# \[BUGFIX\] video/mxsfb: fix crash when unblanking the display - Subsystems: FRAMEBUFFER LAYER, THE REST - Maintainers: Helge Deller, Linus Torvalds - List: linux-fbdev - 3 messages, 2 authors - Page: https://ratatoskr.run/linux-fbdev/2011/12/3796096/t ## \[BUGFIX\] video/mxsfb: fix crash when unblanking the display - From: Lothar Waßmann \ - Date: 2011-12-06 12:27:09 - Message: https://ratatoskr.run/linux-fbdev/2011/12/3796096.md ```text The VDCTRL4 register does not provide the MXS SET/CLR/TOGGLE feature. The write in mxsfb_disable_controller() sets the data_cnt for the LCD DMA to 0 which obviously means the max. count for the LCD DMA and leads to overwriting arbitrary memory when the display is unblanked. Signed-off-by: Lothar Waßmann --- drivers/video/mxsfb.c | 3 ++- 1 files changed, 2 insertions(+), 1 deletions(-) diff --git a/drivers/video/mxsfb.c b/drivers/video/mxsfb.c index d837d63..03cb95a 100644 --- a/drivers/video/mxsfb.c +++ b/drivers/video/mxsfb.c @@ -366,7 +366,8 @@ static void mxsfb_disable_controller(struct fb_info *fb_info) loop--; } - writel(VDCTRL4_SYNC_SIGNALS_ON, host->base + LCDC_VDCTRL4 + REG_CLR); + reg = readl(host->base + LCDC_VDCTRL4); + writel(reg & ~VDCTRL4_SYNC_SIGNALS_ON, host->base + LCDC_VDCTRL4); clk_disable(host->clk); -- 1.5.6.5 ``` ## Re: \[BUGFIX\] video/mxsfb: fix crash when unblanking the display - From: Lothar Waßmann \ - Date: 2011-12-21 07:27:15 - Message: https://ratatoskr.run/linux-fbdev/2011/12/3802481.md ```text Hi, Lothar Waßmann writes: > The VDCTRL4 register does not provide the MXS SET/CLR/TOGGLE feature. > The write in mxsfb_disable_controller() sets the data_cnt for the LCD > DMA to 0 which obviously means the max. count for the LCD DMA and > leads to overwriting arbitrary memory when the display is unblanked. > > Signed-off-by: Lothar Waßmann > --- > drivers/video/mxsfb.c | 3 ++- > 1 files changed, 2 insertions(+), 1 deletions(-) > > diff --git a/drivers/video/mxsfb.c b/drivers/video/mxsfb.c > index d837d63..03cb95a 100644 > --- a/drivers/video/mxsfb.c > +++ b/drivers/video/mxsfb.c > @@ -366,7 +366,8 @@ static void mxsfb_disable_controller(struct fb_info *fb_info) > loop--; > } > > - writel(VDCTRL4_SYNC_SIGNALS_ON, host->base + LCDC_VDCTRL4 + REG_CLR); > + reg = readl(host->base + LCDC_VDCTRL4); > + writel(reg & ~VDCTRL4_SYNC_SIGNALS_ON, host->base + LCDC_VDCTRL4); > > clk_disable(host->clk); > > -- > 1.5.6.5 > Ping. Any comments on this? Lothar Waßmann -- ___________________________________________________________ Ka-Ro electronics GmbH | Pascalstraße 22 | D - 52076 Aachen Phone: +49 2408 1402-0 | Fax: +49 2408 1402-10 Geschäftsführer: Matthias Kaussen Handelsregistereintrag: Amtsgericht Aachen, HRB 4996 www.karo-electronics.de | info@karo-electronics.de ___________________________________________________________ ``` ## Re: \[BUGFIX\] video/mxsfb: fix crash when unblanking the display - From: Robin van der Gracht \ - Date: 2012-07-18 09:53:01 - Message: https://ratatoskr.run/linux-fbdev/2012/07/3895267.md ```text Hi Lothar, > Hi, > > Lothar Waßmann writes: >> The VDCTRL4 register does not provide the MXS SET/CLR/TOGGLE feature. >> The write in mxsfb_disable_controller() sets the data_cnt for the LCD >> DMA to 0 which obviously means the max. count for the LCD DMA and >> leads to overwriting arbitrary memory when the display is unblanked. >> >> Signed-off-by: Lothar Waßmann >> --- >> drivers/video/mxsfb.c | 3 ++- >> 1 files changed, 2 insertions(+), 1 deletions(-) >> >> diff --git a/drivers/video/mxsfb.c b/drivers/video/mxsfb.c >> index d837d63..03cb95a 100644 >> --- a/drivers/video/mxsfb.c >> +++ b/drivers/video/mxsfb.c >> @@ -366,7 +366,8 @@ static void mxsfb_disable_controller(struct fb_info *fb_info) >> loop--; >> } >> >> - writel(VDCTRL4_SYNC_SIGNALS_ON, host->base + LCDC_VDCTRL4 + REG_CLR); >> + reg = readl(host->base + LCDC_VDCTRL4); >> + writel(reg& ~VDCTRL4_SYNC_SIGNALS_ON, host->base + LCDC_VDCTRL4); >> >> clk_disable(host->clk); >> >> -- >> 1.5.6.5 >> > Ping. Any comments on this? > > > Lothar Waßmann I've encountered this problem to, and i can confirm your patch fixed it. The VDCTRL4 register has no CLR feature. Regards, -- Robin van der Gracht Protonic Holland. tel.: +31 (0) 229 212928 fax.: +31 (0) 229 210930 Factorij 36 / 1689 AL Zwaag ```