1 /**************************************************************************
3 * Copyright © 2009-2012 VMware, Inc., Palo Alto, CA., USA
6 * Permission is hereby granted, free of charge, to any person obtaining a
7 * copy of this software and associated documentation files (the
8 * "Software"), to deal in the Software without restriction, including
9 * without limitation the rights to use, copy, modify, merge, publish,
10 * distribute, sub license, and/or sell copies of the Software, and to
11 * permit persons to whom the Software is furnished to do so, subject to
12 * the following conditions:
14 * The above copyright notice and this permission notice (including the
15 * next paragraph) shall be included in all copies or substantial portions
18 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
19 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
20 * FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. IN NO EVENT SHALL
21 * THE COPYRIGHT HOLDERS, AUTHORS AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM,
22 * DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
23 * OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
24 * USE OR OTHER DEALINGS IN THE SOFTWARE.
26 **************************************************************************/
28 #include "vmwgfx_drv.h"
29 #include "vmwgfx_resource_priv.h"
30 #include <ttm/ttm_placement.h>
31 #include "svga3d_surfacedefs.h"
34 * struct vmw_user_surface - User-space visible surface resource
36 * @base: The TTM base object handling user-space visibility.
37 * @srf: The surface metadata.
38 * @size: TTM accounting size for the surface.
40 struct vmw_user_surface {
41 struct ttm_base_object base;
42 struct vmw_surface srf;
44 uint32_t backup_handle;
48 * struct vmw_surface_offset - Backing store mip level offset info
50 * @face: Surface face.
52 * @bo_offset: Offset into backing store of this mip level.
55 struct vmw_surface_offset {
61 static void vmw_user_surface_free(struct vmw_resource *res);
62 static struct vmw_resource *
63 vmw_user_surface_base_to_res(struct ttm_base_object *base);
64 static int vmw_legacy_srf_bind(struct vmw_resource *res,
65 struct ttm_validate_buffer *val_buf);
66 static int vmw_legacy_srf_unbind(struct vmw_resource *res,
68 struct ttm_validate_buffer *val_buf);
69 static int vmw_legacy_srf_create(struct vmw_resource *res);
70 static int vmw_legacy_srf_destroy(struct vmw_resource *res);
72 static const struct vmw_user_resource_conv user_surface_conv = {
73 .object_type = VMW_RES_SURFACE,
74 .base_obj_to_res = vmw_user_surface_base_to_res,
75 .res_free = vmw_user_surface_free
78 const struct vmw_user_resource_conv *user_surface_converter =
82 static uint64_t vmw_user_surface_size;
84 static const struct vmw_res_func vmw_legacy_surface_func = {
85 .res_type = vmw_res_surface,
86 .needs_backup = false,
88 .type_name = "legacy surfaces",
89 .backup_placement = &vmw_srf_placement,
90 .create = &vmw_legacy_srf_create,
91 .destroy = &vmw_legacy_srf_destroy,
92 .bind = &vmw_legacy_srf_bind,
93 .unbind = &vmw_legacy_srf_unbind
97 * struct vmw_surface_dma - SVGA3D DMA command
99 struct vmw_surface_dma {
100 SVGA3dCmdHeader header;
101 SVGA3dCmdSurfaceDMA body;
103 SVGA3dCmdSurfaceDMASuffix suffix;
107 * struct vmw_surface_define - SVGA3D Surface Define command
109 struct vmw_surface_define {
110 SVGA3dCmdHeader header;
111 SVGA3dCmdDefineSurface body;
115 * struct vmw_surface_destroy - SVGA3D Surface Destroy command
117 struct vmw_surface_destroy {
118 SVGA3dCmdHeader header;
119 SVGA3dCmdDestroySurface body;
124 * vmw_surface_dma_size - Compute fifo size for a dma command.
126 * @srf: Pointer to a struct vmw_surface
128 * Computes the required size for a surface dma command for backup or
129 * restoration of the surface represented by @srf.
131 static inline uint32_t vmw_surface_dma_size(const struct vmw_surface *srf)
133 return srf->num_sizes * sizeof(struct vmw_surface_dma);
138 * vmw_surface_define_size - Compute fifo size for a surface define command.
140 * @srf: Pointer to a struct vmw_surface
142 * Computes the required size for a surface define command for the definition
143 * of the surface represented by @srf.
145 static inline uint32_t vmw_surface_define_size(const struct vmw_surface *srf)
147 return sizeof(struct vmw_surface_define) + srf->num_sizes *
153 * vmw_surface_destroy_size - Compute fifo size for a surface destroy command.
155 * Computes the required size for a surface destroy command for the destruction
158 static inline uint32_t vmw_surface_destroy_size(void)
160 return sizeof(struct vmw_surface_destroy);
164 * vmw_surface_destroy_encode - Encode a surface_destroy command.
166 * @id: The surface id
167 * @cmd_space: Pointer to memory area in which the commands should be encoded.
169 static void vmw_surface_destroy_encode(uint32_t id,
172 struct vmw_surface_destroy *cmd = (struct vmw_surface_destroy *)
175 cmd->header.id = SVGA_3D_CMD_SURFACE_DESTROY;
176 cmd->header.size = sizeof(cmd->body);
181 * vmw_surface_define_encode - Encode a surface_define command.
183 * @srf: Pointer to a struct vmw_surface object.
184 * @cmd_space: Pointer to memory area in which the commands should be encoded.
186 static void vmw_surface_define_encode(const struct vmw_surface *srf,
189 struct vmw_surface_define *cmd = (struct vmw_surface_define *)
191 struct drm_vmw_size *src_size;
192 SVGA3dSize *cmd_size;
196 cmd_len = sizeof(cmd->body) + srf->num_sizes * sizeof(SVGA3dSize);
198 cmd->header.id = SVGA_3D_CMD_SURFACE_DEFINE;
199 cmd->header.size = cmd_len;
200 cmd->body.sid = srf->res.id;
201 cmd->body.surfaceFlags = srf->flags;
202 cmd->body.format = cpu_to_le32(srf->format);
203 for (i = 0; i < DRM_VMW_MAX_SURFACE_FACES; ++i)
204 cmd->body.face[i].numMipLevels = srf->mip_levels[i];
207 cmd_size = (SVGA3dSize *) cmd;
208 src_size = srf->sizes;
210 for (i = 0; i < srf->num_sizes; ++i, cmd_size++, src_size++) {
211 cmd_size->width = src_size->width;
212 cmd_size->height = src_size->height;
213 cmd_size->depth = src_size->depth;
218 * vmw_surface_dma_encode - Encode a surface_dma command.
220 * @srf: Pointer to a struct vmw_surface object.
221 * @cmd_space: Pointer to memory area in which the commands should be encoded.
222 * @ptr: Pointer to an SVGAGuestPtr indicating where the surface contents
223 * should be placed or read from.
224 * @to_surface: Boolean whether to DMA to the surface or from the surface.
226 static void vmw_surface_dma_encode(struct vmw_surface *srf,
228 const SVGAGuestPtr *ptr,
232 struct vmw_surface_dma *cmd = (struct vmw_surface_dma *)cmd_space;
233 const struct svga3d_surface_desc *desc =
234 svga3dsurface_get_desc(srf->format);
236 for (i = 0; i < srf->num_sizes; ++i) {
237 SVGA3dCmdHeader *header = &cmd->header;
238 SVGA3dCmdSurfaceDMA *body = &cmd->body;
239 SVGA3dCopyBox *cb = &cmd->cb;
240 SVGA3dCmdSurfaceDMASuffix *suffix = &cmd->suffix;
241 const struct vmw_surface_offset *cur_offset = &srf->offsets[i];
242 const struct drm_vmw_size *cur_size = &srf->sizes[i];
244 header->id = SVGA_3D_CMD_SURFACE_DMA;
245 header->size = sizeof(*body) + sizeof(*cb) + sizeof(*suffix);
247 body->guest.ptr = *ptr;
248 body->guest.ptr.offset += cur_offset->bo_offset;
249 body->guest.pitch = svga3dsurface_calculate_pitch(desc,
251 body->host.sid = srf->res.id;
252 body->host.face = cur_offset->face;
253 body->host.mipmap = cur_offset->mip;
254 body->transfer = ((to_surface) ? SVGA3D_WRITE_HOST_VRAM :
255 SVGA3D_READ_HOST_VRAM);
262 cb->w = cur_size->width;
263 cb->h = cur_size->height;
264 cb->d = cur_size->depth;
266 suffix->suffixSize = sizeof(*suffix);
267 suffix->maximumOffset =
268 svga3dsurface_get_image_buffer_size(desc, cur_size,
270 suffix->flags.discard = 0;
271 suffix->flags.unsynchronized = 0;
272 suffix->flags.reserved = 0;
279 * vmw_hw_surface_destroy - destroy a Device surface
281 * @res: Pointer to a struct vmw_resource embedded in a struct
284 * Destroys a the device surface associated with a struct vmw_surface if
285 * any, and adjusts accounting and resource count accordingly.
287 static void vmw_hw_surface_destroy(struct vmw_resource *res)
290 struct vmw_private *dev_priv = res->dev_priv;
291 struct vmw_surface *srf;
296 cmd = vmw_fifo_reserve(dev_priv, vmw_surface_destroy_size());
297 if (unlikely(cmd == NULL)) {
298 DRM_ERROR("Failed reserving FIFO space for surface "
303 vmw_surface_destroy_encode(res->id, cmd);
304 vmw_fifo_commit(dev_priv, vmw_surface_destroy_size());
307 * used_memory_size_atomic, or separate lock
308 * to avoid taking dev_priv::cmdbuf_mutex in
312 mutex_lock(&dev_priv->cmdbuf_mutex);
313 srf = vmw_res_to_srf(res);
314 dev_priv->used_memory_size -= res->backup_size;
315 mutex_unlock(&dev_priv->cmdbuf_mutex);
317 vmw_3d_resource_dec(dev_priv, false);
321 * vmw_legacy_srf_create - Create a device surface as part of the
322 * resource validation process.
324 * @res: Pointer to a struct vmw_surface.
326 * If the surface doesn't have a hw id.
328 * Returns -EBUSY if there wasn't sufficient device resources to
329 * complete the validation. Retry after freeing up resources.
331 * May return other errors if the kernel is out of guest resources.
333 static int vmw_legacy_srf_create(struct vmw_resource *res)
335 struct vmw_private *dev_priv = res->dev_priv;
336 struct vmw_surface *srf;
337 uint32_t submit_size;
341 if (likely(res->id != -1))
344 srf = vmw_res_to_srf(res);
345 if (unlikely(dev_priv->used_memory_size + res->backup_size >=
346 dev_priv->memory_size))
350 * Alloc id for the resource.
353 ret = vmw_resource_alloc_id(res);
354 if (unlikely(ret != 0)) {
355 DRM_ERROR("Failed to allocate a surface id.\n");
359 if (unlikely(res->id >= SVGA3D_MAX_SURFACE_IDS)) {
365 * Encode surface define- commands.
368 submit_size = vmw_surface_define_size(srf);
369 cmd = vmw_fifo_reserve(dev_priv, submit_size);
370 if (unlikely(cmd == NULL)) {
371 DRM_ERROR("Failed reserving FIFO space for surface "
377 vmw_surface_define_encode(srf, cmd);
378 vmw_fifo_commit(dev_priv, submit_size);
380 * Surface memory usage accounting.
383 dev_priv->used_memory_size += res->backup_size;
387 vmw_resource_release_id(res);
393 * vmw_legacy_srf_dma - Copy backup data to or from a legacy surface.
395 * @res: Pointer to a struct vmw_res embedded in a struct
397 * @val_buf: Pointer to a struct ttm_validate_buffer containing
398 * information about the backup buffer.
399 * @bind: Boolean wether to DMA to the surface.
401 * Transfer backup data to or from a legacy surface as part of the
402 * validation process.
403 * May return other errors if the kernel is out of guest resources.
404 * The backup buffer will be fenced or idle upon successful completion,
405 * and if the surface needs persistent backup storage, the backup buffer
406 * will also be returned reserved iff @bind is true.
408 static int vmw_legacy_srf_dma(struct vmw_resource *res,
409 struct ttm_validate_buffer *val_buf,
413 struct vmw_fence_obj *fence;
414 uint32_t submit_size;
415 struct vmw_surface *srf = vmw_res_to_srf(res);
417 struct vmw_private *dev_priv = res->dev_priv;
419 BUG_ON(val_buf->bo == NULL);
421 submit_size = vmw_surface_dma_size(srf);
422 cmd = vmw_fifo_reserve(dev_priv, submit_size);
423 if (unlikely(cmd == NULL)) {
424 DRM_ERROR("Failed reserving FIFO space for surface "
428 vmw_bo_get_guest_ptr(val_buf->bo, &ptr);
429 vmw_surface_dma_encode(srf, cmd, &ptr, bind);
431 vmw_fifo_commit(dev_priv, submit_size);
434 * Create a fence object and fence the backup buffer.
437 (void) vmw_execbuf_fence_commands(NULL, dev_priv,
440 vmw_fence_single_bo(val_buf->bo, fence);
442 if (likely(fence != NULL))
443 vmw_fence_obj_unreference(&fence);
449 * vmw_legacy_srf_bind - Perform a legacy surface bind as part of the
450 * surface validation process.
452 * @res: Pointer to a struct vmw_res embedded in a struct
454 * @val_buf: Pointer to a struct ttm_validate_buffer containing
455 * information about the backup buffer.
457 * This function will copy backup data to the surface if the
458 * backup buffer is dirty.
460 static int vmw_legacy_srf_bind(struct vmw_resource *res,
461 struct ttm_validate_buffer *val_buf)
463 if (!res->backup_dirty)
466 return vmw_legacy_srf_dma(res, val_buf, true);
471 * vmw_legacy_srf_unbind - Perform a legacy surface unbind as part of the
472 * surface eviction process.
474 * @res: Pointer to a struct vmw_res embedded in a struct
476 * @val_buf: Pointer to a struct ttm_validate_buffer containing
477 * information about the backup buffer.
479 * This function will copy backup data from the surface.
481 static int vmw_legacy_srf_unbind(struct vmw_resource *res,
483 struct ttm_validate_buffer *val_buf)
485 if (unlikely(readback))
486 return vmw_legacy_srf_dma(res, val_buf, false);
491 * vmw_legacy_srf_destroy - Destroy a device surface as part of a
492 * resource eviction process.
494 * @res: Pointer to a struct vmw_res embedded in a struct
497 static int vmw_legacy_srf_destroy(struct vmw_resource *res)
499 struct vmw_private *dev_priv = res->dev_priv;
500 uint32_t submit_size;
503 BUG_ON(res->id == -1);
506 * Encode the dma- and surface destroy commands.
509 submit_size = vmw_surface_destroy_size();
510 cmd = vmw_fifo_reserve(dev_priv, submit_size);
511 if (unlikely(cmd == NULL)) {
512 DRM_ERROR("Failed reserving FIFO space for surface "
517 vmw_surface_destroy_encode(res->id, cmd);
518 vmw_fifo_commit(dev_priv, submit_size);
521 * Surface memory usage accounting.
524 dev_priv->used_memory_size -= res->backup_size;
527 * Release the surface ID.
530 vmw_resource_release_id(res);
537 * vmw_surface_init - initialize a struct vmw_surface
539 * @dev_priv: Pointer to a device private struct.
540 * @srf: Pointer to the struct vmw_surface to initialize.
541 * @res_free: Pointer to a resource destructor used to free
544 static int vmw_surface_init(struct vmw_private *dev_priv,
545 struct vmw_surface *srf,
546 void (*res_free) (struct vmw_resource *res))
549 struct vmw_resource *res = &srf->res;
551 BUG_ON(res_free == NULL);
552 (void) vmw_3d_resource_inc(dev_priv, false);
553 ret = vmw_resource_init(dev_priv, res, true, res_free,
554 &vmw_legacy_surface_func);
556 if (unlikely(ret != 0)) {
557 vmw_3d_resource_dec(dev_priv, false);
563 * The surface won't be visible to hardware until a
567 vmw_resource_activate(res, vmw_hw_surface_destroy);
572 * vmw_user_surface_base_to_res - TTM base object to resource converter for
573 * user visible surfaces
575 * @base: Pointer to a TTM base object
577 * Returns the struct vmw_resource embedded in a struct vmw_surface
578 * for the user-visible object identified by the TTM base object @base.
580 static struct vmw_resource *
581 vmw_user_surface_base_to_res(struct ttm_base_object *base)
583 return &(container_of(base, struct vmw_user_surface, base)->srf.res);
587 * vmw_user_surface_free - User visible surface resource destructor
589 * @res: A struct vmw_resource embedded in a struct vmw_surface.
591 static void vmw_user_surface_free(struct vmw_resource *res)
593 struct vmw_surface *srf = vmw_res_to_srf(res);
594 struct vmw_user_surface *user_srf =
595 container_of(srf, struct vmw_user_surface, srf);
596 struct vmw_private *dev_priv = srf->res.dev_priv;
597 uint32_t size = user_srf->size;
601 kfree(srf->snooper.image);
602 ttm_base_object_kfree(user_srf, base);
603 ttm_mem_global_free(vmw_mem_glob(dev_priv), size);
607 * vmw_user_surface_free - User visible surface TTM base object destructor
609 * @p_base: Pointer to a pointer to a TTM base object
610 * embedded in a struct vmw_user_surface.
612 * Drops the base object's reference on its resource, and the
613 * pointer pointed to by *p_base is set to NULL.
615 static void vmw_user_surface_base_release(struct ttm_base_object **p_base)
617 struct ttm_base_object *base = *p_base;
618 struct vmw_user_surface *user_srf =
619 container_of(base, struct vmw_user_surface, base);
620 struct vmw_resource *res = &user_srf->srf.res;
623 vmw_resource_unreference(&res);
627 * vmw_user_surface_destroy_ioctl - Ioctl function implementing
628 * the user surface destroy functionality.
630 * @dev: Pointer to a struct drm_device.
631 * @data: Pointer to data copied from / to user-space.
632 * @file_priv: Pointer to a drm file private structure.
634 int vmw_surface_destroy_ioctl(struct drm_device *dev, void *data,
635 struct drm_file *file_priv)
637 struct drm_vmw_surface_arg *arg = (struct drm_vmw_surface_arg *)data;
638 struct ttm_object_file *tfile = vmw_fpriv(file_priv)->tfile;
640 return ttm_ref_object_base_unref(tfile, arg->sid, TTM_REF_USAGE);
644 * vmw_user_surface_define_ioctl - Ioctl function implementing
645 * the user surface define functionality.
647 * @dev: Pointer to a struct drm_device.
648 * @data: Pointer to data copied from / to user-space.
649 * @file_priv: Pointer to a drm file private structure.
651 int vmw_surface_define_ioctl(struct drm_device *dev, void *data,
652 struct drm_file *file_priv)
654 struct vmw_private *dev_priv = vmw_priv(dev);
655 struct vmw_user_surface *user_srf;
656 struct vmw_surface *srf;
657 struct vmw_resource *res;
658 struct vmw_resource *tmp;
659 union drm_vmw_surface_create_arg *arg =
660 (union drm_vmw_surface_create_arg *)data;
661 struct drm_vmw_surface_create_req *req = &arg->req;
662 struct drm_vmw_surface_arg *rep = &arg->rep;
663 struct ttm_object_file *tfile = vmw_fpriv(file_priv)->tfile;
664 struct drm_vmw_size __user *user_sizes;
667 uint32_t cur_bo_offset;
668 struct drm_vmw_size *cur_size;
669 struct vmw_surface_offset *cur_offset;
672 struct vmw_master *vmaster = vmw_master(file_priv->master);
673 const struct svga3d_surface_desc *desc;
675 if (unlikely(vmw_user_surface_size == 0))
676 vmw_user_surface_size = ttm_round_pot(sizeof(*user_srf)) +
680 for (i = 0; i < DRM_VMW_MAX_SURFACE_FACES; ++i)
681 num_sizes += req->mip_levels[i];
683 if (num_sizes > DRM_VMW_MAX_SURFACE_FACES *
684 DRM_VMW_MAX_MIP_LEVELS)
687 size = vmw_user_surface_size + 128 +
688 ttm_round_pot(num_sizes * sizeof(struct drm_vmw_size)) +
689 ttm_round_pot(num_sizes * sizeof(struct vmw_surface_offset));
692 desc = svga3dsurface_get_desc(req->format);
693 if (unlikely(desc->block_desc == SVGA3DBLOCKDESC_NONE)) {
694 DRM_ERROR("Invalid surface format for surface creation.\n");
698 ret = ttm_read_lock(&vmaster->lock, true);
699 if (unlikely(ret != 0))
702 ret = ttm_mem_global_alloc(vmw_mem_glob(dev_priv),
704 if (unlikely(ret != 0)) {
705 if (ret != -ERESTARTSYS)
706 DRM_ERROR("Out of graphics memory for surface"
711 user_srf = kzalloc(sizeof(*user_srf), GFP_KERNEL);
712 if (unlikely(user_srf == NULL)) {
714 goto out_no_user_srf;
717 srf = &user_srf->srf;
720 srf->flags = req->flags;
721 srf->format = req->format;
722 srf->scanout = req->scanout;
724 memcpy(srf->mip_levels, req->mip_levels, sizeof(srf->mip_levels));
725 srf->num_sizes = num_sizes;
726 user_srf->size = size;
728 srf->sizes = kmalloc(srf->num_sizes * sizeof(*srf->sizes), GFP_KERNEL);
729 if (unlikely(srf->sizes == NULL)) {
733 srf->offsets = kmalloc(srf->num_sizes * sizeof(*srf->offsets),
735 if (unlikely(srf->sizes == NULL)) {
740 user_sizes = (struct drm_vmw_size __user *)(unsigned long)
743 ret = copy_from_user(srf->sizes, user_sizes,
744 srf->num_sizes * sizeof(*srf->sizes));
745 if (unlikely(ret != 0)) {
750 srf->base_size = *srf->sizes;
751 srf->autogen_filter = SVGA3D_TEX_FILTER_NONE;
752 srf->multisample_count = 1;
755 cur_offset = srf->offsets;
756 cur_size = srf->sizes;
758 for (i = 0; i < DRM_VMW_MAX_SURFACE_FACES; ++i) {
759 for (j = 0; j < srf->mip_levels[i]; ++j) {
760 uint32_t stride = svga3dsurface_calculate_pitch
763 cur_offset->face = i;
765 cur_offset->bo_offset = cur_bo_offset;
766 cur_bo_offset += svga3dsurface_get_image_buffer_size
767 (desc, cur_size, stride);
772 res->backup_size = cur_bo_offset;
774 srf->num_sizes == 1 &&
775 srf->sizes[0].width == 64 &&
776 srf->sizes[0].height == 64 &&
777 srf->format == SVGA3D_A8R8G8B8) {
779 srf->snooper.image = kmalloc(64 * 64 * 4, GFP_KERNEL);
780 /* clear the image */
781 if (srf->snooper.image) {
782 memset(srf->snooper.image, 0x00, 64 * 64 * 4);
784 DRM_ERROR("Failed to allocate cursor_image\n");
789 srf->snooper.image = NULL;
791 srf->snooper.crtc = NULL;
793 user_srf->base.shareable = false;
794 user_srf->base.tfile = NULL;
797 * From this point, the generic resource management functions
798 * destroy the object on failure.
801 ret = vmw_surface_init(dev_priv, srf, vmw_user_surface_free);
802 if (unlikely(ret != 0))
805 tmp = vmw_resource_reference(&srf->res);
806 ret = ttm_base_object_init(tfile, &user_srf->base,
807 req->shareable, VMW_RES_SURFACE,
808 &vmw_user_surface_base_release, NULL);
810 if (unlikely(ret != 0)) {
811 vmw_resource_unreference(&tmp);
812 vmw_resource_unreference(&res);
816 rep->sid = user_srf->base.hash.key;
817 vmw_resource_unreference(&res);
819 ttm_read_unlock(&vmaster->lock);
826 ttm_base_object_kfree(user_srf, base);
828 ttm_mem_global_free(vmw_mem_glob(dev_priv), size);
830 ttm_read_unlock(&vmaster->lock);
835 * vmw_user_surface_define_ioctl - Ioctl function implementing
836 * the user surface reference functionality.
838 * @dev: Pointer to a struct drm_device.
839 * @data: Pointer to data copied from / to user-space.
840 * @file_priv: Pointer to a drm file private structure.
842 int vmw_surface_reference_ioctl(struct drm_device *dev, void *data,
843 struct drm_file *file_priv)
845 union drm_vmw_surface_reference_arg *arg =
846 (union drm_vmw_surface_reference_arg *)data;
847 struct drm_vmw_surface_arg *req = &arg->req;
848 struct drm_vmw_surface_create_req *rep = &arg->rep;
849 struct ttm_object_file *tfile = vmw_fpriv(file_priv)->tfile;
850 struct vmw_surface *srf;
851 struct vmw_user_surface *user_srf;
852 struct drm_vmw_size __user *user_sizes;
853 struct ttm_base_object *base;
856 base = ttm_base_object_lookup(tfile, req->sid);
857 if (unlikely(base == NULL)) {
858 DRM_ERROR("Could not find surface to reference.\n");
862 if (unlikely(base->object_type != VMW_RES_SURFACE))
863 goto out_bad_resource;
865 user_srf = container_of(base, struct vmw_user_surface, base);
866 srf = &user_srf->srf;
868 ret = ttm_ref_object_add(tfile, &user_srf->base, TTM_REF_USAGE, NULL);
869 if (unlikely(ret != 0)) {
870 DRM_ERROR("Could not add a reference to a surface.\n");
871 goto out_no_reference;
874 rep->flags = srf->flags;
875 rep->format = srf->format;
876 memcpy(rep->mip_levels, srf->mip_levels, sizeof(srf->mip_levels));
877 user_sizes = (struct drm_vmw_size __user *)(unsigned long)
881 ret = copy_to_user(user_sizes, srf->sizes,
882 srf->num_sizes * sizeof(*srf->sizes));
883 if (unlikely(ret != 0)) {
884 DRM_ERROR("copy_to_user failed %p %u\n",
885 user_sizes, srf->num_sizes);
890 ttm_base_object_unref(&base);