linux-stable.git/drivers/video, branch linux-2.6.24.y

fbdev: fix /proc/fb oops after module removal

2008-04-19T01:53:30+00:00

upstream commit: c43f89c2084f46e3ec59ddcbc52ecf4b1e9b015a

/proc/fb is not removed during rmmod.

Steps to reproduce:

	modprobe fb
	rmmod fb
	ls /proc

BUG: unable to handle kernel paging request at ffffffffa0094370
IP: [] proc_get_inode+0x101/0x130
PGD 203067 PUD 207063 PMD 17e758067 PTE 0
Oops: 0000 [1] SMP
last sysfs file: /sys/devices/pci0000:00/0000:00:1e.0/0000:05:02.0/resource
CPU 1
Modules linked in: nf_conntrack_irc xt_state iptable_filter ipt_MASQUERADE iptable_nat nf_nat nf_conntrack_ipv4 nf_conntrack ip_tables x_tables vfat fat usbhid ehci_hcd uhci_hcd usbcore sr_mod cdrom [last unloaded: fb]
Pid: 21205, comm: ls Not tainted 2.6.25-rc8-mm2 #14
RIP: 0010:[]  [] proc_get_inode+0x101/0x130
RSP: 0018:ffff81017c4bfc78  EFLAGS: 00010246
RAX: 0000000000008000 RBX: ffff8101787f5470 RCX: 0000000048011ccc
RDX: ffffffffa0094320 RSI: ffff810006ad43b0 RDI: ffff81017fc2cc00
RBP: ffff81017e450300 R08: 0000000000000002 R09: ffff81017c5d1000
R10: 0000000000000000 R11: 0000000000000246 R12: ffff81016b903a28
R13: ffff81017f822020 R14: ffff81017c4bfd58 R15: ffff81017f822020
FS:  00007f08e71696f0(0000) GS:ffff81017fc06480(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
CR2: ffffffffa0094370 CR3: 000000017e54a000 CR4: 00000000000006e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Process ls (pid: 21205, threadinfo ffff81017c4be000, task ffff81017de48770)
Stack:  ffff81017c5d1000 00000000ffffffea ffff81017e450300 ffffffff802bdd1e
 ffff81017f802258 ffff81017c4bfe48 ffff81016b903a28 ffff81017f822020
 ffff81017c4bfd48 ffffffff802b9ba0 ffff81016b903a28 ffff81017f802258
Call Trace:
 [] ? proc_lookup_de+0x8e/0x100
 [] ? proc_root_lookup+0x20/0x60
 [] ? do_lookup+0x1b7/0x210
 [] ? __link_path_walk+0x53d/0x7f0
 [] ? mntput_no_expire+0x28/0x130
 [] ? path_walk+0x5a/0xc0
 [] ? do_path_lookup+0x83/0x1c0
 [] ? getname+0xe5/0x210
 [] ? __user_walk_fd+0x4b/0x80
 [] ? vfs_lstat_fd+0x2c/0x70
 [] ? filldir+0xae/0xf0
 [] ? de_put+0x9/0x50
 [] ? mnt_want_write+0x2d/0x80
 [] ? touch_atime+0x1f/0x170
 [] ? proc_root_readdir+0x7d/0xa0
 [] ? sys_newlstat+0x27/0x50
 [] ? vfs_readdir+0x9b/0xd0
 [] ? sys_getdents+0xce/0xe0
 [] ? system_call_after_swapgs+0x7b/0x80

Code: b7 83 b2 00 00 00 25 00 f0 00 00 3d 00 80 00 00 74 19 48 89 93 f0 00 00 00 48 89 df e8 39 9a fd ff 48 89 d8 48 83 c4 08 5b 5d c3 <48> 83 7a 50 00 48 c7 c0 60 16 45 80 48 c7 c2 40 17 45 80 48 0f
RIP  [] proc_get_inode+0x101/0x130
 RSP 
CR2: ffffffffa0094370
---[ end trace c71hiarjan8ab739 ]---

Signed-off-by: Alexey Dobriyan 
"Antonino A. Daplas" 
Cc: 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Chris Wright

s3c2410_fb: fix line length calculation

2008-01-22T03:39:41+00:00

Fix line length calculation. var->width is the size of the display in mm. We
like to use the pixel size.

Without this fix, dynamic (fbset) based resolution and depths changes with
s3c2410_fb don't work at all.

Spotted by john cass 

Signed-off-by: Stefan Schmidt 
Signed-off-by: Harald Welte 
Acked-by: Ben Dooks 
Acked-by: Arnaud Patard 
Acked-by: Krzysztof Helt 
Cc: "Antonino A. Daplas" 
Cc: Russell King 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

fix radeonfb regression with Xpress 200m 5955

2008-01-17T23:38:59+00:00

Fix http://bugzilla.kernel.org/show_bug.cgi?id=9762

Framebuffer is ok only with default parameters only (it is 1280x800-8@60).  If
parameters are video=radeonfb:1280x800-32@60 then xres, yres and xres_virtual
are ok but yres_virtual is 1024.  It can be corrected by fbset utility so I
think it can be corrected in the driver code also.

Steps to reproduce: video=radeonfb:1280x800-32@60 or
video=radeonfb:1280x800-16@60

Add 1280x800 mode into modedb

Cc: "Rafael J. Wysocki" 
Cc: "Antonino A. Daplas" 
Cc: Geert Uytterhoeven 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

uvesafb: fix section mismatch warnings

2008-01-14T16:52:23+00:00

Mark uvesafb_init_mtrr() as __devinit since its caller is __devinit
and since it accesses __devinitdata.

WARNING: vmlinux.o(.text+0x4df80e): Section mismatch: reference to .init.data: (between 'uvesafb_init_mtrr' and 'uvesafb_show_vbe_ver')

Variable 'blank' cannot be __devinitdata since it is referenced in an
fb_ops method that could be called at any time.

WARNING: vmlinux.o(.text+0x4dfc1e): Section mismatch: reference to .init.data:blank (between 'param_set_scroll' and 'vesa_setpalette')
WARNING: vmlinux.o(.text+0x4dfc24): Section mismatch: reference to .init.data:blank (between 'param_set_scroll' and 'vesa_setpalette')

Signed-off-by: Randy Dunlap 
Cc: "Antonino A. Daplas" 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

s3c2410fb: fix incorrect argument type in resume function

2008-01-14T16:52:23+00:00

Fix wrong pointer type passed into the s3c2410fb_init_registers()
function.

Signed-off-by: Krzysztof Helt 
Cc: "Antonino A. Daplas" 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

MAINTAINERS: email update and add missing entry

2008-01-14T16:52:22+00:00

 - MAINTAINERS email update
 - add atmel_lcdfb entry

Signed-off-by: Nicolas Ferre 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

ps3fb: fix deadlock on kexec()

2008-01-11T19:47:43+00:00

Since the introduction of the acquire_console_sem calls in
0333d83509c7d8496c8965b5ba9bc0c98e83c259, kexecing can cause the
kernel to deadlock:

 ps3fb_shutdown()
  -> unregister_framebuffer()
  -> fb_notifier_call_chain(FB_EVENT_FB_UNBIND)
  -> fbcon_fb_unbind()
  -> unbind_con_driver()
  -> bind_con_driver()
	[ acquires console_sem ]
  -> fbcon_deinit()
  -> fbops->fb_release(newinfo, 0)
  -> ps3fb_release()
  -> ps3fb_sync()
	[ acquires console_sem ]

This change avoids the deadlock by moving the acquire_console_sem()
out of ps3fb_sync(), and puts it into the two other callsites, leaving
ps3fb_release() to call ps3fb_sync() without the console semaphore.

[Geert]
  - Corrected call sequence above
  - ps3fb_release() may be called with and without console_sem held. This is an
    inconsistency that should be fixed at the fb level, but for now, try to
    acquire console_sem in ps3fb_release().

    I think it's safer to let ps3fb_release() try to acquire console_sem and
    not refresh the screen if it fails, than to call ps3fb_sync() without
    holding console_sem, as ps3fb_par may be modified at the same time, causing
    crashes or lockups.

    Besides, ps3fb_release() only calls ps3fb_sync() to refresh the screen
    when display flipping is disabled, which is an uncommon case (except during
    shutdown/kexec).

Signed-off-by: Jeremy Kerr 
Signed-off-by: Geert Uytterhoeven 
Cc: Benjamin Herrenschmidt 
Signed-off-by: Linus Torvalds

ps3fb: prevent use after free of fb_info

2008-01-11T19:47:42+00:00

In ps3fb_shutdown, freeing the framebuffer will cause fb_info (in
dev->core.driver_data) to be free()ed, which we potentially access
from the ps3fbd kthread.

This change frees the framebuffer after stopping the ps3fbd kthread.

Signed-off-by: Jeremy Kerr 
Signed-off-by: Geert Uytterhoeven 
Signed-off-by: Linus Torvalds

ps3fb: Fix ps3fb free_irq() dev_id

2007-12-19T22:27:30+00:00

The dev_id arg passed to free_irq() must match that passed to
request_irq().

Fixes this PS3 error message:

  Trying to free already-free IRQ 44

Signed-off-by: Geoff Levand 
Signed-off-by: Geert Uytterhoeven 
Signed-off-by: Linus Torvalds

ps3fb: Update for firmware 2.10

2007-12-19T22:27:30+00:00

ps3fb: Update for firmware 2.10

As of PS3 firmware version 2.10, the GPU command buffer size must be at least 2
MiB large. Since we use only a small part of the GPU command buffer and don't
want to waste precious XDR memory, move the GPU command buffer back to the
start of the XDR memory reserved for ps3fb and let the unused part overlap with
the actual frame buffer.

Signed-off-by: Geert Uytterhoeven 
Signed-off-by: Linus Torvalds