drm/nv50/fb: fix double free of vram mm
[linux-2.6/linux-acpi-2.6/ibm-acpi-2.6.git] / drivers / gpu / drm / nouveau / core / subdev / fb / nv50.c
blob42d7539e65250d239a9e7f8c65efd68855b76c90
1 /*
2 * Copyright 2012 Red Hat Inc.
4 * Permission is hereby granted, free of charge, to any person obtaining a
5 * copy of this software and associated documentation files (the "Software"),
6 * to deal in the Software without restriction, including without limitation
7 * the rights to use, copy, modify, merge, publish, distribute, sublicense,
8 * and/or sell copies of the Software, and to permit persons to whom the
9 * Software is furnished to do so, subject to the following conditions:
11 * The above copyright notice and this permission notice shall be included in
12 * all copies or substantial portions of the Software.
14 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
15 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
16 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
17 * THE COPYRIGHT HOLDER(S) OR AUTHOR(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR
18 * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
19 * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
20 * OTHER DEALINGS IN THE SOFTWARE.
22 * Authors: Ben Skeggs
25 #include <core/object.h>
26 #include <core/enum.h>
28 #include <subdev/fb.h>
29 #include <subdev/bios.h>
31 struct nv50_fb_priv {
32 struct nouveau_fb base;
33 struct page *r100c08_page;
34 dma_addr_t r100c08;
37 static int types[0x80] = {
38 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
39 1, 1, 1, 1, 0, 0, 0, 0, 2, 2, 2, 2, 0, 0, 0, 0,
40 1, 1, 1, 1, 1, 1, 1, 0, 2, 2, 2, 2, 2, 2, 2, 0,
41 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
42 1, 1, 1, 1, 1, 1, 1, 2, 2, 2, 2, 2, 2, 2, 0, 0,
43 0, 0, 0, 0, 1, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0,
44 1, 1, 1, 1, 1, 1, 1, 0, 1, 1, 1, 1, 2, 2, 2, 2,
45 1, 0, 2, 0, 1, 0, 2, 0, 1, 1, 2, 2, 1, 1, 0, 0
48 static bool
49 nv50_fb_memtype_valid(struct nouveau_fb *pfb, u32 memtype)
51 return types[(memtype & 0xff00) >> 8] != 0;
54 static int
55 nv50_fb_vram_new(struct nouveau_fb *pfb, u64 size, u32 align, u32 ncmin,
56 u32 memtype, struct nouveau_mem **pmem)
58 struct nv50_fb_priv *priv = (void *)pfb;
59 struct nouveau_mm *heap = &priv->base.vram;
60 struct nouveau_mm *tags = &priv->base.tags;
61 struct nouveau_mm_node *r;
62 struct nouveau_mem *mem;
63 int comp = (memtype & 0x300) >> 8;
64 int type = (memtype & 0x07f);
65 int back = (memtype & 0x800);
66 int min, max, ret;
68 max = (size >> 12);
69 min = ncmin ? (ncmin >> 12) : max;
70 align >>= 12;
72 mem = kzalloc(sizeof(*mem), GFP_KERNEL);
73 if (!mem)
74 return -ENOMEM;
76 mutex_lock(&pfb->base.mutex);
77 if (comp) {
78 if (align == 16) {
79 int n = (max >> 4) * comp;
81 ret = nouveau_mm_head(tags, 1, n, n, 1, &mem->tag);
82 if (ret)
83 mem->tag = NULL;
86 if (unlikely(!mem->tag))
87 comp = 0;
90 INIT_LIST_HEAD(&mem->regions);
91 mem->memtype = (comp << 7) | type;
92 mem->size = max;
94 type = types[type];
95 do {
96 if (back)
97 ret = nouveau_mm_tail(heap, type, max, min, align, &r);
98 else
99 ret = nouveau_mm_head(heap, type, max, min, align, &r);
100 if (ret) {
101 mutex_unlock(&pfb->base.mutex);
102 pfb->ram.put(pfb, &mem);
103 return ret;
106 list_add_tail(&r->rl_entry, &mem->regions);
107 max -= r->length;
108 } while (max);
109 mutex_unlock(&pfb->base.mutex);
111 r = list_first_entry(&mem->regions, struct nouveau_mm_node, rl_entry);
112 mem->offset = (u64)r->offset << 12;
113 *pmem = mem;
114 return 0;
117 void
118 nv50_fb_vram_del(struct nouveau_fb *pfb, struct nouveau_mem **pmem)
120 struct nv50_fb_priv *priv = (void *)pfb;
121 struct nouveau_mm_node *this;
122 struct nouveau_mem *mem;
124 mem = *pmem;
125 *pmem = NULL;
126 if (unlikely(mem == NULL))
127 return;
129 mutex_lock(&pfb->base.mutex);
130 while (!list_empty(&mem->regions)) {
131 this = list_first_entry(&mem->regions, typeof(*this), rl_entry);
133 list_del(&this->rl_entry);
134 nouveau_mm_free(&priv->base.vram, &this);
137 nouveau_mm_free(&priv->base.tags, &mem->tag);
138 mutex_unlock(&pfb->base.mutex);
140 kfree(mem);
143 static u32
144 nv50_vram_rblock(struct nv50_fb_priv *priv)
146 int i, parts, colbits, rowbitsa, rowbitsb, banks;
147 u64 rowsize, predicted;
148 u32 r0, r4, rt, ru, rblock_size;
150 r0 = nv_rd32(priv, 0x100200);
151 r4 = nv_rd32(priv, 0x100204);
152 rt = nv_rd32(priv, 0x100250);
153 ru = nv_rd32(priv, 0x001540);
154 nv_debug(priv, "memcfg 0x%08x 0x%08x 0x%08x 0x%08x\n", r0, r4, rt, ru);
156 for (i = 0, parts = 0; i < 8; i++) {
157 if (ru & (0x00010000 << i))
158 parts++;
161 colbits = (r4 & 0x0000f000) >> 12;
162 rowbitsa = ((r4 & 0x000f0000) >> 16) + 8;
163 rowbitsb = ((r4 & 0x00f00000) >> 20) + 8;
164 banks = 1 << (((r4 & 0x03000000) >> 24) + 2);
166 rowsize = parts * banks * (1 << colbits) * 8;
167 predicted = rowsize << rowbitsa;
168 if (r0 & 0x00000004)
169 predicted += rowsize << rowbitsb;
171 if (predicted != priv->base.ram.size) {
172 nv_warn(priv, "memory controller reports %d MiB VRAM\n",
173 (u32)(priv->base.ram.size >> 20));
176 rblock_size = rowsize;
177 if (rt & 1)
178 rblock_size *= 3;
180 nv_debug(priv, "rblock %d bytes\n", rblock_size);
181 return rblock_size;
184 static int
185 nv50_fb_ctor(struct nouveau_object *parent, struct nouveau_object *engine,
186 struct nouveau_oclass *oclass, void *data, u32 size,
187 struct nouveau_object **pobject)
189 struct nouveau_device *device = nv_device(parent);
190 struct nouveau_bios *bios = nouveau_bios(device);
191 const u32 rsvd_head = ( 256 * 1024) >> 12; /* vga memory */
192 const u32 rsvd_tail = (1024 * 1024) >> 12; /* vbios etc */
193 struct nv50_fb_priv *priv;
194 u32 tags;
195 int ret;
197 ret = nouveau_fb_create(parent, engine, oclass, &priv);
198 *pobject = nv_object(priv);
199 if (ret)
200 return ret;
202 switch (nv_rd32(priv, 0x100714) & 0x00000007) {
203 case 0: priv->base.ram.type = NV_MEM_TYPE_DDR1; break;
204 case 1:
205 if (nouveau_fb_bios_memtype(bios) == NV_MEM_TYPE_DDR3)
206 priv->base.ram.type = NV_MEM_TYPE_DDR3;
207 else
208 priv->base.ram.type = NV_MEM_TYPE_DDR2;
209 break;
210 case 2: priv->base.ram.type = NV_MEM_TYPE_GDDR3; break;
211 case 3: priv->base.ram.type = NV_MEM_TYPE_GDDR4; break;
212 case 4: priv->base.ram.type = NV_MEM_TYPE_GDDR5; break;
213 default:
214 break;
217 priv->base.ram.size = nv_rd32(priv, 0x10020c);
218 priv->base.ram.size = (priv->base.ram.size & 0xffffff00) |
219 ((priv->base.ram.size & 0x000000ff) << 32);
221 tags = nv_rd32(priv, 0x100320);
222 if (tags) {
223 ret = nouveau_mm_init(&priv->base.tags, 0, tags, 1);
224 if (ret)
225 return ret;
227 nv_debug(priv, "%d compression tags\n", tags);
230 size = (priv->base.ram.size >> 12) - rsvd_head - rsvd_tail;
231 switch (device->chipset) {
232 case 0xaa:
233 case 0xac:
234 case 0xaf: /* IGPs, no reordering, no real VRAM */
235 ret = nouveau_mm_init(&priv->base.vram, rsvd_head, size, 1);
236 if (ret)
237 return ret;
239 priv->base.ram.stolen = (u64)nv_rd32(priv, 0x100e10) << 12;
240 break;
241 default:
242 ret = nouveau_mm_init(&priv->base.vram, rsvd_head, size,
243 nv50_vram_rblock(priv) >> 12);
244 if (ret)
245 return ret;
247 priv->base.ram.ranks = (nv_rd32(priv, 0x100200) & 0x4) ? 2 : 1;
248 break;
251 priv->r100c08_page = alloc_page(GFP_KERNEL | __GFP_ZERO);
252 if (priv->r100c08_page) {
253 priv->r100c08 = pci_map_page(device->pdev, priv->r100c08_page,
254 0, PAGE_SIZE,
255 PCI_DMA_BIDIRECTIONAL);
256 if (pci_dma_mapping_error(device->pdev, priv->r100c08))
257 nv_warn(priv, "failed 0x100c08 page map\n");
258 } else {
259 nv_warn(priv, "failed 0x100c08 page alloc\n");
262 priv->base.memtype_valid = nv50_fb_memtype_valid;
263 priv->base.ram.get = nv50_fb_vram_new;
264 priv->base.ram.put = nv50_fb_vram_del;
265 return nouveau_fb_created(&priv->base);
268 static void
269 nv50_fb_dtor(struct nouveau_object *object)
271 struct nouveau_device *device = nv_device(object);
272 struct nv50_fb_priv *priv = (void *)object;
274 if (priv->r100c08_page) {
275 pci_unmap_page(device->pdev, priv->r100c08, PAGE_SIZE,
276 PCI_DMA_BIDIRECTIONAL);
277 __free_page(priv->r100c08_page);
280 nouveau_fb_destroy(&priv->base);
283 static int
284 nv50_fb_init(struct nouveau_object *object)
286 struct nouveau_device *device = nv_device(object);
287 struct nv50_fb_priv *priv = (void *)object;
288 int ret;
290 ret = nouveau_fb_init(&priv->base);
291 if (ret)
292 return ret;
294 /* Not a clue what this is exactly. Without pointing it at a
295 * scratch page, VRAM->GART blits with M2MF (as in DDX DFS)
296 * cause IOMMU "read from address 0" errors (rh#561267)
298 nv_wr32(priv, 0x100c08, priv->r100c08 >> 8);
300 /* This is needed to get meaningful information from 100c90
301 * on traps. No idea what these values mean exactly. */
302 switch (device->chipset) {
303 case 0x50:
304 nv_wr32(priv, 0x100c90, 0x000707ff);
305 break;
306 case 0xa3:
307 case 0xa5:
308 case 0xa8:
309 nv_wr32(priv, 0x100c90, 0x000d0fff);
310 break;
311 case 0xaf:
312 nv_wr32(priv, 0x100c90, 0x089d1fff);
313 break;
314 default:
315 nv_wr32(priv, 0x100c90, 0x001d07ff);
316 break;
319 return 0;
322 struct nouveau_oclass
323 nv50_fb_oclass = {
324 .handle = NV_SUBDEV(FB, 0x50),
325 .ofuncs = &(struct nouveau_ofuncs) {
326 .ctor = nv50_fb_ctor,
327 .dtor = nv50_fb_dtor,
328 .init = nv50_fb_init,
329 .fini = _nouveau_fb_fini,
333 static const struct nouveau_enum vm_dispatch_subclients[] = {
334 { 0x00000000, "GRCTX", NULL },
335 { 0x00000001, "NOTIFY", NULL },
336 { 0x00000002, "QUERY", NULL },
337 { 0x00000003, "COND", NULL },
338 { 0x00000004, "M2M_IN", NULL },
339 { 0x00000005, "M2M_OUT", NULL },
340 { 0x00000006, "M2M_NOTIFY", NULL },
344 static const struct nouveau_enum vm_ccache_subclients[] = {
345 { 0x00000000, "CB", NULL },
346 { 0x00000001, "TIC", NULL },
347 { 0x00000002, "TSC", NULL },
351 static const struct nouveau_enum vm_prop_subclients[] = {
352 { 0x00000000, "RT0", NULL },
353 { 0x00000001, "RT1", NULL },
354 { 0x00000002, "RT2", NULL },
355 { 0x00000003, "RT3", NULL },
356 { 0x00000004, "RT4", NULL },
357 { 0x00000005, "RT5", NULL },
358 { 0x00000006, "RT6", NULL },
359 { 0x00000007, "RT7", NULL },
360 { 0x00000008, "ZETA", NULL },
361 { 0x00000009, "LOCAL", NULL },
362 { 0x0000000a, "GLOBAL", NULL },
363 { 0x0000000b, "STACK", NULL },
364 { 0x0000000c, "DST2D", NULL },
368 static const struct nouveau_enum vm_pfifo_subclients[] = {
369 { 0x00000000, "PUSHBUF", NULL },
370 { 0x00000001, "SEMAPHORE", NULL },
374 static const struct nouveau_enum vm_bar_subclients[] = {
375 { 0x00000000, "FB", NULL },
376 { 0x00000001, "IN", NULL },
380 static const struct nouveau_enum vm_client[] = {
381 { 0x00000000, "STRMOUT", NULL },
382 { 0x00000003, "DISPATCH", vm_dispatch_subclients },
383 { 0x00000004, "PFIFO_WRITE", NULL },
384 { 0x00000005, "CCACHE", vm_ccache_subclients },
385 { 0x00000006, "PPPP", NULL },
386 { 0x00000007, "CLIPID", NULL },
387 { 0x00000008, "PFIFO_READ", NULL },
388 { 0x00000009, "VFETCH", NULL },
389 { 0x0000000a, "TEXTURE", NULL },
390 { 0x0000000b, "PROP", vm_prop_subclients },
391 { 0x0000000c, "PVP", NULL },
392 { 0x0000000d, "PBSP", NULL },
393 { 0x0000000e, "PCRYPT", NULL },
394 { 0x0000000f, "PCOUNTER", NULL },
395 { 0x00000011, "PDAEMON", NULL },
399 static const struct nouveau_enum vm_engine[] = {
400 { 0x00000000, "PGRAPH", NULL },
401 { 0x00000001, "PVP", NULL },
402 { 0x00000004, "PEEPHOLE", NULL },
403 { 0x00000005, "PFIFO", vm_pfifo_subclients },
404 { 0x00000006, "BAR", vm_bar_subclients },
405 { 0x00000008, "PPPP", NULL },
406 { 0x00000009, "PBSP", NULL },
407 { 0x0000000a, "PCRYPT", NULL },
408 { 0x0000000b, "PCOUNTER", NULL },
409 { 0x0000000c, "SEMAPHORE_BG", NULL },
410 { 0x0000000d, "PCOPY", NULL },
411 { 0x0000000e, "PDAEMON", NULL },
415 static const struct nouveau_enum vm_fault[] = {
416 { 0x00000000, "PT_NOT_PRESENT", NULL },
417 { 0x00000001, "PT_TOO_SHORT", NULL },
418 { 0x00000002, "PAGE_NOT_PRESENT", NULL },
419 { 0x00000003, "PAGE_SYSTEM_ONLY", NULL },
420 { 0x00000004, "PAGE_READ_ONLY", NULL },
421 { 0x00000006, "NULL_DMAOBJ", NULL },
422 { 0x00000007, "WRONG_MEMTYPE", NULL },
423 { 0x0000000b, "VRAM_LIMIT", NULL },
424 { 0x0000000f, "DMAOBJ_LIMIT", NULL },
428 void
429 nv50_fb_trap(struct nouveau_fb *pfb, int display)
431 struct nouveau_device *device = nv_device(pfb);
432 struct nv50_fb_priv *priv = (void *)pfb;
433 const struct nouveau_enum *en, *cl;
434 u32 trap[6], idx, chan;
435 u8 st0, st1, st2, st3;
436 int i;
438 idx = nv_rd32(priv, 0x100c90);
439 if (!(idx & 0x80000000))
440 return;
441 idx &= 0x00ffffff;
443 for (i = 0; i < 6; i++) {
444 nv_wr32(priv, 0x100c90, idx | i << 24);
445 trap[i] = nv_rd32(priv, 0x100c94);
447 nv_wr32(priv, 0x100c90, idx | 0x80000000);
449 if (!display)
450 return;
452 /* decode status bits into something more useful */
453 if (device->chipset < 0xa3 ||
454 device->chipset == 0xaa || device->chipset == 0xac) {
455 st0 = (trap[0] & 0x0000000f) >> 0;
456 st1 = (trap[0] & 0x000000f0) >> 4;
457 st2 = (trap[0] & 0x00000f00) >> 8;
458 st3 = (trap[0] & 0x0000f000) >> 12;
459 } else {
460 st0 = (trap[0] & 0x000000ff) >> 0;
461 st1 = (trap[0] & 0x0000ff00) >> 8;
462 st2 = (trap[0] & 0x00ff0000) >> 16;
463 st3 = (trap[0] & 0xff000000) >> 24;
465 chan = (trap[2] << 16) | trap[1];
467 nv_error(priv, "trapped %s at 0x%02x%04x%04x on channel 0x%08x ",
468 (trap[5] & 0x00000100) ? "read" : "write",
469 trap[5] & 0xff, trap[4] & 0xffff, trap[3] & 0xffff, chan);
471 en = nouveau_enum_find(vm_engine, st0);
472 if (en)
473 printk("%s/", en->name);
474 else
475 printk("%02x/", st0);
477 cl = nouveau_enum_find(vm_client, st2);
478 if (cl)
479 printk("%s/", cl->name);
480 else
481 printk("%02x/", st2);
483 if (cl && cl->data) cl = nouveau_enum_find(cl->data, st3);
484 else if (en && en->data) cl = nouveau_enum_find(en->data, st3);
485 else cl = NULL;
486 if (cl)
487 printk("%s", cl->name);
488 else
489 printk("%02x", st3);
491 printk(" reason: ");
492 en = nouveau_enum_find(vm_fault, st1);
493 if (en)
494 printk("%s\n", en->name);
495 else
496 printk("0x%08x\n", st1);