--- /dev/null
+From b7ea85a4fed37835eec78a7be3039c8dc22b8178 Mon Sep 17 00:00:00 2001
+From: Huacai Chen <chenhc@lemote.com>
+Date: Tue, 21 May 2013 06:23:43 +0000
+Subject: drm: fix a use-after-free when GPU acceleration disabled
+
+From: Huacai Chen <chenhc@lemote.com>
+
+commit b7ea85a4fed37835eec78a7be3039c8dc22b8178 upstream.
+
+When GPU acceleration is disabled, drm_vblank_cleanup() will free the
+vblank-related data, such as vblank_refcount, vblank_inmodeset, etc.
+But we found that drm_vblank_post_modeset() may be called after the
+cleanup, which use vblank_refcount and vblank_inmodeset. And this will
+cause a kernel panic.
+
+Fix this by return immediately if dev->num_crtcs is zero. This is the
+same thing that drm_vblank_pre_modeset() does.
+
+Call trace of a drm_vblank_post_modeset() after drm_vblank_cleanup():
+[ 62.628906] [<ffffffff804868d0>] drm_vblank_post_modeset+0x34/0xb4
+[ 62.628906] [<ffffffff804c7008>] atombios_crtc_dpms+0xb4/0x174
+[ 62.628906] [<ffffffff804c70e0>] atombios_crtc_commit+0x18/0x38
+[ 62.628906] [<ffffffff8047f038>] drm_crtc_helper_set_mode+0x304/0x3cc
+[ 62.628906] [<ffffffff8047f92c>] drm_crtc_helper_set_config+0x6d8/0x988
+[ 62.628906] [<ffffffff8047dd40>] drm_fb_helper_set_par+0x94/0x104
+[ 62.628906] [<ffffffff80439d14>] fbcon_init+0x424/0x57c
+[ 62.628906] [<ffffffff8046a638>] visual_init+0xb8/0x118
+[ 62.628906] [<ffffffff8046b9f8>] take_over_console+0x238/0x384
+[ 62.628906] [<ffffffff80436df8>] fbcon_takeover+0x7c/0xdc
+[ 62.628906] [<ffffffff8024fa20>] notifier_call_chain+0x44/0x94
+[ 62.628906] [<ffffffff8024fcbc>] __blocking_notifier_call_chain+0x48/0x68
+[ 62.628906] [<ffffffff8042d990>] register_framebuffer+0x228/0x260
+[ 62.628906] [<ffffffff8047e010>] drm_fb_helper_single_fb_probe+0x260/0x314
+[ 62.628906] [<ffffffff8047e2c4>] drm_fb_helper_initial_config+0x200/0x234
+[ 62.628906] [<ffffffff804e5560>] radeon_fbdev_init+0xd4/0xf4
+[ 62.628906] [<ffffffff804e0e08>] radeon_modeset_init+0x9bc/0xa18
+[ 62.628906] [<ffffffff804bfc14>] radeon_driver_load_kms+0xdc/0x12c
+[ 62.628906] [<ffffffff8048b548>] drm_get_pci_dev+0x148/0x238
+[ 62.628906] [<ffffffff80423564>] local_pci_probe+0x5c/0xd0
+[ 62.628906] [<ffffffff80241ac4>] work_for_cpu_fn+0x1c/0x30
+[ 62.628906] [<ffffffff802427c8>] process_one_work+0x274/0x3bc
+[ 62.628906] [<ffffffff80242934>] process_scheduled_works+0x24/0x44
+[ 62.628906] [<ffffffff8024515c>] worker_thread+0x31c/0x3f4
+[ 62.628906] [<ffffffff802497a8>] kthread+0x88/0x90
+[ 62.628906] [<ffffffff80206794>] kernel_thread_helper+0x10/0x18
+
+Signed-off-by: Huacai Chen <chenhc@lemote.com>
+Signed-off-by: Binbin Zhou <zhoubb@lemote.com>
+Reviewed-by: Michel Dänzer <michel.daenzer@amd.com>
+Acked-by: Paul Menzel <paulepanter@users.sourceforge.net>
+Signed-off-by: Dave Airlie <airlied@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/drm_irq.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/drm_irq.c
++++ b/drivers/gpu/drm/drm_irq.c
+@@ -981,7 +981,7 @@ EXPORT_SYMBOL(drm_vblank_off);
+ */
+ void drm_vblank_pre_modeset(struct drm_device *dev, int crtc)
+ {
+- /* vblank is not initialized (IRQ not installed ?) */
++ /* vblank is not initialized (IRQ not installed ?), or has been freed */
+ if (!dev->num_crtcs)
+ return;
+ /*
+@@ -1003,6 +1003,10 @@ void drm_vblank_post_modeset(struct drm_
+ {
+ unsigned long irqflags;
+
++ /* vblank is not initialized (IRQ not installed ?), or has been freed */
++ if (!dev->num_crtcs)
++ return;
++
+ if (dev->vblank_inmodeset[crtc]) {
+ spin_lock_irqsave(&dev->vbl_lock, irqflags);
+ dev->vblank_disable_allowed = 1;
--- /dev/null
+From 45a211d75137b1ac869a8a758a6667f15827a115 Mon Sep 17 00:00:00 2001
+From: Ben Mesman <ben@bnc.nl>
+Date: Tue, 16 Apr 2013 20:00:28 +0200
+Subject: drm/i915: no lvds quirk for hp t5740
+
+From: Ben Mesman <ben@bnc.nl>
+
+commit 45a211d75137b1ac869a8a758a6667f15827a115 upstream.
+
+Last year, a patch was made for the "HP t5740e Thin Client" (see
+http://lists.freedesktop.org/archives/dri-devel/2012-May/023245.html).
+This device reports an lvds panel, but does not really have one.
+
+The predecessor of this device is the "hp t5740", which also does not have
+an lvds panel. This patch will add the same quirk for this device.
+
+Signed-off-by: Ben Mesman <ben@bnc.nl>
+Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/intel_lvds.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/i915/intel_lvds.c
++++ b/drivers/gpu/drm/i915/intel_lvds.c
+@@ -747,10 +747,10 @@ static const struct dmi_system_id intel_
+ },
+ {
+ .callback = intel_no_lvds_dmi_callback,
+- .ident = "Hewlett-Packard HP t5740e Thin Client",
++ .ident = "Hewlett-Packard HP t5740",
+ .matches = {
+ DMI_MATCH(DMI_BOARD_VENDOR, "Hewlett-Packard"),
+- DMI_MATCH(DMI_PRODUCT_NAME, "HP t5740e Thin Client"),
++ DMI_MATCH(DMI_PRODUCT_NAME, " t5740"),
+ },
+ },
+ {
--- /dev/null
+From 53d3b4d7778daf15900867336c85d3f8dd70600c Mon Sep 17 00:00:00 2001
+From: Egbert Eich <eich@suse.de>
+Date: Tue, 4 Jun 2013 17:13:21 +0200
+Subject: drm/i915/sdvo: Use &intel_sdvo->ddc instead of intel_sdvo->i2c for DDC.
+
+From: Egbert Eich <eich@suse.de>
+
+commit 53d3b4d7778daf15900867336c85d3f8dd70600c upstream.
+
+In intel_sdvo_get_lvds_modes() the wrong i2c adapter record is used
+for DDC. Thus the code will always have to rely on a LVDS panel
+mode supplied by VBT.
+In most cases this succeeds, so this didn't get detected for quite
+a while.
+
+This regression seems to have been introduced in
+
+commit f899fc64cda8569d0529452aafc0da31c042df2e
+Author: Chris Wilson <chris@chris-wilson.co.uk>
+Date: Tue Jul 20 15:44:45 2010 -0700
+
+ drm/i915: use GMBUS to manage i2c links
+
+Signed-off-by: Egbert Eich <eich@suse.de>
+Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
+[danvet: Add note about which commit likely introduced this issue.]
+Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/intel_sdvo.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/i915/intel_sdvo.c
++++ b/drivers/gpu/drm/i915/intel_sdvo.c
+@@ -1581,7 +1581,7 @@ static void intel_sdvo_get_lvds_modes(st
+ * Assume that the preferred modes are
+ * arranged in priority order.
+ */
+- intel_ddc_get_modes(connector, intel_sdvo->i2c);
++ intel_ddc_get_modes(connector, &intel_sdvo->ddc);
+ if (list_empty(&connector->probed_modes) == false)
+ goto end;
+
--- /dev/null
+From 591bfcfc334a003ba31c0deff03b22e73349939b Mon Sep 17 00:00:00 2001
+From: Guenter Roeck <linux@roeck-us.net>
+Date: Wed, 5 Jun 2013 14:09:30 -0700
+Subject: hwmon: (adm1021) Strengthen chip detection for ADM1021, LM84 and MAX1617
+
+From: Guenter Roeck <linux@roeck-us.net>
+
+commit 591bfcfc334a003ba31c0deff03b22e73349939b upstream.
+
+On a system with both MAX1617 and JC42 sensors, JC42 sensors can be misdetected
+as LM84. Strengthen detection sufficiently enough to avoid this misdetection.
+Also improve detection for ADM1021.
+
+Modeled after chip detection code in sensors-detect command.
+
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Tested-by: Jean Delvare <khali@linux-fr.org>
+Acked-by: Jean Delvare <khali@linux-fr.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hwmon/adm1021.c | 58 +++++++++++++++++++++++++++++++++++++++++-------
+ 1 file changed, 50 insertions(+), 8 deletions(-)
+
+--- a/drivers/hwmon/adm1021.c
++++ b/drivers/hwmon/adm1021.c
+@@ -332,26 +332,68 @@ static int adm1021_detect(struct i2c_cli
+ man_id = i2c_smbus_read_byte_data(client, ADM1021_REG_MAN_ID);
+ dev_id = i2c_smbus_read_byte_data(client, ADM1021_REG_DEV_ID);
+
++ if (man_id < 0 || dev_id < 0)
++ return -ENODEV;
++
+ if (man_id == 0x4d && dev_id == 0x01)
+ type_name = "max1617a";
+ else if (man_id == 0x41) {
+ if ((dev_id & 0xF0) == 0x30)
+ type_name = "adm1023";
+- else
++ else if ((dev_id & 0xF0) == 0x00)
+ type_name = "adm1021";
++ else
++ return -ENODEV;
+ } else if (man_id == 0x49)
+ type_name = "thmc10";
+ else if (man_id == 0x23)
+ type_name = "gl523sm";
+ else if (man_id == 0x54)
+ type_name = "mc1066";
+- /* LM84 Mfr ID in a different place, and it has more unused bits */
+- else if (conv_rate == 0x00
+- && (config & 0x7F) == 0x00
+- && (status & 0xAB) == 0x00)
+- type_name = "lm84";
+- else
+- type_name = "max1617";
++ else {
++ int lte, rte, lhi, rhi, llo, rlo;
++
++ /* extra checks for LM84 and MAX1617 to avoid misdetections */
++
++ llo = i2c_smbus_read_byte_data(client, ADM1021_REG_THYST_R(0));
++ rlo = i2c_smbus_read_byte_data(client, ADM1021_REG_THYST_R(1));
++
++ /* fail if any of the additional register reads failed */
++ if (llo < 0 || rlo < 0)
++ return -ENODEV;
++
++ lte = i2c_smbus_read_byte_data(client, ADM1021_REG_TEMP(0));
++ rte = i2c_smbus_read_byte_data(client, ADM1021_REG_TEMP(1));
++ lhi = i2c_smbus_read_byte_data(client, ADM1021_REG_TOS_R(0));
++ rhi = i2c_smbus_read_byte_data(client, ADM1021_REG_TOS_R(1));
++
++ /*
++ * Fail for negative temperatures and negative high limits.
++ * This check also catches read errors on the tested registers.
++ */
++ if ((s8)lte < 0 || (s8)rte < 0 || (s8)lhi < 0 || (s8)rhi < 0)
++ return -ENODEV;
++
++ /* fail if all registers hold the same value */
++ if (lte == rte && lte == lhi && lte == rhi && lte == llo
++ && lte == rlo)
++ return -ENODEV;
++
++ /*
++ * LM84 Mfr ID is in a different place,
++ * and it has more unused bits.
++ */
++ if (conv_rate == 0x00
++ && (config & 0x7F) == 0x00
++ && (status & 0xAB) == 0x00) {
++ type_name = "lm84";
++ } else {
++ /* fail if low limits are larger than high limits */
++ if ((s8)llo > lhi || (s8)rlo > rhi)
++ return -ENODEV;
++ type_name = "max1617";
++ }
++ }
+
+ pr_debug("adm1021: Detected chip %s at adapter %d, address 0x%02x.\n",
+ type_name, i2c_adapter_id(adapter), client->addr);
powerpc-eeh-don-t-check-rtas-token-to-get-pe-addr.patch
radeon-fix-system-hang-issue-when-using-kms-with-older-cards.patch
drm-radeon-don-t-allow-audio-on-dce6.patch
+hwmon-adm1021-strengthen-chip-detection-for-adm1021-lm84-and-max1617.patch
+drm-fix-a-use-after-free-when-gpu-acceleration-disabled.patch
+drm-i915-sdvo-use-intel_sdvo-ddc-instead-of-intel_sdvo-i2c-for-ddc.patch
+drm-i915-no-lvds-quirk-for-hp-t5740.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
