From: Greg Kroah-Hartman Date: Wed, 18 Dec 2013 01:31:20 +0000 (-0800) Subject: 3.4-stable patches X-Git-Tag: v3.4.75~45 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=9b479aaaaa4a631ab0b56bdca34d01a3507cdcd5;p=thirdparty%2Fkernel%2Fstable-queue.git 3.4-stable patches added patches: alsa-memalloc.h-fix-wrong-truncation-of-dma_addr_t.patch --- diff --git a/queue-3.4/alsa-memalloc.h-fix-wrong-truncation-of-dma_addr_t.patch b/queue-3.4/alsa-memalloc.h-fix-wrong-truncation-of-dma_addr_t.patch new file mode 100644 index 00000000000..5f4c52f1e1f --- /dev/null +++ b/queue-3.4/alsa-memalloc.h-fix-wrong-truncation-of-dma_addr_t.patch @@ -0,0 +1,68 @@ +From 932e9dec380c67ec15ac3eb073bb55797d8b4801 Mon Sep 17 00:00:00 2001 +From: Stefano Panella +Date: Tue, 10 Dec 2013 14:20:28 +0000 +Subject: ALSA: memalloc.h - fix wrong truncation of dma_addr_t + +From: Stefano Panella + +commit 932e9dec380c67ec15ac3eb073bb55797d8b4801 upstream. + +When running a 32bit kernel the hda_intel driver is still reporting +a 64bit dma_mask if the HW supports it. + +From sound/pci/hda/hda_intel.c: + + /* allow 64bit DMA address if supported by H/W */ + if ((gcap & ICH6_GCAP_64OK) && !pci_set_dma_mask(pci, DMA_BIT_MASK(64))) + pci_set_consistent_dma_mask(pci, DMA_BIT_MASK(64)); + else { + pci_set_dma_mask(pci, DMA_BIT_MASK(32)); + pci_set_consistent_dma_mask(pci, DMA_BIT_MASK(32)); + } + +which means when there is a call to dma_alloc_coherent from +snd_malloc_dev_pages a machine address bigger than 32bit can be returned. +This can be true in particular if running the 32bit kernel as a pv dom0 +under the Xen Hypervisor or PAE on bare metal. + +The problem is that when calling setup_bdle to program the BLE the +dma_addr_t returned from the dma_alloc_coherent is wrongly truncated +from snd_sgbuf_get_addr if running a 32bit kernel: + +static inline dma_addr_t snd_sgbuf_get_addr(struct snd_dma_buffer *dmab, + size_t offset) +{ + struct snd_sg_buf *sgbuf = dmab->private_data; + dma_addr_t addr = sgbuf->table[offset >> PAGE_SHIFT].addr; + addr &= PAGE_MASK; + return addr + offset % PAGE_SIZE; +} + +where PAGE_MASK in a 32bit kernel is zeroing the upper 32bit af addr. + +Without this patch the HW will fetch the 32bit truncated address, +which is not the one obtained from dma_alloc_coherent and will result +to a non working audio but can corrupt host memory at a random location. + +The current patch apply to v3.13-rc3-74-g6c843f5 + +Signed-off-by: Stefano Panella +Reviewed-by: Frediano Ziglio +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + include/sound/memalloc.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/include/sound/memalloc.h ++++ b/include/sound/memalloc.h +@@ -101,7 +101,7 @@ static inline unsigned int snd_sgbuf_ali + static inline dma_addr_t snd_sgbuf_get_addr(struct snd_sg_buf *sgbuf, size_t offset) + { + dma_addr_t addr = sgbuf->table[offset >> PAGE_SHIFT].addr; +- addr &= PAGE_MASK; ++ addr &= ~((dma_addr_t)PAGE_SIZE - 1); + return addr + offset % PAGE_SIZE; + } + diff --git a/queue-3.4/series b/queue-3.4/series index 9248ef317b0..73497a3a499 100644 --- a/queue-3.4/series +++ b/queue-3.4/series @@ -1 +1,2 @@ mips-dma-for-bmips5000-cores-flush-region-just-like-non-coherent-r10000.patch +alsa-memalloc.h-fix-wrong-truncation-of-dma_addr_t.patch