DIV_MASK) >> AC_FMT_DIV_SHIFT) {
90 case 1: as->freq /= 2; break;
91 case 2: as->freq /= 3; break;
92 case 3: as->freq /= 4; break;
93 case 4: as->freq /= 5; break;
94 case 5: as->freq /= 6; break;
95 case 6: as->freq /= 7; break;
96 case 7: as->freq /= 8; break;
99 switch (format & AC_FMT_BITS_MASK) {
100 case AC_FMT_BITS_8: as->fmt = AUD_FMT_S8; break;
101 case AC_FMT_BITS_16: as->fmt = AUD_FMT_S16; break;
102 case AC_FMT_BITS_32: as->fmt = AUD_FMT_S32; break;
105 as->nchannels = ((format & AC_FMT_CHAN_MASK) >> AC_FMT_CHAN_SHIFT) + 1;
108 /* -------------------------------------------------------------------------- */
110 * HDA codec descriptions
113 /* some defines */
115 #define QEMU_HDA_ID_VENDOR 0x1af4
116 #define QEMU_HDA_PCM_FORMATS (AC_SUPPCM_BITS_16 | \
117 0x1fc /* 16 -> 96 kHz */)
118 #define QEMU_HDA_AMP_NONE (0)
119 #define QEMU_HDA_AMP_STEPS 0x4a
121 #define PARAM mixemu
122 #define HDA_MIXER
123 #include "hda-codec-common.h"
125 #define PARAM nomixemu
126 #include "hda-codec-common.h"
128 /* -------------------------------------------------------------------------- */
130 static const char *fmt2name[] = {
131 [ AUD_FMT_U8 ] = "PCM-U8",
132 [ AUD_FMT_S8 ] = "PCM-S8",
133 [ AUD_FMT_U16 ] = "PCM-U16",
134 [ AUD_FMT_S16 ] = "PCM-S16",
135 [ AUD_FMT_U32 ] = "PCM-U32",
136 [ AUD_FMT_S32 ] = "PCM-S32",
139 typedef struct HDAAudioState HDAAudioState;
140 typedef struct HDAAudioStream HDAAudioStream;
142 struct HDAAudioStream {
143 HDAAudioState *state;
144 const desc_node *node;
145 bool output, running;
146 uint32_t stream;
147 uint32_t channel;
148 uint32_t format;
149 uint32_t gain_left, gain_right;
150 bool mute_left, mute_right;
151 struct audsettings as;
152 union {
153 SWVoiceIn *in;
154 SWVoiceOut *out;
155 } voice;
156 uint8_t buf[HDA_BUFFER_SIZE];
157 uint32_t bpos;
160 #define TYPE_HDA_AUDIO "hda-audio"
161 #define HDA_AUDIO(obj) OBJECT_CHECK(HDAAudioState, (obj), TYPE_HDA_AUDIO)
163 struct HDAAudioState {
164 HDACodecDevice hda;
165 const char *name;
167 QEMUSoundCard card;
168 const desc_codec *desc;
169 HDAAudioStream st[4];
170 bool running_compat[16];
171 bool running_real[2 * 16];
173 /* properties */
174 uint32_t debug;
175 bool mixer;
178 static void hda_audio_input_cb(void *opaque, int avail)
180 HDAAudioStream *st = opaque;
181 int recv = 0;
182 int len;
183 bool rc;
185 while (avail - recv >= sizeof(st->buf)) {
186 if (st->bpos != sizeof(st->buf)) {
187 len = AUD_read(st->voice.in, st->buf + st->bpos,
188 sizeof(st->buf) - st->bpos);
189 st->bpos += len;
190 recv += len;
191 if (st->bpos != sizeof(st->buf)) {
192 break;
195 rc = hda_codec_xfer(&st->state->hda, st->stream, false,
196 st->buf, sizeof(st->buf));
197 if (!rc) {
198 break;
200 st->bpos = 0;
204 static void hda_audio_output_cb(void *opaque, int avail)
206 HDAAudioStream *st = opaque;
207 int sent = 0;
208 int len;
209 bool rc;
211 while (avail - sent >= sizeof(st->buf)) {
212 if (st->bpos == sizeof(st->buf)) {
213 rc = hda_codec_xfer(&st->state->hda, st->stream, true,
214 st->buf, sizeof(st->buf));
215 if (!rc) {
216 break;
218 st->bpos = 0;
220 len = AUD_write(st->voice.out, st->buf + st->bpos,
221 sizeof(st->buf) - st->bpos);
222 st->bpos += len;
223 sent += len;
224 if (st->bpos != sizeof(st->buf)) {
225 break;
230 static void hda_audio_set_running(HDAAudioStream *st, bool running)
232 if (st->node == NULL) {
233 return;
235 if (st->running == running) {
236 return;
238 st->running = running;
239 dprint(st->state, 1, "%s: %s (stream %d)\n", st->node->name,
240 st->running ? "on" : "off", st->stream);
241 if (st->output) {
242 AUD_set_active_out(st->voice.out, st->running);
243 } else {
244 AUD_set_active_in(st->voice.in, st->running);
248 static void hda_audio_set_amp(HDAAudioStream *st)
250 bool muted;
251 uint32_t left, right;
253 if (st->node == NULL) {
254 return;
257 muted = st->mute_left && st->mute_right;
258 left = st->mute_left ? 0 : st->gain_left;
259 right = st->mute_right ? 0 : st->gain_right;
261 left = left * 255 / QEMU_HDA_AMP_STEPS;
262 right = right * 255 / QEMU_HDA_AMP_STEPS;
264 if (st->output) {
265 AUD_set_volume_out(st->voice.out, muted, left, right);
266 } else {
267 AUD_set_volume_in(st->voice.in, muted, left, right);
271 static void hda_audio_setup(HDAAudioStream *st)
273 if (st->node == NULL) {
274 return;
277 dprint(st->state, 1, "%s: format: %d x %s @ %d Hz\n",
278 st->node->name, st->as.nchannels,
279 fmt2name[st->as.fmt], st->as.freq);
281 if (st->output) {
282 st->voice.out = AUD_open_out(&st->state->card, st->voice.out,
283 st->node->name, st,
284 hda_audio_output_cb, &st->as);
285 } else {
286 st->voice.in = AUD_open_in(&st->state->card, st->voice.in,
287 st->node->name, st,
288 hda_audio_input_cb, &st->as);
292 static void hda_audio_command(HDACodecDevice *hda, uint32_t nid, uint32_t data)
294 HDAAudioState *a = HDA_AUDIO(hda);
295 HDAAudioStream *st;
296 const desc_node *node = NULL;
297 const desc_param *param;
298 uint32_t verb, payload, response, count, shift;
300 if ((data & 0x70000) == 0x70000) {
301 /* 12/8 id/payload */
302 verb = (data >> 8) & 0xfff;
303 payload = data & 0x00ff;
304 } else {
305 /* 4/16 id/payload */
306 verb = (data >> 8) & 0xf00;
307 payload = data & 0xffff;
310 node = hda_codec_find_node(a->desc, nid);
311 if (node == NULL) {
312 goto fail;
314 dprint(a, 2, "%s: nid %d (%s), verb 0x%x, payload 0x%x\n",
315 __FUNCTION__, nid, node->name, verb, payload);
317 switch (verb) {
318 /* all nodes */
319 case AC_VERB_PARAMETERS:
320 param = hda_codec_find_param(node, payload);
321 if (param == NULL) {
322 goto fail;
324 hda_codec_response(hda, true, param->val);
325 break;
326 case AC_VERB_GET_SUBSYSTEM_ID:
327 hda_codec_response(hda, true, a->desc->iid);
328 break;
330 /* all functions */
331 case AC_VERB_GET_CONNECT_LIST:
332 param = hda_codec_find_param(node, AC_PAR_CONNLIST_LEN);
333 count = param ? param->val : 0;
334 response = 0;
335 shift = 0;
336 while (payload < count && shift < 32) {
337 response |= node->conn[payload] << shift;
338 payload++;
339 shift += 8;
341 hda_codec_response(hda, true, response);
342 break;
344 /* pin widget */
345 case AC_VERB_GET_CONFIG_DEFAULT:
346 hda_codec_response(hda, true, node->config);
347 break;
348 case AC_VERB_GET_PIN_WIDGET_CONTROL:
349 hda_codec_response(hda, true, node->pinctl);
350 break;
351 case AC_VERB_SET_PIN_WIDGET_CONTROL:
352 if (node->pinctl != payload) {
353 dprint(a, 1, "unhandled pin control bit\n");
355 hda_codec_response(hda, true, 0);
356 break;
358 /* audio in/out widget */
359 case AC_VERB_SET_CHANNEL_STREAMID:
360 st = a->st + node->stindex;
361 if (st->node == NULL) {
362 goto fail;
364 hda_audio_set_running(st, false);
365 st->stream = (payload >> 4) & 0x0f;
366 st->channel = payload & 0x0f;
367 dprint(a, 2, "%s: stream %d, channel %d\n",
368 st->node->name, st->stream, st->channel);
369 hda_audio_set_running(st, a->running_real[st->output * 16 + st->stream]);
370 hda_codec_response(hda, true, 0);
371 break;
372 case AC_VERB_GET_CONV:
373 st = a->st + node->stindex;
374 if (st->node == NULL) {
375 goto fail;
377 response = st->stream << 4 | st->channel;
378 hda_codec_response(hda, true, response);
379 break;
380 case AC_VERB_SET_STREAM_FORMAT:
381 st = a->st + node->stindex;
382 if (st->node == NULL) {
383 goto fail;
385 st->format = payload;
386 hda_codec_parse_fmt(st->format, &st->as);
387 hda_audio_setup(st);
388 hda_codec_response(hda, true, 0);
389 break;
390 case AC_VERB_GET_STREAM_FORMAT:
391 st = a->st + node->stindex;
392 if (st->node == NULL) {
393 goto fail;
395 hda_codec_response(hda, true, st->format);
396 break;
397 case AC_VERB_GET_AMP_GAIN_MUTE:
398 st = a->st + node->stindex;
399 if (st->node == NULL) {
400 goto fail;
402 if (payload & AC_AMP_GET_LEFT) {
403 response = st->gain_left | (st->mute_left ? AC_AMP_MUTE : 0);
404 } else {
405 response = st->gain_right | (st->mute_right ? AC_AMP_MUTE : 0);
407 hda_codec_response(hda, true, response);
408 break;
409 case AC_VERB_SET_AMP_GAIN_MUTE:
410 st = a->st + node->stindex;
411 if (st->node == NULL) {
412 goto fail;
414 dprint(a, 1, "amp (%s): %s%s%s%s index %d gain %3d %s\n",
415 st->node->name,
416 (payload & AC_AMP_SET_OUTPUT) ? "o" : "-",
417 (payload & AC_AMP_SET_INPUT) ? "i" : "-",
418 (payload & AC_AMP_SET_LEFT) ? "l" : "-",
419 (payload & AC_AMP_SET_RIGHT) ? "r" : "-",
420 (payload & AC_AMP_SET_INDEX) >> AC_AMP_SET_INDEX_SHIFT,
421 (payload & AC_AMP_GAIN),
422 (payload & AC_AMP_MUTE) ? "muted" : "");
423 if (payload & AC_AMP_SET_LEFT) {
424 st->gain_left = payload & AC_AMP_GAIN;
425 st->mute_left = payload & AC_AMP_MUTE;
427 if (payload & AC_AMP_SET_RIGHT) {
428 st->gain_right = payload & AC_AMP_GAIN;
429 st->mute_right = payload & AC_AMP_MUTE;
431 hda_audio_set_amp(st);
432 hda_codec_response(hda, true, 0);
433 break;
435 /* not supported */
436 case AC_VERB_SET_POWER_STATE:
437 case AC_VERB_GET_POWER_STATE:
438 case AC_VERB_GET_SDI_SELECT:
439 hda_codec_response(hda, true, 0);
440 break;
441 default:
442 goto fail;
444 return;
446 fail:
447 dprint(a, 1, "%s: not handled: nid %d (%s), verb 0x%x, payload 0x%x\n",
448 __FUNCTION__, nid, node ? node->name : "?", verb, payload);
449 hda_codec_response(hda, true, 0);
452 static void hda_audio_stream(HDACodecDevice *hda, uint32_t stnr, bool running, bool output)
454 HDAAudioState *a = HDA_AUDIO(hda);
455 int s;
457 a->running_compat[stnr] = running;
458 a->running_real[output * 16 + stnr] = running;
459 for (s = 0; s < ARRAY_SIZE(a->st); s++) {
460 if (a->st[s].node == NULL) {
461 continue;
463 if (a->st[s].output != output) {
464 continue;
466 if (a->st[s].stream != stnr) {
467 continue;
469 hda_audio_set_running(&a->st[s], running);
473 static int hda_audio_init(HDACodecDevice *hda, const struct desc_codec *desc)
475 HDAAudioState *a = HDA_AUDIO(hda);
476 HDAAudioStream *st;
477 const desc_node *node;
478 const desc_param *param;
479 uint32_t i, type;
481 a->desc = desc;
482 a->name = object_get_typename(OBJECT(a));
483 dprint(a, 1, "%s: cad %d\n", __FUNCTION__, a->hda.cad);
485 AUD_register_card("hda", &a->card);
486 for (i = 0; i < a->desc->nnodes; i++) {
487 node = a->desc->nodes + i;
488 param = hda_codec_find_param(node, AC_PAR_AUDIO_WIDGET_CAP);
489 if (NULL == param)
490 continue;
491 type = (param->val & AC_WCAP_TYPE) >> AC_WCAP_TYPE_SHIFT;
492 switch (type) {
493 case AC_WID_AUD_OUT:
494 case AC_WID_AUD_IN:
495 assert(node->stindex < ARRAY_SIZE(a->st));
496 st = a->st + node->stindex;
497 st->state = a;
498 st->node = node;
499 if (type == AC_WID_AUD_OUT) {
500 /* unmute output by default */
501 st->gain_left = QEMU_HDA_AMP_STEPS;
502 st->gain_right = QEMU_HDA_AMP_STEPS;
503 st->bpos = sizeof(st->buf);
504 st->output = true;
505 } else {
506 st->output = false;
508 st->format = AC_FMT_TYPE_PCM | AC_FMT_BITS_16 |
509 (1 << AC_FMT_CHAN_SHIFT);
510 hda_codec_parse_fmt(st->format, &st->as);
511 hda_audio_setup(st);
512 break;
515 return 0;
518 static int hda_audio_exit(HDACodecDevice *hda)
520 HDAAudioState *a = HDA_AUDIO(hda);
521 HDAAudioStream *st;
522 int i;
524 dprint(a, 1, "%s\n", __FUNCTION__);
525 for (i = 0; i < ARRAY_SIZE(a->st); i++) {
526 st = a->st + i;
527 if (st->node == NULL) {
528 continue;
530 if (st->output) {
531 AUD_close_out(&a->card, st->voice.out);
532 } else {
533 AUD_close_in(&a->card, st->voice.in);
536 AUD_remove_card(&a->card);
537 return 0;
540 static int hda_audio_post_load(void *opaque, int version)
542 HDAAudioState *a = opaque;
543 HDAAudioStream *st;
544 int i;
546 dprint(a, 1, "%s\n", __FUNCTION__);
547 if (version == 1) {
548 /* assume running_compat[] is for output streams */
549 for (i = 0; i < ARRAY_SIZE(a->running_compat); i++)
550 a->running_real[16 + i] = a->running_compat[i];
553 for (i = 0; i < ARRAY_SIZE(a->st); i++) {
554 st = a->st + i;
555 if (st->node == NULL)
556 continue;
557 hda_codec_parse_fmt(st->format, &st->as);
558 hda_audio_setup(st);
559 hda_audio_set_amp(st);
560 hda_audio_set_running(st, a->running_real[st->output * 16 + st->stream]);
562 return 0;
565 static void hda_audio_reset(DeviceState *dev)
567 HDAAudioState *a = HDA_AUDIO(dev);
568 HDAAudioStream *st;
569 int i;
571 dprint(a, 1, "%s\n", __func__);
572 for (i = 0; i < ARRAY_SIZE(a->st); i++) {
573 st = a->st + i;
574 if (st->node != NULL) {
575 hda_audio_set_running(st, false);
580 static const VMStateDescription vmstate_hda_audio_stream = {
581 .name = "hda-audio-stream",
582 .version_id = 1,
583 .fields = (VMStateField []) {
584 VMSTATE_UINT32(stream, HDAAudioStream),
585 VMSTATE_UINT32(channel, HDAAudioStream),
586 VMSTATE_UINT32(format, HDAAudioStream),
587 VMSTATE_UINT32(gain_left, HDAAudioStream),
588 VMSTATE_UINT32(gain_right, HDAAudioStream),
589 VMSTATE_BOOL(mute_left, HDAAudioStream),
590 VMSTATE_BOOL(mute_right, HDAAudioStream),
591 VMSTATE_UINT32(bpos, HDAAudioStream),
592 VMSTATE_BUFFER(buf, HDAAudioStream),
593 VMSTATE_END_OF_LIST()
597 static const VMStateDescription vmstate_hda_audio = {
598 .name = "hda-audio",
599 .version_id = 2,
600 .post_load = hda_audio_post_load,
601 .fields = (VMStateField []) {
602 VMSTATE_STRUCT_ARRAY(st, HDAAudioState, 4, 0,
603 vmstate_hda_audio_stream,
604 HDAAudioStream),
605 VMSTATE_BOOL_ARRAY(running_compat, HDAAudioState, 16),
606 VMSTATE_BOOL_ARRAY_V(running_real, HDAAudioState, 2 * 16, 2),
607 VMSTATE_END_OF_LIST()
611 static Property hda_audio_properties[] = {
612 DEFINE_PROP_UINT32("debug", HDAAudioState, debug, 0),
613 DEFINE_PROP_BOOL("mixer", HDAAudioState, mixer, true),
614 DEFINE_PROP_END_OF_LIST(),
617 static int hda_audio_init_output(HDACodecDevice *hda)
619 HDAAudioState *a = HDA_AUDIO(hda);
621 if (!a->mixer) {
622 return hda_audio_init(hda, &output_nomixemu);
623 } else {
624 return hda_audio_init(hda, &output_mixemu);
628 static int hda_audio_init_duplex(HDACodecDevice *hda)
630 HDAAudioState *a = HDA_AUDIO(hda);
632 if (!a->mixer) {
633 return hda_audio_init(hda, &duplex_nomixemu);
634 } else {
635 return hda_audio_init(hda, &duplex_mixemu);
639 static int hda_audio_init_micro(HDACodecDevice *hda)
641 HDAAudioState *a = HDA_AUDIO(hda);
643 if (!a->mixer) {
644 return hda_audio_init(hda, &micro_nomixemu);
645 } else {
646 return hda_audio_init(hda, &micro_mixemu);
650 static void hda_audio_base_class_init(ObjectClass *klass, void *data)
652 DeviceClass *dc = DEVICE_CLASS(klass);
653 HDACodecDeviceClass *k = HDA_CODEC_DEVICE_CLASS(klass);
655 k->exit = hda_audio_exit;
656 k->command = hda_audio_command;
657 k->stream = hda_audio_stream;
658 set_bit(DEVICE_CATEGORY_SOUND, dc->categories);
659 dc->reset = hda_audio_reset;
660 dc->vmsd = &vmstate_hda_audio;
661 dc->props = hda_audio_properties;
664 static const TypeInfo hda_audio_info = {
665 .name = TYPE_HDA_AUDIO,
666 .parent = TYPE_HDA_CODEC_DEVICE,
667 .class_init = hda_audio_base_class_init,
668 .abstract = true,
671 static void hda_audio_output_class_init(ObjectClass *klass, void *data)
673 DeviceClass *dc = DEVICE_CLASS(klass);
674 HDACodecDeviceClass *k = HDA_CODEC_DEVICE_CLASS(klass);
676 k->init = hda_audio_init_output;
677 dc->desc = "HDA Audio Codec, output-only (line-out)";
680 static const TypeInfo hda_audio_output_info = {
681 .name = "hda-output",
682 .parent = TYPE_HDA_AUDIO,
683 .instance_size = sizeof(HDAAudioState),
684 .class_init = hda_audio_output_class_init,
687 static void hda_audio_duplex_class_init(ObjectClass *klass, void *data)
689 DeviceClass *dc = DEVICE_CLASS(klass);
690 HDACodecDeviceClass *k = HDA_CODEC_DEVICE_CLASS(klass);
692 k->init = hda_audio_init_duplex;
693 dc->desc = "HDA Audio Codec, duplex (line-out, line-in)";
696 static const TypeInfo hda_audio_duplex_info = {
697 .name = "hda-duplex",
698 .parent = TYPE_HDA_AUDIO,
699 .instance_size = sizeof(HDAAudioState),
700 .class_init = hda_audio_duplex_class_init,
703 static void hda_audio_micro_class_init(ObjectClass *klass, void *data)
705 DeviceClass *dc = DEVICE_CLASS(klass);
706 HDACodecDeviceClass *k = HDA_CODEC_DEVICE_CLASS(klass);
708 k->init = hda_audio_init_micro;
709 dc->desc = "HDA Audio Codec, duplex (speaker, microphone)";
712 static const TypeInfo hda_audio_micro_info = {
713 .name = "hda-micro",
714 .parent = TYPE_HDA_AUDIO,
715 .instance_size = sizeof(HDAAudioState),
716 .class_init = hda_audio_micro_class_init,
719 static void hda_audio_register_types(void)
721 type_register_static(&hda_audio_info);
722 type_register_static(&hda_audio_output_info);
723 type_register_static(&hda_audio_duplex_info);
724 type_register_static(&hda_audio_micro_info);
727 type_init(hda_audio_register_types)