Loading drivers/char/drm/via_dmablit.c +45 −23 Original line number Diff line number Diff line Loading @@ -162,7 +162,7 @@ via_map_blit_for_device(struct pci_dev *pdev, /* * Function that frees up all resources for a blit. It is usable even if the * blit info has only be partially built as long as the status enum is consistent * blit info has only been partially built as long as the status enum is consistent * with the actual status of the used resources. */ Loading Loading @@ -238,8 +238,11 @@ via_lock_all_dma_pages(drm_via_sg_info_t *vsg, drm_via_dmablit_t *xfer) return DRM_ERR(ENOMEM); memset(vsg->pages, 0, sizeof(struct page *) * vsg->num_pages); down_read(¤t->mm->mmap_sem); ret = get_user_pages(current, current->mm, (unsigned long) xfer->mem_addr, vsg->num_pages, vsg->direction, 0, vsg->pages, NULL); ret = get_user_pages(current, current->mm, (unsigned long)xfer->mem_addr, vsg->num_pages, (vsg->direction == DMA_FROM_DEVICE), 0, vsg->pages, NULL); up_read(¤t->mm->mmap_sem); if (ret != vsg->num_pages) { Loading Loading @@ -475,10 +478,16 @@ via_dmablit_timer(unsigned long data) if (!timer_pending(&blitq->poll_timer)) { blitq->poll_timer.expires = jiffies+1; add_timer(&blitq->poll_timer); } /* * Rerun handler to delete timer if engines are off, and * to shorten abort latency. This is a little nasty. */ via_dmablit_handler(dev, engine, 0); } } Loading Loading @@ -597,15 +606,27 @@ via_build_sg_info(drm_device_t *dev, drm_via_sg_info_t *vsg, drm_via_dmablit_t * * (Not a big limitation anyway.) */ if (((xfer->mem_stride - xfer->line_length) >= PAGE_SIZE) || (xfer->mem_stride > 2048*4)) { if ((xfer->mem_stride - xfer->line_length) >= PAGE_SIZE) { DRM_ERROR("Too large system memory stride. Stride: %d, " "Length: %d\n", xfer->mem_stride, xfer->line_length); return DRM_ERR(EINVAL); } if (xfer->num_lines > 2048) { DRM_ERROR("Too many PCI DMA bitblt lines.\n"); if ((xfer->mem_stride == xfer->line_length) && (xfer->fb_stride == xfer->line_length)) { xfer->mem_stride *= xfer->num_lines; xfer->line_length = xfer->mem_stride; xfer->fb_stride = xfer->mem_stride; xfer->num_lines = 1; } /* * Don't lock an arbitrary large number of pages, since that causes a * DOS security hole. */ if (xfer->num_lines > 2048 || (xfer->num_lines*xfer->mem_stride > (2048*2048*4))) { DRM_ERROR("Too large PCI DMA bitblt.\n"); return DRM_ERR(EINVAL); } Loading @@ -628,14 +649,15 @@ via_build_sg_info(drm_device_t *dev, drm_via_sg_info_t *vsg, drm_via_dmablit_t * #ifdef VIA_BUGFREE if ((((unsigned long)xfer->mem_addr & 3) != ((unsigned long)xfer->fb_addr & 3)) || ((xfer->mem_stride & 3) != (xfer->fb_stride & 3))) { ((xfer->num_lines > 1) && ((xfer->mem_stride & 3) != (xfer->fb_stride & 3)))) { DRM_ERROR("Invalid DRM bitblt alignment.\n"); return DRM_ERR(EINVAL); } #else if ((((unsigned long)xfer->mem_addr & 15) || ((unsigned long)xfer->fb_addr & 3)) || (xfer->mem_stride & 15) || (xfer->fb_stride & 3)) { ((unsigned long)xfer->fb_addr & 3)) || ((xfer->num_lines > 1) && ((xfer->mem_stride & 15) || (xfer->fb_stride & 3)))) { DRM_ERROR("Invalid DRM bitblt alignment.\n"); return DRM_ERR(EINVAL); } Loading Loading @@ -756,7 +778,7 @@ via_dmablit(drm_device_t *dev, drm_via_dmablit_t *xfer) /* * Sync on a previously submitted blit. Note that the X server use signals extensively, and * that there is a very big proability that this IOCTL will be interrupted by a signal. In that * that there is a very big probability that this IOCTL will be interrupted by a signal. In that * case it returns with -EAGAIN for the signal to be delivered. * The caller should then reissue the IOCTL. This is similar to what is being done for drmGetLock(). */ Loading drivers/char/drm/via_drm.h +7 −1 Original line number Diff line number Diff line Loading @@ -250,6 +250,12 @@ typedef struct drm_via_blitsync { unsigned engine; } drm_via_blitsync_t; /* - * Below,"flags" is currently unused but will be used for possible future * extensions like kernel space bounce buffers for bad alignments and * blit engine busy-wait polling for better latency in the absence of * interrupts. */ typedef struct drm_via_dmablit { uint32_t num_lines; uint32_t line_length; Loading @@ -260,7 +266,7 @@ typedef struct drm_via_dmablit { unsigned char *mem_addr; uint32_t mem_stride; int bounce_buffer; uint32_t flags; int to_fb; drm_via_blitsync_t sync; Loading drivers/char/drm/via_mm.c +2 −2 Original line number Diff line number Diff line Loading @@ -52,7 +52,7 @@ int via_agp_init(DRM_IOCTL_ARGS) return ret; } dev_priv->agp_initialized = TRUE; dev_priv->agp_initialized = 1; dev_priv->agp_offset = agp.offset; mutex_unlock(&dev->struct_mutex); Loading @@ -79,7 +79,7 @@ int via_fb_init(DRM_IOCTL_ARGS) return ret; } dev_priv->vram_initialized = TRUE; dev_priv->vram_initialized = 1; dev_priv->vram_offset = fb.offset; mutex_unlock(&dev->struct_mutex); Loading Loading
drivers/char/drm/via_dmablit.c +45 −23 Original line number Diff line number Diff line Loading @@ -162,7 +162,7 @@ via_map_blit_for_device(struct pci_dev *pdev, /* * Function that frees up all resources for a blit. It is usable even if the * blit info has only be partially built as long as the status enum is consistent * blit info has only been partially built as long as the status enum is consistent * with the actual status of the used resources. */ Loading Loading @@ -238,8 +238,11 @@ via_lock_all_dma_pages(drm_via_sg_info_t *vsg, drm_via_dmablit_t *xfer) return DRM_ERR(ENOMEM); memset(vsg->pages, 0, sizeof(struct page *) * vsg->num_pages); down_read(¤t->mm->mmap_sem); ret = get_user_pages(current, current->mm, (unsigned long) xfer->mem_addr, vsg->num_pages, vsg->direction, 0, vsg->pages, NULL); ret = get_user_pages(current, current->mm, (unsigned long)xfer->mem_addr, vsg->num_pages, (vsg->direction == DMA_FROM_DEVICE), 0, vsg->pages, NULL); up_read(¤t->mm->mmap_sem); if (ret != vsg->num_pages) { Loading Loading @@ -475,10 +478,16 @@ via_dmablit_timer(unsigned long data) if (!timer_pending(&blitq->poll_timer)) { blitq->poll_timer.expires = jiffies+1; add_timer(&blitq->poll_timer); } /* * Rerun handler to delete timer if engines are off, and * to shorten abort latency. This is a little nasty. */ via_dmablit_handler(dev, engine, 0); } } Loading Loading @@ -597,15 +606,27 @@ via_build_sg_info(drm_device_t *dev, drm_via_sg_info_t *vsg, drm_via_dmablit_t * * (Not a big limitation anyway.) */ if (((xfer->mem_stride - xfer->line_length) >= PAGE_SIZE) || (xfer->mem_stride > 2048*4)) { if ((xfer->mem_stride - xfer->line_length) >= PAGE_SIZE) { DRM_ERROR("Too large system memory stride. Stride: %d, " "Length: %d\n", xfer->mem_stride, xfer->line_length); return DRM_ERR(EINVAL); } if (xfer->num_lines > 2048) { DRM_ERROR("Too many PCI DMA bitblt lines.\n"); if ((xfer->mem_stride == xfer->line_length) && (xfer->fb_stride == xfer->line_length)) { xfer->mem_stride *= xfer->num_lines; xfer->line_length = xfer->mem_stride; xfer->fb_stride = xfer->mem_stride; xfer->num_lines = 1; } /* * Don't lock an arbitrary large number of pages, since that causes a * DOS security hole. */ if (xfer->num_lines > 2048 || (xfer->num_lines*xfer->mem_stride > (2048*2048*4))) { DRM_ERROR("Too large PCI DMA bitblt.\n"); return DRM_ERR(EINVAL); } Loading @@ -628,14 +649,15 @@ via_build_sg_info(drm_device_t *dev, drm_via_sg_info_t *vsg, drm_via_dmablit_t * #ifdef VIA_BUGFREE if ((((unsigned long)xfer->mem_addr & 3) != ((unsigned long)xfer->fb_addr & 3)) || ((xfer->mem_stride & 3) != (xfer->fb_stride & 3))) { ((xfer->num_lines > 1) && ((xfer->mem_stride & 3) != (xfer->fb_stride & 3)))) { DRM_ERROR("Invalid DRM bitblt alignment.\n"); return DRM_ERR(EINVAL); } #else if ((((unsigned long)xfer->mem_addr & 15) || ((unsigned long)xfer->fb_addr & 3)) || (xfer->mem_stride & 15) || (xfer->fb_stride & 3)) { ((unsigned long)xfer->fb_addr & 3)) || ((xfer->num_lines > 1) && ((xfer->mem_stride & 15) || (xfer->fb_stride & 3)))) { DRM_ERROR("Invalid DRM bitblt alignment.\n"); return DRM_ERR(EINVAL); } Loading Loading @@ -756,7 +778,7 @@ via_dmablit(drm_device_t *dev, drm_via_dmablit_t *xfer) /* * Sync on a previously submitted blit. Note that the X server use signals extensively, and * that there is a very big proability that this IOCTL will be interrupted by a signal. In that * that there is a very big probability that this IOCTL will be interrupted by a signal. In that * case it returns with -EAGAIN for the signal to be delivered. * The caller should then reissue the IOCTL. This is similar to what is being done for drmGetLock(). */ Loading
drivers/char/drm/via_drm.h +7 −1 Original line number Diff line number Diff line Loading @@ -250,6 +250,12 @@ typedef struct drm_via_blitsync { unsigned engine; } drm_via_blitsync_t; /* - * Below,"flags" is currently unused but will be used for possible future * extensions like kernel space bounce buffers for bad alignments and * blit engine busy-wait polling for better latency in the absence of * interrupts. */ typedef struct drm_via_dmablit { uint32_t num_lines; uint32_t line_length; Loading @@ -260,7 +266,7 @@ typedef struct drm_via_dmablit { unsigned char *mem_addr; uint32_t mem_stride; int bounce_buffer; uint32_t flags; int to_fb; drm_via_blitsync_t sync; Loading
drivers/char/drm/via_mm.c +2 −2 Original line number Diff line number Diff line Loading @@ -52,7 +52,7 @@ int via_agp_init(DRM_IOCTL_ARGS) return ret; } dev_priv->agp_initialized = TRUE; dev_priv->agp_initialized = 1; dev_priv->agp_offset = agp.offset; mutex_unlock(&dev->struct_mutex); Loading @@ -79,7 +79,7 @@ int via_fb_init(DRM_IOCTL_ARGS) return ret; } dev_priv->vram_initialized = TRUE; dev_priv->vram_initialized = 1; dev_priv->vram_offset = fb.offset; mutex_unlock(&dev->struct_mutex); Loading