diff options
author | Greg Kroah-Hartman <gregkh@suse.de> | 2011-10-07 12:18:13 -0700 |
---|---|---|
committer | Greg Kroah-Hartman <gregkh@suse.de> | 2011-10-07 12:18:13 -0700 |
commit | 714472f0eecdd4ad4af22061d27e2622f9eae919 (patch) | |
tree | e5c591058fb31e74a3347587e133c65392d378af | |
parent | 1893af4b5725b9e8bda37278f657f4f708d9dba4 (diff) | |
download | stable-queue-714472f0eecdd4ad4af22061d27e2622f9eae919.tar.gz |
3.0 patches
8 files changed, 699 insertions, 1 deletions
diff --git a/queue-3.0/dm-table-avoid-crash-if-integrity-profile-changes.patch b/queue-3.0/dm-table-avoid-crash-if-integrity-profile-changes.patch new file mode 100644 index 0000000000..67ceb3a986 --- /dev/null +++ b/queue-3.0/dm-table-avoid-crash-if-integrity-profile-changes.patch @@ -0,0 +1,52 @@ +From 876fbba1db4a377f050a2bb49b474c7527b2995d Mon Sep 17 00:00:00 2001 +From: Mike Snitzer <snitzer@redhat.com> +Date: Sun, 25 Sep 2011 23:26:17 +0100 +Subject: dm table: avoid crash if integrity profile changes + +From: Mike Snitzer <snitzer@redhat.com> + +commit 876fbba1db4a377f050a2bb49b474c7527b2995d upstream. + +Commit a63a5cf (dm: improve block integrity support) introduced a +two-phase initialization of a DM device's integrity profile. This +patch avoids dereferencing a NULL 'template_disk' pointer in +blk_integrity_register() if there is an integrity profile mismatch in +dm_table_set_integrity(). + +This can occur if the integrity profiles for stacked devices in a DM +table are changed between the call to dm_table_prealloc_integrity() and +dm_table_set_integrity(). + +Reported-by: Zdenek Kabelac <zkabelac@redhat.com> +Signed-off-by: Mike Snitzer <snitzer@redhat.com> +Signed-off-by: Alasdair G Kergon <agk@redhat.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/md/dm-table.c | 13 +++++++------ + 1 file changed, 7 insertions(+), 6 deletions(-) + +--- a/drivers/md/dm-table.c ++++ b/drivers/md/dm-table.c +@@ -1184,14 +1184,15 @@ static void dm_table_set_integrity(struc + return; + + template_disk = dm_table_get_integrity_disk(t, true); +- if (!template_disk && +- blk_integrity_is_initialized(dm_disk(t->md))) { ++ if (template_disk) ++ blk_integrity_register(dm_disk(t->md), ++ blk_get_integrity(template_disk)); ++ else if (blk_integrity_is_initialized(dm_disk(t->md))) + DMWARN("%s: device no longer has a valid integrity profile", + dm_device_name(t->md)); +- return; +- } +- blk_integrity_register(dm_disk(t->md), +- blk_get_integrity(template_disk)); ++ else ++ DMWARN("%s: unable to establish an integrity profile", ++ dm_device_name(t->md)); + } + + void dm_table_set_restrictions(struct dm_table *t, struct request_queue *q, diff --git a/queue-3.0/fix-pointer-dereference-before-call-to.patch b/queue-3.0/fix-pointer-dereference-before-call-to.patch new file mode 100644 index 0000000000..fa0a17fcf9 --- /dev/null +++ b/queue-3.0/fix-pointer-dereference-before-call-to.patch @@ -0,0 +1,73 @@ +From 5307f6d5fb12fd01f9f321bc4a8fd77e74858647 Mon Sep 17 00:00:00 2001 +From: Shyam Iyer <shyam.iyer.t@gmail.com> +Date: Thu, 8 Sep 2011 16:41:17 -0500 +Subject: Fix pointer dereference before call to pcie_bus_configure_settings + +From: Shyam Iyer <shyam.iyer.t@gmail.com> + +commit 5307f6d5fb12fd01f9f321bc4a8fd77e74858647 upstream. + +Commit b03e7495a862 ("PCI: Set PCI-E Max Payload Size on fabric") +introduced a potential NULL pointer dereference in calls to +pcie_bus_configure_settings due to attempts to access pci_bus self +variables when the self pointer is NULL. + +To correct this, verify that the self pointer in pci_bus is non-NULL +before dereferencing it. + +Reported-by: Stanislaw Gruszka <sgruszka@redhat.com> +Signed-off-by: Shyam Iyer <shyam_iyer@dell.com> +Signed-off-by: Jon Mason <mason@myri.com> +Acked-by: Jesse Barnes <jbarnes@virtuousgeek.org> +Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + arch/x86/pci/acpi.c | 9 +++++++-- + drivers/pci/hotplug/pcihp_slot.c | 4 +++- + drivers/pci/probe.c | 3 --- + 3 files changed, 10 insertions(+), 6 deletions(-) + +--- a/arch/x86/pci/acpi.c ++++ b/arch/x86/pci/acpi.c +@@ -366,8 +366,13 @@ struct pci_bus * __devinit pci_acpi_scan + */ + if (bus) { + struct pci_bus *child; +- list_for_each_entry(child, &bus->children, node) +- pcie_bus_configure_settings(child, child->self->pcie_mpss); ++ list_for_each_entry(child, &bus->children, node) { ++ struct pci_dev *self = child->self; ++ if (!self) ++ continue; ++ ++ pcie_bus_configure_settings(child, self->pcie_mpss); ++ } + } + + if (!bus) +--- a/drivers/pci/hotplug/pcihp_slot.c ++++ b/drivers/pci/hotplug/pcihp_slot.c +@@ -169,7 +169,9 @@ void pci_configure_slot(struct pci_dev * + (dev->class >> 8) == PCI_CLASS_BRIDGE_PCI))) + return; + +- pcie_bus_configure_settings(dev->bus, dev->bus->self->pcie_mpss); ++ if (dev->bus && dev->bus->self) ++ pcie_bus_configure_settings(dev->bus, ++ dev->bus->self->pcie_mpss); + + memset(&hpp, 0, sizeof(hpp)); + ret = pci_get_hp_params(dev, &hpp); +--- a/drivers/pci/probe.c ++++ b/drivers/pci/probe.c +@@ -1461,9 +1461,6 @@ void pcie_bus_configure_settings(struct + { + u8 smpss = mpss; + +- if (!bus->self) +- return; +- + if (!pci_is_pcie(bus->self)) + return; + diff --git a/queue-3.0/libsas-fix-panic-when-single-phy-is-disabled-on-a-wide-port.patch b/queue-3.0/libsas-fix-panic-when-single-phy-is-disabled-on-a-wide-port.patch new file mode 100644 index 0000000000..13c92dad68 --- /dev/null +++ b/queue-3.0/libsas-fix-panic-when-single-phy-is-disabled-on-a-wide-port.patch @@ -0,0 +1,111 @@ +From a73914c35b05d80f8ce78288e10056c91090b666 Mon Sep 17 00:00:00 2001 +From: Mark Salyzyn <mark_salyzyn@us.xyratex.com> +Date: Thu, 22 Sep 2011 08:32:23 -0700 +Subject: [SCSI] libsas: fix panic when single phy is disabled on a wide port + +From: Mark Salyzyn <mark_salyzyn@us.xyratex.com> + +commit a73914c35b05d80f8ce78288e10056c91090b666 upstream. + +When a wide port is being utilized to a target, if one disables only one +of the +phys, we get an OS crash: + +BUG: unable to handle kernel NULL pointer dereference at +0000000000000238 +IP: [<ffffffff814ca9b1>] mutex_lock+0x21/0x50 +PGD 4103f5067 PUD 41dba9067 PMD 0 +Oops: 0002 [#1] SMP +last sysfs file: /sys/bus/pci/slots/5/address +CPU 0 +Modules linked in: pm8001(U) ses enclosure fuse nfsd exportfs autofs4 +ipmi_devintf ipmi_si ipmi_msghandler nfs lockd fscache nfs_acl +auth_rpcgss 8021q fcoe libfcoe garp libfc scsi_transport_fc stp scsi_tgt +llc sunrpc cpufreq_ondemand acpi_cpufreq freq_table ipv6 sr_mod cdrom +dm_mirror dm_region_hash dm_log uinput sg i2c_i801 i2c_core iTCO_wdt +iTCO_vendor_support e1000e mlx4_ib ib_mad ib_core mlx4_en mlx4_core ext3 +jbd mbcache sd_mod crc_t10dif usb_storage ata_generic pata_acpi ata_piix +libsas(U) scsi_transport_sas dm_mod [last unloaded: pm8001] + +Modules linked in: pm8001(U) ses enclosure fuse nfsd exportfs autofs4 +ipmi_devintf ipmi_si ipmi_msghandler nfs lockd fscache nfs_acl +auth_rpcgss 8021q fcoe libfcoe garp libfc scsi_transport_fc stp scsi_tgt +llc sunrpc cpufreq_ondemand acpi_cpufreq freq_table ipv6 sr_mod cdrom +dm_mirror dm_region_hash dm_log uinput sg i2c_i801 i2c_core iTCO_wdt +iTCO_vendor_support e1000e mlx4_ib ib_mad ib_core mlx4_en mlx4_core ext3 +jbd mbcache sd_mod crc_t10dif usb_storage ata_generic pata_acpi ata_piix +libsas(U) scsi_transport_sas dm_mod [last unloaded: pm8001] +Pid: 5146, comm: scsi_wq_5 Not tainted +2.6.32-71.29.1.el6.lustre.7.x86_64 #1 Storage Server +RIP: 0010:[<ffffffff814ca9b1>] [<ffffffff814ca9b1>] +mutex_lock+0x21/0x50 +RSP: 0018:ffff8803e4e33d30 EFLAGS: 00010246 +RAX: 0000000000000000 RBX: 0000000000000238 RCX: 0000000000000000 +RDX: 0000000000000000 RSI: ffff8803e664c800 RDI: 0000000000000238 +RBP: ffff8803e4e33d40 R08: 0000000000000000 R09: 0000000000000000 +R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000000 +R13: 0000000000000238 R14: ffff88041acb7200 R15: ffff88041c51ada0 +FS: 0000000000000000(0000) GS:ffff880028200000(0000) +knlGS:0000000000000000 +CS: 0010 DS: 0018 ES: 0018 CR0: 000000008005003b +CR2: 0000000000000238 CR3: 0000000410143000 CR4: 00000000000006f0 +DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 +Process scsi_wq_5 (pid: 5146, threadinfo ffff8803e4e32000, task +ffff8803e4e294a0) +Stack: + ffff8803e664c800 0000000000000000 ffff8803e4e33d70 ffffffffa001f06e +<0> ffff8803e4e33d60 ffff88041c51ada0 ffff88041acb7200 ffff88041bc0aa00 +<0> ffff8803e4e33d90 ffffffffa0032b6c 0000000000000014 ffff88041acb7200 +Call Trace: + [<ffffffffa001f06e>] sas_port_delete_phy+0x2e/0xa0 [scsi_transport_sas] + [<ffffffffa0032b6c>] sas_unregister_devs_sas_addr+0xac/0xe0 [libsas] + [<ffffffffa0034914>] sas_ex_revalidate_domain+0x204/0x330 [libsas] + [<ffffffffa00307f0>] ? sas_revalidate_domain+0x0/0x90 [libsas] + [<ffffffffa0030855>] sas_revalidate_domain+0x65/0x90 [libsas] + [<ffffffff8108c7d0>] worker_thread+0x170/0x2a0 + [<ffffffff81091ea0>] ? autoremove_wake_function+0x0/0x40 + [<ffffffff8108c660>] ? worker_thread+0x0/0x2a0 + [<ffffffff81091b36>] kthread+0x96/0xa0 + [<ffffffff810141ca>] child_rip+0xa/0x20 + [<ffffffff81091aa0>] ? kthread+0x0/0xa0 + [<ffffffff810141c0>] ? child_rip+0x0/0x20 +Code: ff ff 85 c0 75 ed eb d6 66 90 55 48 89 e5 48 83 ec 10 48 89 1c 24 +4c 89 64 24 08 0f 1f 44 00 00 48 89 fb e8 92 f4 ff ff 48 89 df <f0> ff +0f 79 05 e8 25 00 00 00 65 48 8b 04 25 08 cc 00 00 48 2d +RIP [<ffffffff814ca9b1>] mutex_lock+0x21/0x50 + RSP <ffff8803e4e33d30> +CR2: 0000000000000238 + +The following patch is admittedly a band-aid, and does not solve the +root cause, but it still is a good candidate for hardening as a pointer +check before reference. + +Signed-off-by: Mark Salyzyn <mark_salyzyn@us.xyratex.com> +Tested-by: Jack Wang <jack_wang@usish.com> +Signed-off-by: James Bottomley <JBottomley@Parallels.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/scsi/libsas/sas_expander.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +--- a/drivers/scsi/libsas/sas_expander.c ++++ b/drivers/scsi/libsas/sas_expander.c +@@ -1769,10 +1769,12 @@ static void sas_unregister_devs_sas_addr + sas_disable_routing(parent, phy->attached_sas_addr); + } + memset(phy->attached_sas_addr, 0, SAS_ADDR_SIZE); +- sas_port_delete_phy(phy->port, phy->phy); +- if (phy->port->num_phys == 0) +- sas_port_delete(phy->port); +- phy->port = NULL; ++ if (phy->port) { ++ sas_port_delete_phy(phy->port, phy->phy); ++ if (phy->port->num_phys == 0) ++ sas_port_delete(phy->port); ++ phy->port = NULL; ++ } + } + + static int sas_discover_bfs_by_root_level(struct domain_device *root, diff --git a/queue-3.0/md-avoid-waking-up-a-thread-after-it-has-been-freed.patch b/queue-3.0/md-avoid-waking-up-a-thread-after-it-has-been-freed.patch new file mode 100644 index 0000000000..bafb790984 --- /dev/null +++ b/queue-3.0/md-avoid-waking-up-a-thread-after-it-has-been-freed.patch @@ -0,0 +1,177 @@ +From 01f96c0a9922cd9919baf9d16febdf7016177a12 Mon Sep 17 00:00:00 2001 +From: NeilBrown <neilb@suse.de> +Date: Wed, 21 Sep 2011 15:30:20 +1000 +Subject: md: Avoid waking up a thread after it has been freed. + +From: NeilBrown <neilb@suse.de> + +commit 01f96c0a9922cd9919baf9d16febdf7016177a12 upstream. + +Two related problems: + +1/ some error paths call "md_unregister_thread(mddev->thread)" + without subsequently clearing ->thread. A subsequent call + to mddev_unlock will try to wake the thread, and crash. + +2/ Most calls to md_wakeup_thread are protected against the thread + disappeared either by: + - holding the ->mutex + - having an active request, so something else must be keeping + the array active. + However mddev_unlock calls md_wakeup_thread after dropping the + mutex and without any certainty of an active request, so the + ->thread could theoretically disappear. + So we need a spinlock to provide some protections. + +So change md_unregister_thread to take a pointer to the thread +pointer, and ensure that it always does the required locking, and +clears the pointer properly. + +Reported-by: "Moshe Melnikov" <moshe@zadarastorage.com> +Signed-off-by: NeilBrown <neilb@suse.de> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/md/md.c | 22 +++++++++++++++++++--- + drivers/md/md.h | 2 +- + drivers/md/multipath.c | 3 +-- + drivers/md/raid1.c | 3 +-- + drivers/md/raid10.c | 5 ++--- + drivers/md/raid5.c | 6 ++---- + 6 files changed, 26 insertions(+), 15 deletions(-) + +--- a/drivers/md/md.c ++++ b/drivers/md/md.c +@@ -61,6 +61,11 @@ + static void autostart_arrays(int part); + #endif + ++/* pers_list is a list of registered personalities protected ++ * by pers_lock. ++ * pers_lock does extra service to protect accesses to ++ * mddev->thread when the mutex cannot be held. ++ */ + static LIST_HEAD(pers_list); + static DEFINE_SPINLOCK(pers_lock); + +@@ -690,7 +695,12 @@ static void mddev_unlock(mddev_t * mddev + } else + mutex_unlock(&mddev->reconfig_mutex); + ++ /* was we've dropped the mutex we need a spinlock to ++ * make sur the thread doesn't disappear ++ */ ++ spin_lock(&pers_lock); + md_wakeup_thread(mddev->thread); ++ spin_unlock(&pers_lock); + } + + static mdk_rdev_t * find_rdev_nr(mddev_t *mddev, int nr) +@@ -6186,11 +6196,18 @@ mdk_thread_t *md_register_thread(void (* + return thread; + } + +-void md_unregister_thread(mdk_thread_t *thread) ++void md_unregister_thread(mdk_thread_t **threadp) + { ++ mdk_thread_t *thread = *threadp; + if (!thread) + return; + dprintk("interrupting MD-thread pid %d\n", task_pid_nr(thread->tsk)); ++ /* Locking ensures that mddev_unlock does not wake_up a ++ * non-existent thread ++ */ ++ spin_lock(&pers_lock); ++ *threadp = NULL; ++ spin_unlock(&pers_lock); + + kthread_stop(thread->tsk); + kfree(thread); +@@ -7125,8 +7142,7 @@ static void reap_sync_thread(mddev_t *md + mdk_rdev_t *rdev; + + /* resync has finished, collect result */ +- md_unregister_thread(mddev->sync_thread); +- mddev->sync_thread = NULL; ++ md_unregister_thread(&mddev->sync_thread); + if (!test_bit(MD_RECOVERY_INTR, &mddev->recovery) && + !test_bit(MD_RECOVERY_REQUESTED, &mddev->recovery)) { + /* success...*/ +--- a/drivers/md/md.h ++++ b/drivers/md/md.h +@@ -475,7 +475,7 @@ extern int register_md_personality(struc + extern int unregister_md_personality(struct mdk_personality *p); + extern mdk_thread_t * md_register_thread(void (*run) (mddev_t *mddev), + mddev_t *mddev, const char *name); +-extern void md_unregister_thread(mdk_thread_t *thread); ++extern void md_unregister_thread(mdk_thread_t **threadp); + extern void md_wakeup_thread(mdk_thread_t *thread); + extern void md_check_recovery(mddev_t *mddev); + extern void md_write_start(mddev_t *mddev, struct bio *bi); +--- a/drivers/md/multipath.c ++++ b/drivers/md/multipath.c +@@ -514,8 +514,7 @@ static int multipath_stop (mddev_t *mdde + { + multipath_conf_t *conf = mddev->private; + +- md_unregister_thread(mddev->thread); +- mddev->thread = NULL; ++ md_unregister_thread(&mddev->thread); + blk_sync_queue(mddev->queue); /* the unplug fn references 'conf'*/ + mempool_destroy(conf->pool); + kfree(conf->multipaths); +--- a/drivers/md/raid1.c ++++ b/drivers/md/raid1.c +@@ -2045,8 +2045,7 @@ static int stop(mddev_t *mddev) + raise_barrier(conf); + lower_barrier(conf); + +- md_unregister_thread(mddev->thread); +- mddev->thread = NULL; ++ md_unregister_thread(&mddev->thread); + if (conf->r1bio_pool) + mempool_destroy(conf->r1bio_pool); + kfree(conf->mirrors); +--- a/drivers/md/raid10.c ++++ b/drivers/md/raid10.c +@@ -2331,7 +2331,7 @@ static int run(mddev_t *mddev) + return 0; + + out_free_conf: +- md_unregister_thread(mddev->thread); ++ md_unregister_thread(&mddev->thread); + if (conf->r10bio_pool) + mempool_destroy(conf->r10bio_pool); + safe_put_page(conf->tmppage); +@@ -2349,8 +2349,7 @@ static int stop(mddev_t *mddev) + raise_barrier(conf, 0); + lower_barrier(conf); + +- md_unregister_thread(mddev->thread); +- mddev->thread = NULL; ++ md_unregister_thread(&mddev->thread); + blk_sync_queue(mddev->queue); /* the unplug fn references 'conf'*/ + if (conf->r10bio_pool) + mempool_destroy(conf->r10bio_pool); +--- a/drivers/md/raid5.c ++++ b/drivers/md/raid5.c +@@ -5162,8 +5162,7 @@ static int run(mddev_t *mddev) + + return 0; + abort: +- md_unregister_thread(mddev->thread); +- mddev->thread = NULL; ++ md_unregister_thread(&mddev->thread); + if (conf) { + print_raid5_conf(conf); + free_conf(conf); +@@ -5177,8 +5176,7 @@ static int stop(mddev_t *mddev) + { + raid5_conf_t *conf = mddev->private; + +- md_unregister_thread(mddev->thread); +- mddev->thread = NULL; ++ md_unregister_thread(&mddev->thread); + if (mddev->queue) + mddev->queue->backing_dev_info.congested_fn = NULL; + free_conf(conf); diff --git a/queue-3.0/pci-disable-mps-configuration-by-default.patch b/queue-3.0/pci-disable-mps-configuration-by-default.patch new file mode 100644 index 0000000000..f0ece81bea --- /dev/null +++ b/queue-3.0/pci-disable-mps-configuration-by-default.patch @@ -0,0 +1,97 @@ +From 5f39e6705faade2e89d119958a8c51b9b6e2c53c Mon Sep 17 00:00:00 2001 +From: Jon Mason <mason@myri.com> +Date: Mon, 3 Oct 2011 09:50:20 -0500 +Subject: PCI: Disable MPS configuration by default + +From: Jon Mason <mason@myri.com> + +commit 5f39e6705faade2e89d119958a8c51b9b6e2c53c upstream. + +Add the ability to disable PCI-E MPS turning and using the BIOS +configured MPS defaults. Due to the number of issues recently +discovered on some x86 chipsets, make this the default behavior. + +Also, add the option for peer to peer DMA MPS configuration. Peer to +peer DMA is outside the scope of this patch, but MPS configuration could +prevent it from working by having the MPS on one root port different +than the MPS on another. To work around this, simply make the system +wide MPS the smallest possible value (128B). + +Signed-off-by: Jon Mason <mason@myri.com> +Acked-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> +Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/pci/pci.c | 6 +++++- + drivers/pci/probe.c | 14 +++++++++++++- + include/linux/pci.h | 3 ++- + 3 files changed, 20 insertions(+), 3 deletions(-) + +--- a/drivers/pci/pci.c ++++ b/drivers/pci/pci.c +@@ -77,7 +77,7 @@ unsigned long pci_cardbus_mem_size = DEF + unsigned long pci_hotplug_io_size = DEFAULT_HOTPLUG_IO_SIZE; + unsigned long pci_hotplug_mem_size = DEFAULT_HOTPLUG_MEM_SIZE; + +-enum pcie_bus_config_types pcie_bus_config = PCIE_BUS_SAFE; ++enum pcie_bus_config_types pcie_bus_config = PCIE_BUS_TUNE_OFF; + + /* + * The default CLS is used if arch didn't set CLS explicitly and not +@@ -3568,10 +3568,14 @@ static int __init pci_setup(char *str) + pci_hotplug_io_size = memparse(str + 9, &str); + } else if (!strncmp(str, "hpmemsize=", 10)) { + pci_hotplug_mem_size = memparse(str + 10, &str); ++ } else if (!strncmp(str, "pcie_bus_tune_off", 17)) { ++ pcie_bus_config = PCIE_BUS_TUNE_OFF; + } else if (!strncmp(str, "pcie_bus_safe", 13)) { + pcie_bus_config = PCIE_BUS_SAFE; + } else if (!strncmp(str, "pcie_bus_perf", 13)) { + pcie_bus_config = PCIE_BUS_PERFORMANCE; ++ } else if (!strncmp(str, "pcie_bus_peer2peer", 18)) { ++ pcie_bus_config = PCIE_BUS_PEER2PEER; + } else { + printk(KERN_ERR "PCI: Unknown option `%s'\n", + str); +--- a/drivers/pci/probe.c ++++ b/drivers/pci/probe.c +@@ -1459,12 +1459,24 @@ static int pcie_bus_configure_set(struct + */ + void pcie_bus_configure_settings(struct pci_bus *bus, u8 mpss) + { +- u8 smpss = mpss; ++ u8 smpss; + + if (!pci_is_pcie(bus->self)) + return; + ++ if (pcie_bus_config == PCIE_BUS_TUNE_OFF) ++ return; ++ ++ /* FIXME - Peer to peer DMA is possible, though the endpoint would need ++ * to be aware to the MPS of the destination. To work around this, ++ * simply force the MPS of the entire system to the smallest possible. ++ */ ++ if (pcie_bus_config == PCIE_BUS_PEER2PEER) ++ smpss = 0; ++ + if (pcie_bus_config == PCIE_BUS_SAFE) { ++ smpss = mpss; ++ + pcie_find_smpss(bus->self, &smpss); + pci_walk_bus(bus, pcie_find_smpss, &smpss); + } +--- a/include/linux/pci.h ++++ b/include/linux/pci.h +@@ -621,8 +621,9 @@ struct pci_driver { + extern void pcie_bus_configure_settings(struct pci_bus *bus, u8 smpss); + + enum pcie_bus_config_types { +- PCIE_BUS_PERFORMANCE, ++ PCIE_BUS_TUNE_OFF, + PCIE_BUS_SAFE, ++ PCIE_BUS_PERFORMANCE, + PCIE_BUS_PEER2PEER, + }; + diff --git a/queue-3.0/qla2xxx-fix-crash-in-qla2x00_abort_all_cmds-on-unload.patch b/queue-3.0/qla2xxx-fix-crash-in-qla2x00_abort_all_cmds-on-unload.patch new file mode 100644 index 0000000000..812b93a696 --- /dev/null +++ b/queue-3.0/qla2xxx-fix-crash-in-qla2x00_abort_all_cmds-on-unload.patch @@ -0,0 +1,53 @@ +From 9bfacd01dc9b7519e1e6da12b01963550b9d09a2 Mon Sep 17 00:00:00 2001 +From: Roland Dreier <roland@purestorage.com> +Date: Thu, 22 Sep 2011 00:06:05 -0700 +Subject: [SCSI] qla2xxx: Fix crash in qla2x00_abort_all_cmds() on unload + +From: Roland Dreier <roland@purestorage.com> + +commit 9bfacd01dc9b7519e1e6da12b01963550b9d09a2 upstream. + +I hit a crash in qla2x00_abort_all_cmds() if the qla2xxx module is +unloaded right after it is loaded. I debugged this down to the abort +handling improperly treating a command of type SRB_ADISC_CMD as if it +had a bsg_job to complete when that command actually uses the iocb_cmd +part of the union. (I guess to hit this one has to unload the module +while the async FC initialization is still in progress) + +It seems we should only look for a bsg_job if type is SRB_ELS_CMD_RPT, +SRB_ELS_CMD_HST or SRB_CT_CMD, so switch the test to make that explicit. + +Signed-off-by: Roland Dreier <roland@purestorage.com> +Acked-by: Chad Dupuis <chad.dupuis@qlogic.com> +Signed-off-by: James Bottomley <JBottomley@Parallels.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/scsi/qla2xxx/qla_os.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +--- a/drivers/scsi/qla2xxx/qla_os.c ++++ b/drivers/scsi/qla2xxx/qla_os.c +@@ -1240,10 +1240,9 @@ qla2x00_abort_all_cmds(scsi_qla_host_t * + qla2x00_sp_compl(ha, sp); + } else { + ctx = sp->ctx; +- if (ctx->type == SRB_LOGIN_CMD || +- ctx->type == SRB_LOGOUT_CMD) { +- ctx->u.iocb_cmd->free(sp); +- } else { ++ if (ctx->type == SRB_ELS_CMD_RPT || ++ ctx->type == SRB_ELS_CMD_HST || ++ ctx->type == SRB_CT_CMD) { + struct fc_bsg_job *bsg_job = + ctx->u.bsg_job; + if (bsg_job->request->msgcode +@@ -1255,6 +1254,8 @@ qla2x00_abort_all_cmds(scsi_qla_host_t * + kfree(sp->ctx); + mempool_free(sp, + ha->srb_mempool); ++ } else { ++ ctx->u.iocb_cmd->free(sp); + } + } + } diff --git a/queue-3.0/series b/queue-3.0/series index dbcf9bbdcf..a025e708d4 100644 --- a/queue-3.0/series +++ b/queue-3.0/series @@ -1,9 +1,12 @@ +# do we really want these 6 PCI patches for 3.0? pci-set-pci-e-max-payload-size-on-fabric.patch pci-export-pcie_bus_configure_settings-symbol.patch pci-remove-mrrs-modification-from-mps-setting-code.patch pci-don-t-crash-when-reading-mpss-from-root-complex.patch -sparc64-force-the-execute-bit-in-openfirmware-s-translation-entries.patch +fix-pointer-dereference-before-call-to.patch +pci-disable-mps-configuration-by-default.patch +sparc64-force-the-execute-bit-in-openfirmware-s-translation-entries.patch sched-rt-migrate-equal-priority-tasks-to-available-cpus.patch sched-fix-up-wchan-borkage.patch ide-disk-fix-request-requeuing.patch @@ -18,3 +21,8 @@ drm-radeon-kms-add-retry-limits-for-native-dp-aux-defer.patch drm-radeon-kms-fix-channel_remap-setup-v2.patch ptp-fix-l2-event-message-recognition.patch rt2x00-serialize-tx-operations-on-a-queue.patch +x86-pci-use-host-bridge-_crs-info-on-asus-m2v-mx-se.patch +qla2xxx-fix-crash-in-qla2x00_abort_all_cmds-on-unload.patch +libsas-fix-panic-when-single-phy-is-disabled-on-a-wide-port.patch +md-avoid-waking-up-a-thread-after-it-has-been-freed.patch +dm-table-avoid-crash-if-integrity-profile-changes.patch diff --git a/queue-3.0/x86-pci-use-host-bridge-_crs-info-on-asus-m2v-mx-se.patch b/queue-3.0/x86-pci-use-host-bridge-_crs-info-on-asus-m2v-mx-se.patch new file mode 100644 index 0000000000..68fd7122ee --- /dev/null +++ b/queue-3.0/x86-pci-use-host-bridge-_crs-info-on-asus-m2v-mx-se.patch @@ -0,0 +1,127 @@ +From 29cf7a30f8a0ce4af2406d93d5a332099be26923 Mon Sep 17 00:00:00 2001 +From: Paul Menzel <paulepanter@users.sourceforge.net> +Date: Wed, 31 Aug 2011 17:07:10 +0200 +Subject: x86/PCI: use host bridge _CRS info on ASUS M2V-MX SE + +From: Paul Menzel <paulepanter@users.sourceforge.net> + +commit 29cf7a30f8a0ce4af2406d93d5a332099be26923 upstream. + +In summary, this DMI quirk uses the _CRS info by default for the ASUS +M2V-MX SE by turning on `pci=use_crs` and is similar to the quirk +added by commit 2491762cfb47 ("x86/PCI: use host bridge _CRS info on +ASRock ALiveSATA2-GLAN") whose commit message should be read for further +information. + +Since commit 3e3da00c01d0 ("x86/pci: AMD one chain system to use pci +read out res") Linux gives the following oops: + + parport0: PC-style at 0x378, irq 7 [PCSPP,TRISTATE] + HDA Intel 0000:20:01.0: PCI INT A -> GSI 17 (level, low) -> IRQ 17 + HDA Intel 0000:20:01.0: setting latency timer to 64 + BUG: unable to handle kernel paging request at ffffc90011c08000 + IP: [<ffffffffa0578402>] azx_probe+0x3ad/0x86b [snd_hda_intel] + PGD 13781a067 PUD 13781b067 PMD 1300ba067 PTE 800000fd00000173 + Oops: 0009 [#1] SMP + last sysfs file: /sys/module/snd_pcm/initstate + CPU 0 + Modules linked in: snd_hda_intel(+) snd_hda_codec snd_hwdep snd_pcm_oss snd_mixer_oss snd_pcm snd_seq_midi snd_rawmidi snd_seq_midi_event tpm_tis tpm snd_seq tpm_bios psmouse parport_pc snd_timer snd_seq_device parport processor evdev snd i2c_viapro thermal_sys amd64_edac_mod k8temp i2c_core soundcore shpchp pcspkr serio_raw asus_atk0110 pci_hotplug edac_core button snd_page_alloc edac_mce_amd ext3 jbd mbcache sha256_generic cryptd aes_x86_64 aes_generic cbc dm_crypt dm_mod raid1 md_mod usbhid hid sg sd_mod crc_t10dif sr_mod cdrom ata_generic uhci_hcd sata_via pata_via libata ehci_hcd usbcore scsi_mod via_rhine mii nls_base [last unloaded: scsi_wait_scan] + Pid: 1153, comm: work_for_cpu Not tainted 2.6.37-1-amd64 #1 M2V-MX SE/System Product Name + RIP: 0010:[<ffffffffa0578402>] [<ffffffffa0578402>] azx_probe+0x3ad/0x86b [snd_hda_intel] + RSP: 0018:ffff88013153fe50 EFLAGS: 00010286 + RAX: ffffc90011c08000 RBX: ffff88013029ec00 RCX: 0000000000000006 + RDX: 0000000000000000 RSI: 0000000000000246 RDI: 0000000000000246 + RBP: ffff88013341d000 R08: 0000000000000000 R09: 0000000000000040 + R10: 0000000000000286 R11: 0000000000003731 R12: ffff88013029c400 + R13: 0000000000000000 R14: 0000000000000000 R15: ffff88013341d090 + FS: 0000000000000000(0000) GS:ffff8800bfc00000(0000) knlGS:00000000f7610ab0 + CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b + CR2: ffffc90011c08000 CR3: 0000000132f57000 CR4: 00000000000006f0 + DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 + DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 + Process work_for_cpu (pid: 1153, threadinfo ffff88013153e000, task ffff8801303c86c0) + Stack: + 0000000000000005 ffffffff8123ad65 00000000000136c0 ffff88013029c400 + ffff8801303c8998 ffff88013341d000 ffff88013341d090 ffff8801322d9dc8 + ffff88013341d208 0000000000000000 0000000000000000 ffffffff811ad232 + Call Trace: + [<ffffffff8123ad65>] ? __pm_runtime_set_status+0x162/0x186 + [<ffffffff811ad232>] ? local_pci_probe+0x49/0x92 + [<ffffffff8105afc5>] ? do_work_for_cpu+0x0/0x1b + [<ffffffff8105afc5>] ? do_work_for_cpu+0x0/0x1b + [<ffffffff8105afd0>] ? do_work_for_cpu+0xb/0x1b + [<ffffffff8105fd3f>] ? kthread+0x7a/0x82 + [<ffffffff8100a824>] ? kernel_thread_helper+0x4/0x10 + [<ffffffff8105fcc5>] ? kthread+0x0/0x82 + [<ffffffff8100a820>] ? kernel_thread_helper+0x0/0x10 + Code: f4 01 00 00 ef 31 f6 48 89 df e8 29 dd ff ff 85 c0 0f 88 2b 03 00 00 48 89 ef e8 b4 39 c3 e0 8b 7b 40 e8 fc 9d b1 e0 48 8b 43 38 <66> 8b 10 66 89 14 24 8b 43 14 83 e8 03 83 f8 01 77 32 31 d2 be + RIP [<ffffffffa0578402>] azx_probe+0x3ad/0x86b [snd_hda_intel] + RSP <ffff88013153fe50> + CR2: ffffc90011c08000 + ---[ end trace 8d1f3ebc136437fd ]--- + +Trusting the ACPI _CRS information (`pci=use_crs`) fixes this problem. + + $ dmesg | grep -i crs # with the quirk + PCI: Using host bridge windows from ACPI; if necessary, use "pci=nocrs" and report a bug + +The match has to be against the DMI board entries though since the vendor entries are not populated. + + DMI: System manufacturer System Product Name/M2V-MX SE, BIOS 0304 10/30/2007 + +This quirk should be removed when `pci=use_crs` is enabled for machines +from 2006 or earlier or some other solution is implemented. + +Using coreboot [1] with this board the problem does not exist but this +quirk also does not affect it either. To be safe though the check is +tightened to only take effect when the BIOS from American Megatrends is +used. + + 15:13 < ruik> but coreboot does not need that + 15:13 < ruik> because i have there only one root bus + 15:13 < ruik> the audio is behind a bridge + + $ sudo dmidecode + BIOS Information + Vendor: American Megatrends Inc. + Version: 0304 + Release Date: 10/30/2007 + +[1] http://www.coreboot.org/ + +Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=30552 + +Cc: Thomas Gleixner <tglx@linutronix.de> +Cc: Ingo Molnar <mingo@redhat.com> +Cc: H. Peter Anvin <hpa@zytor.com> +Cc: x86@kernel.org +Signed-off-by: Paul Menzel <paulepanter@users.sourceforge.net> +Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> +Acked-by: Jesse Barnes <jbarnes@virtuousgeek.org> +Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + arch/x86/pci/acpi.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +--- a/arch/x86/pci/acpi.c ++++ b/arch/x86/pci/acpi.c +@@ -43,6 +43,17 @@ static const struct dmi_system_id pci_us + DMI_MATCH(DMI_PRODUCT_NAME, "ALiveSATA2-GLAN"), + }, + }, ++ /* https://bugzilla.kernel.org/show_bug.cgi?id=30552 */ ++ /* 2006 AMD HT/VIA system with two host bridges */ ++ { ++ .callback = set_use_crs, ++ .ident = "ASUS M2V-MX SE", ++ .matches = { ++ DMI_MATCH(DMI_BOARD_VENDOR, "ASUSTeK Computer INC."), ++ DMI_MATCH(DMI_BOARD_NAME, "M2V-MX SE"), ++ DMI_MATCH(DMI_BIOS_VENDOR, "American Megatrends Inc."), ++ }, ++ }, + {} + }; + |