V4L/DVB (6265): Prevent for calling mmap_free without an allocated buffer
[GitHub/mt8127/android_kernel_alcatel_ttab.git] / drivers / media / video / videobuf-vmalloc.c
CommitLineData
87b9ad07
MCC
1/*
2 * helper functions for vmalloc video4linux capture buffers
3 *
4 * The functions expect the hardware being able to scatter gatter
5 * (i.e. the buffers are not linear in physical memory, but fragmented
6 * into PAGE_SIZE chunks). They also assume the driver does not need
7 * to touch the video data.
8 *
9 * (c) 2007 Mauro Carvalho Chehab, <mchehab@infradead.org>
10 *
11 * This program is free software; you can redistribute it and/or modify
12 * it under the terms of the GNU General Public License as published by
13 * the Free Software Foundation; either version 2
14 */
15
16#include <linux/init.h>
17#include <linux/module.h>
18#include <linux/moduleparam.h>
19#include <linux/slab.h>
20#include <linux/interrupt.h>
21
22#include <linux/pci.h>
23#include <linux/vmalloc.h>
24#include <linux/pagemap.h>
25#include <asm/page.h>
26#include <asm/pgtable.h>
27
28#include <media/videobuf-vmalloc.h>
29
30#define MAGIC_DMABUF 0x17760309
31#define MAGIC_VMAL_MEM 0x18221223
32
33#define MAGIC_CHECK(is,should) if (unlikely((is) != (should))) \
34 { printk(KERN_ERR "magic mismatch: %x (expected %x)\n",is,should); BUG(); }
35
36static int debug = 0;
37module_param(debug, int, 0644);
38
39MODULE_DESCRIPTION("helper module to manage video4linux vmalloc buffers");
40MODULE_AUTHOR("Mauro Carvalho Chehab <mchehab@infradead.org>");
41MODULE_LICENSE("GPL");
42
43#define dprintk(level, fmt, arg...) if (debug >= level) \
44 printk(KERN_DEBUG "vbuf-sg: " fmt , ## arg)
45
46
47/***************************************************************************/
48
49static void
50videobuf_vm_open(struct vm_area_struct *vma)
51{
52 struct videobuf_mapping *map = vma->vm_private_data;
53
54 dprintk(2,"vm_open %p [count=%d,vma=%08lx-%08lx]\n",map,
55 map->count,vma->vm_start,vma->vm_end);
56
57 map->count++;
58}
59
60static void
61videobuf_vm_close(struct vm_area_struct *vma)
62{
63 struct videobuf_mapping *map = vma->vm_private_data;
64 struct videobuf_queue *q = map->q;
65 struct videbuf_vmalloc_memory *mem;
66 int i;
67
68 dprintk(2,"vm_close %p [count=%d,vma=%08lx-%08lx]\n",map,
69 map->count,vma->vm_start,vma->vm_end);
70
71 map->count--;
72 if (0 == map->count) {
73 dprintk(1,"munmap %p q=%p\n",map,q);
74 mutex_lock(&q->lock);
75 for (i = 0; i < VIDEO_MAX_FRAME; i++) {
76 if (NULL == q->bufs[i])
77 continue;
78 mem=q->bufs[i]->priv;
79
80 if (!mem)
81 continue;
82
83 MAGIC_CHECK(mem->magic,MAGIC_VMAL_MEM);
84
85 if (mem->map != map)
86 continue;
123f8ef6
MCC
87
88 q->ops->buf_release(q,q->bufs[i]);
89
87b9ad07
MCC
90 mem->map = NULL;
91 q->bufs[i]->baddr = 0;
87b9ad07
MCC
92 }
93 mutex_unlock(&q->lock);
94 kfree(map);
95 }
96 return;
97}
98
99static struct vm_operations_struct videobuf_vm_ops =
100{
101 .open = videobuf_vm_open,
102 .close = videobuf_vm_close,
103};
104
105/* ---------------------------------------------------------------------
106 * vmalloc handlers for the generic methods
107 */
108
109/* Allocated area consists on 3 parts:
110 struct video_buffer
111 struct <driver>_buffer (cx88_buffer, saa7134_buf, ...)
112 struct videobuf_pci_sg_memory
113 */
114
115static void *__videobuf_alloc(size_t size)
116{
117 struct videbuf_vmalloc_memory *mem;
118 struct videobuf_buffer *vb;
119
120 vb = kzalloc(size+sizeof(*mem),GFP_KERNEL);
121
122 mem = vb->priv = ((char *)vb)+size;
123 mem->magic=MAGIC_VMAL_MEM;
124
125 dprintk(1,"%s: allocated at %p(%ld+%ld) & %p(%ld)\n",
126 __FUNCTION__,vb,(long)sizeof(*vb),(long)size-sizeof(*vb),
127 mem,(long)sizeof(*mem));
128
129 return vb;
130}
131
132static int __videobuf_iolock (struct videobuf_queue* q,
133 struct videobuf_buffer *vb,
134 struct v4l2_framebuffer *fbuf)
135{
136 int pages;
137
138 struct videbuf_vmalloc_memory *mem=vb->priv;
139
140
141 BUG_ON(!mem);
142
143 MAGIC_CHECK(mem->magic,MAGIC_VMAL_MEM);
144
87b9ad07
MCC
145 pages = PAGE_ALIGN(vb->size) >> PAGE_SHIFT;
146
147 /* Currently, doesn't support V4L2_MEMORY_OVERLAY */
148 if ((vb->memory != V4L2_MEMORY_MMAP) &&
149 (vb->memory != V4L2_MEMORY_USERPTR) ) {
150 printk(KERN_ERR "Method currently unsupported.\n");
151 return -EINVAL;
152 }
153
154 /* FIXME: should be tested with kernel mmap mem */
155 mem->vmalloc=vmalloc_user (PAGE_ALIGN(vb->size));
156 if (NULL == mem->vmalloc) {
e78dcf55 157 printk(KERN_ERR "vmalloc (%d pages) failed\n",pages);
87b9ad07
MCC
158 return -ENOMEM;
159 }
160
161 dprintk(1,"vmalloc is at addr 0x%08lx, size=%d\n",
162 (unsigned long)mem->vmalloc,
163 pages << PAGE_SHIFT);
164
165 /* It seems that some kernel versions need to do remap *after*
166 the mmap() call
167 */
168 if (mem->vma) {
169 int retval=remap_vmalloc_range(mem->vma, mem->vmalloc,0);
170 kfree(mem->vma);
171 mem->vma=NULL;
172 if (retval<0) {
173 dprintk(1,"mmap app bug: remap_vmalloc_range area %p error %d\n",
174 mem->vmalloc,retval);
175 return retval;
176 }
177 }
178
179 return 0;
180}
181
182static int __videobuf_sync(struct videobuf_queue *q,
183 struct videobuf_buffer *buf)
184{
185 return 0;
186}
187
188static int __videobuf_mmap_free(struct videobuf_queue *q)
189{
190 unsigned int i;
191
192 for (i = 0; i < VIDEO_MAX_FRAME; i++) {
193 if (q->bufs[i]) {
194 struct videbuf_vmalloc_memory *mem=q->bufs[i]->priv;
195 if (mem && mem->map)
196 return -EBUSY;
197 }
198 }
199
200 return 0;
201}
202
203static int __videobuf_mmap_mapper(struct videobuf_queue *q,
204 struct vm_area_struct *vma)
205{
206 struct videbuf_vmalloc_memory *mem;
207 struct videobuf_mapping *map;
208 unsigned int first;
209 int retval;
210 unsigned long offset = vma->vm_pgoff << PAGE_SHIFT;
211
212 if (! (vma->vm_flags & VM_WRITE) || ! (vma->vm_flags & VM_SHARED))
213 return -EINVAL;
214
215 /* look for first buffer to map */
216 for (first = 0; first < VIDEO_MAX_FRAME; first++) {
217 if (NULL == q->bufs[first])
218 continue;
219
220 if (V4L2_MEMORY_MMAP != q->bufs[first]->memory)
221 continue;
222 if (q->bufs[first]->boff == offset)
223 break;
224 }
225 if (VIDEO_MAX_FRAME == first) {
226 dprintk(1,"mmap app bug: offset invalid [offset=0x%lx]\n",
227 (vma->vm_pgoff << PAGE_SHIFT));
228 return -EINVAL;
229 }
230 mem=q->bufs[first]->priv;
231 BUG_ON (!mem);
232 MAGIC_CHECK(mem->magic,MAGIC_VMAL_MEM);
233
234 /* create mapping + update buffer list */
235 map = mem->map = kmalloc(sizeof(struct videobuf_mapping),GFP_KERNEL);
236 if (NULL == map)
237 return -ENOMEM;
238
239 map->start = vma->vm_start;
240 map->end = vma->vm_end;
241 map->q = q;
242
243 q->bufs[first]->baddr = vma->vm_start;
244
245 vma->vm_ops = &videobuf_vm_ops;
246 vma->vm_flags |= VM_DONTEXPAND | VM_RESERVED;
247 vma->vm_private_data = map;
248
249 /* Try to remap memory */
250 retval=remap_vmalloc_range(vma, mem->vmalloc,0);
251 if (retval<0) {
252 dprintk(1,"mmap: postponing remap_vmalloc_range\n");
253 mem->vma=kmalloc(sizeof(*vma),GFP_KERNEL);
254 if (!mem->vma) {
255 kfree(map);
256 mem->map=NULL;
257 return -ENOMEM;
258 }
259 memcpy(mem->vma,vma,sizeof(*vma));
260 }
261
262 dprintk(1,"mmap %p: q=%p %08lx-%08lx (%lx) pgoff %08lx buf %d\n",
263 map,q,vma->vm_start,vma->vm_end,
264 (long int) q->bufs[first]->bsize,
265 vma->vm_pgoff,first);
266
267 videobuf_vm_open(vma);
268
269 return (0);
270}
271
272static int __videobuf_is_mmapped (struct videobuf_buffer *buf)
273{
274 struct videbuf_vmalloc_memory *mem=buf->priv;
275 BUG_ON (!mem);
276 MAGIC_CHECK(mem->magic,MAGIC_VMAL_MEM);
277
278 return (mem->map)?1:0;
279}
280
281static int __videobuf_copy_to_user ( struct videobuf_queue *q,
282 char __user *data, size_t count,
283 int nonblocking )
284{
285 struct videbuf_vmalloc_memory *mem=q->read_buf->priv;
286 BUG_ON (!mem);
287 MAGIC_CHECK(mem->magic,MAGIC_VMAL_MEM);
288
289 BUG_ON (!mem->vmalloc);
290
291 /* copy to userspace */
292 if (count > q->read_buf->size - q->read_off)
293 count = q->read_buf->size - q->read_off;
294
295 if (copy_to_user(data, mem->vmalloc+q->read_off, count))
296 return -EFAULT;
297
298 return count;
299}
300
301static int __videobuf_copy_stream ( struct videobuf_queue *q,
302 char __user *data, size_t count, size_t pos,
303 int vbihack, int nonblocking )
304{
305 unsigned int *fc;
306 struct videbuf_vmalloc_memory *mem=q->read_buf->priv;
307 BUG_ON (!mem);
308 MAGIC_CHECK(mem->magic,MAGIC_VMAL_MEM);
309
310 if (vbihack) {
311 /* dirty, undocumented hack -- pass the frame counter
312 * within the last four bytes of each vbi data block.
313 * We need that one to maintain backward compatibility
314 * to all vbi decoding software out there ... */
315 fc = (unsigned int*)mem->vmalloc;
316 fc += (q->read_buf->size>>2) -1;
317 *fc = q->read_buf->field_count >> 1;
318 dprintk(1,"vbihack: %d\n",*fc);
319 }
320
321 /* copy stuff using the common method */
322 count = __videobuf_copy_to_user (q,data,count,nonblocking);
323
324 if ( (count==-EFAULT) && (0 == pos) )
325 return -EFAULT;
326
327 return count;
328}
329
330static struct videobuf_qtype_ops qops = {
331 .magic = MAGIC_QTYPE_OPS,
332
333 .alloc = __videobuf_alloc,
334 .iolock = __videobuf_iolock,
335 .sync = __videobuf_sync,
336 .mmap_free = __videobuf_mmap_free,
337 .mmap_mapper = __videobuf_mmap_mapper,
338 .is_mmapped = __videobuf_is_mmapped,
339 .copy_to_user = __videobuf_copy_to_user,
340 .copy_stream = __videobuf_copy_stream,
341};
342
343void videobuf_queue_vmalloc_init(struct videobuf_queue* q,
344 struct videobuf_queue_ops *ops,
345 void *dev,
346 spinlock_t *irqlock,
347 enum v4l2_buf_type type,
348 enum v4l2_field field,
349 unsigned int msize,
350 void *priv)
351{
352 videobuf_queue_init(q, ops, dev, irqlock, type, field, msize, priv);
353 q->int_ops=&qops;
354}
355
356EXPORT_SYMBOL_GPL(videobuf_queue_vmalloc_init);
357
358void *videobuf_to_vmalloc (struct videobuf_buffer *buf)
359{
360 struct videbuf_vmalloc_memory *mem=buf->priv;
361 BUG_ON (!mem);
362 MAGIC_CHECK(mem->magic,MAGIC_VMAL_MEM);
363
364 return mem->vmalloc;
365}
366EXPORT_SYMBOL_GPL(videobuf_to_vmalloc);
367
368void videobuf_vmalloc_free (struct videobuf_buffer *buf)
369{
370 struct videbuf_vmalloc_memory *mem=buf->priv;
371 BUG_ON (!mem);
372
373 MAGIC_CHECK(mem->magic,MAGIC_VMAL_MEM);
374
375 vfree(mem->vmalloc);
c520a497 376 mem->vmalloc=NULL;
87b9ad07
MCC
377
378 return;
379}
380EXPORT_SYMBOL_GPL(videobuf_vmalloc_free);
381
382/*
383 * Local variables:
384 * c-basic-offset: 8
385 * End:
386 */