3.7-stable patches

added patches:
	iommu-amd-family15h-model10-1fh-erratum-746-workaround.patch
	radeon_display-use-pointer-return-error-codes.patch
	xfs-fix-possible-use-after-free-with-aio.patch

diff --git a/queue-3.7/iommu-amd-family15h-model10-1fh-erratum-746-workaround.patch b/queue-3.7/iommu-amd-family15h-model10-1fh-erratum-746-workaround.patch
new file mode 100644 (file)
index 0000000..ec5f5c3
--- /dev/null
+++ b/queue-3.7/iommu-amd-family15h-model10-1fh-erratum-746-workaround.patch
@@ -0,0 +1,78 @@
+From 318fe782539c4150d1b8e4e6c9dc3a896512cb8a Mon Sep 17 00:00:00 2001
+From: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
+Date: Thu, 24 Jan 2013 13:17:53 -0600
+Subject: IOMMU, AMD Family15h Model10-1Fh erratum 746 Workaround
+
+From: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
+
+commit 318fe782539c4150d1b8e4e6c9dc3a896512cb8a upstream.
+
+The IOMMU may stop processing page translations due to a perceived lack
+of credits for writing upstream peripheral page service request (PPR)
+or event logs. If the L2B miscellaneous clock gating feature is enabled
+the IOMMU does not properly register credits after the log request has
+completed, leading to a potential system hang.
+
+BIOSes are supposed to disable L2B micellaneous clock gating by setting
+L2_L2B_CK_GATE_CONTROL[CKGateL2BMiscDisable](D0F2xF4_x90[2]) = 1b. This
+patch corrects that for those which do not enable this workaround.
+
+Signed-off-by: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
+Acked-by: Borislav Petkov <bp@suse.de>
+Signed-off-by: Joerg Roedel <joro@8bytes.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iommu/amd_iommu_init.c |   34 ++++++++++++++++++++++++++++++++++
+ 1 file changed, 34 insertions(+)
+
+--- a/drivers/iommu/amd_iommu_init.c
++++ b/drivers/iommu/amd_iommu_init.c
+@@ -975,6 +975,38 @@ static void __init free_iommu_all(void)
+ }
+ 
+ /*
++ * Family15h Model 10h-1fh erratum 746 (IOMMU Logging May Stall Translations)
++ * Workaround:
++ *     BIOS should disable L2B micellaneous clock gating by setting
++ *     L2_L2B_CK_GATE_CONTROL[CKGateL2BMiscDisable](D0F2xF4_x90[2]) = 1b
++ */
++static void __init amd_iommu_erratum_746_workaround(struct amd_iommu *iommu)
++{
++      u32 value;
++
++      if ((boot_cpu_data.x86 != 0x15) ||
++          (boot_cpu_data.x86_model < 0x10) ||
++          (boot_cpu_data.x86_model > 0x1f))
++              return;
++
++      pci_write_config_dword(iommu->dev, 0xf0, 0x90);
++      pci_read_config_dword(iommu->dev, 0xf4, &value);
++
++      if (value & BIT(2))
++              return;
++
++      /* Select NB indirect register 0x90 and enable writing */
++      pci_write_config_dword(iommu->dev, 0xf0, 0x90 | (1 << 8));
++
++      pci_write_config_dword(iommu->dev, 0xf4, value | 0x4);
++      pr_info("AMD-Vi: Applying erratum 746 workaround for IOMMU at %s\n",
++              dev_name(&iommu->dev->dev));
++
++      /* Clear the enable writing bit */
++      pci_write_config_dword(iommu->dev, 0xf0, 0x90);
++}
++
++/*
+  * This function clues the initialization function for one IOMMU
+  * together and also allocates the command buffer and programs the
+  * hardware. It does NOT enable the IOMMU. This is done afterwards.
+@@ -1172,6 +1204,8 @@ static int iommu_init_pci(struct amd_iom
+                       iommu->stored_l2[i] = iommu_read_l2(iommu, i);
+       }
+ 
++      amd_iommu_erratum_746_workaround(iommu);
++
+       return pci_enable_device(iommu->dev);
+ }
+ 

diff --git a/queue-3.7/radeon_display-use-pointer-return-error-codes.patch b/queue-3.7/radeon_display-use-pointer-return-error-codes.patch
new file mode 100644 (file)
index 0000000..3878d34
--- /dev/null
+++ b/queue-3.7/radeon_display-use-pointer-return-error-codes.patch
@@ -0,0 +1,31 @@
+From b2f4b03f8a378cd626d2ea67d19e7470c050a098 Mon Sep 17 00:00:00 2001
+From: xueminsu <xuemin.su@intel.com>
+Date: Tue, 22 Jan 2013 22:16:53 +0800
+Subject: radeon_display: Use pointer return error codes
+
+From: xueminsu <xuemin.su@intel.com>
+
+commit b2f4b03f8a378cd626d2ea67d19e7470c050a098 upstream.
+
+drm_mode_addfb() expects fb_create return error code
+instead of NULL.
+
+Signed-off-by: xueminsu <xuemin.su@intel.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/radeon_display.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/radeon/radeon_display.c
++++ b/drivers/gpu/drm/radeon/radeon_display.c
+@@ -1118,7 +1118,7 @@ radeon_user_framebuffer_create(struct dr
+       if (ret) {
+               kfree(radeon_fb);
+               drm_gem_object_unreference_unlocked(obj);
+-              return NULL;
++              return ERR_PTR(ret);
+       }
+ 
+       return &radeon_fb->base;

diff --git a/queue-3.7/series b/queue-3.7/series
index 3df0001ab5a794387269ce8f7a2652a68cea9c5d..0bdc3348c606c14d234ea3e2219345e911086b92 100644 (file)
--- a/queue-3.7/series
+++ b/queue-3.7/series
@@ -16,3 +16,6 @@ arm-virt-simplify-__hyp_stub_install-epilog.patch
 mfd-tc3589x-use-simple-irqdomain.patch
 bluetooth-fix-sending-hci-commands-after-reset.patch
 drm-radeon-fix-cursor-corruption-on-dce6-and-newer.patch
+radeon_display-use-pointer-return-error-codes.patch
+iommu-amd-family15h-model10-1fh-erratum-746-workaround.patch
+xfs-fix-possible-use-after-free-with-aio.patch

diff --git a/queue-3.7/xfs-fix-possible-use-after-free-with-aio.patch b/queue-3.7/xfs-fix-possible-use-after-free-with-aio.patch
new file mode 100644 (file)
index 0000000..2e56161
--- /dev/null
+++ b/queue-3.7/xfs-fix-possible-use-after-free-with-aio.patch
@@ -0,0 +1,40 @@
+From 4b05d09c18d9aa62d2e7fb4b057f54e5a38963f5 Mon Sep 17 00:00:00 2001
+From: Jan Kara <jack@suse.cz>
+Date: Wed, 23 Jan 2013 13:56:18 +0100
+Subject: xfs: Fix possible use-after-free with AIO
+
+From: Jan Kara <jack@suse.cz>
+
+commit 4b05d09c18d9aa62d2e7fb4b057f54e5a38963f5 upstream.
+
+Running AIO is pinning inode in memory using file reference. Once AIO
+is completed using aio_complete(), file reference is put and inode can
+be freed from memory. So we have to be sure that calling aio_complete()
+is the last thing we do with the inode.
+
+Signed-off-by: Jan Kara <jack@suse.cz>
+CC: xfs@oss.sgi.com
+CC: Ben Myers <bpm@sgi.com>
+Reviewed-by: Ben Myers <bpm@sgi.com>
+Signed-off-by: Ben Myers <bpm@sgi.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/xfs/xfs_aops.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/xfs/xfs_aops.c
++++ b/fs/xfs/xfs_aops.c
+@@ -86,11 +86,11 @@ xfs_destroy_ioend(
+       }
+ 
+       if (ioend->io_iocb) {
++              inode_dio_done(ioend->io_inode);
+               if (ioend->io_isasync) {
+                       aio_complete(ioend->io_iocb, ioend->io_error ?
+                                       ioend->io_error : ioend->io_result, 0);
+               }
+-              inode_dio_done(ioend->io_inode);
+       }
+ 
+       mempool_free(ioend, xfs_ioend_pool);