drivers/gpu/drm/via/via_dmablit.c

   1 /* via_dmablit.c -- PCI DMA BitBlt support for the VIA Unichrome/Pro
   2  *
   3  * Copyright (C) 2005 Thomas Hellstrom, All Rights Reserved.
   4  *
   5  * Permission is hereby granted, free of charge, to any person obtaining a
   6  * copy of this software and associated documentation files (the "Software"),
   7  * to deal in the Software without restriction, including without limitation
   8  * the rights to use, copy, modify, merge, publish, distribute, sub license,
   9  * and/or sell copies of the Software, and to permit persons to whom the
  10  * Software is furnished to do so, subject to the following conditions:
  11  *
  12  * The above copyright notice and this permission notice (including the
  13  * next paragraph) shall be included in all copies or substantial portions
  14  * of the Software.
  15  *
  16  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  17  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  18  * FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. IN NO EVENT SHALL
  19  * THE COPYRIGHT HOLDERS, AUTHORS AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM,
  20  * DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
  21  * OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
  22  * USE OR OTHER DEALINGS IN THE SOFTWARE.
  23  *
  24  * Authors:
  25  *    Thomas Hellstrom.
  26  *    Partially based on code obtained from Digeo Inc.
  27  */
  28
  29
  30 /*
  31  * Unmaps the DMA mappings.
  32  * FIXME: Is this a NoOp on x86? Also
  33  * FIXME: What happens if this one is called and a pending blit has previously done
  34  * the same DMA mappings?
  35  */
  36
  37 #include <linux/pagemap.h>
  38 #include <linux/pci.h>
  39 #include <linux/slab.h>
  40 #include <linux/vmalloc.h>
  41
  42 #include <drm/drm_device.h>
  43 #include <drm/via_drm.h>
  44
  45 #include "via_dmablit.h"
  46 #include "via_drv.h"
  47
  48 #define VIA_PGDN(x)          (((unsigned long)(x)) & PAGE_MASK)
  49 #define VIA_PGOFF(x)        (((unsigned long)(x)) & ~PAGE_MASK)
  50 #define VIA_PFN(x)            ((unsigned long)(x) >> PAGE_SHIFT)
  51
  52 typedef struct _drm_via_descriptor {
  53         uint32_t mem_addr;
  54         uint32_t dev_addr;
  55         uint32_t size;
  56         uint32_t next;
  57 } drm_via_descriptor_t;
  58
  59
  60 /*
  61  * Unmap a DMA mapping.
  62  */
  63
  64
  65
  66 static void
  67 via_unmap_blit_from_device(struct pci_dev *pdev, drm_via_sg_info_t *vsg)
  68 {
  69         int num_desc = vsg->num_desc;
  70         unsigned cur_descriptor_page = num_desc / vsg->descriptors_per_page;
  71         unsigned descriptor_this_page = num_desc % vsg->descriptors_per_page;
  72         drm_via_descriptor_t *desc_ptr = vsg->desc_pages[cur_descriptor_page] +
  73                 descriptor_this_page;
  74         dma_addr_t next = vsg->chain_start;
  75
  76         while (num_desc--) {
  77                 if (descriptor_this_page-- == 0) {
  78                         cur_descriptor_page--;
  79                         descriptor_this_page = vsg->descriptors_per_page - 1;
  80                         desc_ptr = vsg->desc_pages[cur_descriptor_page] +
  81                                 descriptor_this_page;
  82                 }
  83                 dma_unmap_single(&pdev->dev, next, sizeof(*desc_ptr), DMA_TO_DEVICE);
  84                 dma_unmap_page(&pdev->dev, desc_ptr->mem_addr, desc_ptr->size, vsg->direction);
  85                 next = (dma_addr_t) desc_ptr->next;
  86                 desc_ptr--;
  87         }
  88 }
  89
  90 /*
  91  * If mode = 0, count how many descriptors are needed.
  92  * If mode = 1, Map the DMA pages for the device, put together and map also the descriptors.
  93  * Descriptors are run in reverse order by the hardware because we are not allowed to update the
  94  * 'next' field without syncing calls when the descriptor is already mapped.
  95  */
  96
  97 static void
  98 via_map_blit_for_device(struct pci_dev *pdev,
  99                    const drm_via_dmablit_t *xfer,
 100                    drm_via_sg_info_t *vsg,
 101                    int mode)
 102 {
 103         unsigned cur_descriptor_page = 0;
 104         unsigned num_descriptors_this_page = 0;
 105         unsigned char *mem_addr = xfer->mem_addr;
 106         unsigned char *cur_mem;
 107         unsigned char *first_addr = (unsigned char *)VIA_PGDN(mem_addr);
 108         uint32_t fb_addr = xfer->fb_addr;
 109         uint32_t cur_fb;
 110         unsigned long line_len;
 111         unsigned remaining_len;
 112         int num_desc = 0;
 113         int cur_line;
 114         dma_addr_t next = 0 | VIA_DMA_DPR_EC;
 115         drm_via_descriptor_t *desc_ptr = NULL;
 116
 117         if (mode == 1)
 118                 desc_ptr = vsg->desc_pages[cur_descriptor_page];
 119
 120         for (cur_line = 0; cur_line < xfer->num_lines; ++cur_line) {
 121
 122                 line_len = xfer->line_length;
 123                 cur_fb = fb_addr;
 124                 cur_mem = mem_addr;
 125
 126                 while (line_len > 0) {
 127
 128                         remaining_len = min(PAGE_SIZE-VIA_PGOFF(cur_mem), line_len);
 129                         line_len -= remaining_len;
 130
 131                         if (mode == 1) {
 132                                 desc_ptr->mem_addr =
 133                                         dma_map_page(&pdev->dev,
 134                                                      vsg->pages[VIA_PFN(cur_mem) -
 135                                                                 VIA_PFN(first_addr)],
 136                                                      VIA_PGOFF(cur_mem), remaining_len,
 137                                                      vsg->direction);
 138                                 desc_ptr->dev_addr = cur_fb;
 139
 140                                 desc_ptr->size = remaining_len;
 141                                 desc_ptr->next = (uint32_t) next;
 142                                 next = dma_map_single(&pdev->dev, desc_ptr, sizeof(*desc_ptr),
 143                                                       DMA_TO_DEVICE);
 144                                 desc_ptr++;
 145                                 if (++num_descriptors_this_page >= vsg->descriptors_per_page) {
 146                                         num_descriptors_this_page = 0;
 147                                         desc_ptr = vsg->desc_pages[++cur_descriptor_page];
 148                                 }
 149                         }
 150
 151                         num_desc++;
 152                         cur_mem += remaining_len;
 153                         cur_fb += remaining_len;
 154                 }
 155
 156                 mem_addr += xfer->mem_stride;
 157                 fb_addr += xfer->fb_stride;
 158         }
 159
 160         if (mode == 1) {
 161                 vsg->chain_start = next;
 162                 vsg->state = dr_via_device_mapped;
 163         }
 164         vsg->num_desc = num_desc;
 165 }
 166
 167 /*
 168  * Function that frees up all resources for a blit. It is usable even if the
 169  * blit info has only been partially built as long as the status enum is consistent
 170  * with the actual status of the used resources.
 171  */
 172
 173
 174 static void
 175 via_free_sg_info(struct pci_dev *pdev, drm_via_sg_info_t *vsg)
 176 {
 177         int i;
 178
 179         switch (vsg->state) {
 180         case dr_via_device_mapped:
 181                 via_unmap_blit_from_device(pdev, vsg);
 182                 fallthrough;
 183         case dr_via_desc_pages_alloc:
 184                 for (i = 0; i < vsg->num_desc_pages; ++i) {
 185                         if (vsg->desc_pages[i] != NULL)
 186                                 free_page((unsigned long)vsg->desc_pages[i]);
 187                 }
 188                 kfree(vsg->desc_pages);
 189                 fallthrough;
 190         case dr_via_pages_locked:
 191                 unpin_user_pages_dirty_lock(vsg->pages, vsg->num_pages,
 192                                            (vsg->direction == DMA_FROM_DEVICE));
 193                 fallthrough;
 194         case dr_via_pages_alloc:
 195                 vfree(vsg->pages);
 196                 fallthrough;
 197         default:
 198                 vsg->state = dr_via_sg_init;
 199         }
 200         vfree(vsg->bounce_buffer);
 201         vsg->bounce_buffer = NULL;
 202         vsg->free_on_sequence = 0;
 203 }
 204
 205 /*
 206  * Fire a blit engine.
 207  */
 208
 209 static void
 210 via_fire_dmablit(struct drm_device *dev, drm_via_sg_info_t *vsg, int engine)
 211 {
 212         drm_via_private_t *dev_priv = (drm_via_private_t *)dev->dev_private;
 213
 214         via_write(dev_priv, VIA_PCI_DMA_MAR0 + engine*0x10, 0);
 215         via_write(dev_priv, VIA_PCI_DMA_DAR0 + engine*0x10, 0);
 216         via_write(dev_priv, VIA_PCI_DMA_CSR0 + engine*0x04, VIA_DMA_CSR_DD | VIA_DMA_CSR_TD |
 217                   VIA_DMA_CSR_DE);
 218         via_write(dev_priv, VIA_PCI_DMA_MR0  + engine*0x04, VIA_DMA_MR_CM | VIA_DMA_MR_TDIE);
 219         via_write(dev_priv, VIA_PCI_DMA_BCR0 + engine*0x10, 0);
 220         via_write(dev_priv, VIA_PCI_DMA_DPR0 + engine*0x10, vsg->chain_start);
 221         wmb();
 222         via_write(dev_priv, VIA_PCI_DMA_CSR0 + engine*0x04, VIA_DMA_CSR_DE | VIA_DMA_CSR_TS);
 223         via_read(dev_priv, VIA_PCI_DMA_CSR0 + engine*0x04);
 224 }
 225
 226 /*
 227  * Obtain a page pointer array and lock all pages into system memory. A segmentation violation will
 228  * occur here if the calling user does not have access to the submitted address.
 229  */
 230
 231 static int
 232 via_lock_all_dma_pages(drm_via_sg_info_t *vsg,  drm_via_dmablit_t *xfer)
 233 {
 234         int ret;
 235         unsigned long first_pfn = VIA_PFN(xfer->mem_addr);
 236         vsg->num_pages = VIA_PFN(xfer->mem_addr + (xfer->num_lines * xfer->mem_stride - 1)) -
 237                 first_pfn + 1;
 238
 239         vsg->pages = vzalloc(array_size(sizeof(struct page *), vsg->num_pages));
 240         if (NULL == vsg->pages)
 241                 return -ENOMEM;
 242         ret = pin_user_pages_fast((unsigned long)xfer->mem_addr,
 243                         vsg->num_pages,
 244                         vsg->direction == DMA_FROM_DEVICE ? FOLL_WRITE : 0,
 245                         vsg->pages);
 246         if (ret != vsg->num_pages) {
 247                 if (ret < 0)
 248                         return ret;
 249                 vsg->state = dr_via_pages_locked;
 250                 return -EINVAL;
 251         }
 252         vsg->state = dr_via_pages_locked;
 253         DRM_DEBUG("DMA pages locked\n");
 254         return 0;
 255 }
 256
 257 /*
 258  * Allocate DMA capable memory for the blit descriptor chain, and an array that keeps track of the
 259  * pages we allocate. We don't want to use kmalloc for the descriptor chain because it may be
 260  * quite large for some blits, and pages don't need to be contiguous.
 261  */
 262
 263 static int
 264 via_alloc_desc_pages(drm_via_sg_info_t *vsg)
 265 {
 266         int i;
 267
 268         vsg->descriptors_per_page = PAGE_SIZE / sizeof(drm_via_descriptor_t);
 269         vsg->num_desc_pages = (vsg->num_desc + vsg->descriptors_per_page - 1) /
 270                 vsg->descriptors_per_page;
 271
 272         if (NULL ==  (vsg->desc_pages = kcalloc(vsg->num_desc_pages, sizeof(void *), GFP_KERNEL)))
 273                 return -ENOMEM;
 274
 275         vsg->state = dr_via_desc_pages_alloc;
 276         for (i = 0; i < vsg->num_desc_pages; ++i) {
 277                 if (NULL == (vsg->desc_pages[i] =
 278                              (drm_via_descriptor_t *) __get_free_page(GFP_KERNEL)))
 279                         return -ENOMEM;
 280         }
 281         DRM_DEBUG("Allocated %d pages for %d descriptors.\n", vsg->num_desc_pages,
 282                   vsg->num_desc);
 283         return 0;
 284 }
 285
 286 static void
 287 via_abort_dmablit(struct drm_device *dev, int engine)
 288 {
 289         drm_via_private_t *dev_priv = (drm_via_private_t *)dev->dev_private;
 290
 291         via_write(dev_priv, VIA_PCI_DMA_CSR0 + engine*0x04, VIA_DMA_CSR_TA);
 292 }
 293
 294 static void
 295 via_dmablit_engine_off(struct drm_device *dev, int engine)
 296 {
 297         drm_via_private_t *dev_priv = (drm_via_private_t *)dev->dev_private;
 298
 299         via_write(dev_priv, VIA_PCI_DMA_CSR0 + engine*0x04, VIA_DMA_CSR_TD | VIA_DMA_CSR_DD);
 300 }
 301
 302
 303
 304 /*
 305  * The dmablit part of the IRQ handler. Trying to do only reasonably fast things here.
 306  * The rest, like unmapping and freeing memory for done blits is done in a separate workqueue
 307  * task. Basically the task of the interrupt handler is to submit a new blit to the engine, while
 308  * the workqueue task takes care of processing associated with the old blit.
 309  */
 310
 311 void
 312 via_dmablit_handler(struct drm_device *dev, int engine, int from_irq)
 313 {
 314         drm_via_private_t *dev_priv = (drm_via_private_t *)dev->dev_private;
 315         drm_via_blitq_t *blitq = dev_priv->blit_queues + engine;
 316         int cur;
 317         int done_transfer;
 318         unsigned long irqsave = 0;
 319         uint32_t status = 0;
 320
 321         DRM_DEBUG("DMA blit handler called. engine = %d, from_irq = %d, blitq = 0x%lx\n",
 322                   engine, from_irq, (unsigned long) blitq);
 323
 324         if (from_irq)
 325                 spin_lock(&blitq->blit_lock);
 326         else
 327                 spin_lock_irqsave(&blitq->blit_lock, irqsave);
 328
 329         done_transfer = blitq->is_active &&
 330           ((status = via_read(dev_priv, VIA_PCI_DMA_CSR0 + engine*0x04)) & VIA_DMA_CSR_TD);
 331         done_transfer = done_transfer || (blitq->aborting && !(status & VIA_DMA_CSR_DE));
 332
 333         cur = blitq->cur;
 334         if (done_transfer) {
 335
 336                 blitq->blits[cur]->aborted = blitq->aborting;
 337                 blitq->done_blit_handle++;
 338                 wake_up(blitq->blit_queue + cur);
 339
 340                 cur++;
 341                 if (cur >= VIA_NUM_BLIT_SLOTS)
 342                         cur = 0;
 343                 blitq->cur = cur;
 344
 345                 /*
 346                  * Clear transfer done flag.
 347                  */
 348
 349                 via_write(dev_priv, VIA_PCI_DMA_CSR0 + engine*0x04,  VIA_DMA_CSR_TD);
 350
 351                 blitq->is_active = 0;
 352                 blitq->aborting = 0;
 353                 schedule_work(&blitq->wq);
 354
 355         } else if (blitq->is_active && time_after_eq(jiffies, blitq->end)) {
 356
 357                 /*
 358                  * Abort transfer after one second.
 359                  */
 360
 361                 via_abort_dmablit(dev, engine);
 362                 blitq->aborting = 1;
 363                 blitq->end = jiffies + HZ;
 364         }
 365
 366         if (!blitq->is_active) {
 367                 if (blitq->num_outstanding) {
 368                         via_fire_dmablit(dev, blitq->blits[cur], engine);
 369                         blitq->is_active = 1;
 370                         blitq->cur = cur;
 371                         blitq->num_outstanding--;
 372                         blitq->end = jiffies + HZ;
 373                         if (!timer_pending(&blitq->poll_timer))
 374                                 mod_timer(&blitq->poll_timer, jiffies + 1);
 375                 } else {
 376                         if (timer_pending(&blitq->poll_timer))
 377                                 del_timer(&blitq->poll_timer);
 378                         via_dmablit_engine_off(dev, engine);
 379                 }
 380         }
 381
 382         if (from_irq)
 383                 spin_unlock(&blitq->blit_lock);
 384         else
 385                 spin_unlock_irqrestore(&blitq->blit_lock, irqsave);
 386 }
 387
 388
 389
 390 /*
 391  * Check whether this blit is still active, performing necessary locking.
 392  */
 393
 394 static int
 395 via_dmablit_active(drm_via_blitq_t *blitq, int engine, uint32_t handle, wait_queue_head_t **queue)
 396 {
 397         unsigned long irqsave;
 398         uint32_t slot;
 399         int active;
 400
 401         spin_lock_irqsave(&blitq->blit_lock, irqsave);
 402
 403         /*
 404          * Allow for handle wraparounds.
 405          */
 406
 407         active = ((blitq->done_blit_handle - handle) > (1 << 23)) &&
 408                 ((blitq->cur_blit_handle - handle) <= (1 << 23));
 409
 410         if (queue && active) {
 411                 slot = handle - blitq->done_blit_handle + blitq->cur - 1;
 412                 if (slot >= VIA_NUM_BLIT_SLOTS)
 413                         slot -= VIA_NUM_BLIT_SLOTS;
 414                 *queue = blitq->blit_queue + slot;
 415         }
 416
 417         spin_unlock_irqrestore(&blitq->blit_lock, irqsave);
 418
 419         return active;
 420 }
 421
 422 /*
 423  * Sync. Wait for at least three seconds for the blit to be performed.
 424  */
 425
 426 static int
 427 via_dmablit_sync(struct drm_device *dev, uint32_t handle, int engine)
 428 {
 429
 430         drm_via_private_t *dev_priv = (drm_via_private_t *)dev->dev_private;
 431         drm_via_blitq_t *blitq = dev_priv->blit_queues + engine;
 432         wait_queue_head_t *queue;
 433         int ret = 0;
 434
 435         if (via_dmablit_active(blitq, engine, handle, &queue)) {
 436                 VIA_WAIT_ON(ret, *queue, 3 * HZ,
 437                             !via_dmablit_active(blitq, engine, handle, NULL));
 438         }
 439         DRM_DEBUG("DMA blit sync handle 0x%x engine %d returned %d\n",
 440                   handle, engine, ret);
 441
 442         return ret;
 443 }
 444
 445
 446 /*
 447  * A timer that regularly polls the blit engine in cases where we don't have interrupts:
 448  * a) Broken hardware (typically those that don't have any video capture facility).
 449  * b) Blit abort. The hardware doesn't send an interrupt when a blit is aborted.
 450  * The timer and hardware IRQ's can and do work in parallel. If the hardware has
 451  * irqs, it will shorten the latency somewhat.
 452  */
 453
 454
 455
 456 static void
 457 via_dmablit_timer(struct timer_list *t)
 458 {
 459         drm_via_blitq_t *blitq = from_timer(blitq, t, poll_timer);
 460         struct drm_device *dev = blitq->dev;
 461         int engine = (int)
 462                 (blitq - ((drm_via_private_t *)dev->dev_private)->blit_queues);
 463
 464         DRM_DEBUG("Polling timer called for engine %d, jiffies %lu\n", engine,
 465                   (unsigned long) jiffies);
 466
 467         via_dmablit_handler(dev, engine, 0);
 468
 469         if (!timer_pending(&blitq->poll_timer)) {
 470                 mod_timer(&blitq->poll_timer, jiffies + 1);
 471
 472                /*
 473                 * Rerun handler to delete timer if engines are off, and
 474                 * to shorten abort latency. This is a little nasty.
 475                 */
 476
 477                via_dmablit_handler(dev, engine, 0);
 478
 479         }
 480 }
 481
 482
 483
 484
 485 /*
 486  * Workqueue task that frees data and mappings associated with a blit.
 487  * Also wakes up waiting processes. Each of these tasks handles one
 488  * blit engine only and may not be called on each interrupt.
 489  */
 490
 491
 492 static void
 493 via_dmablit_workqueue(struct work_struct *work)
 494 {
 495         drm_via_blitq_t *blitq = container_of(work, drm_via_blitq_t, wq);
 496         struct drm_device *dev = blitq->dev;
 497         unsigned long irqsave;
 498         drm_via_sg_info_t *cur_sg;
 499         int cur_released;
 500
 501
 502         DRM_DEBUG("Workqueue task called for blit engine %ld\n", (unsigned long)
 503                   (blitq - ((drm_via_private_t *)dev->dev_private)->blit_queues));
 504
 505         spin_lock_irqsave(&blitq->blit_lock, irqsave);
 506
 507         while (blitq->serviced != blitq->cur) {
 508
 509                 cur_released = blitq->serviced++;
 510
 511                 DRM_DEBUG("Releasing blit slot %d\n", cur_released);
 512
 513                 if (blitq->serviced >= VIA_NUM_BLIT_SLOTS)
 514                         blitq->serviced = 0;
 515
 516                 cur_sg = blitq->blits[cur_released];
 517                 blitq->num_free++;
 518
 519                 spin_unlock_irqrestore(&blitq->blit_lock, irqsave);
 520
 521                 wake_up(&blitq->busy_queue);
 522
 523                 via_free_sg_info(dev->pdev, cur_sg);
 524                 kfree(cur_sg);
 525
 526                 spin_lock_irqsave(&blitq->blit_lock, irqsave);
 527         }
 528
 529         spin_unlock_irqrestore(&blitq->blit_lock, irqsave);
 530 }
 531
 532
 533 /*
 534  * Init all blit engines. Currently we use two, but some hardware have 4.
 535  */
 536
 537
 538 void
 539 via_init_dmablit(struct drm_device *dev)
 540 {
 541         int i, j;
 542         drm_via_private_t *dev_priv = (drm_via_private_t *)dev->dev_private;
 543         drm_via_blitq_t *blitq;
 544
 545         pci_set_master(dev->pdev);
 546
 547         for (i = 0; i < VIA_NUM_BLIT_ENGINES; ++i) {
 548                 blitq = dev_priv->blit_queues + i;
 549                 blitq->dev = dev;
 550                 blitq->cur_blit_handle = 0;
 551                 blitq->done_blit_handle = 0;
 552                 blitq->head = 0;
 553                 blitq->cur = 0;
 554                 blitq->serviced = 0;
 555                 blitq->num_free = VIA_NUM_BLIT_SLOTS - 1;
 556                 blitq->num_outstanding = 0;
 557                 blitq->is_active = 0;
 558                 blitq->aborting = 0;
 559                 spin_lock_init(&blitq->blit_lock);
 560                 for (j = 0; j < VIA_NUM_BLIT_SLOTS; ++j)
 561                         init_waitqueue_head(blitq->blit_queue + j);
 562                 init_waitqueue_head(&blitq->busy_queue);
 563                 INIT_WORK(&blitq->wq, via_dmablit_workqueue);
 564                 timer_setup(&blitq->poll_timer, via_dmablit_timer, 0);
 565         }
 566 }
 567
 568 /*
 569  * Build all info and do all mappings required for a blit.
 570  */
 571
 572
 573 static int
 574 via_build_sg_info(struct drm_device *dev, drm_via_sg_info_t *vsg, drm_via_dmablit_t *xfer)
 575 {
 576         int draw = xfer->to_fb;
 577         int ret = 0;
 578
 579         vsg->direction = (draw) ? DMA_TO_DEVICE : DMA_FROM_DEVICE;
 580         vsg->bounce_buffer = NULL;
 581
 582         vsg->state = dr_via_sg_init;
 583
 584         if (xfer->num_lines <= 0 || xfer->line_length <= 0) {
 585                 DRM_ERROR("Zero size bitblt.\n");
 586                 return -EINVAL;
 587         }
 588
 589         /*
 590          * Below check is a driver limitation, not a hardware one. We
 591          * don't want to lock unused pages, and don't want to incoporate the
 592          * extra logic of avoiding them. Make sure there are no.
 593          * (Not a big limitation anyway.)
 594          */
 595
 596         if ((xfer->mem_stride - xfer->line_length) > 2*PAGE_SIZE) {
 597                 DRM_ERROR("Too large system memory stride. Stride: %d, "
 598                           "Length: %d\n", xfer->mem_stride, xfer->line_length);
 599                 return -EINVAL;
 600         }
 601
 602         if ((xfer->mem_stride == xfer->line_length) &&
 603            (xfer->fb_stride == xfer->line_length)) {
 604                 xfer->mem_stride *= xfer->num_lines;
 605                 xfer->line_length = xfer->mem_stride;
 606                 xfer->fb_stride = xfer->mem_stride;
 607                 xfer->num_lines = 1;
 608         }
 609
 610         /*
 611          * Don't lock an arbitrary large number of pages, since that causes a
 612          * DOS security hole.
 613          */
 614
 615         if (xfer->num_lines > 2048 || (xfer->num_lines*xfer->mem_stride > (2048*2048*4))) {
 616                 DRM_ERROR("Too large PCI DMA bitblt.\n");
 617                 return -EINVAL;
 618         }
 619
 620         /*
 621          * we allow a negative fb stride to allow flipping of images in
 622          * transfer.
 623          */
 624
 625         if (xfer->mem_stride < xfer->line_length ||
 626                 abs(xfer->fb_stride) < xfer->line_length) {
 627                 DRM_ERROR("Invalid frame-buffer / memory stride.\n");
 628                 return -EINVAL;
 629         }
 630
 631         /*
 632          * A hardware bug seems to be worked around if system memory addresses start on
 633          * 16 byte boundaries. This seems a bit restrictive however. VIA is contacted
 634          * about this. Meanwhile, impose the following restrictions:
 635          */
 636
 637 #ifdef VIA_BUGFREE
 638         if ((((unsigned long)xfer->mem_addr & 3) != ((unsigned long)xfer->fb_addr & 3)) ||
 639             ((xfer->num_lines > 1) && ((xfer->mem_stride & 3) != (xfer->fb_stride & 3)))) {
 640                 DRM_ERROR("Invalid DRM bitblt alignment.\n");
 641                 return -EINVAL;
 642         }
 643 #else
 644         if ((((unsigned long)xfer->mem_addr & 15) ||
 645               ((unsigned long)xfer->fb_addr & 3)) ||
 646            ((xfer->num_lines > 1) &&
 647            ((xfer->mem_stride & 15) || (xfer->fb_stride & 3)))) {
 648                 DRM_ERROR("Invalid DRM bitblt alignment.\n");
 649                 return -EINVAL;
 650         }
 651 #endif
 652
 653         if (0 != (ret = via_lock_all_dma_pages(vsg, xfer))) {
 654                 DRM_ERROR("Could not lock DMA pages.\n");
 655                 via_free_sg_info(dev->pdev, vsg);
 656                 return ret;
 657         }
 658
 659         via_map_blit_for_device(dev->pdev, xfer, vsg, 0);
 660         if (0 != (ret = via_alloc_desc_pages(vsg))) {
 661                 DRM_ERROR("Could not allocate DMA descriptor pages.\n");
 662                 via_free_sg_info(dev->pdev, vsg);
 663                 return ret;
 664         }
 665         via_map_blit_for_device(dev->pdev, xfer, vsg, 1);
 666
 667         return 0;
 668 }
 669
 670
 671 /*
 672  * Reserve one free slot in the blit queue. Will wait for one second for one
 673  * to become available. Otherwise -EBUSY is returned.
 674  */
 675
 676 static int
 677 via_dmablit_grab_slot(drm_via_blitq_t *blitq, int engine)
 678 {
 679         int ret = 0;
 680         unsigned long irqsave;
 681
 682         DRM_DEBUG("Num free is %d\n", blitq->num_free);
 683         spin_lock_irqsave(&blitq->blit_lock, irqsave);
 684         while (blitq->num_free == 0) {
 685                 spin_unlock_irqrestore(&blitq->blit_lock, irqsave);
 686
 687                 VIA_WAIT_ON(ret, blitq->busy_queue, HZ, blitq->num_free > 0);
 688                 if (ret)
 689                         return (-EINTR == ret) ? -EAGAIN : ret;
 690
 691                 spin_lock_irqsave(&blitq->blit_lock, irqsave);
 692         }
 693
 694         blitq->num_free--;
 695         spin_unlock_irqrestore(&blitq->blit_lock, irqsave);
 696
 697         return 0;
 698 }
 699
 700 /*
 701  * Hand back a free slot if we changed our mind.
 702  */
 703
 704 static void
 705 via_dmablit_release_slot(drm_via_blitq_t *blitq)
 706 {
 707         unsigned long irqsave;
 708
 709         spin_lock_irqsave(&blitq->blit_lock, irqsave);
 710         blitq->num_free++;
 711         spin_unlock_irqrestore(&blitq->blit_lock, irqsave);
 712         wake_up(&blitq->busy_queue);
 713 }
 714
 715 /*
 716  * Grab a free slot. Build blit info and queue a blit.
 717  */
 718
 719
 720 static int
 721 via_dmablit(struct drm_device *dev, drm_via_dmablit_t *xfer)
 722 {
 723         drm_via_private_t *dev_priv = (drm_via_private_t *)dev->dev_private;
 724         drm_via_sg_info_t *vsg;
 725         drm_via_blitq_t *blitq;
 726         int ret;
 727         int engine;
 728         unsigned long irqsave;
 729
 730         if (dev_priv == NULL) {
 731                 DRM_ERROR("Called without initialization.\n");
 732                 return -EINVAL;
 733         }
 734
 735         engine = (xfer->to_fb) ? 0 : 1;
 736         blitq = dev_priv->blit_queues + engine;
 737         if (0 != (ret = via_dmablit_grab_slot(blitq, engine)))
 738                 return ret;
 739         if (NULL == (vsg = kmalloc(sizeof(*vsg), GFP_KERNEL))) {
 740                 via_dmablit_release_slot(blitq);
 741                 return -ENOMEM;
 742         }
 743         if (0 != (ret = via_build_sg_info(dev, vsg, xfer))) {
 744                 via_dmablit_release_slot(blitq);
 745                 kfree(vsg);
 746                 return ret;
 747         }
 748         spin_lock_irqsave(&blitq->blit_lock, irqsave);
 749
 750         blitq->blits[blitq->head++] = vsg;
 751         if (blitq->head >= VIA_NUM_BLIT_SLOTS)
 752                 blitq->head = 0;
 753         blitq->num_outstanding++;
 754         xfer->sync.sync_handle = ++blitq->cur_blit_handle;
 755
 756         spin_unlock_irqrestore(&blitq->blit_lock, irqsave);
 757         xfer->sync.engine = engine;
 758
 759         via_dmablit_handler(dev, engine, 0);
 760
 761         return 0;
 762 }
 763
 764 /*
 765  * Sync on a previously submitted blit. Note that the X server use signals extensively, and
 766  * that there is a very big probability that this IOCTL will be interrupted by a signal. In that
 767  * case it returns with -EAGAIN for the signal to be delivered.
 768  * The caller should then reissue the IOCTL. This is similar to what is being done for drmGetLock().
 769  */
 770
 771 int
 772 via_dma_blit_sync(struct drm_device *dev, void *data, struct drm_file *file_priv)
 773 {
 774         drm_via_blitsync_t *sync = data;
 775         int err;
 776
 777         if (sync->engine >= VIA_NUM_BLIT_ENGINES)
 778                 return -EINVAL;
 779
 780         err = via_dmablit_sync(dev, sync->sync_handle, sync->engine);
 781
 782         if (-EINTR == err)
 783                 err = -EAGAIN;
 784
 785         return err;
 786 }
 787
 788
 789 /*
 790  * Queue a blit and hand back a handle to be used for sync. This IOCTL may be interrupted by a signal
 791  * while waiting for a free slot in the blit queue. In that case it returns with -EAGAIN and should
 792  * be reissued. See the above IOCTL code.
 793  */
 794
 795 int
 796 via_dma_blit(struct drm_device *dev, void *data, struct drm_file *file_priv)
 797 {
 798         drm_via_dmablit_t *xfer = data;
 799         int err;
 800
 801         err = via_dmablit(dev, xfer);
 802
 803         return err;
 804 }