2 * Copyright (C) 2013 Red Hat
3 * Author: Rob Clark <robdclark@gmail.com>
5 * This program is free software; you can redistribute it and/or modify it
6 * under the terms of the GNU General Public License version 2 as published by
7 * the Free Software Foundation.
9 * This program is distributed in the hope that it will be useful, but WITHOUT
10 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
14 * You should have received a copy of the GNU General Public License along with
15 * this program. If not, see <http://www.gnu.org/licenses/>.
23 * Cmdstream submission:
26 #define BO_INVALID_FLAGS ~(MSM_SUBMIT_BO_READ | MSM_SUBMIT_BO_WRITE)
27 /* make sure these don't conflict w/ MSM_SUBMIT_BO_x */
28 #define BO_VALID 0x8000
29 #define BO_LOCKED 0x4000
30 #define BO_PINNED 0x2000
32 static inline void __user *to_user_ptr(u64 address)
34 return (void __user *)(uintptr_t)address;
37 static struct msm_gem_submit *submit_create(struct drm_device *dev,
38 struct msm_gpu *gpu, int nr)
40 struct msm_gem_submit *submit;
41 int sz = sizeof(*submit) + (nr * sizeof(submit->bos[0]));
43 submit = kmalloc(sz, GFP_TEMPORARY | __GFP_NOWARN | __GFP_NORETRY);
48 /* initially, until copy_from_user() and bo lookup succeeds: */
52 INIT_LIST_HEAD(&submit->bo_list);
53 ww_acquire_init(&submit->ticket, &reservation_ww_class);
59 static int submit_lookup_objects(struct msm_gem_submit *submit,
60 struct drm_msm_gem_submit *args, struct drm_file *file)
65 spin_lock(&file->table_lock);
67 for (i = 0; i < args->nr_bos; i++) {
68 struct drm_msm_gem_submit_bo submit_bo;
69 struct drm_gem_object *obj;
70 struct msm_gem_object *msm_obj;
71 void __user *userptr =
72 to_user_ptr(args->bos + (i * sizeof(submit_bo)));
74 ret = copy_from_user(&submit_bo, userptr, sizeof(submit_bo));
80 if (submit_bo.flags & BO_INVALID_FLAGS) {
81 DBG("invalid flags: %x", submit_bo.flags);
86 submit->bos[i].flags = submit_bo.flags;
87 /* in validate_objects() we figure out if this is true: */
88 submit->bos[i].iova = submit_bo.presumed;
90 /* normally use drm_gem_object_lookup(), but for bulk lookup
91 * all under single table_lock just hit object_idr directly:
93 obj = idr_find(&file->object_idr, submit_bo.handle);
95 DBG("invalid handle %u at index %u", submit_bo.handle, i);
100 msm_obj = to_msm_bo(obj);
102 if (!list_empty(&msm_obj->submit_entry)) {
103 DBG("handle %u at index %u already on submit list",
104 submit_bo.handle, i);
109 drm_gem_object_reference(obj);
111 submit->bos[i].obj = msm_obj;
113 list_add_tail(&msm_obj->submit_entry, &submit->bo_list);
118 spin_unlock(&file->table_lock);
123 static void submit_unlock_unpin_bo(struct msm_gem_submit *submit, int i)
125 struct msm_gem_object *msm_obj = submit->bos[i].obj;
127 if (submit->bos[i].flags & BO_PINNED)
128 msm_gem_put_iova(&msm_obj->base, submit->gpu->id);
130 if (submit->bos[i].flags & BO_LOCKED)
131 ww_mutex_unlock(&msm_obj->resv->lock);
133 if (!(submit->bos[i].flags & BO_VALID))
134 submit->bos[i].iova = 0;
136 submit->bos[i].flags &= ~(BO_LOCKED | BO_PINNED);
139 /* This is where we make sure all the bo's are reserved and pin'd: */
140 static int submit_validate_objects(struct msm_gem_submit *submit)
142 int contended, slow_locked = -1, i, ret = 0;
145 submit->valid = true;
147 for (i = 0; i < submit->nr_bos; i++) {
148 struct msm_gem_object *msm_obj = submit->bos[i].obj;
151 if (slow_locked == i)
156 if (!(submit->bos[i].flags & BO_LOCKED)) {
157 ret = ww_mutex_lock_interruptible(&msm_obj->resv->lock,
161 submit->bos[i].flags |= BO_LOCKED;
165 /* if locking succeeded, pin bo: */
166 ret = msm_gem_get_iova(&msm_obj->base,
167 submit->gpu->id, &iova);
169 /* this would break the logic in the fail path.. there is no
170 * reason for this to happen, but just to be on the safe side
171 * let's notice if this starts happening in the future:
173 WARN_ON(ret == -EDEADLK);
178 submit->bos[i].flags |= BO_PINNED;
180 if (iova == submit->bos[i].iova) {
181 submit->bos[i].flags |= BO_VALID;
183 submit->bos[i].iova = iova;
184 submit->bos[i].flags &= ~BO_VALID;
185 submit->valid = false;
189 ww_acquire_done(&submit->ticket);
195 submit_unlock_unpin_bo(submit, i);
198 submit_unlock_unpin_bo(submit, slow_locked);
200 if (ret == -EDEADLK) {
201 struct msm_gem_object *msm_obj = submit->bos[contended].obj;
202 /* we lost out in a seqno race, lock and retry.. */
203 ret = ww_mutex_lock_slow_interruptible(&msm_obj->resv->lock,
206 submit->bos[contended].flags |= BO_LOCKED;
207 slow_locked = contended;
215 static int submit_bo(struct msm_gem_submit *submit, uint32_t idx,
216 struct msm_gem_object **obj, uint32_t *iova, bool *valid)
218 if (idx >= submit->nr_bos) {
219 DBG("invalid buffer index: %u (out of %u)", idx, submit->nr_bos);
224 *obj = submit->bos[idx].obj;
226 *iova = submit->bos[idx].iova;
228 *valid = !!(submit->bos[idx].flags & BO_VALID);
233 /* process the reloc's and patch up the cmdstream as needed: */
234 static int submit_reloc(struct msm_gem_submit *submit, struct msm_gem_object *obj,
235 uint32_t offset, uint32_t nr_relocs, uint64_t relocs)
237 uint32_t i, last_offset = 0;
242 DBG("non-aligned cmdstream buffer: %u", offset);
246 /* For now, just map the entire thing. Eventually we probably
247 * to do it page-by-page, w/ kmap() if not vmap()d..
249 ptr = msm_gem_vaddr(&obj->base);
253 DBG("failed to map: %d", ret);
257 for (i = 0; i < nr_relocs; i++) {
258 struct drm_msm_gem_submit_reloc submit_reloc;
259 void __user *userptr =
260 to_user_ptr(relocs + (i * sizeof(submit_reloc)));
264 ret = copy_from_user(&submit_reloc, userptr, sizeof(submit_reloc));
268 if (submit_reloc.submit_offset % 4) {
269 DBG("non-aligned reloc offset: %u",
270 submit_reloc.submit_offset);
274 /* offset in dwords: */
275 off = submit_reloc.submit_offset / 4;
277 if ((off >= (obj->base.size / 4)) ||
278 (off < last_offset)) {
279 DBG("invalid offset %u at reloc %u", off, i);
283 ret = submit_bo(submit, submit_reloc.reloc_idx, NULL, &iova, &valid);
290 iova += submit_reloc.reloc_offset;
292 if (submit_reloc.shift < 0)
293 iova >>= -submit_reloc.shift;
295 iova <<= submit_reloc.shift;
297 ptr[off] = iova | submit_reloc.or;
305 static void submit_cleanup(struct msm_gem_submit *submit, bool fail)
309 mutex_lock(&submit->dev->struct_mutex);
310 for (i = 0; i < submit->nr_bos; i++) {
311 struct msm_gem_object *msm_obj = submit->bos[i].obj;
312 submit_unlock_unpin_bo(submit, i);
313 list_del_init(&msm_obj->submit_entry);
314 drm_gem_object_unreference(&msm_obj->base);
316 mutex_unlock(&submit->dev->struct_mutex);
318 ww_acquire_fini(&submit->ticket);
322 int msm_ioctl_gem_submit(struct drm_device *dev, void *data,
323 struct drm_file *file)
325 struct msm_drm_private *priv = dev->dev_private;
326 struct drm_msm_gem_submit *args = data;
327 struct msm_file_private *ctx = file->driver_priv;
328 struct msm_gem_submit *submit;
333 /* for now, we just have 3d pipe.. eventually this would need to
334 * be more clever to dispatch to appropriate gpu module:
336 if (args->pipe != MSM_PIPE_3D0)
341 if (args->nr_cmds > MAX_CMDS)
344 submit = submit_create(dev, gpu, args->nr_bos);
350 ret = submit_lookup_objects(submit, args, file);
354 ret = submit_validate_objects(submit);
358 for (i = 0; i < args->nr_cmds; i++) {
359 struct drm_msm_gem_submit_cmd submit_cmd;
360 void __user *userptr =
361 to_user_ptr(args->cmds + (i * sizeof(submit_cmd)));
362 struct msm_gem_object *msm_obj;
365 ret = copy_from_user(&submit_cmd, userptr, sizeof(submit_cmd));
371 ret = submit_bo(submit, submit_cmd.submit_idx,
372 &msm_obj, &iova, NULL);
376 if (submit_cmd.size % 4) {
377 DBG("non-aligned cmdstream buffer size: %u",
383 if (submit_cmd.size >= msm_obj->base.size) {
384 DBG("invalid cmdstream size: %u", submit_cmd.size);
389 submit->cmd[i].type = submit_cmd.type;
390 submit->cmd[i].size = submit_cmd.size / 4;
391 submit->cmd[i].iova = iova + submit_cmd.submit_offset;
396 ret = submit_reloc(submit, msm_obj, submit_cmd.submit_offset,
397 submit_cmd.nr_relocs, submit_cmd.relocs);
404 ret = msm_gpu_submit(gpu, submit, ctx);
406 args->fence = submit->fence;
410 submit_cleanup(submit, !!ret);