iwl3945: fix possible il->txq NULL pointer dereference in delayed works
[linux/fpc-iii.git] / drivers / video / fb_defio.c
blobc27e153d8882053e2d28ab72cfc784875752f337
1 /*
2 * linux/drivers/video/fb_defio.c
4 * Copyright (C) 2006 Jaya Kumar
6 * This file is subject to the terms and conditions of the GNU General Public
7 * License. See the file COPYING in the main directory of this archive
8 * for more details.
9 */
11 #include <linux/module.h>
12 #include <linux/kernel.h>
13 #include <linux/errno.h>
14 #include <linux/string.h>
15 #include <linux/mm.h>
16 #include <linux/vmalloc.h>
17 #include <linux/delay.h>
18 #include <linux/interrupt.h>
19 #include <linux/fb.h>
20 #include <linux/list.h>
22 /* to support deferred IO */
23 #include <linux/rmap.h>
24 #include <linux/pagemap.h>
26 struct page *fb_deferred_io_page(struct fb_info *info, unsigned long offs)
28 void *screen_base = (void __force *) info->screen_base;
29 struct page *page;
31 if (is_vmalloc_addr(screen_base + offs))
32 page = vmalloc_to_page(screen_base + offs);
33 else
34 page = pfn_to_page((info->fix.smem_start + offs) >> PAGE_SHIFT);
36 return page;
39 /* this is to find and return the vmalloc-ed fb pages */
40 static int fb_deferred_io_fault(struct vm_area_struct *vma,
41 struct vm_fault *vmf)
43 unsigned long offset;
44 struct page *page;
45 struct fb_info *info = vma->vm_private_data;
47 offset = vmf->pgoff << PAGE_SHIFT;
48 if (offset >= info->fix.smem_len)
49 return VM_FAULT_SIGBUS;
51 page = fb_deferred_io_page(info, offset);
52 if (!page)
53 return VM_FAULT_SIGBUS;
55 get_page(page);
57 if (vma->vm_file)
58 page->mapping = vma->vm_file->f_mapping;
59 else
60 printk(KERN_ERR "no mapping available\n");
62 BUG_ON(!page->mapping);
63 page->index = vmf->pgoff;
65 vmf->page = page;
66 return 0;
69 int fb_deferred_io_fsync(struct file *file, loff_t start, loff_t end, int datasync)
71 struct fb_info *info = file->private_data;
72 struct inode *inode = file->f_path.dentry->d_inode;
73 int err = filemap_write_and_wait_range(inode->i_mapping, start, end);
74 if (err)
75 return err;
77 /* Skip if deferred io is compiled-in but disabled on this fbdev */
78 if (!info->fbdefio)
79 return 0;
81 mutex_lock(&inode->i_mutex);
82 /* Kill off the delayed work */
83 cancel_delayed_work_sync(&info->deferred_work);
85 /* Run it immediately */
86 err = schedule_delayed_work(&info->deferred_work, 0);
87 mutex_unlock(&inode->i_mutex);
88 return err;
90 EXPORT_SYMBOL_GPL(fb_deferred_io_fsync);
92 /* vm_ops->page_mkwrite handler */
93 static int fb_deferred_io_mkwrite(struct vm_area_struct *vma,
94 struct vm_fault *vmf)
96 struct page *page = vmf->page;
97 struct fb_info *info = vma->vm_private_data;
98 struct fb_deferred_io *fbdefio = info->fbdefio;
99 struct page *cur;
101 /* this is a callback we get when userspace first tries to
102 write to the page. we schedule a workqueue. that workqueue
103 will eventually mkclean the touched pages and execute the
104 deferred framebuffer IO. then if userspace touches a page
105 again, we repeat the same scheme */
107 /* protect against the workqueue changing the page list */
108 mutex_lock(&fbdefio->lock);
111 * We want the page to remain locked from ->page_mkwrite until
112 * the PTE is marked dirty to avoid page_mkclean() being called
113 * before the PTE is updated, which would leave the page ignored
114 * by defio.
115 * Do this by locking the page here and informing the caller
116 * about it with VM_FAULT_LOCKED.
118 lock_page(page);
120 /* we loop through the pagelist before adding in order
121 to keep the pagelist sorted */
122 list_for_each_entry(cur, &fbdefio->pagelist, lru) {
123 /* this check is to catch the case where a new
124 process could start writing to the same page
125 through a new pte. this new access can cause the
126 mkwrite even when the original ps's pte is marked
127 writable */
128 if (unlikely(cur == page))
129 goto page_already_added;
130 else if (cur->index > page->index)
131 break;
134 list_add_tail(&page->lru, &cur->lru);
136 page_already_added:
137 mutex_unlock(&fbdefio->lock);
139 /* come back after delay to process the deferred IO */
140 schedule_delayed_work(&info->deferred_work, fbdefio->delay);
141 return VM_FAULT_LOCKED;
144 static const struct vm_operations_struct fb_deferred_io_vm_ops = {
145 .fault = fb_deferred_io_fault,
146 .page_mkwrite = fb_deferred_io_mkwrite,
149 static int fb_deferred_io_set_page_dirty(struct page *page)
151 if (!PageDirty(page))
152 SetPageDirty(page);
153 return 0;
156 static const struct address_space_operations fb_deferred_io_aops = {
157 .set_page_dirty = fb_deferred_io_set_page_dirty,
160 static int fb_deferred_io_mmap(struct fb_info *info, struct vm_area_struct *vma)
162 vma->vm_ops = &fb_deferred_io_vm_ops;
163 vma->vm_flags |= ( VM_RESERVED | VM_DONTEXPAND );
164 if (!(info->flags & FBINFO_VIRTFB))
165 vma->vm_flags |= VM_IO;
166 vma->vm_private_data = info;
167 return 0;
170 /* workqueue callback */
171 static void fb_deferred_io_work(struct work_struct *work)
173 struct fb_info *info = container_of(work, struct fb_info,
174 deferred_work.work);
175 struct list_head *node, *next;
176 struct page *cur;
177 struct fb_deferred_io *fbdefio = info->fbdefio;
179 /* here we mkclean the pages, then do all deferred IO */
180 mutex_lock(&fbdefio->lock);
181 list_for_each_entry(cur, &fbdefio->pagelist, lru) {
182 lock_page(cur);
183 page_mkclean(cur);
184 unlock_page(cur);
187 /* driver's callback with pagelist */
188 fbdefio->deferred_io(info, &fbdefio->pagelist);
190 /* clear the list */
191 list_for_each_safe(node, next, &fbdefio->pagelist) {
192 list_del(node);
194 mutex_unlock(&fbdefio->lock);
197 void fb_deferred_io_init(struct fb_info *info)
199 struct fb_deferred_io *fbdefio = info->fbdefio;
201 BUG_ON(!fbdefio);
202 mutex_init(&fbdefio->lock);
203 info->fbops->fb_mmap = fb_deferred_io_mmap;
204 INIT_DELAYED_WORK(&info->deferred_work, fb_deferred_io_work);
205 INIT_LIST_HEAD(&fbdefio->pagelist);
206 if (fbdefio->delay == 0) /* set a default of 1 s */
207 fbdefio->delay = HZ;
209 EXPORT_SYMBOL_GPL(fb_deferred_io_init);
211 void fb_deferred_io_open(struct fb_info *info,
212 struct inode *inode,
213 struct file *file)
215 file->f_mapping->a_ops = &fb_deferred_io_aops;
217 EXPORT_SYMBOL_GPL(fb_deferred_io_open);
219 void fb_deferred_io_cleanup(struct fb_info *info)
221 struct fb_deferred_io *fbdefio = info->fbdefio;
222 struct page *page;
223 int i;
225 BUG_ON(!fbdefio);
226 cancel_delayed_work_sync(&info->deferred_work);
228 /* clear out the mapping that we setup */
229 for (i = 0 ; i < info->fix.smem_len; i += PAGE_SIZE) {
230 page = fb_deferred_io_page(info, i);
231 page->mapping = NULL;
234 info->fbops->fb_mmap = NULL;
235 mutex_destroy(&fbdefio->lock);
237 EXPORT_SYMBOL_GPL(fb_deferred_io_cleanup);
239 MODULE_LICENSE("GPL");