.33

7 files changed, 318 insertions, 0 deletions

diff --git a/queue-2.6.33/ahci-ahci-and-raid-mode-sata-patch-for-intel-patsburg-deviceids.patch b/queue-2.6.33/ahci-ahci-and-raid-mode-sata-patch-for-intel-patsburg-deviceids.patch
new file mode 100644
index 0000000..4af2a69
--- /dev/null
+++ b/queue-2.6.33/ahci-ahci-and-raid-mode-sata-patch-for-intel-patsburg-deviceids.patch
@@ -0,0 +1,32 @@
+From 992b3fb9b5391bc4de5b42bb810dc6dd583a6c4a Mon Sep 17 00:00:00 2001
+From: Seth Heasley <seth.heasley@intel.com>
+Date: Thu, 9 Sep 2010 09:44:56 -0700
+Subject: ahci: AHCI and RAID mode SATA patch for Intel Patsburg DeviceIDs
+
+From: Seth Heasley <seth.heasley@intel.com>
+
+commit 992b3fb9b5391bc4de5b42bb810dc6dd583a6c4a upstream.
+
+This patch adds the Intel Patsburg (PCH) SATA AHCI and RAID Controller
+DeviceIDs.
+
+Signed-off-by: Seth Heasley <seth.heasley@intel.com>
+Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/ata/ahci.c |    3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/ata/ahci.c
++++ b/drivers/ata/ahci.c
+@@ -576,6 +576,9 @@ static const struct pci_device_id ahci_p
+ 	{ PCI_VDEVICE(INTEL, 0x1c05), board_ahci }, /* CPT RAID */
+ 	{ PCI_VDEVICE(INTEL, 0x1c06), board_ahci }, /* CPT RAID */
+ 	{ PCI_VDEVICE(INTEL, 0x1c07), board_ahci }, /* CPT RAID */
++	{ PCI_VDEVICE(INTEL, 0x1d02), board_ahci }, /* PBG AHCI */
++	{ PCI_VDEVICE(INTEL, 0x1d04), board_ahci }, /* PBG RAID */
++	{ PCI_VDEVICE(INTEL, 0x1d06), board_ahci }, /* PBG RAID */
+ 
+ 	/* JMicron 360/1/3/5/6, match class to avoid IDE function */
+ 	{ PCI_VENDOR_ID_JMICRON, PCI_ANY_ID, PCI_ANY_ID, PCI_ANY_ID,
diff --git a/queue-2.6.33/ahci-ahci-mode-sata-patch-for-intel-dh89xxcc-deviceids.patch b/queue-2.6.33/ahci-ahci-mode-sata-patch-for-intel-dh89xxcc-deviceids.patch
new file mode 100644
index 0000000..18b7072
--- /dev/null
+++ b/queue-2.6.33/ahci-ahci-mode-sata-patch-for-intel-dh89xxcc-deviceids.patch
@@ -0,0 +1,29 @@
+From a4a461a6df6c0481d5a3d61660ed97f5b539cf16 Mon Sep 17 00:00:00 2001
+From: Seth Heasley <seth.heasley@intel.com>
+Date: Mon, 10 Jan 2011 12:57:17 -0800
+Subject: ahci: AHCI mode SATA patch for Intel DH89xxCC DeviceIDs
+
+From: Seth Heasley <seth.heasley@intel.com>
+
+commit a4a461a6df6c0481d5a3d61660ed97f5b539cf16 upstream.
+
+This patch adds the AHCI-mode SATA DeviceID for the Intel DH89xxCC PCH.
+
+Signed-off-by: Seth Heasley <seth.heasley@intel.com>
+Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/ata/ahci.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/ata/ahci.c
++++ b/drivers/ata/ahci.c
+@@ -579,6 +579,7 @@ static const struct pci_device_id ahci_p
+ 	{ PCI_VDEVICE(INTEL, 0x1d02), board_ahci }, /* PBG AHCI */
+ 	{ PCI_VDEVICE(INTEL, 0x1d04), board_ahci }, /* PBG RAID */
+ 	{ PCI_VDEVICE(INTEL, 0x1d06), board_ahci }, /* PBG RAID */
++	{ PCI_VDEVICE(INTEL, 0x2323), board_ahci }, /* DH89xxCC AHCI */
+ 
+ 	/* JMicron 360/1/3/5/6, match class to avoid IDE function */
+ 	{ PCI_VENDOR_ID_JMICRON, PCI_ANY_ID, PCI_ANY_ID, PCI_ANY_ID,
diff --git a/queue-2.6.33/ahci-ahci-mode-sata-patch-for-intel-patsburg-sata-raid-controller.patch b/queue-2.6.33/ahci-ahci-mode-sata-patch-for-intel-patsburg-sata-raid-controller.patch
new file mode 100644
index 0000000..a423596
--- /dev/null
+++ b/queue-2.6.33/ahci-ahci-mode-sata-patch-for-intel-patsburg-sata-raid-controller.patch
@@ -0,0 +1,29 @@
+From 64a3903d0885879ba8706a8bcf71c5e3e7664db2 Mon Sep 17 00:00:00 2001
+From: Seth Heasley <seth.heasley@intel.com>
+Date: Fri, 11 Mar 2011 11:57:42 -0800
+Subject: ahci: AHCI mode SATA patch for Intel Patsburg SATA RAID controller
+
+From: Seth Heasley <seth.heasley@intel.com>
+
+commit 64a3903d0885879ba8706a8bcf71c5e3e7664db2 upstream.
+
+This patch adds an updated SATA RAID DeviceID for the Intel Patsburg PCH.
+
+Signed-off-by: Seth Heasley <seth.heasley@intel.com>
+Signed-off-by: Jeff Garzik <jgarzik@pobox.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/ata/ahci.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/ata/ahci.c
++++ b/drivers/ata/ahci.c
+@@ -579,6 +579,7 @@ static const struct pci_device_id ahci_p
+ 	{ PCI_VDEVICE(INTEL, 0x1d02), board_ahci }, /* PBG AHCI */
+ 	{ PCI_VDEVICE(INTEL, 0x1d04), board_ahci }, /* PBG RAID */
+ 	{ PCI_VDEVICE(INTEL, 0x1d06), board_ahci }, /* PBG RAID */
++	{ PCI_VDEVICE(INTEL, 0x2826), board_ahci }, /* PBG RAID */
+ 	{ PCI_VDEVICE(INTEL, 0x2323), board_ahci }, /* DH89xxCC AHCI */
+ 
+ 	/* JMicron 360/1/3/5/6, match class to avoid IDE function */
diff --git a/queue-2.6.33/ib-cm-bump-reference-count-on-cm_id-before-invoking-callback.patch b/queue-2.6.33/ib-cm-bump-reference-count-on-cm_id-before-invoking-callback.patch
new file mode 100644
index 0000000..ded3e13
--- /dev/null
+++ b/queue-2.6.33/ib-cm-bump-reference-count-on-cm_id-before-invoking-callback.patch
@@ -0,0 +1,42 @@
+From 29963437a48475036353b95ab142bf199adb909e Mon Sep 17 00:00:00 2001
+From: Sean Hefty <sean.hefty@intel.com>
+Date: Wed, 23 Feb 2011 08:17:40 -0800
+Subject: IB/cm: Bump reference count on cm_id before invoking callback
+
+From: Sean Hefty <sean.hefty@intel.com>
+
+commit 29963437a48475036353b95ab142bf199adb909e upstream.
+
+When processing a SIDR REQ, the ib_cm allocates a new cm_id.  The
+refcount of the cm_id is initialized to 1.  However, cm_process_work
+will decrement the refcount after invoking all callbacks.  The result
+is that the cm_id will end up with refcount set to 0 by the end of the
+sidr req handler.
+
+If a user tries to destroy the cm_id, the destruction will proceed,
+under the incorrect assumption that no other threads are referencing
+the cm_id.  This can lead to a crash when the cm callback thread tries
+to access the cm_id.
+
+This problem was noticed as part of a larger investigation with kernel
+crashes in the rdma_cm when running on a real time OS.
+
+Signed-off-by: Sean Hefty <sean.hefty@intel.com>
+Acked-by: Doug Ledford <dledford@redhat.com>
+Signed-off-by: Roland Dreier <roland@purestorage.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/infiniband/core/cm.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/infiniband/core/cm.c
++++ b/drivers/infiniband/core/cm.c
+@@ -2986,6 +2986,7 @@ static int cm_sidr_req_handler(struct cm
+ 		goto out; /* No match. */
+ 	}
+ 	atomic_inc(&cur_cm_id_priv->refcount);
++	atomic_inc(&cm_id_priv->refcount);
+ 	spin_unlock_irq(&cm.lock);
+ 
+ 	cm_id_priv->id.cm_handler = cur_cm_id_priv->id.cm_handler;
diff --git a/queue-2.6.33/rdma-cma-fix-crash-in-request-handlers.patch b/queue-2.6.33/rdma-cma-fix-crash-in-request-handlers.patch
new file mode 100644
index 0000000..1d2a472
--- /dev/null
+++ b/queue-2.6.33/rdma-cma-fix-crash-in-request-handlers.patch
@@ -0,0 +1,131 @@
+From 25ae21a10112875763c18b385624df713a288a05 Mon Sep 17 00:00:00 2001
+From: Sean Hefty <sean.hefty@intel.com>
+Date: Wed, 23 Feb 2011 08:11:32 -0800
+Subject: RDMA/cma: Fix crash in request handlers
+
+From: Sean Hefty <sean.hefty@intel.com>
+
+commit 25ae21a10112875763c18b385624df713a288a05 upstream.
+
+Doug Ledford and Red Hat reported a crash when running the rdma_cm on
+a real-time OS.  The crash has the following call trace:
+
+    cm_process_work
+       cma_req_handler
+          cma_disable_callback
+          rdma_create_id
+             kzalloc
+             init_completion
+          cma_get_net_info
+          cma_save_net_info
+          cma_any_addr
+             cma_zero_addr
+          rdma_translate_ip
+             rdma_copy_addr
+          cma_acquire_dev
+             rdma_addr_get_sgid
+             ib_find_cached_gid
+             cma_attach_to_dev
+          ucma_event_handler
+             kzalloc
+             ib_copy_ah_attr_to_user
+          cma_comp
+
+[ preempted ]
+
+    cma_write
+        copy_from_user
+        ucma_destroy_id
+           copy_from_user
+           _ucma_find_context
+           ucma_put_ctx
+           ucma_free_ctx
+              rdma_destroy_id
+                 cma_exch
+                 cma_cancel_operation
+                 rdma_node_get_transport
+
+        rt_mutex_slowunlock
+        bad_area_nosemaphore
+        oops_enter
+
+They were able to reproduce the crash multiple times with the
+following details:
+
+    Crash seems to always happen on the:
+            mutex_unlock(&conn_id->handler_mutex);
+    as conn_id looks to have been freed during this code path.
+
+An examination of the code shows that a race exists in the request
+handlers.  When a new connection request is received, the rdma_cm
+allocates a new connection identifier.  This identifier has a single
+reference count on it.  If a user calls rdma_destroy_id() from another
+thread after receiving a callback, rdma_destroy_id will proceed to
+destroy the id and free the associated memory.  However, the request
+handlers may still be in the process of running.  When control returns
+to the request handlers, they can attempt to access the newly created
+identifiers.
+
+Fix this by holding a reference on the newly created rdma_cm_id until
+the request handler is through accessing it.
+
+Signed-off-by: Sean Hefty <sean.hefty@intel.com>
+Acked-by: Doug Ledford <dledford@redhat.com>
+Signed-off-by: Roland Dreier <roland@purestorage.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/infiniband/core/cma.c |   15 +++++++++++++++
+ 1 file changed, 15 insertions(+)
+
+--- a/drivers/infiniband/core/cma.c
++++ b/drivers/infiniband/core/cma.c
+@@ -1136,6 +1136,11 @@ static int cma_req_handler(struct ib_cm_
+ 	cm_id->context = conn_id;
+ 	cm_id->cm_handler = cma_ib_handler;
+ 
++	/*
++	 * Protect against the user destroying conn_id from another thread
++	 * until we're done accessing it.
++	 */
++	atomic_inc(&conn_id->refcount);
+ 	ret = conn_id->id.event_handler(&conn_id->id, &event);
+ 	if (!ret) {
+ 		/*
+@@ -1148,8 +1153,10 @@ static int cma_req_handler(struct ib_cm_
+ 			ib_send_cm_mra(cm_id, CMA_CM_MRA_SETTING, NULL, 0);
+ 		mutex_unlock(&lock);
+ 		mutex_unlock(&conn_id->handler_mutex);
++		cma_deref_id(conn_id);
+ 		goto out;
+ 	}
++	cma_deref_id(conn_id);
+ 
+ 	/* Destroy the CM ID by returning a non-zero value. */
+ 	conn_id->cm_id.ib = NULL;
+@@ -1351,17 +1358,25 @@ static int iw_conn_req_handler(struct iw
+ 	event.param.conn.private_data_len = iw_event->private_data_len;
+ 	event.param.conn.initiator_depth = attr.max_qp_init_rd_atom;
+ 	event.param.conn.responder_resources = attr.max_qp_rd_atom;
++
++	/*
++	 * Protect against the user destroying conn_id from another thread
++	 * until we're done accessing it.
++	 */
++	atomic_inc(&conn_id->refcount);
+ 	ret = conn_id->id.event_handler(&conn_id->id, &event);
+ 	if (ret) {
+ 		/* User wants to destroy the CM ID */
+ 		conn_id->cm_id.iw = NULL;
+ 		cma_exch(conn_id, CMA_DESTROYING);
+ 		mutex_unlock(&conn_id->handler_mutex);
++		cma_deref_id(conn_id);
+ 		rdma_destroy_id(&conn_id->id);
+ 		goto out;
+ 	}
+ 
+ 	mutex_unlock(&conn_id->handler_mutex);
++	cma_deref_id(conn_id);
+ 
+ out:
+ 	if (dev)
diff --git a/queue-2.6.33/series b/queue-2.6.33/series
index 9f9edb4..65a1cfb 100644
--- a/queue-2.6.33/series
+++ b/queue-2.6.33/series
@@ -434,3 +434,9 @@ x86-mm-handle-mm_fault_error-in-kernel-space.patch
 ftrace-fix-memory-leak-with-function-graph-and-cpu-hotplug.patch
 x86-fix-panic-when-handling-mem-invalid-param.patch
 x86-emit-mem-nopentium-ignored-warning-when-not-supported.patch
+ahci-ahci-and-raid-mode-sata-patch-for-intel-patsburg-deviceids.patch
+ahci-ahci-mode-sata-patch-for-intel-dh89xxcc-deviceids.patch
+ahci-ahci-mode-sata-patch-for-intel-patsburg-sata-raid-controller.patch
+rdma-cma-fix-crash-in-request-handlers.patch
+ib-cm-bump-reference-count-on-cm_id-before-invoking-callback.patch
+x86-quirk-fix-sb600-revision-check.patch
diff --git a/queue-2.6.33/x86-quirk-fix-sb600-revision-check.patch b/queue-2.6.33/x86-quirk-fix-sb600-revision-check.patch
new file mode 100644
index 0000000..d793be5
--- /dev/null
+++ b/queue-2.6.33/x86-quirk-fix-sb600-revision-check.patch
@@ -0,0 +1,49 @@
+From 1d3e09a304e6c4e004ca06356578b171e8735d3c Mon Sep 17 00:00:00 2001
+From: Andreas Herrmann <andreas.herrmann3@amd.com>
+Date: Tue, 15 Mar 2011 15:31:37 +0100
+Subject: x86, quirk: Fix SB600 revision check
+
+From: Andreas Herrmann <andreas.herrmann3@amd.com>
+
+commit 1d3e09a304e6c4e004ca06356578b171e8735d3c upstream.
+
+Commit 7f74f8f28a2bd9db9404f7d364e2097a0c42cc12
+(x86 quirk: Fix polarity for IRQ0 pin2 override on SB800
+systems) introduced a regression. It removed some SB600 specific
+code to determine the revision ID without adapting a
+corresponding revision ID check for SB600.
+
+See this mail thread:
+
+  http://marc.info/?l=linux-kernel&m=129980296006380&w=2
+
+This patch adapts the corresponding check to cover all SB600
+revisions.
+
+Tested-by: Wang Lei <f3d27b@gmail.com>
+Signed-off-by: Andreas Herrmann <andreas.herrmann3@amd.com>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+LKML-Reference: <20110315143137.GD29499@alberich.amd.com>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/early-quirks.c |    7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/arch/x86/kernel/early-quirks.c
++++ b/arch/x86/kernel/early-quirks.c
+@@ -161,7 +161,12 @@ static void __init ati_bugs_contd(int nu
+ 	if (rev >= 0x40)
+ 		acpi_fix_pin2_polarity = 1;
+ 
+-	if (rev > 0x13)
++	/*
++	 * SB600: revisions 0x11, 0x12, 0x13, 0x14, ...
++	 * SB700: revisions 0x39, 0x3a, ...
++	 * SB800: revisions 0x40, 0x41, ...
++	 */
++	if (rev >= 0x39)
+ 		return;
+ 
+ 	if (acpi_use_timer_override)