Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

The Graphics Synthesizer (GS) drivers #10

Open
frno7 opened this issue Mar 17, 2019 · 64 comments
Open

The Graphics Synthesizer (GS) drivers #10

frno7 opened this issue Mar 17, 2019 · 64 comments
Labels
enhancement New feature or request question Further information is requested

Comments

@frno7
Copy link
Owner

frno7 commented Mar 17, 2019

The Graphics Synthesizer (GS) frame buffer device driver drivers/video/fbdev/ps2fb.c currently operates in

  1. text console mode, via the fbcon driver and its tiled API. It turned out to be a rather good fit. The GS has 4 MiB of local frame buffer video memory that is not directly accessible by the kernel due to its hardware design. No main memory is allocated for the frame buffer, which is a significant saving given that the PlayStation 2 is limited to 32 MiB of total main memory, and mmap is disabled.

    The maximum practical resolution 1920×1080p at 16 bits per pixel is 4147200 bytes, which leaves 47104 bytes for a tiled font, which at 8×8 pixels and at a minimum of a 4 bits indexed texture palette is at most 1464 characters. The indexed palette makes it easy to switch colors. struct fb_tile_ops such as fb_tileblit, fb_fillrect and fb_copyarea are accelerated by GS hardware that is very fast for the kernel via simple DMA (GIF) GS commands. The GS has two CRT merge circuits made for picture-in-picture that are used to accelerate YWRAP in hardware, which is particularly effective for console text scrolling.

    Console text operations are synchronous and therefore work properly in interrupt contexts, with kernel panics, etc. This is essential for debuggability (see also Enable the R5900 breakpoint hardware #27). Various optimisation techniques, such as buffering, can possibly be even faster, but one might want to implement that as a user space console driver via some kind of /dev/gs interface (as explained below) that can do zero-copying of GS commands, etc.

    See also Improve early printk using the Graphics Synthesizer #9 for early printk during booting.

It’s possible to implement a

  1. virtual frame buffer mode, similar to the PlayStation 3 in that the whole visible main memory frame buffer is regularly copied to the GS via DMA at vertical blank intervals. This enables mmap, which is required for frame buffer compatibility, but it is otherwise very inefficient and slow. A complete copy of the whole frame buffer is allocated in main memory and GS hardware acceleration is turned off.

An interesting variant,

  1. a specific Graphics Synthesizer device driver, is not yet implemented. The GS hardware is essentially a serial device that accepts a series of commands via DMA. A /dev/gs device driver could provide direct access to the GS hardware, which would be very efficient and enable most of the GS features to applications. The main drawback is that this kind of device driver is specific to the GS.

Support the Direct Rendering Manager subsystem?

@frno7 frno7 added enhancement New feature or request question Further information is requested labels Mar 17, 2019
@frno7 frno7 changed the title The Graphics Synthesizer drivers The Graphics Synthesizer (GS) drivers Mar 17, 2019
frno7 pushed a commit that referenced this issue Apr 19, 2019
commit fa30dde upstream.

We see the following NULL pointer dereference while running xfstests
generic/475:
BUG: unable to handle kernel NULL pointer dereference at 0000000000000008
PGD 8000000c84bad067 P4D 8000000c84bad067 PUD c84e62067 PMD 0
Oops: 0000 [#1] SMP PTI
CPU: 7 PID: 9886 Comm: fsstress Kdump: loaded Not tainted 5.0.0-rc8 #10
RIP: 0010:ext4_do_update_inode+0x4ec/0x760
...
Call Trace:
? jbd2_journal_get_write_access+0x42/0x50
? __ext4_journal_get_write_access+0x2c/0x70
? ext4_truncate+0x186/0x3f0
ext4_mark_iloc_dirty+0x61/0x80
ext4_mark_inode_dirty+0x62/0x1b0
ext4_truncate+0x186/0x3f0
? unmap_mapping_pages+0x56/0x100
ext4_setattr+0x817/0x8b0
notify_change+0x1df/0x430
do_truncate+0x5e/0x90
? generic_permission+0x12b/0x1a0

This is triggered because the NULL pointer handle->h_transaction was
dereferenced in function ext4_update_inode_fsync_trans().
I found that the h_transaction was set to NULL in jbd2__journal_restart
but failed to attached to a new transaction while the journal is aborted.

Fix this by checking the handle before updating the inode.

Fixes: b436b9b ("ext4: Wait for proper transaction commit on fsync")
Signed-off-by: Jiufei Xue <jiufei.xue@linux.alibaba.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Cc: stable@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
frno7 pushed a commit that referenced this issue Apr 28, 2019
…_map

[ Upstream commit 39df730 ]

Detected via gcc's ASan:

  Direct leak of 2048 byte(s) in 64 object(s) allocated from:
    6     #0 0x7f606512e370 in __interceptor_realloc (/usr/lib/x86_64-linux-gnu/libasan.so.5+0xee370)
    7     #1 0x556b0f1d7ddd in thread_map__realloc util/thread_map.c:43
    8     #2 0x556b0f1d84c7 in thread_map__new_by_tid util/thread_map.c:85
    9     #3 0x556b0f0e045e in is_event_supported util/parse-events.c:2250
   10     #4 0x556b0f0e1aa1 in print_hwcache_events util/parse-events.c:2382
   11     #5 0x556b0f0e3231 in print_events util/parse-events.c:2514
   12     #6 0x556b0ee0a66e in cmd_list /home/changbin/work/linux/tools/perf/builtin-list.c:58
   13     #7 0x556b0f01e0ae in run_builtin /home/changbin/work/linux/tools/perf/perf.c:302
   14     #8 0x556b0f01e859 in handle_internal_command /home/changbin/work/linux/tools/perf/perf.c:354
   15     #9 0x556b0f01edc8 in run_argv /home/changbin/work/linux/tools/perf/perf.c:398
   16     #10 0x556b0f01f71f in main /home/changbin/work/linux/tools/perf/perf.c:520
   17     #11 0x7f6062ccf09a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2409a)

Signed-off-by: Changbin Du <changbin.du@gmail.com>
Reviewed-by: Jiri Olsa <jolsa@kernel.org>
Cc: Alexei Starovoitov <ast@kernel.org>
Cc: Daniel Borkmann <daniel@iogearbox.net>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Steven Rostedt (VMware) <rostedt@goodmis.org>
Fixes: 8989605 ("perf tools: Do not put a variable sized type not at the end of a struct")
Link: http://lkml.kernel.org/r/20190316080556.3075-3-changbin.du@gmail.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
frno7 pushed a commit that referenced this issue Apr 28, 2019
[ Upstream commit 54569ba ]

Detected with gcc's ASan:

  Direct leak of 66 byte(s) in 5 object(s) allocated from:
      #0 0x7ff3b1f32070 in __interceptor_strdup (/usr/lib/x86_64-linux-gnu/libasan.so.5+0x3b070)
      #1 0x560c8761034d in collect_config util/config.c:597
      #2 0x560c8760d9cb in get_value util/config.c:169
      #3 0x560c8760dfd7 in perf_parse_file util/config.c:285
      #4 0x560c8760e0d2 in perf_config_from_file util/config.c:476
      #5 0x560c876108fd in perf_config_set__init util/config.c:661
      #6 0x560c87610c72 in perf_config_set__new util/config.c:709
      #7 0x560c87610d2f in perf_config__init util/config.c:718
      #8 0x560c87610e5d in perf_config util/config.c:730
      #9 0x560c875ddea0 in main /home/changbin/work/linux/tools/perf/perf.c:442
      #10 0x7ff3afb8609a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2409a)

Signed-off-by: Changbin Du <changbin.du@gmail.com>
Reviewed-by: Jiri Olsa <jolsa@kernel.org>
Cc: Alexei Starovoitov <ast@kernel.org>
Cc: Daniel Borkmann <daniel@iogearbox.net>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Steven Rostedt (VMware) <rostedt@goodmis.org>
Cc: Taeung Song <treeze.taeung@gmail.com>
Fixes: 20105ca ("perf config: Introduce perf_config_set class")
Link: http://lkml.kernel.org/r/20190316080556.3075-6-changbin.du@gmail.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
frno7 pushed a commit that referenced this issue Apr 28, 2019
[ Upstream commit 42dfa45 ]

Using gcc's ASan, Changbin reports:

  =================================================================
  ==7494==ERROR: LeakSanitizer: detected memory leaks

  Direct leak of 48 byte(s) in 1 object(s) allocated from:
      #0 0x7f0333a89138 in calloc (/usr/lib/x86_64-linux-gnu/libasan.so.5+0xee138)
      #1 0x5625e5330a5e in zalloc util/util.h:23
      #2 0x5625e5330a9b in perf_counts__new util/counts.c:10
      #3 0x5625e5330ca0 in perf_evsel__alloc_counts util/counts.c:47
      #4 0x5625e520d8e5 in __perf_evsel__read_on_cpu util/evsel.c:1505
      #5 0x5625e517a985 in perf_evsel__read_on_cpu /home/work/linux/tools/perf/util/evsel.h:347
      #6 0x5625e517ad1a in test__openat_syscall_event tests/openat-syscall.c:47
      #7 0x5625e51528e6 in run_test tests/builtin-test.c:358
      #8 0x5625e5152baf in test_and_print tests/builtin-test.c:388
      #9 0x5625e51543fe in __cmd_test tests/builtin-test.c:583
      #10 0x5625e515572f in cmd_test tests/builtin-test.c:722
      #11 0x5625e51c3fb8 in run_builtin /home/changbin/work/linux/tools/perf/perf.c:302
      #12 0x5625e51c44f7 in handle_internal_command /home/changbin/work/linux/tools/perf/perf.c:354
      #13 0x5625e51c48fb in run_argv /home/changbin/work/linux/tools/perf/perf.c:398
      #14 0x5625e51c5069 in main /home/changbin/work/linux/tools/perf/perf.c:520
      #15 0x7f033214d09a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2409a)

  Indirect leak of 72 byte(s) in 1 object(s) allocated from:
      #0 0x7f0333a89138 in calloc (/usr/lib/x86_64-linux-gnu/libasan.so.5+0xee138)
      #1 0x5625e532560d in zalloc util/util.h:23
      #2 0x5625e532566b in xyarray__new util/xyarray.c:10
      #3 0x5625e5330aba in perf_counts__new util/counts.c:15
      #4 0x5625e5330ca0 in perf_evsel__alloc_counts util/counts.c:47
      #5 0x5625e520d8e5 in __perf_evsel__read_on_cpu util/evsel.c:1505
      #6 0x5625e517a985 in perf_evsel__read_on_cpu /home/work/linux/tools/perf/util/evsel.h:347
      #7 0x5625e517ad1a in test__openat_syscall_event tests/openat-syscall.c:47
      #8 0x5625e51528e6 in run_test tests/builtin-test.c:358
      #9 0x5625e5152baf in test_and_print tests/builtin-test.c:388
      #10 0x5625e51543fe in __cmd_test tests/builtin-test.c:583
      #11 0x5625e515572f in cmd_test tests/builtin-test.c:722
      #12 0x5625e51c3fb8 in run_builtin /home/changbin/work/linux/tools/perf/perf.c:302
      #13 0x5625e51c44f7 in handle_internal_command /home/changbin/work/linux/tools/perf/perf.c:354
      #14 0x5625e51c48fb in run_argv /home/changbin/work/linux/tools/perf/perf.c:398
      #15 0x5625e51c5069 in main /home/changbin/work/linux/tools/perf/perf.c:520
      #16 0x7f033214d09a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2409a)

His patch took care of evsel->prev_raw_counts, but the above backtraces
are about evsel->counts, so fix that instead.

Reported-by: Changbin Du <changbin.du@gmail.com>
Cc: Alexei Starovoitov <ast@kernel.org>
Cc: Daniel Borkmann <daniel@iogearbox.net>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Steven Rostedt (VMware) <rostedt@goodmis.org>
Link: https://lkml.kernel.org/n/tip-hd1x13g59f0nuhe4anxhsmfp@git.kernel.org
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
frno7 pushed a commit that referenced this issue Apr 28, 2019
…_event_on_all_cpus test

[ Upstream commit 93faa52 ]

  =================================================================
  ==7497==ERROR: LeakSanitizer: detected memory leaks

  Direct leak of 40 byte(s) in 1 object(s) allocated from:
      #0 0x7f0333a88f30 in __interceptor_malloc (/usr/lib/x86_64-linux-gnu/libasan.so.5+0xedf30)
      #1 0x5625e5326213 in cpu_map__trim_new util/cpumap.c:45
      #2 0x5625e5326703 in cpu_map__read util/cpumap.c:103
      #3 0x5625e53267ef in cpu_map__read_all_cpu_map util/cpumap.c:120
      #4 0x5625e5326915 in cpu_map__new util/cpumap.c:135
      #5 0x5625e517b355 in test__openat_syscall_event_on_all_cpus tests/openat-syscall-all-cpus.c:36
      #6 0x5625e51528e6 in run_test tests/builtin-test.c:358
      #7 0x5625e5152baf in test_and_print tests/builtin-test.c:388
      #8 0x5625e51543fe in __cmd_test tests/builtin-test.c:583
      #9 0x5625e515572f in cmd_test tests/builtin-test.c:722
      #10 0x5625e51c3fb8 in run_builtin /home/changbin/work/linux/tools/perf/perf.c:302
      #11 0x5625e51c44f7 in handle_internal_command /home/changbin/work/linux/tools/perf/perf.c:354
      #12 0x5625e51c48fb in run_argv /home/changbin/work/linux/tools/perf/perf.c:398
      #13 0x5625e51c5069 in main /home/changbin/work/linux/tools/perf/perf.c:520
      #14 0x7f033214d09a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2409a)

Signed-off-by: Changbin Du <changbin.du@gmail.com>
Reviewed-by: Jiri Olsa <jolsa@kernel.org>
Cc: Alexei Starovoitov <ast@kernel.org>
Cc: Daniel Borkmann <daniel@iogearbox.net>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Steven Rostedt (VMware) <rostedt@goodmis.org>
Fixes: f30a79b ("perf tools: Add reference counting for cpu_map object")
Link: http://lkml.kernel.org/r/20190316080556.3075-15-changbin.du@gmail.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
frno7 pushed a commit that referenced this issue Apr 28, 2019
[ Upstream commit f97a899 ]

  =================================================================
  ==7506==ERROR: LeakSanitizer: detected memory leaks

  Direct leak of 13 byte(s) in 3 object(s) allocated from:
      #0 0x7f03339d6070 in __interceptor_strdup (/usr/lib/x86_64-linux-gnu/libasan.so.5+0x3b070)
      #1 0x5625e53aaef0 in expr__find_other util/expr.y:221
      #2 0x5625e51bcd3f in test__expr tests/expr.c:52
      #3 0x5625e51528e6 in run_test tests/builtin-test.c:358
      #4 0x5625e5152baf in test_and_print tests/builtin-test.c:388
      #5 0x5625e51543fe in __cmd_test tests/builtin-test.c:583
      #6 0x5625e515572f in cmd_test tests/builtin-test.c:722
      #7 0x5625e51c3fb8 in run_builtin /home/changbin/work/linux/tools/perf/perf.c:302
      #8 0x5625e51c44f7 in handle_internal_command /home/changbin/work/linux/tools/perf/perf.c:354
      #9 0x5625e51c48fb in run_argv /home/changbin/work/linux/tools/perf/perf.c:398
      #10 0x5625e51c5069 in main /home/changbin/work/linux/tools/perf/perf.c:520
      #11 0x7f033214d09a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2409a)

Signed-off-by: Changbin Du <changbin.du@gmail.com>
Cc: Alexei Starovoitov <ast@kernel.org>
Cc: Andi Kleen <ak@linux.intel.com>
Cc: Daniel Borkmann <daniel@iogearbox.net>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Steven Rostedt (VMware) <rostedt@goodmis.org>
Fixes: 0751673 ("perf tools: Add a simple expression parser for JSON")
Link: http://lkml.kernel.org/r/20190316080556.3075-16-changbin.du@gmail.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
frno7 pushed a commit that referenced this issue Apr 28, 2019
[ Upstream commit d982b33 ]

  =================================================================
  ==20875==ERROR: LeakSanitizer: detected memory leaks

  Direct leak of 1160 byte(s) in 1 object(s) allocated from:
      #0 0x7f1b6fc84138 in calloc (/usr/lib/x86_64-linux-gnu/libasan.so.5+0xee138)
      #1 0x55bd50005599 in zalloc util/util.h:23
      #2 0x55bd500068f5 in perf_evsel__newtp_idx util/evsel.c:327
      #3 0x55bd4ff810fc in perf_evsel__newtp /home/work/linux/tools/perf/util/evsel.h:216
      #4 0x55bd4ff81608 in test__perf_evsel__tp_sched_test tests/evsel-tp-sched.c:69
      #5 0x55bd4ff528e6 in run_test tests/builtin-test.c:358
      #6 0x55bd4ff52baf in test_and_print tests/builtin-test.c:388
      #7 0x55bd4ff543fe in __cmd_test tests/builtin-test.c:583
      #8 0x55bd4ff5572f in cmd_test tests/builtin-test.c:722
      #9 0x55bd4ffc4087 in run_builtin /home/changbin/work/linux/tools/perf/perf.c:302
      #10 0x55bd4ffc45c6 in handle_internal_command /home/changbin/work/linux/tools/perf/perf.c:354
      #11 0x55bd4ffc49ca in run_argv /home/changbin/work/linux/tools/perf/perf.c:398
      #12 0x55bd4ffc5138 in main /home/changbin/work/linux/tools/perf/perf.c:520
      #13 0x7f1b6e34809a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2409a)

  Indirect leak of 19 byte(s) in 1 object(s) allocated from:
      #0 0x7f1b6fc83f30 in __interceptor_malloc (/usr/lib/x86_64-linux-gnu/libasan.so.5+0xedf30)
      #1 0x7f1b6e3ac30f in vasprintf (/lib/x86_64-linux-gnu/libc.so.6+0x8830f)

Signed-off-by: Changbin Du <changbin.du@gmail.com>
Reviewed-by: Jiri Olsa <jolsa@kernel.org>
Cc: Alexei Starovoitov <ast@kernel.org>
Cc: Daniel Borkmann <daniel@iogearbox.net>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Steven Rostedt (VMware) <rostedt@goodmis.org>
Fixes: 6a6cd11 ("perf test: Add test for the sched tracepoint format fields")
Link: http://lkml.kernel.org/r/20190316080556.3075-17-changbin.du@gmail.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
@frno7
Copy link
Owner Author

frno7 commented May 3, 2019

@sp193, I'm attempting to document the privileged Graphics Synthesizer (GS) registers, and a few bit fields remain unclear. Would you be able to fill in some details?

Specifically, the SMODE1 register has many unknown fields marked with FIXME below. Its CMOD field has some kind of standard (VESA/HDTV) mode apart from PAL and NTSC. Is there a better name than gs_cmod_standard?

The field sizes for SRFSH RFSH and SYNCH1 HS are unknown. The HSEQ and HSVS fields of SYNCH1 are unknown too.

Are more fields symbolical (to be represented with enums) rather than numerical? This is somewhat important because symbols are used whenever appropriate to read/write registers with sysfs. For example, inspecting the PMODE register shows symbols for its fields MMOD, AMOD and SLBG, which is much more helpful than their numerical representations:

# cat /sys/devices/platform/gs/registers/pmode
en1 1
en2 0
crtmd 1
mmod circuit1
amod circuit1
slbg circuit2
alp 0

One or several bit fields can be written simultaneously, so even simple shell scripts can set any conceivable video mode configuration. For example, the SLBG field can be changed with:

# echo "slbg bgcolor" >/sys/devices/platform/gs/registers/pmode

These privileged GS registers and bit fields are at the moment partly unclear:

enum gs_smode1_cmod {
	gs_cmod_standard,	/* FIXME: Better name than standard? */
	/* Reserved */
	gs_cmod_ntsc = 2,	/* NTSC broadcast */
	gs_cmod_pal		/* PAL broadcast */
};

enum gs_smode1_gcont {
	gs_gcont_rgbyc,
	gs_gcont_ycrcb
};

struct gs_smode1 {
	u64 rc : 3;		/* PLL reference divider */
	u64 lc : 7;		/* PLL loop divider */
	u64 t1248 : 2;		/* PLL output divider */
	u64 slck : 1;		/* FIXME */
	u64 cmod : 2;		/* Display mode (PAL, NTSC, VESA, etc.) */
	u64 ex : 1;		/* FIXME */
	u64 prst : 1;		/* PLL reset */
	u64 sint : 1;		/* PLL (phase-locked loop) */
	u64 xpck : 1;		/* FIXME */
	u64 pck2 : 2;		/* FIXME */
	u64 spml : 4;		/* FIXME */
	u64 gcont : 1;		/* Select RGBYC or YCrCb */
	u64 phs : 1;		/* HSync output */
	u64 pvs : 1;		/* VSync output */
	u64 pehs : 1;		/* FIXME */
	u64 pevs : 1;		/* FIXME */
	u64 clksel : 2;		/* FIXME */
	u64 nvck : 1;		/* FIXME */
	u64 slck2 : 1;		/* FIXME */
	u64 vcksel : 2;		/* FIXME */
	u64 vhp : 1;		/* FIXME */
	u64 : 27;
};

struct gs_srfsh {
	u64 rfsh : 4;		/* DRAM refresh FIXME: Number of bits? */
	u64 : 60;
};

struct gs_synch1 {
	u64 hfp : 11;		/* Horizontal front porch */
	u64 hbp : 11;		/* Horizontal back porch */
	u64 hseq : 10;		/* FIXME */
	u64 hsvs : 11;		/* FIXME */
	u64 hs : 21;		/* FIXME: Number of bits? */
};

@sp193
Copy link

sp193 commented May 3, 2019

You should refer to the Sony documentation for the meanings behind the documented registers like PMODE.

Those undocumented registers like SMODE1 were just undocumented. The most official information you can find, is from the official PS2Linux. But they only mentioned the field names.
Everything else you might find on the Internet, were likely derived through experimentation. Other than PS2Linux, everything else went through the EE kernel to get video modes set up.

If you worked with analog video signals, some things like HBP might make sense - it requires domain knowledge that I do not have.

On a side note, setting up a video mode for PS2s requires the DVE to be configured. This device was totally replaced with the SCPH-75000 and later, and was always different on the T10000. On the PC CARD consoles, the access to the DVE required slightly different initialization. In all cases, the register interfaces are undocumented.
You may find some code from dve_reg.S of OPL, as I updated the original version from Kernelloader to support models up to the SCPH-70000.

@frno7
Copy link
Owner Author

frno7 commented May 4, 2019

Thanks! Yes, PMODE is covered by the documentation; it only served as an example in using symbolic text fields with sysfs. I'm happy about how that turned out, since it's so easy and flexible to inspect and configure whatever video mode one may wish for, including all specifics (such as overlays and picture-in-picture) that the Graphics Synthesizer can do, without any ioctls. I think it will be great for applications.

I have gathered as much as I can about SMODE1, SRFSH and SYNCH1. I have also implemented conversion functions from the standard kernel video mode timings notation. For example, the standard Linux frame buffer mode for 1920×1080 at 50 Hz progressive moved 13 px to the right to is

mode "1920x1080-50"
    # D: 148.500 MHz, H: 56.250 kHz, V: 50.000 Hz
    geometry 1920 1080 1920 1080 16
    timings 6734 148 484 36 4 88 5
    bcast true
    rgba 5/0,5/5,5/10,1/15
endmode

One can adjust these standard Linux frame buffer notation timings quite freely to adjust screen margins, refresh rates, etc. and the GS registers are recomputed accordingly.

You may find some code from dve_reg.S of OPL, as I updated the original version from Kernelloader to support models up to the SCPH-70000.

Thanks! What does the abbreviation DVE stand for? Are the DVE registers in dve_reg.S needed if the GS is reset? The Linux GS driver does not yet reset the GS, as it currently relies on the GS already being setup at boot. The GIF is reset, though.

@sp193
Copy link

sp193 commented May 4, 2019

It's the Digital Video Encoder. Originally a COTS device, it was eventually replaced with a Sony part. Only Sony will know what will happen if you don't do things in the right order, unfortunately. But I can tell you that it is required for proper video output. It's a reason why the "old" 576P code in GSM did not seem to work properly on some PS2 models (e.g. G/H/I/J-chassis), as GSM used to only just write to the GS priviledged registers for the 576P mode.

The configuration also involves the selection of the PLL clock input (53.9MHz for PAL, 54.0MHz for NTSC), on the F-chassis and later. They did replace the hardware differences between PAL/NTSC regions with a software switch and the DVE configuration code got longer at some point, along with the introduction of messages about a 53.9MHz/54.0MHz selection in TESTMODE. From the service manual for the GH-015 (F-chassis), the DVE gained the 54CLK_SEL input from the SSBUS Interface controller.

@rickgaiser
Copy link

I've attempted a DRM/KMS driver for the ps2 a long time ago. Perhaps the info helps.

This basic DMA driver is fully functional, but breaks some legacy (ps2 specific) interfaces:
https://github.com/rickgaiser/linux/commits/ps2-v3.8-dma

On top of that I tried a DRM/KMS driver, but it's in a terrible state (you'll risk damaging your ps2 if you try this branch, the crtc output is wrong):
https://github.com/rickgaiser/linux/commits/ps2-v3.8-dma-drm

One can adjust these standard Linux frame buffer notation timings quite freely to adjust screen margins, refresh rates, etc. and the GS registers are recomputed accordingly.

Does this mean you can now get a proper 1080p50 output? And possible other resolutions and refresh rates? Having these GS register values would be great for other software as well.

PS: Nice to see you're working on this!

@frno7
Copy link
Owner Author

frno7 commented May 6, 2019

Does this mean you can now get a proper 1080p50 output?

Yes, all modes you could reasonably expect, including both 1080p50 and 1080p60. I have also made them compatible with a popular PS2 HDMI adapter.

And possible other resolutions and refresh rates?

Yes, there are currently 34 video modes (shown below) provided for convenience. All of them are calculated from first principles so one can adjust margins, clock speeds, etc. or even invent new modes.

# cat /sys/class/graphics/fb0/modes | column
V:1280x1024p-75	V:640x480p-60	S:1920x1080i-60	U:1688x964p-50	S:1280x720p-50
V:1280x1024p-60	U:1688x964p-60	S:1280x720p-60	U:1688x964i-50	S:720x576p-50
V:1024x768p-75	U:1688x964i-60	S:720x480p-60	U:1124x644p-50	S:720x576i-50
V:1024x768p-60	U:1124x644p-60	S:720x480i-60	U:576x460p-50	S:640x512i-50
V:800x600p-75	U:576x384p-60	S:640x448i-60	U:576x460i-50	S:720x288p-50
V:800x600p-60	U:576x384i-60	S:720x240p-60	S:1920x1080p-50	S:640x256p-50
V:640x480p-75	S:1920x1080p-60	S:640x224p-60	S:1920x1080i-50

Having these GS register values would be great for other software as well.

Yes, with direct GS register access only the hardware sets the video mode configuration limits.

frno7 pushed a commit that referenced this issue May 10, 2019
commit b57a55e upstream.

There is a KASAN slab-out-of-bounds:
BUG: KASAN: slab-out-of-bounds in _copy_from_iter_full+0x783/0xaa0
Read of size 80 at addr ffff88810c35e180 by task mount.cifs/539

CPU: 1 PID: 539 Comm: mount.cifs Not tainted 4.19 #10
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
            rel-1.12.0-0-ga698c8995f-prebuilt.qemu.org 04/01/2014
Call Trace:
 dump_stack+0xdd/0x12a
 print_address_description+0xa7/0x540
 kasan_report+0x1ff/0x550
 check_memory_region+0x2f1/0x310
 memcpy+0x2f/0x80
 _copy_from_iter_full+0x783/0xaa0
 tcp_sendmsg_locked+0x1840/0x4140
 tcp_sendmsg+0x37/0x60
 inet_sendmsg+0x18c/0x490
 sock_sendmsg+0xae/0x130
 smb_send_kvec+0x29c/0x520
 __smb_send_rqst+0x3ef/0xc60
 smb_send_rqst+0x25a/0x2e0
 compound_send_recv+0x9e8/0x2af0
 cifs_send_recv+0x24/0x30
 SMB2_open+0x35e/0x1620
 open_shroot+0x27b/0x490
 smb2_open_op_close+0x4e1/0x590
 smb2_query_path_info+0x2ac/0x650
 cifs_get_inode_info+0x1058/0x28f0
 cifs_root_iget+0x3bb/0xf80
 cifs_smb3_do_mount+0xe00/0x14c0
 cifs_do_mount+0x15/0x20
 mount_fs+0x5e/0x290
 vfs_kern_mount+0x88/0x460
 do_mount+0x398/0x31e0
 ksys_mount+0xc6/0x150
 __x64_sys_mount+0xea/0x190
 do_syscall_64+0x122/0x590
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

It can be reproduced by the following step:
  1. samba configured with: server max protocol = SMB2_10
  2. mount -o vers=default

When parse the mount version parameter, the 'ops' and 'vals'
was setted to smb30,  if negotiate result is smb21, just
update the 'ops' to smb21, but the 'vals' is still smb30.
When add lease context, the iov_base is allocated with smb21
ops, but the iov_len is initiallited with the smb30. Because
the iov_len is longer than iov_base, when send the message,
copy array out of bounds.

we need to keep the 'ops' and 'vals' consistent.

Fixes: 9764c02 ("SMB3: Add support for multidialect negotiate (SMB2.1 and later)")
Fixes: d5c7076 ("smb3: add smb3.1.1 to default dialect list")

Signed-off-by: ZhangXiaoxu <zhangxiaoxu5@huawei.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
CC: Stable <stable@vger.kernel.org>
Reviewed-by: Pavel Shilovsky <pshilov@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
frno7 pushed a commit that referenced this issue May 20, 2019
[ Upstream commit b9abbdf ]

By calling maps__insert() we assume to get 2 references on the map,
which we relese within maps__remove call.

However if there's already same map name, we currently don't bump the
reference and can crash, like:

  Program received signal SIGABRT, Aborted.
  0x00007ffff75e60f5 in raise () from /lib64/libc.so.6

  (gdb) bt
  #0  0x00007ffff75e60f5 in raise () from /lib64/libc.so.6
  #1  0x00007ffff75d0895 in abort () from /lib64/libc.so.6
  #2  0x00007ffff75d0769 in __assert_fail_base.cold () from /lib64/libc.so.6
  #3  0x00007ffff75de596 in __assert_fail () from /lib64/libc.so.6
  #4  0x00000000004fc006 in refcount_sub_and_test (i=1, r=0x1224e88) at tools/include/linux/refcount.h:131
  #5  refcount_dec_and_test (r=0x1224e88) at tools/include/linux/refcount.h:148
  #6  map__put (map=0x1224df0) at util/map.c:299
  #7  0x00000000004fdb95 in __maps__remove (map=0x1224df0, maps=0xb17d80) at util/map.c:953
  #8  maps__remove (maps=0xb17d80, map=0x1224df0) at util/map.c:959
  #9  0x00000000004f7d8a in map_groups__remove (map=<optimized out>, mg=<optimized out>) at util/map_groups.h:65
  #10 machine__process_ksymbol_unregister (sample=<optimized out>, event=0x7ffff7279670, machine=<optimized out>) at util/machine.c:728
  #11 machine__process_ksymbol (machine=<optimized out>, event=0x7ffff7279670, sample=<optimized out>) at util/machine.c:741
  #12 0x00000000004fffbb in perf_session__deliver_event (session=0xb11390, event=0x7ffff7279670, tool=0x7fffffffc7b0, file_offset=13936) at util/session.c:1362
  #13 0x00000000005039bb in do_flush (show_progress=false, oe=0xb17e80) at util/ordered-events.c:243
  #14 __ordered_events__flush (oe=0xb17e80, how=OE_FLUSH__ROUND, timestamp=<optimized out>) at util/ordered-events.c:322
  #15 0x00000000005005e4 in perf_session__process_user_event (session=session@entry=0xb11390, event=event@entry=0x7ffff72a4af8,
  ...

Add the map to the list and getting the reference event if we find the
map with same name.

Signed-off-by: Jiri Olsa <jolsa@kernel.org>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Alexei Starovoitov <ast@kernel.org>
Cc: Andi Kleen <ak@linux.intel.com>
Cc: Daniel Borkmann <daniel@iogearbox.net>
Cc: Eric Saint-Etienne <eric.saint.etienne@oracle.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Song Liu <songliubraving@fb.com>
Fixes: 1e62856 ("perf symbols: Fix slowness due to -ffunction-section")
Link: http://lkml.kernel.org/r/20190416160127.30203-10-jolsa@kernel.org
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
frno7 pushed a commit that referenced this issue Jul 17, 2019
commit c952b35 upstream.

bpf/btf write_* functions need ff->ph->env.

With this missing, pipe-mode (perf record -o -)  would crash like:

Program terminated with signal SIGSEGV, Segmentation fault.

This patch assign proper ph value to ff.

Committer testing:

  (gdb) run record -o -
  Starting program: /root/bin/perf record -o -
  PERFILE2
  <SNIP start of perf.data headers>
  Thread 1 "perf" received signal SIGSEGV, Segmentation fault.
  __do_write_buf (size=4, buf=0x160, ff=0x7fffffff8f80) at util/header.c:126
  126		memcpy(ff->buf + ff->offset, buf, size);
  (gdb) bt
  #0  __do_write_buf (size=4, buf=0x160, ff=0x7fffffff8f80) at util/header.c:126
  #1  do_write (ff=ff@entry=0x7fffffff8f80, buf=buf@entry=0x160, size=4) at util/header.c:137
  #2  0x00000000004eddba in write_bpf_prog_info (ff=0x7fffffff8f80, evlist=<optimized out>) at util/header.c:912
  #3  0x00000000004f69d7 in perf_event__synthesize_features (tool=tool@entry=0x97cc00 <record>, session=session@entry=0x7fffe9c6d010,
      evlist=0x7fffe9cae010, process=process@entry=0x4435d0 <process_synthesized_event>) at util/header.c:3695
  #4  0x0000000000443c79 in record__synthesize (tail=tail@entry=false, rec=0x97cc00 <record>) at builtin-record.c:1214
  #5  0x0000000000444ec9 in __cmd_record (rec=0x97cc00 <record>, argv=<optimized out>, argc=0) at builtin-record.c:1435
  #6  cmd_record (argc=0, argv=<optimized out>) at builtin-record.c:2450
  #7  0x00000000004ae3e9 in run_builtin (p=p@entry=0x98e058 <commands+216>, argc=argc@entry=3, argv=0x7fffffffd670) at perf.c:304
  #8  0x000000000042eded in handle_internal_command (argv=<optimized out>, argc=<optimized out>) at perf.c:356
  #9  run_argv (argcp=<optimized out>, argv=<optimized out>) at perf.c:400
  #10 main (argc=3, argv=<optimized out>) at perf.c:522
  (gdb)

After the patch the SEGSEGV is gone.

Reported-by: David Carrillo Cisneros <davidca@fb.com>
Signed-off-by: Song Liu <songliubraving@fb.com>
Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: kernel-team@fb.com
Cc: stable@vger.kernel.org # v5.1+
Fixes: 606f972 ("perf bpf: Save bpf_prog_info information as headers to perf.data")
Link: http://lkml.kernel.org/r/20190620010453.4118689-1-songliubraving@fb.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
frno7 pushed a commit that referenced this issue Sep 1, 2019
Revert the commit bd293d0. The proper
fix has been made available with commit d0a255e ("loop: set
PF_MEMALLOC_NOIO for the worker thread").

Note that the fix offered by commit bd293d0 doesn't really prevent
the deadlock from occuring - if we look at the stacktrace reported by
Junxiao Bi, we see that it hangs in bit_wait_io and not on the mutex -
i.e. it has already successfully taken the mutex. Changing the mutex
from mutex_lock to mutex_trylock won't help with deadlocks that happen
afterwards.

PID: 474    TASK: ffff8813e11f4600  CPU: 10  COMMAND: "kswapd0"
   #0 [ffff8813dedfb938] __schedule at ffffffff8173f405
   #1 [ffff8813dedfb990] schedule at ffffffff8173fa27
   #2 [ffff8813dedfb9b0] schedule_timeout at ffffffff81742fec
   #3 [ffff8813dedfba60] io_schedule_timeout at ffffffff8173f186
   #4 [ffff8813dedfbaa0] bit_wait_io at ffffffff8174034f
   #5 [ffff8813dedfbac0] __wait_on_bit at ffffffff8173fec8
   #6 [ffff8813dedfbb10] out_of_line_wait_on_bit at ffffffff8173ff81
   #7 [ffff8813dedfbb90] __make_buffer_clean at ffffffffa038736f [dm_bufio]
   #8 [ffff8813dedfbbb0] __try_evict_buffer at ffffffffa0387bb8 [dm_bufio]
   #9 [ffff8813dedfbbd0] dm_bufio_shrink_scan at ffffffffa0387cc3 [dm_bufio]
  #10 [ffff8813dedfbc40] shrink_slab at ffffffff811a87ce
  #11 [ffff8813dedfbd30] shrink_zone at ffffffff811ad778
  #12 [ffff8813dedfbdc0] kswapd at ffffffff811ae92f
  #13 [ffff8813dedfbec0] kthread at ffffffff810a8428
  #14 [ffff8813dedfbf50] ret_from_fork at ffffffff81745242

Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Cc: stable@vger.kernel.org
Fixes: bd293d0 ("dm bufio: fix deadlock with loop device")
Depends-on: d0a255e ("loop: set PF_MEMALLOC_NOIO for the worker thread")
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
@frno7
Copy link
Owner Author

frno7 commented Sep 7, 2019

@rickgaiser, DRM/KMS is now required to proceed with #1, so I have registered #30 for it.

@Ravenslofty
Copy link

Ravenslofty commented Sep 14, 2019

A quick note, since I can't think of anywhere better to put this: in your GS privileged register documentation, SMODE1.SPML stands for "sub-pixel magnification level".

EDIT: And SMODE1.VHP controls progressive/interlaced.
EDIT 2: Also, you have self-referential comments for SYNCV.VBP and SYNCV.VBPE. Your comments state that VBP happens after VBPE, but also that VBPE happens after VBP.

@frno7
Copy link
Owner Author

frno7 commented Sep 15, 2019

A quick note, since I can't think of anywhere better to put this: in your GS privileged register documentation, SMODE1.SPML stands for "sub-pixel magnification level".

Thanks, @ZirconiumX! Fixed here:

* @spml: sub-pixel magnification level

* @spml: sub-pixel magnification level

EDIT: And SMODE1.VHP controls progressive/interlaced.

Fixed here:

* @vhp: 0 = interlace mode and 1 = progressive mode

EDIT 2: Also, you have self-referential comments for SYNCV.VBP and SYNCV.VBPE. Your comments state that VBP happens after VBPE, but also that VBPE happens after VBP.

Heh, right, that must be VBPE after VS, as fixed here:

* @vbpe: halflines without color burst after @vs

@Ravenslofty
Copy link

Ravenslofty commented Sep 15, 2019

Another one: if SYNCV.VS is number of VSYNC lines, then SYNCH1.HS must surely be number of HSYNC clocks.

EDIT: Actually, your documentation states that SYNCV.V[BF]P[E] talks about colorburst, but this is wrong because colorburst happens every horizontal sync in analogue TV, not every vertical sync.

EDIT 2: The above leads me to believe that SYNCH1.{HSEQ,HSVS} must have something to do with colorburst, but I do not have an oscilloscope to test.

@frno7
Copy link
Owner Author

frno7 commented Sep 15, 2019

Another one: if SYNCV.VS is number of VSYNC lines, then SYNCH1.HS must surely be number of HSYNC clocks.

Indeed, there is a certain correspondence, modulated with SPML. The HDTV modes (720×576p, 1920×1080p, etc.) computed in the vm_to_sp_hdtv function show some register relationships, how they sum, and so on (the functions vm_to_sp_sdtv for SDTV and vm_to_sp_vesa for VESA are similar):

static struct gs_sync_param vm_to_sp_hdtv(
const struct fb_videomode *vm, const struct gs_synch_gen sg)
{
const u32 spml = sg.spml;
const u32 t1248 = sg.t1248;
const u32 lc = sg.lc;
const u32 rc = sg.rc;
const u32 vc = vm->yres <= 576 ? 1 : 0;
const u32 hadj = spml / 2;
const u32 vhp = (vm->vmode & FB_VMODE_INTERLACED) ? 0 : 1;
const u32 hb = vm->xres * spml * 3 / 5;
return (struct gs_sync_param) {
.smode1 = {
.vhp = vhp, .vcksel = vc, .slck2 = 1, .nvck = 1,
.clksel = 1, .pevs = 0, .pehs = 0, .pvs = 0,
.phs = 0, .gcont = 0, .spml = spml, .pck2 = 0,
.xpck = 0, .sint = 1, .prst = 0, .ex = 0,
.cmod = 0, .slck = 0, .t1248 = t1248,
.lc = lc, .rc = rc
},
.smode2 = {
.intm = (vm->vmode & FB_VMODE_INTERLACED) ? 1 : 0
},
.srfsh = {
.rfsh = gs_rfsh_from_synch_gen(sg)
},
.synch1 = {
.hs = vm->hsync_len * spml,
.hsvs = (vm->left_margin + vm->xres +
vm->right_margin - vm->hsync_len) * spml / 2,
.hseq = vm->hsync_len * spml,
.hbp = vm->left_margin * spml - hadj,
.hfp = vm->right_margin * spml + hadj
},
.synch2 = {
.hb = hb,
.hf = vm->xres * spml - hb
},
.syncv = {
.vs = vm->vsync_len,
.vdp = vm->yres,
.vbpe = 0,
.vbp = vm->upper_margin,
.vfpe = 0,
.vfp = vm->lower_margin
},
.display = {
.dh = vm->yres - 1,
.dw = vm->xres * spml - 1,
.magv = 0,
.magh = spml - 1,
.dy = vm->vsync_len + vm->upper_margin - 1,
.dx = (vm->hsync_len + vm->left_margin) * spml - 1 - hadj
}
};
}

EDIT: Actually, your documentation states that SYNCV.V[BF]P[E] talks about colorburst, but this is wrong because colorburst happens every horizontal sync in analogue TV, not every vertical sync.

Well, it is to say that there is no colour burst for the entirety of the horizontal line.

EDIT 2: The above leads me to believe that SYNCH1.{HSEQ,HSVS} must have something to do with colorburst, but I do not have an oscilloscope to test.

HSEQ and HSVS are computed like so, for SDTV:

.hsvs = cmod == gs_cmod_pal ? 1474 : 1462,
.hseq = cmod == gs_cmod_pal ? 127 : 124,

and HDTV and VESA:

.hsvs = (vm->left_margin + vm->xres +
vm->right_margin - vm->hsync_len) * spml / 2,
.hseq = vm->hsync_len * spml,

@Ravenslofty
Copy link

Well, it is to say that there is no colour burst for the entirety of the horizontal line.

I'm sorry, I don't quite understand what you mean here. While there is no colorburst for VESA or digital TV modes, both PAL and NTSC require a colourburst in the horizontal back porch.

@frno7
Copy link
Owner Author

frno7 commented Sep 15, 2019

I'm sorry, I don't quite understand what you mean here. While there is no colorburst for VESA or digital TV modes, both PAL and NTSC require a colourburst in the horizontal back porch.

Perhaps a more accurate term than colour burst could be used? In any case, no pixels from the frame buffer are displayed for the given line, as I recall.

@Ravenslofty
Copy link

So, here's something which I think should be tested.

From http://martin.hinner.info/vga/pal.html

You can stop the display being interlaced if you want - the solution appears to be to just use the same sync pulse train each field, ie: the 6-5-5 one from 'field one' (which lasts 8 whole lines). I've seen it done like this in chip data sheets and tested it with my Z80 project (also confirmed with a oscilloscope connected to a Playstation2 running a non-interlaced game).

I wonder if what SMODE1.VHP actually controls is the sync pulse pattern.

@AKuHAK
Copy link

AKuHAK commented May 2, 2022

Is it possible to switch the default video mode from 1080p to standard NTSC mode? I am asking cause PS3 BC doesn't support 1080p, it supports a maximum of 480p, when setting video mode into 1080p, ps2kernel is crashing.
If I understand correctly, to lower the resolution currently I need to undefine CONFIG_PRINTK in kernel config and change in /sbin/init modprobe ps2fb mode_option=576x384i@60 ?
Also, it will be more user-friendly.

@frno7
Copy link
Owner Author

frno7 commented May 2, 2022

Is it possible to switch the default video mode from 1080p to standard NTSC mode? I am asking cause PS3 BC doesn't support 1080p, it supports a maximum of 480p, when setting video mode into 1080p, ps2kernel is crashing. If I understand correctly, to lower the resolution currently I need to undefine CONFIG_PRINTK in kernel config

I suppose it’d be the EARLY_PRINTK kernel config knob, or revert commit fce1c18 before compiling your kernel (using patch -R <gs-early-putc.patch, for instance).

and change in /sbin/init modprobe ps2fb mode_option=576x384i@60 ?

That should work, yes.

Also, it will be more user-friendly.

See #28 (comment) for ideas. Issue #9 is the one for the boot console.

@Arch91
Copy link

Arch91 commented May 6, 2022

Sorry if I'm writting about it not in the right place, but I think that question is related to GS driver. About the absent cursor.

static void ps2fb_cb_tilecursor(struct fb_info *info,
	struct fb_tilecursor *cursor)

{
	/*
	 * FIXME: Drawing the cursor seems to require composition such as
	 * xor, which is not possible here. If the character under the
	 * cursor was known, a simple change of foreground and background
	 * colors could be implemented to achieve the same effect.
	 */
}

the function "ps2fb_cb_tilecursor" is already exists in the driver code and it is responsible for the background changing, right? The question - what kind of things (function inclusion, lines) it could contain? Can you assume anything - for example, to "miss" and this function will draw the whole screen?

Another aspect - in the GNU linux there is possible to change the background color of the cursor, the speed of it's flashing and the times after those flashing stops. For the first one, the colors can be changed using this command:
echo N > /sys/module/vt/parameters/cur_default
where N is the integer value from 0 to 15 . Will GS driver support that? Is it supporting that already now but the only thing to do is to locate the cursor position in the driver?

@frno7
Copy link
Owner Author

frno7 commented May 6, 2022

The question - what kind of things (function inclusion, lines) it could contain? Can you assume anything - for example, to "miss" and this function will draw the whole screen?

The comment in the code is an attempt to explain that the character under the cursor must be known in order to draw them both. Otherwise the cursor would overwrite the character on the screen and the character would vanish. It wouldn’t work to have the cursor ‘delete’ characters on the screen in this way. The problem could be solved by letting ps2fb_cb_tilecursor know what the character under the cursor is, which means that the generic kernel frame buffer code needs to be updated to supply the character under the cursor.

@Arch91
Copy link

Arch91 commented May 6, 2022

The problem could be solved by letting ps2fb_cb_tilecursor know what the character under the cursor is

Let's suppose that the character is always "C" :D An uppercase third letter of the latin alphabet. Can you write an example how "ps2fb_cb_tilecursor" function could be looked like?

@frno7
Copy link
Owner Author

frno7 commented May 6, 2022

Let's suppose that the character is always "C" :D An uppercase third letter of the latin alphabet. Can you write an example how "ps2fb_cb_tilecursor" function could be looked like?

As a kernel developer in the making one would

  1. study the documentation for .fb_tilecursor in

    linux/include/linux/fb.h

    Lines 346 to 353 in 59a11ab

    struct fb_tilecursor {
    __u32 sx; /* cursor position in the x-axis */
    __u32 sy; /* cursor position in the y-axis */
    __u32 mode; /* 0 = erase, 1 = draw */
    __u32 shape; /* see FB_TILE_CURSOR_* */
    __u32 fg; /* foreground color */
    __u32 bg; /* background color */
    };
  2. study some of the other drivers using .fb_tilecursor (use the git grep command to find them);
  3. study capabilities of the ps2fb.c driver;
  4. study the capabilities of the hardware, especially the document GS User’s Manual, version 6.0, by Sony Computer Entertainment;
  5. and then make a prototype.

That’s reasonable series of steps for starting to understand and implementing the cursor.

@Arch91
Copy link

Arch91 commented May 10, 2022

  1. study some of the other drivers...

By looking to the source files of the other fb drivers I found there were the persons who created that. I decided to write to him... and he responded! And answered back me the next (I think I must be careful with noting the names/nicknames, so no note here from me about that):

Ah, these drivers use tile blitting (fb_tile_ops). I have no experience
with that.
And the only upstream drivers supporting tiles use that for SVGA text mode.

However, is there really no way to XOR the image? I see there is a copyarea
function, so you can copy to offscreen memory, XOR by the CPU, and copy
back to the display memory?

@frno7
Copy link
Owner Author

frno7 commented May 10, 2022

By looking to the source files of the other fb drivers I found there were the persons who created that. I decided to write to him... and he responded!

To my knowledge it’s very tricky and inefficient to read GS memory. Confer section 4.2.2 Transmission from Local Buffer to Host p. 77 in the GS User’s Manual, and I’m not aware of any XOR function within the GS itself.

A workaround could be to have a GS local scratch buffer for saving/restoring the character under the cursor, while overdrawing said character with a cursor, but I’d suggest studying the most promising and flexible variant instead which is, I believe, to supply the character to the fb_tilecursor function.

@rickgaiser
Copy link

I think you can XOR by using alpha blending and the ALPHA register. It can do things like:
(Cs - Cd) * As + 0

Cs = source color, use full white (0xff,0xff,0xff)
Cd = destination color (the thing we want to invert)
As = source alpha, use 0x80

@frno7
Copy link
Owner Author

frno7 commented May 11, 2022

Thanks, @rickgaiser! I’ve registered issue #79 for this. Will have a cursor to play with soon.

@AKuHAK
Copy link

AKuHAK commented May 15, 2022

@frno7 looks like currently, all video modes are incompatible with composite cable, cause smode1.gcont is always 1 aka ycrcb even in low res PAL and NTSC modes. Composite cable doesn't support ycrcb, so it leads to black screen for users with such cables.

@AKuHAK
Copy link

AKuHAK commented May 15, 2022

echo "gcont rgbyc" >/sys/devices/platform/gs/registers/smode1 fixes the problem, this fix should be applied for all video modes before 640x480p, as this is the first video mode that doesnt supported by composite

@AKuHAK
Copy link

AKuHAK commented May 15, 2022

so assuming:
Progressive modes:
224p
240p
are the only 2 progressive modes that composite supports, so rgbyc should be set for them. For other progressive modes, ycrcb should be set.
Interlaced modes:
all interlaced modes up to 576i support composite, so rgbyc should be set for them
964i and 1080i are not supported so ycrcb should be set

@frno7
Copy link
Owner Author

frno7 commented May 15, 2022

echo "gcont rgbyc" >/sys/devices/platform/gs/registers/smode1 fixes the problem,

Neat. :-)

this fix should be applied for all video modes before 640x480p, as this is the first video mode that doesnt supported by composite

That would break those video modes for people having PS2 HDMI adapters, component cables, etc. I suppose there is a reason Sony made the choice between YCbCr and RGB a manual System Configuration setting for the PlayStation 2. Presumably it can’t be configured automatically to suit everyone. Isn’t this setting stored in NVRAM?

@AKuHAK
Copy link

AKuHAK commented May 15, 2022

That would break those video modes for people having PS2 HDMI adapters, component cables

But all of these types of video connectors weren't included in standard PlayStation 2 shipments, so they cannot be called "standard". All you mention is non-standard equipment and should not be set by default.

For users with such types of adapters exist high-res modes, so one can set, for example, 1080p or 480p or something else. Anyway PS3 does support only rgbyc so currently linux kernel is incompatible with that. And I dont know if it is crashing at the moment when ycrcb is set, or these can be fixed by setting rgbyc later after kernel booted.

@frno7
Copy link
Owner Author

frno7 commented May 15, 2022

But all of these types of video connectors weren't included in standard PlayStation 2 shipments, so they cannot be called "standard". All you mention is non-standard equipment and should not be set by default.

Right, but people will be happiest if the equipment (such as HDMI) they tend to use today works properly. That’s worthwhile to pay attention to, in addition to what people used to have 20 or so years ago. I just registered issue #80 for this. :-)

For users with such types of adapters exist high-res modes, so one can set, for example, 1080p or 480p or something else.

True, but how could we determine whether 1080p would work or not in the /sbin/init script of the initramfs? If we can’t, the safest choice seems to be the same video mode chosen by the Sony BIOS.

Anyway PS3 does support only rgbyc so currently linux kernel is incompatible with that. And I dont know if it is crashing at the moment when ycrcb is set, or these can be fixed by setting rgbyc later after kernel booted.

As a test, you might want to change the line

sp.smode1.gcont = gs_gcont_ycrcb;

and try that for the PS3!

@Arch91
Copy link

Arch91 commented May 17, 2022

I had a deep dialog with @frno in the past about the fitting the videomodes resolutions to the actual screen borders, and obtained for myself that my english is not enough to explain what I mean and what I would like to be done.

However, I would like to ask the question at least about the next.
I am activating the ps2fb module using this command:
modprobe ps2fb mode_option=1920x1080p@50 mode_margin=+33+0
Then I have the prefect (almost perfect, to move the screen +1 dx from the left border and narrow to -2 dx from the right border would be even better) 1080p resolution for my TV. I consider +33 for the dx is quite a large distance! The question is
what kernel source file and where is the certain place in it I could edit so the screen for 1080p YPbPr resolution will be moved right to 33? I would like to be making that just for myself, no any pull requests)

@frno7
Copy link
Owner Author

frno7 commented May 17, 2022

Then I have the prefect (almost perfect, to move the screen +1 dx from the left border and narrow to -2 dx from the right border would be even better) 1080p resolution for my TV.

It should be possible to shrink the pixel width to fit it by speeding up the pixel clock a bit, and recalculate the margins accordingly. The fbset command is probably best for it. Study the frame buffer documentation:

+----------+---------------------------------------------+----------+-------+
| | ↑ | | |
| | |upper_margin | | |
| | ↓ | | |
+----------###############################################----------+-------+
| # ↑ # | |
| # | # | |
| # | # | |
| # | # | |
| left # | # right | hsync |
| margin # | xres # margin | len |
|<-------->#<---------------+--------------------------->#<-------->|<----->|
| # | # | |
| # | # | |
| # | # | |
| # |yres # | |
| # | # | |
| # | # | |
| # | # | |
| # | # | |
| # | # | |
| # | # | |
| # | # | |
| # | # | |
| # ↓ # | |
+----------###############################################----------+-------+
| | ↑ | | |
| | |lower_margin | | |
| | ↓ | | |
+----------+---------------------------------------------+----------+-------+
| | ↑ | | |
| | |vsync_len | | |
| | ↓ | | |
+----------+---------------------------------------------+----------+-------+
The frame buffer device expects all horizontal timings in number of dotclocks
(in picoseconds, 1E-12 s), and vertical timings in number of scanlines.

I consider +33 for the dx is quite a large distance!

I’ve had +48 px for some devices. :-)

The question is what kernel source file and where is the certain place in it I could edit so the screen for 1080p YPbPr resolution will be moved right to 33?

Changing the default here?

/*
* Analogue devices are frequently a few pixels off. Use this mode_margin
* option to make necessary device dependent adjustments to the built-in modes.
*/
module_param(mode_margin, charp, 0);
MODULE_PARM_DESC(mode_margin,
"Adjust initial video mode margin as \"<-|+><dx><-|+><dy>\"");

@Arch91
Copy link

Arch91 commented May 17, 2022

to fit it by speeding up the pixel clock

Yes, I remember that this influences to the screen narrowing. But the more clock value the more faded the output; moreover, the clock value can be too high/too low so TV will not show anything anymore. That's why I abandoned the idea of fitting/perfecting the resolutions to the actual screen border.
Anyway, I would like to move the default 1080p YPbPr position to 33 px right, and

Changing the default here?

no, not here. I remember that for each of the resolutions - 480/720/1080, etc... - the screen should be moved to the right not for an equal px "distance". So, +33 for 1080p YPbPr only. I thought it would be some value among this line (line 189 in that file, I don't know how do you, guys, pasting the certain place/lines of some file)

{ "1080p", 50, 1920, 1080, 6734, 148, 484, 36, 4, 88, 5,
FB_SYNC_BROADCAST, FB_VMODE_NONINTERLACED, FB_MODE_IS_STANDARD },

Did I assume wrong that some of these values is resposible for the x starting position?

By the way - mode_option=1920x1080p@50 - is that pal or ntsc?)

@frno7
Copy link
Owner Author

frno7 commented May 17, 2022

Yes, I remember that this influences to the screen narrowing. But the more clock value the more faded the output; moreover, the clock value can be too high/too low so TV will not show anything anymore. That's why I abandoned the idea of fitting/perfecting the resolutions to the actual screen border.

The timings of everything else should be possible to keep perfectly synchronised too, if you prolong the margins according to the pixel clock speed-up.

{ "1080p", 50, 1920, 1080, 6734, 148, 484, 36, 4, 88, 5,
FB_SYNC_BROADCAST, FB_VMODE_NONINTERLACED, FB_MODE_IS_STANDARD },

Did I assume wrong that some of these values is resposible for the x starting position?

The fbset command should, essentially, be able to use similar values. They can be put in a custom /etc/fb.modes file, see the fb.modes manual, with all adjustments you fancy. Check the fbset manual. Study its -move option for display positioning. You may also find the Modeline Calculator useful, with tutorials, documentation, and everything to get started making your own pixel-perfect video modes.

@AKuHAK
Copy link

AKuHAK commented May 17, 2022

1080p is not pal or ntsc, these division only applies to interlace modes.

@frno7
Copy link
Owner Author

frno7 commented May 18, 2022

@AKuHAK, 1080p tends to be either 50 Hz or 60 Hz, which are the traditional PAL and NTSC frequencies, after all.

@uyjulian
Copy link

uyjulian commented May 18, 2022

If the image appears to be zoomed, I would recommend checking the TV/monitor zoom setting. Make sure it is set to "Zoom disabled" or "No zoom" or "Exact" or "1:1" mode. That should give you a pixel perfect display.

@Arch91
Copy link

Arch91 commented May 29, 2023

...so... quite long time no any progress anywhere... Let me at least trigger some 'memories' about the project :p

A pare of questions. Let's suppose that virtual frame buffer graphic driver is completely perfect ready. Then, since it is completed,
what's the main problem was solved for it's completion?
Which X-server is usable for that driver showing the X stuff in real time as it should be (not just a screenshots of the in-memory launched X programs without graphic output using Xvfb server)?

@frno7
Copy link
Owner Author

frno7 commented May 29, 2023

I believe the main improvement over the Linux 2.x frame buffer would be to permit noncontinuous physical memory. The hardware can do it, but Linux 2.x didn’t use it (and therefore Linux 2.x has to be rebooted once memory is fragmented). Another important improvement would be a proper vertical sync, which avoids tearing during animations, etc.

I don’t know which X server would be best. In principle it should be possible to make X work directly with Graphics Synthesizer (GS) commands, and not necessarily use a virtual frame buffer. More effective, but technically more difficult too. As an alternative to X, perhaps you could consider using the GEM desktop environment? :-)

@Arch91
Copy link

Arch91 commented May 29, 2023

As an alternative to X, perhaps you could consider using the GEM desktop environment? :-)
oh no, I wouldn't give it any chance :p
The only X server which is worths is a xorg's. As for the one of the goals I have, it's to have a working internet browser to play some browser games. Such as Super Mario Crossover. However, the days of the javascript games are passed, so I doubt that it is achievable... Well, in the same time having a good stable browser which shows everything normally is nice too.
SDL has more implementations and usabilities in Linux than some GEM :/

With the frame buffer graphic driver it make a full copy of the graphic data from the GS memory to the main memory, right? If you'd ask me, I consider the copyings times and the memory duplication are the wastes.

@frno7
Copy link
Owner Author

frno7 commented May 29, 2023

The only X server which is worths is a xorg's. As for the one of the goals I have, it's to have a working internet browser to play some browser games. Such as Super Mario Crossover. However, the days of the javascript games are passed, so I doubt that it is achievable...

Browser performance will most likely be mediocre, unfortunately. But maybe Scumm VM could be a ported nicely?

With the frame buffer graphic driver it make a full copy of the graphic data from the GS memory to the main memory, right? If you'd ask me, I consider the copyings times and the memory duplication are the wastes.

Yeah, a virtual frame buffer is often wasteful, and slow too. Its main advantage is simplicity, since it’s compatible with SDL, etc.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request question Further information is requested
Projects
None yet
Development

No branches or pull requests

8 participants