1 /*
2  * Copyright 2013 Red Hat Inc.
3  *
4  * Permission is hereby granted, free of charge, to any person obtaining a
5  * copy of this software and associated documentation files (the "Software"),
6  * to deal in the Software without restriction, including without limitation
7  * the rights to use, copy, modify, merge, publish, distribute, sublicense,
8  * and/or sell copies of the Software, and to permit persons to whom the
9  * Software is furnished to do so, subject to the following conditions:
10  *
11  * The above copyright notice and this permission notice shall be included in
12  * all copies or substantial portions of the Software.
13  *
14  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
15  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
16  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
17  * THE COPYRIGHT HOLDER(S) OR AUTHOR(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR
18  * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
19  * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
20  * OTHER DEALINGS IN THE SOFTWARE.
21  *
22  * Authors: Dave Airlie
23  *          Alon Levy
24  */
25 
26 /* QXL cmd/ring handling */
27 
28 #include <linux/delay.h>
29 
30 #include <drm/drm_util.h>
31 
32 #include "qxl_drv.h"
33 #include "qxl_object.h"
34 
35 static int qxl_reap_surface_id(struct qxl_device *qdev, int max_to_reap);
36 
37 struct ring {
38 	struct qxl_ring_header      header;
39 	uint8_t                     elements[0];
40 };
41 
42 struct qxl_ring {
43 	struct ring	       *ring;
44 	int			element_size;
45 	int			n_elements;
46 	int			prod_notify;
47 	wait_queue_head_t      *push_event;
48 	spinlock_t             lock;
49 };
50 
qxl_ring_free(struct qxl_ring * ring)51 void qxl_ring_free(struct qxl_ring *ring)
52 {
53 	kfree(ring);
54 }
55 
qxl_ring_init_hdr(struct qxl_ring * ring)56 void qxl_ring_init_hdr(struct qxl_ring *ring)
57 {
58 	ring->ring->header.notify_on_prod = ring->n_elements;
59 }
60 
61 struct qxl_ring *
qxl_ring_create(struct qxl_ring_header * header,int element_size,int n_elements,int prod_notify,bool set_prod_notify,wait_queue_head_t * push_event)62 qxl_ring_create(struct qxl_ring_header *header,
63 		int element_size,
64 		int n_elements,
65 		int prod_notify,
66 		bool set_prod_notify,
67 		wait_queue_head_t *push_event)
68 {
69 	struct qxl_ring *ring;
70 
71 	ring = kmalloc(sizeof(*ring), GFP_KERNEL);
72 	if (!ring)
73 		return NULL;
74 
75 	ring->ring = (struct ring *)header;
76 	ring->element_size = element_size;
77 	ring->n_elements = n_elements;
78 	ring->prod_notify = prod_notify;
79 	ring->push_event = push_event;
80 	if (set_prod_notify)
81 		qxl_ring_init_hdr(ring);
82 	spin_lock_init(&ring->lock);
83 	return ring;
84 }
85 
qxl_check_header(struct qxl_ring * ring)86 static int qxl_check_header(struct qxl_ring *ring)
87 {
88 	int ret;
89 	struct qxl_ring_header *header = &(ring->ring->header);
90 	unsigned long flags;
91 
92 	spin_lock_irqsave(&ring->lock, flags);
93 	ret = header->prod - header->cons < header->num_items;
94 	if (ret == 0)
95 		header->notify_on_cons = header->cons + 1;
96 	spin_unlock_irqrestore(&ring->lock, flags);
97 	return ret;
98 }
99 
qxl_check_idle(struct qxl_ring * ring)100 int qxl_check_idle(struct qxl_ring *ring)
101 {
102 	int ret;
103 	struct qxl_ring_header *header = &(ring->ring->header);
104 	unsigned long flags;
105 
106 	spin_lock_irqsave(&ring->lock, flags);
107 	ret = header->prod == header->cons;
108 	spin_unlock_irqrestore(&ring->lock, flags);
109 	return ret;
110 }
111 
qxl_ring_push(struct qxl_ring * ring,const void * new_elt,bool interruptible)112 int qxl_ring_push(struct qxl_ring *ring,
113 		  const void *new_elt, bool interruptible)
114 {
115 	struct qxl_ring_header *header = &(ring->ring->header);
116 	uint8_t *elt;
117 	int idx, ret;
118 	unsigned long flags;
119 
120 	spin_lock_irqsave(&ring->lock, flags);
121 	if (header->prod - header->cons == header->num_items) {
122 		header->notify_on_cons = header->cons + 1;
123 		mb();
124 		spin_unlock_irqrestore(&ring->lock, flags);
125 		if (!drm_can_sleep()) {
126 			while (!qxl_check_header(ring))
127 				udelay(1);
128 		} else {
129 			if (interruptible) {
130 				ret = wait_event_interruptible(*ring->push_event,
131 							       qxl_check_header(ring));
132 				if (ret)
133 					return ret;
134 			} else {
135 				wait_event(*ring->push_event,
136 					   qxl_check_header(ring));
137 			}
138 
139 		}
140 		spin_lock_irqsave(&ring->lock, flags);
141 	}
142 
143 	idx = header->prod & (ring->n_elements - 1);
144 	elt = ring->ring->elements + idx * ring->element_size;
145 
146 	memcpy((void *)elt, new_elt, ring->element_size);
147 
148 	header->prod++;
149 
150 	mb();
151 
152 	if (header->prod == header->notify_on_prod)
153 		outb(0, ring->prod_notify);
154 
155 	spin_unlock_irqrestore(&ring->lock, flags);
156 	return 0;
157 }
158 
qxl_ring_pop(struct qxl_ring * ring,void * element)159 static bool qxl_ring_pop(struct qxl_ring *ring,
160 			 void *element)
161 {
162 	volatile struct qxl_ring_header *header = &(ring->ring->header);
163 	volatile uint8_t *ring_elt;
164 	int idx;
165 	unsigned long flags;
166 
167 	spin_lock_irqsave(&ring->lock, flags);
168 	if (header->cons == header->prod) {
169 		header->notify_on_prod = header->cons + 1;
170 		spin_unlock_irqrestore(&ring->lock, flags);
171 		return false;
172 	}
173 
174 	idx = header->cons & (ring->n_elements - 1);
175 	ring_elt = ring->ring->elements + idx * ring->element_size;
176 
177 	memcpy(element, (void *)ring_elt, ring->element_size);
178 
179 	header->cons++;
180 
181 	spin_unlock_irqrestore(&ring->lock, flags);
182 	return true;
183 }
184 
185 int
qxl_push_command_ring_release(struct qxl_device * qdev,struct qxl_release * release,uint32_t type,bool interruptible)186 qxl_push_command_ring_release(struct qxl_device *qdev, struct qxl_release *release,
187 			      uint32_t type, bool interruptible)
188 {
189 	struct qxl_command cmd;
190 
191 	cmd.type = type;
192 	cmd.data = qxl_bo_physical_address(qdev, release->release_bo, release->release_offset);
193 
194 	return qxl_ring_push(qdev->command_ring, &cmd, interruptible);
195 }
196 
197 int
qxl_push_cursor_ring_release(struct qxl_device * qdev,struct qxl_release * release,uint32_t type,bool interruptible)198 qxl_push_cursor_ring_release(struct qxl_device *qdev, struct qxl_release *release,
199 			     uint32_t type, bool interruptible)
200 {
201 	struct qxl_command cmd;
202 
203 	cmd.type = type;
204 	cmd.data = qxl_bo_physical_address(qdev, release->release_bo, release->release_offset);
205 
206 	return qxl_ring_push(qdev->cursor_ring, &cmd, interruptible);
207 }
208 
qxl_queue_garbage_collect(struct qxl_device * qdev,bool flush)209 bool qxl_queue_garbage_collect(struct qxl_device *qdev, bool flush)
210 {
211 	if (!qxl_check_idle(qdev->release_ring)) {
212 		schedule_work(&qdev->gc_work);
213 		if (flush)
214 			flush_work(&qdev->gc_work);
215 		return true;
216 	}
217 	return false;
218 }
219 
qxl_garbage_collect(struct qxl_device * qdev)220 int qxl_garbage_collect(struct qxl_device *qdev)
221 {
222 	struct qxl_release *release;
223 	uint64_t id, next_id;
224 	int i = 0;
225 	union qxl_release_info *info;
226 
227 	while (qxl_ring_pop(qdev->release_ring, &id)) {
228 		DRM_DEBUG_DRIVER("popped %lld\n", id);
229 		while (id) {
230 			release = qxl_release_from_id_locked(qdev, id);
231 			if (release == NULL)
232 				break;
233 
234 			info = qxl_release_map(qdev, release);
235 			next_id = info->next;
236 			qxl_release_unmap(qdev, release, info);
237 
238 			DRM_DEBUG_DRIVER("popped %lld, next %lld\n", id,
239 					 next_id);
240 
241 			switch (release->type) {
242 			case QXL_RELEASE_DRAWABLE:
243 			case QXL_RELEASE_SURFACE_CMD:
244 			case QXL_RELEASE_CURSOR_CMD:
245 				break;
246 			default:
247 				DRM_ERROR("unexpected release type\n");
248 				break;
249 			}
250 			id = next_id;
251 
252 			qxl_release_free(qdev, release);
253 			++i;
254 		}
255 	}
256 
257 	DRM_DEBUG_DRIVER("%d\n", i);
258 
259 	return i;
260 }
261 
qxl_alloc_bo_reserved(struct qxl_device * qdev,struct qxl_release * release,unsigned long size,struct qxl_bo ** _bo)262 int qxl_alloc_bo_reserved(struct qxl_device *qdev,
263 			  struct qxl_release *release,
264 			  unsigned long size,
265 			  struct qxl_bo **_bo)
266 {
267 	struct qxl_bo *bo;
268 	int ret;
269 
270 	ret = qxl_bo_create(qdev, size, false /* not kernel - device */,
271 			    false, QXL_GEM_DOMAIN_VRAM, NULL, &bo);
272 	if (ret) {
273 		DRM_ERROR("failed to allocate VRAM BO\n");
274 		return ret;
275 	}
276 	ret = qxl_release_list_add(release, bo);
277 	if (ret)
278 		goto out_unref;
279 
280 	*_bo = bo;
281 	return 0;
282 out_unref:
283 	qxl_bo_unref(&bo);
284 	return ret;
285 }
286 
wait_for_io_cmd_user(struct qxl_device * qdev,uint8_t val,long port,bool intr)287 static int wait_for_io_cmd_user(struct qxl_device *qdev, uint8_t val, long port, bool intr)
288 {
289 	int irq_num;
290 	long addr = qdev->io_base + port;
291 	int ret;
292 
293 	mutex_lock(&qdev->async_io_mutex);
294 	irq_num = atomic_read(&qdev->irq_received_io_cmd);
295 	if (qdev->last_sent_io_cmd > irq_num) {
296 		if (intr)
297 			ret = wait_event_interruptible_timeout(qdev->io_cmd_event,
298 							       atomic_read(&qdev->irq_received_io_cmd) > irq_num, 5*HZ);
299 		else
300 			ret = wait_event_timeout(qdev->io_cmd_event,
301 						 atomic_read(&qdev->irq_received_io_cmd) > irq_num, 5*HZ);
302 		/* 0 is timeout, just bail the "hw" has gone away */
303 		if (ret <= 0)
304 			goto out;
305 		irq_num = atomic_read(&qdev->irq_received_io_cmd);
306 	}
307 	outb(val, addr);
308 	qdev->last_sent_io_cmd = irq_num + 1;
309 	if (intr)
310 		ret = wait_event_interruptible_timeout(qdev->io_cmd_event,
311 						       atomic_read(&qdev->irq_received_io_cmd) > irq_num, 5*HZ);
312 	else
313 		ret = wait_event_timeout(qdev->io_cmd_event,
314 					 atomic_read(&qdev->irq_received_io_cmd) > irq_num, 5*HZ);
315 out:
316 	if (ret > 0)
317 		ret = 0;
318 	mutex_unlock(&qdev->async_io_mutex);
319 	return ret;
320 }
321 
wait_for_io_cmd(struct qxl_device * qdev,uint8_t val,long port)322 static void wait_for_io_cmd(struct qxl_device *qdev, uint8_t val, long port)
323 {
324 	int ret;
325 
326 restart:
327 	ret = wait_for_io_cmd_user(qdev, val, port, false);
328 	if (ret == -ERESTARTSYS)
329 		goto restart;
330 }
331 
qxl_io_update_area(struct qxl_device * qdev,struct qxl_bo * surf,const struct qxl_rect * area)332 int qxl_io_update_area(struct qxl_device *qdev, struct qxl_bo *surf,
333 			const struct qxl_rect *area)
334 {
335 	int surface_id;
336 	uint32_t surface_width, surface_height;
337 	int ret;
338 
339 	if (!surf->hw_surf_alloc)
340 		DRM_ERROR("got io update area with no hw surface\n");
341 
342 	if (surf->is_primary)
343 		surface_id = 0;
344 	else
345 		surface_id = surf->surface_id;
346 	surface_width = surf->surf.width;
347 	surface_height = surf->surf.height;
348 
349 	if (area->left < 0 || area->top < 0 ||
350 	    area->right > surface_width || area->bottom > surface_height)
351 		return -EINVAL;
352 
353 	mutex_lock(&qdev->update_area_mutex);
354 	qdev->ram_header->update_area = *area;
355 	qdev->ram_header->update_surface = surface_id;
356 	ret = wait_for_io_cmd_user(qdev, 0, QXL_IO_UPDATE_AREA_ASYNC, true);
357 	mutex_unlock(&qdev->update_area_mutex);
358 	return ret;
359 }
360 
qxl_io_notify_oom(struct qxl_device * qdev)361 void qxl_io_notify_oom(struct qxl_device *qdev)
362 {
363 	outb(0, qdev->io_base + QXL_IO_NOTIFY_OOM);
364 }
365 
qxl_io_flush_release(struct qxl_device * qdev)366 void qxl_io_flush_release(struct qxl_device *qdev)
367 {
368 	outb(0, qdev->io_base + QXL_IO_FLUSH_RELEASE);
369 }
370 
qxl_io_flush_surfaces(struct qxl_device * qdev)371 void qxl_io_flush_surfaces(struct qxl_device *qdev)
372 {
373 	wait_for_io_cmd(qdev, 0, QXL_IO_FLUSH_SURFACES_ASYNC);
374 }
375 
qxl_io_destroy_primary(struct qxl_device * qdev)376 void qxl_io_destroy_primary(struct qxl_device *qdev)
377 {
378 	wait_for_io_cmd(qdev, 0, QXL_IO_DESTROY_PRIMARY_ASYNC);
379 	qdev->primary_bo->is_primary = false;
380 	drm_gem_object_put_unlocked(&qdev->primary_bo->tbo.base);
381 	qdev->primary_bo = NULL;
382 }
383 
qxl_io_create_primary(struct qxl_device * qdev,struct qxl_bo * bo)384 void qxl_io_create_primary(struct qxl_device *qdev, struct qxl_bo *bo)
385 {
386 	struct qxl_surface_create *create;
387 
388 	if (WARN_ON(qdev->primary_bo))
389 		return;
390 
391 	DRM_DEBUG_DRIVER("qdev %p, ram_header %p\n", qdev, qdev->ram_header);
392 	create = &qdev->ram_header->create_surface;
393 	create->format = bo->surf.format;
394 	create->width = bo->surf.width;
395 	create->height = bo->surf.height;
396 	create->stride = bo->surf.stride;
397 	create->mem = qxl_bo_physical_address(qdev, bo, 0);
398 
399 	DRM_DEBUG_DRIVER("mem = %llx, from %p\n", create->mem, bo->kptr);
400 
401 	create->flags = QXL_SURF_FLAG_KEEP_DATA;
402 	create->type = QXL_SURF_TYPE_PRIMARY;
403 
404 	wait_for_io_cmd(qdev, 0, QXL_IO_CREATE_PRIMARY_ASYNC);
405 	qdev->primary_bo = bo;
406 	qdev->primary_bo->is_primary = true;
407 	drm_gem_object_get(&qdev->primary_bo->tbo.base);
408 }
409 
qxl_io_memslot_add(struct qxl_device * qdev,uint8_t id)410 void qxl_io_memslot_add(struct qxl_device *qdev, uint8_t id)
411 {
412 	DRM_DEBUG_DRIVER("qxl_memslot_add %d\n", id);
413 	wait_for_io_cmd(qdev, id, QXL_IO_MEMSLOT_ADD_ASYNC);
414 }
415 
qxl_io_reset(struct qxl_device * qdev)416 void qxl_io_reset(struct qxl_device *qdev)
417 {
418 	outb(0, qdev->io_base + QXL_IO_RESET);
419 }
420 
qxl_io_monitors_config(struct qxl_device * qdev)421 void qxl_io_monitors_config(struct qxl_device *qdev)
422 {
423 	wait_for_io_cmd(qdev, 0, QXL_IO_MONITORS_CONFIG_ASYNC);
424 }
425 
qxl_surface_id_alloc(struct qxl_device * qdev,struct qxl_bo * surf)426 int qxl_surface_id_alloc(struct qxl_device *qdev,
427 		      struct qxl_bo *surf)
428 {
429 	uint32_t handle;
430 	int idr_ret;
431 	int count = 0;
432 again:
433 	idr_preload(GFP_ATOMIC);
434 	spin_lock(&qdev->surf_id_idr_lock);
435 	idr_ret = idr_alloc(&qdev->surf_id_idr, NULL, 1, 0, GFP_NOWAIT);
436 	spin_unlock(&qdev->surf_id_idr_lock);
437 	idr_preload_end();
438 	if (idr_ret < 0)
439 		return idr_ret;
440 	handle = idr_ret;
441 
442 	if (handle >= qdev->rom->n_surfaces) {
443 		count++;
444 		spin_lock(&qdev->surf_id_idr_lock);
445 		idr_remove(&qdev->surf_id_idr, handle);
446 		spin_unlock(&qdev->surf_id_idr_lock);
447 		qxl_reap_surface_id(qdev, 2);
448 		goto again;
449 	}
450 	surf->surface_id = handle;
451 
452 	spin_lock(&qdev->surf_id_idr_lock);
453 	qdev->last_alloced_surf_id = handle;
454 	spin_unlock(&qdev->surf_id_idr_lock);
455 	return 0;
456 }
457 
qxl_surface_id_dealloc(struct qxl_device * qdev,uint32_t surface_id)458 void qxl_surface_id_dealloc(struct qxl_device *qdev,
459 			    uint32_t surface_id)
460 {
461 	spin_lock(&qdev->surf_id_idr_lock);
462 	idr_remove(&qdev->surf_id_idr, surface_id);
463 	spin_unlock(&qdev->surf_id_idr_lock);
464 }
465 
qxl_hw_surface_alloc(struct qxl_device * qdev,struct qxl_bo * surf)466 int qxl_hw_surface_alloc(struct qxl_device *qdev,
467 			 struct qxl_bo *surf)
468 {
469 	struct qxl_surface_cmd *cmd;
470 	struct qxl_release *release;
471 	int ret;
472 
473 	if (surf->hw_surf_alloc)
474 		return 0;
475 
476 	ret = qxl_alloc_surface_release_reserved(qdev, QXL_SURFACE_CMD_CREATE,
477 						 NULL,
478 						 &release);
479 	if (ret)
480 		return ret;
481 
482 	ret = qxl_release_reserve_list(release, true);
483 	if (ret)
484 		return ret;
485 
486 	cmd = (struct qxl_surface_cmd *)qxl_release_map(qdev, release);
487 	cmd->type = QXL_SURFACE_CMD_CREATE;
488 	cmd->flags = QXL_SURF_FLAG_KEEP_DATA;
489 	cmd->u.surface_create.format = surf->surf.format;
490 	cmd->u.surface_create.width = surf->surf.width;
491 	cmd->u.surface_create.height = surf->surf.height;
492 	cmd->u.surface_create.stride = surf->surf.stride;
493 	cmd->u.surface_create.data = qxl_bo_physical_address(qdev, surf, 0);
494 	cmd->surface_id = surf->surface_id;
495 	qxl_release_unmap(qdev, release, &cmd->release_info);
496 
497 	surf->surf_create = release;
498 
499 	/* no need to add a release to the fence for this surface bo,
500 	   since it is only released when we ask to destroy the surface
501 	   and it would never signal otherwise */
502 	qxl_push_command_ring_release(qdev, release, QXL_CMD_SURFACE, false);
503 	qxl_release_fence_buffer_objects(release);
504 
505 	surf->hw_surf_alloc = true;
506 	spin_lock(&qdev->surf_id_idr_lock);
507 	idr_replace(&qdev->surf_id_idr, surf, surf->surface_id);
508 	spin_unlock(&qdev->surf_id_idr_lock);
509 	return 0;
510 }
511 
qxl_hw_surface_dealloc(struct qxl_device * qdev,struct qxl_bo * surf)512 int qxl_hw_surface_dealloc(struct qxl_device *qdev,
513 			   struct qxl_bo *surf)
514 {
515 	struct qxl_surface_cmd *cmd;
516 	struct qxl_release *release;
517 	int ret;
518 	int id;
519 
520 	if (!surf->hw_surf_alloc)
521 		return 0;
522 
523 	ret = qxl_alloc_surface_release_reserved(qdev, QXL_SURFACE_CMD_DESTROY,
524 						 surf->surf_create,
525 						 &release);
526 	if (ret)
527 		return ret;
528 
529 	surf->surf_create = NULL;
530 	/* remove the surface from the idr, but not the surface id yet */
531 	spin_lock(&qdev->surf_id_idr_lock);
532 	idr_replace(&qdev->surf_id_idr, NULL, surf->surface_id);
533 	spin_unlock(&qdev->surf_id_idr_lock);
534 	surf->hw_surf_alloc = false;
535 
536 	id = surf->surface_id;
537 	surf->surface_id = 0;
538 
539 	release->surface_release_id = id;
540 	cmd = (struct qxl_surface_cmd *)qxl_release_map(qdev, release);
541 	cmd->type = QXL_SURFACE_CMD_DESTROY;
542 	cmd->surface_id = id;
543 	qxl_release_unmap(qdev, release, &cmd->release_info);
544 
545 	qxl_push_command_ring_release(qdev, release, QXL_CMD_SURFACE, false);
546 
547 	qxl_release_fence_buffer_objects(release);
548 
549 	return 0;
550 }
551 
qxl_update_surface(struct qxl_device * qdev,struct qxl_bo * surf)552 static int qxl_update_surface(struct qxl_device *qdev, struct qxl_bo *surf)
553 {
554 	struct qxl_rect rect;
555 	int ret;
556 
557 	/* if we are evicting, we need to make sure the surface is up
558 	   to date */
559 	rect.left = 0;
560 	rect.right = surf->surf.width;
561 	rect.top = 0;
562 	rect.bottom = surf->surf.height;
563 retry:
564 	ret = qxl_io_update_area(qdev, surf, &rect);
565 	if (ret == -ERESTARTSYS)
566 		goto retry;
567 	return ret;
568 }
569 
qxl_surface_evict_locked(struct qxl_device * qdev,struct qxl_bo * surf,bool do_update_area)570 static void qxl_surface_evict_locked(struct qxl_device *qdev, struct qxl_bo *surf, bool do_update_area)
571 {
572 	/* no need to update area if we are just freeing the surface normally */
573 	if (do_update_area)
574 		qxl_update_surface(qdev, surf);
575 
576 	/* nuke the surface id at the hw */
577 	qxl_hw_surface_dealloc(qdev, surf);
578 }
579 
qxl_surface_evict(struct qxl_device * qdev,struct qxl_bo * surf,bool do_update_area)580 void qxl_surface_evict(struct qxl_device *qdev, struct qxl_bo *surf, bool do_update_area)
581 {
582 	mutex_lock(&qdev->surf_evict_mutex);
583 	qxl_surface_evict_locked(qdev, surf, do_update_area);
584 	mutex_unlock(&qdev->surf_evict_mutex);
585 }
586 
qxl_reap_surf(struct qxl_device * qdev,struct qxl_bo * surf,bool stall)587 static int qxl_reap_surf(struct qxl_device *qdev, struct qxl_bo *surf, bool stall)
588 {
589 	int ret;
590 
591 	ret = qxl_bo_reserve(surf, false);
592 	if (ret)
593 		return ret;
594 
595 	if (stall)
596 		mutex_unlock(&qdev->surf_evict_mutex);
597 
598 	ret = ttm_bo_wait(&surf->tbo, true, !stall);
599 
600 	if (stall)
601 		mutex_lock(&qdev->surf_evict_mutex);
602 	if (ret) {
603 		qxl_bo_unreserve(surf);
604 		return ret;
605 	}
606 
607 	qxl_surface_evict_locked(qdev, surf, true);
608 	qxl_bo_unreserve(surf);
609 	return 0;
610 }
611 
qxl_reap_surface_id(struct qxl_device * qdev,int max_to_reap)612 static int qxl_reap_surface_id(struct qxl_device *qdev, int max_to_reap)
613 {
614 	int num_reaped = 0;
615 	int i, ret;
616 	bool stall = false;
617 	int start = 0;
618 
619 	mutex_lock(&qdev->surf_evict_mutex);
620 again:
621 
622 	spin_lock(&qdev->surf_id_idr_lock);
623 	start = qdev->last_alloced_surf_id + 1;
624 	spin_unlock(&qdev->surf_id_idr_lock);
625 
626 	for (i = start; i < start + qdev->rom->n_surfaces; i++) {
627 		void *objptr;
628 		int surfid = i % qdev->rom->n_surfaces;
629 
630 		/* this avoids the case where the objects is in the
631 		   idr but has been evicted half way - its makes
632 		   the idr lookup atomic with the eviction */
633 		spin_lock(&qdev->surf_id_idr_lock);
634 		objptr = idr_find(&qdev->surf_id_idr, surfid);
635 		spin_unlock(&qdev->surf_id_idr_lock);
636 
637 		if (!objptr)
638 			continue;
639 
640 		ret = qxl_reap_surf(qdev, objptr, stall);
641 		if (ret == 0)
642 			num_reaped++;
643 		if (num_reaped >= max_to_reap)
644 			break;
645 	}
646 	if (num_reaped == 0 && stall == false) {
647 		stall = true;
648 		goto again;
649 	}
650 
651 	mutex_unlock(&qdev->surf_evict_mutex);
652 	if (num_reaped) {
653 		usleep_range(500, 1000);
654 		qxl_queue_garbage_collect(qdev, true);
655 	}
656 
657 	return 0;
658 }
659