* Re: [RFC PATCH] fbcon: Fix out-of-bounds memory in fbcon_putcs
From: Helge Deller @ 2026-03-03 14:15 UTC (permalink / raw)
To: Chen Jun, simona, tzimmermann, linux-fbdev, linux-kernel; +Cc: linruifeng4
In-Reply-To: <20260227144358.101173-1-chenjun102@huawei.com>
On 2/27/26 15:43, Chen Jun wrote:
> When a font is set on an invisible console, the screen will not update.
> However, the fontbuffer is not updated to match the new font dimensions.
>
> This inconsistency leads to out-of-bounds memory access when writing to
> the tty bound to fbcon, as demonstrated by the following KASAN report:
>
> BUG: KASAN: slab-out-of-bounds in fb_pad_aligned_buffer+0xdf/0x140
> Read of size 1 at addr ffff8881195a2280 by task a.out/971
> Call Trace:
> <TASK>
> fb_pad_aligned_buffer+0xdf/0x140
> ud_putcs+0x88a/0xde0
> fbcon_putcs+0x319/0x430
> do_update_region+0x23c/0x3b0
> do_con_write+0x225c/0x67f0
> con_write+0xe/0x30
> n_tty_write+0x4b5/0xff0
> file_tty_write.isra.41+0x46c/0x880
> vfs_write+0x868/0xd60
> ksys_write+0xf2/0x1d0
> do_syscall_64+0xfa/0x570
>
> Fix this by calling fbcon_rotate_font() if vc is invisible in
> fbcon_do_set_font().
>
> Signed-off-by: Chen Jun <chenjun102@huawei.com>
> ---
> drivers/video/fbdev/core/fbcon.c | 5 +++++
> 1 file changed, 5 insertions(+)
applied to fbdev git tree.
Thanks!
Helge
^ permalink raw reply
* Re: [PATCH] fbdev: goldfishfb: use devm_platform_ioremap_resource()
From: Helge Deller @ 2026-03-03 14:07 UTC (permalink / raw)
To: Thomas Zimmermann, Amin GATTOUT; +Cc: linux-fbdev, dri-devel, linux-kernel
In-Reply-To: <2fb9b0fe-e63a-4b06-968d-3cb30383ba37@suse.de>
On 3/3/26 13:51, Thomas Zimmermann wrote:
> Am 03.03.26 um 13:22 schrieb Amin GATTOUT:
>> Replace the open-coded platform_get_resource() + ioremap() pair with
>> devm_platform_ioremap_resource(), which requests the memory region and
>> maps it in a single call, with automatic cleanup on device removal.
>>
>> Signed-off-by: Amin GATTOUT <amin.gattout@gmail.com>
>
> Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de>
>
>> ---
>> drivers/video/fbdev/goldfishfb.c | 14 +++-----------
>> 1 file changed, 3 insertions(+), 11 deletions(-)
applied to fbdev git tree.
Thanks!
Helge
^ permalink raw reply
* Re: [PATCH] fbdev: goldfishfb: use devm_platform_ioremap_resource()
From: Thomas Zimmermann @ 2026-03-03 12:51 UTC (permalink / raw)
To: Amin GATTOUT, Helge Deller; +Cc: linux-fbdev, dri-devel, linux-kernel
In-Reply-To: <20260303-master-v1-1-85eb5ff584b0@gmail.com>
Am 03.03.26 um 13:22 schrieb Amin GATTOUT:
> Replace the open-coded platform_get_resource() + ioremap() pair with
> devm_platform_ioremap_resource(), which requests the memory region and
> maps it in a single call, with automatic cleanup on device removal.
>
> Signed-off-by: Amin GATTOUT <amin.gattout@gmail.com>
Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de>
> ---
> drivers/video/fbdev/goldfishfb.c | 14 +++-----------
> 1 file changed, 3 insertions(+), 11 deletions(-)
>
> diff --git a/drivers/video/fbdev/goldfishfb.c b/drivers/video/fbdev/goldfishfb.c
> index ffe33a36b944..c9871281bc1d 100644
> --- a/drivers/video/fbdev/goldfishfb.c
> +++ b/drivers/video/fbdev/goldfishfb.c
> @@ -174,7 +174,6 @@ static const struct fb_ops goldfish_fb_ops = {
> static int goldfish_fb_probe(struct platform_device *pdev)
> {
> int ret;
> - struct resource *r;
> struct goldfish_fb *fb;
> size_t framesize;
> u32 width, height;
> @@ -189,14 +188,9 @@ static int goldfish_fb_probe(struct platform_device *pdev)
> init_waitqueue_head(&fb->wait);
> platform_set_drvdata(pdev, fb);
>
> - r = platform_get_resource(pdev, IORESOURCE_MEM, 0);
> - if (r == NULL) {
> - ret = -ENODEV;
> - goto err_no_io_base;
> - }
> - fb->reg_base = ioremap(r->start, PAGE_SIZE);
> - if (fb->reg_base == NULL) {
> - ret = -ENOMEM;
> + fb->reg_base = devm_platform_ioremap_resource(pdev, 0);
> + if (IS_ERR(fb->reg_base)) {
> + ret = PTR_ERR(fb->reg_base);
> goto err_no_io_base;
> }
>
> @@ -273,7 +267,6 @@ static int goldfish_fb_probe(struct platform_device *pdev)
> fb->fb.fix.smem_start);
> err_alloc_screen_base_failed:
> err_no_irq:
> - iounmap(fb->reg_base);
> err_no_io_base:
> kfree(fb);
> err_fb_alloc_failed:
> @@ -291,7 +284,6 @@ static void goldfish_fb_remove(struct platform_device *pdev)
>
> dma_free_coherent(&pdev->dev, framesize, (void *)fb->fb.screen_base,
> fb->fb.fix.smem_start);
> - iounmap(fb->reg_base);
> kfree(fb);
> }
>
>
> ---
> base-commit: 11439c4635edd669ae435eec308f4ab8a0804808
> change-id: 20260303-master-341e700a2699
>
> Best regards,
--
--
Thomas Zimmermann
Graphics Driver Developer
SUSE Software Solutions Germany GmbH
Frankenstr. 146, 90461 Nürnberg, Germany, www.suse.com
GF: Jochen Jaser, Andrew McDonald, Werner Knoblich, (HRB 36809, AG Nürnberg)
^ permalink raw reply
* [PATCH] fbdev: goldfishfb: use devm_platform_ioremap_resource()
From: Amin GATTOUT @ 2026-03-03 12:22 UTC (permalink / raw)
To: Helge Deller; +Cc: linux-fbdev, dri-devel, linux-kernel, Amin GATTOUT
Replace the open-coded platform_get_resource() + ioremap() pair with
devm_platform_ioremap_resource(), which requests the memory region and
maps it in a single call, with automatic cleanup on device removal.
Signed-off-by: Amin GATTOUT <amin.gattout@gmail.com>
---
drivers/video/fbdev/goldfishfb.c | 14 +++-----------
1 file changed, 3 insertions(+), 11 deletions(-)
diff --git a/drivers/video/fbdev/goldfishfb.c b/drivers/video/fbdev/goldfishfb.c
index ffe33a36b944..c9871281bc1d 100644
--- a/drivers/video/fbdev/goldfishfb.c
+++ b/drivers/video/fbdev/goldfishfb.c
@@ -174,7 +174,6 @@ static const struct fb_ops goldfish_fb_ops = {
static int goldfish_fb_probe(struct platform_device *pdev)
{
int ret;
- struct resource *r;
struct goldfish_fb *fb;
size_t framesize;
u32 width, height;
@@ -189,14 +188,9 @@ static int goldfish_fb_probe(struct platform_device *pdev)
init_waitqueue_head(&fb->wait);
platform_set_drvdata(pdev, fb);
- r = platform_get_resource(pdev, IORESOURCE_MEM, 0);
- if (r == NULL) {
- ret = -ENODEV;
- goto err_no_io_base;
- }
- fb->reg_base = ioremap(r->start, PAGE_SIZE);
- if (fb->reg_base == NULL) {
- ret = -ENOMEM;
+ fb->reg_base = devm_platform_ioremap_resource(pdev, 0);
+ if (IS_ERR(fb->reg_base)) {
+ ret = PTR_ERR(fb->reg_base);
goto err_no_io_base;
}
@@ -273,7 +267,6 @@ static int goldfish_fb_probe(struct platform_device *pdev)
fb->fb.fix.smem_start);
err_alloc_screen_base_failed:
err_no_irq:
- iounmap(fb->reg_base);
err_no_io_base:
kfree(fb);
err_fb_alloc_failed:
@@ -291,7 +284,6 @@ static void goldfish_fb_remove(struct platform_device *pdev)
dma_free_coherent(&pdev->dev, framesize, (void *)fb->fb.screen_base,
fb->fb.fix.smem_start);
- iounmap(fb->reg_base);
kfree(fb);
}
---
base-commit: 11439c4635edd669ae435eec308f4ab8a0804808
change-id: 20260303-master-341e700a2699
Best regards,
--
Amin GATTOUT <amin.gattout@gmail.com>
^ permalink raw reply related
* [PATCH v2 10/13] lib/fonts: Manage font-data lifetime with font_data_get/_put()
From: Thomas Zimmermann @ 2026-03-02 14:08 UTC (permalink / raw)
To: gregkh, deller, sam
Cc: linux-fbdev, dri-devel, linux-kernel, Thomas Zimmermann
In-Reply-To: <20260302141255.518657-1-tzimmermann@suse.de>
Add font_data_get() and font_data_put(). Update consoles to use them
over REFCOUNT() and plain kfree().
Newly allocated font data starts with a reference count of 1. Loading
the font puts the previously loaded font. If the reference count reaches
zero, font_data_put() frees the font data.
The kernel stores internal font data in a read-only section. Invoking
font_data_get() and font_data_put() tests this internally and returns
success without further operation. From the caller's perspective,
getting and putting works the same for all font data.
Fbcon used the userfont flag distinguish between internal fonts and
fonts loaded by user space. Only the latter where refcounted. With the
new helper's automatic handling of internal font data, remove the
userfont flag from fbcon.
Newport_con uses a default font, FONT_DATA, until user space loads
custom font data. Remove all special cases for FONT_DATA, as the get
and put calls' read-only handlign also covers this case.
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
---
drivers/video/console/newport_con.c | 26 ++++-------
drivers/video/fbdev/core/fbcon.c | 65 +++++++++++++--------------
drivers/video/fbdev/core/fbcon.h | 1 -
include/linux/font.h | 2 +
lib/fonts/fonts.c | 70 +++++++++++++++++++++++++++++
5 files changed, 111 insertions(+), 53 deletions(-)
diff --git a/drivers/video/console/newport_con.c b/drivers/video/console/newport_con.c
index 4db2b901c709..1bc3cb1ea116 100644
--- a/drivers/video/console/newport_con.c
+++ b/drivers/video/console/newport_con.c
@@ -517,7 +517,7 @@ static int newport_set_font(int unit, const struct console_font *op,
new_data += FONT_EXTRA_WORDS * sizeof(int);
FNTSIZE(new_data) = size;
- REFCOUNT(new_data) = 0; /* usage counter */
+ REFCOUNT(new_data) = 1; /* usage counter */
FNTSUM(new_data) = 0;
p = (unsigned char *)font_data_buf(new_data);
@@ -529,23 +529,18 @@ static int newport_set_font(int unit, const struct console_font *op,
/* check if font is already used by other console */
for (i = 0; i < MAX_NR_CONSOLES; i++) {
- if (font_data[i] != FONT_DATA
- && font_data_is_equal(font_data[i], new_data)) {
- kfree(new_data - FONT_EXTRA_WORDS * sizeof(int));
+ if (font_data_is_equal(font_data[i], new_data)) {
+ font_data_put(new_data);
/* current font is the same as the new one */
if (i == unit)
return 0;
new_data = font_data[i];
+ font_data_get(new_data);
break;
}
}
- /* old font is user font */
- if (font_data[unit] != FONT_DATA) {
- if (--REFCOUNT(font_data[unit]) == 0)
- kfree(font_data[unit] -
- FONT_EXTRA_WORDS * sizeof(int));
- }
- REFCOUNT(new_data)++;
+
+ font_data_put(font_data[unit]);
font_data[unit] = new_data;
return 0;
@@ -553,12 +548,9 @@ static int newport_set_font(int unit, const struct console_font *op,
static int newport_set_def_font(int unit, struct console_font *op)
{
- if (font_data[unit] != FONT_DATA) {
- if (--REFCOUNT(font_data[unit]) == 0)
- kfree(font_data[unit] -
- FONT_EXTRA_WORDS * sizeof(int));
- font_data[unit] = FONT_DATA;
- }
+ font_data_put(font_data[unit]);
+ font_data[unit] = FONT_DATA;
+ font_data_get(font_data[unit]);
return 0;
}
diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c
index 31e812d87d9e..00255ac92e42 100644
--- a/drivers/video/fbdev/core/fbcon.c
+++ b/drivers/video/fbdev/core/fbcon.c
@@ -1023,6 +1023,7 @@ static const char *fbcon_startup(void)
vc->vc_font.charcount = font->charcount;
p->fontdata = font->data;
+ font_data_get(p->fontdata);
}
cols = FBCON_SWAP(par->rotate, info->var.xres, info->var.yres);
@@ -1086,10 +1087,7 @@ static void fbcon_init(struct vc_data *vc, bool init)
vc->vc_font.charcount = fvc->vc_font.charcount;
p->fontdata = t->fontdata;
- p->userfont = t->userfont;
-
- if (p->userfont)
- REFCOUNT(p->fontdata)++;
+ font_data_get(p->fontdata);
} else {
const struct font_desc *font = NULL;
@@ -1104,6 +1102,7 @@ static void fbcon_init(struct vc_data *vc, bool init)
vc->vc_font.charcount = font->charcount;
p->fontdata = font->data;
+ font_data_get(p->fontdata);
}
}
@@ -1194,10 +1193,10 @@ static void fbcon_init(struct vc_data *vc, bool init)
static void fbcon_free_font(struct fbcon_display *p)
{
- if (p->userfont && p->fontdata && (--REFCOUNT(p->fontdata) == 0))
- kfree(p->fontdata - FONT_EXTRA_WORDS * sizeof(int));
- p->fontdata = NULL;
- p->userfont = 0;
+ if (p->fontdata) {
+ font_data_put(p->fontdata);
+ p->fontdata = NULL;
+ }
}
static void set_vc_hi_font(struct vc_data *vc, bool set);
@@ -1420,9 +1419,7 @@ static void fbcon_set_disp(struct fb_info *info, struct fb_var_screeninfo *var,
vc->vc_font.height = (*default_mode)->vc_font.height;
vc->vc_font.charcount = (*default_mode)->vc_font.charcount;
p->fontdata = t->fontdata;
- p->userfont = t->userfont;
- if (p->userfont)
- REFCOUNT(p->fontdata)++;
+ font_data_get(p->fontdata);
}
var->activate = FB_ACTIVATE_NOW;
@@ -2053,7 +2050,7 @@ static int fbcon_resize(struct vc_data *vc, unsigned int width,
struct fb_var_screeninfo var = info->var;
int x_diff, y_diff, virt_w, virt_h, virt_fw, virt_fh;
- if (p->userfont && font_data_size(p->fontdata)) {
+ if (font_data_size(p->fontdata)) {
unsigned int size = vc_font_size(&vc->vc_font);
/*
@@ -2413,21 +2410,20 @@ static void set_vc_hi_font(struct vc_data *vc, bool set)
}
static int fbcon_do_set_font(struct vc_data *vc, int w, int h, int charcount,
- font_data_t *data, int userfont)
+ font_data_t *data)
{
struct fb_info *info = fbcon_info_from_console(vc->vc_num);
struct fbcon_par *par = info->fbcon_par;
struct fbcon_display *p = &fb_display[vc->vc_num];
- int resize, ret, old_userfont, old_width, old_height, old_charcount;
+ int resize, ret, old_width, old_height, old_charcount;
font_data_t *old_fontdata = p->fontdata;
const u8 *old_data = vc->vc_font.data;
+ font_data_get(data);
+
resize = (w != vc->vc_font.width) || (h != vc->vc_font.height);
p->fontdata = data;
vc->vc_font.data = font_data_buf(p->fontdata);
- old_userfont = p->userfont;
- if ((p->userfont = userfont))
- REFCOUNT(data)++;
old_width = vc->vc_font.width;
old_height = vc->vc_font.height;
@@ -2457,24 +2453,20 @@ static int fbcon_do_set_font(struct vc_data *vc, int w, int h, int charcount,
update_screen(vc);
}
- if (old_userfont && (--REFCOUNT(old_fontdata) == 0))
- kfree(old_fontdata - FONT_EXTRA_WORDS * sizeof(int));
+ if (old_fontdata)
+ font_data_put(old_fontdata);
+
return 0;
err_out:
p->fontdata = old_fontdata;
vc->vc_font.data = old_data;
-
- if (userfont) {
- p->userfont = old_userfont;
- if (--REFCOUNT(data) == 0)
- kfree(data - FONT_EXTRA_WORDS * sizeof(int));
- }
-
vc->vc_font.width = old_width;
vc->vc_font.height = old_height;
vc->vc_font.charcount = old_charcount;
+ font_data_put(data);
+
return ret;
}
@@ -2491,9 +2483,9 @@ static int fbcon_set_font(struct vc_data *vc, const struct console_font *font,
int w = font->width;
int h = font->height;
int size, alloc_size;
- int i, csum;
+ int i, csum, ret;
font_data_t *new_data;
- u8 *data = font->data;
+ const u8 *data = font->data;
int pitch = PITCH(font->width);
/* Is there a reason why fbconsole couldn't handle any charcount >256?
@@ -2536,7 +2528,7 @@ static int fbcon_set_font(struct vc_data *vc, const struct console_font *font,
new_data += FONT_EXTRA_WORDS * sizeof(int);
FNTSIZE(new_data) = size;
- REFCOUNT(new_data) = 0; /* usage counter */
+ REFCOUNT(new_data) = 1; /* usage counter */
for (i=0; i< charcount; i++) {
memcpy((u8 *)new_data + i * h * pitch, data + i * vpitch * pitch, h * pitch);
}
@@ -2548,15 +2540,18 @@ static int fbcon_set_font(struct vc_data *vc, const struct console_font *font,
FNTSUM(new_data) = csum;
/* Check if the same font is on some other console already */
for (i = first_fb_vc; i <= last_fb_vc; i++) {
- if (fb_display[i].userfont &&
- fb_display[i].fontdata &&
+ if (fb_display[i].fontdata &&
font_data_is_equal(fb_display[i].fontdata, new_data)) {
- kfree(new_data - FONT_EXTRA_WORDS * sizeof(int));
- new_data = (u8 *)fb_display[i].fontdata;
+ font_data_get(fb_display[i].fontdata);
+ font_data_put(new_data);
+ new_data = fb_display[i].fontdata;
break;
}
}
- return fbcon_do_set_font(vc, font->width, font->height, charcount, new_data, 1);
+ ret = fbcon_do_set_font(vc, font->width, font->height, charcount, new_data);
+ font_data_put(new_data);
+
+ return ret;
}
static int fbcon_set_def_font(struct vc_data *vc, struct console_font *font,
@@ -2573,7 +2568,7 @@ static int fbcon_set_def_font(struct vc_data *vc, struct console_font *font,
font->width = f->width;
font->height = f->height;
- return fbcon_do_set_font(vc, f->width, f->height, f->charcount, f->data, 0);
+ return fbcon_do_set_font(vc, f->width, f->height, f->charcount, f->data);
}
static u16 palette_red[16];
diff --git a/drivers/video/fbdev/core/fbcon.h b/drivers/video/fbdev/core/fbcon.h
index d26ee7860cf5..1e3c1ef84762 100644
--- a/drivers/video/fbdev/core/fbcon.h
+++ b/drivers/video/fbdev/core/fbcon.h
@@ -27,7 +27,6 @@
struct fbcon_display {
/* Filled in by the low-level console driver */
font_data_t *fontdata;
- int userfont; /* != 0 if fontdata kmalloc()ed */
#ifdef CONFIG_FRAMEBUFFER_CONSOLE_LEGACY_ACCELERATION
u_short scrollmode; /* Scroll Method, use fb_scrollmode() */
#endif
diff --git a/include/linux/font.h b/include/linux/font.h
index 1f5b85601c9b..a8610201afb7 100644
--- a/include/linux/font.h
+++ b/include/linux/font.h
@@ -54,6 +54,8 @@ static inline const unsigned char *font_data_buf(font_data_t *fd)
return (const unsigned char *)fd;
}
+void font_data_get(font_data_t *fd);
+bool font_data_put(font_data_t *fd);
unsigned int font_data_size(font_data_t *fd);
bool font_data_is_equal(font_data_t *lhs, font_data_t *rhs);
diff --git a/lib/fonts/fonts.c b/lib/fonts/fonts.c
index c9f6328d5dda..1da0acdebf53 100644
--- a/lib/fonts/fonts.c
+++ b/lib/fonts/fonts.c
@@ -12,8 +12,10 @@
* for more details.
*/
+#include <linux/container_of.h>
#include <linux/font.h>
#include <linux/module.h>
+#include <linux/slab.h>
#include <linux/string.h>
#include <linux/types.h>
@@ -26,11 +28,79 @@
* Helpers for font_data_t
*/
+static struct font_data *to_font_data_struct(font_data_t *fd)
+{
+ return container_of(fd, struct font_data, data[0]);
+}
+
static bool font_data_is_internal(font_data_t *fd)
{
return is_kernel_rodata((unsigned long)fd);
}
+static void font_data_free(font_data_t *fd)
+{
+ if (WARN_ON(font_data_is_internal(fd)))
+ return;
+
+ kfree(to_font_data_struct(fd));
+}
+
+/**
+ * font_data_get - Acquires a reference on font data
+ * @fd: Font data
+ *
+ * Font data from user space is reference counted. The helper
+ * font_data_get() increases the reference counter by one. Invoke
+ * font_data_put() to release the reference.
+ *
+ * Internal font data is located in read-only memory. In this case
+ * the helper returns success without modifying the counter field.
+ * It is still required to call font_data_put() on internal font data.
+ */
+void font_data_get(font_data_t *fd)
+{
+ if (font_data_is_internal(fd))
+ return; /* never ref static data */
+
+ if (WARN_ON(!REFCOUNT(fd)))
+ return; /* should never be 0 */
+ ++REFCOUNT(fd);
+}
+EXPORT_SYMBOL_GPL(font_data_get);
+
+/**
+ * font_data_put - Release a reference on font data
+ * @fd: Font data
+ *
+ * Font data from user space is reference counted. The helper
+ * font_data_put() decreases the reference counter by one. If this was
+ * the final reference, it frees the allocated memory.
+ *
+ * Internal font data is located in read-only memory. In this case
+ * the helper returns success without modifying the counter field.
+ *
+ * Returns:
+ * True if this was the final reference, false otherwise.
+ */
+bool font_data_put(font_data_t *fd)
+{
+ unsigned int count;
+
+ if (font_data_is_internal(fd))
+ return true; /* never unref static data */
+
+ if (WARN_ON(!REFCOUNT(fd)))
+ return true; /* should never be 0 */
+
+ count = --REFCOUNT(fd);
+ if (!count)
+ font_data_free(fd);
+
+ return !count;
+}
+EXPORT_SYMBOL_GPL(font_data_put);
+
/**
* font_data_size - Return size of the font data in bytes
* @fd: Font data
--
2.53.0
^ permalink raw reply related
* [PATCH v2 13/13] lib/fonts: Remove internal symbols and macros from public header file
From: Thomas Zimmermann @ 2026-03-02 14:08 UTC (permalink / raw)
To: gregkh, deller, sam
Cc: linux-fbdev, dri-devel, linux-kernel, Thomas Zimmermann
In-Reply-To: <20260302141255.518657-1-tzimmermann@suse.de>
Define access macros for font_data_t in fonts.c. Define struct font_data
and declare most of the font symbols in the internal header font.h, where
they can only be seen by the font code.
Also move font indices into internal font.h. They appear to be unused
though. There is m86k assembly code that operates on the idx field, so
leave them in place for now.
List all built-in fonts in a separate section in the public header file.
v2:
- do not add config guards around font symbols (Helge)
- keep declaration of built-in fonts in public header
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
---
include/linux/font.h | 57 ++++++++++++--------------------------
lib/fonts/font.h | 38 +++++++++++++++++++++++++
lib/fonts/font_10x18.c | 2 +-
lib/fonts/font_6x10.c | 3 +-
lib/fonts/font_6x11.c | 2 +-
lib/fonts/font_6x8.c | 3 +-
lib/fonts/font_7x14.c | 2 +-
lib/fonts/font_8x16.c | 3 +-
lib/fonts/font_8x8.c | 2 +-
lib/fonts/font_acorn_8x8.c | 2 +-
lib/fonts/font_mini_4x6.c | 2 +-
lib/fonts/font_pearl_8x8.c | 2 +-
lib/fonts/font_sun12x22.c | 3 +-
lib/fonts/font_sun8x16.c | 3 +-
lib/fonts/font_ter10x18.c | 4 ++-
lib/fonts/font_ter16x32.c | 4 ++-
lib/fonts/fonts.c | 8 +++++-
17 files changed, 85 insertions(+), 55 deletions(-)
create mode 100644 lib/fonts/font.h
diff --git a/include/linux/font.h b/include/linux/font.h
index e2e02e40c365..63a8aee8e37d 100644
--- a/include/linux/font.h
+++ b/include/linux/font.h
@@ -77,36 +77,6 @@ struct font_desc {
int pref;
};
-#define VGA8x8_IDX 0
-#define VGA8x16_IDX 1
-#define PEARL8x8_IDX 2
-#define VGA6x11_IDX 3
-#define FONT7x14_IDX 4
-#define FONT10x18_IDX 5
-#define SUN8x16_IDX 6
-#define SUN12x22_IDX 7
-#define ACORN8x8_IDX 8
-#define MINI4x6_IDX 9
-#define FONT6x10_IDX 10
-#define TER16x32_IDX 11
-#define FONT6x8_IDX 12
-#define TER10x18_IDX 13
-
-extern const struct font_desc font_vga_8x8,
- font_vga_8x16,
- font_pearl_8x8,
- font_vga_6x11,
- font_7x14,
- font_10x18,
- font_sun_8x16,
- font_sun_12x22,
- font_acorn_8x8,
- font_mini_4x6,
- font_6x10,
- font_ter_16x32,
- font_6x8,
- font_ter_10x18;
-
/* Find a font with a specific name */
extern const struct font_desc *find_font(const char *name);
@@ -120,16 +90,23 @@ extern const struct font_desc *get_default_font(int xres, int yres,
/* Max. length for the name of a predefined font */
#define MAX_FONT_NAME 32
-/* Extra word getters */
-#define REFCOUNT(fd) (((int *)(fd))[-1])
-#define FNTSIZE(fd) (((int *)(fd))[-2])
-#define FNTSUM(fd) (((int *)(fd))[-4])
-
-#define FONT_EXTRA_WORDS 4
+/*
+ * Built-in fonts
+ */
-struct font_data {
- unsigned int extra[FONT_EXTRA_WORDS];
- unsigned char data[];
-} __packed;
+extern const struct font_desc font_10x18;
+extern const struct font_desc font_6x10;
+extern const struct font_desc font_6x8;
+extern const struct font_desc font_7x14;
+extern const struct font_desc font_acorn_8x8;
+extern const struct font_desc font_mini_4x6;
+extern const struct font_desc font_pearl_8x8;
+extern const struct font_desc font_sun_12x22;
+extern const struct font_desc font_sun_8x16;
+extern const struct font_desc font_ter_10x18;
+extern const struct font_desc font_ter_16x32;
+extern const struct font_desc font_vga_6x11;
+extern const struct font_desc font_vga_8x16;
+extern const struct font_desc font_vga_8x8;
#endif /* _VIDEO_FONT_H */
diff --git a/lib/fonts/font.h b/lib/fonts/font.h
new file mode 100644
index 000000000000..4f1adf0b6b54
--- /dev/null
+++ b/lib/fonts/font.h
@@ -0,0 +1,38 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+
+#ifndef _LIB_FONTS_FONT_H
+#define _LIB_FONTS_FONT_H
+
+#include <linux/font.h>
+
+/*
+ * Font data
+ */
+
+#define FONT_EXTRA_WORDS 4
+
+struct font_data {
+ unsigned int extra[FONT_EXTRA_WORDS];
+ unsigned char data[];
+} __packed;
+
+/*
+ * Built-in fonts
+ */
+
+#define VGA8x8_IDX 0
+#define VGA8x16_IDX 1
+#define PEARL8x8_IDX 2
+#define VGA6x11_IDX 3
+#define FONT7x14_IDX 4
+#define FONT10x18_IDX 5
+#define SUN8x16_IDX 6
+#define SUN12x22_IDX 7
+#define ACORN8x8_IDX 8
+#define MINI4x6_IDX 9
+#define FONT6x10_IDX 10
+#define TER16x32_IDX 11
+#define FONT6x8_IDX 12
+#define TER10x18_IDX 13
+
+#endif
diff --git a/lib/fonts/font_10x18.c b/lib/fonts/font_10x18.c
index 5d940db626e7..10edebc4bb74 100644
--- a/lib/fonts/font_10x18.c
+++ b/lib/fonts/font_10x18.c
@@ -4,7 +4,7 @@
* by Jurriaan Kalkman 06-2005 *
********************************/
-#include <linux/font.h>
+#include "font.h"
#define FONTDATAMAX 9216
diff --git a/lib/fonts/font_6x10.c b/lib/fonts/font_6x10.c
index e65df019e0d2..660d3a371b30 100644
--- a/lib/fonts/font_6x10.c
+++ b/lib/fonts/font_6x10.c
@@ -1,5 +1,6 @@
// SPDX-License-Identifier: GPL-2.0
-#include <linux/font.h>
+
+#include "font.h"
#define FONTDATAMAX 2560
diff --git a/lib/fonts/font_6x11.c b/lib/fonts/font_6x11.c
index bd76b3f6b635..671487ccc172 100644
--- a/lib/fonts/font_6x11.c
+++ b/lib/fonts/font_6x11.c
@@ -5,7 +5,7 @@
/* */
/**********************************************/
-#include <linux/font.h>
+#include "font.h"
#define FONTDATAMAX (11*256)
diff --git a/lib/fonts/font_6x8.c b/lib/fonts/font_6x8.c
index 06ace7792521..5811ee07f4d8 100644
--- a/lib/fonts/font_6x8.c
+++ b/lib/fonts/font_6x8.c
@@ -1,5 +1,6 @@
// SPDX-License-Identifier: GPL-2.0
-#include <linux/font.h>
+
+#include "font.h"
#define FONTDATAMAX 2048
diff --git a/lib/fonts/font_7x14.c b/lib/fonts/font_7x14.c
index a2f561c9fa04..0c7475d643c8 100644
--- a/lib/fonts/font_7x14.c
+++ b/lib/fonts/font_7x14.c
@@ -4,7 +4,7 @@
/* by Jurriaan Kalkman 05-2005 */
/**************************************/
-#include <linux/font.h>
+#include "font.h"
#define FONTDATAMAX 3584
diff --git a/lib/fonts/font_8x16.c b/lib/fonts/font_8x16.c
index 06ae14088514..523e95c75569 100644
--- a/lib/fonts/font_8x16.c
+++ b/lib/fonts/font_8x16.c
@@ -5,9 +5,10 @@
/* */
/**********************************************/
-#include <linux/font.h>
#include <linux/module.h>
+#include "font.h"
+
#define FONTDATAMAX 4096
static const struct font_data fontdata_8x16 = {
diff --git a/lib/fonts/font_8x8.c b/lib/fonts/font_8x8.c
index 69570b8c31af..e5b697fc9675 100644
--- a/lib/fonts/font_8x8.c
+++ b/lib/fonts/font_8x8.c
@@ -5,7 +5,7 @@
/* */
/**********************************************/
-#include <linux/font.h>
+#include "font.h"
#define FONTDATAMAX 2048
diff --git a/lib/fonts/font_acorn_8x8.c b/lib/fonts/font_acorn_8x8.c
index af5fa72aa8b7..36c51016769d 100644
--- a/lib/fonts/font_acorn_8x8.c
+++ b/lib/fonts/font_acorn_8x8.c
@@ -1,7 +1,7 @@
// SPDX-License-Identifier: GPL-2.0
/* Acorn-like font definition, with PC graphics characters */
-#include <linux/font.h>
+#include "font.h"
#define FONTDATAMAX 2048
diff --git a/lib/fonts/font_mini_4x6.c b/lib/fonts/font_mini_4x6.c
index cc21dc70cfd1..dc919c160dde 100644
--- a/lib/fonts/font_mini_4x6.c
+++ b/lib/fonts/font_mini_4x6.c
@@ -39,7 +39,7 @@ __END__;
MSBit to LSBit = left to right.
*/
-#include <linux/font.h>
+#include "font.h"
#define FONTDATAMAX 1536
diff --git a/lib/fonts/font_pearl_8x8.c b/lib/fonts/font_pearl_8x8.c
index ae98ca17982e..2438b374acea 100644
--- a/lib/fonts/font_pearl_8x8.c
+++ b/lib/fonts/font_pearl_8x8.c
@@ -10,7 +10,7 @@
/* */
/**********************************************/
-#include <linux/font.h>
+#include "font.h"
#define FONTDATAMAX 2048
diff --git a/lib/fonts/font_sun12x22.c b/lib/fonts/font_sun12x22.c
index 91daf5ab8b6b..2afbc144bea8 100644
--- a/lib/fonts/font_sun12x22.c
+++ b/lib/fonts/font_sun12x22.c
@@ -1,5 +1,6 @@
// SPDX-License-Identifier: GPL-2.0
-#include <linux/font.h>
+
+#include "font.h"
#define FONTDATAMAX 11264
diff --git a/lib/fonts/font_sun8x16.c b/lib/fonts/font_sun8x16.c
index 81bb4eeae04e..2b7b2d8e548a 100644
--- a/lib/fonts/font_sun8x16.c
+++ b/lib/fonts/font_sun8x16.c
@@ -1,5 +1,6 @@
// SPDX-License-Identifier: GPL-2.0
-#include <linux/font.h>
+
+#include "font.h"
#define FONTDATAMAX 4096
diff --git a/lib/fonts/font_ter10x18.c b/lib/fonts/font_ter10x18.c
index 80356e9d56c7..3f30b4a211ab 100644
--- a/lib/fonts/font_ter10x18.c
+++ b/lib/fonts/font_ter10x18.c
@@ -1,7 +1,9 @@
// SPDX-License-Identifier: GPL-2.0
-#include <linux/font.h>
+
#include <linux/module.h>
+#include "font.h"
+
#define FONTDATAMAX 9216
static const struct font_data fontdata_ter10x18 = {
diff --git a/lib/fonts/font_ter16x32.c b/lib/fonts/font_ter16x32.c
index 5baedc573dd6..93616cffe642 100644
--- a/lib/fonts/font_ter16x32.c
+++ b/lib/fonts/font_ter16x32.c
@@ -1,7 +1,9 @@
// SPDX-License-Identifier: GPL-2.0
-#include <linux/font.h>
+
#include <linux/module.h>
+#include "font.h"
+
#define FONTDATAMAX 16384
static const struct font_data fontdata_ter16x32 = {
diff --git a/lib/fonts/fonts.c b/lib/fonts/fonts.c
index 1830e6ae9c87..198aae869be2 100644
--- a/lib/fonts/fonts.c
+++ b/lib/fonts/fonts.c
@@ -13,7 +13,6 @@
*/
#include <linux/container_of.h>
-#include <linux/font.h>
#include <linux/kd.h>
#include <linux/module.h>
#include <linux/overflow.h>
@@ -26,12 +25,19 @@
#include <asm/setup.h>
#endif
+#include "font.h"
+
#define console_font_pitch(font) DIV_ROUND_UP((font)->width, 8)
/*
* Helpers for font_data_t
*/
+/* Extra word getters */
+#define REFCOUNT(fd) (((int *)(fd))[-1])
+#define FNTSIZE(fd) (((int *)(fd))[-2])
+#define FNTSUM(fd) (((int *)(fd))[-4])
+
static struct font_data *to_font_data_struct(font_data_t *fd)
{
return container_of(fd, struct font_data, data[0]);
--
2.53.0
^ permalink raw reply related
* [PATCH v2 07/13] lib/fonts: Store font data as font_data_t; update consoles
From: Thomas Zimmermann @ 2026-03-02 14:08 UTC (permalink / raw)
To: gregkh, deller, sam
Cc: linux-fbdev, dri-devel, linux-kernel, Thomas Zimmermann
In-Reply-To: <20260302141255.518657-1-tzimmermann@suse.de>
Store font data as pointer to font_data_t instead of unsigned char.
Update consoles.
Pointers to font data refer to the raw data. There is a hidden header
before the data that contains additional state. Document the existing
layout and semantics of font_data_t.
The data field in struct vc_font can be used by any console. Therefore
it still points to plain data without the additional header. Fbcon sets
its value from struct fbcon_display.fontdata. Hence, update the size
test in fbcon_resize() to use struct fbcon_display.fontdata instead of
struct vc_font.data.
v2:
- 'Font lookup' -> 'Font description' in <linux/font.h>
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
---
drivers/video/console/newport_con.c | 17 ++++++-----
drivers/video/fbdev/core/fbcon.c | 44 ++++++++++++++++-----------
drivers/video/fbdev/core/fbcon.h | 3 +-
include/linux/font.h | 47 ++++++++++++++++++++++++++++-
4 files changed, 84 insertions(+), 27 deletions(-)
diff --git a/drivers/video/console/newport_con.c b/drivers/video/console/newport_con.c
index e2922caa8685..9b9ed1940404 100644
--- a/drivers/video/console/newport_con.c
+++ b/drivers/video/console/newport_con.c
@@ -33,9 +33,9 @@
#define NEWPORT_LEN 0x10000
-#define FONT_DATA ((unsigned char *)font_vga_8x16.data)
+#define FONT_DATA font_vga_8x16.data
-static unsigned char *font_data[MAX_NR_CONSOLES];
+static font_data_t *font_data[MAX_NR_CONSOLES];
static struct newport_regs *npregs;
static unsigned long newport_addr;
@@ -370,9 +370,9 @@ static void newport_clear(struct vc_data *vc, unsigned int sy, unsigned int sx,
static void newport_putc(struct vc_data *vc, u16 charattr, unsigned int ypos,
unsigned int xpos)
{
- unsigned char *p;
+ const unsigned char *p;
- p = &font_data[vc->vc_num][(charattr & 0xff) << 4];
+ p = &font_data_buf(font_data[vc->vc_num])[(charattr & 0xff) << 4];
charattr = (charattr >> 8) & 0xff;
xpos <<= 3;
ypos <<= 4;
@@ -400,7 +400,7 @@ static void newport_putcs(struct vc_data *vc, const u16 *s,
unsigned int count, unsigned int ypos,
unsigned int xpos)
{
- unsigned char *p;
+ const unsigned char *p;
unsigned int i;
u16 charattr;
@@ -424,7 +424,7 @@ static void newport_putcs(struct vc_data *vc, const u16 *s,
NPORT_DMODE0_L32);
for (i = 0; i < count; i++, xpos += 8) {
- p = &font_data[vc->vc_num][(scr_readw(s++) & 0xff) << 4];
+ p = &font_data_buf(font_data[vc->vc_num])[(scr_readw(s++) & 0xff) << 4];
newport_wait(npregs);
@@ -503,7 +503,8 @@ static int newport_set_font(int unit, const struct console_font *op,
int h = op->height;
int size = h * op->charcount;
int i;
- unsigned char *new_data, *data = op->data, *p;
+ font_data_t *new_data;
+ unsigned char *data = op->data, *p;
/* ladis: when I grow up, there will be a day... and more sizes will
* be supported ;-) */
@@ -519,7 +520,7 @@ static int newport_set_font(int unit, const struct console_font *op,
REFCOUNT(new_data) = 0; /* usage counter */
FNTSUM(new_data) = 0;
- p = new_data;
+ p = (unsigned char *)font_data_buf(new_data);
for (i = 0; i < op->charcount; i++) {
memcpy(p, data, h);
data += 32;
diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c
index 103e91c8d874..8d7840b9ebad 100644
--- a/drivers/video/fbdev/core/fbcon.c
+++ b/drivers/video/fbdev/core/fbcon.c
@@ -1019,8 +1019,10 @@ static const char *fbcon_startup(void)
info->pixmap.blit_y);
vc->vc_font.width = font->width;
vc->vc_font.height = font->height;
- vc->vc_font.data = (void *)(p->fontdata = font->data);
+ vc->vc_font.data = font_data_buf(font->data);
vc->vc_font.charcount = font->charcount;
+
+ p->fontdata = font->data;
}
cols = FBCON_SWAP(par->rotate, info->var.xres, info->var.yres);
@@ -1078,11 +1080,12 @@ static void fbcon_init(struct vc_data *vc, bool init)
if (t->fontdata) {
struct vc_data *fvc = vc_cons[fg_console].d;
- vc->vc_font.data = (void *)(p->fontdata =
- fvc->vc_font.data);
+ vc->vc_font.data = fvc->vc_font.data;
vc->vc_font.width = fvc->vc_font.width;
vc->vc_font.height = fvc->vc_font.height;
vc->vc_font.charcount = fvc->vc_font.charcount;
+
+ p->fontdata = t->fontdata;
p->userfont = t->userfont;
if (p->userfont)
@@ -1097,8 +1100,10 @@ static void fbcon_init(struct vc_data *vc, bool init)
info->pixmap.blit_y);
vc->vc_font.width = font->width;
vc->vc_font.height = font->height;
- vc->vc_font.data = (void *)(p->fontdata = font->data);
+ vc->vc_font.data = font_data_buf(font->data);
vc->vc_font.charcount = font->charcount;
+
+ p->fontdata = font->data;
}
}
@@ -1409,11 +1414,12 @@ static void fbcon_set_disp(struct fb_info *info, struct fb_var_screeninfo *var,
svc = *default_mode;
t = &fb_display[svc->vc_num];
- if (!vc->vc_font.data) {
- vc->vc_font.data = (void *)(p->fontdata = t->fontdata);
+ if (!p->fontdata) {
+ vc->vc_font.data = font_data_buf(t->fontdata);
vc->vc_font.width = (*default_mode)->vc_font.width;
vc->vc_font.height = (*default_mode)->vc_font.height;
vc->vc_font.charcount = (*default_mode)->vc_font.charcount;
+ p->fontdata = t->fontdata;
p->userfont = t->userfont;
if (p->userfont)
REFCOUNT(p->fontdata)++;
@@ -2047,7 +2053,7 @@ static int fbcon_resize(struct vc_data *vc, unsigned int width,
struct fb_var_screeninfo var = info->var;
int x_diff, y_diff, virt_w, virt_h, virt_fw, virt_fh;
- if (p->userfont && FNTSIZE(vc->vc_font.data)) {
+ if (p->userfont && FNTSIZE(p->fontdata)) {
unsigned int size = vc_font_size(&vc->vc_font);
/*
@@ -2057,7 +2063,7 @@ static int fbcon_resize(struct vc_data *vc, unsigned int width,
* charcount can change and cannot be used to determine the
* font data allocated size.
*/
- if (!size || size > FNTSIZE(vc->vc_font.data))
+ if (!size || size > FNTSIZE(p->fontdata))
return -EINVAL;
}
@@ -2281,7 +2287,8 @@ static bool fbcon_blank(struct vc_data *vc, enum vesa_blank_mode blank,
static int fbcon_get_font(struct vc_data *vc, struct console_font *font, unsigned int vpitch)
{
- const u8 *fontdata = vc->vc_font.data;
+ struct fbcon_display *p = &fb_display[vc->vc_num];
+ font_data_t *fontdata = p->fontdata;
u8 *data = font->data;
int i, j;
@@ -2406,16 +2413,18 @@ static void set_vc_hi_font(struct vc_data *vc, bool set)
}
static int fbcon_do_set_font(struct vc_data *vc, int w, int h, int charcount,
- const u8 * data, int userfont)
+ font_data_t *data, int userfont)
{
struct fb_info *info = fbcon_info_from_console(vc->vc_num);
struct fbcon_par *par = info->fbcon_par;
struct fbcon_display *p = &fb_display[vc->vc_num];
int resize, ret, old_userfont, old_width, old_height, old_charcount;
+ font_data_t *old_fontdata = p->fontdata;
const u8 *old_data = vc->vc_font.data;
resize = (w != vc->vc_font.width) || (h != vc->vc_font.height);
- vc->vc_font.data = (void *)(p->fontdata = data);
+ p->fontdata = data;
+ vc->vc_font.data = font_data_buf(p->fontdata);
old_userfont = p->userfont;
if ((p->userfont = userfont))
REFCOUNT(data)++;
@@ -2448,12 +2457,12 @@ static int fbcon_do_set_font(struct vc_data *vc, int w, int h, int charcount,
update_screen(vc);
}
- if (old_userfont && (--REFCOUNT(old_data) == 0))
- kfree(old_data - FONT_EXTRA_WORDS * sizeof(int));
+ if (old_userfont && (--REFCOUNT(old_fontdata) == 0))
+ kfree(old_fontdata - FONT_EXTRA_WORDS * sizeof(int));
return 0;
err_out:
- p->fontdata = old_data;
+ p->fontdata = old_fontdata;
vc->vc_font.data = old_data;
if (userfont) {
@@ -2483,7 +2492,8 @@ static int fbcon_set_font(struct vc_data *vc, const struct console_font *font,
int h = font->height;
int size, alloc_size;
int i, csum;
- u8 *new_data, *data = font->data;
+ font_data_t *new_data;
+ u8 *data = font->data;
int pitch = PITCH(font->width);
/* Is there a reason why fbconsole couldn't handle any charcount >256?
@@ -2522,13 +2532,13 @@ static int fbcon_set_font(struct vc_data *vc, const struct console_font *font,
if (!new_data)
return -ENOMEM;
- memset(new_data, 0, FONT_EXTRA_WORDS * sizeof(int));
+ memset((u8 *)new_data, 0, FONT_EXTRA_WORDS * sizeof(int));
new_data += FONT_EXTRA_WORDS * sizeof(int);
FNTSIZE(new_data) = size;
REFCOUNT(new_data) = 0; /* usage counter */
for (i=0; i< charcount; i++) {
- memcpy(new_data + i*h*pitch, data + i*vpitch*pitch, h*pitch);
+ memcpy((u8 *)new_data + i * h * pitch, data + i * vpitch * pitch, h * pitch);
}
/* Since linux has a nice crc32 function use it for counting font
diff --git a/drivers/video/fbdev/core/fbcon.h b/drivers/video/fbdev/core/fbcon.h
index 3f4386a40237..d26ee7860cf5 100644
--- a/drivers/video/fbdev/core/fbcon.h
+++ b/drivers/video/fbdev/core/fbcon.h
@@ -11,6 +11,7 @@
#ifndef _VIDEO_FBCON_H
#define _VIDEO_FBCON_H
+#include <linux/font.h>
#include <linux/types.h>
#include <linux/vt_buffer.h>
#include <linux/vt_kern.h>
@@ -25,7 +26,7 @@
struct fbcon_display {
/* Filled in by the low-level console driver */
- const u_char *fontdata;
+ font_data_t *fontdata;
int userfont; /* != 0 if fontdata kmalloc()ed */
#ifdef CONFIG_FRAMEBUFFER_CONSOLE_LEGACY_ACCELERATION
u_short scrollmode; /* Scroll Method, use fb_scrollmode() */
diff --git a/include/linux/font.h b/include/linux/font.h
index d929c5fa32ca..f19abd112c18 100644
--- a/include/linux/font.h
+++ b/include/linux/font.h
@@ -13,12 +13,57 @@
#include <linux/types.h>
+/*
+ * font_data_t and helpers
+ */
+
+/**
+ * font_data_t - Raw font data
+ *
+ * Values of type font_data_t store a pointer to raw font data. The format
+ * is monochrome. Each bit sets a pixel of a stored glyph. Font data does
+ * not store geometry information for the individual glyphs. Users of the
+ * font have to store glyph size, pitch and characer count separately.
+ *
+ * Font data in font_data_t is not equivalent to raw u8. Each pointer stores
+ * an additional hidden header before the fotn data. The layout is
+ *
+ * +------+-----------------------------+
+ * | -16 | CRC32 Checksum (optional) |
+ * | -12 | <Unused> |
+ * | -8 | Number of data bytes |
+ * | -4 | Reference count |
+ * +------+-----------------------------+
+ * | 0 | Data buffer |
+ * | ... | |
+ * +------+-----------------------------+
+ *
+ * Use helpers to access font_data_t. Use font_data_buf() to get the stored data.
+ */
+typedef const unsigned char font_data_t;
+
+/**
+ * font_data_buf() - Returns the font data as raw bytes
+ * @fd: The font data
+ *
+ * Returns:
+ * The raw font data. The provided buffer is read-only.
+ */
+static inline const unsigned char *font_data_buf(font_data_t *fd)
+{
+ return (const unsigned char *)fd;
+}
+
+/*
+ * Font description
+ */
+
struct font_desc {
int idx;
const char *name;
unsigned int width, height;
unsigned int charcount;
- const void *data;
+ font_data_t *data;
int pref;
};
--
2.53.0
^ permalink raw reply related
* [PATCH v2 12/13] lib/fonts: Store font data for user space with font_data_export()
From: Thomas Zimmermann @ 2026-03-02 14:08 UTC (permalink / raw)
To: gregkh, deller, sam
Cc: linux-fbdev, dri-devel, linux-kernel, Thomas Zimmermann
In-Reply-To: <20260302141255.518657-1-tzimmermann@suse.de>
Add font_data_export() and update consoles to use it.
The helper font_data_export() is based on code in fbcon_get_font().
It extends the size of a single glyph to match the requested vpitch,
which us usually 32 bytes for fonts from user space. Internal fonts
have a pitch according to the glyph's height.
The implementation of font_data_export() differs in several ways from
the original code. The original implementation distinguished between
different pitches of the font data. This is not necessary as the pitch
is a parameter in the copying.
There was also special handling for a font pitch of 3 bytes, which got
expanded to 4 bytes (with trailing bits on each scanline). The logic
originated from long before git history exists even in the historical
tree. So it is not clear why this was implemented. It is not what user
space expects. The setfont utitlity loads font with 3-bytes pitches and
expects to read such fonts with a 3-byte pitch. For any font width, the
font pitch is always the width extended to the next multiple of 8. See
[1] for the user-space font-reading code.
With the changes ot handling the font pitches, font_data_export() replaces
the original code's various special cases with a single copying logic.
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Link: https://github.com/legionus/kbd/blob/v2.9.0/src/libkfont/kdfontop.c#L73 # [1]
---
drivers/video/fbdev/core/fbcon.c | 57 ++------------------------------
include/linux/font.h | 1 +
lib/fonts/fonts.c | 40 ++++++++++++++++++++++
3 files changed, 43 insertions(+), 55 deletions(-)
diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c
index 53677c09a0ec..8641b0b3edc4 100644
--- a/drivers/video/fbdev/core/fbcon.c
+++ b/drivers/video/fbdev/core/fbcon.c
@@ -2282,68 +2282,15 @@ static bool fbcon_blank(struct vc_data *vc, enum vesa_blank_mode blank,
static int fbcon_get_font(struct vc_data *vc, struct console_font *font, unsigned int vpitch)
{
- struct fbcon_display *p = &fb_display[vc->vc_num];
- font_data_t *fontdata = p->fontdata;
- u8 *data = font->data;
- int i, j;
+ const struct fbcon_display *p = &fb_display[vc->vc_num];
font->width = vc->vc_font.width;
font->height = vc->vc_font.height;
if (font->height > vpitch)
return -ENOSPC;
font->charcount = vc->vc_hi_font_mask ? 512 : 256;
- if (!font->data)
- return 0;
-
- if (font->width <= 8) {
- j = vc->vc_font.height;
- if (font->charcount * j > font_data_size(fontdata))
- return -EINVAL;
- for (i = 0; i < font->charcount; i++) {
- memcpy(data, fontdata, j);
- memset(data + j, 0, vpitch - j);
- data += vpitch;
- fontdata += j;
- }
- } else if (font->width <= 16) {
- j = vc->vc_font.height * 2;
- if (font->charcount * j > font_data_size(fontdata))
- return -EINVAL;
-
- for (i = 0; i < font->charcount; i++) {
- memcpy(data, fontdata, j);
- memset(data + j, 0, 2*vpitch - j);
- data += 2*vpitch;
- fontdata += j;
- }
- } else if (font->width <= 24) {
- if (font->charcount * (vc->vc_font.height * sizeof(u32)) > font_data_size(fontdata))
- return -EINVAL;
-
- for (i = 0; i < font->charcount; i++) {
- for (j = 0; j < vc->vc_font.height; j++) {
- *data++ = fontdata[0];
- *data++ = fontdata[1];
- *data++ = fontdata[2];
- fontdata += sizeof(u32);
- }
- memset(data, 0, 3 * (vpitch - j));
- data += 3 * (vpitch - j);
- }
- } else {
- j = vc->vc_font.height * 4;
- if (font->charcount * j > font_data_size(fontdata))
- return -EINVAL;
-
- for (i = 0; i < font->charcount; i++) {
- memcpy(data, fontdata, j);
- memset(data + j, 0, 4 * vpitch - j);
- data += 4 * vpitch;
- fontdata += j;
- }
- }
- return 0;
+ return font_data_export(p->fontdata, font, vpitch);
}
/* set/clear vc_hi_font_mask and update vc attrs accordingly */
diff --git a/include/linux/font.h b/include/linux/font.h
index d3b8ca240152..e2e02e40c365 100644
--- a/include/linux/font.h
+++ b/include/linux/font.h
@@ -62,6 +62,7 @@ void font_data_get(font_data_t *fd);
bool font_data_put(font_data_t *fd);
unsigned int font_data_size(font_data_t *fd);
bool font_data_is_equal(font_data_t *lhs, font_data_t *rhs);
+int font_data_export(font_data_t *fd, struct console_font *font, unsigned int vpitch);
/*
* Font description
diff --git a/lib/fonts/fonts.c b/lib/fonts/fonts.c
index 9b5355f6d2dc..1830e6ae9c87 100644
--- a/lib/fonts/fonts.c
+++ b/lib/fonts/fonts.c
@@ -202,6 +202,46 @@ bool font_data_is_equal(font_data_t *lhs, font_data_t *rhs)
}
EXPORT_SYMBOL_GPL(font_data_is_equal);
+/**
+ * font_data_export - Stores font data for user space
+ * @fd: Font data
+ * @font: A font for user space
+ * @vpitch: The size of a single glyph in @font in bytes
+ *
+ * Store the font data given in @fd to the font in @font. Values and
+ * pointers in @font are pre-initialized. This helper mostly checks some
+ * corner cases and translates glyph sizes according to the value given
+ * @vpitch.
+ *
+ * Returns:
+ * 0 on success, or a negative errno code otherwise.
+ */
+int font_data_export(font_data_t *fd, struct console_font *font, unsigned int vpitch)
+{
+ const unsigned char *font_data = font_data_buf(fd);
+ unsigned char *data = font->data;
+ unsigned int pitch = console_font_pitch(font);
+ unsigned int glyphsize, i;
+
+ if (!font->width || !font->height || !font->charcount || !font->data)
+ return 0;
+
+ glyphsize = font->height * pitch;
+
+ if (font->charcount * glyphsize > font_data_size(fd))
+ return -EINVAL;
+
+ for (i = 0; i < font->charcount; i++) {
+ memcpy(data, font_data, glyphsize);
+ memset(data + glyphsize, 0, pitch * vpitch - glyphsize);
+ data += pitch * vpitch;
+ font_data += glyphsize;
+ }
+
+ return 0;
+}
+EXPORT_SYMBOL_GPL(font_data_export);
+
/*
* Font lookup
*/
--
2.53.0
^ permalink raw reply related
* [PATCH v2 06/13] lib/fonts: Remove FNTCHARCNT()
From: Thomas Zimmermann @ 2026-03-02 14:08 UTC (permalink / raw)
To: gregkh, deller, sam
Cc: linux-fbdev, dri-devel, linux-kernel, Thomas Zimmermann
In-Reply-To: <20260302141255.518657-1-tzimmermann@suse.de>
The character count in the font data is unused. The internal fonts also
do not set it. Remove FNTCHARCNT().
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
---
drivers/video/console/newport_con.c | 1 -
include/linux/font.h | 1 -
2 files changed, 2 deletions(-)
diff --git a/drivers/video/console/newport_con.c b/drivers/video/console/newport_con.c
index b178678566e7..e2922caa8685 100644
--- a/drivers/video/console/newport_con.c
+++ b/drivers/video/console/newport_con.c
@@ -516,7 +516,6 @@ static int newport_set_font(int unit, const struct console_font *op,
new_data += FONT_EXTRA_WORDS * sizeof(int);
FNTSIZE(new_data) = size;
- FNTCHARCNT(new_data) = op->charcount;
REFCOUNT(new_data) = 0; /* usage counter */
FNTSUM(new_data) = 0;
diff --git a/include/linux/font.h b/include/linux/font.h
index fd8625cd76b2..d929c5fa32ca 100644
--- a/include/linux/font.h
+++ b/include/linux/font.h
@@ -68,7 +68,6 @@ extern const struct font_desc *get_default_font(int xres, int yres,
/* Extra word getters */
#define REFCOUNT(fd) (((int *)(fd))[-1])
#define FNTSIZE(fd) (((int *)(fd))[-2])
-#define FNTCHARCNT(fd) (((int *)(fd))[-3])
#define FNTSUM(fd) (((int *)(fd))[-4])
#define FONT_EXTRA_WORDS 4
--
2.53.0
^ permalink raw reply related
* [PATCH v2 11/13] lib/fonts: Create font_data_t from struct console_font with font_data_import()
From: Thomas Zimmermann @ 2026-03-02 14:08 UTC (permalink / raw)
To: gregkh, deller, sam
Cc: linux-fbdev, dri-devel, linux-kernel, Thomas Zimmermann
In-Reply-To: <20260302141255.518657-1-tzimmermann@suse.de>
Add font_data_import() and update consoles to use it.
The implementation of font_data_import() is based on code from fbcon,
which supports overflow checks and crc32 checksums. Fbcon uses the crc32
checksum.
Newport_con now implements the same overflow checks as fbcon. As before,
this console does not support checksums, which are optional. Newport_con
can now also handle input font data with a vertical pitch other than 32
bytes. (The vertical pitch is the offset between two glyphs in the font
data.)
As an internal change, remove the const qualifier from the data field
if struct font_data. This allows font_data_import() to write the data
without type casting. For all users of the font data via font_data_t,
the stored data is still read only.
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
---
drivers/video/console/newport_con.c | 22 ++--------
drivers/video/fbdev/core/fbcon.c | 38 ++----------------
include/linux/font.h | 6 ++-
lib/fonts/fonts.c | 62 +++++++++++++++++++++++++++++
4 files changed, 75 insertions(+), 53 deletions(-)
diff --git a/drivers/video/console/newport_con.c b/drivers/video/console/newport_con.c
index 1bc3cb1ea116..ecbbe2e4e2a6 100644
--- a/drivers/video/console/newport_con.c
+++ b/drivers/video/console/newport_con.c
@@ -501,31 +501,17 @@ static int newport_set_font(int unit, const struct console_font *op,
{
int w = op->width;
int h = op->height;
- int size = h * op->charcount;
int i;
font_data_t *new_data;
- unsigned char *data = op->data, *p;
/* ladis: when I grow up, there will be a day... and more sizes will
* be supported ;-) */
- if ((w != 8) || (h != 16) || (vpitch != 32)
- || (op->charcount != 256 && op->charcount != 512))
+ if (w != 8 || h != 16 || (op->charcount != 256 && op->charcount != 512))
return -EINVAL;
- if (!(new_data = kmalloc(FONT_EXTRA_WORDS * sizeof(int) + size,
- GFP_USER))) return -ENOMEM;
-
- new_data += FONT_EXTRA_WORDS * sizeof(int);
- FNTSIZE(new_data) = size;
- REFCOUNT(new_data) = 1; /* usage counter */
- FNTSUM(new_data) = 0;
-
- p = (unsigned char *)font_data_buf(new_data);
- for (i = 0; i < op->charcount; i++) {
- memcpy(p, data, h);
- data += 32;
- p += h;
- }
+ new_data = font_data_import(op, vpitch, NULL);
+ if (IS_ERR(new_data))
+ return PTR_ERR(new_data);
/* check if font is already used by other console */
for (i = 0; i < MAX_NR_CONSOLES; i++) {
diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c
index 00255ac92e42..53677c09a0ec 100644
--- a/drivers/video/fbdev/core/fbcon.c
+++ b/drivers/video/fbdev/core/fbcon.c
@@ -2039,8 +2039,6 @@ static void updatescrollmode(struct fbcon_display *p,
updatescrollmode_accel(p, info, vc);
}
-#define PITCH(w) (((w) + 7) >> 3)
-
static int fbcon_resize(struct vc_data *vc, unsigned int width,
unsigned int height, bool from_user)
{
@@ -2424,7 +2422,6 @@ static int fbcon_do_set_font(struct vc_data *vc, int w, int h, int charcount,
resize = (w != vc->vc_font.width) || (h != vc->vc_font.height);
p->fontdata = data;
vc->vc_font.data = font_data_buf(p->fontdata);
-
old_width = vc->vc_font.width;
old_height = vc->vc_font.height;
old_charcount = vc->vc_font.charcount;
@@ -2482,11 +2479,8 @@ static int fbcon_set_font(struct vc_data *vc, const struct console_font *font,
unsigned charcount = font->charcount;
int w = font->width;
int h = font->height;
- int size, alloc_size;
- int i, csum, ret;
+ int i, ret;
font_data_t *new_data;
- const u8 *data = font->data;
- int pitch = PITCH(font->width);
/* Is there a reason why fbconsole couldn't handle any charcount >256?
* If not this check should be changed to charcount < 256 */
@@ -2510,34 +2504,10 @@ static int fbcon_set_font(struct vc_data *vc, const struct console_font *font,
if (fbcon_invalid_charcount(info, charcount))
return -EINVAL;
- /* Check for integer overflow in font size calculation */
- if (check_mul_overflow(h, pitch, &size) ||
- check_mul_overflow(size, charcount, &size))
- return -EINVAL;
-
- /* Check for overflow in allocation size calculation */
- if (check_add_overflow(FONT_EXTRA_WORDS * sizeof(int), size, &alloc_size))
- return -EINVAL;
-
- new_data = kmalloc(alloc_size, GFP_USER);
-
- if (!new_data)
- return -ENOMEM;
-
- memset((u8 *)new_data, 0, FONT_EXTRA_WORDS * sizeof(int));
-
- new_data += FONT_EXTRA_WORDS * sizeof(int);
- FNTSIZE(new_data) = size;
- REFCOUNT(new_data) = 1; /* usage counter */
- for (i=0; i< charcount; i++) {
- memcpy((u8 *)new_data + i * h * pitch, data + i * vpitch * pitch, h * pitch);
- }
-
- /* Since linux has a nice crc32 function use it for counting font
- * checksums. */
- csum = crc32(0, new_data, size);
+ new_data = font_data_import(font, vpitch, crc32);
+ if (IS_ERR(new_data))
+ return PTR_ERR(new_data);
- FNTSUM(new_data) = csum;
/* Check if the same font is on some other console already */
for (i = first_fb_vc; i <= last_fb_vc; i++) {
if (fb_display[i].fontdata &&
diff --git a/include/linux/font.h b/include/linux/font.h
index a8610201afb7..d3b8ca240152 100644
--- a/include/linux/font.h
+++ b/include/linux/font.h
@@ -13,6 +13,8 @@
#include <linux/types.h>
+struct console_font;
+
/*
* font_data_t and helpers
*/
@@ -54,6 +56,8 @@ static inline const unsigned char *font_data_buf(font_data_t *fd)
return (const unsigned char *)fd;
}
+font_data_t *font_data_import(const struct console_font *font, unsigned int vpitch,
+ u32 (*calc_csum)(u32, const void *, size_t));
void font_data_get(font_data_t *fd);
bool font_data_put(font_data_t *fd);
unsigned int font_data_size(font_data_t *fd);
@@ -124,7 +128,7 @@ extern const struct font_desc *get_default_font(int xres, int yres,
struct font_data {
unsigned int extra[FONT_EXTRA_WORDS];
- const unsigned char data[];
+ unsigned char data[];
} __packed;
#endif /* _VIDEO_FONT_H */
diff --git a/lib/fonts/fonts.c b/lib/fonts/fonts.c
index 1da0acdebf53..9b5355f6d2dc 100644
--- a/lib/fonts/fonts.c
+++ b/lib/fonts/fonts.c
@@ -14,7 +14,9 @@
#include <linux/container_of.h>
#include <linux/font.h>
+#include <linux/kd.h>
#include <linux/module.h>
+#include <linux/overflow.h>
#include <linux/slab.h>
#include <linux/string.h>
#include <linux/types.h>
@@ -24,6 +26,8 @@
#include <asm/setup.h>
#endif
+#define console_font_pitch(font) DIV_ROUND_UP((font)->width, 8)
+
/*
* Helpers for font_data_t
*/
@@ -46,6 +50,64 @@ static void font_data_free(font_data_t *fd)
kfree(to_font_data_struct(fd));
}
+/**
+ * font_data_import - Allocates and initializes font data from user space
+ * @font: A font from user space
+ * @vpitch: The size of a single glyph in @font in bytes
+ * @calc_csum: An optional helper to calculate a chechsum
+ *
+ * Font data from user space must be translated to the kernel's format. The
+ * font's glyph geometry and data is provided in @font. The parameter @vpitch
+ * gives the number of bytes per glyph, including trailing bytes.
+ *
+ * The parameter @calc_sum is optional. Fbcon passes crc32() to calculate the
+ * font data's checksum.
+ *
+ * Returns:
+ * Newly initialized font data on success, or a pointer-encoded errno value otherwise.
+ */
+font_data_t *font_data_import(const struct console_font *font, unsigned int vpitch,
+ u32 (*calc_csum)(u32, const void *, size_t))
+{
+ unsigned int pitch = console_font_pitch(font);
+ unsigned int h = font->height;
+ unsigned int charcount = font->charcount;
+ const unsigned char *data = font->data;
+ u32 csum = 0;
+ struct font_data *font_data;
+ int size, alloc_size;
+ unsigned int i;
+ font_data_t *fd;
+
+ /* Check for integer overflow in font-size calculation */
+ if (check_mul_overflow(h, pitch, &size) ||
+ check_mul_overflow(size, charcount, &size))
+ return ERR_PTR(-EINVAL);
+
+ /* Check for overflow in allocation size calculation */
+ if (check_add_overflow(sizeof(*font_data), size, &alloc_size))
+ return ERR_PTR(-EINVAL);
+
+ font_data = kmalloc(alloc_size, GFP_USER);
+ if (!font_data)
+ return ERR_PTR(-ENOMEM);
+ memset(font_data->extra, 0, sizeof(font_data->extra));
+
+ for (i = 0; i < charcount; ++i)
+ memcpy(font_data->data + i * h * pitch, data + i * vpitch * pitch, h * pitch);
+
+ if (calc_csum)
+ csum = calc_csum(0, font_data->data, size);
+
+ fd = font_data->data;
+ REFCOUNT(fd) = 1; /* start with reference acquired */
+ FNTSIZE(fd) = size;
+ FNTSUM(fd) = csum;
+
+ return fd;
+}
+EXPORT_SYMBOL_GPL(font_data_import);
+
/**
* font_data_get - Acquires a reference on font data
* @fd: Font data
--
2.53.0
^ permalink raw reply related
* [PATCH v2 04/13] vt: Calculate font-buffer size with vc_font_size()
From: Thomas Zimmermann @ 2026-03-02 14:08 UTC (permalink / raw)
To: gregkh, deller, sam
Cc: linux-fbdev, dri-devel, linux-kernel, Thomas Zimmermann
In-Reply-To: <20260302141255.518657-1-tzimmermann@suse.de>
In fbcon, fbcon_resize() computes the size of the font buffer from the
values stored in vc_font. Move these calculations to the dedicated helpers
vc_font_pitch() and vc_font_size().
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
---
drivers/video/fbdev/core/fbcon.c | 9 ++-------
include/linux/console_struct.h | 28 ++++++++++++++++++++++++++++
2 files changed, 30 insertions(+), 7 deletions(-)
diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c
index 247bb90c08d3..103e91c8d874 100644
--- a/drivers/video/fbdev/core/fbcon.c
+++ b/drivers/video/fbdev/core/fbcon.c
@@ -2037,7 +2037,6 @@ static void updatescrollmode(struct fbcon_display *p,
}
#define PITCH(w) (((w) + 7) >> 3)
-#define CALC_FONTSZ(h, p, c) ((h) * (p) * (c)) /* size = height * pitch * charcount */
static int fbcon_resize(struct vc_data *vc, unsigned int width,
unsigned int height, bool from_user)
@@ -2049,8 +2048,7 @@ static int fbcon_resize(struct vc_data *vc, unsigned int width,
int x_diff, y_diff, virt_w, virt_h, virt_fw, virt_fh;
if (p->userfont && FNTSIZE(vc->vc_font.data)) {
- int size;
- int pitch = PITCH(vc->vc_font.width);
+ unsigned int size = vc_font_size(&vc->vc_font);
/*
* If user font, ensure that a possible change to user font
@@ -2059,10 +2057,7 @@ static int fbcon_resize(struct vc_data *vc, unsigned int width,
* charcount can change and cannot be used to determine the
* font data allocated size.
*/
- if (pitch <= 0)
- return -EINVAL;
- size = CALC_FONTSZ(vc->vc_font.height, pitch, vc->vc_font.charcount);
- if (size > FNTSIZE(vc->vc_font.data))
+ if (!size || size > FNTSIZE(vc->vc_font.data))
return -EINVAL;
}
diff --git a/include/linux/console_struct.h b/include/linux/console_struct.h
index 7fdcae6ed49c..fbb5dd5f6761 100644
--- a/include/linux/console_struct.h
+++ b/include/linux/console_struct.h
@@ -83,6 +83,34 @@ struct vc_font {
const unsigned char *data;
};
+/**
+ * vc_font_pitch - Calculates the number of bytes between two adjacent scanlines
+ * @font: The VC font
+ *
+ * Returns:
+ * The number of bytes between two adjacent scanlines in the font data
+ */
+static inline unsigned int vc_font_pitch(const struct vc_font *font)
+{
+ return DIV_ROUND_UP(font->width, 8);
+}
+
+/**
+ * vc_font_size - Calculates the size of the font data in bytes
+ * @font: The VC font
+ *
+ * vc_font_size() calculates the number of bytes of font data in the
+ * font specified by @font. The function calculates the size from the
+ * font parameters.
+ *
+ * Returns:
+ * The size of the font data in bytes.
+ */
+static inline unsigned int vc_font_size(const struct vc_font *font)
+{
+ return font->height * vc_font_pitch(font) * font->charcount;
+}
+
/*
* Example: vc_data of a console that was scrolled 3 lines down.
*
--
2.53.0
^ permalink raw reply related
* [PATCH v2 09/13] lib/fonts: Compare font data for equality with font_data_is_equal()
From: Thomas Zimmermann @ 2026-03-02 14:08 UTC (permalink / raw)
To: gregkh, deller, sam
Cc: linux-fbdev, dri-devel, linux-kernel, Thomas Zimmermann
In-Reply-To: <20260302141255.518657-1-tzimmermann@suse.de>
Add font_data_is_equal() and update consoles to use it.
Font data is equal if it has the same size and contains the same values
on all bytes. Only fbcon uses a crc32 checksum. If set in both operands
the checksums have to be equal.
The new helper also guarantees to not compare internal fonts against
fonts from user space. Internal fonts cannot be ref-counted, so making
them equal to user-space fonts with the same byte sequence results in
undefined behavior.
The test only compares data buffers. Their interpretation is up each
console. Therefore remove a width test in fbcon_set_font().
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
---
drivers/video/console/newport_con.c | 3 +--
drivers/video/fbdev/core/fbcon.c | 7 +-----
include/linux/font.h | 1 +
lib/fonts/fonts.c | 37 +++++++++++++++++++++++++++--
4 files changed, 38 insertions(+), 10 deletions(-)
diff --git a/drivers/video/console/newport_con.c b/drivers/video/console/newport_con.c
index 1198c6bc2777..4db2b901c709 100644
--- a/drivers/video/console/newport_con.c
+++ b/drivers/video/console/newport_con.c
@@ -530,8 +530,7 @@ static int newport_set_font(int unit, const struct console_font *op,
/* check if font is already used by other console */
for (i = 0; i < MAX_NR_CONSOLES; i++) {
if (font_data[i] != FONT_DATA
- && font_data_size(font_data[i]) == size
- && !memcmp(font_data[i], new_data, size)) {
+ && font_data_is_equal(font_data[i], new_data)) {
kfree(new_data - FONT_EXTRA_WORDS * sizeof(int));
/* current font is the same as the new one */
if (i == unit)
diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c
index fa8f3e4196de..31e812d87d9e 100644
--- a/drivers/video/fbdev/core/fbcon.c
+++ b/drivers/video/fbdev/core/fbcon.c
@@ -2548,14 +2548,9 @@ static int fbcon_set_font(struct vc_data *vc, const struct console_font *font,
FNTSUM(new_data) = csum;
/* Check if the same font is on some other console already */
for (i = first_fb_vc; i <= last_fb_vc; i++) {
- struct vc_data *tmp = vc_cons[i].d;
-
if (fb_display[i].userfont &&
fb_display[i].fontdata &&
- FNTSUM(fb_display[i].fontdata) == csum &&
- font_data_size(fb_display[i].fontdata) == size &&
- tmp->vc_font.width == w &&
- !memcmp(fb_display[i].fontdata, new_data, size)) {
+ font_data_is_equal(fb_display[i].fontdata, new_data)) {
kfree(new_data - FONT_EXTRA_WORDS * sizeof(int));
new_data = (u8 *)fb_display[i].fontdata;
break;
diff --git a/include/linux/font.h b/include/linux/font.h
index 55cc016a9357..1f5b85601c9b 100644
--- a/include/linux/font.h
+++ b/include/linux/font.h
@@ -55,6 +55,7 @@ static inline const unsigned char *font_data_buf(font_data_t *fd)
}
unsigned int font_data_size(font_data_t *fd);
+bool font_data_is_equal(font_data_t *lhs, font_data_t *rhs);
/*
* Font description
diff --git a/lib/fonts/fonts.c b/lib/fonts/fonts.c
index 8c9a6762061c..c9f6328d5dda 100644
--- a/lib/fonts/fonts.c
+++ b/lib/fonts/fonts.c
@@ -12,18 +12,25 @@
* for more details.
*/
+#include <linux/font.h>
#include <linux/module.h>
-#include <linux/types.h>
#include <linux/string.h>
+#include <linux/types.h>
+
+#include <asm/sections.h>
#if defined(__mc68000__)
#include <asm/setup.h>
#endif
-#include <linux/font.h>
/*
* Helpers for font_data_t
*/
+static bool font_data_is_internal(font_data_t *fd)
+{
+ return is_kernel_rodata((unsigned long)fd);
+}
+
/**
* font_data_size - Return size of the font data in bytes
* @fd: Font data
@@ -37,6 +44,32 @@ unsigned int font_data_size(font_data_t *fd)
}
EXPORT_SYMBOL_GPL(font_data_size);
+/**
+ * font_data_is_equal - Compares font data for equality
+ * @lhs: Left-hand side font data
+ * @rhs: Right-hand-size font data
+ *
+ * Font data is equal if is constain the same sequence of values. The
+ * helper also use the checksum, if both arguments contain it. Font data
+ * coming from different origins, internal or from user space, is never
+ * equal. Allowing this would break reference counting.
+ *
+ * Returns:
+ * True if the given font data is equal, false otherwise.
+ */
+bool font_data_is_equal(font_data_t *lhs, font_data_t *rhs)
+{
+ if (font_data_is_internal(lhs) != font_data_is_internal(rhs))
+ return false;
+ if (font_data_size(lhs) != font_data_size(rhs))
+ return false;
+ if (FNTSUM(lhs) && FNTSUM(rhs) && FNTSUM(lhs) != FNTSUM(rhs))
+ return false;
+
+ return !memcmp(lhs, rhs, FNTSIZE(lhs));
+}
+EXPORT_SYMBOL_GPL(font_data_is_equal);
+
/*
* Font lookup
*/
--
2.53.0
^ permalink raw reply related
* [PATCH v2 03/13] vt: Store font in struct vc_font
From: Thomas Zimmermann @ 2026-03-02 14:08 UTC (permalink / raw)
To: gregkh, deller, sam
Cc: linux-fbdev, dri-devel, linux-kernel, Thomas Zimmermann
In-Reply-To: <20260302141255.518657-1-tzimmermann@suse.de>
Replace struct console_font with struct vc_font for the type of the
vc_font field of struct vc_data. Struct console_font is UAPI, which
prevents further changes. Hence a new data type is required.
Struct console_font has a documented vertical pitch of 32 bytes. This
is not the case after the font data has been loaded into the kernel.
Changing the type of vc_font addresses this inconsistency.
The font data is now declared as constant, as it might come from the
kernel's read-only section. There's some fallout throughout the console
code where non-const variables refer to it. Fix them. A later update
will declare the font data to a dedicated data type.
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
---
drivers/video/fbdev/core/bitblit.c | 11 +++++------
drivers/video/fbdev/core/fbcon.c | 4 ++--
drivers/video/fbdev/core/fbcon.h | 4 ++--
include/linux/console_struct.h | 29 +++++++++++++++++++++++++++--
4 files changed, 36 insertions(+), 12 deletions(-)
diff --git a/drivers/video/fbdev/core/bitblit.c b/drivers/video/fbdev/core/bitblit.c
index 085ffb44c51a..7478accea8ec 100644
--- a/drivers/video/fbdev/core/bitblit.c
+++ b/drivers/video/fbdev/core/bitblit.c
@@ -22,8 +22,7 @@
/*
* Accelerated handlers.
*/
-static void update_attr(u8 *dst, u8 *src, int attribute,
- struct vc_data *vc)
+static void update_attr(u8 *dst, const u8 *src, int attribute, struct vc_data *vc)
{
int i, offset = (vc->vc_font.height < 10) ? 1 : 2;
int width = DIV_ROUND_UP(vc->vc_font.width, 8);
@@ -81,7 +80,7 @@ static inline void bit_putcs_aligned(struct vc_data *vc, struct fb_info *info,
u16 charmask = vc->vc_hi_font_mask ? 0x1ff : 0xff;
unsigned int charcnt = vc->vc_font.charcount;
u32 idx = vc->vc_font.width >> 3;
- u8 *src;
+ const u8 *src;
while (cnt--) {
u16 ch = scr_readw(s++) & charmask;
@@ -120,7 +119,7 @@ static inline void bit_putcs_unaligned(struct vc_data *vc,
u32 shift_low = 0, mod = vc->vc_font.width % 8;
u32 shift_high = 8;
u32 idx = vc->vc_font.width >> 3;
- u8 *src;
+ const u8 *src;
while (cnt--) {
u16 ch = scr_readw(s++) & charmask;
@@ -267,7 +266,7 @@ static void bit_cursor(struct vc_data *vc, struct fb_info *info, bool enable,
int y = real_y(par->p, vc->state.y);
int attribute, use_sw = vc->vc_cursor_type & CUR_SW;
int err = 1;
- char *src;
+ const u8 *src;
cursor.set = 0;
@@ -278,7 +277,7 @@ static void bit_cursor(struct vc_data *vc, struct fb_info *info, bool enable,
attribute = get_attribute(info, c);
src = vc->vc_font.data + ((c & charmask) * (w * vc->vc_font.height));
- if (par->cursor_state.image.data != src ||
+ if (par->cursor_state.image.data != (const char *)src ||
par->cursor_reset) {
par->cursor_state.image.data = src;
cursor.set |= FB_CUR_SETIMAGE;
diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c
index 666261ae59d8..247bb90c08d3 100644
--- a/drivers/video/fbdev/core/fbcon.c
+++ b/drivers/video/fbdev/core/fbcon.c
@@ -2286,7 +2286,7 @@ static bool fbcon_blank(struct vc_data *vc, enum vesa_blank_mode blank,
static int fbcon_get_font(struct vc_data *vc, struct console_font *font, unsigned int vpitch)
{
- u8 *fontdata = vc->vc_font.data;
+ const u8 *fontdata = vc->vc_font.data;
u8 *data = font->data;
int i, j;
@@ -2417,7 +2417,7 @@ static int fbcon_do_set_font(struct vc_data *vc, int w, int h, int charcount,
struct fbcon_par *par = info->fbcon_par;
struct fbcon_display *p = &fb_display[vc->vc_num];
int resize, ret, old_userfont, old_width, old_height, old_charcount;
- u8 *old_data = vc->vc_font.data;
+ const u8 *old_data = vc->vc_font.data;
resize = (w != vc->vc_font.width) || (h != vc->vc_font.height);
vc->vc_font.data = (void *)(p->fontdata = data);
diff --git a/drivers/video/fbdev/core/fbcon.h b/drivers/video/fbdev/core/fbcon.h
index fca14e9b729b..3f4386a40237 100644
--- a/drivers/video/fbdev/core/fbcon.h
+++ b/drivers/video/fbdev/core/fbcon.h
@@ -82,8 +82,8 @@ struct fbcon_par {
int rotate;
int cur_rotate;
char *cursor_data;
- u8 *fontbuffer;
- u8 *fontdata;
+ u8 *fontbuffer;
+ const u8 *fontdata;
u8 *cursor_src;
u32 cursor_size;
u32 fd_size;
diff --git a/include/linux/console_struct.h b/include/linux/console_struct.h
index ebdb9750d348..7fdcae6ed49c 100644
--- a/include/linux/console_struct.h
+++ b/include/linux/console_struct.h
@@ -13,8 +13,9 @@
#ifndef _LINUX_CONSOLE_STRUCT_H
#define _LINUX_CONSOLE_STRUCT_H
-#include <linux/wait.h>
+#include <linux/math.h>
#include <linux/vt.h>
+#include <linux/wait.h>
#include <linux/workqueue.h>
struct uni_pagedict;
@@ -58,6 +59,30 @@ struct vc_state {
bool reverse;
};
+/**
+ * struct vc_font - Describes a font
+ * @width: The width of a single glyph in bits
+ * @height: The height of a single glyph in scanlines
+ * @charcount: The number of glyphs in the font
+ * @data: The raw font data
+ *
+ * Font data is organized as an array of glyphs. Each glyph is a bitmap with
+ * set bits indicating the foreground color. Unset bits indicate background
+ * color. The fields @width and @height store a single glyph's number of
+ * horizontal bits and vertical scanlines. If width is not a multiple of 8,
+ * there are trailing bits to fill up the byte. These bits should not be drawn.
+ *
+ * The field @data points to the first glphy's first byte. The value @charcount
+ * gives the number of glyphs in the font. There are no empty scanlines between
+ * two adjacent glyphs.
+ */
+struct vc_font {
+ unsigned int width;
+ unsigned int height;
+ unsigned int charcount;
+ const unsigned char *data;
+};
+
/*
* Example: vc_data of a console that was scrolled 3 lines down.
*
@@ -122,7 +147,7 @@ struct vc_data {
unsigned long vc_pos; /* Cursor address */
/* fonts */
unsigned short vc_hi_font_mask; /* [#] Attribute set for upper 256 chars of font or 0 if not supported */
- struct console_font vc_font; /* Current VC font set */
+ struct vc_font vc_font; /* Current VC font set */
unsigned short vc_video_erase_char; /* Background erase character */
/* VT terminal data */
unsigned int vc_state; /* Escape sequence parser state */
--
2.53.0
^ permalink raw reply related
* [PATCH v2 08/13] lib/fonts: Read font size with font_data_size()
From: Thomas Zimmermann @ 2026-03-02 14:08 UTC (permalink / raw)
To: gregkh, deller, sam
Cc: linux-fbdev, dri-devel, linux-kernel, Thomas Zimmermann
In-Reply-To: <20260302141255.518657-1-tzimmermann@suse.de>
Add font_data_size() and update consoles to use it.
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
---
drivers/video/console/newport_con.c | 2 +-
drivers/video/fbdev/core/fbcon.c | 14 +++++++-------
include/linux/font.h | 2 ++
lib/fonts/fonts.c | 21 +++++++++++++++++++++
4 files changed, 31 insertions(+), 8 deletions(-)
diff --git a/drivers/video/console/newport_con.c b/drivers/video/console/newport_con.c
index 9b9ed1940404..1198c6bc2777 100644
--- a/drivers/video/console/newport_con.c
+++ b/drivers/video/console/newport_con.c
@@ -530,7 +530,7 @@ static int newport_set_font(int unit, const struct console_font *op,
/* check if font is already used by other console */
for (i = 0; i < MAX_NR_CONSOLES; i++) {
if (font_data[i] != FONT_DATA
- && FNTSIZE(font_data[i]) == size
+ && font_data_size(font_data[i]) == size
&& !memcmp(font_data[i], new_data, size)) {
kfree(new_data - FONT_EXTRA_WORDS * sizeof(int));
/* current font is the same as the new one */
diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c
index 8d7840b9ebad..fa8f3e4196de 100644
--- a/drivers/video/fbdev/core/fbcon.c
+++ b/drivers/video/fbdev/core/fbcon.c
@@ -2053,7 +2053,7 @@ static int fbcon_resize(struct vc_data *vc, unsigned int width,
struct fb_var_screeninfo var = info->var;
int x_diff, y_diff, virt_w, virt_h, virt_fw, virt_fh;
- if (p->userfont && FNTSIZE(p->fontdata)) {
+ if (p->userfont && font_data_size(p->fontdata)) {
unsigned int size = vc_font_size(&vc->vc_font);
/*
@@ -2063,7 +2063,7 @@ static int fbcon_resize(struct vc_data *vc, unsigned int width,
* charcount can change and cannot be used to determine the
* font data allocated size.
*/
- if (!size || size > FNTSIZE(p->fontdata))
+ if (!size || size > font_data_size(p->fontdata))
return -EINVAL;
}
@@ -2302,7 +2302,7 @@ static int fbcon_get_font(struct vc_data *vc, struct console_font *font, unsigne
if (font->width <= 8) {
j = vc->vc_font.height;
- if (font->charcount * j > FNTSIZE(fontdata))
+ if (font->charcount * j > font_data_size(fontdata))
return -EINVAL;
for (i = 0; i < font->charcount; i++) {
@@ -2313,7 +2313,7 @@ static int fbcon_get_font(struct vc_data *vc, struct console_font *font, unsigne
}
} else if (font->width <= 16) {
j = vc->vc_font.height * 2;
- if (font->charcount * j > FNTSIZE(fontdata))
+ if (font->charcount * j > font_data_size(fontdata))
return -EINVAL;
for (i = 0; i < font->charcount; i++) {
@@ -2323,7 +2323,7 @@ static int fbcon_get_font(struct vc_data *vc, struct console_font *font, unsigne
fontdata += j;
}
} else if (font->width <= 24) {
- if (font->charcount * (vc->vc_font.height * sizeof(u32)) > FNTSIZE(fontdata))
+ if (font->charcount * (vc->vc_font.height * sizeof(u32)) > font_data_size(fontdata))
return -EINVAL;
for (i = 0; i < font->charcount; i++) {
@@ -2338,7 +2338,7 @@ static int fbcon_get_font(struct vc_data *vc, struct console_font *font, unsigne
}
} else {
j = vc->vc_font.height * 4;
- if (font->charcount * j > FNTSIZE(fontdata))
+ if (font->charcount * j > font_data_size(fontdata))
return -EINVAL;
for (i = 0; i < font->charcount; i++) {
@@ -2553,7 +2553,7 @@ static int fbcon_set_font(struct vc_data *vc, const struct console_font *font,
if (fb_display[i].userfont &&
fb_display[i].fontdata &&
FNTSUM(fb_display[i].fontdata) == csum &&
- FNTSIZE(fb_display[i].fontdata) == size &&
+ font_data_size(fb_display[i].fontdata) == size &&
tmp->vc_font.width == w &&
!memcmp(fb_display[i].fontdata, new_data, size)) {
kfree(new_data - FONT_EXTRA_WORDS * sizeof(int));
diff --git a/include/linux/font.h b/include/linux/font.h
index f19abd112c18..55cc016a9357 100644
--- a/include/linux/font.h
+++ b/include/linux/font.h
@@ -54,6 +54,8 @@ static inline const unsigned char *font_data_buf(font_data_t *fd)
return (const unsigned char *)fd;
}
+unsigned int font_data_size(font_data_t *fd);
+
/*
* Font description
*/
diff --git a/lib/fonts/fonts.c b/lib/fonts/fonts.c
index a7f118b30171..8c9a6762061c 100644
--- a/lib/fonts/fonts.c
+++ b/lib/fonts/fonts.c
@@ -20,6 +20,27 @@
#endif
#include <linux/font.h>
+/*
+ * Helpers for font_data_t
+ */
+
+/**
+ * font_data_size - Return size of the font data in bytes
+ * @fd: Font data
+ *
+ * Returns:
+ * The number of bytes in the given font data.
+ */
+unsigned int font_data_size(font_data_t *fd)
+{
+ return FNTSIZE(fd);
+}
+EXPORT_SYMBOL_GPL(font_data_size);
+
+/*
+ * Font lookup
+ */
+
static const struct font_desc *fonts[] = {
#ifdef CONFIG_FONT_8x8
&font_vga_8x8,
--
2.53.0
^ permalink raw reply related
* [PATCH v2 01/13] fbdev: Declare src parameter of fb_pad_ helpers as constant
From: Thomas Zimmermann @ 2026-03-02 14:08 UTC (permalink / raw)
To: gregkh, deller, sam
Cc: linux-fbdev, dri-devel, linux-kernel, Thomas Zimmermann
In-Reply-To: <20260302141255.518657-1-tzimmermann@suse.de>
Fbdev's padding helpers do not modify the source buffer. Declare the
parameter as 'const'.
Fbcon's font-rendering code calls these helpers with the font data.
Declaring src as const will allow for making the font data constant
as well.
While at it, also remove the extern qualifier from the function
declarations in the header file.
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
---
drivers/video/fbdev/core/fbmem.c | 6 +++---
include/linux/fb.h | 10 +++++-----
2 files changed, 8 insertions(+), 8 deletions(-)
diff --git a/drivers/video/fbdev/core/fbmem.c b/drivers/video/fbdev/core/fbmem.c
index cf199038f069..30f2b59c47bf 100644
--- a/drivers/video/fbdev/core/fbmem.c
+++ b/drivers/video/fbdev/core/fbmem.c
@@ -91,14 +91,14 @@ EXPORT_SYMBOL(fb_get_color_depth);
/*
* Data padding functions.
*/
-void fb_pad_aligned_buffer(u8 *dst, u32 d_pitch, u8 *src, u32 s_pitch, u32 height)
+void fb_pad_aligned_buffer(u8 *dst, u32 d_pitch, const u8 *src, u32 s_pitch, u32 height)
{
__fb_pad_aligned_buffer(dst, d_pitch, src, s_pitch, height);
}
EXPORT_SYMBOL(fb_pad_aligned_buffer);
-void fb_pad_unaligned_buffer(u8 *dst, u32 d_pitch, u8 *src, u32 idx, u32 height,
- u32 shift_high, u32 shift_low, u32 mod)
+void fb_pad_unaligned_buffer(u8 *dst, u32 d_pitch, const u8 *src, u32 idx, u32 height,
+ u32 shift_high, u32 shift_low, u32 mod)
{
u8 mask = (u8) (0xff << shift_high), tmp;
int i, j;
diff --git a/include/linux/fb.h b/include/linux/fb.h
index 6d4a58084fd5..324b0fd5f617 100644
--- a/include/linux/fb.h
+++ b/include/linux/fb.h
@@ -605,9 +605,9 @@ extern int register_framebuffer(struct fb_info *fb_info);
extern void unregister_framebuffer(struct fb_info *fb_info);
extern int devm_register_framebuffer(struct device *dev, struct fb_info *fb_info);
extern char* fb_get_buffer_offset(struct fb_info *info, struct fb_pixmap *buf, u32 size);
-extern void fb_pad_unaligned_buffer(u8 *dst, u32 d_pitch, u8 *src, u32 idx,
- u32 height, u32 shift_high, u32 shift_low, u32 mod);
-extern void fb_pad_aligned_buffer(u8 *dst, u32 d_pitch, u8 *src, u32 s_pitch, u32 height);
+void fb_pad_unaligned_buffer(u8 *dst, u32 d_pitch, const u8 *src, u32 idx, u32 height,
+ u32 shift_high, u32 shift_low, u32 mod);
+void fb_pad_aligned_buffer(u8 *dst, u32 d_pitch, const u8 *src, u32 s_pitch, u32 height);
extern void fb_set_suspend(struct fb_info *info, int state);
extern int fb_get_color_depth(struct fb_var_screeninfo *var,
struct fb_fix_screeninfo *fix);
@@ -633,8 +633,8 @@ static inline struct device *dev_of_fbinfo(const struct fb_info *info)
#endif
}
-static inline void __fb_pad_aligned_buffer(u8 *dst, u32 d_pitch,
- u8 *src, u32 s_pitch, u32 height)
+static inline void __fb_pad_aligned_buffer(u8 *dst, u32 d_pitch, const u8 *src, u32 s_pitch,
+ u32 height)
{
u32 i, j;
--
2.53.0
^ permalink raw reply related
* [PATCH v2 05/13] lib/fonts: Remove trailing whitespaces
From: Thomas Zimmermann @ 2026-03-02 14:08 UTC (permalink / raw)
To: gregkh, deller, sam
Cc: linux-fbdev, dri-devel, linux-kernel, Thomas Zimmermann
In-Reply-To: <20260302141255.518657-1-tzimmermann@suse.de>
Fix coding style. No functional changes.
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
---
lib/fonts/font_acorn_8x8.c | 2 +-
lib/fonts/font_mini_4x6.c | 8 ++++----
2 files changed, 5 insertions(+), 5 deletions(-)
diff --git a/lib/fonts/font_acorn_8x8.c b/lib/fonts/font_acorn_8x8.c
index 18755c33d249..af5fa72aa8b7 100644
--- a/lib/fonts/font_acorn_8x8.c
+++ b/lib/fonts/font_acorn_8x8.c
@@ -68,7 +68,7 @@ static const struct font_data acorndata_8x8 = {
/* 3A */ 0x00, 0x00, 0x18, 0x18, 0x00, 0x18, 0x18, 0x00, /* : */
/* 3B */ 0x00, 0x00, 0x18, 0x18, 0x00, 0x18, 0x18, 0x30, /* ; */
/* 3C */ 0x0C, 0x18, 0x30, 0x60, 0x30, 0x18, 0x0C, 0x00, /* < */
-/* 3D */ 0x00, 0x00, 0x7E, 0x00, 0x7E, 0x00, 0x00, 0x00, /* = */
+/* 3D */ 0x00, 0x00, 0x7E, 0x00, 0x7E, 0x00, 0x00, 0x00, /* = */
/* 3E */ 0x30, 0x18, 0x0C, 0x06, 0x0C, 0x18, 0x30, 0x00, /* > */
/* 3F */ 0x3C, 0x66, 0x0C, 0x18, 0x18, 0x00, 0x18, 0x00, /* ? */
/* 40 */ 0x3C, 0x66, 0x6E, 0x6A, 0x6E, 0x60, 0x3C, 0x00, /* @ */
diff --git a/lib/fonts/font_mini_4x6.c b/lib/fonts/font_mini_4x6.c
index 8d39fd447952..cc21dc70cfd1 100644
--- a/lib/fonts/font_mini_4x6.c
+++ b/lib/fonts/font_mini_4x6.c
@@ -18,15 +18,15 @@
s{((0x)?[0-9a-fA-F]+)(.*\[([\*\ ]{4})\])}{
($num,$pat,$bits) = ($1,$3,$4);
-
+
$bits =~ s/([^\s0])|(.)/ defined($1) + 0 /ge;
-
+
$num = ord(pack("B8", $bits));
$num |= $num >> 4;
$num = sprintf("0x%.2x", $num);
-
+
#print "$num,$pat,$bits\n";
-
+
$num . $pat;
}ge;
--
2.53.0
^ permalink raw reply related
* [PATCH v2 02/13] vt: Remove trailing whitespaces
From: Thomas Zimmermann @ 2026-03-02 14:08 UTC (permalink / raw)
To: gregkh, deller, sam
Cc: linux-fbdev, dri-devel, linux-kernel, Thomas Zimmermann
In-Reply-To: <20260302141255.518657-1-tzimmermann@suse.de>
Fix coding style. No functional changes.
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
---
include/linux/console_struct.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/include/linux/console_struct.h b/include/linux/console_struct.h
index 13b35637bd5a..ebdb9750d348 100644
--- a/include/linux/console_struct.h
+++ b/include/linux/console_struct.h
@@ -120,7 +120,7 @@ struct vc_data {
unsigned short vc_complement_mask; /* [#] Xor mask for mouse pointer */
unsigned short vc_s_complement_mask; /* Saved mouse pointer mask */
unsigned long vc_pos; /* Cursor address */
- /* fonts */
+ /* fonts */
unsigned short vc_hi_font_mask; /* [#] Attribute set for upper 256 chars of font or 0 if not supported */
struct console_font vc_font; /* Current VC font set */
unsigned short vc_video_erase_char; /* Background erase character */
--
2.53.0
^ permalink raw reply related
* [PATCH v2 00/13] vc,fbcon,fonts: Proper handling of font data
From: Thomas Zimmermann @ 2026-03-02 14:08 UTC (permalink / raw)
To: gregkh, deller, sam
Cc: linux-fbdev, dri-devel, linux-kernel, Thomas Zimmermann
Provide helpers for handling console font data. Update consoles and VT.
VT's vc_state stores font data as a plain byte array of glphys. Fbcon,
newport_con and the kernel's internal fonts store the glyph data as an
array of plain bytes plus a hidden header for reference counting, check
sums and buffer sizes. The reference counting only works for user-space
fonts but not for internal fonts. Font-data handling is duplicated in
several places. Most of the font handling is open-coded and mixed up with
VT's plain glyph arrays.
To address these issues, add proper handling of font data to all involved
components: struct vc_font for font state in VC; a font data type for the
consoles. Then implement interfaces for handling font data one by one.
Patch 1 prepares the fbdev interface.
Patches 2 to 4 prepare VT's font handling.
Patches 5 to 13 refactor fbcon and newport_con to use clean interfaces for
their fonts.
Fbcon has long been a source of problems and bug reports. [1] With its
confusing implementation, it is hard to find the cause of these bugs.
Cleaning up the fbcon code will hopefully help with resolving bug reports
in the future.
The series has been tested with fbcon under DRM's bochs driver by changing
fonts at runtime using the setfont utility. [2] The changes to newport_con
have only been tested to compile.
v2:
- keep declaring the internal fonts in the public header file (Helge)
- rebase and clean up
[1] https://lore.kernel.org/all/6992c84c.a70a0220.2c38d7.00e8.GAE@google.com/
[2] https://www.man7.org/linux/man-pages/man8/setfont.8.html
Thomas Zimmermann (13):
fbdev: Declare src parameter of fb_pad_ helpers as constant
vt: Remove trailing whitespaces
vt: Store font in struct vc_font
vt: Calculate font-buffer size with vc_font_size()
lib/fonts: Remove trailing whitespaces
lib/fonts: Remove FNTCHARCNT()
lib/fonts: Store font data as font_data_t; update consoles
lib/fonts: Read font size with font_data_size()
lib/fonts: Compare font data for equality with font_data_is_equal()
lib/fonts: Manage font-data lifetime with font_data_get/_put()
lib/fonts: Create font_data_t from struct console_font with
font_data_import()
lib/fonts: Store font data for user space with font_data_export()
lib/fonts: Remove internal symbols and macros from public header file
drivers/video/console/newport_con.c | 61 +++----
drivers/video/fbdev/core/bitblit.c | 11 +-
drivers/video/fbdev/core/fbcon.c | 194 +++++++----------------
drivers/video/fbdev/core/fbcon.h | 8 +-
drivers/video/fbdev/core/fbmem.c | 6 +-
include/linux/console_struct.h | 59 ++++++-
include/linux/fb.h | 10 +-
include/linux/font.h | 115 +++++++++-----
lib/fonts/font.h | 38 +++++
lib/fonts/font_10x18.c | 2 +-
lib/fonts/font_6x10.c | 3 +-
lib/fonts/font_6x11.c | 2 +-
lib/fonts/font_6x8.c | 3 +-
lib/fonts/font_7x14.c | 2 +-
lib/fonts/font_8x16.c | 3 +-
lib/fonts/font_8x8.c | 2 +-
lib/fonts/font_acorn_8x8.c | 4 +-
lib/fonts/font_mini_4x6.c | 10 +-
lib/fonts/font_pearl_8x8.c | 2 +-
lib/fonts/font_sun12x22.c | 3 +-
lib/fonts/font_sun8x16.c | 3 +-
lib/fonts/font_ter10x18.c | 4 +-
lib/fonts/font_ter16x32.c | 4 +-
lib/fonts/fonts.c | 236 +++++++++++++++++++++++++++-
24 files changed, 518 insertions(+), 267 deletions(-)
create mode 100644 lib/fonts/font.h
base-commit: e57ac53f3ef90826a0b5b7cdf7f1e742a2aa1e9b
--
2.53.0
^ permalink raw reply
* Re: [PATCH 13/13] lib/fonts: Remove internal symbols and macros from public header file
From: Thomas Zimmermann @ 2026-03-02 13:45 UTC (permalink / raw)
To: Helge Deller, gregkh, sam; +Cc: linux-fbdev, dri-devel, linux-kernel
In-Reply-To: <d8633caa-c01c-433c-8dd3-f300dac53a0b@gmx.de>
Am 23.02.26 um 16:05 schrieb Helge Deller:
> On 2/18/26 09:16, Thomas Zimmermann wrote:
>> diff --git a/include/linux/font.h b/include/linux/font.h
>> index 4ff956a1cd0a..6e9a4c93b47b 100644
>> --- a/include/linux/font.h
>> +++ b/include/linux/font.h
>> @@ -92,20 +92,12 @@ struct font_desc {
>> #define FONT6x8_IDX 12
>> #define TER10x18_IDX 13
>> -extern const struct font_desc font_vga_8x8,
>> - font_vga_8x16,
>> - font_pearl_8x8,
>> - font_vga_6x11,
>> - font_7x14,
>> - font_10x18,
>> - font_sun_8x16,
>> - font_sun_12x22,
>> - font_acorn_8x8,
>> - font_mini_4x6,
>> - font_6x10,
>> - font_ter_16x32,
>> - font_6x8,
>> - font_ter_10x18;
>> +#if defined(CONFIG_FONT_8x8)
>> +extern const struct font_desc font_vga_8x8;
>> +#endif
>> +#if defined(CONFIG_FONT_8x16)
>> +extern const struct font_desc font_vga_8x16;
>> +#endif
>
> I suggest not to use all those #ifdef(CONFIG_XXX) in the header files.
> They are not necessary, and trigger a rebuild of a whole lot C-files
> in case one single CONFIG option is changed.
> Instead use it in the C-files only.
> That way (re-)compilation is faster and you still get a link/build error
> when a symbol is used although the config option is not set.
Ok. I'll send out an update in a bit.
>
>> diff --git a/lib/fonts/font.h b/lib/fonts/font.h
>> new file mode 100644
>> index 000000000000..00f65a3da5c2
>> --- /dev/null
>> +++ b/lib/fonts/font.h
>> @@ -0,0 +1,52 @@
>> +/* SPDX-License-Identifier: GPL-2.0 */
>> +
>> +#ifndef _LIB_FONTS_FONT_H
>> +#define _LIB_FONTS_FONT_H
>> +
>> +#include <linux/font.h>
>> +
>> +#if defined(CONFIG_FONT_PEARL_8x8)
>> +extern const struct font_desc font_pearl_8x8;
>> +#endif
>> +#if defined(CONFIG_FONT_6x11)
>> +extern const struct font_desc font_vga_6x11;
>> +#endif
> ...
> same here...
>
> Helge
>
--
--
Thomas Zimmermann
Graphics Driver Developer
SUSE Software Solutions Germany GmbH
Frankenstr. 146, 90461 Nürnberg, Germany, www.suse.com
GF: Jochen Jaser, Andrew McDonald, Werner Knoblich, (HRB 36809, AG Nürnberg)
^ permalink raw reply
* Re: [PATCH v8 06/25] gpu: nova-core: mm: Add support to use PRAMIN windows to write to VRAM
From: Alexandre Courbot @ 2026-03-02 12:23 UTC (permalink / raw)
To: Joel Fernandes, Zhi Wang, Danilo Krummrich, Gary Guo
Cc: linux-kernel, Miguel Ojeda, Boqun Feng, Gary Guo,
Björn Roy Baron, Benno Lossin, Andreas Hindborg, Alice Ryhl,
Trevor Gross, Danilo Krummrich, Dave Airlie, Daniel Almeida,
Koen Koning, dri-devel, nouveau, rust-for-linux, Nikola Djukic,
Maarten Lankhorst, Maxime Ripard, Simona Vetter, Jonathan Corbet,
Alex Deucher, Christian König, Jani Nikula, Joonas Lahtinen,
Rodrigo Vivi, Tvrtko Ursulin, Huang Rui, Matthew Auld,
Matthew Brost, Lucas De Marchi, Thomas Hellström,
Helge Deller, Alex Gaynor, Boqun Feng, Alistair Popple,
Andrea Righi, Zhi Wang, Philipp Stanner, Elle Rhumsaa, alexeyi,
Eliot Courtney, joel, linux-doc, amd-gfx, intel-gfx, intel-xe,
linux-fbdev
In-Reply-To: <20260224225323.3312204-7-joelagnelf@nvidia.com>
On Wed Feb 25, 2026 at 7:53 AM JST, Joel Fernandes wrote:
> PRAMIN apertures are a crucial mechanism to direct read/write to VRAM.
> Add support for the same.
A few design thoughts that are not immediately actionable, but might
become this cycle if we get a tag with the new `Io` work.
Basically this feature is a prime candidate for an `Io` implementation.
It maps onto the BAR, has a fixed 1MB size, and needs to be accessed
using various sizes. It is also used to fill structured values, which
the I/O projection work will also allow us to do.
The current design doesn't allow the user to explicitly set the start of
the sliding window - this results in a sub-optimal usage of the hardware
and more complex code in this module. At this level, we just want
something that exposes the hardware as it is, i.e. "give me a view of
the 1MB of VRAM starting from this 64K-aligned address".
Then on top of that we can implement another type that handles the
window automatically if we want, but I don't think we will actually need
it. The page table code will most likely want to set the window to the
start of its structure, project it, and access it using compile-time
checked offsets.
If that turns out to be insufficient, we can always compose something
more complex from this basic piece - but the base `Pramin` should stay
simple and truthful to the underlying hardware IMHO.
^ permalink raw reply
* Re: [PATCH v8 25/25] gpu: nova-core: mm: Add PRAMIN aperture self-tests
From: Alexandre Courbot @ 2026-03-02 12:04 UTC (permalink / raw)
To: Joel Fernandes
Cc: linux-kernel, Miguel Ojeda, Boqun Feng, Gary Guo,
Björn Roy Baron, Benno Lossin, Andreas Hindborg, Alice Ryhl,
Trevor Gross, Danilo Krummrich, Dave Airlie, Daniel Almeida,
Koen Koning, dri-devel, nouveau, rust-for-linux, Nikola Djukic,
Maarten Lankhorst, Maxime Ripard, Simona Vetter, Jonathan Corbet,
Alex Deucher, Christian König, Jani Nikula, Joonas Lahtinen,
Rodrigo Vivi, Tvrtko Ursulin, Huang Rui, Matthew Auld,
Matthew Brost, Lucas De Marchi, Thomas Hellström,
Helge Deller, Alex Gaynor, Boqun Feng, Alistair Popple,
Andrea Righi, Zhi Wang, Philipp Stanner, Elle Rhumsaa, alexeyi,
Eliot Courtney, joel, linux-doc, amd-gfx, intel-gfx, intel-xe,
linux-fbdev
In-Reply-To: <20260224225323.3312204-26-joelagnelf@nvidia.com>
On Wed Feb 25, 2026 at 7:53 AM JST, Joel Fernandes wrote:
<snip>
> diff --git a/drivers/gpu/nova-core/mm/pramin.rs b/drivers/gpu/nova-core/mm/pramin.rs
> index 04b652d3ee4f..30b1dba0c305 100644
> --- a/drivers/gpu/nova-core/mm/pramin.rs
> +++ b/drivers/gpu/nova-core/mm/pramin.rs
> @@ -290,3 +290,164 @@ fn drop(&mut self) {
> // MutexGuard drops automatically, releasing the lock.
> }
> }
> +
> +/// Run PRAMIN self-tests during boot if self-tests are enabled.
> +#[cfg(CONFIG_NOVA_MM_SELFTESTS)]
> +pub(crate) fn run_self_test(
> + dev: &kernel::device::Device,
> + bar: Arc<Devres<Bar0>>,
> + mmu_version: super::pagetable::MmuVersion,
> +) -> Result {
> + use super::pagetable::MmuVersion;
> +
> + // PRAMIN support is only for MMU v2 for now (Turing/Ampere/Ada).
> + if mmu_version != MmuVersion::V2 {
Why is that? I thought PRAMIN was also working on Hopper+. Isn't it
orthogonal to the kind of MMU used?
> + dev_info!(
> + dev,
> + "PRAMIN: Skipping self-tests for MMU {:?} (only V2 supported)\n",
> + mmu_version
> + );
> + return Ok(());
> + }
> +
> + dev_info!(dev, "PRAMIN: Starting self-test...\n");
> +
> + let pramin = Arc::pin_init(Pramin::new(bar)?, GFP_KERNEL)?;
> + let mut win = pramin.window()?;
> +
> + // Use offset 0x1000 as test area.
> + let base: usize = 0x1000;
> +
> + // Test 1: Read/write at byte-aligned locations.
Let's split each test into its own function for readability.
^ permalink raw reply
* Re: [PATCH v8 07/25] docs: gpu: nova-core: Document the PRAMIN aperture mechanism
From: Alexandre Courbot @ 2026-03-02 12:02 UTC (permalink / raw)
To: Joel Fernandes
Cc: linux-kernel, Miguel Ojeda, Boqun Feng, Gary Guo,
Björn Roy Baron, Benno Lossin, Andreas Hindborg, Alice Ryhl,
Trevor Gross, Danilo Krummrich, Dave Airlie, Daniel Almeida,
Koen Koning, dri-devel, nouveau, rust-for-linux, Nikola Djukic,
Maarten Lankhorst, Maxime Ripard, Simona Vetter, Jonathan Corbet,
Alex Deucher, Christian König, Jani Nikula, Joonas Lahtinen,
Rodrigo Vivi, Tvrtko Ursulin, Huang Rui, Matthew Auld,
Matthew Brost, Lucas De Marchi, Thomas Hellström,
Helge Deller, Alex Gaynor, Boqun Feng, Alistair Popple,
Andrea Righi, Zhi Wang, Philipp Stanner, Elle Rhumsaa, alexeyi,
Eliot Courtney, joel, linux-doc, amd-gfx, intel-gfx, intel-xe,
linux-fbdev
In-Reply-To: <20260224225323.3312204-8-joelagnelf@nvidia.com>
On Wed Feb 25, 2026 at 7:53 AM JST, Joel Fernandes wrote:
> Add documentation for the PRAMIN aperture mechanism used by nova-core
> for direct VRAM access.
>
> Nova only uses TARGET=VID_MEM for VRAM access. The SYS_MEM target values
> are documented for completeness but not used by the driver.
>
> Cc: Nikola Djukic <ndjukic@nvidia.com>
> Signed-off-by: Joel Fernandes <joelagnelf@nvidia.com>
> ---
> Documentation/gpu/nova/core/pramin.rst | 125 +++++++++++++++++++++++++
> Documentation/gpu/nova/index.rst | 1 +
> 2 files changed, 126 insertions(+)
> create mode 100644 Documentation/gpu/nova/core/pramin.rst
>
> diff --git a/Documentation/gpu/nova/core/pramin.rst b/Documentation/gpu/nova/core/pramin.rst
> new file mode 100644
> index 000000000000..55ec9d920629
> --- /dev/null
> +++ b/Documentation/gpu/nova/core/pramin.rst
> @@ -0,0 +1,125 @@
> +.. SPDX-License-Identifier: GPL-2.0
> +
> +=========================
> +PRAMIN aperture mechanism
> +=========================
> +
> +.. note::
> + The following description is approximate and current as of the Ampere family.
> + It may change for future generations and is intended to assist in understanding
> + the driver code.
> +
> +Introduction
> +============
> +
> +PRAMIN is a hardware aperture mechanism that provides CPU access to GPU Video RAM (VRAM) before
> +the GPU's Memory Management Unit (MMU) and page tables are initialized. This 1MB sliding window,
> +located at a fixed offset within BAR0, is essential for setting up page tables and other critical
> +GPU data structures without relying on the GPU's MMU.
> +
> +Architecture Overview
> +=====================
> +
> +The PRAMIN aperture mechanism is logically implemented by the GPU's PBUS (PCIe Bus Controller Unit)
> +and provides a CPU-accessible window into VRAM through the PCIe interface::
> +
> + +-----------------+ PCIe +------------------------------+
> + | CPU |<----------->| GPU |
> + +-----------------+ | |
> + | +----------------------+ |
> + | | PBUS | |
> + | | (Bus Controller) | |
> + | | | |
> + | | +--------------+<------------ (window starts at
> + | | | PRAMIN | | | BAR0 + 0x700000)
> + | | | Window | | |
> + | | | (1MB) | | |
> + | | +--------------+ | |
> + | | | | |
> + | +---------|------------+ |
> + | | |
> + | v |
> + | +----------------------+<------------ (Program PRAMIN to any
> + | | VRAM | | 64KB-aligned VRAM boundary)
> + | | (Several GBs) | |
> + | | | |
> + | | FB[0x000000000000] | |
> + | | ... | |
> + | | FB[0x7FFFFFFFFFF] | |
> + | +----------------------+ |
> + +------------------------------+
> +
> +PBUS (PCIe Bus Controller) is responsible for, among other things, handling MMIO
> +accesses to the BAR registers.
> +
> +PRAMIN Window Operation
> +=======================
> +
> +The PRAMIN window provides a 1MB sliding aperture that can be repositioned over
> +the entire VRAM address space using the ``NV_PBUS_BAR0_WINDOW`` register.
> +
> +Window Control Mechanism
> +-------------------------
> +
> +The window position is controlled via the PBUS ``BAR0_WINDOW`` register::
This repeats the sentence of `PRAMIN Window Operation`. Let's remove
that sentence.
> +
> + NV_PBUS_BAR0_WINDOW Register (0x1700):
> + +-------+--------+--------------------------------------+
> + | 31:26 | 25:24 | 23:0 |
> + | RSVD | TARGET | BASE_ADDR |
> + | | | (bits 39:16 of VRAM address) |
> + +-------+--------+--------------------------------------+
> +
> + BASE_ADDR field (bits 23:0):
> + - Contains bits [39:16] of the target VRAM address
> + - Provides 40-bit (1TB) address space coverage
> + - Must be programmed with 64KB-aligned addresses
This reads a bit like filler - let's turn this into a single sentence,
of just keep the first point - the other two are deducible from it.
^ permalink raw reply
* Re: [PATCH v8 06/25] gpu: nova-core: mm: Add support to use PRAMIN windows to write to VRAM
From: Alexandre Courbot @ 2026-03-02 11:58 UTC (permalink / raw)
To: Joel Fernandes
Cc: linux-kernel, Miguel Ojeda, Boqun Feng, Gary Guo,
Björn Roy Baron, Benno Lossin, Andreas Hindborg, Alice Ryhl,
Trevor Gross, Danilo Krummrich, Dave Airlie, Daniel Almeida,
Koen Koning, dri-devel, nouveau, rust-for-linux, Nikola Djukic,
Maarten Lankhorst, Maxime Ripard, Simona Vetter, Jonathan Corbet,
Alex Deucher, Christian König, Jani Nikula, Joonas Lahtinen,
Rodrigo Vivi, Tvrtko Ursulin, Huang Rui, Matthew Auld,
Matthew Brost, Lucas De Marchi, Thomas Hellström,
Helge Deller, Alex Gaynor, Boqun Feng, Alistair Popple,
Andrea Righi, Zhi Wang, Philipp Stanner, Elle Rhumsaa, alexeyi,
Eliot Courtney, joel, linux-doc, amd-gfx, intel-gfx, intel-xe,
linux-fbdev
In-Reply-To: <20260224225323.3312204-7-joelagnelf@nvidia.com>
Hi Joel,
On Wed Feb 25, 2026 at 7:53 AM JST, Joel Fernandes wrote:
> PRAMIN apertures are a crucial mechanism to direct read/write to VRAM.
> Add support for the same.
>
> Cc: Nikola Djukic <ndjukic@nvidia.com>
> Signed-off-by: Joel Fernandes <joelagnelf@nvidia.com>
I have two sets of comments for this patch - one that is immediately
actionable, the other that depends on the availability of the new `Io`
interface. Let's start with the actionable items, I'll do the discussion
about `Io` in another email.
> ---
> drivers/gpu/nova-core/mm.rs | 5 +
> drivers/gpu/nova-core/mm/pramin.rs | 292 +++++++++++++++++++++++++++++
> drivers/gpu/nova-core/nova_core.rs | 1 +
> drivers/gpu/nova-core/regs.rs | 5 +
> 4 files changed, 303 insertions(+)
> create mode 100644 drivers/gpu/nova-core/mm.rs
> create mode 100644 drivers/gpu/nova-core/mm/pramin.rs
>
> diff --git a/drivers/gpu/nova-core/mm.rs b/drivers/gpu/nova-core/mm.rs
> new file mode 100644
> index 000000000000..7a5dd4220c67
> --- /dev/null
> +++ b/drivers/gpu/nova-core/mm.rs
> @@ -0,0 +1,5 @@
> +// SPDX-License-Identifier: GPL-2.0
> +
> +//! Memory management subsystems for nova-core.
> +
> +pub(crate) mod pramin;
> diff --git a/drivers/gpu/nova-core/mm/pramin.rs b/drivers/gpu/nova-core/mm/pramin.rs
> new file mode 100644
> index 000000000000..04b652d3ee4f
> --- /dev/null
> +++ b/drivers/gpu/nova-core/mm/pramin.rs
> @@ -0,0 +1,292 @@
> +// SPDX-License-Identifier: GPL-2.0
> +
> +//! Direct VRAM access through the PRAMIN aperture.
> +//!
> +//! PRAMIN provides a 1MB sliding window into VRAM through BAR0, allowing the CPU to access
> +//! video memory directly. Access is managed through a two-level API:
> +//!
> +//! - [`Pramin`]: The parent object that owns the BAR0 reference and synchronization lock.
> +//! - [`PraminWindow`]: A guard object that holds exclusive PRAMIN access for its lifetime.
> +//!
> +//! The PRAMIN aperture is a 1MB region at BAR0 + 0x700000 for all GPUs. The window base is
> +//! controlled by the `NV_PBUS_BAR0_WINDOW` register and must be 64KB aligned.
s/must be/is - it's not like that hardware is giving us a choice anyway
since we cannot even express a non-aligned value in the window register.
> +//!
> +//! # Examples
> +//!
> +//! ## Basic read/write
> +//!
> +//! ```no_run
> +//! use crate::driver::Bar0;
> +//! use crate::mm::pramin;
> +//! use kernel::devres::Devres;
> +//! use kernel::prelude::*;
> +//! use kernel::sync::Arc;
> +//!
> +//! fn example(devres_bar: Arc<Devres<Bar0>>) -> Result<()> {
> +//! let pramin = Arc::pin_init(pramin::Pramin::new(devres_bar)?, GFP_KERNEL)?;
> +//! let mut window = pramin.window()?;
> +//!
> +//! // Write and read back.
> +//! window.try_write32(0x100, 0xDEADBEEF)?;
> +//! let val = window.try_read32(0x100)?;
> +//! assert_eq!(val, 0xDEADBEEF);
> +//!
> +//! Ok(())
> +//! // Original window position restored on drop.
> +//! }
> +//! ```
> +//!
> +//! ## Auto-repositioning across VRAM regions
> +//!
> +//! ```no_run
> +//! use crate::driver::Bar0;
> +//! use crate::mm::pramin;
> +//! use kernel::devres::Devres;
> +//! use kernel::prelude::*;
> +//! use kernel::sync::Arc;
> +//!
> +//! fn example(devres_bar: Arc<Devres<Bar0>>) -> Result<()> {
> +//! let pramin = Arc::pin_init(pramin::Pramin::new(devres_bar)?, GFP_KERNEL)?;
> +//! let mut window = pramin.window()?;
> +//!
> +//! // Access first 1MB region.
> +//! window.try_write32(0x100, 0x11111111)?;
> +//!
> +//! // Access at 2MB - window auto-repositions.
> +//! window.try_write32(0x200000, 0x22222222)?;
> +//!
> +//! // Back to first region - window repositions again.
> +//! let val = window.try_read32(0x100)?;
> +//! assert_eq!(val, 0x11111111);
> +//!
> +//! Ok(())
> +//! }
> +//! ```
> +
> +#![expect(unused)]
> +
> +use crate::{
> + driver::Bar0,
> + num::u64_as_usize,
> + regs, //
> +};
> +
> +use kernel::bits::genmask_u64;
> +use kernel::devres::Devres;
> +use kernel::io::Io;
> +use kernel::new_mutex;
> +use kernel::prelude::*;
> +use kernel::ptr::{
> + Alignable,
> + Alignment, //
> +};
> +use kernel::sizes::{
> + SZ_1M,
> + SZ_64K, //
> +};
> +use kernel::sync::{
> + lock::mutex::MutexGuard,
> + Arc,
> + Mutex, //
> +};
> +
> +/// PRAMIN aperture base offset in BAR0.
> +const PRAMIN_BASE: usize = 0x700000;
> +
> +/// PRAMIN aperture size (1MB).
> +const PRAMIN_SIZE: usize = SZ_1M;
> +
> +/// 64KB alignment for window base.
> +const WINDOW_ALIGN: Alignment = Alignment::new::<SZ_64K>();
> +
> +/// Maximum addressable VRAM offset (40-bit address space).
> +///
> +/// The `NV_PBUS_BAR0_WINDOW` register has a 24-bit `window_base` field (bits 23:0) that stores
> +/// bits [39:16] of the target VRAM address. This limits the addressable space to 2^40 bytes.
> +const MAX_VRAM_OFFSET: usize = u64_as_usize(genmask_u64(0..=39));
> +
> +/// Generate a PRAMIN read accessor.
> +macro_rules! define_pramin_read {
> + ($name:ident, $ty:ty) => {
> + #[doc = concat!("Read a `", stringify!($ty), "` from VRAM at the given offset.")]
> + pub(crate) fn $name(&mut self, vram_offset: usize) -> Result<$ty> {
> + // Compute window parameters without bar reference.
> + let (bar_offset, new_base) =
> + self.compute_window(vram_offset, ::core::mem::size_of::<$ty>())?;
> +
> + // Update window base if needed and perform read.
> + let bar = self.bar.try_access().ok_or(ENODEV)?;
Ouch, we are calling `try_access` for every single read or write
operation. Thankfully we can do without this - see my comments on
`PraminWindow` a bit later.
> + if let Some(base) = new_base {
> + Self::write_window_base(&bar, base);
> + self.state.current_base = base;
> + }
> + bar.$name(bar_offset)
> + }
> + };
> +}
> +
> +/// Generate a PRAMIN write accessor.
> +macro_rules! define_pramin_write {
> + ($name:ident, $ty:ty) => {
> + #[doc = concat!("Write a `", stringify!($ty), "` to VRAM at the given offset.")]
> + pub(crate) fn $name(&mut self, vram_offset: usize, value: $ty) -> Result {
> + // Compute window parameters without bar reference.
> + let (bar_offset, new_base) =
> + self.compute_window(vram_offset, ::core::mem::size_of::<$ty>())?;
> +
> + // Update window base if needed and perform write.
> + let bar = self.bar.try_access().ok_or(ENODEV)?;
> + if let Some(base) = new_base {
> + Self::write_window_base(&bar, base);
> + self.state.current_base = base;
> + }
> + bar.$name(value, bar_offset)
> + }
> + };
> +}
> +
> +/// PRAMIN state protected by mutex.
> +struct PraminState {
> + current_base: usize,
> +}
This has only one member and no impl block of its own - shall we inline
it?
> +
> +/// PRAMIN aperture manager.
> +///
> +/// Call [`Pramin::window()`] to acquire exclusive PRAMIN access.
> +#[pin_data]
> +pub(crate) struct Pramin {
> + bar: Arc<Devres<Bar0>>,
> + /// PRAMIN aperture state, protected by a mutex.
> + ///
> + /// # Safety
> + ///
> + /// This lock is acquired during the DMA fence signalling critical path.
nit: s/signalling/signaling
> + /// It must NEVER be held across any reclaimable CPU memory / allocations
> + /// (`GFP_KERNEL`), because the memory reclaim path can call
> + /// `dma_fence_wait()`, which would deadlock with this lock held.
> + #[pin]
> + state: Mutex<PraminState>,
> +}
> +
> +impl Pramin {
> + /// Create a pin-initializer for PRAMIN.
> + pub(crate) fn new(bar: Arc<Devres<Bar0>>) -> Result<impl PinInit<Self>> {
> + let bar_access = bar.try_access().ok_or(ENODEV)?;
> + let current_base = Self::try_read_window_base(&bar_access)?;
> +
> + Ok(pin_init!(Self {
> + bar,
> + state <- new_mutex!(PraminState { current_base }, "pramin_state"),
> + }))
> + }
> +
> + /// Acquire exclusive PRAMIN access.
> + ///
> + /// Returns a [`PraminWindow`] guard that provides VRAM read/write accessors.
> + /// The [`PraminWindow`] is exclusive and only one can exist at a time.
> + pub(crate) fn window(&self) -> Result<PraminWindow<'_>> {
The name of this method is strange - we don't pass the base of any
window area. It looks more like it is actually acquiring the `Pramin`
for exclusive access.
Also fun question: what happens if we try to access an area above (or
below) the available VRAM?
> + let state = self.state.lock();
> + let saved_base = state.current_base;
> + Ok(PraminWindow {
> + bar: self.bar.clone(),
> + state,
> + saved_base,
> + })
> + }
> +
> + /// Read the current window base from the BAR0_WINDOW register.
> + fn try_read_window_base(bar: &Bar0) -> Result<usize> {
> + let reg = regs::NV_PBUS_BAR0_WINDOW::read(bar);
> + let base = u64::from(reg.window_base());
> + let shifted = base.checked_shl(16).ok_or(EOVERFLOW)?;
> + shifted.try_into().map_err(|_| EOVERFLOW)
This function is actually infallible.
The `checked_shl` cannot fail because we are shifting a `u32` by 16,
which will always fit into a `u64`. There is some `Bounded` code
incoming that will allow us to prove that safely, but it is not
available in `drm-rust-next` yet. For now can you use a regular shift
operation with a TODO to convert to `Bounded`?
The last line could use `num::u64_as_size` to do the conversion
infallibly. But actually the window base is native to the GPU, not the
host CPU architecture - so it should really be a u64 anyway.
> + }
> +}
> +
> +/// PRAMIN window guard for direct VRAM access.
> +///
> +/// This guard holds exclusive access to the PRAMIN aperture. The window auto-repositions
> +/// when accessing VRAM offsets outside the current 1MB range. Original window position
> +/// is saved on creation and restored on drop.
> +///
> +/// Only one [`PraminWindow`] can exist at a time per [`Pramin`] instance (enforced by the
> +/// internal `MutexGuard`).
> +pub(crate) struct PraminWindow<'a> {
> + bar: Arc<Devres<Bar0>>,
Cloning the `Arc` is what forces us to do a `try_access` on every
read/write operation. Needless to say this is overkill and not
efficient.
The `PraminWindow` already holds a reference to its `Pramin`, so you can
just call `try_access` in `window` and store that. This turns `bar` into
this:
bar: RevocableGuard<'a, Bar0>,
And now you can perform operations on `bar` directly without needing to
acquire it every time.
> + state: MutexGuard<'a, PraminState>,
I'm wondering whether we should remove the `Mutex` from `Pramin` and
make its methods take `&mut self` (and this would thus become a `&mut
PraminState`).
The rationale for this is that `Pramin` will be owned by `GpuMm`, which
can implement its own locking policy (including across several of the
items it owns) as it needs. That way `Pramin` also stays "pure" in that
it only needs to care about abstracting the hardware.
> + saved_base: usize,
What is the point of saving and restoring the original position?
`Pramin` gets exclusive access to the PRAMIN area, and whenever we make
an access through the window the base address can be reprogrammed. So
it's not as if the original value has some particular meaning or
constitutes state that deserves to be preserved. Getting rid of this
behavior also lets us remove the `Drop` implementation.
> +}
> +
> +impl PraminWindow<'_> {
> + /// Write a new window base to the BAR0_WINDOW register.
> + fn write_window_base(bar: &Bar0, base: usize) {
`base` should be the native type of the GPU, i.e. `u64`.
> + // CAST:
> + // - We have guaranteed that the base is within the addressable range (40-bits).
> + // - After >> 16, a 40-bit aligned base becomes 24 bits, which fits in u32.
This function does not guarantee anything of the sort - even the caller
doesn't, this actually relies on the behavior of `compute_window`,
another method.
You can enforce this limit by using a `Bounded<u64, 40>` as the type for
base addresses. There is even staging code (not yet in drm-rust-next
unfortunately) that will lets you turn it into a `Bounded<u32, 32>`
safely to be written into the register.
> + regs::NV_PBUS_BAR0_WINDOW::default()
> + .set_window_base((base >> 16) as u32)
> + .write(bar);
> + }
> +
> + /// Compute window parameters for a VRAM access.
> + ///
> + /// Returns (`bar_offset`, `new_base`) where:
> + /// - `bar_offset`: The BAR0 offset to use for the access.
> + /// - `new_base`: `Some(base)` if window needs repositioning, `None` otherwise.
> + fn compute_window(
> + &self,
> + vram_offset: usize,
> + access_size: usize,
> + ) -> Result<(usize, Option<usize>)> {
> + // Validate VRAM offset is within addressable range (40-bit address space).
> + let end_offset = vram_offset.checked_add(access_size).ok_or(EINVAL)?;
> + if end_offset > MAX_VRAM_OFFSET + 1 {
If we are going to use `MAX_VRAM_OFFSET` like this, let's define it as
`1 << 40` and turn this into `if end_offset > MAX_VRAM_OFFSET`.
> + return Err(EINVAL);
> + }
> +
> + // Calculate which 64KB-aligned base we need.
> + let needed_base = vram_offset.align_down(WINDOW_ALIGN);
> +
> + // Calculate offset within the window.
> + let offset_in_window = vram_offset - needed_base;
> +
> + // Check if access fits in 1MB window from this base.
> + if offset_in_window + access_size > PRAMIN_SIZE {
> + return Err(EINVAL);
> + }
Here `offset_in_window` cannot be larger than 64K because of the line
before - this check is effectively dead code.
> +
> + // Return bar offset and whether window needs repositioning.
> + let new_base = if self.state.current_base != needed_base {
> + Some(needed_base)
> + } else {
> + None
> + };
So maybe I am missing something, but aren't we writing a new base if the
requested offset doesn't fit within [current_base..current_base+64K],
despite the fact that the PRAMIN window is 1MB? This looks like a bug.
Also what happens if we access PRAMIN with decreasing addresses? Won't
we be doing more window resets than we need?
> +
> + Ok((PRAMIN_BASE + offset_in_window, new_base))
> + }
> +
> + define_pramin_read!(try_read8, u8);
> + define_pramin_read!(try_read16, u16);
> + define_pramin_read!(try_read32, u32);
> + define_pramin_read!(try_read64, u64);
> +
> + define_pramin_write!(try_write8, u8);
> + define_pramin_write!(try_write16, u16);
> + define_pramin_write!(try_write32, u32);
> + define_pramin_write!(try_write64, u64);
> +}
> +
> +impl Drop for PraminWindow<'_> {
> + fn drop(&mut self) {
> + // Restore the original window base if it changed.
> + if self.state.current_base != self.saved_base {
> + if let Some(bar) = self.bar.try_access() {
> + Self::write_window_base(&bar, self.saved_base);
> +
> + // Update state to reflect the restored base.
> + self.state.current_base = self.saved_base;
> + }
> + }
> + // MutexGuard drops automatically, releasing the lock.
> + }
> +}
Let's drop this alongside the original window base restoration, which
doesn't serve any purpose.
> diff --git a/drivers/gpu/nova-core/nova_core.rs b/drivers/gpu/nova-core/nova_core.rs
> index c1121e7c64c5..3de00db3279e 100644
> --- a/drivers/gpu/nova-core/nova_core.rs
> +++ b/drivers/gpu/nova-core/nova_core.rs
> @@ -13,6 +13,7 @@
> mod gfw;
> mod gpu;
> mod gsp;
> +mod mm;
> mod num;
> mod regs;
> mod sbuffer;
> diff --git a/drivers/gpu/nova-core/regs.rs b/drivers/gpu/nova-core/regs.rs
> index ea0d32f5396c..d0982e346f74 100644
> --- a/drivers/gpu/nova-core/regs.rs
> +++ b/drivers/gpu/nova-core/regs.rs
> @@ -102,6 +102,11 @@ fn fmt(&self, f: &mut kernel::fmt::Formatter<'_>) -> kernel::fmt::Result {
> 31:16 frts_err_code as u16;
> });
>
> +register!(NV_PBUS_BAR0_WINDOW @ 0x00001700, "BAR0 window control for PRAMIN access" {
> + 25:24 target as u8, "Target memory (0=VRAM, 1=SYS_MEM_COH, 2=SYS_MEM_NONCOH)";
This should be converted to an enum. I understand that we only ever want
to use `Vram` as Hopper+ don't support the other types of memories - a
single-variant enum will document that fact and force us to set the
correct value.
^ permalink raw reply
* Re: [RFC PATCH] fbcon: Fix out-of-bounds memory in fbcon_putcs
From: Thomas Zimmermann @ 2026-03-02 11:33 UTC (permalink / raw)
To: chenjun (AM), simona@ffwll.ch, deller@gmx.de,
linux-fbdev@vger.kernel.org, linux-kernel@vger.kernel.org
Cc: linruifeng (A)
In-Reply-To: <e8e3b8182e124ac08cc33700d45772ce@huawei.com>
Hi
Am 02.03.26 um 12:24 schrieb chenjun (AM):
> 在 2026/3/2 18:19, Thomas Zimmermann 写道:
>>
>> Am 27.02.26 um 15:43 schrieb Chen Jun:
>>> When a font is set on an invisible console, the screen will not update.
>>> However, the fontbuffer is not updated to match the new font dimensions.
>>>
>>> This inconsistency leads to out-of-bounds memory access when writing to
>>> the tty bound to fbcon, as demonstrated by the following KASAN report:
>>>
>>> BUG: KASAN: slab-out-of-bounds in fb_pad_aligned_buffer+0xdf/0x140
>>> Read of size 1 at addr ffff8881195a2280 by task a.out/971
>>> Call Trace:
>>> <TASK>
>>> fb_pad_aligned_buffer+0xdf/0x140
>>> ud_putcs+0x88a/0xde0
>>> fbcon_putcs+0x319/0x430
>>> do_update_region+0x23c/0x3b0
>>> do_con_write+0x225c/0x67f0
>>> con_write+0xe/0x30
>>> n_tty_write+0x4b5/0xff0
>>> file_tty_write.isra.41+0x46c/0x880
>>> vfs_write+0x868/0xd60
>>> ksys_write+0xf2/0x1d0
>>> do_syscall_64+0xfa/0x570
>>>
>>> Fix this by calling fbcon_rotate_font() if vc is invisible in
>>> fbcon_do_set_font().
>>>
>>> Signed-off-by: Chen Jun <chenjun102@huawei.com>
>> Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de>
> Hi Thomas,
>
> Thanks for your review.
>
> I'm not familiar with the fbcon module. Is there a better way to fix this?
Not really, I think. The whole module first needs a redesign to be
easier to understand.
Best regards
Thomas
>
>>> ---
>>> drivers/video/fbdev/core/fbcon.c | 5 +++++
>>> 1 file changed, 5 insertions(+)
>>>
>>> diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c
>>> index 666261ae59d8..d76100188bee 100644
>>> --- a/drivers/video/fbdev/core/fbcon.c
>>> +++ b/drivers/video/fbdev/core/fbcon.c
>>> @@ -2444,6 +2444,11 @@ static int fbcon_do_set_font(struct vc_data *vc, int w, int h, int charcount,
>>> rows = FBCON_SWAP(par->rotate, info->var.yres, info->var.xres);
>>> cols /= w;
>>> rows /= h;
>>> + if (!con_is_visible(vc)) {
>>> + ret = fbcon_rotate_font(info, vc);
>>> + if (ret)
>>> + goto err_out;
>>> + }
>>> ret = vc_resize(vc, cols, rows);
>>> if (ret)
>>> goto err_out;
>
--
--
Thomas Zimmermann
Graphics Driver Developer
SUSE Software Solutions Germany GmbH
Frankenstr. 146, 90461 Nürnberg, Germany, www.suse.com
GF: Jochen Jaser, Andrew McDonald, Werner Knoblich, (HRB 36809, AG Nürnberg)
^ permalink raw reply
* Re: [RFC PATCH] fbcon: Fix out-of-bounds memory in fbcon_putcs
From: chenjun (AM) @ 2026-03-02 11:24 UTC (permalink / raw)
To: Thomas Zimmermann, simona@ffwll.ch, deller@gmx.de,
linux-fbdev@vger.kernel.org, linux-kernel@vger.kernel.org
Cc: linruifeng (A)
In-Reply-To: <1c078618-7236-4ccb-ae99-376276369f36@suse.de>
在 2026/3/2 18:19, Thomas Zimmermann 写道:
>
>
> Am 27.02.26 um 15:43 schrieb Chen Jun:
>> When a font is set on an invisible console, the screen will not update.
>> However, the fontbuffer is not updated to match the new font dimensions.
>>
>> This inconsistency leads to out-of-bounds memory access when writing to
>> the tty bound to fbcon, as demonstrated by the following KASAN report:
>>
>> BUG: KASAN: slab-out-of-bounds in fb_pad_aligned_buffer+0xdf/0x140
>> Read of size 1 at addr ffff8881195a2280 by task a.out/971
>> Call Trace:
>> <TASK>
>> fb_pad_aligned_buffer+0xdf/0x140
>> ud_putcs+0x88a/0xde0
>> fbcon_putcs+0x319/0x430
>> do_update_region+0x23c/0x3b0
>> do_con_write+0x225c/0x67f0
>> con_write+0xe/0x30
>> n_tty_write+0x4b5/0xff0
>> file_tty_write.isra.41+0x46c/0x880
>> vfs_write+0x868/0xd60
>> ksys_write+0xf2/0x1d0
>> do_syscall_64+0xfa/0x570
>>
>> Fix this by calling fbcon_rotate_font() if vc is invisible in
>> fbcon_do_set_font().
>>
>> Signed-off-by: Chen Jun <chenjun102@huawei.com>
>
> Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de>
Hi Thomas,
Thanks for your review.
I'm not familiar with the fbcon module. Is there a better way to fix this?
>> ---
>> drivers/video/fbdev/core/fbcon.c | 5 +++++
>> 1 file changed, 5 insertions(+)
>>
>> diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c
>> index 666261ae59d8..d76100188bee 100644
>> --- a/drivers/video/fbdev/core/fbcon.c
>> +++ b/drivers/video/fbdev/core/fbcon.c
>> @@ -2444,6 +2444,11 @@ static int fbcon_do_set_font(struct vc_data *vc, int w, int h, int charcount,
>> rows = FBCON_SWAP(par->rotate, info->var.yres, info->var.xres);
>> cols /= w;
>> rows /= h;
>> + if (!con_is_visible(vc)) {
>> + ret = fbcon_rotate_font(info, vc);
>> + if (ret)
>> + goto err_out;
>> + }
>> ret = vc_resize(vc, cols, rows);
>> if (ret)
>> goto err_out;
>
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox