]> git.kernelconcepts.de Git - karo-tx-linux.git/blob - drivers/gpu/drm/i915/i915_gem.c
Merge git://git.kernel.org/pub/scm/linux/kernel/git/sfrench/cifs-2.6
[karo-tx-linux.git] / drivers / gpu / drm / i915 / i915_gem.c
1 /*
2  * Copyright © 2008 Intel Corporation
3  *
4  * Permission is hereby granted, free of charge, to any person obtaining a
5  * copy of this software and associated documentation files (the "Software"),
6  * to deal in the Software without restriction, including without limitation
7  * the rights to use, copy, modify, merge, publish, distribute, sublicense,
8  * and/or sell copies of the Software, and to permit persons to whom the
9  * Software is furnished to do so, subject to the following conditions:
10  *
11  * The above copyright notice and this permission notice (including the next
12  * paragraph) shall be included in all copies or substantial portions of the
13  * Software.
14  *
15  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
18  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
20  * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
21  * IN THE SOFTWARE.
22  *
23  * Authors:
24  *    Eric Anholt <eric@anholt.net>
25  *
26  */
27
28 #include "drmP.h"
29 #include "drm.h"
30 #include "i915_drm.h"
31 #include "i915_drv.h"
32 #include <linux/swap.h>
33
34 #define I915_GEM_GPU_DOMAINS    (~(I915_GEM_DOMAIN_CPU | I915_GEM_DOMAIN_GTT))
35
36 static int
37 i915_gem_object_set_domain(struct drm_gem_object *obj,
38                             uint32_t read_domains,
39                             uint32_t write_domain);
40 static int
41 i915_gem_object_set_domain_range(struct drm_gem_object *obj,
42                                  uint64_t offset,
43                                  uint64_t size,
44                                  uint32_t read_domains,
45                                  uint32_t write_domain);
46 static int
47 i915_gem_set_domain(struct drm_gem_object *obj,
48                     struct drm_file *file_priv,
49                     uint32_t read_domains,
50                     uint32_t write_domain);
51 static int i915_gem_object_get_page_list(struct drm_gem_object *obj);
52 static void i915_gem_object_free_page_list(struct drm_gem_object *obj);
53 static int i915_gem_object_wait_rendering(struct drm_gem_object *obj);
54
55 static void
56 i915_gem_cleanup_ringbuffer(struct drm_device *dev);
57
58 int
59 i915_gem_init_ioctl(struct drm_device *dev, void *data,
60                     struct drm_file *file_priv)
61 {
62         drm_i915_private_t *dev_priv = dev->dev_private;
63         struct drm_i915_gem_init *args = data;
64
65         mutex_lock(&dev->struct_mutex);
66
67         if (args->gtt_start >= args->gtt_end ||
68             (args->gtt_start & (PAGE_SIZE - 1)) != 0 ||
69             (args->gtt_end & (PAGE_SIZE - 1)) != 0) {
70                 mutex_unlock(&dev->struct_mutex);
71                 return -EINVAL;
72         }
73
74         drm_mm_init(&dev_priv->mm.gtt_space, args->gtt_start,
75             args->gtt_end - args->gtt_start);
76
77         dev->gtt_total = (uint32_t) (args->gtt_end - args->gtt_start);
78
79         mutex_unlock(&dev->struct_mutex);
80
81         return 0;
82 }
83
84 int
85 i915_gem_get_aperture_ioctl(struct drm_device *dev, void *data,
86                             struct drm_file *file_priv)
87 {
88         struct drm_i915_gem_get_aperture *args = data;
89
90         if (!(dev->driver->driver_features & DRIVER_GEM))
91                 return -ENODEV;
92
93         args->aper_size = dev->gtt_total;
94         args->aper_available_size = (args->aper_size -
95                                      atomic_read(&dev->pin_memory));
96
97         return 0;
98 }
99
100
101 /**
102  * Creates a new mm object and returns a handle to it.
103  */
104 int
105 i915_gem_create_ioctl(struct drm_device *dev, void *data,
106                       struct drm_file *file_priv)
107 {
108         struct drm_i915_gem_create *args = data;
109         struct drm_gem_object *obj;
110         int handle, ret;
111
112         args->size = roundup(args->size, PAGE_SIZE);
113
114         /* Allocate the new object */
115         obj = drm_gem_object_alloc(dev, args->size);
116         if (obj == NULL)
117                 return -ENOMEM;
118
119         ret = drm_gem_handle_create(file_priv, obj, &handle);
120         mutex_lock(&dev->struct_mutex);
121         drm_gem_object_handle_unreference(obj);
122         mutex_unlock(&dev->struct_mutex);
123
124         if (ret)
125                 return ret;
126
127         args->handle = handle;
128
129         return 0;
130 }
131
132 /**
133  * Reads data from the object referenced by handle.
134  *
135  * On error, the contents of *data are undefined.
136  */
137 int
138 i915_gem_pread_ioctl(struct drm_device *dev, void *data,
139                      struct drm_file *file_priv)
140 {
141         struct drm_i915_gem_pread *args = data;
142         struct drm_gem_object *obj;
143         struct drm_i915_gem_object *obj_priv;
144         ssize_t read;
145         loff_t offset;
146         int ret;
147
148         obj = drm_gem_object_lookup(dev, file_priv, args->handle);
149         if (obj == NULL)
150                 return -EBADF;
151         obj_priv = obj->driver_private;
152
153         /* Bounds check source.
154          *
155          * XXX: This could use review for overflow issues...
156          */
157         if (args->offset > obj->size || args->size > obj->size ||
158             args->offset + args->size > obj->size) {
159                 drm_gem_object_unreference(obj);
160                 return -EINVAL;
161         }
162
163         mutex_lock(&dev->struct_mutex);
164
165         ret = i915_gem_object_set_domain_range(obj, args->offset, args->size,
166                                                I915_GEM_DOMAIN_CPU, 0);
167         if (ret != 0) {
168                 drm_gem_object_unreference(obj);
169                 mutex_unlock(&dev->struct_mutex);
170                 return ret;
171         }
172
173         offset = args->offset;
174
175         read = vfs_read(obj->filp, (char __user *)(uintptr_t)args->data_ptr,
176                         args->size, &offset);
177         if (read != args->size) {
178                 drm_gem_object_unreference(obj);
179                 mutex_unlock(&dev->struct_mutex);
180                 if (read < 0)
181                         return read;
182                 else
183                         return -EINVAL;
184         }
185
186         drm_gem_object_unreference(obj);
187         mutex_unlock(&dev->struct_mutex);
188
189         return 0;
190 }
191
192 /* This is the fast write path which cannot handle
193  * page faults in the source data
194  */
195
196 static inline int
197 fast_user_write(struct io_mapping *mapping,
198                 loff_t page_base, int page_offset,
199                 char __user *user_data,
200                 int length)
201 {
202         char *vaddr_atomic;
203         unsigned long unwritten;
204
205         vaddr_atomic = io_mapping_map_atomic_wc(mapping, page_base);
206         unwritten = __copy_from_user_inatomic_nocache(vaddr_atomic + page_offset,
207                                                       user_data, length);
208         io_mapping_unmap_atomic(vaddr_atomic);
209         if (unwritten)
210                 return -EFAULT;
211         return 0;
212 }
213
214 /* Here's the write path which can sleep for
215  * page faults
216  */
217
218 static inline int
219 slow_user_write(struct io_mapping *mapping,
220                 loff_t page_base, int page_offset,
221                 char __user *user_data,
222                 int length)
223 {
224         char __iomem *vaddr;
225         unsigned long unwritten;
226
227         vaddr = io_mapping_map_wc(mapping, page_base);
228         if (vaddr == NULL)
229                 return -EFAULT;
230         unwritten = __copy_from_user(vaddr + page_offset,
231                                      user_data, length);
232         io_mapping_unmap(vaddr);
233         if (unwritten)
234                 return -EFAULT;
235         return 0;
236 }
237
238 static int
239 i915_gem_gtt_pwrite(struct drm_device *dev, struct drm_gem_object *obj,
240                     struct drm_i915_gem_pwrite *args,
241                     struct drm_file *file_priv)
242 {
243         struct drm_i915_gem_object *obj_priv = obj->driver_private;
244         drm_i915_private_t *dev_priv = dev->dev_private;
245         ssize_t remain;
246         loff_t offset, page_base;
247         char __user *user_data;
248         int page_offset, page_length;
249         int ret;
250
251         user_data = (char __user *) (uintptr_t) args->data_ptr;
252         remain = args->size;
253         if (!access_ok(VERIFY_READ, user_data, remain))
254                 return -EFAULT;
255
256
257         mutex_lock(&dev->struct_mutex);
258         ret = i915_gem_object_pin(obj, 0);
259         if (ret) {
260                 mutex_unlock(&dev->struct_mutex);
261                 return ret;
262         }
263         ret = i915_gem_set_domain(obj, file_priv,
264                                   I915_GEM_DOMAIN_GTT, I915_GEM_DOMAIN_GTT);
265         if (ret)
266                 goto fail;
267
268         obj_priv = obj->driver_private;
269         offset = obj_priv->gtt_offset + args->offset;
270         obj_priv->dirty = 1;
271
272         while (remain > 0) {
273                 /* Operation in this page
274                  *
275                  * page_base = page offset within aperture
276                  * page_offset = offset within page
277                  * page_length = bytes to copy for this page
278                  */
279                 page_base = (offset & ~(PAGE_SIZE-1));
280                 page_offset = offset & (PAGE_SIZE-1);
281                 page_length = remain;
282                 if ((page_offset + remain) > PAGE_SIZE)
283                         page_length = PAGE_SIZE - page_offset;
284
285                 ret = fast_user_write (dev_priv->mm.gtt_mapping, page_base,
286                                        page_offset, user_data, page_length);
287
288                 /* If we get a fault while copying data, then (presumably) our
289                  * source page isn't available. In this case, use the
290                  * non-atomic function
291                  */
292                 if (ret) {
293                         ret = slow_user_write (dev_priv->mm.gtt_mapping,
294                                                page_base, page_offset,
295                                                user_data, page_length);
296                         if (ret)
297                                 goto fail;
298                 }
299
300                 remain -= page_length;
301                 user_data += page_length;
302                 offset += page_length;
303         }
304
305 fail:
306         i915_gem_object_unpin(obj);
307         mutex_unlock(&dev->struct_mutex);
308
309         return ret;
310 }
311
312 static int
313 i915_gem_shmem_pwrite(struct drm_device *dev, struct drm_gem_object *obj,
314                       struct drm_i915_gem_pwrite *args,
315                       struct drm_file *file_priv)
316 {
317         int ret;
318         loff_t offset;
319         ssize_t written;
320
321         mutex_lock(&dev->struct_mutex);
322
323         ret = i915_gem_set_domain(obj, file_priv,
324                                   I915_GEM_DOMAIN_CPU, I915_GEM_DOMAIN_CPU);
325         if (ret) {
326                 mutex_unlock(&dev->struct_mutex);
327                 return ret;
328         }
329
330         offset = args->offset;
331
332         written = vfs_write(obj->filp,
333                             (char __user *)(uintptr_t) args->data_ptr,
334                             args->size, &offset);
335         if (written != args->size) {
336                 mutex_unlock(&dev->struct_mutex);
337                 if (written < 0)
338                         return written;
339                 else
340                         return -EINVAL;
341         }
342
343         mutex_unlock(&dev->struct_mutex);
344
345         return 0;
346 }
347
348 /**
349  * Writes data to the object referenced by handle.
350  *
351  * On error, the contents of the buffer that were to be modified are undefined.
352  */
353 int
354 i915_gem_pwrite_ioctl(struct drm_device *dev, void *data,
355                       struct drm_file *file_priv)
356 {
357         struct drm_i915_gem_pwrite *args = data;
358         struct drm_gem_object *obj;
359         struct drm_i915_gem_object *obj_priv;
360         int ret = 0;
361
362         obj = drm_gem_object_lookup(dev, file_priv, args->handle);
363         if (obj == NULL)
364                 return -EBADF;
365         obj_priv = obj->driver_private;
366
367         /* Bounds check destination.
368          *
369          * XXX: This could use review for overflow issues...
370          */
371         if (args->offset > obj->size || args->size > obj->size ||
372             args->offset + args->size > obj->size) {
373                 drm_gem_object_unreference(obj);
374                 return -EINVAL;
375         }
376
377         /* We can only do the GTT pwrite on untiled buffers, as otherwise
378          * it would end up going through the fenced access, and we'll get
379          * different detiling behavior between reading and writing.
380          * pread/pwrite currently are reading and writing from the CPU
381          * perspective, requiring manual detiling by the client.
382          */
383         if (obj_priv->tiling_mode == I915_TILING_NONE &&
384             dev->gtt_total != 0)
385                 ret = i915_gem_gtt_pwrite(dev, obj, args, file_priv);
386         else
387                 ret = i915_gem_shmem_pwrite(dev, obj, args, file_priv);
388
389 #if WATCH_PWRITE
390         if (ret)
391                 DRM_INFO("pwrite failed %d\n", ret);
392 #endif
393
394         drm_gem_object_unreference(obj);
395
396         return ret;
397 }
398
399 /**
400  * Called when user space prepares to use an object
401  */
402 int
403 i915_gem_set_domain_ioctl(struct drm_device *dev, void *data,
404                           struct drm_file *file_priv)
405 {
406         struct drm_i915_gem_set_domain *args = data;
407         struct drm_gem_object *obj;
408         int ret;
409
410         if (!(dev->driver->driver_features & DRIVER_GEM))
411                 return -ENODEV;
412
413         obj = drm_gem_object_lookup(dev, file_priv, args->handle);
414         if (obj == NULL)
415                 return -EBADF;
416
417         mutex_lock(&dev->struct_mutex);
418 #if WATCH_BUF
419         DRM_INFO("set_domain_ioctl %p(%d), %08x %08x\n",
420                  obj, obj->size, args->read_domains, args->write_domain);
421 #endif
422         ret = i915_gem_set_domain(obj, file_priv,
423                                   args->read_domains, args->write_domain);
424         drm_gem_object_unreference(obj);
425         mutex_unlock(&dev->struct_mutex);
426         return ret;
427 }
428
429 /**
430  * Called when user space has done writes to this buffer
431  */
432 int
433 i915_gem_sw_finish_ioctl(struct drm_device *dev, void *data,
434                       struct drm_file *file_priv)
435 {
436         struct drm_i915_gem_sw_finish *args = data;
437         struct drm_gem_object *obj;
438         struct drm_i915_gem_object *obj_priv;
439         int ret = 0;
440
441         if (!(dev->driver->driver_features & DRIVER_GEM))
442                 return -ENODEV;
443
444         mutex_lock(&dev->struct_mutex);
445         obj = drm_gem_object_lookup(dev, file_priv, args->handle);
446         if (obj == NULL) {
447                 mutex_unlock(&dev->struct_mutex);
448                 return -EBADF;
449         }
450
451 #if WATCH_BUF
452         DRM_INFO("%s: sw_finish %d (%p %d)\n",
453                  __func__, args->handle, obj, obj->size);
454 #endif
455         obj_priv = obj->driver_private;
456
457         /* Pinned buffers may be scanout, so flush the cache */
458         if ((obj->write_domain & I915_GEM_DOMAIN_CPU) && obj_priv->pin_count) {
459                 i915_gem_clflush_object(obj);
460                 drm_agp_chipset_flush(dev);
461         }
462         drm_gem_object_unreference(obj);
463         mutex_unlock(&dev->struct_mutex);
464         return ret;
465 }
466
467 /**
468  * Maps the contents of an object, returning the address it is mapped
469  * into.
470  *
471  * While the mapping holds a reference on the contents of the object, it doesn't
472  * imply a ref on the object itself.
473  */
474 int
475 i915_gem_mmap_ioctl(struct drm_device *dev, void *data,
476                    struct drm_file *file_priv)
477 {
478         struct drm_i915_gem_mmap *args = data;
479         struct drm_gem_object *obj;
480         loff_t offset;
481         unsigned long addr;
482
483         if (!(dev->driver->driver_features & DRIVER_GEM))
484                 return -ENODEV;
485
486         obj = drm_gem_object_lookup(dev, file_priv, args->handle);
487         if (obj == NULL)
488                 return -EBADF;
489
490         offset = args->offset;
491
492         down_write(&current->mm->mmap_sem);
493         addr = do_mmap(obj->filp, 0, args->size,
494                        PROT_READ | PROT_WRITE, MAP_SHARED,
495                        args->offset);
496         up_write(&current->mm->mmap_sem);
497         mutex_lock(&dev->struct_mutex);
498         drm_gem_object_unreference(obj);
499         mutex_unlock(&dev->struct_mutex);
500         if (IS_ERR((void *)addr))
501                 return addr;
502
503         args->addr_ptr = (uint64_t) addr;
504
505         return 0;
506 }
507
508 static void
509 i915_gem_object_free_page_list(struct drm_gem_object *obj)
510 {
511         struct drm_i915_gem_object *obj_priv = obj->driver_private;
512         int page_count = obj->size / PAGE_SIZE;
513         int i;
514
515         if (obj_priv->page_list == NULL)
516                 return;
517
518
519         for (i = 0; i < page_count; i++)
520                 if (obj_priv->page_list[i] != NULL) {
521                         if (obj_priv->dirty)
522                                 set_page_dirty(obj_priv->page_list[i]);
523                         mark_page_accessed(obj_priv->page_list[i]);
524                         page_cache_release(obj_priv->page_list[i]);
525                 }
526         obj_priv->dirty = 0;
527
528         drm_free(obj_priv->page_list,
529                  page_count * sizeof(struct page *),
530                  DRM_MEM_DRIVER);
531         obj_priv->page_list = NULL;
532 }
533
534 static void
535 i915_gem_object_move_to_active(struct drm_gem_object *obj)
536 {
537         struct drm_device *dev = obj->dev;
538         drm_i915_private_t *dev_priv = dev->dev_private;
539         struct drm_i915_gem_object *obj_priv = obj->driver_private;
540
541         /* Add a reference if we're newly entering the active list. */
542         if (!obj_priv->active) {
543                 drm_gem_object_reference(obj);
544                 obj_priv->active = 1;
545         }
546         /* Move from whatever list we were on to the tail of execution. */
547         list_move_tail(&obj_priv->list,
548                        &dev_priv->mm.active_list);
549 }
550
551
552 static void
553 i915_gem_object_move_to_inactive(struct drm_gem_object *obj)
554 {
555         struct drm_device *dev = obj->dev;
556         drm_i915_private_t *dev_priv = dev->dev_private;
557         struct drm_i915_gem_object *obj_priv = obj->driver_private;
558
559         i915_verify_inactive(dev, __FILE__, __LINE__);
560         if (obj_priv->pin_count != 0)
561                 list_del_init(&obj_priv->list);
562         else
563                 list_move_tail(&obj_priv->list, &dev_priv->mm.inactive_list);
564
565         if (obj_priv->active) {
566                 obj_priv->active = 0;
567                 drm_gem_object_unreference(obj);
568         }
569         i915_verify_inactive(dev, __FILE__, __LINE__);
570 }
571
572 /**
573  * Creates a new sequence number, emitting a write of it to the status page
574  * plus an interrupt, which will trigger i915_user_interrupt_handler.
575  *
576  * Must be called with struct_lock held.
577  *
578  * Returned sequence numbers are nonzero on success.
579  */
580 static uint32_t
581 i915_add_request(struct drm_device *dev, uint32_t flush_domains)
582 {
583         drm_i915_private_t *dev_priv = dev->dev_private;
584         struct drm_i915_gem_request *request;
585         uint32_t seqno;
586         int was_empty;
587         RING_LOCALS;
588
589         request = drm_calloc(1, sizeof(*request), DRM_MEM_DRIVER);
590         if (request == NULL)
591                 return 0;
592
593         /* Grab the seqno we're going to make this request be, and bump the
594          * next (skipping 0 so it can be the reserved no-seqno value).
595          */
596         seqno = dev_priv->mm.next_gem_seqno;
597         dev_priv->mm.next_gem_seqno++;
598         if (dev_priv->mm.next_gem_seqno == 0)
599                 dev_priv->mm.next_gem_seqno++;
600
601         BEGIN_LP_RING(4);
602         OUT_RING(MI_STORE_DWORD_INDEX);
603         OUT_RING(I915_GEM_HWS_INDEX << MI_STORE_DWORD_INDEX_SHIFT);
604         OUT_RING(seqno);
605
606         OUT_RING(MI_USER_INTERRUPT);
607         ADVANCE_LP_RING();
608
609         DRM_DEBUG("%d\n", seqno);
610
611         request->seqno = seqno;
612         request->emitted_jiffies = jiffies;
613         request->flush_domains = flush_domains;
614         was_empty = list_empty(&dev_priv->mm.request_list);
615         list_add_tail(&request->list, &dev_priv->mm.request_list);
616
617         if (was_empty && !dev_priv->mm.suspended)
618                 schedule_delayed_work(&dev_priv->mm.retire_work, HZ);
619         return seqno;
620 }
621
622 /**
623  * Command execution barrier
624  *
625  * Ensures that all commands in the ring are finished
626  * before signalling the CPU
627  */
628 static uint32_t
629 i915_retire_commands(struct drm_device *dev)
630 {
631         drm_i915_private_t *dev_priv = dev->dev_private;
632         uint32_t cmd = MI_FLUSH | MI_NO_WRITE_FLUSH;
633         uint32_t flush_domains = 0;
634         RING_LOCALS;
635
636         /* The sampler always gets flushed on i965 (sigh) */
637         if (IS_I965G(dev))
638                 flush_domains |= I915_GEM_DOMAIN_SAMPLER;
639         BEGIN_LP_RING(2);
640         OUT_RING(cmd);
641         OUT_RING(0); /* noop */
642         ADVANCE_LP_RING();
643         return flush_domains;
644 }
645
646 /**
647  * Moves buffers associated only with the given active seqno from the active
648  * to inactive list, potentially freeing them.
649  */
650 static void
651 i915_gem_retire_request(struct drm_device *dev,
652                         struct drm_i915_gem_request *request)
653 {
654         drm_i915_private_t *dev_priv = dev->dev_private;
655
656         /* Move any buffers on the active list that are no longer referenced
657          * by the ringbuffer to the flushing/inactive lists as appropriate.
658          */
659         while (!list_empty(&dev_priv->mm.active_list)) {
660                 struct drm_gem_object *obj;
661                 struct drm_i915_gem_object *obj_priv;
662
663                 obj_priv = list_first_entry(&dev_priv->mm.active_list,
664                                             struct drm_i915_gem_object,
665                                             list);
666                 obj = obj_priv->obj;
667
668                 /* If the seqno being retired doesn't match the oldest in the
669                  * list, then the oldest in the list must still be newer than
670                  * this seqno.
671                  */
672                 if (obj_priv->last_rendering_seqno != request->seqno)
673                         return;
674 #if WATCH_LRU
675                 DRM_INFO("%s: retire %d moves to inactive list %p\n",
676                          __func__, request->seqno, obj);
677 #endif
678
679                 if (obj->write_domain != 0) {
680                         list_move_tail(&obj_priv->list,
681                                        &dev_priv->mm.flushing_list);
682                 } else {
683                         i915_gem_object_move_to_inactive(obj);
684                 }
685         }
686
687         if (request->flush_domains != 0) {
688                 struct drm_i915_gem_object *obj_priv, *next;
689
690                 /* Clear the write domain and activity from any buffers
691                  * that are just waiting for a flush matching the one retired.
692                  */
693                 list_for_each_entry_safe(obj_priv, next,
694                                          &dev_priv->mm.flushing_list, list) {
695                         struct drm_gem_object *obj = obj_priv->obj;
696
697                         if (obj->write_domain & request->flush_domains) {
698                                 obj->write_domain = 0;
699                                 i915_gem_object_move_to_inactive(obj);
700                         }
701                 }
702
703         }
704 }
705
706 /**
707  * Returns true if seq1 is later than seq2.
708  */
709 static int
710 i915_seqno_passed(uint32_t seq1, uint32_t seq2)
711 {
712         return (int32_t)(seq1 - seq2) >= 0;
713 }
714
715 uint32_t
716 i915_get_gem_seqno(struct drm_device *dev)
717 {
718         drm_i915_private_t *dev_priv = dev->dev_private;
719
720         return READ_HWSP(dev_priv, I915_GEM_HWS_INDEX);
721 }
722
723 /**
724  * This function clears the request list as sequence numbers are passed.
725  */
726 void
727 i915_gem_retire_requests(struct drm_device *dev)
728 {
729         drm_i915_private_t *dev_priv = dev->dev_private;
730         uint32_t seqno;
731
732         seqno = i915_get_gem_seqno(dev);
733
734         while (!list_empty(&dev_priv->mm.request_list)) {
735                 struct drm_i915_gem_request *request;
736                 uint32_t retiring_seqno;
737
738                 request = list_first_entry(&dev_priv->mm.request_list,
739                                            struct drm_i915_gem_request,
740                                            list);
741                 retiring_seqno = request->seqno;
742
743                 if (i915_seqno_passed(seqno, retiring_seqno) ||
744                     dev_priv->mm.wedged) {
745                         i915_gem_retire_request(dev, request);
746
747                         list_del(&request->list);
748                         drm_free(request, sizeof(*request), DRM_MEM_DRIVER);
749                 } else
750                         break;
751         }
752 }
753
754 void
755 i915_gem_retire_work_handler(struct work_struct *work)
756 {
757         drm_i915_private_t *dev_priv;
758         struct drm_device *dev;
759
760         dev_priv = container_of(work, drm_i915_private_t,
761                                 mm.retire_work.work);
762         dev = dev_priv->dev;
763
764         mutex_lock(&dev->struct_mutex);
765         i915_gem_retire_requests(dev);
766         if (!dev_priv->mm.suspended &&
767             !list_empty(&dev_priv->mm.request_list))
768                 schedule_delayed_work(&dev_priv->mm.retire_work, HZ);
769         mutex_unlock(&dev->struct_mutex);
770 }
771
772 /**
773  * Waits for a sequence number to be signaled, and cleans up the
774  * request and object lists appropriately for that event.
775  */
776 static int
777 i915_wait_request(struct drm_device *dev, uint32_t seqno)
778 {
779         drm_i915_private_t *dev_priv = dev->dev_private;
780         int ret = 0;
781
782         BUG_ON(seqno == 0);
783
784         if (!i915_seqno_passed(i915_get_gem_seqno(dev), seqno)) {
785                 dev_priv->mm.waiting_gem_seqno = seqno;
786                 i915_user_irq_get(dev);
787                 ret = wait_event_interruptible(dev_priv->irq_queue,
788                                                i915_seqno_passed(i915_get_gem_seqno(dev),
789                                                                  seqno) ||
790                                                dev_priv->mm.wedged);
791                 i915_user_irq_put(dev);
792                 dev_priv->mm.waiting_gem_seqno = 0;
793         }
794         if (dev_priv->mm.wedged)
795                 ret = -EIO;
796
797         if (ret && ret != -ERESTARTSYS)
798                 DRM_ERROR("%s returns %d (awaiting %d at %d)\n",
799                           __func__, ret, seqno, i915_get_gem_seqno(dev));
800
801         /* Directly dispatch request retiring.  While we have the work queue
802          * to handle this, the waiter on a request often wants an associated
803          * buffer to have made it to the inactive list, and we would need
804          * a separate wait queue to handle that.
805          */
806         if (ret == 0)
807                 i915_gem_retire_requests(dev);
808
809         return ret;
810 }
811
812 static void
813 i915_gem_flush(struct drm_device *dev,
814                uint32_t invalidate_domains,
815                uint32_t flush_domains)
816 {
817         drm_i915_private_t *dev_priv = dev->dev_private;
818         uint32_t cmd;
819         RING_LOCALS;
820
821 #if WATCH_EXEC
822         DRM_INFO("%s: invalidate %08x flush %08x\n", __func__,
823                   invalidate_domains, flush_domains);
824 #endif
825
826         if (flush_domains & I915_GEM_DOMAIN_CPU)
827                 drm_agp_chipset_flush(dev);
828
829         if ((invalidate_domains | flush_domains) & ~(I915_GEM_DOMAIN_CPU |
830                                                      I915_GEM_DOMAIN_GTT)) {
831                 /*
832                  * read/write caches:
833                  *
834                  * I915_GEM_DOMAIN_RENDER is always invalidated, but is
835                  * only flushed if MI_NO_WRITE_FLUSH is unset.  On 965, it is
836                  * also flushed at 2d versus 3d pipeline switches.
837                  *
838                  * read-only caches:
839                  *
840                  * I915_GEM_DOMAIN_SAMPLER is flushed on pre-965 if
841                  * MI_READ_FLUSH is set, and is always flushed on 965.
842                  *
843                  * I915_GEM_DOMAIN_COMMAND may not exist?
844                  *
845                  * I915_GEM_DOMAIN_INSTRUCTION, which exists on 965, is
846                  * invalidated when MI_EXE_FLUSH is set.
847                  *
848                  * I915_GEM_DOMAIN_VERTEX, which exists on 965, is
849                  * invalidated with every MI_FLUSH.
850                  *
851                  * TLBs:
852                  *
853                  * On 965, TLBs associated with I915_GEM_DOMAIN_COMMAND
854                  * and I915_GEM_DOMAIN_CPU in are invalidated at PTE write and
855                  * I915_GEM_DOMAIN_RENDER and I915_GEM_DOMAIN_SAMPLER
856                  * are flushed at any MI_FLUSH.
857                  */
858
859                 cmd = MI_FLUSH | MI_NO_WRITE_FLUSH;
860                 if ((invalidate_domains|flush_domains) &
861                     I915_GEM_DOMAIN_RENDER)
862                         cmd &= ~MI_NO_WRITE_FLUSH;
863                 if (!IS_I965G(dev)) {
864                         /*
865                          * On the 965, the sampler cache always gets flushed
866                          * and this bit is reserved.
867                          */
868                         if (invalidate_domains & I915_GEM_DOMAIN_SAMPLER)
869                                 cmd |= MI_READ_FLUSH;
870                 }
871                 if (invalidate_domains & I915_GEM_DOMAIN_INSTRUCTION)
872                         cmd |= MI_EXE_FLUSH;
873
874 #if WATCH_EXEC
875                 DRM_INFO("%s: queue flush %08x to ring\n", __func__, cmd);
876 #endif
877                 BEGIN_LP_RING(2);
878                 OUT_RING(cmd);
879                 OUT_RING(0); /* noop */
880                 ADVANCE_LP_RING();
881         }
882 }
883
884 /**
885  * Ensures that all rendering to the object has completed and the object is
886  * safe to unbind from the GTT or access from the CPU.
887  */
888 static int
889 i915_gem_object_wait_rendering(struct drm_gem_object *obj)
890 {
891         struct drm_device *dev = obj->dev;
892         struct drm_i915_gem_object *obj_priv = obj->driver_private;
893         int ret;
894
895         /* If there are writes queued to the buffer, flush and
896          * create a new seqno to wait for.
897          */
898         if (obj->write_domain & ~(I915_GEM_DOMAIN_CPU|I915_GEM_DOMAIN_GTT)) {
899                 uint32_t write_domain = obj->write_domain;
900 #if WATCH_BUF
901                 DRM_INFO("%s: flushing object %p from write domain %08x\n",
902                           __func__, obj, write_domain);
903 #endif
904                 i915_gem_flush(dev, 0, write_domain);
905
906                 i915_gem_object_move_to_active(obj);
907                 obj_priv->last_rendering_seqno = i915_add_request(dev,
908                                                                   write_domain);
909                 BUG_ON(obj_priv->last_rendering_seqno == 0);
910 #if WATCH_LRU
911                 DRM_INFO("%s: flush moves to exec list %p\n", __func__, obj);
912 #endif
913         }
914
915         /* If there is rendering queued on the buffer being evicted, wait for
916          * it.
917          */
918         if (obj_priv->active) {
919 #if WATCH_BUF
920                 DRM_INFO("%s: object %p wait for seqno %08x\n",
921                           __func__, obj, obj_priv->last_rendering_seqno);
922 #endif
923                 ret = i915_wait_request(dev, obj_priv->last_rendering_seqno);
924                 if (ret != 0)
925                         return ret;
926         }
927
928         return 0;
929 }
930
931 /**
932  * Unbinds an object from the GTT aperture.
933  */
934 static int
935 i915_gem_object_unbind(struct drm_gem_object *obj)
936 {
937         struct drm_device *dev = obj->dev;
938         struct drm_i915_gem_object *obj_priv = obj->driver_private;
939         int ret = 0;
940
941 #if WATCH_BUF
942         DRM_INFO("%s:%d %p\n", __func__, __LINE__, obj);
943         DRM_INFO("gtt_space %p\n", obj_priv->gtt_space);
944 #endif
945         if (obj_priv->gtt_space == NULL)
946                 return 0;
947
948         if (obj_priv->pin_count != 0) {
949                 DRM_ERROR("Attempting to unbind pinned buffer\n");
950                 return -EINVAL;
951         }
952
953         /* Wait for any rendering to complete
954          */
955         ret = i915_gem_object_wait_rendering(obj);
956         if (ret) {
957                 DRM_ERROR("wait_rendering failed: %d\n", ret);
958                 return ret;
959         }
960
961         /* Move the object to the CPU domain to ensure that
962          * any possible CPU writes while it's not in the GTT
963          * are flushed when we go to remap it. This will
964          * also ensure that all pending GPU writes are finished
965          * before we unbind.
966          */
967         ret = i915_gem_object_set_domain(obj, I915_GEM_DOMAIN_CPU,
968                                          I915_GEM_DOMAIN_CPU);
969         if (ret) {
970                 DRM_ERROR("set_domain failed: %d\n", ret);
971                 return ret;
972         }
973
974         if (obj_priv->agp_mem != NULL) {
975                 drm_unbind_agp(obj_priv->agp_mem);
976                 drm_free_agp(obj_priv->agp_mem, obj->size / PAGE_SIZE);
977                 obj_priv->agp_mem = NULL;
978         }
979
980         BUG_ON(obj_priv->active);
981
982         i915_gem_object_free_page_list(obj);
983
984         if (obj_priv->gtt_space) {
985                 atomic_dec(&dev->gtt_count);
986                 atomic_sub(obj->size, &dev->gtt_memory);
987
988                 drm_mm_put_block(obj_priv->gtt_space);
989                 obj_priv->gtt_space = NULL;
990         }
991
992         /* Remove ourselves from the LRU list if present. */
993         if (!list_empty(&obj_priv->list))
994                 list_del_init(&obj_priv->list);
995
996         return 0;
997 }
998
999 static int
1000 i915_gem_evict_something(struct drm_device *dev)
1001 {
1002         drm_i915_private_t *dev_priv = dev->dev_private;
1003         struct drm_gem_object *obj;
1004         struct drm_i915_gem_object *obj_priv;
1005         int ret = 0;
1006
1007         for (;;) {
1008                 /* If there's an inactive buffer available now, grab it
1009                  * and be done.
1010                  */
1011                 if (!list_empty(&dev_priv->mm.inactive_list)) {
1012                         obj_priv = list_first_entry(&dev_priv->mm.inactive_list,
1013                                                     struct drm_i915_gem_object,
1014                                                     list);
1015                         obj = obj_priv->obj;
1016                         BUG_ON(obj_priv->pin_count != 0);
1017 #if WATCH_LRU
1018                         DRM_INFO("%s: evicting %p\n", __func__, obj);
1019 #endif
1020                         BUG_ON(obj_priv->active);
1021
1022                         /* Wait on the rendering and unbind the buffer. */
1023                         ret = i915_gem_object_unbind(obj);
1024                         break;
1025                 }
1026
1027                 /* If we didn't get anything, but the ring is still processing
1028                  * things, wait for one of those things to finish and hopefully
1029                  * leave us a buffer to evict.
1030                  */
1031                 if (!list_empty(&dev_priv->mm.request_list)) {
1032                         struct drm_i915_gem_request *request;
1033
1034                         request = list_first_entry(&dev_priv->mm.request_list,
1035                                                    struct drm_i915_gem_request,
1036                                                    list);
1037
1038                         ret = i915_wait_request(dev, request->seqno);
1039                         if (ret)
1040                                 break;
1041
1042                         /* if waiting caused an object to become inactive,
1043                          * then loop around and wait for it. Otherwise, we
1044                          * assume that waiting freed and unbound something,
1045                          * so there should now be some space in the GTT
1046                          */
1047                         if (!list_empty(&dev_priv->mm.inactive_list))
1048                                 continue;
1049                         break;
1050                 }
1051
1052                 /* If we didn't have anything on the request list but there
1053                  * are buffers awaiting a flush, emit one and try again.
1054                  * When we wait on it, those buffers waiting for that flush
1055                  * will get moved to inactive.
1056                  */
1057                 if (!list_empty(&dev_priv->mm.flushing_list)) {
1058                         obj_priv = list_first_entry(&dev_priv->mm.flushing_list,
1059                                                     struct drm_i915_gem_object,
1060                                                     list);
1061                         obj = obj_priv->obj;
1062
1063                         i915_gem_flush(dev,
1064                                        obj->write_domain,
1065                                        obj->write_domain);
1066                         i915_add_request(dev, obj->write_domain);
1067
1068                         obj = NULL;
1069                         continue;
1070                 }
1071
1072                 DRM_ERROR("inactive empty %d request empty %d "
1073                           "flushing empty %d\n",
1074                           list_empty(&dev_priv->mm.inactive_list),
1075                           list_empty(&dev_priv->mm.request_list),
1076                           list_empty(&dev_priv->mm.flushing_list));
1077                 /* If we didn't do any of the above, there's nothing to be done
1078                  * and we just can't fit it in.
1079                  */
1080                 return -ENOMEM;
1081         }
1082         return ret;
1083 }
1084
1085 static int
1086 i915_gem_object_get_page_list(struct drm_gem_object *obj)
1087 {
1088         struct drm_i915_gem_object *obj_priv = obj->driver_private;
1089         int page_count, i;
1090         struct address_space *mapping;
1091         struct inode *inode;
1092         struct page *page;
1093         int ret;
1094
1095         if (obj_priv->page_list)
1096                 return 0;
1097
1098         /* Get the list of pages out of our struct file.  They'll be pinned
1099          * at this point until we release them.
1100          */
1101         page_count = obj->size / PAGE_SIZE;
1102         BUG_ON(obj_priv->page_list != NULL);
1103         obj_priv->page_list = drm_calloc(page_count, sizeof(struct page *),
1104                                          DRM_MEM_DRIVER);
1105         if (obj_priv->page_list == NULL) {
1106                 DRM_ERROR("Faled to allocate page list\n");
1107                 return -ENOMEM;
1108         }
1109
1110         inode = obj->filp->f_path.dentry->d_inode;
1111         mapping = inode->i_mapping;
1112         for (i = 0; i < page_count; i++) {
1113                 page = read_mapping_page(mapping, i, NULL);
1114                 if (IS_ERR(page)) {
1115                         ret = PTR_ERR(page);
1116                         DRM_ERROR("read_mapping_page failed: %d\n", ret);
1117                         i915_gem_object_free_page_list(obj);
1118                         return ret;
1119                 }
1120                 obj_priv->page_list[i] = page;
1121         }
1122         return 0;
1123 }
1124
1125 /**
1126  * Finds free space in the GTT aperture and binds the object there.
1127  */
1128 static int
1129 i915_gem_object_bind_to_gtt(struct drm_gem_object *obj, unsigned alignment)
1130 {
1131         struct drm_device *dev = obj->dev;
1132         drm_i915_private_t *dev_priv = dev->dev_private;
1133         struct drm_i915_gem_object *obj_priv = obj->driver_private;
1134         struct drm_mm_node *free_space;
1135         int page_count, ret;
1136
1137         if (alignment == 0)
1138                 alignment = PAGE_SIZE;
1139         if (alignment & (PAGE_SIZE - 1)) {
1140                 DRM_ERROR("Invalid object alignment requested %u\n", alignment);
1141                 return -EINVAL;
1142         }
1143
1144  search_free:
1145         free_space = drm_mm_search_free(&dev_priv->mm.gtt_space,
1146                                         obj->size, alignment, 0);
1147         if (free_space != NULL) {
1148                 obj_priv->gtt_space = drm_mm_get_block(free_space, obj->size,
1149                                                        alignment);
1150                 if (obj_priv->gtt_space != NULL) {
1151                         obj_priv->gtt_space->private = obj;
1152                         obj_priv->gtt_offset = obj_priv->gtt_space->start;
1153                 }
1154         }
1155         if (obj_priv->gtt_space == NULL) {
1156                 /* If the gtt is empty and we're still having trouble
1157                  * fitting our object in, we're out of memory.
1158                  */
1159 #if WATCH_LRU
1160                 DRM_INFO("%s: GTT full, evicting something\n", __func__);
1161 #endif
1162                 if (list_empty(&dev_priv->mm.inactive_list) &&
1163                     list_empty(&dev_priv->mm.flushing_list) &&
1164                     list_empty(&dev_priv->mm.active_list)) {
1165                         DRM_ERROR("GTT full, but LRU list empty\n");
1166                         return -ENOMEM;
1167                 }
1168
1169                 ret = i915_gem_evict_something(dev);
1170                 if (ret != 0) {
1171                         DRM_ERROR("Failed to evict a buffer %d\n", ret);
1172                         return ret;
1173                 }
1174                 goto search_free;
1175         }
1176
1177 #if WATCH_BUF
1178         DRM_INFO("Binding object of size %d at 0x%08x\n",
1179                  obj->size, obj_priv->gtt_offset);
1180 #endif
1181         ret = i915_gem_object_get_page_list(obj);
1182         if (ret) {
1183                 drm_mm_put_block(obj_priv->gtt_space);
1184                 obj_priv->gtt_space = NULL;
1185                 return ret;
1186         }
1187
1188         page_count = obj->size / PAGE_SIZE;
1189         /* Create an AGP memory structure pointing at our pages, and bind it
1190          * into the GTT.
1191          */
1192         obj_priv->agp_mem = drm_agp_bind_pages(dev,
1193                                                obj_priv->page_list,
1194                                                page_count,
1195                                                obj_priv->gtt_offset,
1196                                                obj_priv->agp_type);
1197         if (obj_priv->agp_mem == NULL) {
1198                 i915_gem_object_free_page_list(obj);
1199                 drm_mm_put_block(obj_priv->gtt_space);
1200                 obj_priv->gtt_space = NULL;
1201                 return -ENOMEM;
1202         }
1203         atomic_inc(&dev->gtt_count);
1204         atomic_add(obj->size, &dev->gtt_memory);
1205
1206         /* Assert that the object is not currently in any GPU domain. As it
1207          * wasn't in the GTT, there shouldn't be any way it could have been in
1208          * a GPU cache
1209          */
1210         BUG_ON(obj->read_domains & ~(I915_GEM_DOMAIN_CPU|I915_GEM_DOMAIN_GTT));
1211         BUG_ON(obj->write_domain & ~(I915_GEM_DOMAIN_CPU|I915_GEM_DOMAIN_GTT));
1212
1213         return 0;
1214 }
1215
1216 void
1217 i915_gem_clflush_object(struct drm_gem_object *obj)
1218 {
1219         struct drm_i915_gem_object      *obj_priv = obj->driver_private;
1220
1221         /* If we don't have a page list set up, then we're not pinned
1222          * to GPU, and we can ignore the cache flush because it'll happen
1223          * again at bind time.
1224          */
1225         if (obj_priv->page_list == NULL)
1226                 return;
1227
1228         drm_clflush_pages(obj_priv->page_list, obj->size / PAGE_SIZE);
1229 }
1230
1231 /*
1232  * Set the next domain for the specified object. This
1233  * may not actually perform the necessary flushing/invaliding though,
1234  * as that may want to be batched with other set_domain operations
1235  *
1236  * This is (we hope) the only really tricky part of gem. The goal
1237  * is fairly simple -- track which caches hold bits of the object
1238  * and make sure they remain coherent. A few concrete examples may
1239  * help to explain how it works. For shorthand, we use the notation
1240  * (read_domains, write_domain), e.g. (CPU, CPU) to indicate the
1241  * a pair of read and write domain masks.
1242  *
1243  * Case 1: the batch buffer
1244  *
1245  *      1. Allocated
1246  *      2. Written by CPU
1247  *      3. Mapped to GTT
1248  *      4. Read by GPU
1249  *      5. Unmapped from GTT
1250  *      6. Freed
1251  *
1252  *      Let's take these a step at a time
1253  *
1254  *      1. Allocated
1255  *              Pages allocated from the kernel may still have
1256  *              cache contents, so we set them to (CPU, CPU) always.
1257  *      2. Written by CPU (using pwrite)
1258  *              The pwrite function calls set_domain (CPU, CPU) and
1259  *              this function does nothing (as nothing changes)
1260  *      3. Mapped by GTT
1261  *              This function asserts that the object is not
1262  *              currently in any GPU-based read or write domains
1263  *      4. Read by GPU
1264  *              i915_gem_execbuffer calls set_domain (COMMAND, 0).
1265  *              As write_domain is zero, this function adds in the
1266  *              current read domains (CPU+COMMAND, 0).
1267  *              flush_domains is set to CPU.
1268  *              invalidate_domains is set to COMMAND
1269  *              clflush is run to get data out of the CPU caches
1270  *              then i915_dev_set_domain calls i915_gem_flush to
1271  *              emit an MI_FLUSH and drm_agp_chipset_flush
1272  *      5. Unmapped from GTT
1273  *              i915_gem_object_unbind calls set_domain (CPU, CPU)
1274  *              flush_domains and invalidate_domains end up both zero
1275  *              so no flushing/invalidating happens
1276  *      6. Freed
1277  *              yay, done
1278  *
1279  * Case 2: The shared render buffer
1280  *
1281  *      1. Allocated
1282  *      2. Mapped to GTT
1283  *      3. Read/written by GPU
1284  *      4. set_domain to (CPU,CPU)
1285  *      5. Read/written by CPU
1286  *      6. Read/written by GPU
1287  *
1288  *      1. Allocated
1289  *              Same as last example, (CPU, CPU)
1290  *      2. Mapped to GTT
1291  *              Nothing changes (assertions find that it is not in the GPU)
1292  *      3. Read/written by GPU
1293  *              execbuffer calls set_domain (RENDER, RENDER)
1294  *              flush_domains gets CPU
1295  *              invalidate_domains gets GPU
1296  *              clflush (obj)
1297  *              MI_FLUSH and drm_agp_chipset_flush
1298  *      4. set_domain (CPU, CPU)
1299  *              flush_domains gets GPU
1300  *              invalidate_domains gets CPU
1301  *              wait_rendering (obj) to make sure all drawing is complete.
1302  *              This will include an MI_FLUSH to get the data from GPU
1303  *              to memory
1304  *              clflush (obj) to invalidate the CPU cache
1305  *              Another MI_FLUSH in i915_gem_flush (eliminate this somehow?)
1306  *      5. Read/written by CPU
1307  *              cache lines are loaded and dirtied
1308  *      6. Read written by GPU
1309  *              Same as last GPU access
1310  *
1311  * Case 3: The constant buffer
1312  *
1313  *      1. Allocated
1314  *      2. Written by CPU
1315  *      3. Read by GPU
1316  *      4. Updated (written) by CPU again
1317  *      5. Read by GPU
1318  *
1319  *      1. Allocated
1320  *              (CPU, CPU)
1321  *      2. Written by CPU
1322  *              (CPU, CPU)
1323  *      3. Read by GPU
1324  *              (CPU+RENDER, 0)
1325  *              flush_domains = CPU
1326  *              invalidate_domains = RENDER
1327  *              clflush (obj)
1328  *              MI_FLUSH
1329  *              drm_agp_chipset_flush
1330  *      4. Updated (written) by CPU again
1331  *              (CPU, CPU)
1332  *              flush_domains = 0 (no previous write domain)
1333  *              invalidate_domains = 0 (no new read domains)
1334  *      5. Read by GPU
1335  *              (CPU+RENDER, 0)
1336  *              flush_domains = CPU
1337  *              invalidate_domains = RENDER
1338  *              clflush (obj)
1339  *              MI_FLUSH
1340  *              drm_agp_chipset_flush
1341  */
1342 static int
1343 i915_gem_object_set_domain(struct drm_gem_object *obj,
1344                             uint32_t read_domains,
1345                             uint32_t write_domain)
1346 {
1347         struct drm_device               *dev = obj->dev;
1348         struct drm_i915_gem_object      *obj_priv = obj->driver_private;
1349         uint32_t                        invalidate_domains = 0;
1350         uint32_t                        flush_domains = 0;
1351         int                             ret;
1352
1353 #if WATCH_BUF
1354         DRM_INFO("%s: object %p read %08x -> %08x write %08x -> %08x\n",
1355                  __func__, obj,
1356                  obj->read_domains, read_domains,
1357                  obj->write_domain, write_domain);
1358 #endif
1359         /*
1360          * If the object isn't moving to a new write domain,
1361          * let the object stay in multiple read domains
1362          */
1363         if (write_domain == 0)
1364                 read_domains |= obj->read_domains;
1365         else
1366                 obj_priv->dirty = 1;
1367
1368         /*
1369          * Flush the current write domain if
1370          * the new read domains don't match. Invalidate
1371          * any read domains which differ from the old
1372          * write domain
1373          */
1374         if (obj->write_domain && obj->write_domain != read_domains) {
1375                 flush_domains |= obj->write_domain;
1376                 invalidate_domains |= read_domains & ~obj->write_domain;
1377         }
1378         /*
1379          * Invalidate any read caches which may have
1380          * stale data. That is, any new read domains.
1381          */
1382         invalidate_domains |= read_domains & ~obj->read_domains;
1383         if ((flush_domains | invalidate_domains) & I915_GEM_DOMAIN_CPU) {
1384 #if WATCH_BUF
1385                 DRM_INFO("%s: CPU domain flush %08x invalidate %08x\n",
1386                          __func__, flush_domains, invalidate_domains);
1387 #endif
1388                 /*
1389                  * If we're invaliding the CPU cache and flushing a GPU cache,
1390                  * then pause for rendering so that the GPU caches will be
1391                  * flushed before the cpu cache is invalidated
1392                  */
1393                 if ((invalidate_domains & I915_GEM_DOMAIN_CPU) &&
1394                     (flush_domains & ~(I915_GEM_DOMAIN_CPU |
1395                                        I915_GEM_DOMAIN_GTT))) {
1396                         ret = i915_gem_object_wait_rendering(obj);
1397                         if (ret)
1398                                 return ret;
1399                 }
1400                 i915_gem_clflush_object(obj);
1401         }
1402
1403         if ((write_domain | flush_domains) != 0)
1404                 obj->write_domain = write_domain;
1405
1406         /* If we're invalidating the CPU domain, clear the per-page CPU
1407          * domain list as well.
1408          */
1409         if (obj_priv->page_cpu_valid != NULL &&
1410             (write_domain != 0 ||
1411              read_domains & I915_GEM_DOMAIN_CPU)) {
1412                 drm_free(obj_priv->page_cpu_valid, obj->size / PAGE_SIZE,
1413                          DRM_MEM_DRIVER);
1414                 obj_priv->page_cpu_valid = NULL;
1415         }
1416         obj->read_domains = read_domains;
1417
1418         dev->invalidate_domains |= invalidate_domains;
1419         dev->flush_domains |= flush_domains;
1420 #if WATCH_BUF
1421         DRM_INFO("%s: read %08x write %08x invalidate %08x flush %08x\n",
1422                  __func__,
1423                  obj->read_domains, obj->write_domain,
1424                  dev->invalidate_domains, dev->flush_domains);
1425 #endif
1426         return 0;
1427 }
1428
1429 /**
1430  * Set the read/write domain on a range of the object.
1431  *
1432  * Currently only implemented for CPU reads, otherwise drops to normal
1433  * i915_gem_object_set_domain().
1434  */
1435 static int
1436 i915_gem_object_set_domain_range(struct drm_gem_object *obj,
1437                                  uint64_t offset,
1438                                  uint64_t size,
1439                                  uint32_t read_domains,
1440                                  uint32_t write_domain)
1441 {
1442         struct drm_i915_gem_object *obj_priv = obj->driver_private;
1443         int ret, i;
1444
1445         if (obj->read_domains & I915_GEM_DOMAIN_CPU)
1446                 return 0;
1447
1448         if (read_domains != I915_GEM_DOMAIN_CPU ||
1449             write_domain != 0)
1450                 return i915_gem_object_set_domain(obj,
1451                                                   read_domains, write_domain);
1452
1453         /* Wait on any GPU rendering to the object to be flushed. */
1454         ret = i915_gem_object_wait_rendering(obj);
1455         if (ret)
1456                 return ret;
1457
1458         if (obj_priv->page_cpu_valid == NULL) {
1459                 obj_priv->page_cpu_valid = drm_calloc(1, obj->size / PAGE_SIZE,
1460                                                       DRM_MEM_DRIVER);
1461         }
1462
1463         /* Flush the cache on any pages that are still invalid from the CPU's
1464          * perspective.
1465          */
1466         for (i = offset / PAGE_SIZE; i <= (offset + size - 1) / PAGE_SIZE; i++) {
1467                 if (obj_priv->page_cpu_valid[i])
1468                         continue;
1469
1470                 drm_clflush_pages(obj_priv->page_list + i, 1);
1471
1472                 obj_priv->page_cpu_valid[i] = 1;
1473         }
1474
1475         return 0;
1476 }
1477
1478 /**
1479  * Once all of the objects have been set in the proper domain,
1480  * perform the necessary flush and invalidate operations.
1481  *
1482  * Returns the write domains flushed, for use in flush tracking.
1483  */
1484 static uint32_t
1485 i915_gem_dev_set_domain(struct drm_device *dev)
1486 {
1487         uint32_t flush_domains = dev->flush_domains;
1488
1489         /*
1490          * Now that all the buffers are synced to the proper domains,
1491          * flush and invalidate the collected domains
1492          */
1493         if (dev->invalidate_domains | dev->flush_domains) {
1494 #if WATCH_EXEC
1495                 DRM_INFO("%s: invalidate_domains %08x flush_domains %08x\n",
1496                           __func__,
1497                          dev->invalidate_domains,
1498                          dev->flush_domains);
1499 #endif
1500                 i915_gem_flush(dev,
1501                                dev->invalidate_domains,
1502                                dev->flush_domains);
1503                 dev->invalidate_domains = 0;
1504                 dev->flush_domains = 0;
1505         }
1506
1507         return flush_domains;
1508 }
1509
1510 /**
1511  * Pin an object to the GTT and evaluate the relocations landing in it.
1512  */
1513 static int
1514 i915_gem_object_pin_and_relocate(struct drm_gem_object *obj,
1515                                  struct drm_file *file_priv,
1516                                  struct drm_i915_gem_exec_object *entry)
1517 {
1518         struct drm_device *dev = obj->dev;
1519         drm_i915_private_t *dev_priv = dev->dev_private;
1520         struct drm_i915_gem_relocation_entry reloc;
1521         struct drm_i915_gem_relocation_entry __user *relocs;
1522         struct drm_i915_gem_object *obj_priv = obj->driver_private;
1523         int i, ret;
1524         void __iomem *reloc_page;
1525
1526         /* Choose the GTT offset for our buffer and put it there. */
1527         ret = i915_gem_object_pin(obj, (uint32_t) entry->alignment);
1528         if (ret)
1529                 return ret;
1530
1531         entry->offset = obj_priv->gtt_offset;
1532
1533         relocs = (struct drm_i915_gem_relocation_entry __user *)
1534                  (uintptr_t) entry->relocs_ptr;
1535         /* Apply the relocations, using the GTT aperture to avoid cache
1536          * flushing requirements.
1537          */
1538         for (i = 0; i < entry->relocation_count; i++) {
1539                 struct drm_gem_object *target_obj;
1540                 struct drm_i915_gem_object *target_obj_priv;
1541                 uint32_t reloc_val, reloc_offset;
1542                 uint32_t __iomem *reloc_entry;
1543
1544                 ret = copy_from_user(&reloc, relocs + i, sizeof(reloc));
1545                 if (ret != 0) {
1546                         i915_gem_object_unpin(obj);
1547                         return ret;
1548                 }
1549
1550                 target_obj = drm_gem_object_lookup(obj->dev, file_priv,
1551                                                    reloc.target_handle);
1552                 if (target_obj == NULL) {
1553                         i915_gem_object_unpin(obj);
1554                         return -EBADF;
1555                 }
1556                 target_obj_priv = target_obj->driver_private;
1557
1558                 /* The target buffer should have appeared before us in the
1559                  * exec_object list, so it should have a GTT space bound by now.
1560                  */
1561                 if (target_obj_priv->gtt_space == NULL) {
1562                         DRM_ERROR("No GTT space found for object %d\n",
1563                                   reloc.target_handle);
1564                         drm_gem_object_unreference(target_obj);
1565                         i915_gem_object_unpin(obj);
1566                         return -EINVAL;
1567                 }
1568
1569                 if (reloc.offset > obj->size - 4) {
1570                         DRM_ERROR("Relocation beyond object bounds: "
1571                                   "obj %p target %d offset %d size %d.\n",
1572                                   obj, reloc.target_handle,
1573                                   (int) reloc.offset, (int) obj->size);
1574                         drm_gem_object_unreference(target_obj);
1575                         i915_gem_object_unpin(obj);
1576                         return -EINVAL;
1577                 }
1578                 if (reloc.offset & 3) {
1579                         DRM_ERROR("Relocation not 4-byte aligned: "
1580                                   "obj %p target %d offset %d.\n",
1581                                   obj, reloc.target_handle,
1582                                   (int) reloc.offset);
1583                         drm_gem_object_unreference(target_obj);
1584                         i915_gem_object_unpin(obj);
1585                         return -EINVAL;
1586                 }
1587
1588                 if (reloc.write_domain && target_obj->pending_write_domain &&
1589                     reloc.write_domain != target_obj->pending_write_domain) {
1590                         DRM_ERROR("Write domain conflict: "
1591                                   "obj %p target %d offset %d "
1592                                   "new %08x old %08x\n",
1593                                   obj, reloc.target_handle,
1594                                   (int) reloc.offset,
1595                                   reloc.write_domain,
1596                                   target_obj->pending_write_domain);
1597                         drm_gem_object_unreference(target_obj);
1598                         i915_gem_object_unpin(obj);
1599                         return -EINVAL;
1600                 }
1601
1602 #if WATCH_RELOC
1603                 DRM_INFO("%s: obj %p offset %08x target %d "
1604                          "read %08x write %08x gtt %08x "
1605                          "presumed %08x delta %08x\n",
1606                          __func__,
1607                          obj,
1608                          (int) reloc.offset,
1609                          (int) reloc.target_handle,
1610                          (int) reloc.read_domains,
1611                          (int) reloc.write_domain,
1612                          (int) target_obj_priv->gtt_offset,
1613                          (int) reloc.presumed_offset,
1614                          reloc.delta);
1615 #endif
1616
1617                 target_obj->pending_read_domains |= reloc.read_domains;
1618                 target_obj->pending_write_domain |= reloc.write_domain;
1619
1620                 /* If the relocation already has the right value in it, no
1621                  * more work needs to be done.
1622                  */
1623                 if (target_obj_priv->gtt_offset == reloc.presumed_offset) {
1624                         drm_gem_object_unreference(target_obj);
1625                         continue;
1626                 }
1627
1628                 /* Now that we're going to actually write some data in,
1629                  * make sure that any rendering using this buffer's contents
1630                  * is completed.
1631                  */
1632                 i915_gem_object_wait_rendering(obj);
1633
1634                 /* As we're writing through the gtt, flush
1635                  * any CPU writes before we write the relocations
1636                  */
1637                 if (obj->write_domain & I915_GEM_DOMAIN_CPU) {
1638                         i915_gem_clflush_object(obj);
1639                         drm_agp_chipset_flush(dev);
1640                         obj->write_domain = 0;
1641                 }
1642
1643                 /* Map the page containing the relocation we're going to
1644                  * perform.
1645                  */
1646                 reloc_offset = obj_priv->gtt_offset + reloc.offset;
1647                 reloc_page = io_mapping_map_atomic_wc(dev_priv->mm.gtt_mapping,
1648                                                       (reloc_offset &
1649                                                        ~(PAGE_SIZE - 1)));
1650                 reloc_entry = (uint32_t __iomem *)(reloc_page +
1651                                                    (reloc_offset & (PAGE_SIZE - 1)));
1652                 reloc_val = target_obj_priv->gtt_offset + reloc.delta;
1653
1654 #if WATCH_BUF
1655                 DRM_INFO("Applied relocation: %p@0x%08x %08x -> %08x\n",
1656                           obj, (unsigned int) reloc.offset,
1657                           readl(reloc_entry), reloc_val);
1658 #endif
1659                 writel(reloc_val, reloc_entry);
1660                 io_mapping_unmap_atomic(reloc_page);
1661
1662                 /* Write the updated presumed offset for this entry back out
1663                  * to the user.
1664                  */
1665                 reloc.presumed_offset = target_obj_priv->gtt_offset;
1666                 ret = copy_to_user(relocs + i, &reloc, sizeof(reloc));
1667                 if (ret != 0) {
1668                         drm_gem_object_unreference(target_obj);
1669                         i915_gem_object_unpin(obj);
1670                         return ret;
1671                 }
1672
1673                 drm_gem_object_unreference(target_obj);
1674         }
1675
1676 #if WATCH_BUF
1677         if (0)
1678                 i915_gem_dump_object(obj, 128, __func__, ~0);
1679 #endif
1680         return 0;
1681 }
1682
1683 /** Dispatch a batchbuffer to the ring
1684  */
1685 static int
1686 i915_dispatch_gem_execbuffer(struct drm_device *dev,
1687                               struct drm_i915_gem_execbuffer *exec,
1688                               uint64_t exec_offset)
1689 {
1690         drm_i915_private_t *dev_priv = dev->dev_private;
1691         struct drm_clip_rect __user *boxes = (struct drm_clip_rect __user *)
1692                                              (uintptr_t) exec->cliprects_ptr;
1693         int nbox = exec->num_cliprects;
1694         int i = 0, count;
1695         uint32_t        exec_start, exec_len;
1696         RING_LOCALS;
1697
1698         exec_start = (uint32_t) exec_offset + exec->batch_start_offset;
1699         exec_len = (uint32_t) exec->batch_len;
1700
1701         if ((exec_start | exec_len) & 0x7) {
1702                 DRM_ERROR("alignment\n");
1703                 return -EINVAL;
1704         }
1705
1706         if (!exec_start)
1707                 return -EINVAL;
1708
1709         count = nbox ? nbox : 1;
1710
1711         for (i = 0; i < count; i++) {
1712                 if (i < nbox) {
1713                         int ret = i915_emit_box(dev, boxes, i,
1714                                                 exec->DR1, exec->DR4);
1715                         if (ret)
1716                                 return ret;
1717                 }
1718
1719                 if (IS_I830(dev) || IS_845G(dev)) {
1720                         BEGIN_LP_RING(4);
1721                         OUT_RING(MI_BATCH_BUFFER);
1722                         OUT_RING(exec_start | MI_BATCH_NON_SECURE);
1723                         OUT_RING(exec_start + exec_len - 4);
1724                         OUT_RING(0);
1725                         ADVANCE_LP_RING();
1726                 } else {
1727                         BEGIN_LP_RING(2);
1728                         if (IS_I965G(dev)) {
1729                                 OUT_RING(MI_BATCH_BUFFER_START |
1730                                          (2 << 6) |
1731                                          MI_BATCH_NON_SECURE_I965);
1732                                 OUT_RING(exec_start);
1733                         } else {
1734                                 OUT_RING(MI_BATCH_BUFFER_START |
1735                                          (2 << 6));
1736                                 OUT_RING(exec_start | MI_BATCH_NON_SECURE);
1737                         }
1738                         ADVANCE_LP_RING();
1739                 }
1740         }
1741
1742         /* XXX breadcrumb */
1743         return 0;
1744 }
1745
1746 /* Throttle our rendering by waiting until the ring has completed our requests
1747  * emitted over 20 msec ago.
1748  *
1749  * This should get us reasonable parallelism between CPU and GPU but also
1750  * relatively low latency when blocking on a particular request to finish.
1751  */
1752 static int
1753 i915_gem_ring_throttle(struct drm_device *dev, struct drm_file *file_priv)
1754 {
1755         struct drm_i915_file_private *i915_file_priv = file_priv->driver_priv;
1756         int ret = 0;
1757         uint32_t seqno;
1758
1759         mutex_lock(&dev->struct_mutex);
1760         seqno = i915_file_priv->mm.last_gem_throttle_seqno;
1761         i915_file_priv->mm.last_gem_throttle_seqno =
1762                 i915_file_priv->mm.last_gem_seqno;
1763         if (seqno)
1764                 ret = i915_wait_request(dev, seqno);
1765         mutex_unlock(&dev->struct_mutex);
1766         return ret;
1767 }
1768
1769 int
1770 i915_gem_execbuffer(struct drm_device *dev, void *data,
1771                     struct drm_file *file_priv)
1772 {
1773         drm_i915_private_t *dev_priv = dev->dev_private;
1774         struct drm_i915_file_private *i915_file_priv = file_priv->driver_priv;
1775         struct drm_i915_gem_execbuffer *args = data;
1776         struct drm_i915_gem_exec_object *exec_list = NULL;
1777         struct drm_gem_object **object_list = NULL;
1778         struct drm_gem_object *batch_obj;
1779         int ret, i, pinned = 0;
1780         uint64_t exec_offset;
1781         uint32_t seqno, flush_domains;
1782
1783 #if WATCH_EXEC
1784         DRM_INFO("buffers_ptr %d buffer_count %d len %08x\n",
1785                   (int) args->buffers_ptr, args->buffer_count, args->batch_len);
1786 #endif
1787
1788         if (args->buffer_count < 1) {
1789                 DRM_ERROR("execbuf with %d buffers\n", args->buffer_count);
1790                 return -EINVAL;
1791         }
1792         /* Copy in the exec list from userland */
1793         exec_list = drm_calloc(sizeof(*exec_list), args->buffer_count,
1794                                DRM_MEM_DRIVER);
1795         object_list = drm_calloc(sizeof(*object_list), args->buffer_count,
1796                                  DRM_MEM_DRIVER);
1797         if (exec_list == NULL || object_list == NULL) {
1798                 DRM_ERROR("Failed to allocate exec or object list "
1799                           "for %d buffers\n",
1800                           args->buffer_count);
1801                 ret = -ENOMEM;
1802                 goto pre_mutex_err;
1803         }
1804         ret = copy_from_user(exec_list,
1805                              (struct drm_i915_relocation_entry __user *)
1806                              (uintptr_t) args->buffers_ptr,
1807                              sizeof(*exec_list) * args->buffer_count);
1808         if (ret != 0) {
1809                 DRM_ERROR("copy %d exec entries failed %d\n",
1810                           args->buffer_count, ret);
1811                 goto pre_mutex_err;
1812         }
1813
1814         mutex_lock(&dev->struct_mutex);
1815
1816         i915_verify_inactive(dev, __FILE__, __LINE__);
1817
1818         if (dev_priv->mm.wedged) {
1819                 DRM_ERROR("Execbuf while wedged\n");
1820                 mutex_unlock(&dev->struct_mutex);
1821                 return -EIO;
1822         }
1823
1824         if (dev_priv->mm.suspended) {
1825                 DRM_ERROR("Execbuf while VT-switched.\n");
1826                 mutex_unlock(&dev->struct_mutex);
1827                 return -EBUSY;
1828         }
1829
1830         /* Zero the gloabl flush/invalidate flags. These
1831          * will be modified as each object is bound to the
1832          * gtt
1833          */
1834         dev->invalidate_domains = 0;
1835         dev->flush_domains = 0;
1836
1837         /* Look up object handles and perform the relocations */
1838         for (i = 0; i < args->buffer_count; i++) {
1839                 object_list[i] = drm_gem_object_lookup(dev, file_priv,
1840                                                        exec_list[i].handle);
1841                 if (object_list[i] == NULL) {
1842                         DRM_ERROR("Invalid object handle %d at index %d\n",
1843                                    exec_list[i].handle, i);
1844                         ret = -EBADF;
1845                         goto err;
1846                 }
1847
1848                 object_list[i]->pending_read_domains = 0;
1849                 object_list[i]->pending_write_domain = 0;
1850                 ret = i915_gem_object_pin_and_relocate(object_list[i],
1851                                                        file_priv,
1852                                                        &exec_list[i]);
1853                 if (ret) {
1854                         DRM_ERROR("object bind and relocate failed %d\n", ret);
1855                         goto err;
1856                 }
1857                 pinned = i + 1;
1858         }
1859
1860         /* Set the pending read domains for the batch buffer to COMMAND */
1861         batch_obj = object_list[args->buffer_count-1];
1862         batch_obj->pending_read_domains = I915_GEM_DOMAIN_COMMAND;
1863         batch_obj->pending_write_domain = 0;
1864
1865         i915_verify_inactive(dev, __FILE__, __LINE__);
1866
1867         for (i = 0; i < args->buffer_count; i++) {
1868                 struct drm_gem_object *obj = object_list[i];
1869
1870                 /* make sure all previous memory operations have passed */
1871                 ret = i915_gem_object_set_domain(obj,
1872                                                  obj->pending_read_domains,
1873                                                  obj->pending_write_domain);
1874                 if (ret)
1875                         goto err;
1876         }
1877
1878         i915_verify_inactive(dev, __FILE__, __LINE__);
1879
1880         /* Flush/invalidate caches and chipset buffer */
1881         flush_domains = i915_gem_dev_set_domain(dev);
1882
1883         i915_verify_inactive(dev, __FILE__, __LINE__);
1884
1885 #if WATCH_COHERENCY
1886         for (i = 0; i < args->buffer_count; i++) {
1887                 i915_gem_object_check_coherency(object_list[i],
1888                                                 exec_list[i].handle);
1889         }
1890 #endif
1891
1892         exec_offset = exec_list[args->buffer_count - 1].offset;
1893
1894 #if WATCH_EXEC
1895         i915_gem_dump_object(object_list[args->buffer_count - 1],
1896                               args->batch_len,
1897                               __func__,
1898                               ~0);
1899 #endif
1900
1901         (void)i915_add_request(dev, flush_domains);
1902
1903         /* Exec the batchbuffer */
1904         ret = i915_dispatch_gem_execbuffer(dev, args, exec_offset);
1905         if (ret) {
1906                 DRM_ERROR("dispatch failed %d\n", ret);
1907                 goto err;
1908         }
1909
1910         /*
1911          * Ensure that the commands in the batch buffer are
1912          * finished before the interrupt fires
1913          */
1914         flush_domains = i915_retire_commands(dev);
1915
1916         i915_verify_inactive(dev, __FILE__, __LINE__);
1917
1918         /*
1919          * Get a seqno representing the execution of the current buffer,
1920          * which we can wait on.  We would like to mitigate these interrupts,
1921          * likely by only creating seqnos occasionally (so that we have
1922          * *some* interrupts representing completion of buffers that we can
1923          * wait on when trying to clear up gtt space).
1924          */
1925         seqno = i915_add_request(dev, flush_domains);
1926         BUG_ON(seqno == 0);
1927         i915_file_priv->mm.last_gem_seqno = seqno;
1928         for (i = 0; i < args->buffer_count; i++) {
1929                 struct drm_gem_object *obj = object_list[i];
1930                 struct drm_i915_gem_object *obj_priv = obj->driver_private;
1931
1932                 i915_gem_object_move_to_active(obj);
1933                 obj_priv->last_rendering_seqno = seqno;
1934 #if WATCH_LRU
1935                 DRM_INFO("%s: move to exec list %p\n", __func__, obj);
1936 #endif
1937         }
1938 #if WATCH_LRU
1939         i915_dump_lru(dev, __func__);
1940 #endif
1941
1942         i915_verify_inactive(dev, __FILE__, __LINE__);
1943
1944         /* Copy the new buffer offsets back to the user's exec list. */
1945         ret = copy_to_user((struct drm_i915_relocation_entry __user *)
1946                            (uintptr_t) args->buffers_ptr,
1947                            exec_list,
1948                            sizeof(*exec_list) * args->buffer_count);
1949         if (ret)
1950                 DRM_ERROR("failed to copy %d exec entries "
1951                           "back to user (%d)\n",
1952                            args->buffer_count, ret);
1953 err:
1954         if (object_list != NULL) {
1955                 for (i = 0; i < pinned; i++)
1956                         i915_gem_object_unpin(object_list[i]);
1957
1958                 for (i = 0; i < args->buffer_count; i++)
1959                         drm_gem_object_unreference(object_list[i]);
1960         }
1961         mutex_unlock(&dev->struct_mutex);
1962
1963 pre_mutex_err:
1964         drm_free(object_list, sizeof(*object_list) * args->buffer_count,
1965                  DRM_MEM_DRIVER);
1966         drm_free(exec_list, sizeof(*exec_list) * args->buffer_count,
1967                  DRM_MEM_DRIVER);
1968
1969         return ret;
1970 }
1971
1972 int
1973 i915_gem_object_pin(struct drm_gem_object *obj, uint32_t alignment)
1974 {
1975         struct drm_device *dev = obj->dev;
1976         struct drm_i915_gem_object *obj_priv = obj->driver_private;
1977         int ret;
1978
1979         i915_verify_inactive(dev, __FILE__, __LINE__);
1980         if (obj_priv->gtt_space == NULL) {
1981                 ret = i915_gem_object_bind_to_gtt(obj, alignment);
1982                 if (ret != 0) {
1983                         DRM_ERROR("Failure to bind: %d", ret);
1984                         return ret;
1985                 }
1986         }
1987         obj_priv->pin_count++;
1988
1989         /* If the object is not active and not pending a flush,
1990          * remove it from the inactive list
1991          */
1992         if (obj_priv->pin_count == 1) {
1993                 atomic_inc(&dev->pin_count);
1994                 atomic_add(obj->size, &dev->pin_memory);
1995                 if (!obj_priv->active &&
1996                     (obj->write_domain & ~(I915_GEM_DOMAIN_CPU |
1997                                            I915_GEM_DOMAIN_GTT)) == 0 &&
1998                     !list_empty(&obj_priv->list))
1999                         list_del_init(&obj_priv->list);
2000         }
2001         i915_verify_inactive(dev, __FILE__, __LINE__);
2002
2003         return 0;
2004 }
2005
2006 void
2007 i915_gem_object_unpin(struct drm_gem_object *obj)
2008 {
2009         struct drm_device *dev = obj->dev;
2010         drm_i915_private_t *dev_priv = dev->dev_private;
2011         struct drm_i915_gem_object *obj_priv = obj->driver_private;
2012
2013         i915_verify_inactive(dev, __FILE__, __LINE__);
2014         obj_priv->pin_count--;
2015         BUG_ON(obj_priv->pin_count < 0);
2016         BUG_ON(obj_priv->gtt_space == NULL);
2017
2018         /* If the object is no longer pinned, and is
2019          * neither active nor being flushed, then stick it on
2020          * the inactive list
2021          */
2022         if (obj_priv->pin_count == 0) {
2023                 if (!obj_priv->active &&
2024                     (obj->write_domain & ~(I915_GEM_DOMAIN_CPU |
2025                                            I915_GEM_DOMAIN_GTT)) == 0)
2026                         list_move_tail(&obj_priv->list,
2027                                        &dev_priv->mm.inactive_list);
2028                 atomic_dec(&dev->pin_count);
2029                 atomic_sub(obj->size, &dev->pin_memory);
2030         }
2031         i915_verify_inactive(dev, __FILE__, __LINE__);
2032 }
2033
2034 int
2035 i915_gem_pin_ioctl(struct drm_device *dev, void *data,
2036                    struct drm_file *file_priv)
2037 {
2038         struct drm_i915_gem_pin *args = data;
2039         struct drm_gem_object *obj;
2040         struct drm_i915_gem_object *obj_priv;
2041         int ret;
2042
2043         mutex_lock(&dev->struct_mutex);
2044
2045         obj = drm_gem_object_lookup(dev, file_priv, args->handle);
2046         if (obj == NULL) {
2047                 DRM_ERROR("Bad handle in i915_gem_pin_ioctl(): %d\n",
2048                           args->handle);
2049                 mutex_unlock(&dev->struct_mutex);
2050                 return -EBADF;
2051         }
2052         obj_priv = obj->driver_private;
2053
2054         ret = i915_gem_object_pin(obj, args->alignment);
2055         if (ret != 0) {
2056                 drm_gem_object_unreference(obj);
2057                 mutex_unlock(&dev->struct_mutex);
2058                 return ret;
2059         }
2060
2061         /* XXX - flush the CPU caches for pinned objects
2062          * as the X server doesn't manage domains yet
2063          */
2064         if (obj->write_domain & I915_GEM_DOMAIN_CPU) {
2065                 i915_gem_clflush_object(obj);
2066                 drm_agp_chipset_flush(dev);
2067                 obj->write_domain = 0;
2068         }
2069         args->offset = obj_priv->gtt_offset;
2070         drm_gem_object_unreference(obj);
2071         mutex_unlock(&dev->struct_mutex);
2072
2073         return 0;
2074 }
2075
2076 int
2077 i915_gem_unpin_ioctl(struct drm_device *dev, void *data,
2078                      struct drm_file *file_priv)
2079 {
2080         struct drm_i915_gem_pin *args = data;
2081         struct drm_gem_object *obj;
2082
2083         mutex_lock(&dev->struct_mutex);
2084
2085         obj = drm_gem_object_lookup(dev, file_priv, args->handle);
2086         if (obj == NULL) {
2087                 DRM_ERROR("Bad handle in i915_gem_unpin_ioctl(): %d\n",
2088                           args->handle);
2089                 mutex_unlock(&dev->struct_mutex);
2090                 return -EBADF;
2091         }
2092
2093         i915_gem_object_unpin(obj);
2094
2095         drm_gem_object_unreference(obj);
2096         mutex_unlock(&dev->struct_mutex);
2097         return 0;
2098 }
2099
2100 int
2101 i915_gem_busy_ioctl(struct drm_device *dev, void *data,
2102                     struct drm_file *file_priv)
2103 {
2104         struct drm_i915_gem_busy *args = data;
2105         struct drm_gem_object *obj;
2106         struct drm_i915_gem_object *obj_priv;
2107
2108         mutex_lock(&dev->struct_mutex);
2109         obj = drm_gem_object_lookup(dev, file_priv, args->handle);
2110         if (obj == NULL) {
2111                 DRM_ERROR("Bad handle in i915_gem_busy_ioctl(): %d\n",
2112                           args->handle);
2113                 mutex_unlock(&dev->struct_mutex);
2114                 return -EBADF;
2115         }
2116
2117         obj_priv = obj->driver_private;
2118         args->busy = obj_priv->active;
2119
2120         drm_gem_object_unreference(obj);
2121         mutex_unlock(&dev->struct_mutex);
2122         return 0;
2123 }
2124
2125 int
2126 i915_gem_throttle_ioctl(struct drm_device *dev, void *data,
2127                         struct drm_file *file_priv)
2128 {
2129     return i915_gem_ring_throttle(dev, file_priv);
2130 }
2131
2132 int i915_gem_init_object(struct drm_gem_object *obj)
2133 {
2134         struct drm_i915_gem_object *obj_priv;
2135
2136         obj_priv = drm_calloc(1, sizeof(*obj_priv), DRM_MEM_DRIVER);
2137         if (obj_priv == NULL)
2138                 return -ENOMEM;
2139
2140         /*
2141          * We've just allocated pages from the kernel,
2142          * so they've just been written by the CPU with
2143          * zeros. They'll need to be clflushed before we
2144          * use them with the GPU.
2145          */
2146         obj->write_domain = I915_GEM_DOMAIN_CPU;
2147         obj->read_domains = I915_GEM_DOMAIN_CPU;
2148
2149         obj_priv->agp_type = AGP_USER_MEMORY;
2150
2151         obj->driver_private = obj_priv;
2152         obj_priv->obj = obj;
2153         INIT_LIST_HEAD(&obj_priv->list);
2154         return 0;
2155 }
2156
2157 void i915_gem_free_object(struct drm_gem_object *obj)
2158 {
2159         struct drm_i915_gem_object *obj_priv = obj->driver_private;
2160
2161         while (obj_priv->pin_count > 0)
2162                 i915_gem_object_unpin(obj);
2163
2164         i915_gem_object_unbind(obj);
2165
2166         drm_free(obj_priv->page_cpu_valid, 1, DRM_MEM_DRIVER);
2167         drm_free(obj->driver_private, 1, DRM_MEM_DRIVER);
2168 }
2169
2170 static int
2171 i915_gem_set_domain(struct drm_gem_object *obj,
2172                     struct drm_file *file_priv,
2173                     uint32_t read_domains,
2174                     uint32_t write_domain)
2175 {
2176         struct drm_device *dev = obj->dev;
2177         int ret;
2178         uint32_t flush_domains;
2179
2180         BUG_ON(!mutex_is_locked(&dev->struct_mutex));
2181
2182         ret = i915_gem_object_set_domain(obj, read_domains, write_domain);
2183         if (ret)
2184                 return ret;
2185         flush_domains = i915_gem_dev_set_domain(obj->dev);
2186
2187         if (flush_domains & ~(I915_GEM_DOMAIN_CPU|I915_GEM_DOMAIN_GTT))
2188                 (void) i915_add_request(dev, flush_domains);
2189
2190         return 0;
2191 }
2192
2193 /** Unbinds all objects that are on the given buffer list. */
2194 static int
2195 i915_gem_evict_from_list(struct drm_device *dev, struct list_head *head)
2196 {
2197         struct drm_gem_object *obj;
2198         struct drm_i915_gem_object *obj_priv;
2199         int ret;
2200
2201         while (!list_empty(head)) {
2202                 obj_priv = list_first_entry(head,
2203                                             struct drm_i915_gem_object,
2204                                             list);
2205                 obj = obj_priv->obj;
2206
2207                 if (obj_priv->pin_count != 0) {
2208                         DRM_ERROR("Pinned object in unbind list\n");
2209                         mutex_unlock(&dev->struct_mutex);
2210                         return -EINVAL;
2211                 }
2212
2213                 ret = i915_gem_object_unbind(obj);
2214                 if (ret != 0) {
2215                         DRM_ERROR("Error unbinding object in LeaveVT: %d\n",
2216                                   ret);
2217                         mutex_unlock(&dev->struct_mutex);
2218                         return ret;
2219                 }
2220         }
2221
2222
2223         return 0;
2224 }
2225
2226 static int
2227 i915_gem_idle(struct drm_device *dev)
2228 {
2229         drm_i915_private_t *dev_priv = dev->dev_private;
2230         uint32_t seqno, cur_seqno, last_seqno;
2231         int stuck, ret;
2232
2233         mutex_lock(&dev->struct_mutex);
2234
2235         if (dev_priv->mm.suspended || dev_priv->ring.ring_obj == NULL) {
2236                 mutex_unlock(&dev->struct_mutex);
2237                 return 0;
2238         }
2239
2240         /* Hack!  Don't let anybody do execbuf while we don't control the chip.
2241          * We need to replace this with a semaphore, or something.
2242          */
2243         dev_priv->mm.suspended = 1;
2244
2245         /* Cancel the retire work handler, wait for it to finish if running
2246          */
2247         mutex_unlock(&dev->struct_mutex);
2248         cancel_delayed_work_sync(&dev_priv->mm.retire_work);
2249         mutex_lock(&dev->struct_mutex);
2250
2251         i915_kernel_lost_context(dev);
2252
2253         /* Flush the GPU along with all non-CPU write domains
2254          */
2255         i915_gem_flush(dev, ~(I915_GEM_DOMAIN_CPU|I915_GEM_DOMAIN_GTT),
2256                        ~(I915_GEM_DOMAIN_CPU|I915_GEM_DOMAIN_GTT));
2257         seqno = i915_add_request(dev, ~(I915_GEM_DOMAIN_CPU |
2258                                         I915_GEM_DOMAIN_GTT));
2259
2260         if (seqno == 0) {
2261                 mutex_unlock(&dev->struct_mutex);
2262                 return -ENOMEM;
2263         }
2264
2265         dev_priv->mm.waiting_gem_seqno = seqno;
2266         last_seqno = 0;
2267         stuck = 0;
2268         for (;;) {
2269                 cur_seqno = i915_get_gem_seqno(dev);
2270                 if (i915_seqno_passed(cur_seqno, seqno))
2271                         break;
2272                 if (last_seqno == cur_seqno) {
2273                         if (stuck++ > 100) {
2274                                 DRM_ERROR("hardware wedged\n");
2275                                 dev_priv->mm.wedged = 1;
2276                                 DRM_WAKEUP(&dev_priv->irq_queue);
2277                                 break;
2278                         }
2279                 }
2280                 msleep(10);
2281                 last_seqno = cur_seqno;
2282         }
2283         dev_priv->mm.waiting_gem_seqno = 0;
2284
2285         i915_gem_retire_requests(dev);
2286
2287         if (!dev_priv->mm.wedged) {
2288                 /* Active and flushing should now be empty as we've
2289                  * waited for a sequence higher than any pending execbuffer
2290                  */
2291                 WARN_ON(!list_empty(&dev_priv->mm.active_list));
2292                 WARN_ON(!list_empty(&dev_priv->mm.flushing_list));
2293                 /* Request should now be empty as we've also waited
2294                  * for the last request in the list
2295                  */
2296                 WARN_ON(!list_empty(&dev_priv->mm.request_list));
2297         }
2298
2299         /* Empty the active and flushing lists to inactive.  If there's
2300          * anything left at this point, it means that we're wedged and
2301          * nothing good's going to happen by leaving them there.  So strip
2302          * the GPU domains and just stuff them onto inactive.
2303          */
2304         while (!list_empty(&dev_priv->mm.active_list)) {
2305                 struct drm_i915_gem_object *obj_priv;
2306
2307                 obj_priv = list_first_entry(&dev_priv->mm.active_list,
2308                                             struct drm_i915_gem_object,
2309                                             list);
2310                 obj_priv->obj->write_domain &= ~I915_GEM_GPU_DOMAINS;
2311                 i915_gem_object_move_to_inactive(obj_priv->obj);
2312         }
2313
2314         while (!list_empty(&dev_priv->mm.flushing_list)) {
2315                 struct drm_i915_gem_object *obj_priv;
2316
2317                 obj_priv = list_first_entry(&dev_priv->mm.active_list,
2318                                             struct drm_i915_gem_object,
2319                                             list);
2320                 obj_priv->obj->write_domain &= ~I915_GEM_GPU_DOMAINS;
2321                 i915_gem_object_move_to_inactive(obj_priv->obj);
2322         }
2323
2324
2325         /* Move all inactive buffers out of the GTT. */
2326         ret = i915_gem_evict_from_list(dev, &dev_priv->mm.inactive_list);
2327         WARN_ON(!list_empty(&dev_priv->mm.inactive_list));
2328         if (ret) {
2329                 mutex_unlock(&dev->struct_mutex);
2330                 return ret;
2331         }
2332
2333         i915_gem_cleanup_ringbuffer(dev);
2334         mutex_unlock(&dev->struct_mutex);
2335
2336         return 0;
2337 }
2338
2339 static int
2340 i915_gem_init_hws(struct drm_device *dev)
2341 {
2342         drm_i915_private_t *dev_priv = dev->dev_private;
2343         struct drm_gem_object *obj;
2344         struct drm_i915_gem_object *obj_priv;
2345         int ret;
2346
2347         /* If we need a physical address for the status page, it's already
2348          * initialized at driver load time.
2349          */
2350         if (!I915_NEED_GFX_HWS(dev))
2351                 return 0;
2352
2353         obj = drm_gem_object_alloc(dev, 4096);
2354         if (obj == NULL) {
2355                 DRM_ERROR("Failed to allocate status page\n");
2356                 return -ENOMEM;
2357         }
2358         obj_priv = obj->driver_private;
2359         obj_priv->agp_type = AGP_USER_CACHED_MEMORY;
2360
2361         ret = i915_gem_object_pin(obj, 4096);
2362         if (ret != 0) {
2363                 drm_gem_object_unreference(obj);
2364                 return ret;
2365         }
2366
2367         dev_priv->status_gfx_addr = obj_priv->gtt_offset;
2368
2369         dev_priv->hw_status_page = kmap(obj_priv->page_list[0]);
2370         if (dev_priv->hw_status_page == NULL) {
2371                 DRM_ERROR("Failed to map status page.\n");
2372                 memset(&dev_priv->hws_map, 0, sizeof(dev_priv->hws_map));
2373                 drm_gem_object_unreference(obj);
2374                 return -EINVAL;
2375         }
2376         dev_priv->hws_obj = obj;
2377         memset(dev_priv->hw_status_page, 0, PAGE_SIZE);
2378         I915_WRITE(HWS_PGA, dev_priv->status_gfx_addr);
2379         I915_READ(HWS_PGA); /* posting read */
2380         DRM_DEBUG("hws offset: 0x%08x\n", dev_priv->status_gfx_addr);
2381
2382         return 0;
2383 }
2384
2385 static int
2386 i915_gem_init_ringbuffer(struct drm_device *dev)
2387 {
2388         drm_i915_private_t *dev_priv = dev->dev_private;
2389         struct drm_gem_object *obj;
2390         struct drm_i915_gem_object *obj_priv;
2391         int ret;
2392         u32 head;
2393
2394         ret = i915_gem_init_hws(dev);
2395         if (ret != 0)
2396                 return ret;
2397
2398         obj = drm_gem_object_alloc(dev, 128 * 1024);
2399         if (obj == NULL) {
2400                 DRM_ERROR("Failed to allocate ringbuffer\n");
2401                 return -ENOMEM;
2402         }
2403         obj_priv = obj->driver_private;
2404
2405         ret = i915_gem_object_pin(obj, 4096);
2406         if (ret != 0) {
2407                 drm_gem_object_unreference(obj);
2408                 return ret;
2409         }
2410
2411         /* Set up the kernel mapping for the ring. */
2412         dev_priv->ring.Size = obj->size;
2413         dev_priv->ring.tail_mask = obj->size - 1;
2414
2415         dev_priv->ring.map.offset = dev->agp->base + obj_priv->gtt_offset;
2416         dev_priv->ring.map.size = obj->size;
2417         dev_priv->ring.map.type = 0;
2418         dev_priv->ring.map.flags = 0;
2419         dev_priv->ring.map.mtrr = 0;
2420
2421         drm_core_ioremap_wc(&dev_priv->ring.map, dev);
2422         if (dev_priv->ring.map.handle == NULL) {
2423                 DRM_ERROR("Failed to map ringbuffer.\n");
2424                 memset(&dev_priv->ring, 0, sizeof(dev_priv->ring));
2425                 drm_gem_object_unreference(obj);
2426                 return -EINVAL;
2427         }
2428         dev_priv->ring.ring_obj = obj;
2429         dev_priv->ring.virtual_start = dev_priv->ring.map.handle;
2430
2431         /* Stop the ring if it's running. */
2432         I915_WRITE(PRB0_CTL, 0);
2433         I915_WRITE(PRB0_TAIL, 0);
2434         I915_WRITE(PRB0_HEAD, 0);
2435
2436         /* Initialize the ring. */
2437         I915_WRITE(PRB0_START, obj_priv->gtt_offset);
2438         head = I915_READ(PRB0_HEAD) & HEAD_ADDR;
2439
2440         /* G45 ring initialization fails to reset head to zero */
2441         if (head != 0) {
2442                 DRM_ERROR("Ring head not reset to zero "
2443                           "ctl %08x head %08x tail %08x start %08x\n",
2444                           I915_READ(PRB0_CTL),
2445                           I915_READ(PRB0_HEAD),
2446                           I915_READ(PRB0_TAIL),
2447                           I915_READ(PRB0_START));
2448                 I915_WRITE(PRB0_HEAD, 0);
2449
2450                 DRM_ERROR("Ring head forced to zero "
2451                           "ctl %08x head %08x tail %08x start %08x\n",
2452                           I915_READ(PRB0_CTL),
2453                           I915_READ(PRB0_HEAD),
2454                           I915_READ(PRB0_TAIL),
2455                           I915_READ(PRB0_START));
2456         }
2457
2458         I915_WRITE(PRB0_CTL,
2459                    ((obj->size - 4096) & RING_NR_PAGES) |
2460                    RING_NO_REPORT |
2461                    RING_VALID);
2462
2463         head = I915_READ(PRB0_HEAD) & HEAD_ADDR;
2464
2465         /* If the head is still not zero, the ring is dead */
2466         if (head != 0) {
2467                 DRM_ERROR("Ring initialization failed "
2468                           "ctl %08x head %08x tail %08x start %08x\n",
2469                           I915_READ(PRB0_CTL),
2470                           I915_READ(PRB0_HEAD),
2471                           I915_READ(PRB0_TAIL),
2472                           I915_READ(PRB0_START));
2473                 return -EIO;
2474         }
2475
2476         /* Update our cache of the ring state */
2477         i915_kernel_lost_context(dev);
2478
2479         return 0;
2480 }
2481
2482 static void
2483 i915_gem_cleanup_ringbuffer(struct drm_device *dev)
2484 {
2485         drm_i915_private_t *dev_priv = dev->dev_private;
2486
2487         if (dev_priv->ring.ring_obj == NULL)
2488                 return;
2489
2490         drm_core_ioremapfree(&dev_priv->ring.map, dev);
2491
2492         i915_gem_object_unpin(dev_priv->ring.ring_obj);
2493         drm_gem_object_unreference(dev_priv->ring.ring_obj);
2494         dev_priv->ring.ring_obj = NULL;
2495         memset(&dev_priv->ring, 0, sizeof(dev_priv->ring));
2496
2497         if (dev_priv->hws_obj != NULL) {
2498                 struct drm_gem_object *obj = dev_priv->hws_obj;
2499                 struct drm_i915_gem_object *obj_priv = obj->driver_private;
2500
2501                 kunmap(obj_priv->page_list[0]);
2502                 i915_gem_object_unpin(obj);
2503                 drm_gem_object_unreference(obj);
2504                 dev_priv->hws_obj = NULL;
2505                 memset(&dev_priv->hws_map, 0, sizeof(dev_priv->hws_map));
2506                 dev_priv->hw_status_page = NULL;
2507
2508                 /* Write high address into HWS_PGA when disabling. */
2509                 I915_WRITE(HWS_PGA, 0x1ffff000);
2510         }
2511 }
2512
2513 int
2514 i915_gem_entervt_ioctl(struct drm_device *dev, void *data,
2515                        struct drm_file *file_priv)
2516 {
2517         drm_i915_private_t *dev_priv = dev->dev_private;
2518         int ret;
2519
2520         if (dev_priv->mm.wedged) {
2521                 DRM_ERROR("Reenabling wedged hardware, good luck\n");
2522                 dev_priv->mm.wedged = 0;
2523         }
2524
2525         ret = i915_gem_init_ringbuffer(dev);
2526         if (ret != 0)
2527                 return ret;
2528
2529         dev_priv->mm.gtt_mapping = io_mapping_create_wc(dev->agp->base,
2530                                                         dev->agp->agp_info.aper_size
2531                                                         * 1024 * 1024);
2532
2533         mutex_lock(&dev->struct_mutex);
2534         BUG_ON(!list_empty(&dev_priv->mm.active_list));
2535         BUG_ON(!list_empty(&dev_priv->mm.flushing_list));
2536         BUG_ON(!list_empty(&dev_priv->mm.inactive_list));
2537         BUG_ON(!list_empty(&dev_priv->mm.request_list));
2538         dev_priv->mm.suspended = 0;
2539         mutex_unlock(&dev->struct_mutex);
2540
2541         drm_irq_install(dev);
2542
2543         return 0;
2544 }
2545
2546 int
2547 i915_gem_leavevt_ioctl(struct drm_device *dev, void *data,
2548                        struct drm_file *file_priv)
2549 {
2550         drm_i915_private_t *dev_priv = dev->dev_private;
2551         int ret;
2552
2553         ret = i915_gem_idle(dev);
2554         drm_irq_uninstall(dev);
2555
2556         io_mapping_free(dev_priv->mm.gtt_mapping);
2557         return ret;
2558 }
2559
2560 void
2561 i915_gem_lastclose(struct drm_device *dev)
2562 {
2563         int ret;
2564
2565         ret = i915_gem_idle(dev);
2566         if (ret)
2567                 DRM_ERROR("failed to idle hardware: %d\n", ret);
2568 }
2569
2570 void
2571 i915_gem_load(struct drm_device *dev)
2572 {
2573         drm_i915_private_t *dev_priv = dev->dev_private;
2574
2575         INIT_LIST_HEAD(&dev_priv->mm.active_list);
2576         INIT_LIST_HEAD(&dev_priv->mm.flushing_list);
2577         INIT_LIST_HEAD(&dev_priv->mm.inactive_list);
2578         INIT_LIST_HEAD(&dev_priv->mm.request_list);
2579         INIT_DELAYED_WORK(&dev_priv->mm.retire_work,
2580                           i915_gem_retire_work_handler);
2581         dev_priv->mm.next_gem_seqno = 1;
2582
2583         i915_gem_detect_bit_6_swizzle(dev);
2584 }