![Gabriel Krisman Bertazi](/assets/img/avatar_default.png)
If fbdev emulation is disabled, the QXL shutdown path will try to clean a framebuffer that wasn't initialized, hitting the Oops below. The problem is that even when FBDEV_EMULATION is disabled we allocate the qfbdev strutucture, but we don't initialize it. The fix is to stop allocating the memory, since it won't be used. This allows the existing verification in the cleanup hook to do it's job preventing the oops. Now that we don't allocate the unused fbdev structure, we need to be careful when dereferencing it in the PM suspend hook. [ 24.284684] BUG: unable to handle kernel NULL pointer dereference at 00000000000002e0 [ 24.285627] IP: mutex_lock+0x18/0x30 [ 24.286049] PGD 78cdf067 [ 24.286050] PUD 7940f067 [ 24.286344] PMD 0 [ 24.286649] [ 24.287072] Oops: 0002 [#1] SMP [ 24.287422] Modules linked in: qxl [ 24.287806] CPU: 0 PID: 2328 Comm: bash Not tainted 4.10.0-rc5+ #97 [ 24.288515] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.9.3-20161025_171302-gandalf 04/01/2014 [ 24.289681] task: ffff88007c4c0000 task.stack: ffffc90001b58000 [ 24.290354] RIP: 0010:mutex_lock+0x18/0x30 [ 24.290812] RSP: 0018:ffffc90001b5bcb0 EFLAGS: 00010246 [ 24.291401] RAX: 0000000000000000 RBX: 00000000000002e0 RCX: 0000000000000000 [ 24.292209] RDX: ffff88007c4c0000 RSI: 0000000000000001 RDI: 00000000000002e0 [ 24.292987] RBP: ffffc90001b5bcb8 R08: fffffffffffffffe R09: 0000000000000001 [ 24.293797] R10: ffff880078d80b80 R11: 0000000000011400 R12: 0000000000000000 [ 24.294601] R13: 00000000000002e0 R14: ffffffffa0009c28 R15: 0000000000000060 [ 24.295439] FS: 00007f30e3acbb40(0000) GS:ffff88007fc00000(0000) knlGS:0000000000000000 [ 24.296364] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 24.296997] CR2: 00000000000002e0 CR3: 0000000078c7b000 CR4: 00000000000006f0 [ 24.297813] Call Trace: [ 24.298097] drm_framebuffer_cleanup+0x1f/0x70 [ 24.298612] qxl_fbdev_fini+0x68/0x90 [qxl] [ 24.299074] qxl_modeset_fini+0xd/0x30 [qxl] [ 24.299562] qxl_pci_remove+0x22/0x50 [qxl] [ 24.300025] pci_device_remove+0x34/0xb0 [ 24.300507] device_release_driver_internal+0x150/0x200 [ 24.301082] device_release_driver+0xd/0x10 [ 24.301587] unbind_store+0x108/0x150 [ 24.301993] drv_attr_store+0x20/0x30 [ 24.302402] sysfs_kf_write+0x32/0x40 [ 24.302827] kernfs_fop_write+0x108/0x190 [ 24.303269] __vfs_write+0x23/0x120 [ 24.303678] ? security_file_permission+0x36/0xb0 [ 24.304193] ? rw_verify_area+0x49/0xb0 [ 24.304636] vfs_write+0xb0/0x190 [ 24.305004] SyS_write+0x41/0xa0 [ 24.305362] entry_SYSCALL_64_fastpath+0x1a/0xa9 [ 24.305887] RIP: 0033:0x7f30e31d9620 [ 24.306285] RSP: 002b:00007ffc54b47e68 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 24.307128] RAX: ffffffffffffffda RBX: 00007f30e3497600 RCX: 00007f30e31d9620 [ 24.307928] RDX: 000000000000000d RSI: 0000000000da2008 RDI: 0000000000000001 [ 24.308727] RBP: 000000000070bc60 R08: 00007f30e3498760 R09: 00007f30e3acbb40 [ 24.309504] R10: 0000000000000073 R11: 0000000000000246 R12: 0000000000000001 [ 24.310295] R13: 0000000000000000 R14: 0000000000000000 R15: 00007ffc54b47f34 [ 24.311095] Code: 0e 01 e9 7b fe ff ff 66 90 66 2e 0f 1f 84 00 00 00 00 00 55 48 89 e5 53 48 89 fb e8 83 e8 ff ff 65 48 8b 14 25 40 c4 00 00 31 c0 <3e> 48 0f b1 13 48 85 c0 74 08 48 89 df e8 66 fd ff ff 5b 5d c3 [ 24.313182] RIP: mutex_lock+0x18/0x30 RSP: ffffc90001b5bcb0 [ 24.313811] CR2: 00000000000002e0 [ 24.314208] ---[ end trace 29669c1593cae14b ]--- Signed-off-by: Gabriel Krisman Bertazi <krisman@collabora.co.uk> Link: http://patchwork.freedesktop.org/patch/msgid/20170227203330.18542-1-krisman@collabora.co.uk Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
437 lines
11 KiB
C
437 lines
11 KiB
C
/*
|
|
* Copyright © 2013 Red Hat
|
|
*
|
|
* Permission is hereby granted, free of charge, to any person obtaining a
|
|
* copy of this software and associated documentation files (the "Software"),
|
|
* to deal in the Software without restriction, including without limitation
|
|
* the rights to use, copy, modify, merge, publish, distribute, sublicense,
|
|
* and/or sell copies of the Software, and to permit persons to whom the
|
|
* Software is furnished to do so, subject to the following conditions:
|
|
*
|
|
* The above copyright notice and this permission notice (including the next
|
|
* paragraph) shall be included in all copies or substantial portions of the
|
|
* Software.
|
|
*
|
|
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
|
* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
|
* FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
|
|
* THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
|
* LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
|
|
* FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
|
|
* DEALINGS IN THE SOFTWARE.
|
|
*
|
|
* Authors:
|
|
* David Airlie
|
|
*/
|
|
#include <linux/module.h>
|
|
|
|
#include "drmP.h"
|
|
#include "drm/drm.h"
|
|
#include "drm/drm_crtc.h"
|
|
#include "drm/drm_crtc_helper.h"
|
|
#include "qxl_drv.h"
|
|
|
|
#include "qxl_object.h"
|
|
#include "drm_fb_helper.h"
|
|
|
|
#define QXL_DIRTY_DELAY (HZ / 30)
|
|
|
|
struct qxl_fbdev {
|
|
struct drm_fb_helper helper;
|
|
struct qxl_framebuffer qfb;
|
|
struct qxl_device *qdev;
|
|
|
|
spinlock_t delayed_ops_lock;
|
|
struct list_head delayed_ops;
|
|
void *shadow;
|
|
int size;
|
|
};
|
|
|
|
static void qxl_fb_image_init(struct qxl_fb_image *qxl_fb_image,
|
|
struct qxl_device *qdev, struct fb_info *info,
|
|
const struct fb_image *image)
|
|
{
|
|
qxl_fb_image->qdev = qdev;
|
|
if (info) {
|
|
qxl_fb_image->visual = info->fix.visual;
|
|
if (qxl_fb_image->visual == FB_VISUAL_TRUECOLOR ||
|
|
qxl_fb_image->visual == FB_VISUAL_DIRECTCOLOR)
|
|
memcpy(&qxl_fb_image->pseudo_palette,
|
|
info->pseudo_palette,
|
|
sizeof(qxl_fb_image->pseudo_palette));
|
|
} else {
|
|
/* fallback */
|
|
if (image->depth == 1)
|
|
qxl_fb_image->visual = FB_VISUAL_MONO10;
|
|
else
|
|
qxl_fb_image->visual = FB_VISUAL_DIRECTCOLOR;
|
|
}
|
|
if (image) {
|
|
memcpy(&qxl_fb_image->fb_image, image,
|
|
sizeof(qxl_fb_image->fb_image));
|
|
}
|
|
}
|
|
|
|
#ifdef CONFIG_DRM_FBDEV_EMULATION
|
|
static struct fb_deferred_io qxl_defio = {
|
|
.delay = QXL_DIRTY_DELAY,
|
|
.deferred_io = drm_fb_helper_deferred_io,
|
|
};
|
|
#endif
|
|
|
|
static struct fb_ops qxlfb_ops = {
|
|
.owner = THIS_MODULE,
|
|
DRM_FB_HELPER_DEFAULT_OPS,
|
|
.fb_fillrect = drm_fb_helper_sys_fillrect,
|
|
.fb_copyarea = drm_fb_helper_sys_copyarea,
|
|
.fb_imageblit = drm_fb_helper_sys_imageblit,
|
|
};
|
|
|
|
static void qxlfb_destroy_pinned_object(struct drm_gem_object *gobj)
|
|
{
|
|
struct qxl_bo *qbo = gem_to_qxl_bo(gobj);
|
|
|
|
qxl_bo_kunmap(qbo);
|
|
qxl_bo_unpin(qbo);
|
|
|
|
drm_gem_object_unreference_unlocked(gobj);
|
|
}
|
|
|
|
int qxl_get_handle_for_primary_fb(struct qxl_device *qdev,
|
|
struct drm_file *file_priv,
|
|
uint32_t *handle)
|
|
{
|
|
int r;
|
|
struct drm_gem_object *gobj = qdev->fbdev_qfb->obj;
|
|
|
|
BUG_ON(!gobj);
|
|
/* drm_get_handle_create adds a reference - good */
|
|
r = drm_gem_handle_create(file_priv, gobj, handle);
|
|
if (r)
|
|
return r;
|
|
return 0;
|
|
}
|
|
|
|
static int qxlfb_create_pinned_object(struct qxl_fbdev *qfbdev,
|
|
const struct drm_mode_fb_cmd2 *mode_cmd,
|
|
struct drm_gem_object **gobj_p)
|
|
{
|
|
struct qxl_device *qdev = qfbdev->qdev;
|
|
struct drm_gem_object *gobj = NULL;
|
|
struct qxl_bo *qbo = NULL;
|
|
int ret;
|
|
int aligned_size, size;
|
|
int height = mode_cmd->height;
|
|
|
|
size = mode_cmd->pitches[0] * height;
|
|
aligned_size = ALIGN(size, PAGE_SIZE);
|
|
/* TODO: unallocate and reallocate surface0 for real. Hack to just
|
|
* have a large enough surface0 for 1024x768 Xorg 32bpp mode */
|
|
ret = qxl_gem_object_create(qdev, aligned_size, 0,
|
|
QXL_GEM_DOMAIN_SURFACE,
|
|
false, /* is discardable */
|
|
false, /* is kernel (false means device) */
|
|
NULL,
|
|
&gobj);
|
|
if (ret) {
|
|
pr_err("failed to allocate framebuffer (%d)\n",
|
|
aligned_size);
|
|
return -ENOMEM;
|
|
}
|
|
qbo = gem_to_qxl_bo(gobj);
|
|
|
|
qbo->surf.width = mode_cmd->width;
|
|
qbo->surf.height = mode_cmd->height;
|
|
qbo->surf.stride = mode_cmd->pitches[0];
|
|
qbo->surf.format = SPICE_SURFACE_FMT_32_xRGB;
|
|
|
|
ret = qxl_bo_pin(qbo, QXL_GEM_DOMAIN_SURFACE, NULL);
|
|
if (ret) {
|
|
goto out_unref;
|
|
}
|
|
ret = qxl_bo_kmap(qbo, NULL);
|
|
|
|
if (ret)
|
|
goto out_unref;
|
|
|
|
*gobj_p = gobj;
|
|
return 0;
|
|
out_unref:
|
|
qxlfb_destroy_pinned_object(gobj);
|
|
*gobj_p = NULL;
|
|
return ret;
|
|
}
|
|
|
|
/*
|
|
* FIXME
|
|
* It should not be necessary to have a special dirty() callback for fbdev.
|
|
*/
|
|
static int qxlfb_framebuffer_dirty(struct drm_framebuffer *fb,
|
|
struct drm_file *file_priv,
|
|
unsigned flags, unsigned color,
|
|
struct drm_clip_rect *clips,
|
|
unsigned num_clips)
|
|
{
|
|
struct qxl_device *qdev = fb->dev->dev_private;
|
|
struct fb_info *info = qdev->fbdev_info;
|
|
struct qxl_fbdev *qfbdev = info->par;
|
|
struct qxl_fb_image qxl_fb_image;
|
|
struct fb_image *image = &qxl_fb_image.fb_image;
|
|
|
|
/* TODO: hard coding 32 bpp */
|
|
int stride = qfbdev->qfb.base.pitches[0];
|
|
|
|
/*
|
|
* we are using a shadow draw buffer, at qdev->surface0_shadow
|
|
*/
|
|
qxl_io_log(qdev, "dirty x[%d, %d], y[%d, %d]\n", clips->x1, clips->x2,
|
|
clips->y1, clips->y2);
|
|
image->dx = clips->x1;
|
|
image->dy = clips->y1;
|
|
image->width = clips->x2 - clips->x1;
|
|
image->height = clips->y2 - clips->y1;
|
|
image->fg_color = 0xffffffff; /* unused, just to avoid uninitialized
|
|
warnings */
|
|
image->bg_color = 0;
|
|
image->depth = 32; /* TODO: take from somewhere? */
|
|
image->cmap.start = 0;
|
|
image->cmap.len = 0;
|
|
image->cmap.red = NULL;
|
|
image->cmap.green = NULL;
|
|
image->cmap.blue = NULL;
|
|
image->cmap.transp = NULL;
|
|
image->data = qfbdev->shadow + (clips->x1 * 4) + (stride * clips->y1);
|
|
|
|
qxl_fb_image_init(&qxl_fb_image, qdev, info, NULL);
|
|
qxl_draw_opaque_fb(&qxl_fb_image, stride);
|
|
|
|
return 0;
|
|
}
|
|
|
|
static const struct drm_framebuffer_funcs qxlfb_fb_funcs = {
|
|
.destroy = qxl_user_framebuffer_destroy,
|
|
.dirty = qxlfb_framebuffer_dirty,
|
|
};
|
|
|
|
static int qxlfb_create(struct qxl_fbdev *qfbdev,
|
|
struct drm_fb_helper_surface_size *sizes)
|
|
{
|
|
struct qxl_device *qdev = qfbdev->qdev;
|
|
struct fb_info *info;
|
|
struct drm_framebuffer *fb = NULL;
|
|
struct drm_mode_fb_cmd2 mode_cmd;
|
|
struct drm_gem_object *gobj = NULL;
|
|
struct qxl_bo *qbo = NULL;
|
|
int ret;
|
|
int size;
|
|
int bpp = sizes->surface_bpp;
|
|
int depth = sizes->surface_depth;
|
|
void *shadow;
|
|
|
|
mode_cmd.width = sizes->surface_width;
|
|
mode_cmd.height = sizes->surface_height;
|
|
|
|
mode_cmd.pitches[0] = ALIGN(mode_cmd.width * ((bpp + 1) / 8), 64);
|
|
mode_cmd.pixel_format = drm_mode_legacy_fb_format(bpp, depth);
|
|
|
|
ret = qxlfb_create_pinned_object(qfbdev, &mode_cmd, &gobj);
|
|
if (ret < 0)
|
|
return ret;
|
|
|
|
qbo = gem_to_qxl_bo(gobj);
|
|
QXL_INFO(qdev, "%s: %dx%d %d\n", __func__, mode_cmd.width,
|
|
mode_cmd.height, mode_cmd.pitches[0]);
|
|
|
|
shadow = vmalloc(mode_cmd.pitches[0] * mode_cmd.height);
|
|
/* TODO: what's the usual response to memory allocation errors? */
|
|
BUG_ON(!shadow);
|
|
QXL_INFO(qdev,
|
|
"surface0 at gpu offset %lld, mmap_offset %lld (virt %p, shadow %p)\n",
|
|
qxl_bo_gpu_offset(qbo),
|
|
qxl_bo_mmap_offset(qbo),
|
|
qbo->kptr,
|
|
shadow);
|
|
size = mode_cmd.pitches[0] * mode_cmd.height;
|
|
|
|
info = drm_fb_helper_alloc_fbi(&qfbdev->helper);
|
|
if (IS_ERR(info)) {
|
|
ret = PTR_ERR(info);
|
|
goto out_unref;
|
|
}
|
|
|
|
info->par = qfbdev;
|
|
|
|
qxl_framebuffer_init(&qdev->ddev, &qfbdev->qfb, &mode_cmd, gobj,
|
|
&qxlfb_fb_funcs);
|
|
|
|
fb = &qfbdev->qfb.base;
|
|
|
|
/* setup helper with fb data */
|
|
qfbdev->helper.fb = fb;
|
|
|
|
qfbdev->shadow = shadow;
|
|
strcpy(info->fix.id, "qxldrmfb");
|
|
|
|
drm_fb_helper_fill_fix(info, fb->pitches[0], fb->format->depth);
|
|
|
|
info->flags = FBINFO_DEFAULT | FBINFO_HWACCEL_COPYAREA | FBINFO_HWACCEL_FILLRECT;
|
|
info->fbops = &qxlfb_ops;
|
|
|
|
/*
|
|
* TODO: using gobj->size in various places in this function. Not sure
|
|
* what the difference between the different sizes is.
|
|
*/
|
|
info->fix.smem_start = qdev->vram_base; /* TODO - correct? */
|
|
info->fix.smem_len = gobj->size;
|
|
info->screen_base = qfbdev->shadow;
|
|
info->screen_size = gobj->size;
|
|
|
|
drm_fb_helper_fill_var(info, &qfbdev->helper, sizes->fb_width,
|
|
sizes->fb_height);
|
|
|
|
/* setup aperture base/size for vesafb takeover */
|
|
info->apertures->ranges[0].base = qdev->ddev.mode_config.fb_base;
|
|
info->apertures->ranges[0].size = qdev->vram_size;
|
|
|
|
info->fix.mmio_start = 0;
|
|
info->fix.mmio_len = 0;
|
|
|
|
if (info->screen_base == NULL) {
|
|
ret = -ENOSPC;
|
|
goto out_unref;
|
|
}
|
|
|
|
#ifdef CONFIG_DRM_FBDEV_EMULATION
|
|
info->fbdefio = &qxl_defio;
|
|
fb_deferred_io_init(info);
|
|
#endif
|
|
|
|
qdev->fbdev_info = info;
|
|
qdev->fbdev_qfb = &qfbdev->qfb;
|
|
DRM_INFO("fb mappable at 0x%lX, size %lu\n", info->fix.smem_start, (unsigned long)info->screen_size);
|
|
DRM_INFO("fb: depth %d, pitch %d, width %d, height %d\n",
|
|
fb->format->depth, fb->pitches[0], fb->width, fb->height);
|
|
return 0;
|
|
|
|
out_unref:
|
|
if (qbo) {
|
|
qxl_bo_kunmap(qbo);
|
|
qxl_bo_unpin(qbo);
|
|
}
|
|
if (fb && ret) {
|
|
drm_gem_object_unreference_unlocked(gobj);
|
|
drm_framebuffer_cleanup(fb);
|
|
kfree(fb);
|
|
}
|
|
drm_gem_object_unreference_unlocked(gobj);
|
|
return ret;
|
|
}
|
|
|
|
static int qxl_fb_find_or_create_single(
|
|
struct drm_fb_helper *helper,
|
|
struct drm_fb_helper_surface_size *sizes)
|
|
{
|
|
struct qxl_fbdev *qfbdev =
|
|
container_of(helper, struct qxl_fbdev, helper);
|
|
int new_fb = 0;
|
|
int ret;
|
|
|
|
if (!helper->fb) {
|
|
ret = qxlfb_create(qfbdev, sizes);
|
|
if (ret)
|
|
return ret;
|
|
new_fb = 1;
|
|
}
|
|
return new_fb;
|
|
}
|
|
|
|
static int qxl_fbdev_destroy(struct drm_device *dev, struct qxl_fbdev *qfbdev)
|
|
{
|
|
struct qxl_framebuffer *qfb = &qfbdev->qfb;
|
|
|
|
drm_fb_helper_unregister_fbi(&qfbdev->helper);
|
|
|
|
if (qfb->obj) {
|
|
qxlfb_destroy_pinned_object(qfb->obj);
|
|
qfb->obj = NULL;
|
|
}
|
|
drm_fb_helper_fini(&qfbdev->helper);
|
|
vfree(qfbdev->shadow);
|
|
drm_framebuffer_cleanup(&qfb->base);
|
|
|
|
return 0;
|
|
}
|
|
|
|
static const struct drm_fb_helper_funcs qxl_fb_helper_funcs = {
|
|
.fb_probe = qxl_fb_find_or_create_single,
|
|
};
|
|
|
|
int qxl_fbdev_init(struct qxl_device *qdev)
|
|
{
|
|
int ret = 0;
|
|
|
|
#ifdef CONFIG_DRM_FBDEV_EMULATION
|
|
struct qxl_fbdev *qfbdev;
|
|
int bpp_sel = 32; /* TODO: parameter from somewhere? */
|
|
|
|
qfbdev = kzalloc(sizeof(struct qxl_fbdev), GFP_KERNEL);
|
|
if (!qfbdev)
|
|
return -ENOMEM;
|
|
|
|
qfbdev->qdev = qdev;
|
|
qdev->mode_info.qfbdev = qfbdev;
|
|
spin_lock_init(&qfbdev->delayed_ops_lock);
|
|
INIT_LIST_HEAD(&qfbdev->delayed_ops);
|
|
|
|
drm_fb_helper_prepare(&qdev->ddev, &qfbdev->helper,
|
|
&qxl_fb_helper_funcs);
|
|
|
|
ret = drm_fb_helper_init(&qdev->ddev, &qfbdev->helper,
|
|
QXLFB_CONN_LIMIT);
|
|
if (ret)
|
|
goto free;
|
|
|
|
ret = drm_fb_helper_single_add_all_connectors(&qfbdev->helper);
|
|
if (ret)
|
|
goto fini;
|
|
|
|
ret = drm_fb_helper_initial_config(&qfbdev->helper, bpp_sel);
|
|
if (ret)
|
|
goto fini;
|
|
|
|
return 0;
|
|
|
|
fini:
|
|
drm_fb_helper_fini(&qfbdev->helper);
|
|
free:
|
|
kfree(qfbdev);
|
|
#endif
|
|
|
|
return ret;
|
|
}
|
|
|
|
void qxl_fbdev_fini(struct qxl_device *qdev)
|
|
{
|
|
if (!qdev->mode_info.qfbdev)
|
|
return;
|
|
|
|
qxl_fbdev_destroy(&qdev->ddev, qdev->mode_info.qfbdev);
|
|
kfree(qdev->mode_info.qfbdev);
|
|
qdev->mode_info.qfbdev = NULL;
|
|
}
|
|
|
|
void qxl_fbdev_set_suspend(struct qxl_device *qdev, int state)
|
|
{
|
|
if (!qdev->mode_info.qfbdev)
|
|
return;
|
|
|
|
drm_fb_helper_set_suspend(&qdev->mode_info.qfbdev->helper, state);
|
|
}
|
|
|
|
bool qxl_fbdev_qobj_is_fb(struct qxl_device *qdev, struct qxl_bo *qobj)
|
|
{
|
|
if (qobj == gem_to_qxl_bo(qdev->mode_info.qfbdev->qfb.obj))
|
|
return true;
|
|
return false;
|
|
}
|