From 2e1e5979bbe07f1a72276fd486abb3e693364628 Mon Sep 17 00:00:00 2001 From: Laurent Pinchart Date: Wed, 25 May 2011 11:34:52 +0200 Subject: [PATCH 01/29] 68328fb: use display information in info not in var for panning We must not use any information in the passed var besides xoffset, yoffset and vmode as otherwise applications might abuse it. Signed-off-by: Laurent Pinchart --- drivers/video/68328fb.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/video/68328fb.c b/drivers/video/68328fb.c index 75a39eab70c3..a425d65d5ba2 100644 --- a/drivers/video/68328fb.c +++ b/drivers/video/68328fb.c @@ -378,8 +378,8 @@ static int mc68x328fb_pan_display(struct fb_var_screeninfo *var, || var->xoffset) return -EINVAL; } else { - if (var->xoffset + var->xres > info->var.xres_virtual || - var->yoffset + var->yres > info->var.yres_virtual) + if (var->xoffset + info->var.xres > info->var.xres_virtual || + var->yoffset + info->var.yres > info->var.yres_virtual) return -EINVAL; } info->var.xoffset = var->xoffset; From 3846e93a65b1a127f59203606c0e92dd22f08782 Mon Sep 17 00:00:00 2001 From: Laurent Pinchart Date: Wed, 25 May 2011 13:43:53 +0200 Subject: [PATCH 02/29] acornfb: Dont BUG() on invalid pan parameters The driver currently BUG()s if the pan parameters passed directly from userspace are invalid. Return -EINVAL instead. Signed-off-by: Laurent Pinchart --- drivers/video/acornfb.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/video/acornfb.c b/drivers/video/acornfb.c index 6183a57eb69d..3bacc1290548 100644 --- a/drivers/video/acornfb.c +++ b/drivers/video/acornfb.c @@ -852,7 +852,8 @@ acornfb_pan_display(struct fb_var_screeninfo *var, struct fb_info *info) if (!(var->vmode & FB_VMODE_YWRAP)) y_bottom += var->yres; - BUG_ON(y_bottom > var->yres_virtual); + if (y_bottom > var->yres_virtual) + return -EINVAL; acornfb_update_dma(info, var); From 2970840c034838d717126fbec0b38029c7f04852 Mon Sep 17 00:00:00 2001 From: Laurent Pinchart Date: Wed, 25 May 2011 11:34:52 +0200 Subject: [PATCH 03/29] acornfb: use display information in info not in var for panning We must not use any information in the passed var besides xoffset, yoffset and vmode as otherwise applications might abuse it. Signed-off-by: Laurent Pinchart --- drivers/video/acornfb.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/video/acornfb.c b/drivers/video/acornfb.c index 3bacc1290548..b303f1715065 100644 --- a/drivers/video/acornfb.c +++ b/drivers/video/acornfb.c @@ -850,9 +850,9 @@ acornfb_pan_display(struct fb_var_screeninfo *var, struct fb_info *info) u_int y_bottom = var->yoffset; if (!(var->vmode & FB_VMODE_YWRAP)) - y_bottom += var->yres; + y_bottom += info->var.yres; - if (y_bottom > var->yres_virtual) + if (y_bottom > info->var.yres_virtual) return -EINVAL; acornfb_update_dma(info, var); From a35a9b79dd44b36b688c493610dfbbdb42aff136 Mon Sep 17 00:00:00 2001 From: Laurent Pinchart Date: Wed, 25 May 2011 11:34:52 +0200 Subject: [PATCH 04/29] arkfb: use display information in info not in var for panning We must not use any information in the passed var besides xoffset, yoffset and vmode as otherwise applications might abuse it. Signed-off-by: Laurent Pinchart --- drivers/video/arkfb.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/drivers/video/arkfb.c b/drivers/video/arkfb.c index 8686429cbdf0..555dd4c64f5b 100644 --- a/drivers/video/arkfb.c +++ b/drivers/video/arkfb.c @@ -908,13 +908,14 @@ static int arkfb_pan_display(struct fb_var_screeninfo *var, struct fb_info *info unsigned int offset; /* Calculate the offset */ - if (var->bits_per_pixel == 0) { - offset = (var->yoffset / 16) * (var->xres_virtual / 2) + (var->xoffset / 2); + if (info->var.bits_per_pixel == 0) { + offset = (var->yoffset / 16) * (info->var.xres_virtual / 2) + + (var->xoffset / 2); offset = offset >> 2; } else { offset = (var->yoffset * info->fix.line_length) + - (var->xoffset * var->bits_per_pixel / 8); - offset = offset >> ((var->bits_per_pixel == 4) ? 2 : 3); + (var->xoffset * info->var.bits_per_pixel / 8); + offset = offset >> ((info->var.bits_per_pixel == 4) ? 2 : 3); } /* Set the offset */ From b3e9c12949c1e66f3190e430ad096e53df4e1328 Mon Sep 17 00:00:00 2001 From: Laurent Pinchart Date: Wed, 25 May 2011 11:34:52 +0200 Subject: [PATCH 05/29] atmel_lcdfb: use display information in info not in var for panning We must not use any information in the passed var besides xoffset, yoffset and vmode as otherwise applications might abuse it. Signed-off-by: Laurent Pinchart Acked-by: Nicolas Ferre Reviewed-by: Wolfram Sang --- drivers/video/atmel_lcdfb.c | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) diff --git a/drivers/video/atmel_lcdfb.c b/drivers/video/atmel_lcdfb.c index 817ab60f7537..244d55b7c0ae 100644 --- a/drivers/video/atmel_lcdfb.c +++ b/drivers/video/atmel_lcdfb.c @@ -39,7 +39,8 @@ | FBINFO_HWACCEL_YPAN) static inline void atmel_lcdfb_update_dma2d(struct atmel_lcdfb_info *sinfo, - struct fb_var_screeninfo *var) + struct fb_var_screeninfo *var, + struct fb_info *info) { } @@ -50,14 +51,16 @@ static inline void atmel_lcdfb_update_dma2d(struct atmel_lcdfb_info *sinfo, | FBINFO_HWACCEL_YPAN) static void atmel_lcdfb_update_dma2d(struct atmel_lcdfb_info *sinfo, - struct fb_var_screeninfo *var) + struct fb_var_screeninfo *var, + struct fb_info *info) { u32 dma2dcfg; u32 pixeloff; - pixeloff = (var->xoffset * var->bits_per_pixel) & 0x1f; + pixeloff = (var->xoffset * info->var.bits_per_pixel) & 0x1f; - dma2dcfg = ((var->xres_virtual - var->xres) * var->bits_per_pixel) / 8; + dma2dcfg = (info->var.xres_virtual - info->var.xres) + * info->var.bits_per_pixel / 8; dma2dcfg |= pixeloff << ATMEL_LCDC_PIXELOFF_OFFSET; lcdc_writel(sinfo, ATMEL_LCDC_DMA2DCFG, dma2dcfg); @@ -249,14 +252,14 @@ static void atmel_lcdfb_update_dma(struct fb_info *info, unsigned long dma_addr; dma_addr = (fix->smem_start + var->yoffset * fix->line_length - + var->xoffset * var->bits_per_pixel / 8); + + var->xoffset * info->var.bits_per_pixel / 8); dma_addr &= ~3UL; /* Set framebuffer DMA base address and pixel offset */ lcdc_writel(sinfo, ATMEL_LCDC_DMABADDR1, dma_addr); - atmel_lcdfb_update_dma2d(sinfo, var); + atmel_lcdfb_update_dma2d(sinfo, var, info); } static inline void atmel_lcdfb_free_video_memory(struct atmel_lcdfb_info *sinfo) From 0e03f856d2383a5428cf6de516b73d2b40841ced Mon Sep 17 00:00:00 2001 From: Laurent Pinchart Date: Wed, 25 May 2011 11:34:52 +0200 Subject: [PATCH 06/29] radeonfb: use display information in info not in var for panning We must not use any information in the passed var besides xoffset, yoffset and vmode as otherwise applications might abuse it. Also use the aligned fix.line_length and not the (possible) unaligned xres_virtual. Signed-off-by: Laurent Pinchart --- drivers/video/aty/radeon_base.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/drivers/video/aty/radeon_base.c b/drivers/video/aty/radeon_base.c index 32f8cf6200a7..150684882ef7 100644 --- a/drivers/video/aty/radeon_base.c +++ b/drivers/video/aty/radeon_base.c @@ -845,16 +845,16 @@ static int radeonfb_pan_display (struct fb_var_screeninfo *var, { struct radeonfb_info *rinfo = info->par; - if ((var->xoffset + var->xres > var->xres_virtual) - || (var->yoffset + var->yres > var->yres_virtual)) - return -EINVAL; + if ((var->xoffset + info->var.xres > info->var.xres_virtual) + || (var->yoffset + info->var.yres > info->var.yres_virtual)) + return -EINVAL; if (rinfo->asleep) return 0; radeon_fifo_wait(2); - OUTREG(CRTC_OFFSET, ((var->yoffset * var->xres_virtual + var->xoffset) - * var->bits_per_pixel / 8) & ~7); + OUTREG(CRTC_OFFSET, (var->yoffset * info->fix.line_length + + var->xoffset * info->var.bits_per_pixel / 8) & ~7); return 0; } From 8b76c6827991858a52841b6c20fea91a12499d6f Mon Sep 17 00:00:00 2001 From: Laurent Pinchart Date: Wed, 25 May 2011 11:34:52 +0200 Subject: [PATCH 07/29] fbdev: da8xx: use display information in info not in var for panning We must not use any information in the passed var besides xoffset, yoffset and vmode as otherwise applications might abuse it. Signed-off-by: Laurent Pinchart --- drivers/video/da8xx-fb.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/video/da8xx-fb.c b/drivers/video/da8xx-fb.c index fcdac872522d..8d4e4ebd9977 100644 --- a/drivers/video/da8xx-fb.c +++ b/drivers/video/da8xx-fb.c @@ -877,8 +877,8 @@ static int da8xx_pan_display(struct fb_var_screeninfo *var, start = fix->smem_start + new_var.yoffset * fix->line_length + - new_var.xoffset * var->bits_per_pixel / 8; - end = start + var->yres * fix->line_length - 1; + new_var.xoffset * fbi->var.bits_per_pixel / 8; + end = start + fbi->var.yres * fix->line_length - 1; par->dma_start = start; par->dma_end = end; } From 465cb7e700e8564fd2d76d5c7f3703eb07659617 Mon Sep 17 00:00:00 2001 From: Laurent Pinchart Date: Wed, 25 May 2011 11:34:52 +0200 Subject: [PATCH 08/29] fbdev: unicore32: use display information in info not in var for panning We must not use any information in the passed var besides xoffset, yoffset and vmode as otherwise applications might abuse it. Signed-off-by: Laurent Pinchart Tested-by: Guan Xuetao Acked-by: Guan Xuetao --- drivers/video/fb-puv3.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/video/fb-puv3.c b/drivers/video/fb-puv3.c index 27f2c57e06e9..60a787fa32cf 100644 --- a/drivers/video/fb-puv3.c +++ b/drivers/video/fb-puv3.c @@ -624,8 +624,8 @@ static int unifb_pan_display(struct fb_var_screeninfo *var, || var->xoffset) return -EINVAL; } else { - if (var->xoffset + var->xres > info->var.xres_virtual || - var->yoffset + var->yres > info->var.yres_virtual) + if (var->xoffset + info->var.xres > info->var.xres_virtual || + var->yoffset + info->var.yres > info->var.yres_virtual) return -EINVAL; } info->var.xoffset = var->xoffset; From d8344e090c5adff3290925cbb040d20133b7f586 Mon Sep 17 00:00:00 2001 From: Laurent Pinchart Date: Wed, 25 May 2011 11:34:52 +0200 Subject: [PATCH 09/29] g364fb: use display information in info not in var for panning We must not use any information in the passed var besides xoffset, yoffset and vmode as otherwise applications might abuse it. Signed-off-by: Laurent Pinchart --- drivers/video/g364fb.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/video/g364fb.c b/drivers/video/g364fb.c index d662317d85e3..223896cc5f7d 100644 --- a/drivers/video/g364fb.c +++ b/drivers/video/g364fb.c @@ -149,10 +149,11 @@ int g364fb_cursor(struct fb_info *info, struct fb_cursor *cursor) static int g364fb_pan_display(struct fb_var_screeninfo *var, struct fb_info *info) { - if (var->xoffset || var->yoffset + var->yres > var->yres_virtual) + if (var->xoffset || + var->yoffset + info->var.yres > info->var.yres_virtual) return -EINVAL; - *(unsigned int *) TOP_REG = var->yoffset * var->xres; + *(unsigned int *) TOP_REG = var->yoffset * info->var.xres; return 0; } From 1d4b695fa32b707b40fe2dab6a21a39bd91f4615 Mon Sep 17 00:00:00 2001 From: Laurent Pinchart Date: Wed, 25 May 2011 11:34:52 +0200 Subject: [PATCH 10/29] gxt4500: use display information in info not in var for panning We must not use any information in the passed var besides xoffset, yoffset and vmode as otherwise applications might abuse it. Signed-off-by: Laurent Pinchart --- drivers/video/gxt4500.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/video/gxt4500.c b/drivers/video/gxt4500.c index 896e53dea906..0fad23f810a3 100644 --- a/drivers/video/gxt4500.c +++ b/drivers/video/gxt4500.c @@ -543,8 +543,8 @@ static int gxt4500_pan_display(struct fb_var_screeninfo *var, if (var->xoffset & 7) return -EINVAL; - if (var->xoffset + var->xres > var->xres_virtual || - var->yoffset + var->yres > var->yres_virtual) + if (var->xoffset + info->var.xres > info->var.xres_virtual || + var->yoffset + info->var.yres > info->var.yres_virtual) return -EINVAL; writereg(par, REFRESH_START, (var->xoffset << 16) | var->yoffset); From 7b116e54920ff9b8bf082fb3c371187ed075ac38 Mon Sep 17 00:00:00 2001 From: Laurent Pinchart Date: Wed, 25 May 2011 11:34:52 +0200 Subject: [PATCH 11/29] hgafb: use display information in info not in var for panning We must not use any information in the passed var besides xoffset, yoffset and vmode as otherwise applications might abuse it. Signed-off-by: Laurent Pinchart --- drivers/video/hgafb.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/video/hgafb.c b/drivers/video/hgafb.c index 4052718eefaa..4394389caf68 100644 --- a/drivers/video/hgafb.c +++ b/drivers/video/hgafb.c @@ -422,8 +422,8 @@ static int hgafb_pan_display(struct fb_var_screeninfo *var, var->xoffset) return -EINVAL; } else { - if (var->xoffset + var->xres > info->var.xres_virtual - || var->yoffset + var->yres > info->var.yres_virtual + if (var->xoffset + info->var.xres > info->var.xres_virtual + || var->yoffset + info->var.yres > info->var.yres_virtual || var->yoffset % 8) return -EINVAL; } From 09a9168d4c3f3bf3b0f9306966379df500f201d2 Mon Sep 17 00:00:00 2001 From: Laurent Pinchart Date: Wed, 25 May 2011 11:34:52 +0200 Subject: [PATCH 12/29] imsttfb: use display information in info not in var for panning We must not use any information in the passed var besides xoffset, yoffset and vmode as otherwise applications might abuse it. Signed-off-by: Laurent Pinchart --- drivers/video/imsttfb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/video/imsttfb.c b/drivers/video/imsttfb.c index efb2c10656b0..8149356471e4 100644 --- a/drivers/video/imsttfb.c +++ b/drivers/video/imsttfb.c @@ -749,7 +749,7 @@ set_offset (struct fb_var_screeninfo *var, struct fb_info *info) { struct imstt_par *par = info->par; __u32 off = var->yoffset * (info->fix.line_length >> 3) - + ((var->xoffset * (var->bits_per_pixel >> 3)) >> 3); + + ((var->xoffset * (info->var.bits_per_pixel >> 3)) >> 3); write_reg_le32(par->dc_regs, SSR, off); } From f5b9cc6a66feee205609ef98b1f5a51168c26b74 Mon Sep 17 00:00:00 2001 From: Laurent Pinchart Date: Wed, 25 May 2011 11:34:52 +0200 Subject: [PATCH 13/29] intelfb: use display information in info not in var for panning We must not use any information in the passed var besides xoffset, yoffset and vmode as otherwise applications might abuse it. Signed-off-by: Laurent Pinchart --- drivers/video/intelfb/intelfbhw.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/video/intelfb/intelfbhw.c b/drivers/video/intelfb/intelfbhw.c index 38065cf94ac4..fbad61da359f 100644 --- a/drivers/video/intelfb/intelfbhw.c +++ b/drivers/video/intelfb/intelfbhw.c @@ -390,12 +390,12 @@ int intelfbhw_pan_display(struct fb_var_screeninfo *var, struct fb_info *info) xoffset = ROUND_DOWN_TO(var->xoffset, 8); yoffset = var->yoffset; - if ((xoffset + var->xres > var->xres_virtual) || - (yoffset + var->yres > var->yres_virtual)) + if ((xoffset + info->var.xres > info->var.xres_virtual) || + (yoffset + info->var.yres > info->var.yres_virtual)) return -EINVAL; offset = (yoffset * dinfo->pitch) + - (xoffset * var->bits_per_pixel) / 8; + (xoffset * info->var.bits_per_pixel) / 8; offset += dinfo->fb.offset << 12; From 23dc8b1c07f75427510d56fa7c263dd1371ec2e4 Mon Sep 17 00:00:00 2001 From: Laurent Pinchart Date: Wed, 25 May 2011 11:34:52 +0200 Subject: [PATCH 14/29] mb862xxfb: use display information in info not in var for panning We must not use any information in the passed var besides xoffset, yoffset and vmode as otherwise applications might abuse it. Signed-off-by: Laurent Pinchart --- drivers/video/mb862xx/mb862xxfbdrv.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/video/mb862xx/mb862xxfbdrv.c b/drivers/video/mb862xx/mb862xxfbdrv.c index ee1de3e26dec..7a1f2773cf38 100644 --- a/drivers/video/mb862xx/mb862xxfbdrv.c +++ b/drivers/video/mb862xx/mb862xxfbdrv.c @@ -278,7 +278,7 @@ static int mb862xxfb_pan(struct fb_var_screeninfo *var, reg = pack(var->yoffset, var->xoffset); outreg(disp, GC_L0WY_L0WX, reg); - reg = pack(var->yres_virtual, var->xres_virtual); + reg = pack(info->var.yres_virtual, info->var.xres_virtual); outreg(disp, GC_L0WH_L0WW, reg); return 0; } From 9f1b3ebbce04dc61986a1b3b41b0f1b1a77a5cc4 Mon Sep 17 00:00:00 2001 From: Laurent Pinchart Date: Wed, 25 May 2011 11:34:52 +0200 Subject: [PATCH 15/29] mx3fb: use display information in info not in var for panning We must not use any information in the passed var besides xoffset, yoffset and vmode as otherwise applications might abuse it. Also use the aligned fix.line_length and not the (possible) unaligned xres_virtual. Signed-off-by: Laurent Pinchart Tested-by: Guennadi Liakhovetski --- drivers/video/mx3fb.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/video/mx3fb.c b/drivers/video/mx3fb.c index 7e3a490e8d76..bd768588cf10 100644 --- a/drivers/video/mx3fb.c +++ b/drivers/video/mx3fb.c @@ -1062,15 +1062,15 @@ static int mx3fb_pan_display(struct fb_var_screeninfo *var, y_bottom = var->yoffset; if (!(var->vmode & FB_VMODE_YWRAP)) - y_bottom += var->yres; + y_bottom += fbi->var.yres; if (y_bottom > fbi->var.yres_virtual) return -EINVAL; mutex_lock(&mx3_fbi->mutex); - offset = (var->yoffset * var->xres_virtual + var->xoffset) * - (var->bits_per_pixel / 8); + offset = var->yoffset * fbi->fix.line_length + + var->xoffset * (fbi->var.bits_per_pixel / 8); base = fbi->fix.smem_start + offset; dev_dbg(fbi->device, "Updating SDC BG buf %d address=0x%08lX\n", From 4935ebf43cedadcaffa56cd59449c8b6dda6d507 Mon Sep 17 00:00:00 2001 From: Laurent Pinchart Date: Wed, 25 May 2011 11:34:52 +0200 Subject: [PATCH 16/29] neofb: use display information in info not in var for panning We must not use any information in the passed var besides xoffset, yoffset and vmode as otherwise applications might abuse it. Signed-off-by: Laurent Pinchart --- drivers/video/neofb.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/video/neofb.c b/drivers/video/neofb.c index 588527a254c2..feea7b1dc386 100644 --- a/drivers/video/neofb.c +++ b/drivers/video/neofb.c @@ -1185,8 +1185,8 @@ static int neofb_pan_display(struct fb_var_screeninfo *var, DBG("neofb_update_start"); - Base = (var->yoffset * var->xres_virtual + var->xoffset) >> 2; - Base *= (var->bits_per_pixel + 7) / 8; + Base = (var->yoffset * info->var.xres_virtual + var->xoffset) >> 2; + Base *= (info->var.bits_per_pixel + 7) / 8; neoUnlock(); From 3bb8c31dea4f4fe41c954e1a02ac3cdd8ee6747f Mon Sep 17 00:00:00 2001 From: Laurent Pinchart Date: Wed, 25 May 2011 11:34:52 +0200 Subject: [PATCH 17/29] pm2fb: use display information in info not in var for panning We must not use any information in the passed var besides xoffset, yoffset and vmode as otherwise applications might abuse it. Signed-off-by: Laurent Pinchart --- drivers/video/pm2fb.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/video/pm2fb.c b/drivers/video/pm2fb.c index 27f93aab6ddc..f4f8ce802d02 100644 --- a/drivers/video/pm2fb.c +++ b/drivers/video/pm2fb.c @@ -973,8 +973,8 @@ static int pm2fb_pan_display(struct fb_var_screeninfo *var, { struct pm2fb_par *p = info->par; u32 base; - u32 depth = (var->bits_per_pixel + 7) & ~7; - u32 xres = (var->xres + 31) & ~31; + u32 depth = (info->var.bits_per_pixel + 7) & ~7; + u32 xres = (info->var.xres + 31) & ~31; depth = (depth > 32) ? 32 : depth; base = to3264(var->yoffset * xres + var->xoffset, depth, 1); From 01cba946e38eaa7071fd6fc756eedeecfcec3dd6 Mon Sep 17 00:00:00 2001 From: Laurent Pinchart Date: Wed, 25 May 2011 11:34:52 +0200 Subject: [PATCH 18/29] pm3fb: use display information in info not in var for panning We must not use any information in the passed var besides xoffset, yoffset and vmode as otherwise applications might abuse it. Signed-off-by: Laurent Pinchart --- drivers/video/pm3fb.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/video/pm3fb.c b/drivers/video/pm3fb.c index 6666f45a2f8c..8221b5b42da9 100644 --- a/drivers/video/pm3fb.c +++ b/drivers/video/pm3fb.c @@ -1147,9 +1147,9 @@ static int pm3fb_pan_display(struct fb_var_screeninfo *var, struct fb_info *info) { struct pm3_par *par = info->par; - const u32 xres = (var->xres + 31) & ~31; + const u32 xres = (info->var.xres + 31) & ~31; - par->base = pm3fb_shift_bpp(var->bits_per_pixel, + par->base = pm3fb_shift_bpp(info->var.bits_per_pixel, (var->yoffset * xres) + var->xoffset); PM3_WAIT(par, 1); From d8e7a74bf1f1c3d8235e1d939d3e1e96da94ed82 Mon Sep 17 00:00:00 2001 From: Laurent Pinchart Date: Wed, 25 May 2011 11:34:52 +0200 Subject: [PATCH 19/29] s3c-fb: use display information in info not in var for panning We must not use any information in the passed var besides xoffset, yoffset and vmode as otherwise applications might abuse it. Signed-off-by: Laurent Pinchart Acked-by: Jingoo Han --- drivers/video/s3c-fb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/video/s3c-fb.c b/drivers/video/s3c-fb.c index 4aecf213c9be..fd9f20df912f 100644 --- a/drivers/video/s3c-fb.c +++ b/drivers/video/s3c-fb.c @@ -883,7 +883,7 @@ static int s3c_fb_pan_display(struct fb_var_screeninfo *var, } } /* Offset in bytes to the end of the displayed area */ - end_boff = start_boff + var->yres * info->fix.line_length; + end_boff = start_boff + info->var.yres * info->fix.line_length; /* Temporarily turn off per-vsync update from shadow registers until * both start and end addresses are updated to prevent corruption */ From 305e0e4dbcd038625786a40e9fa801ba5b18b2a2 Mon Sep 17 00:00:00 2001 From: Laurent Pinchart Date: Wed, 25 May 2011 11:34:52 +0200 Subject: [PATCH 20/29] s3fb: use display information in info not in var for panning We must not use any information in the passed var besides xoffset, yoffset and vmode as otherwise applications might abuse it. Signed-off-by: Laurent Pinchart --- drivers/video/s3fb.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/drivers/video/s3fb.c b/drivers/video/s3fb.c index 4ca5d0c8fe84..0f9af1aa5077 100644 --- a/drivers/video/s3fb.c +++ b/drivers/video/s3fb.c @@ -1019,12 +1019,13 @@ static int s3fb_pan_display(struct fb_var_screeninfo *var, struct fb_info *info) unsigned int offset; /* Calculate the offset */ - if (var->bits_per_pixel == 0) { - offset = (var->yoffset / 16) * (var->xres_virtual / 2) + (var->xoffset / 2); + if (info->var.bits_per_pixel == 0) { + offset = (var->yoffset / 16) * (info->var.xres_virtual / 2) + + (var->xoffset / 2); offset = offset >> 2; } else { offset = (var->yoffset * info->fix.line_length) + - (var->xoffset * var->bits_per_pixel / 8); + (var->xoffset * info->var.bits_per_pixel / 8); offset = offset >> 2; } From e1599cf8c7ab93cb4bbd67516f5c989211335df1 Mon Sep 17 00:00:00 2001 From: Laurent Pinchart Date: Wed, 25 May 2011 11:34:52 +0200 Subject: [PATCH 21/29] savagefb: use display information in info not in var for panning We must not use any information in the passed var besides xoffset, yoffset and vmode as otherwise applications might abuse it. Also use the aligned fix.line_length and not the (possible) unaligned xres_virtual. Signed-off-by: Laurent Pinchart Reviewed-by: Tormod Volden --- drivers/video/savage/savagefb_driver.c | 16 +++++++--------- 1 file changed, 7 insertions(+), 9 deletions(-) diff --git a/drivers/video/savage/savagefb_driver.c b/drivers/video/savage/savagefb_driver.c index 4de541ca9c52..beb495044b24 100644 --- a/drivers/video/savage/savagefb_driver.c +++ b/drivers/video/savage/savagefb_driver.c @@ -1477,15 +1477,9 @@ static void savagefb_set_par_int(struct savagefb_par *par, struct savage_reg *r vgaHWProtect(par, 0); } -static void savagefb_update_start(struct savagefb_par *par, - struct fb_var_screeninfo *var) +static void savagefb_update_start(struct savagefb_par *par, int base) { - int base; - - base = ((var->yoffset * var->xres_virtual + (var->xoffset & ~1)) - * ((var->bits_per_pixel+7) / 8)) >> 2; - - /* now program the start address registers */ + /* program the start address registers */ vga_out16(0x3d4, (base & 0x00ff00) | 0x0c, par); vga_out16(0x3d4, ((base & 0x00ff) << 8) | 0x0d, par); vga_out8(0x3d4, 0x69, par); @@ -1550,8 +1544,12 @@ static int savagefb_pan_display(struct fb_var_screeninfo *var, struct fb_info *info) { struct savagefb_par *par = info->par; + int base; - savagefb_update_start(par, var); + base = (var->yoffset * info->fix.line_length + + (var->xoffset & ~1) * ((info->var.bits_per_pixel+7) / 8)) >> 2; + + savagefb_update_start(par, base); return 0; } From 8e42a962a279369ba3e6a25f321c7cd4d471e633 Mon Sep 17 00:00:00 2001 From: Laurent Pinchart Date: Wed, 25 May 2011 11:34:52 +0200 Subject: [PATCH 22/29] sisfb: use display information in info not in var for panning We must not use any information in the passed var besides xoffset, yoffset and vmode as otherwise applications might abuse it. Fix checkpatch.pl warnings in the surrounding code. Signed-off-by: Laurent Pinchart --- drivers/video/sis/sis_main.c | 30 ++++++++++-------------------- 1 file changed, 10 insertions(+), 20 deletions(-) diff --git a/drivers/video/sis/sis_main.c b/drivers/video/sis/sis_main.c index 75259845933d..078ca2167d6f 100644 --- a/drivers/video/sis/sis_main.c +++ b/drivers/video/sis/sis_main.c @@ -1333,19 +1333,14 @@ sisfb_set_base_CRT2(struct sis_video_info *ivideo, unsigned int base) } static int -sisfb_pan_var(struct sis_video_info *ivideo, struct fb_var_screeninfo *var) +sisfb_pan_var(struct sis_video_info *ivideo, struct fb_info *info, + struct fb_var_screeninfo *var) { - if(var->xoffset > (var->xres_virtual - var->xres)) { - return -EINVAL; - } - if(var->yoffset > (var->yres_virtual - var->yres)) { - return -EINVAL; - } - - ivideo->current_base = (var->yoffset * var->xres_virtual) + var->xoffset; + ivideo->current_base = var->yoffset * info->var.xres_virtual + + var->xoffset; /* calculate base bpp dep. */ - switch(var->bits_per_pixel) { + switch (info->var.bits_per_pixel) { case 32: break; case 16: @@ -1635,20 +1630,15 @@ sisfb_pan_display(struct fb_var_screeninfo *var, struct fb_info* info) struct sis_video_info *ivideo = (struct sis_video_info *)info->par; int err; - if(var->xoffset > (var->xres_virtual - var->xres)) + if (var->vmode & FB_VMODE_YWRAP) return -EINVAL; - if(var->yoffset > (var->yres_virtual - var->yres)) + if (var->xoffset + info->var.xres > info->var.xres_virtual || + var->yoffset + info->var.yres > info->var.yres_virtual) return -EINVAL; - if(var->vmode & FB_VMODE_YWRAP) - return -EINVAL; - - if(var->xoffset + info->var.xres > info->var.xres_virtual || - var->yoffset + info->var.yres > info->var.yres_virtual) - return -EINVAL; - - if((err = sisfb_pan_var(ivideo, var)) < 0) + err = sisfb_pan_var(ivideo, info, var); + if (err < 0) return err; info->var.xoffset = var->xoffset; From 0aa76b0ce163f929b4e8f41331073814b0ef8612 Mon Sep 17 00:00:00 2001 From: Laurent Pinchart Date: Wed, 25 May 2011 11:34:52 +0200 Subject: [PATCH 23/29] sm501fb: use display information in info not in var for panning We must not use any information in the passed var besides xoffset, yoffset and vmode as otherwise applications might abuse it. Signed-off-by: Laurent Pinchart --- drivers/video/sm501fb.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/video/sm501fb.c b/drivers/video/sm501fb.c index 6294dca95500..a78254cf8e83 100644 --- a/drivers/video/sm501fb.c +++ b/drivers/video/sm501fb.c @@ -582,7 +582,7 @@ static int sm501fb_pan_crt(struct fb_var_screeninfo *var, { struct sm501fb_par *par = info->par; struct sm501fb_info *fbi = par->info; - unsigned int bytes_pixel = var->bits_per_pixel / 8; + unsigned int bytes_pixel = info->var.bits_per_pixel / 8; unsigned long reg; unsigned long xoffs; @@ -614,10 +614,10 @@ static int sm501fb_pan_pnl(struct fb_var_screeninfo *var, struct sm501fb_info *fbi = par->info; unsigned long reg; - reg = var->xoffset | (var->xres_virtual << 16); + reg = var->xoffset | (info->var.xres_virtual << 16); smc501_writel(reg, fbi->regs + SM501_DC_PANEL_FB_WIDTH); - reg = var->yoffset | (var->yres_virtual << 16); + reg = var->yoffset | (info->var.yres_virtual << 16); smc501_writel(reg, fbi->regs + SM501_DC_PANEL_FB_HEIGHT); sm501fb_sync_regs(fbi); From 4541dbe154c0703cf47c43389b3544884f5f3522 Mon Sep 17 00:00:00 2001 From: Laurent Pinchart Date: Wed, 25 May 2011 11:34:52 +0200 Subject: [PATCH 24/29] tridentfb: use display information in info not in var for panning We must not use any information in the passed var besides xoffset, yoffset and vmode as otherwise applications might abuse it. Signed-off-by: Laurent Pinchart --- drivers/video/tridentfb.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/video/tridentfb.c b/drivers/video/tridentfb.c index c6c77562839d..34cf019bba44 100644 --- a/drivers/video/tridentfb.c +++ b/drivers/video/tridentfb.c @@ -987,8 +987,8 @@ static int tridentfb_pan_display(struct fb_var_screeninfo *var, unsigned int offset; debug("enter\n"); - offset = (var->xoffset + (var->yoffset * var->xres_virtual)) - * var->bits_per_pixel / 32; + offset = (var->xoffset + (var->yoffset * info->var.xres_virtual)) + * info->var.bits_per_pixel / 32; set_screen_start(par, offset); debug("exit\n"); return 0; From 2883cebabbc4efc00408024d284a0230ad3af8a0 Mon Sep 17 00:00:00 2001 From: Laurent Pinchart Date: Wed, 25 May 2011 11:34:52 +0200 Subject: [PATCH 25/29] vfb: use display information in info not in var for panning We must not use any information in the passed var besides xoffset, yoffset and vmode as otherwise applications might abuse it. Signed-off-by: Laurent Pinchart --- drivers/video/vfb.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/video/vfb.c b/drivers/video/vfb.c index bc67251f1a2f..bf2f78065cf9 100644 --- a/drivers/video/vfb.c +++ b/drivers/video/vfb.c @@ -395,8 +395,8 @@ static int vfb_pan_display(struct fb_var_screeninfo *var, || var->xoffset) return -EINVAL; } else { - if (var->xoffset + var->xres > info->var.xres_virtual || - var->yoffset + var->yres > info->var.yres_virtual) + if (var->xoffset + info->var.xres > info->var.xres_virtual || + var->yoffset + info->var.yres > info->var.yres_virtual) return -EINVAL; } info->var.xoffset = var->xoffset; From c272d64111c4fdc0b6a2122452e98a3315bd6b4b Mon Sep 17 00:00:00 2001 From: Laurent Pinchart Date: Wed, 25 May 2011 11:34:52 +0200 Subject: [PATCH 26/29] vga16fb: use display information in info not in var for panning We must not use any information in the passed var besides xoffset, yoffset and vmode as otherwise applications might abuse it. Signed-off-by: Laurent Pinchart --- drivers/video/vga16fb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/video/vga16fb.c b/drivers/video/vga16fb.c index 305c975b1787..0267acd8dc83 100644 --- a/drivers/video/vga16fb.c +++ b/drivers/video/vga16fb.c @@ -207,7 +207,7 @@ static void vga16fb_pan_var(struct fb_info *info, * granularity if someone supports xoffset in bit resolution */ vga_io_r(VGA_IS1_RC); /* reset flip-flop */ vga_io_w(VGA_ATT_IW, VGA_ATC_PEL); - if (var->bits_per_pixel == 8) + if (info->var.bits_per_pixel == 8) vga_io_w(VGA_ATT_IW, (xoffset & 3) << 1); else vga_io_w(VGA_ATT_IW, xoffset & 7); From 8f0246d6287fbb37c05b7983ff61c7f57ad86a92 Mon Sep 17 00:00:00 2001 From: Laurent Pinchart Date: Wed, 25 May 2011 11:34:52 +0200 Subject: [PATCH 27/29] vt8500lcdfb: use display information in info not in var for panning We must not use any information in the passed var besides xoffset, yoffset and vmode as otherwise applications might abuse it. Signed-off-by: Laurent Pinchart --- drivers/video/vt8500lcdfb.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/video/vt8500lcdfb.c b/drivers/video/vt8500lcdfb.c index 0e120d67eb65..c13c246be9a5 100644 --- a/drivers/video/vt8500lcdfb.c +++ b/drivers/video/vt8500lcdfb.c @@ -210,8 +210,8 @@ static int vt8500lcd_pan_display(struct fb_var_screeninfo *var, struct vt8500lcd_info *fbi = to_vt8500lcd_info(info); writel((1 << 31) - | (((var->xres_virtual - var->xres) * pixlen / 4) << 20) - | (off >> 2), fbi->regbase + 0x20); + | (((info->var.xres_virtual - info->var.xres) * pixlen / 4) << 20) + | (off >> 2), fbi->regbase + 0x20); return 0; } From 10a6c1de2ca2761f87c9bd62ab882577a80995f1 Mon Sep 17 00:00:00 2001 From: Laurent Pinchart Date: Wed, 25 May 2011 11:34:52 +0200 Subject: [PATCH 28/29] vt8623fb: use display information in info not in var for panning We must not use any information in the passed var besides xoffset, yoffset and vmode as otherwise applications might abuse it. Signed-off-by: Laurent Pinchart --- drivers/video/vt8623fb.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/drivers/video/vt8623fb.c b/drivers/video/vt8623fb.c index f9b3e3dc2421..4e74d262cf3e 100644 --- a/drivers/video/vt8623fb.c +++ b/drivers/video/vt8623fb.c @@ -620,13 +620,14 @@ static int vt8623fb_pan_display(struct fb_var_screeninfo *var, struct fb_info *i unsigned int offset; /* Calculate the offset */ - if (var->bits_per_pixel == 0) { - offset = (var->yoffset / 16) * var->xres_virtual + var->xoffset; + if (info->var.bits_per_pixel == 0) { + offset = (var->yoffset / 16) * info->var.xres_virtual + + var->xoffset; offset = offset >> 3; } else { offset = (var->yoffset * info->fix.line_length) + - (var->xoffset * var->bits_per_pixel / 8); - offset = offset >> ((var->bits_per_pixel == 4) ? 2 : 1); + (var->xoffset * info->var.bits_per_pixel / 8); + offset = offset >> ((info->var.bits_per_pixel == 4) ? 2 : 1); } /* Set the offset */ From 0d5c6ca30bb0190c0a63fd6452c71051fb6bfbe4 Mon Sep 17 00:00:00 2001 From: Laurent Pinchart Date: Wed, 25 May 2011 11:34:52 +0200 Subject: [PATCH 29/29] staging: xgifb: use display information in info not in var for panning We must not use any information in the passed var besides xoffset, yoffset and vmode as otherwise applications might abuse it. Signed-off-by: Laurent Pinchart --- drivers/staging/xgifb/XGI_main_26.c | 22 ++++++---------------- 1 file changed, 6 insertions(+), 16 deletions(-) diff --git a/drivers/staging/xgifb/XGI_main_26.c b/drivers/staging/xgifb/XGI_main_26.c index 4403e5f80597..f8b88add9520 100644 --- a/drivers/staging/xgifb/XGI_main_26.c +++ b/drivers/staging/xgifb/XGI_main_26.c @@ -1364,26 +1364,16 @@ static int XGIfb_do_set_var(struct fb_var_screeninfo *var, int isactive, } #ifdef XGIFB_PAN -static int XGIfb_pan_var(struct fb_var_screeninfo *var) +static int XGIfb_pan_var(struct fb_var_screeninfo *var, struct fb_info *info) { unsigned int base; /* printk("Inside pan_var"); */ - if (var->xoffset > (var->xres_virtual - var->xres)) { - /* printk("Pan: xo: %d xv %d xr %d\n", - var->xoffset, var->xres_virtual, var->xres); */ - return -EINVAL; - } - if (var->yoffset > (var->yres_virtual - var->yres)) { - /* printk("Pan: yo: %d yv %d yr %d\n", - var->yoffset, var->yres_virtual, var->yres); */ - return -EINVAL; - } - base = var->yoffset * var->xres_virtual + var->xoffset; + base = var->yoffset * info->var.xres_virtual + var->xoffset; /* calculate base bpp dep. */ - switch (var->bits_per_pixel) { + switch (info->var.bits_per_pixel) { case 16: base >>= 1; break; @@ -1681,9 +1671,9 @@ static int XGIfb_pan_display(struct fb_var_screeninfo *var, /* printk("\nInside pan_display:\n"); */ - if (var->xoffset > (var->xres_virtual - var->xres)) + if (var->xoffset > (info->var.xres_virtual - info->var.xres)) return -EINVAL; - if (var->yoffset > (var->yres_virtual - var->yres)) + if (var->yoffset > (info->var.yres_virtual - info->var.yres)) return -EINVAL; if (var->vmode & FB_VMODE_YWRAP) { @@ -1696,7 +1686,7 @@ static int XGIfb_pan_display(struct fb_var_screeninfo *var, > info->var.yres_virtual) return -EINVAL; } - err = XGIfb_pan_var(var); + err = XGIfb_pan_var(var, info); if (err < 0) return err;