drm/radeon: r6xx/r7xx possible security issue, system ram access
[linux-2.6/linux-acpi-2.6/ibm-acpi-2.6.git] / drivers / gpu / drm / radeon / radeon_object.c
blob4e636de877b237b2ca5c53eb15b62d4008a939f6
1 /*
2 * Copyright 2009 Jerome Glisse.
3 * All Rights Reserved.
5 * Permission is hereby granted, free of charge, to any person obtaining a
6 * copy of this software and associated documentation files (the
7 * "Software"), to deal in the Software without restriction, including
8 * without limitation the rights to use, copy, modify, merge, publish,
9 * distribute, sub license, and/or sell copies of the Software, and to
10 * permit persons to whom the Software is furnished to do so, subject to
11 * the following conditions:
13 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
14 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
15 * FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. IN NO EVENT SHALL
16 * THE COPYRIGHT HOLDERS, AUTHORS AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM,
17 * DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
18 * OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
19 * USE OR OTHER DEALINGS IN THE SOFTWARE.
21 * The above copyright notice and this permission notice (including the
22 * next paragraph) shall be included in all copies or substantial portions
23 * of the Software.
27 * Authors:
28 * Jerome Glisse <glisse@freedesktop.org>
29 * Thomas Hellstrom <thomas-at-tungstengraphics-dot-com>
30 * Dave Airlie
32 #include <linux/list.h>
33 #include <drm/drmP.h>
34 #include "radeon_drm.h"
35 #include "radeon.h"
38 int radeon_ttm_init(struct radeon_device *rdev);
39 void radeon_ttm_fini(struct radeon_device *rdev);
40 static void radeon_bo_clear_surface_reg(struct radeon_bo *bo);
43 * To exclude mutual BO access we rely on bo_reserve exclusion, as all
44 * function are calling it.
47 static void radeon_ttm_bo_destroy(struct ttm_buffer_object *tbo)
49 struct radeon_bo *bo;
51 bo = container_of(tbo, struct radeon_bo, tbo);
52 mutex_lock(&bo->rdev->gem.mutex);
53 list_del_init(&bo->list);
54 mutex_unlock(&bo->rdev->gem.mutex);
55 radeon_bo_clear_surface_reg(bo);
56 kfree(bo);
59 bool radeon_ttm_bo_is_radeon_bo(struct ttm_buffer_object *bo)
61 if (bo->destroy == &radeon_ttm_bo_destroy)
62 return true;
63 return false;
66 void radeon_ttm_placement_from_domain(struct radeon_bo *rbo, u32 domain)
68 u32 c = 0;
70 rbo->placement.fpfn = 0;
71 rbo->placement.lpfn = 0;
72 rbo->placement.placement = rbo->placements;
73 rbo->placement.busy_placement = rbo->placements;
74 if (domain & RADEON_GEM_DOMAIN_VRAM)
75 rbo->placements[c++] = TTM_PL_FLAG_WC | TTM_PL_FLAG_UNCACHED |
76 TTM_PL_FLAG_VRAM;
77 if (domain & RADEON_GEM_DOMAIN_GTT)
78 rbo->placements[c++] = TTM_PL_MASK_CACHING | TTM_PL_FLAG_TT;
79 if (domain & RADEON_GEM_DOMAIN_CPU)
80 rbo->placements[c++] = TTM_PL_MASK_CACHING | TTM_PL_FLAG_SYSTEM;
81 if (!c)
82 rbo->placements[c++] = TTM_PL_MASK_CACHING | TTM_PL_FLAG_SYSTEM;
83 rbo->placement.num_placement = c;
84 rbo->placement.num_busy_placement = c;
87 int radeon_bo_create(struct radeon_device *rdev, struct drm_gem_object *gobj,
88 unsigned long size, bool kernel, u32 domain,
89 struct radeon_bo **bo_ptr)
91 struct radeon_bo *bo;
92 enum ttm_bo_type type;
93 int r;
95 if (unlikely(rdev->mman.bdev.dev_mapping == NULL)) {
96 rdev->mman.bdev.dev_mapping = rdev->ddev->dev_mapping;
98 if (kernel) {
99 type = ttm_bo_type_kernel;
100 } else {
101 type = ttm_bo_type_device;
103 *bo_ptr = NULL;
104 bo = kzalloc(sizeof(struct radeon_bo), GFP_KERNEL);
105 if (bo == NULL)
106 return -ENOMEM;
107 bo->rdev = rdev;
108 bo->gobj = gobj;
109 bo->surface_reg = -1;
110 INIT_LIST_HEAD(&bo->list);
112 radeon_ttm_placement_from_domain(bo, domain);
113 /* Kernel allocation are uninterruptible */
114 r = ttm_bo_init(&rdev->mman.bdev, &bo->tbo, size, type,
115 &bo->placement, 0, 0, !kernel, NULL, size,
116 &radeon_ttm_bo_destroy);
117 if (unlikely(r != 0)) {
118 if (r != -ERESTARTSYS)
119 dev_err(rdev->dev,
120 "object_init failed for (%lu, 0x%08X)\n",
121 size, domain);
122 return r;
124 *bo_ptr = bo;
125 if (gobj) {
126 mutex_lock(&bo->rdev->gem.mutex);
127 list_add_tail(&bo->list, &rdev->gem.objects);
128 mutex_unlock(&bo->rdev->gem.mutex);
130 return 0;
133 int radeon_bo_kmap(struct radeon_bo *bo, void **ptr)
135 bool is_iomem;
136 int r;
138 if (bo->kptr) {
139 if (ptr) {
140 *ptr = bo->kptr;
142 return 0;
144 r = ttm_bo_kmap(&bo->tbo, 0, bo->tbo.num_pages, &bo->kmap);
145 if (r) {
146 return r;
148 bo->kptr = ttm_kmap_obj_virtual(&bo->kmap, &is_iomem);
149 if (ptr) {
150 *ptr = bo->kptr;
152 radeon_bo_check_tiling(bo, 0, 0);
153 return 0;
156 void radeon_bo_kunmap(struct radeon_bo *bo)
158 if (bo->kptr == NULL)
159 return;
160 bo->kptr = NULL;
161 radeon_bo_check_tiling(bo, 0, 0);
162 ttm_bo_kunmap(&bo->kmap);
165 void radeon_bo_unref(struct radeon_bo **bo)
167 struct ttm_buffer_object *tbo;
169 if ((*bo) == NULL)
170 return;
171 tbo = &((*bo)->tbo);
172 ttm_bo_unref(&tbo);
173 if (tbo == NULL)
174 *bo = NULL;
177 int radeon_bo_pin(struct radeon_bo *bo, u32 domain, u64 *gpu_addr)
179 int r, i;
181 radeon_ttm_placement_from_domain(bo, domain);
182 if (bo->pin_count) {
183 bo->pin_count++;
184 if (gpu_addr)
185 *gpu_addr = radeon_bo_gpu_offset(bo);
186 return 0;
188 radeon_ttm_placement_from_domain(bo, domain);
189 for (i = 0; i < bo->placement.num_placement; i++)
190 bo->placements[i] |= TTM_PL_FLAG_NO_EVICT;
191 r = ttm_bo_validate(&bo->tbo, &bo->placement, false, false);
192 if (likely(r == 0)) {
193 bo->pin_count = 1;
194 if (gpu_addr != NULL)
195 *gpu_addr = radeon_bo_gpu_offset(bo);
197 if (unlikely(r != 0))
198 dev_err(bo->rdev->dev, "%p pin failed\n", bo);
199 return r;
202 int radeon_bo_unpin(struct radeon_bo *bo)
204 int r, i;
206 if (!bo->pin_count) {
207 dev_warn(bo->rdev->dev, "%p unpin not necessary\n", bo);
208 return 0;
210 bo->pin_count--;
211 if (bo->pin_count)
212 return 0;
213 for (i = 0; i < bo->placement.num_placement; i++)
214 bo->placements[i] &= ~TTM_PL_FLAG_NO_EVICT;
215 r = ttm_bo_validate(&bo->tbo, &bo->placement, false, false);
216 if (unlikely(r != 0))
217 dev_err(bo->rdev->dev, "%p validate failed for unpin\n", bo);
218 return r;
221 int radeon_bo_evict_vram(struct radeon_device *rdev)
223 if (rdev->flags & RADEON_IS_IGP) {
224 if (rdev->mc.igp_sideport_enabled == false)
225 /* Useless to evict on IGP chips */
226 return 0;
228 return ttm_bo_evict_mm(&rdev->mman.bdev, TTM_PL_VRAM);
231 void radeon_bo_force_delete(struct radeon_device *rdev)
233 struct radeon_bo *bo, *n;
234 struct drm_gem_object *gobj;
236 if (list_empty(&rdev->gem.objects)) {
237 return;
239 dev_err(rdev->dev, "Userspace still has active objects !\n");
240 list_for_each_entry_safe(bo, n, &rdev->gem.objects, list) {
241 mutex_lock(&rdev->ddev->struct_mutex);
242 gobj = bo->gobj;
243 dev_err(rdev->dev, "%p %p %lu %lu force free\n",
244 gobj, bo, (unsigned long)gobj->size,
245 *((unsigned long *)&gobj->refcount));
246 mutex_lock(&bo->rdev->gem.mutex);
247 list_del_init(&bo->list);
248 mutex_unlock(&bo->rdev->gem.mutex);
249 radeon_bo_unref(&bo);
250 gobj->driver_private = NULL;
251 drm_gem_object_unreference(gobj);
252 mutex_unlock(&rdev->ddev->struct_mutex);
256 int radeon_bo_init(struct radeon_device *rdev)
258 /* Add an MTRR for the VRAM */
259 rdev->mc.vram_mtrr = mtrr_add(rdev->mc.aper_base, rdev->mc.aper_size,
260 MTRR_TYPE_WRCOMB, 1);
261 DRM_INFO("Detected VRAM RAM=%lluM, BAR=%lluM\n",
262 rdev->mc.mc_vram_size >> 20,
263 (unsigned long long)rdev->mc.aper_size >> 20);
264 DRM_INFO("RAM width %dbits %cDR\n",
265 rdev->mc.vram_width, rdev->mc.vram_is_ddr ? 'D' : 'S');
266 return radeon_ttm_init(rdev);
269 void radeon_bo_fini(struct radeon_device *rdev)
271 radeon_ttm_fini(rdev);
274 void radeon_bo_list_add_object(struct radeon_bo_list *lobj,
275 struct list_head *head)
277 if (lobj->wdomain) {
278 list_add(&lobj->list, head);
279 } else {
280 list_add_tail(&lobj->list, head);
284 int radeon_bo_list_reserve(struct list_head *head)
286 struct radeon_bo_list *lobj;
287 int r;
289 list_for_each_entry(lobj, head, list){
290 r = radeon_bo_reserve(lobj->bo, false);
291 if (unlikely(r != 0))
292 return r;
294 return 0;
297 void radeon_bo_list_unreserve(struct list_head *head)
299 struct radeon_bo_list *lobj;
301 list_for_each_entry(lobj, head, list) {
302 /* only unreserve object we successfully reserved */
303 if (radeon_bo_is_reserved(lobj->bo))
304 radeon_bo_unreserve(lobj->bo);
308 int radeon_bo_list_validate(struct list_head *head, void *fence)
310 struct radeon_bo_list *lobj;
311 struct radeon_bo *bo;
312 struct radeon_fence *old_fence = NULL;
313 int r;
315 r = radeon_bo_list_reserve(head);
316 if (unlikely(r != 0)) {
317 return r;
319 list_for_each_entry(lobj, head, list) {
320 bo = lobj->bo;
321 if (!bo->pin_count) {
322 if (lobj->wdomain) {
323 radeon_ttm_placement_from_domain(bo,
324 lobj->wdomain);
325 } else {
326 radeon_ttm_placement_from_domain(bo,
327 lobj->rdomain);
329 r = ttm_bo_validate(&bo->tbo, &bo->placement,
330 true, false);
331 if (unlikely(r))
332 return r;
334 lobj->gpu_offset = radeon_bo_gpu_offset(bo);
335 lobj->tiling_flags = bo->tiling_flags;
336 if (fence) {
337 old_fence = (struct radeon_fence *)bo->tbo.sync_obj;
338 bo->tbo.sync_obj = radeon_fence_ref(fence);
339 bo->tbo.sync_obj_arg = NULL;
341 if (old_fence) {
342 radeon_fence_unref(&old_fence);
345 return 0;
348 void radeon_bo_list_unvalidate(struct list_head *head, void *fence)
350 struct radeon_bo_list *lobj;
351 struct radeon_fence *old_fence;
353 if (fence)
354 list_for_each_entry(lobj, head, list) {
355 old_fence = to_radeon_fence(lobj->bo->tbo.sync_obj);
356 if (old_fence == fence) {
357 lobj->bo->tbo.sync_obj = NULL;
358 radeon_fence_unref(&old_fence);
361 radeon_bo_list_unreserve(head);
364 int radeon_bo_fbdev_mmap(struct radeon_bo *bo,
365 struct vm_area_struct *vma)
367 return ttm_fbdev_mmap(vma, &bo->tbo);
370 int radeon_bo_get_surface_reg(struct radeon_bo *bo)
372 struct radeon_device *rdev = bo->rdev;
373 struct radeon_surface_reg *reg;
374 struct radeon_bo *old_object;
375 int steal;
376 int i;
378 BUG_ON(!atomic_read(&bo->tbo.reserved));
380 if (!bo->tiling_flags)
381 return 0;
383 if (bo->surface_reg >= 0) {
384 reg = &rdev->surface_regs[bo->surface_reg];
385 i = bo->surface_reg;
386 goto out;
389 steal = -1;
390 for (i = 0; i < RADEON_GEM_MAX_SURFACES; i++) {
392 reg = &rdev->surface_regs[i];
393 if (!reg->bo)
394 break;
396 old_object = reg->bo;
397 if (old_object->pin_count == 0)
398 steal = i;
401 /* if we are all out */
402 if (i == RADEON_GEM_MAX_SURFACES) {
403 if (steal == -1)
404 return -ENOMEM;
405 /* find someone with a surface reg and nuke their BO */
406 reg = &rdev->surface_regs[steal];
407 old_object = reg->bo;
408 /* blow away the mapping */
409 DRM_DEBUG("stealing surface reg %d from %p\n", steal, old_object);
410 ttm_bo_unmap_virtual(&old_object->tbo);
411 old_object->surface_reg = -1;
412 i = steal;
415 bo->surface_reg = i;
416 reg->bo = bo;
418 out:
419 radeon_set_surface_reg(rdev, i, bo->tiling_flags, bo->pitch,
420 bo->tbo.mem.mm_node->start << PAGE_SHIFT,
421 bo->tbo.num_pages << PAGE_SHIFT);
422 return 0;
425 static void radeon_bo_clear_surface_reg(struct radeon_bo *bo)
427 struct radeon_device *rdev = bo->rdev;
428 struct radeon_surface_reg *reg;
430 if (bo->surface_reg == -1)
431 return;
433 reg = &rdev->surface_regs[bo->surface_reg];
434 radeon_clear_surface_reg(rdev, bo->surface_reg);
436 reg->bo = NULL;
437 bo->surface_reg = -1;
440 int radeon_bo_set_tiling_flags(struct radeon_bo *bo,
441 uint32_t tiling_flags, uint32_t pitch)
443 int r;
445 r = radeon_bo_reserve(bo, false);
446 if (unlikely(r != 0))
447 return r;
448 bo->tiling_flags = tiling_flags;
449 bo->pitch = pitch;
450 radeon_bo_unreserve(bo);
451 return 0;
454 void radeon_bo_get_tiling_flags(struct radeon_bo *bo,
455 uint32_t *tiling_flags,
456 uint32_t *pitch)
458 BUG_ON(!atomic_read(&bo->tbo.reserved));
459 if (tiling_flags)
460 *tiling_flags = bo->tiling_flags;
461 if (pitch)
462 *pitch = bo->pitch;
465 int radeon_bo_check_tiling(struct radeon_bo *bo, bool has_moved,
466 bool force_drop)
468 BUG_ON(!atomic_read(&bo->tbo.reserved));
470 if (!(bo->tiling_flags & RADEON_TILING_SURFACE))
471 return 0;
473 if (force_drop) {
474 radeon_bo_clear_surface_reg(bo);
475 return 0;
478 if (bo->tbo.mem.mem_type != TTM_PL_VRAM) {
479 if (!has_moved)
480 return 0;
482 if (bo->surface_reg >= 0)
483 radeon_bo_clear_surface_reg(bo);
484 return 0;
487 if ((bo->surface_reg >= 0) && !has_moved)
488 return 0;
490 return radeon_bo_get_surface_reg(bo);
493 void radeon_bo_move_notify(struct ttm_buffer_object *bo,
494 struct ttm_mem_reg *mem)
496 struct radeon_bo *rbo;
497 if (!radeon_ttm_bo_is_radeon_bo(bo))
498 return;
499 rbo = container_of(bo, struct radeon_bo, tbo);
500 radeon_bo_check_tiling(rbo, 0, 1);
503 void radeon_bo_fault_reserve_notify(struct ttm_buffer_object *bo)
505 struct radeon_bo *rbo;
506 if (!radeon_ttm_bo_is_radeon_bo(bo))
507 return;
508 rbo = container_of(bo, struct radeon_bo, tbo);
509 radeon_bo_check_tiling(rbo, 0, 0);