projects / linux-2.6-block.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
vmwgfx: Make sure we always have a user-space handle to use for objects that are...
[linux-2.6-block.git] / drivers / gpu / drm / vmwgfx / vmwgfx_resource.c
CommitLineData
fb1d9738
JB		 1/**************************************************************************
2 *
3 * Copyright © 2009 VMware, Inc., Palo Alto, CA., USA
4 * All Rights Reserved.
5 *
6 * Permission is hereby granted, free of charge, to any person obtaining a
7 * copy of this software and associated documentation files (the
8 * "Software"), to deal in the Software without restriction, including
9 * without limitation the rights to use, copy, modify, merge, publish,
10 * distribute, sub license, and/or sell copies of the Software, and to
11 * permit persons to whom the Software is furnished to do so, subject to
12 * the following conditions:
13 *
14 * The above copyright notice and this permission notice (including the
15 * next paragraph) shall be included in all copies or substantial portions
16 * of the Software.
17 *
18 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
19 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
20 * FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. IN NO EVENT SHALL
21 * THE COPYRIGHT HOLDERS, AUTHORS AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM,
22 * DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
23 * OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
24 * USE OR OTHER DEALINGS IN THE SOFTWARE.
25 *
26 **************************************************************************/
27
28#include "vmwgfx_drv.h"
29#include "vmwgfx_drm.h"
30#include "ttm/ttm_object.h"
31#include "ttm/ttm_placement.h"
32#include "drmP.h"
33
fb1d9738
JB		 34struct vmw_user_context {
35 struct ttm_base_object base;
36 struct vmw_resource res;
37};
38
39struct vmw_user_surface {
40 struct ttm_base_object base;
41 struct vmw_surface srf;
42};
43
44struct vmw_user_dma_buffer {
45 struct ttm_base_object base;
46 struct vmw_dma_buffer dma;
47};
48
49struct vmw_bo_user_rep {
50 uint32_t handle;
51 uint64_t map_handle;
52};
53
54struct vmw_stream {
55 struct vmw_resource res;
56 uint32_t stream_id;
57};
58
59struct vmw_user_stream {
60 struct ttm_base_object base;
61 struct vmw_stream stream;
62};
63
64static inline struct vmw_dma_buffer *
65vmw_dma_buffer(struct ttm_buffer_object *bo)
66{
67 return container_of(bo, struct vmw_dma_buffer, base);
68}
69
70static inline struct vmw_user_dma_buffer *
71vmw_user_dma_buffer(struct ttm_buffer_object *bo)
72{
73 struct vmw_dma_buffer *vmw_bo = vmw_dma_buffer(bo);
74 return container_of(vmw_bo, struct vmw_user_dma_buffer, dma);
75}
76
77struct vmw_resource *vmw_resource_reference(struct vmw_resource *res)
78{
79 kref_get(&res->kref);
80 return res;
81}
82
83static void vmw_resource_release(struct kref *kref)
84{
85 struct vmw_resource *res =
86 container_of(kref, struct vmw_resource, kref);
87 struct vmw_private *dev_priv = res->dev_priv;
88
89 idr_remove(res->idr, res->id);
90 write_unlock(&dev_priv->resource_lock);
91
92 if (likely(res->hw_destroy != NULL))
93 res->hw_destroy(res);
94
95 if (res->res_free != NULL)
96 res->res_free(res);
97 else
98 kfree(res);
99
100 write_lock(&dev_priv->resource_lock);
101}
102
103void vmw_resource_unreference(struct vmw_resource **p_res)
104{
105 struct vmw_resource *res = *p_res;
106 struct vmw_private *dev_priv = res->dev_priv;
107
108 *p_res = NULL;
109 write_lock(&dev_priv->resource_lock);
110 kref_put(&res->kref, vmw_resource_release);
111 write_unlock(&dev_priv->resource_lock);
112}
113
114static int vmw_resource_init(struct vmw_private *dev_priv,
115 struct vmw_resource *res,
116 struct idr *idr,
117 enum ttm_object_type obj_type,
118 void (*res_free) (struct vmw_resource *res))
119{
120 int ret;
121
122 kref_init(&res->kref);
123 res->hw_destroy = NULL;
124 res->res_free = res_free;
125 res->res_type = obj_type;
126 res->idr = idr;
127 res->avail = false;
128 res->dev_priv = dev_priv;
e2fa3a76 129 INIT_LIST_HEAD(&res->query_head);
f18c8840 130 INIT_LIST_HEAD(&res->validate_head);
fb1d9738
JB		 131 do {
132 if (unlikely(idr_pre_get(idr, GFP_KERNEL) == 0))
133 return -ENOMEM;
134
135 write_lock(&dev_priv->resource_lock);
136 ret = idr_get_new_above(idr, res, 1, &res->id);
137 write_unlock(&dev_priv->resource_lock);
138
139 } while (ret == -EAGAIN);
140
141 return ret;
142}
143
144/**
145 * vmw_resource_activate
146 *
147 * @res: Pointer to the newly created resource
148 * @hw_destroy: Destroy function. NULL if none.
149 *
150 * Activate a resource after the hardware has been made aware of it.
151 * Set tye destroy function to @destroy. Typically this frees the
152 * resource and destroys the hardware resources associated with it.
153 * Activate basically means that the function vmw_resource_lookup will
154 * find it.
155 */
156
157static void vmw_resource_activate(struct vmw_resource *res,
158 void (*hw_destroy) (struct vmw_resource *))
159{
160 struct vmw_private *dev_priv = res->dev_priv;
161
162 write_lock(&dev_priv->resource_lock);
163 res->avail = true;
164 res->hw_destroy = hw_destroy;
165 write_unlock(&dev_priv->resource_lock);
166}
167
168struct vmw_resource *vmw_resource_lookup(struct vmw_private *dev_priv,
169 struct idr *idr, int id)
170{
171 struct vmw_resource *res;
172
173 read_lock(&dev_priv->resource_lock);
174 res = idr_find(idr, id);
175 if (res && res->avail)
176 kref_get(&res->kref);
177 else
178 res = NULL;
179 read_unlock(&dev_priv->resource_lock);
180
181 if (unlikely(res == NULL))
182 return NULL;
183
184 return res;
185}
186
187/**
188 * Context management:
189 */
190
191static void vmw_hw_context_destroy(struct vmw_resource *res)
192{
193
194 struct vmw_private *dev_priv = res->dev_priv;
195 struct {
196 SVGA3dCmdHeader header;
197 SVGA3dCmdDestroyContext body;
e2fa3a76
TH		 198 } *cmd;
199
200
201 vmw_execbuf_release_pinned_bo(dev_priv, true, res->id);
fb1d9738 202
e2fa3a76 203 cmd = vmw_fifo_reserve(dev_priv, sizeof(*cmd));
fb1d9738
JB		 204 if (unlikely(cmd == NULL)) {
205 DRM_ERROR("Failed reserving FIFO space for surface "
206 "destruction.\n");
207 return;
208 }
209
210 cmd->header.id = cpu_to_le32(SVGA_3D_CMD_CONTEXT_DESTROY);
211 cmd->header.size = cpu_to_le32(sizeof(cmd->body));
212 cmd->body.cid = cpu_to_le32(res->id);
213
214 vmw_fifo_commit(dev_priv, sizeof(*cmd));
05730b32 215 vmw_3d_resource_dec(dev_priv, false);
fb1d9738
JB		 216}
217
218static int vmw_context_init(struct vmw_private *dev_priv,
219 struct vmw_resource *res,
220 void (*res_free) (struct vmw_resource *res))
221{
222 int ret;
223
224 struct {
225 SVGA3dCmdHeader header;
226 SVGA3dCmdDefineContext body;
227 } *cmd;
228
229 ret = vmw_resource_init(dev_priv, res, &dev_priv->context_idr,
230 VMW_RES_CONTEXT, res_free);
231
232 if (unlikely(ret != 0)) {
233 if (res_free == NULL)
234 kfree(res);
235 else
236 res_free(res);
237 return ret;
238 }
239
240 cmd = vmw_fifo_reserve(dev_priv, sizeof(*cmd));
241 if (unlikely(cmd == NULL)) {
242 DRM_ERROR("Fifo reserve failed.\n");
243 vmw_resource_unreference(&res);
244 return -ENOMEM;
245 }
246
247 cmd->header.id = cpu_to_le32(SVGA_3D_CMD_CONTEXT_DEFINE);
248 cmd->header.size = cpu_to_le32(sizeof(cmd->body));
249 cmd->body.cid = cpu_to_le32(res->id);
250
251 vmw_fifo_commit(dev_priv, sizeof(*cmd));
05730b32 252 (void) vmw_3d_resource_inc(dev_priv, false);
fb1d9738
JB		 253 vmw_resource_activate(res, vmw_hw_context_destroy);
254 return 0;
255}
256
257struct vmw_resource *vmw_context_alloc(struct vmw_private *dev_priv)
258{
259 struct vmw_resource *res = kmalloc(sizeof(*res), GFP_KERNEL);
260 int ret;
261
262 if (unlikely(res == NULL))
263 return NULL;
264
265 ret = vmw_context_init(dev_priv, res, NULL);
266 return (ret == 0) ? res : NULL;
267}
268
269/**
270 * User-space context management:
271 */
272
273static void vmw_user_context_free(struct vmw_resource *res)
274{
275 struct vmw_user_context *ctx =
276 container_of(res, struct vmw_user_context, res);
277
278 kfree(ctx);
279}
280
281/**
282 * This function is called when user space has no more references on the
283 * base object. It releases the base-object's reference on the resource object.
284 */
285
286static void vmw_user_context_base_release(struct ttm_base_object **p_base)
287{
288 struct ttm_base_object *base = *p_base;
289 struct vmw_user_context *ctx =
290 container_of(base, struct vmw_user_context, base);
291 struct vmw_resource *res = &ctx->res;
292
293 *p_base = NULL;
294 vmw_resource_unreference(&res);
295}
296
297int vmw_context_destroy_ioctl(struct drm_device *dev, void *data,
298 struct drm_file *file_priv)
299{
300 struct vmw_private *dev_priv = vmw_priv(dev);
301 struct vmw_resource *res;
302 struct vmw_user_context *ctx;
303 struct drm_vmw_context_arg *arg = (struct drm_vmw_context_arg *)data;
304 struct ttm_object_file *tfile = vmw_fpriv(file_priv)->tfile;
305 int ret = 0;
306
307 res = vmw_resource_lookup(dev_priv, &dev_priv->context_idr, arg->cid);
308 if (unlikely(res == NULL))
309 return -EINVAL;
310
311 if (res->res_free != &vmw_user_context_free) {
312 ret = -EINVAL;
313 goto out;
314 }
315
316 ctx = container_of(res, struct vmw_user_context, res);
317 if (ctx->base.tfile != tfile && !ctx->base.shareable) {
318 ret = -EPERM;
319 goto out;
320 }
321
322 ttm_ref_object_base_unref(tfile, ctx->base.hash.key, TTM_REF_USAGE);
323out:
324 vmw_resource_unreference(&res);
325 return ret;
326}
327
328int vmw_context_define_ioctl(struct drm_device *dev, void *data,
329 struct drm_file *file_priv)
330{
331 struct vmw_private *dev_priv = vmw_priv(dev);
332 struct vmw_user_context *ctx = kmalloc(sizeof(*ctx), GFP_KERNEL);
333 struct vmw_resource *res;
334 struct vmw_resource *tmp;
335 struct drm_vmw_context_arg *arg = (struct drm_vmw_context_arg *)data;
336 struct ttm_object_file *tfile = vmw_fpriv(file_priv)->tfile;
337 int ret;
338
339 if (unlikely(ctx == NULL))
340 return -ENOMEM;
341
342 res = &ctx->res;
343 ctx->base.shareable = false;
344 ctx->base.tfile = NULL;
345
346 ret = vmw_context_init(dev_priv, res, vmw_user_context_free);
347 if (unlikely(ret != 0))
348 return ret;
349
350 tmp = vmw_resource_reference(&ctx->res);
351 ret = ttm_base_object_init(tfile, &ctx->base, false, VMW_RES_CONTEXT,
352 &vmw_user_context_base_release, NULL);
353
354 if (unlikely(ret != 0)) {
355 vmw_resource_unreference(&tmp);
356 goto out_err;
357 }
358
359 arg->cid = res->id;
360out_err:
361 vmw_resource_unreference(&res);
362 return ret;
363
364}
365
366int vmw_context_check(struct vmw_private *dev_priv,
367 struct ttm_object_file *tfile,
be38ab6e
TH		 368 int id,
369 struct vmw_resource **p_res)
fb1d9738
JB		 370{
371 struct vmw_resource *res;
372 int ret = 0;
373
374 read_lock(&dev_priv->resource_lock);
375 res = idr_find(&dev_priv->context_idr, id);
376 if (res && res->avail) {
377 struct vmw_user_context *ctx =
378 container_of(res, struct vmw_user_context, res);
379 if (ctx->base.tfile != tfile && !ctx->base.shareable)
380 ret = -EPERM;
be38ab6e
TH		 381 if (p_res)
382 *p_res = vmw_resource_reference(res);
fb1d9738
JB		 383 } else
384 ret = -EINVAL;
385 read_unlock(&dev_priv->resource_lock);
386
387 return ret;
388}
389
390
391/**
392 * Surface management.
393 */
394
395static void vmw_hw_surface_destroy(struct vmw_resource *res)
396{
397
398 struct vmw_private *dev_priv = res->dev_priv;
399 struct {
400 SVGA3dCmdHeader header;
401 SVGA3dCmdDestroySurface body;
402 } *cmd = vmw_fifo_reserve(dev_priv, sizeof(*cmd));
403
404 if (unlikely(cmd == NULL)) {
405 DRM_ERROR("Failed reserving FIFO space for surface "
406 "destruction.\n");
407 return;
408 }
409
410 cmd->header.id = cpu_to_le32(SVGA_3D_CMD_SURFACE_DESTROY);
411 cmd->header.size = cpu_to_le32(sizeof(cmd->body));
412 cmd->body.sid = cpu_to_le32(res->id);
413
414 vmw_fifo_commit(dev_priv, sizeof(*cmd));
05730b32 415 vmw_3d_resource_dec(dev_priv, false);
fb1d9738
JB		 416}
417
418void vmw_surface_res_free(struct vmw_resource *res)
419{
420 struct vmw_surface *srf = container_of(res, struct vmw_surface, res);
421
422 kfree(srf->sizes);
423 kfree(srf->snooper.image);
424 kfree(srf);
425}
426
427int vmw_surface_init(struct vmw_private *dev_priv,
428 struct vmw_surface *srf,
429 void (*res_free) (struct vmw_resource *res))
430{
431 int ret;
432 struct {
433 SVGA3dCmdHeader header;
434 SVGA3dCmdDefineSurface body;
435 } *cmd;
436 SVGA3dSize *cmd_size;
437 struct vmw_resource *res = &srf->res;
438 struct drm_vmw_size *src_size;
439 size_t submit_size;
440 uint32_t cmd_len;
441 int i;
442
443 BUG_ON(res_free == NULL);
444 ret = vmw_resource_init(dev_priv, res, &dev_priv->surface_idr,
445 VMW_RES_SURFACE, res_free);
446
447 if (unlikely(ret != 0)) {
448 res_free(res);
449 return ret;
450 }
451
452 submit_size = sizeof(*cmd) + srf->num_sizes * sizeof(SVGA3dSize);
453 cmd_len = sizeof(cmd->body) + srf->num_sizes * sizeof(SVGA3dSize);
454
455 cmd = vmw_fifo_reserve(dev_priv, submit_size);
456 if (unlikely(cmd == NULL)) {
457 DRM_ERROR("Fifo reserve failed for create surface.\n");
458 vmw_resource_unreference(&res);
459 return -ENOMEM;
460 }
461
462 cmd->header.id = cpu_to_le32(SVGA_3D_CMD_SURFACE_DEFINE);
463 cmd->header.size = cpu_to_le32(cmd_len);
464 cmd->body.sid = cpu_to_le32(res->id);
465 cmd->body.surfaceFlags = cpu_to_le32(srf->flags);
466 cmd->body.format = cpu_to_le32(srf->format);
467 for (i = 0; i < DRM_VMW_MAX_SURFACE_FACES; ++i) {
468 cmd->body.face[i].numMipLevels =
469 cpu_to_le32(srf->mip_levels[i]);
470 }
471
472 cmd += 1;
473 cmd_size = (SVGA3dSize *) cmd;
474 src_size = srf->sizes;
475
476 for (i = 0; i < srf->num_sizes; ++i, cmd_size++, src_size++) {
477 cmd_size->width = cpu_to_le32(src_size->width);
478 cmd_size->height = cpu_to_le32(src_size->height);
479 cmd_size->depth = cpu_to_le32(src_size->depth);
480 }
481
482 vmw_fifo_commit(dev_priv, submit_size);
05730b32 483 (void) vmw_3d_resource_inc(dev_priv, false);
fb1d9738
JB		 484 vmw_resource_activate(res, vmw_hw_surface_destroy);
485 return 0;
486}
487
488static void vmw_user_surface_free(struct vmw_resource *res)
489{
490 struct vmw_surface *srf = container_of(res, struct vmw_surface, res);
491 struct vmw_user_surface *user_srf =
492 container_of(srf, struct vmw_user_surface, srf);
493
494 kfree(srf->sizes);
495 kfree(srf->snooper.image);
496 kfree(user_srf);
497}
498
7a73ba74
TH		 499int vmw_user_surface_lookup_handle(struct vmw_private *dev_priv,
500 struct ttm_object_file *tfile,
501 uint32_t handle, struct vmw_surface **out)
fb1d9738
JB		 502{
503 struct vmw_resource *res;
504 struct vmw_surface *srf;
505 struct vmw_user_surface *user_srf;
7a73ba74
TH		 506 struct ttm_base_object *base;
507 int ret = -EINVAL;
fb1d9738 508
7a73ba74
TH		 509 base = ttm_base_object_lookup(tfile, handle);
510 if (unlikely(base == NULL))
fb1d9738
JB		 511 return -EINVAL;
512
7a73ba74
TH		 513 if (unlikely(base->object_type != VMW_RES_SURFACE))
514 goto out_bad_resource;
515
516 user_srf = container_of(base, struct vmw_user_surface, base);
517 srf = &user_srf->srf;
518 res = &srf->res;
519
520 read_lock(&dev_priv->resource_lock);
521
522 if (!res->avail || res->res_free != &vmw_user_surface_free) {
523 read_unlock(&dev_priv->resource_lock);
524 goto out_bad_resource;
525 }
fb1d9738 526
7a73ba74
TH		 527 kref_get(&res->kref);
528 read_unlock(&dev_priv->resource_lock);
fb1d9738
JB		 529
530 *out = srf;
7a73ba74
TH		 531 ret = 0;
532
533out_bad_resource:
534 ttm_base_object_unref(&base);
535
536 return ret;
fb1d9738
JB		 537}
538
539static void vmw_user_surface_base_release(struct ttm_base_object **p_base)
540{
541 struct ttm_base_object *base = *p_base;
542 struct vmw_user_surface *user_srf =
543 container_of(base, struct vmw_user_surface, base);
544 struct vmw_resource *res = &user_srf->srf.res;
545
546 *p_base = NULL;
547 vmw_resource_unreference(&res);
548}
549
550int vmw_surface_destroy_ioctl(struct drm_device *dev, void *data,
551 struct drm_file *file_priv)
552{
fb1d9738
JB		 553 struct drm_vmw_surface_arg *arg = (struct drm_vmw_surface_arg *)data;
554 struct ttm_object_file *tfile = vmw_fpriv(file_priv)->tfile;
fb1d9738 555
7a73ba74 556 return ttm_ref_object_base_unref(tfile, arg->sid, TTM_REF_USAGE);
fb1d9738
JB		 557}
558
559int vmw_surface_define_ioctl(struct drm_device *dev, void *data,
560 struct drm_file *file_priv)
561{
562 struct vmw_private *dev_priv = vmw_priv(dev);
563 struct vmw_user_surface *user_srf =
564 kmalloc(sizeof(*user_srf), GFP_KERNEL);
565 struct vmw_surface *srf;
566 struct vmw_resource *res;
567 struct vmw_resource *tmp;
568 union drm_vmw_surface_create_arg *arg =
569 (union drm_vmw_surface_create_arg *)data;
570 struct drm_vmw_surface_create_req *req = &arg->req;
571 struct drm_vmw_surface_arg *rep = &arg->rep;
572 struct ttm_object_file *tfile = vmw_fpriv(file_priv)->tfile;
573 struct drm_vmw_size __user *user_sizes;
574 int ret;
575 int i;
576
577 if (unlikely(user_srf == NULL))
578 return -ENOMEM;
579
580 srf = &user_srf->srf;
581 res = &srf->res;
582
583 srf->flags = req->flags;
584 srf->format = req->format;
a87897ed 585 srf->scanout = req->scanout;
fb1d9738
JB		 586 memcpy(srf->mip_levels, req->mip_levels, sizeof(srf->mip_levels));
587 srf->num_sizes = 0;
588 for (i = 0; i < DRM_VMW_MAX_SURFACE_FACES; ++i)
589 srf->num_sizes += srf->mip_levels[i];
590
591 if (srf->num_sizes > DRM_VMW_MAX_SURFACE_FACES *
592 DRM_VMW_MAX_MIP_LEVELS) {
593 ret = -EINVAL;
594 goto out_err0;
595 }
596
597 srf->sizes = kmalloc(srf->num_sizes * sizeof(*srf->sizes), GFP_KERNEL);
598 if (unlikely(srf->sizes == NULL)) {
599 ret = -ENOMEM;
600 goto out_err0;
601 }
602
603 user_sizes = (struct drm_vmw_size __user *)(unsigned long)
604 req->size_addr;
605
606 ret = copy_from_user(srf->sizes, user_sizes,
607 srf->num_sizes * sizeof(*srf->sizes));
9b8eb4d1
DC		 608 if (unlikely(ret != 0)) {
609 ret = -EFAULT;
fb1d9738 610 goto out_err1;
9b8eb4d1 611 }
fb1d9738 612
5ffdb658 613 if (srf->scanout &&
50ec3b7c
TH		 614 srf->num_sizes == 1 &&
615 srf->sizes[0].width == 64 &&
616 srf->sizes[0].height == 64 &&
617 srf->format == SVGA3D_A8R8G8B8) {
618
f35119d6
RM		 619 /* allocate image area and clear it */
620 srf->snooper.image = kzalloc(64 * 64 * 4, GFP_KERNEL);
621 if (!srf->snooper.image) {
50ec3b7c
TH		 622 DRM_ERROR("Failed to allocate cursor_image\n");
623 ret = -ENOMEM;
624 goto out_err1;
625 }
626 } else {
627 srf->snooper.image = NULL;
628 }
629 srf->snooper.crtc = NULL;
630
fb1d9738
JB		 631 user_srf->base.shareable = false;
632 user_srf->base.tfile = NULL;
633
634 /**
635 * From this point, the generic resource management functions
636 * destroy the object on failure.
637 */
638
639 ret = vmw_surface_init(dev_priv, srf, vmw_user_surface_free);
640 if (unlikely(ret != 0))
641 return ret;
642
643 tmp = vmw_resource_reference(&srf->res);
644 ret = ttm_base_object_init(tfile, &user_srf->base,
645 req->shareable, VMW_RES_SURFACE,
646 &vmw_user_surface_base_release, NULL);
647
648 if (unlikely(ret != 0)) {
649 vmw_resource_unreference(&tmp);
650 vmw_resource_unreference(&res);
651 return ret;
652 }
653
7a73ba74
TH		 654 rep->sid = user_srf->base.hash.key;
655 if (rep->sid == SVGA3D_INVALID_ID)
656 DRM_ERROR("Created bad Surface ID.\n");
657
fb1d9738
JB		 658 vmw_resource_unreference(&res);
659 return 0;
660out_err1:
661 kfree(srf->sizes);
662out_err0:
663 kfree(user_srf);
664 return ret;
665}
666
667int vmw_surface_reference_ioctl(struct drm_device *dev, void *data,
668 struct drm_file *file_priv)
669{
fb1d9738
JB		 670 union drm_vmw_surface_reference_arg *arg =
671 (union drm_vmw_surface_reference_arg *)data;
672 struct drm_vmw_surface_arg *req = &arg->req;
673 struct drm_vmw_surface_create_req *rep = &arg->rep;
674 struct ttm_object_file *tfile = vmw_fpriv(file_priv)->tfile;
fb1d9738
JB		 675 struct vmw_surface *srf;
676 struct vmw_user_surface *user_srf;
677 struct drm_vmw_size __user *user_sizes;
7a73ba74
TH		 678 struct ttm_base_object *base;
679 int ret = -EINVAL;
fb1d9738 680
7a73ba74
TH		 681 base = ttm_base_object_lookup(tfile, req->sid);
682 if (unlikely(base == NULL)) {
683 DRM_ERROR("Could not find surface to reference.\n");
fb1d9738 684 return -EINVAL;
fb1d9738
JB		 685 }
686
7a73ba74
TH		 687 if (unlikely(base->object_type != VMW_RES_SURFACE))
688 goto out_bad_resource;
689
690 user_srf = container_of(base, struct vmw_user_surface, base);
691 srf = &user_srf->srf;
fb1d9738
JB		 692
693 ret = ttm_ref_object_add(tfile, &user_srf->base, TTM_REF_USAGE, NULL);
694 if (unlikely(ret != 0)) {
695 DRM_ERROR("Could not add a reference to a surface.\n");
7a73ba74 696 goto out_no_reference;
fb1d9738
JB		 697 }
698
699 rep->flags = srf->flags;
700 rep->format = srf->format;
701 memcpy(rep->mip_levels, srf->mip_levels, sizeof(srf->mip_levels));
702 user_sizes = (struct drm_vmw_size __user *)(unsigned long)
703 rep->size_addr;
704
705 if (user_sizes)
706 ret = copy_to_user(user_sizes, srf->sizes,
707 srf->num_sizes * sizeof(*srf->sizes));
9b8eb4d1 708 if (unlikely(ret != 0)) {
fb1d9738
JB		 709 DRM_ERROR("copy_to_user failed %p %u\n",
710 user_sizes, srf->num_sizes);
9b8eb4d1
DC		 711 ret = -EFAULT;
712 }
7a73ba74
TH		 713out_bad_resource:
714out_no_reference:
715 ttm_base_object_unref(&base);
716
fb1d9738
JB		 717 return ret;
718}
719
720int vmw_surface_check(struct vmw_private *dev_priv,
721 struct ttm_object_file *tfile,
7a73ba74 722 uint32_t handle, int *id)
fb1d9738 723{
7a73ba74
TH		 724 struct ttm_base_object *base;
725 struct vmw_user_surface *user_srf;
fb1d9738 726
7a73ba74 727 int ret = -EPERM;
fb1d9738 728
7a73ba74
TH		 729 base = ttm_base_object_lookup(tfile, handle);
730 if (unlikely(base == NULL))
731 return -EINVAL;
732
733 if (unlikely(base->object_type != VMW_RES_SURFACE))
734 goto out_bad_surface;
735
736 user_srf = container_of(base, struct vmw_user_surface, base);
737 *id = user_srf->srf.res.id;
738 ret = 0;
739
740out_bad_surface:
741 /**
742 * FIXME: May deadlock here when called from the
743 * command parsing code.
744 */
fb1d9738 745
7a73ba74 746 ttm_base_object_unref(&base);
fb1d9738
JB		 747 return ret;
748}
749
750/**
751 * Buffer management.
752 */
753
754static size_t vmw_dmabuf_acc_size(struct ttm_bo_global *glob,
755 unsigned long num_pages)
756{
757 static size_t bo_user_size = ~0;
758
759 size_t page_array_size =
760 (num_pages * sizeof(void *) + PAGE_SIZE - 1) & PAGE_MASK;
761
762 if (unlikely(bo_user_size == ~0)) {
763 bo_user_size = glob->ttm_bo_extra_size +
764 ttm_round_pot(sizeof(struct vmw_dma_buffer));
765 }
766
767 return bo_user_size + page_array_size;
768}
769
effe1105
TH		 770void vmw_dmabuf_bo_free(struct ttm_buffer_object *bo)
771{
772 struct vmw_dma_buffer *vmw_bo = vmw_dma_buffer(bo);
773 struct ttm_bo_global *glob = bo->glob;
774
effe1105 775 ttm_mem_global_free(glob->mem_glob, bo->acc_size);
fb1d9738
JB		 776 kfree(vmw_bo);
777}
778
779int vmw_dmabuf_init(struct vmw_private *dev_priv,
780 struct vmw_dma_buffer *vmw_bo,
781 size_t size, struct ttm_placement *placement,
782 bool interruptible,
783 void (*bo_free) (struct ttm_buffer_object *bo))
784{
785 struct ttm_bo_device *bdev = &dev_priv->bdev;
786 struct ttm_mem_global *mem_glob = bdev->glob->mem_glob;
787 size_t acc_size;
788 int ret;
789
790 BUG_ON(!bo_free);
791
792 acc_size =
793 vmw_dmabuf_acc_size(bdev->glob,
794 (size + PAGE_SIZE - 1) >> PAGE_SHIFT);
795
796 ret = ttm_mem_global_alloc(mem_glob, acc_size, false, false);
797 if (unlikely(ret != 0)) {
798 /* we must free the bo here as
799 * ttm_buffer_object_init does so as well */
800 bo_free(&vmw_bo->base);
801 return ret;
802 }
803
804 memset(vmw_bo, 0, sizeof(*vmw_bo));
805
fb1d9738 806 INIT_LIST_HEAD(&vmw_bo->validate_list);
fb1d9738
JB		 807
808 ret = ttm_bo_init(bdev, &vmw_bo->base, size,
809 ttm_bo_type_device, placement,
810 0, 0, interruptible,
811 NULL, acc_size, bo_free);
812 return ret;
813}
814
815static void vmw_user_dmabuf_destroy(struct ttm_buffer_object *bo)
816{
817 struct vmw_user_dma_buffer *vmw_user_bo = vmw_user_dma_buffer(bo);
fb1d9738 818 struct ttm_bo_global *glob = bo->glob;
fb1d9738
JB		 819
820 ttm_mem_global_free(glob->mem_glob, bo->acc_size);
fb1d9738
JB		 821 kfree(vmw_user_bo);
822}
823
824static void vmw_user_dmabuf_release(struct ttm_base_object **p_base)
825{
826 struct vmw_user_dma_buffer *vmw_user_bo;
827 struct ttm_base_object *base = *p_base;
828 struct ttm_buffer_object *bo;
829
830 *p_base = NULL;
831
832 if (unlikely(base == NULL))
833 return;
834
835 vmw_user_bo = container_of(base, struct vmw_user_dma_buffer, base);
836 bo = &vmw_user_bo->dma.base;
837 ttm_bo_unref(&bo);
838}
839
840int vmw_dmabuf_alloc_ioctl(struct drm_device *dev, void *data,
841 struct drm_file *file_priv)
842{
843 struct vmw_private *dev_priv = vmw_priv(dev);
844 union drm_vmw_alloc_dmabuf_arg *arg =
845 (union drm_vmw_alloc_dmabuf_arg *)data;
846 struct drm_vmw_alloc_dmabuf_req *req = &arg->req;
847 struct drm_vmw_dmabuf_rep *rep = &arg->rep;
848 struct vmw_user_dma_buffer *vmw_user_bo;
849 struct ttm_buffer_object *tmp;
850 struct vmw_master *vmaster = vmw_master(file_priv->master);
851 int ret;
852
853 vmw_user_bo = kzalloc(sizeof(*vmw_user_bo), GFP_KERNEL);
854 if (unlikely(vmw_user_bo == NULL))
855 return -ENOMEM;
856
857 ret = ttm_read_lock(&vmaster->lock, true);
858 if (unlikely(ret != 0)) {
859 kfree(vmw_user_bo);
860 return ret;
861 }
862
863 ret = vmw_dmabuf_init(dev_priv, &vmw_user_bo->dma, req->size,
8ba5152a 864 &vmw_vram_sys_placement, true,
fb1d9738
JB		 865 &vmw_user_dmabuf_destroy);
866 if (unlikely(ret != 0))
2f5993cc 867 goto out_no_dmabuf;
fb1d9738
JB		 868
869 tmp = ttm_bo_reference(&vmw_user_bo->dma.base);
870 ret = ttm_base_object_init(vmw_fpriv(file_priv)->tfile,
871 &vmw_user_bo->base,
872 false,
873 ttm_buffer_type,
874 &vmw_user_dmabuf_release, NULL);
2f5993cc
TH		 875 if (unlikely(ret != 0))
876 goto out_no_base_object;
877 else {
fb1d9738
JB		 878 rep->handle = vmw_user_bo->base.hash.key;
879 rep->map_handle = vmw_user_bo->dma.base.addr_space_offset;
880 rep->cur_gmr_id = vmw_user_bo->base.hash.key;
881 rep->cur_gmr_offset = 0;
882 }
fb1d9738 883
2f5993cc
TH		 884out_no_base_object:
885 ttm_bo_unref(&tmp);
886out_no_dmabuf:
fb1d9738
JB		 887 ttm_read_unlock(&vmaster->lock);
888
2f5993cc 889 return ret;
fb1d9738
JB		 890}
891
892int vmw_dmabuf_unref_ioctl(struct drm_device *dev, void *data,
893 struct drm_file *file_priv)
894{
895 struct drm_vmw_unref_dmabuf_arg *arg =
896 (struct drm_vmw_unref_dmabuf_arg *)data;
897
898 return ttm_ref_object_base_unref(vmw_fpriv(file_priv)->tfile,
899 arg->handle,
900 TTM_REF_USAGE);
901}
902
903uint32_t vmw_dmabuf_validate_node(struct ttm_buffer_object *bo,
904 uint32_t cur_validate_node)
905{
906 struct vmw_dma_buffer *vmw_bo = vmw_dma_buffer(bo);
907
908 if (likely(vmw_bo->on_validate_list))
909 return vmw_bo->cur_validate_node;
910
911 vmw_bo->cur_validate_node = cur_validate_node;
912 vmw_bo->on_validate_list = true;
913
914 return cur_validate_node;
915}
916
917void vmw_dmabuf_validate_clear(struct ttm_buffer_object *bo)
918{
919 struct vmw_dma_buffer *vmw_bo = vmw_dma_buffer(bo);
920
921 vmw_bo->on_validate_list = false;
922}
923
fb1d9738
JB		 924int vmw_user_dmabuf_lookup(struct ttm_object_file *tfile,
925 uint32_t handle, struct vmw_dma_buffer **out)
926{
927 struct vmw_user_dma_buffer *vmw_user_bo;
928 struct ttm_base_object *base;
929
930 base = ttm_base_object_lookup(tfile, handle);
931 if (unlikely(base == NULL)) {
932 printk(KERN_ERR "Invalid buffer object handle 0x%08lx.\n",
933 (unsigned long)handle);
934 return -ESRCH;
935 }
936
937 if (unlikely(base->object_type != ttm_buffer_type)) {
938 ttm_base_object_unref(&base);
939 printk(KERN_ERR "Invalid buffer object handle 0x%08lx.\n",
940 (unsigned long)handle);
941 return -EINVAL;
942 }
943
944 vmw_user_bo = container_of(base, struct vmw_user_dma_buffer, base);
945 (void)ttm_bo_reference(&vmw_user_bo->dma.base);
946 ttm_base_object_unref(&base);
947 *out = &vmw_user_bo->dma;
948
949 return 0;
950}
951
fb1d9738 952/*
65155b37 953 * Stream management
fb1d9738
JB		 954 */
955
956static void vmw_stream_destroy(struct vmw_resource *res)
957{
958 struct vmw_private *dev_priv = res->dev_priv;
959 struct vmw_stream *stream;
960 int ret;
961
962 DRM_INFO("%s: unref\n", __func__);
963 stream = container_of(res, struct vmw_stream, res);
964
965 ret = vmw_overlay_unref(dev_priv, stream->stream_id);
966 WARN_ON(ret != 0);
967}
968
969static int vmw_stream_init(struct vmw_private *dev_priv,
970 struct vmw_stream *stream,
971 void (*res_free) (struct vmw_resource *res))
972{
973 struct vmw_resource *res = &stream->res;
974 int ret;
975
976 ret = vmw_resource_init(dev_priv, res, &dev_priv->stream_idr,
977 VMW_RES_STREAM, res_free);
978
979 if (unlikely(ret != 0)) {
980 if (res_free == NULL)
981 kfree(stream);
982 else
983 res_free(&stream->res);
984 return ret;
985 }
986
987 ret = vmw_overlay_claim(dev_priv, &stream->stream_id);
988 if (ret) {
989 vmw_resource_unreference(&res);
990 return ret;
991 }
992
993 DRM_INFO("%s: claimed\n", __func__);
994
995 vmw_resource_activate(&stream->res, vmw_stream_destroy);
996 return 0;
997}
998
999/**
1000 * User-space context management:
1001 */
1002
1003static void vmw_user_stream_free(struct vmw_resource *res)
1004{
1005 struct vmw_user_stream *stream =
1006 container_of(res, struct vmw_user_stream, stream.res);
1007
1008 kfree(stream);
1009}
1010
1011/**
1012 * This function is called when user space has no more references on the
1013 * base object. It releases the base-object's reference on the resource object.
1014 */
1015
1016static void vmw_user_stream_base_release(struct ttm_base_object **p_base)
1017{
1018 struct ttm_base_object *base = *p_base;
1019 struct vmw_user_stream *stream =
1020 container_of(base, struct vmw_user_stream, base);
1021 struct vmw_resource *res = &stream->stream.res;
1022
1023 *p_base = NULL;
1024 vmw_resource_unreference(&res);
1025}
1026
1027int vmw_stream_unref_ioctl(struct drm_device *dev, void *data,
1028 struct drm_file *file_priv)
1029{
1030 struct vmw_private *dev_priv = vmw_priv(dev);
1031 struct vmw_resource *res;
1032 struct vmw_user_stream *stream;
1033 struct drm_vmw_stream_arg *arg = (struct drm_vmw_stream_arg *)data;
1034 struct ttm_object_file *tfile = vmw_fpriv(file_priv)->tfile;
1035 int ret = 0;
1036
1037 res = vmw_resource_lookup(dev_priv, &dev_priv->stream_idr, arg->stream_id);
1038 if (unlikely(res == NULL))
1039 return -EINVAL;
1040
1041 if (res->res_free != &vmw_user_stream_free) {
1042 ret = -EINVAL;
1043 goto out;
1044 }
1045
1046 stream = container_of(res, struct vmw_user_stream, stream.res);
1047 if (stream->base.tfile != tfile) {
1048 ret = -EINVAL;
1049 goto out;
1050 }
1051
1052 ttm_ref_object_base_unref(tfile, stream->base.hash.key, TTM_REF_USAGE);
1053out:
1054 vmw_resource_unreference(&res);
1055 return ret;
1056}
1057
1058int vmw_stream_claim_ioctl(struct drm_device *dev, void *data,
1059 struct drm_file *file_priv)
1060{
1061 struct vmw_private *dev_priv = vmw_priv(dev);
1062 struct vmw_user_stream *stream = kmalloc(sizeof(*stream), GFP_KERNEL);
1063 struct vmw_resource *res;
1064 struct vmw_resource *tmp;
1065 struct drm_vmw_stream_arg *arg = (struct drm_vmw_stream_arg *)data;
1066 struct ttm_object_file *tfile = vmw_fpriv(file_priv)->tfile;
1067 int ret;
1068
1069 if (unlikely(stream == NULL))
1070 return -ENOMEM;
1071
1072 res = &stream->stream.res;
1073 stream->base.shareable = false;
1074 stream->base.tfile = NULL;
1075
1076 ret = vmw_stream_init(dev_priv, &stream->stream, vmw_user_stream_free);
1077 if (unlikely(ret != 0))
1078 return ret;
1079
1080 tmp = vmw_resource_reference(res);
1081 ret = ttm_base_object_init(tfile, &stream->base, false, VMW_RES_STREAM,
1082 &vmw_user_stream_base_release, NULL);
1083
1084 if (unlikely(ret != 0)) {
1085 vmw_resource_unreference(&tmp);
1086 goto out_err;
1087 }
1088
1089 arg->stream_id = res->id;
1090out_err:
1091 vmw_resource_unreference(&res);
1092 return ret;
1093}
1094
1095int vmw_user_stream_lookup(struct vmw_private *dev_priv,
1096 struct ttm_object_file *tfile,
1097 uint32_t *inout_id, struct vmw_resource **out)
1098{
1099 struct vmw_user_stream *stream;
1100 struct vmw_resource *res;
1101 int ret;
1102
1103 res = vmw_resource_lookup(dev_priv, &dev_priv->stream_idr, *inout_id);
1104 if (unlikely(res == NULL))
1105 return -EINVAL;
1106
1107 if (res->res_free != &vmw_user_stream_free) {
1108 ret = -EINVAL;
1109 goto err_ref;
1110 }
1111
1112 stream = container_of(res, struct vmw_user_stream, stream.res);
1113 if (stream->base.tfile != tfile) {
1114 ret = -EPERM;
1115 goto err_ref;
1116 }
1117
1118 *inout_id = stream->stream.stream_id;
1119 *out = res;
1120 return 0;
1121err_ref:
1122 vmw_resource_unreference(&res);
1123 return ret;
1124}
Linux 6.x block layer and io_uring tree(s)