selinux: fix overflow and 0 length allocations
[deliverable/linux.git] / drivers / gpu / drm / cirrus / cirrus_fbdev.c
1 /*
2 * Copyright 2012 Red Hat
3 *
4 * This file is subject to the terms and conditions of the GNU General
5 * Public License version 2. See the file COPYING in the main
6 * directory of this archive for more details.
7 *
8 * Authors: Matthew Garrett
9 * Dave Airlie
10 */
11 #include <linux/module.h>
12 #include <drm/drmP.h>
13 #include <drm/drm_fb_helper.h>
14 #include <drm/drm_crtc_helper.h>
15
16 #include <linux/fb.h>
17
18 #include "cirrus_drv.h"
19
20 static void cirrus_dirty_update(struct cirrus_fbdev *afbdev,
21 int x, int y, int width, int height)
22 {
23 int i;
24 struct drm_gem_object *obj;
25 struct cirrus_bo *bo;
26 int src_offset, dst_offset;
27 int bpp = (afbdev->gfb.base.bits_per_pixel + 7)/8;
28 int ret = -EBUSY;
29 bool unmap = false;
30 bool store_for_later = false;
31 int x2, y2;
32 unsigned long flags;
33
34 obj = afbdev->gfb.obj;
35 bo = gem_to_cirrus_bo(obj);
36
37 /*
38 * try and reserve the BO, if we fail with busy
39 * then the BO is being moved and we should
40 * store up the damage until later.
41 */
42 if (drm_can_sleep())
43 ret = cirrus_bo_reserve(bo, true);
44 if (ret) {
45 if (ret != -EBUSY)
46 return;
47 store_for_later = true;
48 }
49
50 x2 = x + width - 1;
51 y2 = y + height - 1;
52 spin_lock_irqsave(&afbdev->dirty_lock, flags);
53
54 if (afbdev->y1 < y)
55 y = afbdev->y1;
56 if (afbdev->y2 > y2)
57 y2 = afbdev->y2;
58 if (afbdev->x1 < x)
59 x = afbdev->x1;
60 if (afbdev->x2 > x2)
61 x2 = afbdev->x2;
62
63 if (store_for_later) {
64 afbdev->x1 = x;
65 afbdev->x2 = x2;
66 afbdev->y1 = y;
67 afbdev->y2 = y2;
68 spin_unlock_irqrestore(&afbdev->dirty_lock, flags);
69 return;
70 }
71
72 afbdev->x1 = afbdev->y1 = INT_MAX;
73 afbdev->x2 = afbdev->y2 = 0;
74 spin_unlock_irqrestore(&afbdev->dirty_lock, flags);
75
76 if (!bo->kmap.virtual) {
77 ret = ttm_bo_kmap(&bo->bo, 0, bo->bo.num_pages, &bo->kmap);
78 if (ret) {
79 DRM_ERROR("failed to kmap fb updates\n");
80 cirrus_bo_unreserve(bo);
81 return;
82 }
83 unmap = true;
84 }
85 for (i = y; i < y + height; i++) {
86 /* assume equal stride for now */
87 src_offset = dst_offset = i * afbdev->gfb.base.pitches[0] + (x * bpp);
88 memcpy_toio(bo->kmap.virtual + src_offset, afbdev->sysram + src_offset, width * bpp);
89
90 }
91 if (unmap)
92 ttm_bo_kunmap(&bo->kmap);
93
94 cirrus_bo_unreserve(bo);
95 }
96
97 static void cirrus_fillrect(struct fb_info *info,
98 const struct fb_fillrect *rect)
99 {
100 struct cirrus_fbdev *afbdev = info->par;
101 drm_fb_helper_sys_fillrect(info, rect);
102 cirrus_dirty_update(afbdev, rect->dx, rect->dy, rect->width,
103 rect->height);
104 }
105
106 static void cirrus_copyarea(struct fb_info *info,
107 const struct fb_copyarea *area)
108 {
109 struct cirrus_fbdev *afbdev = info->par;
110 drm_fb_helper_sys_copyarea(info, area);
111 cirrus_dirty_update(afbdev, area->dx, area->dy, area->width,
112 area->height);
113 }
114
115 static void cirrus_imageblit(struct fb_info *info,
116 const struct fb_image *image)
117 {
118 struct cirrus_fbdev *afbdev = info->par;
119 drm_fb_helper_sys_imageblit(info, image);
120 cirrus_dirty_update(afbdev, image->dx, image->dy, image->width,
121 image->height);
122 }
123
124
125 static struct fb_ops cirrusfb_ops = {
126 .owner = THIS_MODULE,
127 .fb_check_var = drm_fb_helper_check_var,
128 .fb_set_par = drm_fb_helper_set_par,
129 .fb_fillrect = cirrus_fillrect,
130 .fb_copyarea = cirrus_copyarea,
131 .fb_imageblit = cirrus_imageblit,
132 .fb_pan_display = drm_fb_helper_pan_display,
133 .fb_blank = drm_fb_helper_blank,
134 .fb_setcmap = drm_fb_helper_setcmap,
135 };
136
137 static int cirrusfb_create_object(struct cirrus_fbdev *afbdev,
138 const struct drm_mode_fb_cmd2 *mode_cmd,
139 struct drm_gem_object **gobj_p)
140 {
141 struct drm_device *dev = afbdev->helper.dev;
142 struct cirrus_device *cdev = dev->dev_private;
143 u32 bpp, depth;
144 u32 size;
145 struct drm_gem_object *gobj;
146
147 int ret = 0;
148 drm_fb_get_bpp_depth(mode_cmd->pixel_format, &depth, &bpp);
149
150 if (!cirrus_check_framebuffer(cdev, mode_cmd->width, mode_cmd->height,
151 bpp, mode_cmd->pitches[0]))
152 return -EINVAL;
153
154 size = mode_cmd->pitches[0] * mode_cmd->height;
155 ret = cirrus_gem_create(dev, size, true, &gobj);
156 if (ret)
157 return ret;
158
159 *gobj_p = gobj;
160 return ret;
161 }
162
163 static int cirrusfb_create(struct drm_fb_helper *helper,
164 struct drm_fb_helper_surface_size *sizes)
165 {
166 struct cirrus_fbdev *gfbdev =
167 container_of(helper, struct cirrus_fbdev, helper);
168 struct cirrus_device *cdev = gfbdev->helper.dev->dev_private;
169 struct fb_info *info;
170 struct drm_framebuffer *fb;
171 struct drm_mode_fb_cmd2 mode_cmd;
172 void *sysram;
173 struct drm_gem_object *gobj = NULL;
174 struct cirrus_bo *bo = NULL;
175 int size, ret;
176
177 mode_cmd.width = sizes->surface_width;
178 mode_cmd.height = sizes->surface_height;
179 mode_cmd.pitches[0] = mode_cmd.width * ((sizes->surface_bpp + 7) / 8);
180 mode_cmd.pixel_format = drm_mode_legacy_fb_format(sizes->surface_bpp,
181 sizes->surface_depth);
182 size = mode_cmd.pitches[0] * mode_cmd.height;
183
184 ret = cirrusfb_create_object(gfbdev, &mode_cmd, &gobj);
185 if (ret) {
186 DRM_ERROR("failed to create fbcon backing object %d\n", ret);
187 return ret;
188 }
189
190 bo = gem_to_cirrus_bo(gobj);
191
192 sysram = vmalloc(size);
193 if (!sysram)
194 return -ENOMEM;
195
196 info = drm_fb_helper_alloc_fbi(helper);
197 if (IS_ERR(info))
198 return PTR_ERR(info);
199
200 info->par = gfbdev;
201
202 ret = cirrus_framebuffer_init(cdev->dev, &gfbdev->gfb, &mode_cmd, gobj);
203 if (ret)
204 return ret;
205
206 gfbdev->sysram = sysram;
207 gfbdev->size = size;
208
209 fb = &gfbdev->gfb.base;
210 if (!fb) {
211 DRM_INFO("fb is NULL\n");
212 return -EINVAL;
213 }
214
215 /* setup helper */
216 gfbdev->helper.fb = fb;
217
218 strcpy(info->fix.id, "cirrusdrmfb");
219
220 info->flags = FBINFO_DEFAULT;
221 info->fbops = &cirrusfb_ops;
222
223 drm_fb_helper_fill_fix(info, fb->pitches[0], fb->depth);
224 drm_fb_helper_fill_var(info, &gfbdev->helper, sizes->fb_width,
225 sizes->fb_height);
226
227 /* setup aperture base/size for vesafb takeover */
228 info->apertures->ranges[0].base = cdev->dev->mode_config.fb_base;
229 info->apertures->ranges[0].size = cdev->mc.vram_size;
230
231 info->fix.smem_start = cdev->dev->mode_config.fb_base;
232 info->fix.smem_len = cdev->mc.vram_size;
233
234 info->screen_base = sysram;
235 info->screen_size = size;
236
237 info->fix.mmio_start = 0;
238 info->fix.mmio_len = 0;
239
240 DRM_INFO("fb mappable at 0x%lX\n", info->fix.smem_start);
241 DRM_INFO("vram aper at 0x%lX\n", (unsigned long)info->fix.smem_start);
242 DRM_INFO("size %lu\n", (unsigned long)info->fix.smem_len);
243 DRM_INFO("fb depth is %d\n", fb->depth);
244 DRM_INFO(" pitch is %d\n", fb->pitches[0]);
245
246 return 0;
247 }
248
249 static int cirrus_fbdev_destroy(struct drm_device *dev,
250 struct cirrus_fbdev *gfbdev)
251 {
252 struct cirrus_framebuffer *gfb = &gfbdev->gfb;
253
254 drm_fb_helper_unregister_fbi(&gfbdev->helper);
255 drm_fb_helper_release_fbi(&gfbdev->helper);
256
257 if (gfb->obj) {
258 drm_gem_object_unreference_unlocked(gfb->obj);
259 gfb->obj = NULL;
260 }
261
262 vfree(gfbdev->sysram);
263 drm_fb_helper_fini(&gfbdev->helper);
264 drm_framebuffer_unregister_private(&gfb->base);
265 drm_framebuffer_cleanup(&gfb->base);
266
267 return 0;
268 }
269
270 static const struct drm_fb_helper_funcs cirrus_fb_helper_funcs = {
271 .gamma_set = cirrus_crtc_fb_gamma_set,
272 .gamma_get = cirrus_crtc_fb_gamma_get,
273 .fb_probe = cirrusfb_create,
274 };
275
276 int cirrus_fbdev_init(struct cirrus_device *cdev)
277 {
278 struct cirrus_fbdev *gfbdev;
279 int ret;
280 int bpp_sel = 24;
281
282 /*bpp_sel = 8;*/
283 gfbdev = kzalloc(sizeof(struct cirrus_fbdev), GFP_KERNEL);
284 if (!gfbdev)
285 return -ENOMEM;
286
287 cdev->mode_info.gfbdev = gfbdev;
288 spin_lock_init(&gfbdev->dirty_lock);
289
290 drm_fb_helper_prepare(cdev->dev, &gfbdev->helper,
291 &cirrus_fb_helper_funcs);
292
293 ret = drm_fb_helper_init(cdev->dev, &gfbdev->helper,
294 cdev->num_crtc, CIRRUSFB_CONN_LIMIT);
295 if (ret)
296 return ret;
297
298 ret = drm_fb_helper_single_add_all_connectors(&gfbdev->helper);
299 if (ret)
300 return ret;
301
302 /* disable all the possible outputs/crtcs before entering KMS mode */
303 drm_helper_disable_unused_functions(cdev->dev);
304
305 return drm_fb_helper_initial_config(&gfbdev->helper, bpp_sel);
306 }
307
308 void cirrus_fbdev_fini(struct cirrus_device *cdev)
309 {
310 if (!cdev->mode_info.gfbdev)
311 return;
312
313 cirrus_fbdev_destroy(cdev->dev, cdev->mode_info.gfbdev);
314 kfree(cdev->mode_info.gfbdev);
315 cdev->mode_info.gfbdev = NULL;
316 }
This page took 0.047177 seconds and 5 git commands to generate.