[PATCH 23/24] matroxfb: Color setting fixes

[PATCH 23/24] matroxfb: Color setting fixes

[Antonino A. Daplas]

- the pseudo_palette is only 16 elements long.
- do not write to the pseudo_palette if regno (array index) is more than 15

Signed-off-by: Antonino Daplas <adaplas@gmail.com>
---

 drivers/video/matrox/matroxfb_base.c  |    4 ++++
 drivers/video/matrox/matroxfb_base.h  |    2 +-
 drivers/video/matrox/matroxfb_crtc2.h |    2 +-
 3 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/video/matrox/matroxfb_base.c b/drivers/video/matrox/matroxfb_base.c
index c8559a7..7ebb562 100644
--- a/drivers/video/matrox/matroxfb_base.c
+++ b/drivers/video/matrox/matroxfb_base.c
@@ -679,6 +679,8 @@ #endif
 		mga_outb(M_DAC_VAL, blue);
 		break;
 	case 16:
+		if (regno >= 16)
+			break;
 		{
 			u_int16_t col =
 				(red << ACCESS_FBINFO(fbcon).var.red.offset)     |
@@ -690,6 +692,8 @@ #endif
 		break;
 	case 24:
 	case 32:
+		if (regno >= 16)
+			break;
 		ACCESS_FBINFO(cmap[regno]) =
 			(red   << ACCESS_FBINFO(fbcon).var.red.offset)   |
 			(green << ACCESS_FBINFO(fbcon).var.green.offset) |
diff --git a/drivers/video/matrox/matroxfb_base.h b/drivers/video/matrox/matroxfb_base.h
index 9c25c2f..d59577c 100644
--- a/drivers/video/matrox/matroxfb_base.h
+++ b/drivers/video/matrox/matroxfb_base.h
@@ -518,7 +518,7 @@ #endif
 					dll:1;
 				      } memory;
 			      } values;
-	u_int32_t cmap[17];
+	u_int32_t cmap[16];
 };
 
 #define info2minfo(info) container_of(info, struct matrox_fb_info, fbcon)
diff --git a/drivers/video/matrox/matroxfb_crtc2.h b/drivers/video/matrox/matroxfb_crtc2.h
index 608e40b..24450df 100644
--- a/drivers/video/matrox/matroxfb_crtc2.h
+++ b/drivers/video/matrox/matroxfb_crtc2.h
@@ -30,7 +30,7 @@ struct matroxfb_dh_fb_info {
 
 	unsigned int		interlaced:1;
 
-	u_int32_t cmap[17];
+	u_int32_t cmap[16];
 };
 
 #endif /* __MATROXFB_CRTC2_H__ */


-------------------------------------------------------------------------
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and take
control of your XML. No limits. Just data. Click to get it now.
http://sourceforge.net/powerbar/db2/

Re: [PATCH 23/24] matroxfb: Color setting fixes

[Petr Vandrovec]

Antonino A. Daplas wrote:
> - the pseudo_palette is only 16 elements long.
> - do not write to the pseudo_palette if regno (array index) is more than 15
> 
> Signed-off-by: Antonino Daplas <adaplas@gmail.com>

NACK.  If you want to remove entry #16, you need to also fix all uses of 
it - matroxfb_crtc2 uses it, matroxfb_accel as well.  Before hardware 
cursor was removed from fbcon it was used by hardware cursor - now it is 
only set, but never used.  Removing entry without removing code to set 
entry #16 memory corruption will occur.
								Petr


> ---
> 
>  drivers/video/matrox/matroxfb_base.c  |    4 ++++
>  drivers/video/matrox/matroxfb_base.h  |    2 +-
>  drivers/video/matrox/matroxfb_crtc2.h |    2 +-
>  3 files changed, 6 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/video/matrox/matroxfb_base.c b/drivers/video/matrox/matroxfb_base.c
> index c8559a7..7ebb562 100644
> --- a/drivers/video/matrox/matroxfb_base.c
> +++ b/drivers/video/matrox/matroxfb_base.c
> @@ -679,6 +679,8 @@ #endif
>  		mga_outb(M_DAC_VAL, blue);
>  		break;
>  	case 16:
> +		if (regno >= 16)
> +			break;
>  		{
>  			u_int16_t col =
>  				(red << ACCESS_FBINFO(fbcon).var.red.offset)     |
> @@ -690,6 +692,8 @@ #endif
>  		break;
>  	case 24:
>  	case 32:
> +		if (regno >= 16)
> +			break;
>  		ACCESS_FBINFO(cmap[regno]) =
>  			(red   << ACCESS_FBINFO(fbcon).var.red.offset)   |
>  			(green << ACCESS_FBINFO(fbcon).var.green.offset) |
> diff --git a/drivers/video/matrox/matroxfb_base.h b/drivers/video/matrox/matroxfb_base.h
> index 9c25c2f..d59577c 100644
> --- a/drivers/video/matrox/matroxfb_base.h
> +++ b/drivers/video/matrox/matroxfb_base.h
> @@ -518,7 +518,7 @@ #endif
>  					dll:1;
>  				      } memory;
>  			      } values;
> -	u_int32_t cmap[17];
> +	u_int32_t cmap[16];
>  };
>  
>  #define info2minfo(info) container_of(info, struct matrox_fb_info, fbcon)
> diff --git a/drivers/video/matrox/matroxfb_crtc2.h b/drivers/video/matrox/matroxfb_crtc2.h
> index 608e40b..24450df 100644
> --- a/drivers/video/matrox/matroxfb_crtc2.h
> +++ b/drivers/video/matrox/matroxfb_crtc2.h
> @@ -30,7 +30,7 @@ struct matroxfb_dh_fb_info {
>  
>  	unsigned int		interlaced:1;
>  
> -	u_int32_t cmap[17];
> +	u_int32_t cmap[16];
>  };
>  
>  #endif /* __MATROXFB_CRTC2_H__ */
> 
> 



-------------------------------------------------------------------------
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and take
control of your XML. No limits. Just data. Click to get it now.
http://sourceforge.net/powerbar/db2/

Re: [PATCH 23/24] matroxfb: Color setting fixes

[Antonino Daplas]

On 6/3/07, Petr Vandrovec <vandrove@vc.cvut.cz> wrote:
> Antonino A. Daplas wrote:
> > - the pseudo_palette is only 16 elements long.
> > - do not write to the pseudo_palette if regno (array index) is more than 15
> >
> > Signed-off-by: Antonino Daplas <adaplas@gmail.com>
>
> NACK.  If you want to remove entry #16, you need to also fix all uses of
> it - matroxfb_crtc2 uses it, matroxfb_accel as well.  Before hardware
> cursor was removed from fbcon it was used by hardware cursor - now it is
> only set, but never used.  Removing entry without removing code to set
> entry #16 memory corruption will occur.
>                                                                 Petr

Okay, I see it now.  Andrew, drop the patch for matroxfb.

Petr,

Do you have plans for the 17th entry?

Tony

-------------------------------------------------------------------------
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and take
control of your XML. No limits. Just data. Click to get it now.
http://sourceforge.net/powerbar/db2/

Re: [PATCH 23/24] matroxfb: Color setting fixes

[Petr Vandrovec]

Antonino Daplas wrote:
> On 6/3/07, Petr Vandrovec <vandrove@vc.cvut.cz> wrote:
>> Antonino A. Daplas wrote:
>> > - the pseudo_palette is only 16 elements long.
>> > - do not write to the pseudo_palette if regno (array index) is more 
>> than 15
>> >
>> > Signed-off-by: Antonino Daplas <adaplas@gmail.com>
>>
>> NACK.  If you want to remove entry #16, you need to also fix all uses of
>> it - matroxfb_crtc2 uses it, matroxfb_accel as well.  Before hardware
>> cursor was removed from fbcon it was used by hardware cursor - now it is
>> only set, but never used.  Removing entry without removing code to set
>> entry #16 memory corruption will occur.
>>                                                                 Petr
> 
> Okay, I see it now.  Andrew, drop the patch for matroxfb.
> 
> Petr,
> 
> Do you have plans for the 17th entry?

No.  It was used in the past when hardware XOR cursor was used (so 
palette 4bpp/8bpp needed XOR mask 0x0F, while truecolor modes needed 
0x7FFF for 15bpp/0xFFFF for 16bpp/0xFFFFFF for 32bpp).  Now matroxfb 
uses software cursor (which just repaints complete character) and I have 
no plans to resurrect it.

So feel free to remove code which sets that entry.  I believe that 
passing matroxfb sources through "grep -v 'cmap\[16\]\|pal\[.*F'" 
"fixes" it...

petr@gwy:/usr/src/linus/linux-2.6.22-rc3/drivers/video/matrox$ grep 
'cmap\[16\]\|pal\[.*F' *
matroxfb_accel.c:       pal[i] = 0xFFFFFFFF;
matroxfb_accel.c:       pal[i] = 0x0F0F0F0F;
matroxfb_accel.c: 
ACCESS_FBINFO(cmap[16]) = 0x7FFF7FFF;
matroxfb_accel.c: 
ACCESS_FBINFO(cmap[16]) = 0xFFFFFFFF;
matroxfb_accel.c:                               ACCESS_FBINFO(cmap[16]) 
= 0xFFFFFFFF;
matroxfb_accel.c:                               ACCESS_FBINFO(cmap[16]) 
= 0xFFFFFFFF;
matroxfb_crtc2.c:       m2info->cmap[16] = 0xFFFFFFFF;

								Petr


-------------------------------------------------------------------------
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and take
control of your XML. No limits. Just data. Click to get it now.
http://sourceforge.net/powerbar/db2/