linux-toradex.git/drivers/gpu/drm/drm_fb_cma_helper.c, branch v4.19

drm/cma-helper: Fix crash in fbdev error path

2018-10-02T11:03:34+00:00

Sergey Suloev reported a crash happening in drm_client_dev_hotplug()
when fbdev had failed to register.

[    9.124598] vc4_hdmi 3f902000.hdmi: ASoC: Failed to create component debugfs directory
[    9.147667] vc4_hdmi 3f902000.hdmi: vc4-hdmi-hifi <-> 3f902000.hdmi mapping ok
[    9.155184] vc4_hdmi 3f902000.hdmi: ASoC: no DMI vendor name!
[    9.166544] vc4-drm soc:gpu: bound 3f902000.hdmi (ops vc4_hdmi_ops [vc4])
[    9.173840] vc4-drm soc:gpu: bound 3f806000.vec (ops vc4_vec_ops [vc4])
[    9.181029] vc4-drm soc:gpu: bound 3f004000.txp (ops vc4_txp_ops [vc4])
[    9.188519] vc4-drm soc:gpu: bound 3f400000.hvs (ops vc4_hvs_ops [vc4])
[    9.195690] vc4-drm soc:gpu: bound 3f206000.pixelvalve (ops vc4_crtc_ops [vc4])
[    9.203523] vc4-drm soc:gpu: bound 3f207000.pixelvalve (ops vc4_crtc_ops [vc4])
[    9.215032] vc4-drm soc:gpu: bound 3f807000.pixelvalve (ops vc4_crtc_ops [vc4])
[    9.274785] vc4-drm soc:gpu: bound 3fc00000.v3d (ops vc4_v3d_ops [vc4])
[    9.290246] [drm] Initialized vc4 0.0.0 20140616 for soc:gpu on minor 0
[    9.297464] [drm] Supports vblank timestamp caching Rev 2 (21.10.2013).
[    9.304600] [drm] Driver supports precise vblank timestamp query.
[    9.382856] vc4-drm soc:gpu: [drm:drm_fb_helper_fbdev_setup [drm_kms_helper]] *ERROR* Failed to set fbdev configuration
[   10.404937] Unable to handle kernel paging request at virtual address 00330a656369768a
[   10.441620] [00330a656369768a] address between user and kernel address ranges
[   10.449087] Internal error: Oops: 96000004 [#1] PREEMPT SMP
[   10.454762] Modules linked in: brcmfmac vc4 drm_kms_helper cfg80211 drm rfkill smsc95xx brcmutil usbnet drm_panel_orientation_quirks raspberrypi_hwmon bcm2835_dma crc32_ce pwm_bcm2835 bcm2835_rng virt_dma rng_core i2c_bcm2835 ip_tables x_tables ipv6
[   10.477296] CPU: 2 PID: 45 Comm: kworker/2:1 Not tainted 4.19.0-rc5 #3
[   10.483934] Hardware name: Raspberry Pi 3 Model B Rev 1.2 (DT)
[   10.489966] Workqueue: events output_poll_execute [drm_kms_helper]
[   10.596515] Process kworker/2:1 (pid: 45, stack limit = 0x000000007e8924dc)
[   10.603590] Call trace:
[   10.606259]  drm_client_dev_hotplug+0x5c/0xb0 [drm]
[   10.611303]  drm_kms_helper_hotplug_event+0x30/0x40 [drm_kms_helper]
[   10.617849]  output_poll_execute+0xc4/0x1e0 [drm_kms_helper]
[   10.623616]  process_one_work+0x1c8/0x318
[   10.627695]  worker_thread+0x48/0x428
[   10.631420]  kthread+0xf8/0x128
[   10.634615]  ret_from_fork+0x10/0x18
[   10.638255] Code: 54000220 f9401261 aa1303e0 b4000141 (f9400c21)
[   10.644456] ---[ end trace c75b4a4b0e141908 ]---

The reason for this is that drm_fbdev_cma_init() removes the drm_client
when fbdev registration fails, but it doesn't remove the client from the
drm_device client list. So the client list now has a pointer that points
into the unknown and we have a 'use after free' situation.

Split drm_client_new() into drm_client_init() and drm_client_add() to fix
removal in the error path.

Fixes: 894a677f4b3e ("drm/cma-helper: Use the generic fbdev emulation")
Reported-by: Sergey Suloev 
Cc: Stefan Wahren 
Cc: Eric Anholt 
Cc: Daniel Vetter 
Signed-off-by: Noralf Trønnes 
Reviewed-by: Daniel Vetter 
Link: https://patchwork.freedesktop.org/patch/msgid/20181001194536.57756-1-noralf@tronnes.org

drm/cma-helper: Remove drm_fb_cma_fbdev_init_with_funcs()

2018-07-10T12:54:50+00:00

Remove drm_fb_cma_fbdev_init_with_funcs(), its only user tinydrm has
moved to drm_fbdev_generic_setup().

Cc: Laurent Pinchart 
Signed-off-by: Noralf Trønnes 
Reviewed-by: David Lechner 
Link: https://patchwork.freedesktop.org/patch/msgid/20180703160354.59955-9-noralf@tronnes.org

drm/cma-helper: Use the generic fbdev emulation

2018-07-10T12:53:17+00:00

This switches the CMA helper drivers that use its fbdev emulation over
to the generic fbdev emulation. It's the first phase of using generic
fbdev. A later phase will use DRM client callbacks for the
lastclose/hotplug/remove callbacks.

There are currently 2 fbdev init/fini functions:
- drm_fb_cma_fbdev_init/drm_fb_cma_fbdev_fini
- drm_fbdev_cma_init/drm_fbdev_cma_fini

This is because the work on generic fbdev came up during a fbdev
refactoring and thus wasn't completed. No point in completing that
refactoring when drivers will soon move to drm_fb_helper_generic_probe().

tinydrm uses drm_fb_cma_fbdev_init_with_funcs().

Cc: Laurent Pinchart 
Signed-off-by: Noralf Trønnes 
Acked-by: Daniel Vetter 
Link: https://patchwork.freedesktop.org/patch/msgid/20180703160354.59955-5-noralf@tronnes.org

drm/cma-helper: Add drm_fb_cma_fbdev_init/fini()

2017-12-08T13:27:47+00:00

Add functions drm_fb_cma_fbdev_init(), drm_fb_cma_fbdev_fini() and
drm_fb_cma_fbdev_init_with_funcs(). These functions relies on the fact
that the drm_fb_helper struct is stored in dev->drm_fb_helper_private
so drivers don't need to store it.

Cc: Laurent Pinchart 
Signed-off-by: Noralf Trønnes 
Reviewed-by: Daniel Vetter 
Link: https://patchwork.freedesktop.org/patch/msgid/20171115142001.45358-3-noralf@tronnes.org

drm/cma-helper: Remove drm_fb_cma_debugfs_show()

2017-11-11T10:25:14+00:00

drm_fb_cma_debugfs_show() and drm_gem_cma_describe() are superseded
by drm_framebuffer_debugfs_init() and drm_gem_cma_print_info().

Cc: Laurent Pinchart 
Signed-off-by: Noralf Trønnes 
Reviewed-by: Daniel Vetter 
Reviewed-by: Laurent Pinchart 
Link: https://patchwork.freedesktop.org/patch/msgid/20171107191348.17555-13-noralf@tronnes.org

drm/fb-cma-helper: Remove unused functions

2017-10-01T15:05:39+00:00

The cma drivers use the drm_gem_framebuffer_helper functions now,
so remove drm_fb_cma_destroy, drm_fb_cma_create_handle,
drm_fb_cma_create_with_funcs, drm_fb_cma_create and
drm_fb_cma_prepare_fb.

Signed-off-by: Noralf Trønnes 
Reviewed-by: Eric Anholt 
Reviewed-by: Linus Walleij 
Link: https://patchwork.freedesktop.org/patch/msgid/1506255985-61113-11-git-send-email-noralf@tronnes.org

drm/fb-cma-helper: Use drm_gem_framebuffer_helper

2017-08-16T19:34:38+00:00

Use the new drm_gem_framebuffer_helper who's code was copied
from this helper.

Signed-off-by: Noralf Trønnes 
Reviewed-by: Eric Anholt 
Link: https://patchwork.freedesktop.org/patch/msgid/1502631125-13557-3-git-send-email-noralf@tronnes.org

drm: Convert CMA fbdev console suspend helpers to use bool

2017-06-20T14:23:40+00:00

drm_fbdev_cma_set_suspend{,_unlocked} use an integer parameter
to describe whether the intended state is a suspend or a resume.
It then passes the value to drm_fb_helper_set_suspend{,_unlocked}
which uses a boolean. Switch to using bool everywhere.

Signed-off-by: Liviu Dudau 
Signed-off-by: Daniel Vetter 
Link: http://patchwork.freedesktop.org/patch/msgid/20170620102320.8849-1-Liviu.Dudau@arm.com

drm/cma-helper: Return ENOENT for "no such gem obj"

2017-04-18T15:57:37+00:00

All the error codes we (ab)use are strictly not the right ones (since
they're all for the vfs, and the only thing we're allowed to do from
an ioctl is EINVAL). But ENOENT is the common error code for failed to
look up an object throughout drm, so let's use it in the cma helpers,
too.

Note that this does change uabi for some drivers, but that shouldn't
ba a problem:
- other drivers (e.g. i915) already return ENOENT for invalid gem bo
- userspace tends to only check for errors, not specific ones (except
  when ioctl restarting is needed)
- if the gem bo isn't there a previous step (either creating or
  importing it) failed already, this situation should always be a
  userspace bug.

Changing it does help with debugging userspace bugs though, by making
error reporting more consistent.

Cc: Laurent Pinchart 
Reviewed-by: Laurent Pinchart 
Reviewed-by: Sean Paul 
Signed-off-by: Daniel Vetter 
Link: http://patchwork.freedesktop.org/patch/msgid/20170418121120.31862-1-daniel.vetter@ffwll.ch

drm/fb-cma-helper: Add drm_fb_cma_get_gem_addr()

2017-04-14T18:30:28+00:00

Add function drm_fb_cma_get_gem_addr() which return the physical address
of framebuffer (1st pixel). This function will usually be called by plane
callback (atomic_update).

Signed-off-by: Yannick Fertre 
Signed-off-by: Eric Anholt 
Link: http://patchwork.freedesktop.org/patch/msgid/1492164819-10513-3-git-send-email-yannick.fertre@st.com
Reviewed-by: Neil Armstrong 
Reviewed-by: Eric Anholt