1 /* 2 * Legacy: Generic DRM Buffer Management 3 * 4 * Copyright 1999, 2000 Precision Insight, Inc., Cedar Park, Texas. 5 * Copyright 2000 VA Linux Systems, Inc., Sunnyvale, California. 6 * All Rights Reserved. 7 * 8 * Author: Rickard E. (Rik) Faith <faith@valinux.com> 9 * Author: Gareth Hughes <gareth@valinux.com> 10 * 11 * Permission is hereby granted, free of charge, to any person obtaining a 12 * copy of this software and associated documentation files (the "Software"), 13 * to deal in the Software without restriction, including without limitation 14 * the rights to use, copy, modify, merge, publish, distribute, sublicense, 15 * and/or sell copies of the Software, and to permit persons to whom the 16 * Software is furnished to do so, subject to the following conditions: 17 * 18 * The above copyright notice and this permission notice (including the next 19 * paragraph) shall be included in all copies or substantial portions of the 20 * Software. 21 * 22 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 23 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 24 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL 25 * VA LINUX SYSTEMS AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM, DAMAGES OR 26 * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, 27 * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR 28 * OTHER DEALINGS IN THE SOFTWARE. 29 */ 30 31 #include <linux/vmalloc.h> 32 #include <linux/log2.h> 33 #include <linux/export.h> 34 #include <asm/shmparam.h> 35 #include <drm/drmP.h> 36 #include "drm_legacy.h" 37 38 #include <sys/conf.h> 39 #include <sys/mman.h> 40 #include <vm/vm_map.h> 41 42 static struct drm_map_list *drm_find_matching_map(struct drm_device *dev, 43 struct drm_local_map *map) 44 { 45 struct drm_map_list *entry; 46 list_for_each_entry(entry, &dev->maplist, head) { 47 /* 48 * Because the kernel-userspace ABI is fixed at a 32-bit offset 49 * while PCI resources may live above that, we only compare the 50 * lower 32 bits of the map offset for maps of type 51 * _DRM_FRAMEBUFFER or _DRM_REGISTERS. 52 * It is assumed that if a driver have more than one resource 53 * of each type, the lower 32 bits are different. 54 */ 55 if (!entry->map || 56 map->type != entry->map->type || 57 entry->master != dev->master) 58 continue; 59 switch (map->type) { 60 case _DRM_SHM: 61 if (map->flags != _DRM_CONTAINS_LOCK) 62 break; 63 return entry; 64 case _DRM_REGISTERS: 65 case _DRM_FRAME_BUFFER: 66 if ((entry->map->offset & 0xffffffff) == 67 (map->offset & 0xffffffff)) 68 return entry; 69 default: /* Make gcc happy */ 70 ; 71 } 72 if (entry->map->offset == map->offset) 73 return entry; 74 } 75 76 return NULL; 77 } 78 79 static int drm_map_handle(struct drm_device *dev, struct drm_hash_item *hash, 80 unsigned long user_token, int hashed_handle, int shm) 81 { 82 int use_hashed_handle, shift; 83 unsigned long add; 84 85 #if (BITS_PER_LONG == 64) 86 use_hashed_handle = ((user_token & 0xFFFFFFFF00000000UL) || hashed_handle); 87 #elif (BITS_PER_LONG == 32) 88 use_hashed_handle = hashed_handle; 89 #else 90 #error Unsupported long size. Neither 64 nor 32 bits. 91 #endif 92 93 if (!use_hashed_handle) { 94 int ret; 95 hash->key = user_token >> PAGE_SHIFT; 96 ret = drm_ht_insert_item(&dev->map_hash, hash); 97 if (ret != -EINVAL) 98 return ret; 99 } 100 101 shift = 0; 102 add = DRM_MAP_HASH_OFFSET >> PAGE_SHIFT; 103 if (shm && (SHMLBA > PAGE_SIZE)) { 104 int bits = ilog2(SHMLBA >> PAGE_SHIFT) + 1; 105 106 /* For shared memory, we have to preserve the SHMLBA 107 * bits of the eventual vma->vm_pgoff value during 108 * mmap(). Otherwise we run into cache aliasing problems 109 * on some platforms. On these platforms, the pgoff of 110 * a mmap() request is used to pick a suitable virtual 111 * address for the mmap() region such that it will not 112 * cause cache aliasing problems. 113 * 114 * Therefore, make sure the SHMLBA relevant bits of the 115 * hash value we use are equal to those in the original 116 * kernel virtual address. 117 */ 118 shift = bits; 119 add |= ((user_token >> PAGE_SHIFT) & ((1UL << bits) - 1UL)); 120 } 121 122 return drm_ht_just_insert_please(&dev->map_hash, hash, 123 user_token, 32 - PAGE_SHIFT - 3, 124 shift, add); 125 } 126 127 /** 128 * Core function to create a range of memory available for mapping by a 129 * non-root process. 130 * 131 * Adjusts the memory offset to its absolute value according to the mapping 132 * type. Adds the map to the map list drm_device::maplist. Adds MTRR's where 133 * applicable and if supported by the kernel. 134 */ 135 static int drm_addmap_core(struct drm_device * dev, resource_size_t offset, 136 unsigned int size, enum drm_map_type type, 137 enum drm_map_flags flags, 138 struct drm_map_list ** maplist) 139 { 140 struct drm_local_map *map; 141 struct drm_map_list *list; 142 drm_dma_handle_t *dmah; 143 unsigned long user_token; 144 int ret; 145 146 map = kmalloc(sizeof(*map), M_DRM, M_WAITOK); 147 if (!map) 148 return -ENOMEM; 149 150 map->offset = offset; 151 map->size = size; 152 map->flags = flags; 153 map->type = type; 154 155 /* Only allow shared memory to be removable since we only keep enough 156 * book keeping information about shared memory to allow for removal 157 * when processes fork. 158 */ 159 if ((map->flags & _DRM_REMOVABLE) && map->type != _DRM_SHM) { 160 kfree(map); 161 return -EINVAL; 162 } 163 DRM_DEBUG("offset = 0x%08llx, size = 0x%08lx, type = %d\n", 164 (unsigned long long)map->offset, map->size, map->type); 165 166 /* page-align _DRM_SHM maps. They are allocated here so there is no security 167 * hole created by that and it works around various broken drivers that use 168 * a non-aligned quantity to map the SAREA. --BenH 169 */ 170 if (map->type == _DRM_SHM) 171 map->size = PAGE_ALIGN(map->size); 172 173 if ((map->offset & (~(resource_size_t)LINUX_PAGE_MASK)) || (map->size & (~LINUX_PAGE_MASK))) { 174 kfree(map); 175 return -EINVAL; 176 } 177 map->mtrr = -1; 178 map->handle = NULL; 179 180 switch (map->type) { 181 case _DRM_REGISTERS: 182 case _DRM_FRAME_BUFFER: 183 #if !defined(__sparc__) && !defined(__alpha__) && !defined(__ia64__) && !defined(__powerpc64__) && !defined(__x86_64__) && !defined(__arm__) 184 if (map->offset + (map->size-1) < map->offset || 185 map->offset < virt_to_phys(high_memory)) { 186 kfree(map); 187 return -EINVAL; 188 } 189 #endif 190 /* Some drivers preinitialize some maps, without the X Server 191 * needing to be aware of it. Therefore, we just return success 192 * when the server tries to create a duplicate map. 193 */ 194 list = drm_find_matching_map(dev, map); 195 if (list != NULL) { 196 if (list->map->size != map->size) { 197 DRM_DEBUG("Matching maps of type %d with " 198 "mismatched sizes, (%ld vs %ld)\n", 199 map->type, map->size, 200 list->map->size); 201 list->map->size = map->size; 202 } 203 204 kfree(map); 205 *maplist = list; 206 return 0; 207 } 208 209 if (map->type == _DRM_FRAME_BUFFER || 210 (map->flags & _DRM_WRITE_COMBINING)) { 211 map->mtrr = 212 arch_phys_wc_add(map->offset, map->size); 213 } 214 if (map->type == _DRM_REGISTERS) { 215 if (map->flags & _DRM_WRITE_COMBINING) 216 map->handle = ioremap_wc(map->offset, 217 map->size); 218 else 219 map->handle = ioremap(map->offset, map->size); 220 if (!map->handle) { 221 kfree(map); 222 return -ENOMEM; 223 } 224 } 225 226 break; 227 case _DRM_SHM: 228 list = drm_find_matching_map(dev, map); 229 if (list != NULL) { 230 if(list->map->size != map->size) { 231 DRM_DEBUG("Matching maps of type %d with " 232 "mismatched sizes, (%ld vs %ld)\n", 233 map->type, map->size, list->map->size); 234 list->map->size = map->size; 235 } 236 237 kfree(map); 238 *maplist = list; 239 return 0; 240 } 241 map->handle = vmalloc_user(map->size); 242 DRM_DEBUG("%lu %d %p\n", 243 map->size, order_base_2(map->size), map->handle); 244 if (!map->handle) { 245 kfree(map); 246 return -ENOMEM; 247 } 248 map->offset = (unsigned long)map->handle; 249 if (map->flags & _DRM_CONTAINS_LOCK) { 250 /* Prevent a 2nd X Server from creating a 2nd lock */ 251 if (dev->master->lock.hw_lock != NULL) { 252 vfree(map->handle); 253 kfree(map); 254 return -EBUSY; 255 } 256 dev->sigdata.lock = dev->master->lock.hw_lock = map->handle; /* Pointer to lock */ 257 } 258 break; 259 case _DRM_AGP: { 260 #if 0 261 struct drm_agp_mem *entry; 262 int valid = 0; 263 #endif 264 265 if (!dev->agp) { 266 kfree(map); 267 return -EINVAL; 268 } 269 #ifdef __alpha__ 270 map->offset += dev->hose->mem_space->start; 271 #endif 272 /* In some cases (i810 driver), user space may have already 273 * added the AGP base itself, because dev->agp->base previously 274 * only got set during AGP enable. So, only add the base 275 * address if the map's offset isn't already within the 276 * aperture. 277 */ 278 if (map->offset < dev->agp->base || 279 map->offset > dev->agp->base + 280 dev->agp->agp_info.ai_aperture_size - 1) { 281 map->offset += dev->agp->base; 282 } 283 map->mtrr = dev->agp->agp_mtrr; /* for getmap */ 284 285 /* This assumes the DRM is in total control of AGP space. 286 * It's not always the case as AGP can be in the control 287 * of user space (i.e. i810 driver). So this loop will get 288 * skipped and we double check that dev->agp->memory is 289 * actually set as well as being invalid before EPERM'ing 290 */ 291 #if 0 292 list_for_each_entry(entry, &dev->agp->memory, head) { 293 if ((map->offset >= entry->bound) && 294 (map->offset + map->size <= entry->bound + entry->pages * PAGE_SIZE)) { 295 valid = 1; 296 break; 297 } 298 } 299 if (!list_empty(&dev->agp->memory) && !valid) { 300 kfree(map); 301 return -EPERM; 302 } 303 #endif 304 DRM_DEBUG("AGP offset = 0x%08llx, size = 0x%08lx\n", 305 (unsigned long long)map->offset, map->size); 306 307 break; 308 } 309 case _DRM_SCATTER_GATHER: 310 if (!dev->sg) { 311 kfree(map); 312 return -EINVAL; 313 } 314 map->handle = (void *)(uintptr_t)(dev->sg->vaddr + offset); 315 map->offset = dev->sg->vaddr + offset; 316 break; 317 case _DRM_CONSISTENT: 318 /* dma_addr_t is 64bit on i386 with CONFIG_HIGHMEM64G, 319 * As we're limiting the address to 2^32-1 (or less), 320 * casting it down to 32 bits is no problem, but we 321 * need to point to a 64bit variable first. */ 322 dmah = drm_pci_alloc(dev, map->size, map->size); 323 if (!dmah) { 324 kfree(map); 325 return -ENOMEM; 326 } 327 map->handle = dmah->vaddr; 328 map->offset = (unsigned long)dmah->busaddr; 329 kfree(dmah); 330 break; 331 default: 332 kfree(map); 333 return -EINVAL; 334 } 335 336 list = kzalloc(sizeof(*list), GFP_KERNEL); 337 if (!list) { 338 if (map->type == _DRM_REGISTERS) 339 iounmap(map->handle); 340 kfree(map); 341 return -EINVAL; 342 } 343 list->map = map; 344 345 mutex_lock(&dev->struct_mutex); 346 list_add(&list->head, &dev->maplist); 347 348 /* Assign a 32-bit handle */ 349 /* We do it here so that dev->struct_mutex protects the increment */ 350 user_token = (map->type == _DRM_SHM) ? (unsigned long)map->handle : 351 map->offset; 352 ret = drm_map_handle(dev, &list->hash, user_token, 0, 353 (map->type == _DRM_SHM)); 354 if (ret) { 355 if (map->type == _DRM_REGISTERS) 356 iounmap(map->handle); 357 kfree(map); 358 kfree(list); 359 mutex_unlock(&dev->struct_mutex); 360 return ret; 361 } 362 363 list->user_token = list->hash.key << PAGE_SHIFT; 364 mutex_unlock(&dev->struct_mutex); 365 366 if (!(map->flags & _DRM_DRIVER)) 367 list->master = dev->master; 368 *maplist = list; 369 return 0; 370 } 371 372 int drm_legacy_addmap(struct drm_device * dev, resource_size_t offset, 373 unsigned int size, enum drm_map_type type, 374 enum drm_map_flags flags, struct drm_local_map **map_ptr) 375 { 376 struct drm_map_list *list; 377 int rc; 378 379 rc = drm_addmap_core(dev, offset, size, type, flags, &list); 380 if (!rc) 381 *map_ptr = list->map; 382 return rc; 383 } 384 EXPORT_SYMBOL(drm_legacy_addmap); 385 386 /** 387 * Ioctl to specify a range of memory that is available for mapping by a 388 * non-root process. 389 * 390 * \param inode device inode. 391 * \param file_priv DRM file private. 392 * \param cmd command. 393 * \param arg pointer to a drm_map structure. 394 * \return zero on success or a negative value on error. 395 * 396 */ 397 int drm_legacy_addmap_ioctl(struct drm_device *dev, void *data, 398 struct drm_file *file_priv) 399 { 400 struct drm_map *map = data; 401 struct drm_map_list *maplist; 402 int err; 403 404 if (!(capable(CAP_SYS_ADMIN) || map->type == _DRM_AGP || map->type == _DRM_SHM)) 405 return -EPERM; 406 407 if (!drm_core_check_feature(dev, DRIVER_KMS_LEGACY_CONTEXT) && 408 !drm_core_check_feature(dev, DRIVER_LEGACY)) 409 return -EINVAL; 410 411 err = drm_addmap_core(dev, map->offset, map->size, map->type, 412 map->flags, &maplist); 413 414 if (err) 415 return err; 416 417 /* avoid a warning on 64-bit, this casting isn't very nice, but the API is set so too late */ 418 map->handle = (void *)(unsigned long)maplist->user_token; 419 420 /* 421 * It appears that there are no users of this value whatsoever -- 422 * drmAddMap just discards it. Let's not encourage its use. 423 * (Keeping drm_addmap_core's returned mtrr value would be wrong -- 424 * it's not a real mtrr index anymore.) 425 */ 426 map->mtrr = -1; 427 428 return 0; 429 } 430 431 /* 432 * Get a mapping information. 433 * 434 * \param inode device inode. 435 * \param file_priv DRM file private. 436 * \param cmd command. 437 * \param arg user argument, pointing to a drm_map structure. 438 * 439 * \return zero on success or a negative number on failure. 440 * 441 * Searches for the mapping with the specified offset and copies its information 442 * into userspace 443 */ 444 int drm_legacy_getmap_ioctl(struct drm_device *dev, void *data, 445 struct drm_file *file_priv) 446 { 447 struct drm_map *map = data; 448 struct drm_map_list *r_list = NULL; 449 struct list_head *list; 450 int idx; 451 int i; 452 453 if (!drm_core_check_feature(dev, DRIVER_KMS_LEGACY_CONTEXT) && 454 !drm_core_check_feature(dev, DRIVER_LEGACY)) 455 return -EINVAL; 456 457 idx = map->offset; 458 if (idx < 0) 459 return -EINVAL; 460 461 i = 0; 462 mutex_lock(&dev->struct_mutex); 463 list_for_each(list, &dev->maplist) { 464 if (i == idx) { 465 r_list = list_entry(list, struct drm_map_list, head); 466 break; 467 } 468 i++; 469 } 470 if (!r_list || !r_list->map) { 471 mutex_unlock(&dev->struct_mutex); 472 return -EINVAL; 473 } 474 475 map->offset = r_list->map->offset; 476 map->size = r_list->map->size; 477 map->type = r_list->map->type; 478 map->flags = r_list->map->flags; 479 map->handle = (void *)(unsigned long) r_list->user_token; 480 map->mtrr = r_list->map->mtrr; 481 482 mutex_unlock(&dev->struct_mutex); 483 484 return 0; 485 } 486 487 /** 488 * Remove a map private from list and deallocate resources if the mapping 489 * isn't in use. 490 * 491 * Searches the map on drm_device::maplist, removes it from the list, see if 492 * its being used, and free any associate resource (such as MTRR's) if it's not 493 * being on use. 494 * 495 * \sa drm_legacy_addmap 496 */ 497 int drm_legacy_rmmap_locked(struct drm_device *dev, struct drm_local_map *map) 498 { 499 struct drm_map_list *r_list = NULL, *list_t; 500 drm_dma_handle_t dmah; 501 int found = 0; 502 struct drm_master *master; 503 504 /* Find the list entry for the map and remove it */ 505 list_for_each_entry_safe(r_list, list_t, &dev->maplist, head) { 506 if (r_list->map == map) { 507 master = r_list->master; 508 list_del(&r_list->head); 509 drm_ht_remove_key(&dev->map_hash, 510 r_list->user_token >> PAGE_SHIFT); 511 kfree(r_list); 512 found = 1; 513 break; 514 } 515 } 516 517 if (!found) 518 return -EINVAL; 519 520 switch (map->type) { 521 case _DRM_REGISTERS: 522 iounmap(map->handle); 523 /* FALLTHROUGH */ 524 case _DRM_FRAME_BUFFER: 525 arch_phys_wc_del(map->mtrr); 526 break; 527 case _DRM_SHM: 528 vfree(map->handle); 529 if (master) { 530 if (dev->sigdata.lock == master->lock.hw_lock) 531 dev->sigdata.lock = NULL; 532 master->lock.hw_lock = NULL; /* SHM removed */ 533 master->lock.file_priv = NULL; 534 wake_up_interruptible_all(&master->lock.lock_queue); 535 } 536 break; 537 case _DRM_AGP: 538 case _DRM_SCATTER_GATHER: 539 break; 540 case _DRM_CONSISTENT: 541 dmah.vaddr = map->handle; 542 dmah.busaddr = map->offset; 543 dmah.size = map->size; 544 __drm_legacy_pci_free(dev, &dmah); 545 break; 546 } 547 kfree(map); 548 549 return 0; 550 } 551 EXPORT_SYMBOL(drm_legacy_rmmap_locked); 552 553 void drm_legacy_rmmap(struct drm_device *dev, struct drm_local_map *map) 554 { 555 if (!drm_core_check_feature(dev, DRIVER_KMS_LEGACY_CONTEXT) && 556 !drm_core_check_feature(dev, DRIVER_LEGACY)) 557 return; 558 559 mutex_lock(&dev->struct_mutex); 560 drm_legacy_rmmap_locked(dev, map); 561 mutex_unlock(&dev->struct_mutex); 562 } 563 EXPORT_SYMBOL(drm_legacy_rmmap); 564 565 void drm_legacy_master_rmmaps(struct drm_device *dev, struct drm_master *master) 566 { 567 struct drm_map_list *r_list, *list_temp; 568 569 if (!drm_core_check_feature(dev, DRIVER_LEGACY)) 570 return; 571 572 mutex_lock(&dev->struct_mutex); 573 list_for_each_entry_safe(r_list, list_temp, &dev->maplist, head) { 574 if (r_list->master == master) { 575 drm_legacy_rmmap_locked(dev, r_list->map); 576 r_list = NULL; 577 } 578 } 579 mutex_unlock(&dev->struct_mutex); 580 } 581 582 /* The rmmap ioctl appears to be unnecessary. All mappings are torn down on 583 * the last close of the device, and this is necessary for cleanup when things 584 * exit uncleanly. Therefore, having userland manually remove mappings seems 585 * like a pointless exercise since they're going away anyway. 586 * 587 * One use case might be after addmap is allowed for normal users for SHM and 588 * gets used by drivers that the server doesn't need to care about. This seems 589 * unlikely. 590 * 591 * \param inode device inode. 592 * \param file_priv DRM file private. 593 * \param cmd command. 594 * \param arg pointer to a struct drm_map structure. 595 * \return zero on success or a negative value on error. 596 */ 597 int drm_legacy_rmmap_ioctl(struct drm_device *dev, void *data, 598 struct drm_file *file_priv) 599 { 600 struct drm_map *request = data; 601 struct drm_local_map *map = NULL; 602 struct drm_map_list *r_list; 603 int ret; 604 605 if (!drm_core_check_feature(dev, DRIVER_KMS_LEGACY_CONTEXT) && 606 !drm_core_check_feature(dev, DRIVER_LEGACY)) 607 return -EINVAL; 608 609 mutex_lock(&dev->struct_mutex); 610 list_for_each_entry(r_list, &dev->maplist, head) { 611 if (r_list->map && 612 r_list->user_token == (unsigned long)request->handle && 613 r_list->map->flags & _DRM_REMOVABLE) { 614 map = r_list->map; 615 break; 616 } 617 } 618 619 /* List has wrapped around to the head pointer, or its empty we didn't 620 * find anything. 621 */ 622 if (list_empty(&dev->maplist) || !map) { 623 mutex_unlock(&dev->struct_mutex); 624 return -EINVAL; 625 } 626 627 /* Register and framebuffer maps are permanent */ 628 if ((map->type == _DRM_REGISTERS) || (map->type == _DRM_FRAME_BUFFER)) { 629 mutex_unlock(&dev->struct_mutex); 630 return 0; 631 } 632 633 ret = drm_legacy_rmmap_locked(dev, map); 634 635 mutex_unlock(&dev->struct_mutex); 636 637 return ret; 638 } 639 640 /** 641 * Cleanup after an error on one of the addbufs() functions. 642 * 643 * \param dev DRM device. 644 * \param entry buffer entry where the error occurred. 645 * 646 * Frees any pages and buffers associated with the given entry. 647 */ 648 static void drm_cleanup_buf_error(struct drm_device * dev, 649 struct drm_buf_entry * entry) 650 { 651 int i; 652 653 if (entry->seg_count) { 654 for (i = 0; i < entry->seg_count; i++) { 655 if (entry->seglist[i]) { 656 drm_pci_free(dev, entry->seglist[i]); 657 } 658 } 659 kfree(entry->seglist); 660 661 entry->seg_count = 0; 662 } 663 664 if (entry->buf_count) { 665 for (i = 0; i < entry->buf_count; i++) { 666 kfree(entry->buflist[i].dev_private); 667 } 668 kfree(entry->buflist); 669 670 entry->buf_count = 0; 671 } 672 } 673 674 #if IS_ENABLED(CONFIG_AGP) 675 /** 676 * Add AGP buffers for DMA transfers. 677 * 678 * \param dev struct drm_device to which the buffers are to be added. 679 * \param request pointer to a struct drm_buf_desc describing the request. 680 * \return zero on success or a negative number on failure. 681 * 682 * After some sanity checks creates a drm_buf structure for each buffer and 683 * reallocates the buffer list of the same size order to accommodate the new 684 * buffers. 685 */ 686 int drm_legacy_addbufs_agp(struct drm_device *dev, 687 struct drm_buf_desc *request) 688 { 689 struct drm_device_dma *dma = dev->dma; 690 struct drm_buf_entry *entry; 691 /* struct drm_agp_mem *agp_entry; */ 692 struct drm_buf *buf; 693 unsigned long offset; 694 unsigned long agp_offset; 695 int count; 696 int order; 697 int size; 698 int alignment; 699 int page_order; 700 int total; 701 int byte_count; 702 #if 0 703 int i, valid; 704 #else 705 int i; 706 #endif 707 708 struct drm_buf **temp_buflist; 709 710 if (!dma) 711 return -EINVAL; 712 713 count = request->count; 714 order = order_base_2(request->size); 715 size = 1 << order; 716 717 alignment = (request->flags & _DRM_PAGE_ALIGN) 718 ? PAGE_ALIGN(size) : size; 719 page_order = order - PAGE_SHIFT > 0 ? order - PAGE_SHIFT : 0; 720 total = PAGE_SIZE << page_order; 721 722 byte_count = 0; 723 agp_offset = dev->agp->base + request->agp_start; 724 725 DRM_DEBUG("count: %d\n", count); 726 DRM_DEBUG("order: %d\n", order); 727 DRM_DEBUG("size: %d\n", size); 728 DRM_DEBUG("agp_offset: %lx\n", agp_offset); 729 DRM_DEBUG("alignment: %d\n", alignment); 730 DRM_DEBUG("page_order: %d\n", page_order); 731 DRM_DEBUG("total: %d\n", total); 732 733 if (order < DRM_MIN_ORDER || order > DRM_MAX_ORDER) 734 return -EINVAL; 735 736 /* Make sure buffers are located in AGP memory that we own */ 737 #if 0 738 valid = 0; 739 list_for_each_entry(agp_entry, &dev->agp->memory, head) { 740 if ((agp_offset >= agp_entry->bound) && 741 (agp_offset + total * count <= agp_entry->bound + agp_entry->pages * PAGE_SIZE)) { 742 valid = 1; 743 break; 744 } 745 } 746 if (!list_empty(&dev->agp->memory) && !valid) { 747 DRM_DEBUG("zone invalid\n"); 748 return -EINVAL; 749 } 750 #endif 751 lockmgr(&dev->buf_lock, LK_EXCLUSIVE); 752 if (dev->buf_use) { 753 lockmgr(&dev->buf_lock, LK_RELEASE); 754 return -EBUSY; 755 } 756 atomic_inc(&dev->buf_alloc); 757 lockmgr(&dev->buf_lock, LK_RELEASE); 758 759 mutex_lock(&dev->struct_mutex); 760 entry = &dma->bufs[order]; 761 if (entry->buf_count) { 762 mutex_unlock(&dev->struct_mutex); 763 atomic_dec(&dev->buf_alloc); 764 return -ENOMEM; /* May only call once for each order */ 765 } 766 767 if (count < 0 || count > 4096) { 768 mutex_unlock(&dev->struct_mutex); 769 atomic_dec(&dev->buf_alloc); 770 return -EINVAL; 771 } 772 773 entry->buflist = kcalloc(count, sizeof(*entry->buflist), GFP_KERNEL); 774 if (!entry->buflist) { 775 mutex_unlock(&dev->struct_mutex); 776 atomic_dec(&dev->buf_alloc); 777 return -ENOMEM; 778 } 779 780 entry->buf_size = size; 781 entry->page_order = page_order; 782 783 offset = 0; 784 785 while (entry->buf_count < count) { 786 buf = &entry->buflist[entry->buf_count]; 787 buf->idx = dma->buf_count + entry->buf_count; 788 buf->total = alignment; 789 buf->order = order; 790 buf->used = 0; 791 792 buf->offset = (dma->byte_count + offset); 793 buf->bus_address = agp_offset + offset; 794 buf->address = (void *)(agp_offset + offset); 795 buf->next = NULL; 796 buf->waiting = 0; 797 buf->pending = 0; 798 buf->file_priv = NULL; 799 800 buf->dev_priv_size = dev->driver->dev_priv_size; 801 buf->dev_private = kzalloc(buf->dev_priv_size, GFP_KERNEL); 802 if (!buf->dev_private) { 803 /* Set count correctly so we free the proper amount. */ 804 entry->buf_count = count; 805 drm_cleanup_buf_error(dev, entry); 806 mutex_unlock(&dev->struct_mutex); 807 atomic_dec(&dev->buf_alloc); 808 return -ENOMEM; 809 } 810 811 DRM_DEBUG("buffer %d @ %p\n", entry->buf_count, buf->address); 812 813 offset += alignment; 814 entry->buf_count++; 815 byte_count += PAGE_SIZE << page_order; 816 } 817 818 DRM_DEBUG("byte_count: %d\n", byte_count); 819 820 temp_buflist = krealloc(dma->buflist, 821 (dma->buf_count + entry->buf_count) * 822 sizeof(*dma->buflist), M_DRM, M_WAITOK); 823 if (!temp_buflist) { 824 /* Free the entry because it isn't valid */ 825 drm_cleanup_buf_error(dev, entry); 826 mutex_unlock(&dev->struct_mutex); 827 atomic_dec(&dev->buf_alloc); 828 return -ENOMEM; 829 } 830 dma->buflist = temp_buflist; 831 832 for (i = 0; i < entry->buf_count; i++) { 833 dma->buflist[i + dma->buf_count] = &entry->buflist[i]; 834 } 835 836 dma->buf_count += entry->buf_count; 837 dma->seg_count += entry->seg_count; 838 dma->page_count += byte_count >> PAGE_SHIFT; 839 dma->byte_count += byte_count; 840 841 DRM_DEBUG("dma->buf_count : %d\n", dma->buf_count); 842 DRM_DEBUG("entry->buf_count : %d\n", entry->buf_count); 843 844 mutex_unlock(&dev->struct_mutex); 845 846 request->count = entry->buf_count; 847 request->size = size; 848 849 dma->flags = _DRM_DMA_USE_AGP; 850 851 atomic_dec(&dev->buf_alloc); 852 return 0; 853 } 854 EXPORT_SYMBOL(drm_legacy_addbufs_agp); 855 #endif /* CONFIG_AGP */ 856 857 int drm_legacy_addbufs_pci(struct drm_device *dev, 858 struct drm_buf_desc *request) 859 { 860 struct drm_device_dma *dma = dev->dma; 861 int count; 862 int order; 863 int size; 864 int total; 865 int page_order; 866 struct drm_buf_entry *entry; 867 drm_dma_handle_t *dmah; 868 struct drm_buf *buf; 869 int alignment; 870 unsigned long offset; 871 int i; 872 int byte_count; 873 int page_count; 874 unsigned long *temp_pagelist; 875 struct drm_buf **temp_buflist; 876 877 if (!drm_core_check_feature(dev, DRIVER_PCI_DMA)) 878 return -EINVAL; 879 880 if (!dma) 881 return -EINVAL; 882 883 if (!capable(CAP_SYS_ADMIN)) 884 return -EPERM; 885 886 count = request->count; 887 order = order_base_2(request->size); 888 size = 1 << order; 889 890 DRM_DEBUG("count=%d, size=%d (%d), order=%d\n", 891 request->count, request->size, size, order); 892 893 if (order < DRM_MIN_ORDER || order > DRM_MAX_ORDER) 894 return -EINVAL; 895 896 alignment = (request->flags & _DRM_PAGE_ALIGN) 897 ? PAGE_ALIGN(size) : size; 898 page_order = order - PAGE_SHIFT > 0 ? order - PAGE_SHIFT : 0; 899 total = PAGE_SIZE << page_order; 900 901 lockmgr(&dev->buf_lock, LK_EXCLUSIVE); 902 if (dev->buf_use) { 903 lockmgr(&dev->buf_lock, LK_RELEASE); 904 return -EBUSY; 905 } 906 atomic_inc(&dev->buf_alloc); 907 lockmgr(&dev->buf_lock, LK_RELEASE); 908 909 mutex_lock(&dev->struct_mutex); 910 entry = &dma->bufs[order]; 911 if (entry->buf_count) { 912 mutex_unlock(&dev->struct_mutex); 913 atomic_dec(&dev->buf_alloc); 914 return -ENOMEM; /* May only call once for each order */ 915 } 916 917 if (count < 0 || count > 4096) { 918 mutex_unlock(&dev->struct_mutex); 919 atomic_dec(&dev->buf_alloc); 920 return -EINVAL; 921 } 922 923 entry->buflist = kcalloc(count, sizeof(*entry->buflist), GFP_KERNEL); 924 if (!entry->buflist) { 925 mutex_unlock(&dev->struct_mutex); 926 atomic_dec(&dev->buf_alloc); 927 return -ENOMEM; 928 } 929 930 entry->seglist = kcalloc(count, sizeof(*entry->seglist), GFP_KERNEL); 931 if (!entry->seglist) { 932 kfree(entry->buflist); 933 mutex_unlock(&dev->struct_mutex); 934 atomic_dec(&dev->buf_alloc); 935 return -ENOMEM; 936 } 937 938 /* Keep the original pagelist until we know all the allocations 939 * have succeeded 940 */ 941 temp_pagelist = kmalloc_array(dma->page_count + (count << page_order), 942 sizeof(*dma->pagelist), 943 GFP_KERNEL); 944 if (!temp_pagelist) { 945 kfree(entry->buflist); 946 kfree(entry->seglist); 947 mutex_unlock(&dev->struct_mutex); 948 atomic_dec(&dev->buf_alloc); 949 return -ENOMEM; 950 } 951 memcpy(temp_pagelist, 952 dma->pagelist, dma->page_count * sizeof(*dma->pagelist)); 953 DRM_DEBUG("pagelist: %d entries\n", 954 dma->page_count + (count << page_order)); 955 956 entry->buf_size = size; 957 entry->page_order = page_order; 958 byte_count = 0; 959 page_count = 0; 960 961 while (entry->buf_count < count) { 962 963 dmah = drm_pci_alloc(dev, PAGE_SIZE << page_order, 0x1000); 964 965 if (!dmah) { 966 /* Set count correctly so we free the proper amount. */ 967 entry->buf_count = count; 968 entry->seg_count = count; 969 drm_cleanup_buf_error(dev, entry); 970 kfree(temp_pagelist); 971 mutex_unlock(&dev->struct_mutex); 972 atomic_dec(&dev->buf_alloc); 973 return -ENOMEM; 974 } 975 entry->seglist[entry->seg_count++] = dmah; 976 for (i = 0; i < (1 << page_order); i++) { 977 DRM_DEBUG("page %d @ 0x%08lx\n", 978 dma->page_count + page_count, 979 (unsigned long)dmah->vaddr + PAGE_SIZE * i); 980 temp_pagelist[dma->page_count + page_count++] 981 = (unsigned long)dmah->vaddr + PAGE_SIZE * i; 982 } 983 for (offset = 0; 984 offset + size <= total && entry->buf_count < count; 985 offset += alignment, ++entry->buf_count) { 986 buf = &entry->buflist[entry->buf_count]; 987 buf->idx = dma->buf_count + entry->buf_count; 988 buf->total = alignment; 989 buf->order = order; 990 buf->used = 0; 991 buf->offset = (dma->byte_count + byte_count + offset); 992 buf->address = ((char *)dmah->vaddr + offset); 993 buf->bus_address = dmah->busaddr + offset; 994 buf->next = NULL; 995 buf->waiting = 0; 996 buf->pending = 0; 997 buf->file_priv = NULL; 998 999 buf->dev_priv_size = dev->driver->dev_priv_size; 1000 buf->dev_private = kzalloc(buf->dev_priv_size, 1001 GFP_KERNEL); 1002 if (!buf->dev_private) { 1003 /* Set count correctly so we free the proper amount. */ 1004 entry->buf_count = count; 1005 entry->seg_count = count; 1006 drm_cleanup_buf_error(dev, entry); 1007 kfree(temp_pagelist); 1008 mutex_unlock(&dev->struct_mutex); 1009 atomic_dec(&dev->buf_alloc); 1010 return -ENOMEM; 1011 } 1012 1013 DRM_DEBUG("buffer %d @ %p\n", 1014 entry->buf_count, buf->address); 1015 } 1016 byte_count += PAGE_SIZE << page_order; 1017 } 1018 1019 temp_buflist = krealloc(dma->buflist, 1020 (dma->buf_count + entry->buf_count) * 1021 sizeof(*dma->buflist), M_DRM, M_WAITOK); 1022 if (!temp_buflist) { 1023 /* Free the entry because it isn't valid */ 1024 drm_cleanup_buf_error(dev, entry); 1025 kfree(temp_pagelist); 1026 mutex_unlock(&dev->struct_mutex); 1027 atomic_dec(&dev->buf_alloc); 1028 return -ENOMEM; 1029 } 1030 dma->buflist = temp_buflist; 1031 1032 for (i = 0; i < entry->buf_count; i++) { 1033 dma->buflist[i + dma->buf_count] = &entry->buflist[i]; 1034 } 1035 1036 /* No allocations failed, so now we can replace the original pagelist 1037 * with the new one. 1038 */ 1039 if (dma->page_count) { 1040 kfree(dma->pagelist); 1041 } 1042 dma->pagelist = temp_pagelist; 1043 1044 dma->buf_count += entry->buf_count; 1045 dma->seg_count += entry->seg_count; 1046 dma->page_count += entry->seg_count << page_order; 1047 dma->byte_count += PAGE_SIZE * (entry->seg_count << page_order); 1048 1049 mutex_unlock(&dev->struct_mutex); 1050 1051 request->count = entry->buf_count; 1052 request->size = size; 1053 1054 if (request->flags & _DRM_PCI_BUFFER_RO) 1055 dma->flags = _DRM_DMA_USE_PCI_RO; 1056 1057 atomic_dec(&dev->buf_alloc); 1058 return 0; 1059 1060 } 1061 EXPORT_SYMBOL(drm_legacy_addbufs_pci); 1062 1063 static int drm_legacy_addbufs_sg(struct drm_device *dev, 1064 struct drm_buf_desc *request) 1065 { 1066 struct drm_device_dma *dma = dev->dma; 1067 struct drm_buf_entry *entry; 1068 struct drm_buf *buf; 1069 unsigned long offset; 1070 unsigned long agp_offset; 1071 int count; 1072 int order; 1073 int size; 1074 int alignment; 1075 int page_order; 1076 int total; 1077 int byte_count; 1078 int i; 1079 struct drm_buf **temp_buflist; 1080 1081 if (!drm_core_check_feature(dev, DRIVER_SG)) 1082 return -EINVAL; 1083 1084 if (!dma) 1085 return -EINVAL; 1086 1087 if (!capable(CAP_SYS_ADMIN)) 1088 return -EPERM; 1089 1090 count = request->count; 1091 order = order_base_2(request->size); 1092 size = 1 << order; 1093 1094 alignment = (request->flags & _DRM_PAGE_ALIGN) 1095 ? PAGE_ALIGN(size) : size; 1096 page_order = order - PAGE_SHIFT > 0 ? order - PAGE_SHIFT : 0; 1097 total = PAGE_SIZE << page_order; 1098 1099 byte_count = 0; 1100 agp_offset = request->agp_start; 1101 1102 DRM_DEBUG("count: %d\n", count); 1103 DRM_DEBUG("order: %d\n", order); 1104 DRM_DEBUG("size: %d\n", size); 1105 DRM_DEBUG("agp_offset: %lu\n", agp_offset); 1106 DRM_DEBUG("alignment: %d\n", alignment); 1107 DRM_DEBUG("page_order: %d\n", page_order); 1108 DRM_DEBUG("total: %d\n", total); 1109 1110 if (order < DRM_MIN_ORDER || order > DRM_MAX_ORDER) 1111 return -EINVAL; 1112 1113 lockmgr(&dev->buf_lock, LK_EXCLUSIVE); 1114 if (dev->buf_use) { 1115 lockmgr(&dev->buf_lock, LK_RELEASE); 1116 return -EBUSY; 1117 } 1118 atomic_inc(&dev->buf_alloc); 1119 lockmgr(&dev->buf_lock, LK_RELEASE); 1120 1121 mutex_lock(&dev->struct_mutex); 1122 entry = &dma->bufs[order]; 1123 if (entry->buf_count) { 1124 mutex_unlock(&dev->struct_mutex); 1125 atomic_dec(&dev->buf_alloc); 1126 return -ENOMEM; /* May only call once for each order */ 1127 } 1128 1129 if (count < 0 || count > 4096) { 1130 mutex_unlock(&dev->struct_mutex); 1131 atomic_dec(&dev->buf_alloc); 1132 return -EINVAL; 1133 } 1134 1135 entry->buflist = kcalloc(count, sizeof(*entry->buflist), GFP_KERNEL); 1136 if (!entry->buflist) { 1137 mutex_unlock(&dev->struct_mutex); 1138 atomic_dec(&dev->buf_alloc); 1139 return -ENOMEM; 1140 } 1141 1142 entry->buf_size = size; 1143 entry->page_order = page_order; 1144 1145 offset = 0; 1146 1147 while (entry->buf_count < count) { 1148 buf = &entry->buflist[entry->buf_count]; 1149 buf->idx = dma->buf_count + entry->buf_count; 1150 buf->total = alignment; 1151 buf->order = order; 1152 buf->used = 0; 1153 1154 buf->offset = (dma->byte_count + offset); 1155 buf->bus_address = agp_offset + offset; 1156 buf->address = (void *)(agp_offset + offset + dev->sg->vaddr); 1157 buf->next = NULL; 1158 buf->waiting = 0; 1159 buf->pending = 0; 1160 buf->file_priv = NULL; 1161 1162 buf->dev_priv_size = dev->driver->dev_priv_size; 1163 buf->dev_private = kzalloc(buf->dev_priv_size, GFP_KERNEL); 1164 if (!buf->dev_private) { 1165 /* Set count correctly so we free the proper amount. */ 1166 entry->buf_count = count; 1167 drm_cleanup_buf_error(dev, entry); 1168 mutex_unlock(&dev->struct_mutex); 1169 atomic_dec(&dev->buf_alloc); 1170 return -ENOMEM; 1171 } 1172 1173 DRM_DEBUG("buffer %d @ %p\n", entry->buf_count, buf->address); 1174 1175 offset += alignment; 1176 entry->buf_count++; 1177 byte_count += PAGE_SIZE << page_order; 1178 } 1179 1180 DRM_DEBUG("byte_count: %d\n", byte_count); 1181 1182 temp_buflist = krealloc(dma->buflist, 1183 (dma->buf_count + entry->buf_count) * 1184 sizeof(*dma->buflist), M_DRM, M_WAITOK); 1185 if (!temp_buflist) { 1186 /* Free the entry because it isn't valid */ 1187 drm_cleanup_buf_error(dev, entry); 1188 mutex_unlock(&dev->struct_mutex); 1189 atomic_dec(&dev->buf_alloc); 1190 return -ENOMEM; 1191 } 1192 dma->buflist = temp_buflist; 1193 1194 for (i = 0; i < entry->buf_count; i++) { 1195 dma->buflist[i + dma->buf_count] = &entry->buflist[i]; 1196 } 1197 1198 dma->buf_count += entry->buf_count; 1199 dma->seg_count += entry->seg_count; 1200 dma->page_count += byte_count >> PAGE_SHIFT; 1201 dma->byte_count += byte_count; 1202 1203 DRM_DEBUG("dma->buf_count : %d\n", dma->buf_count); 1204 DRM_DEBUG("entry->buf_count : %d\n", entry->buf_count); 1205 1206 mutex_unlock(&dev->struct_mutex); 1207 1208 request->count = entry->buf_count; 1209 request->size = size; 1210 1211 dma->flags = _DRM_DMA_USE_SG; 1212 1213 atomic_dec(&dev->buf_alloc); 1214 return 0; 1215 } 1216 1217 /** 1218 * Add buffers for DMA transfers (ioctl). 1219 * 1220 * \param inode device inode. 1221 * \param file_priv DRM file private. 1222 * \param cmd command. 1223 * \param arg pointer to a struct drm_buf_desc request. 1224 * \return zero on success or a negative number on failure. 1225 * 1226 * According with the memory type specified in drm_buf_desc::flags and the 1227 * build options, it dispatches the call either to addbufs_agp(), 1228 * addbufs_sg() or addbufs_pci() for AGP, scatter-gather or consistent 1229 * PCI memory respectively. 1230 */ 1231 int drm_legacy_addbufs(struct drm_device *dev, void *data, 1232 struct drm_file *file_priv) 1233 { 1234 struct drm_buf_desc *request = data; 1235 int ret; 1236 1237 if (!drm_core_check_feature(dev, DRIVER_LEGACY)) 1238 return -EINVAL; 1239 1240 if (!drm_core_check_feature(dev, DRIVER_HAVE_DMA)) 1241 return -EINVAL; 1242 1243 #if IS_ENABLED(CONFIG_AGP) 1244 if (request->flags & _DRM_AGP_BUFFER) 1245 ret = drm_legacy_addbufs_agp(dev, request); 1246 else 1247 #endif 1248 if (request->flags & _DRM_SG_BUFFER) 1249 ret = drm_legacy_addbufs_sg(dev, request); 1250 else if (request->flags & _DRM_FB_BUFFER) 1251 ret = -EINVAL; 1252 else 1253 ret = drm_legacy_addbufs_pci(dev, request); 1254 1255 return ret; 1256 } 1257 1258 /** 1259 * Get information about the buffer mappings. 1260 * 1261 * This was originally mean for debugging purposes, or by a sophisticated 1262 * client library to determine how best to use the available buffers (e.g., 1263 * large buffers can be used for image transfer). 1264 * 1265 * \param inode device inode. 1266 * \param file_priv DRM file private. 1267 * \param cmd command. 1268 * \param arg pointer to a drm_buf_info structure. 1269 * \return zero on success or a negative number on failure. 1270 * 1271 * Increments drm_device::buf_use while holding the drm_device::buf_lock 1272 * lock, preventing of allocating more buffers after this call. Information 1273 * about each requested buffer is then copied into user space. 1274 */ 1275 int drm_legacy_infobufs(struct drm_device *dev, void *data, 1276 struct drm_file *file_priv) 1277 { 1278 struct drm_device_dma *dma = dev->dma; 1279 struct drm_buf_info *request = data; 1280 int i; 1281 int count; 1282 1283 if (!drm_core_check_feature(dev, DRIVER_LEGACY)) 1284 return -EINVAL; 1285 1286 if (!drm_core_check_feature(dev, DRIVER_HAVE_DMA)) 1287 return -EINVAL; 1288 1289 if (!dma) 1290 return -EINVAL; 1291 1292 lockmgr(&dev->buf_lock, LK_EXCLUSIVE); 1293 if (atomic_read(&dev->buf_alloc)) { 1294 lockmgr(&dev->buf_lock, LK_RELEASE); 1295 return -EBUSY; 1296 } 1297 ++dev->buf_use; /* Can't allocate more after this call */ 1298 lockmgr(&dev->buf_lock, LK_RELEASE); 1299 1300 for (i = 0, count = 0; i < DRM_MAX_ORDER + 1; i++) { 1301 if (dma->bufs[i].buf_count) 1302 ++count; 1303 } 1304 1305 DRM_DEBUG("count = %d\n", count); 1306 1307 if (request->count >= count) { 1308 for (i = 0, count = 0; i < DRM_MAX_ORDER + 1; i++) { 1309 if (dma->bufs[i].buf_count) { 1310 struct drm_buf_desc __user *to = 1311 &request->list[count]; 1312 struct drm_buf_entry *from = &dma->bufs[i]; 1313 if (copy_to_user(&to->count, 1314 &from->buf_count, 1315 sizeof(from->buf_count)) || 1316 copy_to_user(&to->size, 1317 &from->buf_size, 1318 sizeof(from->buf_size)) || 1319 copy_to_user(&to->low_mark, 1320 &from->low_mark, 1321 sizeof(from->low_mark)) || 1322 copy_to_user(&to->high_mark, 1323 &from->high_mark, 1324 sizeof(from->high_mark))) 1325 return -EFAULT; 1326 1327 DRM_DEBUG("%d %d %d %d %d\n", 1328 i, 1329 dma->bufs[i].buf_count, 1330 dma->bufs[i].buf_size, 1331 dma->bufs[i].low_mark, 1332 dma->bufs[i].high_mark); 1333 ++count; 1334 } 1335 } 1336 } 1337 request->count = count; 1338 1339 return 0; 1340 } 1341 1342 /** 1343 * Specifies a low and high water mark for buffer allocation 1344 * 1345 * \param inode device inode. 1346 * \param file_priv DRM file private. 1347 * \param cmd command. 1348 * \param arg a pointer to a drm_buf_desc structure. 1349 * \return zero on success or a negative number on failure. 1350 * 1351 * Verifies that the size order is bounded between the admissible orders and 1352 * updates the respective drm_device_dma::bufs entry low and high water mark. 1353 * 1354 * \note This ioctl is deprecated and mostly never used. 1355 */ 1356 int drm_legacy_markbufs(struct drm_device *dev, void *data, 1357 struct drm_file *file_priv) 1358 { 1359 struct drm_device_dma *dma = dev->dma; 1360 struct drm_buf_desc *request = data; 1361 int order; 1362 struct drm_buf_entry *entry; 1363 1364 if (!drm_core_check_feature(dev, DRIVER_LEGACY)) 1365 return -EINVAL; 1366 1367 if (!drm_core_check_feature(dev, DRIVER_HAVE_DMA)) 1368 return -EINVAL; 1369 1370 if (!dma) 1371 return -EINVAL; 1372 1373 DRM_DEBUG("%d, %d, %d\n", 1374 request->size, request->low_mark, request->high_mark); 1375 order = order_base_2(request->size); 1376 if (order < DRM_MIN_ORDER || order > DRM_MAX_ORDER) 1377 return -EINVAL; 1378 entry = &dma->bufs[order]; 1379 1380 if (request->low_mark < 0 || request->low_mark > entry->buf_count) 1381 return -EINVAL; 1382 if (request->high_mark < 0 || request->high_mark > entry->buf_count) 1383 return -EINVAL; 1384 1385 entry->low_mark = request->low_mark; 1386 entry->high_mark = request->high_mark; 1387 1388 return 0; 1389 } 1390 1391 /** 1392 * Unreserve the buffers in list, previously reserved using drmDMA. 1393 * 1394 * \param inode device inode. 1395 * \param file_priv DRM file private. 1396 * \param cmd command. 1397 * \param arg pointer to a drm_buf_free structure. 1398 * \return zero on success or a negative number on failure. 1399 * 1400 * Calls free_buffer() for each used buffer. 1401 * This function is primarily used for debugging. 1402 */ 1403 int drm_legacy_freebufs(struct drm_device *dev, void *data, 1404 struct drm_file *file_priv) 1405 { 1406 struct drm_device_dma *dma = dev->dma; 1407 struct drm_buf_free *request = data; 1408 int i; 1409 int idx; 1410 struct drm_buf *buf; 1411 1412 if (!drm_core_check_feature(dev, DRIVER_LEGACY)) 1413 return -EINVAL; 1414 1415 if (!drm_core_check_feature(dev, DRIVER_HAVE_DMA)) 1416 return -EINVAL; 1417 1418 if (!dma) 1419 return -EINVAL; 1420 1421 DRM_DEBUG("%d\n", request->count); 1422 for (i = 0; i < request->count; i++) { 1423 if (copy_from_user(&idx, &request->list[i], sizeof(idx))) 1424 return -EFAULT; 1425 if (idx < 0 || idx >= dma->buf_count) { 1426 DRM_ERROR("Index %d (of %d max)\n", 1427 idx, dma->buf_count - 1); 1428 return -EINVAL; 1429 } 1430 buf = dma->buflist[idx]; 1431 if (buf->file_priv != file_priv) { 1432 DRM_ERROR("Process %d freeing buffer not owned\n", 1433 DRM_CURRENTPID); 1434 return -EINVAL; 1435 } 1436 drm_legacy_free_buffer(dev, buf); 1437 } 1438 1439 return 0; 1440 } 1441 1442 /** 1443 * Maps all of the DMA buffers into client-virtual space (ioctl). 1444 * 1445 * \param inode device inode. 1446 * \param file_priv DRM file private. 1447 * \param cmd command. 1448 * \param arg pointer to a drm_buf_map structure. 1449 * \return zero on success or a negative number on failure. 1450 * 1451 * Maps the AGP, SG or PCI buffer region with vm_mmap(), and copies information 1452 * about each buffer into user space. For PCI buffers, it calls vm_mmap() with 1453 * offset equal to 0, which drm_mmap() interpretes as PCI buffers and calls 1454 * drm_mmap_dma(). 1455 */ 1456 int drm_legacy_mapbufs(struct drm_device *dev, void *data, 1457 struct drm_file *file_priv) 1458 { 1459 struct drm_device_dma *dma = dev->dma; 1460 int retcode = 0; 1461 const int zero = 0; 1462 unsigned long virtual; 1463 vm_offset_t address; 1464 struct vmspace *vms = DRM_CURPROC->td_proc->p_vmspace; 1465 struct drm_buf_map *request = data; 1466 int i; 1467 1468 if (!drm_core_check_feature(dev, DRIVER_LEGACY)) 1469 return -EINVAL; 1470 1471 if (!drm_core_check_feature(dev, DRIVER_HAVE_DMA)) 1472 return -EINVAL; 1473 1474 if (!dma) 1475 return -EINVAL; 1476 1477 lockmgr(&dev->buf_lock, LK_EXCLUSIVE); 1478 if (atomic_read(&dev->buf_alloc)) { 1479 lockmgr(&dev->buf_lock, LK_RELEASE); 1480 return -EBUSY; 1481 } 1482 dev->buf_use++; /* Can't allocate more after this call */ 1483 lockmgr(&dev->buf_lock, LK_RELEASE); 1484 1485 if (request->count >= dma->buf_count) { 1486 if ((dev->agp && (dma->flags & _DRM_DMA_USE_AGP)) 1487 || (drm_core_check_feature(dev, DRIVER_SG) 1488 && (dma->flags & _DRM_DMA_USE_SG))) { 1489 struct drm_local_map *map = dev->agp_buffer_map; 1490 unsigned long token = dev->agp_buffer_token; 1491 1492 if (!map) { 1493 retcode = -EINVAL; 1494 goto done; 1495 } 1496 virtual = vm_mmap(&vms->vm_map, 0, map->size, 1497 PROT_READ | PROT_WRITE, 1498 VM_PROT_ALL, 1499 MAP_SHARED, 1500 SLIST_FIRST(&dev->devnode->si_hlist), 1501 token); 1502 } else { 1503 virtual = vm_mmap(&vms->vm_map, 0, dma->byte_count, 1504 PROT_READ | PROT_WRITE, 1505 VM_PROT_ALL, 1506 MAP_SHARED, 1507 SLIST_FIRST(&dev->devnode->si_hlist), 1508 0); 1509 } 1510 if (virtual > -1024UL) { 1511 /* Real error */ 1512 retcode = (signed long)virtual; 1513 goto done; 1514 } 1515 request->virtual = (void __user *)virtual; 1516 1517 for (i = 0; i < dma->buf_count; i++) { 1518 if (copy_to_user(&request->list[i].idx, 1519 &dma->buflist[i]->idx, 1520 sizeof(request->list[0].idx))) { 1521 retcode = -EFAULT; 1522 goto done; 1523 } 1524 if (copy_to_user(&request->list[i].total, 1525 &dma->buflist[i]->total, 1526 sizeof(request->list[0].total))) { 1527 retcode = -EFAULT; 1528 goto done; 1529 } 1530 if (copy_to_user(&request->list[i].used, 1531 &zero, sizeof(zero))) { 1532 retcode = -EFAULT; 1533 goto done; 1534 } 1535 address = virtual + dma->buflist[i]->offset; /* *** */ 1536 if (copy_to_user(&request->list[i].address, 1537 &address, sizeof(address))) { 1538 retcode = -EFAULT; 1539 goto done; 1540 } 1541 } 1542 } 1543 done: 1544 request->count = dma->buf_count; 1545 DRM_DEBUG("%d buffers, retcode = %d\n", request->count, retcode); 1546 1547 return retcode; 1548 } 1549 1550 int drm_legacy_dma_ioctl(struct drm_device *dev, void *data, 1551 struct drm_file *file_priv) 1552 { 1553 if (!drm_core_check_feature(dev, DRIVER_LEGACY)) 1554 return -EINVAL; 1555 1556 if (dev->driver->dma_ioctl) 1557 return dev->driver->dma_ioctl(dev, data, file_priv); 1558 else 1559 return -EINVAL; 1560 } 1561 1562 struct drm_local_map *drm_legacy_getsarea(struct drm_device *dev) 1563 { 1564 struct drm_map_list *entry; 1565 1566 list_for_each_entry(entry, &dev->maplist, head) { 1567 if (entry->map && entry->map->type == _DRM_SHM && 1568 (entry->map->flags & _DRM_CONTAINS_LOCK)) { 1569 return entry->map; 1570 } 1571 } 1572 return NULL; 1573 } 1574 EXPORT_SYMBOL(drm_legacy_getsarea); 1575