drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c

   1 /**************************************************************************
   2  *
   3  * Copyright © 2009 VMware, Inc., Palo Alto, CA., USA
   4  * All Rights Reserved.
   5  *
   6  * Permission is hereby granted, free of charge, to any person obtaining a
   7  * copy of this software and associated documentation files (the
   8  * "Software"), to deal in the Software without restriction, including
   9  * without limitation the rights to use, copy, modify, merge, publish,
  10  * distribute, sub license, and/or sell copies of the Software, and to
  11  * permit persons to whom the Software is furnished to do so, subject to
  12  * the following conditions:
  13  *
  14  * The above copyright notice and this permission notice (including the
  15  * next paragraph) shall be included in all copies or substantial portions
  16  * of the Software.
  17  *
  18  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  19  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  20  * FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. IN NO EVENT SHALL
  21  * THE COPYRIGHT HOLDERS, AUTHORS AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM,
  22  * DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
  23  * OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
  24  * USE OR OTHER DEALINGS IN THE SOFTWARE.
  25  *
  26  **************************************************************************/
  27
  28 #include "vmwgfx_drv.h"
  29 #include "vmwgfx_reg.h"
  30 #include <drm/ttm/ttm_bo_api.h>
  31 #include <drm/ttm/ttm_placement.h>
  32
  33 #define VMW_RES_HT_ORDER 12
  34
  35 /**
  36  * struct vmw_resource_relocation - Relocation info for resources
  37  *
  38  * @head: List head for the software context's relocation list.
  39  * @res: Non-ref-counted pointer to the resource.
  40  * @offset: Offset of 4 byte entries into the command buffer where the
  41  * id that needs fixup is located.
  42  */
  43 struct vmw_resource_relocation {
  44         struct list_head head;
  45         const struct vmw_resource *res;
  46         unsigned long offset;
  47 };
  48
  49 /**
  50  * struct vmw_resource_val_node - Validation info for resources
  51  *
  52  * @head: List head for the software context's resource list.
  53  * @hash: Hash entry for quick resouce to val_node lookup.
  54  * @res: Ref-counted pointer to the resource.
  55  * @switch_backup: Boolean whether to switch backup buffer on unreserve.
  56  * @new_backup: Refcounted pointer to the new backup buffer.
  57  * @new_backup_offset: New backup buffer offset if @new_backup is non-NUll.
  58  * @first_usage: Set to true the first time the resource is referenced in
  59  * the command stream.
  60  * @no_buffer_needed: Resources do not need to allocate buffer backup on
  61  * reservation. The command stream will provide one.
  62  */
  63 struct vmw_resource_val_node {
  64         struct list_head head;
  65         struct drm_hash_item hash;
  66         struct vmw_resource *res;
  67         struct vmw_dma_buffer *new_backup;
  68         unsigned long new_backup_offset;
  69         bool first_usage;
  70         bool no_buffer_needed;
  71 };
  72
  73 /**
  74  * struct vmw_cmd_entry - Describe a command for the verifier
  75  *
  76  * @user_allow: Whether allowed from the execbuf ioctl.
  77  * @gb_disable: Whether disabled if guest-backed objects are available.
  78  * @gb_enable: Whether enabled iff guest-backed objects are available.
  79  */
  80 struct vmw_cmd_entry {
  81         int (*func) (struct vmw_private *, struct vmw_sw_context *,
  82                      SVGA3dCmdHeader *);
  83         bool user_allow;
  84         bool gb_disable;
  85         bool gb_enable;
  86 };
  87
  88 #define VMW_CMD_DEF(_cmd, _func, _user_allow, _gb_disable, _gb_enable)  \
  89         [(_cmd) - SVGA_3D_CMD_BASE] = {(_func), (_user_allow),\
  90                                        (_gb_disable), (_gb_enable)}
  91
  92 /**
  93  * vmw_resource_unreserve - unreserve resources previously reserved for
  94  * command submission.
  95  *
  96  * @list_head: list of resources to unreserve.
  97  * @backoff: Whether command submission failed.
  98  */
  99 static void vmw_resource_list_unreserve(struct list_head *list,
 100                                         bool backoff)
 101 {
 102         struct vmw_resource_val_node *val;
 103
 104         list_for_each_entry(val, list, head) {
 105                 struct vmw_resource *res = val->res;
 106                 struct vmw_dma_buffer *new_backup =
 107                         backoff ? NULL : val->new_backup;
 108
 109                 vmw_resource_unreserve(res, new_backup,
 110                         val->new_backup_offset);
 111                 vmw_dmabuf_unreference(&val->new_backup);
 112         }
 113 }
 114
 115
 116 /**
 117  * vmw_resource_val_add - Add a resource to the software context's
 118  * resource list if it's not already on it.
 119  *
 120  * @sw_context: Pointer to the software context.
 121  * @res: Pointer to the resource.
 122  * @p_node On successful return points to a valid pointer to a
 123  * struct vmw_resource_val_node, if non-NULL on entry.
 124  */
 125 static int vmw_resource_val_add(struct vmw_sw_context *sw_context,
 126                                 struct vmw_resource *res,
 127                                 struct vmw_resource_val_node **p_node)
 128 {
 129         struct vmw_resource_val_node *node;
 130         struct drm_hash_item *hash;
 131         int ret;
 132
 133         if (likely(drm_ht_find_item(&sw_context->res_ht, (unsigned long) res,
 134                                     &hash) == 0)) {
 135                 node = container_of(hash, struct vmw_resource_val_node, hash);
 136                 node->first_usage = false;
 137                 if (unlikely(p_node != NULL))
 138                         *p_node = node;
 139                 return 0;
 140         }
 141
 142         node = kzalloc(sizeof(*node), GFP_KERNEL);
 143         if (unlikely(node == NULL)) {
 144                 DRM_ERROR("Failed to allocate a resource validation "
 145                           "entry.\n");
 146                 return -ENOMEM;
 147         }
 148
 149         node->hash.key = (unsigned long) res;
 150         ret = drm_ht_insert_item(&sw_context->res_ht, &node->hash);
 151         if (unlikely(ret != 0)) {
 152                 DRM_ERROR("Failed to initialize a resource validation "
 153                           "entry.\n");
 154                 kfree(node);
 155                 return ret;
 156         }
 157         list_add_tail(&node->head, &sw_context->resource_list);
 158         node->res = vmw_resource_reference(res);
 159         node->first_usage = true;
 160
 161         if (unlikely(p_node != NULL))
 162                 *p_node = node;
 163
 164         return 0;
 165 }
 166
 167 /**
 168  * vmw_resource_relocation_add - Add a relocation to the relocation list
 169  *
 170  * @list: Pointer to head of relocation list.
 171  * @res: The resource.
 172  * @offset: Offset into the command buffer currently being parsed where the
 173  * id that needs fixup is located. Granularity is 4 bytes.
 174  */
 175 static int vmw_resource_relocation_add(struct list_head *list,
 176                                        const struct vmw_resource *res,
 177                                        unsigned long offset)
 178 {
 179         struct vmw_resource_relocation *rel;
 180
 181         rel = kmalloc(sizeof(*rel), GFP_KERNEL);
 182         if (unlikely(rel == NULL)) {
 183                 DRM_ERROR("Failed to allocate a resource relocation.\n");
 184                 return -ENOMEM;
 185         }
 186
 187         rel->res = res;
 188         rel->offset = offset;
 189         list_add_tail(&rel->head, list);
 190
 191         return 0;
 192 }
 193
 194 /**
 195  * vmw_resource_relocations_free - Free all relocations on a list
 196  *
 197  * @list: Pointer to the head of the relocation list.
 198  */
 199 static void vmw_resource_relocations_free(struct list_head *list)
 200 {
 201         struct vmw_resource_relocation *rel, *n;
 202
 203         list_for_each_entry_safe(rel, n, list, head) {
 204                 list_del(&rel->head);
 205                 kfree(rel);
 206         }
 207 }
 208
 209 /**
 210  * vmw_resource_relocations_apply - Apply all relocations on a list
 211  *
 212  * @cb: Pointer to the start of the command buffer bein patch. This need
 213  * not be the same buffer as the one being parsed when the relocation
 214  * list was built, but the contents must be the same modulo the
 215  * resource ids.
 216  * @list: Pointer to the head of the relocation list.
 217  */
 218 static void vmw_resource_relocations_apply(uint32_t *cb,
 219                                            struct list_head *list)
 220 {
 221         struct vmw_resource_relocation *rel;
 222
 223         list_for_each_entry(rel, list, head)
 224                 cb[rel->offset] = rel->res->id;
 225 }
 226
 227 static int vmw_cmd_invalid(struct vmw_private *dev_priv,
 228                            struct vmw_sw_context *sw_context,
 229                            SVGA3dCmdHeader *header)
 230 {
 231         return capable(CAP_SYS_ADMIN) ? : -EINVAL;
 232 }
 233
 234 static int vmw_cmd_ok(struct vmw_private *dev_priv,
 235                       struct vmw_sw_context *sw_context,
 236                       SVGA3dCmdHeader *header)
 237 {
 238         return 0;
 239 }
 240
 241 /**
 242  * vmw_bo_to_validate_list - add a bo to a validate list
 243  *
 244  * @sw_context: The software context used for this command submission batch.
 245  * @bo: The buffer object to add.
 246  * @validate_as_mob: Validate this buffer as a MOB.
 247  * @p_val_node: If non-NULL Will be updated with the validate node number
 248  * on return.
 249  *
 250  * Returns -EINVAL if the limit of number of buffer objects per command
 251  * submission is reached.
 252  */
 253 static int vmw_bo_to_validate_list(struct vmw_sw_context *sw_context,
 254                                    struct ttm_buffer_object *bo,
 255                                    bool validate_as_mob,
 256                                    uint32_t *p_val_node)
 257 {
 258         uint32_t val_node;
 259         struct vmw_validate_buffer *vval_buf;
 260         struct ttm_validate_buffer *val_buf;
 261         struct drm_hash_item *hash;
 262         int ret;
 263
 264         if (likely(drm_ht_find_item(&sw_context->res_ht, (unsigned long) bo,
 265                                     &hash) == 0)) {
 266                 vval_buf = container_of(hash, struct vmw_validate_buffer,
 267                                         hash);
 268                 if (unlikely(vval_buf->validate_as_mob != validate_as_mob)) {
 269                         DRM_ERROR("Inconsistent buffer usage.\n");
 270                         return -EINVAL;
 271                 }
 272                 val_buf = &vval_buf->base;
 273                 val_node = vval_buf - sw_context->val_bufs;
 274         } else {
 275                 val_node = sw_context->cur_val_buf;
 276                 if (unlikely(val_node >= VMWGFX_MAX_VALIDATIONS)) {
 277                         DRM_ERROR("Max number of DMA buffers per submission "
 278                                   "exceeded.\n");
 279                         return -EINVAL;
 280                 }
 281                 vval_buf = &sw_context->val_bufs[val_node];
 282                 vval_buf->hash.key = (unsigned long) bo;
 283                 ret = drm_ht_insert_item(&sw_context->res_ht, &vval_buf->hash);
 284                 if (unlikely(ret != 0)) {
 285                         DRM_ERROR("Failed to initialize a buffer validation "
 286                                   "entry.\n");
 287                         return ret;
 288                 }
 289                 ++sw_context->cur_val_buf;
 290                 val_buf = &vval_buf->base;
 291                 val_buf->bo = ttm_bo_reference(bo);
 292                 val_buf->reserved = false;
 293                 list_add_tail(&val_buf->head, &sw_context->validate_nodes);
 294                 vval_buf->validate_as_mob = validate_as_mob;
 295         }
 296
 297         sw_context->fence_flags |= DRM_VMW_FENCE_FLAG_EXEC;
 298
 299         if (p_val_node)
 300                 *p_val_node = val_node;
 301
 302         return 0;
 303 }
 304
 305 /**
 306  * vmw_resources_reserve - Reserve all resources on the sw_context's
 307  * resource list.
 308  *
 309  * @sw_context: Pointer to the software context.
 310  *
 311  * Note that since vmware's command submission currently is protected by
 312  * the cmdbuf mutex, no fancy deadlock avoidance is required for resources,
 313  * since only a single thread at once will attempt this.
 314  */
 315 static int vmw_resources_reserve(struct vmw_sw_context *sw_context)
 316 {
 317         struct vmw_resource_val_node *val;
 318         int ret;
 319
 320         list_for_each_entry(val, &sw_context->resource_list, head) {
 321                 struct vmw_resource *res = val->res;
 322
 323                 ret = vmw_resource_reserve(res, val->no_buffer_needed);
 324                 if (unlikely(ret != 0))
 325                         return ret;
 326
 327                 if (res->backup) {
 328                         struct ttm_buffer_object *bo = &res->backup->base;
 329
 330                         ret = vmw_bo_to_validate_list
 331                                 (sw_context, bo,
 332                                  vmw_resource_needs_backup(res), NULL);
 333
 334                         if (unlikely(ret != 0))
 335                                 return ret;
 336                 }
 337         }
 338         return 0;
 339 }
 340
 341 /**
 342  * vmw_resources_validate - Validate all resources on the sw_context's
 343  * resource list.
 344  *
 345  * @sw_context: Pointer to the software context.
 346  *
 347  * Before this function is called, all resource backup buffers must have
 348  * been validated.
 349  */
 350 static int vmw_resources_validate(struct vmw_sw_context *sw_context)
 351 {
 352         struct vmw_resource_val_node *val;
 353         int ret;
 354
 355         list_for_each_entry(val, &sw_context->resource_list, head) {
 356                 struct vmw_resource *res = val->res;
 357
 358                 ret = vmw_resource_validate(res);
 359                 if (unlikely(ret != 0)) {
 360                         if (ret != -ERESTARTSYS)
 361                                 DRM_ERROR("Failed to validate resource.\n");
 362                         return ret;
 363                 }
 364         }
 365         return 0;
 366 }
 367
 368 /**
 369  * vmw_cmd_res_check - Check that a resource is present and if so, put it
 370  * on the resource validate list unless it's already there.
 371  *
 372  * @dev_priv: Pointer to a device private structure.
 373  * @sw_context: Pointer to the software context.
 374  * @res_type: Resource type.
 375  * @converter: User-space visisble type specific information.
 376  * @id: Pointer to the location in the command buffer currently being
 377  * parsed from where the user-space resource id handle is located.
 378  */
 379 static int vmw_cmd_res_check(struct vmw_private *dev_priv,
 380                              struct vmw_sw_context *sw_context,
 381                              enum vmw_res_type res_type,
 382                              const struct vmw_user_resource_conv *converter,
 383                              uint32_t *id,
 384                              struct vmw_resource_val_node **p_val)
 385 {
 386         struct vmw_res_cache_entry *rcache =
 387                 &sw_context->res_cache[res_type];
 388         struct vmw_resource *res;
 389         struct vmw_resource_val_node *node;
 390         int ret;
 391
 392         if (*id == SVGA3D_INVALID_ID)
 393                 return 0;
 394
 395         /*
 396          * Fastpath in case of repeated commands referencing the same
 397          * resource
 398          */
 399
 400         if (likely(rcache->valid && *id == rcache->handle)) {
 401                 const struct vmw_resource *res = rcache->res;
 402
 403                 rcache->node->first_usage = false;
 404                 if (p_val)
 405                         *p_val = rcache->node;
 406
 407                 return vmw_resource_relocation_add
 408                         (&sw_context->res_relocations, res,
 409                          id - sw_context->buf_start);
 410         }
 411
 412         ret = vmw_user_resource_lookup_handle(dev_priv,
 413                                               sw_context->tfile,
 414                                               *id,
 415                                               converter,
 416                                               &res);
 417         if (unlikely(ret != 0)) {
 418                 DRM_ERROR("Could not find or use resource 0x%08x.\n",
 419                           (unsigned) *id);
 420                 dump_stack();
 421                 return ret;
 422         }
 423
 424         rcache->valid = true;
 425         rcache->res = res;
 426         rcache->handle = *id;
 427
 428         ret = vmw_resource_relocation_add(&sw_context->res_relocations,
 429                                           res,
 430                                           id - sw_context->buf_start);
 431         if (unlikely(ret != 0))
 432                 goto out_no_reloc;
 433
 434         ret = vmw_resource_val_add(sw_context, res, &node);
 435         if (unlikely(ret != 0))
 436                 goto out_no_reloc;
 437
 438         rcache->node = node;
 439         if (p_val)
 440                 *p_val = node;
 441         vmw_resource_unreference(&res);
 442         return 0;
 443
 444 out_no_reloc:
 445         BUG_ON(sw_context->error_resource != NULL);
 446         sw_context->error_resource = res;
 447
 448         return ret;
 449 }
 450
 451 /**
 452  * vmw_cmd_cid_check - Check a command header for valid context information.
 453  *
 454  * @dev_priv: Pointer to a device private structure.
 455  * @sw_context: Pointer to the software context.
 456  * @header: A command header with an embedded user-space context handle.
 457  *
 458  * Convenience function: Call vmw_cmd_res_check with the user-space context
 459  * handle embedded in @header.
 460  */
 461 static int vmw_cmd_cid_check(struct vmw_private *dev_priv,
 462                              struct vmw_sw_context *sw_context,
 463                              SVGA3dCmdHeader *header)
 464 {
 465         struct vmw_cid_cmd {
 466                 SVGA3dCmdHeader header;
 467                 __le32 cid;
 468         } *cmd;
 469
 470         cmd = container_of(header, struct vmw_cid_cmd, header);
 471         return vmw_cmd_res_check(dev_priv, sw_context, vmw_res_context,
 472                                  user_context_converter, &cmd->cid, NULL);
 473 }
 474
 475 static int vmw_cmd_set_render_target_check(struct vmw_private *dev_priv,
 476                                            struct vmw_sw_context *sw_context,
 477                                            SVGA3dCmdHeader *header)
 478 {
 479         struct vmw_sid_cmd {
 480                 SVGA3dCmdHeader header;
 481                 SVGA3dCmdSetRenderTarget body;
 482         } *cmd;
 483         int ret;
 484
 485         ret = vmw_cmd_cid_check(dev_priv, sw_context, header);
 486         if (unlikely(ret != 0))
 487                 return ret;
 488
 489         cmd = container_of(header, struct vmw_sid_cmd, header);
 490         ret = vmw_cmd_res_check(dev_priv, sw_context, vmw_res_surface,
 491                                 user_surface_converter,
 492                                 &cmd->body.target.sid, NULL);
 493         return ret;
 494 }
 495
 496 static int vmw_cmd_surface_copy_check(struct vmw_private *dev_priv,
 497                                       struct vmw_sw_context *sw_context,
 498                                       SVGA3dCmdHeader *header)
 499 {
 500         struct vmw_sid_cmd {
 501                 SVGA3dCmdHeader header;
 502                 SVGA3dCmdSurfaceCopy body;
 503         } *cmd;
 504         int ret;
 505
 506         cmd = container_of(header, struct vmw_sid_cmd, header);
 507         ret = vmw_cmd_res_check(dev_priv, sw_context, vmw_res_surface,
 508                                 user_surface_converter,
 509                                 &cmd->body.src.sid, NULL);
 510         if (unlikely(ret != 0))
 511                 return ret;
 512         return vmw_cmd_res_check(dev_priv, sw_context, vmw_res_surface,
 513                                  user_surface_converter,
 514                                  &cmd->body.dest.sid, NULL);
 515 }
 516
 517 static int vmw_cmd_stretch_blt_check(struct vmw_private *dev_priv,
 518                                      struct vmw_sw_context *sw_context,
 519                                      SVGA3dCmdHeader *header)
 520 {
 521         struct vmw_sid_cmd {
 522                 SVGA3dCmdHeader header;
 523                 SVGA3dCmdSurfaceStretchBlt body;
 524         } *cmd;
 525         int ret;
 526
 527         cmd = container_of(header, struct vmw_sid_cmd, header);
 528         ret = vmw_cmd_res_check(dev_priv, sw_context, vmw_res_surface,
 529                                 user_surface_converter,
 530                                 &cmd->body.src.sid, NULL);
 531         if (unlikely(ret != 0))
 532                 return ret;
 533         return vmw_cmd_res_check(dev_priv, sw_context, vmw_res_surface,
 534                                  user_surface_converter,
 535                                  &cmd->body.dest.sid, NULL);
 536 }
 537
 538 static int vmw_cmd_blt_surf_screen_check(struct vmw_private *dev_priv,
 539                                          struct vmw_sw_context *sw_context,
 540                                          SVGA3dCmdHeader *header)
 541 {
 542         struct vmw_sid_cmd {
 543                 SVGA3dCmdHeader header;
 544                 SVGA3dCmdBlitSurfaceToScreen body;
 545         } *cmd;
 546
 547         cmd = container_of(header, struct vmw_sid_cmd, header);
 548
 549         return vmw_cmd_res_check(dev_priv, sw_context, vmw_res_surface,
 550                                  user_surface_converter,
 551                                  &cmd->body.srcImage.sid, NULL);
 552 }
 553
 554 static int vmw_cmd_present_check(struct vmw_private *dev_priv,
 555                                  struct vmw_sw_context *sw_context,
 556                                  SVGA3dCmdHeader *header)
 557 {
 558         struct vmw_sid_cmd {
 559                 SVGA3dCmdHeader header;
 560                 SVGA3dCmdPresent body;
 561         } *cmd;
 562
 563
 564         cmd = container_of(header, struct vmw_sid_cmd, header);
 565
 566         return vmw_cmd_res_check(dev_priv, sw_context, vmw_res_surface,
 567                                  user_surface_converter, &cmd->body.sid,
 568                                  NULL);
 569 }
 570
 571 /**
 572  * vmw_query_bo_switch_prepare - Prepare to switch pinned buffer for queries.
 573  *
 574  * @dev_priv: The device private structure.
 575  * @new_query_bo: The new buffer holding query results.
 576  * @sw_context: The software context used for this command submission.
 577  *
 578  * This function checks whether @new_query_bo is suitable for holding
 579  * query results, and if another buffer currently is pinned for query
 580  * results. If so, the function prepares the state of @sw_context for
 581  * switching pinned buffers after successful submission of the current
 582  * command batch.
 583  */
 584 static int vmw_query_bo_switch_prepare(struct vmw_private *dev_priv,
 585                                        struct ttm_buffer_object *new_query_bo,
 586                                        struct vmw_sw_context *sw_context)
 587 {
 588         struct vmw_res_cache_entry *ctx_entry =
 589                 &sw_context->res_cache[vmw_res_context];
 590         int ret;
 591
 592         BUG_ON(!ctx_entry->valid);
 593         sw_context->last_query_ctx = ctx_entry->res;
 594
 595         if (unlikely(new_query_bo != sw_context->cur_query_bo)) {
 596
 597                 if (unlikely(new_query_bo->num_pages > 4)) {
 598                         DRM_ERROR("Query buffer too large.\n");
 599                         return -EINVAL;
 600                 }
 601
 602                 if (unlikely(sw_context->cur_query_bo != NULL)) {
 603                         sw_context->needs_post_query_barrier = true;
 604                         ret = vmw_bo_to_validate_list(sw_context,
 605                                                       sw_context->cur_query_bo,
 606                                                       dev_priv->has_mob, NULL);
 607                         if (unlikely(ret != 0))
 608                                 return ret;
 609                 }
 610                 sw_context->cur_query_bo = new_query_bo;
 611
 612                 ret = vmw_bo_to_validate_list(sw_context,
 613                                               dev_priv->dummy_query_bo,
 614                                               dev_priv->has_mob, NULL);
 615                 if (unlikely(ret != 0))
 616                         return ret;
 617
 618         }
 619
 620         return 0;
 621 }
 622
 623
 624 /**
 625  * vmw_query_bo_switch_commit - Finalize switching pinned query buffer
 626  *
 627  * @dev_priv: The device private structure.
 628  * @sw_context: The software context used for this command submission batch.
 629  *
 630  * This function will check if we're switching query buffers, and will then,
 631  * issue a dummy occlusion query wait used as a query barrier. When the fence
 632  * object following that query wait has signaled, we are sure that all
 633  * preceding queries have finished, and the old query buffer can be unpinned.
 634  * However, since both the new query buffer and the old one are fenced with
 635  * that fence, we can do an asynchronus unpin now, and be sure that the
 636  * old query buffer won't be moved until the fence has signaled.
 637  *
 638  * As mentioned above, both the new - and old query buffers need to be fenced
 639  * using a sequence emitted *after* calling this function.
 640  */
 641 static void vmw_query_bo_switch_commit(struct vmw_private *dev_priv,
 642                                      struct vmw_sw_context *sw_context)
 643 {
 644         /*
 645          * The validate list should still hold references to all
 646          * contexts here.
 647          */
 648
 649         if (sw_context->needs_post_query_barrier) {
 650                 struct vmw_res_cache_entry *ctx_entry =
 651                         &sw_context->res_cache[vmw_res_context];
 652                 struct vmw_resource *ctx;
 653                 int ret;
 654
 655                 BUG_ON(!ctx_entry->valid);
 656                 ctx = ctx_entry->res;
 657
 658                 ret = vmw_fifo_emit_dummy_query(dev_priv, ctx->id);
 659
 660                 if (unlikely(ret != 0))
 661                         DRM_ERROR("Out of fifo space for dummy query.\n");
 662         }
 663
 664         if (dev_priv->pinned_bo != sw_context->cur_query_bo) {
 665                 if (dev_priv->pinned_bo) {
 666                         vmw_bo_pin(dev_priv->pinned_bo, false);
 667                         ttm_bo_unref(&dev_priv->pinned_bo);
 668                 }
 669
 670                 if (!sw_context->needs_post_query_barrier) {
 671                         vmw_bo_pin(sw_context->cur_query_bo, true);
 672
 673                         /*
 674                          * We pin also the dummy_query_bo buffer so that we
 675                          * don't need to validate it when emitting
 676                          * dummy queries in context destroy paths.
 677                          */
 678
 679                         vmw_bo_pin(dev_priv->dummy_query_bo, true);
 680                         dev_priv->dummy_query_bo_pinned = true;
 681
 682                         BUG_ON(sw_context->last_query_ctx == NULL);
 683                         dev_priv->query_cid = sw_context->last_query_ctx->id;
 684                         dev_priv->query_cid_valid = true;
 685                         dev_priv->pinned_bo =
 686                                 ttm_bo_reference(sw_context->cur_query_bo);
 687                 }
 688         }
 689 }
 690
 691 /**
 692  * vmw_translate_mob_pointer - Prepare to translate a user-space buffer
 693  * handle to a MOB id.
 694  *
 695  * @dev_priv: Pointer to a device private structure.
 696  * @sw_context: The software context used for this command batch validation.
 697  * @id: Pointer to the user-space handle to be translated.
 698  * @vmw_bo_p: Points to a location that, on successful return will carry
 699  * a reference-counted pointer to the DMA buffer identified by the
 700  * user-space handle in @id.
 701  *
 702  * This function saves information needed to translate a user-space buffer
 703  * handle to a MOB id. The translation does not take place immediately, but
 704  * during a call to vmw_apply_relocations(). This function builds a relocation
 705  * list and a list of buffers to validate. The former needs to be freed using
 706  * either vmw_apply_relocations() or vmw_free_relocations(). The latter
 707  * needs to be freed using vmw_clear_validations.
 708  */
 709 static int vmw_translate_mob_ptr(struct vmw_private *dev_priv,
 710                                  struct vmw_sw_context *sw_context,
 711                                  SVGAMobId *id,
 712                                  struct vmw_dma_buffer **vmw_bo_p)
 713 {
 714         struct vmw_dma_buffer *vmw_bo = NULL;
 715         struct ttm_buffer_object *bo;
 716         uint32_t handle = *id;
 717         struct vmw_relocation *reloc;
 718         int ret;
 719
 720         ret = vmw_user_dmabuf_lookup(sw_context->tfile, handle, &vmw_bo);
 721         if (unlikely(ret != 0)) {
 722                 DRM_ERROR("Could not find or use MOB buffer.\n");
 723                 return -EINVAL;
 724         }
 725         bo = &vmw_bo->base;
 726
 727         if (unlikely(sw_context->cur_reloc >= VMWGFX_MAX_RELOCATIONS)) {
 728                 DRM_ERROR("Max number relocations per submission"
 729                           " exceeded\n");
 730                 ret = -EINVAL;
 731                 goto out_no_reloc;
 732         }
 733
 734         reloc = &sw_context->relocs[sw_context->cur_reloc++];
 735         reloc->mob_loc = id;
 736         reloc->location = NULL;
 737
 738         ret = vmw_bo_to_validate_list(sw_context, bo, true, &reloc->index);
 739         if (unlikely(ret != 0))
 740                 goto out_no_reloc;
 741
 742         *vmw_bo_p = vmw_bo;
 743         return 0;
 744
 745 out_no_reloc:
 746         vmw_dmabuf_unreference(&vmw_bo);
 747         vmw_bo_p = NULL;
 748         return ret;
 749 }
 750
 751 /**
 752  * vmw_translate_guest_pointer - Prepare to translate a user-space buffer
 753  * handle to a valid SVGAGuestPtr
 754  *
 755  * @dev_priv: Pointer to a device private structure.
 756  * @sw_context: The software context used for this command batch validation.
 757  * @ptr: Pointer to the user-space handle to be translated.
 758  * @vmw_bo_p: Points to a location that, on successful return will carry
 759  * a reference-counted pointer to the DMA buffer identified by the
 760  * user-space handle in @id.
 761  *
 762  * This function saves information needed to translate a user-space buffer
 763  * handle to a valid SVGAGuestPtr. The translation does not take place
 764  * immediately, but during a call to vmw_apply_relocations().
 765  * This function builds a relocation list and a list of buffers to validate.
 766  * The former needs to be freed using either vmw_apply_relocations() or
 767  * vmw_free_relocations(). The latter needs to be freed using
 768  * vmw_clear_validations.
 769  */
 770 static int vmw_translate_guest_ptr(struct vmw_private *dev_priv,
 771                                    struct vmw_sw_context *sw_context,
 772                                    SVGAGuestPtr *ptr,
 773                                    struct vmw_dma_buffer **vmw_bo_p)
 774 {
 775         struct vmw_dma_buffer *vmw_bo = NULL;
 776         struct ttm_buffer_object *bo;
 777         uint32_t handle = ptr->gmrId;
 778         struct vmw_relocation *reloc;
 779         int ret;
 780
 781         ret = vmw_user_dmabuf_lookup(sw_context->tfile, handle, &vmw_bo);
 782         if (unlikely(ret != 0)) {
 783                 DRM_ERROR("Could not find or use GMR region.\n");
 784                 return -EINVAL;
 785         }
 786         bo = &vmw_bo->base;
 787
 788         if (unlikely(sw_context->cur_reloc >= VMWGFX_MAX_RELOCATIONS)) {
 789                 DRM_ERROR("Max number relocations per submission"
 790                           " exceeded\n");
 791                 ret = -EINVAL;
 792                 goto out_no_reloc;
 793         }
 794
 795         reloc = &sw_context->relocs[sw_context->cur_reloc++];
 796         reloc->location = ptr;
 797
 798         ret = vmw_bo_to_validate_list(sw_context, bo, false, &reloc->index);
 799         if (unlikely(ret != 0))
 800                 goto out_no_reloc;
 801
 802         *vmw_bo_p = vmw_bo;
 803         return 0;
 804
 805 out_no_reloc:
 806         vmw_dmabuf_unreference(&vmw_bo);
 807         vmw_bo_p = NULL;
 808         return ret;
 809 }
 810
 811 /**
 812  * vmw_cmd_begin_gb_query - validate a  SVGA_3D_CMD_BEGIN_GB_QUERY command.
 813  *
 814  * @dev_priv: Pointer to a device private struct.
 815  * @sw_context: The software context used for this command submission.
 816  * @header: Pointer to the command header in the command stream.
 817  */
 818 static int vmw_cmd_begin_gb_query(struct vmw_private *dev_priv,
 819                                   struct vmw_sw_context *sw_context,
 820                                   SVGA3dCmdHeader *header)
 821 {
 822         struct vmw_begin_gb_query_cmd {
 823                 SVGA3dCmdHeader header;
 824                 SVGA3dCmdBeginGBQuery q;
 825         } *cmd;
 826
 827         cmd = container_of(header, struct vmw_begin_gb_query_cmd,
 828                            header);
 829
 830         return vmw_cmd_res_check(dev_priv, sw_context, vmw_res_context,
 831                                  user_context_converter, &cmd->q.cid,
 832                                  NULL);
 833 }
 834
 835 /**
 836  * vmw_cmd_begin_query - validate a  SVGA_3D_CMD_BEGIN_QUERY command.
 837  *
 838  * @dev_priv: Pointer to a device private struct.
 839  * @sw_context: The software context used for this command submission.
 840  * @header: Pointer to the command header in the command stream.
 841  */
 842 static int vmw_cmd_begin_query(struct vmw_private *dev_priv,
 843                                struct vmw_sw_context *sw_context,
 844                                SVGA3dCmdHeader *header)
 845 {
 846         struct vmw_begin_query_cmd {
 847                 SVGA3dCmdHeader header;
 848                 SVGA3dCmdBeginQuery q;
 849         } *cmd;
 850
 851         cmd = container_of(header, struct vmw_begin_query_cmd,
 852                            header);
 853
 854         if (unlikely(dev_priv->has_mob)) {
 855                 struct {
 856                         SVGA3dCmdHeader header;
 857                         SVGA3dCmdBeginGBQuery q;
 858                 } gb_cmd;
 859
 860                 BUG_ON(sizeof(gb_cmd) != sizeof(*cmd));
 861
 862                 gb_cmd.header.id = SVGA_3D_CMD_BEGIN_GB_QUERY;
 863                 gb_cmd.header.size = cmd->header.size;
 864                 gb_cmd.q.cid = cmd->q.cid;
 865                 gb_cmd.q.type = cmd->q.type;
 866
 867                 memcpy(cmd, &gb_cmd, sizeof(*cmd));
 868                 return vmw_cmd_begin_gb_query(dev_priv, sw_context, header);
 869         }
 870
 871         return vmw_cmd_res_check(dev_priv, sw_context, vmw_res_context,
 872                                  user_context_converter, &cmd->q.cid,
 873                                  NULL);
 874 }
 875
 876 /**
 877  * vmw_cmd_end_gb_query - validate a  SVGA_3D_CMD_END_GB_QUERY command.
 878  *
 879  * @dev_priv: Pointer to a device private struct.
 880  * @sw_context: The software context used for this command submission.
 881  * @header: Pointer to the command header in the command stream.
 882  */
 883 static int vmw_cmd_end_gb_query(struct vmw_private *dev_priv,
 884                                 struct vmw_sw_context *sw_context,
 885                                 SVGA3dCmdHeader *header)
 886 {
 887         struct vmw_dma_buffer *vmw_bo;
 888         struct vmw_query_cmd {
 889                 SVGA3dCmdHeader header;
 890                 SVGA3dCmdEndGBQuery q;
 891         } *cmd;
 892         int ret;
 893
 894         cmd = container_of(header, struct vmw_query_cmd, header);
 895         ret = vmw_cmd_cid_check(dev_priv, sw_context, header);
 896         if (unlikely(ret != 0))
 897                 return ret;
 898
 899         ret = vmw_translate_mob_ptr(dev_priv, sw_context,
 900                                     &cmd->q.mobid,
 901                                     &vmw_bo);
 902         if (unlikely(ret != 0))
 903                 return ret;
 904
 905         ret = vmw_query_bo_switch_prepare(dev_priv, &vmw_bo->base, sw_context);
 906
 907         vmw_dmabuf_unreference(&vmw_bo);
 908         return ret;
 909 }
 910
 911 /**
 912  * vmw_cmd_end_query - validate a  SVGA_3D_CMD_END_QUERY command.
 913  *
 914  * @dev_priv: Pointer to a device private struct.
 915  * @sw_context: The software context used for this command submission.
 916  * @header: Pointer to the command header in the command stream.
 917  */
 918 static int vmw_cmd_end_query(struct vmw_private *dev_priv,
 919                              struct vmw_sw_context *sw_context,
 920                              SVGA3dCmdHeader *header)
 921 {
 922         struct vmw_dma_buffer *vmw_bo;
 923         struct vmw_query_cmd {
 924                 SVGA3dCmdHeader header;
 925                 SVGA3dCmdEndQuery q;
 926         } *cmd;
 927         int ret;
 928
 929         cmd = container_of(header, struct vmw_query_cmd, header);
 930         if (dev_priv->has_mob) {
 931                 struct {
 932                         SVGA3dCmdHeader header;
 933                         SVGA3dCmdEndGBQuery q;
 934                 } gb_cmd;
 935
 936                 BUG_ON(sizeof(gb_cmd) != sizeof(*cmd));
 937
 938                 gb_cmd.header.id = SVGA_3D_CMD_END_GB_QUERY;
 939                 gb_cmd.header.size = cmd->header.size;
 940                 gb_cmd.q.cid = cmd->q.cid;
 941                 gb_cmd.q.type = cmd->q.type;
 942                 gb_cmd.q.mobid = cmd->q.guestResult.gmrId;
 943                 gb_cmd.q.offset = cmd->q.guestResult.offset;
 944
 945                 memcpy(cmd, &gb_cmd, sizeof(*cmd));
 946                 return vmw_cmd_end_gb_query(dev_priv, sw_context, header);
 947         }
 948
 949         ret = vmw_cmd_cid_check(dev_priv, sw_context, header);
 950         if (unlikely(ret != 0))
 951                 return ret;
 952
 953         ret = vmw_translate_guest_ptr(dev_priv, sw_context,
 954                                       &cmd->q.guestResult,
 955                                       &vmw_bo);
 956         if (unlikely(ret != 0))
 957                 return ret;
 958
 959         ret = vmw_query_bo_switch_prepare(dev_priv, &vmw_bo->base, sw_context);
 960
 961         vmw_dmabuf_unreference(&vmw_bo);
 962         return ret;
 963 }
 964
 965 /**
 966  * vmw_cmd_wait_gb_query - validate a  SVGA_3D_CMD_WAIT_GB_QUERY command.
 967  *
 968  * @dev_priv: Pointer to a device private struct.
 969  * @sw_context: The software context used for this command submission.
 970  * @header: Pointer to the command header in the command stream.
 971  */
 972 static int vmw_cmd_wait_gb_query(struct vmw_private *dev_priv,
 973                                  struct vmw_sw_context *sw_context,
 974                                  SVGA3dCmdHeader *header)
 975 {
 976         struct vmw_dma_buffer *vmw_bo;
 977         struct vmw_query_cmd {
 978                 SVGA3dCmdHeader header;
 979                 SVGA3dCmdWaitForGBQuery q;
 980         } *cmd;
 981         int ret;
 982
 983         cmd = container_of(header, struct vmw_query_cmd, header);
 984         ret = vmw_cmd_cid_check(dev_priv, sw_context, header);
 985         if (unlikely(ret != 0))
 986                 return ret;
 987
 988         ret = vmw_translate_mob_ptr(dev_priv, sw_context,
 989                                     &cmd->q.mobid,
 990                                     &vmw_bo);
 991         if (unlikely(ret != 0))
 992                 return ret;
 993
 994         vmw_dmabuf_unreference(&vmw_bo);
 995         return 0;
 996 }
 997
 998 /**
 999  * vmw_cmd_wait_query - validate a  SVGA_3D_CMD_WAIT_QUERY command.
1000  *
1001  * @dev_priv: Pointer to a device private struct.
1002  * @sw_context: The software context used for this command submission.
1003  * @header: Pointer to the command header in the command stream.
1004  */
1005 static int vmw_cmd_wait_query(struct vmw_private *dev_priv,
1006                               struct vmw_sw_context *sw_context,
1007                               SVGA3dCmdHeader *header)
1008 {
1009         struct vmw_dma_buffer *vmw_bo;
1010         struct vmw_query_cmd {
1011                 SVGA3dCmdHeader header;
1012                 SVGA3dCmdWaitForQuery q;
1013         } *cmd;
1014         int ret;
1015
1016         cmd = container_of(header, struct vmw_query_cmd, header);
1017         if (dev_priv->has_mob) {
1018                 struct {
1019                         SVGA3dCmdHeader header;
1020                         SVGA3dCmdWaitForGBQuery q;
1021                 } gb_cmd;
1022
1023                 BUG_ON(sizeof(gb_cmd) != sizeof(*cmd));
1024
1025                 gb_cmd.header.id = SVGA_3D_CMD_WAIT_FOR_GB_QUERY;
1026                 gb_cmd.header.size = cmd->header.size;
1027                 gb_cmd.q.cid = cmd->q.cid;
1028                 gb_cmd.q.type = cmd->q.type;
1029                 gb_cmd.q.mobid = cmd->q.guestResult.gmrId;
1030                 gb_cmd.q.offset = cmd->q.guestResult.offset;
1031
1032                 memcpy(cmd, &gb_cmd, sizeof(*cmd));
1033                 return vmw_cmd_wait_gb_query(dev_priv, sw_context, header);
1034         }
1035
1036         ret = vmw_cmd_cid_check(dev_priv, sw_context, header);
1037         if (unlikely(ret != 0))
1038                 return ret;
1039
1040         ret = vmw_translate_guest_ptr(dev_priv, sw_context,
1041                                       &cmd->q.guestResult,
1042                                       &vmw_bo);
1043         if (unlikely(ret != 0))
1044                 return ret;
1045
1046         vmw_dmabuf_unreference(&vmw_bo);
1047         return 0;
1048 }
1049
1050 static int vmw_cmd_dma(struct vmw_private *dev_priv,
1051                        struct vmw_sw_context *sw_context,
1052                        SVGA3dCmdHeader *header)
1053 {
1054         struct vmw_dma_buffer *vmw_bo = NULL;
1055         struct vmw_surface *srf = NULL;
1056         struct vmw_dma_cmd {
1057                 SVGA3dCmdHeader header;
1058                 SVGA3dCmdSurfaceDMA dma;
1059         } *cmd;
1060         int ret;
1061
1062         cmd = container_of(header, struct vmw_dma_cmd, header);
1063         ret = vmw_translate_guest_ptr(dev_priv, sw_context,
1064                                       &cmd->dma.guest.ptr,
1065                                       &vmw_bo);
1066         if (unlikely(ret != 0))
1067                 return ret;
1068
1069         ret = vmw_cmd_res_check(dev_priv, sw_context, vmw_res_surface,
1070                                 user_surface_converter, &cmd->dma.host.sid,
1071                                 NULL);
1072         if (unlikely(ret != 0)) {
1073                 if (unlikely(ret != -ERESTARTSYS))
1074                         DRM_ERROR("could not find surface for DMA.\n");
1075                 goto out_no_surface;
1076         }
1077
1078         srf = vmw_res_to_srf(sw_context->res_cache[vmw_res_surface].res);
1079
1080         vmw_kms_cursor_snoop(srf, sw_context->tfile, &vmw_bo->base, header);
1081
1082 out_no_surface:
1083         vmw_dmabuf_unreference(&vmw_bo);
1084         return ret;
1085 }
1086
1087 static int vmw_cmd_draw(struct vmw_private *dev_priv,
1088                         struct vmw_sw_context *sw_context,
1089                         SVGA3dCmdHeader *header)
1090 {
1091         struct vmw_draw_cmd {
1092                 SVGA3dCmdHeader header;
1093                 SVGA3dCmdDrawPrimitives body;
1094         } *cmd;
1095         SVGA3dVertexDecl *decl = (SVGA3dVertexDecl *)(
1096                 (unsigned long)header + sizeof(*cmd));
1097         SVGA3dPrimitiveRange *range;
1098         uint32_t i;
1099         uint32_t maxnum;
1100         int ret;
1101
1102         ret = vmw_cmd_cid_check(dev_priv, sw_context, header);
1103         if (unlikely(ret != 0))
1104                 return ret;
1105
1106         cmd = container_of(header, struct vmw_draw_cmd, header);
1107         maxnum = (header->size - sizeof(cmd->body)) / sizeof(*decl);
1108
1109         if (unlikely(cmd->body.numVertexDecls > maxnum)) {
1110                 DRM_ERROR("Illegal number of vertex declarations.\n");
1111                 return -EINVAL;
1112         }
1113
1114         for (i = 0; i < cmd->body.numVertexDecls; ++i, ++decl) {
1115                 ret = vmw_cmd_res_check(dev_priv, sw_context, vmw_res_surface,
1116                                         user_surface_converter,
1117                                         &decl->array.surfaceId, NULL);
1118                 if (unlikely(ret != 0))
1119                         return ret;
1120         }
1121
1122         maxnum = (header->size - sizeof(cmd->body) -
1123                   cmd->body.numVertexDecls * sizeof(*decl)) / sizeof(*range);
1124         if (unlikely(cmd->body.numRanges > maxnum)) {
1125                 DRM_ERROR("Illegal number of index ranges.\n");
1126                 return -EINVAL;
1127         }
1128
1129         range = (SVGA3dPrimitiveRange *) decl;
1130         for (i = 0; i < cmd->body.numRanges; ++i, ++range) {
1131                 ret = vmw_cmd_res_check(dev_priv, sw_context, vmw_res_surface,
1132                                         user_surface_converter,
1133                                         &range->indexArray.surfaceId, NULL);
1134                 if (unlikely(ret != 0))
1135                         return ret;
1136         }
1137         return 0;
1138 }
1139
1140
1141 static int vmw_cmd_tex_state(struct vmw_private *dev_priv,
1142                              struct vmw_sw_context *sw_context,
1143                              SVGA3dCmdHeader *header)
1144 {
1145         struct vmw_tex_state_cmd {
1146                 SVGA3dCmdHeader header;
1147                 SVGA3dCmdSetTextureState state;
1148         };
1149
1150         SVGA3dTextureState *last_state = (SVGA3dTextureState *)
1151           ((unsigned long) header + header->size + sizeof(header));
1152         SVGA3dTextureState *cur_state = (SVGA3dTextureState *)
1153                 ((unsigned long) header + sizeof(struct vmw_tex_state_cmd));
1154         int ret;
1155
1156         ret = vmw_cmd_cid_check(dev_priv, sw_context, header);
1157         if (unlikely(ret != 0))
1158                 return ret;
1159
1160         for (; cur_state < last_state; ++cur_state) {
1161                 if (likely(cur_state->name != SVGA3D_TS_BIND_TEXTURE))
1162                         continue;
1163
1164                 ret = vmw_cmd_res_check(dev_priv, sw_context, vmw_res_surface,
1165                                         user_surface_converter,
1166                                         &cur_state->value, NULL);
1167                 if (unlikely(ret != 0))
1168                         return ret;
1169         }
1170
1171         return 0;
1172 }
1173
1174 static int vmw_cmd_check_define_gmrfb(struct vmw_private *dev_priv,
1175                                       struct vmw_sw_context *sw_context,
1176                                       void *buf)
1177 {
1178         struct vmw_dma_buffer *vmw_bo;
1179         int ret;
1180
1181         struct {
1182                 uint32_t header;
1183                 SVGAFifoCmdDefineGMRFB body;
1184         } *cmd = buf;
1185
1186         ret = vmw_translate_guest_ptr(dev_priv, sw_context,
1187                                       &cmd->body.ptr,
1188                                       &vmw_bo);
1189         if (unlikely(ret != 0))
1190                 return ret;
1191
1192         vmw_dmabuf_unreference(&vmw_bo);
1193
1194         return ret;
1195 }
1196
1197 /**
1198  * vmw_cmd_switch_backup - Utility function to handle backup buffer switching
1199  *
1200  * @dev_priv: Pointer to a device private struct.
1201  * @sw_context: The software context being used for this batch.
1202  * @res_type: The resource type.
1203  * @converter: Information about user-space binding for this resource type.
1204  * @res_id: Pointer to the user-space resource handle in the command stream.
1205  * @buf_id: Pointer to the user-space backup buffer handle in the command
1206  * stream.
1207  * @backup_offset: Offset of backup into MOB.
1208  *
1209  * This function prepares for registering a switch of backup buffers
1210  * in the resource metadata just prior to unreserving.
1211  */
1212 static int vmw_cmd_switch_backup(struct vmw_private *dev_priv,
1213                                  struct vmw_sw_context *sw_context,
1214                                  enum vmw_res_type res_type,
1215                                  const struct vmw_user_resource_conv
1216                                  *converter,
1217                                  uint32_t *res_id,
1218                                  uint32_t *buf_id,
1219                                  unsigned long backup_offset)
1220 {
1221         int ret;
1222         struct vmw_dma_buffer *dma_buf;
1223         struct vmw_resource_val_node *val_node;
1224
1225         ret = vmw_cmd_res_check(dev_priv, sw_context, res_type,
1226                                 converter, res_id, &val_node);
1227         if (unlikely(ret != 0))
1228                 return ret;
1229
1230         ret = vmw_translate_mob_ptr(dev_priv, sw_context, buf_id, &dma_buf);
1231         if (unlikely(ret != 0))
1232                 return ret;
1233
1234         if (val_node->first_usage)
1235                 val_node->no_buffer_needed = true;
1236
1237         vmw_dmabuf_unreference(&val_node->new_backup);
1238         val_node->new_backup = dma_buf;
1239         val_node->new_backup_offset = backup_offset;
1240
1241         return 0;
1242 }
1243
1244 /**
1245  * vmw_cmd_bind_gb_surface - Validate an SVGA_3D_CMD_BIND_GB_SURFACE
1246  * command
1247  *
1248  * @dev_priv: Pointer to a device private struct.
1249  * @sw_context: The software context being used for this batch.
1250  * @header: Pointer to the command header in the command stream.
1251  */
1252 static int vmw_cmd_bind_gb_surface(struct vmw_private *dev_priv,
1253                                    struct vmw_sw_context *sw_context,
1254                                    SVGA3dCmdHeader *header)
1255 {
1256         struct vmw_bind_gb_surface_cmd {
1257                 SVGA3dCmdHeader header;
1258                 SVGA3dCmdBindGBSurface body;
1259         } *cmd;
1260
1261         cmd = container_of(header, struct vmw_bind_gb_surface_cmd, header);
1262
1263         return vmw_cmd_switch_backup(dev_priv, sw_context, vmw_res_surface,
1264                                      user_surface_converter,
1265                                      &cmd->body.sid, &cmd->body.mobid,
1266                                      0);
1267 }
1268
1269 /**
1270  * vmw_cmd_update_gb_image - Validate an SVGA_3D_CMD_UPDATE_GB_IMAGE
1271  * command
1272  *
1273  * @dev_priv: Pointer to a device private struct.
1274  * @sw_context: The software context being used for this batch.
1275  * @header: Pointer to the command header in the command stream.
1276  */
1277 static int vmw_cmd_update_gb_image(struct vmw_private *dev_priv,
1278                                    struct vmw_sw_context *sw_context,
1279                                    SVGA3dCmdHeader *header)
1280 {
1281         struct vmw_gb_surface_cmd {
1282                 SVGA3dCmdHeader header;
1283                 SVGA3dCmdUpdateGBImage body;
1284         } *cmd;
1285
1286         cmd = container_of(header, struct vmw_gb_surface_cmd, header);
1287
1288         return vmw_cmd_res_check(dev_priv, sw_context, vmw_res_surface,
1289                                  user_surface_converter,
1290                                  &cmd->body.image.sid, NULL);
1291 }
1292
1293 /**
1294  * vmw_cmd_update_gb_surface - Validate an SVGA_3D_CMD_UPDATE_GB_SURFACE
1295  * command
1296  *
1297  * @dev_priv: Pointer to a device private struct.
1298  * @sw_context: The software context being used for this batch.
1299  * @header: Pointer to the command header in the command stream.
1300  */
1301 static int vmw_cmd_update_gb_surface(struct vmw_private *dev_priv,
1302                                      struct vmw_sw_context *sw_context,
1303                                      SVGA3dCmdHeader *header)
1304 {
1305         struct vmw_gb_surface_cmd {
1306                 SVGA3dCmdHeader header;
1307                 SVGA3dCmdUpdateGBSurface body;
1308         } *cmd;
1309
1310         cmd = container_of(header, struct vmw_gb_surface_cmd, header);
1311
1312         return vmw_cmd_res_check(dev_priv, sw_context, vmw_res_surface,
1313                                  user_surface_converter,
1314                                  &cmd->body.sid, NULL);
1315 }
1316
1317 /**
1318  * vmw_cmd_readback_gb_image - Validate an SVGA_3D_CMD_READBACK_GB_IMAGE
1319  * command
1320  *
1321  * @dev_priv: Pointer to a device private struct.
1322  * @sw_context: The software context being used for this batch.
1323  * @header: Pointer to the command header in the command stream.
1324  */
1325 static int vmw_cmd_readback_gb_image(struct vmw_private *dev_priv,
1326                                      struct vmw_sw_context *sw_context,
1327                                      SVGA3dCmdHeader *header)
1328 {
1329         struct vmw_gb_surface_cmd {
1330                 SVGA3dCmdHeader header;
1331                 SVGA3dCmdReadbackGBImage body;
1332         } *cmd;
1333
1334         cmd = container_of(header, struct vmw_gb_surface_cmd, header);
1335
1336         return vmw_cmd_res_check(dev_priv, sw_context, vmw_res_surface,
1337                                  user_surface_converter,
1338                                  &cmd->body.image.sid, NULL);
1339 }
1340
1341 /**
1342  * vmw_cmd_readback_gb_surface - Validate an SVGA_3D_CMD_READBACK_GB_SURFACE
1343  * command
1344  *
1345  * @dev_priv: Pointer to a device private struct.
1346  * @sw_context: The software context being used for this batch.
1347  * @header: Pointer to the command header in the command stream.
1348  */
1349 static int vmw_cmd_readback_gb_surface(struct vmw_private *dev_priv,
1350                                        struct vmw_sw_context *sw_context,
1351                                        SVGA3dCmdHeader *header)
1352 {
1353         struct vmw_gb_surface_cmd {
1354                 SVGA3dCmdHeader header;
1355                 SVGA3dCmdReadbackGBSurface body;
1356         } *cmd;
1357
1358         cmd = container_of(header, struct vmw_gb_surface_cmd, header);
1359
1360         return vmw_cmd_res_check(dev_priv, sw_context, vmw_res_surface,
1361                                  user_surface_converter,
1362                                  &cmd->body.sid, NULL);
1363 }
1364
1365 /**
1366  * vmw_cmd_invalidate_gb_image - Validate an SVGA_3D_CMD_INVALIDATE_GB_IMAGE
1367  * command
1368  *
1369  * @dev_priv: Pointer to a device private struct.
1370  * @sw_context: The software context being used for this batch.
1371  * @header: Pointer to the command header in the command stream.
1372  */
1373 static int vmw_cmd_invalidate_gb_image(struct vmw_private *dev_priv,
1374                                        struct vmw_sw_context *sw_context,
1375                                        SVGA3dCmdHeader *header)
1376 {
1377         struct vmw_gb_surface_cmd {
1378                 SVGA3dCmdHeader header;
1379                 SVGA3dCmdInvalidateGBImage body;
1380         } *cmd;
1381
1382         cmd = container_of(header, struct vmw_gb_surface_cmd, header);
1383
1384         return vmw_cmd_res_check(dev_priv, sw_context, vmw_res_surface,
1385                                  user_surface_converter,
1386                                  &cmd->body.image.sid, NULL);
1387 }
1388
1389 /**
1390  * vmw_cmd_invalidate_gb_surface - Validate an
1391  * SVGA_3D_CMD_INVALIDATE_GB_SURFACE command
1392  *
1393  * @dev_priv: Pointer to a device private struct.
1394  * @sw_context: The software context being used for this batch.
1395  * @header: Pointer to the command header in the command stream.
1396  */
1397 static int vmw_cmd_invalidate_gb_surface(struct vmw_private *dev_priv,
1398                                          struct vmw_sw_context *sw_context,
1399                                          SVGA3dCmdHeader *header)
1400 {
1401         struct vmw_gb_surface_cmd {
1402                 SVGA3dCmdHeader header;
1403                 SVGA3dCmdInvalidateGBSurface body;
1404         } *cmd;
1405
1406         cmd = container_of(header, struct vmw_gb_surface_cmd, header);
1407
1408         return vmw_cmd_res_check(dev_priv, sw_context, vmw_res_surface,
1409                                  user_surface_converter,
1410                                  &cmd->body.sid, NULL);
1411 }
1412
1413 /**
1414  * vmw_cmd_set_shader - Validate an SVGA_3D_CMD_SET_SHADER
1415  * command
1416  *
1417  * @dev_priv: Pointer to a device private struct.
1418  * @sw_context: The software context being used for this batch.
1419  * @header: Pointer to the command header in the command stream.
1420  */
1421 static int vmw_cmd_set_shader(struct vmw_private *dev_priv,
1422                               struct vmw_sw_context *sw_context,
1423                               SVGA3dCmdHeader *header)
1424 {
1425         struct vmw_set_shader_cmd {
1426                 SVGA3dCmdHeader header;
1427                 SVGA3dCmdSetShader body;
1428         } *cmd;
1429         int ret;
1430
1431         cmd = container_of(header, struct vmw_set_shader_cmd,
1432                            header);
1433
1434         ret = vmw_cmd_cid_check(dev_priv, sw_context, header);
1435         if (unlikely(ret != 0))
1436                 return ret;
1437
1438
1439         if (dev_priv->has_mob)
1440                 return vmw_cmd_res_check(dev_priv, sw_context, vmw_res_shader,
1441                                          user_shader_converter,
1442                                          &cmd->body.shid, NULL);
1443
1444         return 0;
1445 }
1446
1447 /**
1448  * vmw_cmd_bind_gb_shader - Validate an SVGA_3D_CMD_BIND_GB_SHADER
1449  * command
1450  *
1451  * @dev_priv: Pointer to a device private struct.
1452  * @sw_context: The software context being used for this batch.
1453  * @header: Pointer to the command header in the command stream.
1454  */
1455 static int vmw_cmd_bind_gb_shader(struct vmw_private *dev_priv,
1456                                   struct vmw_sw_context *sw_context,
1457                                   SVGA3dCmdHeader *header)
1458 {
1459         struct vmw_bind_gb_shader_cmd {
1460                 SVGA3dCmdHeader header;
1461                 SVGA3dCmdBindGBShader body;
1462         } *cmd;
1463
1464         cmd = container_of(header, struct vmw_bind_gb_shader_cmd,
1465                            header);
1466
1467         return vmw_cmd_switch_backup(dev_priv, sw_context, vmw_res_shader,
1468                                      user_shader_converter,
1469                                      &cmd->body.shid, &cmd->body.mobid,
1470                                      cmd->body.offsetInBytes);
1471 }
1472
1473 static int vmw_cmd_check_not_3d(struct vmw_private *dev_priv,
1474                                 struct vmw_sw_context *sw_context,
1475                                 void *buf, uint32_t *size)
1476 {
1477         uint32_t size_remaining = *size;
1478         uint32_t cmd_id;
1479
1480         cmd_id = le32_to_cpu(((uint32_t *)buf)[0]);
1481         switch (cmd_id) {
1482         case SVGA_CMD_UPDATE:
1483                 *size = sizeof(uint32_t) + sizeof(SVGAFifoCmdUpdate);
1484                 break;
1485         case SVGA_CMD_DEFINE_GMRFB:
1486                 *size = sizeof(uint32_t) + sizeof(SVGAFifoCmdDefineGMRFB);
1487                 break;
1488         case SVGA_CMD_BLIT_GMRFB_TO_SCREEN:
1489                 *size = sizeof(uint32_t) + sizeof(SVGAFifoCmdBlitGMRFBToScreen);
1490                 break;
1491         case SVGA_CMD_BLIT_SCREEN_TO_GMRFB:
1492                 *size = sizeof(uint32_t) + sizeof(SVGAFifoCmdBlitGMRFBToScreen);
1493                 break;
1494         default:
1495                 DRM_ERROR("Unsupported SVGA command: %u.\n", cmd_id);
1496                 return -EINVAL;
1497         }
1498
1499         if (*size > size_remaining) {
1500                 DRM_ERROR("Invalid SVGA command (size mismatch):"
1501                           " %u.\n", cmd_id);
1502                 return -EINVAL;
1503         }
1504
1505         if (unlikely(!sw_context->kernel)) {
1506                 DRM_ERROR("Kernel only SVGA command: %u.\n", cmd_id);
1507                 return -EPERM;
1508         }
1509
1510         if (cmd_id == SVGA_CMD_DEFINE_GMRFB)
1511                 return vmw_cmd_check_define_gmrfb(dev_priv, sw_context, buf);
1512
1513         return 0;
1514 }
1515
1516 static const struct vmw_cmd_entry const vmw_cmd_entries[SVGA_3D_CMD_MAX] = {
1517         VMW_CMD_DEF(SVGA_3D_CMD_SURFACE_DEFINE, &vmw_cmd_invalid,
1518                     false, false, false),
1519         VMW_CMD_DEF(SVGA_3D_CMD_SURFACE_DESTROY, &vmw_cmd_invalid,
1520                     false, false, false),
1521         VMW_CMD_DEF(SVGA_3D_CMD_SURFACE_COPY, &vmw_cmd_surface_copy_check,
1522                     true, false, false),
1523         VMW_CMD_DEF(SVGA_3D_CMD_SURFACE_STRETCHBLT, &vmw_cmd_stretch_blt_check,
1524                     true, false, false),
1525         VMW_CMD_DEF(SVGA_3D_CMD_SURFACE_DMA, &vmw_cmd_dma,
1526                     true, false, false),
1527         VMW_CMD_DEF(SVGA_3D_CMD_CONTEXT_DEFINE, &vmw_cmd_invalid,
1528                     false, false, false),
1529         VMW_CMD_DEF(SVGA_3D_CMD_CONTEXT_DESTROY, &vmw_cmd_invalid,
1530                     false, false, false),
1531         VMW_CMD_DEF(SVGA_3D_CMD_SETTRANSFORM, &vmw_cmd_cid_check,
1532                     true, false, false),
1533         VMW_CMD_DEF(SVGA_3D_CMD_SETZRANGE, &vmw_cmd_cid_check,
1534                     true, false, false),
1535         VMW_CMD_DEF(SVGA_3D_CMD_SETRENDERSTATE, &vmw_cmd_cid_check,
1536                     true, false, false),
1537         VMW_CMD_DEF(SVGA_3D_CMD_SETRENDERTARGET,
1538                     &vmw_cmd_set_render_target_check, true, false, false),
1539         VMW_CMD_DEF(SVGA_3D_CMD_SETTEXTURESTATE, &vmw_cmd_tex_state,
1540                     true, false, false),
1541         VMW_CMD_DEF(SVGA_3D_CMD_SETMATERIAL, &vmw_cmd_cid_check,
1542                     true, false, false),
1543         VMW_CMD_DEF(SVGA_3D_CMD_SETLIGHTDATA, &vmw_cmd_cid_check,
1544                     true, false, false),
1545         VMW_CMD_DEF(SVGA_3D_CMD_SETLIGHTENABLED, &vmw_cmd_cid_check,
1546                     true, false, false),
1547         VMW_CMD_DEF(SVGA_3D_CMD_SETVIEWPORT, &vmw_cmd_cid_check,
1548                     true, false, false),
1549         VMW_CMD_DEF(SVGA_3D_CMD_SETCLIPPLANE, &vmw_cmd_cid_check,
1550                     true, false, false),
1551         VMW_CMD_DEF(SVGA_3D_CMD_CLEAR, &vmw_cmd_cid_check,
1552                     true, false, false),
1553         VMW_CMD_DEF(SVGA_3D_CMD_PRESENT, &vmw_cmd_present_check,
1554                     false, false, false),
1555         VMW_CMD_DEF(SVGA_3D_CMD_SHADER_DEFINE, &vmw_cmd_cid_check,
1556                     true, true, false),
1557         VMW_CMD_DEF(SVGA_3D_CMD_SHADER_DESTROY, &vmw_cmd_cid_check,
1558                     true, true, false),
1559         VMW_CMD_DEF(SVGA_3D_CMD_SET_SHADER, &vmw_cmd_set_shader,
1560                     true, false, false),
1561         VMW_CMD_DEF(SVGA_3D_CMD_SET_SHADER_CONST, &vmw_cmd_cid_check,
1562                     true, true, false),
1563         VMW_CMD_DEF(SVGA_3D_CMD_DRAW_PRIMITIVES, &vmw_cmd_draw,
1564                     true, false, false),
1565         VMW_CMD_DEF(SVGA_3D_CMD_SETSCISSORRECT, &vmw_cmd_cid_check,
1566                     true, false, false),
1567         VMW_CMD_DEF(SVGA_3D_CMD_BEGIN_QUERY, &vmw_cmd_begin_query,
1568                     true, false, false),
1569         VMW_CMD_DEF(SVGA_3D_CMD_END_QUERY, &vmw_cmd_end_query,
1570                     true, false, false),
1571         VMW_CMD_DEF(SVGA_3D_CMD_WAIT_FOR_QUERY, &vmw_cmd_wait_query,
1572                     true, false, false),
1573         VMW_CMD_DEF(SVGA_3D_CMD_PRESENT_READBACK, &vmw_cmd_ok,
1574                     true, false, false),
1575         VMW_CMD_DEF(SVGA_3D_CMD_BLIT_SURFACE_TO_SCREEN,
1576                     &vmw_cmd_blt_surf_screen_check, false, false, false),
1577         VMW_CMD_DEF(SVGA_3D_CMD_SURFACE_DEFINE_V2, &vmw_cmd_invalid,
1578                     false, false, false),
1579         VMW_CMD_DEF(SVGA_3D_CMD_GENERATE_MIPMAPS, &vmw_cmd_invalid,
1580                     false, false, false),
1581         VMW_CMD_DEF(SVGA_3D_CMD_ACTIVATE_SURFACE, &vmw_cmd_invalid,
1582                     false, false, false),
1583         VMW_CMD_DEF(SVGA_3D_CMD_DEACTIVATE_SURFACE, &vmw_cmd_invalid,
1584                     false, false, false),
1585         VMW_CMD_DEF(SVGA_3D_CMD_SCREEN_DMA, &vmw_cmd_invalid,
1586                     false, false, false),
1587         VMW_CMD_DEF(SVGA_3D_CMD_SET_UNITY_SURFACE_COOKIE, &vmw_cmd_invalid,
1588                     false, false, false),
1589         VMW_CMD_DEF(SVGA_3D_CMD_OPEN_CONTEXT_SURFACE, &vmw_cmd_invalid,
1590                     false, false, false),
1591         VMW_CMD_DEF(SVGA_3D_CMD_LOGICOPS_BITBLT, &vmw_cmd_invalid,
1592                     false, false, false),
1593         VMW_CMD_DEF(SVGA_3D_CMD_LOGICOPS_TRANSBLT, &vmw_cmd_invalid,
1594                     false, false, false),
1595         VMW_CMD_DEF(SVGA_3D_CMD_LOGICOPS_STRETCHBLT, &vmw_cmd_invalid,
1596                     false, false, false),
1597         VMW_CMD_DEF(SVGA_3D_CMD_LOGICOPS_COLORFILL, &vmw_cmd_invalid,
1598                     false, false, false),
1599         VMW_CMD_DEF(SVGA_3D_CMD_LOGICOPS_ALPHABLEND, &vmw_cmd_invalid,
1600                     false, false, false),
1601         VMW_CMD_DEF(SVGA_3D_CMD_LOGICOPS_CLEARTYPEBLEND, &vmw_cmd_invalid,
1602                     false, false, false),
1603         VMW_CMD_DEF(SVGA_3D_CMD_SET_OTABLE_BASE, &vmw_cmd_invalid,
1604                     false, false, true),
1605         VMW_CMD_DEF(SVGA_3D_CMD_READBACK_OTABLE, &vmw_cmd_invalid,
1606                     false, false, true),
1607         VMW_CMD_DEF(SVGA_3D_CMD_DEFINE_GB_MOB, &vmw_cmd_invalid,
1608                     false, false, true),
1609         VMW_CMD_DEF(SVGA_3D_CMD_DESTROY_GB_MOB, &vmw_cmd_invalid,
1610                     false, false, true),
1611         VMW_CMD_DEF(SVGA_3D_CMD_REDEFINE_GB_MOB, &vmw_cmd_invalid,
1612                     false, false, true),
1613         VMW_CMD_DEF(SVGA_3D_CMD_UPDATE_GB_MOB_MAPPING, &vmw_cmd_invalid,
1614                     false, false, true),
1615         VMW_CMD_DEF(SVGA_3D_CMD_DEFINE_GB_SURFACE, &vmw_cmd_invalid,
1616                     false, false, true),
1617         VMW_CMD_DEF(SVGA_3D_CMD_DESTROY_GB_SURFACE, &vmw_cmd_invalid,
1618                     false, false, true),
1619         VMW_CMD_DEF(SVGA_3D_CMD_BIND_GB_SURFACE, &vmw_cmd_bind_gb_surface,
1620                     true, false, true),
1621         VMW_CMD_DEF(SVGA_3D_CMD_COND_BIND_GB_SURFACE, &vmw_cmd_invalid,
1622                     false, false, true),
1623         VMW_CMD_DEF(SVGA_3D_CMD_UPDATE_GB_IMAGE, &vmw_cmd_update_gb_image,
1624                     true, false, true),
1625         VMW_CMD_DEF(SVGA_3D_CMD_UPDATE_GB_SURFACE,
1626                     &vmw_cmd_update_gb_surface, true, false, true),
1627         VMW_CMD_DEF(SVGA_3D_CMD_READBACK_GB_IMAGE,
1628                     &vmw_cmd_readback_gb_image, true, false, true),
1629         VMW_CMD_DEF(SVGA_3D_CMD_READBACK_GB_SURFACE,
1630                     &vmw_cmd_readback_gb_surface, true, false, true),
1631         VMW_CMD_DEF(SVGA_3D_CMD_INVALIDATE_GB_IMAGE,
1632                     &vmw_cmd_invalidate_gb_image, true, false, true),
1633         VMW_CMD_DEF(SVGA_3D_CMD_INVALIDATE_GB_SURFACE,
1634                     &vmw_cmd_invalidate_gb_surface, true, false, true),
1635         VMW_CMD_DEF(SVGA_3D_CMD_DEFINE_GB_CONTEXT, &vmw_cmd_invalid,
1636                     false, false, true),
1637         VMW_CMD_DEF(SVGA_3D_CMD_DESTROY_GB_CONTEXT, &vmw_cmd_invalid,
1638                     false, false, true),
1639         VMW_CMD_DEF(SVGA_3D_CMD_BIND_GB_CONTEXT, &vmw_cmd_invalid,
1640                     false, false, true),
1641         VMW_CMD_DEF(SVGA_3D_CMD_READBACK_GB_CONTEXT, &vmw_cmd_invalid,
1642                     false, false, true),
1643         VMW_CMD_DEF(SVGA_3D_CMD_INVALIDATE_GB_CONTEXT, &vmw_cmd_invalid,
1644                     false, false, true),
1645         VMW_CMD_DEF(SVGA_3D_CMD_DEFINE_GB_SHADER, &vmw_cmd_invalid,
1646                     false, false, true),
1647         VMW_CMD_DEF(SVGA_3D_CMD_BIND_GB_SHADER, &vmw_cmd_bind_gb_shader,
1648                     true, false, true),
1649         VMW_CMD_DEF(SVGA_3D_CMD_DESTROY_GB_SHADER, &vmw_cmd_invalid,
1650                     false, false, true),
1651         VMW_CMD_DEF(SVGA_3D_CMD_BIND_SHADERCONSTS, &vmw_cmd_invalid,
1652                     false, false, false),
1653         VMW_CMD_DEF(SVGA_3D_CMD_BEGIN_GB_QUERY, &vmw_cmd_begin_gb_query,
1654                     true, false, true),
1655         VMW_CMD_DEF(SVGA_3D_CMD_END_GB_QUERY, &vmw_cmd_end_gb_query,
1656                     true, false, true),
1657         VMW_CMD_DEF(SVGA_3D_CMD_WAIT_FOR_GB_QUERY, &vmw_cmd_wait_gb_query,
1658                     true, false, true),
1659         VMW_CMD_DEF(SVGA_3D_CMD_NOP, &vmw_cmd_ok,
1660                     true, false, true),
1661         VMW_CMD_DEF(SVGA_3D_CMD_ENABLE_GART, &vmw_cmd_invalid,
1662                     false, false, true),
1663         VMW_CMD_DEF(SVGA_3D_CMD_DISABLE_GART, &vmw_cmd_invalid,
1664                     false, false, true),
1665         VMW_CMD_DEF(SVGA_3D_CMD_MAP_MOB_INTO_GART, &vmw_cmd_invalid,
1666                     false, false, true),
1667         VMW_CMD_DEF(SVGA_3D_CMD_UNMAP_GART_RANGE, &vmw_cmd_invalid,
1668                     false, false, true),
1669         VMW_CMD_DEF(SVGA_3D_CMD_DEFINE_GB_SCREENTARGET, &vmw_cmd_invalid,
1670                     false, false, true),
1671         VMW_CMD_DEF(SVGA_3D_CMD_DESTROY_GB_SCREENTARGET, &vmw_cmd_invalid,
1672                     false, false, true),
1673         VMW_CMD_DEF(SVGA_3D_CMD_BIND_GB_SCREENTARGET, &vmw_cmd_invalid,
1674                     false, false, true),
1675         VMW_CMD_DEF(SVGA_3D_CMD_UPDATE_GB_SCREENTARGET, &vmw_cmd_invalid,
1676                     false, false, true),
1677         VMW_CMD_DEF(SVGA_3D_CMD_READBACK_GB_IMAGE_PARTIAL, &vmw_cmd_invalid,
1678                     false, false, true),
1679         VMW_CMD_DEF(SVGA_3D_CMD_INVALIDATE_GB_IMAGE_PARTIAL, &vmw_cmd_invalid,
1680                     false, false, true),
1681         VMW_CMD_DEF(SVGA_3D_CMD_SET_GB_SHADERCONSTS_INLINE, &vmw_cmd_cid_check,
1682                     true, false, true)
1683 };
1684
1685 static int vmw_cmd_check(struct vmw_private *dev_priv,
1686                          struct vmw_sw_context *sw_context,
1687                          void *buf, uint32_t *size)
1688 {
1689         uint32_t cmd_id;
1690         uint32_t size_remaining = *size;
1691         SVGA3dCmdHeader *header = (SVGA3dCmdHeader *) buf;
1692         int ret;
1693         const struct vmw_cmd_entry *entry;
1694         bool gb = dev_priv->capabilities & SVGA_CAP_GBOBJECTS;
1695
1696         cmd_id = le32_to_cpu(((uint32_t *)buf)[0]);
1697         /* Handle any none 3D commands */
1698         if (unlikely(cmd_id < SVGA_CMD_MAX))
1699                 return vmw_cmd_check_not_3d(dev_priv, sw_context, buf, size);
1700
1701
1702         cmd_id = le32_to_cpu(header->id);
1703         *size = le32_to_cpu(header->size) + sizeof(SVGA3dCmdHeader);
1704
1705         cmd_id -= SVGA_3D_CMD_BASE;
1706         if (unlikely(*size > size_remaining))
1707                 goto out_invalid;
1708
1709         if (unlikely(cmd_id >= SVGA_3D_CMD_MAX - SVGA_3D_CMD_BASE))
1710                 goto out_invalid;
1711
1712         entry = &vmw_cmd_entries[cmd_id];
1713         if (unlikely(!entry->user_allow && !sw_context->kernel))
1714                 goto out_privileged;
1715
1716         if (unlikely(entry->gb_disable && gb))
1717                 goto out_old;
1718
1719         if (unlikely(entry->gb_enable && !gb))
1720                 goto out_new;
1721
1722         ret = entry->func(dev_priv, sw_context, header);
1723         if (unlikely(ret != 0))
1724                 goto out_invalid;
1725
1726         return 0;
1727 out_invalid:
1728         DRM_ERROR("Invalid SVGA3D command: %d\n",
1729                   cmd_id + SVGA_3D_CMD_BASE);
1730         return -EINVAL;
1731 out_privileged:
1732         DRM_ERROR("Privileged SVGA3D command: %d\n",
1733                   cmd_id + SVGA_3D_CMD_BASE);
1734         return -EPERM;
1735 out_old:
1736         DRM_ERROR("Deprecated (disallowed) SVGA3D command: %d\n",
1737                   cmd_id + SVGA_3D_CMD_BASE);
1738         return -EINVAL;
1739 out_new:
1740         DRM_ERROR("SVGA3D command: %d not supported by virtual hardware.\n",
1741                   cmd_id + SVGA_3D_CMD_BASE);
1742         return -EINVAL;
1743 }
1744
1745 static int vmw_cmd_check_all(struct vmw_private *dev_priv,
1746                              struct vmw_sw_context *sw_context,
1747                              void *buf,
1748                              uint32_t size)
1749 {
1750         int32_t cur_size = size;
1751         int ret;
1752
1753         sw_context->buf_start = buf;
1754
1755         while (cur_size > 0) {
1756                 size = cur_size;
1757                 ret = vmw_cmd_check(dev_priv, sw_context, buf, &size);
1758                 if (unlikely(ret != 0))
1759                         return ret;
1760                 buf = (void *)((unsigned long) buf + size);
1761                 cur_size -= size;
1762         }
1763
1764         if (unlikely(cur_size != 0)) {
1765                 DRM_ERROR("Command verifier out of sync.\n");
1766                 return -EINVAL;
1767         }
1768
1769         return 0;
1770 }
1771
1772 static void vmw_free_relocations(struct vmw_sw_context *sw_context)
1773 {
1774         sw_context->cur_reloc = 0;
1775 }
1776
1777 static void vmw_apply_relocations(struct vmw_sw_context *sw_context)
1778 {
1779         uint32_t i;
1780         struct vmw_relocation *reloc;
1781         struct ttm_validate_buffer *validate;
1782         struct ttm_buffer_object *bo;
1783
1784         for (i = 0; i < sw_context->cur_reloc; ++i) {
1785                 reloc = &sw_context->relocs[i];
1786                 validate = &sw_context->val_bufs[reloc->index].base;
1787                 bo = validate->bo;
1788                 switch (bo->mem.mem_type) {
1789                 case TTM_PL_VRAM:
1790                         reloc->location->offset += bo->offset;
1791                         reloc->location->gmrId = SVGA_GMR_FRAMEBUFFER;
1792                         break;
1793                 case VMW_PL_GMR:
1794                         reloc->location->gmrId = bo->mem.start;
1795                         break;
1796                 case VMW_PL_MOB:
1797                         *reloc->mob_loc = bo->mem.start;
1798                         break;
1799                 default:
1800                         BUG();
1801                 }
1802         }
1803         vmw_free_relocations(sw_context);
1804 }
1805
1806 /**
1807  * vmw_resource_list_unrefererence - Free up a resource list and unreference
1808  * all resources referenced by it.
1809  *
1810  * @list: The resource list.
1811  */
1812 static void vmw_resource_list_unreference(struct list_head *list)
1813 {
1814         struct vmw_resource_val_node *val, *val_next;
1815
1816         /*
1817          * Drop references to resources held during command submission.
1818          */
1819
1820         list_for_each_entry_safe(val, val_next, list, head) {
1821                 list_del_init(&val->head);
1822                 vmw_resource_unreference(&val->res);
1823                 kfree(val);
1824         }
1825 }
1826
1827 static void vmw_clear_validations(struct vmw_sw_context *sw_context)
1828 {
1829         struct vmw_validate_buffer *entry, *next;
1830         struct vmw_resource_val_node *val;
1831
1832         /*
1833          * Drop references to DMA buffers held during command submission.
1834          */
1835         list_for_each_entry_safe(entry, next, &sw_context->validate_nodes,
1836                                  base.head) {
1837                 list_del(&entry->base.head);
1838                 ttm_bo_unref(&entry->base.bo);
1839                 (void) drm_ht_remove_item(&sw_context->res_ht, &entry->hash);
1840                 sw_context->cur_val_buf--;
1841         }
1842         BUG_ON(sw_context->cur_val_buf != 0);
1843
1844         list_for_each_entry(val, &sw_context->resource_list, head)
1845                 (void) drm_ht_remove_item(&sw_context->res_ht, &val->hash);
1846 }
1847
1848 static int vmw_validate_single_buffer(struct vmw_private *dev_priv,
1849                                       struct ttm_buffer_object *bo,
1850                                       bool validate_as_mob)
1851 {
1852         int ret;
1853
1854
1855         /*
1856          * Don't validate pinned buffers.
1857          */
1858
1859         if (bo == dev_priv->pinned_bo ||
1860             (bo == dev_priv->dummy_query_bo &&
1861              dev_priv->dummy_query_bo_pinned))
1862                 return 0;
1863
1864         if (validate_as_mob)
1865                 return ttm_bo_validate(bo, &vmw_mob_placement, true, false);
1866
1867         /**
1868          * Put BO in VRAM if there is space, otherwise as a GMR.
1869          * If there is no space in VRAM and GMR ids are all used up,
1870          * start evicting GMRs to make room. If the DMA buffer can't be
1871          * used as a GMR, this will return -ENOMEM.
1872          */
1873
1874         ret = ttm_bo_validate(bo, &vmw_vram_gmr_placement, true, false);
1875         if (likely(ret == 0 || ret == -ERESTARTSYS))
1876                 return ret;
1877
1878         /**
1879          * If that failed, try VRAM again, this time evicting
1880          * previous contents.
1881          */
1882
1883         DRM_INFO("Falling through to VRAM.\n");
1884         ret = ttm_bo_validate(bo, &vmw_vram_placement, true, false);
1885         return ret;
1886 }
1887
1888 static int vmw_validate_buffers(struct vmw_private *dev_priv,
1889                                 struct vmw_sw_context *sw_context)
1890 {
1891         struct vmw_validate_buffer *entry;
1892         int ret;
1893
1894         list_for_each_entry(entry, &sw_context->validate_nodes, base.head) {
1895                 ret = vmw_validate_single_buffer(dev_priv, entry->base.bo,
1896                                                  entry->validate_as_mob);
1897                 if (unlikely(ret != 0))
1898                         return ret;
1899         }
1900         return 0;
1901 }
1902
1903 static int vmw_resize_cmd_bounce(struct vmw_sw_context *sw_context,
1904                                  uint32_t size)
1905 {
1906         if (likely(sw_context->cmd_bounce_size >= size))
1907                 return 0;
1908
1909         if (sw_context->cmd_bounce_size == 0)
1910                 sw_context->cmd_bounce_size = VMWGFX_CMD_BOUNCE_INIT_SIZE;
1911
1912         while (sw_context->cmd_bounce_size < size) {
1913                 sw_context->cmd_bounce_size =
1914                         PAGE_ALIGN(sw_context->cmd_bounce_size +
1915                                    (sw_context->cmd_bounce_size >> 1));
1916         }
1917
1918         if (sw_context->cmd_bounce != NULL)
1919                 vfree(sw_context->cmd_bounce);
1920
1921         sw_context->cmd_bounce = vmalloc(sw_context->cmd_bounce_size);
1922
1923         if (sw_context->cmd_bounce == NULL) {
1924                 DRM_ERROR("Failed to allocate command bounce buffer.\n");
1925                 sw_context->cmd_bounce_size = 0;
1926                 return -ENOMEM;
1927         }
1928
1929         return 0;
1930 }
1931
1932 /**
1933  * vmw_execbuf_fence_commands - create and submit a command stream fence
1934  *
1935  * Creates a fence object and submits a command stream marker.
1936  * If this fails for some reason, We sync the fifo and return NULL.
1937  * It is then safe to fence buffers with a NULL pointer.
1938  *
1939  * If @p_handle is not NULL @file_priv must also not be NULL. Creates
1940  * a userspace handle if @p_handle is not NULL, otherwise not.
1941  */
1942
1943 int vmw_execbuf_fence_commands(struct drm_file *file_priv,
1944                                struct vmw_private *dev_priv,
1945                                struct vmw_fence_obj **p_fence,
1946                                uint32_t *p_handle)
1947 {
1948         uint32_t sequence;
1949         int ret;
1950         bool synced = false;
1951
1952         /* p_handle implies file_priv. */
1953         BUG_ON(p_handle != NULL && file_priv == NULL);
1954
1955         ret = vmw_fifo_send_fence(dev_priv, &sequence);
1956         if (unlikely(ret != 0)) {
1957                 DRM_ERROR("Fence submission error. Syncing.\n");
1958                 synced = true;
1959         }
1960
1961         if (p_handle != NULL)
1962                 ret = vmw_user_fence_create(file_priv, dev_priv->fman,
1963                                             sequence,
1964                                             DRM_VMW_FENCE_FLAG_EXEC,
1965                                             p_fence, p_handle);
1966         else
1967                 ret = vmw_fence_create(dev_priv->fman, sequence,
1968                                        DRM_VMW_FENCE_FLAG_EXEC,
1969                                        p_fence);
1970
1971         if (unlikely(ret != 0 && !synced)) {
1972                 (void) vmw_fallback_wait(dev_priv, false, false,
1973                                          sequence, false,
1974                                          VMW_FENCE_WAIT_TIMEOUT);
1975                 *p_fence = NULL;
1976         }
1977
1978         return 0;
1979 }
1980
1981 /**
1982  * vmw_execbuf_copy_fence_user - copy fence object information to
1983  * user-space.
1984  *
1985  * @dev_priv: Pointer to a vmw_private struct.
1986  * @vmw_fp: Pointer to the struct vmw_fpriv representing the calling file.
1987  * @ret: Return value from fence object creation.
1988  * @user_fence_rep: User space address of a struct drm_vmw_fence_rep to
1989  * which the information should be copied.
1990  * @fence: Pointer to the fenc object.
1991  * @fence_handle: User-space fence handle.
1992  *
1993  * This function copies fence information to user-space. If copying fails,
1994  * The user-space struct drm_vmw_fence_rep::error member is hopefully
1995  * left untouched, and if it's preloaded with an -EFAULT by user-space,
1996  * the error will hopefully be detected.
1997  * Also if copying fails, user-space will be unable to signal the fence
1998  * object so we wait for it immediately, and then unreference the
1999  * user-space reference.
2000  */
2001 void
2002 vmw_execbuf_copy_fence_user(struct vmw_private *dev_priv,
2003                             struct vmw_fpriv *vmw_fp,
2004                             int ret,
2005                             struct drm_vmw_fence_rep __user *user_fence_rep,
2006                             struct vmw_fence_obj *fence,
2007                             uint32_t fence_handle)
2008 {
2009         struct drm_vmw_fence_rep fence_rep;
2010
2011         if (user_fence_rep == NULL)
2012                 return;
2013
2014         memset(&fence_rep, 0, sizeof(fence_rep));
2015
2016         fence_rep.error = ret;
2017         if (ret == 0) {
2018                 BUG_ON(fence == NULL);
2019
2020                 fence_rep.handle = fence_handle;
2021                 fence_rep.seqno = fence->seqno;
2022                 vmw_update_seqno(dev_priv, &dev_priv->fifo);
2023                 fence_rep.passed_seqno = dev_priv->last_read_seqno;
2024         }
2025
2026         /*
2027          * copy_to_user errors will be detected by user space not
2028          * seeing fence_rep::error filled in. Typically
2029          * user-space would have pre-set that member to -EFAULT.
2030          */
2031         ret = copy_to_user(user_fence_rep, &fence_rep,
2032                            sizeof(fence_rep));
2033
2034         /*
2035          * User-space lost the fence object. We need to sync
2036          * and unreference the handle.
2037          */
2038         if (unlikely(ret != 0) && (fence_rep.error == 0)) {
2039                 ttm_ref_object_base_unref(vmw_fp->tfile,
2040                                           fence_handle, TTM_REF_USAGE);
2041                 DRM_ERROR("Fence copy error. Syncing.\n");
2042                 (void) vmw_fence_obj_wait(fence, fence->signal_mask,
2043                                           false, false,
2044                                           VMW_FENCE_WAIT_TIMEOUT);
2045         }
2046 }
2047
2048 int vmw_execbuf_process(struct drm_file *file_priv,
2049                         struct vmw_private *dev_priv,
2050                         void __user *user_commands,
2051                         void *kernel_commands,
2052                         uint32_t command_size,
2053                         uint64_t throttle_us,
2054                         struct drm_vmw_fence_rep __user *user_fence_rep,
2055                         struct vmw_fence_obj **out_fence)
2056 {
2057         struct vmw_sw_context *sw_context = &dev_priv->ctx;
2058         struct vmw_fence_obj *fence = NULL;
2059         struct vmw_resource *error_resource;
2060         struct list_head resource_list;
2061         struct ww_acquire_ctx ticket;
2062         uint32_t handle;
2063         void *cmd;
2064         int ret;
2065
2066         ret = mutex_lock_interruptible(&dev_priv->cmdbuf_mutex);
2067         if (unlikely(ret != 0))
2068                 return -ERESTARTSYS;
2069
2070         if (kernel_commands == NULL) {
2071                 sw_context->kernel = false;
2072
2073                 ret = vmw_resize_cmd_bounce(sw_context, command_size);
2074                 if (unlikely(ret != 0))
2075                         goto out_unlock;
2076
2077
2078                 ret = copy_from_user(sw_context->cmd_bounce,
2079                                      user_commands, command_size);
2080
2081                 if (unlikely(ret != 0)) {
2082                         ret = -EFAULT;
2083                         DRM_ERROR("Failed copying commands.\n");
2084                         goto out_unlock;
2085                 }
2086                 kernel_commands = sw_context->cmd_bounce;
2087         } else
2088                 sw_context->kernel = true;
2089
2090         sw_context->tfile = vmw_fpriv(file_priv)->tfile;
2091         sw_context->cur_reloc = 0;
2092         sw_context->cur_val_buf = 0;
2093         sw_context->fence_flags = 0;
2094         INIT_LIST_HEAD(&sw_context->resource_list);
2095         sw_context->cur_query_bo = dev_priv->pinned_bo;
2096         sw_context->last_query_ctx = NULL;
2097         sw_context->needs_post_query_barrier = false;
2098         memset(sw_context->res_cache, 0, sizeof(sw_context->res_cache));
2099         INIT_LIST_HEAD(&sw_context->validate_nodes);
2100         INIT_LIST_HEAD(&sw_context->res_relocations);
2101         if (!sw_context->res_ht_initialized) {
2102                 ret = drm_ht_create(&sw_context->res_ht, VMW_RES_HT_ORDER);
2103                 if (unlikely(ret != 0))
2104                         goto out_unlock;
2105                 sw_context->res_ht_initialized = true;
2106         }
2107
2108         INIT_LIST_HEAD(&resource_list);
2109         ret = vmw_cmd_check_all(dev_priv, sw_context, kernel_commands,
2110                                 command_size);
2111         if (unlikely(ret != 0))
2112                 goto out_err;
2113
2114         ret = vmw_resources_reserve(sw_context);
2115         if (unlikely(ret != 0))
2116                 goto out_err;
2117
2118         ret = ttm_eu_reserve_buffers(&ticket, &sw_context->validate_nodes);
2119         if (unlikely(ret != 0))
2120                 goto out_err;
2121
2122         ret = vmw_validate_buffers(dev_priv, sw_context);
2123         if (unlikely(ret != 0))
2124                 goto out_err;
2125
2126         ret = vmw_resources_validate(sw_context);
2127         if (unlikely(ret != 0))
2128                 goto out_err;
2129
2130         if (throttle_us) {
2131                 ret = vmw_wait_lag(dev_priv, &dev_priv->fifo.marker_queue,
2132                                    throttle_us);
2133
2134                 if (unlikely(ret != 0))
2135                         goto out_err;
2136         }
2137
2138         cmd = vmw_fifo_reserve(dev_priv, command_size);
2139         if (unlikely(cmd == NULL)) {
2140                 DRM_ERROR("Failed reserving fifo space for commands.\n");
2141                 ret = -ENOMEM;
2142                 goto out_err;
2143         }
2144
2145         vmw_apply_relocations(sw_context);
2146         memcpy(cmd, kernel_commands, command_size);
2147
2148         vmw_resource_relocations_apply(cmd, &sw_context->res_relocations);
2149         vmw_resource_relocations_free(&sw_context->res_relocations);
2150
2151         vmw_fifo_commit(dev_priv, command_size);
2152
2153         vmw_query_bo_switch_commit(dev_priv, sw_context);
2154         ret = vmw_execbuf_fence_commands(file_priv, dev_priv,
2155                                          &fence,
2156                                          (user_fence_rep) ? &handle : NULL);
2157         /*
2158          * This error is harmless, because if fence submission fails,
2159          * vmw_fifo_send_fence will sync. The error will be propagated to
2160          * user-space in @fence_rep
2161          */
2162
2163         if (ret != 0)
2164                 DRM_ERROR("Fence submission error. Syncing.\n");
2165
2166         vmw_resource_list_unreserve(&sw_context->resource_list, false);
2167         ttm_eu_fence_buffer_objects(&ticket, &sw_context->validate_nodes,
2168                                     (void *) fence);
2169
2170         if (unlikely(dev_priv->pinned_bo != NULL &&
2171                      !dev_priv->query_cid_valid))
2172                 __vmw_execbuf_release_pinned_bo(dev_priv, fence);
2173
2174         vmw_clear_validations(sw_context);
2175         vmw_execbuf_copy_fence_user(dev_priv, vmw_fpriv(file_priv), ret,
2176                                     user_fence_rep, fence, handle);
2177
2178         /* Don't unreference when handing fence out */
2179         if (unlikely(out_fence != NULL)) {
2180                 *out_fence = fence;
2181                 fence = NULL;
2182         } else if (likely(fence != NULL)) {
2183                 vmw_fence_obj_unreference(&fence);
2184         }
2185
2186         list_splice_init(&sw_context->resource_list, &resource_list);
2187         mutex_unlock(&dev_priv->cmdbuf_mutex);
2188
2189         /*
2190          * Unreference resources outside of the cmdbuf_mutex to
2191          * avoid deadlocks in resource destruction paths.
2192          */
2193         vmw_resource_list_unreference(&resource_list);
2194
2195         return 0;
2196
2197 out_err:
2198         vmw_resource_relocations_free(&sw_context->res_relocations);
2199         vmw_free_relocations(sw_context);
2200         ttm_eu_backoff_reservation(&ticket, &sw_context->validate_nodes);
2201         vmw_resource_list_unreserve(&sw_context->resource_list, true);
2202         vmw_clear_validations(sw_context);
2203         if (unlikely(dev_priv->pinned_bo != NULL &&
2204                      !dev_priv->query_cid_valid))
2205                 __vmw_execbuf_release_pinned_bo(dev_priv, NULL);
2206 out_unlock:
2207         list_splice_init(&sw_context->resource_list, &resource_list);
2208         error_resource = sw_context->error_resource;
2209         sw_context->error_resource = NULL;
2210         mutex_unlock(&dev_priv->cmdbuf_mutex);
2211
2212         /*
2213          * Unreference resources outside of the cmdbuf_mutex to
2214          * avoid deadlocks in resource destruction paths.
2215          */
2216         vmw_resource_list_unreference(&resource_list);
2217         if (unlikely(error_resource != NULL))
2218                 vmw_resource_unreference(&error_resource);
2219
2220         return ret;
2221 }
2222
2223 /**
2224  * vmw_execbuf_unpin_panic - Idle the fifo and unpin the query buffer.
2225  *
2226  * @dev_priv: The device private structure.
2227  *
2228  * This function is called to idle the fifo and unpin the query buffer
2229  * if the normal way to do this hits an error, which should typically be
2230  * extremely rare.
2231  */
2232 static void vmw_execbuf_unpin_panic(struct vmw_private *dev_priv)
2233 {
2234         DRM_ERROR("Can't unpin query buffer. Trying to recover.\n");
2235
2236         (void) vmw_fallback_wait(dev_priv, false, true, 0, false, 10*HZ);
2237         vmw_bo_pin(dev_priv->pinned_bo, false);
2238         vmw_bo_pin(dev_priv->dummy_query_bo, false);
2239         dev_priv->dummy_query_bo_pinned = false;
2240 }
2241
2242
2243 /**
2244  * __vmw_execbuf_release_pinned_bo - Flush queries and unpin the pinned
2245  * query bo.
2246  *
2247  * @dev_priv: The device private structure.
2248  * @fence: If non-NULL should point to a struct vmw_fence_obj issued
2249  * _after_ a query barrier that flushes all queries touching the current
2250  * buffer pointed to by @dev_priv->pinned_bo
2251  *
2252  * This function should be used to unpin the pinned query bo, or
2253  * as a query barrier when we need to make sure that all queries have
2254  * finished before the next fifo command. (For example on hardware
2255  * context destructions where the hardware may otherwise leak unfinished
2256  * queries).
2257  *
2258  * This function does not return any failure codes, but make attempts
2259  * to do safe unpinning in case of errors.
2260  *
2261  * The function will synchronize on the previous query barrier, and will
2262  * thus not finish until that barrier has executed.
2263  *
2264  * the @dev_priv->cmdbuf_mutex needs to be held by the current thread
2265  * before calling this function.
2266  */
2267 void __vmw_execbuf_release_pinned_bo(struct vmw_private *dev_priv,
2268                                      struct vmw_fence_obj *fence)
2269 {
2270         int ret = 0;
2271         struct list_head validate_list;
2272         struct ttm_validate_buffer pinned_val, query_val;
2273         struct vmw_fence_obj *lfence = NULL;
2274         struct ww_acquire_ctx ticket;
2275
2276         if (dev_priv->pinned_bo == NULL)
2277                 goto out_unlock;
2278
2279         INIT_LIST_HEAD(&validate_list);
2280
2281         pinned_val.bo = ttm_bo_reference(dev_priv->pinned_bo);
2282         list_add_tail(&pinned_val.head, &validate_list);
2283
2284         query_val.bo = ttm_bo_reference(dev_priv->dummy_query_bo);
2285         list_add_tail(&query_val.head, &validate_list);
2286
2287         do {
2288                 ret = ttm_eu_reserve_buffers(&ticket, &validate_list);
2289         } while (ret == -ERESTARTSYS);
2290
2291         if (unlikely(ret != 0)) {
2292                 vmw_execbuf_unpin_panic(dev_priv);
2293                 goto out_no_reserve;
2294         }
2295
2296         if (dev_priv->query_cid_valid) {
2297                 BUG_ON(fence != NULL);
2298                 ret = vmw_fifo_emit_dummy_query(dev_priv, dev_priv->query_cid);
2299                 if (unlikely(ret != 0)) {
2300                         vmw_execbuf_unpin_panic(dev_priv);
2301                         goto out_no_emit;
2302                 }
2303                 dev_priv->query_cid_valid = false;
2304         }
2305
2306         vmw_bo_pin(dev_priv->pinned_bo, false);
2307         vmw_bo_pin(dev_priv->dummy_query_bo, false);
2308         dev_priv->dummy_query_bo_pinned = false;
2309
2310         if (fence == NULL) {
2311                 (void) vmw_execbuf_fence_commands(NULL, dev_priv, &lfence,
2312                                                   NULL);
2313                 fence = lfence;
2314         }
2315         ttm_eu_fence_buffer_objects(&ticket, &validate_list, (void *) fence);
2316         if (lfence != NULL)
2317                 vmw_fence_obj_unreference(&lfence);
2318
2319         ttm_bo_unref(&query_val.bo);
2320         ttm_bo_unref(&pinned_val.bo);
2321         ttm_bo_unref(&dev_priv->pinned_bo);
2322
2323 out_unlock:
2324         return;
2325
2326 out_no_emit:
2327         ttm_eu_backoff_reservation(&ticket, &validate_list);
2328 out_no_reserve:
2329         ttm_bo_unref(&query_val.bo);
2330         ttm_bo_unref(&pinned_val.bo);
2331         ttm_bo_unref(&dev_priv->pinned_bo);
2332 }
2333
2334 /**
2335  * vmw_execbuf_release_pinned_bo - Flush queries and unpin the pinned
2336  * query bo.
2337  *
2338  * @dev_priv: The device private structure.
2339  *
2340  * This function should be used to unpin the pinned query bo, or
2341  * as a query barrier when we need to make sure that all queries have
2342  * finished before the next fifo command. (For example on hardware
2343  * context destructions where the hardware may otherwise leak unfinished
2344  * queries).
2345  *
2346  * This function does not return any failure codes, but make attempts
2347  * to do safe unpinning in case of errors.
2348  *
2349  * The function will synchronize on the previous query barrier, and will
2350  * thus not finish until that barrier has executed.
2351  */
2352 void vmw_execbuf_release_pinned_bo(struct vmw_private *dev_priv)
2353 {
2354         mutex_lock(&dev_priv->cmdbuf_mutex);
2355         if (dev_priv->query_cid_valid)
2356                 __vmw_execbuf_release_pinned_bo(dev_priv, NULL);
2357         mutex_unlock(&dev_priv->cmdbuf_mutex);
2358 }
2359
2360
2361 int vmw_execbuf_ioctl(struct drm_device *dev, void *data,
2362                       struct drm_file *file_priv)
2363 {
2364         struct vmw_private *dev_priv = vmw_priv(dev);
2365         struct drm_vmw_execbuf_arg *arg = (struct drm_vmw_execbuf_arg *)data;
2366         struct vmw_master *vmaster = vmw_master(file_priv->master);
2367         int ret;
2368
2369         /*
2370          * This will allow us to extend the ioctl argument while
2371          * maintaining backwards compatibility:
2372          * We take different code paths depending on the value of
2373          * arg->version.
2374          */
2375
2376         if (unlikely(arg->version != DRM_VMW_EXECBUF_VERSION)) {
2377                 DRM_ERROR("Incorrect execbuf version.\n");
2378                 DRM_ERROR("You're running outdated experimental "
2379                           "vmwgfx user-space drivers.");
2380                 return -EINVAL;
2381         }
2382
2383         ret = ttm_read_lock(&vmaster->lock, true);
2384         if (unlikely(ret != 0))
2385                 return ret;
2386
2387         ret = vmw_execbuf_process(file_priv, dev_priv,
2388                                   (void __user *)(unsigned long)arg->commands,
2389                                   NULL, arg->command_size, arg->throttle_us,
2390                                   (void __user *)(unsigned long)arg->fence_rep,
2391                                   NULL);
2392
2393         if (unlikely(ret != 0))
2394                 goto out_unlock;
2395
2396         vmw_kms_cursor_post_execbuf(dev_priv);
2397
2398 out_unlock:
2399         ttm_read_unlock(&vmaster->lock);
2400         return ret;
2401 }