hollalinux
/
linux-sg2042
mirror of https://github.com/sophgo/linux-riscv.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

drm: Sanitize DRM_IOCTL_MODE_CREATE_DUMB input 

Some drivers erroneously treat the .pitch and .size fields of struct
 drm_mode_create_dumb as inputs. While the include/uapi/drm/drm_mode.h
 header has a comment denoting them as outputs, that seemingly wasn't
 enough to make drivers use them properly.
 
 The result is that some userspace doesn't explicitly zero out those
 fields, assuming that the kernel won't use them. That causes problems
 since the data within the structure might be uninitialized, so bogus
 data may end up confusing drivers (ridiculously large values for the
 pitch, ...).
 
 This series attempts to improve the situation by fixing all drivers to
 not use the output fields. Furthermore to spare new drivers this bad
 surprise, the DRM core now zeros out these fields prior to handing the
 data structure to the driver.
 
 Lessons learned from this are that future IOCTLs should be properly
 documented (in the DRM DocBook for example) and should be rigorously
 defined. To prevent misuse like this, userspace should be required to
 zero out all output fields. The kernel should check for this and fail
 if that's not the case.
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2
 
 iQIcBAABAgAGBQJUZKbcAAoJEN0jrNd/PrOh57QQAKdX7ASd4XVhMC6fuVGXHUXI
 HVZuJ3Own+e3aAJKhZ2DZ263+PtBLfe3+eEF1WRWqZcDu647Nj3wSV64celdZdIl
 WHU2RokxneHTPHlttZ+MLhVwtzSddO8712iLU/2B7Rg/MNlN9tv9tbRtGqPWwlzg
 IZNAdU5etnm+YDYil8/I8f84+5vT59Z/X2NHbq+jReD3V6I2WBAK6zlRIy4o54io
 fccK7M6+uGlbNmtPwoKXufeiqTxxdYYelZoQzO4NjWEhdU0LoUnTFdfqISSdt3HV
 26NwTmqVTx38AD5bGwot2b1VFEkja5tkP7G+DeFkj0DRHbFfAQK/tNeqdf9xq4gQ
 UEVjljyEW6dauibtT6ASk2RoTmQmMVWw44aSulcaz6eVqa21zpEwOZVMX/VW3QM+
 vKh4Vy6eVbCHmdOiXgtQSexQAN6uO1o9cHEGamJQpMshm+kax9T7hBdcHMH0ORtL
 uEYHXzqB/bbkhAodHTraoZ5aM8YFwS2TgGtCJoYw1GHehMhjpJG9HaDlL50lkObk
 LDUShta8AwN9iu3/qmkaYaxkbBPEnRtU9d9qO6S1NsZugBmmEUj6lNKFOK13U9Ho
 vjKWTpB4USgKdrTwJXEAXJTBmubwrPBnZb1vdCovCtC3JS7sXUH8AM/E6tp4Q0Go
 idGCjMglaSFO8EUeScFT
 =QZIW
 -----END PGP SIGNATURE-----

Merge tag 'drm/gem-cma/for-3.19-rc1' of git://people.freedesktop.org/~tagr/linux into drm-next

drm: Sanitize DRM_IOCTL_MODE_CREATE_DUMB input

Some drivers erroneously treat the .pitch and .size fields of struct
drm_mode_create_dumb as inputs. While the include/uapi/drm/drm_mode.h
header has a comment denoting them as outputs, that seemingly wasn't
enough to make drivers use them properly.

The result is that some userspace doesn't explicitly zero out those
fields, assuming that the kernel won't use them. That causes problems
since the data within the structure might be uninitialized, so bogus
data may end up confusing drivers (ridiculously large values for the
pitch, ...).

This series attempts to improve the situation by fixing all drivers to
not use the output fields. Furthermore to spare new drivers this bad
surprise, the DRM core now zeros out these fields prior to handing the
data structure to the driver.

Lessons learned from this are that future IOCTLs should be properly
documented (in the DRM DocBook for example) and should be rigorously
defined. To prevent misuse like this, userspace should be required to
zero out all output fields. The kernel should check for this and fail
if that's not the case.

* tag 'drm/gem-cma/for-3.19-rc1' of git://people.freedesktop.org/~tagr/linux:
  drm/cma: Remove call to drm_gem_free_mmap_offset()
  drm: Sanitize DRM_IOCTL_MODE_CREATE_DUMB input
  drm/rcar: gem: dumb: pitch is an output
  drm/omap: gem: dumb: pitch is an output
  drm/cma: Introduce drm_gem_cma_dumb_create_internal()
  drm/doc: Add GEM/CMA helpers to kerneldoc
  drm/doc: mm: Fix indentation
  drm/gem: Fix a few kerneldoc typos
This commit is contained in:
Dave Airlie 2014-11-15 09:50:21 +10:00
parent 7dea0941f8 7ff7f0a1a9
commit ca5a71de48
7 changed files with 395 additions and 196 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
Documentation/DocBook/drm.tmpl
View File

@ -963,6 +963,12 @@ struct drm_gem_object * (*gem_prime_import)(struct drm_device *dev,
!Edrivers/gpu/drm/drm_mm.c !Edrivers/gpu/drm/drm_mm.c
!Iinclude/drm/drm_mm.h !Iinclude/drm/drm_mm.h
</sect2> </sect2>
<sect2>
<title>CMA Helper Functions Reference</title>
!Pdrivers/gpu/drm/drm_gem_cma_helper.c cma helpers
!Edrivers/gpu/drm/drm_gem_cma_helper.c
!Iinclude/drm/drm_gem_cma_helper.h
</sect2>
</sect1> </sect1>
<!-- Internals: mode setting --> <!-- Internals: mode setting -->

10
drivers/gpu/drm/drm_crtc.c
View File

@ -4774,6 +4774,16 @@ int drm_mode_create_dumb_ioctl(struct drm_device *dev,
if (PAGE_ALIGN(size) == 0) if (PAGE_ALIGN(size) == 0)
return -EINVAL; return -EINVAL;
/*
* handle, pitch and size are output parameters. Zero them out to
* prevent drivers from accidentally using uninitialized data. Since
* not all existing userspace is clearing these fields properly we
* cannot reject IOCTL with garbage in them.
*/
args->handle = 0;
args->pitch = 0;
args->size = 0;
return dev->driver->dumb_create(file_priv, dev, args); return dev->driver->dumb_create(file_priv, dev, args);
} }

7
drivers/gpu/drm/drm_gem.c
View File

@ -309,7 +309,7 @@ EXPORT_SYMBOL(drm_gem_dumb_destroy);
* drm_gem_handle_create_tail - internal functions to create a handle * drm_gem_handle_create_tail - internal functions to create a handle
* @file_priv: drm file-private structure to register the handle for * @file_priv: drm file-private structure to register the handle for
* @obj: object to register * @obj: object to register
* @handlep: pionter to return the created handle to the caller * @handlep: pointer to return the created handle to the caller
* *
* This expects the dev->object_name_lock to be held already and will drop it * This expects the dev->object_name_lock to be held already and will drop it
* before returning. Used to avoid races in establishing new handles when * before returning. Used to avoid races in establishing new handles when
@ -362,7 +362,7 @@ drm_gem_handle_create_tail(struct drm_file *file_priv,
} }
/** /**
* gem_handle_create - create a gem handle for an object * drm_gem_handle_create - create a gem handle for an object
* @file_priv: drm file-private structure to register the handle for * @file_priv: drm file-private structure to register the handle for
* @obj: object to register * @obj: object to register
* @handlep: pionter to return the created handle to the caller * @handlep: pionter to return the created handle to the caller
@ -371,8 +371,7 @@ drm_gem_handle_create_tail(struct drm_file *file_priv,
* to the object, which includes a regular reference count. Callers * to the object, which includes a regular reference count. Callers
* will likely want to dereference the object afterwards. * will likely want to dereference the object afterwards.
*/ */
int int drm_gem_handle_create(struct drm_file *file_priv,
drm_gem_handle_create(struct drm_file *file_priv,
struct drm_gem_object *obj, struct drm_gem_object *obj,
u32 *handlep) u32 *handlep)
{ {

259
drivers/gpu/drm/drm_gem_cma_helper.c
View File

@ -29,18 +29,31 @@
#include <drm/drm_gem_cma_helper.h> #include <drm/drm_gem_cma_helper.h>
#include <drm/drm_vma_manager.h> #include <drm/drm_vma_manager.h>
/* /**
* DOC: cma helpers
*
* The Contiguous Memory Allocator reserves a pool of memory at early boot
* that is used to service requests for large blocks of contiguous memory.
*
* The DRM GEM/CMA helpers use this allocator as a means to provide buffer
* objects that are physically contiguous in memory. This is useful for
* display drivers that are unable to map scattered buffers via an IOMMU.
*/
/**
* __drm_gem_cma_create - Create a GEM CMA object without allocating memory * __drm_gem_cma_create - Create a GEM CMA object without allocating memory
* @drm: The drm device * @drm: DRM device
* @size: The GEM object size * @size: size of the object to allocate
* *
* This function creates and initializes a GEM CMA object of the given size, but * This function creates and initializes a GEM CMA object of the given size,
* doesn't allocate any memory to back the object. * but doesn't allocate any memory to back the object.
* *
* Return a struct drm_gem_cma_object* on success or ERR_PTR values on failure. * Returns:
* A struct drm_gem_cma_object * on success or an ERR_PTR()-encoded negative
* error code on failure.
*/ */
static struct drm_gem_cma_object * static struct drm_gem_cma_object *
__drm_gem_cma_create(struct drm_device *drm, unsigned int size) __drm_gem_cma_create(struct drm_device *drm, size_t size)
{ {
struct drm_gem_cma_object *cma_obj; struct drm_gem_cma_object *cma_obj;
struct drm_gem_object *gem_obj; struct drm_gem_object *gem_obj;
@ -69,14 +82,21 @@ error:
return ERR_PTR(ret); return ERR_PTR(ret);
} }
/* /**
* drm_gem_cma_create - allocate an object with the given size * drm_gem_cma_create - allocate an object with the given size
* @drm: DRM device
* @size: size of the object to allocate
* *
* returns a struct drm_gem_cma_object* on success or ERR_PTR values * This function creates a CMA GEM object and allocates a contiguous chunk of
* on failure. * memory as backing store. The backing memory has the writecombine attribute
* set.
*
* Returns:
* A struct drm_gem_cma_object * on success or an ERR_PTR()-encoded negative
* error code on failure.
*/ */
struct drm_gem_cma_object *drm_gem_cma_create(struct drm_device *drm, struct drm_gem_cma_object *drm_gem_cma_create(struct drm_device *drm,
unsigned int size) size_t size)
{ {
struct drm_gem_cma_object *cma_obj; struct drm_gem_cma_object *cma_obj;
int ret; int ret;
@ -104,17 +124,26 @@ error:
} }
EXPORT_SYMBOL_GPL(drm_gem_cma_create); EXPORT_SYMBOL_GPL(drm_gem_cma_create);
/* /**
* drm_gem_cma_create_with_handle - allocate an object with the given * drm_gem_cma_create_with_handle - allocate an object with the given size and
* size and create a gem handle on it * return a GEM handle to it
* @file_priv: DRM file-private structure to register the handle for
* @drm: DRM device
* @size: size of the object to allocate
* @handle: return location for the GEM handle
* *
* returns a struct drm_gem_cma_object* on success or ERR_PTR values * This function creates a CMA GEM object, allocating a physically contiguous
* on failure. * chunk of memory as backing store. The GEM object is then added to the list
* of object associated with the given file and a handle to it is returned.
*
* Returns:
* A struct drm_gem_cma_object * on success or an ERR_PTR()-encoded negative
* error code on failure.
*/ */
static struct drm_gem_cma_object *drm_gem_cma_create_with_handle( static struct drm_gem_cma_object *
struct drm_file *file_priv, drm_gem_cma_create_with_handle(struct drm_file *file_priv,
struct drm_device *drm, unsigned int size, struct drm_device *drm, size_t size,
unsigned int *handle) uint32_t *handle)
{ {
struct drm_gem_cma_object *cma_obj; struct drm_gem_cma_object *cma_obj;
struct drm_gem_object *gem_obj; struct drm_gem_object *gem_obj;
@ -145,16 +174,19 @@ err_handle_create:
return ERR_PTR(ret); return ERR_PTR(ret);
} }
/* /**
* drm_gem_cma_free_object - (struct drm_driver)->gem_free_object callback * drm_gem_cma_free_object - free resources associated with a CMA GEM object
* function * @gem_obj: GEM object to free
*
* This function frees the backing memory of the CMA GEM object, cleans up the
* GEM object state and frees the memory used to store the object itself.
* Drivers using the CMA helpers should set this as their DRM driver's
* ->gem_free_object() callback.
*/ */
void drm_gem_cma_free_object(struct drm_gem_object *gem_obj) void drm_gem_cma_free_object(struct drm_gem_object *gem_obj)
{ {
struct drm_gem_cma_object *cma_obj; struct drm_gem_cma_object *cma_obj;
drm_gem_free_mmap_offset(gem_obj);
cma_obj = to_drm_gem_cma_obj(gem_obj); cma_obj = to_drm_gem_cma_obj(gem_obj);
if (cma_obj->vaddr) { if (cma_obj->vaddr) {
@ -170,18 +202,26 @@ void drm_gem_cma_free_object(struct drm_gem_object *gem_obj)
} }
EXPORT_SYMBOL_GPL(drm_gem_cma_free_object); EXPORT_SYMBOL_GPL(drm_gem_cma_free_object);
/* /**
* drm_gem_cma_dumb_create - (struct drm_driver)->dumb_create callback * drm_gem_cma_dumb_create_internal - create a dumb buffer object
* function * @file_priv: DRM file-private structure to create the dumb buffer for
* @drm: DRM device
* @args: IOCTL data
* *
* This aligns the pitch and size arguments to the minimum required. wrap * This aligns the pitch and size arguments to the minimum required. This is
* this into your own function if you need bigger alignment. * an internal helper that can be wrapped by a driver to account for hardware
* with more specific alignment requirements. It should not be used directly
* as the ->dumb_create() callback in a DRM driver.
*
* Returns:
* 0 on success or a negative error code on failure.
*/ */
int drm_gem_cma_dumb_create(struct drm_file *file_priv, int drm_gem_cma_dumb_create_internal(struct drm_file *file_priv,
struct drm_device *dev, struct drm_mode_create_dumb *args) struct drm_device *drm,
struct drm_mode_create_dumb *args)
{ {
unsigned int min_pitch = DIV_ROUND_UP(args->width * args->bpp, 8);
struct drm_gem_cma_object *cma_obj; struct drm_gem_cma_object *cma_obj;
int min_pitch = DIV_ROUND_UP(args->width * args->bpp, 8);
if (args->pitch < min_pitch) if (args->pitch < min_pitch)
args->pitch = min_pitch; args->pitch = min_pitch;
@ -189,18 +229,63 @@ int drm_gem_cma_dumb_create(struct drm_file *file_priv,
if (args->size < args->pitch * args->height) if (args->size < args->pitch * args->height)
args->size = args->pitch * args->height; args->size = args->pitch * args->height;
cma_obj = drm_gem_cma_create_with_handle(file_priv, dev, cma_obj = drm_gem_cma_create_with_handle(file_priv, drm, args->size,
args->size, &args->handle); &args->handle);
return PTR_ERR_OR_ZERO(cma_obj);
}
EXPORT_SYMBOL_GPL(drm_gem_cma_dumb_create_internal);
/**
* drm_gem_cma_dumb_create - create a dumb buffer object
* @file_priv: DRM file-private structure to create the dumb buffer for
* @drm: DRM device
* @args: IOCTL data
*
* This function computes the pitch of the dumb buffer and rounds it up to an
* integer number of bytes per pixel. Drivers for hardware that doesn't have
* any additional restrictions on the pitch can directly use this function as
* their ->dumb_create() callback.
*
* For hardware with additional restrictions, drivers can adjust the fields
* set up by userspace and pass the IOCTL data along to the
* drm_gem_cma_dumb_create_internal() function.
*
* Returns:
* 0 on success or a negative error code on failure.
*/
int drm_gem_cma_dumb_create(struct drm_file *file_priv,
struct drm_device *drm,
struct drm_mode_create_dumb *args)
{
struct drm_gem_cma_object *cma_obj;
args->pitch = DIV_ROUND_UP(args->width * args->bpp, 8);
args->size = args->pitch * args->height;
cma_obj = drm_gem_cma_create_with_handle(file_priv, drm, args->size,
&args->handle);
return PTR_ERR_OR_ZERO(cma_obj); return PTR_ERR_OR_ZERO(cma_obj);
} }
EXPORT_SYMBOL_GPL(drm_gem_cma_dumb_create); EXPORT_SYMBOL_GPL(drm_gem_cma_dumb_create);
/* /**
* drm_gem_cma_dumb_map_offset - (struct drm_driver)->dumb_map_offset callback * drm_gem_cma_dumb_map_offset - return the fake mmap offset for a CMA GEM
* function * object
* @file_priv: DRM file-private structure containing the GEM object
* @drm: DRM device
* @handle: GEM object handle
* @offset: return location for the fake mmap offset
*
* This function look up an object by its handle and returns the fake mmap
* offset associated with it. Drivers using the CMA helpers should set this
* as their DRM driver's ->dumb_map_offset() callback.
*
* Returns:
* 0 on success or a negative error code on failure.
*/ */
int drm_gem_cma_dumb_map_offset(struct drm_file *file_priv, int drm_gem_cma_dumb_map_offset(struct drm_file *file_priv,
struct drm_device *drm, uint32_t handle, uint64_t *offset) struct drm_device *drm, u32 handle,
u64 *offset)
{ {
struct drm_gem_object *gem_obj; struct drm_gem_object *gem_obj;
@ -208,7 +293,7 @@ int drm_gem_cma_dumb_map_offset(struct drm_file *file_priv,
gem_obj = drm_gem_object_lookup(drm, file_priv, handle); gem_obj = drm_gem_object_lookup(drm, file_priv, handle);
if (!gem_obj) { if (!gem_obj) {
dev_err(drm->dev, "failed to lookup gem object\n"); dev_err(drm->dev, "failed to lookup GEM object\n");
mutex_unlock(&drm->struct_mutex); mutex_unlock(&drm->struct_mutex);
return -EINVAL; return -EINVAL;
} }
@ -251,8 +336,20 @@ static int drm_gem_cma_mmap_obj(struct drm_gem_cma_object *cma_obj,
return ret; return ret;
} }
/* /**
* drm_gem_cma_mmap - (struct file_operation)->mmap callback function * drm_gem_cma_mmap - memory-map a CMA GEM object
* @filp: file object
* @vma: VMA for the area to be mapped
*
* This function implements an augmented version of the GEM DRM file mmap
* operation for CMA objects: In addition to the usual GEM VMA setup it
* immediately faults in the entire object instead of using on-demaind
* faulting. Drivers which employ the CMA helpers should use this function
* as their ->mmap() handler in the DRM device file's file_operations
* structure.
*
* Returns:
* 0 on success or a negative error code on failure.
*/ */
int drm_gem_cma_mmap(struct file *filp, struct vm_area_struct *vma) int drm_gem_cma_mmap(struct file *filp, struct vm_area_struct *vma)
{ {
@ -272,7 +369,16 @@ int drm_gem_cma_mmap(struct file *filp, struct vm_area_struct *vma)
EXPORT_SYMBOL_GPL(drm_gem_cma_mmap); EXPORT_SYMBOL_GPL(drm_gem_cma_mmap);
#ifdef CONFIG_DEBUG_FS #ifdef CONFIG_DEBUG_FS
void drm_gem_cma_describe(struct drm_gem_cma_object *cma_obj, struct seq_file *m) /**
* drm_gem_cma_describe - describe a CMA GEM object for debugfs
* @cma_obj: CMA GEM object
* @m: debugfs file handle
*
* This function can be used to dump a human-readable representation of the
* CMA GEM object into a synthetic file.
*/
void drm_gem_cma_describe(struct drm_gem_cma_object *cma_obj,
struct seq_file *m)
{ {
struct drm_gem_object *obj = &cma_obj->base; struct drm_gem_object *obj = &cma_obj->base;
struct drm_device *dev = obj->dev; struct drm_device *dev = obj->dev;
@ -291,7 +397,18 @@ void drm_gem_cma_describe(struct drm_gem_cma_object *cma_obj, struct seq_file *m
EXPORT_SYMBOL_GPL(drm_gem_cma_describe); EXPORT_SYMBOL_GPL(drm_gem_cma_describe);
#endif #endif
/* low-level interface prime helpers */ /**
* drm_gem_cma_prime_get_sg_table - provide a scatter/gather table of pinned
* pages for a CMA GEM object
* @obj: GEM object
*
* This function exports a scatter/gather table suitable for PRIME usage by
* calling the standard DMA mapping API. Drivers using the CMA helpers should
* set this as their DRM driver's ->gem_prime_get_sg_table() callback.
*
* Returns:
* A pointer to the scatter/gather table of pinned pages or NULL on failure.
*/
struct sg_table *drm_gem_cma_prime_get_sg_table(struct drm_gem_object *obj) struct sg_table *drm_gem_cma_prime_get_sg_table(struct drm_gem_object *obj)
{ {
struct drm_gem_cma_object *cma_obj = to_drm_gem_cma_obj(obj); struct drm_gem_cma_object *cma_obj = to_drm_gem_cma_obj(obj);
@ -315,6 +432,23 @@ out:
} }
EXPORT_SYMBOL_GPL(drm_gem_cma_prime_get_sg_table); EXPORT_SYMBOL_GPL(drm_gem_cma_prime_get_sg_table);
/**
* drm_gem_cma_prime_import_sg_table - produce a CMA GEM object from another
* driver's scatter/gather table of pinned pages
* @dev: device to import into
* @attach: DMA-BUF attachment
* @sgt: scatter/gather table of pinned pages
*
* This function imports a scatter/gather table exported via DMA-BUF by
* another driver. Imported buffers must be physically contiguous in memory
* (i.e. the scatter/gather table must contain a single entry). Drivers that
* use the CMA helpers should set this as their DRM driver's
* ->gem_prime_import_sg_table() callback.
*
* Returns:
* A pointer to a newly created GEM object or an ERR_PTR-encoded negative
* error code on failure.
*/
struct drm_gem_object * struct drm_gem_object *
drm_gem_cma_prime_import_sg_table(struct drm_device *dev, drm_gem_cma_prime_import_sg_table(struct drm_device *dev,
struct dma_buf_attachment *attach, struct dma_buf_attachment *attach,
@ -339,6 +473,18 @@ drm_gem_cma_prime_import_sg_table(struct drm_device *dev,
} }
EXPORT_SYMBOL_GPL(drm_gem_cma_prime_import_sg_table); EXPORT_SYMBOL_GPL(drm_gem_cma_prime_import_sg_table);
/**
* drm_gem_cma_prime_mmap - memory-map an exported CMA GEM object
* @obj: GEM object
* @vma: VMA for the area to be mapped
*
* This function maps a buffer imported via DRM PRIME into a userspace
* process's address space. Drivers that use the CMA helpers should set this
* as their DRM driver's ->gem_prime_mmap() callback.
*
* Returns:
* 0 on success or a negative error code on failure.
*/
int drm_gem_cma_prime_mmap(struct drm_gem_object *obj, int drm_gem_cma_prime_mmap(struct drm_gem_object *obj,
struct vm_area_struct *vma) struct vm_area_struct *vma)
{ {
@ -357,6 +503,20 @@ int drm_gem_cma_prime_mmap(struct drm_gem_object *obj,
} }
EXPORT_SYMBOL_GPL(drm_gem_cma_prime_mmap); EXPORT_SYMBOL_GPL(drm_gem_cma_prime_mmap);
/**
* drm_gem_cma_prime_vmap - map a CMA GEM object into the kernel's virtual
* address space
* @obj: GEM object
*
* This function maps a buffer exported via DRM PRIME into the kernel's
* virtual address space. Since the CMA buffers are already mapped into the
* kernel virtual address space this simply returns the cached virtual
* address. Drivers using the CMA helpers should set this as their DRM
* driver's ->gem_prime_vmap() callback.
*
* Returns:
* The kernel virtual address of the CMA GEM object's backing store.
*/
void *drm_gem_cma_prime_vmap(struct drm_gem_object *obj) void *drm_gem_cma_prime_vmap(struct drm_gem_object *obj)
{ {
struct drm_gem_cma_object *cma_obj = to_drm_gem_cma_obj(obj); struct drm_gem_cma_object *cma_obj = to_drm_gem_cma_obj(obj);
@ -365,6 +525,17 @@ void *drm_gem_cma_prime_vmap(struct drm_gem_object *obj)
} }
EXPORT_SYMBOL_GPL(drm_gem_cma_prime_vmap); EXPORT_SYMBOL_GPL(drm_gem_cma_prime_vmap);
/**
* drm_gem_cma_prime_vunmap - unmap a CMA GEM object from the kernel's virtual
* address space
* @obj: GEM object
* @vaddr: kernel virtual address where the CMA GEM object was mapped
*
* This function removes a buffer exported via DRM PRIME from the kernel's
* virtual address space. This is a no-op because CMA buffers cannot be
* unmapped from kernel space. Drivers using the CMA helpers should set this
* as their DRM driver's ->gem_prime_vunmap() callback.
*/
void drm_gem_cma_prime_vunmap(struct drm_gem_object *obj, void *vaddr) void drm_gem_cma_prime_vunmap(struct drm_gem_object *obj, void *vaddr)
{ {
/* Nothing to do */ /* Nothing to do */

3
drivers/gpu/drm/omapdrm/omap_gem.c
View File

@ -612,8 +612,7 @@ int omap_gem_dumb_create(struct drm_file *file, struct drm_device *dev,
{ {
union omap_gem_size gsize; union omap_gem_size gsize;
/* in case someone tries to feed us a completely bogus stride: */ args->pitch = align_pitch(0, args->width, args->bpp);
args->pitch = align_pitch(args->pitch, args->width, args->bpp);
args->size = PAGE_ALIGN(args->pitch * args->height); args->size = PAGE_ALIGN(args->pitch * args->height);
gsize = (union omap_gem_size){ gsize = (union omap_gem_size){

4
drivers/gpu/drm/rcar-du/rcar_du_kms.c
View File

@ -126,9 +126,9 @@ int rcar_du_dumb_create(struct drm_file *file, struct drm_device *dev,
else else
align = 16 * args->bpp / 8; align = 16 * args->bpp / 8;
args->pitch = roundup(max(args->pitch, min_pitch), align); args->pitch = roundup(min_pitch, align);
return drm_gem_cma_dumb_create(file, dev, args); return drm_gem_cma_dumb_create_internal(file, dev, args);
} }
static struct drm_framebuffer * static struct drm_framebuffer *

30
include/drm/drm_gem_cma_helper.h
View File

@ -4,6 +4,13 @@
#include <drm/drmP.h> #include <drm/drmP.h>
#include <drm/drm_gem.h> #include <drm/drm_gem.h>
/**
* struct drm_gem_cma_object - GEM object backed by CMA memory allocations
* @base: base GEM object
* @paddr: physical address of the backing memory
* @sgt: scatter/gather table for imported PRIME buffers
* @vaddr: kernel virtual address of the backing memory
*/
struct drm_gem_cma_object { struct drm_gem_cma_object {
struct drm_gem_object base; struct drm_gem_object base;
dma_addr_t paddr; dma_addr_t paddr;
@ -19,23 +26,30 @@ to_drm_gem_cma_obj(struct drm_gem_object *gem_obj)
return container_of(gem_obj, struct drm_gem_cma_object, base); return container_of(gem_obj, struct drm_gem_cma_object, base);
} }
/* free gem object. */ /* free GEM object */
void drm_gem_cma_free_object(struct drm_gem_object *gem_obj); void drm_gem_cma_free_object(struct drm_gem_object *gem_obj);
/* create memory region for drm framebuffer. */ /* create memory region for DRM framebuffer */
int drm_gem_cma_dumb_create_internal(struct drm_file *file_priv,
struct drm_device *drm,
struct drm_mode_create_dumb *args);
/* create memory region for DRM framebuffer */
int drm_gem_cma_dumb_create(struct drm_file *file_priv, int drm_gem_cma_dumb_create(struct drm_file *file_priv,
struct drm_device *drm, struct drm_mode_create_dumb *args); struct drm_device *drm,
struct drm_mode_create_dumb *args);
/* map memory region for drm framebuffer to user space. */ /* map memory region for DRM framebuffer to user space */
int drm_gem_cma_dumb_map_offset(struct drm_file *file_priv, int drm_gem_cma_dumb_map_offset(struct drm_file *file_priv,
struct drm_device *drm, uint32_t handle, uint64_t *offset); struct drm_device *drm, u32 handle,
u64 *offset);
/* set vm_flags and we can change the vm attribute to other one at here. */ /* set vm_flags and we can change the VM attribute to other one at here */
int drm_gem_cma_mmap(struct file *filp, struct vm_area_struct *vma); int drm_gem_cma_mmap(struct file *filp, struct vm_area_struct *vma);
/* allocate physical memory. */ /* allocate physical memory */
struct drm_gem_cma_object *drm_gem_cma_create(struct drm_device *drm, struct drm_gem_cma_object *drm_gem_cma_create(struct drm_device *drm,
unsigned int size); size_t size);
extern const struct vm_operations_struct drm_gem_cma_vm_ops; extern const struct vm_operations_struct drm_gem_cma_vm_ops;