x86: make vmap yell louder when it is used under irqs_disabled()
[linux-2.6.git] / drivers / gpu / drm / i915 / i915_gem.c
1 /*
2  * Copyright © 2008 Intel Corporation
3  *
4  * Permission is hereby granted, free of charge, to any person obtaining a
5  * copy of this software and associated documentation files (the "Software"),
6  * to deal in the Software without restriction, including without limitation
7  * the rights to use, copy, modify, merge, publish, distribute, sublicense,
8  * and/or sell copies of the Software, and to permit persons to whom the
9  * Software is furnished to do so, subject to the following conditions:
10  *
11  * The above copyright notice and this permission notice (including the next
12  * paragraph) shall be included in all copies or substantial portions of the
13  * Software.
14  *
15  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
18  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
20  * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
21  * IN THE SOFTWARE.
22  *
23  * Authors:
24  *    Eric Anholt <eric@anholt.net>
25  *
26  */
27
28 #include "drmP.h"
29 #include "drm.h"
30 #include "i915_drm.h"
31 #include "i915_drv.h"
32 #include <linux/swap.h>
33 #include <linux/pci.h>
34
35 #define I915_GEM_GPU_DOMAINS    (~(I915_GEM_DOMAIN_CPU | I915_GEM_DOMAIN_GTT))
36
37 static void
38 i915_gem_object_set_to_gpu_domain(struct drm_gem_object *obj,
39                                   uint32_t read_domains,
40                                   uint32_t write_domain);
41 static void i915_gem_object_flush_gpu_write_domain(struct drm_gem_object *obj);
42 static void i915_gem_object_flush_gtt_write_domain(struct drm_gem_object *obj);
43 static void i915_gem_object_flush_cpu_write_domain(struct drm_gem_object *obj);
44 static int i915_gem_object_set_to_cpu_domain(struct drm_gem_object *obj,
45                                              int write);
46 static int i915_gem_object_set_cpu_read_domain_range(struct drm_gem_object *obj,
47                                                      uint64_t offset,
48                                                      uint64_t size);
49 static void i915_gem_object_set_to_full_cpu_read_domain(struct drm_gem_object *obj);
50 static int i915_gem_object_get_page_list(struct drm_gem_object *obj);
51 static void i915_gem_object_free_page_list(struct drm_gem_object *obj);
52 static int i915_gem_object_wait_rendering(struct drm_gem_object *obj);
53 static int i915_gem_object_bind_to_gtt(struct drm_gem_object *obj,
54                                            unsigned alignment);
55 static int i915_gem_object_get_fence_reg(struct drm_gem_object *obj, bool write);
56 static void i915_gem_clear_fence_reg(struct drm_gem_object *obj);
57 static int i915_gem_evict_something(struct drm_device *dev);
58 static int i915_gem_phys_pwrite(struct drm_device *dev, struct drm_gem_object *obj,
59                                 struct drm_i915_gem_pwrite *args,
60                                 struct drm_file *file_priv);
61
62 int i915_gem_do_init(struct drm_device *dev, unsigned long start,
63                      unsigned long end)
64 {
65         drm_i915_private_t *dev_priv = dev->dev_private;
66
67         if (start >= end ||
68             (start & (PAGE_SIZE - 1)) != 0 ||
69             (end & (PAGE_SIZE - 1)) != 0) {
70                 return -EINVAL;
71         }
72
73         drm_mm_init(&dev_priv->mm.gtt_space, start,
74                     end - start);
75
76         dev->gtt_total = (uint32_t) (end - start);
77
78         return 0;
79 }
80
81 int
82 i915_gem_init_ioctl(struct drm_device *dev, void *data,
83                     struct drm_file *file_priv)
84 {
85         struct drm_i915_gem_init *args = data;
86         int ret;
87
88         mutex_lock(&dev->struct_mutex);
89         ret = i915_gem_do_init(dev, args->gtt_start, args->gtt_end);
90         mutex_unlock(&dev->struct_mutex);
91
92         return ret;
93 }
94
95 int
96 i915_gem_get_aperture_ioctl(struct drm_device *dev, void *data,
97                             struct drm_file *file_priv)
98 {
99         struct drm_i915_gem_get_aperture *args = data;
100
101         if (!(dev->driver->driver_features & DRIVER_GEM))
102                 return -ENODEV;
103
104         args->aper_size = dev->gtt_total;
105         args->aper_available_size = (args->aper_size -
106                                      atomic_read(&dev->pin_memory));
107
108         return 0;
109 }
110
111
112 /**
113  * Creates a new mm object and returns a handle to it.
114  */
115 int
116 i915_gem_create_ioctl(struct drm_device *dev, void *data,
117                       struct drm_file *file_priv)
118 {
119         struct drm_i915_gem_create *args = data;
120         struct drm_gem_object *obj;
121         int handle, ret;
122
123         args->size = roundup(args->size, PAGE_SIZE);
124
125         /* Allocate the new object */
126         obj = drm_gem_object_alloc(dev, args->size);
127         if (obj == NULL)
128                 return -ENOMEM;
129
130         ret = drm_gem_handle_create(file_priv, obj, &handle);
131         mutex_lock(&dev->struct_mutex);
132         drm_gem_object_handle_unreference(obj);
133         mutex_unlock(&dev->struct_mutex);
134
135         if (ret)
136                 return ret;
137
138         args->handle = handle;
139
140         return 0;
141 }
142
143 /**
144  * Reads data from the object referenced by handle.
145  *
146  * On error, the contents of *data are undefined.
147  */
148 int
149 i915_gem_pread_ioctl(struct drm_device *dev, void *data,
150                      struct drm_file *file_priv)
151 {
152         struct drm_i915_gem_pread *args = data;
153         struct drm_gem_object *obj;
154         struct drm_i915_gem_object *obj_priv;
155         ssize_t read;
156         loff_t offset;
157         int ret;
158
159         obj = drm_gem_object_lookup(dev, file_priv, args->handle);
160         if (obj == NULL)
161                 return -EBADF;
162         obj_priv = obj->driver_private;
163
164         /* Bounds check source.
165          *
166          * XXX: This could use review for overflow issues...
167          */
168         if (args->offset > obj->size || args->size > obj->size ||
169             args->offset + args->size > obj->size) {
170                 drm_gem_object_unreference(obj);
171                 return -EINVAL;
172         }
173
174         mutex_lock(&dev->struct_mutex);
175
176         ret = i915_gem_object_set_cpu_read_domain_range(obj, args->offset,
177                                                         args->size);
178         if (ret != 0) {
179                 drm_gem_object_unreference(obj);
180                 mutex_unlock(&dev->struct_mutex);
181                 return ret;
182         }
183
184         offset = args->offset;
185
186         read = vfs_read(obj->filp, (char __user *)(uintptr_t)args->data_ptr,
187                         args->size, &offset);
188         if (read != args->size) {
189                 drm_gem_object_unreference(obj);
190                 mutex_unlock(&dev->struct_mutex);
191                 if (read < 0)
192                         return read;
193                 else
194                         return -EINVAL;
195         }
196
197         drm_gem_object_unreference(obj);
198         mutex_unlock(&dev->struct_mutex);
199
200         return 0;
201 }
202
203 /* This is the fast write path which cannot handle
204  * page faults in the source data
205  */
206
207 static inline int
208 fast_user_write(struct io_mapping *mapping,
209                 loff_t page_base, int page_offset,
210                 char __user *user_data,
211                 int length)
212 {
213         char *vaddr_atomic;
214         unsigned long unwritten;
215
216         vaddr_atomic = io_mapping_map_atomic_wc(mapping, page_base);
217         unwritten = __copy_from_user_inatomic_nocache(vaddr_atomic + page_offset,
218                                                       user_data, length, length);
219         io_mapping_unmap_atomic(vaddr_atomic);
220         if (unwritten)
221                 return -EFAULT;
222         return 0;
223 }
224
225 /* Here's the write path which can sleep for
226  * page faults
227  */
228
229 static inline int
230 slow_user_write(struct io_mapping *mapping,
231                 loff_t page_base, int page_offset,
232                 char __user *user_data,
233                 int length)
234 {
235         char __iomem *vaddr;
236         unsigned long unwritten;
237
238         vaddr = io_mapping_map_wc(mapping, page_base);
239         if (vaddr == NULL)
240                 return -EFAULT;
241         unwritten = __copy_from_user(vaddr + page_offset,
242                                      user_data, length);
243         io_mapping_unmap(vaddr);
244         if (unwritten)
245                 return -EFAULT;
246         return 0;
247 }
248
249 static int
250 i915_gem_gtt_pwrite(struct drm_device *dev, struct drm_gem_object *obj,
251                     struct drm_i915_gem_pwrite *args,
252                     struct drm_file *file_priv)
253 {
254         struct drm_i915_gem_object *obj_priv = obj->driver_private;
255         drm_i915_private_t *dev_priv = dev->dev_private;
256         ssize_t remain;
257         loff_t offset, page_base;
258         char __user *user_data;
259         int page_offset, page_length;
260         int ret;
261
262         user_data = (char __user *) (uintptr_t) args->data_ptr;
263         remain = args->size;
264         if (!access_ok(VERIFY_READ, user_data, remain))
265                 return -EFAULT;
266
267
268         mutex_lock(&dev->struct_mutex);
269         ret = i915_gem_object_pin(obj, 0);
270         if (ret) {
271                 mutex_unlock(&dev->struct_mutex);
272                 return ret;
273         }
274         ret = i915_gem_object_set_to_gtt_domain(obj, 1);
275         if (ret)
276                 goto fail;
277
278         obj_priv = obj->driver_private;
279         offset = obj_priv->gtt_offset + args->offset;
280         obj_priv->dirty = 1;
281
282         while (remain > 0) {
283                 /* Operation in this page
284                  *
285                  * page_base = page offset within aperture
286                  * page_offset = offset within page
287                  * page_length = bytes to copy for this page
288                  */
289                 page_base = (offset & ~(PAGE_SIZE-1));
290                 page_offset = offset & (PAGE_SIZE-1);
291                 page_length = remain;
292                 if ((page_offset + remain) > PAGE_SIZE)
293                         page_length = PAGE_SIZE - page_offset;
294
295                 ret = fast_user_write (dev_priv->mm.gtt_mapping, page_base,
296                                        page_offset, user_data, page_length);
297
298                 /* If we get a fault while copying data, then (presumably) our
299                  * source page isn't available. In this case, use the
300                  * non-atomic function
301                  */
302                 if (ret) {
303                         ret = slow_user_write (dev_priv->mm.gtt_mapping,
304                                                page_base, page_offset,
305                                                user_data, page_length);
306                         if (ret)
307                                 goto fail;
308                 }
309
310                 remain -= page_length;
311                 user_data += page_length;
312                 offset += page_length;
313         }
314
315 fail:
316         i915_gem_object_unpin(obj);
317         mutex_unlock(&dev->struct_mutex);
318
319         return ret;
320 }
321
322 static int
323 i915_gem_shmem_pwrite(struct drm_device *dev, struct drm_gem_object *obj,
324                       struct drm_i915_gem_pwrite *args,
325                       struct drm_file *file_priv)
326 {
327         int ret;
328         loff_t offset;
329         ssize_t written;
330
331         mutex_lock(&dev->struct_mutex);
332
333         ret = i915_gem_object_set_to_cpu_domain(obj, 1);
334         if (ret) {
335                 mutex_unlock(&dev->struct_mutex);
336                 return ret;
337         }
338
339         offset = args->offset;
340
341         written = vfs_write(obj->filp,
342                             (char __user *)(uintptr_t) args->data_ptr,
343                             args->size, &offset);
344         if (written != args->size) {
345                 mutex_unlock(&dev->struct_mutex);
346                 if (written < 0)
347                         return written;
348                 else
349                         return -EINVAL;
350         }
351
352         mutex_unlock(&dev->struct_mutex);
353
354         return 0;
355 }
356
357 /**
358  * Writes data to the object referenced by handle.
359  *
360  * On error, the contents of the buffer that were to be modified are undefined.
361  */
362 int
363 i915_gem_pwrite_ioctl(struct drm_device *dev, void *data,
364                       struct drm_file *file_priv)
365 {
366         struct drm_i915_gem_pwrite *args = data;
367         struct drm_gem_object *obj;
368         struct drm_i915_gem_object *obj_priv;
369         int ret = 0;
370
371         obj = drm_gem_object_lookup(dev, file_priv, args->handle);
372         if (obj == NULL)
373                 return -EBADF;
374         obj_priv = obj->driver_private;
375
376         /* Bounds check destination.
377          *
378          * XXX: This could use review for overflow issues...
379          */
380         if (args->offset > obj->size || args->size > obj->size ||
381             args->offset + args->size > obj->size) {
382                 drm_gem_object_unreference(obj);
383                 return -EINVAL;
384         }
385
386         /* We can only do the GTT pwrite on untiled buffers, as otherwise
387          * it would end up going through the fenced access, and we'll get
388          * different detiling behavior between reading and writing.
389          * pread/pwrite currently are reading and writing from the CPU
390          * perspective, requiring manual detiling by the client.
391          */
392         if (obj_priv->phys_obj)
393                 ret = i915_gem_phys_pwrite(dev, obj, args, file_priv);
394         else if (obj_priv->tiling_mode == I915_TILING_NONE &&
395                  dev->gtt_total != 0)
396                 ret = i915_gem_gtt_pwrite(dev, obj, args, file_priv);
397         else
398                 ret = i915_gem_shmem_pwrite(dev, obj, args, file_priv);
399
400 #if WATCH_PWRITE
401         if (ret)
402                 DRM_INFO("pwrite failed %d\n", ret);
403 #endif
404
405         drm_gem_object_unreference(obj);
406
407         return ret;
408 }
409
410 /**
411  * Called when user space prepares to use an object with the CPU, either
412  * through the mmap ioctl's mapping or a GTT mapping.
413  */
414 int
415 i915_gem_set_domain_ioctl(struct drm_device *dev, void *data,
416                           struct drm_file *file_priv)
417 {
418         struct drm_i915_gem_set_domain *args = data;
419         struct drm_gem_object *obj;
420         uint32_t read_domains = args->read_domains;
421         uint32_t write_domain = args->write_domain;
422         int ret;
423
424         if (!(dev->driver->driver_features & DRIVER_GEM))
425                 return -ENODEV;
426
427         /* Only handle setting domains to types used by the CPU. */
428         if (write_domain & ~(I915_GEM_DOMAIN_CPU | I915_GEM_DOMAIN_GTT))
429                 return -EINVAL;
430
431         if (read_domains & ~(I915_GEM_DOMAIN_CPU | I915_GEM_DOMAIN_GTT))
432                 return -EINVAL;
433
434         /* Having something in the write domain implies it's in the read
435          * domain, and only that read domain.  Enforce that in the request.
436          */
437         if (write_domain != 0 && read_domains != write_domain)
438                 return -EINVAL;
439
440         obj = drm_gem_object_lookup(dev, file_priv, args->handle);
441         if (obj == NULL)
442                 return -EBADF;
443
444         mutex_lock(&dev->struct_mutex);
445 #if WATCH_BUF
446         DRM_INFO("set_domain_ioctl %p(%d), %08x %08x\n",
447                  obj, obj->size, read_domains, write_domain);
448 #endif
449         if (read_domains & I915_GEM_DOMAIN_GTT) {
450                 ret = i915_gem_object_set_to_gtt_domain(obj, write_domain != 0);
451
452                 /* Silently promote "you're not bound, there was nothing to do"
453                  * to success, since the client was just asking us to
454                  * make sure everything was done.
455                  */
456                 if (ret == -EINVAL)
457                         ret = 0;
458         } else {
459                 ret = i915_gem_object_set_to_cpu_domain(obj, write_domain != 0);
460         }
461
462         drm_gem_object_unreference(obj);
463         mutex_unlock(&dev->struct_mutex);
464         return ret;
465 }
466
467 /**
468  * Called when user space has done writes to this buffer
469  */
470 int
471 i915_gem_sw_finish_ioctl(struct drm_device *dev, void *data,
472                       struct drm_file *file_priv)
473 {
474         struct drm_i915_gem_sw_finish *args = data;
475         struct drm_gem_object *obj;
476         struct drm_i915_gem_object *obj_priv;
477         int ret = 0;
478
479         if (!(dev->driver->driver_features & DRIVER_GEM))
480                 return -ENODEV;
481
482         mutex_lock(&dev->struct_mutex);
483         obj = drm_gem_object_lookup(dev, file_priv, args->handle);
484         if (obj == NULL) {
485                 mutex_unlock(&dev->struct_mutex);
486                 return -EBADF;
487         }
488
489 #if WATCH_BUF
490         DRM_INFO("%s: sw_finish %d (%p %d)\n",
491                  __func__, args->handle, obj, obj->size);
492 #endif
493         obj_priv = obj->driver_private;
494
495         /* Pinned buffers may be scanout, so flush the cache */
496         if (obj_priv->pin_count)
497                 i915_gem_object_flush_cpu_write_domain(obj);
498
499         drm_gem_object_unreference(obj);
500         mutex_unlock(&dev->struct_mutex);
501         return ret;
502 }
503
504 /**
505  * Maps the contents of an object, returning the address it is mapped
506  * into.
507  *
508  * While the mapping holds a reference on the contents of the object, it doesn't
509  * imply a ref on the object itself.
510  */
511 int
512 i915_gem_mmap_ioctl(struct drm_device *dev, void *data,
513                    struct drm_file *file_priv)
514 {
515         struct drm_i915_gem_mmap *args = data;
516         struct drm_gem_object *obj;
517         loff_t offset;
518         unsigned long addr;
519
520         if (!(dev->driver->driver_features & DRIVER_GEM))
521                 return -ENODEV;
522
523         obj = drm_gem_object_lookup(dev, file_priv, args->handle);
524         if (obj == NULL)
525                 return -EBADF;
526
527         offset = args->offset;
528
529         down_write(&current->mm->mmap_sem);
530         addr = do_mmap(obj->filp, 0, args->size,
531                        PROT_READ | PROT_WRITE, MAP_SHARED,
532                        args->offset);
533         up_write(&current->mm->mmap_sem);
534         mutex_lock(&dev->struct_mutex);
535         drm_gem_object_unreference(obj);
536         mutex_unlock(&dev->struct_mutex);
537         if (IS_ERR((void *)addr))
538                 return addr;
539
540         args->addr_ptr = (uint64_t) addr;
541
542         return 0;
543 }
544
545 /**
546  * i915_gem_fault - fault a page into the GTT
547  * vma: VMA in question
548  * vmf: fault info
549  *
550  * The fault handler is set up by drm_gem_mmap() when a object is GTT mapped
551  * from userspace.  The fault handler takes care of binding the object to
552  * the GTT (if needed), allocating and programming a fence register (again,
553  * only if needed based on whether the old reg is still valid or the object
554  * is tiled) and inserting a new PTE into the faulting process.
555  *
556  * Note that the faulting process may involve evicting existing objects
557  * from the GTT and/or fence registers to make room.  So performance may
558  * suffer if the GTT working set is large or there are few fence registers
559  * left.
560  */
561 int i915_gem_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
562 {
563         struct drm_gem_object *obj = vma->vm_private_data;
564         struct drm_device *dev = obj->dev;
565         struct drm_i915_private *dev_priv = dev->dev_private;
566         struct drm_i915_gem_object *obj_priv = obj->driver_private;
567         pgoff_t page_offset;
568         unsigned long pfn;
569         int ret = 0;
570         bool write = !!(vmf->flags & FAULT_FLAG_WRITE);
571
572         /* We don't use vmf->pgoff since that has the fake offset */
573         page_offset = ((unsigned long)vmf->virtual_address - vma->vm_start) >>
574                 PAGE_SHIFT;
575
576         /* Now bind it into the GTT if needed */
577         mutex_lock(&dev->struct_mutex);
578         if (!obj_priv->gtt_space) {
579                 ret = i915_gem_object_bind_to_gtt(obj, obj_priv->gtt_alignment);
580                 if (ret) {
581                         mutex_unlock(&dev->struct_mutex);
582                         return VM_FAULT_SIGBUS;
583                 }
584                 list_add(&obj_priv->list, &dev_priv->mm.inactive_list);
585         }
586
587         /* Need a new fence register? */
588         if (obj_priv->fence_reg == I915_FENCE_REG_NONE &&
589             obj_priv->tiling_mode != I915_TILING_NONE) {
590                 ret = i915_gem_object_get_fence_reg(obj, write);
591                 if (ret) {
592                         mutex_unlock(&dev->struct_mutex);
593                         return VM_FAULT_SIGBUS;
594                 }
595         }
596
597         pfn = ((dev->agp->base + obj_priv->gtt_offset) >> PAGE_SHIFT) +
598                 page_offset;
599
600         /* Finally, remap it using the new GTT offset */
601         ret = vm_insert_pfn(vma, (unsigned long)vmf->virtual_address, pfn);
602
603         mutex_unlock(&dev->struct_mutex);
604
605         switch (ret) {
606         case -ENOMEM:
607         case -EAGAIN:
608                 return VM_FAULT_OOM;
609         case -EFAULT:
610         case -EBUSY:
611                 DRM_ERROR("can't insert pfn??  fault or busy...\n");
612                 return VM_FAULT_SIGBUS;
613         default:
614                 return VM_FAULT_NOPAGE;
615         }
616 }
617
618 /**
619  * i915_gem_create_mmap_offset - create a fake mmap offset for an object
620  * @obj: obj in question
621  *
622  * GEM memory mapping works by handing back to userspace a fake mmap offset
623  * it can use in a subsequent mmap(2) call.  The DRM core code then looks
624  * up the object based on the offset and sets up the various memory mapping
625  * structures.
626  *
627  * This routine allocates and attaches a fake offset for @obj.
628  */
629 static int
630 i915_gem_create_mmap_offset(struct drm_gem_object *obj)
631 {
632         struct drm_device *dev = obj->dev;
633         struct drm_gem_mm *mm = dev->mm_private;
634         struct drm_i915_gem_object *obj_priv = obj->driver_private;
635         struct drm_map_list *list;
636         struct drm_map *map;
637         int ret = 0;
638
639         /* Set the object up for mmap'ing */
640         list = &obj->map_list;
641         list->map = drm_calloc(1, sizeof(struct drm_map_list),
642                                DRM_MEM_DRIVER);
643         if (!list->map)
644                 return -ENOMEM;
645
646         map = list->map;
647         map->type = _DRM_GEM;
648         map->size = obj->size;
649         map->handle = obj;
650
651         /* Get a DRM GEM mmap offset allocated... */
652         list->file_offset_node = drm_mm_search_free(&mm->offset_manager,
653                                                     obj->size / PAGE_SIZE, 0, 0);
654         if (!list->file_offset_node) {
655                 DRM_ERROR("failed to allocate offset for bo %d\n", obj->name);
656                 ret = -ENOMEM;
657                 goto out_free_list;
658         }
659
660         list->file_offset_node = drm_mm_get_block(list->file_offset_node,
661                                                   obj->size / PAGE_SIZE, 0);
662         if (!list->file_offset_node) {
663                 ret = -ENOMEM;
664                 goto out_free_list;
665         }
666
667         list->hash.key = list->file_offset_node->start;
668         if (drm_ht_insert_item(&mm->offset_hash, &list->hash)) {
669                 DRM_ERROR("failed to add to map hash\n");
670                 goto out_free_mm;
671         }
672
673         /* By now we should be all set, any drm_mmap request on the offset
674          * below will get to our mmap & fault handler */
675         obj_priv->mmap_offset = ((uint64_t) list->hash.key) << PAGE_SHIFT;
676
677         return 0;
678
679 out_free_mm:
680         drm_mm_put_block(list->file_offset_node);
681 out_free_list:
682         drm_free(list->map, sizeof(struct drm_map_list), DRM_MEM_DRIVER);
683
684         return ret;
685 }
686
687 /**
688  * i915_gem_get_gtt_alignment - return required GTT alignment for an object
689  * @obj: object to check
690  *
691  * Return the required GTT alignment for an object, taking into account
692  * potential fence register mapping if needed.
693  */
694 static uint32_t
695 i915_gem_get_gtt_alignment(struct drm_gem_object *obj)
696 {
697         struct drm_device *dev = obj->dev;
698         struct drm_i915_gem_object *obj_priv = obj->driver_private;
699         int start, i;
700
701         /*
702          * Minimum alignment is 4k (GTT page size), but might be greater
703          * if a fence register is needed for the object.
704          */
705         if (IS_I965G(dev) || obj_priv->tiling_mode == I915_TILING_NONE)
706                 return 4096;
707
708         /*
709          * Previous chips need to be aligned to the size of the smallest
710          * fence register that can contain the object.
711          */
712         if (IS_I9XX(dev))
713                 start = 1024*1024;
714         else
715                 start = 512*1024;
716
717         for (i = start; i < obj->size; i <<= 1)
718                 ;
719
720         return i;
721 }
722
723 /**
724  * i915_gem_mmap_gtt_ioctl - prepare an object for GTT mmap'ing
725  * @dev: DRM device
726  * @data: GTT mapping ioctl data
727  * @file_priv: GEM object info
728  *
729  * Simply returns the fake offset to userspace so it can mmap it.
730  * The mmap call will end up in drm_gem_mmap(), which will set things
731  * up so we can get faults in the handler above.
732  *
733  * The fault handler will take care of binding the object into the GTT
734  * (since it may have been evicted to make room for something), allocating
735  * a fence register, and mapping the appropriate aperture address into
736  * userspace.
737  */
738 int
739 i915_gem_mmap_gtt_ioctl(struct drm_device *dev, void *data,
740                         struct drm_file *file_priv)
741 {
742         struct drm_i915_gem_mmap_gtt *args = data;
743         struct drm_i915_private *dev_priv = dev->dev_private;
744         struct drm_gem_object *obj;
745         struct drm_i915_gem_object *obj_priv;
746         int ret;
747
748         if (!(dev->driver->driver_features & DRIVER_GEM))
749                 return -ENODEV;
750
751         obj = drm_gem_object_lookup(dev, file_priv, args->handle);
752         if (obj == NULL)
753                 return -EBADF;
754
755         mutex_lock(&dev->struct_mutex);
756
757         obj_priv = obj->driver_private;
758
759         if (!obj_priv->mmap_offset) {
760                 ret = i915_gem_create_mmap_offset(obj);
761                 if (ret)
762                         return ret;
763         }
764
765         args->offset = obj_priv->mmap_offset;
766
767         obj_priv->gtt_alignment = i915_gem_get_gtt_alignment(obj);
768
769         /* Make sure the alignment is correct for fence regs etc */
770         if (obj_priv->agp_mem &&
771             (obj_priv->gtt_offset & (obj_priv->gtt_alignment - 1))) {
772                 drm_gem_object_unreference(obj);
773                 mutex_unlock(&dev->struct_mutex);
774                 return -EINVAL;
775         }
776
777         /*
778          * Pull it into the GTT so that we have a page list (makes the
779          * initial fault faster and any subsequent flushing possible).
780          */
781         if (!obj_priv->agp_mem) {
782                 ret = i915_gem_object_bind_to_gtt(obj, obj_priv->gtt_alignment);
783                 if (ret) {
784                         drm_gem_object_unreference(obj);
785                         mutex_unlock(&dev->struct_mutex);
786                         return ret;
787                 }
788                 list_add(&obj_priv->list, &dev_priv->mm.inactive_list);
789         }
790
791         drm_gem_object_unreference(obj);
792         mutex_unlock(&dev->struct_mutex);
793
794         return 0;
795 }
796
797 static void
798 i915_gem_object_free_page_list(struct drm_gem_object *obj)
799 {
800         struct drm_i915_gem_object *obj_priv = obj->driver_private;
801         int page_count = obj->size / PAGE_SIZE;
802         int i;
803
804         if (obj_priv->page_list == NULL)
805                 return;
806
807
808         for (i = 0; i < page_count; i++)
809                 if (obj_priv->page_list[i] != NULL) {
810                         if (obj_priv->dirty)
811                                 set_page_dirty(obj_priv->page_list[i]);
812                         mark_page_accessed(obj_priv->page_list[i]);
813                         page_cache_release(obj_priv->page_list[i]);
814                 }
815         obj_priv->dirty = 0;
816
817         drm_free(obj_priv->page_list,
818                  page_count * sizeof(struct page *),
819                  DRM_MEM_DRIVER);
820         obj_priv->page_list = NULL;
821 }
822
823 static void
824 i915_gem_object_move_to_active(struct drm_gem_object *obj, uint32_t seqno)
825 {
826         struct drm_device *dev = obj->dev;
827         drm_i915_private_t *dev_priv = dev->dev_private;
828         struct drm_i915_gem_object *obj_priv = obj->driver_private;
829
830         /* Add a reference if we're newly entering the active list. */
831         if (!obj_priv->active) {
832                 drm_gem_object_reference(obj);
833                 obj_priv->active = 1;
834         }
835         /* Move from whatever list we were on to the tail of execution. */
836         list_move_tail(&obj_priv->list,
837                        &dev_priv->mm.active_list);
838         obj_priv->last_rendering_seqno = seqno;
839 }
840
841 static void
842 i915_gem_object_move_to_flushing(struct drm_gem_object *obj)
843 {
844         struct drm_device *dev = obj->dev;
845         drm_i915_private_t *dev_priv = dev->dev_private;
846         struct drm_i915_gem_object *obj_priv = obj->driver_private;
847
848         BUG_ON(!obj_priv->active);
849         list_move_tail(&obj_priv->list, &dev_priv->mm.flushing_list);
850         obj_priv->last_rendering_seqno = 0;
851 }
852
853 static void
854 i915_gem_object_move_to_inactive(struct drm_gem_object *obj)
855 {
856         struct drm_device *dev = obj->dev;
857         drm_i915_private_t *dev_priv = dev->dev_private;
858         struct drm_i915_gem_object *obj_priv = obj->driver_private;
859
860         i915_verify_inactive(dev, __FILE__, __LINE__);
861         if (obj_priv->pin_count != 0)
862                 list_del_init(&obj_priv->list);
863         else
864                 list_move_tail(&obj_priv->list, &dev_priv->mm.inactive_list);
865
866         obj_priv->last_rendering_seqno = 0;
867         if (obj_priv->active) {
868                 obj_priv->active = 0;
869                 drm_gem_object_unreference(obj);
870         }
871         i915_verify_inactive(dev, __FILE__, __LINE__);
872 }
873
874 /**
875  * Creates a new sequence number, emitting a write of it to the status page
876  * plus an interrupt, which will trigger i915_user_interrupt_handler.
877  *
878  * Must be called with struct_lock held.
879  *
880  * Returned sequence numbers are nonzero on success.
881  */
882 static uint32_t
883 i915_add_request(struct drm_device *dev, uint32_t flush_domains)
884 {
885         drm_i915_private_t *dev_priv = dev->dev_private;
886         struct drm_i915_gem_request *request;
887         uint32_t seqno;
888         int was_empty;
889         RING_LOCALS;
890
891         request = drm_calloc(1, sizeof(*request), DRM_MEM_DRIVER);
892         if (request == NULL)
893                 return 0;
894
895         /* Grab the seqno we're going to make this request be, and bump the
896          * next (skipping 0 so it can be the reserved no-seqno value).
897          */
898         seqno = dev_priv->mm.next_gem_seqno;
899         dev_priv->mm.next_gem_seqno++;
900         if (dev_priv->mm.next_gem_seqno == 0)
901                 dev_priv->mm.next_gem_seqno++;
902
903         BEGIN_LP_RING(4);
904         OUT_RING(MI_STORE_DWORD_INDEX);
905         OUT_RING(I915_GEM_HWS_INDEX << MI_STORE_DWORD_INDEX_SHIFT);
906         OUT_RING(seqno);
907
908         OUT_RING(MI_USER_INTERRUPT);
909         ADVANCE_LP_RING();
910
911         DRM_DEBUG("%d\n", seqno);
912
913         request->seqno = seqno;
914         request->emitted_jiffies = jiffies;
915         was_empty = list_empty(&dev_priv->mm.request_list);
916         list_add_tail(&request->list, &dev_priv->mm.request_list);
917
918         /* Associate any objects on the flushing list matching the write
919          * domain we're flushing with our flush.
920          */
921         if (flush_domains != 0) {
922                 struct drm_i915_gem_object *obj_priv, *next;
923
924                 list_for_each_entry_safe(obj_priv, next,
925                                          &dev_priv->mm.flushing_list, list) {
926                         struct drm_gem_object *obj = obj_priv->obj;
927
928                         if ((obj->write_domain & flush_domains) ==
929                             obj->write_domain) {
930                                 obj->write_domain = 0;
931                                 i915_gem_object_move_to_active(obj, seqno);
932                         }
933                 }
934
935         }
936
937         if (was_empty && !dev_priv->mm.suspended)
938                 schedule_delayed_work(&dev_priv->mm.retire_work, HZ);
939         return seqno;
940 }
941
942 /**
943  * Command execution barrier
944  *
945  * Ensures that all commands in the ring are finished
946  * before signalling the CPU
947  */
948 static uint32_t
949 i915_retire_commands(struct drm_device *dev)
950 {
951         drm_i915_private_t *dev_priv = dev->dev_private;
952         uint32_t cmd = MI_FLUSH | MI_NO_WRITE_FLUSH;
953         uint32_t flush_domains = 0;
954         RING_LOCALS;
955
956         /* The sampler always gets flushed on i965 (sigh) */
957         if (IS_I965G(dev))
958                 flush_domains |= I915_GEM_DOMAIN_SAMPLER;
959         BEGIN_LP_RING(2);
960         OUT_RING(cmd);
961         OUT_RING(0); /* noop */
962         ADVANCE_LP_RING();
963         return flush_domains;
964 }
965
966 /**
967  * Moves buffers associated only with the given active seqno from the active
968  * to inactive list, potentially freeing them.
969  */
970 static void
971 i915_gem_retire_request(struct drm_device *dev,
972                         struct drm_i915_gem_request *request)
973 {
974         drm_i915_private_t *dev_priv = dev->dev_private;
975
976         /* Move any buffers on the active list that are no longer referenced
977          * by the ringbuffer to the flushing/inactive lists as appropriate.
978          */
979         while (!list_empty(&dev_priv->mm.active_list)) {
980                 struct drm_gem_object *obj;
981                 struct drm_i915_gem_object *obj_priv;
982
983                 obj_priv = list_first_entry(&dev_priv->mm.active_list,
984                                             struct drm_i915_gem_object,
985                                             list);
986                 obj = obj_priv->obj;
987
988                 /* If the seqno being retired doesn't match the oldest in the
989                  * list, then the oldest in the list must still be newer than
990                  * this seqno.
991                  */
992                 if (obj_priv->last_rendering_seqno != request->seqno)
993                         return;
994
995 #if WATCH_LRU
996                 DRM_INFO("%s: retire %d moves to inactive list %p\n",
997                          __func__, request->seqno, obj);
998 #endif
999
1000                 if (obj->write_domain != 0)
1001                         i915_gem_object_move_to_flushing(obj);
1002                 else
1003                         i915_gem_object_move_to_inactive(obj);
1004         }
1005 }
1006
1007 /**
1008  * Returns true if seq1 is later than seq2.
1009  */
1010 static int
1011 i915_seqno_passed(uint32_t seq1, uint32_t seq2)
1012 {
1013         return (int32_t)(seq1 - seq2) >= 0;
1014 }
1015
1016 uint32_t
1017 i915_get_gem_seqno(struct drm_device *dev)
1018 {
1019         drm_i915_private_t *dev_priv = dev->dev_private;
1020
1021         return READ_HWSP(dev_priv, I915_GEM_HWS_INDEX);
1022 }
1023
1024 /**
1025  * This function clears the request list as sequence numbers are passed.
1026  */
1027 void
1028 i915_gem_retire_requests(struct drm_device *dev)
1029 {
1030         drm_i915_private_t *dev_priv = dev->dev_private;
1031         uint32_t seqno;
1032
1033         seqno = i915_get_gem_seqno(dev);
1034
1035         while (!list_empty(&dev_priv->mm.request_list)) {
1036                 struct drm_i915_gem_request *request;
1037                 uint32_t retiring_seqno;
1038
1039                 request = list_first_entry(&dev_priv->mm.request_list,
1040                                            struct drm_i915_gem_request,
1041                                            list);
1042                 retiring_seqno = request->seqno;
1043
1044                 if (i915_seqno_passed(seqno, retiring_seqno) ||
1045                     dev_priv->mm.wedged) {
1046                         i915_gem_retire_request(dev, request);
1047
1048                         list_del(&request->list);
1049                         drm_free(request, sizeof(*request), DRM_MEM_DRIVER);
1050                 } else
1051                         break;
1052         }
1053 }
1054
1055 void
1056 i915_gem_retire_work_handler(struct work_struct *work)
1057 {
1058         drm_i915_private_t *dev_priv;
1059         struct drm_device *dev;
1060
1061         dev_priv = container_of(work, drm_i915_private_t,
1062                                 mm.retire_work.work);
1063         dev = dev_priv->dev;
1064
1065         mutex_lock(&dev->struct_mutex);
1066         i915_gem_retire_requests(dev);
1067         if (!dev_priv->mm.suspended &&
1068             !list_empty(&dev_priv->mm.request_list))
1069                 schedule_delayed_work(&dev_priv->mm.retire_work, HZ);
1070         mutex_unlock(&dev->struct_mutex);
1071 }
1072
1073 /**
1074  * Waits for a sequence number to be signaled, and cleans up the
1075  * request and object lists appropriately for that event.
1076  */
1077 static int
1078 i915_wait_request(struct drm_device *dev, uint32_t seqno)
1079 {
1080         drm_i915_private_t *dev_priv = dev->dev_private;
1081         int ret = 0;
1082
1083         BUG_ON(seqno == 0);
1084
1085         if (!i915_seqno_passed(i915_get_gem_seqno(dev), seqno)) {
1086                 dev_priv->mm.waiting_gem_seqno = seqno;
1087                 i915_user_irq_get(dev);
1088                 ret = wait_event_interruptible(dev_priv->irq_queue,
1089                                                i915_seqno_passed(i915_get_gem_seqno(dev),
1090                                                                  seqno) ||
1091                                                dev_priv->mm.wedged);
1092                 i915_user_irq_put(dev);
1093                 dev_priv->mm.waiting_gem_seqno = 0;
1094         }
1095         if (dev_priv->mm.wedged)
1096                 ret = -EIO;
1097
1098         if (ret && ret != -ERESTARTSYS)
1099                 DRM_ERROR("%s returns %d (awaiting %d at %d)\n",
1100                           __func__, ret, seqno, i915_get_gem_seqno(dev));
1101
1102         /* Directly dispatch request retiring.  While we have the work queue
1103          * to handle this, the waiter on a request often wants an associated
1104          * buffer to have made it to the inactive list, and we would need
1105          * a separate wait queue to handle that.
1106          */
1107         if (ret == 0)
1108                 i915_gem_retire_requests(dev);
1109
1110         return ret;
1111 }
1112
1113 static void
1114 i915_gem_flush(struct drm_device *dev,
1115                uint32_t invalidate_domains,
1116                uint32_t flush_domains)
1117 {
1118         drm_i915_private_t *dev_priv = dev->dev_private;
1119         uint32_t cmd;
1120         RING_LOCALS;
1121
1122 #if WATCH_EXEC
1123         DRM_INFO("%s: invalidate %08x flush %08x\n", __func__,
1124                   invalidate_domains, flush_domains);
1125 #endif
1126
1127         if (flush_domains & I915_GEM_DOMAIN_CPU)
1128                 drm_agp_chipset_flush(dev);
1129
1130         if ((invalidate_domains | flush_domains) & ~(I915_GEM_DOMAIN_CPU |
1131                                                      I915_GEM_DOMAIN_GTT)) {
1132                 /*
1133                  * read/write caches:
1134                  *
1135                  * I915_GEM_DOMAIN_RENDER is always invalidated, but is
1136                  * only flushed if MI_NO_WRITE_FLUSH is unset.  On 965, it is
1137                  * also flushed at 2d versus 3d pipeline switches.
1138                  *
1139                  * read-only caches:
1140                  *
1141                  * I915_GEM_DOMAIN_SAMPLER is flushed on pre-965 if
1142                  * MI_READ_FLUSH is set, and is always flushed on 965.
1143                  *
1144                  * I915_GEM_DOMAIN_COMMAND may not exist?
1145                  *
1146                  * I915_GEM_DOMAIN_INSTRUCTION, which exists on 965, is
1147                  * invalidated when MI_EXE_FLUSH is set.
1148                  *
1149                  * I915_GEM_DOMAIN_VERTEX, which exists on 965, is
1150                  * invalidated with every MI_FLUSH.
1151                  *
1152                  * TLBs:
1153                  *
1154                  * On 965, TLBs associated with I915_GEM_DOMAIN_COMMAND
1155                  * and I915_GEM_DOMAIN_CPU in are invalidated at PTE write and
1156                  * I915_GEM_DOMAIN_RENDER and I915_GEM_DOMAIN_SAMPLER
1157                  * are flushed at any MI_FLUSH.
1158                  */
1159
1160                 cmd = MI_FLUSH | MI_NO_WRITE_FLUSH;
1161                 if ((invalidate_domains|flush_domains) &
1162                     I915_GEM_DOMAIN_RENDER)
1163                         cmd &= ~MI_NO_WRITE_FLUSH;
1164                 if (!IS_I965G(dev)) {
1165                         /*
1166                          * On the 965, the sampler cache always gets flushed
1167                          * and this bit is reserved.
1168                          */
1169                         if (invalidate_domains & I915_GEM_DOMAIN_SAMPLER)
1170                                 cmd |= MI_READ_FLUSH;
1171                 }
1172                 if (invalidate_domains & I915_GEM_DOMAIN_INSTRUCTION)
1173                         cmd |= MI_EXE_FLUSH;
1174
1175 #if WATCH_EXEC
1176                 DRM_INFO("%s: queue flush %08x to ring\n", __func__, cmd);
1177 #endif
1178                 BEGIN_LP_RING(2);
1179                 OUT_RING(cmd);
1180                 OUT_RING(0); /* noop */
1181                 ADVANCE_LP_RING();
1182         }
1183 }
1184
1185 /**
1186  * Ensures that all rendering to the object has completed and the object is
1187  * safe to unbind from the GTT or access from the CPU.
1188  */
1189 static int
1190 i915_gem_object_wait_rendering(struct drm_gem_object *obj)
1191 {
1192         struct drm_device *dev = obj->dev;
1193         struct drm_i915_gem_object *obj_priv = obj->driver_private;
1194         int ret;
1195
1196         /* This function only exists to support waiting for existing rendering,
1197          * not for emitting required flushes.
1198          */
1199         BUG_ON((obj->write_domain & I915_GEM_GPU_DOMAINS) != 0);
1200
1201         /* If there is rendering queued on the buffer being evicted, wait for
1202          * it.
1203          */
1204         if (obj_priv->active) {
1205 #if WATCH_BUF
1206                 DRM_INFO("%s: object %p wait for seqno %08x\n",
1207                           __func__, obj, obj_priv->last_rendering_seqno);
1208 #endif
1209                 ret = i915_wait_request(dev, obj_priv->last_rendering_seqno);
1210                 if (ret != 0)
1211                         return ret;
1212         }
1213
1214         return 0;
1215 }
1216
1217 /**
1218  * Unbinds an object from the GTT aperture.
1219  */
1220 int
1221 i915_gem_object_unbind(struct drm_gem_object *obj)
1222 {
1223         struct drm_device *dev = obj->dev;
1224         struct drm_i915_gem_object *obj_priv = obj->driver_private;
1225         loff_t offset;
1226         int ret = 0;
1227
1228 #if WATCH_BUF
1229         DRM_INFO("%s:%d %p\n", __func__, __LINE__, obj);
1230         DRM_INFO("gtt_space %p\n", obj_priv->gtt_space);
1231 #endif
1232         if (obj_priv->gtt_space == NULL)
1233                 return 0;
1234
1235         if (obj_priv->pin_count != 0) {
1236                 DRM_ERROR("Attempting to unbind pinned buffer\n");
1237                 return -EINVAL;
1238         }
1239
1240         /* Move the object to the CPU domain to ensure that
1241          * any possible CPU writes while it's not in the GTT
1242          * are flushed when we go to remap it. This will
1243          * also ensure that all pending GPU writes are finished
1244          * before we unbind.
1245          */
1246         ret = i915_gem_object_set_to_cpu_domain(obj, 1);
1247         if (ret) {
1248                 if (ret != -ERESTARTSYS)
1249                         DRM_ERROR("set_domain failed: %d\n", ret);
1250                 return ret;
1251         }
1252
1253         if (obj_priv->agp_mem != NULL) {
1254                 drm_unbind_agp(obj_priv->agp_mem);
1255                 drm_free_agp(obj_priv->agp_mem, obj->size / PAGE_SIZE);
1256                 obj_priv->agp_mem = NULL;
1257         }
1258
1259         BUG_ON(obj_priv->active);
1260
1261         /* blow away mappings if mapped through GTT */
1262         offset = ((loff_t) obj->map_list.hash.key) << PAGE_SHIFT;
1263         if (dev->dev_mapping)
1264                 unmap_mapping_range(dev->dev_mapping, offset, obj->size, 1);
1265
1266         if (obj_priv->fence_reg != I915_FENCE_REG_NONE)
1267                 i915_gem_clear_fence_reg(obj);
1268
1269         i915_gem_object_free_page_list(obj);
1270
1271         if (obj_priv->gtt_space) {
1272                 atomic_dec(&dev->gtt_count);
1273                 atomic_sub(obj->size, &dev->gtt_memory);
1274
1275                 drm_mm_put_block(obj_priv->gtt_space);
1276                 obj_priv->gtt_space = NULL;
1277         }
1278
1279         /* Remove ourselves from the LRU list if present. */
1280         if (!list_empty(&obj_priv->list))
1281                 list_del_init(&obj_priv->list);
1282
1283         return 0;
1284 }
1285
1286 static int
1287 i915_gem_evict_something(struct drm_device *dev)
1288 {
1289         drm_i915_private_t *dev_priv = dev->dev_private;
1290         struct drm_gem_object *obj;
1291         struct drm_i915_gem_object *obj_priv;
1292         int ret = 0;
1293
1294         for (;;) {
1295                 /* If there's an inactive buffer available now, grab it
1296                  * and be done.
1297                  */
1298                 if (!list_empty(&dev_priv->mm.inactive_list)) {
1299                         obj_priv = list_first_entry(&dev_priv->mm.inactive_list,
1300                                                     struct drm_i915_gem_object,
1301                                                     list);
1302                         obj = obj_priv->obj;
1303                         BUG_ON(obj_priv->pin_count != 0);
1304 #if WATCH_LRU
1305                         DRM_INFO("%s: evicting %p\n", __func__, obj);
1306 #endif
1307                         BUG_ON(obj_priv->active);
1308
1309                         /* Wait on the rendering and unbind the buffer. */
1310                         ret = i915_gem_object_unbind(obj);
1311                         break;
1312                 }
1313
1314                 /* If we didn't get anything, but the ring is still processing
1315                  * things, wait for one of those things to finish and hopefully
1316                  * leave us a buffer to evict.
1317                  */
1318                 if (!list_empty(&dev_priv->mm.request_list)) {
1319                         struct drm_i915_gem_request *request;
1320
1321                         request = list_first_entry(&dev_priv->mm.request_list,
1322                                                    struct drm_i915_gem_request,
1323                                                    list);
1324
1325                         ret = i915_wait_request(dev, request->seqno);
1326                         if (ret)
1327                                 break;
1328
1329                         /* if waiting caused an object to become inactive,
1330                          * then loop around and wait for it. Otherwise, we
1331                          * assume that waiting freed and unbound something,
1332                          * so there should now be some space in the GTT
1333                          */
1334                         if (!list_empty(&dev_priv->mm.inactive_list))
1335                                 continue;
1336                         break;
1337                 }
1338
1339                 /* If we didn't have anything on the request list but there
1340                  * are buffers awaiting a flush, emit one and try again.
1341                  * When we wait on it, those buffers waiting for that flush
1342                  * will get moved to inactive.
1343                  */
1344                 if (!list_empty(&dev_priv->mm.flushing_list)) {
1345                         obj_priv = list_first_entry(&dev_priv->mm.flushing_list,
1346                                                     struct drm_i915_gem_object,
1347                                                     list);
1348                         obj = obj_priv->obj;
1349
1350                         i915_gem_flush(dev,
1351                                        obj->write_domain,
1352                                        obj->write_domain);
1353                         i915_add_request(dev, obj->write_domain);
1354
1355                         obj = NULL;
1356                         continue;
1357                 }
1358
1359                 DRM_ERROR("inactive empty %d request empty %d "
1360                           "flushing empty %d\n",
1361                           list_empty(&dev_priv->mm.inactive_list),
1362                           list_empty(&dev_priv->mm.request_list),
1363                           list_empty(&dev_priv->mm.flushing_list));
1364                 /* If we didn't do any of the above, there's nothing to be done
1365                  * and we just can't fit it in.
1366                  */
1367                 return -ENOMEM;
1368         }
1369         return ret;
1370 }
1371
1372 static int
1373 i915_gem_evict_everything(struct drm_device *dev)
1374 {
1375         int ret;
1376
1377         for (;;) {
1378                 ret = i915_gem_evict_something(dev);
1379                 if (ret != 0)
1380                         break;
1381         }
1382         if (ret == -ENOMEM)
1383                 return 0;
1384         return ret;
1385 }
1386
1387 static int
1388 i915_gem_object_get_page_list(struct drm_gem_object *obj)
1389 {
1390         struct drm_i915_gem_object *obj_priv = obj->driver_private;
1391         int page_count, i;
1392         struct address_space *mapping;
1393         struct inode *inode;
1394         struct page *page;
1395         int ret;
1396
1397         if (obj_priv->page_list)
1398                 return 0;
1399
1400         /* Get the list of pages out of our struct file.  They'll be pinned
1401          * at this point until we release them.
1402          */
1403         page_count = obj->size / PAGE_SIZE;
1404         BUG_ON(obj_priv->page_list != NULL);
1405         obj_priv->page_list = drm_calloc(page_count, sizeof(struct page *),
1406                                          DRM_MEM_DRIVER);
1407         if (obj_priv->page_list == NULL) {
1408                 DRM_ERROR("Faled to allocate page list\n");
1409                 return -ENOMEM;
1410         }
1411
1412         inode = obj->filp->f_path.dentry->d_inode;
1413         mapping = inode->i_mapping;
1414         for (i = 0; i < page_count; i++) {
1415                 page = read_mapping_page(mapping, i, NULL);
1416                 if (IS_ERR(page)) {
1417                         ret = PTR_ERR(page);
1418                         DRM_ERROR("read_mapping_page failed: %d\n", ret);
1419                         i915_gem_object_free_page_list(obj);
1420                         return ret;
1421                 }
1422                 obj_priv->page_list[i] = page;
1423         }
1424         return 0;
1425 }
1426
1427 static void i965_write_fence_reg(struct drm_i915_fence_reg *reg)
1428 {
1429         struct drm_gem_object *obj = reg->obj;
1430         struct drm_device *dev = obj->dev;
1431         drm_i915_private_t *dev_priv = dev->dev_private;
1432         struct drm_i915_gem_object *obj_priv = obj->driver_private;
1433         int regnum = obj_priv->fence_reg;
1434         uint64_t val;
1435
1436         val = (uint64_t)((obj_priv->gtt_offset + obj->size - 4096) &
1437                     0xfffff000) << 32;
1438         val |= obj_priv->gtt_offset & 0xfffff000;
1439         val |= ((obj_priv->stride / 128) - 1) << I965_FENCE_PITCH_SHIFT;
1440         if (obj_priv->tiling_mode == I915_TILING_Y)
1441                 val |= 1 << I965_FENCE_TILING_Y_SHIFT;
1442         val |= I965_FENCE_REG_VALID;
1443
1444         I915_WRITE64(FENCE_REG_965_0 + (regnum * 8), val);
1445 }
1446
1447 static void i915_write_fence_reg(struct drm_i915_fence_reg *reg)
1448 {
1449         struct drm_gem_object *obj = reg->obj;
1450         struct drm_device *dev = obj->dev;
1451         drm_i915_private_t *dev_priv = dev->dev_private;
1452         struct drm_i915_gem_object *obj_priv = obj->driver_private;
1453         int regnum = obj_priv->fence_reg;
1454         int tile_width;
1455         uint32_t val;
1456         uint32_t pitch_val;
1457
1458         if ((obj_priv->gtt_offset & ~I915_FENCE_START_MASK) ||
1459             (obj_priv->gtt_offset & (obj->size - 1))) {
1460                 WARN(1, "%s: object 0x%08x not 1M or size (0x%zx) aligned\n",
1461                      __func__, obj_priv->gtt_offset, obj->size);
1462                 return;
1463         }
1464
1465         if (obj_priv->tiling_mode == I915_TILING_Y &&
1466             HAS_128_BYTE_Y_TILING(dev))
1467                 tile_width = 128;
1468         else
1469                 tile_width = 512;
1470
1471         /* Note: pitch better be a power of two tile widths */
1472         pitch_val = obj_priv->stride / tile_width;
1473         pitch_val = ffs(pitch_val) - 1;
1474
1475         val = obj_priv->gtt_offset;
1476         if (obj_priv->tiling_mode == I915_TILING_Y)
1477                 val |= 1 << I830_FENCE_TILING_Y_SHIFT;
1478         val |= I915_FENCE_SIZE_BITS(obj->size);
1479         val |= pitch_val << I830_FENCE_PITCH_SHIFT;
1480         val |= I830_FENCE_REG_VALID;
1481
1482         I915_WRITE(FENCE_REG_830_0 + (regnum * 4), val);
1483 }
1484
1485 static void i830_write_fence_reg(struct drm_i915_fence_reg *reg)
1486 {
1487         struct drm_gem_object *obj = reg->obj;
1488         struct drm_device *dev = obj->dev;
1489         drm_i915_private_t *dev_priv = dev->dev_private;
1490         struct drm_i915_gem_object *obj_priv = obj->driver_private;
1491         int regnum = obj_priv->fence_reg;
1492         uint32_t val;
1493         uint32_t pitch_val;
1494
1495         if ((obj_priv->gtt_offset & ~I915_FENCE_START_MASK) ||
1496             (obj_priv->gtt_offset & (obj->size - 1))) {
1497                 WARN(1, "%s: object 0x%08x not 1M or size aligned\n",
1498                      __func__, obj_priv->gtt_offset);
1499                 return;
1500         }
1501
1502         pitch_val = (obj_priv->stride / 128) - 1;
1503
1504         val = obj_priv->gtt_offset;
1505         if (obj_priv->tiling_mode == I915_TILING_Y)
1506                 val |= 1 << I830_FENCE_TILING_Y_SHIFT;
1507         val |= I830_FENCE_SIZE_BITS(obj->size);
1508         val |= pitch_val << I830_FENCE_PITCH_SHIFT;
1509         val |= I830_FENCE_REG_VALID;
1510
1511         I915_WRITE(FENCE_REG_830_0 + (regnum * 4), val);
1512
1513 }
1514
1515 /**
1516  * i915_gem_object_get_fence_reg - set up a fence reg for an object
1517  * @obj: object to map through a fence reg
1518  * @write: object is about to be written
1519  *
1520  * When mapping objects through the GTT, userspace wants to be able to write
1521  * to them without having to worry about swizzling if the object is tiled.
1522  *
1523  * This function walks the fence regs looking for a free one for @obj,
1524  * stealing one if it can't find any.
1525  *
1526  * It then sets up the reg based on the object's properties: address, pitch
1527  * and tiling format.
1528  */
1529 static int
1530 i915_gem_object_get_fence_reg(struct drm_gem_object *obj, bool write)
1531 {
1532         struct drm_device *dev = obj->dev;
1533         struct drm_i915_private *dev_priv = dev->dev_private;
1534         struct drm_i915_gem_object *obj_priv = obj->driver_private;
1535         struct drm_i915_fence_reg *reg = NULL;
1536         int i, ret;
1537
1538         switch (obj_priv->tiling_mode) {
1539         case I915_TILING_NONE:
1540                 WARN(1, "allocating a fence for non-tiled object?\n");
1541                 break;
1542         case I915_TILING_X:
1543                 if (!obj_priv->stride)
1544                         return -EINVAL;
1545                 WARN((obj_priv->stride & (512 - 1)),
1546                      "object 0x%08x is X tiled but has non-512B pitch\n",
1547                      obj_priv->gtt_offset);
1548                 break;
1549         case I915_TILING_Y:
1550                 if (!obj_priv->stride)
1551                         return -EINVAL;
1552                 WARN((obj_priv->stride & (128 - 1)),
1553                      "object 0x%08x is Y tiled but has non-128B pitch\n",
1554                      obj_priv->gtt_offset);
1555                 break;
1556         }
1557
1558         /* First try to find a free reg */
1559         for (i = dev_priv->fence_reg_start; i < dev_priv->num_fence_regs; i++) {
1560                 reg = &dev_priv->fence_regs[i];
1561                 if (!reg->obj)
1562                         break;
1563         }
1564
1565         /* None available, try to steal one or wait for a user to finish */
1566         if (i == dev_priv->num_fence_regs) {
1567                 struct drm_i915_gem_object *old_obj_priv = NULL;
1568                 loff_t offset;
1569
1570 try_again:
1571                 /* Could try to use LRU here instead... */
1572                 for (i = dev_priv->fence_reg_start;
1573                      i < dev_priv->num_fence_regs; i++) {
1574                         reg = &dev_priv->fence_regs[i];
1575                         old_obj_priv = reg->obj->driver_private;
1576                         if (!old_obj_priv->pin_count)
1577                                 break;
1578                 }
1579
1580                 /*
1581                  * Now things get ugly... we have to wait for one of the
1582                  * objects to finish before trying again.
1583                  */
1584                 if (i == dev_priv->num_fence_regs) {
1585                         ret = i915_gem_object_set_to_gtt_domain(reg->obj, 0);
1586                         if (ret) {
1587                                 WARN(ret != -ERESTARTSYS,
1588                                      "switch to GTT domain failed: %d\n", ret);
1589                                 return ret;
1590                         }
1591                         goto try_again;
1592                 }
1593
1594                 /*
1595                  * Zap this virtual mapping so we can set up a fence again
1596                  * for this object next time we need it.
1597                  */
1598                 offset = ((loff_t) reg->obj->map_list.hash.key) << PAGE_SHIFT;
1599                 if (dev->dev_mapping)
1600                         unmap_mapping_range(dev->dev_mapping, offset,
1601                                             reg->obj->size, 1);
1602                 old_obj_priv->fence_reg = I915_FENCE_REG_NONE;
1603         }
1604
1605         obj_priv->fence_reg = i;
1606         reg->obj = obj;
1607
1608         if (IS_I965G(dev))
1609                 i965_write_fence_reg(reg);
1610         else if (IS_I9XX(dev))
1611                 i915_write_fence_reg(reg);
1612         else
1613                 i830_write_fence_reg(reg);
1614
1615         return 0;
1616 }
1617
1618 /**
1619  * i915_gem_clear_fence_reg - clear out fence register info
1620  * @obj: object to clear
1621  *
1622  * Zeroes out the fence register itself and clears out the associated
1623  * data structures in dev_priv and obj_priv.
1624  */
1625 static void
1626 i915_gem_clear_fence_reg(struct drm_gem_object *obj)
1627 {
1628         struct drm_device *dev = obj->dev;
1629         drm_i915_private_t *dev_priv = dev->dev_private;
1630         struct drm_i915_gem_object *obj_priv = obj->driver_private;
1631
1632         if (IS_I965G(dev))
1633                 I915_WRITE64(FENCE_REG_965_0 + (obj_priv->fence_reg * 8), 0);
1634         else
1635                 I915_WRITE(FENCE_REG_830_0 + (obj_priv->fence_reg * 4), 0);
1636
1637         dev_priv->fence_regs[obj_priv->fence_reg].obj = NULL;
1638         obj_priv->fence_reg = I915_FENCE_REG_NONE;
1639 }
1640
1641 /**
1642  * Finds free space in the GTT aperture and binds the object there.
1643  */
1644 static int
1645 i915_gem_object_bind_to_gtt(struct drm_gem_object *obj, unsigned alignment)
1646 {
1647         struct drm_device *dev = obj->dev;
1648         drm_i915_private_t *dev_priv = dev->dev_private;
1649         struct drm_i915_gem_object *obj_priv = obj->driver_private;
1650         struct drm_mm_node *free_space;
1651         int page_count, ret;
1652
1653         if (dev_priv->mm.suspended)
1654                 return -EBUSY;
1655         if (alignment == 0)
1656                 alignment = i915_gem_get_gtt_alignment(obj);
1657         if (alignment & (PAGE_SIZE - 1)) {
1658                 DRM_ERROR("Invalid object alignment requested %u\n", alignment);
1659                 return -EINVAL;
1660         }
1661
1662  search_free:
1663         free_space = drm_mm_search_free(&dev_priv->mm.gtt_space,
1664                                         obj->size, alignment, 0);
1665         if (free_space != NULL) {
1666                 obj_priv->gtt_space = drm_mm_get_block(free_space, obj->size,
1667                                                        alignment);
1668                 if (obj_priv->gtt_space != NULL) {
1669                         obj_priv->gtt_space->private = obj;
1670                         obj_priv->gtt_offset = obj_priv->gtt_space->start;
1671                 }
1672         }
1673         if (obj_priv->gtt_space == NULL) {
1674                 /* If the gtt is empty and we're still having trouble
1675                  * fitting our object in, we're out of memory.
1676                  */
1677 #if WATCH_LRU
1678                 DRM_INFO("%s: GTT full, evicting something\n", __func__);
1679 #endif
1680                 if (list_empty(&dev_priv->mm.inactive_list) &&
1681                     list_empty(&dev_priv->mm.flushing_list) &&
1682                     list_empty(&dev_priv->mm.active_list)) {
1683                         DRM_ERROR("GTT full, but LRU list empty\n");
1684                         return -ENOMEM;
1685                 }
1686
1687                 ret = i915_gem_evict_something(dev);
1688                 if (ret != 0) {
1689                         if (ret != -ERESTARTSYS)
1690                                 DRM_ERROR("Failed to evict a buffer %d\n", ret);
1691                         return ret;
1692                 }
1693                 goto search_free;
1694         }
1695
1696 #if WATCH_BUF
1697         DRM_INFO("Binding object of size %d at 0x%08x\n",
1698                  obj->size, obj_priv->gtt_offset);
1699 #endif
1700         ret = i915_gem_object_get_page_list(obj);
1701         if (ret) {
1702                 drm_mm_put_block(obj_priv->gtt_space);
1703                 obj_priv->gtt_space = NULL;
1704                 return ret;
1705         }
1706
1707         page_count = obj->size / PAGE_SIZE;
1708         /* Create an AGP memory structure pointing at our pages, and bind it
1709          * into the GTT.
1710          */
1711         obj_priv->agp_mem = drm_agp_bind_pages(dev,
1712                                                obj_priv->page_list,
1713                                                page_count,
1714                                                obj_priv->gtt_offset,
1715                                                obj_priv->agp_type);
1716         if (obj_priv->agp_mem == NULL) {
1717                 i915_gem_object_free_page_list(obj);
1718                 drm_mm_put_block(obj_priv->gtt_space);
1719                 obj_priv->gtt_space = NULL;
1720                 return -ENOMEM;
1721         }
1722         atomic_inc(&dev->gtt_count);
1723         atomic_add(obj->size, &dev->gtt_memory);
1724
1725         /* Assert that the object is not currently in any GPU domain. As it
1726          * wasn't in the GTT, there shouldn't be any way it could have been in
1727          * a GPU cache
1728          */
1729         BUG_ON(obj->read_domains & ~(I915_GEM_DOMAIN_CPU|I915_GEM_DOMAIN_GTT));
1730         BUG_ON(obj->write_domain & ~(I915_GEM_DOMAIN_CPU|I915_GEM_DOMAIN_GTT));
1731
1732         return 0;
1733 }
1734
1735 void
1736 i915_gem_clflush_object(struct drm_gem_object *obj)
1737 {
1738         struct drm_i915_gem_object      *obj_priv = obj->driver_private;
1739
1740         /* If we don't have a page list set up, then we're not pinned
1741          * to GPU, and we can ignore the cache flush because it'll happen
1742          * again at bind time.
1743          */
1744         if (obj_priv->page_list == NULL)
1745                 return;
1746
1747         drm_clflush_pages(obj_priv->page_list, obj->size / PAGE_SIZE);
1748 }
1749
1750 /** Flushes any GPU write domain for the object if it's dirty. */
1751 static void
1752 i915_gem_object_flush_gpu_write_domain(struct drm_gem_object *obj)
1753 {
1754         struct drm_device *dev = obj->dev;
1755         uint32_t seqno;
1756
1757         if ((obj->write_domain & I915_GEM_GPU_DOMAINS) == 0)
1758                 return;
1759
1760         /* Queue the GPU write cache flushing we need. */
1761         i915_gem_flush(dev, 0, obj->write_domain);
1762         seqno = i915_add_request(dev, obj->write_domain);
1763         obj->write_domain = 0;
1764         i915_gem_object_move_to_active(obj, seqno);
1765 }
1766
1767 /** Flushes the GTT write domain for the object if it's dirty. */
1768 static void
1769 i915_gem_object_flush_gtt_write_domain(struct drm_gem_object *obj)
1770 {
1771         if (obj->write_domain != I915_GEM_DOMAIN_GTT)
1772                 return;
1773
1774         /* No actual flushing is required for the GTT write domain.   Writes
1775          * to it immediately go to main memory as far as we know, so there's
1776          * no chipset flush.  It also doesn't land in render cache.
1777          */
1778         obj->write_domain = 0;
1779 }
1780
1781 /** Flushes the CPU write domain for the object if it's dirty. */
1782 static void
1783 i915_gem_object_flush_cpu_write_domain(struct drm_gem_object *obj)
1784 {
1785         struct drm_device *dev = obj->dev;
1786
1787         if (obj->write_domain != I915_GEM_DOMAIN_CPU)
1788                 return;
1789
1790         i915_gem_clflush_object(obj);
1791         drm_agp_chipset_flush(dev);
1792         obj->write_domain = 0;
1793 }
1794
1795 /**
1796  * Moves a single object to the GTT read, and possibly write domain.
1797  *
1798  * This function returns when the move is complete, including waiting on
1799  * flushes to occur.
1800  */
1801 int
1802 i915_gem_object_set_to_gtt_domain(struct drm_gem_object *obj, int write)
1803 {
1804         struct drm_i915_gem_object *obj_priv = obj->driver_private;
1805         int ret;
1806
1807         /* Not valid to be called on unbound objects. */
1808         if (obj_priv->gtt_space == NULL)
1809                 return -EINVAL;
1810
1811         i915_gem_object_flush_gpu_write_domain(obj);
1812         /* Wait on any GPU rendering and flushing to occur. */
1813         ret = i915_gem_object_wait_rendering(obj);
1814         if (ret != 0)
1815                 return ret;
1816
1817         /* If we're writing through the GTT domain, then CPU and GPU caches
1818          * will need to be invalidated at next use.
1819          */
1820         if (write)
1821                 obj->read_domains &= I915_GEM_DOMAIN_GTT;
1822
1823         i915_gem_object_flush_cpu_write_domain(obj);
1824
1825         /* It should now be out of any other write domains, and we can update
1826          * the domain values for our changes.
1827          */
1828         BUG_ON((obj->write_domain & ~I915_GEM_DOMAIN_GTT) != 0);
1829         obj->read_domains |= I915_GEM_DOMAIN_GTT;
1830         if (write) {
1831                 obj->write_domain = I915_GEM_DOMAIN_GTT;
1832                 obj_priv->dirty = 1;
1833         }
1834
1835         return 0;
1836 }
1837
1838 /**
1839  * Moves a single object to the CPU read, and possibly write domain.
1840  *
1841  * This function returns when the move is complete, including waiting on
1842  * flushes to occur.
1843  */
1844 static int
1845 i915_gem_object_set_to_cpu_domain(struct drm_gem_object *obj, int write)
1846 {
1847         struct drm_device *dev = obj->dev;
1848         int ret;
1849
1850         i915_gem_object_flush_gpu_write_domain(obj);
1851         /* Wait on any GPU rendering and flushing to occur. */
1852         ret = i915_gem_object_wait_rendering(obj);
1853         if (ret != 0)
1854                 return ret;
1855
1856         i915_gem_object_flush_gtt_write_domain(obj);
1857
1858         /* If we have a partially-valid cache of the object in the CPU,
1859          * finish invalidating it and free the per-page flags.
1860          */
1861         i915_gem_object_set_to_full_cpu_read_domain(obj);
1862
1863         /* Flush the CPU cache if it's still invalid. */
1864         if ((obj->read_domains & I915_GEM_DOMAIN_CPU) == 0) {
1865                 i915_gem_clflush_object(obj);
1866                 drm_agp_chipset_flush(dev);
1867
1868                 obj->read_domains |= I915_GEM_DOMAIN_CPU;
1869         }
1870
1871         /* It should now be out of any other write domains, and we can update
1872          * the domain values for our changes.
1873          */
1874         BUG_ON((obj->write_domain & ~I915_GEM_DOMAIN_CPU) != 0);
1875
1876         /* If we're writing through the CPU, then the GPU read domains will
1877          * need to be invalidated at next use.
1878          */
1879         if (write) {
1880                 obj->read_domains &= I915_GEM_DOMAIN_CPU;
1881                 obj->write_domain = I915_GEM_DOMAIN_CPU;
1882         }
1883
1884         return 0;
1885 }
1886
1887 /*
1888  * Set the next domain for the specified object. This
1889  * may not actually perform the necessary flushing/invaliding though,
1890  * as that may want to be batched with other set_domain operations
1891  *
1892  * This is (we hope) the only really tricky part of gem. The goal
1893  * is fairly simple -- track which caches hold bits of the object
1894  * and make sure they remain coherent. A few concrete examples may
1895  * help to explain how it works. For shorthand, we use the notation
1896  * (read_domains, write_domain), e.g. (CPU, CPU) to indicate the
1897  * a pair of read and write domain masks.
1898  *
1899  * Case 1: the batch buffer
1900  *
1901  *      1. Allocated
1902  *      2. Written by CPU
1903  *      3. Mapped to GTT
1904  *      4. Read by GPU
1905  *      5. Unmapped from GTT
1906  *      6. Freed
1907  *
1908  *      Let's take these a step at a time
1909  *
1910  *      1. Allocated
1911  *              Pages allocated from the kernel may still have
1912  *              cache contents, so we set them to (CPU, CPU) always.
1913  *      2. Written by CPU (using pwrite)
1914  *              The pwrite function calls set_domain (CPU, CPU) and
1915  *              this function does nothing (as nothing changes)
1916  *      3. Mapped by GTT
1917  *              This function asserts that the object is not
1918  *              currently in any GPU-based read or write domains
1919  *      4. Read by GPU
1920  *              i915_gem_execbuffer calls set_domain (COMMAND, 0).
1921  *              As write_domain is zero, this function adds in the
1922  *              current read domains (CPU+COMMAND, 0).
1923  *              flush_domains is set to CPU.
1924  *              invalidate_domains is set to COMMAND
1925  *              clflush is run to get data out of the CPU caches
1926  *              then i915_dev_set_domain calls i915_gem_flush to
1927  *              emit an MI_FLUSH and drm_agp_chipset_flush
1928  *      5. Unmapped from GTT
1929  *              i915_gem_object_unbind calls set_domain (CPU, CPU)
1930  *              flush_domains and invalidate_domains end up both zero
1931  *              so no flushing/invalidating happens
1932  *      6. Freed
1933  *              yay, done
1934  *
1935  * Case 2: The shared render buffer
1936  *
1937  *      1. Allocated
1938  *      2. Mapped to GTT
1939  *      3. Read/written by GPU
1940  *      4. set_domain to (CPU,CPU)
1941  *      5. Read/written by CPU
1942  *      6. Read/written by GPU
1943  *
1944  *      1. Allocated
1945  *              Same as last example, (CPU, CPU)
1946  *      2. Mapped to GTT
1947  *              Nothing changes (assertions find that it is not in the GPU)
1948  *      3. Read/written by GPU
1949  *              execbuffer calls set_domain (RENDER, RENDER)
1950  *              flush_domains gets CPU
1951  *              invalidate_domains gets GPU
1952  *              clflush (obj)
1953  *              MI_FLUSH and drm_agp_chipset_flush
1954  *      4. set_domain (CPU, CPU)
1955  *              flush_domains gets GPU
1956  *              invalidate_domains gets CPU
1957  *              wait_rendering (obj) to make sure all drawing is complete.
1958  *              This will include an MI_FLUSH to get the data from GPU
1959  *              to memory
1960  *              clflush (obj) to invalidate the CPU cache
1961  *              Another MI_FLUSH in i915_gem_flush (eliminate this somehow?)
1962  *      5. Read/written by CPU
1963  *              cache lines are loaded and dirtied
1964  *      6. Read written by GPU
1965  *              Same as last GPU access
1966  *
1967  * Case 3: The constant buffer
1968  *
1969  *      1. Allocated
1970  *      2. Written by CPU
1971  *      3. Read by GPU
1972  *      4. Updated (written) by CPU again
1973  *      5. Read by GPU
1974  *
1975  *      1. Allocated
1976  *              (CPU, CPU)
1977  *      2. Written by CPU
1978  *              (CPU, CPU)
1979  *      3. Read by GPU
1980  *              (CPU+RENDER, 0)
1981  *              flush_domains = CPU
1982  *              invalidate_domains = RENDER
1983  *              clflush (obj)
1984  *              MI_FLUSH
1985  *              drm_agp_chipset_flush
1986  *      4. Updated (written) by CPU again
1987  *              (CPU, CPU)
1988  *              flush_domains = 0 (no previous write domain)
1989  *              invalidate_domains = 0 (no new read domains)
1990  *      5. Read by GPU
1991  *              (CPU+RENDER, 0)
1992  *              flush_domains = CPU
1993  *              invalidate_domains = RENDER
1994  *              clflush (obj)
1995  *              MI_FLUSH
1996  *              drm_agp_chipset_flush
1997  */
1998 static void
1999 i915_gem_object_set_to_gpu_domain(struct drm_gem_object *obj,
2000                                   uint32_t read_domains,
2001                                   uint32_t write_domain)
2002 {
2003         struct drm_device               *dev = obj->dev;
2004         struct drm_i915_gem_object      *obj_priv = obj->driver_private;
2005         uint32_t                        invalidate_domains = 0;
2006         uint32_t                        flush_domains = 0;
2007
2008         BUG_ON(read_domains & I915_GEM_DOMAIN_CPU);
2009         BUG_ON(write_domain == I915_GEM_DOMAIN_CPU);
2010
2011 #if WATCH_BUF
2012         DRM_INFO("%s: object %p read %08x -> %08x write %08x -> %08x\n",
2013                  __func__, obj,
2014                  obj->read_domains, read_domains,
2015                  obj->write_domain, write_domain);
2016 #endif
2017         /*
2018          * If the object isn't moving to a new write domain,
2019          * let the object stay in multiple read domains
2020          */
2021         if (write_domain == 0)
2022                 read_domains |= obj->read_domains;
2023         else
2024                 obj_priv->dirty = 1;
2025
2026         /*
2027          * Flush the current write domain if
2028          * the new read domains don't match. Invalidate
2029          * any read domains which differ from the old
2030          * write domain
2031          */
2032         if (obj->write_domain && obj->write_domain != read_domains) {
2033                 flush_domains |= obj->write_domain;
2034                 invalidate_domains |= read_domains & ~obj->write_domain;
2035         }
2036         /*
2037          * Invalidate any read caches which may have
2038          * stale data. That is, any new read domains.
2039          */
2040         invalidate_domains |= read_domains & ~obj->read_domains;
2041         if ((flush_domains | invalidate_domains) & I915_GEM_DOMAIN_CPU) {
2042 #if WATCH_BUF
2043                 DRM_INFO("%s: CPU domain flush %08x invalidate %08x\n",
2044                          __func__, flush_domains, invalidate_domains);
2045 #endif
2046                 i915_gem_clflush_object(obj);
2047         }
2048
2049         if ((write_domain | flush_domains) != 0)
2050                 obj->write_domain = write_domain;
2051         obj->read_domains = read_domains;
2052
2053         dev->invalidate_domains |= invalidate_domains;
2054         dev->flush_domains |= flush_domains;
2055 #if WATCH_BUF
2056         DRM_INFO("%s: read %08x write %08x invalidate %08x flush %08x\n",
2057                  __func__,
2058                  obj->read_domains, obj->write_domain,
2059                  dev->invalidate_domains, dev->flush_domains);
2060 #endif
2061 }
2062
2063 /**
2064  * Moves the object from a partially CPU read to a full one.
2065  *
2066  * Note that this only resolves i915_gem_object_set_cpu_read_domain_range(),
2067  * and doesn't handle transitioning from !(read_domains & I915_GEM_DOMAIN_CPU).
2068  */
2069 static void
2070 i915_gem_object_set_to_full_cpu_read_domain(struct drm_gem_object *obj)
2071 {
2072         struct drm_device *dev = obj->dev;
2073         struct drm_i915_gem_object *obj_priv = obj->driver_private;
2074
2075         if (!obj_priv->page_cpu_valid)
2076                 return;
2077
2078         /* If we're partially in the CPU read domain, finish moving it in.
2079          */
2080         if (obj->read_domains & I915_GEM_DOMAIN_CPU) {
2081                 int i;
2082
2083                 for (i = 0; i <= (obj->size - 1) / PAGE_SIZE; i++) {
2084                         if (obj_priv->page_cpu_valid[i])
2085                                 continue;
2086                         drm_clflush_pages(obj_priv->page_list + i, 1);
2087                 }
2088                 drm_agp_chipset_flush(dev);
2089         }
2090
2091         /* Free the page_cpu_valid mappings which are now stale, whether
2092          * or not we've got I915_GEM_DOMAIN_CPU.
2093          */
2094         drm_free(obj_priv->page_cpu_valid, obj->size / PAGE_SIZE,
2095                  DRM_MEM_DRIVER);
2096         obj_priv->page_cpu_valid = NULL;
2097 }
2098
2099 /**
2100  * Set the CPU read domain on a range of the object.
2101  *
2102  * The object ends up with I915_GEM_DOMAIN_CPU in its read flags although it's
2103  * not entirely valid.  The page_cpu_valid member of the object flags which
2104  * pages have been flushed, and will be respected by
2105  * i915_gem_object_set_to_cpu_domain() if it's called on to get a valid mapping
2106  * of the whole object.
2107  *
2108  * This function returns when the move is complete, including waiting on
2109  * flushes to occur.
2110  */
2111 static int
2112 i915_gem_object_set_cpu_read_domain_range(struct drm_gem_object *obj,
2113                                           uint64_t offset, uint64_t size)
2114 {
2115         struct drm_i915_gem_object *obj_priv = obj->driver_private;
2116         int i, ret;
2117
2118         if (offset == 0 && size == obj->size)
2119                 return i915_gem_object_set_to_cpu_domain(obj, 0);
2120
2121         i915_gem_object_flush_gpu_write_domain(obj);
2122         /* Wait on any GPU rendering and flushing to occur. */
2123         ret = i915_gem_object_wait_rendering(obj);
2124         if (ret != 0)
2125                 return ret;
2126         i915_gem_object_flush_gtt_write_domain(obj);
2127
2128         /* If we're already fully in the CPU read domain, we're done. */
2129         if (obj_priv->page_cpu_valid == NULL &&
2130             (obj->read_domains & I915_GEM_DOMAIN_CPU) != 0)
2131                 return 0;
2132
2133         /* Otherwise, create/clear the per-page CPU read domain flag if we're
2134          * newly adding I915_GEM_DOMAIN_CPU
2135          */
2136         if (obj_priv->page_cpu_valid == NULL) {
2137                 obj_priv->page_cpu_valid = drm_calloc(1, obj->size / PAGE_SIZE,
2138                                                       DRM_MEM_DRIVER);
2139                 if (obj_priv->page_cpu_valid == NULL)
2140                         return -ENOMEM;
2141         } else if ((obj->read_domains & I915_GEM_DOMAIN_CPU) == 0)
2142                 memset(obj_priv->page_cpu_valid, 0, obj->size / PAGE_SIZE);
2143
2144         /* Flush the cache on any pages that are still invalid from the CPU's
2145          * perspective.
2146          */
2147         for (i = offset / PAGE_SIZE; i <= (offset + size - 1) / PAGE_SIZE;
2148              i++) {
2149                 if (obj_priv->page_cpu_valid[i])
2150                         continue;
2151
2152                 drm_clflush_pages(obj_priv->page_list + i, 1);
2153
2154                 obj_priv->page_cpu_valid[i] = 1;
2155         }
2156
2157         /* It should now be out of any other write domains, and we can update
2158          * the domain values for our changes.
2159          */
2160         BUG_ON((obj->write_domain & ~I915_GEM_DOMAIN_CPU) != 0);
2161
2162         obj->read_domains |= I915_GEM_DOMAIN_CPU;
2163
2164         return 0;
2165 }
2166
2167 /**
2168  * Pin an object to the GTT and evaluate the relocations landing in it.
2169  */
2170 static int
2171 i915_gem_object_pin_and_relocate(struct drm_gem_object *obj,
2172                                  struct drm_file *file_priv,
2173                                  struct drm_i915_gem_exec_object *entry)
2174 {
2175         struct drm_device *dev = obj->dev;
2176         drm_i915_private_t *dev_priv = dev->dev_private;
2177         struct drm_i915_gem_relocation_entry reloc;
2178         struct drm_i915_gem_relocation_entry __user *relocs;
2179         struct drm_i915_gem_object *obj_priv = obj->driver_private;
2180         int i, ret;
2181         void __iomem *reloc_page;
2182
2183         /* Choose the GTT offset for our buffer and put it there. */
2184         ret = i915_gem_object_pin(obj, (uint32_t) entry->alignment);
2185         if (ret)
2186                 return ret;
2187
2188         entry->offset = obj_priv->gtt_offset;
2189
2190         relocs = (struct drm_i915_gem_relocation_entry __user *)
2191                  (uintptr_t) entry->relocs_ptr;
2192         /* Apply the relocations, using the GTT aperture to avoid cache
2193          * flushing requirements.
2194          */
2195         for (i = 0; i < entry->relocation_count; i++) {
2196                 struct drm_gem_object *target_obj;
2197                 struct drm_i915_gem_object *target_obj_priv;
2198                 uint32_t reloc_val, reloc_offset;
2199                 uint32_t __iomem *reloc_entry;
2200
2201                 ret = copy_from_user(&reloc, relocs + i, sizeof(reloc));
2202                 if (ret != 0) {
2203                         i915_gem_object_unpin(obj);
2204                         return ret;
2205                 }
2206
2207                 target_obj = drm_gem_object_lookup(obj->dev, file_priv,
2208                                                    reloc.target_handle);
2209                 if (target_obj == NULL) {
2210                         i915_gem_object_unpin(obj);
2211                         return -EBADF;
2212                 }
2213                 target_obj_priv = target_obj->driver_private;
2214
2215                 /* The target buffer should have appeared before us in the
2216                  * exec_object list, so it should have a GTT space bound by now.
2217                  */
2218                 if (target_obj_priv->gtt_space == NULL) {
2219                         DRM_ERROR("No GTT space found for object %d\n",
2220                                   reloc.target_handle);
2221                         drm_gem_object_unreference(target_obj);
2222                         i915_gem_object_unpin(obj);
2223                         return -EINVAL;
2224                 }
2225
2226                 if (reloc.offset > obj->size - 4) {
2227                         DRM_ERROR("Relocation beyond object bounds: "
2228                                   "obj %p target %d offset %d size %d.\n",
2229                                   obj, reloc.target_handle,
2230                                   (int) reloc.offset, (int) obj->size);
2231                         drm_gem_object_unreference(target_obj);
2232                         i915_gem_object_unpin(obj);
2233                         return -EINVAL;
2234                 }
2235                 if (reloc.offset & 3) {
2236                         DRM_ERROR("Relocation not 4-byte aligned: "
2237                                   "obj %p target %d offset %d.\n",
2238                                   obj, reloc.target_handle,
2239                                   (int) reloc.offset);
2240                         drm_gem_object_unreference(target_obj);
2241                         i915_gem_object_unpin(obj);
2242                         return -EINVAL;
2243                 }
2244
2245                 if (reloc.write_domain & I915_GEM_DOMAIN_CPU ||
2246                     reloc.read_domains & I915_GEM_DOMAIN_CPU) {
2247                         DRM_ERROR("reloc with read/write CPU domains: "
2248                                   "obj %p target %d offset %d "
2249                                   "read %08x write %08x",
2250                                   obj, reloc.target_handle,
2251                                   (int) reloc.offset,
2252                                   reloc.read_domains,
2253                                   reloc.write_domain);
2254                         return -EINVAL;
2255                 }
2256
2257                 if (reloc.write_domain && target_obj->pending_write_domain &&
2258                     reloc.write_domain != target_obj->pending_write_domain) {
2259                         DRM_ERROR("Write domain conflict: "
2260                                   "obj %p target %d offset %d "
2261                                   "new %08x old %08x\n",
2262                                   obj, reloc.target_handle,
2263                                   (int) reloc.offset,
2264                                   reloc.write_domain,
2265                                   target_obj->pending_write_domain);
2266                         drm_gem_object_unreference(target_obj);
2267                         i915_gem_object_unpin(obj);
2268                         return -EINVAL;
2269                 }
2270
2271 #if WATCH_RELOC
2272                 DRM_INFO("%s: obj %p offset %08x target %d "
2273                          "read %08x write %08x gtt %08x "
2274                          "presumed %08x delta %08x\n",
2275                          __func__,
2276                          obj,
2277                          (int) reloc.offset,
2278                          (int) reloc.target_handle,
2279                          (int) reloc.read_domains,
2280                          (int) reloc.write_domain,
2281                          (int) target_obj_priv->gtt_offset,
2282                          (int) reloc.presumed_offset,
2283                          reloc.delta);
2284 #endif
2285
2286                 target_obj->pending_read_domains |= reloc.read_domains;
2287                 target_obj->pending_write_domain |= reloc.write_domain;
2288
2289                 /* If the relocation already has the right value in it, no
2290                  * more work needs to be done.
2291                  */
2292                 if (target_obj_priv->gtt_offset == reloc.presumed_offset) {
2293                         drm_gem_object_unreference(target_obj);
2294                         continue;
2295                 }
2296
2297                 ret = i915_gem_object_set_to_gtt_domain(obj, 1);
2298                 if (ret != 0) {
2299                         drm_gem_object_unreference(target_obj);
2300                         i915_gem_object_unpin(obj);
2301                         return -EINVAL;
2302                 }
2303
2304                 /* Map the page containing the relocation we're going to
2305                  * perform.
2306                  */
2307                 reloc_offset = obj_priv->gtt_offset + reloc.offset;
2308                 reloc_page = io_mapping_map_atomic_wc(dev_priv->mm.gtt_mapping,
2309                                                       (reloc_offset &
2310                                                        ~(PAGE_SIZE - 1)));
2311                 reloc_entry = (uint32_t __iomem *)(reloc_page +
2312                                                    (reloc_offset & (PAGE_SIZE - 1)));
2313                 reloc_val = target_obj_priv->gtt_offset + reloc.delta;
2314
2315 #if WATCH_BUF
2316                 DRM_INFO("Applied relocation: %p@0x%08x %08x -> %08x\n",
2317                           obj, (unsigned int) reloc.offset,
2318                           readl(reloc_entry), reloc_val);
2319 #endif
2320                 writel(reloc_val, reloc_entry);
2321                 io_mapping_unmap_atomic(reloc_page);
2322
2323                 /* Write the updated presumed offset for this entry back out
2324                  * to the user.
2325                  */
2326                 reloc.presumed_offset = target_obj_priv->gtt_offset;
2327                 ret = copy_to_user(relocs + i, &reloc, sizeof(reloc));
2328                 if (ret != 0) {
2329                         drm_gem_object_unreference(target_obj);
2330                         i915_gem_object_unpin(obj);
2331                         return ret;
2332                 }
2333
2334                 drm_gem_object_unreference(target_obj);
2335         }
2336
2337 #if WATCH_BUF
2338         if (0)
2339                 i915_gem_dump_object(obj, 128, __func__, ~0);
2340 #endif
2341         return 0;
2342 }
2343
2344 /** Dispatch a batchbuffer to the ring
2345  */
2346 static int
2347 i915_dispatch_gem_execbuffer(struct drm_device *dev,
2348                               struct drm_i915_gem_execbuffer *exec,
2349                               uint64_t exec_offset)
2350 {
2351         drm_i915_private_t *dev_priv = dev->dev_private;
2352         struct drm_clip_rect __user *boxes = (struct drm_clip_rect __user *)
2353                                              (uintptr_t) exec->cliprects_ptr;
2354         int nbox = exec->num_cliprects;
2355         int i = 0, count;
2356         uint32_t        exec_start, exec_len;
2357         RING_LOCALS;
2358
2359         exec_start = (uint32_t) exec_offset + exec->batch_start_offset;
2360         exec_len = (uint32_t) exec->batch_len;
2361
2362         if ((exec_start | exec_len) & 0x7) {
2363                 DRM_ERROR("alignment\n");
2364                 return -EINVAL;
2365         }
2366
2367         if (!exec_start)
2368                 return -EINVAL;
2369
2370         count = nbox ? nbox : 1;
2371
2372         for (i = 0; i < count; i++) {
2373                 if (i < nbox) {
2374                         int ret = i915_emit_box(dev, boxes, i,
2375                                                 exec->DR1, exec->DR4);
2376                         if (ret)
2377                                 return ret;
2378                 }
2379
2380                 if (IS_I830(dev) || IS_845G(dev)) {
2381                         BEGIN_LP_RING(4);
2382                         OUT_RING(MI_BATCH_BUFFER);
2383                         OUT_RING(exec_start | MI_BATCH_NON_SECURE);
2384                         OUT_RING(exec_start + exec_len - 4);
2385                         OUT_RING(0);
2386                         ADVANCE_LP_RING();
2387                 } else {
2388                         BEGIN_LP_RING(2);
2389                         if (IS_I965G(dev)) {
2390                                 OUT_RING(MI_BATCH_BUFFER_START |
2391                                          (2 << 6) |
2392                                          MI_BATCH_NON_SECURE_I965);
2393                                 OUT_RING(exec_start);
2394                         } else {
2395                                 OUT_RING(MI_BATCH_BUFFER_START |
2396                                          (2 << 6));
2397                                 OUT_RING(exec_start | MI_BATCH_NON_SECURE);
2398                         }
2399                         ADVANCE_LP_RING();
2400                 }
2401         }
2402
2403         /* XXX breadcrumb */
2404         return 0;
2405 }
2406
2407 /* Throttle our rendering by waiting until the ring has completed our requests
2408  * emitted over 20 msec ago.
2409  *
2410  * This should get us reasonable parallelism between CPU and GPU but also
2411  * relatively low latency when blocking on a particular request to finish.
2412  */
2413 static int
2414 i915_gem_ring_throttle(struct drm_device *dev, struct drm_file *file_priv)
2415 {
2416         struct drm_i915_file_private *i915_file_priv = file_priv->driver_priv;
2417         int ret = 0;
2418         uint32_t seqno;
2419
2420         mutex_lock(&dev->struct_mutex);
2421         seqno = i915_file_priv->mm.last_gem_throttle_seqno;
2422         i915_file_priv->mm.last_gem_throttle_seqno =
2423                 i915_file_priv->mm.last_gem_seqno;
2424         if (seqno)
2425                 ret = i915_wait_request(dev, seqno);
2426         mutex_unlock(&dev->struct_mutex);
2427         return ret;
2428 }
2429
2430 int
2431 i915_gem_execbuffer(struct drm_device *dev, void *data,
2432                     struct drm_file *file_priv)
2433 {
2434         drm_i915_private_t *dev_priv = dev->dev_private;
2435         struct drm_i915_file_private *i915_file_priv = file_priv->driver_priv;
2436         struct drm_i915_gem_execbuffer *args = data;
2437         struct drm_i915_gem_exec_object *exec_list = NULL;
2438         struct drm_gem_object **object_list = NULL;
2439         struct drm_gem_object *batch_obj;
2440         int ret, i, pinned = 0;
2441         uint64_t exec_offset;
2442         uint32_t seqno, flush_domains;
2443         int pin_tries;
2444
2445 #if WATCH_EXEC
2446         DRM_INFO("buffers_ptr %d buffer_count %d len %08x\n",
2447                   (int) args->buffers_ptr, args->buffer_count, args->batch_len);
2448 #endif
2449
2450         if (args->buffer_count < 1) {
2451                 DRM_ERROR("execbuf with %d buffers\n", args->buffer_count);
2452                 return -EINVAL;
2453         }
2454         /* Copy in the exec list from userland */
2455         exec_list = drm_calloc(sizeof(*exec_list), args->buffer_count,
2456                                DRM_MEM_DRIVER);
2457         object_list = drm_calloc(sizeof(*object_list), args->buffer_count,
2458                                  DRM_MEM_DRIVER);
2459         if (exec_list == NULL || object_list == NULL) {
2460                 DRM_ERROR("Failed to allocate exec or object list "
2461                           "for %d buffers\n",
2462                           args->buffer_count);
2463                 ret = -ENOMEM;
2464                 goto pre_mutex_err;
2465         }
2466         ret = copy_from_user(exec_list,
2467                              (struct drm_i915_relocation_entry __user *)
2468                              (uintptr_t) args->buffers_ptr,
2469                              sizeof(*exec_list) * args->buffer_count);
2470         if (ret != 0) {
2471                 DRM_ERROR("copy %d exec entries failed %d\n",
2472                           args->buffer_count, ret);
2473                 goto pre_mutex_err;
2474         }
2475
2476         mutex_lock(&dev->struct_mutex);
2477
2478         i915_verify_inactive(dev, __FILE__, __LINE__);
2479
2480         if (dev_priv->mm.wedged) {
2481                 DRM_ERROR("Execbuf while wedged\n");
2482                 mutex_unlock(&dev->struct_mutex);
2483                 return -EIO;
2484         }
2485
2486         if (dev_priv->mm.suspended) {
2487                 DRM_ERROR("Execbuf while VT-switched.\n");
2488                 mutex_unlock(&dev->struct_mutex);
2489                 return -EBUSY;
2490         }
2491
2492         /* Look up object handles */
2493         for (i = 0; i < args->buffer_count; i++) {
2494                 object_list[i] = drm_gem_object_lookup(dev, file_priv,
2495                                                        exec_list[i].handle);
2496                 if (object_list[i] == NULL) {
2497                         DRM_ERROR("Invalid object handle %d at index %d\n",
2498                                    exec_list[i].handle, i);
2499                         ret = -EBADF;
2500                         goto err;
2501                 }
2502         }
2503
2504         /* Pin and relocate */
2505         for (pin_tries = 0; ; pin_tries++) {
2506                 ret = 0;
2507                 for (i = 0; i < args->buffer_count; i++) {
2508                         object_list[i]->pending_read_domains = 0;
2509                         object_list[i]->pending_write_domain = 0;
2510                         ret = i915_gem_object_pin_and_relocate(object_list[i],
2511                                                                file_priv,
2512                                                                &exec_list[i]);
2513                         if (ret)
2514                                 break;
2515                         pinned = i + 1;
2516                 }
2517                 /* success */
2518                 if (ret == 0)
2519                         break;
2520
2521                 /* error other than GTT full, or we've already tried again */
2522                 if (ret != -ENOMEM || pin_tries >= 1) {
2523                         if (ret != -ERESTARTSYS)
2524                                 DRM_ERROR("Failed to pin buffers %d\n", ret);
2525                         goto err;
2526                 }
2527
2528                 /* unpin all of our buffers */
2529                 for (i = 0; i < pinned; i++)
2530                         i915_gem_object_unpin(object_list[i]);
2531                 pinned = 0;
2532
2533                 /* evict everyone we can from the aperture */
2534                 ret = i915_gem_evict_everything(dev);
2535                 if (ret)
2536                         goto err;
2537         }
2538
2539         /* Set the pending read domains for the batch buffer to COMMAND */
2540         batch_obj = object_list[args->buffer_count-1];
2541         batch_obj->pending_read_domains = I915_GEM_DOMAIN_COMMAND;
2542         batch_obj->pending_write_domain = 0;
2543
2544         i915_verify_inactive(dev, __FILE__, __LINE__);
2545
2546         /* Zero the global flush/invalidate flags. These
2547          * will be modified as new domains are computed
2548          * for each object
2549          */
2550         dev->invalidate_domains = 0;
2551         dev->flush_domains = 0;
2552
2553         for (i = 0; i < args->buffer_count; i++) {
2554                 struct drm_gem_object *obj = object_list[i];
2555
2556                 /* Compute new gpu domains and update invalidate/flush */
2557                 i915_gem_object_set_to_gpu_domain(obj,
2558                                                   obj->pending_read_domains,
2559                                                   obj->pending_write_domain);
2560         }
2561
2562         i915_verify_inactive(dev, __FILE__, __LINE__);
2563
2564         if (dev->invalidate_domains | dev->flush_domains) {
2565 #if WATCH_EXEC
2566                 DRM_INFO("%s: invalidate_domains %08x flush_domains %08x\n",
2567                           __func__,
2568                          dev->invalidate_domains,
2569                          dev->flush_domains);
2570 #endif
2571                 i915_gem_flush(dev,
2572                                dev->invalidate_domains,
2573                                dev->flush_domains);
2574                 if (dev->flush_domains)
2575                         (void)i915_add_request(dev, dev->flush_domains);
2576         }
2577
2578         i915_verify_inactive(dev, __FILE__, __LINE__);
2579
2580 #if WATCH_COHERENCY
2581         for (i = 0; i < args->buffer_count; i++) {
2582                 i915_gem_object_check_coherency(object_list[i],
2583                                                 exec_list[i].handle);
2584         }
2585 #endif
2586
2587         exec_offset = exec_list[args->buffer_count - 1].offset;
2588
2589 #if WATCH_EXEC
2590         i915_gem_dump_object(object_list[args->buffer_count - 1],
2591                               args->batch_len,
2592                               __func__,
2593                               ~0);
2594 #endif
2595
2596         /* Exec the batchbuffer */
2597         ret = i915_dispatch_gem_execbuffer(dev, args, exec_offset);
2598         if (ret) {
2599                 DRM_ERROR("dispatch failed %d\n", ret);
2600                 goto err;
2601         }
2602
2603         /*
2604          * Ensure that the commands in the batch buffer are
2605          * finished before the interrupt fires
2606          */
2607         flush_domains = i915_retire_commands(dev);
2608
2609         i915_verify_inactive(dev, __FILE__, __LINE__);
2610
2611         /*
2612          * Get a seqno representing the execution of the current buffer,
2613          * which we can wait on.  We would like to mitigate these interrupts,
2614          * likely by only creating seqnos occasionally (so that we have
2615          * *some* interrupts representing completion of buffers that we can
2616          * wait on when trying to clear up gtt space).
2617          */
2618         seqno = i915_add_request(dev, flush_domains);
2619         BUG_ON(seqno == 0);
2620         i915_file_priv->mm.last_gem_seqno = seqno;
2621         for (i = 0; i < args->buffer_count; i++) {
2622                 struct drm_gem_object *obj = object_list[i];
2623
2624                 i915_gem_object_move_to_active(obj, seqno);
2625 #if WATCH_LRU
2626                 DRM_INFO("%s: move to exec list %p\n", __func__, obj);
2627 #endif
2628         }
2629 #if WATCH_LRU
2630         i915_dump_lru(dev, __func__);
2631 #endif
2632
2633         i915_verify_inactive(dev, __FILE__, __LINE__);
2634
2635         /* Copy the new buffer offsets back to the user's exec list. */
2636         ret = copy_to_user((struct drm_i915_relocation_entry __user *)
2637                            (uintptr_t) args->buffers_ptr,
2638                            exec_list,
2639                            sizeof(*exec_list) * args->buffer_count);
2640         if (ret)
2641                 DRM_ERROR("failed to copy %d exec entries "
2642                           "back to user (%d)\n",
2643                            args->buffer_count, ret);
2644 err:
2645         for (i = 0; i < pinned; i++)
2646                 i915_gem_object_unpin(object_list[i]);
2647
2648         for (i = 0; i < args->buffer_count; i++)
2649                 drm_gem_object_unreference(object_list[i]);
2650
2651         mutex_unlock(&dev->struct_mutex);
2652
2653 pre_mutex_err:
2654         drm_free(object_list, sizeof(*object_list) * args->buffer_count,
2655                  DRM_MEM_DRIVER);
2656         drm_free(exec_list, sizeof(*exec_list) * args->buffer_count,
2657                  DRM_MEM_DRIVER);
2658
2659         return ret;
2660 }
2661
2662 int
2663 i915_gem_object_pin(struct drm_gem_object *obj, uint32_t alignment)
2664 {
2665         struct drm_device *dev = obj->dev;
2666         struct drm_i915_gem_object *obj_priv = obj->driver_private;
2667         int ret;
2668
2669         i915_verify_inactive(dev, __FILE__, __LINE__);
2670         if (obj_priv->gtt_space == NULL) {
2671                 ret = i915_gem_object_bind_to_gtt(obj, alignment);
2672                 if (ret != 0) {
2673                         if (ret != -EBUSY && ret != -ERESTARTSYS)
2674                                 DRM_ERROR("Failure to bind: %d", ret);
2675                         return ret;
2676                 }
2677                 /*
2678                  * Pre-965 chips need a fence register set up in order to
2679                  * properly handle tiled surfaces.
2680                  */
2681                 if (!IS_I965G(dev) &&
2682                     obj_priv->fence_reg == I915_FENCE_REG_NONE &&
2683                     obj_priv->tiling_mode != I915_TILING_NONE)
2684                         i915_gem_object_get_fence_reg(obj, true);
2685         }
2686         obj_priv->pin_count++;
2687
2688         /* If the object is not active and not pending a flush,
2689          * remove it from the inactive list
2690          */
2691         if (obj_priv->pin_count == 1) {
2692                 atomic_inc(&dev->pin_count);
2693                 atomic_add(obj->size, &dev->pin_memory);
2694                 if (!obj_priv->active &&
2695                     (obj->write_domain & ~(I915_GEM_DOMAIN_CPU |
2696                                            I915_GEM_DOMAIN_GTT)) == 0 &&
2697                     !list_empty(&obj_priv->list))
2698                         list_del_init(&obj_priv->list);
2699         }
2700         i915_verify_inactive(dev, __FILE__, __LINE__);
2701
2702         return 0;
2703 }
2704
2705 void
2706 i915_gem_object_unpin(struct drm_gem_object *obj)
2707 {
2708         struct drm_device *dev = obj->dev;
2709         drm_i915_private_t *dev_priv = dev->dev_private;
2710         struct drm_i915_gem_object *obj_priv = obj->driver_private;
2711
2712         i915_verify_inactive(dev, __FILE__, __LINE__);
2713         obj_priv->pin_count--;
2714         BUG_ON(obj_priv->pin_count < 0);
2715         BUG_ON(obj_priv->gtt_space == NULL);
2716
2717         /* If the object is no longer pinned, and is
2718          * neither active nor being flushed, then stick it on
2719          * the inactive list
2720          */
2721         if (obj_priv->pin_count == 0) {
2722                 if (!obj_priv->active &&
2723                     (obj->write_domain & ~(I915_GEM_DOMAIN_CPU |
2724                                            I915_GEM_DOMAIN_GTT)) == 0)
2725                         list_move_tail(&obj_priv->list,
2726                                        &dev_priv->mm.inactive_list);
2727                 atomic_dec(&dev->pin_count);
2728                 atomic_sub(obj->size, &dev->pin_memory);
2729         }
2730         i915_verify_inactive(dev, __FILE__, __LINE__);
2731 }
2732
2733 int
2734 i915_gem_pin_ioctl(struct drm_device *dev, void *data,
2735                    struct drm_file *file_priv)
2736 {
2737         struct drm_i915_gem_pin *args = data;
2738         struct drm_gem_object *obj;
2739         struct drm_i915_gem_object *obj_priv;
2740         int ret;
2741
2742         mutex_lock(&dev->struct_mutex);
2743
2744         obj = drm_gem_object_lookup(dev, file_priv, args->handle);
2745         if (obj == NULL) {
2746                 DRM_ERROR("Bad handle in i915_gem_pin_ioctl(): %d\n",
2747                           args->handle);
2748                 mutex_unlock(&dev->struct_mutex);
2749                 return -EBADF;
2750         }
2751         obj_priv = obj->driver_private;
2752
2753         if (obj_priv->pin_filp != NULL && obj_priv->pin_filp != file_priv) {
2754                 DRM_ERROR("Already pinned in i915_gem_pin_ioctl(): %d\n",
2755                           args->handle);
2756                 mutex_unlock(&dev->struct_mutex);
2757                 return -EINVAL;
2758         }
2759
2760         obj_priv->user_pin_count++;
2761         obj_priv->pin_filp = file_priv;
2762         if (obj_priv->user_pin_count == 1) {
2763                 ret = i915_gem_object_pin(obj, args->alignment);
2764                 if (ret != 0) {
2765                         drm_gem_object_unreference(obj);
2766                         mutex_unlock(&dev->struct_mutex);
2767                         return ret;
2768                 }
2769         }
2770
2771         /* XXX - flush the CPU caches for pinned objects
2772          * as the X server doesn't manage domains yet
2773          */
2774         i915_gem_object_flush_cpu_write_domain(obj);
2775         args->offset = obj_priv->gtt_offset;
2776         drm_gem_object_unreference(obj);
2777         mutex_unlock(&dev->struct_mutex);
2778
2779         return 0;
2780 }
2781
2782 int
2783 i915_gem_unpin_ioctl(struct drm_device *dev, void *data,
2784                      struct drm_file *file_priv)
2785 {
2786         struct drm_i915_gem_pin *args = data;
2787         struct drm_gem_object *obj;
2788         struct drm_i915_gem_object *obj_priv;
2789
2790         mutex_lock(&dev->struct_mutex);
2791
2792         obj = drm_gem_object_lookup(dev, file_priv, args->handle);
2793         if (obj == NULL) {
2794                 DRM_ERROR("Bad handle in i915_gem_unpin_ioctl(): %d\n",
2795                           args->handle);
2796                 mutex_unlock(&dev->struct_mutex);
2797                 return -EBADF;
2798         }
2799
2800         obj_priv = obj->driver_private;
2801         if (obj_priv->pin_filp != file_priv) {
2802                 DRM_ERROR("Not pinned by caller in i915_gem_pin_ioctl(): %d\n",
2803                           args->handle);
2804                 drm_gem_object_unreference(obj);
2805                 mutex_unlock(&dev->struct_mutex);
2806                 return -EINVAL;
2807         }
2808         obj_priv->user_pin_count--;
2809         if (obj_priv->user_pin_count == 0) {
2810                 obj_priv->pin_filp = NULL;
2811                 i915_gem_object_unpin(obj);
2812         }
2813
2814         drm_gem_object_unreference(obj);
2815         mutex_unlock(&dev->struct_mutex);
2816         return 0;
2817 }
2818
2819 int
2820 i915_gem_busy_ioctl(struct drm_device *dev, void *data,
2821                     struct drm_file *file_priv)
2822 {
2823         struct drm_i915_gem_busy *args = data;
2824         struct drm_gem_object *obj;
2825         struct drm_i915_gem_object *obj_priv;
2826
2827         mutex_lock(&dev->struct_mutex);
2828         obj = drm_gem_object_lookup(dev, file_priv, args->handle);
2829         if (obj == NULL) {
2830                 DRM_ERROR("Bad handle in i915_gem_busy_ioctl(): %d\n",
2831                           args->handle);
2832                 mutex_unlock(&dev->struct_mutex);
2833                 return -EBADF;
2834         }
2835
2836         obj_priv = obj->driver_private;
2837         /* Don't count being on the flushing list against the object being
2838          * done.  Otherwise, a buffer left on the flushing list but not getting
2839          * flushed (because nobody's flushing that domain) won't ever return
2840          * unbusy and get reused by libdrm's bo cache.  The other expected
2841          * consumer of this interface, OpenGL's occlusion queries, also specs
2842          * that the objects get unbusy "eventually" without any interference.
2843          */
2844         args->busy = obj_priv->active && obj_priv->last_rendering_seqno != 0;
2845
2846         drm_gem_object_unreference(obj);
2847         mutex_unlock(&dev->struct_mutex);
2848         return 0;
2849 }
2850
2851 int
2852 i915_gem_throttle_ioctl(struct drm_device *dev, void *data,
2853                         struct drm_file *file_priv)
2854 {
2855     return i915_gem_ring_throttle(dev, file_priv);
2856 }
2857
2858 int i915_gem_init_object(struct drm_gem_object *obj)
2859 {
2860         struct drm_i915_gem_object *obj_priv;
2861
2862         obj_priv = drm_calloc(1, sizeof(*obj_priv), DRM_MEM_DRIVER);
2863         if (obj_priv == NULL)
2864                 return -ENOMEM;
2865
2866         /*
2867          * We've just allocated pages from the kernel,
2868          * so they've just been written by the CPU with
2869          * zeros. They'll need to be clflushed before we
2870          * use them with the GPU.
2871          */
2872         obj->write_domain = I915_GEM_DOMAIN_CPU;
2873         obj->read_domains = I915_GEM_DOMAIN_CPU;
2874
2875         obj_priv->agp_type = AGP_USER_MEMORY;
2876
2877         obj->driver_private = obj_priv;
2878         obj_priv->obj = obj;
2879         obj_priv->fence_reg = I915_FENCE_REG_NONE;
2880         INIT_LIST_HEAD(&obj_priv->list);
2881
2882         return 0;
2883 }
2884
2885 void i915_gem_free_object(struct drm_gem_object *obj)
2886 {
2887         struct drm_device *dev = obj->dev;
2888         struct drm_gem_mm *mm = dev->mm_private;
2889         struct drm_map_list *list;
2890         struct drm_map *map;
2891         struct drm_i915_gem_object *obj_priv = obj->driver_private;
2892
2893         while (obj_priv->pin_count > 0)
2894                 i915_gem_object_unpin(obj);
2895
2896         if (obj_priv->phys_obj)
2897                 i915_gem_detach_phys_object(dev, obj);
2898
2899         i915_gem_object_unbind(obj);
2900
2901         list = &obj->map_list;
2902         drm_ht_remove_item(&mm->offset_hash, &list->hash);
2903
2904         if (list->file_offset_node) {
2905                 drm_mm_put_block(list->file_offset_node);
2906                 list->file_offset_node = NULL;
2907         }
2908
2909         map = list->map;
2910         if (map) {
2911                 drm_free(map, sizeof(*map), DRM_MEM_DRIVER);
2912                 list->map = NULL;
2913         }
2914
2915         drm_free(obj_priv->page_cpu_valid, 1, DRM_MEM_DRIVER);
2916         drm_free(obj->driver_private, 1, DRM_MEM_DRIVER);
2917 }
2918
2919 /** Unbinds all objects that are on the given buffer list. */
2920 static int
2921 i915_gem_evict_from_list(struct drm_device *dev, struct list_head *head)
2922 {
2923         struct drm_gem_object *obj;
2924         struct drm_i915_gem_object *obj_priv;
2925         int ret;
2926
2927         while (!list_empty(head)) {
2928                 obj_priv = list_first_entry(head,
2929                                             struct drm_i915_gem_object,
2930                                             list);
2931                 obj = obj_priv->obj;
2932
2933                 if (obj_priv->pin_count != 0) {
2934                         DRM_ERROR("Pinned object in unbind list\n");
2935                         mutex_unlock(&dev->struct_mutex);
2936                         return -EINVAL;
2937                 }
2938
2939                 ret = i915_gem_object_unbind(obj);
2940                 if (ret != 0) {
2941                         DRM_ERROR("Error unbinding object in LeaveVT: %d\n",
2942                                   ret);
2943                         mutex_unlock(&dev->struct_mutex);
2944                         return ret;
2945                 }
2946         }
2947
2948
2949         return 0;
2950 }
2951
2952 static int
2953 i915_gem_idle(struct drm_device *dev)
2954 {
2955         drm_i915_private_t *dev_priv = dev->dev_private;
2956         uint32_t seqno, cur_seqno, last_seqno;
2957         int stuck, ret;
2958
2959         mutex_lock(&dev->struct_mutex);
2960
2961         if (dev_priv->mm.suspended || dev_priv->ring.ring_obj == NULL) {
2962                 mutex_unlock(&dev->struct_mutex);
2963                 return 0;
2964         }
2965
2966         /* Hack!  Don't let anybody do execbuf while we don't control the chip.
2967          * We need to replace this with a semaphore, or something.
2968          */
2969         dev_priv->mm.suspended = 1;
2970
2971         /* Cancel the retire work handler, wait for it to finish if running
2972          */
2973         mutex_unlock(&dev->struct_mutex);
2974         cancel_delayed_work_sync(&dev_priv->mm.retire_work);
2975         mutex_lock(&dev->struct_mutex);
2976
2977         i915_kernel_lost_context(dev);
2978
2979         /* Flush the GPU along with all non-CPU write domains
2980          */
2981         i915_gem_flush(dev, ~(I915_GEM_DOMAIN_CPU|I915_GEM_DOMAIN_GTT),
2982                        ~(I915_GEM_DOMAIN_CPU|I915_GEM_DOMAIN_GTT));
2983         seqno = i915_add_request(dev, ~I915_GEM_DOMAIN_CPU);
2984
2985         if (seqno == 0) {
2986                 mutex_unlock(&dev->struct_mutex);
2987                 return -ENOMEM;
2988         }
2989
2990         dev_priv->mm.waiting_gem_seqno = seqno;
2991         last_seqno = 0;
2992         stuck = 0;
2993         for (;;) {
2994                 cur_seqno = i915_get_gem_seqno(dev);
2995                 if (i915_seqno_passed(cur_seqno, seqno))
2996                         break;
2997                 if (last_seqno == cur_seqno) {
2998                         if (stuck++ > 100) {
2999                                 DRM_ERROR("hardware wedged\n");
3000                                 dev_priv->mm.wedged = 1;
3001                                 DRM_WAKEUP(&dev_priv->irq_queue);
3002                                 break;
3003                         }
3004                 }
3005                 msleep(10);
3006                 last_seqno = cur_seqno;
3007         }
3008         dev_priv->mm.waiting_gem_seqno = 0;
3009
3010         i915_gem_retire_requests(dev);
3011
3012         if (!dev_priv->mm.wedged) {
3013                 /* Active and flushing should now be empty as we've
3014                  * waited for a sequence higher than any pending execbuffer
3015                  */
3016                 WARN_ON(!list_empty(&dev_priv->mm.active_list));
3017                 WARN_ON(!list_empty(&dev_priv->mm.flushing_list));
3018                 /* Request should now be empty as we've also waited
3019                  * for the last request in the list
3020                  */
3021                 WARN_ON(!list_empty(&dev_priv->mm.request_list));
3022         }
3023
3024         /* Empty the active and flushing lists to inactive.  If there's
3025          * anything left at this point, it means that we're wedged and
3026          * nothing good's going to happen by leaving them there.  So strip
3027          * the GPU domains and just stuff them onto inactive.
3028          */
3029         while (!list_empty(&dev_priv->mm.active_list)) {
3030                 struct drm_i915_gem_object *obj_priv;
3031
3032                 obj_priv = list_first_entry(&dev_priv->mm.active_list,
3033                                             struct drm_i915_gem_object,
3034                                             list);
3035                 obj_priv->obj->write_domain &= ~I915_GEM_GPU_DOMAINS;
3036                 i915_gem_object_move_to_inactive(obj_priv->obj);
3037         }
3038
3039         while (!list_empty(&dev_priv->mm.flushing_list)) {
3040                 struct drm_i915_gem_object *obj_priv;
3041
3042                 obj_priv = list_first_entry(&dev_priv->mm.flushing_list,
3043                                             struct drm_i915_gem_object,
3044                                             list);
3045                 obj_priv->obj->write_domain &= ~I915_GEM_GPU_DOMAINS;
3046                 i915_gem_object_move_to_inactive(obj_priv->obj);
3047         }
3048
3049
3050         /* Move all inactive buffers out of the GTT. */
3051         ret = i915_gem_evict_from_list(dev, &dev_priv->mm.inactive_list);
3052         WARN_ON(!list_empty(&dev_priv->mm.inactive_list));
3053         if (ret) {
3054                 mutex_unlock(&dev->struct_mutex);
3055                 return ret;
3056         }
3057
3058         i915_gem_cleanup_ringbuffer(dev);
3059         mutex_unlock(&dev->struct_mutex);
3060
3061         return 0;
3062 }
3063
3064 static int
3065 i915_gem_init_hws(struct drm_device *dev)
3066 {
3067         drm_i915_private_t *dev_priv = dev->dev_private;
3068         struct drm_gem_object *obj;
3069         struct drm_i915_gem_object *obj_priv;
3070         int ret;
3071
3072         /* If we need a physical address for the status page, it's already
3073          * initialized at driver load time.
3074          */
3075         if (!I915_NEED_GFX_HWS(dev))
3076                 return 0;
3077
3078         obj = drm_gem_object_alloc(dev, 4096);
3079         if (obj == NULL) {
3080                 DRM_ERROR("Failed to allocate status page\n");
3081                 return -ENOMEM;
3082         }
3083         obj_priv = obj->driver_private;
3084         obj_priv->agp_type = AGP_USER_CACHED_MEMORY;
3085
3086         ret = i915_gem_object_pin(obj, 4096);
3087         if (ret != 0) {
3088                 drm_gem_object_unreference(obj);
3089                 return ret;
3090         }
3091
3092         dev_priv->status_gfx_addr = obj_priv->gtt_offset;
3093
3094         dev_priv->hw_status_page = kmap(obj_priv->page_list[0]);
3095         if (dev_priv->hw_status_page == NULL) {
3096                 DRM_ERROR("Failed to map status page.\n");
3097                 memset(&dev_priv->hws_map, 0, sizeof(dev_priv->hws_map));
3098                 drm_gem_object_unreference(obj);
3099                 return -EINVAL;
3100         }
3101         dev_priv->hws_obj = obj;
3102         memset(dev_priv->hw_status_page, 0, PAGE_SIZE);
3103         I915_WRITE(HWS_PGA, dev_priv->status_gfx_addr);
3104         I915_READ(HWS_PGA); /* posting read */
3105         DRM_DEBUG("hws offset: 0x%08x\n", dev_priv->status_gfx_addr);
3106
3107         return 0;
3108 }
3109
3110 int
3111 i915_gem_init_ringbuffer(struct drm_device *dev)
3112 {
3113         drm_i915_private_t *dev_priv = dev->dev_private;
3114         struct drm_gem_object *obj;
3115         struct drm_i915_gem_object *obj_priv;
3116         drm_i915_ring_buffer_t *ring = &dev_priv->ring;
3117         int ret;
3118         u32 head;
3119
3120         ret = i915_gem_init_hws(dev);
3121         if (ret != 0)
3122                 return ret;
3123
3124         obj = drm_gem_object_alloc(dev, 128 * 1024);
3125         if (obj == NULL) {
3126                 DRM_ERROR("Failed to allocate ringbuffer\n");
3127                 return -ENOMEM;
3128         }
3129         obj_priv = obj->driver_private;
3130
3131         ret = i915_gem_object_pin(obj, 4096);
3132         if (ret != 0) {
3133                 drm_gem_object_unreference(obj);
3134                 return ret;
3135         }
3136
3137         /* Set up the kernel mapping for the ring. */
3138         ring->Size = obj->size;
3139         ring->tail_mask = obj->size - 1;
3140
3141         ring->map.offset = dev->agp->base + obj_priv->gtt_offset;
3142         ring->map.size = obj->size;
3143         ring->map.type = 0;
3144         ring->map.flags = 0;
3145         ring->map.mtrr = 0;
3146
3147         drm_core_ioremap_wc(&ring->map, dev);
3148         if (ring->map.handle == NULL) {
3149                 DRM_ERROR("Failed to map ringbuffer.\n");
3150                 memset(&dev_priv->ring, 0, sizeof(dev_priv->ring));
3151                 drm_gem_object_unreference(obj);
3152                 return -EINVAL;
3153         }
3154         ring->ring_obj = obj;
3155         ring->virtual_start = ring->map.handle;
3156
3157         /* Stop the ring if it's running. */
3158         I915_WRITE(PRB0_CTL, 0);
3159         I915_WRITE(PRB0_TAIL, 0);
3160         I915_WRITE(PRB0_HEAD, 0);
3161
3162         /* Initialize the ring. */
3163         I915_WRITE(PRB0_START, obj_priv->gtt_offset);
3164         head = I915_READ(PRB0_HEAD) & HEAD_ADDR;
3165
3166         /* G45 ring initialization fails to reset head to zero */
3167         if (head != 0) {
3168                 DRM_ERROR("Ring head not reset to zero "
3169                           "ctl %08x head %08x tail %08x start %08x\n",
3170                           I915_READ(PRB0_CTL),
3171                           I915_READ(PRB0_HEAD),
3172                           I915_READ(PRB0_TAIL),
3173                           I915_READ(PRB0_START));
3174                 I915_WRITE(PRB0_HEAD, 0);
3175
3176                 DRM_ERROR("Ring head forced to zero "
3177                           "ctl %08x head %08x tail %08x start %08x\n",
3178                           I915_READ(PRB0_CTL),
3179                           I915_READ(PRB0_HEAD),
3180                           I915_READ(PRB0_TAIL),
3181                           I915_READ(PRB0_START));
3182         }
3183
3184         I915_WRITE(PRB0_CTL,
3185                    ((obj->size - 4096) & RING_NR_PAGES) |
3186                    RING_NO_REPORT |
3187                    RING_VALID);
3188
3189         head = I915_READ(PRB0_HEAD) & HEAD_ADDR;
3190
3191         /* If the head is still not zero, the ring is dead */
3192         if (head != 0) {
3193                 DRM_ERROR("Ring initialization failed "
3194                           "ctl %08x head %08x tail %08x start %08x\n",
3195                           I915_READ(PRB0_CTL),
3196                           I915_READ(PRB0_HEAD),
3197                           I915_READ(PRB0_TAIL),
3198                           I915_READ(PRB0_START));
3199                 return -EIO;
3200         }
3201
3202         /* Update our cache of the ring state */
3203         if (!drm_core_check_feature(dev, DRIVER_MODESET))
3204                 i915_kernel_lost_context(dev);
3205         else {
3206                 ring->head = I915_READ(PRB0_HEAD) & HEAD_ADDR;
3207                 ring->tail = I915_READ(PRB0_TAIL) & TAIL_ADDR;
3208                 ring->space = ring->head - (ring->tail + 8);
3209                 if (ring->space < 0)
3210                         ring->space += ring->Size;
3211         }
3212
3213         return 0;
3214 }
3215
3216 void
3217 i915_gem_cleanup_ringbuffer(struct drm_device *dev)
3218 {
3219         drm_i915_private_t *dev_priv = dev->dev_private;
3220
3221         if (dev_priv->ring.ring_obj == NULL)
3222                 return;
3223
3224         drm_core_ioremapfree(&dev_priv->ring.map, dev);
3225
3226         i915_gem_object_unpin(dev_priv->ring.ring_obj);
3227         drm_gem_object_unreference(dev_priv->ring.ring_obj);
3228         dev_priv->ring.ring_obj = NULL;
3229         memset(&dev_priv->ring, 0, sizeof(dev_priv->ring));
3230
3231         if (dev_priv->hws_obj != NULL) {
3232                 struct drm_gem_object *obj = dev_priv->hws_obj;
3233                 struct drm_i915_gem_object *obj_priv = obj->driver_private;
3234
3235                 kunmap(obj_priv->page_list[0]);
3236                 i915_gem_object_unpin(obj);
3237                 drm_gem_object_unreference(obj);
3238                 dev_priv->hws_obj = NULL;
3239                 memset(&dev_priv->hws_map, 0, sizeof(dev_priv->hws_map));
3240                 dev_priv->hw_status_page = NULL;
3241
3242                 /* Write high address into HWS_PGA when disabling. */
3243                 I915_WRITE(HWS_PGA, 0x1ffff000);
3244         }
3245 }
3246
3247 int
3248 i915_gem_entervt_ioctl(struct drm_device *dev, void *data,
3249                        struct drm_file *file_priv)
3250 {
3251         drm_i915_private_t *dev_priv = dev->dev_private;
3252         int ret;
3253
3254         if (drm_core_check_feature(dev, DRIVER_MODESET))
3255                 return 0;
3256
3257         if (dev_priv->mm.wedged) {
3258                 DRM_ERROR("Reenabling wedged hardware, good luck\n");
3259                 dev_priv->mm.wedged = 0;
3260         }
3261
3262         mutex_lock(&dev->struct_mutex);
3263         dev_priv->mm.suspended = 0;
3264
3265         ret = i915_gem_init_ringbuffer(dev);
3266         if (ret != 0)
3267                 return ret;
3268
3269         BUG_ON(!list_empty(&dev_priv->mm.active_list));
3270         BUG_ON(!list_empty(&dev_priv->mm.flushing_list));
3271         BUG_ON(!list_empty(&dev_priv->mm.inactive_list));
3272         BUG_ON(!list_empty(&dev_priv->mm.request_list));
3273         mutex_unlock(&dev->struct_mutex);
3274
3275         drm_irq_install(dev);
3276
3277         return 0;
3278 }
3279
3280 int
3281 i915_gem_leavevt_ioctl(struct drm_device *dev, void *data,
3282                        struct drm_file *file_priv)
3283 {
3284         int ret;
3285
3286         if (drm_core_check_feature(dev, DRIVER_MODESET))
3287                 return 0;
3288
3289         ret = i915_gem_idle(dev);
3290         drm_irq_uninstall(dev);
3291
3292         return ret;
3293 }
3294
3295 void
3296 i915_gem_lastclose(struct drm_device *dev)
3297 {
3298         int ret;
3299
3300         if (drm_core_check_feature(dev, DRIVER_MODESET))
3301                 return;
3302
3303         ret = i915_gem_idle(dev);
3304         if (ret)
3305                 DRM_ERROR("failed to idle hardware: %d\n", ret);
3306 }
3307
3308 void
3309 i915_gem_load(struct drm_device *dev)
3310 {
3311         drm_i915_private_t *dev_priv = dev->dev_private;
3312
3313         INIT_LIST_HEAD(&dev_priv->mm.active_list);
3314         INIT_LIST_HEAD(&dev_priv->mm.flushing_list);
3315         INIT_LIST_HEAD(&dev_priv->mm.inactive_list);
3316         INIT_LIST_HEAD(&dev_priv->mm.request_list);
3317         INIT_DELAYED_WORK(&dev_priv->mm.retire_work,
3318                           i915_gem_retire_work_handler);
3319         dev_priv->mm.next_gem_seqno = 1;
3320
3321         /* Old X drivers will take 0-2 for front, back, depth buffers */
3322         dev_priv->fence_reg_start = 3;
3323
3324         if (IS_I965G(dev) || IS_I945G(dev) || IS_I945GM(dev) || IS_G33(dev))
3325                 dev_priv->num_fence_regs = 16;
3326         else
3327                 dev_priv->num_fence_regs = 8;
3328
3329         i915_gem_detect_bit_6_swizzle(dev);
3330 }
3331
3332 /*
3333  * Create a physically contiguous memory object for this object
3334  * e.g. for cursor + overlay regs
3335  */
3336 int i915_gem_init_phys_object(struct drm_device *dev,
3337                               int id, int size)
3338 {
3339         drm_i915_private_t *dev_priv = dev->dev_private;
3340         struct drm_i915_gem_phys_object *phys_obj;
3341         int ret;
3342
3343         if (dev_priv->mm.phys_objs[id - 1] || !size)
3344                 return 0;
3345
3346         phys_obj = drm_calloc(1, sizeof(struct drm_i915_gem_phys_object), DRM_MEM_DRIVER);
3347         if (!phys_obj)
3348                 return -ENOMEM;
3349
3350         phys_obj->id = id;
3351
3352         phys_obj->handle = drm_pci_alloc(dev, size, 0, 0xffffffff);
3353         if (!phys_obj->handle) {
3354                 ret = -ENOMEM;
3355                 goto kfree_obj;
3356         }
3357 #ifdef CONFIG_X86
3358         set_memory_wc((unsigned long)phys_obj->handle->vaddr, phys_obj->handle->size / PAGE_SIZE);
3359 #endif
3360
3361         dev_priv->mm.phys_objs[id - 1] = phys_obj;
3362
3363         return 0;
3364 kfree_obj:
3365         drm_free(phys_obj, sizeof(struct drm_i915_gem_phys_object), DRM_MEM_DRIVER);
3366         return ret;
3367 }
3368
3369 void i915_gem_free_phys_object(struct drm_device *dev, int id)
3370 {
3371         drm_i915_private_t *dev_priv = dev->dev_private;
3372         struct drm_i915_gem_phys_object *phys_obj;
3373
3374         if (!dev_priv->mm.phys_objs[id - 1])
3375                 return;
3376
3377         phys_obj = dev_priv->mm.phys_objs[id - 1];
3378         if (phys_obj->cur_obj) {
3379                 i915_gem_detach_phys_object(dev, phys_obj->cur_obj);
3380         }
3381
3382 #ifdef CONFIG_X86
3383         set_memory_wb((unsigned long)phys_obj->handle->vaddr, phys_obj->handle->size / PAGE_SIZE);
3384 #endif
3385         drm_pci_free(dev, phys_obj->handle);
3386         kfree(phys_obj);
3387         dev_priv->mm.phys_objs[id - 1] = NULL;
3388 }
3389
3390 void i915_gem_free_all_phys_object(struct drm_device *dev)
3391 {
3392         int i;
3393
3394         for (i = I915_GEM_PHYS_CURSOR_0; i <= I915_MAX_PHYS_OBJECT; i++)
3395                 i915_gem_free_phys_object(dev, i);
3396 }
3397
3398 void i915_gem_detach_phys_object(struct drm_device *dev,
3399                                  struct drm_gem_object *obj)
3400 {
3401         struct drm_i915_gem_object *obj_priv;
3402         int i;
3403         int ret;
3404         int page_count;
3405
3406         obj_priv = obj->driver_private;
3407         if (!obj_priv->phys_obj)
3408                 return;
3409
3410         ret = i915_gem_object_get_page_list(obj);
3411         if (ret)
3412                 goto out;
3413
3414         page_count = obj->size / PAGE_SIZE;
3415
3416         for (i = 0; i < page_count; i++) {
3417                 char *dst = kmap_atomic(obj_priv->page_list[i], KM_USER0);
3418                 char *src = obj_priv->phys_obj->handle->vaddr + (i * PAGE_SIZE);
3419
3420                 memcpy(dst, src, PAGE_SIZE);
3421                 kunmap_atomic(dst, KM_USER0);
3422         }
3423         drm_clflush_pages(obj_priv->page_list, page_count);
3424         drm_agp_chipset_flush(dev);
3425 out:
3426         obj_priv->phys_obj->cur_obj = NULL;
3427         obj_priv->phys_obj = NULL;
3428 }
3429
3430 int
3431 i915_gem_attach_phys_object(struct drm_device *dev,
3432                             struct drm_gem_object *obj, int id)
3433 {
3434         drm_i915_private_t *dev_priv = dev->dev_private;
3435         struct drm_i915_gem_object *obj_priv;
3436         int ret = 0;
3437         int page_count;
3438         int i;
3439
3440         if (id > I915_MAX_PHYS_OBJECT)
3441                 return -EINVAL;
3442
3443         obj_priv = obj->driver_private;
3444
3445         if (obj_priv->phys_obj) {
3446                 if (obj_priv->phys_obj->id == id)
3447                         return 0;
3448                 i915_gem_detach_phys_object(dev, obj);
3449         }
3450
3451
3452         /* create a new object */
3453         if (!dev_priv->mm.phys_objs[id - 1]) {
3454                 ret = i915_gem_init_phys_object(dev, id,
3455                                                 obj->size);
3456                 if (ret) {
3457                         DRM_ERROR("failed to init phys object %d size: %zu\n", id, obj->size);
3458                         goto out;
3459                 }
3460         }
3461
3462         /* bind to the object */
3463         obj_priv->phys_obj = dev_priv->mm.phys_objs[id - 1];
3464         obj_priv->phys_obj->cur_obj = obj;
3465
3466         ret = i915_gem_object_get_page_list(obj);
3467         if (ret) {
3468                 DRM_ERROR("failed to get page list\n");
3469                 goto out;
3470         }
3471
3472         page_count = obj->size / PAGE_SIZE;
3473
3474         for (i = 0; i < page_count; i++) {
3475                 char *src = kmap_atomic(obj_priv->page_list[i], KM_USER0);
3476                 char *dst = obj_priv->phys_obj->handle->vaddr + (i * PAGE_SIZE);
3477
3478                 memcpy(dst, src, PAGE_SIZE);
3479                 kunmap_atomic(src, KM_USER0);
3480         }
3481
3482         return 0;
3483 out:
3484         return ret;
3485 }
3486
3487 static int
3488 i915_gem_phys_pwrite(struct drm_device *dev, struct drm_gem_object *obj,
3489                      struct drm_i915_gem_pwrite *args,
3490                      struct drm_file *file_priv)
3491 {
3492         struct drm_i915_gem_object *obj_priv = obj->driver_private;
3493         void *obj_addr;
3494         int ret;
3495         char __user *user_data;
3496
3497         user_data = (char __user *) (uintptr_t) args->data_ptr;
3498         obj_addr = obj_priv->phys_obj->handle->vaddr + args->offset;
3499
3500         DRM_ERROR("obj_addr %p, %lld\n", obj_addr, args->size);
3501         ret = copy_from_user(obj_addr, user_data, args->size);
3502         if (ret)
3503                 return -EFAULT;
3504
3505         drm_agp_chipset_flush(dev);
3506         return 0;
3507 }