4 files changed, 37 insertions, 32 deletions

diff --git a/linux-core/drmP.h b/linux-core/drmP.h
index 07f3571b..af082ad7 100644
--- a/linux-core/drmP.h
+++ b/linux-core/drmP.h
@@ -952,9 +952,9 @@ typedef struct drm_buffer_object{
 	drm_ttm_object_t *ttm_object;
 	drm_ttm_backend_list_t *ttm_region;
         void __user *user_pages;
+	unsigned long num_pages;
 
 	atomic_t mapped;
-
 	uint32_t flags;
 	uint32_t mask;
 	uint32_t mask_hint;
@@ -1360,32 +1360,6 @@ extern int drm_fence_ioctl(DRM_IOCTL_ARGS);
 
 extern int drm_bo_ioctl(DRM_IOCTL_ARGS);
 
-/*
- * Convenience drm_u64_t functions
- */
-
-static __inline__ unsigned long drm_ul(drm_u64_t val)
-{
-	unsigned long ret = val.lo;
-#if (BITS_PER_LONG == 64)
-		ret |= (val.hi << 32);
-#endif
-	return ret;
-}
-
-static __inline__ drm_u64_t drm_u64(unsigned long val)
-{
-	drm_u64_t ret;
-
-	ret.lo = val & 0xFFFFFFFFUL;
-#if (BITS_PER_LONG == 64)
-	ret.hi = val >> 32;
-#else 
-	ret.hi = 0;
-#endif
-	return ret;
-}
-
 
 /* Inline replacements for DRM_IOREMAP macros */
 static __inline__ void drm_core_ioremap(struct drm_map *map,
diff --git a/linux-core/drm_bo.c b/linux-core/drm_bo.c
index 7f5088fb..23634955 100644
--- a/linux-core/drm_bo.c
+++ b/linux-core/drm_bo.c
@@ -531,6 +531,7 @@ static int drm_buffer_object_validate(drm_device_t *dev, drm_buffer_object_t *bo
 	return 0;
 }
 
+
 int drm_buffer_object_create(drm_file_t *priv,
 			     int size,
 			     drm_bo_type_t type,
@@ -544,6 +545,7 @@ int drm_buffer_object_create(drm_file_t *priv,
 	drm_buffer_object_t *bo;
 	int ret = 0;
 	uint32_t ttm_flags = 0;
+	drm_ttm_t *ttm;
 
 	bo = drm_calloc(1, sizeof(*bo), DRM_MEM_BUFOBJ);
 
@@ -567,11 +569,35 @@ int drm_buffer_object_create(drm_file_t *priv,
 			goto out_err;
 		break;
 	case drm_bo_type_ttm:
+		if (buffer_start & ~PAGE_MASK) {
+			DRM_ERROR("Illegal buffer object start\n");
+			ret = -EINVAL;
+		}
+		bo->num_pages = (size + PAGE_SIZE - 1) >> PAGE_SHIFT;
+		if (!bo->num_pages) {
+			DRM_ERROR("Illegal buffer object size\n");
+			ret = -EINVAL;
+			goto out_err;
+		}			
 		bo->ttm_object = drm_lookup_ttm_object(priv, ttm_handle, 1);
+		if (!bo->ttm_object) {
+			DRM_ERROR("Could not find buffer object TTM\n");
+			ret = -EINVAL;
+			goto out_err;
+		}
+		ttm = drm_ttm_from_object(bo->ttm_object);
+		ret = drm_create_ttm_region(ttm, buffer_start >> PAGE_SHIFT,
+					    bo->num_pages, 0, &bo->ttm_region);
 		if (ret) 
 			goto out_err;
 		break;
 	case drm_bo_type_user:
+		if (buffer_start & ~PAGE_MASK) {
+			DRM_ERROR("Illegal buffer object start\n");
+			ret = -EINVAL;
+			goto out_err;
+		}
+		bo->num_pages = (size + PAGE_SIZE - 1) >> PAGE_SHIFT; 
 		bo->user_pages = (void __user *)buffer_start;
 		break;
 	default:
@@ -635,8 +661,8 @@ int drm_bo_ioctl(DRM_IOCTL_ARGS)
 		rep.handled = 0;
 		switch (req->op) {
 		case drm_bo_create: {
-			unsigned long buffer_start = drm_ul(req->buffer_start);
-			rep.ret = drm_buffer_object_create(priv, drm_ul(req->size),
+			unsigned long buffer_start = req->buffer_start;
+			rep.ret = drm_buffer_object_create(priv, req->size,
 							   req->type, req->arg_handle,
 							   req->mask, req->hint,
 							   buffer_start,
@@ -687,7 +713,7 @@ int drm_bo_ioctl(DRM_IOCTL_ARGS)
 		default:
 			rep.ret = -EINVAL;
 		}
-		next = drm_ul(req->next);
+		next = req->next;
 		rep.handled = 1;
 		arg.rep = rep;
 		DRM_COPY_TO_USER_IOCTL((void __user *)data, arg, sizeof(arg));
diff --git a/linux-core/drm_ttm.c b/linux-core/drm_ttm.c
index cda3ec29..8cd0af61 100644
--- a/linux-core/drm_ttm.c
+++ b/linux-core/drm_ttm.c
@@ -888,7 +888,7 @@ int drm_ttm_ioctl(DRM_IOCTL_ARGS)
 	switch(arg.op) {
 	case drm_ttm_create:
 		mutex_lock(&dev->struct_mutex);
-		size = drm_ul(arg.size);
+		size = arg.size;
 		ret = drm_ttm_object_create(dev, size, arg.flags, &entry);
 		if (ret) {
 			mutex_unlock(&dev->struct_mutex);
@@ -929,7 +929,7 @@ int drm_ttm_ioctl(DRM_IOCTL_ARGS)
 	}
 	arg.handle = entry->base.hash.key;
 	arg.user_token = entry->map_list.user_token;
-	arg.size = drm_u64(entry->map_list.map->size);
+	arg.size = entry->map_list.map->size;
 	drm_ttm_object_deref_locked(dev, entry);
 	mutex_unlock(&dev->struct_mutex);
 
diff --git a/linux-core/drm_ttm.h b/linux-core/drm_ttm.h
index a87cf53e..ba4261bf 100644
--- a/linux-core/drm_ttm.h
+++ b/linux-core/drm_ttm.h
@@ -165,6 +165,11 @@ extern int drm_ttm_add_mm_to_list(drm_ttm_t * ttm, struct mm_struct *mm);
 extern void drm_ttm_delete_mm(drm_ttm_t * ttm, struct mm_struct *mm);
 extern int drm_ttm_ioctl(DRM_IOCTL_ARGS);
 
+static __inline__ drm_ttm_t *drm_ttm_from_object(drm_ttm_object_t *to)
+{
+	return (drm_ttm_t *) to->map_list.map->offset;
+}
+
 #define DRM_MASK_VAL(dest, mask, val)			\
   (dest) = ((dest) & ~(mask)) | ((val) & (mask));