1 /* 2 * Legacy: Generic DRM Buffer Management 3 * 4 * Copyright 1999, 2000 Precision Insight, Inc., Cedar Park, Texas. 5 * Copyright 2000 VA Linux Systems, Inc., Sunnyvale, California. 6 * All Rights Reserved. 7 * 8 * Author: Rickard E. (Rik) Faith <faith@valinux.com> 9 * Author: Gareth Hughes <gareth@valinux.com> 10 * 11 * Permission is hereby granted, free of charge, to any person obtaining a 12 * copy of this software and associated documentation files (the "Software"), 13 * to deal in the Software without restriction, including without limitation 14 * the rights to use, copy, modify, merge, publish, distribute, sublicense, 15 * and/or sell copies of the Software, and to permit persons to whom the 16 * Software is furnished to do so, subject to the following conditions: 17 * 18 * The above copyright notice and this permission notice (including the next 19 * paragraph) shall be included in all copies or substantial portions of the 20 * Software. 21 * 22 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 23 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 24 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL 25 * VA LINUX SYSTEMS AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM, DAMAGES OR 26 * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, 27 * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR 28 * OTHER DEALINGS IN THE SOFTWARE. 29 */ 30 31 #include <linux/vmalloc.h> 32 #include <linux/slab.h> 33 #include <linux/log2.h> 34 #include <linux/export.h> 35 #include <asm/shmparam.h> 36 #include <drm/drmP.h> 37 #include "drm_legacy.h" 38 39 static struct drm_map_list *drm_find_matching_map(struct drm_device *dev, 40 struct drm_local_map *map) 41 { 42 struct drm_map_list *entry; 43 list_for_each_entry(entry, &dev->maplist, head) { 44 /* 45 * Because the kernel-userspace ABI is fixed at a 32-bit offset 46 * while PCI resources may live above that, we only compare the 47 * lower 32 bits of the map offset for maps of type 48 * _DRM_FRAMEBUFFER or _DRM_REGISTERS. 49 * It is assumed that if a driver have more than one resource 50 * of each type, the lower 32 bits are different. 51 */ 52 if (!entry->map || 53 map->type != entry->map->type || 54 entry->master != dev->master) 55 continue; 56 switch (map->type) { 57 case _DRM_SHM: 58 if (map->flags != _DRM_CONTAINS_LOCK) 59 break; 60 return entry; 61 case _DRM_REGISTERS: 62 case _DRM_FRAME_BUFFER: 63 if ((entry->map->offset & 0xffffffff) == 64 (map->offset & 0xffffffff)) 65 return entry; 66 default: /* Make gcc happy */ 67 ; 68 } 69 if (entry->map->offset == map->offset) 70 return entry; 71 } 72 73 return NULL; 74 } 75 76 static int drm_map_handle(struct drm_device *dev, struct drm_hash_item *hash, 77 unsigned long user_token, int hashed_handle, int shm) 78 { 79 int use_hashed_handle, shift; 80 unsigned long add; 81 82 #if (BITS_PER_LONG == 64) 83 use_hashed_handle = ((user_token & 0xFFFFFFFF00000000UL) || hashed_handle); 84 #elif (BITS_PER_LONG == 32) 85 use_hashed_handle = hashed_handle; 86 #else 87 #error Unsupported long size. Neither 64 nor 32 bits. 88 #endif 89 90 if (!use_hashed_handle) { 91 int ret; 92 hash->key = user_token >> PAGE_SHIFT; 93 ret = drm_ht_insert_item(&dev->map_hash, hash); 94 if (ret != -EINVAL) 95 return ret; 96 } 97 98 shift = 0; 99 add = DRM_MAP_HASH_OFFSET >> PAGE_SHIFT; 100 if (shm && (SHMLBA > PAGE_SIZE)) { 101 int bits = ilog2(SHMLBA >> PAGE_SHIFT) + 1; 102 103 /* For shared memory, we have to preserve the SHMLBA 104 * bits of the eventual vma->vm_pgoff value during 105 * mmap(). Otherwise we run into cache aliasing problems 106 * on some platforms. On these platforms, the pgoff of 107 * a mmap() request is used to pick a suitable virtual 108 * address for the mmap() region such that it will not 109 * cause cache aliasing problems. 110 * 111 * Therefore, make sure the SHMLBA relevant bits of the 112 * hash value we use are equal to those in the original 113 * kernel virtual address. 114 */ 115 shift = bits; 116 add |= ((user_token >> PAGE_SHIFT) & ((1UL << bits) - 1UL)); 117 } 118 119 return drm_ht_just_insert_please(&dev->map_hash, hash, 120 user_token, 32 - PAGE_SHIFT - 3, 121 shift, add); 122 } 123 124 /** 125 * Core function to create a range of memory available for mapping by a 126 * non-root process. 127 * 128 * Adjusts the memory offset to its absolute value according to the mapping 129 * type. Adds the map to the map list drm_device::maplist. Adds MTRR's where 130 * applicable and if supported by the kernel. 131 */ 132 static int drm_addmap_core(struct drm_device * dev, resource_size_t offset, 133 unsigned int size, enum drm_map_type type, 134 enum drm_map_flags flags, 135 struct drm_map_list ** maplist) 136 { 137 struct drm_local_map *map; 138 struct drm_map_list *list; 139 drm_dma_handle_t *dmah; 140 unsigned long user_token; 141 int ret; 142 143 map = kmalloc(sizeof(*map), GFP_KERNEL); 144 if (!map) 145 return -ENOMEM; 146 147 map->offset = offset; 148 map->size = size; 149 map->flags = flags; 150 map->type = type; 151 152 /* Only allow shared memory to be removable since we only keep enough 153 * book keeping information about shared memory to allow for removal 154 * when processes fork. 155 */ 156 if ((map->flags & _DRM_REMOVABLE) && map->type != _DRM_SHM) { 157 kfree(map); 158 return -EINVAL; 159 } 160 DRM_DEBUG("offset = 0x%08llx, size = 0x%08lx, type = %d\n", 161 (unsigned long long)map->offset, map->size, map->type); 162 163 /* page-align _DRM_SHM maps. They are allocated here so there is no security 164 * hole created by that and it works around various broken drivers that use 165 * a non-aligned quantity to map the SAREA. --BenH 166 */ 167 if (map->type == _DRM_SHM) 168 map->size = PAGE_ALIGN(map->size); 169 170 if ((map->offset & (~(resource_size_t)PAGE_MASK)) || (map->size & (~PAGE_MASK))) { 171 kfree(map); 172 return -EINVAL; 173 } 174 map->mtrr = -1; 175 map->handle = NULL; 176 177 switch (map->type) { 178 case _DRM_REGISTERS: 179 case _DRM_FRAME_BUFFER: 180 #if !defined(__sparc__) && !defined(__alpha__) && !defined(__ia64__) && !defined(__powerpc64__) && !defined(__x86_64__) && !defined(__arm__) 181 if (map->offset + (map->size-1) < map->offset || 182 map->offset < virt_to_phys(high_memory)) { 183 kfree(map); 184 return -EINVAL; 185 } 186 #endif 187 /* Some drivers preinitialize some maps, without the X Server 188 * needing to be aware of it. Therefore, we just return success 189 * when the server tries to create a duplicate map. 190 */ 191 list = drm_find_matching_map(dev, map); 192 if (list != NULL) { 193 if (list->map->size != map->size) { 194 DRM_DEBUG("Matching maps of type %d with " 195 "mismatched sizes, (%ld vs %ld)\n", 196 map->type, map->size, 197 list->map->size); 198 list->map->size = map->size; 199 } 200 201 kfree(map); 202 *maplist = list; 203 return 0; 204 } 205 206 if (map->type == _DRM_FRAME_BUFFER || 207 (map->flags & _DRM_WRITE_COMBINING)) { 208 map->mtrr = 209 arch_phys_wc_add(map->offset, map->size); 210 } 211 if (map->type == _DRM_REGISTERS) { 212 if (map->flags & _DRM_WRITE_COMBINING) 213 map->handle = ioremap_wc(map->offset, 214 map->size); 215 else 216 map->handle = ioremap(map->offset, map->size); 217 if (!map->handle) { 218 kfree(map); 219 return -ENOMEM; 220 } 221 } 222 223 break; 224 case _DRM_SHM: 225 list = drm_find_matching_map(dev, map); 226 if (list != NULL) { 227 if(list->map->size != map->size) { 228 DRM_DEBUG("Matching maps of type %d with " 229 "mismatched sizes, (%ld vs %ld)\n", 230 map->type, map->size, list->map->size); 231 list->map->size = map->size; 232 } 233 234 kfree(map); 235 *maplist = list; 236 return 0; 237 } 238 map->handle = vmalloc_user(map->size); 239 DRM_DEBUG("%lu %d %p\n", 240 map->size, order_base_2(map->size), map->handle); 241 if (!map->handle) { 242 kfree(map); 243 return -ENOMEM; 244 } 245 map->offset = (unsigned long)map->handle; 246 if (map->flags & _DRM_CONTAINS_LOCK) { 247 /* Prevent a 2nd X Server from creating a 2nd lock */ 248 if (dev->master->lock.hw_lock != NULL) { 249 vfree(map->handle); 250 kfree(map); 251 return -EBUSY; 252 } 253 dev->sigdata.lock = dev->master->lock.hw_lock = map->handle; /* Pointer to lock */ 254 } 255 break; 256 case _DRM_AGP: { 257 struct drm_agp_mem *entry; 258 int valid = 0; 259 260 if (!dev->agp) { 261 kfree(map); 262 return -EINVAL; 263 } 264 #ifdef __alpha__ 265 map->offset += dev->hose->mem_space->start; 266 #endif 267 /* In some cases (i810 driver), user space may have already 268 * added the AGP base itself, because dev->agp->base previously 269 * only got set during AGP enable. So, only add the base 270 * address if the map's offset isn't already within the 271 * aperture. 272 */ 273 if (map->offset < dev->agp->base || 274 map->offset > dev->agp->base + 275 dev->agp->agp_info.aper_size * 1024 * 1024 - 1) { 276 map->offset += dev->agp->base; 277 } 278 map->mtrr = dev->agp->agp_mtrr; /* for getmap */ 279 280 /* This assumes the DRM is in total control of AGP space. 281 * It's not always the case as AGP can be in the control 282 * of user space (i.e. i810 driver). So this loop will get 283 * skipped and we double check that dev->agp->memory is 284 * actually set as well as being invalid before EPERM'ing 285 */ 286 list_for_each_entry(entry, &dev->agp->memory, head) { 287 if ((map->offset >= entry->bound) && 288 (map->offset + map->size <= entry->bound + entry->pages * PAGE_SIZE)) { 289 valid = 1; 290 break; 291 } 292 } 293 if (!list_empty(&dev->agp->memory) && !valid) { 294 kfree(map); 295 return -EPERM; 296 } 297 DRM_DEBUG("AGP offset = 0x%08llx, size = 0x%08lx\n", 298 (unsigned long long)map->offset, map->size); 299 300 break; 301 } 302 case _DRM_SCATTER_GATHER: 303 if (!dev->sg) { 304 kfree(map); 305 return -EINVAL; 306 } 307 map->offset += (unsigned long)dev->sg->virtual; 308 break; 309 case _DRM_CONSISTENT: 310 /* dma_addr_t is 64bit on i386 with CONFIG_HIGHMEM64G, 311 * As we're limiting the address to 2^32-1 (or less), 312 * casting it down to 32 bits is no problem, but we 313 * need to point to a 64bit variable first. */ 314 dmah = drm_pci_alloc(dev, map->size, map->size); 315 if (!dmah) { 316 kfree(map); 317 return -ENOMEM; 318 } 319 map->handle = dmah->vaddr; 320 map->offset = (unsigned long)dmah->busaddr; 321 kfree(dmah); 322 break; 323 default: 324 kfree(map); 325 return -EINVAL; 326 } 327 328 list = kzalloc(sizeof(*list), GFP_KERNEL); 329 if (!list) { 330 if (map->type == _DRM_REGISTERS) 331 iounmap(map->handle); 332 kfree(map); 333 return -EINVAL; 334 } 335 list->map = map; 336 337 mutex_lock(&dev->struct_mutex); 338 list_add(&list->head, &dev->maplist); 339 340 /* Assign a 32-bit handle */ 341 /* We do it here so that dev->struct_mutex protects the increment */ 342 user_token = (map->type == _DRM_SHM) ? (unsigned long)map->handle : 343 map->offset; 344 ret = drm_map_handle(dev, &list->hash, user_token, 0, 345 (map->type == _DRM_SHM)); 346 if (ret) { 347 if (map->type == _DRM_REGISTERS) 348 iounmap(map->handle); 349 kfree(map); 350 kfree(list); 351 mutex_unlock(&dev->struct_mutex); 352 return ret; 353 } 354 355 list->user_token = list->hash.key << PAGE_SHIFT; 356 mutex_unlock(&dev->struct_mutex); 357 358 if (!(map->flags & _DRM_DRIVER)) 359 list->master = dev->master; 360 *maplist = list; 361 return 0; 362 } 363 364 int drm_legacy_addmap(struct drm_device * dev, resource_size_t offset, 365 unsigned int size, enum drm_map_type type, 366 enum drm_map_flags flags, struct drm_local_map **map_ptr) 367 { 368 struct drm_map_list *list; 369 int rc; 370 371 rc = drm_addmap_core(dev, offset, size, type, flags, &list); 372 if (!rc) 373 *map_ptr = list->map; 374 return rc; 375 } 376 EXPORT_SYMBOL(drm_legacy_addmap); 377 378 /** 379 * Ioctl to specify a range of memory that is available for mapping by a 380 * non-root process. 381 * 382 * \param inode device inode. 383 * \param file_priv DRM file private. 384 * \param cmd command. 385 * \param arg pointer to a drm_map structure. 386 * \return zero on success or a negative value on error. 387 * 388 */ 389 int drm_legacy_addmap_ioctl(struct drm_device *dev, void *data, 390 struct drm_file *file_priv) 391 { 392 struct drm_map *map = data; 393 struct drm_map_list *maplist; 394 int err; 395 396 if (!(capable(CAP_SYS_ADMIN) || map->type == _DRM_AGP || map->type == _DRM_SHM)) 397 return -EPERM; 398 399 if (!drm_core_check_feature(dev, DRIVER_KMS_LEGACY_CONTEXT) && 400 !drm_core_check_feature(dev, DRIVER_LEGACY)) 401 return -EINVAL; 402 403 err = drm_addmap_core(dev, map->offset, map->size, map->type, 404 map->flags, &maplist); 405 406 if (err) 407 return err; 408 409 /* avoid a warning on 64-bit, this casting isn't very nice, but the API is set so too late */ 410 map->handle = (void *)(unsigned long)maplist->user_token; 411 412 /* 413 * It appears that there are no users of this value whatsoever -- 414 * drmAddMap just discards it. Let's not encourage its use. 415 * (Keeping drm_addmap_core's returned mtrr value would be wrong -- 416 * it's not a real mtrr index anymore.) 417 */ 418 map->mtrr = -1; 419 420 return 0; 421 } 422 423 /* 424 * Get a mapping information. 425 * 426 * \param inode device inode. 427 * \param file_priv DRM file private. 428 * \param cmd command. 429 * \param arg user argument, pointing to a drm_map structure. 430 * 431 * \return zero on success or a negative number on failure. 432 * 433 * Searches for the mapping with the specified offset and copies its information 434 * into userspace 435 */ 436 int drm_legacy_getmap_ioctl(struct drm_device *dev, void *data, 437 struct drm_file *file_priv) 438 { 439 struct drm_map *map = data; 440 struct drm_map_list *r_list = NULL; 441 struct list_head *list; 442 int idx; 443 int i; 444 445 if (!drm_core_check_feature(dev, DRIVER_KMS_LEGACY_CONTEXT) && 446 !drm_core_check_feature(dev, DRIVER_LEGACY)) 447 return -EINVAL; 448 449 idx = map->offset; 450 if (idx < 0) 451 return -EINVAL; 452 453 i = 0; 454 mutex_lock(&dev->struct_mutex); 455 list_for_each(list, &dev->maplist) { 456 if (i == idx) { 457 r_list = list_entry(list, struct drm_map_list, head); 458 break; 459 } 460 i++; 461 } 462 if (!r_list || !r_list->map) { 463 mutex_unlock(&dev->struct_mutex); 464 return -EINVAL; 465 } 466 467 map->offset = r_list->map->offset; 468 map->size = r_list->map->size; 469 map->type = r_list->map->type; 470 map->flags = r_list->map->flags; 471 map->handle = (void *)(unsigned long) r_list->user_token; 472 map->mtrr = arch_phys_wc_index(r_list->map->mtrr); 473 474 mutex_unlock(&dev->struct_mutex); 475 476 return 0; 477 } 478 479 /** 480 * Remove a map private from list and deallocate resources if the mapping 481 * isn't in use. 482 * 483 * Searches the map on drm_device::maplist, removes it from the list, see if 484 * its being used, and free any associate resource (such as MTRR's) if it's not 485 * being on use. 486 * 487 * \sa drm_legacy_addmap 488 */ 489 int drm_legacy_rmmap_locked(struct drm_device *dev, struct drm_local_map *map) 490 { 491 struct drm_map_list *r_list = NULL, *list_t; 492 drm_dma_handle_t dmah; 493 int found = 0; 494 struct drm_master *master; 495 496 /* Find the list entry for the map and remove it */ 497 list_for_each_entry_safe(r_list, list_t, &dev->maplist, head) { 498 if (r_list->map == map) { 499 master = r_list->master; 500 list_del(&r_list->head); 501 drm_ht_remove_key(&dev->map_hash, 502 r_list->user_token >> PAGE_SHIFT); 503 kfree(r_list); 504 found = 1; 505 break; 506 } 507 } 508 509 if (!found) 510 return -EINVAL; 511 512 switch (map->type) { 513 case _DRM_REGISTERS: 514 iounmap(map->handle); 515 /* FALLTHROUGH */ 516 case _DRM_FRAME_BUFFER: 517 arch_phys_wc_del(map->mtrr); 518 break; 519 case _DRM_SHM: 520 vfree(map->handle); 521 if (master) { 522 if (dev->sigdata.lock == master->lock.hw_lock) 523 dev->sigdata.lock = NULL; 524 master->lock.hw_lock = NULL; /* SHM removed */ 525 master->lock.file_priv = NULL; 526 wake_up_interruptible_all(&master->lock.lock_queue); 527 } 528 break; 529 case _DRM_AGP: 530 case _DRM_SCATTER_GATHER: 531 break; 532 case _DRM_CONSISTENT: 533 dmah.vaddr = map->handle; 534 dmah.busaddr = map->offset; 535 dmah.size = map->size; 536 __drm_legacy_pci_free(dev, &dmah); 537 break; 538 } 539 kfree(map); 540 541 return 0; 542 } 543 EXPORT_SYMBOL(drm_legacy_rmmap_locked); 544 545 void drm_legacy_rmmap(struct drm_device *dev, struct drm_local_map *map) 546 { 547 if (!drm_core_check_feature(dev, DRIVER_KMS_LEGACY_CONTEXT) && 548 !drm_core_check_feature(dev, DRIVER_LEGACY)) 549 return; 550 551 mutex_lock(&dev->struct_mutex); 552 drm_legacy_rmmap_locked(dev, map); 553 mutex_unlock(&dev->struct_mutex); 554 } 555 EXPORT_SYMBOL(drm_legacy_rmmap); 556 557 void drm_legacy_master_rmmaps(struct drm_device *dev, struct drm_master *master) 558 { 559 struct drm_map_list *r_list, *list_temp; 560 561 if (!drm_core_check_feature(dev, DRIVER_LEGACY)) 562 return; 563 564 mutex_lock(&dev->struct_mutex); 565 list_for_each_entry_safe(r_list, list_temp, &dev->maplist, head) { 566 if (r_list->master == master) { 567 drm_legacy_rmmap_locked(dev, r_list->map); 568 r_list = NULL; 569 } 570 } 571 mutex_unlock(&dev->struct_mutex); 572 } 573 574 /* The rmmap ioctl appears to be unnecessary. All mappings are torn down on 575 * the last close of the device, and this is necessary for cleanup when things 576 * exit uncleanly. Therefore, having userland manually remove mappings seems 577 * like a pointless exercise since they're going away anyway. 578 * 579 * One use case might be after addmap is allowed for normal users for SHM and 580 * gets used by drivers that the server doesn't need to care about. This seems 581 * unlikely. 582 * 583 * \param inode device inode. 584 * \param file_priv DRM file private. 585 * \param cmd command. 586 * \param arg pointer to a struct drm_map structure. 587 * \return zero on success or a negative value on error. 588 */ 589 int drm_legacy_rmmap_ioctl(struct drm_device *dev, void *data, 590 struct drm_file *file_priv) 591 { 592 struct drm_map *request = data; 593 struct drm_local_map *map = NULL; 594 struct drm_map_list *r_list; 595 int ret; 596 597 if (!drm_core_check_feature(dev, DRIVER_KMS_LEGACY_CONTEXT) && 598 !drm_core_check_feature(dev, DRIVER_LEGACY)) 599 return -EINVAL; 600 601 mutex_lock(&dev->struct_mutex); 602 list_for_each_entry(r_list, &dev->maplist, head) { 603 if (r_list->map && 604 r_list->user_token == (unsigned long)request->handle && 605 r_list->map->flags & _DRM_REMOVABLE) { 606 map = r_list->map; 607 break; 608 } 609 } 610 611 /* List has wrapped around to the head pointer, or its empty we didn't 612 * find anything. 613 */ 614 if (list_empty(&dev->maplist) || !map) { 615 mutex_unlock(&dev->struct_mutex); 616 return -EINVAL; 617 } 618 619 /* Register and framebuffer maps are permanent */ 620 if ((map->type == _DRM_REGISTERS) || (map->type == _DRM_FRAME_BUFFER)) { 621 mutex_unlock(&dev->struct_mutex); 622 return 0; 623 } 624 625 ret = drm_legacy_rmmap_locked(dev, map); 626 627 mutex_unlock(&dev->struct_mutex); 628 629 return ret; 630 } 631 632 /** 633 * Cleanup after an error on one of the addbufs() functions. 634 * 635 * \param dev DRM device. 636 * \param entry buffer entry where the error occurred. 637 * 638 * Frees any pages and buffers associated with the given entry. 639 */ 640 static void drm_cleanup_buf_error(struct drm_device * dev, 641 struct drm_buf_entry * entry) 642 { 643 int i; 644 645 if (entry->seg_count) { 646 for (i = 0; i < entry->seg_count; i++) { 647 if (entry->seglist[i]) { 648 drm_pci_free(dev, entry->seglist[i]); 649 } 650 } 651 kfree(entry->seglist); 652 653 entry->seg_count = 0; 654 } 655 656 if (entry->buf_count) { 657 for (i = 0; i < entry->buf_count; i++) { 658 kfree(entry->buflist[i].dev_private); 659 } 660 kfree(entry->buflist); 661 662 entry->buf_count = 0; 663 } 664 } 665 666 #if IS_ENABLED(CONFIG_AGP) 667 /** 668 * Add AGP buffers for DMA transfers. 669 * 670 * \param dev struct drm_device to which the buffers are to be added. 671 * \param request pointer to a struct drm_buf_desc describing the request. 672 * \return zero on success or a negative number on failure. 673 * 674 * After some sanity checks creates a drm_buf structure for each buffer and 675 * reallocates the buffer list of the same size order to accommodate the new 676 * buffers. 677 */ 678 int drm_legacy_addbufs_agp(struct drm_device *dev, 679 struct drm_buf_desc *request) 680 { 681 struct drm_device_dma *dma = dev->dma; 682 struct drm_buf_entry *entry; 683 struct drm_agp_mem *agp_entry; 684 struct drm_buf *buf; 685 unsigned long offset; 686 unsigned long agp_offset; 687 int count; 688 int order; 689 int size; 690 int alignment; 691 int page_order; 692 int total; 693 int byte_count; 694 int i, valid; 695 struct drm_buf **temp_buflist; 696 697 if (!dma) 698 return -EINVAL; 699 700 count = request->count; 701 order = order_base_2(request->size); 702 size = 1 << order; 703 704 alignment = (request->flags & _DRM_PAGE_ALIGN) 705 ? PAGE_ALIGN(size) : size; 706 page_order = order - PAGE_SHIFT > 0 ? order - PAGE_SHIFT : 0; 707 total = PAGE_SIZE << page_order; 708 709 byte_count = 0; 710 agp_offset = dev->agp->base + request->agp_start; 711 712 DRM_DEBUG("count: %d\n", count); 713 DRM_DEBUG("order: %d\n", order); 714 DRM_DEBUG("size: %d\n", size); 715 DRM_DEBUG("agp_offset: %lx\n", agp_offset); 716 DRM_DEBUG("alignment: %d\n", alignment); 717 DRM_DEBUG("page_order: %d\n", page_order); 718 DRM_DEBUG("total: %d\n", total); 719 720 if (order < DRM_MIN_ORDER || order > DRM_MAX_ORDER) 721 return -EINVAL; 722 723 /* Make sure buffers are located in AGP memory that we own */ 724 valid = 0; 725 list_for_each_entry(agp_entry, &dev->agp->memory, head) { 726 if ((agp_offset >= agp_entry->bound) && 727 (agp_offset + total * count <= agp_entry->bound + agp_entry->pages * PAGE_SIZE)) { 728 valid = 1; 729 break; 730 } 731 } 732 if (!list_empty(&dev->agp->memory) && !valid) { 733 DRM_DEBUG("zone invalid\n"); 734 return -EINVAL; 735 } 736 spin_lock(&dev->buf_lock); 737 if (dev->buf_use) { 738 spin_unlock(&dev->buf_lock); 739 return -EBUSY; 740 } 741 atomic_inc(&dev->buf_alloc); 742 spin_unlock(&dev->buf_lock); 743 744 mutex_lock(&dev->struct_mutex); 745 entry = &dma->bufs[order]; 746 if (entry->buf_count) { 747 mutex_unlock(&dev->struct_mutex); 748 atomic_dec(&dev->buf_alloc); 749 return -ENOMEM; /* May only call once for each order */ 750 } 751 752 if (count < 0 || count > 4096) { 753 mutex_unlock(&dev->struct_mutex); 754 atomic_dec(&dev->buf_alloc); 755 return -EINVAL; 756 } 757 758 entry->buflist = kcalloc(count, sizeof(*entry->buflist), GFP_KERNEL); 759 if (!entry->buflist) { 760 mutex_unlock(&dev->struct_mutex); 761 atomic_dec(&dev->buf_alloc); 762 return -ENOMEM; 763 } 764 765 entry->buf_size = size; 766 entry->page_order = page_order; 767 768 offset = 0; 769 770 while (entry->buf_count < count) { 771 buf = &entry->buflist[entry->buf_count]; 772 buf->idx = dma->buf_count + entry->buf_count; 773 buf->total = alignment; 774 buf->order = order; 775 buf->used = 0; 776 777 buf->offset = (dma->byte_count + offset); 778 buf->bus_address = agp_offset + offset; 779 buf->address = (void *)(agp_offset + offset); 780 buf->next = NULL; 781 buf->waiting = 0; 782 buf->pending = 0; 783 buf->file_priv = NULL; 784 785 buf->dev_priv_size = dev->driver->dev_priv_size; 786 buf->dev_private = kzalloc(buf->dev_priv_size, GFP_KERNEL); 787 if (!buf->dev_private) { 788 /* Set count correctly so we free the proper amount. */ 789 entry->buf_count = count; 790 drm_cleanup_buf_error(dev, entry); 791 mutex_unlock(&dev->struct_mutex); 792 atomic_dec(&dev->buf_alloc); 793 return -ENOMEM; 794 } 795 796 DRM_DEBUG("buffer %d @ %p\n", entry->buf_count, buf->address); 797 798 offset += alignment; 799 entry->buf_count++; 800 byte_count += PAGE_SIZE << page_order; 801 } 802 803 DRM_DEBUG("byte_count: %d\n", byte_count); 804 805 temp_buflist = krealloc(dma->buflist, 806 (dma->buf_count + entry->buf_count) * 807 sizeof(*dma->buflist), GFP_KERNEL); 808 if (!temp_buflist) { 809 /* Free the entry because it isn't valid */ 810 drm_cleanup_buf_error(dev, entry); 811 mutex_unlock(&dev->struct_mutex); 812 atomic_dec(&dev->buf_alloc); 813 return -ENOMEM; 814 } 815 dma->buflist = temp_buflist; 816 817 for (i = 0; i < entry->buf_count; i++) { 818 dma->buflist[i + dma->buf_count] = &entry->buflist[i]; 819 } 820 821 dma->buf_count += entry->buf_count; 822 dma->seg_count += entry->seg_count; 823 dma->page_count += byte_count >> PAGE_SHIFT; 824 dma->byte_count += byte_count; 825 826 DRM_DEBUG("dma->buf_count : %d\n", dma->buf_count); 827 DRM_DEBUG("entry->buf_count : %d\n", entry->buf_count); 828 829 mutex_unlock(&dev->struct_mutex); 830 831 request->count = entry->buf_count; 832 request->size = size; 833 834 dma->flags = _DRM_DMA_USE_AGP; 835 836 atomic_dec(&dev->buf_alloc); 837 return 0; 838 } 839 EXPORT_SYMBOL(drm_legacy_addbufs_agp); 840 #endif /* CONFIG_AGP */ 841 842 int drm_legacy_addbufs_pci(struct drm_device *dev, 843 struct drm_buf_desc *request) 844 { 845 struct drm_device_dma *dma = dev->dma; 846 int count; 847 int order; 848 int size; 849 int total; 850 int page_order; 851 struct drm_buf_entry *entry; 852 drm_dma_handle_t *dmah; 853 struct drm_buf *buf; 854 int alignment; 855 unsigned long offset; 856 int i; 857 int byte_count; 858 int page_count; 859 unsigned long *temp_pagelist; 860 struct drm_buf **temp_buflist; 861 862 if (!drm_core_check_feature(dev, DRIVER_PCI_DMA)) 863 return -EINVAL; 864 865 if (!dma) 866 return -EINVAL; 867 868 if (!capable(CAP_SYS_ADMIN)) 869 return -EPERM; 870 871 count = request->count; 872 order = order_base_2(request->size); 873 size = 1 << order; 874 875 DRM_DEBUG("count=%d, size=%d (%d), order=%d\n", 876 request->count, request->size, size, order); 877 878 if (order < DRM_MIN_ORDER || order > DRM_MAX_ORDER) 879 return -EINVAL; 880 881 alignment = (request->flags & _DRM_PAGE_ALIGN) 882 ? PAGE_ALIGN(size) : size; 883 page_order = order - PAGE_SHIFT > 0 ? order - PAGE_SHIFT : 0; 884 total = PAGE_SIZE << page_order; 885 886 spin_lock(&dev->buf_lock); 887 if (dev->buf_use) { 888 spin_unlock(&dev->buf_lock); 889 return -EBUSY; 890 } 891 atomic_inc(&dev->buf_alloc); 892 spin_unlock(&dev->buf_lock); 893 894 mutex_lock(&dev->struct_mutex); 895 entry = &dma->bufs[order]; 896 if (entry->buf_count) { 897 mutex_unlock(&dev->struct_mutex); 898 atomic_dec(&dev->buf_alloc); 899 return -ENOMEM; /* May only call once for each order */ 900 } 901 902 if (count < 0 || count > 4096) { 903 mutex_unlock(&dev->struct_mutex); 904 atomic_dec(&dev->buf_alloc); 905 return -EINVAL; 906 } 907 908 entry->buflist = kcalloc(count, sizeof(*entry->buflist), GFP_KERNEL); 909 if (!entry->buflist) { 910 mutex_unlock(&dev->struct_mutex); 911 atomic_dec(&dev->buf_alloc); 912 return -ENOMEM; 913 } 914 915 entry->seglist = kcalloc(count, sizeof(*entry->seglist), GFP_KERNEL); 916 if (!entry->seglist) { 917 kfree(entry->buflist); 918 mutex_unlock(&dev->struct_mutex); 919 atomic_dec(&dev->buf_alloc); 920 return -ENOMEM; 921 } 922 923 /* Keep the original pagelist until we know all the allocations 924 * have succeeded 925 */ 926 temp_pagelist = kmalloc_array(dma->page_count + (count << page_order), 927 sizeof(*dma->pagelist), 928 GFP_KERNEL); 929 if (!temp_pagelist) { 930 kfree(entry->buflist); 931 kfree(entry->seglist); 932 mutex_unlock(&dev->struct_mutex); 933 atomic_dec(&dev->buf_alloc); 934 return -ENOMEM; 935 } 936 memcpy(temp_pagelist, 937 dma->pagelist, dma->page_count * sizeof(*dma->pagelist)); 938 DRM_DEBUG("pagelist: %d entries\n", 939 dma->page_count + (count << page_order)); 940 941 entry->buf_size = size; 942 entry->page_order = page_order; 943 byte_count = 0; 944 page_count = 0; 945 946 while (entry->buf_count < count) { 947 948 dmah = drm_pci_alloc(dev, PAGE_SIZE << page_order, 0x1000); 949 950 if (!dmah) { 951 /* Set count correctly so we free the proper amount. */ 952 entry->buf_count = count; 953 entry->seg_count = count; 954 drm_cleanup_buf_error(dev, entry); 955 kfree(temp_pagelist); 956 mutex_unlock(&dev->struct_mutex); 957 atomic_dec(&dev->buf_alloc); 958 return -ENOMEM; 959 } 960 entry->seglist[entry->seg_count++] = dmah; 961 for (i = 0; i < (1 << page_order); i++) { 962 DRM_DEBUG("page %d @ 0x%08lx\n", 963 dma->page_count + page_count, 964 (unsigned long)dmah->vaddr + PAGE_SIZE * i); 965 temp_pagelist[dma->page_count + page_count++] 966 = (unsigned long)dmah->vaddr + PAGE_SIZE * i; 967 } 968 for (offset = 0; 969 offset + size <= total && entry->buf_count < count; 970 offset += alignment, ++entry->buf_count) { 971 buf = &entry->buflist[entry->buf_count]; 972 buf->idx = dma->buf_count + entry->buf_count; 973 buf->total = alignment; 974 buf->order = order; 975 buf->used = 0; 976 buf->offset = (dma->byte_count + byte_count + offset); 977 buf->address = (void *)(dmah->vaddr + offset); 978 buf->bus_address = dmah->busaddr + offset; 979 buf->next = NULL; 980 buf->waiting = 0; 981 buf->pending = 0; 982 buf->file_priv = NULL; 983 984 buf->dev_priv_size = dev->driver->dev_priv_size; 985 buf->dev_private = kzalloc(buf->dev_priv_size, 986 GFP_KERNEL); 987 if (!buf->dev_private) { 988 /* Set count correctly so we free the proper amount. */ 989 entry->buf_count = count; 990 entry->seg_count = count; 991 drm_cleanup_buf_error(dev, entry); 992 kfree(temp_pagelist); 993 mutex_unlock(&dev->struct_mutex); 994 atomic_dec(&dev->buf_alloc); 995 return -ENOMEM; 996 } 997 998 DRM_DEBUG("buffer %d @ %p\n", 999 entry->buf_count, buf->address); 1000 } 1001 byte_count += PAGE_SIZE << page_order; 1002 } 1003 1004 temp_buflist = krealloc(dma->buflist, 1005 (dma->buf_count + entry->buf_count) * 1006 sizeof(*dma->buflist), GFP_KERNEL); 1007 if (!temp_buflist) { 1008 /* Free the entry because it isn't valid */ 1009 drm_cleanup_buf_error(dev, entry); 1010 kfree(temp_pagelist); 1011 mutex_unlock(&dev->struct_mutex); 1012 atomic_dec(&dev->buf_alloc); 1013 return -ENOMEM; 1014 } 1015 dma->buflist = temp_buflist; 1016 1017 for (i = 0; i < entry->buf_count; i++) { 1018 dma->buflist[i + dma->buf_count] = &entry->buflist[i]; 1019 } 1020 1021 /* No allocations failed, so now we can replace the original pagelist 1022 * with the new one. 1023 */ 1024 if (dma->page_count) { 1025 kfree(dma->pagelist); 1026 } 1027 dma->pagelist = temp_pagelist; 1028 1029 dma->buf_count += entry->buf_count; 1030 dma->seg_count += entry->seg_count; 1031 dma->page_count += entry->seg_count << page_order; 1032 dma->byte_count += PAGE_SIZE * (entry->seg_count << page_order); 1033 1034 mutex_unlock(&dev->struct_mutex); 1035 1036 request->count = entry->buf_count; 1037 request->size = size; 1038 1039 if (request->flags & _DRM_PCI_BUFFER_RO) 1040 dma->flags = _DRM_DMA_USE_PCI_RO; 1041 1042 atomic_dec(&dev->buf_alloc); 1043 return 0; 1044 1045 } 1046 EXPORT_SYMBOL(drm_legacy_addbufs_pci); 1047 1048 static int drm_legacy_addbufs_sg(struct drm_device *dev, 1049 struct drm_buf_desc *request) 1050 { 1051 struct drm_device_dma *dma = dev->dma; 1052 struct drm_buf_entry *entry; 1053 struct drm_buf *buf; 1054 unsigned long offset; 1055 unsigned long agp_offset; 1056 int count; 1057 int order; 1058 int size; 1059 int alignment; 1060 int page_order; 1061 int total; 1062 int byte_count; 1063 int i; 1064 struct drm_buf **temp_buflist; 1065 1066 if (!drm_core_check_feature(dev, DRIVER_SG)) 1067 return -EINVAL; 1068 1069 if (!dma) 1070 return -EINVAL; 1071 1072 if (!capable(CAP_SYS_ADMIN)) 1073 return -EPERM; 1074 1075 count = request->count; 1076 order = order_base_2(request->size); 1077 size = 1 << order; 1078 1079 alignment = (request->flags & _DRM_PAGE_ALIGN) 1080 ? PAGE_ALIGN(size) : size; 1081 page_order = order - PAGE_SHIFT > 0 ? order - PAGE_SHIFT : 0; 1082 total = PAGE_SIZE << page_order; 1083 1084 byte_count = 0; 1085 agp_offset = request->agp_start; 1086 1087 DRM_DEBUG("count: %d\n", count); 1088 DRM_DEBUG("order: %d\n", order); 1089 DRM_DEBUG("size: %d\n", size); 1090 DRM_DEBUG("agp_offset: %lu\n", agp_offset); 1091 DRM_DEBUG("alignment: %d\n", alignment); 1092 DRM_DEBUG("page_order: %d\n", page_order); 1093 DRM_DEBUG("total: %d\n", total); 1094 1095 if (order < DRM_MIN_ORDER || order > DRM_MAX_ORDER) 1096 return -EINVAL; 1097 1098 spin_lock(&dev->buf_lock); 1099 if (dev->buf_use) { 1100 spin_unlock(&dev->buf_lock); 1101 return -EBUSY; 1102 } 1103 atomic_inc(&dev->buf_alloc); 1104 spin_unlock(&dev->buf_lock); 1105 1106 mutex_lock(&dev->struct_mutex); 1107 entry = &dma->bufs[order]; 1108 if (entry->buf_count) { 1109 mutex_unlock(&dev->struct_mutex); 1110 atomic_dec(&dev->buf_alloc); 1111 return -ENOMEM; /* May only call once for each order */ 1112 } 1113 1114 if (count < 0 || count > 4096) { 1115 mutex_unlock(&dev->struct_mutex); 1116 atomic_dec(&dev->buf_alloc); 1117 return -EINVAL; 1118 } 1119 1120 entry->buflist = kcalloc(count, sizeof(*entry->buflist), GFP_KERNEL); 1121 if (!entry->buflist) { 1122 mutex_unlock(&dev->struct_mutex); 1123 atomic_dec(&dev->buf_alloc); 1124 return -ENOMEM; 1125 } 1126 1127 entry->buf_size = size; 1128 entry->page_order = page_order; 1129 1130 offset = 0; 1131 1132 while (entry->buf_count < count) { 1133 buf = &entry->buflist[entry->buf_count]; 1134 buf->idx = dma->buf_count + entry->buf_count; 1135 buf->total = alignment; 1136 buf->order = order; 1137 buf->used = 0; 1138 1139 buf->offset = (dma->byte_count + offset); 1140 buf->bus_address = agp_offset + offset; 1141 buf->address = (void *)(agp_offset + offset 1142 + (unsigned long)dev->sg->virtual); 1143 buf->next = NULL; 1144 buf->waiting = 0; 1145 buf->pending = 0; 1146 buf->file_priv = NULL; 1147 1148 buf->dev_priv_size = dev->driver->dev_priv_size; 1149 buf->dev_private = kzalloc(buf->dev_priv_size, GFP_KERNEL); 1150 if (!buf->dev_private) { 1151 /* Set count correctly so we free the proper amount. */ 1152 entry->buf_count = count; 1153 drm_cleanup_buf_error(dev, entry); 1154 mutex_unlock(&dev->struct_mutex); 1155 atomic_dec(&dev->buf_alloc); 1156 return -ENOMEM; 1157 } 1158 1159 DRM_DEBUG("buffer %d @ %p\n", entry->buf_count, buf->address); 1160 1161 offset += alignment; 1162 entry->buf_count++; 1163 byte_count += PAGE_SIZE << page_order; 1164 } 1165 1166 DRM_DEBUG("byte_count: %d\n", byte_count); 1167 1168 temp_buflist = krealloc(dma->buflist, 1169 (dma->buf_count + entry->buf_count) * 1170 sizeof(*dma->buflist), GFP_KERNEL); 1171 if (!temp_buflist) { 1172 /* Free the entry because it isn't valid */ 1173 drm_cleanup_buf_error(dev, entry); 1174 mutex_unlock(&dev->struct_mutex); 1175 atomic_dec(&dev->buf_alloc); 1176 return -ENOMEM; 1177 } 1178 dma->buflist = temp_buflist; 1179 1180 for (i = 0; i < entry->buf_count; i++) { 1181 dma->buflist[i + dma->buf_count] = &entry->buflist[i]; 1182 } 1183 1184 dma->buf_count += entry->buf_count; 1185 dma->seg_count += entry->seg_count; 1186 dma->page_count += byte_count >> PAGE_SHIFT; 1187 dma->byte_count += byte_count; 1188 1189 DRM_DEBUG("dma->buf_count : %d\n", dma->buf_count); 1190 DRM_DEBUG("entry->buf_count : %d\n", entry->buf_count); 1191 1192 mutex_unlock(&dev->struct_mutex); 1193 1194 request->count = entry->buf_count; 1195 request->size = size; 1196 1197 dma->flags = _DRM_DMA_USE_SG; 1198 1199 atomic_dec(&dev->buf_alloc); 1200 return 0; 1201 } 1202 1203 /** 1204 * Add buffers for DMA transfers (ioctl). 1205 * 1206 * \param inode device inode. 1207 * \param file_priv DRM file private. 1208 * \param cmd command. 1209 * \param arg pointer to a struct drm_buf_desc request. 1210 * \return zero on success or a negative number on failure. 1211 * 1212 * According with the memory type specified in drm_buf_desc::flags and the 1213 * build options, it dispatches the call either to addbufs_agp(), 1214 * addbufs_sg() or addbufs_pci() for AGP, scatter-gather or consistent 1215 * PCI memory respectively. 1216 */ 1217 int drm_legacy_addbufs(struct drm_device *dev, void *data, 1218 struct drm_file *file_priv) 1219 { 1220 struct drm_buf_desc *request = data; 1221 int ret; 1222 1223 if (!drm_core_check_feature(dev, DRIVER_LEGACY)) 1224 return -EINVAL; 1225 1226 if (!drm_core_check_feature(dev, DRIVER_HAVE_DMA)) 1227 return -EINVAL; 1228 1229 #if IS_ENABLED(CONFIG_AGP) 1230 if (request->flags & _DRM_AGP_BUFFER) 1231 ret = drm_legacy_addbufs_agp(dev, request); 1232 else 1233 #endif 1234 if (request->flags & _DRM_SG_BUFFER) 1235 ret = drm_legacy_addbufs_sg(dev, request); 1236 else if (request->flags & _DRM_FB_BUFFER) 1237 ret = -EINVAL; 1238 else 1239 ret = drm_legacy_addbufs_pci(dev, request); 1240 1241 return ret; 1242 } 1243 1244 /** 1245 * Get information about the buffer mappings. 1246 * 1247 * This was originally mean for debugging purposes, or by a sophisticated 1248 * client library to determine how best to use the available buffers (e.g., 1249 * large buffers can be used for image transfer). 1250 * 1251 * \param inode device inode. 1252 * \param file_priv DRM file private. 1253 * \param cmd command. 1254 * \param arg pointer to a drm_buf_info structure. 1255 * \return zero on success or a negative number on failure. 1256 * 1257 * Increments drm_device::buf_use while holding the drm_device::buf_lock 1258 * lock, preventing of allocating more buffers after this call. Information 1259 * about each requested buffer is then copied into user space. 1260 */ 1261 int __drm_legacy_infobufs(struct drm_device *dev, 1262 void *data, int *p, 1263 int (*f)(void *, int, struct drm_buf_entry *)) 1264 { 1265 struct drm_device_dma *dma = dev->dma; 1266 int i; 1267 int count; 1268 1269 if (!drm_core_check_feature(dev, DRIVER_LEGACY)) 1270 return -EINVAL; 1271 1272 if (!drm_core_check_feature(dev, DRIVER_HAVE_DMA)) 1273 return -EINVAL; 1274 1275 if (!dma) 1276 return -EINVAL; 1277 1278 spin_lock(&dev->buf_lock); 1279 if (atomic_read(&dev->buf_alloc)) { 1280 spin_unlock(&dev->buf_lock); 1281 return -EBUSY; 1282 } 1283 ++dev->buf_use; /* Can't allocate more after this call */ 1284 spin_unlock(&dev->buf_lock); 1285 1286 for (i = 0, count = 0; i < DRM_MAX_ORDER + 1; i++) { 1287 if (dma->bufs[i].buf_count) 1288 ++count; 1289 } 1290 1291 DRM_DEBUG("count = %d\n", count); 1292 1293 if (*p >= count) { 1294 for (i = 0, count = 0; i < DRM_MAX_ORDER + 1; i++) { 1295 struct drm_buf_entry *from = &dma->bufs[i]; 1296 if (from->buf_count) { 1297 if (f(data, count, from) < 0) 1298 return -EFAULT; 1299 DRM_DEBUG("%d %d %d %d %d\n", 1300 i, 1301 dma->bufs[i].buf_count, 1302 dma->bufs[i].buf_size, 1303 dma->bufs[i].low_mark, 1304 dma->bufs[i].high_mark); 1305 ++count; 1306 } 1307 } 1308 } 1309 *p = count; 1310 1311 return 0; 1312 } 1313 1314 static int copy_one_buf(void *data, int count, struct drm_buf_entry *from) 1315 { 1316 struct drm_buf_info *request = data; 1317 struct drm_buf_desc __user *to = &request->list[count]; 1318 struct drm_buf_desc v = {.count = from->buf_count, 1319 .size = from->buf_size, 1320 .low_mark = from->low_mark, 1321 .high_mark = from->high_mark}; 1322 return copy_to_user(to, &v, offsetof(struct drm_buf_desc, flags)); 1323 } 1324 1325 int drm_legacy_infobufs(struct drm_device *dev, void *data, 1326 struct drm_file *file_priv) 1327 { 1328 struct drm_buf_info *request = data; 1329 return __drm_legacy_infobufs(dev, data, &request->count, copy_one_buf); 1330 } 1331 1332 /** 1333 * Specifies a low and high water mark for buffer allocation 1334 * 1335 * \param inode device inode. 1336 * \param file_priv DRM file private. 1337 * \param cmd command. 1338 * \param arg a pointer to a drm_buf_desc structure. 1339 * \return zero on success or a negative number on failure. 1340 * 1341 * Verifies that the size order is bounded between the admissible orders and 1342 * updates the respective drm_device_dma::bufs entry low and high water mark. 1343 * 1344 * \note This ioctl is deprecated and mostly never used. 1345 */ 1346 int drm_legacy_markbufs(struct drm_device *dev, void *data, 1347 struct drm_file *file_priv) 1348 { 1349 struct drm_device_dma *dma = dev->dma; 1350 struct drm_buf_desc *request = data; 1351 int order; 1352 struct drm_buf_entry *entry; 1353 1354 if (!drm_core_check_feature(dev, DRIVER_LEGACY)) 1355 return -EINVAL; 1356 1357 if (!drm_core_check_feature(dev, DRIVER_HAVE_DMA)) 1358 return -EINVAL; 1359 1360 if (!dma) 1361 return -EINVAL; 1362 1363 DRM_DEBUG("%d, %d, %d\n", 1364 request->size, request->low_mark, request->high_mark); 1365 order = order_base_2(request->size); 1366 if (order < DRM_MIN_ORDER || order > DRM_MAX_ORDER) 1367 return -EINVAL; 1368 entry = &dma->bufs[order]; 1369 1370 if (request->low_mark < 0 || request->low_mark > entry->buf_count) 1371 return -EINVAL; 1372 if (request->high_mark < 0 || request->high_mark > entry->buf_count) 1373 return -EINVAL; 1374 1375 entry->low_mark = request->low_mark; 1376 entry->high_mark = request->high_mark; 1377 1378 return 0; 1379 } 1380 1381 /** 1382 * Unreserve the buffers in list, previously reserved using drmDMA. 1383 * 1384 * \param inode device inode. 1385 * \param file_priv DRM file private. 1386 * \param cmd command. 1387 * \param arg pointer to a drm_buf_free structure. 1388 * \return zero on success or a negative number on failure. 1389 * 1390 * Calls free_buffer() for each used buffer. 1391 * This function is primarily used for debugging. 1392 */ 1393 int drm_legacy_freebufs(struct drm_device *dev, void *data, 1394 struct drm_file *file_priv) 1395 { 1396 struct drm_device_dma *dma = dev->dma; 1397 struct drm_buf_free *request = data; 1398 int i; 1399 int idx; 1400 struct drm_buf *buf; 1401 1402 if (!drm_core_check_feature(dev, DRIVER_LEGACY)) 1403 return -EINVAL; 1404 1405 if (!drm_core_check_feature(dev, DRIVER_HAVE_DMA)) 1406 return -EINVAL; 1407 1408 if (!dma) 1409 return -EINVAL; 1410 1411 DRM_DEBUG("%d\n", request->count); 1412 for (i = 0; i < request->count; i++) { 1413 if (copy_from_user(&idx, &request->list[i], sizeof(idx))) 1414 return -EFAULT; 1415 if (idx < 0 || idx >= dma->buf_count) { 1416 DRM_ERROR("Index %d (of %d max)\n", 1417 idx, dma->buf_count - 1); 1418 return -EINVAL; 1419 } 1420 buf = dma->buflist[idx]; 1421 if (buf->file_priv != file_priv) { 1422 DRM_ERROR("Process %d freeing buffer not owned\n", 1423 task_pid_nr(current)); 1424 return -EINVAL; 1425 } 1426 drm_legacy_free_buffer(dev, buf); 1427 } 1428 1429 return 0; 1430 } 1431 1432 /** 1433 * Maps all of the DMA buffers into client-virtual space (ioctl). 1434 * 1435 * \param inode device inode. 1436 * \param file_priv DRM file private. 1437 * \param cmd command. 1438 * \param arg pointer to a drm_buf_map structure. 1439 * \return zero on success or a negative number on failure. 1440 * 1441 * Maps the AGP, SG or PCI buffer region with vm_mmap(), and copies information 1442 * about each buffer into user space. For PCI buffers, it calls vm_mmap() with 1443 * offset equal to 0, which drm_mmap() interpretes as PCI buffers and calls 1444 * drm_mmap_dma(). 1445 */ 1446 int __drm_legacy_mapbufs(struct drm_device *dev, void *data, int *p, 1447 void __user **v, 1448 int (*f)(void *, int, unsigned long, 1449 struct drm_buf *), 1450 struct drm_file *file_priv) 1451 { 1452 struct drm_device_dma *dma = dev->dma; 1453 int retcode = 0; 1454 unsigned long virtual; 1455 int i; 1456 1457 if (!drm_core_check_feature(dev, DRIVER_LEGACY)) 1458 return -EINVAL; 1459 1460 if (!drm_core_check_feature(dev, DRIVER_HAVE_DMA)) 1461 return -EINVAL; 1462 1463 if (!dma) 1464 return -EINVAL; 1465 1466 spin_lock(&dev->buf_lock); 1467 if (atomic_read(&dev->buf_alloc)) { 1468 spin_unlock(&dev->buf_lock); 1469 return -EBUSY; 1470 } 1471 dev->buf_use++; /* Can't allocate more after this call */ 1472 spin_unlock(&dev->buf_lock); 1473 1474 if (*p >= dma->buf_count) { 1475 if ((dev->agp && (dma->flags & _DRM_DMA_USE_AGP)) 1476 || (drm_core_check_feature(dev, DRIVER_SG) 1477 && (dma->flags & _DRM_DMA_USE_SG))) { 1478 struct drm_local_map *map = dev->agp_buffer_map; 1479 unsigned long token = dev->agp_buffer_token; 1480 1481 if (!map) { 1482 retcode = -EINVAL; 1483 goto done; 1484 } 1485 virtual = vm_mmap(file_priv->filp, 0, map->size, 1486 PROT_READ | PROT_WRITE, 1487 MAP_SHARED, 1488 token); 1489 } else { 1490 virtual = vm_mmap(file_priv->filp, 0, dma->byte_count, 1491 PROT_READ | PROT_WRITE, 1492 MAP_SHARED, 0); 1493 } 1494 if (virtual > -1024UL) { 1495 /* Real error */ 1496 retcode = (signed long)virtual; 1497 goto done; 1498 } 1499 *v = (void __user *)virtual; 1500 1501 for (i = 0; i < dma->buf_count; i++) { 1502 if (f(data, i, virtual, dma->buflist[i]) < 0) { 1503 retcode = -EFAULT; 1504 goto done; 1505 } 1506 } 1507 } 1508 done: 1509 *p = dma->buf_count; 1510 DRM_DEBUG("%d buffers, retcode = %d\n", *p, retcode); 1511 1512 return retcode; 1513 } 1514 1515 static int map_one_buf(void *data, int idx, unsigned long virtual, 1516 struct drm_buf *buf) 1517 { 1518 struct drm_buf_map *request = data; 1519 unsigned long address = virtual + buf->offset; /* *** */ 1520 1521 if (copy_to_user(&request->list[idx].idx, &buf->idx, 1522 sizeof(request->list[0].idx))) 1523 return -EFAULT; 1524 if (copy_to_user(&request->list[idx].total, &buf->total, 1525 sizeof(request->list[0].total))) 1526 return -EFAULT; 1527 if (clear_user(&request->list[idx].used, sizeof(int))) 1528 return -EFAULT; 1529 if (copy_to_user(&request->list[idx].address, &address, 1530 sizeof(address))) 1531 return -EFAULT; 1532 return 0; 1533 } 1534 1535 int drm_legacy_mapbufs(struct drm_device *dev, void *data, 1536 struct drm_file *file_priv) 1537 { 1538 struct drm_buf_map *request = data; 1539 return __drm_legacy_mapbufs(dev, data, &request->count, 1540 &request->virtual, map_one_buf, 1541 file_priv); 1542 } 1543 1544 int drm_legacy_dma_ioctl(struct drm_device *dev, void *data, 1545 struct drm_file *file_priv) 1546 { 1547 if (!drm_core_check_feature(dev, DRIVER_LEGACY)) 1548 return -EINVAL; 1549 1550 if (dev->driver->dma_ioctl) 1551 return dev->driver->dma_ioctl(dev, data, file_priv); 1552 else 1553 return -EINVAL; 1554 } 1555 1556 struct drm_local_map *drm_legacy_getsarea(struct drm_device *dev) 1557 { 1558 struct drm_map_list *entry; 1559 1560 list_for_each_entry(entry, &dev->maplist, head) { 1561 if (entry->map && entry->map->type == _DRM_SHM && 1562 (entry->map->flags & _DRM_CONTAINS_LOCK)) { 1563 return entry->map; 1564 } 1565 } 1566 return NULL; 1567 } 1568 EXPORT_SYMBOL(drm_legacy_getsarea); 1569