lkml.org 
[lkml]   [2013]   [Dec]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 3.11 168/208] ALSA: memalloc.h - fix wrong truncation of dma_addr_t
    Date
    3.11.10.2 -stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Stefano Panella <stefano.panella@citrix.com>

    commit 932e9dec380c67ec15ac3eb073bb55797d8b4801 upstream.

    When running a 32bit kernel the hda_intel driver is still reporting
    a 64bit dma_mask if the HW supports it.

    From sound/pci/hda/hda_intel.c:

    /* allow 64bit DMA address if supported by H/W */
    if ((gcap & ICH6_GCAP_64OK) && !pci_set_dma_mask(pci, DMA_BIT_MASK(64)))
    pci_set_consistent_dma_mask(pci, DMA_BIT_MASK(64));
    else {
    pci_set_dma_mask(pci, DMA_BIT_MASK(32));
    pci_set_consistent_dma_mask(pci, DMA_BIT_MASK(32));
    }

    which means when there is a call to dma_alloc_coherent from
    snd_malloc_dev_pages a machine address bigger than 32bit can be returned.
    This can be true in particular if running the 32bit kernel as a pv dom0
    under the Xen Hypervisor or PAE on bare metal.

    The problem is that when calling setup_bdle to program the BLE the
    dma_addr_t returned from the dma_alloc_coherent is wrongly truncated
    from snd_sgbuf_get_addr if running a 32bit kernel:

    static inline dma_addr_t snd_sgbuf_get_addr(struct snd_dma_buffer *dmab,
    size_t offset)
    {
    struct snd_sg_buf *sgbuf = dmab->private_data;
    dma_addr_t addr = sgbuf->table[offset >> PAGE_SHIFT].addr;
    addr &= PAGE_MASK;
    return addr + offset % PAGE_SIZE;
    }

    where PAGE_MASK in a 32bit kernel is zeroing the upper 32bit af addr.

    Without this patch the HW will fetch the 32bit truncated address,
    which is not the one obtained from dma_alloc_coherent and will result
    to a non working audio but can corrupt host memory at a random location.

    The current patch apply to v3.13-rc3-74-g6c843f5

    Signed-off-by: Stefano Panella <stefano.panella@citrix.com>
    Reviewed-by: Frediano Ziglio <frediano.ziglio@citrix.com>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
    ---
    include/sound/memalloc.h | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    diff --git a/include/sound/memalloc.h b/include/sound/memalloc.h
    index cf15b82..54aff2d 100644
    --- a/include/sound/memalloc.h
    +++ b/include/sound/memalloc.h
    @@ -103,7 +103,7 @@ static inline dma_addr_t snd_sgbuf_get_addr(struct snd_dma_buffer *dmab,
    {
    struct snd_sg_buf *sgbuf = dmab->private_data;
    dma_addr_t addr = sgbuf->table[offset >> PAGE_SHIFT].addr;
    - addr &= PAGE_MASK;
    + addr &= ~((dma_addr_t)PAGE_SIZE - 1);
    return addr + offset % PAGE_SIZE;
    }

    --
    1.8.3.2


    \
     
     \ /
      Last update: 2013-12-22 03:01    [W:4.125 / U:0.036 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site