From: Greg Kroah-Hartman Date: Mon, 10 Jun 2013 18:16:04 +0000 (-0700) Subject: 3.4-stable patches X-Git-Tag: v3.0.82~8 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=21e66c7d6cee49f074cfa438e053e1eb6a918be2;p=thirdparty%2Fkernel%2Fstable-queue.git 3.4-stable patches added patches: drm-fix-a-use-after-free-when-gpu-acceleration-disabled.patch drm-i915-no-lvds-quirk-for-hp-t5740.patch drm-i915-sdvo-use-intel_sdvo-ddc-instead-of-intel_sdvo-i2c-for-ddc.patch hwmon-adm1021-strengthen-chip-detection-for-adm1021-lm84-and-max1617.patch --- diff --git a/queue-3.4/drm-fix-a-use-after-free-when-gpu-acceleration-disabled.patch b/queue-3.4/drm-fix-a-use-after-free-when-gpu-acceleration-disabled.patch new file mode 100644 index 00000000000..8146ae2e8fd --- /dev/null +++ b/queue-3.4/drm-fix-a-use-after-free-when-gpu-acceleration-disabled.patch @@ -0,0 +1,79 @@ +From b7ea85a4fed37835eec78a7be3039c8dc22b8178 Mon Sep 17 00:00:00 2001 +From: Huacai Chen +Date: Tue, 21 May 2013 06:23:43 +0000 +Subject: drm: fix a use-after-free when GPU acceleration disabled + +From: Huacai Chen + +commit b7ea85a4fed37835eec78a7be3039c8dc22b8178 upstream. + +When GPU acceleration is disabled, drm_vblank_cleanup() will free the +vblank-related data, such as vblank_refcount, vblank_inmodeset, etc. +But we found that drm_vblank_post_modeset() may be called after the +cleanup, which use vblank_refcount and vblank_inmodeset. And this will +cause a kernel panic. + +Fix this by return immediately if dev->num_crtcs is zero. This is the +same thing that drm_vblank_pre_modeset() does. + +Call trace of a drm_vblank_post_modeset() after drm_vblank_cleanup(): +[ 62.628906] [] drm_vblank_post_modeset+0x34/0xb4 +[ 62.628906] [] atombios_crtc_dpms+0xb4/0x174 +[ 62.628906] [] atombios_crtc_commit+0x18/0x38 +[ 62.628906] [] drm_crtc_helper_set_mode+0x304/0x3cc +[ 62.628906] [] drm_crtc_helper_set_config+0x6d8/0x988 +[ 62.628906] [] drm_fb_helper_set_par+0x94/0x104 +[ 62.628906] [] fbcon_init+0x424/0x57c +[ 62.628906] [] visual_init+0xb8/0x118 +[ 62.628906] [] take_over_console+0x238/0x384 +[ 62.628906] [] fbcon_takeover+0x7c/0xdc +[ 62.628906] [] notifier_call_chain+0x44/0x94 +[ 62.628906] [] __blocking_notifier_call_chain+0x48/0x68 +[ 62.628906] [] register_framebuffer+0x228/0x260 +[ 62.628906] [] drm_fb_helper_single_fb_probe+0x260/0x314 +[ 62.628906] [] drm_fb_helper_initial_config+0x200/0x234 +[ 62.628906] [] radeon_fbdev_init+0xd4/0xf4 +[ 62.628906] [] radeon_modeset_init+0x9bc/0xa18 +[ 62.628906] [] radeon_driver_load_kms+0xdc/0x12c +[ 62.628906] [] drm_get_pci_dev+0x148/0x238 +[ 62.628906] [] local_pci_probe+0x5c/0xd0 +[ 62.628906] [] work_for_cpu_fn+0x1c/0x30 +[ 62.628906] [] process_one_work+0x274/0x3bc +[ 62.628906] [] process_scheduled_works+0x24/0x44 +[ 62.628906] [] worker_thread+0x31c/0x3f4 +[ 62.628906] [] kthread+0x88/0x90 +[ 62.628906] [] kernel_thread_helper+0x10/0x18 + +Signed-off-by: Huacai Chen +Signed-off-by: Binbin Zhou +Reviewed-by: Michel Dänzer +Acked-by: Paul Menzel +Signed-off-by: Dave Airlie +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/drm_irq.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/drm_irq.c ++++ b/drivers/gpu/drm/drm_irq.c +@@ -981,7 +981,7 @@ EXPORT_SYMBOL(drm_vblank_off); + */ + void drm_vblank_pre_modeset(struct drm_device *dev, int crtc) + { +- /* vblank is not initialized (IRQ not installed ?) */ ++ /* vblank is not initialized (IRQ not installed ?), or has been freed */ + if (!dev->num_crtcs) + return; + /* +@@ -1003,6 +1003,10 @@ void drm_vblank_post_modeset(struct drm_ + { + unsigned long irqflags; + ++ /* vblank is not initialized (IRQ not installed ?), or has been freed */ ++ if (!dev->num_crtcs) ++ return; ++ + if (dev->vblank_inmodeset[crtc]) { + spin_lock_irqsave(&dev->vbl_lock, irqflags); + dev->vblank_disable_allowed = 1; diff --git a/queue-3.4/drm-i915-no-lvds-quirk-for-hp-t5740.patch b/queue-3.4/drm-i915-no-lvds-quirk-for-hp-t5740.patch new file mode 100644 index 00000000000..69b23217d93 --- /dev/null +++ b/queue-3.4/drm-i915-no-lvds-quirk-for-hp-t5740.patch @@ -0,0 +1,39 @@ +From 45a211d75137b1ac869a8a758a6667f15827a115 Mon Sep 17 00:00:00 2001 +From: Ben Mesman +Date: Tue, 16 Apr 2013 20:00:28 +0200 +Subject: drm/i915: no lvds quirk for hp t5740 + +From: Ben Mesman + +commit 45a211d75137b1ac869a8a758a6667f15827a115 upstream. + +Last year, a patch was made for the "HP t5740e Thin Client" (see +http://lists.freedesktop.org/archives/dri-devel/2012-May/023245.html). +This device reports an lvds panel, but does not really have one. + +The predecessor of this device is the "hp t5740", which also does not have +an lvds panel. This patch will add the same quirk for this device. + +Signed-off-by: Ben Mesman +Signed-off-by: Daniel Vetter +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/intel_lvds.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/i915/intel_lvds.c ++++ b/drivers/gpu/drm/i915/intel_lvds.c +@@ -747,10 +747,10 @@ static const struct dmi_system_id intel_ + }, + { + .callback = intel_no_lvds_dmi_callback, +- .ident = "Hewlett-Packard HP t5740e Thin Client", ++ .ident = "Hewlett-Packard HP t5740", + .matches = { + DMI_MATCH(DMI_BOARD_VENDOR, "Hewlett-Packard"), +- DMI_MATCH(DMI_PRODUCT_NAME, "HP t5740e Thin Client"), ++ DMI_MATCH(DMI_PRODUCT_NAME, " t5740"), + }, + }, + { diff --git a/queue-3.4/drm-i915-sdvo-use-intel_sdvo-ddc-instead-of-intel_sdvo-i2c-for-ddc.patch b/queue-3.4/drm-i915-sdvo-use-intel_sdvo-ddc-instead-of-intel_sdvo-i2c-for-ddc.patch new file mode 100644 index 00000000000..33b32808e15 --- /dev/null +++ b/queue-3.4/drm-i915-sdvo-use-intel_sdvo-ddc-instead-of-intel_sdvo-i2c-for-ddc.patch @@ -0,0 +1,44 @@ +From 53d3b4d7778daf15900867336c85d3f8dd70600c Mon Sep 17 00:00:00 2001 +From: Egbert Eich +Date: Tue, 4 Jun 2013 17:13:21 +0200 +Subject: drm/i915/sdvo: Use &intel_sdvo->ddc instead of intel_sdvo->i2c for DDC. + +From: Egbert Eich + +commit 53d3b4d7778daf15900867336c85d3f8dd70600c upstream. + +In intel_sdvo_get_lvds_modes() the wrong i2c adapter record is used +for DDC. Thus the code will always have to rely on a LVDS panel +mode supplied by VBT. +In most cases this succeeds, so this didn't get detected for quite +a while. + +This regression seems to have been introduced in + +commit f899fc64cda8569d0529452aafc0da31c042df2e +Author: Chris Wilson +Date: Tue Jul 20 15:44:45 2010 -0700 + + drm/i915: use GMBUS to manage i2c links + +Signed-off-by: Egbert Eich +Reviewed-by: Chris Wilson +[danvet: Add note about which commit likely introduced this issue.] +Signed-off-by: Daniel Vetter +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/intel_sdvo.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/i915/intel_sdvo.c ++++ b/drivers/gpu/drm/i915/intel_sdvo.c +@@ -1581,7 +1581,7 @@ static void intel_sdvo_get_lvds_modes(st + * Assume that the preferred modes are + * arranged in priority order. + */ +- intel_ddc_get_modes(connector, intel_sdvo->i2c); ++ intel_ddc_get_modes(connector, &intel_sdvo->ddc); + if (list_empty(&connector->probed_modes) == false) + goto end; + diff --git a/queue-3.4/hwmon-adm1021-strengthen-chip-detection-for-adm1021-lm84-and-max1617.patch b/queue-3.4/hwmon-adm1021-strengthen-chip-detection-for-adm1021-lm84-and-max1617.patch new file mode 100644 index 00000000000..423ed8de545 --- /dev/null +++ b/queue-3.4/hwmon-adm1021-strengthen-chip-detection-for-adm1021-lm84-and-max1617.patch @@ -0,0 +1,103 @@ +From 591bfcfc334a003ba31c0deff03b22e73349939b Mon Sep 17 00:00:00 2001 +From: Guenter Roeck +Date: Wed, 5 Jun 2013 14:09:30 -0700 +Subject: hwmon: (adm1021) Strengthen chip detection for ADM1021, LM84 and MAX1617 + +From: Guenter Roeck + +commit 591bfcfc334a003ba31c0deff03b22e73349939b upstream. + +On a system with both MAX1617 and JC42 sensors, JC42 sensors can be misdetected +as LM84. Strengthen detection sufficiently enough to avoid this misdetection. +Also improve detection for ADM1021. + +Modeled after chip detection code in sensors-detect command. + +Signed-off-by: Guenter Roeck +Tested-by: Jean Delvare +Acked-by: Jean Delvare +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwmon/adm1021.c | 58 +++++++++++++++++++++++++++++++++++++++++------- + 1 file changed, 50 insertions(+), 8 deletions(-) + +--- a/drivers/hwmon/adm1021.c ++++ b/drivers/hwmon/adm1021.c +@@ -332,26 +332,68 @@ static int adm1021_detect(struct i2c_cli + man_id = i2c_smbus_read_byte_data(client, ADM1021_REG_MAN_ID); + dev_id = i2c_smbus_read_byte_data(client, ADM1021_REG_DEV_ID); + ++ if (man_id < 0 || dev_id < 0) ++ return -ENODEV; ++ + if (man_id == 0x4d && dev_id == 0x01) + type_name = "max1617a"; + else if (man_id == 0x41) { + if ((dev_id & 0xF0) == 0x30) + type_name = "adm1023"; +- else ++ else if ((dev_id & 0xF0) == 0x00) + type_name = "adm1021"; ++ else ++ return -ENODEV; + } else if (man_id == 0x49) + type_name = "thmc10"; + else if (man_id == 0x23) + type_name = "gl523sm"; + else if (man_id == 0x54) + type_name = "mc1066"; +- /* LM84 Mfr ID in a different place, and it has more unused bits */ +- else if (conv_rate == 0x00 +- && (config & 0x7F) == 0x00 +- && (status & 0xAB) == 0x00) +- type_name = "lm84"; +- else +- type_name = "max1617"; ++ else { ++ int lte, rte, lhi, rhi, llo, rlo; ++ ++ /* extra checks for LM84 and MAX1617 to avoid misdetections */ ++ ++ llo = i2c_smbus_read_byte_data(client, ADM1021_REG_THYST_R(0)); ++ rlo = i2c_smbus_read_byte_data(client, ADM1021_REG_THYST_R(1)); ++ ++ /* fail if any of the additional register reads failed */ ++ if (llo < 0 || rlo < 0) ++ return -ENODEV; ++ ++ lte = i2c_smbus_read_byte_data(client, ADM1021_REG_TEMP(0)); ++ rte = i2c_smbus_read_byte_data(client, ADM1021_REG_TEMP(1)); ++ lhi = i2c_smbus_read_byte_data(client, ADM1021_REG_TOS_R(0)); ++ rhi = i2c_smbus_read_byte_data(client, ADM1021_REG_TOS_R(1)); ++ ++ /* ++ * Fail for negative temperatures and negative high limits. ++ * This check also catches read errors on the tested registers. ++ */ ++ if ((s8)lte < 0 || (s8)rte < 0 || (s8)lhi < 0 || (s8)rhi < 0) ++ return -ENODEV; ++ ++ /* fail if all registers hold the same value */ ++ if (lte == rte && lte == lhi && lte == rhi && lte == llo ++ && lte == rlo) ++ return -ENODEV; ++ ++ /* ++ * LM84 Mfr ID is in a different place, ++ * and it has more unused bits. ++ */ ++ if (conv_rate == 0x00 ++ && (config & 0x7F) == 0x00 ++ && (status & 0xAB) == 0x00) { ++ type_name = "lm84"; ++ } else { ++ /* fail if low limits are larger than high limits */ ++ if ((s8)llo > lhi || (s8)rlo > rhi) ++ return -ENODEV; ++ type_name = "max1617"; ++ } ++ } + + pr_debug("adm1021: Detected chip %s at adapter %d, address 0x%02x.\n", + type_name, i2c_adapter_id(adapter), client->addr); diff --git a/queue-3.4/series b/queue-3.4/series index 884ba461fa4..1f337f59040 100644 --- a/queue-3.4/series +++ b/queue-3.4/series @@ -21,3 +21,7 @@ acpi-video-ignore-bios-initial-backlight-value-for-hp-pavilion-g6.patch powerpc-eeh-don-t-check-rtas-token-to-get-pe-addr.patch radeon-fix-system-hang-issue-when-using-kms-with-older-cards.patch drm-radeon-don-t-allow-audio-on-dce6.patch +hwmon-adm1021-strengthen-chip-detection-for-adm1021-lm84-and-max1617.patch +drm-fix-a-use-after-free-when-gpu-acceleration-disabled.patch +drm-i915-sdvo-use-intel_sdvo-ddc-instead-of-intel_sdvo-i2c-for-ddc.patch +drm-i915-no-lvds-quirk-for-hp-t5740.patch