linux-stable.git/drivers/video/fbdev/aty, branch linux-4.9.y

mach64: fix image corruption due to reading accelerator registers

2018-11-21T08:26:00+00:00

commit c09bcc91bb94ed91f1391bffcbe294963d605732 upstream.

Reading the registers without waiting for engine idle returns
unpredictable values. These unpredictable values result in display
corruption - if atyfb_imageblit reads the content of DP_PIX_WIDTH with the
bit DP_HOST_TRIPLE_EN set (from previous invocation), the driver would
never ever clear the bit, resulting in display corruption.

We don't want to wait for idle because it would degrade performance, so
this patch modifies the driver so that it never reads accelerator
registers.

HOST_CNTL doesn't have to be read, we can just write it with
HOST_BYTE_ALIGN because no other part of the driver cares if
HOST_BYTE_ALIGN is set.

DP_PIX_WIDTH is written in the functions atyfb_copyarea and atyfb_fillrect
with the default value and in atyfb_imageblit with the value set according
to the source image data.

Signed-off-by: Mikulas Patocka 
Reviewed-by: Ville Syrjälä 
Cc: stable@vger.kernel.org
Signed-off-by: Bartlomiej Zolnierkiewicz 
Signed-off-by: Greg Kroah-Hartman

mach64: fix display corruption on big endian machines

2018-11-21T08:25:59+00:00

commit 3c6c6a7878d00a3ac997a779c5b9861ff25dfcc8 upstream.

The code for manual bit triple is not endian-clean. It builds the variable
"hostdword" using byte accesses, therefore we must read the variable with
"le32_to_cpu".

The patch also enables (hardware or software) bit triple only if the image
is monochrome (image->depth). If we want to blit full-color image, we
shouldn't use the triple code.

Signed-off-by: Mikulas Patocka 
Reviewed-by: Ville Syrjälä 
Cc: stable@vger.kernel.org
Signed-off-by: Bartlomiej Zolnierkiewicz 
Signed-off-by: Greg Kroah-Hartman

mach64: detect the dot clock divider correctly on sparc

2018-10-18T07:13:21+00:00

commit 76ebebd2464c5c8a4453c98b6dbf9c95a599e810 upstream.

On Sun Ultra 5, it happens that the dot clock is not set up properly for
some videomodes. For example, if we set the videomode "r1024x768x60" in
the firmware, Linux would incorrectly set a videomode with refresh rate
180Hz when booting (suprisingly, my LCD monitor can display it, although
display quality is very low).

The reason is this: Older mach64 cards set the divider in the register
VCLK_POST_DIV. The register has four 2-bit fields (the field that is
actually used is specified in the lowest two bits of the register
CLOCK_CNTL). The 2 bits select divider "1, 2, 4, 8". On newer mach64 cards,
there's another bit added - the top four bits of PLL_EXT_CNTL extend the
divider selection, so we have possible dividers "1, 2, 4, 8, 3, 5, 6, 12".
The Linux driver clears the top four bits of PLL_EXT_CNTL and never sets
them, so it can work regardless if the card supports them. However, the
sparc64 firmware may set these extended dividers during boot - and the
mach64 driver detects incorrect dot clock in this case.

This patch makes the driver read the additional divider bit from
PLL_EXT_CNTL and calculate the initial refresh rate properly.

Signed-off-by: Mikulas Patocka 
Cc: stable@vger.kernel.org
Acked-by: David S. Miller 
Reviewed-by: Ville Syrjälä 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

video: fbdev: aty: do not leak uninitialized padding in clk to userspace

2017-10-05T07:44:05+00:00

commit 8e75f7a7a00461ef6d91797a60b606367f6e344d upstream.

'clk' is copied to a userland with padding byte(s) after 'vclk_post_div'
field unitialized, leaking data from the stack. Fix this ensuring all of
'clk' is initialized to zero.

References: https://github.com/torvalds/linux/pull/441
Reported-by: sohu0106 
Signed-off-by: Vladis Dronov 
Signed-off-by: Bartlomiej Zolnierkiewicz 
Signed-off-by: Greg Kroah-Hartman

video: fbdev: constify fb_fix_screeninfo and fb_var_screeninfo structures

2016-09-27T08:16:35+00:00

These structures are only used to copy into other structures, so declare
them as const.

The semantic patch that makes this change in the fb_fix_screeninfo case is
as follows (http://coccinelle.lip6.fr/).  The fb_var_screeninfo case is
analogous.

// 
@r disable optional_qualifier@
identifier i;
position p;
@@
static struct fb_fix_screeninfo i@p = { ... };

@ok@
identifier r.i;
expression e;
position p;
@@
e = i@p

@bad@
position p != {r.p,ok.p};
identifier r.i;
struct fb_fix_screeninfo e;
@@
e@i@p

@depends on !bad disable optional_qualifier@
identifier r.i;
@@
static
+const
 struct fb_fix_screeninfo i = { ... };
// 

Signed-off-by: Julia Lawall 
Signed-off-by: Tomi Valkeinen

PCI: Remove includes of asm/pci-bridge.h

2016-02-05T22:29:28+00:00

Drivers should include asm/pci-bridge.h only when they need the arch-
specific things provided there.  Outside of the arch/ directories, the only
drivers that actually need things provided by asm/pci-bridge.h are the
powerpc RPA hotplug drivers in drivers/pci/hotplug/rpa*.

Remove the includes of asm/pci-bridge.h from the other drivers, adding an
include of linux/pci.h if necessary.

Signed-off-by: Bjorn Helgaas

radeonfb: Deinline large functions

2015-10-08T09:24:12+00:00

With this .config: http://busybox.net/~vda/kernel_config,
after uninlining these functions have sizes and callsite counts
as follows:

__OUTPLLP: 61 bytes, 12 callsites
__INPLL:   79 bytes, 150 callsites
__OUTPLL:  82 bytes, 138 callsites
_OUTREGP: 101 bytes, 8 callsites
_radeon_msleep:      66 bytes, 18 callsites
_radeon_fifo_wait:   83 bytes, 24 callsites
_radeon_engine_idle: 92 bytes, 10 callsites
radeon_engine_flush: 105 bytes, 2 callsites
radeon_pll_errata_after_index_slow: 31 bytes, 11 callsites
radeon_pll_errata_after_data_slow:  91 bytes, 9 callsites

radeon_pll_errata_after_FOO functions are split into two parts:
the inlined part which checks corresponding rinfo->errata bit,
and out-of-line part which performs workaround magic per se.

Reduction in code size is about 49,500 bytes:

    text     data      bss       dec     hex filename
85789648 22294616 20627456 128711720 7abfc28 vmlinux.before
85740176 22294680 20627456 128662312 7ab3b28 vmlinux

Signed-off-by: Denys Vlasenko 
Cc: Benjamin Herrenschmidt 
Cc: Jean-Christophe Plagniol-Villard 
Cc: Tomi Valkeinen 
Cc: Richard Purdie 
Cc: Chris Wilson 
Cc: David Airlie 
Cc: Alex Deucher 
Cc: Ben Skeggs 
Cc: Zhang Rui 
Cc: Len Brown 
Cc: Jesse Barnes 
Cc: Dave Airlie 
Cc: linux-kernel@vger.kernel.org
Cc: linux-fbdev@vger.kernel.org
Signed-off-by: Tomi Valkeinen

Merge tag 'v4.2-rc8' into x86/mm, before applying new changes

2015-08-25T07:59:19+00:00

Signed-off-by: Ingo Molnar

drivers/video/fbdev/atyfb: Use arch_phys_wc_add() and ioremap_wc()

2015-07-21T08:47:05+00:00

This driver uses strong UC for the MMIO region, and ioremap_wc()
for the framebuffer to whitelist for the WC MTRR that can be
changed to WC. On PAT systems we don't need the MTRR call so
just use arch_phys_wc_add() there, this lets us remove all those
ifdefs. Let's also be consistent and use ioremap_wc() for ATARI
as well.

There are a few motivations for this:

  a) Take advantage of PAT when available.

  b) Help bury MTRR code away, MTRR is architecture specific and
     on x86 it is being replaced by PAT.

  c) Help with the goal of eventually using _PAGE_CACHE_UC over
     _PAGE_CACHE_UC_MINUS on x86 on ioremap_nocache() (see commit
     de33c442e titled "x86 PAT: fix performance drop for glx,
     use UC minus for ioremap(), ioremap_nocache() and
     pci_mmap_page_range()").

The conversion done is expressed by the following Coccinelle
SmPL patch, it additionally required manual intervention to
address all the ifdeffery and removal of redundant things which
arch_phys_wc_add() already addresses such as verbose message
about when MTRR fails and doing nothing when we didn't get an
MTRR:

	@ mtrr_found @
	expression index, base, size;
	@@

	-index = mtrr_add(base, size, MTRR_TYPE_WRCOMB, 1);
	+index = arch_phys_wc_add(base, size);

	@ mtrr_rm depends on mtrr_found @
	expression mtrr_found.index, mtrr_found.base, mtrr_found.size;
	@@

	-mtrr_del(index, base, size);
	+arch_phys_wc_del(index);

	@ mtrr_rm_zero_arg depends on mtrr_found @
	expression mtrr_found.index;
	@@

	-mtrr_del(index, 0, 0);
	+arch_phys_wc_del(index);

	@ mtrr_rm_fb_info depends on mtrr_found @
	struct fb_info *info;
	expression mtrr_found.index;
	@@

	-mtrr_del(index, info->fix.smem_start, info->fix.smem_len);
	+arch_phys_wc_del(index);

	@ ioremap_replace_nocache depends on mtrr_found @
	struct fb_info *info;
	expression base, size;
	@@

	-info->screen_base = ioremap_nocache(base, size);
	+info->screen_base = ioremap_wc(base, size);

	@ ioremap_replace_default depends on mtrr_found @
	struct fb_info *info;
	expression base, size;
	@@

	-info->screen_base = ioremap(base, size);
	+info->screen_base = ioremap_wc(base, size);

Signed-off-by: Luis R. Rodriguez 
Signed-off-by: Borislav Petkov 
Cc: Andrew Morton 
Cc: Andrzej Hajda 
Cc: Andy Lutomirski 
Cc: Antonino Daplas 
Cc: Daniel Vetter 
Cc: Dave Airlie 
Cc: Davidlohr Bueso 
Cc: H. Peter Anvin 
Cc: Jean-Christophe Plagniol-Villard 
Cc: Juergen Gross 
Cc: Linus Torvalds 
Cc: Mathias Krause 
Cc: Mel Gorman 
Cc: Peter Zijlstra 
Cc: Rob Clark 
Cc: Suresh Siddha 
Cc: Thomas Gleixner 
Cc: Tomi Valkeinen 
Cc: Toshi Kani 
Cc: Ville Syrjälä 
Cc: Vlastimil Babka 
Cc: arnd@arndb.de
Cc: benh@kernel.crashing.org
Cc: dan.j.williams@intel.com
Cc: geert@linux-m68k.org
Cc: hch@lst.de
Cc: hmh@hmh.eng.br
Cc: linux-fbdev@vger.kernel.org
Cc: linux-mm@kvack.org
Cc: linux-pci@vger.kernel.org
Cc: mpe@ellerman.id.au
Cc: mst@redhat.com
Cc: ralf@linux-mips.org
Cc: ross.zwisler@linux.intel.com
Cc: stefan.bader@canonical.com
Cc: tj@kernel.org
Cc: ville.syrjala@linux.intel.com
Link: http://lkml.kernel.org/r/1436491499-3289-5-git-send-email-mcgrof@do-not-panic.com
Signed-off-by: Ingo Molnar

drivers/video/fbdev/atyfb: Replace MTRR UC hole with strong UC

2015-07-21T08:47:05+00:00

Replace a WC MTRR call followed by a UC MTRR "hole" call with a
single WC MTRR call and use strong UC to protect the MMIO region
and account for the device's architecture and MTRR size
requirements.

The atyfb driver relies on two overlapping MTRRs. It does this
to account for the fact that, on some devices, it has the MMIO
region bundled together with the framebuffer on the same PCI BAR
and the hardware requirement on MTRRs on both base and size to
be powers of two.

In the worst case, the PCI BAR is of 16 MiB while the MMIO
region is on the last 4 KiB of the same PCI BAR. If we use just
one MTRR for WC, we can only end up with an 8 MiB or 16 MiB
framebuffer. Using a 16 MiB WC framebuffer area is unacceptable
since we need the MMIO region to not be write-combined. An 8 MiB
WC framebuffer option does not let use quite a bit of
framebuffer space, it would reduce the resolution capability of
the device considerably.

An alternative is to use many MTRRs but on some systems that
could mean not having enough MTRRs to cover the framebuffer. The
current solution is to issue a 16 MiB WC MTRR followed by a 4
KiB UC MTRR on the last 4 KiB. Its worth mentioning and
documenting that the current ioremap*() strategy as well: the
first ioremap() is used only for the MMIO region, a second
ioremap() call is used for the framebuffer *and* the MMIO
region, the MMIO region then ends up mmapped twice.

Two ioremap() calls are used since in some situations the
framebuffer actually ends up on a separate auxiliary PCI BAR,
but this is not always true. In the worst case, the PCI BAR is
shared for both MMIO and the framebuffer. By allowing
overlapping ioremap() calls, the driver enables two types of
devices with one simple ioremap() strategy.

See also:

  2f9e897353fc ("x86/mm/mtrr, pat: Document Write Combining MTRR type effects on PAT / non-PAT pages")

By default, Linux today defaults both pci_mmap_page_range() and
ioremap_nocache() to use _PAGE_CACHE_MODE_UC_MINUS. On x86,
ioremap() aliases ioremap_nocache(). The preferred value for
Linux may soon change, however, the goal is to use
_PAGE_CACHE_MODE_UC by default in the future.

We can use ioremap_uc() to set PCD=1, PWT=1 on non-PAT systems
and use a PAT value of UC for PAT systems. This will ensure the
same settings are in place regardless of what Linux decides to
use by default later and to not regress our MTRR strategy since
the effective memory type will differ depending on the value
used. Using a WC MTRR on such an area will be nullified. This
technique can be used to protect the MMIO region in this
driver's case and address the restrictions of the device's
architecture as well as restrictions set upon us by powers of 2
when using MTRRs.

This allows us to replace the two MTRR calls with a single 16
MiB WC MTRR and use page-attribute settings for non-PAT and PAT
entry values for PAT systems to ensure the appropriate effective
memory type won't have a write-combining effect on the MMIO
region on both non-PAT and PAT systems. The framebuffer area
will be sure to get the write-combined effective memory type by
white-listing it with ioremap_wc().

We ensure the desired effective memory types are set by:

0) Using one ioremap_uc() for the MMIO region alone.
   This will set the page attribute settings for the MMIO
   region to PCD=1, PWT=1 for non-PAT systems while using a
   strong UC value on PAT systems.

1) Fixing the framebuffer ioremapped area to exclude the
   MMIO region and using ioremap_wc() instead to whitelist
   the area we want for write-combining.

In both cases, an implementation defined (as per 2f9e897353fc)
effective memory type of WC is used for the framebuffer for
non-PAT systems.

Signed-off-by: Luis R. Rodriguez 
Signed-off-by: Borislav Petkov 
Cc: Andrew Morton 
Cc: Andrzej Hajda 
Cc: Andy Lutomirski 
Cc: Antonino Daplas 
Cc: Daniel Vetter 
Cc: Dave Airlie 
Cc: Davidlohr Bueso 
Cc: H. Peter Anvin 
Cc: Jean-Christophe Plagniol-Villard 
Cc: Juergen Gross 
Cc: Linus Torvalds 
Cc: Mathias Krause 
Cc: Mel Gorman 
Cc: Peter Zijlstra 
Cc: Rob Clark 
Cc: Suresh Siddha 
Cc: Thomas Gleixner 
Cc: Tomi Valkeinen 
Cc: Toshi Kani 
Cc: Ville Syrjälä 
Cc: Vlastimil Babka 
Cc: arnd@arndb.de
Cc: benh@kernel.crashing.org
Cc: dan.j.williams@intel.com
Cc: geert@linux-m68k.org
Cc: hch@lst.de
Cc: hmh@hmh.eng.br
Cc: linux-fbdev@vger.kernel.org
Cc: linux-mm@kvack.org
Cc: linux-pci@vger.kernel.org
Cc: mpe@ellerman.id.au
Cc: mst@redhat.com
Cc: ralf@linux-mips.org
Cc: ross.zwisler@linux.intel.com
Cc: stefan.bader@canonical.com
Cc: tj@kernel.org
Cc: ville.syrjala@linux.intel.com
Link: http://lkml.kernel.org/r/1435196060-27350-3-git-send-email-mcgrof@do-not-panic.com
Link: http://lkml.kernel.org/r/1436491499-3289-4-git-send-email-mcgrof@do-not-panic.com
Signed-off-by: Ingo Molnar