drivers/gpu/drm/vmwgfx/vmwgfx_surface.c

   1 /**************************************************************************
   2  *
   3  * Copyright © 2009-2012 VMware, Inc., Palo Alto, CA., USA
   4  * All Rights Reserved.
   5  *
   6  * Permission is hereby granted, free of charge, to any person obtaining a
   7  * copy of this software and associated documentation files (the
   8  * "Software"), to deal in the Software without restriction, including
   9  * without limitation the rights to use, copy, modify, merge, publish,
  10  * distribute, sub license, and/or sell copies of the Software, and to
  11  * permit persons to whom the Software is furnished to do so, subject to
  12  * the following conditions:
  13  *
  14  * The above copyright notice and this permission notice (including the
  15  * next paragraph) shall be included in all copies or substantial portions
  16  * of the Software.
  17  *
  18  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  19  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  20  * FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. IN NO EVENT SHALL
  21  * THE COPYRIGHT HOLDERS, AUTHORS AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM,
  22  * DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
  23  * OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
  24  * USE OR OTHER DEALINGS IN THE SOFTWARE.
  25  *
  26  **************************************************************************/
  27
  28 #include "vmwgfx_drv.h"
  29 #include "vmwgfx_resource_priv.h"
  30 #include <ttm/ttm_placement.h>
  31 #include "svga3d_surfacedefs.h"
  32
  33 /**
  34  * struct vmw_user_surface - User-space visible surface resource
  35  *
  36  * @base:           The TTM base object handling user-space visibility.
  37  * @srf:            The surface metadata.
  38  * @size:           TTM accounting size for the surface.
  39  */
  40 struct vmw_user_surface {
  41         struct ttm_prime_object prime;
  42         struct vmw_surface srf;
  43         uint32_t size;
  44         uint32_t backup_handle;
  45 };
  46
  47 /**
  48  * struct vmw_surface_offset - Backing store mip level offset info
  49  *
  50  * @face:           Surface face.
  51  * @mip:            Mip level.
  52  * @bo_offset:      Offset into backing store of this mip level.
  53  *
  54  */
  55 struct vmw_surface_offset {
  56         uint32_t face;
  57         uint32_t mip;
  58         uint32_t bo_offset;
  59 };
  60
  61 static void vmw_user_surface_free(struct vmw_resource *res);
  62 static struct vmw_resource *
  63 vmw_user_surface_base_to_res(struct ttm_base_object *base);
  64 static int vmw_legacy_srf_bind(struct vmw_resource *res,
  65                                struct ttm_validate_buffer *val_buf);
  66 static int vmw_legacy_srf_unbind(struct vmw_resource *res,
  67                                  bool readback,
  68                                  struct ttm_validate_buffer *val_buf);
  69 static int vmw_legacy_srf_create(struct vmw_resource *res);
  70 static int vmw_legacy_srf_destroy(struct vmw_resource *res);
  71
  72 static const struct vmw_user_resource_conv user_surface_conv = {
  73         .object_type = VMW_RES_SURFACE,
  74         .base_obj_to_res = vmw_user_surface_base_to_res,
  75         .res_free = vmw_user_surface_free
  76 };
  77
  78 const struct vmw_user_resource_conv *user_surface_converter =
  79         &user_surface_conv;
  80
  81
  82 static uint64_t vmw_user_surface_size;
  83
  84 static const struct vmw_res_func vmw_legacy_surface_func = {
  85         .res_type = vmw_res_surface,
  86         .needs_backup = false,
  87         .may_evict = true,
  88         .type_name = "legacy surfaces",
  89         .backup_placement = &vmw_srf_placement,
  90         .create = &vmw_legacy_srf_create,
  91         .destroy = &vmw_legacy_srf_destroy,
  92         .bind = &vmw_legacy_srf_bind,
  93         .unbind = &vmw_legacy_srf_unbind
  94 };
  95
  96 /**
  97  * struct vmw_surface_dma - SVGA3D DMA command
  98  */
  99 struct vmw_surface_dma {
 100         SVGA3dCmdHeader header;
 101         SVGA3dCmdSurfaceDMA body;
 102         SVGA3dCopyBox cb;
 103         SVGA3dCmdSurfaceDMASuffix suffix;
 104 };
 105
 106 /**
 107  * struct vmw_surface_define - SVGA3D Surface Define command
 108  */
 109 struct vmw_surface_define {
 110         SVGA3dCmdHeader header;
 111         SVGA3dCmdDefineSurface body;
 112 };
 113
 114 /**
 115  * struct vmw_surface_destroy - SVGA3D Surface Destroy command
 116  */
 117 struct vmw_surface_destroy {
 118         SVGA3dCmdHeader header;
 119         SVGA3dCmdDestroySurface body;
 120 };
 121
 122
 123 /**
 124  * vmw_surface_dma_size - Compute fifo size for a dma command.
 125  *
 126  * @srf: Pointer to a struct vmw_surface
 127  *
 128  * Computes the required size for a surface dma command for backup or
 129  * restoration of the surface represented by @srf.
 130  */
 131 static inline uint32_t vmw_surface_dma_size(const struct vmw_surface *srf)
 132 {
 133         return srf->num_sizes * sizeof(struct vmw_surface_dma);
 134 }
 135
 136
 137 /**
 138  * vmw_surface_define_size - Compute fifo size for a surface define command.
 139  *
 140  * @srf: Pointer to a struct vmw_surface
 141  *
 142  * Computes the required size for a surface define command for the definition
 143  * of the surface represented by @srf.
 144  */
 145 static inline uint32_t vmw_surface_define_size(const struct vmw_surface *srf)
 146 {
 147         return sizeof(struct vmw_surface_define) + srf->num_sizes *
 148                 sizeof(SVGA3dSize);
 149 }
 150
 151
 152 /**
 153  * vmw_surface_destroy_size - Compute fifo size for a surface destroy command.
 154  *
 155  * Computes the required size for a surface destroy command for the destruction
 156  * of a hw surface.
 157  */
 158 static inline uint32_t vmw_surface_destroy_size(void)
 159 {
 160         return sizeof(struct vmw_surface_destroy);
 161 }
 162
 163 /**
 164  * vmw_surface_destroy_encode - Encode a surface_destroy command.
 165  *
 166  * @id: The surface id
 167  * @cmd_space: Pointer to memory area in which the commands should be encoded.
 168  */
 169 static void vmw_surface_destroy_encode(uint32_t id,
 170                                        void *cmd_space)
 171 {
 172         struct vmw_surface_destroy *cmd = (struct vmw_surface_destroy *)
 173                 cmd_space;
 174
 175         cmd->header.id = SVGA_3D_CMD_SURFACE_DESTROY;
 176         cmd->header.size = sizeof(cmd->body);
 177         cmd->body.sid = id;
 178 }
 179
 180 /**
 181  * vmw_surface_define_encode - Encode a surface_define command.
 182  *
 183  * @srf: Pointer to a struct vmw_surface object.
 184  * @cmd_space: Pointer to memory area in which the commands should be encoded.
 185  */
 186 static void vmw_surface_define_encode(const struct vmw_surface *srf,
 187                                       void *cmd_space)
 188 {
 189         struct vmw_surface_define *cmd = (struct vmw_surface_define *)
 190                 cmd_space;
 191         struct drm_vmw_size *src_size;
 192         SVGA3dSize *cmd_size;
 193         uint32_t cmd_len;
 194         int i;
 195
 196         cmd_len = sizeof(cmd->body) + srf->num_sizes * sizeof(SVGA3dSize);
 197
 198         cmd->header.id = SVGA_3D_CMD_SURFACE_DEFINE;
 199         cmd->header.size = cmd_len;
 200         cmd->body.sid = srf->res.id;
 201         cmd->body.surfaceFlags = srf->flags;
 202         cmd->body.format = cpu_to_le32(srf->format);
 203         for (i = 0; i < DRM_VMW_MAX_SURFACE_FACES; ++i)
 204                 cmd->body.face[i].numMipLevels = srf->mip_levels[i];
 205
 206         cmd += 1;
 207         cmd_size = (SVGA3dSize *) cmd;
 208         src_size = srf->sizes;
 209
 210         for (i = 0; i < srf->num_sizes; ++i, cmd_size++, src_size++) {
 211                 cmd_size->width = src_size->width;
 212                 cmd_size->height = src_size->height;
 213                 cmd_size->depth = src_size->depth;
 214         }
 215 }
 216
 217 /**
 218  * vmw_surface_dma_encode - Encode a surface_dma command.
 219  *
 220  * @srf: Pointer to a struct vmw_surface object.
 221  * @cmd_space: Pointer to memory area in which the commands should be encoded.
 222  * @ptr: Pointer to an SVGAGuestPtr indicating where the surface contents
 223  * should be placed or read from.
 224  * @to_surface: Boolean whether to DMA to the surface or from the surface.
 225  */
 226 static void vmw_surface_dma_encode(struct vmw_surface *srf,
 227                                    void *cmd_space,
 228                                    const SVGAGuestPtr *ptr,
 229                                    bool to_surface)
 230 {
 231         uint32_t i;
 232         struct vmw_surface_dma *cmd = (struct vmw_surface_dma *)cmd_space;
 233         const struct svga3d_surface_desc *desc =
 234                 svga3dsurface_get_desc(srf->format);
 235
 236         for (i = 0; i < srf->num_sizes; ++i) {
 237                 SVGA3dCmdHeader *header = &cmd->header;
 238                 SVGA3dCmdSurfaceDMA *body = &cmd->body;
 239                 SVGA3dCopyBox *cb = &cmd->cb;
 240                 SVGA3dCmdSurfaceDMASuffix *suffix = &cmd->suffix;
 241                 const struct vmw_surface_offset *cur_offset = &srf->offsets[i];
 242                 const struct drm_vmw_size *cur_size = &srf->sizes[i];
 243
 244                 header->id = SVGA_3D_CMD_SURFACE_DMA;
 245                 header->size = sizeof(*body) + sizeof(*cb) + sizeof(*suffix);
 246
 247                 body->guest.ptr = *ptr;
 248                 body->guest.ptr.offset += cur_offset->bo_offset;
 249                 body->guest.pitch = svga3dsurface_calculate_pitch(desc,
 250                                                                   cur_size);
 251                 body->host.sid = srf->res.id;
 252                 body->host.face = cur_offset->face;
 253                 body->host.mipmap = cur_offset->mip;
 254                 body->transfer = ((to_surface) ?  SVGA3D_WRITE_HOST_VRAM :
 255                                   SVGA3D_READ_HOST_VRAM);
 256                 cb->x = 0;
 257                 cb->y = 0;
 258                 cb->z = 0;
 259                 cb->srcx = 0;
 260                 cb->srcy = 0;
 261                 cb->srcz = 0;
 262                 cb->w = cur_size->width;
 263                 cb->h = cur_size->height;
 264                 cb->d = cur_size->depth;
 265
 266                 suffix->suffixSize = sizeof(*suffix);
 267                 suffix->maximumOffset =
 268                         svga3dsurface_get_image_buffer_size(desc, cur_size,
 269                                                             body->guest.pitch);
 270                 suffix->flags.discard = 0;
 271                 suffix->flags.unsynchronized = 0;
 272                 suffix->flags.reserved = 0;
 273                 ++cmd;
 274         }
 275 };
 276
 277
 278 /**
 279  * vmw_hw_surface_destroy - destroy a Device surface
 280  *
 281  * @res:        Pointer to a struct vmw_resource embedded in a struct
 282  *              vmw_surface.
 283  *
 284  * Destroys a the device surface associated with a struct vmw_surface if
 285  * any, and adjusts accounting and resource count accordingly.
 286  */
 287 static void vmw_hw_surface_destroy(struct vmw_resource *res)
 288 {
 289
 290         struct vmw_private *dev_priv = res->dev_priv;
 291         struct vmw_surface *srf;
 292         void *cmd;
 293
 294         if (res->id != -1) {
 295
 296                 cmd = vmw_fifo_reserve(dev_priv, vmw_surface_destroy_size());
 297                 if (unlikely(cmd == NULL)) {
 298                         DRM_ERROR("Failed reserving FIFO space for surface "
 299                                   "destruction.\n");
 300                         return;
 301                 }
 302
 303                 vmw_surface_destroy_encode(res->id, cmd);
 304                 vmw_fifo_commit(dev_priv, vmw_surface_destroy_size());
 305
 306                 /*
 307                  * used_memory_size_atomic, or separate lock
 308                  * to avoid taking dev_priv::cmdbuf_mutex in
 309                  * the destroy path.
 310                  */
 311
 312                 mutex_lock(&dev_priv->cmdbuf_mutex);
 313                 srf = vmw_res_to_srf(res);
 314                 dev_priv->used_memory_size -= res->backup_size;
 315                 mutex_unlock(&dev_priv->cmdbuf_mutex);
 316         }
 317         vmw_3d_resource_dec(dev_priv, false);
 318 }
 319
 320 /**
 321  * vmw_legacy_srf_create - Create a device surface as part of the
 322  * resource validation process.
 323  *
 324  * @res: Pointer to a struct vmw_surface.
 325  *
 326  * If the surface doesn't have a hw id.
 327  *
 328  * Returns -EBUSY if there wasn't sufficient device resources to
 329  * complete the validation. Retry after freeing up resources.
 330  *
 331  * May return other errors if the kernel is out of guest resources.
 332  */
 333 static int vmw_legacy_srf_create(struct vmw_resource *res)
 334 {
 335         struct vmw_private *dev_priv = res->dev_priv;
 336         struct vmw_surface *srf;
 337         uint32_t submit_size;
 338         uint8_t *cmd;
 339         int ret;
 340
 341         if (likely(res->id != -1))
 342                 return 0;
 343
 344         srf = vmw_res_to_srf(res);
 345         if (unlikely(dev_priv->used_memory_size + res->backup_size >=
 346                      dev_priv->memory_size))
 347                 return -EBUSY;
 348
 349         /*
 350          * Alloc id for the resource.
 351          */
 352
 353         ret = vmw_resource_alloc_id(res);
 354         if (unlikely(ret != 0)) {
 355                 DRM_ERROR("Failed to allocate a surface id.\n");
 356                 goto out_no_id;
 357         }
 358
 359         if (unlikely(res->id >= SVGA3D_MAX_SURFACE_IDS)) {
 360                 ret = -EBUSY;
 361                 goto out_no_fifo;
 362         }
 363
 364         /*
 365          * Encode surface define- commands.
 366          */
 367
 368         submit_size = vmw_surface_define_size(srf);
 369         cmd = vmw_fifo_reserve(dev_priv, submit_size);
 370         if (unlikely(cmd == NULL)) {
 371                 DRM_ERROR("Failed reserving FIFO space for surface "
 372                           "creation.\n");
 373                 ret = -ENOMEM;
 374                 goto out_no_fifo;
 375         }
 376
 377         vmw_surface_define_encode(srf, cmd);
 378         vmw_fifo_commit(dev_priv, submit_size);
 379         /*
 380          * Surface memory usage accounting.
 381          */
 382
 383         dev_priv->used_memory_size += res->backup_size;
 384         return 0;
 385
 386 out_no_fifo:
 387         vmw_resource_release_id(res);
 388 out_no_id:
 389         return ret;
 390 }
 391
 392 /**
 393  * vmw_legacy_srf_dma - Copy backup data to or from a legacy surface.
 394  *
 395  * @res:            Pointer to a struct vmw_res embedded in a struct
 396  *                  vmw_surface.
 397  * @val_buf:        Pointer to a struct ttm_validate_buffer containing
 398  *                  information about the backup buffer.
 399  * @bind:           Boolean wether to DMA to the surface.
 400  *
 401  * Transfer backup data to or from a legacy surface as part of the
 402  * validation process.
 403  * May return other errors if the kernel is out of guest resources.
 404  * The backup buffer will be fenced or idle upon successful completion,
 405  * and if the surface needs persistent backup storage, the backup buffer
 406  * will also be returned reserved iff @bind is true.
 407  */
 408 static int vmw_legacy_srf_dma(struct vmw_resource *res,
 409                               struct ttm_validate_buffer *val_buf,
 410                               bool bind)
 411 {
 412         SVGAGuestPtr ptr;
 413         struct vmw_fence_obj *fence;
 414         uint32_t submit_size;
 415         struct vmw_surface *srf = vmw_res_to_srf(res);
 416         uint8_t *cmd;
 417         struct vmw_private *dev_priv = res->dev_priv;
 418
 419         BUG_ON(val_buf->bo == NULL);
 420
 421         submit_size = vmw_surface_dma_size(srf);
 422         cmd = vmw_fifo_reserve(dev_priv, submit_size);
 423         if (unlikely(cmd == NULL)) {
 424                 DRM_ERROR("Failed reserving FIFO space for surface "
 425                           "DMA.\n");
 426                 return -ENOMEM;
 427         }
 428         vmw_bo_get_guest_ptr(val_buf->bo, &ptr);
 429         vmw_surface_dma_encode(srf, cmd, &ptr, bind);
 430
 431         vmw_fifo_commit(dev_priv, submit_size);
 432
 433         /*
 434          * Create a fence object and fence the backup buffer.
 435          */
 436
 437         (void) vmw_execbuf_fence_commands(NULL, dev_priv,
 438                                           &fence, NULL);
 439
 440         vmw_fence_single_bo(val_buf->bo, fence);
 441
 442         if (likely(fence != NULL))
 443                 vmw_fence_obj_unreference(&fence);
 444
 445         return 0;
 446 }
 447
 448 /**
 449  * vmw_legacy_srf_bind - Perform a legacy surface bind as part of the
 450  *                       surface validation process.
 451  *
 452  * @res:            Pointer to a struct vmw_res embedded in a struct
 453  *                  vmw_surface.
 454  * @val_buf:        Pointer to a struct ttm_validate_buffer containing
 455  *                  information about the backup buffer.
 456  *
 457  * This function will copy backup data to the surface if the
 458  * backup buffer is dirty.
 459  */
 460 static int vmw_legacy_srf_bind(struct vmw_resource *res,
 461                                struct ttm_validate_buffer *val_buf)
 462 {
 463         if (!res->backup_dirty)
 464                 return 0;
 465
 466         return vmw_legacy_srf_dma(res, val_buf, true);
 467 }
 468
 469
 470 /**
 471  * vmw_legacy_srf_unbind - Perform a legacy surface unbind as part of the
 472  *                         surface eviction process.
 473  *
 474  * @res:            Pointer to a struct vmw_res embedded in a struct
 475  *                  vmw_surface.
 476  * @val_buf:        Pointer to a struct ttm_validate_buffer containing
 477  *                  information about the backup buffer.
 478  *
 479  * This function will copy backup data from the surface.
 480  */
 481 static int vmw_legacy_srf_unbind(struct vmw_resource *res,
 482                                  bool readback,
 483                                  struct ttm_validate_buffer *val_buf)
 484 {
 485         if (unlikely(readback))
 486                 return vmw_legacy_srf_dma(res, val_buf, false);
 487         return 0;
 488 }
 489
 490 /**
 491  * vmw_legacy_srf_destroy - Destroy a device surface as part of a
 492  *                          resource eviction process.
 493  *
 494  * @res:            Pointer to a struct vmw_res embedded in a struct
 495  *                  vmw_surface.
 496  */
 497 static int vmw_legacy_srf_destroy(struct vmw_resource *res)
 498 {
 499         struct vmw_private *dev_priv = res->dev_priv;
 500         uint32_t submit_size;
 501         uint8_t *cmd;
 502
 503         BUG_ON(res->id == -1);
 504
 505         /*
 506          * Encode the dma- and surface destroy commands.
 507          */
 508
 509         submit_size = vmw_surface_destroy_size();
 510         cmd = vmw_fifo_reserve(dev_priv, submit_size);
 511         if (unlikely(cmd == NULL)) {
 512                 DRM_ERROR("Failed reserving FIFO space for surface "
 513                           "eviction.\n");
 514                 return -ENOMEM;
 515         }
 516
 517         vmw_surface_destroy_encode(res->id, cmd);
 518         vmw_fifo_commit(dev_priv, submit_size);
 519
 520         /*
 521          * Surface memory usage accounting.
 522          */
 523
 524         dev_priv->used_memory_size -= res->backup_size;
 525
 526         /*
 527          * Release the surface ID.
 528          */
 529
 530         vmw_resource_release_id(res);
 531
 532         return 0;
 533 }
 534
 535
 536 /**
 537  * vmw_surface_init - initialize a struct vmw_surface
 538  *
 539  * @dev_priv:       Pointer to a device private struct.
 540  * @srf:            Pointer to the struct vmw_surface to initialize.
 541  * @res_free:       Pointer to a resource destructor used to free
 542  *                  the object.
 543  */
 544 static int vmw_surface_init(struct vmw_private *dev_priv,
 545                             struct vmw_surface *srf,
 546                             void (*res_free) (struct vmw_resource *res))
 547 {
 548         int ret;
 549         struct vmw_resource *res = &srf->res;
 550
 551         BUG_ON(res_free == NULL);
 552         (void) vmw_3d_resource_inc(dev_priv, false);
 553         ret = vmw_resource_init(dev_priv, res, true, res_free,
 554                                 &vmw_legacy_surface_func);
 555
 556         if (unlikely(ret != 0)) {
 557                 vmw_3d_resource_dec(dev_priv, false);
 558                 res_free(res);
 559                 return ret;
 560         }
 561
 562         /*
 563          * The surface won't be visible to hardware until a
 564          * surface validate.
 565          */
 566
 567         vmw_resource_activate(res, vmw_hw_surface_destroy);
 568         return ret;
 569 }
 570
 571 /**
 572  * vmw_user_surface_base_to_res - TTM base object to resource converter for
 573  *                                user visible surfaces
 574  *
 575  * @base:           Pointer to a TTM base object
 576  *
 577  * Returns the struct vmw_resource embedded in a struct vmw_surface
 578  * for the user-visible object identified by the TTM base object @base.
 579  */
 580 static struct vmw_resource *
 581 vmw_user_surface_base_to_res(struct ttm_base_object *base)
 582 {
 583         return &(container_of(base, struct vmw_user_surface,
 584                               prime.base)->srf.res);
 585 }
 586
 587 /**
 588  * vmw_user_surface_free - User visible surface resource destructor
 589  *
 590  * @res:            A struct vmw_resource embedded in a struct vmw_surface.
 591  */
 592 static void vmw_user_surface_free(struct vmw_resource *res)
 593 {
 594         struct vmw_surface *srf = vmw_res_to_srf(res);
 595         struct vmw_user_surface *user_srf =
 596             container_of(srf, struct vmw_user_surface, srf);
 597         struct vmw_private *dev_priv = srf->res.dev_priv;
 598         uint32_t size = user_srf->size;
 599
 600         kfree(srf->offsets);
 601         kfree(srf->sizes);
 602         kfree(srf->snooper.image);
 603         ttm_prime_object_kfree(user_srf, prime);
 604         ttm_mem_global_free(vmw_mem_glob(dev_priv), size);
 605 }
 606
 607 /**
 608  * vmw_user_surface_free - User visible surface TTM base object destructor
 609  *
 610  * @p_base:         Pointer to a pointer to a TTM base object
 611  *                  embedded in a struct vmw_user_surface.
 612  *
 613  * Drops the base object's reference on its resource, and the
 614  * pointer pointed to by *p_base is set to NULL.
 615  */
 616 static void vmw_user_surface_base_release(struct ttm_base_object **p_base)
 617 {
 618         struct ttm_base_object *base = *p_base;
 619         struct vmw_user_surface *user_srf =
 620             container_of(base, struct vmw_user_surface, prime.base);
 621         struct vmw_resource *res = &user_srf->srf.res;
 622
 623         *p_base = NULL;
 624         vmw_resource_unreference(&res);
 625 }
 626
 627 /**
 628  * vmw_user_surface_destroy_ioctl - Ioctl function implementing
 629  *                                  the user surface destroy functionality.
 630  *
 631  * @dev:            Pointer to a struct drm_device.
 632  * @data:           Pointer to data copied from / to user-space.
 633  * @file_priv:      Pointer to a drm file private structure.
 634  */
 635 int vmw_surface_destroy_ioctl(struct drm_device *dev, void *data,
 636                               struct drm_file *file_priv)
 637 {
 638         struct drm_vmw_surface_arg *arg = (struct drm_vmw_surface_arg *)data;
 639         struct ttm_object_file *tfile = vmw_fpriv(file_priv)->tfile;
 640
 641         return ttm_ref_object_base_unref(tfile, arg->sid, TTM_REF_USAGE);
 642 }
 643
 644 /**
 645  * vmw_user_surface_define_ioctl - Ioctl function implementing
 646  *                                  the user surface define functionality.
 647  *
 648  * @dev:            Pointer to a struct drm_device.
 649  * @data:           Pointer to data copied from / to user-space.
 650  * @file_priv:      Pointer to a drm file private structure.
 651  */
 652 int vmw_surface_define_ioctl(struct drm_device *dev, void *data,
 653                              struct drm_file *file_priv)
 654 {
 655         struct vmw_private *dev_priv = vmw_priv(dev);
 656         struct vmw_user_surface *user_srf;
 657         struct vmw_surface *srf;
 658         struct vmw_resource *res;
 659         struct vmw_resource *tmp;
 660         union drm_vmw_surface_create_arg *arg =
 661             (union drm_vmw_surface_create_arg *)data;
 662         struct drm_vmw_surface_create_req *req = &arg->req;
 663         struct drm_vmw_surface_arg *rep = &arg->rep;
 664         struct ttm_object_file *tfile = vmw_fpriv(file_priv)->tfile;
 665         struct drm_vmw_size __user *user_sizes;
 666         int ret;
 667         int i, j;
 668         uint32_t cur_bo_offset;
 669         struct drm_vmw_size *cur_size;
 670         struct vmw_surface_offset *cur_offset;
 671         uint32_t num_sizes;
 672         uint32_t size;
 673         struct vmw_master *vmaster = vmw_master(file_priv->master);
 674         const struct svga3d_surface_desc *desc;
 675
 676         if (unlikely(vmw_user_surface_size == 0))
 677                 vmw_user_surface_size = ttm_round_pot(sizeof(*user_srf)) +
 678                         128;
 679
 680         num_sizes = 0;
 681         for (i = 0; i < DRM_VMW_MAX_SURFACE_FACES; ++i)
 682                 num_sizes += req->mip_levels[i];
 683
 684         if (num_sizes > DRM_VMW_MAX_SURFACE_FACES *
 685             DRM_VMW_MAX_MIP_LEVELS)
 686                 return -EINVAL;
 687
 688         size = vmw_user_surface_size + 128 +
 689                 ttm_round_pot(num_sizes * sizeof(struct drm_vmw_size)) +
 690                 ttm_round_pot(num_sizes * sizeof(struct vmw_surface_offset));
 691
 692
 693         desc = svga3dsurface_get_desc(req->format);
 694         if (unlikely(desc->block_desc == SVGA3DBLOCKDESC_NONE)) {
 695                 DRM_ERROR("Invalid surface format for surface creation.\n");
 696                 return -EINVAL;
 697         }
 698
 699         ret = ttm_read_lock(&vmaster->lock, true);
 700         if (unlikely(ret != 0))
 701                 return ret;
 702
 703         ret = ttm_mem_global_alloc(vmw_mem_glob(dev_priv),
 704                                    size, false, true);
 705         if (unlikely(ret != 0)) {
 706                 if (ret != -ERESTARTSYS)
 707                         DRM_ERROR("Out of graphics memory for surface"
 708                                   " creation.\n");
 709                 goto out_unlock;
 710         }
 711
 712         user_srf = kzalloc(sizeof(*user_srf), GFP_KERNEL);
 713         if (unlikely(user_srf == NULL)) {
 714                 ret = -ENOMEM;
 715                 goto out_no_user_srf;
 716         }
 717
 718         srf = &user_srf->srf;
 719         res = &srf->res;
 720
 721         srf->flags = req->flags;
 722         srf->format = req->format;
 723         srf->scanout = req->scanout;
 724
 725         memcpy(srf->mip_levels, req->mip_levels, sizeof(srf->mip_levels));
 726         srf->num_sizes = num_sizes;
 727         user_srf->size = size;
 728
 729         srf->sizes = kmalloc(srf->num_sizes * sizeof(*srf->sizes), GFP_KERNEL);
 730         if (unlikely(srf->sizes == NULL)) {
 731                 ret = -ENOMEM;
 732                 goto out_no_sizes;
 733         }
 734         srf->offsets = kmalloc(srf->num_sizes * sizeof(*srf->offsets),
 735                                GFP_KERNEL);
 736         if (unlikely(srf->sizes == NULL)) {
 737                 ret = -ENOMEM;
 738                 goto out_no_offsets;
 739         }
 740
 741         user_sizes = (struct drm_vmw_size __user *)(unsigned long)
 742             req->size_addr;
 743
 744         ret = copy_from_user(srf->sizes, user_sizes,
 745                              srf->num_sizes * sizeof(*srf->sizes));
 746         if (unlikely(ret != 0)) {
 747                 ret = -EFAULT;
 748                 goto out_no_copy;
 749         }
 750
 751         srf->base_size = *srf->sizes;
 752         srf->autogen_filter = SVGA3D_TEX_FILTER_NONE;
 753         srf->multisample_count = 1;
 754
 755         cur_bo_offset = 0;
 756         cur_offset = srf->offsets;
 757         cur_size = srf->sizes;
 758
 759         for (i = 0; i < DRM_VMW_MAX_SURFACE_FACES; ++i) {
 760                 for (j = 0; j < srf->mip_levels[i]; ++j) {
 761                         uint32_t stride = svga3dsurface_calculate_pitch
 762                                 (desc, cur_size);
 763
 764                         cur_offset->face = i;
 765                         cur_offset->mip = j;
 766                         cur_offset->bo_offset = cur_bo_offset;
 767                         cur_bo_offset += svga3dsurface_get_image_buffer_size
 768                                 (desc, cur_size, stride);
 769                         ++cur_offset;
 770                         ++cur_size;
 771                 }
 772         }
 773         res->backup_size = cur_bo_offset;
 774         if (srf->scanout &&
 775             srf->num_sizes == 1 &&
 776             srf->sizes[0].width == 64 &&
 777             srf->sizes[0].height == 64 &&
 778             srf->format == SVGA3D_A8R8G8B8) {
 779
 780                 srf->snooper.image = kmalloc(64 * 64 * 4, GFP_KERNEL);
 781                 /* clear the image */
 782                 if (srf->snooper.image) {
 783                         memset(srf->snooper.image, 0x00, 64 * 64 * 4);
 784                 } else {
 785                         DRM_ERROR("Failed to allocate cursor_image\n");
 786                         ret = -ENOMEM;
 787                         goto out_no_copy;
 788                 }
 789         } else {
 790                 srf->snooper.image = NULL;
 791         }
 792         srf->snooper.crtc = NULL;
 793
 794         user_srf->prime.base.shareable = false;
 795         user_srf->prime.base.tfile = NULL;
 796
 797         /**
 798          * From this point, the generic resource management functions
 799          * destroy the object on failure.
 800          */
 801
 802         ret = vmw_surface_init(dev_priv, srf, vmw_user_surface_free);
 803         if (unlikely(ret != 0))
 804                 goto out_unlock;
 805
 806         tmp = vmw_resource_reference(&srf->res);
 807         ret = ttm_prime_object_init(tfile, res->backup_size, &user_srf->prime,
 808                                     req->shareable, VMW_RES_SURFACE,
 809                                     &vmw_user_surface_base_release, NULL);
 810
 811         if (unlikely(ret != 0)) {
 812                 vmw_resource_unreference(&tmp);
 813                 vmw_resource_unreference(&res);
 814                 goto out_unlock;
 815         }
 816
 817         rep->sid = user_srf->prime.base.hash.key;
 818         vmw_resource_unreference(&res);
 819
 820         ttm_read_unlock(&vmaster->lock);
 821         return 0;
 822 out_no_copy:
 823         kfree(srf->offsets);
 824 out_no_offsets:
 825         kfree(srf->sizes);
 826 out_no_sizes:
 827         ttm_prime_object_kfree(user_srf, prime);
 828 out_no_user_srf:
 829         ttm_mem_global_free(vmw_mem_glob(dev_priv), size);
 830 out_unlock:
 831         ttm_read_unlock(&vmaster->lock);
 832         return ret;
 833 }
 834
 835 /**
 836  * vmw_user_surface_define_ioctl - Ioctl function implementing
 837  *                                  the user surface reference functionality.
 838  *
 839  * @dev:            Pointer to a struct drm_device.
 840  * @data:           Pointer to data copied from / to user-space.
 841  * @file_priv:      Pointer to a drm file private structure.
 842  */
 843 int vmw_surface_reference_ioctl(struct drm_device *dev, void *data,
 844                                 struct drm_file *file_priv)
 845 {
 846         union drm_vmw_surface_reference_arg *arg =
 847             (union drm_vmw_surface_reference_arg *)data;
 848         struct drm_vmw_surface_arg *req = &arg->req;
 849         struct drm_vmw_surface_create_req *rep = &arg->rep;
 850         struct ttm_object_file *tfile = vmw_fpriv(file_priv)->tfile;
 851         struct vmw_surface *srf;
 852         struct vmw_user_surface *user_srf;
 853         struct drm_vmw_size __user *user_sizes;
 854         struct ttm_base_object *base;
 855         int ret = -EINVAL;
 856
 857         base = ttm_base_object_lookup(tfile, req->sid);
 858         if (unlikely(base == NULL)) {
 859                 DRM_ERROR("Could not find surface to reference.\n");
 860                 return -EINVAL;
 861         }
 862
 863         if (unlikely(ttm_base_object_type(base) != VMW_RES_SURFACE))
 864                 goto out_bad_resource;
 865
 866         user_srf = container_of(base, struct vmw_user_surface, prime.base);
 867         srf = &user_srf->srf;
 868
 869         ret = ttm_ref_object_add(tfile, &user_srf->prime.base,
 870                                  TTM_REF_USAGE, NULL);
 871         if (unlikely(ret != 0)) {
 872                 DRM_ERROR("Could not add a reference to a surface.\n");
 873                 goto out_no_reference;
 874         }
 875
 876         rep->flags = srf->flags;
 877         rep->format = srf->format;
 878         memcpy(rep->mip_levels, srf->mip_levels, sizeof(srf->mip_levels));
 879         user_sizes = (struct drm_vmw_size __user *)(unsigned long)
 880             rep->size_addr;
 881
 882         if (user_sizes)
 883                 ret = copy_to_user(user_sizes, srf->sizes,
 884                                    srf->num_sizes * sizeof(*srf->sizes));
 885         if (unlikely(ret != 0)) {
 886                 DRM_ERROR("copy_to_user failed %p %u\n",
 887                           user_sizes, srf->num_sizes);
 888                 ret = -EFAULT;
 889         }
 890 out_bad_resource:
 891 out_no_reference:
 892         ttm_base_object_unref(&base);
 893
 894         return ret;
 895 }