3.4-stable patches

added patches:
	iommu-amd-family15h-model10-1fh-erratum-746-workaround.patch
	radeon_display-use-pointer-return-error-codes.patch
	xfs-fix-possible-use-after-free-with-aio.patch

diff --git a/queue-3.4/iommu-amd-family15h-model10-1fh-erratum-746-workaround.patch b/queue-3.4/iommu-amd-family15h-model10-1fh-erratum-746-workaround.patch
new file mode 100644 (file)
index 0000000..5a878fa
--- /dev/null
+++ b/queue-3.4/iommu-amd-family15h-model10-1fh-erratum-746-workaround.patch
@@ -0,0 +1,78 @@
+From 318fe782539c4150d1b8e4e6c9dc3a896512cb8a Mon Sep 17 00:00:00 2001
+From: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
+Date: Thu, 24 Jan 2013 13:17:53 -0600
+Subject: IOMMU, AMD Family15h Model10-1Fh erratum 746 Workaround
+
+From: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
+
+commit 318fe782539c4150d1b8e4e6c9dc3a896512cb8a upstream.
+
+The IOMMU may stop processing page translations due to a perceived lack
+of credits for writing upstream peripheral page service request (PPR)
+or event logs. If the L2B miscellaneous clock gating feature is enabled
+the IOMMU does not properly register credits after the log request has
+completed, leading to a potential system hang.
+
+BIOSes are supposed to disable L2B micellaneous clock gating by setting
+L2_L2B_CK_GATE_CONTROL[CKGateL2BMiscDisable](D0F2xF4_x90[2]) = 1b. This
+patch corrects that for those which do not enable this workaround.
+
+Signed-off-by: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
+Acked-by: Borislav Petkov <bp@suse.de>
+Signed-off-by: Joerg Roedel <joro@8bytes.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iommu/amd_iommu_init.c |   34 ++++++++++++++++++++++++++++++++++
+ 1 file changed, 34 insertions(+)
+
+--- a/drivers/iommu/amd_iommu_init.c
++++ b/drivers/iommu/amd_iommu_init.c
+@@ -1002,6 +1002,38 @@ static void __init free_iommu_all(void)
+ }
+ 
+ /*
++ * Family15h Model 10h-1fh erratum 746 (IOMMU Logging May Stall Translations)
++ * Workaround:
++ *     BIOS should disable L2B micellaneous clock gating by setting
++ *     L2_L2B_CK_GATE_CONTROL[CKGateL2BMiscDisable](D0F2xF4_x90[2]) = 1b
++ */
++static void __init amd_iommu_erratum_746_workaround(struct amd_iommu *iommu)
++{
++      u32 value;
++
++      if ((boot_cpu_data.x86 != 0x15) ||
++          (boot_cpu_data.x86_model < 0x10) ||
++          (boot_cpu_data.x86_model > 0x1f))
++              return;
++
++      pci_write_config_dword(iommu->dev, 0xf0, 0x90);
++      pci_read_config_dword(iommu->dev, 0xf4, &value);
++
++      if (value & BIT(2))
++              return;
++
++      /* Select NB indirect register 0x90 and enable writing */
++      pci_write_config_dword(iommu->dev, 0xf0, 0x90 | (1 << 8));
++
++      pci_write_config_dword(iommu->dev, 0xf4, value | 0x4);
++      pr_info("AMD-Vi: Applying erratum 746 workaround for IOMMU at %s\n",
++              dev_name(&iommu->dev->dev));
++
++      /* Clear the enable writing bit */
++      pci_write_config_dword(iommu->dev, 0xf0, 0x90);
++}
++
++/*
+  * This function clues the initialization function for one IOMMU
+  * together and also allocates the command buffer and programs the
+  * hardware. It does NOT enable the IOMMU. This is done afterwards.
+@@ -1062,6 +1094,8 @@ static int __init init_iommu_one(struct
+       if (iommu->cap & (1UL << IOMMU_CAP_NPCACHE))
+               amd_iommu_np_cache = true;
+ 
++      amd_iommu_erratum_746_workaround(iommu);
++
+       return pci_enable_device(iommu->dev);
+ }
+ 

diff --git a/queue-3.4/radeon_display-use-pointer-return-error-codes.patch b/queue-3.4/radeon_display-use-pointer-return-error-codes.patch
new file mode 100644 (file)
index 0000000..68926ff
--- /dev/null
+++ b/queue-3.4/radeon_display-use-pointer-return-error-codes.patch
@@ -0,0 +1,31 @@
+From b2f4b03f8a378cd626d2ea67d19e7470c050a098 Mon Sep 17 00:00:00 2001
+From: xueminsu <xuemin.su@intel.com>
+Date: Tue, 22 Jan 2013 22:16:53 +0800
+Subject: radeon_display: Use pointer return error codes
+
+From: xueminsu <xuemin.su@intel.com>
+
+commit b2f4b03f8a378cd626d2ea67d19e7470c050a098 upstream.
+
+drm_mode_addfb() expects fb_create return error code
+instead of NULL.
+
+Signed-off-by: xueminsu <xuemin.su@intel.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/radeon_display.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/radeon/radeon_display.c
++++ b/drivers/gpu/drm/radeon/radeon_display.c
+@@ -1136,7 +1136,7 @@ radeon_user_framebuffer_create(struct dr
+       if (ret) {
+               kfree(radeon_fb);
+               drm_gem_object_unreference_unlocked(obj);
+-              return NULL;
++              return ERR_PTR(ret);
+       }
+ 
+       return &radeon_fb->base;

diff --git a/queue-3.4/series b/queue-3.4/series
index 708b474bb34ab49665bdbaf10d35f50eccd3483f..a453163424859f95eb7ca5aa9616dc05fabdd7ea 100644 (file)
--- a/queue-3.4/series
+++ b/queue-3.4/series
@@ -7,3 +7,6 @@ arm-at91-rm9200-remake-the-bga-as-default-version.patch
 arm-7627-1-predicate-preempt-logic-on-preemp_count-not-preempt-alone.patch
 bluetooth-fix-sending-hci-commands-after-reset.patch
 drm-radeon-fix-cursor-corruption-on-dce6-and-newer.patch
+radeon_display-use-pointer-return-error-codes.patch
+iommu-amd-family15h-model10-1fh-erratum-746-workaround.patch
+xfs-fix-possible-use-after-free-with-aio.patch

diff --git a/queue-3.4/xfs-fix-possible-use-after-free-with-aio.patch b/queue-3.4/xfs-fix-possible-use-after-free-with-aio.patch
new file mode 100644 (file)
index 0000000..ef907c9
--- /dev/null
+++ b/queue-3.4/xfs-fix-possible-use-after-free-with-aio.patch
@@ -0,0 +1,40 @@
+From 4b05d09c18d9aa62d2e7fb4b057f54e5a38963f5 Mon Sep 17 00:00:00 2001
+From: Jan Kara <jack@suse.cz>
+Date: Wed, 23 Jan 2013 13:56:18 +0100
+Subject: xfs: Fix possible use-after-free with AIO
+
+From: Jan Kara <jack@suse.cz>
+
+commit 4b05d09c18d9aa62d2e7fb4b057f54e5a38963f5 upstream.
+
+Running AIO is pinning inode in memory using file reference. Once AIO
+is completed using aio_complete(), file reference is put and inode can
+be freed from memory. So we have to be sure that calling aio_complete()
+is the last thing we do with the inode.
+
+Signed-off-by: Jan Kara <jack@suse.cz>
+CC: xfs@oss.sgi.com
+CC: Ben Myers <bpm@sgi.com>
+Reviewed-by: Ben Myers <bpm@sgi.com>
+Signed-off-by: Ben Myers <bpm@sgi.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/xfs/xfs_aops.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/xfs/xfs_aops.c
++++ b/fs/xfs/xfs_aops.c
+@@ -89,11 +89,11 @@ xfs_destroy_ioend(
+       }
+ 
+       if (ioend->io_iocb) {
++              inode_dio_done(ioend->io_inode);
+               if (ioend->io_isasync) {
+                       aio_complete(ioend->io_iocb, ioend->io_error ?
+                                       ioend->io_error : ioend->io_result, 0);
+               }
+-              inode_dio_done(ioend->io_inode);
+       }
+ 
+       mempool_free(ioend, xfs_ioend_pool);