projects / deliverable / linux.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
drm/i915: Reject non-default contexts on non-render again
[deliverable/linux.git] / drivers / gpu / drm / i915 / i915_gem_execbuffer.c
1 /*
2 * Copyright © 2008,2010 Intel Corporation
3 *
4 * Permission is hereby granted, free of charge, to any person obtaining a
5 * copy of this software and associated documentation files (the "Software"),
6 * to deal in the Software without restriction, including without limitation
7 * the rights to use, copy, modify, merge, publish, distribute, sublicense,
8 * and/or sell copies of the Software, and to permit persons to whom the
9 * Software is furnished to do so, subject to the following conditions:
10 *
11 * The above copyright notice and this permission notice (including the next
12 * paragraph) shall be included in all copies or substantial portions of the
13 * Software.
14 *
15 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
18 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
20 * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
21 * IN THE SOFTWARE.
22 *
23 * Authors:
24 * Eric Anholt <eric@anholt.net>
25 * Chris Wilson <chris@chris-wilson.co.uk>
26 *
27 */
28
29 #include <drm/drmP.h>
30 #include <drm/i915_drm.h>
31 #include "i915_drv.h"
32 #include "i915_trace.h"
33 #include "intel_drv.h"
34 #include <linux/dma_remapping.h>
35
36 #define __EXEC_OBJECT_HAS_PIN (1<<31)
37 #define __EXEC_OBJECT_HAS_FENCE (1<<30)
38
39 struct eb_vmas {
40 struct list_head vmas;
41 int and;
42 union {
43 struct i915_vma *lut[0];
44 struct hlist_head buckets[0];
45 };
46 };
47
48 static struct eb_vmas *
49 eb_create(struct drm_i915_gem_execbuffer2 *args)
50 {
51 struct eb_vmas *eb = NULL;
52
53 if (args->flags & I915_EXEC_HANDLE_LUT) {
54 unsigned size = args->buffer_count;
55 size *= sizeof(struct i915_vma *);
56 size += sizeof(struct eb_vmas);
57 eb = kmalloc(size, GFP_TEMPORARY | __GFP_NOWARN | __GFP_NORETRY);
58 }
59
60 if (eb == NULL) {
61 unsigned size = args->buffer_count;
62 unsigned count = PAGE_SIZE / sizeof(struct hlist_head) / 2;
63 BUILD_BUG_ON_NOT_POWER_OF_2(PAGE_SIZE / sizeof(struct hlist_head));
64 while (count > 2*size)
65 count >>= 1;
66 eb = kzalloc(count*sizeof(struct hlist_head) +
67 sizeof(struct eb_vmas),
68 GFP_TEMPORARY);
69 if (eb == NULL)
70 return eb;
71
72 eb->and = count - 1;
73 } else
74 eb->and = -args->buffer_count;
75
76 INIT_LIST_HEAD(&eb->vmas);
77 return eb;
78 }
79
80 static void
81 eb_reset(struct eb_vmas *eb)
82 {
83 if (eb->and >= 0)
84 memset(eb->buckets, 0, (eb->and+1)*sizeof(struct hlist_head));
85 }
86
87 static int
88 eb_lookup_vmas(struct eb_vmas *eb,
89 struct drm_i915_gem_exec_object2 *exec,
90 const struct drm_i915_gem_execbuffer2 *args,
91 struct i915_address_space *vm,
92 struct drm_file *file)
93 {
94 struct drm_i915_private *dev_priv = vm->dev->dev_private;
95 struct drm_i915_gem_object *obj;
96 struct list_head objects;
97 int i, ret = 0;
98
99 INIT_LIST_HEAD(&objects);
100 spin_lock(&file->table_lock);
101 /* Grab a reference to the object and release the lock so we can lookup
102 * or create the VMA without using GFP_ATOMIC */
103 for (i = 0; i < args->buffer_count; i++) {
104 obj = to_intel_bo(idr_find(&file->object_idr, exec[i].handle));
105 if (obj == NULL) {
106 spin_unlock(&file->table_lock);
107 DRM_DEBUG("Invalid object handle %d at index %d\n",
108 exec[i].handle, i);
109 ret = -ENOENT;
110 goto out;
111 }
112
113 if (!list_empty(&obj->obj_exec_link)) {
114 spin_unlock(&file->table_lock);
115 DRM_DEBUG("Object %p [handle %d, index %d] appears more than once in object list\n",
116 obj, exec[i].handle, i);
117 ret = -EINVAL;
118 goto out;
119 }
120
121 drm_gem_object_reference(&obj->base);
122 list_add_tail(&obj->obj_exec_link, &objects);
123 }
124 spin_unlock(&file->table_lock);
125
126 i = 0;
127 list_for_each_entry(obj, &objects, obj_exec_link) {
128 struct i915_vma *vma;
129 struct i915_address_space *bind_vm = vm;
130
131 /* If we have secure dispatch, or the userspace assures us that
132 * they know what they're doing, use the GGTT VM.
133 */
134 if (exec[i].flags & EXEC_OBJECT_NEEDS_GTT ||
135 ((args->flags & I915_EXEC_SECURE) &&
136 (i == (args->buffer_count - 1))))
137 bind_vm = &dev_priv->gtt.base;
138
139 /*
140 * NOTE: We can leak any vmas created here when something fails
141 * later on. But that's no issue since vma_unbind can deal with
142 * vmas which are not actually bound. And since only
143 * lookup_or_create exists as an interface to get at the vma
144 * from the (obj, vm) we don't run the risk of creating
145 * duplicated vmas for the same vm.
146 */
147 vma = i915_gem_obj_lookup_or_create_vma(obj, bind_vm);
148 if (IS_ERR(vma)) {
149 DRM_DEBUG("Failed to lookup VMA\n");
150 ret = PTR_ERR(vma);
151 goto out;
152 }
153
154 list_add_tail(&vma->exec_list, &eb->vmas);
155
156 vma->exec_entry = &exec[i];
157 if (eb->and < 0) {
158 eb->lut[i] = vma;
159 } else {
160 uint32_t handle = args->flags & I915_EXEC_HANDLE_LUT ? i : exec[i].handle;
161 vma->exec_handle = handle;
162 hlist_add_head(&vma->exec_node,
163 &eb->buckets[handle & eb->and]);
164 }
165 ++i;
166 }
167
168
169 out:
170 while (!list_empty(&objects)) {
171 obj = list_first_entry(&objects,
172 struct drm_i915_gem_object,
173 obj_exec_link);
174 list_del_init(&obj->obj_exec_link);
175 if (ret)
176 drm_gem_object_unreference(&obj->base);
177 }
178 return ret;
179 }
180
181 static struct i915_vma *eb_get_vma(struct eb_vmas *eb, unsigned long handle)
182 {
183 if (eb->and < 0) {
184 if (handle >= -eb->and)
185 return NULL;
186 return eb->lut[handle];
187 } else {
188 struct hlist_head *head;
189 struct hlist_node *node;
190
191 head = &eb->buckets[handle & eb->and];
192 hlist_for_each(node, head) {
193 struct i915_vma *vma;
194
195 vma = hlist_entry(node, struct i915_vma, exec_node);
196 if (vma->exec_handle == handle)
197 return vma;
198 }
199 return NULL;
200 }
201 }
202
203 static void
204 i915_gem_execbuffer_unreserve_vma(struct i915_vma *vma)
205 {
206 struct drm_i915_gem_exec_object2 *entry;
207 struct drm_i915_gem_object *obj = vma->obj;
208
209 if (!drm_mm_node_allocated(&vma->node))
210 return;
211
212 entry = vma->exec_entry;
213
214 if (entry->flags & __EXEC_OBJECT_HAS_FENCE)
215 i915_gem_object_unpin_fence(obj);
216
217 if (entry->flags & __EXEC_OBJECT_HAS_PIN)
218 vma->pin_count--;
219
220 entry->flags &= ~(__EXEC_OBJECT_HAS_FENCE | __EXEC_OBJECT_HAS_PIN);
221 }
222
223 static void eb_destroy(struct eb_vmas *eb)
224 {
225 while (!list_empty(&eb->vmas)) {
226 struct i915_vma *vma;
227
228 vma = list_first_entry(&eb->vmas,
229 struct i915_vma,
230 exec_list);
231 list_del_init(&vma->exec_list);
232 i915_gem_execbuffer_unreserve_vma(vma);
233 drm_gem_object_unreference(&vma->obj->base);
234 }
235 kfree(eb);
236 }
237
238 static inline int use_cpu_reloc(struct drm_i915_gem_object *obj)
239 {
240 return (HAS_LLC(obj->base.dev) ||
241 obj->base.write_domain == I915_GEM_DOMAIN_CPU ||
242 !obj->map_and_fenceable ||
243 obj->cache_level != I915_CACHE_NONE);
244 }
245
246 static int
247 relocate_entry_cpu(struct drm_i915_gem_object *obj,
248 struct drm_i915_gem_relocation_entry *reloc)
249 {
250 struct drm_device *dev = obj->base.dev;
251 uint32_t page_offset = offset_in_page(reloc->offset);
252 char *vaddr;
253 int ret = -EINVAL;
254
255 ret = i915_gem_object_set_to_cpu_domain(obj, true);
256 if (ret)
257 return ret;
258
259 vaddr = kmap_atomic(i915_gem_object_get_page(obj,
260 reloc->offset >> PAGE_SHIFT));
261 *(uint32_t *)(vaddr + page_offset) = reloc->delta;
262
263 if (INTEL_INFO(dev)->gen >= 8) {
264 page_offset = offset_in_page(page_offset + sizeof(uint32_t));
265
266 if (page_offset == 0) {
267 kunmap_atomic(vaddr);
268 vaddr = kmap_atomic(i915_gem_object_get_page(obj,
269 (reloc->offset + sizeof(uint32_t)) >> PAGE_SHIFT));
270 }
271
272 *(uint32_t *)(vaddr + page_offset) = 0;
273 }
274
275 kunmap_atomic(vaddr);
276
277 return 0;
278 }
279
280 static int
281 relocate_entry_gtt(struct drm_i915_gem_object *obj,
282 struct drm_i915_gem_relocation_entry *reloc)
283 {
284 struct drm_device *dev = obj->base.dev;
285 struct drm_i915_private *dev_priv = dev->dev_private;
286 uint32_t __iomem *reloc_entry;
287 void __iomem *reloc_page;
288 int ret = -EINVAL;
289
290 ret = i915_gem_object_set_to_gtt_domain(obj, true);
291 if (ret)
292 return ret;
293
294 ret = i915_gem_object_put_fence(obj);
295 if (ret)
296 return ret;
297
298 /* Map the page containing the relocation we're going to perform. */
299 reloc->offset += i915_gem_obj_ggtt_offset(obj);
300 reloc_page = io_mapping_map_atomic_wc(dev_priv->gtt.mappable,
301 reloc->offset & PAGE_MASK);
302 reloc_entry = (uint32_t __iomem *)
303 (reloc_page + offset_in_page(reloc->offset));
304 iowrite32(reloc->delta, reloc_entry);
305
306 if (INTEL_INFO(dev)->gen >= 8) {
307 reloc_entry += 1;
308
309 if (offset_in_page(reloc->offset + sizeof(uint32_t)) == 0) {
310 io_mapping_unmap_atomic(reloc_page);
311 reloc_page = io_mapping_map_atomic_wc(
312 dev_priv->gtt.mappable,
313 reloc->offset + sizeof(uint32_t));
314 reloc_entry = reloc_page;
315 }
316
317 iowrite32(0, reloc_entry);
318 }
319
320 io_mapping_unmap_atomic(reloc_page);
321
322 return 0;
323 }
324
325 static int
326 i915_gem_execbuffer_relocate_entry(struct drm_i915_gem_object *obj,
327 struct eb_vmas *eb,
328 struct drm_i915_gem_relocation_entry *reloc)
329 {
330 struct drm_device *dev = obj->base.dev;
331 struct drm_gem_object *target_obj;
332 struct drm_i915_gem_object *target_i915_obj;
333 struct i915_vma *target_vma;
334 uint32_t target_offset;
335 int ret = -EINVAL;
336
337 /* we've already hold a reference to all valid objects */
338 target_vma = eb_get_vma(eb, reloc->target_handle);
339 if (unlikely(target_vma == NULL))
340 return -ENOENT;
341 target_i915_obj = target_vma->obj;
342 target_obj = &target_vma->obj->base;
343
344 target_offset = target_vma->node.start;
345
346 /* Sandybridge PPGTT errata: We need a global gtt mapping for MI and
347 * pipe_control writes because the gpu doesn't properly redirect them
348 * through the ppgtt for non_secure batchbuffers. */
349 if (unlikely(IS_GEN6(dev) &&
350 reloc->write_domain == I915_GEM_DOMAIN_INSTRUCTION &&
351 !target_i915_obj->has_global_gtt_mapping)) {
352 struct i915_vma *vma =
353 list_first_entry(&target_i915_obj->vma_list,
354 typeof(*vma), vma_link);
355 vma->bind_vma(vma, target_i915_obj->cache_level, GLOBAL_BIND);
356 }
357
358 /* Validate that the target is in a valid r/w GPU domain */
359 if (unlikely(reloc->write_domain & (reloc->write_domain - 1))) {
360 DRM_DEBUG("reloc with multiple write domains: "
361 "obj %p target %d offset %d "
362 "read %08x write %08x",
363 obj, reloc->target_handle,
364 (int) reloc->offset,
365 reloc->read_domains,
366 reloc->write_domain);
367 return ret;
368 }
369 if (unlikely((reloc->write_domain | reloc->read_domains)
370 & ~I915_GEM_GPU_DOMAINS)) {
371 DRM_DEBUG("reloc with read/write non-GPU domains: "
372 "obj %p target %d offset %d "
373 "read %08x write %08x",
374 obj, reloc->target_handle,
375 (int) reloc->offset,
376 reloc->read_domains,
377 reloc->write_domain);
378 return ret;
379 }
380
381 target_obj->pending_read_domains |= reloc->read_domains;
382 target_obj->pending_write_domain |= reloc->write_domain;
383
384 /* If the relocation already has the right value in it, no
385 * more work needs to be done.
386 */
387 if (target_offset == reloc->presumed_offset)
388 return 0;
389
390 /* Check that the relocation address is valid... */
391 if (unlikely(reloc->offset >
392 obj->base.size - (INTEL_INFO(dev)->gen >= 8 ? 8 : 4))) {
393 DRM_DEBUG("Relocation beyond object bounds: "
394 "obj %p target %d offset %d size %d.\n",
395 obj, reloc->target_handle,
396 (int) reloc->offset,
397 (int) obj->base.size);
398 return ret;
399 }
400 if (unlikely(reloc->offset & 3)) {
401 DRM_DEBUG("Relocation not 4-byte aligned: "
402 "obj %p target %d offset %d.\n",
403 obj, reloc->target_handle,
404 (int) reloc->offset);
405 return ret;
406 }
407
408 /* We can't wait for rendering with pagefaults disabled */
409 if (obj->active && in_atomic())
410 return -EFAULT;
411
412 reloc->delta += target_offset;
413 if (use_cpu_reloc(obj))
414 ret = relocate_entry_cpu(obj, reloc);
415 else
416 ret = relocate_entry_gtt(obj, reloc);
417
418 if (ret)
419 return ret;
420
421 /* and update the user's relocation entry */
422 reloc->presumed_offset = target_offset;
423
424 return 0;
425 }
426
427 static int
428 i915_gem_execbuffer_relocate_vma(struct i915_vma *vma,
429 struct eb_vmas *eb)
430 {
431 #define N_RELOC(x) ((x) / sizeof(struct drm_i915_gem_relocation_entry))
432 struct drm_i915_gem_relocation_entry stack_reloc[N_RELOC(512)];
433 struct drm_i915_gem_relocation_entry __user *user_relocs;
434 struct drm_i915_gem_exec_object2 *entry = vma->exec_entry;
435 int remain, ret;
436
437 user_relocs = to_user_ptr(entry->relocs_ptr);
438
439 remain = entry->relocation_count;
440 while (remain) {
441 struct drm_i915_gem_relocation_entry *r = stack_reloc;
442 int count = remain;
443 if (count > ARRAY_SIZE(stack_reloc))
444 count = ARRAY_SIZE(stack_reloc);
445 remain -= count;
446
447 if (__copy_from_user_inatomic(r, user_relocs, count*sizeof(r[0])))
448 return -EFAULT;
449
450 do {
451 u64 offset = r->presumed_offset;
452
453 ret = i915_gem_execbuffer_relocate_entry(vma->obj, eb, r);
454 if (ret)
455 return ret;
456
457 if (r->presumed_offset != offset &&
458 __copy_to_user_inatomic(&user_relocs->presumed_offset,
459 &r->presumed_offset,
460 sizeof(r->presumed_offset))) {
461 return -EFAULT;
462 }
463
464 user_relocs++;
465 r++;
466 } while (--count);
467 }
468
469 return 0;
470 #undef N_RELOC
471 }
472
473 static int
474 i915_gem_execbuffer_relocate_vma_slow(struct i915_vma *vma,
475 struct eb_vmas *eb,
476 struct drm_i915_gem_relocation_entry *relocs)
477 {
478 const struct drm_i915_gem_exec_object2 *entry = vma->exec_entry;
479 int i, ret;
480
481 for (i = 0; i < entry->relocation_count; i++) {
482 ret = i915_gem_execbuffer_relocate_entry(vma->obj, eb, &relocs[i]);
483 if (ret)
484 return ret;
485 }
486
487 return 0;
488 }
489
490 static int
491 i915_gem_execbuffer_relocate(struct eb_vmas *eb)
492 {
493 struct i915_vma *vma;
494 int ret = 0;
495
496 /* This is the fast path and we cannot handle a pagefault whilst
497 * holding the struct mutex lest the user pass in the relocations
498 * contained within a mmaped bo. For in such a case we, the page
499 * fault handler would call i915_gem_fault() and we would try to
500 * acquire the struct mutex again. Obviously this is bad and so
501 * lockdep complains vehemently.
502 */
503 pagefault_disable();
504 list_for_each_entry(vma, &eb->vmas, exec_list) {
505 ret = i915_gem_execbuffer_relocate_vma(vma, eb);
506 if (ret)
507 break;
508 }
509 pagefault_enable();
510
511 return ret;
512 }
513
514 static int
515 need_reloc_mappable(struct i915_vma *vma)
516 {
517 struct drm_i915_gem_exec_object2 *entry = vma->exec_entry;
518 return entry->relocation_count && !use_cpu_reloc(vma->obj) &&
519 i915_is_ggtt(vma->vm);
520 }
521
522 static int
523 i915_gem_execbuffer_reserve_vma(struct i915_vma *vma,
524 struct intel_ring_buffer *ring,
525 bool *need_reloc)
526 {
527 struct drm_i915_gem_object *obj = vma->obj;
528 struct drm_i915_gem_exec_object2 *entry = vma->exec_entry;
529 bool has_fenced_gpu_access = INTEL_INFO(ring->dev)->gen < 4;
530 bool need_fence, need_mappable;
531 u32 flags = (entry->flags & EXEC_OBJECT_NEEDS_GTT) &&
532 !vma->obj->has_global_gtt_mapping ? GLOBAL_BIND : 0;
533 int ret;
534
535 need_fence =
536 has_fenced_gpu_access &&
537 entry->flags & EXEC_OBJECT_NEEDS_FENCE &&
538 obj->tiling_mode != I915_TILING_NONE;
539 need_mappable = need_fence || need_reloc_mappable(vma);
540
541 ret = i915_gem_object_pin(obj, vma->vm, entry->alignment, need_mappable,
542 false);
543 if (ret)
544 return ret;
545
546 entry->flags |= __EXEC_OBJECT_HAS_PIN;
547
548 if (has_fenced_gpu_access) {
549 if (entry->flags & EXEC_OBJECT_NEEDS_FENCE) {
550 ret = i915_gem_object_get_fence(obj);
551 if (ret)
552 return ret;
553
554 if (i915_gem_object_pin_fence(obj))
555 entry->flags |= __EXEC_OBJECT_HAS_FENCE;
556
557 obj->pending_fenced_gpu_access = true;
558 }
559 }
560
561 if (entry->offset != vma->node.start) {
562 entry->offset = vma->node.start;
563 *need_reloc = true;
564 }
565
566 if (entry->flags & EXEC_OBJECT_WRITE) {
567 obj->base.pending_read_domains = I915_GEM_DOMAIN_RENDER;
568 obj->base.pending_write_domain = I915_GEM_DOMAIN_RENDER;
569 }
570
571 vma->bind_vma(vma, obj->cache_level, flags);
572
573 return 0;
574 }
575
576 static int
577 i915_gem_execbuffer_reserve(struct intel_ring_buffer *ring,
578 struct list_head *vmas,
579 bool *need_relocs)
580 {
581 struct drm_i915_gem_object *obj;
582 struct i915_vma *vma;
583 struct i915_address_space *vm;
584 struct list_head ordered_vmas;
585 bool has_fenced_gpu_access = INTEL_INFO(ring->dev)->gen < 4;
586 int retry;
587
588 if (list_empty(vmas))
589 return 0;
590
591 vm = list_first_entry(vmas, struct i915_vma, exec_list)->vm;
592
593 INIT_LIST_HEAD(&ordered_vmas);
594 while (!list_empty(vmas)) {
595 struct drm_i915_gem_exec_object2 *entry;
596 bool need_fence, need_mappable;
597
598 vma = list_first_entry(vmas, struct i915_vma, exec_list);
599 obj = vma->obj;
600 entry = vma->exec_entry;
601
602 need_fence =
603 has_fenced_gpu_access &&
604 entry->flags & EXEC_OBJECT_NEEDS_FENCE &&
605 obj->tiling_mode != I915_TILING_NONE;
606 need_mappable = need_fence || need_reloc_mappable(vma);
607
608 if (need_mappable)
609 list_move(&vma->exec_list, &ordered_vmas);
610 else
611 list_move_tail(&vma->exec_list, &ordered_vmas);
612
613 obj->base.pending_read_domains = I915_GEM_GPU_DOMAINS & ~I915_GEM_DOMAIN_COMMAND;
614 obj->base.pending_write_domain = 0;
615 obj->pending_fenced_gpu_access = false;
616 }
617 list_splice(&ordered_vmas, vmas);
618
619 /* Attempt to pin all of the buffers into the GTT.
620 * This is done in 3 phases:
621 *
622 * 1a. Unbind all objects that do not match the GTT constraints for
623 * the execbuffer (fenceable, mappable, alignment etc).
624 * 1b. Increment pin count for already bound objects.
625 * 2. Bind new objects.
626 * 3. Decrement pin count.
627 *
628 * This avoid unnecessary unbinding of later objects in order to make
629 * room for the earlier objects *unless* we need to defragment.
630 */
631 retry = 0;
632 do {
633 int ret = 0;
634
635 /* Unbind any ill-fitting objects or pin. */
636 list_for_each_entry(vma, vmas, exec_list) {
637 struct drm_i915_gem_exec_object2 *entry = vma->exec_entry;
638 bool need_fence, need_mappable;
639
640 obj = vma->obj;
641
642 if (!drm_mm_node_allocated(&vma->node))
643 continue;
644
645 need_fence =
646 has_fenced_gpu_access &&
647 entry->flags & EXEC_OBJECT_NEEDS_FENCE &&
648 obj->tiling_mode != I915_TILING_NONE;
649 need_mappable = need_fence || need_reloc_mappable(vma);
650
651 WARN_ON((need_mappable || need_fence) &&
652 !i915_is_ggtt(vma->vm));
653
654 if ((entry->alignment &&
655 vma->node.start & (entry->alignment - 1)) ||
656 (need_mappable && !obj->map_and_fenceable))
657 ret = i915_vma_unbind(vma);
658 else
659 ret = i915_gem_execbuffer_reserve_vma(vma, ring, need_relocs);
660 if (ret)
661 goto err;
662 }
663
664 /* Bind fresh objects */
665 list_for_each_entry(vma, vmas, exec_list) {
666 if (drm_mm_node_allocated(&vma->node))
667 continue;
668
669 ret = i915_gem_execbuffer_reserve_vma(vma, ring, need_relocs);
670 if (ret)
671 goto err;
672 }
673
674 err:
675 if (ret != -ENOSPC || retry++)
676 return ret;
677
678 /* Decrement pin count for bound objects */
679 list_for_each_entry(vma, vmas, exec_list)
680 i915_gem_execbuffer_unreserve_vma(vma);
681
682 ret = i915_gem_evict_vm(vm, true);
683 if (ret)
684 return ret;
685 } while (1);
686 }
687
688 static int
689 i915_gem_execbuffer_relocate_slow(struct drm_device *dev,
690 struct drm_i915_gem_execbuffer2 *args,
691 struct drm_file *file,
692 struct intel_ring_buffer *ring,
693 struct eb_vmas *eb,
694 struct drm_i915_gem_exec_object2 *exec)
695 {
696 struct drm_i915_gem_relocation_entry *reloc;
697 struct i915_address_space *vm;
698 struct i915_vma *vma;
699 bool need_relocs;
700 int *reloc_offset;
701 int i, total, ret;
702 unsigned count = args->buffer_count;
703
704 if (WARN_ON(list_empty(&eb->vmas)))
705 return 0;
706
707 vm = list_first_entry(&eb->vmas, struct i915_vma, exec_list)->vm;
708
709 /* We may process another execbuffer during the unlock... */
710 while (!list_empty(&eb->vmas)) {
711 vma = list_first_entry(&eb->vmas, struct i915_vma, exec_list);
712 list_del_init(&vma->exec_list);
713 i915_gem_execbuffer_unreserve_vma(vma);
714 drm_gem_object_unreference(&vma->obj->base);
715 }
716
717 mutex_unlock(&dev->struct_mutex);
718
719 total = 0;
720 for (i = 0; i < count; i++)
721 total += exec[i].relocation_count;
722
723 reloc_offset = drm_malloc_ab(count, sizeof(*reloc_offset));
724 reloc = drm_malloc_ab(total, sizeof(*reloc));
725 if (reloc == NULL || reloc_offset == NULL) {
726 drm_free_large(reloc);
727 drm_free_large(reloc_offset);
728 mutex_lock(&dev->struct_mutex);
729 return -ENOMEM;
730 }
731
732 total = 0;
733 for (i = 0; i < count; i++) {
734 struct drm_i915_gem_relocation_entry __user *user_relocs;
735 u64 invalid_offset = (u64)-1;
736 int j;
737
738 user_relocs = to_user_ptr(exec[i].relocs_ptr);
739
740 if (copy_from_user(reloc+total, user_relocs,
741 exec[i].relocation_count * sizeof(*reloc))) {
742 ret = -EFAULT;
743 mutex_lock(&dev->struct_mutex);
744 goto err;
745 }
746
747 /* As we do not update the known relocation offsets after
748 * relocating (due to the complexities in lock handling),
749 * we need to mark them as invalid now so that we force the
750 * relocation processing next time. Just in case the target
751 * object is evicted and then rebound into its old
752 * presumed_offset before the next execbuffer - if that
753 * happened we would make the mistake of assuming that the
754 * relocations were valid.
755 */
756 for (j = 0; j < exec[i].relocation_count; j++) {
757 if (copy_to_user(&user_relocs[j].presumed_offset,
758 &invalid_offset,
759 sizeof(invalid_offset))) {
760 ret = -EFAULT;
761 mutex_lock(&dev->struct_mutex);
762 goto err;
763 }
764 }
765
766 reloc_offset[i] = total;
767 total += exec[i].relocation_count;
768 }
769
770 ret = i915_mutex_lock_interruptible(dev);
771 if (ret) {
772 mutex_lock(&dev->struct_mutex);
773 goto err;
774 }
775
776 /* reacquire the objects */
777 eb_reset(eb);
778 ret = eb_lookup_vmas(eb, exec, args, vm, file);
779 if (ret)
780 goto err;
781
782 need_relocs = (args->flags & I915_EXEC_NO_RELOC) == 0;
783 ret = i915_gem_execbuffer_reserve(ring, &eb->vmas, &need_relocs);
784 if (ret)
785 goto err;
786
787 list_for_each_entry(vma, &eb->vmas, exec_list) {
788 int offset = vma->exec_entry - exec;
789 ret = i915_gem_execbuffer_relocate_vma_slow(vma, eb,
790 reloc + reloc_offset[offset]);
791 if (ret)
792 goto err;
793 }
794
795 /* Leave the user relocations as are, this is the painfully slow path,
796 * and we want to avoid the complication of dropping the lock whilst
797 * having buffers reserved in the aperture and so causing spurious
798 * ENOSPC for random operations.
799 */
800
801 err:
802 drm_free_large(reloc);
803 drm_free_large(reloc_offset);
804 return ret;
805 }
806
807 static int
808 i915_gem_execbuffer_move_to_gpu(struct intel_ring_buffer *ring,
809 struct list_head *vmas)
810 {
811 struct i915_vma *vma;
812 uint32_t flush_domains = 0;
813 bool flush_chipset = false;
814 int ret;
815
816 list_for_each_entry(vma, vmas, exec_list) {
817 struct drm_i915_gem_object *obj = vma->obj;
818 ret = i915_gem_object_sync(obj, ring);
819 if (ret)
820 return ret;
821
822 if (obj->base.write_domain & I915_GEM_DOMAIN_CPU)
823 flush_chipset |= i915_gem_clflush_object(obj, false);
824
825 flush_domains |= obj->base.write_domain;
826 }
827
828 if (flush_chipset)
829 i915_gem_chipset_flush(ring->dev);
830
831 if (flush_domains & I915_GEM_DOMAIN_GTT)
832 wmb();
833
834 /* Unconditionally invalidate gpu caches and ensure that we do flush
835 * any residual writes from the previous batch.
836 */
837 return intel_ring_invalidate_all_caches(ring);
838 }
839
840 static bool
841 i915_gem_check_execbuffer(struct drm_i915_gem_execbuffer2 *exec)
842 {
843 if (exec->flags & __I915_EXEC_UNKNOWN_FLAGS)
844 return false;
845
846 return ((exec->batch_start_offset | exec->batch_len) & 0x7) == 0;
847 }
848
849 static int
850 validate_exec_list(struct drm_i915_gem_exec_object2 *exec,
851 int count)
852 {
853 int i;
854 unsigned relocs_total = 0;
855 unsigned relocs_max = UINT_MAX / sizeof(struct drm_i915_gem_relocation_entry);
856
857 for (i = 0; i < count; i++) {
858 char __user *ptr = to_user_ptr(exec[i].relocs_ptr);
859 int length; /* limited by fault_in_pages_readable() */
860
861 if (exec[i].flags & __EXEC_OBJECT_UNKNOWN_FLAGS)
862 return -EINVAL;
863
864 /* First check for malicious input causing overflow in
865 * the worst case where we need to allocate the entire
866 * relocation tree as a single array.
867 */
868 if (exec[i].relocation_count > relocs_max - relocs_total)
869 return -EINVAL;
870 relocs_total += exec[i].relocation_count;
871
872 length = exec[i].relocation_count *
873 sizeof(struct drm_i915_gem_relocation_entry);
874 /*
875 * We must check that the entire relocation array is safe
876 * to read, but since we may need to update the presumed
877 * offsets during execution, check for full write access.
878 */
879 if (!access_ok(VERIFY_WRITE, ptr, length))
880 return -EFAULT;
881
882 if (likely(!i915_prefault_disable)) {
883 if (fault_in_multipages_readable(ptr, length))
884 return -EFAULT;
885 }
886 }
887
888 return 0;
889 }
890
891 static struct i915_hw_context *
892 i915_gem_validate_context(struct drm_device *dev, struct drm_file *file,
893 struct intel_ring_buffer *ring, const u32 ctx_id)
894 {
895 struct i915_hw_context *ctx = NULL;
896 struct i915_ctx_hang_stats *hs;
897
898 if (ring->id != RCS && ctx_id != DEFAULT_CONTEXT_ID)
899 return ERR_PTR(-EINVAL);
900
901 ctx = i915_gem_context_get(file->driver_priv, ctx_id);
902 if (IS_ERR_OR_NULL(ctx))
903 return ctx;
904
905 hs = &ctx->hang_stats;
906 if (hs->banned) {
907 DRM_DEBUG("Context %u tried to submit while banned\n", ctx_id);
908 return ERR_PTR(-EIO);
909 }
910
911 return ctx;
912 }
913
914 static void
915 i915_gem_execbuffer_move_to_active(struct list_head *vmas,
916 struct intel_ring_buffer *ring)
917 {
918 struct i915_vma *vma;
919
920 list_for_each_entry(vma, vmas, exec_list) {
921 struct drm_i915_gem_object *obj = vma->obj;
922 u32 old_read = obj->base.read_domains;
923 u32 old_write = obj->base.write_domain;
924
925 obj->base.write_domain = obj->base.pending_write_domain;
926 if (obj->base.write_domain == 0)
927 obj->base.pending_read_domains |= obj->base.read_domains;
928 obj->base.read_domains = obj->base.pending_read_domains;
929 obj->fenced_gpu_access = obj->pending_fenced_gpu_access;
930
931 i915_vma_move_to_active(vma, ring);
932 if (obj->base.write_domain) {
933 obj->dirty = 1;
934 obj->last_write_seqno = intel_ring_get_seqno(ring);
935 /* check for potential scanout */
936 if (i915_gem_obj_ggtt_bound(obj) &&
937 i915_gem_obj_to_ggtt(obj)->pin_count)
938 intel_mark_fb_busy(obj, ring);
939 }
940
941 trace_i915_gem_object_change_domain(obj, old_read, old_write);
942 }
943 }
944
945 static void
946 i915_gem_execbuffer_retire_commands(struct drm_device *dev,
947 struct drm_file *file,
948 struct intel_ring_buffer *ring,
949 struct drm_i915_gem_object *obj)
950 {
951 /* Unconditionally force add_request to emit a full flush. */
952 ring->gpu_caches_dirty = true;
953
954 /* Add a breadcrumb for the completion of the batch buffer */
955 (void)__i915_add_request(ring, file, obj, NULL);
956 }
957
958 static int
959 i915_reset_gen7_sol_offsets(struct drm_device *dev,
960 struct intel_ring_buffer *ring)
961 {
962 drm_i915_private_t *dev_priv = dev->dev_private;
963 int ret, i;
964
965 if (!IS_GEN7(dev) || ring != &dev_priv->ring[RCS])
966 return 0;
967
968 ret = intel_ring_begin(ring, 4 * 3);
969 if (ret)
970 return ret;
971
972 for (i = 0; i < 4; i++) {
973 intel_ring_emit(ring, MI_LOAD_REGISTER_IMM(1));
974 intel_ring_emit(ring, GEN7_SO_WRITE_OFFSET(i));
975 intel_ring_emit(ring, 0);
976 }
977
978 intel_ring_advance(ring);
979
980 return 0;
981 }
982
983 static int
984 i915_gem_do_execbuffer(struct drm_device *dev, void *data,
985 struct drm_file *file,
986 struct drm_i915_gem_execbuffer2 *args,
987 struct drm_i915_gem_exec_object2 *exec)
988 {
989 drm_i915_private_t *dev_priv = dev->dev_private;
990 struct eb_vmas *eb;
991 struct drm_i915_gem_object *batch_obj;
992 struct drm_clip_rect *cliprects = NULL;
993 struct intel_ring_buffer *ring;
994 struct i915_hw_context *ctx;
995 struct i915_address_space *vm;
996 const u32 ctx_id = i915_execbuffer2_get_context_id(*args);
997 u32 exec_start = args->batch_start_offset, exec_len;
998 u32 mask, flags;
999 int ret, mode, i;
1000 bool need_relocs;
1001
1002 if (!i915_gem_check_execbuffer(args))
1003 return -EINVAL;
1004
1005 ret = validate_exec_list(exec, args->buffer_count);
1006 if (ret)
1007 return ret;
1008
1009 flags = 0;
1010 if (args->flags & I915_EXEC_SECURE) {
1011 if (!file->is_master || !capable(CAP_SYS_ADMIN))
1012 return -EPERM;
1013
1014 flags |= I915_DISPATCH_SECURE;
1015 }
1016 if (args->flags & I915_EXEC_IS_PINNED)
1017 flags |= I915_DISPATCH_PINNED;
1018
1019 if ((args->flags & I915_EXEC_RING_MASK) > I915_NUM_RINGS) {
1020 DRM_DEBUG("execbuf with unknown ring: %d\n",
1021 (int)(args->flags & I915_EXEC_RING_MASK));
1022 return -EINVAL;
1023 }
1024
1025 if ((args->flags & I915_EXEC_RING_MASK) == I915_EXEC_DEFAULT)
1026 ring = &dev_priv->ring[RCS];
1027 else
1028 ring = &dev_priv->ring[(args->flags & I915_EXEC_RING_MASK) - 1];
1029
1030 if (!intel_ring_initialized(ring)) {
1031 DRM_DEBUG("execbuf with invalid ring: %d\n",
1032 (int)(args->flags & I915_EXEC_RING_MASK));
1033 return -EINVAL;
1034 }
1035
1036 mode = args->flags & I915_EXEC_CONSTANTS_MASK;
1037 mask = I915_EXEC_CONSTANTS_MASK;
1038 switch (mode) {
1039 case I915_EXEC_CONSTANTS_REL_GENERAL:
1040 case I915_EXEC_CONSTANTS_ABSOLUTE:
1041 case I915_EXEC_CONSTANTS_REL_SURFACE:
1042 if (ring == &dev_priv->ring[RCS] &&
1043 mode != dev_priv->relative_constants_mode) {
1044 if (INTEL_INFO(dev)->gen < 4)
1045 return -EINVAL;
1046
1047 if (INTEL_INFO(dev)->gen > 5 &&
1048 mode == I915_EXEC_CONSTANTS_REL_SURFACE)
1049 return -EINVAL;
1050
1051 /* The HW changed the meaning on this bit on gen6 */
1052 if (INTEL_INFO(dev)->gen >= 6)
1053 mask &= ~I915_EXEC_CONSTANTS_REL_SURFACE;
1054 }
1055 break;
1056 default:
1057 DRM_DEBUG("execbuf with unknown constants: %d\n", mode);
1058 return -EINVAL;
1059 }
1060
1061 if (args->buffer_count < 1) {
1062 DRM_DEBUG("execbuf with %d buffers\n", args->buffer_count);
1063 return -EINVAL;
1064 }
1065
1066 if (args->num_cliprects != 0) {
1067 if (ring != &dev_priv->ring[RCS]) {
1068 DRM_DEBUG("clip rectangles are only valid with the render ring\n");
1069 return -EINVAL;
1070 }
1071
1072 if (INTEL_INFO(dev)->gen >= 5) {
1073 DRM_DEBUG("clip rectangles are only valid on pre-gen5\n");
1074 return -EINVAL;
1075 }
1076
1077 if (args->num_cliprects > UINT_MAX / sizeof(*cliprects)) {
1078 DRM_DEBUG("execbuf with %u cliprects\n",
1079 args->num_cliprects);
1080 return -EINVAL;
1081 }
1082
1083 cliprects = kcalloc(args->num_cliprects,
1084 sizeof(*cliprects),
1085 GFP_KERNEL);
1086 if (cliprects == NULL) {
1087 ret = -ENOMEM;
1088 goto pre_mutex_err;
1089 }
1090
1091 if (copy_from_user(cliprects,
1092 to_user_ptr(args->cliprects_ptr),
1093 sizeof(*cliprects)*args->num_cliprects)) {
1094 ret = -EFAULT;
1095 goto pre_mutex_err;
1096 }
1097 }
1098
1099 ret = i915_mutex_lock_interruptible(dev);
1100 if (ret)
1101 goto pre_mutex_err;
1102
1103 if (dev_priv->ums.mm_suspended) {
1104 mutex_unlock(&dev->struct_mutex);
1105 ret = -EBUSY;
1106 goto pre_mutex_err;
1107 }
1108
1109 ctx = i915_gem_validate_context(dev, file, ring, ctx_id);
1110 if (IS_ERR_OR_NULL(ctx)) {
1111 mutex_unlock(&dev->struct_mutex);
1112 ret = PTR_ERR(ctx);
1113 goto pre_mutex_err;
1114 }
1115
1116 i915_gem_context_reference(ctx);
1117
1118 vm = ctx->vm;
1119 if (!USES_FULL_PPGTT(dev))
1120 vm = &dev_priv->gtt.base;
1121
1122 eb = eb_create(args);
1123 if (eb == NULL) {
1124 mutex_unlock(&dev->struct_mutex);
1125 ret = -ENOMEM;
1126 goto pre_mutex_err;
1127 }
1128
1129 /* Look up object handles */
1130 ret = eb_lookup_vmas(eb, exec, args, vm, file);
1131 if (ret)
1132 goto err;
1133
1134 /* take note of the batch buffer before we might reorder the lists */
1135 batch_obj = list_entry(eb->vmas.prev, struct i915_vma, exec_list)->obj;
1136
1137 /* Move the objects en-masse into the GTT, evicting if necessary. */
1138 need_relocs = (args->flags & I915_EXEC_NO_RELOC) == 0;
1139 ret = i915_gem_execbuffer_reserve(ring, &eb->vmas, &need_relocs);
1140 if (ret)
1141 goto err;
1142
1143 /* The objects are in their final locations, apply the relocations. */
1144 if (need_relocs)
1145 ret = i915_gem_execbuffer_relocate(eb);
1146 if (ret) {
1147 if (ret == -EFAULT) {
1148 ret = i915_gem_execbuffer_relocate_slow(dev, args, file, ring,
1149 eb, exec);
1150 BUG_ON(!mutex_is_locked(&dev->struct_mutex));
1151 }
1152 if (ret)
1153 goto err;
1154 }
1155
1156 /* Set the pending read domains for the batch buffer to COMMAND */
1157 if (batch_obj->base.pending_write_domain) {
1158 DRM_DEBUG("Attempting to use self-modifying batch buffer\n");
1159 ret = -EINVAL;
1160 goto err;
1161 }
1162 batch_obj->base.pending_read_domains |= I915_GEM_DOMAIN_COMMAND;
1163
1164 /* snb/ivb/vlv conflate the "batch in ppgtt" bit with the "non-secure
1165 * batch" bit. Hence we need to pin secure batches into the global gtt.
1166 * hsw should have this fixed, but bdw mucks it up again. */
1167 if (flags & I915_DISPATCH_SECURE &&
1168 !batch_obj->has_global_gtt_mapping) {
1169 /* When we have multiple VMs, we'll need to make sure that we
1170 * allocate space first */
1171 struct i915_vma *vma = i915_gem_obj_to_ggtt(batch_obj);
1172 BUG_ON(!vma);
1173 vma->bind_vma(vma, batch_obj->cache_level, GLOBAL_BIND);
1174 }
1175
1176 if (flags & I915_DISPATCH_SECURE)
1177 exec_start += i915_gem_obj_ggtt_offset(batch_obj);
1178 else
1179 exec_start += i915_gem_obj_offset(batch_obj, vm);
1180
1181 ret = i915_gem_execbuffer_move_to_gpu(ring, &eb->vmas);
1182 if (ret)
1183 goto err;
1184
1185 ret = i915_switch_context(ring, file, ctx);
1186 if (ret)
1187 goto err;
1188
1189 if (ring == &dev_priv->ring[RCS] &&
1190 mode != dev_priv->relative_constants_mode) {
1191 ret = intel_ring_begin(ring, 4);
1192 if (ret)
1193 goto err;
1194
1195 intel_ring_emit(ring, MI_NOOP);
1196 intel_ring_emit(ring, MI_LOAD_REGISTER_IMM(1));
1197 intel_ring_emit(ring, INSTPM);
1198 intel_ring_emit(ring, mask << 16 | mode);
1199 intel_ring_advance(ring);
1200
1201 dev_priv->relative_constants_mode = mode;
1202 }
1203
1204 if (args->flags & I915_EXEC_GEN7_SOL_RESET) {
1205 ret = i915_reset_gen7_sol_offsets(dev, ring);
1206 if (ret)
1207 goto err;
1208 }
1209
1210
1211 exec_len = args->batch_len;
1212 if (cliprects) {
1213 for (i = 0; i < args->num_cliprects; i++) {
1214 ret = i915_emit_box(dev, &cliprects[i],
1215 args->DR1, args->DR4);
1216 if (ret)
1217 goto err;
1218
1219 ret = ring->dispatch_execbuffer(ring,
1220 exec_start, exec_len,
1221 flags);
1222 if (ret)
1223 goto err;
1224 }
1225 } else {
1226 ret = ring->dispatch_execbuffer(ring,
1227 exec_start, exec_len,
1228 flags);
1229 if (ret)
1230 goto err;
1231 }
1232
1233 trace_i915_gem_ring_dispatch(ring, intel_ring_get_seqno(ring), flags);
1234
1235 i915_gem_execbuffer_move_to_active(&eb->vmas, ring);
1236 i915_gem_execbuffer_retire_commands(dev, file, ring, batch_obj);
1237
1238 err:
1239 /* the request owns the ref now */
1240 i915_gem_context_unreference(ctx);
1241 eb_destroy(eb);
1242
1243 mutex_unlock(&dev->struct_mutex);
1244
1245 pre_mutex_err:
1246 kfree(cliprects);
1247 return ret;
1248 }
1249
1250 /*
1251 * Legacy execbuffer just creates an exec2 list from the original exec object
1252 * list array and passes it to the real function.
1253 */
1254 int
1255 i915_gem_execbuffer(struct drm_device *dev, void *data,
1256 struct drm_file *file)
1257 {
1258 struct drm_i915_gem_execbuffer *args = data;
1259 struct drm_i915_gem_execbuffer2 exec2;
1260 struct drm_i915_gem_exec_object *exec_list = NULL;
1261 struct drm_i915_gem_exec_object2 *exec2_list = NULL;
1262 int ret, i;
1263
1264 if (args->buffer_count < 1) {
1265 DRM_DEBUG("execbuf with %d buffers\n", args->buffer_count);
1266 return -EINVAL;
1267 }
1268
1269 /* Copy in the exec list from userland */
1270 exec_list = drm_malloc_ab(sizeof(*exec_list), args->buffer_count);
1271 exec2_list = drm_malloc_ab(sizeof(*exec2_list), args->buffer_count);
1272 if (exec_list == NULL || exec2_list == NULL) {
1273 DRM_DEBUG("Failed to allocate exec list for %d buffers\n",
1274 args->buffer_count);
1275 drm_free_large(exec_list);
1276 drm_free_large(exec2_list);
1277 return -ENOMEM;
1278 }
1279 ret = copy_from_user(exec_list,
1280 to_user_ptr(args->buffers_ptr),
1281 sizeof(*exec_list) * args->buffer_count);
1282 if (ret != 0) {
1283 DRM_DEBUG("copy %d exec entries failed %d\n",
1284 args->buffer_count, ret);
1285 drm_free_large(exec_list);
1286 drm_free_large(exec2_list);
1287 return -EFAULT;
1288 }
1289
1290 for (i = 0; i < args->buffer_count; i++) {
1291 exec2_list[i].handle = exec_list[i].handle;
1292 exec2_list[i].relocation_count = exec_list[i].relocation_count;
1293 exec2_list[i].relocs_ptr = exec_list[i].relocs_ptr;
1294 exec2_list[i].alignment = exec_list[i].alignment;
1295 exec2_list[i].offset = exec_list[i].offset;
1296 if (INTEL_INFO(dev)->gen < 4)
1297 exec2_list[i].flags = EXEC_OBJECT_NEEDS_FENCE;
1298 else
1299 exec2_list[i].flags = 0;
1300 }
1301
1302 exec2.buffers_ptr = args->buffers_ptr;
1303 exec2.buffer_count = args->buffer_count;
1304 exec2.batch_start_offset = args->batch_start_offset;
1305 exec2.batch_len = args->batch_len;
1306 exec2.DR1 = args->DR1;
1307 exec2.DR4 = args->DR4;
1308 exec2.num_cliprects = args->num_cliprects;
1309 exec2.cliprects_ptr = args->cliprects_ptr;
1310 exec2.flags = I915_EXEC_RENDER;
1311 i915_execbuffer2_set_context_id(exec2, 0);
1312
1313 ret = i915_gem_do_execbuffer(dev, data, file, &exec2, exec2_list);
1314 if (!ret) {
1315 /* Copy the new buffer offsets back to the user's exec list. */
1316 for (i = 0; i < args->buffer_count; i++)
1317 exec_list[i].offset = exec2_list[i].offset;
1318 /* ... and back out to userspace */
1319 ret = copy_to_user(to_user_ptr(args->buffers_ptr),
1320 exec_list,
1321 sizeof(*exec_list) * args->buffer_count);
1322 if (ret) {
1323 ret = -EFAULT;
1324 DRM_DEBUG("failed to copy %d exec entries "
1325 "back to user (%d)\n",
1326 args->buffer_count, ret);
1327 }
1328 }
1329
1330 drm_free_large(exec_list);
1331 drm_free_large(exec2_list);
1332 return ret;
1333 }
1334
1335 int
1336 i915_gem_execbuffer2(struct drm_device *dev, void *data,
1337 struct drm_file *file)
1338 {
1339 struct drm_i915_gem_execbuffer2 *args = data;
1340 struct drm_i915_gem_exec_object2 *exec2_list = NULL;
1341 int ret;
1342
1343 if (args->buffer_count < 1 ||
1344 args->buffer_count > UINT_MAX / sizeof(*exec2_list)) {
1345 DRM_DEBUG("execbuf2 with %d buffers\n", args->buffer_count);
1346 return -EINVAL;
1347 }
1348
1349 exec2_list = kmalloc(sizeof(*exec2_list)*args->buffer_count,
1350 GFP_TEMPORARY | __GFP_NOWARN | __GFP_NORETRY);
1351 if (exec2_list == NULL)
1352 exec2_list = drm_malloc_ab(sizeof(*exec2_list),
1353 args->buffer_count);
1354 if (exec2_list == NULL) {
1355 DRM_DEBUG("Failed to allocate exec list for %d buffers\n",
1356 args->buffer_count);
1357 return -ENOMEM;
1358 }
1359 ret = copy_from_user(exec2_list,
1360 to_user_ptr(args->buffers_ptr),
1361 sizeof(*exec2_list) * args->buffer_count);
1362 if (ret != 0) {
1363 DRM_DEBUG("copy %d exec entries failed %d\n",
1364 args->buffer_count, ret);
1365 drm_free_large(exec2_list);
1366 return -EFAULT;
1367 }
1368
1369 ret = i915_gem_do_execbuffer(dev, data, file, args, exec2_list);
1370 if (!ret) {
1371 /* Copy the new buffer offsets back to the user's exec list. */
1372 ret = copy_to_user(to_user_ptr(args->buffers_ptr),
1373 exec2_list,
1374 sizeof(*exec2_list) * args->buffer_count);
1375 if (ret) {
1376 ret = -EFAULT;
1377 DRM_DEBUG("failed to copy %d exec entries "
1378 "back to user (%d)\n",
1379 args->buffer_count, ret);
1380 }
1381 }
1382
1383 drm_free_large(exec2_list);
1384 return ret;
1385 }
Linux kernel - Deliverables
This page took 0.07171 seconds and 5 git commands to generate.