Merge branch 'fixes-hwmod-regression' of git://git.kernel.org/pub/scm/linux/kernel...
[linux-2.6.git] / drivers / gpu / drm / vmwgfx / vmwgfx_resource.c
1 /**************************************************************************
2  *
3  * Copyright © 2009 VMware, Inc., Palo Alto, CA., USA
4  * All Rights Reserved.
5  *
6  * Permission is hereby granted, free of charge, to any person obtaining a
7  * copy of this software and associated documentation files (the
8  * "Software"), to deal in the Software without restriction, including
9  * without limitation the rights to use, copy, modify, merge, publish,
10  * distribute, sub license, and/or sell copies of the Software, and to
11  * permit persons to whom the Software is furnished to do so, subject to
12  * the following conditions:
13  *
14  * The above copyright notice and this permission notice (including the
15  * next paragraph) shall be included in all copies or substantial portions
16  * of the Software.
17  *
18  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
19  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
20  * FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. IN NO EVENT SHALL
21  * THE COPYRIGHT HOLDERS, AUTHORS AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM,
22  * DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
23  * OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
24  * USE OR OTHER DEALINGS IN THE SOFTWARE.
25  *
26  **************************************************************************/
27
28 #include "vmwgfx_drv.h"
29 #include "vmwgfx_drm.h"
30 #include "ttm/ttm_object.h"
31 #include "ttm/ttm_placement.h"
32 #include "drmP.h"
33
34 struct vmw_user_context {
35         struct ttm_base_object base;
36         struct vmw_resource res;
37 };
38
39 struct vmw_user_surface {
40         struct ttm_base_object base;
41         struct vmw_surface srf;
42         uint32_t size;
43 };
44
45 struct vmw_user_dma_buffer {
46         struct ttm_base_object base;
47         struct vmw_dma_buffer dma;
48 };
49
50 struct vmw_bo_user_rep {
51         uint32_t handle;
52         uint64_t map_handle;
53 };
54
55 struct vmw_stream {
56         struct vmw_resource res;
57         uint32_t stream_id;
58 };
59
60 struct vmw_user_stream {
61         struct ttm_base_object base;
62         struct vmw_stream stream;
63 };
64
65 struct vmw_surface_offset {
66         uint32_t face;
67         uint32_t mip;
68         uint32_t bo_offset;
69 };
70
71
72 static uint64_t vmw_user_context_size;
73 static uint64_t vmw_user_surface_size;
74 static uint64_t vmw_user_stream_size;
75
76 static inline struct vmw_dma_buffer *
77 vmw_dma_buffer(struct ttm_buffer_object *bo)
78 {
79         return container_of(bo, struct vmw_dma_buffer, base);
80 }
81
82 static inline struct vmw_user_dma_buffer *
83 vmw_user_dma_buffer(struct ttm_buffer_object *bo)
84 {
85         struct vmw_dma_buffer *vmw_bo = vmw_dma_buffer(bo);
86         return container_of(vmw_bo, struct vmw_user_dma_buffer, dma);
87 }
88
89 struct vmw_resource *vmw_resource_reference(struct vmw_resource *res)
90 {
91         kref_get(&res->kref);
92         return res;
93 }
94
95
96 /**
97  * vmw_resource_release_id - release a resource id to the id manager.
98  *
99  * @res: Pointer to the resource.
100  *
101  * Release the resource id to the resource id manager and set it to -1
102  */
103 static void vmw_resource_release_id(struct vmw_resource *res)
104 {
105         struct vmw_private *dev_priv = res->dev_priv;
106
107         write_lock(&dev_priv->resource_lock);
108         if (res->id != -1)
109                 idr_remove(res->idr, res->id);
110         res->id = -1;
111         write_unlock(&dev_priv->resource_lock);
112 }
113
114 static void vmw_resource_release(struct kref *kref)
115 {
116         struct vmw_resource *res =
117             container_of(kref, struct vmw_resource, kref);
118         struct vmw_private *dev_priv = res->dev_priv;
119         int id = res->id;
120         struct idr *idr = res->idr;
121
122         res->avail = false;
123         if (res->remove_from_lists != NULL)
124                 res->remove_from_lists(res);
125         write_unlock(&dev_priv->resource_lock);
126
127         if (likely(res->hw_destroy != NULL))
128                 res->hw_destroy(res);
129
130         if (res->res_free != NULL)
131                 res->res_free(res);
132         else
133                 kfree(res);
134
135         write_lock(&dev_priv->resource_lock);
136
137         if (id != -1)
138                 idr_remove(idr, id);
139 }
140
141 void vmw_resource_unreference(struct vmw_resource **p_res)
142 {
143         struct vmw_resource *res = *p_res;
144         struct vmw_private *dev_priv = res->dev_priv;
145
146         *p_res = NULL;
147         write_lock(&dev_priv->resource_lock);
148         kref_put(&res->kref, vmw_resource_release);
149         write_unlock(&dev_priv->resource_lock);
150 }
151
152
153 /**
154  * vmw_resource_alloc_id - release a resource id to the id manager.
155  *
156  * @dev_priv: Pointer to the device private structure.
157  * @res: Pointer to the resource.
158  *
159  * Allocate the lowest free resource from the resource manager, and set
160  * @res->id to that id. Returns 0 on success and -ENOMEM on failure.
161  */
162 static int vmw_resource_alloc_id(struct vmw_private *dev_priv,
163                                  struct vmw_resource *res)
164 {
165         int ret;
166
167         BUG_ON(res->id != -1);
168
169         do {
170                 if (unlikely(idr_pre_get(res->idr, GFP_KERNEL) == 0))
171                         return -ENOMEM;
172
173                 write_lock(&dev_priv->resource_lock);
174                 ret = idr_get_new_above(res->idr, res, 1, &res->id);
175                 write_unlock(&dev_priv->resource_lock);
176
177         } while (ret == -EAGAIN);
178
179         return ret;
180 }
181
182
183 static int vmw_resource_init(struct vmw_private *dev_priv,
184                              struct vmw_resource *res,
185                              struct idr *idr,
186                              enum ttm_object_type obj_type,
187                              bool delay_id,
188                              void (*res_free) (struct vmw_resource *res),
189                              void (*remove_from_lists)
190                              (struct vmw_resource *res))
191 {
192         kref_init(&res->kref);
193         res->hw_destroy = NULL;
194         res->res_free = res_free;
195         res->remove_from_lists = remove_from_lists;
196         res->res_type = obj_type;
197         res->idr = idr;
198         res->avail = false;
199         res->dev_priv = dev_priv;
200         INIT_LIST_HEAD(&res->query_head);
201         INIT_LIST_HEAD(&res->validate_head);
202         res->id = -1;
203         if (delay_id)
204                 return 0;
205         else
206                 return vmw_resource_alloc_id(dev_priv, res);
207 }
208
209 /**
210  * vmw_resource_activate
211  *
212  * @res:        Pointer to the newly created resource
213  * @hw_destroy: Destroy function. NULL if none.
214  *
215  * Activate a resource after the hardware has been made aware of it.
216  * Set tye destroy function to @destroy. Typically this frees the
217  * resource and destroys the hardware resources associated with it.
218  * Activate basically means that the function vmw_resource_lookup will
219  * find it.
220  */
221
222 static void vmw_resource_activate(struct vmw_resource *res,
223                                   void (*hw_destroy) (struct vmw_resource *))
224 {
225         struct vmw_private *dev_priv = res->dev_priv;
226
227         write_lock(&dev_priv->resource_lock);
228         res->avail = true;
229         res->hw_destroy = hw_destroy;
230         write_unlock(&dev_priv->resource_lock);
231 }
232
233 struct vmw_resource *vmw_resource_lookup(struct vmw_private *dev_priv,
234                                          struct idr *idr, int id)
235 {
236         struct vmw_resource *res;
237
238         read_lock(&dev_priv->resource_lock);
239         res = idr_find(idr, id);
240         if (res && res->avail)
241                 kref_get(&res->kref);
242         else
243                 res = NULL;
244         read_unlock(&dev_priv->resource_lock);
245
246         if (unlikely(res == NULL))
247                 return NULL;
248
249         return res;
250 }
251
252 /**
253  * Context management:
254  */
255
256 static void vmw_hw_context_destroy(struct vmw_resource *res)
257 {
258
259         struct vmw_private *dev_priv = res->dev_priv;
260         struct {
261                 SVGA3dCmdHeader header;
262                 SVGA3dCmdDestroyContext body;
263         } *cmd;
264
265
266         vmw_execbuf_release_pinned_bo(dev_priv, true, res->id);
267
268         cmd = vmw_fifo_reserve(dev_priv, sizeof(*cmd));
269         if (unlikely(cmd == NULL)) {
270                 DRM_ERROR("Failed reserving FIFO space for surface "
271                           "destruction.\n");
272                 return;
273         }
274
275         cmd->header.id = cpu_to_le32(SVGA_3D_CMD_CONTEXT_DESTROY);
276         cmd->header.size = cpu_to_le32(sizeof(cmd->body));
277         cmd->body.cid = cpu_to_le32(res->id);
278
279         vmw_fifo_commit(dev_priv, sizeof(*cmd));
280         vmw_3d_resource_dec(dev_priv, false);
281 }
282
283 static int vmw_context_init(struct vmw_private *dev_priv,
284                             struct vmw_resource *res,
285                             void (*res_free) (struct vmw_resource *res))
286 {
287         int ret;
288
289         struct {
290                 SVGA3dCmdHeader header;
291                 SVGA3dCmdDefineContext body;
292         } *cmd;
293
294         ret = vmw_resource_init(dev_priv, res, &dev_priv->context_idr,
295                                 VMW_RES_CONTEXT, false, res_free, NULL);
296
297         if (unlikely(ret != 0)) {
298                 DRM_ERROR("Failed to allocate a resource id.\n");
299                 goto out_early;
300         }
301
302         if (unlikely(res->id >= SVGA3D_MAX_CONTEXT_IDS)) {
303                 DRM_ERROR("Out of hw context ids.\n");
304                 vmw_resource_unreference(&res);
305                 return -ENOMEM;
306         }
307
308         cmd = vmw_fifo_reserve(dev_priv, sizeof(*cmd));
309         if (unlikely(cmd == NULL)) {
310                 DRM_ERROR("Fifo reserve failed.\n");
311                 vmw_resource_unreference(&res);
312                 return -ENOMEM;
313         }
314
315         cmd->header.id = cpu_to_le32(SVGA_3D_CMD_CONTEXT_DEFINE);
316         cmd->header.size = cpu_to_le32(sizeof(cmd->body));
317         cmd->body.cid = cpu_to_le32(res->id);
318
319         vmw_fifo_commit(dev_priv, sizeof(*cmd));
320         (void) vmw_3d_resource_inc(dev_priv, false);
321         vmw_resource_activate(res, vmw_hw_context_destroy);
322         return 0;
323
324 out_early:
325         if (res_free == NULL)
326                 kfree(res);
327         else
328                 res_free(res);
329         return ret;
330 }
331
332 struct vmw_resource *vmw_context_alloc(struct vmw_private *dev_priv)
333 {
334         struct vmw_resource *res = kmalloc(sizeof(*res), GFP_KERNEL);
335         int ret;
336
337         if (unlikely(res == NULL))
338                 return NULL;
339
340         ret = vmw_context_init(dev_priv, res, NULL);
341         return (ret == 0) ? res : NULL;
342 }
343
344 /**
345  * User-space context management:
346  */
347
348 static void vmw_user_context_free(struct vmw_resource *res)
349 {
350         struct vmw_user_context *ctx =
351             container_of(res, struct vmw_user_context, res);
352         struct vmw_private *dev_priv = res->dev_priv;
353
354         kfree(ctx);
355         ttm_mem_global_free(vmw_mem_glob(dev_priv),
356                             vmw_user_context_size);
357 }
358
359 /**
360  * This function is called when user space has no more references on the
361  * base object. It releases the base-object's reference on the resource object.
362  */
363
364 static void vmw_user_context_base_release(struct ttm_base_object **p_base)
365 {
366         struct ttm_base_object *base = *p_base;
367         struct vmw_user_context *ctx =
368             container_of(base, struct vmw_user_context, base);
369         struct vmw_resource *res = &ctx->res;
370
371         *p_base = NULL;
372         vmw_resource_unreference(&res);
373 }
374
375 int vmw_context_destroy_ioctl(struct drm_device *dev, void *data,
376                               struct drm_file *file_priv)
377 {
378         struct vmw_private *dev_priv = vmw_priv(dev);
379         struct vmw_resource *res;
380         struct vmw_user_context *ctx;
381         struct drm_vmw_context_arg *arg = (struct drm_vmw_context_arg *)data;
382         struct ttm_object_file *tfile = vmw_fpriv(file_priv)->tfile;
383         int ret = 0;
384
385         res = vmw_resource_lookup(dev_priv, &dev_priv->context_idr, arg->cid);
386         if (unlikely(res == NULL))
387                 return -EINVAL;
388
389         if (res->res_free != &vmw_user_context_free) {
390                 ret = -EINVAL;
391                 goto out;
392         }
393
394         ctx = container_of(res, struct vmw_user_context, res);
395         if (ctx->base.tfile != tfile && !ctx->base.shareable) {
396                 ret = -EPERM;
397                 goto out;
398         }
399
400         ttm_ref_object_base_unref(tfile, ctx->base.hash.key, TTM_REF_USAGE);
401 out:
402         vmw_resource_unreference(&res);
403         return ret;
404 }
405
406 int vmw_context_define_ioctl(struct drm_device *dev, void *data,
407                              struct drm_file *file_priv)
408 {
409         struct vmw_private *dev_priv = vmw_priv(dev);
410         struct vmw_user_context *ctx;
411         struct vmw_resource *res;
412         struct vmw_resource *tmp;
413         struct drm_vmw_context_arg *arg = (struct drm_vmw_context_arg *)data;
414         struct ttm_object_file *tfile = vmw_fpriv(file_priv)->tfile;
415         struct vmw_master *vmaster = vmw_master(file_priv->master);
416         int ret;
417
418
419         /*
420          * Approximate idr memory usage with 128 bytes. It will be limited
421          * by maximum number_of contexts anyway.
422          */
423
424         if (unlikely(vmw_user_context_size == 0))
425                 vmw_user_context_size = ttm_round_pot(sizeof(*ctx)) + 128;
426
427         ret = ttm_read_lock(&vmaster->lock, true);
428         if (unlikely(ret != 0))
429                 return ret;
430
431         ret = ttm_mem_global_alloc(vmw_mem_glob(dev_priv),
432                                    vmw_user_context_size,
433                                    false, true);
434         if (unlikely(ret != 0)) {
435                 if (ret != -ERESTARTSYS)
436                         DRM_ERROR("Out of graphics memory for context"
437                                   " creation.\n");
438                 goto out_unlock;
439         }
440
441         ctx = kmalloc(sizeof(*ctx), GFP_KERNEL);
442         if (unlikely(ctx == NULL)) {
443                 ttm_mem_global_free(vmw_mem_glob(dev_priv),
444                                     vmw_user_context_size);
445                 ret = -ENOMEM;
446                 goto out_unlock;
447         }
448
449         res = &ctx->res;
450         ctx->base.shareable = false;
451         ctx->base.tfile = NULL;
452
453         /*
454          * From here on, the destructor takes over resource freeing.
455          */
456
457         ret = vmw_context_init(dev_priv, res, vmw_user_context_free);
458         if (unlikely(ret != 0))
459                 goto out_unlock;
460
461         tmp = vmw_resource_reference(&ctx->res);
462         ret = ttm_base_object_init(tfile, &ctx->base, false, VMW_RES_CONTEXT,
463                                    &vmw_user_context_base_release, NULL);
464
465         if (unlikely(ret != 0)) {
466                 vmw_resource_unreference(&tmp);
467                 goto out_err;
468         }
469
470         arg->cid = res->id;
471 out_err:
472         vmw_resource_unreference(&res);
473 out_unlock:
474         ttm_read_unlock(&vmaster->lock);
475         return ret;
476
477 }
478
479 int vmw_context_check(struct vmw_private *dev_priv,
480                       struct ttm_object_file *tfile,
481                       int id,
482                       struct vmw_resource **p_res)
483 {
484         struct vmw_resource *res;
485         int ret = 0;
486
487         read_lock(&dev_priv->resource_lock);
488         res = idr_find(&dev_priv->context_idr, id);
489         if (res && res->avail) {
490                 struct vmw_user_context *ctx =
491                         container_of(res, struct vmw_user_context, res);
492                 if (ctx->base.tfile != tfile && !ctx->base.shareable)
493                         ret = -EPERM;
494                 if (p_res)
495                         *p_res = vmw_resource_reference(res);
496         } else
497                 ret = -EINVAL;
498         read_unlock(&dev_priv->resource_lock);
499
500         return ret;
501 }
502
503 struct vmw_bpp {
504         uint8_t bpp;
505         uint8_t s_bpp;
506 };
507
508 /*
509  * Size table for the supported SVGA3D surface formats. It consists of
510  * two values. The bpp value and the s_bpp value which is short for
511  * "stride bits per pixel" The values are given in such a way that the
512  * minimum stride for the image is calculated using
513  *
514  * min_stride = w*s_bpp
515  *
516  * and the total memory requirement for the image is
517  *
518  * h*min_stride*bpp/s_bpp
519  *
520  */
521 static const struct vmw_bpp vmw_sf_bpp[] = {
522         [SVGA3D_FORMAT_INVALID] = {0, 0},
523         [SVGA3D_X8R8G8B8] = {32, 32},
524         [SVGA3D_A8R8G8B8] = {32, 32},
525         [SVGA3D_R5G6B5] = {16, 16},
526         [SVGA3D_X1R5G5B5] = {16, 16},
527         [SVGA3D_A1R5G5B5] = {16, 16},
528         [SVGA3D_A4R4G4B4] = {16, 16},
529         [SVGA3D_Z_D32] = {32, 32},
530         [SVGA3D_Z_D16] = {16, 16},
531         [SVGA3D_Z_D24S8] = {32, 32},
532         [SVGA3D_Z_D15S1] = {16, 16},
533         [SVGA3D_LUMINANCE8] = {8, 8},
534         [SVGA3D_LUMINANCE4_ALPHA4] = {8, 8},
535         [SVGA3D_LUMINANCE16] = {16, 16},
536         [SVGA3D_LUMINANCE8_ALPHA8] = {16, 16},
537         [SVGA3D_DXT1] = {4, 16},
538         [SVGA3D_DXT2] = {8, 32},
539         [SVGA3D_DXT3] = {8, 32},
540         [SVGA3D_DXT4] = {8, 32},
541         [SVGA3D_DXT5] = {8, 32},
542         [SVGA3D_BUMPU8V8] = {16, 16},
543         [SVGA3D_BUMPL6V5U5] = {16, 16},
544         [SVGA3D_BUMPX8L8V8U8] = {32, 32},
545         [SVGA3D_ARGB_S10E5] = {16, 16},
546         [SVGA3D_ARGB_S23E8] = {32, 32},
547         [SVGA3D_A2R10G10B10] = {32, 32},
548         [SVGA3D_V8U8] = {16, 16},
549         [SVGA3D_Q8W8V8U8] = {32, 32},
550         [SVGA3D_CxV8U8] = {16, 16},
551         [SVGA3D_X8L8V8U8] = {32, 32},
552         [SVGA3D_A2W10V10U10] = {32, 32},
553         [SVGA3D_ALPHA8] = {8, 8},
554         [SVGA3D_R_S10E5] = {16, 16},
555         [SVGA3D_R_S23E8] = {32, 32},
556         [SVGA3D_RG_S10E5] = {16, 16},
557         [SVGA3D_RG_S23E8] = {32, 32},
558         [SVGA3D_BUFFER] = {8, 8},
559         [SVGA3D_Z_D24X8] = {32, 32},
560         [SVGA3D_V16U16] = {32, 32},
561         [SVGA3D_G16R16] = {32, 32},
562         [SVGA3D_A16B16G16R16] = {64,  64},
563         [SVGA3D_UYVY] = {12, 12},
564         [SVGA3D_YUY2] = {12, 12},
565         [SVGA3D_NV12] = {12, 8},
566         [SVGA3D_AYUV] = {32, 32},
567         [SVGA3D_BC4_UNORM] = {4,  16},
568         [SVGA3D_BC5_UNORM] = {8,  32},
569         [SVGA3D_Z_DF16] = {16,  16},
570         [SVGA3D_Z_DF24] = {24,  24},
571         [SVGA3D_Z_D24S8_INT] = {32,  32}
572 };
573
574
575 /**
576  * Surface management.
577  */
578
579 struct vmw_surface_dma {
580         SVGA3dCmdHeader header;
581         SVGA3dCmdSurfaceDMA body;
582         SVGA3dCopyBox cb;
583         SVGA3dCmdSurfaceDMASuffix suffix;
584 };
585
586 struct vmw_surface_define {
587         SVGA3dCmdHeader header;
588         SVGA3dCmdDefineSurface body;
589 };
590
591 struct vmw_surface_destroy {
592         SVGA3dCmdHeader header;
593         SVGA3dCmdDestroySurface body;
594 };
595
596
597 /**
598  * vmw_surface_dma_size - Compute fifo size for a dma command.
599  *
600  * @srf: Pointer to a struct vmw_surface
601  *
602  * Computes the required size for a surface dma command for backup or
603  * restoration of the surface represented by @srf.
604  */
605 static inline uint32_t vmw_surface_dma_size(const struct vmw_surface *srf)
606 {
607         return srf->num_sizes * sizeof(struct vmw_surface_dma);
608 }
609
610
611 /**
612  * vmw_surface_define_size - Compute fifo size for a surface define command.
613  *
614  * @srf: Pointer to a struct vmw_surface
615  *
616  * Computes the required size for a surface define command for the definition
617  * of the surface represented by @srf.
618  */
619 static inline uint32_t vmw_surface_define_size(const struct vmw_surface *srf)
620 {
621         return sizeof(struct vmw_surface_define) + srf->num_sizes *
622                 sizeof(SVGA3dSize);
623 }
624
625
626 /**
627  * vmw_surface_destroy_size - Compute fifo size for a surface destroy command.
628  *
629  * Computes the required size for a surface destroy command for the destruction
630  * of a hw surface.
631  */
632 static inline uint32_t vmw_surface_destroy_size(void)
633 {
634         return sizeof(struct vmw_surface_destroy);
635 }
636
637 /**
638  * vmw_surface_destroy_encode - Encode a surface_destroy command.
639  *
640  * @id: The surface id
641  * @cmd_space: Pointer to memory area in which the commands should be encoded.
642  */
643 static void vmw_surface_destroy_encode(uint32_t id,
644                                        void *cmd_space)
645 {
646         struct vmw_surface_destroy *cmd = (struct vmw_surface_destroy *)
647                 cmd_space;
648
649         cmd->header.id = SVGA_3D_CMD_SURFACE_DESTROY;
650         cmd->header.size = sizeof(cmd->body);
651         cmd->body.sid = id;
652 }
653
654 /**
655  * vmw_surface_define_encode - Encode a surface_define command.
656  *
657  * @srf: Pointer to a struct vmw_surface object.
658  * @cmd_space: Pointer to memory area in which the commands should be encoded.
659  */
660 static void vmw_surface_define_encode(const struct vmw_surface *srf,
661                                       void *cmd_space)
662 {
663         struct vmw_surface_define *cmd = (struct vmw_surface_define *)
664                 cmd_space;
665         struct drm_vmw_size *src_size;
666         SVGA3dSize *cmd_size;
667         uint32_t cmd_len;
668         int i;
669
670         cmd_len = sizeof(cmd->body) + srf->num_sizes * sizeof(SVGA3dSize);
671
672         cmd->header.id = SVGA_3D_CMD_SURFACE_DEFINE;
673         cmd->header.size = cmd_len;
674         cmd->body.sid = srf->res.id;
675         cmd->body.surfaceFlags = srf->flags;
676         cmd->body.format = cpu_to_le32(srf->format);
677         for (i = 0; i < DRM_VMW_MAX_SURFACE_FACES; ++i)
678                 cmd->body.face[i].numMipLevels = srf->mip_levels[i];
679
680         cmd += 1;
681         cmd_size = (SVGA3dSize *) cmd;
682         src_size = srf->sizes;
683
684         for (i = 0; i < srf->num_sizes; ++i, cmd_size++, src_size++) {
685                 cmd_size->width = src_size->width;
686                 cmd_size->height = src_size->height;
687                 cmd_size->depth = src_size->depth;
688         }
689 }
690
691
692 /**
693  * vmw_surface_dma_encode - Encode a surface_dma command.
694  *
695  * @srf: Pointer to a struct vmw_surface object.
696  * @cmd_space: Pointer to memory area in which the commands should be encoded.
697  * @ptr: Pointer to an SVGAGuestPtr indicating where the surface contents
698  * should be placed or read from.
699  * @to_surface: Boolean whether to DMA to the surface or from the surface.
700  */
701 static void vmw_surface_dma_encode(struct vmw_surface *srf,
702                                    void *cmd_space,
703                                    const SVGAGuestPtr *ptr,
704                                    bool to_surface)
705 {
706         uint32_t i;
707         uint32_t bpp = vmw_sf_bpp[srf->format].bpp;
708         uint32_t stride_bpp = vmw_sf_bpp[srf->format].s_bpp;
709         struct vmw_surface_dma *cmd = (struct vmw_surface_dma *)cmd_space;
710
711         for (i = 0; i < srf->num_sizes; ++i) {
712                 SVGA3dCmdHeader *header = &cmd->header;
713                 SVGA3dCmdSurfaceDMA *body = &cmd->body;
714                 SVGA3dCopyBox *cb = &cmd->cb;
715                 SVGA3dCmdSurfaceDMASuffix *suffix = &cmd->suffix;
716                 const struct vmw_surface_offset *cur_offset = &srf->offsets[i];
717                 const struct drm_vmw_size *cur_size = &srf->sizes[i];
718
719                 header->id = SVGA_3D_CMD_SURFACE_DMA;
720                 header->size = sizeof(*body) + sizeof(*cb) + sizeof(*suffix);
721
722                 body->guest.ptr = *ptr;
723                 body->guest.ptr.offset += cur_offset->bo_offset;
724                 body->guest.pitch = (cur_size->width * stride_bpp + 7) >> 3;
725                 body->host.sid = srf->res.id;
726                 body->host.face = cur_offset->face;
727                 body->host.mipmap = cur_offset->mip;
728                 body->transfer = ((to_surface) ?  SVGA3D_WRITE_HOST_VRAM :
729                                   SVGA3D_READ_HOST_VRAM);
730                 cb->x = 0;
731                 cb->y = 0;
732                 cb->z = 0;
733                 cb->srcx = 0;
734                 cb->srcy = 0;
735                 cb->srcz = 0;
736                 cb->w = cur_size->width;
737                 cb->h = cur_size->height;
738                 cb->d = cur_size->depth;
739
740                 suffix->suffixSize = sizeof(*suffix);
741                 suffix->maximumOffset = body->guest.pitch*cur_size->height*
742                         cur_size->depth*bpp / stride_bpp;
743                 suffix->flags.discard = 0;
744                 suffix->flags.unsynchronized = 0;
745                 suffix->flags.reserved = 0;
746                 ++cmd;
747         }
748 };
749
750
751 static void vmw_hw_surface_destroy(struct vmw_resource *res)
752 {
753
754         struct vmw_private *dev_priv = res->dev_priv;
755         struct vmw_surface *srf;
756         void *cmd;
757
758         if (res->id != -1) {
759
760                 cmd = vmw_fifo_reserve(dev_priv, vmw_surface_destroy_size());
761                 if (unlikely(cmd == NULL)) {
762                         DRM_ERROR("Failed reserving FIFO space for surface "
763                                   "destruction.\n");
764                         return;
765                 }
766
767                 vmw_surface_destroy_encode(res->id, cmd);
768                 vmw_fifo_commit(dev_priv, vmw_surface_destroy_size());
769
770                 /*
771                  * used_memory_size_atomic, or separate lock
772                  * to avoid taking dev_priv::cmdbuf_mutex in
773                  * the destroy path.
774                  */
775
776                 mutex_lock(&dev_priv->cmdbuf_mutex);
777                 srf = container_of(res, struct vmw_surface, res);
778                 dev_priv->used_memory_size -= srf->backup_size;
779                 mutex_unlock(&dev_priv->cmdbuf_mutex);
780
781         }
782         vmw_3d_resource_dec(dev_priv, false);
783 }
784
785 void vmw_surface_res_free(struct vmw_resource *res)
786 {
787         struct vmw_surface *srf = container_of(res, struct vmw_surface, res);
788
789         if (srf->backup)
790                 ttm_bo_unref(&srf->backup);
791         kfree(srf->offsets);
792         kfree(srf->sizes);
793         kfree(srf->snooper.image);
794         kfree(srf);
795 }
796
797
798 /**
799  * vmw_surface_do_validate - make a surface available to the device.
800  *
801  * @dev_priv: Pointer to a device private struct.
802  * @srf: Pointer to a struct vmw_surface.
803  *
804  * If the surface doesn't have a hw id, allocate one, and optionally
805  * DMA the backed up surface contents to the device.
806  *
807  * Returns -EBUSY if there wasn't sufficient device resources to
808  * complete the validation. Retry after freeing up resources.
809  *
810  * May return other errors if the kernel is out of guest resources.
811  */
812 int vmw_surface_do_validate(struct vmw_private *dev_priv,
813                             struct vmw_surface *srf)
814 {
815         struct vmw_resource *res = &srf->res;
816         struct list_head val_list;
817         struct ttm_validate_buffer val_buf;
818         uint32_t submit_size;
819         uint8_t *cmd;
820         int ret;
821
822         if (likely(res->id != -1))
823                 return 0;
824
825         if (unlikely(dev_priv->used_memory_size + srf->backup_size >=
826                      dev_priv->memory_size))
827                 return -EBUSY;
828
829         /*
830          * Reserve- and validate the backup DMA bo.
831          */
832
833         if (srf->backup) {
834                 INIT_LIST_HEAD(&val_list);
835                 val_buf.bo = ttm_bo_reference(srf->backup);
836                 val_buf.new_sync_obj_arg = (void *)((unsigned long)
837                                                     DRM_VMW_FENCE_FLAG_EXEC);
838                 list_add_tail(&val_buf.head, &val_list);
839                 ret = ttm_eu_reserve_buffers(&val_list);
840                 if (unlikely(ret != 0))
841                         goto out_no_reserve;
842
843                 ret = ttm_bo_validate(srf->backup, &vmw_srf_placement,
844                                       true, false, false);
845                 if (unlikely(ret != 0))
846                         goto out_no_validate;
847         }
848
849         /*
850          * Alloc id for the resource.
851          */
852
853         ret = vmw_resource_alloc_id(dev_priv, res);
854         if (unlikely(ret != 0)) {
855                 DRM_ERROR("Failed to allocate a surface id.\n");
856                 goto out_no_id;
857         }
858         if (unlikely(res->id >= SVGA3D_MAX_SURFACE_IDS)) {
859                 ret = -EBUSY;
860                 goto out_no_fifo;
861         }
862
863
864         /*
865          * Encode surface define- and dma commands.
866          */
867
868         submit_size = vmw_surface_define_size(srf);
869         if (srf->backup)
870                 submit_size += vmw_surface_dma_size(srf);
871
872         cmd = vmw_fifo_reserve(dev_priv, submit_size);
873         if (unlikely(cmd == NULL)) {
874                 DRM_ERROR("Failed reserving FIFO space for surface "
875                           "validation.\n");
876                 ret = -ENOMEM;
877                 goto out_no_fifo;
878         }
879
880         vmw_surface_define_encode(srf, cmd);
881         if (srf->backup) {
882                 SVGAGuestPtr ptr;
883
884                 cmd += vmw_surface_define_size(srf);
885                 vmw_bo_get_guest_ptr(srf->backup, &ptr);
886                 vmw_surface_dma_encode(srf, cmd, &ptr, true);
887         }
888
889         vmw_fifo_commit(dev_priv, submit_size);
890
891         /*
892          * Create a fence object and fence the backup buffer.
893          */
894
895         if (srf->backup) {
896                 struct vmw_fence_obj *fence;
897
898                 (void) vmw_execbuf_fence_commands(NULL, dev_priv,
899                                                   &fence, NULL);
900                 ttm_eu_fence_buffer_objects(&val_list, fence);
901                 if (likely(fence != NULL))
902                         vmw_fence_obj_unreference(&fence);
903                 ttm_bo_unref(&val_buf.bo);
904                 ttm_bo_unref(&srf->backup);
905         }
906
907         /*
908          * Surface memory usage accounting.
909          */
910
911         dev_priv->used_memory_size += srf->backup_size;
912
913         return 0;
914
915 out_no_fifo:
916         vmw_resource_release_id(res);
917 out_no_id:
918 out_no_validate:
919         if (srf->backup)
920                 ttm_eu_backoff_reservation(&val_list);
921 out_no_reserve:
922         if (srf->backup)
923                 ttm_bo_unref(&val_buf.bo);
924         return ret;
925 }
926
927 /**
928  * vmw_surface_evict - Evict a hw surface.
929  *
930  * @dev_priv: Pointer to a device private struct.
931  * @srf: Pointer to a struct vmw_surface
932  *
933  * DMA the contents of a hw surface to a backup guest buffer object,
934  * and destroy the hw surface, releasing its id.
935  */
936 int vmw_surface_evict(struct vmw_private *dev_priv,
937                       struct vmw_surface *srf)
938 {
939         struct vmw_resource *res = &srf->res;
940         struct list_head val_list;
941         struct ttm_validate_buffer val_buf;
942         uint32_t submit_size;
943         uint8_t *cmd;
944         int ret;
945         struct vmw_fence_obj *fence;
946         SVGAGuestPtr ptr;
947
948         BUG_ON(res->id == -1);
949
950         /*
951          * Create a surface backup buffer object.
952          */
953
954         if (!srf->backup) {
955                 ret = ttm_bo_create(&dev_priv->bdev, srf->backup_size,
956                                     ttm_bo_type_device,
957                                     &vmw_srf_placement, 0, 0, true,
958                                     NULL, &srf->backup);
959                 if (unlikely(ret != 0))
960                         return ret;
961         }
962
963         /*
964          * Reserve- and validate the backup DMA bo.
965          */
966
967         INIT_LIST_HEAD(&val_list);
968         val_buf.bo = ttm_bo_reference(srf->backup);
969         val_buf.new_sync_obj_arg = (void *)(unsigned long)
970                 DRM_VMW_FENCE_FLAG_EXEC;
971         list_add_tail(&val_buf.head, &val_list);
972         ret = ttm_eu_reserve_buffers(&val_list);
973         if (unlikely(ret != 0))
974                 goto out_no_reserve;
975
976         ret = ttm_bo_validate(srf->backup, &vmw_srf_placement,
977                               true, false, false);
978         if (unlikely(ret != 0))
979                 goto out_no_validate;
980
981
982         /*
983          * Encode the dma- and surface destroy commands.
984          */
985
986         submit_size = vmw_surface_dma_size(srf) + vmw_surface_destroy_size();
987         cmd = vmw_fifo_reserve(dev_priv, submit_size);
988         if (unlikely(cmd == NULL)) {
989                 DRM_ERROR("Failed reserving FIFO space for surface "
990                           "eviction.\n");
991                 ret = -ENOMEM;
992                 goto out_no_fifo;
993         }
994
995         vmw_bo_get_guest_ptr(srf->backup, &ptr);
996         vmw_surface_dma_encode(srf, cmd, &ptr, false);
997         cmd += vmw_surface_dma_size(srf);
998         vmw_surface_destroy_encode(res->id, cmd);
999         vmw_fifo_commit(dev_priv, submit_size);
1000
1001         /*
1002          * Surface memory usage accounting.
1003          */
1004
1005         dev_priv->used_memory_size -= srf->backup_size;
1006
1007         /*
1008          * Create a fence object and fence the DMA buffer.
1009          */
1010
1011         (void) vmw_execbuf_fence_commands(NULL, dev_priv,
1012                                           &fence, NULL);
1013         ttm_eu_fence_buffer_objects(&val_list, fence);
1014         if (likely(fence != NULL))
1015                 vmw_fence_obj_unreference(&fence);
1016         ttm_bo_unref(&val_buf.bo);
1017
1018         /*
1019          * Release the surface ID.
1020          */
1021
1022         vmw_resource_release_id(res);
1023
1024         return 0;
1025
1026 out_no_fifo:
1027 out_no_validate:
1028         if (srf->backup)
1029                 ttm_eu_backoff_reservation(&val_list);
1030 out_no_reserve:
1031         ttm_bo_unref(&val_buf.bo);
1032         ttm_bo_unref(&srf->backup);
1033         return ret;
1034 }
1035
1036
1037 /**
1038  * vmw_surface_validate - make a surface available to the device, evicting
1039  * other surfaces if needed.
1040  *
1041  * @dev_priv: Pointer to a device private struct.
1042  * @srf: Pointer to a struct vmw_surface.
1043  *
1044  * Try to validate a surface and if it fails due to limited device resources,
1045  * repeatedly try to evict other surfaces until the request can be
1046  * acommodated.
1047  *
1048  * May return errors if out of resources.
1049  */
1050 int vmw_surface_validate(struct vmw_private *dev_priv,
1051                          struct vmw_surface *srf)
1052 {
1053         int ret;
1054         struct vmw_surface *evict_srf;
1055
1056         do {
1057                 write_lock(&dev_priv->resource_lock);
1058                 list_del_init(&srf->lru_head);
1059                 write_unlock(&dev_priv->resource_lock);
1060
1061                 ret = vmw_surface_do_validate(dev_priv, srf);
1062                 if (likely(ret != -EBUSY))
1063                         break;
1064
1065                 write_lock(&dev_priv->resource_lock);
1066                 if (list_empty(&dev_priv->surface_lru)) {
1067                         DRM_ERROR("Out of device memory for surfaces.\n");
1068                         ret = -EBUSY;
1069                         write_unlock(&dev_priv->resource_lock);
1070                         break;
1071                 }
1072
1073                 evict_srf = vmw_surface_reference
1074                         (list_first_entry(&dev_priv->surface_lru,
1075                                           struct vmw_surface,
1076                                           lru_head));
1077                 list_del_init(&evict_srf->lru_head);
1078
1079                 write_unlock(&dev_priv->resource_lock);
1080                 (void) vmw_surface_evict(dev_priv, evict_srf);
1081
1082                 vmw_surface_unreference(&evict_srf);
1083
1084         } while (1);
1085
1086         if (unlikely(ret != 0 && srf->res.id != -1)) {
1087                 write_lock(&dev_priv->resource_lock);
1088                 list_add_tail(&srf->lru_head, &dev_priv->surface_lru);
1089                 write_unlock(&dev_priv->resource_lock);
1090         }
1091
1092         return ret;
1093 }
1094
1095
1096 /**
1097  * vmw_surface_remove_from_lists - Remove surface resources from lookup lists
1098  *
1099  * @res: Pointer to a struct vmw_resource embedded in a struct vmw_surface
1100  *
1101  * As part of the resource destruction, remove the surface from any
1102  * lookup lists.
1103  */
1104 static void vmw_surface_remove_from_lists(struct vmw_resource *res)
1105 {
1106         struct vmw_surface *srf = container_of(res, struct vmw_surface, res);
1107
1108         list_del_init(&srf->lru_head);
1109 }
1110
1111 int vmw_surface_init(struct vmw_private *dev_priv,
1112                      struct vmw_surface *srf,
1113                      void (*res_free) (struct vmw_resource *res))
1114 {
1115         int ret;
1116         struct vmw_resource *res = &srf->res;
1117
1118         BUG_ON(res_free == NULL);
1119         INIT_LIST_HEAD(&srf->lru_head);
1120         ret = vmw_resource_init(dev_priv, res, &dev_priv->surface_idr,
1121                                 VMW_RES_SURFACE, true, res_free,
1122                                 vmw_surface_remove_from_lists);
1123
1124         if (unlikely(ret != 0))
1125                 res_free(res);
1126
1127         /*
1128          * The surface won't be visible to hardware until a
1129          * surface validate.
1130          */
1131
1132         (void) vmw_3d_resource_inc(dev_priv, false);
1133         vmw_resource_activate(res, vmw_hw_surface_destroy);
1134         return ret;
1135 }
1136
1137 static void vmw_user_surface_free(struct vmw_resource *res)
1138 {
1139         struct vmw_surface *srf = container_of(res, struct vmw_surface, res);
1140         struct vmw_user_surface *user_srf =
1141             container_of(srf, struct vmw_user_surface, srf);
1142         struct vmw_private *dev_priv = srf->res.dev_priv;
1143         uint32_t size = user_srf->size;
1144
1145         if (srf->backup)
1146                 ttm_bo_unref(&srf->backup);
1147         kfree(srf->offsets);
1148         kfree(srf->sizes);
1149         kfree(srf->snooper.image);
1150         kfree(user_srf);
1151         ttm_mem_global_free(vmw_mem_glob(dev_priv), size);
1152 }
1153
1154 /**
1155  * vmw_resource_unreserve - unreserve resources previously reserved for
1156  * command submission.
1157  *
1158  * @list_head: list of resources to unreserve.
1159  *
1160  * Currently only surfaces are considered, and unreserving a surface
1161  * means putting it back on the device's surface lru list,
1162  * so that it can be evicted if necessary.
1163  * This function traverses the resource list and
1164  * checks whether resources are surfaces, and in that case puts them back
1165  * on the device's surface LRU list.
1166  */
1167 void vmw_resource_unreserve(struct list_head *list)
1168 {
1169         struct vmw_resource *res;
1170         struct vmw_surface *srf;
1171         rwlock_t *lock = NULL;
1172
1173         list_for_each_entry(res, list, validate_head) {
1174
1175                 if (res->res_free != &vmw_surface_res_free &&
1176                     res->res_free != &vmw_user_surface_free)
1177                         continue;
1178
1179                 if (unlikely(lock == NULL)) {
1180                         lock = &res->dev_priv->resource_lock;
1181                         write_lock(lock);
1182                 }
1183
1184                 srf = container_of(res, struct vmw_surface, res);
1185                 list_del_init(&srf->lru_head);
1186                 list_add_tail(&srf->lru_head, &res->dev_priv->surface_lru);
1187         }
1188
1189         if (lock != NULL)
1190                 write_unlock(lock);
1191 }
1192
1193
1194 int vmw_user_surface_lookup_handle(struct vmw_private *dev_priv,
1195                                    struct ttm_object_file *tfile,
1196                                    uint32_t handle, struct vmw_surface **out)
1197 {
1198         struct vmw_resource *res;
1199         struct vmw_surface *srf;
1200         struct vmw_user_surface *user_srf;
1201         struct ttm_base_object *base;
1202         int ret = -EINVAL;
1203
1204         base = ttm_base_object_lookup(tfile, handle);
1205         if (unlikely(base == NULL))
1206                 return -EINVAL;
1207
1208         if (unlikely(base->object_type != VMW_RES_SURFACE))
1209                 goto out_bad_resource;
1210
1211         user_srf = container_of(base, struct vmw_user_surface, base);
1212         srf = &user_srf->srf;
1213         res = &srf->res;
1214
1215         read_lock(&dev_priv->resource_lock);
1216
1217         if (!res->avail || res->res_free != &vmw_user_surface_free) {
1218                 read_unlock(&dev_priv->resource_lock);
1219                 goto out_bad_resource;
1220         }
1221
1222         kref_get(&res->kref);
1223         read_unlock(&dev_priv->resource_lock);
1224
1225         *out = srf;
1226         ret = 0;
1227
1228 out_bad_resource:
1229         ttm_base_object_unref(&base);
1230
1231         return ret;
1232 }
1233
1234 static void vmw_user_surface_base_release(struct ttm_base_object **p_base)
1235 {
1236         struct ttm_base_object *base = *p_base;
1237         struct vmw_user_surface *user_srf =
1238             container_of(base, struct vmw_user_surface, base);
1239         struct vmw_resource *res = &user_srf->srf.res;
1240
1241         *p_base = NULL;
1242         vmw_resource_unreference(&res);
1243 }
1244
1245 int vmw_surface_destroy_ioctl(struct drm_device *dev, void *data,
1246                               struct drm_file *file_priv)
1247 {
1248         struct drm_vmw_surface_arg *arg = (struct drm_vmw_surface_arg *)data;
1249         struct ttm_object_file *tfile = vmw_fpriv(file_priv)->tfile;
1250
1251         return ttm_ref_object_base_unref(tfile, arg->sid, TTM_REF_USAGE);
1252 }
1253
1254 int vmw_surface_define_ioctl(struct drm_device *dev, void *data,
1255                              struct drm_file *file_priv)
1256 {
1257         struct vmw_private *dev_priv = vmw_priv(dev);
1258         struct vmw_user_surface *user_srf;
1259         struct vmw_surface *srf;
1260         struct vmw_resource *res;
1261         struct vmw_resource *tmp;
1262         union drm_vmw_surface_create_arg *arg =
1263             (union drm_vmw_surface_create_arg *)data;
1264         struct drm_vmw_surface_create_req *req = &arg->req;
1265         struct drm_vmw_surface_arg *rep = &arg->rep;
1266         struct ttm_object_file *tfile = vmw_fpriv(file_priv)->tfile;
1267         struct drm_vmw_size __user *user_sizes;
1268         int ret;
1269         int i, j;
1270         uint32_t cur_bo_offset;
1271         struct drm_vmw_size *cur_size;
1272         struct vmw_surface_offset *cur_offset;
1273         uint32_t stride_bpp;
1274         uint32_t bpp;
1275         uint32_t num_sizes;
1276         uint32_t size;
1277         struct vmw_master *vmaster = vmw_master(file_priv->master);
1278
1279         if (unlikely(vmw_user_surface_size == 0))
1280                 vmw_user_surface_size = ttm_round_pot(sizeof(*user_srf)) +
1281                         128;
1282
1283         num_sizes = 0;
1284         for (i = 0; i < DRM_VMW_MAX_SURFACE_FACES; ++i)
1285                 num_sizes += req->mip_levels[i];
1286
1287         if (num_sizes > DRM_VMW_MAX_SURFACE_FACES *
1288             DRM_VMW_MAX_MIP_LEVELS)
1289                 return -EINVAL;
1290
1291         size = vmw_user_surface_size + 128 +
1292                 ttm_round_pot(num_sizes * sizeof(struct drm_vmw_size)) +
1293                 ttm_round_pot(num_sizes * sizeof(struct vmw_surface_offset));
1294
1295
1296         ret = ttm_read_lock(&vmaster->lock, true);
1297         if (unlikely(ret != 0))
1298                 return ret;
1299
1300         ret = ttm_mem_global_alloc(vmw_mem_glob(dev_priv),
1301                                    size, false, true);
1302         if (unlikely(ret != 0)) {
1303                 if (ret != -ERESTARTSYS)
1304                         DRM_ERROR("Out of graphics memory for surface"
1305                                   " creation.\n");
1306                 goto out_unlock;
1307         }
1308
1309         user_srf = kmalloc(sizeof(*user_srf), GFP_KERNEL);
1310         if (unlikely(user_srf == NULL)) {
1311                 ret = -ENOMEM;
1312                 goto out_no_user_srf;
1313         }
1314
1315         srf = &user_srf->srf;
1316         res = &srf->res;
1317
1318         srf->flags = req->flags;
1319         srf->format = req->format;
1320         srf->scanout = req->scanout;
1321         srf->backup = NULL;
1322
1323         memcpy(srf->mip_levels, req->mip_levels, sizeof(srf->mip_levels));
1324         srf->num_sizes = num_sizes;
1325         user_srf->size = size;
1326
1327         srf->sizes = kmalloc(srf->num_sizes * sizeof(*srf->sizes), GFP_KERNEL);
1328         if (unlikely(srf->sizes == NULL)) {
1329                 ret = -ENOMEM;
1330                 goto out_no_sizes;
1331         }
1332         srf->offsets = kmalloc(srf->num_sizes * sizeof(*srf->offsets),
1333                                GFP_KERNEL);
1334         if (unlikely(srf->sizes == NULL)) {
1335                 ret = -ENOMEM;
1336                 goto out_no_offsets;
1337         }
1338
1339         user_sizes = (struct drm_vmw_size __user *)(unsigned long)
1340             req->size_addr;
1341
1342         ret = copy_from_user(srf->sizes, user_sizes,
1343                              srf->num_sizes * sizeof(*srf->sizes));
1344         if (unlikely(ret != 0)) {
1345                 ret = -EFAULT;
1346                 goto out_no_copy;
1347         }
1348
1349         cur_bo_offset = 0;
1350         cur_offset = srf->offsets;
1351         cur_size = srf->sizes;
1352
1353         bpp = vmw_sf_bpp[srf->format].bpp;
1354         stride_bpp = vmw_sf_bpp[srf->format].s_bpp;
1355
1356         for (i = 0; i < DRM_VMW_MAX_SURFACE_FACES; ++i) {
1357                 for (j = 0; j < srf->mip_levels[i]; ++j) {
1358                         uint32_t stride =
1359                                 (cur_size->width * stride_bpp + 7) >> 3;
1360
1361                         cur_offset->face = i;
1362                         cur_offset->mip = j;
1363                         cur_offset->bo_offset = cur_bo_offset;
1364                         cur_bo_offset += stride * cur_size->height *
1365                                 cur_size->depth * bpp / stride_bpp;
1366                         ++cur_offset;
1367                         ++cur_size;
1368                 }
1369         }
1370         srf->backup_size = cur_bo_offset;
1371
1372         if (srf->scanout &&
1373             srf->num_sizes == 1 &&
1374             srf->sizes[0].width == 64 &&
1375             srf->sizes[0].height == 64 &&
1376             srf->format == SVGA3D_A8R8G8B8) {
1377
1378                 /* allocate image area and clear it */
1379                 srf->snooper.image = kzalloc(64 * 64 * 4, GFP_KERNEL);
1380                 if (!srf->snooper.image) {
1381                         DRM_ERROR("Failed to allocate cursor_image\n");
1382                         ret = -ENOMEM;
1383                         goto out_no_copy;
1384                 }
1385         } else {
1386                 srf->snooper.image = NULL;
1387         }
1388         srf->snooper.crtc = NULL;
1389
1390         user_srf->base.shareable = false;
1391         user_srf->base.tfile = NULL;
1392
1393         /**
1394          * From this point, the generic resource management functions
1395          * destroy the object on failure.
1396          */
1397
1398         ret = vmw_surface_init(dev_priv, srf, vmw_user_surface_free);
1399         if (unlikely(ret != 0))
1400                 goto out_unlock;
1401
1402         tmp = vmw_resource_reference(&srf->res);
1403         ret = ttm_base_object_init(tfile, &user_srf->base,
1404                                    req->shareable, VMW_RES_SURFACE,
1405                                    &vmw_user_surface_base_release, NULL);
1406
1407         if (unlikely(ret != 0)) {
1408                 vmw_resource_unreference(&tmp);
1409                 vmw_resource_unreference(&res);
1410                 goto out_unlock;
1411         }
1412
1413         rep->sid = user_srf->base.hash.key;
1414         if (rep->sid == SVGA3D_INVALID_ID)
1415                 DRM_ERROR("Created bad Surface ID.\n");
1416
1417         vmw_resource_unreference(&res);
1418
1419         ttm_read_unlock(&vmaster->lock);
1420         return 0;
1421 out_no_copy:
1422         kfree(srf->offsets);
1423 out_no_offsets:
1424         kfree(srf->sizes);
1425 out_no_sizes:
1426         kfree(user_srf);
1427 out_no_user_srf:
1428         ttm_mem_global_free(vmw_mem_glob(dev_priv), size);
1429 out_unlock:
1430         ttm_read_unlock(&vmaster->lock);
1431         return ret;
1432 }
1433
1434 int vmw_surface_reference_ioctl(struct drm_device *dev, void *data,
1435                                 struct drm_file *file_priv)
1436 {
1437         union drm_vmw_surface_reference_arg *arg =
1438             (union drm_vmw_surface_reference_arg *)data;
1439         struct drm_vmw_surface_arg *req = &arg->req;
1440         struct drm_vmw_surface_create_req *rep = &arg->rep;
1441         struct ttm_object_file *tfile = vmw_fpriv(file_priv)->tfile;
1442         struct vmw_surface *srf;
1443         struct vmw_user_surface *user_srf;
1444         struct drm_vmw_size __user *user_sizes;
1445         struct ttm_base_object *base;
1446         int ret = -EINVAL;
1447
1448         base = ttm_base_object_lookup(tfile, req->sid);
1449         if (unlikely(base == NULL)) {
1450                 DRM_ERROR("Could not find surface to reference.\n");
1451                 return -EINVAL;
1452         }
1453
1454         if (unlikely(base->object_type != VMW_RES_SURFACE))
1455                 goto out_bad_resource;
1456
1457         user_srf = container_of(base, struct vmw_user_surface, base);
1458         srf = &user_srf->srf;
1459
1460         ret = ttm_ref_object_add(tfile, &user_srf->base, TTM_REF_USAGE, NULL);
1461         if (unlikely(ret != 0)) {
1462                 DRM_ERROR("Could not add a reference to a surface.\n");
1463                 goto out_no_reference;
1464         }
1465
1466         rep->flags = srf->flags;
1467         rep->format = srf->format;
1468         memcpy(rep->mip_levels, srf->mip_levels, sizeof(srf->mip_levels));
1469         user_sizes = (struct drm_vmw_size __user *)(unsigned long)
1470             rep->size_addr;
1471
1472         if (user_sizes)
1473                 ret = copy_to_user(user_sizes, srf->sizes,
1474                                    srf->num_sizes * sizeof(*srf->sizes));
1475         if (unlikely(ret != 0)) {
1476                 DRM_ERROR("copy_to_user failed %p %u\n",
1477                           user_sizes, srf->num_sizes);
1478                 ret = -EFAULT;
1479         }
1480 out_bad_resource:
1481 out_no_reference:
1482         ttm_base_object_unref(&base);
1483
1484         return ret;
1485 }
1486
1487 int vmw_surface_check(struct vmw_private *dev_priv,
1488                       struct ttm_object_file *tfile,
1489                       uint32_t handle, int *id)
1490 {
1491         struct ttm_base_object *base;
1492         struct vmw_user_surface *user_srf;
1493
1494         int ret = -EPERM;
1495
1496         base = ttm_base_object_lookup(tfile, handle);
1497         if (unlikely(base == NULL))
1498                 return -EINVAL;
1499
1500         if (unlikely(base->object_type != VMW_RES_SURFACE))
1501                 goto out_bad_surface;
1502
1503         user_srf = container_of(base, struct vmw_user_surface, base);
1504         *id = user_srf->srf.res.id;
1505         ret = 0;
1506
1507 out_bad_surface:
1508         /**
1509          * FIXME: May deadlock here when called from the
1510          * command parsing code.
1511          */
1512
1513         ttm_base_object_unref(&base);
1514         return ret;
1515 }
1516
1517 /**
1518  * Buffer management.
1519  */
1520
1521 static size_t vmw_dmabuf_acc_size(struct ttm_bo_global *glob,
1522                                   unsigned long num_pages)
1523 {
1524         static size_t bo_user_size = ~0;
1525
1526         size_t page_array_size =
1527             (num_pages * sizeof(void *) + PAGE_SIZE - 1) & PAGE_MASK;
1528
1529         if (unlikely(bo_user_size == ~0)) {
1530                 bo_user_size = glob->ttm_bo_extra_size +
1531                     ttm_round_pot(sizeof(struct vmw_dma_buffer));
1532         }
1533
1534         return bo_user_size + page_array_size;
1535 }
1536
1537 void vmw_dmabuf_bo_free(struct ttm_buffer_object *bo)
1538 {
1539         struct vmw_dma_buffer *vmw_bo = vmw_dma_buffer(bo);
1540         struct ttm_bo_global *glob = bo->glob;
1541
1542         ttm_mem_global_free(glob->mem_glob, bo->acc_size);
1543         kfree(vmw_bo);
1544 }
1545
1546 int vmw_dmabuf_init(struct vmw_private *dev_priv,
1547                     struct vmw_dma_buffer *vmw_bo,
1548                     size_t size, struct ttm_placement *placement,
1549                     bool interruptible,
1550                     void (*bo_free) (struct ttm_buffer_object *bo))
1551 {
1552         struct ttm_bo_device *bdev = &dev_priv->bdev;
1553         struct ttm_mem_global *mem_glob = bdev->glob->mem_glob;
1554         size_t acc_size;
1555         int ret;
1556
1557         BUG_ON(!bo_free);
1558
1559         acc_size =
1560             vmw_dmabuf_acc_size(bdev->glob,
1561                                 (size + PAGE_SIZE - 1) >> PAGE_SHIFT);
1562
1563         ret = ttm_mem_global_alloc(mem_glob, acc_size, false, false);
1564         if (unlikely(ret != 0)) {
1565                 /* we must free the bo here as
1566                  * ttm_buffer_object_init does so as well */
1567                 bo_free(&vmw_bo->base);
1568                 return ret;
1569         }
1570
1571         memset(vmw_bo, 0, sizeof(*vmw_bo));
1572
1573         INIT_LIST_HEAD(&vmw_bo->validate_list);
1574
1575         ret = ttm_bo_init(bdev, &vmw_bo->base, size,
1576                           ttm_bo_type_device, placement,
1577                           0, 0, interruptible,
1578                           NULL, acc_size, bo_free);
1579         return ret;
1580 }
1581
1582 static void vmw_user_dmabuf_destroy(struct ttm_buffer_object *bo)
1583 {
1584         struct vmw_user_dma_buffer *vmw_user_bo = vmw_user_dma_buffer(bo);
1585         struct ttm_bo_global *glob = bo->glob;
1586
1587         ttm_mem_global_free(glob->mem_glob, bo->acc_size);
1588         kfree(vmw_user_bo);
1589 }
1590
1591 static void vmw_user_dmabuf_release(struct ttm_base_object **p_base)
1592 {
1593         struct vmw_user_dma_buffer *vmw_user_bo;
1594         struct ttm_base_object *base = *p_base;
1595         struct ttm_buffer_object *bo;
1596
1597         *p_base = NULL;
1598
1599         if (unlikely(base == NULL))
1600                 return;
1601
1602         vmw_user_bo = container_of(base, struct vmw_user_dma_buffer, base);
1603         bo = &vmw_user_bo->dma.base;
1604         ttm_bo_unref(&bo);
1605 }
1606
1607 int vmw_dmabuf_alloc_ioctl(struct drm_device *dev, void *data,
1608                            struct drm_file *file_priv)
1609 {
1610         struct vmw_private *dev_priv = vmw_priv(dev);
1611         union drm_vmw_alloc_dmabuf_arg *arg =
1612             (union drm_vmw_alloc_dmabuf_arg *)data;
1613         struct drm_vmw_alloc_dmabuf_req *req = &arg->req;
1614         struct drm_vmw_dmabuf_rep *rep = &arg->rep;
1615         struct vmw_user_dma_buffer *vmw_user_bo;
1616         struct ttm_buffer_object *tmp;
1617         struct vmw_master *vmaster = vmw_master(file_priv->master);
1618         int ret;
1619
1620         vmw_user_bo = kzalloc(sizeof(*vmw_user_bo), GFP_KERNEL);
1621         if (unlikely(vmw_user_bo == NULL))
1622                 return -ENOMEM;
1623
1624         ret = ttm_read_lock(&vmaster->lock, true);
1625         if (unlikely(ret != 0)) {
1626                 kfree(vmw_user_bo);
1627                 return ret;
1628         }
1629
1630         ret = vmw_dmabuf_init(dev_priv, &vmw_user_bo->dma, req->size,
1631                               &vmw_vram_sys_placement, true,
1632                               &vmw_user_dmabuf_destroy);
1633         if (unlikely(ret != 0))
1634                 goto out_no_dmabuf;
1635
1636         tmp = ttm_bo_reference(&vmw_user_bo->dma.base);
1637         ret = ttm_base_object_init(vmw_fpriv(file_priv)->tfile,
1638                                    &vmw_user_bo->base,
1639                                    false,
1640                                    ttm_buffer_type,
1641                                    &vmw_user_dmabuf_release, NULL);
1642         if (unlikely(ret != 0))
1643                 goto out_no_base_object;
1644         else {
1645                 rep->handle = vmw_user_bo->base.hash.key;
1646                 rep->map_handle = vmw_user_bo->dma.base.addr_space_offset;
1647                 rep->cur_gmr_id = vmw_user_bo->base.hash.key;
1648                 rep->cur_gmr_offset = 0;
1649         }
1650
1651 out_no_base_object:
1652         ttm_bo_unref(&tmp);
1653 out_no_dmabuf:
1654         ttm_read_unlock(&vmaster->lock);
1655
1656         return ret;
1657 }
1658
1659 int vmw_dmabuf_unref_ioctl(struct drm_device *dev, void *data,
1660                            struct drm_file *file_priv)
1661 {
1662         struct drm_vmw_unref_dmabuf_arg *arg =
1663             (struct drm_vmw_unref_dmabuf_arg *)data;
1664
1665         return ttm_ref_object_base_unref(vmw_fpriv(file_priv)->tfile,
1666                                          arg->handle,
1667                                          TTM_REF_USAGE);
1668 }
1669
1670 uint32_t vmw_dmabuf_validate_node(struct ttm_buffer_object *bo,
1671                                   uint32_t cur_validate_node)
1672 {
1673         struct vmw_dma_buffer *vmw_bo = vmw_dma_buffer(bo);
1674
1675         if (likely(vmw_bo->on_validate_list))
1676                 return vmw_bo->cur_validate_node;
1677
1678         vmw_bo->cur_validate_node = cur_validate_node;
1679         vmw_bo->on_validate_list = true;
1680
1681         return cur_validate_node;
1682 }
1683
1684 void vmw_dmabuf_validate_clear(struct ttm_buffer_object *bo)
1685 {
1686         struct vmw_dma_buffer *vmw_bo = vmw_dma_buffer(bo);
1687
1688         vmw_bo->on_validate_list = false;
1689 }
1690
1691 int vmw_user_dmabuf_lookup(struct ttm_object_file *tfile,
1692                            uint32_t handle, struct vmw_dma_buffer **out)
1693 {
1694         struct vmw_user_dma_buffer *vmw_user_bo;
1695         struct ttm_base_object *base;
1696
1697         base = ttm_base_object_lookup(tfile, handle);
1698         if (unlikely(base == NULL)) {
1699                 printk(KERN_ERR "Invalid buffer object handle 0x%08lx.\n",
1700                        (unsigned long)handle);
1701                 return -ESRCH;
1702         }
1703
1704         if (unlikely(base->object_type != ttm_buffer_type)) {
1705                 ttm_base_object_unref(&base);
1706                 printk(KERN_ERR "Invalid buffer object handle 0x%08lx.\n",
1707                        (unsigned long)handle);
1708                 return -EINVAL;
1709         }
1710
1711         vmw_user_bo = container_of(base, struct vmw_user_dma_buffer, base);
1712         (void)ttm_bo_reference(&vmw_user_bo->dma.base);
1713         ttm_base_object_unref(&base);
1714         *out = &vmw_user_bo->dma;
1715
1716         return 0;
1717 }
1718
1719 /*
1720  * Stream management
1721  */
1722
1723 static void vmw_stream_destroy(struct vmw_resource *res)
1724 {
1725         struct vmw_private *dev_priv = res->dev_priv;
1726         struct vmw_stream *stream;
1727         int ret;
1728
1729         DRM_INFO("%s: unref\n", __func__);
1730         stream = container_of(res, struct vmw_stream, res);
1731
1732         ret = vmw_overlay_unref(dev_priv, stream->stream_id);
1733         WARN_ON(ret != 0);
1734 }
1735
1736 static int vmw_stream_init(struct vmw_private *dev_priv,
1737                            struct vmw_stream *stream,
1738                            void (*res_free) (struct vmw_resource *res))
1739 {
1740         struct vmw_resource *res = &stream->res;
1741         int ret;
1742
1743         ret = vmw_resource_init(dev_priv, res, &dev_priv->stream_idr,
1744                                 VMW_RES_STREAM, false, res_free, NULL);
1745
1746         if (unlikely(ret != 0)) {
1747                 if (res_free == NULL)
1748                         kfree(stream);
1749                 else
1750                         res_free(&stream->res);
1751                 return ret;
1752         }
1753
1754         ret = vmw_overlay_claim(dev_priv, &stream->stream_id);
1755         if (ret) {
1756                 vmw_resource_unreference(&res);
1757                 return ret;
1758         }
1759
1760         DRM_INFO("%s: claimed\n", __func__);
1761
1762         vmw_resource_activate(&stream->res, vmw_stream_destroy);
1763         return 0;
1764 }
1765
1766 /**
1767  * User-space context management:
1768  */
1769
1770 static void vmw_user_stream_free(struct vmw_resource *res)
1771 {
1772         struct vmw_user_stream *stream =
1773             container_of(res, struct vmw_user_stream, stream.res);
1774         struct vmw_private *dev_priv = res->dev_priv;
1775
1776         kfree(stream);
1777         ttm_mem_global_free(vmw_mem_glob(dev_priv),
1778                             vmw_user_stream_size);
1779 }
1780
1781 /**
1782  * This function is called when user space has no more references on the
1783  * base object. It releases the base-object's reference on the resource object.
1784  */
1785
1786 static void vmw_user_stream_base_release(struct ttm_base_object **p_base)
1787 {
1788         struct ttm_base_object *base = *p_base;
1789         struct vmw_user_stream *stream =
1790             container_of(base, struct vmw_user_stream, base);
1791         struct vmw_resource *res = &stream->stream.res;
1792
1793         *p_base = NULL;
1794         vmw_resource_unreference(&res);
1795 }
1796
1797 int vmw_stream_unref_ioctl(struct drm_device *dev, void *data,
1798                            struct drm_file *file_priv)
1799 {
1800         struct vmw_private *dev_priv = vmw_priv(dev);
1801         struct vmw_resource *res;
1802         struct vmw_user_stream *stream;
1803         struct drm_vmw_stream_arg *arg = (struct drm_vmw_stream_arg *)data;
1804         struct ttm_object_file *tfile = vmw_fpriv(file_priv)->tfile;
1805         int ret = 0;
1806
1807         res = vmw_resource_lookup(dev_priv, &dev_priv->stream_idr, arg->stream_id);
1808         if (unlikely(res == NULL))
1809                 return -EINVAL;
1810
1811         if (res->res_free != &vmw_user_stream_free) {
1812                 ret = -EINVAL;
1813                 goto out;
1814         }
1815
1816         stream = container_of(res, struct vmw_user_stream, stream.res);
1817         if (stream->base.tfile != tfile) {
1818                 ret = -EINVAL;
1819                 goto out;
1820         }
1821
1822         ttm_ref_object_base_unref(tfile, stream->base.hash.key, TTM_REF_USAGE);
1823 out:
1824         vmw_resource_unreference(&res);
1825         return ret;
1826 }
1827
1828 int vmw_stream_claim_ioctl(struct drm_device *dev, void *data,
1829                            struct drm_file *file_priv)
1830 {
1831         struct vmw_private *dev_priv = vmw_priv(dev);
1832         struct vmw_user_stream *stream;
1833         struct vmw_resource *res;
1834         struct vmw_resource *tmp;
1835         struct drm_vmw_stream_arg *arg = (struct drm_vmw_stream_arg *)data;
1836         struct ttm_object_file *tfile = vmw_fpriv(file_priv)->tfile;
1837         struct vmw_master *vmaster = vmw_master(file_priv->master);
1838         int ret;
1839
1840         /*
1841          * Approximate idr memory usage with 128 bytes. It will be limited
1842          * by maximum number_of streams anyway?
1843          */
1844
1845         if (unlikely(vmw_user_stream_size == 0))
1846                 vmw_user_stream_size = ttm_round_pot(sizeof(*stream)) + 128;
1847
1848         ret = ttm_read_lock(&vmaster->lock, true);
1849         if (unlikely(ret != 0))
1850                 return ret;
1851
1852         ret = ttm_mem_global_alloc(vmw_mem_glob(dev_priv),
1853                                    vmw_user_stream_size,
1854                                    false, true);
1855         if (unlikely(ret != 0)) {
1856                 if (ret != -ERESTARTSYS)
1857                         DRM_ERROR("Out of graphics memory for stream"
1858                                   " creation.\n");
1859                 goto out_unlock;
1860         }
1861
1862
1863         stream = kmalloc(sizeof(*stream), GFP_KERNEL);
1864         if (unlikely(stream == NULL)) {
1865                 ttm_mem_global_free(vmw_mem_glob(dev_priv),
1866                                     vmw_user_stream_size);
1867                 ret = -ENOMEM;
1868                 goto out_unlock;
1869         }
1870
1871         res = &stream->stream.res;
1872         stream->base.shareable = false;
1873         stream->base.tfile = NULL;
1874
1875         /*
1876          * From here on, the destructor takes over resource freeing.
1877          */
1878
1879         ret = vmw_stream_init(dev_priv, &stream->stream, vmw_user_stream_free);
1880         if (unlikely(ret != 0))
1881                 goto out_unlock;
1882
1883         tmp = vmw_resource_reference(res);
1884         ret = ttm_base_object_init(tfile, &stream->base, false, VMW_RES_STREAM,
1885                                    &vmw_user_stream_base_release, NULL);
1886
1887         if (unlikely(ret != 0)) {
1888                 vmw_resource_unreference(&tmp);
1889                 goto out_err;
1890         }
1891
1892         arg->stream_id = res->id;
1893 out_err:
1894         vmw_resource_unreference(&res);
1895 out_unlock:
1896         ttm_read_unlock(&vmaster->lock);
1897         return ret;
1898 }
1899
1900 int vmw_user_stream_lookup(struct vmw_private *dev_priv,
1901                            struct ttm_object_file *tfile,
1902                            uint32_t *inout_id, struct vmw_resource **out)
1903 {
1904         struct vmw_user_stream *stream;
1905         struct vmw_resource *res;
1906         int ret;
1907
1908         res = vmw_resource_lookup(dev_priv, &dev_priv->stream_idr, *inout_id);
1909         if (unlikely(res == NULL))
1910                 return -EINVAL;
1911
1912         if (res->res_free != &vmw_user_stream_free) {
1913                 ret = -EINVAL;
1914                 goto err_ref;
1915         }
1916
1917         stream = container_of(res, struct vmw_user_stream, stream.res);
1918         if (stream->base.tfile != tfile) {
1919                 ret = -EPERM;
1920                 goto err_ref;
1921         }
1922
1923         *inout_id = stream->stream.stream_id;
1924         *out = res;
1925         return 0;
1926 err_ref:
1927         vmw_resource_unreference(&res);
1928         return ret;
1929 }