[PATCH] firmware/dcdbas: add size check in smi_data_write
[linux-2.6] / drivers / video / cg3.c
1 /* cg3.c: CGTHREE frame buffer driver
2  *
3  * Copyright (C) 2003, 2006 David S. Miller (davem@davemloft.net)
4  * Copyright (C) 1996,1998 Jakub Jelinek (jj@ultra.linux.cz)
5  * Copyright (C) 1996 Miguel de Icaza (miguel@nuclecu.unam.mx)
6  * Copyright (C) 1997 Eddie C. Dost (ecd@skynet.be)
7  *
8  * Driver layout based loosely on tgafb.c, see that file for credits.
9  */
10
11 #include <linux/module.h>
12 #include <linux/kernel.h>
13 #include <linux/errno.h>
14 #include <linux/string.h>
15 #include <linux/slab.h>
16 #include <linux/delay.h>
17 #include <linux/init.h>
18 #include <linux/fb.h>
19 #include <linux/mm.h>
20
21 #include <asm/io.h>
22 #include <asm/oplib.h>
23 #include <asm/prom.h>
24 #include <asm/of_device.h>
25 #include <asm/fbio.h>
26
27 #include "sbuslib.h"
28
29 /*
30  * Local functions.
31  */
32
33 static int cg3_setcolreg(unsigned, unsigned, unsigned, unsigned,
34                          unsigned, struct fb_info *);
35 static int cg3_blank(int, struct fb_info *);
36
37 static int cg3_mmap(struct fb_info *, struct vm_area_struct *);
38 static int cg3_ioctl(struct fb_info *, unsigned int, unsigned long);
39
40 /*
41  *  Frame buffer operations
42  */
43
44 static struct fb_ops cg3_ops = {
45         .owner                  = THIS_MODULE,
46         .fb_setcolreg           = cg3_setcolreg,
47         .fb_blank               = cg3_blank,
48         .fb_fillrect            = cfb_fillrect,
49         .fb_copyarea            = cfb_copyarea,
50         .fb_imageblit           = cfb_imageblit,
51         .fb_mmap                = cg3_mmap,
52         .fb_ioctl               = cg3_ioctl,
53 #ifdef CONFIG_COMPAT
54         .fb_compat_ioctl        = sbusfb_compat_ioctl,
55 #endif
56 };
57
58
59 /* Control Register Constants */
60 #define CG3_CR_ENABLE_INTS      0x80
61 #define CG3_CR_ENABLE_VIDEO     0x40
62 #define CG3_CR_ENABLE_TIMING    0x20
63 #define CG3_CR_ENABLE_CURCMP    0x10
64 #define CG3_CR_XTAL_MASK        0x0c
65 #define CG3_CR_DIVISOR_MASK     0x03
66
67 /* Status Register Constants */
68 #define CG3_SR_PENDING_INT      0x80
69 #define CG3_SR_RES_MASK         0x70
70 #define CG3_SR_1152_900_76_A    0x40
71 #define CG3_SR_1152_900_76_B    0x60
72 #define CG3_SR_ID_MASK          0x0f
73 #define CG3_SR_ID_COLOR         0x01
74 #define CG3_SR_ID_MONO          0x02
75 #define CG3_SR_ID_MONO_ECL      0x03
76
77 enum cg3_type {
78         CG3_AT_66HZ = 0,
79         CG3_AT_76HZ,
80         CG3_RDI
81 };
82
83 struct bt_regs {
84         u32 addr;
85         u32 color_map;
86         u32 control;
87         u32 cursor;
88 };
89
90 struct cg3_regs {
91         struct bt_regs  cmap;
92         u8      control;
93         u8      status;
94         u8      cursor_start;
95         u8      cursor_end;
96         u8      h_blank_start;
97         u8      h_blank_end;
98         u8      h_sync_start;
99         u8      h_sync_end;
100         u8      comp_sync_end;
101         u8      v_blank_start_high;
102         u8      v_blank_start_low;
103         u8      v_blank_end;
104         u8      v_sync_start;
105         u8      v_sync_end;
106         u8      xfer_holdoff_start;
107         u8      xfer_holdoff_end;
108 };
109
110 /* Offset of interesting structures in the OBIO space */
111 #define CG3_REGS_OFFSET      0x400000UL
112 #define CG3_RAM_OFFSET       0x800000UL
113
114 struct cg3_par {
115         spinlock_t              lock;
116         struct cg3_regs         __iomem *regs;
117         u32                     sw_cmap[((256 * 3) + 3) / 4];
118
119         u32                     flags;
120 #define CG3_FLAG_BLANKED        0x00000001
121 #define CG3_FLAG_RDI            0x00000002
122
123         unsigned long           physbase;
124         unsigned long           which_io;
125         unsigned long           fbsize;
126 };
127
128 /**
129  *      cg3_setcolreg - Optional function. Sets a color register.
130  *      @regno: boolean, 0 copy local, 1 get_user() function
131  *      @red: frame buffer colormap structure
132  *      @green: The green value which can be up to 16 bits wide
133  *      @blue:  The blue value which can be up to 16 bits wide.
134  *      @transp: If supported the alpha value which can be up to 16 bits wide.
135  *      @info: frame buffer info structure
136  *
137  * The cg3 palette is loaded with 4 color values at each time
138  * so you end up with: (rgb)(r), (gb)(rg), (b)(rgb), and so on.
139  * We keep a sw copy of the hw cmap to assist us in this esoteric
140  * loading procedure.
141  */
142 static int cg3_setcolreg(unsigned regno,
143                          unsigned red, unsigned green, unsigned blue,
144                          unsigned transp, struct fb_info *info)
145 {
146         struct cg3_par *par = (struct cg3_par *) info->par;
147         struct bt_regs __iomem *bt = &par->regs->cmap;
148         unsigned long flags;
149         u32 *p32;
150         u8 *p8;
151         int count;
152
153         if (regno >= 256)
154                 return 1;
155
156         red >>= 8;
157         green >>= 8;
158         blue >>= 8;
159
160         spin_lock_irqsave(&par->lock, flags);
161
162         p8 = (u8 *)par->sw_cmap + (regno * 3);
163         p8[0] = red;
164         p8[1] = green;
165         p8[2] = blue;
166
167 #define D4M3(x) ((((x)>>2)<<1) + ((x)>>2))      /* (x/4)*3 */
168 #define D4M4(x) ((x)&~0x3)                      /* (x/4)*4 */
169
170         count = 3;
171         p32 = &par->sw_cmap[D4M3(regno)];
172         sbus_writel(D4M4(regno), &bt->addr);
173         while (count--)
174                 sbus_writel(*p32++, &bt->color_map);
175
176 #undef D4M3
177 #undef D4M4
178
179         spin_unlock_irqrestore(&par->lock, flags);
180
181         return 0;
182 }
183
184 /**
185  *      cg3_blank - Optional function.  Blanks the display.
186  *      @blank_mode: the blank mode we want.
187  *      @info: frame buffer structure that represents a single frame buffer
188  */
189 static int
190 cg3_blank(int blank, struct fb_info *info)
191 {
192         struct cg3_par *par = (struct cg3_par *) info->par;
193         struct cg3_regs __iomem *regs = par->regs;
194         unsigned long flags;
195         u8 val;
196
197         spin_lock_irqsave(&par->lock, flags);
198
199         switch (blank) {
200         case FB_BLANK_UNBLANK: /* Unblanking */
201                 val = sbus_readb(&regs->control);
202                 val |= CG3_CR_ENABLE_VIDEO;
203                 sbus_writeb(val, &regs->control);
204                 par->flags &= ~CG3_FLAG_BLANKED;
205                 break;
206
207         case FB_BLANK_NORMAL: /* Normal blanking */
208         case FB_BLANK_VSYNC_SUSPEND: /* VESA blank (vsync off) */
209         case FB_BLANK_HSYNC_SUSPEND: /* VESA blank (hsync off) */
210         case FB_BLANK_POWERDOWN: /* Poweroff */
211                 val = sbus_readb(&regs->control);
212                 val &= ~CG3_CR_ENABLE_VIDEO;
213                 sbus_writeb(val, &regs->control);
214                 par->flags |= CG3_FLAG_BLANKED;
215                 break;
216         }
217
218         spin_unlock_irqrestore(&par->lock, flags);
219
220         return 0;
221 }
222
223 static struct sbus_mmap_map cg3_mmap_map[] = {
224         {
225                 .voff   = CG3_MMAP_OFFSET,
226                 .poff   = CG3_RAM_OFFSET,
227                 .size   = SBUS_MMAP_FBSIZE(1)
228         },
229         { .size = 0 }
230 };
231
232 static int cg3_mmap(struct fb_info *info, struct vm_area_struct *vma)
233 {
234         struct cg3_par *par = (struct cg3_par *)info->par;
235
236         return sbusfb_mmap_helper(cg3_mmap_map,
237                                   par->physbase, par->fbsize,
238                                   par->which_io,
239                                   vma);
240 }
241
242 static int cg3_ioctl(struct fb_info *info, unsigned int cmd, unsigned long arg)
243 {
244         struct cg3_par *par = (struct cg3_par *) info->par;
245
246         return sbusfb_ioctl_helper(cmd, arg, info,
247                                    FBTYPE_SUN3COLOR, 8, par->fbsize);
248 }
249
250 /*
251  *  Initialisation
252  */
253
254 static void
255 cg3_init_fix(struct fb_info *info, int linebytes, struct device_node *dp)
256 {
257         strlcpy(info->fix.id, dp->name, sizeof(info->fix.id));
258
259         info->fix.type = FB_TYPE_PACKED_PIXELS;
260         info->fix.visual = FB_VISUAL_PSEUDOCOLOR;
261
262         info->fix.line_length = linebytes;
263
264         info->fix.accel = FB_ACCEL_SUN_CGTHREE;
265 }
266
267 static void cg3_rdi_maybe_fixup_var(struct fb_var_screeninfo *var,
268                                     struct device_node *dp)
269 {
270         char *params;
271         char *p;
272         int ww, hh;
273
274         params = of_get_property(dp, "params", NULL);
275         if (params) {
276                 ww = simple_strtoul(params, &p, 10);
277                 if (ww && *p == 'x') {
278                         hh = simple_strtoul(p + 1, &p, 10);
279                         if (hh && *p == '-') {
280                                 if (var->xres != ww ||
281                                     var->yres != hh) {
282                                         var->xres = var->xres_virtual = ww;
283                                         var->yres = var->yres_virtual = hh;
284                                 }
285                         }
286                 }
287         }
288 }
289
290 static u8 cg3regvals_66hz[] __initdata = {      /* 1152 x 900, 66 Hz */
291         0x14, 0xbb,     0x15, 0x2b,     0x16, 0x04,     0x17, 0x14,
292         0x18, 0xae,     0x19, 0x03,     0x1a, 0xa8,     0x1b, 0x24,
293         0x1c, 0x01,     0x1d, 0x05,     0x1e, 0xff,     0x1f, 0x01,
294         0x10, 0x20,     0
295 };
296
297 static u8 cg3regvals_76hz[] __initdata = {      /* 1152 x 900, 76 Hz */
298         0x14, 0xb7,     0x15, 0x27,     0x16, 0x03,     0x17, 0x0f,
299         0x18, 0xae,     0x19, 0x03,     0x1a, 0xae,     0x1b, 0x2a,
300         0x1c, 0x01,     0x1d, 0x09,     0x1e, 0xff,     0x1f, 0x01,
301         0x10, 0x24,     0
302 };
303
304 static u8 cg3regvals_rdi[] __initdata = {       /* 640 x 480, cgRDI */
305         0x14, 0x70,     0x15, 0x20,     0x16, 0x08,     0x17, 0x10,
306         0x18, 0x06,     0x19, 0x02,     0x1a, 0x31,     0x1b, 0x51,
307         0x1c, 0x06,     0x1d, 0x0c,     0x1e, 0xff,     0x1f, 0x01,
308         0x10, 0x22,     0
309 };
310
311 static u8 *cg3_regvals[] __initdata = {
312         cg3regvals_66hz, cg3regvals_76hz, cg3regvals_rdi
313 };
314
315 static u_char cg3_dacvals[] __initdata = {
316         4, 0xff,        5, 0x00,        6, 0x70,        7, 0x00,        0
317 };
318
319 static void cg3_do_default_mode(struct cg3_par *par)
320 {
321         enum cg3_type type;
322         u8 *p;
323
324         if (par->flags & CG3_FLAG_RDI)
325                 type = CG3_RDI;
326         else {
327                 u8 status = sbus_readb(&par->regs->status), mon;
328                 if ((status & CG3_SR_ID_MASK) == CG3_SR_ID_COLOR) {
329                         mon = status & CG3_SR_RES_MASK;
330                         if (mon == CG3_SR_1152_900_76_A ||
331                             mon == CG3_SR_1152_900_76_B)
332                                 type = CG3_AT_76HZ;
333                         else
334                                 type = CG3_AT_66HZ;
335                 } else {
336                         prom_printf("cgthree: can't handle SR %02x\n",
337                                     status);
338                         prom_halt();
339                         return;
340                 }
341         }
342
343         for (p = cg3_regvals[type]; *p; p += 2) {
344                 u8 __iomem *regp = &((u8 __iomem *)par->regs)[p[0]];
345                 sbus_writeb(p[1], regp);
346         }
347         for (p = cg3_dacvals; *p; p += 2) {
348                 u8 __iomem *regp;
349
350                 regp = (u8 __iomem *)&par->regs->cmap.addr;
351                 sbus_writeb(p[0], regp);
352                 regp = (u8 __iomem *)&par->regs->cmap.control;
353                 sbus_writeb(p[1], regp);
354         }
355 }
356
357 struct all_info {
358         struct fb_info info;
359         struct cg3_par par;
360 };
361
362 static int __devinit cg3_init_one(struct of_device *op)
363 {
364         struct device_node *dp = op->node;
365         struct all_info *all;
366         int linebytes, err;
367
368         all = kzalloc(sizeof(*all), GFP_KERNEL);
369         if (!all)
370                 return -ENOMEM;
371
372         spin_lock_init(&all->par.lock);
373
374         all->par.physbase = op->resource[0].start;
375         all->par.which_io = op->resource[0].flags & IORESOURCE_BITS;
376
377         sbusfb_fill_var(&all->info.var, dp->node, 8);
378         all->info.var.red.length = 8;
379         all->info.var.green.length = 8;
380         all->info.var.blue.length = 8;
381         if (!strcmp(dp->name, "cgRDI"))
382                 all->par.flags |= CG3_FLAG_RDI;
383         if (all->par.flags & CG3_FLAG_RDI)
384                 cg3_rdi_maybe_fixup_var(&all->info.var, dp);
385
386         linebytes = of_getintprop_default(dp, "linebytes",
387                                           all->info.var.xres);
388         all->par.fbsize = PAGE_ALIGN(linebytes * all->info.var.yres);
389
390         all->par.regs = of_ioremap(&op->resource[0], CG3_REGS_OFFSET,
391                                    sizeof(struct cg3_regs), "cg3 regs");
392
393         all->info.flags = FBINFO_DEFAULT;
394         all->info.fbops = &cg3_ops;
395         all->info.screen_base =
396                 of_ioremap(&op->resource[0], CG3_RAM_OFFSET,
397                            all->par.fbsize, "cg3 ram");
398         all->info.par = &all->par;
399
400         cg3_blank(0, &all->info);
401
402         if (!of_find_property(dp, "width", NULL))
403                 cg3_do_default_mode(&all->par);
404
405         if (fb_alloc_cmap(&all->info.cmap, 256, 0)) {
406                 of_iounmap(all->par.regs, sizeof(struct cg3_regs));
407                 of_iounmap(all->info.screen_base, all->par.fbsize);
408                 kfree(all);
409                 return -ENOMEM;
410         }
411         fb_set_cmap(&all->info.cmap, &all->info);
412
413         cg3_init_fix(&all->info, linebytes, dp);
414
415         err = register_framebuffer(&all->info);
416         if (err < 0) {
417                 fb_dealloc_cmap(&all->info.cmap);
418                 of_iounmap(all->par.regs, sizeof(struct cg3_regs));
419                 of_iounmap(all->info.screen_base, all->par.fbsize);
420                 kfree(all);
421                 return err;
422         }
423
424         dev_set_drvdata(&op->dev, all);
425
426         printk("%s: cg3 at %lx:%lx\n",
427                dp->full_name, all->par.which_io, all->par.physbase);
428
429         return 0;
430 }
431
432 static int __devinit cg3_probe(struct of_device *dev, const struct of_device_id *match)
433 {
434         struct of_device *op = to_of_device(&dev->dev);
435
436         return cg3_init_one(op);
437 }
438
439 static int __devexit cg3_remove(struct of_device *dev)
440 {
441         struct all_info *all = dev_get_drvdata(&dev->dev);
442
443         unregister_framebuffer(&all->info);
444         fb_dealloc_cmap(&all->info.cmap);
445
446         of_iounmap(all->par.regs, sizeof(struct cg3_regs));
447         of_iounmap(all->info.screen_base, all->par.fbsize);
448
449         kfree(all);
450
451         dev_set_drvdata(&dev->dev, NULL);
452
453         return 0;
454 }
455
456 static struct of_device_id cg3_match[] = {
457         {
458                 .name = "cgthree",
459         },
460         {
461                 .name = "cgRDI",
462         },
463         {},
464 };
465 MODULE_DEVICE_TABLE(of, cg3_match);
466
467 static struct of_platform_driver cg3_driver = {
468         .name           = "cg3",
469         .match_table    = cg3_match,
470         .probe          = cg3_probe,
471         .remove         = __devexit_p(cg3_remove),
472 };
473
474 static int __init cg3_init(void)
475 {
476         if (fb_get_options("cg3fb", NULL))
477                 return -ENODEV;
478
479         return of_register_driver(&cg3_driver, &of_bus_type);
480 }
481
482 static void __exit cg3_exit(void)
483 {
484         of_unregister_driver(&cg3_driver);
485 }
486
487 module_init(cg3_init);
488 module_exit(cg3_exit);
489
490 MODULE_DESCRIPTION("framebuffer driver for CGthree chipsets");
491 MODULE_AUTHOR("David S. Miller <davem@davemloft.net>");
492 MODULE_VERSION("2.0");
493 MODULE_LICENSE("GPL");