i915_gem.c 137 KB
Newer Older
1
/*
2
 * Copyright © 2008-2015 Intel Corporation
3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27
 *
 * Permission is hereby granted, free of charge, to any person obtaining a
 * copy of this software and associated documentation files (the "Software"),
 * to deal in the Software without restriction, including without limitation
 * the rights to use, copy, modify, merge, publish, distribute, sublicense,
 * and/or sell copies of the Software, and to permit persons to whom the
 * Software is furnished to do so, subject to the following conditions:
 *
 * The above copyright notice and this permission notice (including the next
 * paragraph) shall be included in all copies or substantial portions of the
 * Software.
 *
 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
 * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
 * IN THE SOFTWARE.
 *
 * Authors:
 *    Eric Anholt <eric@anholt.net>
 *
 */

28
#include <drm/drmP.h>
29
#include <drm/drm_vma_manager.h>
30
#include <drm/i915_drm.h>
31
#include "i915_drv.h"
32
#include "i915_vgpu.h"
Chris Wilson's avatar
Chris Wilson committed
33
#include "i915_trace.h"
34
#include "intel_drv.h"
35
#include <linux/shmem_fs.h>
36
#include <linux/slab.h>
37
#include <linux/swap.h>
38
#include <linux/pci.h>
39
#include <linux/dma-buf.h>
40

41 42
#define RQ_BUG_ON(expr)

43
static void i915_gem_object_flush_gtt_write_domain(struct drm_i915_gem_object *obj);
44
static void i915_gem_object_flush_cpu_write_domain(struct drm_i915_gem_object *obj);
45
static void
46 47 48
i915_gem_object_retire__write(struct drm_i915_gem_object *obj);
static void
i915_gem_object_retire__read(struct drm_i915_gem_object *obj, int ring);
49

50 51 52 53 54 55
static bool cpu_cache_is_coherent(struct drm_device *dev,
				  enum i915_cache_level level)
{
	return HAS_LLC(dev) || level != I915_CACHE_NONE;
}

56 57 58 59 60 61 62 63
static bool cpu_write_needs_clflush(struct drm_i915_gem_object *obj)
{
	if (!cpu_cache_is_coherent(obj->base.dev, obj->cache_level))
		return true;

	return obj->pin_display;
}

64 65 66 67
/* some bookkeeping */
static void i915_gem_info_add_obj(struct drm_i915_private *dev_priv,
				  size_t size)
{
68
	spin_lock(&dev_priv->mm.object_stat_lock);
69 70
	dev_priv->mm.object_count++;
	dev_priv->mm.object_memory += size;
71
	spin_unlock(&dev_priv->mm.object_stat_lock);
72 73 74 75 76
}

static void i915_gem_info_remove_obj(struct drm_i915_private *dev_priv,
				     size_t size)
{
77
	spin_lock(&dev_priv->mm.object_stat_lock);
78 79
	dev_priv->mm.object_count--;
	dev_priv->mm.object_memory -= size;
80
	spin_unlock(&dev_priv->mm.object_stat_lock);
81 82
}

83
static int
84
i915_gem_wait_for_error(struct i915_gpu_error *error)
85 86 87
{
	int ret;

88 89
#define EXIT_COND (!i915_reset_in_progress(error) || \
		   i915_terminally_wedged(error))
90
	if (EXIT_COND)
91 92
		return 0;

93 94 95 96 97
	/*
	 * Only wait 10 seconds for the gpu reset to complete to avoid hanging
	 * userspace. If it takes that long something really bad is going on and
	 * we should simply try to bail out and fail as gracefully as possible.
	 */
98 99 100
	ret = wait_event_interruptible_timeout(error->reset_queue,
					       EXIT_COND,
					       10*HZ);
101 102 103 104
	if (ret == 0) {
		DRM_ERROR("Timed out waiting for the gpu reset to complete\n");
		return -EIO;
	} else if (ret < 0) {
105
		return ret;
106
	}
107
#undef EXIT_COND
108

109
	return 0;
110 111
}

112
int i915_mutex_lock_interruptible(struct drm_device *dev)
113
{
114
	struct drm_i915_private *dev_priv = dev->dev_private;
115 116
	int ret;

117
	ret = i915_gem_wait_for_error(&dev_priv->gpu_error);
118 119 120 121 122 123 124
	if (ret)
		return ret;

	ret = mutex_lock_interruptible(&dev->struct_mutex);
	if (ret)
		return ret;

125
	WARN_ON(i915_verify_lists(dev));
126 127
	return 0;
}
128

129 130
int
i915_gem_get_aperture_ioctl(struct drm_device *dev, void *data,
131
			    struct drm_file *file)
132
{
133
	struct drm_i915_private *dev_priv = dev->dev_private;
134
	struct drm_i915_gem_get_aperture *args = data;
135 136
	struct i915_gtt *ggtt = &dev_priv->gtt;
	struct i915_vma *vma;
137
	size_t pinned;
138

139
	pinned = 0;
140
	mutex_lock(&dev->struct_mutex);
141 142 143 144 145 146
	list_for_each_entry(vma, &ggtt->base.active_list, mm_list)
		if (vma->pin_count)
			pinned += vma->node.size;
	list_for_each_entry(vma, &ggtt->base.inactive_list, mm_list)
		if (vma->pin_count)
			pinned += vma->node.size;
147
	mutex_unlock(&dev->struct_mutex);
148

149
	args->aper_size = dev_priv->gtt.base.total;
150
	args->aper_available_size = args->aper_size - pinned;
151

152 153 154
	return 0;
}

155 156
static int
i915_gem_object_get_pages_phys(struct drm_i915_gem_object *obj)
157
{
158 159 160 161 162
	struct address_space *mapping = file_inode(obj->base.filp)->i_mapping;
	char *vaddr = obj->phys_handle->vaddr;
	struct sg_table *st;
	struct scatterlist *sg;
	int i;
163

164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197
	if (WARN_ON(i915_gem_object_needs_bit17_swizzle(obj)))
		return -EINVAL;

	for (i = 0; i < obj->base.size / PAGE_SIZE; i++) {
		struct page *page;
		char *src;

		page = shmem_read_mapping_page(mapping, i);
		if (IS_ERR(page))
			return PTR_ERR(page);

		src = kmap_atomic(page);
		memcpy(vaddr, src, PAGE_SIZE);
		drm_clflush_virt_range(vaddr, PAGE_SIZE);
		kunmap_atomic(src);

		page_cache_release(page);
		vaddr += PAGE_SIZE;
	}

	i915_gem_chipset_flush(obj->base.dev);

	st = kmalloc(sizeof(*st), GFP_KERNEL);
	if (st == NULL)
		return -ENOMEM;

	if (sg_alloc_table(st, 1, GFP_KERNEL)) {
		kfree(st);
		return -ENOMEM;
	}

	sg = st->sgl;
	sg->offset = 0;
	sg->length = obj->base.size;
198

199 200 201 202 203 204 205 206 207 208 209 210 211
	sg_dma_address(sg) = obj->phys_handle->busaddr;
	sg_dma_len(sg) = obj->base.size;

	obj->pages = st;
	return 0;
}

static void
i915_gem_object_put_pages_phys(struct drm_i915_gem_object *obj)
{
	int ret;

	BUG_ON(obj->madv == __I915_MADV_PURGED);
212

213 214 215 216 217 218 219 220 221 222 223 224 225
	ret = i915_gem_object_set_to_cpu_domain(obj, true);
	if (ret) {
		/* In the event of a disaster, abandon all caches and
		 * hope for the best.
		 */
		WARN_ON(ret != -EIO);
		obj->base.read_domains = obj->base.write_domain = I915_GEM_DOMAIN_CPU;
	}

	if (obj->madv == I915_MADV_DONTNEED)
		obj->dirty = 0;

	if (obj->dirty) {
226
		struct address_space *mapping = file_inode(obj->base.filp)->i_mapping;
227
		char *vaddr = obj->phys_handle->vaddr;
228 229 230
		int i;

		for (i = 0; i < obj->base.size / PAGE_SIZE; i++) {
231 232 233 234 235 236 237 238 239 240 241 242 243 244
			struct page *page;
			char *dst;

			page = shmem_read_mapping_page(mapping, i);
			if (IS_ERR(page))
				continue;

			dst = kmap_atomic(page);
			drm_clflush_virt_range(vaddr, PAGE_SIZE);
			memcpy(dst, vaddr, PAGE_SIZE);
			kunmap_atomic(dst);

			set_page_dirty(page);
			if (obj->madv == I915_MADV_WILLNEED)
245
				mark_page_accessed(page);
246
			page_cache_release(page);
247 248
			vaddr += PAGE_SIZE;
		}
249
		obj->dirty = 0;
250 251
	}

252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282
	sg_free_table(obj->pages);
	kfree(obj->pages);
}

static void
i915_gem_object_release_phys(struct drm_i915_gem_object *obj)
{
	drm_pci_free(obj->base.dev, obj->phys_handle);
}

static const struct drm_i915_gem_object_ops i915_gem_phys_ops = {
	.get_pages = i915_gem_object_get_pages_phys,
	.put_pages = i915_gem_object_put_pages_phys,
	.release = i915_gem_object_release_phys,
};

static int
drop_pages(struct drm_i915_gem_object *obj)
{
	struct i915_vma *vma, *next;
	int ret;

	drm_gem_object_reference(&obj->base);
	list_for_each_entry_safe(vma, next, &obj->vma_list, vma_link)
		if (i915_vma_unbind(vma))
			break;

	ret = i915_gem_object_put_pages(obj);
	drm_gem_object_unreference(&obj->base);

	return ret;
283 284 285 286 287 288 289
}

int
i915_gem_object_attach_phys(struct drm_i915_gem_object *obj,
			    int align)
{
	drm_dma_handle_t *phys;
290
	int ret;
291 292 293 294 295 296 297 298 299 300 301 302 303 304

	if (obj->phys_handle) {
		if ((unsigned long)obj->phys_handle->vaddr & (align -1))
			return -EBUSY;

		return 0;
	}

	if (obj->madv != I915_MADV_WILLNEED)
		return -EFAULT;

	if (obj->base.filp == NULL)
		return -EINVAL;

305 306 307 308
	ret = drop_pages(obj);
	if (ret)
		return ret;

309 310 311 312 313 314
	/* create a new object */
	phys = drm_pci_alloc(obj->base.dev, obj->base.size, align);
	if (!phys)
		return -ENOMEM;

	obj->phys_handle = phys;
315 316 317
	obj->ops = &i915_gem_phys_ops;

	return i915_gem_object_get_pages(obj);
318 319 320 321 322 323 324 325 326 327
}

static int
i915_gem_phys_pwrite(struct drm_i915_gem_object *obj,
		     struct drm_i915_gem_pwrite *args,
		     struct drm_file *file_priv)
{
	struct drm_device *dev = obj->base.dev;
	void *vaddr = obj->phys_handle->vaddr + args->offset;
	char __user *user_data = to_user_ptr(args->data_ptr);
328
	int ret = 0;
329 330 331 332 333 334 335

	/* We manually control the domain here and pretend that it
	 * remains coherent i.e. in the GTT domain, like shmem_pwrite.
	 */
	ret = i915_gem_object_wait_rendering(obj, false);
	if (ret)
		return ret;
336

337
	intel_fb_obj_invalidate(obj, ORIGIN_CPU);
338 339 340 341 342 343 344 345 346 347
	if (__copy_from_user_inatomic_nocache(vaddr, user_data, args->size)) {
		unsigned long unwritten;

		/* The physical object once assigned is fixed for the lifetime
		 * of the obj, so we can safely drop the lock and continue
		 * to access vaddr.
		 */
		mutex_unlock(&dev->struct_mutex);
		unwritten = copy_from_user(vaddr, user_data, args->size);
		mutex_lock(&dev->struct_mutex);
348 349 350 351
		if (unwritten) {
			ret = -EFAULT;
			goto out;
		}
352 353
	}

354
	drm_clflush_virt_range(vaddr, args->size);
355
	i915_gem_chipset_flush(dev);
356 357

out:
358
	intel_fb_obj_flush(obj, false, ORIGIN_CPU);
359
	return ret;
360 361
}

362 363 364
void *i915_gem_object_alloc(struct drm_device *dev)
{
	struct drm_i915_private *dev_priv = dev->dev_private;
365
	return kmem_cache_zalloc(dev_priv->objects, GFP_KERNEL);
366 367 368 369 370
}

void i915_gem_object_free(struct drm_i915_gem_object *obj)
{
	struct drm_i915_private *dev_priv = obj->base.dev->dev_private;
371
	kmem_cache_free(dev_priv->objects, obj);
372 373
}

374 375 376 377 378
static int
i915_gem_create(struct drm_file *file,
		struct drm_device *dev,
		uint64_t size,
		uint32_t *handle_p)
379
{
380
	struct drm_i915_gem_object *obj;
381 382
	int ret;
	u32 handle;
383

384
	size = roundup(size, PAGE_SIZE);
385 386
	if (size == 0)
		return -EINVAL;
387 388

	/* Allocate the new object */
389
	obj = i915_gem_alloc_object(dev, size);
390 391 392
	if (obj == NULL)
		return -ENOMEM;

393
	ret = drm_gem_handle_create(file, &obj->base, &handle);
394
	/* drop reference from allocate - handle holds it now */
395 396 397
	drm_gem_object_unreference_unlocked(&obj->base);
	if (ret)
		return ret;
398

399
	*handle_p = handle;
400 401 402
	return 0;
}

403 404 405 406 407 408
int
i915_gem_dumb_create(struct drm_file *file,
		     struct drm_device *dev,
		     struct drm_mode_create_dumb *args)
{
	/* have to work out size/pitch and return them */
409
	args->pitch = ALIGN(args->width * DIV_ROUND_UP(args->bpp, 8), 64);
410 411
	args->size = args->pitch * args->height;
	return i915_gem_create(file, dev,
412
			       args->size, &args->handle);
413 414 415 416 417 418 419 420 421 422
}

/**
 * Creates a new mm object and returns a handle to it.
 */
int
i915_gem_create_ioctl(struct drm_device *dev, void *data,
		      struct drm_file *file)
{
	struct drm_i915_gem_create *args = data;
423

424
	return i915_gem_create(file, dev,
425
			       args->size, &args->handle);
426 427
}

428 429 430 431 432 433 434 435 436 437 438 439 440 441 442 443 444 445 446 447 448 449 450 451 452 453
static inline int
__copy_to_user_swizzled(char __user *cpu_vaddr,
			const char *gpu_vaddr, int gpu_offset,
			int length)
{
	int ret, cpu_offset = 0;

	while (length > 0) {
		int cacheline_end = ALIGN(gpu_offset + 1, 64);
		int this_length = min(cacheline_end - gpu_offset, length);
		int swizzled_gpu_offset = gpu_offset ^ 64;

		ret = __copy_to_user(cpu_vaddr + cpu_offset,
				     gpu_vaddr + swizzled_gpu_offset,
				     this_length);
		if (ret)
			return ret + length;

		cpu_offset += this_length;
		gpu_offset += this_length;
		length -= this_length;
	}

	return 0;
}

454
static inline int
455 456
__copy_from_user_swizzled(char *gpu_vaddr, int gpu_offset,
			  const char __user *cpu_vaddr,
457 458 459 460 461 462 463 464 465 466 467 468 469 470 471 472 473 474 475 476 477 478 479
			  int length)
{
	int ret, cpu_offset = 0;

	while (length > 0) {
		int cacheline_end = ALIGN(gpu_offset + 1, 64);
		int this_length = min(cacheline_end - gpu_offset, length);
		int swizzled_gpu_offset = gpu_offset ^ 64;

		ret = __copy_from_user(gpu_vaddr + swizzled_gpu_offset,
				       cpu_vaddr + cpu_offset,
				       this_length);
		if (ret)
			return ret + length;

		cpu_offset += this_length;
		gpu_offset += this_length;
		length -= this_length;
	}

	return 0;
}

480 481 482 483 484 485 486 487 488 489 490 491
/*
 * Pins the specified object's pages and synchronizes the object with
 * GPU accesses. Sets needs_clflush to non-zero if the caller should
 * flush the object from the CPU cache.
 */
int i915_gem_obj_prepare_shmem_read(struct drm_i915_gem_object *obj,
				    int *needs_clflush)
{
	int ret;

	*needs_clflush = 0;

492
	if (WARN_ON((obj->ops->flags & I915_GEM_OBJECT_HAS_STRUCT_PAGE) == 0))
493 494 495 496 497 498 499 500 501 502 503 504 505 506 507 508 509 510 511 512 513 514 515
		return -EINVAL;

	if (!(obj->base.read_domains & I915_GEM_DOMAIN_CPU)) {
		/* If we're not in the cpu read domain, set ourself into the gtt
		 * read domain and manually flush cachelines (if required). This
		 * optimizes for the case when the gpu will dirty the data
		 * anyway again before the next pread happens. */
		*needs_clflush = !cpu_cache_is_coherent(obj->base.dev,
							obj->cache_level);
		ret = i915_gem_object_wait_rendering(obj, true);
		if (ret)
			return ret;
	}

	ret = i915_gem_object_get_pages(obj);
	if (ret)
		return ret;

	i915_gem_object_pin_pages(obj);

	return ret;
}

516 517 518
/* Per-page copy function for the shmem pread fastpath.
 * Flushes invalid cachelines before reading the target if
 * needs_clflush is set. */
519
static int
520 521 522 523 524 525 526
shmem_pread_fast(struct page *page, int shmem_page_offset, int page_length,
		 char __user *user_data,
		 bool page_do_bit17_swizzling, bool needs_clflush)
{
	char *vaddr;
	int ret;

527
	if (unlikely(page_do_bit17_swizzling))
528 529 530 531 532 533 534 535 536 537 538
		return -EINVAL;

	vaddr = kmap_atomic(page);
	if (needs_clflush)
		drm_clflush_virt_range(vaddr + shmem_page_offset,
				       page_length);
	ret = __copy_to_user_inatomic(user_data,
				      vaddr + shmem_page_offset,
				      page_length);
	kunmap_atomic(vaddr);

539
	return ret ? -EFAULT : 0;
540 541
}

542 543 544 545
static void
shmem_clflush_swizzled_range(char *addr, unsigned long length,
			     bool swizzled)
{
546
	if (unlikely(swizzled)) {
547 548 549 550 551 552 553 554 555 556 557 558 559 560 561 562 563
		unsigned long start = (unsigned long) addr;
		unsigned long end = (unsigned long) addr + length;

		/* For swizzling simply ensure that we always flush both
		 * channels. Lame, but simple and it works. Swizzled
		 * pwrite/pread is far from a hotpath - current userspace
		 * doesn't use it at all. */
		start = round_down(start, 128);
		end = round_up(end, 128);

		drm_clflush_virt_range((void *)start, end - start);
	} else {
		drm_clflush_virt_range(addr, length);
	}

}

564 565 566 567 568 569 570 571 572 573 574 575
/* Only difference to the fast-path function is that this can handle bit17
 * and uses non-atomic copy and kmap functions. */
static int
shmem_pread_slow(struct page *page, int shmem_page_offset, int page_length,
		 char __user *user_data,
		 bool page_do_bit17_swizzling, bool needs_clflush)
{
	char *vaddr;
	int ret;

	vaddr = kmap(page);
	if (needs_clflush)
576 577 578
		shmem_clflush_swizzled_range(vaddr + shmem_page_offset,
					     page_length,
					     page_do_bit17_swizzling);
579 580 581 582 583 584 585 586 587 588 589

	if (page_do_bit17_swizzling)
		ret = __copy_to_user_swizzled(user_data,
					      vaddr, shmem_page_offset,
					      page_length);
	else
		ret = __copy_to_user(user_data,
				     vaddr + shmem_page_offset,
				     page_length);
	kunmap(page);

590
	return ret ? - EFAULT : 0;
591 592
}

593
static int
594 595 596 597
i915_gem_shmem_pread(struct drm_device *dev,
		     struct drm_i915_gem_object *obj,
		     struct drm_i915_gem_pread *args,
		     struct drm_file *file)
598
{
599
	char __user *user_data;
600
	ssize_t remain;
601
	loff_t offset;
602
	int shmem_page_offset, page_length, ret = 0;
603
	int obj_do_bit17_swizzling, page_do_bit17_swizzling;
604
	int prefaulted = 0;
605
	int needs_clflush = 0;
606
	struct sg_page_iter sg_iter;
607

608
	user_data = to_user_ptr(args->data_ptr);
609 610
	remain = args->size;

611
	obj_do_bit17_swizzling = i915_gem_object_needs_bit17_swizzle(obj);
612

613
	ret = i915_gem_obj_prepare_shmem_read(obj, &needs_clflush);
614 615 616
	if (ret)
		return ret;

617
	offset = args->offset;
618

619 620
	for_each_sg_page(obj->pages->sgl, &sg_iter, obj->pages->nents,
			 offset >> PAGE_SHIFT) {
621
		struct page *page = sg_page_iter_page(&sg_iter);
622 623 624 625

		if (remain <= 0)
			break;

626 627 628 629 630
		/* Operation in this page
		 *
		 * shmem_page_offset = offset within page in shmem file
		 * page_length = bytes to copy for this page
		 */
631
		shmem_page_offset = offset_in_page(offset);
632 633 634 635
		page_length = remain;
		if ((shmem_page_offset + page_length) > PAGE_SIZE)
			page_length = PAGE_SIZE - shmem_page_offset;

636 637 638
		page_do_bit17_swizzling = obj_do_bit17_swizzling &&
			(page_to_phys(page) & (1 << 17)) != 0;

639 640 641 642 643
		ret = shmem_pread_fast(page, shmem_page_offset, page_length,
				       user_data, page_do_bit17_swizzling,
				       needs_clflush);
		if (ret == 0)
			goto next_page;
644 645 646

		mutex_unlock(&dev->struct_mutex);

647
		if (likely(!i915.prefault_disable) && !prefaulted) {
648
			ret = fault_in_multipages_writeable(user_data, remain);
649 650 651 652 653 654 655
			/* Userspace is tricking us, but we've already clobbered
			 * its pages with the prefault and promised to write the
			 * data up to the first fault. Hence ignore any errors
			 * and just continue. */
			(void)ret;
			prefaulted = 1;
		}
656

657 658 659
		ret = shmem_pread_slow(page, shmem_page_offset, page_length,
				       user_data, page_do_bit17_swizzling,
				       needs_clflush);
660

661
		mutex_lock(&dev->struct_mutex);
662 663

		if (ret)
664 665
			goto out;

666
next_page:
667
		remain -= page_length;
668
		user_data += page_length;
669 670 671
		offset += page_length;
	}

672
out:
673 674
	i915_gem_object_unpin_pages(obj);

675 676 677
	return ret;
}

678 679 680 681 682 683 684
/**
 * Reads data from the object referenced by handle.
 *
 * On error, the contents of *data are undefined.
 */
int
i915_gem_pread_ioctl(struct drm_device *dev, void *data,
685
		     struct drm_file *file)
686 687
{
	struct drm_i915_gem_pread *args = data;
688
	struct drm_i915_gem_object *obj;
689
	int ret = 0;
690

691 692 693 694
	if (args->size == 0)
		return 0;

	if (!access_ok(VERIFY_WRITE,
695
		       to_user_ptr(args->data_ptr),
696 697 698
		       args->size))
		return -EFAULT;

699
	ret = i915_mutex_lock_interruptible(dev);
700
	if (ret)
701
		return ret;
702

703
	obj = to_intel_bo(drm_gem_object_lookup(dev, file, args->handle));
704
	if (&obj->base == NULL) {
705 706
		ret = -ENOENT;
		goto unlock;
707
	}
708

709
	/* Bounds check source.  */
710 711
	if (args->offset > obj->base.size ||
	    args->size > obj->base.size - args->offset) {
712
		ret = -EINVAL;
713
		goto out;
714 715
	}

716 717 718 719 720 721 722 723
	/* prime objects have no backing filp to GEM pread/pwrite
	 * pages from.
	 */
	if (!obj->base.filp) {
		ret = -EINVAL;
		goto out;
	}

Chris Wilson's avatar
Chris Wilson committed
724 725
	trace_i915_gem_object_pread(obj, args->offset, args->size);

726
	ret = i915_gem_shmem_pread(dev, obj, args, file);
727

728
out:
729
	drm_gem_object_unreference(&obj->base);
730
unlock:
731
	mutex_unlock(&dev->struct_mutex);
732
	return ret;
733 734
}

735 736
/* This is the fast write path which cannot handle
 * page faults in the source data
737
 */
738 739 740 741 742 743

static inline int
fast_user_write(struct io_mapping *mapping,
		loff_t page_base, int page_offset,
		char __user *user_data,
		int length)
744
{
745 746
	void __iomem *vaddr_atomic;
	void *vaddr;
747
	unsigned long unwritten;
748

749
	vaddr_atomic = io_mapping_map_atomic_wc(mapping, page_base);
750 751 752
	/* We can use the cpu mem copy function because this is X86. */
	vaddr = (void __force*)vaddr_atomic + page_offset;
	unwritten = __copy_from_user_inatomic_nocache(vaddr,
753
						      user_data, length);
754
	io_mapping_unmap_atomic(vaddr_atomic);
755
	return unwritten;
756 757
}

758 759 760 761
/**
 * This is the fast pwrite path, where we copy the data directly from the
 * user into the GTT, uncached.
 */
762
static int
763 764
i915_gem_gtt_pwrite_fast(struct drm_device *dev,
			 struct drm_i915_gem_object *obj,
765
			 struct drm_i915_gem_pwrite *args,
766
			 struct drm_file *file)
767
{
768
	struct drm_i915_private *dev_priv = dev->dev_private;
769
	ssize_t remain;
770
	loff_t offset, page_base;
771
	char __user *user_data;
Daniel Vetter's avatar
Daniel Vetter committed
772 773
	int page_offset, page_length, ret;

774
	ret = i915_gem_obj_ggtt_pin(obj, 0, PIN_MAPPABLE | PIN_NONBLOCK);
Daniel Vetter's avatar
Daniel Vetter committed
775 776 777 778 779 780 781 782 783 784
	if (ret)
		goto out;

	ret = i915_gem_object_set_to_gtt_domain(obj, true);
	if (ret)
		goto out_unpin;

	ret = i915_gem_object_put_fence(obj);
	if (ret)
		goto out_unpin;
785

786
	user_data = to_user_ptr(args->data_ptr);
787 788
	remain = args->size;

789
	offset = i915_gem_obj_ggtt_offset(obj) + args->offset;
790

791
	intel_fb_obj_invalidate(obj, ORIGIN_GTT);
792

793 794 795
	while (remain > 0) {
		/* Operation in this page
		 *
796 797 798
		 * page_base = page offset within aperture
		 * page_offset = offset within page
		 * page_length = bytes to copy for this page
799
		 */
800 801
		page_base = offset & PAGE_MASK;
		page_offset = offset_in_page(offset);
802 803 804 805 806
		page_length = remain;
		if ((page_offset + remain) > PAGE_SIZE)
			page_length = PAGE_SIZE - page_offset;

		/* If we get a fault while copying data, then (presumably) our
807 808
		 * source page isn't available.  Return the error and we'll
		 * retry in the slow path.
809
		 */
810
		if (fast_user_write(dev_priv->gtt.mappable, page_base,
Daniel Vetter's avatar
Daniel Vetter committed
811 812
				    page_offset, user_data, page_length)) {
			ret = -EFAULT;
813
			goto out_flush;
Daniel Vetter's avatar
Daniel Vetter committed
814
		}
815

816 817 818
		remain -= page_length;
		user_data += page_length;
		offset += page_length;
819 820
	}

821
out_flush:
822
	intel_fb_obj_flush(obj, false, ORIGIN_GTT);
Daniel Vetter's avatar
Daniel Vetter committed
823
out_unpin:
824
	i915_gem_object_ggtt_unpin(obj);
Daniel Vetter's avatar
Daniel Vetter committed
825
out:
826
	return ret;
827 828
}

829 830 831 832
/* Per-page copy function for the shmem pwrite fastpath.
 * Flushes invalid cachelines before writing to the target if
 * needs_clflush_before is set and flushes out any written cachelines after
 * writing if needs_clflush is set. */
833
static int
834 835 836 837 838
shmem_pwrite_fast(struct page *page, int shmem_page_offset, int page_length,
		  char __user *user_data,
		  bool page_do_bit17_swizzling,
		  bool needs_clflush_before,
		  bool needs_clflush_after)
839
{
840
	char *vaddr;
841
	int ret;
842

843
	if (unlikely(page_do_bit17_swizzling))
844
		return -EINVAL;
845

846 847 848 849
	vaddr = kmap_atomic(page);
	if (needs_clflush_before)
		drm_clflush_virt_range(vaddr + shmem_page_offset,
				       page_length);
850 851
	ret = __copy_from_user_inatomic(vaddr + shmem_page_offset,
					user_data, page_length);
852 853 854 855
	if (needs_clflush_after)
		drm_clflush_virt_range(vaddr + shmem_page_offset,
				       page_length);
	kunmap_atomic(vaddr);
856

857
	return ret ? -EFAULT : 0;
858 859
}

860 861
/* Only difference to the fast-path function is that this can handle bit17
 * and uses non-atomic copy and kmap functions. */
862
static int
863 864 865 866 867
shmem_pwrite_slow(struct page *page, int shmem_page_offset, int page_length,
		  char __user *user_data,
		  bool page_do_bit17_swizzling,
		  bool needs_clflush_before,
		  bool needs_clflush_after)
868
{
869 870
	char *vaddr;
	int ret;
871

872
	vaddr = kmap(page);
873
	if (unlikely(needs_clflush_before || page_do_bit17_swizzling))
874 875 876
		shmem_clflush_swizzled_range(vaddr + shmem_page_offset,
					     page_length,
					     page_do_bit17_swizzling);
877 878
	if (page_do_bit17_swizzling)
		ret = __copy_from_user_swizzled(vaddr, shmem_page_offset,
879 880
						user_data,
						page_length);
881 882 883 884 885
	else
		ret = __copy_from_user(vaddr + shmem_page_offset,
				       user_data,
				       page_length);
	if (needs_clflush_after)
886 887 888
		shmem_clflush_swizzled_range(vaddr + shmem_page_offset,
					     page_length,
					     page_do_bit17_swizzling);
889
	kunmap(page);
890

891
	return ret ? -EFAULT : 0;
892 893 894
}

static int
895 896 897 898
i915_gem_shmem_pwrite(struct drm_device *dev,
		      struct drm_i915_gem_object *obj,
		      struct drm_i915_gem_pwrite *args,
		      struct drm_file *file)
899 900
{
	ssize_t remain;
901 902
	loff_t offset;
	char __user *user_data;
903
	int shmem_page_offset, page_length, ret = 0;
904
	int obj_do_bit17_swizzling, page_do_bit17_swizzling;
905
	int hit_slowpath = 0;
906 907
	int needs_clflush_after = 0;
	int needs_clflush_before = 0;
908
	struct sg_page_iter sg_iter;
909

910
	user_data = to_user_ptr(args->data_ptr);
911 912
	remain = args->size;

913
	obj_do_bit17_swizzling = i915_gem_object_needs_bit17_swizzle(obj);
914

915 916 917 918 919
	if (obj->base.write_domain != I915_GEM_DOMAIN_CPU) {
		/* If we're not in the cpu write domain, set ourself into the gtt
		 * write domain and manually flush cachelines (if required). This
		 * optimizes for the case when the gpu will use the data
		 * right away and we therefore have to clflush anyway. */
920
		needs_clflush_after = cpu_write_needs_clflush(obj);
921 922 923
		ret = i915_gem_object_wait_rendering(obj, false);
		if (ret)
			return ret;
924
	}
925 926 927 928 929
	/* Same trick applies to invalidate partially written cachelines read
	 * before writing. */
	if ((obj->base.read_domains & I915_GEM_DOMAIN_CPU) == 0)
		needs_clflush_before =
			!cpu_cache_is_coherent(dev, obj->cache_level);
930

931 932 933 934
	ret = i915_gem_object_get_pages(obj);
	if (ret)
		return ret;

935
	intel_fb_obj_invalidate(obj, ORIGIN_CPU);
936

937 938
	i915_gem_object_pin_pages(obj);

939
	offset = args->offset;
940
	obj->dirty = 1;
941

942 943
	for_each_sg_page(obj->pages->sgl, &sg_iter, obj->pages->nents,
			 offset >> PAGE_SHIFT) {
944
		struct page *page = sg_page_iter_page(&sg_iter);
945
		int partial_cacheline_write;
946

947 948 949
		if (remain <= 0)
			break;

950 951 952 953 954
		/* Operation in this page
		 *
		 * shmem_page_offset = offset within page in shmem file
		 * page_length = bytes to copy for this page
		 */
955
		shmem_page_offset = offset_in_page(offset);
956 957 958 959 960

		page_length = remain;
		if ((shmem_page_offset + page_length) > PAGE_SIZE)
			page_length = PAGE_SIZE - shmem_page_offset;

961 962 963 964 965 966 967
		/* If we don't overwrite a cacheline completely we need to be
		 * careful to have up-to-date data by first clflushing. Don't
		 * overcomplicate things and flush the entire patch. */
		partial_cacheline_write = needs_clflush_before &&
			((shmem_page_offset | page_length)
				& (boot_cpu_data.x86_clflush_size - 1));

968 969 970
		page_do_bit17_swizzling = obj_do_bit17_swizzling &&
			(page_to_phys(page) & (1 << 17)) != 0;

971 972 973 974 975 976
		ret = shmem_pwrite_fast(page, shmem_page_offset, page_length,
					user_data, page_do_bit17_swizzling,
					partial_cacheline_write,
					needs_clflush_after);
		if (ret == 0)
			goto next_page;
977 978 979

		hit_slowpath = 1;
		mutex_unlock(&dev->struct_mutex);
980 981 982 983
		ret = shmem_pwrite_slow(page, shmem_page_offset, page_length,
					user_data, page_do_bit17_swizzling,
					partial_cacheline_write,
					needs_clflush_after);
984

985
		mutex_lock(&dev->struct_mutex);
986 987

		if (ret)
988 989
			goto out;

990
next_page:
991
		remain -= page_length;
992
		user_data += page_length;
993
		offset += page_length;
994 995
	}

996
out:
997 998
	i915_gem_object_unpin_pages(obj);

999
	if (hit_slowpath) {
1000 1001 1002 1003 1004 1005 1006
		/*
		 * Fixup: Flush cpu caches in case we didn't flush the dirty
		 * cachelines in-line while writing and the object moved
		 * out of the cpu write domain while we've dropped the lock.
		 */
		if (!needs_clflush_after &&
		    obj->base.write_domain != I915_GEM_DOMAIN_CPU) {
1007
			if (i915_gem_clflush_object(obj, obj->pin_display))
1008
				needs_clflush_after = true;
1009
		}
1010
	}
1011

1012
	if (needs_clflush_after)
1013
		i915_gem_chipset_flush(dev);
1014 1015
	else
		obj->cache_dirty = true;
1016

1017
	intel_fb_obj_flush(obj, false, ORIGIN_CPU);
1018
	return ret;
1019 1020 1021 1022 1023 1024 1025 1026 1027
}

/**
 * Writes data to the object referenced by handle.
 *
 * On error, the contents of the buffer that were to be modified are undefined.
 */
int
i915_gem_pwrite_ioctl(struct drm_device *dev, void *data,
1028
		      struct drm_file *file)
1029
{
1030
	struct drm_i915_private *dev_priv = dev->dev_private;
1031
	struct drm_i915_gem_pwrite *args = data;
1032
	struct drm_i915_gem_object *obj;
1033 1034 1035 1036 1037 1038
	int ret;

	if (args->size == 0)
		return 0;

	if (!access_ok(VERIFY_READ,
1039
		       to_user_ptr(args->data_ptr),
1040 1041 1042
		       args->size))
		return -EFAULT;

1043
	if (likely(!i915.prefault_disable)) {
1044 1045 1046 1047 1048
		ret = fault_in_multipages_readable(to_user_ptr(args->data_ptr),
						   args->size);
		if (ret)
			return -EFAULT;
	}
1049

1050 1051
	intel_runtime_pm_get(dev_priv);

1052
	ret = i915_mutex_lock_interruptible(dev);
1053
	if (ret)
1054
		goto put_rpm;
1055

1056
	obj = to_intel_bo(drm_gem_object_lookup(dev, file, args->handle));
1057
	if (&obj->base == NULL) {
1058 1059
		ret = -ENOENT;
		goto unlock;
1060
	}
1061

1062
	/* Bounds check destination. */
1063 1064
	if (args->offset > obj->base.size ||
	    args->size > obj->base.size - args->offset) {
1065
		ret = -EINVAL;
1066
		goto out;
1067 1068
	}

1069 1070 1071 1072 1073 1074 1075 1076
	/* prime objects have no backing filp to GEM pread/pwrite
	 * pages from.
	 */
	if (!obj->base.filp) {
		ret = -EINVAL;
		goto out;
	}

Chris Wilson's avatar
Chris Wilson committed
1077 1078
	trace_i915_gem_object_pwrite(obj, args->offset, args->size);

Daniel Vetter's avatar
Daniel Vetter committed
1079
	ret = -EFAULT;
1080 1081 1082 1083 1084 1085
	/* We can only do the GTT pwrite on untiled buffers, as otherwise
	 * it would end up going through the fenced access, and we'll get
	 * different detiling behavior between reading and writing.
	 * pread/pwrite currently are reading and writing from the CPU
	 * perspective, requiring manual detiling by the client.
	 */
1086 1087 1088
	if (obj->tiling_mode == I915_TILING_NONE &&
	    obj->base.write_domain != I915_GEM_DOMAIN_CPU &&
	    cpu_write_needs_clflush(obj)) {
1089
		ret = i915_gem_gtt_pwrite_fast(dev, obj, args, file);
Daniel Vetter's avatar
Daniel Vetter committed
1090 1091 1092
		/* Note that the gtt paths might fail with non-page-backed user
		 * pointers (e.g. gtt mappings when moving data between
		 * textures). Fallback to the shmem path in that case. */
1093
	}
1094

1095 1096 1097 1098 1099 1100
	if (ret == -EFAULT || ret == -ENOSPC) {
		if (obj->phys_handle)
			ret = i915_gem_phys_pwrite(obj, args, file);
		else
			ret = i915_gem_shmem_pwrite(dev, obj, args, file);
	}
1101

1102
out:
1103
	drm_gem_object_unreference(&obj->base);
1104
unlock:
1105
	mutex_unlock(&dev->struct_mutex);
1106 1107 1108
put_rpm:
	intel_runtime_pm_put(dev_priv);

1109 1110 1111
	return ret;
}

1112
int
1113
i915_gem_check_wedge(struct i915_gpu_error *error,
1114 1115
		     bool interruptible)
{
1116
	if (i915_reset_in_progress(error)) {
1117 1118 1119 1120 1121
		/* Non-interruptible callers can't handle -EAGAIN, hence return
		 * -EIO unconditionally for these. */
		if (!interruptible)
			return -EIO;

1122 1123
		/* Recovery complete, but the reset failed ... */
		if (i915_terminally_wedged(error))
1124 1125
			return -EIO;

1126 1127 1128 1129 1130 1131 1132
		/*
		 * Check if GPU Reset is in progress - we need intel_ring_begin
		 * to work properly to reinit the hw state while the gpu is
		 * still marked as reset-in-progress. Handle this with a flag.
		 */
		if (!error->reload_in_reset)
			return -EAGAIN;
1133 1134 1135 1136 1137
	}

	return 0;
}

1138 1139 1140 1141 1142 1143
static void fake_irq(unsigned long data)
{
	wake_up_process((struct task_struct *)data);
}

static bool missed_irq(struct drm_i915_private *dev_priv,
1144
		       struct intel_engine_cs *ring)
1145 1146 1147 1148
{
	return test_bit(ring->id, &dev_priv->gpu_error.missed_irq_rings);
}

1149 1150 1151 1152 1153 1154 1155 1156 1157 1158 1159 1160 1161 1162 1163