Skip to content

Commit

Permalink
fbmem: fix fb_read, fb_write unaligned accesses
Browse files Browse the repository at this point in the history 
fb_{read,write} access the framebuffer using lots of fb_{read,write}l's
but don't check that the file position is aligned which can cause problems
on some architectures which do not support unaligned accesses.

Since the operations are essentially memcpy_{from,to}io, new
fb_memcpy_{from,to}fb macros have been defined and these are used instead.

For Sparc, fb_{read,write} macros use sbus_{read,write}, so this defines
new sbus_memcpy_{from,to}io functions the same as memcpy_{from,to}io but
using sbus_{read,write}b instead of {read,write}b.

Signed-off-by: James Hogan <james@albanarts.com>
Acked-by: David S. Miller <davem@davemloft.net>
Acked-by: Florian Tobias Schandinat <FlorianSchandinat@gmx.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
  • Loading branch information
James Hogan authored and Linus Torvalds committed Oct 28, 2010
1 parent c9c62dc commit f11b478
Show file tree
Hide file tree
Showing 4 changed files with 82 additions and 32 deletions.
31 changes: 31 additions & 0 deletions arch/sparc/include/asm/io_32.h
View file
Original file line number Diff line number Diff line change
Expand Up @@ -207,6 +207,21 @@ _memset_io(volatile void __iomem *dst, int c, __kernel_size_t n)

#define memset_io(d,c,sz) _memset_io(d,c,sz)

static inline void
_sbus_memcpy_fromio(void *dst, const volatile void __iomem *src,
__kernel_size_t n)
{
char *d = dst;

while (n--) {
char tmp = sbus_readb(src);
*d++ = tmp;
src++;
}
}

#define sbus_memcpy_fromio(d, s, sz) _sbus_memcpy_fromio(d, s, sz)

static inline void
_memcpy_fromio(void *dst, const volatile void __iomem *src, __kernel_size_t n)
{
Expand All @@ -221,6 +236,22 @@ _memcpy_fromio(void *dst, const volatile void __iomem *src, __kernel_size_t n)

#define memcpy_fromio(d,s,sz) _memcpy_fromio(d,s,sz)

static inline void
_sbus_memcpy_toio(volatile void __iomem *dst, const void *src,
__kernel_size_t n)
{
const char *s = src;
volatile void __iomem *d = dst;

while (n--) {
char tmp = *s++;
sbus_writeb(tmp, d);
d++;
}
}

#define sbus_memcpy_toio(d, s, sz) _sbus_memcpy_toio(d, s, sz)

static inline void
_memcpy_toio(volatile void __iomem *dst, const void *src, __kernel_size_t n)
{
Expand Down
31 changes: 31 additions & 0 deletions arch/sparc/include/asm/io_64.h
View file
Original file line number Diff line number Diff line change
Expand Up @@ -418,6 +418,21 @@ _memset_io(volatile void __iomem *dst, int c, __kernel_size_t n)

#define memset_io(d,c,sz) _memset_io(d,c,sz)

static inline void
_sbus_memcpy_fromio(void *dst, const volatile void __iomem *src,
__kernel_size_t n)
{
char *d = dst;

while (n--) {
char tmp = sbus_readb(src);
*d++ = tmp;
src++;
}
}

#define sbus_memcpy_fromio(d, s, sz) _sbus_memcpy_fromio(d, s, sz)

static inline void
_memcpy_fromio(void *dst, const volatile void __iomem *src, __kernel_size_t n)
{
Expand All @@ -432,6 +447,22 @@ _memcpy_fromio(void *dst, const volatile void __iomem *src, __kernel_size_t n)

#define memcpy_fromio(d,s,sz) _memcpy_fromio(d,s,sz)

static inline void
_sbus_memcpy_toio(volatile void __iomem *dst, const void *src,
__kernel_size_t n)
{
const char *s = src;
volatile void __iomem *d = dst;

while (n--) {
char tmp = *s++;
sbus_writeb(tmp, d);
d++;
}
}

#define sbus_memcpy_toio(d, s, sz) _sbus_memcpy_toio(d, s, sz)

static inline void
_memcpy_toio(volatile void __iomem *dst, const void *src, __kernel_size_t n)
{
Expand Down
46 changes: 14 additions & 32 deletions drivers/video/fbmem.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -697,9 +697,9 @@ fb_read(struct file *file, char __user *buf, size_t count, loff_t *ppos)
struct inode *inode = file->f_path.dentry->d_inode;
int fbidx = iminor(inode);
struct fb_info *info = registered_fb[fbidx];
u32 *buffer, *dst;
u32 __iomem *src;
int c, i, cnt = 0, err = 0;
u8 *buffer, *dst;
u8 __iomem *src;
int c, cnt = 0, err = 0;
unsigned long total_size;

if (!info || ! info->screen_base)
Expand Down Expand Up @@ -730,25 +730,17 @@ fb_read(struct file *file, char __user *buf, size_t count, loff_t *ppos)
if (!buffer)
return -ENOMEM;

src = (u32 __iomem *) (info->screen_base + p);
src = (u8 __iomem *) (info->screen_base + p);

if (info->fbops->fb_sync)
info->fbops->fb_sync(info);

while (count) {
c = (count > PAGE_SIZE) ? PAGE_SIZE : count;
dst = buffer;
for (i = c >> 2; i--; )
*dst++ = fb_readl(src++);
if (c & 3) {
u8 *dst8 = (u8 *) dst;
u8 __iomem *src8 = (u8 __iomem *) src;

for (i = c & 3; i--;)
*dst8++ = fb_readb(src8++);

src = (u32 __iomem *) src8;
}
fb_memcpy_fromfb(dst, src, c);
dst += c;
src += c;

if (copy_to_user(buf, buffer, c)) {
err = -EFAULT;
Expand All @@ -772,9 +764,9 @@ fb_write(struct file *file, const char __user *buf, size_t count, loff_t *ppos)
struct inode *inode = file->f_path.dentry->d_inode;
int fbidx = iminor(inode);
struct fb_info *info = registered_fb[fbidx];
u32 *buffer, *src;
u32 __iomem *dst;
int c, i, cnt = 0, err = 0;
u8 *buffer, *src;
u8 __iomem *dst;
int c, cnt = 0, err = 0;
unsigned long total_size;

if (!info || !info->screen_base)
Expand Down Expand Up @@ -811,7 +803,7 @@ fb_write(struct file *file, const char __user *buf, size_t count, loff_t *ppos)
if (!buffer)
return -ENOMEM;

dst = (u32 __iomem *) (info->screen_base + p);
dst = (u8 __iomem *) (info->screen_base + p);

if (info->fbops->fb_sync)
info->fbops->fb_sync(info);
Expand All @@ -825,19 +817,9 @@ fb_write(struct file *file, const char __user *buf, size_t count, loff_t *ppos)
break;
}

for (i = c >> 2; i--; )
fb_writel(*src++, dst++);

if (c & 3) {
u8 *src8 = (u8 *) src;
u8 __iomem *dst8 = (u8 __iomem *) dst;

for (i = c & 3; i--; )
fb_writeb(*src8++, dst8++);

dst = (u32 __iomem *) dst8;
}

fb_memcpy_tofb(dst, src, c);
dst += c;
src += c;
*ppos += c;
buf += c;
cnt += c;
Expand Down
6 changes: 6 additions & 0 deletions include/linux/fb.h
View file
Original file line number Diff line number Diff line change
Expand Up @@ -931,6 +931,8 @@ static inline struct apertures_struct *alloc_apertures(unsigned int max_num) {
#define fb_writel sbus_writel
#define fb_writeq sbus_writeq
#define fb_memset sbus_memset_io
#define fb_memcpy_fromfb sbus_memcpy_fromio
#define fb_memcpy_tofb sbus_memcpy_toio

#elif defined(__i386__) || defined(__alpha__) || defined(__x86_64__) || defined(__hppa__) || defined(__sh__) || defined(__powerpc__) || defined(__avr32__) || defined(__bfin__)

Expand All @@ -943,6 +945,8 @@ static inline struct apertures_struct *alloc_apertures(unsigned int max_num) {
#define fb_writel __raw_writel
#define fb_writeq __raw_writeq
#define fb_memset memset_io
#define fb_memcpy_fromfb memcpy_fromio
#define fb_memcpy_tofb memcpy_toio

#else

Expand All @@ -955,6 +959,8 @@ static inline struct apertures_struct *alloc_apertures(unsigned int max_num) {
#define fb_writel(b,addr) (*(volatile u32 *) (addr) = (b))
#define fb_writeq(b,addr) (*(volatile u64 *) (addr) = (b))
#define fb_memset memset
#define fb_memcpy_fromfb memcpy
#define fb_memcpy_tofb memcpy

#endif

Expand Down

0 comments on commit f11b478

Please sign in to comment.