drivers/char/drm/drm_bufs.c

   1 /**
   2  * \file drm_bufs.h
   3  * Generic buffer template
   4  *
   5  * \author Rickard E. (Rik) Faith <faith@valinux.com>
   6  * \author Gareth Hughes <gareth@valinux.com>
   7  */
   8
   9 /*
  10  * Created: Thu Nov 23 03:10:50 2000 by gareth@valinux.com
  11  *
  12  * Copyright 1999, 2000 Precision Insight, Inc., Cedar Park, Texas.
  13  * Copyright 2000 VA Linux Systems, Inc., Sunnyvale, California.
  14  * All Rights Reserved.
  15  *
  16  * Permission is hereby granted, free of charge, to any person obtaining a
  17  * copy of this software and associated documentation files (the "Software"),
  18  * to deal in the Software without restriction, including without limitation
  19  * the rights to use, copy, modify, merge, publish, distribute, sublicense,
  20  * and/or sell copies of the Software, and to permit persons to whom the
  21  * Software is furnished to do so, subject to the following conditions:
  22  *
  23  * The above copyright notice and this permission notice (including the next
  24  * paragraph) shall be included in all copies or substantial portions of the
  25  * Software.
  26  *
  27  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  28  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  29  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
  30  * VA LINUX SYSTEMS AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM, DAMAGES OR
  31  * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
  32  * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
  33  * OTHER DEALINGS IN THE SOFTWARE.
  34  */
  35
  36 #include <linux/vmalloc.h>
  37 #include "drmP.h"
  38
  39 /**
  40  * Compute size order.  Returns the exponent of the smaller power of two which
  41  * is greater or equal to given number.
  42  *
  43  * \param size size.
  44  * \return order.
  45  *
  46  * \todo Can be made faster.
  47  */
  48 int drm_order( unsigned long size )
  49 {
  50         int order;
  51         unsigned long tmp;
  52
  53         for (order = 0, tmp = size >> 1; tmp; tmp >>= 1, order++)
  54                 ;
  55
  56         if (size & (size - 1))
  57                 ++order;
  58
  59         return order;
  60 }
  61 EXPORT_SYMBOL(drm_order);
  62
  63 #ifdef CONFIG_COMPAT
  64 /*
  65  * Used to allocate 32-bit handles for _DRM_SHM regions
  66  * The 0x10000000 value is chosen to be out of the way of
  67  * FB/register and GART physical addresses.
  68  */
  69 static unsigned int map32_handle = 0x10000000;
  70 #endif
  71
  72 /**
  73  * Ioctl to specify a range of memory that is available for mapping by a non-root process.
  74  *
  75  * \param inode device inode.
  76  * \param filp file pointer.
  77  * \param cmd command.
  78  * \param arg pointer to a drm_map structure.
  79  * \return zero on success or a negative value on error.
  80  *
  81  * Adjusts the memory offset to its absolute value according to the mapping
  82  * type.  Adds the map to the map list drm_device::maplist. Adds MTRR's where
  83  * applicable and if supported by the kernel.
  84  */
  85 int drm_addmap( struct inode *inode, struct file *filp,
  86                  unsigned int cmd, unsigned long arg )
  87 {
  88         drm_file_t *priv = filp->private_data;
  89         drm_device_t *dev = priv->head->dev;
  90         drm_map_t *map;
  91         drm_map_t __user *argp = (void __user *)arg;
  92         drm_map_list_t *list;
  93
  94         if ( !(filp->f_mode & 3) ) return -EACCES; /* Require read/write */
  95
  96         map = drm_alloc( sizeof(*map), DRM_MEM_MAPS );
  97         if ( !map )
  98                 return -ENOMEM;
  99
 100         if ( copy_from_user( map, argp, sizeof(*map) ) ) {
 101                 drm_free( map, sizeof(*map), DRM_MEM_MAPS );
 102                 return -EFAULT;
 103         }
 104
 105         /* Only allow shared memory to be removable since we only keep enough
 106          * book keeping information about shared memory to allow for removal
 107          * when processes fork.
 108          */
 109         if ( (map->flags & _DRM_REMOVABLE) && map->type != _DRM_SHM ) {
 110                 drm_free( map, sizeof(*map), DRM_MEM_MAPS );
 111                 return -EINVAL;
 112         }
 113         DRM_DEBUG( "offset = 0x%08lx, size = 0x%08lx, type = %d\n",
 114                    map->offset, map->size, map->type );
 115         if ( (map->offset & (~PAGE_MASK)) || (map->size & (~PAGE_MASK)) ) {
 116                 drm_free( map, sizeof(*map), DRM_MEM_MAPS );
 117                 return -EINVAL;
 118         }
 119         map->mtrr   = -1;
 120         map->handle = NULL;
 121
 122         switch ( map->type ) {
 123         case _DRM_REGISTERS:
 124         case _DRM_FRAME_BUFFER:
 125 #if !defined(__sparc__) && !defined(__alpha__) && !defined(__ia64__)
 126                 if ( map->offset + map->size < map->offset ||
 127                      map->offset < virt_to_phys(high_memory) ) {
 128                         drm_free( map, sizeof(*map), DRM_MEM_MAPS );
 129                         return -EINVAL;
 130                 }
 131 #endif
 132 #ifdef __alpha__
 133                 map->offset += dev->hose->mem_space->start;
 134 #endif
 135                 if (drm_core_has_MTRR(dev)) {
 136                         if ( map->type == _DRM_FRAME_BUFFER ||
 137                              (map->flags & _DRM_WRITE_COMBINING) ) {
 138                                 map->mtrr = mtrr_add( map->offset, map->size,
 139                                                       MTRR_TYPE_WRCOMB, 1 );
 140                         }
 141                 }
 142                 if (map->type == _DRM_REGISTERS)
 143                         map->handle = drm_ioremap( map->offset, map->size,
 144                                                     dev );
 145                 break;
 146
 147         case _DRM_SHM:
 148                 map->handle = vmalloc_32(map->size);
 149                 DRM_DEBUG( "%lu %d %p\n",
 150                            map->size, drm_order( map->size ), map->handle );
 151                 if ( !map->handle ) {
 152                         drm_free( map, sizeof(*map), DRM_MEM_MAPS );
 153                         return -ENOMEM;
 154                 }
 155                 map->offset = (unsigned long)map->handle;
 156                 if ( map->flags & _DRM_CONTAINS_LOCK ) {
 157                         /* Prevent a 2nd X Server from creating a 2nd lock */
 158                         if (dev->lock.hw_lock != NULL) {
 159                                 vfree( map->handle );
 160                                 drm_free( map, sizeof(*map), DRM_MEM_MAPS );
 161                                 return -EBUSY;
 162                         }
 163                         dev->sigdata.lock =
 164                         dev->lock.hw_lock = map->handle; /* Pointer to lock */
 165                 }
 166                 break;
 167         case _DRM_AGP:
 168                 if (drm_core_has_AGP(dev)) {
 169 #ifdef __alpha__
 170                         map->offset += dev->hose->mem_space->start;
 171 #endif
 172                         map->offset += dev->agp->base;
 173                         map->mtrr   = dev->agp->agp_mtrr; /* for getmap */
 174                 }
 175                 break;
 176         case _DRM_SCATTER_GATHER:
 177                 if (!dev->sg) {
 178                         drm_free(map, sizeof(*map), DRM_MEM_MAPS);
 179                         return -EINVAL;
 180                 }
 181                 map->offset += dev->sg->handle;
 182                 break;
 183         case _DRM_CONSISTENT:
 184         {
 185                 /* dma_addr_t is 64bit on i386 with CONFIG_HIGHMEM64G,
 186                  * As we're limit the address to 2^32-1 (or lses),
 187                  * casting it down to 32 bits is no problem, but we
 188                  * need to point to a 64bit variable first. */
 189                 dma_addr_t bus_addr;
 190                 map->handle = drm_pci_alloc(dev, map->size, map->size,
 191                                             0xffffffffUL, &bus_addr);
 192                 map->offset = (unsigned long)bus_addr;
 193                 if (!map->handle) {
 194                         drm_free(map, sizeof(*map), DRM_MEM_MAPS);
 195                         return -ENOMEM;
 196                 }
 197                 break;
 198         }
 199         default:
 200                 drm_free( map, sizeof(*map), DRM_MEM_MAPS );
 201                 return -EINVAL;
 202         }
 203
 204         list = drm_alloc(sizeof(*list), DRM_MEM_MAPS);
 205         if(!list) {
 206                 drm_free(map, sizeof(*map), DRM_MEM_MAPS);
 207                 return -EINVAL;
 208         }
 209         memset(list, 0, sizeof(*list));
 210         list->map = map;
 211
 212         down(&dev->struct_sem);
 213         list_add(&list->head, &dev->maplist->head);
 214 #ifdef CONFIG_COMPAT
 215         /* Assign a 32-bit handle for _DRM_SHM mappings */
 216         /* We do it here so that dev->struct_sem protects the increment */
 217         if (map->type == _DRM_SHM)
 218                 map->offset = map32_handle += PAGE_SIZE;
 219 #endif
 220         up(&dev->struct_sem);
 221
 222         if ( copy_to_user( argp, map, sizeof(*map) ) )
 223                 return -EFAULT;
 224         if (copy_to_user(&argp->handle, &map->offset, sizeof(map->offset)))
 225                 return -EFAULT;
 226         return 0;
 227 }
 228
 229
 230 /**
 231  * Remove a map private from list and deallocate resources if the mapping
 232  * isn't in use.
 233  *
 234  * \param inode device inode.
 235  * \param filp file pointer.
 236  * \param cmd command.
 237  * \param arg pointer to a drm_map_t structure.
 238  * \return zero on success or a negative value on error.
 239  *
 240  * Searches the map on drm_device::maplist, removes it from the list, see if
 241  * its being used, and free any associate resource (such as MTRR's) if it's not
 242  * being on use.
 243  *
 244  * \sa addmap().
 245  */
 246 int drm_rmmap(struct inode *inode, struct file *filp,
 247                unsigned int cmd, unsigned long arg)
 248 {
 249         drm_file_t      *priv   = filp->private_data;
 250         drm_device_t    *dev    = priv->head->dev;
 251         struct list_head *list;
 252         drm_map_list_t *r_list = NULL;
 253         drm_vma_entry_t *pt, *prev;
 254         drm_map_t *map;
 255         drm_map_t request;
 256         int found_maps = 0;
 257
 258         if (copy_from_user(&request, (drm_map_t __user *)arg,
 259                            sizeof(request))) {
 260                 return -EFAULT;
 261         }
 262
 263         down(&dev->struct_sem);
 264         list = &dev->maplist->head;
 265         list_for_each(list, &dev->maplist->head) {
 266                 r_list = list_entry(list, drm_map_list_t, head);
 267
 268                 if(r_list->map &&
 269                    r_list->map->offset == (unsigned long) request.handle &&
 270                    r_list->map->flags & _DRM_REMOVABLE) break;
 271         }
 272
 273         /* List has wrapped around to the head pointer, or its empty we didn't
 274          * find anything.
 275          */
 276         if(list == (&dev->maplist->head)) {
 277                 up(&dev->struct_sem);
 278                 return -EINVAL;
 279         }
 280         map = r_list->map;
 281         list_del(list);
 282         drm_free(list, sizeof(*list), DRM_MEM_MAPS);
 283
 284         for (pt = dev->vmalist, prev = NULL; pt; prev = pt, pt = pt->next) {
 285                 if (pt->vma->vm_private_data == map) found_maps++;
 286         }
 287
 288         if(!found_maps) {
 289                 switch (map->type) {
 290                 case _DRM_REGISTERS:
 291                 case _DRM_FRAME_BUFFER:
 292                   if (drm_core_has_MTRR(dev)) {
 293                                 if (map->mtrr >= 0) {
 294                                         int retcode;
 295                                         retcode = mtrr_del(map->mtrr,
 296                                                            map->offset,
 297                                                            map->size);
 298                                         DRM_DEBUG("mtrr_del = %d\n", retcode);
 299                                 }
 300                         }
 301                         drm_ioremapfree(map->handle, map->size, dev);
 302                         break;
 303                 case _DRM_SHM:
 304                         vfree(map->handle);
 305                         break;
 306                 case _DRM_AGP:
 307                 case _DRM_SCATTER_GATHER:
 308                         break;
 309                 case _DRM_CONSISTENT:
 310                         drm_pci_free(dev, map->size, map->handle, map->offset);
 311                         break;
 312                 }
 313                 drm_free(map, sizeof(*map), DRM_MEM_MAPS);
 314         }
 315         up(&dev->struct_sem);
 316         return 0;
 317 }
 318
 319 /**
 320  * Cleanup after an error on one of the addbufs() functions.
 321  *
 322  * \param entry buffer entry where the error occurred.
 323  *
 324  * Frees any pages and buffers associated with the given entry.
 325  */
 326 static void drm_cleanup_buf_error(drm_device_t *dev, drm_buf_entry_t *entry)
 327 {
 328         int i;
 329
 330         if (entry->seg_count) {
 331                 for (i = 0; i < entry->seg_count; i++) {
 332                         if (entry->seglist[i]) {
 333                                 drm_free_pages(entry->seglist[i],
 334                                                 entry->page_order,
 335                                                 DRM_MEM_DMA);
 336                         }
 337                 }
 338                 drm_free(entry->seglist,
 339                           entry->seg_count *
 340                           sizeof(*entry->seglist),
 341                           DRM_MEM_SEGS);
 342
 343                 entry->seg_count = 0;
 344         }
 345
 346         if (entry->buf_count) {
 347                 for (i = 0; i < entry->buf_count; i++) {
 348                         if (entry->buflist[i].dev_private) {
 349                                 drm_free(entry->buflist[i].dev_private,
 350                                           entry->buflist[i].dev_priv_size,
 351                                           DRM_MEM_BUFS);
 352                         }
 353                 }
 354                 drm_free(entry->buflist,
 355                           entry->buf_count *
 356                           sizeof(*entry->buflist),
 357                           DRM_MEM_BUFS);
 358
 359                 entry->buf_count = 0;
 360         }
 361 }
 362
 363 #if __OS_HAS_AGP
 364 /**
 365  * Add AGP buffers for DMA transfers (ioctl).
 366  *
 367  * \param inode device inode.
 368  * \param filp file pointer.
 369  * \param cmd command.
 370  * \param arg pointer to a drm_buf_desc_t request.
 371  * \return zero on success or a negative number on failure.
 372  *
 373  * After some sanity checks creates a drm_buf structure for each buffer and
 374  * reallocates the buffer list of the same size order to accommodate the new
 375  * buffers.
 376  */
 377 static int drm_addbufs_agp( struct inode *inode, struct file *filp,
 378                             unsigned int cmd, unsigned long arg )
 379 {
 380         drm_file_t *priv = filp->private_data;
 381         drm_device_t *dev = priv->head->dev;
 382         drm_device_dma_t *dma = dev->dma;
 383         drm_buf_desc_t request;
 384         drm_buf_entry_t *entry;
 385         drm_buf_t *buf;
 386         unsigned long offset;
 387         unsigned long agp_offset;
 388         int count;
 389         int order;
 390         int size;
 391         int alignment;
 392         int page_order;
 393         int total;
 394         int byte_count;
 395         int i;
 396         drm_buf_t **temp_buflist;
 397         drm_buf_desc_t __user *argp = (void __user *)arg;
 398
 399         if ( !dma ) return -EINVAL;
 400
 401         if ( copy_from_user( &request, argp,
 402                              sizeof(request) ) )
 403                 return -EFAULT;
 404
 405         count = request.count;
 406         order = drm_order( request.size );
 407         size = 1 << order;
 408
 409         alignment  = (request.flags & _DRM_PAGE_ALIGN)
 410                 ? PAGE_ALIGN(size) : size;
 411         page_order = order - PAGE_SHIFT > 0 ? order - PAGE_SHIFT : 0;
 412         total = PAGE_SIZE << page_order;
 413
 414         byte_count = 0;
 415         agp_offset = dev->agp->base + request.agp_start;
 416
 417         DRM_DEBUG( "count:      %d\n",  count );
 418         DRM_DEBUG( "order:      %d\n",  order );
 419         DRM_DEBUG( "size:       %d\n",  size );
 420         DRM_DEBUG( "agp_offset: %lu\n", agp_offset );
 421         DRM_DEBUG( "alignment:  %d\n",  alignment );
 422         DRM_DEBUG( "page_order: %d\n",  page_order );
 423         DRM_DEBUG( "total:      %d\n",  total );
 424
 425         if ( order < DRM_MIN_ORDER || order > DRM_MAX_ORDER ) return -EINVAL;
 426         if ( dev->queue_count ) return -EBUSY; /* Not while in use */
 427
 428         spin_lock( &dev->count_lock );
 429         if ( dev->buf_use ) {
 430                 spin_unlock( &dev->count_lock );
 431                 return -EBUSY;
 432         }
 433         atomic_inc( &dev->buf_alloc );
 434         spin_unlock( &dev->count_lock );
 435
 436         down( &dev->struct_sem );
 437         entry = &dma->bufs[order];
 438         if ( entry->buf_count ) {
 439                 up( &dev->struct_sem );
 440                 atomic_dec( &dev->buf_alloc );
 441                 return -ENOMEM; /* May only call once for each order */
 442         }
 443
 444         if (count < 0 || count > 4096) {
 445                 up( &dev->struct_sem );
 446                 atomic_dec( &dev->buf_alloc );
 447                 return -EINVAL;
 448         }
 449
 450         entry->buflist = drm_alloc( count * sizeof(*entry->buflist),
 451                                     DRM_MEM_BUFS );
 452         if ( !entry->buflist ) {
 453                 up( &dev->struct_sem );
 454                 atomic_dec( &dev->buf_alloc );
 455                 return -ENOMEM;
 456         }
 457         memset( entry->buflist, 0, count * sizeof(*entry->buflist) );
 458
 459         entry->buf_size = size;
 460         entry->page_order = page_order;
 461
 462         offset = 0;
 463
 464         while ( entry->buf_count < count ) {
 465                 buf          = &entry->buflist[entry->buf_count];
 466                 buf->idx     = dma->buf_count + entry->buf_count;
 467                 buf->total   = alignment;
 468                 buf->order   = order;
 469                 buf->used    = 0;
 470
 471                 buf->offset  = (dma->byte_count + offset);
 472                 buf->bus_address = agp_offset + offset;
 473                 buf->address = (void *)(agp_offset + offset);
 474                 buf->next    = NULL;
 475                 buf->waiting = 0;
 476                 buf->pending = 0;
 477                 init_waitqueue_head( &buf->dma_wait );
 478                 buf->filp    = NULL;
 479
 480                 buf->dev_priv_size = dev->driver->dev_priv_size;
 481                 buf->dev_private = drm_alloc( buf->dev_priv_size,
 482                                                DRM_MEM_BUFS );
 483                 if(!buf->dev_private) {
 484                         /* Set count correctly so we free the proper amount. */
 485                         entry->buf_count = count;
 486                         drm_cleanup_buf_error(dev,entry);
 487                         up( &dev->struct_sem );
 488                         atomic_dec( &dev->buf_alloc );
 489                         return -ENOMEM;
 490                 }
 491                 memset( buf->dev_private, 0, buf->dev_priv_size );
 492
 493                 DRM_DEBUG( "buffer %d @ %p\n",
 494                            entry->buf_count, buf->address );
 495
 496                 offset += alignment;
 497                 entry->buf_count++;
 498                 byte_count += PAGE_SIZE << page_order;
 499         }
 500
 501         DRM_DEBUG( "byte_count: %d\n", byte_count );
 502
 503         temp_buflist = drm_realloc( dma->buflist,
 504                                      dma->buf_count * sizeof(*dma->buflist),
 505                                      (dma->buf_count + entry->buf_count)
 506                                      * sizeof(*dma->buflist),
 507                                      DRM_MEM_BUFS );
 508         if(!temp_buflist) {
 509                 /* Free the entry because it isn't valid */
 510                 drm_cleanup_buf_error(dev,entry);
 511                 up( &dev->struct_sem );
 512                 atomic_dec( &dev->buf_alloc );
 513                 return -ENOMEM;
 514         }
 515         dma->buflist = temp_buflist;
 516
 517         for ( i = 0 ; i < entry->buf_count ; i++ ) {
 518                 dma->buflist[i + dma->buf_count] = &entry->buflist[i];
 519         }
 520
 521         dma->buf_count += entry->buf_count;
 522         dma->byte_count += byte_count;
 523
 524         DRM_DEBUG( "dma->buf_count : %d\n", dma->buf_count );
 525         DRM_DEBUG( "entry->buf_count : %d\n", entry->buf_count );
 526
 527         up( &dev->struct_sem );
 528
 529         request.count = entry->buf_count;
 530         request.size = size;
 531
 532         if ( copy_to_user( argp, &request, sizeof(request) ) )
 533                 return -EFAULT;
 534
 535         dma->flags = _DRM_DMA_USE_AGP;
 536
 537         atomic_dec( &dev->buf_alloc );
 538         return 0;
 539 }
 540 #endif /* __OS_HAS_AGP */
 541
 542 static int drm_addbufs_pci( struct inode *inode, struct file *filp,
 543                             unsigned int cmd, unsigned long arg )
 544 {
 545         drm_file_t *priv = filp->private_data;
 546         drm_device_t *dev = priv->head->dev;
 547         drm_device_dma_t *dma = dev->dma;
 548         drm_buf_desc_t request;
 549         int count;
 550         int order;
 551         int size;
 552         int total;
 553         int page_order;
 554         drm_buf_entry_t *entry;
 555         unsigned long page;
 556         drm_buf_t *buf;
 557         int alignment;
 558         unsigned long offset;
 559         int i;
 560         int byte_count;
 561         int page_count;
 562         unsigned long *temp_pagelist;
 563         drm_buf_t **temp_buflist;
 564         drm_buf_desc_t __user *argp = (void __user *)arg;
 565
 566         if (!drm_core_check_feature(dev, DRIVER_PCI_DMA)) return -EINVAL;
 567         if ( !dma ) return -EINVAL;
 568
 569         if ( copy_from_user( &request, argp, sizeof(request) ) )
 570                 return -EFAULT;
 571
 572         count = request.count;
 573         order = drm_order( request.size );
 574         size = 1 << order;
 575
 576         DRM_DEBUG( "count=%d, size=%d (%d), order=%d, queue_count=%d\n",
 577                    request.count, request.size, size,
 578                    order, dev->queue_count );
 579
 580         if ( order < DRM_MIN_ORDER || order > DRM_MAX_ORDER ) return -EINVAL;
 581         if ( dev->queue_count ) return -EBUSY; /* Not while in use */
 582
 583         alignment = (request.flags & _DRM_PAGE_ALIGN)
 584                 ? PAGE_ALIGN(size) : size;
 585         page_order = order - PAGE_SHIFT > 0 ? order - PAGE_SHIFT : 0;
 586         total = PAGE_SIZE << page_order;
 587
 588         spin_lock( &dev->count_lock );
 589         if ( dev->buf_use ) {
 590                 spin_unlock( &dev->count_lock );
 591                 return -EBUSY;
 592         }
 593         atomic_inc( &dev->buf_alloc );
 594         spin_unlock( &dev->count_lock );
 595
 596         down( &dev->struct_sem );
 597         entry = &dma->bufs[order];
 598         if ( entry->buf_count ) {
 599                 up( &dev->struct_sem );
 600                 atomic_dec( &dev->buf_alloc );
 601                 return -ENOMEM; /* May only call once for each order */
 602         }
 603
 604         if (count < 0 || count > 4096) {
 605                 up( &dev->struct_sem );
 606                 atomic_dec( &dev->buf_alloc );
 607                 return -EINVAL;
 608         }
 609
 610         entry->buflist = drm_alloc( count * sizeof(*entry->buflist),
 611                                     DRM_MEM_BUFS );
 612         if ( !entry->buflist ) {
 613                 up( &dev->struct_sem );
 614                 atomic_dec( &dev->buf_alloc );
 615                 return -ENOMEM;
 616         }
 617         memset( entry->buflist, 0, count * sizeof(*entry->buflist) );
 618
 619         entry->seglist = drm_alloc( count * sizeof(*entry->seglist),
 620                                     DRM_MEM_SEGS );
 621         if ( !entry->seglist ) {
 622                 drm_free( entry->buflist,
 623                           count * sizeof(*entry->buflist),
 624                           DRM_MEM_BUFS );
 625                 up( &dev->struct_sem );
 626                 atomic_dec( &dev->buf_alloc );
 627                 return -ENOMEM;
 628         }
 629         memset( entry->seglist, 0, count * sizeof(*entry->seglist) );
 630
 631         /* Keep the original pagelist until we know all the allocations
 632          * have succeeded
 633          */
 634         temp_pagelist = drm_alloc( (dma->page_count + (count << page_order))
 635                                     * sizeof(*dma->pagelist),
 636                                     DRM_MEM_PAGES );
 637         if (!temp_pagelist) {
 638                 drm_free( entry->buflist,
 639                            count * sizeof(*entry->buflist),
 640                            DRM_MEM_BUFS );
 641                 drm_free( entry->seglist,
 642                            count * sizeof(*entry->seglist),
 643                            DRM_MEM_SEGS );
 644                 up( &dev->struct_sem );
 645                 atomic_dec( &dev->buf_alloc );
 646                 return -ENOMEM;
 647         }
 648         memcpy(temp_pagelist,
 649                dma->pagelist,
 650                dma->page_count * sizeof(*dma->pagelist));
 651         DRM_DEBUG( "pagelist: %d entries\n",
 652                    dma->page_count + (count << page_order) );
 653
 654         entry->buf_size = size;
 655         entry->page_order = page_order;
 656         byte_count = 0;
 657         page_count = 0;
 658
 659         while ( entry->buf_count < count ) {
 660                 page = drm_alloc_pages( page_order, DRM_MEM_DMA );
 661                 if ( !page ) {
 662                         /* Set count correctly so we free the proper amount. */
 663                         entry->buf_count = count;
 664                         entry->seg_count = count;
 665                         drm_cleanup_buf_error(dev, entry);
 666                         drm_free( temp_pagelist,
 667                                    (dma->page_count + (count << page_order))
 668                                    * sizeof(*dma->pagelist),
 669                                    DRM_MEM_PAGES );
 670                         up( &dev->struct_sem );
 671                         atomic_dec( &dev->buf_alloc );
 672                         return -ENOMEM;
 673                 }
 674                 entry->seglist[entry->seg_count++] = page;
 675                 for ( i = 0 ; i < (1 << page_order) ; i++ ) {
 676                         DRM_DEBUG( "page %d @ 0x%08lx\n",
 677                                    dma->page_count + page_count,
 678                                    page + PAGE_SIZE * i );
 679                         temp_pagelist[dma->page_count + page_count++]
 680                                 = page + PAGE_SIZE * i;
 681                 }
 682                 for ( offset = 0 ;
 683                       offset + size <= total && entry->buf_count < count ;
 684                       offset += alignment, ++entry->buf_count ) {
 685                         buf          = &entry->buflist[entry->buf_count];
 686                         buf->idx     = dma->buf_count + entry->buf_count;
 687                         buf->total   = alignment;
 688                         buf->order   = order;
 689                         buf->used    = 0;
 690                         buf->offset  = (dma->byte_count + byte_count + offset);
 691                         buf->address = (void *)(page + offset);
 692                         buf->next    = NULL;
 693                         buf->waiting = 0;
 694                         buf->pending = 0;
 695                         init_waitqueue_head( &buf->dma_wait );
 696                         buf->filp    = NULL;
 697
 698                         buf->dev_priv_size = dev->driver->dev_priv_size;
 699                         buf->dev_private = drm_alloc( buf->dev_priv_size,
 700                                                        DRM_MEM_BUFS );
 701                         if(!buf->dev_private) {
 702                                 /* Set count correctly so we free the proper amount. */
 703                                 entry->buf_count = count;
 704                                 entry->seg_count = count;
 705                                 drm_cleanup_buf_error(dev,entry);
 706                                 drm_free( temp_pagelist,
 707                                            (dma->page_count + (count << page_order))
 708                                            * sizeof(*dma->pagelist),
 709                                            DRM_MEM_PAGES );
 710                                 up( &dev->struct_sem );
 711                                 atomic_dec( &dev->buf_alloc );
 712                                 return -ENOMEM;
 713                         }
 714                         memset( buf->dev_private, 0, buf->dev_priv_size );
 715
 716                         DRM_DEBUG( "buffer %d @ %p\n",
 717                                    entry->buf_count, buf->address );
 718                 }
 719                 byte_count += PAGE_SIZE << page_order;
 720         }
 721
 722         temp_buflist = drm_realloc( dma->buflist,
 723                                      dma->buf_count * sizeof(*dma->buflist),
 724                                      (dma->buf_count + entry->buf_count)
 725                                      * sizeof(*dma->buflist),
 726                                      DRM_MEM_BUFS );
 727         if (!temp_buflist) {
 728                 /* Free the entry because it isn't valid */
 729                 drm_cleanup_buf_error(dev,entry);
 730                 drm_free( temp_pagelist,
 731                            (dma->page_count + (count << page_order))
 732                            * sizeof(*dma->pagelist),
 733                            DRM_MEM_PAGES );
 734                 up( &dev->struct_sem );
 735                 atomic_dec( &dev->buf_alloc );
 736                 return -ENOMEM;
 737         }
 738         dma->buflist = temp_buflist;
 739
 740         for ( i = 0 ; i < entry->buf_count ; i++ ) {
 741                 dma->buflist[i + dma->buf_count] = &entry->buflist[i];
 742         }
 743
 744         /* No allocations failed, so now we can replace the orginal pagelist
 745          * with the new one.
 746          */
 747         if (dma->page_count) {
 748                 drm_free(dma->pagelist,
 749                           dma->page_count * sizeof(*dma->pagelist),
 750                           DRM_MEM_PAGES);
 751         }
 752         dma->pagelist = temp_pagelist;
 753
 754         dma->buf_count += entry->buf_count;
 755         dma->seg_count += entry->seg_count;
 756         dma->page_count += entry->seg_count << page_order;
 757         dma->byte_count += PAGE_SIZE * (entry->seg_count << page_order);
 758
 759         up( &dev->struct_sem );
 760
 761         request.count = entry->buf_count;
 762         request.size = size;
 763
 764         if ( copy_to_user( argp, &request, sizeof(request) ) )
 765                 return -EFAULT;
 766
 767         atomic_dec( &dev->buf_alloc );
 768         return 0;
 769
 770 }
 771
 772 static int drm_addbufs_sg( struct inode *inode, struct file *filp,
 773                            unsigned int cmd, unsigned long arg )
 774 {
 775         drm_file_t *priv = filp->private_data;
 776         drm_device_t *dev = priv->head->dev;
 777         drm_device_dma_t *dma = dev->dma;
 778         drm_buf_desc_t __user *argp = (void __user *)arg;
 779         drm_buf_desc_t request;
 780         drm_buf_entry_t *entry;
 781         drm_buf_t *buf;
 782         unsigned long offset;
 783         unsigned long agp_offset;
 784         int count;
 785         int order;
 786         int size;
 787         int alignment;
 788         int page_order;
 789         int total;
 790         int byte_count;
 791         int i;
 792         drm_buf_t **temp_buflist;
 793
 794         if (!drm_core_check_feature(dev, DRIVER_SG)) return -EINVAL;
 795
 796         if ( !dma ) return -EINVAL;
 797
 798         if ( copy_from_user( &request, argp, sizeof(request) ) )
 799                 return -EFAULT;
 800
 801         count = request.count;
 802         order = drm_order( request.size );
 803         size = 1 << order;
 804
 805         alignment  = (request.flags & _DRM_PAGE_ALIGN)
 806                         ? PAGE_ALIGN(size) : size;
 807         page_order = order - PAGE_SHIFT > 0 ? order - PAGE_SHIFT : 0;
 808         total = PAGE_SIZE << page_order;
 809
 810         byte_count = 0;
 811         agp_offset = request.agp_start;
 812
 813         DRM_DEBUG( "count:      %d\n",  count );
 814         DRM_DEBUG( "order:      %d\n",  order );
 815         DRM_DEBUG( "size:       %d\n",  size );
 816         DRM_DEBUG( "agp_offset: %lu\n", agp_offset );
 817         DRM_DEBUG( "alignment:  %d\n",  alignment );
 818         DRM_DEBUG( "page_order: %d\n",  page_order );
 819         DRM_DEBUG( "total:      %d\n",  total );
 820
 821         if ( order < DRM_MIN_ORDER || order > DRM_MAX_ORDER ) return -EINVAL;
 822         if ( dev->queue_count ) return -EBUSY; /* Not while in use */
 823
 824         spin_lock( &dev->count_lock );
 825         if ( dev->buf_use ) {
 826                 spin_unlock( &dev->count_lock );
 827                 return -EBUSY;
 828         }
 829         atomic_inc( &dev->buf_alloc );
 830         spin_unlock( &dev->count_lock );
 831
 832         down( &dev->struct_sem );
 833         entry = &dma->bufs[order];
 834         if ( entry->buf_count ) {
 835                 up( &dev->struct_sem );
 836                 atomic_dec( &dev->buf_alloc );
 837                 return -ENOMEM; /* May only call once for each order */
 838         }
 839
 840         if (count < 0 || count > 4096) {
 841                 up( &dev->struct_sem );
 842                 atomic_dec( &dev->buf_alloc );
 843                 return -EINVAL;
 844         }
 845
 846         entry->buflist = drm_alloc( count * sizeof(*entry->buflist),
 847                                      DRM_MEM_BUFS );
 848         if ( !entry->buflist ) {
 849                 up( &dev->struct_sem );
 850                 atomic_dec( &dev->buf_alloc );
 851                 return -ENOMEM;
 852         }
 853         memset( entry->buflist, 0, count * sizeof(*entry->buflist) );
 854
 855         entry->buf_size = size;
 856         entry->page_order = page_order;
 857
 858         offset = 0;
 859
 860         while ( entry->buf_count < count ) {
 861                 buf          = &entry->buflist[entry->buf_count];
 862                 buf->idx     = dma->buf_count + entry->buf_count;
 863                 buf->total   = alignment;
 864                 buf->order   = order;
 865                 buf->used    = 0;
 866
 867                 buf->offset  = (dma->byte_count + offset);
 868                 buf->bus_address = agp_offset + offset;
 869                 buf->address = (void *)(agp_offset + offset + dev->sg->handle);
 870                 buf->next    = NULL;
 871                 buf->waiting = 0;
 872                 buf->pending = 0;
 873                 init_waitqueue_head( &buf->dma_wait );
 874                 buf->filp    = NULL;
 875
 876                 buf->dev_priv_size = dev->driver->dev_priv_size;
 877                 buf->dev_private = drm_alloc( buf->dev_priv_size,
 878                                                DRM_MEM_BUFS );
 879                 if(!buf->dev_private) {
 880                         /* Set count correctly so we free the proper amount. */
 881                         entry->buf_count = count;
 882                         drm_cleanup_buf_error(dev,entry);
 883                         up( &dev->struct_sem );
 884                         atomic_dec( &dev->buf_alloc );
 885                         return -ENOMEM;
 886                 }
 887
 888                 memset( buf->dev_private, 0, buf->dev_priv_size );
 889
 890                 DRM_DEBUG( "buffer %d @ %p\n",
 891                            entry->buf_count, buf->address );
 892
 893                 offset += alignment;
 894                 entry->buf_count++;
 895                 byte_count += PAGE_SIZE << page_order;
 896         }
 897
 898         DRM_DEBUG( "byte_count: %d\n", byte_count );
 899
 900         temp_buflist = drm_realloc( dma->buflist,
 901                                      dma->buf_count * sizeof(*dma->buflist),
 902                                      (dma->buf_count + entry->buf_count)
 903                                      * sizeof(*dma->buflist),
 904                                      DRM_MEM_BUFS );
 905         if(!temp_buflist) {
 906                 /* Free the entry because it isn't valid */
 907                 drm_cleanup_buf_error(dev,entry);
 908                 up( &dev->struct_sem );
 909                 atomic_dec( &dev->buf_alloc );
 910                 return -ENOMEM;
 911         }
 912         dma->buflist = temp_buflist;
 913
 914         for ( i = 0 ; i < entry->buf_count ; i++ ) {
 915                 dma->buflist[i + dma->buf_count] = &entry->buflist[i];
 916         }
 917
 918         dma->buf_count += entry->buf_count;
 919         dma->byte_count += byte_count;
 920
 921         DRM_DEBUG( "dma->buf_count : %d\n", dma->buf_count );
 922         DRM_DEBUG( "entry->buf_count : %d\n", entry->buf_count );
 923
 924         up( &dev->struct_sem );
 925
 926         request.count = entry->buf_count;
 927         request.size = size;
 928
 929         if ( copy_to_user( argp, &request, sizeof(request) ) )
 930                 return -EFAULT;
 931
 932         dma->flags = _DRM_DMA_USE_SG;
 933
 934         atomic_dec( &dev->buf_alloc );
 935         return 0;
 936 }
 937
 938 int drm_addbufs_fb(struct inode *inode, struct file *filp,
 939                     unsigned int cmd, unsigned long arg)
 940 {
 941         drm_file_t *priv = filp->private_data;
 942         drm_device_t *dev = priv->head->dev;
 943         drm_device_dma_t *dma = dev->dma;
 944         drm_buf_desc_t request;
 945         drm_buf_entry_t *entry;
 946         drm_buf_t *buf;
 947         unsigned long offset;
 948         unsigned long agp_offset;
 949         int count;
 950         int order;
 951         int size;
 952         int alignment;
 953         int page_order;
 954         int total;
 955         int byte_count;
 956         int i;
 957         drm_buf_t **temp_buflist;
 958         drm_buf_desc_t __user *argp = (void __user *)arg;
 959
 960         if (!drm_core_check_feature(dev, DRIVER_FB_DMA))
 961                 return -EINVAL;
 962
 963         if (!dma)
 964                 return -EINVAL;
 965
 966         if (copy_from_user(&request, argp, sizeof(request)))
 967                 return -EFAULT;
 968
 969         count = request.count;
 970         order = drm_order(request.size);
 971         size = 1 << order;
 972
 973         alignment = (request.flags & _DRM_PAGE_ALIGN)
 974             ? PAGE_ALIGN(size) : size;
 975         page_order = order - PAGE_SHIFT > 0 ? order - PAGE_SHIFT : 0;
 976         total = PAGE_SIZE << page_order;
 977
 978         byte_count = 0;
 979         agp_offset = request.agp_start;
 980
 981         DRM_DEBUG("count:      %d\n", count);
 982         DRM_DEBUG("order:      %d\n", order);
 983         DRM_DEBUG("size:       %d\n", size);
 984         DRM_DEBUG("agp_offset: %lu\n", agp_offset);
 985         DRM_DEBUG("alignment:  %d\n", alignment);
 986         DRM_DEBUG("page_order: %d\n", page_order);
 987         DRM_DEBUG("total:      %d\n", total);
 988
 989         if (order < DRM_MIN_ORDER || order > DRM_MAX_ORDER)
 990                 return -EINVAL;
 991         if (dev->queue_count)
 992                 return -EBUSY;  /* Not while in use */
 993
 994         spin_lock(&dev->count_lock);
 995         if (dev->buf_use) {
 996                 spin_unlock(&dev->count_lock);
 997                 return -EBUSY;
 998         }
 999         atomic_inc(&dev->buf_alloc);
1000         spin_unlock(&dev->count_lock);
1001
1002         down(&dev->struct_sem);
1003         entry = &dma->bufs[order];
1004         if (entry->buf_count) {
1005                 up(&dev->struct_sem);
1006                 atomic_dec(&dev->buf_alloc);
1007                 return -ENOMEM; /* May only call once for each order */
1008         }
1009
1010         if (count < 0 || count > 4096) {
1011                 up(&dev->struct_sem);
1012                 atomic_dec(&dev->buf_alloc);
1013                 return -EINVAL;
1014         }
1015
1016         entry->buflist = drm_alloc(count * sizeof(*entry->buflist),
1017                                    DRM_MEM_BUFS);
1018         if (!entry->buflist) {
1019                 up(&dev->struct_sem);
1020                 atomic_dec(&dev->buf_alloc);
1021                 return -ENOMEM;
1022         }
1023         memset(entry->buflist, 0, count * sizeof(*entry->buflist));
1024
1025         entry->buf_size = size;
1026         entry->page_order = page_order;
1027
1028         offset = 0;
1029
1030         while (entry->buf_count < count) {
1031                 buf = &entry->buflist[entry->buf_count];
1032                 buf->idx = dma->buf_count + entry->buf_count;
1033                 buf->total = alignment;
1034                 buf->order = order;
1035                 buf->used = 0;
1036
1037                 buf->offset = (dma->byte_count + offset);
1038                 buf->bus_address = agp_offset + offset;
1039                 buf->address = (void *)(agp_offset + offset);
1040                 buf->next = NULL;
1041                 buf->waiting = 0;
1042                 buf->pending = 0;
1043                 init_waitqueue_head(&buf->dma_wait);
1044                 buf->filp = NULL;
1045
1046                 buf->dev_priv_size = dev->driver->dev_priv_size;
1047                 buf->dev_private = drm_alloc(buf->dev_priv_size, DRM_MEM_BUFS);
1048                 if (!buf->dev_private) {
1049                         /* Set count correctly so we free the proper amount. */
1050                         entry->buf_count = count;
1051                         drm_cleanup_buf_error(dev, entry);
1052                         up(&dev->struct_sem);
1053                         atomic_dec(&dev->buf_alloc);
1054                         return -ENOMEM;
1055                 }
1056                 memset(buf->dev_private, 0, buf->dev_priv_size);
1057
1058                 DRM_DEBUG("buffer %d @ %p\n", entry->buf_count, buf->address);
1059
1060                 offset += alignment;
1061                 entry->buf_count++;
1062                 byte_count += PAGE_SIZE << page_order;
1063         }
1064
1065         DRM_DEBUG("byte_count: %d\n", byte_count);
1066
1067         temp_buflist = drm_realloc(dma->buflist,
1068                                    dma->buf_count * sizeof(*dma->buflist),
1069                                    (dma->buf_count + entry->buf_count)
1070                                    * sizeof(*dma->buflist), DRM_MEM_BUFS);
1071         if (!temp_buflist) {
1072                 /* Free the entry because it isn't valid */
1073                 drm_cleanup_buf_error(dev, entry);
1074                 up(&dev->struct_sem);
1075                 atomic_dec(&dev->buf_alloc);
1076                 return -ENOMEM;
1077         }
1078         dma->buflist = temp_buflist;
1079
1080         for (i = 0; i < entry->buf_count; i++) {
1081                 dma->buflist[i + dma->buf_count] = &entry->buflist[i];
1082         }
1083
1084         dma->buf_count += entry->buf_count;
1085         dma->byte_count += byte_count;
1086
1087         DRM_DEBUG("dma->buf_count : %d\n", dma->buf_count);
1088         DRM_DEBUG("entry->buf_count : %d\n", entry->buf_count);
1089
1090         up(&dev->struct_sem);
1091
1092         request.count = entry->buf_count;
1093         request.size = size;
1094
1095         if (copy_to_user(argp, &request, sizeof(request)))
1096                 return -EFAULT;
1097
1098         dma->flags = _DRM_DMA_USE_FB;
1099
1100         atomic_dec(&dev->buf_alloc);
1101         return 0;
1102 }
1103
1104 /**
1105  * Add buffers for DMA transfers (ioctl).
1106  *
1107  * \param inode device inode.
1108  * \param filp file pointer.
1109  * \param cmd command.
1110  * \param arg pointer to a drm_buf_desc_t request.
1111  * \return zero on success or a negative number on failure.
1112  *
1113  * According with the memory type specified in drm_buf_desc::flags and the
1114  * build options, it dispatches the call either to addbufs_agp(),
1115  * addbufs_sg() or addbufs_pci() for AGP, scatter-gather or consistent
1116  * PCI memory respectively.
1117  */
1118 int drm_addbufs( struct inode *inode, struct file *filp,
1119                   unsigned int cmd, unsigned long arg )
1120 {
1121         drm_buf_desc_t request;
1122         drm_file_t *priv = filp->private_data;
1123         drm_device_t *dev = priv->head->dev;
1124
1125         if (!drm_core_check_feature(dev, DRIVER_HAVE_DMA))
1126                 return -EINVAL;
1127
1128         if ( copy_from_user( &request, (drm_buf_desc_t __user *)arg,
1129                              sizeof(request) ) )
1130                 return -EFAULT;
1131
1132 #if __OS_HAS_AGP
1133         if ( request.flags & _DRM_AGP_BUFFER )
1134                 return drm_addbufs_agp( inode, filp, cmd, arg );
1135         else
1136 #endif
1137         if ( request.flags & _DRM_SG_BUFFER )
1138                 return drm_addbufs_sg( inode, filp, cmd, arg );
1139         else if ( request.flags & _DRM_FB_BUFFER)
1140                 return drm_addbufs_fb( inode, filp, cmd, arg );
1141         else
1142                 return drm_addbufs_pci( inode, filp, cmd, arg );
1143 }
1144
1145
1146 /**
1147  * Get information about the buffer mappings.
1148  *
1149  * This was originally mean for debugging purposes, or by a sophisticated
1150  * client library to determine how best to use the available buffers (e.g.,
1151  * large buffers can be used for image transfer).
1152  *
1153  * \param inode device inode.
1154  * \param filp file pointer.
1155  * \param cmd command.
1156  * \param arg pointer to a drm_buf_info structure.
1157  * \return zero on success or a negative number on failure.
1158  *
1159  * Increments drm_device::buf_use while holding the drm_device::count_lock
1160  * lock, preventing of allocating more buffers after this call. Information
1161  * about each requested buffer is then copied into user space.
1162  */
1163 int drm_infobufs( struct inode *inode, struct file *filp,
1164                    unsigned int cmd, unsigned long arg )
1165 {
1166         drm_file_t *priv = filp->private_data;
1167         drm_device_t *dev = priv->head->dev;
1168         drm_device_dma_t *dma = dev->dma;
1169         drm_buf_info_t request;
1170         drm_buf_info_t __user *argp = (void __user *)arg;
1171         int i;
1172         int count;
1173
1174         if (!drm_core_check_feature(dev, DRIVER_HAVE_DMA))
1175                 return -EINVAL;
1176
1177         if ( !dma ) return -EINVAL;
1178
1179         spin_lock( &dev->count_lock );
1180         if ( atomic_read( &dev->buf_alloc ) ) {
1181                 spin_unlock( &dev->count_lock );
1182                 return -EBUSY;
1183         }
1184         ++dev->buf_use;         /* Can't allocate more after this call */
1185         spin_unlock( &dev->count_lock );
1186
1187         if ( copy_from_user( &request, argp, sizeof(request) ) )
1188                 return -EFAULT;
1189
1190         for ( i = 0, count = 0 ; i < DRM_MAX_ORDER + 1 ; i++ ) {
1191                 if ( dma->bufs[i].buf_count ) ++count;
1192         }
1193
1194         DRM_DEBUG( "count = %d\n", count );
1195
1196         if ( request.count >= count ) {
1197                 for ( i = 0, count = 0 ; i < DRM_MAX_ORDER + 1 ; i++ ) {
1198                         if ( dma->bufs[i].buf_count ) {
1199                                 drm_buf_desc_t __user *to = &request.list[count];
1200                                 drm_buf_entry_t *from = &dma->bufs[i];
1201                                 drm_freelist_t *list = &dma->bufs[i].freelist;
1202                                 if ( copy_to_user( &to->count,
1203                                                    &from->buf_count,
1204                                                    sizeof(from->buf_count) ) ||
1205                                      copy_to_user( &to->size,
1206                                                    &from->buf_size,
1207                                                    sizeof(from->buf_size) ) ||
1208                                      copy_to_user( &to->low_mark,
1209                                                    &list->low_mark,
1210                                                    sizeof(list->low_mark) ) ||
1211                                      copy_to_user( &to->high_mark,
1212                                                    &list->high_mark,
1213                                                    sizeof(list->high_mark) ) )
1214                                         return -EFAULT;
1215
1216                                 DRM_DEBUG( "%d %d %d %d %d\n",
1217                                            i,
1218                                            dma->bufs[i].buf_count,
1219                                            dma->bufs[i].buf_size,
1220                                            dma->bufs[i].freelist.low_mark,
1221                                            dma->bufs[i].freelist.high_mark );
1222                                 ++count;
1223                         }
1224                 }
1225         }
1226         request.count = count;
1227
1228         if ( copy_to_user( argp, &request, sizeof(request) ) )
1229                 return -EFAULT;
1230
1231         return 0;
1232 }
1233
1234 /**
1235  * Specifies a low and high water mark for buffer allocation
1236  *
1237  * \param inode device inode.
1238  * \param filp file pointer.
1239  * \param cmd command.
1240  * \param arg a pointer to a drm_buf_desc structure.
1241  * \return zero on success or a negative number on failure.
1242  *
1243  * Verifies that the size order is bounded between the admissible orders and
1244  * updates the respective drm_device_dma::bufs entry low and high water mark.
1245  *
1246  * \note This ioctl is deprecated and mostly never used.
1247  */
1248 int drm_markbufs( struct inode *inode, struct file *filp,
1249                    unsigned int cmd, unsigned long arg )
1250 {
1251         drm_file_t *priv = filp->private_data;
1252         drm_device_t *dev = priv->head->dev;
1253         drm_device_dma_t *dma = dev->dma;
1254         drm_buf_desc_t request;
1255         int order;
1256         drm_buf_entry_t *entry;
1257
1258         if (!drm_core_check_feature(dev, DRIVER_HAVE_DMA))
1259                 return -EINVAL;
1260
1261         if ( !dma ) return -EINVAL;
1262
1263         if ( copy_from_user( &request,
1264                              (drm_buf_desc_t __user *)arg,
1265                              sizeof(request) ) )
1266                 return -EFAULT;
1267
1268         DRM_DEBUG( "%d, %d, %d\n",
1269                    request.size, request.low_mark, request.high_mark );
1270         order = drm_order( request.size );
1271         if ( order < DRM_MIN_ORDER || order > DRM_MAX_ORDER ) return -EINVAL;
1272         entry = &dma->bufs[order];
1273
1274         if ( request.low_mark < 0 || request.low_mark > entry->buf_count )
1275                 return -EINVAL;
1276         if ( request.high_mark < 0 || request.high_mark > entry->buf_count )
1277                 return -EINVAL;
1278
1279         entry->freelist.low_mark  = request.low_mark;
1280         entry->freelist.high_mark = request.high_mark;
1281
1282         return 0;
1283 }
1284
1285 /**
1286  * Unreserve the buffers in list, previously reserved using drmDMA.
1287  *
1288  * \param inode device inode.
1289  * \param filp file pointer.
1290  * \param cmd command.
1291  * \param arg pointer to a drm_buf_free structure.
1292  * \return zero on success or a negative number on failure.
1293  *
1294  * Calls free_buffer() for each used buffer.
1295  * This function is primarily used for debugging.
1296  */
1297 int drm_freebufs( struct inode *inode, struct file *filp,
1298                    unsigned int cmd, unsigned long arg )
1299 {
1300         drm_file_t *priv = filp->private_data;
1301         drm_device_t *dev = priv->head->dev;
1302         drm_device_dma_t *dma = dev->dma;
1303         drm_buf_free_t request;
1304         int i;
1305         int idx;
1306         drm_buf_t *buf;
1307
1308         if (!drm_core_check_feature(dev, DRIVER_HAVE_DMA))
1309                 return -EINVAL;
1310
1311         if ( !dma ) return -EINVAL;
1312
1313         if ( copy_from_user( &request,
1314                              (drm_buf_free_t __user *)arg,
1315                              sizeof(request) ) )
1316                 return -EFAULT;
1317
1318         DRM_DEBUG( "%d\n", request.count );
1319         for ( i = 0 ; i < request.count ; i++ ) {
1320                 if ( copy_from_user( &idx,
1321                                      &request.list[i],
1322                                      sizeof(idx) ) )
1323                         return -EFAULT;
1324                 if ( idx < 0 || idx >= dma->buf_count ) {
1325                         DRM_ERROR( "Index %d (of %d max)\n",
1326                                    idx, dma->buf_count - 1 );
1327                         return -EINVAL;
1328                 }
1329                 buf = dma->buflist[idx];
1330                 if ( buf->filp != filp ) {
1331                         DRM_ERROR( "Process %d freeing buffer not owned\n",
1332                                    current->pid );
1333                         return -EINVAL;
1334                 }
1335                 drm_free_buffer( dev, buf );
1336         }
1337
1338         return 0;
1339 }
1340
1341 /**
1342  * Maps all of the DMA buffers into client-virtual space (ioctl).
1343  *
1344  * \param inode device inode.
1345  * \param filp file pointer.
1346  * \param cmd command.
1347  * \param arg pointer to a drm_buf_map structure.
1348  * \return zero on success or a negative number on failure.
1349  *
1350  * Maps the AGP or SG buffer region with do_mmap(), and copies information
1351  * about each buffer into user space. The PCI buffers are already mapped on the
1352  * addbufs_pci() call.
1353  */
1354 int drm_mapbufs( struct inode *inode, struct file *filp,
1355                   unsigned int cmd, unsigned long arg )
1356 {
1357         drm_file_t *priv = filp->private_data;
1358         drm_device_t *dev = priv->head->dev;
1359         drm_device_dma_t *dma = dev->dma;
1360         drm_buf_map_t __user *argp = (void __user *)arg;
1361         int retcode = 0;
1362         const int zero = 0;
1363         unsigned long virtual;
1364         unsigned long address;
1365         drm_buf_map_t request;
1366         int i;
1367
1368         if (!drm_core_check_feature(dev, DRIVER_HAVE_DMA))
1369                 return -EINVAL;
1370
1371         if ( !dma ) return -EINVAL;
1372
1373         spin_lock( &dev->count_lock );
1374         if ( atomic_read( &dev->buf_alloc ) ) {
1375                 spin_unlock( &dev->count_lock );
1376                 return -EBUSY;
1377         }
1378         dev->buf_use++;         /* Can't allocate more after this call */
1379         spin_unlock( &dev->count_lock );
1380
1381         if ( copy_from_user( &request, argp, sizeof(request) ) )
1382                 return -EFAULT;
1383
1384         if ( request.count >= dma->buf_count ) {
1385                 if ((drm_core_has_AGP(dev) && (dma->flags & _DRM_DMA_USE_AGP))
1386                     || (drm_core_check_feature(dev, DRIVER_SG)
1387                         && (dma->flags & _DRM_DMA_USE_SG))
1388                     || (drm_core_check_feature(dev, DRIVER_FB_DMA)
1389                         && (dma->flags & _DRM_DMA_USE_FB))) {
1390                         drm_map_t *map = dev->agp_buffer_map;
1391
1392                         if ( !map ) {
1393                                 retcode = -EINVAL;
1394                                 goto done;
1395                         }
1396
1397 #if LINUX_VERSION_CODE <= 0x020402
1398                         down( &current->mm->mmap_sem );
1399 #else
1400                         down_write( &current->mm->mmap_sem );
1401 #endif
1402                         virtual = do_mmap( filp, 0, map->size,
1403                                            PROT_READ | PROT_WRITE,
1404                                            MAP_SHARED,
1405                                            (unsigned long)map->offset );
1406 #if LINUX_VERSION_CODE <= 0x020402
1407                         up( &current->mm->mmap_sem );
1408 #else
1409                         up_write( &current->mm->mmap_sem );
1410 #endif
1411                 } else {
1412 #if LINUX_VERSION_CODE <= 0x020402
1413                         down( &current->mm->mmap_sem );
1414 #else
1415                         down_write( &current->mm->mmap_sem );
1416 #endif
1417                         virtual = do_mmap( filp, 0, dma->byte_count,
1418                                            PROT_READ | PROT_WRITE,
1419                                            MAP_SHARED, 0 );
1420 #if LINUX_VERSION_CODE <= 0x020402
1421                         up( &current->mm->mmap_sem );
1422 #else
1423                         up_write( &current->mm->mmap_sem );
1424 #endif
1425                 }
1426                 if ( virtual > -1024UL ) {
1427                         /* Real error */
1428                         retcode = (signed long)virtual;
1429                         goto done;
1430                 }
1431                 request.virtual = (void __user *)virtual;
1432
1433                 for ( i = 0 ; i < dma->buf_count ; i++ ) {
1434                         if ( copy_to_user( &request.list[i].idx,
1435                                            &dma->buflist[i]->idx,
1436                                            sizeof(request.list[0].idx) ) ) {
1437                                 retcode = -EFAULT;
1438                                 goto done;
1439                         }
1440                         if ( copy_to_user( &request.list[i].total,
1441                                            &dma->buflist[i]->total,
1442                                            sizeof(request.list[0].total) ) ) {
1443                                 retcode = -EFAULT;
1444                                 goto done;
1445                         }
1446                         if ( copy_to_user( &request.list[i].used,
1447                                            &zero,
1448                                            sizeof(zero) ) ) {
1449                                 retcode = -EFAULT;
1450                                 goto done;
1451                         }
1452                         address = virtual + dma->buflist[i]->offset; /* *** */
1453                         if ( copy_to_user( &request.list[i].address,
1454                                            &address,
1455                                            sizeof(address) ) ) {
1456                                 retcode = -EFAULT;
1457                                 goto done;
1458                         }
1459                 }
1460         }
1461  done:
1462         request.count = dma->buf_count;
1463         DRM_DEBUG( "%d buffers, retcode = %d\n", request.count, retcode );
1464
1465         if ( copy_to_user( argp, &request, sizeof(request) ) )
1466                 return -EFAULT;
1467
1468         return retcode;
1469 }
1470