1 files changed, 20 insertions, 8 deletions

diff --git a/drivers/video/ps3fb.c b/drivers/video/ps3fb.c
index 9c56c492a693..b3128903d673 100644
--- a/drivers/video/ps3fb.c
+++ b/drivers/video/ps3fb.c
@@ -51,7 +51,8 @@
 #define L1GPU_DISPLAY_SYNC_HSYNC                1
 #define L1GPU_DISPLAY_SYNC_VSYNC                2
 
-#define GPU_CMD_BUF_SIZE                        (64 * 1024)
+#define GPU_CMD_BUF_SIZE                        (2 * 1024 * 1024)
+#define GPU_FB_START                            (64 * 1024)
 #define GPU_IOIF                                (0x0d000000UL)
 #define GPU_ALIGN_UP(x)                         _ALIGN_UP((x), 64)
 #define GPU_MAX_LINE_LENGTH                     (65536 - 64)
@@ -406,6 +407,7 @@ static void ps3fb_sync_image(struct device *dev, u64 frame_offset,
         if (src_line_length != dst_line_length)
                 line_length |= (u64)src_line_length << 32;
 
+        src_offset += GPU_FB_START;
         status = lv1_gpu_context_attribute(ps3fb.context_handle,
                                            L1GPU_CONTEXT_ATTRIBUTE_FB_BLIT,
                                            dst_offset, GPU_IOIF + src_offset,
@@ -976,9 +978,8 @@ static int ps3fb_xdr_settings(u64 xdr_lpar, struct device *dev)
 
         status = lv1_gpu_context_attribute(ps3fb.context_handle,
                                            L1GPU_CONTEXT_ATTRIBUTE_FB_SETUP,
-                                           xdr_lpar + ps3fb.xdr_size,
-                                           GPU_CMD_BUF_SIZE,
-                                           GPU_IOIF + ps3fb.xdr_size, 0);
+                                           xdr_lpar, GPU_CMD_BUF_SIZE,
+                                           GPU_IOIF, 0);
         if (status) {
                 dev_err(dev,
                         "%s: lv1_gpu_context_attribute FB_SETUP failed: %d\n",
@@ -1061,6 +1062,11 @@ static int __devinit ps3fb_probe(struct ps3_system_bus_device *dev)
         struct task_struct *task;
         unsigned long max_ps3fb_size;
 
+        if (ps3fb_videomemory.size < GPU_CMD_BUF_SIZE) {
+                dev_err(&dev->core, "%s: Not enough video memory\n", __func__);
+                return -ENOMEM;
+        }
+
         status = ps3_open_hv_device(dev);
         if (status) {
                 dev_err(&dev->core, "%s: ps3_open_hv_device failed\n",
@@ -1131,8 +1137,14 @@ static int __devinit ps3fb_probe(struct ps3_system_bus_device *dev)
         /* Clear memory to prevent kernel info leakage into userspace */
         memset(ps3fb.xdr_ea, 0, ps3fb_videomemory.size);
 
-        /* The GPU command buffer is at the end of video memory */
-        ps3fb.xdr_size = ps3fb_videomemory.size - GPU_CMD_BUF_SIZE;
+        /*
+         * The GPU command buffer is at the start of video memory
+         * As we don't use the full command buffer, we can put the actual
+         * frame buffer at offset GPU_FB_START and save some precious XDR
+         * memory
+         */
+        ps3fb.xdr_ea += GPU_FB_START;
+        ps3fb.xdr_size = ps3fb_videomemory.size - GPU_FB_START;
 
         retval = ps3fb_xdr_settings(xdr_lpar, &dev->core);
         if (retval)
@@ -1200,7 +1212,7 @@ err_fb_dealloc:
 err_framebuffer_release:
         framebuffer_release(info);
 err_free_irq:
-        free_irq(ps3fb.irq_no, dev);
+        free_irq(ps3fb.irq_no, &dev->core);
         ps3_irq_plug_destroy(ps3fb.irq_no);
 err_iounmap_dinfo:
         iounmap((u8 __iomem *)ps3fb.dinfo);
@@ -1235,7 +1247,7 @@ static int ps3fb_shutdown(struct ps3_system_bus_device *dev)
                 kthread_stop(task);
         }
         if (ps3fb.irq_no) {
-                free_irq(ps3fb.irq_no, dev);
+                free_irq(ps3fb.irq_no, &dev->core);
                 ps3_irq_plug_destroy(ps3fb.irq_no);
         }
         iounmap((u8 __iomem *)ps3fb.dinfo);