linux-stable.git/drivers/video/console, branch v4.9.166

fbdev: fbcon: Fix unregister crash when more than one framebuffer

2019-02-12T18:44:57+00:00

[ Upstream commit 2122b40580dd9d0620398739c773d07a7b7939d0 ]

When unregistering fbdev using unregister_framebuffer(), any bound
console will unbind automatically. This is working fine if this is the
only framebuffer, resulting in a switch to the dummy console. However if
there is a fb0 and I unregister fb1 having a bound console, I eventually
get a crash. The fastest way for me to trigger the crash is to do a
reboot, resulting in this splat:

[   76.478825] WARNING: CPU: 0 PID: 527 at linux/kernel/workqueue.c:1442 __queue_work+0x2d4/0x41c
[   76.478849] Modules linked in: raspberrypi_hwmon gpio_backlight backlight bcm2835_rng rng_core [last unloaded: tinydrm]
[   76.478916] CPU: 0 PID: 527 Comm: systemd-udevd Not tainted 4.20.0-rc4+ #4
[   76.478933] Hardware name: BCM2835
[   76.478949] Backtrace:
[   76.478995] [] (dump_backtrace) from [] (show_stack+0x20/0x24)
[   76.479022]  r6:00000000 r5:c0bc73be r4:00000000 r3:6fb5bf81
[   76.479060] [] (show_stack) from [] (dump_stack+0x20/0x28)
[   76.479102] [] (dump_stack) from [] (__warn+0xec/0x12c)
[   76.479134] [] (__warn) from [] (warn_slowpath_null+0x4c/0x58)
[   76.479165]  r9:c0eb6944 r8:00000001 r7:c0e927f8 r6:c0bc73be r5:000005a2 r4:c0139e84
[   76.479197] [] (warn_slowpath_null) from [] (__queue_work+0x2d4/0x41c)
[   76.479222]  r6:d7666a00 r5:c0e918ee r4:dbc4e700
[   76.479251] [] (__queue_work) from [] (queue_work_on+0x60/0x88)
[   76.479281]  r10:c0496bf8 r9:00000100 r8:c0e92ae0 r7:00000001 r6:d9403700 r5:d7666a00
[   76.479298]  r4:20000113
[   76.479348] [] (queue_work_on) from [] (cursor_timer_handler+0x30/0x54)
[   76.479374]  r7:d8a8fabc r6:c0e08088 r5:d8afdc5c r4:d8a8fabc
[   76.479413] [] (cursor_timer_handler) from [] (call_timer_fn+0x100/0x230)
[   76.479435]  r4:c0e9192f r3:d758a340
[   76.479465] [] (call_timer_fn) from [] (expire_timers+0x10c/0x12c)
[   76.479495]  r10:40000000 r9:c0e9192f r8:c0e92ae0 r7:d8afdccc r6:c0e19280 r5:c0496bf8
[   76.479513]  r4:d8a8fabc
[   76.479541] [] (expire_timers) from [] (run_timer_softirq+0xa8/0x184)
[   76.479570]  r9:00000001 r8:c0e19280 r7:00000000 r6:c0e08088 r5:c0e1a3e0 r4:c0e19280
[   76.479603] [] (run_timer_softirq) from [] (__do_softirq+0x1ac/0x3fc)
[   76.479632]  r10:c0e91680 r9:d8afc020 r8:0000000a r7:00000100 r6:00000001 r5:00000002
[   76.479650]  r4:c0eb65ec
[   76.479686] [] (__do_softirq) from [] (irq_exit+0xe8/0x168)
[   76.479716]  r10:d8d1a9b0 r9:d8afc000 r8:00000001 r7:d949c000 r6:00000000 r5:c0e8b3f0
[   76.479734]  r4:00000000
[   76.479764] [] (irq_exit) from [] (__handle_domain_irq+0x94/0xb0)
[   76.479793] [] (__handle_domain_irq) from [] (bcm2835_handle_irq+0x3c/0x48)
[   76.479823]  r8:d8afdebc r7:d8afddfc r6:ffffffff r5:c0e089f8 r4:d8afddc8 r3:d8afddc8
[   76.479851] [] (bcm2835_handle_irq) from [] (__irq_svc+0x70/0x98)

The problem is in the console rebinding in fbcon_fb_unbind(). It uses the
virtual console index as the new framebuffer index to bind the console(s)
to. The correct way is to use the con2fb_map lookup table to find the
framebuffer index.

Fixes: cfafca8067c6 ("fbdev: fbcon: console unregistration from unregister_framebuffer")
Signed-off-by: Noralf Trønnes 
Reviewed-by: Mikulas Patocka 
Acked-by: Daniel Vetter 
Signed-off-by: Bartlomiej Zolnierkiewicz 
Signed-off-by: Sasha Levin

vgacon: Set VGA struct resource types

2018-03-24T10:00:25+00:00

[ Upstream commit c82084117f79bcae085e40da526253736a247120 ]

Set the resource type when we reserve VGA-related I/O port resources.

The resource code doesn't actually look at the type, so it inserts
resources without a type in the tree correctly even without this change.
But if we ever print a resource without a type, it looks like this:

  vga+ [??? 0x000003c0-0x000003df flags 0x0]

Setting the type means it will be printed correctly as:

  vga+ [io  0x000003c0-0x000003df]

Signed-off-by: Bjorn Helgaas 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman

console/dummy: leave .con_font_get set to NULL

2018-02-22T14:43:49+00:00

commit 724ba8b30b044aa0d94b1cd374fc15806cdd6f18 upstream.

When this method is set, the caller expects struct console_font fields
to be properly initialized when it returns. Leave it unset otherwise
nonsensical (leaked kernel stack) values are returned to user space.

Signed-off-by: Nicolas Pitre 
Cc: stable@vger.kernel.org
Signed-off-by: Bartlomiej Zolnierkiewicz 
Signed-off-by: Greg Kroah-Hartman

fbcon: Fix vc attr at deinit

2017-03-30T07:41:28+00:00

commit 8aac7f34369726d1a158788ae8aff3002d5eb528 upstream.

fbcon can deal with vc_hi_font_mask (the upper 256 chars) and adjust
the vc attrs dynamically when vc_hi_font_mask is changed at
fbcon_init().  When the vc_hi_font_mask is set, it remaps the attrs in
the existing console buffer with one bit shift up (for 9 bits), while
it remaps with one bit shift down (for 8 bits) when the value is
cleared.  It works fine as long as the font gets updated after fbcon
was initialized.

However, we hit a bizarre problem when the console is switched to
another fb driver (typically from vesafb or efifb to drmfb).  At
switching to the new fb driver, we temporarily rebind the console to
the dummy console, then rebind to the new driver.  During the
switching, we leave the modified attrs as is.  Thus, the new fbcon
takes over the old buffer as if it were to contain 8 bits chars
(although the attrs are still shifted for 9 bits), and effectively
this results in the yellow color texts instead of the original white
color, as found in the bugzilla entry below.

An easy fix for this is to re-adjust the attrs before leaving the
fbcon at con_deinit callback.  Since the code to adjust the attrs is
already present in the current fbcon code, in this patch, we simply
factor out the relevant code, and call it from fbcon_deinit().

Bugzilla: https://bugzilla.suse.com/show_bug.cgi?id=1000619
Signed-off-by: Takashi Iwai 
Signed-off-by: Bartlomiej Zolnierkiewicz 
Cc: Arnd Bergmann 
Signed-off-by: Greg Kroah-Hartman

tty: vt, convert more macros to functions

2016-06-25T16:04:48+00:00

Namely convert:
* IS_FG -> con_is_fg
* DO_UPDATE -> con_should_update
* CON_IS_VISIBLE -> con_is_visible

DO_UPDATE was a weird name for a yes/no answer, so the new name is
con_should_update.

Signed-off-by: Jiri Slaby 
Cc: Thomas Winischhofer 
Cc: Jean-Christophe Plagniol-Villard 
Cc: linux-usb@vger.kernel.org
Cc: linux-fbdev@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman

tty: vt, remove consw->con_bmove

2016-06-25T16:04:48+00:00

It is never called since commit 81732c3b2fede (tty vt: Fix line
garbage in virtual console on command line edition) in 3.7. So remove
all the callbacks.

Signed-off-by: Jiri Slaby 
Cc: Thomas Winischhofer 
Cc: linux-usb@vger.kernel.org
Cc: Jean-Christophe Plagniol-Villard 
Cc: Tomi Valkeinen 
Cc: "James E.J. Bottomley" 
Cc: Helge Deller 
Cc: linux-fbdev@vger.kernel.org
Cc: linux-parisc@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman

tty: vt, consw->con_set_palette cleanup

2016-06-25T16:04:48+00:00

* allow NULL consw->con_set_palette (some consoles define an empty
  hook)
* => remove empty hooks now
* return value of consw->con_set_palette is never checked => make the
  function void
* document consw->con_set_palette a bit

Signed-off-by: Jiri Slaby 
Cc: Thomas Winischhofer 
Cc: linux-usb@vger.kernel.org
Cc: Jean-Christophe Plagniol-Villard 
Cc: Tomi Valkeinen 
Cc: "James E.J. Bottomley" 
Cc: Helge Deller 
Cc: linux-fbdev@vger.kernel.org
Cc: linux-parisc@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman

tty: vt, consw->con_scrolldelta cleanup

2016-06-25T16:04:48+00:00

* allow NULL consw->con_scrolldelta (some consoles define an empty
  hook)
* => remove empty hooks now
* return value of consw->con_scrolldelta is never checked => make the
  function void
* document consw->con_scrolldelta a bit

Signed-off-by: Jiri Slaby 
Cc: Thomas Winischhofer 
Cc: linux-usb@vger.kernel.org
Cc: Jean-Christophe Plagniol-Villard 
Cc: Tomi Valkeinen 
Cc: "James E.J. Bottomley" 
Cc: Helge Deller 
Cc: linux-fbdev@vger.kernel.org
Cc: linux-parisc@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman

tty: vt, make color_table const

2016-04-30T16:26:55+00:00

This means all ->con_set_palette have to have the second parameter
const too now.

Signed-off-by: Jiri Slaby 
Signed-off-by: Greg Kroah-Hartman

fbcon: set a default value to blink interval

2016-02-26T11:19:55+00:00

Since commit 27a4c827c34ac4256a190cc9d24607f953c1c459
	fbcon: use the cursor blink interval provided by vt

two attempts have been made at fixing a possible hang caused by
cursor_timer_handler. That function registers a timer to be triggered at
"jiffies + fbcon_ops.cur_blink_jiffies".

A new case had been encountered during initialisation of clcd-pl11x:

    fbcon_fb_registered
    do_fbcon_takeover

    ->  do_register_con_driver
        fbcon_startup
    (A) add_cursor_timer (with cur_blink_jiffies = 0)

    ->  do_bind_con_driver
        visual_init
        fbcon_init
    (B) cur_blink_jiffies = msecs_to_jiffies(vc->vc_cur_blink_ms);

If we take an softirq anywhere between A and B (and we do),
cursor_timer_handler executes indefinitely.

Instead of patching all possible paths that lead to this case one at a
time, fix the issue at the source and initialise cur_blink_jiffies to
200ms when allocating fbcon_ops. This was its default value before
aforesaid commit. fbcon_cursor or fbcon_init will refine this value
downstream.

Signed-off-by: Jean-Philippe Brucker 
Cc:  # v4.2
Tested-by: Scot Doyle 
Signed-off-by: Tomi Valkeinen