3.0 patches

8 files changed, 699 insertions, 1 deletions

diff --git a/queue-3.0/dm-table-avoid-crash-if-integrity-profile-changes.patch b/queue-3.0/dm-table-avoid-crash-if-integrity-profile-changes.patch
new file mode 100644
index 0000000000..67ceb3a986
--- /dev/null
+++ b/queue-3.0/dm-table-avoid-crash-if-integrity-profile-changes.patch
@@ -0,0 +1,52 @@
+From 876fbba1db4a377f050a2bb49b474c7527b2995d Mon Sep 17 00:00:00 2001
+From: Mike Snitzer <snitzer@redhat.com>
+Date: Sun, 25 Sep 2011 23:26:17 +0100
+Subject: dm table: avoid crash if integrity profile changes
+
+From: Mike Snitzer <snitzer@redhat.com>
+
+commit 876fbba1db4a377f050a2bb49b474c7527b2995d upstream.
+
+Commit a63a5cf (dm: improve block integrity support) introduced a
+two-phase initialization of a DM device's integrity profile.  This
+patch avoids dereferencing a NULL 'template_disk' pointer in
+blk_integrity_register() if there is an integrity profile mismatch in
+dm_table_set_integrity().
+
+This can occur if the integrity profiles for stacked devices in a DM
+table are changed between the call to dm_table_prealloc_integrity() and
+dm_table_set_integrity().
+
+Reported-by: Zdenek Kabelac <zkabelac@redhat.com>
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Alasdair G Kergon <agk@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/dm-table.c |   13 +++++++------
+ 1 file changed, 7 insertions(+), 6 deletions(-)
+
+--- a/drivers/md/dm-table.c
++++ b/drivers/md/dm-table.c
+@@ -1184,14 +1184,15 @@ static void dm_table_set_integrity(struc
+ 		return;
+ 
+ 	template_disk = dm_table_get_integrity_disk(t, true);
+-	if (!template_disk &&
+-	    blk_integrity_is_initialized(dm_disk(t->md))) {
++	if (template_disk)
++		blk_integrity_register(dm_disk(t->md),
++				       blk_get_integrity(template_disk));
++	else if (blk_integrity_is_initialized(dm_disk(t->md)))
+ 		DMWARN("%s: device no longer has a valid integrity profile",
+ 		       dm_device_name(t->md));
+-		return;
+-	}
+-	blk_integrity_register(dm_disk(t->md),
+-			       blk_get_integrity(template_disk));
++	else
++		DMWARN("%s: unable to establish an integrity profile",
++		       dm_device_name(t->md));
+ }
+ 
+ void dm_table_set_restrictions(struct dm_table *t, struct request_queue *q,
diff --git a/queue-3.0/fix-pointer-dereference-before-call-to.patch b/queue-3.0/fix-pointer-dereference-before-call-to.patch
new file mode 100644
index 0000000000..fa0a17fcf9
--- /dev/null
+++ b/queue-3.0/fix-pointer-dereference-before-call-to.patch
@@ -0,0 +1,73 @@
+From 5307f6d5fb12fd01f9f321bc4a8fd77e74858647 Mon Sep 17 00:00:00 2001
+From: Shyam Iyer <shyam.iyer.t@gmail.com>
+Date: Thu, 8 Sep 2011 16:41:17 -0500
+Subject: Fix pointer dereference before call to pcie_bus_configure_settings
+
+From: Shyam Iyer <shyam.iyer.t@gmail.com>
+
+commit 5307f6d5fb12fd01f9f321bc4a8fd77e74858647 upstream.
+
+Commit b03e7495a862 ("PCI: Set PCI-E Max Payload Size on fabric")
+introduced a potential NULL pointer dereference in calls to
+pcie_bus_configure_settings due to attempts to access pci_bus self
+variables when the self pointer is NULL.
+
+To correct this, verify that the self pointer in pci_bus is non-NULL
+before dereferencing it.
+
+Reported-by: Stanislaw Gruszka <sgruszka@redhat.com>
+Signed-off-by: Shyam Iyer <shyam_iyer@dell.com>
+Signed-off-by: Jon Mason <mason@myri.com>
+Acked-by: Jesse Barnes <jbarnes@virtuousgeek.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/pci/acpi.c              |    9 +++++++--
+ drivers/pci/hotplug/pcihp_slot.c |    4 +++-
+ drivers/pci/probe.c              |    3 ---
+ 3 files changed, 10 insertions(+), 6 deletions(-)
+
+--- a/arch/x86/pci/acpi.c
++++ b/arch/x86/pci/acpi.c
+@@ -366,8 +366,13 @@ struct pci_bus * __devinit pci_acpi_scan
+ 	 */
+ 	if (bus) {
+ 		struct pci_bus *child;
+-		list_for_each_entry(child, &bus->children, node)
+-			pcie_bus_configure_settings(child, child->self->pcie_mpss);
++		list_for_each_entry(child, &bus->children, node) {
++			struct pci_dev *self = child->self;
++			if (!self)
++				continue;
++
++			pcie_bus_configure_settings(child, self->pcie_mpss);
++		}
+ 	}
+ 
+ 	if (!bus)
+--- a/drivers/pci/hotplug/pcihp_slot.c
++++ b/drivers/pci/hotplug/pcihp_slot.c
+@@ -169,7 +169,9 @@ void pci_configure_slot(struct pci_dev *
+ 			(dev->class >> 8) == PCI_CLASS_BRIDGE_PCI)))
+ 		return;
+ 
+-	pcie_bus_configure_settings(dev->bus, dev->bus->self->pcie_mpss);
++	if (dev->bus && dev->bus->self)
++		pcie_bus_configure_settings(dev->bus,
++					    dev->bus->self->pcie_mpss);
+ 
+ 	memset(&hpp, 0, sizeof(hpp));
+ 	ret = pci_get_hp_params(dev, &hpp);
+--- a/drivers/pci/probe.c
++++ b/drivers/pci/probe.c
+@@ -1461,9 +1461,6 @@ void pcie_bus_configure_settings(struct
+ {
+ 	u8 smpss = mpss;
+ 
+-	if (!bus->self)
+-		return;
+-
+ 	if (!pci_is_pcie(bus->self))
+ 		return;
+ 
diff --git a/queue-3.0/libsas-fix-panic-when-single-phy-is-disabled-on-a-wide-port.patch b/queue-3.0/libsas-fix-panic-when-single-phy-is-disabled-on-a-wide-port.patch
new file mode 100644
index 0000000000..13c92dad68
--- /dev/null
+++ b/queue-3.0/libsas-fix-panic-when-single-phy-is-disabled-on-a-wide-port.patch
@@ -0,0 +1,111 @@
+From a73914c35b05d80f8ce78288e10056c91090b666 Mon Sep 17 00:00:00 2001
+From: Mark Salyzyn <mark_salyzyn@us.xyratex.com>
+Date: Thu, 22 Sep 2011 08:32:23 -0700
+Subject: [SCSI] libsas: fix panic when single phy is disabled on a wide port
+
+From: Mark Salyzyn <mark_salyzyn@us.xyratex.com>
+
+commit a73914c35b05d80f8ce78288e10056c91090b666 upstream.
+
+When a wide port is being utilized to a target, if one disables only one
+of the
+phys, we get an OS crash:
+
+BUG: unable to handle kernel NULL pointer dereference at
+0000000000000238
+IP: [<ffffffff814ca9b1>] mutex_lock+0x21/0x50
+PGD 4103f5067 PUD 41dba9067 PMD 0
+Oops: 0002 [#1] SMP
+last sysfs file: /sys/bus/pci/slots/5/address
+CPU 0
+Modules linked in: pm8001(U) ses enclosure fuse nfsd exportfs autofs4
+ipmi_devintf ipmi_si ipmi_msghandler nfs lockd fscache nfs_acl
+auth_rpcgss 8021q fcoe libfcoe garp libfc scsi_transport_fc stp scsi_tgt
+llc sunrpc cpufreq_ondemand acpi_cpufreq freq_table ipv6 sr_mod cdrom
+dm_mirror dm_region_hash dm_log uinput sg i2c_i801 i2c_core iTCO_wdt
+iTCO_vendor_support e1000e mlx4_ib ib_mad ib_core mlx4_en mlx4_core ext3
+jbd mbcache sd_mod crc_t10dif usb_storage ata_generic pata_acpi ata_piix
+libsas(U) scsi_transport_sas dm_mod [last unloaded: pm8001]
+
+Modules linked in: pm8001(U) ses enclosure fuse nfsd exportfs autofs4
+ipmi_devintf ipmi_si ipmi_msghandler nfs lockd fscache nfs_acl
+auth_rpcgss 8021q fcoe libfcoe garp libfc scsi_transport_fc stp scsi_tgt
+llc sunrpc cpufreq_ondemand acpi_cpufreq freq_table ipv6 sr_mod cdrom
+dm_mirror dm_region_hash dm_log uinput sg i2c_i801 i2c_core iTCO_wdt
+iTCO_vendor_support e1000e mlx4_ib ib_mad ib_core mlx4_en mlx4_core ext3
+jbd mbcache sd_mod crc_t10dif usb_storage ata_generic pata_acpi ata_piix
+libsas(U) scsi_transport_sas dm_mod [last unloaded: pm8001]
+Pid: 5146, comm: scsi_wq_5 Not tainted
+2.6.32-71.29.1.el6.lustre.7.x86_64 #1 Storage Server
+RIP: 0010:[<ffffffff814ca9b1>]  [<ffffffff814ca9b1>]
+mutex_lock+0x21/0x50
+RSP: 0018:ffff8803e4e33d30  EFLAGS: 00010246
+RAX: 0000000000000000 RBX: 0000000000000238 RCX: 0000000000000000
+RDX: 0000000000000000 RSI: ffff8803e664c800 RDI: 0000000000000238
+RBP: ffff8803e4e33d40 R08: 0000000000000000 R09: 0000000000000000
+R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000000
+R13: 0000000000000238 R14: ffff88041acb7200 R15: ffff88041c51ada0
+FS:  0000000000000000(0000) GS:ffff880028200000(0000)
+knlGS:0000000000000000
+CS:  0010 DS: 0018 ES: 0018 CR0: 000000008005003b
+CR2: 0000000000000238 CR3: 0000000410143000 CR4: 00000000000006f0
+DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
+Process scsi_wq_5 (pid: 5146, threadinfo ffff8803e4e32000, task
+ffff8803e4e294a0)
+Stack:
+ ffff8803e664c800 0000000000000000 ffff8803e4e33d70 ffffffffa001f06e
+<0> ffff8803e4e33d60 ffff88041c51ada0 ffff88041acb7200 ffff88041bc0aa00
+<0> ffff8803e4e33d90 ffffffffa0032b6c 0000000000000014 ffff88041acb7200
+Call Trace:
+ [<ffffffffa001f06e>] sas_port_delete_phy+0x2e/0xa0 [scsi_transport_sas]
+ [<ffffffffa0032b6c>] sas_unregister_devs_sas_addr+0xac/0xe0 [libsas]
+ [<ffffffffa0034914>] sas_ex_revalidate_domain+0x204/0x330 [libsas]
+ [<ffffffffa00307f0>] ? sas_revalidate_domain+0x0/0x90 [libsas]
+ [<ffffffffa0030855>] sas_revalidate_domain+0x65/0x90 [libsas]
+ [<ffffffff8108c7d0>] worker_thread+0x170/0x2a0
+ [<ffffffff81091ea0>] ? autoremove_wake_function+0x0/0x40
+ [<ffffffff8108c660>] ? worker_thread+0x0/0x2a0
+ [<ffffffff81091b36>] kthread+0x96/0xa0
+ [<ffffffff810141ca>] child_rip+0xa/0x20
+ [<ffffffff81091aa0>] ? kthread+0x0/0xa0
+ [<ffffffff810141c0>] ? child_rip+0x0/0x20
+Code: ff ff 85 c0 75 ed eb d6 66 90 55 48 89 e5 48 83 ec 10 48 89 1c 24
+4c 89 64 24 08 0f 1f 44 00 00 48 89 fb e8 92 f4 ff ff 48 89 df <f0> ff
+0f 79 05 e8 25 00 00 00 65 48 8b 04 25 08 cc 00 00 48 2d
+RIP  [<ffffffff814ca9b1>] mutex_lock+0x21/0x50
+ RSP <ffff8803e4e33d30>
+CR2: 0000000000000238
+
+The following patch is admittedly a band-aid, and does not solve the
+root cause, but it still is a good candidate for hardening as a pointer
+check before reference.
+
+Signed-off-by: Mark Salyzyn <mark_salyzyn@us.xyratex.com>
+Tested-by: Jack Wang <jack_wang@usish.com>
+Signed-off-by: James Bottomley <JBottomley@Parallels.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/scsi/libsas/sas_expander.c |   10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+--- a/drivers/scsi/libsas/sas_expander.c
++++ b/drivers/scsi/libsas/sas_expander.c
+@@ -1769,10 +1769,12 @@ static void sas_unregister_devs_sas_addr
+ 		sas_disable_routing(parent, phy->attached_sas_addr);
+ 	}
+ 	memset(phy->attached_sas_addr, 0, SAS_ADDR_SIZE);
+-	sas_port_delete_phy(phy->port, phy->phy);
+-	if (phy->port->num_phys == 0)
+-		sas_port_delete(phy->port);
+-	phy->port = NULL;
++	if (phy->port) {
++		sas_port_delete_phy(phy->port, phy->phy);
++		if (phy->port->num_phys == 0)
++			sas_port_delete(phy->port);
++		phy->port = NULL;
++	}
+ }
+ 
+ static int sas_discover_bfs_by_root_level(struct domain_device *root,
diff --git a/queue-3.0/md-avoid-waking-up-a-thread-after-it-has-been-freed.patch b/queue-3.0/md-avoid-waking-up-a-thread-after-it-has-been-freed.patch
new file mode 100644
index 0000000000..bafb790984
--- /dev/null
+++ b/queue-3.0/md-avoid-waking-up-a-thread-after-it-has-been-freed.patch
@@ -0,0 +1,177 @@
+From 01f96c0a9922cd9919baf9d16febdf7016177a12 Mon Sep 17 00:00:00 2001
+From: NeilBrown <neilb@suse.de>
+Date: Wed, 21 Sep 2011 15:30:20 +1000
+Subject: md: Avoid waking up a thread after it has been freed.
+
+From: NeilBrown <neilb@suse.de>
+
+commit 01f96c0a9922cd9919baf9d16febdf7016177a12 upstream.
+
+Two related problems:
+
+1/ some error paths call "md_unregister_thread(mddev->thread)"
+   without subsequently clearing ->thread.  A subsequent call
+   to mddev_unlock will try to wake the thread, and crash.
+
+2/ Most calls to md_wakeup_thread are protected against the thread
+   disappeared either by:
+      - holding the ->mutex
+      - having an active request, so something else must be keeping
+        the array active.
+   However mddev_unlock calls md_wakeup_thread after dropping the
+   mutex and without any certainty of an active request, so the
+   ->thread could theoretically disappear.
+   So we need a spinlock to provide some protections.
+
+So change md_unregister_thread to take a pointer to the thread
+pointer, and ensure that it always does the required locking, and
+clears the pointer properly.
+
+Reported-by: "Moshe Melnikov" <moshe@zadarastorage.com>
+Signed-off-by: NeilBrown <neilb@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/md.c        |   22 +++++++++++++++++++---
+ drivers/md/md.h        |    2 +-
+ drivers/md/multipath.c |    3 +--
+ drivers/md/raid1.c     |    3 +--
+ drivers/md/raid10.c    |    5 ++---
+ drivers/md/raid5.c     |    6 ++----
+ 6 files changed, 26 insertions(+), 15 deletions(-)
+
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -61,6 +61,11 @@
+ static void autostart_arrays(int part);
+ #endif
+ 
++/* pers_list is a list of registered personalities protected
++ * by pers_lock.
++ * pers_lock does extra service to protect accesses to
++ * mddev->thread when the mutex cannot be held.
++ */
+ static LIST_HEAD(pers_list);
+ static DEFINE_SPINLOCK(pers_lock);
+ 
+@@ -690,7 +695,12 @@ static void mddev_unlock(mddev_t * mddev
+ 	} else
+ 		mutex_unlock(&mddev->reconfig_mutex);
+ 
++	/* was we've dropped the mutex we need a spinlock to
++	 * make sur the thread doesn't disappear
++	 */
++	spin_lock(&pers_lock);
+ 	md_wakeup_thread(mddev->thread);
++	spin_unlock(&pers_lock);
+ }
+ 
+ static mdk_rdev_t * find_rdev_nr(mddev_t *mddev, int nr)
+@@ -6186,11 +6196,18 @@ mdk_thread_t *md_register_thread(void (*
+ 	return thread;
+ }
+ 
+-void md_unregister_thread(mdk_thread_t *thread)
++void md_unregister_thread(mdk_thread_t **threadp)
+ {
++	mdk_thread_t *thread = *threadp;
+ 	if (!thread)
+ 		return;
+ 	dprintk("interrupting MD-thread pid %d\n", task_pid_nr(thread->tsk));
++	/* Locking ensures that mddev_unlock does not wake_up a
++	 * non-existent thread
++	 */
++	spin_lock(&pers_lock);
++	*threadp = NULL;
++	spin_unlock(&pers_lock);
+ 
+ 	kthread_stop(thread->tsk);
+ 	kfree(thread);
+@@ -7125,8 +7142,7 @@ static void reap_sync_thread(mddev_t *md
+ 	mdk_rdev_t *rdev;
+ 
+ 	/* resync has finished, collect result */
+-	md_unregister_thread(mddev->sync_thread);
+-	mddev->sync_thread = NULL;
++	md_unregister_thread(&mddev->sync_thread);
+ 	if (!test_bit(MD_RECOVERY_INTR, &mddev->recovery) &&
+ 	    !test_bit(MD_RECOVERY_REQUESTED, &mddev->recovery)) {
+ 		/* success...*/
+--- a/drivers/md/md.h
++++ b/drivers/md/md.h
+@@ -475,7 +475,7 @@ extern int register_md_personality(struc
+ extern int unregister_md_personality(struct mdk_personality *p);
+ extern mdk_thread_t * md_register_thread(void (*run) (mddev_t *mddev),
+ 				mddev_t *mddev, const char *name);
+-extern void md_unregister_thread(mdk_thread_t *thread);
++extern void md_unregister_thread(mdk_thread_t **threadp);
+ extern void md_wakeup_thread(mdk_thread_t *thread);
+ extern void md_check_recovery(mddev_t *mddev);
+ extern void md_write_start(mddev_t *mddev, struct bio *bi);
+--- a/drivers/md/multipath.c
++++ b/drivers/md/multipath.c
+@@ -514,8 +514,7 @@ static int multipath_stop (mddev_t *mdde
+ {
+ 	multipath_conf_t *conf = mddev->private;
+ 
+-	md_unregister_thread(mddev->thread);
+-	mddev->thread = NULL;
++	md_unregister_thread(&mddev->thread);
+ 	blk_sync_queue(mddev->queue); /* the unplug fn references 'conf'*/
+ 	mempool_destroy(conf->pool);
+ 	kfree(conf->multipaths);
+--- a/drivers/md/raid1.c
++++ b/drivers/md/raid1.c
+@@ -2045,8 +2045,7 @@ static int stop(mddev_t *mddev)
+ 	raise_barrier(conf);
+ 	lower_barrier(conf);
+ 
+-	md_unregister_thread(mddev->thread);
+-	mddev->thread = NULL;
++	md_unregister_thread(&mddev->thread);
+ 	if (conf->r1bio_pool)
+ 		mempool_destroy(conf->r1bio_pool);
+ 	kfree(conf->mirrors);
+--- a/drivers/md/raid10.c
++++ b/drivers/md/raid10.c
+@@ -2331,7 +2331,7 @@ static int run(mddev_t *mddev)
+ 	return 0;
+ 
+ out_free_conf:
+-	md_unregister_thread(mddev->thread);
++	md_unregister_thread(&mddev->thread);
+ 	if (conf->r10bio_pool)
+ 		mempool_destroy(conf->r10bio_pool);
+ 	safe_put_page(conf->tmppage);
+@@ -2349,8 +2349,7 @@ static int stop(mddev_t *mddev)
+ 	raise_barrier(conf, 0);
+ 	lower_barrier(conf);
+ 
+-	md_unregister_thread(mddev->thread);
+-	mddev->thread = NULL;
++	md_unregister_thread(&mddev->thread);
+ 	blk_sync_queue(mddev->queue); /* the unplug fn references 'conf'*/
+ 	if (conf->r10bio_pool)
+ 		mempool_destroy(conf->r10bio_pool);
+--- a/drivers/md/raid5.c
++++ b/drivers/md/raid5.c
+@@ -5162,8 +5162,7 @@ static int run(mddev_t *mddev)
+ 
+ 	return 0;
+ abort:
+-	md_unregister_thread(mddev->thread);
+-	mddev->thread = NULL;
++	md_unregister_thread(&mddev->thread);
+ 	if (conf) {
+ 		print_raid5_conf(conf);
+ 		free_conf(conf);
+@@ -5177,8 +5176,7 @@ static int stop(mddev_t *mddev)
+ {
+ 	raid5_conf_t *conf = mddev->private;
+ 
+-	md_unregister_thread(mddev->thread);
+-	mddev->thread = NULL;
++	md_unregister_thread(&mddev->thread);
+ 	if (mddev->queue)
+ 		mddev->queue->backing_dev_info.congested_fn = NULL;
+ 	free_conf(conf);
diff --git a/queue-3.0/pci-disable-mps-configuration-by-default.patch b/queue-3.0/pci-disable-mps-configuration-by-default.patch
new file mode 100644
index 0000000000..f0ece81bea
--- /dev/null
+++ b/queue-3.0/pci-disable-mps-configuration-by-default.patch
@@ -0,0 +1,97 @@
+From 5f39e6705faade2e89d119958a8c51b9b6e2c53c Mon Sep 17 00:00:00 2001
+From: Jon Mason <mason@myri.com>
+Date: Mon, 3 Oct 2011 09:50:20 -0500
+Subject: PCI: Disable MPS configuration by default
+
+From: Jon Mason <mason@myri.com>
+
+commit 5f39e6705faade2e89d119958a8c51b9b6e2c53c upstream.
+
+Add the ability to disable PCI-E MPS turning and using the BIOS
+configured MPS defaults.  Due to the number of issues recently
+discovered on some x86 chipsets, make this the default behavior.
+
+Also, add the option for peer to peer DMA MPS configuration.  Peer to
+peer DMA is outside the scope of this patch, but MPS configuration could
+prevent it from working by having the MPS on one root port different
+than the MPS on another.  To work around this, simply make the system
+wide MPS the smallest possible value (128B).
+
+Signed-off-by: Jon Mason <mason@myri.com>
+Acked-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/pci/pci.c   |    6 +++++-
+ drivers/pci/probe.c |   14 +++++++++++++-
+ include/linux/pci.h |    3 ++-
+ 3 files changed, 20 insertions(+), 3 deletions(-)
+
+--- a/drivers/pci/pci.c
++++ b/drivers/pci/pci.c
+@@ -77,7 +77,7 @@ unsigned long pci_cardbus_mem_size = DEF
+ unsigned long pci_hotplug_io_size  = DEFAULT_HOTPLUG_IO_SIZE;
+ unsigned long pci_hotplug_mem_size = DEFAULT_HOTPLUG_MEM_SIZE;
+ 
+-enum pcie_bus_config_types pcie_bus_config = PCIE_BUS_SAFE;
++enum pcie_bus_config_types pcie_bus_config = PCIE_BUS_TUNE_OFF;
+ 
+ /*
+  * The default CLS is used if arch didn't set CLS explicitly and not
+@@ -3568,10 +3568,14 @@ static int __init pci_setup(char *str)
+ 				pci_hotplug_io_size = memparse(str + 9, &str);
+ 			} else if (!strncmp(str, "hpmemsize=", 10)) {
+ 				pci_hotplug_mem_size = memparse(str + 10, &str);
++			} else if (!strncmp(str, "pcie_bus_tune_off", 17)) {
++				pcie_bus_config = PCIE_BUS_TUNE_OFF;
+ 			} else if (!strncmp(str, "pcie_bus_safe", 13)) {
+ 				pcie_bus_config = PCIE_BUS_SAFE;
+ 			} else if (!strncmp(str, "pcie_bus_perf", 13)) {
+ 				pcie_bus_config = PCIE_BUS_PERFORMANCE;
++			} else if (!strncmp(str, "pcie_bus_peer2peer", 18)) {
++				pcie_bus_config = PCIE_BUS_PEER2PEER;
+ 			} else {
+ 				printk(KERN_ERR "PCI: Unknown option `%s'\n",
+ 						str);
+--- a/drivers/pci/probe.c
++++ b/drivers/pci/probe.c
+@@ -1459,12 +1459,24 @@ static int pcie_bus_configure_set(struct
+  */
+ void pcie_bus_configure_settings(struct pci_bus *bus, u8 mpss)
+ {
+-	u8 smpss = mpss;
++	u8 smpss;
+ 
+ 	if (!pci_is_pcie(bus->self))
+ 		return;
+ 
++	if (pcie_bus_config == PCIE_BUS_TUNE_OFF)
++		return;
++
++	/* FIXME - Peer to peer DMA is possible, though the endpoint would need
++	 * to be aware to the MPS of the destination.  To work around this,
++	 * simply force the MPS of the entire system to the smallest possible.
++	 */
++	if (pcie_bus_config == PCIE_BUS_PEER2PEER)
++		smpss = 0;
++
+ 	if (pcie_bus_config == PCIE_BUS_SAFE) {
++		smpss = mpss;
++
+ 		pcie_find_smpss(bus->self, &smpss);
+ 		pci_walk_bus(bus, pcie_find_smpss, &smpss);
+ 	}
+--- a/include/linux/pci.h
++++ b/include/linux/pci.h
+@@ -621,8 +621,9 @@ struct pci_driver {
+ extern void pcie_bus_configure_settings(struct pci_bus *bus, u8 smpss);
+ 
+ enum pcie_bus_config_types {
+-	PCIE_BUS_PERFORMANCE,
++	PCIE_BUS_TUNE_OFF,
+ 	PCIE_BUS_SAFE,
++	PCIE_BUS_PERFORMANCE,
+ 	PCIE_BUS_PEER2PEER,
+ };
+ 
diff --git a/queue-3.0/qla2xxx-fix-crash-in-qla2x00_abort_all_cmds-on-unload.patch b/queue-3.0/qla2xxx-fix-crash-in-qla2x00_abort_all_cmds-on-unload.patch
new file mode 100644
index 0000000000..812b93a696
--- /dev/null
+++ b/queue-3.0/qla2xxx-fix-crash-in-qla2x00_abort_all_cmds-on-unload.patch
@@ -0,0 +1,53 @@
+From 9bfacd01dc9b7519e1e6da12b01963550b9d09a2 Mon Sep 17 00:00:00 2001
+From: Roland Dreier <roland@purestorage.com>
+Date: Thu, 22 Sep 2011 00:06:05 -0700
+Subject: [SCSI] qla2xxx: Fix crash in qla2x00_abort_all_cmds() on unload
+
+From: Roland Dreier <roland@purestorage.com>
+
+commit 9bfacd01dc9b7519e1e6da12b01963550b9d09a2 upstream.
+
+I hit a crash in qla2x00_abort_all_cmds() if the qla2xxx module is
+unloaded right after it is loaded.  I debugged this down to the abort
+handling improperly treating a command of type SRB_ADISC_CMD as if it
+had a bsg_job to complete when that command actually uses the iocb_cmd
+part of the union.  (I guess to hit this one has to unload the module
+while the async FC initialization is still in progress)
+
+It seems we should only look for a bsg_job if type is SRB_ELS_CMD_RPT,
+SRB_ELS_CMD_HST or SRB_CT_CMD, so switch the test to make that explicit.
+
+Signed-off-by: Roland Dreier <roland@purestorage.com>
+Acked-by: Chad Dupuis <chad.dupuis@qlogic.com>
+Signed-off-by: James Bottomley <JBottomley@Parallels.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/scsi/qla2xxx/qla_os.c |    9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+--- a/drivers/scsi/qla2xxx/qla_os.c
++++ b/drivers/scsi/qla2xxx/qla_os.c
+@@ -1240,10 +1240,9 @@ qla2x00_abort_all_cmds(scsi_qla_host_t *
+ 					qla2x00_sp_compl(ha, sp);
+ 				} else {
+ 					ctx = sp->ctx;
+-					if (ctx->type == SRB_LOGIN_CMD ||
+-					    ctx->type == SRB_LOGOUT_CMD) {
+-						ctx->u.iocb_cmd->free(sp);
+-					} else {
++					if (ctx->type == SRB_ELS_CMD_RPT ||
++					    ctx->type == SRB_ELS_CMD_HST ||
++					    ctx->type == SRB_CT_CMD) {
+ 						struct fc_bsg_job *bsg_job =
+ 						    ctx->u.bsg_job;
+ 						if (bsg_job->request->msgcode
+@@ -1255,6 +1254,8 @@ qla2x00_abort_all_cmds(scsi_qla_host_t *
+ 						kfree(sp->ctx);
+ 						mempool_free(sp,
+ 							ha->srb_mempool);
++					} else {
++						ctx->u.iocb_cmd->free(sp);
+ 					}
+ 				}
+ 			}
diff --git a/queue-3.0/series b/queue-3.0/series
index dbcf9bbdcf..a025e708d4 100644
--- a/queue-3.0/series
+++ b/queue-3.0/series
@@ -1,9 +1,12 @@
+# do we really want these 6 PCI patches for 3.0?
 pci-set-pci-e-max-payload-size-on-fabric.patch
 pci-export-pcie_bus_configure_settings-symbol.patch
 pci-remove-mrrs-modification-from-mps-setting-code.patch
 pci-don-t-crash-when-reading-mpss-from-root-complex.patch
-sparc64-force-the-execute-bit-in-openfirmware-s-translation-entries.patch
+fix-pointer-dereference-before-call-to.patch
+pci-disable-mps-configuration-by-default.patch
 
+sparc64-force-the-execute-bit-in-openfirmware-s-translation-entries.patch
 sched-rt-migrate-equal-priority-tasks-to-available-cpus.patch
 sched-fix-up-wchan-borkage.patch
 ide-disk-fix-request-requeuing.patch
@@ -18,3 +21,8 @@ drm-radeon-kms-add-retry-limits-for-native-dp-aux-defer.patch
 drm-radeon-kms-fix-channel_remap-setup-v2.patch
 ptp-fix-l2-event-message-recognition.patch
 rt2x00-serialize-tx-operations-on-a-queue.patch
+x86-pci-use-host-bridge-_crs-info-on-asus-m2v-mx-se.patch
+qla2xxx-fix-crash-in-qla2x00_abort_all_cmds-on-unload.patch
+libsas-fix-panic-when-single-phy-is-disabled-on-a-wide-port.patch
+md-avoid-waking-up-a-thread-after-it-has-been-freed.patch
+dm-table-avoid-crash-if-integrity-profile-changes.patch
diff --git a/queue-3.0/x86-pci-use-host-bridge-_crs-info-on-asus-m2v-mx-se.patch b/queue-3.0/x86-pci-use-host-bridge-_crs-info-on-asus-m2v-mx-se.patch
new file mode 100644
index 0000000000..68fd7122ee
--- /dev/null
+++ b/queue-3.0/x86-pci-use-host-bridge-_crs-info-on-asus-m2v-mx-se.patch
@@ -0,0 +1,127 @@
+From 29cf7a30f8a0ce4af2406d93d5a332099be26923 Mon Sep 17 00:00:00 2001
+From: Paul Menzel <paulepanter@users.sourceforge.net>
+Date: Wed, 31 Aug 2011 17:07:10 +0200
+Subject: x86/PCI: use host bridge _CRS info on ASUS M2V-MX SE
+
+From: Paul Menzel <paulepanter@users.sourceforge.net>
+
+commit 29cf7a30f8a0ce4af2406d93d5a332099be26923 upstream.
+
+In summary, this DMI quirk uses the _CRS info by default for the ASUS
+M2V-MX SE by turning on `pci=use_crs` and is similar to the quirk
+added by commit 2491762cfb47 ("x86/PCI: use host bridge _CRS info on
+ASRock ALiveSATA2-GLAN") whose commit message should be read for further
+information.
+
+Since commit 3e3da00c01d0 ("x86/pci: AMD one chain system to use pci
+read out res") Linux gives the following oops:
+
+    parport0: PC-style at 0x378, irq 7 [PCSPP,TRISTATE]
+    HDA Intel 0000:20:01.0: PCI INT A -> GSI 17 (level, low) -> IRQ 17
+    HDA Intel 0000:20:01.0: setting latency timer to 64
+    BUG: unable to handle kernel paging request at ffffc90011c08000
+    IP: [<ffffffffa0578402>] azx_probe+0x3ad/0x86b [snd_hda_intel]
+    PGD 13781a067 PUD 13781b067 PMD 1300ba067 PTE 800000fd00000173
+    Oops: 0009 [#1] SMP
+    last sysfs file: /sys/module/snd_pcm/initstate
+    CPU 0
+    Modules linked in: snd_hda_intel(+) snd_hda_codec snd_hwdep snd_pcm_oss snd_mixer_oss snd_pcm snd_seq_midi snd_rawmidi snd_seq_midi_event tpm_tis tpm snd_seq tpm_bios psmouse parport_pc snd_timer snd_seq_device parport processor evdev snd i2c_viapro thermal_sys amd64_edac_mod k8temp i2c_core soundcore shpchp pcspkr serio_raw asus_atk0110 pci_hotplug edac_core button snd_page_alloc edac_mce_amd ext3 jbd mbcache sha256_generic cryptd aes_x86_64 aes_generic cbc dm_crypt dm_mod raid1 md_mod usbhid hid sg sd_mod crc_t10dif sr_mod cdrom ata_generic uhci_hcd sata_via pata_via libata ehci_hcd usbcore scsi_mod via_rhine mii nls_base [last unloaded: scsi_wait_scan]
+    Pid: 1153, comm: work_for_cpu Not tainted 2.6.37-1-amd64 #1 M2V-MX SE/System Product Name
+    RIP: 0010:[<ffffffffa0578402>]  [<ffffffffa0578402>] azx_probe+0x3ad/0x86b [snd_hda_intel]
+    RSP: 0018:ffff88013153fe50  EFLAGS: 00010286
+    RAX: ffffc90011c08000 RBX: ffff88013029ec00 RCX: 0000000000000006
+    RDX: 0000000000000000 RSI: 0000000000000246 RDI: 0000000000000246
+    RBP: ffff88013341d000 R08: 0000000000000000 R09: 0000000000000040
+    R10: 0000000000000286 R11: 0000000000003731 R12: ffff88013029c400
+    R13: 0000000000000000 R14: 0000000000000000 R15: ffff88013341d090
+    FS:  0000000000000000(0000) GS:ffff8800bfc00000(0000) knlGS:00000000f7610ab0
+    CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
+    CR2: ffffc90011c08000 CR3: 0000000132f57000 CR4: 00000000000006f0
+    DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+    DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
+    Process work_for_cpu (pid: 1153, threadinfo ffff88013153e000, task ffff8801303c86c0)
+    Stack:
+     0000000000000005 ffffffff8123ad65 00000000000136c0 ffff88013029c400
+     ffff8801303c8998 ffff88013341d000 ffff88013341d090 ffff8801322d9dc8
+     ffff88013341d208 0000000000000000 0000000000000000 ffffffff811ad232
+    Call Trace:
+     [<ffffffff8123ad65>] ? __pm_runtime_set_status+0x162/0x186
+     [<ffffffff811ad232>] ? local_pci_probe+0x49/0x92
+     [<ffffffff8105afc5>] ? do_work_for_cpu+0x0/0x1b
+     [<ffffffff8105afc5>] ? do_work_for_cpu+0x0/0x1b
+     [<ffffffff8105afd0>] ? do_work_for_cpu+0xb/0x1b
+     [<ffffffff8105fd3f>] ? kthread+0x7a/0x82
+     [<ffffffff8100a824>] ? kernel_thread_helper+0x4/0x10
+     [<ffffffff8105fcc5>] ? kthread+0x0/0x82
+     [<ffffffff8100a820>] ? kernel_thread_helper+0x0/0x10
+    Code: f4 01 00 00 ef 31 f6 48 89 df e8 29 dd ff ff 85 c0 0f 88 2b 03 00 00 48 89 ef e8 b4 39 c3 e0 8b 7b 40 e8 fc 9d b1 e0 48 8b 43 38 <66> 8b 10 66 89 14 24 8b 43 14 83 e8 03 83 f8 01 77 32 31 d2 be
+    RIP  [<ffffffffa0578402>] azx_probe+0x3ad/0x86b [snd_hda_intel]
+     RSP <ffff88013153fe50>
+    CR2: ffffc90011c08000
+    ---[ end trace 8d1f3ebc136437fd ]---
+
+Trusting the ACPI _CRS information (`pci=use_crs`) fixes this problem.
+
+    $ dmesg | grep -i crs # with the quirk
+    PCI: Using host bridge windows from ACPI; if necessary, use "pci=nocrs" and report a bug
+
+The match has to be against the DMI board entries though since the vendor entries are not populated.
+
+    DMI: System manufacturer System Product Name/M2V-MX SE, BIOS 0304    10/30/2007
+
+This quirk should be removed when `pci=use_crs` is enabled for machines
+from 2006 or earlier or some other solution is implemented.
+
+Using coreboot [1] with this board the problem does not exist but this
+quirk also does not affect it either. To be safe though the check is
+tightened to only take effect when the BIOS from American Megatrends is
+used.
+
+        15:13 < ruik> but coreboot does not need that
+        15:13 < ruik> because i have there only one root bus
+        15:13 < ruik> the audio is behind a bridge
+
+        $ sudo dmidecode
+        BIOS Information
+                Vendor: American Megatrends Inc.
+                Version: 0304
+                Release Date: 10/30/2007
+
+[1] http://www.coreboot.org/
+
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=30552
+
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: H. Peter Anvin <hpa@zytor.com>
+Cc: x86@kernel.org
+Signed-off-by: Paul Menzel <paulepanter@users.sourceforge.net>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Acked-by: Jesse Barnes <jbarnes@virtuousgeek.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/pci/acpi.c |   11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+--- a/arch/x86/pci/acpi.c
++++ b/arch/x86/pci/acpi.c
+@@ -43,6 +43,17 @@ static const struct dmi_system_id pci_us
+ 			DMI_MATCH(DMI_PRODUCT_NAME, "ALiveSATA2-GLAN"),
+                 },
+         },
++	/* https://bugzilla.kernel.org/show_bug.cgi?id=30552 */
++	/* 2006 AMD HT/VIA system with two host bridges */
++	{
++		.callback = set_use_crs,
++		.ident = "ASUS M2V-MX SE",
++		.matches = {
++			DMI_MATCH(DMI_BOARD_VENDOR, "ASUSTeK Computer INC."),
++			DMI_MATCH(DMI_BOARD_NAME, "M2V-MX SE"),
++			DMI_MATCH(DMI_BIOS_VENDOR, "American Megatrends Inc."),
++		},
++	},
+ 	{}
+ };
+