On Mon, Jan 31, 2022 at 03:57:04PM +0100, Takashi Iwai wrote: > In anyway, we need to track down exactly which access triggers those > errors... I went deeper into codec reads and writes: - snd_hda_codec_write - snd_hdac_codec_write - codec_write - snd_hdac_exec_verb - codec_exec_verb - snd_hdac_bus_exec_verb_unlocked - azx_send_cmd / azx_get_response - snd_hdac_bus_send_cmd / azx_rirb_get_response In the last functions a circular buffer is used to write commands. The problem is that "bus->corb.buf[wp]" and "bus->rirb.res[addr]" are nowhere close to the IOMMU-reported address of the offending memory access. It's likely that I've missed other communication channels. But is it possible that IOMMU-reported address and buffers addresses are of different kinds (physical/virtual) or different regions mapped to the same physical pages? Example: snd_hdac_bus_send_cmd: bus->corb.buf[wp] = cpu_to_le32(val) // = 0x3b8000, wp=0xfb, &buf[wp]=00000000f1fd4592 snd_hdac_bus_get_response: reading result from 0000000059c4003d snd_hdac_bus_send_cmd: bus->corb.buf[wp] = cpu_to_le32(val) // = 0x339000, wp=0xfc, &buf[wp]=000000007f14c128 snd_hdac_bus_get_response: reading result from 0000000059c4003d snd_hdac_bus_send_cmd: bus->corb.buf[wp] = cpu_to_le32(val) // = 0x1470740, wp=0xfd, &buf[wp]=00000000a6b14901 snd_hdac_bus_get_response: reading result from 0000000059c4003d snd_hdac_bus_send_cmd: bus->corb.buf[wp] = cpu_to_le32(val) // = 0x14ba000, wp=0xfe, &buf[wp]=00000000d8d1672a snd_hdac_bus_get_response: reading result from 0000000059c4003d snd_hdac_bus_send_cmd: bus->corb.buf[wp] = cpu_to_le32(val) // = 0x14b8000, wp=0xff, &buf[wp]=00000000b87b3287 snd_hdac_bus_get_response: reading result from 0000000059c4003d snd_hdac_bus_send_cmd: bus->corb.buf[wp] = cpu_to_le32(val) // = 0x2ba000, wp=0x0, &buf[wp]=000000002162c728 snd_hdac_bus_get_response: reading result from 0000000059c4003d snd_hdac_bus_send_cmd: bus->corb.buf[wp] = cpu_to_le32(val) // = 0x2b8000, wp=0x1, &buf[wp]=0000000095f61061 snd_hda_intel 0000:05:00.6: AMD-Vi: Event logged [IO_PAGE_FAULT domain=0x0015 address=0x1fffff800 flags=0x0020]
