From cf8ce0888acf34afb5705faf1b6cb8d2f2945402 Mon Sep 17 00:00:00 2001
From: Thomas Hellstrom <unichrome@shipmail.org>
Date: Thu, 20 Oct 2005 17:37:32 +0000
Subject: via: PCI DMA bugfixes and DOS due to too many mapped pages checks.

---
 linux-core/via_dmablit.c | 17 +++++++++++++++--
 shared-core/via_drv.h    |  2 +-
 2 files changed, 16 insertions(+), 3 deletions(-)

diff --git a/linux-core/via_dmablit.c b/linux-core/via_dmablit.c
index b6e3e4f5..6e04cb57 100644
--- a/linux-core/via_dmablit.c
+++ b/linux-core/via_dmablit.c
@@ -74,7 +74,7 @@ via_unmap_blit_from_device(struct pci_dev *pdev, drm_via_sg_info_t *vsg)
 			desc_ptr = vsg->desc_pages[cur_descriptor_page] + 
 				descriptor_this_page;
 		}
-		dma_unmap_single(&pdev->dev, next, sizeof(*desc_ptr), DMA_FROM_DEVICE);
+		dma_unmap_single(&pdev->dev, next, sizeof(*desc_ptr), DMA_TO_DEVICE);
 		dma_unmap_page(&pdev->dev, desc_ptr->mem_addr, desc_ptr->size, vsg->direction);
 		next = (dma_addr_t) desc_ptr->next;
 		desc_ptr--;
@@ -595,11 +595,17 @@ via_build_sg_info(drm_device_t *dev, drm_via_sg_info_t *vsg, drm_via_dmablit_t *
 	 * (Not a big limitation anyway.)
 	 */
 
-	if ((xfer->mem_stride - xfer->line_length) >= PAGE_SIZE) {
+	if (((xfer->mem_stride - xfer->line_length) >= PAGE_SIZE) ||
+	    (xfer->mem_stride > 2048)) {
 		DRM_ERROR("Too large system memory stride.\n");
 		return DRM_ERR(EINVAL);
 	}
 
+	if (xfer->num_lines > 2048) {
+		DRM_ERROR("Too many PCI DMA bitblt lines.\n");
+		return DRM_ERR(EINVAL);
+	}		
+
 	/* 
 	 * we allow a negative fb stride to allow flipping of images in
 	 * transfer. 
@@ -617,11 +623,18 @@ via_build_sg_info(drm_device_t *dev, drm_via_sg_info_t *vsg, drm_via_dmablit_t *
 	 * about this. Meanwhile, impose the following restrictions:
 	 */
 
+#ifdef VIA_BUGFREE
 	if ((((unsigned long)xfer->mem_addr & 3) != ((unsigned long)xfer->fb_addr & 3)) ||
 	    ((xfer->mem_stride & 3) != (xfer->fb_stride & 3))) {
 		DRM_ERROR("Invalid DRM bitblt alignment.\n");
 	        return DRM_ERR(EINVAL);
 	}
+#else
+	if ((((unsigned long)xfer->mem_addr & 15) || ((unsigned long)xfer->fb_addr & 15))) {
+		DRM_ERROR("Invalid DRM bitblt alignment.\n");
+	        return DRM_ERR(EINVAL);
+	}	
+#endif
 
 	if (0 != (ret = via_lock_all_dma_pages(vsg, xfer))) {
 		DRM_ERROR("Could not lock DMA pages.\n");
diff --git a/shared-core/via_drv.h b/shared-core/via_drv.h
index 9e4f303a..fd884223 100644
--- a/shared-core/via_drv.h
+++ b/shared-core/via_drv.h
@@ -32,7 +32,7 @@
 
 #define DRIVER_MAJOR		2
 #define DRIVER_MINOR		7
-#define DRIVER_PATCHLEVEL	0
+#define DRIVER_PATCHLEVEL	1
 
 #include "via_verifier.h"
 
-- 
cgit v1.2.3