Merge branch 'i2c-for-linus' of git://jdelvare.pck.nerim.net/jdelvare-2.6
[linux-2.6] / drivers / gpu / drm / i915 / i915_gem.c
1 /*
2  * Copyright © 2008 Intel Corporation
3  *
4  * Permission is hereby granted, free of charge, to any person obtaining a
5  * copy of this software and associated documentation files (the "Software"),
6  * to deal in the Software without restriction, including without limitation
7  * the rights to use, copy, modify, merge, publish, distribute, sublicense,
8  * and/or sell copies of the Software, and to permit persons to whom the
9  * Software is furnished to do so, subject to the following conditions:
10  *
11  * The above copyright notice and this permission notice (including the next
12  * paragraph) shall be included in all copies or substantial portions of the
13  * Software.
14  *
15  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
18  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
20  * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
21  * IN THE SOFTWARE.
22  *
23  * Authors:
24  *    Eric Anholt <eric@anholt.net>
25  *
26  */
27
28 #include "drmP.h"
29 #include "drm.h"
30 #include "i915_drm.h"
31 #include "i915_drv.h"
32 #include <linux/swap.h>
33 #include <linux/pci.h>
34
35 #define I915_GEM_GPU_DOMAINS    (~(I915_GEM_DOMAIN_CPU | I915_GEM_DOMAIN_GTT))
36
37 static void
38 i915_gem_object_set_to_gpu_domain(struct drm_gem_object *obj,
39                                   uint32_t read_domains,
40                                   uint32_t write_domain);
41 static void i915_gem_object_flush_gpu_write_domain(struct drm_gem_object *obj);
42 static void i915_gem_object_flush_gtt_write_domain(struct drm_gem_object *obj);
43 static void i915_gem_object_flush_cpu_write_domain(struct drm_gem_object *obj);
44 static int i915_gem_object_set_to_cpu_domain(struct drm_gem_object *obj,
45                                              int write);
46 static int i915_gem_object_set_cpu_read_domain_range(struct drm_gem_object *obj,
47                                                      uint64_t offset,
48                                                      uint64_t size);
49 static void i915_gem_object_set_to_full_cpu_read_domain(struct drm_gem_object *obj);
50 static int i915_gem_object_get_page_list(struct drm_gem_object *obj);
51 static void i915_gem_object_free_page_list(struct drm_gem_object *obj);
52 static int i915_gem_object_wait_rendering(struct drm_gem_object *obj);
53 static int i915_gem_object_bind_to_gtt(struct drm_gem_object *obj,
54                                            unsigned alignment);
55 static void i915_gem_object_get_fence_reg(struct drm_gem_object *obj);
56 static void i915_gem_clear_fence_reg(struct drm_gem_object *obj);
57 static int i915_gem_evict_something(struct drm_device *dev);
58 static int i915_gem_phys_pwrite(struct drm_device *dev, struct drm_gem_object *obj,
59                                 struct drm_i915_gem_pwrite *args,
60                                 struct drm_file *file_priv);
61
62 int i915_gem_do_init(struct drm_device *dev, unsigned long start,
63                      unsigned long end)
64 {
65         drm_i915_private_t *dev_priv = dev->dev_private;
66
67         if (start >= end ||
68             (start & (PAGE_SIZE - 1)) != 0 ||
69             (end & (PAGE_SIZE - 1)) != 0) {
70                 return -EINVAL;
71         }
72
73         drm_mm_init(&dev_priv->mm.gtt_space, start,
74                     end - start);
75
76         dev->gtt_total = (uint32_t) (end - start);
77
78         return 0;
79 }
80
81 int
82 i915_gem_init_ioctl(struct drm_device *dev, void *data,
83                     struct drm_file *file_priv)
84 {
85         struct drm_i915_gem_init *args = data;
86         int ret;
87
88         mutex_lock(&dev->struct_mutex);
89         ret = i915_gem_do_init(dev, args->gtt_start, args->gtt_end);
90         mutex_unlock(&dev->struct_mutex);
91
92         return ret;
93 }
94
95 int
96 i915_gem_get_aperture_ioctl(struct drm_device *dev, void *data,
97                             struct drm_file *file_priv)
98 {
99         struct drm_i915_gem_get_aperture *args = data;
100
101         if (!(dev->driver->driver_features & DRIVER_GEM))
102                 return -ENODEV;
103
104         args->aper_size = dev->gtt_total;
105         args->aper_available_size = (args->aper_size -
106                                      atomic_read(&dev->pin_memory));
107
108         return 0;
109 }
110
111
112 /**
113  * Creates a new mm object and returns a handle to it.
114  */
115 int
116 i915_gem_create_ioctl(struct drm_device *dev, void *data,
117                       struct drm_file *file_priv)
118 {
119         struct drm_i915_gem_create *args = data;
120         struct drm_gem_object *obj;
121         int handle, ret;
122
123         args->size = roundup(args->size, PAGE_SIZE);
124
125         /* Allocate the new object */
126         obj = drm_gem_object_alloc(dev, args->size);
127         if (obj == NULL)
128                 return -ENOMEM;
129
130         ret = drm_gem_handle_create(file_priv, obj, &handle);
131         mutex_lock(&dev->struct_mutex);
132         drm_gem_object_handle_unreference(obj);
133         mutex_unlock(&dev->struct_mutex);
134
135         if (ret)
136                 return ret;
137
138         args->handle = handle;
139
140         return 0;
141 }
142
143 /**
144  * Reads data from the object referenced by handle.
145  *
146  * On error, the contents of *data are undefined.
147  */
148 int
149 i915_gem_pread_ioctl(struct drm_device *dev, void *data,
150                      struct drm_file *file_priv)
151 {
152         struct drm_i915_gem_pread *args = data;
153         struct drm_gem_object *obj;
154         struct drm_i915_gem_object *obj_priv;
155         ssize_t read;
156         loff_t offset;
157         int ret;
158
159         obj = drm_gem_object_lookup(dev, file_priv, args->handle);
160         if (obj == NULL)
161                 return -EBADF;
162         obj_priv = obj->driver_private;
163
164         /* Bounds check source.
165          *
166          * XXX: This could use review for overflow issues...
167          */
168         if (args->offset > obj->size || args->size > obj->size ||
169             args->offset + args->size > obj->size) {
170                 drm_gem_object_unreference(obj);
171                 return -EINVAL;
172         }
173
174         mutex_lock(&dev->struct_mutex);
175
176         ret = i915_gem_object_set_cpu_read_domain_range(obj, args->offset,
177                                                         args->size);
178         if (ret != 0) {
179                 drm_gem_object_unreference(obj);
180                 mutex_unlock(&dev->struct_mutex);
181                 return ret;
182         }
183
184         offset = args->offset;
185
186         read = vfs_read(obj->filp, (char __user *)(uintptr_t)args->data_ptr,
187                         args->size, &offset);
188         if (read != args->size) {
189                 drm_gem_object_unreference(obj);
190                 mutex_unlock(&dev->struct_mutex);
191                 if (read < 0)
192                         return read;
193                 else
194                         return -EINVAL;
195         }
196
197         drm_gem_object_unreference(obj);
198         mutex_unlock(&dev->struct_mutex);
199
200         return 0;
201 }
202
203 /* This is the fast write path which cannot handle
204  * page faults in the source data
205  */
206
207 static inline int
208 fast_user_write(struct io_mapping *mapping,
209                 loff_t page_base, int page_offset,
210                 char __user *user_data,
211                 int length)
212 {
213         char *vaddr_atomic;
214         unsigned long unwritten;
215
216         vaddr_atomic = io_mapping_map_atomic_wc(mapping, page_base);
217         unwritten = __copy_from_user_inatomic_nocache(vaddr_atomic + page_offset,
218                                                       user_data, length);
219         io_mapping_unmap_atomic(vaddr_atomic);
220         if (unwritten)
221                 return -EFAULT;
222         return 0;
223 }
224
225 /* Here's the write path which can sleep for
226  * page faults
227  */
228
229 static inline int
230 slow_user_write(struct io_mapping *mapping,
231                 loff_t page_base, int page_offset,
232                 char __user *user_data,
233                 int length)
234 {
235         char __iomem *vaddr;
236         unsigned long unwritten;
237
238         vaddr = io_mapping_map_wc(mapping, page_base);
239         if (vaddr == NULL)
240                 return -EFAULT;
241         unwritten = __copy_from_user(vaddr + page_offset,
242                                      user_data, length);
243         io_mapping_unmap(vaddr);
244         if (unwritten)
245                 return -EFAULT;
246         return 0;
247 }
248
249 static int
250 i915_gem_gtt_pwrite(struct drm_device *dev, struct drm_gem_object *obj,
251                     struct drm_i915_gem_pwrite *args,
252                     struct drm_file *file_priv)
253 {
254         struct drm_i915_gem_object *obj_priv = obj->driver_private;
255         drm_i915_private_t *dev_priv = dev->dev_private;
256         ssize_t remain;
257         loff_t offset, page_base;
258         char __user *user_data;
259         int page_offset, page_length;
260         int ret;
261
262         user_data = (char __user *) (uintptr_t) args->data_ptr;
263         remain = args->size;
264         if (!access_ok(VERIFY_READ, user_data, remain))
265                 return -EFAULT;
266
267
268         mutex_lock(&dev->struct_mutex);
269         ret = i915_gem_object_pin(obj, 0);
270         if (ret) {
271                 mutex_unlock(&dev->struct_mutex);
272                 return ret;
273         }
274         ret = i915_gem_object_set_to_gtt_domain(obj, 1);
275         if (ret)
276                 goto fail;
277
278         obj_priv = obj->driver_private;
279         offset = obj_priv->gtt_offset + args->offset;
280         obj_priv->dirty = 1;
281
282         while (remain > 0) {
283                 /* Operation in this page
284                  *
285                  * page_base = page offset within aperture
286                  * page_offset = offset within page
287                  * page_length = bytes to copy for this page
288                  */
289                 page_base = (offset & ~(PAGE_SIZE-1));
290                 page_offset = offset & (PAGE_SIZE-1);
291                 page_length = remain;
292                 if ((page_offset + remain) > PAGE_SIZE)
293                         page_length = PAGE_SIZE - page_offset;
294
295                 ret = fast_user_write (dev_priv->mm.gtt_mapping, page_base,
296                                        page_offset, user_data, page_length);
297
298                 /* If we get a fault while copying data, then (presumably) our
299                  * source page isn't available. In this case, use the
300                  * non-atomic function
301                  */
302                 if (ret) {
303                         ret = slow_user_write (dev_priv->mm.gtt_mapping,
304                                                page_base, page_offset,
305                                                user_data, page_length);
306                         if (ret)
307                                 goto fail;
308                 }
309
310                 remain -= page_length;
311                 user_data += page_length;
312                 offset += page_length;
313         }
314
315 fail:
316         i915_gem_object_unpin(obj);
317         mutex_unlock(&dev->struct_mutex);
318
319         return ret;
320 }
321
322 static int
323 i915_gem_shmem_pwrite(struct drm_device *dev, struct drm_gem_object *obj,
324                       struct drm_i915_gem_pwrite *args,
325                       struct drm_file *file_priv)
326 {
327         int ret;
328         loff_t offset;
329         ssize_t written;
330
331         mutex_lock(&dev->struct_mutex);
332
333         ret = i915_gem_object_set_to_cpu_domain(obj, 1);
334         if (ret) {
335                 mutex_unlock(&dev->struct_mutex);
336                 return ret;
337         }
338
339         offset = args->offset;
340
341         written = vfs_write(obj->filp,
342                             (char __user *)(uintptr_t) args->data_ptr,
343                             args->size, &offset);
344         if (written != args->size) {
345                 mutex_unlock(&dev->struct_mutex);
346                 if (written < 0)
347                         return written;
348                 else
349                         return -EINVAL;
350         }
351
352         mutex_unlock(&dev->struct_mutex);
353
354         return 0;
355 }
356
357 /**
358  * Writes data to the object referenced by handle.
359  *
360  * On error, the contents of the buffer that were to be modified are undefined.
361  */
362 int
363 i915_gem_pwrite_ioctl(struct drm_device *dev, void *data,
364                       struct drm_file *file_priv)
365 {
366         struct drm_i915_gem_pwrite *args = data;
367         struct drm_gem_object *obj;
368         struct drm_i915_gem_object *obj_priv;
369         int ret = 0;
370
371         obj = drm_gem_object_lookup(dev, file_priv, args->handle);
372         if (obj == NULL)
373                 return -EBADF;
374         obj_priv = obj->driver_private;
375
376         /* Bounds check destination.
377          *
378          * XXX: This could use review for overflow issues...
379          */
380         if (args->offset > obj->size || args->size > obj->size ||
381             args->offset + args->size > obj->size) {
382                 drm_gem_object_unreference(obj);
383                 return -EINVAL;
384         }
385
386         /* We can only do the GTT pwrite on untiled buffers, as otherwise
387          * it would end up going through the fenced access, and we'll get
388          * different detiling behavior between reading and writing.
389          * pread/pwrite currently are reading and writing from the CPU
390          * perspective, requiring manual detiling by the client.
391          */
392         if (obj_priv->phys_obj)
393                 ret = i915_gem_phys_pwrite(dev, obj, args, file_priv);
394         else if (obj_priv->tiling_mode == I915_TILING_NONE &&
395                  dev->gtt_total != 0)
396                 ret = i915_gem_gtt_pwrite(dev, obj, args, file_priv);
397         else
398                 ret = i915_gem_shmem_pwrite(dev, obj, args, file_priv);
399
400 #if WATCH_PWRITE
401         if (ret)
402                 DRM_INFO("pwrite failed %d\n", ret);
403 #endif
404
405         drm_gem_object_unreference(obj);
406
407         return ret;
408 }
409
410 /**
411  * Called when user space prepares to use an object with the CPU, either
412  * through the mmap ioctl's mapping or a GTT mapping.
413  */
414 int
415 i915_gem_set_domain_ioctl(struct drm_device *dev, void *data,
416                           struct drm_file *file_priv)
417 {
418         struct drm_i915_gem_set_domain *args = data;
419         struct drm_gem_object *obj;
420         uint32_t read_domains = args->read_domains;
421         uint32_t write_domain = args->write_domain;
422         int ret;
423
424         if (!(dev->driver->driver_features & DRIVER_GEM))
425                 return -ENODEV;
426
427         /* Only handle setting domains to types used by the CPU. */
428         if (write_domain & ~(I915_GEM_DOMAIN_CPU | I915_GEM_DOMAIN_GTT))
429                 return -EINVAL;
430
431         if (read_domains & ~(I915_GEM_DOMAIN_CPU | I915_GEM_DOMAIN_GTT))
432                 return -EINVAL;
433
434         /* Having something in the write domain implies it's in the read
435          * domain, and only that read domain.  Enforce that in the request.
436          */
437         if (write_domain != 0 && read_domains != write_domain)
438                 return -EINVAL;
439
440         obj = drm_gem_object_lookup(dev, file_priv, args->handle);
441         if (obj == NULL)
442                 return -EBADF;
443
444         mutex_lock(&dev->struct_mutex);
445 #if WATCH_BUF
446         DRM_INFO("set_domain_ioctl %p(%d), %08x %08x\n",
447                  obj, obj->size, read_domains, write_domain);
448 #endif
449         if (read_domains & I915_GEM_DOMAIN_GTT) {
450                 ret = i915_gem_object_set_to_gtt_domain(obj, write_domain != 0);
451
452                 /* Silently promote "you're not bound, there was nothing to do"
453                  * to success, since the client was just asking us to
454                  * make sure everything was done.
455                  */
456                 if (ret == -EINVAL)
457                         ret = 0;
458         } else {
459                 ret = i915_gem_object_set_to_cpu_domain(obj, write_domain != 0);
460         }
461
462         drm_gem_object_unreference(obj);
463         mutex_unlock(&dev->struct_mutex);
464         return ret;
465 }
466
467 /**
468  * Called when user space has done writes to this buffer
469  */
470 int
471 i915_gem_sw_finish_ioctl(struct drm_device *dev, void *data,
472                       struct drm_file *file_priv)
473 {
474         struct drm_i915_gem_sw_finish *args = data;
475         struct drm_gem_object *obj;
476         struct drm_i915_gem_object *obj_priv;
477         int ret = 0;
478
479         if (!(dev->driver->driver_features & DRIVER_GEM))
480                 return -ENODEV;
481
482         mutex_lock(&dev->struct_mutex);
483         obj = drm_gem_object_lookup(dev, file_priv, args->handle);
484         if (obj == NULL) {
485                 mutex_unlock(&dev->struct_mutex);
486                 return -EBADF;
487         }
488
489 #if WATCH_BUF
490         DRM_INFO("%s: sw_finish %d (%p %d)\n",
491                  __func__, args->handle, obj, obj->size);
492 #endif
493         obj_priv = obj->driver_private;
494
495         /* Pinned buffers may be scanout, so flush the cache */
496         if (obj_priv->pin_count)
497                 i915_gem_object_flush_cpu_write_domain(obj);
498
499         drm_gem_object_unreference(obj);
500         mutex_unlock(&dev->struct_mutex);
501         return ret;
502 }
503
504 /**
505  * Maps the contents of an object, returning the address it is mapped
506  * into.
507  *
508  * While the mapping holds a reference on the contents of the object, it doesn't
509  * imply a ref on the object itself.
510  */
511 int
512 i915_gem_mmap_ioctl(struct drm_device *dev, void *data,
513                    struct drm_file *file_priv)
514 {
515         struct drm_i915_gem_mmap *args = data;
516         struct drm_gem_object *obj;
517         loff_t offset;
518         unsigned long addr;
519
520         if (!(dev->driver->driver_features & DRIVER_GEM))
521                 return -ENODEV;
522
523         obj = drm_gem_object_lookup(dev, file_priv, args->handle);
524         if (obj == NULL)
525                 return -EBADF;
526
527         offset = args->offset;
528
529         down_write(&current->mm->mmap_sem);
530         addr = do_mmap(obj->filp, 0, args->size,
531                        PROT_READ | PROT_WRITE, MAP_SHARED,
532                        args->offset);
533         up_write(&current->mm->mmap_sem);
534         mutex_lock(&dev->struct_mutex);
535         drm_gem_object_unreference(obj);
536         mutex_unlock(&dev->struct_mutex);
537         if (IS_ERR((void *)addr))
538                 return addr;
539
540         args->addr_ptr = (uint64_t) addr;
541
542         return 0;
543 }
544
545 /**
546  * i915_gem_fault - fault a page into the GTT
547  * vma: VMA in question
548  * vmf: fault info
549  *
550  * The fault handler is set up by drm_gem_mmap() when a object is GTT mapped
551  * from userspace.  The fault handler takes care of binding the object to
552  * the GTT (if needed), allocating and programming a fence register (again,
553  * only if needed based on whether the old reg is still valid or the object
554  * is tiled) and inserting a new PTE into the faulting process.
555  *
556  * Note that the faulting process may involve evicting existing objects
557  * from the GTT and/or fence registers to make room.  So performance may
558  * suffer if the GTT working set is large or there are few fence registers
559  * left.
560  */
561 int i915_gem_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
562 {
563         struct drm_gem_object *obj = vma->vm_private_data;
564         struct drm_device *dev = obj->dev;
565         struct drm_i915_private *dev_priv = dev->dev_private;
566         struct drm_i915_gem_object *obj_priv = obj->driver_private;
567         pgoff_t page_offset;
568         unsigned long pfn;
569         int ret = 0;
570
571         /* We don't use vmf->pgoff since that has the fake offset */
572         page_offset = ((unsigned long)vmf->virtual_address - vma->vm_start) >>
573                 PAGE_SHIFT;
574
575         /* Now bind it into the GTT if needed */
576         mutex_lock(&dev->struct_mutex);
577         if (!obj_priv->gtt_space) {
578                 ret = i915_gem_object_bind_to_gtt(obj, obj_priv->gtt_alignment);
579                 if (ret) {
580                         mutex_unlock(&dev->struct_mutex);
581                         return VM_FAULT_SIGBUS;
582                 }
583                 list_add(&obj_priv->list, &dev_priv->mm.inactive_list);
584         }
585
586         /* Need a new fence register? */
587         if (obj_priv->fence_reg == I915_FENCE_REG_NONE &&
588             obj_priv->tiling_mode != I915_TILING_NONE)
589                 i915_gem_object_get_fence_reg(obj);
590
591         pfn = ((dev->agp->base + obj_priv->gtt_offset) >> PAGE_SHIFT) +
592                 page_offset;
593
594         /* Finally, remap it using the new GTT offset */
595         ret = vm_insert_pfn(vma, (unsigned long)vmf->virtual_address, pfn);
596
597         mutex_unlock(&dev->struct_mutex);
598
599         switch (ret) {
600         case -ENOMEM:
601         case -EAGAIN:
602                 return VM_FAULT_OOM;
603         case -EFAULT:
604         case -EBUSY:
605                 DRM_ERROR("can't insert pfn??  fault or busy...\n");
606                 return VM_FAULT_SIGBUS;
607         default:
608                 return VM_FAULT_NOPAGE;
609         }
610 }
611
612 /**
613  * i915_gem_create_mmap_offset - create a fake mmap offset for an object
614  * @obj: obj in question
615  *
616  * GEM memory mapping works by handing back to userspace a fake mmap offset
617  * it can use in a subsequent mmap(2) call.  The DRM core code then looks
618  * up the object based on the offset and sets up the various memory mapping
619  * structures.
620  *
621  * This routine allocates and attaches a fake offset for @obj.
622  */
623 static int
624 i915_gem_create_mmap_offset(struct drm_gem_object *obj)
625 {
626         struct drm_device *dev = obj->dev;
627         struct drm_gem_mm *mm = dev->mm_private;
628         struct drm_i915_gem_object *obj_priv = obj->driver_private;
629         struct drm_map_list *list;
630         struct drm_map *map;
631         int ret = 0;
632
633         /* Set the object up for mmap'ing */
634         list = &obj->map_list;
635         list->map = drm_calloc(1, sizeof(struct drm_map_list),
636                                DRM_MEM_DRIVER);
637         if (!list->map)
638                 return -ENOMEM;
639
640         map = list->map;
641         map->type = _DRM_GEM;
642         map->size = obj->size;
643         map->handle = obj;
644
645         /* Get a DRM GEM mmap offset allocated... */
646         list->file_offset_node = drm_mm_search_free(&mm->offset_manager,
647                                                     obj->size / PAGE_SIZE, 0, 0);
648         if (!list->file_offset_node) {
649                 DRM_ERROR("failed to allocate offset for bo %d\n", obj->name);
650                 ret = -ENOMEM;
651                 goto out_free_list;
652         }
653
654         list->file_offset_node = drm_mm_get_block(list->file_offset_node,
655                                                   obj->size / PAGE_SIZE, 0);
656         if (!list->file_offset_node) {
657                 ret = -ENOMEM;
658                 goto out_free_list;
659         }
660
661         list->hash.key = list->file_offset_node->start;
662         if (drm_ht_insert_item(&mm->offset_hash, &list->hash)) {
663                 DRM_ERROR("failed to add to map hash\n");
664                 goto out_free_mm;
665         }
666
667         /* By now we should be all set, any drm_mmap request on the offset
668          * below will get to our mmap & fault handler */
669         obj_priv->mmap_offset = ((uint64_t) list->hash.key) << PAGE_SHIFT;
670
671         return 0;
672
673 out_free_mm:
674         drm_mm_put_block(list->file_offset_node);
675 out_free_list:
676         drm_free(list->map, sizeof(struct drm_map_list), DRM_MEM_DRIVER);
677
678         return ret;
679 }
680
681 /**
682  * i915_gem_get_gtt_alignment - return required GTT alignment for an object
683  * @obj: object to check
684  *
685  * Return the required GTT alignment for an object, taking into account
686  * potential fence register mapping if needed.
687  */
688 static uint32_t
689 i915_gem_get_gtt_alignment(struct drm_gem_object *obj)
690 {
691         struct drm_device *dev = obj->dev;
692         struct drm_i915_gem_object *obj_priv = obj->driver_private;
693         int start, i;
694
695         /*
696          * Minimum alignment is 4k (GTT page size), but might be greater
697          * if a fence register is needed for the object.
698          */
699         if (IS_I965G(dev) || obj_priv->tiling_mode == I915_TILING_NONE)
700                 return 4096;
701
702         /*
703          * Previous chips need to be aligned to the size of the smallest
704          * fence register that can contain the object.
705          */
706         if (IS_I9XX(dev))
707                 start = 1024*1024;
708         else
709                 start = 512*1024;
710
711         for (i = start; i < obj->size; i <<= 1)
712                 ;
713
714         return i;
715 }
716
717 /**
718  * i915_gem_mmap_gtt_ioctl - prepare an object for GTT mmap'ing
719  * @dev: DRM device
720  * @data: GTT mapping ioctl data
721  * @file_priv: GEM object info
722  *
723  * Simply returns the fake offset to userspace so it can mmap it.
724  * The mmap call will end up in drm_gem_mmap(), which will set things
725  * up so we can get faults in the handler above.
726  *
727  * The fault handler will take care of binding the object into the GTT
728  * (since it may have been evicted to make room for something), allocating
729  * a fence register, and mapping the appropriate aperture address into
730  * userspace.
731  */
732 int
733 i915_gem_mmap_gtt_ioctl(struct drm_device *dev, void *data,
734                         struct drm_file *file_priv)
735 {
736         struct drm_i915_gem_mmap_gtt *args = data;
737         struct drm_i915_private *dev_priv = dev->dev_private;
738         struct drm_gem_object *obj;
739         struct drm_i915_gem_object *obj_priv;
740         int ret;
741
742         if (!(dev->driver->driver_features & DRIVER_GEM))
743                 return -ENODEV;
744
745         obj = drm_gem_object_lookup(dev, file_priv, args->handle);
746         if (obj == NULL)
747                 return -EBADF;
748
749         mutex_lock(&dev->struct_mutex);
750
751         obj_priv = obj->driver_private;
752
753         if (!obj_priv->mmap_offset) {
754                 ret = i915_gem_create_mmap_offset(obj);
755                 if (ret)
756                         return ret;
757         }
758
759         args->offset = obj_priv->mmap_offset;
760
761         obj_priv->gtt_alignment = i915_gem_get_gtt_alignment(obj);
762
763         /* Make sure the alignment is correct for fence regs etc */
764         if (obj_priv->agp_mem &&
765             (obj_priv->gtt_offset & (obj_priv->gtt_alignment - 1))) {
766                 drm_gem_object_unreference(obj);
767                 mutex_unlock(&dev->struct_mutex);
768                 return -EINVAL;
769         }
770
771         /*
772          * Pull it into the GTT so that we have a page list (makes the
773          * initial fault faster and any subsequent flushing possible).
774          */
775         if (!obj_priv->agp_mem) {
776                 ret = i915_gem_object_bind_to_gtt(obj, obj_priv->gtt_alignment);
777                 if (ret) {
778                         drm_gem_object_unreference(obj);
779                         mutex_unlock(&dev->struct_mutex);
780                         return ret;
781                 }
782                 list_add(&obj_priv->list, &dev_priv->mm.inactive_list);
783         }
784
785         drm_gem_object_unreference(obj);
786         mutex_unlock(&dev->struct_mutex);
787
788         return 0;
789 }
790
791 static void
792 i915_gem_object_free_page_list(struct drm_gem_object *obj)
793 {
794         struct drm_i915_gem_object *obj_priv = obj->driver_private;
795         int page_count = obj->size / PAGE_SIZE;
796         int i;
797
798         if (obj_priv->page_list == NULL)
799                 return;
800
801
802         for (i = 0; i < page_count; i++)
803                 if (obj_priv->page_list[i] != NULL) {
804                         if (obj_priv->dirty)
805                                 set_page_dirty(obj_priv->page_list[i]);
806                         mark_page_accessed(obj_priv->page_list[i]);
807                         page_cache_release(obj_priv->page_list[i]);
808                 }
809         obj_priv->dirty = 0;
810
811         drm_free(obj_priv->page_list,
812                  page_count * sizeof(struct page *),
813                  DRM_MEM_DRIVER);
814         obj_priv->page_list = NULL;
815 }
816
817 static void
818 i915_gem_object_move_to_active(struct drm_gem_object *obj, uint32_t seqno)
819 {
820         struct drm_device *dev = obj->dev;
821         drm_i915_private_t *dev_priv = dev->dev_private;
822         struct drm_i915_gem_object *obj_priv = obj->driver_private;
823
824         /* Add a reference if we're newly entering the active list. */
825         if (!obj_priv->active) {
826                 drm_gem_object_reference(obj);
827                 obj_priv->active = 1;
828         }
829         /* Move from whatever list we were on to the tail of execution. */
830         list_move_tail(&obj_priv->list,
831                        &dev_priv->mm.active_list);
832         obj_priv->last_rendering_seqno = seqno;
833 }
834
835 static void
836 i915_gem_object_move_to_flushing(struct drm_gem_object *obj)
837 {
838         struct drm_device *dev = obj->dev;
839         drm_i915_private_t *dev_priv = dev->dev_private;
840         struct drm_i915_gem_object *obj_priv = obj->driver_private;
841
842         BUG_ON(!obj_priv->active);
843         list_move_tail(&obj_priv->list, &dev_priv->mm.flushing_list);
844         obj_priv->last_rendering_seqno = 0;
845 }
846
847 static void
848 i915_gem_object_move_to_inactive(struct drm_gem_object *obj)
849 {
850         struct drm_device *dev = obj->dev;
851         drm_i915_private_t *dev_priv = dev->dev_private;
852         struct drm_i915_gem_object *obj_priv = obj->driver_private;
853
854         i915_verify_inactive(dev, __FILE__, __LINE__);
855         if (obj_priv->pin_count != 0)
856                 list_del_init(&obj_priv->list);
857         else
858                 list_move_tail(&obj_priv->list, &dev_priv->mm.inactive_list);
859
860         obj_priv->last_rendering_seqno = 0;
861         if (obj_priv->active) {
862                 obj_priv->active = 0;
863                 drm_gem_object_unreference(obj);
864         }
865         i915_verify_inactive(dev, __FILE__, __LINE__);
866 }
867
868 /**
869  * Creates a new sequence number, emitting a write of it to the status page
870  * plus an interrupt, which will trigger i915_user_interrupt_handler.
871  *
872  * Must be called with struct_lock held.
873  *
874  * Returned sequence numbers are nonzero on success.
875  */
876 static uint32_t
877 i915_add_request(struct drm_device *dev, uint32_t flush_domains)
878 {
879         drm_i915_private_t *dev_priv = dev->dev_private;
880         struct drm_i915_gem_request *request;
881         uint32_t seqno;
882         int was_empty;
883         RING_LOCALS;
884
885         request = drm_calloc(1, sizeof(*request), DRM_MEM_DRIVER);
886         if (request == NULL)
887                 return 0;
888
889         /* Grab the seqno we're going to make this request be, and bump the
890          * next (skipping 0 so it can be the reserved no-seqno value).
891          */
892         seqno = dev_priv->mm.next_gem_seqno;
893         dev_priv->mm.next_gem_seqno++;
894         if (dev_priv->mm.next_gem_seqno == 0)
895                 dev_priv->mm.next_gem_seqno++;
896
897         BEGIN_LP_RING(4);
898         OUT_RING(MI_STORE_DWORD_INDEX);
899         OUT_RING(I915_GEM_HWS_INDEX << MI_STORE_DWORD_INDEX_SHIFT);
900         OUT_RING(seqno);
901
902         OUT_RING(MI_USER_INTERRUPT);
903         ADVANCE_LP_RING();
904
905         DRM_DEBUG("%d\n", seqno);
906
907         request->seqno = seqno;
908         request->emitted_jiffies = jiffies;
909         was_empty = list_empty(&dev_priv->mm.request_list);
910         list_add_tail(&request->list, &dev_priv->mm.request_list);
911
912         /* Associate any objects on the flushing list matching the write
913          * domain we're flushing with our flush.
914          */
915         if (flush_domains != 0) {
916                 struct drm_i915_gem_object *obj_priv, *next;
917
918                 list_for_each_entry_safe(obj_priv, next,
919                                          &dev_priv->mm.flushing_list, list) {
920                         struct drm_gem_object *obj = obj_priv->obj;
921
922                         if ((obj->write_domain & flush_domains) ==
923                             obj->write_domain) {
924                                 obj->write_domain = 0;
925                                 i915_gem_object_move_to_active(obj, seqno);
926                         }
927                 }
928
929         }
930
931         if (was_empty && !dev_priv->mm.suspended)
932                 schedule_delayed_work(&dev_priv->mm.retire_work, HZ);
933         return seqno;
934 }
935
936 /**
937  * Command execution barrier
938  *
939  * Ensures that all commands in the ring are finished
940  * before signalling the CPU
941  */
942 static uint32_t
943 i915_retire_commands(struct drm_device *dev)
944 {
945         drm_i915_private_t *dev_priv = dev->dev_private;
946         uint32_t cmd = MI_FLUSH | MI_NO_WRITE_FLUSH;
947         uint32_t flush_domains = 0;
948         RING_LOCALS;
949
950         /* The sampler always gets flushed on i965 (sigh) */
951         if (IS_I965G(dev))
952                 flush_domains |= I915_GEM_DOMAIN_SAMPLER;
953         BEGIN_LP_RING(2);
954         OUT_RING(cmd);
955         OUT_RING(0); /* noop */
956         ADVANCE_LP_RING();
957         return flush_domains;
958 }
959
960 /**
961  * Moves buffers associated only with the given active seqno from the active
962  * to inactive list, potentially freeing them.
963  */
964 static void
965 i915_gem_retire_request(struct drm_device *dev,
966                         struct drm_i915_gem_request *request)
967 {
968         drm_i915_private_t *dev_priv = dev->dev_private;
969
970         /* Move any buffers on the active list that are no longer referenced
971          * by the ringbuffer to the flushing/inactive lists as appropriate.
972          */
973         while (!list_empty(&dev_priv->mm.active_list)) {
974                 struct drm_gem_object *obj;
975                 struct drm_i915_gem_object *obj_priv;
976
977                 obj_priv = list_first_entry(&dev_priv->mm.active_list,
978                                             struct drm_i915_gem_object,
979                                             list);
980                 obj = obj_priv->obj;
981
982                 /* If the seqno being retired doesn't match the oldest in the
983                  * list, then the oldest in the list must still be newer than
984                  * this seqno.
985                  */
986                 if (obj_priv->last_rendering_seqno != request->seqno)
987                         return;
988
989 #if WATCH_LRU
990                 DRM_INFO("%s: retire %d moves to inactive list %p\n",
991                          __func__, request->seqno, obj);
992 #endif
993
994                 if (obj->write_domain != 0)
995                         i915_gem_object_move_to_flushing(obj);
996                 else
997                         i915_gem_object_move_to_inactive(obj);
998         }
999 }
1000
1001 /**
1002  * Returns true if seq1 is later than seq2.
1003  */
1004 static int
1005 i915_seqno_passed(uint32_t seq1, uint32_t seq2)
1006 {
1007         return (int32_t)(seq1 - seq2) >= 0;
1008 }
1009
1010 uint32_t
1011 i915_get_gem_seqno(struct drm_device *dev)
1012 {
1013         drm_i915_private_t *dev_priv = dev->dev_private;
1014
1015         return READ_HWSP(dev_priv, I915_GEM_HWS_INDEX);
1016 }
1017
1018 /**
1019  * This function clears the request list as sequence numbers are passed.
1020  */
1021 void
1022 i915_gem_retire_requests(struct drm_device *dev)
1023 {
1024         drm_i915_private_t *dev_priv = dev->dev_private;
1025         uint32_t seqno;
1026
1027         seqno = i915_get_gem_seqno(dev);
1028
1029         while (!list_empty(&dev_priv->mm.request_list)) {
1030                 struct drm_i915_gem_request *request;
1031                 uint32_t retiring_seqno;
1032
1033                 request = list_first_entry(&dev_priv->mm.request_list,
1034                                            struct drm_i915_gem_request,
1035                                            list);
1036                 retiring_seqno = request->seqno;
1037
1038                 if (i915_seqno_passed(seqno, retiring_seqno) ||
1039                     dev_priv->mm.wedged) {
1040                         i915_gem_retire_request(dev, request);
1041
1042                         list_del(&request->list);
1043                         drm_free(request, sizeof(*request), DRM_MEM_DRIVER);
1044                 } else
1045                         break;
1046         }
1047 }
1048
1049 void
1050 i915_gem_retire_work_handler(struct work_struct *work)
1051 {
1052         drm_i915_private_t *dev_priv;
1053         struct drm_device *dev;
1054
1055         dev_priv = container_of(work, drm_i915_private_t,
1056                                 mm.retire_work.work);
1057         dev = dev_priv->dev;
1058
1059         mutex_lock(&dev->struct_mutex);
1060         i915_gem_retire_requests(dev);
1061         if (!dev_priv->mm.suspended &&
1062             !list_empty(&dev_priv->mm.request_list))
1063                 schedule_delayed_work(&dev_priv->mm.retire_work, HZ);
1064         mutex_unlock(&dev->struct_mutex);
1065 }
1066
1067 /**
1068  * Waits for a sequence number to be signaled, and cleans up the
1069  * request and object lists appropriately for that event.
1070  */
1071 static int
1072 i915_wait_request(struct drm_device *dev, uint32_t seqno)
1073 {
1074         drm_i915_private_t *dev_priv = dev->dev_private;
1075         int ret = 0;
1076
1077         BUG_ON(seqno == 0);
1078
1079         if (!i915_seqno_passed(i915_get_gem_seqno(dev), seqno)) {
1080                 dev_priv->mm.waiting_gem_seqno = seqno;
1081                 i915_user_irq_get(dev);
1082                 ret = wait_event_interruptible(dev_priv->irq_queue,
1083                                                i915_seqno_passed(i915_get_gem_seqno(dev),
1084                                                                  seqno) ||
1085                                                dev_priv->mm.wedged);
1086                 i915_user_irq_put(dev);
1087                 dev_priv->mm.waiting_gem_seqno = 0;
1088         }
1089         if (dev_priv->mm.wedged)
1090                 ret = -EIO;
1091
1092         if (ret && ret != -ERESTARTSYS)
1093                 DRM_ERROR("%s returns %d (awaiting %d at %d)\n",
1094                           __func__, ret, seqno, i915_get_gem_seqno(dev));
1095
1096         /* Directly dispatch request retiring.  While we have the work queue
1097          * to handle this, the waiter on a request often wants an associated
1098          * buffer to have made it to the inactive list, and we would need
1099          * a separate wait queue to handle that.
1100          */
1101         if (ret == 0)
1102                 i915_gem_retire_requests(dev);
1103
1104         return ret;
1105 }
1106
1107 static void
1108 i915_gem_flush(struct drm_device *dev,
1109                uint32_t invalidate_domains,
1110                uint32_t flush_domains)
1111 {
1112         drm_i915_private_t *dev_priv = dev->dev_private;
1113         uint32_t cmd;
1114         RING_LOCALS;
1115
1116 #if WATCH_EXEC
1117         DRM_INFO("%s: invalidate %08x flush %08x\n", __func__,
1118                   invalidate_domains, flush_domains);
1119 #endif
1120
1121         if (flush_domains & I915_GEM_DOMAIN_CPU)
1122                 drm_agp_chipset_flush(dev);
1123
1124         if ((invalidate_domains | flush_domains) & ~(I915_GEM_DOMAIN_CPU |
1125                                                      I915_GEM_DOMAIN_GTT)) {
1126                 /*
1127                  * read/write caches:
1128                  *
1129                  * I915_GEM_DOMAIN_RENDER is always invalidated, but is
1130                  * only flushed if MI_NO_WRITE_FLUSH is unset.  On 965, it is
1131                  * also flushed at 2d versus 3d pipeline switches.
1132                  *
1133                  * read-only caches:
1134                  *
1135                  * I915_GEM_DOMAIN_SAMPLER is flushed on pre-965 if
1136                  * MI_READ_FLUSH is set, and is always flushed on 965.
1137                  *
1138                  * I915_GEM_DOMAIN_COMMAND may not exist?
1139                  *
1140                  * I915_GEM_DOMAIN_INSTRUCTION, which exists on 965, is
1141                  * invalidated when MI_EXE_FLUSH is set.
1142                  *
1143                  * I915_GEM_DOMAIN_VERTEX, which exists on 965, is
1144                  * invalidated with every MI_FLUSH.
1145                  *
1146                  * TLBs:
1147                  *
1148                  * On 965, TLBs associated with I915_GEM_DOMAIN_COMMAND
1149                  * and I915_GEM_DOMAIN_CPU in are invalidated at PTE write and
1150                  * I915_GEM_DOMAIN_RENDER and I915_GEM_DOMAIN_SAMPLER
1151                  * are flushed at any MI_FLUSH.
1152                  */
1153
1154                 cmd = MI_FLUSH | MI_NO_WRITE_FLUSH;
1155                 if ((invalidate_domains|flush_domains) &
1156                     I915_GEM_DOMAIN_RENDER)
1157                         cmd &= ~MI_NO_WRITE_FLUSH;
1158                 if (!IS_I965G(dev)) {
1159                         /*
1160                          * On the 965, the sampler cache always gets flushed
1161                          * and this bit is reserved.
1162                          */
1163                         if (invalidate_domains & I915_GEM_DOMAIN_SAMPLER)
1164                                 cmd |= MI_READ_FLUSH;
1165                 }
1166                 if (invalidate_domains & I915_GEM_DOMAIN_INSTRUCTION)
1167                         cmd |= MI_EXE_FLUSH;
1168
1169 #if WATCH_EXEC
1170                 DRM_INFO("%s: queue flush %08x to ring\n", __func__, cmd);
1171 #endif
1172                 BEGIN_LP_RING(2);
1173                 OUT_RING(cmd);
1174                 OUT_RING(0); /* noop */
1175                 ADVANCE_LP_RING();
1176         }
1177 }
1178
1179 /**
1180  * Ensures that all rendering to the object has completed and the object is
1181  * safe to unbind from the GTT or access from the CPU.
1182  */
1183 static int
1184 i915_gem_object_wait_rendering(struct drm_gem_object *obj)
1185 {
1186         struct drm_device *dev = obj->dev;
1187         struct drm_i915_gem_object *obj_priv = obj->driver_private;
1188         int ret;
1189
1190         /* This function only exists to support waiting for existing rendering,
1191          * not for emitting required flushes.
1192          */
1193         BUG_ON((obj->write_domain & I915_GEM_GPU_DOMAINS) != 0);
1194
1195         /* If there is rendering queued on the buffer being evicted, wait for
1196          * it.
1197          */
1198         if (obj_priv->active) {
1199 #if WATCH_BUF
1200                 DRM_INFO("%s: object %p wait for seqno %08x\n",
1201                           __func__, obj, obj_priv->last_rendering_seqno);
1202 #endif
1203                 ret = i915_wait_request(dev, obj_priv->last_rendering_seqno);
1204                 if (ret != 0)
1205                         return ret;
1206         }
1207
1208         return 0;
1209 }
1210
1211 /**
1212  * Unbinds an object from the GTT aperture.
1213  */
1214 static int
1215 i915_gem_object_unbind(struct drm_gem_object *obj)
1216 {
1217         struct drm_device *dev = obj->dev;
1218         struct drm_i915_gem_object *obj_priv = obj->driver_private;
1219         loff_t offset;
1220         int ret = 0;
1221
1222 #if WATCH_BUF
1223         DRM_INFO("%s:%d %p\n", __func__, __LINE__, obj);
1224         DRM_INFO("gtt_space %p\n", obj_priv->gtt_space);
1225 #endif
1226         if (obj_priv->gtt_space == NULL)
1227                 return 0;
1228
1229         if (obj_priv->pin_count != 0) {
1230                 DRM_ERROR("Attempting to unbind pinned buffer\n");
1231                 return -EINVAL;
1232         }
1233
1234         /* Move the object to the CPU domain to ensure that
1235          * any possible CPU writes while it's not in the GTT
1236          * are flushed when we go to remap it. This will
1237          * also ensure that all pending GPU writes are finished
1238          * before we unbind.
1239          */
1240         ret = i915_gem_object_set_to_cpu_domain(obj, 1);
1241         if (ret) {
1242                 if (ret != -ERESTARTSYS)
1243                         DRM_ERROR("set_domain failed: %d\n", ret);
1244                 return ret;
1245         }
1246
1247         if (obj_priv->agp_mem != NULL) {
1248                 drm_unbind_agp(obj_priv->agp_mem);
1249                 drm_free_agp(obj_priv->agp_mem, obj->size / PAGE_SIZE);
1250                 obj_priv->agp_mem = NULL;
1251         }
1252
1253         BUG_ON(obj_priv->active);
1254
1255         /* blow away mappings if mapped through GTT */
1256         offset = ((loff_t) obj->map_list.hash.key) << PAGE_SHIFT;
1257         if (dev->dev_mapping)
1258                 unmap_mapping_range(dev->dev_mapping, offset, obj->size, 1);
1259
1260         if (obj_priv->fence_reg != I915_FENCE_REG_NONE)
1261                 i915_gem_clear_fence_reg(obj);
1262
1263         i915_gem_object_free_page_list(obj);
1264
1265         if (obj_priv->gtt_space) {
1266                 atomic_dec(&dev->gtt_count);
1267                 atomic_sub(obj->size, &dev->gtt_memory);
1268
1269                 drm_mm_put_block(obj_priv->gtt_space);
1270                 obj_priv->gtt_space = NULL;
1271         }
1272
1273         /* Remove ourselves from the LRU list if present. */
1274         if (!list_empty(&obj_priv->list))
1275                 list_del_init(&obj_priv->list);
1276
1277         return 0;
1278 }
1279
1280 static int
1281 i915_gem_evict_something(struct drm_device *dev)
1282 {
1283         drm_i915_private_t *dev_priv = dev->dev_private;
1284         struct drm_gem_object *obj;
1285         struct drm_i915_gem_object *obj_priv;
1286         int ret = 0;
1287
1288         for (;;) {
1289                 /* If there's an inactive buffer available now, grab it
1290                  * and be done.
1291                  */
1292                 if (!list_empty(&dev_priv->mm.inactive_list)) {
1293                         obj_priv = list_first_entry(&dev_priv->mm.inactive_list,
1294                                                     struct drm_i915_gem_object,
1295                                                     list);
1296                         obj = obj_priv->obj;
1297                         BUG_ON(obj_priv->pin_count != 0);
1298 #if WATCH_LRU
1299                         DRM_INFO("%s: evicting %p\n", __func__, obj);
1300 #endif
1301                         BUG_ON(obj_priv->active);
1302
1303                         /* Wait on the rendering and unbind the buffer. */
1304                         ret = i915_gem_object_unbind(obj);
1305                         break;
1306                 }
1307
1308                 /* If we didn't get anything, but the ring is still processing
1309                  * things, wait for one of those things to finish and hopefully
1310                  * leave us a buffer to evict.
1311                  */
1312                 if (!list_empty(&dev_priv->mm.request_list)) {
1313                         struct drm_i915_gem_request *request;
1314
1315                         request = list_first_entry(&dev_priv->mm.request_list,
1316                                                    struct drm_i915_gem_request,
1317                                                    list);
1318
1319                         ret = i915_wait_request(dev, request->seqno);
1320                         if (ret)
1321                                 break;
1322
1323                         /* if waiting caused an object to become inactive,
1324                          * then loop around and wait for it. Otherwise, we
1325                          * assume that waiting freed and unbound something,
1326                          * so there should now be some space in the GTT
1327                          */
1328                         if (!list_empty(&dev_priv->mm.inactive_list))
1329                                 continue;
1330                         break;
1331                 }
1332
1333                 /* If we didn't have anything on the request list but there
1334                  * are buffers awaiting a flush, emit one and try again.
1335                  * When we wait on it, those buffers waiting for that flush
1336                  * will get moved to inactive.
1337                  */
1338                 if (!list_empty(&dev_priv->mm.flushing_list)) {
1339                         obj_priv = list_first_entry(&dev_priv->mm.flushing_list,
1340                                                     struct drm_i915_gem_object,
1341                                                     list);
1342                         obj = obj_priv->obj;
1343
1344                         i915_gem_flush(dev,
1345                                        obj->write_domain,
1346                                        obj->write_domain);
1347                         i915_add_request(dev, obj->write_domain);
1348
1349                         obj = NULL;
1350                         continue;
1351                 }
1352
1353                 DRM_ERROR("inactive empty %d request empty %d "
1354                           "flushing empty %d\n",
1355                           list_empty(&dev_priv->mm.inactive_list),
1356                           list_empty(&dev_priv->mm.request_list),
1357                           list_empty(&dev_priv->mm.flushing_list));
1358                 /* If we didn't do any of the above, there's nothing to be done
1359                  * and we just can't fit it in.
1360                  */
1361                 return -ENOMEM;
1362         }
1363         return ret;
1364 }
1365
1366 static int
1367 i915_gem_evict_everything(struct drm_device *dev)
1368 {
1369         int ret;
1370
1371         for (;;) {
1372                 ret = i915_gem_evict_something(dev);
1373                 if (ret != 0)
1374                         break;
1375         }
1376         if (ret == -ENOMEM)
1377                 return 0;
1378         return ret;
1379 }
1380
1381 static int
1382 i915_gem_object_get_page_list(struct drm_gem_object *obj)
1383 {
1384         struct drm_i915_gem_object *obj_priv = obj->driver_private;
1385         int page_count, i;
1386         struct address_space *mapping;
1387         struct inode *inode;
1388         struct page *page;
1389         int ret;
1390
1391         if (obj_priv->page_list)
1392                 return 0;
1393
1394         /* Get the list of pages out of our struct file.  They'll be pinned
1395          * at this point until we release them.
1396          */
1397         page_count = obj->size / PAGE_SIZE;
1398         BUG_ON(obj_priv->page_list != NULL);
1399         obj_priv->page_list = drm_calloc(page_count, sizeof(struct page *),
1400                                          DRM_MEM_DRIVER);
1401         if (obj_priv->page_list == NULL) {
1402                 DRM_ERROR("Faled to allocate page list\n");
1403                 return -ENOMEM;
1404         }
1405
1406         inode = obj->filp->f_path.dentry->d_inode;
1407         mapping = inode->i_mapping;
1408         for (i = 0; i < page_count; i++) {
1409                 page = read_mapping_page(mapping, i, NULL);
1410                 if (IS_ERR(page)) {
1411                         ret = PTR_ERR(page);
1412                         DRM_ERROR("read_mapping_page failed: %d\n", ret);
1413                         i915_gem_object_free_page_list(obj);
1414                         return ret;
1415                 }
1416                 obj_priv->page_list[i] = page;
1417         }
1418         return 0;
1419 }
1420
1421 static void i965_write_fence_reg(struct drm_i915_fence_reg *reg)
1422 {
1423         struct drm_gem_object *obj = reg->obj;
1424         struct drm_device *dev = obj->dev;
1425         drm_i915_private_t *dev_priv = dev->dev_private;
1426         struct drm_i915_gem_object *obj_priv = obj->driver_private;
1427         int regnum = obj_priv->fence_reg;
1428         uint64_t val;
1429
1430         val = (uint64_t)((obj_priv->gtt_offset + obj->size - 4096) &
1431                     0xfffff000) << 32;
1432         val |= obj_priv->gtt_offset & 0xfffff000;
1433         val |= ((obj_priv->stride / 128) - 1) << I965_FENCE_PITCH_SHIFT;
1434         if (obj_priv->tiling_mode == I915_TILING_Y)
1435                 val |= 1 << I965_FENCE_TILING_Y_SHIFT;
1436         val |= I965_FENCE_REG_VALID;
1437
1438         I915_WRITE64(FENCE_REG_965_0 + (regnum * 8), val);
1439 }
1440
1441 static void i915_write_fence_reg(struct drm_i915_fence_reg *reg)
1442 {
1443         struct drm_gem_object *obj = reg->obj;
1444         struct drm_device *dev = obj->dev;
1445         drm_i915_private_t *dev_priv = dev->dev_private;
1446         struct drm_i915_gem_object *obj_priv = obj->driver_private;
1447         int regnum = obj_priv->fence_reg;
1448         uint32_t val;
1449         uint32_t pitch_val;
1450
1451         if ((obj_priv->gtt_offset & ~I915_FENCE_START_MASK) ||
1452             (obj_priv->gtt_offset & (obj->size - 1))) {
1453                 WARN(1, "%s: object not 1M or size aligned\n", __func__);
1454                 return;
1455         }
1456
1457         if (obj_priv->tiling_mode == I915_TILING_Y && (IS_I945G(dev) ||
1458                                                        IS_I945GM(dev) ||
1459                                                        IS_G33(dev)))
1460                 pitch_val = (obj_priv->stride / 128) - 1;
1461         else
1462                 pitch_val = (obj_priv->stride / 512) - 1;
1463
1464         val = obj_priv->gtt_offset;
1465         if (obj_priv->tiling_mode == I915_TILING_Y)
1466                 val |= 1 << I830_FENCE_TILING_Y_SHIFT;
1467         val |= I915_FENCE_SIZE_BITS(obj->size);
1468         val |= pitch_val << I830_FENCE_PITCH_SHIFT;
1469         val |= I830_FENCE_REG_VALID;
1470
1471         I915_WRITE(FENCE_REG_830_0 + (regnum * 4), val);
1472 }
1473
1474 static void i830_write_fence_reg(struct drm_i915_fence_reg *reg)
1475 {
1476         struct drm_gem_object *obj = reg->obj;
1477         struct drm_device *dev = obj->dev;
1478         drm_i915_private_t *dev_priv = dev->dev_private;
1479         struct drm_i915_gem_object *obj_priv = obj->driver_private;
1480         int regnum = obj_priv->fence_reg;
1481         uint32_t val;
1482         uint32_t pitch_val;
1483
1484         if ((obj_priv->gtt_offset & ~I915_FENCE_START_MASK) ||
1485             (obj_priv->gtt_offset & (obj->size - 1))) {
1486                 WARN(1, "%s: object not 1M or size aligned\n", __func__);
1487                 return;
1488         }
1489
1490         pitch_val = (obj_priv->stride / 128) - 1;
1491
1492         val = obj_priv->gtt_offset;
1493         if (obj_priv->tiling_mode == I915_TILING_Y)
1494                 val |= 1 << I830_FENCE_TILING_Y_SHIFT;
1495         val |= I830_FENCE_SIZE_BITS(obj->size);
1496         val |= pitch_val << I830_FENCE_PITCH_SHIFT;
1497         val |= I830_FENCE_REG_VALID;
1498
1499         I915_WRITE(FENCE_REG_830_0 + (regnum * 4), val);
1500
1501 }
1502
1503 /**
1504  * i915_gem_object_get_fence_reg - set up a fence reg for an object
1505  * @obj: object to map through a fence reg
1506  *
1507  * When mapping objects through the GTT, userspace wants to be able to write
1508  * to them without having to worry about swizzling if the object is tiled.
1509  *
1510  * This function walks the fence regs looking for a free one for @obj,
1511  * stealing one if it can't find any.
1512  *
1513  * It then sets up the reg based on the object's properties: address, pitch
1514  * and tiling format.
1515  */
1516 static void
1517 i915_gem_object_get_fence_reg(struct drm_gem_object *obj)
1518 {
1519         struct drm_device *dev = obj->dev;
1520         struct drm_i915_private *dev_priv = dev->dev_private;
1521         struct drm_i915_gem_object *obj_priv = obj->driver_private;
1522         struct drm_i915_fence_reg *reg = NULL;
1523         int i, ret;
1524
1525         switch (obj_priv->tiling_mode) {
1526         case I915_TILING_NONE:
1527                 WARN(1, "allocating a fence for non-tiled object?\n");
1528                 break;
1529         case I915_TILING_X:
1530                 WARN(obj_priv->stride & (512 - 1),
1531                      "object is X tiled but has non-512B pitch\n");
1532                 break;
1533         case I915_TILING_Y:
1534                 WARN(obj_priv->stride & (128 - 1),
1535                      "object is Y tiled but has non-128B pitch\n");
1536                 break;
1537         }
1538
1539         /* First try to find a free reg */
1540         for (i = dev_priv->fence_reg_start; i < dev_priv->num_fence_regs; i++) {
1541                 reg = &dev_priv->fence_regs[i];
1542                 if (!reg->obj)
1543                         break;
1544         }
1545
1546         /* None available, try to steal one or wait for a user to finish */
1547         if (i == dev_priv->num_fence_regs) {
1548                 struct drm_i915_gem_object *old_obj_priv = NULL;
1549                 loff_t offset;
1550
1551 try_again:
1552                 /* Could try to use LRU here instead... */
1553                 for (i = dev_priv->fence_reg_start;
1554                      i < dev_priv->num_fence_regs; i++) {
1555                         reg = &dev_priv->fence_regs[i];
1556                         old_obj_priv = reg->obj->driver_private;
1557                         if (!old_obj_priv->pin_count)
1558                                 break;
1559                 }
1560
1561                 /*
1562                  * Now things get ugly... we have to wait for one of the
1563                  * objects to finish before trying again.
1564                  */
1565                 if (i == dev_priv->num_fence_regs) {
1566                         ret = i915_gem_object_wait_rendering(reg->obj);
1567                         if (ret) {
1568                                 WARN(ret, "wait_rendering failed: %d\n", ret);
1569                                 return;
1570                         }
1571                         goto try_again;
1572                 }
1573
1574                 /*
1575                  * Zap this virtual mapping so we can set up a fence again
1576                  * for this object next time we need it.
1577                  */
1578                 offset = ((loff_t) reg->obj->map_list.hash.key) << PAGE_SHIFT;
1579                 if (dev->dev_mapping)
1580                         unmap_mapping_range(dev->dev_mapping, offset,
1581                                             reg->obj->size, 1);
1582                 old_obj_priv->fence_reg = I915_FENCE_REG_NONE;
1583         }
1584
1585         obj_priv->fence_reg = i;
1586         reg->obj = obj;
1587
1588         if (IS_I965G(dev))
1589                 i965_write_fence_reg(reg);
1590         else if (IS_I9XX(dev))
1591                 i915_write_fence_reg(reg);
1592         else
1593                 i830_write_fence_reg(reg);
1594 }
1595
1596 /**
1597  * i915_gem_clear_fence_reg - clear out fence register info
1598  * @obj: object to clear
1599  *
1600  * Zeroes out the fence register itself and clears out the associated
1601  * data structures in dev_priv and obj_priv.
1602  */
1603 static void
1604 i915_gem_clear_fence_reg(struct drm_gem_object *obj)
1605 {
1606         struct drm_device *dev = obj->dev;
1607         drm_i915_private_t *dev_priv = dev->dev_private;
1608         struct drm_i915_gem_object *obj_priv = obj->driver_private;
1609
1610         if (IS_I965G(dev))
1611                 I915_WRITE64(FENCE_REG_965_0 + (obj_priv->fence_reg * 8), 0);
1612         else
1613                 I915_WRITE(FENCE_REG_830_0 + (obj_priv->fence_reg * 4), 0);
1614
1615         dev_priv->fence_regs[obj_priv->fence_reg].obj = NULL;
1616         obj_priv->fence_reg = I915_FENCE_REG_NONE;
1617 }
1618
1619 /**
1620  * Finds free space in the GTT aperture and binds the object there.
1621  */
1622 static int
1623 i915_gem_object_bind_to_gtt(struct drm_gem_object *obj, unsigned alignment)
1624 {
1625         struct drm_device *dev = obj->dev;
1626         drm_i915_private_t *dev_priv = dev->dev_private;
1627         struct drm_i915_gem_object *obj_priv = obj->driver_private;
1628         struct drm_mm_node *free_space;
1629         int page_count, ret;
1630
1631         if (dev_priv->mm.suspended)
1632                 return -EBUSY;
1633         if (alignment == 0)
1634                 alignment = PAGE_SIZE;
1635         if (alignment & (PAGE_SIZE - 1)) {
1636                 DRM_ERROR("Invalid object alignment requested %u\n", alignment);
1637                 return -EINVAL;
1638         }
1639
1640  search_free:
1641         free_space = drm_mm_search_free(&dev_priv->mm.gtt_space,
1642                                         obj->size, alignment, 0);
1643         if (free_space != NULL) {
1644                 obj_priv->gtt_space = drm_mm_get_block(free_space, obj->size,
1645                                                        alignment);
1646                 if (obj_priv->gtt_space != NULL) {
1647                         obj_priv->gtt_space->private = obj;
1648                         obj_priv->gtt_offset = obj_priv->gtt_space->start;
1649                 }
1650         }
1651         if (obj_priv->gtt_space == NULL) {
1652                 /* If the gtt is empty and we're still having trouble
1653                  * fitting our object in, we're out of memory.
1654                  */
1655 #if WATCH_LRU
1656                 DRM_INFO("%s: GTT full, evicting something\n", __func__);
1657 #endif
1658                 if (list_empty(&dev_priv->mm.inactive_list) &&
1659                     list_empty(&dev_priv->mm.flushing_list) &&
1660                     list_empty(&dev_priv->mm.active_list)) {
1661                         DRM_ERROR("GTT full, but LRU list empty\n");
1662                         return -ENOMEM;
1663                 }
1664
1665                 ret = i915_gem_evict_something(dev);
1666                 if (ret != 0) {
1667                         if (ret != -ERESTARTSYS)
1668                                 DRM_ERROR("Failed to evict a buffer %d\n", ret);
1669                         return ret;
1670                 }
1671                 goto search_free;
1672         }
1673
1674 #if WATCH_BUF
1675         DRM_INFO("Binding object of size %d at 0x%08x\n",
1676                  obj->size, obj_priv->gtt_offset);
1677 #endif
1678         ret = i915_gem_object_get_page_list(obj);
1679         if (ret) {
1680                 drm_mm_put_block(obj_priv->gtt_space);
1681                 obj_priv->gtt_space = NULL;
1682                 return ret;
1683         }
1684
1685         page_count = obj->size / PAGE_SIZE;
1686         /* Create an AGP memory structure pointing at our pages, and bind it
1687          * into the GTT.
1688          */
1689         obj_priv->agp_mem = drm_agp_bind_pages(dev,
1690                                                obj_priv->page_list,
1691                                                page_count,
1692                                                obj_priv->gtt_offset,
1693                                                obj_priv->agp_type);
1694         if (obj_priv->agp_mem == NULL) {
1695                 i915_gem_object_free_page_list(obj);
1696                 drm_mm_put_block(obj_priv->gtt_space);
1697                 obj_priv->gtt_space = NULL;
1698                 return -ENOMEM;
1699         }
1700         atomic_inc(&dev->gtt_count);
1701         atomic_add(obj->size, &dev->gtt_memory);
1702
1703         /* Assert that the object is not currently in any GPU domain. As it
1704          * wasn't in the GTT, there shouldn't be any way it could have been in
1705          * a GPU cache
1706          */
1707         BUG_ON(obj->read_domains & ~(I915_GEM_DOMAIN_CPU|I915_GEM_DOMAIN_GTT));
1708         BUG_ON(obj->write_domain & ~(I915_GEM_DOMAIN_CPU|I915_GEM_DOMAIN_GTT));
1709
1710         return 0;
1711 }
1712
1713 void
1714 i915_gem_clflush_object(struct drm_gem_object *obj)
1715 {
1716         struct drm_i915_gem_object      *obj_priv = obj->driver_private;
1717
1718         /* If we don't have a page list set up, then we're not pinned
1719          * to GPU, and we can ignore the cache flush because it'll happen
1720          * again at bind time.
1721          */
1722         if (obj_priv->page_list == NULL)
1723                 return;
1724
1725         drm_clflush_pages(obj_priv->page_list, obj->size / PAGE_SIZE);
1726 }
1727
1728 /** Flushes any GPU write domain for the object if it's dirty. */
1729 static void
1730 i915_gem_object_flush_gpu_write_domain(struct drm_gem_object *obj)
1731 {
1732         struct drm_device *dev = obj->dev;
1733         uint32_t seqno;
1734
1735         if ((obj->write_domain & I915_GEM_GPU_DOMAINS) == 0)
1736                 return;
1737
1738         /* Queue the GPU write cache flushing we need. */
1739         i915_gem_flush(dev, 0, obj->write_domain);
1740         seqno = i915_add_request(dev, obj->write_domain);
1741         obj->write_domain = 0;
1742         i915_gem_object_move_to_active(obj, seqno);
1743 }
1744
1745 /** Flushes the GTT write domain for the object if it's dirty. */
1746 static void
1747 i915_gem_object_flush_gtt_write_domain(struct drm_gem_object *obj)
1748 {
1749         if (obj->write_domain != I915_GEM_DOMAIN_GTT)
1750                 return;
1751
1752         /* No actual flushing is required for the GTT write domain.   Writes
1753          * to it immediately go to main memory as far as we know, so there's
1754          * no chipset flush.  It also doesn't land in render cache.
1755          */
1756         obj->write_domain = 0;
1757 }
1758
1759 /** Flushes the CPU write domain for the object if it's dirty. */
1760 static void
1761 i915_gem_object_flush_cpu_write_domain(struct drm_gem_object *obj)
1762 {
1763         struct drm_device *dev = obj->dev;
1764
1765         if (obj->write_domain != I915_GEM_DOMAIN_CPU)
1766                 return;
1767
1768         i915_gem_clflush_object(obj);
1769         drm_agp_chipset_flush(dev);
1770         obj->write_domain = 0;
1771 }
1772
1773 /**
1774  * Moves a single object to the GTT read, and possibly write domain.
1775  *
1776  * This function returns when the move is complete, including waiting on
1777  * flushes to occur.
1778  */
1779 int
1780 i915_gem_object_set_to_gtt_domain(struct drm_gem_object *obj, int write)
1781 {
1782         struct drm_i915_gem_object *obj_priv = obj->driver_private;
1783         int ret;
1784
1785         /* Not valid to be called on unbound objects. */
1786         if (obj_priv->gtt_space == NULL)
1787                 return -EINVAL;
1788
1789         i915_gem_object_flush_gpu_write_domain(obj);
1790         /* Wait on any GPU rendering and flushing to occur. */
1791         ret = i915_gem_object_wait_rendering(obj);
1792         if (ret != 0)
1793                 return ret;
1794
1795         /* If we're writing through the GTT domain, then CPU and GPU caches
1796          * will need to be invalidated at next use.
1797          */
1798         if (write)
1799                 obj->read_domains &= I915_GEM_DOMAIN_GTT;
1800
1801         i915_gem_object_flush_cpu_write_domain(obj);
1802
1803         /* It should now be out of any other write domains, and we can update
1804          * the domain values for our changes.
1805          */
1806         BUG_ON((obj->write_domain & ~I915_GEM_DOMAIN_GTT) != 0);
1807         obj->read_domains |= I915_GEM_DOMAIN_GTT;
1808         if (write) {
1809                 obj->write_domain = I915_GEM_DOMAIN_GTT;
1810                 obj_priv->dirty = 1;
1811         }
1812
1813         return 0;
1814 }
1815
1816 /**
1817  * Moves a single object to the CPU read, and possibly write domain.
1818  *
1819  * This function returns when the move is complete, including waiting on
1820  * flushes to occur.
1821  */
1822 static int
1823 i915_gem_object_set_to_cpu_domain(struct drm_gem_object *obj, int write)
1824 {
1825         struct drm_device *dev = obj->dev;
1826         int ret;
1827
1828         i915_gem_object_flush_gpu_write_domain(obj);
1829         /* Wait on any GPU rendering and flushing to occur. */
1830         ret = i915_gem_object_wait_rendering(obj);
1831         if (ret != 0)
1832                 return ret;
1833
1834         i915_gem_object_flush_gtt_write_domain(obj);
1835
1836         /* If we have a partially-valid cache of the object in the CPU,
1837          * finish invalidating it and free the per-page flags.
1838          */
1839         i915_gem_object_set_to_full_cpu_read_domain(obj);
1840
1841         /* Flush the CPU cache if it's still invalid. */
1842         if ((obj->read_domains & I915_GEM_DOMAIN_CPU) == 0) {
1843                 i915_gem_clflush_object(obj);
1844                 drm_agp_chipset_flush(dev);
1845
1846                 obj->read_domains |= I915_GEM_DOMAIN_CPU;
1847         }
1848
1849         /* It should now be out of any other write domains, and we can update
1850          * the domain values for our changes.
1851          */
1852         BUG_ON((obj->write_domain & ~I915_GEM_DOMAIN_CPU) != 0);
1853
1854         /* If we're writing through the CPU, then the GPU read domains will
1855          * need to be invalidated at next use.
1856          */
1857         if (write) {
1858                 obj->read_domains &= I915_GEM_DOMAIN_CPU;
1859                 obj->write_domain = I915_GEM_DOMAIN_CPU;
1860         }
1861
1862         return 0;
1863 }
1864
1865 /*
1866  * Set the next domain for the specified object. This
1867  * may not actually perform the necessary flushing/invaliding though,
1868  * as that may want to be batched with other set_domain operations
1869  *
1870  * This is (we hope) the only really tricky part of gem. The goal
1871  * is fairly simple -- track which caches hold bits of the object
1872  * and make sure they remain coherent. A few concrete examples may
1873  * help to explain how it works. For shorthand, we use the notation
1874  * (read_domains, write_domain), e.g. (CPU, CPU) to indicate the
1875  * a pair of read and write domain masks.
1876  *
1877  * Case 1: the batch buffer
1878  *
1879  *      1. Allocated
1880  *      2. Written by CPU
1881  *      3. Mapped to GTT
1882  *      4. Read by GPU
1883  *      5. Unmapped from GTT
1884  *      6. Freed
1885  *
1886  *      Let's take these a step at a time
1887  *
1888  *      1. Allocated
1889  *              Pages allocated from the kernel may still have
1890  *              cache contents, so we set them to (CPU, CPU) always.
1891  *      2. Written by CPU (using pwrite)
1892  *              The pwrite function calls set_domain (CPU, CPU) and
1893  *              this function does nothing (as nothing changes)
1894  *      3. Mapped by GTT
1895  *              This function asserts that the object is not
1896  *              currently in any GPU-based read or write domains
1897  *      4. Read by GPU
1898  *              i915_gem_execbuffer calls set_domain (COMMAND, 0).
1899  *              As write_domain is zero, this function adds in the
1900  *              current read domains (CPU+COMMAND, 0).
1901  *              flush_domains is set to CPU.
1902  *              invalidate_domains is set to COMMAND
1903  *              clflush is run to get data out of the CPU caches
1904  *              then i915_dev_set_domain calls i915_gem_flush to
1905  *              emit an MI_FLUSH and drm_agp_chipset_flush
1906  *      5. Unmapped from GTT
1907  *              i915_gem_object_unbind calls set_domain (CPU, CPU)
1908  *              flush_domains and invalidate_domains end up both zero
1909  *              so no flushing/invalidating happens
1910  *      6. Freed
1911  *              yay, done
1912  *
1913  * Case 2: The shared render buffer
1914  *
1915  *      1. Allocated
1916  *      2. Mapped to GTT
1917  *      3. Read/written by GPU
1918  *      4. set_domain to (CPU,CPU)
1919  *      5. Read/written by CPU
1920  *      6. Read/written by GPU
1921  *
1922  *      1. Allocated
1923  *              Same as last example, (CPU, CPU)
1924  *      2. Mapped to GTT
1925  *              Nothing changes (assertions find that it is not in the GPU)
1926  *      3. Read/written by GPU
1927  *              execbuffer calls set_domain (RENDER, RENDER)
1928  *              flush_domains gets CPU
1929  *              invalidate_domains gets GPU
1930  *              clflush (obj)
1931  *              MI_FLUSH and drm_agp_chipset_flush
1932  *      4. set_domain (CPU, CPU)
1933  *              flush_domains gets GPU
1934  *              invalidate_domains gets CPU
1935  *              wait_rendering (obj) to make sure all drawing is complete.
1936  *              This will include an MI_FLUSH to get the data from GPU
1937  *              to memory
1938  *              clflush (obj) to invalidate the CPU cache
1939  *              Another MI_FLUSH in i915_gem_flush (eliminate this somehow?)
1940  *      5. Read/written by CPU
1941  *              cache lines are loaded and dirtied
1942  *      6. Read written by GPU
1943  *              Same as last GPU access
1944  *
1945  * Case 3: The constant buffer
1946  *
1947  *      1. Allocated
1948  *      2. Written by CPU
1949  *      3. Read by GPU
1950  *      4. Updated (written) by CPU again
1951  *      5. Read by GPU
1952  *
1953  *      1. Allocated
1954  *              (CPU, CPU)
1955  *      2. Written by CPU
1956  *              (CPU, CPU)
1957  *      3. Read by GPU
1958  *              (CPU+RENDER, 0)
1959  *              flush_domains = CPU
1960  *              invalidate_domains = RENDER
1961  *              clflush (obj)
1962  *              MI_FLUSH
1963  *              drm_agp_chipset_flush
1964  *      4. Updated (written) by CPU again
1965  *              (CPU, CPU)
1966  *              flush_domains = 0 (no previous write domain)
1967  *              invalidate_domains = 0 (no new read domains)
1968  *      5. Read by GPU
1969  *              (CPU+RENDER, 0)
1970  *              flush_domains = CPU
1971  *              invalidate_domains = RENDER
1972  *              clflush (obj)
1973  *              MI_FLUSH
1974  *              drm_agp_chipset_flush
1975  */
1976 static void
1977 i915_gem_object_set_to_gpu_domain(struct drm_gem_object *obj,
1978                                   uint32_t read_domains,
1979                                   uint32_t write_domain)
1980 {
1981         struct drm_device               *dev = obj->dev;
1982         struct drm_i915_gem_object      *obj_priv = obj->driver_private;
1983         uint32_t                        invalidate_domains = 0;
1984         uint32_t                        flush_domains = 0;
1985
1986         BUG_ON(read_domains & I915_GEM_DOMAIN_CPU);
1987         BUG_ON(write_domain == I915_GEM_DOMAIN_CPU);
1988
1989 #if WATCH_BUF
1990         DRM_INFO("%s: object %p read %08x -> %08x write %08x -> %08x\n",
1991                  __func__, obj,
1992                  obj->read_domains, read_domains,
1993                  obj->write_domain, write_domain);
1994 #endif
1995         /*
1996          * If the object isn't moving to a new write domain,
1997          * let the object stay in multiple read domains
1998          */
1999         if (write_domain == 0)
2000                 read_domains |= obj->read_domains;
2001         else
2002                 obj_priv->dirty = 1;
2003
2004         /*
2005          * Flush the current write domain if
2006          * the new read domains don't match. Invalidate
2007          * any read domains which differ from the old
2008          * write domain
2009          */
2010         if (obj->write_domain && obj->write_domain != read_domains) {
2011                 flush_domains |= obj->write_domain;
2012                 invalidate_domains |= read_domains & ~obj->write_domain;
2013         }
2014         /*
2015          * Invalidate any read caches which may have
2016          * stale data. That is, any new read domains.
2017          */
2018         invalidate_domains |= read_domains & ~obj->read_domains;
2019         if ((flush_domains | invalidate_domains) & I915_GEM_DOMAIN_CPU) {
2020 #if WATCH_BUF
2021                 DRM_INFO("%s: CPU domain flush %08x invalidate %08x\n",
2022                          __func__, flush_domains, invalidate_domains);
2023 #endif
2024                 i915_gem_clflush_object(obj);
2025         }
2026
2027         if ((write_domain | flush_domains) != 0)
2028                 obj->write_domain = write_domain;
2029         obj->read_domains = read_domains;
2030
2031         dev->invalidate_domains |= invalidate_domains;
2032         dev->flush_domains |= flush_domains;
2033 #if WATCH_BUF
2034         DRM_INFO("%s: read %08x write %08x invalidate %08x flush %08x\n",
2035                  __func__,
2036                  obj->read_domains, obj->write_domain,
2037                  dev->invalidate_domains, dev->flush_domains);
2038 #endif
2039 }
2040
2041 /**
2042  * Moves the object from a partially CPU read to a full one.
2043  *
2044  * Note that this only resolves i915_gem_object_set_cpu_read_domain_range(),
2045  * and doesn't handle transitioning from !(read_domains & I915_GEM_DOMAIN_CPU).
2046  */
2047 static void
2048 i915_gem_object_set_to_full_cpu_read_domain(struct drm_gem_object *obj)
2049 {
2050         struct drm_device *dev = obj->dev;
2051         struct drm_i915_gem_object *obj_priv = obj->driver_private;
2052
2053         if (!obj_priv->page_cpu_valid)
2054                 return;
2055
2056         /* If we're partially in the CPU read domain, finish moving it in.
2057          */
2058         if (obj->read_domains & I915_GEM_DOMAIN_CPU) {
2059                 int i;
2060
2061                 for (i = 0; i <= (obj->size - 1) / PAGE_SIZE; i++) {
2062                         if (obj_priv->page_cpu_valid[i])
2063                                 continue;
2064                         drm_clflush_pages(obj_priv->page_list + i, 1);
2065                 }
2066                 drm_agp_chipset_flush(dev);
2067         }
2068
2069         /* Free the page_cpu_valid mappings which are now stale, whether
2070          * or not we've got I915_GEM_DOMAIN_CPU.
2071          */
2072         drm_free(obj_priv->page_cpu_valid, obj->size / PAGE_SIZE,
2073                  DRM_MEM_DRIVER);
2074         obj_priv->page_cpu_valid = NULL;
2075 }
2076
2077 /**
2078  * Set the CPU read domain on a range of the object.
2079  *
2080  * The object ends up with I915_GEM_DOMAIN_CPU in its read flags although it's
2081  * not entirely valid.  The page_cpu_valid member of the object flags which
2082  * pages have been flushed, and will be respected by
2083  * i915_gem_object_set_to_cpu_domain() if it's called on to get a valid mapping
2084  * of the whole object.
2085  *
2086  * This function returns when the move is complete, including waiting on
2087  * flushes to occur.
2088  */
2089 static int
2090 i915_gem_object_set_cpu_read_domain_range(struct drm_gem_object *obj,
2091                                           uint64_t offset, uint64_t size)
2092 {
2093         struct drm_i915_gem_object *obj_priv = obj->driver_private;
2094         int i, ret;
2095
2096         if (offset == 0 && size == obj->size)
2097                 return i915_gem_object_set_to_cpu_domain(obj, 0);
2098
2099         i915_gem_object_flush_gpu_write_domain(obj);
2100         /* Wait on any GPU rendering and flushing to occur. */
2101         ret = i915_gem_object_wait_rendering(obj);
2102         if (ret != 0)
2103                 return ret;
2104         i915_gem_object_flush_gtt_write_domain(obj);
2105
2106         /* If we're already fully in the CPU read domain, we're done. */
2107         if (obj_priv->page_cpu_valid == NULL &&
2108             (obj->read_domains & I915_GEM_DOMAIN_CPU) != 0)
2109                 return 0;
2110
2111         /* Otherwise, create/clear the per-page CPU read domain flag if we're
2112          * newly adding I915_GEM_DOMAIN_CPU
2113          */
2114         if (obj_priv->page_cpu_valid == NULL) {
2115                 obj_priv->page_cpu_valid = drm_calloc(1, obj->size / PAGE_SIZE,
2116                                                       DRM_MEM_DRIVER);
2117                 if (obj_priv->page_cpu_valid == NULL)
2118                         return -ENOMEM;
2119         } else if ((obj->read_domains & I915_GEM_DOMAIN_CPU) == 0)
2120                 memset(obj_priv->page_cpu_valid, 0, obj->size / PAGE_SIZE);
2121
2122         /* Flush the cache on any pages that are still invalid from the CPU's
2123          * perspective.
2124          */
2125         for (i = offset / PAGE_SIZE; i <= (offset + size - 1) / PAGE_SIZE;
2126              i++) {
2127                 if (obj_priv->page_cpu_valid[i])
2128                         continue;
2129
2130                 drm_clflush_pages(obj_priv->page_list + i, 1);
2131
2132                 obj_priv->page_cpu_valid[i] = 1;
2133         }
2134
2135         /* It should now be out of any other write domains, and we can update
2136          * the domain values for our changes.
2137          */
2138         BUG_ON((obj->write_domain & ~I915_GEM_DOMAIN_CPU) != 0);
2139
2140         obj->read_domains |= I915_GEM_DOMAIN_CPU;
2141
2142         return 0;
2143 }
2144
2145 /**
2146  * Pin an object to the GTT and evaluate the relocations landing in it.
2147  */
2148 static int
2149 i915_gem_object_pin_and_relocate(struct drm_gem_object *obj,
2150                                  struct drm_file *file_priv,
2151                                  struct drm_i915_gem_exec_object *entry)
2152 {
2153         struct drm_device *dev = obj->dev;
2154         drm_i915_private_t *dev_priv = dev->dev_private;
2155         struct drm_i915_gem_relocation_entry reloc;
2156         struct drm_i915_gem_relocation_entry __user *relocs;
2157         struct drm_i915_gem_object *obj_priv = obj->driver_private;
2158         int i, ret;
2159         void __iomem *reloc_page;
2160
2161         /* Choose the GTT offset for our buffer and put it there. */
2162         ret = i915_gem_object_pin(obj, (uint32_t) entry->alignment);
2163         if (ret)
2164                 return ret;
2165
2166         entry->offset = obj_priv->gtt_offset;
2167
2168         relocs = (struct drm_i915_gem_relocation_entry __user *)
2169                  (uintptr_t) entry->relocs_ptr;
2170         /* Apply the relocations, using the GTT aperture to avoid cache
2171          * flushing requirements.
2172          */
2173         for (i = 0; i < entry->relocation_count; i++) {
2174                 struct drm_gem_object *target_obj;
2175                 struct drm_i915_gem_object *target_obj_priv;
2176                 uint32_t reloc_val, reloc_offset;
2177                 uint32_t __iomem *reloc_entry;
2178
2179                 ret = copy_from_user(&reloc, relocs + i, sizeof(reloc));
2180                 if (ret != 0) {
2181                         i915_gem_object_unpin(obj);
2182                         return ret;
2183                 }
2184
2185                 target_obj = drm_gem_object_lookup(obj->dev, file_priv,
2186                                                    reloc.target_handle);
2187                 if (target_obj == NULL) {
2188                         i915_gem_object_unpin(obj);
2189                         return -EBADF;
2190                 }
2191                 target_obj_priv = target_obj->driver_private;
2192
2193                 /* The target buffer should have appeared before us in the
2194                  * exec_object list, so it should have a GTT space bound by now.
2195                  */
2196                 if (target_obj_priv->gtt_space == NULL) {
2197                         DRM_ERROR("No GTT space found for object %d\n",
2198                                   reloc.target_handle);
2199                         drm_gem_object_unreference(target_obj);
2200                         i915_gem_object_unpin(obj);
2201                         return -EINVAL;
2202                 }
2203
2204                 if (reloc.offset > obj->size - 4) {
2205                         DRM_ERROR("Relocation beyond object bounds: "
2206                                   "obj %p target %d offset %d size %d.\n",
2207                                   obj, reloc.target_handle,
2208                                   (int) reloc.offset, (int) obj->size);
2209                         drm_gem_object_unreference(target_obj);
2210                         i915_gem_object_unpin(obj);
2211                         return -EINVAL;
2212                 }
2213                 if (reloc.offset & 3) {
2214                         DRM_ERROR("Relocation not 4-byte aligned: "
2215                                   "obj %p target %d offset %d.\n",
2216                                   obj, reloc.target_handle,
2217                                   (int) reloc.offset);
2218                         drm_gem_object_unreference(target_obj);
2219                         i915_gem_object_unpin(obj);
2220                         return -EINVAL;
2221                 }
2222
2223                 if (reloc.write_domain & I915_GEM_DOMAIN_CPU ||
2224                     reloc.read_domains & I915_GEM_DOMAIN_CPU) {
2225                         DRM_ERROR("reloc with read/write CPU domains: "
2226                                   "obj %p target %d offset %d "
2227                                   "read %08x write %08x",
2228                                   obj, reloc.target_handle,
2229                                   (int) reloc.offset,
2230                                   reloc.read_domains,
2231                                   reloc.write_domain);
2232                         return -EINVAL;
2233                 }
2234
2235                 if (reloc.write_domain && target_obj->pending_write_domain &&
2236                     reloc.write_domain != target_obj->pending_write_domain) {
2237                         DRM_ERROR("Write domain conflict: "
2238                                   "obj %p target %d offset %d "
2239                                   "new %08x old %08x\n",
2240                                   obj, reloc.target_handle,
2241                                   (int) reloc.offset,
2242                                   reloc.write_domain,
2243                                   target_obj->pending_write_domain);
2244                         drm_gem_object_unreference(target_obj);
2245                         i915_gem_object_unpin(obj);
2246                         return -EINVAL;
2247                 }
2248
2249 #if WATCH_RELOC
2250                 DRM_INFO("%s: obj %p offset %08x target %d "
2251                          "read %08x write %08x gtt %08x "
2252                          "presumed %08x delta %08x\n",
2253                          __func__,
2254                          obj,
2255                          (int) reloc.offset,
2256                          (int) reloc.target_handle,
2257                          (int) reloc.read_domains,
2258                          (int) reloc.write_domain,
2259                          (int) target_obj_priv->gtt_offset,
2260                          (int) reloc.presumed_offset,
2261                          reloc.delta);
2262 #endif
2263
2264                 target_obj->pending_read_domains |= reloc.read_domains;
2265                 target_obj->pending_write_domain |= reloc.write_domain;
2266
2267                 /* If the relocation already has the right value in it, no
2268                  * more work needs to be done.
2269                  */
2270                 if (target_obj_priv->gtt_offset == reloc.presumed_offset) {
2271                         drm_gem_object_unreference(target_obj);
2272                         continue;
2273                 }
2274
2275                 ret = i915_gem_object_set_to_gtt_domain(obj, 1);
2276                 if (ret != 0) {
2277                         drm_gem_object_unreference(target_obj);
2278                         i915_gem_object_unpin(obj);
2279                         return -EINVAL;
2280                 }
2281
2282                 /* Map the page containing the relocation we're going to
2283                  * perform.
2284                  */
2285                 reloc_offset = obj_priv->gtt_offset + reloc.offset;
2286                 reloc_page = io_mapping_map_atomic_wc(dev_priv->mm.gtt_mapping,
2287                                                       (reloc_offset &
2288                                                        ~(PAGE_SIZE - 1)));
2289                 reloc_entry = (uint32_t __iomem *)(reloc_page +
2290                                                    (reloc_offset & (PAGE_SIZE - 1)));
2291                 reloc_val = target_obj_priv->gtt_offset + reloc.delta;
2292
2293 #if WATCH_BUF
2294                 DRM_INFO("Applied relocation: %p@0x%08x %08x -> %08x\n",
2295                           obj, (unsigned int) reloc.offset,
2296                           readl(reloc_entry), reloc_val);
2297 #endif
2298                 writel(reloc_val, reloc_entry);
2299                 io_mapping_unmap_atomic(reloc_page);
2300
2301                 /* Write the updated presumed offset for this entry back out
2302                  * to the user.
2303                  */
2304                 reloc.presumed_offset = target_obj_priv->gtt_offset;
2305                 ret = copy_to_user(relocs + i, &reloc, sizeof(reloc));
2306                 if (ret != 0) {
2307                         drm_gem_object_unreference(target_obj);
2308                         i915_gem_object_unpin(obj);
2309                         return ret;
2310                 }
2311
2312                 drm_gem_object_unreference(target_obj);
2313         }
2314
2315 #if WATCH_BUF
2316         if (0)
2317                 i915_gem_dump_object(obj, 128, __func__, ~0);
2318 #endif
2319         return 0;
2320 }
2321
2322 /** Dispatch a batchbuffer to the ring
2323  */
2324 static int
2325 i915_dispatch_gem_execbuffer(struct drm_device *dev,
2326                               struct drm_i915_gem_execbuffer *exec,
2327                               uint64_t exec_offset)
2328 {
2329         drm_i915_private_t *dev_priv = dev->dev_private;
2330         struct drm_clip_rect __user *boxes = (struct drm_clip_rect __user *)
2331                                              (uintptr_t) exec->cliprects_ptr;
2332         int nbox = exec->num_cliprects;
2333         int i = 0, count;
2334         uint32_t        exec_start, exec_len;
2335         RING_LOCALS;
2336
2337         exec_start = (uint32_t) exec_offset + exec->batch_start_offset;
2338         exec_len = (uint32_t) exec->batch_len;
2339
2340         if ((exec_start | exec_len) & 0x7) {
2341                 DRM_ERROR("alignment\n");
2342                 return -EINVAL;
2343         }
2344
2345         if (!exec_start)
2346                 return -EINVAL;
2347
2348         count = nbox ? nbox : 1;
2349
2350         for (i = 0; i < count; i++) {
2351                 if (i < nbox) {
2352                         int ret = i915_emit_box(dev, boxes, i,
2353                                                 exec->DR1, exec->DR4);
2354                         if (ret)
2355                                 return ret;
2356                 }
2357
2358                 if (IS_I830(dev) || IS_845G(dev)) {
2359                         BEGIN_LP_RING(4);
2360                         OUT_RING(MI_BATCH_BUFFER);
2361                         OUT_RING(exec_start | MI_BATCH_NON_SECURE);
2362                         OUT_RING(exec_start + exec_len - 4);
2363                         OUT_RING(0);
2364                         ADVANCE_LP_RING();
2365                 } else {
2366                         BEGIN_LP_RING(2);
2367                         if (IS_I965G(dev)) {
2368                                 OUT_RING(MI_BATCH_BUFFER_START |
2369                                          (2 << 6) |
2370                                          MI_BATCH_NON_SECURE_I965);
2371                                 OUT_RING(exec_start);
2372                         } else {
2373                                 OUT_RING(MI_BATCH_BUFFER_START |
2374                                          (2 << 6));
2375                                 OUT_RING(exec_start | MI_BATCH_NON_SECURE);
2376                         }
2377                         ADVANCE_LP_RING();
2378                 }
2379         }
2380
2381         /* XXX breadcrumb */
2382         return 0;
2383 }
2384
2385 /* Throttle our rendering by waiting until the ring has completed our requests
2386  * emitted over 20 msec ago.
2387  *
2388  * This should get us reasonable parallelism between CPU and GPU but also
2389  * relatively low latency when blocking on a particular request to finish.
2390  */
2391 static int
2392 i915_gem_ring_throttle(struct drm_device *dev, struct drm_file *file_priv)
2393 {
2394         struct drm_i915_file_private *i915_file_priv = file_priv->driver_priv;
2395         int ret = 0;
2396         uint32_t seqno;
2397
2398         mutex_lock(&dev->struct_mutex);
2399         seqno = i915_file_priv->mm.last_gem_throttle_seqno;
2400         i915_file_priv->mm.last_gem_throttle_seqno =
2401                 i915_file_priv->mm.last_gem_seqno;
2402         if (seqno)
2403                 ret = i915_wait_request(dev, seqno);
2404         mutex_unlock(&dev->struct_mutex);
2405         return ret;
2406 }
2407
2408 int
2409 i915_gem_execbuffer(struct drm_device *dev, void *data,
2410                     struct drm_file *file_priv)
2411 {
2412         drm_i915_private_t *dev_priv = dev->dev_private;
2413         struct drm_i915_file_private *i915_file_priv = file_priv->driver_priv;
2414         struct drm_i915_gem_execbuffer *args = data;
2415         struct drm_i915_gem_exec_object *exec_list = NULL;
2416         struct drm_gem_object **object_list = NULL;
2417         struct drm_gem_object *batch_obj;
2418         int ret, i, pinned = 0;
2419         uint64_t exec_offset;
2420         uint32_t seqno, flush_domains;
2421         int pin_tries;
2422
2423 #if WATCH_EXEC
2424         DRM_INFO("buffers_ptr %d buffer_count %d len %08x\n",
2425                   (int) args->buffers_ptr, args->buffer_count, args->batch_len);
2426 #endif
2427
2428         if (args->buffer_count < 1) {
2429                 DRM_ERROR("execbuf with %d buffers\n", args->buffer_count);
2430                 return -EINVAL;
2431         }
2432         /* Copy in the exec list from userland */
2433         exec_list = drm_calloc(sizeof(*exec_list), args->buffer_count,
2434                                DRM_MEM_DRIVER);
2435         object_list = drm_calloc(sizeof(*object_list), args->buffer_count,
2436                                  DRM_MEM_DRIVER);
2437         if (exec_list == NULL || object_list == NULL) {
2438                 DRM_ERROR("Failed to allocate exec or object list "
2439                           "for %d buffers\n",
2440                           args->buffer_count);
2441                 ret = -ENOMEM;
2442                 goto pre_mutex_err;
2443         }
2444         ret = copy_from_user(exec_list,
2445                              (struct drm_i915_relocation_entry __user *)
2446                              (uintptr_t) args->buffers_ptr,
2447                              sizeof(*exec_list) * args->buffer_count);
2448         if (ret != 0) {
2449                 DRM_ERROR("copy %d exec entries failed %d\n",
2450                           args->buffer_count, ret);
2451                 goto pre_mutex_err;
2452         }
2453
2454         mutex_lock(&dev->struct_mutex);
2455
2456         i915_verify_inactive(dev, __FILE__, __LINE__);
2457
2458         if (dev_priv->mm.wedged) {
2459                 DRM_ERROR("Execbuf while wedged\n");
2460                 mutex_unlock(&dev->struct_mutex);
2461                 return -EIO;
2462         }
2463
2464         if (dev_priv->mm.suspended) {
2465                 DRM_ERROR("Execbuf while VT-switched.\n");
2466                 mutex_unlock(&dev->struct_mutex);
2467                 return -EBUSY;
2468         }
2469
2470         /* Look up object handles */
2471         for (i = 0; i < args->buffer_count; i++) {
2472                 object_list[i] = drm_gem_object_lookup(dev, file_priv,
2473                                                        exec_list[i].handle);
2474                 if (object_list[i] == NULL) {
2475                         DRM_ERROR("Invalid object handle %d at index %d\n",
2476                                    exec_list[i].handle, i);
2477                         ret = -EBADF;
2478                         goto err;
2479                 }
2480         }
2481
2482         /* Pin and relocate */
2483         for (pin_tries = 0; ; pin_tries++) {
2484                 ret = 0;
2485                 for (i = 0; i < args->buffer_count; i++) {
2486                         object_list[i]->pending_read_domains = 0;
2487                         object_list[i]->pending_write_domain = 0;
2488                         ret = i915_gem_object_pin_and_relocate(object_list[i],
2489                                                                file_priv,
2490                                                                &exec_list[i]);
2491                         if (ret)
2492                                 break;
2493                         pinned = i + 1;
2494                 }
2495                 /* success */
2496                 if (ret == 0)
2497                         break;
2498
2499                 /* error other than GTT full, or we've already tried again */
2500                 if (ret != -ENOMEM || pin_tries >= 1) {
2501                         if (ret != -ERESTARTSYS)
2502                                 DRM_ERROR("Failed to pin buffers %d\n", ret);
2503                         goto err;
2504                 }
2505
2506                 /* unpin all of our buffers */
2507                 for (i = 0; i < pinned; i++)
2508                         i915_gem_object_unpin(object_list[i]);
2509                 pinned = 0;
2510
2511                 /* evict everyone we can from the aperture */
2512                 ret = i915_gem_evict_everything(dev);
2513                 if (ret)
2514                         goto err;
2515         }
2516
2517         /* Set the pending read domains for the batch buffer to COMMAND */
2518         batch_obj = object_list[args->buffer_count-1];
2519         batch_obj->pending_read_domains = I915_GEM_DOMAIN_COMMAND;
2520         batch_obj->pending_write_domain = 0;
2521
2522         i915_verify_inactive(dev, __FILE__, __LINE__);
2523
2524         /* Zero the global flush/invalidate flags. These
2525          * will be modified as new domains are computed
2526          * for each object
2527          */
2528         dev->invalidate_domains = 0;
2529         dev->flush_domains = 0;
2530
2531         for (i = 0; i < args->buffer_count; i++) {
2532                 struct drm_gem_object *obj = object_list[i];
2533
2534                 /* Compute new gpu domains and update invalidate/flush */
2535                 i915_gem_object_set_to_gpu_domain(obj,
2536                                                   obj->pending_read_domains,
2537                                                   obj->pending_write_domain);
2538         }
2539
2540         i915_verify_inactive(dev, __FILE__, __LINE__);
2541
2542         if (dev->invalidate_domains | dev->flush_domains) {
2543 #if WATCH_EXEC
2544                 DRM_INFO("%s: invalidate_domains %08x flush_domains %08x\n",
2545                           __func__,
2546                          dev->invalidate_domains,
2547                          dev->flush_domains);
2548 #endif
2549                 i915_gem_flush(dev,
2550                                dev->invalidate_domains,
2551                                dev->flush_domains);
2552                 if (dev->flush_domains)
2553                         (void)i915_add_request(dev, dev->flush_domains);
2554         }
2555
2556         i915_verify_inactive(dev, __FILE__, __LINE__);
2557
2558 #if WATCH_COHERENCY
2559         for (i = 0; i < args->buffer_count; i++) {
2560                 i915_gem_object_check_coherency(object_list[i],
2561                                                 exec_list[i].handle);
2562         }
2563 #endif
2564
2565         exec_offset = exec_list[args->buffer_count - 1].offset;
2566
2567 #if WATCH_EXEC
2568         i915_gem_dump_object(object_list[args->buffer_count - 1],
2569                               args->batch_len,
2570                               __func__,
2571                               ~0);
2572 #endif
2573
2574         /* Exec the batchbuffer */
2575         ret = i915_dispatch_gem_execbuffer(dev, args, exec_offset);
2576         if (ret) {
2577                 DRM_ERROR("dispatch failed %d\n", ret);
2578                 goto err;
2579         }
2580
2581         /*
2582          * Ensure that the commands in the batch buffer are
2583          * finished before the interrupt fires
2584          */
2585         flush_domains = i915_retire_commands(dev);
2586
2587         i915_verify_inactive(dev, __FILE__, __LINE__);
2588
2589         /*
2590          * Get a seqno representing the execution of the current buffer,
2591          * which we can wait on.  We would like to mitigate these interrupts,
2592          * likely by only creating seqnos occasionally (so that we have
2593          * *some* interrupts representing completion of buffers that we can
2594          * wait on when trying to clear up gtt space).
2595          */
2596         seqno = i915_add_request(dev, flush_domains);
2597         BUG_ON(seqno == 0);
2598         i915_file_priv->mm.last_gem_seqno = seqno;
2599         for (i = 0; i < args->buffer_count; i++) {
2600                 struct drm_gem_object *obj = object_list[i];
2601
2602                 i915_gem_object_move_to_active(obj, seqno);
2603 #if WATCH_LRU
2604                 DRM_INFO("%s: move to exec list %p\n", __func__, obj);
2605 #endif
2606         }
2607 #if WATCH_LRU
2608         i915_dump_lru(dev, __func__);
2609 #endif
2610
2611         i915_verify_inactive(dev, __FILE__, __LINE__);
2612
2613         /* Copy the new buffer offsets back to the user's exec list. */
2614         ret = copy_to_user((struct drm_i915_relocation_entry __user *)
2615                            (uintptr_t) args->buffers_ptr,
2616                            exec_list,
2617                            sizeof(*exec_list) * args->buffer_count);
2618         if (ret)
2619                 DRM_ERROR("failed to copy %d exec entries "
2620                           "back to user (%d)\n",
2621                            args->buffer_count, ret);
2622 err:
2623         for (i = 0; i < pinned; i++)
2624                 i915_gem_object_unpin(object_list[i]);
2625
2626         for (i = 0; i < args->buffer_count; i++)
2627                 drm_gem_object_unreference(object_list[i]);
2628
2629         mutex_unlock(&dev->struct_mutex);
2630
2631 pre_mutex_err:
2632         drm_free(object_list, sizeof(*object_list) * args->buffer_count,
2633                  DRM_MEM_DRIVER);
2634         drm_free(exec_list, sizeof(*exec_list) * args->buffer_count,
2635                  DRM_MEM_DRIVER);
2636
2637         return ret;
2638 }
2639
2640 int
2641 i915_gem_object_pin(struct drm_gem_object *obj, uint32_t alignment)
2642 {
2643         struct drm_device *dev = obj->dev;
2644         struct drm_i915_gem_object *obj_priv = obj->driver_private;
2645         int ret;
2646
2647         i915_verify_inactive(dev, __FILE__, __LINE__);
2648         if (obj_priv->gtt_space == NULL) {
2649                 ret = i915_gem_object_bind_to_gtt(obj, alignment);
2650                 if (ret != 0) {
2651                         if (ret != -EBUSY && ret != -ERESTARTSYS)
2652                                 DRM_ERROR("Failure to bind: %d", ret);
2653                         return ret;
2654                 }
2655         }
2656         obj_priv->pin_count++;
2657
2658         /* If the object is not active and not pending a flush,
2659          * remove it from the inactive list
2660          */
2661         if (obj_priv->pin_count == 1) {
2662                 atomic_inc(&dev->pin_count);
2663                 atomic_add(obj->size, &dev->pin_memory);
2664                 if (!obj_priv->active &&
2665                     (obj->write_domain & ~(I915_GEM_DOMAIN_CPU |
2666                                            I915_GEM_DOMAIN_GTT)) == 0 &&
2667                     !list_empty(&obj_priv->list))
2668                         list_del_init(&obj_priv->list);
2669         }
2670         i915_verify_inactive(dev, __FILE__, __LINE__);
2671
2672         return 0;
2673 }
2674
2675 void
2676 i915_gem_object_unpin(struct drm_gem_object *obj)
2677 {
2678         struct drm_device *dev = obj->dev;
2679         drm_i915_private_t *dev_priv = dev->dev_private;
2680         struct drm_i915_gem_object *obj_priv = obj->driver_private;
2681
2682         i915_verify_inactive(dev, __FILE__, __LINE__);
2683         obj_priv->pin_count--;
2684         BUG_ON(obj_priv->pin_count < 0);
2685         BUG_ON(obj_priv->gtt_space == NULL);
2686
2687         /* If the object is no longer pinned, and is
2688          * neither active nor being flushed, then stick it on
2689          * the inactive list
2690          */
2691         if (obj_priv->pin_count == 0) {
2692                 if (!obj_priv->active &&
2693                     (obj->write_domain & ~(I915_GEM_DOMAIN_CPU |
2694                                            I915_GEM_DOMAIN_GTT)) == 0)
2695                         list_move_tail(&obj_priv->list,
2696                                        &dev_priv->mm.inactive_list);
2697                 atomic_dec(&dev->pin_count);
2698                 atomic_sub(obj->size, &dev->pin_memory);
2699         }
2700         i915_verify_inactive(dev, __FILE__, __LINE__);
2701 }
2702
2703 int
2704 i915_gem_pin_ioctl(struct drm_device *dev, void *data,
2705                    struct drm_file *file_priv)
2706 {
2707         struct drm_i915_gem_pin *args = data;
2708         struct drm_gem_object *obj;
2709         struct drm_i915_gem_object *obj_priv;
2710         int ret;
2711
2712         mutex_lock(&dev->struct_mutex);
2713
2714         obj = drm_gem_object_lookup(dev, file_priv, args->handle);
2715         if (obj == NULL) {
2716                 DRM_ERROR("Bad handle in i915_gem_pin_ioctl(): %d\n",
2717                           args->handle);
2718                 mutex_unlock(&dev->struct_mutex);
2719                 return -EBADF;
2720         }
2721         obj_priv = obj->driver_private;
2722
2723         if (obj_priv->pin_filp != NULL && obj_priv->pin_filp != file_priv) {
2724                 DRM_ERROR("Already pinned in i915_gem_pin_ioctl(): %d\n",
2725                           args->handle);
2726                 mutex_unlock(&dev->struct_mutex);
2727                 return -EINVAL;
2728         }
2729
2730         obj_priv->user_pin_count++;
2731         obj_priv->pin_filp = file_priv;
2732         if (obj_priv->user_pin_count == 1) {
2733                 ret = i915_gem_object_pin(obj, args->alignment);
2734                 if (ret != 0) {
2735                         drm_gem_object_unreference(obj);
2736                         mutex_unlock(&dev->struct_mutex);
2737                         return ret;
2738                 }
2739         }
2740
2741         /* XXX - flush the CPU caches for pinned objects
2742          * as the X server doesn't manage domains yet
2743          */
2744         i915_gem_object_flush_cpu_write_domain(obj);
2745         args->offset = obj_priv->gtt_offset;
2746         drm_gem_object_unreference(obj);
2747         mutex_unlock(&dev->struct_mutex);
2748
2749         return 0;
2750 }
2751
2752 int
2753 i915_gem_unpin_ioctl(struct drm_device *dev, void *data,
2754                      struct drm_file *file_priv)
2755 {
2756         struct drm_i915_gem_pin *args = data;
2757         struct drm_gem_object *obj;
2758         struct drm_i915_gem_object *obj_priv;
2759
2760         mutex_lock(&dev->struct_mutex);
2761
2762         obj = drm_gem_object_lookup(dev, file_priv, args->handle);
2763         if (obj == NULL) {
2764                 DRM_ERROR("Bad handle in i915_gem_unpin_ioctl(): %d\n",
2765                           args->handle);
2766                 mutex_unlock(&dev->struct_mutex);
2767                 return -EBADF;
2768         }
2769
2770         obj_priv = obj->driver_private;
2771         if (obj_priv->pin_filp != file_priv) {
2772                 DRM_ERROR("Not pinned by caller in i915_gem_pin_ioctl(): %d\n",
2773                           args->handle);
2774                 drm_gem_object_unreference(obj);
2775                 mutex_unlock(&dev->struct_mutex);
2776                 return -EINVAL;
2777         }
2778         obj_priv->user_pin_count--;
2779         if (obj_priv->user_pin_count == 0) {
2780                 obj_priv->pin_filp = NULL;
2781                 i915_gem_object_unpin(obj);
2782         }
2783
2784         drm_gem_object_unreference(obj);
2785         mutex_unlock(&dev->struct_mutex);
2786         return 0;
2787 }
2788
2789 int
2790 i915_gem_busy_ioctl(struct drm_device *dev, void *data,
2791                     struct drm_file *file_priv)
2792 {
2793         struct drm_i915_gem_busy *args = data;
2794         struct drm_gem_object *obj;
2795         struct drm_i915_gem_object *obj_priv;
2796
2797         mutex_lock(&dev->struct_mutex);
2798         obj = drm_gem_object_lookup(dev, file_priv, args->handle);
2799         if (obj == NULL) {
2800                 DRM_ERROR("Bad handle in i915_gem_busy_ioctl(): %d\n",
2801                           args->handle);
2802                 mutex_unlock(&dev->struct_mutex);
2803                 return -EBADF;
2804         }
2805
2806         obj_priv = obj->driver_private;
2807         /* Don't count being on the flushing list against the object being
2808          * done.  Otherwise, a buffer left on the flushing list but not getting
2809          * flushed (because nobody's flushing that domain) won't ever return
2810          * unbusy and get reused by libdrm's bo cache.  The other expected
2811          * consumer of this interface, OpenGL's occlusion queries, also specs
2812          * that the objects get unbusy "eventually" without any interference.
2813          */
2814         args->busy = obj_priv->active && obj_priv->last_rendering_seqno != 0;
2815
2816         drm_gem_object_unreference(obj);
2817         mutex_unlock(&dev->struct_mutex);
2818         return 0;
2819 }
2820
2821 int
2822 i915_gem_throttle_ioctl(struct drm_device *dev, void *data,
2823                         struct drm_file *file_priv)
2824 {
2825     return i915_gem_ring_throttle(dev, file_priv);
2826 }
2827
2828 int i915_gem_init_object(struct drm_gem_object *obj)
2829 {
2830         struct drm_i915_gem_object *obj_priv;
2831
2832         obj_priv = drm_calloc(1, sizeof(*obj_priv), DRM_MEM_DRIVER);
2833         if (obj_priv == NULL)
2834                 return -ENOMEM;
2835
2836         /*
2837          * We've just allocated pages from the kernel,
2838          * so they've just been written by the CPU with
2839          * zeros. They'll need to be clflushed before we
2840          * use them with the GPU.
2841          */
2842         obj->write_domain = I915_GEM_DOMAIN_CPU;
2843         obj->read_domains = I915_GEM_DOMAIN_CPU;
2844
2845         obj_priv->agp_type = AGP_USER_MEMORY;
2846
2847         obj->driver_private = obj_priv;
2848         obj_priv->obj = obj;
2849         obj_priv->fence_reg = I915_FENCE_REG_NONE;
2850         INIT_LIST_HEAD(&obj_priv->list);
2851
2852         return 0;
2853 }
2854
2855 void i915_gem_free_object(struct drm_gem_object *obj)
2856 {
2857         struct drm_device *dev = obj->dev;
2858         struct drm_gem_mm *mm = dev->mm_private;
2859         struct drm_map_list *list;
2860         struct drm_map *map;
2861         struct drm_i915_gem_object *obj_priv = obj->driver_private;
2862
2863         while (obj_priv->pin_count > 0)
2864                 i915_gem_object_unpin(obj);
2865
2866         if (obj_priv->phys_obj)
2867                 i915_gem_detach_phys_object(dev, obj);
2868
2869         i915_gem_object_unbind(obj);
2870
2871         list = &obj->map_list;
2872         drm_ht_remove_item(&mm->offset_hash, &list->hash);
2873
2874         if (list->file_offset_node) {
2875                 drm_mm_put_block(list->file_offset_node);
2876                 list->file_offset_node = NULL;
2877         }
2878
2879         map = list->map;
2880         if (map) {
2881                 drm_free(map, sizeof(*map), DRM_MEM_DRIVER);
2882                 list->map = NULL;
2883         }
2884
2885         drm_free(obj_priv->page_cpu_valid, 1, DRM_MEM_DRIVER);
2886         drm_free(obj->driver_private, 1, DRM_MEM_DRIVER);
2887 }
2888
2889 /** Unbinds all objects that are on the given buffer list. */
2890 static int
2891 i915_gem_evict_from_list(struct drm_device *dev, struct list_head *head)
2892 {
2893         struct drm_gem_object *obj;
2894         struct drm_i915_gem_object *obj_priv;
2895         int ret;
2896
2897         while (!list_empty(head)) {
2898                 obj_priv = list_first_entry(head,
2899                                             struct drm_i915_gem_object,
2900                                             list);
2901                 obj = obj_priv->obj;
2902
2903                 if (obj_priv->pin_count != 0) {
2904                         DRM_ERROR("Pinned object in unbind list\n");
2905                         mutex_unlock(&dev->struct_mutex);
2906                         return -EINVAL;
2907                 }
2908
2909                 ret = i915_gem_object_unbind(obj);
2910                 if (ret != 0) {
2911                         DRM_ERROR("Error unbinding object in LeaveVT: %d\n",
2912                                   ret);
2913                         mutex_unlock(&dev->struct_mutex);
2914                         return ret;
2915                 }
2916         }
2917
2918
2919         return 0;
2920 }
2921
2922 static int
2923 i915_gem_idle(struct drm_device *dev)
2924 {
2925         drm_i915_private_t *dev_priv = dev->dev_private;
2926         uint32_t seqno, cur_seqno, last_seqno;
2927         int stuck, ret;
2928
2929         mutex_lock(&dev->struct_mutex);
2930
2931         if (dev_priv->mm.suspended || dev_priv->ring.ring_obj == NULL) {
2932                 mutex_unlock(&dev->struct_mutex);
2933                 return 0;
2934         }
2935
2936         /* Hack!  Don't let anybody do execbuf while we don't control the chip.
2937          * We need to replace this with a semaphore, or something.
2938          */
2939         dev_priv->mm.suspended = 1;
2940
2941         /* Cancel the retire work handler, wait for it to finish if running
2942          */
2943         mutex_unlock(&dev->struct_mutex);
2944         cancel_delayed_work_sync(&dev_priv->mm.retire_work);
2945         mutex_lock(&dev->struct_mutex);
2946
2947         i915_kernel_lost_context(dev);
2948
2949         /* Flush the GPU along with all non-CPU write domains
2950          */
2951         i915_gem_flush(dev, ~(I915_GEM_DOMAIN_CPU|I915_GEM_DOMAIN_GTT),
2952                        ~(I915_GEM_DOMAIN_CPU|I915_GEM_DOMAIN_GTT));
2953         seqno = i915_add_request(dev, ~I915_GEM_DOMAIN_CPU);
2954
2955         if (seqno == 0) {
2956                 mutex_unlock(&dev->struct_mutex);
2957                 return -ENOMEM;
2958         }
2959
2960         dev_priv->mm.waiting_gem_seqno = seqno;
2961         last_seqno = 0;
2962         stuck = 0;
2963         for (;;) {
2964                 cur_seqno = i915_get_gem_seqno(dev);
2965                 if (i915_seqno_passed(cur_seqno, seqno))
2966                         break;
2967                 if (last_seqno == cur_seqno) {
2968                         if (stuck++ > 100) {
2969                                 DRM_ERROR("hardware wedged\n");
2970                                 dev_priv->mm.wedged = 1;
2971                                 DRM_WAKEUP(&dev_priv->irq_queue);
2972                                 break;
2973                         }
2974                 }
2975                 msleep(10);
2976                 last_seqno = cur_seqno;
2977         }
2978         dev_priv->mm.waiting_gem_seqno = 0;
2979
2980         i915_gem_retire_requests(dev);
2981
2982         if (!dev_priv->mm.wedged) {
2983                 /* Active and flushing should now be empty as we've
2984                  * waited for a sequence higher than any pending execbuffer
2985                  */
2986                 WARN_ON(!list_empty(&dev_priv->mm.active_list));
2987                 WARN_ON(!list_empty(&dev_priv->mm.flushing_list));
2988                 /* Request should now be empty as we've also waited
2989                  * for the last request in the list
2990                  */
2991                 WARN_ON(!list_empty(&dev_priv->mm.request_list));
2992         }
2993
2994         /* Empty the active and flushing lists to inactive.  If there's
2995          * anything left at this point, it means that we're wedged and
2996          * nothing good's going to happen by leaving them there.  So strip
2997          * the GPU domains and just stuff them onto inactive.
2998          */
2999         while (!list_empty(&dev_priv->mm.active_list)) {
3000                 struct drm_i915_gem_object *obj_priv;
3001
3002                 obj_priv = list_first_entry(&dev_priv->mm.active_list,
3003                                             struct drm_i915_gem_object,
3004                                             list);
3005                 obj_priv->obj->write_domain &= ~I915_GEM_GPU_DOMAINS;
3006                 i915_gem_object_move_to_inactive(obj_priv->obj);
3007         }
3008
3009         while (!list_empty(&dev_priv->mm.flushing_list)) {
3010                 struct drm_i915_gem_object *obj_priv;
3011
3012                 obj_priv = list_first_entry(&dev_priv->mm.flushing_list,
3013                                             struct drm_i915_gem_object,
3014                                             list);
3015                 obj_priv->obj->write_domain &= ~I915_GEM_GPU_DOMAINS;
3016                 i915_gem_object_move_to_inactive(obj_priv->obj);
3017         }
3018
3019
3020         /* Move all inactive buffers out of the GTT. */
3021         ret = i915_gem_evict_from_list(dev, &dev_priv->mm.inactive_list);
3022         WARN_ON(!list_empty(&dev_priv->mm.inactive_list));
3023         if (ret) {
3024                 mutex_unlock(&dev->struct_mutex);
3025                 return ret;
3026         }
3027
3028         i915_gem_cleanup_ringbuffer(dev);
3029         mutex_unlock(&dev->struct_mutex);
3030
3031         return 0;
3032 }
3033
3034 static int
3035 i915_gem_init_hws(struct drm_device *dev)
3036 {
3037         drm_i915_private_t *dev_priv = dev->dev_private;
3038         struct drm_gem_object *obj;
3039         struct drm_i915_gem_object *obj_priv;
3040         int ret;
3041
3042         /* If we need a physical address for the status page, it's already
3043          * initialized at driver load time.
3044          */
3045         if (!I915_NEED_GFX_HWS(dev))
3046                 return 0;
3047
3048         obj = drm_gem_object_alloc(dev, 4096);
3049         if (obj == NULL) {
3050                 DRM_ERROR("Failed to allocate status page\n");
3051                 return -ENOMEM;
3052         }
3053         obj_priv = obj->driver_private;
3054         obj_priv->agp_type = AGP_USER_CACHED_MEMORY;
3055
3056         ret = i915_gem_object_pin(obj, 4096);
3057         if (ret != 0) {
3058                 drm_gem_object_unreference(obj);
3059                 return ret;
3060         }
3061
3062         dev_priv->status_gfx_addr = obj_priv->gtt_offset;
3063
3064         dev_priv->hw_status_page = kmap(obj_priv->page_list[0]);
3065         if (dev_priv->hw_status_page == NULL) {
3066                 DRM_ERROR("Failed to map status page.\n");
3067                 memset(&dev_priv->hws_map, 0, sizeof(dev_priv->hws_map));
3068                 drm_gem_object_unreference(obj);
3069                 return -EINVAL;
3070         }
3071         dev_priv->hws_obj = obj;
3072         memset(dev_priv->hw_status_page, 0, PAGE_SIZE);
3073         I915_WRITE(HWS_PGA, dev_priv->status_gfx_addr);
3074         I915_READ(HWS_PGA); /* posting read */
3075         DRM_DEBUG("hws offset: 0x%08x\n", dev_priv->status_gfx_addr);
3076
3077         return 0;
3078 }
3079
3080 int
3081 i915_gem_init_ringbuffer(struct drm_device *dev)
3082 {
3083         drm_i915_private_t *dev_priv = dev->dev_private;
3084         struct drm_gem_object *obj;
3085         struct drm_i915_gem_object *obj_priv;
3086         drm_i915_ring_buffer_t *ring = &dev_priv->ring;
3087         int ret;
3088         u32 head;
3089
3090         ret = i915_gem_init_hws(dev);
3091         if (ret != 0)
3092                 return ret;
3093
3094         obj = drm_gem_object_alloc(dev, 128 * 1024);
3095         if (obj == NULL) {
3096                 DRM_ERROR("Failed to allocate ringbuffer\n");
3097                 return -ENOMEM;
3098         }
3099         obj_priv = obj->driver_private;
3100
3101         ret = i915_gem_object_pin(obj, 4096);
3102         if (ret != 0) {
3103                 drm_gem_object_unreference(obj);
3104                 return ret;
3105         }
3106
3107         /* Set up the kernel mapping for the ring. */
3108         ring->Size = obj->size;
3109         ring->tail_mask = obj->size - 1;
3110
3111         ring->map.offset = dev->agp->base + obj_priv->gtt_offset;
3112         ring->map.size = obj->size;
3113         ring->map.type = 0;
3114         ring->map.flags = 0;
3115         ring->map.mtrr = 0;
3116
3117         drm_core_ioremap_wc(&ring->map, dev);
3118         if (ring->map.handle == NULL) {
3119                 DRM_ERROR("Failed to map ringbuffer.\n");
3120                 memset(&dev_priv->ring, 0, sizeof(dev_priv->ring));
3121                 drm_gem_object_unreference(obj);
3122                 return -EINVAL;
3123         }
3124         ring->ring_obj = obj;
3125         ring->virtual_start = ring->map.handle;
3126
3127         /* Stop the ring if it's running. */
3128         I915_WRITE(PRB0_CTL, 0);
3129         I915_WRITE(PRB0_TAIL, 0);
3130         I915_WRITE(PRB0_HEAD, 0);
3131
3132         /* Initialize the ring. */
3133         I915_WRITE(PRB0_START, obj_priv->gtt_offset);
3134         head = I915_READ(PRB0_HEAD) & HEAD_ADDR;
3135
3136         /* G45 ring initialization fails to reset head to zero */
3137         if (head != 0) {
3138                 DRM_ERROR("Ring head not reset to zero "
3139                           "ctl %08x head %08x tail %08x start %08x\n",
3140                           I915_READ(PRB0_CTL),
3141                           I915_READ(PRB0_HEAD),
3142                           I915_READ(PRB0_TAIL),
3143                           I915_READ(PRB0_START));
3144                 I915_WRITE(PRB0_HEAD, 0);
3145
3146                 DRM_ERROR("Ring head forced to zero "
3147                           "ctl %08x head %08x tail %08x start %08x\n",
3148                           I915_READ(PRB0_CTL),
3149                           I915_READ(PRB0_HEAD),
3150                           I915_READ(PRB0_TAIL),
3151                           I915_READ(PRB0_START));
3152         }
3153
3154         I915_WRITE(PRB0_CTL,
3155                    ((obj->size - 4096) & RING_NR_PAGES) |
3156                    RING_NO_REPORT |
3157                    RING_VALID);
3158
3159         head = I915_READ(PRB0_HEAD) & HEAD_ADDR;
3160
3161         /* If the head is still not zero, the ring is dead */
3162         if (head != 0) {
3163                 DRM_ERROR("Ring initialization failed "
3164                           "ctl %08x head %08x tail %08x start %08x\n",
3165                           I915_READ(PRB0_CTL),
3166                           I915_READ(PRB0_HEAD),
3167                           I915_READ(PRB0_TAIL),
3168                           I915_READ(PRB0_START));
3169                 return -EIO;
3170         }
3171
3172         /* Update our cache of the ring state */
3173         if (!drm_core_check_feature(dev, DRIVER_MODESET))
3174                 i915_kernel_lost_context(dev);
3175         else {
3176                 ring->head = I915_READ(PRB0_HEAD) & HEAD_ADDR;
3177                 ring->tail = I915_READ(PRB0_TAIL) & TAIL_ADDR;
3178                 ring->space = ring->head - (ring->tail + 8);
3179                 if (ring->space < 0)
3180                         ring->space += ring->Size;
3181         }
3182
3183         return 0;
3184 }
3185
3186 void
3187 i915_gem_cleanup_ringbuffer(struct drm_device *dev)
3188 {
3189         drm_i915_private_t *dev_priv = dev->dev_private;
3190
3191         if (dev_priv->ring.ring_obj == NULL)
3192                 return;
3193
3194         drm_core_ioremapfree(&dev_priv->ring.map, dev);
3195
3196         i915_gem_object_unpin(dev_priv->ring.ring_obj);
3197         drm_gem_object_unreference(dev_priv->ring.ring_obj);
3198         dev_priv->ring.ring_obj = NULL;
3199         memset(&dev_priv->ring, 0, sizeof(dev_priv->ring));
3200
3201         if (dev_priv->hws_obj != NULL) {
3202                 struct drm_gem_object *obj = dev_priv->hws_obj;
3203                 struct drm_i915_gem_object *obj_priv = obj->driver_private;
3204
3205                 kunmap(obj_priv->page_list[0]);
3206                 i915_gem_object_unpin(obj);
3207                 drm_gem_object_unreference(obj);
3208                 dev_priv->hws_obj = NULL;
3209                 memset(&dev_priv->hws_map, 0, sizeof(dev_priv->hws_map));
3210                 dev_priv->hw_status_page = NULL;
3211
3212                 /* Write high address into HWS_PGA when disabling. */
3213                 I915_WRITE(HWS_PGA, 0x1ffff000);
3214         }
3215 }
3216
3217 int
3218 i915_gem_entervt_ioctl(struct drm_device *dev, void *data,
3219                        struct drm_file *file_priv)
3220 {
3221         drm_i915_private_t *dev_priv = dev->dev_private;
3222         int ret;
3223
3224         if (drm_core_check_feature(dev, DRIVER_MODESET))
3225                 return 0;
3226
3227         if (dev_priv->mm.wedged) {
3228                 DRM_ERROR("Reenabling wedged hardware, good luck\n");
3229                 dev_priv->mm.wedged = 0;
3230         }
3231
3232         dev_priv->mm.gtt_mapping = io_mapping_create_wc(dev->agp->base,
3233                                                         dev->agp->agp_info.aper_size
3234                                                         * 1024 * 1024);
3235
3236         mutex_lock(&dev->struct_mutex);
3237         dev_priv->mm.suspended = 0;
3238
3239         ret = i915_gem_init_ringbuffer(dev);
3240         if (ret != 0)
3241                 return ret;
3242
3243         BUG_ON(!list_empty(&dev_priv->mm.active_list));
3244         BUG_ON(!list_empty(&dev_priv->mm.flushing_list));
3245         BUG_ON(!list_empty(&dev_priv->mm.inactive_list));
3246         BUG_ON(!list_empty(&dev_priv->mm.request_list));
3247         mutex_unlock(&dev->struct_mutex);
3248
3249         drm_irq_install(dev);
3250
3251         return 0;
3252 }
3253
3254 int
3255 i915_gem_leavevt_ioctl(struct drm_device *dev, void *data,
3256                        struct drm_file *file_priv)
3257 {
3258         drm_i915_private_t *dev_priv = dev->dev_private;
3259         int ret;
3260
3261         if (drm_core_check_feature(dev, DRIVER_MODESET))
3262                 return 0;
3263
3264         ret = i915_gem_idle(dev);
3265         drm_irq_uninstall(dev);
3266
3267         io_mapping_free(dev_priv->mm.gtt_mapping);
3268         return ret;
3269 }
3270
3271 void
3272 i915_gem_lastclose(struct drm_device *dev)
3273 {
3274         int ret;
3275
3276         ret = i915_gem_idle(dev);
3277         if (ret)
3278                 DRM_ERROR("failed to idle hardware: %d\n", ret);
3279 }
3280
3281 void
3282 i915_gem_load(struct drm_device *dev)
3283 {
3284         drm_i915_private_t *dev_priv = dev->dev_private;
3285
3286         INIT_LIST_HEAD(&dev_priv->mm.active_list);
3287         INIT_LIST_HEAD(&dev_priv->mm.flushing_list);
3288         INIT_LIST_HEAD(&dev_priv->mm.inactive_list);
3289         INIT_LIST_HEAD(&dev_priv->mm.request_list);
3290         INIT_DELAYED_WORK(&dev_priv->mm.retire_work,
3291                           i915_gem_retire_work_handler);
3292         dev_priv->mm.next_gem_seqno = 1;
3293
3294         /* Old X drivers will take 0-2 for front, back, depth buffers */
3295         dev_priv->fence_reg_start = 3;
3296
3297         if (IS_I965G(dev))
3298                 dev_priv->num_fence_regs = 16;
3299         else
3300                 dev_priv->num_fence_regs = 8;
3301
3302         i915_gem_detect_bit_6_swizzle(dev);
3303 }
3304
3305 /*
3306  * Create a physically contiguous memory object for this object
3307  * e.g. for cursor + overlay regs
3308  */
3309 int i915_gem_init_phys_object(struct drm_device *dev,
3310                               int id, int size)
3311 {
3312         drm_i915_private_t *dev_priv = dev->dev_private;
3313         struct drm_i915_gem_phys_object *phys_obj;
3314         int ret;
3315
3316         if (dev_priv->mm.phys_objs[id - 1] || !size)
3317                 return 0;
3318
3319         phys_obj = drm_calloc(1, sizeof(struct drm_i915_gem_phys_object), DRM_MEM_DRIVER);
3320         if (!phys_obj)
3321                 return -ENOMEM;
3322
3323         phys_obj->id = id;
3324
3325         phys_obj->handle = drm_pci_alloc(dev, size, 0, 0xffffffff);
3326         if (!phys_obj->handle) {
3327                 ret = -ENOMEM;
3328                 goto kfree_obj;
3329         }
3330 #ifdef CONFIG_X86
3331         set_memory_wc((unsigned long)phys_obj->handle->vaddr, phys_obj->handle->size / PAGE_SIZE);
3332 #endif
3333
3334         dev_priv->mm.phys_objs[id - 1] = phys_obj;
3335
3336         return 0;
3337 kfree_obj:
3338         drm_free(phys_obj, sizeof(struct drm_i915_gem_phys_object), DRM_MEM_DRIVER);
3339         return ret;
3340 }
3341
3342 void i915_gem_free_phys_object(struct drm_device *dev, int id)
3343 {
3344         drm_i915_private_t *dev_priv = dev->dev_private;
3345         struct drm_i915_gem_phys_object *phys_obj;
3346
3347         if (!dev_priv->mm.phys_objs[id - 1])
3348                 return;
3349
3350         phys_obj = dev_priv->mm.phys_objs[id - 1];
3351         if (phys_obj->cur_obj) {
3352                 i915_gem_detach_phys_object(dev, phys_obj->cur_obj);
3353         }
3354
3355 #ifdef CONFIG_X86
3356         set_memory_wb((unsigned long)phys_obj->handle->vaddr, phys_obj->handle->size / PAGE_SIZE);
3357 #endif
3358         drm_pci_free(dev, phys_obj->handle);
3359         kfree(phys_obj);
3360         dev_priv->mm.phys_objs[id - 1] = NULL;
3361 }
3362
3363 void i915_gem_free_all_phys_object(struct drm_device *dev)
3364 {
3365         int i;
3366
3367         for (i = I915_GEM_PHYS_CURSOR_0; i <= I915_MAX_PHYS_OBJECT; i++)
3368                 i915_gem_free_phys_object(dev, i);
3369 }
3370
3371 void i915_gem_detach_phys_object(struct drm_device *dev,
3372                                  struct drm_gem_object *obj)
3373 {
3374         struct drm_i915_gem_object *obj_priv;
3375         int i;
3376         int ret;
3377         int page_count;
3378
3379         obj_priv = obj->driver_private;
3380         if (!obj_priv->phys_obj)
3381                 return;
3382
3383         ret = i915_gem_object_get_page_list(obj);
3384         if (ret)
3385                 goto out;
3386
3387         page_count = obj->size / PAGE_SIZE;
3388
3389         for (i = 0; i < page_count; i++) {
3390                 char *dst = kmap_atomic(obj_priv->page_list[i], KM_USER0);
3391                 char *src = obj_priv->phys_obj->handle->vaddr + (i * PAGE_SIZE);
3392
3393                 memcpy(dst, src, PAGE_SIZE);
3394                 kunmap_atomic(dst, KM_USER0);
3395         }
3396         drm_clflush_pages(obj_priv->page_list, page_count);
3397         drm_agp_chipset_flush(dev);
3398 out:
3399         obj_priv->phys_obj->cur_obj = NULL;
3400         obj_priv->phys_obj = NULL;
3401 }
3402
3403 int
3404 i915_gem_attach_phys_object(struct drm_device *dev,
3405                             struct drm_gem_object *obj, int id)
3406 {
3407         drm_i915_private_t *dev_priv = dev->dev_private;
3408         struct drm_i915_gem_object *obj_priv;
3409         int ret = 0;
3410         int page_count;
3411         int i;
3412
3413         if (id > I915_MAX_PHYS_OBJECT)
3414                 return -EINVAL;
3415
3416         obj_priv = obj->driver_private;
3417
3418         if (obj_priv->phys_obj) {
3419                 if (obj_priv->phys_obj->id == id)
3420                         return 0;
3421                 i915_gem_detach_phys_object(dev, obj);
3422         }
3423
3424
3425         /* create a new object */
3426         if (!dev_priv->mm.phys_objs[id - 1]) {
3427                 ret = i915_gem_init_phys_object(dev, id,
3428                                                 obj->size);
3429                 if (ret) {
3430                         DRM_ERROR("failed to init phys object %d size: %zu\n", id, obj->size);
3431                         goto out;
3432                 }
3433         }
3434
3435         /* bind to the object */
3436         obj_priv->phys_obj = dev_priv->mm.phys_objs[id - 1];
3437         obj_priv->phys_obj->cur_obj = obj;
3438
3439         ret = i915_gem_object_get_page_list(obj);
3440         if (ret) {
3441                 DRM_ERROR("failed to get page list\n");
3442                 goto out;
3443         }
3444
3445         page_count = obj->size / PAGE_SIZE;
3446
3447         for (i = 0; i < page_count; i++) {
3448                 char *src = kmap_atomic(obj_priv->page_list[i], KM_USER0);
3449                 char *dst = obj_priv->phys_obj->handle->vaddr + (i * PAGE_SIZE);
3450
3451                 memcpy(dst, src, PAGE_SIZE);
3452                 kunmap_atomic(src, KM_USER0);
3453         }
3454
3455         return 0;
3456 out:
3457         return ret;
3458 }
3459
3460 static int
3461 i915_gem_phys_pwrite(struct drm_device *dev, struct drm_gem_object *obj,
3462                      struct drm_i915_gem_pwrite *args,
3463                      struct drm_file *file_priv)
3464 {
3465         struct drm_i915_gem_object *obj_priv = obj->driver_private;
3466         void *obj_addr;
3467         int ret;
3468         char __user *user_data;
3469
3470         user_data = (char __user *) (uintptr_t) args->data_ptr;
3471         obj_addr = obj_priv->phys_obj->handle->vaddr + args->offset;
3472
3473         DRM_ERROR("obj_addr %p, %lld\n", obj_addr, args->size);
3474         ret = copy_from_user(obj_addr, user_data, args->size);
3475         if (ret)
3476                 return -EFAULT;
3477
3478         drm_agp_chipset_flush(dev);
3479         return 0;
3480 }