From: Greg Kroah-Hartman Date: Wed, 30 Jan 2013 09:26:17 +0000 (+0100) Subject: 3.7-stable patches X-Git-Tag: v3.0.62~30 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=7a52ca6fce504a284831bd0af56ac1f571571186;p=thirdparty%2Fkernel%2Fstable-queue.git 3.7-stable patches added patches: iommu-amd-family15h-model10-1fh-erratum-746-workaround.patch radeon_display-use-pointer-return-error-codes.patch xfs-fix-possible-use-after-free-with-aio.patch --- diff --git a/queue-3.7/iommu-amd-family15h-model10-1fh-erratum-746-workaround.patch b/queue-3.7/iommu-amd-family15h-model10-1fh-erratum-746-workaround.patch new file mode 100644 index 00000000000..ec5f5c381c2 --- /dev/null +++ b/queue-3.7/iommu-amd-family15h-model10-1fh-erratum-746-workaround.patch @@ -0,0 +1,78 @@ +From 318fe782539c4150d1b8e4e6c9dc3a896512cb8a Mon Sep 17 00:00:00 2001 +From: Suravee Suthikulpanit +Date: Thu, 24 Jan 2013 13:17:53 -0600 +Subject: IOMMU, AMD Family15h Model10-1Fh erratum 746 Workaround + +From: Suravee Suthikulpanit + +commit 318fe782539c4150d1b8e4e6c9dc3a896512cb8a upstream. + +The IOMMU may stop processing page translations due to a perceived lack +of credits for writing upstream peripheral page service request (PPR) +or event logs. If the L2B miscellaneous clock gating feature is enabled +the IOMMU does not properly register credits after the log request has +completed, leading to a potential system hang. + +BIOSes are supposed to disable L2B micellaneous clock gating by setting +L2_L2B_CK_GATE_CONTROL[CKGateL2BMiscDisable](D0F2xF4_x90[2]) = 1b. This +patch corrects that for those which do not enable this workaround. + +Signed-off-by: Suravee Suthikulpanit +Acked-by: Borislav Petkov +Signed-off-by: Joerg Roedel +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iommu/amd_iommu_init.c | 34 ++++++++++++++++++++++++++++++++++ + 1 file changed, 34 insertions(+) + +--- a/drivers/iommu/amd_iommu_init.c ++++ b/drivers/iommu/amd_iommu_init.c +@@ -975,6 +975,38 @@ static void __init free_iommu_all(void) + } + + /* ++ * Family15h Model 10h-1fh erratum 746 (IOMMU Logging May Stall Translations) ++ * Workaround: ++ * BIOS should disable L2B micellaneous clock gating by setting ++ * L2_L2B_CK_GATE_CONTROL[CKGateL2BMiscDisable](D0F2xF4_x90[2]) = 1b ++ */ ++static void __init amd_iommu_erratum_746_workaround(struct amd_iommu *iommu) ++{ ++ u32 value; ++ ++ if ((boot_cpu_data.x86 != 0x15) || ++ (boot_cpu_data.x86_model < 0x10) || ++ (boot_cpu_data.x86_model > 0x1f)) ++ return; ++ ++ pci_write_config_dword(iommu->dev, 0xf0, 0x90); ++ pci_read_config_dword(iommu->dev, 0xf4, &value); ++ ++ if (value & BIT(2)) ++ return; ++ ++ /* Select NB indirect register 0x90 and enable writing */ ++ pci_write_config_dword(iommu->dev, 0xf0, 0x90 | (1 << 8)); ++ ++ pci_write_config_dword(iommu->dev, 0xf4, value | 0x4); ++ pr_info("AMD-Vi: Applying erratum 746 workaround for IOMMU at %s\n", ++ dev_name(&iommu->dev->dev)); ++ ++ /* Clear the enable writing bit */ ++ pci_write_config_dword(iommu->dev, 0xf0, 0x90); ++} ++ ++/* + * This function clues the initialization function for one IOMMU + * together and also allocates the command buffer and programs the + * hardware. It does NOT enable the IOMMU. This is done afterwards. +@@ -1172,6 +1204,8 @@ static int iommu_init_pci(struct amd_iom + iommu->stored_l2[i] = iommu_read_l2(iommu, i); + } + ++ amd_iommu_erratum_746_workaround(iommu); ++ + return pci_enable_device(iommu->dev); + } + diff --git a/queue-3.7/radeon_display-use-pointer-return-error-codes.patch b/queue-3.7/radeon_display-use-pointer-return-error-codes.patch new file mode 100644 index 00000000000..3878d343559 --- /dev/null +++ b/queue-3.7/radeon_display-use-pointer-return-error-codes.patch @@ -0,0 +1,31 @@ +From b2f4b03f8a378cd626d2ea67d19e7470c050a098 Mon Sep 17 00:00:00 2001 +From: xueminsu +Date: Tue, 22 Jan 2013 22:16:53 +0800 +Subject: radeon_display: Use pointer return error codes + +From: xueminsu + +commit b2f4b03f8a378cd626d2ea67d19e7470c050a098 upstream. + +drm_mode_addfb() expects fb_create return error code +instead of NULL. + +Signed-off-by: xueminsu +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/radeon/radeon_display.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/radeon/radeon_display.c ++++ b/drivers/gpu/drm/radeon/radeon_display.c +@@ -1118,7 +1118,7 @@ radeon_user_framebuffer_create(struct dr + if (ret) { + kfree(radeon_fb); + drm_gem_object_unreference_unlocked(obj); +- return NULL; ++ return ERR_PTR(ret); + } + + return &radeon_fb->base; diff --git a/queue-3.7/series b/queue-3.7/series index 3df0001ab5a..0bdc3348c60 100644 --- a/queue-3.7/series +++ b/queue-3.7/series @@ -16,3 +16,6 @@ arm-virt-simplify-__hyp_stub_install-epilog.patch mfd-tc3589x-use-simple-irqdomain.patch bluetooth-fix-sending-hci-commands-after-reset.patch drm-radeon-fix-cursor-corruption-on-dce6-and-newer.patch +radeon_display-use-pointer-return-error-codes.patch +iommu-amd-family15h-model10-1fh-erratum-746-workaround.patch +xfs-fix-possible-use-after-free-with-aio.patch diff --git a/queue-3.7/xfs-fix-possible-use-after-free-with-aio.patch b/queue-3.7/xfs-fix-possible-use-after-free-with-aio.patch new file mode 100644 index 00000000000..2e56161082a --- /dev/null +++ b/queue-3.7/xfs-fix-possible-use-after-free-with-aio.patch @@ -0,0 +1,40 @@ +From 4b05d09c18d9aa62d2e7fb4b057f54e5a38963f5 Mon Sep 17 00:00:00 2001 +From: Jan Kara +Date: Wed, 23 Jan 2013 13:56:18 +0100 +Subject: xfs: Fix possible use-after-free with AIO + +From: Jan Kara + +commit 4b05d09c18d9aa62d2e7fb4b057f54e5a38963f5 upstream. + +Running AIO is pinning inode in memory using file reference. Once AIO +is completed using aio_complete(), file reference is put and inode can +be freed from memory. So we have to be sure that calling aio_complete() +is the last thing we do with the inode. + +Signed-off-by: Jan Kara +CC: xfs@oss.sgi.com +CC: Ben Myers +Reviewed-by: Ben Myers +Signed-off-by: Ben Myers +Signed-off-by: Greg Kroah-Hartman + +--- + fs/xfs/xfs_aops.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/xfs/xfs_aops.c ++++ b/fs/xfs/xfs_aops.c +@@ -86,11 +86,11 @@ xfs_destroy_ioend( + } + + if (ioend->io_iocb) { ++ inode_dio_done(ioend->io_inode); + if (ioend->io_isasync) { + aio_complete(ioend->io_iocb, ioend->io_error ? + ioend->io_error : ioend->io_result, 0); + } +- inode_dio_done(ioend->io_inode); + } + + mempool_free(ioend, xfs_ioend_pool);