1 /* 2 * Copyright © 2008 Intel Corporation 3 * 4 * Permission is hereby granted, free of charge, to any person obtaining a 5 * copy of this software and associated documentation files (the "Software"), 6 * to deal in the Software without restriction, including without limitation 7 * the rights to use, copy, modify, merge, publish, distribute, sublicense, 8 * and/or sell copies of the Software, and to permit persons to whom the 9 * Software is furnished to do so, subject to the following conditions: 10 * 11 * The above copyright notice and this permission notice (including the next 12 * paragraph) shall be included in all copies or substantial portions of the 13 * Software. 14 * 15 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 16 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 17 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL 18 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 19 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING 20 * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS 21 * IN THE SOFTWARE. 22 * 23 * Authors: 24 * Eric Anholt <eric@anholt.net> 25 * 26 */ 27 /*- 28 * Copyright (c) 2011 The FreeBSD Foundation 29 * All rights reserved. 30 * 31 * This software was developed by Konstantin Belousov under sponsorship from 32 * the FreeBSD Foundation. 33 * 34 * Redistribution and use in source and binary forms, with or without 35 * modification, are permitted provided that the following conditions 36 * are met: 37 * 1. Redistributions of source code must retain the above copyright 38 * notice, this list of conditions and the following disclaimer. 39 * 2. Redistributions in binary form must reproduce the above copyright 40 * notice, this list of conditions and the following disclaimer in the 41 * documentation and/or other materials provided with the distribution. 42 * 43 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 44 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 45 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 46 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 47 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 48 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 49 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 50 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 51 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 52 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 53 * SUCH DAMAGE. 54 */ 55 56 #include "opt_vm.h" 57 58 #include <sys/param.h> 59 #include <sys/systm.h> 60 #include <sys/limits.h> 61 #include <sys/lock.h> 62 #include <sys/mutex.h> 63 #include <sys/conf.h> 64 65 #include <vm/vm.h> 66 #include <vm/vm_page.h> 67 68 #include <linux/module.h> 69 #include <drm/drmP.h> 70 71 /** @file drm_gem.c 72 * 73 * This file provides some of the base ioctls and library routines for 74 * the graphics memory manager implemented by each device driver. 75 * 76 * Because various devices have different requirements in terms of 77 * synchronization and migration strategies, implementing that is left up to 78 * the driver, and all that the general API provides should be generic -- 79 * allocating objects, reading/writing data with the cpu, freeing objects. 80 * Even there, platform-dependent optimizations for reading/writing data with 81 * the CPU mean we'll likely hook those out to driver-specific calls. However, 82 * the DRI2 implementation wants to have at least allocate/mmap be generic. 83 * 84 * The goal was to have swap-backed object allocation managed through 85 * struct file. However, file descriptors as handles to a struct file have 86 * two major failings: 87 * - Process limits prevent more than 1024 or so being used at a time by 88 * default. 89 * - Inability to allocate high fds will aggravate the X Server's select() 90 * handling, and likely that of many GL client applications as well. 91 * 92 * This led to a plan of using our own integer IDs (called handles, following 93 * DRM terminology) to mimic fds, and implement the fd syscalls we need as 94 * ioctls. The objects themselves will still include the struct file so 95 * that we can transition to fds if the required kernel infrastructure shows 96 * up at a later date, and as our interface with shmfs for memory allocation. 97 */ 98 99 /* 100 * We make up offsets for buffer objects so we can recognize them at 101 * mmap time. 102 */ 103 104 /* pgoff in mmap is an unsigned long, so we need to make sure that 105 * the faked up offset will fit 106 */ 107 108 #if BITS_PER_LONG == 64 109 #define DRM_FILE_PAGE_OFFSET_START ((0xFFFFFFFFUL >> PAGE_SHIFT) + 1) 110 #define DRM_FILE_PAGE_OFFSET_SIZE ((0xFFFFFFFFUL >> PAGE_SHIFT) * 16) 111 #else 112 #define DRM_FILE_PAGE_OFFSET_START ((0xFFFFFFFUL >> PAGE_SHIFT) + 1) 113 #define DRM_FILE_PAGE_OFFSET_SIZE ((0xFFFFFFFUL >> PAGE_SHIFT) * 16) 114 #endif 115 116 /** 117 * Initialize the GEM device fields 118 */ 119 120 int 121 drm_gem_init(struct drm_device *dev) 122 { 123 struct drm_gem_mm *mm; 124 125 lockinit(&dev->object_name_lock, "objnam", 0, LK_CANRECURSE); 126 idr_init(&dev->object_name_idr); 127 128 mm = kzalloc(sizeof(struct drm_gem_mm), GFP_KERNEL); 129 if (!mm) { 130 DRM_ERROR("out of memory\n"); 131 return -ENOMEM; 132 } 133 134 dev->mm_private = mm; 135 136 if (drm_ht_create(&mm->offset_hash, 12)) { 137 kfree(mm); 138 return -ENOMEM; 139 } 140 141 mm->idxunr = new_unrhdr(0, DRM_GEM_MAX_IDX, NULL); 142 drm_mm_init(&mm->offset_manager, DRM_FILE_PAGE_OFFSET_START, 143 DRM_FILE_PAGE_OFFSET_SIZE); 144 return 0; 145 } 146 147 void 148 drm_gem_destroy(struct drm_device *dev) 149 { 150 struct drm_gem_mm *mm = dev->mm_private; 151 152 drm_mm_takedown(&mm->offset_manager); 153 drm_ht_remove(&mm->offset_hash); 154 delete_unrhdr(mm->idxunr); 155 kfree(mm); 156 dev->mm_private = NULL; 157 } 158 159 /** 160 * Initialize an already allocated GEM object of the specified size with 161 * shmfs backing store. 162 */ 163 int drm_gem_object_init(struct drm_device *dev, 164 struct drm_gem_object *obj, size_t size) 165 { 166 BUG_ON((size & (PAGE_SIZE - 1)) != 0); 167 168 obj->dev = dev; 169 obj->vm_obj = default_pager_alloc(NULL, size, 170 VM_PROT_READ | VM_PROT_WRITE, 0); 171 172 kref_init(&obj->refcount); 173 atomic_set(&obj->handle_count, 0); 174 obj->size = size; 175 176 return 0; 177 } 178 EXPORT_SYMBOL(drm_gem_object_init); 179 180 /** 181 * Initialize an already allocated GEM object of the specified size with 182 * no GEM provided backing store. Instead the caller is responsible for 183 * backing the object and handling it. 184 */ 185 int drm_gem_private_object_init(struct drm_device *dev, 186 struct drm_gem_object *obj, size_t size) 187 { 188 BUG_ON((size & (PAGE_SIZE - 1)) != 0); 189 190 obj->dev = dev; 191 obj->vm_obj = NULL; 192 193 kref_init(&obj->refcount); 194 atomic_set(&obj->handle_count, 0); 195 obj->size = size; 196 197 return 0; 198 } 199 EXPORT_SYMBOL(drm_gem_private_object_init); 200 201 /** 202 * Allocate a GEM object of the specified size with shmfs backing store 203 */ 204 struct drm_gem_object * 205 drm_gem_object_alloc(struct drm_device *dev, size_t size) 206 { 207 struct drm_gem_object *obj; 208 209 obj = kzalloc(sizeof(*obj), GFP_KERNEL); 210 if (!obj) 211 goto free; 212 213 if (drm_gem_object_init(dev, obj, size) != 0) 214 goto free; 215 216 if (dev->driver->gem_init_object != NULL && 217 dev->driver->gem_init_object(obj) != 0) 218 goto dealloc; 219 return (obj); 220 dealloc: 221 vm_object_deallocate(obj->vm_obj); 222 free: 223 kfree(obj); 224 return NULL; 225 } 226 EXPORT_SYMBOL(drm_gem_object_alloc); 227 228 static void 229 drm_gem_remove_prime_handles(struct drm_gem_object *obj, struct drm_file *filp) 230 { 231 #if 0 232 if (obj->import_attach) { 233 drm_prime_remove_buf_handle(&filp->prime, 234 obj->import_attach->dmabuf); 235 } 236 if (obj->export_dma_buf) { 237 drm_prime_remove_buf_handle(&filp->prime, 238 obj->export_dma_buf); 239 } 240 #endif 241 } 242 243 /** 244 * Removes the mapping from handle to filp for this object. 245 */ 246 int 247 drm_gem_handle_delete(struct drm_file *filp, u32 handle) 248 { 249 struct drm_device *dev; 250 struct drm_gem_object *obj; 251 252 /* This is gross. The idr system doesn't let us try a delete and 253 * return an error code. It just spews if you fail at deleting. 254 * So, we have to grab a lock around finding the object and then 255 * doing the delete on it and dropping the refcount, or the user 256 * could race us to double-decrement the refcount and cause a 257 * use-after-free later. Given the frequency of our handle lookups, 258 * we may want to use ida for number allocation and a hash table 259 * for the pointers, anyway. 260 */ 261 lockmgr(&filp->table_lock, LK_EXCLUSIVE); 262 263 /* Check if we currently have a reference on the object */ 264 obj = idr_find(&filp->object_idr, handle); 265 if (obj == NULL) { 266 lockmgr(&filp->table_lock, LK_RELEASE); 267 return -EINVAL; 268 } 269 dev = obj->dev; 270 271 /* Release reference and decrement refcount. */ 272 idr_remove(&filp->object_idr, handle); 273 lockmgr(&filp->table_lock, LK_RELEASE); 274 275 drm_gem_remove_prime_handles(obj, filp); 276 277 if (dev->driver->gem_close_object) 278 dev->driver->gem_close_object(obj, filp); 279 drm_gem_object_handle_unreference_unlocked(obj); 280 281 return 0; 282 } 283 EXPORT_SYMBOL(drm_gem_handle_delete); 284 285 /** 286 * Create a handle for this object. This adds a handle reference 287 * to the object, which includes a regular reference count. Callers 288 * will likely want to dereference the object afterwards. 289 */ 290 int 291 drm_gem_handle_create(struct drm_file *file_priv, 292 struct drm_gem_object *obj, 293 u32 *handlep) 294 { 295 struct drm_device *dev = obj->dev; 296 int ret; 297 298 /* 299 * Get the user-visible handle using idr. 300 */ 301 again: 302 /* ensure there is space available to allocate a handle */ 303 if (idr_pre_get(&file_priv->object_idr, GFP_KERNEL) == 0) 304 return -ENOMEM; 305 306 /* do the allocation under our spinlock */ 307 lockmgr(&file_priv->table_lock, LK_EXCLUSIVE); 308 ret = idr_get_new_above(&file_priv->object_idr, obj, 1, (int *)handlep); 309 lockmgr(&file_priv->table_lock, LK_RELEASE); 310 if (ret == -EAGAIN) 311 goto again; 312 else if (ret) 313 return ret; 314 315 drm_gem_object_handle_reference(obj); 316 317 if (dev->driver->gem_open_object) { 318 ret = dev->driver->gem_open_object(obj, file_priv); 319 if (ret) { 320 drm_gem_handle_delete(file_priv, *handlep); 321 return ret; 322 } 323 } 324 325 return 0; 326 } 327 EXPORT_SYMBOL(drm_gem_handle_create); 328 329 330 /** 331 * drm_gem_free_mmap_offset - release a fake mmap offset for an object 332 * @obj: obj in question 333 * 334 * This routine frees fake offsets allocated by drm_gem_create_mmap_offset(). 335 */ 336 void 337 drm_gem_free_mmap_offset(struct drm_gem_object *obj) 338 { 339 struct drm_device *dev = obj->dev; 340 struct drm_gem_mm *mm = dev->mm_private; 341 struct drm_hash_item *list; 342 343 if (!obj->on_map) 344 return; 345 list = &obj->map_list; 346 347 drm_ht_remove_item(&mm->offset_hash, list); 348 free_unr(mm->idxunr, list->key); 349 obj->on_map = false; 350 } 351 EXPORT_SYMBOL(drm_gem_free_mmap_offset); 352 353 /** 354 * drm_gem_create_mmap_offset - create a fake mmap offset for an object 355 * @obj: obj in question 356 * 357 * GEM memory mapping works by handing back to userspace a fake mmap offset 358 * it can use in a subsequent mmap(2) call. The DRM core code then looks 359 * up the object based on the offset and sets up the various memory mapping 360 * structures. 361 * 362 * This routine allocates and attaches a fake offset for @obj. 363 */ 364 int 365 drm_gem_create_mmap_offset(struct drm_gem_object *obj) 366 { 367 struct drm_device *dev = obj->dev; 368 struct drm_gem_mm *mm = dev->mm_private; 369 int ret; 370 371 if (obj->on_map) 372 return (0); 373 ret = 0; 374 375 obj->map_list.key = alloc_unr(mm->idxunr); 376 ret = drm_ht_insert_item(&mm->offset_hash, &obj->map_list); 377 if (ret != 0) { 378 DRM_ERROR("failed to add to map hash\n"); 379 free_unr(mm->idxunr, obj->map_list.key); 380 return (ret); 381 } 382 obj->on_map = true; 383 return 0; 384 } 385 EXPORT_SYMBOL(drm_gem_create_mmap_offset); 386 387 /** Returns a reference to the object named by the handle. */ 388 struct drm_gem_object * 389 drm_gem_object_lookup(struct drm_device *dev, struct drm_file *filp, 390 u32 handle) 391 { 392 struct drm_gem_object *obj; 393 394 lockmgr(&filp->table_lock, LK_EXCLUSIVE); 395 396 /* Check if we currently have a reference on the object */ 397 obj = idr_find(&filp->object_idr, handle); 398 if (obj == NULL) { 399 lockmgr(&filp->table_lock, LK_RELEASE); 400 return NULL; 401 } 402 403 drm_gem_object_reference(obj); 404 405 lockmgr(&filp->table_lock, LK_RELEASE); 406 407 return obj; 408 } 409 EXPORT_SYMBOL(drm_gem_object_lookup); 410 411 /** 412 * Releases the handle to an mm object. 413 */ 414 int 415 drm_gem_close_ioctl(struct drm_device *dev, void *data, 416 struct drm_file *file_priv) 417 { 418 struct drm_gem_close *args = data; 419 420 if (!drm_core_check_feature(dev, DRIVER_GEM)) 421 return (ENODEV); 422 423 return (drm_gem_handle_delete(file_priv, args->handle)); 424 } 425 426 /** 427 * Create a global name for an object, returning the name. 428 * 429 * Note that the name does not hold a reference; when the object 430 * is freed, the name goes away. 431 */ 432 int 433 drm_gem_flink_ioctl(struct drm_device *dev, void *data, 434 struct drm_file *file_priv) 435 { 436 struct drm_gem_flink *args = data; 437 struct drm_gem_object *obj; 438 int ret; 439 440 if (!drm_core_check_feature(dev, DRIVER_GEM)) 441 return -ENODEV; 442 443 obj = drm_gem_object_lookup(dev, file_priv, args->handle); 444 if (obj == NULL) 445 return -ENOENT; 446 447 again: 448 if (idr_pre_get(&dev->object_name_idr, GFP_KERNEL) == 0) { 449 ret = -ENOMEM; 450 goto err; 451 } 452 453 lockmgr(&dev->object_name_lock, LK_EXCLUSIVE); 454 if (!obj->name) { 455 ret = idr_get_new_above(&dev->object_name_idr, obj, 1, 456 &obj->name); 457 args->name = (uint64_t) obj->name; 458 lockmgr(&dev->object_name_lock, LK_RELEASE); 459 460 if (ret == -EAGAIN) 461 goto again; 462 else if (ret) 463 goto err; 464 465 /* Allocate a reference for the name table. */ 466 drm_gem_object_reference(obj); 467 } else { 468 args->name = (uint64_t) obj->name; 469 lockmgr(&dev->object_name_lock, LK_RELEASE); 470 ret = 0; 471 } 472 473 err: 474 drm_gem_object_unreference_unlocked(obj); 475 return ret; 476 } 477 478 /** 479 * Open an object using the global name, returning a handle and the size. 480 * 481 * This handle (of course) holds a reference to the object, so the object 482 * will not go away until the handle is deleted. 483 */ 484 int 485 drm_gem_open_ioctl(struct drm_device *dev, void *data, 486 struct drm_file *file_priv) 487 { 488 struct drm_gem_open *args = data; 489 struct drm_gem_object *obj; 490 int ret; 491 u32 handle; 492 493 if (!(dev->driver->driver_features & DRIVER_GEM)) 494 return -ENODEV; 495 496 lockmgr(&dev->object_name_lock, LK_EXCLUSIVE); 497 obj = idr_find(&dev->object_name_idr, (int) args->name); 498 if (obj) 499 drm_gem_object_reference(obj); 500 lockmgr(&dev->object_name_lock, LK_RELEASE); 501 if (!obj) 502 return -ENOENT; 503 504 ret = drm_gem_handle_create(file_priv, obj, &handle); 505 drm_gem_object_unreference_unlocked(obj); 506 if (ret) 507 return ret; 508 509 args->handle = handle; 510 args->size = obj->size; 511 512 return 0; 513 } 514 515 /** 516 * Called at device open time, sets up the structure for handling refcounting 517 * of mm objects. 518 */ 519 void 520 drm_gem_open(struct drm_device *dev, struct drm_file *file_private) 521 { 522 idr_init(&file_private->object_idr); 523 lockinit(&file_private->table_lock, "fptab", 0, LK_CANRECURSE); 524 } 525 526 /** 527 * Called at device close to release the file's 528 * handle references on objects. 529 */ 530 static int 531 drm_gem_object_release_handle(int id, void *ptr, void *data) 532 { 533 struct drm_file *file_priv = data; 534 struct drm_gem_object *obj = ptr; 535 struct drm_device *dev = obj->dev; 536 537 drm_gem_remove_prime_handles(obj, file_priv); 538 539 if (dev->driver->gem_close_object) 540 dev->driver->gem_close_object(obj, file_priv); 541 542 drm_gem_object_handle_unreference_unlocked(obj); 543 544 return 0; 545 } 546 547 /** 548 * Called at close time when the filp is going away. 549 * 550 * Releases any remaining references on objects by this filp. 551 */ 552 void 553 drm_gem_release(struct drm_device *dev, struct drm_file *file_private) 554 { 555 idr_for_each(&file_private->object_idr, 556 &drm_gem_object_release_handle, file_private); 557 idr_destroy(&file_private->object_idr); 558 } 559 560 void 561 drm_gem_object_release(struct drm_gem_object *obj) 562 { 563 564 /* 565 * obj->vm_obj can be NULL for private gem objects. 566 */ 567 vm_object_deallocate(obj->vm_obj); 568 } 569 EXPORT_SYMBOL(drm_gem_object_release); 570 571 /** 572 * Called after the last reference to the object has been lost. 573 * Must be called holding struct_ mutex 574 * 575 * Frees the object 576 */ 577 void 578 drm_gem_object_free(struct kref *kref) 579 { 580 struct drm_gem_object *obj = (struct drm_gem_object *) kref; 581 struct drm_device *dev = obj->dev; 582 583 BUG_ON(!mutex_is_locked(&dev->struct_mutex)); 584 585 if (dev->driver->gem_free_object != NULL) 586 dev->driver->gem_free_object(obj); 587 } 588 EXPORT_SYMBOL(drm_gem_object_free); 589 590 static void drm_gem_object_ref_bug(struct kref *list_kref) 591 { 592 BUG(); 593 } 594 595 /** 596 * Called after the last handle to the object has been closed 597 * 598 * Removes any name for the object. Note that this must be 599 * called before drm_gem_object_free or we'll be touching 600 * freed memory 601 */ 602 void drm_gem_object_handle_free(struct drm_gem_object *obj) 603 { 604 struct drm_device *dev = obj->dev; 605 606 /* Remove any name for this object */ 607 lockmgr(&dev->object_name_lock, LK_EXCLUSIVE); 608 if (obj->name) { 609 idr_remove(&dev->object_name_idr, obj->name); 610 obj->name = 0; 611 lockmgr(&dev->object_name_lock, LK_RELEASE); 612 /* 613 * The object name held a reference to this object, drop 614 * that now. 615 * 616 * This cannot be the last reference, since the handle holds one too. 617 */ 618 kref_put(&obj->refcount, drm_gem_object_ref_bug); 619 } else 620 lockmgr(&dev->object_name_lock, LK_RELEASE); 621 622 } 623 EXPORT_SYMBOL(drm_gem_object_handle_free); 624 625 static struct drm_gem_object * 626 drm_gem_object_from_offset(struct drm_device *dev, vm_ooffset_t offset) 627 { 628 struct drm_gem_object *obj; 629 struct drm_gem_mm *mm; 630 struct drm_hash_item *map_list; 631 632 if ((offset & DRM_GEM_MAPPING_MASK) != DRM_GEM_MAPPING_KEY) 633 return (NULL); 634 offset &= ~DRM_GEM_MAPPING_KEY; 635 mm = dev->mm_private; 636 if (drm_ht_find_item(&mm->offset_hash, DRM_GEM_MAPPING_IDX(offset), 637 &map_list) != 0) { 638 DRM_DEBUG("drm_gem_object_from_offset: offset 0x%jx obj not found\n", 639 (uintmax_t)offset); 640 return (NULL); 641 } 642 obj = container_of(map_list, struct drm_gem_object, map_list); 643 return (obj); 644 } 645 646 int 647 drm_gem_mmap_single(struct drm_device *dev, vm_ooffset_t *offset, vm_size_t size, 648 struct vm_object **obj_res, int nprot) 649 { 650 struct drm_gem_object *gem_obj; 651 struct vm_object *vm_obj; 652 653 DRM_LOCK(dev); 654 gem_obj = drm_gem_object_from_offset(dev, *offset); 655 if (gem_obj == NULL) { 656 DRM_UNLOCK(dev); 657 return (ENODEV); 658 } 659 drm_gem_object_reference(gem_obj); 660 DRM_UNLOCK(dev); 661 vm_obj = cdev_pager_allocate(gem_obj, OBJT_MGTDEVICE, 662 dev->driver->gem_pager_ops, size, nprot, 663 DRM_GEM_MAPPING_MAPOFF(*offset), curthread->td_ucred); 664 if (vm_obj == NULL) { 665 drm_gem_object_unreference_unlocked(gem_obj); 666 return (EINVAL); 667 } 668 *offset = DRM_GEM_MAPPING_MAPOFF(*offset); 669 *obj_res = vm_obj; 670 return (0); 671 } 672 673 void 674 drm_gem_pager_dtr(void *handle) 675 { 676 struct drm_gem_object *obj; 677 struct drm_device *dev; 678 679 obj = handle; 680 dev = obj->dev; 681 682 DRM_LOCK(dev); 683 drm_gem_free_mmap_offset(obj); 684 drm_gem_object_unreference(obj); 685 DRM_UNLOCK(dev); 686 } 687