* [PATCH 02/11] fbdev/omapfb: use vm_iomap_memory()
2013-04-23 6:36 [PATCH 01/11] fbdev/fbmem: use vm_iomap_memory() Tomi Valkeinen
@ 2013-04-23 6:36 ` Tomi Valkeinen
2013-04-23 6:36 ` [PATCH 03/11] fbdev/au1100fb: " Tomi Valkeinen
` (8 subsequent siblings)
9 siblings, 0 replies; 12+ messages in thread
From: Tomi Valkeinen @ 2013-04-23 6:36 UTC (permalink / raw)
To: linux-fbdev, linux-kernel; +Cc: Tomi Valkeinen
Use vm_iomap_memory() instead of [io_]remap_pfn_range().
vm_iomap_memory() gives us much simpler API to map memory to userspace,
and reduces possibilities for bugs.
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
---
drivers/video/omap2/omapfb/omapfb-main.c | 30 +++++++-----------------------
1 file changed, 7 insertions(+), 23 deletions(-)
diff --git a/drivers/video/omap2/omapfb/omapfb-main.c b/drivers/video/omap2/omapfb/omapfb-main.c
index ca585ef..717f13a 100644
--- a/drivers/video/omap2/omapfb/omapfb-main.c
+++ b/drivers/video/omap2/omapfb/omapfb-main.c
@@ -1101,41 +1101,25 @@ static int omapfb_mmap(struct fb_info *fbi, struct vm_area_struct *vma)
struct omapfb_info *ofbi = FB2OFB(fbi);
struct fb_fix_screeninfo *fix = &fbi->fix;
struct omapfb2_mem_region *rg;
- unsigned long off;
unsigned long start;
u32 len;
- int r = -EINVAL;
-
- if (vma->vm_end - vma->vm_start = 0)
- return 0;
- if (vma->vm_pgoff > (~0UL >> PAGE_SHIFT))
- return -EINVAL;
- off = vma->vm_pgoff << PAGE_SHIFT;
+ int r;
rg = omapfb_get_mem_region(ofbi->region);
start = omapfb_get_region_paddr(ofbi);
len = fix->smem_len;
- if (off >= len)
- goto error;
- if ((vma->vm_end - vma->vm_start + off) > len)
- goto error;
-
- off += start;
- DBG("user mmap region start %lx, len %d, off %lx\n", start, len, off);
+ DBG("user mmap region start %lx, len %d, off %lx\n", start, len,
+ vma->vm_pgoff << PAGE_SHIFT);
- vma->vm_pgoff = off >> PAGE_SHIFT;
- /* VM_IO | VM_DONTEXPAND | VM_DONTDUMP are set by remap_pfn_range() */
vma->vm_page_prot = pgprot_writecombine(vma->vm_page_prot);
vma->vm_ops = &mmap_user_ops;
vma->vm_private_data = rg;
- if (io_remap_pfn_range(vma, vma->vm_start, off >> PAGE_SHIFT,
- vma->vm_end - vma->vm_start,
- vma->vm_page_prot)) {
- r = -EAGAIN;
+
+ r = vm_iomap_memory(vma, start, len);
+ if (r)
goto error;
- }
/* vm_ops.open won't be called for mmap itself. */
atomic_inc(&rg->map_count);
@@ -1144,7 +1128,7 @@ static int omapfb_mmap(struct fb_info *fbi, struct vm_area_struct *vma)
return 0;
- error:
+error:
omapfb_put_mem_region(ofbi->region);
return r;
--
1.7.10.4
^ permalink raw reply related [flat|nested] 12+ messages in thread* [PATCH 03/11] fbdev/au1100fb: use vm_iomap_memory()
2013-04-23 6:36 [PATCH 01/11] fbdev/fbmem: use vm_iomap_memory() Tomi Valkeinen
2013-04-23 6:36 ` [PATCH 02/11] fbdev/omapfb: " Tomi Valkeinen
@ 2013-04-23 6:36 ` Tomi Valkeinen
2013-04-23 6:36 ` [PATCH 04/11] fbdev/au1200fb: " Tomi Valkeinen
` (7 subsequent siblings)
9 siblings, 0 replies; 12+ messages in thread
From: Tomi Valkeinen @ 2013-04-23 6:36 UTC (permalink / raw)
To: linux-fbdev, linux-kernel; +Cc: Tomi Valkeinen
Use vm_iomap_memory() instead of [io_]remap_pfn_range().
vm_iomap_memory() gives us much simpler API to map memory to userspace,
and reduces possibilities for bugs.
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
---
drivers/video/au1100fb.c | 28 +---------------------------
1 file changed, 1 insertion(+), 27 deletions(-)
diff --git a/drivers/video/au1100fb.c b/drivers/video/au1100fb.c
index ddabaa8..0473b11 100644
--- a/drivers/video/au1100fb.c
+++ b/drivers/video/au1100fb.c
@@ -375,39 +375,13 @@ void au1100fb_fb_rotate(struct fb_info *fbi, int angle)
int au1100fb_fb_mmap(struct fb_info *fbi, struct vm_area_struct *vma)
{
struct au1100fb_device *fbdev;
- unsigned int len;
- unsigned long start=0, off;
fbdev = to_au1100fb_device(fbi);
- if (vma->vm_pgoff > (~0UL >> PAGE_SHIFT)) {
- return -EINVAL;
- }
-
- start = fbdev->fb_phys & PAGE_MASK;
- len = PAGE_ALIGN((start & ~PAGE_MASK) + fbdev->fb_len);
-
- off = vma->vm_pgoff << PAGE_SHIFT;
-
- if ((vma->vm_end - vma->vm_start + off) > len) {
- return -EINVAL;
- }
-
- off += start;
- vma->vm_pgoff = off >> PAGE_SHIFT;
-
vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
pgprot_val(vma->vm_page_prot) |= (6 << 9); //CCA=6
- vma->vm_flags |= VM_IO;
-
- if (io_remap_pfn_range(vma, vma->vm_start, off >> PAGE_SHIFT,
- vma->vm_end - vma->vm_start,
- vma->vm_page_prot)) {
- return -EAGAIN;
- }
-
- return 0;
+ return vm_iomap_memory(vma, fbdev->fb_phys, fbdev->fb_len);
}
static struct fb_ops au1100fb_ops --
1.7.10.4
^ permalink raw reply related [flat|nested] 12+ messages in thread* [PATCH 04/11] fbdev/au1200fb: use vm_iomap_memory()
2013-04-23 6:36 [PATCH 01/11] fbdev/fbmem: use vm_iomap_memory() Tomi Valkeinen
2013-04-23 6:36 ` [PATCH 02/11] fbdev/omapfb: " Tomi Valkeinen
2013-04-23 6:36 ` [PATCH 03/11] fbdev/au1100fb: " Tomi Valkeinen
@ 2013-04-23 6:36 ` Tomi Valkeinen
2013-04-23 6:36 ` [PATCH 05/11] fbdev/controlfb: " Tomi Valkeinen
` (6 subsequent siblings)
9 siblings, 0 replies; 12+ messages in thread
From: Tomi Valkeinen @ 2013-04-23 6:36 UTC (permalink / raw)
To: linux-fbdev, linux-kernel; +Cc: Tomi Valkeinen, Ralf Baechle, Manuel Lauss
Use vm_iomap_memory() instead of [io_]remap_pfn_range().
vm_iomap_memory() gives us much simpler API to map memory to userspace,
and reduces possibilities for bugs.
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
Cc: Ralf Baechle <ralf@linux-mips.org>
Cc: Manuel Lauss <manuel.lauss@googlemail.com>
---
drivers/video/au1200fb.c | 26 +-------------------------
1 file changed, 1 insertion(+), 25 deletions(-)
diff --git a/drivers/video/au1200fb.c b/drivers/video/au1200fb.c
index 1b59054..6ce6b83 100644
--- a/drivers/video/au1200fb.c
+++ b/drivers/video/au1200fb.c
@@ -1235,36 +1235,12 @@ static int au1200fb_fb_blank(int blank_mode, struct fb_info *fbi)
static int au1200fb_fb_mmap(struct fb_info *info, struct vm_area_struct *vma)
{
- unsigned int len;
- unsigned long start=0, off;
struct au1200fb_device *fbdev = info->par;
- if (vma->vm_pgoff > (~0UL >> PAGE_SHIFT)) {
- return -EINVAL;
- }
-
- start = fbdev->fb_phys & PAGE_MASK;
- len = PAGE_ALIGN((start & ~PAGE_MASK) + fbdev->fb_len);
-
- off = vma->vm_pgoff << PAGE_SHIFT;
-
- if ((vma->vm_end - vma->vm_start + off) > len) {
- return -EINVAL;
- }
-
- off += start;
- vma->vm_pgoff = off >> PAGE_SHIFT;
-
vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
pgprot_val(vma->vm_page_prot) |= _CACHE_MASK; /* CCA=7 */
- vma->vm_flags |= VM_IO;
-
- return io_remap_pfn_range(vma, vma->vm_start, off >> PAGE_SHIFT,
- vma->vm_end - vma->vm_start,
- vma->vm_page_prot);
-
- return 0;
+ return vm_iomap_memory(vma, fbdev->fb_phys, fbdev->fb_len);
}
static void set_global(u_int cmd, struct au1200_lcd_global_regs_t *pdata)
--
1.7.10.4
^ permalink raw reply related [flat|nested] 12+ messages in thread* [PATCH 05/11] fbdev/controlfb: use vm_iomap_memory()
2013-04-23 6:36 [PATCH 01/11] fbdev/fbmem: use vm_iomap_memory() Tomi Valkeinen
` (2 preceding siblings ...)
2013-04-23 6:36 ` [PATCH 04/11] fbdev/au1200fb: " Tomi Valkeinen
@ 2013-04-23 6:36 ` Tomi Valkeinen
2013-04-23 6:36 ` [PATCH 06/11] fbdev/fb-puv3: " Tomi Valkeinen
` (5 subsequent siblings)
9 siblings, 0 replies; 12+ messages in thread
From: Tomi Valkeinen @ 2013-04-23 6:36 UTC (permalink / raw)
To: linux-fbdev, linux-kernel; +Cc: Tomi Valkeinen
Use vm_iomap_memory() instead of [io_]remap_pfn_range().
vm_iomap_memory() gives us much simpler API to map memory to userspace,
and reduces possibilities for bugs.
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
---
drivers/video/controlfb.c | 50 ++++++++++++++++++---------------------------
1 file changed, 20 insertions(+), 30 deletions(-)
diff --git a/drivers/video/controlfb.c b/drivers/video/controlfb.c
index 0c189b3..67b77b4 100644
--- a/drivers/video/controlfb.c
+++ b/drivers/video/controlfb.c
@@ -285,36 +285,26 @@ static int controlfb_pan_display(struct fb_var_screeninfo *var,
static int controlfb_mmap(struct fb_info *info,
struct vm_area_struct *vma)
{
- unsigned long off, start;
- u32 len;
-
- off = vma->vm_pgoff << PAGE_SHIFT;
-
- /* frame buffer memory */
- start = info->fix.smem_start;
- len = PAGE_ALIGN((start & ~PAGE_MASK)+info->fix.smem_len);
- if (off >= len) {
- /* memory mapped io */
- off -= len;
- if (info->var.accel_flags)
- return -EINVAL;
- start = info->fix.mmio_start;
- len = PAGE_ALIGN((start & ~PAGE_MASK)+info->fix.mmio_len);
- vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
- } else {
- /* framebuffer */
- vma->vm_page_prot = pgprot_cached_wthru(vma->vm_page_prot);
- }
- start &= PAGE_MASK;
- if ((vma->vm_end - vma->vm_start + off) > len)
- return -EINVAL;
- off += start;
- vma->vm_pgoff = off >> PAGE_SHIFT;
- if (io_remap_pfn_range(vma, vma->vm_start, off >> PAGE_SHIFT,
- vma->vm_end - vma->vm_start, vma->vm_page_prot))
- return -EAGAIN;
-
- return 0;
+ unsigned long mmio_pgoff;
+ unsigned long start;
+ u32 len;
+
+ start = info->fix.smem_start;
+ len = info->fix.smem_len;
+ mmio_pgoff = PAGE_ALIGN((start & ~PAGE_MASK) + len) >> PAGE_SHIFT;
+ if (vma->vm_pgoff >= mmio_pgoff) {
+ if (info->var.accel_flags)
+ return -EINVAL;
+ vma->vm_pgoff -= mmio_pgoff;
+ start = info->fix.mmio_start;
+ len = info->fix.mmio_len;
+ vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
+ } else {
+ /* framebuffer */
+ vma->vm_page_prot = pgprot_cached_wthru(vma->vm_page_prot);
+ }
+
+ return vm_iomap_memory(vma, start, len);
}
static int controlfb_blank(int blank_mode, struct fb_info *info)
--
1.7.10.4
^ permalink raw reply related [flat|nested] 12+ messages in thread* [PATCH 06/11] fbdev/fb-puv3: use vm_iomap_memory()
2013-04-23 6:36 [PATCH 01/11] fbdev/fbmem: use vm_iomap_memory() Tomi Valkeinen
` (3 preceding siblings ...)
2013-04-23 6:36 ` [PATCH 05/11] fbdev/controlfb: " Tomi Valkeinen
@ 2013-04-23 6:36 ` Tomi Valkeinen
2013-04-23 6:36 ` [PATCH 07/11] fbdev/sa1100fb: " Tomi Valkeinen
` (4 subsequent siblings)
9 siblings, 0 replies; 12+ messages in thread
From: Tomi Valkeinen @ 2013-04-23 6:36 UTC (permalink / raw)
To: linux-fbdev, linux-kernel; +Cc: Tomi Valkeinen, Guan Xuetao
Use vm_iomap_memory() instead of [io_]remap_pfn_range().
vm_iomap_memory() gives us much simpler API to map memory to userspace,
and reduces possibilities for bugs.
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
Cc: Guan Xuetao <gxt@mprc.pku.edu.cn>
---
drivers/video/fb-puv3.c | 14 +-------------
1 file changed, 1 insertion(+), 13 deletions(-)
diff --git a/drivers/video/fb-puv3.c b/drivers/video/fb-puv3.c
index 7d106f1f..27fc956 100644
--- a/drivers/video/fb-puv3.c
+++ b/drivers/video/fb-puv3.c
@@ -640,21 +640,9 @@ static int unifb_pan_display(struct fb_var_screeninfo *var,
int unifb_mmap(struct fb_info *info,
struct vm_area_struct *vma)
{
- unsigned long size = vma->vm_end - vma->vm_start;
- unsigned long offset = vma->vm_pgoff << PAGE_SHIFT;
- unsigned long pos = info->fix.smem_start + offset;
-
- if (offset + size > info->fix.smem_len)
- return -EINVAL;
-
vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
- if (io_remap_pfn_range(vma, vma->vm_start, pos >> PAGE_SHIFT, size,
- vma->vm_page_prot))
- return -EAGAIN;
-
- /* VM_IO | VM_DONTEXPAND | VM_DONTDUMP are set by remap_pfn_range() */
- return 0;
+ return vm_iomap_memory(vma, info->fix.smem_start, info->fix.smem_len);
}
static struct fb_ops unifb_ops = {
--
1.7.10.4
^ permalink raw reply related [flat|nested] 12+ messages in thread* [PATCH 07/11] fbdev/sa1100fb: use vm_iomap_memory()
2013-04-23 6:36 [PATCH 01/11] fbdev/fbmem: use vm_iomap_memory() Tomi Valkeinen
` (4 preceding siblings ...)
2013-04-23 6:36 ` [PATCH 06/11] fbdev/fb-puv3: " Tomi Valkeinen
@ 2013-04-23 6:36 ` Tomi Valkeinen
2013-04-23 18:53 ` Russell King - ARM Linux
2013-04-23 6:36 ` [PATCH 08/11] fbdev/vermillion: " Tomi Valkeinen
` (3 subsequent siblings)
9 siblings, 1 reply; 12+ messages in thread
From: Tomi Valkeinen @ 2013-04-23 6:36 UTC (permalink / raw)
To: linux-fbdev, linux-kernel; +Cc: Tomi Valkeinen, Russell King
Use vm_iomap_memory() instead of [io_]remap_pfn_range().
vm_iomap_memory() gives us much simpler API to map memory to userspace,
and reduces possibilities for bugs.
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
Cc: Russell King <rmk+kernel@arm.linux.org.uk>
---
drivers/video/sa1100fb.c | 16 +++-------------
1 file changed, 3 insertions(+), 13 deletions(-)
diff --git a/drivers/video/sa1100fb.c b/drivers/video/sa1100fb.c
index cfbde5e..f34c858 100644
--- a/drivers/video/sa1100fb.c
+++ b/drivers/video/sa1100fb.c
@@ -556,7 +556,7 @@ static int sa1100fb_mmap(struct fb_info *info,
struct vm_area_struct *vma)
{
struct sa1100fb_info *fbi = (struct sa1100fb_info *)info;
- unsigned long start, len, off = vma->vm_pgoff << PAGE_SHIFT;
+ unsigned long off = vma->vm_pgoff << PAGE_SHIFT;
if (off < info->fix.smem_len) {
vma->vm_pgoff += 1; /* skip over the palette */
@@ -564,19 +564,9 @@ static int sa1100fb_mmap(struct fb_info *info,
fbi->map_dma, fbi->map_size);
}
- start = info->fix.mmio_start;
- len = PAGE_ALIGN((start & ~PAGE_MASK) + info->fix.mmio_len);
-
- if ((vma->vm_end - vma->vm_start + off) > len)
- return -EINVAL;
-
- off += start & PAGE_MASK;
- vma->vm_pgoff = off >> PAGE_SHIFT;
- vma->vm_flags |= VM_IO;
vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
- return io_remap_pfn_range(vma, vma->vm_start, off >> PAGE_SHIFT,
- vma->vm_end - vma->vm_start,
- vma->vm_page_prot);
+
+ return vm_iomap_memory(vma, info->fix.mmio_start, info->fix.mmio_len);
}
static struct fb_ops sa1100fb_ops = {
--
1.7.10.4
^ permalink raw reply related [flat|nested] 12+ messages in thread* [PATCH 08/11] fbdev/vermillion: use vm_iomap_memory()
2013-04-23 6:36 [PATCH 01/11] fbdev/fbmem: use vm_iomap_memory() Tomi Valkeinen
` (5 preceding siblings ...)
2013-04-23 6:36 ` [PATCH 07/11] fbdev/sa1100fb: " Tomi Valkeinen
@ 2013-04-23 6:36 ` Tomi Valkeinen
2013-04-23 6:36 ` [PATCH 09/11] fbdev/sgivwfb: " Tomi Valkeinen
` (2 subsequent siblings)
9 siblings, 0 replies; 12+ messages in thread
From: Tomi Valkeinen @ 2013-04-23 6:36 UTC (permalink / raw)
To: linux-fbdev, linux-kernel; +Cc: Tomi Valkeinen, Alan Hourihane
Use vm_iomap_memory() instead of [io_]remap_pfn_range().
vm_iomap_memory() gives us much simpler API to map memory to userspace,
and reduces possibilities for bugs.
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
Cc: Alan Hourihane <alanh@fairlite.demon.co.uk>
---
drivers/video/vermilion/vermilion.c | 14 ++++----------
1 file changed, 4 insertions(+), 10 deletions(-)
diff --git a/drivers/video/vermilion/vermilion.c b/drivers/video/vermilion/vermilion.c
index 0aa516f..09a1366 100644
--- a/drivers/video/vermilion/vermilion.c
+++ b/drivers/video/vermilion/vermilion.c
@@ -1003,24 +1003,18 @@ static int vmlfb_setcolreg(u_int regno, u_int red, u_int green, u_int blue,
static int vmlfb_mmap(struct fb_info *info, struct vm_area_struct *vma)
{
struct vml_info *vinfo = container_of(info, struct vml_info, info);
- unsigned long size = vma->vm_end - vma->vm_start;
unsigned long offset = vma->vm_pgoff << PAGE_SHIFT;
int ret;
- if (vma->vm_pgoff > (~0UL >> PAGE_SHIFT))
- return -EINVAL;
- if (offset + size > vinfo->vram_contig_size)
- return -EINVAL;
ret = vmlfb_vram_offset(vinfo, offset);
if (ret)
return -EINVAL;
- offset += vinfo->vram_start;
+
pgprot_val(vma->vm_page_prot) |= _PAGE_PCD;
pgprot_val(vma->vm_page_prot) &= ~_PAGE_PWT;
- if (remap_pfn_range(vma, vma->vm_start, offset >> PAGE_SHIFT,
- size, vma->vm_page_prot))
- return -EAGAIN;
- return 0;
+
+ return vm_iomap_memory(vma, vinfo->vram_start,
+ vinfo->vram_contig_size);
}
static int vmlfb_sync(struct fb_info *info)
--
1.7.10.4
^ permalink raw reply related [flat|nested] 12+ messages in thread* [PATCH 09/11] fbdev/sgivwfb: use vm_iomap_memory()
2013-04-23 6:36 [PATCH 01/11] fbdev/fbmem: use vm_iomap_memory() Tomi Valkeinen
` (6 preceding siblings ...)
2013-04-23 6:36 ` [PATCH 08/11] fbdev/vermillion: " Tomi Valkeinen
@ 2013-04-23 6:36 ` Tomi Valkeinen
2013-04-23 6:36 ` [PATCH 10/11] fbdev/ps3fb: " Tomi Valkeinen
2013-04-23 6:36 ` [PATCH 11/11] fbdev: improve fb_mmap bounds checks Tomi Valkeinen
9 siblings, 0 replies; 12+ messages in thread
From: Tomi Valkeinen @ 2013-04-23 6:36 UTC (permalink / raw)
To: linux-fbdev, linux-kernel; +Cc: Tomi Valkeinen
Use vm_iomap_memory() instead of [io_]remap_pfn_range().
vm_iomap_memory() gives us much simpler API to map memory to userspace,
and reduces possibilities for bugs.
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
---
drivers/video/sgivwfb.c | 20 +++++++-------------
1 file changed, 7 insertions(+), 13 deletions(-)
diff --git a/drivers/video/sgivwfb.c b/drivers/video/sgivwfb.c
index 2331fad..b2a8912 100644
--- a/drivers/video/sgivwfb.c
+++ b/drivers/video/sgivwfb.c
@@ -705,23 +705,17 @@ static int sgivwfb_setcolreg(u_int regno, u_int red, u_int green,
static int sgivwfb_mmap(struct fb_info *info,
struct vm_area_struct *vma)
{
- unsigned long size = vma->vm_end - vma->vm_start;
- unsigned long offset = vma->vm_pgoff << PAGE_SHIFT;
+ int r;
- if (vma->vm_pgoff > (~0UL >> PAGE_SHIFT))
- return -EINVAL;
- if (offset + size > sgivwfb_mem_size)
- return -EINVAL;
- offset += sgivwfb_mem_phys;
pgprot_val(vma->vm_page_prot) - pgprot_val(vma->vm_page_prot) | _PAGE_PCD;
- vma->vm_flags |= VM_IO;
- if (remap_pfn_range(vma, vma->vm_start, offset >> PAGE_SHIFT,
- size, vma->vm_page_prot))
- return -EAGAIN;
+ pgprot_val(vma->vm_page_prot) | _PAGE_PCD;
+
+ r = vm_iomap_memory(vma, sgivwfb_mem_phys, sgivwfb_mem_size);
+
printk(KERN_DEBUG "sgivwfb: mmap framebuffer P(%lx)->V(%lx)\n",
offset, vma->vm_start);
- return 0;
+
+ return r;
}
int __init sgivwfb_setup(char *options)
--
1.7.10.4
^ permalink raw reply related [flat|nested] 12+ messages in thread* [PATCH 10/11] fbdev/ps3fb: use vm_iomap_memory()
2013-04-23 6:36 [PATCH 01/11] fbdev/fbmem: use vm_iomap_memory() Tomi Valkeinen
` (7 preceding siblings ...)
2013-04-23 6:36 ` [PATCH 09/11] fbdev/sgivwfb: " Tomi Valkeinen
@ 2013-04-23 6:36 ` Tomi Valkeinen
2013-04-23 6:36 ` [PATCH 11/11] fbdev: improve fb_mmap bounds checks Tomi Valkeinen
9 siblings, 0 replies; 12+ messages in thread
From: Tomi Valkeinen @ 2013-04-23 6:36 UTC (permalink / raw)
To: linux-fbdev, linux-kernel; +Cc: Tomi Valkeinen, Geert Uytterhoeven
Use vm_iomap_memory() instead of [io_]remap_pfn_range().
vm_iomap_memory() gives us much simpler API to map memory to userspace,
and reduces possibilities for bugs.
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
Cc: Geert Uytterhoeven <Geert.Uytterhoeven@sonycom.com>
---
drivers/video/ps3fb.c | 15 ++++-----------
1 file changed, 4 insertions(+), 11 deletions(-)
diff --git a/drivers/video/ps3fb.c b/drivers/video/ps3fb.c
index 920c27b..1bdeb08 100644
--- a/drivers/video/ps3fb.c
+++ b/drivers/video/ps3fb.c
@@ -705,21 +705,14 @@ static int ps3fb_pan_display(struct fb_var_screeninfo *var,
static int ps3fb_mmap(struct fb_info *info, struct vm_area_struct *vma)
{
- unsigned long size, offset;
+ int r;
- size = vma->vm_end - vma->vm_start;
- offset = vma->vm_pgoff << PAGE_SHIFT;
- if (offset + size > info->fix.smem_len)
- return -EINVAL;
-
- offset += info->fix.smem_start;
- if (remap_pfn_range(vma, vma->vm_start, offset >> PAGE_SHIFT,
- size, vma->vm_page_prot))
- return -EAGAIN;
+ r = vm_ioremap_memory(vma, info->fix.smem_start, info->fix.smem_len);
dev_dbg(info->device, "ps3fb: mmap framebuffer P(%lx)->V(%lx)\n",
offset, vma->vm_start);
- return 0;
+
+ return r;
}
/*
--
1.7.10.4
^ permalink raw reply related [flat|nested] 12+ messages in thread* [PATCH 11/11] fbdev: improve fb_mmap bounds checks
2013-04-23 6:36 [PATCH 01/11] fbdev/fbmem: use vm_iomap_memory() Tomi Valkeinen
` (8 preceding siblings ...)
2013-04-23 6:36 ` [PATCH 10/11] fbdev/ps3fb: " Tomi Valkeinen
@ 2013-04-23 6:36 ` Tomi Valkeinen
9 siblings, 0 replies; 12+ messages in thread
From: Tomi Valkeinen @ 2013-04-23 6:36 UTC (permalink / raw)
To: linux-fbdev, linux-kernel
Cc: Tomi Valkeinen, Steve Glendinning, Bernie Thompson
Improve fb_mmap bounds checks in gbefb, smscufx, udlfb and vfb drivers to
prevent possible uint overflows.
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
Cc: Steve Glendinning <steve.glendinning@smsc.com>
Cc: Bernie Thompson <bernie@plugable.com>
---
drivers/video/gbefb.c | 4 +++-
drivers/video/smscufx.c | 6 +++++-
drivers/video/udlfb.c | 6 +++++-
drivers/video/vfb.c | 7 +++++--
4 files changed, 18 insertions(+), 5 deletions(-)
diff --git a/drivers/video/gbefb.c b/drivers/video/gbefb.c
index bda5e39..ceab370 100644
--- a/drivers/video/gbefb.c
+++ b/drivers/video/gbefb.c
@@ -1016,7 +1016,9 @@ static int gbefb_mmap(struct fb_info *info,
/* check range */
if (vma->vm_pgoff > (~0UL >> PAGE_SHIFT))
return -EINVAL;
- if (offset + size > gbe_mem_size)
+ if (size > gbe_mem_size)
+ return -EINVAL;
+ if (offset > gbe_mem_size - size)
return -EINVAL;
/* remap using the fastest write-through mode on architecture */
diff --git a/drivers/video/smscufx.c b/drivers/video/smscufx.c
index 97bd662..b2b33fc 100644
--- a/drivers/video/smscufx.c
+++ b/drivers/video/smscufx.c
@@ -782,7 +782,11 @@ static int ufx_ops_mmap(struct fb_info *info, struct vm_area_struct *vma)
unsigned long offset = vma->vm_pgoff << PAGE_SHIFT;
unsigned long page, pos;
- if (offset + size > info->fix.smem_len)
+ if (vma->vm_pgoff > (~0UL >> PAGE_SHIFT))
+ return -EINVAL;
+ if (size > info->fix.smem_len)
+ return -EINVAL;
+ if (offset > info->fix.smem_len - size)
return -EINVAL;
pos = (unsigned long)info->fix.smem_start + offset;
diff --git a/drivers/video/udlfb.c b/drivers/video/udlfb.c
index 86d449e..ec03e72 100644
--- a/drivers/video/udlfb.c
+++ b/drivers/video/udlfb.c
@@ -324,7 +324,11 @@ static int dlfb_ops_mmap(struct fb_info *info, struct vm_area_struct *vma)
unsigned long offset = vma->vm_pgoff << PAGE_SHIFT;
unsigned long page, pos;
- if (offset + size > info->fix.smem_len)
+ if (vma->vm_pgoff > (~0UL >> PAGE_SHIFT))
+ return -EINVAL;
+ if (size > info->fix.smem_len)
+ return -EINVAL;
+ if (offset > info->fix.smem_len - size)
return -EINVAL;
pos = (unsigned long)info->fix.smem_start + offset;
diff --git a/drivers/video/vfb.c b/drivers/video/vfb.c
index 8bc1f93..ee5985e 100644
--- a/drivers/video/vfb.c
+++ b/drivers/video/vfb.c
@@ -420,9 +420,12 @@ static int vfb_mmap(struct fb_info *info,
unsigned long offset = vma->vm_pgoff << PAGE_SHIFT;
unsigned long page, pos;
- if (offset + size > info->fix.smem_len) {
+ if (vma->vm_pgoff > (~0UL >> PAGE_SHIFT))
+ return -EINVAL;
+ if (size > info->fix.smem_len)
+ return -EINVAL;
+ if (offset > info->fix.smem_len - size)
return -EINVAL;
- }
pos = (unsigned long)info->fix.smem_start + offset;
--
1.7.10.4
^ permalink raw reply related [flat|nested] 12+ messages in thread