From: Greg Kroah-Hartman Date: Fri, 1 Mar 2013 19:25:21 +0000 (-0800) Subject: 3.0-stable patches X-Git-Tag: v3.8.2~6 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=a70cc5651a5c905ddf4641318687773f3835c81e;p=thirdparty%2Fkernel%2Fstable-queue.git 3.0-stable patches added patches: dca-check-against-empty-dca_domains-list-before-fix.patch s390-kvm-Fix-store-status-for-ACRS-FPRS-fix.patch staging-comedi-check-s-async-for-poll-read-and-write.patch staging-comedi-ni_labpc-correct-differential-channel-sequence-for-ai-commands.patch staging-comedi-ni_labpc-set-up-command4-register-after-command3.patch --- diff --git a/queue-3.0/dca-check-against-empty-dca_domains-list-before-fix.patch b/queue-3.0/dca-check-against-empty-dca_domains-list-before-fix.patch new file mode 100644 index 00000000000..01c08ea0c06 --- /dev/null +++ b/queue-3.0/dca-check-against-empty-dca_domains-list-before-fix.patch @@ -0,0 +1,31 @@ +From: Jiri Slaby +Subject: dca: check against empty dca_domains list before unregister provider fix + +In 3.0.67, commit 7a9a20ea77e7508c795dead9ab2f6c98a617762d (dca: check +against empty dca_domains list before unregister provider), upstream +commit c419fcfd071cf34ba00f9f65282583772d2655e7, added a fail path to +unregister_dca_provider. It added there also a call to +raw_spin_unlock_irqrestore. But in 3.0, the lock is not raw, so this +results in: +drivers/dca/dca-core.c: In function 'unregister_dca_provider': +drivers/dca/dca-core.c:413: warning: passing argument 1 of '_raw_spin_unlock_irqrestore' from incompatible pointer type + +Fix it by calling spin_unlock_irqrestore properly. + +Signed-off-by: Jiri Slaby +Signed-off-by: Greg Kroah-Hartman +--- + drivers/dca/dca-core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/dca/dca-core.c ++++ b/drivers/dca/dca-core.c +@@ -410,7 +410,7 @@ void unregister_dca_provider(struct dca_ + spin_lock_irqsave(&dca_lock, flags); + + if (list_empty(&dca_domains)) { +- raw_spin_unlock_irqrestore(&dca_lock, flags); ++ spin_unlock_irqrestore(&dca_lock, flags); + return; + } + diff --git a/queue-3.0/s390-kvm-Fix-store-status-for-ACRS-FPRS-fix.patch b/queue-3.0/s390-kvm-Fix-store-status-for-ACRS-FPRS-fix.patch new file mode 100644 index 00000000000..98f514d927b --- /dev/null +++ b/queue-3.0/s390-kvm-Fix-store-status-for-ACRS-FPRS-fix.patch @@ -0,0 +1,30 @@ +From: Jiri Slaby +Subject: s390/kvm: Fix store status for ACRS/FPRS fix + +In 3.0.67, commit 58c9ce6fad8e00d9726447f939fe7e78e2aec891 (s390/kvm: +Fix store status for ACRS/FPRS), upstream commit +15bc8d8457875f495c59d933b05770ba88d1eacb, added a call to +save_access_regs to save ACRS. But we do not have ARCS in kvm_run in +3.0 yet, so this results in: +arch/s390/kvm/kvm-s390.c: In function 'kvm_s390_vcpu_store_status': +arch/s390/kvm/kvm-s390.c:593: error: 'struct kvm_run' has no member named 's' + +Fix it by saving guest_acrs which is where ARCS are in 3.0. + +Signed-off-by: Jiri Slaby +Signed-off-by: Greg Kroah-Hartman +--- + arch/s390/kvm/kvm-s390.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/s390/kvm/kvm-s390.c ++++ b/arch/s390/kvm/kvm-s390.c +@@ -590,7 +590,7 @@ int kvm_s390_vcpu_store_status(struct kv + * it into the save area + */ + save_fp_regs(&vcpu->arch.guest_fpregs); +- save_access_regs(vcpu->run->s.regs.acrs); ++ save_access_regs(vcpu->arch.guest_acrs); + + if (__guestcopy(vcpu, addr + offsetof(struct save_area, fp_regs), + vcpu->arch.guest_fpregs.fprs, 128, prefix)) diff --git a/queue-3.0/series b/queue-3.0/series index 10e86d57c69..478677dd2af 100644 --- a/queue-3.0/series +++ b/queue-3.0/series @@ -23,3 +23,8 @@ x86-do-not-leak-kernel-page-mapping-locations.patch x86-apic-work-around-boot-failure-on-hp-proliant-dl980-g7-server-systems.patch cpuset-fix-cpuset_print_task_mems_allowed-vs-rename-race.patch cgroup-fix-exit-vs-rmdir-race.patch +dca-check-against-empty-dca_domains-list-before-fix.patch +s390-kvm-Fix-store-status-for-ACRS-FPRS-fix.patch +staging-comedi-ni_labpc-correct-differential-channel-sequence-for-ai-commands.patch +staging-comedi-ni_labpc-set-up-command4-register-after-command3.patch +staging-comedi-check-s-async-for-poll-read-and-write.patch diff --git a/queue-3.0/staging-comedi-check-s-async-for-poll-read-and-write.patch b/queue-3.0/staging-comedi-check-s-async-for-poll-read-and-write.patch new file mode 100644 index 00000000000..92cac5be00c --- /dev/null +++ b/queue-3.0/staging-comedi-check-s-async-for-poll-read-and-write.patch @@ -0,0 +1,68 @@ +From abbotti@mev.co.uk Fri Mar 1 11:20:18 2013 +From: Ian Abbott +Date: Wed, 27 Feb 2013 10:56:19 +0000 +Subject: staging: comedi: check s->async for poll(), read() and write() +To: stable@vger.kernel.org +Cc: gregkh@linuxfoundation.org, Ian Abbott +Message-ID: <1361962579-4790-1-git-send-email-abbotti@mev.co.uk> + +From: Ian Abbott + +commit cc400e185c07c15a42d2635995f422de5b94b696 upstream. + +Some low-level comedi drivers (incorrectly) point `dev->read_subdev` or +`dev->write_subdev` to a subdevice that does not support asynchronous +commands. Comedi's poll(), read() and write() file operation handlers +assume these subdevices do support asynchronous commands. In +particular, they assume `s->async` is valid (where `s` points to the +read or write subdevice), which it won't be if it has been set +incorrectly. This can lead to a NULL pointer dereference. + +Check `s->async` is non-NULL in `comedi_poll()`, `comedi_read()` and +`comedi_write()` to avoid the bug. + +Signed-off-by: Ian Abbott +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/comedi/comedi_fops.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/staging/comedi/comedi_fops.c ++++ b/drivers/staging/comedi/comedi_fops.c +@@ -1577,7 +1577,7 @@ static unsigned int comedi_poll(struct f + + mask = 0; + read_subdev = comedi_get_read_subdevice(dev_file_info); +- if (read_subdev) { ++ if (read_subdev && read_subdev->async) { + poll_wait(file, &read_subdev->async->wait_head, wait); + if (!read_subdev->busy + || comedi_buf_read_n_available(read_subdev->async) > 0 +@@ -1587,7 +1587,7 @@ static unsigned int comedi_poll(struct f + } + } + write_subdev = comedi_get_write_subdevice(dev_file_info); +- if (write_subdev) { ++ if (write_subdev && write_subdev->async) { + poll_wait(file, &write_subdev->async->wait_head, wait); + comedi_buf_write_alloc(write_subdev->async, + write_subdev->async->prealloc_bufsz); +@@ -1629,7 +1629,7 @@ static ssize_t comedi_write(struct file + } + + s = comedi_get_write_subdevice(dev_file_info); +- if (s == NULL) { ++ if (s == NULL || s->async == NULL) { + retval = -EIO; + goto done; + } +@@ -1740,7 +1740,7 @@ static ssize_t comedi_read(struct file * + } + + s = comedi_get_read_subdevice(dev_file_info); +- if (s == NULL) { ++ if (s == NULL || s->async == NULL) { + retval = -EIO; + goto done; + } diff --git a/queue-3.0/staging-comedi-ni_labpc-correct-differential-channel-sequence-for-ai-commands.patch b/queue-3.0/staging-comedi-ni_labpc-correct-differential-channel-sequence-for-ai-commands.patch new file mode 100644 index 00000000000..7c0d5af836d --- /dev/null +++ b/queue-3.0/staging-comedi-ni_labpc-correct-differential-channel-sequence-for-ai-commands.patch @@ -0,0 +1,54 @@ +From abbotti@mev.co.uk Fri Mar 1 11:18:44 2013 +From: Ian Abbott +Date: Wed, 27 Feb 2013 12:52:45 +0000 +Subject: staging: comedi: ni_labpc: correct differential channel sequence for AI commands +To: stable@vger.kernel.org +Cc: Ian Abbott +Message-ID: <1361969566-32521-1-git-send-email-abbotti@mev.co.uk> + +From: Ian Abbott + +Commit 4c4bc25d0fa6beaf054c0b4c3b324487f266c820 upstream. + +Tuomas reported problems getting +meaningful output from a Lab-PC+ in differential mode for AI cmds, but +AI insn reads gave correct readings. He tracked it down to two +problems, one of which is addressed by this patch. + +It seems the setting of the channel bits for particular scanning modes +was incorrect for differential mode. (Only half the number of channels +are available in differential mode; comedi refers to them as channels 0, +1, 2 and 3, but the hardware documentation refers to them as channels 0, +2, 4 and 6.) In differential mode, the setting of the channel enable +bits in the command1 register should depend on whether the scan enable +bit is set. Effectively, we need to double the comedi channel number +when the scan enable bit is not set in differential mode. The scan +enable bit gets set when the AI scan mode is `MODE_MULT_CHAN_UP` or +`MODE_MULT_CHAN_DOWN`, and gets cleared when the AI scan mode is +`MODE_SINGLE_CHAN` or `MODE_SINGLE_CHAN_INTERVAL`. The existing test +for whether the comedi channel number needs to be doubled in +differential mode is incorrect in `labpc_ai_cmd()`. This patch corrects +the test. + +Thanks to Tuomas for suggesting the fix. + +Signed-off-by: Ian Abbott +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/comedi/drivers/ni_labpc.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/staging/comedi/drivers/ni_labpc.c ++++ b/drivers/staging/comedi/drivers/ni_labpc.c +@@ -1241,7 +1241,9 @@ static int labpc_ai_cmd(struct comedi_de + else + channel = CR_CHAN(cmd->chanlist[0]); + /* munge channel bits for differential / scan disabled mode */ +- if (labpc_ai_scan_mode(cmd) != MODE_SINGLE_CHAN && aref == AREF_DIFF) ++ if ((labpc_ai_scan_mode(cmd) == MODE_SINGLE_CHAN || ++ labpc_ai_scan_mode(cmd) == MODE_SINGLE_CHAN_INTERVAL) && ++ aref == AREF_DIFF) + channel *= 2; + devpriv->command1_bits |= ADC_CHAN_BITS(channel); + devpriv->command1_bits |= thisboard->ai_range_code[range]; diff --git a/queue-3.0/staging-comedi-ni_labpc-set-up-command4-register-after-command3.patch b/queue-3.0/staging-comedi-ni_labpc-set-up-command4-register-after-command3.patch new file mode 100644 index 00000000000..d54ad895e86 --- /dev/null +++ b/queue-3.0/staging-comedi-ni_labpc-set-up-command4-register-after-command3.patch @@ -0,0 +1,79 @@ +From abbotti@mev.co.uk Fri Mar 1 11:19:33 2013 +From: Ian Abbott +Date: Wed, 27 Feb 2013 12:52:46 +0000 +Subject: staging: comedi: ni_labpc: set up command4 register *after* command3 +To: stable@vger.kernel.org +Cc: Ian Abbott +Message-ID: <1361969566-32521-2-git-send-email-abbotti@mev.co.uk> + +From: Ian Abbott + +Commit 22056e2b46246d97ff0f7c6e21a77b8daa07f02c upstream. + +Tuomas reported problems getting +meaningful output from a Lab-PC+ in differential mode for AI cmds, but +AI insn reads gave correct readings. He tracked it down to two +problems, one of which is addressed by this patch. + +It seems that writing to the command3 register after writing to the +command4 register in `labpc_ai_cmd()` messes up the differential +reference bit setting in the command4 register. Set up the command4 +register after the command3 register (as in `labpc_ai_rinsn()`) to avoid +the problem. + +Thanks to Tuomas for suggesting the fix. + +Signed-off-by: Ian Abbott +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/comedi/drivers/ni_labpc.c | 31 +++++++++++++++--------------- + 1 file changed, 16 insertions(+), 15 deletions(-) + +--- a/drivers/staging/comedi/drivers/ni_labpc.c ++++ b/drivers/staging/comedi/drivers/ni_labpc.c +@@ -1259,21 +1259,6 @@ static int labpc_ai_cmd(struct comedi_de + devpriv->write_byte(devpriv->command1_bits, + dev->iobase + COMMAND1_REG); + } +- /* setup any external triggering/pacing (command4 register) */ +- devpriv->command4_bits = 0; +- if (cmd->convert_src != TRIG_EXT) +- devpriv->command4_bits |= EXT_CONVERT_DISABLE_BIT; +- /* XXX should discard first scan when using interval scanning +- * since manual says it is not synced with scan clock */ +- if (labpc_use_continuous_mode(cmd) == 0) { +- devpriv->command4_bits |= INTERVAL_SCAN_EN_BIT; +- if (cmd->scan_begin_src == TRIG_EXT) +- devpriv->command4_bits |= EXT_SCAN_EN_BIT; +- } +- /* single-ended/differential */ +- if (aref == AREF_DIFF) +- devpriv->command4_bits |= ADC_DIFF_BIT; +- devpriv->write_byte(devpriv->command4_bits, dev->iobase + COMMAND4_REG); + + devpriv->write_byte(cmd->chanlist_len, + dev->iobase + INTERVAL_COUNT_REG); +@@ -1351,6 +1336,22 @@ static int labpc_ai_cmd(struct comedi_de + devpriv->command3_bits &= ~ADC_FNE_INTR_EN_BIT; + devpriv->write_byte(devpriv->command3_bits, dev->iobase + COMMAND3_REG); + ++ /* setup any external triggering/pacing (command4 register) */ ++ devpriv->command4_bits = 0; ++ if (cmd->convert_src != TRIG_EXT) ++ devpriv->command4_bits |= EXT_CONVERT_DISABLE_BIT; ++ /* XXX should discard first scan when using interval scanning ++ * since manual says it is not synced with scan clock */ ++ if (labpc_use_continuous_mode(cmd) == 0) { ++ devpriv->command4_bits |= INTERVAL_SCAN_EN_BIT; ++ if (cmd->scan_begin_src == TRIG_EXT) ++ devpriv->command4_bits |= EXT_SCAN_EN_BIT; ++ } ++ /* single-ended/differential */ ++ if (aref == AREF_DIFF) ++ devpriv->command4_bits |= ADC_DIFF_BIT; ++ devpriv->write_byte(devpriv->command4_bits, dev->iobase + COMMAND4_REG); ++ + /* startup acquisition */ + + /* command2 reg */