1/*
   2 * Legacy: Generic DRM Buffer Management
   3 *
   4 * Copyright 1999, 2000 Precision Insight, Inc., Cedar Park, Texas.
   5 * Copyright 2000 VA Linux Systems, Inc., Sunnyvale, California.
   6 * All Rights Reserved.
   7 *
   8 * Author: Rickard E. (Rik) Faith <faith@valinux.com>
   9 * Author: Gareth Hughes <gareth@valinux.com>
  10 *
  11 * Permission is hereby granted, free of charge, to any person obtaining a
  12 * copy of this software and associated documentation files (the "Software"),
  13 * to deal in the Software without restriction, including without limitation
  14 * the rights to use, copy, modify, merge, publish, distribute, sublicense,
  15 * and/or sell copies of the Software, and to permit persons to whom the
  16 * Software is furnished to do so, subject to the following conditions:
  17 *
  18 * The above copyright notice and this permission notice (including the next
  19 * paragraph) shall be included in all copies or substantial portions of the
  20 * Software.
  21 *
  22 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  23 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  24 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
  25 * VA LINUX SYSTEMS AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM, DAMAGES OR
  26 * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
  27 * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
  28 * OTHER DEALINGS IN THE SOFTWARE.
  29 */
  30
  31#include <linux/export.h>
  32#include <linux/log2.h>
  33#include <linux/mm.h>
  34#include <linux/mman.h>
  35#include <linux/nospec.h>
  36#include <linux/pci.h>
  37#include <linux/slab.h>
  38#include <linux/uaccess.h>
  39#include <linux/vmalloc.h>
  40
  41#include <asm/shmparam.h>
  42
  43#include <drm/drm_agpsupport.h>
  44#include <drm/drm_device.h>
  45#include <drm/drm_drv.h>
  46#include <drm/drm_file.h>
  47#include <drm/drm_print.h>
  48
  49#include "drm_legacy.h"
  50
  51
  52static struct drm_map_list *drm_find_matching_map(struct drm_device *dev,
  53						  struct drm_local_map *map)
  54{
  55	struct drm_map_list *entry;
  56
  57	list_for_each_entry(entry, &dev->maplist, head) {
  58		/*
  59		 * Because the kernel-userspace ABI is fixed at a 32-bit offset
  60		 * while PCI resources may live above that, we only compare the
  61		 * lower 32 bits of the map offset for maps of type
  62		 * _DRM_FRAMEBUFFER or _DRM_REGISTERS.
  63		 * It is assumed that if a driver have more than one resource
  64		 * of each type, the lower 32 bits are different.
  65		 */
  66		if (!entry->map ||
  67		    map->type != entry->map->type ||
  68		    entry->master != dev->master)
  69			continue;
  70		switch (map->type) {
  71		case _DRM_SHM:
  72			if (map->flags != _DRM_CONTAINS_LOCK)
  73				break;
  74			return entry;
  75		case _DRM_REGISTERS:
  76		case _DRM_FRAME_BUFFER:
  77			if ((entry->map->offset & 0xffffffff) ==
  78			    (map->offset & 0xffffffff))
  79				return entry;
 
  80		default: /* Make gcc happy */
  81			;
  82		}
  83		if (entry->map->offset == map->offset)
  84			return entry;
  85	}
  86
  87	return NULL;
  88}
  89
  90static int drm_map_handle(struct drm_device *dev, struct drm_hash_item *hash,
  91			  unsigned long user_token, int hashed_handle, int shm)
  92{
  93	int use_hashed_handle, shift;
  94	unsigned long add;
  95
  96#if (BITS_PER_LONG == 64)
  97	use_hashed_handle = ((user_token & 0xFFFFFFFF00000000UL) || hashed_handle);
  98#elif (BITS_PER_LONG == 32)
  99	use_hashed_handle = hashed_handle;
 100#else
 101#error Unsupported long size. Neither 64 nor 32 bits.
 102#endif
 103
 104	if (!use_hashed_handle) {
 105		int ret;
 106
 107		hash->key = user_token >> PAGE_SHIFT;
 108		ret = drm_ht_insert_item(&dev->map_hash, hash);
 109		if (ret != -EINVAL)
 110			return ret;
 111	}
 112
 113	shift = 0;
 114	add = DRM_MAP_HASH_OFFSET >> PAGE_SHIFT;
 115	if (shm && (SHMLBA > PAGE_SIZE)) {
 116		int bits = ilog2(SHMLBA >> PAGE_SHIFT) + 1;
 117
 118		/* For shared memory, we have to preserve the SHMLBA
 119		 * bits of the eventual vma->vm_pgoff value during
 120		 * mmap().  Otherwise we run into cache aliasing problems
 121		 * on some platforms.  On these platforms, the pgoff of
 122		 * a mmap() request is used to pick a suitable virtual
 123		 * address for the mmap() region such that it will not
 124		 * cause cache aliasing problems.
 125		 *
 126		 * Therefore, make sure the SHMLBA relevant bits of the
 127		 * hash value we use are equal to those in the original
 128		 * kernel virtual address.
 129		 */
 130		shift = bits;
 131		add |= ((user_token >> PAGE_SHIFT) & ((1UL << bits) - 1UL));
 132	}
 133
 134	return drm_ht_just_insert_please(&dev->map_hash, hash,
 135					 user_token, 32 - PAGE_SHIFT - 3,
 136					 shift, add);
 137}
 138
 139/*
 140 * Core function to create a range of memory available for mapping by a
 141 * non-root process.
 142 *
 143 * Adjusts the memory offset to its absolute value according to the mapping
 144 * type.  Adds the map to the map list drm_device::maplist. Adds MTRR's where
 145 * applicable and if supported by the kernel.
 146 */
 147static int drm_addmap_core(struct drm_device *dev, resource_size_t offset,
 148			   unsigned int size, enum drm_map_type type,
 149			   enum drm_map_flags flags,
 150			   struct drm_map_list **maplist)
 151{
 152	struct drm_local_map *map;
 153	struct drm_map_list *list;
 154	unsigned long user_token;
 155	int ret;
 156
 157	map = kmalloc(sizeof(*map), GFP_KERNEL);
 158	if (!map)
 159		return -ENOMEM;
 160
 161	map->offset = offset;
 162	map->size = size;
 163	map->flags = flags;
 164	map->type = type;
 165
 166	/* Only allow shared memory to be removable since we only keep enough
 167	 * book keeping information about shared memory to allow for removal
 168	 * when processes fork.
 169	 */
 170	if ((map->flags & _DRM_REMOVABLE) && map->type != _DRM_SHM) {
 171		kfree(map);
 172		return -EINVAL;
 173	}
 174	DRM_DEBUG("offset = 0x%08llx, size = 0x%08lx, type = %d\n",
 175		  (unsigned long long)map->offset, map->size, map->type);
 176
 177	/* page-align _DRM_SHM maps. They are allocated here so there is no security
 178	 * hole created by that and it works around various broken drivers that use
 179	 * a non-aligned quantity to map the SAREA. --BenH
 180	 */
 181	if (map->type == _DRM_SHM)
 182		map->size = PAGE_ALIGN(map->size);
 183
 184	if ((map->offset & (~(resource_size_t)PAGE_MASK)) || (map->size & (~PAGE_MASK))) {
 185		kfree(map);
 186		return -EINVAL;
 187	}
 188	map->mtrr = -1;
 189	map->handle = NULL;
 190
 191	switch (map->type) {
 192	case _DRM_REGISTERS:
 193	case _DRM_FRAME_BUFFER:
 194#if !defined(__sparc__) && !defined(__alpha__) && !defined(__ia64__) && !defined(__powerpc64__) && !defined(__x86_64__) && !defined(__arm__)
 195		if (map->offset + (map->size-1) < map->offset ||
 196		    map->offset < virt_to_phys(high_memory)) {
 197			kfree(map);
 198			return -EINVAL;
 199		}
 200#endif
 201		/* Some drivers preinitialize some maps, without the X Server
 202		 * needing to be aware of it.  Therefore, we just return success
 203		 * when the server tries to create a duplicate map.
 204		 */
 205		list = drm_find_matching_map(dev, map);
 206		if (list != NULL) {
 207			if (list->map->size != map->size) {
 208				DRM_DEBUG("Matching maps of type %d with "
 209					  "mismatched sizes, (%ld vs %ld)\n",
 210					  map->type, map->size,
 211					  list->map->size);
 212				list->map->size = map->size;
 213			}
 214
 215			kfree(map);
 216			*maplist = list;
 217			return 0;
 218		}
 219
 220		if (map->type == _DRM_FRAME_BUFFER ||
 221		    (map->flags & _DRM_WRITE_COMBINING)) {
 222			map->mtrr =
 223				arch_phys_wc_add(map->offset, map->size);
 224		}
 225		if (map->type == _DRM_REGISTERS) {
 226			if (map->flags & _DRM_WRITE_COMBINING)
 227				map->handle = ioremap_wc(map->offset,
 228							 map->size);
 229			else
 230				map->handle = ioremap(map->offset, map->size);
 231			if (!map->handle) {
 232				kfree(map);
 233				return -ENOMEM;
 234			}
 235		}
 236
 237		break;
 238	case _DRM_SHM:
 239		list = drm_find_matching_map(dev, map);
 240		if (list != NULL) {
 241			if (list->map->size != map->size) {
 242				DRM_DEBUG("Matching maps of type %d with "
 243					  "mismatched sizes, (%ld vs %ld)\n",
 244					  map->type, map->size, list->map->size);
 245				list->map->size = map->size;
 246			}
 247
 248			kfree(map);
 249			*maplist = list;
 250			return 0;
 251		}
 252		map->handle = vmalloc_user(map->size);
 253		DRM_DEBUG("%lu %d %p\n",
 254			  map->size, order_base_2(map->size), map->handle);
 255		if (!map->handle) {
 256			kfree(map);
 257			return -ENOMEM;
 258		}
 259		map->offset = (unsigned long)map->handle;
 260		if (map->flags & _DRM_CONTAINS_LOCK) {
 261			/* Prevent a 2nd X Server from creating a 2nd lock */
 262			if (dev->master->lock.hw_lock != NULL) {
 263				vfree(map->handle);
 264				kfree(map);
 265				return -EBUSY;
 266			}
 267			dev->sigdata.lock = dev->master->lock.hw_lock = map->handle;	/* Pointer to lock */
 268		}
 269		break;
 270	case _DRM_AGP: {
 271		struct drm_agp_mem *entry;
 272		int valid = 0;
 273
 274		if (!dev->agp) {
 275			kfree(map);
 276			return -EINVAL;
 277		}
 278#ifdef __alpha__
 279		map->offset += dev->hose->mem_space->start;
 280#endif
 281		/* In some cases (i810 driver), user space may have already
 282		 * added the AGP base itself, because dev->agp->base previously
 283		 * only got set during AGP enable.  So, only add the base
 284		 * address if the map's offset isn't already within the
 285		 * aperture.
 286		 */
 287		if (map->offset < dev->agp->base ||
 288		    map->offset > dev->agp->base +
 289		    dev->agp->agp_info.aper_size * 1024 * 1024 - 1) {
 290			map->offset += dev->agp->base;
 291		}
 292		map->mtrr = dev->agp->agp_mtrr;	/* for getmap */
 293
 294		/* This assumes the DRM is in total control of AGP space.
 295		 * It's not always the case as AGP can be in the control
 296		 * of user space (i.e. i810 driver). So this loop will get
 297		 * skipped and we double check that dev->agp->memory is
 298		 * actually set as well as being invalid before EPERM'ing
 299		 */
 300		list_for_each_entry(entry, &dev->agp->memory, head) {
 301			if ((map->offset >= entry->bound) &&
 302			    (map->offset + map->size <= entry->bound + entry->pages * PAGE_SIZE)) {
 303				valid = 1;
 304				break;
 305			}
 306		}
 307		if (!list_empty(&dev->agp->memory) && !valid) {
 308			kfree(map);
 309			return -EPERM;
 310		}
 311		DRM_DEBUG("AGP offset = 0x%08llx, size = 0x%08lx\n",
 312			  (unsigned long long)map->offset, map->size);
 313
 314		break;
 315	}
 316	case _DRM_SCATTER_GATHER:
 317		if (!dev->sg) {
 318			kfree(map);
 319			return -EINVAL;
 320		}
 321		map->offset += (unsigned long)dev->sg->virtual;
 322		break;
 323	case _DRM_CONSISTENT:
 324		/* dma_addr_t is 64bit on i386 with CONFIG_HIGHMEM64G,
 325		 * As we're limiting the address to 2^32-1 (or less),
 326		 * casting it down to 32 bits is no problem, but we
 327		 * need to point to a 64bit variable first. */
 328		map->handle = dma_alloc_coherent(&dev->pdev->dev,
 
 329						 map->size,
 330						 &map->offset,
 331						 GFP_KERNEL);
 332		if (!map->handle) {
 333			kfree(map);
 334			return -ENOMEM;
 335		}
 336		break;
 337	default:
 338		kfree(map);
 339		return -EINVAL;
 340	}
 341
 342	list = kzalloc(sizeof(*list), GFP_KERNEL);
 343	if (!list) {
 344		if (map->type == _DRM_REGISTERS)
 345			iounmap(map->handle);
 346		kfree(map);
 347		return -EINVAL;
 348	}
 349	list->map = map;
 350
 351	mutex_lock(&dev->struct_mutex);
 352	list_add(&list->head, &dev->maplist);
 353
 354	/* Assign a 32-bit handle */
 355	/* We do it here so that dev->struct_mutex protects the increment */
 356	user_token = (map->type == _DRM_SHM) ? (unsigned long)map->handle :
 357		map->offset;
 358	ret = drm_map_handle(dev, &list->hash, user_token, 0,
 359			     (map->type == _DRM_SHM));
 360	if (ret) {
 361		if (map->type == _DRM_REGISTERS)
 362			iounmap(map->handle);
 363		kfree(map);
 364		kfree(list);
 365		mutex_unlock(&dev->struct_mutex);
 366		return ret;
 367	}
 368
 369	list->user_token = list->hash.key << PAGE_SHIFT;
 370	mutex_unlock(&dev->struct_mutex);
 371
 372	if (!(map->flags & _DRM_DRIVER))
 373		list->master = dev->master;
 374	*maplist = list;
 375	return 0;
 376}
 377
 378int drm_legacy_addmap(struct drm_device *dev, resource_size_t offset,
 379		      unsigned int size, enum drm_map_type type,
 380		      enum drm_map_flags flags, struct drm_local_map **map_ptr)
 381{
 382	struct drm_map_list *list;
 383	int rc;
 384
 385	rc = drm_addmap_core(dev, offset, size, type, flags, &list);
 386	if (!rc)
 387		*map_ptr = list->map;
 388	return rc;
 389}
 390EXPORT_SYMBOL(drm_legacy_addmap);
 391
 392struct drm_local_map *drm_legacy_findmap(struct drm_device *dev,
 393					 unsigned int token)
 394{
 395	struct drm_map_list *_entry;
 396
 397	list_for_each_entry(_entry, &dev->maplist, head)
 398		if (_entry->user_token == token)
 399			return _entry->map;
 400	return NULL;
 401}
 402EXPORT_SYMBOL(drm_legacy_findmap);
 403
 404/*
 405 * Ioctl to specify a range of memory that is available for mapping by a
 406 * non-root process.
 407 *
 408 * \param inode device inode.
 409 * \param file_priv DRM file private.
 410 * \param cmd command.
 411 * \param arg pointer to a drm_map structure.
 412 * \return zero on success or a negative value on error.
 413 *
 414 */
 415int drm_legacy_addmap_ioctl(struct drm_device *dev, void *data,
 416			    struct drm_file *file_priv)
 417{
 418	struct drm_map *map = data;
 419	struct drm_map_list *maplist;
 420	int err;
 421
 422	if (!(capable(CAP_SYS_ADMIN) || map->type == _DRM_AGP || map->type == _DRM_SHM))
 423		return -EPERM;
 424
 425	if (!drm_core_check_feature(dev, DRIVER_KMS_LEGACY_CONTEXT) &&
 426	    !drm_core_check_feature(dev, DRIVER_LEGACY))
 427		return -EOPNOTSUPP;
 428
 429	err = drm_addmap_core(dev, map->offset, map->size, map->type,
 430			      map->flags, &maplist);
 431
 432	if (err)
 433		return err;
 434
 435	/* avoid a warning on 64-bit, this casting isn't very nice, but the API is set so too late */
 436	map->handle = (void *)(unsigned long)maplist->user_token;
 437
 438	/*
 439	 * It appears that there are no users of this value whatsoever --
 440	 * drmAddMap just discards it.  Let's not encourage its use.
 441	 * (Keeping drm_addmap_core's returned mtrr value would be wrong --
 442	 *  it's not a real mtrr index anymore.)
 443	 */
 444	map->mtrr = -1;
 445
 446	return 0;
 447}
 448
 449/*
 450 * Get a mapping information.
 451 *
 452 * \param inode device inode.
 453 * \param file_priv DRM file private.
 454 * \param cmd command.
 455 * \param arg user argument, pointing to a drm_map structure.
 456 *
 457 * \return zero on success or a negative number on failure.
 458 *
 459 * Searches for the mapping with the specified offset and copies its information
 460 * into userspace
 461 */
 462int drm_legacy_getmap_ioctl(struct drm_device *dev, void *data,
 463			    struct drm_file *file_priv)
 464{
 465	struct drm_map *map = data;
 466	struct drm_map_list *r_list = NULL;
 467	struct list_head *list;
 468	int idx;
 469	int i;
 470
 471	if (!drm_core_check_feature(dev, DRIVER_KMS_LEGACY_CONTEXT) &&
 472	    !drm_core_check_feature(dev, DRIVER_LEGACY))
 473		return -EOPNOTSUPP;
 474
 475	idx = map->offset;
 476	if (idx < 0)
 477		return -EINVAL;
 478
 479	i = 0;
 480	mutex_lock(&dev->struct_mutex);
 481	list_for_each(list, &dev->maplist) {
 482		if (i == idx) {
 483			r_list = list_entry(list, struct drm_map_list, head);
 484			break;
 485		}
 486		i++;
 487	}
 488	if (!r_list || !r_list->map) {
 489		mutex_unlock(&dev->struct_mutex);
 490		return -EINVAL;
 491	}
 492
 493	map->offset = r_list->map->offset;
 494	map->size = r_list->map->size;
 495	map->type = r_list->map->type;
 496	map->flags = r_list->map->flags;
 497	map->handle = (void *)(unsigned long) r_list->user_token;
 498	map->mtrr = arch_phys_wc_index(r_list->map->mtrr);
 499
 500	mutex_unlock(&dev->struct_mutex);
 501
 502	return 0;
 503}
 504
 505/*
 506 * Remove a map private from list and deallocate resources if the mapping
 507 * isn't in use.
 508 *
 509 * Searches the map on drm_device::maplist, removes it from the list, see if
 510 * it's being used, and free any associated resource (such as MTRR's) if it's not
 511 * being on use.
 512 *
 513 * \sa drm_legacy_addmap
 514 */
 515int drm_legacy_rmmap_locked(struct drm_device *dev, struct drm_local_map *map)
 516{
 517	struct drm_map_list *r_list = NULL, *list_t;
 518	int found = 0;
 519	struct drm_master *master;
 520
 521	/* Find the list entry for the map and remove it */
 522	list_for_each_entry_safe(r_list, list_t, &dev->maplist, head) {
 523		if (r_list->map == map) {
 524			master = r_list->master;
 525			list_del(&r_list->head);
 526			drm_ht_remove_key(&dev->map_hash,
 527					  r_list->user_token >> PAGE_SHIFT);
 528			kfree(r_list);
 529			found = 1;
 530			break;
 531		}
 532	}
 533
 534	if (!found)
 535		return -EINVAL;
 536
 537	switch (map->type) {
 538	case _DRM_REGISTERS:
 539		iounmap(map->handle);
 540		fallthrough;
 541	case _DRM_FRAME_BUFFER:
 542		arch_phys_wc_del(map->mtrr);
 543		break;
 544	case _DRM_SHM:
 545		vfree(map->handle);
 546		if (master) {
 547			if (dev->sigdata.lock == master->lock.hw_lock)
 548				dev->sigdata.lock = NULL;
 549			master->lock.hw_lock = NULL;   /* SHM removed */
 550			master->lock.file_priv = NULL;
 551			wake_up_interruptible_all(&master->lock.lock_queue);
 552		}
 553		break;
 554	case _DRM_AGP:
 555	case _DRM_SCATTER_GATHER:
 556		break;
 557	case _DRM_CONSISTENT:
 558		dma_free_coherent(&dev->pdev->dev,
 559				  map->size,
 560				  map->handle,
 561				  map->offset);
 562		break;
 563	}
 564	kfree(map);
 565
 566	return 0;
 567}
 568EXPORT_SYMBOL(drm_legacy_rmmap_locked);
 569
 570void drm_legacy_rmmap(struct drm_device *dev, struct drm_local_map *map)
 571{
 572	if (!drm_core_check_feature(dev, DRIVER_KMS_LEGACY_CONTEXT) &&
 573	    !drm_core_check_feature(dev, DRIVER_LEGACY))
 574		return;
 575
 576	mutex_lock(&dev->struct_mutex);
 577	drm_legacy_rmmap_locked(dev, map);
 578	mutex_unlock(&dev->struct_mutex);
 579}
 580EXPORT_SYMBOL(drm_legacy_rmmap);
 581
 582void drm_legacy_master_rmmaps(struct drm_device *dev, struct drm_master *master)
 583{
 584	struct drm_map_list *r_list, *list_temp;
 585
 586	if (!drm_core_check_feature(dev, DRIVER_LEGACY))
 587		return;
 588
 589	mutex_lock(&dev->struct_mutex);
 590	list_for_each_entry_safe(r_list, list_temp, &dev->maplist, head) {
 591		if (r_list->master == master) {
 592			drm_legacy_rmmap_locked(dev, r_list->map);
 593			r_list = NULL;
 594		}
 595	}
 596	mutex_unlock(&dev->struct_mutex);
 597}
 598
 599void drm_legacy_rmmaps(struct drm_device *dev)
 600{
 601	struct drm_map_list *r_list, *list_temp;
 602
 603	list_for_each_entry_safe(r_list, list_temp, &dev->maplist, head)
 604		drm_legacy_rmmap(dev, r_list->map);
 605}
 606
 607/* The rmmap ioctl appears to be unnecessary.  All mappings are torn down on
 608 * the last close of the device, and this is necessary for cleanup when things
 609 * exit uncleanly.  Therefore, having userland manually remove mappings seems
 610 * like a pointless exercise since they're going away anyway.
 611 *
 612 * One use case might be after addmap is allowed for normal users for SHM and
 613 * gets used by drivers that the server doesn't need to care about.  This seems
 614 * unlikely.
 615 *
 616 * \param inode device inode.
 617 * \param file_priv DRM file private.
 618 * \param cmd command.
 619 * \param arg pointer to a struct drm_map structure.
 620 * \return zero on success or a negative value on error.
 621 */
 622int drm_legacy_rmmap_ioctl(struct drm_device *dev, void *data,
 623			   struct drm_file *file_priv)
 624{
 625	struct drm_map *request = data;
 626	struct drm_local_map *map = NULL;
 627	struct drm_map_list *r_list;
 628	int ret;
 629
 630	if (!drm_core_check_feature(dev, DRIVER_KMS_LEGACY_CONTEXT) &&
 631	    !drm_core_check_feature(dev, DRIVER_LEGACY))
 632		return -EOPNOTSUPP;
 633
 634	mutex_lock(&dev->struct_mutex);
 635	list_for_each_entry(r_list, &dev->maplist, head) {
 636		if (r_list->map &&
 637		    r_list->user_token == (unsigned long)request->handle &&
 638		    r_list->map->flags & _DRM_REMOVABLE) {
 639			map = r_list->map;
 640			break;
 641		}
 642	}
 643
 644	/* List has wrapped around to the head pointer, or it's empty we didn't
 645	 * find anything.
 646	 */
 647	if (list_empty(&dev->maplist) || !map) {
 648		mutex_unlock(&dev->struct_mutex);
 649		return -EINVAL;
 650	}
 651
 652	/* Register and framebuffer maps are permanent */
 653	if ((map->type == _DRM_REGISTERS) || (map->type == _DRM_FRAME_BUFFER)) {
 654		mutex_unlock(&dev->struct_mutex);
 655		return 0;
 656	}
 657
 658	ret = drm_legacy_rmmap_locked(dev, map);
 659
 660	mutex_unlock(&dev->struct_mutex);
 661
 662	return ret;
 663}
 664
 665/*
 666 * Cleanup after an error on one of the addbufs() functions.
 667 *
 668 * \param dev DRM device.
 669 * \param entry buffer entry where the error occurred.
 670 *
 671 * Frees any pages and buffers associated with the given entry.
 672 */
 673static void drm_cleanup_buf_error(struct drm_device *dev,
 674				  struct drm_buf_entry *entry)
 675{
 
 676	int i;
 677
 678	if (entry->seg_count) {
 679		for (i = 0; i < entry->seg_count; i++) {
 680			if (entry->seglist[i]) {
 681				drm_pci_free(dev, entry->seglist[i]);
 
 
 
 
 
 682			}
 683		}
 684		kfree(entry->seglist);
 685
 686		entry->seg_count = 0;
 687	}
 688
 689	if (entry->buf_count) {
 690		for (i = 0; i < entry->buf_count; i++) {
 691			kfree(entry->buflist[i].dev_private);
 692		}
 693		kfree(entry->buflist);
 694
 695		entry->buf_count = 0;
 696	}
 697}
 698
 699#if IS_ENABLED(CONFIG_AGP)
 700/*
 701 * Add AGP buffers for DMA transfers.
 702 *
 703 * \param dev struct drm_device to which the buffers are to be added.
 704 * \param request pointer to a struct drm_buf_desc describing the request.
 705 * \return zero on success or a negative number on failure.
 706 *
 707 * After some sanity checks creates a drm_buf structure for each buffer and
 708 * reallocates the buffer list of the same size order to accommodate the new
 709 * buffers.
 710 */
 711int drm_legacy_addbufs_agp(struct drm_device *dev,
 712			   struct drm_buf_desc *request)
 713{
 714	struct drm_device_dma *dma = dev->dma;
 715	struct drm_buf_entry *entry;
 716	struct drm_agp_mem *agp_entry;
 717	struct drm_buf *buf;
 718	unsigned long offset;
 719	unsigned long agp_offset;
 720	int count;
 721	int order;
 722	int size;
 723	int alignment;
 724	int page_order;
 725	int total;
 726	int byte_count;
 727	int i, valid;
 728	struct drm_buf **temp_buflist;
 729
 730	if (!dma)
 731		return -EINVAL;
 732
 733	count = request->count;
 734	order = order_base_2(request->size);
 735	size = 1 << order;
 736
 737	alignment = (request->flags & _DRM_PAGE_ALIGN)
 738	    ? PAGE_ALIGN(size) : size;
 739	page_order = order - PAGE_SHIFT > 0 ? order - PAGE_SHIFT : 0;
 740	total = PAGE_SIZE << page_order;
 741
 742	byte_count = 0;
 743	agp_offset = dev->agp->base + request->agp_start;
 744
 745	DRM_DEBUG("count:      %d\n", count);
 746	DRM_DEBUG("order:      %d\n", order);
 747	DRM_DEBUG("size:       %d\n", size);
 748	DRM_DEBUG("agp_offset: %lx\n", agp_offset);
 749	DRM_DEBUG("alignment:  %d\n", alignment);
 750	DRM_DEBUG("page_order: %d\n", page_order);
 751	DRM_DEBUG("total:      %d\n", total);
 752
 753	if (order < DRM_MIN_ORDER || order > DRM_MAX_ORDER)
 754		return -EINVAL;
 755
 756	/* Make sure buffers are located in AGP memory that we own */
 757	valid = 0;
 758	list_for_each_entry(agp_entry, &dev->agp->memory, head) {
 759		if ((agp_offset >= agp_entry->bound) &&
 760		    (agp_offset + total * count <= agp_entry->bound + agp_entry->pages * PAGE_SIZE)) {
 761			valid = 1;
 762			break;
 763		}
 764	}
 765	if (!list_empty(&dev->agp->memory) && !valid) {
 766		DRM_DEBUG("zone invalid\n");
 767		return -EINVAL;
 768	}
 769	spin_lock(&dev->buf_lock);
 770	if (dev->buf_use) {
 771		spin_unlock(&dev->buf_lock);
 772		return -EBUSY;
 773	}
 774	atomic_inc(&dev->buf_alloc);
 775	spin_unlock(&dev->buf_lock);
 776
 777	mutex_lock(&dev->struct_mutex);
 778	entry = &dma->bufs[order];
 779	if (entry->buf_count) {
 780		mutex_unlock(&dev->struct_mutex);
 781		atomic_dec(&dev->buf_alloc);
 782		return -ENOMEM;	/* May only call once for each order */
 783	}
 784
 785	if (count < 0 || count > 4096) {
 786		mutex_unlock(&dev->struct_mutex);
 787		atomic_dec(&dev->buf_alloc);
 788		return -EINVAL;
 789	}
 790
 791	entry->buflist = kcalloc(count, sizeof(*entry->buflist), GFP_KERNEL);
 792	if (!entry->buflist) {
 793		mutex_unlock(&dev->struct_mutex);
 794		atomic_dec(&dev->buf_alloc);
 795		return -ENOMEM;
 796	}
 797
 798	entry->buf_size = size;
 799	entry->page_order = page_order;
 800
 801	offset = 0;
 802
 803	while (entry->buf_count < count) {
 804		buf = &entry->buflist[entry->buf_count];
 805		buf->idx = dma->buf_count + entry->buf_count;
 806		buf->total = alignment;
 807		buf->order = order;
 808		buf->used = 0;
 809
 810		buf->offset = (dma->byte_count + offset);
 811		buf->bus_address = agp_offset + offset;
 812		buf->address = (void *)(agp_offset + offset);
 813		buf->next = NULL;
 814		buf->waiting = 0;
 815		buf->pending = 0;
 816		buf->file_priv = NULL;
 817
 818		buf->dev_priv_size = dev->driver->dev_priv_size;
 819		buf->dev_private = kzalloc(buf->dev_priv_size, GFP_KERNEL);
 820		if (!buf->dev_private) {
 821			/* Set count correctly so we free the proper amount. */
 822			entry->buf_count = count;
 823			drm_cleanup_buf_error(dev, entry);
 824			mutex_unlock(&dev->struct_mutex);
 825			atomic_dec(&dev->buf_alloc);
 826			return -ENOMEM;
 827		}
 828
 829		DRM_DEBUG("buffer %d @ %p\n", entry->buf_count, buf->address);
 830
 831		offset += alignment;
 832		entry->buf_count++;
 833		byte_count += PAGE_SIZE << page_order;
 834	}
 835
 836	DRM_DEBUG("byte_count: %d\n", byte_count);
 837
 838	temp_buflist = krealloc(dma->buflist,
 839				(dma->buf_count + entry->buf_count) *
 840				sizeof(*dma->buflist), GFP_KERNEL);
 841	if (!temp_buflist) {
 842		/* Free the entry because it isn't valid */
 843		drm_cleanup_buf_error(dev, entry);
 844		mutex_unlock(&dev->struct_mutex);
 845		atomic_dec(&dev->buf_alloc);
 846		return -ENOMEM;
 847	}
 848	dma->buflist = temp_buflist;
 849
 850	for (i = 0; i < entry->buf_count; i++) {
 851		dma->buflist[i + dma->buf_count] = &entry->buflist[i];
 852	}
 853
 854	dma->buf_count += entry->buf_count;
 855	dma->seg_count += entry->seg_count;
 856	dma->page_count += byte_count >> PAGE_SHIFT;
 857	dma->byte_count += byte_count;
 858
 859	DRM_DEBUG("dma->buf_count : %d\n", dma->buf_count);
 860	DRM_DEBUG("entry->buf_count : %d\n", entry->buf_count);
 861
 862	mutex_unlock(&dev->struct_mutex);
 863
 864	request->count = entry->buf_count;
 865	request->size = size;
 866
 867	dma->flags = _DRM_DMA_USE_AGP;
 868
 869	atomic_dec(&dev->buf_alloc);
 870	return 0;
 871}
 872EXPORT_SYMBOL(drm_legacy_addbufs_agp);
 873#endif /* CONFIG_AGP */
 874
 875int drm_legacy_addbufs_pci(struct drm_device *dev,
 876			   struct drm_buf_desc *request)
 877{
 878	struct drm_device_dma *dma = dev->dma;
 879	int count;
 880	int order;
 881	int size;
 882	int total;
 883	int page_order;
 884	struct drm_buf_entry *entry;
 885	drm_dma_handle_t *dmah;
 886	struct drm_buf *buf;
 887	int alignment;
 888	unsigned long offset;
 889	int i;
 890	int byte_count;
 891	int page_count;
 892	unsigned long *temp_pagelist;
 893	struct drm_buf **temp_buflist;
 894
 895	if (!drm_core_check_feature(dev, DRIVER_PCI_DMA))
 896		return -EOPNOTSUPP;
 897
 898	if (!dma)
 899		return -EINVAL;
 900
 901	if (!capable(CAP_SYS_ADMIN))
 902		return -EPERM;
 903
 904	count = request->count;
 905	order = order_base_2(request->size);
 906	size = 1 << order;
 907
 908	DRM_DEBUG("count=%d, size=%d (%d), order=%d\n",
 909		  request->count, request->size, size, order);
 910
 911	if (order < DRM_MIN_ORDER || order > DRM_MAX_ORDER)
 912		return -EINVAL;
 913
 914	alignment = (request->flags & _DRM_PAGE_ALIGN)
 915	    ? PAGE_ALIGN(size) : size;
 916	page_order = order - PAGE_SHIFT > 0 ? order - PAGE_SHIFT : 0;
 917	total = PAGE_SIZE << page_order;
 918
 919	spin_lock(&dev->buf_lock);
 920	if (dev->buf_use) {
 921		spin_unlock(&dev->buf_lock);
 922		return -EBUSY;
 923	}
 924	atomic_inc(&dev->buf_alloc);
 925	spin_unlock(&dev->buf_lock);
 926
 927	mutex_lock(&dev->struct_mutex);
 928	entry = &dma->bufs[order];
 929	if (entry->buf_count) {
 930		mutex_unlock(&dev->struct_mutex);
 931		atomic_dec(&dev->buf_alloc);
 932		return -ENOMEM;	/* May only call once for each order */
 933	}
 934
 935	if (count < 0 || count > 4096) {
 936		mutex_unlock(&dev->struct_mutex);
 937		atomic_dec(&dev->buf_alloc);
 938		return -EINVAL;
 939	}
 940
 941	entry->buflist = kcalloc(count, sizeof(*entry->buflist), GFP_KERNEL);
 942	if (!entry->buflist) {
 943		mutex_unlock(&dev->struct_mutex);
 944		atomic_dec(&dev->buf_alloc);
 945		return -ENOMEM;
 946	}
 947
 948	entry->seglist = kcalloc(count, sizeof(*entry->seglist), GFP_KERNEL);
 949	if (!entry->seglist) {
 950		kfree(entry->buflist);
 951		mutex_unlock(&dev->struct_mutex);
 952		atomic_dec(&dev->buf_alloc);
 953		return -ENOMEM;
 954	}
 955
 956	/* Keep the original pagelist until we know all the allocations
 957	 * have succeeded
 958	 */
 959	temp_pagelist = kmalloc_array(dma->page_count + (count << page_order),
 960				      sizeof(*dma->pagelist),
 961				      GFP_KERNEL);
 962	if (!temp_pagelist) {
 963		kfree(entry->buflist);
 964		kfree(entry->seglist);
 965		mutex_unlock(&dev->struct_mutex);
 966		atomic_dec(&dev->buf_alloc);
 967		return -ENOMEM;
 968	}
 969	memcpy(temp_pagelist,
 970	       dma->pagelist, dma->page_count * sizeof(*dma->pagelist));
 971	DRM_DEBUG("pagelist: %d entries\n",
 972		  dma->page_count + (count << page_order));
 973
 974	entry->buf_size = size;
 975	entry->page_order = page_order;
 976	byte_count = 0;
 977	page_count = 0;
 978
 979	while (entry->buf_count < count) {
 
 
 
 
 
 
 
 
 
 
 
 980
 981		dmah = drm_pci_alloc(dev, PAGE_SIZE << page_order, 0x1000);
 
 
 
 
 
 
 982
 983		if (!dmah) {
 984			/* Set count correctly so we free the proper amount. */
 985			entry->buf_count = count;
 986			entry->seg_count = count;
 987			drm_cleanup_buf_error(dev, entry);
 988			kfree(temp_pagelist);
 989			mutex_unlock(&dev->struct_mutex);
 990			atomic_dec(&dev->buf_alloc);
 991			return -ENOMEM;
 992		}
 993		entry->seglist[entry->seg_count++] = dmah;
 994		for (i = 0; i < (1 << page_order); i++) {
 995			DRM_DEBUG("page %d @ 0x%08lx\n",
 996				  dma->page_count + page_count,
 997				  (unsigned long)dmah->vaddr + PAGE_SIZE * i);
 998			temp_pagelist[dma->page_count + page_count++]
 999				= (unsigned long)dmah->vaddr + PAGE_SIZE * i;
1000		}
1001		for (offset = 0;
1002		     offset + size <= total && entry->buf_count < count;
1003		     offset += alignment, ++entry->buf_count) {
1004			buf = &entry->buflist[entry->buf_count];
1005			buf->idx = dma->buf_count + entry->buf_count;
1006			buf->total = alignment;
1007			buf->order = order;
1008			buf->used = 0;
1009			buf->offset = (dma->byte_count + byte_count + offset);
1010			buf->address = (void *)(dmah->vaddr + offset);
1011			buf->bus_address = dmah->busaddr + offset;
1012			buf->next = NULL;
1013			buf->waiting = 0;
1014			buf->pending = 0;
1015			buf->file_priv = NULL;
1016
1017			buf->dev_priv_size = dev->driver->dev_priv_size;
1018			buf->dev_private = kzalloc(buf->dev_priv_size,
1019						GFP_KERNEL);
1020			if (!buf->dev_private) {
1021				/* Set count correctly so we free the proper amount. */
1022				entry->buf_count = count;
1023				entry->seg_count = count;
1024				drm_cleanup_buf_error(dev, entry);
1025				kfree(temp_pagelist);
1026				mutex_unlock(&dev->struct_mutex);
1027				atomic_dec(&dev->buf_alloc);
1028				return -ENOMEM;
1029			}
1030
1031			DRM_DEBUG("buffer %d @ %p\n",
1032				  entry->buf_count, buf->address);
1033		}
1034		byte_count += PAGE_SIZE << page_order;
1035	}
1036
1037	temp_buflist = krealloc(dma->buflist,
1038				(dma->buf_count + entry->buf_count) *
1039				sizeof(*dma->buflist), GFP_KERNEL);
1040	if (!temp_buflist) {
1041		/* Free the entry because it isn't valid */
1042		drm_cleanup_buf_error(dev, entry);
1043		kfree(temp_pagelist);
1044		mutex_unlock(&dev->struct_mutex);
1045		atomic_dec(&dev->buf_alloc);
1046		return -ENOMEM;
1047	}
1048	dma->buflist = temp_buflist;
1049
1050	for (i = 0; i < entry->buf_count; i++) {
1051		dma->buflist[i + dma->buf_count] = &entry->buflist[i];
1052	}
1053
1054	/* No allocations failed, so now we can replace the original pagelist
1055	 * with the new one.
1056	 */
1057	if (dma->page_count) {
1058		kfree(dma->pagelist);
1059	}
1060	dma->pagelist = temp_pagelist;
1061
1062	dma->buf_count += entry->buf_count;
1063	dma->seg_count += entry->seg_count;
1064	dma->page_count += entry->seg_count << page_order;
1065	dma->byte_count += PAGE_SIZE * (entry->seg_count << page_order);
1066
1067	mutex_unlock(&dev->struct_mutex);
1068
1069	request->count = entry->buf_count;
1070	request->size = size;
1071
1072	if (request->flags & _DRM_PCI_BUFFER_RO)
1073		dma->flags = _DRM_DMA_USE_PCI_RO;
1074
1075	atomic_dec(&dev->buf_alloc);
1076	return 0;
1077
1078}
1079EXPORT_SYMBOL(drm_legacy_addbufs_pci);
1080
1081static int drm_legacy_addbufs_sg(struct drm_device *dev,
1082				 struct drm_buf_desc *request)
1083{
1084	struct drm_device_dma *dma = dev->dma;
1085	struct drm_buf_entry *entry;
1086	struct drm_buf *buf;
1087	unsigned long offset;
1088	unsigned long agp_offset;
1089	int count;
1090	int order;
1091	int size;
1092	int alignment;
1093	int page_order;
1094	int total;
1095	int byte_count;
1096	int i;
1097	struct drm_buf **temp_buflist;
1098
1099	if (!drm_core_check_feature(dev, DRIVER_SG))
1100		return -EOPNOTSUPP;
1101
1102	if (!dma)
1103		return -EINVAL;
1104
1105	if (!capable(CAP_SYS_ADMIN))
1106		return -EPERM;
1107
1108	count = request->count;
1109	order = order_base_2(request->size);
1110	size = 1 << order;
1111
1112	alignment = (request->flags & _DRM_PAGE_ALIGN)
1113	    ? PAGE_ALIGN(size) : size;
1114	page_order = order - PAGE_SHIFT > 0 ? order - PAGE_SHIFT : 0;
1115	total = PAGE_SIZE << page_order;
1116
1117	byte_count = 0;
1118	agp_offset = request->agp_start;
1119
1120	DRM_DEBUG("count:      %d\n", count);
1121	DRM_DEBUG("order:      %d\n", order);
1122	DRM_DEBUG("size:       %d\n", size);
1123	DRM_DEBUG("agp_offset: %lu\n", agp_offset);
1124	DRM_DEBUG("alignment:  %d\n", alignment);
1125	DRM_DEBUG("page_order: %d\n", page_order);
1126	DRM_DEBUG("total:      %d\n", total);
1127
1128	if (order < DRM_MIN_ORDER || order > DRM_MAX_ORDER)
1129		return -EINVAL;
1130
1131	spin_lock(&dev->buf_lock);
1132	if (dev->buf_use) {
1133		spin_unlock(&dev->buf_lock);
1134		return -EBUSY;
1135	}
1136	atomic_inc(&dev->buf_alloc);
1137	spin_unlock(&dev->buf_lock);
1138
1139	mutex_lock(&dev->struct_mutex);
1140	entry = &dma->bufs[order];
1141	if (entry->buf_count) {
1142		mutex_unlock(&dev->struct_mutex);
1143		atomic_dec(&dev->buf_alloc);
1144		return -ENOMEM;	/* May only call once for each order */
1145	}
1146
1147	if (count < 0 || count > 4096) {
1148		mutex_unlock(&dev->struct_mutex);
1149		atomic_dec(&dev->buf_alloc);
1150		return -EINVAL;
1151	}
1152
1153	entry->buflist = kcalloc(count, sizeof(*entry->buflist), GFP_KERNEL);
1154	if (!entry->buflist) {
1155		mutex_unlock(&dev->struct_mutex);
1156		atomic_dec(&dev->buf_alloc);
1157		return -ENOMEM;
1158	}
1159
1160	entry->buf_size = size;
1161	entry->page_order = page_order;
1162
1163	offset = 0;
1164
1165	while (entry->buf_count < count) {
1166		buf = &entry->buflist[entry->buf_count];
1167		buf->idx = dma->buf_count + entry->buf_count;
1168		buf->total = alignment;
1169		buf->order = order;
1170		buf->used = 0;
1171
1172		buf->offset = (dma->byte_count + offset);
1173		buf->bus_address = agp_offset + offset;
1174		buf->address = (void *)(agp_offset + offset
1175					+ (unsigned long)dev->sg->virtual);
1176		buf->next = NULL;
1177		buf->waiting = 0;
1178		buf->pending = 0;
1179		buf->file_priv = NULL;
1180
1181		buf->dev_priv_size = dev->driver->dev_priv_size;
1182		buf->dev_private = kzalloc(buf->dev_priv_size, GFP_KERNEL);
1183		if (!buf->dev_private) {
1184			/* Set count correctly so we free the proper amount. */
1185			entry->buf_count = count;
1186			drm_cleanup_buf_error(dev, entry);
1187			mutex_unlock(&dev->struct_mutex);
1188			atomic_dec(&dev->buf_alloc);
1189			return -ENOMEM;
1190		}
1191
1192		DRM_DEBUG("buffer %d @ %p\n", entry->buf_count, buf->address);
1193
1194		offset += alignment;
1195		entry->buf_count++;
1196		byte_count += PAGE_SIZE << page_order;
1197	}
1198
1199	DRM_DEBUG("byte_count: %d\n", byte_count);
1200
1201	temp_buflist = krealloc(dma->buflist,
1202				(dma->buf_count + entry->buf_count) *
1203				sizeof(*dma->buflist), GFP_KERNEL);
1204	if (!temp_buflist) {
1205		/* Free the entry because it isn't valid */
1206		drm_cleanup_buf_error(dev, entry);
1207		mutex_unlock(&dev->struct_mutex);
1208		atomic_dec(&dev->buf_alloc);
1209		return -ENOMEM;
1210	}
1211	dma->buflist = temp_buflist;
1212
1213	for (i = 0; i < entry->buf_count; i++) {
1214		dma->buflist[i + dma->buf_count] = &entry->buflist[i];
1215	}
1216
1217	dma->buf_count += entry->buf_count;
1218	dma->seg_count += entry->seg_count;
1219	dma->page_count += byte_count >> PAGE_SHIFT;
1220	dma->byte_count += byte_count;
1221
1222	DRM_DEBUG("dma->buf_count : %d\n", dma->buf_count);
1223	DRM_DEBUG("entry->buf_count : %d\n", entry->buf_count);
1224
1225	mutex_unlock(&dev->struct_mutex);
1226
1227	request->count = entry->buf_count;
1228	request->size = size;
1229
1230	dma->flags = _DRM_DMA_USE_SG;
1231
1232	atomic_dec(&dev->buf_alloc);
1233	return 0;
1234}
1235
1236/*
1237 * Add buffers for DMA transfers (ioctl).
1238 *
1239 * \param inode device inode.
1240 * \param file_priv DRM file private.
1241 * \param cmd command.
1242 * \param arg pointer to a struct drm_buf_desc request.
1243 * \return zero on success or a negative number on failure.
1244 *
1245 * According with the memory type specified in drm_buf_desc::flags and the
1246 * build options, it dispatches the call either to addbufs_agp(),
1247 * addbufs_sg() or addbufs_pci() for AGP, scatter-gather or consistent
1248 * PCI memory respectively.
1249 */
1250int drm_legacy_addbufs(struct drm_device *dev, void *data,
1251		       struct drm_file *file_priv)
1252{
1253	struct drm_buf_desc *request = data;
1254	int ret;
1255
1256	if (!drm_core_check_feature(dev, DRIVER_LEGACY))
1257		return -EOPNOTSUPP;
1258
1259	if (!drm_core_check_feature(dev, DRIVER_HAVE_DMA))
1260		return -EOPNOTSUPP;
1261
1262#if IS_ENABLED(CONFIG_AGP)
1263	if (request->flags & _DRM_AGP_BUFFER)
1264		ret = drm_legacy_addbufs_agp(dev, request);
1265	else
1266#endif
1267	if (request->flags & _DRM_SG_BUFFER)
1268		ret = drm_legacy_addbufs_sg(dev, request);
1269	else if (request->flags & _DRM_FB_BUFFER)
1270		ret = -EINVAL;
1271	else
1272		ret = drm_legacy_addbufs_pci(dev, request);
1273
1274	return ret;
1275}
1276
1277/*
1278 * Get information about the buffer mappings.
1279 *
1280 * This was originally mean for debugging purposes, or by a sophisticated
1281 * client library to determine how best to use the available buffers (e.g.,
1282 * large buffers can be used for image transfer).
1283 *
1284 * \param inode device inode.
1285 * \param file_priv DRM file private.
1286 * \param cmd command.
1287 * \param arg pointer to a drm_buf_info structure.
1288 * \return zero on success or a negative number on failure.
1289 *
1290 * Increments drm_device::buf_use while holding the drm_device::buf_lock
1291 * lock, preventing of allocating more buffers after this call. Information
1292 * about each requested buffer is then copied into user space.
1293 */
1294int __drm_legacy_infobufs(struct drm_device *dev,
1295			void *data, int *p,
1296			int (*f)(void *, int, struct drm_buf_entry *))
1297{
1298	struct drm_device_dma *dma = dev->dma;
1299	int i;
1300	int count;
1301
1302	if (!drm_core_check_feature(dev, DRIVER_LEGACY))
1303		return -EOPNOTSUPP;
1304
1305	if (!drm_core_check_feature(dev, DRIVER_HAVE_DMA))
1306		return -EOPNOTSUPP;
1307
1308	if (!dma)
1309		return -EINVAL;
1310
1311	spin_lock(&dev->buf_lock);
1312	if (atomic_read(&dev->buf_alloc)) {
1313		spin_unlock(&dev->buf_lock);
1314		return -EBUSY;
1315	}
1316	++dev->buf_use;		/* Can't allocate more after this call */
1317	spin_unlock(&dev->buf_lock);
1318
1319	for (i = 0, count = 0; i < DRM_MAX_ORDER + 1; i++) {
1320		if (dma->bufs[i].buf_count)
1321			++count;
1322	}
1323
1324	DRM_DEBUG("count = %d\n", count);
1325
1326	if (*p >= count) {
1327		for (i = 0, count = 0; i < DRM_MAX_ORDER + 1; i++) {
1328			struct drm_buf_entry *from = &dma->bufs[i];
1329
1330			if (from->buf_count) {
1331				if (f(data, count, from) < 0)
1332					return -EFAULT;
1333				DRM_DEBUG("%d %d %d %d %d\n",
1334					  i,
1335					  dma->bufs[i].buf_count,
1336					  dma->bufs[i].buf_size,
1337					  dma->bufs[i].low_mark,
1338					  dma->bufs[i].high_mark);
1339				++count;
1340			}
1341		}
1342	}
1343	*p = count;
1344
1345	return 0;
1346}
1347
1348static int copy_one_buf(void *data, int count, struct drm_buf_entry *from)
1349{
1350	struct drm_buf_info *request = data;
1351	struct drm_buf_desc __user *to = &request->list[count];
1352	struct drm_buf_desc v = {.count = from->buf_count,
1353				 .size = from->buf_size,
1354				 .low_mark = from->low_mark,
1355				 .high_mark = from->high_mark};
1356
1357	if (copy_to_user(to, &v, offsetof(struct drm_buf_desc, flags)))
1358		return -EFAULT;
1359	return 0;
1360}
1361
1362int drm_legacy_infobufs(struct drm_device *dev, void *data,
1363			struct drm_file *file_priv)
1364{
1365	struct drm_buf_info *request = data;
1366
1367	return __drm_legacy_infobufs(dev, data, &request->count, copy_one_buf);
1368}
1369
1370/*
1371 * Specifies a low and high water mark for buffer allocation
1372 *
1373 * \param inode device inode.
1374 * \param file_priv DRM file private.
1375 * \param cmd command.
1376 * \param arg a pointer to a drm_buf_desc structure.
1377 * \return zero on success or a negative number on failure.
1378 *
1379 * Verifies that the size order is bounded between the admissible orders and
1380 * updates the respective drm_device_dma::bufs entry low and high water mark.
1381 *
1382 * \note This ioctl is deprecated and mostly never used.
1383 */
1384int drm_legacy_markbufs(struct drm_device *dev, void *data,
1385			struct drm_file *file_priv)
1386{
1387	struct drm_device_dma *dma = dev->dma;
1388	struct drm_buf_desc *request = data;
1389	int order;
1390	struct drm_buf_entry *entry;
1391
1392	if (!drm_core_check_feature(dev, DRIVER_LEGACY))
1393		return -EOPNOTSUPP;
1394
1395	if (!drm_core_check_feature(dev, DRIVER_HAVE_DMA))
1396		return -EOPNOTSUPP;
1397
1398	if (!dma)
1399		return -EINVAL;
1400
1401	DRM_DEBUG("%d, %d, %d\n",
1402		  request->size, request->low_mark, request->high_mark);
1403	order = order_base_2(request->size);
1404	if (order < DRM_MIN_ORDER || order > DRM_MAX_ORDER)
1405		return -EINVAL;
1406	entry = &dma->bufs[order];
1407
1408	if (request->low_mark < 0 || request->low_mark > entry->buf_count)
1409		return -EINVAL;
1410	if (request->high_mark < 0 || request->high_mark > entry->buf_count)
1411		return -EINVAL;
1412
1413	entry->low_mark = request->low_mark;
1414	entry->high_mark = request->high_mark;
1415
1416	return 0;
1417}
1418
1419/*
1420 * Unreserve the buffers in list, previously reserved using drmDMA.
1421 *
1422 * \param inode device inode.
1423 * \param file_priv DRM file private.
1424 * \param cmd command.
1425 * \param arg pointer to a drm_buf_free structure.
1426 * \return zero on success or a negative number on failure.
1427 *
1428 * Calls free_buffer() for each used buffer.
1429 * This function is primarily used for debugging.
1430 */
1431int drm_legacy_freebufs(struct drm_device *dev, void *data,
1432			struct drm_file *file_priv)
1433{
1434	struct drm_device_dma *dma = dev->dma;
1435	struct drm_buf_free *request = data;
1436	int i;
1437	int idx;
1438	struct drm_buf *buf;
1439
1440	if (!drm_core_check_feature(dev, DRIVER_LEGACY))
1441		return -EOPNOTSUPP;
1442
1443	if (!drm_core_check_feature(dev, DRIVER_HAVE_DMA))
1444		return -EOPNOTSUPP;
1445
1446	if (!dma)
1447		return -EINVAL;
1448
1449	DRM_DEBUG("%d\n", request->count);
1450	for (i = 0; i < request->count; i++) {
1451		if (copy_from_user(&idx, &request->list[i], sizeof(idx)))
1452			return -EFAULT;
1453		if (idx < 0 || idx >= dma->buf_count) {
1454			DRM_ERROR("Index %d (of %d max)\n",
1455				  idx, dma->buf_count - 1);
1456			return -EINVAL;
1457		}
1458		idx = array_index_nospec(idx, dma->buf_count);
1459		buf = dma->buflist[idx];
1460		if (buf->file_priv != file_priv) {
1461			DRM_ERROR("Process %d freeing buffer not owned\n",
1462				  task_pid_nr(current));
1463			return -EINVAL;
1464		}
1465		drm_legacy_free_buffer(dev, buf);
1466	}
1467
1468	return 0;
1469}
1470
1471/*
1472 * Maps all of the DMA buffers into client-virtual space (ioctl).
1473 *
1474 * \param inode device inode.
1475 * \param file_priv DRM file private.
1476 * \param cmd command.
1477 * \param arg pointer to a drm_buf_map structure.
1478 * \return zero on success or a negative number on failure.
1479 *
1480 * Maps the AGP, SG or PCI buffer region with vm_mmap(), and copies information
1481 * about each buffer into user space. For PCI buffers, it calls vm_mmap() with
1482 * offset equal to 0, which drm_mmap() interpretes as PCI buffers and calls
1483 * drm_mmap_dma().
1484 */
1485int __drm_legacy_mapbufs(struct drm_device *dev, void *data, int *p,
1486			 void __user **v,
1487			 int (*f)(void *, int, unsigned long,
1488				 struct drm_buf *),
1489				 struct drm_file *file_priv)
1490{
1491	struct drm_device_dma *dma = dev->dma;
1492	int retcode = 0;
1493	unsigned long virtual;
1494	int i;
1495
1496	if (!drm_core_check_feature(dev, DRIVER_LEGACY))
1497		return -EOPNOTSUPP;
1498
1499	if (!drm_core_check_feature(dev, DRIVER_HAVE_DMA))
1500		return -EOPNOTSUPP;
1501
1502	if (!dma)
1503		return -EINVAL;
1504
1505	spin_lock(&dev->buf_lock);
1506	if (atomic_read(&dev->buf_alloc)) {
1507		spin_unlock(&dev->buf_lock);
1508		return -EBUSY;
1509	}
1510	dev->buf_use++;		/* Can't allocate more after this call */
1511	spin_unlock(&dev->buf_lock);
1512
1513	if (*p >= dma->buf_count) {
1514		if ((dev->agp && (dma->flags & _DRM_DMA_USE_AGP))
1515		    || (drm_core_check_feature(dev, DRIVER_SG)
1516			&& (dma->flags & _DRM_DMA_USE_SG))) {
1517			struct drm_local_map *map = dev->agp_buffer_map;
1518			unsigned long token = dev->agp_buffer_token;
1519
1520			if (!map) {
1521				retcode = -EINVAL;
1522				goto done;
1523			}
1524			virtual = vm_mmap(file_priv->filp, 0, map->size,
1525					  PROT_READ | PROT_WRITE,
1526					  MAP_SHARED,
1527					  token);
1528		} else {
1529			virtual = vm_mmap(file_priv->filp, 0, dma->byte_count,
1530					  PROT_READ | PROT_WRITE,
1531					  MAP_SHARED, 0);
1532		}
1533		if (virtual > -1024UL) {
1534			/* Real error */
1535			retcode = (signed long)virtual;
1536			goto done;
1537		}
1538		*v = (void __user *)virtual;
1539
1540		for (i = 0; i < dma->buf_count; i++) {
1541			if (f(data, i, virtual, dma->buflist[i]) < 0) {
1542				retcode = -EFAULT;
1543				goto done;
1544			}
1545		}
1546	}
1547      done:
1548	*p = dma->buf_count;
1549	DRM_DEBUG("%d buffers, retcode = %d\n", *p, retcode);
1550
1551	return retcode;
1552}
1553
1554static int map_one_buf(void *data, int idx, unsigned long virtual,
1555			struct drm_buf *buf)
1556{
1557	struct drm_buf_map *request = data;
1558	unsigned long address = virtual + buf->offset;	/* *** */
1559
1560	if (copy_to_user(&request->list[idx].idx, &buf->idx,
1561			 sizeof(request->list[0].idx)))
1562		return -EFAULT;
1563	if (copy_to_user(&request->list[idx].total, &buf->total,
1564			 sizeof(request->list[0].total)))
1565		return -EFAULT;
1566	if (clear_user(&request->list[idx].used, sizeof(int)))
1567		return -EFAULT;
1568	if (copy_to_user(&request->list[idx].address, &address,
1569			 sizeof(address)))
1570		return -EFAULT;
1571	return 0;
1572}
1573
1574int drm_legacy_mapbufs(struct drm_device *dev, void *data,
1575		       struct drm_file *file_priv)
1576{
1577	struct drm_buf_map *request = data;
1578
1579	return __drm_legacy_mapbufs(dev, data, &request->count,
1580				    &request->virtual, map_one_buf,
1581				    file_priv);
1582}
1583
1584int drm_legacy_dma_ioctl(struct drm_device *dev, void *data,
1585		  struct drm_file *file_priv)
1586{
1587	if (!drm_core_check_feature(dev, DRIVER_LEGACY))
1588		return -EOPNOTSUPP;
1589
1590	if (dev->driver->dma_ioctl)
1591		return dev->driver->dma_ioctl(dev, data, file_priv);
1592	else
1593		return -EINVAL;
1594}
1595
1596struct drm_local_map *drm_legacy_getsarea(struct drm_device *dev)
1597{
1598	struct drm_map_list *entry;
1599
1600	list_for_each_entry(entry, &dev->maplist, head) {
1601		if (entry->map && entry->map->type == _DRM_SHM &&
1602		    (entry->map->flags & _DRM_CONTAINS_LOCK)) {
1603			return entry->map;
1604		}
1605	}
1606	return NULL;
1607}
1608EXPORT_SYMBOL(drm_legacy_getsarea);