3.4-stable patches

added patches:
	alsa-memalloc.h-fix-wrong-truncation-of-dma_addr_t.patch

diff --git a/queue-3.4/alsa-memalloc.h-fix-wrong-truncation-of-dma_addr_t.patch b/queue-3.4/alsa-memalloc.h-fix-wrong-truncation-of-dma_addr_t.patch
new file mode 100644 (file)
index 0000000..5f4c52f
--- /dev/null
+++ b/queue-3.4/alsa-memalloc.h-fix-wrong-truncation-of-dma_addr_t.patch
@@ -0,0 +1,68 @@
+From 932e9dec380c67ec15ac3eb073bb55797d8b4801 Mon Sep 17 00:00:00 2001
+From: Stefano Panella <stefano.panella@citrix.com>
+Date: Tue, 10 Dec 2013 14:20:28 +0000
+Subject: ALSA: memalloc.h - fix wrong truncation of dma_addr_t
+
+From: Stefano Panella <stefano.panella@citrix.com>
+
+commit 932e9dec380c67ec15ac3eb073bb55797d8b4801 upstream.
+
+When running a 32bit kernel the hda_intel driver is still reporting
+a 64bit dma_mask if the HW supports it.
+
+From sound/pci/hda/hda_intel.c:
+
+        /* allow 64bit DMA address if supported by H/W */
+        if ((gcap & ICH6_GCAP_64OK) && !pci_set_dma_mask(pci, DMA_BIT_MASK(64)))
+                pci_set_consistent_dma_mask(pci, DMA_BIT_MASK(64));
+        else {
+                pci_set_dma_mask(pci, DMA_BIT_MASK(32));
+                pci_set_consistent_dma_mask(pci, DMA_BIT_MASK(32));
+        }
+
+which means when there is a call to dma_alloc_coherent from
+snd_malloc_dev_pages a machine address bigger than 32bit can be returned.
+This can be true in particular if running  the 32bit kernel as a pv dom0
+under the Xen Hypervisor or PAE on bare metal.
+
+The problem is that when calling setup_bdle to program the BLE the
+dma_addr_t returned from the dma_alloc_coherent is wrongly truncated
+from snd_sgbuf_get_addr if running a 32bit kernel:
+
+static inline dma_addr_t snd_sgbuf_get_addr(struct snd_dma_buffer *dmab,
+                                           size_t offset)
+{
+        struct snd_sg_buf *sgbuf = dmab->private_data;
+        dma_addr_t addr = sgbuf->table[offset >> PAGE_SHIFT].addr;
+        addr &= PAGE_MASK;
+        return addr + offset % PAGE_SIZE;
+}
+
+where PAGE_MASK in a 32bit kernel is zeroing the upper 32bit af addr.
+
+Without this patch the HW will fetch the 32bit truncated address,
+which is not the one obtained from dma_alloc_coherent and will result
+to a non working audio but can corrupt host memory at a random location.
+
+The current patch apply to v3.13-rc3-74-g6c843f5
+
+Signed-off-by: Stefano Panella <stefano.panella@citrix.com>
+Reviewed-by: Frediano Ziglio <frediano.ziglio@citrix.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/sound/memalloc.h |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/include/sound/memalloc.h
++++ b/include/sound/memalloc.h
+@@ -101,7 +101,7 @@ static inline unsigned int snd_sgbuf_ali
+ static inline dma_addr_t snd_sgbuf_get_addr(struct snd_sg_buf *sgbuf, size_t offset)
+ {
+       dma_addr_t addr = sgbuf->table[offset >> PAGE_SHIFT].addr;
+-      addr &= PAGE_MASK;
++      addr &= ~((dma_addr_t)PAGE_SIZE - 1);
+       return addr + offset % PAGE_SIZE;
+ }
+ 

diff --git a/queue-3.4/series b/queue-3.4/series
index 9248ef317b019b599a3bc134d16d32af8f8fc1ce..73497a3a499053fcb23430686ce1be650a2bde81 100644 (file)
--- a/queue-3.4/series
+++ b/queue-3.4/series
@@ -1 +1,2 @@
 mips-dma-for-bmips5000-cores-flush-region-just-like-non-coherent-r10000.patch
+alsa-memalloc.h-fix-wrong-truncation-of-dma_addr_t.patch