SAFE public projects git trees. - safe/jmp/linux-2.6/blob - drivers/char/drm/drm_bufs.c

   1 /**
   2  * \file drm_bufs.c
   3  * Generic buffer template
   4  *
   5  * \author Rickard E. (Rik) Faith <faith@valinux.com>
   6  * \author Gareth Hughes <gareth@valinux.com>
   7  */
   8
   9 /*
  10  * Created: Thu Nov 23 03:10:50 2000 by gareth@valinux.com
  11  *
  12  * Copyright 1999, 2000 Precision Insight, Inc., Cedar Park, Texas.
  13  * Copyright 2000 VA Linux Systems, Inc., Sunnyvale, California.
  14  * All Rights Reserved.
  15  *
  16  * Permission is hereby granted, free of charge, to any person obtaining a
  17  * copy of this software and associated documentation files (the "Software"),
  18  * to deal in the Software without restriction, including without limitation
  19  * the rights to use, copy, modify, merge, publish, distribute, sublicense,
  20  * and/or sell copies of the Software, and to permit persons to whom the
  21  * Software is furnished to do so, subject to the following conditions:
  22  *
  23  * The above copyright notice and this permission notice (including the next
  24  * paragraph) shall be included in all copies or substantial portions of the
  25  * Software.
  26  *
  27  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  28  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  29  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
  30  * VA LINUX SYSTEMS AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM, DAMAGES OR
  31  * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
  32  * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
  33  * OTHER DEALINGS IN THE SOFTWARE.
  34  */
  35
  36 #include <linux/vmalloc.h>
  37 #include "drmP.h"
  38
  39 unsigned long drm_get_resource_start(struct drm_device *dev, unsigned int resource)
  40 {
  41         return pci_resource_start(dev->pdev, resource);
  42 }
  43 EXPORT_SYMBOL(drm_get_resource_start);
  44
  45 unsigned long drm_get_resource_len(struct drm_device *dev, unsigned int resource)
  46 {
  47         return pci_resource_len(dev->pdev, resource);
  48 }
  49
  50 EXPORT_SYMBOL(drm_get_resource_len);
  51
  52 static struct drm_map_list *drm_find_matching_map(struct drm_device *dev,
  53                                              drm_local_map_t *map)
  54 {
  55         struct drm_map_list *entry;
  56         list_for_each_entry(entry, &dev->maplist, head) {
  57                 if (entry->map && map->type == entry->map->type &&
  58                     ((entry->map->offset == map->offset) ||
  59                      (map->type == _DRM_SHM && map->flags==_DRM_CONTAINS_LOCK))) {
  60                         return entry;
  61                 }
  62         }
  63
  64         return NULL;
  65 }
  66
  67 static int drm_map_handle(struct drm_device *dev, drm_hash_item_t *hash,
  68                           unsigned long user_token, int hashed_handle)
  69 {
  70         int use_hashed_handle;
  71 #if (BITS_PER_LONG == 64)
  72         use_hashed_handle = ((user_token & 0xFFFFFFFF00000000UL) || hashed_handle);
  73 #elif (BITS_PER_LONG == 32)
  74         use_hashed_handle = hashed_handle;
  75 #else
  76 #error Unsupported long size. Neither 64 nor 32 bits.
  77 #endif
  78
  79         if (!use_hashed_handle) {
  80                 int ret;
  81                 hash->key = user_token >> PAGE_SHIFT;
  82                 ret = drm_ht_insert_item(&dev->map_hash, hash);
  83                 if (ret != -EINVAL)
  84                         return ret;
  85         }
  86         return drm_ht_just_insert_please(&dev->map_hash, hash,
  87                                          user_token, 32 - PAGE_SHIFT - 3,
  88                                          0, DRM_MAP_HASH_OFFSET >> PAGE_SHIFT);
  89 }
  90
  91 /**
  92  * Ioctl to specify a range of memory that is available for mapping by a non-root process.
  93  *
  94  * \param inode device inode.
  95  * \param filp file pointer.
  96  * \param cmd command.
  97  * \param arg pointer to a drm_map structure.
  98  * \return zero on success or a negative value on error.
  99  *
 100  * Adjusts the memory offset to its absolute value according to the mapping
 101  * type.  Adds the map to the map list drm_device::maplist. Adds MTRR's where
 102  * applicable and if supported by the kernel.
 103  */
 104 static int drm_addmap_core(struct drm_device * dev, unsigned int offset,
 105                            unsigned int size, enum drm_map_type type,
 106                            enum drm_map_flags flags,
 107                            struct drm_map_list ** maplist)
 108 {
 109         struct drm_map *map;
 110         struct drm_map_list *list;
 111         drm_dma_handle_t *dmah;
 112         unsigned long user_token;
 113         int ret;
 114
 115         map = drm_alloc(sizeof(*map), DRM_MEM_MAPS);
 116         if (!map)
 117                 return -ENOMEM;
 118
 119         map->offset = offset;
 120         map->size = size;
 121         map->flags = flags;
 122         map->type = type;
 123
 124         /* Only allow shared memory to be removable since we only keep enough
 125          * book keeping information about shared memory to allow for removal
 126          * when processes fork.
 127          */
 128         if ((map->flags & _DRM_REMOVABLE) && map->type != _DRM_SHM) {
 129                 drm_free(map, sizeof(*map), DRM_MEM_MAPS);
 130                 return -EINVAL;
 131         }
 132         DRM_DEBUG("offset = 0x%08lx, size = 0x%08lx, type = %d\n",
 133                   map->offset, map->size, map->type);
 134         if ((map->offset & (~PAGE_MASK)) || (map->size & (~PAGE_MASK))) {
 135                 drm_free(map, sizeof(*map), DRM_MEM_MAPS);
 136                 return -EINVAL;
 137         }
 138         map->mtrr = -1;
 139         map->handle = NULL;
 140
 141         switch (map->type) {
 142         case _DRM_REGISTERS:
 143         case _DRM_FRAME_BUFFER:
 144 #if !defined(__sparc__) && !defined(__alpha__) && !defined(__ia64__) && !defined(__powerpc64__) && !defined(__x86_64__)
 145                 if (map->offset + (map->size-1) < map->offset ||
 146                     map->offset < virt_to_phys(high_memory)) {
 147                         drm_free(map, sizeof(*map), DRM_MEM_MAPS);
 148                         return -EINVAL;
 149                 }
 150 #endif
 151 #ifdef __alpha__
 152                 map->offset += dev->hose->mem_space->start;
 153 #endif
 154                 /* Some drivers preinitialize some maps, without the X Server
 155                  * needing to be aware of it.  Therefore, we just return success
 156                  * when the server tries to create a duplicate map.
 157                  */
 158                 list = drm_find_matching_map(dev, map);
 159                 if (list != NULL) {
 160                         if (list->map->size != map->size) {
 161                                 DRM_DEBUG("Matching maps of type %d with "
 162                                           "mismatched sizes, (%ld vs %ld)\n",
 163                                           map->type, map->size,
 164                                           list->map->size);
 165                                 list->map->size = map->size;
 166                         }
 167
 168                         drm_free(map, sizeof(*map), DRM_MEM_MAPS);
 169                         *maplist = list;
 170                         return 0;
 171                 }
 172
 173                 if (drm_core_has_MTRR(dev)) {
 174                         if (map->type == _DRM_FRAME_BUFFER ||
 175                             (map->flags & _DRM_WRITE_COMBINING)) {
 176                                 map->mtrr = mtrr_add(map->offset, map->size,
 177                                                      MTRR_TYPE_WRCOMB, 1);
 178                         }
 179                 }
 180                 if (map->type == _DRM_REGISTERS)
 181                         map->handle = ioremap(map->offset, map->size);
 182                 break;
 183         case _DRM_SHM:
 184                 list = drm_find_matching_map(dev, map);
 185                 if (list != NULL) {
 186                         if(list->map->size != map->size) {
 187                                 DRM_DEBUG("Matching maps of type %d with "
 188                                           "mismatched sizes, (%ld vs %ld)\n",
 189                                           map->type, map->size, list->map->size);
 190                                 list->map->size = map->size;
 191                         }
 192
 193                         drm_free(map, sizeof(*map), DRM_MEM_MAPS);
 194                         *maplist = list;
 195                         return 0;
 196                 }
 197                 map->handle = vmalloc_user(map->size);
 198                 DRM_DEBUG("%lu %d %p\n",
 199                           map->size, drm_order(map->size), map->handle);
 200                 if (!map->handle) {
 201                         drm_free(map, sizeof(*map), DRM_MEM_MAPS);
 202                         return -ENOMEM;
 203                 }
 204                 map->offset = (unsigned long)map->handle;
 205                 if (map->flags & _DRM_CONTAINS_LOCK) {
 206                         /* Prevent a 2nd X Server from creating a 2nd lock */
 207                         if (dev->lock.hw_lock != NULL) {
 208                                 vfree(map->handle);
 209                                 drm_free(map, sizeof(*map), DRM_MEM_MAPS);
 210                                 return -EBUSY;
 211                         }
 212                         dev->sigdata.lock = dev->lock.hw_lock = map->handle;    /* Pointer to lock */
 213                 }
 214                 break;
 215         case _DRM_AGP: {
 216                 struct drm_agp_mem *entry;
 217                 int valid = 0;
 218
 219                 if (!drm_core_has_AGP(dev)) {
 220                         drm_free(map, sizeof(*map), DRM_MEM_MAPS);
 221                         return -EINVAL;
 222                 }
 223 #ifdef __alpha__
 224                 map->offset += dev->hose->mem_space->start;
 225 #endif
 226                 /* Note: dev->agp->base may actually be 0 when the DRM
 227                  * is not in control of AGP space. But if user space is
 228                  * it should already have added the AGP base itself.
 229                  */
 230                 map->offset += dev->agp->base;
 231                 map->mtrr = dev->agp->agp_mtrr; /* for getmap */
 232
 233                 /* This assumes the DRM is in total control of AGP space.
 234                  * It's not always the case as AGP can be in the control
 235                  * of user space (i.e. i810 driver). So this loop will get
 236                  * skipped and we double check that dev->agp->memory is
 237                  * actually set as well as being invalid before EPERM'ing
 238                  */
 239                 list_for_each_entry(entry, &dev->agp->memory, head) {
 240                         if ((map->offset >= entry->bound) &&
 241                             (map->offset + map->size <= entry->bound + entry->pages * PAGE_SIZE)) {
 242                                 valid = 1;
 243                                 break;
 244                         }
 245                 }
 246                 if (!list_empty(&dev->agp->memory) && !valid) {
 247                         drm_free(map, sizeof(*map), DRM_MEM_MAPS);
 248                         return -EPERM;
 249                 }
 250                 DRM_DEBUG("AGP offset = 0x%08lx, size = 0x%08lx\n", map->offset, map->size);
 251
 252                 break;
 253         }
 254         case _DRM_SCATTER_GATHER:
 255                 if (!dev->sg) {
 256                         drm_free(map, sizeof(*map), DRM_MEM_MAPS);
 257                         return -EINVAL;
 258                 }
 259                 map->offset += (unsigned long)dev->sg->virtual;
 260                 break;
 261         case _DRM_CONSISTENT:
 262                 /* dma_addr_t is 64bit on i386 with CONFIG_HIGHMEM64G,
 263                  * As we're limiting the address to 2^32-1 (or less),
 264                  * casting it down to 32 bits is no problem, but we
 265                  * need to point to a 64bit variable first. */
 266                 dmah = drm_pci_alloc(dev, map->size, map->size, 0xffffffffUL);
 267                 if (!dmah) {
 268                         drm_free(map, sizeof(*map), DRM_MEM_MAPS);
 269                         return -ENOMEM;
 270                 }
 271                 map->handle = dmah->vaddr;
 272                 map->offset = (unsigned long)dmah->busaddr;
 273                 kfree(dmah);
 274                 break;
 275         default:
 276                 drm_free(map, sizeof(*map), DRM_MEM_MAPS);
 277                 return -EINVAL;
 278         }
 279
 280         list = drm_alloc(sizeof(*list), DRM_MEM_MAPS);
 281         if (!list) {
 282                 if (map->type == _DRM_REGISTERS)
 283                         iounmap(map->handle);
 284                 drm_free(map, sizeof(*map), DRM_MEM_MAPS);
 285                 return -EINVAL;
 286         }
 287         memset(list, 0, sizeof(*list));
 288         list->map = map;
 289
 290         mutex_lock(&dev->struct_mutex);
 291         list_add(&list->head, &dev->maplist);
 292
 293         /* Assign a 32-bit handle */
 294         /* We do it here so that dev->struct_mutex protects the increment */
 295         user_token = (map->type == _DRM_SHM) ? (unsigned long)map->handle :
 296                 map->offset;
 297         ret = drm_map_handle(dev, &list->hash, user_token, 0);
 298         if (ret) {
 299                 if (map->type == _DRM_REGISTERS)
 300                         iounmap(map->handle);
 301                 drm_free(map, sizeof(*map), DRM_MEM_MAPS);
 302                 drm_free(list, sizeof(*list), DRM_MEM_MAPS);
 303                 mutex_unlock(&dev->struct_mutex);
 304                 return ret;
 305         }
 306
 307         list->user_token = list->hash.key << PAGE_SHIFT;
 308         mutex_unlock(&dev->struct_mutex);
 309
 310         *maplist = list;
 311         return 0;
 312         }
 313
 314 int drm_addmap(struct drm_device * dev, unsigned int offset,
 315                unsigned int size, enum drm_map_type type,
 316                enum drm_map_flags flags, drm_local_map_t ** map_ptr)
 317 {
 318         struct drm_map_list *list;
 319         int rc;
 320
 321         rc = drm_addmap_core(dev, offset, size, type, flags, &list);
 322         if (!rc)
 323                 *map_ptr = list->map;
 324         return rc;
 325 }
 326
 327 EXPORT_SYMBOL(drm_addmap);
 328
 329 int drm_addmap_ioctl(struct inode *inode, struct file *filp,
 330                      unsigned int cmd, unsigned long arg)
 331 {
 332         struct drm_file *priv = filp->private_data;
 333         struct drm_device *dev = priv->head->dev;
 334         struct drm_map map;
 335         struct drm_map_list *maplist;
 336         struct drm_map __user *argp = (void __user *)arg;
 337         int err;
 338
 339         if (!(filp->f_mode & 3))
 340                 return -EACCES; /* Require read/write */
 341
 342         if (copy_from_user(&map, argp, sizeof(map))) {
 343                 return -EFAULT;
 344         }
 345
 346         if (!(capable(CAP_SYS_ADMIN) || map.type == _DRM_AGP))
 347                 return -EPERM;
 348
 349         err = drm_addmap_core(dev, map.offset, map.size, map.type, map.flags,
 350                               &maplist);
 351
 352         if (err)
 353                 return err;
 354
 355         if (copy_to_user(argp, maplist->map, sizeof(struct drm_map)))
 356                 return -EFAULT;
 357
 358         /* avoid a warning on 64-bit, this casting isn't very nice, but the API is set so too late */
 359         if (put_user((void *)(unsigned long)maplist->user_token, &argp->handle))
 360                 return -EFAULT;
 361         return 0;
 362 }
 363
 364 /**
 365  * Remove a map private from list and deallocate resources if the mapping
 366  * isn't in use.
 367  *
 368  * \param inode device inode.
 369  * \param filp file pointer.
 370  * \param cmd command.
 371  * \param arg pointer to a struct drm_map structure.
 372  * \return zero on success or a negative value on error.
 373  *
 374  * Searches the map on drm_device::maplist, removes it from the list, see if
 375  * its being used, and free any associate resource (such as MTRR's) if it's not
 376  * being on use.
 377  *
 378  * \sa drm_addmap
 379  */
 380 int drm_rmmap_locked(struct drm_device *dev, drm_local_map_t *map)
 381 {
 382         struct drm_map_list *r_list = NULL, *list_t;
 383         drm_dma_handle_t dmah;
 384         int found = 0;
 385
 386         /* Find the list entry for the map and remove it */
 387         list_for_each_entry_safe(r_list, list_t, &dev->maplist, head) {
 388                 if (r_list->map == map) {
 389                         list_del(&r_list->head);
 390                         drm_ht_remove_key(&dev->map_hash,
 391                                           r_list->user_token >> PAGE_SHIFT);
 392                         drm_free(r_list, sizeof(*r_list), DRM_MEM_MAPS);
 393                         found = 1;
 394                         break;
 395                 }
 396         }
 397
 398         if (!found)
 399                 return -EINVAL;
 400
 401         switch (map->type) {
 402         case _DRM_REGISTERS:
 403                 iounmap(map->handle);
 404                 /* FALLTHROUGH */
 405         case _DRM_FRAME_BUFFER:
 406                 if (drm_core_has_MTRR(dev) && map->mtrr >= 0) {
 407                         int retcode;
 408                         retcode = mtrr_del(map->mtrr, map->offset, map->size);
 409                         DRM_DEBUG("mtrr_del=%d\n", retcode);
 410                 }
 411                 break;
 412         case _DRM_SHM:
 413                 vfree(map->handle);
 414                 break;
 415         case _DRM_AGP:
 416         case _DRM_SCATTER_GATHER:
 417                 break;
 418         case _DRM_CONSISTENT:
 419                 dmah.vaddr = map->handle;
 420                 dmah.busaddr = map->offset;
 421                 dmah.size = map->size;
 422                 __drm_pci_free(dev, &dmah);
 423                 break;
 424         }
 425         drm_free(map, sizeof(*map), DRM_MEM_MAPS);
 426
 427         return 0;
 428 }
 429
 430 int drm_rmmap(struct drm_device *dev, drm_local_map_t *map)
 431 {
 432         int ret;
 433
 434         mutex_lock(&dev->struct_mutex);
 435         ret = drm_rmmap_locked(dev, map);
 436         mutex_unlock(&dev->struct_mutex);
 437
 438         return ret;
 439 }
 440
 441 /* The rmmap ioctl appears to be unnecessary.  All mappings are torn down on
 442  * the last close of the device, and this is necessary for cleanup when things
 443  * exit uncleanly.  Therefore, having userland manually remove mappings seems
 444  * like a pointless exercise since they're going away anyway.
 445  *
 446  * One use case might be after addmap is allowed for normal users for SHM and
 447  * gets used by drivers that the server doesn't need to care about.  This seems
 448  * unlikely.
 449  */
 450 int drm_rmmap_ioctl(struct inode *inode, struct file *filp,
 451                     unsigned int cmd, unsigned long arg)
 452 {
 453         struct drm_file *priv = filp->private_data;
 454         struct drm_device *dev = priv->head->dev;
 455         struct drm_map request;
 456         drm_local_map_t *map = NULL;
 457         struct drm_map_list *r_list;
 458         int ret;
 459
 460         if (copy_from_user(&request, (struct drm_map __user *) arg, sizeof(request))) {
 461                 return -EFAULT;
 462         }
 463
 464         mutex_lock(&dev->struct_mutex);
 465         list_for_each_entry(r_list, &dev->maplist, head) {
 466                 if (r_list->map &&
 467                     r_list->user_token == (unsigned long)request.handle &&
 468                     r_list->map->flags & _DRM_REMOVABLE) {
 469                         map = r_list->map;
 470                         break;
 471                 }
 472         }
 473
 474         /* List has wrapped around to the head pointer, or its empty we didn't
 475          * find anything.
 476          */
 477         if (list_empty(&dev->maplist) || !map) {
 478                 mutex_unlock(&dev->struct_mutex);
 479                 return -EINVAL;
 480         }
 481
 482         if (!map) {
 483                 mutex_unlock(&dev->struct_mutex);
 484                 return -EINVAL;
 485         }
 486
 487         /* Register and framebuffer maps are permanent */
 488         if ((map->type == _DRM_REGISTERS) || (map->type == _DRM_FRAME_BUFFER)) {
 489                 mutex_unlock(&dev->struct_mutex);
 490                 return 0;
 491         }
 492
 493         ret = drm_rmmap_locked(dev, map);
 494
 495         mutex_unlock(&dev->struct_mutex);
 496
 497         return ret;
 498 }
 499
 500 /**
 501  * Cleanup after an error on one of the addbufs() functions.
 502  *
 503  * \param dev DRM device.
 504  * \param entry buffer entry where the error occurred.
 505  *
 506  * Frees any pages and buffers associated with the given entry.
 507  */
 508 static void drm_cleanup_buf_error(struct drm_device * dev,
 509                                   struct drm_buf_entry * entry)
 510 {
 511         int i;
 512
 513         if (entry->seg_count) {
 514                 for (i = 0; i < entry->seg_count; i++) {
 515                         if (entry->seglist[i]) {
 516                                 drm_pci_free(dev, entry->seglist[i]);
 517                         }
 518                 }
 519                 drm_free(entry->seglist,
 520                          entry->seg_count *
 521                          sizeof(*entry->seglist), DRM_MEM_SEGS);
 522
 523                 entry->seg_count = 0;
 524         }
 525
 526         if (entry->buf_count) {
 527                 for (i = 0; i < entry->buf_count; i++) {
 528                         if (entry->buflist[i].dev_private) {
 529                                 drm_free(entry->buflist[i].dev_private,
 530                                          entry->buflist[i].dev_priv_size,
 531                                          DRM_MEM_BUFS);
 532                         }
 533                 }
 534                 drm_free(entry->buflist,
 535                          entry->buf_count *
 536                          sizeof(*entry->buflist), DRM_MEM_BUFS);
 537
 538                 entry->buf_count = 0;
 539         }
 540 }
 541
 542 #if __OS_HAS_AGP
 543 /**
 544  * Add AGP buffers for DMA transfers.
 545  *
 546  * \param dev struct drm_device to which the buffers are to be added.
 547  * \param request pointer to a struct drm_buf_desc describing the request.
 548  * \return zero on success or a negative number on failure.
 549  *
 550  * After some sanity checks creates a drm_buf structure for each buffer and
 551  * reallocates the buffer list of the same size order to accommodate the new
 552  * buffers.
 553  */
 554 int drm_addbufs_agp(struct drm_device * dev, struct drm_buf_desc * request)
 555 {
 556         struct drm_device_dma *dma = dev->dma;
 557         struct drm_buf_entry *entry;
 558         struct drm_agp_mem *agp_entry;
 559         struct drm_buf *buf;
 560         unsigned long offset;
 561         unsigned long agp_offset;
 562         int count;
 563         int order;
 564         int size;
 565         int alignment;
 566         int page_order;
 567         int total;
 568         int byte_count;
 569         int i, valid;
 570         struct drm_buf **temp_buflist;
 571
 572         if (!dma)
 573                 return -EINVAL;
 574
 575         count = request->count;
 576         order = drm_order(request->size);
 577         size = 1 << order;
 578
 579         alignment = (request->flags & _DRM_PAGE_ALIGN)
 580             ? PAGE_ALIGN(size) : size;
 581         page_order = order - PAGE_SHIFT > 0 ? order - PAGE_SHIFT : 0;
 582         total = PAGE_SIZE << page_order;
 583
 584         byte_count = 0;
 585         agp_offset = dev->agp->base + request->agp_start;
 586
 587         DRM_DEBUG("count:      %d\n", count);
 588         DRM_DEBUG("order:      %d\n", order);
 589         DRM_DEBUG("size:       %d\n", size);
 590         DRM_DEBUG("agp_offset: %lx\n", agp_offset);
 591         DRM_DEBUG("alignment:  %d\n", alignment);
 592         DRM_DEBUG("page_order: %d\n", page_order);
 593         DRM_DEBUG("total:      %d\n", total);
 594
 595         if (order < DRM_MIN_ORDER || order > DRM_MAX_ORDER)
 596                 return -EINVAL;
 597         if (dev->queue_count)
 598                 return -EBUSY;  /* Not while in use */
 599
 600         /* Make sure buffers are located in AGP memory that we own */
 601         valid = 0;
 602         list_for_each_entry(agp_entry, &dev->agp->memory, head) {
 603                 if ((agp_offset >= agp_entry->bound) &&
 604                     (agp_offset + total * count <= agp_entry->bound + agp_entry->pages * PAGE_SIZE)) {
 605                         valid = 1;
 606                         break;
 607                 }
 608         }
 609         if (!list_empty(&dev->agp->memory) && !valid) {
 610                 DRM_DEBUG("zone invalid\n");
 611                 return -EINVAL;
 612         }
 613         spin_lock(&dev->count_lock);
 614         if (dev->buf_use) {
 615                 spin_unlock(&dev->count_lock);
 616                 return -EBUSY;
 617         }
 618         atomic_inc(&dev->buf_alloc);
 619         spin_unlock(&dev->count_lock);
 620
 621         mutex_lock(&dev->struct_mutex);
 622         entry = &dma->bufs[order];
 623         if (entry->buf_count) {
 624                 mutex_unlock(&dev->struct_mutex);
 625                 atomic_dec(&dev->buf_alloc);
 626                 return -ENOMEM; /* May only call once for each order */
 627         }
 628
 629         if (count < 0 || count > 4096) {
 630                 mutex_unlock(&dev->struct_mutex);
 631                 atomic_dec(&dev->buf_alloc);
 632                 return -EINVAL;
 633         }
 634
 635         entry->buflist = drm_alloc(count * sizeof(*entry->buflist),
 636                                    DRM_MEM_BUFS);
 637         if (!entry->buflist) {
 638                 mutex_unlock(&dev->struct_mutex);
 639                 atomic_dec(&dev->buf_alloc);
 640                 return -ENOMEM;
 641         }
 642         memset(entry->buflist, 0, count * sizeof(*entry->buflist));
 643
 644         entry->buf_size = size;
 645         entry->page_order = page_order;
 646
 647         offset = 0;
 648
 649         while (entry->buf_count < count) {
 650                 buf = &entry->buflist[entry->buf_count];
 651                 buf->idx = dma->buf_count + entry->buf_count;
 652                 buf->total = alignment;
 653                 buf->order = order;
 654                 buf->used = 0;
 655
 656                 buf->offset = (dma->byte_count + offset);
 657                 buf->bus_address = agp_offset + offset;
 658                 buf->address = (void *)(agp_offset + offset);
 659                 buf->next = NULL;
 660                 buf->waiting = 0;
 661                 buf->pending = 0;
 662                 init_waitqueue_head(&buf->dma_wait);
 663                 buf->filp = NULL;
 664
 665                 buf->dev_priv_size = dev->driver->dev_priv_size;
 666                 buf->dev_private = drm_alloc(buf->dev_priv_size, DRM_MEM_BUFS);
 667                 if (!buf->dev_private) {
 668                         /* Set count correctly so we free the proper amount. */
 669                         entry->buf_count = count;
 670                         drm_cleanup_buf_error(dev, entry);
 671                         mutex_unlock(&dev->struct_mutex);
 672                         atomic_dec(&dev->buf_alloc);
 673                         return -ENOMEM;
 674                 }
 675                 memset(buf->dev_private, 0, buf->dev_priv_size);
 676
 677                 DRM_DEBUG("buffer %d @ %p\n", entry->buf_count, buf->address);
 678
 679                 offset += alignment;
 680                 entry->buf_count++;
 681                 byte_count += PAGE_SIZE << page_order;
 682         }
 683
 684         DRM_DEBUG("byte_count: %d\n", byte_count);
 685
 686         temp_buflist = drm_realloc(dma->buflist,
 687                                    dma->buf_count * sizeof(*dma->buflist),
 688                                    (dma->buf_count + entry->buf_count)
 689                                    * sizeof(*dma->buflist), DRM_MEM_BUFS);
 690         if (!temp_buflist) {
 691                 /* Free the entry because it isn't valid */
 692                 drm_cleanup_buf_error(dev, entry);
 693                 mutex_unlock(&dev->struct_mutex);
 694                 atomic_dec(&dev->buf_alloc);
 695                 return -ENOMEM;
 696         }
 697         dma->buflist = temp_buflist;
 698
 699         for (i = 0; i < entry->buf_count; i++) {
 700                 dma->buflist[i + dma->buf_count] = &entry->buflist[i];
 701         }
 702
 703         dma->buf_count += entry->buf_count;
 704         dma->seg_count += entry->seg_count;
 705         dma->page_count += byte_count >> PAGE_SHIFT;
 706         dma->byte_count += byte_count;
 707
 708         DRM_DEBUG("dma->buf_count : %d\n", dma->buf_count);
 709         DRM_DEBUG("entry->buf_count : %d\n", entry->buf_count);
 710
 711         mutex_unlock(&dev->struct_mutex);
 712
 713         request->count = entry->buf_count;
 714         request->size = size;
 715
 716         dma->flags = _DRM_DMA_USE_AGP;
 717
 718         atomic_dec(&dev->buf_alloc);
 719         return 0;
 720 }
 721 EXPORT_SYMBOL(drm_addbufs_agp);
 722 #endif                          /* __OS_HAS_AGP */
 723
 724 int drm_addbufs_pci(struct drm_device * dev, struct drm_buf_desc * request)
 725 {
 726         struct drm_device_dma *dma = dev->dma;
 727         int count;
 728         int order;
 729         int size;
 730         int total;
 731         int page_order;
 732         struct drm_buf_entry *entry;
 733         drm_dma_handle_t *dmah;
 734         struct drm_buf *buf;
 735         int alignment;
 736         unsigned long offset;
 737         int i;
 738         int byte_count;
 739         int page_count;
 740         unsigned long *temp_pagelist;
 741         struct drm_buf **temp_buflist;
 742
 743         if (!drm_core_check_feature(dev, DRIVER_PCI_DMA))
 744                 return -EINVAL;
 745
 746         if (!dma)
 747                 return -EINVAL;
 748
 749         if (!capable(CAP_SYS_ADMIN))
 750                 return -EPERM;
 751
 752         count = request->count;
 753         order = drm_order(request->size);
 754         size = 1 << order;
 755
 756         DRM_DEBUG("count=%d, size=%d (%d), order=%d, queue_count=%d\n",
 757                   request->count, request->size, size, order, dev->queue_count);
 758
 759         if (order < DRM_MIN_ORDER || order > DRM_MAX_ORDER)
 760                 return -EINVAL;
 761         if (dev->queue_count)
 762                 return -EBUSY;  /* Not while in use */
 763
 764         alignment = (request->flags & _DRM_PAGE_ALIGN)
 765             ? PAGE_ALIGN(size) : size;
 766         page_order = order - PAGE_SHIFT > 0 ? order - PAGE_SHIFT : 0;
 767         total = PAGE_SIZE << page_order;
 768
 769         spin_lock(&dev->count_lock);
 770         if (dev->buf_use) {
 771                 spin_unlock(&dev->count_lock);
 772                 return -EBUSY;
 773         }
 774         atomic_inc(&dev->buf_alloc);
 775         spin_unlock(&dev->count_lock);
 776
 777         mutex_lock(&dev->struct_mutex);
 778         entry = &dma->bufs[order];
 779         if (entry->buf_count) {
 780                 mutex_unlock(&dev->struct_mutex);
 781                 atomic_dec(&dev->buf_alloc);
 782                 return -ENOMEM; /* May only call once for each order */
 783         }
 784
 785         if (count < 0 || count > 4096) {
 786                 mutex_unlock(&dev->struct_mutex);
 787                 atomic_dec(&dev->buf_alloc);
 788                 return -EINVAL;
 789         }
 790
 791         entry->buflist = drm_alloc(count * sizeof(*entry->buflist),
 792                                    DRM_MEM_BUFS);
 793         if (!entry->buflist) {
 794                 mutex_unlock(&dev->struct_mutex);
 795                 atomic_dec(&dev->buf_alloc);
 796                 return -ENOMEM;
 797         }
 798         memset(entry->buflist, 0, count * sizeof(*entry->buflist));
 799
 800         entry->seglist = drm_alloc(count * sizeof(*entry->seglist),
 801                                    DRM_MEM_SEGS);
 802         if (!entry->seglist) {
 803                 drm_free(entry->buflist,
 804                          count * sizeof(*entry->buflist), DRM_MEM_BUFS);
 805                 mutex_unlock(&dev->struct_mutex);
 806                 atomic_dec(&dev->buf_alloc);
 807                 return -ENOMEM;
 808         }
 809         memset(entry->seglist, 0, count * sizeof(*entry->seglist));
 810
 811         /* Keep the original pagelist until we know all the allocations
 812          * have succeeded
 813          */
 814         temp_pagelist = drm_alloc((dma->page_count + (count << page_order))
 815                                   * sizeof(*dma->pagelist), DRM_MEM_PAGES);
 816         if (!temp_pagelist) {
 817                 drm_free(entry->buflist,
 818                          count * sizeof(*entry->buflist), DRM_MEM_BUFS);
 819                 drm_free(entry->seglist,
 820                          count * sizeof(*entry->seglist), DRM_MEM_SEGS);
 821                 mutex_unlock(&dev->struct_mutex);
 822                 atomic_dec(&dev->buf_alloc);
 823                 return -ENOMEM;
 824         }
 825         memcpy(temp_pagelist,
 826                dma->pagelist, dma->page_count * sizeof(*dma->pagelist));
 827         DRM_DEBUG("pagelist: %d entries\n",
 828                   dma->page_count + (count << page_order));
 829
 830         entry->buf_size = size;
 831         entry->page_order = page_order;
 832         byte_count = 0;
 833         page_count = 0;
 834
 835         while (entry->buf_count < count) {
 836
 837                 dmah = drm_pci_alloc(dev, PAGE_SIZE << page_order, 0x1000, 0xfffffffful);
 838
 839                 if (!dmah) {
 840                         /* Set count correctly so we free the proper amount. */
 841                         entry->buf_count = count;
 842                         entry->seg_count = count;
 843                         drm_cleanup_buf_error(dev, entry);
 844                         drm_free(temp_pagelist,
 845                                  (dma->page_count + (count << page_order))
 846                                  * sizeof(*dma->pagelist), DRM_MEM_PAGES);
 847                         mutex_unlock(&dev->struct_mutex);
 848                         atomic_dec(&dev->buf_alloc);
 849                         return -ENOMEM;
 850                 }
 851                 entry->seglist[entry->seg_count++] = dmah;
 852                 for (i = 0; i < (1 << page_order); i++) {
 853                         DRM_DEBUG("page %d @ 0x%08lx\n",
 854                                   dma->page_count + page_count,
 855                                   (unsigned long)dmah->vaddr + PAGE_SIZE * i);
 856                         temp_pagelist[dma->page_count + page_count++]
 857                                 = (unsigned long)dmah->vaddr + PAGE_SIZE * i;
 858                 }
 859                 for (offset = 0;
 860                      offset + size <= total && entry->buf_count < count;
 861                      offset += alignment, ++entry->buf_count) {
 862                         buf = &entry->buflist[entry->buf_count];
 863                         buf->idx = dma->buf_count + entry->buf_count;
 864                         buf->total = alignment;
 865                         buf->order = order;
 866                         buf->used = 0;
 867                         buf->offset = (dma->byte_count + byte_count + offset);
 868                         buf->address = (void *)(dmah->vaddr + offset);
 869                         buf->bus_address = dmah->busaddr + offset;
 870                         buf->next = NULL;
 871                         buf->waiting = 0;
 872                         buf->pending = 0;
 873                         init_waitqueue_head(&buf->dma_wait);
 874                         buf->filp = NULL;
 875
 876                         buf->dev_priv_size = dev->driver->dev_priv_size;
 877                         buf->dev_private = drm_alloc(buf->dev_priv_size,
 878                                                      DRM_MEM_BUFS);
 879                         if (!buf->dev_private) {
 880                                 /* Set count correctly so we free the proper amount. */
 881                                 entry->buf_count = count;
 882                                 entry->seg_count = count;
 883                                 drm_cleanup_buf_error(dev, entry);
 884                                 drm_free(temp_pagelist,
 885                                          (dma->page_count +
 886                                           (count << page_order))
 887                                          * sizeof(*dma->pagelist),
 888                                          DRM_MEM_PAGES);
 889                                 mutex_unlock(&dev->struct_mutex);
 890                                 atomic_dec(&dev->buf_alloc);
 891                                 return -ENOMEM;
 892                         }
 893                         memset(buf->dev_private, 0, buf->dev_priv_size);
 894
 895                         DRM_DEBUG("buffer %d @ %p\n",
 896                                   entry->buf_count, buf->address);
 897                 }
 898                 byte_count += PAGE_SIZE << page_order;
 899         }
 900
 901         temp_buflist = drm_realloc(dma->buflist,
 902                                    dma->buf_count * sizeof(*dma->buflist),
 903                                    (dma->buf_count + entry->buf_count)
 904                                    * sizeof(*dma->buflist), DRM_MEM_BUFS);
 905         if (!temp_buflist) {
 906                 /* Free the entry because it isn't valid */
 907                 drm_cleanup_buf_error(dev, entry);
 908                 drm_free(temp_pagelist,
 909                          (dma->page_count + (count << page_order))
 910                          * sizeof(*dma->pagelist), DRM_MEM_PAGES);
 911                 mutex_unlock(&dev->struct_mutex);
 912                 atomic_dec(&dev->buf_alloc);
 913                 return -ENOMEM;
 914         }
 915         dma->buflist = temp_buflist;
 916
 917         for (i = 0; i < entry->buf_count; i++) {
 918                 dma->buflist[i + dma->buf_count] = &entry->buflist[i];
 919         }
 920
 921         /* No allocations failed, so now we can replace the orginal pagelist
 922          * with the new one.
 923          */
 924         if (dma->page_count) {
 925                 drm_free(dma->pagelist,
 926                          dma->page_count * sizeof(*dma->pagelist),
 927                          DRM_MEM_PAGES);
 928         }
 929         dma->pagelist = temp_pagelist;
 930
 931         dma->buf_count += entry->buf_count;
 932         dma->seg_count += entry->seg_count;
 933         dma->page_count += entry->seg_count << page_order;
 934         dma->byte_count += PAGE_SIZE * (entry->seg_count << page_order);
 935
 936         mutex_unlock(&dev->struct_mutex);
 937
 938         request->count = entry->buf_count;
 939         request->size = size;
 940
 941         if (request->flags & _DRM_PCI_BUFFER_RO)
 942                 dma->flags = _DRM_DMA_USE_PCI_RO;
 943
 944         atomic_dec(&dev->buf_alloc);
 945         return 0;
 946
 947 }
 948 EXPORT_SYMBOL(drm_addbufs_pci);
 949
 950 static int drm_addbufs_sg(struct drm_device * dev, struct drm_buf_desc * request)
 951 {
 952         struct drm_device_dma *dma = dev->dma;
 953         struct drm_buf_entry *entry;
 954         struct drm_buf *buf;
 955         unsigned long offset;
 956         unsigned long agp_offset;
 957         int count;
 958         int order;
 959         int size;
 960         int alignment;
 961         int page_order;
 962         int total;
 963         int byte_count;
 964         int i;
 965         struct drm_buf **temp_buflist;
 966
 967         if (!drm_core_check_feature(dev, DRIVER_SG))
 968                 return -EINVAL;
 969
 970         if (!dma)
 971                 return -EINVAL;
 972
 973         if (!capable(CAP_SYS_ADMIN))
 974                 return -EPERM;
 975
 976         count = request->count;
 977         order = drm_order(request->size);
 978         size = 1 << order;
 979
 980         alignment = (request->flags & _DRM_PAGE_ALIGN)
 981             ? PAGE_ALIGN(size) : size;
 982         page_order = order - PAGE_SHIFT > 0 ? order - PAGE_SHIFT : 0;
 983         total = PAGE_SIZE << page_order;
 984
 985         byte_count = 0;
 986         agp_offset = request->agp_start;
 987
 988         DRM_DEBUG("count:      %d\n", count);
 989         DRM_DEBUG("order:      %d\n", order);
 990         DRM_DEBUG("size:       %d\n", size);
 991         DRM_DEBUG("agp_offset: %lu\n", agp_offset);
 992         DRM_DEBUG("alignment:  %d\n", alignment);
 993         DRM_DEBUG("page_order: %d\n", page_order);
 994         DRM_DEBUG("total:      %d\n", total);
 995
 996         if (order < DRM_MIN_ORDER || order > DRM_MAX_ORDER)
 997                 return -EINVAL;
 998         if (dev->queue_count)
 999                 return -EBUSY;  /* Not while in use */
1000
1001         spin_lock(&dev->count_lock);
1002         if (dev->buf_use) {
1003                 spin_unlock(&dev->count_lock);
1004                 return -EBUSY;
1005         }
1006         atomic_inc(&dev->buf_alloc);
1007         spin_unlock(&dev->count_lock);
1008
1009         mutex_lock(&dev->struct_mutex);
1010         entry = &dma->bufs[order];
1011         if (entry->buf_count) {
1012                 mutex_unlock(&dev->struct_mutex);
1013                 atomic_dec(&dev->buf_alloc);
1014                 return -ENOMEM; /* May only call once for each order */
1015         }
1016
1017         if (count < 0 || count > 4096) {
1018                 mutex_unlock(&dev->struct_mutex);
1019                 atomic_dec(&dev->buf_alloc);
1020                 return -EINVAL;
1021         }
1022
1023         entry->buflist = drm_alloc(count * sizeof(*entry->buflist),
1024                                    DRM_MEM_BUFS);
1025         if (!entry->buflist) {
1026                 mutex_unlock(&dev->struct_mutex);
1027                 atomic_dec(&dev->buf_alloc);
1028                 return -ENOMEM;
1029         }
1030         memset(entry->buflist, 0, count * sizeof(*entry->buflist));
1031
1032         entry->buf_size = size;
1033         entry->page_order = page_order;
1034
1035         offset = 0;
1036
1037         while (entry->buf_count < count) {
1038                 buf = &entry->buflist[entry->buf_count];
1039                 buf->idx = dma->buf_count + entry->buf_count;
1040                 buf->total = alignment;
1041                 buf->order = order;
1042                 buf->used = 0;
1043
1044                 buf->offset = (dma->byte_count + offset);
1045                 buf->bus_address = agp_offset + offset;
1046                 buf->address = (void *)(agp_offset + offset
1047                                         + (unsigned long)dev->sg->virtual);
1048                 buf->next = NULL;
1049                 buf->waiting = 0;
1050                 buf->pending = 0;
1051                 init_waitqueue_head(&buf->dma_wait);
1052                 buf->filp = NULL;
1053
1054                 buf->dev_priv_size = dev->driver->dev_priv_size;
1055                 buf->dev_private = drm_alloc(buf->dev_priv_size, DRM_MEM_BUFS);
1056                 if (!buf->dev_private) {
1057                         /* Set count correctly so we free the proper amount. */
1058                         entry->buf_count = count;
1059                         drm_cleanup_buf_error(dev, entry);
1060                         mutex_unlock(&dev->struct_mutex);
1061                         atomic_dec(&dev->buf_alloc);
1062                         return -ENOMEM;
1063                 }
1064
1065                 memset(buf->dev_private, 0, buf->dev_priv_size);
1066
1067                 DRM_DEBUG("buffer %d @ %p\n", entry->buf_count, buf->address);
1068
1069                 offset += alignment;
1070                 entry->buf_count++;
1071                 byte_count += PAGE_SIZE << page_order;
1072         }
1073
1074         DRM_DEBUG("byte_count: %d\n", byte_count);
1075
1076         temp_buflist = drm_realloc(dma->buflist,
1077                                    dma->buf_count * sizeof(*dma->buflist),
1078                                    (dma->buf_count + entry->buf_count)
1079                                    * sizeof(*dma->buflist), DRM_MEM_BUFS);
1080         if (!temp_buflist) {
1081                 /* Free the entry because it isn't valid */
1082                 drm_cleanup_buf_error(dev, entry);
1083                 mutex_unlock(&dev->struct_mutex);
1084                 atomic_dec(&dev->buf_alloc);
1085                 return -ENOMEM;
1086         }
1087         dma->buflist = temp_buflist;
1088
1089         for (i = 0; i < entry->buf_count; i++) {
1090                 dma->buflist[i + dma->buf_count] = &entry->buflist[i];
1091         }
1092
1093         dma->buf_count += entry->buf_count;
1094         dma->seg_count += entry->seg_count;
1095         dma->page_count += byte_count >> PAGE_SHIFT;
1096         dma->byte_count += byte_count;
1097
1098         DRM_DEBUG("dma->buf_count : %d\n", dma->buf_count);
1099         DRM_DEBUG("entry->buf_count : %d\n", entry->buf_count);
1100
1101         mutex_unlock(&dev->struct_mutex);
1102
1103         request->count = entry->buf_count;
1104         request->size = size;
1105
1106         dma->flags = _DRM_DMA_USE_SG;
1107
1108         atomic_dec(&dev->buf_alloc);
1109         return 0;
1110 }
1111
1112 static int drm_addbufs_fb(struct drm_device * dev, struct drm_buf_desc * request)
1113 {
1114         struct drm_device_dma *dma = dev->dma;
1115         struct drm_buf_entry *entry;
1116         struct drm_buf *buf;
1117         unsigned long offset;
1118         unsigned long agp_offset;
1119         int count;
1120         int order;
1121         int size;
1122         int alignment;
1123         int page_order;
1124         int total;
1125         int byte_count;
1126         int i;
1127         struct drm_buf **temp_buflist;
1128
1129         if (!drm_core_check_feature(dev, DRIVER_FB_DMA))
1130                 return -EINVAL;
1131
1132         if (!dma)
1133                 return -EINVAL;
1134
1135         if (!capable(CAP_SYS_ADMIN))
1136                 return -EPERM;
1137
1138         count = request->count;
1139         order = drm_order(request->size);
1140         size = 1 << order;
1141
1142         alignment = (request->flags & _DRM_PAGE_ALIGN)
1143             ? PAGE_ALIGN(size) : size;
1144         page_order = order - PAGE_SHIFT > 0 ? order - PAGE_SHIFT : 0;
1145         total = PAGE_SIZE << page_order;
1146
1147         byte_count = 0;
1148         agp_offset = request->agp_start;
1149
1150         DRM_DEBUG("count:      %d\n", count);
1151         DRM_DEBUG("order:      %d\n", order);
1152         DRM_DEBUG("size:       %d\n", size);
1153         DRM_DEBUG("agp_offset: %lu\n", agp_offset);
1154         DRM_DEBUG("alignment:  %d\n", alignment);
1155         DRM_DEBUG("page_order: %d\n", page_order);
1156         DRM_DEBUG("total:      %d\n", total);
1157
1158         if (order < DRM_MIN_ORDER || order > DRM_MAX_ORDER)
1159                 return -EINVAL;
1160         if (dev->queue_count)
1161                 return -EBUSY;  /* Not while in use */
1162
1163         spin_lock(&dev->count_lock);
1164         if (dev->buf_use) {
1165                 spin_unlock(&dev->count_lock);
1166                 return -EBUSY;
1167         }
1168         atomic_inc(&dev->buf_alloc);
1169         spin_unlock(&dev->count_lock);
1170
1171         mutex_lock(&dev->struct_mutex);
1172         entry = &dma->bufs[order];
1173         if (entry->buf_count) {
1174                 mutex_unlock(&dev->struct_mutex);
1175                 atomic_dec(&dev->buf_alloc);
1176                 return -ENOMEM; /* May only call once for each order */
1177         }
1178
1179         if (count < 0 || count > 4096) {
1180                 mutex_unlock(&dev->struct_mutex);
1181                 atomic_dec(&dev->buf_alloc);
1182                 return -EINVAL;
1183         }
1184
1185         entry->buflist = drm_alloc(count * sizeof(*entry->buflist),
1186                                    DRM_MEM_BUFS);
1187         if (!entry->buflist) {
1188                 mutex_unlock(&dev->struct_mutex);
1189                 atomic_dec(&dev->buf_alloc);
1190                 return -ENOMEM;
1191         }
1192         memset(entry->buflist, 0, count * sizeof(*entry->buflist));
1193
1194         entry->buf_size = size;
1195         entry->page_order = page_order;
1196
1197         offset = 0;
1198
1199         while (entry->buf_count < count) {
1200                 buf = &entry->buflist[entry->buf_count];
1201                 buf->idx = dma->buf_count + entry->buf_count;
1202                 buf->total = alignment;
1203                 buf->order = order;
1204                 buf->used = 0;
1205
1206                 buf->offset = (dma->byte_count + offset);
1207                 buf->bus_address = agp_offset + offset;
1208                 buf->address = (void *)(agp_offset + offset);
1209                 buf->next = NULL;
1210                 buf->waiting = 0;
1211                 buf->pending = 0;
1212                 init_waitqueue_head(&buf->dma_wait);
1213                 buf->filp = NULL;
1214
1215                 buf->dev_priv_size = dev->driver->dev_priv_size;
1216                 buf->dev_private = drm_alloc(buf->dev_priv_size, DRM_MEM_BUFS);
1217                 if (!buf->dev_private) {
1218                         /* Set count correctly so we free the proper amount. */
1219                         entry->buf_count = count;
1220                         drm_cleanup_buf_error(dev, entry);
1221                         mutex_unlock(&dev->struct_mutex);
1222                         atomic_dec(&dev->buf_alloc);
1223                         return -ENOMEM;
1224                 }
1225                 memset(buf->dev_private, 0, buf->dev_priv_size);
1226
1227                 DRM_DEBUG("buffer %d @ %p\n", entry->buf_count, buf->address);
1228
1229                 offset += alignment;
1230                 entry->buf_count++;
1231                 byte_count += PAGE_SIZE << page_order;
1232         }
1233
1234         DRM_DEBUG("byte_count: %d\n", byte_count);
1235
1236         temp_buflist = drm_realloc(dma->buflist,
1237                                    dma->buf_count * sizeof(*dma->buflist),
1238                                    (dma->buf_count + entry->buf_count)
1239                                    * sizeof(*dma->buflist), DRM_MEM_BUFS);
1240         if (!temp_buflist) {
1241                 /* Free the entry because it isn't valid */
1242                 drm_cleanup_buf_error(dev, entry);
1243                 mutex_unlock(&dev->struct_mutex);
1244                 atomic_dec(&dev->buf_alloc);
1245                 return -ENOMEM;
1246         }
1247         dma->buflist = temp_buflist;
1248
1249         for (i = 0; i < entry->buf_count; i++) {
1250                 dma->buflist[i + dma->buf_count] = &entry->buflist[i];
1251         }
1252
1253         dma->buf_count += entry->buf_count;
1254         dma->seg_count += entry->seg_count;
1255         dma->page_count += byte_count >> PAGE_SHIFT;
1256         dma->byte_count += byte_count;
1257
1258         DRM_DEBUG("dma->buf_count : %d\n", dma->buf_count);
1259         DRM_DEBUG("entry->buf_count : %d\n", entry->buf_count);
1260
1261         mutex_unlock(&dev->struct_mutex);
1262
1263         request->count = entry->buf_count;
1264         request->size = size;
1265
1266         dma->flags = _DRM_DMA_USE_FB;
1267
1268         atomic_dec(&dev->buf_alloc);
1269         return 0;
1270 }
1271
1272
1273 /**
1274  * Add buffers for DMA transfers (ioctl).
1275  *
1276  * \param inode device inode.
1277  * \param filp file pointer.
1278  * \param cmd command.
1279  * \param arg pointer to a struct drm_buf_desc request.
1280  * \return zero on success or a negative number on failure.
1281  *
1282  * According with the memory type specified in drm_buf_desc::flags and the
1283  * build options, it dispatches the call either to addbufs_agp(),
1284  * addbufs_sg() or addbufs_pci() for AGP, scatter-gather or consistent
1285  * PCI memory respectively.
1286  */
1287 int drm_addbufs(struct inode *inode, struct file *filp,
1288                 unsigned int cmd, unsigned long arg)
1289 {
1290         struct drm_buf_desc request;
1291         struct drm_file *priv = filp->private_data;
1292         struct drm_device *dev = priv->head->dev;
1293         int ret;
1294
1295         if (!drm_core_check_feature(dev, DRIVER_HAVE_DMA))
1296                 return -EINVAL;
1297
1298         if (copy_from_user(&request, (struct drm_buf_desc __user *) arg,
1299                            sizeof(request)))
1300                 return -EFAULT;
1301
1302 #if __OS_HAS_AGP
1303         if (request.flags & _DRM_AGP_BUFFER)
1304                 ret = drm_addbufs_agp(dev, &request);
1305         else
1306 #endif
1307         if (request.flags & _DRM_SG_BUFFER)
1308                 ret = drm_addbufs_sg(dev, &request);
1309         else if (request.flags & _DRM_FB_BUFFER)
1310                 ret = drm_addbufs_fb(dev, &request);
1311         else
1312                 ret = drm_addbufs_pci(dev, &request);
1313
1314         if (ret == 0) {
1315                 if (copy_to_user((void __user *)arg, &request, sizeof(request))) {
1316                         ret = -EFAULT;
1317                 }
1318         }
1319         return ret;
1320 }
1321
1322 /**
1323  * Get information about the buffer mappings.
1324  *
1325  * This was originally mean for debugging purposes, or by a sophisticated
1326  * client library to determine how best to use the available buffers (e.g.,
1327  * large buffers can be used for image transfer).
1328  *
1329  * \param inode device inode.
1330  * \param filp file pointer.
1331  * \param cmd command.
1332  * \param arg pointer to a drm_buf_info structure.
1333  * \return zero on success or a negative number on failure.
1334  *
1335  * Increments drm_device::buf_use while holding the drm_device::count_lock
1336  * lock, preventing of allocating more buffers after this call. Information
1337  * about each requested buffer is then copied into user space.
1338  */
1339 int drm_infobufs(struct inode *inode, struct file *filp,
1340                  unsigned int cmd, unsigned long arg)
1341 {
1342         struct drm_file *priv = filp->private_data;
1343         struct drm_device *dev = priv->head->dev;
1344         struct drm_device_dma *dma = dev->dma;
1345         struct drm_buf_info request;
1346         struct drm_buf_info __user *argp = (void __user *)arg;
1347         int i;
1348         int count;
1349
1350         if (!drm_core_check_feature(dev, DRIVER_HAVE_DMA))
1351                 return -EINVAL;
1352
1353         if (!dma)
1354                 return -EINVAL;
1355
1356         spin_lock(&dev->count_lock);
1357         if (atomic_read(&dev->buf_alloc)) {
1358                 spin_unlock(&dev->count_lock);
1359                 return -EBUSY;
1360         }
1361         ++dev->buf_use;         /* Can't allocate more after this call */
1362         spin_unlock(&dev->count_lock);
1363
1364         if (copy_from_user(&request, argp, sizeof(request)))
1365                 return -EFAULT;
1366
1367         for (i = 0, count = 0; i < DRM_MAX_ORDER + 1; i++) {
1368                 if (dma->bufs[i].buf_count)
1369                         ++count;
1370         }
1371
1372         DRM_DEBUG("count = %d\n", count);
1373
1374         if (request.count >= count) {
1375                 for (i = 0, count = 0; i < DRM_MAX_ORDER + 1; i++) {
1376                         if (dma->bufs[i].buf_count) {
1377                                 struct drm_buf_desc __user *to =
1378                                     &request.list[count];
1379                                 struct drm_buf_entry *from = &dma->bufs[i];
1380                                 struct drm_freelist *list = &dma->bufs[i].freelist;
1381                                 if (copy_to_user(&to->count,
1382                                                  &from->buf_count,
1383                                                  sizeof(from->buf_count)) ||
1384                                     copy_to_user(&to->size,
1385                                                  &from->buf_size,
1386                                                  sizeof(from->buf_size)) ||
1387                                     copy_to_user(&to->low_mark,
1388                                                  &list->low_mark,
1389                                                  sizeof(list->low_mark)) ||
1390                                     copy_to_user(&to->high_mark,
1391                                                  &list->high_mark,
1392                                                  sizeof(list->high_mark)))
1393                                         return -EFAULT;
1394
1395                                 DRM_DEBUG("%d %d %d %d %d\n",
1396                                           i,
1397                                           dma->bufs[i].buf_count,
1398                                           dma->bufs[i].buf_size,
1399                                           dma->bufs[i].freelist.low_mark,
1400                                           dma->bufs[i].freelist.high_mark);
1401                                 ++count;
1402                         }
1403                 }
1404         }
1405         request.count = count;
1406
1407         if (copy_to_user(argp, &request, sizeof(request)))
1408                 return -EFAULT;
1409
1410         return 0;
1411 }
1412
1413 /**
1414  * Specifies a low and high water mark for buffer allocation
1415  *
1416  * \param inode device inode.
1417  * \param filp file pointer.
1418  * \param cmd command.
1419  * \param arg a pointer to a drm_buf_desc structure.
1420  * \return zero on success or a negative number on failure.
1421  *
1422  * Verifies that the size order is bounded between the admissible orders and
1423  * updates the respective drm_device_dma::bufs entry low and high water mark.
1424  *
1425  * \note This ioctl is deprecated and mostly never used.
1426  */
1427 int drm_markbufs(struct inode *inode, struct file *filp,
1428                  unsigned int cmd, unsigned long arg)
1429 {
1430         struct drm_file *priv = filp->private_data;
1431         struct drm_device *dev = priv->head->dev;
1432         struct drm_device_dma *dma = dev->dma;
1433         struct drm_buf_desc request;
1434         int order;
1435         struct drm_buf_entry *entry;
1436
1437         if (!drm_core_check_feature(dev, DRIVER_HAVE_DMA))
1438                 return -EINVAL;
1439
1440         if (!dma)
1441                 return -EINVAL;
1442
1443         if (copy_from_user(&request,
1444                            (struct drm_buf_desc __user *) arg, sizeof(request)))
1445                 return -EFAULT;
1446
1447         DRM_DEBUG("%d, %d, %d\n",
1448                   request.size, request.low_mark, request.high_mark);
1449         order = drm_order(request.size);
1450         if (order < DRM_MIN_ORDER || order > DRM_MAX_ORDER)
1451                 return -EINVAL;
1452         entry = &dma->bufs[order];
1453
1454         if (request.low_mark < 0 || request.low_mark > entry->buf_count)
1455                 return -EINVAL;
1456         if (request.high_mark < 0 || request.high_mark > entry->buf_count)
1457                 return -EINVAL;
1458
1459         entry->freelist.low_mark = request.low_mark;
1460         entry->freelist.high_mark = request.high_mark;
1461
1462         return 0;
1463 }
1464
1465 /**
1466  * Unreserve the buffers in list, previously reserved using drmDMA.
1467  *
1468  * \param inode device inode.
1469  * \param filp file pointer.
1470  * \param cmd command.
1471  * \param arg pointer to a drm_buf_free structure.
1472  * \return zero on success or a negative number on failure.
1473  *
1474  * Calls free_buffer() for each used buffer.
1475  * This function is primarily used for debugging.
1476  */
1477 int drm_freebufs(struct inode *inode, struct file *filp,
1478                  unsigned int cmd, unsigned long arg)
1479 {
1480         struct drm_file *priv = filp->private_data;
1481         struct drm_device *dev = priv->head->dev;
1482         struct drm_device_dma *dma = dev->dma;
1483         struct drm_buf_free request;
1484         int i;
1485         int idx;
1486         struct drm_buf *buf;
1487
1488         if (!drm_core_check_feature(dev, DRIVER_HAVE_DMA))
1489                 return -EINVAL;
1490
1491         if (!dma)
1492                 return -EINVAL;
1493
1494         if (copy_from_user(&request,
1495                            (struct drm_buf_free __user *) arg, sizeof(request)))
1496                 return -EFAULT;
1497
1498         DRM_DEBUG("%d\n", request.count);
1499         for (i = 0; i < request.count; i++) {
1500                 if (copy_from_user(&idx, &request.list[i], sizeof(idx)))
1501                         return -EFAULT;
1502                 if (idx < 0 || idx >= dma->buf_count) {
1503                         DRM_ERROR("Index %d (of %d max)\n",
1504                                   idx, dma->buf_count - 1);
1505                         return -EINVAL;
1506                 }
1507                 buf = dma->buflist[idx];
1508                 if (buf->filp != filp) {
1509                         DRM_ERROR("Process %d freeing buffer not owned\n",
1510                                   current->pid);
1511                         return -EINVAL;
1512                 }
1513                 drm_free_buffer(dev, buf);
1514         }
1515
1516         return 0;
1517 }
1518
1519 /**
1520  * Maps all of the DMA buffers into client-virtual space (ioctl).
1521  *
1522  * \param inode device inode.
1523  * \param filp file pointer.
1524  * \param cmd command.
1525  * \param arg pointer to a drm_buf_map structure.
1526  * \return zero on success or a negative number on failure.
1527  *
1528  * Maps the AGP, SG or PCI buffer region with do_mmap(), and copies information
1529  * about each buffer into user space. For PCI buffers, it calls do_mmap() with
1530  * offset equal to 0, which drm_mmap() interpretes as PCI buffers and calls
1531  * drm_mmap_dma().
1532  */
1533 int drm_mapbufs(struct inode *inode, struct file *filp,
1534                 unsigned int cmd, unsigned long arg)
1535 {
1536         struct drm_file *priv = filp->private_data;
1537         struct drm_device *dev = priv->head->dev;
1538         struct drm_device_dma *dma = dev->dma;
1539         struct drm_buf_map __user *argp = (void __user *)arg;
1540         int retcode = 0;
1541         const int zero = 0;
1542         unsigned long virtual;
1543         unsigned long address;
1544         struct drm_buf_map request;
1545         int i;
1546
1547         if (!drm_core_check_feature(dev, DRIVER_HAVE_DMA))
1548                 return -EINVAL;
1549
1550         if (!dma)
1551                 return -EINVAL;
1552
1553         spin_lock(&dev->count_lock);
1554         if (atomic_read(&dev->buf_alloc)) {
1555                 spin_unlock(&dev->count_lock);
1556                 return -EBUSY;
1557         }
1558         dev->buf_use++;         /* Can't allocate more after this call */
1559         spin_unlock(&dev->count_lock);
1560
1561         if (copy_from_user(&request, argp, sizeof(request)))
1562                 return -EFAULT;
1563
1564         if (request.count >= dma->buf_count) {
1565                 if ((drm_core_has_AGP(dev) && (dma->flags & _DRM_DMA_USE_AGP))
1566                     || (drm_core_check_feature(dev, DRIVER_SG)
1567                         && (dma->flags & _DRM_DMA_USE_SG))
1568                     || (drm_core_check_feature(dev, DRIVER_FB_DMA)
1569                         && (dma->flags & _DRM_DMA_USE_FB))) {
1570                         struct drm_map *map = dev->agp_buffer_map;
1571                         unsigned long token = dev->agp_buffer_token;
1572
1573                         if (!map) {
1574                                 retcode = -EINVAL;
1575                                 goto done;
1576                         }
1577
1578                         down_write(&current->mm->mmap_sem);
1579                         virtual = do_mmap(filp, 0, map->size,
1580                                           PROT_READ | PROT_WRITE,
1581                                           MAP_SHARED, token);
1582                         up_write(&current->mm->mmap_sem);
1583                 } else {
1584                         down_write(&current->mm->mmap_sem);
1585                         virtual = do_mmap(filp, 0, dma->byte_count,
1586                                           PROT_READ | PROT_WRITE,
1587                                           MAP_SHARED, 0);
1588                         up_write(&current->mm->mmap_sem);
1589                 }
1590                 if (virtual > -1024UL) {
1591                         /* Real error */
1592                         retcode = (signed long)virtual;
1593                         goto done;
1594                 }
1595                 request.virtual = (void __user *)virtual;
1596
1597                 for (i = 0; i < dma->buf_count; i++) {
1598                         if (copy_to_user(&request.list[i].idx,
1599                                          &dma->buflist[i]->idx,
1600                                          sizeof(request.list[0].idx))) {
1601                                 retcode = -EFAULT;
1602                                 goto done;
1603                         }
1604                         if (copy_to_user(&request.list[i].total,
1605                                          &dma->buflist[i]->total,
1606                                          sizeof(request.list[0].total))) {
1607                                 retcode = -EFAULT;
1608                                 goto done;
1609                         }
1610                         if (copy_to_user(&request.list[i].used,
1611                                          &zero, sizeof(zero))) {
1612                                 retcode = -EFAULT;
1613                                 goto done;
1614                         }
1615                         address = virtual + dma->buflist[i]->offset;    /* *** */
1616                         if (copy_to_user(&request.list[i].address,
1617                                          &address, sizeof(address))) {
1618                                 retcode = -EFAULT;
1619                                 goto done;
1620                         }
1621                 }
1622         }
1623       done:
1624         request.count = dma->buf_count;
1625         DRM_DEBUG("%d buffers, retcode = %d\n", request.count, retcode);
1626
1627         if (copy_to_user(argp, &request, sizeof(request)))
1628                 return -EFAULT;
1629
1630         return retcode;
1631 }
1632
1633 /**
1634  * Compute size order.  Returns the exponent of the smaller power of two which
1635  * is greater or equal to given number.
1636  *
1637  * \param size size.
1638  * \return order.
1639  *
1640  * \todo Can be made faster.
1641  */
1642 int drm_order(unsigned long size)
1643 {
1644         int order;
1645         unsigned long tmp;
1646
1647         for (order = 0, tmp = size >> 1; tmp; tmp >>= 1, order++) ;
1648
1649         if (size & (size - 1))
1650                 ++order;
1651
1652         return order;
1653 }
1654 EXPORT_SYMBOL(drm_order);
1655
1656