vc4_bo.c

   1// SPDX-License-Identifier: GPL-2.0-only
   2/*
   3 *  Copyright © 2015 Broadcom
   4 */
   5
   6/**
   7 * DOC: VC4 GEM BO management support
   8 *
   9 * The VC4 GPU architecture (both scanout and rendering) has direct
  10 * access to system memory with no MMU in between.  To support it, we
  11 * use the GEM DMA helper functions to allocate contiguous ranges of
  12 * physical memory for our BOs.
  13 *
  14 * Since the DMA allocator is very slow, we keep a cache of recently
  15 * freed BOs around so that the kernel's allocation of objects for 3D
  16 * rendering can return quickly.
  17 */
  18
  19#include <linux/dma-buf.h>
  20
  21#include <drm/drm_fourcc.h>
  22#include <drm/drm_print.h>
  23
  24#include "vc4_drv.h"
  25#include "uapi/drm/vc4_drm.h"
  26
  27static const struct drm_gem_object_funcs vc4_gem_object_funcs;
  28
  29static const char * const bo_type_names[] = {
  30	"kernel",
  31	"V3D",
  32	"V3D shader",
  33	"dumb",
  34	"binner",
  35	"RCL",
  36	"BCL",
  37	"kernel BO cache",
  38};
  39
  40static bool is_user_label(int label)
  41{
  42	return label >= VC4_BO_TYPE_COUNT;
  43}
  44
  45static void vc4_bo_stats_print(struct drm_printer *p, struct vc4_dev *vc4)
  46{
  47	int i;
  48
  49	for (i = 0; i < vc4->num_labels; i++) {
  50		if (!vc4->bo_labels[i].num_allocated)
  51			continue;
  52
  53		drm_printf(p, "%30s: %6dkb BOs (%d)\n",
  54			   vc4->bo_labels[i].name,
  55			   vc4->bo_labels[i].size_allocated / 1024,
  56			   vc4->bo_labels[i].num_allocated);
  57	}
  58
  59	mutex_lock(&vc4->purgeable.lock);
  60	if (vc4->purgeable.num)
  61		drm_printf(p, "%30s: %6zdkb BOs (%d)\n", "userspace BO cache",
  62			   vc4->purgeable.size / 1024, vc4->purgeable.num);
  63
  64	if (vc4->purgeable.purged_num)
  65		drm_printf(p, "%30s: %6zdkb BOs (%d)\n", "total purged BO",
  66			   vc4->purgeable.purged_size / 1024,
  67			   vc4->purgeable.purged_num);
  68	mutex_unlock(&vc4->purgeable.lock);
  69}
  70
  71static int vc4_bo_stats_debugfs(struct seq_file *m, void *unused)
  72{
  73	struct drm_debugfs_entry *entry = m->private;
  74	struct drm_device *dev = entry->dev;
  75	struct vc4_dev *vc4 = to_vc4_dev(dev);
  76	struct drm_printer p = drm_seq_file_printer(m);
  77
  78	vc4_bo_stats_print(&p, vc4);
  79
  80	return 0;
  81}
  82
  83/* Takes ownership of *name and returns the appropriate slot for it in
  84 * the bo_labels[] array, extending it as necessary.
  85 *
  86 * This is inefficient and could use a hash table instead of walking
  87 * an array and strcmp()ing.  However, the assumption is that user
  88 * labeling will be infrequent (scanout buffers and other long-lived
  89 * objects, or debug driver builds), so we can live with it for now.
  90 */
  91static int vc4_get_user_label(struct vc4_dev *vc4, const char *name)
  92{
  93	int i;
  94	int free_slot = -1;
  95
  96	for (i = 0; i < vc4->num_labels; i++) {
  97		if (!vc4->bo_labels[i].name) {
  98			free_slot = i;
  99		} else if (strcmp(vc4->bo_labels[i].name, name) == 0) {
 100			kfree(name);
 101			return i;
 102		}
 103	}
 104
 105	if (free_slot != -1) {
 106		WARN_ON(vc4->bo_labels[free_slot].num_allocated != 0);
 107		vc4->bo_labels[free_slot].name = name;
 108		return free_slot;
 109	} else {
 110		u32 new_label_count = vc4->num_labels + 1;
 111		struct vc4_label *new_labels =
 112			krealloc(vc4->bo_labels,
 113				 new_label_count * sizeof(*new_labels),
 114				 GFP_KERNEL);
 115
 116		if (!new_labels) {
 117			kfree(name);
 118			return -1;
 119		}
 120
 121		free_slot = vc4->num_labels;
 122		vc4->bo_labels = new_labels;
 123		vc4->num_labels = new_label_count;
 124
 125		vc4->bo_labels[free_slot].name = name;
 126		vc4->bo_labels[free_slot].num_allocated = 0;
 127		vc4->bo_labels[free_slot].size_allocated = 0;
 128
 129		return free_slot;
 130	}
 131}
 132
 133static void vc4_bo_set_label(struct drm_gem_object *gem_obj, int label)
 134{
 135	struct vc4_bo *bo = to_vc4_bo(gem_obj);
 136	struct vc4_dev *vc4 = to_vc4_dev(gem_obj->dev);
 137
 138	lockdep_assert_held(&vc4->bo_lock);
 139
 140	if (label != -1) {
 141		vc4->bo_labels[label].num_allocated++;
 142		vc4->bo_labels[label].size_allocated += gem_obj->size;
 143	}
 144
 145	vc4->bo_labels[bo->label].num_allocated--;
 146	vc4->bo_labels[bo->label].size_allocated -= gem_obj->size;
 147
 148	if (vc4->bo_labels[bo->label].num_allocated == 0 &&
 149	    is_user_label(bo->label)) {
 150		/* Free user BO label slots on last unreference.
 151		 * Slots are just where we track the stats for a given
 152		 * name, and once a name is unused we can reuse that
 153		 * slot.
 154		 */
 155		kfree(vc4->bo_labels[bo->label].name);
 156		vc4->bo_labels[bo->label].name = NULL;
 157	}
 158
 159	bo->label = label;
 160}
 161
 162static uint32_t bo_page_index(size_t size)
 163{
 164	return (size / PAGE_SIZE) - 1;
 165}
 166
 167static void vc4_bo_destroy(struct vc4_bo *bo)
 168{
 169	struct drm_gem_object *obj = &bo->base.base;
 170	struct vc4_dev *vc4 = to_vc4_dev(obj->dev);
 171
 172	lockdep_assert_held(&vc4->bo_lock);
 173
 174	vc4_bo_set_label(obj, -1);
 175
 176	if (bo->validated_shader) {
 177		kfree(bo->validated_shader->uniform_addr_offsets);
 178		kfree(bo->validated_shader->texture_samples);
 179		kfree(bo->validated_shader);
 180		bo->validated_shader = NULL;
 181	}
 182
 183	mutex_destroy(&bo->madv_lock);
 184	drm_gem_dma_free(&bo->base);
 185}
 186
 187static void vc4_bo_remove_from_cache(struct vc4_bo *bo)
 188{
 189	struct vc4_dev *vc4 = to_vc4_dev(bo->base.base.dev);
 190
 191	lockdep_assert_held(&vc4->bo_lock);
 192	list_del(&bo->unref_head);
 193	list_del(&bo->size_head);
 194}
 195
 196static struct list_head *vc4_get_cache_list_for_size(struct drm_device *dev,
 197						     size_t size)
 198{
 199	struct vc4_dev *vc4 = to_vc4_dev(dev);
 200	uint32_t page_index = bo_page_index(size);
 201
 202	if (vc4->bo_cache.size_list_size <= page_index) {
 203		uint32_t new_size = max(vc4->bo_cache.size_list_size * 2,
 204					page_index + 1);
 205		struct list_head *new_list;
 206		uint32_t i;
 207
 208		new_list = kmalloc_array(new_size, sizeof(struct list_head),
 209					 GFP_KERNEL);
 210		if (!new_list)
 211			return NULL;
 212
 213		/* Rebase the old cached BO lists to their new list
 214		 * head locations.
 215		 */
 216		for (i = 0; i < vc4->bo_cache.size_list_size; i++) {
 217			struct list_head *old_list =
 218				&vc4->bo_cache.size_list[i];
 219
 220			if (list_empty(old_list))
 221				INIT_LIST_HEAD(&new_list[i]);
 222			else
 223				list_replace(old_list, &new_list[i]);
 224		}
 225		/* And initialize the brand new BO list heads. */
 226		for (i = vc4->bo_cache.size_list_size; i < new_size; i++)
 227			INIT_LIST_HEAD(&new_list[i]);
 228
 229		kfree(vc4->bo_cache.size_list);
 230		vc4->bo_cache.size_list = new_list;
 231		vc4->bo_cache.size_list_size = new_size;
 232	}
 233
 234	return &vc4->bo_cache.size_list[page_index];
 235}
 236
 237static void vc4_bo_cache_purge(struct drm_device *dev)
 238{
 239	struct vc4_dev *vc4 = to_vc4_dev(dev);
 240
 241	mutex_lock(&vc4->bo_lock);
 242	while (!list_empty(&vc4->bo_cache.time_list)) {
 243		struct vc4_bo *bo = list_last_entry(&vc4->bo_cache.time_list,
 244						    struct vc4_bo, unref_head);
 245		vc4_bo_remove_from_cache(bo);
 246		vc4_bo_destroy(bo);
 247	}
 248	mutex_unlock(&vc4->bo_lock);
 249}
 250
 251void vc4_bo_add_to_purgeable_pool(struct vc4_bo *bo)
 252{
 253	struct vc4_dev *vc4 = to_vc4_dev(bo->base.base.dev);
 254
 255	if (WARN_ON_ONCE(vc4->gen > VC4_GEN_4))
 256		return;
 257
 258	mutex_lock(&vc4->purgeable.lock);
 259	list_add_tail(&bo->size_head, &vc4->purgeable.list);
 260	vc4->purgeable.num++;
 261	vc4->purgeable.size += bo->base.base.size;
 262	mutex_unlock(&vc4->purgeable.lock);
 263}
 264
 265static void vc4_bo_remove_from_purgeable_pool_locked(struct vc4_bo *bo)
 266{
 267	struct vc4_dev *vc4 = to_vc4_dev(bo->base.base.dev);
 268
 269	if (WARN_ON_ONCE(vc4->gen > VC4_GEN_4))
 270		return;
 271
 272	/* list_del_init() is used here because the caller might release
 273	 * the purgeable lock in order to acquire the madv one and update the
 274	 * madv status.
 275	 * During this short period of time a user might decide to mark
 276	 * the BO as unpurgeable, and if bo->madv is set to
 277	 * VC4_MADV_DONTNEED it will try to remove the BO from the
 278	 * purgeable list which will fail if the ->next/prev fields
 279	 * are set to LIST_POISON1/LIST_POISON2 (which is what
 280	 * list_del() does).
 281	 * Re-initializing the list element guarantees that list_del()
 282	 * will work correctly even if it's a NOP.
 283	 */
 284	list_del_init(&bo->size_head);
 285	vc4->purgeable.num--;
 286	vc4->purgeable.size -= bo->base.base.size;
 287}
 288
 289void vc4_bo_remove_from_purgeable_pool(struct vc4_bo *bo)
 290{
 291	struct vc4_dev *vc4 = to_vc4_dev(bo->base.base.dev);
 292
 293	mutex_lock(&vc4->purgeable.lock);
 294	vc4_bo_remove_from_purgeable_pool_locked(bo);
 295	mutex_unlock(&vc4->purgeable.lock);
 296}
 297
 298static void vc4_bo_purge(struct drm_gem_object *obj)
 299{
 300	struct vc4_bo *bo = to_vc4_bo(obj);
 301	struct drm_device *dev = obj->dev;
 302
 303	WARN_ON(!mutex_is_locked(&bo->madv_lock));
 304	WARN_ON(bo->madv != VC4_MADV_DONTNEED);
 305
 306	drm_vma_node_unmap(&obj->vma_node, dev->anon_inode->i_mapping);
 307
 308	dma_free_wc(dev->dev, obj->size, bo->base.vaddr, bo->base.dma_addr);
 309	bo->base.vaddr = NULL;
 310	bo->madv = __VC4_MADV_PURGED;
 311}
 312
 313static void vc4_bo_userspace_cache_purge(struct drm_device *dev)
 314{
 315	struct vc4_dev *vc4 = to_vc4_dev(dev);
 316
 317	mutex_lock(&vc4->purgeable.lock);
 318	while (!list_empty(&vc4->purgeable.list)) {
 319		struct vc4_bo *bo = list_first_entry(&vc4->purgeable.list,
 320						     struct vc4_bo, size_head);
 321		struct drm_gem_object *obj = &bo->base.base;
 322		size_t purged_size = 0;
 323
 324		vc4_bo_remove_from_purgeable_pool_locked(bo);
 325
 326		/* Release the purgeable lock while we're purging the BO so
 327		 * that other people can continue inserting things in the
 328		 * purgeable pool without having to wait for all BOs to be
 329		 * purged.
 330		 */
 331		mutex_unlock(&vc4->purgeable.lock);
 332		mutex_lock(&bo->madv_lock);
 333
 334		/* Since we released the purgeable pool lock before acquiring
 335		 * the BO madv one, the user may have marked the BO as WILLNEED
 336		 * and re-used it in the meantime.
 337		 * Before purging the BO we need to make sure
 338		 * - it is still marked as DONTNEED
 339		 * - it has not been re-inserted in the purgeable list
 340		 * - it is not used by HW blocks
 341		 * If one of these conditions is not met, just skip the entry.
 342		 */
 343		if (bo->madv == VC4_MADV_DONTNEED &&
 344		    list_empty(&bo->size_head) &&
 345		    !refcount_read(&bo->usecnt)) {
 346			purged_size = bo->base.base.size;
 347			vc4_bo_purge(obj);
 348		}
 349		mutex_unlock(&bo->madv_lock);
 350		mutex_lock(&vc4->purgeable.lock);
 351
 352		if (purged_size) {
 353			vc4->purgeable.purged_size += purged_size;
 354			vc4->purgeable.purged_num++;
 355		}
 356	}
 357	mutex_unlock(&vc4->purgeable.lock);
 358}
 359
 360static struct vc4_bo *vc4_bo_get_from_cache(struct drm_device *dev,
 361					    uint32_t size,
 362					    enum vc4_kernel_bo_type type)
 363{
 364	struct vc4_dev *vc4 = to_vc4_dev(dev);
 365	uint32_t page_index = bo_page_index(size);
 366	struct vc4_bo *bo = NULL;
 367
 368	mutex_lock(&vc4->bo_lock);
 369	if (page_index >= vc4->bo_cache.size_list_size)
 370		goto out;
 371
 372	if (list_empty(&vc4->bo_cache.size_list[page_index]))
 373		goto out;
 374
 375	bo = list_first_entry(&vc4->bo_cache.size_list[page_index],
 376			      struct vc4_bo, size_head);
 377	vc4_bo_remove_from_cache(bo);
 378	kref_init(&bo->base.base.refcount);
 379
 380out:
 381	if (bo)
 382		vc4_bo_set_label(&bo->base.base, type);
 383	mutex_unlock(&vc4->bo_lock);
 384	return bo;
 385}
 386
 387/**
 388 * vc4_create_object - Implementation of driver->gem_create_object.
 389 * @dev: DRM device
 390 * @size: Size in bytes of the memory the object will reference
 391 *
 392 * This lets the DMA helpers allocate object structs for us, and keep
 393 * our BO stats correct.
 394 */
 395struct drm_gem_object *vc4_create_object(struct drm_device *dev, size_t size)
 396{
 397	struct vc4_dev *vc4 = to_vc4_dev(dev);
 398	struct vc4_bo *bo;
 399
 400	if (WARN_ON_ONCE(vc4->gen > VC4_GEN_4))
 401		return ERR_PTR(-ENODEV);
 402
 403	bo = kzalloc(sizeof(*bo), GFP_KERNEL);
 404	if (!bo)
 405		return ERR_PTR(-ENOMEM);
 406
 407	bo->madv = VC4_MADV_WILLNEED;
 408	refcount_set(&bo->usecnt, 0);
 409
 410	mutex_init(&bo->madv_lock);
 411
 412	mutex_lock(&vc4->bo_lock);
 413	bo->label = VC4_BO_TYPE_KERNEL;
 414	vc4->bo_labels[VC4_BO_TYPE_KERNEL].num_allocated++;
 415	vc4->bo_labels[VC4_BO_TYPE_KERNEL].size_allocated += size;
 416	mutex_unlock(&vc4->bo_lock);
 417
 418	bo->base.base.funcs = &vc4_gem_object_funcs;
 419
 420	return &bo->base.base;
 421}
 422
 423struct vc4_bo *vc4_bo_create(struct drm_device *dev, size_t unaligned_size,
 424			     bool allow_unzeroed, enum vc4_kernel_bo_type type)
 425{
 426	size_t size = roundup(unaligned_size, PAGE_SIZE);
 427	struct vc4_dev *vc4 = to_vc4_dev(dev);
 428	struct drm_gem_dma_object *dma_obj;
 429	struct vc4_bo *bo;
 430
 431	if (WARN_ON_ONCE(vc4->gen > VC4_GEN_4))
 432		return ERR_PTR(-ENODEV);
 433
 434	if (size == 0)
 435		return ERR_PTR(-EINVAL);
 436
 437	/* First, try to get a vc4_bo from the kernel BO cache. */
 438	bo = vc4_bo_get_from_cache(dev, size, type);
 439	if (bo) {
 440		if (!allow_unzeroed)
 441			memset(bo->base.vaddr, 0, bo->base.base.size);
 442		return bo;
 443	}
 444
 445	dma_obj = drm_gem_dma_create(dev, size);
 446	if (IS_ERR(dma_obj)) {
 447		/*
 448		 * If we've run out of DMA memory, kill the cache of
 449		 * DMA allocations we've got laying around and try again.
 450		 */
 451		vc4_bo_cache_purge(dev);
 452		dma_obj = drm_gem_dma_create(dev, size);
 453	}
 454
 455	if (IS_ERR(dma_obj)) {
 456		/*
 457		 * Still not enough DMA memory, purge the userspace BO
 458		 * cache and retry.
 459		 * This is sub-optimal since we purge the whole userspace
 460		 * BO cache which forces user that want to re-use the BO to
 461		 * restore its initial content.
 462		 * Ideally, we should purge entries one by one and retry
 463		 * after each to see if DMA allocation succeeds. Or even
 464		 * better, try to find an entry with at least the same
 465		 * size.
 466		 */
 467		vc4_bo_userspace_cache_purge(dev);
 468		dma_obj = drm_gem_dma_create(dev, size);
 469	}
 470
 471	if (IS_ERR(dma_obj)) {
 472		struct drm_printer p = drm_info_printer(vc4->base.dev);
 473		drm_err(dev, "Failed to allocate from GEM DMA helper:\n");
 474		vc4_bo_stats_print(&p, vc4);
 475		return ERR_PTR(-ENOMEM);
 476	}
 477	bo = to_vc4_bo(&dma_obj->base);
 478
 479	/* By default, BOs do not support the MADV ioctl. This will be enabled
 480	 * only on BOs that are exposed to userspace (V3D, V3D_SHADER and DUMB
 481	 * BOs).
 482	 */
 483	bo->madv = __VC4_MADV_NOTSUPP;
 484
 485	mutex_lock(&vc4->bo_lock);
 486	vc4_bo_set_label(&dma_obj->base, type);
 487	mutex_unlock(&vc4->bo_lock);
 488
 489	return bo;
 490}
 491
 492int vc4_bo_dumb_create(struct drm_file *file_priv,
 493		       struct drm_device *dev,
 494		       struct drm_mode_create_dumb *args)
 495{
 496	struct vc4_dev *vc4 = to_vc4_dev(dev);
 497	struct vc4_bo *bo = NULL;
 498	int ret;
 499
 500	if (WARN_ON_ONCE(vc4->gen > VC4_GEN_4))
 501		return -ENODEV;
 502
 503	ret = vc4_dumb_fixup_args(args);
 504	if (ret)
 505		return ret;
 506
 507	bo = vc4_bo_create(dev, args->size, false, VC4_BO_TYPE_DUMB);
 508	if (IS_ERR(bo))
 509		return PTR_ERR(bo);
 510
 511	bo->madv = VC4_MADV_WILLNEED;
 512
 513	ret = drm_gem_handle_create(file_priv, &bo->base.base, &args->handle);
 514	drm_gem_object_put(&bo->base.base);
 515
 516	return ret;
 517}
 518
 519static void vc4_bo_cache_free_old(struct drm_device *dev)
 520{
 521	struct vc4_dev *vc4 = to_vc4_dev(dev);
 522	unsigned long expire_time = jiffies - msecs_to_jiffies(1000);
 523
 524	lockdep_assert_held(&vc4->bo_lock);
 525
 526	while (!list_empty(&vc4->bo_cache.time_list)) {
 527		struct vc4_bo *bo = list_last_entry(&vc4->bo_cache.time_list,
 528						    struct vc4_bo, unref_head);
 529		if (time_before(expire_time, bo->free_time)) {
 530			mod_timer(&vc4->bo_cache.time_timer,
 531				  round_jiffies_up(jiffies +
 532						   msecs_to_jiffies(1000)));
 533			return;
 534		}
 535
 536		vc4_bo_remove_from_cache(bo);
 537		vc4_bo_destroy(bo);
 538	}
 539}
 540
 541/* Called on the last userspace/kernel unreference of the BO.  Returns
 542 * it to the BO cache if possible, otherwise frees it.
 543 */
 544static void vc4_free_object(struct drm_gem_object *gem_bo)
 545{
 546	struct drm_device *dev = gem_bo->dev;
 547	struct vc4_dev *vc4 = to_vc4_dev(dev);
 548	struct vc4_bo *bo = to_vc4_bo(gem_bo);
 549	struct list_head *cache_list;
 550
 551	/* Remove the BO from the purgeable list. */
 552	mutex_lock(&bo->madv_lock);
 553	if (bo->madv == VC4_MADV_DONTNEED && !refcount_read(&bo->usecnt))
 554		vc4_bo_remove_from_purgeable_pool(bo);
 555	mutex_unlock(&bo->madv_lock);
 556
 557	mutex_lock(&vc4->bo_lock);
 558	/* If the object references someone else's memory, we can't cache it.
 559	 */
 560	if (gem_bo->import_attach) {
 561		vc4_bo_destroy(bo);
 562		goto out;
 563	}
 564
 565	/* Don't cache if it was publicly named. */
 566	if (gem_bo->name) {
 567		vc4_bo_destroy(bo);
 568		goto out;
 569	}
 570
 571	/* If this object was partially constructed but DMA allocation
 572	 * had failed, just free it. Can also happen when the BO has been
 573	 * purged.
 574	 */
 575	if (!bo->base.vaddr) {
 576		vc4_bo_destroy(bo);
 577		goto out;
 578	}
 579
 580	cache_list = vc4_get_cache_list_for_size(dev, gem_bo->size);
 581	if (!cache_list) {
 582		vc4_bo_destroy(bo);
 583		goto out;
 584	}
 585
 586	if (bo->validated_shader) {
 587		kfree(bo->validated_shader->uniform_addr_offsets);
 588		kfree(bo->validated_shader->texture_samples);
 589		kfree(bo->validated_shader);
 590		bo->validated_shader = NULL;
 591	}
 592
 593	/* Reset madv and usecnt before adding the BO to the cache. */
 594	bo->madv = __VC4_MADV_NOTSUPP;
 595	refcount_set(&bo->usecnt, 0);
 596
 597	bo->t_format = false;
 598	bo->free_time = jiffies;
 599	list_add(&bo->size_head, cache_list);
 600	list_add(&bo->unref_head, &vc4->bo_cache.time_list);
 601
 602	vc4_bo_set_label(&bo->base.base, VC4_BO_TYPE_KERNEL_CACHE);
 603
 604	vc4_bo_cache_free_old(dev);
 605
 606out:
 607	mutex_unlock(&vc4->bo_lock);
 608}
 609
 610static void vc4_bo_cache_time_work(struct work_struct *work)
 611{
 612	struct vc4_dev *vc4 =
 613		container_of(work, struct vc4_dev, bo_cache.time_work);
 614	struct drm_device *dev = &vc4->base;
 615
 616	mutex_lock(&vc4->bo_lock);
 617	vc4_bo_cache_free_old(dev);
 618	mutex_unlock(&vc4->bo_lock);
 619}
 620
 621int vc4_bo_inc_usecnt(struct vc4_bo *bo)
 622{
 623	struct vc4_dev *vc4 = to_vc4_dev(bo->base.base.dev);
 624	int ret;
 625
 626	if (WARN_ON_ONCE(vc4->gen > VC4_GEN_4))
 627		return -ENODEV;
 628
 629	/* Fast path: if the BO is already retained by someone, no need to
 630	 * check the madv status.
 631	 */
 632	if (refcount_inc_not_zero(&bo->usecnt))
 633		return 0;
 634
 635	mutex_lock(&bo->madv_lock);
 636	switch (bo->madv) {
 637	case VC4_MADV_WILLNEED:
 638		if (!refcount_inc_not_zero(&bo->usecnt))
 639			refcount_set(&bo->usecnt, 1);
 640		ret = 0;
 641		break;
 642	case VC4_MADV_DONTNEED:
 643		/* We shouldn't use a BO marked as purgeable if at least
 644		 * someone else retained its content by incrementing usecnt.
 645		 * Luckily the BO hasn't been purged yet, but something wrong
 646		 * is happening here. Just throw an error instead of
 647		 * authorizing this use case.
 648		 */
 649	case __VC4_MADV_PURGED:
 650		/* We can't use a purged BO. */
 651	default:
 652		/* Invalid madv value. */
 653		ret = -EINVAL;
 654		break;
 655	}
 656	mutex_unlock(&bo->madv_lock);
 657
 658	return ret;
 659}
 660
 661void vc4_bo_dec_usecnt(struct vc4_bo *bo)
 662{
 663	struct vc4_dev *vc4 = to_vc4_dev(bo->base.base.dev);
 664
 665	if (WARN_ON_ONCE(vc4->gen > VC4_GEN_4))
 666		return;
 667
 668	/* Fast path: if the BO is still retained by someone, no need to test
 669	 * the madv value.
 670	 */
 671	if (refcount_dec_not_one(&bo->usecnt))
 672		return;
 673
 674	mutex_lock(&bo->madv_lock);
 675	if (refcount_dec_and_test(&bo->usecnt) &&
 676	    bo->madv == VC4_MADV_DONTNEED)
 677		vc4_bo_add_to_purgeable_pool(bo);
 678	mutex_unlock(&bo->madv_lock);
 679}
 680
 681static void vc4_bo_cache_time_timer(struct timer_list *t)
 682{
 683	struct vc4_dev *vc4 = timer_container_of(vc4, t, bo_cache.time_timer);
 684
 685	schedule_work(&vc4->bo_cache.time_work);
 686}
 687
 688static struct dma_buf *vc4_prime_export(struct drm_gem_object *obj, int flags)
 689{
 690	struct vc4_bo *bo = to_vc4_bo(obj);
 691	struct dma_buf *dmabuf;
 692	int ret;
 693
 694	if (bo->validated_shader) {
 695		DRM_DEBUG("Attempting to export shader BO\n");
 696		return ERR_PTR(-EINVAL);
 697	}
 698
 699	/* Note: as soon as the BO is exported it becomes unpurgeable, because
 700	 * noone ever decrements the usecnt even if the reference held by the
 701	 * exported BO is released. This shouldn't be a problem since we don't
 702	 * expect exported BOs to be marked as purgeable.
 703	 */
 704	ret = vc4_bo_inc_usecnt(bo);
 705	if (ret) {
 706		drm_err(obj->dev, "Failed to increment BO usecnt\n");
 707		return ERR_PTR(ret);
 708	}
 709
 710	dmabuf = drm_gem_prime_export(obj, flags);
 711	if (IS_ERR(dmabuf))
 712		vc4_bo_dec_usecnt(bo);
 713
 714	return dmabuf;
 715}
 716
 717static vm_fault_t vc4_fault(struct vm_fault *vmf)
 718{
 719	struct vm_area_struct *vma = vmf->vma;
 720	struct drm_gem_object *obj = vma->vm_private_data;
 721	struct vc4_bo *bo = to_vc4_bo(obj);
 722
 723	/* The only reason we would end up here is when user-space accesses
 724	 * BO's memory after it's been purged.
 725	 */
 726	mutex_lock(&bo->madv_lock);
 727	WARN_ON(bo->madv != __VC4_MADV_PURGED);
 728	mutex_unlock(&bo->madv_lock);
 729
 730	return VM_FAULT_SIGBUS;
 731}
 732
 733static int vc4_gem_object_mmap(struct drm_gem_object *obj, struct vm_area_struct *vma)
 734{
 735	struct vc4_bo *bo = to_vc4_bo(obj);
 736
 737	if (bo->validated_shader && (vma->vm_flags & VM_WRITE)) {
 738		DRM_DEBUG("mmapping of shader BOs for writing not allowed.\n");
 739		return -EINVAL;
 740	}
 741
 742	mutex_lock(&bo->madv_lock);
 743	if (bo->madv != VC4_MADV_WILLNEED) {
 744		DRM_DEBUG("mmapping of %s BO not allowed\n",
 745			  bo->madv == VC4_MADV_DONTNEED ?
 746			  "purgeable" : "purged");
 747		mutex_unlock(&bo->madv_lock);
 748		return -EINVAL;
 749	}
 750	mutex_unlock(&bo->madv_lock);
 751
 752	return drm_gem_dma_mmap(&bo->base, vma);
 753}
 754
 755static const struct vm_operations_struct vc4_vm_ops = {
 756	.fault = vc4_fault,
 757	.open = drm_gem_vm_open,
 758	.close = drm_gem_vm_close,
 759};
 760
 761static const struct drm_gem_object_funcs vc4_gem_object_funcs = {
 762	.free = vc4_free_object,
 763	.export = vc4_prime_export,
 764	.get_sg_table = drm_gem_dma_object_get_sg_table,
 765	.vmap = drm_gem_dma_object_vmap,
 766	.mmap = vc4_gem_object_mmap,
 767	.vm_ops = &vc4_vm_ops,
 768};
 769
 770static int vc4_grab_bin_bo(struct vc4_dev *vc4, struct vc4_file *vc4file)
 771{
 772	if (!vc4->v3d)
 773		return -ENODEV;
 774
 775	if (vc4file->bin_bo_used)
 776		return 0;
 777
 778	return vc4_v3d_bin_bo_get(vc4, &vc4file->bin_bo_used);
 779}
 780
 781int vc4_create_bo_ioctl(struct drm_device *dev, void *data,
 782			struct drm_file *file_priv)
 783{
 784	struct drm_vc4_create_bo *args = data;
 785	struct vc4_file *vc4file = file_priv->driver_priv;
 786	struct vc4_dev *vc4 = to_vc4_dev(dev);
 787	struct vc4_bo *bo = NULL;
 788	int ret;
 789
 790	if (WARN_ON_ONCE(vc4->gen > VC4_GEN_4))
 791		return -ENODEV;
 792
 793	ret = vc4_grab_bin_bo(vc4, vc4file);
 794	if (ret)
 795		return ret;
 796
 797	/*
 798	 * We can't allocate from the BO cache, because the BOs don't
 799	 * get zeroed, and that might leak data between users.
 800	 */
 801	bo = vc4_bo_create(dev, args->size, false, VC4_BO_TYPE_V3D);
 802	if (IS_ERR(bo))
 803		return PTR_ERR(bo);
 804
 805	bo->madv = VC4_MADV_WILLNEED;
 806
 807	ret = drm_gem_handle_create(file_priv, &bo->base.base, &args->handle);
 808	drm_gem_object_put(&bo->base.base);
 809
 810	return ret;
 811}
 812
 813int vc4_mmap_bo_ioctl(struct drm_device *dev, void *data,
 814		      struct drm_file *file_priv)
 815{
 816	struct vc4_dev *vc4 = to_vc4_dev(dev);
 817	struct drm_vc4_mmap_bo *args = data;
 818	struct drm_gem_object *gem_obj;
 819
 820	if (WARN_ON_ONCE(vc4->gen > VC4_GEN_4))
 821		return -ENODEV;
 822
 823	gem_obj = drm_gem_object_lookup(file_priv, args->handle);
 824	if (!gem_obj) {
 825		DRM_DEBUG("Failed to look up GEM BO %d\n", args->handle);
 826		return -EINVAL;
 827	}
 828
 829	/* The mmap offset was set up at BO allocation time. */
 830	args->offset = drm_vma_node_offset_addr(&gem_obj->vma_node);
 831
 832	drm_gem_object_put(gem_obj);
 833	return 0;
 834}
 835
 836int
 837vc4_create_shader_bo_ioctl(struct drm_device *dev, void *data,
 838			   struct drm_file *file_priv)
 839{
 840	struct drm_vc4_create_shader_bo *args = data;
 841	struct vc4_file *vc4file = file_priv->driver_priv;
 842	struct vc4_dev *vc4 = to_vc4_dev(dev);
 843	struct vc4_bo *bo = NULL;
 844	int ret;
 845
 846	if (WARN_ON_ONCE(vc4->gen > VC4_GEN_4))
 847		return -ENODEV;
 848
 849	if (args->size == 0)
 850		return -EINVAL;
 851
 852	if (args->size % sizeof(u64) != 0)
 853		return -EINVAL;
 854
 855	if (args->flags != 0) {
 856		DRM_INFO("Unknown flags set: 0x%08x\n", args->flags);
 857		return -EINVAL;
 858	}
 859
 860	if (args->pad != 0) {
 861		DRM_INFO("Pad set: 0x%08x\n", args->pad);
 862		return -EINVAL;
 863	}
 864
 865	ret = vc4_grab_bin_bo(vc4, vc4file);
 866	if (ret)
 867		return ret;
 868
 869	bo = vc4_bo_create(dev, args->size, true, VC4_BO_TYPE_V3D_SHADER);
 870	if (IS_ERR(bo))
 871		return PTR_ERR(bo);
 872
 873	bo->madv = VC4_MADV_WILLNEED;
 874
 875	if (copy_from_user(bo->base.vaddr,
 876			     (void __user *)(uintptr_t)args->data,
 877			     args->size)) {
 878		ret = -EFAULT;
 879		goto fail;
 880	}
 881	/* Clear the rest of the memory from allocating from the BO
 882	 * cache.
 883	 */
 884	memset(bo->base.vaddr + args->size, 0,
 885	       bo->base.base.size - args->size);
 886
 887	bo->validated_shader = vc4_validate_shader(&bo->base);
 888	if (!bo->validated_shader) {
 889		ret = -EINVAL;
 890		goto fail;
 891	}
 892
 893	/* We have to create the handle after validation, to avoid
 894	 * races for users to do doing things like mmap the shader BO.
 895	 */
 896	ret = drm_gem_handle_create(file_priv, &bo->base.base, &args->handle);
 897
 898fail:
 899	drm_gem_object_put(&bo->base.base);
 900
 901	return ret;
 902}
 903
 904/**
 905 * vc4_set_tiling_ioctl() - Sets the tiling modifier for a BO.
 906 * @dev: DRM device
 907 * @data: ioctl argument
 908 * @file_priv: DRM file for this fd
 909 *
 910 * The tiling state of the BO decides the default modifier of an fb if
 911 * no specific modifier was set by userspace, and the return value of
 912 * vc4_get_tiling_ioctl() (so that userspace can treat a BO it
 913 * received from dmabuf as the same tiling format as the producer
 914 * used).
 915 */
 916int vc4_set_tiling_ioctl(struct drm_device *dev, void *data,
 917			 struct drm_file *file_priv)
 918{
 919	struct vc4_dev *vc4 = to_vc4_dev(dev);
 920	struct drm_vc4_set_tiling *args = data;
 921	struct drm_gem_object *gem_obj;
 922	struct vc4_bo *bo;
 923	bool t_format;
 924
 925	if (WARN_ON_ONCE(vc4->gen > VC4_GEN_4))
 926		return -ENODEV;
 927
 928	if (args->flags != 0)
 929		return -EINVAL;
 930
 931	switch (args->modifier) {
 932	case DRM_FORMAT_MOD_NONE:
 933		t_format = false;
 934		break;
 935	case DRM_FORMAT_MOD_BROADCOM_VC4_T_TILED:
 936		t_format = true;
 937		break;
 938	default:
 939		return -EINVAL;
 940	}
 941
 942	gem_obj = drm_gem_object_lookup(file_priv, args->handle);
 943	if (!gem_obj) {
 944		DRM_DEBUG("Failed to look up GEM BO %d\n", args->handle);
 945		return -ENOENT;
 946	}
 947	bo = to_vc4_bo(gem_obj);
 948	bo->t_format = t_format;
 949
 950	drm_gem_object_put(gem_obj);
 951
 952	return 0;
 953}
 954
 955/**
 956 * vc4_get_tiling_ioctl() - Gets the tiling modifier for a BO.
 957 * @dev: DRM device
 958 * @data: ioctl argument
 959 * @file_priv: DRM file for this fd
 960 *
 961 * Returns the tiling modifier for a BO as set by vc4_set_tiling_ioctl().
 962 */
 963int vc4_get_tiling_ioctl(struct drm_device *dev, void *data,
 964			 struct drm_file *file_priv)
 965{
 966	struct vc4_dev *vc4 = to_vc4_dev(dev);
 967	struct drm_vc4_get_tiling *args = data;
 968	struct drm_gem_object *gem_obj;
 969	struct vc4_bo *bo;
 970
 971	if (WARN_ON_ONCE(vc4->gen > VC4_GEN_4))
 972		return -ENODEV;
 973
 974	if (args->flags != 0 || args->modifier != 0)
 975		return -EINVAL;
 976
 977	gem_obj = drm_gem_object_lookup(file_priv, args->handle);
 978	if (!gem_obj) {
 979		DRM_DEBUG("Failed to look up GEM BO %d\n", args->handle);
 980		return -ENOENT;
 981	}
 982	bo = to_vc4_bo(gem_obj);
 983
 984	if (bo->t_format)
 985		args->modifier = DRM_FORMAT_MOD_BROADCOM_VC4_T_TILED;
 986	else
 987		args->modifier = DRM_FORMAT_MOD_NONE;
 988
 989	drm_gem_object_put(gem_obj);
 990
 991	return 0;
 992}
 993
 994int vc4_bo_debugfs_init(struct drm_minor *minor)
 995{
 996	struct drm_device *drm = minor->dev;
 997	struct vc4_dev *vc4 = to_vc4_dev(drm);
 998
 999	if (!vc4->v3d)
1000		return -ENODEV;
1001
1002	drm_debugfs_add_file(drm, "bo_stats", vc4_bo_stats_debugfs, NULL);
1003
1004	return 0;
1005}
1006
1007static void vc4_bo_cache_destroy(struct drm_device *dev, void *unused);
1008int vc4_bo_cache_init(struct drm_device *dev)
1009{
1010	struct vc4_dev *vc4 = to_vc4_dev(dev);
1011	int ret;
1012	int i;
1013
1014	if (WARN_ON_ONCE(vc4->gen > VC4_GEN_4))
1015		return -ENODEV;
1016
1017	/* Create the initial set of BO labels that the kernel will
1018	 * use.  This lets us avoid a bunch of string reallocation in
1019	 * the kernel's draw and BO allocation paths.
1020	 */
1021	vc4->bo_labels = kcalloc(VC4_BO_TYPE_COUNT, sizeof(*vc4->bo_labels),
1022				 GFP_KERNEL);
1023	if (!vc4->bo_labels)
1024		return -ENOMEM;
1025	vc4->num_labels = VC4_BO_TYPE_COUNT;
1026
1027	BUILD_BUG_ON(ARRAY_SIZE(bo_type_names) != VC4_BO_TYPE_COUNT);
1028	for (i = 0; i < VC4_BO_TYPE_COUNT; i++)
1029		vc4->bo_labels[i].name = bo_type_names[i];
1030
1031	ret = drmm_mutex_init(dev, &vc4->bo_lock);
1032	if (ret) {
1033		kfree(vc4->bo_labels);
1034		return ret;
1035	}
1036
1037	INIT_LIST_HEAD(&vc4->bo_cache.time_list);
1038
1039	INIT_WORK(&vc4->bo_cache.time_work, vc4_bo_cache_time_work);
1040	timer_setup(&vc4->bo_cache.time_timer, vc4_bo_cache_time_timer, 0);
1041
1042	return drmm_add_action_or_reset(dev, vc4_bo_cache_destroy, NULL);
1043}
1044
1045static void vc4_bo_cache_destroy(struct drm_device *dev, void *unused)
1046{
1047	struct vc4_dev *vc4 = to_vc4_dev(dev);
1048	int i;
1049
1050	timer_delete(&vc4->bo_cache.time_timer);
1051	cancel_work_sync(&vc4->bo_cache.time_work);
1052
1053	vc4_bo_cache_purge(dev);
1054
1055	for (i = 0; i < vc4->num_labels; i++) {
1056		if (vc4->bo_labels[i].num_allocated) {
1057			drm_err(dev, "Destroying BO cache with %d %s "
1058				"BOs still allocated\n",
1059				vc4->bo_labels[i].num_allocated,
1060				vc4->bo_labels[i].name);
1061		}
1062
1063		if (is_user_label(i))
1064			kfree(vc4->bo_labels[i].name);
1065	}
1066	kfree(vc4->bo_labels);
1067}
1068
1069int vc4_label_bo_ioctl(struct drm_device *dev, void *data,
1070		       struct drm_file *file_priv)
1071{
1072	struct vc4_dev *vc4 = to_vc4_dev(dev);
1073	struct drm_vc4_label_bo *args = data;
1074	char *name;
1075	struct drm_gem_object *gem_obj;
1076	int ret = 0, label;
1077
1078	if (WARN_ON_ONCE(vc4->gen > VC4_GEN_4))
1079		return -ENODEV;
1080
1081	if (!args->len)
1082		return -EINVAL;
1083
1084	name = strndup_user(u64_to_user_ptr(args->name), args->len + 1);
1085	if (IS_ERR(name))
1086		return PTR_ERR(name);
1087
1088	gem_obj = drm_gem_object_lookup(file_priv, args->handle);
1089	if (!gem_obj) {
1090		drm_err(dev, "Failed to look up GEM BO %d\n", args->handle);
1091		kfree(name);
1092		return -ENOENT;
1093	}
1094
1095	mutex_lock(&vc4->bo_lock);
1096	label = vc4_get_user_label(vc4, name);
1097	if (label != -1)
1098		vc4_bo_set_label(gem_obj, label);
1099	else
1100		ret = -ENOMEM;
1101	mutex_unlock(&vc4->bo_lock);
1102
1103	drm_gem_object_put(gem_obj);
1104
1105	return ret;
1106}