drivers/gpu/drm/i915/i915_gem.c

   1 /*
   2  * Copyright © 2008-2015 Intel Corporation
   3  *
   4  * Permission is hereby granted, free of charge, to any person obtaining a
   5  * copy of this software and associated documentation files (the "Software"),
   6  * to deal in the Software without restriction, including without limitation
   7  * the rights to use, copy, modify, merge, publish, distribute, sublicense,
   8  * and/or sell copies of the Software, and to permit persons to whom the
   9  * Software is furnished to do so, subject to the following conditions:
  10  *
  11  * The above copyright notice and this permission notice (including the next
  12  * paragraph) shall be included in all copies or substantial portions of the
  13  * Software.
  14  *
  15  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  16  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  17  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
  18  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
  19  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
  20  * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
  21  * IN THE SOFTWARE.
  22  *
  23  * Authors:
  24  *    Eric Anholt <eric@anholt.net>
  25  *
  26  */
  27
  28 #include <drm/drmP.h>
  29 #include <drm/drm_vma_manager.h>
  30 #include <drm/i915_drm.h>
  31 #include "i915_drv.h"
  32 #include "i915_vgpu.h"
  33 #include "i915_trace.h"
  34 #include "intel_drv.h"
  35 #include <linux/shmem_fs.h>
  36 #include <linux/slab.h>
  37 #include <linux/swap.h>
  38 #include <linux/pci.h>
  39 #include <linux/dma-buf.h>
  40
  41 static void i915_gem_object_flush_gtt_write_domain(struct drm_i915_gem_object *obj);
  42 static void i915_gem_object_flush_cpu_write_domain(struct drm_i915_gem_object *obj);
  43 static __must_check int
  44 i915_gem_object_wait_rendering(struct drm_i915_gem_object *obj,
  45                                bool readonly);
  46 static void
  47 i915_gem_object_retire(struct drm_i915_gem_object *obj);
  48
  49 static void i915_gem_write_fence(struct drm_device *dev, int reg,
  50                                  struct drm_i915_gem_object *obj);
  51 static void i915_gem_object_update_fence(struct drm_i915_gem_object *obj,
  52                                          struct drm_i915_fence_reg *fence,
  53                                          bool enable);
  54
  55 static bool cpu_cache_is_coherent(struct drm_device *dev,
  56                                   enum i915_cache_level level)
  57 {
  58         return HAS_LLC(dev) || level != I915_CACHE_NONE;
  59 }
  60
  61 static bool cpu_write_needs_clflush(struct drm_i915_gem_object *obj)
  62 {
  63         if (!cpu_cache_is_coherent(obj->base.dev, obj->cache_level))
  64                 return true;
  65
  66         return obj->pin_display;
  67 }
  68
  69 static inline void i915_gem_object_fence_lost(struct drm_i915_gem_object *obj)
  70 {
  71         if (obj->tiling_mode)
  72                 i915_gem_release_mmap(obj);
  73
  74         /* As we do not have an associated fence register, we will force
  75          * a tiling change if we ever need to acquire one.
  76          */
  77         obj->fence_dirty = false;
  78         obj->fence_reg = I915_FENCE_REG_NONE;
  79 }
  80
  81 /* some bookkeeping */
  82 static void i915_gem_info_add_obj(struct drm_i915_private *dev_priv,
  83                                   size_t size)
  84 {
  85         spin_lock(&dev_priv->mm.object_stat_lock);
  86         dev_priv->mm.object_count++;
  87         dev_priv->mm.object_memory += size;
  88         spin_unlock(&dev_priv->mm.object_stat_lock);
  89 }
  90
  91 static void i915_gem_info_remove_obj(struct drm_i915_private *dev_priv,
  92                                      size_t size)
  93 {
  94         spin_lock(&dev_priv->mm.object_stat_lock);
  95         dev_priv->mm.object_count--;
  96         dev_priv->mm.object_memory -= size;
  97         spin_unlock(&dev_priv->mm.object_stat_lock);
  98 }
  99
 100 static int
 101 i915_gem_wait_for_error(struct i915_gpu_error *error)
 102 {
 103         int ret;
 104
 105 #define EXIT_COND (!i915_reset_in_progress(error) || \
 106                    i915_terminally_wedged(error))
 107         if (EXIT_COND)
 108                 return 0;
 109
 110         /*
 111          * Only wait 10 seconds for the gpu reset to complete to avoid hanging
 112          * userspace. If it takes that long something really bad is going on and
 113          * we should simply try to bail out and fail as gracefully as possible.
 114          */
 115         ret = wait_event_interruptible_timeout(error->reset_queue,
 116                                                EXIT_COND,
 117                                                10*HZ);
 118         if (ret == 0) {
 119                 DRM_ERROR("Timed out waiting for the gpu reset to complete\n");
 120                 return -EIO;
 121         } else if (ret < 0) {
 122                 return ret;
 123         }
 124 #undef EXIT_COND
 125
 126         return 0;
 127 }
 128
 129 int i915_mutex_lock_interruptible(struct drm_device *dev)
 130 {
 131         struct drm_i915_private *dev_priv = dev->dev_private;
 132         int ret;
 133
 134         ret = i915_gem_wait_for_error(&dev_priv->gpu_error);
 135         if (ret)
 136                 return ret;
 137
 138         ret = mutex_lock_interruptible(&dev->struct_mutex);
 139         if (ret)
 140                 return ret;
 141
 142         WARN_ON(i915_verify_lists(dev));
 143         return 0;
 144 }
 145
 146 int
 147 i915_gem_get_aperture_ioctl(struct drm_device *dev, void *data,
 148                             struct drm_file *file)
 149 {
 150         struct drm_i915_private *dev_priv = dev->dev_private;
 151         struct drm_i915_gem_get_aperture *args = data;
 152         struct drm_i915_gem_object *obj;
 153         size_t pinned;
 154
 155         pinned = 0;
 156         mutex_lock(&dev->struct_mutex);
 157         list_for_each_entry(obj, &dev_priv->mm.bound_list, global_list)
 158                 if (i915_gem_obj_is_pinned(obj))
 159                         pinned += i915_gem_obj_ggtt_size(obj);
 160         mutex_unlock(&dev->struct_mutex);
 161
 162         args->aper_size = dev_priv->gtt.base.total;
 163         args->aper_available_size = args->aper_size - pinned;
 164
 165         return 0;
 166 }
 167
 168 static int
 169 i915_gem_object_get_pages_phys(struct drm_i915_gem_object *obj)
 170 {
 171         struct address_space *mapping = file_inode(obj->base.filp)->i_mapping;
 172         char *vaddr = obj->phys_handle->vaddr;
 173         struct sg_table *st;
 174         struct scatterlist *sg;
 175         int i;
 176
 177         if (WARN_ON(i915_gem_object_needs_bit17_swizzle(obj)))
 178                 return -EINVAL;
 179
 180         for (i = 0; i < obj->base.size / PAGE_SIZE; i++) {
 181                 struct page *page;
 182                 char *src;
 183
 184                 page = shmem_read_mapping_page(mapping, i);
 185                 if (IS_ERR(page))
 186                         return PTR_ERR(page);
 187
 188                 src = kmap_atomic(page);
 189                 memcpy(vaddr, src, PAGE_SIZE);
 190                 drm_clflush_virt_range(vaddr, PAGE_SIZE);
 191                 kunmap_atomic(src);
 192
 193                 page_cache_release(page);
 194                 vaddr += PAGE_SIZE;
 195         }
 196
 197         i915_gem_chipset_flush(obj->base.dev);
 198
 199         st = kmalloc(sizeof(*st), GFP_KERNEL);
 200         if (st == NULL)
 201                 return -ENOMEM;
 202
 203         if (sg_alloc_table(st, 1, GFP_KERNEL)) {
 204                 kfree(st);
 205                 return -ENOMEM;
 206         }
 207
 208         sg = st->sgl;
 209         sg->offset = 0;
 210         sg->length = obj->base.size;
 211
 212         sg_dma_address(sg) = obj->phys_handle->busaddr;
 213         sg_dma_len(sg) = obj->base.size;
 214
 215         obj->pages = st;
 216         obj->has_dma_mapping = true;
 217         return 0;
 218 }
 219
 220 static void
 221 i915_gem_object_put_pages_phys(struct drm_i915_gem_object *obj)
 222 {
 223         int ret;
 224
 225         BUG_ON(obj->madv == __I915_MADV_PURGED);
 226
 227         ret = i915_gem_object_set_to_cpu_domain(obj, true);
 228         if (ret) {
 229                 /* In the event of a disaster, abandon all caches and
 230                  * hope for the best.
 231                  */
 232                 WARN_ON(ret != -EIO);
 233                 obj->base.read_domains = obj->base.write_domain = I915_GEM_DOMAIN_CPU;
 234         }
 235
 236         if (obj->madv == I915_MADV_DONTNEED)
 237                 obj->dirty = 0;
 238
 239         if (obj->dirty) {
 240                 struct address_space *mapping = file_inode(obj->base.filp)->i_mapping;
 241                 char *vaddr = obj->phys_handle->vaddr;
 242                 int i;
 243
 244                 for (i = 0; i < obj->base.size / PAGE_SIZE; i++) {
 245                         struct page *page;
 246                         char *dst;
 247
 248                         page = shmem_read_mapping_page(mapping, i);
 249                         if (IS_ERR(page))
 250                                 continue;
 251
 252                         dst = kmap_atomic(page);
 253                         drm_clflush_virt_range(vaddr, PAGE_SIZE);
 254                         memcpy(dst, vaddr, PAGE_SIZE);
 255                         kunmap_atomic(dst);
 256
 257                         set_page_dirty(page);
 258                         if (obj->madv == I915_MADV_WILLNEED)
 259                                 mark_page_accessed(page);
 260                         page_cache_release(page);
 261                         vaddr += PAGE_SIZE;
 262                 }
 263                 obj->dirty = 0;
 264         }
 265
 266         sg_free_table(obj->pages);
 267         kfree(obj->pages);
 268
 269         obj->has_dma_mapping = false;
 270 }
 271
 272 static void
 273 i915_gem_object_release_phys(struct drm_i915_gem_object *obj)
 274 {
 275         drm_pci_free(obj->base.dev, obj->phys_handle);
 276 }
 277
 278 static const struct drm_i915_gem_object_ops i915_gem_phys_ops = {
 279         .get_pages = i915_gem_object_get_pages_phys,
 280         .put_pages = i915_gem_object_put_pages_phys,
 281         .release = i915_gem_object_release_phys,
 282 };
 283
 284 static int
 285 drop_pages(struct drm_i915_gem_object *obj)
 286 {
 287         struct i915_vma *vma, *next;
 288         int ret;
 289
 290         drm_gem_object_reference(&obj->base);
 291         list_for_each_entry_safe(vma, next, &obj->vma_list, vma_link)
 292                 if (i915_vma_unbind(vma))
 293                         break;
 294
 295         ret = i915_gem_object_put_pages(obj);
 296         drm_gem_object_unreference(&obj->base);
 297
 298         return ret;
 299 }
 300
 301 int
 302 i915_gem_object_attach_phys(struct drm_i915_gem_object *obj,
 303                             int align)
 304 {
 305         drm_dma_handle_t *phys;
 306         int ret;
 307
 308         if (obj->phys_handle) {
 309                 if ((unsigned long)obj->phys_handle->vaddr & (align -1))
 310                         return -EBUSY;
 311
 312                 return 0;
 313         }
 314
 315         if (obj->madv != I915_MADV_WILLNEED)
 316                 return -EFAULT;
 317
 318         if (obj->base.filp == NULL)
 319                 return -EINVAL;
 320
 321         ret = drop_pages(obj);
 322         if (ret)
 323                 return ret;
 324
 325         /* create a new object */
 326         phys = drm_pci_alloc(obj->base.dev, obj->base.size, align);
 327         if (!phys)
 328                 return -ENOMEM;
 329
 330         obj->phys_handle = phys;
 331         obj->ops = &i915_gem_phys_ops;
 332
 333         return i915_gem_object_get_pages(obj);
 334 }
 335
 336 static int
 337 i915_gem_phys_pwrite(struct drm_i915_gem_object *obj,
 338                      struct drm_i915_gem_pwrite *args,
 339                      struct drm_file *file_priv)
 340 {
 341         struct drm_device *dev = obj->base.dev;
 342         void *vaddr = obj->phys_handle->vaddr + args->offset;
 343         char __user *user_data = to_user_ptr(args->data_ptr);
 344         int ret = 0;
 345
 346         /* We manually control the domain here and pretend that it
 347          * remains coherent i.e. in the GTT domain, like shmem_pwrite.
 348          */
 349         ret = i915_gem_object_wait_rendering(obj, false);
 350         if (ret)
 351                 return ret;
 352
 353         intel_fb_obj_invalidate(obj, NULL, ORIGIN_CPU);
 354         if (__copy_from_user_inatomic_nocache(vaddr, user_data, args->size)) {
 355                 unsigned long unwritten;
 356
 357                 /* The physical object once assigned is fixed for the lifetime
 358                  * of the obj, so we can safely drop the lock and continue
 359                  * to access vaddr.
 360                  */
 361                 mutex_unlock(&dev->struct_mutex);
 362                 unwritten = copy_from_user(vaddr, user_data, args->size);
 363                 mutex_lock(&dev->struct_mutex);
 364                 if (unwritten) {
 365                         ret = -EFAULT;
 366                         goto out;
 367                 }
 368         }
 369
 370         drm_clflush_virt_range(vaddr, args->size);
 371         i915_gem_chipset_flush(dev);
 372
 373 out:
 374         intel_fb_obj_flush(obj, false);
 375         return ret;
 376 }
 377
 378 void *i915_gem_object_alloc(struct drm_device *dev)
 379 {
 380         struct drm_i915_private *dev_priv = dev->dev_private;
 381         return kmem_cache_zalloc(dev_priv->objects, GFP_KERNEL);
 382 }
 383
 384 void i915_gem_object_free(struct drm_i915_gem_object *obj)
 385 {
 386         struct drm_i915_private *dev_priv = obj->base.dev->dev_private;
 387         kmem_cache_free(dev_priv->objects, obj);
 388 }
 389
 390 static int
 391 i915_gem_create(struct drm_file *file,
 392                 struct drm_device *dev,
 393                 uint64_t size,
 394                 uint32_t *handle_p)
 395 {
 396         struct drm_i915_gem_object *obj;
 397         int ret;
 398         u32 handle;
 399
 400         size = roundup(size, PAGE_SIZE);
 401         if (size == 0)
 402                 return -EINVAL;
 403
 404         /* Allocate the new object */
 405         obj = i915_gem_alloc_object(dev, size);
 406         if (obj == NULL)
 407                 return -ENOMEM;
 408
 409         ret = drm_gem_handle_create(file, &obj->base, &handle);
 410         /* drop reference from allocate - handle holds it now */
 411         drm_gem_object_unreference_unlocked(&obj->base);
 412         if (ret)
 413                 return ret;
 414
 415         *handle_p = handle;
 416         return 0;
 417 }
 418
 419 int
 420 i915_gem_dumb_create(struct drm_file *file,
 421                      struct drm_device *dev,
 422                      struct drm_mode_create_dumb *args)
 423 {
 424         /* have to work out size/pitch and return them */
 425         args->pitch = ALIGN(args->width * DIV_ROUND_UP(args->bpp, 8), 64);
 426         args->size = args->pitch * args->height;
 427         return i915_gem_create(file, dev,
 428                                args->size, &args->handle);
 429 }
 430
 431 /**
 432  * Creates a new mm object and returns a handle to it.
 433  */
 434 int
 435 i915_gem_create_ioctl(struct drm_device *dev, void *data,
 436                       struct drm_file *file)
 437 {
 438         struct drm_i915_gem_create *args = data;
 439
 440         return i915_gem_create(file, dev,
 441                                args->size, &args->handle);
 442 }
 443
 444 static inline int
 445 __copy_to_user_swizzled(char __user *cpu_vaddr,
 446                         const char *gpu_vaddr, int gpu_offset,
 447                         int length)
 448 {
 449         int ret, cpu_offset = 0;
 450
 451         while (length > 0) {
 452                 int cacheline_end = ALIGN(gpu_offset + 1, 64);
 453                 int this_length = min(cacheline_end - gpu_offset, length);
 454                 int swizzled_gpu_offset = gpu_offset ^ 64;
 455
 456                 ret = __copy_to_user(cpu_vaddr + cpu_offset,
 457                                      gpu_vaddr + swizzled_gpu_offset,
 458                                      this_length);
 459                 if (ret)
 460                         return ret + length;
 461
 462                 cpu_offset += this_length;
 463                 gpu_offset += this_length;
 464                 length -= this_length;
 465         }
 466
 467         return 0;
 468 }
 469
 470 static inline int
 471 __copy_from_user_swizzled(char *gpu_vaddr, int gpu_offset,
 472                           const char __user *cpu_vaddr,
 473                           int length)
 474 {
 475         int ret, cpu_offset = 0;
 476
 477         while (length > 0) {
 478                 int cacheline_end = ALIGN(gpu_offset + 1, 64);
 479                 int this_length = min(cacheline_end - gpu_offset, length);
 480                 int swizzled_gpu_offset = gpu_offset ^ 64;
 481
 482                 ret = __copy_from_user(gpu_vaddr + swizzled_gpu_offset,
 483                                        cpu_vaddr + cpu_offset,
 484                                        this_length);
 485                 if (ret)
 486                         return ret + length;
 487
 488                 cpu_offset += this_length;
 489                 gpu_offset += this_length;
 490                 length -= this_length;
 491         }
 492
 493         return 0;
 494 }
 495
 496 /*
 497  * Pins the specified object's pages and synchronizes the object with
 498  * GPU accesses. Sets needs_clflush to non-zero if the caller should
 499  * flush the object from the CPU cache.
 500  */
 501 int i915_gem_obj_prepare_shmem_read(struct drm_i915_gem_object *obj,
 502                                     int *needs_clflush)
 503 {
 504         int ret;
 505
 506         *needs_clflush = 0;
 507
 508         if (!obj->base.filp)
 509                 return -EINVAL;
 510
 511         if (!(obj->base.read_domains & I915_GEM_DOMAIN_CPU)) {
 512                 /* If we're not in the cpu read domain, set ourself into the gtt
 513                  * read domain and manually flush cachelines (if required). This
 514                  * optimizes for the case when the gpu will dirty the data
 515                  * anyway again before the next pread happens. */
 516                 *needs_clflush = !cpu_cache_is_coherent(obj->base.dev,
 517                                                         obj->cache_level);
 518                 ret = i915_gem_object_wait_rendering(obj, true);
 519                 if (ret)
 520                         return ret;
 521
 522                 i915_gem_object_retire(obj);
 523         }
 524
 525         ret = i915_gem_object_get_pages(obj);
 526         if (ret)
 527                 return ret;
 528
 529         i915_gem_object_pin_pages(obj);
 530
 531         return ret;
 532 }
 533
 534 /* Per-page copy function for the shmem pread fastpath.
 535  * Flushes invalid cachelines before reading the target if
 536  * needs_clflush is set. */
 537 static int
 538 shmem_pread_fast(struct page *page, int shmem_page_offset, int page_length,
 539                  char __user *user_data,
 540                  bool page_do_bit17_swizzling, bool needs_clflush)
 541 {
 542         char *vaddr;
 543         int ret;
 544
 545         if (unlikely(page_do_bit17_swizzling))
 546                 return -EINVAL;
 547
 548         vaddr = kmap_atomic(page);
 549         if (needs_clflush)
 550                 drm_clflush_virt_range(vaddr + shmem_page_offset,
 551                                        page_length);
 552         ret = __copy_to_user_inatomic(user_data,
 553                                       vaddr + shmem_page_offset,
 554                                       page_length);
 555         kunmap_atomic(vaddr);
 556
 557         return ret ? -EFAULT : 0;
 558 }
 559
 560 static void
 561 shmem_clflush_swizzled_range(char *addr, unsigned long length,
 562                              bool swizzled)
 563 {
 564         if (unlikely(swizzled)) {
 565                 unsigned long start = (unsigned long) addr;
 566                 unsigned long end = (unsigned long) addr + length;
 567
 568                 /* For swizzling simply ensure that we always flush both
 569                  * channels. Lame, but simple and it works. Swizzled
 570                  * pwrite/pread is far from a hotpath - current userspace
 571                  * doesn't use it at all. */
 572                 start = round_down(start, 128);
 573                 end = round_up(end, 128);
 574
 575                 drm_clflush_virt_range((void *)start, end - start);
 576         } else {
 577                 drm_clflush_virt_range(addr, length);
 578         }
 579
 580 }
 581
 582 /* Only difference to the fast-path function is that this can handle bit17
 583  * and uses non-atomic copy and kmap functions. */
 584 static int
 585 shmem_pread_slow(struct page *page, int shmem_page_offset, int page_length,
 586                  char __user *user_data,
 587                  bool page_do_bit17_swizzling, bool needs_clflush)
 588 {
 589         char *vaddr;
 590         int ret;
 591
 592         vaddr = kmap(page);
 593         if (needs_clflush)
 594                 shmem_clflush_swizzled_range(vaddr + shmem_page_offset,
 595                                              page_length,
 596                                              page_do_bit17_swizzling);
 597
 598         if (page_do_bit17_swizzling)
 599                 ret = __copy_to_user_swizzled(user_data,
 600                                               vaddr, shmem_page_offset,
 601                                               page_length);
 602         else
 603                 ret = __copy_to_user(user_data,
 604                                      vaddr + shmem_page_offset,
 605                                      page_length);
 606         kunmap(page);
 607
 608         return ret ? - EFAULT : 0;
 609 }
 610
 611 static int
 612 i915_gem_shmem_pread(struct drm_device *dev,
 613                      struct drm_i915_gem_object *obj,
 614                      struct drm_i915_gem_pread *args,
 615                      struct drm_file *file)
 616 {
 617         char __user *user_data;
 618         ssize_t remain;
 619         loff_t offset;
 620         int shmem_page_offset, page_length, ret = 0;
 621         int obj_do_bit17_swizzling, page_do_bit17_swizzling;
 622         int prefaulted = 0;
 623         int needs_clflush = 0;
 624         struct sg_page_iter sg_iter;
 625
 626         user_data = to_user_ptr(args->data_ptr);
 627         remain = args->size;
 628
 629         obj_do_bit17_swizzling = i915_gem_object_needs_bit17_swizzle(obj);
 630
 631         ret = i915_gem_obj_prepare_shmem_read(obj, &needs_clflush);
 632         if (ret)
 633                 return ret;
 634
 635         offset = args->offset;
 636
 637         for_each_sg_page(obj->pages->sgl, &sg_iter, obj->pages->nents,
 638                          offset >> PAGE_SHIFT) {
 639                 struct page *page = sg_page_iter_page(&sg_iter);
 640
 641                 if (remain <= 0)
 642                         break;
 643
 644                 /* Operation in this page
 645                  *
 646                  * shmem_page_offset = offset within page in shmem file
 647                  * page_length = bytes to copy for this page
 648                  */
 649                 shmem_page_offset = offset_in_page(offset);
 650                 page_length = remain;
 651                 if ((shmem_page_offset + page_length) > PAGE_SIZE)
 652                         page_length = PAGE_SIZE - shmem_page_offset;
 653
 654                 page_do_bit17_swizzling = obj_do_bit17_swizzling &&
 655                         (page_to_phys(page) & (1 << 17)) != 0;
 656
 657                 ret = shmem_pread_fast(page, shmem_page_offset, page_length,
 658                                        user_data, page_do_bit17_swizzling,
 659                                        needs_clflush);
 660                 if (ret == 0)
 661                         goto next_page;
 662
 663                 mutex_unlock(&dev->struct_mutex);
 664
 665                 if (likely(!i915.prefault_disable) && !prefaulted) {
 666                         ret = fault_in_multipages_writeable(user_data, remain);
 667                         /* Userspace is tricking us, but we've already clobbered
 668                          * its pages with the prefault and promised to write the
 669                          * data up to the first fault. Hence ignore any errors
 670                          * and just continue. */
 671                         (void)ret;
 672                         prefaulted = 1;
 673                 }
 674
 675                 ret = shmem_pread_slow(page, shmem_page_offset, page_length,
 676                                        user_data, page_do_bit17_swizzling,
 677                                        needs_clflush);
 678
 679                 mutex_lock(&dev->struct_mutex);
 680
 681                 if (ret)
 682                         goto out;
 683
 684 next_page:
 685                 remain -= page_length;
 686                 user_data += page_length;
 687                 offset += page_length;
 688         }
 689
 690 out:
 691         i915_gem_object_unpin_pages(obj);
 692
 693         return ret;
 694 }
 695
 696 /**
 697  * Reads data from the object referenced by handle.
 698  *
 699  * On error, the contents of *data are undefined.
 700  */
 701 int
 702 i915_gem_pread_ioctl(struct drm_device *dev, void *data,
 703                      struct drm_file *file)
 704 {
 705         struct drm_i915_gem_pread *args = data;
 706         struct drm_i915_gem_object *obj;
 707         int ret = 0;
 708
 709         if (args->size == 0)
 710                 return 0;
 711
 712         if (!access_ok(VERIFY_WRITE,
 713                        to_user_ptr(args->data_ptr),
 714                        args->size))
 715                 return -EFAULT;
 716
 717         ret = i915_mutex_lock_interruptible(dev);
 718         if (ret)
 719                 return ret;
 720
 721         obj = to_intel_bo(drm_gem_object_lookup(dev, file, args->handle));
 722         if (&obj->base == NULL) {
 723                 ret = -ENOENT;
 724                 goto unlock;
 725         }
 726
 727         /* Bounds check source.  */
 728         if (args->offset > obj->base.size ||
 729             args->size > obj->base.size - args->offset) {
 730                 ret = -EINVAL;
 731                 goto out;
 732         }
 733
 734         /* prime objects have no backing filp to GEM pread/pwrite
 735          * pages from.
 736          */
 737         if (!obj->base.filp) {
 738                 ret = -EINVAL;
 739                 goto out;
 740         }
 741
 742         trace_i915_gem_object_pread(obj, args->offset, args->size);
 743
 744         ret = i915_gem_shmem_pread(dev, obj, args, file);
 745
 746 out:
 747         drm_gem_object_unreference(&obj->base);
 748 unlock:
 749         mutex_unlock(&dev->struct_mutex);
 750         return ret;
 751 }
 752
 753 /* This is the fast write path which cannot handle
 754  * page faults in the source data
 755  */
 756
 757 static inline int
 758 fast_user_write(struct io_mapping *mapping,
 759                 loff_t page_base, int page_offset,
 760                 char __user *user_data,
 761                 int length)
 762 {
 763         void __iomem *vaddr_atomic;
 764         void *vaddr;
 765         unsigned long unwritten;
 766
 767         vaddr_atomic = io_mapping_map_atomic_wc(mapping, page_base);
 768         /* We can use the cpu mem copy function because this is X86. */
 769         vaddr = (void __force*)vaddr_atomic + page_offset;
 770         unwritten = __copy_from_user_inatomic_nocache(vaddr,
 771                                                       user_data, length);
 772         io_mapping_unmap_atomic(vaddr_atomic);
 773         return unwritten;
 774 }
 775
 776 /**
 777  * This is the fast pwrite path, where we copy the data directly from the
 778  * user into the GTT, uncached.
 779  */
 780 static int
 781 i915_gem_gtt_pwrite_fast(struct drm_device *dev,
 782                          struct drm_i915_gem_object *obj,
 783                          struct drm_i915_gem_pwrite *args,
 784                          struct drm_file *file)
 785 {
 786         struct drm_i915_private *dev_priv = dev->dev_private;
 787         ssize_t remain;
 788         loff_t offset, page_base;
 789         char __user *user_data;
 790         int page_offset, page_length, ret;
 791
 792         ret = i915_gem_obj_ggtt_pin(obj, 0, PIN_MAPPABLE | PIN_NONBLOCK);
 793         if (ret)
 794                 goto out;
 795
 796         ret = i915_gem_object_set_to_gtt_domain(obj, true);
 797         if (ret)
 798                 goto out_unpin;
 799
 800         ret = i915_gem_object_put_fence(obj);
 801         if (ret)
 802                 goto out_unpin;
 803
 804         user_data = to_user_ptr(args->data_ptr);
 805         remain = args->size;
 806
 807         offset = i915_gem_obj_ggtt_offset(obj) + args->offset;
 808
 809         intel_fb_obj_invalidate(obj, NULL, ORIGIN_GTT);
 810
 811         while (remain > 0) {
 812                 /* Operation in this page
 813                  *
 814                  * page_base = page offset within aperture
 815                  * page_offset = offset within page
 816                  * page_length = bytes to copy for this page
 817                  */
 818                 page_base = offset & PAGE_MASK;
 819                 page_offset = offset_in_page(offset);
 820                 page_length = remain;
 821                 if ((page_offset + remain) > PAGE_SIZE)
 822                         page_length = PAGE_SIZE - page_offset;
 823
 824                 /* If we get a fault while copying data, then (presumably) our
 825                  * source page isn't available.  Return the error and we'll
 826                  * retry in the slow path.
 827                  */
 828                 if (fast_user_write(dev_priv->gtt.mappable, page_base,
 829                                     page_offset, user_data, page_length)) {
 830                         ret = -EFAULT;
 831                         goto out_flush;
 832                 }
 833
 834                 remain -= page_length;
 835                 user_data += page_length;
 836                 offset += page_length;
 837         }
 838
 839 out_flush:
 840         intel_fb_obj_flush(obj, false);
 841 out_unpin:
 842         i915_gem_object_ggtt_unpin(obj);
 843 out:
 844         return ret;
 845 }
 846
 847 /* Per-page copy function for the shmem pwrite fastpath.
 848  * Flushes invalid cachelines before writing to the target if
 849  * needs_clflush_before is set and flushes out any written cachelines after
 850  * writing if needs_clflush is set. */
 851 static int
 852 shmem_pwrite_fast(struct page *page, int shmem_page_offset, int page_length,
 853                   char __user *user_data,
 854                   bool page_do_bit17_swizzling,
 855                   bool needs_clflush_before,
 856                   bool needs_clflush_after)
 857 {
 858         char *vaddr;
 859         int ret;
 860
 861         if (unlikely(page_do_bit17_swizzling))
 862                 return -EINVAL;
 863
 864         vaddr = kmap_atomic(page);
 865         if (needs_clflush_before)
 866                 drm_clflush_virt_range(vaddr + shmem_page_offset,
 867                                        page_length);
 868         ret = __copy_from_user_inatomic(vaddr + shmem_page_offset,
 869                                         user_data, page_length);
 870         if (needs_clflush_after)
 871                 drm_clflush_virt_range(vaddr + shmem_page_offset,
 872                                        page_length);
 873         kunmap_atomic(vaddr);
 874
 875         return ret ? -EFAULT : 0;
 876 }
 877
 878 /* Only difference to the fast-path function is that this can handle bit17
 879  * and uses non-atomic copy and kmap functions. */
 880 static int
 881 shmem_pwrite_slow(struct page *page, int shmem_page_offset, int page_length,
 882                   char __user *user_data,
 883                   bool page_do_bit17_swizzling,
 884                   bool needs_clflush_before,
 885                   bool needs_clflush_after)
 886 {
 887         char *vaddr;
 888         int ret;
 889
 890         vaddr = kmap(page);
 891         if (unlikely(needs_clflush_before || page_do_bit17_swizzling))
 892                 shmem_clflush_swizzled_range(vaddr + shmem_page_offset,
 893                                              page_length,
 894                                              page_do_bit17_swizzling);
 895         if (page_do_bit17_swizzling)
 896                 ret = __copy_from_user_swizzled(vaddr, shmem_page_offset,
 897                                                 user_data,
 898                                                 page_length);
 899         else
 900                 ret = __copy_from_user(vaddr + shmem_page_offset,
 901                                        user_data,
 902                                        page_length);
 903         if (needs_clflush_after)
 904                 shmem_clflush_swizzled_range(vaddr + shmem_page_offset,
 905                                              page_length,
 906                                              page_do_bit17_swizzling);
 907         kunmap(page);
 908
 909         return ret ? -EFAULT : 0;
 910 }
 911
 912 static int
 913 i915_gem_shmem_pwrite(struct drm_device *dev,
 914                       struct drm_i915_gem_object *obj,
 915                       struct drm_i915_gem_pwrite *args,
 916                       struct drm_file *file)
 917 {
 918         ssize_t remain;
 919         loff_t offset;
 920         char __user *user_data;
 921         int shmem_page_offset, page_length, ret = 0;
 922         int obj_do_bit17_swizzling, page_do_bit17_swizzling;
 923         int hit_slowpath = 0;
 924         int needs_clflush_after = 0;
 925         int needs_clflush_before = 0;
 926         struct sg_page_iter sg_iter;
 927
 928         user_data = to_user_ptr(args->data_ptr);
 929         remain = args->size;
 930
 931         obj_do_bit17_swizzling = i915_gem_object_needs_bit17_swizzle(obj);
 932
 933         if (obj->base.write_domain != I915_GEM_DOMAIN_CPU) {
 934                 /* If we're not in the cpu write domain, set ourself into the gtt
 935                  * write domain and manually flush cachelines (if required). This
 936                  * optimizes for the case when the gpu will use the data
 937                  * right away and we therefore have to clflush anyway. */
 938                 needs_clflush_after = cpu_write_needs_clflush(obj);
 939                 ret = i915_gem_object_wait_rendering(obj, false);
 940                 if (ret)
 941                         return ret;
 942
 943                 i915_gem_object_retire(obj);
 944         }
 945         /* Same trick applies to invalidate partially written cachelines read
 946          * before writing. */
 947         if ((obj->base.read_domains & I915_GEM_DOMAIN_CPU) == 0)
 948                 needs_clflush_before =
 949                         !cpu_cache_is_coherent(dev, obj->cache_level);
 950
 951         ret = i915_gem_object_get_pages(obj);
 952         if (ret)
 953                 return ret;
 954
 955         intel_fb_obj_invalidate(obj, NULL, ORIGIN_CPU);
 956
 957         i915_gem_object_pin_pages(obj);
 958
 959         offset = args->offset;
 960         obj->dirty = 1;
 961
 962         for_each_sg_page(obj->pages->sgl, &sg_iter, obj->pages->nents,
 963                          offset >> PAGE_SHIFT) {
 964                 struct page *page = sg_page_iter_page(&sg_iter);
 965                 int partial_cacheline_write;
 966
 967                 if (remain <= 0)
 968                         break;
 969
 970                 /* Operation in this page
 971                  *
 972                  * shmem_page_offset = offset within page in shmem file
 973                  * page_length = bytes to copy for this page
 974                  */
 975                 shmem_page_offset = offset_in_page(offset);
 976
 977                 page_length = remain;
 978                 if ((shmem_page_offset + page_length) > PAGE_SIZE)
 979                         page_length = PAGE_SIZE - shmem_page_offset;
 980
 981                 /* If we don't overwrite a cacheline completely we need to be
 982                  * careful to have up-to-date data by first clflushing. Don't
 983                  * overcomplicate things and flush the entire patch. */
 984                 partial_cacheline_write = needs_clflush_before &&
 985                         ((shmem_page_offset | page_length)
 986                                 & (boot_cpu_data.x86_clflush_size - 1));
 987
 988                 page_do_bit17_swizzling = obj_do_bit17_swizzling &&
 989                         (page_to_phys(page) & (1 << 17)) != 0;
 990
 991                 ret = shmem_pwrite_fast(page, shmem_page_offset, page_length,
 992                                         user_data, page_do_bit17_swizzling,
 993                                         partial_cacheline_write,
 994                                         needs_clflush_after);
 995                 if (ret == 0)
 996                         goto next_page;
 997
 998                 hit_slowpath = 1;
 999                 mutex_unlock(&dev->struct_mutex);
1000                 ret = shmem_pwrite_slow(page, shmem_page_offset, page_length,
1001                                         user_data, page_do_bit17_swizzling,
1002                                         partial_cacheline_write,
1003                                         needs_clflush_after);
1004
1005                 mutex_lock(&dev->struct_mutex);
1006
1007                 if (ret)
1008                         goto out;
1009
1010 next_page:
1011                 remain -= page_length;
1012                 user_data += page_length;
1013                 offset += page_length;
1014         }
1015
1016 out:
1017         i915_gem_object_unpin_pages(obj);
1018
1019         if (hit_slowpath) {
1020                 /*
1021                  * Fixup: Flush cpu caches in case we didn't flush the dirty
1022                  * cachelines in-line while writing and the object moved
1023                  * out of the cpu write domain while we've dropped the lock.
1024                  */
1025                 if (!needs_clflush_after &&
1026                     obj->base.write_domain != I915_GEM_DOMAIN_CPU) {
1027                         if (i915_gem_clflush_object(obj, obj->pin_display))
1028                                 i915_gem_chipset_flush(dev);
1029                 }
1030         }
1031
1032         if (needs_clflush_after)
1033                 i915_gem_chipset_flush(dev);
1034
1035         intel_fb_obj_flush(obj, false);
1036         return ret;
1037 }
1038
1039 /**
1040  * Writes data to the object referenced by handle.
1041  *
1042  * On error, the contents of the buffer that were to be modified are undefined.
1043  */
1044 int
1045 i915_gem_pwrite_ioctl(struct drm_device *dev, void *data,
1046                       struct drm_file *file)
1047 {
1048         struct drm_i915_private *dev_priv = dev->dev_private;
1049         struct drm_i915_gem_pwrite *args = data;
1050         struct drm_i915_gem_object *obj;
1051         int ret;
1052
1053         if (args->size == 0)
1054                 return 0;
1055
1056         if (!access_ok(VERIFY_READ,
1057                        to_user_ptr(args->data_ptr),
1058                        args->size))
1059                 return -EFAULT;
1060
1061         if (likely(!i915.prefault_disable)) {
1062                 ret = fault_in_multipages_readable(to_user_ptr(args->data_ptr),
1063                                                    args->size);
1064                 if (ret)
1065                         return -EFAULT;
1066         }
1067
1068         intel_runtime_pm_get(dev_priv);
1069
1070         ret = i915_mutex_lock_interruptible(dev);
1071         if (ret)
1072                 goto put_rpm;
1073
1074         obj = to_intel_bo(drm_gem_object_lookup(dev, file, args->handle));
1075         if (&obj->base == NULL) {
1076                 ret = -ENOENT;
1077                 goto unlock;
1078         }
1079
1080         /* Bounds check destination. */
1081         if (args->offset > obj->base.size ||
1082             args->size > obj->base.size - args->offset) {
1083                 ret = -EINVAL;
1084                 goto out;
1085         }
1086
1087         /* prime objects have no backing filp to GEM pread/pwrite
1088          * pages from.
1089          */
1090         if (!obj->base.filp) {
1091                 ret = -EINVAL;
1092                 goto out;
1093         }
1094
1095         trace_i915_gem_object_pwrite(obj, args->offset, args->size);
1096
1097         ret = -EFAULT;
1098         /* We can only do the GTT pwrite on untiled buffers, as otherwise
1099          * it would end up going through the fenced access, and we'll get
1100          * different detiling behavior between reading and writing.
1101          * pread/pwrite currently are reading and writing from the CPU
1102          * perspective, requiring manual detiling by the client.
1103          */
1104         if (obj->tiling_mode == I915_TILING_NONE &&
1105             obj->base.write_domain != I915_GEM_DOMAIN_CPU &&
1106             cpu_write_needs_clflush(obj)) {
1107                 ret = i915_gem_gtt_pwrite_fast(dev, obj, args, file);
1108                 /* Note that the gtt paths might fail with non-page-backed user
1109                  * pointers (e.g. gtt mappings when moving data between
1110                  * textures). Fallback to the shmem path in that case. */
1111         }
1112
1113         if (ret == -EFAULT || ret == -ENOSPC) {
1114                 if (obj->phys_handle)
1115                         ret = i915_gem_phys_pwrite(obj, args, file);
1116                 else
1117                         ret = i915_gem_shmem_pwrite(dev, obj, args, file);
1118         }
1119
1120 out:
1121         drm_gem_object_unreference(&obj->base);
1122 unlock:
1123         mutex_unlock(&dev->struct_mutex);
1124 put_rpm:
1125         intel_runtime_pm_put(dev_priv);
1126
1127         return ret;
1128 }
1129
1130 int
1131 i915_gem_check_wedge(struct i915_gpu_error *error,
1132                      bool interruptible)
1133 {
1134         if (i915_reset_in_progress(error)) {
1135                 /* Non-interruptible callers can't handle -EAGAIN, hence return
1136                  * -EIO unconditionally for these. */
1137                 if (!interruptible)
1138                         return -EIO;
1139
1140                 /* Recovery complete, but the reset failed ... */
1141                 if (i915_terminally_wedged(error))
1142                         return -EIO;
1143
1144                 /*
1145                  * Check if GPU Reset is in progress - we need intel_ring_begin
1146                  * to work properly to reinit the hw state while the gpu is
1147                  * still marked as reset-in-progress. Handle this with a flag.
1148                  */
1149                 if (!error->reload_in_reset)
1150                         return -EAGAIN;
1151         }
1152
1153         return 0;
1154 }
1155
1156 /*
1157  * Compare arbitrary request against outstanding lazy request. Emit on match.
1158  */
1159 int
1160 i915_gem_check_olr(struct drm_i915_gem_request *req)
1161 {
1162         int ret;
1163
1164         WARN_ON(!mutex_is_locked(&req->ring->dev->struct_mutex));
1165
1166         ret = 0;
1167         if (req == req->ring->outstanding_lazy_request)
1168                 ret = i915_add_request(req->ring);
1169
1170         return ret;
1171 }
1172
1173 static void fake_irq(unsigned long data)
1174 {
1175         wake_up_process((struct task_struct *)data);
1176 }
1177
1178 static bool missed_irq(struct drm_i915_private *dev_priv,
1179                        struct intel_engine_cs *ring)
1180 {
1181         return test_bit(ring->id, &dev_priv->gpu_error.missed_irq_rings);
1182 }
1183
1184 /**
1185  * __i915_wait_request - wait until execution of request has finished
1186  * @req: duh!
1187  * @reset_counter: reset sequence associated with the given request
1188  * @interruptible: do an interruptible wait (normally yes)
1189  * @timeout: in - how long to wait (NULL forever); out - how much time remaining
1190  *
1191  * Note: It is of utmost importance that the passed in seqno and reset_counter
1192  * values have been read by the caller in an smp safe manner. Where read-side
1193  * locks are involved, it is sufficient to read the reset_counter before
1194  * unlocking the lock that protects the seqno. For lockless tricks, the
1195  * reset_counter _must_ be read before, and an appropriate smp_rmb must be
1196  * inserted.
1197  *
1198  * Returns 0 if the request was found within the alloted time. Else returns the
1199  * errno with remaining time filled in timeout argument.
1200  */
1201 int __i915_wait_request(struct drm_i915_gem_request *req,
1202                         unsigned reset_counter,
1203                         bool interruptible,
1204                         s64 *timeout,
1205                         struct drm_i915_file_private *file_priv)
1206 {
1207         struct intel_engine_cs *ring = i915_gem_request_get_ring(req);
1208         struct drm_device *dev = ring->dev;
1209         struct drm_i915_private *dev_priv = dev->dev_private;
1210         const bool irq_test_in_progress =
1211                 ACCESS_ONCE(dev_priv->gpu_error.test_irq_rings) & intel_ring_flag(ring);
1212         DEFINE_WAIT(wait);
1213         unsigned long timeout_expire;
1214         s64 before, now;
1215         int ret;
1216
1217         WARN(!intel_irqs_enabled(dev_priv), "IRQs disabled");
1218
1219         if (i915_gem_request_completed(req, true))
1220                 return 0;
1221
1222         timeout_expire = timeout ?
1223                 jiffies + nsecs_to_jiffies_timeout((u64)*timeout) : 0;
1224
1225         if (INTEL_INFO(dev)->gen >= 6)
1226                 gen6_rps_boost(dev_priv, file_priv);
1227
1228         if (!irq_test_in_progress && WARN_ON(!ring->irq_get(ring)))
1229                 return -ENODEV;
1230
1231         /* Record current time in case interrupted by signal, or wedged */
1232         trace_i915_gem_request_wait_begin(req);
1233         before = ktime_get_raw_ns();
1234         for (;;) {
1235                 struct timer_list timer;
1236
1237                 prepare_to_wait(&ring->irq_queue, &wait,
1238                                 interruptible ? TASK_INTERRUPTIBLE : TASK_UNINTERRUPTIBLE);
1239
1240                 /* We need to check whether any gpu reset happened in between
1241                  * the caller grabbing the seqno and now ... */
1242                 if (reset_counter != atomic_read(&dev_priv->gpu_error.reset_counter)) {
1243                         /* ... but upgrade the -EAGAIN to an -EIO if the gpu
1244                          * is truely gone. */
1245                         ret = i915_gem_check_wedge(&dev_priv->gpu_error, interruptible);
1246                         if (ret == 0)
1247                                 ret = -EAGAIN;
1248                         break;
1249                 }
1250
1251                 if (i915_gem_request_completed(req, false)) {
1252                         ret = 0;
1253                         break;
1254                 }
1255
1256                 if (interruptible && signal_pending(current)) {
1257                         ret = -ERESTARTSYS;
1258                         break;
1259                 }
1260
1261                 if (timeout && time_after_eq(jiffies, timeout_expire)) {
1262                         ret = -ETIME;
1263                         break;
1264                 }
1265
1266                 timer.function = NULL;
1267                 if (timeout || missed_irq(dev_priv, ring)) {
1268                         unsigned long expire;
1269
1270                         setup_timer_on_stack(&timer, fake_irq, (unsigned long)current);
1271                         expire = missed_irq(dev_priv, ring) ? jiffies + 1 : timeout_expire;
1272                         mod_timer(&timer, expire);
1273                 }
1274
1275                 io_schedule();
1276
1277                 if (timer.function) {
1278                         del_singleshot_timer_sync(&timer);
1279                         destroy_timer_on_stack(&timer);
1280                 }
1281         }
1282         now = ktime_get_raw_ns();
1283         trace_i915_gem_request_wait_end(req);
1284
1285         if (!irq_test_in_progress)
1286                 ring->irq_put(ring);
1287
1288         finish_wait(&ring->irq_queue, &wait);
1289
1290         if (timeout) {
1291                 s64 tres = *timeout - (now - before);
1292
1293                 *timeout = tres < 0 ? 0 : tres;
1294
1295                 /*
1296                  * Apparently ktime isn't accurate enough and occasionally has a
1297                  * bit of mismatch in the jiffies<->nsecs<->ktime loop. So patch
1298                  * things up to make the test happy. We allow up to 1 jiffy.
1299                  *
1300                  * This is a regrssion from the timespec->ktime conversion.
1301                  */
1302                 if (ret == -ETIME && *timeout < jiffies_to_usecs(1)*1000)
1303                         *timeout = 0;
1304         }
1305
1306         return ret;
1307 }
1308
1309 /**
1310  * Waits for a request to be signaled, and cleans up the
1311  * request and object lists appropriately for that event.
1312  */
1313 int
1314 i915_wait_request(struct drm_i915_gem_request *req)
1315 {
1316         struct drm_device *dev;
1317         struct drm_i915_private *dev_priv;
1318         bool interruptible;
1319         unsigned reset_counter;
1320         int ret;
1321
1322         BUG_ON(req == NULL);
1323
1324         dev = req->ring->dev;
1325         dev_priv = dev->dev_private;
1326         interruptible = dev_priv->mm.interruptible;
1327
1328         BUG_ON(!mutex_is_locked(&dev->struct_mutex));
1329
1330         ret = i915_gem_check_wedge(&dev_priv->gpu_error, interruptible);
1331         if (ret)
1332                 return ret;
1333
1334         ret = i915_gem_check_olr(req);
1335         if (ret)
1336                 return ret;
1337
1338         reset_counter = atomic_read(&dev_priv->gpu_error.reset_counter);
1339         i915_gem_request_reference(req);
1340         ret = __i915_wait_request(req, reset_counter,
1341                                   interruptible, NULL, NULL);
1342         i915_gem_request_unreference(req);
1343         return ret;
1344 }
1345
1346 static int
1347 i915_gem_object_wait_rendering__tail(struct drm_i915_gem_object *obj)
1348 {
1349         if (!obj->active)
1350                 return 0;
1351
1352         /* Manually manage the write flush as we may have not yet
1353          * retired the buffer.
1354          *
1355          * Note that the last_write_req is always the earlier of
1356          * the two (read/write) requests, so if we haved successfully waited,
1357          * we know we have passed the last write.
1358          */
1359         i915_gem_request_assign(&obj->last_write_req, NULL);
1360
1361         return 0;
1362 }
1363
1364 /**
1365  * Ensures that all rendering to the object has completed and the object is
1366  * safe to unbind from the GTT or access from the CPU.
1367  */
1368 static __must_check int
1369 i915_gem_object_wait_rendering(struct drm_i915_gem_object *obj,
1370                                bool readonly)
1371 {
1372         struct drm_i915_gem_request *req;
1373         int ret;
1374
1375         req = readonly ? obj->last_write_req : obj->last_read_req;
1376         if (!req)
1377                 return 0;
1378
1379         ret = i915_wait_request(req);
1380         if (ret)
1381                 return ret;
1382
1383         return i915_gem_object_wait_rendering__tail(obj);
1384 }
1385
1386 /* A nonblocking variant of the above wait. This is a highly dangerous routine
1387  * as the object state may change during this call.
1388  */
1389 static __must_check int
1390 i915_gem_object_wait_rendering__nonblocking(struct drm_i915_gem_object *obj,
1391                                             struct drm_i915_file_private *file_priv,
1392                                             bool readonly)
1393 {
1394         struct drm_i915_gem_request *req;
1395         struct drm_device *dev = obj->base.dev;
1396         struct drm_i915_private *dev_priv = dev->dev_private;
1397         unsigned reset_counter;
1398         int ret;
1399
1400         BUG_ON(!mutex_is_locked(&dev->struct_mutex));
1401         BUG_ON(!dev_priv->mm.interruptible);
1402
1403         req = readonly ? obj->last_write_req : obj->last_read_req;
1404         if (!req)
1405                 return 0;
1406
1407         ret = i915_gem_check_wedge(&dev_priv->gpu_error, true);
1408         if (ret)
1409                 return ret;
1410
1411         ret = i915_gem_check_olr(req);
1412         if (ret)
1413                 return ret;
1414
1415         reset_counter = atomic_read(&dev_priv->gpu_error.reset_counter);
1416         i915_gem_request_reference(req);
1417         mutex_unlock(&dev->struct_mutex);
1418         ret = __i915_wait_request(req, reset_counter, true, NULL, file_priv);
1419         mutex_lock(&dev->struct_mutex);
1420         i915_gem_request_unreference(req);
1421         if (ret)
1422                 return ret;
1423
1424         return i915_gem_object_wait_rendering__tail(obj);
1425 }
1426
1427 /**
1428  * Called when user space prepares to use an object with the CPU, either
1429  * through the mmap ioctl's mapping or a GTT mapping.
1430  */
1431 int
1432 i915_gem_set_domain_ioctl(struct drm_device *dev, void *data,
1433                           struct drm_file *file)
1434 {
1435         struct drm_i915_gem_set_domain *args = data;
1436         struct drm_i915_gem_object *obj;
1437         uint32_t read_domains = args->read_domains;
1438         uint32_t write_domain = args->write_domain;
1439         int ret;
1440
1441         /* Only handle setting domains to types used by the CPU. */
1442         if (write_domain & I915_GEM_GPU_DOMAINS)
1443                 return -EINVAL;
1444
1445         if (read_domains & I915_GEM_GPU_DOMAINS)
1446                 return -EINVAL;
1447
1448         /* Having something in the write domain implies it's in the read
1449          * domain, and only that read domain.  Enforce that in the request.
1450          */
1451         if (write_domain != 0 && read_domains != write_domain)
1452                 return -EINVAL;
1453
1454         ret = i915_mutex_lock_interruptible(dev);
1455         if (ret)
1456                 return ret;
1457
1458         obj = to_intel_bo(drm_gem_object_lookup(dev, file, args->handle));
1459         if (&obj->base == NULL) {
1460                 ret = -ENOENT;
1461                 goto unlock;
1462         }
1463
1464         /* Try to flush the object off the GPU without holding the lock.
1465          * We will repeat the flush holding the lock in the normal manner
1466          * to catch cases where we are gazumped.
1467          */
1468         ret = i915_gem_object_wait_rendering__nonblocking(obj,
1469                                                           file->driver_priv,
1470                                                           !write_domain);
1471         if (ret)
1472                 goto unref;
1473
1474         if (read_domains & I915_GEM_DOMAIN_GTT)
1475                 ret = i915_gem_object_set_to_gtt_domain(obj, write_domain != 0);
1476         else
1477                 ret = i915_gem_object_set_to_cpu_domain(obj, write_domain != 0);
1478
1479 unref:
1480         drm_gem_object_unreference(&obj->base);
1481 unlock:
1482         mutex_unlock(&dev->struct_mutex);
1483         return ret;
1484 }
1485
1486 /**
1487  * Called when user space has done writes to this buffer
1488  */
1489 int
1490 i915_gem_sw_finish_ioctl(struct drm_device *dev, void *data,
1491                          struct drm_file *file)
1492 {
1493         struct drm_i915_gem_sw_finish *args = data;
1494         struct drm_i915_gem_object *obj;
1495         int ret = 0;
1496
1497         ret = i915_mutex_lock_interruptible(dev);
1498         if (ret)
1499                 return ret;
1500
1501         obj = to_intel_bo(drm_gem_object_lookup(dev, file, args->handle));
1502         if (&obj->base == NULL) {
1503                 ret = -ENOENT;
1504                 goto unlock;
1505         }
1506
1507         /* Pinned buffers may be scanout, so flush the cache */
1508         if (obj->pin_display)
1509                 i915_gem_object_flush_cpu_write_domain(obj);
1510
1511         drm_gem_object_unreference(&obj->base);
1512 unlock:
1513         mutex_unlock(&dev->struct_mutex);
1514         return ret;
1515 }
1516
1517 /**
1518  * Maps the contents of an object, returning the address it is mapped
1519  * into.
1520  *
1521  * While the mapping holds a reference on the contents of the object, it doesn't
1522  * imply a ref on the object itself.
1523  *
1524  * IMPORTANT:
1525  *
1526  * DRM driver writers who look a this function as an example for how to do GEM
1527  * mmap support, please don't implement mmap support like here. The modern way
1528  * to implement DRM mmap support is with an mmap offset ioctl (like
1529  * i915_gem_mmap_gtt) and then using the mmap syscall on the DRM fd directly.
1530  * That way debug tooling like valgrind will understand what's going on, hiding
1531  * the mmap call in a driver private ioctl will break that. The i915 driver only
1532  * does cpu mmaps this way because we didn't know better.
1533  */
1534 int
1535 i915_gem_mmap_ioctl(struct drm_device *dev, void *data,
1536                     struct drm_file *file)
1537 {
1538         struct drm_i915_gem_mmap *args = data;
1539         struct drm_gem_object *obj;
1540         unsigned long addr;
1541
1542         if (args->flags & ~(I915_MMAP_WC))
1543                 return -EINVAL;
1544
1545         if (args->flags & I915_MMAP_WC && !cpu_has_pat)
1546                 return -ENODEV;
1547
1548         obj = drm_gem_object_lookup(dev, file, args->handle);
1549         if (obj == NULL)
1550                 return -ENOENT;
1551
1552         /* prime objects have no backing filp to GEM mmap
1553          * pages from.
1554          */
1555         if (!obj->filp) {
1556                 drm_gem_object_unreference_unlocked(obj);
1557                 return -EINVAL;
1558         }
1559
1560         addr = vm_mmap(obj->filp, 0, args->size,
1561                        PROT_READ | PROT_WRITE, MAP_SHARED,
1562                        args->offset);
1563         if (args->flags & I915_MMAP_WC) {
1564                 struct mm_struct *mm = current->mm;
1565                 struct vm_area_struct *vma;
1566
1567                 down_write(&mm->mmap_sem);
1568                 vma = find_vma(mm, addr);
1569                 if (vma)
1570                         vma->vm_page_prot =
1571                                 pgprot_writecombine(vm_get_page_prot(vma->vm_flags));
1572                 else
1573                         addr = -ENOMEM;
1574                 up_write(&mm->mmap_sem);
1575         }
1576         drm_gem_object_unreference_unlocked(obj);
1577         if (IS_ERR((void *)addr))
1578                 return addr;
1579
1580         args->addr_ptr = (uint64_t) addr;
1581
1582         return 0;
1583 }
1584
1585 /**
1586  * i915_gem_fault - fault a page into the GTT
1587  * vma: VMA in question
1588  * vmf: fault info
1589  *
1590  * The fault handler is set up by drm_gem_mmap() when a object is GTT mapped
1591  * from userspace.  The fault handler takes care of binding the object to
1592  * the GTT (if needed), allocating and programming a fence register (again,
1593  * only if needed based on whether the old reg is still valid or the object
1594  * is tiled) and inserting a new PTE into the faulting process.
1595  *
1596  * Note that the faulting process may involve evicting existing objects
1597  * from the GTT and/or fence registers to make room.  So performance may
1598  * suffer if the GTT working set is large or there are few fence registers
1599  * left.
1600  */
1601 int i915_gem_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
1602 {
1603         struct drm_i915_gem_object *obj = to_intel_bo(vma->vm_private_data);
1604         struct drm_device *dev = obj->base.dev;
1605         struct drm_i915_private *dev_priv = dev->dev_private;
1606         pgoff_t page_offset;
1607         unsigned long pfn;
1608         int ret = 0;
1609         bool write = !!(vmf->flags & FAULT_FLAG_WRITE);
1610
1611         intel_runtime_pm_get(dev_priv);
1612
1613         /* We don't use vmf->pgoff since that has the fake offset */
1614         page_offset = ((unsigned long)vmf->virtual_address - vma->vm_start) >>
1615                 PAGE_SHIFT;
1616
1617         ret = i915_mutex_lock_interruptible(dev);
1618         if (ret)
1619                 goto out;
1620
1621         trace_i915_gem_object_fault(obj, page_offset, true, write);
1622
1623         /* Try to flush the object off the GPU first without holding the lock.
1624          * Upon reacquiring the lock, we will perform our sanity checks and then
1625          * repeat the flush holding the lock in the normal manner to catch cases
1626          * where we are gazumped.
1627          */
1628         ret = i915_gem_object_wait_rendering__nonblocking(obj, NULL, !write);
1629         if (ret)
1630                 goto unlock;
1631
1632         /* Access to snoopable pages through the GTT is incoherent. */
1633         if (obj->cache_level != I915_CACHE_NONE && !HAS_LLC(dev)) {
1634                 ret = -EFAULT;
1635                 goto unlock;
1636         }
1637
1638         /* Now bind it into the GTT if needed */
1639         ret = i915_gem_obj_ggtt_pin(obj, 0, PIN_MAPPABLE);
1640         if (ret)
1641                 goto unlock;
1642
1643         ret = i915_gem_object_set_to_gtt_domain(obj, write);
1644         if (ret)
1645                 goto unpin;
1646
1647         ret = i915_gem_object_get_fence(obj);
1648         if (ret)
1649                 goto unpin;
1650
1651         /* Finally, remap it using the new GTT offset */
1652         pfn = dev_priv->gtt.mappable_base + i915_gem_obj_ggtt_offset(obj);
1653         pfn >>= PAGE_SHIFT;
1654
1655         if (!obj->fault_mappable) {
1656                 unsigned long size = min_t(unsigned long,
1657                                            vma->vm_end - vma->vm_start,
1658                                            obj->base.size);
1659                 int i;
1660
1661                 for (i = 0; i < size >> PAGE_SHIFT; i++) {
1662                         ret = vm_insert_pfn(vma,
1663                                             (unsigned long)vma->vm_start + i * PAGE_SIZE,
1664                                             pfn + i);
1665                         if (ret)
1666                                 break;
1667                 }
1668
1669                 obj->fault_mappable = true;
1670         } else
1671                 ret = vm_insert_pfn(vma,
1672                                     (unsigned long)vmf->virtual_address,
1673                                     pfn + page_offset);
1674 unpin:
1675         i915_gem_object_ggtt_unpin(obj);
1676 unlock:
1677         mutex_unlock(&dev->struct_mutex);
1678 out:
1679         switch (ret) {
1680         case -EIO:
1681                 /*
1682                  * We eat errors when the gpu is terminally wedged to avoid
1683                  * userspace unduly crashing (gl has no provisions for mmaps to
1684                  * fail). But any other -EIO isn't ours (e.g. swap in failure)
1685                  * and so needs to be reported.
1686                  */
1687                 if (!i915_terminally_wedged(&dev_priv->gpu_error)) {
1688                         ret = VM_FAULT_SIGBUS;
1689                         break;
1690                 }
1691         case -EAGAIN:
1692                 /*
1693                  * EAGAIN means the gpu is hung and we'll wait for the error
1694                  * handler to reset everything when re-faulting in
1695                  * i915_mutex_lock_interruptible.
1696                  */
1697         case 0:
1698         case -ERESTARTSYS:
1699         case -EINTR:
1700         case -EBUSY:
1701                 /*
1702                  * EBUSY is ok: this just means that another thread
1703                  * already did the job.
1704                  */
1705                 ret = VM_FAULT_NOPAGE;
1706                 break;
1707         case -ENOMEM:
1708                 ret = VM_FAULT_OOM;
1709                 break;
1710         case -ENOSPC:
1711         case -EFAULT:
1712                 ret = VM_FAULT_SIGBUS;
1713                 break;
1714         default:
1715                 WARN_ONCE(ret, "unhandled error in i915_gem_fault: %i\n", ret);
1716                 ret = VM_FAULT_SIGBUS;
1717                 break;
1718         }
1719
1720         intel_runtime_pm_put(dev_priv);
1721         return ret;
1722 }
1723
1724 /**
1725  * i915_gem_release_mmap - remove physical page mappings
1726  * @obj: obj in question
1727  *
1728  * Preserve the reservation of the mmapping with the DRM core code, but
1729  * relinquish ownership of the pages back to the system.
1730  *
1731  * It is vital that we remove the page mapping if we have mapped a tiled
1732  * object through the GTT and then lose the fence register due to
1733  * resource pressure. Similarly if the object has been moved out of the
1734  * aperture, than pages mapped into userspace must be revoked. Removing the
1735  * mapping will then trigger a page fault on the next user access, allowing
1736  * fixup by i915_gem_fault().
1737  */
1738 void
1739 i915_gem_release_mmap(struct drm_i915_gem_object *obj)
1740 {
1741         if (!obj->fault_mappable)
1742                 return;
1743
1744         drm_vma_node_unmap(&obj->base.vma_node,
1745                            obj->base.dev->anon_inode->i_mapping);
1746         obj->fault_mappable = false;
1747 }
1748
1749 void
1750 i915_gem_release_all_mmaps(struct drm_i915_private *dev_priv)
1751 {
1752         struct drm_i915_gem_object *obj;
1753
1754         list_for_each_entry(obj, &dev_priv->mm.bound_list, global_list)
1755                 i915_gem_release_mmap(obj);
1756 }
1757
1758 uint32_t
1759 i915_gem_get_gtt_size(struct drm_device *dev, uint32_t size, int tiling_mode)
1760 {
1761         uint32_t gtt_size;
1762
1763         if (INTEL_INFO(dev)->gen >= 4 ||
1764             tiling_mode == I915_TILING_NONE)
1765                 return size;
1766
1767         /* Previous chips need a power-of-two fence region when tiling */
1768         if (INTEL_INFO(dev)->gen == 3)
1769                 gtt_size = 1024*1024;
1770         else
1771                 gtt_size = 512*1024;
1772
1773         while (gtt_size < size)
1774                 gtt_size <<= 1;
1775
1776         return gtt_size;
1777 }
1778
1779 /**
1780  * i915_gem_get_gtt_alignment - return required GTT alignment for an object
1781  * @obj: object to check
1782  *
1783  * Return the required GTT alignment for an object, taking into account
1784  * potential fence register mapping.
1785  */
1786 uint32_t
1787 i915_gem_get_gtt_alignment(struct drm_device *dev, uint32_t size,
1788                            int tiling_mode, bool fenced)
1789 {
1790         /*
1791          * Minimum alignment is 4k (GTT page size), but might be greater
1792          * if a fence register is needed for the object.
1793          */
1794         if (INTEL_INFO(dev)->gen >= 4 || (!fenced && IS_G33(dev)) ||
1795             tiling_mode == I915_TILING_NONE)
1796                 return 4096;
1797
1798         /*
1799          * Previous chips need to be aligned to the size of the smallest
1800          * fence register that can contain the object.
1801          */
1802         return i915_gem_get_gtt_size(dev, size, tiling_mode);
1803 }
1804
1805 static int i915_gem_object_create_mmap_offset(struct drm_i915_gem_object *obj)
1806 {
1807         struct drm_i915_private *dev_priv = obj->base.dev->dev_private;
1808         int ret;
1809
1810         if (drm_vma_node_has_offset(&obj->base.vma_node))
1811                 return 0;
1812
1813         dev_priv->mm.shrinker_no_lock_stealing = true;
1814
1815         ret = drm_gem_create_mmap_offset(&obj->base);
1816         if (ret != -ENOSPC)
1817                 goto out;
1818
1819         /* Badly fragmented mmap space? The only way we can recover
1820          * space is by destroying unwanted objects. We can't randomly release
1821          * mmap_offsets as userspace expects them to be persistent for the
1822          * lifetime of the objects. The closest we can is to release the
1823          * offsets on purgeable objects by truncating it and marking it purged,
1824          * which prevents userspace from ever using that object again.
1825          */
1826         i915_gem_shrink(dev_priv,
1827                         obj->base.size >> PAGE_SHIFT,
1828                         I915_SHRINK_BOUND |
1829                         I915_SHRINK_UNBOUND |
1830                         I915_SHRINK_PURGEABLE);
1831         ret = drm_gem_create_mmap_offset(&obj->base);
1832         if (ret != -ENOSPC)
1833                 goto out;
1834
1835         i915_gem_shrink_all(dev_priv);
1836         ret = drm_gem_create_mmap_offset(&obj->base);
1837 out:
1838         dev_priv->mm.shrinker_no_lock_stealing = false;
1839
1840         return ret;
1841 }
1842
1843 static void i915_gem_object_free_mmap_offset(struct drm_i915_gem_object *obj)
1844 {
1845         drm_gem_free_mmap_offset(&obj->base);
1846 }
1847
1848 int
1849 i915_gem_mmap_gtt(struct drm_file *file,
1850                   struct drm_device *dev,
1851                   uint32_t handle,
1852                   uint64_t *offset)
1853 {
1854         struct drm_i915_private *dev_priv = dev->dev_private;
1855         struct drm_i915_gem_object *obj;
1856         int ret;
1857
1858         ret = i915_mutex_lock_interruptible(dev);
1859         if (ret)
1860                 return ret;
1861
1862         obj = to_intel_bo(drm_gem_object_lookup(dev, file, handle));
1863         if (&obj->base == NULL) {
1864                 ret = -ENOENT;
1865                 goto unlock;
1866         }
1867
1868         if (obj->base.size > dev_priv->gtt.mappable_end) {
1869                 ret = -E2BIG;
1870                 goto out;
1871         }
1872
1873         if (obj->madv != I915_MADV_WILLNEED) {
1874                 DRM_DEBUG("Attempting to mmap a purgeable buffer\n");
1875                 ret = -EFAULT;
1876                 goto out;
1877         }
1878
1879         ret = i915_gem_object_create_mmap_offset(obj);
1880         if (ret)
1881                 goto out;
1882
1883         *offset = drm_vma_node_offset_addr(&obj->base.vma_node);
1884
1885 out:
1886         drm_gem_object_unreference(&obj->base);
1887 unlock:
1888         mutex_unlock(&dev->struct_mutex);
1889         return ret;
1890 }
1891
1892 /**
1893  * i915_gem_mmap_gtt_ioctl - prepare an object for GTT mmap'ing
1894  * @dev: DRM device
1895  * @data: GTT mapping ioctl data
1896  * @file: GEM object info
1897  *
1898  * Simply returns the fake offset to userspace so it can mmap it.
1899  * The mmap call will end up in drm_gem_mmap(), which will set things
1900  * up so we can get faults in the handler above.
1901  *
1902  * The fault handler will take care of binding the object into the GTT
1903  * (since it may have been evicted to make room for something), allocating
1904  * a fence register, and mapping the appropriate aperture address into
1905  * userspace.
1906  */
1907 int
1908 i915_gem_mmap_gtt_ioctl(struct drm_device *dev, void *data,
1909                         struct drm_file *file)
1910 {
1911         struct drm_i915_gem_mmap_gtt *args = data;
1912
1913         return i915_gem_mmap_gtt(file, dev, args->handle, &args->offset);
1914 }
1915
1916 /* Immediately discard the backing storage */
1917 static void
1918 i915_gem_object_truncate(struct drm_i915_gem_object *obj)
1919 {
1920         i915_gem_object_free_mmap_offset(obj);
1921
1922         if (obj->base.filp == NULL)
1923                 return;
1924
1925         /* Our goal here is to return as much of the memory as
1926          * is possible back to the system as we are called from OOM.
1927          * To do this we must instruct the shmfs to drop all of its
1928          * backing pages, *now*.
1929          */
1930         shmem_truncate_range(file_inode(obj->base.filp), 0, (loff_t)-1);
1931         obj->madv = __I915_MADV_PURGED;
1932 }
1933
1934 /* Try to discard unwanted pages */
1935 static void
1936 i915_gem_object_invalidate(struct drm_i915_gem_object *obj)
1937 {
1938         struct address_space *mapping;
1939
1940         switch (obj->madv) {
1941         case I915_MADV_DONTNEED:
1942                 i915_gem_object_truncate(obj);
1943         case __I915_MADV_PURGED:
1944                 return;
1945         }
1946
1947         if (obj->base.filp == NULL)
1948                 return;
1949
1950         mapping = file_inode(obj->base.filp)->i_mapping,
1951         invalidate_mapping_pages(mapping, 0, (loff_t)-1);
1952 }
1953
1954 static void
1955 i915_gem_object_put_pages_gtt(struct drm_i915_gem_object *obj)
1956 {
1957         struct sg_page_iter sg_iter;
1958         int ret;
1959
1960         BUG_ON(obj->madv == __I915_MADV_PURGED);
1961
1962         ret = i915_gem_object_set_to_cpu_domain(obj, true);
1963         if (ret) {
1964                 /* In the event of a disaster, abandon all caches and
1965                  * hope for the best.
1966                  */
1967                 WARN_ON(ret != -EIO);
1968                 i915_gem_clflush_object(obj, true);
1969                 obj->base.read_domains = obj->base.write_domain = I915_GEM_DOMAIN_CPU;
1970         }
1971
1972         if (i915_gem_object_needs_bit17_swizzle(obj))
1973                 i915_gem_object_save_bit_17_swizzle(obj);
1974
1975         if (obj->madv == I915_MADV_DONTNEED)
1976                 obj->dirty = 0;
1977
1978         for_each_sg_page(obj->pages->sgl, &sg_iter, obj->pages->nents, 0) {
1979                 struct page *page = sg_page_iter_page(&sg_iter);
1980
1981                 if (obj->dirty)
1982                         set_page_dirty(page);
1983
1984                 if (obj->madv == I915_MADV_WILLNEED)
1985                         mark_page_accessed(page);
1986
1987                 page_cache_release(page);
1988         }
1989         obj->dirty = 0;
1990
1991         sg_free_table(obj->pages);
1992         kfree(obj->pages);
1993 }
1994
1995 int
1996 i915_gem_object_put_pages(struct drm_i915_gem_object *obj)
1997 {
1998         const struct drm_i915_gem_object_ops *ops = obj->ops;
1999
2000         if (obj->pages == NULL)
2001                 return 0;
2002
2003         if (obj->pages_pin_count)
2004                 return -EBUSY;
2005
2006         BUG_ON(i915_gem_obj_bound_any(obj));
2007
2008         /* ->put_pages might need to allocate memory for the bit17 swizzle
2009          * array, hence protect them from being reaped by removing them from gtt
2010          * lists early. */
2011         list_del(&obj->global_list);
2012
2013         ops->put_pages(obj);
2014         obj->pages = NULL;
2015
2016         i915_gem_object_invalidate(obj);
2017
2018         return 0;
2019 }
2020
2021 static int
2022 i915_gem_object_get_pages_gtt(struct drm_i915_gem_object *obj)
2023 {
2024         struct drm_i915_private *dev_priv = obj->base.dev->dev_private;
2025         int page_count, i;
2026         struct address_space *mapping;
2027         struct sg_table *st;
2028         struct scatterlist *sg;
2029         struct sg_page_iter sg_iter;
2030         struct page *page;
2031         unsigned long last_pfn = 0;     /* suppress gcc warning */
2032         gfp_t gfp;
2033
2034         /* Assert that the object is not currently in any GPU domain. As it
2035          * wasn't in the GTT, there shouldn't be any way it could have been in
2036          * a GPU cache
2037          */
2038         BUG_ON(obj->base.read_domains & I915_GEM_GPU_DOMAINS);
2039         BUG_ON(obj->base.write_domain & I915_GEM_GPU_DOMAINS);
2040
2041         st = kmalloc(sizeof(*st), GFP_KERNEL);
2042         if (st == NULL)
2043                 return -ENOMEM;
2044
2045         page_count = obj->base.size / PAGE_SIZE;
2046         if (sg_alloc_table(st, page_count, GFP_KERNEL)) {
2047                 kfree(st);
2048                 return -ENOMEM;
2049         }
2050
2051         /* Get the list of pages out of our struct file.  They'll be pinned
2052          * at this point until we release them.
2053          *
2054          * Fail silently without starting the shrinker
2055          */
2056         mapping = file_inode(obj->base.filp)->i_mapping;
2057         gfp = mapping_gfp_mask(mapping);
2058         gfp |= __GFP_NORETRY | __GFP_NOWARN | __GFP_NO_KSWAPD;
2059         gfp &= ~(__GFP_IO | __GFP_WAIT);
2060         sg = st->sgl;
2061         st->nents = 0;
2062         for (i = 0; i < page_count; i++) {
2063                 page = shmem_read_mapping_page_gfp(mapping, i, gfp);
2064                 if (IS_ERR(page)) {
2065                         i915_gem_shrink(dev_priv,
2066                                         page_count,
2067                                         I915_SHRINK_BOUND |
2068                                         I915_SHRINK_UNBOUND |
2069                                         I915_SHRINK_PURGEABLE);
2070                         page = shmem_read_mapping_page_gfp(mapping, i, gfp);
2071                 }
2072                 if (IS_ERR(page)) {
2073                         /* We've tried hard to allocate the memory by reaping
2074                          * our own buffer, now let the real VM do its job and
2075                          * go down in flames if truly OOM.
2076                          */
2077                         i915_gem_shrink_all(dev_priv);
2078                         page = shmem_read_mapping_page(mapping, i);
2079                         if (IS_ERR(page))
2080                                 goto err_pages;
2081                 }
2082 #ifdef CONFIG_SWIOTLB
2083                 if (swiotlb_nr_tbl()) {
2084                         st->nents++;
2085                         sg_set_page(sg, page, PAGE_SIZE, 0);
2086                         sg = sg_next(sg);
2087                         continue;
2088                 }
2089 #endif
2090                 if (!i || page_to_pfn(page) != last_pfn + 1) {
2091                         if (i)
2092                                 sg = sg_next(sg);
2093                         st->nents++;
2094                         sg_set_page(sg, page, PAGE_SIZE, 0);
2095                 } else {
2096                         sg->length += PAGE_SIZE;
2097                 }
2098                 last_pfn = page_to_pfn(page);
2099
2100                 /* Check that the i965g/gm workaround works. */
2101                 WARN_ON((gfp & __GFP_DMA32) && (last_pfn >= 0x00100000UL));
2102         }
2103 #ifdef CONFIG_SWIOTLB
2104         if (!swiotlb_nr_tbl())
2105 #endif
2106                 sg_mark_end(sg);
2107         obj->pages = st;
2108
2109         if (i915_gem_object_needs_bit17_swizzle(obj))
2110                 i915_gem_object_do_bit_17_swizzle(obj);
2111
2112         if (obj->tiling_mode != I915_TILING_NONE &&
2113             dev_priv->quirks & QUIRK_PIN_SWIZZLED_PAGES)
2114                 i915_gem_object_pin_pages(obj);
2115
2116         return 0;
2117
2118 err_pages:
2119         sg_mark_end(sg);
2120         for_each_sg_page(st->sgl, &sg_iter, st->nents, 0)
2121                 page_cache_release(sg_page_iter_page(&sg_iter));
2122         sg_free_table(st);
2123         kfree(st);
2124
2125         /* shmemfs first checks if there is enough memory to allocate the page
2126          * and reports ENOSPC should there be insufficient, along with the usual
2127          * ENOMEM for a genuine allocation failure.
2128          *
2129          * We use ENOSPC in our driver to mean that we have run out of aperture
2130          * space and so want to translate the error from shmemfs back to our
2131          * usual understanding of ENOMEM.
2132          */
2133         if (PTR_ERR(page) == -ENOSPC)
2134                 return -ENOMEM;
2135         else
2136                 return PTR_ERR(page);
2137 }
2138
2139 /* Ensure that the associated pages are gathered from the backing storage
2140  * and pinned into our object. i915_gem_object_get_pages() may be called
2141  * multiple times before they are released by a single call to
2142  * i915_gem_object_put_pages() - once the pages are no longer referenced
2143  * either as a result of memory pressure (reaping pages under the shrinker)
2144  * or as the object is itself released.
2145  */
2146 int
2147 i915_gem_object_get_pages(struct drm_i915_gem_object *obj)
2148 {
2149         struct drm_i915_private *dev_priv = obj->base.dev->dev_private;
2150         const struct drm_i915_gem_object_ops *ops = obj->ops;
2151         int ret;
2152
2153         if (obj->pages)
2154                 return 0;
2155
2156         if (obj->madv != I915_MADV_WILLNEED) {
2157                 DRM_DEBUG("Attempting to obtain a purgeable object\n");
2158                 return -EFAULT;
2159         }
2160
2161         BUG_ON(obj->pages_pin_count);
2162
2163         ret = ops->get_pages(obj);
2164         if (ret)
2165                 return ret;
2166
2167         list_add_tail(&obj->global_list, &dev_priv->mm.unbound_list);
2168
2169         obj->get_page.sg = obj->pages->sgl;
2170         obj->get_page.last = 0;
2171
2172         return 0;
2173 }
2174
2175 static void
2176 i915_gem_object_move_to_active(struct drm_i915_gem_object *obj,
2177                                struct intel_engine_cs *ring)
2178 {
2179         struct drm_i915_gem_request *req;
2180         struct intel_engine_cs *old_ring;
2181
2182         BUG_ON(ring == NULL);
2183
2184         req = intel_ring_get_request(ring);
2185         old_ring = i915_gem_request_get_ring(obj->last_read_req);
2186
2187         if (old_ring != ring && obj->last_write_req) {
2188                 /* Keep the request relative to the current ring */
2189                 i915_gem_request_assign(&obj->last_write_req, req);
2190         }
2191
2192         /* Add a reference if we're newly entering the active list. */
2193         if (!obj->active) {
2194                 drm_gem_object_reference(&obj->base);
2195                 obj->active = 1;
2196         }
2197
2198         list_move_tail(&obj->ring_list, &ring->active_list);
2199
2200         i915_gem_request_assign(&obj->last_read_req, req);
2201 }
2202
2203 void i915_vma_move_to_active(struct i915_vma *vma,
2204                              struct intel_engine_cs *ring)
2205 {
2206         list_move_tail(&vma->mm_list, &vma->vm->active_list);
2207         return i915_gem_object_move_to_active(vma->obj, ring);
2208 }
2209
2210 static void
2211 i915_gem_object_move_to_inactive(struct drm_i915_gem_object *obj)
2212 {
2213         struct i915_vma *vma;
2214
2215         BUG_ON(obj->base.write_domain & ~I915_GEM_GPU_DOMAINS);
2216         BUG_ON(!obj->active);
2217
2218         list_for_each_entry(vma, &obj->vma_list, vma_link) {
2219                 if (!list_empty(&vma->mm_list))
2220                         list_move_tail(&vma->mm_list, &vma->vm->inactive_list);
2221         }
2222
2223         intel_fb_obj_flush(obj, true);
2224
2225         list_del_init(&obj->ring_list);
2226
2227         i915_gem_request_assign(&obj->last_read_req, NULL);
2228         i915_gem_request_assign(&obj->last_write_req, NULL);
2229         obj->base.write_domain = 0;
2230
2231         i915_gem_request_assign(&obj->last_fenced_req, NULL);
2232
2233         obj->active = 0;
2234         drm_gem_object_unreference(&obj->base);
2235
2236         WARN_ON(i915_verify_lists(dev));
2237 }
2238
2239 static void
2240 i915_gem_object_retire(struct drm_i915_gem_object *obj)
2241 {
2242         if (obj->last_read_req == NULL)
2243                 return;
2244
2245         if (i915_gem_request_completed(obj->last_read_req, true))
2246                 i915_gem_object_move_to_inactive(obj);
2247 }
2248
2249 static int
2250 i915_gem_init_seqno(struct drm_device *dev, u32 seqno)
2251 {
2252         struct drm_i915_private *dev_priv = dev->dev_private;
2253         struct intel_engine_cs *ring;
2254         int ret, i, j;
2255
2256         /* Carefully retire all requests without writing to the rings */
2257         for_each_ring(ring, dev_priv, i) {
2258                 ret = intel_ring_idle(ring);
2259                 if (ret)
2260                         return ret;
2261         }
2262         i915_gem_retire_requests(dev);
2263
2264         /* Finally reset hw state */
2265         for_each_ring(ring, dev_priv, i) {
2266                 intel_ring_init_seqno(ring, seqno);
2267
2268                 for (j = 0; j < ARRAY_SIZE(ring->semaphore.sync_seqno); j++)
2269                         ring->semaphore.sync_seqno[j] = 0;
2270         }
2271
2272         return 0;
2273 }
2274
2275 int i915_gem_set_seqno(struct drm_device *dev, u32 seqno)
2276 {
2277         struct drm_i915_private *dev_priv = dev->dev_private;
2278         int ret;
2279
2280         if (seqno == 0)
2281                 return -EINVAL;
2282
2283         /* HWS page needs to be set less than what we
2284          * will inject to ring
2285          */
2286         ret = i915_gem_init_seqno(dev, seqno - 1);
2287         if (ret)
2288                 return ret;
2289
2290         /* Carefully set the last_seqno value so that wrap
2291          * detection still works
2292          */
2293         dev_priv->next_seqno = seqno;
2294         dev_priv->last_seqno = seqno - 1;
2295         if (dev_priv->last_seqno == 0)
2296                 dev_priv->last_seqno--;
2297
2298         return 0;
2299 }
2300
2301 int
2302 i915_gem_get_seqno(struct drm_device *dev, u32 *seqno)
2303 {
2304         struct drm_i915_private *dev_priv = dev->dev_private;
2305
2306         /* reserve 0 for non-seqno */
2307         if (dev_priv->next_seqno == 0) {
2308                 int ret = i915_gem_init_seqno(dev, 0);
2309                 if (ret)
2310                         return ret;
2311
2312                 dev_priv->next_seqno = 1;
2313         }
2314
2315         *seqno = dev_priv->last_seqno = dev_priv->next_seqno++;
2316         return 0;
2317 }
2318
2319 int __i915_add_request(struct intel_engine_cs *ring,
2320                        struct drm_file *file,
2321                        struct drm_i915_gem_object *obj)
2322 {
2323         struct drm_i915_private *dev_priv = ring->dev->dev_private;
2324         struct drm_i915_gem_request *request;
2325         struct intel_ringbuffer *ringbuf;
2326         u32 request_start;
2327         int ret;
2328
2329         request = ring->outstanding_lazy_request;
2330         if (WARN_ON(request == NULL))
2331                 return -ENOMEM;
2332
2333         if (i915.enable_execlists) {
2334                 ringbuf = request->ctx->engine[ring->id].ringbuf;
2335         } else
2336                 ringbuf = ring->buffer;
2337
2338         request_start = intel_ring_get_tail(ringbuf);
2339         /*
2340          * Emit any outstanding flushes - execbuf can fail to emit the flush
2341          * after having emitted the batchbuffer command. Hence we need to fix
2342          * things up similar to emitting the lazy request. The difference here
2343          * is that the flush _must_ happen before the next request, no matter
2344          * what.
2345          */
2346         if (i915.enable_execlists) {
2347                 ret = logical_ring_flush_all_caches(ringbuf, request->ctx);
2348                 if (ret)
2349                         return ret;
2350         } else {
2351                 ret = intel_ring_flush_all_caches(ring);
2352                 if (ret)
2353                         return ret;
2354         }
2355
2356         /* Record the position of the start of the request so that
2357          * should we detect the updated seqno part-way through the
2358          * GPU processing the request, we never over-estimate the
2359          * position of the head.
2360          */
2361         request->postfix = intel_ring_get_tail(ringbuf);
2362
2363         if (i915.enable_execlists) {
2364                 ret = ring->emit_request(ringbuf, request);
2365                 if (ret)
2366                         return ret;
2367         } else {
2368                 ret = ring->add_request(ring);
2369                 if (ret)
2370                         return ret;
2371         }
2372
2373         request->head = request_start;
2374         request->tail = intel_ring_get_tail(ringbuf);
2375
2376         /* Whilst this request exists, batch_obj will be on the
2377          * active_list, and so will hold the active reference. Only when this
2378          * request is retired will the the batch_obj be moved onto the
2379          * inactive_list and lose its active reference. Hence we do not need
2380          * to explicitly hold another reference here.
2381          */
2382         request->batch_obj = obj;
2383
2384         if (!i915.enable_execlists) {
2385                 /* Hold a reference to the current context so that we can inspect
2386                  * it later in case a hangcheck error event fires.
2387                  */
2388                 request->ctx = ring->last_context;
2389                 if (request->ctx)
2390                         i915_gem_context_reference(request->ctx);
2391         }
2392
2393         request->emitted_jiffies = jiffies;
2394         list_add_tail(&request->list, &ring->request_list);
2395         request->file_priv = NULL;
2396
2397         if (file) {
2398                 struct drm_i915_file_private *file_priv = file->driver_priv;
2399
2400                 spin_lock(&file_priv->mm.lock);
2401                 request->file_priv = file_priv;
2402                 list_add_tail(&request->client_list,
2403                               &file_priv->mm.request_list);
2404                 spin_unlock(&file_priv->mm.lock);
2405
2406                 request->pid = get_pid(task_pid(current));
2407         }
2408
2409         trace_i915_gem_request_add(request);
2410         ring->outstanding_lazy_request = NULL;
2411
2412         i915_queue_hangcheck(ring->dev);
2413
2414         cancel_delayed_work_sync(&dev_priv->mm.idle_work);
2415         queue_delayed_work(dev_priv->wq,
2416                            &dev_priv->mm.retire_work,
2417                            round_jiffies_up_relative(HZ));
2418         intel_mark_busy(dev_priv->dev);
2419
2420         return 0;
2421 }
2422
2423 static inline void
2424 i915_gem_request_remove_from_client(struct drm_i915_gem_request *request)
2425 {
2426         struct drm_i915_file_private *file_priv = request->file_priv;
2427
2428         if (!file_priv)
2429                 return;
2430
2431         spin_lock(&file_priv->mm.lock);
2432         list_del(&request->client_list);
2433         request->file_priv = NULL;
2434         spin_unlock(&file_priv->mm.lock);
2435 }
2436
2437 static bool i915_context_is_banned(struct drm_i915_private *dev_priv,
2438                                    const struct intel_context *ctx)
2439 {
2440         unsigned long elapsed;
2441
2442         elapsed = get_seconds() - ctx->hang_stats.guilty_ts;
2443
2444         if (ctx->hang_stats.banned)
2445                 return true;
2446
2447         if (ctx->hang_stats.ban_period_seconds &&
2448             elapsed <= ctx->hang_stats.ban_period_seconds) {
2449                 if (!i915_gem_context_is_default(ctx)) {
2450                         DRM_DEBUG("context hanging too fast, banning!\n");
2451                         return true;
2452                 } else if (i915_stop_ring_allow_ban(dev_priv)) {
2453                         if (i915_stop_ring_allow_warn(dev_priv))
2454                                 DRM_ERROR("gpu hanging too fast, banning!\n");
2455                         return true;
2456                 }
2457         }
2458
2459         return false;
2460 }
2461
2462 static void i915_set_reset_status(struct drm_i915_private *dev_priv,
2463                                   struct intel_context *ctx,
2464                                   const bool guilty)
2465 {
2466         struct i915_ctx_hang_stats *hs;
2467
2468         if (WARN_ON(!ctx))
2469                 return;
2470
2471         hs = &ctx->hang_stats;
2472
2473         if (guilty) {
2474                 hs->banned = i915_context_is_banned(dev_priv, ctx);
2475                 hs->batch_active++;
2476                 hs->guilty_ts = get_seconds();
2477         } else {
2478                 hs->batch_pending++;
2479         }
2480 }
2481
2482 static void i915_gem_free_request(struct drm_i915_gem_request *request)
2483 {
2484         list_del(&request->list);
2485         i915_gem_request_remove_from_client(request);
2486
2487         put_pid(request->pid);
2488
2489         i915_gem_request_unreference(request);
2490 }
2491
2492 void i915_gem_request_free(struct kref *req_ref)
2493 {
2494         struct drm_i915_gem_request *req = container_of(req_ref,
2495                                                  typeof(*req), ref);
2496         struct intel_context *ctx = req->ctx;
2497
2498         if (ctx) {
2499                 if (i915.enable_execlists) {
2500                         struct intel_engine_cs *ring = req->ring;
2501
2502                         if (ctx != ring->default_context)
2503                                 intel_lr_context_unpin(ring, ctx);
2504                 }
2505
2506                 i915_gem_context_unreference(ctx);
2507         }
2508
2509         kmem_cache_free(req->i915->requests, req);
2510 }
2511
2512 int i915_gem_request_alloc(struct intel_engine_cs *ring,
2513                            struct intel_context *ctx)
2514 {
2515         struct drm_i915_private *dev_priv = to_i915(ring->dev);
2516         struct drm_i915_gem_request *rq;
2517         int ret;
2518
2519         if (ring->outstanding_lazy_request)
2520                 return 0;
2521
2522         rq = kmem_cache_zalloc(dev_priv->requests, GFP_KERNEL);
2523         if (rq == NULL)
2524                 return -ENOMEM;
2525
2526         kref_init(&rq->ref);
2527         rq->i915 = dev_priv;
2528
2529         ret = i915_gem_get_seqno(ring->dev, &rq->seqno);
2530         if (ret) {
2531                 kfree(rq);
2532                 return ret;
2533         }
2534
2535         rq->ring = ring;
2536         rq->uniq = dev_priv->request_uniq++;
2537
2538         if (i915.enable_execlists)
2539                 ret = intel_logical_ring_alloc_request_extras(rq, ctx);
2540         else
2541                 ret = intel_ring_alloc_request_extras(rq);
2542         if (ret) {
2543                 kfree(rq);
2544                 return ret;
2545         }
2546
2547         ring->outstanding_lazy_request = rq;
2548         return 0;
2549 }
2550
2551 struct drm_i915_gem_request *
2552 i915_gem_find_active_request(struct intel_engine_cs *ring)
2553 {
2554         struct drm_i915_gem_request *request;
2555
2556         list_for_each_entry(request, &ring->request_list, list) {
2557                 if (i915_gem_request_completed(request, false))
2558                         continue;
2559
2560                 return request;
2561         }
2562
2563         return NULL;
2564 }
2565
2566 static void i915_gem_reset_ring_status(struct drm_i915_private *dev_priv,
2567                                        struct intel_engine_cs *ring)
2568 {
2569         struct drm_i915_gem_request *request;
2570         bool ring_hung;
2571
2572         request = i915_gem_find_active_request(ring);
2573
2574         if (request == NULL)
2575                 return;
2576
2577         ring_hung = ring->hangcheck.score >= HANGCHECK_SCORE_RING_HUNG;
2578
2579         i915_set_reset_status(dev_priv, request->ctx, ring_hung);
2580
2581         list_for_each_entry_continue(request, &ring->request_list, list)
2582                 i915_set_reset_status(dev_priv, request->ctx, false);
2583 }
2584
2585 static void i915_gem_reset_ring_cleanup(struct drm_i915_private *dev_priv,
2586                                         struct intel_engine_cs *ring)
2587 {
2588         while (!list_empty(&ring->active_list)) {
2589                 struct drm_i915_gem_object *obj;
2590
2591                 obj = list_first_entry(&ring->active_list,
2592                                        struct drm_i915_gem_object,
2593                                        ring_list);
2594
2595                 i915_gem_object_move_to_inactive(obj);
2596         }
2597
2598         /*
2599          * Clear the execlists queue up before freeing the requests, as those
2600          * are the ones that keep the context and ringbuffer backing objects
2601          * pinned in place.
2602          */
2603         while (!list_empty(&ring->execlist_queue)) {
2604                 struct drm_i915_gem_request *submit_req;
2605
2606                 submit_req = list_first_entry(&ring->execlist_queue,
2607                                 struct drm_i915_gem_request,
2608                                 execlist_link);
2609                 list_del(&submit_req->execlist_link);
2610
2611                 if (submit_req->ctx != ring->default_context)
2612                         intel_lr_context_unpin(ring, submit_req->ctx);
2613
2614                 i915_gem_request_unreference(submit_req);
2615         }
2616
2617         /*
2618          * We must free the requests after all the corresponding objects have
2619          * been moved off active lists. Which is the same order as the normal
2620          * retire_requests function does. This is important if object hold
2621          * implicit references on things like e.g. ppgtt address spaces through
2622          * the request.
2623          */
2624         while (!list_empty(&ring->request_list)) {
2625                 struct drm_i915_gem_request *request;
2626
2627                 request = list_first_entry(&ring->request_list,
2628                                            struct drm_i915_gem_request,
2629                                            list);
2630
2631                 i915_gem_free_request(request);
2632         }
2633
2634         /* This may not have been flushed before the reset, so clean it now */
2635         i915_gem_request_assign(&ring->outstanding_lazy_request, NULL);
2636 }
2637
2638 void i915_gem_restore_fences(struct drm_device *dev)
2639 {
2640         struct drm_i915_private *dev_priv = dev->dev_private;
2641         int i;
2642
2643         for (i = 0; i < dev_priv->num_fence_regs; i++) {
2644                 struct drm_i915_fence_reg *reg = &dev_priv->fence_regs[i];
2645
2646                 /*
2647                  * Commit delayed tiling changes if we have an object still
2648                  * attached to the fence, otherwise just clear the fence.
2649                  */
2650                 if (reg->obj) {
2651                         i915_gem_object_update_fence(reg->obj, reg,
2652                                                      reg->obj->tiling_mode);
2653                 } else {
2654                         i915_gem_write_fence(dev, i, NULL);
2655                 }
2656         }
2657 }
2658
2659 void i915_gem_reset(struct drm_device *dev)
2660 {
2661         struct drm_i915_private *dev_priv = dev->dev_private;
2662         struct intel_engine_cs *ring;
2663         int i;
2664
2665         /*
2666          * Before we free the objects from the requests, we need to inspect
2667          * them for finding the guilty party. As the requests only borrow
2668          * their reference to the objects, the inspection must be done first.
2669          */
2670         for_each_ring(ring, dev_priv, i)
2671                 i915_gem_reset_ring_status(dev_priv, ring);
2672
2673         for_each_ring(ring, dev_priv, i)
2674                 i915_gem_reset_ring_cleanup(dev_priv, ring);
2675
2676         i915_gem_context_reset(dev);
2677
2678         i915_gem_restore_fences(dev);
2679 }
2680
2681 /**
2682  * This function clears the request list as sequence numbers are passed.
2683  */
2684 void
2685 i915_gem_retire_requests_ring(struct intel_engine_cs *ring)
2686 {
2687         if (list_empty(&ring->request_list))
2688                 return;
2689
2690         WARN_ON(i915_verify_lists(ring->dev));
2691
2692         /* Retire requests first as we use it above for the early return.
2693          * If we retire requests last, we may use a later seqno and so clear
2694          * the requests lists without clearing the active list, leading to
2695          * confusion.
2696          */
2697         while (!list_empty(&ring->request_list)) {
2698                 struct drm_i915_gem_request *request;
2699
2700                 request = list_first_entry(&ring->request_list,
2701                                            struct drm_i915_gem_request,
2702                                            list);
2703
2704                 if (!i915_gem_request_completed(request, true))
2705                         break;
2706
2707                 trace_i915_gem_request_retire(request);
2708
2709                 /* We know the GPU must have read the request to have
2710                  * sent us the seqno + interrupt, so use the position
2711                  * of tail of the request to update the last known position
2712                  * of the GPU head.
2713                  */
2714                 request->ringbuf->last_retired_head = request->postfix;
2715
2716                 i915_gem_free_request(request);
2717         }
2718
2719         /* Move any buffers on the active list that are no longer referenced
2720          * by the ringbuffer to the flushing/inactive lists as appropriate,
2721          * before we free the context associated with the requests.
2722          */
2723         while (!list_empty(&ring->active_list)) {
2724                 struct drm_i915_gem_object *obj;
2725
2726                 obj = list_first_entry(&ring->active_list,
2727                                       struct drm_i915_gem_object,
2728                                       ring_list);
2729
2730                 if (!i915_gem_request_completed(obj->last_read_req, true))
2731                         break;
2732
2733                 i915_gem_object_move_to_inactive(obj);
2734         }
2735
2736         if (unlikely(ring->trace_irq_req &&
2737                      i915_gem_request_completed(ring->trace_irq_req, true))) {
2738                 ring->irq_put(ring);
2739                 i915_gem_request_assign(&ring->trace_irq_req, NULL);
2740         }
2741
2742         WARN_ON(i915_verify_lists(ring->dev));
2743 }
2744
2745 bool
2746 i915_gem_retire_requests(struct drm_device *dev)
2747 {
2748         struct drm_i915_private *dev_priv = dev->dev_private;
2749         struct intel_engine_cs *ring;
2750         bool idle = true;
2751         int i;
2752
2753         for_each_ring(ring, dev_priv, i) {
2754                 i915_gem_retire_requests_ring(ring);
2755                 idle &= list_empty(&ring->request_list);
2756                 if (i915.enable_execlists) {
2757                         unsigned long flags;
2758
2759                         spin_lock_irqsave(&ring->execlist_lock, flags);
2760                         idle &= list_empty(&ring->execlist_queue);
2761                         spin_unlock_irqrestore(&ring->execlist_lock, flags);
2762
2763                         intel_execlists_retire_requests(ring);
2764                 }
2765         }
2766
2767         if (idle)
2768                 mod_delayed_work(dev_priv->wq,
2769                                    &dev_priv->mm.idle_work,
2770                                    msecs_to_jiffies(100));
2771
2772         return idle;
2773 }
2774
2775 static void
2776 i915_gem_retire_work_handler(struct work_struct *work)
2777 {
2778         struct drm_i915_private *dev_priv =
2779                 container_of(work, typeof(*dev_priv), mm.retire_work.work);
2780         struct drm_device *dev = dev_priv->dev;
2781         bool idle;
2782
2783         /* Come back later if the device is busy... */
2784         idle = false;
2785         if (mutex_trylock(&dev->struct_mutex)) {
2786                 idle = i915_gem_retire_requests(dev);
2787                 mutex_unlock(&dev->struct_mutex);
2788         }
2789         if (!idle)
2790                 queue_delayed_work(dev_priv->wq, &dev_priv->mm.retire_work,
2791                                    round_jiffies_up_relative(HZ));
2792 }
2793
2794 static void
2795 i915_gem_idle_work_handler(struct work_struct *work)
2796 {
2797         struct drm_i915_private *dev_priv =
2798                 container_of(work, typeof(*dev_priv), mm.idle_work.work);
2799         struct drm_device *dev = dev_priv->dev;
2800
2801         intel_mark_idle(dev);
2802
2803         if (mutex_trylock(&dev->struct_mutex)) {
2804                 struct intel_engine_cs *ring;
2805                 int i;
2806
2807                 for_each_ring(ring, dev_priv, i)
2808                         i915_gem_batch_pool_fini(&ring->batch_pool);
2809
2810                 mutex_unlock(&dev->struct_mutex);
2811         }
2812 }
2813
2814 /**
2815  * Ensures that an object will eventually get non-busy by flushing any required
2816  * write domains, emitting any outstanding lazy request and retiring and
2817  * completed requests.
2818  */
2819 static int
2820 i915_gem_object_flush_active(struct drm_i915_gem_object *obj)
2821 {
2822         struct intel_engine_cs *ring;
2823         int ret;
2824
2825         if (obj->active) {
2826                 ring = i915_gem_request_get_ring(obj->last_read_req);
2827
2828                 ret = i915_gem_check_olr(obj->last_read_req);
2829                 if (ret)
2830                         return ret;
2831
2832                 i915_gem_retire_requests_ring(ring);
2833         }
2834
2835         return 0;
2836 }
2837
2838 /**
2839  * i915_gem_wait_ioctl - implements DRM_IOCTL_I915_GEM_WAIT
2840  * @DRM_IOCTL_ARGS: standard ioctl arguments
2841  *
2842  * Returns 0 if successful, else an error is returned with the remaining time in
2843  * the timeout parameter.
2844  *  -ETIME: object is still busy after timeout
2845  *  -ERESTARTSYS: signal interrupted the wait
2846  *  -ENONENT: object doesn't exist
2847  * Also possible, but rare:
2848  *  -EAGAIN: GPU wedged
2849  *  -ENOMEM: damn
2850  *  -ENODEV: Internal IRQ fail
2851  *  -E?: The add request failed
2852  *
2853  * The wait ioctl with a timeout of 0 reimplements the busy ioctl. With any
2854  * non-zero timeout parameter the wait ioctl will wait for the given number of
2855  * nanoseconds on an object becoming unbusy. Since the wait itself does so
2856  * without holding struct_mutex the object may become re-busied before this
2857  * function completes. A similar but shorter * race condition exists in the busy
2858  * ioctl
2859  */
2860 int
2861 i915_gem_wait_ioctl(struct drm_device *dev, void *data, struct drm_file *file)
2862 {
2863         struct drm_i915_private *dev_priv = dev->dev_private;
2864         struct drm_i915_gem_wait *args = data;
2865         struct drm_i915_gem_object *obj;
2866         struct drm_i915_gem_request *req;
2867         unsigned reset_counter;
2868         int ret = 0;
2869
2870         if (args->flags != 0)
2871                 return -EINVAL;
2872
2873         ret = i915_mutex_lock_interruptible(dev);
2874         if (ret)
2875                 return ret;
2876
2877         obj = to_intel_bo(drm_gem_object_lookup(dev, file, args->bo_handle));
2878         if (&obj->base == NULL) {
2879                 mutex_unlock(&dev->struct_mutex);
2880                 return -ENOENT;
2881         }
2882
2883         /* Need to make sure the object gets inactive eventually. */
2884         ret = i915_gem_object_flush_active(obj);
2885         if (ret)
2886                 goto out;
2887
2888         if (!obj->active || !obj->last_read_req)
2889                 goto out;
2890
2891         req = obj->last_read_req;
2892
2893         /* Do this after OLR check to make sure we make forward progress polling
2894          * on this IOCTL with a timeout == 0 (like busy ioctl)
2895          */
2896         if (args->timeout_ns == 0) {
2897                 ret = -ETIME;
2898                 goto out;
2899         }
2900
2901         drm_gem_object_unreference(&obj->base);
2902         reset_counter = atomic_read(&dev_priv->gpu_error.reset_counter);
2903         i915_gem_request_reference(req);
2904         mutex_unlock(&dev->struct_mutex);
2905
2906         ret = __i915_wait_request(req, reset_counter, true,
2907                                   args->timeout_ns > 0 ? &args->timeout_ns : NULL,
2908                                   file->driver_priv);
2909         i915_gem_request_unreference__unlocked(req);
2910         return ret;
2911
2912 out:
2913         drm_gem_object_unreference(&obj->base);
2914         mutex_unlock(&dev->struct_mutex);
2915         return ret;
2916 }
2917
2918 /**
2919  * i915_gem_object_sync - sync an object to a ring.
2920  *
2921  * @obj: object which may be in use on another ring.
2922  * @to: ring we wish to use the object on. May be NULL.
2923  *
2924  * This code is meant to abstract object synchronization with the GPU.
2925  * Calling with NULL implies synchronizing the object with the CPU
2926  * rather than a particular GPU ring.
2927  *
2928  * Returns 0 if successful, else propagates up the lower layer error.
2929  */
2930 int
2931 i915_gem_object_sync(struct drm_i915_gem_object *obj,
2932                      struct intel_engine_cs *to)
2933 {
2934         struct intel_engine_cs *from;
2935         u32 seqno;
2936         int ret, idx;
2937
2938         from = i915_gem_request_get_ring(obj->last_read_req);
2939
2940         if (from == NULL || to == from)
2941                 return 0;
2942
2943         if (to == NULL || !i915_semaphore_is_enabled(obj->base.dev))
2944                 return i915_gem_object_wait_rendering(obj, false);
2945
2946         idx = intel_ring_sync_index(from, to);
2947
2948         seqno = i915_gem_request_get_seqno(obj->last_read_req);
2949         /* Optimization: Avoid semaphore sync when we are sure we already
2950          * waited for an object with higher seqno */
2951         if (seqno <= from->semaphore.sync_seqno[idx])
2952                 return 0;
2953
2954         ret = i915_gem_check_olr(obj->last_read_req);
2955         if (ret)
2956                 return ret;
2957
2958         trace_i915_gem_ring_sync_to(from, to, obj->last_read_req);
2959         ret = to->semaphore.sync_to(to, from, seqno);
2960         if (!ret)
2961                 /* We use last_read_req because sync_to()
2962                  * might have just caused seqno wrap under
2963                  * the radar.
2964                  */
2965                 from->semaphore.sync_seqno[idx] =
2966                                 i915_gem_request_get_seqno(obj->last_read_req);
2967
2968         return ret;
2969 }
2970
2971 static void i915_gem_object_finish_gtt(struct drm_i915_gem_object *obj)
2972 {
2973         u32 old_write_domain, old_read_domains;
2974
2975         /* Force a pagefault for domain tracking on next user access */
2976         i915_gem_release_mmap(obj);
2977
2978         if ((obj->base.read_domains & I915_GEM_DOMAIN_GTT) == 0)
2979                 return;
2980
2981         /* Wait for any direct GTT access to complete */
2982         mb();
2983
2984         old_read_domains = obj->base.read_domains;
2985         old_write_domain = obj->base.write_domain;
2986
2987         obj->base.read_domains &= ~I915_GEM_DOMAIN_GTT;
2988         obj->base.write_domain &= ~I915_GEM_DOMAIN_GTT;
2989
2990         trace_i915_gem_object_change_domain(obj,
2991                                             old_read_domains,
2992                                             old_write_domain);
2993 }
2994
2995 int i915_vma_unbind(struct i915_vma *vma)
2996 {
2997         struct drm_i915_gem_object *obj = vma->obj;
2998         struct drm_i915_private *dev_priv = obj->base.dev->dev_private;
2999         int ret;
3000
3001         if (list_empty(&vma->vma_link))
3002                 return 0;
3003
3004         if (!drm_mm_node_allocated(&vma->node)) {
3005                 i915_gem_vma_destroy(vma);
3006                 return 0;
3007         }
3008
3009         if (vma->pin_count)
3010                 return -EBUSY;
3011
3012         BUG_ON(obj->pages == NULL);
3013
3014         ret = i915_gem_object_finish_gpu(obj);
3015         if (ret)
3016                 return ret;
3017         /* Continue on if we fail due to EIO, the GPU is hung so we
3018          * should be safe and we need to cleanup or else we might
3019          * cause memory corruption through use-after-free.
3020          */
3021
3022         if (i915_is_ggtt(vma->vm) &&
3023             vma->ggtt_view.type == I915_GGTT_VIEW_NORMAL) {
3024                 i915_gem_object_finish_gtt(obj);
3025
3026                 /* release the fence reg _after_ flushing */
3027                 ret = i915_gem_object_put_fence(obj);
3028                 if (ret)
3029                         return ret;
3030         }
3031
3032         trace_i915_vma_unbind(vma);
3033
3034         vma->unbind_vma(vma);
3035
3036         list_del_init(&vma->mm_list);
3037         if (i915_is_ggtt(vma->vm)) {
3038                 if (vma->ggtt_view.type == I915_GGTT_VIEW_NORMAL) {
3039                         obj->map_and_fenceable = false;
3040                 } else if (vma->ggtt_view.pages) {
3041                         sg_free_table(vma->ggtt_view.pages);
3042                         kfree(vma->ggtt_view.pages);
3043                         vma->ggtt_view.pages = NULL;
3044                 }
3045         }
3046
3047         drm_mm_remove_node(&vma->node);
3048         i915_gem_vma_destroy(vma);
3049
3050         /* Since the unbound list is global, only move to that list if
3051          * no more VMAs exist. */
3052         if (list_empty(&obj->vma_list)) {
3053                 /* Throw away the active reference before
3054                  * moving to the unbound list. */
3055                 i915_gem_object_retire(obj);
3056
3057                 i915_gem_gtt_finish_object(obj);
3058                 list_move_tail(&obj->global_list, &dev_priv->mm.unbound_list);
3059         }
3060
3061         /* And finally now the object is completely decoupled from this vma,
3062          * we can drop its hold on the backing storage and allow it to be
3063          * reaped by the shrinker.
3064          */
3065         i915_gem_object_unpin_pages(obj);
3066
3067         return 0;
3068 }
3069
3070 int i915_gpu_idle(struct drm_device *dev)
3071 {
3072         struct drm_i915_private *dev_priv = dev->dev_private;
3073         struct intel_engine_cs *ring;
3074         int ret, i;
3075
3076         /* Flush everything onto the inactive list. */
3077         for_each_ring(ring, dev_priv, i) {
3078                 if (!i915.enable_execlists) {
3079                         ret = i915_switch_context(ring, ring->default_context);
3080                         if (ret)
3081                                 return ret;
3082                 }
3083
3084                 ret = intel_ring_idle(ring);
3085                 if (ret)
3086                         return ret;
3087         }
3088
3089         return 0;
3090 }
3091
3092 static void i965_write_fence_reg(struct drm_device *dev, int reg,
3093                                  struct drm_i915_gem_object *obj)
3094 {
3095         struct drm_i915_private *dev_priv = dev->dev_private;
3096         int fence_reg;
3097         int fence_pitch_shift;
3098
3099         if (INTEL_INFO(dev)->gen >= 6) {
3100                 fence_reg = FENCE_REG_SANDYBRIDGE_0;
3101                 fence_pitch_shift = SANDYBRIDGE_FENCE_PITCH_SHIFT;
3102         } else {
3103                 fence_reg = FENCE_REG_965_0;
3104                 fence_pitch_shift = I965_FENCE_PITCH_SHIFT;
3105         }
3106
3107         fence_reg += reg * 8;
3108
3109         /* To w/a incoherency with non-atomic 64-bit register updates,
3110          * we split the 64-bit update into two 32-bit writes. In order
3111          * for a partial fence not to be evaluated between writes, we
3112          * precede the update with write to turn off the fence register,
3113          * and only enable the fence as the last step.
3114          *
3115          * For extra levels of paranoia, we make sure each step lands
3116          * before applying the next step.
3117          */
3118         I915_WRITE(fence_reg, 0);
3119         POSTING_READ(fence_reg);
3120
3121         if (obj) {
3122                 u32 size = i915_gem_obj_ggtt_size(obj);
3123                 uint64_t val;
3124
3125                 /* Adjust fence size to match tiled area */
3126                 if (obj->tiling_mode != I915_TILING_NONE) {
3127                         uint32_t row_size = obj->stride *
3128                                 (obj->tiling_mode == I915_TILING_Y ? 32 : 8);
3129                         size = (size / row_size) * row_size;
3130                 }
3131
3132                 val = (uint64_t)((i915_gem_obj_ggtt_offset(obj) + size - 4096) &
3133                                  0xfffff000) << 32;
3134                 val |= i915_gem_obj_ggtt_offset(obj) & 0xfffff000;
3135                 val |= (uint64_t)((obj->stride / 128) - 1) << fence_pitch_shift;
3136                 if (obj->tiling_mode == I915_TILING_Y)
3137                         val |= 1 << I965_FENCE_TILING_Y_SHIFT;
3138                 val |= I965_FENCE_REG_VALID;
3139
3140                 I915_WRITE(fence_reg + 4, val >> 32);
3141                 POSTING_READ(fence_reg + 4);
3142
3143                 I915_WRITE(fence_reg + 0, val);
3144                 POSTING_READ(fence_reg);
3145         } else {
3146                 I915_WRITE(fence_reg + 4, 0);
3147                 POSTING_READ(fence_reg + 4);
3148         }
3149 }
3150
3151 static void i915_write_fence_reg(struct drm_device *dev, int reg,
3152                                  struct drm_i915_gem_object *obj)
3153 {
3154         struct drm_i915_private *dev_priv = dev->dev_private;
3155         u32 val;
3156
3157         if (obj) {
3158                 u32 size = i915_gem_obj_ggtt_size(obj);
3159                 int pitch_val;
3160                 int tile_width;
3161
3162                 WARN((i915_gem_obj_ggtt_offset(obj) & ~I915_FENCE_START_MASK) ||
3163                      (size & -size) != size ||
3164                      (i915_gem_obj_ggtt_offset(obj) & (size - 1)),
3165                      "object 0x%08lx [fenceable? %d] not 1M or pot-size (0x%08x) aligned\n",
3166                      i915_gem_obj_ggtt_offset(obj), obj->map_and_fenceable, size);
3167
3168                 if (obj->tiling_mode == I915_TILING_Y && HAS_128_BYTE_Y_TILING(dev))
3169                         tile_width = 128;
3170                 else
3171                         tile_width = 512;
3172
3173                 /* Note: pitch better be a power of two tile widths */
3174                 pitch_val = obj->stride / tile_width;
3175                 pitch_val = ffs(pitch_val) - 1;
3176
3177                 val = i915_gem_obj_ggtt_offset(obj);
3178                 if (obj->tiling_mode == I915_TILING_Y)
3179                         val |= 1 << I830_FENCE_TILING_Y_SHIFT;
3180                 val |= I915_FENCE_SIZE_BITS(size);
3181                 val |= pitch_val << I830_FENCE_PITCH_SHIFT;
3182                 val |= I830_FENCE_REG_VALID;
3183         } else
3184                 val = 0;
3185
3186         if (reg < 8)
3187                 reg = FENCE_REG_830_0 + reg * 4;
3188         else
3189                 reg = FENCE_REG_945_8 + (reg - 8) * 4;
3190
3191         I915_WRITE(reg, val);
3192         POSTING_READ(reg);
3193 }
3194
3195 static void i830_write_fence_reg(struct drm_device *dev, int reg,
3196                                 struct drm_i915_gem_object *obj)
3197 {
3198         struct drm_i915_private *dev_priv = dev->dev_private;
3199         uint32_t val;
3200
3201         if (obj) {
3202                 u32 size = i915_gem_obj_ggtt_size(obj);
3203                 uint32_t pitch_val;
3204
3205                 WARN((i915_gem_obj_ggtt_offset(obj) & ~I830_FENCE_START_MASK) ||
3206                      (size & -size) != size ||
3207                      (i915_gem_obj_ggtt_offset(obj) & (size - 1)),
3208                      "object 0x%08lx not 512K or pot-size 0x%08x aligned\n",
3209                      i915_gem_obj_ggtt_offset(obj), size);
3210
3211                 pitch_val = obj->stride / 128;
3212                 pitch_val = ffs(pitch_val) - 1;
3213
3214                 val = i915_gem_obj_ggtt_offset(obj);
3215                 if (obj->tiling_mode == I915_TILING_Y)
3216                         val |= 1 << I830_FENCE_TILING_Y_SHIFT;
3217                 val |= I830_FENCE_SIZE_BITS(size);
3218                 val |= pitch_val << I830_FENCE_PITCH_SHIFT;
3219                 val |= I830_FENCE_REG_VALID;
3220         } else
3221                 val = 0;
3222
3223         I915_WRITE(FENCE_REG_830_0 + reg * 4, val);
3224         POSTING_READ(FENCE_REG_830_0 + reg * 4);
3225 }
3226
3227 inline static bool i915_gem_object_needs_mb(struct drm_i915_gem_object *obj)
3228 {
3229         return obj && obj->base.read_domains & I915_GEM_DOMAIN_GTT;
3230 }
3231
3232 static void i915_gem_write_fence(struct drm_device *dev, int reg,
3233                                  struct drm_i915_gem_object *obj)
3234 {
3235         struct drm_i915_private *dev_priv = dev->dev_private;
3236
3237         /* Ensure that all CPU reads are completed before installing a fence
3238          * and all writes before removing the fence.
3239          */
3240         if (i915_gem_object_needs_mb(dev_priv->fence_regs[reg].obj))
3241                 mb();
3242
3243         WARN(obj && (!obj->stride || !obj->tiling_mode),
3244              "bogus fence setup with stride: 0x%x, tiling mode: %i\n",
3245              obj->stride, obj->tiling_mode);
3246
3247         if (IS_GEN2(dev))
3248                 i830_write_fence_reg(dev, reg, obj);
3249         else if (IS_GEN3(dev))
3250                 i915_write_fence_reg(dev, reg, obj);
3251         else if (INTEL_INFO(dev)->gen >= 4)
3252                 i965_write_fence_reg(dev, reg, obj);
3253
3254         /* And similarly be paranoid that no direct access to this region
3255          * is reordered to before the fence is installed.
3256          */
3257         if (i915_gem_object_needs_mb(obj))
3258                 mb();
3259 }
3260
3261 static inline int fence_number(struct drm_i915_private *dev_priv,
3262                                struct drm_i915_fence_reg *fence)
3263 {
3264         return fence - dev_priv->fence_regs;
3265 }
3266
3267 static void i915_gem_object_update_fence(struct drm_i915_gem_object *obj,
3268                                          struct drm_i915_fence_reg *fence,
3269                                          bool enable)
3270 {
3271         struct drm_i915_private *dev_priv = obj->base.dev->dev_private;
3272         int reg = fence_number(dev_priv, fence);
3273
3274         i915_gem_write_fence(obj->base.dev, reg, enable ? obj : NULL);
3275
3276         if (enable) {
3277                 obj->fence_reg = reg;
3278                 fence->obj = obj;
3279                 list_move_tail(&fence->lru_list, &dev_priv->mm.fence_list);
3280         } else {
3281                 obj->fence_reg = I915_FENCE_REG_NONE;
3282                 fence->obj = NULL;
3283                 list_del_init(&fence->lru_list);
3284         }
3285         obj->fence_dirty = false;
3286 }
3287
3288 static int
3289 i915_gem_object_wait_fence(struct drm_i915_gem_object *obj)
3290 {
3291         if (obj->last_fenced_req) {
3292                 int ret = i915_wait_request(obj->last_fenced_req);
3293                 if (ret)
3294                         return ret;
3295
3296                 i915_gem_request_assign(&obj->last_fenced_req, NULL);
3297         }
3298
3299         return 0;
3300 }
3301
3302 int
3303 i915_gem_object_put_fence(struct drm_i915_gem_object *obj)
3304 {
3305         struct drm_i915_private *dev_priv = obj->base.dev->dev_private;
3306         struct drm_i915_fence_reg *fence;
3307         int ret;
3308
3309         ret = i915_gem_object_wait_fence(obj);
3310         if (ret)
3311                 return ret;
3312
3313         if (obj->fence_reg == I915_FENCE_REG_NONE)
3314                 return 0;
3315
3316         fence = &dev_priv->fence_regs[obj->fence_reg];
3317
3318         if (WARN_ON(fence->pin_count))
3319                 return -EBUSY;
3320
3321         i915_gem_object_fence_lost(obj);
3322         i915_gem_object_update_fence(obj, fence, false);
3323
3324         return 0;
3325 }
3326
3327 static struct drm_i915_fence_reg *
3328 i915_find_fence_reg(struct drm_device *dev)
3329 {
3330         struct drm_i915_private *dev_priv = dev->dev_private;
3331         struct drm_i915_fence_reg *reg, *avail;
3332         int i;
3333
3334         /* First try to find a free reg */
3335         avail = NULL;
3336         for (i = dev_priv->fence_reg_start; i < dev_priv->num_fence_regs; i++) {
3337                 reg = &dev_priv->fence_regs[i];
3338                 if (!reg->obj)
3339                         return reg;
3340
3341                 if (!reg->pin_count)
3342                         avail = reg;
3343         }
3344
3345         if (avail == NULL)
3346                 goto deadlock;
3347
3348         /* None available, try to steal one or wait for a user to finish */
3349         list_for_each_entry(reg, &dev_priv->mm.fence_list, lru_list) {
3350                 if (reg->pin_count)
3351                         continue;
3352
3353                 return reg;
3354         }
3355
3356 deadlock:
3357         /* Wait for completion of pending flips which consume fences */
3358         if (intel_has_pending_fb_unpin(dev))
3359                 return ERR_PTR(-EAGAIN);
3360
3361         return ERR_PTR(-EDEADLK);
3362 }
3363
3364 /**
3365  * i915_gem_object_get_fence - set up fencing for an object
3366  * @obj: object to map through a fence reg
3367  *
3368  * When mapping objects through the GTT, userspace wants to be able to write
3369  * to them without having to worry about swizzling if the object is tiled.
3370  * This function walks the fence regs looking for a free one for @obj,
3371  * stealing one if it can't find any.
3372  *
3373  * It then sets up the reg based on the object's properties: address, pitch
3374  * and tiling format.
3375  *
3376  * For an untiled surface, this removes any existing fence.
3377  */
3378 int
3379 i915_gem_object_get_fence(struct drm_i915_gem_object *obj)
3380 {
3381         struct drm_device *dev = obj->base.dev;
3382         struct drm_i915_private *dev_priv = dev->dev_private;
3383         bool enable = obj->tiling_mode != I915_TILING_NONE;
3384         struct drm_i915_fence_reg *reg;
3385         int ret;
3386
3387         /* Have we updated the tiling parameters upon the object and so
3388          * will need to serialise the write to the associated fence register?
3389          */
3390         if (obj->fence_dirty) {
3391                 ret = i915_gem_object_wait_fence(obj);
3392                 if (ret)
3393                         return ret;
3394         }
3395
3396         /* Just update our place in the LRU if our fence is getting reused. */
3397         if (obj->fence_reg != I915_FENCE_REG_NONE) {
3398                 reg = &dev_priv->fence_regs[obj->fence_reg];
3399                 if (!obj->fence_dirty) {
3400                         list_move_tail(&reg->lru_list,
3401                                        &dev_priv->mm.fence_list);
3402                         return 0;
3403                 }
3404         } else if (enable) {
3405                 if (WARN_ON(!obj->map_and_fenceable))
3406                         return -EINVAL;
3407
3408                 reg = i915_find_fence_reg(dev);
3409                 if (IS_ERR(reg))
3410                         return PTR_ERR(reg);
3411
3412                 if (reg->obj) {
3413                         struct drm_i915_gem_object *old = reg->obj;
3414
3415                         ret = i915_gem_object_wait_fence(old);
3416                         if (ret)
3417                                 return ret;
3418
3419                         i915_gem_object_fence_lost(old);
3420                 }
3421         } else
3422                 return 0;
3423
3424         i915_gem_object_update_fence(obj, reg, enable);
3425
3426         return 0;
3427 }
3428
3429 static bool i915_gem_valid_gtt_space(struct i915_vma *vma,
3430                                      unsigned long cache_level)
3431 {
3432         struct drm_mm_node *gtt_space = &vma->node;
3433         struct drm_mm_node *other;
3434
3435         /*
3436          * On some machines we have to be careful when putting differing types
3437          * of snoopable memory together to avoid the prefetcher crossing memory
3438          * domains and dying. During vm initialisation, we decide whether or not
3439          * these constraints apply and set the drm_mm.color_adjust
3440          * appropriately.
3441          */
3442         if (vma->vm->mm.color_adjust == NULL)
3443                 return true;
3444
3445         if (!drm_mm_node_allocated(gtt_space))
3446                 return true;
3447
3448         if (list_empty(&gtt_space->node_list))
3449                 return true;
3450
3451         other = list_entry(gtt_space->node_list.prev, struct drm_mm_node, node_list);
3452         if (other->allocated && !other->hole_follows && other->color != cache_level)
3453                 return false;
3454
3455         other = list_entry(gtt_space->node_list.next, struct drm_mm_node, node_list);
3456         if (other->allocated && !gtt_space->hole_follows && other->color != cache_level)
3457                 return false;
3458
3459         return true;
3460 }
3461
3462 /**
3463  * Finds free space in the GTT aperture and binds the object there.
3464  */
3465 static struct i915_vma *
3466 i915_gem_object_bind_to_vm(struct drm_i915_gem_object *obj,
3467                            struct i915_address_space *vm,
3468                            const struct i915_ggtt_view *ggtt_view,
3469                            unsigned alignment,
3470                            uint64_t flags)
3471 {
3472         struct drm_device *dev = obj->base.dev;
3473         struct drm_i915_private *dev_priv = dev->dev_private;
3474         u32 size, fence_size, fence_alignment, unfenced_alignment;
3475         unsigned long start =
3476                 flags & PIN_OFFSET_BIAS ? flags & PIN_OFFSET_MASK : 0;
3477         unsigned long end =
3478                 flags & PIN_MAPPABLE ? dev_priv->gtt.mappable_end : vm->total;
3479         struct i915_vma *vma;
3480         int ret;
3481
3482         if(WARN_ON(i915_is_ggtt(vm) != !!ggtt_view))
3483                 return ERR_PTR(-EINVAL);
3484
3485         fence_size = i915_gem_get_gtt_size(dev,
3486                                            obj->base.size,
3487                                            obj->tiling_mode);
3488         fence_alignment = i915_gem_get_gtt_alignment(dev,
3489                                                      obj->base.size,
3490                                                      obj->tiling_mode, true);
3491         unfenced_alignment =
3492                 i915_gem_get_gtt_alignment(dev,
3493                                            obj->base.size,
3494                                            obj->tiling_mode, false);
3495
3496         if (alignment == 0)
3497                 alignment = flags & PIN_MAPPABLE ? fence_alignment :
3498                                                 unfenced_alignment;
3499         if (flags & PIN_MAPPABLE && alignment & (fence_alignment - 1)) {
3500                 DRM_DEBUG("Invalid object alignment requested %u\n", alignment);
3501                 return ERR_PTR(-EINVAL);
3502         }
3503
3504         size = flags & PIN_MAPPABLE ? fence_size : obj->base.size;
3505
3506         /* If the object is bigger than the entire aperture, reject it early
3507          * before evicting everything in a vain attempt to find space.
3508          */
3509         if (obj->base.size > end) {
3510                 DRM_DEBUG("Attempting to bind an object larger than the aperture: object=%zd > %s aperture=%lu\n",
3511                           obj->base.size,
3512                           flags & PIN_MAPPABLE ? "mappable" : "total",
3513                           end);
3514                 return ERR_PTR(-E2BIG);
3515         }
3516
3517         ret = i915_gem_object_get_pages(obj);
3518         if (ret)
3519                 return ERR_PTR(ret);
3520
3521         i915_gem_object_pin_pages(obj);
3522
3523         vma = ggtt_view ? i915_gem_obj_lookup_or_create_ggtt_vma(obj, ggtt_view) :
3524                           i915_gem_obj_lookup_or_create_vma(obj, vm);
3525
3526         if (IS_ERR(vma))
3527                 goto err_unpin;
3528
3529 search_free:
3530         ret = drm_mm_insert_node_in_range_generic(&vm->mm, &vma->node,
3531                                                   size, alignment,
3532                                                   obj->cache_level,
3533                                                   start, end,
3534                                                   DRM_MM_SEARCH_DEFAULT,
3535                                                   DRM_MM_CREATE_DEFAULT);
3536         if (ret) {
3537                 ret = i915_gem_evict_something(dev, vm, size, alignment,
3538                                                obj->cache_level,
3539                                                start, end,
3540                                                flags);
3541                 if (ret == 0)
3542                         goto search_free;
3543
3544                 goto err_free_vma;
3545         }
3546         if (WARN_ON(!i915_gem_valid_gtt_space(vma, obj->cache_level))) {
3547                 ret = -EINVAL;
3548                 goto err_remove_node;
3549         }
3550
3551         ret = i915_gem_gtt_prepare_object(obj);
3552         if (ret)
3553                 goto err_remove_node;
3554
3555         /*  allocate before insert / bind */
3556         if (vma->vm->allocate_va_range) {
3557                 trace_i915_va_alloc(vma->vm, vma->node.start, vma->node.size,
3558                                 VM_TO_TRACE_NAME(vma->vm));
3559                 ret = vma->vm->allocate_va_range(vma->vm,
3560                                                 vma->node.start,
3561                                                 vma->node.size);
3562                 if (ret)
3563                         goto err_remove_node;
3564         }
3565
3566         trace_i915_vma_bind(vma, flags);
3567         ret = i915_vma_bind(vma, obj->cache_level,
3568                             flags & PIN_GLOBAL ? GLOBAL_BIND : 0);
3569         if (ret)
3570                 goto err_finish_gtt;
3571
3572         list_move_tail(&obj->global_list, &dev_priv->mm.bound_list);
3573         list_add_tail(&vma->mm_list, &vm->inactive_list);
3574
3575         return vma;
3576
3577 err_finish_gtt:
3578         i915_gem_gtt_finish_object(obj);
3579 err_remove_node:
3580         drm_mm_remove_node(&vma->node);
3581 err_free_vma:
3582         i915_gem_vma_destroy(vma);
3583         vma = ERR_PTR(ret);
3584 err_unpin:
3585         i915_gem_object_unpin_pages(obj);
3586         return vma;
3587 }
3588
3589 bool
3590 i915_gem_clflush_object(struct drm_i915_gem_object *obj,
3591                         bool force)
3592 {
3593         /* If we don't have a page list set up, then we're not pinned
3594          * to GPU, and we can ignore the cache flush because it'll happen
3595          * again at bind time.
3596          */
3597         if (obj->pages == NULL)
3598                 return false;
3599
3600         /*
3601          * Stolen memory is always coherent with the GPU as it is explicitly
3602          * marked as wc by the system, or the system is cache-coherent.
3603          */
3604         if (obj->stolen || obj->phys_handle)
3605                 return false;
3606
3607         /* If the GPU is snooping the contents of the CPU cache,
3608          * we do not need to manually clear the CPU cache lines.  However,
3609          * the caches are only snooped when the render cache is
3610          * flushed/invalidated.  As we always have to emit invalidations
3611          * and flushes when moving into and out of the RENDER domain, correct
3612          * snooping behaviour occurs naturally as the result of our domain
3613          * tracking.
3614          */
3615         if (!force && cpu_cache_is_coherent(obj->base.dev, obj->cache_level)) {
3616                 obj->cache_dirty = true;
3617                 return false;
3618         }
3619
3620         trace_i915_gem_object_clflush(obj);
3621         drm_clflush_sg(obj->pages);
3622         obj->cache_dirty = false;
3623
3624         return true;
3625 }
3626
3627 /** Flushes the GTT write domain for the object if it's dirty. */
3628 static void
3629 i915_gem_object_flush_gtt_write_domain(struct drm_i915_gem_object *obj)
3630 {
3631         uint32_t old_write_domain;
3632
3633         if (obj->base.write_domain != I915_GEM_DOMAIN_GTT)
3634                 return;
3635
3636         /* No actual flushing is required for the GTT write domain.  Writes
3637          * to it immediately go to main memory as far as we know, so there's
3638          * no chipset flush.  It also doesn't land in render cache.
3639          *
3640          * However, we do have to enforce the order so that all writes through
3641          * the GTT land before any writes to the device, such as updates to
3642          * the GATT itself.
3643          */
3644         wmb();
3645
3646         old_write_domain = obj->base.write_domain;
3647         obj->base.write_domain = 0;
3648
3649         intel_fb_obj_flush(obj, false);
3650
3651         trace_i915_gem_object_change_domain(obj,
3652                                             obj->base.read_domains,
3653                                             old_write_domain);
3654 }
3655
3656 /** Flushes the CPU write domain for the object if it's dirty. */
3657 static void
3658 i915_gem_object_flush_cpu_write_domain(struct drm_i915_gem_object *obj)
3659 {
3660         uint32_t old_write_domain;
3661
3662         if (obj->base.write_domain != I915_GEM_DOMAIN_CPU)
3663                 return;
3664
3665         if (i915_gem_clflush_object(obj, obj->pin_display))
3666                 i915_gem_chipset_flush(obj->base.dev);
3667
3668         old_write_domain = obj->base.write_domain;
3669         obj->base.write_domain = 0;
3670
3671         intel_fb_obj_flush(obj, false);
3672
3673         trace_i915_gem_object_change_domain(obj,
3674                                             obj->base.read_domains,
3675                                             old_write_domain);
3676 }
3677
3678 /**
3679  * Moves a single object to the GTT read, and possibly write domain.
3680  *
3681  * This function returns when the move is complete, including waiting on
3682  * flushes to occur.
3683  */
3684 int
3685 i915_gem_object_set_to_gtt_domain(struct drm_i915_gem_object *obj, bool write)
3686 {
3687         uint32_t old_write_domain, old_read_domains;
3688         struct i915_vma *vma;
3689         int ret;
3690
3691         if (obj->base.write_domain == I915_GEM_DOMAIN_GTT)
3692                 return 0;
3693
3694         ret = i915_gem_object_wait_rendering(obj, !write);
3695         if (ret)
3696                 return ret;
3697
3698         i915_gem_object_retire(obj);
3699
3700         /* Flush and acquire obj->pages so that we are coherent through
3701          * direct access in memory with previous cached writes through
3702          * shmemfs and that our cache domain tracking remains valid.
3703          * For example, if the obj->filp was moved to swap without us
3704          * being notified and releasing the pages, we would mistakenly
3705          * continue to assume that the obj remained out of the CPU cached
3706          * domain.
3707          */
3708         ret = i915_gem_object_get_pages(obj);
3709         if (ret)
3710                 return ret;
3711
3712         i915_gem_object_flush_cpu_write_domain(obj);
3713
3714         /* Serialise direct access to this object with the barriers for
3715          * coherent writes from the GPU, by effectively invalidating the
3716          * GTT domain upon first access.
3717          */
3718         if ((obj->base.read_domains & I915_GEM_DOMAIN_GTT) == 0)
3719                 mb();
3720
3721         old_write_domain = obj->base.write_domain;
3722         old_read_domains = obj->base.read_domains;
3723
3724         /* It should now be out of any other write domains, and we can update
3725          * the domain values for our changes.
3726          */
3727         BUG_ON((obj->base.write_domain & ~I915_GEM_DOMAIN_GTT) != 0);
3728         obj->base.read_domains |= I915_GEM_DOMAIN_GTT;
3729         if (write) {
3730                 obj->base.read_domains = I915_GEM_DOMAIN_GTT;
3731                 obj->base.write_domain = I915_GEM_DOMAIN_GTT;
3732                 obj->dirty = 1;
3733         }
3734
3735         if (write)
3736                 intel_fb_obj_invalidate(obj, NULL, ORIGIN_GTT);
3737
3738         trace_i915_gem_object_change_domain(obj,
3739                                             old_read_domains,
3740                                             old_write_domain);
3741
3742         /* And bump the LRU for this access */
3743         vma = i915_gem_obj_to_ggtt(obj);
3744         if (vma && drm_mm_node_allocated(&vma->node) && !obj->active)
3745                 list_move_tail(&vma->mm_list,
3746                                &to_i915(obj->base.dev)->gtt.base.inactive_list);
3747
3748         return 0;
3749 }
3750
3751 int i915_gem_object_set_cache_level(struct drm_i915_gem_object *obj,
3752                                     enum i915_cache_level cache_level)
3753 {
3754         struct drm_device *dev = obj->base.dev;
3755         struct i915_vma *vma, *next;
3756         int ret;
3757
3758         if (obj->cache_level == cache_level)
3759                 return 0;
3760
3761         if (i915_gem_obj_is_pinned(obj)) {
3762                 DRM_DEBUG("can not change the cache level of pinned objects\n");
3763                 return -EBUSY;
3764         }
3765
3766         list_for_each_entry_safe(vma, next, &obj->vma_list, vma_link) {
3767                 if (!i915_gem_valid_gtt_space(vma, cache_level)) {
3768                         ret = i915_vma_unbind(vma);
3769                         if (ret)
3770                                 return ret;
3771                 }
3772         }
3773
3774         if (i915_gem_obj_bound_any(obj)) {
3775                 ret = i915_gem_object_finish_gpu(obj);
3776                 if (ret)
3777                         return ret;
3778
3779                 i915_gem_object_finish_gtt(obj);
3780
3781                 /* Before SandyBridge, you could not use tiling or fence
3782                  * registers with snooped memory, so relinquish any fences
3783                  * currently pointing to our region in the aperture.
3784                  */
3785                 if (INTEL_INFO(dev)->gen < 6) {
3786                         ret = i915_gem_object_put_fence(obj);
3787                         if (ret)
3788                                 return ret;
3789                 }
3790
3791                 list_for_each_entry(vma, &obj->vma_list, vma_link)
3792                         if (drm_mm_node_allocated(&vma->node)) {
3793                                 ret = i915_vma_bind(vma, cache_level,
3794                                                     vma->bound & GLOBAL_BIND);
3795                                 if (ret)
3796                                         return ret;
3797                         }
3798         }
3799
3800         list_for_each_entry(vma, &obj->vma_list, vma_link)
3801                 vma->node.color = cache_level;
3802         obj->cache_level = cache_level;
3803
3804         if (obj->cache_dirty &&
3805             obj->base.write_domain != I915_GEM_DOMAIN_CPU &&
3806             cpu_write_needs_clflush(obj)) {
3807                 if (i915_gem_clflush_object(obj, true))
3808                         i915_gem_chipset_flush(obj->base.dev);
3809         }
3810
3811         return 0;
3812 }
3813
3814 int i915_gem_get_caching_ioctl(struct drm_device *dev, void *data,
3815                                struct drm_file *file)
3816 {
3817         struct drm_i915_gem_caching *args = data;
3818         struct drm_i915_gem_object *obj;
3819         int ret;
3820
3821         ret = i915_mutex_lock_interruptible(dev);
3822         if (ret)
3823                 return ret;
3824
3825         obj = to_intel_bo(drm_gem_object_lookup(dev, file, args->handle));
3826         if (&obj->base == NULL) {
3827                 ret = -ENOENT;
3828                 goto unlock;
3829         }
3830
3831         switch (obj->cache_level) {
3832         case I915_CACHE_LLC:
3833         case I915_CACHE_L3_LLC:
3834                 args->caching = I915_CACHING_CACHED;
3835                 break;
3836
3837         case I915_CACHE_WT:
3838                 args->caching = I915_CACHING_DISPLAY;
3839                 break;
3840
3841         default:
3842                 args->caching = I915_CACHING_NONE;
3843                 break;
3844         }
3845
3846         drm_gem_object_unreference(&obj->base);
3847 unlock:
3848         mutex_unlock(&dev->struct_mutex);
3849         return ret;
3850 }
3851
3852 int i915_gem_set_caching_ioctl(struct drm_device *dev, void *data,
3853                                struct drm_file *file)
3854 {
3855         struct drm_i915_gem_caching *args = data;
3856         struct drm_i915_gem_object *obj;
3857         enum i915_cache_level level;
3858         int ret;
3859
3860         switch (args->caching) {
3861         case I915_CACHING_NONE:
3862                 level = I915_CACHE_NONE;
3863                 break;
3864         case I915_CACHING_CACHED:
3865                 level = I915_CACHE_LLC;
3866                 break;
3867         case I915_CACHING_DISPLAY:
3868                 level = HAS_WT(dev) ? I915_CACHE_WT : I915_CACHE_NONE;
3869                 break;
3870         default:
3871                 return -EINVAL;
3872         }
3873
3874         ret = i915_mutex_lock_interruptible(dev);
3875         if (ret)
3876                 return ret;
3877
3878         obj = to_intel_bo(drm_gem_object_lookup(dev, file, args->handle));
3879         if (&obj->base == NULL) {
3880                 ret = -ENOENT;
3881                 goto unlock;
3882         }
3883
3884         ret = i915_gem_object_set_cache_level(obj, level);
3885
3886         drm_gem_object_unreference(&obj->base);
3887 unlock:
3888         mutex_unlock(&dev->struct_mutex);
3889         return ret;
3890 }
3891
3892 static bool is_pin_display(struct drm_i915_gem_object *obj)
3893 {
3894         struct i915_vma *vma;
3895
3896         vma = i915_gem_obj_to_ggtt(obj);
3897         if (!vma)
3898                 return false;
3899
3900         /* There are 2 sources that pin objects:
3901          *   1. The display engine (scanouts, sprites, cursors);
3902          *   2. Reservations for execbuffer;
3903          *
3904          * We can ignore reservations as we hold the struct_mutex and
3905          * are only called outside of the reservation path.
3906          */
3907         return vma->pin_count;
3908 }
3909
3910 /*
3911  * Prepare buffer for display plane (scanout, cursors, etc).
3912  * Can be called from an uninterruptible phase (modesetting) and allows
3913  * any flushes to be pipelined (for pageflips).
3914  */
3915 int
3916 i915_gem_object_pin_to_display_plane(struct drm_i915_gem_object *obj,
3917                                      u32 alignment,
3918                                      struct intel_engine_cs *pipelined,
3919                                      const struct i915_ggtt_view *view)
3920 {
3921         u32 old_read_domains, old_write_domain;
3922         bool was_pin_display;
3923         int ret;
3924
3925         if (pipelined != i915_gem_request_get_ring(obj->last_read_req)) {
3926                 ret = i915_gem_object_sync(obj, pipelined);
3927                 if (ret)
3928                         return ret;
3929         }
3930
3931         /* Mark the pin_display early so that we account for the
3932          * display coherency whilst setting up the cache domains.
3933          */
3934         was_pin_display = obj->pin_display;
3935         obj->pin_display = true;
3936
3937         /* The display engine is not coherent with the LLC cache on gen6.  As
3938          * a result, we make sure that the pinning that is about to occur is
3939          * done with uncached PTEs. This is lowest common denominator for all
3940          * chipsets.
3941          *
3942          * However for gen6+, we could do better by using the GFDT bit instead
3943          * of uncaching, which would allow us to flush all the LLC-cached data
3944          * with that bit in the PTE to main memory with just one PIPE_CONTROL.
3945          */
3946         ret = i915_gem_object_set_cache_level(obj,
3947                                               HAS_WT(obj->base.dev) ? I915_CACHE_WT : I915_CACHE_NONE);
3948         if (ret)
3949                 goto err_unpin_display;
3950
3951         /* As the user may map the buffer once pinned in the display plane
3952          * (e.g. libkms for the bootup splash), we have to ensure that we
3953          * always use map_and_fenceable for all scanout buffers.
3954          */
3955         ret = i915_gem_object_ggtt_pin(obj, view, alignment,
3956                                        view->type == I915_GGTT_VIEW_NORMAL ?
3957                                        PIN_MAPPABLE : 0);
3958         if (ret)
3959                 goto err_unpin_display;
3960
3961         i915_gem_object_flush_cpu_write_domain(obj);
3962
3963         old_write_domain = obj->base.write_domain;
3964         old_read_domains = obj->base.read_domains;
3965
3966         /* It should now be out of any other write domains, and we can update
3967          * the domain values for our changes.
3968          */
3969         obj->base.write_domain = 0;
3970         obj->base.read_domains |= I915_GEM_DOMAIN_GTT;
3971
3972         trace_i915_gem_object_change_domain(obj,
3973                                             old_read_domains,
3974                                             old_write_domain);
3975
3976         return 0;
3977
3978 err_unpin_display:
3979         WARN_ON(was_pin_display != is_pin_display(obj));
3980         obj->pin_display = was_pin_display;
3981         return ret;
3982 }
3983
3984 void
3985 i915_gem_object_unpin_from_display_plane(struct drm_i915_gem_object *obj,
3986                                          const struct i915_ggtt_view *view)
3987 {
3988         i915_gem_object_ggtt_unpin_view(obj, view);
3989
3990         obj->pin_display = is_pin_display(obj);
3991 }
3992
3993 int
3994 i915_gem_object_finish_gpu(struct drm_i915_gem_object *obj)
3995 {
3996         int ret;
3997
3998         if ((obj->base.read_domains & I915_GEM_GPU_DOMAINS) == 0)
3999                 return 0;
4000
4001         ret = i915_gem_object_wait_rendering(obj, false);
4002         if (ret)
4003                 return ret;
4004
4005         /* Ensure that we invalidate the GPU's caches and TLBs. */
4006         obj->base.read_domains &= ~I915_GEM_GPU_DOMAINS;
4007         return 0;
4008 }
4009
4010 /**
4011  * Moves a single object to the CPU read, and possibly write domain.
4012  *
4013  * This function returns when the move is complete, including waiting on
4014  * flushes to occur.
4015  */
4016 int
4017 i915_gem_object_set_to_cpu_domain(struct drm_i915_gem_object *obj, bool write)
4018 {
4019         uint32_t old_write_domain, old_read_domains;
4020         int ret;
4021
4022         if (obj->base.write_domain == I915_GEM_DOMAIN_CPU)
4023                 return 0;
4024
4025         ret = i915_gem_object_wait_rendering(obj, !write);
4026         if (ret)
4027                 return ret;
4028
4029         i915_gem_object_retire(obj);
4030         i915_gem_object_flush_gtt_write_domain(obj);
4031
4032         old_write_domain = obj->base.write_domain;
4033         old_read_domains = obj->base.read_domains;
4034
4035         /* Flush the CPU cache if it's still invalid. */
4036         if ((obj->base.read_domains & I915_GEM_DOMAIN_CPU) == 0) {
4037                 i915_gem_clflush_object(obj, false);
4038
4039                 obj->base.read_domains |= I915_GEM_DOMAIN_CPU;
4040         }
4041
4042         /* It should now be out of any other write domains, and we can update
4043          * the domain values for our changes.
4044          */
4045         BUG_ON((obj->base.write_domain & ~I915_GEM_DOMAIN_CPU) != 0);
4046
4047         /* If we're writing through the CPU, then the GPU read domains will
4048          * need to be invalidated at next use.
4049          */
4050         if (write) {
4051                 obj->base.read_domains = I915_GEM_DOMAIN_CPU;
4052                 obj->base.write_domain = I915_GEM_DOMAIN_CPU;
4053         }
4054
4055         if (write)
4056                 intel_fb_obj_invalidate(obj, NULL, ORIGIN_CPU);
4057
4058         trace_i915_gem_object_change_domain(obj,
4059                                             old_read_domains,
4060                                             old_write_domain);
4061
4062         return 0;
4063 }
4064
4065 /* Throttle our rendering by waiting until the ring has completed our requests
4066  * emitted over 20 msec ago.
4067  *
4068  * Note that if we were to use the current jiffies each time around the loop,
4069  * we wouldn't escape the function with any frames outstanding if the time to
4070  * render a frame was over 20ms.
4071  *
4072  * This should get us reasonable parallelism between CPU and GPU but also
4073  * relatively low latency when blocking on a particular request to finish.
4074  */
4075 static int
4076 i915_gem_ring_throttle(struct drm_device *dev, struct drm_file *file)
4077 {
4078         struct drm_i915_private *dev_priv = dev->dev_private;
4079         struct drm_i915_file_private *file_priv = file->driver_priv;
4080         unsigned long recent_enough = jiffies - msecs_to_jiffies(20);
4081         struct drm_i915_gem_request *request, *target = NULL;
4082         unsigned reset_counter;
4083         int ret;
4084
4085         ret = i915_gem_wait_for_error(&dev_priv->gpu_error);
4086         if (ret)
4087                 return ret;
4088
4089         ret = i915_gem_check_wedge(&dev_priv->gpu_error, false);
4090         if (ret)
4091                 return ret;
4092
4093         spin_lock(&file_priv->mm.lock);
4094         list_for_each_entry(request, &file_priv->mm.request_list, client_list) {
4095                 if (time_after_eq(request->emitted_jiffies, recent_enough))
4096                         break;
4097
4098                 target = request;
4099         }
4100         reset_counter = atomic_read(&dev_priv->gpu_error.reset_counter);
4101         if (target)
4102                 i915_gem_request_reference(target);
4103         spin_unlock(&file_priv->mm.lock);
4104
4105         if (target == NULL)
4106                 return 0;
4107
4108         ret = __i915_wait_request(target, reset_counter, true, NULL, NULL);
4109         if (ret == 0)
4110                 queue_delayed_work(dev_priv->wq, &dev_priv->mm.retire_work, 0);
4111
4112         i915_gem_request_unreference__unlocked(target);
4113
4114         return ret;
4115 }
4116
4117 static bool
4118 i915_vma_misplaced(struct i915_vma *vma, uint32_t alignment, uint64_t flags)
4119 {
4120         struct drm_i915_gem_object *obj = vma->obj;
4121
4122         if (alignment &&
4123             vma->node.start & (alignment - 1))
4124                 return true;
4125
4126         if (flags & PIN_MAPPABLE && !obj->map_and_fenceable)
4127                 return true;
4128
4129         if (flags & PIN_OFFSET_BIAS &&
4130             vma->node.start < (flags & PIN_OFFSET_MASK))
4131                 return true;
4132
4133         return false;
4134 }
4135
4136 static int
4137 i915_gem_object_do_pin(struct drm_i915_gem_object *obj,
4138                        struct i915_address_space *vm,
4139                        const struct i915_ggtt_view *ggtt_view,
4140                        uint32_t alignment,
4141                        uint64_t flags)
4142 {
4143         struct drm_i915_private *dev_priv = obj->base.dev->dev_private;
4144         struct i915_vma *vma;
4145         unsigned bound;
4146         int ret;
4147
4148         if (WARN_ON(vm == &dev_priv->mm.aliasing_ppgtt->base))
4149                 return -ENODEV;
4150
4151         if (WARN_ON(flags & (PIN_GLOBAL | PIN_MAPPABLE) && !i915_is_ggtt(vm)))
4152                 return -EINVAL;
4153
4154         if (WARN_ON((flags & (PIN_MAPPABLE | PIN_GLOBAL)) == PIN_MAPPABLE))
4155                 return -EINVAL;
4156
4157         if (WARN_ON(i915_is_ggtt(vm) != !!ggtt_view))
4158                 return -EINVAL;
4159
4160         vma = ggtt_view ? i915_gem_obj_to_ggtt_view(obj, ggtt_view) :
4161                           i915_gem_obj_to_vma(obj, vm);
4162
4163         if (IS_ERR(vma))
4164                 return PTR_ERR(vma);
4165
4166         if (vma) {
4167                 if (WARN_ON(vma->pin_count == DRM_I915_GEM_OBJECT_MAX_PIN_COUNT))
4168                         return -EBUSY;
4169
4170                 if (i915_vma_misplaced(vma, alignment, flags)) {
4171                         unsigned long offset;
4172                         offset = ggtt_view ? i915_gem_obj_ggtt_offset_view(obj, ggtt_view) :
4173                                              i915_gem_obj_offset(obj, vm);
4174                         WARN(vma->pin_count,
4175                              "bo is already pinned in %s with incorrect alignment:"
4176                              " offset=%lx, req.alignment=%x, req.map_and_fenceable=%d,"
4177                              " obj->map_and_fenceable=%d\n",
4178                              ggtt_view ? "ggtt" : "ppgtt",
4179                              offset,
4180                              alignment,
4181                              !!(flags & PIN_MAPPABLE),
4182                              obj->map_and_fenceable);
4183                         ret = i915_vma_unbind(vma);
4184                         if (ret)
4185                                 return ret;
4186
4187                         vma = NULL;
4188                 }
4189         }
4190
4191         bound = vma ? vma->bound : 0;
4192         if (vma == NULL || !drm_mm_node_allocated(&vma->node)) {
4193                 /* In true PPGTT, bind has possibly changed PDEs, which
4194                  * means we must do a context switch before the GPU can
4195                  * accurately read some of the VMAs.
4196                  */
4197                 vma = i915_gem_object_bind_to_vm(obj, vm, ggtt_view, alignment,
4198                                                  flags);
4199                 if (IS_ERR(vma))
4200                         return PTR_ERR(vma);
4201         }
4202
4203         if (flags & PIN_GLOBAL && !(vma->bound & GLOBAL_BIND)) {
4204                 ret = i915_vma_bind(vma, obj->cache_level, GLOBAL_BIND);
4205                 if (ret)
4206                         return ret;
4207         }
4208
4209         if ((bound ^ vma->bound) & GLOBAL_BIND) {
4210                 bool mappable, fenceable;
4211                 u32 fence_size, fence_alignment;
4212
4213                 fence_size = i915_gem_get_gtt_size(obj->base.dev,
4214                                                    obj->base.size,
4215                                                    obj->tiling_mode);
4216                 fence_alignment = i915_gem_get_gtt_alignment(obj->base.dev,
4217                                                              obj->base.size,
4218                                                              obj->tiling_mode,
4219                                                              true);
4220
4221                 fenceable = (vma->node.size == fence_size &&
4222                              (vma->node.start & (fence_alignment - 1)) == 0);
4223
4224                 mappable = (vma->node.start + fence_size <=
4225                             dev_priv->gtt.mappable_end);
4226
4227                 obj->map_and_fenceable = mappable && fenceable;
4228         }
4229
4230         WARN_ON(flags & PIN_MAPPABLE && !obj->map_and_fenceable);
4231
4232         vma->pin_count++;
4233         if (flags & PIN_MAPPABLE)
4234                 obj->pin_mappable |= true;
4235
4236         return 0;
4237 }
4238
4239 int
4240 i915_gem_object_pin(struct drm_i915_gem_object *obj,
4241                     struct i915_address_space *vm,
4242                     uint32_t alignment,
4243                     uint64_t flags)
4244 {
4245         return i915_gem_object_do_pin(obj, vm,
4246                                       i915_is_ggtt(vm) ? &i915_ggtt_view_normal : NULL,
4247                                       alignment, flags);
4248 }
4249
4250 int
4251 i915_gem_object_ggtt_pin(struct drm_i915_gem_object *obj,
4252                          const struct i915_ggtt_view *view,
4253                          uint32_t alignment,
4254                          uint64_t flags)
4255 {
4256         if (WARN_ONCE(!view, "no view specified"))
4257                 return -EINVAL;
4258
4259         return i915_gem_object_do_pin(obj, i915_obj_to_ggtt(obj), view,
4260                                       alignment, flags | PIN_GLOBAL);
4261 }
4262
4263 void
4264 i915_gem_object_ggtt_unpin_view(struct drm_i915_gem_object *obj,
4265                                 const struct i915_ggtt_view *view)
4266 {
4267         struct i915_vma *vma = i915_gem_obj_to_ggtt_view(obj, view);
4268
4269         BUG_ON(!vma);
4270         WARN_ON(vma->pin_count == 0);
4271         WARN_ON(!i915_gem_obj_ggtt_bound_view(obj, view));
4272
4273         if (--vma->pin_count == 0 && view->type == I915_GGTT_VIEW_NORMAL)
4274                 obj->pin_mappable = false;
4275 }
4276
4277 bool
4278 i915_gem_object_pin_fence(struct drm_i915_gem_object *obj)
4279 {
4280         if (obj->fence_reg != I915_FENCE_REG_NONE) {
4281                 struct drm_i915_private *dev_priv = obj->base.dev->dev_private;
4282                 struct i915_vma *ggtt_vma = i915_gem_obj_to_ggtt(obj);
4283
4284                 WARN_ON(!ggtt_vma ||
4285                         dev_priv->fence_regs[obj->fence_reg].pin_count >
4286                         ggtt_vma->pin_count);
4287                 dev_priv->fence_regs[obj->fence_reg].pin_count++;
4288                 return true;
4289         } else
4290                 return false;
4291 }
4292
4293 void
4294 i915_gem_object_unpin_fence(struct drm_i915_gem_object *obj)
4295 {
4296         if (obj->fence_reg != I915_FENCE_REG_NONE) {
4297                 struct drm_i915_private *dev_priv = obj->base.dev->dev_private;
4298                 WARN_ON(dev_priv->fence_regs[obj->fence_reg].pin_count <= 0);
4299                 dev_priv->fence_regs[obj->fence_reg].pin_count--;
4300         }
4301 }
4302
4303 int
4304 i915_gem_busy_ioctl(struct drm_device *dev, void *data,
4305                     struct drm_file *file)
4306 {
4307         struct drm_i915_gem_busy *args = data;
4308         struct drm_i915_gem_object *obj;
4309         int ret;
4310
4311         ret = i915_mutex_lock_interruptible(dev);
4312         if (ret)
4313                 return ret;
4314
4315         obj = to_intel_bo(drm_gem_object_lookup(dev, file, args->handle));
4316         if (&obj->base == NULL) {
4317                 ret = -ENOENT;
4318                 goto unlock;
4319         }
4320
4321         /* Count all active objects as busy, even if they are currently not used
4322          * by the gpu. Users of this interface expect objects to eventually
4323          * become non-busy without any further actions, therefore emit any
4324          * necessary flushes here.
4325          */
4326         ret = i915_gem_object_flush_active(obj);
4327
4328         args->busy = obj->active;
4329         if (obj->last_read_req) {
4330                 struct intel_engine_cs *ring;
4331                 BUILD_BUG_ON(I915_NUM_RINGS > 16);
4332                 ring = i915_gem_request_get_ring(obj->last_read_req);
4333                 args->busy |= intel_ring_flag(ring) << 16;
4334         }
4335
4336         drm_gem_object_unreference(&obj->base);
4337 unlock:
4338         mutex_unlock(&dev->struct_mutex);
4339         return ret;
4340 }
4341
4342 int
4343 i915_gem_throttle_ioctl(struct drm_device *dev, void *data,
4344                         struct drm_file *file_priv)
4345 {
4346         return i915_gem_ring_throttle(dev, file_priv);
4347 }
4348
4349 int
4350 i915_gem_madvise_ioctl(struct drm_device *dev, void *data,
4351                        struct drm_file *file_priv)
4352 {
4353         struct drm_i915_private *dev_priv = dev->dev_private;
4354         struct drm_i915_gem_madvise *args = data;
4355         struct drm_i915_gem_object *obj;
4356         int ret;
4357
4358         switch (args->madv) {
4359         case I915_MADV_DONTNEED:
4360         case I915_MADV_WILLNEED:
4361             break;
4362         default:
4363             return -EINVAL;
4364         }
4365
4366         ret = i915_mutex_lock_interruptible(dev);
4367         if (ret)
4368                 return ret;
4369
4370         obj = to_intel_bo(drm_gem_object_lookup(dev, file_priv, args->handle));
4371         if (&obj->base == NULL) {
4372                 ret = -ENOENT;
4373                 goto unlock;
4374         }
4375
4376         if (i915_gem_obj_is_pinned(obj)) {
4377                 ret = -EINVAL;
4378                 goto out;
4379         }
4380
4381         if (obj->pages &&
4382             obj->tiling_mode != I915_TILING_NONE &&
4383             dev_priv->quirks & QUIRK_PIN_SWIZZLED_PAGES) {
4384                 if (obj->madv == I915_MADV_WILLNEED)
4385                         i915_gem_object_unpin_pages(obj);
4386                 if (args->madv == I915_MADV_WILLNEED)
4387                         i915_gem_object_pin_pages(obj);
4388         }
4389
4390         if (obj->madv != __I915_MADV_PURGED)
4391                 obj->madv = args->madv;
4392
4393         /* if the object is no longer attached, discard its backing storage */
4394         if (obj->madv == I915_MADV_DONTNEED && obj->pages == NULL)
4395                 i915_gem_object_truncate(obj);
4396
4397         args->retained = obj->madv != __I915_MADV_PURGED;
4398
4399 out:
4400         drm_gem_object_unreference(&obj->base);
4401 unlock:
4402         mutex_unlock(&dev->struct_mutex);
4403         return ret;
4404 }
4405
4406 void i915_gem_object_init(struct drm_i915_gem_object *obj,
4407                           const struct drm_i915_gem_object_ops *ops)
4408 {
4409         INIT_LIST_HEAD(&obj->global_list);
4410         INIT_LIST_HEAD(&obj->ring_list);
4411         INIT_LIST_HEAD(&obj->obj_exec_link);
4412         INIT_LIST_HEAD(&obj->vma_list);
4413         INIT_LIST_HEAD(&obj->batch_pool_link);
4414
4415         obj->ops = ops;
4416
4417         obj->fence_reg = I915_FENCE_REG_NONE;
4418         obj->madv = I915_MADV_WILLNEED;
4419
4420         i915_gem_info_add_obj(obj->base.dev->dev_private, obj->base.size);
4421 }
4422
4423 static const struct drm_i915_gem_object_ops i915_gem_object_ops = {
4424         .get_pages = i915_gem_object_get_pages_gtt,
4425         .put_pages = i915_gem_object_put_pages_gtt,
4426 };
4427
4428 struct drm_i915_gem_object *i915_gem_alloc_object(struct drm_device *dev,
4429                                                   size_t size)
4430 {
4431         struct drm_i915_gem_object *obj;
4432         struct address_space *mapping;
4433         gfp_t mask;
4434
4435         obj = i915_gem_object_alloc(dev);
4436         if (obj == NULL)
4437                 return NULL;
4438
4439         if (drm_gem_object_init(dev, &obj->base, size) != 0) {
4440                 i915_gem_object_free(obj);
4441                 return NULL;
4442         }
4443
4444         mask = GFP_HIGHUSER | __GFP_RECLAIMABLE;
4445         if (IS_CRESTLINE(dev) || IS_BROADWATER(dev)) {
4446                 /* 965gm cannot relocate objects above 4GiB. */
4447                 mask &= ~__GFP_HIGHMEM;
4448                 mask |= __GFP_DMA32;
4449         }
4450
4451         mapping = file_inode(obj->base.filp)->i_mapping;
4452         mapping_set_gfp_mask(mapping, mask);
4453
4454         i915_gem_object_init(obj, &i915_gem_object_ops);
4455
4456         obj->base.write_domain = I915_GEM_DOMAIN_CPU;
4457         obj->base.read_domains = I915_GEM_DOMAIN_CPU;
4458
4459         if (HAS_LLC(dev)) {
4460                 /* On some devices, we can have the GPU use the LLC (the CPU
4461                  * cache) for about a 10% performance improvement
4462                  * compared to uncached.  Graphics requests other than
4463                  * display scanout are coherent with the CPU in
4464                  * accessing this cache.  This means in this mode we
4465                  * don't need to clflush on the CPU side, and on the
4466                  * GPU side we only need to flush internal caches to
4467                  * get data visible to the CPU.
4468                  *
4469                  * However, we maintain the display planes as UC, and so
4470                  * need to rebind when first used as such.
4471                  */
4472                 obj->cache_level = I915_CACHE_LLC;
4473         } else
4474                 obj->cache_level = I915_CACHE_NONE;
4475
4476         trace_i915_gem_object_create(obj);
4477
4478         return obj;
4479 }
4480
4481 static bool discard_backing_storage(struct drm_i915_gem_object *obj)
4482 {
4483         /* If we are the last user of the backing storage (be it shmemfs
4484          * pages or stolen etc), we know that the pages are going to be
4485          * immediately released. In this case, we can then skip copying
4486          * back the contents from the GPU.
4487          */
4488
4489         if (obj->madv != I915_MADV_WILLNEED)
4490                 return false;
4491
4492         if (obj->base.filp == NULL)
4493                 return true;
4494
4495         /* At first glance, this looks racy, but then again so would be
4496          * userspace racing mmap against close. However, the first external
4497          * reference to the filp can only be obtained through the
4498          * i915_gem_mmap_ioctl() which safeguards us against the user
4499          * acquiring such a reference whilst we are in the middle of
4500          * freeing the object.
4501          */
4502         return atomic_long_read(&obj->base.filp->f_count) == 1;
4503 }
4504
4505 void i915_gem_free_object(struct drm_gem_object *gem_obj)
4506 {
4507         struct drm_i915_gem_object *obj = to_intel_bo(gem_obj);
4508         struct drm_device *dev = obj->base.dev;
4509         struct drm_i915_private *dev_priv = dev->dev_private;
4510         struct i915_vma *vma, *next;
4511
4512         intel_runtime_pm_get(dev_priv);
4513
4514         trace_i915_gem_object_destroy(obj);
4515
4516         list_for_each_entry_safe(vma, next, &obj->vma_list, vma_link) {
4517                 int ret;
4518
4519                 vma->pin_count = 0;
4520                 ret = i915_vma_unbind(vma);
4521                 if (WARN_ON(ret == -ERESTARTSYS)) {
4522                         bool was_interruptible;
4523
4524                         was_interruptible = dev_priv->mm.interruptible;
4525                         dev_priv->mm.interruptible = false;
4526
4527                         WARN_ON(i915_vma_unbind(vma));
4528
4529                         dev_priv->mm.interruptible = was_interruptible;
4530                 }
4531         }
4532
4533         /* Stolen objects don't hold a ref, but do hold pin count. Fix that up
4534          * before progressing. */
4535         if (obj->stolen)
4536                 i915_gem_object_unpin_pages(obj);
4537
4538         WARN_ON(obj->frontbuffer_bits);
4539
4540         if (obj->pages && obj->madv == I915_MADV_WILLNEED &&
4541             dev_priv->quirks & QUIRK_PIN_SWIZZLED_PAGES &&
4542             obj->tiling_mode != I915_TILING_NONE)
4543                 i915_gem_object_unpin_pages(obj);
4544
4545         if (WARN_ON(obj->pages_pin_count))
4546                 obj->pages_pin_count = 0;
4547         if (discard_backing_storage(obj))
4548                 obj->madv = I915_MADV_DONTNEED;
4549         i915_gem_object_put_pages(obj);
4550         i915_gem_object_free_mmap_offset(obj);
4551
4552         BUG_ON(obj->pages);
4553
4554         if (obj->base.import_attach)
4555                 drm_prime_gem_destroy(&obj->base, NULL);
4556
4557         if (obj->ops->release)
4558                 obj->ops->release(obj);
4559
4560         drm_gem_object_release(&obj->base);
4561         i915_gem_info_remove_obj(dev_priv, obj->base.size);
4562
4563         kfree(obj->bit_17);
4564         i915_gem_object_free(obj);
4565
4566         intel_runtime_pm_put(dev_priv);
4567 }
4568
4569 struct i915_vma *i915_gem_obj_to_vma(struct drm_i915_gem_object *obj,
4570                                      struct i915_address_space *vm)
4571 {
4572         struct i915_vma *vma;
4573         list_for_each_entry(vma, &obj->vma_list, vma_link) {
4574                 if (i915_is_ggtt(vma->vm) &&
4575                     vma->ggtt_view.type != I915_GGTT_VIEW_NORMAL)
4576                         continue;
4577                 if (vma->vm == vm)
4578                         return vma;
4579         }
4580         return NULL;
4581 }
4582
4583 struct i915_vma *i915_gem_obj_to_ggtt_view(struct drm_i915_gem_object *obj,
4584                                            const struct i915_ggtt_view *view)
4585 {
4586         struct i915_address_space *ggtt = i915_obj_to_ggtt(obj);
4587         struct i915_vma *vma;
4588
4589         if (WARN_ONCE(!view, "no view specified"))
4590                 return ERR_PTR(-EINVAL);
4591
4592         list_for_each_entry(vma, &obj->vma_list, vma_link)
4593                 if (vma->vm == ggtt &&
4594                     i915_ggtt_view_equal(&vma->ggtt_view, view))
4595                         return vma;
4596         return NULL;
4597 }
4598
4599 void i915_gem_vma_destroy(struct i915_vma *vma)
4600 {
4601         struct i915_address_space *vm = NULL;
4602         WARN_ON(vma->node.allocated);
4603
4604         /* Keep the vma as a placeholder in the execbuffer reservation lists */
4605         if (!list_empty(&vma->exec_list))
4606                 return;
4607
4608         vm = vma->vm;
4609
4610         if (!i915_is_ggtt(vm))
4611                 i915_ppgtt_put(i915_vm_to_ppgtt(vm));
4612
4613         list_del(&vma->vma_link);
4614
4615         kmem_cache_free(to_i915(vma->obj->base.dev)->vmas, vma);
4616 }
4617
4618 static void
4619 i915_gem_stop_ringbuffers(struct drm_device *dev)
4620 {
4621         struct drm_i915_private *dev_priv = dev->dev_private;
4622         struct intel_engine_cs *ring;
4623         int i;
4624
4625         for_each_ring(ring, dev_priv, i)
4626                 dev_priv->gt.stop_ring(ring);
4627 }
4628
4629 int
4630 i915_gem_suspend(struct drm_device *dev)
4631 {
4632         struct drm_i915_private *dev_priv = dev->dev_private;
4633         int ret = 0;
4634
4635         mutex_lock(&dev->struct_mutex);
4636         ret = i915_gpu_idle(dev);
4637         if (ret)
4638                 goto err;
4639
4640         i915_gem_retire_requests(dev);
4641
4642         i915_gem_stop_ringbuffers(dev);
4643         mutex_unlock(&dev->struct_mutex);
4644
4645         cancel_delayed_work_sync(&dev_priv->gpu_error.hangcheck_work);
4646         cancel_delayed_work_sync(&dev_priv->mm.retire_work);
4647         flush_delayed_work(&dev_priv->mm.idle_work);
4648
4649         /* Assert that we sucessfully flushed all the work and
4650          * reset the GPU back to its idle, low power state.
4651          */
4652         WARN_ON(dev_priv->mm.busy);
4653
4654         return 0;
4655
4656 err:
4657         mutex_unlock(&dev->struct_mutex);
4658         return ret;
4659 }
4660
4661 int i915_gem_l3_remap(struct intel_engine_cs *ring, int slice)
4662 {
4663         struct drm_device *dev = ring->dev;
4664         struct drm_i915_private *dev_priv = dev->dev_private;
4665         u32 reg_base = GEN7_L3LOG_BASE + (slice * 0x200);
4666         u32 *remap_info = dev_priv->l3_parity.remap_info[slice];
4667         int i, ret;
4668
4669         if (!HAS_L3_DPF(dev) || !remap_info)
4670                 return 0;
4671
4672         ret = intel_ring_begin(ring, GEN7_L3LOG_SIZE / 4 * 3);
4673         if (ret)
4674                 return ret;
4675
4676         /*
4677          * Note: We do not worry about the concurrent register cacheline hang
4678          * here because no other code should access these registers other than
4679          * at initialization time.
4680          */
4681         for (i = 0; i < GEN7_L3LOG_SIZE; i += 4) {
4682                 intel_ring_emit(ring, MI_LOAD_REGISTER_IMM(1));
4683                 intel_ring_emit(ring, reg_base + i);
4684                 intel_ring_emit(ring, remap_info[i/4]);
4685         }
4686
4687         intel_ring_advance(ring);
4688
4689         return ret;
4690 }
4691
4692 void i915_gem_init_swizzling(struct drm_device *dev)
4693 {
4694         struct drm_i915_private *dev_priv = dev->dev_private;
4695
4696         if (INTEL_INFO(dev)->gen < 5 ||
4697             dev_priv->mm.bit_6_swizzle_x == I915_BIT_6_SWIZZLE_NONE)
4698                 return;
4699
4700         I915_WRITE(DISP_ARB_CTL, I915_READ(DISP_ARB_CTL) |
4701                                  DISP_TILE_SURFACE_SWIZZLING);
4702
4703         if (IS_GEN5(dev))
4704                 return;
4705
4706         I915_WRITE(TILECTL, I915_READ(TILECTL) | TILECTL_SWZCTL);
4707         if (IS_GEN6(dev))
4708                 I915_WRITE(ARB_MODE, _MASKED_BIT_ENABLE(ARB_MODE_SWIZZLE_SNB));
4709         else if (IS_GEN7(dev))
4710                 I915_WRITE(ARB_MODE, _MASKED_BIT_ENABLE(ARB_MODE_SWIZZLE_IVB));
4711         else if (IS_GEN8(dev))
4712                 I915_WRITE(GAMTARBMODE, _MASKED_BIT_ENABLE(ARB_MODE_SWIZZLE_BDW));
4713         else
4714                 BUG();
4715 }
4716
4717 static bool
4718 intel_enable_blt(struct drm_device *dev)
4719 {
4720         if (!HAS_BLT(dev))
4721                 return false;
4722
4723         /* The blitter was dysfunctional on early prototypes */
4724         if (IS_GEN6(dev) && dev->pdev->revision < 8) {
4725                 DRM_INFO("BLT not supported on this pre-production hardware;"
4726                          " graphics performance will be degraded.\n");
4727                 return false;
4728         }
4729
4730         return true;
4731 }
4732
4733 static void init_unused_ring(struct drm_device *dev, u32 base)
4734 {
4735         struct drm_i915_private *dev_priv = dev->dev_private;
4736
4737         I915_WRITE(RING_CTL(base), 0);
4738         I915_WRITE(RING_HEAD(base), 0);
4739         I915_WRITE(RING_TAIL(base), 0);
4740         I915_WRITE(RING_START(base), 0);
4741 }
4742
4743 static void init_unused_rings(struct drm_device *dev)
4744 {
4745         if (IS_I830(dev)) {
4746                 init_unused_ring(dev, PRB1_BASE);
4747                 init_unused_ring(dev, SRB0_BASE);
4748                 init_unused_ring(dev, SRB1_BASE);
4749                 init_unused_ring(dev, SRB2_BASE);
4750                 init_unused_ring(dev, SRB3_BASE);
4751         } else if (IS_GEN2(dev)) {
4752                 init_unused_ring(dev, SRB0_BASE);
4753                 init_unused_ring(dev, SRB1_BASE);
4754         } else if (IS_GEN3(dev)) {
4755                 init_unused_ring(dev, PRB1_BASE);
4756                 init_unused_ring(dev, PRB2_BASE);
4757         }
4758 }
4759
4760 int i915_gem_init_rings(struct drm_device *dev)
4761 {
4762         struct drm_i915_private *dev_priv = dev->dev_private;
4763         int ret;
4764
4765         ret = intel_init_render_ring_buffer(dev);
4766         if (ret)
4767                 return ret;
4768
4769         if (HAS_BSD(dev)) {
4770                 ret = intel_init_bsd_ring_buffer(dev);
4771                 if (ret)
4772                         goto cleanup_render_ring;
4773         }
4774
4775         if (intel_enable_blt(dev)) {
4776                 ret = intel_init_blt_ring_buffer(dev);
4777                 if (ret)
4778                         goto cleanup_bsd_ring;
4779         }
4780
4781         if (HAS_VEBOX(dev)) {
4782                 ret = intel_init_vebox_ring_buffer(dev);
4783                 if (ret)
4784                         goto cleanup_blt_ring;
4785         }
4786
4787         if (HAS_BSD2(dev)) {
4788                 ret = intel_init_bsd2_ring_buffer(dev);
4789                 if (ret)
4790                         goto cleanup_vebox_ring;
4791         }
4792
4793         ret = i915_gem_set_seqno(dev, ((u32)~0 - 0x1000));
4794         if (ret)
4795                 goto cleanup_bsd2_ring;
4796
4797         return 0;
4798
4799 cleanup_bsd2_ring:
4800         intel_cleanup_ring_buffer(&dev_priv->ring[VCS2]);
4801 cleanup_vebox_ring:
4802         intel_cleanup_ring_buffer(&dev_priv->ring[VECS]);
4803 cleanup_blt_ring:
4804         intel_cleanup_ring_buffer(&dev_priv->ring[BCS]);
4805 cleanup_bsd_ring:
4806         intel_cleanup_ring_buffer(&dev_priv->ring[VCS]);
4807 cleanup_render_ring:
4808         intel_cleanup_ring_buffer(&dev_priv->ring[RCS]);
4809
4810         return ret;
4811 }
4812
4813 int
4814 i915_gem_init_hw(struct drm_device *dev)
4815 {
4816         struct drm_i915_private *dev_priv = dev->dev_private;
4817         struct intel_engine_cs *ring;
4818         int ret, i;
4819
4820         if (INTEL_INFO(dev)->gen < 6 && !intel_enable_gtt())
4821                 return -EIO;
4822
4823         /* Double layer security blanket, see i915_gem_init() */
4824         intel_uncore_forcewake_get(dev_priv, FORCEWAKE_ALL);
4825
4826         if (dev_priv->ellc_size)
4827                 I915_WRITE(HSW_IDICR, I915_READ(HSW_IDICR) | IDIHASHMSK(0xf));
4828
4829         if (IS_HASWELL(dev))
4830                 I915_WRITE(MI_PREDICATE_RESULT_2, IS_HSW_GT3(dev) ?
4831                            LOWER_SLICE_ENABLED : LOWER_SLICE_DISABLED);
4832
4833         if (HAS_PCH_NOP(dev)) {
4834                 if (IS_IVYBRIDGE(dev)) {
4835                         u32 temp = I915_READ(GEN7_MSG_CTL);
4836                         temp &= ~(WAIT_FOR_PCH_FLR_ACK | WAIT_FOR_PCH_RESET_ACK);
4837                         I915_WRITE(GEN7_MSG_CTL, temp);
4838                 } else if (INTEL_INFO(dev)->gen >= 7) {
4839                         u32 temp = I915_READ(HSW_NDE_RSTWRN_OPT);
4840                         temp &= ~RESET_PCH_HANDSHAKE_ENABLE;
4841                         I915_WRITE(HSW_NDE_RSTWRN_OPT, temp);
4842                 }
4843         }
4844
4845         i915_gem_init_swizzling(dev);
4846
4847         /*
4848          * At least 830 can leave some of the unused rings
4849          * "active" (ie. head != tail) after resume which
4850          * will prevent c3 entry. Makes sure all unused rings
4851          * are totally idle.
4852          */
4853         init_unused_rings(dev);
4854
4855         for_each_ring(ring, dev_priv, i) {
4856                 ret = ring->init_hw(ring);
4857                 if (ret)
4858                         goto out;
4859         }
4860
4861         for (i = 0; i < NUM_L3_SLICES(dev); i++)
4862                 i915_gem_l3_remap(&dev_priv->ring[RCS], i);
4863
4864         ret = i915_ppgtt_init_hw(dev);
4865         if (ret && ret != -EIO) {
4866                 DRM_ERROR("PPGTT enable failed %d\n", ret);
4867                 i915_gem_cleanup_ringbuffer(dev);
4868         }
4869
4870         ret = i915_gem_context_enable(dev_priv);
4871         if (ret && ret != -EIO) {
4872                 DRM_ERROR("Context enable failed %d\n", ret);
4873                 i915_gem_cleanup_ringbuffer(dev);
4874
4875                 goto out;
4876         }
4877
4878 out:
4879         intel_uncore_forcewake_put(dev_priv, FORCEWAKE_ALL);
4880         return ret;
4881 }
4882
4883 int i915_gem_init(struct drm_device *dev)
4884 {
4885         struct drm_i915_private *dev_priv = dev->dev_private;
4886         int ret;
4887
4888         i915.enable_execlists = intel_sanitize_enable_execlists(dev,
4889                         i915.enable_execlists);
4890
4891         mutex_lock(&dev->struct_mutex);
4892
4893         if (IS_VALLEYVIEW(dev)) {
4894                 /* VLVA0 (potential hack), BIOS isn't actually waking us */
4895                 I915_WRITE(VLV_GTLC_WAKE_CTRL, VLV_GTLC_ALLOWWAKEREQ);
4896                 if (wait_for((I915_READ(VLV_GTLC_PW_STATUS) &
4897                               VLV_GTLC_ALLOWWAKEACK), 10))
4898                         DRM_DEBUG_DRIVER("allow wake ack timed out\n");
4899         }
4900
4901         if (!i915.enable_execlists) {
4902                 dev_priv->gt.execbuf_submit = i915_gem_ringbuffer_submission;
4903                 dev_priv->gt.init_rings = i915_gem_init_rings;
4904                 dev_priv->gt.cleanup_ring = intel_cleanup_ring_buffer;
4905                 dev_priv->gt.stop_ring = intel_stop_ring_buffer;
4906         } else {
4907                 dev_priv->gt.execbuf_submit = intel_execlists_submission;
4908                 dev_priv->gt.init_rings = intel_logical_rings_init;
4909                 dev_priv->gt.cleanup_ring = intel_logical_ring_cleanup;
4910                 dev_priv->gt.stop_ring = intel_logical_ring_stop;
4911         }
4912
4913         /* This is just a security blanket to placate dragons.
4914          * On some systems, we very sporadically observe that the first TLBs
4915          * used by the CS may be stale, despite us poking the TLB reset. If
4916          * we hold the forcewake during initialisation these problems
4917          * just magically go away.
4918          */
4919         intel_uncore_forcewake_get(dev_priv, FORCEWAKE_ALL);
4920
4921         ret = i915_gem_init_userptr(dev);
4922         if (ret)
4923                 goto out_unlock;
4924
4925         i915_gem_init_global_gtt(dev);
4926
4927         ret = i915_gem_context_init(dev);
4928         if (ret)
4929                 goto out_unlock;
4930
4931         ret = dev_priv->gt.init_rings(dev);
4932         if (ret)
4933                 goto out_unlock;
4934
4935         ret = i915_gem_init_hw(dev);
4936         if (ret == -EIO) {
4937                 /* Allow ring initialisation to fail by marking the GPU as
4938                  * wedged. But we only want to do this where the GPU is angry,
4939                  * for all other failure, such as an allocation failure, bail.
4940                  */
4941                 DRM_ERROR("Failed to initialize GPU, declaring it wedged\n");
4942                 atomic_set_mask(I915_WEDGED, &dev_priv->gpu_error.reset_counter);
4943                 ret = 0;
4944         }
4945
4946 out_unlock:
4947         intel_uncore_forcewake_put(dev_priv, FORCEWAKE_ALL);
4948         mutex_unlock(&dev->struct_mutex);
4949
4950         return ret;
4951 }
4952
4953 void
4954 i915_gem_cleanup_ringbuffer(struct drm_device *dev)
4955 {
4956         struct drm_i915_private *dev_priv = dev->dev_private;
4957         struct intel_engine_cs *ring;
4958         int i;
4959
4960         for_each_ring(ring, dev_priv, i)
4961                 dev_priv->gt.cleanup_ring(ring);
4962 }
4963
4964 static void
4965 init_ring_lists(struct intel_engine_cs *ring)
4966 {
4967         INIT_LIST_HEAD(&ring->active_list);
4968         INIT_LIST_HEAD(&ring->request_list);
4969 }
4970
4971 void i915_init_vm(struct drm_i915_private *dev_priv,
4972                   struct i915_address_space *vm)
4973 {
4974         if (!i915_is_ggtt(vm))
4975                 drm_mm_init(&vm->mm, vm->start, vm->total);
4976         vm->dev = dev_priv->dev;
4977         INIT_LIST_HEAD(&vm->active_list);
4978         INIT_LIST_HEAD(&vm->inactive_list);
4979         INIT_LIST_HEAD(&vm->global_link);
4980         list_add_tail(&vm->global_link, &dev_priv->vm_list);
4981 }
4982
4983 void
4984 i915_gem_load(struct drm_device *dev)
4985 {
4986         struct drm_i915_private *dev_priv = dev->dev_private;
4987         int i;
4988
4989         dev_priv->objects =
4990                 kmem_cache_create("i915_gem_object",
4991                                   sizeof(struct drm_i915_gem_object), 0,
4992                                   SLAB_HWCACHE_ALIGN,
4993                                   NULL);
4994         dev_priv->vmas =
4995                 kmem_cache_create("i915_gem_vma",
4996                                   sizeof(struct i915_vma), 0,
4997                                   SLAB_HWCACHE_ALIGN,
4998                                   NULL);
4999         dev_priv->requests =
5000                 kmem_cache_create("i915_gem_request",
5001                                   sizeof(struct drm_i915_gem_request), 0,
5002                                   SLAB_HWCACHE_ALIGN,
5003                                   NULL);
5004
5005         INIT_LIST_HEAD(&dev_priv->vm_list);
5006         i915_init_vm(dev_priv, &dev_priv->gtt.base);
5007
5008         INIT_LIST_HEAD(&dev_priv->context_list);
5009         INIT_LIST_HEAD(&dev_priv->mm.unbound_list);
5010         INIT_LIST_HEAD(&dev_priv->mm.bound_list);
5011         INIT_LIST_HEAD(&dev_priv->mm.fence_list);
5012         for (i = 0; i < I915_NUM_RINGS; i++)
5013                 init_ring_lists(&dev_priv->ring[i]);
5014         for (i = 0; i < I915_MAX_NUM_FENCES; i++)
5015                 INIT_LIST_HEAD(&dev_priv->fence_regs[i].lru_list);
5016         INIT_DELAYED_WORK(&dev_priv->mm.retire_work,
5017                           i915_gem_retire_work_handler);
5018         INIT_DELAYED_WORK(&dev_priv->mm.idle_work,
5019                           i915_gem_idle_work_handler);
5020         init_waitqueue_head(&dev_priv->gpu_error.reset_queue);
5021
5022         dev_priv->relative_constants_mode = I915_EXEC_CONSTANTS_REL_GENERAL;
5023
5024         if (INTEL_INFO(dev)->gen >= 7 && !IS_VALLEYVIEW(dev))
5025                 dev_priv->num_fence_regs = 32;
5026         else if (INTEL_INFO(dev)->gen >= 4 || IS_I945G(dev) || IS_I945GM(dev) || IS_G33(dev))
5027                 dev_priv->num_fence_regs = 16;
5028         else
5029                 dev_priv->num_fence_regs = 8;
5030
5031         if (intel_vgpu_active(dev))
5032                 dev_priv->num_fence_regs =
5033                                 I915_READ(vgtif_reg(avail_rs.fence_num));
5034
5035         /* Initialize fence registers to zero */
5036         INIT_LIST_HEAD(&dev_priv->mm.fence_list);
5037         i915_gem_restore_fences(dev);
5038
5039         i915_gem_detect_bit_6_swizzle(dev);
5040         init_waitqueue_head(&dev_priv->pending_flip_queue);
5041
5042         dev_priv->mm.interruptible = true;
5043
5044         i915_gem_shrinker_init(dev_priv);
5045
5046         mutex_init(&dev_priv->fb_tracking.lock);
5047 }
5048
5049 void i915_gem_release(struct drm_device *dev, struct drm_file *file)
5050 {
5051         struct drm_i915_file_private *file_priv = file->driver_priv;
5052
5053         /* Clean up our request list when the client is going away, so that
5054          * later retire_requests won't dereference our soon-to-be-gone
5055          * file_priv.
5056          */
5057         spin_lock(&file_priv->mm.lock);
5058         while (!list_empty(&file_priv->mm.request_list)) {
5059                 struct drm_i915_gem_request *request;
5060
5061                 request = list_first_entry(&file_priv->mm.request_list,
5062                                            struct drm_i915_gem_request,
5063                                            client_list);
5064                 list_del(&request->client_list);
5065                 request->file_priv = NULL;
5066         }
5067         spin_unlock(&file_priv->mm.lock);
5068
5069         if (!list_empty(&file_priv->rps_boost)) {
5070                 mutex_lock(&to_i915(dev)->rps.hw_lock);
5071                 list_del(&file_priv->rps_boost);
5072                 mutex_unlock(&to_i915(dev)->rps.hw_lock);
5073         }
5074 }
5075
5076 int i915_gem_open(struct drm_device *dev, struct drm_file *file)
5077 {
5078         struct drm_i915_file_private *file_priv;
5079         int ret;
5080
5081         DRM_DEBUG_DRIVER("\n");
5082
5083         file_priv = kzalloc(sizeof(*file_priv), GFP_KERNEL);
5084         if (!file_priv)
5085                 return -ENOMEM;
5086
5087         file->driver_priv = file_priv;
5088         file_priv->dev_priv = dev->dev_private;
5089         file_priv->file = file;
5090         INIT_LIST_HEAD(&file_priv->rps_boost);
5091
5092         spin_lock_init(&file_priv->mm.lock);
5093         INIT_LIST_HEAD(&file_priv->mm.request_list);
5094
5095         ret = i915_gem_context_open(dev, file);
5096         if (ret)
5097                 kfree(file_priv);
5098
5099         return ret;
5100 }
5101
5102 /**
5103  * i915_gem_track_fb - update frontbuffer tracking
5104  * old: current GEM buffer for the frontbuffer slots
5105  * new: new GEM buffer for the frontbuffer slots
5106  * frontbuffer_bits: bitmask of frontbuffer slots
5107  *
5108  * This updates the frontbuffer tracking bits @frontbuffer_bits by clearing them
5109  * from @old and setting them in @new. Both @old and @new can be NULL.
5110  */
5111 void i915_gem_track_fb(struct drm_i915_gem_object *old,
5112                        struct drm_i915_gem_object *new,
5113                        unsigned frontbuffer_bits)
5114 {
5115         if (old) {
5116                 WARN_ON(!mutex_is_locked(&old->base.dev->struct_mutex));
5117                 WARN_ON(!(old->frontbuffer_bits & frontbuffer_bits));
5118                 old->frontbuffer_bits &= ~frontbuffer_bits;
5119         }
5120
5121         if (new) {
5122                 WARN_ON(!mutex_is_locked(&new->base.dev->struct_mutex));
5123                 WARN_ON(new->frontbuffer_bits & frontbuffer_bits);
5124                 new->frontbuffer_bits |= frontbuffer_bits;
5125         }
5126 }
5127
5128 /* All the new VM stuff */
5129 unsigned long
5130 i915_gem_obj_offset(struct drm_i915_gem_object *o,
5131                     struct i915_address_space *vm)
5132 {
5133         struct drm_i915_private *dev_priv = o->base.dev->dev_private;
5134         struct i915_vma *vma;
5135
5136         WARN_ON(vm == &dev_priv->mm.aliasing_ppgtt->base);
5137
5138         list_for_each_entry(vma, &o->vma_list, vma_link) {
5139                 if (i915_is_ggtt(vma->vm) &&
5140                     vma->ggtt_view.type != I915_GGTT_VIEW_NORMAL)
5141                         continue;
5142                 if (vma->vm == vm)
5143                         return vma->node.start;
5144         }
5145
5146         WARN(1, "%s vma for this object not found.\n",
5147              i915_is_ggtt(vm) ? "global" : "ppgtt");
5148         return -1;
5149 }
5150
5151 unsigned long
5152 i915_gem_obj_ggtt_offset_view(struct drm_i915_gem_object *o,
5153                               const struct i915_ggtt_view *view)
5154 {
5155         struct i915_address_space *ggtt = i915_obj_to_ggtt(o);
5156         struct i915_vma *vma;
5157
5158         list_for_each_entry(vma, &o->vma_list, vma_link)
5159                 if (vma->vm == ggtt &&
5160                     i915_ggtt_view_equal(&vma->ggtt_view, view))
5161                         return vma->node.start;
5162
5163         WARN(1, "global vma for this object not found.\n");
5164         return -1;
5165 }
5166
5167 bool i915_gem_obj_bound(struct drm_i915_gem_object *o,
5168                         struct i915_address_space *vm)
5169 {
5170         struct i915_vma *vma;
5171
5172         list_for_each_entry(vma, &o->vma_list, vma_link) {
5173                 if (i915_is_ggtt(vma->vm) &&
5174                     vma->ggtt_view.type != I915_GGTT_VIEW_NORMAL)
5175                         continue;
5176                 if (vma->vm == vm && drm_mm_node_allocated(&vma->node))
5177                         return true;
5178         }
5179
5180         return false;
5181 }
5182
5183 bool i915_gem_obj_ggtt_bound_view(struct drm_i915_gem_object *o,
5184                                   const struct i915_ggtt_view *view)
5185 {
5186         struct i915_address_space *ggtt = i915_obj_to_ggtt(o);
5187         struct i915_vma *vma;
5188
5189         list_for_each_entry(vma, &o->vma_list, vma_link)
5190                 if (vma->vm == ggtt &&
5191                     i915_ggtt_view_equal(&vma->ggtt_view, view) &&
5192                     drm_mm_node_allocated(&vma->node))
5193                         return true;
5194
5195         return false;
5196 }
5197
5198 bool i915_gem_obj_bound_any(struct drm_i915_gem_object *o)
5199 {
5200         struct i915_vma *vma;
5201
5202         list_for_each_entry(vma, &o->vma_list, vma_link)
5203                 if (drm_mm_node_allocated(&vma->node))
5204                         return true;
5205
5206         return false;
5207 }
5208
5209 unsigned long i915_gem_obj_size(struct drm_i915_gem_object *o,
5210                                 struct i915_address_space *vm)
5211 {
5212         struct drm_i915_private *dev_priv = o->base.dev->dev_private;
5213         struct i915_vma *vma;
5214
5215         WARN_ON(vm == &dev_priv->mm.aliasing_ppgtt->base);
5216
5217         BUG_ON(list_empty(&o->vma_list));
5218
5219         list_for_each_entry(vma, &o->vma_list, vma_link) {
5220                 if (i915_is_ggtt(vma->vm) &&
5221                     vma->ggtt_view.type != I915_GGTT_VIEW_NORMAL)
5222                         continue;
5223                 if (vma->vm == vm)
5224                         return vma->node.size;
5225         }
5226         return 0;
5227 }
5228
5229 bool i915_gem_obj_is_pinned(struct drm_i915_gem_object *obj)
5230 {
5231         struct i915_vma *vma;
5232         list_for_each_entry(vma, &obj->vma_list, vma_link) {
5233                 if (i915_is_ggtt(vma->vm) &&
5234                     vma->ggtt_view.type != I915_GGTT_VIEW_NORMAL)
5235                         continue;
5236                 if (vma->pin_count > 0)
5237                         return true;
5238         }
5239         return false;
5240 }
5241