2010-08-02 19:50:12

by Ondrej Zary

[permalink] [raw]
Subject: 6175ddf06b6172046a329e3abfd9c901a43efd2e breaks matroxfb console

Hello,
matroxfb (at least with Mystique and Mystique 220) stopped working in 2.6.34 -
the screen is completely corrupted. Bisection shows that
6175ddf06b6172046a329e3abfd9c901a43efd2e is first bad commit.

Reverting 6175ddf06b6172046a329e3abfd9c901a43efd2e in 2.6.34 fixes the problem
(1c5b9069e12e20d2fe883076ae0bf73966492108 must be reverted first).

--
Ondrej Zary


2010-08-02 21:05:18

by H. Peter Anvin

[permalink] [raw]
Subject: Re: 6175ddf06b6172046a329e3abfd9c901a43efd2e breaks matroxfb console

On 08/02/2010 12:49 PM, Ondrej Zary wrote:
> Hello,
> matroxfb (at least with Mystique and Mystique 220) stopped working in 2.6.34 -
> the screen is completely corrupted. Bisection shows that
> 6175ddf06b6172046a329e3abfd9c901a43efd2e is first bad commit.
>
> Reverting 6175ddf06b6172046a329e3abfd9c901a43efd2e in 2.6.34 fixes the problem
> (1c5b9069e12e20d2fe883076ae0bf73966492108 must be reverted first).
>

Sounds like another driver which used memcpy_toio() when it should have
used iowrite32_rep() or __iowrite32_copy().

Hmm... is __iowrite32_copy() and iowrite32_rep() redundant? If so, we
should get rid of the former.

-hpa

2010-08-02 21:14:44

by Ondrej Zary

[permalink] [raw]
Subject: Re: 6175ddf06b6172046a329e3abfd9c901a43efd2e breaks matroxfb console

On Monday 02 August 2010 23:04:28 H. Peter Anvin wrote:
> On 08/02/2010 12:49 PM, Ondrej Zary wrote:
> > Hello,
> > matroxfb (at least with Mystique and Mystique 220) stopped working in
> > 2.6.34 - the screen is completely corrupted. Bisection shows that
> > 6175ddf06b6172046a329e3abfd9c901a43efd2e is first bad commit.
> >
> > Reverting 6175ddf06b6172046a329e3abfd9c901a43efd2e in 2.6.34 fixes the
> > problem (1c5b9069e12e20d2fe883076ae0bf73966492108 must be reverted
> > first).
>
> Sounds like another driver which used memcpy_toio() when it should have
> used iowrite32_rep() or __iowrite32_copy().
>
> Hmm... is __iowrite32_copy() and iowrite32_rep() redundant? If so, we
> should get rid of the former.

There is a wrapper in drivers/video/matrox/matroxfb_base.h (see below) with
some comment. So this commit changed one of the three points?

static inline void mga_memcpy_toio(vaddr_t va, const void* src, int len) {
#if defined(__alpha__) || defined(__i386__) || defined(__x86_64__)
/*
* memcpy_toio works for us if:
* (1) Copies data as 32bit quantities, not byte after byte,
* (2) Performs LE ordered stores, and
* (3) It copes with unaligned source (destination is guaranteed to be page
* aligned and length is guaranteed to be multiple of 4).
*/
memcpy_toio(va.vaddr, src, len);
#else
u_int32_t __iomem* addr = va.vaddr;

if ((unsigned long)src & 3) {
while (len >= 4) {
fb_writel(get_unaligned((u32 *)src), addr);
addr++;
len -= 4;
src += 4;
}
} else {
while (len >= 4) {
fb_writel(*(u32 *)src, addr);
addr++;
len -= 4;
src += 4;
}
}
#endif
}

--
Ondrej Zary

2010-08-02 21:15:40

by H. Peter Anvin

[permalink] [raw]
Subject: Re: 6175ddf06b6172046a329e3abfd9c901a43efd2e breaks matroxfb console

On 08/02/2010 02:14 PM, Ondrej Zary wrote:
> On Monday 02 August 2010 23:04:28 H. Peter Anvin wrote:
>> On 08/02/2010 12:49 PM, Ondrej Zary wrote:
>>> Hello,
>>> matroxfb (at least with Mystique and Mystique 220) stopped working in
>>> 2.6.34 - the screen is completely corrupted. Bisection shows that
>>> 6175ddf06b6172046a329e3abfd9c901a43efd2e is first bad commit.
>>>
>>> Reverting 6175ddf06b6172046a329e3abfd9c901a43efd2e in 2.6.34 fixes the
>>> problem (1c5b9069e12e20d2fe883076ae0bf73966492108 must be reverted
>>> first).
>>
>> Sounds like another driver which used memcpy_toio() when it should have
>> used iowrite32_rep() or __iowrite32_copy().
>>
>> Hmm... is __iowrite32_copy() and iowrite32_rep() redundant? If so, we
>> should get rid of the former.
>
> There is a wrapper in drivers/video/matrox/matroxfb_base.h (see below) with
> some comment. So this commit changed one of the three points?
>
> static inline void mga_memcpy_toio(vaddr_t va, const void* src, int len) {
> #if defined(__alpha__) || defined(__i386__) || defined(__x86_64__)
> /*
> * memcpy_toio works for us if:
> * (1) Copies data as 32bit quantities, not byte after byte,
> * (2) Performs LE ordered stores, and
> * (3) It copes with unaligned source (destination is guaranteed to be page
> * aligned and length is guaranteed to be multiple of 4).
> */
> memcpy_toio(va.vaddr, src, len);
> #else

Yes, point (1) is not guaranteed by memcpy_toio().

-hpa

2010-08-02 21:35:21

by Ondrej Zary

[permalink] [raw]
Subject: Re: 6175ddf06b6172046a329e3abfd9c901a43efd2e breaks matroxfb console

On Monday 02 August 2010 23:15:33 H. Peter Anvin wrote:
> On 08/02/2010 02:14 PM, Ondrej Zary wrote:
> > On Monday 02 August 2010 23:04:28 H. Peter Anvin wrote:
> >> On 08/02/2010 12:49 PM, Ondrej Zary wrote:
> >>> Hello,
> >>> matroxfb (at least with Mystique and Mystique 220) stopped working in
> >>> 2.6.34 - the screen is completely corrupted. Bisection shows that
> >>> 6175ddf06b6172046a329e3abfd9c901a43efd2e is first bad commit.
> >>>
> >>> Reverting 6175ddf06b6172046a329e3abfd9c901a43efd2e in 2.6.34 fixes the
> >>> problem (1c5b9069e12e20d2fe883076ae0bf73966492108 must be reverted
> >>> first).
> >>
> >> Sounds like another driver which used memcpy_toio() when it should have
> >> used iowrite32_rep() or __iowrite32_copy().
> >>
> >> Hmm... is __iowrite32_copy() and iowrite32_rep() redundant? If so, we
> >> should get rid of the former.
> >
> > There is a wrapper in drivers/video/matrox/matroxfb_base.h (see below)
> > with some comment. So this commit changed one of the three points?
> >
> > static inline void mga_memcpy_toio(vaddr_t va, const void* src, int len)
> > { #if defined(__alpha__) || defined(__i386__) || defined(__x86_64__) /*
> > * memcpy_toio works for us if:
> > * (1) Copies data as 32bit quantities, not byte after byte,
> > * (2) Performs LE ordered stores, and
> > * (3) It copes with unaligned source (destination is guaranteed
> > to be page * aligned and length is guaranteed to be multiple of 4).
> > */
> > memcpy_toio(va.vaddr, src, len);
> > #else
>
> Yes, point (1) is not guaranteed by memcpy_toio().

Now I wonder how many drivers will this break...

The patch below fixes it for me. Is it correct on all architectures?

--- linux-2.6.35-rc2/drivers/video/matrox/matroxfb_base.h 2010-06-06 05:43:24.000000000 +0200
+++ linux-2.6.35-rc3/drivers/video/matrox/matroxfb_base.h 2010-08-02 23:31:34.000000000 +0200
@@ -157,7 +157,7 @@ static inline void mga_memcpy_toio(vaddr
* (3) It copes with unaligned source (destination is guaranteed to be page
* aligned and length is guaranteed to be multiple of 4).
*/
- memcpy_toio(va.vaddr, src, len);
+ iowrite32_rep(va.vaddr, src, len);
#else
u_int32_t __iomem* addr = va.vaddr;



--
Ondrej Zary

2010-08-02 21:42:37

by H. Peter Anvin

[permalink] [raw]
Subject: Re: 6175ddf06b6172046a329e3abfd9c901a43efd2e breaks matroxfb console

On 08/02/2010 02:35 PM, Ondrej Zary wrote:
>
> The patch below fixes it for me. Is it correct on all architectures?
>
> --- linux-2.6.35-rc2/drivers/video/matrox/matroxfb_base.h 2010-06-06 05:43:24.000000000 +0200
> +++ linux-2.6.35-rc3/drivers/video/matrox/matroxfb_base.h 2010-08-02 23:31:34.000000000 +0200
> @@ -157,7 +157,7 @@ static inline void mga_memcpy_toio(vaddr
> * (3) It copes with unaligned source (destination is guaranteed to be page
> * aligned and length is guaranteed to be multiple of 4).
> */
> - memcpy_toio(va.vaddr, src, len);
> + iowrite32_rep(va.vaddr, src, len);
> #else
> u_int32_t __iomem* addr = va.vaddr;
>

I don't think so; in particular I don't *think* non-x86 architectures
will deal with the requirement that it handles an unaligned source. As
such, the #if would still be necessary; the #else clause could be
replaced with a get_unaligned() ... iowrite32() loop.

The other thing to watch out for is that "len" passed to iowrite32_rep()
is a count of 32-bit words, whereas memcpy_toio() takes a byte count...
you need to >> 2 there.

-hpa

2010-08-03 00:00:07

by Chris Rankin

[permalink] [raw]
Subject: RE: 6175ddf06b6172046a329e3abfd9c901a43efd2e breaks matroxfb console

> matroxfb (at least with Mystique and Mystique 220) stopped working
> in 2.6.34 - the screen is completely corrupted.

Interesting... I have just upgraded one of my old machines with a Matrox Millenium II card to 2.6.33.7, and have noticed that the matroxfb console has developed a slight wobble. (Think of a subtle "heat haze" / "one too many beers" kind of effect.)

Have any relevant changes been back-ported to 2.6.33.x-stable, please?

Cheers,
Chris


2010-08-03 18:34:48

by Ondrej Zary

[permalink] [raw]
Subject: Re: 6175ddf06b6172046a329e3abfd9c901a43efd2e breaks matroxfb console

On Monday 02 August 2010 23:42:29 H. Peter Anvin wrote:
> On 08/02/2010 02:35 PM, Ondrej Zary wrote:
> > The patch below fixes it for me. Is it correct on all architectures?
> >
> > --- linux-2.6.35-rc2/drivers/video/matrox/matroxfb_base.h 2010-06-06
> > 05:43:24.000000000 +0200 +++
> > linux-2.6.35-rc3/drivers/video/matrox/matroxfb_base.h 2010-08-02
> > 23:31:34.000000000 +0200 @@ -157,7 +157,7 @@ static inline void
> > mga_memcpy_toio(vaddr
> > * (3) It copes with unaligned source (destination is guaranteed to be
> > page * aligned and length is guaranteed to be multiple of 4). */
> > - memcpy_toio(va.vaddr, src, len);
> > + iowrite32_rep(va.vaddr, src, len);
> > #else
> > u_int32_t __iomem* addr = va.vaddr;
>
> I don't think so; in particular I don't *think* non-x86 architectures
> will deal with the requirement that it handles an unaligned source. As
> such, the #if would still be necessary; the #else clause could be
> replaced with a get_unaligned() ... iowrite32() loop.

Just tested the #else part on sparc and it seems to work fine - so I'm not going to touch (break) it.

> The other thing to watch out for is that "len" passed to iowrite32_rep()
> is a count of 32-bit words, whereas memcpy_toio() takes a byte count...
> you need to >> 2 there.

Thanks.

Here's v2 patch:


Fix incorrect use of memcpy_toio() in matroxfb that broke in 2.6.34.

Signed-off-by: Ondrej Zary <[email protected]>

--- linux-2.6.35-rc2/drivers/video/matrox/matroxfb_base.h 2010-06-06 05:43:24.000000000 +0200
+++ linux-2.6.35-rc3/drivers/video/matrox/matroxfb_base.h 2010-08-03 18:13:46.000000000 +0200
@@ -151,13 +151,13 @@ static inline void mga_writel(vaddr_t va
static inline void mga_memcpy_toio(vaddr_t va, const void* src, int len) {
#if defined(__alpha__) || defined(__i386__) || defined(__x86_64__)
/*
- * memcpy_toio works for us if:
+ * iowrite32_rep works for us if:
* (1) Copies data as 32bit quantities, not byte after byte,
* (2) Performs LE ordered stores, and
* (3) It copes with unaligned source (destination is guaranteed to be page
* aligned and length is guaranteed to be multiple of 4).
*/
- memcpy_toio(va.vaddr, src, len);
+ iowrite32_rep(va.vaddr, src, len >> 2);
#else
u_int32_t __iomem* addr = va.vaddr;



--
Ondrej Zary