--- /dev/null
+From stable-bounces@linux.kernel.org Mon Oct 15 06:05:14 2007
+From: Takashi Iwai <tiwai@suse.de>
+Date: Mon, 15 Oct 2007 14:37:11 +0200
+Subject: ALSA: hda-codec - Add array terminator for dmic in STAC codec
+To: stable@kernel.org
+Message-ID: <s5habqk5zbc.wl%tiwai@suse.de>
+
+From: Takashi Iwai <tiwai@suse.de>
+
+patch f6e9852ad05fa28301c83d4e2b082620de010358 in mainline.
+
+[ALSA] hda-codec - Add array terminator for dmic in STAC codec
+
+Reported by Jan-Marek Glogowski.
+
+The dmic array is passed to snd_hda_parse_pin_def_config() and
+should be zero-terminated.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/hda/patch_sigmatel.c | 14 ++++++++------
+ 1 file changed, 8 insertions(+), 6 deletions(-)
+
+--- a/sound/pci/hda/patch_sigmatel.c
++++ b/sound/pci/hda/patch_sigmatel.c
+@@ -162,8 +162,9 @@ static hda_nid_t stac925x_dac_nids[1] =
+ 0x02,
+ };
+
+-static hda_nid_t stac925x_dmic_nids[1] = {
+- 0x15,
++#define STAC925X_NUM_DMICS 1
++static hda_nid_t stac925x_dmic_nids[STAC925X_NUM_DMICS + 1] = {
++ 0x15, 0
+ };
+
+ static hda_nid_t stac922x_adc_nids[2] = {
+@@ -190,8 +191,9 @@ static hda_nid_t stac9205_mux_nids[2] =
+ 0x19, 0x1a
+ };
+
+-static hda_nid_t stac9205_dmic_nids[2] = {
+- 0x17, 0x18,
++#define STAC9205_NUM_DMICS 2
++static hda_nid_t stac9205_dmic_nids[STAC9205_NUM_DMICS + 1] = {
++ 0x17, 0x18, 0
+ };
+
+ static hda_nid_t stac9200_pin_nids[8] = {
+@@ -2063,7 +2065,7 @@ static int patch_stac925x(struct hda_cod
+ case 0x83847633: /* STAC9202D */
+ case 0x83847636: /* STAC9251 */
+ case 0x83847637: /* STAC9251D */
+- spec->num_dmics = 1;
++ spec->num_dmics = STAC925X_NUM_DMICS;
+ spec->dmic_nids = stac925x_dmic_nids;
+ break;
+ default:
+@@ -2307,7 +2309,7 @@ static int patch_stac9205(struct hda_cod
+ spec->mux_nids = stac9205_mux_nids;
+ spec->num_muxes = ARRAY_SIZE(stac9205_mux_nids);
+ spec->dmic_nids = stac9205_dmic_nids;
+- spec->num_dmics = ARRAY_SIZE(stac9205_dmic_nids);
++ spec->num_dmics = STAC9205_NUM_DMICS;
+ spec->dmux_nid = 0x1d;
+
+ spec->init = stac9205_core_init;
--- /dev/null
+From stable-bounces@linux.kernel.org Tue Oct 16 06:46:03 2007
+From: Jan-Bernd Themann <ossthema@de.ibm.com>
+Date: Tue, 16 Oct 2007 15:45:23 +0200
+Subject: ehea: 64K page kernel support fix
+To: stable@kernel.org
+Message-ID: <200710161545.23446.ossthema@de.ibm.com>
+Content-Disposition: inline
+
+From: Jan-Bernd Themann <ossthema@de.ibm.com>
+
+based on 2c69448bbcedebeb8409ddb05fbc7d3fe1cfbda7 in mainline.
+
+The current eHEA module compiled for 64K page kernels can not
+be loaded with insmod due to bad hypervisor call parameters.
+The patch is a subset of the follwing patch which has been applied
+for 2.6.24 upstream:
+
+http://www.spinics.net/lists/netdev/msg42814.html
+
+Signed-off-by: Jan-Bernd Themann <themann@de.ibm.com>
+Cc: Jeff Garzik <jeff@garzik.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/ehea/ehea_qmr.c | 20 ++++++++------------
+ drivers/net/ehea/ehea_qmr.h | 2 +-
+ 2 files changed, 9 insertions(+), 13 deletions(-)
+
+--- a/drivers/net/ehea/ehea_qmr.c
++++ b/drivers/net/ehea/ehea_qmr.c
+@@ -563,8 +563,7 @@ int ehea_destroy_qp(struct ehea_qp *qp)
+ int ehea_create_busmap( void )
+ {
+ u64 vaddr = EHEA_BUSMAP_START;
+- unsigned long abs_max_pfn = 0;
+- unsigned long sec_max_pfn;
++ unsigned long high_section_index = 0;
+ int i;
+
+ /*
+@@ -574,14 +573,10 @@ int ehea_create_busmap( void )
+ ehea_bmap.valid_sections = 0;
+
+ for (i = 0; i < NR_MEM_SECTIONS; i++)
+- if (valid_section_nr(i)) {
+- sec_max_pfn = section_nr_to_pfn(i);
+- if (sec_max_pfn > abs_max_pfn)
+- abs_max_pfn = sec_max_pfn;
+- ehea_bmap.valid_sections++;
+- }
++ if (valid_section_nr(i))
++ high_section_index = i;
+
+- ehea_bmap.entries = abs_max_pfn / EHEA_PAGES_PER_SECTION + 1;
++ ehea_bmap.entries = high_section_index + 1;
+ ehea_bmap.vaddr = vmalloc(ehea_bmap.entries * sizeof(*ehea_bmap.vaddr));
+
+ if (!ehea_bmap.vaddr)
+@@ -593,6 +588,7 @@ int ehea_create_busmap( void )
+ if (pfn_valid(pfn)) {
+ ehea_bmap.vaddr[i] = vaddr;
+ vaddr += EHEA_SECTSIZE;
++ ehea_bmap.valid_sections++;
+ } else
+ ehea_bmap.vaddr[i] = 0;
+ }
+@@ -637,7 +633,7 @@ int ehea_reg_kernel_mr(struct ehea_adapt
+
+ mr_len = ehea_bmap.valid_sections * EHEA_SECTSIZE;
+
+- pt = kzalloc(EHEA_MAX_RPAGE * sizeof(u64), GFP_KERNEL);
++ pt = kzalloc(PAGE_SIZE, GFP_KERNEL);
+ if (!pt) {
+ ehea_error("no mem");
+ ret = -ENOMEM;
+@@ -660,8 +656,8 @@ int ehea_reg_kernel_mr(struct ehea_adapt
+ void *sectbase = __va(i << SECTION_SIZE_BITS);
+ unsigned long k = 0;
+
+- for (j = 0; j < (PAGES_PER_SECTION / EHEA_MAX_RPAGE);
+- j++) {
++ for (j = 0; j < (EHEA_PAGES_PER_SECTION /
++ EHEA_MAX_RPAGE); j++) {
+
+ for (m = 0; m < EHEA_MAX_RPAGE; m++) {
+ pg = sectbase + ((k++) * EHEA_PAGESIZE);
+--- a/drivers/net/ehea/ehea_qmr.h
++++ b/drivers/net/ehea/ehea_qmr.h
+@@ -39,7 +39,7 @@
+ #define EHEA_PAGESHIFT 12
+ #define EHEA_PAGESIZE (1UL << EHEA_PAGESHIFT)
+ #define EHEA_SECTSIZE (1UL << 24)
+-#define EHEA_PAGES_PER_SECTION (EHEA_SECTSIZE >> PAGE_SHIFT)
++#define EHEA_PAGES_PER_SECTION (EHEA_SECTSIZE >> EHEA_PAGESHIFT)
+
+ #if (1UL << SECTION_SIZE_BITS) < EHEA_SECTSIZE
+ #error eHEA module can't work if kernel sectionsize < ehea sectionsize
--- /dev/null
+From stable-bounces@linux.kernel.org Tue Oct 16 23:29:17 2007
+From: Ingo Molnar <mingo@elte.hu>
+Date: Tue, 16 Oct 2007 23:18:38 -0700
+Subject: fix the softlockup watchdog to actually work
+To: torvalds@linux-foundation.org
+Cc: akpm@linux-foundation.org, mingo@elte.hu, jeremy@goop.org, stable@kernel.org
+Message-ID: <200710170618.l9H6IcbE005545@imap1.linux-foundation.org>
+
+
+From: Ingo Molnar <mingo@elte.hu>
+
+patch a115d5caca1a2905ba7a32b408a6042b20179aaa in mainline.
+
+this Xen related commit:
+
+ commit 966812dc98e6a7fcdf759cbfa0efab77500a8868
+ Author: Jeremy Fitzhardinge <jeremy@goop.org>
+ Date: Tue May 8 00:28:02 2007 -0700
+
+ Ignore stolen time in the softlockup watchdog
+
+broke the softlockup watchdog to never report any lockups. (!)
+
+print_timestamp defaults to 0, this makes the following condition
+always true:
+
+ if (print_timestamp < (touch_timestamp + 1) ||
+
+and we'll in essence never report soft lockups.
+
+apparently the functionality of the soft lockup watchdog was never
+actually tested with that patch applied ...
+
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Cc: Jeremy Fitzhardinge <jeremy@goop.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/softlockup.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/kernel/softlockup.c
++++ b/kernel/softlockup.c
+@@ -80,10 +80,11 @@ void softlockup_tick(void)
+ print_timestamp = per_cpu(print_timestamp, this_cpu);
+
+ /* report at most once a second */
+- if (print_timestamp < (touch_timestamp + 1) ||
+- did_panic ||
+- !per_cpu(watchdog_task, this_cpu))
++ if ((print_timestamp >= touch_timestamp &&
++ print_timestamp < (touch_timestamp + 1)) ||
++ did_panic || !per_cpu(watchdog_task, this_cpu)) {
+ return;
++ }
+
+ /* do not print during early bootup: */
+ if (unlikely(system_state != SYSTEM_RUNNING)) {
--- /dev/null
+From a7475906bc496456ded9e4b062f94067fb93057a Mon Sep 17 00:00:00 2001
+From: Manfred Spraul <manfred@colorfullife.com>
+Date: Wed, 17 Oct 2007 21:52:33 +0200
+Subject: forcedeth msi bugfix
+Message-ID: <4716A761.5040307@garzik.org>
+
+From: Manfred Spraul <manfred@colorfullife.com>
+
+patch a7475906bc496456ded9e4b062f94067fb93057a in mainline.
+
+pci_enable_msi() replaces the INTx irq number in pci_dev->irq with the
+new MSI irq number.
+The forcedeth driver did not update the copy in netdevice->irq and
+parts of the driver used the stale copy.
+See bugzilla.kernel.org, bug 9047.
+
+The patch
+- updates netdevice->irq
+- replaces all accesses to netdevice->irq with pci_dev->irq.
+
+The patch is against 2.6.23.1. IMHO suitable for both 2.6.23 and 2.6.24
+
+Signed-off-by: Manfred Spraul <manfred@colorfullife.com>
+Signed-off-by: Jeff Garzik <jeff@garzik.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/forcedeth.c | 19 +++++++++++--------
+ 1 file changed, 11 insertions(+), 8 deletions(-)
+
+--- a/drivers/net/forcedeth.c
++++ b/drivers/net/forcedeth.c
+@@ -988,7 +988,7 @@ static void nv_enable_irq(struct net_dev
+ if (np->msi_flags & NV_MSI_X_ENABLED)
+ enable_irq(np->msi_x_entry[NV_MSI_X_VECTOR_ALL].vector);
+ else
+- enable_irq(dev->irq);
++ enable_irq(np->pci_dev->irq);
+ } else {
+ enable_irq(np->msi_x_entry[NV_MSI_X_VECTOR_RX].vector);
+ enable_irq(np->msi_x_entry[NV_MSI_X_VECTOR_TX].vector);
+@@ -1004,7 +1004,7 @@ static void nv_disable_irq(struct net_de
+ if (np->msi_flags & NV_MSI_X_ENABLED)
+ disable_irq(np->msi_x_entry[NV_MSI_X_VECTOR_ALL].vector);
+ else
+- disable_irq(dev->irq);
++ disable_irq(np->pci_dev->irq);
+ } else {
+ disable_irq(np->msi_x_entry[NV_MSI_X_VECTOR_RX].vector);
+ disable_irq(np->msi_x_entry[NV_MSI_X_VECTOR_TX].vector);
+@@ -1601,7 +1601,7 @@ static void nv_do_rx_refill(unsigned lon
+ if (np->msi_flags & NV_MSI_X_ENABLED)
+ disable_irq(np->msi_x_entry[NV_MSI_X_VECTOR_ALL].vector);
+ else
+- disable_irq(dev->irq);
++ disable_irq(np->pci_dev->irq);
+ } else {
+ disable_irq(np->msi_x_entry[NV_MSI_X_VECTOR_RX].vector);
+ }
+@@ -1619,7 +1619,7 @@ static void nv_do_rx_refill(unsigned lon
+ if (np->msi_flags & NV_MSI_X_ENABLED)
+ enable_irq(np->msi_x_entry[NV_MSI_X_VECTOR_ALL].vector);
+ else
+- enable_irq(dev->irq);
++ enable_irq(np->pci_dev->irq);
+ } else {
+ enable_irq(np->msi_x_entry[NV_MSI_X_VECTOR_RX].vector);
+ }
+@@ -3557,10 +3557,12 @@ static int nv_request_irq(struct net_dev
+ if (ret != 0 && np->msi_flags & NV_MSI_CAPABLE) {
+ if ((ret = pci_enable_msi(np->pci_dev)) == 0) {
+ np->msi_flags |= NV_MSI_ENABLED;
++ dev->irq = np->pci_dev->irq;
+ if (request_irq(np->pci_dev->irq, handler, IRQF_SHARED, dev->name, dev) != 0) {
+ printk(KERN_INFO "forcedeth: request_irq failed %d\n", ret);
+ pci_disable_msi(np->pci_dev);
+ np->msi_flags &= ~NV_MSI_ENABLED;
++ dev->irq = np->pci_dev->irq;
+ goto out_err;
+ }
+
+@@ -3623,7 +3625,7 @@ static void nv_do_nic_poll(unsigned long
+ if (np->msi_flags & NV_MSI_X_ENABLED)
+ disable_irq_lockdep(np->msi_x_entry[NV_MSI_X_VECTOR_ALL].vector);
+ else
+- disable_irq_lockdep(dev->irq);
++ disable_irq_lockdep(np->pci_dev->irq);
+ mask = np->irqmask;
+ } else {
+ if (np->nic_poll_irq & NVREG_IRQ_RX_ALL) {
+@@ -3641,6 +3643,8 @@ static void nv_do_nic_poll(unsigned long
+ }
+ np->nic_poll_irq = 0;
+
++ /* disable_irq() contains synchronize_irq, thus no irq handler can run now */
++
+ if (np->recover_error) {
+ np->recover_error = 0;
+ printk(KERN_INFO "forcedeth: MAC in recoverable error state\n");
+@@ -3677,7 +3681,6 @@ static void nv_do_nic_poll(unsigned long
+ }
+ }
+
+- /* FIXME: Do we need synchronize_irq(dev->irq) here? */
+
+ writel(mask, base + NvRegIrqMask);
+ pci_push(base);
+@@ -3690,7 +3693,7 @@ static void nv_do_nic_poll(unsigned long
+ if (np->msi_flags & NV_MSI_X_ENABLED)
+ enable_irq_lockdep(np->msi_x_entry[NV_MSI_X_VECTOR_ALL].vector);
+ else
+- enable_irq_lockdep(dev->irq);
++ enable_irq_lockdep(np->pci_dev->irq);
+ } else {
+ if (np->nic_poll_irq & NVREG_IRQ_RX_ALL) {
+ nv_nic_irq_rx(0, dev);
+@@ -4943,7 +4946,7 @@ static int nv_close(struct net_device *d
+ np->in_shutdown = 1;
+ spin_unlock_irq(&np->lock);
+ netif_poll_disable(dev);
+- synchronize_irq(dev->irq);
++ synchronize_irq(np->pci_dev->irq);
+
+ del_timer_sync(&np->oom_kick);
+ del_timer_sync(&np->nic_poll);
--- /dev/null
+From stable-bounces@linux.kernel.org Tue Oct 16 15:28:18 2007
+From: HighPoint Linux Team <linux@highpoint-tech.com>
+Date: Tue, 16 Oct 2007 14:28:24 -0700
+Subject: hptiop: avoid buffer overflow when returning sense data
+To: James.Bottomley@steeleye.com
+Cc: akpm@linux-foundation.org, linux@highpoint-tech.com, stable@kernel.org, linux-scsi@vger.kernel.org
+Message-ID: <200710162128.l9GLSORo018187@imap1.linux-foundation.org>
+
+
+From: HighPoint Linux Team <linux@highpoint-tech.com>
+
+patch 0fec02c93f60fb44ba3a24a0d3e4a52521d34d3f in mainline.
+
+avoid buffer overflow when returning sense data.
+
+With current adapter firmware the driver is working but future firmware
+updates may return sense data larger than 96 bytes, causing overflow on
+scp->sense_buffer and a kernel crash.
+
+This fix should be backported to earlier kernels.
+
+Signed-off-by: HighPoint Linux Team <linux@highpoint-tech.com>
+Signed-off-by: James Bottomley <James.Bottomley@steeleye.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/scsi/hptiop.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/scsi/hptiop.c
++++ b/drivers/scsi/hptiop.c
+@@ -365,8 +365,9 @@ static void hptiop_host_request_callback
+ scp->result = SAM_STAT_CHECK_CONDITION;
+ memset(&scp->sense_buffer,
+ 0, sizeof(scp->sense_buffer));
+- memcpy(&scp->sense_buffer,
+- &req->sg_list, le32_to_cpu(req->dataxfer_length));
++ memcpy(&scp->sense_buffer, &req->sg_list,
++ min(sizeof(scp->sense_buffer),
++ le32_to_cpu(req->dataxfer_length)));
+ break;
+
+ default:
--- /dev/null
+From stable-bounces@linux.kernel.org Thu Oct 18 03:05:05 2007
+From: Karsten Keil <kkeil@suse.de>
+Date: Thu, 18 Oct 2007 03:04:31 -0700
+Subject: i4l: fix random freezes with AVM B1 drivers
+To: torvalds@linux-foundation.org
+Cc: akpm@linux-foundation.org, stable@kernel.org, kkeil@suse.de
+Message-ID: <200710181004.l9IA4VVS005629@imap1.linux-foundation.org>
+
+
+From: Karsten Keil <kkeil@suse.de>
+
+patch 9713d9e650045f7f2afd81d58a068827be306993 in mainline.
+
+This fix the same issue which was debbuged for the C4 controller for the B1
+versions.
+
+The capilib_ function modify or traverse a linked list without locking.
+
+This patch extends the existing locking to the calls of these function to
+prevent access to a list which is in the middle of a modification.
+
+Signed-off-by: Karsten Keil <kkeil@suse.de>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/isdn/hardware/avm/b1.c | 28 +++++++++++++---------------
+ 1 file changed, 13 insertions(+), 15 deletions(-)
+
+--- a/drivers/isdn/hardware/avm/b1.c
++++ b/drivers/isdn/hardware/avm/b1.c
+@@ -321,12 +321,15 @@ void b1_reset_ctr(struct capi_ctr *ctrl)
+ avmctrl_info *cinfo = (avmctrl_info *)(ctrl->driverdata);
+ avmcard *card = cinfo->card;
+ unsigned int port = card->port;
++ unsigned long flags;
+
+ b1_reset(port);
+ b1_reset(port);
+
+ memset(cinfo->version, 0, sizeof(cinfo->version));
++ spin_lock_irqsave(&card->lock, flags);
+ capilib_release(&cinfo->ncci_head);
++ spin_unlock_irqrestore(&card->lock, flags);
+ capi_ctr_reseted(ctrl);
+ }
+
+@@ -361,9 +364,8 @@ void b1_release_appl(struct capi_ctr *ct
+ unsigned int port = card->port;
+ unsigned long flags;
+
+- capilib_release_appl(&cinfo->ncci_head, appl);
+-
+ spin_lock_irqsave(&card->lock, flags);
++ capilib_release_appl(&cinfo->ncci_head, appl);
+ b1_put_byte(port, SEND_RELEASE);
+ b1_put_word(port, appl);
+ spin_unlock_irqrestore(&card->lock, flags);
+@@ -380,27 +382,27 @@ u16 b1_send_message(struct capi_ctr *ctr
+ u8 subcmd = CAPIMSG_SUBCOMMAND(skb->data);
+ u16 dlen, retval;
+
++ spin_lock_irqsave(&card->lock, flags);
+ if (CAPICMD(cmd, subcmd) == CAPI_DATA_B3_REQ) {
+ retval = capilib_data_b3_req(&cinfo->ncci_head,
+ CAPIMSG_APPID(skb->data),
+ CAPIMSG_NCCI(skb->data),
+ CAPIMSG_MSGID(skb->data));
+- if (retval != CAPI_NOERROR)
++ if (retval != CAPI_NOERROR) {
++ spin_unlock_irqrestore(&card->lock, flags);
+ return retval;
++ }
+
+ dlen = CAPIMSG_DATALEN(skb->data);
+
+- spin_lock_irqsave(&card->lock, flags);
+ b1_put_byte(port, SEND_DATA_B3_REQ);
+ b1_put_slice(port, skb->data, len);
+ b1_put_slice(port, skb->data + len, dlen);
+- spin_unlock_irqrestore(&card->lock, flags);
+ } else {
+- spin_lock_irqsave(&card->lock, flags);
+ b1_put_byte(port, SEND_MESSAGE);
+ b1_put_slice(port, skb->data, len);
+- spin_unlock_irqrestore(&card->lock, flags);
+ }
++ spin_unlock_irqrestore(&card->lock, flags);
+
+ dev_kfree_skb_any(skb);
+ return CAPI_NOERROR;
+@@ -534,17 +536,17 @@ irqreturn_t b1_interrupt(int interrupt,
+
+ ApplId = (unsigned) b1_get_word(card->port);
+ MsgLen = b1_get_slice(card->port, card->msgbuf);
+- spin_unlock_irqrestore(&card->lock, flags);
+ if (!(skb = alloc_skb(MsgLen, GFP_ATOMIC))) {
+ printk(KERN_ERR "%s: incoming packet dropped\n",
+ card->name);
++ spin_unlock_irqrestore(&card->lock, flags);
+ } else {
+ memcpy(skb_put(skb, MsgLen), card->msgbuf, MsgLen);
+ if (CAPIMSG_CMD(skb->data) == CAPI_DATA_B3_CONF)
+ capilib_data_b3_conf(&cinfo->ncci_head, ApplId,
+ CAPIMSG_NCCI(skb->data),
+ CAPIMSG_MSGID(skb->data));
+-
++ spin_unlock_irqrestore(&card->lock, flags);
+ capi_ctr_handle_message(ctrl, ApplId, skb);
+ }
+ break;
+@@ -554,21 +556,17 @@ irqreturn_t b1_interrupt(int interrupt,
+ ApplId = b1_get_word(card->port);
+ NCCI = b1_get_word(card->port);
+ WindowSize = b1_get_word(card->port);
+- spin_unlock_irqrestore(&card->lock, flags);
+-
+ capilib_new_ncci(&cinfo->ncci_head, ApplId, NCCI, WindowSize);
+-
++ spin_unlock_irqrestore(&card->lock, flags);
+ break;
+
+ case RECEIVE_FREE_NCCI:
+
+ ApplId = b1_get_word(card->port);
+ NCCI = b1_get_word(card->port);
+- spin_unlock_irqrestore(&card->lock, flags);
+-
+ if (NCCI != 0xffffffff)
+ capilib_free_ncci(&cinfo->ncci_head, ApplId, NCCI);
+-
++ spin_unlock_irqrestore(&card->lock, flags);
+ break;
+
+ case RECEIVE_START:
--- /dev/null
+From stable-bounces@linux.kernel.org Thu Oct 18 03:05:10 2007
+From: Karsten Keil <kkeil@suse.de>
+Date: Thu, 18 Oct 2007 03:04:32 -0700
+Subject: i4l: Fix random hard freeze with AVM c4 card
+To: torvalds@linux-foundation.org
+Cc: stable@kernel.org, akpm@linux-foundation.org, rainer.brestan@frequentis.com, kkeil@suse.de, rsc@runtux.com
+Message-ID: <200710181004.l9IA4WtD005633@imap1.linux-foundation.org>
+
+
+From: Karsten Keil <kkeil@suse.de>
+
+patch 1ccfd63367c1a6aaf8b33943f18856dde85f2f0b in mainline.
+
+The patch
+- Includes the call to capilib_data_b3_req in the spinlock. This routine
+ in turn calls the offending mq_enqueue routine that triggered the
+ freeze if not locked. This should also fix other indicators of
+ incosistent capilib_msgidqueue list, that trigger messages like:
+ Oct 5 03:05:57 BERL0 kernel: kcapi: msgid 3019 ncci 0x30301 not on queue
+ that we saw several times a day (usually several in a row).
+- Fixes all occurrences of c4_dispatch_tx to be called with active
+ spinlock, there were some instances where no lock was active. Mostly
+ these are in very infrequently called routines, so the additional
+ performance penalty is minimal.
+
+Signed-off-by: Karsten Keil <kkeil@suse.de>
+Signed-off-by: Rainer Brestan <rainer.brestan@frequentis.com>
+Signed-off-by: Ralf Schlatterbeck <rsc@runtux.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/isdn/hardware/avm/c4.c | 14 +++++++++++---
+ 1 file changed, 11 insertions(+), 3 deletions(-)
+
+--- a/drivers/isdn/hardware/avm/c4.c
++++ b/drivers/isdn/hardware/avm/c4.c
+@@ -727,6 +727,7 @@ static void c4_send_init(avmcard *card)
+ {
+ struct sk_buff *skb;
+ void *p;
++ unsigned long flags;
+
+ skb = alloc_skb(15, GFP_ATOMIC);
+ if (!skb) {
+@@ -744,12 +745,15 @@ static void c4_send_init(avmcard *card)
+ skb_put(skb, (u8 *)p - (u8 *)skb->data);
+
+ skb_queue_tail(&card->dma->send_queue, skb);
++ spin_lock_irqsave(&card->lock, flags);
+ c4_dispatch_tx(card);
++ spin_unlock_irqrestore(&card->lock, flags);
+ }
+
+ static int queue_sendconfigword(avmcard *card, u32 val)
+ {
+ struct sk_buff *skb;
++ unsigned long flags;
+ void *p;
+
+ skb = alloc_skb(3+4, GFP_ATOMIC);
+@@ -766,7 +770,9 @@ static int queue_sendconfigword(avmcard
+ skb_put(skb, (u8 *)p - (u8 *)skb->data);
+
+ skb_queue_tail(&card->dma->send_queue, skb);
++ spin_lock_irqsave(&card->lock, flags);
+ c4_dispatch_tx(card);
++ spin_unlock_irqrestore(&card->lock, flags);
+ return 0;
+ }
+
+@@ -986,7 +992,9 @@ static void c4_release_appl(struct capi_
+ struct sk_buff *skb;
+ void *p;
+
++ spin_lock_irqsave(&card->lock, flags);
+ capilib_release_appl(&cinfo->ncci_head, appl);
++ spin_unlock_irqrestore(&card->lock, flags);
+
+ if (ctrl->cnr == card->cardnr) {
+ skb = alloc_skb(7, GFP_ATOMIC);
+@@ -1019,7 +1027,8 @@ static u16 c4_send_message(struct capi_c
+ u16 retval = CAPI_NOERROR;
+ unsigned long flags;
+
+- if (CAPIMSG_CMD(skb->data) == CAPI_DATA_B3_REQ) {
++ spin_lock_irqsave(&card->lock, flags);
++ if (CAPIMSG_CMD(skb->data) == CAPI_DATA_B3_REQ) {
+ retval = capilib_data_b3_req(&cinfo->ncci_head,
+ CAPIMSG_APPID(skb->data),
+ CAPIMSG_NCCI(skb->data),
+@@ -1027,10 +1036,9 @@ static u16 c4_send_message(struct capi_c
+ }
+ if (retval == CAPI_NOERROR) {
+ skb_queue_tail(&card->dma->send_queue, skb);
+- spin_lock_irqsave(&card->lock, flags);
+ c4_dispatch_tx(card);
+- spin_unlock_irqrestore(&card->lock, flags);
+ }
++ spin_unlock_irqrestore(&card->lock, flags);
+ return retval;
+ }
+
--- /dev/null
+From 0c824b51b338c808de650b440ba5f9f4a725f7fc Mon Sep 17 00:00:00 2001
+From: Tony Battersby <tonyb@cybernetics.com>
+Date: Tue, 16 Oct 2007 22:29:52 +0200
+Subject: [PATCH] ide: fix serverworks.c UDMA regression
+Message-Id: <200710162125.41987.bzolnier@gmail.com>
+
+From: Tony Battersby <tonyb@cybernetics.com>
+
+patch 0c824b51b338c808de650b440ba5f9f4a725f7fc in mainline.
+
+The patch described by the following excerpt from ChangeLog-2.6.22 makes
+it impossible to use UDMA on a Tyan S2707 motherboard (SvrWks CSB5):
+
+commit 2d5eaa6dd744a641e75503232a01f52d0768884c
+Author: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
+Date: Thu May 10 00:01:08 2007 +0200
+
+ ide: rework the code for selecting the best DMA transfer mode (v3)
+
+ ...
+
+This one-line patch against 2.6.23 fixes the problem.
+
+Signed-off-by: Tony Battersby <tonyb@cybernetics.com>
+Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/ide/pci/serverworks.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/ide/pci/serverworks.c
++++ b/drivers/ide/pci/serverworks.c
+@@ -97,6 +97,7 @@ static u8 svwks_udma_filter(ide_drive_t
+ mode = 2;
+
+ switch(mode) {
++ case 3: mask = 0x3f; break;
+ case 2: mask = 0x1f; break;
+ case 1: mask = 0x07; break;
+ default: mask = 0x00; break;
slub-fix-memory-leak-by-not-reusing-cpu_slab.patch
x86-setup-handle-boot-loaders-which-set-up-the-stack-incorrectly.patch
x86-setup-sizeof-is-unsigned-unbreak-comparisons.patch
+alsa-hda-codec-add-array-terminator-for-dmic-in-stac-codec.patch
+ehea-64k-page-kernel-support-fix.patch
+ide-fix-serverworks.c-udma-regression.patch
+hptiop-avoid-buffer-overflow-when-returning-sense-data.patch
+writeback-don-t-propagate-aop_writepage_activate.patch
+fix-the-softlockup-watchdog-to-actually-work.patch
+splice-fix-double-kunmap-in-vmsplice-copy-path.patch
+forcedeth-msi-bugfix.patch
+i4l-fix-random-hard-freeze-with-avm-c4-card.patch
+i4l-fix-random-freezes-with-avm-b1-drivers.patch
+x86-fix-tsc-clock-source-calibration-error.patch
--- /dev/null
+From 6866bef40d06f7c2baac3a855b1917a8ca75456c Mon Sep 17 00:00:00 2001
+From: Jens Axboe <jens.axboe@oracle.com>
+Date: Tue, 16 Oct 2007 10:01:29 +0200
+Subject: [PATCH] splice: fix double kunmap() in vmsplice copy path
+Message-ID: <20071017065521.GA5041@kernel.dk>
+
+From: Jens Axboe <jens.axboe@oracle.com>
+
+patch 6866bef40d06f7c2baac3a855b1917a8ca75456c in mainline.
+
+The out label should not include the unmap, the only way to jump
+there already has unmapped the source.
+
+00002000
+ f7c21a00 00000000 00000000 c0489036 00018e32 00000002 00000000
+00001000
+Call Trace:
+ [<c0487dd9>] pipe_to_user+0xca/0xd3
+ [<c0488233>] __splice_from_pipe+0x53/0x1bd
+ [<c0454947>] ------------[ cut here ]------------
+filemap_fault+0x221/0x380
+ [<c0487d0f>] pipe_to_user+0x0/0xd3
+ [<c0489036>] sys_vmsplice+0x3b7/0x422
+ [<c045ec3f>] kernel BUG at mm/highmem.c:206!
+handle_mm_fault+0x4d5/0x8eb
+ [<c041ed5b>] kmap_atomic+0x1c/0x20
+ [<c045d33d>] unmap_vmas+0x3d1/0x584
+ [<c045f717>] free_pgtables+0x90/0xa0
+ [<c041d84b>] pgd_dtor+0x0/0x1
+ [<c044d665>] audit_syscall_exit+0x2aa/0x2c6
+ [<c0407817>] do_syscall_trace+0x124/0x169
+ [<c0404df2>] syscall_call+0x7/0xb
+ =======================
+Code: 2d 00 d0 5b 00 25 00 00 e0 ff 29 invalid opcode: 0000 [#1]
+c2 89 d0 c1 e8 0c 8b 14 85 a0 6c 7c c0 4a 85 d2 89 14 85 a0 6c 7c c0 74 07
+31 c9 4a 75 15 eb 04 <0f> 0b eb fe 31 c9 81 3d 78 38 6d c0 78 38 6d c0 0f
+95 c1 b0 01
+EIP: [<c045bbc3>] kunmap_high+0x51/0x8e SS:ESP 0068:f5960df0
+SMP
+Modules linked in: netconsole autofs4 hidp nfs lockd nfs_acl rfcomm l2cap
+bluetooth sunrpc ipv6 ib_iser rdma_cm ib_cm iw_cmib_sa ib_mad ib_core
+ib_addr iscsi_tcp libiscsi scsi_transport_iscsi dm_mirror dm_multipath
+dm_mod video output sbs batteryac parport_pc lp parport sg i2c_piix4
+i2c_core floppy cfi_probe gen_probe scb2_flash mtd chipreg tg3 e1000 button
+ide_cd serio_raw cdrom aic7xxx scsi_transport_spi sd_mod scsi_mod ext3 jbd
+ehci_hcd ohci_hcd uhci_hcd
+CPU: 3
+EIP: 0060:[<c045bbc3>] Not tainted VLI
+EFLAGS: 00010246 (2.6.23 #1)
+EIP is at kunmap_high+0x51/0x8e
+
+Signed-off-by: Jens Axboe <jens.axboe@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/splice.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/splice.c
++++ b/fs/splice.c
+@@ -1390,10 +1390,10 @@ static int pipe_to_user(struct pipe_inod
+ if (copy_to_user(sd->u.userptr, src + buf->offset, sd->len))
+ ret = -EFAULT;
+
++ buf->ops->unmap(pipe, buf, src);
+ out:
+ if (ret > 0)
+ sd->u.userptr += ret;
+- buf->ops->unmap(pipe, buf, src);
+ return ret;
+ }
+
--- /dev/null
+From stable-bounces@linux.kernel.org Tue Oct 16 23:25:28 2007
+From: akpm@linux-foundation.org
+Date: Tue, 16 Oct 2007 23:18:32 -0700
+Subject: writeback: don't propagate AOP_WRITEPAGE_ACTIVATE
+To: torvalds@linux-foundation.org
+Cc: akpm@linux-foundation.org, stable@kernel.org
+Message-ID: <200710170618.l9H6IWq3005517@imap1.linux-foundation.org>
+
+
+From: Andrew Morton <akpm@linux-foundation.org>
+
+patch e423003028183df54f039dfda8b58c49e78c89d7 in mainline.
+
+This is a writeback-internal marker but we're propagating it all the way back
+to userspace!.
+
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+
+
+---
+ mm/page-writeback.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/mm/page-writeback.c
++++ b/mm/page-writeback.c
+@@ -672,8 +672,10 @@ retry:
+
+ ret = (*writepage)(page, wbc, data);
+
+- if (unlikely(ret == AOP_WRITEPAGE_ACTIVATE))
++ if (unlikely(ret == AOP_WRITEPAGE_ACTIVATE)) {
+ unlock_page(page);
++ ret = 0;
++ }
+ if (ret || (--(wbc->nr_to_write) <= 0))
+ done = 1;
+ if (wbc->nonblocking && bdi_write_congested(bdi)) {
--- /dev/null
+From edaf420fdc122e7a42326fe39274c8b8c9b19d41 Mon Sep 17 00:00:00 2001
+From: Dave Johnson <djohnson@sw.starentnetworks.com>
+Date: Tue, 23 Oct 2007 22:37:22 +0200
+Subject: [PATCH] x86: fix TSC clock source calibration error
+Message-ID: <20071018085713.GA11022@elte.hu>
+
+From: Dave Johnson <djohnson@sw.starentnetworks.com>
+
+patch edaf420fdc122e7a42326fe39274c8b8c9b19d41 in mainline.
+
+I ran into this problem on a system that was unable to obtain NTP sync
+because the clock was running very slow (over 10000ppm slow). ntpd had
+declared all of its peers 'reject' with 'peer_dist' reason.
+
+On investigation, the tsc_khz variable was significantly incorrect
+causing xtime to run slow. After a reboot tsc_khz was correct so I
+did a reboot test to see how often the problem occurred:
+
+Test was done on a 2000 Mhz Xeon system. Of 689 reboots, 8 of them
+had unacceptable tsc_khz values (>500ppm):
+
+ range of tsc_khz # of boots % of boots
+ ---------------- ---------- ----------
+ < 1999750 0 0.000%
+1999750 - 1999800 21 3.048%
+1999800 - 1999850 166 24.128%
+1999850 - 1999900 241 35.029%
+1999900 - 1999950 211 30.669%
+1999950 - 2000000 42 6.105%
+2000000 - 2000000 0 0.000%
+2000050 - 2000100 0 0.000%
+ [...]
+2000100 - 2015000 1 0.145% << BAD
+2015000 - 2030000 6 0.872% << BAD
+2030000 - 2045000 1 0.145% << BAD
+2045000 < 0 0.000%
+
+The worst boot was 2032.577 Mhz, over 1.5% off!
+
+It appears that on rare occasions, mach_countup() is taking longer to
+complete than necessary.
+
+I suspect that this is caused by the CPU taking a periodic SMI
+interrupt right at the end of the 30ms calibration loop. This would
+cause the loop to delay while the SMI BIOS hander runs. The resulting
+TSC value is beyond what it actually should be resulting in a higher
+tsc_khz.
+
+The below patch makes native_calculate_cpu_khz() take the best
+(shortest duration, lowest khz) run of it's 3 calibration loops. If a
+SMI goes off causing a bad result (long duration, higher khz) it will
+be discarded.
+
+With the patch applied, 300 boots of the same system produce good
+results:
+
+ range of tsc_khz # of boots % of boots
+ ---------------- ---------- ----------
+ < 1999750 0 0.000%
+1999750 - 1999800 30 10.000%
+1999800 - 1999850 166 55.333%
+1999850 - 1999900 89 29.667%
+1999900 - 1999950 15 5.000%
+1999950 < 0 0.000%
+
+Problem was found and tested against 2.6.18. Patch is against 2.6.22.
+
+Signed-off-by: Dave Johnson <djohnson@sw.starentnetworks.com>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/i386/kernel/tsc.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+--- a/arch/i386/kernel/tsc.c
++++ b/arch/i386/kernel/tsc.c
+@@ -137,7 +137,7 @@ unsigned long native_calculate_cpu_khz(v
+ {
+ unsigned long long start, end;
+ unsigned long count;
+- u64 delta64;
++ u64 delta64 = (u64)ULLONG_MAX;
+ int i;
+ unsigned long flags;
+
+@@ -149,6 +149,7 @@ unsigned long native_calculate_cpu_khz(v
+ rdtscll(start);
+ mach_countup(&count);
+ rdtscll(end);
++ delta64 = min(delta64, (end - start));
+ }
+ /*
+ * Error: ECTCNEVERSET
+@@ -159,8 +160,6 @@ unsigned long native_calculate_cpu_khz(v
+ if (count <= 1)
+ goto err;
+
+- delta64 = end - start;
+-
+ /* cpu freq too fast: */
+ if (delta64 > (1ULL<<32))
+ goto err;
projects / thirdparty / kernel / stable-queue.git / commitdiff
