From: Greg Kroah-Hartman Date: Wed, 30 Jan 2013 09:25:49 +0000 (+0100) Subject: 3.4-stable patches X-Git-Tag: v3.0.62~31 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=7993a645972364781cf0737a198b411a2929fa76;p=thirdparty%2Fkernel%2Fstable-queue.git 3.4-stable patches added patches: iommu-amd-family15h-model10-1fh-erratum-746-workaround.patch radeon_display-use-pointer-return-error-codes.patch xfs-fix-possible-use-after-free-with-aio.patch --- diff --git a/queue-3.4/iommu-amd-family15h-model10-1fh-erratum-746-workaround.patch b/queue-3.4/iommu-amd-family15h-model10-1fh-erratum-746-workaround.patch new file mode 100644 index 00000000000..5a878fa99de --- /dev/null +++ b/queue-3.4/iommu-amd-family15h-model10-1fh-erratum-746-workaround.patch @@ -0,0 +1,78 @@ +From 318fe782539c4150d1b8e4e6c9dc3a896512cb8a Mon Sep 17 00:00:00 2001 +From: Suravee Suthikulpanit +Date: Thu, 24 Jan 2013 13:17:53 -0600 +Subject: IOMMU, AMD Family15h Model10-1Fh erratum 746 Workaround + +From: Suravee Suthikulpanit + +commit 318fe782539c4150d1b8e4e6c9dc3a896512cb8a upstream. + +The IOMMU may stop processing page translations due to a perceived lack +of credits for writing upstream peripheral page service request (PPR) +or event logs. If the L2B miscellaneous clock gating feature is enabled +the IOMMU does not properly register credits after the log request has +completed, leading to a potential system hang. + +BIOSes are supposed to disable L2B micellaneous clock gating by setting +L2_L2B_CK_GATE_CONTROL[CKGateL2BMiscDisable](D0F2xF4_x90[2]) = 1b. This +patch corrects that for those which do not enable this workaround. + +Signed-off-by: Suravee Suthikulpanit +Acked-by: Borislav Petkov +Signed-off-by: Joerg Roedel +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iommu/amd_iommu_init.c | 34 ++++++++++++++++++++++++++++++++++ + 1 file changed, 34 insertions(+) + +--- a/drivers/iommu/amd_iommu_init.c ++++ b/drivers/iommu/amd_iommu_init.c +@@ -1002,6 +1002,38 @@ static void __init free_iommu_all(void) + } + + /* ++ * Family15h Model 10h-1fh erratum 746 (IOMMU Logging May Stall Translations) ++ * Workaround: ++ * BIOS should disable L2B micellaneous clock gating by setting ++ * L2_L2B_CK_GATE_CONTROL[CKGateL2BMiscDisable](D0F2xF4_x90[2]) = 1b ++ */ ++static void __init amd_iommu_erratum_746_workaround(struct amd_iommu *iommu) ++{ ++ u32 value; ++ ++ if ((boot_cpu_data.x86 != 0x15) || ++ (boot_cpu_data.x86_model < 0x10) || ++ (boot_cpu_data.x86_model > 0x1f)) ++ return; ++ ++ pci_write_config_dword(iommu->dev, 0xf0, 0x90); ++ pci_read_config_dword(iommu->dev, 0xf4, &value); ++ ++ if (value & BIT(2)) ++ return; ++ ++ /* Select NB indirect register 0x90 and enable writing */ ++ pci_write_config_dword(iommu->dev, 0xf0, 0x90 | (1 << 8)); ++ ++ pci_write_config_dword(iommu->dev, 0xf4, value | 0x4); ++ pr_info("AMD-Vi: Applying erratum 746 workaround for IOMMU at %s\n", ++ dev_name(&iommu->dev->dev)); ++ ++ /* Clear the enable writing bit */ ++ pci_write_config_dword(iommu->dev, 0xf0, 0x90); ++} ++ ++/* + * This function clues the initialization function for one IOMMU + * together and also allocates the command buffer and programs the + * hardware. It does NOT enable the IOMMU. This is done afterwards. +@@ -1062,6 +1094,8 @@ static int __init init_iommu_one(struct + if (iommu->cap & (1UL << IOMMU_CAP_NPCACHE)) + amd_iommu_np_cache = true; + ++ amd_iommu_erratum_746_workaround(iommu); ++ + return pci_enable_device(iommu->dev); + } + diff --git a/queue-3.4/radeon_display-use-pointer-return-error-codes.patch b/queue-3.4/radeon_display-use-pointer-return-error-codes.patch new file mode 100644 index 00000000000..68926ff753a --- /dev/null +++ b/queue-3.4/radeon_display-use-pointer-return-error-codes.patch @@ -0,0 +1,31 @@ +From b2f4b03f8a378cd626d2ea67d19e7470c050a098 Mon Sep 17 00:00:00 2001 +From: xueminsu +Date: Tue, 22 Jan 2013 22:16:53 +0800 +Subject: radeon_display: Use pointer return error codes + +From: xueminsu + +commit b2f4b03f8a378cd626d2ea67d19e7470c050a098 upstream. + +drm_mode_addfb() expects fb_create return error code +instead of NULL. + +Signed-off-by: xueminsu +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/radeon/radeon_display.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/radeon/radeon_display.c ++++ b/drivers/gpu/drm/radeon/radeon_display.c +@@ -1136,7 +1136,7 @@ radeon_user_framebuffer_create(struct dr + if (ret) { + kfree(radeon_fb); + drm_gem_object_unreference_unlocked(obj); +- return NULL; ++ return ERR_PTR(ret); + } + + return &radeon_fb->base; diff --git a/queue-3.4/series b/queue-3.4/series index 708b474bb34..a4531634248 100644 --- a/queue-3.4/series +++ b/queue-3.4/series @@ -7,3 +7,6 @@ arm-at91-rm9200-remake-the-bga-as-default-version.patch arm-7627-1-predicate-preempt-logic-on-preemp_count-not-preempt-alone.patch bluetooth-fix-sending-hci-commands-after-reset.patch drm-radeon-fix-cursor-corruption-on-dce6-and-newer.patch +radeon_display-use-pointer-return-error-codes.patch +iommu-amd-family15h-model10-1fh-erratum-746-workaround.patch +xfs-fix-possible-use-after-free-with-aio.patch diff --git a/queue-3.4/xfs-fix-possible-use-after-free-with-aio.patch b/queue-3.4/xfs-fix-possible-use-after-free-with-aio.patch new file mode 100644 index 00000000000..ef907c9649c --- /dev/null +++ b/queue-3.4/xfs-fix-possible-use-after-free-with-aio.patch @@ -0,0 +1,40 @@ +From 4b05d09c18d9aa62d2e7fb4b057f54e5a38963f5 Mon Sep 17 00:00:00 2001 +From: Jan Kara +Date: Wed, 23 Jan 2013 13:56:18 +0100 +Subject: xfs: Fix possible use-after-free with AIO + +From: Jan Kara + +commit 4b05d09c18d9aa62d2e7fb4b057f54e5a38963f5 upstream. + +Running AIO is pinning inode in memory using file reference. Once AIO +is completed using aio_complete(), file reference is put and inode can +be freed from memory. So we have to be sure that calling aio_complete() +is the last thing we do with the inode. + +Signed-off-by: Jan Kara +CC: xfs@oss.sgi.com +CC: Ben Myers +Reviewed-by: Ben Myers +Signed-off-by: Ben Myers +Signed-off-by: Greg Kroah-Hartman + +--- + fs/xfs/xfs_aops.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/xfs/xfs_aops.c ++++ b/fs/xfs/xfs_aops.c +@@ -89,11 +89,11 @@ xfs_destroy_ioend( + } + + if (ioend->io_iocb) { ++ inode_dio_done(ioend->io_inode); + if (ioend->io_isasync) { + aio_complete(ioend->io_iocb, ioend->io_error ? + ioend->io_error : ioend->io_result, 0); + } +- inode_dio_done(ioend->io_inode); + } + + mempool_free(ioend, xfs_ioend_pool);