Home | History | Annotate | Line # | Download | only in vmwgfx
      1 /*	$NetBSD: vmwgfx_surface.c,v 1.3 2021/12/18 23:45:45 riastradh Exp $	*/
      2 
      3 // SPDX-License-Identifier: GPL-2.0 OR MIT
      4 /**************************************************************************
      5  *
      6  * Copyright 2009-2015 VMware, Inc., Palo Alto, CA., USA
      7  *
      8  * Permission is hereby granted, free of charge, to any person obtaining a
      9  * copy of this software and associated documentation files (the
     10  * "Software"), to deal in the Software without restriction, including
     11  * without limitation the rights to use, copy, modify, merge, publish,
     12  * distribute, sub license, and/or sell copies of the Software, and to
     13  * permit persons to whom the Software is furnished to do so, subject to
     14  * the following conditions:
     15  *
     16  * The above copyright notice and this permission notice (including the
     17  * next paragraph) shall be included in all copies or substantial portions
     18  * of the Software.
     19  *
     20  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
     21  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
     22  * FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. IN NO EVENT SHALL
     23  * THE COPYRIGHT HOLDERS, AUTHORS AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM,
     24  * DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
     25  * OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
     26  * USE OR OTHER DEALINGS IN THE SOFTWARE.
     27  *
     28  **************************************************************************/
     29 
     30 #include <sys/cdefs.h>
     31 __KERNEL_RCSID(0, "$NetBSD: vmwgfx_surface.c,v 1.3 2021/12/18 23:45:45 riastradh Exp $");
     32 
     33 #include <drm/ttm/ttm_placement.h>
     34 
     35 #include "vmwgfx_drv.h"
     36 #include "vmwgfx_resource_priv.h"
     37 #include "vmwgfx_so.h"
     38 #include "vmwgfx_binding.h"
     39 #include "device_include/svga3d_surfacedefs.h"
     40 
     41 #define SVGA3D_FLAGS_64(upper32, lower32) (((uint64_t)upper32 << 32) | lower32)
     42 #define SVGA3D_FLAGS_UPPER_32(svga3d_flags) (svga3d_flags >> 32)
     43 #define SVGA3D_FLAGS_LOWER_32(svga3d_flags) \
     44 	(svga3d_flags & ((uint64_t)U32_MAX))
     45 
     46 /**
     47  * struct vmw_user_surface - User-space visible surface resource
     48  *
     49  * @base:           The TTM base object handling user-space visibility.
     50  * @srf:            The surface metadata.
     51  * @size:           TTM accounting size for the surface.
     52  * @master: master of the creating client. Used for security check.
     53  */
     54 struct vmw_user_surface {
     55 	struct ttm_prime_object prime;
     56 	struct vmw_surface srf;
     57 	uint32_t size;
     58 	struct drm_master *master;
     59 	struct ttm_base_object *backup_base;
     60 };
     61 
     62 /**
     63  * struct vmw_surface_offset - Backing store mip level offset info
     64  *
     65  * @face:           Surface face.
     66  * @mip:            Mip level.
     67  * @bo_offset:      Offset into backing store of this mip level.
     68  *
     69  */
     70 struct vmw_surface_offset {
     71 	uint32_t face;
     72 	uint32_t mip;
     73 	uint32_t bo_offset;
     74 };
     75 
     76 /**
     77  * vmw_surface_dirty - Surface dirty-tracker
     78  * @cache: Cached layout information of the surface.
     79  * @size: Accounting size for the struct vmw_surface_dirty.
     80  * @num_subres: Number of subresources.
     81  * @boxes: Array of SVGA3dBoxes indicating dirty regions. One per subresource.
     82  */
     83 struct vmw_surface_dirty {
     84 	struct svga3dsurface_cache cache;
     85 	size_t size;
     86 	u32 num_subres;
     87 	SVGA3dBox boxes[0];
     88 };
     89 
     90 static void vmw_user_surface_free(struct vmw_resource *res);
     91 static struct vmw_resource *
     92 vmw_user_surface_base_to_res(struct ttm_base_object *base);
     93 static int vmw_legacy_srf_bind(struct vmw_resource *res,
     94 			       struct ttm_validate_buffer *val_buf);
     95 static int vmw_legacy_srf_unbind(struct vmw_resource *res,
     96 				 bool readback,
     97 				 struct ttm_validate_buffer *val_buf);
     98 static int vmw_legacy_srf_create(struct vmw_resource *res);
     99 static int vmw_legacy_srf_destroy(struct vmw_resource *res);
    100 static int vmw_gb_surface_create(struct vmw_resource *res);
    101 static int vmw_gb_surface_bind(struct vmw_resource *res,
    102 			       struct ttm_validate_buffer *val_buf);
    103 static int vmw_gb_surface_unbind(struct vmw_resource *res,
    104 				 bool readback,
    105 				 struct ttm_validate_buffer *val_buf);
    106 static int vmw_gb_surface_destroy(struct vmw_resource *res);
    107 static int
    108 vmw_gb_surface_define_internal(struct drm_device *dev,
    109 			       struct drm_vmw_gb_surface_create_ext_req *req,
    110 			       struct drm_vmw_gb_surface_create_rep *rep,
    111 			       struct drm_file *file_priv);
    112 static int
    113 vmw_gb_surface_reference_internal(struct drm_device *dev,
    114 				  struct drm_vmw_surface_arg *req,
    115 				  struct drm_vmw_gb_surface_ref_ext_rep *rep,
    116 				  struct drm_file *file_priv);
    117 
    118 static void vmw_surface_dirty_free(struct vmw_resource *res);
    119 static int vmw_surface_dirty_alloc(struct vmw_resource *res);
    120 static int vmw_surface_dirty_sync(struct vmw_resource *res);
    121 static void vmw_surface_dirty_range_add(struct vmw_resource *res, size_t start,
    122 					size_t end);
    123 static int vmw_surface_clean(struct vmw_resource *res);
    124 
    125 static const struct vmw_user_resource_conv user_surface_conv = {
    126 	.object_type = VMW_RES_SURFACE,
    127 	.base_obj_to_res = vmw_user_surface_base_to_res,
    128 	.res_free = vmw_user_surface_free
    129 };
    130 
    131 const struct vmw_user_resource_conv *user_surface_converter =
    132 	&user_surface_conv;
    133 
    134 
    135 static uint64_t vmw_user_surface_size;
    136 
    137 static const struct vmw_res_func vmw_legacy_surface_func = {
    138 	.res_type = vmw_res_surface,
    139 	.needs_backup = false,
    140 	.may_evict = true,
    141 	.prio = 1,
    142 	.dirty_prio = 1,
    143 	.type_name = "legacy surfaces",
    144 	.backup_placement = &vmw_srf_placement,
    145 	.create = &vmw_legacy_srf_create,
    146 	.destroy = &vmw_legacy_srf_destroy,
    147 	.bind = &vmw_legacy_srf_bind,
    148 	.unbind = &vmw_legacy_srf_unbind
    149 };
    150 
    151 static const struct vmw_res_func vmw_gb_surface_func = {
    152 	.res_type = vmw_res_surface,
    153 	.needs_backup = true,
    154 	.may_evict = true,
    155 	.prio = 1,
    156 	.dirty_prio = 2,
    157 	.type_name = "guest backed surfaces",
    158 	.backup_placement = &vmw_mob_placement,
    159 	.create = vmw_gb_surface_create,
    160 	.destroy = vmw_gb_surface_destroy,
    161 	.bind = vmw_gb_surface_bind,
    162 	.unbind = vmw_gb_surface_unbind,
    163 	.dirty_alloc = vmw_surface_dirty_alloc,
    164 	.dirty_free = vmw_surface_dirty_free,
    165 	.dirty_sync = vmw_surface_dirty_sync,
    166 	.dirty_range_add = vmw_surface_dirty_range_add,
    167 	.clean = vmw_surface_clean,
    168 };
    169 
    170 /**
    171  * struct vmw_surface_dma - SVGA3D DMA command
    172  */
    173 struct vmw_surface_dma {
    174 	SVGA3dCmdHeader header;
    175 	SVGA3dCmdSurfaceDMA body;
    176 	SVGA3dCopyBox cb;
    177 	SVGA3dCmdSurfaceDMASuffix suffix;
    178 };
    179 
    180 /**
    181  * struct vmw_surface_define - SVGA3D Surface Define command
    182  */
    183 struct vmw_surface_define {
    184 	SVGA3dCmdHeader header;
    185 	SVGA3dCmdDefineSurface body;
    186 };
    187 
    188 /**
    189  * struct vmw_surface_destroy - SVGA3D Surface Destroy command
    190  */
    191 struct vmw_surface_destroy {
    192 	SVGA3dCmdHeader header;
    193 	SVGA3dCmdDestroySurface body;
    194 };
    195 
    196 
    197 /**
    198  * vmw_surface_dma_size - Compute fifo size for a dma command.
    199  *
    200  * @srf: Pointer to a struct vmw_surface
    201  *
    202  * Computes the required size for a surface dma command for backup or
    203  * restoration of the surface represented by @srf.
    204  */
    205 static inline uint32_t vmw_surface_dma_size(const struct vmw_surface *srf)
    206 {
    207 	return srf->num_sizes * sizeof(struct vmw_surface_dma);
    208 }
    209 
    210 
    211 /**
    212  * vmw_surface_define_size - Compute fifo size for a surface define command.
    213  *
    214  * @srf: Pointer to a struct vmw_surface
    215  *
    216  * Computes the required size for a surface define command for the definition
    217  * of the surface represented by @srf.
    218  */
    219 static inline uint32_t vmw_surface_define_size(const struct vmw_surface *srf)
    220 {
    221 	return sizeof(struct vmw_surface_define) + srf->num_sizes *
    222 		sizeof(SVGA3dSize);
    223 }
    224 
    225 
    226 /**
    227  * vmw_surface_destroy_size - Compute fifo size for a surface destroy command.
    228  *
    229  * Computes the required size for a surface destroy command for the destruction
    230  * of a hw surface.
    231  */
    232 static inline uint32_t vmw_surface_destroy_size(void)
    233 {
    234 	return sizeof(struct vmw_surface_destroy);
    235 }
    236 
    237 /**
    238  * vmw_surface_destroy_encode - Encode a surface_destroy command.
    239  *
    240  * @id: The surface id
    241  * @cmd_space: Pointer to memory area in which the commands should be encoded.
    242  */
    243 static void vmw_surface_destroy_encode(uint32_t id,
    244 				       void *cmd_space)
    245 {
    246 	struct vmw_surface_destroy *cmd = (struct vmw_surface_destroy *)
    247 		cmd_space;
    248 
    249 	cmd->header.id = SVGA_3D_CMD_SURFACE_DESTROY;
    250 	cmd->header.size = sizeof(cmd->body);
    251 	cmd->body.sid = id;
    252 }
    253 
    254 /**
    255  * vmw_surface_define_encode - Encode a surface_define command.
    256  *
    257  * @srf: Pointer to a struct vmw_surface object.
    258  * @cmd_space: Pointer to memory area in which the commands should be encoded.
    259  */
    260 static void vmw_surface_define_encode(const struct vmw_surface *srf,
    261 				      void *cmd_space)
    262 {
    263 	struct vmw_surface_define *cmd = (struct vmw_surface_define *)
    264 		cmd_space;
    265 	struct drm_vmw_size *src_size;
    266 	SVGA3dSize *cmd_size;
    267 	uint32_t cmd_len;
    268 	int i;
    269 
    270 	cmd_len = sizeof(cmd->body) + srf->num_sizes * sizeof(SVGA3dSize);
    271 
    272 	cmd->header.id = SVGA_3D_CMD_SURFACE_DEFINE;
    273 	cmd->header.size = cmd_len;
    274 	cmd->body.sid = srf->res.id;
    275 	/*
    276 	 * Downcast of surfaceFlags, was upcasted when received from user-space,
    277 	 * since driver internally stores as 64 bit.
    278 	 * For legacy surface define only 32 bit flag is supported.
    279 	 */
    280 	cmd->body.surfaceFlags = (SVGA3dSurface1Flags)srf->flags;
    281 	cmd->body.format = srf->format;
    282 	for (i = 0; i < DRM_VMW_MAX_SURFACE_FACES; ++i)
    283 		cmd->body.face[i].numMipLevels = srf->mip_levels[i];
    284 
    285 	cmd += 1;
    286 	cmd_size = (SVGA3dSize *) cmd;
    287 	src_size = srf->sizes;
    288 
    289 	for (i = 0; i < srf->num_sizes; ++i, cmd_size++, src_size++) {
    290 		cmd_size->width = src_size->width;
    291 		cmd_size->height = src_size->height;
    292 		cmd_size->depth = src_size->depth;
    293 	}
    294 }
    295 
    296 /**
    297  * vmw_surface_dma_encode - Encode a surface_dma command.
    298  *
    299  * @srf: Pointer to a struct vmw_surface object.
    300  * @cmd_space: Pointer to memory area in which the commands should be encoded.
    301  * @ptr: Pointer to an SVGAGuestPtr indicating where the surface contents
    302  * should be placed or read from.
    303  * @to_surface: Boolean whether to DMA to the surface or from the surface.
    304  */
    305 static void vmw_surface_dma_encode(struct vmw_surface *srf,
    306 				   void *cmd_space,
    307 				   const SVGAGuestPtr *ptr,
    308 				   bool to_surface)
    309 {
    310 	uint32_t i;
    311 	struct vmw_surface_dma *cmd = (struct vmw_surface_dma *)cmd_space;
    312 	const struct svga3d_surface_desc *desc =
    313 		svga3dsurface_get_desc(srf->format);
    314 
    315 	for (i = 0; i < srf->num_sizes; ++i) {
    316 		SVGA3dCmdHeader *header = &cmd->header;
    317 		SVGA3dCmdSurfaceDMA *body = &cmd->body;
    318 		SVGA3dCopyBox *cb = &cmd->cb;
    319 		SVGA3dCmdSurfaceDMASuffix *suffix = &cmd->suffix;
    320 		const struct vmw_surface_offset *cur_offset = &srf->offsets[i];
    321 		const struct drm_vmw_size *cur_size = &srf->sizes[i];
    322 
    323 		header->id = SVGA_3D_CMD_SURFACE_DMA;
    324 		header->size = sizeof(*body) + sizeof(*cb) + sizeof(*suffix);
    325 
    326 		body->guest.ptr = *ptr;
    327 		body->guest.ptr.offset += cur_offset->bo_offset;
    328 		body->guest.pitch = svga3dsurface_calculate_pitch(desc,
    329 								  cur_size);
    330 		body->host.sid = srf->res.id;
    331 		body->host.face = cur_offset->face;
    332 		body->host.mipmap = cur_offset->mip;
    333 		body->transfer = ((to_surface) ?  SVGA3D_WRITE_HOST_VRAM :
    334 				  SVGA3D_READ_HOST_VRAM);
    335 		cb->x = 0;
    336 		cb->y = 0;
    337 		cb->z = 0;
    338 		cb->srcx = 0;
    339 		cb->srcy = 0;
    340 		cb->srcz = 0;
    341 		cb->w = cur_size->width;
    342 		cb->h = cur_size->height;
    343 		cb->d = cur_size->depth;
    344 
    345 		suffix->suffixSize = sizeof(*suffix);
    346 		suffix->maximumOffset =
    347 			svga3dsurface_get_image_buffer_size(desc, cur_size,
    348 							    body->guest.pitch);
    349 		suffix->flags.discard = 0;
    350 		suffix->flags.unsynchronized = 0;
    351 		suffix->flags.reserved = 0;
    352 		++cmd;
    353 	}
    354 };
    355 
    356 
    357 /**
    358  * vmw_hw_surface_destroy - destroy a Device surface
    359  *
    360  * @res:        Pointer to a struct vmw_resource embedded in a struct
    361  *              vmw_surface.
    362  *
    363  * Destroys a the device surface associated with a struct vmw_surface if
    364  * any, and adjusts accounting and resource count accordingly.
    365  */
    366 static void vmw_hw_surface_destroy(struct vmw_resource *res)
    367 {
    368 
    369 	struct vmw_private *dev_priv = res->dev_priv;
    370 	void *cmd;
    371 
    372 	if (res->func->destroy == vmw_gb_surface_destroy) {
    373 		(void) vmw_gb_surface_destroy(res);
    374 		return;
    375 	}
    376 
    377 	if (res->id != -1) {
    378 
    379 		cmd = VMW_FIFO_RESERVE(dev_priv, vmw_surface_destroy_size());
    380 		if (unlikely(!cmd))
    381 			return;
    382 
    383 		vmw_surface_destroy_encode(res->id, cmd);
    384 		vmw_fifo_commit(dev_priv, vmw_surface_destroy_size());
    385 
    386 		/*
    387 		 * used_memory_size_atomic, or separate lock
    388 		 * to avoid taking dev_priv::cmdbuf_mutex in
    389 		 * the destroy path.
    390 		 */
    391 
    392 		mutex_lock(&dev_priv->cmdbuf_mutex);
    393 		dev_priv->used_memory_size -= res->backup_size;
    394 		mutex_unlock(&dev_priv->cmdbuf_mutex);
    395 	}
    396 }
    397 
    398 /**
    399  * vmw_legacy_srf_create - Create a device surface as part of the
    400  * resource validation process.
    401  *
    402  * @res: Pointer to a struct vmw_surface.
    403  *
    404  * If the surface doesn't have a hw id.
    405  *
    406  * Returns -EBUSY if there wasn't sufficient device resources to
    407  * complete the validation. Retry after freeing up resources.
    408  *
    409  * May return other errors if the kernel is out of guest resources.
    410  */
    411 static int vmw_legacy_srf_create(struct vmw_resource *res)
    412 {
    413 	struct vmw_private *dev_priv = res->dev_priv;
    414 	struct vmw_surface *srf;
    415 	uint32_t submit_size;
    416 	uint8_t *cmd;
    417 	int ret;
    418 
    419 	if (likely(res->id != -1))
    420 		return 0;
    421 
    422 	srf = vmw_res_to_srf(res);
    423 	if (unlikely(dev_priv->used_memory_size + res->backup_size >=
    424 		     dev_priv->memory_size))
    425 		return -EBUSY;
    426 
    427 	/*
    428 	 * Alloc id for the resource.
    429 	 */
    430 
    431 	ret = vmw_resource_alloc_id(res);
    432 	if (unlikely(ret != 0)) {
    433 		DRM_ERROR("Failed to allocate a surface id.\n");
    434 		goto out_no_id;
    435 	}
    436 
    437 	if (unlikely(res->id >= SVGA3D_MAX_SURFACE_IDS)) {
    438 		ret = -EBUSY;
    439 		goto out_no_fifo;
    440 	}
    441 
    442 	/*
    443 	 * Encode surface define- commands.
    444 	 */
    445 
    446 	submit_size = vmw_surface_define_size(srf);
    447 	cmd = VMW_FIFO_RESERVE(dev_priv, submit_size);
    448 	if (unlikely(!cmd)) {
    449 		ret = -ENOMEM;
    450 		goto out_no_fifo;
    451 	}
    452 
    453 	vmw_surface_define_encode(srf, cmd);
    454 	vmw_fifo_commit(dev_priv, submit_size);
    455 	vmw_fifo_resource_inc(dev_priv);
    456 
    457 	/*
    458 	 * Surface memory usage accounting.
    459 	 */
    460 
    461 	dev_priv->used_memory_size += res->backup_size;
    462 	return 0;
    463 
    464 out_no_fifo:
    465 	vmw_resource_release_id(res);
    466 out_no_id:
    467 	return ret;
    468 }
    469 
    470 /**
    471  * vmw_legacy_srf_dma - Copy backup data to or from a legacy surface.
    472  *
    473  * @res:            Pointer to a struct vmw_res embedded in a struct
    474  *                  vmw_surface.
    475  * @val_buf:        Pointer to a struct ttm_validate_buffer containing
    476  *                  information about the backup buffer.
    477  * @bind:           Boolean wether to DMA to the surface.
    478  *
    479  * Transfer backup data to or from a legacy surface as part of the
    480  * validation process.
    481  * May return other errors if the kernel is out of guest resources.
    482  * The backup buffer will be fenced or idle upon successful completion,
    483  * and if the surface needs persistent backup storage, the backup buffer
    484  * will also be returned reserved iff @bind is true.
    485  */
    486 static int vmw_legacy_srf_dma(struct vmw_resource *res,
    487 			      struct ttm_validate_buffer *val_buf,
    488 			      bool bind)
    489 {
    490 	SVGAGuestPtr ptr;
    491 	struct vmw_fence_obj *fence;
    492 	uint32_t submit_size;
    493 	struct vmw_surface *srf = vmw_res_to_srf(res);
    494 	uint8_t *cmd;
    495 	struct vmw_private *dev_priv = res->dev_priv;
    496 
    497 	BUG_ON(!val_buf->bo);
    498 	submit_size = vmw_surface_dma_size(srf);
    499 	cmd = VMW_FIFO_RESERVE(dev_priv, submit_size);
    500 	if (unlikely(!cmd))
    501 		return -ENOMEM;
    502 
    503 	vmw_bo_get_guest_ptr(val_buf->bo, &ptr);
    504 	vmw_surface_dma_encode(srf, cmd, &ptr, bind);
    505 
    506 	vmw_fifo_commit(dev_priv, submit_size);
    507 
    508 	/*
    509 	 * Create a fence object and fence the backup buffer.
    510 	 */
    511 
    512 	(void) vmw_execbuf_fence_commands(NULL, dev_priv,
    513 					  &fence, NULL);
    514 
    515 	vmw_bo_fence_single(val_buf->bo, fence);
    516 
    517 	if (likely(fence != NULL))
    518 		vmw_fence_obj_unreference(&fence);
    519 
    520 	return 0;
    521 }
    522 
    523 /**
    524  * vmw_legacy_srf_bind - Perform a legacy surface bind as part of the
    525  *                       surface validation process.
    526  *
    527  * @res:            Pointer to a struct vmw_res embedded in a struct
    528  *                  vmw_surface.
    529  * @val_buf:        Pointer to a struct ttm_validate_buffer containing
    530  *                  information about the backup buffer.
    531  *
    532  * This function will copy backup data to the surface if the
    533  * backup buffer is dirty.
    534  */
    535 static int vmw_legacy_srf_bind(struct vmw_resource *res,
    536 			       struct ttm_validate_buffer *val_buf)
    537 {
    538 	if (!res->backup_dirty)
    539 		return 0;
    540 
    541 	return vmw_legacy_srf_dma(res, val_buf, true);
    542 }
    543 
    544 
    545 /**
    546  * vmw_legacy_srf_unbind - Perform a legacy surface unbind as part of the
    547  *                         surface eviction process.
    548  *
    549  * @res:            Pointer to a struct vmw_res embedded in a struct
    550  *                  vmw_surface.
    551  * @val_buf:        Pointer to a struct ttm_validate_buffer containing
    552  *                  information about the backup buffer.
    553  *
    554  * This function will copy backup data from the surface.
    555  */
    556 static int vmw_legacy_srf_unbind(struct vmw_resource *res,
    557 				 bool readback,
    558 				 struct ttm_validate_buffer *val_buf)
    559 {
    560 	if (unlikely(readback))
    561 		return vmw_legacy_srf_dma(res, val_buf, false);
    562 	return 0;
    563 }
    564 
    565 /**
    566  * vmw_legacy_srf_destroy - Destroy a device surface as part of a
    567  *                          resource eviction process.
    568  *
    569  * @res:            Pointer to a struct vmw_res embedded in a struct
    570  *                  vmw_surface.
    571  */
    572 static int vmw_legacy_srf_destroy(struct vmw_resource *res)
    573 {
    574 	struct vmw_private *dev_priv = res->dev_priv;
    575 	uint32_t submit_size;
    576 	uint8_t *cmd;
    577 
    578 	BUG_ON(res->id == -1);
    579 
    580 	/*
    581 	 * Encode the dma- and surface destroy commands.
    582 	 */
    583 
    584 	submit_size = vmw_surface_destroy_size();
    585 	cmd = VMW_FIFO_RESERVE(dev_priv, submit_size);
    586 	if (unlikely(!cmd))
    587 		return -ENOMEM;
    588 
    589 	vmw_surface_destroy_encode(res->id, cmd);
    590 	vmw_fifo_commit(dev_priv, submit_size);
    591 
    592 	/*
    593 	 * Surface memory usage accounting.
    594 	 */
    595 
    596 	dev_priv->used_memory_size -= res->backup_size;
    597 
    598 	/*
    599 	 * Release the surface ID.
    600 	 */
    601 
    602 	vmw_resource_release_id(res);
    603 	vmw_fifo_resource_dec(dev_priv);
    604 
    605 	return 0;
    606 }
    607 
    608 
    609 /**
    610  * vmw_surface_init - initialize a struct vmw_surface
    611  *
    612  * @dev_priv:       Pointer to a device private struct.
    613  * @srf:            Pointer to the struct vmw_surface to initialize.
    614  * @res_free:       Pointer to a resource destructor used to free
    615  *                  the object.
    616  */
    617 static int vmw_surface_init(struct vmw_private *dev_priv,
    618 			    struct vmw_surface *srf,
    619 			    void (*res_free) (struct vmw_resource *res))
    620 {
    621 	int ret;
    622 	struct vmw_resource *res = &srf->res;
    623 
    624 	BUG_ON(!res_free);
    625 	ret = vmw_resource_init(dev_priv, res, true, res_free,
    626 				(dev_priv->has_mob) ? &vmw_gb_surface_func :
    627 				&vmw_legacy_surface_func);
    628 
    629 	if (unlikely(ret != 0)) {
    630 		res_free(res);
    631 		return ret;
    632 	}
    633 
    634 	/*
    635 	 * The surface won't be visible to hardware until a
    636 	 * surface validate.
    637 	 */
    638 
    639 	INIT_LIST_HEAD(&srf->view_list);
    640 	res->hw_destroy = vmw_hw_surface_destroy;
    641 	return ret;
    642 }
    643 
    644 /**
    645  * vmw_user_surface_base_to_res - TTM base object to resource converter for
    646  *                                user visible surfaces
    647  *
    648  * @base:           Pointer to a TTM base object
    649  *
    650  * Returns the struct vmw_resource embedded in a struct vmw_surface
    651  * for the user-visible object identified by the TTM base object @base.
    652  */
    653 static struct vmw_resource *
    654 vmw_user_surface_base_to_res(struct ttm_base_object *base)
    655 {
    656 	return &(container_of(base, struct vmw_user_surface,
    657 			      prime.base)->srf.res);
    658 }
    659 
    660 /**
    661  * vmw_user_surface_free - User visible surface resource destructor
    662  *
    663  * @res:            A struct vmw_resource embedded in a struct vmw_surface.
    664  */
    665 static void vmw_user_surface_free(struct vmw_resource *res)
    666 {
    667 	struct vmw_surface *srf = vmw_res_to_srf(res);
    668 	struct vmw_user_surface *user_srf =
    669 	    container_of(srf, struct vmw_user_surface, srf);
    670 	struct vmw_private *dev_priv = srf->res.dev_priv;
    671 	uint32_t size = user_srf->size;
    672 
    673 	WARN_ON_ONCE(res->dirty);
    674 	if (user_srf->master)
    675 		drm_master_put(&user_srf->master);
    676 	kfree(srf->offsets);
    677 	kfree(srf->sizes);
    678 	kfree(srf->snooper.image);
    679 	ttm_prime_object_kfree(user_srf, prime);
    680 	ttm_mem_global_free(vmw_mem_glob(dev_priv), size);
    681 }
    682 
    683 /**
    684  * vmw_user_surface_free - User visible surface TTM base object destructor
    685  *
    686  * @p_base:         Pointer to a pointer to a TTM base object
    687  *                  embedded in a struct vmw_user_surface.
    688  *
    689  * Drops the base object's reference on its resource, and the
    690  * pointer pointed to by *p_base is set to NULL.
    691  */
    692 static void vmw_user_surface_base_release(struct ttm_base_object **p_base)
    693 {
    694 	struct ttm_base_object *base = *p_base;
    695 	struct vmw_user_surface *user_srf =
    696 	    container_of(base, struct vmw_user_surface, prime.base);
    697 	struct vmw_resource *res = &user_srf->srf.res;
    698 
    699 	*p_base = NULL;
    700 	if (user_srf->backup_base)
    701 		ttm_base_object_unref(&user_srf->backup_base);
    702 	vmw_resource_unreference(&res);
    703 }
    704 
    705 /**
    706  * vmw_user_surface_destroy_ioctl - Ioctl function implementing
    707  *                                  the user surface destroy functionality.
    708  *
    709  * @dev:            Pointer to a struct drm_device.
    710  * @data:           Pointer to data copied from / to user-space.
    711  * @file_priv:      Pointer to a drm file private structure.
    712  */
    713 int vmw_surface_destroy_ioctl(struct drm_device *dev, void *data,
    714 			      struct drm_file *file_priv)
    715 {
    716 	struct drm_vmw_surface_arg *arg = (struct drm_vmw_surface_arg *)data;
    717 	struct ttm_object_file *tfile = vmw_fpriv(file_priv)->tfile;
    718 
    719 	return ttm_ref_object_base_unref(tfile, arg->sid, TTM_REF_USAGE);
    720 }
    721 
    722 /**
    723  * vmw_user_surface_define_ioctl - Ioctl function implementing
    724  *                                  the user surface define functionality.
    725  *
    726  * @dev:            Pointer to a struct drm_device.
    727  * @data:           Pointer to data copied from / to user-space.
    728  * @file_priv:      Pointer to a drm file private structure.
    729  */
    730 int vmw_surface_define_ioctl(struct drm_device *dev, void *data,
    731 			     struct drm_file *file_priv)
    732 {
    733 	struct vmw_private *dev_priv = vmw_priv(dev);
    734 	struct vmw_user_surface *user_srf;
    735 	struct vmw_surface *srf;
    736 	struct vmw_resource *res;
    737 	struct vmw_resource *tmp;
    738 	union drm_vmw_surface_create_arg *arg =
    739 	    (union drm_vmw_surface_create_arg *)data;
    740 	struct drm_vmw_surface_create_req *req = &arg->req;
    741 	struct drm_vmw_surface_arg *rep = &arg->rep;
    742 	struct ttm_object_file *tfile = vmw_fpriv(file_priv)->tfile;
    743 	struct ttm_operation_ctx ctx = {
    744 		.interruptible = true,
    745 		.no_wait_gpu = false
    746 	};
    747 	int ret;
    748 	int i, j;
    749 	uint32_t cur_bo_offset;
    750 	struct drm_vmw_size *cur_size;
    751 	struct vmw_surface_offset *cur_offset;
    752 	uint32_t num_sizes;
    753 	uint32_t size;
    754 	const struct svga3d_surface_desc *desc;
    755 
    756 	if (unlikely(vmw_user_surface_size == 0))
    757 		vmw_user_surface_size = ttm_round_pot(sizeof(*user_srf)) +
    758 			VMW_IDA_ACC_SIZE + TTM_OBJ_EXTRA_SIZE;
    759 
    760 	num_sizes = 0;
    761 	for (i = 0; i < DRM_VMW_MAX_SURFACE_FACES; ++i) {
    762 		if (req->mip_levels[i] > DRM_VMW_MAX_MIP_LEVELS)
    763 			return -EINVAL;
    764 		num_sizes += req->mip_levels[i];
    765 	}
    766 
    767 	if (num_sizes > DRM_VMW_MAX_SURFACE_FACES * DRM_VMW_MAX_MIP_LEVELS ||
    768 	    num_sizes == 0)
    769 		return -EINVAL;
    770 
    771 	size = vmw_user_surface_size +
    772 		ttm_round_pot(num_sizes * sizeof(struct drm_vmw_size)) +
    773 		ttm_round_pot(num_sizes * sizeof(struct vmw_surface_offset));
    774 
    775 	desc = svga3dsurface_get_desc(req->format);
    776 	if (unlikely(desc->block_desc == SVGA3DBLOCKDESC_NONE)) {
    777 		VMW_DEBUG_USER("Invalid format %d for surface creation.\n",
    778 			       req->format);
    779 		return -EINVAL;
    780 	}
    781 
    782 	ret = ttm_read_lock(&dev_priv->reservation_sem, true);
    783 	if (unlikely(ret != 0))
    784 		return ret;
    785 
    786 	ret = ttm_mem_global_alloc(vmw_mem_glob(dev_priv),
    787 				   size, &ctx);
    788 	if (unlikely(ret != 0)) {
    789 		if (ret != -ERESTARTSYS)
    790 			DRM_ERROR("Out of graphics memory for surface.\n");
    791 		goto out_unlock;
    792 	}
    793 
    794 	user_srf = kzalloc(sizeof(*user_srf), GFP_KERNEL);
    795 	if (unlikely(!user_srf)) {
    796 		ret = -ENOMEM;
    797 		goto out_no_user_srf;
    798 	}
    799 
    800 	srf = &user_srf->srf;
    801 	res = &srf->res;
    802 
    803 	/* Driver internally stores as 64-bit flags */
    804 	srf->flags = (SVGA3dSurfaceAllFlags)req->flags;
    805 	srf->format = req->format;
    806 	srf->scanout = req->scanout;
    807 
    808 	memcpy(srf->mip_levels, req->mip_levels, sizeof(srf->mip_levels));
    809 	srf->num_sizes = num_sizes;
    810 	user_srf->size = size;
    811 	srf->sizes = memdup_user((struct drm_vmw_size __user *)(unsigned long)
    812 				 req->size_addr,
    813 				 sizeof(*srf->sizes) * srf->num_sizes);
    814 	if (IS_ERR(srf->sizes)) {
    815 		ret = PTR_ERR(srf->sizes);
    816 		goto out_no_sizes;
    817 	}
    818 	srf->offsets = kmalloc_array(srf->num_sizes,
    819 				     sizeof(*srf->offsets),
    820 				     GFP_KERNEL);
    821 	if (unlikely(!srf->offsets)) {
    822 		ret = -ENOMEM;
    823 		goto out_no_offsets;
    824 	}
    825 
    826 	srf->base_size = *srf->sizes;
    827 	srf->autogen_filter = SVGA3D_TEX_FILTER_NONE;
    828 	srf->multisample_count = 0;
    829 	srf->multisample_pattern = SVGA3D_MS_PATTERN_NONE;
    830 	srf->quality_level = SVGA3D_MS_QUALITY_NONE;
    831 
    832 	cur_bo_offset = 0;
    833 	cur_offset = srf->offsets;
    834 	cur_size = srf->sizes;
    835 
    836 	for (i = 0; i < DRM_VMW_MAX_SURFACE_FACES; ++i) {
    837 		for (j = 0; j < srf->mip_levels[i]; ++j) {
    838 			uint32_t stride = svga3dsurface_calculate_pitch
    839 				(desc, cur_size);
    840 
    841 			cur_offset->face = i;
    842 			cur_offset->mip = j;
    843 			cur_offset->bo_offset = cur_bo_offset;
    844 			cur_bo_offset += svga3dsurface_get_image_buffer_size
    845 				(desc, cur_size, stride);
    846 			++cur_offset;
    847 			++cur_size;
    848 		}
    849 	}
    850 	res->backup_size = cur_bo_offset;
    851 	if (srf->scanout &&
    852 	    srf->num_sizes == 1 &&
    853 	    srf->sizes[0].width == 64 &&
    854 	    srf->sizes[0].height == 64 &&
    855 	    srf->format == SVGA3D_A8R8G8B8) {
    856 
    857 		srf->snooper.image = kzalloc(64 * 64 * 4, GFP_KERNEL);
    858 		if (!srf->snooper.image) {
    859 			DRM_ERROR("Failed to allocate cursor_image\n");
    860 			ret = -ENOMEM;
    861 			goto out_no_copy;
    862 		}
    863 	} else {
    864 		srf->snooper.image = NULL;
    865 	}
    866 
    867 	user_srf->prime.base.shareable = false;
    868 	user_srf->prime.base.tfile = NULL;
    869 	if (drm_is_primary_client(file_priv))
    870 		user_srf->master = drm_master_get(file_priv->master);
    871 
    872 	/**
    873 	 * From this point, the generic resource management functions
    874 	 * destroy the object on failure.
    875 	 */
    876 
    877 	ret = vmw_surface_init(dev_priv, srf, vmw_user_surface_free);
    878 	if (unlikely(ret != 0))
    879 		goto out_unlock;
    880 
    881 	/*
    882 	 * A gb-aware client referencing a shared surface will
    883 	 * expect a backup buffer to be present.
    884 	 */
    885 	if (dev_priv->has_mob && req->shareable) {
    886 		uint32_t backup_handle;
    887 
    888 		ret = vmw_user_bo_alloc(dev_priv, tfile,
    889 					res->backup_size,
    890 					true,
    891 					&backup_handle,
    892 					&res->backup,
    893 					&user_srf->backup_base);
    894 		if (unlikely(ret != 0)) {
    895 			vmw_resource_unreference(&res);
    896 			goto out_unlock;
    897 		}
    898 	}
    899 
    900 	tmp = vmw_resource_reference(&srf->res);
    901 	ret = ttm_prime_object_init(tfile, res->backup_size, &user_srf->prime,
    902 				    req->shareable, VMW_RES_SURFACE,
    903 				    &vmw_user_surface_base_release, NULL);
    904 
    905 	if (unlikely(ret != 0)) {
    906 		vmw_resource_unreference(&tmp);
    907 		vmw_resource_unreference(&res);
    908 		goto out_unlock;
    909 	}
    910 
    911 	rep->sid = user_srf->prime.base.handle;
    912 	vmw_resource_unreference(&res);
    913 
    914 	ttm_read_unlock(&dev_priv->reservation_sem);
    915 	return 0;
    916 out_no_copy:
    917 	kfree(srf->offsets);
    918 out_no_offsets:
    919 	kfree(srf->sizes);
    920 out_no_sizes:
    921 	ttm_prime_object_kfree(user_srf, prime);
    922 out_no_user_srf:
    923 	ttm_mem_global_free(vmw_mem_glob(dev_priv), size);
    924 out_unlock:
    925 	ttm_read_unlock(&dev_priv->reservation_sem);
    926 	return ret;
    927 }
    928 
    929 
    930 static int
    931 vmw_surface_handle_reference(struct vmw_private *dev_priv,
    932 			     struct drm_file *file_priv,
    933 			     uint32_t u_handle,
    934 			     enum drm_vmw_handle_type handle_type,
    935 			     struct ttm_base_object **base_p)
    936 {
    937 	struct ttm_object_file *tfile = vmw_fpriv(file_priv)->tfile;
    938 	struct vmw_user_surface *user_srf;
    939 	uint32_t handle;
    940 	struct ttm_base_object *base;
    941 	int ret;
    942 
    943 	if (handle_type == DRM_VMW_HANDLE_PRIME) {
    944 		ret = ttm_prime_fd_to_handle(tfile, u_handle, &handle);
    945 		if (unlikely(ret != 0))
    946 			return ret;
    947 	} else {
    948 		handle = u_handle;
    949 	}
    950 
    951 	ret = -EINVAL;
    952 	base = ttm_base_object_lookup_for_ref(dev_priv->tdev, handle);
    953 	if (unlikely(!base)) {
    954 		VMW_DEBUG_USER("Could not find surface to reference.\n");
    955 		goto out_no_lookup;
    956 	}
    957 
    958 	if (unlikely(ttm_base_object_type(base) != VMW_RES_SURFACE)) {
    959 		VMW_DEBUG_USER("Referenced object is not a surface.\n");
    960 		goto out_bad_resource;
    961 	}
    962 
    963 	if (handle_type != DRM_VMW_HANDLE_PRIME) {
    964 		bool require_exist = false;
    965 
    966 		user_srf = container_of(base, struct vmw_user_surface,
    967 					prime.base);
    968 
    969 		/* Error out if we are unauthenticated primary */
    970 		if (drm_is_primary_client(file_priv) &&
    971 		    !file_priv->authenticated) {
    972 			ret = -EACCES;
    973 			goto out_bad_resource;
    974 		}
    975 
    976 		/*
    977 		 * Make sure the surface creator has the same
    978 		 * authenticating master, or is already registered with us.
    979 		 */
    980 		if (drm_is_primary_client(file_priv) &&
    981 		    user_srf->master != file_priv->master)
    982 			require_exist = true;
    983 
    984 		if (unlikely(drm_is_render_client(file_priv)))
    985 			require_exist = true;
    986 
    987 		ret = ttm_ref_object_add(tfile, base, TTM_REF_USAGE, NULL,
    988 					 require_exist);
    989 		if (unlikely(ret != 0)) {
    990 			DRM_ERROR("Could not add a reference to a surface.\n");
    991 			goto out_bad_resource;
    992 		}
    993 	}
    994 
    995 	*base_p = base;
    996 	return 0;
    997 
    998 out_bad_resource:
    999 	ttm_base_object_unref(&base);
   1000 out_no_lookup:
   1001 	if (handle_type == DRM_VMW_HANDLE_PRIME)
   1002 		(void) ttm_ref_object_base_unref(tfile, handle, TTM_REF_USAGE);
   1003 
   1004 	return ret;
   1005 }
   1006 
   1007 /**
   1008  * vmw_user_surface_define_ioctl - Ioctl function implementing
   1009  *                                  the user surface reference functionality.
   1010  *
   1011  * @dev:            Pointer to a struct drm_device.
   1012  * @data:           Pointer to data copied from / to user-space.
   1013  * @file_priv:      Pointer to a drm file private structure.
   1014  */
   1015 int vmw_surface_reference_ioctl(struct drm_device *dev, void *data,
   1016 				struct drm_file *file_priv)
   1017 {
   1018 	struct vmw_private *dev_priv = vmw_priv(dev);
   1019 	union drm_vmw_surface_reference_arg *arg =
   1020 	    (union drm_vmw_surface_reference_arg *)data;
   1021 	struct drm_vmw_surface_arg *req = &arg->req;
   1022 	struct drm_vmw_surface_create_req *rep = &arg->rep;
   1023 	struct ttm_object_file *tfile = vmw_fpriv(file_priv)->tfile;
   1024 	struct vmw_surface *srf;
   1025 	struct vmw_user_surface *user_srf;
   1026 	struct drm_vmw_size __user *user_sizes;
   1027 	struct ttm_base_object *base;
   1028 	int ret;
   1029 
   1030 	ret = vmw_surface_handle_reference(dev_priv, file_priv, req->sid,
   1031 					   req->handle_type, &base);
   1032 	if (unlikely(ret != 0))
   1033 		return ret;
   1034 
   1035 	user_srf = container_of(base, struct vmw_user_surface, prime.base);
   1036 	srf = &user_srf->srf;
   1037 
   1038 	/* Downcast of flags when sending back to user space */
   1039 	rep->flags = (uint32_t)srf->flags;
   1040 	rep->format = srf->format;
   1041 	memcpy(rep->mip_levels, srf->mip_levels, sizeof(srf->mip_levels));
   1042 	user_sizes = (struct drm_vmw_size __user *)(unsigned long)
   1043 	    rep->size_addr;
   1044 
   1045 	if (user_sizes)
   1046 		ret = copy_to_user(user_sizes, &srf->base_size,
   1047 				   sizeof(srf->base_size));
   1048 	if (unlikely(ret != 0)) {
   1049 		VMW_DEBUG_USER("copy_to_user failed %p %u\n", user_sizes,
   1050 			       srf->num_sizes);
   1051 		ttm_ref_object_base_unref(tfile, base->handle, TTM_REF_USAGE);
   1052 		ret = -EFAULT;
   1053 	}
   1054 
   1055 	ttm_base_object_unref(&base);
   1056 
   1057 	return ret;
   1058 }
   1059 
   1060 /**
   1061  * vmw_surface_define_encode - Encode a surface_define command.
   1062  *
   1063  * @srf: Pointer to a struct vmw_surface object.
   1064  * @cmd_space: Pointer to memory area in which the commands should be encoded.
   1065  */
   1066 static int vmw_gb_surface_create(struct vmw_resource *res)
   1067 {
   1068 	struct vmw_private *dev_priv = res->dev_priv;
   1069 	struct vmw_surface *srf = vmw_res_to_srf(res);
   1070 	uint32_t cmd_len, cmd_id, submit_len;
   1071 	int ret;
   1072 	struct {
   1073 		SVGA3dCmdHeader header;
   1074 		SVGA3dCmdDefineGBSurface body;
   1075 	} *cmd;
   1076 	struct {
   1077 		SVGA3dCmdHeader header;
   1078 		SVGA3dCmdDefineGBSurface_v2 body;
   1079 	} *cmd2;
   1080 	struct {
   1081 		SVGA3dCmdHeader header;
   1082 		SVGA3dCmdDefineGBSurface_v3 body;
   1083 	} *cmd3;
   1084 
   1085 	if (likely(res->id != -1))
   1086 		return 0;
   1087 
   1088 	vmw_fifo_resource_inc(dev_priv);
   1089 	ret = vmw_resource_alloc_id(res);
   1090 	if (unlikely(ret != 0)) {
   1091 		DRM_ERROR("Failed to allocate a surface id.\n");
   1092 		goto out_no_id;
   1093 	}
   1094 
   1095 	if (unlikely(res->id >= VMWGFX_NUM_GB_SURFACE)) {
   1096 		ret = -EBUSY;
   1097 		goto out_no_fifo;
   1098 	}
   1099 
   1100 	if (dev_priv->has_sm4_1 && srf->array_size > 0) {
   1101 		cmd_id = SVGA_3D_CMD_DEFINE_GB_SURFACE_V3;
   1102 		cmd_len = sizeof(cmd3->body);
   1103 		submit_len = sizeof(*cmd3);
   1104 	} else if (srf->array_size > 0) {
   1105 		/* has_dx checked on creation time. */
   1106 		cmd_id = SVGA_3D_CMD_DEFINE_GB_SURFACE_V2;
   1107 		cmd_len = sizeof(cmd2->body);
   1108 		submit_len = sizeof(*cmd2);
   1109 	} else {
   1110 		cmd_id = SVGA_3D_CMD_DEFINE_GB_SURFACE;
   1111 		cmd_len = sizeof(cmd->body);
   1112 		submit_len = sizeof(*cmd);
   1113 	}
   1114 
   1115 	cmd = VMW_FIFO_RESERVE(dev_priv, submit_len);
   1116 	cmd2 = (typeof(cmd2))cmd;
   1117 	cmd3 = (typeof(cmd3))cmd;
   1118 	if (unlikely(!cmd)) {
   1119 		ret = -ENOMEM;
   1120 		goto out_no_fifo;
   1121 	}
   1122 
   1123 	if (dev_priv->has_sm4_1 && srf->array_size > 0) {
   1124 		cmd3->header.id = cmd_id;
   1125 		cmd3->header.size = cmd_len;
   1126 		cmd3->body.sid = srf->res.id;
   1127 		cmd3->body.surfaceFlags = srf->flags;
   1128 		cmd3->body.format = srf->format;
   1129 		cmd3->body.numMipLevels = srf->mip_levels[0];
   1130 		cmd3->body.multisampleCount = srf->multisample_count;
   1131 		cmd3->body.multisamplePattern = srf->multisample_pattern;
   1132 		cmd3->body.qualityLevel = srf->quality_level;
   1133 		cmd3->body.autogenFilter = srf->autogen_filter;
   1134 		cmd3->body.size.width = srf->base_size.width;
   1135 		cmd3->body.size.height = srf->base_size.height;
   1136 		cmd3->body.size.depth = srf->base_size.depth;
   1137 		cmd3->body.arraySize = srf->array_size;
   1138 	} else if (srf->array_size > 0) {
   1139 		cmd2->header.id = cmd_id;
   1140 		cmd2->header.size = cmd_len;
   1141 		cmd2->body.sid = srf->res.id;
   1142 		cmd2->body.surfaceFlags = srf->flags;
   1143 		cmd2->body.format = srf->format;
   1144 		cmd2->body.numMipLevels = srf->mip_levels[0];
   1145 		cmd2->body.multisampleCount = srf->multisample_count;
   1146 		cmd2->body.autogenFilter = srf->autogen_filter;
   1147 		cmd2->body.size.width = srf->base_size.width;
   1148 		cmd2->body.size.height = srf->base_size.height;
   1149 		cmd2->body.size.depth = srf->base_size.depth;
   1150 		cmd2->body.arraySize = srf->array_size;
   1151 	} else {
   1152 		cmd->header.id = cmd_id;
   1153 		cmd->header.size = cmd_len;
   1154 		cmd->body.sid = srf->res.id;
   1155 		cmd->body.surfaceFlags = srf->flags;
   1156 		cmd->body.format = srf->format;
   1157 		cmd->body.numMipLevels = srf->mip_levels[0];
   1158 		cmd->body.multisampleCount = srf->multisample_count;
   1159 		cmd->body.autogenFilter = srf->autogen_filter;
   1160 		cmd->body.size.width = srf->base_size.width;
   1161 		cmd->body.size.height = srf->base_size.height;
   1162 		cmd->body.size.depth = srf->base_size.depth;
   1163 	}
   1164 
   1165 	vmw_fifo_commit(dev_priv, submit_len);
   1166 
   1167 	return 0;
   1168 
   1169 out_no_fifo:
   1170 	vmw_resource_release_id(res);
   1171 out_no_id:
   1172 	vmw_fifo_resource_dec(dev_priv);
   1173 	return ret;
   1174 }
   1175 
   1176 
   1177 static int vmw_gb_surface_bind(struct vmw_resource *res,
   1178 			       struct ttm_validate_buffer *val_buf)
   1179 {
   1180 	struct vmw_private *dev_priv = res->dev_priv;
   1181 	struct {
   1182 		SVGA3dCmdHeader header;
   1183 		SVGA3dCmdBindGBSurface body;
   1184 	} *cmd1;
   1185 	struct {
   1186 		SVGA3dCmdHeader header;
   1187 		SVGA3dCmdUpdateGBSurface body;
   1188 	} *cmd2;
   1189 	uint32_t submit_size;
   1190 	struct ttm_buffer_object *bo = val_buf->bo;
   1191 
   1192 	BUG_ON(bo->mem.mem_type != VMW_PL_MOB);
   1193 
   1194 	submit_size = sizeof(*cmd1) + (res->backup_dirty ? sizeof(*cmd2) : 0);
   1195 
   1196 	cmd1 = VMW_FIFO_RESERVE(dev_priv, submit_size);
   1197 	if (unlikely(!cmd1))
   1198 		return -ENOMEM;
   1199 
   1200 	cmd1->header.id = SVGA_3D_CMD_BIND_GB_SURFACE;
   1201 	cmd1->header.size = sizeof(cmd1->body);
   1202 	cmd1->body.sid = res->id;
   1203 	cmd1->body.mobid = bo->mem.start;
   1204 	if (res->backup_dirty) {
   1205 		cmd2 = (void *) &cmd1[1];
   1206 		cmd2->header.id = SVGA_3D_CMD_UPDATE_GB_SURFACE;
   1207 		cmd2->header.size = sizeof(cmd2->body);
   1208 		cmd2->body.sid = res->id;
   1209 	}
   1210 	vmw_fifo_commit(dev_priv, submit_size);
   1211 
   1212 	if (res->backup->dirty && res->backup_dirty) {
   1213 		/* We've just made a full upload. Cear dirty regions. */
   1214 		vmw_bo_dirty_clear_res(res);
   1215 	}
   1216 
   1217 	res->backup_dirty = false;
   1218 
   1219 	return 0;
   1220 }
   1221 
   1222 static int vmw_gb_surface_unbind(struct vmw_resource *res,
   1223 				 bool readback,
   1224 				 struct ttm_validate_buffer *val_buf)
   1225 {
   1226 	struct vmw_private *dev_priv = res->dev_priv;
   1227 	struct ttm_buffer_object *bo = val_buf->bo;
   1228 	struct vmw_fence_obj *fence;
   1229 
   1230 	struct {
   1231 		SVGA3dCmdHeader header;
   1232 		SVGA3dCmdReadbackGBSurface body;
   1233 	} *cmd1;
   1234 	struct {
   1235 		SVGA3dCmdHeader header;
   1236 		SVGA3dCmdInvalidateGBSurface body;
   1237 	} *cmd2;
   1238 	struct {
   1239 		SVGA3dCmdHeader header;
   1240 		SVGA3dCmdBindGBSurface body;
   1241 	} *cmd3;
   1242 	uint32_t submit_size;
   1243 	uint8_t *cmd;
   1244 
   1245 
   1246 	BUG_ON(bo->mem.mem_type != VMW_PL_MOB);
   1247 
   1248 	submit_size = sizeof(*cmd3) + (readback ? sizeof(*cmd1) : sizeof(*cmd2));
   1249 	cmd = VMW_FIFO_RESERVE(dev_priv, submit_size);
   1250 	if (unlikely(!cmd))
   1251 		return -ENOMEM;
   1252 
   1253 	if (readback) {
   1254 		cmd1 = (void *) cmd;
   1255 		cmd1->header.id = SVGA_3D_CMD_READBACK_GB_SURFACE;
   1256 		cmd1->header.size = sizeof(cmd1->body);
   1257 		cmd1->body.sid = res->id;
   1258 		cmd3 = (void *) &cmd1[1];
   1259 	} else {
   1260 		cmd2 = (void *) cmd;
   1261 		cmd2->header.id = SVGA_3D_CMD_INVALIDATE_GB_SURFACE;
   1262 		cmd2->header.size = sizeof(cmd2->body);
   1263 		cmd2->body.sid = res->id;
   1264 		cmd3 = (void *) &cmd2[1];
   1265 	}
   1266 
   1267 	cmd3->header.id = SVGA_3D_CMD_BIND_GB_SURFACE;
   1268 	cmd3->header.size = sizeof(cmd3->body);
   1269 	cmd3->body.sid = res->id;
   1270 	cmd3->body.mobid = SVGA3D_INVALID_ID;
   1271 
   1272 	vmw_fifo_commit(dev_priv, submit_size);
   1273 
   1274 	/*
   1275 	 * Create a fence object and fence the backup buffer.
   1276 	 */
   1277 
   1278 	(void) vmw_execbuf_fence_commands(NULL, dev_priv,
   1279 					  &fence, NULL);
   1280 
   1281 	vmw_bo_fence_single(val_buf->bo, fence);
   1282 
   1283 	if (likely(fence != NULL))
   1284 		vmw_fence_obj_unreference(&fence);
   1285 
   1286 	return 0;
   1287 }
   1288 
   1289 static int vmw_gb_surface_destroy(struct vmw_resource *res)
   1290 {
   1291 	struct vmw_private *dev_priv = res->dev_priv;
   1292 	struct vmw_surface *srf = vmw_res_to_srf(res);
   1293 	struct {
   1294 		SVGA3dCmdHeader header;
   1295 		SVGA3dCmdDestroyGBSurface body;
   1296 	} *cmd;
   1297 
   1298 	if (likely(res->id == -1))
   1299 		return 0;
   1300 
   1301 	mutex_lock(&dev_priv->binding_mutex);
   1302 	vmw_view_surface_list_destroy(dev_priv, &srf->view_list);
   1303 	vmw_binding_res_list_scrub(&res->binding_head);
   1304 
   1305 	cmd = VMW_FIFO_RESERVE(dev_priv, sizeof(*cmd));
   1306 	if (unlikely(!cmd)) {
   1307 		mutex_unlock(&dev_priv->binding_mutex);
   1308 		return -ENOMEM;
   1309 	}
   1310 
   1311 	cmd->header.id = SVGA_3D_CMD_DESTROY_GB_SURFACE;
   1312 	cmd->header.size = sizeof(cmd->body);
   1313 	cmd->body.sid = res->id;
   1314 	vmw_fifo_commit(dev_priv, sizeof(*cmd));
   1315 	mutex_unlock(&dev_priv->binding_mutex);
   1316 	vmw_resource_release_id(res);
   1317 	vmw_fifo_resource_dec(dev_priv);
   1318 
   1319 	return 0;
   1320 }
   1321 
   1322 
   1323 /**
   1324  * vmw_gb_surface_define_ioctl - Ioctl function implementing
   1325  * the user surface define functionality.
   1326  *
   1327  * @dev: Pointer to a struct drm_device.
   1328  * @data: Pointer to data copied from / to user-space.
   1329  * @file_priv: Pointer to a drm file private structure.
   1330  */
   1331 int vmw_gb_surface_define_ioctl(struct drm_device *dev, void *data,
   1332 				struct drm_file *file_priv)
   1333 {
   1334 	union drm_vmw_gb_surface_create_arg *arg =
   1335 	    (union drm_vmw_gb_surface_create_arg *)data;
   1336 	struct drm_vmw_gb_surface_create_rep *rep = &arg->rep;
   1337 	struct drm_vmw_gb_surface_create_ext_req req_ext;
   1338 
   1339 	req_ext.base = arg->req;
   1340 	req_ext.version = drm_vmw_gb_surface_v1;
   1341 	req_ext.svga3d_flags_upper_32_bits = 0;
   1342 	req_ext.multisample_pattern = SVGA3D_MS_PATTERN_NONE;
   1343 	req_ext.quality_level = SVGA3D_MS_QUALITY_NONE;
   1344 	req_ext.must_be_zero = 0;
   1345 
   1346 	return vmw_gb_surface_define_internal(dev, &req_ext, rep, file_priv);
   1347 }
   1348 
   1349 /**
   1350  * vmw_gb_surface_reference_ioctl - Ioctl function implementing
   1351  * the user surface reference functionality.
   1352  *
   1353  * @dev: Pointer to a struct drm_device.
   1354  * @data: Pointer to data copied from / to user-space.
   1355  * @file_priv: Pointer to a drm file private structure.
   1356  */
   1357 int vmw_gb_surface_reference_ioctl(struct drm_device *dev, void *data,
   1358 				   struct drm_file *file_priv)
   1359 {
   1360 	union drm_vmw_gb_surface_reference_arg *arg =
   1361 	    (union drm_vmw_gb_surface_reference_arg *)data;
   1362 	struct drm_vmw_surface_arg *req = &arg->req;
   1363 	struct drm_vmw_gb_surface_ref_rep *rep = &arg->rep;
   1364 	struct drm_vmw_gb_surface_ref_ext_rep rep_ext;
   1365 	int ret;
   1366 
   1367 	ret = vmw_gb_surface_reference_internal(dev, req, &rep_ext, file_priv);
   1368 
   1369 	if (unlikely(ret != 0))
   1370 		return ret;
   1371 
   1372 	rep->creq = rep_ext.creq.base;
   1373 	rep->crep = rep_ext.crep;
   1374 
   1375 	return ret;
   1376 }
   1377 
   1378 /**
   1379  * vmw_surface_gb_priv_define - Define a private GB surface
   1380  *
   1381  * @dev:  Pointer to a struct drm_device
   1382  * @user_accounting_size:  Used to track user-space memory usage, set
   1383  *                         to 0 for kernel mode only memory
   1384  * @svga3d_flags: SVGA3d surface flags for the device
   1385  * @format: requested surface format
   1386  * @for_scanout: true if inteded to be used for scanout buffer
   1387  * @num_mip_levels:  number of MIP levels
   1388  * @multisample_count:
   1389  * @array_size: Surface array size.
   1390  * @size: width, heigh, depth of the surface requested
   1391  * @multisample_pattern: Multisampling pattern when msaa is supported
   1392  * @quality_level: Precision settings
   1393  * @user_srf_out: allocated user_srf.  Set to NULL on failure.
   1394  *
   1395  * GB surfaces allocated by this function will not have a user mode handle, and
   1396  * thus will only be visible to vmwgfx.  For optimization reasons the
   1397  * surface may later be given a user mode handle by another function to make
   1398  * it available to user mode drivers.
   1399  */
   1400 int vmw_surface_gb_priv_define(struct drm_device *dev,
   1401 			       uint32_t user_accounting_size,
   1402 			       SVGA3dSurfaceAllFlags svga3d_flags,
   1403 			       SVGA3dSurfaceFormat format,
   1404 			       bool for_scanout,
   1405 			       uint32_t num_mip_levels,
   1406 			       uint32_t multisample_count,
   1407 			       uint32_t array_size,
   1408 			       struct drm_vmw_size size,
   1409 			       SVGA3dMSPattern multisample_pattern,
   1410 			       SVGA3dMSQualityLevel quality_level,
   1411 			       struct vmw_surface **srf_out)
   1412 {
   1413 	struct vmw_private *dev_priv = vmw_priv(dev);
   1414 	struct vmw_user_surface *user_srf;
   1415 	struct ttm_operation_ctx ctx = {
   1416 		.interruptible = true,
   1417 		.no_wait_gpu = false
   1418 	};
   1419 	struct vmw_surface *srf;
   1420 	int ret;
   1421 	u32 num_layers = 1;
   1422 	u32 sample_count = 1;
   1423 
   1424 	*srf_out = NULL;
   1425 
   1426 	if (for_scanout) {
   1427 		if (!svga3dsurface_is_screen_target_format(format)) {
   1428 			VMW_DEBUG_USER("Invalid Screen Target surface format.");
   1429 			return -EINVAL;
   1430 		}
   1431 
   1432 		if (size.width > dev_priv->texture_max_width ||
   1433 		    size.height > dev_priv->texture_max_height) {
   1434 			VMW_DEBUG_USER("%ux%u\n, exceeds max surface size %ux%u",
   1435 				       size.width, size.height,
   1436 				       dev_priv->texture_max_width,
   1437 				       dev_priv->texture_max_height);
   1438 			return -EINVAL;
   1439 		}
   1440 	} else {
   1441 		const struct svga3d_surface_desc *desc;
   1442 
   1443 		desc = svga3dsurface_get_desc(format);
   1444 		if (unlikely(desc->block_desc == SVGA3DBLOCKDESC_NONE)) {
   1445 			VMW_DEBUG_USER("Invalid surface format.\n");
   1446 			return -EINVAL;
   1447 		}
   1448 	}
   1449 
   1450 	/* array_size must be null for non-GL3 host. */
   1451 	if (array_size > 0 && !dev_priv->has_dx) {
   1452 		VMW_DEBUG_USER("Tried to create DX surface on non-DX host.\n");
   1453 		return -EINVAL;
   1454 	}
   1455 
   1456 	ret = ttm_read_lock(&dev_priv->reservation_sem, true);
   1457 	if (unlikely(ret != 0))
   1458 		return ret;
   1459 
   1460 	ret = ttm_mem_global_alloc(vmw_mem_glob(dev_priv),
   1461 				   user_accounting_size, &ctx);
   1462 	if (unlikely(ret != 0)) {
   1463 		if (ret != -ERESTARTSYS)
   1464 			DRM_ERROR("Out of graphics memory for surface"
   1465 				  " creation.\n");
   1466 		goto out_unlock;
   1467 	}
   1468 
   1469 	user_srf = kzalloc(sizeof(*user_srf), GFP_KERNEL);
   1470 	if (unlikely(!user_srf)) {
   1471 		ret = -ENOMEM;
   1472 		goto out_no_user_srf;
   1473 	}
   1474 
   1475 	*srf_out  = &user_srf->srf;
   1476 	user_srf->size = user_accounting_size;
   1477 	user_srf->prime.base.shareable = false;
   1478 	user_srf->prime.base.tfile     = NULL;
   1479 
   1480 	srf = &user_srf->srf;
   1481 	srf->flags             = svga3d_flags;
   1482 	srf->format            = format;
   1483 	srf->scanout           = for_scanout;
   1484 	srf->mip_levels[0]     = num_mip_levels;
   1485 	srf->num_sizes         = 1;
   1486 	srf->sizes             = NULL;
   1487 	srf->offsets           = NULL;
   1488 	srf->base_size         = size;
   1489 	srf->autogen_filter    = SVGA3D_TEX_FILTER_NONE;
   1490 	srf->array_size        = array_size;
   1491 	srf->multisample_count = multisample_count;
   1492 	srf->multisample_pattern = multisample_pattern;
   1493 	srf->quality_level = quality_level;
   1494 
   1495 	if (array_size)
   1496 		num_layers = array_size;
   1497 	else if (svga3d_flags & SVGA3D_SURFACE_CUBEMAP)
   1498 		num_layers = SVGA3D_MAX_SURFACE_FACES;
   1499 
   1500 	if (srf->flags & SVGA3D_SURFACE_MULTISAMPLE)
   1501 		sample_count = srf->multisample_count;
   1502 
   1503 	srf->res.backup_size   =
   1504 		svga3dsurface_get_serialized_size_extended(srf->format,
   1505 							   srf->base_size,
   1506 							   srf->mip_levels[0],
   1507 							   num_layers,
   1508 							   sample_count);
   1509 
   1510 	if (srf->flags & SVGA3D_SURFACE_BIND_STREAM_OUTPUT)
   1511 		srf->res.backup_size += sizeof(SVGA3dDXSOState);
   1512 
   1513 	/*
   1514 	 * Don't set SVGA3D_SURFACE_SCREENTARGET flag for a scanout surface with
   1515 	 * size greater than STDU max width/height. This is really a workaround
   1516 	 * to support creation of big framebuffer requested by some user-space
   1517 	 * for whole topology. That big framebuffer won't really be used for
   1518 	 * binding with screen target as during prepare_fb a separate surface is
   1519 	 * created so it's safe to ignore SVGA3D_SURFACE_SCREENTARGET flag.
   1520 	 */
   1521 	if (dev_priv->active_display_unit == vmw_du_screen_target &&
   1522 	    for_scanout && size.width <= dev_priv->stdu_max_width &&
   1523 	    size.height <= dev_priv->stdu_max_height)
   1524 		srf->flags |= SVGA3D_SURFACE_SCREENTARGET;
   1525 
   1526 	/*
   1527 	 * From this point, the generic resource management functions
   1528 	 * destroy the object on failure.
   1529 	 */
   1530 	ret = vmw_surface_init(dev_priv, srf, vmw_user_surface_free);
   1531 
   1532 	ttm_read_unlock(&dev_priv->reservation_sem);
   1533 	return ret;
   1534 
   1535 out_no_user_srf:
   1536 	ttm_mem_global_free(vmw_mem_glob(dev_priv), user_accounting_size);
   1537 
   1538 out_unlock:
   1539 	ttm_read_unlock(&dev_priv->reservation_sem);
   1540 	return ret;
   1541 }
   1542 
   1543 /**
   1544  * vmw_gb_surface_define_ext_ioctl - Ioctl function implementing
   1545  * the user surface define functionality.
   1546  *
   1547  * @dev: Pointer to a struct drm_device.
   1548  * @data: Pointer to data copied from / to user-space.
   1549  * @file_priv: Pointer to a drm file private structure.
   1550  */
   1551 int vmw_gb_surface_define_ext_ioctl(struct drm_device *dev, void *data,
   1552 				struct drm_file *file_priv)
   1553 {
   1554 	union drm_vmw_gb_surface_create_ext_arg *arg =
   1555 	    (union drm_vmw_gb_surface_create_ext_arg *)data;
   1556 	struct drm_vmw_gb_surface_create_ext_req *req = &arg->req;
   1557 	struct drm_vmw_gb_surface_create_rep *rep = &arg->rep;
   1558 
   1559 	return vmw_gb_surface_define_internal(dev, req, rep, file_priv);
   1560 }
   1561 
   1562 /**
   1563  * vmw_gb_surface_reference_ext_ioctl - Ioctl function implementing
   1564  * the user surface reference functionality.
   1565  *
   1566  * @dev: Pointer to a struct drm_device.
   1567  * @data: Pointer to data copied from / to user-space.
   1568  * @file_priv: Pointer to a drm file private structure.
   1569  */
   1570 int vmw_gb_surface_reference_ext_ioctl(struct drm_device *dev, void *data,
   1571 				   struct drm_file *file_priv)
   1572 {
   1573 	union drm_vmw_gb_surface_reference_ext_arg *arg =
   1574 	    (union drm_vmw_gb_surface_reference_ext_arg *)data;
   1575 	struct drm_vmw_surface_arg *req = &arg->req;
   1576 	struct drm_vmw_gb_surface_ref_ext_rep *rep = &arg->rep;
   1577 
   1578 	return vmw_gb_surface_reference_internal(dev, req, rep, file_priv);
   1579 }
   1580 
   1581 /**
   1582  * vmw_gb_surface_define_internal - Ioctl function implementing
   1583  * the user surface define functionality.
   1584  *
   1585  * @dev: Pointer to a struct drm_device.
   1586  * @req: Request argument from user-space.
   1587  * @rep: Response argument to user-space.
   1588  * @file_priv: Pointer to a drm file private structure.
   1589  */
   1590 static int
   1591 vmw_gb_surface_define_internal(struct drm_device *dev,
   1592 			       struct drm_vmw_gb_surface_create_ext_req *req,
   1593 			       struct drm_vmw_gb_surface_create_rep *rep,
   1594 			       struct drm_file *file_priv)
   1595 {
   1596 	struct vmw_private *dev_priv = vmw_priv(dev);
   1597 	struct vmw_user_surface *user_srf;
   1598 	struct vmw_surface *srf;
   1599 	struct vmw_resource *res;
   1600 	struct vmw_resource *tmp;
   1601 	struct ttm_object_file *tfile = vmw_fpriv(file_priv)->tfile;
   1602 	int ret;
   1603 	uint32_t size;
   1604 	uint32_t backup_handle = 0;
   1605 	SVGA3dSurfaceAllFlags svga3d_flags_64 =
   1606 		SVGA3D_FLAGS_64(req->svga3d_flags_upper_32_bits,
   1607 				req->base.svga3d_flags);
   1608 
   1609 	if (!dev_priv->has_sm4_1) {
   1610 		/*
   1611 		 * If SM4_1 is not support then cannot send 64-bit flag to
   1612 		 * device.
   1613 		 */
   1614 		if (req->svga3d_flags_upper_32_bits != 0)
   1615 			return -EINVAL;
   1616 
   1617 		if (req->base.multisample_count != 0)
   1618 			return -EINVAL;
   1619 
   1620 		if (req->multisample_pattern != SVGA3D_MS_PATTERN_NONE)
   1621 			return -EINVAL;
   1622 
   1623 		if (req->quality_level != SVGA3D_MS_QUALITY_NONE)
   1624 			return -EINVAL;
   1625 	}
   1626 
   1627 	if ((svga3d_flags_64 & SVGA3D_SURFACE_MULTISAMPLE) &&
   1628 	    req->base.multisample_count == 0)
   1629 		return -EINVAL;
   1630 
   1631 	if (req->base.mip_levels > DRM_VMW_MAX_MIP_LEVELS)
   1632 		return -EINVAL;
   1633 
   1634 	if (unlikely(vmw_user_surface_size == 0))
   1635 		vmw_user_surface_size = ttm_round_pot(sizeof(*user_srf)) +
   1636 			VMW_IDA_ACC_SIZE + TTM_OBJ_EXTRA_SIZE;
   1637 
   1638 	size = vmw_user_surface_size;
   1639 
   1640 	/* Define a surface based on the parameters. */
   1641 	ret = vmw_surface_gb_priv_define(dev,
   1642 					 size,
   1643 					 svga3d_flags_64,
   1644 					 req->base.format,
   1645 					 req->base.drm_surface_flags &
   1646 					 drm_vmw_surface_flag_scanout,
   1647 					 req->base.mip_levels,
   1648 					 req->base.multisample_count,
   1649 					 req->base.array_size,
   1650 					 req->base.base_size,
   1651 					 req->multisample_pattern,
   1652 					 req->quality_level,
   1653 					 &srf);
   1654 	if (unlikely(ret != 0))
   1655 		return ret;
   1656 
   1657 	user_srf = container_of(srf, struct vmw_user_surface, srf);
   1658 	if (drm_is_primary_client(file_priv))
   1659 		user_srf->master = drm_master_get(file_priv->master);
   1660 
   1661 	ret = ttm_read_lock(&dev_priv->reservation_sem, true);
   1662 	if (unlikely(ret != 0))
   1663 		return ret;
   1664 
   1665 	res = &user_srf->srf.res;
   1666 
   1667 	if (req->base.buffer_handle != SVGA3D_INVALID_ID) {
   1668 		ret = vmw_user_bo_lookup(tfile, req->base.buffer_handle,
   1669 					 &res->backup,
   1670 					 &user_srf->backup_base);
   1671 		if (ret == 0) {
   1672 			if (res->backup->base.num_pages * PAGE_SIZE <
   1673 			    res->backup_size) {
   1674 				VMW_DEBUG_USER("Surface backup buffer too small.\n");
   1675 				vmw_bo_unreference(&res->backup);
   1676 				ret = -EINVAL;
   1677 				goto out_unlock;
   1678 			} else {
   1679 				backup_handle = req->base.buffer_handle;
   1680 			}
   1681 		}
   1682 	} else if (req->base.drm_surface_flags &
   1683 		   (drm_vmw_surface_flag_create_buffer |
   1684 		    drm_vmw_surface_flag_coherent))
   1685 		ret = vmw_user_bo_alloc(dev_priv, tfile,
   1686 					res->backup_size,
   1687 					req->base.drm_surface_flags &
   1688 					drm_vmw_surface_flag_shareable,
   1689 					&backup_handle,
   1690 					&res->backup,
   1691 					&user_srf->backup_base);
   1692 
   1693 	if (unlikely(ret != 0)) {
   1694 		vmw_resource_unreference(&res);
   1695 		goto out_unlock;
   1696 	}
   1697 
   1698 	if (req->base.drm_surface_flags & drm_vmw_surface_flag_coherent) {
   1699 		struct vmw_buffer_object *backup = res->backup;
   1700 
   1701 		ttm_bo_reserve(&backup->base, false, false, NULL);
   1702 		if (!res->func->dirty_alloc)
   1703 			ret = -EINVAL;
   1704 		if (!ret)
   1705 			ret = vmw_bo_dirty_add(backup);
   1706 		if (!ret) {
   1707 			res->coherent = true;
   1708 			ret = res->func->dirty_alloc(res);
   1709 		}
   1710 		ttm_bo_unreserve(&backup->base);
   1711 		if (ret) {
   1712 			vmw_resource_unreference(&res);
   1713 			goto out_unlock;
   1714 		}
   1715 
   1716 	}
   1717 
   1718 	tmp = vmw_resource_reference(res);
   1719 	ret = ttm_prime_object_init(tfile, res->backup_size, &user_srf->prime,
   1720 				    req->base.drm_surface_flags &
   1721 				    drm_vmw_surface_flag_shareable,
   1722 				    VMW_RES_SURFACE,
   1723 				    &vmw_user_surface_base_release, NULL);
   1724 
   1725 	if (unlikely(ret != 0)) {
   1726 		vmw_resource_unreference(&tmp);
   1727 		vmw_resource_unreference(&res);
   1728 		goto out_unlock;
   1729 	}
   1730 
   1731 	rep->handle      = user_srf->prime.base.handle;
   1732 	rep->backup_size = res->backup_size;
   1733 	if (res->backup) {
   1734 		rep->buffer_map_handle =
   1735 			drm_vma_node_offset_addr(&res->backup->base.base.vma_node);
   1736 		rep->buffer_size = res->backup->base.num_pages * PAGE_SIZE;
   1737 		rep->buffer_handle = backup_handle;
   1738 	} else {
   1739 		rep->buffer_map_handle = 0;
   1740 		rep->buffer_size = 0;
   1741 		rep->buffer_handle = SVGA3D_INVALID_ID;
   1742 	}
   1743 
   1744 	vmw_resource_unreference(&res);
   1745 
   1746 out_unlock:
   1747 	ttm_read_unlock(&dev_priv->reservation_sem);
   1748 	return ret;
   1749 }
   1750 
   1751 /**
   1752  * vmw_gb_surface_reference_internal - Ioctl function implementing
   1753  * the user surface reference functionality.
   1754  *
   1755  * @dev: Pointer to a struct drm_device.
   1756  * @req: Pointer to user-space request surface arg.
   1757  * @rep: Pointer to response to user-space.
   1758  * @file_priv: Pointer to a drm file private structure.
   1759  */
   1760 static int
   1761 vmw_gb_surface_reference_internal(struct drm_device *dev,
   1762 				  struct drm_vmw_surface_arg *req,
   1763 				  struct drm_vmw_gb_surface_ref_ext_rep *rep,
   1764 				  struct drm_file *file_priv)
   1765 {
   1766 	struct vmw_private *dev_priv = vmw_priv(dev);
   1767 	struct ttm_object_file *tfile = vmw_fpriv(file_priv)->tfile;
   1768 	struct vmw_surface *srf;
   1769 	struct vmw_user_surface *user_srf;
   1770 	struct ttm_base_object *base;
   1771 	uint32_t backup_handle;
   1772 	int ret = -EINVAL;
   1773 
   1774 	ret = vmw_surface_handle_reference(dev_priv, file_priv, req->sid,
   1775 					   req->handle_type, &base);
   1776 	if (unlikely(ret != 0))
   1777 		return ret;
   1778 
   1779 	user_srf = container_of(base, struct vmw_user_surface, prime.base);
   1780 	srf = &user_srf->srf;
   1781 	if (!srf->res.backup) {
   1782 		DRM_ERROR("Shared GB surface is missing a backup buffer.\n");
   1783 		goto out_bad_resource;
   1784 	}
   1785 
   1786 	mutex_lock(&dev_priv->cmdbuf_mutex); /* Protect res->backup */
   1787 	ret = vmw_user_bo_reference(tfile, srf->res.backup, &backup_handle);
   1788 	mutex_unlock(&dev_priv->cmdbuf_mutex);
   1789 
   1790 	if (unlikely(ret != 0)) {
   1791 		DRM_ERROR("Could not add a reference to a GB surface "
   1792 			  "backup buffer.\n");
   1793 		(void) ttm_ref_object_base_unref(tfile, base->handle,
   1794 						 TTM_REF_USAGE);
   1795 		goto out_bad_resource;
   1796 	}
   1797 
   1798 	rep->creq.base.svga3d_flags = SVGA3D_FLAGS_LOWER_32(srf->flags);
   1799 	rep->creq.base.format = srf->format;
   1800 	rep->creq.base.mip_levels = srf->mip_levels[0];
   1801 	rep->creq.base.drm_surface_flags = 0;
   1802 	rep->creq.base.multisample_count = srf->multisample_count;
   1803 	rep->creq.base.autogen_filter = srf->autogen_filter;
   1804 	rep->creq.base.array_size = srf->array_size;
   1805 	rep->creq.base.buffer_handle = backup_handle;
   1806 	rep->creq.base.base_size = srf->base_size;
   1807 	rep->crep.handle = user_srf->prime.base.handle;
   1808 	rep->crep.backup_size = srf->res.backup_size;
   1809 	rep->crep.buffer_handle = backup_handle;
   1810 	rep->crep.buffer_map_handle =
   1811 		drm_vma_node_offset_addr(&srf->res.backup->base.base.vma_node);
   1812 	rep->crep.buffer_size = srf->res.backup->base.num_pages * PAGE_SIZE;
   1813 
   1814 	rep->creq.version = drm_vmw_gb_surface_v1;
   1815 	rep->creq.svga3d_flags_upper_32_bits =
   1816 		SVGA3D_FLAGS_UPPER_32(srf->flags);
   1817 	rep->creq.multisample_pattern = srf->multisample_pattern;
   1818 	rep->creq.quality_level = srf->quality_level;
   1819 	rep->creq.must_be_zero = 0;
   1820 
   1821 out_bad_resource:
   1822 	ttm_base_object_unref(&base);
   1823 
   1824 	return ret;
   1825 }
   1826 
   1827 /**
   1828  * vmw_subres_dirty_add - Add a dirty region to a subresource
   1829  * @dirty: The surfaces's dirty tracker.
   1830  * @loc_start: The location corresponding to the start of the region.
   1831  * @loc_end: The location corresponding to the end of the region.
   1832  *
   1833  * As we are assuming that @loc_start and @loc_end represent a sequential
   1834  * range of backing store memory, if the region spans multiple lines then
   1835  * regardless of the x coordinate, the full lines are dirtied.
   1836  * Correspondingly if the region spans multiple z slices, then full rather
   1837  * than partial z slices are dirtied.
   1838  */
   1839 static void vmw_subres_dirty_add(struct vmw_surface_dirty *dirty,
   1840 				 const struct svga3dsurface_loc *loc_start,
   1841 				 const struct svga3dsurface_loc *loc_end)
   1842 {
   1843 	const struct svga3dsurface_cache *cache = &dirty->cache;
   1844 	SVGA3dBox *box = &dirty->boxes[loc_start->sub_resource];
   1845 	u32 mip = loc_start->sub_resource % cache->num_mip_levels;
   1846 	const struct drm_vmw_size *size = &cache->mip[mip].size;
   1847 	u32 box_c2 = box->z + box->d;
   1848 
   1849 	if (WARN_ON(loc_start->sub_resource >= dirty->num_subres))
   1850 		return;
   1851 
   1852 	if (box->d == 0 || box->z > loc_start->z)
   1853 		box->z = loc_start->z;
   1854 	if (box_c2 < loc_end->z)
   1855 		box->d = loc_end->z - box->z;
   1856 
   1857 	if (loc_start->z + 1 == loc_end->z) {
   1858 		box_c2 = box->y + box->h;
   1859 		if (box->h == 0 || box->y > loc_start->y)
   1860 			box->y = loc_start->y;
   1861 		if (box_c2 < loc_end->y)
   1862 			box->h = loc_end->y - box->y;
   1863 
   1864 		if (loc_start->y + 1 == loc_end->y) {
   1865 			box_c2 = box->x + box->w;
   1866 			if (box->w == 0 || box->x > loc_start->x)
   1867 				box->x = loc_start->x;
   1868 			if (box_c2 < loc_end->x)
   1869 				box->w = loc_end->x - box->x;
   1870 		} else {
   1871 			box->x = 0;
   1872 			box->w = size->width;
   1873 		}
   1874 	} else {
   1875 		box->y = 0;
   1876 		box->h = size->height;
   1877 		box->x = 0;
   1878 		box->w = size->width;
   1879 	}
   1880 }
   1881 
   1882 /**
   1883  * vmw_subres_dirty_full - Mark a full subresource as dirty
   1884  * @dirty: The surface's dirty tracker.
   1885  * @subres: The subresource
   1886  */
   1887 static void vmw_subres_dirty_full(struct vmw_surface_dirty *dirty, u32 subres)
   1888 {
   1889 	const struct svga3dsurface_cache *cache = &dirty->cache;
   1890 	u32 mip = subres % cache->num_mip_levels;
   1891 	const struct drm_vmw_size *size = &cache->mip[mip].size;
   1892 	SVGA3dBox *box = &dirty->boxes[subres];
   1893 
   1894 	box->x = 0;
   1895 	box->y = 0;
   1896 	box->z = 0;
   1897 	box->w = size->width;
   1898 	box->h = size->height;
   1899 	box->d = size->depth;
   1900 }
   1901 
   1902 /*
   1903  * vmw_surface_tex_dirty_add_range - The dirty_add_range callback for texture
   1904  * surfaces.
   1905  */
   1906 static void vmw_surface_tex_dirty_range_add(struct vmw_resource *res,
   1907 					    size_t start, size_t end)
   1908 {
   1909 	struct vmw_surface_dirty *dirty =
   1910 		(struct vmw_surface_dirty *) res->dirty;
   1911 	size_t backup_end = res->backup_offset + res->backup_size;
   1912 	struct svga3dsurface_loc loc1, loc2;
   1913 	const struct svga3dsurface_cache *cache;
   1914 
   1915 	start = max_t(size_t, start, res->backup_offset) - res->backup_offset;
   1916 	end = min(end, backup_end) - res->backup_offset;
   1917 	cache = &dirty->cache;
   1918 	svga3dsurface_get_loc(cache, &loc1, start);
   1919 	svga3dsurface_get_loc(cache, &loc2, end - 1);
   1920 	svga3dsurface_inc_loc(cache, &loc2);
   1921 
   1922 	if (loc1.sub_resource + 1 == loc2.sub_resource) {
   1923 		/* Dirty range covers a single sub-resource */
   1924 		vmw_subres_dirty_add(dirty, &loc1, &loc2);
   1925 	} else {
   1926 		/* Dirty range covers multiple sub-resources */
   1927 		struct svga3dsurface_loc loc_min, loc_max;
   1928 		u32 sub_res;
   1929 
   1930 		svga3dsurface_max_loc(cache, loc1.sub_resource, &loc_max);
   1931 		vmw_subres_dirty_add(dirty, &loc1, &loc_max);
   1932 		svga3dsurface_min_loc(cache, loc2.sub_resource - 1, &loc_min);
   1933 		vmw_subres_dirty_add(dirty, &loc_min, &loc2);
   1934 		for (sub_res = loc1.sub_resource + 1;
   1935 		     sub_res < loc2.sub_resource - 1; ++sub_res)
   1936 			vmw_subres_dirty_full(dirty, sub_res);
   1937 	}
   1938 }
   1939 
   1940 /*
   1941  * vmw_surface_tex_dirty_add_range - The dirty_add_range callback for buffer
   1942  * surfaces.
   1943  */
   1944 static void vmw_surface_buf_dirty_range_add(struct vmw_resource *res,
   1945 					    size_t start, size_t end)
   1946 {
   1947 	struct vmw_surface_dirty *dirty =
   1948 		(struct vmw_surface_dirty *) res->dirty;
   1949 	const struct svga3dsurface_cache *cache = &dirty->cache;
   1950 	size_t backup_end = res->backup_offset + cache->mip_chain_bytes;
   1951 	SVGA3dBox *box = &dirty->boxes[0];
   1952 	u32 box_c2;
   1953 
   1954 	box->h = box->d = 1;
   1955 	start = max_t(size_t, start, res->backup_offset) - res->backup_offset;
   1956 	end = min(end, backup_end) - res->backup_offset;
   1957 	box_c2 = box->x + box->w;
   1958 	if (box->w == 0 || box->x > start)
   1959 		box->x = start;
   1960 	if (box_c2 < end)
   1961 		box->w = end - box->x;
   1962 }
   1963 
   1964 /*
   1965  * vmw_surface_tex_dirty_add_range - The dirty_add_range callback for surfaces
   1966  */
   1967 static void vmw_surface_dirty_range_add(struct vmw_resource *res, size_t start,
   1968 					size_t end)
   1969 {
   1970 	struct vmw_surface *srf = vmw_res_to_srf(res);
   1971 
   1972 	if (WARN_ON(end <= res->backup_offset ||
   1973 		    start >= res->backup_offset + res->backup_size))
   1974 		return;
   1975 
   1976 	if (srf->format == SVGA3D_BUFFER)
   1977 		vmw_surface_buf_dirty_range_add(res, start, end);
   1978 	else
   1979 		vmw_surface_tex_dirty_range_add(res, start, end);
   1980 }
   1981 
   1982 /*
   1983  * vmw_surface_dirty_sync - The surface's dirty_sync callback.
   1984  */
   1985 static int vmw_surface_dirty_sync(struct vmw_resource *res)
   1986 {
   1987 	struct vmw_private *dev_priv = res->dev_priv;
   1988 	bool has_dx = 0;
   1989 	u32 i, num_dirty;
   1990 	struct vmw_surface_dirty *dirty =
   1991 		(struct vmw_surface_dirty *) res->dirty;
   1992 	size_t alloc_size;
   1993 	const struct svga3dsurface_cache *cache = &dirty->cache;
   1994 	struct {
   1995 		SVGA3dCmdHeader header;
   1996 		SVGA3dCmdDXUpdateSubResource body;
   1997 	} *cmd1;
   1998 	struct {
   1999 		SVGA3dCmdHeader header;
   2000 		SVGA3dCmdUpdateGBImage body;
   2001 	} *cmd2;
   2002 	void *cmd;
   2003 
   2004 	num_dirty = 0;
   2005 	for (i = 0; i < dirty->num_subres; ++i) {
   2006 		const SVGA3dBox *box = &dirty->boxes[i];
   2007 
   2008 		if (box->d)
   2009 			num_dirty++;
   2010 	}
   2011 
   2012 	if (!num_dirty)
   2013 		goto out;
   2014 
   2015 	alloc_size = num_dirty * ((has_dx) ? sizeof(*cmd1) : sizeof(*cmd2));
   2016 	cmd = VMW_FIFO_RESERVE(dev_priv, alloc_size);
   2017 	if (!cmd)
   2018 		return -ENOMEM;
   2019 
   2020 	cmd1 = cmd;
   2021 	cmd2 = cmd;
   2022 
   2023 	for (i = 0; i < dirty->num_subres; ++i) {
   2024 		const SVGA3dBox *box = &dirty->boxes[i];
   2025 
   2026 		if (!box->d)
   2027 			continue;
   2028 
   2029 		/*
   2030 		 * DX_UPDATE_SUBRESOURCE is aware of array surfaces.
   2031 		 * UPDATE_GB_IMAGE is not.
   2032 		 */
   2033 		if (has_dx) {
   2034 			cmd1->header.id = SVGA_3D_CMD_DX_UPDATE_SUBRESOURCE;
   2035 			cmd1->header.size = sizeof(cmd1->body);
   2036 			cmd1->body.sid = res->id;
   2037 			cmd1->body.subResource = i;
   2038 			cmd1->body.box = *box;
   2039 			cmd1++;
   2040 		} else {
   2041 			cmd2->header.id = SVGA_3D_CMD_UPDATE_GB_IMAGE;
   2042 			cmd2->header.size = sizeof(cmd2->body);
   2043 			cmd2->body.image.sid = res->id;
   2044 			cmd2->body.image.face = i / cache->num_mip_levels;
   2045 			cmd2->body.image.mipmap = i -
   2046 				(cache->num_mip_levels * cmd2->body.image.face);
   2047 			cmd2->body.box = *box;
   2048 			cmd2++;
   2049 		}
   2050 
   2051 	}
   2052 	vmw_fifo_commit(dev_priv, alloc_size);
   2053  out:
   2054 	memset(&dirty->boxes[0], 0, sizeof(dirty->boxes[0]) *
   2055 	       dirty->num_subres);
   2056 
   2057 	return 0;
   2058 }
   2059 
   2060 /*
   2061  * vmw_surface_dirty_alloc - The surface's dirty_alloc callback.
   2062  */
   2063 static int vmw_surface_dirty_alloc(struct vmw_resource *res)
   2064 {
   2065 	struct vmw_surface *srf = vmw_res_to_srf(res);
   2066 	struct vmw_surface_dirty *dirty;
   2067 	u32 num_layers = 1;
   2068 	u32 num_mip;
   2069 	u32 num_subres;
   2070 	u32 num_samples;
   2071 	size_t dirty_size, acc_size;
   2072 	static struct ttm_operation_ctx ctx = {
   2073 		.interruptible = false,
   2074 		.no_wait_gpu = false
   2075 	};
   2076 	int ret;
   2077 
   2078 	if (srf->array_size)
   2079 		num_layers = srf->array_size;
   2080 	else if (srf->flags & SVGA3D_SURFACE_CUBEMAP)
   2081 		num_layers *= SVGA3D_MAX_SURFACE_FACES;
   2082 
   2083 	num_mip = srf->mip_levels[0];
   2084 	if (!num_mip)
   2085 		num_mip = 1;
   2086 
   2087 	num_subres = num_layers * num_mip;
   2088 	dirty_size = sizeof(*dirty) + num_subres * sizeof(dirty->boxes[0]);
   2089 	acc_size = ttm_round_pot(dirty_size);
   2090 	ret = ttm_mem_global_alloc(vmw_mem_glob(res->dev_priv),
   2091 				   acc_size, &ctx);
   2092 	if (ret) {
   2093 		VMW_DEBUG_USER("Out of graphics memory for surface "
   2094 			       "dirty tracker.\n");
   2095 		return ret;
   2096 	}
   2097 
   2098 	dirty = kvzalloc(dirty_size, GFP_KERNEL);
   2099 	if (!dirty) {
   2100 		ret = -ENOMEM;
   2101 		goto out_no_dirty;
   2102 	}
   2103 
   2104 	num_samples = max_t(u32, 1, srf->multisample_count);
   2105 	ret = svga3dsurface_setup_cache(&srf->base_size, srf->format, num_mip,
   2106 					num_layers, num_samples, &dirty->cache);
   2107 	if (ret)
   2108 		goto out_no_cache;
   2109 
   2110 	dirty->num_subres = num_subres;
   2111 	dirty->size = acc_size;
   2112 	res->dirty = (struct vmw_resource_dirty *) dirty;
   2113 
   2114 	return 0;
   2115 
   2116 out_no_cache:
   2117 	kvfree(dirty);
   2118 out_no_dirty:
   2119 	ttm_mem_global_free(vmw_mem_glob(res->dev_priv), acc_size);
   2120 	return ret;
   2121 }
   2122 
   2123 /*
   2124  * vmw_surface_dirty_free - The surface's dirty_free callback
   2125  */
   2126 static void vmw_surface_dirty_free(struct vmw_resource *res)
   2127 {
   2128 	struct vmw_surface_dirty *dirty =
   2129 		(struct vmw_surface_dirty *) res->dirty;
   2130 	size_t acc_size = dirty->size;
   2131 
   2132 	kvfree(dirty);
   2133 	ttm_mem_global_free(vmw_mem_glob(res->dev_priv), acc_size);
   2134 	res->dirty = NULL;
   2135 }
   2136 
   2137 /*
   2138  * vmw_surface_clean - The surface's clean callback
   2139  */
   2140 static int vmw_surface_clean(struct vmw_resource *res)
   2141 {
   2142 	struct vmw_private *dev_priv = res->dev_priv;
   2143 	size_t alloc_size;
   2144 	struct {
   2145 		SVGA3dCmdHeader header;
   2146 		SVGA3dCmdReadbackGBSurface body;
   2147 	} *cmd;
   2148 
   2149 	alloc_size = sizeof(*cmd);
   2150 	cmd = VMW_FIFO_RESERVE(dev_priv, alloc_size);
   2151 	if (!cmd)
   2152 		return -ENOMEM;
   2153 
   2154 	cmd->header.id = SVGA_3D_CMD_READBACK_GB_SURFACE;
   2155 	cmd->header.size = sizeof(cmd->body);
   2156 	cmd->body.sid = res->id;
   2157 	vmw_fifo_commit(dev_priv, alloc_size);
   2158 
   2159 	return 0;
   2160 }
   2161