xref: /freebsd-12.1/sys/dev/drm/via_dmablit.c (revision 592ffb21)
1 /* via_dmablit.c -- PCI DMA BitBlt support for the VIA Unichrome/Pro
2  *
3  * Copyright (C) 2005 Thomas Hellstrom, All Rights Reserved.
4  *
5  * Permission is hereby granted, free of charge, to any person obtaining a
6  * copy of this software and associated documentation files (the "Software"),
7  * to deal in the Software without restriction, including without limitation
8  * the rights to use, copy, modify, merge, publish, distribute, sub license,
9  * and/or sell copies of the Software, and to permit persons to whom the
10  * Software is furnished to do so, subject to the following conditions:
11  *
12  * The above copyright notice and this permission notice (including the
13  * next paragraph) shall be included in all copies or substantial portions
14  * of the Software.
15  *
16  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18  * FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. IN NO EVENT SHALL
19  * THE COPYRIGHT HOLDERS, AUTHORS AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM,
20  * DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
21  * OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
22  * USE OR OTHER DEALINGS IN THE SOFTWARE.
23  *
24  * Authors:
25  *    Thomas Hellstrom.
26  *    Partially based on code obtained from Digeo Inc.
27  */
28 
29 #include <sys/cdefs.h>
30 __FBSDID("$FreeBSD$");
31 
32 /*
33  * Unmaps the DMA mappings.
34  * FIXME: Is this a NoOp on x86? Also
35  * FIXME: What happens if this one is called and a pending blit has previously done
36  * the same DMA mappings?
37  */
38 
39 #include "dev/drm/drmP.h"
40 #include "dev/drm/via_drm.h"
41 #include "dev/drm/via_drv.h"
42 #include "dev/drm/via_dmablit.h"
43 
44 #define VIA_PGDN(x)	(((unsigned long)(x)) & ~PAGE_MASK)
45 #define VIA_PGOFF(x)	(((unsigned long)(x)) & PAGE_MASK)
46 #define VIA_PFN(x)	((unsigned long)(x) >> PAGE_SHIFT)
47 
48 typedef struct _drm_via_descriptor {
49 	uint32_t mem_addr;
50 	uint32_t dev_addr;
51 	uint32_t size;
52 	uint32_t next;
53 } drm_via_descriptor_t;
54 
55 static void via_dmablit_timer(void *arg);
56 
57 /*
58  * Unmap a DMA mapping.
59  */
60 static void
via_unmap_blit_from_device(drm_via_sg_info_t * vsg)61 via_unmap_blit_from_device(drm_via_sg_info_t *vsg)
62 {
63 	int num_desc = vsg->num_desc;
64 	unsigned cur_descriptor_page = num_desc / vsg->descriptors_per_page;
65 	unsigned descriptor_this_page = num_desc % vsg->descriptors_per_page;
66 	drm_via_descriptor_t *desc_ptr = vsg->desc_pages[cur_descriptor_page] +
67 		descriptor_this_page;
68 	dma_addr_t next = vsg->chain_start;
69 
70 	while(num_desc--) {
71 		if (descriptor_this_page-- == 0) {
72 			cur_descriptor_page--;
73 			descriptor_this_page = vsg->descriptors_per_page - 1;
74 			desc_ptr = vsg->desc_pages[cur_descriptor_page] +
75 				descriptor_this_page;
76 		}
77 		next = (dma_addr_t) desc_ptr->next;
78 		desc_ptr--;
79 	}
80 }
81 
82 
83 /*
84  * If mode = 0, count how many descriptors are needed.
85  * If mode = 1, Map the DMA pages for the device, put together and map also the descriptors.
86  * Descriptors are run in reverse order by the hardware because we are not allowed to update the
87  * 'next' field without syncing calls when the descriptor is already mapped.
88  */
89 static void
via_map_blit_for_device(const drm_via_dmablit_t * xfer,drm_via_sg_info_t * vsg,int mode)90 via_map_blit_for_device(const drm_via_dmablit_t *xfer,
91 		   drm_via_sg_info_t *vsg, int mode)
92 {
93 	unsigned cur_descriptor_page = 0;
94 	unsigned num_descriptors_this_page = 0;
95 	unsigned char *mem_addr = xfer->mem_addr;
96 	unsigned char *cur_mem;
97 	unsigned char *first_addr = (unsigned char *)VIA_PGDN(mem_addr);
98 	uint32_t fb_addr = xfer->fb_addr;
99 	uint32_t cur_fb;
100 	unsigned long line_len;
101 	unsigned remaining_len;
102 	int num_desc = 0;
103 	int cur_line;
104 	dma_addr_t next = 0 | VIA_DMA_DPR_EC;
105 	drm_via_descriptor_t *desc_ptr = NULL;
106 
107 	if (mode == 1)
108 		desc_ptr = vsg->desc_pages[cur_descriptor_page];
109 
110 	for (cur_line = 0; cur_line < xfer->num_lines; ++cur_line) {
111 
112 		line_len = xfer->line_length;
113 		cur_fb = fb_addr;
114 		cur_mem = mem_addr;
115 
116 		while (line_len > 0) {
117 
118 			remaining_len = min(PAGE_SIZE - VIA_PGOFF(cur_mem),
119 			    line_len);
120 			line_len -= remaining_len;
121 
122 			if (mode == 1) {
123 				desc_ptr->mem_addr =
124 				    VM_PAGE_TO_PHYS(
125 				    vsg->pages[VIA_PFN(cur_mem) -
126 				    VIA_PFN(first_addr)]) + VIA_PGOFF(cur_mem);
127 				desc_ptr->dev_addr = cur_fb;
128 
129 				desc_ptr->size = remaining_len;
130 				desc_ptr->next = (uint32_t) next;
131 
132 				next = vtophys(desc_ptr);
133 
134 				desc_ptr++;
135 				if (++num_descriptors_this_page >= vsg->descriptors_per_page) {
136 					num_descriptors_this_page = 0;
137 					desc_ptr = vsg->desc_pages[++cur_descriptor_page];
138 				}
139 			}
140 
141 			num_desc++;
142 			cur_mem += remaining_len;
143 			cur_fb += remaining_len;
144 		}
145 
146 		mem_addr += xfer->mem_stride;
147 		fb_addr += xfer->fb_stride;
148 	}
149 
150 	if (mode == 1) {
151 		vsg->chain_start = next;
152 		vsg->state = dr_via_device_mapped;
153 	}
154 	vsg->num_desc = num_desc;
155 }
156 
157 
158 /*
159  * Function that frees up all resources for a blit. It is usable even if the
160  * blit info has only been partially built as long as the status enum is consistent
161  * with the actual status of the used resources.
162  */
163 static void
via_free_sg_info(drm_via_sg_info_t * vsg)164 via_free_sg_info(drm_via_sg_info_t *vsg)
165 {
166 	vm_page_t page;
167 	int i;
168 
169 	switch(vsg->state) {
170 	case dr_via_device_mapped:
171 		via_unmap_blit_from_device(vsg);
172 	case dr_via_desc_pages_alloc:
173 		for (i=0; i<vsg->num_desc_pages; ++i) {
174 			if (vsg->desc_pages[i] != NULL)
175 			    free(vsg->desc_pages[i], DRM_MEM_PAGES);
176 		}
177 		free(vsg->desc_pages, DRM_MEM_DRIVER);
178 	case dr_via_pages_locked:
179 		for (i=0; i < vsg->num_pages; ++i) {
180 			page = vsg->pages[i];
181 			vm_page_lock(page);
182 			vm_page_unwire(page, PQ_INACTIVE);
183 			vm_page_unlock(page);
184 		}
185 	case dr_via_pages_alloc:
186 		free(vsg->pages, DRM_MEM_DRIVER);
187 	default:
188 		vsg->state = dr_via_sg_init;
189 	}
190 	free(vsg->bounce_buffer, DRM_MEM_DRIVER);
191 	vsg->bounce_buffer = NULL;
192 	vsg->free_on_sequence = 0;
193 }
194 
195 
196 /*
197  * Fire a blit engine.
198  */
199 static void
via_fire_dmablit(struct drm_device * dev,drm_via_sg_info_t * vsg,int engine)200 via_fire_dmablit(struct drm_device *dev, drm_via_sg_info_t *vsg, int engine)
201 {
202 	drm_via_private_t *dev_priv = (drm_via_private_t *)dev->dev_private;
203 
204 	VIA_WRITE(VIA_PCI_DMA_MAR0 + engine*0x10, 0);
205 	VIA_WRITE(VIA_PCI_DMA_DAR0 + engine*0x10, 0);
206 	VIA_WRITE(VIA_PCI_DMA_CSR0 + engine*0x04, VIA_DMA_CSR_DD | VIA_DMA_CSR_TD |
207 		  VIA_DMA_CSR_DE);
208 	VIA_WRITE(VIA_PCI_DMA_MR0  + engine*0x04, VIA_DMA_MR_CM | VIA_DMA_MR_TDIE);
209 	VIA_WRITE(VIA_PCI_DMA_BCR0 + engine*0x10, 0);
210 	VIA_WRITE(VIA_PCI_DMA_DPR0 + engine*0x10, vsg->chain_start);
211 	DRM_WRITEMEMORYBARRIER();
212 	VIA_WRITE(VIA_PCI_DMA_CSR0 + engine*0x04, VIA_DMA_CSR_DE | VIA_DMA_CSR_TS);
213 	(void)VIA_READ(VIA_PCI_DMA_CSR0 + engine*0x04);
214 }
215 
216 
217 /*
218  * Obtain a page pointer array and lock all pages into system memory. A segmentation violation will
219  * occur here if the calling user does not have access to the submitted address.
220  */
221 static int
via_lock_all_dma_pages(drm_via_sg_info_t * vsg,drm_via_dmablit_t * xfer)222 via_lock_all_dma_pages(drm_via_sg_info_t *vsg,  drm_via_dmablit_t *xfer)
223 {
224 	unsigned long first_pfn = VIA_PFN(xfer->mem_addr);
225 	vm_page_t m;
226 	int i;
227 
228 	vsg->num_pages = VIA_PFN(xfer->mem_addr +
229 	    (xfer->num_lines * xfer->mem_stride -1)) - first_pfn + 1;
230 
231 	if (NULL == (vsg->pages = malloc(sizeof(vm_page_t) * vsg->num_pages,
232 	    DRM_MEM_DRIVER, M_NOWAIT)))
233 		return -ENOMEM;
234 
235 	vsg->state = dr_via_pages_alloc;
236 
237 	if (vm_fault_quick_hold_pages(&curproc->p_vmspace->vm_map,
238 	    (vm_offset_t)xfer->mem_addr, vsg->num_pages * PAGE_SIZE,
239 	    VM_PROT_READ | VM_PROT_WRITE, vsg->pages, vsg->num_pages) < 0)
240 		return -EACCES;
241 
242 	for (i = 0; i < vsg->num_pages; i++) {
243 		m = vsg->pages[i];
244 		vm_page_lock(m);
245 		vm_page_wire(m);
246 		vm_page_unhold(m);
247 		vm_page_unlock(m);
248 	}
249 	vsg->state = dr_via_pages_locked;
250 
251 	DRM_DEBUG("DMA pages locked\n");
252 
253 	return 0;
254 }
255 
256 
257 /*
258  * Allocate DMA capable memory for the blit descriptor chain, and an array that keeps track of the
259  * pages we allocate. We don't want to use kmalloc for the descriptor chain because it may be
260  * quite large for some blits, and pages don't need to be contingous.
261  */
262 static int
via_alloc_desc_pages(drm_via_sg_info_t * vsg)263 via_alloc_desc_pages(drm_via_sg_info_t *vsg)
264 {
265 	int i;
266 
267 	vsg->descriptors_per_page = PAGE_SIZE / sizeof(drm_via_descriptor_t);
268 	vsg->num_desc_pages = (vsg->num_desc + vsg->descriptors_per_page - 1) /
269 	    vsg->descriptors_per_page;
270 
271 	if (NULL ==  (vsg->desc_pages = malloc(vsg->num_desc_pages *
272 	    sizeof(void *), DRM_MEM_DRIVER, M_NOWAIT | M_ZERO)))
273 		return -ENOMEM;
274 
275 	vsg->state = dr_via_desc_pages_alloc;
276 	for (i = 0; i < vsg->num_desc_pages; ++i) {
277 		if (NULL == (vsg->desc_pages[i] =
278 		    (drm_via_descriptor_t *)malloc(PAGE_SIZE, DRM_MEM_PAGES,
279 		    M_NOWAIT | M_ZERO)))
280 			return -ENOMEM;
281 	}
282 	DRM_DEBUG("Allocated %d pages for %d descriptors.\n",
283 	    vsg->num_desc_pages, vsg->num_desc);
284 
285 	return 0;
286 }
287 
288 
289 static void
via_abort_dmablit(struct drm_device * dev,int engine)290 via_abort_dmablit(struct drm_device *dev, int engine)
291 {
292 	drm_via_private_t *dev_priv = (drm_via_private_t *)dev->dev_private;
293 
294 	VIA_WRITE(VIA_PCI_DMA_CSR0 + engine*0x04, VIA_DMA_CSR_TA);
295 }
296 
297 
298 static void
via_dmablit_engine_off(struct drm_device * dev,int engine)299 via_dmablit_engine_off(struct drm_device *dev, int engine)
300 {
301 	drm_via_private_t *dev_priv = (drm_via_private_t *)dev->dev_private;
302 
303 	VIA_WRITE(VIA_PCI_DMA_CSR0 + engine*0x04, VIA_DMA_CSR_TD | VIA_DMA_CSR_DD);
304 }
305 
306 
307 /*
308  * The dmablit part of the IRQ handler. Trying to do only reasonably fast things here.
309  * The rest, like unmapping and freeing memory for done blits is done in a separate workqueue
310  * task. Basically the task of the interrupt handler is to submit a new blit to the engine, while
311  * the workqueue task takes care of processing associated with the old blit.
312  */
313 void
via_dmablit_handler(struct drm_device * dev,int engine,int from_irq)314 via_dmablit_handler(struct drm_device *dev, int engine, int from_irq)
315 {
316 	drm_via_private_t *dev_priv = (drm_via_private_t *)dev->dev_private;
317 	drm_via_blitq_t *blitq = dev_priv->blit_queues + engine;
318 	int cur;
319 	int done_transfer;
320 	uint32_t status = 0;
321 
322 	DRM_DEBUG("DMA blit handler called. engine = %d, from_irq = %d, blitq = 0x%lx\n",
323 		  engine, from_irq, (unsigned long) blitq);
324 
325 	mtx_lock(&blitq->blit_lock);
326 
327 	done_transfer = blitq->is_active &&
328 	  (( status = VIA_READ(VIA_PCI_DMA_CSR0 + engine*0x04)) & VIA_DMA_CSR_TD);
329 	done_transfer = done_transfer || ( blitq->aborting && !(status & VIA_DMA_CSR_DE));
330 
331 	cur = blitq->cur;
332 	if (done_transfer) {
333 
334 		blitq->blits[cur]->aborted = blitq->aborting;
335 		blitq->done_blit_handle++;
336 		DRM_WAKEUP(&blitq->blit_queue[cur]);
337 
338 		cur++;
339 		if (cur >= VIA_NUM_BLIT_SLOTS)
340 			cur = 0;
341 		blitq->cur = cur;
342 
343 		/*
344 		 * Clear transfer done flag.
345 		 */
346 
347 		VIA_WRITE(VIA_PCI_DMA_CSR0 + engine*0x04,  VIA_DMA_CSR_TD);
348 
349 		blitq->is_active = 0;
350 		blitq->aborting = 0;
351 
352 		taskqueue_enqueue(taskqueue_swi, &blitq->wq);
353 
354 	} else if (blitq->is_active && (ticks >= blitq->end)) {
355 
356 		/*
357 		 * Abort transfer after one second.
358 		 */
359 
360 		via_abort_dmablit(dev, engine);
361 		blitq->aborting = 1;
362 		blitq->end = ticks + DRM_HZ;
363 	}
364 
365 	if (!blitq->is_active) {
366 		if (blitq->num_outstanding) {
367 			via_fire_dmablit(dev, blitq->blits[cur], engine);
368 			blitq->is_active = 1;
369 			blitq->cur = cur;
370 			blitq->num_outstanding--;
371 			blitq->end = ticks + DRM_HZ;
372 
373 			if (!callout_pending(&blitq->poll_timer))
374 				callout_reset(&blitq->poll_timer,
375 				    1, (timeout_t *)via_dmablit_timer,
376 				    (void *)blitq);
377 		} else {
378 			if (callout_pending(&blitq->poll_timer)) {
379 				callout_stop(&blitq->poll_timer);
380 			}
381 			via_dmablit_engine_off(dev, engine);
382 		}
383 	}
384 
385 	mtx_unlock(&blitq->blit_lock);
386 }
387 
388 
389 /*
390  * Check whether this blit is still active, performing necessary locking.
391  */
392 static int
via_dmablit_active(drm_via_blitq_t * blitq,int engine,uint32_t handle,wait_queue_head_t ** queue)393 via_dmablit_active(drm_via_blitq_t *blitq, int engine, uint32_t handle, wait_queue_head_t **queue)
394 {
395 	uint32_t slot;
396 	int active;
397 
398 	mtx_lock(&blitq->blit_lock);
399 
400 	/*
401 	 * Allow for handle wraparounds.
402 	 */
403 	active = ((blitq->done_blit_handle - handle) > (1 << 23)) &&
404 		((blitq->cur_blit_handle - handle) <= (1 << 23));
405 
406 	if (queue && active) {
407 		slot = handle - blitq->done_blit_handle + blitq->cur -1;
408 		if (slot >= VIA_NUM_BLIT_SLOTS) {
409 			slot -= VIA_NUM_BLIT_SLOTS;
410 		}
411 		*queue = blitq->blit_queue + slot;
412 	}
413 
414 	mtx_unlock(&blitq->blit_lock);
415 
416 	return active;
417 }
418 
419 
420 /*
421  * Sync. Wait for at least three seconds for the blit to be performed.
422  */
423 static int
via_dmablit_sync(struct drm_device * dev,uint32_t handle,int engine)424 via_dmablit_sync(struct drm_device *dev, uint32_t handle, int engine)
425 {
426 
427 	drm_via_private_t *dev_priv = (drm_via_private_t *)dev->dev_private;
428 	drm_via_blitq_t *blitq = dev_priv->blit_queues + engine;
429 	wait_queue_head_t *queue;
430 	int ret = 0;
431 
432 	if (via_dmablit_active(blitq, engine, handle, &queue)) {
433 		DRM_WAIT_ON(ret, *queue, 3 * DRM_HZ,
434 			    !via_dmablit_active(blitq, engine, handle, NULL));
435 	}
436 	DRM_DEBUG("DMA blit sync handle 0x%x engine %d returned %d\n",
437 		  handle, engine, ret);
438 
439 	return ret;
440 }
441 
442 
443 /*
444  * A timer that regularly polls the blit engine in cases where we don't have interrupts:
445  * a) Broken hardware (typically those that don't have any video capture facility).
446  * b) Blit abort. The hardware doesn't send an interrupt when a blit is aborted.
447  * The timer and hardware IRQ's can and do work in parallel. If the hardware has
448  * irqs, it will shorten the latency somewhat.
449  */
450 static void
via_dmablit_timer(void * arg)451 via_dmablit_timer(void *arg)
452 {
453 	drm_via_blitq_t *blitq = (drm_via_blitq_t *)arg;
454 	struct drm_device *dev = blitq->dev;
455 	int engine = (int)
456 		(blitq - ((drm_via_private_t *)dev->dev_private)->blit_queues);
457 
458 	DRM_DEBUG("Polling timer called for engine %d, jiffies %lu\n", engine,
459 		  (unsigned long) jiffies);
460 
461 	via_dmablit_handler(dev, engine, 0);
462 
463 	if (!callout_pending(&blitq->poll_timer)) {
464 		callout_schedule(&blitq->poll_timer, 1);
465 
466 	       /*
467 		* Rerun handler to delete timer if engines are off, and
468 		* to shorten abort latency. This is a little nasty.
469 		*/
470 
471 	       via_dmablit_handler(dev, engine, 0);
472 
473 	}
474 }
475 
476 
477 /*
478  * Workqueue task that frees data and mappings associated with a blit.
479  * Also wakes up waiting processes. Each of these tasks handles one
480  * blit engine only and may not be called on each interrupt.
481  */
482 static void
via_dmablit_workqueue(void * arg,int pending)483 via_dmablit_workqueue(void *arg, int pending)
484 {
485 	drm_via_blitq_t *blitq = (drm_via_blitq_t *)arg;
486 	struct drm_device *dev = blitq->dev;
487 	drm_via_sg_info_t *cur_sg;
488 	int cur_released;
489 
490 
491 	DRM_DEBUG("task called for blit engine %ld\n",(unsigned long)
492 		  (blitq - ((drm_via_private_t *)dev->dev_private)->blit_queues));
493 
494 	mtx_lock(&blitq->blit_lock);
495 
496 	while(blitq->serviced != blitq->cur) {
497 
498 		cur_released = blitq->serviced++;
499 
500 		DRM_DEBUG("Releasing blit slot %d\n", cur_released);
501 
502 		if (blitq->serviced >= VIA_NUM_BLIT_SLOTS)
503 			blitq->serviced = 0;
504 
505 		cur_sg = blitq->blits[cur_released];
506 		blitq->num_free++;
507 
508 		mtx_unlock(&blitq->blit_lock);
509 
510 		DRM_WAKEUP(&blitq->busy_queue);
511 
512 		via_free_sg_info(cur_sg);
513 		free(cur_sg, DRM_MEM_DRIVER);
514 
515 		mtx_lock(&blitq->blit_lock);
516 	}
517 
518 	mtx_unlock(&blitq->blit_lock);
519 }
520 
521 
522 /*
523  * Init all blit engines. Currently we use two, but some hardware have 4.
524  */
525 void
via_init_dmablit(struct drm_device * dev)526 via_init_dmablit(struct drm_device *dev)
527 {
528 	int i,j;
529 	drm_via_private_t *dev_priv = (drm_via_private_t *)dev->dev_private;
530 	drm_via_blitq_t *blitq;
531 
532 	for (i=0; i< VIA_NUM_BLIT_ENGINES; ++i) {
533 		blitq = dev_priv->blit_queues + i;
534 		blitq->dev = dev;
535 		blitq->cur_blit_handle = 0;
536 		blitq->done_blit_handle = 0;
537 		blitq->head = 0;
538 		blitq->cur = 0;
539 		blitq->serviced = 0;
540 		blitq->num_free = VIA_NUM_BLIT_SLOTS - 1;
541 		blitq->num_outstanding = 0;
542 		blitq->is_active = 0;
543 		blitq->aborting = 0;
544 		mtx_init(&blitq->blit_lock, "via_blit_lk", NULL, MTX_DEF);
545 		for (j=0; j<VIA_NUM_BLIT_SLOTS; ++j) {
546 			DRM_INIT_WAITQUEUE(blitq->blit_queue + j);
547 		}
548 		DRM_INIT_WAITQUEUE(&blitq->busy_queue);
549 		TASK_INIT(&blitq->wq, 0, via_dmablit_workqueue, blitq);
550 		callout_init(&blitq->poll_timer, 0);
551 	}
552 }
553 
554 
555 /*
556  * Build all info and do all mappings required for a blit.
557  */
558 static int
via_build_sg_info(struct drm_device * dev,drm_via_sg_info_t * vsg,drm_via_dmablit_t * xfer)559 via_build_sg_info(struct drm_device *dev, drm_via_sg_info_t *vsg,
560     drm_via_dmablit_t *xfer)
561 {
562 	int ret = 0;
563 
564 	vsg->bounce_buffer = NULL;
565 
566 	vsg->state = dr_via_sg_init;
567 
568 	if (xfer->num_lines <= 0 || xfer->line_length <= 0) {
569 		DRM_ERROR("Zero size bitblt.\n");
570 		return -EINVAL;
571 	}
572 
573 	/*
574 	 * Below check is a driver limitation, not a hardware one. We
575 	 * don't want to lock unused pages, and don't want to incoporate the
576 	 * extra logic of avoiding them. Make sure there are no.
577 	 * (Not a big limitation anyway.)
578 	 */
579 	if ((xfer->mem_stride - xfer->line_length) > 2 * PAGE_SIZE) {
580 		DRM_ERROR("Too large system memory stride. Stride: %d, "
581 			  "Length: %d\n", xfer->mem_stride, xfer->line_length);
582 		return -EINVAL;
583 	}
584 
585 	if ((xfer->mem_stride == xfer->line_length) &&
586 	    (xfer->fb_stride == xfer->line_length)) {
587 		xfer->mem_stride *= xfer->num_lines;
588 		xfer->line_length = xfer->mem_stride;
589 		xfer->fb_stride = xfer->mem_stride;
590 		xfer->num_lines = 1;
591 	}
592 
593 	/*
594 	 * Don't lock an arbitrary large number of pages, since that causes a
595 	 * DOS security hole.
596 	 */
597 	if (xfer->num_lines > 2048 ||
598 	    (xfer->num_lines*xfer->mem_stride > (2048*2048*4))) {
599 		DRM_ERROR("Too large PCI DMA bitblt.\n");
600 		return -EINVAL;
601 	}
602 
603 	/*
604 	 * we allow a negative fb stride to allow flipping of images in
605 	 * transfer.
606 	 */
607 	if (xfer->mem_stride < xfer->line_length ||
608 		abs(xfer->fb_stride) < xfer->line_length) {
609 		DRM_ERROR("Invalid frame-buffer / memory stride.\n");
610 		return -EINVAL;
611 	}
612 
613 	/*
614 	 * A hardware bug seems to be worked around if system memory addresses
615 	 * start on 16 byte boundaries. This seems a bit restrictive however.
616 	 * VIA is contacted about this. Meanwhile, impose the following
617 	 * restrictions:
618 	 */
619 #ifdef VIA_BUGFREE
620 	if ((((unsigned long)xfer->mem_addr & 3) !=
621 	    ((unsigned long)xfer->fb_addr & 3)) ||
622 	    ((xfer->num_lines > 1) && ((xfer->mem_stride & 3) !=
623 	    (xfer->fb_stride & 3)))) {
624 		DRM_ERROR("Invalid DRM bitblt alignment.\n");
625 		return -EINVAL;
626 	}
627 #else
628 	if ((((unsigned long)xfer->mem_addr & 15) ||
629 	    ((unsigned long)xfer->fb_addr & 3)) ||
630 	    ((xfer->num_lines > 1) &&
631 	    ((xfer->mem_stride & 15) || (xfer->fb_stride & 3)))) {
632 		DRM_ERROR("Invalid DRM bitblt alignment.\n");
633 		return -EINVAL;
634 	}
635 #endif
636 
637 	if (0 != (ret = via_lock_all_dma_pages(vsg, xfer))) {
638 		DRM_ERROR("Could not lock DMA pages.\n");
639 		via_free_sg_info(vsg);
640 		return ret;
641 	}
642 
643 	via_map_blit_for_device(xfer, vsg, 0);
644 	if (0 != (ret = via_alloc_desc_pages(vsg))) {
645 		DRM_ERROR("Could not allocate DMA descriptor pages.\n");
646 		via_free_sg_info(vsg);
647 		return ret;
648 	}
649 	via_map_blit_for_device(xfer, vsg, 1);
650 
651 	return 0;
652 }
653 
654 
655 /*
656  * Reserve one free slot in the blit queue. Will wait for one second for one
657  * to become available. Otherwise -EBUSY is returned.
658  */
659 static int
via_dmablit_grab_slot(drm_via_blitq_t * blitq,int engine)660 via_dmablit_grab_slot(drm_via_blitq_t *blitq, int engine)
661 {
662 	struct drm_device *dev = blitq->dev;
663 	int ret=0;
664 
665 	DRM_DEBUG("Num free is %d\n", blitq->num_free);
666 	mtx_lock(&blitq->blit_lock);
667 	while(blitq->num_free == 0) {
668 		mtx_unlock(&blitq->blit_lock);
669 
670 		DRM_WAIT_ON(ret, blitq->busy_queue, DRM_HZ,
671 		    blitq->num_free > 0);
672 		if (ret) {
673 			return (-EINTR == ret) ? -EAGAIN : ret;
674 		}
675 
676 		mtx_lock(&blitq->blit_lock);
677 	}
678 
679 	blitq->num_free--;
680 	mtx_unlock(&blitq->blit_lock);
681 
682 	return 0;
683 }
684 
685 
686 /*
687  * Hand back a free slot if we changed our mind.
688  */
689 static void
via_dmablit_release_slot(drm_via_blitq_t * blitq)690 via_dmablit_release_slot(drm_via_blitq_t *blitq)
691 {
692 
693 	mtx_lock(&blitq->blit_lock);
694 	blitq->num_free++;
695 	mtx_unlock(&blitq->blit_lock);
696 	DRM_WAKEUP( &blitq->busy_queue );
697 }
698 
699 
700 /*
701  * Grab a free slot. Build blit info and queue a blit.
702  */
703 static int
via_dmablit(struct drm_device * dev,drm_via_dmablit_t * xfer)704 via_dmablit(struct drm_device *dev, drm_via_dmablit_t *xfer)
705 {
706 	drm_via_private_t *dev_priv = (drm_via_private_t *)dev->dev_private;
707 	drm_via_sg_info_t *vsg;
708 	drm_via_blitq_t *blitq;
709 	int ret;
710 	int engine;
711 
712 	if (dev_priv == NULL) {
713 		DRM_ERROR("Called without initialization.\n");
714 		return -EINVAL;
715 	}
716 
717 	engine = (xfer->to_fb) ? 0 : 1;
718 	blitq = dev_priv->blit_queues + engine;
719 	if (0 != (ret = via_dmablit_grab_slot(blitq, engine))) {
720 		return ret;
721 	}
722 	if (NULL == (vsg = malloc(sizeof(*vsg), DRM_MEM_DRIVER,
723 	    M_NOWAIT | M_ZERO))) {
724 		via_dmablit_release_slot(blitq);
725 		return -ENOMEM;
726 	}
727 	if (0 != (ret = via_build_sg_info(dev, vsg, xfer))) {
728 		via_dmablit_release_slot(blitq);
729 		free(vsg, DRM_MEM_DRIVER);
730 		return ret;
731 	}
732 	mtx_lock(&blitq->blit_lock);
733 
734 	blitq->blits[blitq->head++] = vsg;
735 	if (blitq->head >= VIA_NUM_BLIT_SLOTS)
736 		blitq->head = 0;
737 	blitq->num_outstanding++;
738 	xfer->sync.sync_handle = ++blitq->cur_blit_handle;
739 
740 	mtx_unlock(&blitq->blit_lock);
741 	xfer->sync.engine = engine;
742 
743 	via_dmablit_handler(dev, engine, 0);
744 
745 	return 0;
746 }
747 
748 
749 /*
750  * Sync on a previously submitted blit. Note that the X server use signals
751  * extensively, and that there is a very big probability that this IOCTL will
752  * be interrupted by a signal. In that case it returns with -EAGAIN for the
753  * signal to be delivered. The caller should then reissue the IOCTL. This is
754  * similar to what is being done for drmGetLock().
755  */
756 int
via_dma_blit_sync(struct drm_device * dev,void * data,struct drm_file * file_priv)757 via_dma_blit_sync( struct drm_device *dev, void *data,
758     struct drm_file *file_priv )
759 {
760 	drm_via_blitsync_t *sync = data;
761 	int err;
762 
763 	if (sync->engine >= VIA_NUM_BLIT_ENGINES)
764 		return -EINVAL;
765 
766 	err = via_dmablit_sync(dev, sync->sync_handle, sync->engine);
767 
768 	if (-EINTR == err)
769 		err = -EAGAIN;
770 
771 	return err;
772 }
773 
774 
775 /*
776  * Queue a blit and hand back a handle to be used for sync. This IOCTL may be
777  * interrupted by a signal while waiting for a free slot in the blit queue.
778  * In that case it returns with -EAGAIN and should be reissued. See the above
779  * IOCTL code.
780  */
781 int
via_dma_blit(struct drm_device * dev,void * data,struct drm_file * file_priv)782 via_dma_blit( struct drm_device *dev, void *data, struct drm_file *file_priv )
783 {
784 	drm_via_dmablit_t *xfer = data;
785 	int err;
786 
787 	err = via_dmablit(dev, xfer);
788 
789 	return err;
790 }
791