diff --git a/sys/arch/alpha/alpha/trap.c b/sys/arch/alpha/alpha/trap.c index 613dea32940d..d8c37dfa8eb7 100644 --- a/sys/arch/alpha/alpha/trap.c +++ b/sys/arch/alpha/alpha/trap.c @@ -1,4 +1,4 @@ -/* $NetBSD: trap.c,v 1.88 2003/10/29 05:16:26 mycroft Exp $ */ +/* $NetBSD: trap.c,v 1.89 2003/11/13 03:09:28 chs Exp $ */ /*- * Copyright (c) 2000, 2001 The NetBSD Foundation, Inc. @@ -100,7 +100,7 @@ #include /* RCS ID & Copyright macro defns */ -__KERNEL_RCSID(0, "$NetBSD: trap.c,v 1.88 2003/10/29 05:16:26 mycroft Exp $"); +__KERNEL_RCSID(0, "$NetBSD: trap.c,v 1.89 2003/11/13 03:09:28 chs Exp $"); #include #include @@ -872,14 +872,13 @@ struct unaligned_fixup_data { const char *type; /* opcode name */ int fixable; /* fixable, 0 if fixup not supported */ int size; /* size, 0 if unknown */ - int acc; /* useracc type; B_READ or B_WRITE */ }; -#define UNKNOWN() { "0x%lx", 0, 0, 0 } -#define FIX_LD(n,s) { n, 1, s, B_READ } -#define FIX_ST(n,s) { n, 1, s, B_WRITE } -#define NOFIX_LD(n,s) { n, 0, s, B_READ } -#define NOFIX_ST(n,s) { n, 0, s, B_WRITE } +#define UNKNOWN() { "0x%lx", 0, 0 } +#define FIX_LD(n,s) { n, 1, s } +#define FIX_ST(n,s) { n, 1, s } +#define NOFIX_LD(n,s) { n, 0, s } +#define NOFIX_ST(n,s) { n, 0, s } int unaligned_fixup(u_long va, u_long opcode, u_long reg, struct lwp *l) @@ -942,21 +941,6 @@ unaligned_fixup(u_long va, u_long opcode, u_long reg, struct lwp *l) else selected_tab = tab_unknown; - /* - * See if the user can access the memory in question. - * If it's an unknown opcode, we don't know whether to - * read or write, so we don't check. - * - * We adjust the PC backwards so that the instruction will - * be re-run. - */ - if (selected_tab->size != 0 && - !uvm_useracc((caddr_t)va, selected_tab->size, selected_tab->acc)) { - l->l_md.md_tf->tf_regs[FRAME_PC] -= 4; - signal = SIGSEGV; - goto out; - } - /* * If we're supposed to be noisy, squawk now. */ @@ -975,16 +959,16 @@ unaligned_fixup(u_long va, u_long opcode, u_long reg, struct lwp *l) /* * If we should try to fix it and know how, give it a shot. * - * We never allow bad data to be unknowingly used by the - * user process. That is, if we decide not to fix up an - * access we cause a SIGBUS rather than letting the user - * process go on without warning. + * We never allow bad data to be unknowingly used by the user process. + * That is, if we can't access the address needed to fix up the trap, + * we cause a SIGSEGV rather than letting the user process go on + * without warning. * * If we're trying to do a fixup, we assume that things * will be botched. If everything works out OK, * unaligned_{load,store}_* clears the signal flag. */ - signal = SIGBUS; + signal = SIGSEGV; if (dofix && selected_tab->fixable) { switch (opcode) { case 0x0c: /* ldwu */ @@ -1062,7 +1046,6 @@ unaligned_fixup(u_long va, u_long opcode, u_long reg, struct lwp *l) if (dosigbus) signal = SIGBUS; -out: /* * Write back USP. */ diff --git a/sys/arch/arm/iomd/vidcvideo.c b/sys/arch/arm/iomd/vidcvideo.c index 39b6b6699cfb..a4379ef8ba40 100644 --- a/sys/arch/arm/iomd/vidcvideo.c +++ b/sys/arch/arm/iomd/vidcvideo.c @@ -1,4 +1,4 @@ -/* $NetBSD: vidcvideo.c,v 1.19 2003/11/07 18:29:30 he Exp $ */ +/* $NetBSD: vidcvideo.c,v 1.20 2003/11/13 03:09:28 chs Exp $ */ /* * Copyright (c) 2001 Reinoud Zandijk @@ -36,7 +36,7 @@ #include /* RCS ID & Copyright macro defns */ -__KERNEL_RCSID(0, "$NetBSD: vidcvideo.c,v 1.19 2003/11/07 18:29:30 he Exp $"); +__KERNEL_RCSID(0, "$NetBSD: vidcvideo.c,v 1.20 2003/11/13 03:09:28 chs Exp $"); #include #include @@ -766,20 +766,19 @@ get_cmap(sc, p) struct wsdisplay_cmap *p; { u_int index = p->index, count = p->count; + int error; if (index >= CMAP_SIZE || count > CMAP_SIZE - index) return (EINVAL); - if (!uvm_useracc(p->red, count, B_WRITE) || - !uvm_useracc(p->green, count, B_WRITE) || - !uvm_useracc(p->blue, count, B_WRITE)) - return (EFAULT); - - copyout(&sc->sc_dc->dc_cmap.r[index], p->red, count); - copyout(&sc->sc_dc->dc_cmap.g[index], p->green, count); - copyout(&sc->sc_dc->dc_cmap.b[index], p->blue, count); - - return (0); + error = copyout(&sc->sc_dc->dc_cmap.r[index], p->red, count); + if (error) + return error; + error = copyout(&sc->sc_dc->dc_cmap.g[index], p->green, count); + if (error) + return error; + error = copyout(&sc->sc_dc->dc_cmap.b[index], p->blue, count); + return error; } @@ -789,19 +788,25 @@ set_cmap(sc, p) struct wsdisplay_cmap *p; { struct fb_devconfig *dc = sc->sc_dc; + struct hwcmap256 cmap; u_int index = p->index, count = p->count; + int error; if (index >= CMAP_SIZE || (index + count) > CMAP_SIZE) return (EINVAL); - if (!uvm_useracc(p->red, count, B_READ) || - !uvm_useracc(p->green, count, B_READ) || - !uvm_useracc(p->blue, count, B_READ)) - return (EFAULT); - - copyin(p->red, &dc->dc_cmap.r[index], count); - copyin(p->green, &dc->dc_cmap.g[index], count); - copyin(p->blue, &dc->dc_cmap.b[index], count); + error = copyin(p->red, &cmap.r[index], count); + if (error) + return error; + error = copyin(p->green, &cmap.g[index], count); + if (error) + return error; + error = copyin(p->blue, &cmap.b[index], count); + if (error) + return error; + memcpy(&dc->dc_cmap.r[index], &cmap.r[index], count); + memcpy(&dc->dc_cmap.g[index], &cmap.g[index], count); + memcpy(&dc->dc_cmap.b[index], &cmap.b[index], count); dc->dc_changed |= WSDISPLAY_CMAP_DOLUT; return (0); } @@ -814,7 +819,9 @@ set_cursor(sc, p) { #define cc (&dc->dc_cursor) struct fb_devconfig *dc = sc->sc_dc; - u_int v, index, count, icount; + u_int v, index = 0, count = 0, icount = 0; + uint8_t r[2], g[2], b[2], image[512], mask[512]; + int error; /* XXX gcc does not detect identical conditions */ index = count = icount = 0; @@ -823,20 +830,30 @@ set_cursor(sc, p) if (v & WSDISPLAY_CURSOR_DOCMAP) { index = p->cmap.index; count = p->cmap.count; - if (index >= CURSOR_MAX_COLOURS || (index + count) > CURSOR_MAX_COLOURS) + if (index >= CURSOR_MAX_COLOURS || + (index + count) > CURSOR_MAX_COLOURS) return (EINVAL); - if (!uvm_useracc(p->cmap.red, count, B_READ) || - !uvm_useracc(p->cmap.green, count, B_READ) || - !uvm_useracc(p->cmap.blue, count, B_READ)) - return (EFAULT); + error = copyin(p->cmap.red, &r[index], count); + if (error) + return error; + error = copyin(p->cmap.green, &g[index], count); + if (error) + return error; + error = copyin(p->cmap.blue, &b[index], count); + if (error) + return error; } if (v & WSDISPLAY_CURSOR_DOSHAPE) { - if (p->size.x > CURSOR_MAX_WIDTH || p->size.y > CURSOR_MAX_HEIGHT) + if (p->size.x > CURSOR_MAX_WIDTH || + p->size.y > CURSOR_MAX_HEIGHT) return (EINVAL); icount = sizeof(u_int32_t) * p->size.y; - if (!uvm_useracc(p->image, icount, B_READ) || - !uvm_useracc(p->mask, icount, B_READ)) - return (EFAULT); + error = copyin(p->image, &image, icount); + if (error) + return error; + error = copyin(p->mask, &mask, icount); + if (error) + return error; } if (v & WSDISPLAY_CURSOR_DOCUR) @@ -846,16 +863,16 @@ set_cursor(sc, p) if (v & WSDISPLAY_CURSOR_DOHOT) cc->cc_hot = p->hot; if (v & WSDISPLAY_CURSOR_DOCMAP) { - copyin(p->cmap.red, &cc->cc_color[index], count); - copyin(p->cmap.green, &cc->cc_color[index + 2], count); - copyin(p->cmap.blue, &cc->cc_color[index + 4], count); + memcpy(&cc->cc_color[index], &r[index], count); + memcpy(&cc->cc_color[index + 2], &g[index], count); + memcpy(&cc->cc_color[index + 4], &b[index], count); } if (v & WSDISPLAY_CURSOR_DOSHAPE) { cc->cc_size = p->size; memset(cc->cc_image, 0, sizeof cc->cc_image); + memcpy(cc->cc_image, image, icount); memset(cc->cc_mask, 0, sizeof cc->cc_mask); - copyin(p->image, cc->cc_image, icount); - copyin(p->mask, cc->cc_mask, icount); + memcpy(cc->cc_mask, mask, icount); } dc->dc_changed |= v; diff --git a/sys/arch/hpcmips/dev/ite8181.c b/sys/arch/hpcmips/dev/ite8181.c index e6b5614f6a2c..f447a8a1a3a1 100644 --- a/sys/arch/hpcmips/dev/ite8181.c +++ b/sys/arch/hpcmips/dev/ite8181.c @@ -1,4 +1,4 @@ -/* $NetBSD: ite8181.c,v 1.19 2003/07/15 02:29:29 lukem Exp $ */ +/* $NetBSD: ite8181.c,v 1.20 2003/11/13 03:09:28 chs Exp $ */ /*- * Copyright (c) 2000,2001 SATO Kazumi @@ -28,7 +28,7 @@ */ #include -__KERNEL_RCSID(0, "$NetBSD: ite8181.c,v 1.19 2003/07/15 02:29:29 lukem Exp $"); +__KERNEL_RCSID(0, "$NetBSD: ite8181.c,v 1.20 2003/11/13 03:09:28 chs Exp $"); #include #include @@ -640,10 +640,11 @@ ite8181_ioctl(v, cmd, data, flag, p) struct hpcfb_dspconf *dspconf; struct wsdisplay_cmap *cmap; struct wsdisplay_param *dispparam; + int error; switch (cmd) { case WSDISPLAYIO_GETCMAP: - cmap = (struct wsdisplay_cmap*)data; + cmap = (struct wsdisplay_cmap *)data; if (sc->sc_fbconf.hf_class != HPCFB_CLASS_INDEXCOLOR || sc->sc_fbconf.hf_pack_width != 8 || @@ -651,16 +652,18 @@ ite8181_ioctl(v, cmd, data, flag, p) 256 - cmap->index < cmap->count) return (EINVAL); - if (!uvm_useracc(cmap->red, cmap->count, B_WRITE) || - !uvm_useracc(cmap->green, cmap->count, B_WRITE) || - !uvm_useracc(cmap->blue, cmap->count, B_WRITE)) - return (EFAULT); - #ifdef ITE8181_WINCE_CMAP - copyout(&bivideo_cmap_r[cmap->index], cmap->red, cmap->count); - copyout(&bivideo_cmap_g[cmap->index], cmap->green,cmap->count); - copyout(&bivideo_cmap_b[cmap->index], cmap->blue, cmap->count); - return (0); + error = copyout(&bivideo_cmap_r[cmap->index], cmap->red, + cmap->count); + if (error) + return error; + error = copyout(&bivideo_cmap_g[cmap->index], cmap->green, + cmap->count); + if (error) + return error; + error = copyout(&bivideo_cmap_b[cmap->index], cmap->blue, + cmap->count); + return error; #else /* ITE8181_WINCE_CMAP */ return EINVAL; #endif /* ITE8181_WINCE_CMAP */ diff --git a/sys/arch/hpcmips/dev/mq200.c b/sys/arch/hpcmips/dev/mq200.c index 574f8fb88763..2c04f83c8187 100644 --- a/sys/arch/hpcmips/dev/mq200.c +++ b/sys/arch/hpcmips/dev/mq200.c @@ -1,4 +1,4 @@ -/* $NetBSD: mq200.c,v 1.22 2003/07/15 02:29:29 lukem Exp $ */ +/* $NetBSD: mq200.c,v 1.23 2003/11/13 03:09:28 chs Exp $ */ /*- * Copyright (c) 2000, 2001 TAKEMURA Shin @@ -30,7 +30,7 @@ */ #include -__KERNEL_RCSID(0, "$NetBSD: mq200.c,v 1.22 2003/07/15 02:29:29 lukem Exp $"); +__KERNEL_RCSID(0, "$NetBSD: mq200.c,v 1.23 2003/11/13 03:09:28 chs Exp $"); #include #include @@ -477,7 +477,7 @@ mq200_ioctl(v, cmd, data, flag, p) switch (cmd) { case WSDISPLAYIO_GETCMAP: - cmap = (struct wsdisplay_cmap*)data; + cmap = (struct wsdisplay_cmap *)data; if (sc->sc_fbconf.hf_class != HPCFB_CLASS_INDEXCOLOR || sc->sc_fbconf.hf_pack_width != 8 || @@ -485,18 +485,10 @@ mq200_ioctl(v, cmd, data, flag, p) 256 - cmap->index < cmap->count) return (EINVAL); -#if 0 - if (!uvm_useracc(cmap->red, cmap->count, B_WRITE) || - !uvm_useracc(cmap->green, cmap->count, B_WRITE) || - !uvm_useracc(cmap->blue, cmap->count, B_WRITE)) - return (EFAULT); - - copyout(&bivideo_cmap_r[cmap->index], cmap->red, cmap->count); - copyout(&bivideo_cmap_g[cmap->index], cmap->green,cmap->count); - copyout(&bivideo_cmap_b[cmap->index], cmap->blue, cmap->count); -#endif - - return (0); + /* + * This driver can't get color map. + */ + return (EINVAL); case WSDISPLAYIO_PUTCMAP: /* diff --git a/sys/arch/hpcmips/dev/plumvideo.c b/sys/arch/hpcmips/dev/plumvideo.c index ac311afe809b..2949bb9ea598 100644 --- a/sys/arch/hpcmips/dev/plumvideo.c +++ b/sys/arch/hpcmips/dev/plumvideo.c @@ -1,4 +1,4 @@ -/* $NetBSD: plumvideo.c,v 1.33 2003/10/25 18:56:48 mycroft Exp $ */ +/* $NetBSD: plumvideo.c,v 1.34 2003/11/13 03:09:28 chs Exp $ */ /*- * Copyright (c) 1999-2002 The NetBSD Foundation, Inc. @@ -37,7 +37,7 @@ */ #include -__KERNEL_RCSID(0, "$NetBSD: plumvideo.c,v 1.33 2003/10/25 18:56:48 mycroft Exp $"); +__KERNEL_RCSID(0, "$NetBSD: plumvideo.c,v 1.34 2003/11/13 03:09:28 chs Exp $"); #undef PLUMVIDEODEBUG @@ -433,71 +433,62 @@ plumvideo_ioctl(void *v, u_long cmd, caddr_t data, int flag, struct proc *p) switch (cmd) { case WSDISPLAYIO_GETCMAP: - cmap = (struct wsdisplay_cmap*)data; + cmap = (struct wsdisplay_cmap *)data; cnt = cmap->count; idx = cmap->index; if (sc->sc_fbconf.hf_class != HPCFB_CLASS_INDEXCOLOR || sc->sc_fbconf.hf_pack_width != 8 || !LEGAL_CLUT_INDEX(idx) || - !LEGAL_CLUT_INDEX(idx + cnt -1)) { + !LEGAL_CLUT_INDEX(idx + cnt - 1)) { return (EINVAL); } - if (!uvm_useracc(cmap->red, cnt, B_WRITE) || - !uvm_useracc(cmap->green, cnt, B_WRITE) || - !uvm_useracc(cmap->blue, cnt, B_WRITE)) { - return (EFAULT); - } - error = cmap_work_alloc(&r, &g, &b, &rgb, cnt); - if (error != 0) { - cmap_work_free(r, g, b, rgb); - return (ENOMEM); - } + if (error) + goto out; plumvideo_clut_get(sc, rgb, idx, cnt); rgb24_decompose(rgb, r, g, b, cnt); - copyout(r, cmap->red, cnt); - copyout(g, cmap->green,cnt); - copyout(b, cmap->blue, cnt); + error = copyout(r, cmap->red, cnt); + if (error) + goto out; + error = copyout(g, cmap->green, cnt); + if (error) + goto out; + error = copyout(b, cmap->blue, cnt); +out: cmap_work_free(r, g, b, rgb); - - return (0); + return error; case WSDISPLAYIO_PUTCMAP: - cmap = (struct wsdisplay_cmap*)data; + cmap = (struct wsdisplay_cmap *)data; cnt = cmap->count; idx = cmap->index; if (sc->sc_fbconf.hf_class != HPCFB_CLASS_INDEXCOLOR || sc->sc_fbconf.hf_pack_width != 8 || !LEGAL_CLUT_INDEX(idx) || - !LEGAL_CLUT_INDEX(idx + cnt -1)) { + !LEGAL_CLUT_INDEX(idx + cnt - 1)) { return (EINVAL); } - if (!uvm_useracc(cmap->red, cnt, B_WRITE) || - !uvm_useracc(cmap->green, cnt, B_WRITE) || - !uvm_useracc(cmap->blue, cnt, B_WRITE)) { - return (EFAULT); - } - error = cmap_work_alloc(&r, &g, &b, &rgb, cnt); - if (error != 0) { - cmap_work_free(r, g, b, rgb); - return (ENOMEM); - } - copyin(cmap->red, r, cnt); - copyin(cmap->green, g, cnt); - copyin(cmap->blue, b, cnt); + if (error) + goto out; + error = copyin(cmap->red, r, cnt); + if (error) + goto out; + error = copyin(cmap->green, g, cnt); + if (error) + goto out; + error = copyin(cmap->blue, b, cnt); + if (error) + goto out; rgb24_compose(rgb, r, g, b, cnt); plumvideo_clut_set(sc, rgb, idx, cnt); - - cmap_work_free(r, g, b, rgb); - - return (0); + goto out; case HPCFBIO_GCONF: fbconf = (struct hpcfb_fbconf *)data; diff --git a/sys/arch/hpcmips/tx/tx3912video.c b/sys/arch/hpcmips/tx/tx3912video.c index 9d42d46026d6..d71da3c28df8 100644 --- a/sys/arch/hpcmips/tx/tx3912video.c +++ b/sys/arch/hpcmips/tx/tx3912video.c @@ -1,4 +1,4 @@ -/* $NetBSD: tx3912video.c,v 1.34 2003/07/15 02:29:33 lukem Exp $ */ +/* $NetBSD: tx3912video.c,v 1.35 2003/11/13 03:09:28 chs Exp $ */ /*- * Copyright (c) 1999-2002 The NetBSD Foundation, Inc. @@ -37,7 +37,7 @@ */ #include -__KERNEL_RCSID(0, "$NetBSD: tx3912video.c,v 1.34 2003/07/15 02:29:33 lukem Exp $"); +__KERNEL_RCSID(0, "$NetBSD: tx3912video.c,v 1.35 2003/11/13 03:09:28 chs Exp $"); #define TX3912VIDEO_DEBUG @@ -517,38 +517,34 @@ tx3912video_ioctl(void *v, u_long cmd, caddr_t data, int flag, struct proc *p) switch (cmd) { case WSDISPLAYIO_GETCMAP: - cmap = (struct wsdisplay_cmap*)data; + cmap = (struct wsdisplay_cmap *)data; cnt = cmap->count; idx = cmap->index; if (sc->sc_fbconf.hf_class != HPCFB_CLASS_INDEXCOLOR || sc->sc_fbconf.hf_pack_width != 8 || !LEGAL_CLUT_INDEX(idx) || - !LEGAL_CLUT_INDEX(idx + cnt -1)) { + !LEGAL_CLUT_INDEX(idx + cnt - 1)) { return (EINVAL); } - if (!uvm_useracc(cmap->red, cnt, B_WRITE) || - !uvm_useracc(cmap->green, cnt, B_WRITE) || - !uvm_useracc(cmap->blue, cnt, B_WRITE)) { - return (EFAULT); - } - error = cmap_work_alloc(&r, &g, &b, &rgb, cnt); - if (error != 0) { - cmap_work_free(r, g, b, rgb); - return (ENOMEM); - } + if (error) + goto out; tx3912video_clut_get(sc, rgb, idx, cnt); rgb24_decompose(rgb, r, g, b, cnt); - copyout(r, cmap->red, cnt); - copyout(g, cmap->green,cnt); - copyout(b, cmap->blue, cnt); + error = copyout(r, cmap->red, cnt); + if (error) + goto out; + error = copyout(g, cmap->green,cnt); + if (error) + goto out; + error = copyout(b, cmap->blue, cnt); +out: cmap_work_free(r, g, b, rgb); - - return (0); + return error; case WSDISPLAYIO_PUTCMAP: /* diff --git a/sys/arch/hpcsh/dev/hd64461/hd64461video.c b/sys/arch/hpcsh/dev/hd64461/hd64461video.c index 47735920f04a..5af1455bab8b 100644 --- a/sys/arch/hpcsh/dev/hd64461/hd64461video.c +++ b/sys/arch/hpcsh/dev/hd64461/hd64461video.c @@ -1,4 +1,4 @@ -/* $NetBSD: hd64461video.c,v 1.21 2003/11/09 02:05:42 uwe Exp $ */ +/* $NetBSD: hd64461video.c,v 1.22 2003/11/13 03:09:28 chs Exp $ */ /*- * Copyright (c) 2001, 2002 The NetBSD Foundation, Inc. @@ -37,7 +37,7 @@ */ #include -__KERNEL_RCSID(0, "$NetBSD: hd64461video.c,v 1.21 2003/11/09 02:05:42 uwe Exp $"); +__KERNEL_RCSID(0, "$NetBSD: hd64461video.c,v 1.22 2003/11/13 03:09:28 chs Exp $"); #include "debug_hpcsh.h" // #define HD64461VIDEO_HWACCEL @@ -431,7 +431,7 @@ hd64461video_ioctl(void *v, u_long cmd, caddr_t data, int flag, struct proc *p) return (0); case WSDISPLAYIO_GETCMAP: - cmap = (struct wsdisplay_cmap*)data; + cmap = (struct wsdisplay_cmap *)data; cnt = cmap->count; idx = cmap->index; @@ -442,25 +442,21 @@ hd64461video_ioctl(void *v, u_long cmd, caddr_t data, int flag, struct proc *p) return (EINVAL); } - if (!uvm_useracc(cmap->red, cnt, B_WRITE) || - !uvm_useracc(cmap->green, cnt, B_WRITE) || - !uvm_useracc(cmap->blue, cnt, B_WRITE)) { - return (EFAULT); - } - error = cmap_work_alloc(&r, &g, &b, 0, cnt); - if (error != 0) { - cmap_work_free(r, g, b, 0); - return (ENOMEM); - } - + if (error) + goto out; hd64461video_get_clut(sc->sc_vc, idx, cnt, r, g, b); - copyout(r, cmap->red, cnt); - copyout(g, cmap->green,cnt); - copyout(b, cmap->blue, cnt); - cmap_work_free(r, g, b, 0); + error = copyout(r, cmap->red, cnt); + if (error) + goto out; + error = copyout(g, cmap->green,cnt); + if (error) + goto out; + error = copyout(b, cmap->blue, cnt); - return (0); +out: + cmap_work_free(r, g, b, 0); + return error; case WSDISPLAYIO_PUTCMAP: cmap = (struct wsdisplay_cmap *)data; @@ -474,25 +470,21 @@ hd64461video_ioctl(void *v, u_long cmd, caddr_t data, int flag, struct proc *p) return (EINVAL); } - if (!uvm_useracc(cmap->red, cnt, B_WRITE) || - !uvm_useracc(cmap->green, cnt, B_WRITE) || - !uvm_useracc(cmap->blue, cnt, B_WRITE)) { - return (EFAULT); - } - error = cmap_work_alloc(&r, &g, &b, 0, cnt); - if (error != 0) { - cmap_work_free(r, g, b, 0); - return (ENOMEM); - } + if (error) + goto out; - copyin(cmap->red, r, cnt); - copyin(cmap->green,g, cnt); - copyin(cmap->blue, b, cnt); + error = copyin(cmap->red, r, cnt); + if (error) + goto out; + error = copyin(cmap->green,g, cnt); + if (error) + goto out; + error = copyin(cmap->blue, b, cnt); + if (error) + goto out; hd64461video_set_clut(sc->sc_vc, idx, cnt, r, g, b); - cmap_work_free(r, g, b, 0); - - return (0); + goto out; case HPCFBIO_GCONF: fbconf = (struct hpcfb_fbconf *)data; diff --git a/sys/arch/luna68k/dev/lunafb.c b/sys/arch/luna68k/dev/lunafb.c index f58acec4ea05..e45f91fa3cf7 100644 --- a/sys/arch/luna68k/dev/lunafb.c +++ b/sys/arch/luna68k/dev/lunafb.c @@ -1,4 +1,4 @@ -/* $NetBSD: lunafb.c,v 1.11 2003/04/02 00:08:13 thorpej Exp $ */ +/* $NetBSD: lunafb.c,v 1.12 2003/11/13 03:09:28 chs Exp $ */ /*- * Copyright (c) 2000 The NetBSD Foundation, Inc. @@ -38,7 +38,7 @@ #include /* RCS ID & Copyright macro defns */ -__KERNEL_RCSID(0, "$NetBSD: lunafb.c,v 1.11 2003/04/02 00:08:13 thorpej Exp $"); +__KERNEL_RCSID(0, "$NetBSD: lunafb.c,v 1.12 2003/11/13 03:09:28 chs Exp $"); #include #include @@ -295,22 +295,20 @@ omgetcmap(sc, p) struct wsdisplay_cmap *p; { u_int index = p->index, count = p->count; - int cmsize; + int cmsize, error; cmsize = sc->sc_dc->dc_cmsize; if (index >= cmsize || count > cmsize - index) return (EINVAL); - if (!uvm_useracc(p->red, count, B_WRITE) || - !uvm_useracc(p->green, count, B_WRITE) || - !uvm_useracc(p->blue, count, B_WRITE)) - return (EFAULT); - - copyout(&sc->sc_cmap.r[index], p->red, count); - copyout(&sc->sc_cmap.g[index], p->green, count); - copyout(&sc->sc_cmap.b[index], p->blue, count); - - return (0); + error = copyout(&sc->sc_cmap.r[index], p->red, count); + if (error) + return error; + error = copyout(&sc->sc_cmap.g[index], p->green, count); + if (error) + return error; + error = copyout(&sc->sc_cmap.b[index], p->blue, count); + return error; } static int @@ -318,22 +316,27 @@ omsetcmap(sc, p) struct omfb_softc *sc; struct wsdisplay_cmap *p; { + struct hwcmap cmap; u_int index = p->index, count = p->count; - int cmsize, i; + int cmsize, i, error; cmsize = sc->sc_dc->dc_cmsize; if (index >= cmsize || (index + count) > cmsize) return (EINVAL); - if (!uvm_useracc(p->red, count, B_READ) || - !uvm_useracc(p->green, count, B_READ) || - !uvm_useracc(p->blue, count, B_READ)) - return (EFAULT); - - copyin(p->red, &sc->sc_cmap.r[index], count); - copyin(p->green, &sc->sc_cmap.g[index], count); - copyin(p->blue, &sc->sc_cmap.b[index], count); + error = copyin(p->red, &cmap.r[index], count); + if (error) + return error; + error = copyin(p->green, &cmap.g[index], count); + if (error) + return error; + error = copyin(p->blue, &cmap.b[index], count); + if (error) + return error; + memcpy(&sc->sc_cmap.r[index], &cmap.r[index], count); + memcpy(&sc->sc_cmap.g[index], &cmap.g[index], count); + memcpy(&sc->sc_cmap.b[index], &cmap.b[index], count); if (hwplanemask == 0x0f) { struct bt454 *odac = (struct bt454 *)OMFB_RAMDAC; odac->bt_addr = index; diff --git a/sys/arch/macppc/dev/ofb.c b/sys/arch/macppc/dev/ofb.c index d7121cccde54..2d74d2701525 100644 --- a/sys/arch/macppc/dev/ofb.c +++ b/sys/arch/macppc/dev/ofb.c @@ -1,4 +1,4 @@ -/* $NetBSD: ofb.c,v 1.37 2003/10/20 00:12:10 matt Exp $ */ +/* $NetBSD: ofb.c,v 1.38 2003/11/13 03:09:28 chs Exp $ */ /* * Copyright (c) 1995, 1996 Carnegie-Mellon University. @@ -28,7 +28,7 @@ */ #include -__KERNEL_RCSID(0, "$NetBSD: ofb.c,v 1.37 2003/10/20 00:12:10 matt Exp $"); +__KERNEL_RCSID(0, "$NetBSD: ofb.c,v 1.38 2003/11/13 03:09:28 chs Exp $"); #include #include @@ -563,28 +563,33 @@ ofb_putcmap(sc, cm) struct ofb_devconfig *dc = sc->sc_dc; u_int index = cm->index; u_int count = cm->count; - int i; + int i, error; + u_char rbuf[256], gbuf[256], bbuf[256]; u_char *r, *g, *b; if (cm->index >= 256 || cm->count > 256 || (cm->index + cm->count) > 256) return EINVAL; - if (!uvm_useracc(cm->red, cm->count, B_READ) || - !uvm_useracc(cm->green, cm->count, B_READ) || - !uvm_useracc(cm->blue, cm->count, B_READ)) - return EFAULT; - copyin(cm->red, &sc->sc_cmap_red[index], count); - copyin(cm->green, &sc->sc_cmap_green[index], count); - copyin(cm->blue, &sc->sc_cmap_blue[index], count); + error = copyin(cm->red, &rbuf[index], count); + if (error) + return error; + error = copyin(cm->green, &gbuf[index], count); + if (error) + return error; + error = copyin(cm->blue, &bbuf[index], count); + if (error) + return error; + + memcpy(&sc->sc_cmap_red[index], &rbuf[index], count); + memcpy(&sc->sc_cmap_green[index], &gbuf[index], count); + memcpy(&sc->sc_cmap_blue[index], &bbuf[index], count); r = &sc->sc_cmap_red[index]; g = &sc->sc_cmap_green[index]; b = &sc->sc_cmap_blue[index]; - for (i = 0; i < count; i++) { OF_call_method_1("color!", dc->dc_ih, 4, *r, *g, *b, index); r++, g++, b++, index++; } - return 0; } diff --git a/sys/arch/newsmips/apbus/xafb.c b/sys/arch/newsmips/apbus/xafb.c index e034870faa4f..075c605a6cff 100644 --- a/sys/arch/newsmips/apbus/xafb.c +++ b/sys/arch/newsmips/apbus/xafb.c @@ -1,4 +1,4 @@ -/* $NetBSD: xafb.c,v 1.6 2003/07/15 02:59:29 lukem Exp $ */ +/* $NetBSD: xafb.c,v 1.7 2003/11/13 03:09:28 chs Exp $ */ /*- * Copyright (c) 2000 Tsubai Masanari. All rights reserved. @@ -29,7 +29,7 @@ /* "xa" frame buffer driver. Currently supports 1280x1024x8 only. */ #include -__KERNEL_RCSID(0, "$NetBSD: xafb.c,v 1.6 2003/07/15 02:59:29 lukem Exp $"); +__KERNEL_RCSID(0, "$NetBSD: xafb.c,v 1.7 2003/11/13 03:09:28 chs Exp $"); #include #include @@ -403,25 +403,31 @@ xafb_putcmap(sc, cm) { u_int index = cm->index; u_int count = cm->count; - int i; + int i, error; + u_char rbuf[256], gbuf[256], bbuf[256]; u_char *r, *g, *b; - if (index >= 256 || count > 256 || index + count > 256) + if (cm->index >= 256 || cm->count > 256 || + (cm->index + cm->count) > 256) return EINVAL; - if (!uvm_useracc(cm->red, count, B_READ) || - !uvm_useracc(cm->green, count, B_READ) || - !uvm_useracc(cm->blue, count, B_READ)) - return EFAULT; - copyin(cm->red, &sc->sc_cmap_red[index], count); - copyin(cm->green, &sc->sc_cmap_green[index], count); - copyin(cm->blue, &sc->sc_cmap_blue[index], count); + error = copyin(cm->red, &rbuf[index], count); + if (error) + return error; + error = copyin(cm->green, &gbuf[index], count); + if (error) + return error; + error = copyin(cm->blue, &bbuf[index], count); + if (error) + return error; + + memcpy(&sc->sc_cmap_red[index], &rbuf[index], count); + memcpy(&sc->sc_cmap_green[index], &gbuf[index], count); + memcpy(&sc->sc_cmap_blue[index], &bbuf[index], count); r = &sc->sc_cmap_red[index]; g = &sc->sc_cmap_green[index]; b = &sc->sc_cmap_blue[index]; - for (i = 0; i < count; i++) xafb_setcolor(sc->sc_dc, index++, *r++, *g++, *b++); - return 0; } diff --git a/sys/arch/prep/pci/gten.c b/sys/arch/prep/pci/gten.c index 49235ba09fe1..c9c4469190bf 100644 --- a/sys/arch/prep/pci/gten.c +++ b/sys/arch/prep/pci/gten.c @@ -1,4 +1,4 @@ -/* $NetBSD: gten.c,v 1.9 2003/07/15 02:54:51 lukem Exp $ */ +/* $NetBSD: gten.c,v 1.10 2003/11/13 03:09:28 chs Exp $ */ /*- * Copyright (c) 2000 The NetBSD Foundation, Inc. @@ -37,7 +37,7 @@ */ #include -__KERNEL_RCSID(0, "$NetBSD: gten.c,v 1.9 2003/07/15 02:54:51 lukem Exp $"); +__KERNEL_RCSID(0, "$NetBSD: gten.c,v 1.10 2003/11/13 03:09:28 chs Exp $"); #include #include @@ -423,30 +423,24 @@ gten_putcmap(gt, cm) { int index = cm->index; int count = cm->count; - int i; - u_char *r, *g, *b; + int i, error; + u_char rbuf[256], gbuf[256], bbuf[256]; if (cm->index >= 256 || cm->count > 256 || (cm->index + cm->count) > 256) return EINVAL; - if (!uvm_useracc(cm->red, cm->count, B_READ) || - !uvm_useracc(cm->green, cm->count, B_READ) || - !uvm_useracc(cm->blue, cm->count, B_READ)) - return EFAULT; - copyin(cm->red, >->gt_cmap_red[index], count); - copyin(cm->green, >->gt_cmap_green[index], count); - copyin(cm->blue, >->gt_cmap_blue[index], count); - - r = >->gt_cmap_red[index]; - g = >->gt_cmap_green[index]; - b = >->gt_cmap_blue[index]; - -#if 0 - for (i = 0; i < count; i++) { - OF_call_method_1("color!", dc->dc_ih, 4, *r, *g, *b, index); - r++, g++, b++, index++; - } -#endif + error = copyin(cm->red, &rbuf[index], count); + if (error) + return error; + error = copyin(cm->green, &gbuf[index], count); + if (error) + return error; + error = copyin(cm->blue, &bbuf[index], count); + if (error) + return error; + memcpy(>->gt_cmap_red[index], &rbuf[index], count); + memcpy(>->gt_cmap_green[index], &gbuf[index], count); + memcpy(>->gt_cmap_blue[index], &bbuf[index], count); return 0; } diff --git a/sys/arch/sparc/dev/cgfourteen.c b/sys/arch/sparc/dev/cgfourteen.c index c4e147938dde..583e275e865c 100644 --- a/sys/arch/sparc/dev/cgfourteen.c +++ b/sys/arch/sparc/dev/cgfourteen.c @@ -1,4 +1,4 @@ -/* $NetBSD: cgfourteen.c,v 1.37 2003/08/25 17:50:25 uwe Exp $ */ +/* $NetBSD: cgfourteen.c,v 1.38 2003/11/13 03:09:28 chs Exp $ */ /* * Copyright (c) 1996 @@ -78,7 +78,7 @@ #undef CG14_CG8 #include -__KERNEL_RCSID(0, "$NetBSD: cgfourteen.c,v 1.37 2003/08/25 17:50:25 uwe Exp $"); +__KERNEL_RCSID(0, "$NetBSD: cgfourteen.c,v 1.38 2003/11/13 03:09:28 chs Exp $"); #include #include @@ -379,6 +379,7 @@ cgfourteenioctl(dev, cmd, data, flags, p) union cg14cursor_cmap tcm; int v, error; u_int count; + u_int eplane[32], cplane[32]; switch (cmd) { @@ -439,12 +440,10 @@ cgfourteenioctl(dev, cmd, data, flags, p) /* begin ugh ... can we lose some of this crap?? */ if (p->image != NULL) { count = cc->cc_size.y * 32 / NBBY; - error = copyout((caddr_t)cc->cc_cplane, - (caddr_t)p->image, count); + error = copyout(cc->cc_cplane, p->image, count); if (error) return (error); - error = copyout((caddr_t)cc->cc_eplane, - (caddr_t)p->mask, count); + error = copyout(cc->cc_eplane, p->mask, count); if (error) return (error); } @@ -483,9 +482,12 @@ cgfourteenioctl(dev, cmd, data, flags, p) if ((u_int)p->size.x > 32 || (u_int)p->size.y > 32) return (EINVAL); count = p->size.y * 32 / NBBY; - if (!uvm_useracc(p->image, count, B_READ) || - !uvm_useracc(p->mask, count, B_READ)) - return (EFAULT); + error = copyin(p->mask, eplane, count); + if (error) + return error; + error = copyin(p->image, cplane, count); + if (error) + return error; } /* parameters are OK; do it */ @@ -505,10 +507,10 @@ cgfourteenioctl(dev, cmd, data, flags, p) if (v & FB_CUR_SETSHAPE) { cc->cc_size = p->size; count = p->size.y * 32 / NBBY; - bzero((caddr_t)cc->cc_eplane, sizeof cc->cc_eplane); - bzero((caddr_t)cc->cc_cplane, sizeof cc->cc_cplane); - bcopy(p->mask, (caddr_t)cc->cc_eplane, count); - bcopy(p->image, (caddr_t)cc->cc_cplane, count); + memset(cc->cc_eplane, 0, sizeof cc->cc_eplane); + memcpy(cc->cc_eplane, eplane, count); + memset(cc->cc_cplane, 0, sizeof cc->cc_cplane); + memcpy(cc->cc_cplane, cplane, count); cg14_loadcursor(sc); } break; @@ -662,7 +664,7 @@ cg14_init(sc) /* * Zero the xlut to enable direct-color mode */ - bzero(sc->sc_xlut, CG14_CLUT_SIZE); + memset(sc->sc_xlut, 0, CG14_CLUT_SIZE); #else /* * Enable the video and put it in 8 bit mode @@ -747,28 +749,23 @@ cg14_get_cmap(p, cm, cmsize) { u_int i, start, count; u_char *cp; + int error; start = p->index; count = p->count; if (start >= cmsize || count > cmsize - start) -#ifdef DEBUG - { - printf("putcmaperror: start %d cmsize %d count %d\n", - start,cmsize,count); -#endif return (EINVAL); -#ifdef DEBUG - } -#endif - if (!uvm_useracc(p->red, count, B_WRITE) || - !uvm_useracc(p->green, count, B_WRITE) || - !uvm_useracc(p->blue, count, B_WRITE)) - return (EFAULT); for (cp = &cm->cm_map[start][0], i = 0; i < count; cp += 4, i++) { - p->red[i] = cp[3]; - p->green[i] = cp[2]; - p->blue[i] = cp[1]; + error = copyout(&cp[3], &p->red[i], 1); + if (error) + return error; + error = copyout(&cp[2], &p->green[i], 1); + if (error) + return error; + error = copyout(&cp[1], &p->blue[i], 1); + if (error) + return error; } return (0); } @@ -782,30 +779,28 @@ cg14_put_cmap(p, cm, cmsize) { u_int i, start, count; u_char *cp; + u_char cmap[256][4]; + int error; start = p->index; count = p->count; if (start >= cmsize || count > cmsize - start) -#ifdef DEBUG - { - printf("putcmaperror: start %d cmsize %d count %d\n", - start,cmsize,count); -#endif return (EINVAL); -#ifdef DEBUG - } -#endif - if (!uvm_useracc(p->red, count, B_READ) || - !uvm_useracc(p->green, count, B_READ) || - !uvm_useracc(p->blue, count, B_READ)) - return (EFAULT); - for (cp = &cm->cm_map[start][0], i = 0; i < count; cp += 4, i++) { - cp[3] = p->red[i]; - cp[2] = p->green[i]; - cp[1] = p->blue[i]; + memcpy(&cmap, &cm->cm_map, sizeof cmap); + for (cp = &cmap[start][0], i = 0; i < count; cp += 4, i++) { + error = copyin(&p->red[i], &cp[3], 1); + if (error) + return error; + error = copyin(&p->green[i], &cp[2], 1); + if (error) + return error; + error = copyin(&p->blue[i], &cp[1], 1); + if (error) + return error; cp[0] = 0; /* no alpha channel */ } + memcpy(&cm->cm_map, &cmap, sizeof cmap); return (0); } diff --git a/sys/arch/sparc64/sparc64/machdep.c b/sys/arch/sparc64/sparc64/machdep.c index 4c55db5c1579..00f88cfeaeb5 100644 --- a/sys/arch/sparc64/sparc64/machdep.c +++ b/sys/arch/sparc64/sparc64/machdep.c @@ -1,4 +1,4 @@ -/* $NetBSD: machdep.c,v 1.156 2003/11/09 16:41:52 martin Exp $ */ +/* $NetBSD: machdep.c,v 1.157 2003/11/13 03:09:29 chs Exp $ */ /*- * Copyright (c) 1996, 1997, 1998 The NetBSD Foundation, Inc. @@ -78,7 +78,7 @@ */ #include -__KERNEL_RCSID(0, "$NetBSD: machdep.c,v 1.156 2003/11/09 16:41:52 martin Exp $"); +__KERNEL_RCSID(0, "$NetBSD: machdep.c,v 1.157 2003/11/13 03:09:29 chs Exp $"); #include "opt_ddb.h" #include "opt_compat_netbsd.h" @@ -1242,25 +1242,14 @@ _bus_dmamap_load_uio(t, map, uio, flags) struct proc *p = uio->uio_procp; struct pmap *pm; - /* - * Check user read/write access to the data buffer. - */ if (uio->uio_segflg == UIO_USERSPACE) { pm = p->p_vmspace->vm_map.pmap; - for (i = 0; i < uio->uio_iovcnt; i++) { - /* XXXCDC: map not locked, rethink */ - if (__predict_false(!uvm_useracc(uio->uio_iov[i].iov_base, - uio->uio_iov[i].iov_len, -/* XXX is UIO_WRITE correct? */ - (uio->uio_rw == UIO_WRITE) ? B_WRITE : B_READ))) - return (EFAULT); - } } else pm = pmap_kernel(); i = 0; len = 0; - for (j=0; juio_iovcnt; j++) { + for (j = 0; j < uio->uio_iovcnt; j++) { struct iovec *iov = &uio->uio_iov[j]; vaddr_t vaddr = (vaddr_t)iov->iov_base; bus_size_t buflen = iov->iov_len; @@ -1272,8 +1261,7 @@ _bus_dmamap_load_uio(t, map, uio, flags) PHOLD(p); if (__predict_false(uvm_vslock(p, vaddr, buflen, (uio->uio_rw == UIO_WRITE) ? - VM_PROT_WRITE : VM_PROT_READ) - != 0)) { + VM_PROT_WRITE : VM_PROT_READ) != 0)) { goto after_vsunlock; } diff --git a/sys/compat/irix/irix_swap.c b/sys/compat/irix/irix_swap.c index 3965f2bbe027..78c988f4d5e7 100644 --- a/sys/compat/irix/irix_swap.c +++ b/sys/compat/irix/irix_swap.c @@ -1,4 +1,4 @@ -/* $NetBSD: irix_swap.c,v 1.10 2003/07/29 16:18:54 mrg Exp $ */ +/* $NetBSD: irix_swap.c,v 1.11 2003/11/13 03:09:29 chs Exp $ */ /*- * Copyright (c) 2002 The NetBSD Foundation, Inc. @@ -37,7 +37,7 @@ */ #include -__KERNEL_RCSID(0, "$NetBSD: irix_swap.c,v 1.10 2003/07/29 16:18:54 mrg Exp $"); +__KERNEL_RCSID(0, "$NetBSD: irix_swap.c,v 1.11 2003/11/13 03:09:29 chs Exp $"); #include #include @@ -190,10 +190,6 @@ bad: struct swapent *sep; int i, dontcare, sum = 0; - if (!uvm_useracc((caddr_t)SCARG(uap, arg), - sizeof(sum), B_WRITE)) - return EACCES; - SCARG(&cup, cmd) = SWAP_NSWAP; SCARG(&cup, arg) = NULL; SCARG(&cup, misc) = 0; diff --git a/sys/compat/irix/irix_sysmp.c b/sys/compat/irix/irix_sysmp.c index 0eb3db4d85d7..f0444431ab47 100644 --- a/sys/compat/irix/irix_sysmp.c +++ b/sys/compat/irix/irix_sysmp.c @@ -1,4 +1,4 @@ -/* $NetBSD: irix_sysmp.c,v 1.9 2003/01/22 12:58:23 rafal Exp $ */ +/* $NetBSD: irix_sysmp.c,v 1.10 2003/11/13 03:09:29 chs Exp $ */ /*- * Copyright (c) 2001-2002 The NetBSD Foundation, Inc. @@ -37,7 +37,7 @@ */ #include -__KERNEL_RCSID(0, "$NetBSD: irix_sysmp.c,v 1.9 2003/01/22 12:58:23 rafal Exp $"); +__KERNEL_RCSID(0, "$NetBSD: irix_sysmp.c,v 1.10 2003/11/13 03:09:29 chs Exp $"); #include #include @@ -182,9 +182,6 @@ irix_sysmp_saget(cmd, buf, len) void *kbuf; int error = 0; - if (!uvm_useracc(buf, len, B_WRITE)) - return EINVAL; - kbuf = malloc(len, M_TEMP, M_WAITOK); switch (cmd) { @@ -216,7 +213,7 @@ irix_sysmp_saget(cmd, buf, len) } if (error == 0) - (void)copyout((void *)kbuf, (void *)buf, len); + error = copyout(kbuf, buf, len); free(kbuf, M_TEMP); return error; diff --git a/sys/compat/irix/irix_syssgi.c b/sys/compat/irix/irix_syssgi.c index 02d2d0b637e1..e4a24b5d5c10 100644 --- a/sys/compat/irix/irix_syssgi.c +++ b/sys/compat/irix/irix_syssgi.c @@ -1,4 +1,4 @@ -/* $NetBSD: irix_syssgi.c,v 1.37 2003/07/29 16:18:54 mrg Exp $ */ +/* $NetBSD: irix_syssgi.c,v 1.38 2003/11/13 03:09:29 chs Exp $ */ /*- * Copyright (c) 2001-2002 The NetBSD Foundation, Inc. @@ -37,7 +37,7 @@ */ #include -__KERNEL_RCSID(0, "$NetBSD: irix_syssgi.c,v 1.37 2003/07/29 16:18:54 mrg Exp $"); +__KERNEL_RCSID(0, "$NetBSD: irix_syssgi.c,v 1.38 2003/11/13 03:09:29 chs Exp $"); #if defined(_KERNEL_OPT) #include "opt_ddb.h" @@ -217,9 +217,6 @@ irix_sys_syssgi(l, v, retval) arg1 = SCARG(uap, arg1); /* PID of the process */ arg2 = SCARG(uap, arg2); /* Address of user buffer */ arg3 = SCARG(uap, arg3); /* Length of user buffer */ - if (!uvm_useracc((caddr_t)arg2, (size_t)arg2, B_WRITE)) - return EACCES; - tp = pfind((pid_t)arg1); if (tp == NULL || \ tp->p_psstr == NULL || \ @@ -317,13 +314,7 @@ irix_syssgi_mapelf(fd, ph, count, p, retval) vcset.evs_cnt = 0; vcset.evs_used = 0; - /* Check that the program header array is readable by the process */ - if (!uvm_useracc((caddr_t)ph, sizeof(Elf_Phdr) * count, B_READ)) - return EACCES; - - kph = (Elf_Phdr *)malloc(sizeof(Elf_Phdr) * count, - M_TEMP, M_WAITOK); - + kph = (Elf_Phdr *)malloc(sizeof(Elf_Phdr) * count, M_TEMP, M_WAITOK); error = copyin(ph, kph, sizeof(Elf_Phdr) * count); if (error) goto bad; diff --git a/sys/compat/mach/mach_vm.c b/sys/compat/mach/mach_vm.c index 72271ba89ecf..077a0e5bb0b3 100644 --- a/sys/compat/mach/mach_vm.c +++ b/sys/compat/mach/mach_vm.c @@ -1,4 +1,4 @@ -/* $NetBSD: mach_vm.c,v 1.32 2003/11/03 20:58:18 manu Exp $ */ +/* $NetBSD: mach_vm.c,v 1.33 2003/11/13 03:09:29 chs Exp $ */ /*- * Copyright (c) 2002-2003 The NetBSD Foundation, Inc. @@ -37,7 +37,7 @@ */ #include -__KERNEL_RCSID(0, "$NetBSD: mach_vm.c,v 1.32 2003/11/03 20:58:18 manu Exp $"); +__KERNEL_RCSID(0, "$NetBSD: mach_vm.c,v 1.33 2003/11/13 03:09:29 chs Exp $"); #include #include @@ -693,10 +693,6 @@ mach_vm_copy(args) src = (caddr_t)req->req_src; dst = (caddr_t)req->req_addr; - if ((uvm_useracc(src, req->req_size, B_READ) == 0) || - (uvm_useracc(dst, req->req_size, B_WRITE) == 0)) - return mach_msg_error(args, EPERM); - /* Is there an easy way of dealing with that efficiently? */ do { if ((error = copyin(src, tmpbuf, PAGE_SIZE)) != 0) diff --git a/sys/dev/hpc/bivideo.c b/sys/dev/hpc/bivideo.c index 8bda10970892..3ec9dc002c1c 100644 --- a/sys/dev/hpc/bivideo.c +++ b/sys/dev/hpc/bivideo.c @@ -1,4 +1,4 @@ -/* $NetBSD: bivideo.c,v 1.17 2002/10/02 16:33:48 thorpej Exp $ */ +/* $NetBSD: bivideo.c,v 1.18 2003/11/13 03:09:29 chs Exp $ */ /*- * Copyright (c) 1999-2001 @@ -35,7 +35,7 @@ */ #include -__KERNEL_RCSID(0, "$NetBSD: bivideo.c,v 1.17 2002/10/02 16:33:48 thorpej Exp $"); +__KERNEL_RCSID(0, "$NetBSD: bivideo.c,v 1.18 2003/11/13 03:09:29 chs Exp $"); #define FBDEBUG static const char _copyright[] __attribute__ ((unused)) = @@ -376,10 +376,11 @@ bivideo_ioctl(void *v, u_long cmd, caddr_t data, int flag, struct proc *p) struct hpcfb_dspconf *dspconf; struct wsdisplay_cmap *cmap; struct wsdisplay_param *dispparam; + int error; switch (cmd) { case WSDISPLAYIO_GETCMAP: - cmap = (struct wsdisplay_cmap*)data; + cmap = (struct wsdisplay_cmap *)data; if (sc->sc_fbconf.hf_class != HPCFB_CLASS_INDEXCOLOR || sc->sc_fbconf.hf_pack_width != 8 || @@ -387,16 +388,17 @@ bivideo_ioctl(void *v, u_long cmd, caddr_t data, int flag, struct proc *p) 256 < (cmap->index + cmap->count)) return (EINVAL); - if (!uvm_useracc(cmap->red, cmap->count, B_WRITE) || - !uvm_useracc(cmap->green, cmap->count, B_WRITE) || - !uvm_useracc(cmap->blue, cmap->count, B_WRITE)) - return (EFAULT); - - copyout(&bivideo_cmap_r[cmap->index], cmap->red, cmap->count); - copyout(&bivideo_cmap_g[cmap->index], cmap->green,cmap->count); - copyout(&bivideo_cmap_b[cmap->index], cmap->blue, cmap->count); - - return (0); + error = copyout(&bivideo_cmap_r[cmap->index], cmap->red, + cmap->count); + if (error) + return error; + error = copyout(&bivideo_cmap_g[cmap->index], cmap->green, + cmap->count); + if (error) + return error; + error = copyout(&bivideo_cmap_b[cmap->index], cmap->blue, + cmap->count); + return error; case WSDISPLAYIO_PUTCMAP: /* diff --git a/sys/dev/hpc/video_subr.c b/sys/dev/hpc/video_subr.c index a9ccdccf392e..1e34afdc4eb2 100644 --- a/sys/dev/hpc/video_subr.c +++ b/sys/dev/hpc/video_subr.c @@ -1,4 +1,4 @@ -/* $NetBSD: video_subr.c,v 1.5 2003/08/02 22:14:13 uwe Exp $ */ +/* $NetBSD: video_subr.c,v 1.6 2003/11/13 03:09:29 chs Exp $ */ /*- * Copyright (c) 2000 The NetBSD Foundation, Inc. @@ -37,7 +37,7 @@ */ #include -__KERNEL_RCSID(0, "$NetBSD: video_subr.c,v 1.5 2003/08/02 22:14:13 uwe Exp $"); +__KERNEL_RCSID(0, "$NetBSD: video_subr.c,v 1.6 2003/11/13 03:09:29 chs Exp $"); #include #include @@ -183,7 +183,7 @@ cmap_work_alloc(u_int8_t **r, u_int8_t **g, u_int8_t **b, u_int32_t **rgb, errout: cmap_work_free(*r, *g, *b, *rgb); - return (1); + return (ENOMEM); } void diff --git a/sys/dev/ic/bt463.c b/sys/dev/ic/bt463.c index 8573c9214bd6..2fd25a29d342 100644 --- a/sys/dev/ic/bt463.c +++ b/sys/dev/ic/bt463.c @@ -1,4 +1,4 @@ -/* $NetBSD: bt463.c,v 1.8 2002/08/03 00:13:02 itojun Exp $ */ +/* $NetBSD: bt463.c,v 1.9 2003/11/13 03:09:29 chs Exp $ */ /*- * Copyright (c) 1998 The NetBSD Foundation, Inc. @@ -69,7 +69,7 @@ */ #include -__KERNEL_RCSID(0, "$NetBSD: bt463.c,v 1.8 2002/08/03 00:13:02 itojun Exp $"); +__KERNEL_RCSID(0, "$NetBSD: bt463.c,v 1.9 2003/11/13 03:09:29 chs Exp $"); #include #include @@ -154,6 +154,9 @@ struct bt463data { char curcmap_r[2]; /* cursor colormap */ char curcmap_g[2]; char curcmap_b[2]; + char tmpcurcmap_r[2]; /* tmp cursor colormap */ + char tmpcurcmap_g[2]; + char tmpcurcmap_b[2]; char cmap_r[BT463_NCMAP_ENTRIES]; /* colormap */ char cmap_g[BT463_NCMAP_ENTRIES]; char cmap_b[BT463_NCMAP_ENTRIES]; @@ -366,29 +369,33 @@ bt463_set_cmap(rc, cmapp) { struct bt463data *data = (struct bt463data *)rc; u_int count, index; - int s; + uint8_t r[BT463_NCMAP_ENTRIES]; + uint8_t g[BT463_NCMAP_ENTRIES]; + uint8_t b[BT463_NCMAP_ENTRIES]; + int s, error; if (cmapp->index >= BT463_NCMAP_ENTRIES || cmapp->count > BT463_NCMAP_ENTRIES - cmapp->index) return (EINVAL); - if (!uvm_useracc(cmapp->red, cmapp->count, B_READ) || - !uvm_useracc(cmapp->green, cmapp->count, B_READ) || - !uvm_useracc(cmapp->blue, cmapp->count, B_READ)) - return (EFAULT); - - s = spltty(); index = cmapp->index; count = cmapp->count; - copyin(cmapp->red, &data->cmap_r[index], count); - copyin(cmapp->green, &data->cmap_g[index], count); - copyin(cmapp->blue, &data->cmap_b[index], count); - - data->changed |= DATA_CMAP_CHANGED; - + error = copyin(cmapp->red, &r[index], count); + if (error) + return error; + error = copyin(cmapp->green, &g[index], count); + if (error) + return error; + error = copyin(cmapp->blue, &b[index], count); + if (error) + return error; + s = spltty(); + memcpy(&data->cmap_r[index], &r[index], count); + memcpy(&data->cmap_g[index], &g[index], count); + memcpy(&data->cmap_b[index], &b[index], count); + data->changed |= DATA_CMAP_CHANGED; data->ramdac_sched_update(data->cookie, bt463_update); splx(s); - return (0); } @@ -423,17 +430,23 @@ bt463_check_curcmap(rc, cursorp) struct ramdac_cookie *rc; struct wsdisplay_cursor *cursorp; { - int count; + struct bt463data *data = (struct bt463data *)rc; + int count, index, error; - if ((u_int)cursorp->cmap.index > 2 || - ((u_int)cursorp->cmap.index + - (u_int)cursorp->cmap.count) > 2) + if (cursorp->cmap.index > 2 || + (cursorp->cmap.index + cursorp->cmap.count) > 2) return (EINVAL); - count = cursorp->cmap.count; - if (!uvm_useracc(cursorp->cmap.red, count, B_READ) || - !uvm_useracc(cursorp->cmap.green, count, B_READ) || - !uvm_useracc(cursorp->cmap.blue, count, B_READ)) - return (EFAULT); + count = cursorp->cmap.count; + index = cursorp->cmap.index; + error = copyin(cursorp->cmap.red, &data->tmpcurcmap_r[index], count); + if (error) + return error; + error = copyin(cursorp->cmap.green, &data->tmpcurcmap_g[index], count); + if (error) + return error; + error = copyin(cursorp->cmap.blue, &data->tmpcurcmap_b[index], count); + if (error) + return error; return (0); } @@ -445,12 +458,11 @@ bt463_set_curcmap(rc, cursorp) struct bt463data *data = (struct bt463data *)rc; int count, index; - /* can't fail; parameters have already been checked. */ count = cursorp->cmap.count; index = cursorp->cmap.index; - copyin(cursorp->cmap.red, &data->curcmap_r[index], count); - copyin(cursorp->cmap.green, &data->curcmap_g[index], count); - copyin(cursorp->cmap.blue, &data->curcmap_b[index], count); + memcpy(&data->curcmap_r[index], &data->tmpcurcmap_r[index], count); + memcpy(&data->curcmap_g[index], &data->tmpcurcmap_g[index], count); + memcpy(&data->curcmap_b[index], &data->tmpcurcmap_b[index], count); data->changed |= DATA_CURCMAP_CHANGED; data->ramdac_sched_update(data->cookie, bt463_update); } diff --git a/sys/dev/ic/bt485.c b/sys/dev/ic/bt485.c index 904e412e549f..3b08d47d0363 100644 --- a/sys/dev/ic/bt485.c +++ b/sys/dev/ic/bt485.c @@ -1,4 +1,4 @@ -/* $NetBSD: bt485.c,v 1.9 2002/08/03 00:13:03 itojun Exp $ */ +/* $NetBSD: bt485.c,v 1.10 2003/11/13 03:09:29 chs Exp $ */ /* * Copyright (c) 1995, 1996 Carnegie-Mellon University. @@ -32,7 +32,7 @@ */ #include -__KERNEL_RCSID(0, "$NetBSD: bt485.c,v 1.9 2002/08/03 00:13:03 itojun Exp $"); +__KERNEL_RCSID(0, "$NetBSD: bt485.c,v 1.10 2003/11/13 03:09:29 chs Exp $"); #include #include @@ -264,28 +264,30 @@ bt485_set_cmap(rc, cmapp) { struct bt485data *data = (struct bt485data *)rc; u_int count, index; - int s; + uint8_t r[256], g[256], b[256]; + int s, error; if (cmapp->index >= 256 || cmapp->count > 256 - cmapp->index) return (EINVAL); - if (!uvm_useracc(cmapp->red, cmapp->count, B_READ) || - !uvm_useracc(cmapp->green, cmapp->count, B_READ) || - !uvm_useracc(cmapp->blue, cmapp->count, B_READ)) - return (EFAULT); - - s = spltty(); index = cmapp->index; count = cmapp->count; - copyin(cmapp->red, &data->cmap_r[index], count); - copyin(cmapp->green, &data->cmap_g[index], count); - copyin(cmapp->blue, &data->cmap_b[index], count); - + error = copyin(cmapp->red, &r[index], count); + if (error) + return error; + error = copyin(cmapp->green, &g[index], count); + if (error) + return error; + error = copyin(cmapp->blue, &b[index], count); + if (error) + return error; + s = spltty(); + memcpy(&data->cmap_r[index], &r[index], count); + memcpy(&data->cmap_g[index], &g[index], count); + memcpy(&data->cmap_b[index], &b[index], count); data->changed |= DATA_CMAP_CHANGED; - data->ramdac_sched_update(data->cookie, bt485_update); splx(s); - return (0); } @@ -303,7 +305,6 @@ bt485_get_cmap(rc, cmapp) count = cmapp->count; index = cmapp->index; - error = copyout(&data->cmap_r[index], cmapp->red, count); if (error) return (error); @@ -320,13 +321,14 @@ bt485_set_cursor(rc, cursorp) struct wsdisplay_cursor *cursorp; { struct bt485data *data = (struct bt485data *)rc; - u_int count, index, v; - int s; + u_int count = 0, icount = 0, index = 0, v; + char r[2], g[2], b[2], image[512], mask[512]; + int s, error; v = cursorp->which; /* - * For DOCMAP and DOSHAPE, verify that parameters are OK + * For DOCMAP and DOSHAPE, copy in the new data * before we do anything that we can't recover from. */ if (v & WSDISPLAY_CURSOR_DOCMAP) { @@ -334,19 +336,28 @@ bt485_set_cursor(rc, cursorp) (cursorp->cmap.index + cursorp->cmap.count) > 2) return (EINVAL); count = cursorp->cmap.count; - if (!uvm_useracc(cursorp->cmap.red, count, B_READ) || - !uvm_useracc(cursorp->cmap.green, count, B_READ) || - !uvm_useracc(cursorp->cmap.blue, count, B_READ)) - return (EFAULT); + index = cursorp->cmap.index; + error = copyin(cursorp->cmap.red, &r[index], count); + if (error) + return error; + error = copyin(cursorp->cmap.green, &g[index], count); + if (error) + return error; + error = copyin(cursorp->cmap.blue, &b[index], count); + if (error) + return error; } if (v & WSDISPLAY_CURSOR_DOSHAPE) { if (cursorp->size.x > CURSOR_MAX_SIZE || cursorp->size.y > CURSOR_MAX_SIZE) return (EINVAL); - count = (CURSOR_MAX_SIZE / NBBY) * data->cursize.y; - if (!uvm_useracc(cursorp->image, count, B_READ) || - !uvm_useracc(cursorp->mask, count, B_READ)) - return (EFAULT); + icount = (CURSOR_MAX_SIZE / NBBY) * data->cursize.y; + error = copyin(cursorp->image, image, icount); + if (error) + return error; + error = copyin(cursorp->mask, mask, icount); + if (error) + return error; } if (v & (WSDISPLAY_CURSOR_DOPOS | WSDISPLAY_CURSOR_DOCUR)) { @@ -359,17 +370,15 @@ bt485_set_cursor(rc, cursorp) s = spltty(); - /* Parameters are OK; perform the requested operations. */ + /* Data is all available; perform the requested operations. */ if (v & WSDISPLAY_CURSOR_DOCUR) { data->curenb = cursorp->enable; data->changed |= DATA_ENB_CHANGED; } if (v & WSDISPLAY_CURSOR_DOCMAP) { - count = cursorp->cmap.count; - index = cursorp->cmap.index; - copyin(cursorp->cmap.red, &data->curcmap_r[index], count); - copyin(cursorp->cmap.green, &data->curcmap_g[index], count); - copyin(cursorp->cmap.blue, &data->curcmap_b[index], count); + memcpy(&data->curcmap_r[index], &r[index], count); + memcpy(&data->curcmap_g[index], &g[index], count); + memcpy(&data->curcmap_b[index], &b[index], count); data->changed |= DATA_CURCMAP_CHANGED; } if (v & WSDISPLAY_CURSOR_DOSHAPE) { @@ -377,8 +386,8 @@ bt485_set_cursor(rc, cursorp) count = (CURSOR_MAX_SIZE / NBBY) * data->cursize.y; memset(data->curimage, 0, sizeof data->curimage); memset(data->curmask, 0, sizeof data->curmask); - copyin(cursorp->image, data->curimage, count); /* can't fail */ - copyin(cursorp->mask, data->curmask, count); /* can't fail */ + memcpy(data->curimage, image, icount); + memcpy(data->curmask, mask, icount); data->changed |= DATA_CURSHAPE_CHANGED; } diff --git a/sys/dev/ic/ibm561.c b/sys/dev/ic/ibm561.c index 7462de829e10..eb404a636195 100644 --- a/sys/dev/ic/ibm561.c +++ b/sys/dev/ic/ibm561.c @@ -1,4 +1,4 @@ -/* $NetBSD: ibm561.c,v 1.4 2003/07/14 15:47:10 lukem Exp $ */ +/* $NetBSD: ibm561.c,v 1.5 2003/11/13 03:09:29 chs Exp $ */ /*- * Copyright (c) 2001 The NetBSD Foundation, Inc. @@ -37,7 +37,7 @@ */ #include -__KERNEL_RCSID(0, "$NetBSD: ibm561.c,v 1.4 2003/07/14 15:47:10 lukem Exp $"); +__KERNEL_RCSID(0, "$NetBSD: ibm561.c,v 1.5 2003/11/13 03:09:29 chs Exp $"); #include #include @@ -277,22 +277,30 @@ ibm561_set_cmap(rc, cmapp) { struct ibm561data *data = (struct ibm561data *)rc; u_int count, index; - int s; + uint8_t r[IBM561_NCMAP_ENTRIES]; + uint8_t g[IBM561_NCMAP_ENTRIES]; + uint8_t b[IBM561_NCMAP_ENTRIES]; + int s, error; if (cmapp->index >= IBM561_NCMAP_ENTRIES || cmapp->count > IBM561_NCMAP_ENTRIES - cmapp->index) return (EINVAL); - if (!uvm_useracc(cmapp->red, cmapp->count, B_READ) || - !uvm_useracc(cmapp->green, cmapp->count, B_READ) || - !uvm_useracc(cmapp->blue, cmapp->count, B_READ)) - return (EFAULT); - s = spltty(); index = cmapp->index; count = cmapp->count; - copyin(cmapp->red, &data->cmap_r[index], count); - copyin(cmapp->green, &data->cmap_g[index], count); - copyin(cmapp->blue, &data->cmap_b[index], count); + error = copyin(cmapp->red, &r[index], count); + if (error) + return error; + error = copyin(cmapp->green, &g[index], count); + if (error) + return error; + error = copyin(cmapp->blue, &b[index], count); + if (error) + return error; + s = spltty(); + memcpy(&data->cmap_r[index], &r[index], count); + memcpy(&data->cmap_g[index], &g[index], count); + memcpy(&data->cmap_b[index], &b[index], count); data->changed |= CHANGED_CMAP; data->ramdac_sched_update(data->cookie, ibm561_update); splx(s); diff --git a/sys/dev/ic/igsfb.c b/sys/dev/ic/igsfb.c index 5cd23df1bc1f..92e0ae374d03 100644 --- a/sys/dev/ic/igsfb.c +++ b/sys/dev/ic/igsfb.c @@ -1,4 +1,4 @@ -/* $NetBSD: igsfb.c,v 1.16 2003/11/07 15:02:28 uwe Exp $ */ +/* $NetBSD: igsfb.c,v 1.17 2003/11/13 03:09:29 chs Exp $ */ /* * Copyright (c) 2002, 2003 Valeriy E. Ushakov @@ -31,7 +31,7 @@ * Integraphics Systems IGA 168x and CyberPro series. */ #include -__KERNEL_RCSID(0, "$NetBSD: igsfb.c,v 1.16 2003/11/07 15:02:28 uwe Exp $"); +__KERNEL_RCSID(0, "$NetBSD: igsfb.c,v 1.17 2003/11/13 03:09:29 chs Exp $"); #include #include @@ -756,25 +756,31 @@ igsfb_set_cmap(dc, p) const struct wsdisplay_cmap *p; { u_int index, count; + uint8_t r[IGS_CMAP_SIZE]; + uint8_t g[IGS_CMAP_SIZE]; + uint8_t b[IGS_CMAP_SIZE]; + int error; index = p->index; count = p->count; - if (index >= IGS_CMAP_SIZE || count > IGS_CMAP_SIZE - index) return (EINVAL); + error = copyin(p->red, &r[index], count); + if (error) + return error; + error = copyin(p->green, &g[index], count); + if (error) + return error; + error = copyin(p->blue, &b[index], count); + if (error) + return error; - if (!uvm_useracc(p->red, count, B_READ) || - !uvm_useracc(p->green, count, B_READ) || - !uvm_useracc(p->blue, count, B_READ)) - return (EFAULT); - - copyin(p->red, &dc->dc_cmap.r[index], count); - copyin(p->green, &dc->dc_cmap.g[index], count); - copyin(p->blue, &dc->dc_cmap.b[index], count); + memcpy(&dc->dc_cmap.r[index], &r[index], count); + memcpy(&dc->dc_cmap.g[index], &g[index], count); + memcpy(&dc->dc_cmap.b[index], &b[index], count); /* propagate changes to the device */ igsfb_update_cmap(dc, index, count); - return (0); } @@ -896,23 +902,28 @@ igsfb_set_cursor(dc, p) struct igs_hwcursor *cc; struct wsdisplay_curpos pos, hot; u_int v, index, count, icount, iwidth; + uint8_t r[2], g[2], b[2], image[512], mask[512]; + int error; cc = &dc->dc_cursor; v = p->which; + index = count = icount = iwidth = 0; /* XXX: gcc */ - index = count = icount = iwidth = 0; /* XXX: gcc */ - - /* verify that the new cursor colormap is valid */ + /* copy in the new cursor colormap */ if (v & WSDISPLAY_CURSOR_DOCMAP) { index = p->cmap.index; count = p->cmap.count; if (index >= 2 || (index + count) > 2) return (EINVAL); - - if (!uvm_useracc(p->cmap.red, count, B_READ) - || !uvm_useracc(p->cmap.green, count, B_READ) - || !uvm_useracc(p->cmap.blue, count, B_READ)) - return (EFAULT); + error = copyin(p->cmap.red, &r[index], count); + if (error) + return error; + error = copyin(p->cmap.green, &g[index], count); + if (error) + return error; + error = copyin(p->cmap.blue, &b[index], count); + if (error) + return error; } /* verify that the new cursor data are valid */ @@ -923,9 +934,12 @@ igsfb_set_cursor(dc, p) iwidth = (p->size.x + 7) >> 3; /* bytes per scan line */ icount = iwidth * p->size.y; - if (!uvm_useracc(p->image, icount, B_READ) - || !uvm_useracc(p->mask, icount, B_READ)) - return (EFAULT); + error = copyin(p->image, image, icount); + if (error) + return error; + error = copyin(p->mask, mask, icount); + if (error) + return error; } /* enforce that the position is within screen bounds */ @@ -957,28 +971,23 @@ igsfb_set_cursor(dc, p) nhot->y = nsize->y - 1; } - - /* arguments verified, copy data to the driver's cursor info */ + /* copy data to the driver's cursor info */ if (v & WSDISPLAY_CURSOR_DOCUR) dc->dc_curenb = p->enable; - if (v & WSDISPLAY_CURSOR_DOPOS) cc->cc_pos = pos; /* local copy, possibly corrected */ - if (v & WSDISPLAY_CURSOR_DOHOT) cc->cc_hot = hot; /* local copy, possibly corrected */ - if (v & WSDISPLAY_CURSOR_DOCMAP) { - copyin(p->cmap.red, &cc->cc_color[index], count); - copyin(p->cmap.green, &cc->cc_color[index + 2], count); - copyin(p->cmap.blue, &cc->cc_color[index + 4], count); + memcpy(&cc->cc_color[index], &r[index], count); + memcpy(&cc->cc_color[index + 2], &g[index], count); + memcpy(&cc->cc_color[index + 4], &b[index], count); } - if (v & WSDISPLAY_CURSOR_DOSHAPE) { u_int trailing_bits; - copyin(p->image, cc->cc_image, icount); - copyin(p->mask, cc->cc_mask, icount); + memcpy(cc->cc_image, image, icount); + memcpy(cc->cc_mask, mask, icount); cc->cc_size = p->size; /* clear trailing bits in the "partial" mask bytes */ diff --git a/sys/dev/pci/tga.c b/sys/dev/pci/tga.c index dbf42405ae09..65d324797430 100644 --- a/sys/dev/pci/tga.c +++ b/sys/dev/pci/tga.c @@ -1,4 +1,4 @@ -/* $NetBSD: tga.c,v 1.56 2003/10/29 04:43:18 mycroft Exp $ */ +/* $NetBSD: tga.c,v 1.57 2003/11/13 03:09:29 chs Exp $ */ /* * Copyright (c) 1995, 1996 Carnegie-Mellon University. @@ -28,7 +28,7 @@ */ #include -__KERNEL_RCSID(0, "$NetBSD: tga.c,v 1.56 2003/10/29 04:43:18 mycroft Exp $"); +__KERNEL_RCSID(0, "$NetBSD: tga.c,v 1.57 2003/11/13 03:09:29 chs Exp $"); #include #include @@ -810,6 +810,7 @@ tga_builtin_set_cursor(dc, cursorp) { struct ramdac_funcs *dcrf = dc->dc_ramdac_funcs; struct ramdac_cookie *dcrc = dc->dc_ramdac_cookie; + u_char image[512]; u_int count, v; int error; @@ -825,8 +826,9 @@ tga_builtin_set_cursor(dc, cursorp) return (EINVAL); /* The cursor is 2 bits deep, and there is no mask */ count = (cursorp->size.y * 64 * 2) / NBBY; - if (!uvm_useracc(cursorp->image, count, B_READ)) - return (EFAULT); + error = copyin(cursorp->image, image, count); + if (error) + return error; } if (v & WSDISPLAY_CURSOR_DOHOT) /* not supported */ return EINVAL; @@ -835,26 +837,28 @@ tga_builtin_set_cursor(dc, cursorp) if (v & WSDISPLAY_CURSOR_DOCUR) { if (cursorp->enable) /* XXX */ - TGAWREG(dc, TGA_REG_VVVR, TGARREG(dc, TGA_REG_VVVR) | 0x04); + TGAWREG(dc, TGA_REG_VVVR, + TGARREG(dc, TGA_REG_VVVR) | 0x04); else /* XXX */ - TGAWREG(dc, TGA_REG_VVVR, TGARREG(dc, TGA_REG_VVVR) & ~0x04); + TGAWREG(dc, TGA_REG_VVVR, + TGARREG(dc, TGA_REG_VVVR) & ~0x04); } if (v & WSDISPLAY_CURSOR_DOPOS) { - TGAWREG(dc, TGA_REG_CXYR, - ((cursorp->pos.y & 0xfff) << 12) | (cursorp->pos.x & 0xfff)); + TGAWREG(dc, TGA_REG_CXYR, ((cursorp->pos.y & 0xfff) << 12) | + (cursorp->pos.x & 0xfff)); } if (v & WSDISPLAY_CURSOR_DOCMAP) { - /* can't fail. */ dcrf->ramdac_set_curcmap(dcrc, cursorp); } if (v & WSDISPLAY_CURSOR_DOSHAPE) { count = ((64 * 2) / NBBY) * cursorp->size.y; TGAWREG(dc, TGA_REG_CCBR, - (TGARREG(dc, TGA_REG_CCBR) & ~0xfc00) | (cursorp->size.y << 10)); - copyin(cursorp->image, (char *)(dc->dc_vaddr + - (TGARREG(dc, TGA_REG_CCBR) & 0x3ff)), - count); /* can't fail. */ + (TGARREG(dc, TGA_REG_CCBR) & ~0xfc00) | + (cursorp->size.y << 10)); + memcpy((char *)(dc->dc_vaddr + + (TGARREG(dc, TGA_REG_CCBR) & 0x3ff)), + image, count); } return (0); } diff --git a/sys/dev/sbus/zx.c b/sys/dev/sbus/zx.c index e039b2ccfb06..6d3cb6e8c1d3 100644 --- a/sys/dev/sbus/zx.c +++ b/sys/dev/sbus/zx.c @@ -1,4 +1,4 @@ -/* $NetBSD: zx.c,v 1.12 2003/10/28 15:25:27 chs Exp $ */ +/* $NetBSD: zx.c,v 1.13 2003/11/13 03:09:29 chs Exp $ */ /* * Copyright (c) 2002 The NetBSD Foundation, Inc. @@ -52,7 +52,7 @@ */ #include -__KERNEL_RCSID(0, "$NetBSD: zx.c,v 1.12 2003/10/28 15:25:27 chs Exp $"); +__KERNEL_RCSID(0, "$NetBSD: zx.c,v 1.13 2003/11/13 03:09:29 chs Exp $"); #include #include @@ -303,6 +303,7 @@ zxioctl(dev_t dev, u_long cmd, caddr_t data, int flags, struct proc *p) struct zx_softc *sc; struct fbcmap *cm; struct fbcursor *cu; + uint32_t curbits[2][32]; int rv, v, count, i; sc = zx_cd.cd_devs[minor(dev)]; @@ -386,9 +387,12 @@ zxioctl(dev_t dev, u_long cmd, caddr_t data, int flags, struct proc *p) if ((u_int)cu->size.x > 32 || (u_int)cu->size.y > 32) return (EINVAL); count = cu->size.y * 4; - if (!uvm_useracc(cu->image, count, B_READ) || - !uvm_useracc(cu->mask, count, B_READ)) - return (EFAULT); + rv = copyin(cu->mask, curbits[0], count); + if (rv) + return rv; + rv = copyin(cu->image, curbits[1], count); + if (rv) + return rv; } if ((v & FB_CUR_SETCUR) != 0) { if (cu->enable) @@ -424,8 +428,8 @@ zxioctl(dev_t dev, u_long cmd, caddr_t data, int flags, struct proc *p) sc->sc_cursize = cu->size; count = cu->size.y * 4; memset(sc->sc_curbits, 0, sizeof(sc->sc_curbits)); - copyin(cu->mask, (caddr_t)sc->sc_curbits[0], count); - copyin(cu->image, (caddr_t)sc->sc_curbits[1], count); + memcpy(sc->sc_curbits[0], curbits[0], count); + memcpy(sc->sc_curbits[1], curbits[1], count); zx_cursor_set(sc); } break; @@ -441,12 +445,10 @@ zxioctl(dev_t dev, u_long cmd, caddr_t data, int flags, struct proc *p) if (cu->image != NULL) { count = sc->sc_cursize.y * 4; - rv = copyout((caddr_t)sc->sc_curbits[1], - (caddr_t)cu->image, count); + rv = copyout(sc->sc_curbits[1], cu->image, count); if (rv) return (rv); - rv = copyout((caddr_t)sc->sc_curbits[0], - (caddr_t)cu->mask, count); + rv = copyout(sc->sc_curbits[0], cu->mask, count); if (rv) return (rv); } diff --git a/sys/dev/sun/bt_subr.c b/sys/dev/sun/bt_subr.c index c81057821e9a..a200065c4d03 100644 --- a/sys/dev/sun/bt_subr.c +++ b/sys/dev/sun/bt_subr.c @@ -1,4 +1,4 @@ -/* $NetBSD: bt_subr.c,v 1.7 2003/08/25 17:50:29 uwe Exp $ */ +/* $NetBSD: bt_subr.c,v 1.8 2003/11/13 03:09:29 chs Exp $ */ /* * Copyright (c) 1993 @@ -41,7 +41,7 @@ */ #include -__KERNEL_RCSID(0, "$NetBSD: bt_subr.c,v 1.7 2003/08/25 17:50:29 uwe Exp $"); +__KERNEL_RCSID(0, "$NetBSD: bt_subr.c,v 1.8 2003/11/13 03:09:29 chs Exp $"); #include #include @@ -83,14 +83,8 @@ bt_getcmap(p, cm, cmsize, uspace) return (EINVAL); if (uspace) { - /* Check user buffers for appropriate access */ - if (!uvm_useracc(p->red, count, B_WRITE) || - !uvm_useracc(p->green, count, B_WRITE) || - !uvm_useracc(p->blue, count, B_WRITE)) - return (EFAULT); - /* Allocate temporary buffer for color values */ - cbuf = malloc(3*count*sizeof(char), M_TEMP, M_WAITOK); + cbuf = malloc(3 * count * sizeof(char), M_TEMP, M_WAITOK); r = cbuf; g = r + count; b = g + count; @@ -148,14 +142,8 @@ bt_putcmap(p, cm, cmsize, uspace) return (EINVAL); if (uspace) { - /* Check user buffers for appropriate access */ - if (!uvm_useracc(p->red, count, B_READ) || - !uvm_useracc(p->green, count, B_READ) || - !uvm_useracc(p->blue, count, B_READ)) - return (EFAULT); - /* Allocate temporary buffer for color values */ - cbuf = malloc(3*count*sizeof(char), M_TEMP, M_WAITOK); + cbuf = malloc(3 * count * sizeof(char), M_TEMP, M_WAITOK); r = cbuf; g = r + count; b = g + count; diff --git a/sys/dev/sun/cgsix.c b/sys/dev/sun/cgsix.c index 7c48af24be5c..2c40807e72d4 100644 --- a/sys/dev/sun/cgsix.c +++ b/sys/dev/sun/cgsix.c @@ -1,4 +1,4 @@ -/* $NetBSD: cgsix.c,v 1.15 2003/08/25 17:50:29 uwe Exp $ */ +/* $NetBSD: cgsix.c,v 1.16 2003/11/13 03:09:29 chs Exp $ */ /*- * Copyright (c) 1998 The NetBSD Foundation, Inc. @@ -85,7 +85,7 @@ */ #include -__KERNEL_RCSID(0, "$NetBSD: cgsix.c,v 1.15 2003/08/25 17:50:29 uwe Exp $"); +__KERNEL_RCSID(0, "$NetBSD: cgsix.c,v 1.16 2003/11/13 03:09:29 chs Exp $"); #include #include @@ -569,9 +569,10 @@ cgsixioctl(dev, cmd, data, flags, p) struct proc *p; { struct cgsix_softc *sc = cgsix_cd.cd_devs[minor(dev)]; + union cursor_cmap tcm; + uint32_t image[32], mask[32]; u_int count; int v, error; - union cursor_cmap tcm; switch (cmd) { @@ -635,12 +636,10 @@ cgsixioctl(dev, cmd, data, flags, p) /* begin ugh ... can we lose some of this crap?? */ if (p->image != NULL) { count = cc->cc_size.y * 32 / NBBY; - error = copyout((caddr_t)cc->cc_bits[1], - (caddr_t)p->image, count); + error = copyout(cc->cc_bits[1], p->image, count); if (error) return (error); - error = copyout((caddr_t)cc->cc_bits[0], - (caddr_t)p->mask, count); + error = copyout(cc->cc_bits[0], p->mask, count); if (error) return (error); } @@ -678,9 +677,12 @@ cgsixioctl(dev, cmd, data, flags, p) if ((u_int)p->size.x > 32 || (u_int)p->size.y > 32) return (EINVAL); count = p->size.y * 32 / NBBY; - if (!uvm_useracc(p->image, count, B_READ) || - !uvm_useracc(p->mask, count, B_READ)) - return (EFAULT); + error = copyin(p->image, image, count); + if (error) + return error; + error = copyin(p->mask, mask, count); + if (error) + return error; } /* parameters are OK; do it */ @@ -700,9 +702,9 @@ cgsixioctl(dev, cmd, data, flags, p) if (v & FB_CUR_SETSHAPE) { cc->cc_size = p->size; count = p->size.y * 32 / NBBY; - bzero((caddr_t)cc->cc_bits, sizeof cc->cc_bits); - copyin(p->mask, (caddr_t)cc->cc_bits[0], count); - copyin(p->image, (caddr_t)cc->cc_bits[1], count); + memset(cc->cc_bits, 0, sizeof cc->cc_bits); + memcpy(cc->cc_bits[1], image, count); + memcpy(cc->cc_bits[0], mask, count); cg6_loadcursor(sc); } break; diff --git a/sys/dev/tc/cfb.c b/sys/dev/tc/cfb.c index 2dc8e1074a2d..9b4b1538c3c0 100644 --- a/sys/dev/tc/cfb.c +++ b/sys/dev/tc/cfb.c @@ -1,4 +1,4 @@ -/* $NetBSD: cfb.c,v 1.41 2003/10/27 07:07:35 chs Exp $ */ +/* $NetBSD: cfb.c,v 1.42 2003/11/13 03:09:29 chs Exp $ */ /* * Copyright (c) 1998, 1999 Tohru Nishimura. All rights reserved. @@ -31,7 +31,7 @@ */ #include -__KERNEL_RCSID(0, "$NetBSD: cfb.c,v 1.41 2003/10/27 07:07:35 chs Exp $"); +__KERNEL_RCSID(0, "$NetBSD: cfb.c,v 1.42 2003/11/13 03:09:29 chs Exp $"); #include #include @@ -111,7 +111,8 @@ struct hwcursor64 { struct wsdisplay_curpos cc_magic; #define CURSOR_MAX_SIZE 64 u_int8_t cc_color[6]; - u_int64_t cc_image[64 + 64]; + u_int64_t cc_image[CURSOR_MAX_SIZE]; + u_int64_t cc_mask[CURSOR_MAX_SIZE]; }; struct cfb_softc { @@ -551,7 +552,7 @@ cfbintr(arg) int bcnt; ip = (u_int8_t *)sc->sc_cursor.cc_image; - mp = (u_int8_t *)(sc->sc_cursor.cc_image + CURSOR_MAX_SIZE); + mp = (u_int8_t *)sc->sc_cursor.cc_mask; bcnt = 0; SELECT(vdac, BT459_IREG_CRAM_BASE+0); @@ -670,20 +671,19 @@ get_cmap(sc, p) struct wsdisplay_cmap *p; { u_int index = p->index, count = p->count; + int error; if (index >= CMAP_SIZE || count > CMAP_SIZE - index) return (EINVAL); - if (!uvm_useracc(p->red, count, B_WRITE) || - !uvm_useracc(p->green, count, B_WRITE) || - !uvm_useracc(p->blue, count, B_WRITE)) - return (EFAULT); - - copyout(&sc->sc_cmap.r[index], p->red, count); - copyout(&sc->sc_cmap.g[index], p->green, count); - copyout(&sc->sc_cmap.b[index], p->blue, count); - - return (0); + error = copyout(&sc->sc_cmap.r[index], p->red, count); + if (error) + return error; + error = copyout(&sc->sc_cmap.g[index], p->green, count); + if (error) + return error; + error = copyout(&sc->sc_cmap.b[index], p->blue, count); + return error; } static int @@ -691,19 +691,25 @@ set_cmap(sc, p) struct cfb_softc *sc; struct wsdisplay_cmap *p; { + struct hwcmap256 cmap; u_int index = p->index, count = p->count; + int error; if (index >= CMAP_SIZE || count > CMAP_SIZE - index) return (EINVAL); - if (!uvm_useracc(p->red, count, B_READ) || - !uvm_useracc(p->green, count, B_READ) || - !uvm_useracc(p->blue, count, B_READ)) - return (EFAULT); - - copyin(p->red, &sc->sc_cmap.r[index], count); - copyin(p->green, &sc->sc_cmap.g[index], count); - copyin(p->blue, &sc->sc_cmap.b[index], count); + error = copyin(p->red, &cmap.r[index], count); + if (error) + return error; + error = copyin(p->green, &cmap.g[index], count); + if (error) + return error; + error = copyin(p->blue, &cmap.b[index], count); + if (error) + return error; + memcpy(&sc->sc_cmap.r[index], &cmap.r[index], count); + memcpy(&sc->sc_cmap.g[index], &cmap.g[index], count); + memcpy(&sc->sc_cmap.b[index], &cmap.b[index], count); sc->sc_changed |= WSDISPLAY_CMAP_DOLUT; return (0); } @@ -715,6 +721,8 @@ set_cursor(sc, p) { #define cc (&sc->sc_cursor) u_int v, index = 0, count = 0, icount = 0; + uint8_t r[2], g[2], b[2], image[512], mask[512]; + int error; v = p->which; if (v & WSDISPLAY_CURSOR_DOCMAP) { @@ -722,18 +730,26 @@ set_cursor(sc, p) count = p->cmap.count; if (index >= 2 || (index + count) > 2) return (EINVAL); - if (!uvm_useracc(p->cmap.red, count, B_READ) || - !uvm_useracc(p->cmap.green, count, B_READ) || - !uvm_useracc(p->cmap.blue, count, B_READ)) - return (EFAULT); + error = copyin(p->cmap.red, &r[index], count); + if (error) + return error; + error = copyin(p->cmap.green, &g[index], count); + if (error) + return error; + error = copyin(p->cmap.blue, &b[index], count); + if (error) + return error; } if (v & WSDISPLAY_CURSOR_DOSHAPE) { if (p->size.x > CURSOR_MAX_SIZE || p->size.y > CURSOR_MAX_SIZE) return (EINVAL); icount = ((p->size.x < 33) ? 4 : 8) * p->size.y; - if (!uvm_useracc(p->image, icount, B_READ) || - !uvm_useracc(p->mask, icount, B_READ)) - return (EFAULT); + error = copyin(p->image, image, icount); + if (error) + return error; + error = copyin(p->mask, mask, icount); + if (error) + return error; } if (v & WSDISPLAY_CURSOR_DOCUR) @@ -743,15 +759,16 @@ set_cursor(sc, p) if (v & WSDISPLAY_CURSOR_DOHOT) cc->cc_hot = p->hot; if (v & WSDISPLAY_CURSOR_DOCMAP) { - copyin(p->cmap.red, &cc->cc_color[index], count); - copyin(p->cmap.green, &cc->cc_color[index + 2], count); - copyin(p->cmap.blue, &cc->cc_color[index + 4], count); + memcpy(&cc->cc_color[index], &r[index], count); + memcpy(&cc->cc_color[index + 2], &g[index], count); + memcpy(&cc->cc_color[index + 4], &b[index], count); } if (v & WSDISPLAY_CURSOR_DOSHAPE) { cc->cc_size = p->size; memset(cc->cc_image, 0, sizeof cc->cc_image); - copyin(p->image, cc->cc_image, icount); - copyin(p->mask, cc->cc_image+CURSOR_MAX_SIZE, icount); + memcpy(cc->cc_image, image, icount); + memset(cc->cc_mask, 0, sizeof cc->cc_mask); + memcpy(cc->cc_mask, mask, icount); } sc->sc_changed |= v; diff --git a/sys/dev/tc/mfb.c b/sys/dev/tc/mfb.c index 005d0fea6f55..542404626192 100644 --- a/sys/dev/tc/mfb.c +++ b/sys/dev/tc/mfb.c @@ -1,4 +1,4 @@ -/* $NetBSD: mfb.c,v 1.38 2003/10/27 07:07:35 chs Exp $ */ +/* $NetBSD: mfb.c,v 1.39 2003/11/13 03:09:29 chs Exp $ */ /* * Copyright (c) 1998, 1999 Tohru Nishimura. All rights reserved. @@ -31,7 +31,7 @@ */ #include -__KERNEL_RCSID(0, "$NetBSD: mfb.c,v 1.38 2003/10/27 07:07:35 chs Exp $"); +__KERNEL_RCSID(0, "$NetBSD: mfb.c,v 1.39 2003/11/13 03:09:29 chs Exp $"); #include #include @@ -104,7 +104,8 @@ struct hwcursor64 { struct wsdisplay_curpos cc_magic; #define CURSOR_MAX_SIZE 64 u_int8_t cc_color[6]; - u_int64_t cc_image[64 + 64]; + u_int64_t cc_image[CURSOR_MAX_SIZE]; + u_int64_t cc_mask[CURSOR_MAX_SIZE]; }; struct mfb_softc { @@ -539,7 +540,7 @@ mfbintr(arg) int bcnt; ip = (u_int8_t *)sc->sc_cursor.cc_image; - mp = (u_int8_t *)(sc->sc_cursor.cc_image + CURSOR_MAX_SIZE); + mp = (u_int8_t *)(sc->sc_cursor.cc_mask); bcnt = 0; SELECT431(curs, BT431_REG_CRAM_BASE); @@ -625,7 +626,11 @@ set_cursor(sc, p) struct wsdisplay_cursor *p; { #define cc (&sc->sc_cursor) - u_int v, count = 0, index = 0; + u_int v, count = 0, icount = 0, index = 0; + uint64_t image[CURSOR_MAX_SIZE]; + uint64_t mask[CURSOR_MAX_SIZE]; + uint8_t color[6]; + int error; v = p->which; if (v & WSDISPLAY_CURSOR_DOCMAP) { @@ -633,16 +638,20 @@ set_cursor(sc, p) count = p->cmap.count; if (index >= 2 || (index + count) > 2) return (EINVAL); - if (!uvm_useracc(p->cmap.red, count, B_READ)) - return (EFAULT); + error = copyin(p->cmap.red, &color[index], count); + if (error) + return error; } if (v & WSDISPLAY_CURSOR_DOSHAPE) { if (p->size.x > CURSOR_MAX_SIZE || p->size.y > CURSOR_MAX_SIZE) return (EINVAL); - count = ((p->size.x < 33) ? 4 : 8) * p->size.y; - if (!uvm_useracc(p->image, count, B_READ) || - !uvm_useracc(p->mask, count, B_READ)) - return (EFAULT); + icount = ((p->size.x < 33) ? 4 : 8) * p->size.y; + error = copyin(p->image, image, icount); + if (error) + return error; + error = copyin(p->mask, mask, icount); + if (error) + return error; } if (v & WSDISPLAY_CURSOR_DOCUR) @@ -652,12 +661,13 @@ set_cursor(sc, p) if (v & WSDISPLAY_CURSOR_DOHOT) cc->cc_hot = p->hot; if (v & WSDISPLAY_CURSOR_DOCMAP) - copyin(p->cmap.red, &cc->cc_color[index], count); + memcpy(&cc->cc_color[index], &color[index], count); if (v & WSDISPLAY_CURSOR_DOSHAPE) { cc->cc_size = p->size; memset(cc->cc_image, 0, sizeof cc->cc_image); - copyin(p->image, cc->cc_image, count); - copyin(p->mask, cc->cc_image+CURSOR_MAX_SIZE, count); + memcpy(cc->cc_image, image, icount); + memset(cc->cc_mask, 0, sizeof cc->cc_mask); + memcpy(cc->cc_mask, mask, icount); } sc->sc_changed = v; diff --git a/sys/dev/tc/sfb.c b/sys/dev/tc/sfb.c index bd089ee0053e..6f4a237acacf 100644 --- a/sys/dev/tc/sfb.c +++ b/sys/dev/tc/sfb.c @@ -1,4 +1,4 @@ -/* $NetBSD: sfb.c,v 1.60 2003/10/27 07:07:35 chs Exp $ */ +/* $NetBSD: sfb.c,v 1.61 2003/11/13 03:09:29 chs Exp $ */ /* * Copyright (c) 1998, 1999 Tohru Nishimura. All rights reserved. @@ -31,7 +31,7 @@ */ #include -__KERNEL_RCSID(0, "$NetBSD: sfb.c,v 1.60 2003/10/27 07:07:35 chs Exp $"); +__KERNEL_RCSID(0, "$NetBSD: sfb.c,v 1.61 2003/11/13 03:09:29 chs Exp $"); #include #include @@ -112,7 +112,8 @@ struct hwcursor64 { struct wsdisplay_curpos cc_magic; #define CURSOR_MAX_SIZE 64 u_int8_t cc_color[6]; - u_int64_t cc_image[64 + 64]; + u_int64_t cc_image[CURSOR_MAX_SIZE]; + u_int64_t cc_mask[CURSOR_MAX_SIZE]; }; struct sfb_softc { @@ -580,7 +581,7 @@ sfbintr(arg) int bcnt; ip = (u_int8_t *)sc->sc_cursor.cc_image; - mp = (u_int8_t *)(sc->sc_cursor.cc_image + CURSOR_MAX_SIZE); + mp = (u_int8_t *)sc->sc_cursor.cc_mask; bcnt = 0; SELECT(vdac, BT459_IREG_CRAM_BASE+0); @@ -700,20 +701,19 @@ get_cmap(sc, p) struct wsdisplay_cmap *p; { u_int index = p->index, count = p->count; + int error; if (index >= CMAP_SIZE || count > CMAP_SIZE - index) return (EINVAL); - if (!uvm_useracc(p->red, count, B_WRITE) || - !uvm_useracc(p->green, count, B_WRITE) || - !uvm_useracc(p->blue, count, B_WRITE)) - return (EFAULT); - - copyout(&sc->sc_cmap.r[index], p->red, count); - copyout(&sc->sc_cmap.g[index], p->green, count); - copyout(&sc->sc_cmap.b[index], p->blue, count); - - return (0); + error = copyout(&sc->sc_cmap.r[index], p->red, count); + if (error) + return error; + error = copyout(&sc->sc_cmap.g[index], p->green, count); + if (error) + return error; + error = copyout(&sc->sc_cmap.b[index], p->blue, count); + return error; } static int @@ -721,19 +721,26 @@ set_cmap(sc, p) struct sfb_softc *sc; struct wsdisplay_cmap *p; { + struct hwcmap256 cmap; u_int index = p->index, count = p->count; + int error; if (index >= CMAP_SIZE || count > CMAP_SIZE - index) return (EINVAL); - if (!uvm_useracc(p->red, count, B_READ) || - !uvm_useracc(p->green, count, B_READ) || - !uvm_useracc(p->blue, count, B_READ)) - return (EFAULT); + error = copyin(p->red, &cmap.r[index], count); + if (error) + return error; + error = copyin(p->green, &cmap.g[index], count); + if (error) + return error; + error = copyin(p->blue, &cmap.b[index], count); + if (error) + return error; - copyin(p->red, &sc->sc_cmap.r[index], count); - copyin(p->green, &sc->sc_cmap.g[index], count); - copyin(p->blue, &sc->sc_cmap.b[index], count); + memcpy(&sc->sc_cmap.r[index], &cmap.r[index], count); + memcpy(&sc->sc_cmap.g[index], &cmap.g[index], count); + memcpy(&sc->sc_cmap.b[index], &cmap.b[index], count); sc->sc_changed |= WSDISPLAY_CMAP_DOLUT; return (0); } @@ -745,6 +752,8 @@ set_cursor(sc, p) { #define cc (&sc->sc_cursor) u_int v, index = 0, count = 0, icount = 0; + uint8_t r[2], g[2], b[2], image[512], mask[512]; + int error; v = p->which; if (v & WSDISPLAY_CURSOR_DOCMAP) { @@ -752,18 +761,26 @@ set_cursor(sc, p) count = p->cmap.count; if (index >= 2 || (index + count) > 2) return (EINVAL); - if (!uvm_useracc(p->cmap.red, count, B_READ) || - !uvm_useracc(p->cmap.green, count, B_READ) || - !uvm_useracc(p->cmap.blue, count, B_READ)) - return (EFAULT); + error = copyin(p->cmap.red, &r[index], count); + if (error) + return error; + error = copyin(p->cmap.green, &g[index], count); + if (error) + return error; + error = copyin(p->cmap.blue, &b[index], count); + if (error) + return error; } if (v & WSDISPLAY_CURSOR_DOSHAPE) { if (p->size.x > CURSOR_MAX_SIZE || p->size.y > CURSOR_MAX_SIZE) return (EINVAL); icount = ((p->size.x < 33) ? 4 : 8) * p->size.y; - if (!uvm_useracc(p->image, icount, B_READ) || - !uvm_useracc(p->mask, icount, B_READ)) - return (EFAULT); + error = copyin(p->image, image, icount); + if (error) + return error; + error = copyin(p->mask, mask, icount); + if (error) + return error; } if (v & WSDISPLAY_CURSOR_DOCUR) @@ -773,15 +790,16 @@ set_cursor(sc, p) if (v & WSDISPLAY_CURSOR_DOHOT) cc->cc_hot = p->hot; if (v & WSDISPLAY_CURSOR_DOCMAP) { - copyin(p->cmap.red, &cc->cc_color[index], count); - copyin(p->cmap.green, &cc->cc_color[index + 2], count); - copyin(p->cmap.blue, &cc->cc_color[index + 4], count); + memcpy(&cc->cc_color[index], &r[index], count); + memcpy(&cc->cc_color[index + 2], &g[index], count); + memcpy(&cc->cc_color[index + 4], &b[index], count); } if (v & WSDISPLAY_CURSOR_DOSHAPE) { cc->cc_size = p->size; memset(cc->cc_image, 0, sizeof cc->cc_image); - copyin(p->image, cc->cc_image, icount); - copyin(p->mask, cc->cc_image+CURSOR_MAX_SIZE, icount); + memcpy(cc->cc_image, image, icount); + memset(cc->cc_mask, 0, sizeof cc->cc_mask); + memcpy(cc->cc_mask, mask, icount); } sc->sc_changed |= v; diff --git a/sys/dev/tc/sfbplus.c b/sys/dev/tc/sfbplus.c index 224292faf4d3..48e5a949642b 100644 --- a/sys/dev/tc/sfbplus.c +++ b/sys/dev/tc/sfbplus.c @@ -1,4 +1,4 @@ -/* $NetBSD: sfbplus.c,v 1.18 2002/10/02 16:53:07 thorpej Exp $ */ +/* $NetBSD: sfbplus.c,v 1.19 2003/11/13 03:09:29 chs Exp $ */ /* * Copyright (c) 1999, 2000, 2001 Tohru Nishimura. All rights reserved. @@ -31,7 +31,7 @@ */ #include -__KERNEL_RCSID(0, "$NetBSD: sfbplus.c,v 1.18 2002/10/02 16:53:07 thorpej Exp $"); +__KERNEL_RCSID(0, "$NetBSD: sfbplus.c,v 1.19 2003/11/13 03:09:29 chs Exp $"); #include #include @@ -93,7 +93,8 @@ struct hwcursor64 { struct wsdisplay_curpos cc_magic; #define CURSOR_MAX_SIZE 64 u_int8_t cc_color[6]; - u_int64_t cc_image[64 + 64]; + u_int64_t cc_image[CURSOR_MAX_SIZE]; + u_int64_t cc_mask[CURSOR_MAX_SIZE]; }; struct hwops { @@ -709,20 +710,19 @@ get_cmap(sc, p) struct wsdisplay_cmap *p; { u_int index = p->index, count = p->count; + int error; if (index >= CMAP_SIZE || count > CMAP_SIZE - index) return (EINVAL); - if (!uvm_useracc(p->red, count, B_WRITE) || - !uvm_useracc(p->green, count, B_WRITE) || - !uvm_useracc(p->blue, count, B_WRITE)) - return (EFAULT); - - copyout(&sc->sc_cmap.r[index], p->red, count); - copyout(&sc->sc_cmap.g[index], p->green, count); - copyout(&sc->sc_cmap.b[index], p->blue, count); - - return (0); + error = copyout(&sc->sc_cmap.r[index], p->red, count); + if (error) + return error; + error = copyout(&sc->sc_cmap.g[index], p->green, count); + if (error) + return error; + error = copyout(&sc->sc_cmap.b[index], p->blue, count); + return error; } static int @@ -730,19 +730,25 @@ set_cmap(sc, p) struct sfbp_softc *sc; struct wsdisplay_cmap *p; { + struct hwcmap256 cmap; u_int index = p->index, count = p->count; + int error; if (index >= CMAP_SIZE || count > CMAP_SIZE - index) return (EINVAL); - if (!uvm_useracc(p->red, count, B_READ) || - !uvm_useracc(p->green, count, B_READ) || - !uvm_useracc(p->blue, count, B_READ)) - return (EFAULT); - - copyin(p->red, &sc->sc_cmap.r[index], count); - copyin(p->green, &sc->sc_cmap.g[index], count); - copyin(p->blue, &sc->sc_cmap.b[index], count); + error = copyin(p->red, &cmap.r[index], count); + if (error) + return error; + error = copyin(p->green, &cmap.g[index], count); + if (error) + return error; + error = copyin(p->blue, &cmap.b[index], count); + if (error) + return error; + memcpy(&sc->sc_cmap.r[index], &cmap.r[index], count); + memcpy(&sc->sc_cmap.g[index], &cmap.g[index], count); + memcpy(&sc->sc_cmap.b[index], &cmap.b[index], count); sc->sc_changed |= WSDISPLAY_CMAP_DOLUT; return (0); } @@ -753,7 +759,9 @@ set_cursor(sc, p) struct wsdisplay_cursor *p; { #define cc (&sc->sc_cursor) - u_int v, index, count, icount; + u_int v, index = 0, count = 0, icount = 0; + uint8_t r[2], g[2], b[2], image[512], mask[512]; + int error; v = p->which; if (v & WSDISPLAY_CURSOR_DOCMAP) { @@ -761,18 +769,26 @@ set_cursor(sc, p) count = p->cmap.count; if (index >= 2 || (index + count) > 2) return (EINVAL); - if (!uvm_useracc(p->cmap.red, count, B_READ) || - !uvm_useracc(p->cmap.green, count, B_READ) || - !uvm_useracc(p->cmap.blue, count, B_READ)) - return (EFAULT); + error = copyin(p->cmap.red, &r[index], count); + if (error) + return error; + error = copyin(p->cmap.green, &g[index], count); + if (error) + return error; + error = copyin(p->cmap.blue, &b[index], count); + if (error) + return error; } if (v & WSDISPLAY_CURSOR_DOSHAPE) { if (p->size.x > CURSOR_MAX_SIZE || p->size.y > CURSOR_MAX_SIZE) return (EINVAL); icount = ((p->size.x < 33) ? 4 : 8) * p->size.y; - if (!uvm_useracc(p->image, icount, B_READ) || - !uvm_useracc(p->mask, icount, B_READ)) - return (EFAULT); + error = copyin(p->image, image, icount); + if (error) + return error; + error = copyin(p->mask, mask, icount); + if (error) + return error; } if (v & WSDISPLAY_CURSOR_DOCUR) @@ -782,15 +798,16 @@ set_cursor(sc, p) if (v & WSDISPLAY_CURSOR_DOHOT) cc->cc_hot = p->hot; if (v & WSDISPLAY_CURSOR_DOCMAP) { - copyin(p->cmap.red, &cc->cc_color[index], count); - copyin(p->cmap.green, &cc->cc_color[index + 2], count); - copyin(p->cmap.blue, &cc->cc_color[index + 4], count); + memcpy(&cc->cc_color[index], &r[index], count); + memcpy(&cc->cc_color[index + 2], &g[index], count); + memcpy(&cc->cc_color[index + 4], &b[index], count); } if (v & WSDISPLAY_CURSOR_DOSHAPE) { cc->cc_size = p->size; memset(cc->cc_image, 0, sizeof cc->cc_image); - copyin(p->image, cc->cc_image, icount); - copyin(p->mask, cc->cc_image+CURSOR_MAX_SIZE, icount); + memcpy(cc->cc_image, image, icount); + memset(cc->cc_mask, 0, sizeof cc->cc_mask); + memcpy(cc->cc_mask, mask, icount); } sc->sc_changed = v; diff --git a/sys/dev/tc/stic.c b/sys/dev/tc/stic.c index afe9fd1cc1dc..1e83345d4abc 100644 --- a/sys/dev/tc/stic.c +++ b/sys/dev/tc/stic.c @@ -1,4 +1,4 @@ -/* $NetBSD: stic.c,v 1.25 2003/10/27 07:07:35 chs Exp $ */ +/* $NetBSD: stic.c,v 1.26 2003/11/13 03:09:29 chs Exp $ */ /*- * Copyright (c) 1999, 2000, 2001 The NetBSD Foundation, Inc. @@ -73,7 +73,7 @@ */ #include -__KERNEL_RCSID(0, "$NetBSD: stic.c,v 1.25 2003/10/27 07:07:35 chs Exp $"); +__KERNEL_RCSID(0, "$NetBSD: stic.c,v 1.26 2003/11/13 03:09:29 chs Exp $"); #include #include @@ -490,8 +490,9 @@ stic_setup_vdac(struct stic_info *si) s = spltty(); ip = (u_int8_t *)si->si_cursor.cc_image; - mp = ip + (sizeof(si->si_cursor.cc_image) >> 1); + mp = (u_int8_t *)si->si_cursor.cc_mask; memset(ip, 0, sizeof(si->si_cursor.cc_image)); + memset(mp, 0, sizeof(si->si_cursor.cc_mask)); for (r = 0; r < si->si_fonth; r++) { for (c = r & 1; c < si->si_fontw; c += 2) { @@ -1216,7 +1217,7 @@ stic_flush(struct stic_info *si) int bcnt; ip = (u_int8_t *)si->si_cursor.cc_image; - mp = (u_int8_t *)(si->si_cursor.cc_image + CURSOR_MAX_SIZE); + mp = (u_int8_t *)si->si_cursor.cc_mask; bcnt = 0; SELECT(vdac, BT459_IREG_CRAM_BASE); @@ -1257,30 +1258,28 @@ stic_flush(struct stic_info *si) int stic_get_cmap(struct stic_info *si, struct wsdisplay_cmap *p) { - u_int index, count; - - index = p->index; - count = p->count; + u_int index = p->index, count = p->count; + int error; if (index >= CMAP_SIZE || count > CMAP_SIZE - index) return (EINVAL); - if (!uvm_useracc(p->red, count, B_WRITE) || - !uvm_useracc(p->green, count, B_WRITE) || - !uvm_useracc(p->blue, count, B_WRITE)) - return (EFAULT); - - copyout(&si->si_cmap.r[index], p->red, count); - copyout(&si->si_cmap.g[index], p->green, count); - copyout(&si->si_cmap.b[index], p->blue, count); - return (0); + error = copyout(&si->si_cmap.r[index], p->red, count); + if (error) + return error; + error = copyout(&si->si_cmap.g[index], p->green, count); + if (error) + return error; + error = copyout(&si->si_cmap.b[index], p->blue, count); + return error; } int stic_set_cmap(struct stic_info *si, struct wsdisplay_cmap *p) { + struct stic_hwcmap256 cmap; u_int index, count; - int s; + int s, error; index = p->index; count = p->count; @@ -1288,15 +1287,20 @@ stic_set_cmap(struct stic_info *si, struct wsdisplay_cmap *p) if (index >= CMAP_SIZE || count > CMAP_SIZE - index) return (EINVAL); - if (!uvm_useracc(p->red, count, B_READ) || - !uvm_useracc(p->green, count, B_READ) || - !uvm_useracc(p->blue, count, B_READ)) - return (EFAULT); + error = copyin(p->red, &cmap.r[index], count); + if (error) + return error; + error = copyin(p->green, &cmap.g[index], count); + if (error) + return error; + error = copyin(p->blue, &cmap.b[index], count); + if (error) + return error; s = spltty(); - copyin(p->red, &si->si_cmap.r[index], count); - copyin(p->green, &si->si_cmap.g[index], count); - copyin(p->blue, &si->si_cmap.b[index], count); + memcpy(&si->si_cmap.r[index], &cmap.r[index], count); + memcpy(&si->si_cmap.g[index], &cmap.g[index], count); + memcpy(&si->si_cmap.b[index], &cmap.b[index], count); si->si_flags |= SI_CMAP_CHANGED; splx(s); @@ -1316,31 +1320,37 @@ stic_set_cursor(struct stic_info *si, struct wsdisplay_cursor *p) #define cc (&si->si_cursor) u_int v, index = 0, count = 0, icount = 0; struct stic_screen *ss; - int s; + uint8_t r[2], g[2], b[2], image[512], mask[512]; + int s, error; v = p->which; ss = si->si_curscreen; - if ((v & WSDISPLAY_CURSOR_DOCMAP) != 0) { index = p->cmap.index; count = p->cmap.count; if (index >= 2 || (index + count) > 2) return (EINVAL); - if (!uvm_useracc(p->cmap.red, count, B_READ) || - !uvm_useracc(p->cmap.green, count, B_READ) || - !uvm_useracc(p->cmap.blue, count, B_READ)) - return (EFAULT); + error = copyin(p->cmap.red, &r[index], count); + if (error) + return error; + error = copyin(p->cmap.green, &g[index], count); + if (error) + return error; + error = copyin(p->cmap.blue, &b[index], count); + if (error) + return error; } - if ((v & WSDISPLAY_CURSOR_DOSHAPE) != 0) { if (p->size.x > CURSOR_MAX_SIZE || p->size.y > CURSOR_MAX_SIZE) return (EINVAL); icount = ((p->size.x < 33) ? 4 : 8) * p->size.y; - if (!uvm_useracc(p->image, icount, B_READ) || - !uvm_useracc(p->mask, icount, B_READ)) - return (EFAULT); + error = copyin(p->image, image, icount); + if (error) + return error; + error = copyin(p->mask, mask, icount); + if (error) + return error; } - if ((v & (WSDISPLAY_CURSOR_DOPOS | WSDISPLAY_CURSOR_DOCUR)) != 0) { if (v & WSDISPLAY_CURSOR_DOCUR) cc->cc_hot = p->hot; @@ -1349,7 +1359,6 @@ stic_set_cursor(struct stic_info *si, struct wsdisplay_cursor *p) } s = spltty(); - if ((v & WSDISPLAY_CURSOR_DOCUR) != 0) { if (p->enable) ss->ss_flags |= SS_CURENB; @@ -1357,21 +1366,19 @@ stic_set_cursor(struct stic_info *si, struct wsdisplay_cursor *p) ss->ss_flags &= ~SS_CURENB; si->si_flags |= SI_CURENB_CHANGED; } - if ((v & WSDISPLAY_CURSOR_DOCMAP) != 0) { - copyin(p->cmap.red, &cc->cc_color[index], count); - copyin(p->cmap.green, &cc->cc_color[index + 2], count); - copyin(p->cmap.blue, &cc->cc_color[index + 4], count); + memcpy(&cc->cc_color[index], &r[index], count); + memcpy(&cc->cc_color[index + 2], &g[index], count); + memcpy(&cc->cc_color[index + 4], &b[index], count); si->si_flags |= SI_CURCMAP_CHANGED; } - if ((v & WSDISPLAY_CURSOR_DOSHAPE) != 0) { - memset(cc->cc_image, 0, sizeof(cc->cc_image)); - copyin(p->image, cc->cc_image, icount); - copyin(p->mask, cc->cc_image + CURSOR_MAX_SIZE, icount); + memset(cc->cc_image, 0, sizeof cc->cc_image); + memcpy(cc->cc_image, image, icount); + memset(cc->cc_mask, 0, sizeof cc->cc_mask); + memcpy(cc->cc_mask, mask, icount); si->si_flags |= SI_CURSHAPE_CHANGED; } - splx(s); /* diff --git a/sys/dev/tc/sticvar.h b/sys/dev/tc/sticvar.h index d2c46aaf2bc7..91ed4644c15f 100644 --- a/sys/dev/tc/sticvar.h +++ b/sys/dev/tc/sticvar.h @@ -1,4 +1,4 @@ -/* $NetBSD: sticvar.h,v 1.13 2003/06/29 22:30:54 fvdl Exp $ */ +/* $NetBSD: sticvar.h,v 1.14 2003/11/13 03:09:29 chs Exp $ */ /*- * Copyright (c) 1999, 2000, 2001 The NetBSD Foundation, Inc. @@ -62,7 +62,8 @@ struct stic_hwcursor64 { struct wsdisplay_curpos cc_size; #define CURSOR_MAX_SIZE 64 u_int8_t cc_color[6]; - u_int64_t cc_image[64 + 64]; + u_int64_t cc_image[CURSOR_MAX_SIZE]; + u_int64_t cc_mask[CURSOR_MAX_SIZE]; }; struct stic_screen { diff --git a/sys/dev/tc/tfb.c b/sys/dev/tc/tfb.c index 91384f87f3c9..1246827a980e 100644 --- a/sys/dev/tc/tfb.c +++ b/sys/dev/tc/tfb.c @@ -1,4 +1,4 @@ -/* $NetBSD: tfb.c,v 1.41 2003/10/27 07:07:35 chs Exp $ */ +/* $NetBSD: tfb.c,v 1.42 2003/11/13 03:09:29 chs Exp $ */ /* * Copyright (c) 1998, 1999 Tohru Nishimura. All rights reserved. @@ -31,7 +31,7 @@ */ #include -__KERNEL_RCSID(0, "$NetBSD: tfb.c,v 1.41 2003/10/27 07:07:35 chs Exp $"); +__KERNEL_RCSID(0, "$NetBSD: tfb.c,v 1.42 2003/11/13 03:09:29 chs Exp $"); #include #include @@ -159,7 +159,8 @@ struct hwcursor64 { struct wsdisplay_curpos cc_magic; #define CURSOR_MAX_SIZE 64 u_int8_t cc_color[6]; - u_int64_t cc_image[64 + 64]; + u_int64_t cc_image[CURSOR_MAX_SIZE]; + u_int64_t cc_mask[CURSOR_MAX_SIZE]; }; struct tfb_softc { @@ -621,7 +622,7 @@ tfbintr(arg) int bcnt; ip = (u_int8_t *)sc->sc_cursor.cc_image; - mp = (u_int8_t *)(sc->sc_cursor.cc_image + CURSOR_MAX_SIZE); + mp = (u_int8_t *)sc->sc_cursor.cc_mask; bcnt = 0; SELECT431(curs, BT431_REG_CRAM_BASE); @@ -750,20 +751,19 @@ get_cmap(sc, p) struct wsdisplay_cmap *p; { u_int index = p->index, count = p->count; + int error; if (index >= CMAP_SIZE || count > CMAP_SIZE - index) return (EINVAL); - if (!uvm_useracc(p->red, count, B_WRITE) || - !uvm_useracc(p->green, count, B_WRITE) || - !uvm_useracc(p->blue, count, B_WRITE)) - return (EFAULT); - - copyout(&sc->sc_cmap.r[index], p->red, count); - copyout(&sc->sc_cmap.g[index], p->green, count); - copyout(&sc->sc_cmap.b[index], p->blue, count); - - return (0); + error = copyout(&sc->sc_cmap.r[index], p->red, count); + if (error) + return error; + error = copyout(&sc->sc_cmap.g[index], p->green, count); + if (error) + return error; + error = copyout(&sc->sc_cmap.b[index], p->blue, count); + return error; } static int @@ -771,22 +771,26 @@ set_cmap(sc, p) struct tfb_softc *sc; struct wsdisplay_cmap *p; { + struct hwcmap256 cmap; u_int index = p->index, count = p->count; + int error; if (index >= CMAP_SIZE || count > CMAP_SIZE - index) return (EINVAL); - if (!uvm_useracc(p->red, count, B_READ) || - !uvm_useracc(p->green, count, B_READ) || - !uvm_useracc(p->blue, count, B_READ)) - return (EFAULT); - - copyin(p->red, &sc->sc_cmap.r[index], count); - copyin(p->green, &sc->sc_cmap.g[index], count); - copyin(p->blue, &sc->sc_cmap.b[index], count); - + error = copyin(p->red, &cmap.r[index], count); + if (error) + return error; + error = copyin(p->green, &cmap.g[index], count); + if (error) + return error; + error = copyin(p->blue, &cmap.b[index], count); + if (error) + return error; + memcpy(&sc->sc_cmap.r[index], &cmap.r[index], count); + memcpy(&sc->sc_cmap.g[index], &cmap.g[index], count); + memcpy(&sc->sc_cmap.b[index], &cmap.b[index], count); sc->sc_changed |= WSDISPLAY_CMAP_DOLUT; - return (0); } @@ -797,6 +801,8 @@ set_cursor(sc, p) { #define cc (&sc->sc_cursor) u_int v, index = 0, count = 0, icount = 0; + uint8_t r[2], g[2], b[2], image[512], mask[512]; + int error; v = p->which; if (v & WSDISPLAY_CURSOR_DOCMAP) { @@ -804,18 +810,26 @@ set_cursor(sc, p) count = p->cmap.count; if (index >= 2 || (index + count) > 2) return (EINVAL); - if (!uvm_useracc(p->cmap.red, count, B_READ) || - !uvm_useracc(p->cmap.green, count, B_READ) || - !uvm_useracc(p->cmap.blue, count, B_READ)) - return (EFAULT); + error = copyin(p->cmap.red, &r[index], count); + if (error) + return error; + error = copyin(p->cmap.green, &g[index], count); + if (error) + return error; + error = copyin(p->cmap.blue, &b[index], count); + if (error) + return error; } if (v & WSDISPLAY_CURSOR_DOSHAPE) { if (p->size.x > CURSOR_MAX_SIZE || p->size.y > CURSOR_MAX_SIZE) return (EINVAL); icount = ((p->size.x < 33) ? 4 : 8) * p->size.y; - if (!uvm_useracc(p->image, icount, B_READ) || - !uvm_useracc(p->mask, icount, B_READ)) - return (EFAULT); + error = copyin(p->image, image, icount); + if (error) + return error; + error = copyin(p->mask, mask, icount); + if (error) + return error; } if (v & WSDISPLAY_CURSOR_DOCUR) @@ -825,15 +839,16 @@ set_cursor(sc, p) if (v & WSDISPLAY_CURSOR_DOHOT) cc->cc_hot = p->hot; if (v & WSDISPLAY_CURSOR_DOCMAP) { - copyin(p->cmap.red, &cc->cc_color[index], count); - copyin(p->cmap.green, &cc->cc_color[index + 2], count); - copyin(p->cmap.blue, &cc->cc_color[index + 4], count); + memcpy(&cc->cc_color[index], &r[index], count); + memcpy(&cc->cc_color[index + 2], &g[index], count); + memcpy(&cc->cc_color[index + 4], &b[index], count); } if (v & WSDISPLAY_CURSOR_DOSHAPE) { cc->cc_size = p->size; memset(cc->cc_image, 0, sizeof cc->cc_image); - copyin(p->image, cc->cc_image, icount); - copyin(p->mask, cc->cc_image+CURSOR_MAX_SIZE, icount); + memcpy(cc->cc_image, image, icount); + memset(cc->cc_mask, 0, sizeof cc->cc_mask); + memcpy(cc->cc_mask, mask, icount); } sc->sc_changed = v; diff --git a/sys/dev/tc/xcfb.c b/sys/dev/tc/xcfb.c index 992701e60b71..3a470eabf3b7 100644 --- a/sys/dev/tc/xcfb.c +++ b/sys/dev/tc/xcfb.c @@ -1,4 +1,4 @@ -/* $NetBSD: xcfb.c,v 1.32 2002/10/02 16:53:09 thorpej Exp $ */ +/* $NetBSD: xcfb.c,v 1.33 2003/11/13 03:09:29 chs Exp $ */ /* * Copyright (c) 1998, 1999 Tohru Nishimura. All rights reserved. @@ -31,7 +31,7 @@ */ #include -__KERNEL_RCSID(0, "$NetBSD: xcfb.c,v 1.32 2002/10/02 16:53:09 thorpej Exp $"); +__KERNEL_RCSID(0, "$NetBSD: xcfb.c,v 1.33 2003/11/13 03:09:29 chs Exp $"); #include #include @@ -71,7 +71,8 @@ struct hwcursor64 { struct wsdisplay_curpos cc_magic; /* not used by PMAG-DV */ #define CURSOR_MAX_SIZE 64 u_int8_t cc_color[6]; - u_int64_t cc_image[64 + 64]; + u_int64_t cc_image[CURSOR_MAX_SIZE]; + u_int64_t cc_mask[CURSOR_MAX_SIZE]; }; #define XCFB_FB_BASE (XINE_PHYS_CFB_START + 0x2000000) @@ -551,20 +552,19 @@ get_cmap(sc, p) struct wsdisplay_cmap *p; { u_int index = p->index, count = p->count; + int error; if (index >= CMAP_SIZE || count > CMAP_SIZE - index) return (EINVAL); - if (!uvm_useracc(p->red, count, B_WRITE) || - !uvm_useracc(p->green, count, B_WRITE) || - !uvm_useracc(p->blue, count, B_WRITE)) - return (EFAULT); - - copyout(&sc->sc_cmap.r[index], p->red, count); - copyout(&sc->sc_cmap.g[index], p->green, count); - copyout(&sc->sc_cmap.b[index], p->blue, count); - - return (0); + error = copyout(&sc->sc_cmap.r[index], p->red, count); + if (error) + return error; + error = copyout(&sc->sc_cmap.g[index], p->green, count); + if (error) + return error; + error = copyout(&sc->sc_cmap.b[index], p->blue, count); + return error; } static int @@ -572,20 +572,26 @@ set_cmap(sc, p) struct xcfb_softc *sc; struct wsdisplay_cmap *p; { + struct hwcmap256 cmap; u_int index = p->index, count = p->count; + int error; if (index >= CMAP_SIZE || count > CMAP_SIZE - index) return (EINVAL); - if (!uvm_useracc(p->red, count, B_READ) || - !uvm_useracc(p->green, count, B_READ) || - !uvm_useracc(p->blue, count, B_READ)) - return (EFAULT); - - copyin(p->red, &sc->sc_cmap.r[index], count); - copyin(p->green, &sc->sc_cmap.g[index], count); - copyin(p->blue, &sc->sc_cmap.b[index], count); - + error = copyin(p->red, &cmap.r[index], count); + if (error) + return error; + error = copyin(p->green, &cmap.g[index], count); + if (error) + return error; + error = copyin(p->blue, &cmap.b[index], count); + if (error) + return error; + memcpy(&sc->sc_cmap.r[index], &cmap.r[index], count); + memcpy(&sc->sc_cmap.g[index], &cmap.g[index], count); + memcpy(&sc->sc_cmap.b[index], &cmap.b[index], count); + sc->sc_changed |= WSDISPLAY_CMAP_DOLUT; return (0); } @@ -595,7 +601,9 @@ set_cursor(sc, p) struct wsdisplay_cursor *p; { #define cc (&sc->sc_cursor) - u_int v, index, count; + u_int v, index = 0, count = 0, icount = 0; + uint8_t r[2], g[2], b[2], image[512], mask[512]; + int error; v = p->which; if (v & WSDISPLAY_CURSOR_DOCMAP) { @@ -604,27 +612,40 @@ set_cursor(sc, p) if (index >= 2 || index + count > 2) return (EINVAL); - if (!uvm_useracc(p->cmap.red, count, B_READ) || - !uvm_useracc(p->cmap.green, count, B_READ) || - !uvm_useracc(p->cmap.blue, count, B_READ)) - return (EFAULT); - - copyin(p->cmap.red, &cc->cc_color[index], count); - copyin(p->cmap.green, &cc->cc_color[index + 2], count); - copyin(p->cmap.blue, &cc->cc_color[index + 4], count); - ims332_load_curcmap(sc); + error = copyin(p->cmap.red, &r[index], count); + if (error) + return error; + error = copyin(p->cmap.green, &g[index], count); + if (error) + return error; + error = copyin(p->cmap.blue, &b[index], count); + if (error) + return error; } if (v & WSDISPLAY_CURSOR_DOSHAPE) { if (p->size.x > CURSOR_MAX_SIZE || p->size.y > CURSOR_MAX_SIZE) return (EINVAL); - count = ((p->size.x < 33) ? 4 : 8) * p->size.y; - if (!uvm_useracc(p->image, count, B_READ) || - !uvm_useracc(p->mask, count, B_READ)) - return (EFAULT); + icount = ((p->size.x < 33) ? 4 : 8) * p->size.y; + error = copyin(p->image, image, icount); + if (error) + return error; + error = copyin(p->mask, mask, icount); + if (error) + return error; + } + + if (v & WSDISPLAY_CURSOR_DOCMAP) { + memcpy(&cc->cc_color[index], &r[index], count); + memcpy(&cc->cc_color[index + 2], &g[index], count); + memcpy(&cc->cc_color[index + 4], &b[index], count); + ims332_load_curcmap(sc); + } + if (v & WSDISPLAY_CURSOR_DOSHAPE) { cc->cc_size = p->size; memset(cc->cc_image, 0, sizeof cc->cc_image); - copyin(p->image, cc->cc_image, count); - copyin(p->mask, cc->cc_image+CURSOR_MAX_SIZE, count); + memcpy(cc->cc_image, image, icount); + memset(cc->cc_mask, 0, sizeof cc->cc_mask); + memcpy(cc->cc_mask, mask, icount); ims332_load_curshape(sc); } if (v & WSDISPLAY_CURSOR_DOCUR) { @@ -719,11 +740,11 @@ static void ims332_load_curshape(sc) struct xcfb_softc *sc; { - unsigned i, img, msk, bits; + u_int i, img, msk, bits; u_int8_t u, *ip, *mp; ip = (u_int8_t *)sc->sc_cursor.cc_image; - mp = (u_int8_t *)(sc->sc_cursor.cc_image+CURSOR_MAX_SIZE); + mp = (u_int8_t *)sc->sc_cursor.cc_mask; i = 0; /* 64 pixel scan line is consisted with 8 halfword cursor ram */ diff --git a/sys/kern/kern_time.c b/sys/kern/kern_time.c index 4224369c42fd..8ea3c3f510c6 100644 --- a/sys/kern/kern_time.c +++ b/sys/kern/kern_time.c @@ -1,4 +1,4 @@ -/* $NetBSD: kern_time.c,v 1.78 2003/11/02 16:26:10 cl Exp $ */ +/* $NetBSD: kern_time.c,v 1.79 2003/11/13 03:09:30 chs Exp $ */ /*- * Copyright (c) 2000 The NetBSD Foundation, Inc. @@ -68,7 +68,7 @@ */ #include -__KERNEL_RCSID(0, "$NetBSD: kern_time.c,v 1.78 2003/11/02 16:26:10 cl Exp $"); +__KERNEL_RCSID(0, "$NetBSD: kern_time.c,v 1.79 2003/11/13 03:09:30 chs Exp $"); #include "fs_nfs.h" #include "opt_nfs.h" @@ -443,12 +443,6 @@ adjtime1(delta, olddelta, p) if (error) return (error); - if (olddelta != NULL) { - if (uvm_useracc((caddr_t)olddelta, - sizeof(struct timeval), B_WRITE) == FALSE) - return (EFAULT); - } - /* * Compute the total correction and the rate at which to apply it. * Round the adjustment down to a whole multiple of the per-tick @@ -483,9 +477,9 @@ adjtime1(delta, olddelta, p) if (olddelta) { atv.tv_sec = odelta / 1000000; atv.tv_usec = odelta % 1000000; - (void) copyout(&atv, olddelta, sizeof(struct timeval)); + error = copyout(&atv, olddelta, sizeof(struct timeval)); } - return (0); + return error; } /* diff --git a/sys/kern/uipc_syscalls.c b/sys/kern/uipc_syscalls.c index 3591a4e12f5c..85504748e9ad 100644 --- a/sys/kern/uipc_syscalls.c +++ b/sys/kern/uipc_syscalls.c @@ -1,4 +1,4 @@ -/* $NetBSD: uipc_syscalls.c,v 1.83 2003/09/04 04:33:49 matt Exp $ */ +/* $NetBSD: uipc_syscalls.c,v 1.84 2003/11/13 03:09:30 chs Exp $ */ /* * Copyright (c) 1982, 1986, 1989, 1990, 1993 @@ -32,7 +32,7 @@ */ #include -__KERNEL_RCSID(0, "$NetBSD: uipc_syscalls.c,v 1.83 2003/09/04 04:33:49 matt Exp $"); +__KERNEL_RCSID(0, "$NetBSD: uipc_syscalls.c,v 1.84 2003/11/13 03:09:30 chs Exp $"); #include "opt_ktrace.h" #include "opt_pipe.h" @@ -175,13 +175,9 @@ sys_accept(struct lwp *l, void *v, register_t *retval) p = l->l_proc; fdp = p->p_fd; - if (SCARG(uap, name) && (error = copyin((caddr_t)SCARG(uap, anamelen), - (caddr_t)&namelen, sizeof(namelen)))) + if (SCARG(uap, name) && (error = copyin(SCARG(uap, anamelen), + &namelen, sizeof(namelen)))) return (error); - if (SCARG(uap, name) != NULL && - uvm_useracc((caddr_t)SCARG(uap, name), sizeof(struct sockaddr), - B_WRITE) == FALSE) - return (EFAULT); /* getsock() will use the descriptor for us */ if ((error = getsock(fdp, SCARG(uap, s), &fp)) != 0) diff --git a/sys/uvm/uvm_extern.h b/sys/uvm/uvm_extern.h index a9fd411a16db..a26f84780bb5 100644 --- a/sys/uvm/uvm_extern.h +++ b/sys/uvm/uvm_extern.h @@ -1,4 +1,4 @@ -/* $NetBSD: uvm_extern.h,v 1.84 2003/08/11 16:33:30 pk Exp $ */ +/* $NetBSD: uvm_extern.h,v 1.85 2003/11/13 03:09:30 chs Exp $ */ /* * @@ -577,7 +577,6 @@ __dead void uvm_scheduler __P((void)) __attribute__((noreturn)); void uvm_swapin __P((struct lwp *)); boolean_t uvm_uarea_alloc(vaddr_t *); void uvm_uarea_free(vaddr_t); -boolean_t uvm_useracc __P((caddr_t, size_t, int)); int uvm_vslock __P((struct proc *, caddr_t, size_t, vm_prot_t)); void uvm_vsunlock __P((struct proc *, caddr_t, size_t)); diff --git a/sys/uvm/uvm_glue.c b/sys/uvm/uvm_glue.c index 705a3027bbeb..1922c07b505e 100644 --- a/sys/uvm/uvm_glue.c +++ b/sys/uvm/uvm_glue.c @@ -1,4 +1,4 @@ -/* $NetBSD: uvm_glue.c,v 1.72 2003/11/03 04:39:11 yamt Exp $ */ +/* $NetBSD: uvm_glue.c,v 1.73 2003/11/13 03:09:30 chs Exp $ */ /* * Copyright (c) 1997 Charles D. Cranor and Washington University. @@ -67,7 +67,7 @@ */ #include -__KERNEL_RCSID(0, "$NetBSD: uvm_glue.c,v 1.72 2003/11/03 04:39:11 yamt Exp $"); +__KERNEL_RCSID(0, "$NetBSD: uvm_glue.c,v 1.73 2003/11/13 03:09:30 chs Exp $"); #include "opt_kgdb.h" #include "opt_kstack.h" @@ -144,33 +144,6 @@ uvm_kernacc(addr, len, rw) return(rv); } -/* - * uvm_useracc: can the user access it? - * - * - called from physio() and sys___sysctl(). - */ - -boolean_t -uvm_useracc(addr, len, rw) - caddr_t addr; - size_t len; - int rw; -{ - struct vm_map *map; - boolean_t rv; - vm_prot_t prot = rw == B_READ ? VM_PROT_READ : VM_PROT_WRITE; - - /* XXX curproc */ - map = &curproc->p_vmspace->vm_map; - - vm_map_lock_read(map); - rv = uvm_map_checkprot(map, trunc_page((vaddr_t)addr), - round_page((vaddr_t)addr + len), prot); - vm_map_unlock_read(map); - - return(rv); -} - #ifdef KGDB /* * Change protections on kernel pages from addr to addr+len