6175ddf06b6172046a329e3abfd9c901a43efd2e breaks matroxfb console

6175ddf06b6172046a329e3abfd9c901a43efd2e breaks matroxfb console

[Ondrej Zary]

Hello,
matroxfb (at least with Mystique and Mystique 220) stopped working in 2.6.34 - 
the screen is completely corrupted. Bisection shows that 
6175ddf06b6172046a329e3abfd9c901a43efd2e is first bad commit.

Reverting 6175ddf06b6172046a329e3abfd9c901a43efd2e in 2.6.34 fixes the problem 
(1c5b9069e12e20d2fe883076ae0bf73966492108 must be reverted first).

-- 
Ondrej Zary

Re: 6175ddf06b6172046a329e3abfd9c901a43efd2e breaks matroxfb console

[H. Peter Anvin]

On 08/02/2010 12:49 PM, Ondrej Zary wrote:
> Hello,
> matroxfb (at least with Mystique and Mystique 220) stopped working in 2.6.34 - 
> the screen is completely corrupted. Bisection shows that 
> 6175ddf06b6172046a329e3abfd9c901a43efd2e is first bad commit.
> 
> Reverting 6175ddf06b6172046a329e3abfd9c901a43efd2e in 2.6.34 fixes the problem 
> (1c5b9069e12e20d2fe883076ae0bf73966492108 must be reverted first).
> 

Sounds like another driver which used memcpy_toio() when it should have
used iowrite32_rep() or __iowrite32_copy().

Hmm... is __iowrite32_copy() and iowrite32_rep() redundant?  If so, we
should get rid of the former.

	-hpa

Re: 6175ddf06b6172046a329e3abfd9c901a43efd2e breaks matroxfb console

[Ondrej Zary]

On Monday 02 August 2010 23:04:28 H. Peter Anvin wrote:
> On 08/02/2010 12:49 PM, Ondrej Zary wrote:
> > Hello,
> > matroxfb (at least with Mystique and Mystique 220) stopped working in
> > 2.6.34 - the screen is completely corrupted. Bisection shows that
> > 6175ddf06b6172046a329e3abfd9c901a43efd2e is first bad commit.
> >
> > Reverting 6175ddf06b6172046a329e3abfd9c901a43efd2e in 2.6.34 fixes the
> > problem (1c5b9069e12e20d2fe883076ae0bf73966492108 must be reverted
> > first).
>
> Sounds like another driver which used memcpy_toio() when it should have
> used iowrite32_rep() or __iowrite32_copy().
>
> Hmm... is __iowrite32_copy() and iowrite32_rep() redundant?  If so, we
> should get rid of the former.

There is a wrapper in drivers/video/matrox/matroxfb_base.h (see below) with
some comment. So this commit changed one of the three points?

static inline void mga_memcpy_toio(vaddr_t va, const void* src, int len) {
#if defined(__alpha__) || defined(__i386__) || defined(__x86_64__)
        /*
         * memcpy_toio works for us if:
         *  (1) Copies data as 32bit quantities, not byte after byte,
         *  (2) Performs LE ordered stores, and
         *  (3) It copes with unaligned source (destination is guaranteed to be page
         *      aligned and length is guaranteed to be multiple of 4).
         */
        memcpy_toio(va.vaddr, src, len);
#else
        u_int32_t __iomem* addr = va.vaddr;

        if ((unsigned long)src & 3) {
                while (len >= 4) {
                        fb_writel(get_unaligned((u32 *)src), addr);
                        addr++;
                        len -= 4;
                        src += 4;
                }
        } else {
                while (len >= 4) {
                        fb_writel(*(u32 *)src, addr);
                        addr++;
                        len -= 4;
                        src += 4;
                }
        }
#endif
}

-- 
Ondrej Zary

Re: 6175ddf06b6172046a329e3abfd9c901a43efd2e breaks matroxfb console

[H. Peter Anvin]

On 08/02/2010 02:14 PM, Ondrej Zary wrote:
> On Monday 02 August 2010 23:04:28 H. Peter Anvin wrote:
>> On 08/02/2010 12:49 PM, Ondrej Zary wrote:
>>> Hello,
>>> matroxfb (at least with Mystique and Mystique 220) stopped working in
>>> 2.6.34 - the screen is completely corrupted. Bisection shows that
>>> 6175ddf06b6172046a329e3abfd9c901a43efd2e is first bad commit.
>>>
>>> Reverting 6175ddf06b6172046a329e3abfd9c901a43efd2e in 2.6.34 fixes the
>>> problem (1c5b9069e12e20d2fe883076ae0bf73966492108 must be reverted
>>> first).
>>
>> Sounds like another driver which used memcpy_toio() when it should have
>> used iowrite32_rep() or __iowrite32_copy().
>>
>> Hmm... is __iowrite32_copy() and iowrite32_rep() redundant?  If so, we
>> should get rid of the former.
> 
> There is a wrapper in drivers/video/matrox/matroxfb_base.h (see below) with
> some comment. So this commit changed one of the three points?
> 
> static inline void mga_memcpy_toio(vaddr_t va, const void* src, int len) {
> #if defined(__alpha__) || defined(__i386__) || defined(__x86_64__)
>         /*
>          * memcpy_toio works for us if:
>          *  (1) Copies data as 32bit quantities, not byte after byte,
>          *  (2) Performs LE ordered stores, and
>          *  (3) It copes with unaligned source (destination is guaranteed to be page
>          *      aligned and length is guaranteed to be multiple of 4).
>          */
>         memcpy_toio(va.vaddr, src, len);
> #else

Yes, point (1) is not guaranteed by memcpy_toio().

	-hpa

Re: 6175ddf06b6172046a329e3abfd9c901a43efd2e breaks matroxfb console

[Ondrej Zary]

On Monday 02 August 2010 23:15:33 H. Peter Anvin wrote:
> On 08/02/2010 02:14 PM, Ondrej Zary wrote:
> > On Monday 02 August 2010 23:04:28 H. Peter Anvin wrote:
> >> On 08/02/2010 12:49 PM, Ondrej Zary wrote:
> >>> Hello,
> >>> matroxfb (at least with Mystique and Mystique 220) stopped working in
> >>> 2.6.34 - the screen is completely corrupted. Bisection shows that
> >>> 6175ddf06b6172046a329e3abfd9c901a43efd2e is first bad commit.
> >>>
> >>> Reverting 6175ddf06b6172046a329e3abfd9c901a43efd2e in 2.6.34 fixes the
> >>> problem (1c5b9069e12e20d2fe883076ae0bf73966492108 must be reverted
> >>> first).
> >>
> >> Sounds like another driver which used memcpy_toio() when it should have
> >> used iowrite32_rep() or __iowrite32_copy().
> >>
> >> Hmm... is __iowrite32_copy() and iowrite32_rep() redundant?  If so, we
> >> should get rid of the former.
> >
> > There is a wrapper in drivers/video/matrox/matroxfb_base.h (see below)
> > with some comment. So this commit changed one of the three points?
> >
> > static inline void mga_memcpy_toio(vaddr_t va, const void* src, int len)
> > { #if defined(__alpha__) || defined(__i386__) || defined(__x86_64__) /*
> >          * memcpy_toio works for us if:
> >          *  (1) Copies data as 32bit quantities, not byte after byte,
> >          *  (2) Performs LE ordered stores, and
> >          *  (3) It copes with unaligned source (destination is guaranteed
> > to be page *      aligned and length is guaranteed to be multiple of 4).
> > */
> >         memcpy_toio(va.vaddr, src, len);
> > #else
>
> Yes, point (1) is not guaranteed by memcpy_toio().

Now I wonder how many drivers will this break...

The patch below fixes it for me. Is it correct on all architectures?

--- linux-2.6.35-rc2/drivers/video/matrox/matroxfb_base.h	2010-06-06 05:43:24.000000000 +0200
+++ linux-2.6.35-rc3/drivers/video/matrox/matroxfb_base.h	2010-08-02 23:31:34.000000000 +0200
@@ -157,7 +157,7 @@ static inline void mga_memcpy_toio(vaddr
 	 *  (3) It copes with unaligned source (destination is guaranteed to be page
 	 *      aligned and length is guaranteed to be multiple of 4).
 	 */
-	memcpy_toio(va.vaddr, src, len);
+	iowrite32_rep(va.vaddr, src, len);
 #else
         u_int32_t __iomem* addr = va.vaddr;
 


-- 
Ondrej Zary

Re: 6175ddf06b6172046a329e3abfd9c901a43efd2e breaks matroxfb console

[H. Peter Anvin]

On 08/02/2010 02:35 PM, Ondrej Zary wrote:
> 
> The patch below fixes it for me. Is it correct on all architectures?
> 
> --- linux-2.6.35-rc2/drivers/video/matrox/matroxfb_base.h	2010-06-06 05:43:24.000000000 +0200
> +++ linux-2.6.35-rc3/drivers/video/matrox/matroxfb_base.h	2010-08-02 23:31:34.000000000 +0200
> @@ -157,7 +157,7 @@ static inline void mga_memcpy_toio(vaddr
>  	 *  (3) It copes with unaligned source (destination is guaranteed to be page
>  	 *      aligned and length is guaranteed to be multiple of 4).
>  	 */
> -	memcpy_toio(va.vaddr, src, len);
> +	iowrite32_rep(va.vaddr, src, len);
>  #else
>          u_int32_t __iomem* addr = va.vaddr;
>  

I don't think so; in particular I don't *think* non-x86 architectures
will deal with the requirement that it handles an unaligned source.  As
such, the #if would still be necessary; the #else clause could be
replaced with a get_unaligned() ... iowrite32() loop.

The other thing to watch out for is that "len" passed to iowrite32_rep()
is a count of 32-bit words, whereas memcpy_toio() takes a byte count...
you need to >> 2 there.

	-hpa

Re: 6175ddf06b6172046a329e3abfd9c901a43efd2e breaks matroxfb console

[Ondrej Zary]

On Monday 02 August 2010 23:42:29 H. Peter Anvin wrote:
> On 08/02/2010 02:35 PM, Ondrej Zary wrote:
> > The patch below fixes it for me. Is it correct on all architectures?
> >
> > --- linux-2.6.35-rc2/drivers/video/matrox/matroxfb_base.h	2010-06-06
> > 05:43:24.000000000 +0200 +++
> > linux-2.6.35-rc3/drivers/video/matrox/matroxfb_base.h	2010-08-02
> > 23:31:34.000000000 +0200 @@ -157,7 +157,7 @@ static inline void
> > mga_memcpy_toio(vaddr
> >  	 *  (3) It copes with unaligned source (destination is guaranteed to be
> > page *      aligned and length is guaranteed to be multiple of 4). */
> > -	memcpy_toio(va.vaddr, src, len);
> > +	iowrite32_rep(va.vaddr, src, len);
> >  #else
> >          u_int32_t __iomem* addr = va.vaddr;
>
> I don't think so; in particular I don't *think* non-x86 architectures
> will deal with the requirement that it handles an unaligned source.  As
> such, the #if would still be necessary; the #else clause could be
> replaced with a get_unaligned() ... iowrite32() loop.

Just tested the #else part on sparc and it seems to work fine - so I'm not going to touch (break) it.

> The other thing to watch out for is that "len" passed to iowrite32_rep()
> is a count of 32-bit words, whereas memcpy_toio() takes a byte count...
> you need to >> 2 there.

Thanks.

Here's v2 patch:


Fix incorrect use of memcpy_toio() in matroxfb that broke in 2.6.34.

Signed-off-by: Ondrej Zary <linux@rainbow-software.org>

--- linux-2.6.35-rc2/drivers/video/matrox/matroxfb_base.h	2010-06-06 05:43:24.000000000 +0200
+++ linux-2.6.35-rc3/drivers/video/matrox/matroxfb_base.h	2010-08-03 18:13:46.000000000 +0200
@@ -151,13 +151,13 @@ static inline void mga_writel(vaddr_t va
 static inline void mga_memcpy_toio(vaddr_t va, const void* src, int len) {
 #if defined(__alpha__) || defined(__i386__) || defined(__x86_64__)
 	/*
-	 * memcpy_toio works for us if:
+	 * iowrite32_rep works for us if:
 	 *  (1) Copies data as 32bit quantities, not byte after byte,
 	 *  (2) Performs LE ordered stores, and
 	 *  (3) It copes with unaligned source (destination is guaranteed to be page
 	 *      aligned and length is guaranteed to be multiple of 4).
 	 */
-	memcpy_toio(va.vaddr, src, len);
+	iowrite32_rep(va.vaddr, src, len >> 2);
 #else
         u_int32_t __iomem* addr = va.vaddr;
 


-- 
Ondrej Zary

RE: 6175ddf06b6172046a329e3abfd9c901a43efd2e breaks matroxfb console

[Chris Rankin]

> matroxfb (at least with Mystique and Mystique 220) stopped working
> in 2.6.34 - the screen is completely corrupted.

Interesting... I have just upgraded one of my old machines with a Matrox Millenium II card to 2.6.33.7, and have noticed that the matroxfb console has developed a slight wobble. (Think of a subtle "heat haze" / "one too many beers" kind of effect.)

Have any relevant changes been back-ported to 2.6.33.x-stable, please?

Cheers,
Chris