shared-core/r300_cmdbuf.c

   1 /* r300_cmdbuf.c -- Command buffer emission for R300 -*- linux-c -*-
   2  *
   3  * Copyright (C) The Weather Channel, Inc.  2002.
   4  * Copyright (C) 2004 Nicolai Haehnle.
   5  * All Rights Reserved.
   6  *
   7  * The Weather Channel (TM) funded Tungsten Graphics to develop the
   8  * initial release of the Radeon 8500 driver under the XFree86 license.
   9  * This notice must be preserved.
  10  *
  11  * Permission is hereby granted, free of charge, to any person obtaining a
  12  * copy of this software and associated documentation files (the "Software"),
  13  * to deal in the Software without restriction, including without limitation
  14  * the rights to use, copy, modify, merge, publish, distribute, sublicense,
  15  * and/or sell copies of the Software, and to permit persons to whom the
  16  * Software is furnished to do so, subject to the following conditions:
  17  *
  18  * The above copyright notice and this permission notice (including the next
  19  * paragraph) shall be included in all copies or substantial portions of the
  20  * Software.
  21  *
  22  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  23  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  24  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
  25  * PRECISION INSIGHT AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM, DAMAGES OR
  26  * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
  27  * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
  28  * DEALINGS IN THE SOFTWARE.
  29  *
  30  * Authors:
  31  *    Nicolai Haehnle <prefect_@gmx.net>
  32  */
  33
  34 #include "drmP.h"
  35 #include "drm.h"
  36 #include "radeon_drm.h"
  37 #include "radeon_drv.h"
  38 #include "r300_reg.h"
  39
  40 #define R300_SIMULTANEOUS_CLIPRECTS             4
  41
  42 /* Values for R300_RE_CLIPRECT_CNTL depending on the number of cliprects
  43  */
  44 static const int r300_cliprect_cntl[4] = {
  45         0xAAAA,
  46         0xEEEE,
  47         0xFEFE,
  48         0xFFFE
  49 };
  50
  51 /**
  52  * Emit up to R300_SIMULTANEOUS_CLIPRECTS cliprects from the given command
  53  * buffer, starting with index n.
  54  */
  55 static int r300_emit_cliprects(drm_radeon_private_t *dev_priv,
  56                                drm_radeon_kcmd_buffer_t *cmdbuf, int n)
  57 {
  58         struct drm_clip_rect box;
  59         int nr;
  60         int i;
  61         RING_LOCALS;
  62
  63         nr = cmdbuf->nbox - n;
  64         if (nr > R300_SIMULTANEOUS_CLIPRECTS)
  65                 nr = R300_SIMULTANEOUS_CLIPRECTS;
  66
  67         DRM_DEBUG("%i cliprects\n", nr);
  68
  69         if (nr) {
  70                 BEGIN_RING(6 + nr * 2);
  71                 OUT_RING(CP_PACKET0(R300_RE_CLIPRECT_TL_0, nr * 2 - 1));
  72
  73                 for (i = 0; i < nr; ++i) {
  74                         if (DRM_COPY_FROM_USER_UNCHECKED
  75                             (&box, &cmdbuf->boxes[n + i], sizeof(box))) {
  76                                 DRM_ERROR("copy cliprect faulted\n");
  77                                 return -EFAULT;
  78                         }
  79
  80                         box.x2--; /* Hardware expects inclusive bottom-right corner */
  81                         box.y2--;
  82
  83                         if ((dev_priv->flags & RADEON_FAMILY_MASK) >= CHIP_RV515) {
  84                                 box.x1 = (box.x1) &
  85                                         R300_CLIPRECT_MASK;
  86                                 box.y1 = (box.y1) &
  87                                         R300_CLIPRECT_MASK;
  88                                 box.x2 = (box.x2) &
  89                                         R300_CLIPRECT_MASK;
  90                                 box.y2 = (box.y2) &
  91                                         R300_CLIPRECT_MASK;
  92                         } else {
  93                                 box.x1 = (box.x1 + R300_CLIPRECT_OFFSET) &
  94                                         R300_CLIPRECT_MASK;
  95                                 box.y1 = (box.y1 + R300_CLIPRECT_OFFSET) &
  96                                         R300_CLIPRECT_MASK;
  97                                 box.x2 = (box.x2 + R300_CLIPRECT_OFFSET) &
  98                                         R300_CLIPRECT_MASK;
  99                                 box.y2 = (box.y2 + R300_CLIPRECT_OFFSET) &
 100                                         R300_CLIPRECT_MASK;
 101                         }
 102
 103                         OUT_RING((box.x1 << R300_CLIPRECT_X_SHIFT) |
 104                                  (box.y1 << R300_CLIPRECT_Y_SHIFT));
 105                         OUT_RING((box.x2 << R300_CLIPRECT_X_SHIFT) |
 106                                  (box.y2 << R300_CLIPRECT_Y_SHIFT));
 107
 108                 }
 109
 110                 OUT_RING_REG(R300_RE_CLIPRECT_CNTL, r300_cliprect_cntl[nr - 1]);
 111
 112                 /* TODO/SECURITY: Force scissors to a safe value, otherwise the
 113                  * client might be able to trample over memory.
 114                  * The impact should be very limited, but I'd rather be safe than
 115                  * sorry.
 116                  */
 117                 OUT_RING(CP_PACKET0(R300_RE_SCISSORS_TL, 1));
 118                 OUT_RING(0);
 119                 OUT_RING(R300_SCISSORS_X_MASK | R300_SCISSORS_Y_MASK);
 120                 ADVANCE_RING();
 121         } else {
 122                 /* Why we allow zero cliprect rendering:
 123                  * There are some commands in a command buffer that must be submitted
 124                  * even when there are no cliprects, e.g. DMA buffer discard
 125                  * or state setting (though state setting could be avoided by
 126                  * simulating a loss of context).
 127                  *
 128                  * Now since the cmdbuf interface is so chaotic right now (and is
 129                  * bound to remain that way for a bit until things settle down),
 130                  * it is basically impossible to filter out the commands that are
 131                  * necessary and those that aren't.
 132                  *
 133                  * So I choose the safe way and don't do any filtering at all;
 134                  * instead, I simply set up the engine so that all rendering
 135                  * can't produce any fragments.
 136                  */
 137                 BEGIN_RING(2);
 138                 OUT_RING_REG(R300_RE_CLIPRECT_CNTL, 0);
 139                 ADVANCE_RING();
 140         }
 141
 142         /* flus cache and wait idle clean after cliprect change */
 143         BEGIN_RING(2);
 144         OUT_RING(CP_PACKET0(R300_RB3D_DSTCACHE_CTLSTAT, 0));
 145         OUT_RING(R300_RB3D_DC_FLUSH);
 146         ADVANCE_RING();
 147         BEGIN_RING(2);
 148         OUT_RING(CP_PACKET0(RADEON_WAIT_UNTIL, 0));
 149         OUT_RING(RADEON_WAIT_3D_IDLECLEAN);
 150         ADVANCE_RING();
 151         /* set flush flag */
 152         dev_priv->track_flush |= RADEON_FLUSH_EMITED;
 153
 154         return 0;
 155 }
 156
 157 static u8 r300_reg_flags[0x10000 >> 2];
 158
 159 void r300_init_reg_flags(struct drm_device *dev)
 160 {
 161         int i;
 162         drm_radeon_private_t *dev_priv = dev->dev_private;
 163
 164         memset(r300_reg_flags, 0, 0x10000 >> 2);
 165 #define ADD_RANGE_MARK(reg, count,mark) \
 166                 for(i=((reg)>>2);i<((reg)>>2)+(count);i++)\
 167                         r300_reg_flags[i]|=(mark);
 168
 169
 170 #define ADD_RANGE(reg, count)   ADD_RANGE_MARK(reg, count, MARK_SAFE)
 171
 172         /* these match cmducs() command in r300_driver/r300/r300_cmdbuf.c */
 173         ADD_RANGE(R300_SE_VPORT_XSCALE, 6);
 174         ADD_RANGE(R300_VAP_CNTL, 1);
 175         ADD_RANGE(R300_SE_VTE_CNTL, 2);
 176         ADD_RANGE(0x2134, 2);
 177         ADD_RANGE(R300_VAP_CNTL_STATUS, 1);
 178         ADD_RANGE(R300_VAP_INPUT_CNTL_0, 2);
 179         ADD_RANGE(0x21DC, 1);
 180         ADD_RANGE(R300_VAP_UNKNOWN_221C, 1);
 181         ADD_RANGE(R300_VAP_CLIP_X_0, 4);
 182         ADD_RANGE(R300_VAP_PVS_STATE_FLUSH_REG, 1);
 183         ADD_RANGE(R300_VAP_UNKNOWN_2288, 1);
 184         ADD_RANGE(R300_VAP_OUTPUT_VTX_FMT_0, 2);
 185         ADD_RANGE(R300_VAP_PVS_CNTL_1, 3);
 186         ADD_RANGE(R300_GB_ENABLE, 1);
 187         ADD_RANGE(R300_GB_MSPOS0, 5);
 188         ADD_RANGE(R300_TX_INVALTAGS, 1);
 189         ADD_RANGE(R300_TX_ENABLE, 1);
 190         ADD_RANGE(0x4200, 4);
 191         ADD_RANGE(0x4214, 1);
 192         ADD_RANGE(R300_RE_POINTSIZE, 1);
 193         ADD_RANGE(0x4230, 3);
 194         ADD_RANGE(R300_RE_LINE_CNT, 1);
 195         ADD_RANGE(R300_RE_UNK4238, 1);
 196         ADD_RANGE(0x4260, 3);
 197         ADD_RANGE(R300_RE_SHADE, 4);
 198         ADD_RANGE(R300_RE_POLYGON_MODE, 5);
 199         ADD_RANGE(R300_RE_ZBIAS_CNTL, 1);
 200         ADD_RANGE(R300_RE_ZBIAS_T_FACTOR, 4);
 201         ADD_RANGE(R300_RE_OCCLUSION_CNTL, 1);
 202         ADD_RANGE(R300_RE_CULL_CNTL, 1);
 203         ADD_RANGE(0x42C0, 2);
 204         ADD_RANGE(R300_RS_CNTL_0, 2);
 205
 206         ADD_RANGE(R300_SC_HYPERZ, 2);
 207         ADD_RANGE(0x43E8, 1);
 208
 209         ADD_RANGE(0x46A4, 5);
 210
 211         ADD_RANGE(R300_RE_FOG_STATE, 1);
 212         ADD_RANGE(R300_FOG_COLOR_R, 3);
 213         ADD_RANGE(R300_PP_ALPHA_TEST, 2);
 214         ADD_RANGE(0x4BD8, 1);
 215         ADD_RANGE(R300_PFS_PARAM_0_X, 64);
 216         ADD_RANGE(0x4E00, 1);
 217         ADD_RANGE(R300_RB3D_CBLEND, 2);
 218         ADD_RANGE(R300_RB3D_COLORMASK, 1);
 219         ADD_RANGE(R300_RB3D_BLEND_COLOR, 3);
 220         ADD_RANGE_MARK(R300_RB3D_COLOROFFSET0, 1, MARK_CHECK_OFFSET);   /* check offset */
 221         ADD_RANGE(R300_RB3D_COLORPITCH0, 1);
 222         ADD_RANGE(0x4E50, 9);
 223         ADD_RANGE(0x4E88, 1);
 224         ADD_RANGE(0x4EA0, 2);
 225         ADD_RANGE(R300_ZB_CNTL, 3);
 226         ADD_RANGE(R300_ZB_FORMAT, 4);
 227         ADD_RANGE_MARK(R300_ZB_DEPTHOFFSET, 1, MARK_CHECK_OFFSET);      /* check offset */
 228         ADD_RANGE(R300_ZB_DEPTHPITCH, 1);
 229         ADD_RANGE(R300_ZB_DEPTHCLEARVALUE, 1);
 230         ADD_RANGE(R300_ZB_ZMASK_OFFSET, 13);
 231
 232         ADD_RANGE(R300_TX_FILTER_0, 16);
 233         ADD_RANGE(R300_TX_FILTER1_0, 16);
 234         ADD_RANGE(R300_TX_SIZE_0, 16);
 235         ADD_RANGE(R300_TX_FORMAT_0, 16);
 236         ADD_RANGE(R300_TX_PITCH_0, 16);
 237         /* Texture offset is dangerous and needs more checking */
 238         ADD_RANGE_MARK(R300_TX_OFFSET_0, 16, MARK_CHECK_OFFSET);
 239         ADD_RANGE(R300_TX_CHROMA_KEY_0, 16);
 240         ADD_RANGE(R300_TX_BORDER_COLOR_0, 16);
 241
 242         /* Sporadic registers used as primitives are emitted */
 243         ADD_RANGE(R300_ZB_ZCACHE_CTLSTAT, 1);
 244         ADD_RANGE(R300_RB3D_DSTCACHE_CTLSTAT, 1);
 245         ADD_RANGE(R300_VAP_INPUT_ROUTE_0_0, 8);
 246         ADD_RANGE(R300_VAP_INPUT_ROUTE_1_0, 8);
 247
 248         ADD_RANGE(R500_SU_REG_DEST, 1);
 249         if ((dev_priv->flags & RADEON_FAMILY_MASK) >= CHIP_RV410) {
 250                 ADD_RANGE(R300_DST_PIPE_CONFIG, 1);
 251         }
 252
 253         if ((dev_priv->flags & RADEON_FAMILY_MASK) >= CHIP_RV515) {
 254                 ADD_RANGE(R500_VAP_INDEX_OFFSET, 1);
 255                 ADD_RANGE(R500_US_CONFIG, 2);
 256                 ADD_RANGE(R500_US_CODE_ADDR, 3);
 257                 ADD_RANGE(R500_US_FC_CTRL, 1);
 258                 ADD_RANGE(R500_RS_IP_0, 16);
 259                 ADD_RANGE(R500_RS_INST_0, 16);
 260                 ADD_RANGE(R500_RB3D_COLOR_CLEAR_VALUE_AR, 2);
 261                 ADD_RANGE(R500_RB3D_CONSTANT_COLOR_AR, 2);
 262                 ADD_RANGE(R500_ZB_FIFO_SIZE, 2);
 263                 ADD_RANGE(R500_GA_US_VECTOR_INDEX, 2);
 264         } else {
 265                 ADD_RANGE(R300_PFS_CNTL_0, 3);
 266                 ADD_RANGE(R300_PFS_NODE_0, 4);
 267                 ADD_RANGE(R300_PFS_TEXI_0, 64);
 268                 ADD_RANGE(R300_PFS_INSTR0_0, 64);
 269                 ADD_RANGE(R300_PFS_INSTR1_0, 64);
 270                 ADD_RANGE(R300_PFS_INSTR2_0, 64);
 271                 ADD_RANGE(R300_PFS_INSTR3_0, 64);
 272                 ADD_RANGE(R300_RS_INTERP_0, 8);
 273                 ADD_RANGE(R300_RS_ROUTE_0, 8);
 274
 275         }
 276
 277         /* add 2d blit engine registers for DDX */
 278         ADD_RANGE(RADEON_SRC_Y_X, 3); /* 1434, 1438, 143c,
 279                                          SRC_Y_X, DST_Y_X, DST_HEIGHT_WIDTH
 280                                        */
 281         ADD_RANGE(RADEON_DP_GUI_MASTER_CNTL, 1); /* 146c */
 282         ADD_RANGE(RADEON_DP_BRUSH_BKGD_CLR, 2); /* 1478, 147c */
 283         ADD_RANGE(RADEON_DP_SRC_FRGD_CLR, 2); /* 15d8, 15dc */
 284         ADD_RANGE(RADEON_DP_CNTL, 1); /* 16c0 */
 285         ADD_RANGE(RADEON_DP_WRITE_MASK, 1); /* 16cc */
 286         ADD_RANGE(RADEON_DEFAULT_SC_BOTTOM_RIGHT, 1); /* 16e8 */
 287
 288         ADD_RANGE(RADEON_DSTCACHE_CTLSTAT, 1);
 289         ADD_RANGE(RADEON_WAIT_UNTIL, 1);
 290
 291         ADD_RANGE_MARK(RADEON_DST_OFFSET, 1, MARK_CHECK_OFFSET);
 292         ADD_RANGE_MARK(RADEON_SRC_OFFSET, 1, MARK_CHECK_OFFSET);
 293
 294         ADD_RANGE_MARK(RADEON_DST_PITCH_OFFSET, 1, MARK_CHECK_OFFSET);
 295         ADD_RANGE_MARK(RADEON_SRC_PITCH_OFFSET, 1, MARK_CHECK_OFFSET);
 296
 297         /* TODO SCISSOR */
 298         ADD_RANGE_MARK(R300_SC_SCISSOR0, 2, MARK_CHECK_SCISSOR);
 299
 300         ADD_RANGE(R300_SC_CLIP_0_A, 2);
 301         ADD_RANGE(R300_SC_CLIP_RULE, 1);
 302         ADD_RANGE(R300_SC_SCREENDOOR, 1);
 303
 304         ADD_RANGE(R300_VAP_PVS_CODE_CNTL_0, 4);
 305         ADD_RANGE(R300_VAP_PVS_VECTOR_INDX_REG, 2);
 306 }
 307
 308 int r300_check_range(unsigned reg, int count)
 309 {
 310         int i;
 311         if (reg & ~0xffff)
 312                 return -1;
 313         for (i = (reg >> 2); i < (reg >> 2) + count; i++)
 314                 if (r300_reg_flags[i] != MARK_SAFE)
 315                         return 1;
 316         return 0;
 317 }
 318
 319 int r300_get_reg_flags(unsigned reg)
 320 {
 321         if (reg & ~0xffff)
 322                 return -1;
 323         return r300_reg_flags[(reg >> 2)];
 324 }
 325
 326 static __inline__ int r300_emit_carefully_checked_packet0(drm_radeon_private_t *
 327                                                           dev_priv,
 328                                                           drm_radeon_kcmd_buffer_t
 329                                                           * cmdbuf,
 330                                                           drm_r300_cmd_header_t
 331                                                           header)
 332 {
 333         int reg;
 334         int sz;
 335         int i;
 336         int values[64];
 337         RING_LOCALS;
 338
 339         sz = header.packet0.count;
 340         reg = (header.packet0.reghi << 8) | header.packet0.reglo;
 341
 342         if ((sz > 64) || (sz < 0)) {
 343                 DRM_ERROR
 344                     ("Cannot emit more than 64 values at a time (reg=%04x sz=%d)\n",
 345                      reg, sz);
 346                 return -EINVAL;
 347         }
 348         for (i = 0; i < sz; i++) {
 349                 values[i] = ((int *)cmdbuf->buf)[i];
 350                 switch (r300_reg_flags[(reg >> 2) + i]) {
 351                 case MARK_SAFE:
 352                         break;
 353                 case MARK_CHECK_OFFSET:
 354                         if (!radeon_check_offset(dev_priv, (u32) values[i])) {
 355                                 DRM_ERROR
 356                                     ("Offset failed range check (reg=%04x sz=%d)\n",
 357                                      reg, sz);
 358                                 return -EINVAL;
 359                         }
 360                         break;
 361                 default:
 362                         DRM_ERROR("Register %04x failed check as flag=%02x\n",
 363                                   reg + i * 4, r300_reg_flags[(reg >> 2) + i]);
 364                         return -EINVAL;
 365                 }
 366         }
 367
 368         BEGIN_RING(1 + sz);
 369         OUT_RING(CP_PACKET0(reg, sz - 1));
 370         OUT_RING_TABLE(values, sz);
 371         ADVANCE_RING();
 372
 373         cmdbuf->buf += sz * 4;
 374         cmdbuf->bufsz -= sz * 4;
 375
 376         return 0;
 377 }
 378
 379 /**
 380  * Emits a packet0 setting arbitrary registers.
 381  * Called by r300_do_cp_cmdbuf.
 382  *
 383  * Note that checks are performed on contents and addresses of the registers
 384  */
 385 static __inline__ int r300_emit_packet0(drm_radeon_private_t *dev_priv,
 386                                         drm_radeon_kcmd_buffer_t *cmdbuf,
 387                                         drm_r300_cmd_header_t header)
 388 {
 389         int reg;
 390         int sz;
 391         RING_LOCALS;
 392
 393         sz = header.packet0.count;
 394         reg = (header.packet0.reghi << 8) | header.packet0.reglo;
 395
 396         DRM_DEBUG("R300_CMD_PACKET0: reg %04x, sz %d\n", reg, sz);
 397         if (!sz)
 398                 return 0;
 399
 400         if (sz * 4 > cmdbuf->bufsz)
 401                 return -EINVAL;
 402
 403         if (reg + sz * 4 >= 0x10000) {
 404                 DRM_ERROR("No such registers in hardware reg=%04x sz=%d\n", reg,
 405                           sz);
 406                 return -EINVAL;
 407         }
 408
 409         if (r300_check_range(reg, sz)) {
 410                 /* go and check everything */
 411                 return r300_emit_carefully_checked_packet0(dev_priv, cmdbuf,
 412                                                            header);
 413         }
 414         /* the rest of the data is safe to emit, whatever the values the user passed */
 415
 416         BEGIN_RING(1 + sz);
 417         OUT_RING(CP_PACKET0(reg, sz - 1));
 418         OUT_RING_TABLE((int *)cmdbuf->buf, sz);
 419         ADVANCE_RING();
 420
 421         cmdbuf->buf += sz * 4;
 422         cmdbuf->bufsz -= sz * 4;
 423
 424         return 0;
 425 }
 426
 427 /**
 428  * Uploads user-supplied vertex program instructions or parameters onto
 429  * the graphics card.
 430  * Called by r300_do_cp_cmdbuf.
 431  */
 432 static __inline__ int r300_emit_vpu(drm_radeon_private_t *dev_priv,
 433                                     drm_radeon_kcmd_buffer_t *cmdbuf,
 434                                     drm_r300_cmd_header_t header)
 435 {
 436         int sz;
 437         int addr;
 438         RING_LOCALS;
 439
 440         sz = header.vpu.count;
 441         addr = (header.vpu.adrhi << 8) | header.vpu.adrlo;
 442
 443         if (!sz)
 444                 return 0;
 445         if (sz * 16 > cmdbuf->bufsz)
 446                 return -EINVAL;
 447
 448         /* VAP is very sensitive so we purge cache before we program it
 449          * and we also flush its state before & after */
 450         BEGIN_RING(6);
 451         OUT_RING(CP_PACKET0(R300_RB3D_DSTCACHE_CTLSTAT, 0));
 452         OUT_RING(R300_RB3D_DC_FLUSH);
 453         OUT_RING(CP_PACKET0(RADEON_WAIT_UNTIL, 0));
 454         OUT_RING(RADEON_WAIT_3D_IDLECLEAN);
 455         OUT_RING(CP_PACKET0(R300_VAP_PVS_STATE_FLUSH_REG, 0));
 456         OUT_RING(0);
 457         ADVANCE_RING();
 458         /* set flush flag */
 459         dev_priv->track_flush |= RADEON_FLUSH_EMITED;
 460
 461         BEGIN_RING(3 + sz * 4);
 462         OUT_RING_REG(R300_VAP_PVS_UPLOAD_ADDRESS, addr);
 463         OUT_RING(CP_PACKET0_TABLE(R300_VAP_PVS_UPLOAD_DATA, sz * 4 - 1));
 464         OUT_RING_TABLE((int *)cmdbuf->buf, sz * 4);
 465         ADVANCE_RING();
 466
 467         BEGIN_RING(2);
 468         OUT_RING(CP_PACKET0(R300_VAP_PVS_STATE_FLUSH_REG, 0));
 469         OUT_RING(0);
 470         ADVANCE_RING();
 471
 472         cmdbuf->buf += sz * 16;
 473         cmdbuf->bufsz -= sz * 16;
 474
 475         return 0;
 476 }
 477
 478 /**
 479  * Emit a clear packet from userspace.
 480  * Called by r300_emit_packet3.
 481  */
 482 static __inline__ int r300_emit_clear(drm_radeon_private_t *dev_priv,
 483                                       drm_radeon_kcmd_buffer_t *cmdbuf)
 484 {
 485         RING_LOCALS;
 486
 487         if (8 * 4 > cmdbuf->bufsz)
 488                 return -EINVAL;
 489
 490         BEGIN_RING(10);
 491         OUT_RING(CP_PACKET3(R200_3D_DRAW_IMMD_2, 8));
 492         OUT_RING(R300_PRIM_TYPE_POINT | R300_PRIM_WALK_RING |
 493                  (1 << R300_PRIM_NUM_VERTICES_SHIFT));
 494         OUT_RING_TABLE((int *)cmdbuf->buf, 8);
 495         ADVANCE_RING();
 496
 497         BEGIN_RING(4);
 498         OUT_RING(CP_PACKET0(R300_RB3D_DSTCACHE_CTLSTAT, 0));
 499         OUT_RING(R300_RB3D_DC_FLUSH);
 500         OUT_RING(CP_PACKET0(RADEON_WAIT_UNTIL, 0));
 501         OUT_RING(RADEON_WAIT_3D_IDLECLEAN);
 502         ADVANCE_RING();
 503         /* set flush flag */
 504         dev_priv->track_flush |= RADEON_FLUSH_EMITED;
 505
 506         cmdbuf->buf += 8 * 4;
 507         cmdbuf->bufsz -= 8 * 4;
 508
 509         return 0;
 510 }
 511
 512 static __inline__ int r300_emit_3d_load_vbpntr(drm_radeon_private_t *dev_priv,
 513                                                drm_radeon_kcmd_buffer_t *cmdbuf,
 514                                                u32 header)
 515 {
 516         int count, i, k;
 517 #define MAX_ARRAY_PACKET  64
 518         u32 payload[MAX_ARRAY_PACKET];
 519         u32 narrays;
 520         RING_LOCALS;
 521
 522         count = (header >> 16) & 0x3fff;
 523
 524         if ((count + 1) > MAX_ARRAY_PACKET) {
 525                 DRM_ERROR("Too large payload in 3D_LOAD_VBPNTR (count=%d)\n",
 526                           count);
 527                 return -EINVAL;
 528         }
 529         memset(payload, 0, MAX_ARRAY_PACKET * 4);
 530         memcpy(payload, cmdbuf->buf + 4, (count + 1) * 4);
 531
 532         /* carefully check packet contents */
 533
 534         narrays = payload[0];
 535         k = 0;
 536         i = 1;
 537         while ((k < narrays) && (i < (count + 1))) {
 538                 i++;            /* skip attribute field */
 539                 if (!radeon_check_offset(dev_priv, payload[i])) {
 540                         DRM_ERROR
 541                             ("Offset failed range check (k=%d i=%d) while processing 3D_LOAD_VBPNTR packet.\n",
 542                              k, i);
 543                         return -EINVAL;
 544                 }
 545                 k++;
 546                 i++;
 547                 if (k == narrays)
 548                         break;
 549                 /* have one more to process, they come in pairs */
 550                 if (!radeon_check_offset(dev_priv, payload[i])) {
 551                         DRM_ERROR
 552                             ("Offset failed range check (k=%d i=%d) while processing 3D_LOAD_VBPNTR packet.\n",
 553                              k, i);
 554                         return -EINVAL;
 555                 }
 556                 k++;
 557                 i++;
 558         }
 559         /* do the counts match what we expect ? */
 560         if ((k != narrays) || (i != (count + 1))) {
 561                 DRM_ERROR
 562                     ("Malformed 3D_LOAD_VBPNTR packet (k=%d i=%d narrays=%d count+1=%d).\n",
 563                      k, i, narrays, count + 1);
 564                 return -EINVAL;
 565         }
 566
 567         /* all clear, output packet */
 568
 569         BEGIN_RING(count + 2);
 570         OUT_RING(header);
 571         OUT_RING_TABLE(payload, count + 1);
 572         ADVANCE_RING();
 573
 574         cmdbuf->buf += (count + 2) * 4;
 575         cmdbuf->bufsz -= (count + 2) * 4;
 576
 577         return 0;
 578 }
 579
 580 static __inline__ int r300_emit_bitblt_multi(drm_radeon_private_t *dev_priv,
 581                                              drm_radeon_kcmd_buffer_t *cmdbuf)
 582 {
 583         u32 *cmd = (u32 *) cmdbuf->buf;
 584         int count, ret;
 585         RING_LOCALS;
 586
 587         count=(cmd[0]>>16) & 0x3fff;
 588
 589         if (cmd[0] & 0x8000) {
 590                 u32 offset;
 591
 592                 if (cmd[1] & (RADEON_GMC_SRC_PITCH_OFFSET_CNTL
 593                               | RADEON_GMC_DST_PITCH_OFFSET_CNTL)) {
 594                         offset = cmd[2] << 10;
 595                         ret = !radeon_check_offset(dev_priv, offset);
 596                         if (ret) {
 597                                 DRM_ERROR("Invalid bitblt first offset is %08X\n", offset);
 598                                 return -EINVAL;
 599                         }
 600                 }
 601
 602                 if ((cmd[1] & RADEON_GMC_SRC_PITCH_OFFSET_CNTL) &&
 603                     (cmd[1] & RADEON_GMC_DST_PITCH_OFFSET_CNTL)) {
 604                         offset = cmd[3] << 10;
 605                         ret = !radeon_check_offset(dev_priv, offset);
 606                         if (ret) {
 607                                 DRM_ERROR("Invalid bitblt second offset is %08X\n", offset);
 608                                 return -EINVAL;
 609                         }
 610
 611                 }
 612         }
 613
 614         BEGIN_RING(count+2);
 615         OUT_RING(cmd[0]);
 616         OUT_RING_TABLE((int *)(cmdbuf->buf + 4), count + 1);
 617         ADVANCE_RING();
 618
 619         cmdbuf->buf += (count+2)*4;
 620         cmdbuf->bufsz -= (count+2)*4;
 621
 622         return 0;
 623 }
 624
 625 static __inline__ int r300_emit_draw_indx_2(drm_radeon_private_t *dev_priv,
 626                                             drm_radeon_kcmd_buffer_t *cmdbuf)
 627 {
 628         u32 *cmd;
 629         int count;
 630         int expected_count;
 631         RING_LOCALS;
 632
 633         cmd = (u32 *) cmdbuf->buf;
 634         count = (cmd[0]>>16) & 0x3fff;
 635         expected_count = cmd[1] >> 16;
 636         if (!(cmd[1] & R300_VAP_VF_CNTL__INDEX_SIZE_32bit))
 637                 expected_count = (expected_count+1)/2;
 638
 639         if (count && count != expected_count) {
 640                 DRM_ERROR("3D_DRAW_INDX_2: packet size %i, expected %i\n",
 641                         count, expected_count);
 642                 return -EINVAL;
 643         }
 644
 645         BEGIN_RING(count+2);
 646         OUT_RING(cmd[0]);
 647         OUT_RING_TABLE((int *)(cmdbuf->buf + 4), count + 1);
 648         ADVANCE_RING();
 649
 650         cmdbuf->buf += (count+2)*4;
 651         cmdbuf->bufsz -= (count+2)*4;
 652
 653         if (!count) {
 654                 drm_r300_cmd_header_t header;
 655
 656                 if (cmdbuf->bufsz < 4*4 + sizeof(header)) {
 657                         DRM_ERROR("3D_DRAW_INDX_2: expect subsequent INDX_BUFFER, but stream is too short.\n");
 658                         return -EINVAL;
 659                 }
 660
 661                 header.u = *(unsigned int *)cmdbuf->buf;
 662
 663                 cmdbuf->buf += sizeof(header);
 664                 cmdbuf->bufsz -= sizeof(header);
 665                 cmd = (u32 *) cmdbuf->buf;
 666
 667                 if (header.header.cmd_type != R300_CMD_PACKET3 ||
 668                     header.packet3.packet != R300_CMD_PACKET3_RAW ||
 669                     cmd[0] != CP_PACKET3(RADEON_CP_INDX_BUFFER, 2)) {
 670                         DRM_ERROR("3D_DRAW_INDX_2: expect subsequent INDX_BUFFER.\n");
 671                         return -EINVAL;
 672                 }
 673
 674                 if ((cmd[1] & 0x8000ffff) != 0x80000810) {
 675                         DRM_ERROR("Invalid indx_buffer reg address %08X\n", cmd[1]);
 676                         return -EINVAL;
 677                 }
 678                 if (!radeon_check_offset(dev_priv, cmd[2])) {
 679                         DRM_ERROR("Invalid indx_buffer offset is %08X\n", cmd[2]);
 680                         return -EINVAL;
 681                 }
 682                 if (cmd[3] != expected_count) {
 683                         DRM_ERROR("INDX_BUFFER: buffer size %i, expected %i\n",
 684                                 cmd[3], expected_count);
 685                         return -EINVAL;
 686                 }
 687
 688                 BEGIN_RING(4);
 689                 OUT_RING(cmd[0]);
 690                 OUT_RING_TABLE((int *)(cmdbuf->buf + 4), 3);
 691                 ADVANCE_RING();
 692
 693                 cmdbuf->buf += 4*4;
 694                 cmdbuf->bufsz -= 4*4;
 695         }
 696
 697         return 0;
 698 }
 699
 700 static __inline__ int r300_emit_raw_packet3(drm_radeon_private_t *dev_priv,
 701                                             drm_radeon_kcmd_buffer_t *cmdbuf)
 702 {
 703         u32 header;
 704         int count;
 705         RING_LOCALS;
 706
 707         if (4 > cmdbuf->bufsz)
 708                 return -EINVAL;
 709
 710         /* Fixme !! This simply emits a packet without much checking.
 711            We need to be smarter. */
 712
 713         /* obtain first word - actual packet3 header */
 714         header = *(u32 *) cmdbuf->buf;
 715
 716         /* Is it packet 3 ? */
 717         if ((header >> 30) != 0x3) {
 718                 DRM_ERROR("Not a packet3 header (0x%08x)\n", header);
 719                 return -EINVAL;
 720         }
 721
 722         count = (header >> 16) & 0x3fff;
 723
 724         /* Check again now that we know how much data to expect */
 725         if ((count + 2) * 4 > cmdbuf->bufsz) {
 726                 DRM_ERROR
 727                     ("Expected packet3 of length %d but have only %d bytes left\n",
 728                      (count + 2) * 4, cmdbuf->bufsz);
 729                 return -EINVAL;
 730         }
 731
 732         /* Is it a packet type we know about ? */
 733         switch (header & 0xff00) {
 734         case RADEON_3D_LOAD_VBPNTR:     /* load vertex array pointers */
 735                 return r300_emit_3d_load_vbpntr(dev_priv, cmdbuf, header);
 736
 737         case RADEON_CNTL_BITBLT_MULTI:
 738                 return r300_emit_bitblt_multi(dev_priv, cmdbuf);
 739
 740         case RADEON_CP_INDX_BUFFER:
 741                 DRM_ERROR("packet3 INDX_BUFFER without preceding 3D_DRAW_INDX_2 is illegal.\n");
 742                 return -EINVAL;
 743         case RADEON_CP_3D_DRAW_IMMD_2:
 744                 /* triggers drawing using in-packet vertex data */
 745         case RADEON_CP_3D_DRAW_VBUF_2:
 746                 /* triggers drawing of vertex buffers setup elsewhere */
 747                 dev_priv->track_flush &= ~(RADEON_FLUSH_EMITED |
 748                                            RADEON_PURGE_EMITED);
 749                 break;
 750         case RADEON_CP_3D_DRAW_INDX_2:
 751                 /* triggers drawing using indices to vertex buffer */
 752                 /* whenever we send vertex we clear flush & purge */
 753                 dev_priv->track_flush &= ~(RADEON_FLUSH_EMITED |
 754                                            RADEON_PURGE_EMITED);
 755                 return r300_emit_draw_indx_2(dev_priv, cmdbuf);
 756         case RADEON_WAIT_FOR_IDLE:
 757         case RADEON_CP_NOP:
 758                 /* these packets are safe */
 759                 break;
 760         default:
 761                 DRM_ERROR("Unknown packet3 header (0x%08x)\n", header);
 762                 return -EINVAL;
 763         }
 764
 765         BEGIN_RING(count + 2);
 766         OUT_RING(header);
 767         OUT_RING_TABLE((int *)(cmdbuf->buf + 4), count + 1);
 768         ADVANCE_RING();
 769
 770         cmdbuf->buf += (count + 2) * 4;
 771         cmdbuf->bufsz -= (count + 2) * 4;
 772
 773         return 0;
 774 }
 775
 776 /**
 777  * Emit a rendering packet3 from userspace.
 778  * Called by r300_do_cp_cmdbuf.
 779  */
 780 static __inline__ int r300_emit_packet3(drm_radeon_private_t *dev_priv,
 781                                         drm_radeon_kcmd_buffer_t *cmdbuf,
 782                                         drm_r300_cmd_header_t header)
 783 {
 784         int n;
 785         int ret;
 786         char *orig_buf = cmdbuf->buf;
 787         int orig_bufsz = cmdbuf->bufsz;
 788
 789         /* This is a do-while-loop so that we run the interior at least once,
 790          * even if cmdbuf->nbox is 0. Compare r300_emit_cliprects for rationale.
 791          */
 792         n = 0;
 793         do {
 794                 if (cmdbuf->nbox > R300_SIMULTANEOUS_CLIPRECTS) {
 795                         ret = r300_emit_cliprects(dev_priv, cmdbuf, n);
 796                         if (ret)
 797                                 return ret;
 798
 799                         cmdbuf->buf = orig_buf;
 800                         cmdbuf->bufsz = orig_bufsz;
 801                 }
 802
 803                 switch (header.packet3.packet) {
 804                 case R300_CMD_PACKET3_CLEAR:
 805                         DRM_DEBUG("R300_CMD_PACKET3_CLEAR\n");
 806                         ret = r300_emit_clear(dev_priv, cmdbuf);
 807                         if (ret) {
 808                                 DRM_ERROR("r300_emit_clear failed\n");
 809                                 return ret;
 810                         }
 811                         break;
 812
 813                 case R300_CMD_PACKET3_RAW:
 814                         DRM_DEBUG("R300_CMD_PACKET3_RAW\n");
 815                         ret = r300_emit_raw_packet3(dev_priv, cmdbuf);
 816                         if (ret) {
 817                                 DRM_ERROR("r300_emit_raw_packet3 failed\n");
 818                                 return ret;
 819                         }
 820                         break;
 821
 822                 default:
 823                         DRM_ERROR("bad packet3 type %i at %p\n",
 824                                   header.packet3.packet,
 825                                   cmdbuf->buf - sizeof(header));
 826                         return -EINVAL;
 827                 }
 828
 829                 n += R300_SIMULTANEOUS_CLIPRECTS;
 830         } while (n < cmdbuf->nbox);
 831
 832         return 0;
 833 }
 834
 835 /* Some of the R300 chips seem to be extremely touchy about the two registers
 836  * that are configured in r300_pacify.
 837  * Among the worst offenders seems to be the R300 ND (0x4E44): When userspace
 838  * sends a command buffer that contains only state setting commands and a
 839  * vertex program/parameter upload sequence, this will eventually lead to a
 840  * lockup, unless the sequence is bracketed by calls to r300_pacify.
 841  * So we should take great care to *always* call r300_pacify before
 842  * *anything* 3D related, and again afterwards. This is what the
 843  * call bracket in r300_do_cp_cmdbuf is for.
 844  */
 845
 846 /**
 847  * Emit the sequence to pacify R300.
 848  */
 849 static __inline__ void r300_pacify(drm_radeon_private_t *dev_priv)
 850 {
 851         uint32_t cache_z, cache_3d, cache_2d;
 852         RING_LOCALS;
 853
 854         cache_z = R300_ZC_FLUSH;
 855         cache_2d = R300_DC_FLUSH_2D;
 856         cache_3d = R300_DC_FLUSH_3D;
 857         if (!(dev_priv->track_flush & RADEON_PURGE_EMITED)) {
 858                 /* we can purge, primitive where draw since last purge */
 859                 cache_z |= R300_ZC_FREE;
 860                 cache_2d |= R300_DC_FREE_2D;
 861                 cache_3d |= R300_DC_FREE_3D;
 862         }
 863
 864         /* flush & purge zbuffer */
 865         BEGIN_RING(2);
 866         OUT_RING(CP_PACKET0(R300_ZB_ZCACHE_CTLSTAT, 0));
 867         OUT_RING(cache_z);
 868         ADVANCE_RING();
 869         /* flush & purge 3d */
 870         BEGIN_RING(2);
 871         OUT_RING(CP_PACKET0(R300_RB3D_DSTCACHE_CTLSTAT, 0));
 872         OUT_RING(cache_3d);
 873         ADVANCE_RING();
 874         /* flush & purge texture */
 875         BEGIN_RING(2);
 876         OUT_RING(CP_PACKET0(R300_TX_INVALTAGS, 0));
 877         OUT_RING(0);
 878         ADVANCE_RING();
 879         /* FIXME: is this one really needed ? */
 880         BEGIN_RING(2);
 881         OUT_RING(CP_PACKET0(R300_RB3D_AARESOLVE_CTL, 0));
 882         OUT_RING(0);
 883         ADVANCE_RING();
 884         BEGIN_RING(2);
 885         OUT_RING(CP_PACKET0(RADEON_WAIT_UNTIL, 0));
 886         OUT_RING(RADEON_WAIT_3D_IDLECLEAN);
 887         ADVANCE_RING();
 888         /* flush & purge 2d through E2 as RB2D will trigger lockup */
 889         BEGIN_RING(4);
 890         OUT_RING(CP_PACKET0(R300_DSTCACHE_CTLSTAT, 0));
 891         OUT_RING(cache_2d);
 892         OUT_RING(CP_PACKET0(RADEON_WAIT_UNTIL, 0));
 893         OUT_RING(RADEON_WAIT_2D_IDLECLEAN |
 894                  RADEON_WAIT_HOST_IDLECLEAN);
 895         ADVANCE_RING();
 896         /* set flush & purge flags */
 897         dev_priv->track_flush |= RADEON_FLUSH_EMITED | RADEON_PURGE_EMITED;
 898 }
 899
 900 /**
 901  * Called by r300_do_cp_cmdbuf to update the internal buffer age and state.
 902  * The actual age emit is done by r300_do_cp_cmdbuf, which is why you must
 903  * be careful about how this function is called.
 904  */
 905 static void r300_discard_buffer(struct drm_device * dev, struct drm_master *master, struct drm_buf * buf)
 906 {
 907         drm_radeon_buf_priv_t *buf_priv = buf->dev_private;
 908         struct drm_radeon_master_private *master_priv = master->driver_priv;
 909
 910         buf_priv->age = ++master_priv->sarea_priv->last_dispatch;
 911         buf->pending = 1;
 912         buf->used = 0;
 913 }
 914
 915 static void r300_cmd_wait(drm_radeon_private_t * dev_priv,
 916                           drm_r300_cmd_header_t header)
 917 {
 918         u32 wait_until;
 919         RING_LOCALS;
 920
 921         if (!header.wait.flags)
 922                 return;
 923
 924         wait_until = 0;
 925
 926         switch(header.wait.flags) {
 927         case R300_WAIT_2D:
 928                 wait_until = RADEON_WAIT_2D_IDLE;
 929                 break;
 930         case R300_WAIT_3D:
 931                 wait_until = RADEON_WAIT_3D_IDLE;
 932                 break;
 933         case R300_NEW_WAIT_2D_3D:
 934                 wait_until = RADEON_WAIT_2D_IDLE|RADEON_WAIT_3D_IDLE;
 935                 break;
 936         case R300_NEW_WAIT_2D_2D_CLEAN:
 937                 wait_until = RADEON_WAIT_2D_IDLE|RADEON_WAIT_2D_IDLECLEAN;
 938                 break;
 939         case R300_NEW_WAIT_3D_3D_CLEAN:
 940                 wait_until = RADEON_WAIT_3D_IDLE|RADEON_WAIT_3D_IDLECLEAN;
 941                 break;
 942         case R300_NEW_WAIT_2D_2D_CLEAN_3D_3D_CLEAN:
 943                 wait_until = RADEON_WAIT_2D_IDLE|RADEON_WAIT_2D_IDLECLEAN;
 944                 wait_until |= RADEON_WAIT_3D_IDLE|RADEON_WAIT_3D_IDLECLEAN;
 945                 break;
 946         default:
 947                 return;
 948         }
 949
 950         BEGIN_RING(2);
 951         OUT_RING(CP_PACKET0(RADEON_WAIT_UNTIL, 0));
 952         OUT_RING(wait_until);
 953         ADVANCE_RING();
 954 }
 955
 956 static int r300_scratch(drm_radeon_private_t *dev_priv,
 957                         drm_radeon_kcmd_buffer_t *cmdbuf,
 958                         drm_r300_cmd_header_t header)
 959 {
 960         u32 *ref_age_base;
 961         u32 i, buf_idx, h_pending;
 962         RING_LOCALS;
 963
 964         if (cmdbuf->bufsz < sizeof(uint64_t) + header.scratch.n_bufs * sizeof(buf_idx) ) {
 965                 return -EINVAL;
 966         }
 967
 968         if (header.scratch.reg >= 5) {
 969                 return -EINVAL;
 970         }
 971
 972         dev_priv->scratch_ages[header.scratch.reg] ++;
 973
 974         ref_age_base = (u32 *)(unsigned long)*((uint64_t *)cmdbuf->buf);
 975
 976         cmdbuf->buf += sizeof(uint64_t);
 977         cmdbuf->bufsz -= sizeof(uint64_t);
 978
 979         for (i=0; i < header.scratch.n_bufs; i++) {
 980                 buf_idx = *(u32 *)cmdbuf->buf;
 981                 buf_idx *= 2; /* 8 bytes per buf */
 982
 983                 if (DRM_COPY_TO_USER(ref_age_base + buf_idx, &dev_priv->scratch_ages[header.scratch.reg], sizeof(u32))) {
 984                         return -EINVAL;
 985                 }
 986
 987                 if (DRM_COPY_FROM_USER(&h_pending, ref_age_base + buf_idx + 1, sizeof(u32))) {
 988                         return -EINVAL;
 989                 }
 990
 991                 if (h_pending == 0) {
 992                         return -EINVAL;
 993                 }
 994
 995                 h_pending--;
 996
 997                 if (DRM_COPY_TO_USER(ref_age_base + buf_idx + 1, &h_pending, sizeof(u32))) {
 998                         return -EINVAL;
 999                 }
1000
1001                 cmdbuf->buf += sizeof(buf_idx);
1002                 cmdbuf->bufsz -= sizeof(buf_idx);
1003         }
1004
1005         BEGIN_RING(2);
1006         OUT_RING( CP_PACKET0( RADEON_SCRATCH_REG0 + header.scratch.reg * 4, 0 ) );
1007         OUT_RING( dev_priv->scratch_ages[header.scratch.reg] );
1008         ADVANCE_RING();
1009
1010         return 0;
1011 }
1012
1013 /**
1014  * Uploads user-supplied vertex program instructions or parameters onto
1015  * the graphics card.
1016  * Called by r300_do_cp_cmdbuf.
1017  */
1018 static __inline__ int r300_emit_r500fp(drm_radeon_private_t *dev_priv,
1019                                        drm_radeon_kcmd_buffer_t *cmdbuf,
1020                                        drm_r300_cmd_header_t header)
1021 {
1022         int sz;
1023         int addr;
1024         int type;
1025         int clamp;
1026         int stride;
1027         RING_LOCALS;
1028
1029         sz = header.r500fp.count;
1030         /* address is 9 bits 0 - 8, bit 1 of flags is part of address */
1031         addr = ((header.r500fp.adrhi_flags & 1) << 8) | header.r500fp.adrlo;
1032
1033         type = !!(header.r500fp.adrhi_flags & R500FP_CONSTANT_TYPE);
1034         clamp = !!(header.r500fp.adrhi_flags & R500FP_CONSTANT_CLAMP);
1035
1036         addr |= (type << 16);
1037         addr |= (clamp << 17);
1038
1039         stride = type ? 4 : 6;
1040
1041         DRM_DEBUG("r500fp %d %d type: %d\n", sz, addr, type);
1042         if (!sz)
1043                 return 0;
1044         if (sz * stride * 4 > cmdbuf->bufsz)
1045                 return -EINVAL;
1046
1047         BEGIN_RING(3 + sz * stride);
1048         OUT_RING_REG(R500_GA_US_VECTOR_INDEX, addr);
1049         OUT_RING(CP_PACKET0_TABLE(R500_GA_US_VECTOR_DATA, sz * stride - 1));
1050         OUT_RING_TABLE((int *)cmdbuf->buf, sz * stride);
1051
1052         ADVANCE_RING();
1053
1054         cmdbuf->buf += sz * stride * 4;
1055         cmdbuf->bufsz -= sz * stride * 4;
1056
1057         return 0;
1058 }
1059
1060
1061 /**
1062  * Parses and validates a user-supplied command buffer and emits appropriate
1063  * commands on the DMA ring buffer.
1064  * Called by the ioctl handler function radeon_cp_cmdbuf.
1065  */
1066 int r300_do_cp_cmdbuf(struct drm_device *dev,
1067                       struct drm_file *file_priv,
1068                       drm_radeon_kcmd_buffer_t *cmdbuf)
1069 {
1070         drm_radeon_private_t *dev_priv = dev->dev_private;
1071         struct drm_radeon_master_private *master_priv = file_priv->master->driver_priv;
1072         struct drm_device_dma *dma = dev->dma;
1073         struct drm_buf *buf = NULL;
1074         int emit_dispatch_age = 0;
1075         int ret = 0;
1076
1077         DRM_DEBUG("\n");
1078
1079         /* pacify */
1080         r300_pacify(dev_priv);
1081
1082         if (cmdbuf->nbox <= R300_SIMULTANEOUS_CLIPRECTS) {
1083                 ret = r300_emit_cliprects(dev_priv, cmdbuf, 0);
1084                 if (ret)
1085                         goto cleanup;
1086         }
1087
1088         while (cmdbuf->bufsz >= sizeof(drm_r300_cmd_header_t)) {
1089                 int idx;
1090                 drm_r300_cmd_header_t header;
1091
1092                 header.u = *(unsigned int *)cmdbuf->buf;
1093
1094                 cmdbuf->buf += sizeof(header);
1095                 cmdbuf->bufsz -= sizeof(header);
1096
1097                 switch (header.header.cmd_type) {
1098                 case R300_CMD_PACKET0:
1099                         ret = r300_emit_packet0(dev_priv, cmdbuf, header);
1100                         if (ret) {
1101                                 DRM_ERROR("r300_emit_packet0 failed\n");
1102                                 goto cleanup;
1103                         }
1104                         break;
1105
1106                 case R300_CMD_VPU:
1107                         DRM_DEBUG("R300_CMD_VPU\n");
1108                         ret = r300_emit_vpu(dev_priv, cmdbuf, header);
1109                         if (ret) {
1110                                 DRM_ERROR("r300_emit_vpu failed\n");
1111                                 goto cleanup;
1112                         }
1113                         break;
1114
1115                 case R300_CMD_PACKET3:
1116                         DRM_DEBUG("R300_CMD_PACKET3\n");
1117                         ret = r300_emit_packet3(dev_priv, cmdbuf, header);
1118                         if (ret) {
1119                                 DRM_ERROR("r300_emit_packet3 failed\n");
1120                                 goto cleanup;
1121                         }
1122                         break;
1123
1124                 case R300_CMD_END3D:
1125                         DRM_DEBUG("R300_CMD_END3D\n");
1126                         /* TODO:
1127                            Ideally userspace driver should not need to issue this call,
1128                            i.e. the drm driver should issue it automatically and prevent
1129                            lockups.
1130
1131                            In practice, we do not understand why this call is needed and what
1132                            it does (except for some vague guesses that it has to do with cache
1133                            coherence) and so the user space driver does it.
1134
1135                            Once we are sure which uses prevent lockups the code could be moved
1136                            into the kernel and the userspace driver will not
1137                            need to use this command.
1138
1139                            Note that issuing this command does not hurt anything
1140                            except, possibly, performance */
1141                         r300_pacify(dev_priv);
1142                         break;
1143
1144                 case R300_CMD_CP_DELAY:
1145                         /* simple enough, we can do it here */
1146                         DRM_DEBUG("R300_CMD_CP_DELAY\n");
1147                         {
1148                                 int i;
1149                                 RING_LOCALS;
1150
1151                                 BEGIN_RING(header.delay.count);
1152                                 for (i = 0; i < header.delay.count; i++)
1153                                         OUT_RING(RADEON_CP_PACKET2);
1154                                 ADVANCE_RING();
1155                         }
1156                         break;
1157
1158                 case R300_CMD_DMA_DISCARD:
1159                         DRM_DEBUG("RADEON_CMD_DMA_DISCARD\n");
1160                         idx = header.dma.buf_idx;
1161                         if (idx < 0 || idx >= dma->buf_count) {
1162                                 DRM_ERROR("buffer index %d (of %d max)\n",
1163                                           idx, dma->buf_count - 1);
1164                                 ret = -EINVAL;
1165                                 goto cleanup;
1166                         }
1167
1168                         buf = dma->buflist[idx];
1169                         if (buf->file_priv != file_priv || buf->pending) {
1170                                 DRM_ERROR("bad buffer %p %p %d\n",
1171                                           buf->file_priv, file_priv,
1172                                           buf->pending);
1173                                 ret = -EINVAL;
1174                                 goto cleanup;
1175                         }
1176
1177                         emit_dispatch_age = 1;
1178                         r300_discard_buffer(dev, file_priv->master, buf);
1179                         break;
1180
1181                 case R300_CMD_WAIT:
1182                         DRM_DEBUG("R300_CMD_WAIT\n");
1183                         r300_cmd_wait(dev_priv, header);
1184                         break;
1185
1186                 case R300_CMD_SCRATCH:
1187                         DRM_DEBUG("R300_CMD_SCRATCH\n");
1188                         ret = r300_scratch(dev_priv, cmdbuf, header);
1189                         if (ret) {
1190                                 DRM_ERROR("r300_scratch failed\n");
1191                                 goto cleanup;
1192                         }
1193                         break;
1194
1195                 case R300_CMD_R500FP:
1196                         if ((dev_priv->flags & RADEON_FAMILY_MASK) < CHIP_RV515) {
1197                                 DRM_ERROR("Calling r500 command on r300 card\n");
1198                                 ret = -EINVAL;
1199                                 goto cleanup;
1200                         }
1201                         DRM_DEBUG("R300_CMD_R500FP\n");
1202                         ret = r300_emit_r500fp(dev_priv, cmdbuf, header);
1203                         if (ret) {
1204                                 DRM_ERROR("r300_emit_r500fp failed\n");
1205                                 goto cleanup;
1206                         }
1207                         break;
1208                 default:
1209                         DRM_ERROR("bad cmd_type %i at %p\n",
1210                                   header.header.cmd_type,
1211                                   cmdbuf->buf - sizeof(header));
1212                         ret = -EINVAL;
1213                         goto cleanup;
1214                 }
1215         }
1216
1217         DRM_DEBUG("END\n");
1218
1219       cleanup:
1220         r300_pacify(dev_priv);
1221
1222         /* We emit the vertex buffer age here, outside the pacifier "brackets"
1223          * for two reasons:
1224          *  (1) This may coalesce multiple age emissions into a single one and
1225          *  (2) more importantly, some chips lock up hard when scratch registers
1226          *      are written inside the pacifier bracket.
1227          */
1228         if (emit_dispatch_age) {
1229                 RING_LOCALS;
1230
1231                 /* Emit the vertex buffer age */
1232                 BEGIN_RING(2);
1233                 RADEON_DISPATCH_AGE(master_priv->sarea_priv->last_dispatch);
1234                 ADVANCE_RING();
1235         }
1236
1237         COMMIT_RING();
1238
1239         return ret;
1240 }