1 /**
2 * \file drm_bufs.c
3 * Generic buffer template
4 *
5 * \author Rickard E. (Rik) Faith <faith@valinux.com>
6 * \author Gareth Hughes <gareth@valinux.com>
7 */
8
9 /*
10 * Created: Thu Nov 23 03:10:50 2000 by gareth@valinux.com
11 *
12 * Copyright 1999, 2000 Precision Insight, Inc., Cedar Park, Texas.
13 * Copyright 2000 VA Linux Systems, Inc., Sunnyvale, California.
14 * All Rights Reserved.
15 *
16 * Permission is hereby granted, free of charge, to any person obtaining a
17 * copy of this software and associated documentation files (the "Software"),
18 * to deal in the Software without restriction, including without limitation
19 * the rights to use, copy, modify, merge, publish, distribute, sublicense,
20 * and/or sell copies of the Software, and to permit persons to whom the
21 * Software is furnished to do so, subject to the following conditions:
22 *
23 * The above copyright notice and this permission notice (including the next
24 * paragraph) shall be included in all copies or substantial portions of the
25 * Software.
26 *
27 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
28 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
29 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
30 * VA LINUX SYSTEMS AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM, DAMAGES OR
31 * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
32 * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
33 * OTHER DEALINGS IN THE SOFTWARE.
34 */
35
36 #include <linux/vmalloc.h>
37 #include <linux/slab.h>
38 #include <linux/sched.h>
39 #include <linux/log2.h>
40 #include <linux/export.h>
41 #include <linux/mm.h>
42 #include <asm/bug.h>
43 #include <asm/io.h>
44 #include <asm/shmparam.h>
45 #include <drm/drmP.h>
46
drm_find_matching_map(struct drm_device * dev,struct drm_local_map * map)47 static struct drm_map_list *drm_find_matching_map(struct drm_device *dev,
48 struct drm_local_map *map)
49 {
50 struct drm_map_list *entry;
51 list_for_each_entry(entry, &dev->maplist, head) {
52 /*
53 * Because the kernel-userspace ABI is fixed at a 32-bit offset
54 * while PCI resources may live above that, we only compare the
55 * lower 32 bits of the map offset for maps of type
56 * _DRM_FRAMEBUFFER or _DRM_REGISTERS.
57 * It is assumed that if a driver have more than one resource
58 * of each type, the lower 32 bits are different.
59 */
60 if (!entry->map ||
61 map->type != entry->map->type ||
62 entry->master != dev->primary->master)
63 continue;
64 switch (map->type) {
65 case _DRM_SHM:
66 if (map->flags != _DRM_CONTAINS_LOCK)
67 break;
68 return entry;
69 case _DRM_REGISTERS:
70 case _DRM_FRAME_BUFFER:
71 if ((entry->map->offset & 0xffffffff) ==
72 (map->offset & 0xffffffff))
73 return entry;
74 default: /* Make gcc happy */
75 ;
76 }
77 if (entry->map->offset == map->offset)
78 return entry;
79 }
80
81 return NULL;
82 }
83
drm_map_handle(struct drm_device * dev,struct drm_hash_item * hash,unsigned long user_token,int hashed_handle,int shm)84 static int drm_map_handle(struct drm_device *dev, struct drm_hash_item *hash,
85 unsigned long user_token, int hashed_handle, int shm)
86 {
87 int use_hashed_handle, shift;
88 unsigned long add;
89
90 use_hashed_handle = (user_token &~ 0xffffffffUL) || hashed_handle;
91 if (!use_hashed_handle) {
92 int ret;
93 hash->key = user_token >> PAGE_SHIFT;
94 ret = drm_ht_insert_item(&dev->map_hash, hash);
95 if (ret != -EINVAL)
96 return ret;
97 }
98
99 shift = 0;
100 add = DRM_MAP_HASH_OFFSET >> PAGE_SHIFT;
101 if (shm && (SHMLBA > PAGE_SIZE)) {
102 int bits = ilog2(SHMLBA >> PAGE_SHIFT) + 1;
103
104 /* For shared memory, we have to preserve the SHMLBA
105 * bits of the eventual vma->vm_pgoff value during
106 * mmap(). Otherwise we run into cache aliasing problems
107 * on some platforms. On these platforms, the pgoff of
108 * a mmap() request is used to pick a suitable virtual
109 * address for the mmap() region such that it will not
110 * cause cache aliasing problems.
111 *
112 * Therefore, make sure the SHMLBA relevant bits of the
113 * hash value we use are equal to those in the original
114 * kernel virtual address.
115 */
116 shift = bits;
117 add |= ((user_token >> PAGE_SHIFT) & ((1UL << bits) - 1UL));
118 }
119
120 return drm_ht_just_insert_please(&dev->map_hash, hash,
121 user_token, 32 - PAGE_SHIFT - 3,
122 shift, add);
123 }
124
125 /**
126 * Core function to create a range of memory available for mapping by a
127 * non-root process.
128 *
129 * Adjusts the memory offset to its absolute value according to the mapping
130 * type. Adds the map to the map list drm_device::maplist. Adds MTRR's where
131 * applicable and if supported by the kernel.
132 */
drm_addmap_core(struct drm_device * dev,resource_size_t offset,unsigned int size,enum drm_map_type type,enum drm_map_flags flags,struct drm_map_list ** maplist)133 static int drm_addmap_core(struct drm_device * dev, resource_size_t offset,
134 unsigned int size, enum drm_map_type type,
135 enum drm_map_flags flags,
136 struct drm_map_list ** maplist)
137 {
138 struct drm_local_map *map;
139 struct drm_map_list *list;
140 drm_dma_handle_t *dmah;
141 unsigned long user_token;
142 int ret;
143
144 map = kmalloc(sizeof(*map), GFP_KERNEL);
145 if (!map)
146 return -ENOMEM;
147
148 map->offset = offset;
149 map->size = size;
150 map->flags = flags;
151 map->type = type;
152
153 /* Only allow shared memory to be removable since we only keep enough
154 * book keeping information about shared memory to allow for removal
155 * when processes fork.
156 */
157 if ((map->flags & _DRM_REMOVABLE) && map->type != _DRM_SHM) {
158 kfree(map);
159 return -EINVAL;
160 }
161 DRM_DEBUG("offset = 0x%08llx, size = 0x%08lx, type = %d\n",
162 (unsigned long long)map->offset, map->size, map->type);
163
164 /* page-align _DRM_SHM maps. They are allocated here so there is no security
165 * hole created by that and it works around various broken drivers that use
166 * a non-aligned quantity to map the SAREA. --BenH
167 */
168 if (map->type == _DRM_SHM)
169 map->size = PAGE_ALIGN(map->size);
170
171 if ((map->offset & (~(resource_size_t)PAGE_MASK)) || (map->size & (~PAGE_MASK))) {
172 kfree(map);
173 return -EINVAL;
174 }
175 map->mtrr = -1;
176 map->handle = NULL;
177
178 switch (map->type) {
179 case _DRM_REGISTERS:
180 case _DRM_FRAME_BUFFER:
181 #ifndef __NetBSD__ /* XXX No idea what this is for... */
182 #if !defined(__sparc__) && !defined(__alpha__) && !defined(__ia64__) && !defined(__powerpc64__) && !defined(__x86_64__) && !defined(__arm__)
183 if (map->offset + (map->size-1) < map->offset ||
184 map->offset < virt_to_phys(high_memory)) {
185 kfree(map);
186 return -EINVAL;
187 }
188 #endif
189 #endif
190 /* Some drivers preinitialize some maps, without the X Server
191 * needing to be aware of it. Therefore, we just return success
192 * when the server tries to create a duplicate map.
193 */
194 list = drm_find_matching_map(dev, map);
195 if (list != NULL) {
196 if (list->map->size != map->size) {
197 DRM_DEBUG("Matching maps of type %d with "
198 "mismatched sizes, (%ld vs %ld)\n",
199 map->type, map->size,
200 list->map->size);
201 list->map->size = map->size;
202 }
203
204 kfree(map);
205 *maplist = list;
206 return 0;
207 }
208
209 if (map->type == _DRM_FRAME_BUFFER ||
210 (map->flags & _DRM_WRITE_COMBINING)) {
211 map->mtrr =
212 arch_phys_wc_add(map->offset, map->size);
213 }
214 if (map->type == _DRM_REGISTERS) {
215 #ifdef __NetBSD__
216 drm_core_ioremap(map, dev);
217 #else
218 if (map->flags & _DRM_WRITE_COMBINING)
219 map->handle = ioremap_wc(map->offset,
220 map->size);
221 else
222 map->handle = ioremap(map->offset, map->size);
223 #endif
224 if (!map->handle) {
225 kfree(map);
226 return -ENOMEM;
227 }
228 }
229
230 break;
231 case _DRM_SHM:
232 list = drm_find_matching_map(dev, map);
233 if (list != NULL) {
234 if(list->map->size != map->size) {
235 DRM_DEBUG("Matching maps of type %d with "
236 "mismatched sizes, (%ld vs %ld)\n",
237 map->type, map->size, list->map->size);
238 list->map->size = map->size;
239 }
240
241 kfree(map);
242 *maplist = list;
243 return 0;
244 }
245 map->handle = vmalloc_user(map->size);
246 DRM_DEBUG("%lu %d %p\n",
247 map->size, order_base_2(map->size), map->handle);
248 if (!map->handle) {
249 kfree(map);
250 return -ENOMEM;
251 }
252 map->offset = (unsigned long)map->handle;
253 if (map->flags & _DRM_CONTAINS_LOCK) {
254 /* Prevent a 2nd X Server from creating a 2nd lock */
255 spin_lock(&dev->primary->master->lock.spinlock);
256 if (dev->primary->master->lock.hw_lock != NULL) {
257 vfree(map->handle);
258 kfree(map);
259 spin_unlock(&dev->primary->master->lock.spinlock);
260 return -EBUSY;
261 }
262 dev->sigdata.lock = dev->primary->master->lock.hw_lock = map->handle; /* Pointer to lock */
263 spin_unlock(&dev->primary->master->lock.spinlock);
264 }
265 break;
266 case _DRM_AGP: {
267 struct drm_agp_mem *entry;
268 int valid = 0;
269
270 if (!dev->agp) {
271 kfree(map);
272 return -EINVAL;
273 }
274 #ifdef __alpha__
275 map->offset += dev->hose->mem_space->start;
276 #endif
277 /* In some cases (i810 driver), user space may have already
278 * added the AGP base itself, because dev->agp->base previously
279 * only got set during AGP enable. So, only add the base
280 * address if the map's offset isn't already within the
281 * aperture.
282 */
283 #ifdef __NetBSD__
284 if (map->offset < dev->agp->base ||
285 map->offset > dev->agp->base +
286 dev->agp->agp_info.aki_info.ai_aperture_size - 1) {
287 map->offset += dev->agp->base;
288 }
289 #else
290 if (map->offset < dev->agp->base ||
291 map->offset > dev->agp->base +
292 dev->agp->agp_info.aper_size * 1024 * 1024 - 1) {
293 map->offset += dev->agp->base;
294 }
295 #endif
296 map->mtrr = dev->agp->agp_mtrr; /* for getmap */
297
298 /* This assumes the DRM is in total control of AGP space.
299 * It's not always the case as AGP can be in the control
300 * of user space (i.e. i810 driver). So this loop will get
301 * skipped and we double check that dev->agp->memory is
302 * actually set as well as being invalid before EPERM'ing
303 */
304 list_for_each_entry(entry, &dev->agp->memory, head) {
305 if ((map->offset >= entry->bound) &&
306 (map->offset + map->size <= entry->bound + entry->pages * PAGE_SIZE)) {
307 valid = 1;
308 break;
309 }
310 }
311 if (!list_empty(&dev->agp->memory) && !valid) {
312 kfree(map);
313 return -EPERM;
314 }
315 DRM_DEBUG("AGP offset = 0x%08llx, size = 0x%08lx\n",
316 (unsigned long long)map->offset, map->size);
317
318 break;
319 }
320 case _DRM_SCATTER_GATHER:
321 if (!dev->sg) {
322 kfree(map);
323 return -EINVAL;
324 }
325 map->offset += (unsigned long)dev->sg->virtual;
326 break;
327 case _DRM_CONSISTENT:
328 /* dma_addr_t is 64bit on i386 with CONFIG_HIGHMEM64G,
329 * As we're limiting the address to 2^32-1 (or less),
330 * casting it down to 32 bits is no problem, but we
331 * need to point to a 64bit variable first. */
332 dmah = drm_pci_alloc(dev, map->size, map->size);
333 if (!dmah) {
334 kfree(map);
335 return -ENOMEM;
336 }
337 map->handle = dmah->vaddr;
338 map->offset = (unsigned long)dmah->busaddr;
339 #ifdef __NetBSD__
340 map->lm_data.dmah = dmah;
341 #else
342 kfree(dmah);
343 #endif
344 break;
345 default:
346 kfree(map);
347 return -EINVAL;
348 }
349
350 list = kzalloc(sizeof(*list), GFP_KERNEL);
351 if (!list) {
352 if (map->type == _DRM_REGISTERS)
353 #ifdef __NetBSD__
354 drm_core_ioremapfree(map, dev);
355 #else
356 iounmap(map->handle);
357 #endif
358 kfree(map);
359 return -EINVAL;
360 }
361 list->map = map;
362
363 mutex_lock(&dev->struct_mutex);
364 list_add(&list->head, &dev->maplist);
365
366 /* Assign a 32-bit handle */
367 /* We do it here so that dev->struct_mutex protects the increment */
368 user_token = (map->type == _DRM_SHM) ? (unsigned long)map->handle :
369 map->offset;
370 ret = drm_map_handle(dev, &list->hash, user_token, 0,
371 (map->type == _DRM_SHM));
372 if (ret) {
373 if (map->type == _DRM_REGISTERS)
374 #ifdef __NetBSD__ /* XXX What about other map types...? */
375 drm_core_ioremapfree(map, dev);
376 #else
377 iounmap(map->handle);
378 #endif
379 kfree(map);
380 kfree(list);
381 mutex_unlock(&dev->struct_mutex);
382 return ret;
383 }
384
385 list->user_token = list->hash.key << PAGE_SHIFT;
386 mutex_unlock(&dev->struct_mutex);
387
388 if (!(map->flags & _DRM_DRIVER))
389 list->master = dev->primary->master;
390 *maplist = list;
391 return 0;
392 }
393
drm_addmap(struct drm_device * dev,resource_size_t offset,unsigned int size,enum drm_map_type type,enum drm_map_flags flags,struct drm_local_map ** map_ptr)394 int drm_addmap(struct drm_device * dev, resource_size_t offset,
395 unsigned int size, enum drm_map_type type,
396 enum drm_map_flags flags, struct drm_local_map ** map_ptr)
397 {
398 struct drm_map_list *list;
399 int rc;
400
401 rc = drm_addmap_core(dev, offset, size, type, flags, &list);
402 if (!rc)
403 *map_ptr = list->map;
404 return rc;
405 }
406
407 EXPORT_SYMBOL(drm_addmap);
408
409 /**
410 * Ioctl to specify a range of memory that is available for mapping by a
411 * non-root process.
412 *
413 * \param inode device inode.
414 * \param file_priv DRM file private.
415 * \param cmd command.
416 * \param arg pointer to a drm_map structure.
417 * \return zero on success or a negative value on error.
418 *
419 */
drm_addmap_ioctl(struct drm_device * dev,void * data,struct drm_file * file_priv)420 int drm_addmap_ioctl(struct drm_device *dev, void *data,
421 struct drm_file *file_priv)
422 {
423 struct drm_map *map = data;
424 struct drm_map_list *maplist;
425 int err;
426
427 #ifdef __NetBSD__
428 # if 0 /* XXX Old drm did this. */
429 if (!(dev->flags & (FREAD | FWRITE)))
430 return -EACCES;
431 # endif
432 if (!(DRM_SUSER() || map->type == _DRM_AGP || map->type == _DRM_SHM))
433 return -EACCES; /* XXX */
434 #else
435 if (!(capable(CAP_SYS_ADMIN) || map->type == _DRM_AGP || map->type == _DRM_SHM))
436 return -EPERM;
437 #endif
438
439 err = drm_addmap_core(dev, map->offset, map->size, map->type,
440 map->flags, &maplist);
441
442 if (err)
443 return err;
444
445 /* avoid a warning on 64-bit, this casting isn't very nice, but the API is set so too late */
446 map->handle = (void *)(unsigned long)maplist->user_token;
447
448 /*
449 * It appears that there are no users of this value whatsoever --
450 * drmAddMap just discards it. Let's not encourage its use.
451 * (Keeping drm_addmap_core's returned mtrr value would be wrong --
452 * it's not a real mtrr index anymore.)
453 */
454 map->mtrr = -1;
455
456 return 0;
457 }
458
459 /**
460 * Remove a map private from list and deallocate resources if the mapping
461 * isn't in use.
462 *
463 * Searches the map on drm_device::maplist, removes it from the list, see if
464 * its being used, and free any associate resource (such as MTRR's) if it's not
465 * being on use.
466 *
467 * \sa drm_addmap
468 */
drm_rmmap_locked(struct drm_device * dev,struct drm_local_map * map)469 int drm_rmmap_locked(struct drm_device *dev, struct drm_local_map *map)
470 {
471 struct drm_map_list *r_list = NULL, *list_t;
472 #ifndef __NetBSD__
473 drm_dma_handle_t dmah;
474 #endif
475 int found = 0;
476 struct drm_master *master;
477
478 /* Find the list entry for the map and remove it */
479 list_for_each_entry_safe(r_list, list_t, &dev->maplist, head) {
480 if (r_list->map == map) {
481 master = r_list->master;
482 list_del(&r_list->head);
483 drm_ht_remove_key(&dev->map_hash,
484 r_list->user_token >> PAGE_SHIFT);
485 kfree(r_list);
486 found = 1;
487 break;
488 }
489 }
490
491 if (!found)
492 return -EINVAL;
493
494 switch (map->type) {
495 case _DRM_REGISTERS:
496 #ifdef __NetBSD__
497 drm_core_ioremapfree(map, dev);
498 #else
499 iounmap(map->handle);
500 #endif
501 /* FALLTHROUGH */
502 case _DRM_FRAME_BUFFER:
503 arch_phys_wc_del(map->mtrr);
504 break;
505 case _DRM_SHM:
506 if (master && (map->flags & _DRM_CONTAINS_LOCK)) {
507 spin_lock(&master->lock.spinlock);
508 /*
509 * If we successfully removed this mapping,
510 * then the mapping must have been there in the
511 * first place, and we must have had a
512 * heavyweight lock, so we assert here instead
513 * of just checking and failing.
514 *
515 * XXX What about the _DRM_CONTAINS_LOCK flag?
516 * Where is that supposed to be set? Is it
517 * equivalent to having a master set?
518 *
519 * XXX There is copypasta of this in
520 * drm_fops.c.
521 */
522 BUG_ON(master->lock.hw_lock == NULL);
523 if (dev->sigdata.lock == master->lock.hw_lock)
524 dev->sigdata.lock = NULL;
525 master->lock.hw_lock = NULL; /* SHM removed */
526 master->lock.file_priv = NULL;
527 #ifdef __NetBSD__
528 DRM_SPIN_WAKEUP_ALL(&master->lock.lock_queue,
529 &master->lock.spinlock);
530 #else
531 wake_up_interruptible_all(&master->lock.lock_queue);
532 #endif
533 spin_unlock(&master->lock.spinlock);
534 }
535 vfree(map->handle);
536 break;
537 case _DRM_AGP:
538 case _DRM_SCATTER_GATHER:
539 break;
540 case _DRM_CONSISTENT:
541 #ifdef __NetBSD__
542 drm_pci_free(dev, map->lm_data.dmah);
543 #else
544 dmah.vaddr = map->handle;
545 dmah.busaddr = map->offset;
546 dmah.size = map->size;
547 __drm_pci_free(dev, &dmah);
548 #endif
549 break;
550 }
551 kfree(map);
552
553 return 0;
554 }
555 EXPORT_SYMBOL(drm_rmmap_locked);
556
drm_rmmap(struct drm_device * dev,struct drm_local_map * map)557 int drm_rmmap(struct drm_device *dev, struct drm_local_map *map)
558 {
559 int ret;
560
561 mutex_lock(&dev->struct_mutex);
562 ret = drm_rmmap_locked(dev, map);
563 mutex_unlock(&dev->struct_mutex);
564
565 return ret;
566 }
567 EXPORT_SYMBOL(drm_rmmap);
568
569 /* The rmmap ioctl appears to be unnecessary. All mappings are torn down on
570 * the last close of the device, and this is necessary for cleanup when things
571 * exit uncleanly. Therefore, having userland manually remove mappings seems
572 * like a pointless exercise since they're going away anyway.
573 *
574 * One use case might be after addmap is allowed for normal users for SHM and
575 * gets used by drivers that the server doesn't need to care about. This seems
576 * unlikely.
577 *
578 * \param inode device inode.
579 * \param file_priv DRM file private.
580 * \param cmd command.
581 * \param arg pointer to a struct drm_map structure.
582 * \return zero on success or a negative value on error.
583 */
drm_rmmap_ioctl(struct drm_device * dev,void * data,struct drm_file * file_priv)584 int drm_rmmap_ioctl(struct drm_device *dev, void *data,
585 struct drm_file *file_priv)
586 {
587 struct drm_map *request = data;
588 struct drm_local_map *map = NULL;
589 struct drm_map_list *r_list;
590 int ret;
591
592 mutex_lock(&dev->struct_mutex);
593 list_for_each_entry(r_list, &dev->maplist, head) {
594 if (r_list->map &&
595 r_list->user_token == (unsigned long)request->handle &&
596 r_list->map->flags & _DRM_REMOVABLE) {
597 map = r_list->map;
598 break;
599 }
600 }
601
602 /* List has wrapped around to the head pointer, or its empty we didn't
603 * find anything.
604 */
605 if (list_empty(&dev->maplist) || !map) {
606 mutex_unlock(&dev->struct_mutex);
607 return -EINVAL;
608 }
609
610 /* Register and framebuffer maps are permanent */
611 if ((map->type == _DRM_REGISTERS) || (map->type == _DRM_FRAME_BUFFER)) {
612 mutex_unlock(&dev->struct_mutex);
613 return 0;
614 }
615
616 ret = drm_rmmap_locked(dev, map);
617
618 mutex_unlock(&dev->struct_mutex);
619
620 return ret;
621 }
622
623 /**
624 * Cleanup after an error on one of the addbufs() functions.
625 *
626 * \param dev DRM device.
627 * \param entry buffer entry where the error occurred.
628 *
629 * Frees any pages and buffers associated with the given entry.
630 */
drm_cleanup_buf_error(struct drm_device * dev,struct drm_buf_entry * entry)631 static void drm_cleanup_buf_error(struct drm_device * dev,
632 struct drm_buf_entry * entry)
633 {
634 int i;
635
636 if (entry->seg_count) {
637 for (i = 0; i < entry->seg_count; i++) {
638 if (entry->seglist[i]) {
639 drm_pci_free(dev, entry->seglist[i]);
640 }
641 }
642 kfree(entry->seglist);
643
644 entry->seg_count = 0;
645 }
646
647 if (entry->buf_count) {
648 for (i = 0; i < entry->buf_count; i++) {
649 kfree(entry->buflist[i].dev_private);
650 }
651 kfree(entry->buflist);
652
653 entry->buf_count = 0;
654 }
655 }
656
657 #if __OS_HAS_AGP
658 /**
659 * Add AGP buffers for DMA transfers.
660 *
661 * \param dev struct drm_device to which the buffers are to be added.
662 * \param request pointer to a struct drm_buf_desc describing the request.
663 * \return zero on success or a negative number on failure.
664 *
665 * After some sanity checks creates a drm_buf structure for each buffer and
666 * reallocates the buffer list of the same size order to accommodate the new
667 * buffers.
668 */
drm_addbufs_agp(struct drm_device * dev,struct drm_buf_desc * request)669 int drm_addbufs_agp(struct drm_device * dev, struct drm_buf_desc * request)
670 {
671 struct drm_device_dma *dma = dev->dma;
672 struct drm_buf_entry *entry;
673 struct drm_agp_mem *agp_entry;
674 struct drm_buf *buf;
675 unsigned long offset;
676 unsigned long agp_offset;
677 int count;
678 int order;
679 int size;
680 int alignment;
681 int page_order;
682 int total;
683 int byte_count;
684 int i, valid;
685 struct drm_buf **temp_buflist;
686
687 if (!dma)
688 return -EINVAL;
689
690 count = request->count;
691 order = order_base_2(request->size);
692 size = 1 << order;
693
694 alignment = (request->flags & _DRM_PAGE_ALIGN)
695 ? PAGE_ALIGN(size) : size;
696 page_order = order - PAGE_SHIFT > 0 ? order - PAGE_SHIFT : 0;
697 total = PAGE_SIZE << page_order;
698
699 byte_count = 0;
700 agp_offset = dev->agp->base + request->agp_start;
701
702 DRM_DEBUG("count: %d\n", count);
703 DRM_DEBUG("order: %d\n", order);
704 DRM_DEBUG("size: %d\n", size);
705 DRM_DEBUG("agp_offset: %lx\n", agp_offset);
706 DRM_DEBUG("alignment: %d\n", alignment);
707 DRM_DEBUG("page_order: %d\n", page_order);
708 DRM_DEBUG("total: %d\n", total);
709
710 if (order < DRM_MIN_ORDER || order > DRM_MAX_ORDER)
711 return -EINVAL;
712
713 /* Make sure buffers are located in AGP memory that we own */
714 valid = 0;
715 list_for_each_entry(agp_entry, &dev->agp->memory, head) {
716 if ((agp_offset >= agp_entry->bound) &&
717 (agp_offset + total * count <= agp_entry->bound + agp_entry->pages * PAGE_SIZE)) {
718 valid = 1;
719 break;
720 }
721 }
722 if (!list_empty(&dev->agp->memory) && !valid) {
723 DRM_DEBUG("zone invalid\n");
724 return -EINVAL;
725 }
726 spin_lock(&dev->count_lock);
727 if (dev->buf_use) {
728 spin_unlock(&dev->count_lock);
729 return -EBUSY;
730 }
731 atomic_inc(&dev->buf_alloc);
732 spin_unlock(&dev->count_lock);
733
734 mutex_lock(&dev->struct_mutex);
735 entry = &dma->bufs[order];
736 if (entry->buf_count) {
737 mutex_unlock(&dev->struct_mutex);
738 atomic_dec(&dev->buf_alloc);
739 return -ENOMEM; /* May only call once for each order */
740 }
741
742 if (count < 0 || count > 4096) {
743 mutex_unlock(&dev->struct_mutex);
744 atomic_dec(&dev->buf_alloc);
745 return -EINVAL;
746 }
747
748 entry->buflist = kzalloc(count * sizeof(*entry->buflist), GFP_KERNEL);
749 if (!entry->buflist) {
750 mutex_unlock(&dev->struct_mutex);
751 atomic_dec(&dev->buf_alloc);
752 return -ENOMEM;
753 }
754
755 entry->buf_size = size;
756 entry->page_order = page_order;
757
758 offset = 0;
759
760 while (entry->buf_count < count) {
761 buf = &entry->buflist[entry->buf_count];
762 buf->idx = dma->buf_count + entry->buf_count;
763 buf->total = alignment;
764 buf->order = order;
765 buf->used = 0;
766
767 buf->offset = (dma->byte_count + offset);
768 buf->bus_address = agp_offset + offset;
769 buf->address = (void *)(agp_offset + offset);
770 buf->next = NULL;
771 buf->waiting = 0;
772 buf->pending = 0;
773 buf->file_priv = NULL;
774
775 buf->dev_priv_size = dev->driver->dev_priv_size;
776 buf->dev_private = kzalloc(buf->dev_priv_size, GFP_KERNEL);
777 if (!buf->dev_private) {
778 /* Set count correctly so we free the proper amount. */
779 entry->buf_count = count;
780 drm_cleanup_buf_error(dev, entry);
781 mutex_unlock(&dev->struct_mutex);
782 atomic_dec(&dev->buf_alloc);
783 return -ENOMEM;
784 }
785
786 DRM_DEBUG("buffer %d @ %p\n", entry->buf_count, buf->address);
787
788 offset += alignment;
789 entry->buf_count++;
790 byte_count += PAGE_SIZE << page_order;
791 }
792
793 DRM_DEBUG("byte_count: %d\n", byte_count);
794
795 temp_buflist = krealloc(dma->buflist,
796 (dma->buf_count + entry->buf_count) *
797 sizeof(*dma->buflist), GFP_KERNEL);
798 if (!temp_buflist) {
799 /* Free the entry because it isn't valid */
800 drm_cleanup_buf_error(dev, entry);
801 mutex_unlock(&dev->struct_mutex);
802 atomic_dec(&dev->buf_alloc);
803 return -ENOMEM;
804 }
805 dma->buflist = temp_buflist;
806
807 for (i = 0; i < entry->buf_count; i++) {
808 dma->buflist[i + dma->buf_count] = &entry->buflist[i];
809 }
810
811 dma->buf_count += entry->buf_count;
812 dma->seg_count += entry->seg_count;
813 dma->page_count += byte_count >> PAGE_SHIFT;
814 dma->byte_count += byte_count;
815
816 DRM_DEBUG("dma->buf_count : %d\n", dma->buf_count);
817 DRM_DEBUG("entry->buf_count : %d\n", entry->buf_count);
818
819 mutex_unlock(&dev->struct_mutex);
820
821 request->count = entry->buf_count;
822 request->size = size;
823
824 dma->flags = _DRM_DMA_USE_AGP;
825
826 atomic_dec(&dev->buf_alloc);
827 return 0;
828 }
829 EXPORT_SYMBOL(drm_addbufs_agp);
830 #endif /* __OS_HAS_AGP */
831
drm_addbufs_pci(struct drm_device * dev,struct drm_buf_desc * request)832 int drm_addbufs_pci(struct drm_device * dev, struct drm_buf_desc * request)
833 {
834 struct drm_device_dma *dma = dev->dma;
835 int count;
836 int order;
837 int size;
838 int total;
839 int page_order;
840 struct drm_buf_entry *entry;
841 drm_dma_handle_t *dmah;
842 struct drm_buf *buf;
843 int alignment;
844 unsigned long offset;
845 int i;
846 int byte_count;
847 int page_count;
848 unsigned long *temp_pagelist;
849 struct drm_buf **temp_buflist;
850
851 if (!drm_core_check_feature(dev, DRIVER_PCI_DMA))
852 return -EINVAL;
853
854 if (!dma)
855 return -EINVAL;
856
857 #ifdef __NetBSD__
858 if (!DRM_SUSER())
859 return -EACCES; /* XXX */
860 #else
861 if (!capable(CAP_SYS_ADMIN))
862 return -EPERM;
863 #endif
864
865 count = request->count;
866 order = order_base_2(request->size);
867 size = 1 << order;
868
869 DRM_DEBUG("count=%d, size=%d (%d), order=%d\n",
870 request->count, request->size, size, order);
871
872 if (order < DRM_MIN_ORDER || order > DRM_MAX_ORDER)
873 return -EINVAL;
874
875 alignment = (request->flags & _DRM_PAGE_ALIGN)
876 ? PAGE_ALIGN(size) : size;
877 page_order = order - PAGE_SHIFT > 0 ? order - PAGE_SHIFT : 0;
878 total = PAGE_SIZE << page_order;
879
880 spin_lock(&dev->count_lock);
881 if (dev->buf_use) {
882 spin_unlock(&dev->count_lock);
883 return -EBUSY;
884 }
885 atomic_inc(&dev->buf_alloc);
886 spin_unlock(&dev->count_lock);
887
888 mutex_lock(&dev->struct_mutex);
889 entry = &dma->bufs[order];
890 if (entry->buf_count) {
891 mutex_unlock(&dev->struct_mutex);
892 atomic_dec(&dev->buf_alloc);
893 return -ENOMEM; /* May only call once for each order */
894 }
895
896 if (count < 0 || count > 4096) {
897 mutex_unlock(&dev->struct_mutex);
898 atomic_dec(&dev->buf_alloc);
899 return -EINVAL;
900 }
901
902 entry->buflist = kzalloc(count * sizeof(*entry->buflist), GFP_KERNEL);
903 if (!entry->buflist) {
904 mutex_unlock(&dev->struct_mutex);
905 atomic_dec(&dev->buf_alloc);
906 return -ENOMEM;
907 }
908
909 entry->seglist = kzalloc(count * sizeof(*entry->seglist), GFP_KERNEL);
910 if (!entry->seglist) {
911 kfree(entry->buflist);
912 mutex_unlock(&dev->struct_mutex);
913 atomic_dec(&dev->buf_alloc);
914 return -ENOMEM;
915 }
916
917 /* Keep the original pagelist until we know all the allocations
918 * have succeeded
919 */
920 temp_pagelist = kmalloc((dma->page_count + (count << page_order)) *
921 sizeof(*dma->pagelist), GFP_KERNEL);
922 if (!temp_pagelist) {
923 kfree(entry->buflist);
924 kfree(entry->seglist);
925 mutex_unlock(&dev->struct_mutex);
926 atomic_dec(&dev->buf_alloc);
927 return -ENOMEM;
928 }
929 memcpy(temp_pagelist,
930 dma->pagelist, dma->page_count * sizeof(*dma->pagelist));
931 DRM_DEBUG("pagelist: %d entries\n",
932 dma->page_count + (count << page_order));
933
934 entry->buf_size = size;
935 entry->page_order = page_order;
936 byte_count = 0;
937 page_count = 0;
938
939 while (entry->buf_count < count) {
940
941 dmah = drm_pci_alloc(dev, PAGE_SIZE << page_order, 0x1000);
942
943 if (!dmah) {
944 /* Set count correctly so we free the proper amount. */
945 entry->buf_count = count;
946 entry->seg_count = count;
947 drm_cleanup_buf_error(dev, entry);
948 kfree(temp_pagelist);
949 mutex_unlock(&dev->struct_mutex);
950 atomic_dec(&dev->buf_alloc);
951 return -ENOMEM;
952 }
953 entry->seglist[entry->seg_count++] = dmah;
954 for (i = 0; i < (1 << page_order); i++) {
955 DRM_DEBUG("page %d @ 0x%08lx\n",
956 dma->page_count + page_count,
957 (unsigned long)dmah->vaddr + PAGE_SIZE * i);
958 temp_pagelist[dma->page_count + page_count++]
959 = (unsigned long)dmah->vaddr + PAGE_SIZE * i;
960 }
961 for (offset = 0;
962 offset + size <= total && entry->buf_count < count;
963 offset += alignment, ++entry->buf_count) {
964 buf = &entry->buflist[entry->buf_count];
965 buf->idx = dma->buf_count + entry->buf_count;
966 buf->total = alignment;
967 buf->order = order;
968 buf->used = 0;
969 buf->offset = (dma->byte_count + byte_count + offset);
970 buf->address = (void *)((char *)dmah->vaddr + offset);
971 buf->bus_address = dmah->busaddr + offset;
972 buf->next = NULL;
973 buf->waiting = 0;
974 buf->pending = 0;
975 buf->file_priv = NULL;
976
977 buf->dev_priv_size = dev->driver->dev_priv_size;
978 buf->dev_private = kzalloc(buf->dev_priv_size,
979 GFP_KERNEL);
980 if (!buf->dev_private) {
981 /* Set count correctly so we free the proper amount. */
982 entry->buf_count = count;
983 entry->seg_count = count;
984 drm_cleanup_buf_error(dev, entry);
985 kfree(temp_pagelist);
986 mutex_unlock(&dev->struct_mutex);
987 atomic_dec(&dev->buf_alloc);
988 return -ENOMEM;
989 }
990
991 DRM_DEBUG("buffer %d @ %p\n",
992 entry->buf_count, buf->address);
993 }
994 byte_count += PAGE_SIZE << page_order;
995 }
996
997 temp_buflist = krealloc(dma->buflist,
998 (dma->buf_count + entry->buf_count) *
999 sizeof(*dma->buflist), GFP_KERNEL);
1000 if (!temp_buflist) {
1001 /* Free the entry because it isn't valid */
1002 drm_cleanup_buf_error(dev, entry);
1003 kfree(temp_pagelist);
1004 mutex_unlock(&dev->struct_mutex);
1005 atomic_dec(&dev->buf_alloc);
1006 return -ENOMEM;
1007 }
1008 dma->buflist = temp_buflist;
1009
1010 for (i = 0; i < entry->buf_count; i++) {
1011 dma->buflist[i + dma->buf_count] = &entry->buflist[i];
1012 }
1013
1014 /* No allocations failed, so now we can replace the original pagelist
1015 * with the new one.
1016 */
1017 if (dma->page_count) {
1018 kfree(dma->pagelist);
1019 }
1020 dma->pagelist = temp_pagelist;
1021
1022 dma->buf_count += entry->buf_count;
1023 dma->seg_count += entry->seg_count;
1024 dma->page_count += entry->seg_count << page_order;
1025 dma->byte_count += PAGE_SIZE * (entry->seg_count << page_order);
1026
1027 mutex_unlock(&dev->struct_mutex);
1028
1029 request->count = entry->buf_count;
1030 request->size = size;
1031
1032 if (request->flags & _DRM_PCI_BUFFER_RO)
1033 dma->flags = _DRM_DMA_USE_PCI_RO;
1034
1035 atomic_dec(&dev->buf_alloc);
1036 return 0;
1037
1038 }
1039 EXPORT_SYMBOL(drm_addbufs_pci);
1040
drm_addbufs_sg(struct drm_device * dev,struct drm_buf_desc * request)1041 static int drm_addbufs_sg(struct drm_device * dev, struct drm_buf_desc * request)
1042 {
1043 struct drm_device_dma *dma = dev->dma;
1044 struct drm_buf_entry *entry;
1045 struct drm_buf *buf;
1046 unsigned long offset;
1047 unsigned long agp_offset;
1048 int count;
1049 int order;
1050 int size;
1051 int alignment;
1052 int page_order;
1053 int total;
1054 int byte_count;
1055 int i;
1056 struct drm_buf **temp_buflist;
1057
1058 if (!drm_core_check_feature(dev, DRIVER_SG))
1059 return -EINVAL;
1060
1061 if (!dma)
1062 return -EINVAL;
1063
1064 #ifdef __NetBSD__
1065 if (!DRM_SUSER())
1066 return -EACCES; /* XXX */
1067 #else
1068 if (!capable(CAP_SYS_ADMIN))
1069 return -EPERM;
1070 #endif
1071
1072 count = request->count;
1073 order = order_base_2(request->size);
1074 size = 1 << order;
1075
1076 alignment = (request->flags & _DRM_PAGE_ALIGN)
1077 ? PAGE_ALIGN(size) : size;
1078 page_order = order - PAGE_SHIFT > 0 ? order - PAGE_SHIFT : 0;
1079 total = PAGE_SIZE << page_order;
1080
1081 byte_count = 0;
1082 agp_offset = request->agp_start;
1083
1084 DRM_DEBUG("count: %d\n", count);
1085 DRM_DEBUG("order: %d\n", order);
1086 DRM_DEBUG("size: %d\n", size);
1087 DRM_DEBUG("agp_offset: %lu\n", agp_offset);
1088 DRM_DEBUG("alignment: %d\n", alignment);
1089 DRM_DEBUG("page_order: %d\n", page_order);
1090 DRM_DEBUG("total: %d\n", total);
1091
1092 if (order < DRM_MIN_ORDER || order > DRM_MAX_ORDER)
1093 return -EINVAL;
1094
1095 spin_lock(&dev->count_lock);
1096 if (dev->buf_use) {
1097 spin_unlock(&dev->count_lock);
1098 return -EBUSY;
1099 }
1100 atomic_inc(&dev->buf_alloc);
1101 spin_unlock(&dev->count_lock);
1102
1103 mutex_lock(&dev->struct_mutex);
1104 entry = &dma->bufs[order];
1105 if (entry->buf_count) {
1106 mutex_unlock(&dev->struct_mutex);
1107 atomic_dec(&dev->buf_alloc);
1108 return -ENOMEM; /* May only call once for each order */
1109 }
1110
1111 if (count < 0 || count > 4096) {
1112 mutex_unlock(&dev->struct_mutex);
1113 atomic_dec(&dev->buf_alloc);
1114 return -EINVAL;
1115 }
1116
1117 entry->buflist = kzalloc(count * sizeof(*entry->buflist),
1118 GFP_KERNEL);
1119 if (!entry->buflist) {
1120 mutex_unlock(&dev->struct_mutex);
1121 atomic_dec(&dev->buf_alloc);
1122 return -ENOMEM;
1123 }
1124
1125 entry->buf_size = size;
1126 entry->page_order = page_order;
1127
1128 offset = 0;
1129
1130 while (entry->buf_count < count) {
1131 buf = &entry->buflist[entry->buf_count];
1132 buf->idx = dma->buf_count + entry->buf_count;
1133 buf->total = alignment;
1134 buf->order = order;
1135 buf->used = 0;
1136
1137 buf->offset = (dma->byte_count + offset);
1138 buf->bus_address = agp_offset + offset;
1139 buf->address = (void *)(agp_offset + offset
1140 + (unsigned long)dev->sg->virtual);
1141 buf->next = NULL;
1142 buf->waiting = 0;
1143 buf->pending = 0;
1144 buf->file_priv = NULL;
1145
1146 buf->dev_priv_size = dev->driver->dev_priv_size;
1147 buf->dev_private = kzalloc(buf->dev_priv_size, GFP_KERNEL);
1148 if (!buf->dev_private) {
1149 /* Set count correctly so we free the proper amount. */
1150 entry->buf_count = count;
1151 drm_cleanup_buf_error(dev, entry);
1152 mutex_unlock(&dev->struct_mutex);
1153 atomic_dec(&dev->buf_alloc);
1154 return -ENOMEM;
1155 }
1156
1157 DRM_DEBUG("buffer %d @ %p\n", entry->buf_count, buf->address);
1158
1159 offset += alignment;
1160 entry->buf_count++;
1161 byte_count += PAGE_SIZE << page_order;
1162 }
1163
1164 DRM_DEBUG("byte_count: %d\n", byte_count);
1165
1166 temp_buflist = krealloc(dma->buflist,
1167 (dma->buf_count + entry->buf_count) *
1168 sizeof(*dma->buflist), GFP_KERNEL);
1169 if (!temp_buflist) {
1170 /* Free the entry because it isn't valid */
1171 drm_cleanup_buf_error(dev, entry);
1172 mutex_unlock(&dev->struct_mutex);
1173 atomic_dec(&dev->buf_alloc);
1174 return -ENOMEM;
1175 }
1176 dma->buflist = temp_buflist;
1177
1178 for (i = 0; i < entry->buf_count; i++) {
1179 dma->buflist[i + dma->buf_count] = &entry->buflist[i];
1180 }
1181
1182 dma->buf_count += entry->buf_count;
1183 dma->seg_count += entry->seg_count;
1184 dma->page_count += byte_count >> PAGE_SHIFT;
1185 dma->byte_count += byte_count;
1186
1187 DRM_DEBUG("dma->buf_count : %d\n", dma->buf_count);
1188 DRM_DEBUG("entry->buf_count : %d\n", entry->buf_count);
1189
1190 mutex_unlock(&dev->struct_mutex);
1191
1192 request->count = entry->buf_count;
1193 request->size = size;
1194
1195 dma->flags = _DRM_DMA_USE_SG;
1196
1197 atomic_dec(&dev->buf_alloc);
1198 return 0;
1199 }
1200
1201 /**
1202 * Add buffers for DMA transfers (ioctl).
1203 *
1204 * \param inode device inode.
1205 * \param file_priv DRM file private.
1206 * \param cmd command.
1207 * \param arg pointer to a struct drm_buf_desc request.
1208 * \return zero on success or a negative number on failure.
1209 *
1210 * According with the memory type specified in drm_buf_desc::flags and the
1211 * build options, it dispatches the call either to addbufs_agp(),
1212 * addbufs_sg() or addbufs_pci() for AGP, scatter-gather or consistent
1213 * PCI memory respectively.
1214 */
drm_addbufs(struct drm_device * dev,void * data,struct drm_file * file_priv)1215 int drm_addbufs(struct drm_device *dev, void *data,
1216 struct drm_file *file_priv)
1217 {
1218 struct drm_buf_desc *request = data;
1219 int ret;
1220
1221 if (drm_core_check_feature(dev, DRIVER_MODESET))
1222 return -EINVAL;
1223
1224 if (!drm_core_check_feature(dev, DRIVER_HAVE_DMA))
1225 return -EINVAL;
1226
1227 #if __OS_HAS_AGP
1228 if (request->flags & _DRM_AGP_BUFFER)
1229 ret = drm_addbufs_agp(dev, request);
1230 else
1231 #endif
1232 if (request->flags & _DRM_SG_BUFFER)
1233 ret = drm_addbufs_sg(dev, request);
1234 else if (request->flags & _DRM_FB_BUFFER)
1235 ret = -EINVAL;
1236 else
1237 ret = drm_addbufs_pci(dev, request);
1238
1239 return ret;
1240 }
1241
1242 /**
1243 * Get information about the buffer mappings.
1244 *
1245 * This was originally mean for debugging purposes, or by a sophisticated
1246 * client library to determine how best to use the available buffers (e.g.,
1247 * large buffers can be used for image transfer).
1248 *
1249 * \param inode device inode.
1250 * \param file_priv DRM file private.
1251 * \param cmd command.
1252 * \param arg pointer to a drm_buf_info structure.
1253 * \return zero on success or a negative number on failure.
1254 *
1255 * Increments drm_device::buf_use while holding the drm_device::count_lock
1256 * lock, preventing of allocating more buffers after this call. Information
1257 * about each requested buffer is then copied into user space.
1258 */
drm_infobufs(struct drm_device * dev,void * data,struct drm_file * file_priv)1259 int drm_infobufs(struct drm_device *dev, void *data,
1260 struct drm_file *file_priv)
1261 {
1262 struct drm_device_dma *dma = dev->dma;
1263 struct drm_buf_info *request = data;
1264 int i;
1265 int count;
1266
1267 if (drm_core_check_feature(dev, DRIVER_MODESET))
1268 return -EINVAL;
1269
1270 if (!drm_core_check_feature(dev, DRIVER_HAVE_DMA))
1271 return -EINVAL;
1272
1273 if (!dma)
1274 return -EINVAL;
1275
1276 spin_lock(&dev->count_lock);
1277 if (atomic_read(&dev->buf_alloc)) {
1278 spin_unlock(&dev->count_lock);
1279 return -EBUSY;
1280 }
1281 ++dev->buf_use; /* Can't allocate more after this call */
1282 spin_unlock(&dev->count_lock);
1283
1284 for (i = 0, count = 0; i < DRM_MAX_ORDER + 1; i++) {
1285 if (dma->bufs[i].buf_count)
1286 ++count;
1287 }
1288
1289 DRM_DEBUG("count = %d\n", count);
1290
1291 if (request->count >= count) {
1292 for (i = 0, count = 0; i < DRM_MAX_ORDER + 1; i++) {
1293 if (dma->bufs[i].buf_count) {
1294 struct drm_buf_desc __user *to =
1295 &request->list[count];
1296 struct drm_buf_entry *from = &dma->bufs[i];
1297 struct drm_freelist *list = &dma->bufs[i].freelist;
1298 if (copy_to_user(&to->count,
1299 &from->buf_count,
1300 sizeof(from->buf_count)) ||
1301 copy_to_user(&to->size,
1302 &from->buf_size,
1303 sizeof(from->buf_size)) ||
1304 copy_to_user(&to->low_mark,
1305 &list->low_mark,
1306 sizeof(list->low_mark)) ||
1307 copy_to_user(&to->high_mark,
1308 &list->high_mark,
1309 sizeof(list->high_mark)))
1310 return -EFAULT;
1311
1312 DRM_DEBUG("%d %d %d %d %d\n",
1313 i,
1314 dma->bufs[i].buf_count,
1315 dma->bufs[i].buf_size,
1316 dma->bufs[i].freelist.low_mark,
1317 dma->bufs[i].freelist.high_mark);
1318 ++count;
1319 }
1320 }
1321 }
1322 request->count = count;
1323
1324 return 0;
1325 }
1326
1327 /**
1328 * Specifies a low and high water mark for buffer allocation
1329 *
1330 * \param inode device inode.
1331 * \param file_priv DRM file private.
1332 * \param cmd command.
1333 * \param arg a pointer to a drm_buf_desc structure.
1334 * \return zero on success or a negative number on failure.
1335 *
1336 * Verifies that the size order is bounded between the admissible orders and
1337 * updates the respective drm_device_dma::bufs entry low and high water mark.
1338 *
1339 * \note This ioctl is deprecated and mostly never used.
1340 */
drm_markbufs(struct drm_device * dev,void * data,struct drm_file * file_priv)1341 int drm_markbufs(struct drm_device *dev, void *data,
1342 struct drm_file *file_priv)
1343 {
1344 struct drm_device_dma *dma = dev->dma;
1345 struct drm_buf_desc *request = data;
1346 int order;
1347 struct drm_buf_entry *entry;
1348
1349 if (drm_core_check_feature(dev, DRIVER_MODESET))
1350 return -EINVAL;
1351
1352 if (!drm_core_check_feature(dev, DRIVER_HAVE_DMA))
1353 return -EINVAL;
1354
1355 if (!dma)
1356 return -EINVAL;
1357
1358 DRM_DEBUG("%d, %d, %d\n",
1359 request->size, request->low_mark, request->high_mark);
1360 order = order_base_2(request->size);
1361 if (order < DRM_MIN_ORDER || order > DRM_MAX_ORDER)
1362 return -EINVAL;
1363 entry = &dma->bufs[order];
1364
1365 if (request->low_mark < 0 || request->low_mark > entry->buf_count)
1366 return -EINVAL;
1367 if (request->high_mark < 0 || request->high_mark > entry->buf_count)
1368 return -EINVAL;
1369
1370 entry->freelist.low_mark = request->low_mark;
1371 entry->freelist.high_mark = request->high_mark;
1372
1373 return 0;
1374 }
1375
1376 /**
1377 * Unreserve the buffers in list, previously reserved using drmDMA.
1378 *
1379 * \param inode device inode.
1380 * \param file_priv DRM file private.
1381 * \param cmd command.
1382 * \param arg pointer to a drm_buf_free structure.
1383 * \return zero on success or a negative number on failure.
1384 *
1385 * Calls free_buffer() for each used buffer.
1386 * This function is primarily used for debugging.
1387 */
drm_freebufs(struct drm_device * dev,void * data,struct drm_file * file_priv)1388 int drm_freebufs(struct drm_device *dev, void *data,
1389 struct drm_file *file_priv)
1390 {
1391 struct drm_device_dma *dma = dev->dma;
1392 struct drm_buf_free *request = data;
1393 int i;
1394 int idx;
1395 struct drm_buf *buf;
1396
1397 if (drm_core_check_feature(dev, DRIVER_MODESET))
1398 return -EINVAL;
1399
1400 if (!drm_core_check_feature(dev, DRIVER_HAVE_DMA))
1401 return -EINVAL;
1402
1403 if (!dma)
1404 return -EINVAL;
1405
1406 DRM_DEBUG("%d\n", request->count);
1407 for (i = 0; i < request->count; i++) {
1408 if (copy_from_user(&idx, &request->list[i], sizeof(idx)))
1409 return -EFAULT;
1410 if (idx < 0 || idx >= dma->buf_count) {
1411 DRM_ERROR("Index %d (of %d max)\n",
1412 idx, dma->buf_count - 1);
1413 return -EINVAL;
1414 }
1415 buf = dma->buflist[idx];
1416 if (buf->file_priv != file_priv) {
1417 DRM_ERROR("Process %d freeing buffer not owned\n",
1418 task_pid_nr(current));
1419 return -EINVAL;
1420 }
1421 drm_free_buffer(dev, buf);
1422 }
1423
1424 return 0;
1425 }
1426
1427 /**
1428 * Maps all of the DMA buffers into client-virtual space (ioctl).
1429 *
1430 * \param inode device inode.
1431 * \param file_priv DRM file private.
1432 * \param cmd command.
1433 * \param arg pointer to a drm_buf_map structure.
1434 * \return zero on success or a negative number on failure.
1435 *
1436 * Maps the AGP, SG or PCI buffer region with vm_mmap(), and copies information
1437 * about each buffer into user space. For PCI buffers, it calls vm_mmap() with
1438 * offset equal to 0, which drm_mmap() interpretes as PCI buffers and calls
1439 * drm_mmap_dma().
1440 */
drm_mapbufs(struct drm_device * dev,void * data,struct drm_file * file_priv)1441 int drm_mapbufs(struct drm_device *dev, void *data,
1442 struct drm_file *file_priv)
1443 {
1444 struct drm_device_dma *dma = dev->dma;
1445 int retcode = 0;
1446 const int zero = 0;
1447 unsigned long virtual;
1448 unsigned long address;
1449 struct drm_buf_map *request = data;
1450 int i;
1451
1452 if (drm_core_check_feature(dev, DRIVER_MODESET))
1453 return -EINVAL;
1454
1455 if (!drm_core_check_feature(dev, DRIVER_HAVE_DMA))
1456 return -EINVAL;
1457
1458 if (!dma)
1459 return -EINVAL;
1460
1461 spin_lock(&dev->count_lock);
1462 if (atomic_read(&dev->buf_alloc)) {
1463 spin_unlock(&dev->count_lock);
1464 return -EBUSY;
1465 }
1466 dev->buf_use++; /* Can't allocate more after this call */
1467 spin_unlock(&dev->count_lock);
1468
1469 if (request->count >= dma->buf_count) {
1470 if ((dev->agp && (dma->flags & _DRM_DMA_USE_AGP))
1471 || (drm_core_check_feature(dev, DRIVER_SG)
1472 && (dma->flags & _DRM_DMA_USE_SG))) {
1473 struct drm_local_map *map = dev->agp_buffer_map;
1474 unsigned long token = dev->agp_buffer_token;
1475
1476 if (!map) {
1477 retcode = -EINVAL;
1478 goto done;
1479 }
1480 virtual = vm_mmap(file_priv->filp, 0, map->size,
1481 PROT_READ | PROT_WRITE,
1482 MAP_SHARED,
1483 token);
1484 } else {
1485 virtual = vm_mmap(file_priv->filp, 0, dma->byte_count,
1486 PROT_READ | PROT_WRITE,
1487 MAP_SHARED, 0);
1488 }
1489 if (virtual > -1024UL) {
1490 /* Real error */
1491 retcode = (signed long)virtual;
1492 goto done;
1493 }
1494 request->virtual = (void __user *)virtual;
1495
1496 for (i = 0; i < dma->buf_count; i++) {
1497 if (copy_to_user(&request->list[i].idx,
1498 &dma->buflist[i]->idx,
1499 sizeof(request->list[0].idx))) {
1500 retcode = -EFAULT;
1501 goto done;
1502 }
1503 if (copy_to_user(&request->list[i].total,
1504 &dma->buflist[i]->total,
1505 sizeof(request->list[0].total))) {
1506 retcode = -EFAULT;
1507 goto done;
1508 }
1509 if (copy_to_user(&request->list[i].used,
1510 &zero, sizeof(zero))) {
1511 retcode = -EFAULT;
1512 goto done;
1513 }
1514 address = virtual + dma->buflist[i]->offset; /* *** */
1515 if (copy_to_user(&request->list[i].address,
1516 &address, sizeof(address))) {
1517 retcode = -EFAULT;
1518 goto done;
1519 }
1520 }
1521 }
1522 done:
1523 request->count = dma->buf_count;
1524 DRM_DEBUG("%d buffers, retcode = %d\n", request->count, retcode);
1525
1526 return retcode;
1527 }
1528
drm_dma_ioctl(struct drm_device * dev,void * data,struct drm_file * file_priv)1529 int drm_dma_ioctl(struct drm_device *dev, void *data,
1530 struct drm_file *file_priv)
1531 {
1532 if (drm_core_check_feature(dev, DRIVER_MODESET))
1533 return -EINVAL;
1534
1535 if (dev->driver->dma_ioctl)
1536 return dev->driver->dma_ioctl(dev, data, file_priv);
1537 else
1538 return -EINVAL;
1539 }
1540
drm_getsarea(struct drm_device * dev)1541 struct drm_local_map *drm_getsarea(struct drm_device *dev)
1542 {
1543 struct drm_map_list *entry;
1544
1545 list_for_each_entry(entry, &dev->maplist, head) {
1546 if (entry->map && entry->map->type == _DRM_SHM &&
1547 (entry->map->flags & _DRM_CONTAINS_LOCK)) {
1548 return entry->map;
1549 }
1550 }
1551 return NULL;
1552 }
1553 EXPORT_SYMBOL(drm_getsarea);
1554