Home Home > GIT Browse > SLE11-SP4
summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorMichal Hocko <mhocko@suse.com>2019-01-14 13:17:38 +0100
committerMichal Hocko <mhocko@suse.com>2019-01-14 13:17:38 +0100
commitbd3070861b998ff74b126f6404772ff5e0383cb4 (patch)
treed96918897973856d7ac44be54bcc776b11e16a0c
parent8988d6f36e5ba31151c638aef6e201429c42c193 (diff)
parent5a012278b9231c995dab48dd29870ba77f6a63d6 (diff)
Merge remote-tracking branch 'origin/users/tzimmermann/SLE11-SP4/for-next' into users/mhocko/SLE11-SP4/for-next
-rw-r--r--patches.fixes/0001-fbdev-fbcon-Fix-unregister-crash-when-more-than-one-.patch80
-rw-r--r--patches.fixes/0001-fbdev-fbmem-behave-better-with-small-rotated-display.patch58
-rw-r--r--series.conf2
3 files changed, 140 insertions, 0 deletions
diff --git a/patches.fixes/0001-fbdev-fbcon-Fix-unregister-crash-when-more-than-one-.patch b/patches.fixes/0001-fbdev-fbcon-Fix-unregister-crash-when-more-than-one-.patch
new file mode 100644
index 0000000000..10a58f64be
--- /dev/null
+++ b/patches.fixes/0001-fbdev-fbcon-Fix-unregister-crash-when-more-than-one-.patch
@@ -0,0 +1,80 @@
+From 2122b40580dd9d0620398739c773d07a7b7939d0 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Noralf=20Tr=C3=B8nnes?= <noralf@tronnes.org>
+Date: Thu, 20 Dec 2018 19:13:09 +0100
+Subject: fbdev: fbcon: Fix unregister crash when more than one framebuffer
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+Git-commit: 2122b40580dd9d0620398739c773d07a7b7939d0
+Patch-mainline: v5.0-rc1
+References: bsc#1106886
+
+When unregistering fbdev using unregister_framebuffer(), any bound
+console will unbind automatically. This is working fine if this is the
+only framebuffer, resulting in a switch to the dummy console. However if
+there is a fb0 and I unregister fb1 having a bound console, I eventually
+get a crash. The fastest way for me to trigger the crash is to do a
+reboot, resulting in this splat:
+
+[ 76.478825] WARNING: CPU: 0 PID: 527 at linux/kernel/workqueue.c:1442 __queue_work+0x2d4/0x41c
+[ 76.478849] Modules linked in: raspberrypi_hwmon gpio_backlight backlight bcm2835_rng rng_core [last unloaded: tinydrm]
+[ 76.478916] CPU: 0 PID: 527 Comm: systemd-udevd Not tainted 4.20.0-rc4+ #4
+[ 76.478933] Hardware name: BCM2835
+[ 76.478949] Backtrace:
+[ 76.478995] [<c010d388>] (dump_backtrace) from [<c010d670>] (show_stack+0x20/0x24)
+[ 76.479022] r6:00000000 r5:c0bc73be r4:00000000 r3:6fb5bf81
+[ 76.479060] [<c010d650>] (show_stack) from [<c08e82f4>] (dump_stack+0x20/0x28)
+[ 76.479102] [<c08e82d4>] (dump_stack) from [<c0120070>] (__warn+0xec/0x12c)
+[ 76.479134] [<c011ff84>] (__warn) from [<c01201e4>] (warn_slowpath_null+0x4c/0x58)
+[ 76.479165] r9:c0eb6944 r8:00000001 r7:c0e927f8 r6:c0bc73be r5:000005a2 r4:c0139e84
+[ 76.479197] [<c0120198>] (warn_slowpath_null) from [<c0139e84>] (__queue_work+0x2d4/0x41c)
+[ 76.479222] r6:d7666a00 r5:c0e918ee r4:dbc4e700
+[ 76.479251] [<c0139bb0>] (__queue_work) from [<c013a02c>] (queue_work_on+0x60/0x88)
+[ 76.479281] r10:c0496bf8 r9:00000100 r8:c0e92ae0 r7:00000001 r6:d9403700 r5:d7666a00
+[ 76.479298] r4:20000113
+[ 76.479348] [<c0139fcc>] (queue_work_on) from [<c0496c28>] (cursor_timer_handler+0x30/0x54)
+[ 76.479374] r7:d8a8fabc r6:c0e08088 r5:d8afdc5c r4:d8a8fabc
+[ 76.479413] [<c0496bf8>] (cursor_timer_handler) from [<c0178744>] (call_timer_fn+0x100/0x230)
+[ 76.479435] r4:c0e9192f r3:d758a340
+[ 76.479465] [<c0178644>] (call_timer_fn) from [<c0178980>] (expire_timers+0x10c/0x12c)
+[ 76.479495] r10:40000000 r9:c0e9192f r8:c0e92ae0 r7:d8afdccc r6:c0e19280 r5:c0496bf8
+[ 76.479513] r4:d8a8fabc
+[ 76.479541] [<c0178874>] (expire_timers) from [<c0179630>] (run_timer_softirq+0xa8/0x184)
+[ 76.479570] r9:00000001 r8:c0e19280 r7:00000000 r6:c0e08088 r5:c0e1a3e0 r4:c0e19280
+[ 76.479603] [<c0179588>] (run_timer_softirq) from [<c0102404>] (__do_softirq+0x1ac/0x3fc)
+[ 76.479632] r10:c0e91680 r9:d8afc020 r8:0000000a r7:00000100 r6:00000001 r5:00000002
+[ 76.479650] r4:c0eb65ec
+[ 76.479686] [<c0102258>] (__do_softirq) from [<c0124d10>] (irq_exit+0xe8/0x168)
+[ 76.479716] r10:d8d1a9b0 r9:d8afc000 r8:00000001 r7:d949c000 r6:00000000 r5:c0e8b3f0
+[ 76.479734] r4:00000000
+[ 76.479764] [<c0124c28>] (irq_exit) from [<c016b72c>] (__handle_domain_irq+0x94/0xb0)
+[ 76.479793] [<c016b698>] (__handle_domain_irq) from [<c01021dc>] (bcm2835_handle_irq+0x3c/0x48)
+[ 76.479823] r8:d8afdebc r7:d8afddfc r6:ffffffff r5:c0e089f8 r4:d8afddc8 r3:d8afddc8
+[ 76.479851] [<c01021a0>] (bcm2835_handle_irq) from [<c01019f0>] (__irq_svc+0x70/0x98)
+
+The problem is in the console rebinding in fbcon_fb_unbind(). It uses the
+virtual console index as the new framebuffer index to bind the console(s)
+to. The correct way is to use the con2fb_map lookup table to find the
+framebuffer index.
+
+Fixes: cfafca8067c6 ("fbdev: fbcon: console unregistration from unregister_framebuffer")
+Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
+Reviewed-by: Mikulas Patocka <mpatocka@redhat.com>
+Acked-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
+Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
+---
+ drivers/video/console/fbcon.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/video/console/fbcon.c
++++ b/drivers/video/console/fbcon.c
+@@ -3039,7 +3039,7 @@ static int fbcon_fb_unbind(int idx)
+ for (i = first_fb_vc; i <= last_fb_vc; i++) {
+ if (con2fb_map[i] != idx &&
+ con2fb_map[i] != -1) {
+- new_idx = i;
++ new_idx = con2fb_map[i];
+ break;
+ }
+ }
diff --git a/patches.fixes/0001-fbdev-fbmem-behave-better-with-small-rotated-display.patch b/patches.fixes/0001-fbdev-fbmem-behave-better-with-small-rotated-display.patch
new file mode 100644
index 0000000000..ae55c61656
--- /dev/null
+++ b/patches.fixes/0001-fbdev-fbmem-behave-better-with-small-rotated-display.patch
@@ -0,0 +1,58 @@
+From f75df8d4b4fabfad7e3cba2debfad12741c6fde7 Mon Sep 17 00:00:00 2001
+From: Peter Rosin <peda@axentia.se>
+Date: Thu, 20 Dec 2018 19:13:07 +0100
+Subject: fbdev: fbmem: behave better with small rotated displays and many CPUs
+Git-commit: f75df8d4b4fabfad7e3cba2debfad12741c6fde7
+Patch-mainline: v5.0-rc1
+References: bsc#1106886
+
+Blitting an image with "negative" offsets is not working since there
+is no clipping. It hopefully just crashes. For the bootup logo, there
+is protection so that blitting does not happen as the image is drawn
+further and further to the right (ROTATE_UR) or further and further
+down (ROTATE_CW). There is however no protection when drawing in the
+opposite directions (ROTATE_UD and ROTATE_CCW).
+
+Add back this protection.
+
+The regression is 20-odd years old but the mindless warning-killing
+mentality displayed in commit 34bdb666f4b2 ("fbdev: fbmem: remove
+positive test on unsigned values") is also to blame, methinks.
+
+Fixes: 448d479747b8 ("fbdev: fb_do_show_logo() updates")
+Signed-off-by: Peter Rosin <peda@axentia.se>
+Cc: Tomi Valkeinen <tomi.valkeinen@ti.com>
+Cc: Fabian Frederick <ffrederick@users.sourceforge.net>
+Cc: Geert Uytterhoeven <geert+renesas@glider.be>
+cc: Geoff Levand <geoff@infradead.org>
+Cc: James Simmons <jsimmons@users.sf.net>
+Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
+Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
+---
+ drivers/video/fbmem.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/drivers/video/fbmem.c
++++ b/drivers/video/fbmem.c
+@@ -428,7 +428,9 @@ static void fb_do_show_logo(struct fb_in
+ image->dx += image->width + 8;
+ }
+ } else if (rotate == FB_ROTATE_UD) {
+- for (x = 0; x < num && image->dx >= 0; x++) {
++ u32 dx = image->dx;
++
++ for (x = 0; x < num && image->dx <= dx; x++) {
+ info->fbops->fb_imageblit(info, image);
+ image->dx -= image->width + 8;
+ }
+@@ -440,7 +442,9 @@ static void fb_do_show_logo(struct fb_in
+ image->dy += image->height + 8;
+ }
+ } else if (rotate == FB_ROTATE_CCW) {
+- for (x = 0; x < num && image->dy >= 0; x++) {
++ u32 dy = image->dy;
++
++ for (x = 0; x < num && image->dy <= dy; x++) {
+ info->fbops->fb_imageblit(info, image);
+ image->dy -= image->height + 8;
+ }
diff --git a/series.conf b/series.conf
index 8c3f367e1d..5ff40b5682 100644
--- a/series.conf
+++ b/series.conf
@@ -12617,6 +12617,8 @@
# bsc1106886
patches.fixes/0001-fbdev-omapfb-off-by-one-in-omapfb_register_client.patch
+ patches.fixes/0001-fbdev-fbmem-behave-better-with-small-rotated-display.patch
+ patches.fixes/0001-fbdev-fbcon-Fix-unregister-crash-when-more-than-one-.patch
# boo1112963
patches.drm/0001-drm-ast-Remove-existing-framebuffers-before-loading-.patch