audio: /dev/dsp, AudioEngine, and an AC'97 under it

A program that wants to make a sound opens /dev/dsp, writes PCM, and closes
it. That is what UNIX audio has always been and it now exists here:

    tone 440 2

Three pieces, in the order a sample passes through them. **/dev/dsp** is a
character device where write() is audio and a handful of OSS ioctls say what
the samples are. **AudioEngine** is everything above a driver that is not
specific to a chip -- the format, whether there is room, and what a write does
when there is not. **A driver** is bound by class, exactly as a display driver
is: device_find_class(DEVCLASS_AUDIO).

OSS numbering rather than something new, because every UNIX audio program ever
written already knows it and the only thing a different set would achieve is
making ports harder. They are read/write ioctls, which is the part that
matters: a program asks for 44100, the device sets 48000 and writes 48000
back, the program resamples. One that ignores the answer plays 9% fast, and
that is its bug rather than the driver's.

**The engine is deliberately one stream.** Mixing several programs is a real
feature with a real design behind it, and building it before anything had
played a single sound would be exactly what docs/plan/1.0.md keeps a register
for: work that exists and is connected to nothing. The second program that
wants to play at the same time is what should cause it to be written.

**audio_wait() sleeps on the timer tick, not on the device.** That looks like
the lazy choice and is not: a ring that drains is a ring with room, so asking
again in ten milliseconds always makes progress, whereas sleeping on the card
makes audio depend on an interrupt arriving. On a machine whose line is
misrouted that is not a stutter, it is a writer that never wakes. The handler
still accounts for finished buffers -- deleting it would cost efficiency, not
correctness -- and it retires descriptors through the same `tail` pointer
queue() uses, so the two cannot disagree about what is in flight.

**AC'97 first because HDA is two unproven things at once.** It is the simplest
audio device that exists on real machines and in QEMU both. Intel HDA is what
the laptop actually has and is a much larger driver; writing it against an
interface nothing had ever played through would have meant debugging the
driver and the interface simultaneously. HDA arrives as a second
struct audio_ops and nothing above it changes -- which is the entire point of
the class.

Two things the wiring needed: PCI class 0x04 now maps to DEVCLASS_AUDIO (the
driver bound and /proc/devices showed it, but audio_get() found nothing,
because the class byte had never been translated), and include/x86.h grew
inw() -- AC'97's mixer is all 16-bit registers and reading one a byte at a
time returns the low half twice on some codecs.

**Tested by measuring what came out, not by not crashing.** QEMU's wav backend
writes the guest's audio to a file; `tone 440 2` produced 1.97 seconds of
44.1 kHz stereo with peak amplitude 14177 against the generator's table
maximum of 14178, and 880 zero crossings per second -- 440 Hz exactly. wav is
on every QEMU target rather than a host backend, because a build machine may
have no sound card and it is the only backend whose output can be checked.

Both supported configurations: one boot each, no traps, no panics, socktest
and memfdtest green.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
Nexoniarz 2026-09-24 14:23:13 +02:00
commit 9fea18b18b
18 changed files with 1110 additions and 5 deletions

413
kernel/drivers/audio/ac97.c Normal file
View file

@ -0,0 +1,413 @@
// AC'97, the audio class's first driver.
//
// Written from the Intel 82801 datasheet's audio chapter. It is the simplest
// PC audio device that exists on real machines and in QEMU both, which is why
// it is first: the point of this driver is to prove the class and /dev/dsp
// with the least chip-specific code possible. Intel HDA -- which is what a
// laptop built this century actually has -- is a much larger driver, and
// writing it against an interface nothing had ever played a sound through
// would be writing two unproven things at once.
//
// Two register files, both **I/O ports** rather than MMIO:
//
// NAM BAR0, the mixer. Volume, and the codec's own capabilities.
// NABM BAR1, bus mastering. The descriptor list, and the DMA engine that
// walks it.
//
// The DMA engine reads a *buffer descriptor list*: 32 entries, each naming a
// physical address and a length in samples. It plays entry CIV, and stops when
// it reaches LVI -- the "last valid index". Playing continuously is therefore
// not a matter of starting it and walking away; it is a matter of keeping LVI
// ahead of CIV, which is what queue() does.
#include "types.h"
#include "defs.h"
#include "param.h"
#include "x86.h"
#include "spinlock.h"
#include "sleeplock.h"
#include "fs.h"
#include "file.h"
#include "memlayout.h"
#include "mmu.h"
#include "pci.h"
#include "device.h"
#include "audio.h"
#include "dma.h"
#include "irq.h"
// --- NAM, the mixer ---------------------------------------------------------
#define NAM_RESET 0x00
#define NAM_MASTER_VOL 0x02
#define NAM_PCM_OUT_VOL 0x18
#define NAM_EXT_ID 0x28
#define NAM_EXT_CTRL 0x2A
#define NAM_PCM_FRONT_RATE 0x2C
#define EXT_VRA 0x0001 // variable rate: the codec can do 44100
// --- NABM, the bus master ---------------------------------------------------
//
// The PCM *out* box starts at 0x10. There are three boxes (in, out, mic) and
// they have the same shape, which is why the offsets below are written as a
// base plus a field rather than as constants.
#define PO_BASE 0x10
#define PO_BDBAR (PO_BASE + 0x00) // uint32: physical address of the list
#define PO_CIV (PO_BASE + 0x04) // uint8: entry being played now
#define PO_LVI (PO_BASE + 0x05) // uint8: last entry the engine may play
#define PO_SR (PO_BASE + 0x06) // uint16: status
#define PO_PICB (PO_BASE + 0x08) // uint16: samples left in this entry
#define PO_CR (PO_BASE + 0x0B) // uint8: control
#define CR_RPBM 0x01 // run
#define CR_RR 0x02 // reset the box
#define CR_IOCE 0x10 // interrupt on completion
#define SR_DCH 0x01 // DMA halted
#define SR_BCIS 0x08 // buffer completion interrupt
#define SR_LVBCI 0x04 // last valid buffer played
#define GLOB_CTRL 0x2C
#define GLOB_STA 0x30
// --- the ring ---------------------------------------------------------------
//
// 32 descriptors of 4 KB each: 128 KB, which at 48 kHz stereo is about
// two thirds of a second. Long enough that a writer can fall behind for a
// scheduling quantum without a gap, short enough that stopping is prompt.
#define NDESC 32
#define DESC_BYTES 4096
struct bdl_entry {
uint32 addr;
uint16 samples; // *samples*, not bytes: 16-bit words, so bytes/2
uint16 flags;
};
#define BDL_IOC 0x8000 // interrupt when this one finishes
struct ac97 {
uint16 nam, nabm; // I/O port bases
struct bdl_entry *bdl; // NDESC entries, DMA memory
uint8 *buf; // NDESC * DESC_BYTES, DMA memory
uint32 bdl_phys, buf_phys;
int head; // next descriptor to fill
int tail; // oldest one still queued
int filled[NDESC]; // bytes in each, 0 when free
int running;
struct spinlock lock;
struct pci_dev *pdev;
};
static struct ac97 ac97dev;
static struct ac97 *
of(struct device *d)
{
(void)d;
return ac97dev.nabm ? &ac97dev : 0;
}
// --- mixer ------------------------------------------------------------------
// Volume is attenuation: 0 is loudest, and the mute bit is 0x8000. Writing 0
// rather than a "sensible" level on purpose -- the kernel has no business
// deciding how loud a machine is, and a device that comes up silent reads as
// broken to whoever is testing it.
static void
mixer_init(struct ac97 *a)
{
outw(a->nam + NAM_RESET, 0);
outw(a->nam + NAM_MASTER_VOL, 0x0000);
outw(a->nam + NAM_PCM_OUT_VOL, 0x0000);
}
// --- the class ops ----------------------------------------------------------
static int
ac97_configure(struct device *d, struct audio_format *f)
{
struct ac97 *a = of(d);
uint16 ext;
if (!a)
return -1;
// Two channels always. AC'97 plays stereo; a mono stream would have to be
// doubled, and doing that in the driver would hide it from the caller that
// asked -- which is what the write-back in the ioctl is for.
f->channels = 2;
f->bits = AUDIO_FMT_S16LE;
ext = inw(a->nam + NAM_EXT_ID);
if (ext & EXT_VRA) {
outw(a->nam + NAM_EXT_CTRL, inw(a->nam + NAM_EXT_CTRL) | EXT_VRA);
outw(a->nam + NAM_PCM_FRONT_RATE, (uint16)f->rate);
// What the codec settled on, which is not always what was asked: it is
// entitled to round to something it can generate.
f->rate = inw(a->nam + NAM_PCM_FRONT_RATE);
} else {
// No variable rate. 48 kHz is the only thing this codec plays, and saying
// so is more useful than accepting 44100 and playing it 9% fast.
f->rate = 48000;
}
return 0;
}
// How many descriptors the engine has finished with.
// Descriptors with nothing in them, counted forward from where the next write
// would go. Stops at the first one still holding audio, which is what makes
// this the number of bytes a write can take without waiting.
static int
free_descs(struct ac97 *a)
{
int n = 0;
for (int i = 0; i < NDESC; i++) {
if (a->filled[(a->head + i) % NDESC])
break;
n++;
}
return n;
}
static int
ac97_space(struct device *d)
{
struct ac97 *a = of(d);
int n;
if (!a)
return 0;
acquire(&a->lock);
n = free_descs(a) * DESC_BYTES;
release(&a->lock);
return n;
}
static int
ac97_queue(struct device *d, const void *pcm, int bytes)
{
struct ac97 *a = of(d);
int civ, idx, take;
if (!a)
return -1;
acquire(&a->lock);
civ = inb(a->nabm + PO_CIV) % NDESC;
idx = a->head;
// Retire what the engine has finished with.
//
// `tail` is the oldest descriptor we still believe is queued; CIV is the one
// being played. Everything between them is done. Doing this here as well as
// in the interrupt handler is deliberate -- the handler is an optimisation,
// and audio that only works when its interrupt arrives is audio that stops
// dead on a machine whose line is misrouted.
while (a->tail != civ && a->filled[a->tail]) {
a->filled[a->tail] = 0;
a->tail = (a->tail + 1) % NDESC;
}
if (a->filled[idx]) {
release(&a->lock);
return 0; // ring full
}
take = bytes > DESC_BYTES ? DESC_BYTES : bytes;
memmove(a->buf + (uint64)idx * DESC_BYTES, pcm, take);
a->bdl[idx].addr = a->buf_phys + (uint32)idx * DESC_BYTES;
a->bdl[idx].samples = (uint16)(take / 2); // 16-bit words
a->bdl[idx].flags = BDL_IOC;
a->filled[idx] = take;
a->head = (idx + 1) % NDESC;
// LVI is the last entry the engine may play. Keeping it at the descriptor
// just written is what makes this a queue rather than a one-shot.
outb(a->nabm + PO_LVI, (uint8)idx);
release(&a->lock);
return take;
}
static void
ac97_start(struct device *d)
{
struct ac97 *a = of(d);
if (!a)
return;
acquire(&a->lock);
if (!a->running) {
outb(a->nabm + PO_CR, CR_RPBM | CR_IOCE);
a->running = 1;
}
release(&a->lock);
}
static void
ac97_stop(struct device *d)
{
struct ac97 *a = of(d);
if (!a)
return;
acquire(&a->lock);
outb(a->nabm + PO_CR, 0);
outb(a->nabm + PO_CR, CR_RR); // reset the box: CIV, LVI, PICB to 0
for (int i = 0; i < NDESC; i++)
a->filled[i] = 0;
a->head = 0;
a->tail = 0;
a->running = 0;
release(&a->lock);
}
static int
ac97_pending(struct device *d)
{
struct ac97 *a = of(d);
int n = 0;
if (!a)
return 0;
acquire(&a->lock);
if (a->running && !(inw(a->nabm + PO_SR) & SR_DCH)) {
for (int i = 0; i < NDESC; i++)
if (a->filled[i])
n += a->filled[i];
}
release(&a->lock);
return n;
}
static const struct audio_ops ac97_ops = {
.configure = ac97_configure,
.space = ac97_space,
.queue = ac97_queue,
.start = ac97_start,
.stop = ac97_stop,
.pending = ac97_pending,
};
// --- interrupt --------------------------------------------------------------
static void
ac97_intr(void *arg)
{
struct ac97 *a = arg;
uint16 sr;
if (!a || !a->nabm)
return;
sr = inw(a->nabm + PO_SR);
// Acknowledge by writing the bits back. A status bit left set on a
// level-triggered line is an interrupt that re-fires for ever -- the same
// shape as the e1000 bug in docs/history/kernel.md section 13.
if (sr & (SR_BCIS | SR_LVBCI | SR_DCH))
outw(a->nabm + PO_SR, sr & (SR_BCIS | SR_LVBCI | SR_DCH));
{
int civ = inb(a->nabm + PO_CIV) % NDESC;
// Everything the engine has passed is free again. Through `tail` rather
// than by clearing one entry, so this and ac97_queue() cannot disagree
// about which descriptors are in flight.
while (a->tail != civ && a->filled[a->tail]) {
a->filled[a->tail] = 0;
a->tail = (a->tail + 1) % NDESC;
}
}
// The writer is asleep on the tick rather than on this device, so there is
// nothing to wake -- see audio_wait(). Keeping the handler to "acknowledge
// and account" is deliberate: an interrupt handler that can be deleted
// without the audio stopping is one that cannot deadlock the audio either.
}
// --- probe ------------------------------------------------------------------
static int
ac97_probe(struct pci_dev *d)
{
struct ac97 *a = &ac97dev;
if (a->nabm)
return -1; // one is enough
// Both BARs are I/O ports on this device, which is why nothing here maps
// anything: `is_io` is what says so, and a driver that ioremapped these
// would be mapping a port number as if it were an address.
if (!d->bar[0].is_io || !d->bar[1].is_io ||
!d->bar[0].base || !d->bar[1].base) {
cprintf("ac97: expected two I/O BARs; not driving this device\n");
return -1;
}
a->nam = (uint16)d->bar[0].base;
a->nabm = (uint16)d->bar[1].base;
a->pdev = d;
initlock(&a->lock, "ac97");
pci_enable(d, PCI_CMD_IO | PCI_CMD_BUS_MASTER);
// The descriptor list and the audio itself, both from the DMA arena: the
// engine reads them by physical address, and kalloc's pages are adjacent
// only by chance.
a->bdl = dma_alloc(NDESC * sizeof(struct bdl_entry), 4096);
a->buf = dma_alloc(NDESC * DESC_BYTES, 4096);
if (!a->bdl || !a->buf) {
cprintf("ac97: no DMA memory for a %d KB ring\n",
(NDESC * DESC_BYTES) / 1024);
a->nabm = 0;
return -1;
}
a->bdl_phys = (uint32)dma_phys(a->bdl);
a->buf_phys = (uint32)dma_phys(a->buf);
memset(a->bdl, 0, NDESC * sizeof(struct bdl_entry));
memset(a->buf, 0, NDESC * DESC_BYTES);
// Cold reset of the whole controller, then the PCM-out box.
outl(a->nabm + GLOB_CTRL, 0x00000002);
mixer_init(a);
outb(a->nabm + PO_CR, CR_RR);
for (int spin = 0; spin < 100000 && (inb(a->nabm + PO_CR) & CR_RR); spin++)
;
outl(a->nabm + PO_BDBAR, a->bdl_phys);
if (d->irq != 0xFF && d->irq < 24)
irq_register(d->irq, ac97_intr, a, "ac97", 1);
kinfo("ac97: nam %x nabm %x, %d KB ring, irq %d\n",
a->nam, a->nabm, (NDESC * DESC_BYTES) / 1024, d->irq);
return 0;
}
static const struct pci_match ac97_match[] = {
{ 0x8086, 0x2415, 0, 0 }, // 82801AA, which is what QEMU's -device AC97 is
{ 0x8086, 0x2425, 0, 0 }, // 82801AB
{ 0x8086, 0x2445, 0, 0 }, // 82801BA
{ 0x8086, 0x24C5, 0, 0 }, // ICH4
{ 0x8086, 0x24D5, 0, 0 }, // ICH5
{ 0x8086, 0x266E, 0, 0 }, // ICH6
{ 0, 0, 0, 0 },
};
const struct pci_driver ac97_driver = {
.name = "ac97",
.devname = "audio",
.match = ac97_match,
.ops = &ac97_ops,
.probe = ac97_probe,
};

View file

@ -32,6 +32,7 @@ extern const struct pci_driver vga_pci_driver;
extern const struct pci_driver xhci_driver;
extern const struct pci_driver virtio_gpu_driver;
extern const struct pci_driver e1000_driver;
extern const struct pci_driver ac97_driver;
// Order matters here in one respect: virtio-gpu is offered the bus before the
// VBE framebuffer driver, so that on a machine with both, the device with real
@ -43,6 +44,7 @@ static const struct pci_driver *drivers[] = {
&vga_pci_driver,
&e1000_driver,
&xhci_driver,
&ac97_driver,
};
void