Remove drm_linux.h, move the two useful defines into drm_drv.h. Use fd locking

on -current.  Actually copy in data from userspace to kernel in the
linux-compat ioctl path.  Make sure ioctl sizes are as expected in the handler
functions.

Reviewed by:	rwatson

3 files changed, 73 insertions, 167 deletions

diff --git a/sys/dev/drm/drm_drv.h b/sys/dev/drm/drm_drv.h
index cb50e1e..ff034dd 100644
--- a/sys/dev/drm/drm_drv.h
+++ b/sys/dev/drm/drm_drv.h
@@ -138,7 +138,6 @@ static struct file_operations	DRM(fops) = {	\
 #include <sys/proc.h>
 #include <machine/../linux/linux.h>
 #include <machine/../linux/linux_proto.h>
-#include "dev/drm/drm_linux.h"
 #endif
 #endif /* __FreeBSD__ */
 #endif
@@ -1416,34 +1415,84 @@ int DRM(unlock)( DRM_OS_IOCTL )
 	return 0;
 }
 
-#ifdef __FreeBSD__
 #if DRM_LINUX
+#define LINUX_IOCTL_DRM_MIN		0x6400
+#define LINUX_IOCTL_DRM_MAX		0x64ff
+
 static linux_ioctl_function_t DRM( linux_ioctl);
 static struct linux_ioctl_handler DRM( handler) = {DRM( linux_ioctl), LINUX_IOCTL_DRM_MIN, LINUX_IOCTL_DRM_MAX};
 SYSINIT  (DRM( register),   SI_SUB_KLD, SI_ORDER_MIDDLE, linux_ioctl_register_handler, &DRM( handler));
 SYSUNINIT(DRM( unregister), SI_SUB_KLD, SI_ORDER_MIDDLE, linux_ioctl_unregister_handler, &DRM( handler));
 
+#define LINUX_IOC_VOID	IOC_VOID
+#define LINUX_IOC_IN	IOC_OUT		/* Linux has the values the other way around */
+#define LINUX_IOC_OUT	IOC_IN
+
 /*
  * Linux emulation IOCTL
  */
 static int
 DRM(linux_ioctl)(DRM_OS_STRUCTPROC *p, struct linux_ioctl_args* args)
 {
+	u_long		cmd = args->cmd;
+#define STK_PARAMS	128
+	union {
+	    char stkbuf[STK_PARAMS];
+	    long align;
+	} ubuf;
+	caddr_t		data=NULL, memp=NULL;
+	u_int		size = IOCPARM_LEN(cmd);
+	int		error;
 #if (__FreeBSD_version >= 500000)
-    struct file		*fp = p->td_proc->p_fd->fd_ofiles[args->fd];
+	struct file	*fp;
 #else
-    struct file		*fp = p->p_fd->fd_ofiles[args->fd];
+	struct file	*fp = p->p_fd->fd_ofiles[args->fd];
 #endif
-    u_long		cmd = args->cmd;
-    caddr_t             data = (caddr_t) args->arg;
-    /*
-     * Pass the ioctl off to our standard handler.
-     */
+	if ( size > STK_PARAMS ) {
+		if ( size > IOCPARM_MAX )
+			return EINVAL;
+		memp = malloc( (u_long)size, DRM(M_DRM), M_WAITOK );
+		data = memp;
+	} else {
+		data = ubuf.stkbuf;
+	}
+
+	if ( cmd & LINUX_IOC_IN ) {
+		if ( size ) {
+			error = copyin( (caddr_t)args->arg, data, (u_int)size );
+			if (error) {
+				if ( memp )
+					free( data, DRM(M_DRM) );
+				return error;
+			}
+		} else {
+			data = (caddr_t)args->arg;
+		}
+	} else if ( (cmd & LINUX_IOC_OUT) && size ) {
+		/*
+		 * Zero the buffer so the user always
+		 * gets back something deterministic.
+		 */
+		bzero( data, size );
+	} else if ( cmd & LINUX_IOC_VOID ) {
+		*(caddr_t *)data = (caddr_t)args->arg;
+	}
+
 #if (__FreeBSD_version >= 500000)
-    return(fo_ioctl(fp, cmd, data, p->td_ucred, p));
+	if ( (error = fget( p, args->fd, &fp )) != 0 ) {
+		if ( memp )
+			free( memp, DRM(M_DRM) );
+		return (error);
+	}
+	error = fo_ioctl( fp, cmd, data, p->td_ucred, p );
+	fdrop( fp, p );
 #else
-    return(fo_ioctl(fp, cmd, data, p));
+	error = fo_ioctl( fp, cmd, data, p );
 #endif
+	if ( error == 0 && (cmd & LINUX_IOC_OUT) && size )
+		error = copyout( data, (caddr_t)args->arg, (u_int)size );
+	if ( memp )
+		free( memp, DRM(M_DRM) );
+	return error;
 }
 #endif /* DRM_LINUX */
-#endif /* __FreeBSD__ */
diff --git a/sys/dev/drm/drm_linux.h b/sys/dev/drm/drm_linux.h
deleted file mode 100644
index 2f712cf..0000000
--- a/sys/dev/drm/drm_linux.h
+++ /dev/null
@@ -1,147 +0,0 @@
-/*
- * Copyright (c) 2000 by Coleman Kane <cokane@FreeBSD.org>
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *      This product includes software developed by Gardner Buchanan.
- * 4. The name of Gardner Buchanan may not be used to endorse or promote
- *    products derived from this software without specific prior written
- *    permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- *
- * $FreeBSD$
- */
-
-/* FIXME: There are IOCTLS to merge in here, see drm.h*/
-
-/* Query IOCTLs */
-/* XFree86 4.1.x DRI support */
-
-#define LINUX_DRM_IOCTL_VERSION		0x6400
-#define LINUX_DRM_IOCTL_GET_UNIQUE	0x6401
-#define LINUX_DRM_IOCTL_GET_MAGIC	0x6402
-#define LINUX_DRM_IOCTL_IRQ_BUSID	0x6403
-#define LINUX_DRM_IOCTL_GET_MAP		0x6404
-#define LINUX_DRM_IOCTL_GET_CLIENT	0x6405
-#define LINUX_DRM_IOCTL_GET_STATS	0x6406
-
-#define LINUX_DRM_IOCTL_SET_UNIQUE	0x6410
-#define LINUX_DRM_IOCTL_AUTH_MAGIC	0x6411
-#define LINUX_DRM_IOCTL_BLOCK		0x6412
-#define LINUX_DRM_IOCTL_UNBLOCK		0x6413
-#define LINUX_DRM_IOCTL_CONTROL		0x6414
-#define LINUX_DRM_IOCTL_ADD_MAP		0x6415
-#define LINUX_DRM_IOCTL_ADD_BUFS	0x6416
-#define LINUX_DRM_IOCTL_MARK_BUFS	0x6417
-#define LINUX_DRM_IOCTL_INFO_BUFS	0x6418
-#define LINUX_DRM_IOCTL_MAP_BUFS	0x6419
-#define LINUX_DRM_IOCTL_FREE_BUFS	0x641a
-
-#define LINUX_DRM_IOCTL_RM_MAP		0x641b
-
-#define LINUX_DRM_IOCTL_SET_SAREA_CTX	0x641c
-#define LINUX_DRM_IOCTL_GET_SAREA_CTX 	0x641d
-
-#define LINUX_DRM_IOCTL_ADD_CTX		0x6420
-#define LINUX_DRM_IOCTL_RM_CTX		0x6421
-#define LINUX_DRM_IOCTL_MOD_CTX		0x6422
-#define LINUX_DRM_IOCTL_GET_CTX		0x6423
-#define LINUX_DRM_IOCTL_SWITCH_CTX	0x6424
-#define LINUX_DRM_IOCTL_NEW_CTX		0x6425
-#define LINUX_DRM_IOCTL_RES_CTX		0x6426
-#define LINUX_DRM_IOCTL_ADD_DRAW	0x6427
-#define LINUX_DRM_IOCTL_RM_DRAW		0x6428
-#define LINUX_DRM_IOCTL_DMA		0x6429
-#define LINUX_DRM_IOCTL_LOCK		0x642a
-#define LINUX_DRM_IOCTL_UNLOCK		0x642b
-#define LINUX_DRM_IOCTL_FINISH		0x642c
-
-#define LINUX_DRM_IOCTL_AGP_ACQUIRE	0x6430
-#define LINUX_DRM_IOCTL_AGP_RELEASE	0x6431
-#define LINUX_DRM_IOCTL_AGP_ENABLE	0x6432
-#define LINUX_DRM_IOCTL_AGP_INFO	0x6433
-#define LINUX_DRM_IOCTL_AGP_ALLOC	0x6434
-#define LINUX_DRM_IOCTL_AGP_FREE	0x6435
-#define LINUX_DRM_IOCTL_AGP_BIND	0x6436
-#define LINUX_DRM_IOCTL_AGP_UNBIND	0x6437
-
-#define LINUX_DRM_IOCTL_SG_ALLOC	0x6438
-#define LINUX_DRM_IOCTL_SG_FREE		0x6439
-
-/* MGA specific ioctls */
-#define LINUX_DRM_IOCTL_MGA_INIT	0x6440
-#define LINUX_DRM_IOCTL_MGA_FLUSH	0x6441
-#define LINUX_DRM_IOCTL_MGA_RESET	0x6442
-#define LINUX_DRM_IOCTL_MGA_SWAP	0x6443
-#define LINUX_DRM_IOCTL_MGA_CLEAR	0x6444
-#define LINUX_DRM_IOCTL_MGA_VERTEX	0x6445
-#define LINUX_DRM_IOCTL_MGA_INDICES	0x6446
-#define LINUX_DRM_IOCTL_MGA_ILOAD	0x6447
-#define LINUX_DRM_IOCTL_MGA_BLIT	0x6448
-
-/* i810 specific ioctls */
-#define LINUX_DRM_IOCTL_I810_INIT	0x6440
-#define LINUX_DRM_IOCTL_I810_VERTEX	0x6441
-#define LINUX_DRM_IOCTL_I810_CLEAR	0x6442
-#define LINUX_DRM_IOCTL_I810_FLUSH	0x6443
-#define LINUX_DRM_IOCTL_I810_GETAGE	0x6444
-#define LINUX_DRM_IOCTL_I810_GETBUF	0x6445
-#define LINUX_DRM_IOCTL_I810_SWAP	0x6446
-#define LINUX_DRM_IOCTL_I810_COPY	0x6447
-#define LINUX_DRM_IOCTL_I810_DOCOPY	0x6448
-
-/* Rage 128 specific ioctls */
-#define LINUX_DRM_IOCTL_R128_INIT	0x6440
-#define LINUX_DRM_IOCTL_R128_CCE_START	0x6441
-#define LINUX_DRM_IOCTL_R128_CCE_STOP	0x6442
-#define LINUX_DRM_IOCTL_R128_CCE_RESET	0x6443
-#define LINUX_DRM_IOCTL_R128_CCE_IDLE	0x6444
-#define LINUX_DRM_IOCTL_R128_RESET	0x6446
-#define LINUX_DRM_IOCTL_R128_SWAP	0x6447
-#define LINUX_DRM_IOCTL_R128_CLEAR	0x6448
-#define LINUX_DRM_IOCTL_R128_VERTEX	0x6449
-#define LINUX_DRM_IOCTL_R128_INDICES	0x644a
-#define LINUX_DRM_IOCTL_R128_BLIT	0x644b
-#define LINUX_DRM_IOCTL_R128_DEPTH	0x644c
-#define LINUX_DRM_IOCTL_R128_STIPPLE	0x644d
-#define LINUX_DRM_IOCTL_R128_INDIRECT	0x644f
-#define LINUX_DRM_IOCTL_R128_FULLSCREEN	0x6450
-
-/* Radeon specific ioctls */
-#define LINUX_DRM_IOCTL_RADEON_CP_INIT	0x6440
-#define LINUX_DRM_IOCTL_RADEON_CP_START	0x6441
-#define LINUX_DRM_IOCTL_RADEON_CP_STOP	0x6442
-#define LINUX_DRM_IOCTL_RADEON_CP_RESET	0x6443
-#define LINUX_DRM_IOCTL_RADEON_CP_IDLE	0x6444
-#define LINUX_DRM_IOCTL_RADEON_RESET	0x6445
-#define LINUX_DRM_IOCTL_RADEON_FULLSCREEN	0x6446
-#define LINUX_DRM_IOCTL_RADEON_SWAP	0x6447
-#define LINUX_DRM_IOCTL_RADEON_CLEAR	0x6448
-#define LINUX_DRM_IOCTL_RADEON_VERTEX	0x6449
-#define LINUX_DRM_IOCTL_RADEON_INDICES	0x644a
-#define LINUX_DRM_IOCTL_RADEON_STIPPLE	0x644c
-#define LINUX_DRM_IOCTL_RADEON_INDIRECT	0x644d
-#define LINUX_DRM_IOCTL_RADEON_TEXTURE	0x644e
-
-/* card specific ioctls may increase the DRM_MAX */
-#define  LINUX_IOCTL_DRM_MIN		LINUX_DRM_IOCTL_VERSION
-#define  LINUX_IOCTL_DRM_MAX		LINUX_DRM_IOCTL_R128_FULLSCREEN
diff --git a/sys/dev/drm/drm_os_freebsd.h b/sys/dev/drm/drm_os_freebsd.h
index 5cd7056..e7c5901 100644
--- a/sys/dev/drm/drm_os_freebsd.h
+++ b/sys/dev/drm/drm_os_freebsd.h
@@ -106,14 +106,18 @@ do {								\
 #define DRM_OS_ERR(v)	v
 
 
-#define DRM_OS_KRNTOUSR(arg1, arg2, arg3) \
-	*arg1 = arg2
-#define DRM_OS_KRNFROMUSR(arg1, arg2, arg3) \
-	arg1 = *arg2
-#define DRM_OS_COPYTOUSR(arg1, arg2, arg3) \
-	copyout(arg2, arg1, arg3)
-#define DRM_OS_COPYFROMUSR(arg1, arg2, arg3) \
-	copyin(arg2, arg1, arg3)
+#define DRM_OS_KRNTOUSR( user, kern, size)	\
+	if ( IOCPARM_LEN(cmd) != size)			\
+		return EINVAL;				\
+	*user = kern;
+#define DRM_OS_KRNFROMUSR(kern, user, size) \
+	if ( IOCPARM_LEN(cmd) != size)			\
+		return EINVAL;				\
+	kern = *user;
+#define DRM_OS_COPYTOUSR(user, kern, size) \
+	copyout(kern, user, size)
+#define DRM_OS_COPYFROMUSR(kern, user, size) \
+	copyin(user, kern, size)
 
 #define DRM_OS_READMEMORYBARRIER \
 {												\