linux-toradex.git/drivers/video/console/fbcon.c, branch v2.6.27.12

fbcon_set_all_vcs: fix kernel crash when switching the rotated consoles

2008-10-22T21:20:56+00:00

commit 232fb69a53a5ec3f22a8104d447abe4806848a8f upstream

echo 3 >> /sys/class/graphics/fbcon/rotate_all, then switch to another
console. Result:

	BUG: unable to handle kernel paging request at ffffc20005d00000
	IP: [bitfill_aligned+149/265] bitfill_aligned+0x95/0x109
	PGD 7e228067 PUD 7e229067 PMD 7bc1f067 PTE 0
	Oops: 0002 [1] SMP
	CPU 1
	Modules linked in: [...a lot...]
	Pid: 10, comm: events/1 Not tainted 2.6.26.5-45.fc9.x86_64 #1
	RIP: 0010:[bitfill_aligned+149/265]  [bitfill_aligned+149/265] bitfill_aligned+0x95/0x109
	RSP: 0018:ffff81007d811bc8  EFLAGS: 00010216
	RAX: ffffc20005d00000 RBX: 0000000000000000 RCX: 0000000000000400
	RDX: 0000000000000000 RSI: ffffc20005d00000 RDI: ffffffffffffffff
	RBP: ffff81007d811be0 R08: 0000000000000400 R09: 0000000000000040
	R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000010000
	R13: ffffffff811632f0 R14: 0000000000000006 R15: ffff81007cb85400
	FS:  0000000000000000(0000) GS:ffff81007e004780(0000) knlGS:0000000000000000
	CS:  0010 DS: 0018 ES: 0018 CR0: 000000008005003b
	CR2: ffffc20005d00000 CR3: 0000000000201000 CR4: 00000000000006e0
	DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
	DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
	Process events/1 (pid: 10, threadinfo ffff81007d810000, task ffff81007d808000)
	Stack:  ffff81007c9d75a0 0000000000000000 0000000000000000 ffff81007d811c80
	 ffffffff81163a61 ffff810000000000 ffffffff8115f9c8 0000001000000000
	 0000000100aaaaaa 000000007cd0d4a0 fffffd8a00000800 0001000000000000
	Call Trace:
	 [cfb_fillrect+523/798] cfb_fillrect+0x20b/0x31e
	 [soft_cursor+416/436] ? soft_cursor+0x1a0/0x1b4
	 [ccw_clear_margins+205/263] ccw_clear_margins+0xcd/0x107
	 [fbcon_clear_margins+59/61] fbcon_clear_margins+0x3b/0x3d
	 [fbcon_switch+1291/1466] fbcon_switch+0x50b/0x5ba
	 [redraw_screen+261/481] redraw_screen+0x105/0x1e1
	 [ccw_cursor+0/1869] ? ccw_cursor+0x0/0x74d
	 [complete_change_console+48/190] complete_change_console+0x30/0xbe
	 [change_console+115/120] change_console+0x73/0x78
	 [console_callback+0/292] ? console_callback+0x0/0x124
	 [console_callback+97/292] console_callback+0x61/0x124
	 [schedule_delayed_work+25/30] ? schedule_delayed_work+0x19/0x1e
	 [run_workqueue+139/282] run_workqueue+0x8b/0x11a
	 [worker_thread+221/238] worker_thread+0xdd/0xee
	 [autoremove_wake_function+0/56] ? autoremove_wake_function+0x0/0x38
	 [worker_thread+0/238] ? worker_thread+0x0/0xee
	 [kthread+73/118] kthread+0x49/0x76
	 [child_rip+10/18] child_rip+0xa/0x12
	 [kthread+0/118] ? kthread+0x0/0x76
	 [child_rip+0/18] ? child_rip+0x0/0x12

Because fbcon_set_all_vcs()->FBCON_SWAP() uses display->rotate == 0 instead
of fbcon_ops->rotate, and vc_resize() has no effect because it is called with
new_cols/rows == ->vc_cols/rows.

Tested on 2.6.26.5-45.fc9.x86_64, but
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git seems to
have the same problem.

Signed-off-by: Oleg Nesterov 
Cc: Krzysztof Helt 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman

fbdev: fix recursive notifier and locking when fbdev console is blanked

2008-10-04T01:22:17+00:00

Fix infinite recursive notifier in the fbdev layer.  This causes recursive
locking.  Dmitry Baryshkov found the problem and confirmed that the patch
fixes the bug.

After doing
# echo 1 > /sys/class/graphics/fb0/blank
I got the following in my kernel log:

=============================================
[ INFO: possible recursive locking detected ]
2.6.27-rc6-00086-gda63874-dirty #97
---------------------------------------------
echo/1564 is trying to acquire lock:
 ((fb_notifier_list).rwsem){..--}, at: [] __blocking_notifier_call_chain+0x38/0x6c

but task is already holding lock:
 ((fb_notifier_list).rwsem){..--}, at: [] __blocking_notifier_call_chain+0x38/0x6c

other info that might help us debug this:
2 locks held by echo/1564:
 #0:  (&buffer->mutex){--..}, at: [] sysfs_write_file+0x30/0x80
 #1:  ((fb_notifier_list).rwsem){..--}, at: [] __blocking_notifier_call_chain+0x38/0x6c

stack backtrace:
[] (dump_stack+0x0/0x14) from [] (print_deadlock_bug+0xa4/0xd0)
[] (print_deadlock_bug+0x0/0xd0) from [] (check_deadlock+0x148/0x17c)
 r6:c397a1e0 r5:c397a530 r4:c04fcf98
[] (check_deadlock+0x0/0x17c) from [] (validate_chain+0x3c4/0x4f0)
[] (validate_chain+0x0/0x4f0) from [] (__lock_acquire+0x5e8/0x6b4)
[] (__lock_acquire+0x0/0x6b4) from [] (lock_acquire+0x64/0x78)
[] (lock_acquire+0x0/0x78) from [] (down_read+0x4c/0x60)
 r7:00000009 r6:ffffffff r5:c0427a40 r4:c005a384
[] (down_read+0x0/0x60) from [] (__blocking_notifier_call_chain+0x38/0x6c)
 r5:c0427a40 r4:c0427a74
[] (__blocking_notifier_call_chain+0x0/0x6c) from [] (blocking_notifier_call_chain+0x20/0x28)
 r8:00000009 r7:c086d640 r6:c3967940 r5:00000000 r4:c38984b8
[] (blocking_notifier_call_chain+0x0/0x28) from [] (fb_notifier_call_chain+0x1c/0x24)
[] (fb_notifier_call_chain+0x0/0x24) from [] (fb_blank+0x64/0x70)
[] (fb_blank+0x0/0x70) from [] (fbcon_blank+0x114/0x1bc)
 r5:00000001 r4:c38984b8
[] (fbcon_blank+0x0/0x1bc) from [] (do_blank_screen+0x1e0/0x2a0)
[] (do_blank_screen+0x0/0x2a0) from [] (fbcon_fb_blanked+0x74/0x94)
 r5:c3967940 r4:00000001
[] (fbcon_fb_blanked+0x0/0x94) from [] (fbcon_event_notify+0x100/0x12c)
 r5:fffffffe r4:c39bc194
[] (fbcon_event_notify+0x0/0x12c) from [] (notifier_call_chain+0x38/0x7c)
[] (notifier_call_chain+0x0/0x7c) from [] (__blocking_notifier_call_chain+0x54/0x6c)
 r8:c3b51ea0 r7:00000009 r6:ffffffff r5:c0427a40 r4:c0427a74
[] (__blocking_notifier_call_chain+0x0/0x6c) from [] (blocking_notifier_call_chain+0x20/0x28)
 r8:00000001 r7:c3a7e000 r6:00000000 r5:00000000 r4:c38984b8
[] (blocking_notifier_call_chain+0x0/0x28) from [] (fb_notifier_call_chain+0x1c/0x24)
[] (fb_notifier_call_chain+0x0/0x24) from [] (fb_blank+0x64/0x70)
[] (fb_blank+0x0/0x70) from [] (store_blank+0x54/0x7c)
 r5:c38984b8 r4:c3b51ec4
[] (store_blank+0x0/0x7c) from [] (dev_attr_store+0x28/0x2c)
 r8:00000001 r7:c042bf80 r6:c39eba10 r5:c3967c30 r4:c38e0140
[] (dev_attr_store+0x0/0x2c) from [] (flush_write_buffer+0x54/0x68)
[] (flush_write_buffer+0x0/0x68) from [] (sysfs_write_file+0x58/0x80)
 r8:c3b51f78 r7:c3bcb070 r6:c39eba10 r5:00000001 r4:00000001
[] (sysfs_write_file+0x0/0x80) from [] (vfs_write+0xb8/0x148)
[] (vfs_write+0x0/0x148) from [] (sys_write+0x44/0x70)
 r7:00000004 r6:c3bcb070 r5:00000000 r4:00000000
[] (sys_write+0x0/0x70) from [] (ret_fast_syscall+0x0/0x2c)
 r6:4001b000 r5:00000001 r4:401dc658

Signed-off-by: Krzysztof Helt 
Reported-by: Dmitry Baryshkov 
Testted-by: Dmitry Baryshkov 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

fbcon: prevent cursor disappearance after switching to 512 character font

2008-08-12T23:07:29+00:00

Adjust and honor the vc_scrl_erase_char for 256 and 512 character fonts.

It fixes the issue with disappearing cursor during scrolling
(http://bugzilla.kernel.org/show_bug.cgi?id=11258).  The issue was
reported and tracked by Peter Hanzel.

Signed-off-by: Krzysztof Helt 
Reported-by: Peter Hanzel 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

fbcon: fix scrolling after logo is cleared

2008-08-05T21:33:49+00:00

If the 'clear' command is used on the frame buffer with a logo the upper
area is filled by few lines but not scrolled anymore.

Fix this by removing the protected area for the logo if any part of the
logo is cleared.

Signed-off-by: Krzysztof Helt 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

fbcon: make logo_height a local variable

2008-07-24T17:47:37+00:00

Make logo_height variable local in the only function it is used.

Signed-off-by: Krzysztof Helt 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

device create: framebuffer: convert device_create to device_create_drvdata

2008-07-22T04:54:42+00:00

device_create() is race-prone, so use the race-free
device_create_drvdata() instead as device_create() is going away.

Cc: Antonino Daplas 
Signed-off-by: Greg Kroah-Hartman

fbcon: fix wrong vmode bits copied on console switch

2008-06-06T18:29:11+00:00

The interlaced and double line mode bits should not be copied to new
console when the console is switched.  Otherwise, the new console may be
set to incorrect refresh rate.

Also, the x and y offsets does not need to be copied.

Signed-off-by: Krzysztof Helt 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

vt/fbcon: fix background color on line feed

2008-05-13T15:02:26+00:00

Another addendum to commit c9e587abfdec2c2aaa55fab83bcb4972e2f84f9b
("vt: fix background color on line feed").

fbcon still was not doing the right thing (read: continued to do old
behavior).  fbcon_clear() seems to clear the new line (e.g.  where your new
prompt appears after doing echo -en "\e[42mfoo\n"), while scr_memsetw clears
the previous one only (where "foo" appears).  So just temporarily set the
video_erase_char to the scrl_erase_char so that fbcon_clear does the right
thing.

Signed-off-by: Jan Engelhardt 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

vt/fbcon: update scrl_erase_char after 256/512-glyph font switch

2008-05-13T15:02:26+00:00

Addendum to commit c9e587abfdec2c2aaa55fab83bcb4972e2f84f9b ("vt: fix
background color on line feed").

vc->vc_scrl_erase_char was not updated when fbcon switches between
256- and 512-glyph fonts.

Signed-off-by: Jan Engelhardt 
Acked-by: David S. Miller 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

vt: fix background color on line feed

2008-04-29T15:06:06+00:00

A command that causes a line feed while a background color is active,
such as

	perl -e 'print "x" x 60, "\e[44m", "x" x 40, "\e[0m\n"'
and
	perl -e 'print "x" x 40, "\e[44m\n", "x" x 40, "\e[0m\n"'

causes the line that was started as a result of the line feed to be completely
filled with the currently active background color instead of the default
color.

When scrolling, part of the current screen is memcpy'd/memmove'd to the new
region, and the new line(s) that will appear as a result are cleared using
memset.  However, the lines are cleared with vc->vc_video_erase_char, causing
them to be colored with the currently active background color.  This is
different from X11 terminal emulators which always paint the new lines with
the default background color (e.g.  `xterm -bg black`).

The clear operation (\e[1J and \e[2J) also use vc_video_erase_char, so a new
vc->vc_scrl_erase_char is introduced with contains the erase character used
for scrolling, which is built from vc->vc_def_color instead of vc->vc_color.

Signed-off-by: Jan Engelhardt 
Cc: "Antonino A. Daplas" 
Cc: "H. Peter Anvin" 
Cc: Alan Cox 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds