linux.git/drivers/video, branch v2.6.39

Merge branch 'fbmem'

2011-05-14T18:24:32+00:00

* fbmem:
  Further fbcon sanity checking
  fbmem: fix remove_conflicting_framebuffers races

Further fbcon sanity checking

2011-05-14T17:28:54+00:00

This moves the

    if (num_registered_fb == FB_MAX)
            return -ENXIO;

check _AFTER_ the call to do_remove_conflicting_framebuffers() as this
would (now in a safe way) allow a native driver to replace the
conflicting one even if all slots in registered_fb[] are taken.

This also prevents unregistering a framebuffer that is no longer
registered (vga16f will unregister at module unload time even if the
frame buffer had been unregistered earlier due to being found
conflicting).

Signed-off-by: Bruno Prémont 
Signed-off-by: Linus Torvalds

fbmem: fix remove_conflicting_framebuffers races

2011-05-14T17:23:44+00:00

When a register_framebuffer() call results in us removing old
conflicting framebuffers, the new registration_lock doesn't protect that
situation.  And we can't just add the same locking to the function,
because these functions call each other: register_framebuffer() calls
remove_conflicting_framebuffers, which in turn calls
unregister_framebuffer for any conflicting entry.

In order to fix it, this just creates wrapper functions around all three
functions and makes the versions that actually do the work be called
"do_xxx()", leaving just the wrapper that gets the lock and calls the
worker function.

So the rule becomes simply that "do_xxxx()" has to be called with the
lock held, and now do_register_framebuffer() can just call
do_remove_conflicting_framebuffers(), and that in turn can call
_do_unregister_framebuffer(), and there is no deadlock, and we can hold
the registration lock over the whole sequence, fixing the races.

It also makes error cases simpler, and fixes one situation where we
would return from unregister_framebuffer() without releasing the lock,
pointed out by Bruno Prémont.

Tested-by: Bruno Prémont 
Tested-by: Anca Emanuel 
Signed-off-by: Linus Torvalds

Merge branch 'fbmem'

2011-05-12T17:42:36+00:00

* fbmem:
  fbmem: make read/write/ioctl use the frame buffer at open time
  fbcon: add lifetime refcount to opened frame buffers

fbmem: make read/write/ioctl use the frame buffer at open time

2011-05-12T14:46:43+00:00

read/write/ioctl on a fbcon file descriptor has traditionally used the
fbcon not when it was opened, but as it was at the time of the call.
That makes no sense, but the lack of sense is much more obvious now that
we properly ref-count the usage - it means that the ref-counting doesn't
actually protect operations we do on the frame buffer.

This changes it to look at the fb_info that we got at open time, but in
order to avoid using a frame buffer long after it has been unregistered,
we do verify that it is still current, and return -ENODEV if not.

Acked-by: Tim Gardner 
Tested-by: Daniel J Blueman 
Tested-by: Anca Emanuel 
Cc: Bruno Prémont 
Cc: Alan Cox 
Cc: Paul Mundt 
Cc: Dave Airlie 
Cc: Andy Whitcroft 
Signed-off-by: Linus Torvalds

fbcon: add lifetime refcount to opened frame buffers

2011-05-12T14:37:51+00:00

This just adds the refcount and the new registration lock logic.  It
does not (for example) actually change the read/write/ioctl routines to
actually use the frame buffer that was opened: those function still end
up alway susing whatever the current frame buffer is at the time of the
call.

Without this, if something holds the frame buffer open over a
framebuffer switch, the close() operation after the switch will access a
fb_info that has been free'd by the unregistering of the old frame
buffer.

(The read/write/ioctl operations will normally not cause problems,
because they will - illogically - pick up the new fbcon instead.  But a
switch that happens just as one of those is going on might see problems
too, the window is just much smaller: one individual op rather than the
whole open-close sequence.)

This use-after-free is apparently fairly easily triggered by the Ubuntu
11.04 boot sequence.

Acked-by: Tim Gardner 
Tested-by: Daniel J Blueman 
Tested-by: Anca Emanuel 
Cc: Bruno Prémont 
Cc: Alan Cox 
Cc: Paul Mundt 
Cc: Dave Airlie 
Cc: Andy Whitcroft 
Signed-off-by: Linus Torvalds

ARM: RiscPC: acornfb: fix section mismatches

2011-05-06T07:16:51+00:00

WARNING: drivers/video/built-in.o(.devinit.text+0x38): Section mismatch in reference from the function acornfb_probe() to the function .init.text:acornfb_setup()
The function __devinit acornfb_probe() references
a function __init acornfb_setup().
If acornfb_setup is only used by acornfb_probe then
annotate acornfb_setup with a matching annotation.

WARNING: drivers/video/built-in.o(.devinit.text+0x3c): Section mismatch in reference from the function acornfb_probe() to the function .init.text:acornfb_init_fbinfo()
The function __devinit acornfb_probe() references
a function __init acornfb_init_fbinfo().
If acornfb_init_fbinfo is only used by acornfb_probe then
annotate acornfb_init_fbinfo with a matching annotation.

WARNING: drivers/video/built-in.o(.devinit.text+0x4c0): Section mismatch in reference from the function acornfb_probe() to the (unknown reference) .init.data:(unknown)
The function __devinit acornfb_probe() references
a (unknown reference) __initdata (unknown).
If (unknown) is only used by acornfb_probe then
annotate (unknown) with a matching annotation.

WARNING: drivers/video/built-in.o(.devinit.text+0x4c8): Section mismatch in reference from the function acornfb_probe() to the (unknown reference) .init.data:(unknown)
The function __devinit acornfb_probe() references
a (unknown reference) __initdata (unknown).
If (unknown) is only used by acornfb_probe then
annotate (unknown) with a matching annotation.

WARNING: drivers/video/built-in.o(.devinit.text+0x4cc): Section mismatch in reference from the function acornfb_probe() to the (unknown reference) .init.data:(unknown)
The function __devinit acornfb_probe() references
a (unknown reference) __initdata (unknown).
If (unknown) is only used by acornfb_probe then
annotate (unknown) with a matching annotation.

Signed-off-by: Russell King

ARM: pxafb: Fix access to nonexistent member of pxafb_info

2011-04-12T15:07:42+00:00

In case CONFIG_FB_PXA_OVERLAY is not defined, the pxafb_freq_transition()
function tests nonexistent member of pxafb_info (since the member is not
part of the structure).

Fix this by wraping the test in ifdef, even if I don't really like how the code
looks now. The check doesn't have to happen if overlays are disabled at all as
the check is always true then.

Signed-off-by: Marek Vasut 
Acked-by: Vasily Khoruzhick 
Signed-off-by: Eric Miao

Merge branch 'fbdev-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/lethal/fbdev-2.6

2011-04-07T19:49:17+00:00

* 'fbdev-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/lethal/fbdev-2.6:
  efifb: Add override for 11" Macbook Air 3,1
  efifb: Support overriding fields FW tells us with the DMI data.
  fb: Reduce priority of resource conflict message
  savagefb: Remove obsolete else clause in savage_setup_i2c_bus
  savagefb: Set up I2C based on chip family instead of card id
  savagefb: Replace magic register address with define
  drivers/video/bfin-lq035q1-fb.c: introduce missing kfree
  video: s3c-fb: fix checkpatch errors and warning
  efifb: support AMD Radeon HD 6490
  s3fb: fix Virge/GX2
  fbcon: Remove unused 'display *p' variable from fb_flashcursor()
  fbdev: sh_mobile_lcdcfb: fix module lock acquisition
  fbdev: sh_mobile_lcdcfb: add blanking support
  viafb: initialize margins correct
  viafb: refresh rate bug collection
  sh: mach-ap325rxa: move backlight control code
  sh: mach-ecovec24: support for main lcd backlight

Merge branch 'for-linus2' of git://git.profusion.mobi/users/lucas/linux-2.6

2011-04-07T18:14:49+00:00

* 'for-linus2' of git://git.profusion.mobi/users/lucas/linux-2.6:
  Fix common misspellings