index : renesas/drm.git	android live master
	libdrm, cloned from git://anongit.freedesktop.org/mesa/drm	Laurent Pinchart

summaryrefslogtreecommitdiff

log msg author committer range

Age	Commit message (Collapse)	Author
2012-04-03	modetest: add drm_plane support	Rob Clark
	Signed-off-by: Rob Clark <rob@ti.com>
2012-04-03	omap: fix compiler warning	Víctor Manuel Jáquez Leal
	When compiling with linaro toolchain version 4.6.2 got this warning. CC omap_drm.lo omap_drm.c: In function 'omap_bo_new_impl': omap_drm.c:139:6: warning: 'bo' may be used uninitialized in this function [-Wuninitialized] This patch initialize bo to NULL avoiding the warning. Signed-off-by: Víctor Manuel Jáquez Leal <vjaquez@igalia.com> Signed-off-by: Rob Clark <rob@ti.com>
2012-04-03	omap: fix license header	Rob Clark
	In syncing with the corresponding kernel header, the wrong license header was inadvertantly copied over. The intention was for the userspace headers to have a MIT license following the convention of the rest of libdrm, xorg, etc. Signed-off-by: Rob Clark <rob@ti.com>
2012-04-02	intel/decode: decode MI_WAIT_FOR_EVENT	Daniel Vetter
	... and add support to decode MI instructions with functions. Reviewed-by: Eugeni Dodonov <eugeni.dodonov@intel.com> Signed-Off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
2012-04-01	intel: add Ivy Bridge GT2 server variant	Eugeni Dodonov
	We were missing this one and it is being used by Bromolow. Signed-off-by: Eugeni Dodonov <eugeni.dodonov@intel.com>
2012-03-28	configure: Bump version for 2.4.33	Alex Deucher
	Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
2012-03-28	omap: add omapdrm support	Rob Clark
	This adds libdrm_omap helper layer (as used by xf86-video-omap, omapdrmtest, etc). Signed-off-by: Rob Clark <rob@ti.com> Reviewed-by: Alex Deucher <alexander.deucher@amd.com> [danvet: pushed for Rob, he doesn't yet have commit access.] Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
2012-03-22	intel: Add some PCI IDs for Haswell.	Kenneth Graunke
	Signed-off-by: Kenneth Graunke <kenneth@whitecape.org> Reviewed-by: Eugeni Dodonov <eugeni.dodonov@intel.com>
2012-03-20	radeon: add TN surface support	Alex Deucher
	Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2012-03-16	configure: Bump version for 2.4.32.	Eric Anholt
2012-03-13	intel: Quiet two more valgrind complaints with recent changes.	Eric Anholt
	These are more cases where valgrind doesn't understand what gets read or written by our ioctls.
2012-03-10	intel: Add per-dword decode of gen7 3DPRIMITIVE.	Eric Anholt
2012-03-10	intel: Move the gen4-6 3DPRIMITIVE handling out of the switch statement.	Eric Anholt
2012-03-10	intel: Add support for (possibly) unsynchronized maps.	Eric Anholt
	This improves the performance of Mesa's GL_MAP_UNSYNCHRONIZED_BIT path in GL_ARB_map_buffer_range. Improves Unigine Tropics performance at 1024x768 by 2.30482% +/- 0.0492146% (n=61) v2: Fix comment grammar. Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
2012-03-09	intel: Fix error check for I915_PARAM_HAS_LLC.	Eric Anholt
	drmIoctl returns -1 on error with errno set to the error value. Other users of it in this file just check for != 0, and only use errno when they need to send an error value on to the caller of the API.
2012-03-09	intel: Bump the copyright dates on the bufmgr files.	Eric Anholt
	We've been hacking these constantly.
2012-03-09	intel: Add .aub file output support.	Eric Anholt
	This will allow the driver to capture all of its execution state to a file for later debugging. intel_gpu_dump is limited in that it only captures batchbuffers, and Mesa's captures, while more complete, still capture only a portion of the state involved in execution. This is a squash commit of a long series of hacking as we tried to get the resulting traces to work in the internal simulator. It contains contributions by Yuanhan Liu and Kenneth Graunke. v2: Drop the MI_FLUSH_ENABLE setup. Reviewed-by: Kenneth Graunke <kenneth@whitecape.org> Signed-off-by: Eric Anholt <eric@anholt.net> Signed-off-by: Yuanhan Liu <yuanhan.liu@linux.intel.com> Signed-off-by: Kenneth Graunke <kenneth@whitecape.org>
2012-03-09	intel: Add support for overriding the PCI ID via an environment variable	Kenneth Graunke
	For example: export INTEL_DEVID_OVERRIDE=0x162 If this variable is set, don't actually submit the batchbuffer to the GPU, it probably contains commands for the wrong generation of hardware. v2: Introduce a getter for the overridden devid, and avoid getenv per exec. Reviewed-by: Yuanhan Liu <yuanhan.liu@linux.intel.com> Signed-off-by: Kenneth Graunke <kenneth@whitecape.org> Signed-off-by: Eric Anholt <eric@anholt.net>
2012-03-09	xf86drmMode.h: Add header protection	David Herrman
	xf86drmMode.h is missing a header protection. xf86drm.h has one so just copy it and adjust the name. Reviewed-by: Adam Jackson <ajax@redhat.com> Signed-off-by: David Herrmann <dh.herrmann@googlemail.com>
2012-03-05	Make drm/drm_fourcc.h portable to non-linux platforms	Alan Coopersmith
	Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2012-03-02	Don't require pciaccess if Intel is disabled	Matt Turner
	Reviewed-by: Eric Anholt <eric@anholt.net> Signed-off-by: Matt Turner <mattst88@gmail.com>
2012-02-22	intel: Import a new batchbuffer for the gen7 test.	Eric Anholt
	This one doesn't have the 3DSTATE_HIER_DEPTH_BUFFER bug that the previous one did. Acked-by: Daniel Vetter <daniel.vetter@ffwll.ch>
2012-02-22	intel: Add decode for gen7 HIER_DEPTH_BUFFER.	Eric Anholt
	Note that the regression test complains here: The batch that was captured included a bug in its packet output, which was later fixed in Mesa. Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
2012-02-22	intel: Add decode for gen7 3DSTATE_WM.	Eric Anholt
	This requires pulling the gen6 3DSTATE_WM out to a function so it doesn't override gen7's handler. v2: Fix pasteo in interpreting ZW interpolation (thanks danvet!). Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
2012-02-22	intel: Fix a typo in decode error message.	Eric Anholt
	Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
2012-02-15	intel: Detect cache domain inconsistency with valgrind	Chris Wilson
	Every access to either the GTT or CPU pointer is supposed to be proceeded by a set_domain ioctl so that GEM is able to manage the cache domains correctly and for the following access to be coherent. Of course, some people explicitly want incoherent, non-blocking access which is going to trigger warnings by this patch but are probably better served by explicit suppression. v2: Also mark the pointers as inaccessible following the explicit unmap and implicit unmap upon return to the cache. Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
2012-02-13	radeon: fix pitch alignment for scanout buffer	Jerome Glisse
	Signed-off-by: Jerome Glisse <jglisse@redhat.com>
2012-02-13	configure: Fix pkg-config test in absence of valgrind	Chris Wilson
	The empty string used for the not case is replaced by the default if-else clause and so causes the configure to fail in the absence of valgrind. Which is not quite what was intended. Instead use the common idiom of setting a variable depending on whether the true or false branch is taken and emit the conditional code as a second step. Reported-by: Tobias Jakobi <liquid.acid@gmx.net> Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
2012-02-11	intel: Mark up with valgrind intrinsics to reduce false positives	Chris Wilson
	In particular, declare the hidden CPU mmaps to valgrind so that it knows about those memory regions. v2: Add an additional VG_CLEAR for the getparam References: https://bugs.freedesktop.org/show_bug.cgi?id=35071 Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> Acked-by: Ben Widawsky <ben@bwidawsk.net> [anholt: Ideally valgrind should just learn about the ioctls, and removing the clear for the non-valgrindified code feels risky.] Reviewed-by: Eric Anholt <eric@anholt.net>
2012-02-08	radeon_cs_setup_bo: Fix accounting if caller specified write and read domains.	Michel Dänzer
	Only account for the write domain in that case. Fixes https://bugs.freedesktop.org/show_bug.cgi?id=43893 . Signed-off-by: Michel Dänzer <michel.daenzer@amd.com> Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
2012-02-06	configure: Bump version for 2.4.31	Jerome Glisse
2012-02-06	radeon: add r600_pci_ids.h to header file	Jerome Glisse
	Signed-off-by: Jerome Glisse <jglisse@redhat.com>
2012-02-03	radeon: fix surface API for good before anyone start relying on it	Jerome Glisse
	The mipmap level computation was wrong, we need to know the block width, height, depth of compressed texture to properly compute this. Change API to provide block width, height, depth instead of nblk_x, nblk_y, nblk_z. Signed-off-by: Jerome Glisse <jglisse@redhat.com>
2012-02-02	radeon: surface fix macro -> micro tile fallback	Jerome Glisse
	We need to force 1D tiling only on old kernel the fallback was broken along the way. Signed-off-by: Jerome Glisse <jglisse@redhat.com>
2012-02-02	Using sizeof() on a function parameter with an array type does not	Ville Syrjälä
	work. sizeof() treats such parameters as pointers. Signed-off-by: Ville Syrjälä <ville.syrjala at linux.intel.com>
2012-02-02	This function was missing.	Ville Syrjälä
	Signed-off-by: Ville Syrjälä <ville.syrjala at linux.intel.com>
2012-02-02	drmModeFreeResources() always leaked some memory.	Ville Syrjälä
	drmModeGetPlaneResources() and drmModeGetPlane() leaked in one error path. Signed-off-by: Ville Syrjälä <ville.syrjala at linux.intel.com>
2012-02-01	radeon: add surface allocator helper v10	Jerome Glisse
	The surface allocator is able to build complete miptree when allocating surface for r600/r700/evergreen/northern islands GPU family. It also compute bo size and alignment for render buffer, depth buffer and scanout buffer. v2 fix r6xx/r7xx 2D tiling width align computation v3 add tile split support and fix 1d texture alignment v4 rework to more properly support compressed format, split surface pixel size and surface element size in separate fields v5 support texture array (still issue on r6xx) v6 split surface value computation and mipmap tree building, rework eg and newer computation v7 add a check for tile split and 2d tiled v8 initialize mode value before testing it in all case, reenable 2D macro tile mode on r6xx for cubemap and array. Fix cubemap to force array size to the number of face. v9 fix handling of stencil buffer on evergreen v10 on evergreen depth buffer need to have enough room for a stencil buffer just after depth one Signed-off-by: Jerome Glisse <jglisse@redhat.com>
2012-02-01	intel: query for LLC support	Eugeni Dodonov
	This adds support for querying the kernel about the LLC support in the hardware. In case the ioctl fails, we assume that it is present on GEN6 and GEN7. v2: fix the return code checking Signed-off-by: Eugeni Dodonov <eugeni.dodonov@intel.com>
2012-01-31	intel: Fix build of Intel DRM on x86 systems	Paul Berry
	Commit efd6e81e inadvertently broke the build by looking for "i?86" or "x86_64" in $host_os. The correct variable to check is $host_cpu. This was preventing libdrm_intel.so from being built. Reviewed-by: Chad Versace <chad.versace@linux.intel.com>
2012-01-30	Don't build Intel DRM if $CHOST is not i?86-* or x86_64-*	Jeremy Huddleston
	This fixes a failure in 'make check' found by the tinderbox when trying to build this code on Linux/ppc. This code is only designed to run on Intel platforms, so don't even bother building it if we're not in that set. Found-by: Tinderbox Signed-off-by: Jeremy Huddleston <jeremyhu@apple.com>
2012-01-30	intel: Fix bufmgr_gem->gen for gen > 4	Chad Versace
	If the pci_device's actual gen was > 4, then we stupidly set bufmgr_gem->gen = 6. Luckily this caused no bugs, and this fix shouldn't change any behavior, because all checks against the gen currently have one of the forms below: gen == 2 gen == 3 gen >= 4 Reviewed-by: Eric Anholt <eric@anholt.net> Reviewed-by: Eugeni Dodonov <eugeni.dodonov@intel.com> Signed-off-by: Chad Versace <chad.versace@linux.intel.com>
2012-01-27	intel: Add minimal decode for remaining gen7 packets in use.	Eric Anholt
	This just gets packet name and length in place, with the remainder unfinished. I've long since finished the work that got me started fixing up the decode.
2012-01-27	intel: Add decode for gen7 constant buffer packets.	Eric Anholt
2012-01-27	intel: Add decode for gen7 state pointers.	Eric Anholt
	Since CC_STATE_POINTERS for gen6 and 7 are quite different but use the same opcode, move gen6 out to a helper function too, so we can use a helper function for gen7.
2012-01-27	intel: Add support for parsing gen7 URB packets.	Eric Anholt
2012-01-27	intel: Make most of the logic for 965 3d packet length checks table-driven.	Eric Anholt
	This puts the error message in a consistent location relative to the packet, and while I'm here I made the error message a bit more informative. Now, most static length packets need to just declare their length in the table and not worry.
2012-01-27	intel: Move the logic for getting 965 3d packet length to the packet table.	Eric Anholt
	While I'm touching every line of the table, sort it by opcode.
2012-01-27	intel: Add support for parsing 965 3d packets using helper functions.	Eric Anholt
	I want to add packets, without contributing to the switch statement of doom.
2012-01-27	intel: Parse the correct length for gen7 3DSTATE_MULTISAMPLE.	Eric Anholt

• [prev]
• [next]

generated by cgit v1.2.3 (git 2.25.1) at 2025-11-05 01:17:57 +0000

/*
 * Copyright © 2008 Intel Corporation
 *
 * Permission is hereby granted, free of charge, to any person obtaining a
 * copy of this software and associated documentation files (the "Software"),
 * to deal in the Software without restriction, including without limitation
 * the rights to use, copy, modify, merge, publish, distribute, sublicense,
 * and/or sell copies of the Software, and to permit persons to whom the
 * Software is furnished to do so, subject to the following conditions:
 *
 * The above copyright notice and this permission notice (including the next
 * paragraph) shall be included in all copies or substantial portions of the
 * Software.
 *
 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
 * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
 * IN THE SOFTWARE.
 *
 * Authors:
 *    Eric Anholt <eric@anholt.net>
 *
 */

#include "drmP.h"
#include "drm.h"
#include "drm_compat.h"
#include "i915_drm.h"
#include "i915_drv.h"
#include <linux/swap.h>

static int
i915_gem_object_set_domain(struct drm_gem_object *obj,
			    uint32_t read_domains,
			    uint32_t write_domain);
static int
i915_gem_object_set_domain_range(struct drm_gem_object *obj,
				 uint64_t offset,
				 uint64_t size,
				 uint32_t read_domains,
				 uint32_t write_domain);
int
i915_gem_set_domain(struct drm_gem_object *obj,
		    struct drm_file *file_priv,
		    uint32_t read_domains,
		    uint32_t write_domain);
static int i915_gem_object_get_page_list(struct drm_gem_object *obj);
static void i915_gem_object_free_page_list(struct drm_gem_object *obj);
static int i915_gem_object_wait_rendering(struct drm_gem_object *obj);

int
i915_gem_init_ioctl(struct drm_device *dev, void *data,
		    struct drm_file *file_priv)
{
	drm_i915_private_t *dev_priv = dev->dev_private;
	struct drm_i915_gem_init *args = data;

	mutex_lock(&dev->struct_mutex);

	if (args->gtt_start >= args->gtt_end ||
	    (args->gtt_start & (PAGE_SIZE - 1)) != 0 ||
	    (args->gtt_end & (PAGE_SIZE - 1)) != 0) {
		mutex_unlock(&dev->struct_mutex);
		return -EINVAL;
	}

	drm_mm_init(&dev_priv->mm.gtt_space, args->gtt_start,
	    args->gtt_end - args->gtt_start);

	dev->gtt_total = (uint32_t) (args->gtt_end - args->gtt_start);

	mutex_unlock(&dev->struct_mutex);

	return 0;
}


/**
 * Creates a new mm object and returns a handle to it.
 */
int
i915_gem_create_ioctl(struct drm_device *dev, void *data,
		      struct drm_file *file_priv)
{
	struct drm_i915_gem_create *args = data;
	struct drm_gem_object *obj;
	int handle, ret;

	args->size = roundup(args->size, PAGE_SIZE);

	/* Allocate the new object */
	obj = drm_gem_object_alloc(dev, args->size);
	if (obj == NULL)
		return -ENOMEM;

	ret = drm_gem_handle_create(file_priv, obj, &handle);
	mutex_lock(&dev->struct_mutex);
	drm_gem_object_handle_unreference(obj);
	mutex_unlock(&dev->struct_mutex);

	if (ret)
		return ret;

	args->handle = handle;

	return 0;
}

/**
 * Reads data from the object referenced by handle.
 *
 * On error, the contents of *data are undefined.
 */
int
i915_gem_pread_ioctl(struct drm_device *dev, void *data,
		     struct drm_file *file_priv)
{
	struct drm_i915_gem_pread *args = data;
	struct drm_gem_object *obj;
	struct drm_i915_gem_object *obj_priv;
	ssize_t read;
	loff_t offset;
	int ret;

	obj = drm_gem_object_lookup(dev, file_priv, args->handle);
	if (obj == NULL)
		return -EBADF;
	obj_priv = obj->driver_private;

	/* Bounds check source.
	 *
	 * XXX: This could use review for overflow issues...
	 */
	if (args->offset > obj->size || args->size > obj->size ||
	    args->offset + args->size > obj->size) {
		drm_gem_object_unreference(obj);
		return -EINVAL;
	}

	mutex_lock(&dev->struct_mutex);

	ret = i915_gem_object_set_domain_range(obj, args->offset, args->size,
					       I915_GEM_DOMAIN_CPU, 0);
	if (ret != 0) {
		drm_gem_object_unreference(obj);
		mutex_unlock(&dev->struct_mutex);
	}

	offset = args->offset;

	read = vfs_read(obj->filp, (char __user *)(uintptr_t)args->data_ptr,
			args->size, &offset);
	if (read != args->size) {
		drm_gem_object_unreference(obj);
		mutex_unlock(&dev->struct_mutex);
		if (read < 0)
			return read;
		else
			return -EINVAL;
	}

	drm_gem_object_unreference(obj);
	mutex_unlock(&dev->struct_mutex);

	return 0;
}

#include "drm_compat.h"

static int
i915_gem_gtt_pwrite(struct drm_device *dev, struct drm_gem_object *obj,
		    struct drm_i915_gem_pwrite *args,
		    struct drm_file *file_priv)
{
	struct drm_i915_gem_object *obj_priv = obj->driver_private;
	ssize_t remain;
	loff_t offset;
	char __user *user_data;
	char *vaddr;
	int i, o, l;
	int ret = 0;
	unsigned long pfn;
	unsigned long unwritten;

	user_data = (char __user *) (uintptr_t) args->data_ptr;
	remain = args->size;
	if (!access_ok(VERIFY_READ, user_data, remain))
		return -EFAULT;


	mutex_lock(&dev->struct_mutex);
	ret = i915_gem_object_pin(obj, 0);
	if (ret) {
		mutex_unlock(&dev->struct_mutex);
		return ret;
	}
	ret = i915_gem_set_domain(obj, file_priv,
				  I915_GEM_DOMAIN_GTT, I915_GEM_DOMAIN_GTT);
	if (ret)
		goto fail;

	obj_priv = obj->driver_private;
	offset = obj_priv->gtt_offset + args->offset;
	obj_priv->dirty = 1;

	while (remain > 0) {
		/* Operation in this page
		 *
		 * i = page number
		 * o = offset within page
		 * l = bytes to copy
		 */
		i = offset >> PAGE_SHIFT;
		o = offset & (PAGE_SIZE-1);
		l = remain;
		if ((o + l) > PAGE_SIZE)
			l = PAGE_SIZE - o;

		pfn = (dev->agp->base >> PAGE_SHIFT) + i;

#ifdef DRM_KMAP_ATOMIC_PROT_PFN
		/* kmap_atomic can't map IO pages on non-HIGHMEM kernels
		 */
		vaddr = kmap_atomic_prot_pfn(pfn, KM_USER0,
					     __pgprot(__PAGE_KERNEL));
#if WATCH_PWRITE
		DRM_INFO("pwrite i %d o %d l %d pfn %ld vaddr %p\n",
			 i, o, l, pfn, vaddr);
#endif
		unwritten = __copy_from_user_inatomic_nocache(vaddr + o,
							      user_data, l);
		kunmap_atomic(vaddr, KM_USER0);

		if (unwritten)
#endif
		{
			vaddr = ioremap(pfn << PAGE_SHIFT, PAGE_SIZE);
#if WATCH_PWRITE
			DRM_INFO("pwrite slow i %d o %d l %d "
				 "pfn %ld vaddr %p\n",
				 i, o, l, pfn, vaddr);
#endif
			if (vaddr == NULL) {
				ret = -EFAULT;
				goto fail;
			}
			unwritten = __copy_from_user(vaddr + o, user_data, l);
#if WATCH_PWRITE
			DRM_INFO("unwritten %ld\n", unwritten);
#endif
			iounmap(vaddr);
			if (unwritten) {
				ret = -EFAULT;
				goto fail;
			}
		}

		remain -= l;
		user_data += l;
		offset += l;
	}
#if WATCH_PWRITE && 1
	i915_gem_clflush_object(obj);
	i915_gem_dump_object(obj, args->offset + args->size, __func__, ~0);
	i915_gem_clflush_object(obj);
#endif

fail:
	i915_gem_object_unpin(obj);
	mutex_unlock(&dev->struct_mutex);

	return ret;
}

int
i915_gem_shmem_pwrite(struct drm_device *dev, struct drm_gem_object *obj,
		      struct drm_i915_gem_pwrite *args,
		      struct drm_file *file_priv)
{
	int ret;
	loff_t offset;
	ssize_t written;

	mutex_lock(&dev->struct_mutex);

	ret = i915_gem_set_domain(obj, file_priv,
				  I915_GEM_DOMAIN_CPU, I915_GEM_DOMAIN_CPU);
	if (ret) {
		mutex_unlock(&dev->struct_mutex);
		return ret;
	}

	offset = args->offset;

	written = vfs_write(obj->filp,
			    (char __user *)(uintptr_t) args->data_ptr,
			    args->size, &offset);
	if (written != args->size) {
		mutex_unlock(&dev->struct_mutex);
		if (written < 0)
			return written;
		else
			return -EINVAL;
	}

	mutex_unlock(&dev->struct_mutex);

	return 0;
}

/**
 * Writes data to the object referenced by handle.
 *
 * On error, the contents of the buffer that were to be modified are undefined.
 */
int
i915_gem_pwrite_ioctl(struct drm_device *dev, void *data,
		      struct drm_file *file_priv)
{
	struct drm_i915_gem_pwrite *args = data;
	struct drm_gem_object *obj;
	struct drm_i915_gem_object *obj_priv;
	int ret = 0;

	obj = drm_gem_object_lookup(dev, file_priv, args->handle);
	if (obj == NULL)
		return -EBADF;
	obj_priv = obj->driver_private;

	/* Bounds check destination.
	 *
	 * XXX: This could use review for overflow issues...
	 */
	if (args->offset > obj->size || args->size > obj->size ||
	    args->offset + args->size > obj->size) {
		drm_gem_object_unreference(obj);
		return -EINVAL;
	}

	/* We can only do the GTT pwrite on untiled buffers, as otherwise
	 * it would end up going through the fenced access, and we'll get
	 * different detiling behavior between reading and writing.
	 * pread/pwrite currently are reading and writing from the CPU
	 * perspective, requiring manual detiling by the client.
	 */
	if (obj_priv->tiling_mode == I915_TILING_NONE &&
	    dev->gtt_total != 0)
		ret = i915_gem_gtt_pwrite(dev, obj, args, file_priv);
	else
		ret = i915_gem_shmem_pwrite(dev, obj, args, file_priv);

#if WATCH_PWRITE
	if (ret)
		DRM_INFO("pwrite failed %d\n", ret);
#endif

	drm_gem_object_unreference(obj);

	return ret;
}

/**
 * Called when user space prepares to use an object
 */
int
i915_gem_set_domain_ioctl(struct drm_device *dev, void *data,
			  struct drm_file *file_priv)
{
	struct drm_i915_gem_set_domain *args = data;
	struct drm_gem_object *obj;
	int ret;

	if (!(dev->driver->driver_features & DRIVER_GEM))
		return -ENODEV;

	obj = drm_gem_object_lookup(dev, file_priv, args->handle);
	if (obj == NULL)
		return -EBADF;

	mutex_lock(&dev->struct_mutex);
#if WATCH_BUF
	DRM_INFO("set_domain_ioctl %p(%d), %08x %08x\n",
		 obj, obj->size, args->read_domains, args->write_domain);
#endif
	ret = i915_gem_set_domain(obj, file_priv,
				  args->read_domains, args->write_domain);
	drm_gem_object_unreference(obj);
	mutex_unlock(&dev->struct_mutex);
	return ret;
}

/**
 * Called when user space has done writes to this buffer
 */
int
i915_gem_sw_finish_ioctl(struct drm_device *dev, void *data,
		      struct drm_file *file_priv)
{
	struct drm_i915_gem_sw_finish *args = data;
	struct drm_gem_object *obj;
	struct drm_i915_gem_object *obj_priv;
	int ret = 0;

	if (!(dev->driver->driver_features & DRIVER_GEM))
		return -ENODEV;

	mutex_lock(&dev->struct_mutex);
	obj = drm_gem_object_lookup(dev, file_priv, args->handle);
	if (obj == NULL) {
		mutex_unlock(&dev->struct_mutex);
		return -EBADF;
	}

#if WATCH_BUF
	DRM_INFO("%s: sw_finish %d (%p %d)\n",
		 __func__, args->handle, obj, obj->size);
#endif
	obj_priv = obj->driver_private;

	/* Pinned buffers may be scanout, so flush the cache */
	if ((obj->write_domain & I915_GEM_DOMAIN_CPU) && obj_priv->pin_count) {
		i915_gem_clflush_object(obj);
		drm_agp_chipset_flush(dev);
	}
	drm_gem_object_unreference(obj);
	mutex_unlock(&dev->struct_mutex);
	return ret;
}

/**
 * Maps the contents of an object, returning the address it is mapped
 * into.
 *
 * While the mapping holds a reference on the contents of the object, it doesn't
 * imply a ref on the object itself.
 */
int
i915_gem_mmap_ioctl(struct drm_device *dev, void *data,
		   struct drm_file *file_priv)
{
	struct drm_i915_gem_mmap *args = data;
	struct drm_gem_object *obj;
	loff_t offset;
	unsigned long addr;

	if (!(dev->driver->driver_features & DRIVER_GEM))
		return -ENODEV;

	obj = drm_gem_object_lookup(dev, file_priv, args->handle);
	if (obj == NULL)
		return -EBADF;

	offset = args->offset;

	down_write(&current->mm->mmap_sem);
	addr = do_mmap(obj->filp, 0, args->size,
		       PROT_READ | PROT_WRITE, MAP_SHARED,
		       args->offset);
	up_write(&current->mm->mmap_sem);
	mutex_lock(&dev->struct_mutex);
	drm_gem_object_unreference(obj);
	mutex_unlock(&dev->struct_mutex);
	if (IS_ERR((void *)addr))
		return addr;

	args->addr_ptr = (uint64_t) addr;

	return 0;
}

static void
i915_gem_object_free_page_list(struct drm_gem_object *obj)
{
	struct drm_i915_gem_object *obj_priv = obj->driver_private;
	int page_count = obj->size / PAGE_SIZE;
	int i;

	if (obj_priv->page_list == NULL)
		return;


	for (i = 0; i < page_count; i++)
		if (obj_priv->page_list[i] != NULL) {
			if (obj_priv->dirty)
				set_page_dirty(obj_priv->page_list[i]);
			mark_page_accessed(obj_priv->page_list[i]);
			page_cache_release(obj_priv->page_list[i]);
		}
	obj_priv->dirty = 0;

	drm_free(obj_priv->page_list,
		 page_count * sizeof(struct page *),
		 DRM_MEM_DRIVER);
	obj_priv->page_list = NULL;
}

static void
i915_gem_object_move_to_active(struct drm_gem_object *obj)
{
	struct drm_device *dev = obj->dev;
	drm_i915_private_t *dev_priv = dev->dev_private;
	struct drm_i915_gem_object *obj_priv = obj->driver_private;

	/* Add a reference if we're newly entering the active list. */
	if (!obj_priv->active) {
		drm_gem_object_reference(obj);
		obj_priv->active = 1;
	}
	/* Move from whatever list we were on to the tail of execution. */
	list_move_tail(&obj_priv->list,
		       &dev_priv->mm.active_list);
}


static void
i915_gem_object_move_to_inactive(struct drm_gem_object *obj)
{
	struct drm_device *dev = obj->dev;
	drm_i915_private_t *dev_priv = dev->dev_private;
	struct drm_i915_gem_object *obj_priv = obj->driver_private;

	i915_verify_inactive(dev, __FILE__, __LINE__);
	if (obj_priv->pin_count != 0)
		list_del_init(&obj_priv->list);
	else
		list_move_tail(&obj_priv->list, &dev_priv->mm.inactive_list);

	if (obj_priv->active) {
		obj_priv->active = 0;
		drm_gem_object_unreference(obj);
	}
	i915_verify_inactive(dev, __FILE__, __LINE__);
}

/**
 * Creates a new sequence number, emitting a write of it to the status page
 * plus an interrupt, which will trigger i915_user_interrupt_handler.
 *
 * Must be called with struct_lock held.
 *
 * Returned sequence numbers are nonzero on success.
 */
static uint32_t
i915_add_request(struct drm_device *dev, uint32_t flush_domains)
{
	drm_i915_private_t *dev_priv = dev->dev_private;
	struct drm_i915_gem_request *request;
	uint32_t seqno;
	int was_empty;
	RING_LOCALS;

	request = drm_calloc(1, sizeof(*request), DRM_MEM_DRIVER);
	if (request == NULL)
		return 0;

	/* Grab the seqno we're going to make this request be, and bump the
	 * next (skipping 0 so it can be the reserved no-seqno value).
	 */
	seqno = dev_priv->mm.next_gem_seqno;
	dev_priv->mm.next_gem_seqno++;
	if (dev_priv->mm.next_gem_seqno == 0)
		dev_priv->mm.next_gem_seqno++;

	BEGIN_LP_RING(4);
	OUT_RING(MI_STORE_DWORD_INDEX);
	OUT_RING(I915_GEM_HWS_INDEX << MI_STORE_DWORD_INDEX_SHIFT);
	OUT_RING(seqno);

	OUT_RING(MI_USER_INTERRUPT);
	ADVANCE_LP_RING();

	DRM_DEBUG("%d\n", seqno);

	request->seqno = seqno;
	request->emitted_jiffies = jiffies;
	request->flush_domains = flush_domains;
	was_empty = list_empty(&dev_priv->mm.request_list);
	list_add_tail(&request->list, &dev_priv->mm.request_list);

	if (was_empty)
		schedule_delayed_work(&dev_priv->mm.retire_work, HZ);
	return seqno;
}

/**
 * Command execution barrier
 *
 * Ensures that all commands in the ring are finished
 * before signalling the CPU
 */
uint32_t
i915_retire_commands(struct drm_device *dev)
{
	drm_i915_private_t *dev_priv = dev->dev_private;
	uint32_t cmd = MI_FLUSH | MI_NO_WRITE_FLUSH;
	uint32_t flush_domains = 0;
	RING_LOCALS;

	/* The sampler always gets flushed on i965 (sigh) */
	if (IS_I965G(dev))
		flush_domains |= I915_GEM_DOMAIN_SAMPLER;
	BEGIN_LP_RING(2);
	OUT_RING(cmd);
	OUT_RING(0); /* noop */
	ADVANCE_LP_RING();
	return flush_domains;
}

/**
 * Moves buffers associated only with the given active seqno from the active
 * to inactive list, potentially freeing them.
 */
static void
i915_gem_retire_request(struct drm_device *dev,
			struct drm_i915_gem_request *request)
{
	drm_i915_private_t *dev_priv = dev->dev_private;

	if (request->flush_domains != 0) {
		struct drm_i915_gem_object *obj_priv, *next;

		/* First clear any buffers that were only waiting for a flush
		 * matching the one just retired.
		 */

		list_for_each_entry_safe(obj_priv, next,
					 &dev_priv->mm.flushing_list, list) {
			struct drm_gem_object *obj = obj_priv->obj;

			if (obj->write_domain & request->flush_domains) {
				obj->write_domain = 0;
				i915_gem_object_move_to_inactive(obj);
			}
		}

	}

	/* Move any buffers on the active list that are no longer referenced
	 * by the ringbuffer to the flushing/inactive lists as appropriate.
	 */
	while (!list_empty(&dev_priv->mm.active_list)) {
		struct drm_gem_object *obj;
		struct drm_i915_gem_object *obj_priv;

		obj_priv = list_first_entry(&dev_priv->mm.active_list,
					    struct drm_i915_gem_object,
					    list);
		obj = obj_priv->obj;

		/* If the seqno being retired doesn't match the oldest in the
		 * list, then the oldest in the list must still be newer than
		 * this seqno.
		 */
		if (obj_priv->last_rendering_seqno != request->seqno)
			return;
#if WATCH_LRU
		DRM_INFO("%s: retire %d moves to inactive list %p\n",
			 __func__, request->seqno, obj);
#endif

		/* If this request flushes the write domain,
		 * clear the write domain from the object now
		 */
		if (request->flush_domains & obj->write_domain)
		    obj->write_domain = 0;

		if (obj->write_domain != 0) {
			list_move_tail(&obj_priv->list,
				       &dev_priv->mm.flushing_list);
		} else {
			i915_gem_object_move_to_inactive(obj);
		}
	}
}

/**
 * Returns true if seq1 is later than seq2.
 */
static int
i915_seqno_passed(uint32_t seq1, uint32_t seq2)
{
	return (int32_t)(seq1 - seq2) >= 0;
}

uint32_t
i915_get_gem_seqno(struct drm_device *dev)
{
	drm_i915_private_t *dev_priv = dev->dev_private;

	return READ_HWSP(dev_priv, I915_GEM_HWS_INDEX);
}

/**
 * This function clears the request list as sequence numbers are passed.
 */
void
i915_gem_retire_requests(struct drm_device *dev)
{
	drm_i915_private_t *dev_priv = dev->dev_private;
	uint32_t seqno;

	seqno = i915_get_gem_seqno(dev);

	while (!list_empty(&dev_priv->mm.request_list)) {
		struct drm_i915_gem_request *request;
		uint32_t retiring_seqno;

		request = list_first_entry(&dev_priv->mm.request_list,
					   struct drm_i915_gem_request,
					   list);
		retiring_seqno = request->seqno;

		if (i915_seqno_passed(seqno, retiring_seqno) ||
		    dev_priv->mm.wedged) {
			i915_gem_retire_request(dev, request);

			list_del(&request->list);
			drm_free(request, sizeof(*request), DRM_MEM_DRIVER);
		} else
			break;
	}
}

void
i915_gem_retire_work_handler(struct work_struct *work)
{
	drm_i915_private_t *dev_priv;
	struct drm_device *dev;

	dev_priv = container_of(work, drm_i915_private_t,
				mm.retire_work.work);
	dev = dev_priv->dev;

	mutex_lock(&dev->struct_mutex);
	i915_gem_retire_requests(dev);
	if (!list_empty(&dev_priv->mm.request_list))
		schedule_delayed_work(&dev_priv->mm.retire_work, HZ);
	mutex_unlock(&dev->struct_mutex);
}

/**
 * Waits for a sequence number to be signaled, and cleans up the
 * request and object lists appropriately for that event.
 */
int
i915_wait_request(struct drm_device *dev, uint32_t seqno)
{
	drm_i915_private_t *dev_priv = dev->dev_private;
	int ret = 0;

	BUG_ON(seqno == 0);

	if (!i915_seqno_passed(i915_get_gem_seqno(dev), seqno)) {
		dev_priv->mm.waiting_gem_seqno = seqno;
		i915_user_irq_on(dev_priv);
		ret = wait_event_interruptible(dev_priv->irq_queue,
					       i915_seqno_passed(i915_get_gem_seqno(dev),
								 seqno) ||
					       dev_priv->mm.wedged);
		i915_user_irq_off(dev_priv);
		dev_priv->mm.waiting_gem_seqno = 0;
	}
	if (dev_priv->mm.wedged)
		ret = -EIO;

	if (ret && ret != -ERESTARTSYS)
		DRM_ERROR("%s returns %d (awaiting %d at %d)\n",
			  __func__, ret, seqno, i915_get_gem_seqno(dev));

	/* Directly dispatch request retiring.  While we have the work queue
	 * to handle this, the waiter on a request often wants an associated
	 * buffer to have made it to the inactive list, and we would need
	 * a separate wait queue to handle that.
	 */
	if (ret == 0)
		i915_gem_retire_requests(dev);

	return ret;
}

static void
i915_gem_flush(struct drm_device *dev,
	       uint32_t invalidate_domains,
	       uint32_t flush_domains)
{
	drm_i915_private_t *dev_priv = dev->dev_private;
	uint32_t cmd;
	RING_LOCALS;

#if WATCH_EXEC
	DRM_INFO("%s: invalidate %08x flush %08x\n", __func__,
		  invalidate_domains, flush_domains);
#endif

	if (flush_domains & I915_GEM_DOMAIN_CPU)
		drm_agp_chipset_flush(dev);

	if ((invalidate_domains | flush_domains) & ~(I915_GEM_DOMAIN_CPU |
						     I915_GEM_DOMAIN_GTT)) {
		/*
		 * read/write caches:
		 *