<feed xmlns='http://www.w3.org/2005/Atom'>
<title>linux-toradex.git/drivers/gpu, branch v3.2.47</title>
<subtitle>Linux kernel for Apalis and Colibri modules</subtitle>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/'/>
<entry>
<title>drm/i915: prefer VBT modes for SVDO-LVDS over EDID</title>
<updated>2013-06-19T01:16:58+00:00</updated>
<author>
<name>Daniel Vetter</name>
<email>daniel.vetter@ffwll.ch</email>
</author>
<published>2013-06-10T07:47:58+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=8548c6942cbce6a38d3dd9e218e043dd1e1941d0'/>
<id>8548c6942cbce6a38d3dd9e218e043dd1e1941d0</id>
<content type='text'>
commit c3456fb3e4712d0448592af3c5d644c9472cd3c1 upstream.

In

commit 53d3b4d7778daf15900867336c85d3f8dd70600c
Author: Egbert Eich &lt;eich@suse.de&gt;
Date:   Tue Jun 4 17:13:21 2013 +0200

    drm/i915/sdvo: Use &amp;intel_sdvo-&gt;ddc instead of intel_sdvo-&gt;i2c for DDC

Egbert Eich fixed a long-standing bug where we simply used a
non-working i2c controller to read the EDID for SDVO-LVDS panels.
Unfortunately some machines seem to not be able to cope with the mode
provided in the EDID. Specifically they seem to not be able to cope
with a 4x pixel mutliplier instead of a 2x one, which seems to have
been worked around by slightly changing the panels native mode in the
VBT so that the dotclock is just barely above 50MHz.

Since it took forever to notice the breakage it's fairly safe to
assume that at least for SDVO-LVDS panels the VBT contains fairly sane
data. So just switch around the order and use VBT modes first.

v2: Also add EDID modes just in case, and spell Egbert correctly.

v3: Elaborate a bit more about what's going on on Chris' machine.

Cc: Egbert Eich &lt;eich@suse.de&gt;
Cc: Chris Wilson &lt;chris@chris-wilson.co.uk&gt;
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=65524
Reported-and-tested-by: Chris Wilson &lt;chris@chris-wilson.co.uk&gt;
Signed-off-by: Daniel Vetter &lt;daniel.vetter@ffwll.ch&gt;
Signed-off-by: Ben Hutchings &lt;ben@decadent.org.uk&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit c3456fb3e4712d0448592af3c5d644c9472cd3c1 upstream.

In

commit 53d3b4d7778daf15900867336c85d3f8dd70600c
Author: Egbert Eich &lt;eich@suse.de&gt;
Date:   Tue Jun 4 17:13:21 2013 +0200

    drm/i915/sdvo: Use &amp;intel_sdvo-&gt;ddc instead of intel_sdvo-&gt;i2c for DDC

Egbert Eich fixed a long-standing bug where we simply used a
non-working i2c controller to read the EDID for SDVO-LVDS panels.
Unfortunately some machines seem to not be able to cope with the mode
provided in the EDID. Specifically they seem to not be able to cope
with a 4x pixel mutliplier instead of a 2x one, which seems to have
been worked around by slightly changing the panels native mode in the
VBT so that the dotclock is just barely above 50MHz.

Since it took forever to notice the breakage it's fairly safe to
assume that at least for SDVO-LVDS panels the VBT contains fairly sane
data. So just switch around the order and use VBT modes first.

v2: Also add EDID modes just in case, and spell Egbert correctly.

v3: Elaborate a bit more about what's going on on Chris' machine.

Cc: Egbert Eich &lt;eich@suse.de&gt;
Cc: Chris Wilson &lt;chris@chris-wilson.co.uk&gt;
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=65524
Reported-and-tested-by: Chris Wilson &lt;chris@chris-wilson.co.uk&gt;
Signed-off-by: Daniel Vetter &lt;daniel.vetter@ffwll.ch&gt;
Signed-off-by: Ben Hutchings &lt;ben@decadent.org.uk&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>drm/i915/sdvo: Use &amp;intel_sdvo-&gt;ddc instead of intel_sdvo-&gt;i2c for DDC.</title>
<updated>2013-06-19T01:16:54+00:00</updated>
<author>
<name>Egbert Eich</name>
<email>eich@suse.de</email>
</author>
<published>2013-06-04T15:13:21+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=94dbc341c33589c6cb3c2e60414250c9e1535968'/>
<id>94dbc341c33589c6cb3c2e60414250c9e1535968</id>
<content type='text'>
commit 53d3b4d7778daf15900867336c85d3f8dd70600c upstream.

In intel_sdvo_get_lvds_modes() the wrong i2c adapter record is used
for DDC. Thus the code will always have to rely on a LVDS panel
mode supplied by VBT.
In most cases this succeeds, so this didn't get detected for quite
a while.

This regression seems to have been introduced in

commit f899fc64cda8569d0529452aafc0da31c042df2e
Author: Chris Wilson &lt;chris@chris-wilson.co.uk&gt;
Date:   Tue Jul 20 15:44:45 2010 -0700

    drm/i915: use GMBUS to manage i2c links

Signed-off-by: Egbert Eich &lt;eich@suse.de&gt;
Reviewed-by: Chris Wilson &lt;chris@chris-wilson.co.uk&gt;
[danvet: Add note about which commit likely introduced this issue.]
Signed-off-by: Daniel Vetter &lt;daniel.vetter@ffwll.ch&gt;
Signed-off-by: Ben Hutchings &lt;ben@decadent.org.uk&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 53d3b4d7778daf15900867336c85d3f8dd70600c upstream.

In intel_sdvo_get_lvds_modes() the wrong i2c adapter record is used
for DDC. Thus the code will always have to rely on a LVDS panel
mode supplied by VBT.
In most cases this succeeds, so this didn't get detected for quite
a while.

This regression seems to have been introduced in

commit f899fc64cda8569d0529452aafc0da31c042df2e
Author: Chris Wilson &lt;chris@chris-wilson.co.uk&gt;
Date:   Tue Jul 20 15:44:45 2010 -0700

    drm/i915: use GMBUS to manage i2c links

Signed-off-by: Egbert Eich &lt;eich@suse.de&gt;
Reviewed-by: Chris Wilson &lt;chris@chris-wilson.co.uk&gt;
[danvet: Add note about which commit likely introduced this issue.]
Signed-off-by: Daniel Vetter &lt;daniel.vetter@ffwll.ch&gt;
Signed-off-by: Ben Hutchings &lt;ben@decadent.org.uk&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>radeon: Fix system hang issue when using KMS with older cards</title>
<updated>2013-06-19T01:16:53+00:00</updated>
<author>
<name>Adis Hamzić</name>
<email>adis@hamzadis.com</email>
</author>
<published>2013-06-02T14:47:54+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=62f5e8156da4e5373a10c7c1d15a4327283f64f2'/>
<id>62f5e8156da4e5373a10c7c1d15a4327283f64f2</id>
<content type='text'>
commit e49f3959a96dc279860af7e86e6dbcfda50580a5 upstream.

The current radeon driver initialization routines, when using KMS, are written
so that the IRQ installation routine is called before initializing the WB buffer
and the CP rings. With some ASICs, though, the IRQ routine tries to access the
GFX_INDEX ring causing a call to RREG32 with the value of -1 in
radeon_fence_read. This, in turn causes the system to completely hang with some
cards, requiring a hard reset.

A call stack that can cause such a hang looks like this (using rv515 ASIC for the
example here):
 * rv515_init (rv515.c)
 * radeon_irq_kms_init (radeon_irq_kms.c)
 * drm_irq_install (drm_irq.c)
 * radeon_driver_irq_preinstall_kms (radeon_irq_kms.c)
 * rs600_irq_process (rs600.c)
 * radeon_fence_process - due to SW interrupt (radeon_fence.c)
 * radeon_fence_read (radeon_fence.c)
 * hang due to RREG32(-1)

The patch moves the IRQ installation to the card startup routine, after the ring
has been initialized, but before the IRQ has been set. This fixes the issue, but
requires a check to see if the IRQ is already installed, as is the case in the
system resume codepath.
I have tested the patch on three machines using the rv515, the rv770 and the
evergreen ASIC. They worked without issues.

This seems to be a known issue and has been reported on several bug tracking
sites by various distributions (see links below). Most of reports recommend
booting the system with KMS disabled and then enabling KMS by reloading the
radeon module. For some reason, this was indeed a usable workaround, however,
UMS is now deprecated and disabled by default.

Bug reports:
https://bugzilla.redhat.com/show_bug.cgi?id=845745
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/561789
https://bbs.archlinux.org/viewtopic.php?id=156964

Signed-off-by: Adis Hamzić &lt;adis@hamzadis.com&gt;
Signed-off-by: Alex Deucher &lt;alexander.deucher@amd.com&gt;
[bwh: Backported to 3.2:
 - Adjust context
 - Drop changes for Southern Islands]
Signed-off-by: Ben Hutchings &lt;ben@decadent.org.uk&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit e49f3959a96dc279860af7e86e6dbcfda50580a5 upstream.

The current radeon driver initialization routines, when using KMS, are written
so that the IRQ installation routine is called before initializing the WB buffer
and the CP rings. With some ASICs, though, the IRQ routine tries to access the
GFX_INDEX ring causing a call to RREG32 with the value of -1 in
radeon_fence_read. This, in turn causes the system to completely hang with some
cards, requiring a hard reset.

A call stack that can cause such a hang looks like this (using rv515 ASIC for the
example here):
 * rv515_init (rv515.c)
 * radeon_irq_kms_init (radeon_irq_kms.c)
 * drm_irq_install (drm_irq.c)
 * radeon_driver_irq_preinstall_kms (radeon_irq_kms.c)
 * rs600_irq_process (rs600.c)
 * radeon_fence_process - due to SW interrupt (radeon_fence.c)
 * radeon_fence_read (radeon_fence.c)
 * hang due to RREG32(-1)

The patch moves the IRQ installation to the card startup routine, after the ring
has been initialized, but before the IRQ has been set. This fixes the issue, but
requires a check to see if the IRQ is already installed, as is the case in the
system resume codepath.
I have tested the patch on three machines using the rv515, the rv770 and the
evergreen ASIC. They worked without issues.

This seems to be a known issue and has been reported on several bug tracking
sites by various distributions (see links below). Most of reports recommend
booting the system with KMS disabled and then enabling KMS by reloading the
radeon module. For some reason, this was indeed a usable workaround, however,
UMS is now deprecated and disabled by default.

Bug reports:
https://bugzilla.redhat.com/show_bug.cgi?id=845745
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/561789
https://bbs.archlinux.org/viewtopic.php?id=156964

Signed-off-by: Adis Hamzić &lt;adis@hamzadis.com&gt;
Signed-off-by: Alex Deucher &lt;alexander.deucher@amd.com&gt;
[bwh: Backported to 3.2:
 - Adjust context
 - Drop changes for Southern Islands]
Signed-off-by: Ben Hutchings &lt;ben@decadent.org.uk&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>drm/i915: no lvds quirk for hp t5740</title>
<updated>2013-06-19T01:16:53+00:00</updated>
<author>
<name>Ben Mesman</name>
<email>ben@bnc.nl</email>
</author>
<published>2013-04-16T18:00:28+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=a95372a5c25fcc392422ae00e54ec8a557624de7'/>
<id>a95372a5c25fcc392422ae00e54ec8a557624de7</id>
<content type='text'>
commit 45a211d75137b1ac869a8a758a6667f15827a115 upstream.

Last year, a patch was made for the "HP t5740e Thin Client" (see
http://lists.freedesktop.org/archives/dri-devel/2012-May/023245.html).
This device reports an lvds panel, but does not really have one.

The predecessor of this device is the "hp t5740", which also does not have
an lvds panel. This patch will add the same quirk for this device.

Signed-off-by: Ben Mesman &lt;ben@bnc.nl&gt;
Signed-off-by: Daniel Vetter &lt;daniel.vetter@ffwll.ch&gt;
Signed-off-by: Ben Hutchings &lt;ben@decadent.org.uk&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 45a211d75137b1ac869a8a758a6667f15827a115 upstream.

Last year, a patch was made for the "HP t5740e Thin Client" (see
http://lists.freedesktop.org/archives/dri-devel/2012-May/023245.html).
This device reports an lvds panel, but does not really have one.

The predecessor of this device is the "hp t5740", which also does not have
an lvds panel. This patch will add the same quirk for this device.

Signed-off-by: Ben Mesman &lt;ben@bnc.nl&gt;
Signed-off-by: Daniel Vetter &lt;daniel.vetter@ffwll.ch&gt;
Signed-off-by: Ben Hutchings &lt;ben@decadent.org.uk&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>drm: fix a use-after-free when GPU acceleration disabled</title>
<updated>2013-06-19T01:16:53+00:00</updated>
<author>
<name>Huacai Chen</name>
<email>chenhc@lemote.com</email>
</author>
<published>2013-05-21T06:23:43+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=8766964c1daea3b743f8e3c12c331b528ade278c'/>
<id>8766964c1daea3b743f8e3c12c331b528ade278c</id>
<content type='text'>
commit b7ea85a4fed37835eec78a7be3039c8dc22b8178 upstream.

When GPU acceleration is disabled, drm_vblank_cleanup() will free the
vblank-related data, such as vblank_refcount, vblank_inmodeset, etc.
But we found that drm_vblank_post_modeset() may be called after the
cleanup, which use vblank_refcount and vblank_inmodeset. And this will
cause a kernel panic.

Fix this by return immediately if dev-&gt;num_crtcs is zero. This is the
same thing that drm_vblank_pre_modeset() does.

Call trace of a drm_vblank_post_modeset() after drm_vblank_cleanup():
[   62.628906] [&lt;ffffffff804868d0&gt;] drm_vblank_post_modeset+0x34/0xb4
[   62.628906] [&lt;ffffffff804c7008&gt;] atombios_crtc_dpms+0xb4/0x174
[   62.628906] [&lt;ffffffff804c70e0&gt;] atombios_crtc_commit+0x18/0x38
[   62.628906] [&lt;ffffffff8047f038&gt;] drm_crtc_helper_set_mode+0x304/0x3cc
[   62.628906] [&lt;ffffffff8047f92c&gt;] drm_crtc_helper_set_config+0x6d8/0x988
[   62.628906] [&lt;ffffffff8047dd40&gt;] drm_fb_helper_set_par+0x94/0x104
[   62.628906] [&lt;ffffffff80439d14&gt;] fbcon_init+0x424/0x57c
[   62.628906] [&lt;ffffffff8046a638&gt;] visual_init+0xb8/0x118
[   62.628906] [&lt;ffffffff8046b9f8&gt;] take_over_console+0x238/0x384
[   62.628906] [&lt;ffffffff80436df8&gt;] fbcon_takeover+0x7c/0xdc
[   62.628906] [&lt;ffffffff8024fa20&gt;] notifier_call_chain+0x44/0x94
[   62.628906] [&lt;ffffffff8024fcbc&gt;] __blocking_notifier_call_chain+0x48/0x68
[   62.628906] [&lt;ffffffff8042d990&gt;] register_framebuffer+0x228/0x260
[   62.628906] [&lt;ffffffff8047e010&gt;] drm_fb_helper_single_fb_probe+0x260/0x314
[   62.628906] [&lt;ffffffff8047e2c4&gt;] drm_fb_helper_initial_config+0x200/0x234
[   62.628906] [&lt;ffffffff804e5560&gt;] radeon_fbdev_init+0xd4/0xf4
[   62.628906] [&lt;ffffffff804e0e08&gt;] radeon_modeset_init+0x9bc/0xa18
[   62.628906] [&lt;ffffffff804bfc14&gt;] radeon_driver_load_kms+0xdc/0x12c
[   62.628906] [&lt;ffffffff8048b548&gt;] drm_get_pci_dev+0x148/0x238
[   62.628906] [&lt;ffffffff80423564&gt;] local_pci_probe+0x5c/0xd0
[   62.628906] [&lt;ffffffff80241ac4&gt;] work_for_cpu_fn+0x1c/0x30
[   62.628906] [&lt;ffffffff802427c8&gt;] process_one_work+0x274/0x3bc
[   62.628906] [&lt;ffffffff80242934&gt;] process_scheduled_works+0x24/0x44
[   62.628906] [&lt;ffffffff8024515c&gt;] worker_thread+0x31c/0x3f4
[   62.628906] [&lt;ffffffff802497a8&gt;] kthread+0x88/0x90
[   62.628906] [&lt;ffffffff80206794&gt;] kernel_thread_helper+0x10/0x18

Signed-off-by: Huacai Chen &lt;chenhc@lemote.com&gt;
Signed-off-by: Binbin Zhou &lt;zhoubb@lemote.com&gt;
Reviewed-by: Michel Dänzer &lt;michel.daenzer@amd.com&gt;
Acked-by: Paul Menzel &lt;paulepanter@users.sourceforge.net&gt;
Signed-off-by: Dave Airlie &lt;airlied@gmail.com&gt;
Signed-off-by: Ben Hutchings &lt;ben@decadent.org.uk&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit b7ea85a4fed37835eec78a7be3039c8dc22b8178 upstream.

When GPU acceleration is disabled, drm_vblank_cleanup() will free the
vblank-related data, such as vblank_refcount, vblank_inmodeset, etc.
But we found that drm_vblank_post_modeset() may be called after the
cleanup, which use vblank_refcount and vblank_inmodeset. And this will
cause a kernel panic.

Fix this by return immediately if dev-&gt;num_crtcs is zero. This is the
same thing that drm_vblank_pre_modeset() does.

Call trace of a drm_vblank_post_modeset() after drm_vblank_cleanup():
[   62.628906] [&lt;ffffffff804868d0&gt;] drm_vblank_post_modeset+0x34/0xb4
[   62.628906] [&lt;ffffffff804c7008&gt;] atombios_crtc_dpms+0xb4/0x174
[   62.628906] [&lt;ffffffff804c70e0&gt;] atombios_crtc_commit+0x18/0x38
[   62.628906] [&lt;ffffffff8047f038&gt;] drm_crtc_helper_set_mode+0x304/0x3cc
[   62.628906] [&lt;ffffffff8047f92c&gt;] drm_crtc_helper_set_config+0x6d8/0x988
[   62.628906] [&lt;ffffffff8047dd40&gt;] drm_fb_helper_set_par+0x94/0x104
[   62.628906] [&lt;ffffffff80439d14&gt;] fbcon_init+0x424/0x57c
[   62.628906] [&lt;ffffffff8046a638&gt;] visual_init+0xb8/0x118
[   62.628906] [&lt;ffffffff8046b9f8&gt;] take_over_console+0x238/0x384
[   62.628906] [&lt;ffffffff80436df8&gt;] fbcon_takeover+0x7c/0xdc
[   62.628906] [&lt;ffffffff8024fa20&gt;] notifier_call_chain+0x44/0x94
[   62.628906] [&lt;ffffffff8024fcbc&gt;] __blocking_notifier_call_chain+0x48/0x68
[   62.628906] [&lt;ffffffff8042d990&gt;] register_framebuffer+0x228/0x260
[   62.628906] [&lt;ffffffff8047e010&gt;] drm_fb_helper_single_fb_probe+0x260/0x314
[   62.628906] [&lt;ffffffff8047e2c4&gt;] drm_fb_helper_initial_config+0x200/0x234
[   62.628906] [&lt;ffffffff804e5560&gt;] radeon_fbdev_init+0xd4/0xf4
[   62.628906] [&lt;ffffffff804e0e08&gt;] radeon_modeset_init+0x9bc/0xa18
[   62.628906] [&lt;ffffffff804bfc14&gt;] radeon_driver_load_kms+0xdc/0x12c
[   62.628906] [&lt;ffffffff8048b548&gt;] drm_get_pci_dev+0x148/0x238
[   62.628906] [&lt;ffffffff80423564&gt;] local_pci_probe+0x5c/0xd0
[   62.628906] [&lt;ffffffff80241ac4&gt;] work_for_cpu_fn+0x1c/0x30
[   62.628906] [&lt;ffffffff802427c8&gt;] process_one_work+0x274/0x3bc
[   62.628906] [&lt;ffffffff80242934&gt;] process_scheduled_works+0x24/0x44
[   62.628906] [&lt;ffffffff8024515c&gt;] worker_thread+0x31c/0x3f4
[   62.628906] [&lt;ffffffff802497a8&gt;] kthread+0x88/0x90
[   62.628906] [&lt;ffffffff80206794&gt;] kernel_thread_helper+0x10/0x18

Signed-off-by: Huacai Chen &lt;chenhc@lemote.com&gt;
Signed-off-by: Binbin Zhou &lt;zhoubb@lemote.com&gt;
Reviewed-by: Michel Dänzer &lt;michel.daenzer@amd.com&gt;
Acked-by: Paul Menzel &lt;paulepanter@users.sourceforge.net&gt;
Signed-off-by: Dave Airlie &lt;airlied@gmail.com&gt;
Signed-off-by: Ben Hutchings &lt;ben@decadent.org.uk&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>drm/radeon: fix card_posted check for newer asics</title>
<updated>2013-06-19T01:16:40+00:00</updated>
<author>
<name>Alex Deucher</name>
<email>alexander.deucher@amd.com</email>
</author>
<published>2013-05-22T15:22:51+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=e597b7c39df9cf5a66e740bc6a5cf10fa083dee8'/>
<id>e597b7c39df9cf5a66e740bc6a5cf10fa083dee8</id>
<content type='text'>
commit 09fb8bd1a63b0f9f15e655c4fe8d047e5d2bf67a upstream.

Newer asics have variable numbers of crtcs.  Use that
rather than the asic family to determine which crtcs
to check.  This avoids checking non-existent crtcs or
missing crtcs on certain asics.

Reviewed-by: Michel Dänzer &lt;michel.daenzer@amd.com&gt;
Signed-off-by: Alex Deucher &lt;alexander.deucher@amd.com&gt;
Signed-off-by: Ben Hutchings &lt;ben@decadent.org.uk&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 09fb8bd1a63b0f9f15e655c4fe8d047e5d2bf67a upstream.

Newer asics have variable numbers of crtcs.  Use that
rather than the asic family to determine which crtcs
to check.  This avoids checking non-existent crtcs or
missing crtcs on certain asics.

Reviewed-by: Michel Dänzer &lt;michel.daenzer@amd.com&gt;
Signed-off-by: Alex Deucher &lt;alexander.deucher@amd.com&gt;
Signed-off-by: Ben Hutchings &lt;ben@decadent.org.uk&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>drm/radeon: check incoming cliprects pointer</title>
<updated>2013-05-30T13:34:57+00:00</updated>
<author>
<name>Kees Cook</name>
<email>keescook@chromium.org</email>
</author>
<published>2013-05-13T05:00:51+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=05172d75318ab9c583895576acb24c62382f60fe'/>
<id>05172d75318ab9c583895576acb24c62382f60fe</id>
<content type='text'>
commit fefaedcfb82d2e57c2320acf60604ab03b750cc0 upstream.

The "boxes" parameter points into userspace memory. It should be verified
like any other operation against user memory.

Signed-off-by: Kees Cook &lt;keescook@chromium.org&gt;
Signed-off-by: Dave Airlie &lt;airlied@redhat.com&gt;
Signed-off-by: Ben Hutchings &lt;ben@decadent.org.uk&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit fefaedcfb82d2e57c2320acf60604ab03b750cc0 upstream.

The "boxes" parameter points into userspace memory. It should be verified
like any other operation against user memory.

Signed-off-by: Kees Cook &lt;keescook@chromium.org&gt;
Signed-off-by: Dave Airlie &lt;airlied@redhat.com&gt;
Signed-off-by: Ben Hutchings &lt;ben@decadent.org.uk&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>Revert "drm/i915: Fix detection of base of stolen memory"</title>
<updated>2013-05-30T13:34:48+00:00</updated>
<author>
<name>Ben Hutchings</name>
<email>ben@decadent.org.uk</email>
</author>
<published>2013-05-19T00:13:29+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=a331e84de8c7f69cf484fcc47713893668e2edeb'/>
<id>a331e84de8c7f69cf484fcc47713893668e2edeb</id>
<content type='text'>
This reverts commit 53e587aa5ca81497d0ea6e340320ec5778d1f311.
Yves-Alexis Perez reported that it broke the driver on two machines
with GMA4500 and i965 chips.  Only the backported version in 3.2.45
had this effect; the fix in mainline is fine.

Daniel Vetter stated that the fix is not needed in 3.2 anyway.

Reported-by: Yves-Alexis Perez &lt;corsac@debian.org&gt;
Signed-off-by: Ben Hutchings &lt;ben@decadent.org.uk&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
This reverts commit 53e587aa5ca81497d0ea6e340320ec5778d1f311.
Yves-Alexis Perez reported that it broke the driver on two machines
with GMA4500 and i965 chips.  Only the backported version in 3.2.45
had this effect; the fix in mainline is fine.

Daniel Vetter stated that the fix is not needed in 3.2 anyway.

Reported-by: Yves-Alexis Perez &lt;corsac@debian.org&gt;
Signed-off-by: Ben Hutchings &lt;ben@decadent.org.uk&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>drm/i915: Fix detection of base of stolen memory</title>
<updated>2013-05-13T14:02:43+00:00</updated>
<author>
<name>Chris Wilson</name>
<email>chris@chris-wilson.co.uk</email>
</author>
<published>2012-11-15T11:32:18+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=53e587aa5ca81497d0ea6e340320ec5778d1f311'/>
<id>53e587aa5ca81497d0ea6e340320ec5778d1f311</id>
<content type='text'>
commit e12a2d53ae45a69aea499b64f75e7222cca0f12f upstream.

The routine to query the base of stolen memory was using the wrong
registers and the wrong encodings on virtually every platform.

It was not until the G33 refresh, that a PCI config register was
introduced that explicitly said where the stolen memory was. Prior to
865G there was not even a register that said where the end of usable
low memory was and where the stolen memory began (or ended depending
upon chipset). Before then, one has to look at the BIOS memory maps to
find the Top of Memory. Alas that is not exported by arch/x86 and so we
have to resort to disabling stolen memory on gen2 for the time being.

Then SandyBridge enlarged the PCI register to a full 32-bits and change
the encoding of the address, so even though we happened to be querying
the right register, we read the wrong bits and ended up using address 0
for our stolen data, i.e. notably FBC.

Signed-off-by: Chris Wilson &lt;chris@chris-wilson.co.uk&gt;
Signed-off-by: Daniel Vetter &lt;daniel.vetter@ffwll.ch&gt;
[bwh: Backported to 3.2: adjust filename, context]
Signed-off-by: Ben Hutchings &lt;ben@decadent.org.uk&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit e12a2d53ae45a69aea499b64f75e7222cca0f12f upstream.

The routine to query the base of stolen memory was using the wrong
registers and the wrong encodings on virtually every platform.

It was not until the G33 refresh, that a PCI config register was
introduced that explicitly said where the stolen memory was. Prior to
865G there was not even a register that said where the end of usable
low memory was and where the stolen memory began (or ended depending
upon chipset). Before then, one has to look at the BIOS memory maps to
find the Top of Memory. Alas that is not exported by arch/x86 and so we
have to resort to disabling stolen memory on gen2 for the time being.

Then SandyBridge enlarged the PCI register to a full 32-bits and change
the encoding of the address, so even though we happened to be querying
the right register, we read the wrong bits and ended up using address 0
for our stolen data, i.e. notably FBC.

Signed-off-by: Chris Wilson &lt;chris@chris-wilson.co.uk&gt;
Signed-off-by: Daniel Vetter &lt;daniel.vetter@ffwll.ch&gt;
[bwh: Backported to 3.2: adjust filename, context]
Signed-off-by: Ben Hutchings &lt;ben@decadent.org.uk&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>drm/radeon: fix handling of v6 power tables</title>
<updated>2013-05-13T14:02:31+00:00</updated>
<author>
<name>Alex Deucher</name>
<email>alexander.deucher@amd.com</email>
</author>
<published>2013-05-01T18:34:54+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=268a8c92cb70b59d71e51c22c20f7aac45971391'/>
<id>268a8c92cb70b59d71e51c22c20f7aac45971391</id>
<content type='text'>
commit 441e76ca83ac604eaf0f046def96d8e3a27eea28 upstream.

The code was mis-handling variable sized arrays.

Reported-by: Sylvain BERTRAND &lt;sylware@legeek.net&gt;
Signed-off-by: Alex Deucher &lt;alexander.deucher@amd.com&gt;
Signed-off-by: Ben Hutchings &lt;ben@decadent.org.uk&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 441e76ca83ac604eaf0f046def96d8e3a27eea28 upstream.

The code was mis-handling variable sized arrays.

Reported-by: Sylvain BERTRAND &lt;sylware@legeek.net&gt;
Signed-off-by: Alex Deucher &lt;alexander.deucher@amd.com&gt;
Signed-off-by: Ben Hutchings &lt;ben@decadent.org.uk&gt;
</pre>
</div>
</content>
</entry>
</feed>
