kernel/drivers/video/console/fbcon.c, branch linux-4.3.y

fbcon: initialize blink interval before calling fb_set_par

2015-10-18T05:00:39Z

Since commit 27a4c827c34ac4256a190cc9d24607f953c1c459 fbcon: use the cursor blink interval provided by vt a PPC64LE kernel fails to boot when fbcon_add_cursor_timer uses an uninitialized ops->cur_blink_jiffies. Prevent by initializing in fbcon_init before the call to info->fbops->fb_set_par. Reported-and-tested-by: Alistair Popple Signed-off-by: Scot Doyle Cc: [v4.2] Signed-off-by: Greg Kroah-Hartman

fbcon: unconditionally initialize cursor blink interval

2015-08-10T14:20:32Z

A sun7i-a20-olinuxino-micro fails to boot when kernel parameter vt.global_cursor_default=0. The value is copied to vc->vc_deccm causing the initialization of ops->cur_blink_jiffies to be skipped. Unconditionally initialize it. Reported-and-tested-by: Jonathan Liu Signed-off-by: Scot Doyle Acked-by: Pavel Machek Signed-off-by: Tomi Valkeinen

fbcon: Avoid deleting a timer in IRQ context

2015-05-27T12:55:38Z

Commit 27a4c827c34a ("fbcon: use the cursor blink interval provided by vt") unconditionally removes the cursor blink timer. Unfortunately that wreaks havoc under some circumstances. An easily reproducible way is to use both the framebuffer console and a debug serial port as the console output for kernel messages (e.g. "console=ttyS0 console=tty1" on the kernel command-line. Upon boot this triggers a warning from within the del_timer_sync() function because it is called from IRQ context: [ 5.070096] ------------[ cut here ]------------ [ 5.070110] WARNING: CPU: 0 PID: 0 at ../kernel/time/timer.c:1098 del_timer_sync+0x4c/0x54() [ 5.070115] Modules linked in: [ 5.070120] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.1.0-rc4-next-20150519 #1 [ 5.070123] Hardware name: SAMSUNG EXYNOS (Flattened Device Tree) [ 5.070142] [] (unwind_backtrace) from [] (show_stack+0x10/0x14) [ 5.070156] [] (show_stack) from [] (dump_stack+0x70/0xbc) [ 5.070164] [] (dump_stack) from [] (warn_slowpath_common+0x74/0xb0) [ 5.070169] [] (warn_slowpath_common) from [] (warn_slowpath_null+0x1c/0x24) [ 5.070174] [] (warn_slowpath_null) from [] (del_timer_sync+0x4c/0x54) [ 5.070183] [] (del_timer_sync) from [] (fbcon_del_cursor_timer+0x2c/0x40) [ 5.070190] [] (fbcon_del_cursor_timer) from [] (fbcon_cursor+0x9c/0x180) [ 5.070198] [] (fbcon_cursor) from [] (hide_cursor+0x30/0x98) [ 5.070204] [] (hide_cursor) from [] (vt_console_print+0x2a8/0x340) [ 5.070212] [] (vt_console_print) from [] (call_console_drivers.constprop.23+0xc8/0xec) [ 5.070218] [] (call_console_drivers.constprop.23) from [] (console_unlock+0x498/0x4f0) [ 5.070223] [] (console_unlock) from [] (vprintk_emit+0x1f0/0x508) [ 5.070228] [] (vprintk_emit) from [] (vprintk_default+0x24/0x2c) [ 5.070234] [] (vprintk_default) from [] (printk+0x70/0x88) After which the system starts spewing all kinds of weird and seemingly unrelated error messages. This commit fixes this by restoring the condition under which the call to fbcon_del_cursor_timer() happens. Reported-by: Daniel Stone Reported-by: Kevin Hilman Tested-by: Kevin Hilman Tested-by: Scot Doyle Signed-off-by: Thierry Reding Tested-by: Andrew Vagin Tested-by: Tomeu Vizoso Signed-off-by: Greg Kroah-Hartman

fbcon: use the cursor blink interval provided by vt

2015-05-10T17:15:52Z

vt now provides a cursor blink interval via vc_data. Use this interval instead of the currently hardcoded 200 msecs. Store it in fbcon_ops to avoid locking the console in cursor_timer_handler(). Signed-off-by: Scot Doyle Acked-by: Pavel Machek Signed-off-by: Greg Kroah-Hartman

fbcon: Remove unused vblank cursor code

2015-01-26T12:10:37Z

commit 1fa0b29f3a43 ("fbdev: Kill Atari vblank cursor blinking") rendered vbl_cursor_cnt and therefore CURSOR_DRAW_DELAY unused in fbcon.c, so remove them. Signed-off-by: Scot Doyle Signed-off-by: Tomi Valkeinen

fbcon: Change fbcon_init from module_init to fs_initcall

2014-11-14T13:29:11Z

Various fb drivers register themselves before module_init so as to have a console as early as possible, this is of little use if fbcon does not initialize early too. Fbcon cannot initialize earlier then fs_initcall, because then the creation of /sys/class/graphics/fbcon will fail. Signed-off-by: Hans de Goede Signed-off-by: Tomi Valkeinen

fbcon: Fix option parsing control flow in fb_console_setup

2014-10-22T06:49:40Z

Since strsep is used to tokenize the options string, after each option match the code should use "continue" to get the next token from strsep. This patch applies this pattern consistently. Previously, for "scrollback:" and "map:" the parse code would return (unconditionally: strsep ensures *options != ','), causing any following option to be ignored, while for "vc:" the parse code would go on to parse further options within the same token, which could lead to invalid input being accepted. Signed-off-by: Maarten ter Huurne Acked-by: Paul Cercueil Signed-off-by: Tomi Valkeinen

fbcon: Fix memory leak in con2fb_release_oldinfo()

2014-05-09T09:55:49Z

kmemleak reported a memory leak as below. unreferenced object 0xffff8800dab6d8d8 (size 96): comm "swapper/0", pid 1, jiffies 4294877598 (age 38.483s) hex dump (first 32 bytes): 00 00 00 00 00 01 00 00 08 00 00 00 10 00 00 00 ................ 07 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 ................ backtrace: [] kmemleak_alloc+0x4e/0xb0 [] __kmalloc+0x280/0x320 [] soft_cursor+0x231/0x290 [] bit_cursor+0x613/0x650 [] fbcon_cursor+0x13b/0x1c0 [] hide_cursor+0x28/0xa0 [] redraw_screen+0x168/0x240 [] fbcon_prepare_logo+0x381/0x420 [] fbcon_init+0x34e/0x590 [] visual_init+0xb8/0x120 [] do_bind_con_driver+0x163/0x380 [] do_take_over_console+0x114/0x1c0 [] do_fbcon_takeover+0x63/0xd0 [] fbcon_event_notify+0x68d/0x7e0 [] notifier_call_chain+0x4c/0x70 [] __blocking_notifier_call_chain+0x4d/0x70 This memory leak cause is, fbcon_ops's cursor_src is allocated in soft_cursor() but not released in con2fb_release_oldinfo(). so, cursor_src is needed to be released when oldinfo is going to be released. Signed-off-by: Masami Ichikawa Signed-off-by: Tomi Valkeinen

fbcon: Clean up fbcon data in fb_info on FB_EVENT_FB_UNBIND with 0 fbs

2014-02-11T12:16:22Z

When FB_EVENT_FB_UNBIND is sent, fbcon has two paths, one path taken when there is another frame buffer to switch any affected vcs to and another path when there isn't. In the case where there is another frame buffer to use, fbcon_fb_unbind calls set_con2fb_map to remap all of the affected vcs to the replacement frame buffer. set_con2fb_map will eventually call con2fb_release_oldinfo when the last vcs gets unmapped from the old frame buffer. con2fb_release_oldinfo frees the fbcon data that is hooked off of the fb_info structure, including the cursor timer. In the case where there isn't another frame buffer to use, fbcon_fb_unbind simply calls fbcon_unbind, which doesn't clear the con2fb_map or free the fbcon data hooked from the fb_info structure. In particular, it doesn't stop the cursor blink timer. When the fb_info structure is then freed, we end up with a timer queue pointing into freed memory and "bad things" start happening. This patch first changes con2fb_release_oldinfo so that it can take a NULL pointer for the new frame buffer, but still does all of the deallocation and cursor timer cleanup. Finally, the patch tries to replicate some of what set_con2fb_map does by clearing the con2fb_map for the affected vcs and calling the modified con2fb_release_info function to clean up the fb_info structure. Signed-off-by: Keith Packard Signed-off-by: Tomi Valkeinen

fbcon: Fix memory leak in fbcon_exit().

2014-01-17T08:57:44Z

kmemleak reported a memory leak as below. unreferenced object 0xffff880036ca84c0 (size 16): comm "swapper/0", pid 1, jiffies 4294877407 (age 4434.633s) hex dump (first 16 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ................ backtrace: [] kmemleak_alloc+0x4e/0xb0 [] __kmalloc+0x1fc/0x290 [] bit_cursor+0x24e/0x6c0 [] fbcon_cursor+0x154/0x1d0 [] hide_cursor+0x28/0xa0 [] update_region+0x6f/0x90 [] fbcon_switch+0x518/0x550 [] redraw_screen+0x189/0x240 [] do_bind_con_driver+0x360/0x380 [] do_take_over_console+0x114/0x1c0 [] do_fbcon_takeover+0x63/0xd0 [] fbcon_event_notify+0x605/0x720 [] notifier_call_chain+0x4c/0x70 [] __blocking_notifier_call_chain+0x4d/0x70 [] blocking_notifier_call_chain+0x16/0x20 [] fb_notifier_call_chain+0x1b/0x20 In this case ops->cursor_state.mask is allocated in bit_cursor() but not freed in fbcon_exit(). So, fbcon_exit() needs to free buffer in its process. In the case, fbcon_exit() was called from fbcon_deinit() when driver called remove_conflicting_framebuffers(). Signed-off-by: Masami Ichikawa Signed-off-by: Tomi Valkeinen