bpf: Prevent memory disambiguation attack
[linux/fpc-iii.git] / drivers / gpu / drm / udl / udl_main.c
blobf1ec4528a73e71de7074404134ba2d063ddbceaa
1 /*
2 * Copyright (C) 2012 Red Hat
4 * based in parts on udlfb.c:
5 * Copyright (C) 2009 Roberto De Ioris <roberto@unbit.it>
6 * Copyright (C) 2009 Jaya Kumar <jayakumar.lkml@gmail.com>
7 * Copyright (C) 2009 Bernie Thompson <bernie@plugable.com>
9 * This file is subject to the terms and conditions of the GNU General Public
10 * License v2. See the file COPYING in the main directory of this archive for
11 * more details.
13 #include <drm/drmP.h>
14 #include <drm/drm_crtc_helper.h>
15 #include "udl_drv.h"
17 /* -BULK_SIZE as per usb-skeleton. Can we get full page and avoid overhead? */
18 #define BULK_SIZE 512
20 #define NR_USB_REQUEST_CHANNEL 0x12
22 #define MAX_TRANSFER (PAGE_SIZE*16 - BULK_SIZE)
23 #define WRITES_IN_FLIGHT (4)
24 #define MAX_VENDOR_DESCRIPTOR_SIZE 256
26 #define GET_URB_TIMEOUT HZ
27 #define FREE_URB_TIMEOUT (HZ*2)
29 static int udl_parse_vendor_descriptor(struct drm_device *dev,
30 struct usb_device *usbdev)
32 struct udl_device *udl = dev->dev_private;
33 char *desc;
34 char *buf;
35 char *desc_end;
37 u8 total_len = 0;
39 buf = kzalloc(MAX_VENDOR_DESCRIPTOR_SIZE, GFP_KERNEL);
40 if (!buf)
41 return false;
42 desc = buf;
44 total_len = usb_get_descriptor(usbdev, 0x5f, /* vendor specific */
45 0, desc, MAX_VENDOR_DESCRIPTOR_SIZE);
46 if (total_len > 5) {
47 DRM_INFO("vendor descriptor length:%x data:%11ph\n",
48 total_len, desc);
50 if ((desc[0] != total_len) || /* descriptor length */
51 (desc[1] != 0x5f) || /* vendor descriptor type */
52 (desc[2] != 0x01) || /* version (2 bytes) */
53 (desc[3] != 0x00) ||
54 (desc[4] != total_len - 2)) /* length after type */
55 goto unrecognized;
57 desc_end = desc + total_len;
58 desc += 5; /* the fixed header we've already parsed */
60 while (desc < desc_end) {
61 u8 length;
62 u16 key;
64 key = le16_to_cpu(*((u16 *) desc));
65 desc += sizeof(u16);
66 length = *desc;
67 desc++;
69 switch (key) {
70 case 0x0200: { /* max_area */
71 u32 max_area;
72 max_area = le32_to_cpu(*((u32 *)desc));
73 DRM_DEBUG("DL chip limited to %d pixel modes\n",
74 max_area);
75 udl->sku_pixel_limit = max_area;
76 break;
78 default:
79 break;
81 desc += length;
85 goto success;
87 unrecognized:
88 /* allow udlfb to load for now even if firmware unrecognized */
89 DRM_ERROR("Unrecognized vendor firmware descriptor\n");
91 success:
92 kfree(buf);
93 return true;
97 * Need to ensure a channel is selected before submitting URBs
99 static int udl_select_std_channel(struct udl_device *udl)
101 int ret;
102 static const u8 set_def_chn[] = {0x57, 0xCD, 0xDC, 0xA7,
103 0x1C, 0x88, 0x5E, 0x15,
104 0x60, 0xFE, 0xC6, 0x97,
105 0x16, 0x3D, 0x47, 0xF2};
106 void *sendbuf;
108 sendbuf = kmemdup(set_def_chn, sizeof(set_def_chn), GFP_KERNEL);
109 if (!sendbuf)
110 return -ENOMEM;
112 ret = usb_control_msg(udl->udev,
113 usb_sndctrlpipe(udl->udev, 0),
114 NR_USB_REQUEST_CHANNEL,
115 (USB_DIR_OUT | USB_TYPE_VENDOR), 0, 0,
116 sendbuf, sizeof(set_def_chn),
117 USB_CTRL_SET_TIMEOUT);
118 kfree(sendbuf);
119 return ret < 0 ? ret : 0;
122 static void udl_release_urb_work(struct work_struct *work)
124 struct urb_node *unode = container_of(work, struct urb_node,
125 release_urb_work.work);
127 up(&unode->dev->urbs.limit_sem);
130 void udl_urb_completion(struct urb *urb)
132 struct urb_node *unode = urb->context;
133 struct udl_device *udl = unode->dev;
134 unsigned long flags;
136 /* sync/async unlink faults aren't errors */
137 if (urb->status) {
138 if (!(urb->status == -ENOENT ||
139 urb->status == -ECONNRESET ||
140 urb->status == -ESHUTDOWN)) {
141 DRM_ERROR("%s - nonzero write bulk status received: %d\n",
142 __func__, urb->status);
143 atomic_set(&udl->lost_pixels, 1);
147 urb->transfer_buffer_length = udl->urbs.size; /* reset to actual */
149 spin_lock_irqsave(&udl->urbs.lock, flags);
150 list_add_tail(&unode->entry, &udl->urbs.list);
151 udl->urbs.available++;
152 spin_unlock_irqrestore(&udl->urbs.lock, flags);
154 #if 0
156 * When using fb_defio, we deadlock if up() is called
157 * while another is waiting. So queue to another process.
159 if (fb_defio)
160 schedule_delayed_work(&unode->release_urb_work, 0);
161 else
162 #endif
163 up(&udl->urbs.limit_sem);
166 static void udl_free_urb_list(struct drm_device *dev)
168 struct udl_device *udl = dev->dev_private;
169 int count = udl->urbs.count;
170 struct list_head *node;
171 struct urb_node *unode;
172 struct urb *urb;
173 int ret;
174 unsigned long flags;
176 DRM_DEBUG("Waiting for completes and freeing all render urbs\n");
178 /* keep waiting and freeing, until we've got 'em all */
179 while (count--) {
181 /* Getting interrupted means a leak, but ok at shutdown*/
182 ret = down_interruptible(&udl->urbs.limit_sem);
183 if (ret)
184 break;
186 spin_lock_irqsave(&udl->urbs.lock, flags);
188 node = udl->urbs.list.next; /* have reserved one with sem */
189 list_del_init(node);
191 spin_unlock_irqrestore(&udl->urbs.lock, flags);
193 unode = list_entry(node, struct urb_node, entry);
194 urb = unode->urb;
196 /* Free each separately allocated piece */
197 usb_free_coherent(urb->dev, udl->urbs.size,
198 urb->transfer_buffer, urb->transfer_dma);
199 usb_free_urb(urb);
200 kfree(node);
202 udl->urbs.count = 0;
205 static int udl_alloc_urb_list(struct drm_device *dev, int count, size_t size)
207 struct udl_device *udl = dev->dev_private;
208 int i = 0;
209 struct urb *urb;
210 struct urb_node *unode;
211 char *buf;
213 spin_lock_init(&udl->urbs.lock);
215 udl->urbs.size = size;
216 INIT_LIST_HEAD(&udl->urbs.list);
218 while (i < count) {
219 unode = kzalloc(sizeof(struct urb_node), GFP_KERNEL);
220 if (!unode)
221 break;
222 unode->dev = udl;
224 INIT_DELAYED_WORK(&unode->release_urb_work,
225 udl_release_urb_work);
227 urb = usb_alloc_urb(0, GFP_KERNEL);
228 if (!urb) {
229 kfree(unode);
230 break;
232 unode->urb = urb;
234 buf = usb_alloc_coherent(udl->udev, MAX_TRANSFER, GFP_KERNEL,
235 &urb->transfer_dma);
236 if (!buf) {
237 kfree(unode);
238 usb_free_urb(urb);
239 break;
242 /* urb->transfer_buffer_length set to actual before submit */
243 usb_fill_bulk_urb(urb, udl->udev, usb_sndbulkpipe(udl->udev, 1),
244 buf, size, udl_urb_completion, unode);
245 urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
247 list_add_tail(&unode->entry, &udl->urbs.list);
249 i++;
252 sema_init(&udl->urbs.limit_sem, i);
253 udl->urbs.count = i;
254 udl->urbs.available = i;
256 DRM_DEBUG("allocated %d %d byte urbs\n", i, (int) size);
258 return i;
261 struct urb *udl_get_urb(struct drm_device *dev)
263 struct udl_device *udl = dev->dev_private;
264 int ret = 0;
265 struct list_head *entry;
266 struct urb_node *unode;
267 struct urb *urb = NULL;
268 unsigned long flags;
270 /* Wait for an in-flight buffer to complete and get re-queued */
271 ret = down_timeout(&udl->urbs.limit_sem, GET_URB_TIMEOUT);
272 if (ret) {
273 atomic_set(&udl->lost_pixels, 1);
274 DRM_INFO("wait for urb interrupted: %x available: %d\n",
275 ret, udl->urbs.available);
276 goto error;
279 spin_lock_irqsave(&udl->urbs.lock, flags);
281 BUG_ON(list_empty(&udl->urbs.list)); /* reserved one with limit_sem */
282 entry = udl->urbs.list.next;
283 list_del_init(entry);
284 udl->urbs.available--;
286 spin_unlock_irqrestore(&udl->urbs.lock, flags);
288 unode = list_entry(entry, struct urb_node, entry);
289 urb = unode->urb;
291 error:
292 return urb;
295 int udl_submit_urb(struct drm_device *dev, struct urb *urb, size_t len)
297 struct udl_device *udl = dev->dev_private;
298 int ret;
300 BUG_ON(len > udl->urbs.size);
302 urb->transfer_buffer_length = len; /* set to actual payload len */
303 ret = usb_submit_urb(urb, GFP_ATOMIC);
304 if (ret) {
305 udl_urb_completion(urb); /* because no one else will */
306 atomic_set(&udl->lost_pixels, 1);
307 DRM_ERROR("usb_submit_urb error %x\n", ret);
309 return ret;
312 int udl_driver_load(struct drm_device *dev, unsigned long flags)
314 struct usb_device *udev = (void*)flags;
315 struct udl_device *udl;
316 int ret = -ENOMEM;
318 DRM_DEBUG("\n");
319 udl = kzalloc(sizeof(struct udl_device), GFP_KERNEL);
320 if (!udl)
321 return -ENOMEM;
323 udl->udev = udev;
324 udl->ddev = dev;
325 dev->dev_private = udl;
327 if (!udl_parse_vendor_descriptor(dev, udl->udev)) {
328 ret = -ENODEV;
329 DRM_ERROR("firmware not recognized. Assume incompatible device\n");
330 goto err;
333 if (udl_select_std_channel(udl))
334 DRM_ERROR("Selecting channel failed\n");
336 if (!udl_alloc_urb_list(dev, WRITES_IN_FLIGHT, MAX_TRANSFER)) {
337 DRM_ERROR("udl_alloc_urb_list failed\n");
338 goto err;
341 DRM_DEBUG("\n");
342 ret = udl_modeset_init(dev);
343 if (ret)
344 goto err;
346 ret = udl_fbdev_init(dev);
347 if (ret)
348 goto err;
350 ret = drm_vblank_init(dev, 1);
351 if (ret)
352 goto err_fb;
354 drm_kms_helper_poll_init(dev);
356 return 0;
357 err_fb:
358 udl_fbdev_cleanup(dev);
359 err:
360 if (udl->urbs.count)
361 udl_free_urb_list(dev);
362 kfree(udl);
363 DRM_ERROR("%d\n", ret);
364 return ret;
367 int udl_drop_usb(struct drm_device *dev)
369 udl_free_urb_list(dev);
370 return 0;
373 void udl_driver_unload(struct drm_device *dev)
375 struct udl_device *udl = dev->dev_private;
377 drm_kms_helper_poll_fini(dev);
379 if (udl->urbs.count)
380 udl_free_urb_list(dev);
382 udl_fbdev_cleanup(dev);
383 udl_modeset_cleanup(dev);
384 kfree(udl);