--- /dev/null
+From 876fbba1db4a377f050a2bb49b474c7527b2995d Mon Sep 17 00:00:00 2001
+From: Mike Snitzer <snitzer@redhat.com>
+Date: Sun, 25 Sep 2011 23:26:17 +0100
+Subject: dm table: avoid crash if integrity profile changes
+
+From: Mike Snitzer <snitzer@redhat.com>
+
+commit 876fbba1db4a377f050a2bb49b474c7527b2995d upstream.
+
+Commit a63a5cf (dm: improve block integrity support) introduced a
+two-phase initialization of a DM device's integrity profile. This
+patch avoids dereferencing a NULL 'template_disk' pointer in
+blk_integrity_register() if there is an integrity profile mismatch in
+dm_table_set_integrity().
+
+This can occur if the integrity profiles for stacked devices in a DM
+table are changed between the call to dm_table_prealloc_integrity() and
+dm_table_set_integrity().
+
+Reported-by: Zdenek Kabelac <zkabelac@redhat.com>
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Alasdair G Kergon <agk@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/dm-table.c | 13 +++++++------
+ 1 file changed, 7 insertions(+), 6 deletions(-)
+
+--- a/drivers/md/dm-table.c
++++ b/drivers/md/dm-table.c
+@@ -1184,14 +1184,15 @@ static void dm_table_set_integrity(struc
+ return;
+
+ template_disk = dm_table_get_integrity_disk(t, true);
+- if (!template_disk &&
+- blk_integrity_is_initialized(dm_disk(t->md))) {
++ if (template_disk)
++ blk_integrity_register(dm_disk(t->md),
++ blk_get_integrity(template_disk));
++ else if (blk_integrity_is_initialized(dm_disk(t->md)))
+ DMWARN("%s: device no longer has a valid integrity profile",
+ dm_device_name(t->md));
+- return;
+- }
+- blk_integrity_register(dm_disk(t->md),
+- blk_get_integrity(template_disk));
++ else
++ DMWARN("%s: unable to establish an integrity profile",
++ dm_device_name(t->md));
+ }
+
+ void dm_table_set_restrictions(struct dm_table *t, struct request_queue *q,
--- /dev/null
+From 5307f6d5fb12fd01f9f321bc4a8fd77e74858647 Mon Sep 17 00:00:00 2001
+From: Shyam Iyer <shyam.iyer.t@gmail.com>
+Date: Thu, 8 Sep 2011 16:41:17 -0500
+Subject: Fix pointer dereference before call to pcie_bus_configure_settings
+
+From: Shyam Iyer <shyam.iyer.t@gmail.com>
+
+commit 5307f6d5fb12fd01f9f321bc4a8fd77e74858647 upstream.
+
+Commit b03e7495a862 ("PCI: Set PCI-E Max Payload Size on fabric")
+introduced a potential NULL pointer dereference in calls to
+pcie_bus_configure_settings due to attempts to access pci_bus self
+variables when the self pointer is NULL.
+
+To correct this, verify that the self pointer in pci_bus is non-NULL
+before dereferencing it.
+
+Reported-by: Stanislaw Gruszka <sgruszka@redhat.com>
+Signed-off-by: Shyam Iyer <shyam_iyer@dell.com>
+Signed-off-by: Jon Mason <mason@myri.com>
+Acked-by: Jesse Barnes <jbarnes@virtuousgeek.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/pci/acpi.c | 9 +++++++--
+ drivers/pci/hotplug/pcihp_slot.c | 4 +++-
+ drivers/pci/probe.c | 3 ---
+ 3 files changed, 10 insertions(+), 6 deletions(-)
+
+--- a/arch/x86/pci/acpi.c
++++ b/arch/x86/pci/acpi.c
+@@ -366,8 +366,13 @@ struct pci_bus * __devinit pci_acpi_scan
+ */
+ if (bus) {
+ struct pci_bus *child;
+- list_for_each_entry(child, &bus->children, node)
+- pcie_bus_configure_settings(child, child->self->pcie_mpss);
++ list_for_each_entry(child, &bus->children, node) {
++ struct pci_dev *self = child->self;
++ if (!self)
++ continue;
++
++ pcie_bus_configure_settings(child, self->pcie_mpss);
++ }
+ }
+
+ if (!bus)
+--- a/drivers/pci/hotplug/pcihp_slot.c
++++ b/drivers/pci/hotplug/pcihp_slot.c
+@@ -169,7 +169,9 @@ void pci_configure_slot(struct pci_dev *
+ (dev->class >> 8) == PCI_CLASS_BRIDGE_PCI)))
+ return;
+
+- pcie_bus_configure_settings(dev->bus, dev->bus->self->pcie_mpss);
++ if (dev->bus && dev->bus->self)
++ pcie_bus_configure_settings(dev->bus,
++ dev->bus->self->pcie_mpss);
+
+ memset(&hpp, 0, sizeof(hpp));
+ ret = pci_get_hp_params(dev, &hpp);
+--- a/drivers/pci/probe.c
++++ b/drivers/pci/probe.c
+@@ -1461,9 +1461,6 @@ void pcie_bus_configure_settings(struct
+ {
+ u8 smpss = mpss;
+
+- if (!bus->self)
+- return;
+-
+ if (!pci_is_pcie(bus->self))
+ return;
+
--- /dev/null
+From a73914c35b05d80f8ce78288e10056c91090b666 Mon Sep 17 00:00:00 2001
+From: Mark Salyzyn <mark_salyzyn@us.xyratex.com>
+Date: Thu, 22 Sep 2011 08:32:23 -0700
+Subject: [SCSI] libsas: fix panic when single phy is disabled on a wide port
+
+From: Mark Salyzyn <mark_salyzyn@us.xyratex.com>
+
+commit a73914c35b05d80f8ce78288e10056c91090b666 upstream.
+
+When a wide port is being utilized to a target, if one disables only one
+of the
+phys, we get an OS crash:
+
+BUG: unable to handle kernel NULL pointer dereference at
+0000000000000238
+IP: [<ffffffff814ca9b1>] mutex_lock+0x21/0x50
+PGD 4103f5067 PUD 41dba9067 PMD 0
+Oops: 0002 [#1] SMP
+last sysfs file: /sys/bus/pci/slots/5/address
+CPU 0
+Modules linked in: pm8001(U) ses enclosure fuse nfsd exportfs autofs4
+ipmi_devintf ipmi_si ipmi_msghandler nfs lockd fscache nfs_acl
+auth_rpcgss 8021q fcoe libfcoe garp libfc scsi_transport_fc stp scsi_tgt
+llc sunrpc cpufreq_ondemand acpi_cpufreq freq_table ipv6 sr_mod cdrom
+dm_mirror dm_region_hash dm_log uinput sg i2c_i801 i2c_core iTCO_wdt
+iTCO_vendor_support e1000e mlx4_ib ib_mad ib_core mlx4_en mlx4_core ext3
+jbd mbcache sd_mod crc_t10dif usb_storage ata_generic pata_acpi ata_piix
+libsas(U) scsi_transport_sas dm_mod [last unloaded: pm8001]
+
+Modules linked in: pm8001(U) ses enclosure fuse nfsd exportfs autofs4
+ipmi_devintf ipmi_si ipmi_msghandler nfs lockd fscache nfs_acl
+auth_rpcgss 8021q fcoe libfcoe garp libfc scsi_transport_fc stp scsi_tgt
+llc sunrpc cpufreq_ondemand acpi_cpufreq freq_table ipv6 sr_mod cdrom
+dm_mirror dm_region_hash dm_log uinput sg i2c_i801 i2c_core iTCO_wdt
+iTCO_vendor_support e1000e mlx4_ib ib_mad ib_core mlx4_en mlx4_core ext3
+jbd mbcache sd_mod crc_t10dif usb_storage ata_generic pata_acpi ata_piix
+libsas(U) scsi_transport_sas dm_mod [last unloaded: pm8001]
+Pid: 5146, comm: scsi_wq_5 Not tainted
+2.6.32-71.29.1.el6.lustre.7.x86_64 #1 Storage Server
+RIP: 0010:[<ffffffff814ca9b1>] [<ffffffff814ca9b1>]
+mutex_lock+0x21/0x50
+RSP: 0018:ffff8803e4e33d30 EFLAGS: 00010246
+RAX: 0000000000000000 RBX: 0000000000000238 RCX: 0000000000000000
+RDX: 0000000000000000 RSI: ffff8803e664c800 RDI: 0000000000000238
+RBP: ffff8803e4e33d40 R08: 0000000000000000 R09: 0000000000000000
+R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000000
+R13: 0000000000000238 R14: ffff88041acb7200 R15: ffff88041c51ada0
+FS: 0000000000000000(0000) GS:ffff880028200000(0000)
+knlGS:0000000000000000
+CS: 0010 DS: 0018 ES: 0018 CR0: 000000008005003b
+CR2: 0000000000000238 CR3: 0000000410143000 CR4: 00000000000006f0
+DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
+Process scsi_wq_5 (pid: 5146, threadinfo ffff8803e4e32000, task
+ffff8803e4e294a0)
+Stack:
+ ffff8803e664c800 0000000000000000 ffff8803e4e33d70 ffffffffa001f06e
+<0> ffff8803e4e33d60 ffff88041c51ada0 ffff88041acb7200 ffff88041bc0aa00
+<0> ffff8803e4e33d90 ffffffffa0032b6c 0000000000000014 ffff88041acb7200
+Call Trace:
+ [<ffffffffa001f06e>] sas_port_delete_phy+0x2e/0xa0 [scsi_transport_sas]
+ [<ffffffffa0032b6c>] sas_unregister_devs_sas_addr+0xac/0xe0 [libsas]
+ [<ffffffffa0034914>] sas_ex_revalidate_domain+0x204/0x330 [libsas]
+ [<ffffffffa00307f0>] ? sas_revalidate_domain+0x0/0x90 [libsas]
+ [<ffffffffa0030855>] sas_revalidate_domain+0x65/0x90 [libsas]
+ [<ffffffff8108c7d0>] worker_thread+0x170/0x2a0
+ [<ffffffff81091ea0>] ? autoremove_wake_function+0x0/0x40
+ [<ffffffff8108c660>] ? worker_thread+0x0/0x2a0
+ [<ffffffff81091b36>] kthread+0x96/0xa0
+ [<ffffffff810141ca>] child_rip+0xa/0x20
+ [<ffffffff81091aa0>] ? kthread+0x0/0xa0
+ [<ffffffff810141c0>] ? child_rip+0x0/0x20
+Code: ff ff 85 c0 75 ed eb d6 66 90 55 48 89 e5 48 83 ec 10 48 89 1c 24
+4c 89 64 24 08 0f 1f 44 00 00 48 89 fb e8 92 f4 ff ff 48 89 df <f0> ff
+0f 79 05 e8 25 00 00 00 65 48 8b 04 25 08 cc 00 00 48 2d
+RIP [<ffffffff814ca9b1>] mutex_lock+0x21/0x50
+ RSP <ffff8803e4e33d30>
+CR2: 0000000000000238
+
+The following patch is admittedly a band-aid, and does not solve the
+root cause, but it still is a good candidate for hardening as a pointer
+check before reference.
+
+Signed-off-by: Mark Salyzyn <mark_salyzyn@us.xyratex.com>
+Tested-by: Jack Wang <jack_wang@usish.com>
+Signed-off-by: James Bottomley <JBottomley@Parallels.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/scsi/libsas/sas_expander.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+--- a/drivers/scsi/libsas/sas_expander.c
++++ b/drivers/scsi/libsas/sas_expander.c
+@@ -1769,10 +1769,12 @@ static void sas_unregister_devs_sas_addr
+ sas_disable_routing(parent, phy->attached_sas_addr);
+ }
+ memset(phy->attached_sas_addr, 0, SAS_ADDR_SIZE);
+- sas_port_delete_phy(phy->port, phy->phy);
+- if (phy->port->num_phys == 0)
+- sas_port_delete(phy->port);
+- phy->port = NULL;
++ if (phy->port) {
++ sas_port_delete_phy(phy->port, phy->phy);
++ if (phy->port->num_phys == 0)
++ sas_port_delete(phy->port);
++ phy->port = NULL;
++ }
+ }
+
+ static int sas_discover_bfs_by_root_level(struct domain_device *root,
--- /dev/null
+From 01f96c0a9922cd9919baf9d16febdf7016177a12 Mon Sep 17 00:00:00 2001
+From: NeilBrown <neilb@suse.de>
+Date: Wed, 21 Sep 2011 15:30:20 +1000
+Subject: md: Avoid waking up a thread after it has been freed.
+
+From: NeilBrown <neilb@suse.de>
+
+commit 01f96c0a9922cd9919baf9d16febdf7016177a12 upstream.
+
+Two related problems:
+
+1/ some error paths call "md_unregister_thread(mddev->thread)"
+ without subsequently clearing ->thread. A subsequent call
+ to mddev_unlock will try to wake the thread, and crash.
+
+2/ Most calls to md_wakeup_thread are protected against the thread
+ disappeared either by:
+ - holding the ->mutex
+ - having an active request, so something else must be keeping
+ the array active.
+ However mddev_unlock calls md_wakeup_thread after dropping the
+ mutex and without any certainty of an active request, so the
+ ->thread could theoretically disappear.
+ So we need a spinlock to provide some protections.
+
+So change md_unregister_thread to take a pointer to the thread
+pointer, and ensure that it always does the required locking, and
+clears the pointer properly.
+
+Reported-by: "Moshe Melnikov" <moshe@zadarastorage.com>
+Signed-off-by: NeilBrown <neilb@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/md.c | 22 +++++++++++++++++++---
+ drivers/md/md.h | 2 +-
+ drivers/md/multipath.c | 3 +--
+ drivers/md/raid1.c | 3 +--
+ drivers/md/raid10.c | 5 ++---
+ drivers/md/raid5.c | 6 ++----
+ 6 files changed, 26 insertions(+), 15 deletions(-)
+
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -61,6 +61,11 @@
+ static void autostart_arrays(int part);
+ #endif
+
++/* pers_list is a list of registered personalities protected
++ * by pers_lock.
++ * pers_lock does extra service to protect accesses to
++ * mddev->thread when the mutex cannot be held.
++ */
+ static LIST_HEAD(pers_list);
+ static DEFINE_SPINLOCK(pers_lock);
+
+@@ -690,7 +695,12 @@ static void mddev_unlock(mddev_t * mddev
+ } else
+ mutex_unlock(&mddev->reconfig_mutex);
+
++ /* was we've dropped the mutex we need a spinlock to
++ * make sur the thread doesn't disappear
++ */
++ spin_lock(&pers_lock);
+ md_wakeup_thread(mddev->thread);
++ spin_unlock(&pers_lock);
+ }
+
+ static mdk_rdev_t * find_rdev_nr(mddev_t *mddev, int nr)
+@@ -6186,11 +6196,18 @@ mdk_thread_t *md_register_thread(void (*
+ return thread;
+ }
+
+-void md_unregister_thread(mdk_thread_t *thread)
++void md_unregister_thread(mdk_thread_t **threadp)
+ {
++ mdk_thread_t *thread = *threadp;
+ if (!thread)
+ return;
+ dprintk("interrupting MD-thread pid %d\n", task_pid_nr(thread->tsk));
++ /* Locking ensures that mddev_unlock does not wake_up a
++ * non-existent thread
++ */
++ spin_lock(&pers_lock);
++ *threadp = NULL;
++ spin_unlock(&pers_lock);
+
+ kthread_stop(thread->tsk);
+ kfree(thread);
+@@ -7125,8 +7142,7 @@ static void reap_sync_thread(mddev_t *md
+ mdk_rdev_t *rdev;
+
+ /* resync has finished, collect result */
+- md_unregister_thread(mddev->sync_thread);
+- mddev->sync_thread = NULL;
++ md_unregister_thread(&mddev->sync_thread);
+ if (!test_bit(MD_RECOVERY_INTR, &mddev->recovery) &&
+ !test_bit(MD_RECOVERY_REQUESTED, &mddev->recovery)) {
+ /* success...*/
+--- a/drivers/md/md.h
++++ b/drivers/md/md.h
+@@ -475,7 +475,7 @@ extern int register_md_personality(struc
+ extern int unregister_md_personality(struct mdk_personality *p);
+ extern mdk_thread_t * md_register_thread(void (*run) (mddev_t *mddev),
+ mddev_t *mddev, const char *name);
+-extern void md_unregister_thread(mdk_thread_t *thread);
++extern void md_unregister_thread(mdk_thread_t **threadp);
+ extern void md_wakeup_thread(mdk_thread_t *thread);
+ extern void md_check_recovery(mddev_t *mddev);
+ extern void md_write_start(mddev_t *mddev, struct bio *bi);
+--- a/drivers/md/multipath.c
++++ b/drivers/md/multipath.c
+@@ -514,8 +514,7 @@ static int multipath_stop (mddev_t *mdde
+ {
+ multipath_conf_t *conf = mddev->private;
+
+- md_unregister_thread(mddev->thread);
+- mddev->thread = NULL;
++ md_unregister_thread(&mddev->thread);
+ blk_sync_queue(mddev->queue); /* the unplug fn references 'conf'*/
+ mempool_destroy(conf->pool);
+ kfree(conf->multipaths);
+--- a/drivers/md/raid1.c
++++ b/drivers/md/raid1.c
+@@ -2045,8 +2045,7 @@ static int stop(mddev_t *mddev)
+ raise_barrier(conf);
+ lower_barrier(conf);
+
+- md_unregister_thread(mddev->thread);
+- mddev->thread = NULL;
++ md_unregister_thread(&mddev->thread);
+ if (conf->r1bio_pool)
+ mempool_destroy(conf->r1bio_pool);
+ kfree(conf->mirrors);
+--- a/drivers/md/raid10.c
++++ b/drivers/md/raid10.c
+@@ -2331,7 +2331,7 @@ static int run(mddev_t *mddev)
+ return 0;
+
+ out_free_conf:
+- md_unregister_thread(mddev->thread);
++ md_unregister_thread(&mddev->thread);
+ if (conf->r10bio_pool)
+ mempool_destroy(conf->r10bio_pool);
+ safe_put_page(conf->tmppage);
+@@ -2349,8 +2349,7 @@ static int stop(mddev_t *mddev)
+ raise_barrier(conf, 0);
+ lower_barrier(conf);
+
+- md_unregister_thread(mddev->thread);
+- mddev->thread = NULL;
++ md_unregister_thread(&mddev->thread);
+ blk_sync_queue(mddev->queue); /* the unplug fn references 'conf'*/
+ if (conf->r10bio_pool)
+ mempool_destroy(conf->r10bio_pool);
+--- a/drivers/md/raid5.c
++++ b/drivers/md/raid5.c
+@@ -5162,8 +5162,7 @@ static int run(mddev_t *mddev)
+
+ return 0;
+ abort:
+- md_unregister_thread(mddev->thread);
+- mddev->thread = NULL;
++ md_unregister_thread(&mddev->thread);
+ if (conf) {
+ print_raid5_conf(conf);
+ free_conf(conf);
+@@ -5177,8 +5176,7 @@ static int stop(mddev_t *mddev)
+ {
+ raid5_conf_t *conf = mddev->private;
+
+- md_unregister_thread(mddev->thread);
+- mddev->thread = NULL;
++ md_unregister_thread(&mddev->thread);
+ if (mddev->queue)
+ mddev->queue->backing_dev_info.congested_fn = NULL;
+ free_conf(conf);
--- /dev/null
+From 5f39e6705faade2e89d119958a8c51b9b6e2c53c Mon Sep 17 00:00:00 2001
+From: Jon Mason <mason@myri.com>
+Date: Mon, 3 Oct 2011 09:50:20 -0500
+Subject: PCI: Disable MPS configuration by default
+
+From: Jon Mason <mason@myri.com>
+
+commit 5f39e6705faade2e89d119958a8c51b9b6e2c53c upstream.
+
+Add the ability to disable PCI-E MPS turning and using the BIOS
+configured MPS defaults. Due to the number of issues recently
+discovered on some x86 chipsets, make this the default behavior.
+
+Also, add the option for peer to peer DMA MPS configuration. Peer to
+peer DMA is outside the scope of this patch, but MPS configuration could
+prevent it from working by having the MPS on one root port different
+than the MPS on another. To work around this, simply make the system
+wide MPS the smallest possible value (128B).
+
+Signed-off-by: Jon Mason <mason@myri.com>
+Acked-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/pci/pci.c | 6 +++++-
+ drivers/pci/probe.c | 14 +++++++++++++-
+ include/linux/pci.h | 3 ++-
+ 3 files changed, 20 insertions(+), 3 deletions(-)
+
+--- a/drivers/pci/pci.c
++++ b/drivers/pci/pci.c
+@@ -77,7 +77,7 @@ unsigned long pci_cardbus_mem_size = DEF
+ unsigned long pci_hotplug_io_size = DEFAULT_HOTPLUG_IO_SIZE;
+ unsigned long pci_hotplug_mem_size = DEFAULT_HOTPLUG_MEM_SIZE;
+
+-enum pcie_bus_config_types pcie_bus_config = PCIE_BUS_SAFE;
++enum pcie_bus_config_types pcie_bus_config = PCIE_BUS_TUNE_OFF;
+
+ /*
+ * The default CLS is used if arch didn't set CLS explicitly and not
+@@ -3568,10 +3568,14 @@ static int __init pci_setup(char *str)
+ pci_hotplug_io_size = memparse(str + 9, &str);
+ } else if (!strncmp(str, "hpmemsize=", 10)) {
+ pci_hotplug_mem_size = memparse(str + 10, &str);
++ } else if (!strncmp(str, "pcie_bus_tune_off", 17)) {
++ pcie_bus_config = PCIE_BUS_TUNE_OFF;
+ } else if (!strncmp(str, "pcie_bus_safe", 13)) {
+ pcie_bus_config = PCIE_BUS_SAFE;
+ } else if (!strncmp(str, "pcie_bus_perf", 13)) {
+ pcie_bus_config = PCIE_BUS_PERFORMANCE;
++ } else if (!strncmp(str, "pcie_bus_peer2peer", 18)) {
++ pcie_bus_config = PCIE_BUS_PEER2PEER;
+ } else {
+ printk(KERN_ERR "PCI: Unknown option `%s'\n",
+ str);
+--- a/drivers/pci/probe.c
++++ b/drivers/pci/probe.c
+@@ -1459,12 +1459,24 @@ static int pcie_bus_configure_set(struct
+ */
+ void pcie_bus_configure_settings(struct pci_bus *bus, u8 mpss)
+ {
+- u8 smpss = mpss;
++ u8 smpss;
+
+ if (!pci_is_pcie(bus->self))
+ return;
+
++ if (pcie_bus_config == PCIE_BUS_TUNE_OFF)
++ return;
++
++ /* FIXME - Peer to peer DMA is possible, though the endpoint would need
++ * to be aware to the MPS of the destination. To work around this,
++ * simply force the MPS of the entire system to the smallest possible.
++ */
++ if (pcie_bus_config == PCIE_BUS_PEER2PEER)
++ smpss = 0;
++
+ if (pcie_bus_config == PCIE_BUS_SAFE) {
++ smpss = mpss;
++
+ pcie_find_smpss(bus->self, &smpss);
+ pci_walk_bus(bus, pcie_find_smpss, &smpss);
+ }
+--- a/include/linux/pci.h
++++ b/include/linux/pci.h
+@@ -621,8 +621,9 @@ struct pci_driver {
+ extern void pcie_bus_configure_settings(struct pci_bus *bus, u8 smpss);
+
+ enum pcie_bus_config_types {
+- PCIE_BUS_PERFORMANCE,
++ PCIE_BUS_TUNE_OFF,
+ PCIE_BUS_SAFE,
++ PCIE_BUS_PERFORMANCE,
+ PCIE_BUS_PEER2PEER,
+ };
+
--- /dev/null
+From 9bfacd01dc9b7519e1e6da12b01963550b9d09a2 Mon Sep 17 00:00:00 2001
+From: Roland Dreier <roland@purestorage.com>
+Date: Thu, 22 Sep 2011 00:06:05 -0700
+Subject: [SCSI] qla2xxx: Fix crash in qla2x00_abort_all_cmds() on unload
+
+From: Roland Dreier <roland@purestorage.com>
+
+commit 9bfacd01dc9b7519e1e6da12b01963550b9d09a2 upstream.
+
+I hit a crash in qla2x00_abort_all_cmds() if the qla2xxx module is
+unloaded right after it is loaded. I debugged this down to the abort
+handling improperly treating a command of type SRB_ADISC_CMD as if it
+had a bsg_job to complete when that command actually uses the iocb_cmd
+part of the union. (I guess to hit this one has to unload the module
+while the async FC initialization is still in progress)
+
+It seems we should only look for a bsg_job if type is SRB_ELS_CMD_RPT,
+SRB_ELS_CMD_HST or SRB_CT_CMD, so switch the test to make that explicit.
+
+Signed-off-by: Roland Dreier <roland@purestorage.com>
+Acked-by: Chad Dupuis <chad.dupuis@qlogic.com>
+Signed-off-by: James Bottomley <JBottomley@Parallels.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/scsi/qla2xxx/qla_os.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+--- a/drivers/scsi/qla2xxx/qla_os.c
++++ b/drivers/scsi/qla2xxx/qla_os.c
+@@ -1240,10 +1240,9 @@ qla2x00_abort_all_cmds(scsi_qla_host_t *
+ qla2x00_sp_compl(ha, sp);
+ } else {
+ ctx = sp->ctx;
+- if (ctx->type == SRB_LOGIN_CMD ||
+- ctx->type == SRB_LOGOUT_CMD) {
+- ctx->u.iocb_cmd->free(sp);
+- } else {
++ if (ctx->type == SRB_ELS_CMD_RPT ||
++ ctx->type == SRB_ELS_CMD_HST ||
++ ctx->type == SRB_CT_CMD) {
+ struct fc_bsg_job *bsg_job =
+ ctx->u.bsg_job;
+ if (bsg_job->request->msgcode
+@@ -1255,6 +1254,8 @@ qla2x00_abort_all_cmds(scsi_qla_host_t *
+ kfree(sp->ctx);
+ mempool_free(sp,
+ ha->srb_mempool);
++ } else {
++ ctx->u.iocb_cmd->free(sp);
+ }
+ }
+ }
+# do we really want these 6 PCI patches for 3.0?
pci-set-pci-e-max-payload-size-on-fabric.patch
pci-export-pcie_bus_configure_settings-symbol.patch
pci-remove-mrrs-modification-from-mps-setting-code.patch
pci-don-t-crash-when-reading-mpss-from-root-complex.patch
-sparc64-force-the-execute-bit-in-openfirmware-s-translation-entries.patch
+fix-pointer-dereference-before-call-to.patch
+pci-disable-mps-configuration-by-default.patch
+sparc64-force-the-execute-bit-in-openfirmware-s-translation-entries.patch
sched-rt-migrate-equal-priority-tasks-to-available-cpus.patch
sched-fix-up-wchan-borkage.patch
ide-disk-fix-request-requeuing.patch
drm-radeon-kms-fix-channel_remap-setup-v2.patch
ptp-fix-l2-event-message-recognition.patch
rt2x00-serialize-tx-operations-on-a-queue.patch
+x86-pci-use-host-bridge-_crs-info-on-asus-m2v-mx-se.patch
+qla2xxx-fix-crash-in-qla2x00_abort_all_cmds-on-unload.patch
+libsas-fix-panic-when-single-phy-is-disabled-on-a-wide-port.patch
+md-avoid-waking-up-a-thread-after-it-has-been-freed.patch
+dm-table-avoid-crash-if-integrity-profile-changes.patch
--- /dev/null
+From 29cf7a30f8a0ce4af2406d93d5a332099be26923 Mon Sep 17 00:00:00 2001
+From: Paul Menzel <paulepanter@users.sourceforge.net>
+Date: Wed, 31 Aug 2011 17:07:10 +0200
+Subject: x86/PCI: use host bridge _CRS info on ASUS M2V-MX SE
+
+From: Paul Menzel <paulepanter@users.sourceforge.net>
+
+commit 29cf7a30f8a0ce4af2406d93d5a332099be26923 upstream.
+
+In summary, this DMI quirk uses the _CRS info by default for the ASUS
+M2V-MX SE by turning on `pci=use_crs` and is similar to the quirk
+added by commit 2491762cfb47 ("x86/PCI: use host bridge _CRS info on
+ASRock ALiveSATA2-GLAN") whose commit message should be read for further
+information.
+
+Since commit 3e3da00c01d0 ("x86/pci: AMD one chain system to use pci
+read out res") Linux gives the following oops:
+
+ parport0: PC-style at 0x378, irq 7 [PCSPP,TRISTATE]
+ HDA Intel 0000:20:01.0: PCI INT A -> GSI 17 (level, low) -> IRQ 17
+ HDA Intel 0000:20:01.0: setting latency timer to 64
+ BUG: unable to handle kernel paging request at ffffc90011c08000
+ IP: [<ffffffffa0578402>] azx_probe+0x3ad/0x86b [snd_hda_intel]
+ PGD 13781a067 PUD 13781b067 PMD 1300ba067 PTE 800000fd00000173
+ Oops: 0009 [#1] SMP
+ last sysfs file: /sys/module/snd_pcm/initstate
+ CPU 0
+ Modules linked in: snd_hda_intel(+) snd_hda_codec snd_hwdep snd_pcm_oss snd_mixer_oss snd_pcm snd_seq_midi snd_rawmidi snd_seq_midi_event tpm_tis tpm snd_seq tpm_bios psmouse parport_pc snd_timer snd_seq_device parport processor evdev snd i2c_viapro thermal_sys amd64_edac_mod k8temp i2c_core soundcore shpchp pcspkr serio_raw asus_atk0110 pci_hotplug edac_core button snd_page_alloc edac_mce_amd ext3 jbd mbcache sha256_generic cryptd aes_x86_64 aes_generic cbc dm_crypt dm_mod raid1 md_mod usbhid hid sg sd_mod crc_t10dif sr_mod cdrom ata_generic uhci_hcd sata_via pata_via libata ehci_hcd usbcore scsi_mod via_rhine mii nls_base [last unloaded: scsi_wait_scan]
+ Pid: 1153, comm: work_for_cpu Not tainted 2.6.37-1-amd64 #1 M2V-MX SE/System Product Name
+ RIP: 0010:[<ffffffffa0578402>] [<ffffffffa0578402>] azx_probe+0x3ad/0x86b [snd_hda_intel]
+ RSP: 0018:ffff88013153fe50 EFLAGS: 00010286
+ RAX: ffffc90011c08000 RBX: ffff88013029ec00 RCX: 0000000000000006
+ RDX: 0000000000000000 RSI: 0000000000000246 RDI: 0000000000000246
+ RBP: ffff88013341d000 R08: 0000000000000000 R09: 0000000000000040
+ R10: 0000000000000286 R11: 0000000000003731 R12: ffff88013029c400
+ R13: 0000000000000000 R14: 0000000000000000 R15: ffff88013341d090
+ FS: 0000000000000000(0000) GS:ffff8800bfc00000(0000) knlGS:00000000f7610ab0
+ CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
+ CR2: ffffc90011c08000 CR3: 0000000132f57000 CR4: 00000000000006f0
+ DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+ DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
+ Process work_for_cpu (pid: 1153, threadinfo ffff88013153e000, task ffff8801303c86c0)
+ Stack:
+ 0000000000000005 ffffffff8123ad65 00000000000136c0 ffff88013029c400
+ ffff8801303c8998 ffff88013341d000 ffff88013341d090 ffff8801322d9dc8
+ ffff88013341d208 0000000000000000 0000000000000000 ffffffff811ad232
+ Call Trace:
+ [<ffffffff8123ad65>] ? __pm_runtime_set_status+0x162/0x186
+ [<ffffffff811ad232>] ? local_pci_probe+0x49/0x92
+ [<ffffffff8105afc5>] ? do_work_for_cpu+0x0/0x1b
+ [<ffffffff8105afc5>] ? do_work_for_cpu+0x0/0x1b
+ [<ffffffff8105afd0>] ? do_work_for_cpu+0xb/0x1b
+ [<ffffffff8105fd3f>] ? kthread+0x7a/0x82
+ [<ffffffff8100a824>] ? kernel_thread_helper+0x4/0x10
+ [<ffffffff8105fcc5>] ? kthread+0x0/0x82
+ [<ffffffff8100a820>] ? kernel_thread_helper+0x0/0x10
+ Code: f4 01 00 00 ef 31 f6 48 89 df e8 29 dd ff ff 85 c0 0f 88 2b 03 00 00 48 89 ef e8 b4 39 c3 e0 8b 7b 40 e8 fc 9d b1 e0 48 8b 43 38 <66> 8b 10 66 89 14 24 8b 43 14 83 e8 03 83 f8 01 77 32 31 d2 be
+ RIP [<ffffffffa0578402>] azx_probe+0x3ad/0x86b [snd_hda_intel]
+ RSP <ffff88013153fe50>
+ CR2: ffffc90011c08000
+ ---[ end trace 8d1f3ebc136437fd ]---
+
+Trusting the ACPI _CRS information (`pci=use_crs`) fixes this problem.
+
+ $ dmesg | grep -i crs # with the quirk
+ PCI: Using host bridge windows from ACPI; if necessary, use "pci=nocrs" and report a bug
+
+The match has to be against the DMI board entries though since the vendor entries are not populated.
+
+ DMI: System manufacturer System Product Name/M2V-MX SE, BIOS 0304 10/30/2007
+
+This quirk should be removed when `pci=use_crs` is enabled for machines
+from 2006 or earlier or some other solution is implemented.
+
+Using coreboot [1] with this board the problem does not exist but this
+quirk also does not affect it either. To be safe though the check is
+tightened to only take effect when the BIOS from American Megatrends is
+used.
+
+ 15:13 < ruik> but coreboot does not need that
+ 15:13 < ruik> because i have there only one root bus
+ 15:13 < ruik> the audio is behind a bridge
+
+ $ sudo dmidecode
+ BIOS Information
+ Vendor: American Megatrends Inc.
+ Version: 0304
+ Release Date: 10/30/2007
+
+[1] http://www.coreboot.org/
+
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=30552
+
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: H. Peter Anvin <hpa@zytor.com>
+Cc: x86@kernel.org
+Signed-off-by: Paul Menzel <paulepanter@users.sourceforge.net>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Acked-by: Jesse Barnes <jbarnes@virtuousgeek.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/pci/acpi.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+--- a/arch/x86/pci/acpi.c
++++ b/arch/x86/pci/acpi.c
+@@ -43,6 +43,17 @@ static const struct dmi_system_id pci_us
+ DMI_MATCH(DMI_PRODUCT_NAME, "ALiveSATA2-GLAN"),
+ },
+ },
++ /* https://bugzilla.kernel.org/show_bug.cgi?id=30552 */
++ /* 2006 AMD HT/VIA system with two host bridges */
++ {
++ .callback = set_use_crs,
++ .ident = "ASUS M2V-MX SE",
++ .matches = {
++ DMI_MATCH(DMI_BOARD_VENDOR, "ASUSTeK Computer INC."),
++ DMI_MATCH(DMI_BOARD_NAME, "M2V-MX SE"),
++ DMI_MATCH(DMI_BIOS_VENDOR, "American Megatrends Inc."),
++ },
++ },
+ {}
+ };
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
