Merge branch 'fbdev-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/lethal/fbdev-3.x
* 'fbdev-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/lethal/fbdev-3.x:
video: Fix use-after-free by vga16fb on rmmod
video: Convert vmalloc/memset to vzalloc
efifb: Disallow manual bind and unbind
efifb: Fix mismatched request/release_mem_region
efifb: Enable write-combining
drivers/video/pxa168fb.c: add missing clk_put
drivers/video/imxfb.c: add missing clk_put
fbdev: bf537-lq035: add missing blacklight properties type
savagefb: Use panel CVT mode as default
fbdev: sh_mobile_lcdcfb: Fix up fallout from MERAM changes.
diff --git a/drivers/video/arcfb.c b/drivers/video/arcfb.c
index 3ec4923..c22e8d3 100644
--- a/drivers/video/arcfb.c
+++ b/drivers/video/arcfb.c
@@ -515,11 +515,10 @@
/* We need a flat backing store for the Arc's
less-flat actual paged framebuffer */
- if (!(videomemory = vmalloc(videomemorysize)))
+ videomemory = vzalloc(videomemorysize);
+ if (!videomemory)
return retval;
- memset(videomemory, 0, videomemorysize);
-
info = framebuffer_alloc(sizeof(struct arcfb_par), &dev->dev);
if (!info)
goto err;
diff --git a/drivers/video/bf537-lq035.c b/drivers/video/bf537-lq035.c
index 47c21fb..bea53c1 100644
--- a/drivers/video/bf537-lq035.c
+++ b/drivers/video/bf537-lq035.c
@@ -789,6 +789,7 @@
i2c_add_driver(&ad5280_driver);
memset(&props, 0, sizeof(props));
+ props.type = BACKLIGHT_RAW;
props.max_brightness = MAX_BRIGHENESS;
bl_dev = backlight_device_register("bf537-bl", NULL, NULL,
&bfin_lq035fb_bl_ops, &props);
diff --git a/drivers/video/broadsheetfb.c b/drivers/video/broadsheetfb.c
index ebda687..377dde3 100644
--- a/drivers/video/broadsheetfb.c
+++ b/drivers/video/broadsheetfb.c
@@ -1101,12 +1101,10 @@
videomemorysize = roundup((dpyw*dpyh), PAGE_SIZE);
- videomemory = vmalloc(videomemorysize);
+ videomemory = vzalloc(videomemorysize);
if (!videomemory)
goto err_fb_rel;
- memset(videomemory, 0, videomemorysize);
-
info->screen_base = (char *)videomemory;
info->fbops = &broadsheetfb_ops;
diff --git a/drivers/video/efifb.c b/drivers/video/efifb.c
index fb20584..69c49df 100644
--- a/drivers/video/efifb.c
+++ b/drivers/video/efifb.c
@@ -16,6 +16,8 @@
#include <linux/pci.h>
#include <video/vga.h>
+static bool request_mem_succeeded = false;
+
static struct fb_var_screeninfo efifb_defined __devinitdata = {
.activate = FB_ACTIVATE_NOW,
.height = -1,
@@ -281,7 +283,9 @@
{
if (info->screen_base)
iounmap(info->screen_base);
- release_mem_region(info->apertures->ranges[0].base, info->apertures->ranges[0].size);
+ if (request_mem_succeeded)
+ release_mem_region(info->apertures->ranges[0].base,
+ info->apertures->ranges[0].size);
framebuffer_release(info);
}
@@ -326,14 +330,13 @@
return 0;
}
-static int __devinit efifb_probe(struct platform_device *dev)
+static int __init efifb_probe(struct platform_device *dev)
{
struct fb_info *info;
int err;
unsigned int size_vmode;
unsigned int size_remap;
unsigned int size_total;
- int request_succeeded = 0;
if (!screen_info.lfb_depth)
screen_info.lfb_depth = 32;
@@ -387,7 +390,7 @@
efifb_fix.smem_len = size_remap;
if (request_mem_region(efifb_fix.smem_start, size_remap, "efifb")) {
- request_succeeded = 1;
+ request_mem_succeeded = true;
} else {
/* We cannot make this fatal. Sometimes this comes from magic
spaces our resource handlers simply don't know about */
@@ -413,7 +416,7 @@
info->apertures->ranges[0].base = efifb_fix.smem_start;
info->apertures->ranges[0].size = size_remap;
- info->screen_base = ioremap(efifb_fix.smem_start, efifb_fix.smem_len);
+ info->screen_base = ioremap_wc(efifb_fix.smem_start, efifb_fix.smem_len);
if (!info->screen_base) {
printk(KERN_ERR "efifb: abort, cannot ioremap video memory "
"0x%x @ 0x%lx\n",
@@ -491,13 +494,12 @@
err_release_fb:
framebuffer_release(info);
err_release_mem:
- if (request_succeeded)
+ if (request_mem_succeeded)
release_mem_region(efifb_fix.smem_start, size_total);
return err;
}
static struct platform_driver efifb_driver = {
- .probe = efifb_probe,
.driver = {
.name = "efifb",
},
@@ -528,13 +530,21 @@
if (!screen_info.lfb_linelength)
return -ENODEV;
- ret = platform_driver_register(&efifb_driver);
+ ret = platform_device_register(&efifb_device);
+ if (ret)
+ return ret;
- if (!ret) {
- ret = platform_device_register(&efifb_device);
- if (ret)
- platform_driver_unregister(&efifb_driver);
+ /*
+ * This is not just an optimization. We will interfere
+ * with a real driver if we get reprobed, so don't allow
+ * it.
+ */
+ ret = platform_driver_probe(&efifb_driver, efifb_probe);
+ if (ret) {
+ platform_device_unregister(&efifb_driver);
+ return ret;
}
+
return ret;
}
module_init(efifb_init);
diff --git a/drivers/video/hecubafb.c b/drivers/video/hecubafb.c
index 1b94643..fbef15f 100644
--- a/drivers/video/hecubafb.c
+++ b/drivers/video/hecubafb.c
@@ -231,11 +231,10 @@
videomemorysize = (DPY_W*DPY_H)/8;
- if (!(videomemory = vmalloc(videomemorysize)))
+ videomemory = vzalloc(videomemorysize);
+ if (!videomemory)
return retval;
- memset(videomemory, 0, videomemorysize);
-
info = framebuffer_alloc(sizeof(struct hecubafb_par), &dev->dev);
if (!info)
goto err_fballoc;
diff --git a/drivers/video/imxfb.c b/drivers/video/imxfb.c
index d2ccfd6..f135dbe 100644
--- a/drivers/video/imxfb.c
+++ b/drivers/video/imxfb.c
@@ -856,10 +856,10 @@
dma_free_writecombine(&pdev->dev,fbi->map_size,fbi->map_cpu,
fbi->map_dma);
failed_map:
- clk_put(fbi->clk);
-failed_getclock:
iounmap(fbi->regs);
failed_ioremap:
+ clk_put(fbi->clk);
+failed_getclock:
release_mem_region(res->start, resource_size(res));
failed_req:
kfree(info->pseudo_palette);
diff --git a/drivers/video/metronomefb.c b/drivers/video/metronomefb.c
index ed64edf..97d45e5 100644
--- a/drivers/video/metronomefb.c
+++ b/drivers/video/metronomefb.c
@@ -628,12 +628,10 @@
/* we need to add a spare page because our csum caching scheme walks
* to the end of the page */
videomemorysize = PAGE_SIZE + (fw * fh);
- videomemory = vmalloc(videomemorysize);
+ videomemory = vzalloc(videomemorysize);
if (!videomemory)
goto err_fb_rel;
- memset(videomemory, 0, videomemorysize);
-
info->screen_base = (char __force __iomem *)videomemory;
info->fbops = &metronomefb_ops;
diff --git a/drivers/video/modedb.c b/drivers/video/modedb.c
index 48c3ea8..cb175fe 100644
--- a/drivers/video/modedb.c
+++ b/drivers/video/modedb.c
@@ -1128,3 +1128,4 @@
EXPORT_SYMBOL(fb_find_nearest_mode);
EXPORT_SYMBOL(fb_videomode_to_modelist);
EXPORT_SYMBOL(fb_find_mode);
+EXPORT_SYMBOL(fb_find_mode_cvt);
diff --git a/drivers/video/pxa168fb.c b/drivers/video/pxa168fb.c
index 35f61dd..bb95ec5 100644
--- a/drivers/video/pxa168fb.c
+++ b/drivers/video/pxa168fb.c
@@ -623,19 +623,21 @@
res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
if (res == NULL) {
dev_err(&pdev->dev, "no IO memory defined\n");
- return -ENOENT;
+ ret = -ENOENT;
+ goto failed_put_clk;
}
irq = platform_get_irq(pdev, 0);
if (irq < 0) {
dev_err(&pdev->dev, "no IRQ defined\n");
- return -ENOENT;
+ ret = -ENOENT;
+ goto failed_put_clk;
}
info = framebuffer_alloc(sizeof(struct pxa168fb_info), &pdev->dev);
if (info == NULL) {
- clk_put(clk);
- return -ENOMEM;
+ ret = -ENOMEM;
+ goto failed_put_clk;
}
/* Initialize private data */
@@ -671,7 +673,7 @@
fbi->reg_base = ioremap_nocache(res->start, resource_size(res));
if (fbi->reg_base == NULL) {
ret = -ENOMEM;
- goto failed;
+ goto failed_free_info;
}
/*
@@ -683,7 +685,7 @@
&fbi->fb_start_dma, GFP_KERNEL);
if (info->screen_base == NULL) {
ret = -ENOMEM;
- goto failed;
+ goto failed_free_info;
}
info->fix.smem_start = (unsigned long)fbi->fb_start_dma;
@@ -772,8 +774,9 @@
failed_free_fbmem:
dma_free_coherent(fbi->dev, info->fix.smem_len,
info->screen_base, fbi->fb_start_dma);
-failed:
+failed_free_info:
kfree(info);
+failed_put_clk:
clk_put(clk);
dev_err(&pdev->dev, "frame buffer device init failed with %d\n", ret);
diff --git a/drivers/video/savage/savagefb_driver.c b/drivers/video/savage/savagefb_driver.c
index 3b7f2f5..4de541c 100644
--- a/drivers/video/savage/savagefb_driver.c
+++ b/drivers/video/savage/savagefb_driver.c
@@ -2237,6 +2237,22 @@
&info->modelist);
#endif
info->var = savagefb_var800x600x8;
+ /* if a panel was detected, default to a CVT mode instead */
+ if (par->SavagePanelWidth) {
+ struct fb_videomode cvt_mode;
+
+ memset(&cvt_mode, 0, sizeof(cvt_mode));
+ cvt_mode.xres = par->SavagePanelWidth;
+ cvt_mode.yres = par->SavagePanelHeight;
+ cvt_mode.refresh = 60;
+ /* FIXME: if we know there is only the panel
+ * we can enable reduced blanking as well */
+ if (fb_find_mode_cvt(&cvt_mode, 0, 0))
+ printk(KERN_WARNING "No CVT mode found for panel\n");
+ else if (fb_find_mode(&info->var, info, NULL, NULL, 0,
+ &cvt_mode, 0) != 3)
+ info->var = savagefb_var800x600x8;
+ }
if (mode_option) {
fb_find_mode(&info->var, info, mode_option,
diff --git a/drivers/video/sh_mobile_lcdcfb.c b/drivers/video/sh_mobile_lcdcfb.c
index 404c03b..019dbd3 100644
--- a/drivers/video/sh_mobile_lcdcfb.c
+++ b/drivers/video/sh_mobile_lcdcfb.c
@@ -470,7 +470,7 @@
unsigned long tmp;
int bpp = 0;
unsigned long ldddsr;
- int k, m;
+ int k, m, ret;
/* enable clocks before accessing the hardware */
for (k = 0; k < ARRAY_SIZE(priv->ch); k++) {
@@ -540,7 +540,7 @@
board_cfg = &ch->cfg.board_cfg;
if (board_cfg->setup_sys) {
- int ret = board_cfg->setup_sys(board_cfg->board_data,
+ ret = board_cfg->setup_sys(board_cfg->board_data,
ch, &sh_mobile_lcdc_sys_bus_ops);
if (ret)
return ret;
diff --git a/drivers/video/vga16fb.c b/drivers/video/vga16fb.c
index 53b2c5a..305c975 100644
--- a/drivers/video/vga16fb.c
+++ b/drivers/video/vga16fb.c
@@ -1265,9 +1265,11 @@
static void vga16fb_destroy(struct fb_info *info)
{
+ struct platform_device *dev = container_of(info->device, struct platform_device, dev);
iounmap(info->screen_base);
fb_dealloc_cmap(&info->cmap);
/* XXX unshare VGA regions */
+ platform_set_drvdata(dev, NULL);
framebuffer_release(info);
}
diff --git a/drivers/video/xen-fbfront.c b/drivers/video/xen-fbfront.c
index a20218c..beac52fc 100644
--- a/drivers/video/xen-fbfront.c
+++ b/drivers/video/xen-fbfront.c
@@ -395,10 +395,9 @@
spin_lock_init(&info->dirty_lock);
spin_lock_init(&info->resize_lock);
- info->fb = vmalloc(fb_size);
+ info->fb = vzalloc(fb_size);
if (info->fb == NULL)
goto error_nomem;
- memset(info->fb, 0, fb_size);
info->nr_pages = (fb_size + PAGE_SIZE - 1) >> PAGE_SHIFT;