drivers/char/drm/r300_cmdbuf.c

   1 /* r300_cmdbuf.c -- Command buffer emission for R300 -*- linux-c -*-
   2  *
   3  * Copyright (C) The Weather Channel, Inc.  2002.
   4  * Copyright (C) 2004 Nicolai Haehnle.
   5  * All Rights Reserved.
   6  *
   7  * The Weather Channel (TM) funded Tungsten Graphics to develop the
   8  * initial release of the Radeon 8500 driver under the XFree86 license.
   9  * This notice must be preserved.
  10  *
  11  * Permission is hereby granted, free of charge, to any person obtaining a
  12  * copy of this software and associated documentation files (the "Software"),
  13  * to deal in the Software without restriction, including without limitation
  14  * the rights to use, copy, modify, merge, publish, distribute, sublicense,
  15  * and/or sell copies of the Software, and to permit persons to whom the
  16  * Software is furnished to do so, subject to the following conditions:
  17  *
  18  * The above copyright notice and this permission notice (including the next
  19  * paragraph) shall be included in all copies or substantial portions of the
  20  * Software.
  21  *
  22  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  23  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  24  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
  25  * PRECISION INSIGHT AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM, DAMAGES OR
  26  * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
  27  * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
  28  * DEALINGS IN THE SOFTWARE.
  29  *
  30  * Authors:
  31  *    Nicolai Haehnle <prefect_@gmx.net>
  32  */
  33
  34 #include "drmP.h"
  35 #include "drm.h"
  36 #include "radeon_drm.h"
  37 #include "radeon_drv.h"
  38 #include "r300_reg.h"
  39
  40 #define R300_SIMULTANEOUS_CLIPRECTS             4
  41
  42 /* Values for R300_RE_CLIPRECT_CNTL depending on the number of cliprects
  43  */
  44 static const int r300_cliprect_cntl[4] = {
  45         0xAAAA,
  46         0xEEEE,
  47         0xFEFE,
  48         0xFFFE
  49 };
  50
  51 /**
  52  * Emit up to R300_SIMULTANEOUS_CLIPRECTS cliprects from the given command
  53  * buffer, starting with index n.
  54  */
  55 static int r300_emit_cliprects(drm_radeon_private_t * dev_priv,
  56                                drm_radeon_cmd_buffer_t * cmdbuf, int n)
  57 {
  58         drm_clip_rect_t box;
  59         int nr;
  60         int i;
  61         RING_LOCALS;
  62
  63         nr = cmdbuf->nbox - n;
  64         if (nr > R300_SIMULTANEOUS_CLIPRECTS)
  65                 nr = R300_SIMULTANEOUS_CLIPRECTS;
  66
  67         DRM_DEBUG("%i cliprects\n", nr);
  68
  69         if (nr) {
  70                 BEGIN_RING(6 + nr * 2);
  71                 OUT_RING(CP_PACKET0(R300_RE_CLIPRECT_TL_0, nr * 2 - 1));
  72
  73                 for (i = 0; i < nr; ++i) {
  74                         if (DRM_COPY_FROM_USER_UNCHECKED
  75                             (&box, &cmdbuf->boxes[n + i], sizeof(box))) {
  76                                 DRM_ERROR("copy cliprect faulted\n");
  77                                 return DRM_ERR(EFAULT);
  78                         }
  79
  80                         box.x1 =
  81                             (box.x1 +
  82                              R300_CLIPRECT_OFFSET) & R300_CLIPRECT_MASK;
  83                         box.y1 =
  84                             (box.y1 +
  85                              R300_CLIPRECT_OFFSET) & R300_CLIPRECT_MASK;
  86                         box.x2 =
  87                             (box.x2 +
  88                              R300_CLIPRECT_OFFSET) & R300_CLIPRECT_MASK;
  89                         box.y2 =
  90                             (box.y2 +
  91                              R300_CLIPRECT_OFFSET) & R300_CLIPRECT_MASK;
  92
  93                         OUT_RING((box.x1 << R300_CLIPRECT_X_SHIFT) |
  94                                  (box.y1 << R300_CLIPRECT_Y_SHIFT));
  95                         OUT_RING((box.x2 << R300_CLIPRECT_X_SHIFT) |
  96                                  (box.y2 << R300_CLIPRECT_Y_SHIFT));
  97                 }
  98
  99                 OUT_RING_REG(R300_RE_CLIPRECT_CNTL, r300_cliprect_cntl[nr - 1]);
 100
 101                 /* TODO/SECURITY: Force scissors to a safe value, otherwise the
 102                  * client might be able to trample over memory.
 103                  * The impact should be very limited, but I'd rather be safe than
 104                  * sorry.
 105                  */
 106                 OUT_RING(CP_PACKET0(R300_RE_SCISSORS_TL, 1));
 107                 OUT_RING(0);
 108                 OUT_RING(R300_SCISSORS_X_MASK | R300_SCISSORS_Y_MASK);
 109                 ADVANCE_RING();
 110         } else {
 111                 /* Why we allow zero cliprect rendering:
 112                  * There are some commands in a command buffer that must be submitted
 113                  * even when there are no cliprects, e.g. DMA buffer discard
 114                  * or state setting (though state setting could be avoided by
 115                  * simulating a loss of context).
 116                  *
 117                  * Now since the cmdbuf interface is so chaotic right now (and is
 118                  * bound to remain that way for a bit until things settle down),
 119                  * it is basically impossible to filter out the commands that are
 120                  * necessary and those that aren't.
 121                  *
 122                  * So I choose the safe way and don't do any filtering at all;
 123                  * instead, I simply set up the engine so that all rendering
 124                  * can't produce any fragments.
 125                  */
 126                 BEGIN_RING(2);
 127                 OUT_RING_REG(R300_RE_CLIPRECT_CNTL, 0);
 128                 ADVANCE_RING();
 129         }
 130
 131         return 0;
 132 }
 133
 134 u8 r300_reg_flags[0x10000 >> 2];
 135
 136 void r300_init_reg_flags(void)
 137 {
 138         int i;
 139         memset(r300_reg_flags, 0, 0x10000 >> 2);
 140 #define ADD_RANGE_MARK(reg, count,mark) \
 141                 for(i=((reg)>>2);i<((reg)>>2)+(count);i++)\
 142                         r300_reg_flags[i]|=(mark);
 143
 144 #define MARK_SAFE               1
 145 #define MARK_CHECK_OFFSET       2
 146
 147 #define ADD_RANGE(reg, count)   ADD_RANGE_MARK(reg, count, MARK_SAFE)
 148
 149         /* these match cmducs() command in r300_driver/r300/r300_cmdbuf.c */
 150         ADD_RANGE(R300_SE_VPORT_XSCALE, 6);
 151         ADD_RANGE(0x2080, 1);
 152         ADD_RANGE(R300_SE_VTE_CNTL, 2);
 153         ADD_RANGE(0x2134, 2);
 154         ADD_RANGE(0x2140, 1);
 155         ADD_RANGE(R300_VAP_INPUT_CNTL_0, 2);
 156         ADD_RANGE(0x21DC, 1);
 157         ADD_RANGE(0x221C, 1);
 158         ADD_RANGE(0x2220, 4);
 159         ADD_RANGE(0x2288, 1);
 160         ADD_RANGE(R300_VAP_OUTPUT_VTX_FMT_0, 2);
 161         ADD_RANGE(R300_VAP_PVS_CNTL_1, 3);
 162         ADD_RANGE(R300_GB_ENABLE, 1);
 163         ADD_RANGE(R300_GB_MSPOS0, 5);
 164         ADD_RANGE(R300_TX_ENABLE, 1);
 165         ADD_RANGE(0x4200, 4);
 166         ADD_RANGE(0x4214, 1);
 167         ADD_RANGE(R300_RE_POINTSIZE, 1);
 168         ADD_RANGE(0x4230, 3);
 169         ADD_RANGE(R300_RE_LINE_CNT, 1);
 170         ADD_RANGE(0x4238, 1);
 171         ADD_RANGE(0x4260, 3);
 172         ADD_RANGE(0x4274, 4);
 173         ADD_RANGE(0x4288, 5);
 174         ADD_RANGE(0x42A0, 1);
 175         ADD_RANGE(R300_RE_ZBIAS_T_FACTOR, 4);
 176         ADD_RANGE(0x42B4, 1);
 177         ADD_RANGE(R300_RE_CULL_CNTL, 1);
 178         ADD_RANGE(0x42C0, 2);
 179         ADD_RANGE(R300_RS_CNTL_0, 2);
 180         ADD_RANGE(R300_RS_INTERP_0, 8);
 181         ADD_RANGE(R300_RS_ROUTE_0, 8);
 182         ADD_RANGE(0x43A4, 2);
 183         ADD_RANGE(0x43E8, 1);
 184         ADD_RANGE(R300_PFS_CNTL_0, 3);
 185         ADD_RANGE(R300_PFS_NODE_0, 4);
 186         ADD_RANGE(R300_PFS_TEXI_0, 64);
 187         ADD_RANGE(0x46A4, 5);
 188         ADD_RANGE(R300_PFS_INSTR0_0, 64);
 189         ADD_RANGE(R300_PFS_INSTR1_0, 64);
 190         ADD_RANGE(R300_PFS_INSTR2_0, 64);
 191         ADD_RANGE(R300_PFS_INSTR3_0, 64);
 192         ADD_RANGE(0x4BC0, 1);
 193         ADD_RANGE(0x4BC8, 3);
 194         ADD_RANGE(R300_PP_ALPHA_TEST, 2);
 195         ADD_RANGE(0x4BD8, 1);
 196         ADD_RANGE(R300_PFS_PARAM_0_X, 64);
 197         ADD_RANGE(0x4E00, 1);
 198         ADD_RANGE(R300_RB3D_CBLEND, 2);
 199         ADD_RANGE(R300_RB3D_COLORMASK, 1);
 200         ADD_RANGE(0x4E10, 3);
 201         ADD_RANGE_MARK(R300_RB3D_COLOROFFSET0, 1, MARK_CHECK_OFFSET);   /* check offset */
 202         ADD_RANGE(R300_RB3D_COLORPITCH0, 1);
 203         ADD_RANGE(0x4E50, 9);
 204         ADD_RANGE(0x4E88, 1);
 205         ADD_RANGE(0x4EA0, 2);
 206         ADD_RANGE(R300_RB3D_ZSTENCIL_CNTL_0, 3);
 207         ADD_RANGE(0x4F10, 4);
 208         ADD_RANGE_MARK(R300_RB3D_DEPTHOFFSET, 1, MARK_CHECK_OFFSET);    /* check offset */
 209         ADD_RANGE(R300_RB3D_DEPTHPITCH, 1);
 210         ADD_RANGE(0x4F28, 1);
 211         ADD_RANGE(0x4F30, 2);
 212         ADD_RANGE(0x4F44, 1);
 213         ADD_RANGE(0x4F54, 1);
 214
 215         ADD_RANGE(R300_TX_FILTER_0, 16);
 216         ADD_RANGE(R300_TX_UNK1_0, 16);
 217         ADD_RANGE(R300_TX_SIZE_0, 16);
 218         ADD_RANGE(R300_TX_FORMAT_0, 16);
 219         /* Texture offset is dangerous and needs more checking */
 220         ADD_RANGE_MARK(R300_TX_OFFSET_0, 16, MARK_CHECK_OFFSET);
 221         ADD_RANGE(R300_TX_UNK4_0, 16);
 222         ADD_RANGE(R300_TX_BORDER_COLOR_0, 16);
 223
 224         /* Sporadic registers used as primitives are emitted */
 225         ADD_RANGE(0x4f18, 1);
 226         ADD_RANGE(R300_RB3D_DSTCACHE_CTLSTAT, 1);
 227         ADD_RANGE(R300_VAP_INPUT_ROUTE_0_0, 8);
 228         ADD_RANGE(R300_VAP_INPUT_ROUTE_1_0, 8);
 229
 230 }
 231
 232 static __inline__ int r300_check_range(unsigned reg, int count)
 233 {
 234         int i;
 235         if (reg & ~0xffff)
 236                 return -1;
 237         for (i = (reg >> 2); i < (reg >> 2) + count; i++)
 238                 if (r300_reg_flags[i] != MARK_SAFE)
 239                         return 1;
 240         return 0;
 241 }
 242
 243   /* we expect offsets passed to the framebuffer to be either within video memory or
 244      within AGP space */
 245 static __inline__ int r300_check_offset(drm_radeon_private_t * dev_priv,
 246                                         u32 offset)
 247 {
 248         /* we realy want to check against end of video aperture
 249            but this value is not being kept.
 250            This code is correct for now (does the same thing as the
 251            code that sets MC_FB_LOCATION) in radeon_cp.c */
 252         if ((offset >= dev_priv->fb_location) &&
 253             (offset < dev_priv->gart_vm_start))
 254                 return 0;
 255         if ((offset >= dev_priv->gart_vm_start) &&
 256             (offset < dev_priv->gart_vm_start + dev_priv->gart_size))
 257                 return 0;
 258         return 1;
 259 }
 260
 261 static __inline__ int r300_emit_carefully_checked_packet0(drm_radeon_private_t *
 262                                                           dev_priv,
 263                                                           drm_radeon_cmd_buffer_t
 264                                                           * cmdbuf,
 265                                                           drm_r300_cmd_header_t
 266                                                           header)
 267 {
 268         int reg;
 269         int sz;
 270         int i;
 271         int values[64];
 272         RING_LOCALS;
 273
 274         sz = header.packet0.count;
 275         reg = (header.packet0.reghi << 8) | header.packet0.reglo;
 276
 277         if ((sz > 64) || (sz < 0)) {
 278                 DRM_ERROR
 279                     ("Cannot emit more than 64 values at a time (reg=%04x sz=%d)\n",
 280                      reg, sz);
 281                 return DRM_ERR(EINVAL);
 282         }
 283         for (i = 0; i < sz; i++) {
 284                 values[i] = ((int __user *)cmdbuf->buf)[i];
 285                 switch (r300_reg_flags[(reg >> 2) + i]) {
 286                 case MARK_SAFE:
 287                         break;
 288                 case MARK_CHECK_OFFSET:
 289                         if (r300_check_offset(dev_priv, (u32) values[i])) {
 290                                 DRM_ERROR
 291                                     ("Offset failed range check (reg=%04x sz=%d)\n",
 292                                      reg, sz);
 293                                 return DRM_ERR(EINVAL);
 294                         }
 295                         break;
 296                 default:
 297                         DRM_ERROR("Register %04x failed check as flag=%02x\n",
 298                                   reg + i * 4, r300_reg_flags[(reg >> 2) + i]);
 299                         return DRM_ERR(EINVAL);
 300                 }
 301         }
 302
 303         BEGIN_RING(1 + sz);
 304         OUT_RING(CP_PACKET0(reg, sz - 1));
 305         OUT_RING_TABLE(values, sz);
 306         ADVANCE_RING();
 307
 308         cmdbuf->buf += sz * 4;
 309         cmdbuf->bufsz -= sz * 4;
 310
 311         return 0;
 312 }
 313
 314 /**
 315  * Emits a packet0 setting arbitrary registers.
 316  * Called by r300_do_cp_cmdbuf.
 317  *
 318  * Note that checks are performed on contents and addresses of the registers
 319  */
 320 static __inline__ int r300_emit_packet0(drm_radeon_private_t * dev_priv,
 321                                         drm_radeon_cmd_buffer_t * cmdbuf,
 322                                         drm_r300_cmd_header_t header)
 323 {
 324         int reg;
 325         int sz;
 326         RING_LOCALS;
 327
 328         sz = header.packet0.count;
 329         reg = (header.packet0.reghi << 8) | header.packet0.reglo;
 330
 331         if (!sz)
 332                 return 0;
 333
 334         if (sz * 4 > cmdbuf->bufsz)
 335                 return DRM_ERR(EINVAL);
 336
 337         if (reg + sz * 4 >= 0x10000) {
 338                 DRM_ERROR("No such registers in hardware reg=%04x sz=%d\n", reg,
 339                           sz);
 340                 return DRM_ERR(EINVAL);
 341         }
 342
 343         if (r300_check_range(reg, sz)) {
 344                 /* go and check everything */
 345                 return r300_emit_carefully_checked_packet0(dev_priv, cmdbuf,
 346                                                            header);
 347         }
 348         /* the rest of the data is safe to emit, whatever the values the user passed */
 349
 350         BEGIN_RING(1 + sz);
 351         OUT_RING(CP_PACKET0(reg, sz - 1));
 352         OUT_RING_TABLE((int __user *)cmdbuf->buf, sz);
 353         ADVANCE_RING();
 354
 355         cmdbuf->buf += sz * 4;
 356         cmdbuf->bufsz -= sz * 4;
 357
 358         return 0;
 359 }
 360
 361 /**
 362  * Uploads user-supplied vertex program instructions or parameters onto
 363  * the graphics card.
 364  * Called by r300_do_cp_cmdbuf.
 365  */
 366 static __inline__ int r300_emit_vpu(drm_radeon_private_t * dev_priv,
 367                                     drm_radeon_cmd_buffer_t * cmdbuf,
 368                                     drm_r300_cmd_header_t header)
 369 {
 370         int sz;
 371         int addr;
 372         RING_LOCALS;
 373
 374         sz = header.vpu.count;
 375         addr = (header.vpu.adrhi << 8) | header.vpu.adrlo;
 376
 377         if (!sz)
 378                 return 0;
 379         if (sz * 16 > cmdbuf->bufsz)
 380                 return DRM_ERR(EINVAL);
 381
 382         BEGIN_RING(5 + sz * 4);
 383         /* Wait for VAP to come to senses.. */
 384         /* there is no need to emit it multiple times, (only once before VAP is programmed,
 385            but this optimization is for later */
 386         OUT_RING_REG(R300_VAP_PVS_WAITIDLE, 0);
 387         OUT_RING_REG(R300_VAP_PVS_UPLOAD_ADDRESS, addr);
 388         OUT_RING(CP_PACKET0_TABLE(R300_VAP_PVS_UPLOAD_DATA, sz * 4 - 1));
 389         OUT_RING_TABLE((int __user *)cmdbuf->buf, sz * 4);
 390
 391         ADVANCE_RING();
 392
 393         cmdbuf->buf += sz * 16;
 394         cmdbuf->bufsz -= sz * 16;
 395
 396         return 0;
 397 }
 398
 399 /**
 400  * Emit a clear packet from userspace.
 401  * Called by r300_emit_packet3.
 402  */
 403 static __inline__ int r300_emit_clear(drm_radeon_private_t * dev_priv,
 404                                       drm_radeon_cmd_buffer_t * cmdbuf)
 405 {
 406         RING_LOCALS;
 407
 408         if (8 * 4 > cmdbuf->bufsz)
 409                 return DRM_ERR(EINVAL);
 410
 411         BEGIN_RING(10);
 412         OUT_RING(CP_PACKET3(R200_3D_DRAW_IMMD_2, 8));
 413         OUT_RING(R300_PRIM_TYPE_POINT | R300_PRIM_WALK_RING |
 414                  (1 << R300_PRIM_NUM_VERTICES_SHIFT));
 415         OUT_RING_TABLE((int __user *)cmdbuf->buf, 8);
 416         ADVANCE_RING();
 417
 418         cmdbuf->buf += 8 * 4;
 419         cmdbuf->bufsz -= 8 * 4;
 420
 421         return 0;
 422 }
 423
 424 static __inline__ int r300_emit_3d_load_vbpntr(drm_radeon_private_t * dev_priv,
 425                                                drm_radeon_cmd_buffer_t * cmdbuf,
 426                                                u32 header)
 427 {
 428         int count, i, k;
 429 #define MAX_ARRAY_PACKET  64
 430         u32 payload[MAX_ARRAY_PACKET];
 431         u32 narrays;
 432         RING_LOCALS;
 433
 434         count = (header >> 16) & 0x3fff;
 435
 436         if ((count + 1) > MAX_ARRAY_PACKET) {
 437                 DRM_ERROR("Too large payload in 3D_LOAD_VBPNTR (count=%d)\n",
 438                           count);
 439                 return DRM_ERR(EINVAL);
 440         }
 441         memset(payload, 0, MAX_ARRAY_PACKET * 4);
 442         memcpy(payload, cmdbuf->buf + 4, (count + 1) * 4);
 443
 444         /* carefully check packet contents */
 445
 446         narrays = payload[0];
 447         k = 0;
 448         i = 1;
 449         while ((k < narrays) && (i < (count + 1))) {
 450                 i++;            /* skip attribute field */
 451                 if (r300_check_offset(dev_priv, payload[i])) {
 452                         DRM_ERROR
 453                             ("Offset failed range check (k=%d i=%d) while processing 3D_LOAD_VBPNTR packet.\n",
 454                              k, i);
 455                         return DRM_ERR(EINVAL);
 456                 }
 457                 k++;
 458                 i++;
 459                 if (k == narrays)
 460                         break;
 461                 /* have one more to process, they come in pairs */
 462                 if (r300_check_offset(dev_priv, payload[i])) {
 463                         DRM_ERROR
 464                             ("Offset failed range check (k=%d i=%d) while processing 3D_LOAD_VBPNTR packet.\n",
 465                              k, i);
 466                         return DRM_ERR(EINVAL);
 467                 }
 468                 k++;
 469                 i++;
 470         }
 471         /* do the counts match what we expect ? */
 472         if ((k != narrays) || (i != (count + 1))) {
 473                 DRM_ERROR
 474                     ("Malformed 3D_LOAD_VBPNTR packet (k=%d i=%d narrays=%d count+1=%d).\n",
 475                      k, i, narrays, count + 1);
 476                 return DRM_ERR(EINVAL);
 477         }
 478
 479         /* all clear, output packet */
 480
 481         BEGIN_RING(count + 2);
 482         OUT_RING(header);
 483         OUT_RING_TABLE(payload, count + 1);
 484         ADVANCE_RING();
 485
 486         cmdbuf->buf += (count + 2) * 4;
 487         cmdbuf->bufsz -= (count + 2) * 4;
 488
 489         return 0;
 490 }
 491
 492 static __inline__ int r300_emit_raw_packet3(drm_radeon_private_t * dev_priv,
 493                                             drm_radeon_cmd_buffer_t * cmdbuf)
 494 {
 495         u32 header;
 496         int count;
 497         RING_LOCALS;
 498
 499         if (4 > cmdbuf->bufsz)
 500                 return DRM_ERR(EINVAL);
 501
 502         /* Fixme !! This simply emits a packet without much checking.
 503            We need to be smarter. */
 504
 505         /* obtain first word - actual packet3 header */
 506         header = *(u32 __user *) cmdbuf->buf;
 507
 508         /* Is it packet 3 ? */
 509         if ((header >> 30) != 0x3) {
 510                 DRM_ERROR("Not a packet3 header (0x%08x)\n", header);
 511                 return DRM_ERR(EINVAL);
 512         }
 513
 514         count = (header >> 16) & 0x3fff;
 515
 516         /* Check again now that we know how much data to expect */
 517         if ((count + 2) * 4 > cmdbuf->bufsz) {
 518                 DRM_ERROR
 519                     ("Expected packet3 of length %d but have only %d bytes left\n",
 520                      (count + 2) * 4, cmdbuf->bufsz);
 521                 return DRM_ERR(EINVAL);
 522         }
 523
 524         /* Is it a packet type we know about ? */
 525         switch (header & 0xff00) {
 526         case RADEON_3D_LOAD_VBPNTR:     /* load vertex array pointers */
 527                 return r300_emit_3d_load_vbpntr(dev_priv, cmdbuf, header);
 528
 529         case RADEON_CP_3D_DRAW_IMMD_2:  /* triggers drawing using in-packet vertex data */
 530         case RADEON_CP_3D_DRAW_VBUF_2:  /* triggers drawing of vertex buffers setup elsewhere */
 531         case RADEON_CP_3D_DRAW_INDX_2:  /* triggers drawing using indices to vertex buffer */
 532         case RADEON_CP_INDX_BUFFER:     /* DRAW_INDX_2 without INDX_BUFFER seems to lock up the gpu */
 533         case RADEON_WAIT_FOR_IDLE:
 534         case RADEON_CP_NOP:
 535                 /* these packets are safe */
 536                 break;
 537         default:
 538                 DRM_ERROR("Unknown packet3 header (0x%08x)\n", header);
 539                 return DRM_ERR(EINVAL);
 540         }
 541
 542         BEGIN_RING(count + 2);
 543         OUT_RING(header);
 544         OUT_RING_TABLE((int __user *)(cmdbuf->buf + 4), count + 1);
 545         ADVANCE_RING();
 546
 547         cmdbuf->buf += (count + 2) * 4;
 548         cmdbuf->bufsz -= (count + 2) * 4;
 549
 550         return 0;
 551 }
 552
 553 /**
 554  * Emit a rendering packet3 from userspace.
 555  * Called by r300_do_cp_cmdbuf.
 556  */
 557 static __inline__ int r300_emit_packet3(drm_radeon_private_t * dev_priv,
 558                                         drm_radeon_cmd_buffer_t * cmdbuf,
 559                                         drm_r300_cmd_header_t header)
 560 {
 561         int n;
 562         int ret;
 563         char __user *orig_buf = cmdbuf->buf;
 564         int orig_bufsz = cmdbuf->bufsz;
 565
 566         /* This is a do-while-loop so that we run the interior at least once,
 567          * even if cmdbuf->nbox is 0. Compare r300_emit_cliprects for rationale.
 568          */
 569         n = 0;
 570         do {
 571                 if (cmdbuf->nbox > R300_SIMULTANEOUS_CLIPRECTS) {
 572                         ret = r300_emit_cliprects(dev_priv, cmdbuf, n);
 573                         if (ret)
 574                                 return ret;
 575
 576                         cmdbuf->buf = orig_buf;
 577                         cmdbuf->bufsz = orig_bufsz;
 578                 }
 579
 580                 switch (header.packet3.packet) {
 581                 case R300_CMD_PACKET3_CLEAR:
 582                         DRM_DEBUG("R300_CMD_PACKET3_CLEAR\n");
 583                         ret = r300_emit_clear(dev_priv, cmdbuf);
 584                         if (ret) {
 585                                 DRM_ERROR("r300_emit_clear failed\n");
 586                                 return ret;
 587                         }
 588                         break;
 589
 590                 case R300_CMD_PACKET3_RAW:
 591                         DRM_DEBUG("R300_CMD_PACKET3_RAW\n");
 592                         ret = r300_emit_raw_packet3(dev_priv, cmdbuf);
 593                         if (ret) {
 594                                 DRM_ERROR("r300_emit_raw_packet3 failed\n");
 595                                 return ret;
 596                         }
 597                         break;
 598
 599                 default:
 600                         DRM_ERROR("bad packet3 type %i at %p\n",
 601                                   header.packet3.packet,
 602                                   cmdbuf->buf - sizeof(header));
 603                         return DRM_ERR(EINVAL);
 604                 }
 605
 606                 n += R300_SIMULTANEOUS_CLIPRECTS;
 607         } while (n < cmdbuf->nbox);
 608
 609         return 0;
 610 }
 611
 612 /* Some of the R300 chips seem to be extremely touchy about the two registers
 613  * that are configured in r300_pacify.
 614  * Among the worst offenders seems to be the R300 ND (0x4E44): When userspace
 615  * sends a command buffer that contains only state setting commands and a
 616  * vertex program/parameter upload sequence, this will eventually lead to a
 617  * lockup, unless the sequence is bracketed by calls to r300_pacify.
 618  * So we should take great care to *always* call r300_pacify before
 619  * *anything* 3D related, and again afterwards. This is what the
 620  * call bracket in r300_do_cp_cmdbuf is for.
 621  */
 622
 623 /**
 624  * Emit the sequence to pacify R300.
 625  */
 626 static __inline__ void r300_pacify(drm_radeon_private_t * dev_priv)
 627 {
 628         RING_LOCALS;
 629
 630         BEGIN_RING(6);
 631         OUT_RING(CP_PACKET0(R300_RB3D_DSTCACHE_CTLSTAT, 0));
 632         OUT_RING(0xa);
 633         OUT_RING(CP_PACKET0(0x4f18, 0));
 634         OUT_RING(0x3);
 635         OUT_RING(CP_PACKET3(RADEON_CP_NOP, 0));
 636         OUT_RING(0x0);
 637         ADVANCE_RING();
 638 }
 639
 640 /**
 641  * Called by r300_do_cp_cmdbuf to update the internal buffer age and state.
 642  * The actual age emit is done by r300_do_cp_cmdbuf, which is why you must
 643  * be careful about how this function is called.
 644  */
 645 static void r300_discard_buffer(drm_device_t * dev, drm_buf_t * buf)
 646 {
 647         drm_radeon_private_t *dev_priv = dev->dev_private;
 648         drm_radeon_buf_priv_t *buf_priv = buf->dev_private;
 649
 650         buf_priv->age = ++dev_priv->sarea_priv->last_dispatch;
 651         buf->pending = 1;
 652         buf->used = 0;
 653 }
 654
 655 /**
 656  * Parses and validates a user-supplied command buffer and emits appropriate
 657  * commands on the DMA ring buffer.
 658  * Called by the ioctl handler function radeon_cp_cmdbuf.
 659  */
 660 int r300_do_cp_cmdbuf(drm_device_t * dev,
 661                       DRMFILE filp,
 662                       drm_file_t * filp_priv, drm_radeon_cmd_buffer_t * cmdbuf)
 663 {
 664         drm_radeon_private_t *dev_priv = dev->dev_private;
 665         drm_device_dma_t *dma = dev->dma;
 666         drm_buf_t *buf = NULL;
 667         int emit_dispatch_age = 0;
 668         int ret = 0;
 669
 670         DRM_DEBUG("\n");
 671
 672         /* See the comment above r300_emit_begin3d for why this call must be here,
 673          * and what the cleanup gotos are for. */
 674         r300_pacify(dev_priv);
 675
 676         if (cmdbuf->nbox <= R300_SIMULTANEOUS_CLIPRECTS) {
 677                 ret = r300_emit_cliprects(dev_priv, cmdbuf, 0);
 678                 if (ret)
 679                         goto cleanup;
 680         }
 681
 682         while (cmdbuf->bufsz >= sizeof(drm_r300_cmd_header_t)) {
 683                 int idx;
 684                 drm_r300_cmd_header_t header;
 685
 686                 header.u = *(unsigned int *)cmdbuf->buf;
 687
 688                 cmdbuf->buf += sizeof(header);
 689                 cmdbuf->bufsz -= sizeof(header);
 690
 691                 switch (header.header.cmd_type) {
 692                 case R300_CMD_PACKET0:
 693                         DRM_DEBUG("R300_CMD_PACKET0\n");
 694                         ret = r300_emit_packet0(dev_priv, cmdbuf, header);
 695                         if (ret) {
 696                                 DRM_ERROR("r300_emit_packet0 failed\n");
 697                                 goto cleanup;
 698                         }
 699                         break;
 700
 701                 case R300_CMD_VPU:
 702                         DRM_DEBUG("R300_CMD_VPU\n");
 703                         ret = r300_emit_vpu(dev_priv, cmdbuf, header);
 704                         if (ret) {
 705                                 DRM_ERROR("r300_emit_vpu failed\n");
 706                                 goto cleanup;
 707                         }
 708                         break;
 709
 710                 case R300_CMD_PACKET3:
 711                         DRM_DEBUG("R300_CMD_PACKET3\n");
 712                         ret = r300_emit_packet3(dev_priv, cmdbuf, header);
 713                         if (ret) {
 714                                 DRM_ERROR("r300_emit_packet3 failed\n");
 715                                 goto cleanup;
 716                         }
 717                         break;
 718
 719                 case R300_CMD_END3D:
 720                         DRM_DEBUG("R300_CMD_END3D\n");
 721                         /* TODO:
 722                            Ideally userspace driver should not need to issue this call,
 723                            i.e. the drm driver should issue it automatically and prevent
 724                            lockups.
 725
 726                            In practice, we do not understand why this call is needed and what
 727                            it does (except for some vague guesses that it has to do with cache
 728                            coherence) and so the user space driver does it.
 729
 730                            Once we are sure which uses prevent lockups the code could be moved
 731                            into the kernel and the userspace driver will not
 732                            need to use this command.
 733
 734                            Note that issuing this command does not hurt anything
 735                            except, possibly, performance */
 736                         r300_pacify(dev_priv);
 737                         break;
 738
 739                 case R300_CMD_CP_DELAY:
 740                         /* simple enough, we can do it here */
 741                         DRM_DEBUG("R300_CMD_CP_DELAY\n");
 742                         {
 743                                 int i;
 744                                 RING_LOCALS;
 745
 746                                 BEGIN_RING(header.delay.count);
 747                                 for (i = 0; i < header.delay.count; i++)
 748                                         OUT_RING(RADEON_CP_PACKET2);
 749                                 ADVANCE_RING();
 750                         }
 751                         break;
 752
 753                 case R300_CMD_DMA_DISCARD:
 754                         DRM_DEBUG("RADEON_CMD_DMA_DISCARD\n");
 755                         idx = header.dma.buf_idx;
 756                         if (idx < 0 || idx >= dma->buf_count) {
 757                                 DRM_ERROR("buffer index %d (of %d max)\n",
 758                                           idx, dma->buf_count - 1);
 759                                 ret = DRM_ERR(EINVAL);
 760                                 goto cleanup;
 761                         }
 762
 763                         buf = dma->buflist[idx];
 764                         if (buf->filp != filp || buf->pending) {
 765                                 DRM_ERROR("bad buffer %p %p %d\n",
 766                                           buf->filp, filp, buf->pending);
 767                                 ret = DRM_ERR(EINVAL);
 768                                 goto cleanup;
 769                         }
 770
 771                         emit_dispatch_age = 1;
 772                         r300_discard_buffer(dev, buf);
 773                         break;
 774
 775                 case R300_CMD_WAIT:
 776                         /* simple enough, we can do it here */
 777                         DRM_DEBUG("R300_CMD_WAIT\n");
 778                         if (header.wait.flags == 0)
 779                                 break;  /* nothing to do */
 780
 781                         {
 782                                 RING_LOCALS;
 783
 784                                 BEGIN_RING(2);
 785                                 OUT_RING(CP_PACKET0(RADEON_WAIT_UNTIL, 0));
 786                                 OUT_RING((header.wait.flags & 0xf) << 14);
 787                                 ADVANCE_RING();
 788                         }
 789                         break;
 790
 791                 default:
 792                         DRM_ERROR("bad cmd_type %i at %p\n",
 793                                   header.header.cmd_type,
 794                                   cmdbuf->buf - sizeof(header));
 795                         ret = DRM_ERR(EINVAL);
 796                         goto cleanup;
 797                 }
 798         }
 799
 800         DRM_DEBUG("END\n");
 801
 802       cleanup:
 803         r300_pacify(dev_priv);
 804
 805         /* We emit the vertex buffer age here, outside the pacifier "brackets"
 806          * for two reasons:
 807          *  (1) This may coalesce multiple age emissions into a single one and
 808          *  (2) more importantly, some chips lock up hard when scratch registers
 809          *      are written inside the pacifier bracket.
 810          */
 811         if (emit_dispatch_age) {
 812                 RING_LOCALS;
 813
 814                 /* Emit the vertex buffer age */
 815                 BEGIN_RING(2);
 816                 RADEON_DISPATCH_AGE(dev_priv->sarea_priv->last_dispatch);
 817                 ADVANCE_RING();
 818         }
 819
 820         COMMIT_RING();
 821
 822         return ret;
 823 }