<feed xmlns='http://www.w3.org/2005/Atom'>
<title>linux-stable.git/drivers/video, branch v3.0.26</title>
<subtitle>Linux kernel stable tree</subtitle>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/'/>
<entry>
<title>OMAPDSS: HDMI: PHY burnout fix</title>
<updated>2012-03-12T17:32:59+00:00</updated>
<author>
<name>Tomi Valkeinen</name>
<email>tomi.valkeinen@ti.com</email>
</author>
<published>2012-01-17T09:09:57+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=21189f03d3ec3a74d9949907c828410d7a9a86d5'/>
<id>21189f03d3ec3a74d9949907c828410d7a9a86d5</id>
<content type='text'>
commit c49d005b6cc8491fad5b24f82805be2d6bcbd3dd upstream.

A hardware bug in the OMAP4 HDMI PHY causes physical damage to the board
if the HDMI PHY is kept powered on when the cable is not connected.

This patch solves the problem by adding hot-plug-detection into the HDMI
IP driver. This is not a real HPD support in the sense that nobody else
than the IP driver gets to know about the HPD events, but is only meant
to fix the HW bug.

The strategy is simple: If the display device is turned off by the user,
the PHY power is set to OFF. When the display device is turned on by the
user, the PHY power is set either to LDOON or TXON, depending on whether
the HDMI cable is connected.

The reason to avoid PHY OFF when the display device is on, but the cable
is disconnected, is that when the PHY is turned OFF, the HDMI IP is not
"ticking" and thus the DISPC does not receive pixel clock from the HDMI
IP. This would, for example, prevent any VSYNCs from happening, and
would thus affect the users of omapdss. By using LDOON when the cable is
disconnected we'll avoid the HW bug, but keep the HDMI working as usual
from the user's point of view.

Signed-off-by: Tomi Valkeinen &lt;tomi.valkeinen@ti.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit c49d005b6cc8491fad5b24f82805be2d6bcbd3dd upstream.

A hardware bug in the OMAP4 HDMI PHY causes physical damage to the board
if the HDMI PHY is kept powered on when the cable is not connected.

This patch solves the problem by adding hot-plug-detection into the HDMI
IP driver. This is not a real HPD support in the sense that nobody else
than the IP driver gets to know about the HPD events, but is only meant
to fix the HW bug.

The strategy is simple: If the display device is turned off by the user,
the PHY power is set to OFF. When the display device is turned on by the
user, the PHY power is set either to LDOON or TXON, depending on whether
the HDMI cable is connected.

The reason to avoid PHY OFF when the display device is on, but the cable
is disconnected, is that when the PHY is turned OFF, the HDMI IP is not
"ticking" and thus the DISPC does not receive pixel clock from the HDMI
IP. This would, for example, prevent any VSYNCs from happening, and
would thus affect the users of omapdss. By using LDOON when the cable is
disconnected we'll avoid the HW bug, but keep the HDMI working as usual
from the user's point of view.

Signed-off-by: Tomi Valkeinen &lt;tomi.valkeinen@ti.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>OMAP: DSS2: HDMI: use default dividers</title>
<updated>2012-03-12T17:32:58+00:00</updated>
<author>
<name>Tomi Valkeinen</name>
<email>tomi.valkeinen@ti.com</email>
</author>
<published>2011-08-22T10:02:52+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=1825e65dbb5370d5cebd13dbdfe4bce86caf351c'/>
<id>1825e65dbb5370d5cebd13dbdfe4bce86caf351c</id>
<content type='text'>
commit 8d88767a4377171752c22ac39bcb2b505eb751da upstream.

Use default regn and regm2 dividers in the hdmi driver if the board file
does not define them.

Cc: Mythri P K &lt;mythripk@ti.com&gt;
Acked-by: Tony Lindgren &lt;tony@atomide.com&gt;
Signed-off-by: Tomi Valkeinen &lt;tomi.valkeinen@ti.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 8d88767a4377171752c22ac39bcb2b505eb751da upstream.

Use default regn and regm2 dividers in the hdmi driver if the board file
does not define them.

Cc: Mythri P K &lt;mythripk@ti.com&gt;
Acked-by: Tony Lindgren &lt;tony@atomide.com&gt;
Signed-off-by: Tomi Valkeinen &lt;tomi.valkeinen@ti.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>atmel_lcdfb: fix usage of CONTRAST_CTR in suspend/resume</title>
<updated>2012-02-13T19:06:09+00:00</updated>
<author>
<name>Hubert Feurstein</name>
<email>h.feurstein@gmail.com</email>
</author>
<published>2012-01-09T16:23:57+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=e02c339f506e10fadf8a5f00f1c932035596ed8e'/>
<id>e02c339f506e10fadf8a5f00f1c932035596ed8e</id>
<content type='text'>
commit 9f1065032ceb7e86c7c9f16bb86518857e88a172 upstream.

An error was existing in the saving of CONTRAST_CTR register
across suspend/resume.

Signed-off-by: Hubert Feurstein &lt;h.feurstein@gmail.com&gt;
Signed-off-by: Nicolas Ferre &lt;nicolas.ferre@atmel.com&gt;
Acked-by: Jean-Christophe PLAGNIOL-VILLARD &lt;plagnioj@jcrosoft.com&gt;
Signed-off-by: Florian Tobias Schandinat &lt;FlorianSchandinat@gmx.de&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 9f1065032ceb7e86c7c9f16bb86518857e88a172 upstream.

An error was existing in the saving of CONTRAST_CTR register
across suspend/resume.

Signed-off-by: Hubert Feurstein &lt;h.feurstein@gmail.com&gt;
Signed-off-by: Nicolas Ferre &lt;nicolas.ferre@atmel.com&gt;
Acked-by: Jean-Christophe PLAGNIOL-VILLARD &lt;plagnioj@jcrosoft.com&gt;
Signed-off-by: Florian Tobias Schandinat &lt;FlorianSchandinat@gmx.de&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>offb: Fix bug in calculating requested vram size</title>
<updated>2012-01-12T19:35:00+00:00</updated>
<author>
<name>Benjamin Herrenschmidt</name>
<email>benh@kernel.crashing.org</email>
</author>
<published>2012-01-03T01:09:15+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=68530d7210025a1e395819b774fcffaf943dd8f3'/>
<id>68530d7210025a1e395819b774fcffaf943dd8f3</id>
<content type='text'>
commit c055fe0797b7bd8f6f21a13598a55a16d5c13ae7 upstream.

We used to try to request 8 times more vram than needed, which would
fail if the card has a too small BAR (observed with qemu &amp; kvm).

Signed-off-by: Benjamin Herrenschmidt &lt;benh@kernel.crashing.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@suse.de&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit c055fe0797b7bd8f6f21a13598a55a16d5c13ae7 upstream.

We used to try to request 8 times more vram than needed, which would
fail if the card has a too small BAR (observed with qemu &amp; kvm).

Signed-off-by: Benjamin Herrenschmidt &lt;benh@kernel.crashing.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@suse.de&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>offb: Fix setting of the pseudo-palette for &gt;8bpp</title>
<updated>2012-01-12T19:34:59+00:00</updated>
<author>
<name>Benjamin Herrenschmidt</name>
<email>benh@kernel.crashing.org</email>
</author>
<published>2011-12-28T00:10:16+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=51a32a1a373e071aec24ffa765d198d591b3d6dd'/>
<id>51a32a1a373e071aec24ffa765d198d591b3d6dd</id>
<content type='text'>
commit 1bb0b7d21584b3f878e2bc880db62351ddee5185 upstream.

When using a &gt;8bpp framebuffer, offb advertises truecolor, not directcolor,
and doesn't touch the color map even if it has a corresponding access method
for the real hardware.

Thus it needs to set the pseudo-palette with all 3 components of the color,
like other truecolor framebuffers, not with copies of the color index like
a directcolor framebuffer would do.

This went unnoticed for a long time because it's pretty hard to get offb
to kick in with anything but 8bpp (old BootX under MacOS will do that and
qemu does it).

Signed-off-by: Benjamin Herrenschmidt &lt;benh@kernel.crashing.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@suse.de&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 1bb0b7d21584b3f878e2bc880db62351ddee5185 upstream.

When using a &gt;8bpp framebuffer, offb advertises truecolor, not directcolor,
and doesn't touch the color map even if it has a corresponding access method
for the real hardware.

Thus it needs to set the pseudo-palette with all 3 components of the color,
like other truecolor framebuffers, not with copies of the color index like
a directcolor framebuffer would do.

This went unnoticed for a long time because it's pretty hard to get offb
to kick in with anything but 8bpp (old BootX under MacOS will do that and
qemu does it).

Signed-off-by: Benjamin Herrenschmidt &lt;benh@kernel.crashing.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@suse.de&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>viafb: correct sync polarity for OLPC DCON</title>
<updated>2011-12-09T16:52:23+00:00</updated>
<author>
<name>Daniel Drake</name>
<email>dsd@laptop.org</email>
</author>
<published>2011-11-21T15:05:56+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=47b52de3faa57f5849c71bdaee4cd041debcc1ff'/>
<id>47b52de3faa57f5849c71bdaee4cd041debcc1ff</id>
<content type='text'>
commit a32839696a8eef813a1aff604fbad9a32dff6c95 upstream.

While the OLPC display appears to be able to handle either positive
or negative sync, the Display Controller only recognises positive sync.

This brings viafb (for XO-1.5) in line with lxfb (for XO-1) and
fixes a recent regression where the XO-1.5 DCON could no longer be
frozen. Thanks to Florian Tobias Schandinat for helping identify
the fix.

Test case: from a vt,
	echo 1 &gt; /sys/devices/platform/dcon/freeze
should cause the current screen contents to freeze, rather than garbage being
displayed.

Signed-off-by: Daniel Drake &lt;dsd@laptop.org&gt;
Signed-off-by: Florian Tobias Schandinat &lt;FlorianSchandinat@gmx.de&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@suse.de&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit a32839696a8eef813a1aff604fbad9a32dff6c95 upstream.

While the OLPC display appears to be able to handle either positive
or negative sync, the Display Controller only recognises positive sync.

This brings viafb (for XO-1.5) in line with lxfb (for XO-1) and
fixes a recent regression where the XO-1.5 DCON could no longer be
frozen. Thanks to Florian Tobias Schandinat for helping identify
the fix.

Test case: from a vt,
	echo 1 &gt; /sys/devices/platform/dcon/freeze
should cause the current screen contents to freeze, rather than garbage being
displayed.

Signed-off-by: Daniel Drake &lt;dsd@laptop.org&gt;
Signed-off-by: Florian Tobias Schandinat &lt;FlorianSchandinat@gmx.de&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@suse.de&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>viafb: improve pitch handling</title>
<updated>2011-11-11T17:36:13+00:00</updated>
<author>
<name>Florian Tobias Schandinat</name>
<email>FlorianSchandinat@gmx.de</email>
</author>
<published>2011-06-06T01:27:34+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=76ec8cdcca9f8fa8e2546ed96a2715a6654487ad'/>
<id>76ec8cdcca9f8fa8e2546ed96a2715a6654487ad</id>
<content type='text'>
commit 936a3f770b8de7042d793272f008ef1bb08522e9 upstream.

This patch adds checks for minimum and maximum pitch size to prevent
invalid settings which could otherwise crash the machine. Also the
alignment is done in a slightly more readable way.

Signed-off-by: Florian Tobias Schandinat &lt;FlorianSchandinat@gmx.de&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@suse.de&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 936a3f770b8de7042d793272f008ef1bb08522e9 upstream.

This patch adds checks for minimum and maximum pitch size to prevent
invalid settings which could otherwise crash the machine. Also the
alignment is done in a slightly more readable way.

Signed-off-by: Florian Tobias Schandinat &lt;FlorianSchandinat@gmx.de&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@suse.de&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>viafb: use display information in info not in var for panning</title>
<updated>2011-11-11T17:36:12+00:00</updated>
<author>
<name>Florian Tobias Schandinat</name>
<email>FlorianSchandinat@gmx.de</email>
</author>
<published>2011-05-23T21:39:58+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=cdf3e3448744d14b6307dfc7f7203cba6fecf199'/>
<id>cdf3e3448744d14b6307dfc7f7203cba6fecf199</id>
<content type='text'>
commit d933990c57b498c092ceef591c7c5d69dbfe9f30 upstream.

As Laurent pointed out we must not use any information in the passed
var besides xoffset, yoffset and vmode as otherwise applications
might abuse it. Also use the aligned fix.line_length and not the
(possible) unaligned xres_virtual.

Signed-off-by: Florian Tobias Schandinat &lt;FlorianSchandinat@gmx.de&gt;
Reported-by: Laurent Pinchart &lt;laurent.pinchart@ideasonboard.com&gt;
Acked-by: Laurent Pinchart &lt;laurent.pinchart@ideasonboard.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@suse.de&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit d933990c57b498c092ceef591c7c5d69dbfe9f30 upstream.

As Laurent pointed out we must not use any information in the passed
var besides xoffset, yoffset and vmode as otherwise applications
might abuse it. Also use the aligned fix.line_length and not the
(possible) unaligned xres_virtual.

Signed-off-by: Florian Tobias Schandinat &lt;FlorianSchandinat@gmx.de&gt;
Reported-by: Laurent Pinchart &lt;laurent.pinchart@ideasonboard.com&gt;
Acked-by: Laurent Pinchart &lt;laurent.pinchart@ideasonboard.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@suse.de&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>fb: sh-mobile: Fix deadlock risk between lock_fb_info() and console_lock()</title>
<updated>2011-11-11T17:36:11+00:00</updated>
<author>
<name>Bruno Prémont</name>
<email>bonbons@linux-vserver.org</email>
</author>
<published>2011-09-02T17:24:03+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=3f199a7d6f2c769131f1c0dda2eb9b30d1e21617'/>
<id>3f199a7d6f2c769131f1c0dda2eb9b30d1e21617</id>
<content type='text'>
commit 4a47a0e09c504e3ce0ccdb405411aefc5b09deb8 upstream.

Following on Herton's patch "fb: avoid possible deadlock caused by
fb_set_suspend" which moves lock_fb_info() out of fb_set_suspend()
to its callers, correct sh-mobile's locking around call to
fb_set_suspend() and the same sort of deaklocks with console_lock()
due to order of taking the lock.

console_lock() must be taken while fb_info is already locked and fb_info
must be locked while calling fb_set_suspend().

Signed-off-by: Bruno Prémont &lt;bonbons@linux-vserver.org&gt;
Signed-off-by: Guennadi Liakhovetski &lt;g.liakhovetski@gmx.de&gt;
Signed-off-by: Florian Tobias Schandinat &lt;FlorianSchandinat@gmx.de&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@suse.de&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 4a47a0e09c504e3ce0ccdb405411aefc5b09deb8 upstream.

Following on Herton's patch "fb: avoid possible deadlock caused by
fb_set_suspend" which moves lock_fb_info() out of fb_set_suspend()
to its callers, correct sh-mobile's locking around call to
fb_set_suspend() and the same sort of deaklocks with console_lock()
due to order of taking the lock.

console_lock() must be taken while fb_info is already locked and fb_info
must be locked while calling fb_set_suspend().

Signed-off-by: Bruno Prémont &lt;bonbons@linux-vserver.org&gt;
Signed-off-by: Guennadi Liakhovetski &lt;g.liakhovetski@gmx.de&gt;
Signed-off-by: Florian Tobias Schandinat &lt;FlorianSchandinat@gmx.de&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@suse.de&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>fb: avoid possible deadlock caused by fb_set_suspend</title>
<updated>2011-11-11T17:36:10+00:00</updated>
<author>
<name>Herton Ronaldo Krzesinski</name>
<email>herton@mandriva.com.br</email>
</author>
<published>2011-06-17T19:02:39+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=627afd48f8d28f14271b9ccf3b1f5d3e77237e2c'/>
<id>627afd48f8d28f14271b9ccf3b1f5d3e77237e2c</id>
<content type='text'>
commit 9e769ff3f585db8f978f9113be83d36c7e3965dd upstream.

A lock ordering issue can cause deadlocks: in framebuffer/console code,
all needed struct fb_info locks are taken before acquire_console_sem(),
in places which need to take console semaphore.

But fb_set_suspend is always called with console semaphore held, and
inside it we call lock_fb_info which gets the fb_info lock, inverse
locking order of what the rest of the code does. This causes a real
deadlock issue, when we write to state fb sysfs attribute (which calls
fb_set_suspend) while a framebuffer is being unregistered by
remove_conflicting_framebuffers, as can be shown by following show
blocked state trace on a test program which loads i915 and runs another
forked processes writing to state attribute:

Test process with semaphore held and trying to get fb_info lock:
..
fb-test2      D 0000000000000000     0   237    228 0x00000000
 ffff8800774f3d68 0000000000000082 00000000000135c0 00000000000135c0
 ffff880000000000 ffff8800774f3fd8 ffff8800774f3fd8 ffff880076ee4530
 00000000000135c0 ffff8800774f3fd8 ffff8800774f2000 00000000000135c0
Call Trace:
 [&lt;ffffffff8141287a&gt;] __mutex_lock_slowpath+0x11a/0x1e0
 [&lt;ffffffff814142f2&gt;] ? _raw_spin_lock_irq+0x22/0x40
 [&lt;ffffffff814123d3&gt;] mutex_lock+0x23/0x50
 [&lt;ffffffff8125dfc5&gt;] lock_fb_info+0x25/0x60
 [&lt;ffffffff8125e3f0&gt;] fb_set_suspend+0x20/0x80
 [&lt;ffffffff81263e2f&gt;] store_fbstate+0x4f/0x70
 [&lt;ffffffff812e7f70&gt;] dev_attr_store+0x20/0x30
 [&lt;ffffffff811c46b4&gt;] sysfs_write_file+0xd4/0x160
 [&lt;ffffffff81155a26&gt;] vfs_write+0xc6/0x190
 [&lt;ffffffff81155d51&gt;] sys_write+0x51/0x90
 [&lt;ffffffff8100c012&gt;] system_call_fastpath+0x16/0x1b
..
modprobe process stalled because has the fb_info lock (got inside
unregister_framebuffer) but waiting for the semaphore held by the
test process which is waiting to get the fb_info lock:
..
modprobe      D 0000000000000000     0   230    218 0x00000000
 ffff880077a4d618 0000000000000082 0000000000000001 0000000000000001
 ffff880000000000 ffff880077a4dfd8 ffff880077a4dfd8 ffff8800775a2e20
 00000000000135c0 ffff880077a4dfd8 ffff880077a4c000 00000000000135c0
Call Trace:
 [&lt;ffffffff81411fe5&gt;] schedule_timeout+0x215/0x310
 [&lt;ffffffff81058051&gt;] ? get_parent_ip+0x11/0x50
 [&lt;ffffffff814130dd&gt;] __down+0x6d/0xb0
 [&lt;ffffffff81089f71&gt;] down+0x41/0x50
 [&lt;ffffffff810629ac&gt;] acquire_console_sem+0x2c/0x50
 [&lt;ffffffff812ca53d&gt;] unbind_con_driver+0xad/0x2d0
 [&lt;ffffffff8126f5f7&gt;] fbcon_event_notify+0x457/0x890
 [&lt;ffffffff814144ff&gt;] ? _raw_spin_unlock_irqrestore+0x1f/0x50
 [&lt;ffffffff81058051&gt;] ? get_parent_ip+0x11/0x50
 [&lt;ffffffff8141836d&gt;] notifier_call_chain+0x4d/0x70
 [&lt;ffffffff8108a3b8&gt;] __blocking_notifier_call_chain+0x58/0x80
 [&lt;ffffffff8108a3f6&gt;] blocking_notifier_call_chain+0x16/0x20
 [&lt;ffffffff8125dabb&gt;] fb_notifier_call_chain+0x1b/0x20
 [&lt;ffffffff8125e6ac&gt;] unregister_framebuffer+0x7c/0x130
 [&lt;ffffffff8125e8b3&gt;] remove_conflicting_framebuffers+0x153/0x180
 [&lt;ffffffff8125eef3&gt;] register_framebuffer+0x93/0x2c0
 [&lt;ffffffffa0331112&gt;] drm_fb_helper_single_fb_probe+0x252/0x2f0 [drm_kms_helper]
 [&lt;ffffffffa03314a3&gt;] drm_fb_helper_initial_config+0x2f3/0x6d0 [drm_kms_helper]
 [&lt;ffffffffa03318dd&gt;] ? drm_fb_helper_single_add_all_connectors+0x5d/0x1c0 [drm_kms_helper]
 [&lt;ffffffffa037b588&gt;] intel_fbdev_init+0xa8/0x160 [i915]
 [&lt;ffffffffa0343d74&gt;] i915_driver_load+0x854/0x12b0 [i915]
 [&lt;ffffffffa02f0e7e&gt;] drm_get_pci_dev+0x19e/0x360 [drm]
 [&lt;ffffffff8141821d&gt;] ? sub_preempt_count+0x9d/0xd0
 [&lt;ffffffffa0386f91&gt;] i915_pci_probe+0x15/0x17 [i915]
 [&lt;ffffffff8124481f&gt;] local_pci_probe+0x5f/0xd0
 [&lt;ffffffff81244f89&gt;] pci_device_probe+0x119/0x120
 [&lt;ffffffff812eccaa&gt;] ? driver_sysfs_add+0x7a/0xb0
 [&lt;ffffffff812ed003&gt;] driver_probe_device+0xa3/0x290
 [&lt;ffffffff812ed1f0&gt;] ? __driver_attach+0x0/0xb0
 [&lt;ffffffff812ed29b&gt;] __driver_attach+0xab/0xb0
 [&lt;ffffffff812ed1f0&gt;] ? __driver_attach+0x0/0xb0
 [&lt;ffffffff812ebd3e&gt;] bus_for_each_dev+0x5e/0x90
 [&lt;ffffffff812ecc2e&gt;] driver_attach+0x1e/0x20
 [&lt;ffffffff812ec6f2&gt;] bus_add_driver+0xe2/0x320
 [&lt;ffffffffa03aa000&gt;] ? i915_init+0x0/0x96 [i915]
 [&lt;ffffffff812ed536&gt;] driver_register+0x76/0x140
 [&lt;ffffffffa03aa000&gt;] ? i915_init+0x0/0x96 [i915]
 [&lt;ffffffff81245216&gt;] __pci_register_driver+0x56/0xd0
 [&lt;ffffffffa02f1264&gt;] drm_pci_init+0xe4/0xf0 [drm]
 [&lt;ffffffffa03aa000&gt;] ? i915_init+0x0/0x96 [i915]
 [&lt;ffffffffa02e84a8&gt;] drm_init+0x58/0x70 [drm]
 [&lt;ffffffffa03aa094&gt;] i915_init+0x94/0x96 [i915]
 [&lt;ffffffff81002194&gt;] do_one_initcall+0x44/0x190
 [&lt;ffffffff810a066b&gt;] sys_init_module+0xcb/0x210
 [&lt;ffffffff8100c012&gt;] system_call_fastpath+0x16/0x1b
..

fb-test2 which reproduces above is available on kernel.org bug #26232.
To solve this issue, avoid calling lock_fb_info inside fb_set_suspend,
and move it out to where needed (callers of fb_set_suspend must call
lock_fb_info before if needed). So far, the only place which needs to
call lock_fb_info is store_fbstate, all other places which calls
fb_set_suspend are suspend/resume hooks that should not need the lock as
they should be run only when processes are already frozen in
suspend/resume.

References: https://bugzilla.kernel.org/show_bug.cgi?id=26232
Signed-off-by: Herton Ronaldo Krzesinski &lt;herton@mandriva.com.br&gt;
Signed-off-by: Florian Tobias Schandinat &lt;FlorianSchandinat@gmx.de&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@suse.de&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 9e769ff3f585db8f978f9113be83d36c7e3965dd upstream.

A lock ordering issue can cause deadlocks: in framebuffer/console code,
all needed struct fb_info locks are taken before acquire_console_sem(),
in places which need to take console semaphore.

But fb_set_suspend is always called with console semaphore held, and
inside it we call lock_fb_info which gets the fb_info lock, inverse
locking order of what the rest of the code does. This causes a real
deadlock issue, when we write to state fb sysfs attribute (which calls
fb_set_suspend) while a framebuffer is being unregistered by
remove_conflicting_framebuffers, as can be shown by following show
blocked state trace on a test program which loads i915 and runs another
forked processes writing to state attribute:

Test process with semaphore held and trying to get fb_info lock:
..
fb-test2      D 0000000000000000     0   237    228 0x00000000
 ffff8800774f3d68 0000000000000082 00000000000135c0 00000000000135c0
 ffff880000000000 ffff8800774f3fd8 ffff8800774f3fd8 ffff880076ee4530
 00000000000135c0 ffff8800774f3fd8 ffff8800774f2000 00000000000135c0
Call Trace:
 [&lt;ffffffff8141287a&gt;] __mutex_lock_slowpath+0x11a/0x1e0
 [&lt;ffffffff814142f2&gt;] ? _raw_spin_lock_irq+0x22/0x40
 [&lt;ffffffff814123d3&gt;] mutex_lock+0x23/0x50
 [&lt;ffffffff8125dfc5&gt;] lock_fb_info+0x25/0x60
 [&lt;ffffffff8125e3f0&gt;] fb_set_suspend+0x20/0x80
 [&lt;ffffffff81263e2f&gt;] store_fbstate+0x4f/0x70
 [&lt;ffffffff812e7f70&gt;] dev_attr_store+0x20/0x30
 [&lt;ffffffff811c46b4&gt;] sysfs_write_file+0xd4/0x160
 [&lt;ffffffff81155a26&gt;] vfs_write+0xc6/0x190
 [&lt;ffffffff81155d51&gt;] sys_write+0x51/0x90
 [&lt;ffffffff8100c012&gt;] system_call_fastpath+0x16/0x1b
..
modprobe process stalled because has the fb_info lock (got inside
unregister_framebuffer) but waiting for the semaphore held by the
test process which is waiting to get the fb_info lock:
..
modprobe      D 0000000000000000     0   230    218 0x00000000
 ffff880077a4d618 0000000000000082 0000000000000001 0000000000000001
 ffff880000000000 ffff880077a4dfd8 ffff880077a4dfd8 ffff8800775a2e20
 00000000000135c0 ffff880077a4dfd8 ffff880077a4c000 00000000000135c0
Call Trace:
 [&lt;ffffffff81411fe5&gt;] schedule_timeout+0x215/0x310
 [&lt;ffffffff81058051&gt;] ? get_parent_ip+0x11/0x50
 [&lt;ffffffff814130dd&gt;] __down+0x6d/0xb0
 [&lt;ffffffff81089f71&gt;] down+0x41/0x50
 [&lt;ffffffff810629ac&gt;] acquire_console_sem+0x2c/0x50
 [&lt;ffffffff812ca53d&gt;] unbind_con_driver+0xad/0x2d0
 [&lt;ffffffff8126f5f7&gt;] fbcon_event_notify+0x457/0x890
 [&lt;ffffffff814144ff&gt;] ? _raw_spin_unlock_irqrestore+0x1f/0x50
 [&lt;ffffffff81058051&gt;] ? get_parent_ip+0x11/0x50
 [&lt;ffffffff8141836d&gt;] notifier_call_chain+0x4d/0x70
 [&lt;ffffffff8108a3b8&gt;] __blocking_notifier_call_chain+0x58/0x80
 [&lt;ffffffff8108a3f6&gt;] blocking_notifier_call_chain+0x16/0x20
 [&lt;ffffffff8125dabb&gt;] fb_notifier_call_chain+0x1b/0x20
 [&lt;ffffffff8125e6ac&gt;] unregister_framebuffer+0x7c/0x130
 [&lt;ffffffff8125e8b3&gt;] remove_conflicting_framebuffers+0x153/0x180
 [&lt;ffffffff8125eef3&gt;] register_framebuffer+0x93/0x2c0
 [&lt;ffffffffa0331112&gt;] drm_fb_helper_single_fb_probe+0x252/0x2f0 [drm_kms_helper]
 [&lt;ffffffffa03314a3&gt;] drm_fb_helper_initial_config+0x2f3/0x6d0 [drm_kms_helper]
 [&lt;ffffffffa03318dd&gt;] ? drm_fb_helper_single_add_all_connectors+0x5d/0x1c0 [drm_kms_helper]
 [&lt;ffffffffa037b588&gt;] intel_fbdev_init+0xa8/0x160 [i915]
 [&lt;ffffffffa0343d74&gt;] i915_driver_load+0x854/0x12b0 [i915]
 [&lt;ffffffffa02f0e7e&gt;] drm_get_pci_dev+0x19e/0x360 [drm]
 [&lt;ffffffff8141821d&gt;] ? sub_preempt_count+0x9d/0xd0
 [&lt;ffffffffa0386f91&gt;] i915_pci_probe+0x15/0x17 [i915]
 [&lt;ffffffff8124481f&gt;] local_pci_probe+0x5f/0xd0
 [&lt;ffffffff81244f89&gt;] pci_device_probe+0x119/0x120
 [&lt;ffffffff812eccaa&gt;] ? driver_sysfs_add+0x7a/0xb0
 [&lt;ffffffff812ed003&gt;] driver_probe_device+0xa3/0x290
 [&lt;ffffffff812ed1f0&gt;] ? __driver_attach+0x0/0xb0
 [&lt;ffffffff812ed29b&gt;] __driver_attach+0xab/0xb0
 [&lt;ffffffff812ed1f0&gt;] ? __driver_attach+0x0/0xb0
 [&lt;ffffffff812ebd3e&gt;] bus_for_each_dev+0x5e/0x90
 [&lt;ffffffff812ecc2e&gt;] driver_attach+0x1e/0x20
 [&lt;ffffffff812ec6f2&gt;] bus_add_driver+0xe2/0x320
 [&lt;ffffffffa03aa000&gt;] ? i915_init+0x0/0x96 [i915]
 [&lt;ffffffff812ed536&gt;] driver_register+0x76/0x140
 [&lt;ffffffffa03aa000&gt;] ? i915_init+0x0/0x96 [i915]
 [&lt;ffffffff81245216&gt;] __pci_register_driver+0x56/0xd0
 [&lt;ffffffffa02f1264&gt;] drm_pci_init+0xe4/0xf0 [drm]
 [&lt;ffffffffa03aa000&gt;] ? i915_init+0x0/0x96 [i915]
 [&lt;ffffffffa02e84a8&gt;] drm_init+0x58/0x70 [drm]
 [&lt;ffffffffa03aa094&gt;] i915_init+0x94/0x96 [i915]
 [&lt;ffffffff81002194&gt;] do_one_initcall+0x44/0x190
 [&lt;ffffffff810a066b&gt;] sys_init_module+0xcb/0x210
 [&lt;ffffffff8100c012&gt;] system_call_fastpath+0x16/0x1b
..

fb-test2 which reproduces above is available on kernel.org bug #26232.
To solve this issue, avoid calling lock_fb_info inside fb_set_suspend,
and move it out to where needed (callers of fb_set_suspend must call
lock_fb_info before if needed). So far, the only place which needs to
call lock_fb_info is store_fbstate, all other places which calls
fb_set_suspend are suspend/resume hooks that should not need the lock as
they should be run only when processes are already frozen in
suspend/resume.

References: https://bugzilla.kernel.org/show_bug.cgi?id=26232
Signed-off-by: Herton Ronaldo Krzesinski &lt;herton@mandriva.com.br&gt;
Signed-off-by: Florian Tobias Schandinat &lt;FlorianSchandinat@gmx.de&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@suse.de&gt;

</pre>
</div>
</content>
</entry>
</feed>
