2011-03-03 18:00:22

by Stephen Hemminger

[permalink] [raw]
Subject: [PATCH] video via: fix iomem access

This driver is not respecting the iomem memory space restrictions
and does direct access. This works on x86 but is non-portable and
should not be done. Converted memcpy() of 2 to readw.
Last post increment of romptr was unnecessary since pointer never
used after that.

Found by sparse, compile tested only.

Signed-off-by: Stephen Hemminger <[email protected]>

---
drivers/video/via/lcd.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)

--- a/drivers/video/via/lcd.c 2011-03-03 09:09:10.552604209 -0800
+++ b/drivers/video/via/lcd.c 2011-03-03 09:56:12.144398571 -0800
@@ -1064,34 +1064,33 @@ static struct display_timing lcd_centeri

bool viafb_lcd_get_mobile_state(bool *mobile)
{
- unsigned char *romptr, *tableptr;
+ unsigned char __iomem *romptr, *tableptr, *biosptr;
u8 core_base;
- unsigned char *biosptr;
/* Rom address */
- u32 romaddr = 0x000C0000;
- u16 start_pattern = 0;
+ const u32 romaddr = 0x000C0000;
+ u16 start_pattern;

biosptr = ioremap(romaddr, 0x10000);
+ start_pattern = readw(biosptr);

- memcpy(&start_pattern, biosptr, 2);
/* Compare pattern */
if (start_pattern == 0xAA55) {
/* Get the start of Table */
/* 0x1B means BIOS offset position */
romptr = biosptr + 0x1B;
- tableptr = biosptr + *((u16 *) romptr);
+ tableptr = biosptr + readw(romptr);

/* Get the start of biosver structure */
/* 18 means BIOS version position. */
romptr = tableptr + 18;
- romptr = biosptr + *((u16 *) romptr);
+ romptr = biosptr + readw(romptr);

/* The offset should be 44, but the
actual image is less three char. */
/* pRom += 44; */
romptr += 41;

- core_base = *romptr++;
+ core_base = readb(romptr);

if (core_base & 0x8)
*mobile = false;


Subject: Re: [PATCH] video via: fix iomem access

Stephen Hemminger schrieb:
> This driver is not respecting the iomem memory space restrictions
> and does direct access. This works on x86 but is non-portable and
> should not be done. Converted memcpy() of 2 to readw.
> Last post increment of romptr was unnecessary since pointer never
> used after that.
>
> Found by sparse, compile tested only.
>
> Signed-off-by: Stephen Hemminger <[email protected]>

Applied (although it does not make a difference as viafb is x86 only). Thanks,


Florian Tobias Schandinat

>
> ---
> drivers/video/via/lcd.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> --- a/drivers/video/via/lcd.c 2011-03-03 09:09:10.552604209 -0800
> +++ b/drivers/video/via/lcd.c 2011-03-03 09:56:12.144398571 -0800
> @@ -1064,34 +1064,33 @@ static struct display_timing lcd_centeri
>
> bool viafb_lcd_get_mobile_state(bool *mobile)
> {
> - unsigned char *romptr, *tableptr;
> + unsigned char __iomem *romptr, *tableptr, *biosptr;
> u8 core_base;
> - unsigned char *biosptr;
> /* Rom address */
> - u32 romaddr = 0x000C0000;
> - u16 start_pattern = 0;
> + const u32 romaddr = 0x000C0000;
> + u16 start_pattern;
>
> biosptr = ioremap(romaddr, 0x10000);
> + start_pattern = readw(biosptr);
>
> - memcpy(&start_pattern, biosptr, 2);
> /* Compare pattern */
> if (start_pattern == 0xAA55) {
> /* Get the start of Table */
> /* 0x1B means BIOS offset position */
> romptr = biosptr + 0x1B;
> - tableptr = biosptr + *((u16 *) romptr);
> + tableptr = biosptr + readw(romptr);
>
> /* Get the start of biosver structure */
> /* 18 means BIOS version position. */
> romptr = tableptr + 18;
> - romptr = biosptr + *((u16 *) romptr);
> + romptr = biosptr + readw(romptr);
>
> /* The offset should be 44, but the
> actual image is less three char. */
> /* pRom += 44; */
> romptr += 41;
>
> - core_base = *romptr++;
> + core_base = readb(romptr);
>
> if (core_base & 0x8)
> *mobile = false;
> --
> To unsubscribe from this list: send the line "unsubscribe linux-fbdev" in
> the body of a message to [email protected]
> More majordomo info at http://vger.kernel.org/majordomo-info.html
>