1. 30 Jun, 2009 1 commit
    • Krzysztof Helt's avatar
      fbdev: add mutex for fb_mmap locking · 537a1bf0
      Krzysztof Helt authored
      
      
      Add a mutex to avoid a circular locking problem between the mm layer
      semaphore and fbdev ioctl mutex through the fb_mmap() call.
      
      Also, add mutex to all places where smem_start and smem_len fields change
      so the mutex inside the fb_mmap() is actually used.  Changing of these
      fields before calling the framebuffer_register() are not mutexed.
      
      This is 2.6.31 material.  It removes one lockdep (fb_mmap() and
      register_framebuffer()) but there is still another one (fb_release() and
      register_framebuffer()).  It also cleans up handling of the smem_start and
      smem_len fields used by mutexed section of the fb_mmap().
      Signed-off-by: default avatarKrzysztof Helt <krzysztof.h1@wp.pl>
      Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
      Cc: "Rafael J. Wysocki" <rjw@sisk.pl>
      Cc: <stable@kernel.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      537a1bf0
  2. 16 Jun, 2009 1 commit
    • Dave Airlie's avatar
      fbdev: add support for handoff from firmware to hw framebuffers · 4410f391
      Dave Airlie authored
      
      
      With KMS we have ran into an issue where we really want the KMS fb driver
      to be the one running the console, so panics etc can be shown by switching
      out of X etc.
      
      However with vesafb/efifb built-in, we end up with those on fb0 and the
      KMS fb driver on fb1, driving the same piece of hw, so this adds an fb
      info flag to denote a firmware fbdev, and adds a new aperture base/size
      range which can be compared when the hw drivers are installed to see if
      there is a conflict with a firmware driver, and if there is the firmware
      driver is unregistered and the hw driver takes over.
      
      It uses new aperture_base/size members instead of comparing on the fix
      smem_start/length, as smem_start/length might for example only cover the
      first 1MB of the PCI aperture, and we could allocate the kms fb from 8MB
      into the aperture, thus they would never overlap.
      
      [akpm@linux-foundation.org: coding-style fixes]
      Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
      Acked-by: default avatarPeter Jones <pjones@redhat.com>
      Cc: Geert Uytterhoeven <geert@linux-m68k.org>
      Cc: Krzysztof Helt <krzysztof.h1@poczta.fm>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      4410f391
  3. 13 Apr, 2009 1 commit
  4. 01 Apr, 2009 2 commits
  5. 05 Feb, 2009 1 commit
    • Andrea Righi's avatar
      fbmem: don't call copy_from/to_user() with mutex held · 1f5e31d7
      Andrea Righi authored
      
      
      Avoid calling copy_from/to_user() with fb_info->lock mutex held in fbmem
      ioctl().
      
      fb_mmap() is called under mm->mmap_sem (A) held, that also acquires
      fb_info->lock (B); fb_ioctl() takes fb_info->lock (B) and does
      copy_from/to_user() that might acquire mm->mmap_sem (A), causing a
      deadlock.
      
      NOTE: it doesn't push down the fb_info->lock in each own driver's
      fb_ioctl(), so there are still potential deadlocks elsewhere.
      Signed-off-by: default avatarAndrea Righi <righi.andrea@gmail.com>
      Cc: Dave Jones <davej@redhat.com>
      Cc: "Rafael J. Wysocki" <rjw@sisk.pl>
      Cc: Johannes Weiner <hannes@saeurebad.de>
      Cc: Krzysztof Helt <krzysztof.h1@wp.pl>
      Cc: Harvey Harrison <harvey.harrison@gmail.com>
      Cc: Stefan Richter <stefanr@s5r6.in-berlin.de>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      1f5e31d7
  6. 06 Jan, 2009 1 commit
  7. 19 Nov, 2008 1 commit
  8. 06 Nov, 2008 1 commit
    • Geert Uytterhoeven's avatar
      fbdev: fix fb_compat_ioctl() deadlocks · a684e7d3
      Geert Uytterhoeven authored
      commit 3e680aae ("fb: convert
      lock/unlock_kernel() into local fb mutex") introduced several deadlocks
      in the fb_compat_ioctl() path, as mutex_lock() doesn't allow recursion,
      unlike lock_kernel().  This broke frame buffer applications on 64-bit
      systems with a 32-bit userland.
      
      commit 120a3747 ("framebuffer compat_ioctl
      deadlock") fixed one of the deadlocks.
      
      This patch fixes the remaining deadlocks:
        - Revert commit 120a3747
      
      ,
        - Extract the core logic of fb_ioctl() into a new function do_fb_ioctl(),
        - Change all callsites of fb_ioctl() where info->lock is already held to
          call do_fb_ioctl() instead,
        - Add sparse annotations to all routines that take info->lock.
      Signed-off-by: default avatarGeert Uytterhoeven <Geert.Uytterhoeven@sonycom.com>
      Cc: Mikulas Patocka <mpatocka@redhat.com>
      Cc: Krzysztof Helt <krzysztof.h1@wp.pl>
      Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      a684e7d3
  9. 30 Oct, 2008 1 commit
  10. 20 Oct, 2008 2 commits
  11. 16 Oct, 2008 2 commits
  12. 23 Sep, 2008 1 commit
  13. 20 Aug, 2008 1 commit
    • Ian Campbell's avatar
      fbdefio: add set_page_dirty handler to deferred IO FB · d847471d
      Ian Campbell authored
      Fixes kernel BUG at lib/radix-tree.c:473.
      
      Previously the handler was incidentally provided by tmpfs but this was
      removed with:
      
        commit 14fcc23f
      
      
        Author: Hugh Dickins <hugh@veritas.com>
        Date:   Mon Jul 28 15:46:19 2008 -0700
      
          tmpfs: fix kernel BUG in shmem_delete_inode
      
      relying on this behaviour was incorrect in any case and the BUG also
      appeared when the device node was on an ext3 filesystem.
      
      v2: override a_ops at open() time rather than mmap() time to minimise
      races per AKPM's concerns.
      Signed-off-by: default avatarIan Campbell <ijc@hellion.org.uk>
      Cc: Jaya Kumar <jayakumar.lkml@gmail.com>
      Cc: Nick Piggin <npiggin@suse.de>
      Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
      Cc: Hugh Dickins <hugh@veritas.com>
      Cc: Johannes Weiner <hannes@saeurebad.de>
      Cc: Jeremy Fitzhardinge <jeremy@goop.org>
      Cc: Kel Modderman <kel@otaku42.de>
      Cc: Markus Armbruster <armbru@redhat.com>
      Cc: Krzysztof Helt <krzysztof.h1@poczta.fm>
      Cc: <stable@kernel.org> [14fcc23f
      
       is in 2.6.25.14 and 2.6.26.1]
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      d847471d
  14. 26 Jul, 2008 1 commit
  15. 24 Jul, 2008 2 commits
  16. 21 Jul, 2008 1 commit
  17. 20 Jun, 2008 1 commit
  18. 28 Apr, 2008 3 commits
  19. 15 Apr, 2008 1 commit
    • Alexey Dobriyan's avatar
      fbdev: fix /proc/fb oops after module removal · c43f89c2
      Alexey Dobriyan authored
      
      
      /proc/fb is not removed during rmmod.
      
      Steps to reproduce:
      
      	modprobe fb
      	rmmod fb
      	ls /proc
      
      BUG: unable to handle kernel paging request at ffffffffa0094370
      IP: [<ffffffff802b92a1>] proc_get_inode+0x101/0x130
      PGD 203067 PUD 207063 PMD 17e758067 PTE 0
      Oops: 0000 [1] SMP
      last sysfs file: /sys/devices/pci0000:00/0000:00:1e.0/0000:05:02.0/resource
      CPU 1
      Modules linked in: nf_conntrack_irc xt_state iptable_filter ipt_MASQUERADE iptable_nat nf_nat nf_conntrack_ipv4 nf_conntrack ip_tables x_tables vfat fat usbhid ehci_hcd uhci_hcd usbcore sr_mod cdrom [last unloaded: fb]
      Pid: 21205, comm: ls Not tainted 2.6.25-rc8-mm2 #14
      RIP: 0010:[<ffffffff802b92a1>]  [<ffffffff802b92a1>] proc_get_inode+0x101/0x130
      RSP: 0018:ffff81017c4bfc78  EFLAGS: 00010246
      RAX: 0000000000008000 RBX: ffff8101787f5470 RCX: 0000000048011ccc
      RDX: ffffffffa0094320 RSI: ffff810006ad43b0 RDI: ffff81017fc2cc00
      RBP: ffff81017e450300 R08: 0000000000000002 R09: ffff81017c5d1000
      R10: 0000000000000000 R11: 0000000000000246 R12: ffff81016b903a28
      R13: ffff81017f822020 R14: ffff81017c4bfd58 R15: ffff81017f822020
      FS:  00007f08e71696f0(0000) GS:ffff81017fc06480(0000) knlGS:0000000000000000
      CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
      CR2: ffffffffa0094370 CR3: 000000017e54a000 CR4: 00000000000006e0
      DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
      DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
      Process ls (pid: 21205, threadinfo ffff81017c4be000, task ffff81017de48770)
      Stack:  ffff81017c5d1000 00000000ffffffea ffff81017e450300 ffffffff802bdd1e
       ffff81017f802258 ffff81017c4bfe48 ffff81016b903a28 ffff81017f822020
       ffff81017c4bfd48 ffffffff802b9ba0 ffff81016b903a28 ffff81017f802258
      Call Trace:
       [<ffffffff802bdd1e>] ? proc_lookup_de+0x8e/0x100
       [<ffffffff802b9ba0>] ? proc_root_lookup+0x20/0x60
       [<ffffffff802882a7>] ? do_lookup+0x1b7/0x210
       [<ffffffff8028883d>] ? __link_path_walk+0x53d/0x7f0
       [<ffffffff80295eb8>] ? mntput_no_expire+0x28/0x130
       [<ffffffff80288b4a>] ? path_walk+0x5a/0xc0
       [<ffffffff80288dd3>] ? do_path_lookup+0x83/0x1c0
       [<ffffffff80287785>] ? getname+0xe5/0x210
       [<ffffffff80289adb>] ? __user_walk_fd+0x4b/0x80
       [<ffffffff8028236c>] ? vfs_lstat_fd+0x2c/0x70
       [<ffffffff8028bf1e>] ? filldir+0xae/0xf0
       [<ffffffff802b92e9>] ? de_put+0x9/0x50
       [<ffffffff8029633d>] ? mnt_want_write+0x2d/0x80
       [<ffffffff8029339f>] ? touch_atime+0x1f/0x170
       [<ffffffff802b9b1d>] ? proc_root_readdir+0x7d/0xa0
       [<ffffffff802825e7>] ? sys_newlstat+0x27/0x50
       [<ffffffff8028bffb>] ? vfs_readdir+0x9b/0xd0
       [<ffffffff8028c0fe>] ? sys_getdents+0xce/0xe0
       [<ffffffff8020b39b>] ? system_call_after_swapgs+0x7b/0x80
      
      Code: b7 83 b2 00 00 00 25 00 f0 00 00 3d 00 80 00 00 74 19 48 89 93 f0 00 00 00 48 89 df e8 39 9a fd ff 48 89 d8 48 83 c4 08 5b 5d c3 <48> 83 7a 50 00 48 c7 c0 60 16 45 80 48 c7 c2 40 17 45 80 48 0f
      RIP  [<ffffffff802b92a1>] proc_get_inode+0x101/0x130
       RSP <ffff81017c4bfc78>
      CR2: ffffffffa0094370
      ---[ end trace c71hiarjan8ab739 ]---
      Signed-off-by: default avatarAlexey Dobriyan <adobriyan@gmail.com>
      "Antonino A. Daplas" <adaplas@pol.net>
      Cc: <stable@kernel.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      c43f89c2
  20. 16 Oct, 2007 2 commits
  21. 31 Jul, 2007 1 commit
  22. 17 Jul, 2007 4 commits
  23. 09 May, 2007 1 commit
  24. 08 May, 2007 7 commits