mirror of
https://github.com/torvalds/linux.git
synced 2024-12-26 21:02:19 +00:00
f6619ef750
The machine hang completely with the following message on the console: [ 487.777538] BUG: unable to handle kernel NULL pointer dereference at 0000000000000060 [ 487.777554] IP: [<ffffffff8158aaee>] _raw_spin_lock+0xe/0x30 [ 487.777557] PGD 42e9f7067 PUD 42f2fa067 PMD 0 [ 487.777560] Oops: 0002 [#1] SMP ... [ 487.777618] CPU: 21 PID: 3190 Comm: Xorg Tainted: G E 4.4.0-rc1-3-default+ #6 [ 487.777620] Hardware name: Intel Corporation BRICKLAND/BRICKLAND, BIOS BRHSXSD1.86B.0059.R00.1501081238 01/08/2015 [ 487.777621] task: ffff880853ae4680 ti: ffff8808696d4000 task.ti: ffff8808696d4000 [ 487.777625] RIP: 0010:[<ffffffff8158aaee>] [<ffffffff8158aaee>] _raw_spin_lock+0xe/0x30 [ 487.777627] RSP: 0018:ffff8808696d79c0 EFLAGS: 00010246 [ 487.777628] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ 487.777629] RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000060 [ 487.777630] RBP: ffff8808696d79e0 R08: 0000000000000000 R09: ffff88086924a780 [ 487.777631] R10: 000000000001bb40 R11: 0000000000003246 R12: 0000000000000000 [ 487.777632] R13: ffff880463a27360 R14: ffff88046ca50218 R15: 0000000000000080 [ 487.777634] FS: 00007f3f81c5a8c0(0000) GS:ffff88086f060000(0000) knlGS:0000000000000000 [ 487.777635] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 487.777636] CR2: 0000000000000060 CR3: 000000042e678000 CR4: 00000000001406e0 [ 487.777638] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 487.777639] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 487.777639] Stack: [ 487.777642] ffffffffa00eb5fa ffff8808696d7b60 ffff88086b87d800 0000000000000000 [ 487.777644] ffff8808696d7ac8 ffffffffa01694b6 ffff8808696d7ae8 ffffffff8109c8d5 [ 487.777647] ffff880469158740 ffff880463a27000 ffff88086b87d800 ffff88086b87d800 [ 487.777647] Call Trace: [ 487.777674] [<ffffffffa00eb5fa>] ? drm_gem_object_lookup+0x1a/0xa0 [drm] [ 487.777681] [<ffffffffa01694b6>] mga_crtc_cursor_set+0xc6/0xb60 [mgag200] [ 487.777691] [<ffffffff8109c8d5>] ? find_busiest_group+0x35/0x4a0 [ 487.777696] [<ffffffff81086294>] ? __might_sleep+0x44/0x80 [ 487.777699] [<ffffffff815888c2>] ? __ww_mutex_lock+0x22/0x9c [ 487.777722] [<ffffffffa0104f64>] ? drm_modeset_lock+0x34/0xf0 [drm] [ 487.777733] [<ffffffffa0148d9e>] restore_fbdev_mode+0xee/0x2a0 [drm_kms_helper] [ 487.777742] [<ffffffffa014afce>] drm_fb_helper_restore_fbdev_mode_unlocked+0x2e/0x70 [drm_kms_helper] [ 487.777748] [<ffffffffa014b037>] drm_fb_helper_set_par+0x27/0x50 [drm_kms_helper] [ 487.777752] [<ffffffff8134560c>] fb_set_var+0x18c/0x3f0 [ 487.777777] [<ffffffffa02a9b0a>] ? __ext4_handle_dirty_metadata+0x8a/0x210 [ext4] [ 487.777783] [<ffffffff8133cb97>] fbcon_blank+0x1b7/0x2b0 [ 487.777790] [<ffffffff813be2a3>] do_unblank_screen+0xb3/0x1c0 [ 487.777795] [<ffffffff813b5aba>] vt_ioctl+0x118a/0x1210 [ 487.777801] [<ffffffff813a8fe0>] tty_ioctl+0x3f0/0xc90 [ 487.777808] [<ffffffff81172018>] ? kzfree+0x28/0x30 [ 487.777813] [<ffffffff811e053f>] ? mntput+0x1f/0x30 [ 487.777817] [<ffffffff811d3f5d>] do_vfs_ioctl+0x30d/0x570 [ 487.777822] [<ffffffff8107ed3a>] ? task_work_run+0x8a/0xa0 [ 487.777825] [<ffffffff811d4234>] SyS_ioctl+0x74/0x80 [ 487.777829] [<ffffffff8158aeae>] entry_SYSCALL_64_fastpath+0x12/0x71 [ 487.777851] Code: 65 ff 0d ce 02 a8 7e 5d c3 ba 01 00 00 00 f0 0f b1 17 85 c0 75 e8 b0 01 5d c3 0f 1f 00 65 ff 05 b1 02 a8 7e 31 c0 ba 01 00 00 00 <f0> 0f b1 17 85 c0 75 01 c3 55 89 c6 48 89 e5 e8 4e f5 b1 ff 5d [ 487.777854] RIP [<ffffffff8158aaee>] _raw_spin_lock+0xe/0x30 [ 487.777855] RSP <ffff8808696d79c0> [ 487.777856] CR2: 0000000000000060 [ 487.777860] ---[ end trace 672a2cd555e0ebd3 ]--- The cursor code may be entered with file_priv == NULL && handle == NULL. The problem was introduced by: "bf89209 drm/mga200g: Hold a proper reference for cursor_set" which calls drm_gem_object_lookup(dev, file_priv...). Previously this wasn't a problem because we checked the handle. Move the check early in the function can fix the problem. Signed-off-by: Rui Wang <rui.y.wang@intel.com> Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch> Signed-off-by: Dave Airlie <airlied@redhat.com>
275 lines
7.2 KiB
C
275 lines
7.2 KiB
C
/*
|
|
* Copyright 2013 Matrox Graphics
|
|
*
|
|
* This file is subject to the terms and conditions of the GNU General
|
|
* Public License version 2. See the file COPYING in the main
|
|
* directory of this archive for more details.
|
|
*
|
|
* Author: Christopher Harvey <charvey@matrox.com>
|
|
*/
|
|
|
|
#include <drm/drmP.h>
|
|
#include "mgag200_drv.h"
|
|
|
|
static bool warn_transparent = true;
|
|
static bool warn_palette = true;
|
|
|
|
/*
|
|
Hide the cursor off screen. We can't disable the cursor hardware because it
|
|
takes too long to re-activate and causes momentary corruption
|
|
*/
|
|
static void mga_hide_cursor(struct mga_device *mdev)
|
|
{
|
|
WREG8(MGA_CURPOSXL, 0);
|
|
WREG8(MGA_CURPOSXH, 0);
|
|
if (mdev->cursor.pixels_1->pin_count)
|
|
mgag200_bo_unpin(mdev->cursor.pixels_1);
|
|
if (mdev->cursor.pixels_2->pin_count)
|
|
mgag200_bo_unpin(mdev->cursor.pixels_2);
|
|
}
|
|
|
|
int mga_crtc_cursor_set(struct drm_crtc *crtc,
|
|
struct drm_file *file_priv,
|
|
uint32_t handle,
|
|
uint32_t width,
|
|
uint32_t height)
|
|
{
|
|
struct drm_device *dev = crtc->dev;
|
|
struct mga_device *mdev = (struct mga_device *)dev->dev_private;
|
|
struct mgag200_bo *pixels_1 = mdev->cursor.pixels_1;
|
|
struct mgag200_bo *pixels_2 = mdev->cursor.pixels_2;
|
|
struct mgag200_bo *pixels_current = mdev->cursor.pixels_current;
|
|
struct mgag200_bo *pixels_prev = mdev->cursor.pixels_prev;
|
|
struct drm_gem_object *obj;
|
|
struct mgag200_bo *bo = NULL;
|
|
int ret = 0;
|
|
unsigned int i, row, col;
|
|
uint32_t colour_set[16];
|
|
uint32_t *next_space = &colour_set[0];
|
|
uint32_t *palette_iter;
|
|
uint32_t this_colour;
|
|
bool found = false;
|
|
int colour_count = 0;
|
|
u64 gpu_addr;
|
|
u8 reg_index;
|
|
u8 this_row[48];
|
|
|
|
if (!pixels_1 || !pixels_2) {
|
|
WREG8(MGA_CURPOSXL, 0);
|
|
WREG8(MGA_CURPOSXH, 0);
|
|
return -ENOTSUPP; /* Didn't allocate space for cursors */
|
|
}
|
|
|
|
if ((width != 64 || height != 64) && handle) {
|
|
WREG8(MGA_CURPOSXL, 0);
|
|
WREG8(MGA_CURPOSXH, 0);
|
|
return -EINVAL;
|
|
}
|
|
|
|
BUG_ON(pixels_1 != pixels_current && pixels_1 != pixels_prev);
|
|
BUG_ON(pixels_2 != pixels_current && pixels_2 != pixels_prev);
|
|
BUG_ON(pixels_current == pixels_prev);
|
|
|
|
if (!handle || !file_priv) {
|
|
mga_hide_cursor(mdev);
|
|
return 0;
|
|
}
|
|
|
|
obj = drm_gem_object_lookup(dev, file_priv, handle);
|
|
if (!obj)
|
|
return -ENOENT;
|
|
|
|
ret = mgag200_bo_reserve(pixels_1, true);
|
|
if (ret) {
|
|
WREG8(MGA_CURPOSXL, 0);
|
|
WREG8(MGA_CURPOSXH, 0);
|
|
goto out_unref;
|
|
}
|
|
ret = mgag200_bo_reserve(pixels_2, true);
|
|
if (ret) {
|
|
WREG8(MGA_CURPOSXL, 0);
|
|
WREG8(MGA_CURPOSXH, 0);
|
|
mgag200_bo_unreserve(pixels_1);
|
|
goto out_unreserve1;
|
|
}
|
|
|
|
/* Move cursor buffers into VRAM if they aren't already */
|
|
if (!pixels_1->pin_count) {
|
|
ret = mgag200_bo_pin(pixels_1, TTM_PL_FLAG_VRAM,
|
|
&mdev->cursor.pixels_1_gpu_addr);
|
|
if (ret)
|
|
goto out1;
|
|
}
|
|
if (!pixels_2->pin_count) {
|
|
ret = mgag200_bo_pin(pixels_2, TTM_PL_FLAG_VRAM,
|
|
&mdev->cursor.pixels_2_gpu_addr);
|
|
if (ret) {
|
|
mgag200_bo_unpin(pixels_1);
|
|
goto out1;
|
|
}
|
|
}
|
|
|
|
bo = gem_to_mga_bo(obj);
|
|
ret = mgag200_bo_reserve(bo, true);
|
|
if (ret) {
|
|
dev_err(&dev->pdev->dev, "failed to reserve user bo\n");
|
|
goto out1;
|
|
}
|
|
if (!bo->kmap.virtual) {
|
|
ret = ttm_bo_kmap(&bo->bo, 0, bo->bo.num_pages, &bo->kmap);
|
|
if (ret) {
|
|
dev_err(&dev->pdev->dev, "failed to kmap user buffer updates\n");
|
|
goto out2;
|
|
}
|
|
}
|
|
|
|
memset(&colour_set[0], 0, sizeof(uint32_t)*16);
|
|
/* width*height*4 = 16384 */
|
|
for (i = 0; i < 16384; i += 4) {
|
|
this_colour = ioread32(bo->kmap.virtual + i);
|
|
/* No transparency */
|
|
if (this_colour>>24 != 0xff &&
|
|
this_colour>>24 != 0x0) {
|
|
if (warn_transparent) {
|
|
dev_info(&dev->pdev->dev, "Video card doesn't support cursors with partial transparency.\n");
|
|
dev_info(&dev->pdev->dev, "Not enabling hardware cursor.\n");
|
|
warn_transparent = false; /* Only tell the user once. */
|
|
}
|
|
ret = -EINVAL;
|
|
goto out3;
|
|
}
|
|
/* Don't need to store transparent pixels as colours */
|
|
if (this_colour>>24 == 0x0)
|
|
continue;
|
|
found = false;
|
|
for (palette_iter = &colour_set[0]; palette_iter != next_space; palette_iter++) {
|
|
if (*palette_iter == this_colour) {
|
|
found = true;
|
|
break;
|
|
}
|
|
}
|
|
if (found)
|
|
continue;
|
|
/* We only support 4bit paletted cursors */
|
|
if (colour_count >= 16) {
|
|
if (warn_palette) {
|
|
dev_info(&dev->pdev->dev, "Video card only supports cursors with up to 16 colours.\n");
|
|
dev_info(&dev->pdev->dev, "Not enabling hardware cursor.\n");
|
|
warn_palette = false; /* Only tell the user once. */
|
|
}
|
|
ret = -EINVAL;
|
|
goto out3;
|
|
}
|
|
*next_space = this_colour;
|
|
next_space++;
|
|
colour_count++;
|
|
}
|
|
|
|
/* Program colours from cursor icon into palette */
|
|
for (i = 0; i < colour_count; i++) {
|
|
if (i <= 2)
|
|
reg_index = 0x8 + i*0x4;
|
|
else
|
|
reg_index = 0x60 + i*0x3;
|
|
WREG_DAC(reg_index, colour_set[i] & 0xff);
|
|
WREG_DAC(reg_index+1, colour_set[i]>>8 & 0xff);
|
|
WREG_DAC(reg_index+2, colour_set[i]>>16 & 0xff);
|
|
BUG_ON((colour_set[i]>>24 & 0xff) != 0xff);
|
|
}
|
|
|
|
/* Map up-coming buffer to write colour indices */
|
|
if (!pixels_prev->kmap.virtual) {
|
|
ret = ttm_bo_kmap(&pixels_prev->bo, 0,
|
|
pixels_prev->bo.num_pages,
|
|
&pixels_prev->kmap);
|
|
if (ret) {
|
|
dev_err(&dev->pdev->dev, "failed to kmap cursor updates\n");
|
|
goto out3;
|
|
}
|
|
}
|
|
|
|
/* now write colour indices into hardware cursor buffer */
|
|
for (row = 0; row < 64; row++) {
|
|
memset(&this_row[0], 0, 48);
|
|
for (col = 0; col < 64; col++) {
|
|
this_colour = ioread32(bo->kmap.virtual + 4*(col + 64*row));
|
|
/* write transparent pixels */
|
|
if (this_colour>>24 == 0x0) {
|
|
this_row[47 - col/8] |= 0x80>>(col%8);
|
|
continue;
|
|
}
|
|
|
|
/* write colour index here */
|
|
for (i = 0; i < colour_count; i++) {
|
|
if (colour_set[i] == this_colour) {
|
|
if (col % 2)
|
|
this_row[col/2] |= i<<4;
|
|
else
|
|
this_row[col/2] |= i;
|
|
break;
|
|
}
|
|
}
|
|
}
|
|
memcpy_toio(pixels_prev->kmap.virtual + row*48, &this_row[0], 48);
|
|
}
|
|
|
|
/* Program gpu address of cursor buffer */
|
|
if (pixels_prev == pixels_1)
|
|
gpu_addr = mdev->cursor.pixels_1_gpu_addr;
|
|
else
|
|
gpu_addr = mdev->cursor.pixels_2_gpu_addr;
|
|
WREG_DAC(MGA1064_CURSOR_BASE_ADR_LOW, (u8)((gpu_addr>>10) & 0xff));
|
|
WREG_DAC(MGA1064_CURSOR_BASE_ADR_HI, (u8)((gpu_addr>>18) & 0x3f));
|
|
|
|
/* Adjust cursor control register to turn on the cursor */
|
|
WREG_DAC(MGA1064_CURSOR_CTL, 4); /* 16-colour palletized cursor mode */
|
|
|
|
/* Now swap internal buffer pointers */
|
|
if (mdev->cursor.pixels_1 == mdev->cursor.pixels_prev) {
|
|
mdev->cursor.pixels_prev = mdev->cursor.pixels_2;
|
|
mdev->cursor.pixels_current = mdev->cursor.pixels_1;
|
|
} else if (mdev->cursor.pixels_1 == mdev->cursor.pixels_current) {
|
|
mdev->cursor.pixels_prev = mdev->cursor.pixels_1;
|
|
mdev->cursor.pixels_current = mdev->cursor.pixels_2;
|
|
} else {
|
|
BUG();
|
|
}
|
|
ret = 0;
|
|
|
|
ttm_bo_kunmap(&pixels_prev->kmap);
|
|
out3:
|
|
ttm_bo_kunmap(&bo->kmap);
|
|
out2:
|
|
mgag200_bo_unreserve(bo);
|
|
out1:
|
|
if (ret)
|
|
mga_hide_cursor(mdev);
|
|
mgag200_bo_unreserve(pixels_1);
|
|
out_unreserve1:
|
|
mgag200_bo_unreserve(pixels_2);
|
|
out_unref:
|
|
drm_gem_object_unreference_unlocked(obj);
|
|
|
|
return ret;
|
|
}
|
|
|
|
int mga_crtc_cursor_move(struct drm_crtc *crtc, int x, int y)
|
|
{
|
|
struct mga_device *mdev = (struct mga_device *)crtc->dev->dev_private;
|
|
/* Our origin is at (64,64) */
|
|
x += 64;
|
|
y += 64;
|
|
|
|
BUG_ON(x <= 0);
|
|
BUG_ON(y <= 0);
|
|
BUG_ON(x & ~0xffff);
|
|
BUG_ON(y & ~0xffff);
|
|
|
|
WREG8(MGA_CURPOSXL, x & 0xff);
|
|
WREG8(MGA_CURPOSXH, (x>>8) & 0xff);
|
|
|
|
WREG8(MGA_CURPOSYL, y & 0xff);
|
|
WREG8(MGA_CURPOSYH, (y>>8) & 0xff);
|
|
return 0;
|
|
}
|