1 // SPDX-License-Identifier: GPL-2.0 OR MIT
2 /**************************************************************************
3  *
4  * Copyright 2009-2015 VMware, Inc., Palo Alto, CA., USA
5  *
6  * Permission is hereby granted, free of charge, to any person obtaining a
7  * copy of this software and associated documentation files (the
8  * "Software"), to deal in the Software without restriction, including
9  * without limitation the rights to use, copy, modify, merge, publish,
10  * distribute, sub license, and/or sell copies of the Software, and to
11  * permit persons to whom the Software is furnished to do so, subject to
12  * the following conditions:
13  *
14  * The above copyright notice and this permission notice (including the
15  * next paragraph) shall be included in all copies or substantial portions
16  * of the Software.
17  *
18  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
19  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
20  * FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. IN NO EVENT SHALL
21  * THE COPYRIGHT HOLDERS, AUTHORS AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM,
22  * DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
23  * OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
24  * USE OR OTHER DEALINGS IN THE SOFTWARE.
25  *
26  **************************************************************************/
27 
28 #include <drm/ttm/ttm_placement.h>
29 
30 #include "vmwgfx_drv.h"
31 #include "vmwgfx_resource_priv.h"
32 #include "vmwgfx_so.h"
33 #include "vmwgfx_binding.h"
34 #include "vmw_surface_cache.h"
35 #include "device_include/svga3d_surfacedefs.h"
36 
37 #define SVGA3D_FLAGS_64(upper32, lower32) (((uint64_t)upper32 << 32) | lower32)
38 #define SVGA3D_FLAGS_UPPER_32(svga3d_flags) (svga3d_flags >> 32)
39 #define SVGA3D_FLAGS_LOWER_32(svga3d_flags) \
40 	(svga3d_flags & ((uint64_t)U32_MAX))
41 
42 /**
43  * struct vmw_user_surface - User-space visible surface resource
44  *
45  * @prime:          The TTM prime object.
46  * @base:           The TTM base object handling user-space visibility.
47  * @srf:            The surface metadata.
48  * @master:         Master of the creating client. Used for security check.
49  */
50 struct vmw_user_surface {
51 	struct ttm_prime_object prime;
52 	struct vmw_surface srf;
53 	struct drm_master *master;
54 };
55 
56 /**
57  * struct vmw_surface_offset - Backing store mip level offset info
58  *
59  * @face:           Surface face.
60  * @mip:            Mip level.
61  * @bo_offset:      Offset into backing store of this mip level.
62  *
63  */
64 struct vmw_surface_offset {
65 	uint32_t face;
66 	uint32_t mip;
67 	uint32_t bo_offset;
68 };
69 
70 /**
71  * struct vmw_surface_dirty - Surface dirty-tracker
72  * @cache: Cached layout information of the surface.
73  * @num_subres: Number of subresources.
74  * @boxes: Array of SVGA3dBoxes indicating dirty regions. One per subresource.
75  */
76 struct vmw_surface_dirty {
77 	struct vmw_surface_cache cache;
78 	u32 num_subres;
79 	SVGA3dBox boxes[];
80 };
81 
82 static void vmw_user_surface_free(struct vmw_resource *res);
83 static struct vmw_resource *
84 vmw_user_surface_base_to_res(struct ttm_base_object *base);
85 static int vmw_legacy_srf_bind(struct vmw_resource *res,
86 			       struct ttm_validate_buffer *val_buf);
87 static int vmw_legacy_srf_unbind(struct vmw_resource *res,
88 				 bool readback,
89 				 struct ttm_validate_buffer *val_buf);
90 static int vmw_legacy_srf_create(struct vmw_resource *res);
91 static int vmw_legacy_srf_destroy(struct vmw_resource *res);
92 static int vmw_gb_surface_create(struct vmw_resource *res);
93 static int vmw_gb_surface_bind(struct vmw_resource *res,
94 			       struct ttm_validate_buffer *val_buf);
95 static int vmw_gb_surface_unbind(struct vmw_resource *res,
96 				 bool readback,
97 				 struct ttm_validate_buffer *val_buf);
98 static int vmw_gb_surface_destroy(struct vmw_resource *res);
99 static int
100 vmw_gb_surface_define_internal(struct drm_device *dev,
101 			       struct drm_vmw_gb_surface_create_ext_req *req,
102 			       struct drm_vmw_gb_surface_create_rep *rep,
103 			       struct drm_file *file_priv);
104 static int
105 vmw_gb_surface_reference_internal(struct drm_device *dev,
106 				  struct drm_vmw_surface_arg *req,
107 				  struct drm_vmw_gb_surface_ref_ext_rep *rep,
108 				  struct drm_file *file_priv);
109 
110 static void vmw_surface_dirty_free(struct vmw_resource *res);
111 static int vmw_surface_dirty_alloc(struct vmw_resource *res);
112 static int vmw_surface_dirty_sync(struct vmw_resource *res);
113 static void vmw_surface_dirty_range_add(struct vmw_resource *res, size_t start,
114 					size_t end);
115 static int vmw_surface_clean(struct vmw_resource *res);
116 
117 static const struct vmw_user_resource_conv user_surface_conv = {
118 	.object_type = VMW_RES_SURFACE,
119 	.base_obj_to_res = vmw_user_surface_base_to_res,
120 	.res_free = vmw_user_surface_free
121 };
122 
123 const struct vmw_user_resource_conv *user_surface_converter =
124 	&user_surface_conv;
125 
126 static const struct vmw_res_func vmw_legacy_surface_func = {
127 	.res_type = vmw_res_surface,
128 	.needs_backup = false,
129 	.may_evict = true,
130 	.prio = 1,
131 	.dirty_prio = 1,
132 	.type_name = "legacy surfaces",
133 	.backup_placement = &vmw_srf_placement,
134 	.create = &vmw_legacy_srf_create,
135 	.destroy = &vmw_legacy_srf_destroy,
136 	.bind = &vmw_legacy_srf_bind,
137 	.unbind = &vmw_legacy_srf_unbind
138 };
139 
140 static const struct vmw_res_func vmw_gb_surface_func = {
141 	.res_type = vmw_res_surface,
142 	.needs_backup = true,
143 	.may_evict = true,
144 	.prio = 1,
145 	.dirty_prio = 2,
146 	.type_name = "guest backed surfaces",
147 	.backup_placement = &vmw_mob_placement,
148 	.create = vmw_gb_surface_create,
149 	.destroy = vmw_gb_surface_destroy,
150 	.bind = vmw_gb_surface_bind,
151 	.unbind = vmw_gb_surface_unbind,
152 	.dirty_alloc = vmw_surface_dirty_alloc,
153 	.dirty_free = vmw_surface_dirty_free,
154 	.dirty_sync = vmw_surface_dirty_sync,
155 	.dirty_range_add = vmw_surface_dirty_range_add,
156 	.clean = vmw_surface_clean,
157 };
158 
159 /*
160  * struct vmw_surface_dma - SVGA3D DMA command
161  */
162 struct vmw_surface_dma {
163 	SVGA3dCmdHeader header;
164 	SVGA3dCmdSurfaceDMA body;
165 	SVGA3dCopyBox cb;
166 	SVGA3dCmdSurfaceDMASuffix suffix;
167 };
168 
169 /*
170  * struct vmw_surface_define - SVGA3D Surface Define command
171  */
172 struct vmw_surface_define {
173 	SVGA3dCmdHeader header;
174 	SVGA3dCmdDefineSurface body;
175 };
176 
177 /*
178  * struct vmw_surface_destroy - SVGA3D Surface Destroy command
179  */
180 struct vmw_surface_destroy {
181 	SVGA3dCmdHeader header;
182 	SVGA3dCmdDestroySurface body;
183 };
184 
185 
186 /**
187  * vmw_surface_dma_size - Compute fifo size for a dma command.
188  *
189  * @srf: Pointer to a struct vmw_surface
190  *
191  * Computes the required size for a surface dma command for backup or
192  * restoration of the surface represented by @srf.
193  */
194 static inline uint32_t vmw_surface_dma_size(const struct vmw_surface *srf)
195 {
196 	return srf->metadata.num_sizes * sizeof(struct vmw_surface_dma);
197 }
198 
199 
200 /**
201  * vmw_surface_define_size - Compute fifo size for a surface define command.
202  *
203  * @srf: Pointer to a struct vmw_surface
204  *
205  * Computes the required size for a surface define command for the definition
206  * of the surface represented by @srf.
207  */
208 static inline uint32_t vmw_surface_define_size(const struct vmw_surface *srf)
209 {
210 	return sizeof(struct vmw_surface_define) + srf->metadata.num_sizes *
211 		sizeof(SVGA3dSize);
212 }
213 
214 
215 /**
216  * vmw_surface_destroy_size - Compute fifo size for a surface destroy command.
217  *
218  * Computes the required size for a surface destroy command for the destruction
219  * of a hw surface.
220  */
221 static inline uint32_t vmw_surface_destroy_size(void)
222 {
223 	return sizeof(struct vmw_surface_destroy);
224 }
225 
226 /**
227  * vmw_surface_destroy_encode - Encode a surface_destroy command.
228  *
229  * @id: The surface id
230  * @cmd_space: Pointer to memory area in which the commands should be encoded.
231  */
232 static void vmw_surface_destroy_encode(uint32_t id,
233 				       void *cmd_space)
234 {
235 	struct vmw_surface_destroy *cmd = (struct vmw_surface_destroy *)
236 		cmd_space;
237 
238 	cmd->header.id = SVGA_3D_CMD_SURFACE_DESTROY;
239 	cmd->header.size = sizeof(cmd->body);
240 	cmd->body.sid = id;
241 }
242 
243 /**
244  * vmw_surface_define_encode - Encode a surface_define command.
245  *
246  * @srf: Pointer to a struct vmw_surface object.
247  * @cmd_space: Pointer to memory area in which the commands should be encoded.
248  */
249 static void vmw_surface_define_encode(const struct vmw_surface *srf,
250 				      void *cmd_space)
251 {
252 	struct vmw_surface_define *cmd = (struct vmw_surface_define *)
253 		cmd_space;
254 	struct drm_vmw_size *src_size;
255 	SVGA3dSize *cmd_size;
256 	uint32_t cmd_len;
257 	int i;
258 
259 	cmd_len = sizeof(cmd->body) + srf->metadata.num_sizes *
260 		sizeof(SVGA3dSize);
261 
262 	cmd->header.id = SVGA_3D_CMD_SURFACE_DEFINE;
263 	cmd->header.size = cmd_len;
264 	cmd->body.sid = srf->res.id;
265 	/*
266 	 * Downcast of surfaceFlags, was upcasted when received from user-space,
267 	 * since driver internally stores as 64 bit.
268 	 * For legacy surface define only 32 bit flag is supported.
269 	 */
270 	cmd->body.surfaceFlags = (SVGA3dSurface1Flags)srf->metadata.flags;
271 	cmd->body.format = srf->metadata.format;
272 	for (i = 0; i < DRM_VMW_MAX_SURFACE_FACES; ++i)
273 		cmd->body.face[i].numMipLevels = srf->metadata.mip_levels[i];
274 
275 	cmd += 1;
276 	cmd_size = (SVGA3dSize *) cmd;
277 	src_size = srf->metadata.sizes;
278 
279 	for (i = 0; i < srf->metadata.num_sizes; ++i, cmd_size++, src_size++) {
280 		cmd_size->width = src_size->width;
281 		cmd_size->height = src_size->height;
282 		cmd_size->depth = src_size->depth;
283 	}
284 }
285 
286 /**
287  * vmw_surface_dma_encode - Encode a surface_dma command.
288  *
289  * @srf: Pointer to a struct vmw_surface object.
290  * @cmd_space: Pointer to memory area in which the commands should be encoded.
291  * @ptr: Pointer to an SVGAGuestPtr indicating where the surface contents
292  * should be placed or read from.
293  * @to_surface: Boolean whether to DMA to the surface or from the surface.
294  */
295 static void vmw_surface_dma_encode(struct vmw_surface *srf,
296 				   void *cmd_space,
297 				   const SVGAGuestPtr *ptr,
298 				   bool to_surface)
299 {
300 	uint32_t i;
301 	struct vmw_surface_dma *cmd = (struct vmw_surface_dma *)cmd_space;
302 	const struct SVGA3dSurfaceDesc *desc =
303 		vmw_surface_get_desc(srf->metadata.format);
304 
305 	for (i = 0; i < srf->metadata.num_sizes; ++i) {
306 		SVGA3dCmdHeader *header = &cmd->header;
307 		SVGA3dCmdSurfaceDMA *body = &cmd->body;
308 		SVGA3dCopyBox *cb = &cmd->cb;
309 		SVGA3dCmdSurfaceDMASuffix *suffix = &cmd->suffix;
310 		const struct vmw_surface_offset *cur_offset = &srf->offsets[i];
311 		const struct drm_vmw_size *cur_size = &srf->metadata.sizes[i];
312 
313 		header->id = SVGA_3D_CMD_SURFACE_DMA;
314 		header->size = sizeof(*body) + sizeof(*cb) + sizeof(*suffix);
315 
316 		body->guest.ptr = *ptr;
317 		body->guest.ptr.offset += cur_offset->bo_offset;
318 		body->guest.pitch = vmw_surface_calculate_pitch(desc, cur_size);
319 		body->host.sid = srf->res.id;
320 		body->host.face = cur_offset->face;
321 		body->host.mipmap = cur_offset->mip;
322 		body->transfer = ((to_surface) ?  SVGA3D_WRITE_HOST_VRAM :
323 				  SVGA3D_READ_HOST_VRAM);
324 		cb->x = 0;
325 		cb->y = 0;
326 		cb->z = 0;
327 		cb->srcx = 0;
328 		cb->srcy = 0;
329 		cb->srcz = 0;
330 		cb->w = cur_size->width;
331 		cb->h = cur_size->height;
332 		cb->d = cur_size->depth;
333 
334 		suffix->suffixSize = sizeof(*suffix);
335 		suffix->maximumOffset =
336 			vmw_surface_get_image_buffer_size(desc, cur_size,
337 							    body->guest.pitch);
338 		suffix->flags.discard = 0;
339 		suffix->flags.unsynchronized = 0;
340 		suffix->flags.reserved = 0;
341 		++cmd;
342 	}
343 };
344 
345 
346 /**
347  * vmw_hw_surface_destroy - destroy a Device surface
348  *
349  * @res:        Pointer to a struct vmw_resource embedded in a struct
350  *              vmw_surface.
351  *
352  * Destroys a the device surface associated with a struct vmw_surface if
353  * any, and adjusts resource count accordingly.
354  */
355 static void vmw_hw_surface_destroy(struct vmw_resource *res)
356 {
357 
358 	struct vmw_private *dev_priv = res->dev_priv;
359 	void *cmd;
360 
361 	if (res->func->destroy == vmw_gb_surface_destroy) {
362 		(void) vmw_gb_surface_destroy(res);
363 		return;
364 	}
365 
366 	if (res->id != -1) {
367 
368 		cmd = VMW_CMD_RESERVE(dev_priv, vmw_surface_destroy_size());
369 		if (unlikely(!cmd))
370 			return;
371 
372 		vmw_surface_destroy_encode(res->id, cmd);
373 		vmw_cmd_commit(dev_priv, vmw_surface_destroy_size());
374 
375 		/*
376 		 * used_memory_size_atomic, or separate lock
377 		 * to avoid taking dev_priv::cmdbuf_mutex in
378 		 * the destroy path.
379 		 */
380 
381 		mutex_lock(&dev_priv->cmdbuf_mutex);
382 		dev_priv->used_memory_size -= res->backup_size;
383 		mutex_unlock(&dev_priv->cmdbuf_mutex);
384 	}
385 }
386 
387 /**
388  * vmw_legacy_srf_create - Create a device surface as part of the
389  * resource validation process.
390  *
391  * @res: Pointer to a struct vmw_surface.
392  *
393  * If the surface doesn't have a hw id.
394  *
395  * Returns -EBUSY if there wasn't sufficient device resources to
396  * complete the validation. Retry after freeing up resources.
397  *
398  * May return other errors if the kernel is out of guest resources.
399  */
400 static int vmw_legacy_srf_create(struct vmw_resource *res)
401 {
402 	struct vmw_private *dev_priv = res->dev_priv;
403 	struct vmw_surface *srf;
404 	uint32_t submit_size;
405 	uint8_t *cmd;
406 	int ret;
407 
408 	if (likely(res->id != -1))
409 		return 0;
410 
411 	srf = vmw_res_to_srf(res);
412 	if (unlikely(dev_priv->used_memory_size + res->backup_size >=
413 		     dev_priv->memory_size))
414 		return -EBUSY;
415 
416 	/*
417 	 * Alloc id for the resource.
418 	 */
419 
420 	ret = vmw_resource_alloc_id(res);
421 	if (unlikely(ret != 0)) {
422 		DRM_ERROR("Failed to allocate a surface id.\n");
423 		goto out_no_id;
424 	}
425 
426 	if (unlikely(res->id >= SVGA3D_HB_MAX_SURFACE_IDS)) {
427 		ret = -EBUSY;
428 		goto out_no_fifo;
429 	}
430 
431 	/*
432 	 * Encode surface define- commands.
433 	 */
434 
435 	submit_size = vmw_surface_define_size(srf);
436 	cmd = VMW_CMD_RESERVE(dev_priv, submit_size);
437 	if (unlikely(!cmd)) {
438 		ret = -ENOMEM;
439 		goto out_no_fifo;
440 	}
441 
442 	vmw_surface_define_encode(srf, cmd);
443 	vmw_cmd_commit(dev_priv, submit_size);
444 	vmw_fifo_resource_inc(dev_priv);
445 
446 	/*
447 	 * Surface memory usage accounting.
448 	 */
449 
450 	dev_priv->used_memory_size += res->backup_size;
451 	return 0;
452 
453 out_no_fifo:
454 	vmw_resource_release_id(res);
455 out_no_id:
456 	return ret;
457 }
458 
459 /**
460  * vmw_legacy_srf_dma - Copy backup data to or from a legacy surface.
461  *
462  * @res:            Pointer to a struct vmw_res embedded in a struct
463  *                  vmw_surface.
464  * @val_buf:        Pointer to a struct ttm_validate_buffer containing
465  *                  information about the backup buffer.
466  * @bind:           Boolean wether to DMA to the surface.
467  *
468  * Transfer backup data to or from a legacy surface as part of the
469  * validation process.
470  * May return other errors if the kernel is out of guest resources.
471  * The backup buffer will be fenced or idle upon successful completion,
472  * and if the surface needs persistent backup storage, the backup buffer
473  * will also be returned reserved iff @bind is true.
474  */
475 static int vmw_legacy_srf_dma(struct vmw_resource *res,
476 			      struct ttm_validate_buffer *val_buf,
477 			      bool bind)
478 {
479 	SVGAGuestPtr ptr;
480 	struct vmw_fence_obj *fence;
481 	uint32_t submit_size;
482 	struct vmw_surface *srf = vmw_res_to_srf(res);
483 	uint8_t *cmd;
484 	struct vmw_private *dev_priv = res->dev_priv;
485 
486 	BUG_ON(!val_buf->bo);
487 	submit_size = vmw_surface_dma_size(srf);
488 	cmd = VMW_CMD_RESERVE(dev_priv, submit_size);
489 	if (unlikely(!cmd))
490 		return -ENOMEM;
491 
492 	vmw_bo_get_guest_ptr(val_buf->bo, &ptr);
493 	vmw_surface_dma_encode(srf, cmd, &ptr, bind);
494 
495 	vmw_cmd_commit(dev_priv, submit_size);
496 
497 	/*
498 	 * Create a fence object and fence the backup buffer.
499 	 */
500 
501 	(void) vmw_execbuf_fence_commands(NULL, dev_priv,
502 					  &fence, NULL);
503 
504 	vmw_bo_fence_single(val_buf->bo, fence);
505 
506 	if (likely(fence != NULL))
507 		vmw_fence_obj_unreference(&fence);
508 
509 	return 0;
510 }
511 
512 /**
513  * vmw_legacy_srf_bind - Perform a legacy surface bind as part of the
514  *                       surface validation process.
515  *
516  * @res:            Pointer to a struct vmw_res embedded in a struct
517  *                  vmw_surface.
518  * @val_buf:        Pointer to a struct ttm_validate_buffer containing
519  *                  information about the backup buffer.
520  *
521  * This function will copy backup data to the surface if the
522  * backup buffer is dirty.
523  */
524 static int vmw_legacy_srf_bind(struct vmw_resource *res,
525 			       struct ttm_validate_buffer *val_buf)
526 {
527 	if (!res->backup_dirty)
528 		return 0;
529 
530 	return vmw_legacy_srf_dma(res, val_buf, true);
531 }
532 
533 
534 /**
535  * vmw_legacy_srf_unbind - Perform a legacy surface unbind as part of the
536  *                         surface eviction process.
537  *
538  * @res:            Pointer to a struct vmw_res embedded in a struct
539  *                  vmw_surface.
540  * @readback:       Readback - only true if dirty
541  * @val_buf:        Pointer to a struct ttm_validate_buffer containing
542  *                  information about the backup buffer.
543  *
544  * This function will copy backup data from the surface.
545  */
546 static int vmw_legacy_srf_unbind(struct vmw_resource *res,
547 				 bool readback,
548 				 struct ttm_validate_buffer *val_buf)
549 {
550 	if (unlikely(readback))
551 		return vmw_legacy_srf_dma(res, val_buf, false);
552 	return 0;
553 }
554 
555 /**
556  * vmw_legacy_srf_destroy - Destroy a device surface as part of a
557  *                          resource eviction process.
558  *
559  * @res:            Pointer to a struct vmw_res embedded in a struct
560  *                  vmw_surface.
561  */
562 static int vmw_legacy_srf_destroy(struct vmw_resource *res)
563 {
564 	struct vmw_private *dev_priv = res->dev_priv;
565 	uint32_t submit_size;
566 	uint8_t *cmd;
567 
568 	BUG_ON(res->id == -1);
569 
570 	/*
571 	 * Encode the dma- and surface destroy commands.
572 	 */
573 
574 	submit_size = vmw_surface_destroy_size();
575 	cmd = VMW_CMD_RESERVE(dev_priv, submit_size);
576 	if (unlikely(!cmd))
577 		return -ENOMEM;
578 
579 	vmw_surface_destroy_encode(res->id, cmd);
580 	vmw_cmd_commit(dev_priv, submit_size);
581 
582 	/*
583 	 * Surface memory usage accounting.
584 	 */
585 
586 	dev_priv->used_memory_size -= res->backup_size;
587 
588 	/*
589 	 * Release the surface ID.
590 	 */
591 
592 	vmw_resource_release_id(res);
593 	vmw_fifo_resource_dec(dev_priv);
594 
595 	return 0;
596 }
597 
598 
599 /**
600  * vmw_surface_init - initialize a struct vmw_surface
601  *
602  * @dev_priv:       Pointer to a device private struct.
603  * @srf:            Pointer to the struct vmw_surface to initialize.
604  * @res_free:       Pointer to a resource destructor used to free
605  *                  the object.
606  */
607 static int vmw_surface_init(struct vmw_private *dev_priv,
608 			    struct vmw_surface *srf,
609 			    void (*res_free) (struct vmw_resource *res))
610 {
611 	int ret;
612 	struct vmw_resource *res = &srf->res;
613 
614 	BUG_ON(!res_free);
615 	ret = vmw_resource_init(dev_priv, res, true, res_free,
616 				(dev_priv->has_mob) ? &vmw_gb_surface_func :
617 				&vmw_legacy_surface_func);
618 
619 	if (unlikely(ret != 0)) {
620 		res_free(res);
621 		return ret;
622 	}
623 
624 	/*
625 	 * The surface won't be visible to hardware until a
626 	 * surface validate.
627 	 */
628 
629 	INIT_LIST_HEAD(&srf->view_list);
630 	res->hw_destroy = vmw_hw_surface_destroy;
631 	return ret;
632 }
633 
634 /**
635  * vmw_user_surface_base_to_res - TTM base object to resource converter for
636  *                                user visible surfaces
637  *
638  * @base:           Pointer to a TTM base object
639  *
640  * Returns the struct vmw_resource embedded in a struct vmw_surface
641  * for the user-visible object identified by the TTM base object @base.
642  */
643 static struct vmw_resource *
644 vmw_user_surface_base_to_res(struct ttm_base_object *base)
645 {
646 	return &(container_of(base, struct vmw_user_surface,
647 			      prime.base)->srf.res);
648 }
649 
650 /**
651  * vmw_user_surface_free - User visible surface resource destructor
652  *
653  * @res:            A struct vmw_resource embedded in a struct vmw_surface.
654  */
655 static void vmw_user_surface_free(struct vmw_resource *res)
656 {
657 	struct vmw_surface *srf = vmw_res_to_srf(res);
658 	struct vmw_user_surface *user_srf =
659 	    container_of(srf, struct vmw_user_surface, srf);
660 
661 	WARN_ON_ONCE(res->dirty);
662 	if (user_srf->master)
663 		drm_master_put(&user_srf->master);
664 	kfree(srf->offsets);
665 	kfree(srf->metadata.sizes);
666 	kfree(srf->snooper.image);
667 	ttm_prime_object_kfree(user_srf, prime);
668 }
669 
670 /**
671  * vmw_user_surface_base_release - User visible surface TTM base object destructor
672  *
673  * @p_base:         Pointer to a pointer to a TTM base object
674  *                  embedded in a struct vmw_user_surface.
675  *
676  * Drops the base object's reference on its resource, and the
677  * pointer pointed to by *p_base is set to NULL.
678  */
679 static void vmw_user_surface_base_release(struct ttm_base_object **p_base)
680 {
681 	struct ttm_base_object *base = *p_base;
682 	struct vmw_user_surface *user_srf =
683 	    container_of(base, struct vmw_user_surface, prime.base);
684 	struct vmw_resource *res = &user_srf->srf.res;
685 
686 	if (res && res->backup)
687 		drm_gem_object_put(&res->backup->base.base);
688 
689 	*p_base = NULL;
690 	vmw_resource_unreference(&res);
691 }
692 
693 /**
694  * vmw_surface_destroy_ioctl - Ioctl function implementing
695  *                                  the user surface destroy functionality.
696  *
697  * @dev:            Pointer to a struct drm_device.
698  * @data:           Pointer to data copied from / to user-space.
699  * @file_priv:      Pointer to a drm file private structure.
700  */
701 int vmw_surface_destroy_ioctl(struct drm_device *dev, void *data,
702 			      struct drm_file *file_priv)
703 {
704 	struct drm_vmw_surface_arg *arg = (struct drm_vmw_surface_arg *)data;
705 	struct ttm_object_file *tfile = vmw_fpriv(file_priv)->tfile;
706 
707 	return ttm_ref_object_base_unref(tfile, arg->sid);
708 }
709 
710 /**
711  * vmw_surface_define_ioctl - Ioctl function implementing
712  *                                  the user surface define functionality.
713  *
714  * @dev:            Pointer to a struct drm_device.
715  * @data:           Pointer to data copied from / to user-space.
716  * @file_priv:      Pointer to a drm file private structure.
717  */
718 int vmw_surface_define_ioctl(struct drm_device *dev, void *data,
719 			     struct drm_file *file_priv)
720 {
721 	struct vmw_private *dev_priv = vmw_priv(dev);
722 	struct vmw_user_surface *user_srf;
723 	struct vmw_surface *srf;
724 	struct vmw_surface_metadata *metadata;
725 	struct vmw_resource *res;
726 	struct vmw_resource *tmp;
727 	union drm_vmw_surface_create_arg *arg =
728 	    (union drm_vmw_surface_create_arg *)data;
729 	struct drm_vmw_surface_create_req *req = &arg->req;
730 	struct drm_vmw_surface_arg *rep = &arg->rep;
731 	struct ttm_object_file *tfile = vmw_fpriv(file_priv)->tfile;
732 	int ret;
733 	int i, j;
734 	uint32_t cur_bo_offset;
735 	struct drm_vmw_size *cur_size;
736 	struct vmw_surface_offset *cur_offset;
737 	uint32_t num_sizes;
738 	const SVGA3dSurfaceDesc *desc;
739 
740 	num_sizes = 0;
741 	for (i = 0; i < DRM_VMW_MAX_SURFACE_FACES; ++i) {
742 		if (req->mip_levels[i] > DRM_VMW_MAX_MIP_LEVELS)
743 			return -EINVAL;
744 		num_sizes += req->mip_levels[i];
745 	}
746 
747 	if (num_sizes > DRM_VMW_MAX_SURFACE_FACES * DRM_VMW_MAX_MIP_LEVELS ||
748 	    num_sizes == 0)
749 		return -EINVAL;
750 
751 	desc = vmw_surface_get_desc(req->format);
752 	if (unlikely(desc->blockDesc == SVGA3DBLOCKDESC_NONE)) {
753 		VMW_DEBUG_USER("Invalid format %d for surface creation.\n",
754 			       req->format);
755 		return -EINVAL;
756 	}
757 
758 	user_srf = kzalloc(sizeof(*user_srf), GFP_KERNEL);
759 	if (unlikely(!user_srf)) {
760 		ret = -ENOMEM;
761 		goto out_unlock;
762 	}
763 
764 	srf = &user_srf->srf;
765 	metadata = &srf->metadata;
766 	res = &srf->res;
767 
768 	/* Driver internally stores as 64-bit flags */
769 	metadata->flags = (SVGA3dSurfaceAllFlags)req->flags;
770 	metadata->format = req->format;
771 	metadata->scanout = req->scanout;
772 
773 	memcpy(metadata->mip_levels, req->mip_levels,
774 	       sizeof(metadata->mip_levels));
775 	metadata->num_sizes = num_sizes;
776 	metadata->sizes =
777 		memdup_user((struct drm_vmw_size __user *)(unsigned long)
778 			    req->size_addr,
779 			    sizeof(*metadata->sizes) * metadata->num_sizes);
780 	if (IS_ERR(metadata->sizes)) {
781 		ret = PTR_ERR(metadata->sizes);
782 		goto out_no_sizes;
783 	}
784 	srf->offsets = kmalloc_array(metadata->num_sizes, sizeof(*srf->offsets),
785 				     GFP_KERNEL);
786 	if (unlikely(!srf->offsets)) {
787 		ret = -ENOMEM;
788 		goto out_no_offsets;
789 	}
790 
791 	metadata->base_size = *srf->metadata.sizes;
792 	metadata->autogen_filter = SVGA3D_TEX_FILTER_NONE;
793 	metadata->multisample_count = 0;
794 	metadata->multisample_pattern = SVGA3D_MS_PATTERN_NONE;
795 	metadata->quality_level = SVGA3D_MS_QUALITY_NONE;
796 
797 	cur_bo_offset = 0;
798 	cur_offset = srf->offsets;
799 	cur_size = metadata->sizes;
800 
801 	for (i = 0; i < DRM_VMW_MAX_SURFACE_FACES; ++i) {
802 		for (j = 0; j < metadata->mip_levels[i]; ++j) {
803 			uint32_t stride = vmw_surface_calculate_pitch(
804 						  desc, cur_size);
805 
806 			cur_offset->face = i;
807 			cur_offset->mip = j;
808 			cur_offset->bo_offset = cur_bo_offset;
809 			cur_bo_offset += vmw_surface_get_image_buffer_size
810 				(desc, cur_size, stride);
811 			++cur_offset;
812 			++cur_size;
813 		}
814 	}
815 	res->backup_size = cur_bo_offset;
816 	if (metadata->scanout &&
817 	    metadata->num_sizes == 1 &&
818 	    metadata->sizes[0].width == VMW_CURSOR_SNOOP_WIDTH &&
819 	    metadata->sizes[0].height == VMW_CURSOR_SNOOP_HEIGHT &&
820 	    metadata->format == VMW_CURSOR_SNOOP_FORMAT) {
821 		const struct SVGA3dSurfaceDesc *desc =
822 			vmw_surface_get_desc(VMW_CURSOR_SNOOP_FORMAT);
823 		const u32 cursor_size_bytes = VMW_CURSOR_SNOOP_WIDTH *
824 					      VMW_CURSOR_SNOOP_HEIGHT *
825 					      desc->pitchBytesPerBlock;
826 		srf->snooper.image = kzalloc(cursor_size_bytes, GFP_KERNEL);
827 		if (!srf->snooper.image) {
828 			DRM_ERROR("Failed to allocate cursor_image\n");
829 			ret = -ENOMEM;
830 			goto out_no_copy;
831 		}
832 	} else {
833 		srf->snooper.image = NULL;
834 	}
835 
836 	user_srf->prime.base.shareable = false;
837 	user_srf->prime.base.tfile = NULL;
838 	if (drm_is_primary_client(file_priv))
839 		user_srf->master = drm_file_get_master(file_priv);
840 
841 	/**
842 	 * From this point, the generic resource management functions
843 	 * destroy the object on failure.
844 	 */
845 
846 	ret = vmw_surface_init(dev_priv, srf, vmw_user_surface_free);
847 	if (unlikely(ret != 0))
848 		goto out_unlock;
849 
850 	/*
851 	 * A gb-aware client referencing a shared surface will
852 	 * expect a backup buffer to be present.
853 	 */
854 	if (dev_priv->has_mob && req->shareable) {
855 		uint32_t backup_handle;
856 
857 		ret = vmw_gem_object_create_with_handle(dev_priv,
858 							file_priv,
859 							res->backup_size,
860 							&backup_handle,
861 							&res->backup);
862 		if (unlikely(ret != 0)) {
863 			vmw_resource_unreference(&res);
864 			goto out_unlock;
865 		}
866 		vmw_bo_reference(res->backup);
867 		/*
868 		 * We don't expose the handle to the userspace and surface
869 		 * already holds a gem reference
870 		 */
871 		drm_gem_handle_delete(file_priv, backup_handle);
872 	}
873 
874 	tmp = vmw_resource_reference(&srf->res);
875 	ret = ttm_prime_object_init(tfile, res->backup_size, &user_srf->prime,
876 				    req->shareable, VMW_RES_SURFACE,
877 				    &vmw_user_surface_base_release);
878 
879 	if (unlikely(ret != 0)) {
880 		vmw_resource_unreference(&tmp);
881 		vmw_resource_unreference(&res);
882 		goto out_unlock;
883 	}
884 
885 	rep->sid = user_srf->prime.base.handle;
886 	vmw_resource_unreference(&res);
887 
888 	return 0;
889 out_no_copy:
890 	kfree(srf->offsets);
891 out_no_offsets:
892 	kfree(metadata->sizes);
893 out_no_sizes:
894 	ttm_prime_object_kfree(user_srf, prime);
895 out_unlock:
896 	return ret;
897 }
898 
899 
900 static int
901 vmw_surface_handle_reference(struct vmw_private *dev_priv,
902 			     struct drm_file *file_priv,
903 			     uint32_t u_handle,
904 			     enum drm_vmw_handle_type handle_type,
905 			     struct ttm_base_object **base_p)
906 {
907 	struct ttm_object_file *tfile = vmw_fpriv(file_priv)->tfile;
908 	struct vmw_user_surface *user_srf;
909 	uint32_t handle;
910 	struct ttm_base_object *base;
911 	int ret;
912 
913 	if (handle_type == DRM_VMW_HANDLE_PRIME) {
914 		ret = ttm_prime_fd_to_handle(tfile, u_handle, &handle);
915 		if (unlikely(ret != 0))
916 			return ret;
917 	} else {
918 		handle = u_handle;
919 	}
920 
921 	ret = -EINVAL;
922 	base = ttm_base_object_lookup_for_ref(dev_priv->tdev, handle);
923 	if (unlikely(!base)) {
924 		VMW_DEBUG_USER("Could not find surface to reference.\n");
925 		goto out_no_lookup;
926 	}
927 
928 	if (unlikely(ttm_base_object_type(base) != VMW_RES_SURFACE)) {
929 		VMW_DEBUG_USER("Referenced object is not a surface.\n");
930 		goto out_bad_resource;
931 	}
932 	if (handle_type != DRM_VMW_HANDLE_PRIME) {
933 		bool require_exist = false;
934 
935 		user_srf = container_of(base, struct vmw_user_surface,
936 					prime.base);
937 
938 		/* Error out if we are unauthenticated primary */
939 		if (drm_is_primary_client(file_priv) &&
940 		    !file_priv->authenticated) {
941 			ret = -EACCES;
942 			goto out_bad_resource;
943 		}
944 
945 		/*
946 		 * Make sure the surface creator has the same
947 		 * authenticating master, or is already registered with us.
948 		 */
949 		if (drm_is_primary_client(file_priv) &&
950 		    user_srf->master != file_priv->master)
951 			require_exist = true;
952 
953 		if (unlikely(drm_is_render_client(file_priv)))
954 			require_exist = true;
955 
956 		ret = ttm_ref_object_add(tfile, base, NULL, require_exist);
957 		if (unlikely(ret != 0)) {
958 			DRM_ERROR("Could not add a reference to a surface.\n");
959 			goto out_bad_resource;
960 		}
961 	}
962 
963 	*base_p = base;
964 	return 0;
965 
966 out_bad_resource:
967 	ttm_base_object_unref(&base);
968 out_no_lookup:
969 	if (handle_type == DRM_VMW_HANDLE_PRIME)
970 		(void) ttm_ref_object_base_unref(tfile, handle);
971 
972 	return ret;
973 }
974 
975 /**
976  * vmw_surface_reference_ioctl - Ioctl function implementing
977  *                                  the user surface reference functionality.
978  *
979  * @dev:            Pointer to a struct drm_device.
980  * @data:           Pointer to data copied from / to user-space.
981  * @file_priv:      Pointer to a drm file private structure.
982  */
983 int vmw_surface_reference_ioctl(struct drm_device *dev, void *data,
984 				struct drm_file *file_priv)
985 {
986 	struct vmw_private *dev_priv = vmw_priv(dev);
987 	union drm_vmw_surface_reference_arg *arg =
988 	    (union drm_vmw_surface_reference_arg *)data;
989 	struct drm_vmw_surface_arg *req = &arg->req;
990 	struct drm_vmw_surface_create_req *rep = &arg->rep;
991 	struct ttm_object_file *tfile = vmw_fpriv(file_priv)->tfile;
992 	struct vmw_surface *srf;
993 	struct vmw_user_surface *user_srf;
994 	struct drm_vmw_size __user *user_sizes;
995 	struct ttm_base_object *base;
996 	int ret;
997 
998 	ret = vmw_surface_handle_reference(dev_priv, file_priv, req->sid,
999 					   req->handle_type, &base);
1000 	if (unlikely(ret != 0))
1001 		return ret;
1002 
1003 	user_srf = container_of(base, struct vmw_user_surface, prime.base);
1004 	srf = &user_srf->srf;
1005 
1006 	/* Downcast of flags when sending back to user space */
1007 	rep->flags = (uint32_t)srf->metadata.flags;
1008 	rep->format = srf->metadata.format;
1009 	memcpy(rep->mip_levels, srf->metadata.mip_levels,
1010 	       sizeof(srf->metadata.mip_levels));
1011 	user_sizes = (struct drm_vmw_size __user *)(unsigned long)
1012 	    rep->size_addr;
1013 
1014 	if (user_sizes)
1015 		ret = copy_to_user(user_sizes, &srf->metadata.base_size,
1016 				   sizeof(srf->metadata.base_size));
1017 	if (unlikely(ret != 0)) {
1018 		VMW_DEBUG_USER("copy_to_user failed %p %u\n", user_sizes,
1019 			       srf->metadata.num_sizes);
1020 		ttm_ref_object_base_unref(tfile, base->handle);
1021 		ret = -EFAULT;
1022 	}
1023 
1024 	ttm_base_object_unref(&base);
1025 
1026 	return ret;
1027 }
1028 
1029 /**
1030  * vmw_gb_surface_create - Encode a surface_define command.
1031  *
1032  * @res:        Pointer to a struct vmw_resource embedded in a struct
1033  *              vmw_surface.
1034  */
1035 static int vmw_gb_surface_create(struct vmw_resource *res)
1036 {
1037 	struct vmw_private *dev_priv = res->dev_priv;
1038 	struct vmw_surface *srf = vmw_res_to_srf(res);
1039 	struct vmw_surface_metadata *metadata = &srf->metadata;
1040 	uint32_t cmd_len, cmd_id, submit_len;
1041 	int ret;
1042 	struct {
1043 		SVGA3dCmdHeader header;
1044 		SVGA3dCmdDefineGBSurface body;
1045 	} *cmd;
1046 	struct {
1047 		SVGA3dCmdHeader header;
1048 		SVGA3dCmdDefineGBSurface_v2 body;
1049 	} *cmd2;
1050 	struct {
1051 		SVGA3dCmdHeader header;
1052 		SVGA3dCmdDefineGBSurface_v3 body;
1053 	} *cmd3;
1054 	struct {
1055 		SVGA3dCmdHeader header;
1056 		SVGA3dCmdDefineGBSurface_v4 body;
1057 	} *cmd4;
1058 
1059 	if (likely(res->id != -1))
1060 		return 0;
1061 
1062 	vmw_fifo_resource_inc(dev_priv);
1063 	ret = vmw_resource_alloc_id(res);
1064 	if (unlikely(ret != 0)) {
1065 		DRM_ERROR("Failed to allocate a surface id.\n");
1066 		goto out_no_id;
1067 	}
1068 
1069 	if (unlikely(res->id >= VMWGFX_NUM_GB_SURFACE)) {
1070 		ret = -EBUSY;
1071 		goto out_no_fifo;
1072 	}
1073 
1074 	if (has_sm5_context(dev_priv) && metadata->array_size > 0) {
1075 		cmd_id = SVGA_3D_CMD_DEFINE_GB_SURFACE_V4;
1076 		cmd_len = sizeof(cmd4->body);
1077 		submit_len = sizeof(*cmd4);
1078 	} else if (has_sm4_1_context(dev_priv) && metadata->array_size > 0) {
1079 		cmd_id = SVGA_3D_CMD_DEFINE_GB_SURFACE_V3;
1080 		cmd_len = sizeof(cmd3->body);
1081 		submit_len = sizeof(*cmd3);
1082 	} else if (metadata->array_size > 0) {
1083 		/* VMW_SM_4 support verified at creation time. */
1084 		cmd_id = SVGA_3D_CMD_DEFINE_GB_SURFACE_V2;
1085 		cmd_len = sizeof(cmd2->body);
1086 		submit_len = sizeof(*cmd2);
1087 	} else {
1088 		cmd_id = SVGA_3D_CMD_DEFINE_GB_SURFACE;
1089 		cmd_len = sizeof(cmd->body);
1090 		submit_len = sizeof(*cmd);
1091 	}
1092 
1093 	cmd = VMW_CMD_RESERVE(dev_priv, submit_len);
1094 	cmd2 = (typeof(cmd2))cmd;
1095 	cmd3 = (typeof(cmd3))cmd;
1096 	cmd4 = (typeof(cmd4))cmd;
1097 	if (unlikely(!cmd)) {
1098 		ret = -ENOMEM;
1099 		goto out_no_fifo;
1100 	}
1101 
1102 	if (has_sm5_context(dev_priv) && metadata->array_size > 0) {
1103 		cmd4->header.id = cmd_id;
1104 		cmd4->header.size = cmd_len;
1105 		cmd4->body.sid = srf->res.id;
1106 		cmd4->body.surfaceFlags = metadata->flags;
1107 		cmd4->body.format = metadata->format;
1108 		cmd4->body.numMipLevels = metadata->mip_levels[0];
1109 		cmd4->body.multisampleCount = metadata->multisample_count;
1110 		cmd4->body.multisamplePattern = metadata->multisample_pattern;
1111 		cmd4->body.qualityLevel = metadata->quality_level;
1112 		cmd4->body.autogenFilter = metadata->autogen_filter;
1113 		cmd4->body.size.width = metadata->base_size.width;
1114 		cmd4->body.size.height = metadata->base_size.height;
1115 		cmd4->body.size.depth = metadata->base_size.depth;
1116 		cmd4->body.arraySize = metadata->array_size;
1117 		cmd4->body.bufferByteStride = metadata->buffer_byte_stride;
1118 	} else if (has_sm4_1_context(dev_priv) && metadata->array_size > 0) {
1119 		cmd3->header.id = cmd_id;
1120 		cmd3->header.size = cmd_len;
1121 		cmd3->body.sid = srf->res.id;
1122 		cmd3->body.surfaceFlags = metadata->flags;
1123 		cmd3->body.format = metadata->format;
1124 		cmd3->body.numMipLevels = metadata->mip_levels[0];
1125 		cmd3->body.multisampleCount = metadata->multisample_count;
1126 		cmd3->body.multisamplePattern = metadata->multisample_pattern;
1127 		cmd3->body.qualityLevel = metadata->quality_level;
1128 		cmd3->body.autogenFilter = metadata->autogen_filter;
1129 		cmd3->body.size.width = metadata->base_size.width;
1130 		cmd3->body.size.height = metadata->base_size.height;
1131 		cmd3->body.size.depth = metadata->base_size.depth;
1132 		cmd3->body.arraySize = metadata->array_size;
1133 	} else if (metadata->array_size > 0) {
1134 		cmd2->header.id = cmd_id;
1135 		cmd2->header.size = cmd_len;
1136 		cmd2->body.sid = srf->res.id;
1137 		cmd2->body.surfaceFlags = metadata->flags;
1138 		cmd2->body.format = metadata->format;
1139 		cmd2->body.numMipLevels = metadata->mip_levels[0];
1140 		cmd2->body.multisampleCount = metadata->multisample_count;
1141 		cmd2->body.autogenFilter = metadata->autogen_filter;
1142 		cmd2->body.size.width = metadata->base_size.width;
1143 		cmd2->body.size.height = metadata->base_size.height;
1144 		cmd2->body.size.depth = metadata->base_size.depth;
1145 		cmd2->body.arraySize = metadata->array_size;
1146 	} else {
1147 		cmd->header.id = cmd_id;
1148 		cmd->header.size = cmd_len;
1149 		cmd->body.sid = srf->res.id;
1150 		cmd->body.surfaceFlags = metadata->flags;
1151 		cmd->body.format = metadata->format;
1152 		cmd->body.numMipLevels = metadata->mip_levels[0];
1153 		cmd->body.multisampleCount = metadata->multisample_count;
1154 		cmd->body.autogenFilter = metadata->autogen_filter;
1155 		cmd->body.size.width = metadata->base_size.width;
1156 		cmd->body.size.height = metadata->base_size.height;
1157 		cmd->body.size.depth = metadata->base_size.depth;
1158 	}
1159 
1160 	vmw_cmd_commit(dev_priv, submit_len);
1161 
1162 	return 0;
1163 
1164 out_no_fifo:
1165 	vmw_resource_release_id(res);
1166 out_no_id:
1167 	vmw_fifo_resource_dec(dev_priv);
1168 	return ret;
1169 }
1170 
1171 
1172 static int vmw_gb_surface_bind(struct vmw_resource *res,
1173 			       struct ttm_validate_buffer *val_buf)
1174 {
1175 	struct vmw_private *dev_priv = res->dev_priv;
1176 	struct {
1177 		SVGA3dCmdHeader header;
1178 		SVGA3dCmdBindGBSurface body;
1179 	} *cmd1;
1180 	struct {
1181 		SVGA3dCmdHeader header;
1182 		SVGA3dCmdUpdateGBSurface body;
1183 	} *cmd2;
1184 	uint32_t submit_size;
1185 	struct ttm_buffer_object *bo = val_buf->bo;
1186 
1187 	BUG_ON(bo->resource->mem_type != VMW_PL_MOB);
1188 
1189 	submit_size = sizeof(*cmd1) + (res->backup_dirty ? sizeof(*cmd2) : 0);
1190 
1191 	cmd1 = VMW_CMD_RESERVE(dev_priv, submit_size);
1192 	if (unlikely(!cmd1))
1193 		return -ENOMEM;
1194 
1195 	cmd1->header.id = SVGA_3D_CMD_BIND_GB_SURFACE;
1196 	cmd1->header.size = sizeof(cmd1->body);
1197 	cmd1->body.sid = res->id;
1198 	cmd1->body.mobid = bo->resource->start;
1199 	if (res->backup_dirty) {
1200 		cmd2 = (void *) &cmd1[1];
1201 		cmd2->header.id = SVGA_3D_CMD_UPDATE_GB_SURFACE;
1202 		cmd2->header.size = sizeof(cmd2->body);
1203 		cmd2->body.sid = res->id;
1204 	}
1205 	vmw_cmd_commit(dev_priv, submit_size);
1206 
1207 	if (res->backup->dirty && res->backup_dirty) {
1208 		/* We've just made a full upload. Cear dirty regions. */
1209 		vmw_bo_dirty_clear_res(res);
1210 	}
1211 
1212 	res->backup_dirty = false;
1213 
1214 	return 0;
1215 }
1216 
1217 static int vmw_gb_surface_unbind(struct vmw_resource *res,
1218 				 bool readback,
1219 				 struct ttm_validate_buffer *val_buf)
1220 {
1221 	struct vmw_private *dev_priv = res->dev_priv;
1222 	struct ttm_buffer_object *bo = val_buf->bo;
1223 	struct vmw_fence_obj *fence;
1224 
1225 	struct {
1226 		SVGA3dCmdHeader header;
1227 		SVGA3dCmdReadbackGBSurface body;
1228 	} *cmd1;
1229 	struct {
1230 		SVGA3dCmdHeader header;
1231 		SVGA3dCmdInvalidateGBSurface body;
1232 	} *cmd2;
1233 	struct {
1234 		SVGA3dCmdHeader header;
1235 		SVGA3dCmdBindGBSurface body;
1236 	} *cmd3;
1237 	uint32_t submit_size;
1238 	uint8_t *cmd;
1239 
1240 
1241 	BUG_ON(bo->resource->mem_type != VMW_PL_MOB);
1242 
1243 	submit_size = sizeof(*cmd3) + (readback ? sizeof(*cmd1) : sizeof(*cmd2));
1244 	cmd = VMW_CMD_RESERVE(dev_priv, submit_size);
1245 	if (unlikely(!cmd))
1246 		return -ENOMEM;
1247 
1248 	if (readback) {
1249 		cmd1 = (void *) cmd;
1250 		cmd1->header.id = SVGA_3D_CMD_READBACK_GB_SURFACE;
1251 		cmd1->header.size = sizeof(cmd1->body);
1252 		cmd1->body.sid = res->id;
1253 		cmd3 = (void *) &cmd1[1];
1254 	} else {
1255 		cmd2 = (void *) cmd;
1256 		cmd2->header.id = SVGA_3D_CMD_INVALIDATE_GB_SURFACE;
1257 		cmd2->header.size = sizeof(cmd2->body);
1258 		cmd2->body.sid = res->id;
1259 		cmd3 = (void *) &cmd2[1];
1260 	}
1261 
1262 	cmd3->header.id = SVGA_3D_CMD_BIND_GB_SURFACE;
1263 	cmd3->header.size = sizeof(cmd3->body);
1264 	cmd3->body.sid = res->id;
1265 	cmd3->body.mobid = SVGA3D_INVALID_ID;
1266 
1267 	vmw_cmd_commit(dev_priv, submit_size);
1268 
1269 	/*
1270 	 * Create a fence object and fence the backup buffer.
1271 	 */
1272 
1273 	(void) vmw_execbuf_fence_commands(NULL, dev_priv,
1274 					  &fence, NULL);
1275 
1276 	vmw_bo_fence_single(val_buf->bo, fence);
1277 
1278 	if (likely(fence != NULL))
1279 		vmw_fence_obj_unreference(&fence);
1280 
1281 	return 0;
1282 }
1283 
1284 static int vmw_gb_surface_destroy(struct vmw_resource *res)
1285 {
1286 	struct vmw_private *dev_priv = res->dev_priv;
1287 	struct vmw_surface *srf = vmw_res_to_srf(res);
1288 	struct {
1289 		SVGA3dCmdHeader header;
1290 		SVGA3dCmdDestroyGBSurface body;
1291 	} *cmd;
1292 
1293 	if (likely(res->id == -1))
1294 		return 0;
1295 
1296 	mutex_lock(&dev_priv->binding_mutex);
1297 	vmw_view_surface_list_destroy(dev_priv, &srf->view_list);
1298 	vmw_binding_res_list_scrub(&res->binding_head);
1299 
1300 	cmd = VMW_CMD_RESERVE(dev_priv, sizeof(*cmd));
1301 	if (unlikely(!cmd)) {
1302 		mutex_unlock(&dev_priv->binding_mutex);
1303 		return -ENOMEM;
1304 	}
1305 
1306 	cmd->header.id = SVGA_3D_CMD_DESTROY_GB_SURFACE;
1307 	cmd->header.size = sizeof(cmd->body);
1308 	cmd->body.sid = res->id;
1309 	vmw_cmd_commit(dev_priv, sizeof(*cmd));
1310 	mutex_unlock(&dev_priv->binding_mutex);
1311 	vmw_resource_release_id(res);
1312 	vmw_fifo_resource_dec(dev_priv);
1313 
1314 	return 0;
1315 }
1316 
1317 /**
1318  * vmw_gb_surface_define_ioctl - Ioctl function implementing
1319  * the user surface define functionality.
1320  *
1321  * @dev: Pointer to a struct drm_device.
1322  * @data: Pointer to data copied from / to user-space.
1323  * @file_priv: Pointer to a drm file private structure.
1324  */
1325 int vmw_gb_surface_define_ioctl(struct drm_device *dev, void *data,
1326 				struct drm_file *file_priv)
1327 {
1328 	union drm_vmw_gb_surface_create_arg *arg =
1329 	    (union drm_vmw_gb_surface_create_arg *)data;
1330 	struct drm_vmw_gb_surface_create_rep *rep = &arg->rep;
1331 	struct drm_vmw_gb_surface_create_ext_req req_ext;
1332 
1333 	req_ext.base = arg->req;
1334 	req_ext.version = drm_vmw_gb_surface_v1;
1335 	req_ext.svga3d_flags_upper_32_bits = 0;
1336 	req_ext.multisample_pattern = SVGA3D_MS_PATTERN_NONE;
1337 	req_ext.quality_level = SVGA3D_MS_QUALITY_NONE;
1338 	req_ext.buffer_byte_stride = 0;
1339 	req_ext.must_be_zero = 0;
1340 
1341 	return vmw_gb_surface_define_internal(dev, &req_ext, rep, file_priv);
1342 }
1343 
1344 /**
1345  * vmw_gb_surface_reference_ioctl - Ioctl function implementing
1346  * the user surface reference functionality.
1347  *
1348  * @dev: Pointer to a struct drm_device.
1349  * @data: Pointer to data copied from / to user-space.
1350  * @file_priv: Pointer to a drm file private structure.
1351  */
1352 int vmw_gb_surface_reference_ioctl(struct drm_device *dev, void *data,
1353 				   struct drm_file *file_priv)
1354 {
1355 	union drm_vmw_gb_surface_reference_arg *arg =
1356 	    (union drm_vmw_gb_surface_reference_arg *)data;
1357 	struct drm_vmw_surface_arg *req = &arg->req;
1358 	struct drm_vmw_gb_surface_ref_rep *rep = &arg->rep;
1359 	struct drm_vmw_gb_surface_ref_ext_rep rep_ext;
1360 	int ret;
1361 
1362 	ret = vmw_gb_surface_reference_internal(dev, req, &rep_ext, file_priv);
1363 
1364 	if (unlikely(ret != 0))
1365 		return ret;
1366 
1367 	rep->creq = rep_ext.creq.base;
1368 	rep->crep = rep_ext.crep;
1369 
1370 	return ret;
1371 }
1372 
1373 /**
1374  * vmw_gb_surface_define_ext_ioctl - Ioctl function implementing
1375  * the user surface define functionality.
1376  *
1377  * @dev: Pointer to a struct drm_device.
1378  * @data: Pointer to data copied from / to user-space.
1379  * @file_priv: Pointer to a drm file private structure.
1380  */
1381 int vmw_gb_surface_define_ext_ioctl(struct drm_device *dev, void *data,
1382 				struct drm_file *file_priv)
1383 {
1384 	union drm_vmw_gb_surface_create_ext_arg *arg =
1385 	    (union drm_vmw_gb_surface_create_ext_arg *)data;
1386 	struct drm_vmw_gb_surface_create_ext_req *req = &arg->req;
1387 	struct drm_vmw_gb_surface_create_rep *rep = &arg->rep;
1388 
1389 	return vmw_gb_surface_define_internal(dev, req, rep, file_priv);
1390 }
1391 
1392 /**
1393  * vmw_gb_surface_reference_ext_ioctl - Ioctl function implementing
1394  * the user surface reference functionality.
1395  *
1396  * @dev: Pointer to a struct drm_device.
1397  * @data: Pointer to data copied from / to user-space.
1398  * @file_priv: Pointer to a drm file private structure.
1399  */
1400 int vmw_gb_surface_reference_ext_ioctl(struct drm_device *dev, void *data,
1401 				   struct drm_file *file_priv)
1402 {
1403 	union drm_vmw_gb_surface_reference_ext_arg *arg =
1404 	    (union drm_vmw_gb_surface_reference_ext_arg *)data;
1405 	struct drm_vmw_surface_arg *req = &arg->req;
1406 	struct drm_vmw_gb_surface_ref_ext_rep *rep = &arg->rep;
1407 
1408 	return vmw_gb_surface_reference_internal(dev, req, rep, file_priv);
1409 }
1410 
1411 /**
1412  * vmw_gb_surface_define_internal - Ioctl function implementing
1413  * the user surface define functionality.
1414  *
1415  * @dev: Pointer to a struct drm_device.
1416  * @req: Request argument from user-space.
1417  * @rep: Response argument to user-space.
1418  * @file_priv: Pointer to a drm file private structure.
1419  */
1420 static int
1421 vmw_gb_surface_define_internal(struct drm_device *dev,
1422 			       struct drm_vmw_gb_surface_create_ext_req *req,
1423 			       struct drm_vmw_gb_surface_create_rep *rep,
1424 			       struct drm_file *file_priv)
1425 {
1426 	struct ttm_object_file *tfile = vmw_fpriv(file_priv)->tfile;
1427 	struct vmw_private *dev_priv = vmw_priv(dev);
1428 	struct vmw_user_surface *user_srf;
1429 	struct vmw_surface_metadata metadata = {0};
1430 	struct vmw_surface *srf;
1431 	struct vmw_resource *res;
1432 	struct vmw_resource *tmp;
1433 	int ret = 0;
1434 	uint32_t backup_handle = 0;
1435 	SVGA3dSurfaceAllFlags svga3d_flags_64 =
1436 		SVGA3D_FLAGS_64(req->svga3d_flags_upper_32_bits,
1437 				req->base.svga3d_flags);
1438 
1439 	/* array_size must be null for non-GL3 host. */
1440 	if (req->base.array_size > 0 && !has_sm4_context(dev_priv)) {
1441 		VMW_DEBUG_USER("SM4 surface not supported.\n");
1442 		return -EINVAL;
1443 	}
1444 
1445 	if (!has_sm4_1_context(dev_priv)) {
1446 		if (req->svga3d_flags_upper_32_bits != 0)
1447 			ret = -EINVAL;
1448 
1449 		if (req->base.multisample_count != 0)
1450 			ret = -EINVAL;
1451 
1452 		if (req->multisample_pattern != SVGA3D_MS_PATTERN_NONE)
1453 			ret = -EINVAL;
1454 
1455 		if (req->quality_level != SVGA3D_MS_QUALITY_NONE)
1456 			ret = -EINVAL;
1457 
1458 		if (ret) {
1459 			VMW_DEBUG_USER("SM4.1 surface not supported.\n");
1460 			return ret;
1461 		}
1462 	}
1463 
1464 	if (req->buffer_byte_stride > 0 && !has_sm5_context(dev_priv)) {
1465 		VMW_DEBUG_USER("SM5 surface not supported.\n");
1466 		return -EINVAL;
1467 	}
1468 
1469 	if ((svga3d_flags_64 & SVGA3D_SURFACE_MULTISAMPLE) &&
1470 	    req->base.multisample_count == 0) {
1471 		VMW_DEBUG_USER("Invalid sample count.\n");
1472 		return -EINVAL;
1473 	}
1474 
1475 	if (req->base.mip_levels > DRM_VMW_MAX_MIP_LEVELS) {
1476 		VMW_DEBUG_USER("Invalid mip level.\n");
1477 		return -EINVAL;
1478 	}
1479 
1480 	metadata.flags = svga3d_flags_64;
1481 	metadata.format = req->base.format;
1482 	metadata.mip_levels[0] = req->base.mip_levels;
1483 	metadata.multisample_count = req->base.multisample_count;
1484 	metadata.multisample_pattern = req->multisample_pattern;
1485 	metadata.quality_level = req->quality_level;
1486 	metadata.array_size = req->base.array_size;
1487 	metadata.buffer_byte_stride = req->buffer_byte_stride;
1488 	metadata.num_sizes = 1;
1489 	metadata.base_size = req->base.base_size;
1490 	metadata.scanout = req->base.drm_surface_flags &
1491 		drm_vmw_surface_flag_scanout;
1492 
1493 	/* Define a surface based on the parameters. */
1494 	ret = vmw_gb_surface_define(dev_priv, &metadata, &srf);
1495 	if (ret != 0) {
1496 		VMW_DEBUG_USER("Failed to define surface.\n");
1497 		return ret;
1498 	}
1499 
1500 	user_srf = container_of(srf, struct vmw_user_surface, srf);
1501 	if (drm_is_primary_client(file_priv))
1502 		user_srf->master = drm_file_get_master(file_priv);
1503 
1504 	res = &user_srf->srf.res;
1505 
1506 	if (req->base.buffer_handle != SVGA3D_INVALID_ID) {
1507 		ret = vmw_user_bo_lookup(file_priv, req->base.buffer_handle,
1508 					 &res->backup);
1509 		if (ret == 0) {
1510 			if (res->backup->base.base.size < res->backup_size) {
1511 				VMW_DEBUG_USER("Surface backup buffer too small.\n");
1512 				vmw_bo_unreference(&res->backup);
1513 				ret = -EINVAL;
1514 				goto out_unlock;
1515 			} else {
1516 				backup_handle = req->base.buffer_handle;
1517 			}
1518 		}
1519 	} else if (req->base.drm_surface_flags &
1520 		   (drm_vmw_surface_flag_create_buffer |
1521 		    drm_vmw_surface_flag_coherent)) {
1522 		ret = vmw_gem_object_create_with_handle(dev_priv, file_priv,
1523 							res->backup_size,
1524 							&backup_handle,
1525 							&res->backup);
1526 		if (ret == 0)
1527 			vmw_bo_reference(res->backup);
1528 	}
1529 
1530 	if (unlikely(ret != 0)) {
1531 		vmw_resource_unreference(&res);
1532 		goto out_unlock;
1533 	}
1534 
1535 	if (req->base.drm_surface_flags & drm_vmw_surface_flag_coherent) {
1536 		struct vmw_buffer_object *backup = res->backup;
1537 
1538 		ttm_bo_reserve(&backup->base, false, false, NULL);
1539 		if (!res->func->dirty_alloc)
1540 			ret = -EINVAL;
1541 		if (!ret)
1542 			ret = vmw_bo_dirty_add(backup);
1543 		if (!ret) {
1544 			res->coherent = true;
1545 			ret = res->func->dirty_alloc(res);
1546 		}
1547 		ttm_bo_unreserve(&backup->base);
1548 		if (ret) {
1549 			vmw_resource_unreference(&res);
1550 			goto out_unlock;
1551 		}
1552 
1553 	}
1554 
1555 	tmp = vmw_resource_reference(res);
1556 	ret = ttm_prime_object_init(tfile, res->backup_size, &user_srf->prime,
1557 				    req->base.drm_surface_flags &
1558 				    drm_vmw_surface_flag_shareable,
1559 				    VMW_RES_SURFACE,
1560 				    &vmw_user_surface_base_release);
1561 
1562 	if (unlikely(ret != 0)) {
1563 		vmw_resource_unreference(&tmp);
1564 		vmw_resource_unreference(&res);
1565 		goto out_unlock;
1566 	}
1567 
1568 	rep->handle      = user_srf->prime.base.handle;
1569 	rep->backup_size = res->backup_size;
1570 	if (res->backup) {
1571 		rep->buffer_map_handle =
1572 			drm_vma_node_offset_addr(&res->backup->base.base.vma_node);
1573 		rep->buffer_size = res->backup->base.base.size;
1574 		rep->buffer_handle = backup_handle;
1575 	} else {
1576 		rep->buffer_map_handle = 0;
1577 		rep->buffer_size = 0;
1578 		rep->buffer_handle = SVGA3D_INVALID_ID;
1579 	}
1580 	vmw_resource_unreference(&res);
1581 
1582 out_unlock:
1583 	return ret;
1584 }
1585 
1586 /**
1587  * vmw_gb_surface_reference_internal - Ioctl function implementing
1588  * the user surface reference functionality.
1589  *
1590  * @dev: Pointer to a struct drm_device.
1591  * @req: Pointer to user-space request surface arg.
1592  * @rep: Pointer to response to user-space.
1593  * @file_priv: Pointer to a drm file private structure.
1594  */
1595 static int
1596 vmw_gb_surface_reference_internal(struct drm_device *dev,
1597 				  struct drm_vmw_surface_arg *req,
1598 				  struct drm_vmw_gb_surface_ref_ext_rep *rep,
1599 				  struct drm_file *file_priv)
1600 {
1601 	struct vmw_private *dev_priv = vmw_priv(dev);
1602 	struct vmw_surface *srf;
1603 	struct vmw_user_surface *user_srf;
1604 	struct vmw_surface_metadata *metadata;
1605 	struct ttm_base_object *base;
1606 	u32 backup_handle;
1607 	int ret;
1608 
1609 	ret = vmw_surface_handle_reference(dev_priv, file_priv, req->sid,
1610 					   req->handle_type, &base);
1611 	if (unlikely(ret != 0))
1612 		return ret;
1613 
1614 	user_srf = container_of(base, struct vmw_user_surface, prime.base);
1615 	srf = &user_srf->srf;
1616 	if (!srf->res.backup) {
1617 		DRM_ERROR("Shared GB surface is missing a backup buffer.\n");
1618 		goto out_bad_resource;
1619 	}
1620 	metadata = &srf->metadata;
1621 
1622 	mutex_lock(&dev_priv->cmdbuf_mutex); /* Protect res->backup */
1623 	ret = drm_gem_handle_create(file_priv, &srf->res.backup->base.base,
1624 				    &backup_handle);
1625 	mutex_unlock(&dev_priv->cmdbuf_mutex);
1626 	if (ret != 0) {
1627 		drm_err(dev, "Wasn't able to create a backing handle for surface sid = %u.\n",
1628 			req->sid);
1629 		goto out_bad_resource;
1630 	}
1631 
1632 	rep->creq.base.svga3d_flags = SVGA3D_FLAGS_LOWER_32(metadata->flags);
1633 	rep->creq.base.format = metadata->format;
1634 	rep->creq.base.mip_levels = metadata->mip_levels[0];
1635 	rep->creq.base.drm_surface_flags = 0;
1636 	rep->creq.base.multisample_count = metadata->multisample_count;
1637 	rep->creq.base.autogen_filter = metadata->autogen_filter;
1638 	rep->creq.base.array_size = metadata->array_size;
1639 	rep->creq.base.buffer_handle = backup_handle;
1640 	rep->creq.base.base_size = metadata->base_size;
1641 	rep->crep.handle = user_srf->prime.base.handle;
1642 	rep->crep.backup_size = srf->res.backup_size;
1643 	rep->crep.buffer_handle = backup_handle;
1644 	rep->crep.buffer_map_handle =
1645 		drm_vma_node_offset_addr(&srf->res.backup->base.base.vma_node);
1646 	rep->crep.buffer_size = srf->res.backup->base.base.size;
1647 
1648 	rep->creq.version = drm_vmw_gb_surface_v1;
1649 	rep->creq.svga3d_flags_upper_32_bits =
1650 		SVGA3D_FLAGS_UPPER_32(metadata->flags);
1651 	rep->creq.multisample_pattern = metadata->multisample_pattern;
1652 	rep->creq.quality_level = metadata->quality_level;
1653 	rep->creq.must_be_zero = 0;
1654 
1655 out_bad_resource:
1656 	ttm_base_object_unref(&base);
1657 
1658 	return ret;
1659 }
1660 
1661 /**
1662  * vmw_subres_dirty_add - Add a dirty region to a subresource
1663  * @dirty: The surfaces's dirty tracker.
1664  * @loc_start: The location corresponding to the start of the region.
1665  * @loc_end: The location corresponding to the end of the region.
1666  *
1667  * As we are assuming that @loc_start and @loc_end represent a sequential
1668  * range of backing store memory, if the region spans multiple lines then
1669  * regardless of the x coordinate, the full lines are dirtied.
1670  * Correspondingly if the region spans multiple z slices, then full rather
1671  * than partial z slices are dirtied.
1672  */
1673 static void vmw_subres_dirty_add(struct vmw_surface_dirty *dirty,
1674 				 const struct vmw_surface_loc *loc_start,
1675 				 const struct vmw_surface_loc *loc_end)
1676 {
1677 	const struct vmw_surface_cache *cache = &dirty->cache;
1678 	SVGA3dBox *box = &dirty->boxes[loc_start->sub_resource];
1679 	u32 mip = loc_start->sub_resource % cache->num_mip_levels;
1680 	const struct drm_vmw_size *size = &cache->mip[mip].size;
1681 	u32 box_c2 = box->z + box->d;
1682 
1683 	if (WARN_ON(loc_start->sub_resource >= dirty->num_subres))
1684 		return;
1685 
1686 	if (box->d == 0 || box->z > loc_start->z)
1687 		box->z = loc_start->z;
1688 	if (box_c2 < loc_end->z)
1689 		box->d = loc_end->z - box->z;
1690 
1691 	if (loc_start->z + 1 == loc_end->z) {
1692 		box_c2 = box->y + box->h;
1693 		if (box->h == 0 || box->y > loc_start->y)
1694 			box->y = loc_start->y;
1695 		if (box_c2 < loc_end->y)
1696 			box->h = loc_end->y - box->y;
1697 
1698 		if (loc_start->y + 1 == loc_end->y) {
1699 			box_c2 = box->x + box->w;
1700 			if (box->w == 0 || box->x > loc_start->x)
1701 				box->x = loc_start->x;
1702 			if (box_c2 < loc_end->x)
1703 				box->w = loc_end->x - box->x;
1704 		} else {
1705 			box->x = 0;
1706 			box->w = size->width;
1707 		}
1708 	} else {
1709 		box->y = 0;
1710 		box->h = size->height;
1711 		box->x = 0;
1712 		box->w = size->width;
1713 	}
1714 }
1715 
1716 /**
1717  * vmw_subres_dirty_full - Mark a full subresource as dirty
1718  * @dirty: The surface's dirty tracker.
1719  * @subres: The subresource
1720  */
1721 static void vmw_subres_dirty_full(struct vmw_surface_dirty *dirty, u32 subres)
1722 {
1723 	const struct vmw_surface_cache *cache = &dirty->cache;
1724 	u32 mip = subres % cache->num_mip_levels;
1725 	const struct drm_vmw_size *size = &cache->mip[mip].size;
1726 	SVGA3dBox *box = &dirty->boxes[subres];
1727 
1728 	box->x = 0;
1729 	box->y = 0;
1730 	box->z = 0;
1731 	box->w = size->width;
1732 	box->h = size->height;
1733 	box->d = size->depth;
1734 }
1735 
1736 /*
1737  * vmw_surface_tex_dirty_add_range - The dirty_add_range callback for texture
1738  * surfaces.
1739  */
1740 static void vmw_surface_tex_dirty_range_add(struct vmw_resource *res,
1741 					    size_t start, size_t end)
1742 {
1743 	struct vmw_surface_dirty *dirty =
1744 		(struct vmw_surface_dirty *) res->dirty;
1745 	size_t backup_end = res->backup_offset + res->backup_size;
1746 	struct vmw_surface_loc loc1, loc2;
1747 	const struct vmw_surface_cache *cache;
1748 
1749 	start = max_t(size_t, start, res->backup_offset) - res->backup_offset;
1750 	end = min(end, backup_end) - res->backup_offset;
1751 	cache = &dirty->cache;
1752 	vmw_surface_get_loc(cache, &loc1, start);
1753 	vmw_surface_get_loc(cache, &loc2, end - 1);
1754 	vmw_surface_inc_loc(cache, &loc2);
1755 
1756 	if (loc1.sheet != loc2.sheet) {
1757 		u32 sub_res;
1758 
1759 		/*
1760 		 * Multiple multisample sheets. To do this in an optimized
1761 		 * fashion, compute the dirty region for each sheet and the
1762 		 * resulting union. Since this is not a common case, just dirty
1763 		 * the whole surface.
1764 		 */
1765 		for (sub_res = 0; sub_res < dirty->num_subres; ++sub_res)
1766 			vmw_subres_dirty_full(dirty, sub_res);
1767 		return;
1768 	}
1769 	if (loc1.sub_resource + 1 == loc2.sub_resource) {
1770 		/* Dirty range covers a single sub-resource */
1771 		vmw_subres_dirty_add(dirty, &loc1, &loc2);
1772 	} else {
1773 		/* Dirty range covers multiple sub-resources */
1774 		struct vmw_surface_loc loc_min, loc_max;
1775 		u32 sub_res;
1776 
1777 		vmw_surface_max_loc(cache, loc1.sub_resource, &loc_max);
1778 		vmw_subres_dirty_add(dirty, &loc1, &loc_max);
1779 		vmw_surface_min_loc(cache, loc2.sub_resource - 1, &loc_min);
1780 		vmw_subres_dirty_add(dirty, &loc_min, &loc2);
1781 		for (sub_res = loc1.sub_resource + 1;
1782 		     sub_res < loc2.sub_resource - 1; ++sub_res)
1783 			vmw_subres_dirty_full(dirty, sub_res);
1784 	}
1785 }
1786 
1787 /*
1788  * vmw_surface_tex_dirty_add_range - The dirty_add_range callback for buffer
1789  * surfaces.
1790  */
1791 static void vmw_surface_buf_dirty_range_add(struct vmw_resource *res,
1792 					    size_t start, size_t end)
1793 {
1794 	struct vmw_surface_dirty *dirty =
1795 		(struct vmw_surface_dirty *) res->dirty;
1796 	const struct vmw_surface_cache *cache = &dirty->cache;
1797 	size_t backup_end = res->backup_offset + cache->mip_chain_bytes;
1798 	SVGA3dBox *box = &dirty->boxes[0];
1799 	u32 box_c2;
1800 
1801 	box->h = box->d = 1;
1802 	start = max_t(size_t, start, res->backup_offset) - res->backup_offset;
1803 	end = min(end, backup_end) - res->backup_offset;
1804 	box_c2 = box->x + box->w;
1805 	if (box->w == 0 || box->x > start)
1806 		box->x = start;
1807 	if (box_c2 < end)
1808 		box->w = end - box->x;
1809 }
1810 
1811 /*
1812  * vmw_surface_tex_dirty_add_range - The dirty_add_range callback for surfaces
1813  */
1814 static void vmw_surface_dirty_range_add(struct vmw_resource *res, size_t start,
1815 					size_t end)
1816 {
1817 	struct vmw_surface *srf = vmw_res_to_srf(res);
1818 
1819 	if (WARN_ON(end <= res->backup_offset ||
1820 		    start >= res->backup_offset + res->backup_size))
1821 		return;
1822 
1823 	if (srf->metadata.format == SVGA3D_BUFFER)
1824 		vmw_surface_buf_dirty_range_add(res, start, end);
1825 	else
1826 		vmw_surface_tex_dirty_range_add(res, start, end);
1827 }
1828 
1829 /*
1830  * vmw_surface_dirty_sync - The surface's dirty_sync callback.
1831  */
1832 static int vmw_surface_dirty_sync(struct vmw_resource *res)
1833 {
1834 	struct vmw_private *dev_priv = res->dev_priv;
1835 	u32 i, num_dirty;
1836 	struct vmw_surface_dirty *dirty =
1837 		(struct vmw_surface_dirty *) res->dirty;
1838 	size_t alloc_size;
1839 	const struct vmw_surface_cache *cache = &dirty->cache;
1840 	struct {
1841 		SVGA3dCmdHeader header;
1842 		SVGA3dCmdDXUpdateSubResource body;
1843 	} *cmd1;
1844 	struct {
1845 		SVGA3dCmdHeader header;
1846 		SVGA3dCmdUpdateGBImage body;
1847 	} *cmd2;
1848 	void *cmd;
1849 
1850 	num_dirty = 0;
1851 	for (i = 0; i < dirty->num_subres; ++i) {
1852 		const SVGA3dBox *box = &dirty->boxes[i];
1853 
1854 		if (box->d)
1855 			num_dirty++;
1856 	}
1857 
1858 	if (!num_dirty)
1859 		goto out;
1860 
1861 	alloc_size = num_dirty * ((has_sm4_context(dev_priv)) ? sizeof(*cmd1) : sizeof(*cmd2));
1862 	cmd = VMW_CMD_RESERVE(dev_priv, alloc_size);
1863 	if (!cmd)
1864 		return -ENOMEM;
1865 
1866 	cmd1 = cmd;
1867 	cmd2 = cmd;
1868 
1869 	for (i = 0; i < dirty->num_subres; ++i) {
1870 		const SVGA3dBox *box = &dirty->boxes[i];
1871 
1872 		if (!box->d)
1873 			continue;
1874 
1875 		/*
1876 		 * DX_UPDATE_SUBRESOURCE is aware of array surfaces.
1877 		 * UPDATE_GB_IMAGE is not.
1878 		 */
1879 		if (has_sm4_context(dev_priv)) {
1880 			cmd1->header.id = SVGA_3D_CMD_DX_UPDATE_SUBRESOURCE;
1881 			cmd1->header.size = sizeof(cmd1->body);
1882 			cmd1->body.sid = res->id;
1883 			cmd1->body.subResource = i;
1884 			cmd1->body.box = *box;
1885 			cmd1++;
1886 		} else {
1887 			cmd2->header.id = SVGA_3D_CMD_UPDATE_GB_IMAGE;
1888 			cmd2->header.size = sizeof(cmd2->body);
1889 			cmd2->body.image.sid = res->id;
1890 			cmd2->body.image.face = i / cache->num_mip_levels;
1891 			cmd2->body.image.mipmap = i -
1892 				(cache->num_mip_levels * cmd2->body.image.face);
1893 			cmd2->body.box = *box;
1894 			cmd2++;
1895 		}
1896 
1897 	}
1898 	vmw_cmd_commit(dev_priv, alloc_size);
1899  out:
1900 	memset(&dirty->boxes[0], 0, sizeof(dirty->boxes[0]) *
1901 	       dirty->num_subres);
1902 
1903 	return 0;
1904 }
1905 
1906 /*
1907  * vmw_surface_dirty_alloc - The surface's dirty_alloc callback.
1908  */
1909 static int vmw_surface_dirty_alloc(struct vmw_resource *res)
1910 {
1911 	struct vmw_surface *srf = vmw_res_to_srf(res);
1912 	const struct vmw_surface_metadata *metadata = &srf->metadata;
1913 	struct vmw_surface_dirty *dirty;
1914 	u32 num_layers = 1;
1915 	u32 num_mip;
1916 	u32 num_subres;
1917 	u32 num_samples;
1918 	size_t dirty_size;
1919 	int ret;
1920 
1921 	if (metadata->array_size)
1922 		num_layers = metadata->array_size;
1923 	else if (metadata->flags & SVGA3D_SURFACE_CUBEMAP)
1924 		num_layers *= SVGA3D_MAX_SURFACE_FACES;
1925 
1926 	num_mip = metadata->mip_levels[0];
1927 	if (!num_mip)
1928 		num_mip = 1;
1929 
1930 	num_subres = num_layers * num_mip;
1931 	dirty_size = struct_size(dirty, boxes, num_subres);
1932 
1933 	dirty = kvzalloc(dirty_size, GFP_KERNEL);
1934 	if (!dirty) {
1935 		ret = -ENOMEM;
1936 		goto out_no_dirty;
1937 	}
1938 
1939 	num_samples = max_t(u32, 1, metadata->multisample_count);
1940 	ret = vmw_surface_setup_cache(&metadata->base_size, metadata->format,
1941 				      num_mip, num_layers, num_samples,
1942 				      &dirty->cache);
1943 	if (ret)
1944 		goto out_no_cache;
1945 
1946 	dirty->num_subres = num_subres;
1947 	res->dirty = (struct vmw_resource_dirty *) dirty;
1948 
1949 	return 0;
1950 
1951 out_no_cache:
1952 	kvfree(dirty);
1953 out_no_dirty:
1954 	return ret;
1955 }
1956 
1957 /*
1958  * vmw_surface_dirty_free - The surface's dirty_free callback
1959  */
1960 static void vmw_surface_dirty_free(struct vmw_resource *res)
1961 {
1962 	struct vmw_surface_dirty *dirty =
1963 		(struct vmw_surface_dirty *) res->dirty;
1964 
1965 	kvfree(dirty);
1966 	res->dirty = NULL;
1967 }
1968 
1969 /*
1970  * vmw_surface_clean - The surface's clean callback
1971  */
1972 static int vmw_surface_clean(struct vmw_resource *res)
1973 {
1974 	struct vmw_private *dev_priv = res->dev_priv;
1975 	size_t alloc_size;
1976 	struct {
1977 		SVGA3dCmdHeader header;
1978 		SVGA3dCmdReadbackGBSurface body;
1979 	} *cmd;
1980 
1981 	alloc_size = sizeof(*cmd);
1982 	cmd = VMW_CMD_RESERVE(dev_priv, alloc_size);
1983 	if (!cmd)
1984 		return -ENOMEM;
1985 
1986 	cmd->header.id = SVGA_3D_CMD_READBACK_GB_SURFACE;
1987 	cmd->header.size = sizeof(cmd->body);
1988 	cmd->body.sid = res->id;
1989 	vmw_cmd_commit(dev_priv, alloc_size);
1990 
1991 	return 0;
1992 }
1993 
1994 /*
1995  * vmw_gb_surface_define - Define a private GB surface
1996  *
1997  * @dev_priv: Pointer to a device private.
1998  * @metadata: Metadata representing the surface to create.
1999  * @user_srf_out: allocated user_srf. Set to NULL on failure.
2000  *
2001  * GB surfaces allocated by this function will not have a user mode handle, and
2002  * thus will only be visible to vmwgfx.  For optimization reasons the
2003  * surface may later be given a user mode handle by another function to make
2004  * it available to user mode drivers.
2005  */
2006 int vmw_gb_surface_define(struct vmw_private *dev_priv,
2007 			  const struct vmw_surface_metadata *req,
2008 			  struct vmw_surface **srf_out)
2009 {
2010 	struct vmw_surface_metadata *metadata;
2011 	struct vmw_user_surface *user_srf;
2012 	struct vmw_surface *srf;
2013 	u32 sample_count = 1;
2014 	u32 num_layers = 1;
2015 	int ret;
2016 
2017 	*srf_out = NULL;
2018 
2019 	if (req->scanout) {
2020 		if (!vmw_surface_is_screen_target_format(req->format)) {
2021 			VMW_DEBUG_USER("Invalid Screen Target surface format.");
2022 			return -EINVAL;
2023 		}
2024 
2025 		if (req->base_size.width > dev_priv->texture_max_width ||
2026 		    req->base_size.height > dev_priv->texture_max_height) {
2027 			VMW_DEBUG_USER("%ux%u\n, exceed max surface size %ux%u",
2028 				       req->base_size.width,
2029 				       req->base_size.height,
2030 				       dev_priv->texture_max_width,
2031 				       dev_priv->texture_max_height);
2032 			return -EINVAL;
2033 		}
2034 	} else {
2035 		const SVGA3dSurfaceDesc *desc =
2036 			vmw_surface_get_desc(req->format);
2037 
2038 		if (desc->blockDesc == SVGA3DBLOCKDESC_NONE) {
2039 			VMW_DEBUG_USER("Invalid surface format.\n");
2040 			return -EINVAL;
2041 		}
2042 	}
2043 
2044 	if (req->autogen_filter != SVGA3D_TEX_FILTER_NONE)
2045 		return -EINVAL;
2046 
2047 	if (req->num_sizes != 1)
2048 		return -EINVAL;
2049 
2050 	if (req->sizes != NULL)
2051 		return -EINVAL;
2052 
2053 	user_srf = kzalloc(sizeof(*user_srf), GFP_KERNEL);
2054 	if (unlikely(!user_srf)) {
2055 		ret = -ENOMEM;
2056 		goto out_unlock;
2057 	}
2058 
2059 	*srf_out  = &user_srf->srf;
2060 	user_srf->prime.base.shareable = false;
2061 	user_srf->prime.base.tfile = NULL;
2062 
2063 	srf = &user_srf->srf;
2064 	srf->metadata = *req;
2065 	srf->offsets = NULL;
2066 
2067 	metadata = &srf->metadata;
2068 
2069 	if (metadata->array_size)
2070 		num_layers = req->array_size;
2071 	else if (metadata->flags & SVGA3D_SURFACE_CUBEMAP)
2072 		num_layers = SVGA3D_MAX_SURFACE_FACES;
2073 
2074 	if (metadata->flags & SVGA3D_SURFACE_MULTISAMPLE)
2075 		sample_count = metadata->multisample_count;
2076 
2077 	srf->res.backup_size =
2078 		vmw_surface_get_serialized_size_extended(
2079 				metadata->format,
2080 				metadata->base_size,
2081 				metadata->mip_levels[0],
2082 				num_layers,
2083 				sample_count);
2084 
2085 	if (metadata->flags & SVGA3D_SURFACE_BIND_STREAM_OUTPUT)
2086 		srf->res.backup_size += sizeof(SVGA3dDXSOState);
2087 
2088 	/*
2089 	 * Don't set SVGA3D_SURFACE_SCREENTARGET flag for a scanout surface with
2090 	 * size greater than STDU max width/height. This is really a workaround
2091 	 * to support creation of big framebuffer requested by some user-space
2092 	 * for whole topology. That big framebuffer won't really be used for
2093 	 * binding with screen target as during prepare_fb a separate surface is
2094 	 * created so it's safe to ignore SVGA3D_SURFACE_SCREENTARGET flag.
2095 	 */
2096 	if (dev_priv->active_display_unit == vmw_du_screen_target &&
2097 	    metadata->scanout &&
2098 	    metadata->base_size.width <= dev_priv->stdu_max_width &&
2099 	    metadata->base_size.height <= dev_priv->stdu_max_height)
2100 		metadata->flags |= SVGA3D_SURFACE_SCREENTARGET;
2101 
2102 	/*
2103 	 * From this point, the generic resource management functions
2104 	 * destroy the object on failure.
2105 	 */
2106 	ret = vmw_surface_init(dev_priv, srf, vmw_user_surface_free);
2107 
2108 	return ret;
2109 
2110 out_unlock:
2111 	return ret;
2112 }
2113