<feed xmlns='http://www.w3.org/2005/Atom'>
<title>linux-toradex.git/drivers/gpu, branch v3.4.49</title>
<subtitle>Linux kernel for Apalis and Colibri modules</subtitle>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/'/>
<entry>
<title>drm/gma500: Increase max resolution for mode setting</title>
<updated>2013-06-13T16:45:03+00:00</updated>
<author>
<name>Patrik Jakobsson</name>
<email>patrik.r.jakobsson@gmail.com</email>
</author>
<published>2013-04-25T20:23:36+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=ce840e2f7825bfd240782dc209c2f2b8db514287'/>
<id>ce840e2f7825bfd240782dc209c2f2b8db514287</id>
<content type='text'>
commit cbbd379aa43890f36da934f5af619d2fb8ec3d87 upstream.

By having a higher max resolution we can now set up a virtual
framebuffer that spans several monitors. 4096 should be ok since we're
gen 3 or higher and should be enough for most dual head setups.

Bugzilla:
https://bugs.launchpad.net/ubuntu/+source/xserver-xorg-video-modesetting/+bug/1169147
Signed-off-by: Patrik Jakobsson &lt;patrik.r.jakobsson@gmail.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit cbbd379aa43890f36da934f5af619d2fb8ec3d87 upstream.

By having a higher max resolution we can now set up a virtual
framebuffer that spans several monitors. 4096 should be ok since we're
gen 3 or higher and should be enough for most dual head setups.

Bugzilla:
https://bugs.launchpad.net/ubuntu/+source/xserver-xorg-video-modesetting/+bug/1169147
Signed-off-by: Patrik Jakobsson &lt;patrik.r.jakobsson@gmail.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>drm/i915: no lvds quirk for hp t5740</title>
<updated>2013-06-13T16:45:02+00:00</updated>
<author>
<name>Ben Mesman</name>
<email>ben@bnc.nl</email>
</author>
<published>2013-04-16T18:00:28+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=57e90e2cc1e073cd9a595c86d64717a07b6c85ee'/>
<id>57e90e2cc1e073cd9a595c86d64717a07b6c85ee</id>
<content type='text'>
commit 45a211d75137b1ac869a8a758a6667f15827a115 upstream.

Last year, a patch was made for the "HP t5740e Thin Client" (see
http://lists.freedesktop.org/archives/dri-devel/2012-May/023245.html).
This device reports an lvds panel, but does not really have one.

The predecessor of this device is the "hp t5740", which also does not have
an lvds panel. This patch will add the same quirk for this device.

Signed-off-by: Ben Mesman &lt;ben@bnc.nl&gt;
Signed-off-by: Daniel Vetter &lt;daniel.vetter@ffwll.ch&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 45a211d75137b1ac869a8a758a6667f15827a115 upstream.

Last year, a patch was made for the "HP t5740e Thin Client" (see
http://lists.freedesktop.org/archives/dri-devel/2012-May/023245.html).
This device reports an lvds panel, but does not really have one.

The predecessor of this device is the "hp t5740", which also does not have
an lvds panel. This patch will add the same quirk for this device.

Signed-off-by: Ben Mesman &lt;ben@bnc.nl&gt;
Signed-off-by: Daniel Vetter &lt;daniel.vetter@ffwll.ch&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>drm/i915/sdvo: Use &amp;intel_sdvo-&gt;ddc instead of intel_sdvo-&gt;i2c for DDC.</title>
<updated>2013-06-13T16:45:02+00:00</updated>
<author>
<name>Egbert Eich</name>
<email>eich@suse.de</email>
</author>
<published>2013-06-04T15:13:21+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=15360c3f303d9d12b36611b2721a68451e9f6424'/>
<id>15360c3f303d9d12b36611b2721a68451e9f6424</id>
<content type='text'>
commit 53d3b4d7778daf15900867336c85d3f8dd70600c upstream.

In intel_sdvo_get_lvds_modes() the wrong i2c adapter record is used
for DDC. Thus the code will always have to rely on a LVDS panel
mode supplied by VBT.
In most cases this succeeds, so this didn't get detected for quite
a while.

This regression seems to have been introduced in

commit f899fc64cda8569d0529452aafc0da31c042df2e
Author: Chris Wilson &lt;chris@chris-wilson.co.uk&gt;
Date:   Tue Jul 20 15:44:45 2010 -0700

    drm/i915: use GMBUS to manage i2c links

Signed-off-by: Egbert Eich &lt;eich@suse.de&gt;
Reviewed-by: Chris Wilson &lt;chris@chris-wilson.co.uk&gt;
[danvet: Add note about which commit likely introduced this issue.]
Signed-off-by: Daniel Vetter &lt;daniel.vetter@ffwll.ch&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 53d3b4d7778daf15900867336c85d3f8dd70600c upstream.

In intel_sdvo_get_lvds_modes() the wrong i2c adapter record is used
for DDC. Thus the code will always have to rely on a LVDS panel
mode supplied by VBT.
In most cases this succeeds, so this didn't get detected for quite
a while.

This regression seems to have been introduced in

commit f899fc64cda8569d0529452aafc0da31c042df2e
Author: Chris Wilson &lt;chris@chris-wilson.co.uk&gt;
Date:   Tue Jul 20 15:44:45 2010 -0700

    drm/i915: use GMBUS to manage i2c links

Signed-off-by: Egbert Eich &lt;eich@suse.de&gt;
Reviewed-by: Chris Wilson &lt;chris@chris-wilson.co.uk&gt;
[danvet: Add note about which commit likely introduced this issue.]
Signed-off-by: Daniel Vetter &lt;daniel.vetter@ffwll.ch&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>drm: fix a use-after-free when GPU acceleration disabled</title>
<updated>2013-06-13T16:45:02+00:00</updated>
<author>
<name>Huacai Chen</name>
<email>chenhc@lemote.com</email>
</author>
<published>2013-05-21T06:23:43+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=7cfaeaba14a0fd625d96ba35fda75c8eed60a368'/>
<id>7cfaeaba14a0fd625d96ba35fda75c8eed60a368</id>
<content type='text'>
commit b7ea85a4fed37835eec78a7be3039c8dc22b8178 upstream.

When GPU acceleration is disabled, drm_vblank_cleanup() will free the
vblank-related data, such as vblank_refcount, vblank_inmodeset, etc.
But we found that drm_vblank_post_modeset() may be called after the
cleanup, which use vblank_refcount and vblank_inmodeset. And this will
cause a kernel panic.

Fix this by return immediately if dev-&gt;num_crtcs is zero. This is the
same thing that drm_vblank_pre_modeset() does.

Call trace of a drm_vblank_post_modeset() after drm_vblank_cleanup():
[   62.628906] [&lt;ffffffff804868d0&gt;] drm_vblank_post_modeset+0x34/0xb4
[   62.628906] [&lt;ffffffff804c7008&gt;] atombios_crtc_dpms+0xb4/0x174
[   62.628906] [&lt;ffffffff804c70e0&gt;] atombios_crtc_commit+0x18/0x38
[   62.628906] [&lt;ffffffff8047f038&gt;] drm_crtc_helper_set_mode+0x304/0x3cc
[   62.628906] [&lt;ffffffff8047f92c&gt;] drm_crtc_helper_set_config+0x6d8/0x988
[   62.628906] [&lt;ffffffff8047dd40&gt;] drm_fb_helper_set_par+0x94/0x104
[   62.628906] [&lt;ffffffff80439d14&gt;] fbcon_init+0x424/0x57c
[   62.628906] [&lt;ffffffff8046a638&gt;] visual_init+0xb8/0x118
[   62.628906] [&lt;ffffffff8046b9f8&gt;] take_over_console+0x238/0x384
[   62.628906] [&lt;ffffffff80436df8&gt;] fbcon_takeover+0x7c/0xdc
[   62.628906] [&lt;ffffffff8024fa20&gt;] notifier_call_chain+0x44/0x94
[   62.628906] [&lt;ffffffff8024fcbc&gt;] __blocking_notifier_call_chain+0x48/0x68
[   62.628906] [&lt;ffffffff8042d990&gt;] register_framebuffer+0x228/0x260
[   62.628906] [&lt;ffffffff8047e010&gt;] drm_fb_helper_single_fb_probe+0x260/0x314
[   62.628906] [&lt;ffffffff8047e2c4&gt;] drm_fb_helper_initial_config+0x200/0x234
[   62.628906] [&lt;ffffffff804e5560&gt;] radeon_fbdev_init+0xd4/0xf4
[   62.628906] [&lt;ffffffff804e0e08&gt;] radeon_modeset_init+0x9bc/0xa18
[   62.628906] [&lt;ffffffff804bfc14&gt;] radeon_driver_load_kms+0xdc/0x12c
[   62.628906] [&lt;ffffffff8048b548&gt;] drm_get_pci_dev+0x148/0x238
[   62.628906] [&lt;ffffffff80423564&gt;] local_pci_probe+0x5c/0xd0
[   62.628906] [&lt;ffffffff80241ac4&gt;] work_for_cpu_fn+0x1c/0x30
[   62.628906] [&lt;ffffffff802427c8&gt;] process_one_work+0x274/0x3bc
[   62.628906] [&lt;ffffffff80242934&gt;] process_scheduled_works+0x24/0x44
[   62.628906] [&lt;ffffffff8024515c&gt;] worker_thread+0x31c/0x3f4
[   62.628906] [&lt;ffffffff802497a8&gt;] kthread+0x88/0x90
[   62.628906] [&lt;ffffffff80206794&gt;] kernel_thread_helper+0x10/0x18

Signed-off-by: Huacai Chen &lt;chenhc@lemote.com&gt;
Signed-off-by: Binbin Zhou &lt;zhoubb@lemote.com&gt;
Reviewed-by: Michel Dänzer &lt;michel.daenzer@amd.com&gt;
Acked-by: Paul Menzel &lt;paulepanter@users.sourceforge.net&gt;
Signed-off-by: Dave Airlie &lt;airlied@gmail.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit b7ea85a4fed37835eec78a7be3039c8dc22b8178 upstream.

When GPU acceleration is disabled, drm_vblank_cleanup() will free the
vblank-related data, such as vblank_refcount, vblank_inmodeset, etc.
But we found that drm_vblank_post_modeset() may be called after the
cleanup, which use vblank_refcount and vblank_inmodeset. And this will
cause a kernel panic.

Fix this by return immediately if dev-&gt;num_crtcs is zero. This is the
same thing that drm_vblank_pre_modeset() does.

Call trace of a drm_vblank_post_modeset() after drm_vblank_cleanup():
[   62.628906] [&lt;ffffffff804868d0&gt;] drm_vblank_post_modeset+0x34/0xb4
[   62.628906] [&lt;ffffffff804c7008&gt;] atombios_crtc_dpms+0xb4/0x174
[   62.628906] [&lt;ffffffff804c70e0&gt;] atombios_crtc_commit+0x18/0x38
[   62.628906] [&lt;ffffffff8047f038&gt;] drm_crtc_helper_set_mode+0x304/0x3cc
[   62.628906] [&lt;ffffffff8047f92c&gt;] drm_crtc_helper_set_config+0x6d8/0x988
[   62.628906] [&lt;ffffffff8047dd40&gt;] drm_fb_helper_set_par+0x94/0x104
[   62.628906] [&lt;ffffffff80439d14&gt;] fbcon_init+0x424/0x57c
[   62.628906] [&lt;ffffffff8046a638&gt;] visual_init+0xb8/0x118
[   62.628906] [&lt;ffffffff8046b9f8&gt;] take_over_console+0x238/0x384
[   62.628906] [&lt;ffffffff80436df8&gt;] fbcon_takeover+0x7c/0xdc
[   62.628906] [&lt;ffffffff8024fa20&gt;] notifier_call_chain+0x44/0x94
[   62.628906] [&lt;ffffffff8024fcbc&gt;] __blocking_notifier_call_chain+0x48/0x68
[   62.628906] [&lt;ffffffff8042d990&gt;] register_framebuffer+0x228/0x260
[   62.628906] [&lt;ffffffff8047e010&gt;] drm_fb_helper_single_fb_probe+0x260/0x314
[   62.628906] [&lt;ffffffff8047e2c4&gt;] drm_fb_helper_initial_config+0x200/0x234
[   62.628906] [&lt;ffffffff804e5560&gt;] radeon_fbdev_init+0xd4/0xf4
[   62.628906] [&lt;ffffffff804e0e08&gt;] radeon_modeset_init+0x9bc/0xa18
[   62.628906] [&lt;ffffffff804bfc14&gt;] radeon_driver_load_kms+0xdc/0x12c
[   62.628906] [&lt;ffffffff8048b548&gt;] drm_get_pci_dev+0x148/0x238
[   62.628906] [&lt;ffffffff80423564&gt;] local_pci_probe+0x5c/0xd0
[   62.628906] [&lt;ffffffff80241ac4&gt;] work_for_cpu_fn+0x1c/0x30
[   62.628906] [&lt;ffffffff802427c8&gt;] process_one_work+0x274/0x3bc
[   62.628906] [&lt;ffffffff80242934&gt;] process_scheduled_works+0x24/0x44
[   62.628906] [&lt;ffffffff8024515c&gt;] worker_thread+0x31c/0x3f4
[   62.628906] [&lt;ffffffff802497a8&gt;] kthread+0x88/0x90
[   62.628906] [&lt;ffffffff80206794&gt;] kernel_thread_helper+0x10/0x18

Signed-off-by: Huacai Chen &lt;chenhc@lemote.com&gt;
Signed-off-by: Binbin Zhou &lt;zhoubb@lemote.com&gt;
Reviewed-by: Michel Dänzer &lt;michel.daenzer@amd.com&gt;
Acked-by: Paul Menzel &lt;paulepanter@users.sourceforge.net&gt;
Signed-off-by: Dave Airlie &lt;airlied@gmail.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>drm/radeon: don't allow audio on DCE6</title>
<updated>2013-06-13T16:45:00+00:00</updated>
<author>
<name>Alex Deucher</name>
<email>alexander.deucher@amd.com</email>
</author>
<published>2013-06-03T14:32:40+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=36247d18978750da120dbded4d23c74bb9468549'/>
<id>36247d18978750da120dbded4d23c74bb9468549</id>
<content type='text'>
commit 1cbcca302a318499f20a512847c5d6a510c08c35 upstream.

It's not supported yet.  Fixes display issues when
users force it on.

Signed-off-by: Alex Deucher &lt;alexander.deucher@amd.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 1cbcca302a318499f20a512847c5d6a510c08c35 upstream.

It's not supported yet.  Fixes display issues when
users force it on.

Signed-off-by: Alex Deucher &lt;alexander.deucher@amd.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>radeon: Fix system hang issue when using KMS with older cards</title>
<updated>2013-06-13T16:45:00+00:00</updated>
<author>
<name>Adis Hamzić</name>
<email>adis@hamzadis.com</email>
</author>
<published>2013-06-02T14:47:54+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=f6321eec602f4eed6a78b0cbb91514d7c4cb74b7'/>
<id>f6321eec602f4eed6a78b0cbb91514d7c4cb74b7</id>
<content type='text'>
commit e49f3959a96dc279860af7e86e6dbcfda50580a5 upstream.

The current radeon driver initialization routines, when using KMS, are written
so that the IRQ installation routine is called before initializing the WB buffer
and the CP rings. With some ASICs, though, the IRQ routine tries to access the
GFX_INDEX ring causing a call to RREG32 with the value of -1 in
radeon_fence_read. This, in turn causes the system to completely hang with some
cards, requiring a hard reset.

A call stack that can cause such a hang looks like this (using rv515 ASIC for the
example here):
 * rv515_init (rv515.c)
 * radeon_irq_kms_init (radeon_irq_kms.c)
 * drm_irq_install (drm_irq.c)
 * radeon_driver_irq_preinstall_kms (radeon_irq_kms.c)
 * rs600_irq_process (rs600.c)
 * radeon_fence_process - due to SW interrupt (radeon_fence.c)
 * radeon_fence_read (radeon_fence.c)
 * hang due to RREG32(-1)

The patch moves the IRQ installation to the card startup routine, after the ring
has been initialized, but before the IRQ has been set. This fixes the issue, but
requires a check to see if the IRQ is already installed, as is the case in the
system resume codepath.
I have tested the patch on three machines using the rv515, the rv770 and the
evergreen ASIC. They worked without issues.

This seems to be a known issue and has been reported on several bug tracking
sites by various distributions (see links below). Most of reports recommend
booting the system with KMS disabled and then enabling KMS by reloading the
radeon module. For some reason, this was indeed a usable workaround, however,
UMS is now deprecated and disabled by default.

Bug reports:
https://bugzilla.redhat.com/show_bug.cgi?id=845745
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/561789
https://bbs.archlinux.org/viewtopic.php?id=156964

Signed-off-by: Adis Hamzić &lt;adis@hamzadis.com&gt;
Signed-off-by: Alex Deucher &lt;alexander.deucher@amd.com&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit e49f3959a96dc279860af7e86e6dbcfda50580a5 upstream.

The current radeon driver initialization routines, when using KMS, are written
so that the IRQ installation routine is called before initializing the WB buffer
and the CP rings. With some ASICs, though, the IRQ routine tries to access the
GFX_INDEX ring causing a call to RREG32 with the value of -1 in
radeon_fence_read. This, in turn causes the system to completely hang with some
cards, requiring a hard reset.

A call stack that can cause such a hang looks like this (using rv515 ASIC for the
example here):
 * rv515_init (rv515.c)
 * radeon_irq_kms_init (radeon_irq_kms.c)
 * drm_irq_install (drm_irq.c)
 * radeon_driver_irq_preinstall_kms (radeon_irq_kms.c)
 * rs600_irq_process (rs600.c)
 * radeon_fence_process - due to SW interrupt (radeon_fence.c)
 * radeon_fence_read (radeon_fence.c)
 * hang due to RREG32(-1)

The patch moves the IRQ installation to the card startup routine, after the ring
has been initialized, but before the IRQ has been set. This fixes the issue, but
requires a check to see if the IRQ is already installed, as is the case in the
system resume codepath.
I have tested the patch on three machines using the rv515, the rv770 and the
evergreen ASIC. They worked without issues.

This seems to be a known issue and has been reported on several bug tracking
sites by various distributions (see links below). Most of reports recommend
booting the system with KMS disabled and then enabling KMS by reloading the
radeon module. For some reason, this was indeed a usable workaround, however,
UMS is now deprecated and disabled by default.

Bug reports:
https://bugzilla.redhat.com/show_bug.cgi?id=845745
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/561789
https://bbs.archlinux.org/viewtopic.php?id=156964

Signed-off-by: Adis Hamzić &lt;adis@hamzadis.com&gt;
Signed-off-by: Alex Deucher &lt;alexander.deucher@amd.com&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>drm/radeon: fix card_posted check for newer asics</title>
<updated>2013-06-07T19:49:31+00:00</updated>
<author>
<name>Alex Deucher</name>
<email>alexander.deucher@amd.com</email>
</author>
<published>2013-05-22T15:22:51+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=a43adb2a09ec54181238bd00117585c3e6014f56'/>
<id>a43adb2a09ec54181238bd00117585c3e6014f56</id>
<content type='text'>
commit 09fb8bd1a63b0f9f15e655c4fe8d047e5d2bf67a upstream.

Newer asics have variable numbers of crtcs.  Use that
rather than the asic family to determine which crtcs
to check.  This avoids checking non-existent crtcs or
missing crtcs on certain asics.

Reviewed-by: Michel Dänzer &lt;michel.daenzer@amd.com&gt;
Signed-off-by: Alex Deucher &lt;alexander.deucher@amd.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 09fb8bd1a63b0f9f15e655c4fe8d047e5d2bf67a upstream.

Newer asics have variable numbers of crtcs.  Use that
rather than the asic family to determine which crtcs
to check.  This avoids checking non-existent crtcs or
missing crtcs on certain asics.

Reviewed-by: Michel Dänzer &lt;michel.daenzer@amd.com&gt;
Signed-off-by: Alex Deucher &lt;alexander.deucher@amd.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>drm/radeon: Fix VRAM size calculation for VRAM &gt;= 4GB</title>
<updated>2013-05-24T18:14:22+00:00</updated>
<author>
<name>Niels Ole Salscheider</name>
<email>niels_ole@salscheider-online.de</email>
</author>
<published>2013-05-18T19:19:23+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=a91ffa34d47309834074223796343ed208397085'/>
<id>a91ffa34d47309834074223796343ed208397085</id>
<content type='text'>
commit fc986034540102cd090237bf3f70262e1ae80d9c upstream.

Add ULL prefix to avoid overflow.

Signed-off-by: Niels Ole Salscheider &lt;niels_ole@salscheider-online.de&gt;
Signed-off-by: Alex Deucher &lt;alexander.deucher@amd.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit fc986034540102cd090237bf3f70262e1ae80d9c upstream.

Add ULL prefix to avoid overflow.

Signed-off-by: Niels Ole Salscheider &lt;niels_ole@salscheider-online.de&gt;
Signed-off-by: Alex Deucher &lt;alexander.deucher@amd.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>drm/radeon: check incoming cliprects pointer</title>
<updated>2013-05-19T17:54:50+00:00</updated>
<author>
<name>Kees Cook</name>
<email>keescook@chromium.org</email>
</author>
<published>2013-05-13T05:00:51+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=b58f2e1650eafddfdfcff2f4831bf2896f8c9bf6'/>
<id>b58f2e1650eafddfdfcff2f4831bf2896f8c9bf6</id>
<content type='text'>
commit fefaedcfb82d2e57c2320acf60604ab03b750cc0 upstream.

The "boxes" parameter points into userspace memory. It should be verified
like any other operation against user memory.

Signed-off-by: Kees Cook &lt;keescook@chromium.org&gt;
Signed-off-by: Dave Airlie &lt;airlied@redhat.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit fefaedcfb82d2e57c2320acf60604ab03b750cc0 upstream.

The "boxes" parameter points into userspace memory. It should be verified
like any other operation against user memory.

Signed-off-by: Kees Cook &lt;keescook@chromium.org&gt;
Signed-off-by: Dave Airlie &lt;airlied@redhat.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>drm/mm: fix dump table BUG</title>
<updated>2013-05-19T17:54:41+00:00</updated>
<author>
<name>Daniel Vetter</name>
<email>daniel.vetter@ffwll.ch</email>
</author>
<published>2013-04-20T10:08:11+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=25853a12e468fa75e82fca7208f03ad4c879f95f'/>
<id>25853a12e468fa75e82fca7208f03ad4c879f95f</id>
<content type='text'>
commit 3a359f0b21ab218c1bf7a6a1b638b6fd143d0b99 upstream.

In

commit 9e8944ab564f2e3dde90a518cd32048c58918608
Author: Chris Wilson &lt;chris@chris-wilson.co.uk&gt;
Date:   Thu Nov 15 11:32:17 2012 +0000

    drm: Introduce an iterator over holes in the drm_mm range manager

helpers and iterators for hole handling have been introduced with some
debug BUG_ONs sprinkled over. Unfortunately this broke the mm dumper
which unconditionally tried to compute the size of the very first
hole.

While at it unify the code a bit with the hole dumping in the loop.

v2: Extract a hole dump helper.

Reported-by: Christopher Harvey &lt;charvey@matrox.com&gt;
Cc: Christopher Harvey &lt;charvey@matrox.com&gt;
Cc: Dave Airlie &lt;airlied@redhat.com&gt;
Cc: Chris Wilson &lt;chris@chris-wilson.co.uk&gt;
Acked-by: Dave Airlie &lt;airlied@redhat.com&gt;
Signed-off-by: Daniel Vetter &lt;daniel.vetter@ffwll.ch&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 3a359f0b21ab218c1bf7a6a1b638b6fd143d0b99 upstream.

In

commit 9e8944ab564f2e3dde90a518cd32048c58918608
Author: Chris Wilson &lt;chris@chris-wilson.co.uk&gt;
Date:   Thu Nov 15 11:32:17 2012 +0000

    drm: Introduce an iterator over holes in the drm_mm range manager

helpers and iterators for hole handling have been introduced with some
debug BUG_ONs sprinkled over. Unfortunately this broke the mm dumper
which unconditionally tried to compute the size of the very first
hole.

While at it unify the code a bit with the hole dumping in the loop.

v2: Extract a hole dump helper.

Reported-by: Christopher Harvey &lt;charvey@matrox.com&gt;
Cc: Christopher Harvey &lt;charvey@matrox.com&gt;
Cc: Dave Airlie &lt;airlied@redhat.com&gt;
Cc: Chris Wilson &lt;chris@chris-wilson.co.uk&gt;
Acked-by: Dave Airlie &lt;airlied@redhat.com&gt;
Signed-off-by: Daniel Vetter &lt;daniel.vetter@ffwll.ch&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</pre>
</div>
</content>
</entry>
</feed>
