target/linux/bcm27xx/patches-4.19/950-0287-video-bcm2708_fb-Add-compat_ioctl-support.patch

   1 From b5bd7b621f6ab2f29e9f18ec2a2720d702b9727c Mon Sep 17 00:00:00 2001
   2 From: Dave Stevenson <dave.stevenson@raspberrypi.org>
   3 Date: Fri, 25 Jan 2019 17:12:54 +0000
   4 Subject: [PATCH] video: bcm2708_fb: Add compat_ioctl support.
   5
   6 When using a 64 bit kernel with 32 bit userspace we need
   7 compat ioctl handling for FBIODMACOPY as one of the
   8 parameters is a pointer.
   9
  10 Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
  11 ---
  12  drivers/video/fbdev/bcm2708_fb.c | 87 ++++++++++++++++++++++++--------
  13  1 file changed, 66 insertions(+), 21 deletions(-)
  14
  15 --- a/drivers/video/fbdev/bcm2708_fb.c
  16 +++ b/drivers/video/fbdev/bcm2708_fb.c
  17 @@ -482,9 +482,8 @@ static void dma_memcpy(struct bcm2708_fb
  18  /* cache coherent but non-allocating in L1 and L2 */
  19  #define INTALIAS_L1L2_NONALLOCATING(x) (((x)&~0xc0000000)|0x80000000)
  20
  21 -static long vc_mem_copy(struct bcm2708_fb *fb, unsigned long arg)
  22 +static long vc_mem_copy(struct bcm2708_fb *fb, struct fb_dmacopy *ioparam)
  23  {
  24 -       struct fb_dmacopy ioparam;
  25         size_t size = PAGE_SIZE;
  26         u32 *buf = NULL;
  27         dma_addr_t bus_addr;
  28 @@ -497,26 +496,16 @@ static long vc_mem_copy(struct bcm2708_f
  29                 goto out;
  30         }
  31
  32 -       /* Get the parameter data.
  33 -        */
  34 -       if (copy_from_user
  35 -           (&ioparam, (void *)arg, sizeof(ioparam)) != 0) {
  36 -               pr_err("[%s]: failed to copy-from-user\n",
  37 -                               __func__);
  38 -               rc = -EFAULT;
  39 -               goto out;
  40 -       }
  41 -
  42 -       if (fb->gpu.base == 0 || fb->gpu.length == 0) {
  43 +       if (!fb->gpu.base || !fb->gpu.length) {
  44                 pr_err("[%s]: Unable to determine gpu memory (%x,%x)\n",
  45                         __func__, fb->gpu.base, fb->gpu.length);
  46                 return -EFAULT;
  47         }
  48
  49 -       if (INTALIAS_NORMAL(ioparam.src) < fb->gpu.base ||
  50 -               INTALIAS_NORMAL(ioparam.src) >= fb->gpu.base + fb->gpu.length) {
  51 +       if (INTALIAS_NORMAL(ioparam->src) < fb->gpu.base ||
  52 +           INTALIAS_NORMAL(ioparam->src) >= fb->gpu.base + fb->gpu.length) {
  53                 pr_err("[%s]: Invalid memory access %x (%x-%x)", __func__,
  54 -                       INTALIAS_NORMAL(ioparam.src), fb->gpu.base,
  55 +                       INTALIAS_NORMAL(ioparam->src), fb->gpu.base,
  56                         fb->gpu.base + fb->gpu.length);
  57                 return -EFAULT;
  58         }
  59 @@ -530,11 +519,11 @@ static long vc_mem_copy(struct bcm2708_f
  60                 goto out;
  61         }
  62
  63 -       for (offset = 0; offset < ioparam.length; offset += size) {
  64 -               size_t remaining = ioparam.length - offset;
  65 +       for (offset = 0; offset < ioparam->length; offset += size) {
  66 +               size_t remaining = ioparam->length - offset;
  67                 size_t s = min(size, remaining);
  68 -               unsigned char *p = (unsigned char *)ioparam.src + offset;
  69 -               unsigned char *q = (unsigned char *)ioparam.dst + offset;
  70 +               u8 *p = (u8 *)((uintptr_t)ioparam->src + offset);
  71 +               u8 *q = (u8 *)ioparam->dst + offset;
  72
  73                 dma_memcpy(fb, bus_addr,
  74                            INTALIAS_L1L2_NONALLOCATING((dma_addr_t)p), size);
  75 @@ -566,8 +555,19 @@ static int bcm2708_ioctl(struct fb_info
  76                                             &dummy, sizeof(dummy));
  77                 break;
  78         case FBIODMACOPY:
  79 -               ret = vc_mem_copy(fb, arg);
  80 +       {
  81 +               struct fb_dmacopy ioparam;
  82 +               /* Get the parameter data.
  83 +                */
  84 +               if (copy_from_user
  85 +                   (&ioparam, (void *)arg, sizeof(ioparam))) {
  86 +                       pr_err("[%s]: failed to copy-from-user\n", __func__);
  87 +                       ret = -EFAULT;
  88 +                       break;
  89 +               }
  90 +               ret = vc_mem_copy(fb, &ioparam);
  91                 break;
  92 +       }
  93         default:
  94                 dev_dbg(info->device, "Unknown ioctl 0x%x\n", cmd);
  95                 return -ENOTTY;
  96 @@ -578,6 +578,48 @@ static int bcm2708_ioctl(struct fb_info
  97
  98         return ret;
  99  }
 100 +
 101 +#ifdef CONFIG_COMPAT
 102 +struct fb_dmacopy32 {
 103 +       compat_uptr_t dst;
 104 +       __u32 src;
 105 +       __u32 length;
 106 +};
 107 +
 108 +#define FBIODMACOPY32          _IOW('z', 0x22, struct fb_dmacopy32)
 109 +
 110 +static int bcm2708_compat_ioctl(struct fb_info *info, unsigned int cmd,
 111 +                               unsigned long arg)
 112 +{
 113 +       struct bcm2708_fb *fb = to_bcm2708(info);
 114 +       int ret;
 115 +
 116 +       switch (cmd) {
 117 +       case FBIODMACOPY32:
 118 +       {
 119 +               struct fb_dmacopy32 param32;
 120 +               struct fb_dmacopy param;
 121 +               /* Get the parameter data.
 122 +                */
 123 +               if (copy_from_user(&param32, (void *)arg, sizeof(param32))) {
 124 +                       pr_err("[%s]: failed to copy-from-user\n", __func__);
 125 +                       ret = -EFAULT;
 126 +                       break;
 127 +               }
 128 +               param.dst = compat_ptr(param32.dst);
 129 +               param.src = param32.src;
 130 +               param.length = param32.length;
 131 +               ret = vc_mem_copy(fb, &param);
 132 +               break;
 133 +       }
 134 +       default:
 135 +               ret = bcm2708_ioctl(info, cmd, arg);
 136 +               break;
 137 +       }
 138 +       return ret;
 139 +}
 140 +#endif
 141 +
 142  static void bcm2708_fb_fillrect(struct fb_info *info,
 143                                 const struct fb_fillrect *rect)
 144  {
 145 @@ -768,6 +810,9 @@ static struct fb_ops bcm2708_fb_ops = {
 146         .fb_imageblit = bcm2708_fb_imageblit,
 147         .fb_pan_display = bcm2708_fb_pan_display,
 148         .fb_ioctl = bcm2708_ioctl,
 149 +#ifdef CONFIG_COMPAT
 150 +       .fb_compat_ioctl = bcm2708_compat_ioctl,
 151 +#endif
 152  };
 153
 154  static int bcm2708_fb_register(struct bcm2708_fb *fb)