-
Notifications
You must be signed in to change notification settings - Fork 5k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
bcm2708_fb_blank not implemented (prevents DPMS from working in X) #487
Comments
What behaviour is needed to make monitor enter power saving mode: I assume when the blank is removed, you want the previous contents of framebuffer preserved? |
In the olden days (and presumably would still be valid for RCA output) if you turned off Vsync or Hsync pulses (and blanked the screen) then the monitor would enter power save mode. http://en.wikipedia.org/wiki/VESA_Display_Power_Management_Signaling I think for HDMI, CEC messages for suspend are required. |
CEC won't help DVI monitors (and older HDMI TVs) nor composite. With my current LG TV, running:
Shows "LG No Signal" on screen after a few seconds. |
I have a DVI monitor connected and doing tvservice -o, the Dell switches off and goes to standby pretty quick. Unfortunately it doesn't seem to come back after a tvservice -p but I assume that is a separate issue. |
Yes, "fbset -depth 8 && fbset -depth 16" or xrefresh will bring back the framebuffer. The problem is powering off a display frees any dispmanx elements, and someone has to put them back. I was thinking of an mailbox message to FBIOBLANK, which when unblanked puts the framebuffer back on the display. There could still be problems if additional dispmanx layers had been added by other applicatons. |
Thanks for the quick replies to this.
|
fbset needs to change something or else it is no-op. |
I tested with a NEC DVI monitor, and Also, section 2.4 of the DVI spec looks useful. It say that all DVI-compliant monitors must support the "active-off" power state, which is entered by disabling the T.M.D.S. link, and exited by re-activating the link. I think that means that |
I'm running the standard X server (part of Raspian distro) and have a Acer monitor hooked up to my Pi via DVI. From an SSH session I'm using my Pi for a kiosk display and my intension is to hook up a motion detector via GPIO that I could monitor to issue display on/off commands. Any progress on this or other approaches to control display power? |
@arionl, I've found the most reliable technique is to switch VTs and back after running |
Hi Folks. Here's my FBIOBLANK handling implementation using the mailbox interface like @popcornmix suggested. I know FB_BLANK_UNBLANK and FB_BLANK_NORMAL work, the others arguments but I've not tried them static int bcm2708_fb_blank(int blank_mode, struct fb_info info) } I'm also adding FBIO_WAITFORVSYNC once I get head round the hows and the whys of it all :) @popcornmix I'll submit a pull request if you want |
@trevd |
… interface This addresses raspberrypi#487
Apologises for the spam ... That'll teach me for not doing a proper fork . |
Same here, screen blank only but never power off. |
Are there any updates on this, recently got an RPi2 and running Ubuntu Mate (15.04) on it but am experiencing this issue |
I wrote a simple tool to work around the problem. It simply polls the X server for the DPMS state and calls |
@lealanko I will install it when I next plug my Pi in and if it doesn't work for me will raise an Issue there, else will Star and Follow it; Thanks in Advance!! Edit: |
@lealanko you may be better off using We did add this into the firmware, but some applications (like omxplayer) don't stop the blanking and we got complaints about video blanking. You can enable the behaviour with |
I did consider that, but calling |
@popcornmix I can confirm this works for me, and is much better done at the firmware level rather than the application level; This hould be in https://www.raspberrypi.org/documentation/configuration/config-txt.md so I will PR it in shortly. |
|
My AC power meter (of course notoriously imprecise at such low currents) showed the power of Pi2 dropping from 3 W to 2 W upon tvservice -o. I might do more precise DC current measurements later. In any case, DPMS off mode does actually turn some video hardware off both on AMD and Intel, saving several watts. Surely RPi, meant for much more power-conscious use, should follow suit? Setting In any case, preventing DPMS from working seems like a very questionable default. It breaks the principle of least astonishment. DPMS is a standard facility on every X desktop, and anyone using X on the Pi would expect it to work the same there as everywhere else. It's much easier to disable DPMS on X than to enable blanking on config.txt. So please consider changing the default. |
I will shortly do some precise measurements on a milliamp+milliwatt scale, between |
So there is a difference and saving, but it is very minor in comparison to the saving made by the Monitor actually switching into standby. |
@popcornmix thanks |
tvservice -o will not support the requirements for my hardware application (as it produces lines within our products selected 7in touch screen). Screen blanking doesn't pose a power issue but produces too much ambient light for my specific needs (my application requires complete blackout conditions). Does anyone know of any alternatives to enable proper DPMS shutdown from the Pi? |
@robbharvey read from about 10 lines up about hdmi_blanking in config.txt [https://github.com/raspberrypi/documentation/pull/245] |
Thanks for the quick response @t3chguy. Unfortunately "vcgencmd display_power 0" with "hdmi_blanking=1" produces the same result as tvservice -o. This may be an issue with my choice of LCD panel (which seems to handle an absence of HDMI signals with vertical lines). Can you (or anyone else) confirm that switching the HDMI off is equivalent to a DPMS (off) result...meaning, when DPMS shuts "off" the monitor, does it just disable the HDMI port(like tvservice -o - implying the monitor responds to the absence of an input with a power saving state) or are there specific set of instructions sent to the monitor/screen to move it into a power saving mode? Thank you for your time! |
@robbharvey why don't you connect the LCD to another device that supports DPMS (e.g. a windows or linux PC) and see how LCD behaves? |
tvservice is giving me a lot of trouble, and I have DPMS disabled ("xserver-command=X -s 0 dpms" in lightdm.conf, and both BLANK_TIME and POWERDOWN_TIME set to 0 in /etc/kbd/config). When I run tvservice -o, and then tvservice -p shortly after, I need to run "fbset -depth 8; fbset -depth 16; DISPLAY=:0 xrefresh" as others here have reported. That is no problem. However, if I leave it for a more extended period of time (~30 minutes), it doesn't work. I have a completely blank screen, and when I run fbset -depth 8 I get: ioctl FBIOPUT_VSCREENINFO: Invalid argument And my dmesg is full of these sort of errors: [ 2428.465039] raspberrypi-firmware soc:firmware: Request 0x00048003 returned status 0x80000001 This seems to be more easily reproducible if omxplayer is running when I run tvservice -o. So I modified my cron job to first shut down omxplayer and then turn off the display. My results seem to be a bit different (before, both fbset -depth 8 and fbset -depth 16 used to throw errors, but now only the former throws the error). I'm really not concerned about 1 or 2 watts, I just want to be able to shut down the TV and turn it back on the next day. @popcornmix maybe I'll try vcgencmd display_power 0 and vcgencmd display_power 1 like you suggested in one of your comments above. Is this the right place to report this, and is there any further information I can provide? |
So I tried "vcgencmd display_power" instead, and for a few hours it seemed to be working, but then something went wrong and this is what I got in dmesg after typing "vcgencmd display_power" in the terminal (without a 1 or 0, I just wanted to see it print out the status):
In the terminal, I got the following output:
|
@falaca Can you provide a way of reproducing the issue? |
@popcornmix For the first issue (using tvservice), it's very easy for me to reproduce. Just start a live RTSP stream with omxplayer, run tvservice -o, wait roughly 30 minutes, and then run tvservice -p. The screen will be blank, and trying to "revive" it with fbset and xrefresh will generate those errors in dmesg. I start omxplayer via /etc/xdg/autostart, with the following bash script:
And I have a cherrypy (python) web application running, which listens on localhost:8000/tvon and /tvoff, and executes a bash script that runs tvservice -p or -o when it receives a GET request at those URLs. I also autostart the web application in /etc/xdg/autostart. It doesn't make a difference whether I run the command manually or through the web app, but I'm sharing just in case it matters in some way that doesn't occur to me. As for the stack trace that came up last night when I tried "vcgencmd display_power" instead of tvservice, I restarted the pi and it seems like so far today it hasn't reoccured. So it seems like that might be an intermittent issue, as opposed to the omxplayer/tvservice issue which is easily reproducible. I am running Raspbian Jessie, and almost everything is default (no overclocking or anything) except for disabling DPMS via lightdm.conf and /etc/kbd/conf. Other than that, I just have a few python and bash scripts as described above. |
@popcornmix I ran some more tests tonight (on a different raspberry pi and different TV) and found out what the real issue was - now I have a simple and bullet-proof way for you to reproduce it. It turns out that it has nothing to do with omxplayer - I had neglected another change that I made last week, which was to add a /snapshot URL to my web application, which returns a screenshot of the raspberry pi taken with this little program: https://github.com/AndrewFromMelbourne/raspi2png So here's how to reproduce the problem:
After the above steps, your display will be blank. Running Interestingly, I realized when testing on the other raspberry pi that the latest commit to that program fixes the issue by checking that that the display handle returned by vc_dispmanx_display_open() is not 0 before attempting to call vc_dispmanx_snapshot(): AndrewFromMelbourne/raspi2png@808fb02 So to reproduce this bug, you will have to revert that last commit. So to put it simply, I believe that this bug is triggered by running vc_dispmanx_snapshot() with 0 as the first function parameter while the HDMI port is powered off. |
@popcornmix After compiling the updated version of raspi2png, everything seemed to be working fine throughout the day (the TV was turning on and off at the scheduled times, and I would occasionally check my web interface to make sure that it was displaying the correct content). About an hour ago I pulled up my web interface and just left it running on the side. It grabs an updated thumbnail of the display (240x135 pixels) every 5 seconds, and eventually I got the kernel oops again. This was with Here's the stack trace:
So basically these are 2 separate bugs:
Edit: Also, I was able to reproduce (1) on another raspberry pi + TV, but I haven't tried to reproduce (2). The other TV I'm using supports CEC so I'm able to turn that one on/off using cec-client. So I seem to have no issues taking snapshots as long as the raspberry pi's HDMI port is active. |
@AGWA has this issue been resolved? If yes, then please close this issue. |
My #1 issue with my Raspberry Pi boards is that I can't walk away and leave the display turned on because VESA Display Power Management (DPMS) doesn't work. It works on Beaglebone Black - why not on Raspberry Pi? I've been waiting 2 years for a fix; I think there are many other people waiting for this fix as well. Please do NOT close this until the problem is resolved. |
@TheTechnoGuy try what I tried adding to the config.txt docs |
bcm2708_fb_blank was implemented in kernel with: We initially disabled the HDMI based on that, but it caused issues for apps that didn't use the framebuffer (e.g. omxplayer) which would lose the display after a few minutes. So, it is now optional. Enable with |
@popcornmix or anyone else that may be able to help, anything you can do to get raspberrypi/documentation#245 applied, as https://www.raspberrypi.org/documentation/configuration/config-txt.md still contains no mention of hdmi_blanking. |
hdmi_blanking works great with Touchscreen monitor 27" iiyama T2735MSC. I was wondering if anyone knows how to adjust the time rpi waits until it switches the monitor off. |
@xeusito it'll be in userland, as in likely whatever screensaver your DE ships with will trigger it. So configure that |
erhm.. could you be a bit more specific? I'm not sure what userland means.. is it somewhere in folder /usr? Thanks ! |
Sorry, DE is Desktop Environment, as in Pixel |
* Remove unnecessary licence files * Add hdmi_blanking config option ref: raspberrypi/linux#487 (comment) * Update config-txt.md
[ Upstream commit 4058ebf ] When using a AIO read() operation on the function FS gadget driver a URB is submitted asynchronously and on URB completion the received data is copied to the userspace buffer associated with the read operation. This is done from a kernel worker thread invoking copy_to_user() (through copy_to_iter()). And while the user space process memory is made available to the kernel thread using use_mm(), some architecture require in addition to this that the operation runs with USER_DS set. Otherwise the userspace memory access will fail. For example on ARM64 with Privileged Access Never (PAN) and User Access Override (UAO) enabled the following crash occurs. Internal error: Accessing user space memory with fs=KERNEL_DS: 9600004f [raspberrypi#1] SMP Modules linked in: CPU: 2 PID: 1636 Comm: kworker/2:1 Not tainted 4.9.0-04081-g8ab2dfb-dirty raspberrypi#487 Hardware name: ZynqMP ZCU102 Rev1.0 (DT) Workqueue: events ffs_user_copy_worker task: ffffffc87afc8080 task.stack: ffffffc87a00c000 PC is at __arch_copy_to_user+0x190/0x220 LR is at copy_to_iter+0x78/0x3c8 [...] [<ffffff800847b790>] __arch_copy_to_user+0x190/0x220 [<ffffff80086f25d8>] ffs_user_copy_worker+0x70/0x130 [<ffffff80080b8c64>] process_one_work+0x1dc/0x460 [<ffffff80080b8f38>] worker_thread+0x50/0x4b0 [<ffffff80080bf5a0>] kthread+0xd8/0xf0 [<ffffff8008083680>] ret_from_fork+0x10/0x50 Address this by placing a set_fs(USER_DS) before of the copy operation and revert it again once the copy operation has finished. This patch is analogous to commit d7ffde3 ("vhost: use USER_DS in vhost_worker thread") which addresses the same underlying issue. Signed-off-by: Lars-Peter Clausen <lars@metafoo.de> Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com> Signed-off-by: Sasha Levin <alexander.levin@microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[ Upstream commit 4058ebf ] When using a AIO read() operation on the function FS gadget driver a URB is submitted asynchronously and on URB completion the received data is copied to the userspace buffer associated with the read operation. This is done from a kernel worker thread invoking copy_to_user() (through copy_to_iter()). And while the user space process memory is made available to the kernel thread using use_mm(), some architecture require in addition to this that the operation runs with USER_DS set. Otherwise the userspace memory access will fail. For example on ARM64 with Privileged Access Never (PAN) and User Access Override (UAO) enabled the following crash occurs. Internal error: Accessing user space memory with fs=KERNEL_DS: 9600004f [#1] SMP Modules linked in: CPU: 2 PID: 1636 Comm: kworker/2:1 Not tainted 4.9.0-04081-g8ab2dfb-dirty #487 Hardware name: ZynqMP ZCU102 Rev1.0 (DT) Workqueue: events ffs_user_copy_worker task: ffffffc87afc8080 task.stack: ffffffc87a00c000 PC is at __arch_copy_to_user+0x190/0x220 LR is at copy_to_iter+0x78/0x3c8 [...] [<ffffff800847b790>] __arch_copy_to_user+0x190/0x220 [<ffffff80086f25d8>] ffs_user_copy_worker+0x70/0x130 [<ffffff80080b8c64>] process_one_work+0x1dc/0x460 [<ffffff80080b8f38>] worker_thread+0x50/0x4b0 [<ffffff80080bf5a0>] kthread+0xd8/0xf0 [<ffffff8008083680>] ret_from_fork+0x10/0x50 Address this by placing a set_fs(USER_DS) before of the copy operation and revert it again once the copy operation has finished. This patch is analogous to commit d7ffde3 ("vhost: use USER_DS in vhost_worker thread") which addresses the same underlying issue. Signed-off-by: Lars-Peter Clausen <lars@metafoo.de> Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com> Signed-off-by: Sasha Levin <alexander.levin@microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Jordy reported issue against XSKMAP which also applies to DEVMAP - the index used for accessing map entry, due to being a signed integer, causes the OOB writes. Fix is simple as changing the type from int to u32, however, when compared to XSKMAP case, one more thing needs to be addressed. When map is released from system via dev_map_free(), we iterate through all of the entries and an iterator variable is also an int, which implies OOB accesses. Again, change it to be u32. Example splat below: [ 160.724676] BUG: unable to handle page fault for address: ffffc8fc2c001000 [ 160.731662] #PF: supervisor read access in kernel mode [ 160.736876] #PF: error_code(0x0000) - not-present page [ 160.742095] PGD 0 P4D 0 [ 160.744678] Oops: Oops: 0000 [#1] PREEMPT SMP [ 160.749106] CPU: 1 UID: 0 PID: 520 Comm: kworker/u145:12 Not tainted 6.12.0-rc1+ #487 [ 160.757050] Hardware name: Intel Corporation S2600WFT/S2600WFT, BIOS SE5C620.86B.02.01.0008.031920191559 03/19/2019 [ 160.767642] Workqueue: events_unbound bpf_map_free_deferred [ 160.773308] RIP: 0010:dev_map_free+0x77/0x170 [ 160.777735] Code: 00 e8 fd 91 ed ff e8 b8 73 ed ff 41 83 7d 18 19 74 6e 41 8b 45 24 49 8b bd f8 00 00 00 31 db 85 c0 74 48 48 63 c3 48 8d 04 c7 <48> 8b 28 48 85 ed 74 30 48 8b 7d 18 48 85 ff 74 05 e8 b3 52 fa ff [ 160.796777] RSP: 0018:ffffc9000ee1fe38 EFLAGS: 00010202 [ 160.802086] RAX: ffffc8fc2c001000 RBX: 0000000080000000 RCX: 0000000000000024 [ 160.809331] RDX: 0000000000000000 RSI: 0000000000000024 RDI: ffffc9002c001000 [ 160.816576] RBP: 0000000000000000 R08: 0000000000000023 R09: 0000000000000001 [ 160.823823] R10: 0000000000000001 R11: 00000000000ee6b2 R12: dead000000000122 [ 160.831066] R13: ffff88810c928e00 R14: ffff8881002df405 R15: 0000000000000000 [ 160.838310] FS: 0000000000000000(0000) GS:ffff8897e0c40000(0000) knlGS:0000000000000000 [ 160.846528] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 160.852357] CR2: ffffc8fc2c001000 CR3: 0000000005c32006 CR4: 00000000007726f0 [ 160.859604] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 160.866847] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 160.874092] PKRU: 55555554 [ 160.876847] Call Trace: [ 160.879338] <TASK> [ 160.881477] ? __die+0x20/0x60 [ 160.884586] ? page_fault_oops+0x15a/0x450 [ 160.888746] ? search_extable+0x22/0x30 [ 160.892647] ? search_bpf_extables+0x5f/0x80 [ 160.896988] ? exc_page_fault+0xa9/0x140 [ 160.900973] ? asm_exc_page_fault+0x22/0x30 [ 160.905232] ? dev_map_free+0x77/0x170 [ 160.909043] ? dev_map_free+0x58/0x170 [ 160.912857] bpf_map_free_deferred+0x51/0x90 [ 160.917196] process_one_work+0x142/0x370 [ 160.921272] worker_thread+0x29e/0x3b0 [ 160.925082] ? rescuer_thread+0x4b0/0x4b0 [ 160.929157] kthread+0xd4/0x110 [ 160.932355] ? kthread_park+0x80/0x80 [ 160.936079] ret_from_fork+0x2d/0x50 [ 160.943396] ? kthread_park+0x80/0x80 [ 160.950803] ret_from_fork_asm+0x11/0x20 [ 160.958482] </TASK> Fixes: 546ac1f ("bpf: add devmap, a map for storing net device references") CC: stable@vger.kernel.org Reported-by: Jordy Zomer <jordyzomer@google.com> Suggested-by: Jordy Zomer <jordyzomer@google.com> Reviewed-by: Toke Høiland-Jørgensen <toke@redhat.com> Acked-by: John Fastabend <john.fastabend@gmail.com> Signed-off-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com> Link: https://lore.kernel.org/r/20241122121030.716788-3-maciej.fijalkowski@intel.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
commit ab244dd upstream. Jordy reported issue against XSKMAP which also applies to DEVMAP - the index used for accessing map entry, due to being a signed integer, causes the OOB writes. Fix is simple as changing the type from int to u32, however, when compared to XSKMAP case, one more thing needs to be addressed. When map is released from system via dev_map_free(), we iterate through all of the entries and an iterator variable is also an int, which implies OOB accesses. Again, change it to be u32. Example splat below: [ 160.724676] BUG: unable to handle page fault for address: ffffc8fc2c001000 [ 160.731662] #PF: supervisor read access in kernel mode [ 160.736876] #PF: error_code(0x0000) - not-present page [ 160.742095] PGD 0 P4D 0 [ 160.744678] Oops: Oops: 0000 [#1] PREEMPT SMP [ 160.749106] CPU: 1 UID: 0 PID: 520 Comm: kworker/u145:12 Not tainted 6.12.0-rc1+ #487 [ 160.757050] Hardware name: Intel Corporation S2600WFT/S2600WFT, BIOS SE5C620.86B.02.01.0008.031920191559 03/19/2019 [ 160.767642] Workqueue: events_unbound bpf_map_free_deferred [ 160.773308] RIP: 0010:dev_map_free+0x77/0x170 [ 160.777735] Code: 00 e8 fd 91 ed ff e8 b8 73 ed ff 41 83 7d 18 19 74 6e 41 8b 45 24 49 8b bd f8 00 00 00 31 db 85 c0 74 48 48 63 c3 48 8d 04 c7 <48> 8b 28 48 85 ed 74 30 48 8b 7d 18 48 85 ff 74 05 e8 b3 52 fa ff [ 160.796777] RSP: 0018:ffffc9000ee1fe38 EFLAGS: 00010202 [ 160.802086] RAX: ffffc8fc2c001000 RBX: 0000000080000000 RCX: 0000000000000024 [ 160.809331] RDX: 0000000000000000 RSI: 0000000000000024 RDI: ffffc9002c001000 [ 160.816576] RBP: 0000000000000000 R08: 0000000000000023 R09: 0000000000000001 [ 160.823823] R10: 0000000000000001 R11: 00000000000ee6b2 R12: dead000000000122 [ 160.831066] R13: ffff88810c928e00 R14: ffff8881002df405 R15: 0000000000000000 [ 160.838310] FS: 0000000000000000(0000) GS:ffff8897e0c40000(0000) knlGS:0000000000000000 [ 160.846528] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 160.852357] CR2: ffffc8fc2c001000 CR3: 0000000005c32006 CR4: 00000000007726f0 [ 160.859604] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 160.866847] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 160.874092] PKRU: 55555554 [ 160.876847] Call Trace: [ 160.879338] <TASK> [ 160.881477] ? __die+0x20/0x60 [ 160.884586] ? page_fault_oops+0x15a/0x450 [ 160.888746] ? search_extable+0x22/0x30 [ 160.892647] ? search_bpf_extables+0x5f/0x80 [ 160.896988] ? exc_page_fault+0xa9/0x140 [ 160.900973] ? asm_exc_page_fault+0x22/0x30 [ 160.905232] ? dev_map_free+0x77/0x170 [ 160.909043] ? dev_map_free+0x58/0x170 [ 160.912857] bpf_map_free_deferred+0x51/0x90 [ 160.917196] process_one_work+0x142/0x370 [ 160.921272] worker_thread+0x29e/0x3b0 [ 160.925082] ? rescuer_thread+0x4b0/0x4b0 [ 160.929157] kthread+0xd4/0x110 [ 160.932355] ? kthread_park+0x80/0x80 [ 160.936079] ret_from_fork+0x2d/0x50 [ 160.943396] ? kthread_park+0x80/0x80 [ 160.950803] ret_from_fork_asm+0x11/0x20 [ 160.958482] </TASK> Fixes: 546ac1f ("bpf: add devmap, a map for storing net device references") CC: stable@vger.kernel.org Reported-by: Jordy Zomer <jordyzomer@google.com> Suggested-by: Jordy Zomer <jordyzomer@google.com> Reviewed-by: Toke Høiland-Jørgensen <toke@redhat.com> Acked-by: John Fastabend <john.fastabend@gmail.com> Signed-off-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com> Link: https://lore.kernel.org/r/20241122121030.716788-3-maciej.fijalkowski@intel.com Signed-off-by: Alexei Starovoitov <ast@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit ab244dd upstream. Jordy reported issue against XSKMAP which also applies to DEVMAP - the index used for accessing map entry, due to being a signed integer, causes the OOB writes. Fix is simple as changing the type from int to u32, however, when compared to XSKMAP case, one more thing needs to be addressed. When map is released from system via dev_map_free(), we iterate through all of the entries and an iterator variable is also an int, which implies OOB accesses. Again, change it to be u32. Example splat below: [ 160.724676] BUG: unable to handle page fault for address: ffffc8fc2c001000 [ 160.731662] #PF: supervisor read access in kernel mode [ 160.736876] #PF: error_code(0x0000) - not-present page [ 160.742095] PGD 0 P4D 0 [ 160.744678] Oops: Oops: 0000 [#1] PREEMPT SMP [ 160.749106] CPU: 1 UID: 0 PID: 520 Comm: kworker/u145:12 Not tainted 6.12.0-rc1+ #487 [ 160.757050] Hardware name: Intel Corporation S2600WFT/S2600WFT, BIOS SE5C620.86B.02.01.0008.031920191559 03/19/2019 [ 160.767642] Workqueue: events_unbound bpf_map_free_deferred [ 160.773308] RIP: 0010:dev_map_free+0x77/0x170 [ 160.777735] Code: 00 e8 fd 91 ed ff e8 b8 73 ed ff 41 83 7d 18 19 74 6e 41 8b 45 24 49 8b bd f8 00 00 00 31 db 85 c0 74 48 48 63 c3 48 8d 04 c7 <48> 8b 28 48 85 ed 74 30 48 8b 7d 18 48 85 ff 74 05 e8 b3 52 fa ff [ 160.796777] RSP: 0018:ffffc9000ee1fe38 EFLAGS: 00010202 [ 160.802086] RAX: ffffc8fc2c001000 RBX: 0000000080000000 RCX: 0000000000000024 [ 160.809331] RDX: 0000000000000000 RSI: 0000000000000024 RDI: ffffc9002c001000 [ 160.816576] RBP: 0000000000000000 R08: 0000000000000023 R09: 0000000000000001 [ 160.823823] R10: 0000000000000001 R11: 00000000000ee6b2 R12: dead000000000122 [ 160.831066] R13: ffff88810c928e00 R14: ffff8881002df405 R15: 0000000000000000 [ 160.838310] FS: 0000000000000000(0000) GS:ffff8897e0c40000(0000) knlGS:0000000000000000 [ 160.846528] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 160.852357] CR2: ffffc8fc2c001000 CR3: 0000000005c32006 CR4: 00000000007726f0 [ 160.859604] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 160.866847] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 160.874092] PKRU: 55555554 [ 160.876847] Call Trace: [ 160.879338] <TASK> [ 160.881477] ? __die+0x20/0x60 [ 160.884586] ? page_fault_oops+0x15a/0x450 [ 160.888746] ? search_extable+0x22/0x30 [ 160.892647] ? search_bpf_extables+0x5f/0x80 [ 160.896988] ? exc_page_fault+0xa9/0x140 [ 160.900973] ? asm_exc_page_fault+0x22/0x30 [ 160.905232] ? dev_map_free+0x77/0x170 [ 160.909043] ? dev_map_free+0x58/0x170 [ 160.912857] bpf_map_free_deferred+0x51/0x90 [ 160.917196] process_one_work+0x142/0x370 [ 160.921272] worker_thread+0x29e/0x3b0 [ 160.925082] ? rescuer_thread+0x4b0/0x4b0 [ 160.929157] kthread+0xd4/0x110 [ 160.932355] ? kthread_park+0x80/0x80 [ 160.936079] ret_from_fork+0x2d/0x50 [ 160.943396] ? kthread_park+0x80/0x80 [ 160.950803] ret_from_fork_asm+0x11/0x20 [ 160.958482] </TASK> Fixes: 546ac1f ("bpf: add devmap, a map for storing net device references") CC: stable@vger.kernel.org Reported-by: Jordy Zomer <jordyzomer@google.com> Suggested-by: Jordy Zomer <jordyzomer@google.com> Reviewed-by: Toke Høiland-Jørgensen <toke@redhat.com> Acked-by: John Fastabend <john.fastabend@gmail.com> Signed-off-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com> Link: https://lore.kernel.org/r/20241122121030.716788-3-maciej.fijalkowski@intel.com Signed-off-by: Alexei Starovoitov <ast@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Are there any plans to implement
bcm2708_fb_blank
? This function is called when theFBIOBLANK
ioctl is made on the frame buffer and is supposed to put the monitor into power saving mode. Since it has not been implemented, X on the Raspberry Pi is unable to put the monitor into power saving mode (aka DPMS).You can see the problem by running
xset dpms force off
in X. The monitor blanks but does not enter power saving mode, and the message "(EE) FBTURBO(0): FBIOBLANK: Operation not permitted" is printed to the X log. (It says "Operation not permitted" becausebcm2708_fb_blank
always returns -1, and 1 ==EPERM
.)The text was updated successfully, but these errors were encountered: