/usr/src/sys/dev/pci/drm/i915/gem/i915_gem

Bug Summary

File:	dev/pci/drm/i915/gem/i915_gem_context.c
Warning:	line 2356, column 17 Potential leak of memory pointed to by 'ext_data.pc'

Annotated Source Code

Press '?' to see keyboard shortcuts

Show analyzer invocation

clang -cc1 -cc1 -triple amd64-unknown-openbsd7.4 -analyze -disable-free -clear-ast-before-backend -disable-llvm-verifier -discard-value-names -main-file-name i915_gem_context.c -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model static -mframe-pointer=all -relaxed-aliasing -ffp-contract=on -fno-rounding-math -mconstructor-aliases -ffreestanding -mcmodel=kernel -target-cpu x86-64 -target-feature +retpoline-indirect-calls -target-feature +retpoline-indirect-branches -target-feature -sse2 -target-feature -sse -target-feature -3dnow -target-feature -mmx -target-feature +save-args -target-feature +retpoline-external-thunk -disable-red-zone -no-implicit-float -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/usr/src/sys/arch/amd64/compile/GENERIC.MP/obj -nostdsysteminc -nobuiltininc -resource-dir /usr/local/llvm16/lib/clang/16 -I /usr/src/sys -I /usr/src/sys/arch/amd64/compile/GENERIC.MP/obj -I /usr/src/sys/arch -I /usr/src/sys/dev/pci/drm/include -I /usr/src/sys/dev/pci/drm/include/uapi -I /usr/src/sys/dev/pci/drm/amd/include/asic_reg -I /usr/src/sys/dev/pci/drm/amd/include -I /usr/src/sys/dev/pci/drm/amd/amdgpu -I /usr/src/sys/dev/pci/drm/amd/display -I /usr/src/sys/dev/pci/drm/amd/display/include -I /usr/src/sys/dev/pci/drm/amd/display/dc -I /usr/src/sys/dev/pci/drm/amd/display/amdgpu_dm -I /usr/src/sys/dev/pci/drm/amd/pm/inc -I /usr/src/sys/dev/pci/drm/amd/pm/legacy-dpm -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu/inc -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu/smu11 -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu/smu12 -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu/smu13 -I /usr/src/sys/dev/pci/drm/amd/pm/powerplay/inc -I /usr/src/sys/dev/pci/drm/amd/pm/powerplay/hwmgr -I /usr/src/sys/dev/pci/drm/amd/pm/powerplay/smumgr -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu/inc -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu/inc/pmfw_if -I /usr/src/sys/dev/pci/drm/amd/display/dc/inc -I /usr/src/sys/dev/pci/drm/amd/display/dc/inc/hw -I /usr/src/sys/dev/pci/drm/amd/display/dc/clk_mgr -I /usr/src/sys/dev/pci/drm/amd/display/modules/inc -I /usr/src/sys/dev/pci/drm/amd/display/modules/hdcp -I /usr/src/sys/dev/pci/drm/amd/display/dmub/inc -I /usr/src/sys/dev/pci/drm/i915 -D DDB -D DIAGNOSTIC -D KTRACE -D ACCOUNTING -D KMEMSTATS -D PTRACE -D POOL_DEBUG -D CRYPTO -D SYSVMSG -D SYSVSEM -D SYSVSHM -D UVM_SWAP_ENCRYPT -D FFS -D FFS2 -D FFS_SOFTUPDATES -D UFS_DIRHASH -D QUOTA -D EXT2FS -D MFS -D NFSCLIENT -D NFSSERVER -D CD9660 -D UDF -D MSDOSFS -D FIFO -D FUSE -D SOCKET_SPLICE -D TCP_ECN -D TCP_SIGNATURE -D INET6 -D IPSEC -D PPP_BSDCOMP -D PPP_DEFLATE -D PIPEX -D MROUTING -D MPLS -D BOOT_CONFIG -D USER_PCICONF -D APERTURE -D MTRR -D NTFS -D SUSPEND -D HIBERNATE -D PCIVERBOSE -D USBVERBOSE -D WSDISPLAY_COMPAT_USL -D WSDISPLAY_COMPAT_RAWKBD -D WSDISPLAY_DEFAULTSCREENS=6 -D X86EMU -D ONEWIREVERBOSE -D MULTIPROCESSOR -D MAXUSERS=80 -D _KERNEL -O2 -Wno-pointer-sign -Wno-address-of-packed-member -Wno-constant-conversion -Wno-unused-but-set-variable -Wno-gnu-folding-constant -fdebug-compilation-dir=/usr/src/sys/arch/amd64/compile/GENERIC.MP/obj -ferror-limit 19 -fwrapv -D_RET_PROTECTOR -ret-protector -fcf-protection=branch -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-valloc -fno-builtin-free -fno-builtin-strdup -fno-builtin-strndup -analyzer-output=html -faddrsig -o /home/ben/Projects/scan/2024-01-11-110808-61670-1 -x c /usr/src/sys/dev/pci/drm/i915/gem/i915_gem_context.c

/usr/src/sys/dev/pci/drm/i915/gem/i915_gem_context.c

→

1/*
* SPDX-License-Identifier: MIT
*
* Copyright © 2011-2012 Intel Corporation
*/

7/*
* This file implements HW context support. On gen5+ a HW context consists of an
* opaque GPU object which is referenced at times of context saves and restores.
* With RC6 enabled, the context is also referenced as the GPU enters and exists
* from RC6 (GPU has it's own internal power context, except on gen5). Though
* something like a context does exist for the media ring, the code only
* supports contexts for the render ring.
*
* In software, there is a distinction between contexts created by the user,
* and the default HW context. The default HW context is used by GPU clients
* that do not request setup of their own hardware context. The default
* context's state is never restored to help prevent programming errors. This
* would happen if a client ran and piggy-backed off another clients GPU state.
* The default context only exists to give the GPU some offset to load as the
* current to invoke a save of the context we actually care about. In fact, the
* code could likely be constructed, albeit in a more complicated fashion, to
* never use the default context, though that limits the driver's ability to
* swap out, and/or destroy other contexts.
*
* All other contexts are created as a request by the GPU client. These contexts
* store GPU state, and thus allow GPU clients to not re-emit state (and
* potentially query certain state) at any time. The kernel driver makes
* certain that the appropriate commands are inserted.
*
* The context life cycle is semi-complicated in that context BOs may live
* longer than the context itself because of the way the hardware, and object
* tracking works. Below is a very crude representation of the state machine
* describing the context life.
*                                         refcount     pincount     active
* S0: initial state                          0            0           0
* S1: context created                        1            0           0
* S2: context is currently running           2            1           X
* S3: GPU referenced, but not current        2            0           1
* S4: context is current, but destroyed      1            1           0
* S5: like S3, but destroyed                 1            0           1
*
* The most common (but not all) transitions:
* S0->S1: client creates a context
* S1->S2: client submits execbuf with context
* S2->S3: other clients submits execbuf with context
* S3->S1: context object was retired
* S3->S2: clients submits another execbuf
* S2->S4: context destroy called with current context
* S3->S5->S0: destroy path
* S4->S5->S0: destroy path on current context
*
* There are two confusing terms used above:
*  The "current context" means the context which is currently running on the
*  GPU. The GPU has loaded its state already and has stored away the gtt
*  offset of the BO. The GPU is not actively referencing the data at this
*  offset, but it will on the next context switch. The only way to avoid this
*  is to do a GPU reset.
*
*  An "active context' is one which was previously the "current context" and is
*  on the active list waiting for the next context switch to occur. Until this
*  happens, the object must remain at the same gtt offset. It is therefore
*  possible to destroy a context, but it is still active.
*
*/

67#include <linux/highmem.h>
68#include <linux/log2.h>
69#include <linux/nospec.h>

71#include <drm/drm_cache.h>
72#include <drm/drm_syncobj.h>

74#include "gt/gen6_ppgtt.h"
75#include "gt/intel_context.h"
76#include "gt/intel_context_param.h"
77#include "gt/intel_engine_heartbeat.h"
78#include "gt/intel_engine_user.h"
79#include "gt/intel_gpu_commands.h"
80#include "gt/intel_ring.h"

82#include "pxp/intel_pxp.h"

84#include "i915_file_private.h"
85#include "i915_gem_context.h"
86#include "i915_trace.h"
87#include "i915_user_extensions.h"

89#define ALL_L3_SLICES(dev)(1 << ((IS_PLATFORM(dev, INTEL_HASWELL) && (&
(dev)->__info)->gt == 3) ? 2 : ((&(dev)->__info)
->has_l3_dpf))) - 1 (1 << NUM_L3_SLICES(dev)((IS_PLATFORM(dev, INTEL_HASWELL) && (&(dev)->
__info)->gt == 3) ? 2 : ((&(dev)->__info)->has_l3_dpf
))) - 1

91static struct pool slab_luts;

93struct i915_lut_handle *i915_lut_handle_alloc(void)
94{
95#ifdef __linux__
return kmem_cache_alloc(slab_luts, GFP_KERNEL(0x0001 | 0x0004));
97#else
return pool_get(&slab_luts, PR_WAITOK0x0001);
99#endif
100}

102void i915_lut_handle_free(struct i915_lut_handle *lut)
103{
104#ifdef __linux__
return kmem_cache_free(slab_luts, lut);
106#else
pool_put(&slab_luts, lut);
108#endif
109}

111static void lut_close(struct i915_gem_context *ctx)
112{
struct radix_tree_iter iter;
void __rcu **slot;

mutex_lock(&ctx->lut_mutex)rw_enter_write(&ctx->lut_mutex);
rcu_read_lock();
radix_tree_for_each_slot(slot, &ctx->handles_vma, &iter, 0)for ((&iter)->index = (0); radix_tree_iter_find(&ctx
->handles_vma, &iter, &(slot)); (&iter)->index
++) {
struct i915_vma *vma = rcu_dereference_raw(*slot)(*slot);
struct drm_i915_gem_object *obj = vma->obj;
struct i915_lut_handle *lut;

if (!kref_get_unless_zero(&obj->base.refcount))
	continue;

spin_lock(&obj->lut_lock)mtx_enter(&obj->lut_lock);
list_for_each_entry(lut, &obj->lut_list, obj_link)for (lut = ({ const __typeof( ((__typeof(*lut) *)0)->obj_link
 ) *__mptr = ((&obj->lut_list)->next); (__typeof(*lut
) *)( (char *)__mptr - __builtin_offsetof(__typeof(*lut), obj_link
) );}); &lut->obj_link != (&obj->lut_list); lut
 = ({ const __typeof( ((__typeof(*lut) *)0)->obj_link ) *__mptr
 = (lut->obj_link.next); (__typeof(*lut) *)( (char *)__mptr
 - __builtin_offsetof(__typeof(*lut), obj_link) );})) {
	if (lut->ctx != ctx)
		continue;

	if (lut->handle != iter.index)
		continue;

	list_del(&lut->obj_link);
	break;
}
spin_unlock(&obj->lut_lock)mtx_leave(&obj->lut_lock);

if (&lut->obj_link != &obj->lut_list) {
	i915_lut_handle_free(lut);
	radix_tree_iter_delete(&ctx->handles_vma, &iter, slot);
	i915_vma_close(vma);
	i915_gem_object_put(obj);
}

i915_gem_object_put(obj);
}
rcu_read_unlock();
mutex_unlock(&ctx->lut_mutex)rw_exit_write(&ctx->lut_mutex);
150}

152static struct intel_context *
153lookup_user_engine(struct i915_gem_context *ctx,
   unsigned long flags,
   const struct i915_engine_class_instance *ci)
156#define LOOKUP_USER_INDEX(1UL << (0)) BIT(0)(1UL << (0))
157{
int idx;

if (!!(flags & LOOKUP_USER_INDEX(1UL << (0))) != i915_gem_context_user_engines(ctx))
return ERR_PTR(-EINVAL22);

if (!i915_gem_context_user_engines(ctx)) {
struct intel_engine_cs *engine;

engine = intel_engine_lookup_user(ctx->i915,
				  ci->engine_class,
				  ci->engine_instance);
if (!engine)
	return ERR_PTR(-EINVAL22);

idx = engine->legacy_idx;
} else {
idx = ci->engine_instance;
}

return i915_gem_context_get_engine(ctx, idx);
178}

180static int validate_priority(struct drm_i915_privateinteldrm_softc *i915,
	     const struct drm_i915_gem_context_param *args)
182{
s64 priority = args->value;

if (args->size)
return -EINVAL22;

if (!(i915->caps.scheduler & I915_SCHEDULER_CAP_PRIORITY(1ul << 1)))
return -ENODEV19;

if (priority > I915_CONTEXT_MAX_USER_PRIORITY1023 ||
   priority < I915_CONTEXT_MIN_USER_PRIORITY-1023)
return -EINVAL22;

if (priority > I915_CONTEXT_DEFAULT_PRIORITY0 &&
   !capable(CAP_SYS_NICE0x2))
return -EPERM1;

return 0;
200}

202static void proto_context_close(struct drm_i915_privateinteldrm_softc *i915,
		struct i915_gem_proto_context *pc)
204{
int i;

if (pc->pxp_wakeref)
intel_runtime_pm_put(&i915->runtime_pm, pc->pxp_wakeref);
if (pc->vm)
i915_vm_put(pc->vm);
if (pc->user_engines) {
for (i = 0; i < pc->num_user_engines; i++)
	kfree(pc->user_engines[i].siblings);
kfree(pc->user_engines);
}
kfree(pc);
217}

219static int proto_context_set_persistence(struct drm_i915_privateinteldrm_softc *i915,
			 struct i915_gem_proto_context *pc,
			 bool_Bool persist)
222{
if (persist) {
/*
 * Only contexts that are short-lived [that will expire or be
 * reset] are allowed to survive past termination. We require
 * hangcheck to ensure that the persistent requests are healthy.
 */
if (!i915->params.enable_hangcheck)
	return -EINVAL22;

pc->user_flags |= BIT(UCONTEXT_PERSISTENCE)(1UL << (4));
} else {
/* To cancel a context we use "preempt-to-idle" */
if (!(i915->caps.scheduler & I915_SCHEDULER_CAP_PREEMPTION(1ul << 2)))
	return -ENODEV19;

/*
 * If the cancel fails, we then need to reset, cleanly!
 *
 * If the per-engine reset fails, all hope is lost! We resort
 * to a full GPU reset in that unlikely case, but realistically
 * if the engine could not reset, the full reset does not fare
 * much better. The damage has been done.
 *
 * However, if we cannot reset an engine by itself, we cannot
 * cleanup a hanging persistent context without causing
 * colateral damage, and we should not pretend we can by
 * exposing the interface.
 */
if (!intel_has_reset_engine(to_gt(i915)))
	return -ENODEV19;

pc->user_flags &= ~BIT(UCONTEXT_PERSISTENCE)(1UL << (4));
}

return 0;
258}

260static int proto_context_set_protected(struct drm_i915_privateinteldrm_softc *i915,
		       struct i915_gem_proto_context *pc,
		       bool_Bool protected)
263{
int ret = 0;

if (!protected) {
pc->uses_protected_content = false0;
} else if (!intel_pxp_is_enabled(&to_gt(i915)->pxp)) {
ret = -ENODEV19;
} else if ((pc->user_flags & BIT(UCONTEXT_RECOVERABLE)(1UL << (3))) ||
   !(pc->user_flags & BIT(UCONTEXT_BANNABLE)(1UL << (2)))) {
ret = -EPERM1;
} else {
pc->uses_protected_content = true1;

/*
 * protected context usage requires the PXP session to be up,
 * which in turn requires the device to be active.
 */
pc->pxp_wakeref = intel_runtime_pm_get(&i915->runtime_pm);

if (!intel_pxp_is_active(&to_gt(i915)->pxp))
	ret = intel_pxp_start(&to_gt(i915)->pxp);
}

return ret;
287}

289static struct i915_gem_proto_context *
290proto_context_create(struct drm_i915_privateinteldrm_softc *i915, unsigned int flags)
291{
struct i915_gem_proto_context *pc, *err;

pc = kzalloc(sizeof(*pc), GFP_KERNEL(0x0001 | 0x0004));
9
←
Calling 'kzalloc'→
11
←
Returned allocated memory→
if (!pc)
12
←
Assuming 'pc' is non-null→
13
←
Taking false branch→
return ERR_PTR(-ENOMEM12);

pc->num_user_engines = -1;
pc->user_engines = NULL((void *)0);
pc->user_flags = BIT(UCONTEXT_BANNABLE)(1UL << (2)) |
	 BIT(UCONTEXT_RECOVERABLE)(1UL << (3));
if (i915->params.enable_hangcheck)
14
←
Assuming field 'enable_hangcheck' is false→
15
←
Taking false branch→
pc->user_flags |= BIT(UCONTEXT_PERSISTENCE)(1UL << (4));
pc->sched.priority = I915_PRIORITY_NORMAL;

if (flags & I915_CONTEXT_CREATE_FLAGS_SINGLE_TIMELINE(1u << 1)) {
16
←
Assuming the condition is false→
17
←
Taking false branch→
if (!HAS_EXECLISTS(i915)((&(i915)->__info)->has_logical_ring_contexts)) {
	err = ERR_PTR(-EINVAL22);
	goto proto_close;
}
pc->single_timeline = true1;
}

return pc;

316proto_close:
proto_context_close(i915, pc);
return err;
319}

321static int proto_context_register_locked(struct drm_i915_file_private *fpriv,
			 struct i915_gem_proto_context *pc,
			 u32 *id)
324{
int ret;
void *old;

lockdep_assert_held(&fpriv->proto_context_lock)do { (void)(&fpriv->proto_context_lock); } while(0);

ret = xa_alloc(&fpriv->context_xa, id, NULL((void *)0), xa_limit_32b0, GFP_KERNEL(0x0001 | 0x0004));
if (ret)
return ret;

old = xa_store(&fpriv->proto_context_xa, *id, pc, GFP_KERNEL(0x0001 | 0x0004));
if (xa_is_err(old)) {
xa_erase(&fpriv->context_xa, *id);
return xa_err(old);
}
WARN_ON(old)({ int __ret = !!(old); if (__ret) printf("WARNING %s failed at %s:%d\n"
, "old", "/usr/src/sys/dev/pci/drm/i915/gem/i915_gem_context.c"
, 339); __builtin_expect(!!(__ret), 0); });

return 0;
342}

344static int proto_context_register(struct drm_i915_file_private *fpriv,
		  struct i915_gem_proto_context *pc,
		  u32 *id)
347{
int ret;

mutex_lock(&fpriv->proto_context_lock)rw_enter_write(&fpriv->proto_context_lock);
ret = proto_context_register_locked(fpriv, pc, id);
mutex_unlock(&fpriv->proto_context_lock)rw_exit_write(&fpriv->proto_context_lock);

return ret;
355}

357static struct i915_address_space *
358i915_gem_vm_lookup(struct drm_i915_file_private *file_priv, u32 id)
359{
struct i915_address_space *vm;

xa_lock(&file_priv->vm_xa)do { mtx_enter(&(&file_priv->vm_xa)->xa_lock); }
 while (0);
vm = xa_load(&file_priv->vm_xa, id);
if (vm)
kref_get(&vm->ref);
xa_unlock(&file_priv->vm_xa)do { mtx_leave(&(&file_priv->vm_xa)->xa_lock); }
 while (0);

return vm;
369}

371static int set_proto_ctx_vm(struct drm_i915_file_private *fpriv,
	    struct i915_gem_proto_context *pc,
	    const struct drm_i915_gem_context_param *args)
374{
struct drm_i915_privateinteldrm_softc *i915 = fpriv->dev_priv;
struct i915_address_space *vm;

if (args->size)
return -EINVAL22;

if (!HAS_FULL_PPGTT(i915)(((&(i915)->__runtime)->ppgtt_type) >= INTEL_PPGTT_FULL
))
return -ENODEV19;

if (upper_32_bits(args->value)((u32)(((args->value) >> 16) >> 16)))
return -ENOENT2;

vm = i915_gem_vm_lookup(fpriv, args->value);
if (!vm)
return -ENOENT2;

if (pc->vm)
i915_vm_put(pc->vm);
pc->vm = vm;

return 0;
396}

398struct set_proto_ctx_engines {
struct drm_i915_privateinteldrm_softc *i915;
unsigned num_engines;
struct i915_gem_proto_engine *engines;
402};

404static int
405set_proto_ctx_engines_balance(struct i915_user_extension __user *base,
	      void *data)
407{
struct i915_context_engines_load_balance __user *ext =
container_of_user(base, typeof(*ext), base)({ void *__mptr = (void *)(base); do { } while (0); ((typeof(
*ext) *)(__mptr - __builtin_offsetof(typeof(*ext), base))); }
);
const struct set_proto_ctx_engines *set = data;
struct drm_i915_privateinteldrm_softc *i915 = set->i915;
struct intel_engine_cs **siblings;
u16 num_siblings, idx;
unsigned int n;
int err;

if (!HAS_EXECLISTS(i915)((&(i915)->__info)->has_logical_ring_contexts))
return -ENODEV19;

if (get_user(idx, &ext->engine_index)-copyin(&ext->engine_index, &(idx), sizeof(idx)))
return -EFAULT14;

if (idx >= set->num_engines) {
drm_dbg(&i915->drm, "Invalid placement value, %d >= %d\n",__drm_dev_dbg(((void *)0), (&i915->drm) ? (&i915->
drm)->dev : ((void *)0), DRM_UT_DRIVER, "Invalid placement value, %d >= %d\n"
, idx, set->num_engines)
	idx, set->num_engines)__drm_dev_dbg(((void *)0), (&i915->drm) ? (&i915->
drm)->dev : ((void *)0), DRM_UT_DRIVER, "Invalid placement value, %d >= %d\n"
, idx, set->num_engines);
return -EINVAL22;
}

idx = array_index_nospec(idx, set->num_engines)(idx);
if (set->engines[idx].type != I915_GEM_ENGINE_TYPE_INVALID) {
drm_dbg(&i915->drm,__drm_dev_dbg(((void *)0), (&i915->drm) ? (&i915->
drm)->dev : ((void *)0), DRM_UT_DRIVER, "Invalid placement[%d], already occupied\n"
, idx)
	"Invalid placement[%d], already occupied\n", idx)__drm_dev_dbg(((void *)0), (&i915->drm) ? (&i915->
drm)->dev : ((void *)0), DRM_UT_DRIVER, "Invalid placement[%d], already occupied\n"
, idx);
return -EEXIST17;
}

if (get_user(num_siblings, &ext->num_siblings)-copyin(&ext->num_siblings, &(num_siblings), sizeof
(num_siblings)))
return -EFAULT14;

err = check_user_mbz(&ext->flags)({ typeof(*(&ext->flags)) mbz__; -copyin((&ext->
flags), &(mbz__), sizeof(mbz__)) ? -14 : mbz__ ? -22 : 0;
 });
if (err)
return err;

err = check_user_mbz(&ext->mbz64)({ typeof(*(&ext->mbz64)) mbz__; -copyin((&ext->
mbz64), &(mbz__), sizeof(mbz__)) ? -14 : mbz__ ? -22 : 0;
 });
if (err)
return err;

if (num_siblings == 0)
return 0;

siblings = kmalloc_array(num_siblings, sizeof(*siblings), GFP_KERNEL(0x0001 | 0x0004));
if (!siblings)
return -ENOMEM12;

for (n = 0; n < num_siblings; n++) {
struct i915_engine_class_instance ci;

if (copy_from_user(&ci, &ext->engines[n], sizeof(ci))) {
	err = -EFAULT14;
	goto err_siblings;
}

siblings[n] = intel_engine_lookup_user(i915,
				       ci.engine_class,
				       ci.engine_instance);
if (!siblings[n]) {
	drm_dbg(&i915->drm,__drm_dev_dbg(((void *)0), (&i915->drm) ? (&i915->
drm)->dev : ((void *)0), DRM_UT_DRIVER, "Invalid sibling[%d]: { class:%d, inst:%d }\n"
, n, ci.engine_class, ci.engine_instance)
		"Invalid sibling[%d]: { class:%d, inst:%d }\n",__drm_dev_dbg(((void *)0), (&i915->drm) ? (&i915->
drm)->dev : ((void *)0), DRM_UT_DRIVER, "Invalid sibling[%d]: { class:%d, inst:%d }\n"
, n, ci.engine_class, ci.engine_instance)
		n, ci.engine_class, ci.engine_instance)__drm_dev_dbg(((void *)0), (&i915->drm) ? (&i915->
drm)->dev : ((void *)0), DRM_UT_DRIVER, "Invalid sibling[%d]: { class:%d, inst:%d }\n"
, n, ci.engine_class, ci.engine_instance);
	err = -EINVAL22;
	goto err_siblings;
}
}

if (num_siblings == 1) {
set->engines[idx].type = I915_GEM_ENGINE_TYPE_PHYSICAL;
set->engines[idx].engine = siblings[0];
kfree(siblings);
} else {
set->engines[idx].type = I915_GEM_ENGINE_TYPE_BALANCED;
set->engines[idx].num_siblings = num_siblings;
set->engines[idx].siblings = siblings;
}

return 0;

486err_siblings:
kfree(siblings);

return err;
490}

492static int
493set_proto_ctx_engines_bond(struct i915_user_extension __user *base, void *data)
494{
struct i915_context_engines_bond __user *ext =
container_of_user(base, typeof(*ext), base)({ void *__mptr = (void *)(base); do { } while (0); ((typeof(
*ext) *)(__mptr - __builtin_offsetof(typeof(*ext), base))); }
);
const struct set_proto_ctx_engines *set = data;
struct drm_i915_privateinteldrm_softc *i915 = set->i915;
struct i915_engine_class_instance ci;
struct intel_engine_cs *master;
u16 idx, num_bonds;
int err, n;

if (GRAPHICS_VER(i915)((&(i915)->__runtime)->graphics.ip.ver) >= 12 && !IS_TIGERLAKE(i915)IS_PLATFORM(i915, INTEL_TIGERLAKE) &&
   !IS_ROCKETLAKE(i915)IS_PLATFORM(i915, INTEL_ROCKETLAKE) && !IS_ALDERLAKE_S(i915)IS_PLATFORM(i915, INTEL_ALDERLAKE_S)) {
drm_dbg(&i915->drm,__drm_dev_dbg(((void *)0), (&i915->drm) ? (&i915->
drm)->dev : ((void *)0), DRM_UT_DRIVER, "Bonding not supported on this platform\n"
)
	"Bonding not supported on this platform\n")__drm_dev_dbg(((void *)0), (&i915->drm) ? (&i915->
drm)->dev : ((void *)0), DRM_UT_DRIVER, "Bonding not supported on this platform\n"
);
return -ENODEV19;
}

if (get_user(idx, &ext->virtual_index)-copyin(&ext->virtual_index, &(idx), sizeof(idx)))
return -EFAULT14;

if (idx >= set->num_engines) {
drm_dbg(&i915->drm,__drm_dev_dbg(((void *)0), (&i915->drm) ? (&i915->
drm)->dev : ((void *)0), DRM_UT_DRIVER, "Invalid index for virtual engine: %d >= %d\n"
, idx, set->num_engines)
	"Invalid index for virtual engine: %d >= %d\n",__drm_dev_dbg(((void *)0), (&i915->drm) ? (&i915->
drm)->dev : ((void *)0), DRM_UT_DRIVER, "Invalid index for virtual engine: %d >= %d\n"
, idx, set->num_engines)
	idx, set->num_engines)__drm_dev_dbg(((void *)0), (&i915->drm) ? (&i915->
drm)->dev : ((void *)0), DRM_UT_DRIVER, "Invalid index for virtual engine: %d >= %d\n"
, idx, set->num_engines);
return -EINVAL22;
}

idx = array_index_nospec(idx, set->num_engines)(idx);
if (set->engines[idx].type == I915_GEM_ENGINE_TYPE_INVALID) {
drm_dbg(&i915->drm, "Invalid engine at %d\n", idx)__drm_dev_dbg(((void *)0), (&i915->drm) ? (&i915->
drm)->dev : ((void *)0), DRM_UT_DRIVER, "Invalid engine at %d\n"
, idx);
return -EINVAL22;
}

if (set->engines[idx].type != I915_GEM_ENGINE_TYPE_PHYSICAL) {
drm_dbg(&i915->drm,__drm_dev_dbg(((void *)0), (&i915->drm) ? (&i915->
drm)->dev : ((void *)0), DRM_UT_DRIVER, "Bonding with virtual engines not allowed\n"
)
	"Bonding with virtual engines not allowed\n")__drm_dev_dbg(((void *)0), (&i915->drm) ? (&i915->
drm)->dev : ((void *)0), DRM_UT_DRIVER, "Bonding with virtual engines not allowed\n"
);
return -EINVAL22;
}

err = check_user_mbz(&ext->flags)({ typeof(*(&ext->flags)) mbz__; -copyin((&ext->
flags), &(mbz__), sizeof(mbz__)) ? -14 : mbz__ ? -22 : 0;
 });
if (err)
return err;

for (n = 0; n < ARRAY_SIZE(ext->mbz64)(sizeof((ext->mbz64)) / sizeof((ext->mbz64)[0])); n++) {
err = check_user_mbz(&ext->mbz64[n])({ typeof(*(&ext->mbz64[n])) mbz__; -copyin((&ext->
mbz64[n]), &(mbz__), sizeof(mbz__)) ? -14 : mbz__ ? -22 :
 0; });
if (err)
	return err;
}

if (copy_from_user(&ci, &ext->master, sizeof(ci)))
return -EFAULT14;

master = intel_engine_lookup_user(i915,
			  ci.engine_class,
			  ci.engine_instance);
if (!master) {
drm_dbg(&i915->drm,__drm_dev_dbg(((void *)0), (&i915->drm) ? (&i915->
drm)->dev : ((void *)0), DRM_UT_DRIVER, "Unrecognised master engine: { class:%u, instance:%u }\n"
, ci.engine_class, ci.engine_instance)
	"Unrecognised master engine: { class:%u, instance:%u }\n",__drm_dev_dbg(((void *)0), (&i915->drm) ? (&i915->
drm)->dev : ((void *)0), DRM_UT_DRIVER, "Unrecognised master engine: { class:%u, instance:%u }\n"
, ci.engine_class, ci.engine_instance)
	ci.engine_class, ci.engine_instance)__drm_dev_dbg(((void *)0), (&i915->drm) ? (&i915->
drm)->dev : ((void *)0), DRM_UT_DRIVER, "Unrecognised master engine: { class:%u, instance:%u }\n"
, ci.engine_class, ci.engine_instance);
return -EINVAL22;
}

if (intel_engine_uses_guc(master)) {
DRM_DEBUG("bonding extension not supported with GuC submission")___drm_dbg(((void *)0), DRM_UT_CORE, "bonding extension not supported with GuC submission"
);
return -ENODEV19;
}

if (get_user(num_bonds, &ext->num_bonds)-copyin(&ext->num_bonds, &(num_bonds), sizeof(num_bonds
)))
return -EFAULT14;

for (n = 0; n < num_bonds; n++) {
struct intel_engine_cs *bond;

if (copy_from_user(&ci, &ext->engines[n], sizeof(ci)))
	return -EFAULT14;

bond = intel_engine_lookup_user(i915,
				ci.engine_class,
				ci.engine_instance);
if (!bond) {
	drm_dbg(&i915->drm,__drm_dev_dbg(((void *)0), (&i915->drm) ? (&i915->
drm)->dev : ((void *)0), DRM_UT_DRIVER, "Unrecognised engine[%d] for bonding: { class:%d, instance: %d }\n"
, n, ci.engine_class, ci.engine_instance)
		"Unrecognised engine[%d] for bonding: { class:%d, instance: %d }\n",__drm_dev_dbg(((void *)0), (&i915->drm) ? (&i915->
drm)->dev : ((void *)0), DRM_UT_DRIVER, "Unrecognised engine[%d] for bonding: { class:%d, instance: %d }\n"
, n, ci.engine_class, ci.engine_instance)
		n, ci.engine_class, ci.engine_instance)__drm_dev_dbg(((void *)0), (&i915->drm) ? (&i915->
drm)->dev : ((void *)0), DRM_UT_DRIVER, "Unrecognised engine[%d] for bonding: { class:%d, instance: %d }\n"
, n, ci.engine_class, ci.engine_instance);
	return -EINVAL22;
}
}

return 0;
582}

584static int
585set_proto_ctx_engines_parallel_submit(struct i915_user_extension __user *base,
		      void *data)
587{
struct i915_context_engines_parallel_submit __user *ext =
container_of_user(base, typeof(*ext), base)({ void *__mptr = (void *)(base); do { } while (0); ((typeof(
*ext) *)(__mptr - __builtin_offsetof(typeof(*ext), base))); }
);
const struct set_proto_ctx_engines *set = data;
struct drm_i915_privateinteldrm_softc *i915 = set->i915;
struct i915_engine_class_instance prev_engine;
u64 flags;
int err = 0, n, i, j;
u16 slot, width, num_siblings;
struct intel_engine_cs **siblings = NULL((void *)0);
intel_engine_mask_t prev_mask;

if (get_user(slot, &ext->engine_index)-copyin(&ext->engine_index, &(slot), sizeof(slot)))
return -EFAULT14;

if (get_user(width, &ext->width)-copyin(&ext->width, &(width), sizeof(width)))
return -EFAULT14;

if (get_user(num_siblings, &ext->num_siblings)-copyin(&ext->num_siblings, &(num_siblings), sizeof
(num_siblings)))
return -EFAULT14;

if (!intel_uc_uses_guc_submission(&to_gt(i915)->uc) &&
   num_siblings != 1) {
drm_dbg(&i915->drm, "Only 1 sibling (%d) supported in non-GuC mode\n",__drm_dev_dbg(((void *)0), (&i915->drm) ? (&i915->
drm)->dev : ((void *)0), DRM_UT_DRIVER, "Only 1 sibling (%d) supported in non-GuC mode\n"
, num_siblings)
	num_siblings)__drm_dev_dbg(((void *)0), (&i915->drm) ? (&i915->
drm)->dev : ((void *)0), DRM_UT_DRIVER, "Only 1 sibling (%d) supported in non-GuC mode\n"
, num_siblings);
return -EINVAL22;
}

if (slot >= set->num_engines) {
drm_dbg(&i915->drm, "Invalid placement value, %d >= %d\n",__drm_dev_dbg(((void *)0), (&i915->drm) ? (&i915->
drm)->dev : ((void *)0), DRM_UT_DRIVER, "Invalid placement value, %d >= %d\n"
, slot, set->num_engines)
	slot, set->num_engines)__drm_dev_dbg(((void *)0), (&i915->drm) ? (&i915->
drm)->dev : ((void *)0), DRM_UT_DRIVER, "Invalid placement value, %d >= %d\n"
, slot, set->num_engines);
return -EINVAL22;
}

if (set->engines[slot].type != I915_GEM_ENGINE_TYPE_INVALID) {
drm_dbg(&i915->drm,__drm_dev_dbg(((void *)0), (&i915->drm) ? (&i915->
drm)->dev : ((void *)0), DRM_UT_DRIVER, "Invalid placement[%d], already occupied\n"
, slot)
	"Invalid placement[%d], already occupied\n", slot)__drm_dev_dbg(((void *)0), (&i915->drm) ? (&i915->
drm)->dev : ((void *)0), DRM_UT_DRIVER, "Invalid placement[%d], already occupied\n"
, slot);
return -EINVAL22;
}

if (get_user(flags, &ext->flags)-copyin(&ext->flags, &(flags), sizeof(flags)))
return -EFAULT14;

if (flags) {
drm_dbg(&i915->drm, "Unknown flags 0x%02llx", flags)__drm_dev_dbg(((void *)0), (&i915->drm) ? (&i915->
drm)->dev : ((void *)0), DRM_UT_DRIVER, "Unknown flags 0x%02llx"
, flags);
return -EINVAL22;
}

for (n = 0; n < ARRAY_SIZE(ext->mbz64)(sizeof((ext->mbz64)) / sizeof((ext->mbz64)[0])); n++) {
err = check_user_mbz(&ext->mbz64[n])({ typeof(*(&ext->mbz64[n])) mbz__; -copyin((&ext->
mbz64[n]), &(mbz__), sizeof(mbz__)) ? -14 : mbz__ ? -22 :
 0; });
if (err)
	return err;
}

if (width < 2) {
drm_dbg(&i915->drm, "Width (%d) < 2\n", width)__drm_dev_dbg(((void *)0), (&i915->drm) ? (&i915->
drm)->dev : ((void *)0), DRM_UT_DRIVER, "Width (%d) < 2\n"
, width);
return -EINVAL22;
}

if (num_siblings < 1) {
drm_dbg(&i915->drm, "Number siblings (%d) < 1\n",__drm_dev_dbg(((void *)0), (&i915->drm) ? (&i915->
drm)->dev : ((void *)0), DRM_UT_DRIVER, "Number siblings (%d) < 1\n"
, num_siblings)
	num_siblings)__drm_dev_dbg(((void *)0), (&i915->drm) ? (&i915->
drm)->dev : ((void *)0), DRM_UT_DRIVER, "Number siblings (%d) < 1\n"
, num_siblings);
return -EINVAL22;
}

siblings = kmalloc_array(num_siblings * width,
		 sizeof(*siblings),
		 GFP_KERNEL(0x0001 | 0x0004));
if (!siblings)
return -ENOMEM12;

/* Create contexts / engines */
for (i = 0; i < width; ++i) {
intel_engine_mask_t current_mask = 0;

for (j = 0; j < num_siblings; ++j) {
	struct i915_engine_class_instance ci;

	n = i * num_siblings + j;
	if (copy_from_user(&ci, &ext->engines[n], sizeof(ci))) {
		err = -EFAULT14;
		goto out_err;
	}

	siblings[n] =
		intel_engine_lookup_user(i915, ci.engine_class,
					 ci.engine_instance);
	if (!siblings[n]) {
		drm_dbg(&i915->drm,__drm_dev_dbg(((void *)0), (&i915->drm) ? (&i915->
drm)->dev : ((void *)0), DRM_UT_DRIVER, "Invalid sibling[%d]: { class:%d, inst:%d }\n"
, n, ci.engine_class, ci.engine_instance)
			"Invalid sibling[%d]: { class:%d, inst:%d }\n",__drm_dev_dbg(((void *)0), (&i915->drm) ? (&i915->
drm)->dev : ((void *)0), DRM_UT_DRIVER, "Invalid sibling[%d]: { class:%d, inst:%d }\n"
, n, ci.engine_class, ci.engine_instance)
			n, ci.engine_class, ci.engine_instance)__drm_dev_dbg(((void *)0), (&i915->drm) ? (&i915->
drm)->dev : ((void *)0), DRM_UT_DRIVER, "Invalid sibling[%d]: { class:%d, inst:%d }\n"
, n, ci.engine_class, ci.engine_instance);
		err = -EINVAL22;
		goto out_err;
	}

	/*
	 * We don't support breadcrumb handshake on these
	 * classes
	 */
	if (siblings[n]->class == RENDER_CLASS0 ||
	    siblings[n]->class == COMPUTE_CLASS5) {
		err = -EINVAL22;
		goto out_err;
	}

	if (n) {
		if (prev_engine.engine_class !=
		    ci.engine_class) {
			drm_dbg(&i915->drm,__drm_dev_dbg(((void *)0), (&i915->drm) ? (&i915->
drm)->dev : ((void *)0), DRM_UT_DRIVER, "Mismatched class %d, %d\n"
, prev_engine.engine_class, ci.engine_class)
				"Mismatched class %d, %d\n",__drm_dev_dbg(((void *)0), (&i915->drm) ? (&i915->
drm)->dev : ((void *)0), DRM_UT_DRIVER, "Mismatched class %d, %d\n"
, prev_engine.engine_class, ci.engine_class)
				prev_engine.engine_class,__drm_dev_dbg(((void *)0), (&i915->drm) ? (&i915->
drm)->dev : ((void *)0), DRM_UT_DRIVER, "Mismatched class %d, %d\n"
, prev_engine.engine_class, ci.engine_class)
				ci.engine_class)__drm_dev_dbg(((void *)0), (&i915->drm) ? (&i915->
drm)->dev : ((void *)0), DRM_UT_DRIVER, "Mismatched class %d, %d\n"
, prev_engine.engine_class, ci.engine_class);
			err = -EINVAL22;
			goto out_err;
		}
	}

	prev_engine = ci;
	current_mask |= siblings[n]->logical_mask;
}

if (i > 0) {
	if (current_mask != prev_mask << 1) {
		drm_dbg(&i915->drm,__drm_dev_dbg(((void *)0), (&i915->drm) ? (&i915->
drm)->dev : ((void *)0), DRM_UT_DRIVER, "Non contiguous logical mask 0x%x, 0x%x\n"
, prev_mask, current_mask)
			"Non contiguous logical mask 0x%x, 0x%x\n",__drm_dev_dbg(((void *)0), (&i915->drm) ? (&i915->
drm)->dev : ((void *)0), DRM_UT_DRIVER, "Non contiguous logical mask 0x%x, 0x%x\n"
, prev_mask, current_mask)
			prev_mask, current_mask)__drm_dev_dbg(((void *)0), (&i915->drm) ? (&i915->
drm)->dev : ((void *)0), DRM_UT_DRIVER, "Non contiguous logical mask 0x%x, 0x%x\n"
, prev_mask, current_mask);
		err = -EINVAL22;
		goto out_err;
	}
}
prev_mask = current_mask;
}

set->engines[slot].type = I915_GEM_ENGINE_TYPE_PARALLEL;
set->engines[slot].num_siblings = num_siblings;
set->engines[slot].width = width;
set->engines[slot].siblings = siblings;

return 0;

727out_err:
kfree(siblings);

return err;
731}

733static const i915_user_extension_fn set_proto_ctx_engines_extensions[] = {
[I915_CONTEXT_ENGINES_EXT_LOAD_BALANCE0] = set_proto_ctx_engines_balance,
[I915_CONTEXT_ENGINES_EXT_BOND1] = set_proto_ctx_engines_bond,
[I915_CONTEXT_ENGINES_EXT_PARALLEL_SUBMIT2] =
set_proto_ctx_engines_parallel_submit,
738};

740static int set_proto_ctx_engines(struct drm_i915_file_private *fpriv,
	         struct i915_gem_proto_context *pc,
	         const struct drm_i915_gem_context_param *args)
743{
struct drm_i915_privateinteldrm_softc *i915 = fpriv->dev_priv;
struct set_proto_ctx_engines set = { .i915 = i915 };
struct i915_context_param_engines __user *user =
u64_to_user_ptr(args->value)((void *)(uintptr_t)(args->value));
unsigned int n;
u64 extensions;
int err;

if (pc->num_user_engines >= 0) {
drm_dbg(&i915->drm, "Cannot set engines twice")__drm_dev_dbg(((void *)0), (&i915->drm) ? (&i915->
drm)->dev : ((void *)0), DRM_UT_DRIVER, "Cannot set engines twice"
);
return -EINVAL22;
}

if (args->size < sizeof(*user) ||
   !IS_ALIGNED(args->size - sizeof(*user), sizeof(*user->engines))(((args->size - sizeof(*user)) & ((sizeof(*user->engines
)) - 1)) == 0)) {
drm_dbg(&i915->drm, "Invalid size for engine array: %d\n",__drm_dev_dbg(((void *)0), (&i915->drm) ? (&i915->
drm)->dev : ((void *)0), DRM_UT_DRIVER, "Invalid size for engine array: %d\n"
, args->size)
	args->size)__drm_dev_dbg(((void *)0), (&i915->drm) ? (&i915->
drm)->dev : ((void *)0), DRM_UT_DRIVER, "Invalid size for engine array: %d\n"
, args->size);
return -EINVAL22;
}

set.num_engines = (args->size - sizeof(*user)) / sizeof(*user->engines);
/* RING_MASK has no shift so we can use it directly here */
if (set.num_engines > I915_EXEC_RING_MASK(0x3f) + 1)
return -EINVAL22;

set.engines = kmalloc_array(set.num_engines, sizeof(*set.engines), GFP_KERNEL(0x0001 | 0x0004));
if (!set.engines)
return -ENOMEM12;

for (n = 0; n < set.num_engines; n++) {
struct i915_engine_class_instance ci;
struct intel_engine_cs *engine;

if (copy_from_user(&ci, &user->engines[n], sizeof(ci))) {
	kfree(set.engines);
	return -EFAULT14;
}

memset(&set.engines[n], 0, sizeof(set.engines[n]))__builtin_memset((&set.engines[n]), (0), (sizeof(set.engines
[n])));

if (ci.engine_class == (u16)I915_ENGINE_CLASS_INVALID &&
    ci.engine_instance == (u16)I915_ENGINE_CLASS_INVALID_NONE-1)
	continue;

engine = intel_engine_lookup_user(i915,
				  ci.engine_class,
				  ci.engine_instance);
if (!engine) {
	drm_dbg(&i915->drm,__drm_dev_dbg(((void *)0), (&i915->drm) ? (&i915->
drm)->dev : ((void *)0), DRM_UT_DRIVER, "Invalid engine[%d]: { class:%d, instance:%d }\n"
, n, ci.engine_class, ci.engine_instance)
		"Invalid engine[%d]: { class:%d, instance:%d }\n",__drm_dev_dbg(((void *)0), (&i915->drm) ? (&i915->
drm)->dev : ((void *)0), DRM_UT_DRIVER, "Invalid engine[%d]: { class:%d, instance:%d }\n"
, n, ci.engine_class, ci.engine_instance)
		n, ci.engine_class, ci.engine_instance)__drm_dev_dbg(((void *)0), (&i915->drm) ? (&i915->
drm)->dev : ((void *)0), DRM_UT_DRIVER, "Invalid engine[%d]: { class:%d, instance:%d }\n"
, n, ci.engine_class, ci.engine_instance);
	kfree(set.engines);
	return -ENOENT2;
}

set.engines[n].type = I915_GEM_ENGINE_TYPE_PHYSICAL;
set.engines[n].engine = engine;
}

err = -EFAULT14;
if (!get_user(extensions, &user->extensions)-copyin(&user->extensions, &(extensions), sizeof(extensions
)))
err = i915_user_extensions(u64_to_user_ptr(extensions)((void *)(uintptr_t)(extensions)),
			   set_proto_ctx_engines_extensions,
			   ARRAY_SIZE(set_proto_ctx_engines_extensions)(sizeof((set_proto_ctx_engines_extensions)) / sizeof((set_proto_ctx_engines_extensions
)[0])),
			   &set);
if (err) {
kfree(set.engines);
return err;
}

pc->num_user_engines = set.num_engines;
pc->user_engines = set.engines;

return 0;
818}

820static int set_proto_ctx_sseu(struct drm_i915_file_private *fpriv,
	      struct i915_gem_proto_context *pc,
	      struct drm_i915_gem_context_param *args)
823{
struct drm_i915_privateinteldrm_softc *i915 = fpriv->dev_priv;
struct drm_i915_gem_context_param_sseu user_sseu;
struct intel_sseu *sseu;
int ret;

if (args->size < sizeof(user_sseu))
return -EINVAL22;

if (GRAPHICS_VER(i915)((&(i915)->__runtime)->graphics.ip.ver) != 11)
return -ENODEV19;

if (copy_from_user(&user_sseu, u64_to_user_ptr(args->value)((void *)(uintptr_t)(args->value)),
	   sizeof(user_sseu)))
return -EFAULT14;

if (user_sseu.rsvd)
return -EINVAL22;

if (user_sseu.flags & ~(I915_CONTEXT_SSEU_FLAG_ENGINE_INDEX(1u << 0)))
return -EINVAL22;

if (!!(user_sseu.flags & I915_CONTEXT_SSEU_FLAG_ENGINE_INDEX(1u << 0)) != (pc->num_user_engines >= 0))
return -EINVAL22;

if (pc->num_user_engines >= 0) {
int idx = user_sseu.engine.engine_instance;
struct i915_gem_proto_engine *pe;

if (idx >= pc->num_user_engines)
	return -EINVAL22;

idx = array_index_nospec(idx, pc->num_user_engines)(idx);
pe = &pc->user_engines[idx];

/* Only render engine supports RPCS configuration. */
if (pe->engine->class != RENDER_CLASS0)
	return -EINVAL22;

sseu = &pe->sseu;
} else {
/* Only render engine supports RPCS configuration. */
if (user_sseu.engine.engine_class != I915_ENGINE_CLASS_RENDER)
	return -EINVAL22;

/* There is only one render engine */
if (user_sseu.engine.engine_instance != 0)
	return -EINVAL22;

sseu = &pc->legacy_rcs_sseu;
}

ret = i915_gem_user_to_context_sseu(to_gt(i915), &user_sseu, sseu);
if (ret)
return ret;

args->size = sizeof(user_sseu);

return 0;
882}

884static int set_proto_ctx_param(struct drm_i915_file_private *fpriv,
	       struct i915_gem_proto_context *pc,
	       struct drm_i915_gem_context_param *args)
887{
int ret = 0;

switch (args->param) {
case I915_CONTEXT_PARAM_NO_ERROR_CAPTURE0x4:
if (args->size)
	ret = -EINVAL22;
else if (args->value)
	pc->user_flags |= BIT(UCONTEXT_NO_ERROR_CAPTURE)(1UL << (1));
else
	pc->user_flags &= ~BIT(UCONTEXT_NO_ERROR_CAPTURE)(1UL << (1));
break;

case I915_CONTEXT_PARAM_BANNABLE0x5:
if (args->size)
	ret = -EINVAL22;
else if (!capable(CAP_SYS_ADMIN0x1) && !args->value)
	ret = -EPERM1;
else if (args->value)
	pc->user_flags |= BIT(UCONTEXT_BANNABLE)(1UL << (2));
else if (pc->uses_protected_content)
	ret = -EPERM1;
else
	pc->user_flags &= ~BIT(UCONTEXT_BANNABLE)(1UL << (2));
break;

case I915_CONTEXT_PARAM_RECOVERABLE0x8:
if (args->size)
	ret = -EINVAL22;
else if (!args->value)
	pc->user_flags &= ~BIT(UCONTEXT_RECOVERABLE)(1UL << (3));
else if (pc->uses_protected_content)
	ret = -EPERM1;
else
	pc->user_flags |= BIT(UCONTEXT_RECOVERABLE)(1UL << (3));
break;

case I915_CONTEXT_PARAM_PRIORITY0x6:
ret = validate_priority(fpriv->dev_priv, args);
if (!ret)
	pc->sched.priority = args->value;
break;

case I915_CONTEXT_PARAM_SSEU0x7:
ret = set_proto_ctx_sseu(fpriv, pc, args);
break;

case I915_CONTEXT_PARAM_VM0x9:
ret = set_proto_ctx_vm(fpriv, pc, args);
break;

case I915_CONTEXT_PARAM_ENGINES0xa:
ret = set_proto_ctx_engines(fpriv, pc, args);
break;

case I915_CONTEXT_PARAM_PERSISTENCE0xb:
if (args->size)
	ret = -EINVAL22;
else
	ret = proto_context_set_persistence(fpriv->dev_priv, pc,
					    args->value);
break;

case I915_CONTEXT_PARAM_PROTECTED_CONTENT0xd:
ret = proto_context_set_protected(fpriv->dev_priv, pc,
				  args->value);
break;

case I915_CONTEXT_PARAM_NO_ZEROMAP0x2:
case I915_CONTEXT_PARAM_BAN_PERIOD0x1:
case I915_CONTEXT_PARAM_RINGSIZE0xc:
default:
ret = -EINVAL22;
break;
}

return ret;
964}

966static int intel_context_set_gem(struct intel_context *ce,
		 struct i915_gem_context *ctx,
		 struct intel_sseu sseu)
969{
int ret = 0;

GEM_BUG_ON(rcu_access_pointer(ce->gem_context))((void)0);
RCU_INIT_POINTER(ce->gem_context, ctx)do { (ce->gem_context) = (ctx); } while(0);

GEM_BUG_ON(intel_context_is_pinned(ce))((void)0);
ce->ring_size = SZ_16K(16 << 10);

i915_vm_put(ce->vm);
ce->vm = i915_gem_context_get_eb_vm(ctx);

if (ctx->sched.priority >= I915_PRIORITY_NORMAL &&
   intel_engine_has_timeslices(ce->engine) &&
   intel_engine_has_semaphores(ce->engine))
__set_bit(CONTEXT_USE_SEMAPHORES5, &ce->flags);

if (CONFIG_DRM_I915_REQUEST_TIMEOUT20000 &&
   ctx->i915->params.request_timeout_ms) {
unsigned int timeout_ms = ctx->i915->params.request_timeout_ms;

intel_context_set_watchdog_us(ce, (u64)timeout_ms * 1000);
}

/* A valid SSEU has no zero fields */
if (sseu.slice_mask && !WARN_ON(ce->engine->class != RENDER_CLASS)({ int __ret = !!(ce->engine->class != 0); if (__ret) printf
("WARNING %s failed at %s:%d\n", "ce->engine->class != 0"
, "/usr/src/sys/dev/pci/drm/i915/gem/i915_gem_context.c", 994
); __builtin_expect(!!(__ret), 0); }))
ret = intel_context_reconfigure_sseu(ce, sseu);

return ret;
998}

1000static void __unpin_engines(struct i915_gem_engines *e, unsigned int count)
1001{
while (count--) {
struct intel_context *ce = e->engines[count], *child;

if (!ce || !test_bit(CONTEXT_PERMA_PIN11, &ce->flags))
	continue;

for_each_child(ce, child)for (child = ({ const __typeof( ((__typeof(*child) *)0)->parallel
.child_link ) *__mptr = ((&(ce)->parallel.child_list)->
next); (__typeof(*child) *)( (char *)__mptr - __builtin_offsetof
(__typeof(*child), parallel.child_link) );}); &child->
parallel.child_link != (&(ce)->parallel.child_list); child
 = ({ const __typeof( ((__typeof(*child) *)0)->parallel.child_link
 ) *__mptr = (child->parallel.child_link.next); (__typeof(
*child) *)( (char *)__mptr - __builtin_offsetof(__typeof(*child
), parallel.child_link) );}))
	intel_context_unpin(child);
intel_context_unpin(ce);
}
1012}

1014static void unpin_engines(struct i915_gem_engines *e)
1015{
__unpin_engines(e, e->num_engines);
1017}

1019static void __free_engines(struct i915_gem_engines *e, unsigned int count)
1020{
while (count--) {
if (!e->engines[count])
	continue;

intel_context_put(e->engines[count]);
}
kfree(e);
1028}

1030static void free_engines(struct i915_gem_engines *e)
1031{
__free_engines(e, e->num_engines);
1033}

1035static void free_engines_rcu(struct rcu_head *rcu)
1036{
struct i915_gem_engines *engines =
container_of(rcu, struct i915_gem_engines, rcu)({ const __typeof( ((struct i915_gem_engines *)0)->rcu ) *
__mptr = (rcu); (struct i915_gem_engines *)( (char *)__mptr -
 __builtin_offsetof(struct i915_gem_engines, rcu) );});

i915_sw_fence_fini(&engines->fence);
free_engines(engines);
1042}

1044static void accumulate_runtime(struct i915_drm_client *client,
	       struct i915_gem_engines *engines)
1046{
struct i915_gem_engines_iter it;
struct intel_context *ce;

if (!client)
return;

/* Transfer accumulated runtime to the parent GEM context. */
for_each_gem_engine(ce, engines, it)for (i915_gem_engines_iter_init(&(it), (engines)); ((ce) =
 i915_gem_engines_iter_next(&(it)));) {
unsigned int class = ce->engine->uabi_class;

GEM_BUG_ON(class >= ARRAY_SIZE(client->past_runtime))((void)0);
atomic64_add(intel_context_get_total_runtime_ns(ce),__sync_fetch_and_add_8(&client->past_runtime[class], intel_context_get_total_runtime_ns
(ce))
	     &client->past_runtime[class])__sync_fetch_and_add_8(&client->past_runtime[class], intel_context_get_total_runtime_ns
(ce));
}
1061}

1063static int
1064engines_notify(struct i915_sw_fence *fence, enum i915_sw_fence_notify state)
1065{
struct i915_gem_engines *engines =
container_of(fence, typeof(*engines), fence)({ const __typeof( ((typeof(*engines) *)0)->fence ) *__mptr
 = (fence); (typeof(*engines) *)( (char *)__mptr - __builtin_offsetof
(typeof(*engines), fence) );});
struct i915_gem_context *ctx = engines->ctx;

switch (state) {
case FENCE_COMPLETE:
if (!list_empty(&engines->link)) {
	unsigned long flags;

	spin_lock_irqsave(&ctx->stale.lock, flags)do { flags = 0; mtx_enter(&ctx->stale.lock); } while (
0);
	list_del(&engines->link);
	spin_unlock_irqrestore(&ctx->stale.lock, flags)do { (void)(flags); mtx_leave(&ctx->stale.lock); } while
 (0);
}
accumulate_runtime(ctx->client, engines);
i915_gem_context_put(ctx);

break;

case FENCE_FREE:
init_rcu_head(&engines->rcu);
call_rcu(&engines->rcu, free_engines_rcu);
break;
}

return NOTIFY_DONE0;
1091}

1093static struct i915_gem_engines *alloc_engines(unsigned int count)
1094{
struct i915_gem_engines *e;

e = kzalloc(struct_size(e, engines, count)(sizeof(*(e)) + ((count) * (sizeof(*(e)->engines)))), GFP_KERNEL(0x0001 | 0x0004));
if (!e)
return NULL((void *)0);

i915_sw_fence_init(&e->fence, engines_notify)do { extern char _ctassert[(!((engines_notify) == ((void *)0)
)) ? 1 : -1 ] __attribute__((__unused__)); __i915_sw_fence_init
((&e->fence), (engines_notify), ((void *)0), ((void *)
0)); } while (0);
return e;
1103}

1105static struct i915_gem_engines *default_engines(struct i915_gem_context *ctx,
				struct intel_sseu rcs_sseu)
1107{
const struct intel_gt *gt = to_gt(ctx->i915);
struct intel_engine_cs *engine;
struct i915_gem_engines *e, *err;
enum intel_engine_id id;

e = alloc_engines(I915_NUM_ENGINES);
if (!e)
return ERR_PTR(-ENOMEM12);

for_each_engine(engine, gt, id)for ((id) = 0; (id) < I915_NUM_ENGINES; (id)++) if (!((engine
) = (gt)->engine[(id)])) {} else {
struct intel_context *ce;
struct intel_sseu sseu = {};
int ret;

if (engine->legacy_idx == INVALID_ENGINE((enum intel_engine_id)-1))
	continue;

GEM_BUG_ON(engine->legacy_idx >= I915_NUM_ENGINES)((void)0);
GEM_BUG_ON(e->engines[engine->legacy_idx])((void)0);

ce = intel_context_create(engine);
if (IS_ERR(ce)) {
	err = ERR_CAST(ce);
	goto free_engines;
}

e->engines[engine->legacy_idx] = ce;
e->num_engines = max(e->num_engines, engine->legacy_idx + 1)(((e->num_engines)>(engine->legacy_idx + 1))?(e->
num_engines):(engine->legacy_idx + 1));

if (engine->class == RENDER_CLASS0)
	sseu = rcs_sseu;

ret = intel_context_set_gem(ce, ctx, sseu);
if (ret) {
	err = ERR_PTR(ret);
	goto free_engines;
}

}

return e;

1150free_engines:
free_engines(e);
return err;
1153}

1155static int perma_pin_contexts(struct intel_context *ce)
1156{
struct intel_context *child;
int i = 0, j = 0, ret;

GEM_BUG_ON(!intel_context_is_parent(ce))((void)0);

ret = intel_context_pin(ce);
if (unlikely(ret)__builtin_expect(!!(ret), 0))
return ret;

for_each_child(ce, child)for (child = ({ const __typeof( ((__typeof(*child) *)0)->parallel
.child_link ) *__mptr = ((&(ce)->parallel.child_list)->
next); (__typeof(*child) *)( (char *)__mptr - __builtin_offsetof
(__typeof(*child), parallel.child_link) );}); &child->
parallel.child_link != (&(ce)->parallel.child_list); child
 = ({ const __typeof( ((__typeof(*child) *)0)->parallel.child_link
 ) *__mptr = (child->parallel.child_link.next); (__typeof(
*child) *)( (char *)__mptr - __builtin_offsetof(__typeof(*child
), parallel.child_link) );})) {
ret = intel_context_pin(child);
if (unlikely(ret)__builtin_expect(!!(ret), 0))
	goto unwind;
++i;
}

set_bit(CONTEXT_PERMA_PIN11, &ce->flags);

return 0;

1177unwind:
intel_context_unpin(ce);
for_each_child(ce, child)for (child = ({ const __typeof( ((__typeof(*child) *)0)->parallel
.child_link ) *__mptr = ((&(ce)->parallel.child_list)->
next); (__typeof(*child) *)( (char *)__mptr - __builtin_offsetof
(__typeof(*child), parallel.child_link) );}); &child->
parallel.child_link != (&(ce)->parallel.child_list); child
 = ({ const __typeof( ((__typeof(*child) *)0)->parallel.child_link
 ) *__mptr = (child->parallel.child_link.next); (__typeof(
*child) *)( (char *)__mptr - __builtin_offsetof(__typeof(*child
), parallel.child_link) );})) {
if (j++ < i)
	intel_context_unpin(child);
else
	break;
}

return ret;
1187}

1189static struct i915_gem_engines *user_engines(struct i915_gem_context *ctx,
			     unsigned int num_engines,
			     struct i915_gem_proto_engine *pe)
1192{
struct i915_gem_engines *e, *err;
unsigned int n;

e = alloc_engines(num_engines);
if (!e)
return ERR_PTR(-ENOMEM12);
e->num_engines = num_engines;

for (n = 0; n < num_engines; n++) {
struct intel_context *ce, *child;
int ret;

switch (pe[n].type) {
case I915_GEM_ENGINE_TYPE_PHYSICAL:
	ce = intel_context_create(pe[n].engine);
	break;

case I915_GEM_ENGINE_TYPE_BALANCED:
	ce = intel_engine_create_virtual(pe[n].siblings,
					 pe[n].num_siblings, 0);
	break;

case I915_GEM_ENGINE_TYPE_PARALLEL:
	ce = intel_engine_create_parallel(pe[n].siblings,
					  pe[n].num_siblings,
					  pe[n].width);
	break;

case I915_GEM_ENGINE_TYPE_INVALID:
default:
	GEM_WARN_ON(pe[n].type != I915_GEM_ENGINE_TYPE_INVALID)({ __builtin_expect(!!(!!(pe[n].type != I915_GEM_ENGINE_TYPE_INVALID
)), 0); });
	continue;
}

if (IS_ERR(ce)) {
	err = ERR_CAST(ce);
	goto free_engines;
}

e->engines[n] = ce;

ret = intel_context_set_gem(ce, ctx, pe->sseu);
if (ret) {
	err = ERR_PTR(ret);
	goto free_engines;
}
for_each_child(ce, child)for (child = ({ const __typeof( ((__typeof(*child) *)0)->parallel
.child_link ) *__mptr = ((&(ce)->parallel.child_list)->
next); (__typeof(*child) *)( (char *)__mptr - __builtin_offsetof
(__typeof(*child), parallel.child_link) );}); &child->
parallel.child_link != (&(ce)->parallel.child_list); child
 = ({ const __typeof( ((__typeof(*child) *)0)->parallel.child_link
 ) *__mptr = (child->parallel.child_link.next); (__typeof(
*child) *)( (char *)__mptr - __builtin_offsetof(__typeof(*child
), parallel.child_link) );})) {
	ret = intel_context_set_gem(child, ctx, pe->sseu);
	if (ret) {
		err = ERR_PTR(ret);
		goto free_engines;
	}
}

/*
 * XXX: Must be done after calling intel_context_set_gem as that
 * function changes the ring size. The ring is allocated when
 * the context is pinned. If the ring size is changed after
 * allocation we have a mismatch of the ring size and will cause
 * the context to hang. Presumably with a bit of reordering we
 * could move the perma-pin step to the backend function
 * intel_engine_create_parallel.
 */
if (pe[n].type == I915_GEM_ENGINE_TYPE_PARALLEL) {
	ret = perma_pin_contexts(ce);
	if (ret) {
		err = ERR_PTR(ret);
		goto free_engines;
	}
}
}

return e;

1267free_engines:
free_engines(e);
return err;
1270}

1272static void i915_gem_context_release_work(struct work_struct *work)
1273{
struct i915_gem_context *ctx = container_of(work, typeof(*ctx),({ const __typeof( ((typeof(*ctx) *)0)->release_work ) *__mptr
 = (work); (typeof(*ctx) *)( (char *)__mptr - __builtin_offsetof
(typeof(*ctx), release_work) );})
				    release_work)({ const __typeof( ((typeof(*ctx) *)0)->release_work ) *__mptr
 = (work); (typeof(*ctx) *)( (char *)__mptr - __builtin_offsetof
(typeof(*ctx), release_work) );});
struct i915_address_space *vm;

trace_i915_context_free(ctx);
GEM_BUG_ON(!i915_gem_context_is_closed(ctx))((void)0);

spin_lock(&ctx->i915->gem.contexts.lock)mtx_enter(&ctx->i915->gem.contexts.lock);
list_del(&ctx->link);
spin_unlock(&ctx->i915->gem.contexts.lock)mtx_leave(&ctx->i915->gem.contexts.lock);

if (ctx->syncobj)
drm_syncobj_put(ctx->syncobj);

vm = ctx->vm;
if (vm)
i915_vm_put(vm);

if (ctx->pxp_wakeref)
intel_runtime_pm_put(&ctx->i915->runtime_pm, ctx->pxp_wakeref);

if (ctx->client)
i915_drm_client_put(ctx->client);

mutex_destroy(&ctx->engines_mutex);
mutex_destroy(&ctx->lut_mutex);

put_pid(ctx->pid);
mutex_destroy(&ctx->mutex);

kfree_rcu(ctx, rcu)do { free((void *)ctx, 145, 0); } while(0);
1305}

1307void i915_gem_context_release(struct kref *ref)
1308{
struct i915_gem_context *ctx = container_of(ref, typeof(*ctx), ref)({ const __typeof( ((typeof(*ctx) *)0)->ref ) *__mptr = (ref
); (typeof(*ctx) *)( (char *)__mptr - __builtin_offsetof(typeof
(*ctx), ref) );});

queue_work(ctx->i915->wq, &ctx->release_work);
1312}

1314static inline struct i915_gem_engines *
1315__context_engines_static(const struct i915_gem_context *ctx)
1316{
return rcu_dereference_protected(ctx->engines, true)(ctx->engines);
1318}

1320static void __reset_context(struct i915_gem_context *ctx,
	    struct intel_engine_cs *engine)
1322{
intel_gt_handle_error(engine->gt, engine->mask, 0,
	      "context closure in %s", ctx->name);
1325}

1327static bool_Bool __cancel_engine(struct intel_engine_cs *engine)
1328{
/*
* Send a "high priority pulse" down the engine to cause the
* current request to be momentarily preempted. (If it fails to
* be preempted, it will be reset). As we have marked our context
* as banned, any incomplete request, including any running, will
* be skipped following the preemption.
*
* If there is no hangchecking (one of the reasons why we try to
* cancel the context) and no forced preemption, there may be no
* means by which we reset the GPU and evict the persistent hog.
* Ergo if we are unable to inject a preemptive pulse that can
* kill the banned context, we fallback to doing a local reset
* instead.
*/
return intel_engine_pulse(engine) == 0;
1344}

1346static struct intel_engine_cs *active_engine(struct intel_context *ce)
1347{
struct intel_engine_cs *engine = NULL((void *)0);
struct i915_request *rq;

if (intel_context_has_inflight(ce))
return intel_context_inflight(ce)({ unsigned long __v = (unsigned long)(({ typeof((ce)->inflight
) __tmp = *(volatile typeof((ce)->inflight) *)&((ce)->
inflight); membar_datadep_consumer(); __tmp; })); (typeof(({ typeof
((ce)->inflight) __tmp = *(volatile typeof((ce)->inflight
) *)&((ce)->inflight); membar_datadep_consumer(); __tmp
; })))(__v & -(1UL << (3))); });

if (!ce->timeline)
return NULL((void *)0);

/*
* rq->link is only SLAB_TYPESAFE_BY_RCU, we need to hold a reference
* to the request to prevent it being transferred to a new timeline
* (and onto a new timeline->requests list).
*/
rcu_read_lock();
list_for_each_entry_reverse(rq, &ce->timeline->requests, link)for (rq = ({ const __typeof( ((__typeof(*rq) *)0)->link ) *
__mptr = ((&ce->timeline->requests)->prev); (__typeof
(*rq) *)( (char *)__mptr - __builtin_offsetof(__typeof(*rq), link
) );}); &rq->link != (&ce->timeline->requests
); rq = ({ const __typeof( ((__typeof(*rq) *)0)->link ) *__mptr
 = (rq->link.prev); (__typeof(*rq) *)( (char *)__mptr - __builtin_offsetof
(__typeof(*rq), link) );})) {
bool_Bool found;

/* timeline is already completed upto this point? */
if (!i915_request_get_rcu(rq))
	break;

/* Check with the backend if the request is inflight */
found = true1;
if (likely(rcu_access_pointer(rq->timeline) == ce->timeline)__builtin_expect(!!((rq->timeline) == ce->timeline), 1))
	found = i915_request_active_engine(rq, &engine);

i915_request_put(rq);
if (found)
	break;
}
rcu_read_unlock();

return engine;
1382}

1384static void
1385kill_engines(struct i915_gem_engines *engines, bool_Bool exit, bool_Bool persistent)
1386{
struct i915_gem_engines_iter it;
struct intel_context *ce;

/*
* Map the user's engine back to the actual engines; one virtual
* engine will be mapped to multiple engines, and using ctx->engine[]
* the same engine may be have multiple instances in the user's map.
* However, we only care about pending requests, so only include
* engines on which there are incomplete requests.
*/
for_each_gem_engine(ce, engines, it)for (i915_gem_engines_iter_init(&(it), (engines)); ((ce) =
 i915_gem_engines_iter_next(&(it)));) {
struct intel_engine_cs *engine;

if ((exit || !persistent) && intel_context_revoke(ce))
	continue; /* Already marked. */

/*
 * Check the current active state of this context; if we
 * are currently executing on the GPU we need to evict
 * ourselves. On the other hand, if we haven't yet been
 * submitted to the GPU or if everything is complete,
 * we have nothing to do.
 */
engine = active_engine(ce);

/* First attempt to gracefully cancel the context */
if (engine && !__cancel_engine(engine) && (exit || !persistent))
	/*
	 * If we are unable to send a preemptive pulse to bump
	 * the context from the GPU, we have to resort to a full
	 * reset. We hope the collateral damage is worth it.
	 */
	__reset_context(engines->ctx, engine);
}
1421}

1423static void kill_context(struct i915_gem_context *ctx)
1424{
struct i915_gem_engines *pos, *next;
static int warn = 1;

spin_lock_irq(&ctx->stale.lock)mtx_enter(&ctx->stale.lock);
GEM_BUG_ON(!i915_gem_context_is_closed(ctx))((void)0);
list_for_each_entry_safe(pos, next, &ctx->stale.engines, link)for (pos = ({ const __typeof( ((__typeof(*pos) *)0)->link )
 *__mptr = ((&ctx->stale.engines)->next); (__typeof
(*pos) *)( (char *)__mptr - __builtin_offsetof(__typeof(*pos)
, link) );}), next = ({ const __typeof( ((__typeof(*pos) *)0)
->link ) *__mptr = (pos->link.next); (__typeof(*pos) *)
( (char *)__mptr - __builtin_offsetof(__typeof(*pos), link) )
;}); &pos->link != (&ctx->stale.engines); pos =
 next, next = ({ const __typeof( ((__typeof(*next) *)0)->link
 ) *__mptr = (next->link.next); (__typeof(*next) *)( (char
 *)__mptr - __builtin_offsetof(__typeof(*next), link) );})) {
if (!i915_sw_fence_await(&pos->fence)) {
	list_del_init(&pos->link);
	continue;
}

/*
 * XXX don't incorrectly reset chip on
 * gm45/vlv/ivb/hsw/bdw cause unknown
 */
if (IS_GRAPHICS_VER(ctx->i915, 4, 8)(((&(ctx->i915)->__runtime)->graphics.ip.ver) >=
 (4) && ((&(ctx->i915)->__runtime)->graphics
.ip.ver) <= (8))) {
	if (warn) {
		DRM_DEBUG("%s XXX skipping reset pos %p\n", __func__, pos)___drm_dbg(((void *)0), DRM_UT_CORE, "%s XXX skipping reset pos %p\n"
, __func__, pos);
		warn = 0;
	}
	continue;
}

spin_unlock_irq(&ctx->stale.lock)mtx_leave(&ctx->stale.lock);

kill_engines(pos, !ctx->i915->params.enable_hangcheck,
	     i915_gem_context_is_persistent(ctx));

spin_lock_irq(&ctx->stale.lock)mtx_enter(&ctx->stale.lock);
GEM_BUG_ON(i915_sw_fence_signaled(&pos->fence))((void)0);
list_safe_reset_next(pos, next, link)next = ({ const __typeof( ((typeof(*(pos)) *)0)->link ) *__mptr
 = (((pos)->link.next)); (typeof(*(pos)) *)( (char *)__mptr
 - __builtin_offsetof(typeof(*(pos)), link) );});
list_del_init(&pos->link); /* decouple from FENCE_COMPLETE */

i915_sw_fence_complete(&pos->fence);
}
spin_unlock_irq(&ctx->stale.lock)mtx_leave(&ctx->stale.lock);
1461}

1463static void engines_idle_release(struct i915_gem_context *ctx,
		 struct i915_gem_engines *engines)
1465{
struct i915_gem_engines_iter it;
struct intel_context *ce;

INIT_LIST_HEAD(&engines->link);

engines->ctx = i915_gem_context_get(ctx);

for_each_gem_engine(ce, engines, it)for (i915_gem_engines_iter_init(&(it), (engines)); ((ce) =
 i915_gem_engines_iter_next(&(it)));) {
int err;

/* serialises with execbuf */
set_bit(CONTEXT_CLOSED_BIT4, &ce->flags);
if (!intel_context_pin_if_active(ce))
	continue;

/* Wait until context is finally scheduled out and retired */
err = i915_sw_fence_await_active(&engines->fence,
				 &ce->active,
				 I915_ACTIVE_AWAIT_BARRIER(1UL << (2)));
intel_context_unpin(ce);
if (err)
	goto kill;
}

spin_lock_irq(&ctx->stale.lock)mtx_enter(&ctx->stale.lock);
if (!i915_gem_context_is_closed(ctx))
list_add_tail(&engines->link, &ctx->stale.engines);
spin_unlock_irq(&ctx->stale.lock)mtx_leave(&ctx->stale.lock);

1495kill:
if (list_empty(&engines->link)) /* raced, already closed */
kill_engines(engines, true1,
	     i915_gem_context_is_persistent(ctx));

i915_sw_fence_commit(&engines->fence);
1501}

1503static void set_closed_name(struct i915_gem_context *ctx)
1504{
char *s;

/* Replace '[]' with '<>' to indicate closed in debug prints */

s = strrchr(ctx->name, '[');
if (!s)
return;

*s = '<';

s = strchr(s + 1, ']');
if (s)
*s = '>';
1518}

1520static void context_close(struct i915_gem_context *ctx)
1521{
struct i915_drm_client *client;

/* Flush any concurrent set_engines() */
mutex_lock(&ctx->engines_mutex)rw_enter_write(&ctx->engines_mutex);
unpin_engines(__context_engines_static(ctx));
engines_idle_release(ctx, rcu_replace_pointer(ctx->engines, NULL, 1)({ __typeof(ctx->engines) __r = ctx->engines; ctx->engines
 = ((void *)0); __r; }));
i915_gem_context_set_closed(ctx);
mutex_unlock(&ctx->engines_mutex)rw_exit_write(&ctx->engines_mutex);

mutex_lock(&ctx->mutex)rw_enter_write(&ctx->mutex);

set_closed_name(ctx);

/*
* The LUT uses the VMA as a backpointer to unref the object,
* so we need to clear the LUT before we close all the VMA (inside
* the ppgtt).
*/
lut_close(ctx);

ctx->file_priv = ERR_PTR(-EBADF9);

client = ctx->client;
if (client) {
spin_lock(&client->ctx_lock)mtx_enter(&client->ctx_lock);
list_del_rcu(&ctx->client_link)list_del(&ctx->client_link);
spin_unlock(&client->ctx_lock)mtx_leave(&client->ctx_lock);
}

mutex_unlock(&ctx->mutex)rw_exit_write(&ctx->mutex);

/*
* If the user has disabled hangchecking, we can not be sure that
* the batches will ever complete after the context is closed,
* keeping the context and all resources pinned forever. So in this
* case we opt to forcibly kill off all remaining requests on
* context close.
*/
kill_context(ctx);

i915_gem_context_put(ctx);
1563}

1565static int __context_set_persistence(struct i915_gem_context *ctx, bool_Bool state)
1566{
if (i915_gem_context_is_persistent(ctx) == state)
return 0;

if (state) {
/*
 * Only contexts that are short-lived [that will expire or be
 * reset] are allowed to survive past termination. We require
 * hangcheck to ensure that the persistent requests are healthy.
 */
if (!ctx->i915->params.enable_hangcheck)
	return -EINVAL22;

i915_gem_context_set_persistence(ctx);
} else {
/* To cancel a context we use "preempt-to-idle" */
if (!(ctx->i915->caps.scheduler & I915_SCHEDULER_CAP_PREEMPTION(1ul << 2)))
	return -ENODEV19;

/*
 * If the cancel fails, we then need to reset, cleanly!
 *
 * If the per-engine reset fails, all hope is lost! We resort
 * to a full GPU reset in that unlikely case, but realistically
 * if the engine could not reset, the full reset does not fare
 * much better. The damage has been done.
 *
 * However, if we cannot reset an engine by itself, we cannot
 * cleanup a hanging persistent context without causing
 * colateral damage, and we should not pretend we can by
 * exposing the interface.
 */
if (!intel_has_reset_engine(to_gt(ctx->i915)))
	return -ENODEV19;

i915_gem_context_clear_persistence(ctx);
}

return 0;
1605}

1607static struct i915_gem_context *
1608i915_gem_create_context(struct drm_i915_privateinteldrm_softc *i915,
	const struct i915_gem_proto_context *pc)
1610{
struct i915_gem_context *ctx;
struct i915_address_space *vm = NULL((void *)0);
struct i915_gem_engines *e;
int err;
int i;

ctx = kzalloc(sizeof(*ctx), GFP_KERNEL(0x0001 | 0x0004));
if (!ctx)
return ERR_PTR(-ENOMEM12);

kref_init(&ctx->ref);
ctx->i915 = i915;
ctx->sched = pc->sched;
rw_init(&ctx->mutex, "gemctx")_rw_init_flags(&ctx->mutex, "gemctx", 0, ((void *)0));
INIT_LIST_HEAD(&ctx->link);
INIT_WORK(&ctx->release_work, i915_gem_context_release_work);

mtx_init(&ctx->stale.lock, IPL_TTY)do { (void)(((void *)0)); (void)(0); __mtx_init((&ctx->
stale.lock), ((((0x9)) > 0x0 && ((0x9)) < 0x9) ?
 0x9 : ((0x9)))); } while (0);
INIT_LIST_HEAD(&ctx->stale.engines);

if (pc->vm) {
vm = i915_vm_get(pc->vm);
} else if (HAS_FULL_PPGTT(i915)(((&(i915)->__runtime)->ppgtt_type) >= INTEL_PPGTT_FULL
)) {
struct i915_ppgtt *ppgtt;

ppgtt = i915_ppgtt_create(to_gt(i915), 0);
if (IS_ERR(ppgtt)) {
	drm_dbg(&i915->drm, "PPGTT setup failed (%ld)\n",__drm_dev_dbg(((void *)0), (&i915->drm) ? (&i915->
drm)->dev : ((void *)0), DRM_UT_DRIVER, "PPGTT setup failed (%ld)\n"
, PTR_ERR(ppgtt))
		PTR_ERR(ppgtt))__drm_dev_dbg(((void *)0), (&i915->drm) ? (&i915->
drm)->dev : ((void *)0), DRM_UT_DRIVER, "PPGTT setup failed (%ld)\n"
, PTR_ERR(ppgtt));
	err = PTR_ERR(ppgtt);
	goto err_ctx;
}
vm = &ppgtt->vm;
}
if (vm)
ctx->vm = vm;

rw_init(&ctx->engines_mutex, "gemeng")_rw_init_flags(&ctx->engines_mutex, "gemeng", 0, ((void
 *)0));
if (pc->num_user_engines >= 0) {
i915_gem_context_set_user_engines(ctx);
e = user_engines(ctx, pc->num_user_engines, pc->user_engines);
} else {
i915_gem_context_clear_user_engines(ctx);
e = default_engines(ctx, pc->legacy_rcs_sseu);
}
if (IS_ERR(e)) {
err = PTR_ERR(e);
goto err_vm;
}
RCU_INIT_POINTER(ctx->engines, e)do { (ctx->engines) = (e); } while(0);

INIT_RADIX_TREE(&ctx->handles_vma, GFP_KERNEL){ (&ctx->handles_vma)->rnode = ((void *)0); (&ctx
->handles_vma)->gfp_mask = (0x0001 | 0x0004); (&ctx
->handles_vma)->height = 0; };
rw_init(&ctx->lut_mutex, "lutrw")_rw_init_flags(&ctx->lut_mutex, "lutrw", 0, ((void *)0
));

/* NB: Mark all slices as needing a remap so that when the context first
* loads it will restore whatever remap state already exists. If there
* is no remap info, it will be a NOP. */
ctx->remap_slice = ALL_L3_SLICES(i915)(1 << ((IS_PLATFORM(i915, INTEL_HASWELL) && (&
(i915)->__info)->gt == 3) ? 2 : ((&(i915)->__info
)->has_l3_dpf))) - 1;

ctx->user_flags = pc->user_flags;

for (i = 0; i < ARRAY_SIZE(ctx->hang_timestamp)(sizeof((ctx->hang_timestamp)) / sizeof((ctx->hang_timestamp
)[0])); i++)
ctx->hang_timestamp[i] = jiffies - CONTEXT_FAST_HANG_JIFFIES(120 * hz);

if (pc->single_timeline) {
err = drm_syncobj_create(&ctx->syncobj,
			 DRM_SYNCOBJ_CREATE_SIGNALED(1 << 0),
			 NULL((void *)0));
if (err)
	goto err_engines;
}

if (pc->uses_protected_content) {
ctx->pxp_wakeref = intel_runtime_pm_get(&i915->runtime_pm);
ctx->uses_protected_content = true1;
}

trace_i915_context_create(ctx);

return ctx;

1692err_engines:
free_engines(e);
1694err_vm:
if (ctx->vm)
i915_vm_put(ctx->vm);
1697err_ctx:
kfree(ctx);
return ERR_PTR(err);
1700}

1702static void init_contexts(struct i915_gem_contexts *gc)
1703{
mtx_init(&gc->lock, IPL_NONE)do { (void)(((void *)0)); (void)(0); __mtx_init((&gc->
lock), ((((0x0)) > 0x0 && ((0x0)) < 0x9) ? 0x9 :
 ((0x0)))); } while (0);
INIT_LIST_HEAD(&gc->list);
1706}

1708void i915_gem_init__contexts(struct drm_i915_privateinteldrm_softc *i915)
1709{
init_contexts(&i915->gem.contexts);
1711}

1713/*
* Note that this implicitly consumes the ctx reference, by placing
* the ctx in the context_xa.
*/
1717static void gem_context_register(struct i915_gem_context *ctx,
		 struct drm_i915_file_private *fpriv,
		 u32 id)
1720{
struct drm_i915_privateinteldrm_softc *i915 = ctx->i915;
void *old;

ctx->file_priv = fpriv;

1726#ifdef __linux__
ctx->pid = get_task_pid(current, PIDTYPE_PID);
ctx->client = i915_drm_client_get(fpriv->client);

snprintf(ctx->name, sizeof(ctx->name), "%s[%d]",
 current->comm, pid_nr(ctx->pid));
1732#else
ctx->pid = curproc({struct cpu_info *__ci; asm volatile("movq %%gs:%P1,%0" : "=r"
 (__ci) :"n" (__builtin_offsetof(struct cpu_info, ci_self)));
 __ci;})->ci_curproc->p_p->ps_pid;
ctx->client = i915_drm_client_get(fpriv->client);

snprintf(ctx->name, sizeof(ctx->name), "%s[%d]",
 curproc({struct cpu_info *__ci; asm volatile("movq %%gs:%P1,%0" : "=r"
 (__ci) :"n" (__builtin_offsetof(struct cpu_info, ci_self)));
 __ci;})->ci_curproc->p_p->ps_comm, ctx->pid);
1738#endif

spin_lock(&ctx->client->ctx_lock)mtx_enter(&ctx->client->ctx_lock);
list_add_tail_rcu(&ctx->client_link, &ctx->client->ctx_list)list_add_tail(&ctx->client_link, &ctx->client->
ctx_list);
spin_unlock(&ctx->client->ctx_lock)mtx_leave(&ctx->client->ctx_lock);

spin_lock(&i915->gem.contexts.lock)mtx_enter(&i915->gem.contexts.lock);
list_add_tail(&ctx->link, &i915->gem.contexts.list);
spin_unlock(&i915->gem.contexts.lock)mtx_leave(&i915->gem.contexts.lock);

/* And finally expose ourselves to userspace via the idr */
old = xa_store(&fpriv->context_xa, id, ctx, GFP_KERNEL(0x0001 | 0x0004));
WARN_ON(old)({ int __ret = !!(old); if (__ret) printf("WARNING %s failed at %s:%d\n"
, "old", "/usr/src/sys/dev/pci/drm/i915/gem/i915_gem_context.c"
, 1750); __builtin_expect(!!(__ret), 0); });
1751}

1753int i915_gem_context_open(struct drm_i915_privateinteldrm_softc *i915,
	  struct drm_file *file)
1755{
struct drm_i915_file_private *file_priv = file->driver_priv;
struct i915_gem_proto_context *pc;
struct i915_gem_context *ctx;
int err;

rw_init(&file_priv->proto_context_lock, "pctxlk")_rw_init_flags(&file_priv->proto_context_lock, "pctxlk"
, 0, ((void *)0));
xa_init_flags(&file_priv->proto_context_xa, XA_FLAGS_ALLOC1);

/* 0 reserved for the default context */
xa_init_flags(&file_priv->context_xa, XA_FLAGS_ALLOC12);

/* 0 reserved for invalid/unassigned ppgtt */
xa_init_flags(&file_priv->vm_xa, XA_FLAGS_ALLOC12);

pc = proto_context_create(i915, 0);
if (IS_ERR(pc)) {
err = PTR_ERR(pc);
goto err;
}

ctx = i915_gem_create_context(i915, pc);
proto_context_close(i915, pc);
if (IS_ERR(ctx)) {
err = PTR_ERR(ctx);
goto err;
}

gem_context_register(ctx, file_priv, 0);

return 0;

1787err:
xa_destroy(&file_priv->vm_xa);
xa_destroy(&file_priv->context_xa);
xa_destroy(&file_priv->proto_context_xa);
mutex_destroy(&file_priv->proto_context_lock);
return err;
1793}

1795void i915_gem_context_close(struct drm_file *file)
1796{
struct drm_i915_file_private *file_priv = file->driver_priv;
struct i915_gem_proto_context *pc;
struct i915_address_space *vm;
struct i915_gem_context *ctx;
unsigned long idx;

xa_for_each(&file_priv->proto_context_xa, idx, pc)for (idx = 0; ((pc) = xa_get_next(&file_priv->proto_context_xa
, &(idx))) != ((void *)0); idx++)
proto_context_close(file_priv->dev_priv, pc);
xa_destroy(&file_priv->proto_context_xa);
mutex_destroy(&file_priv->proto_context_lock);

xa_for_each(&file_priv->context_xa, idx, ctx)for (idx = 0; ((ctx) = xa_get_next(&file_priv->context_xa
, &(idx))) != ((void *)0); idx++)
context_close(ctx);
xa_destroy(&file_priv->context_xa);

xa_for_each(&file_priv->vm_xa, idx, vm)for (idx = 0; ((vm) = xa_get_next(&file_priv->vm_xa, &
(idx))) != ((void *)0); idx++)
i915_vm_put(vm);
xa_destroy(&file_priv->vm_xa);
1815}

1817int i915_gem_vm_create_ioctl(struct drm_device *dev, void *data,
	     struct drm_file *file)
1819{
struct drm_i915_privateinteldrm_softc *i915 = to_i915(dev);
struct drm_i915_gem_vm_control *args = data;
struct drm_i915_file_private *file_priv = file->driver_priv;
struct i915_ppgtt *ppgtt;
u32 id;
int err;

if (!HAS_FULL_PPGTT(i915)(((&(i915)->__runtime)->ppgtt_type) >= INTEL_PPGTT_FULL
))
return -ENODEV19;

if (args->flags)
return -EINVAL22;

ppgtt = i915_ppgtt_create(to_gt(i915), 0);
if (IS_ERR(ppgtt))
return PTR_ERR(ppgtt);

if (args->extensions) {
err = i915_user_extensions(u64_to_user_ptr(args->extensions)((void *)(uintptr_t)(args->extensions)),
			   NULL((void *)0), 0,
			   ppgtt);
if (err)
	goto err_put;
}

err = xa_alloc(&file_priv->vm_xa, &id, &ppgtt->vm,
       xa_limit_32b0, GFP_KERNEL(0x0001 | 0x0004));
if (err)
goto err_put;

GEM_BUG_ON(id == 0)((void)0); /* reserved for invalid/unassigned ppgtt */
args->vm_id = id;
return 0;

1854err_put:
i915_vm_put(&ppgtt->vm);
return err;
1857}

1859int i915_gem_vm_destroy_ioctl(struct drm_device *dev, void *data,
	      struct drm_file *file)
1861{
struct drm_i915_file_private *file_priv = file->driver_priv;
struct drm_i915_gem_vm_control *args = data;
struct i915_address_space *vm;

if (args->flags)
return -EINVAL22;

if (args->extensions)
return -EINVAL22;

vm = xa_erase(&file_priv->vm_xa, args->vm_id);
if (!vm)
return -ENOENT2;

i915_vm_put(vm);
return 0;
1878}

1880static int get_ppgtt(struct drm_i915_file_private *file_priv,
     struct i915_gem_context *ctx,
     struct drm_i915_gem_context_param *args)
1883{
struct i915_address_space *vm;
int err;
u32 id;

if (!i915_gem_context_has_full_ppgtt(ctx))
return -ENODEV19;

vm = ctx->vm;
GEM_BUG_ON(!vm)((void)0);

/*
* Get a reference for the allocated handle.  Once the handle is
* visible in the vm_xa table, userspace could try to close it
* from under our feet, so we need to hold the extra reference
* first.
*/
i915_vm_get(vm);

err = xa_alloc(&file_priv->vm_xa, &id, vm, xa_limit_32b0, GFP_KERNEL(0x0001 | 0x0004));
if (err) {
i915_vm_put(vm);
return err;
}

GEM_BUG_ON(id == 0)((void)0); /* reserved for invalid/unassigned ppgtt */
args->value = id;
args->size = 0;

return err;
1913}

1915int
1916i915_gem_user_to_context_sseu(struct intel_gt *gt,
	      const struct drm_i915_gem_context_param_sseu *user,
	      struct intel_sseu *context)
1919{
const struct sseu_dev_info *device = &gt->info.sseu;
struct drm_i915_privateinteldrm_softc *i915 = gt->i915;
unsigned int dev_subslice_mask = intel_sseu_get_hsw_subslices(device, 0);

/* No zeros in any field. */
if (!user->slice_mask || !user->subslice_mask ||
   !user->min_eus_per_subslice || !user->max_eus_per_subslice)
return -EINVAL22;

/* Max > min. */
if (user->max_eus_per_subslice < user->min_eus_per_subslice)
return -EINVAL22;

/*
* Some future proofing on the types since the uAPI is wider than the
* current internal implementation.
*/
if (overflows_type(user->slice_mask, context->slice_mask)(sizeof(user->slice_mask) > sizeof(context->slice_mask
) && (user->slice_mask) >> (8 * sizeof(context
->slice_mask))) ||
   overflows_type(user->subslice_mask, context->subslice_mask)(sizeof(user->subslice_mask) > sizeof(context->subslice_mask
) && (user->subslice_mask) >> (8 * sizeof(context
->subslice_mask))) ||
   overflows_type(user->min_eus_per_subslice,(sizeof(user->min_eus_per_subslice) > sizeof(context->
min_eus_per_subslice) && (user->min_eus_per_subslice
) >> (8 * sizeof(context->min_eus_per_subslice)))
	   context->min_eus_per_subslice)(sizeof(user->min_eus_per_subslice) > sizeof(context->
min_eus_per_subslice) && (user->min_eus_per_subslice
) >> (8 * sizeof(context->min_eus_per_subslice))) ||
   overflows_type(user->max_eus_per_subslice,(sizeof(user->max_eus_per_subslice) > sizeof(context->
max_eus_per_subslice) && (user->max_eus_per_subslice
) >> (8 * sizeof(context->max_eus_per_subslice)))
	   context->max_eus_per_subslice)(sizeof(user->max_eus_per_subslice) > sizeof(context->
max_eus_per_subslice) && (user->max_eus_per_subslice
) >> (8 * sizeof(context->max_eus_per_subslice))))
return -EINVAL22;

/* Check validity against hardware. */
if (user->slice_mask & ~device->slice_mask)
return -EINVAL22;

if (user->subslice_mask & ~dev_subslice_mask)
return -EINVAL22;

if (user->max_eus_per_subslice > device->max_eus_per_subslice)
return -EINVAL22;

context->slice_mask = user->slice_mask;
context->subslice_mask = user->subslice_mask;
context->min_eus_per_subslice = user->min_eus_per_subslice;
context->max_eus_per_subslice = user->max_eus_per_subslice;

/* Part specific restrictions. */
if (GRAPHICS_VER(i915)((&(i915)->__runtime)->graphics.ip.ver) == 11) {
unsigned int hw_s = hweight8(device->slice_mask);
unsigned int hw_ss_per_s = hweight8(dev_subslice_mask);
unsigned int req_s = hweight8(context->slice_mask);
unsigned int req_ss = hweight8(context->subslice_mask);

/*
 * Only full subslice enablement is possible if more than one
 * slice is turned on.
 */
if (req_s > 1 && req_ss != hw_ss_per_s)
	return -EINVAL22;

/*
 * If more than four (SScount bitfield limit) subslices are
 * requested then the number has to be even.
 */
if (req_ss > 4 && (req_ss & 1))
	return -EINVAL22;

/*
 * If only one slice is enabled and subslice count is below the
 * device full enablement, it must be at most half of the all
 * available subslices.
 */
if (req_s == 1 && req_ss < hw_ss_per_s &&
    req_ss > (hw_ss_per_s / 2))
	return -EINVAL22;

/* ABI restriction - VME use case only. */

/* All slices or one slice only. */
if (req_s != 1 && req_s != hw_s)
	return -EINVAL22;

/*
 * Half subslices or full enablement only when one slice is
 * enabled.
 */
if (req_s == 1 &&
    (req_ss != hw_ss_per_s && req_ss != (hw_ss_per_s / 2)))
	return -EINVAL22;

/* No EU configuration changes. */
if ((user->min_eus_per_subslice !=
     device->max_eus_per_subslice) ||
    (user->max_eus_per_subslice !=
     device->max_eus_per_subslice))
	return -EINVAL22;
}

return 0;
2013}

2015static int set_sseu(struct i915_gem_context *ctx,
    struct drm_i915_gem_context_param *args)
2017{
struct drm_i915_privateinteldrm_softc *i915 = ctx->i915;
struct drm_i915_gem_context_param_sseu user_sseu;
struct intel_context *ce;
struct intel_sseu sseu;
unsigned long lookup;
int ret;

if (args->size < sizeof(user_sseu))
return -EINVAL22;

if (GRAPHICS_VER(i915)((&(i915)->__runtime)->graphics.ip.ver) != 11)
return -ENODEV19;

if (copy_from_user(&user_sseu, u64_to_user_ptr(args->value)((void *)(uintptr_t)(args->value)),
	   sizeof(user_sseu)))
return -EFAULT14;

if (user_sseu.rsvd)
return -EINVAL22;

if (user_sseu.flags & ~(I915_CONTEXT_SSEU_FLAG_ENGINE_INDEX(1u << 0)))
return -EINVAL22;

lookup = 0;
if (user_sseu.flags & I915_CONTEXT_SSEU_FLAG_ENGINE_INDEX(1u << 0))
lookup |= LOOKUP_USER_INDEX(1UL << (0));

ce = lookup_user_engine(ctx, lookup, &user_sseu.engine);
if (IS_ERR(ce))
return PTR_ERR(ce);

/* Only render engine supports RPCS configuration. */
if (ce->engine->class != RENDER_CLASS0) {
ret = -ENODEV19;
goto out_ce;
}

ret = i915_gem_user_to_context_sseu(ce->engine->gt, &user_sseu, &sseu);
if (ret)
goto out_ce;

ret = intel_context_reconfigure_sseu(ce, sseu);
if (ret)
goto out_ce;

args->size = sizeof(user_sseu);

2065out_ce:
intel_context_put(ce);
return ret;
2068}

2070static int
2071set_persistence(struct i915_gem_context *ctx,
const struct drm_i915_gem_context_param *args)
2073{
if (args->size)
return -EINVAL22;

return __context_set_persistence(ctx, args->value);
2078}

2080static int set_priority(struct i915_gem_context *ctx,
	const struct drm_i915_gem_context_param *args)
2082{
struct i915_gem_engines_iter it;
struct intel_context *ce;
int err;

err = validate_priority(ctx->i915, args);
if (err)
return err;

ctx->sched.priority = args->value;

for_each_gem_engine(ce, i915_gem_context_lock_engines(ctx), it)for (i915_gem_engines_iter_init(&(it), (i915_gem_context_lock_engines
(ctx))); ((ce) = i915_gem_engines_iter_next(&(it)));) {
if (!intel_engine_has_timeslices(ce->engine))
	continue;

if (ctx->sched.priority >= I915_PRIORITY_NORMAL &&
    intel_engine_has_semaphores(ce->engine))
	intel_context_set_use_semaphores(ce);
else
	intel_context_clear_use_semaphores(ce);
}
i915_gem_context_unlock_engines(ctx);

return 0;
2106}

2108static int get_protected(struct i915_gem_context *ctx,
	 struct drm_i915_gem_context_param *args)
2110{
args->size = 0;
args->value = i915_gem_context_uses_protected_content(ctx);

return 0;
2115}

2117static int ctx_setparam(struct drm_i915_file_private *fpriv,
	struct i915_gem_context *ctx,
	struct drm_i915_gem_context_param *args)
2120{
int ret = 0;

switch (args->param) {
case I915_CONTEXT_PARAM_NO_ERROR_CAPTURE0x4:
if (args->size)
	ret = -EINVAL22;
else if (args->value)
	i915_gem_context_set_no_error_capture(ctx);
else
	i915_gem_context_clear_no_error_capture(ctx);
break;

case I915_CONTEXT_PARAM_BANNABLE0x5:
if (args->size)
	ret = -EINVAL22;
else if (!capable(CAP_SYS_ADMIN0x1) && !args->value)
	ret = -EPERM1;
else if (args->value)
	i915_gem_context_set_bannable(ctx);
else if (i915_gem_context_uses_protected_content(ctx))
	ret = -EPERM1; /* can't clear this for protected contexts */
else
	i915_gem_context_clear_bannable(ctx);
break;

case I915_CONTEXT_PARAM_RECOVERABLE0x8:
if (args->size)
	ret = -EINVAL22;
else if (!args->value)
	i915_gem_context_clear_recoverable(ctx);
else if (i915_gem_context_uses_protected_content(ctx))
	ret = -EPERM1; /* can't set this for protected contexts */
else
	i915_gem_context_set_recoverable(ctx);
break;

case I915_CONTEXT_PARAM_PRIORITY0x6:
ret = set_priority(ctx, args);
break;

case I915_CONTEXT_PARAM_SSEU0x7:
ret = set_sseu(ctx, args);
break;

case I915_CONTEXT_PARAM_PERSISTENCE0xb:
ret = set_persistence(ctx, args);
break;

case I915_CONTEXT_PARAM_PROTECTED_CONTENT0xd:
case I915_CONTEXT_PARAM_NO_ZEROMAP0x2:
case I915_CONTEXT_PARAM_BAN_PERIOD0x1:
case I915_CONTEXT_PARAM_RINGSIZE0xc:
case I915_CONTEXT_PARAM_VM0x9:
case I915_CONTEXT_PARAM_ENGINES0xa:
default:
ret = -EINVAL22;
break;
}

return ret;
2181}

2183struct create_ext {
struct i915_gem_proto_context *pc;
struct drm_i915_file_private *fpriv;
2186};

2188static int create_setparam(struct i915_user_extension __user *ext, void *data)
2189{
struct drm_i915_gem_context_create_ext_setparam local;
const struct create_ext *arg = data;

if (copy_from_user(&local, ext, sizeof(local)))
return -EFAULT14;

if (local.param.ctx_id)
return -EINVAL22;

return set_proto_ctx_param(arg->fpriv, arg->pc, &local.param);
2200}

2202static int invalid_ext(struct i915_user_extension __user *ext, void *data)
2203{
return -EINVAL22;
2205}

2207static const i915_user_extension_fn create_extensions[] = {
[I915_CONTEXT_CREATE_EXT_SETPARAM0] = create_setparam,
[I915_CONTEXT_CREATE_EXT_CLONE1] = invalid_ext,
2210};

2212static bool_Bool client_is_banned(struct drm_i915_file_private *file_priv)
2213{
return atomic_read(&file_priv->ban_score)({ typeof(*(&file_priv->ban_score)) __tmp = *(volatile
 typeof(*(&file_priv->ban_score)) *)&(*(&file_priv
->ban_score)); membar_datadep_consumer(); __tmp; }) >= I915_CLIENT_SCORE_BANNED9;
2215}

2217static inline struct i915_gem_context *
2218__context_lookup(struct drm_i915_file_private *file_priv, u32 id)
2219{
struct i915_gem_context *ctx;

rcu_read_lock();
ctx = xa_load(&file_priv->context_xa, id);
if (ctx && !kref_get_unless_zero(&ctx->ref))
ctx = NULL((void *)0);
rcu_read_unlock();

return ctx;
2229}

2231static struct i915_gem_context *
2232finalize_create_context_locked(struct drm_i915_file_private *file_priv,
	       struct i915_gem_proto_context *pc, u32 id)
2234{
struct i915_gem_context *ctx;
void *old;

lockdep_assert_held(&file_priv->proto_context_lock)do { (void)(&file_priv->proto_context_lock); } while(0
);

ctx = i915_gem_create_context(file_priv->dev_priv, pc);
if (IS_ERR(ctx))
return ctx;

/*
* One for the xarray and one for the caller.  We need to grab
* the reference *prior* to making the ctx visble to userspace
* in gem_context_register(), as at any point after that
* userspace can try to race us with another thread destroying
* the context under our feet.
*/
i915_gem_context_get(ctx);

gem_context_register(ctx, file_priv, id);

old = xa_erase(&file_priv->proto_context_xa, id);
GEM_BUG_ON(old != pc)((void)0);
proto_context_close(file_priv->dev_priv, pc);

return ctx;
2260}

2262struct i915_gem_context *
2263i915_gem_context_lookup(struct drm_i915_file_private *file_priv, u32 id)
2264{
struct i915_gem_proto_context *pc;
struct i915_gem_context *ctx;

ctx = __context_lookup(file_priv, id);
if (ctx)
return ctx;

mutex_lock(&file_priv->proto_context_lock)rw_enter_write(&file_priv->proto_context_lock);
/* Try one more time under the lock */
ctx = __context_lookup(file_priv, id);
if (!ctx) {
pc = xa_load(&file_priv->proto_context_xa, id);
if (!pc)
	ctx = ERR_PTR(-ENOENT2);
else
	ctx = finalize_create_context_locked(file_priv, pc, id);
}
mutex_unlock(&file_priv->proto_context_lock)rw_exit_write(&file_priv->proto_context_lock);

return ctx;
2285}

2287int i915_gem_context_create_ioctl(struct drm_device *dev, void *data,
		  struct drm_file *file)
2289{
struct drm_i915_privateinteldrm_softc *i915 = to_i915(dev);
struct drm_i915_gem_context_create_ext *args = data;
struct create_ext ext_data;
int ret;
u32 id;

if (!DRIVER_CAPS(i915)(&(i915)->caps)->has_logical_contexts)
1
Assuming field 'has_logical_contexts' is true→
2
←
Taking false branch→
return -ENODEV19;

if (args->flags & I915_CONTEXT_CREATE_FLAGS_UNKNOWN(-((1u << 1) << 1)))
3
←
Assuming the condition is false→
4
←
Taking false branch→
return -EINVAL22;

ret = intel_gt_terminally_wedged(to_gt(i915));
if (ret)
5
←
Assuming 'ret' is 0→
6
←
Taking false branch→
return ret;

ext_data.fpriv = file->driver_priv;
if (client_is_banned(ext_data.fpriv)) {
7
←
Taking false branch→
2308#ifdef __linux__
drm_dbg(&i915->drm,__drm_dev_dbg(((void *)0), (&i915->drm) ? (&i915->
drm)->dev : ((void *)0), DRM_UT_DRIVER, "client %s[%d] banned from creating ctx\n"
, current->comm, task_pid_nr(current))
	"client %s[%d] banned from creating ctx\n",__drm_dev_dbg(((void *)0), (&i915->drm) ? (&i915->
drm)->dev : ((void *)0), DRM_UT_DRIVER, "client %s[%d] banned from creating ctx\n"
, current->comm, task_pid_nr(current))
	current->comm, task_pid_nr(current))__drm_dev_dbg(((void *)0), (&i915->drm) ? (&i915->
drm)->dev : ((void *)0), DRM_UT_DRIVER, "client %s[%d] banned from creating ctx\n"
, current->comm, task_pid_nr(current));
2312#else
drm_dbg(&i915->drm,__drm_dev_dbg(((void *)0), (&i915->drm) ? (&i915->
drm)->dev : ((void *)0), DRM_UT_DRIVER, "client %s[%d] banned from creating ctx\n"
, ({struct cpu_info *__ci; asm volatile("movq %%gs:%P1,%0" : "=r"
 (__ci) :"n" (__builtin_offsetof(struct cpu_info, ci_self)));
 __ci;})->ci_curproc->p_p->ps_comm, ({struct cpu_info
 *__ci; asm volatile("movq %%gs:%P1,%0" : "=r" (__ci) :"n" (__builtin_offsetof
(struct cpu_info, ci_self))); __ci;})->ci_curproc->p_p->
ps_pid)
	"client %s[%d] banned from creating ctx\n",__drm_dev_dbg(((void *)0), (&i915->drm) ? (&i915->
drm)->dev : ((void *)0), DRM_UT_DRIVER, "client %s[%d] banned from creating ctx\n"
, ({struct cpu_info *__ci; asm volatile("movq %%gs:%P1,%0" : "=r"
 (__ci) :"n" (__builtin_offsetof(struct cpu_info, ci_self)));
 __ci;})->ci_curproc->p_p->ps_comm, ({struct cpu_info
 *__ci; asm volatile("movq %%gs:%P1,%0" : "=r" (__ci) :"n" (__builtin_offsetof
(struct cpu_info, ci_self))); __ci;})->ci_curproc->p_p->
ps_pid)
	curproc->p_p->ps_comm, curproc->p_p->ps_pid)__drm_dev_dbg(((void *)0), (&i915->drm) ? (&i915->
drm)->dev : ((void *)0), DRM_UT_DRIVER, "client %s[%d] banned from creating ctx\n"
, ({struct cpu_info *__ci; asm volatile("movq %%gs:%P1,%0" : "=r"
 (__ci) :"n" (__builtin_offsetof(struct cpu_info, ci_self)));
 __ci;})->ci_curproc->p_p->ps_comm, ({struct cpu_info
 *__ci; asm volatile("movq %%gs:%P1,%0" : "=r" (__ci) :"n" (__builtin_offsetof
(struct cpu_info, ci_self))); __ci;})->ci_curproc->p_p->
ps_pid);
2316#endif
return -EIO5;
}

ext_data.pc = proto_context_create(i915, args->flags);
8
←
Calling 'proto_context_create'→
18
←
Returned allocated memory→
if (IS_ERR(ext_data.pc))
19
←
Taking false branch→
return PTR_ERR(ext_data.pc);

if (args->flags & I915_CONTEXT_CREATE_FLAGS_USE_EXTENSIONS(1u << 0)) {
20
←
Assuming the condition is false→
21
←
Taking false branch→
ret = i915_user_extensions(u64_to_user_ptr(args->extensions)((void *)(uintptr_t)(args->extensions)),
			   create_extensions,
			   ARRAY_SIZE(create_extensions)(sizeof((create_extensions)) / sizeof((create_extensions)[0])
),
			   &ext_data);
if (ret)
	goto err_pc;
}

if (GRAPHICS_VER(i915)((&(i915)->__runtime)->graphics.ip.ver) > 12) {
22
←
Assuming field 'ver' is <= 12→
23
←
Taking false branch→
struct i915_gem_context *ctx;

/* Get ourselves a context ID */
ret = xa_alloc(&ext_data.fpriv->context_xa, &id, NULL((void *)0),
	       xa_limit_32b0, GFP_KERNEL(0x0001 | 0x0004));
if (ret)
	goto err_pc;

ctx = i915_gem_create_context(i915, ext_data.pc);
if (IS_ERR(ctx)) {
	ret = PTR_ERR(ctx);
	goto err_pc;
}

proto_context_close(i915, ext_data.pc);
gem_context_register(ctx, ext_data.fpriv, id);
} else {
ret = proto_context_register(ext_data.fpriv, ext_data.pc, &id);
if (ret < 0)
24
←
Assuming 'ret' is >= 0→
25
←
Taking false branch→
	goto err_pc;
}

args->ctx_id = id;
26
←
Potential leak of memory pointed to by 'ext_data.pc'
drm_dbg(&i915->drm, "HW context %d created\n", args->ctx_id)__drm_dev_dbg(((void *)0), (&i915->drm) ? (&i915->
drm)->dev : ((void *)0), DRM_UT_DRIVER, "HW context %d created\n"
, args->ctx_id);

return 0;

2361err_pc:
proto_context_close(i915, ext_data.pc);
return ret;
2364}

2366int i915_gem_context_destroy_ioctl(struct drm_device *dev, void *data,
		   struct drm_file *file)
2368{
struct drm_i915_gem_context_destroy *args = data;
struct drm_i915_file_private *file_priv = file->driver_priv;
struct i915_gem_proto_context *pc;
struct i915_gem_context *ctx;

if (args->pad != 0)
return -EINVAL22;

if (!args->ctx_id)
return -ENOENT2;

/* We need to hold the proto-context lock here to prevent races
* with finalize_create_context_locked().
*/
mutex_lock(&file_priv->proto_context_lock)rw_enter_write(&file_priv->proto_context_lock);
ctx = xa_erase(&file_priv->context_xa, args->ctx_id);
pc = xa_erase(&file_priv->proto_context_xa, args->ctx_id);
mutex_unlock(&file_priv->proto_context_lock)rw_exit_write(&file_priv->proto_context_lock);

if (!ctx && !pc)
return -ENOENT2;
GEM_WARN_ON(ctx && pc)({ __builtin_expect(!!(!!(ctx && pc)), 0); });

if (pc)
proto_context_close(file_priv->dev_priv, pc);

if (ctx)
context_close(ctx);

return 0;
2399}

2401static int get_sseu(struct i915_gem_context *ctx,
    struct drm_i915_gem_context_param *args)
2403{
struct drm_i915_gem_context_param_sseu user_sseu;
struct intel_context *ce;
unsigned long lookup;
int err;

if (args->size == 0)
goto out;
else if (args->size < sizeof(user_sseu))
return -EINVAL22;

if (copy_from_user(&user_sseu, u64_to_user_ptr(args->value)((void *)(uintptr_t)(args->value)),
	   sizeof(user_sseu)))
return -EFAULT14;

if (user_sseu.rsvd)
return -EINVAL22;

if (user_sseu.flags & ~(I915_CONTEXT_SSEU_FLAG_ENGINE_INDEX(1u << 0)))
return -EINVAL22;

lookup = 0;
if (user_sseu.flags & I915_CONTEXT_SSEU_FLAG_ENGINE_INDEX(1u << 0))
lookup |= LOOKUP_USER_INDEX(1UL << (0));

ce = lookup_user_engine(ctx, lookup, &user_sseu.engine);
if (IS_ERR(ce))
return PTR_ERR(ce);

err = intel_context_lock_pinned(ce); /* serialises with set_sseu */
if (err) {
intel_context_put(ce);
return err;
}

user_sseu.slice_mask = ce->sseu.slice_mask;
user_sseu.subslice_mask = ce->sseu.subslice_mask;
user_sseu.min_eus_per_subslice = ce->sseu.min_eus_per_subslice;
user_sseu.max_eus_per_subslice = ce->sseu.max_eus_per_subslice;

intel_context_unlock_pinned(ce);
intel_context_put(ce);

if (copy_to_user(u64_to_user_ptr(args->value)((void *)(uintptr_t)(args->value)), &user_sseu,
	 sizeof(user_sseu)))
return -EFAULT14;

2450out:
args->size = sizeof(user_sseu);

return 0;
2454}

2456int i915_gem_context_getparam_ioctl(struct drm_device *dev, void *data,
		    struct drm_file *file)
2458{
struct drm_i915_file_private *file_priv = file->driver_priv;
struct drm_i915_gem_context_param *args = data;
struct i915_gem_context *ctx;
struct i915_address_space *vm;
int ret = 0;

ctx = i915_gem_context_lookup(file_priv, args->ctx_id);
if (IS_ERR(ctx))
return PTR_ERR(ctx);

switch (args->param) {
case I915_CONTEXT_PARAM_GTT_SIZE0x3:
args->size = 0;
vm = i915_gem_context_get_eb_vm(ctx);
args->value = vm->total;
i915_vm_put(vm);

break;

case I915_CONTEXT_PARAM_NO_ERROR_CAPTURE0x4:
args->size = 0;
args->value = i915_gem_context_no_error_capture(ctx);
break;

case I915_CONTEXT_PARAM_BANNABLE0x5:
args->size = 0;
args->value = i915_gem_context_is_bannable(ctx);
break;

case I915_CONTEXT_PARAM_RECOVERABLE0x8:
args->size = 0;
args->value = i915_gem_context_is_recoverable(ctx);
break;

case I915_CONTEXT_PARAM_PRIORITY0x6:
args->size = 0;
args->value = ctx->sched.priority;
break;

case I915_CONTEXT_PARAM_SSEU0x7:
ret = get_sseu(ctx, args);
break;

case I915_CONTEXT_PARAM_VM0x9:
ret = get_ppgtt(file_priv, ctx, args);
break;

case I915_CONTEXT_PARAM_PERSISTENCE0xb:
args->size = 0;
args->value = i915_gem_context_is_persistent(ctx);
break;

case I915_CONTEXT_PARAM_PROTECTED_CONTENT0xd:
ret = get_protected(ctx, args);
break;

case I915_CONTEXT_PARAM_NO_ZEROMAP0x2:
case I915_CONTEXT_PARAM_BAN_PERIOD0x1:
case I915_CONTEXT_PARAM_ENGINES0xa:
case I915_CONTEXT_PARAM_RINGSIZE0xc:
default:
ret = -EINVAL22;
break;
}

i915_gem_context_put(ctx);
return ret;
2526}

2528int i915_gem_context_setparam_ioctl(struct drm_device *dev, void *data,
		    struct drm_file *file)
2530{
struct drm_i915_file_private *file_priv = file->driver_priv;
struct drm_i915_gem_context_param *args = data;
struct i915_gem_proto_context *pc;
struct i915_gem_context *ctx;
int ret = 0;

mutex_lock(&file_priv->proto_context_lock)rw_enter_write(&file_priv->proto_context_lock);
ctx = __context_lookup(file_priv, args->ctx_id);
if (!ctx) {
pc = xa_load(&file_priv->proto_context_xa, args->ctx_id);
if (pc) {
	/* Contexts should be finalized inside
	 * GEM_CONTEXT_CREATE starting with graphics
	 * version 13.
	 */
	WARN_ON(GRAPHICS_VER(file_priv->dev_priv) > 12)({ int __ret = !!(((&(file_priv->dev_priv)->__runtime
)->graphics.ip.ver) > 12); if (__ret) printf("WARNING %s failed at %s:%d\n"
, "((&(file_priv->dev_priv)->__runtime)->graphics.ip.ver) > 12"
, "/usr/src/sys/dev/pci/drm/i915/gem/i915_gem_context.c", 2546
); __builtin_expect(!!(__ret), 0); });
	ret = set_proto_ctx_param(file_priv, pc, args);
} else {
	ret = -ENOENT2;
}
}
mutex_unlock(&file_priv->proto_context_lock)rw_exit_write(&file_priv->proto_context_lock);

if (ctx) {
ret = ctx_setparam(file_priv, ctx, args);
i915_gem_context_put(ctx);
}

return ret;
2560}

2562int i915_gem_context_reset_stats_ioctl(struct drm_device *dev,
		       void *data, struct drm_file *file)
2564{
struct drm_i915_privateinteldrm_softc *i915 = to_i915(dev);
struct drm_i915_reset_stats *args = data;
struct i915_gem_context *ctx;

if (args->flags || args->pad)
return -EINVAL22;

ctx = i915_gem_context_lookup(file->driver_priv, args->ctx_id);
if (IS_ERR(ctx))
return PTR_ERR(ctx);

/*
* We opt for unserialised reads here. This may result in tearing
* in the extremely unlikely event of a GPU hang on this context
* as we are querying them. If we need that extra layer of protection,
* we should wrap the hangstats with a seqlock.
*/

if (capable(CAP_SYS_ADMIN0x1))
args->reset_count = i915_reset_count(&i915->gpu_error);
else
args->reset_count = 0;

args->batch_active = atomic_read(&ctx->guilty_count)({ typeof(*(&ctx->guilty_count)) __tmp = *(volatile typeof
(*(&ctx->guilty_count)) *)&(*(&ctx->guilty_count
)); membar_datadep_consumer(); __tmp; });
args->batch_pending = atomic_read(&ctx->active_count)({ typeof(*(&ctx->active_count)) __tmp = *(volatile typeof
(*(&ctx->active_count)) *)&(*(&ctx->active_count
)); membar_datadep_consumer(); __tmp; });

i915_gem_context_put(ctx);
return 0;
2593}

2595/* GEM context-engines iterator: for_each_gem_engine() */
2596struct intel_context *
2597i915_gem_engines_iter_next(struct i915_gem_engines_iter *it)
2598{
const struct i915_gem_engines *e = it->engines;
struct intel_context *ctx;

if (unlikely(!e)__builtin_expect(!!(!e), 0))
return NULL((void *)0);

do {
if (it->idx >= e->num_engines)
	return NULL((void *)0);

ctx = e->engines[it->idx++];
} while (!ctx);

return ctx;
2613}

2615#if IS_ENABLED(CONFIG_DRM_I915_SELFTEST)0
2616#include "selftests/mock_context.c"
2617#include "selftests/i915_gem_context.c"
2618#endif

2620void i915_gem_context_module_exit(void)
2621{
2622#ifdef __linux__
kmem_cache_destroy(slab_luts);
2624#else
pool_destroy(&slab_luts);
2626#endif
2627}

2629int __init i915_gem_context_module_init(void)
2630{
2631#ifdef __linux__
slab_luts = KMEM_CACHE(i915_lut_handle, 0);
if (!slab_luts)
return -ENOMEM12;
2635#else
pool_init(&slab_luts , sizeof(struct i915_lut_handle),
   0, IPL_NONE0x0, 0, "drmlut", NULL((void *)0));
2638#endif

return 0;
2641}

←

/usr/src/sys/dev/pci/drm/include/linux/slab.h

1/* Public domain. */
2 
3#ifndef _LINUX_SLAB_H
4#define _LINUX_SLAB_H
5 
6#include <sys/types.h>
7#include <sys/malloc.h>
8 
9#include <linux/types.h>
10#include <linux/workqueue.h>
11#include <linux/gfp.h>
12 
13#include <linux/processor.h>	/* for CACHELINESIZE */
14 
15#define ARCH_KMALLOC_MINALIGN64 CACHELINESIZE64
16 
17#define ZERO_SIZE_PTR((void *)0) NULL((void *)0)
18 
19static inline void *
20kmalloc(size_t size, int flags)
21{
22	return malloc(size, M_DRM145, flags);
23}
24 
25static inline void *
26kmalloc_array(size_t n, size_t size, int flags)
27{
28	if (n != 0 && SIZE_MAX0xffffffffffffffffUL / n < size)
29		return NULL((void *)0);
30	return malloc(n * size, M_DRM145, flags);
31}
32 
33static inline void *
34kcalloc(size_t n, size_t size, int flags)
35{
36	if (n != 0 && SIZE_MAX0xffffffffffffffffUL / n < size)
37		return NULL((void *)0);
38	return malloc(n * size, M_DRM145, flags | M_ZERO0x0008);
39}
40 
41static inline void *
42kzalloc(size_t size, int flags)
43{
44	return malloc(size, M_DRM145, flags | M_ZERO0x0008);
10
←
Memory is allocated→
45}
46 
47static inline void
48kfree(const void *objp)
49{
50	free((void *)objp, M_DRM145, 0);
51}
52 
53#endif