Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

bcm2708_fb_check_var doesn't account for screen rotation #463

Closed
mschorer opened this issue Dec 17, 2013 · 27 comments
Closed

bcm2708_fb_check_var doesn't account for screen rotation #463

mschorer opened this issue Dec 17, 2013 · 27 comments

Comments

@mschorer
Copy link

we're using fullHD screens with screen_rotation set to 90/270 degrees.
we're also using "tvservice -o/-p" to send the display to sleep/wakeup ...
tvservice returns an error ...

this works perfectly if the screen is rotated 0/180 degrees, but fails if rotation is 90/270 ... as is obvious from https://github.com/raspberrypi/linux/blob/rpi-3.6.y/drivers/video/bcm2708_fb.c#L194

the comparison needs to be rotation-aware? e.g.

if (( <screen_rot> & 0x01) ? (xres > 1200) : (yres > 1200)) {
@popcornmix
Copy link
Collaborator

Perhaps

if (xres * yres > 1920 * 1200 || xres > 1920 || yres > 1920)

would be sufficient. I think the 1200 limit is more a sanity check than an absolute limit.
There's a danger if too high a resolution is selected you may get no image at all, so I'll need to check it's not easy to create an an invalid framebuffer with this change.

@mschorer
Copy link
Author

fine for me ... when can i have it? ;-)

@popcornmix
Copy link
Collaborator

Source is pushed (76d183f) and I've sanity checked:

tvservice -o && tvservice -p && fbset -depth 8 && fbset -depth 16

does the right thing. Should be in next rpi-update (probably at weekend).

@mschorer
Copy link
Author

Perfect!
On 30 Jan 2014 18:44, "popcornmix" notifications@github.com wrote:

Source is pushed (76d183fhttps://github.com/raspberrypi/linux/commit/76d183fbc25004148d3f844a8c78c7cbc59dd1f0)
and I've sanity checked:

tvservice -o && tvservice -p && fbset -depth 8 && fbset -depth 16

does the right thing. Should be in next rpi-update (probably at weekend).


Reply to this email directly or view it on GitHubhttps://github.com//issues/463#issuecomment-33712572
.

popcornmix pushed a commit to raspberrypi/firmware that referenced this issue Feb 2, 2014
See: raspberrypi/linux#463

firmware: vdec3: h264: Changed scaling lists don't force a new sequence
See: http://openelec.tv/forum/124-raspberry-pi/68526-openelec-rbej-version-frodo-12-3?start=45#96106

firmware: audioserv: handle odd buffer sizes and only submit multiples of pitch
See: raspberrypi/linux#320
popcornmix pushed a commit to Hexxeh/rpi-firmware that referenced this issue Feb 2, 2014
See: raspberrypi/linux#463

firmware: vdec3: h264: Changed scaling lists don't force a new sequence
See: http://openelec.tv/forum/124-raspberry-pi/68526-openelec-rbej-version-frodo-12-3?start=45#96106

firmware: audioserv: handle odd buffer sizes and only submit multiples of pitch
See: raspberrypi/linux#320
@popcornmix
Copy link
Collaborator

rpi-update firmware should have this fix. Please update and test.

@mschorer
Copy link
Author

mschorer commented Feb 5, 2014

hmmh ...
it seems to work for rotations of 0/180 degrees.

for left/right-protrait (rot 90/270) setups ... the screen stays black:

  • no tvservice error.
  • screen turns on (from sleep) and shows correct resolution (in menu).
  • qt app runs without errors @ proper res
  • getting a screenshot from the app shows the right content
  • screen all black.

i'm running in 1366x768@24bit ...

@popcornmix
Copy link
Collaborator

First, does this work (from console):

tvservice -o && tvservice -p && fbset -depth 8 && fbset -depth 16

Note, after powering off display, the framebuffer needs to be recreated with something like fbset.
You may also need to do something like xrefresh to ensure framebuffer is refreshed.

@mschorer
Copy link
Author

mschorer commented Feb 5, 2014

i know that and no it doesn't (no error but black screen)
also, i'm using qt via eglfs from the console so no X involved.

my process is:

  • run qt app, exit if we need to sleep
  • run "tvservice -o"
  • run sleep app, exit if we need to wake up
  • do a "tvservice -p && fbset -depth 16 && fbset -depth 24"
  • loop

this does work with in a production digital signage setup for rotation of 0/180 degrees - but gives black for 90/270.
tvservice used to return an error with -p before the fix - now it doesn't anymore.
the framebuffer including opengl acceleration is working as i see in the screenshot - qt used to return something like "no framebuffer available" and bail out before.

only the display stays black.

is there another sanity check in the firmware preventing the "display-bitstream-generator" being "switched on"?

@popcornmix
Copy link
Collaborator

Really I need to see the failure here. Can you try a clean raspbian install and enable 90 degrees rotation and check if:

tvservice -o && tvservice -p && fbset -depth 8 && fbset -depth 16

results in console returning. If it does, what is the minimal number of things you do to provoke a black screen.

@mschorer
Copy link
Author

mschorer commented Feb 5, 2014

sure i tested your statement!
the screen stays black but is powered on - no error displayed on the commandline!

pi@piMaster ~ $ tvservice -o && tvservice -p && fbset -depth 8 && fbset -depth 16
Powering off HDMI
Powering on HDMI with preferred settings
pi@piMaster ~ $ tvservice -s
state 0x12001a [HDMI DMT (81) RGB full 16:9], 1366x768 @ 60Hz, progressive
pi@piMaster ~ $

the above is from a ssh session (to be able to see something).
the same happens if done on the pi console via keyboard.

i mentioned all the other stuff only to show that i had my learning curve with pi's diplay controller.

@popcornmix
Copy link
Collaborator

Just to confirm was this with a clean raspbian image?
Did you run rpi-update to get the fixed kernel? (I didn't mention this, but you should).

@mschorer
Copy link
Author

mschorer commented Feb 5, 2014

freshly downloaded "2014-01-07-wheezy-raspbian.zip".
boot into console.
ssh into machine.
set "display_rotate=3" in config.txt

pi@raspberrypi ~ $ tvservice -o && tvservice -p && fbset -depth 8 && fbset -depth 16
Powering off HDMI
Powering on HDMI with preferred settings
ioctl FBIOPUT_VSCREENINFO: Invalid argument
pi@raspberrypi ~ $

=> ioctl error and black/blank screen as expected
then "sudo rpi-update".
then "sudo reboot"
boot into console.
ssh into machine.

pi@raspberrypi ~ $ tvservice -o && tvservice -p && fbset -depth 8 && fbset -depth 16
Powering off HDMI
Powering on HDMI with preferred settings
pi@raspberrypi ~ $

=> no ioctl error as expected, STILL BLACK SCREEN

comment display rotation
reboot. normal display. ssh in.

pi@raspberrypi ~ $ tvservice -o && tvservice -p && fbset -depth 8 && fbset -depth 16
Powering off HDMI
Powering on HDMI with preferred settings
pi@raspberrypi ~ $

=> screen blinks off and goes on again. console as before.

@szantaii
Copy link

This issue is also affects me.

The same thing happens what @mschorer described. I'd like to turn off and on the HDMI, and I'm also using a 270° rotated display (/boot/config.txt):

hdmi_group=2
hdmi_mode=35
hdmi_force_hotplug=1
display_rotate=3

Has the fix gone into Raspbian already? (I'm using the latest one, I'm regularly update it.)

@popcornmix
Copy link
Collaborator

The latest firmware is

$ uname -a
Linux raspberrypi 3.12.19+ #684 PREEMPT Fri May 16 19:27:32 BST 2014 armv6l GNU/Linux

Is that what you are running? (run rpi-update to get it if not).

@szantaii
Copy link

I was still on a 3.10 kernel:

$ uname -a
Linux raspberrypi 3.10.25+ #622 PREEMPT Fri Jan 3 18:41:00 GMT 2014 armv6l GNU/Linux

But after I ran an rpi-update, I got the latest:

$ uname -a
Linux raspberrypi 3.12.19+ #684 PREEMPT Fri May 16 19:27:32 BST 2014 armv6l GNU/Linux

However the issue still exists. If I remove the previously mentioned options from /boot/config.txt then I can turn off and on the HDMI without any problems. However when my screen is rotated, then the monitor turns back on, but it remains completely black.

@popcornmix
Copy link
Collaborator

Can you report output of

tvservice -s
fbset

@szantaii
Copy link

This is the output when my display is rotated.

$ /opt/vc/bin/tvservice -s
state 0x120016 [DVI DMT (35) RGB full 5:4], 1280x1024 @ 60.00Hz, progressive
$ fbset 

mode "1024x1280"
    geometry 1024 1280 1024 1280 16
    timings 0 0 0 0 0 0 0
    rgba 5/11,6/5,5/0,0/16
endmode

@mschorer
Copy link
Author

mine are:

pi@rpi ~ $ /opt/vc/bin/tvservice -s
state 0x120016 [DVI DMT (27) RGB full 16:10], 1280x800 @ 60Hz, progressive
pi@rpi ~ $ fbset

mode "800x1280"
    geometry 800 1280 800 1280 24
    timings 0 0 0 0 0 0 0
    rgba 8/0,8/8,8/16,0/24
endmode

i tested a couple of fw versions for this "feature": only the tvservice error disppeared, the display did never go back to a visible console in 90/270 rotations.

@popcornmix
Copy link
Collaborator

Okay, I can reproduce the issue. I'll see what I can do.

@mschorer
Copy link
Author

great!

this really is a requirement for portrait digital signage displays!

popcornmix pushed a commit to raspberrypi/firmware that referenced this issue May 23, 2014
kernel: V4L2 padding removal, and support for H264_I_PERIOD
See: raspberrypi/linux#598

firmware: dispmanx: Limit LBM usage on any channel
See: #277

firmware: MMAL: vc_image: Fix some of the combinations for vc_image_pack
firmware: MMAL: Don't ask for YUVUV when tearing down an opaque tunnel
See: http://www.raspberrypi.org/forums/viewtopic.php?f=43&t=62364&start=300#p552913

firmware: gencmd: Add display_power command for controlling power to hdmi phy

firmware: config: Add hdmi_force_mode option to force only one mode
See: http://openelec.tv/forum/124-raspberry-pi/71222-display-issues#108236

firmware: hdmi: Make configured mode have high score, so it is respected after power on preferred

firmware: hdmi: Call the callback with current hdmi mode, not preferred
See: http://forum.stmlabs.com/showthread.php?tid=11003&pid=102973#pid102973

firmware: dispmanx: Move the offline/rotated buffer allocation into attach function.
See: raspberrypi/linux#463
@popcornmix
Copy link
Collaborator

Can you test after updating with rpi-update?

popcornmix pushed a commit to Hexxeh/rpi-firmware that referenced this issue May 23, 2014
kernel: V4L2 padding removal, and support for H264_I_PERIOD
See: raspberrypi/linux#598

firmware: dispmanx: Limit LBM usage on any channel
See: raspberrypi/firmware#277

firmware: MMAL: vc_image: Fix some of the combinations for vc_image_pack
firmware: MMAL: Don't ask for YUVUV when tearing down an opaque tunnel
See: http://www.raspberrypi.org/forums/viewtopic.php?f=43&t=62364&start=300#p552913

firmware: gencmd: Add display_power command for controlling power to hdmi phy

firmware: config: Add hdmi_force_mode option to force only one mode
See: http://openelec.tv/forum/124-raspberry-pi/71222-display-issues#108236

firmware: hdmi: Make configured mode have high score, so it is respected after power on preferred

firmware: hdmi: Call the callback with current hdmi mode, not preferred
See: http://forum.stmlabs.com/showthread.php?tid=11003&pid=102973#pid102973

firmware: dispmanx: Move the offline/rotated buffer allocation into attach function.
See: raspberrypi/linux#463
@rklueber
Copy link

You are my hero. Works!

@popcornmix
Copy link
Collaborator

@mschorer can you test and close if happy?

@mschorer
Copy link
Author

@popcornmix: sure. Not sure if i`ll get to it on monday though. Latest on
wednesday ...

Thanks. That`ll be a huge improvement!
Am 23.05.2014 23:47 schrieb "popcornmix" notifications@github.com:

@mschorer https://github.com/mschorer can you test and close if happy?


Reply to this email directly or view it on GitHubhttps://github.com//issues/463#issuecomment-44064226
.

@szantaii
Copy link

I just ran an rpi-update to get the lastest firmware:

$ uname -a
Linux raspberrypi 3.12.20+ #685 PREEMPT Fri May 23 18:59:01 BST 2014 armv6l GNU/Linux

Tested the stuff, and now it works, so the monitor turns back on and everythings displays correctly. I've tested this both in console and under the default LXDE session also.

@popcornmix Thanks for resolving this so fast! Could you point me to the code that was changed to fix this issue? I just want to learn what was the problem.

@popcornmix
Copy link
Collaborator

It was on firmware side (in start.elf).
Basically when running with display_rotate or dispmanx_offline an extra frame buffer is allocated.
It turned out that when powering off this got freed, but wasn't reallocated when powered back on again.

@mschorer
Copy link
Author

Works for me now!

Thanks!

popcornmix pushed a commit that referenced this issue Feb 2, 2016
There is a race discovered by Juri, where we are able to:
- create and read a sysfs file before policy->governor_data is being set
  to a non NULL value.
  OR
- set policy->governor_data to NULL, and reading a file before being
  destroyed.

And so such a crash is reported:

Unable to handle kernel NULL pointer dereference at virtual address 0000000c
pgd = edfc8000
[0000000c] *pgd=bfc8c835
Internal error: Oops: 17 [#1] SMP ARM
Modules linked in:
CPU: 4 PID: 1730 Comm: cat Not tainted 4.5.0-rc1+ #463
Hardware name: ARM-Versatile Express
task: ee8e8480 ti: ee930000 task.ti: ee930000
PC is at show_ignore_nice_load_gov_pol+0x24/0x34
LR is at show+0x4c/0x60
pc : [<c058f1bc>]    lr : [<c058ae88>]    psr: a0070013
sp : ee931dd0  ip : ee931de0  fp : ee931ddc
r10: ee4bc290  r9 : 00001000  r8 : ef2cb000
r7 : ee4bc200  r6 : ef2cb000  r5 : c0af57b0  r4 : ee4bc2e0
r3 : 00000000  r2 : 00000000  r1 : c0928df4  r0 : ef2cb000
Flags: NzCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment none
Control: 10c5387d  Table: adfc806a  DAC: 00000051
Process cat (pid: 1730, stack limit = 0xee930210)
Stack: (0xee931dd0 to 0xee932000)
1dc0:                                     ee931dfc ee931de0 c058ae88 c058f1a4
1de0: edce3bc0 c07bfca4 edce3ac0 00001000 ee931e24 ee931e00 c01fcb90 c058ae48
1e00: 00000001 edce3bc0 00000000 00000001 ee931e50 ee8ff480 ee931e34 ee931e28
1e20: c01fb33c c01fcb0c ee931e8c ee931e38 c01a5210 c01fb314 ee931e9c ee931e48
1e40: 00000000 edce3bf0 befe4a00 ee931f78 00000000 00000000 000001e4 00000000
1e60: c00545a8 edce3ac0 00001000 00001000 befe4a00 ee931f78 00000000 00001000
1e80: ee931ed4 ee931e90 c01fbed8 c01a5038 ed085a58 00020000 00000000 00000000
1ea0: c0ad72e4 ee931f78 ee8ff488 ee8ff480 c077f3fc 00001000 befe4a00 ee931f78
1ec0: 00000000 00001000 ee931f44 ee931ed8 c017c328 c01fbdc4 00001000 00000000
1ee0: ee8ff480 00001000 ee931f44 ee931ef8 c017c65c c03deb10 ee931fac ee931f08
1f00: c0009270 c001f290 c0a8d968 ef2cb000 ef2cb000 ee8ff480 00000020 ee8ff480
1f20: ee8ff480 befe4a00 00001000 ee931f78 00000000 00000000 ee931f74 ee931f48
1f40: c017d1ec c017c2f8 c019c724 c019c684 ee8ff480 ee8ff480 00001000 befe4a00
1f60: 00000000 00000000 ee931fa4 ee931f78 c017d2a8 c017d160 00000000 00000000
1f80: 000a9f20 00001000 befe4a00 00000003 c000ffe4 ee930000 00000000 ee931fa8
1fa0: c000fe40 c017d264 000a9f20 00001000 00000003 befe4a00 00001000 00000000
Unable to handle kernel NULL pointer dereference at virtual address 0000000c
1fc0: 000a9f20 00001000 befe4a00 00000003 00000000 00000000 00000003 00000001
pgd = edfc4000
[0000000c] *pgd=bfcac835
1fe0: 00000000 befe49dc 000197f8 b6e35dfc 60070010 00000003 3065b49d 134ac2c9

[<c058f1bc>] (show_ignore_nice_load_gov_pol) from [<c058ae88>] (show+0x4c/0x60)
[<c058ae88>] (show) from [<c01fcb90>] (sysfs_kf_seq_show+0x90/0xfc)
[<c01fcb90>] (sysfs_kf_seq_show) from [<c01fb33c>] (kernfs_seq_show+0x34/0x38)
[<c01fb33c>] (kernfs_seq_show) from [<c01a5210>] (seq_read+0x1e4/0x4e4)
[<c01a5210>] (seq_read) from [<c01fbed8>] (kernfs_fop_read+0x120/0x1a0)
[<c01fbed8>] (kernfs_fop_read) from [<c017c328>] (__vfs_read+0x3c/0xe0)
[<c017c328>] (__vfs_read) from [<c017d1ec>] (vfs_read+0x98/0x104)
[<c017d1ec>] (vfs_read) from [<c017d2a8>] (SyS_read+0x50/0x90)
[<c017d2a8>] (SyS_read) from [<c000fe40>] (ret_fast_syscall+0x0/0x1c)
Code: e5903044 e1a00001 e3081df4 e34c1092 (e593300c)
---[ end trace 5994b9a5111f35ee ]---

Fix that by making sure, policy->governor_data is updated at the right
places only.

Cc: 4.2+ <stable@vger.kernel.org> # 4.2+
Reported-and-tested-by: Juri Lelli <juri.lelli@arm.com>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
popcornmix pushed a commit that referenced this issue Mar 4, 2016
commit e4b133c upstream.

There is a race discovered by Juri, where we are able to:
- create and read a sysfs file before policy->governor_data is being set
  to a non NULL value.
  OR
- set policy->governor_data to NULL, and reading a file before being
  destroyed.

And so such a crash is reported:

Unable to handle kernel NULL pointer dereference at virtual address 0000000c
pgd = edfc8000
[0000000c] *pgd=bfc8c835
Internal error: Oops: 17 [#1] SMP ARM
Modules linked in:
CPU: 4 PID: 1730 Comm: cat Not tainted 4.5.0-rc1+ #463
Hardware name: ARM-Versatile Express
task: ee8e8480 ti: ee930000 task.ti: ee930000
PC is at show_ignore_nice_load_gov_pol+0x24/0x34
LR is at show+0x4c/0x60
pc : [<c058f1bc>]    lr : [<c058ae88>]    psr: a0070013
sp : ee931dd0  ip : ee931de0  fp : ee931ddc
r10: ee4bc290  r9 : 00001000  r8 : ef2cb000
r7 : ee4bc200  r6 : ef2cb000  r5 : c0af57b0  r4 : ee4bc2e0
r3 : 00000000  r2 : 00000000  r1 : c0928df4  r0 : ef2cb000
Flags: NzCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment none
Control: 10c5387d  Table: adfc806a  DAC: 00000051
Process cat (pid: 1730, stack limit = 0xee930210)
Stack: (0xee931dd0 to 0xee932000)
1dc0:                                     ee931dfc ee931de0 c058ae88 c058f1a4
1de0: edce3bc0 c07bfca4 edce3ac0 00001000 ee931e24 ee931e00 c01fcb90 c058ae48
1e00: 00000001 edce3bc0 00000000 00000001 ee931e50 ee8ff480 ee931e34 ee931e28
1e20: c01fb33c c01fcb0c ee931e8c ee931e38 c01a5210 c01fb314 ee931e9c ee931e48
1e40: 00000000 edce3bf0 befe4a00 ee931f78 00000000 00000000 000001e4 00000000
1e60: c00545a8 edce3ac0 00001000 00001000 befe4a00 ee931f78 00000000 00001000
1e80: ee931ed4 ee931e90 c01fbed8 c01a5038 ed085a58 00020000 00000000 00000000
1ea0: c0ad72e4 ee931f78 ee8ff488 ee8ff480 c077f3fc 00001000 befe4a00 ee931f78
1ec0: 00000000 00001000 ee931f44 ee931ed8 c017c328 c01fbdc4 00001000 00000000
1ee0: ee8ff480 00001000 ee931f44 ee931ef8 c017c65c c03deb10 ee931fac ee931f08
1f00: c0009270 c001f290 c0a8d968 ef2cb000 ef2cb000 ee8ff480 00000020 ee8ff480
1f20: ee8ff480 befe4a00 00001000 ee931f78 00000000 00000000 ee931f74 ee931f48
1f40: c017d1ec c017c2f8 c019c724 c019c684 ee8ff480 ee8ff480 00001000 befe4a00
1f60: 00000000 00000000 ee931fa4 ee931f78 c017d2a8 c017d160 00000000 00000000
1f80: 000a9f20 00001000 befe4a00 00000003 c000ffe4 ee930000 00000000 ee931fa8
1fa0: c000fe40 c017d264 000a9f20 00001000 00000003 befe4a00 00001000 00000000
Unable to handle kernel NULL pointer dereference at virtual address 0000000c
1fc0: 000a9f20 00001000 befe4a00 00000003 00000000 00000000 00000003 00000001
pgd = edfc4000
[0000000c] *pgd=bfcac835
1fe0: 00000000 befe49dc 000197f8 b6e35dfc 60070010 00000003 3065b49d 134ac2c9

[<c058f1bc>] (show_ignore_nice_load_gov_pol) from [<c058ae88>] (show+0x4c/0x60)
[<c058ae88>] (show) from [<c01fcb90>] (sysfs_kf_seq_show+0x90/0xfc)
[<c01fcb90>] (sysfs_kf_seq_show) from [<c01fb33c>] (kernfs_seq_show+0x34/0x38)
[<c01fb33c>] (kernfs_seq_show) from [<c01a5210>] (seq_read+0x1e4/0x4e4)
[<c01a5210>] (seq_read) from [<c01fbed8>] (kernfs_fop_read+0x120/0x1a0)
[<c01fbed8>] (kernfs_fop_read) from [<c017c328>] (__vfs_read+0x3c/0xe0)
[<c017c328>] (__vfs_read) from [<c017d1ec>] (vfs_read+0x98/0x104)
[<c017d1ec>] (vfs_read) from [<c017d2a8>] (SyS_read+0x50/0x90)
[<c017d2a8>] (SyS_read) from [<c000fe40>] (ret_fast_syscall+0x0/0x1c)
Code: e5903044 e1a00001 e3081df4 e34c1092 (e593300c)
---[ end trace 5994b9a5111f35ee ]---

Fix that by making sure, policy->governor_data is updated at the right
places only.

Reported-and-tested-by: Juri Lelli <juri.lelli@arm.com>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
neuschaefer pushed a commit to neuschaefer/raspi-binary-firmware that referenced this issue Feb 27, 2017
See: raspberrypi/linux#463

firmware: vdec3: h264: Changed scaling lists don't force a new sequence
See: http://openelec.tv/forum/124-raspberry-pi/68526-openelec-rbej-version-frodo-12-3?start=45#96106

firmware: audioserv: handle odd buffer sizes and only submit multiples of pitch
See: raspberrypi/linux#320
neuschaefer pushed a commit to neuschaefer/raspi-binary-firmware that referenced this issue Feb 27, 2017
kernel: V4L2 padding removal, and support for H264_I_PERIOD
See: raspberrypi/linux#598

firmware: dispmanx: Limit LBM usage on any channel
See: raspberrypi#277

firmware: MMAL: vc_image: Fix some of the combinations for vc_image_pack
firmware: MMAL: Don't ask for YUVUV when tearing down an opaque tunnel
See: http://www.raspberrypi.org/forums/viewtopic.php?f=43&t=62364&start=300#p552913

firmware: gencmd: Add display_power command for controlling power to hdmi phy

firmware: config: Add hdmi_force_mode option to force only one mode
See: http://openelec.tv/forum/124-raspberry-pi/71222-display-issues#108236

firmware: hdmi: Make configured mode have high score, so it is respected after power on preferred

firmware: hdmi: Call the callback with current hdmi mode, not preferred
See: http://forum.stmlabs.com/showthread.php?tid=11003&pid=102973#pid102973

firmware: dispmanx: Move the offline/rotated buffer allocation into attach function.
See: raspberrypi/linux#463
popcornmix pushed a commit that referenced this issue May 19, 2021
[ Upstream commit 4d6a38d ]

Zenghui reports that booting a kernel with "irqchip.gicv3_pseudo_nmi=1"
on the command line hits a warning during kernel entry, due to the way
we manipulate the PMR.

Early in the entry sequence, we call lockdep_hardirqs_off() to inform
lockdep that interrupts have been masked (as the HW sets DAIF wqhen
entering an exception). Architecturally PMR_EL1 is not affected by
exception entry, and we don't set GIC_PRIO_PSR_I_SET in the PMR early in
the exception entry sequence, so early in exception entry the PMR can
indicate that interrupts are unmasked even though they are masked by
DAIF.

If DEBUG_LOCKDEP is selected, lockdep_hardirqs_off() will check that
interrupts are masked, before we set GIC_PRIO_PSR_I_SET in any of the
exception entry paths, and hence lockdep_hardirqs_off() will WARN() that
something is amiss.

We can avoid this by consistently setting GIC_PRIO_PSR_I_SET during
exception entry so that kernel code sees a consistent environment. We
must also update local_daif_inherit() to undo this, as currently only
touches DAIF. For other paths, local_daif_restore() will update both
DAIF and the PMR. With this done, we can remove the existing special
cases which set this later in the entry code.

We always use (GIC_PRIO_IRQON | GIC_PRIO_PSR_I_SET) for consistency with
local_daif_save(), as this will warn if it ever encounters
(GIC_PRIO_IRQOFF | GIC_PRIO_PSR_I_SET), and never sets this itself. This
matches the gic_prio_kentry_setup that we have to retain for
ret_to_user.

The original splat from Zenghui's report was:

| DEBUG_LOCKS_WARN_ON(!irqs_disabled())
| WARNING: CPU: 3 PID: 125 at kernel/locking/lockdep.c:4258 lockdep_hardirqs_off+0xd4/0xe8
| Modules linked in:
| CPU: 3 PID: 125 Comm: modprobe Tainted: G        W         5.12.0-rc8+ #463
| Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015
| pstate: 604003c5 (nZCv DAIF +PAN -UAO -TCO BTYPE=--)
| pc : lockdep_hardirqs_off+0xd4/0xe8
| lr : lockdep_hardirqs_off+0xd4/0xe8
| sp : ffff80002a39bad0
| pmr_save: 000000e0
| x29: ffff80002a39bad0 x28: ffff0000de214bc0
| x27: ffff0000de1c0400 x26: 000000000049b328
| x25: 0000000000406f30 x24: ffff0000de1c00a0
| x23: 0000000020400005 x22: ffff8000105f747c
| x21: 0000000096000044 x20: 0000000000498ef9
| x19: ffff80002a39bc88 x18: ffffffffffffffff
| x17: 0000000000000000 x16: ffff800011c61eb0
| x15: ffff800011700a88 x14: 0720072007200720
| x13: 0720072007200720 x12: 0720072007200720
| x11: 0720072007200720 x10: 0720072007200720
| x9 : ffff80002a39bad0 x8 : ffff80002a39bad0
| x7 : ffff8000119f0800 x6 : c0000000ffff7fff
| x5 : ffff8000119f07a8 x4 : 0000000000000001
| x3 : 9bcdab23f2432800 x2 : ffff800011730538
| x1 : 9bcdab23f2432800 x0 : 0000000000000000
| Call trace:
|  lockdep_hardirqs_off+0xd4/0xe8
|  enter_from_kernel_mode.isra.5+0x7c/0xa8
|  el1_abort+0x24/0x100
|  el1_sync_handler+0x80/0xd0
|  el1_sync+0x6c/0x100
|  __arch_clear_user+0xc/0x90
|  load_elf_binary+0x9fc/0x1450
|  bprm_execve+0x404/0x880
|  kernel_execve+0x180/0x188
|  call_usermodehelper_exec_async+0xdc/0x158
|  ret_from_fork+0x10/0x18

Fixes: 2352904 ("arm64: entry: fix non-NMI user<->kernel transitions")
Fixes: 7cd1ea1 ("arm64: entry: fix non-NMI kernel<->kernel transitions")
Fixes: f0cd5ac ("arm64: entry: fix NMI {user, kernel}->kernel transitions")
Fixes: 2a9b3e6 ("arm64: entry: fix EL1 debug transitions")
Link: https://lore.kernel.org/r/f4012761-026f-4e51-3a0c-7524e434e8b3@huawei.com
Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Reported-by: Zenghui Yu <yuzenghui@huawei.com>
Cc: Marc Zyngier <maz@kernel.org>
Cc: Will Deacon <will@kernel.org>
Acked-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20210428111555.50880-1-mark.rutland@arm.com
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
popcornmix pushed a commit that referenced this issue May 19, 2021
[ Upstream commit 4d6a38d ]

Zenghui reports that booting a kernel with "irqchip.gicv3_pseudo_nmi=1"
on the command line hits a warning during kernel entry, due to the way
we manipulate the PMR.

Early in the entry sequence, we call lockdep_hardirqs_off() to inform
lockdep that interrupts have been masked (as the HW sets DAIF wqhen
entering an exception). Architecturally PMR_EL1 is not affected by
exception entry, and we don't set GIC_PRIO_PSR_I_SET in the PMR early in
the exception entry sequence, so early in exception entry the PMR can
indicate that interrupts are unmasked even though they are masked by
DAIF.

If DEBUG_LOCKDEP is selected, lockdep_hardirqs_off() will check that
interrupts are masked, before we set GIC_PRIO_PSR_I_SET in any of the
exception entry paths, and hence lockdep_hardirqs_off() will WARN() that
something is amiss.

We can avoid this by consistently setting GIC_PRIO_PSR_I_SET during
exception entry so that kernel code sees a consistent environment. We
must also update local_daif_inherit() to undo this, as currently only
touches DAIF. For other paths, local_daif_restore() will update both
DAIF and the PMR. With this done, we can remove the existing special
cases which set this later in the entry code.

We always use (GIC_PRIO_IRQON | GIC_PRIO_PSR_I_SET) for consistency with
local_daif_save(), as this will warn if it ever encounters
(GIC_PRIO_IRQOFF | GIC_PRIO_PSR_I_SET), and never sets this itself. This
matches the gic_prio_kentry_setup that we have to retain for
ret_to_user.

The original splat from Zenghui's report was:

| DEBUG_LOCKS_WARN_ON(!irqs_disabled())
| WARNING: CPU: 3 PID: 125 at kernel/locking/lockdep.c:4258 lockdep_hardirqs_off+0xd4/0xe8
| Modules linked in:
| CPU: 3 PID: 125 Comm: modprobe Tainted: G        W         5.12.0-rc8+ #463
| Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015
| pstate: 604003c5 (nZCv DAIF +PAN -UAO -TCO BTYPE=--)
| pc : lockdep_hardirqs_off+0xd4/0xe8
| lr : lockdep_hardirqs_off+0xd4/0xe8
| sp : ffff80002a39bad0
| pmr_save: 000000e0
| x29: ffff80002a39bad0 x28: ffff0000de214bc0
| x27: ffff0000de1c0400 x26: 000000000049b328
| x25: 0000000000406f30 x24: ffff0000de1c00a0
| x23: 0000000020400005 x22: ffff8000105f747c
| x21: 0000000096000044 x20: 0000000000498ef9
| x19: ffff80002a39bc88 x18: ffffffffffffffff
| x17: 0000000000000000 x16: ffff800011c61eb0
| x15: ffff800011700a88 x14: 0720072007200720
| x13: 0720072007200720 x12: 0720072007200720
| x11: 0720072007200720 x10: 0720072007200720
| x9 : ffff80002a39bad0 x8 : ffff80002a39bad0
| x7 : ffff8000119f0800 x6 : c0000000ffff7fff
| x5 : ffff8000119f07a8 x4 : 0000000000000001
| x3 : 9bcdab23f2432800 x2 : ffff800011730538
| x1 : 9bcdab23f2432800 x0 : 0000000000000000
| Call trace:
|  lockdep_hardirqs_off+0xd4/0xe8
|  enter_from_kernel_mode.isra.5+0x7c/0xa8
|  el1_abort+0x24/0x100
|  el1_sync_handler+0x80/0xd0
|  el1_sync+0x6c/0x100
|  __arch_clear_user+0xc/0x90
|  load_elf_binary+0x9fc/0x1450
|  bprm_execve+0x404/0x880
|  kernel_execve+0x180/0x188
|  call_usermodehelper_exec_async+0xdc/0x158
|  ret_from_fork+0x10/0x18

Fixes: 2352904 ("arm64: entry: fix non-NMI user<->kernel transitions")
Fixes: 7cd1ea1 ("arm64: entry: fix non-NMI kernel<->kernel transitions")
Fixes: f0cd5ac ("arm64: entry: fix NMI {user, kernel}->kernel transitions")
Fixes: 2a9b3e6 ("arm64: entry: fix EL1 debug transitions")
Link: https://lore.kernel.org/r/f4012761-026f-4e51-3a0c-7524e434e8b3@huawei.com
Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Reported-by: Zenghui Yu <yuzenghui@huawei.com>
Cc: Marc Zyngier <maz@kernel.org>
Cc: Will Deacon <will@kernel.org>
Acked-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20210428111555.50880-1-mark.rutland@arm.com
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
popcornmix pushed a commit that referenced this issue May 19, 2021
[ Upstream commit 4d6a38d ]

Zenghui reports that booting a kernel with "irqchip.gicv3_pseudo_nmi=1"
on the command line hits a warning during kernel entry, due to the way
we manipulate the PMR.

Early in the entry sequence, we call lockdep_hardirqs_off() to inform
lockdep that interrupts have been masked (as the HW sets DAIF wqhen
entering an exception). Architecturally PMR_EL1 is not affected by
exception entry, and we don't set GIC_PRIO_PSR_I_SET in the PMR early in
the exception entry sequence, so early in exception entry the PMR can
indicate that interrupts are unmasked even though they are masked by
DAIF.

If DEBUG_LOCKDEP is selected, lockdep_hardirqs_off() will check that
interrupts are masked, before we set GIC_PRIO_PSR_I_SET in any of the
exception entry paths, and hence lockdep_hardirqs_off() will WARN() that
something is amiss.

We can avoid this by consistently setting GIC_PRIO_PSR_I_SET during
exception entry so that kernel code sees a consistent environment. We
must also update local_daif_inherit() to undo this, as currently only
touches DAIF. For other paths, local_daif_restore() will update both
DAIF and the PMR. With this done, we can remove the existing special
cases which set this later in the entry code.

We always use (GIC_PRIO_IRQON | GIC_PRIO_PSR_I_SET) for consistency with
local_daif_save(), as this will warn if it ever encounters
(GIC_PRIO_IRQOFF | GIC_PRIO_PSR_I_SET), and never sets this itself. This
matches the gic_prio_kentry_setup that we have to retain for
ret_to_user.

The original splat from Zenghui's report was:

| DEBUG_LOCKS_WARN_ON(!irqs_disabled())
| WARNING: CPU: 3 PID: 125 at kernel/locking/lockdep.c:4258 lockdep_hardirqs_off+0xd4/0xe8
| Modules linked in:
| CPU: 3 PID: 125 Comm: modprobe Tainted: G        W         5.12.0-rc8+ #463
| Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015
| pstate: 604003c5 (nZCv DAIF +PAN -UAO -TCO BTYPE=--)
| pc : lockdep_hardirqs_off+0xd4/0xe8
| lr : lockdep_hardirqs_off+0xd4/0xe8
| sp : ffff80002a39bad0
| pmr_save: 000000e0
| x29: ffff80002a39bad0 x28: ffff0000de214bc0
| x27: ffff0000de1c0400 x26: 000000000049b328
| x25: 0000000000406f30 x24: ffff0000de1c00a0
| x23: 0000000020400005 x22: ffff8000105f747c
| x21: 0000000096000044 x20: 0000000000498ef9
| x19: ffff80002a39bc88 x18: ffffffffffffffff
| x17: 0000000000000000 x16: ffff800011c61eb0
| x15: ffff800011700a88 x14: 0720072007200720
| x13: 0720072007200720 x12: 0720072007200720
| x11: 0720072007200720 x10: 0720072007200720
| x9 : ffff80002a39bad0 x8 : ffff80002a39bad0
| x7 : ffff8000119f0800 x6 : c0000000ffff7fff
| x5 : ffff8000119f07a8 x4 : 0000000000000001
| x3 : 9bcdab23f2432800 x2 : ffff800011730538
| x1 : 9bcdab23f2432800 x0 : 0000000000000000
| Call trace:
|  lockdep_hardirqs_off+0xd4/0xe8
|  enter_from_kernel_mode.isra.5+0x7c/0xa8
|  el1_abort+0x24/0x100
|  el1_sync_handler+0x80/0xd0
|  el1_sync+0x6c/0x100
|  __arch_clear_user+0xc/0x90
|  load_elf_binary+0x9fc/0x1450
|  bprm_execve+0x404/0x880
|  kernel_execve+0x180/0x188
|  call_usermodehelper_exec_async+0xdc/0x158
|  ret_from_fork+0x10/0x18

Fixes: 2352904 ("arm64: entry: fix non-NMI user<->kernel transitions")
Fixes: 7cd1ea1 ("arm64: entry: fix non-NMI kernel<->kernel transitions")
Fixes: f0cd5ac ("arm64: entry: fix NMI {user, kernel}->kernel transitions")
Fixes: 2a9b3e6 ("arm64: entry: fix EL1 debug transitions")
Link: https://lore.kernel.org/r/f4012761-026f-4e51-3a0c-7524e434e8b3@huawei.com
Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Reported-by: Zenghui Yu <yuzenghui@huawei.com>
Cc: Marc Zyngier <maz@kernel.org>
Cc: Will Deacon <will@kernel.org>
Acked-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20210428111555.50880-1-mark.rutland@arm.com
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
herrnst pushed a commit to herrnst/linux-raspberrypi that referenced this issue Jan 2, 2023
…nslate the same key

[ Upstream commit 5476fcf ]

The hid-apple driver does not support chaining translations or
dependencies on other translations. This creates two problems:

1 - In Non-English keyboards of Macs, KEY_102ND and KEY_GRAVE are
swapped and the APPLE_ISO_TILDE_QUIRK is used to work around this
problem. The quirk is not set for the Macs where these bugs happen yet
(see the 2nd patch for that), but this can be forced by setting the
iso_layout parameter. Unfortunately, this only partially works.
KEY_102ND gets translated to KEY_GRAVE, but KEY_GRAVE does not get
translated to KEY_102ND, so both of them end up functioning as
KEY_GRAVE. This is because the driver translates the keys as if Fn was
pressed and the original is sent if it is not pressed, without any
further translations happening on the key[raspberrypi#463]. KEY_GRAVE is present at
macbookpro_no_esc_fn_keys[raspberrypi#195], so this is what happens:

    - KEY_GRAVE -> KEY_ESC (as if Fn is pressed)
    - KEY_GRAVE is returned (Fn isn't pressed, so translation is discarded)
    - KEY_GRAVE -> KEY_102ND (this part is not reached!)
    ...

2 - In case the touchbar does not work, the driver supports sending
Escape when Fn+KEY_GRAVE is pressed. As mentioned previously, KEY_102ND
is actually KEY_GRAVE and needs to be translated before this happens.

Normally, these are the steps that should happen:

    - KEY_102ND -> KEY_GRAVE
    - KEY_GRAVE -> KEY_ESC (Fn is pressed)
    - KEY_ESC is returned

Though this is what happens instead, as dependencies on other
translations are not supported:

    - KEY_102ND -> KEY_ESC (Fn is pressed)
    - KEY_ESC is returned

This patch fixes both bugs by ordering the translations correctly and by
making the translations continue and not return immediately after
translating a key so that chained translations work and translations can
depend on other ones.

This patch also simplifies the implementation of the swap_fn_leftctrl
option a little bit, as it makes it simply use a normal translation
instead adding extra code to translate a key to KEY_FN[raspberrypi#381]. This change
wasn't put in another patch as the code that translates the Fn key needs
to be changed because of the changes in the patch, and those changes
would be discarded with the next patch anyway (the part that originally
translates KEY_FN to KEY_LEFTCTRL needs to be made an else-if branch of
the part that transltes KEY_LEFTCTRL to KEY_FN).

Note: Line numbers (#XYZ) are for drivers/hid/hid-apple.c at commit
20afcc4 ("HID: apple: Add "GANSS" to the non-Apple list").

Note: These bugs are only present on Macs with a keyboard with no
dedicated escape key and a non-English layout.

Signed-off-by: Kerem Karabay <kekrby@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
popcornmix pushed a commit that referenced this issue Jan 3, 2023
…nslate the same key

[ Upstream commit 5476fcf ]

The hid-apple driver does not support chaining translations or
dependencies on other translations. This creates two problems:

1 - In Non-English keyboards of Macs, KEY_102ND and KEY_GRAVE are
swapped and the APPLE_ISO_TILDE_QUIRK is used to work around this
problem. The quirk is not set for the Macs where these bugs happen yet
(see the 2nd patch for that), but this can be forced by setting the
iso_layout parameter. Unfortunately, this only partially works.
KEY_102ND gets translated to KEY_GRAVE, but KEY_GRAVE does not get
translated to KEY_102ND, so both of them end up functioning as
KEY_GRAVE. This is because the driver translates the keys as if Fn was
pressed and the original is sent if it is not pressed, without any
further translations happening on the key[#463]. KEY_GRAVE is present at
macbookpro_no_esc_fn_keys[#195], so this is what happens:

    - KEY_GRAVE -> KEY_ESC (as if Fn is pressed)
    - KEY_GRAVE is returned (Fn isn't pressed, so translation is discarded)
    - KEY_GRAVE -> KEY_102ND (this part is not reached!)
    ...

2 - In case the touchbar does not work, the driver supports sending
Escape when Fn+KEY_GRAVE is pressed. As mentioned previously, KEY_102ND
is actually KEY_GRAVE and needs to be translated before this happens.

Normally, these are the steps that should happen:

    - KEY_102ND -> KEY_GRAVE
    - KEY_GRAVE -> KEY_ESC (Fn is pressed)
    - KEY_ESC is returned

Though this is what happens instead, as dependencies on other
translations are not supported:

    - KEY_102ND -> KEY_ESC (Fn is pressed)
    - KEY_ESC is returned

This patch fixes both bugs by ordering the translations correctly and by
making the translations continue and not return immediately after
translating a key so that chained translations work and translations can
depend on other ones.

This patch also simplifies the implementation of the swap_fn_leftctrl
option a little bit, as it makes it simply use a normal translation
instead adding extra code to translate a key to KEY_FN[#381]. This change
wasn't put in another patch as the code that translates the Fn key needs
to be changed because of the changes in the patch, and those changes
would be discarded with the next patch anyway (the part that originally
translates KEY_FN to KEY_LEFTCTRL needs to be made an else-if branch of
the part that transltes KEY_LEFTCTRL to KEY_FN).

Note: Line numbers (#XYZ) are for drivers/hid/hid-apple.c at commit
20afcc4 ("HID: apple: Add "GANSS" to the non-Apple list").

Note: These bugs are only present on Macs with a keyboard with no
dedicated escape key and a non-English layout.

Signed-off-by: Kerem Karabay <kekrby@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

4 participants