Back to home page

OSCL-LXR

 
 

    


0001 // SPDX-License-Identifier: GPL-2.0-only
0002 /*
0003  *  Copyright © 2015 Broadcom
0004  */
0005 
0006 /**
0007  * DOC: VC4 GEM BO management support
0008  *
0009  * The VC4 GPU architecture (both scanout and rendering) has direct
0010  * access to system memory with no MMU in between.  To support it, we
0011  * use the GEM CMA helper functions to allocate contiguous ranges of
0012  * physical memory for our BOs.
0013  *
0014  * Since the CMA allocator is very slow, we keep a cache of recently
0015  * freed BOs around so that the kernel's allocation of objects for 3D
0016  * rendering can return quickly.
0017  */
0018 
0019 #include <linux/dma-buf.h>
0020 
0021 #include <drm/drm_fourcc.h>
0022 
0023 #include "vc4_drv.h"
0024 #include "uapi/drm/vc4_drm.h"
0025 
0026 static const struct drm_gem_object_funcs vc4_gem_object_funcs;
0027 
0028 static const char * const bo_type_names[] = {
0029     "kernel",
0030     "V3D",
0031     "V3D shader",
0032     "dumb",
0033     "binner",
0034     "RCL",
0035     "BCL",
0036     "kernel BO cache",
0037 };
0038 
0039 static bool is_user_label(int label)
0040 {
0041     return label >= VC4_BO_TYPE_COUNT;
0042 }
0043 
0044 static void vc4_bo_stats_print(struct drm_printer *p, struct vc4_dev *vc4)
0045 {
0046     int i;
0047 
0048     for (i = 0; i < vc4->num_labels; i++) {
0049         if (!vc4->bo_labels[i].num_allocated)
0050             continue;
0051 
0052         drm_printf(p, "%30s: %6dkb BOs (%d)\n",
0053                vc4->bo_labels[i].name,
0054                vc4->bo_labels[i].size_allocated / 1024,
0055                vc4->bo_labels[i].num_allocated);
0056     }
0057 
0058     mutex_lock(&vc4->purgeable.lock);
0059     if (vc4->purgeable.num)
0060         drm_printf(p, "%30s: %6zdkb BOs (%d)\n", "userspace BO cache",
0061                vc4->purgeable.size / 1024, vc4->purgeable.num);
0062 
0063     if (vc4->purgeable.purged_num)
0064         drm_printf(p, "%30s: %6zdkb BOs (%d)\n", "total purged BO",
0065                vc4->purgeable.purged_size / 1024,
0066                vc4->purgeable.purged_num);
0067     mutex_unlock(&vc4->purgeable.lock);
0068 }
0069 
0070 static int vc4_bo_stats_debugfs(struct seq_file *m, void *unused)
0071 {
0072     struct drm_info_node *node = (struct drm_info_node *)m->private;
0073     struct drm_device *dev = node->minor->dev;
0074     struct vc4_dev *vc4 = to_vc4_dev(dev);
0075     struct drm_printer p = drm_seq_file_printer(m);
0076 
0077     vc4_bo_stats_print(&p, vc4);
0078 
0079     return 0;
0080 }
0081 
0082 /* Takes ownership of *name and returns the appropriate slot for it in
0083  * the bo_labels[] array, extending it as necessary.
0084  *
0085  * This is inefficient and could use a hash table instead of walking
0086  * an array and strcmp()ing.  However, the assumption is that user
0087  * labeling will be infrequent (scanout buffers and other long-lived
0088  * objects, or debug driver builds), so we can live with it for now.
0089  */
0090 static int vc4_get_user_label(struct vc4_dev *vc4, const char *name)
0091 {
0092     int i;
0093     int free_slot = -1;
0094 
0095     for (i = 0; i < vc4->num_labels; i++) {
0096         if (!vc4->bo_labels[i].name) {
0097             free_slot = i;
0098         } else if (strcmp(vc4->bo_labels[i].name, name) == 0) {
0099             kfree(name);
0100             return i;
0101         }
0102     }
0103 
0104     if (free_slot != -1) {
0105         WARN_ON(vc4->bo_labels[free_slot].num_allocated != 0);
0106         vc4->bo_labels[free_slot].name = name;
0107         return free_slot;
0108     } else {
0109         u32 new_label_count = vc4->num_labels + 1;
0110         struct vc4_label *new_labels =
0111             krealloc(vc4->bo_labels,
0112                  new_label_count * sizeof(*new_labels),
0113                  GFP_KERNEL);
0114 
0115         if (!new_labels) {
0116             kfree(name);
0117             return -1;
0118         }
0119 
0120         free_slot = vc4->num_labels;
0121         vc4->bo_labels = new_labels;
0122         vc4->num_labels = new_label_count;
0123 
0124         vc4->bo_labels[free_slot].name = name;
0125         vc4->bo_labels[free_slot].num_allocated = 0;
0126         vc4->bo_labels[free_slot].size_allocated = 0;
0127 
0128         return free_slot;
0129     }
0130 }
0131 
0132 static void vc4_bo_set_label(struct drm_gem_object *gem_obj, int label)
0133 {
0134     struct vc4_bo *bo = to_vc4_bo(gem_obj);
0135     struct vc4_dev *vc4 = to_vc4_dev(gem_obj->dev);
0136 
0137     lockdep_assert_held(&vc4->bo_lock);
0138 
0139     if (label != -1) {
0140         vc4->bo_labels[label].num_allocated++;
0141         vc4->bo_labels[label].size_allocated += gem_obj->size;
0142     }
0143 
0144     vc4->bo_labels[bo->label].num_allocated--;
0145     vc4->bo_labels[bo->label].size_allocated -= gem_obj->size;
0146 
0147     if (vc4->bo_labels[bo->label].num_allocated == 0 &&
0148         is_user_label(bo->label)) {
0149         /* Free user BO label slots on last unreference.
0150          * Slots are just where we track the stats for a given
0151          * name, and once a name is unused we can reuse that
0152          * slot.
0153          */
0154         kfree(vc4->bo_labels[bo->label].name);
0155         vc4->bo_labels[bo->label].name = NULL;
0156     }
0157 
0158     bo->label = label;
0159 }
0160 
0161 static uint32_t bo_page_index(size_t size)
0162 {
0163     return (size / PAGE_SIZE) - 1;
0164 }
0165 
0166 static void vc4_bo_destroy(struct vc4_bo *bo)
0167 {
0168     struct drm_gem_object *obj = &bo->base.base;
0169     struct vc4_dev *vc4 = to_vc4_dev(obj->dev);
0170 
0171     lockdep_assert_held(&vc4->bo_lock);
0172 
0173     vc4_bo_set_label(obj, -1);
0174 
0175     if (bo->validated_shader) {
0176         kfree(bo->validated_shader->uniform_addr_offsets);
0177         kfree(bo->validated_shader->texture_samples);
0178         kfree(bo->validated_shader);
0179         bo->validated_shader = NULL;
0180     }
0181 
0182     drm_gem_cma_free(&bo->base);
0183 }
0184 
0185 static void vc4_bo_remove_from_cache(struct vc4_bo *bo)
0186 {
0187     struct vc4_dev *vc4 = to_vc4_dev(bo->base.base.dev);
0188 
0189     lockdep_assert_held(&vc4->bo_lock);
0190     list_del(&bo->unref_head);
0191     list_del(&bo->size_head);
0192 }
0193 
0194 static struct list_head *vc4_get_cache_list_for_size(struct drm_device *dev,
0195                              size_t size)
0196 {
0197     struct vc4_dev *vc4 = to_vc4_dev(dev);
0198     uint32_t page_index = bo_page_index(size);
0199 
0200     if (vc4->bo_cache.size_list_size <= page_index) {
0201         uint32_t new_size = max(vc4->bo_cache.size_list_size * 2,
0202                     page_index + 1);
0203         struct list_head *new_list;
0204         uint32_t i;
0205 
0206         new_list = kmalloc_array(new_size, sizeof(struct list_head),
0207                      GFP_KERNEL);
0208         if (!new_list)
0209             return NULL;
0210 
0211         /* Rebase the old cached BO lists to their new list
0212          * head locations.
0213          */
0214         for (i = 0; i < vc4->bo_cache.size_list_size; i++) {
0215             struct list_head *old_list =
0216                 &vc4->bo_cache.size_list[i];
0217 
0218             if (list_empty(old_list))
0219                 INIT_LIST_HEAD(&new_list[i]);
0220             else
0221                 list_replace(old_list, &new_list[i]);
0222         }
0223         /* And initialize the brand new BO list heads. */
0224         for (i = vc4->bo_cache.size_list_size; i < new_size; i++)
0225             INIT_LIST_HEAD(&new_list[i]);
0226 
0227         kfree(vc4->bo_cache.size_list);
0228         vc4->bo_cache.size_list = new_list;
0229         vc4->bo_cache.size_list_size = new_size;
0230     }
0231 
0232     return &vc4->bo_cache.size_list[page_index];
0233 }
0234 
0235 static void vc4_bo_cache_purge(struct drm_device *dev)
0236 {
0237     struct vc4_dev *vc4 = to_vc4_dev(dev);
0238 
0239     mutex_lock(&vc4->bo_lock);
0240     while (!list_empty(&vc4->bo_cache.time_list)) {
0241         struct vc4_bo *bo = list_last_entry(&vc4->bo_cache.time_list,
0242                             struct vc4_bo, unref_head);
0243         vc4_bo_remove_from_cache(bo);
0244         vc4_bo_destroy(bo);
0245     }
0246     mutex_unlock(&vc4->bo_lock);
0247 }
0248 
0249 void vc4_bo_add_to_purgeable_pool(struct vc4_bo *bo)
0250 {
0251     struct vc4_dev *vc4 = to_vc4_dev(bo->base.base.dev);
0252 
0253     if (WARN_ON_ONCE(vc4->is_vc5))
0254         return;
0255 
0256     mutex_lock(&vc4->purgeable.lock);
0257     list_add_tail(&bo->size_head, &vc4->purgeable.list);
0258     vc4->purgeable.num++;
0259     vc4->purgeable.size += bo->base.base.size;
0260     mutex_unlock(&vc4->purgeable.lock);
0261 }
0262 
0263 static void vc4_bo_remove_from_purgeable_pool_locked(struct vc4_bo *bo)
0264 {
0265     struct vc4_dev *vc4 = to_vc4_dev(bo->base.base.dev);
0266 
0267     if (WARN_ON_ONCE(vc4->is_vc5))
0268         return;
0269 
0270     /* list_del_init() is used here because the caller might release
0271      * the purgeable lock in order to acquire the madv one and update the
0272      * madv status.
0273      * During this short period of time a user might decide to mark
0274      * the BO as unpurgeable, and if bo->madv is set to
0275      * VC4_MADV_DONTNEED it will try to remove the BO from the
0276      * purgeable list which will fail if the ->next/prev fields
0277      * are set to LIST_POISON1/LIST_POISON2 (which is what
0278      * list_del() does).
0279      * Re-initializing the list element guarantees that list_del()
0280      * will work correctly even if it's a NOP.
0281      */
0282     list_del_init(&bo->size_head);
0283     vc4->purgeable.num--;
0284     vc4->purgeable.size -= bo->base.base.size;
0285 }
0286 
0287 void vc4_bo_remove_from_purgeable_pool(struct vc4_bo *bo)
0288 {
0289     struct vc4_dev *vc4 = to_vc4_dev(bo->base.base.dev);
0290 
0291     mutex_lock(&vc4->purgeable.lock);
0292     vc4_bo_remove_from_purgeable_pool_locked(bo);
0293     mutex_unlock(&vc4->purgeable.lock);
0294 }
0295 
0296 static void vc4_bo_purge(struct drm_gem_object *obj)
0297 {
0298     struct vc4_bo *bo = to_vc4_bo(obj);
0299     struct drm_device *dev = obj->dev;
0300 
0301     WARN_ON(!mutex_is_locked(&bo->madv_lock));
0302     WARN_ON(bo->madv != VC4_MADV_DONTNEED);
0303 
0304     drm_vma_node_unmap(&obj->vma_node, dev->anon_inode->i_mapping);
0305 
0306     dma_free_wc(dev->dev, obj->size, bo->base.vaddr, bo->base.paddr);
0307     bo->base.vaddr = NULL;
0308     bo->madv = __VC4_MADV_PURGED;
0309 }
0310 
0311 static void vc4_bo_userspace_cache_purge(struct drm_device *dev)
0312 {
0313     struct vc4_dev *vc4 = to_vc4_dev(dev);
0314 
0315     mutex_lock(&vc4->purgeable.lock);
0316     while (!list_empty(&vc4->purgeable.list)) {
0317         struct vc4_bo *bo = list_first_entry(&vc4->purgeable.list,
0318                              struct vc4_bo, size_head);
0319         struct drm_gem_object *obj = &bo->base.base;
0320         size_t purged_size = 0;
0321 
0322         vc4_bo_remove_from_purgeable_pool_locked(bo);
0323 
0324         /* Release the purgeable lock while we're purging the BO so
0325          * that other people can continue inserting things in the
0326          * purgeable pool without having to wait for all BOs to be
0327          * purged.
0328          */
0329         mutex_unlock(&vc4->purgeable.lock);
0330         mutex_lock(&bo->madv_lock);
0331 
0332         /* Since we released the purgeable pool lock before acquiring
0333          * the BO madv one, the user may have marked the BO as WILLNEED
0334          * and re-used it in the meantime.
0335          * Before purging the BO we need to make sure
0336          * - it is still marked as DONTNEED
0337          * - it has not been re-inserted in the purgeable list
0338          * - it is not used by HW blocks
0339          * If one of these conditions is not met, just skip the entry.
0340          */
0341         if (bo->madv == VC4_MADV_DONTNEED &&
0342             list_empty(&bo->size_head) &&
0343             !refcount_read(&bo->usecnt)) {
0344             purged_size = bo->base.base.size;
0345             vc4_bo_purge(obj);
0346         }
0347         mutex_unlock(&bo->madv_lock);
0348         mutex_lock(&vc4->purgeable.lock);
0349 
0350         if (purged_size) {
0351             vc4->purgeable.purged_size += purged_size;
0352             vc4->purgeable.purged_num++;
0353         }
0354     }
0355     mutex_unlock(&vc4->purgeable.lock);
0356 }
0357 
0358 static struct vc4_bo *vc4_bo_get_from_cache(struct drm_device *dev,
0359                         uint32_t size,
0360                         enum vc4_kernel_bo_type type)
0361 {
0362     struct vc4_dev *vc4 = to_vc4_dev(dev);
0363     uint32_t page_index = bo_page_index(size);
0364     struct vc4_bo *bo = NULL;
0365 
0366     mutex_lock(&vc4->bo_lock);
0367     if (page_index >= vc4->bo_cache.size_list_size)
0368         goto out;
0369 
0370     if (list_empty(&vc4->bo_cache.size_list[page_index]))
0371         goto out;
0372 
0373     bo = list_first_entry(&vc4->bo_cache.size_list[page_index],
0374                   struct vc4_bo, size_head);
0375     vc4_bo_remove_from_cache(bo);
0376     kref_init(&bo->base.base.refcount);
0377 
0378 out:
0379     if (bo)
0380         vc4_bo_set_label(&bo->base.base, type);
0381     mutex_unlock(&vc4->bo_lock);
0382     return bo;
0383 }
0384 
0385 /**
0386  * vc4_create_object - Implementation of driver->gem_create_object.
0387  * @dev: DRM device
0388  * @size: Size in bytes of the memory the object will reference
0389  *
0390  * This lets the CMA helpers allocate object structs for us, and keep
0391  * our BO stats correct.
0392  */
0393 struct drm_gem_object *vc4_create_object(struct drm_device *dev, size_t size)
0394 {
0395     struct vc4_dev *vc4 = to_vc4_dev(dev);
0396     struct vc4_bo *bo;
0397 
0398     if (WARN_ON_ONCE(vc4->is_vc5))
0399         return ERR_PTR(-ENODEV);
0400 
0401     bo = kzalloc(sizeof(*bo), GFP_KERNEL);
0402     if (!bo)
0403         return ERR_PTR(-ENOMEM);
0404 
0405     bo->madv = VC4_MADV_WILLNEED;
0406     refcount_set(&bo->usecnt, 0);
0407     mutex_init(&bo->madv_lock);
0408     mutex_lock(&vc4->bo_lock);
0409     bo->label = VC4_BO_TYPE_KERNEL;
0410     vc4->bo_labels[VC4_BO_TYPE_KERNEL].num_allocated++;
0411     vc4->bo_labels[VC4_BO_TYPE_KERNEL].size_allocated += size;
0412     mutex_unlock(&vc4->bo_lock);
0413 
0414     bo->base.base.funcs = &vc4_gem_object_funcs;
0415 
0416     return &bo->base.base;
0417 }
0418 
0419 struct vc4_bo *vc4_bo_create(struct drm_device *dev, size_t unaligned_size,
0420                  bool allow_unzeroed, enum vc4_kernel_bo_type type)
0421 {
0422     size_t size = roundup(unaligned_size, PAGE_SIZE);
0423     struct vc4_dev *vc4 = to_vc4_dev(dev);
0424     struct drm_gem_cma_object *cma_obj;
0425     struct vc4_bo *bo;
0426 
0427     if (WARN_ON_ONCE(vc4->is_vc5))
0428         return ERR_PTR(-ENODEV);
0429 
0430     if (size == 0)
0431         return ERR_PTR(-EINVAL);
0432 
0433     /* First, try to get a vc4_bo from the kernel BO cache. */
0434     bo = vc4_bo_get_from_cache(dev, size, type);
0435     if (bo) {
0436         if (!allow_unzeroed)
0437             memset(bo->base.vaddr, 0, bo->base.base.size);
0438         return bo;
0439     }
0440 
0441     cma_obj = drm_gem_cma_create(dev, size);
0442     if (IS_ERR(cma_obj)) {
0443         /*
0444          * If we've run out of CMA memory, kill the cache of
0445          * CMA allocations we've got laying around and try again.
0446          */
0447         vc4_bo_cache_purge(dev);
0448         cma_obj = drm_gem_cma_create(dev, size);
0449     }
0450 
0451     if (IS_ERR(cma_obj)) {
0452         /*
0453          * Still not enough CMA memory, purge the userspace BO
0454          * cache and retry.
0455          * This is sub-optimal since we purge the whole userspace
0456          * BO cache which forces user that want to re-use the BO to
0457          * restore its initial content.
0458          * Ideally, we should purge entries one by one and retry
0459          * after each to see if CMA allocation succeeds. Or even
0460          * better, try to find an entry with at least the same
0461          * size.
0462          */
0463         vc4_bo_userspace_cache_purge(dev);
0464         cma_obj = drm_gem_cma_create(dev, size);
0465     }
0466 
0467     if (IS_ERR(cma_obj)) {
0468         struct drm_printer p = drm_info_printer(vc4->base.dev);
0469         DRM_ERROR("Failed to allocate from CMA:\n");
0470         vc4_bo_stats_print(&p, vc4);
0471         return ERR_PTR(-ENOMEM);
0472     }
0473     bo = to_vc4_bo(&cma_obj->base);
0474 
0475     /* By default, BOs do not support the MADV ioctl. This will be enabled
0476      * only on BOs that are exposed to userspace (V3D, V3D_SHADER and DUMB
0477      * BOs).
0478      */
0479     bo->madv = __VC4_MADV_NOTSUPP;
0480 
0481     mutex_lock(&vc4->bo_lock);
0482     vc4_bo_set_label(&cma_obj->base, type);
0483     mutex_unlock(&vc4->bo_lock);
0484 
0485     return bo;
0486 }
0487 
0488 int vc4_bo_dumb_create(struct drm_file *file_priv,
0489                struct drm_device *dev,
0490                struct drm_mode_create_dumb *args)
0491 {
0492     struct vc4_dev *vc4 = to_vc4_dev(dev);
0493     struct vc4_bo *bo = NULL;
0494     int ret;
0495 
0496     if (WARN_ON_ONCE(vc4->is_vc5))
0497         return -ENODEV;
0498 
0499     ret = vc4_dumb_fixup_args(args);
0500     if (ret)
0501         return ret;
0502 
0503     bo = vc4_bo_create(dev, args->size, false, VC4_BO_TYPE_DUMB);
0504     if (IS_ERR(bo))
0505         return PTR_ERR(bo);
0506 
0507     bo->madv = VC4_MADV_WILLNEED;
0508 
0509     ret = drm_gem_handle_create(file_priv, &bo->base.base, &args->handle);
0510     drm_gem_object_put(&bo->base.base);
0511 
0512     return ret;
0513 }
0514 
0515 static void vc4_bo_cache_free_old(struct drm_device *dev)
0516 {
0517     struct vc4_dev *vc4 = to_vc4_dev(dev);
0518     unsigned long expire_time = jiffies - msecs_to_jiffies(1000);
0519 
0520     lockdep_assert_held(&vc4->bo_lock);
0521 
0522     while (!list_empty(&vc4->bo_cache.time_list)) {
0523         struct vc4_bo *bo = list_last_entry(&vc4->bo_cache.time_list,
0524                             struct vc4_bo, unref_head);
0525         if (time_before(expire_time, bo->free_time)) {
0526             mod_timer(&vc4->bo_cache.time_timer,
0527                   round_jiffies_up(jiffies +
0528                            msecs_to_jiffies(1000)));
0529             return;
0530         }
0531 
0532         vc4_bo_remove_from_cache(bo);
0533         vc4_bo_destroy(bo);
0534     }
0535 }
0536 
0537 /* Called on the last userspace/kernel unreference of the BO.  Returns
0538  * it to the BO cache if possible, otherwise frees it.
0539  */
0540 static void vc4_free_object(struct drm_gem_object *gem_bo)
0541 {
0542     struct drm_device *dev = gem_bo->dev;
0543     struct vc4_dev *vc4 = to_vc4_dev(dev);
0544     struct vc4_bo *bo = to_vc4_bo(gem_bo);
0545     struct list_head *cache_list;
0546 
0547     /* Remove the BO from the purgeable list. */
0548     mutex_lock(&bo->madv_lock);
0549     if (bo->madv == VC4_MADV_DONTNEED && !refcount_read(&bo->usecnt))
0550         vc4_bo_remove_from_purgeable_pool(bo);
0551     mutex_unlock(&bo->madv_lock);
0552 
0553     mutex_lock(&vc4->bo_lock);
0554     /* If the object references someone else's memory, we can't cache it.
0555      */
0556     if (gem_bo->import_attach) {
0557         vc4_bo_destroy(bo);
0558         goto out;
0559     }
0560 
0561     /* Don't cache if it was publicly named. */
0562     if (gem_bo->name) {
0563         vc4_bo_destroy(bo);
0564         goto out;
0565     }
0566 
0567     /* If this object was partially constructed but CMA allocation
0568      * had failed, just free it. Can also happen when the BO has been
0569      * purged.
0570      */
0571     if (!bo->base.vaddr) {
0572         vc4_bo_destroy(bo);
0573         goto out;
0574     }
0575 
0576     cache_list = vc4_get_cache_list_for_size(dev, gem_bo->size);
0577     if (!cache_list) {
0578         vc4_bo_destroy(bo);
0579         goto out;
0580     }
0581 
0582     if (bo->validated_shader) {
0583         kfree(bo->validated_shader->uniform_addr_offsets);
0584         kfree(bo->validated_shader->texture_samples);
0585         kfree(bo->validated_shader);
0586         bo->validated_shader = NULL;
0587     }
0588 
0589     /* Reset madv and usecnt before adding the BO to the cache. */
0590     bo->madv = __VC4_MADV_NOTSUPP;
0591     refcount_set(&bo->usecnt, 0);
0592 
0593     bo->t_format = false;
0594     bo->free_time = jiffies;
0595     list_add(&bo->size_head, cache_list);
0596     list_add(&bo->unref_head, &vc4->bo_cache.time_list);
0597 
0598     vc4_bo_set_label(&bo->base.base, VC4_BO_TYPE_KERNEL_CACHE);
0599 
0600     vc4_bo_cache_free_old(dev);
0601 
0602 out:
0603     mutex_unlock(&vc4->bo_lock);
0604 }
0605 
0606 static void vc4_bo_cache_time_work(struct work_struct *work)
0607 {
0608     struct vc4_dev *vc4 =
0609         container_of(work, struct vc4_dev, bo_cache.time_work);
0610     struct drm_device *dev = &vc4->base;
0611 
0612     mutex_lock(&vc4->bo_lock);
0613     vc4_bo_cache_free_old(dev);
0614     mutex_unlock(&vc4->bo_lock);
0615 }
0616 
0617 int vc4_bo_inc_usecnt(struct vc4_bo *bo)
0618 {
0619     struct vc4_dev *vc4 = to_vc4_dev(bo->base.base.dev);
0620     int ret;
0621 
0622     if (WARN_ON_ONCE(vc4->is_vc5))
0623         return -ENODEV;
0624 
0625     /* Fast path: if the BO is already retained by someone, no need to
0626      * check the madv status.
0627      */
0628     if (refcount_inc_not_zero(&bo->usecnt))
0629         return 0;
0630 
0631     mutex_lock(&bo->madv_lock);
0632     switch (bo->madv) {
0633     case VC4_MADV_WILLNEED:
0634         if (!refcount_inc_not_zero(&bo->usecnt))
0635             refcount_set(&bo->usecnt, 1);
0636         ret = 0;
0637         break;
0638     case VC4_MADV_DONTNEED:
0639         /* We shouldn't use a BO marked as purgeable if at least
0640          * someone else retained its content by incrementing usecnt.
0641          * Luckily the BO hasn't been purged yet, but something wrong
0642          * is happening here. Just throw an error instead of
0643          * authorizing this use case.
0644          */
0645     case __VC4_MADV_PURGED:
0646         /* We can't use a purged BO. */
0647     default:
0648         /* Invalid madv value. */
0649         ret = -EINVAL;
0650         break;
0651     }
0652     mutex_unlock(&bo->madv_lock);
0653 
0654     return ret;
0655 }
0656 
0657 void vc4_bo_dec_usecnt(struct vc4_bo *bo)
0658 {
0659     struct vc4_dev *vc4 = to_vc4_dev(bo->base.base.dev);
0660 
0661     if (WARN_ON_ONCE(vc4->is_vc5))
0662         return;
0663 
0664     /* Fast path: if the BO is still retained by someone, no need to test
0665      * the madv value.
0666      */
0667     if (refcount_dec_not_one(&bo->usecnt))
0668         return;
0669 
0670     mutex_lock(&bo->madv_lock);
0671     if (refcount_dec_and_test(&bo->usecnt) &&
0672         bo->madv == VC4_MADV_DONTNEED)
0673         vc4_bo_add_to_purgeable_pool(bo);
0674     mutex_unlock(&bo->madv_lock);
0675 }
0676 
0677 static void vc4_bo_cache_time_timer(struct timer_list *t)
0678 {
0679     struct vc4_dev *vc4 = from_timer(vc4, t, bo_cache.time_timer);
0680 
0681     schedule_work(&vc4->bo_cache.time_work);
0682 }
0683 
0684 static struct dma_buf *vc4_prime_export(struct drm_gem_object *obj, int flags)
0685 {
0686     struct vc4_bo *bo = to_vc4_bo(obj);
0687     struct dma_buf *dmabuf;
0688     int ret;
0689 
0690     if (bo->validated_shader) {
0691         DRM_DEBUG("Attempting to export shader BO\n");
0692         return ERR_PTR(-EINVAL);
0693     }
0694 
0695     /* Note: as soon as the BO is exported it becomes unpurgeable, because
0696      * noone ever decrements the usecnt even if the reference held by the
0697      * exported BO is released. This shouldn't be a problem since we don't
0698      * expect exported BOs to be marked as purgeable.
0699      */
0700     ret = vc4_bo_inc_usecnt(bo);
0701     if (ret) {
0702         DRM_ERROR("Failed to increment BO usecnt\n");
0703         return ERR_PTR(ret);
0704     }
0705 
0706     dmabuf = drm_gem_prime_export(obj, flags);
0707     if (IS_ERR(dmabuf))
0708         vc4_bo_dec_usecnt(bo);
0709 
0710     return dmabuf;
0711 }
0712 
0713 static vm_fault_t vc4_fault(struct vm_fault *vmf)
0714 {
0715     struct vm_area_struct *vma = vmf->vma;
0716     struct drm_gem_object *obj = vma->vm_private_data;
0717     struct vc4_bo *bo = to_vc4_bo(obj);
0718 
0719     /* The only reason we would end up here is when user-space accesses
0720      * BO's memory after it's been purged.
0721      */
0722     mutex_lock(&bo->madv_lock);
0723     WARN_ON(bo->madv != __VC4_MADV_PURGED);
0724     mutex_unlock(&bo->madv_lock);
0725 
0726     return VM_FAULT_SIGBUS;
0727 }
0728 
0729 static int vc4_gem_object_mmap(struct drm_gem_object *obj, struct vm_area_struct *vma)
0730 {
0731     struct vc4_bo *bo = to_vc4_bo(obj);
0732 
0733     if (bo->validated_shader && (vma->vm_flags & VM_WRITE)) {
0734         DRM_DEBUG("mmaping of shader BOs for writing not allowed.\n");
0735         return -EINVAL;
0736     }
0737 
0738     if (bo->madv != VC4_MADV_WILLNEED) {
0739         DRM_DEBUG("mmaping of %s BO not allowed\n",
0740               bo->madv == VC4_MADV_DONTNEED ?
0741               "purgeable" : "purged");
0742         return -EINVAL;
0743     }
0744 
0745     return drm_gem_cma_mmap(&bo->base, vma);
0746 }
0747 
0748 static const struct vm_operations_struct vc4_vm_ops = {
0749     .fault = vc4_fault,
0750     .open = drm_gem_vm_open,
0751     .close = drm_gem_vm_close,
0752 };
0753 
0754 static const struct drm_gem_object_funcs vc4_gem_object_funcs = {
0755     .free = vc4_free_object,
0756     .export = vc4_prime_export,
0757     .get_sg_table = drm_gem_cma_object_get_sg_table,
0758     .vmap = drm_gem_cma_object_vmap,
0759     .mmap = vc4_gem_object_mmap,
0760     .vm_ops = &vc4_vm_ops,
0761 };
0762 
0763 static int vc4_grab_bin_bo(struct vc4_dev *vc4, struct vc4_file *vc4file)
0764 {
0765     if (!vc4->v3d)
0766         return -ENODEV;
0767 
0768     if (vc4file->bin_bo_used)
0769         return 0;
0770 
0771     return vc4_v3d_bin_bo_get(vc4, &vc4file->bin_bo_used);
0772 }
0773 
0774 int vc4_create_bo_ioctl(struct drm_device *dev, void *data,
0775             struct drm_file *file_priv)
0776 {
0777     struct drm_vc4_create_bo *args = data;
0778     struct vc4_file *vc4file = file_priv->driver_priv;
0779     struct vc4_dev *vc4 = to_vc4_dev(dev);
0780     struct vc4_bo *bo = NULL;
0781     int ret;
0782 
0783     if (WARN_ON_ONCE(vc4->is_vc5))
0784         return -ENODEV;
0785 
0786     ret = vc4_grab_bin_bo(vc4, vc4file);
0787     if (ret)
0788         return ret;
0789 
0790     /*
0791      * We can't allocate from the BO cache, because the BOs don't
0792      * get zeroed, and that might leak data between users.
0793      */
0794     bo = vc4_bo_create(dev, args->size, false, VC4_BO_TYPE_V3D);
0795     if (IS_ERR(bo))
0796         return PTR_ERR(bo);
0797 
0798     bo->madv = VC4_MADV_WILLNEED;
0799 
0800     ret = drm_gem_handle_create(file_priv, &bo->base.base, &args->handle);
0801     drm_gem_object_put(&bo->base.base);
0802 
0803     return ret;
0804 }
0805 
0806 int vc4_mmap_bo_ioctl(struct drm_device *dev, void *data,
0807               struct drm_file *file_priv)
0808 {
0809     struct vc4_dev *vc4 = to_vc4_dev(dev);
0810     struct drm_vc4_mmap_bo *args = data;
0811     struct drm_gem_object *gem_obj;
0812 
0813     if (WARN_ON_ONCE(vc4->is_vc5))
0814         return -ENODEV;
0815 
0816     gem_obj = drm_gem_object_lookup(file_priv, args->handle);
0817     if (!gem_obj) {
0818         DRM_DEBUG("Failed to look up GEM BO %d\n", args->handle);
0819         return -EINVAL;
0820     }
0821 
0822     /* The mmap offset was set up at BO allocation time. */
0823     args->offset = drm_vma_node_offset_addr(&gem_obj->vma_node);
0824 
0825     drm_gem_object_put(gem_obj);
0826     return 0;
0827 }
0828 
0829 int
0830 vc4_create_shader_bo_ioctl(struct drm_device *dev, void *data,
0831                struct drm_file *file_priv)
0832 {
0833     struct drm_vc4_create_shader_bo *args = data;
0834     struct vc4_file *vc4file = file_priv->driver_priv;
0835     struct vc4_dev *vc4 = to_vc4_dev(dev);
0836     struct vc4_bo *bo = NULL;
0837     int ret;
0838 
0839     if (WARN_ON_ONCE(vc4->is_vc5))
0840         return -ENODEV;
0841 
0842     if (args->size == 0)
0843         return -EINVAL;
0844 
0845     if (args->size % sizeof(u64) != 0)
0846         return -EINVAL;
0847 
0848     if (args->flags != 0) {
0849         DRM_INFO("Unknown flags set: 0x%08x\n", args->flags);
0850         return -EINVAL;
0851     }
0852 
0853     if (args->pad != 0) {
0854         DRM_INFO("Pad set: 0x%08x\n", args->pad);
0855         return -EINVAL;
0856     }
0857 
0858     ret = vc4_grab_bin_bo(vc4, vc4file);
0859     if (ret)
0860         return ret;
0861 
0862     bo = vc4_bo_create(dev, args->size, true, VC4_BO_TYPE_V3D_SHADER);
0863     if (IS_ERR(bo))
0864         return PTR_ERR(bo);
0865 
0866     bo->madv = VC4_MADV_WILLNEED;
0867 
0868     if (copy_from_user(bo->base.vaddr,
0869                  (void __user *)(uintptr_t)args->data,
0870                  args->size)) {
0871         ret = -EFAULT;
0872         goto fail;
0873     }
0874     /* Clear the rest of the memory from allocating from the BO
0875      * cache.
0876      */
0877     memset(bo->base.vaddr + args->size, 0,
0878            bo->base.base.size - args->size);
0879 
0880     bo->validated_shader = vc4_validate_shader(&bo->base);
0881     if (!bo->validated_shader) {
0882         ret = -EINVAL;
0883         goto fail;
0884     }
0885 
0886     /* We have to create the handle after validation, to avoid
0887      * races for users to do doing things like mmap the shader BO.
0888      */
0889     ret = drm_gem_handle_create(file_priv, &bo->base.base, &args->handle);
0890 
0891 fail:
0892     drm_gem_object_put(&bo->base.base);
0893 
0894     return ret;
0895 }
0896 
0897 /**
0898  * vc4_set_tiling_ioctl() - Sets the tiling modifier for a BO.
0899  * @dev: DRM device
0900  * @data: ioctl argument
0901  * @file_priv: DRM file for this fd
0902  *
0903  * The tiling state of the BO decides the default modifier of an fb if
0904  * no specific modifier was set by userspace, and the return value of
0905  * vc4_get_tiling_ioctl() (so that userspace can treat a BO it
0906  * received from dmabuf as the same tiling format as the producer
0907  * used).
0908  */
0909 int vc4_set_tiling_ioctl(struct drm_device *dev, void *data,
0910              struct drm_file *file_priv)
0911 {
0912     struct vc4_dev *vc4 = to_vc4_dev(dev);
0913     struct drm_vc4_set_tiling *args = data;
0914     struct drm_gem_object *gem_obj;
0915     struct vc4_bo *bo;
0916     bool t_format;
0917 
0918     if (WARN_ON_ONCE(vc4->is_vc5))
0919         return -ENODEV;
0920 
0921     if (args->flags != 0)
0922         return -EINVAL;
0923 
0924     switch (args->modifier) {
0925     case DRM_FORMAT_MOD_NONE:
0926         t_format = false;
0927         break;
0928     case DRM_FORMAT_MOD_BROADCOM_VC4_T_TILED:
0929         t_format = true;
0930         break;
0931     default:
0932         return -EINVAL;
0933     }
0934 
0935     gem_obj = drm_gem_object_lookup(file_priv, args->handle);
0936     if (!gem_obj) {
0937         DRM_DEBUG("Failed to look up GEM BO %d\n", args->handle);
0938         return -ENOENT;
0939     }
0940     bo = to_vc4_bo(gem_obj);
0941     bo->t_format = t_format;
0942 
0943     drm_gem_object_put(gem_obj);
0944 
0945     return 0;
0946 }
0947 
0948 /**
0949  * vc4_get_tiling_ioctl() - Gets the tiling modifier for a BO.
0950  * @dev: DRM device
0951  * @data: ioctl argument
0952  * @file_priv: DRM file for this fd
0953  *
0954  * Returns the tiling modifier for a BO as set by vc4_set_tiling_ioctl().
0955  */
0956 int vc4_get_tiling_ioctl(struct drm_device *dev, void *data,
0957              struct drm_file *file_priv)
0958 {
0959     struct vc4_dev *vc4 = to_vc4_dev(dev);
0960     struct drm_vc4_get_tiling *args = data;
0961     struct drm_gem_object *gem_obj;
0962     struct vc4_bo *bo;
0963 
0964     if (WARN_ON_ONCE(vc4->is_vc5))
0965         return -ENODEV;
0966 
0967     if (args->flags != 0 || args->modifier != 0)
0968         return -EINVAL;
0969 
0970     gem_obj = drm_gem_object_lookup(file_priv, args->handle);
0971     if (!gem_obj) {
0972         DRM_DEBUG("Failed to look up GEM BO %d\n", args->handle);
0973         return -ENOENT;
0974     }
0975     bo = to_vc4_bo(gem_obj);
0976 
0977     if (bo->t_format)
0978         args->modifier = DRM_FORMAT_MOD_BROADCOM_VC4_T_TILED;
0979     else
0980         args->modifier = DRM_FORMAT_MOD_NONE;
0981 
0982     drm_gem_object_put(gem_obj);
0983 
0984     return 0;
0985 }
0986 
0987 static void vc4_bo_cache_destroy(struct drm_device *dev, void *unused);
0988 int vc4_bo_cache_init(struct drm_device *dev)
0989 {
0990     struct vc4_dev *vc4 = to_vc4_dev(dev);
0991     int i;
0992 
0993     if (WARN_ON_ONCE(vc4->is_vc5))
0994         return -ENODEV;
0995 
0996     /* Create the initial set of BO labels that the kernel will
0997      * use.  This lets us avoid a bunch of string reallocation in
0998      * the kernel's draw and BO allocation paths.
0999      */
1000     vc4->bo_labels = kcalloc(VC4_BO_TYPE_COUNT, sizeof(*vc4->bo_labels),
1001                  GFP_KERNEL);
1002     if (!vc4->bo_labels)
1003         return -ENOMEM;
1004     vc4->num_labels = VC4_BO_TYPE_COUNT;
1005 
1006     BUILD_BUG_ON(ARRAY_SIZE(bo_type_names) != VC4_BO_TYPE_COUNT);
1007     for (i = 0; i < VC4_BO_TYPE_COUNT; i++)
1008         vc4->bo_labels[i].name = bo_type_names[i];
1009 
1010     mutex_init(&vc4->bo_lock);
1011 
1012     vc4_debugfs_add_file(dev, "bo_stats", vc4_bo_stats_debugfs, NULL);
1013 
1014     INIT_LIST_HEAD(&vc4->bo_cache.time_list);
1015 
1016     INIT_WORK(&vc4->bo_cache.time_work, vc4_bo_cache_time_work);
1017     timer_setup(&vc4->bo_cache.time_timer, vc4_bo_cache_time_timer, 0);
1018 
1019     return drmm_add_action_or_reset(dev, vc4_bo_cache_destroy, NULL);
1020 }
1021 
1022 static void vc4_bo_cache_destroy(struct drm_device *dev, void *unused)
1023 {
1024     struct vc4_dev *vc4 = to_vc4_dev(dev);
1025     int i;
1026 
1027     del_timer(&vc4->bo_cache.time_timer);
1028     cancel_work_sync(&vc4->bo_cache.time_work);
1029 
1030     vc4_bo_cache_purge(dev);
1031 
1032     for (i = 0; i < vc4->num_labels; i++) {
1033         if (vc4->bo_labels[i].num_allocated) {
1034             DRM_ERROR("Destroying BO cache with %d %s "
1035                   "BOs still allocated\n",
1036                   vc4->bo_labels[i].num_allocated,
1037                   vc4->bo_labels[i].name);
1038         }
1039 
1040         if (is_user_label(i))
1041             kfree(vc4->bo_labels[i].name);
1042     }
1043     kfree(vc4->bo_labels);
1044 }
1045 
1046 int vc4_label_bo_ioctl(struct drm_device *dev, void *data,
1047                struct drm_file *file_priv)
1048 {
1049     struct vc4_dev *vc4 = to_vc4_dev(dev);
1050     struct drm_vc4_label_bo *args = data;
1051     char *name;
1052     struct drm_gem_object *gem_obj;
1053     int ret = 0, label;
1054 
1055     if (WARN_ON_ONCE(vc4->is_vc5))
1056         return -ENODEV;
1057 
1058     if (!args->len)
1059         return -EINVAL;
1060 
1061     name = strndup_user(u64_to_user_ptr(args->name), args->len + 1);
1062     if (IS_ERR(name))
1063         return PTR_ERR(name);
1064 
1065     gem_obj = drm_gem_object_lookup(file_priv, args->handle);
1066     if (!gem_obj) {
1067         DRM_ERROR("Failed to look up GEM BO %d\n", args->handle);
1068         kfree(name);
1069         return -ENOENT;
1070     }
1071 
1072     mutex_lock(&vc4->bo_lock);
1073     label = vc4_get_user_label(vc4, name);
1074     if (label != -1)
1075         vc4_bo_set_label(gem_obj, label);
1076     else
1077         ret = -ENOMEM;
1078     mutex_unlock(&vc4->bo_lock);
1079 
1080     drm_gem_object_put(gem_obj);
1081 
1082     return ret;
1083 }