sys/dev/drm/radeon/evergreen_cs.c

   1 /*
   2  * Copyright 2010 Advanced Micro Devices, Inc.
   3  * Copyright 2008 Red Hat Inc.
   4  * Copyright 2009 Jerome Glisse.
   5  *
   6  * Permission is hereby granted, free of charge, to any person obtaining a
   7  * copy of this software and associated documentation files (the "Software"),
   8  * to deal in the Software without restriction, including without limitation
   9  * the rights to use, copy, modify, merge, publish, distribute, sublicense,
  10  * and/or sell copies of the Software, and to permit persons to whom the
  11  * Software is furnished to do so, subject to the following conditions:
  12  *
  13  * The above copyright notice and this permission notice shall be included in
  14  * all copies or substantial portions of the Software.
  15  *
  16  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  17  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  18  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
  19  * THE COPYRIGHT HOLDER(S) OR AUTHOR(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR
  20  * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
  21  * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
  22  * OTHER DEALINGS IN THE SOFTWARE.
  23  *
  24  * Authors: Dave Airlie
  25  *          Alex Deucher
  26  *          Jerome Glisse
  27  *
  28  * $FreeBSD: head/sys/dev/drm2/radeon/evergreen_cs.c 254885 2013-08-25 19:37:15Z dumbbell $
  29  */
  30
  31 #include <drm/drmP.h>
  32 #include "radeon.h"
  33 #include "radeon_asic.h"
  34 #include "evergreend.h"
  35 #include "evergreen_reg_safe.h"
  36 #include "cayman_reg_safe.h"
  37 #include "r600_cs.h"
  38
  39 #define MAX(a,b)                   (((a)>(b))?(a):(b))
  40 #define MIN(a,b)                   (((a)<(b))?(a):(b))
  41
  42 static int evergreen_cs_packet_next_reloc(struct radeon_cs_parser *p,
  43                                           struct radeon_cs_reloc **cs_reloc);
  44
  45 struct evergreen_cs_track {
  46         u32                     group_size;
  47         u32                     nbanks;
  48         u32                     npipes;
  49         u32                     row_size;
  50         /* value we track */
  51         u32                     nsamples;               /* unused */
  52         struct radeon_bo        *cb_color_bo[12];
  53         u32                     cb_color_bo_offset[12];
  54         struct radeon_bo        *cb_color_fmask_bo[8];  /* unused */
  55         struct radeon_bo        *cb_color_cmask_bo[8];  /* unused */
  56         u32                     cb_color_info[12];
  57         u32                     cb_color_view[12];
  58         u32                     cb_color_pitch[12];
  59         u32                     cb_color_slice[12];
  60         u32                     cb_color_slice_idx[12];
  61         u32                     cb_color_attrib[12];
  62         u32                     cb_color_cmask_slice[8];/* unused */
  63         u32                     cb_color_fmask_slice[8];/* unused */
  64         u32                     cb_target_mask;
  65         u32                     cb_shader_mask; /* unused */
  66         u32                     vgt_strmout_config;
  67         u32                     vgt_strmout_buffer_config;
  68         struct radeon_bo        *vgt_strmout_bo[4];
  69         u32                     vgt_strmout_bo_offset[4];
  70         u32                     vgt_strmout_size[4];
  71         u32                     db_depth_control;
  72         u32                     db_depth_view;
  73         u32                     db_depth_slice;
  74         u32                     db_depth_size;
  75         u32                     db_z_info;
  76         u32                     db_z_read_offset;
  77         u32                     db_z_write_offset;
  78         struct radeon_bo        *db_z_read_bo;
  79         struct radeon_bo        *db_z_write_bo;
  80         u32                     db_s_info;
  81         u32                     db_s_read_offset;
  82         u32                     db_s_write_offset;
  83         struct radeon_bo        *db_s_read_bo;
  84         struct radeon_bo        *db_s_write_bo;
  85         bool                    sx_misc_kill_all_prims;
  86         bool                    cb_dirty;
  87         bool                    db_dirty;
  88         bool                    streamout_dirty;
  89         u32                     htile_offset;
  90         u32                     htile_surface;
  91         struct radeon_bo        *htile_bo;
  92 };
  93
  94 static u32 evergreen_cs_get_aray_mode(u32 tiling_flags)
  95 {
  96         if (tiling_flags & RADEON_TILING_MACRO)
  97                 return ARRAY_2D_TILED_THIN1;
  98         else if (tiling_flags & RADEON_TILING_MICRO)
  99                 return ARRAY_1D_TILED_THIN1;
 100         else
 101                 return ARRAY_LINEAR_GENERAL;
 102 }
 103
 104 static u32 evergreen_cs_get_num_banks(u32 nbanks)
 105 {
 106         switch (nbanks) {
 107         case 2:
 108                 return ADDR_SURF_2_BANK;
 109         case 4:
 110                 return ADDR_SURF_4_BANK;
 111         case 8:
 112         default:
 113                 return ADDR_SURF_8_BANK;
 114         case 16:
 115                 return ADDR_SURF_16_BANK;
 116         }
 117 }
 118
 119 static void evergreen_cs_track_init(struct evergreen_cs_track *track)
 120 {
 121         int i;
 122
 123         for (i = 0; i < 8; i++) {
 124                 track->cb_color_fmask_bo[i] = NULL;
 125                 track->cb_color_cmask_bo[i] = NULL;
 126                 track->cb_color_cmask_slice[i] = 0;
 127                 track->cb_color_fmask_slice[i] = 0;
 128         }
 129
 130         for (i = 0; i < 12; i++) {
 131                 track->cb_color_bo[i] = NULL;
 132                 track->cb_color_bo_offset[i] = 0xFFFFFFFF;
 133                 track->cb_color_info[i] = 0;
 134                 track->cb_color_view[i] = 0xFFFFFFFF;
 135                 track->cb_color_pitch[i] = 0;
 136                 track->cb_color_slice[i] = 0xfffffff;
 137                 track->cb_color_slice_idx[i] = 0;
 138         }
 139         track->cb_target_mask = 0xFFFFFFFF;
 140         track->cb_shader_mask = 0xFFFFFFFF;
 141         track->cb_dirty = true;
 142
 143         track->db_depth_slice = 0xffffffff;
 144         track->db_depth_view = 0xFFFFC000;
 145         track->db_depth_size = 0xFFFFFFFF;
 146         track->db_depth_control = 0xFFFFFFFF;
 147         track->db_z_info = 0xFFFFFFFF;
 148         track->db_z_read_offset = 0xFFFFFFFF;
 149         track->db_z_write_offset = 0xFFFFFFFF;
 150         track->db_z_read_bo = NULL;
 151         track->db_z_write_bo = NULL;
 152         track->db_s_info = 0xFFFFFFFF;
 153         track->db_s_read_offset = 0xFFFFFFFF;
 154         track->db_s_write_offset = 0xFFFFFFFF;
 155         track->db_s_read_bo = NULL;
 156         track->db_s_write_bo = NULL;
 157         track->db_dirty = true;
 158         track->htile_bo = NULL;
 159         track->htile_offset = 0xFFFFFFFF;
 160         track->htile_surface = 0;
 161
 162         for (i = 0; i < 4; i++) {
 163                 track->vgt_strmout_size[i] = 0;
 164                 track->vgt_strmout_bo[i] = NULL;
 165                 track->vgt_strmout_bo_offset[i] = 0xFFFFFFFF;
 166         }
 167         track->streamout_dirty = true;
 168         track->sx_misc_kill_all_prims = false;
 169 }
 170
 171 struct eg_surface {
 172         /* value gathered from cs */
 173         unsigned        nbx;
 174         unsigned        nby;
 175         unsigned        format;
 176         unsigned        mode;
 177         unsigned        nbanks;
 178         unsigned        bankw;
 179         unsigned        bankh;
 180         unsigned        tsplit;
 181         unsigned        mtilea;
 182         unsigned        nsamples;
 183         /* output value */
 184         unsigned        bpe;
 185         unsigned        layer_size;
 186         unsigned        palign;
 187         unsigned        halign;
 188         unsigned long   base_align;
 189 };
 190
 191 static int evergreen_surface_check_linear(struct radeon_cs_parser *p,
 192                                           struct eg_surface *surf,
 193                                           const char *prefix)
 194 {
 195         surf->layer_size = surf->nbx * surf->nby * surf->bpe * surf->nsamples;
 196         surf->base_align = surf->bpe;
 197         surf->palign = 1;
 198         surf->halign = 1;
 199         return 0;
 200 }
 201
 202 static int evergreen_surface_check_linear_aligned(struct radeon_cs_parser *p,
 203                                                   struct eg_surface *surf,
 204                                                   const char *prefix)
 205 {
 206         struct evergreen_cs_track *track = p->track;
 207         unsigned palign;
 208
 209         palign = MAX(64, track->group_size / surf->bpe);
 210         surf->layer_size = surf->nbx * surf->nby * surf->bpe * surf->nsamples;
 211         surf->base_align = track->group_size;
 212         surf->palign = palign;
 213         surf->halign = 1;
 214         if (surf->nbx & (palign - 1)) {
 215                 if (prefix) {
 216                         dev_warn(p->dev, "%s:%d %s pitch %d invalid must be aligned with %d\n",
 217                                  __func__, __LINE__, prefix, surf->nbx, palign);
 218                 }
 219                 return -EINVAL;
 220         }
 221         return 0;
 222 }
 223
 224 static int evergreen_surface_check_1d(struct radeon_cs_parser *p,
 225                                       struct eg_surface *surf,
 226                                       const char *prefix)
 227 {
 228         struct evergreen_cs_track *track = p->track;
 229         unsigned palign;
 230
 231         palign = track->group_size / (8 * surf->bpe * surf->nsamples);
 232         palign = MAX(8, palign);
 233         surf->layer_size = surf->nbx * surf->nby * surf->bpe;
 234         surf->base_align = track->group_size;
 235         surf->palign = palign;
 236         surf->halign = 8;
 237         if ((surf->nbx & (palign - 1))) {
 238                 if (prefix) {
 239                         dev_warn(p->dev, "%s:%d %s pitch %d invalid must be aligned with %d (%d %d %d)\n",
 240                                  __func__, __LINE__, prefix, surf->nbx, palign,
 241                                  track->group_size, surf->bpe, surf->nsamples);
 242                 }
 243                 return -EINVAL;
 244         }
 245         if ((surf->nby & (8 - 1))) {
 246                 if (prefix) {
 247                         dev_warn(p->dev, "%s:%d %s height %d invalid must be aligned with 8\n",
 248                                  __func__, __LINE__, prefix, surf->nby);
 249                 }
 250                 return -EINVAL;
 251         }
 252         return 0;
 253 }
 254
 255 static int evergreen_surface_check_2d(struct radeon_cs_parser *p,
 256                                       struct eg_surface *surf,
 257                                       const char *prefix)
 258 {
 259         struct evergreen_cs_track *track = p->track;
 260         unsigned palign, halign, tileb, slice_pt;
 261         unsigned mtile_pr, mtile_ps, mtileb;
 262
 263         tileb = 64 * surf->bpe * surf->nsamples;
 264         slice_pt = 1;
 265         if (tileb > surf->tsplit) {
 266                 slice_pt = tileb / surf->tsplit;
 267         }
 268         tileb = tileb / slice_pt;
 269         /* macro tile width & height */
 270         palign = (8 * surf->bankw * track->npipes) * surf->mtilea;
 271         halign = (8 * surf->bankh * surf->nbanks) / surf->mtilea;
 272         mtileb = (palign / 8) * (halign / 8) * tileb;
 273         mtile_pr = surf->nbx / palign;
 274         mtile_ps = (mtile_pr * surf->nby) / halign;
 275         surf->layer_size = mtile_ps * mtileb * slice_pt;
 276         surf->base_align = (palign / 8) * (halign / 8) * tileb;
 277         surf->palign = palign;
 278         surf->halign = halign;
 279
 280         if ((surf->nbx & (palign - 1))) {
 281                 if (prefix) {
 282                         dev_warn(p->dev, "%s:%d %s pitch %d invalid must be aligned with %d\n",
 283                                  __func__, __LINE__, prefix, surf->nbx, palign);
 284                 }
 285                 return -EINVAL;
 286         }
 287         if ((surf->nby & (halign - 1))) {
 288                 if (prefix) {
 289                         dev_warn(p->dev, "%s:%d %s height %d invalid must be aligned with %d\n",
 290                                  __func__, __LINE__, prefix, surf->nby, halign);
 291                 }
 292                 return -EINVAL;
 293         }
 294
 295         return 0;
 296 }
 297
 298 static int evergreen_surface_check(struct radeon_cs_parser *p,
 299                                    struct eg_surface *surf,
 300                                    const char *prefix)
 301 {
 302         /* some common value computed here */
 303         surf->bpe = r600_fmt_get_blocksize(surf->format);
 304
 305         switch (surf->mode) {
 306         case ARRAY_LINEAR_GENERAL:
 307                 return evergreen_surface_check_linear(p, surf, prefix);
 308         case ARRAY_LINEAR_ALIGNED:
 309                 return evergreen_surface_check_linear_aligned(p, surf, prefix);
 310         case ARRAY_1D_TILED_THIN1:
 311                 return evergreen_surface_check_1d(p, surf, prefix);
 312         case ARRAY_2D_TILED_THIN1:
 313                 return evergreen_surface_check_2d(p, surf, prefix);
 314         default:
 315                 dev_warn(p->dev, "%s:%d %s invalid array mode %d\n",
 316                                 __func__, __LINE__, prefix, surf->mode);
 317                 return -EINVAL;
 318         }
 319         return -EINVAL;
 320 }
 321
 322 static int evergreen_surface_value_conv_check(struct radeon_cs_parser *p,
 323                                               struct eg_surface *surf,
 324                                               const char *prefix)
 325 {
 326         switch (surf->mode) {
 327         case ARRAY_2D_TILED_THIN1:
 328                 break;
 329         case ARRAY_LINEAR_GENERAL:
 330         case ARRAY_LINEAR_ALIGNED:
 331         case ARRAY_1D_TILED_THIN1:
 332                 return 0;
 333         default:
 334                 dev_warn(p->dev, "%s:%d %s invalid array mode %d\n",
 335                                 __func__, __LINE__, prefix, surf->mode);
 336                 return -EINVAL;
 337         }
 338
 339         switch (surf->nbanks) {
 340         case 0: surf->nbanks = 2; break;
 341         case 1: surf->nbanks = 4; break;
 342         case 2: surf->nbanks = 8; break;
 343         case 3: surf->nbanks = 16; break;
 344         default:
 345                 dev_warn(p->dev, "%s:%d %s invalid number of banks %d\n",
 346                          __func__, __LINE__, prefix, surf->nbanks);
 347                 return -EINVAL;
 348         }
 349         switch (surf->bankw) {
 350         case 0: surf->bankw = 1; break;
 351         case 1: surf->bankw = 2; break;
 352         case 2: surf->bankw = 4; break;
 353         case 3: surf->bankw = 8; break;
 354         default:
 355                 dev_warn(p->dev, "%s:%d %s invalid bankw %d\n",
 356                          __func__, __LINE__, prefix, surf->bankw);
 357                 return -EINVAL;
 358         }
 359         switch (surf->bankh) {
 360         case 0: surf->bankh = 1; break;
 361         case 1: surf->bankh = 2; break;
 362         case 2: surf->bankh = 4; break;
 363         case 3: surf->bankh = 8; break;
 364         default:
 365                 dev_warn(p->dev, "%s:%d %s invalid bankh %d\n",
 366                          __func__, __LINE__, prefix, surf->bankh);
 367                 return -EINVAL;
 368         }
 369         switch (surf->mtilea) {
 370         case 0: surf->mtilea = 1; break;
 371         case 1: surf->mtilea = 2; break;
 372         case 2: surf->mtilea = 4; break;
 373         case 3: surf->mtilea = 8; break;
 374         default:
 375                 dev_warn(p->dev, "%s:%d %s invalid macro tile aspect %d\n",
 376                          __func__, __LINE__, prefix, surf->mtilea);
 377                 return -EINVAL;
 378         }
 379         switch (surf->tsplit) {
 380         case 0: surf->tsplit = 64; break;
 381         case 1: surf->tsplit = 128; break;
 382         case 2: surf->tsplit = 256; break;
 383         case 3: surf->tsplit = 512; break;
 384         case 4: surf->tsplit = 1024; break;
 385         case 5: surf->tsplit = 2048; break;
 386         case 6: surf->tsplit = 4096; break;
 387         default:
 388                 dev_warn(p->dev, "%s:%d %s invalid tile split %d\n",
 389                          __func__, __LINE__, prefix, surf->tsplit);
 390                 return -EINVAL;
 391         }
 392         return 0;
 393 }
 394
 395 static int evergreen_cs_track_validate_cb(struct radeon_cs_parser *p, unsigned id)
 396 {
 397         struct evergreen_cs_track *track = p->track;
 398         struct eg_surface surf;
 399         unsigned pitch, slice, mslice;
 400         unsigned long offset;
 401         int r;
 402
 403         mslice = G_028C6C_SLICE_MAX(track->cb_color_view[id]) + 1;
 404         pitch = track->cb_color_pitch[id];
 405         slice = track->cb_color_slice[id];
 406         surf.nbx = (pitch + 1) * 8;
 407         surf.nby = ((slice + 1) * 64) / surf.nbx;
 408         surf.mode = G_028C70_ARRAY_MODE(track->cb_color_info[id]);
 409         surf.format = G_028C70_FORMAT(track->cb_color_info[id]);
 410         surf.tsplit = G_028C74_TILE_SPLIT(track->cb_color_attrib[id]);
 411         surf.nbanks = G_028C74_NUM_BANKS(track->cb_color_attrib[id]);
 412         surf.bankw = G_028C74_BANK_WIDTH(track->cb_color_attrib[id]);
 413         surf.bankh = G_028C74_BANK_HEIGHT(track->cb_color_attrib[id]);
 414         surf.mtilea = G_028C74_MACRO_TILE_ASPECT(track->cb_color_attrib[id]);
 415         surf.nsamples = 1;
 416
 417         if (!r600_fmt_is_valid_color(surf.format)) {
 418                 dev_warn(p->dev, "%s:%d cb invalid format %d for %d (0x%08x)\n",
 419                          __func__, __LINE__, surf.format,
 420                         id, track->cb_color_info[id]);
 421                 return -EINVAL;
 422         }
 423
 424         r = evergreen_surface_value_conv_check(p, &surf, "cb");
 425         if (r) {
 426                 return r;
 427         }
 428
 429         r = evergreen_surface_check(p, &surf, "cb");
 430         if (r) {
 431                 dev_warn(p->dev, "%s:%d cb[%d] invalid (0x%08x 0x%08x 0x%08x 0x%08x)\n",
 432                          __func__, __LINE__, id, track->cb_color_pitch[id],
 433                          track->cb_color_slice[id], track->cb_color_attrib[id],
 434                          track->cb_color_info[id]);
 435                 return r;
 436         }
 437
 438         offset = track->cb_color_bo_offset[id] << 8;
 439         if (offset & (surf.base_align - 1)) {
 440                 dev_warn(p->dev, "%s:%d cb[%d] bo base %ld not aligned with %ld\n",
 441                          __func__, __LINE__, id, offset, surf.base_align);
 442                 return -EINVAL;
 443         }
 444
 445         offset += surf.layer_size * mslice;
 446         if (offset > radeon_bo_size(track->cb_color_bo[id])) {
 447                 /* old ddx are broken they allocate bo with w*h*bpp but
 448                  * program slice with ALIGN(h, 8), catch this and patch
 449                  * command stream.
 450                  */
 451                 if (!surf.mode) {
 452                         volatile u32 *ib = p->ib.ptr;
 453                         unsigned long tmp, nby, bsize, size, min = 0;
 454
 455                         /* find the height the ddx wants */
 456                         if (surf.nby > 8) {
 457                                 min = surf.nby - 8;
 458                         }
 459                         bsize = radeon_bo_size(track->cb_color_bo[id]);
 460                         tmp = track->cb_color_bo_offset[id] << 8;
 461                         for (nby = surf.nby; nby > min; nby--) {
 462                                 size = nby * surf.nbx * surf.bpe * surf.nsamples;
 463                                 if ((tmp + size * mslice) <= bsize) {
 464                                         break;
 465                                 }
 466                         }
 467                         if (nby > min) {
 468                                 surf.nby = nby;
 469                                 slice = ((nby * surf.nbx) / 64) - 1;
 470                                 if (!evergreen_surface_check(p, &surf, "cb")) {
 471                                         /* check if this one works */
 472                                         tmp += surf.layer_size * mslice;
 473                                         if (tmp <= bsize) {
 474                                                 ib[track->cb_color_slice_idx[id]] = slice;
 475                                                 goto old_ddx_ok;
 476                                         }
 477                                 }
 478                         }
 479                 }
 480                 dev_warn(p->dev, "%s:%d cb[%d] bo too small (layer size %d, "
 481                          "offset %d, max layer %d, bo size %ld, slice %d)\n",
 482                          __func__, __LINE__, id, surf.layer_size,
 483                         track->cb_color_bo_offset[id] << 8, mslice,
 484                         radeon_bo_size(track->cb_color_bo[id]), slice);
 485                 dev_warn(p->dev, "%s:%d problematic surf: (%d %d) (%d %d %d %d %d %d %d)\n",
 486                          __func__, __LINE__, surf.nbx, surf.nby,
 487                         surf.mode, surf.bpe, surf.nsamples,
 488                         surf.bankw, surf.bankh,
 489                         surf.tsplit, surf.mtilea);
 490                 return -EINVAL;
 491         }
 492 old_ddx_ok:
 493
 494         return 0;
 495 }
 496
 497 static int evergreen_cs_track_validate_htile(struct radeon_cs_parser *p,
 498                                                 unsigned nbx, unsigned nby)
 499 {
 500         struct evergreen_cs_track *track = p->track;
 501         unsigned long size;
 502
 503         if (track->htile_bo == NULL) {
 504                 dev_warn(p->dev, "%s:%d htile enabled without htile surface 0x%08x\n",
 505                                 __func__, __LINE__, track->db_z_info);
 506                 return -EINVAL;
 507         }
 508
 509         if (G_028ABC_LINEAR(track->htile_surface)) {
 510                 /* pitch must be 16 htiles aligned == 16 * 8 pixel aligned */
 511                 nbx = roundup(nbx, 16 * 8);
 512                 /* height is npipes htiles aligned == npipes * 8 pixel aligned */
 513                 nby = roundup(nby, track->npipes * 8);
 514         } else {
 515                 /* always assume 8x8 htile */
 516                 /* align is htile align * 8, htile align vary according to
 517                  * number of pipe and tile width and nby
 518                  */
 519                 switch (track->npipes) {
 520                 case 8:
 521                         /* HTILE_WIDTH = 8 & HTILE_HEIGHT = 8*/
 522                         nbx = roundup(nbx, 64 * 8);
 523                         nby = roundup(nby, 64 * 8);
 524                         break;
 525                 case 4:
 526                         /* HTILE_WIDTH = 8 & HTILE_HEIGHT = 8*/
 527                         nbx = roundup(nbx, 64 * 8);
 528                         nby = roundup(nby, 32 * 8);
 529                         break;
 530                 case 2:
 531                         /* HTILE_WIDTH = 8 & HTILE_HEIGHT = 8*/
 532                         nbx = roundup(nbx, 32 * 8);
 533                         nby = roundup(nby, 32 * 8);
 534                         break;
 535                 case 1:
 536                         /* HTILE_WIDTH = 8 & HTILE_HEIGHT = 8*/
 537                         nbx = roundup(nbx, 32 * 8);
 538                         nby = roundup(nby, 16 * 8);
 539                         break;
 540                 default:
 541                         dev_warn(p->dev, "%s:%d invalid num pipes %d\n",
 542                                         __func__, __LINE__, track->npipes);
 543                         return -EINVAL;
 544                 }
 545         }
 546         /* compute number of htile */
 547         nbx = nbx >> 3;
 548         nby = nby >> 3;
 549         /* size must be aligned on npipes * 2K boundary */
 550         size = roundup(nbx * nby * 4, track->npipes * (2 << 10));
 551         size += track->htile_offset;
 552
 553         if (size > radeon_bo_size(track->htile_bo)) {
 554                 dev_warn(p->dev, "%s:%d htile surface too small %ld for %ld (%d %d)\n",
 555                                 __func__, __LINE__, radeon_bo_size(track->htile_bo),
 556                                 size, nbx, nby);
 557                 return -EINVAL;
 558         }
 559         return 0;
 560 }
 561
 562 static int evergreen_cs_track_validate_stencil(struct radeon_cs_parser *p)
 563 {
 564         struct evergreen_cs_track *track = p->track;
 565         struct eg_surface surf;
 566         unsigned pitch, slice, mslice;
 567         unsigned long offset;
 568         int r;
 569
 570         mslice = G_028008_SLICE_MAX(track->db_depth_view) + 1;
 571         pitch = G_028058_PITCH_TILE_MAX(track->db_depth_size);
 572         slice = track->db_depth_slice;
 573         surf.nbx = (pitch + 1) * 8;
 574         surf.nby = ((slice + 1) * 64) / surf.nbx;
 575         surf.mode = G_028040_ARRAY_MODE(track->db_z_info);
 576         surf.format = G_028044_FORMAT(track->db_s_info);
 577         surf.tsplit = G_028044_TILE_SPLIT(track->db_s_info);
 578         surf.nbanks = G_028040_NUM_BANKS(track->db_z_info);
 579         surf.bankw = G_028040_BANK_WIDTH(track->db_z_info);
 580         surf.bankh = G_028040_BANK_HEIGHT(track->db_z_info);
 581         surf.mtilea = G_028040_MACRO_TILE_ASPECT(track->db_z_info);
 582         surf.nsamples = 1;
 583
 584         if (surf.format != 1) {
 585                 dev_warn(p->dev, "%s:%d stencil invalid format %d\n",
 586                          __func__, __LINE__, surf.format);
 587                 return -EINVAL;
 588         }
 589         /* replace by color format so we can use same code */
 590         surf.format = V_028C70_COLOR_8;
 591
 592         r = evergreen_surface_value_conv_check(p, &surf, "stencil");
 593         if (r) {
 594                 return r;
 595         }
 596
 597         r = evergreen_surface_check(p, &surf, NULL);
 598         if (r) {
 599                 /* old userspace doesn't compute proper depth/stencil alignment
 600                  * check that alignment against a bigger byte per elements and
 601                  * only report if that alignment is wrong too.
 602                  */
 603                 surf.format = V_028C70_COLOR_8_8_8_8;
 604                 r = evergreen_surface_check(p, &surf, "stencil");
 605                 if (r) {
 606                         dev_warn(p->dev, "%s:%d stencil invalid (0x%08x 0x%08x 0x%08x 0x%08x)\n",
 607                                  __func__, __LINE__, track->db_depth_size,
 608                                  track->db_depth_slice, track->db_s_info, track->db_z_info);
 609                 }
 610                 return r;
 611         }
 612
 613         offset = track->db_s_read_offset << 8;
 614         if (offset & (surf.base_align - 1)) {
 615                 dev_warn(p->dev, "%s:%d stencil read bo base %ld not aligned with %ld\n",
 616                          __func__, __LINE__, offset, surf.base_align);
 617                 return -EINVAL;
 618         }
 619         offset += surf.layer_size * mslice;
 620         if (offset > radeon_bo_size(track->db_s_read_bo)) {
 621                 dev_warn(p->dev, "%s:%d stencil read bo too small (layer size %d, "
 622                          "offset %ld, max layer %d, bo size %ld)\n",
 623                          __func__, __LINE__, surf.layer_size,
 624                         (unsigned long)track->db_s_read_offset << 8, mslice,
 625                         radeon_bo_size(track->db_s_read_bo));
 626                 dev_warn(p->dev, "%s:%d stencil invalid (0x%08x 0x%08x 0x%08x 0x%08x)\n",
 627                          __func__, __LINE__, track->db_depth_size,
 628                          track->db_depth_slice, track->db_s_info, track->db_z_info);
 629                 return -EINVAL;
 630         }
 631
 632         offset = track->db_s_write_offset << 8;
 633         if (offset & (surf.base_align - 1)) {
 634                 dev_warn(p->dev, "%s:%d stencil write bo base %ld not aligned with %ld\n",
 635                          __func__, __LINE__, offset, surf.base_align);
 636                 return -EINVAL;
 637         }
 638         offset += surf.layer_size * mslice;
 639         if (offset > radeon_bo_size(track->db_s_write_bo)) {
 640                 dev_warn(p->dev, "%s:%d stencil write bo too small (layer size %d, "
 641                          "offset %ld, max layer %d, bo size %ld)\n",
 642                          __func__, __LINE__, surf.layer_size,
 643                         (unsigned long)track->db_s_write_offset << 8, mslice,
 644                         radeon_bo_size(track->db_s_write_bo));
 645                 return -EINVAL;
 646         }
 647
 648         /* hyperz */
 649         if (G_028040_TILE_SURFACE_ENABLE(track->db_z_info)) {
 650                 r = evergreen_cs_track_validate_htile(p, surf.nbx, surf.nby);
 651                 if (r) {
 652                         return r;
 653                 }
 654         }
 655
 656         return 0;
 657 }
 658
 659 static int evergreen_cs_track_validate_depth(struct radeon_cs_parser *p)
 660 {
 661         struct evergreen_cs_track *track = p->track;
 662         struct eg_surface surf;
 663         unsigned pitch, slice, mslice;
 664         unsigned long offset;
 665         int r;
 666
 667         mslice = G_028008_SLICE_MAX(track->db_depth_view) + 1;
 668         pitch = G_028058_PITCH_TILE_MAX(track->db_depth_size);
 669         slice = track->db_depth_slice;
 670         surf.nbx = (pitch + 1) * 8;
 671         surf.nby = ((slice + 1) * 64) / surf.nbx;
 672         surf.mode = G_028040_ARRAY_MODE(track->db_z_info);
 673         surf.format = G_028040_FORMAT(track->db_z_info);
 674         surf.tsplit = G_028040_TILE_SPLIT(track->db_z_info);
 675         surf.nbanks = G_028040_NUM_BANKS(track->db_z_info);
 676         surf.bankw = G_028040_BANK_WIDTH(track->db_z_info);
 677         surf.bankh = G_028040_BANK_HEIGHT(track->db_z_info);
 678         surf.mtilea = G_028040_MACRO_TILE_ASPECT(track->db_z_info);
 679         surf.nsamples = 1;
 680
 681         switch (surf.format) {
 682         case V_028040_Z_16:
 683                 surf.format = V_028C70_COLOR_16;
 684                 break;
 685         case V_028040_Z_24:
 686         case V_028040_Z_32_FLOAT:
 687                 surf.format = V_028C70_COLOR_8_8_8_8;
 688                 break;
 689         default:
 690                 dev_warn(p->dev, "%s:%d depth invalid format %d\n",
 691                          __func__, __LINE__, surf.format);
 692                 return -EINVAL;
 693         }
 694
 695         r = evergreen_surface_value_conv_check(p, &surf, "depth");
 696         if (r) {
 697                 dev_warn(p->dev, "%s:%d depth invalid (0x%08x 0x%08x 0x%08x)\n",
 698                          __func__, __LINE__, track->db_depth_size,
 699                          track->db_depth_slice, track->db_z_info);
 700                 return r;
 701         }
 702
 703         r = evergreen_surface_check(p, &surf, "depth");
 704         if (r) {
 705                 dev_warn(p->dev, "%s:%d depth invalid (0x%08x 0x%08x 0x%08x)\n",
 706                          __func__, __LINE__, track->db_depth_size,
 707                          track->db_depth_slice, track->db_z_info);
 708                 return r;
 709         }
 710
 711         offset = track->db_z_read_offset << 8;
 712         if (offset & (surf.base_align - 1)) {
 713                 dev_warn(p->dev, "%s:%d stencil read bo base %ld not aligned with %ld\n",
 714                          __func__, __LINE__, offset, surf.base_align);
 715                 return -EINVAL;
 716         }
 717         offset += surf.layer_size * mslice;
 718         if (offset > radeon_bo_size(track->db_z_read_bo)) {
 719                 dev_warn(p->dev, "%s:%d depth read bo too small (layer size %d, "
 720                          "offset %ld, max layer %d, bo size %ld)\n",
 721                          __func__, __LINE__, surf.layer_size,
 722                         (unsigned long)track->db_z_read_offset << 8, mslice,
 723                         radeon_bo_size(track->db_z_read_bo));
 724                 return -EINVAL;
 725         }
 726
 727         offset = track->db_z_write_offset << 8;
 728         if (offset & (surf.base_align - 1)) {
 729                 dev_warn(p->dev, "%s:%d stencil write bo base %ld not aligned with %ld\n",
 730                          __func__, __LINE__, offset, surf.base_align);
 731                 return -EINVAL;
 732         }
 733         offset += surf.layer_size * mslice;
 734         if (offset > radeon_bo_size(track->db_z_write_bo)) {
 735                 dev_warn(p->dev, "%s:%d depth write bo too small (layer size %d, "
 736                          "offset %ld, max layer %d, bo size %ld)\n",
 737                          __func__, __LINE__, surf.layer_size,
 738                         (unsigned long)track->db_z_write_offset << 8, mslice,
 739                         radeon_bo_size(track->db_z_write_bo));
 740                 return -EINVAL;
 741         }
 742
 743         /* hyperz */
 744         if (G_028040_TILE_SURFACE_ENABLE(track->db_z_info)) {
 745                 r = evergreen_cs_track_validate_htile(p, surf.nbx, surf.nby);
 746                 if (r) {
 747                         return r;
 748                 }
 749         }
 750
 751         return 0;
 752 }
 753
 754 static int evergreen_cs_track_validate_texture(struct radeon_cs_parser *p,
 755                                                struct radeon_bo *texture,
 756                                                struct radeon_bo *mipmap,
 757                                                unsigned idx)
 758 {
 759         struct eg_surface surf;
 760         unsigned long toffset, moffset;
 761         unsigned dim, llevel, mslice, width, height, depth, i;
 762         u32 texdw[8];
 763         int r;
 764
 765         texdw[0] = radeon_get_ib_value(p, idx + 0);
 766         texdw[1] = radeon_get_ib_value(p, idx + 1);
 767         texdw[2] = radeon_get_ib_value(p, idx + 2);
 768         texdw[3] = radeon_get_ib_value(p, idx + 3);
 769         texdw[4] = radeon_get_ib_value(p, idx + 4);
 770         texdw[5] = radeon_get_ib_value(p, idx + 5);
 771         texdw[6] = radeon_get_ib_value(p, idx + 6);
 772         texdw[7] = radeon_get_ib_value(p, idx + 7);
 773         dim = G_030000_DIM(texdw[0]);
 774         llevel = G_030014_LAST_LEVEL(texdw[5]);
 775         mslice = G_030014_LAST_ARRAY(texdw[5]) + 1;
 776         width = G_030000_TEX_WIDTH(texdw[0]) + 1;
 777         height =  G_030004_TEX_HEIGHT(texdw[1]) + 1;
 778         depth = G_030004_TEX_DEPTH(texdw[1]) + 1;
 779         surf.format = G_03001C_DATA_FORMAT(texdw[7]);
 780         surf.nbx = (G_030000_PITCH(texdw[0]) + 1) * 8;
 781         surf.nbx = r600_fmt_get_nblocksx(surf.format, surf.nbx);
 782         surf.nby = r600_fmt_get_nblocksy(surf.format, height);
 783         surf.mode = G_030004_ARRAY_MODE(texdw[1]);
 784         surf.tsplit = G_030018_TILE_SPLIT(texdw[6]);
 785         surf.nbanks = G_03001C_NUM_BANKS(texdw[7]);
 786         surf.bankw = G_03001C_BANK_WIDTH(texdw[7]);
 787         surf.bankh = G_03001C_BANK_HEIGHT(texdw[7]);
 788         surf.mtilea = G_03001C_MACRO_TILE_ASPECT(texdw[7]);
 789         surf.nsamples = 1;
 790         toffset = texdw[2] << 8;
 791         moffset = texdw[3] << 8;
 792
 793         if (!r600_fmt_is_valid_texture(surf.format, p->family)) {
 794                 dev_warn(p->dev, "%s:%d texture invalid format %d\n",
 795                          __func__, __LINE__, surf.format);
 796                 return -EINVAL;
 797         }
 798         switch (dim) {
 799         case V_030000_SQ_TEX_DIM_1D:
 800         case V_030000_SQ_TEX_DIM_2D:
 801         case V_030000_SQ_TEX_DIM_CUBEMAP:
 802         case V_030000_SQ_TEX_DIM_1D_ARRAY:
 803         case V_030000_SQ_TEX_DIM_2D_ARRAY:
 804                 depth = 1;
 805                 break;
 806         case V_030000_SQ_TEX_DIM_2D_MSAA:
 807         case V_030000_SQ_TEX_DIM_2D_ARRAY_MSAA:
 808                 surf.nsamples = 1 << llevel;
 809                 llevel = 0;
 810                 depth = 1;
 811                 break;
 812         case V_030000_SQ_TEX_DIM_3D:
 813                 break;
 814         default:
 815                 dev_warn(p->dev, "%s:%d texture invalid dimension %d\n",
 816                          __func__, __LINE__, dim);
 817                 return -EINVAL;
 818         }
 819
 820         r = evergreen_surface_value_conv_check(p, &surf, "texture");
 821         if (r) {
 822                 return r;
 823         }
 824
 825         /* align height */
 826         evergreen_surface_check(p, &surf, NULL);
 827         surf.nby = roundup(surf.nby, surf.halign);
 828
 829         r = evergreen_surface_check(p, &surf, "texture");
 830         if (r) {
 831                 dev_warn(p->dev, "%s:%d texture invalid 0x%08x 0x%08x 0x%08x 0x%08x 0x%08x 0x%08x\n",
 832                          __func__, __LINE__, texdw[0], texdw[1], texdw[4],
 833                          texdw[5], texdw[6], texdw[7]);
 834                 return r;
 835         }
 836
 837         /* check texture size */
 838         if (toffset & (surf.base_align - 1)) {
 839                 dev_warn(p->dev, "%s:%d texture bo base %ld not aligned with %ld\n",
 840                          __func__, __LINE__, toffset, surf.base_align);
 841                 return -EINVAL;
 842         }
 843         if (moffset & (surf.base_align - 1)) {
 844                 dev_warn(p->dev, "%s:%d mipmap bo base %ld not aligned with %ld\n",
 845                          __func__, __LINE__, moffset, surf.base_align);
 846                 return -EINVAL;
 847         }
 848         if (dim == SQ_TEX_DIM_3D) {
 849                 toffset += surf.layer_size * depth;
 850         } else {
 851                 toffset += surf.layer_size * mslice;
 852         }
 853         if (toffset > radeon_bo_size(texture)) {
 854                 dev_warn(p->dev, "%s:%d texture bo too small (layer size %d, "
 855                          "offset %ld, max layer %d, depth %d, bo size %ld) (%d %d)\n",
 856                          __func__, __LINE__, surf.layer_size,
 857                         (unsigned long)texdw[2] << 8, mslice,
 858                         depth, radeon_bo_size(texture),
 859                         surf.nbx, surf.nby);
 860                 return -EINVAL;
 861         }
 862
 863         if (!mipmap) {
 864                 if (llevel) {
 865                         dev_warn(p->dev, "%s:%i got NULL MIP_ADDRESS relocation\n",
 866                                  __func__, __LINE__);
 867                         return -EINVAL;
 868                 } else {
 869                         return 0; /* everything's ok */
 870                 }
 871         }
 872
 873         /* check mipmap size */
 874         for (i = 1; i <= llevel; i++) {
 875                 unsigned w, h, d;
 876
 877                 w = r600_mip_minify(width, i);
 878                 h = r600_mip_minify(height, i);
 879                 d = r600_mip_minify(depth, i);
 880                 surf.nbx = r600_fmt_get_nblocksx(surf.format, w);
 881                 surf.nby = r600_fmt_get_nblocksy(surf.format, h);
 882
 883                 switch (surf.mode) {
 884                 case ARRAY_2D_TILED_THIN1:
 885                         if (surf.nbx < surf.palign || surf.nby < surf.halign) {
 886                                 surf.mode = ARRAY_1D_TILED_THIN1;
 887                         }
 888                         /* recompute alignment */
 889                         evergreen_surface_check(p, &surf, NULL);
 890                         break;
 891                 case ARRAY_LINEAR_GENERAL:
 892                 case ARRAY_LINEAR_ALIGNED:
 893                 case ARRAY_1D_TILED_THIN1:
 894                         break;
 895                 default:
 896                         dev_warn(p->dev, "%s:%d invalid array mode %d\n",
 897                                  __func__, __LINE__, surf.mode);
 898                         return -EINVAL;
 899                 }
 900                 surf.nbx = roundup(surf.nbx, surf.palign);
 901                 surf.nby = roundup(surf.nby, surf.halign);
 902
 903                 r = evergreen_surface_check(p, &surf, "mipmap");
 904                 if (r) {
 905                         return r;
 906                 }
 907
 908                 if (dim == SQ_TEX_DIM_3D) {
 909                         moffset += surf.layer_size * d;
 910                 } else {
 911                         moffset += surf.layer_size * mslice;
 912                 }
 913                 if (moffset > radeon_bo_size(mipmap)) {
 914                         dev_warn(p->dev, "%s:%d mipmap [%d] bo too small (layer size %d, "
 915                                         "offset %ld, coffset %ld, max layer %d, depth %d, "
 916                                         "bo size %ld) level0 (%d %d %d)\n",
 917                                         __func__, __LINE__, i, surf.layer_size,
 918                                         (unsigned long)texdw[3] << 8, moffset, mslice,
 919                                         d, radeon_bo_size(mipmap),
 920                                         width, height, depth);
 921                         dev_warn(p->dev, "%s:%d problematic surf: (%d %d) (%d %d %d %d %d %d %d)\n",
 922                                  __func__, __LINE__, surf.nbx, surf.nby,
 923                                 surf.mode, surf.bpe, surf.nsamples,
 924                                 surf.bankw, surf.bankh,
 925                                 surf.tsplit, surf.mtilea);
 926                         return -EINVAL;
 927                 }
 928         }
 929
 930         return 0;
 931 }
 932
 933 static int evergreen_cs_track_check(struct radeon_cs_parser *p)
 934 {
 935         struct evergreen_cs_track *track = p->track;
 936         unsigned tmp, i;
 937         int r;
 938         unsigned buffer_mask = 0;
 939
 940         /* check streamout */
 941         if (track->streamout_dirty && track->vgt_strmout_config) {
 942                 for (i = 0; i < 4; i++) {
 943                         if (track->vgt_strmout_config & (1 << i)) {
 944                                 buffer_mask |= (track->vgt_strmout_buffer_config >> (i * 4)) & 0xf;
 945                         }
 946                 }
 947
 948                 for (i = 0; i < 4; i++) {
 949                         if (buffer_mask & (1 << i)) {
 950                                 if (track->vgt_strmout_bo[i]) {
 951                                         u64 offset = (u64)track->vgt_strmout_bo_offset[i] +
 952                                                         (u64)track->vgt_strmout_size[i];
 953                                         if (offset > radeon_bo_size(track->vgt_strmout_bo[i])) {
 954                                                 DRM_ERROR("streamout %d bo too small: 0x%jx, 0x%lx\n",
 955                                                           i, (uintmax_t)offset,
 956                                                           radeon_bo_size(track->vgt_strmout_bo[i]));
 957                                                 return -EINVAL;
 958                                         }
 959                                 } else {
 960                                         dev_warn(p->dev, "No buffer for streamout %d\n", i);
 961                                         return -EINVAL;
 962                                 }
 963                         }
 964                 }
 965                 track->streamout_dirty = false;
 966         }
 967
 968         if (track->sx_misc_kill_all_prims)
 969                 return 0;
 970
 971         /* check that we have a cb for each enabled target
 972          */
 973         if (track->cb_dirty) {
 974                 tmp = track->cb_target_mask;
 975                 for (i = 0; i < 8; i++) {
 976                         if ((tmp >> (i * 4)) & 0xF) {
 977                                 /* at least one component is enabled */
 978                                 if (track->cb_color_bo[i] == NULL) {
 979                                         dev_warn(p->dev, "%s:%d mask 0x%08X | 0x%08X no cb for %d\n",
 980                                                 __func__, __LINE__, track->cb_target_mask, track->cb_shader_mask, i);
 981                                         return -EINVAL;
 982                                 }
 983                                 /* check cb */
 984                                 r = evergreen_cs_track_validate_cb(p, i);
 985                                 if (r) {
 986                                         return r;
 987                                 }
 988                         }
 989                 }
 990                 track->cb_dirty = false;
 991         }
 992
 993         if (track->db_dirty) {
 994                 /* Check stencil buffer */
 995                 if (G_028044_FORMAT(track->db_s_info) != V_028044_STENCIL_INVALID &&
 996                     G_028800_STENCIL_ENABLE(track->db_depth_control)) {
 997                         r = evergreen_cs_track_validate_stencil(p);
 998                         if (r)
 999                                 return r;
1000                 }
1001                 /* Check depth buffer */
1002                 if (G_028040_FORMAT(track->db_z_info) != V_028040_Z_INVALID &&
1003                     G_028800_Z_ENABLE(track->db_depth_control)) {
1004                         r = evergreen_cs_track_validate_depth(p);
1005                         if (r)
1006                                 return r;
1007                 }
1008                 track->db_dirty = false;
1009         }
1010
1011         return 0;
1012 }
1013
1014 /**
1015  * evergreen_cs_packet_parse() - parse cp packet and point ib index to next packet
1016  * @parser:     parser structure holding parsing context.
1017  * @pkt:        where to store packet informations
1018  *
1019  * Assume that chunk_ib_index is properly set. Will return -EINVAL
1020  * if packet is bigger than remaining ib size. or if packets is unknown.
1021  **/
1022 static int evergreen_cs_packet_parse(struct radeon_cs_parser *p,
1023                               struct radeon_cs_packet *pkt,
1024                               unsigned idx)
1025 {
1026         struct radeon_cs_chunk *ib_chunk = &p->chunks[p->chunk_ib_idx];
1027         uint32_t header;
1028
1029         if (idx >= ib_chunk->length_dw) {
1030                 DRM_ERROR("Can not parse packet at %d after CS end %d !\n",
1031                           idx, ib_chunk->length_dw);
1032                 return -EINVAL;
1033         }
1034         header = radeon_get_ib_value(p, idx);
1035         pkt->idx = idx;
1036         pkt->type = CP_PACKET_GET_TYPE(header);
1037         pkt->count = CP_PACKET_GET_COUNT(header);
1038         pkt->one_reg_wr = 0;
1039         switch (pkt->type) {
1040         case PACKET_TYPE0:
1041                 pkt->reg = CP_PACKET0_GET_REG(header);
1042                 break;
1043         case PACKET_TYPE3:
1044                 pkt->opcode = CP_PACKET3_GET_OPCODE(header);
1045                 break;
1046         case PACKET_TYPE2:
1047                 pkt->count = -1;
1048                 break;
1049         default:
1050                 DRM_ERROR("Unknown packet type %d at %d !\n", pkt->type, idx);
1051                 return -EINVAL;
1052         }
1053         if ((pkt->count + 1 + pkt->idx) >= ib_chunk->length_dw) {
1054                 DRM_ERROR("Packet (%d:%d:%d) end after CS buffer (%d) !\n",
1055                           pkt->idx, pkt->type, pkt->count, ib_chunk->length_dw);
1056                 return -EINVAL;
1057         }
1058         return 0;
1059 }
1060
1061 /**
1062  * evergreen_cs_packet_next_reloc() - parse next packet which should be reloc packet3
1063  * @parser:             parser structure holding parsing context.
1064  * @data:               pointer to relocation data
1065  * @offset_start:       starting offset
1066  * @offset_mask:        offset mask (to align start offset on)
1067  * @reloc:              reloc informations
1068  *
1069  * Check next packet is relocation packet3, do bo validation and compute
1070  * GPU offset using the provided start.
1071  **/
1072 static int evergreen_cs_packet_next_reloc(struct radeon_cs_parser *p,
1073                                           struct radeon_cs_reloc **cs_reloc)
1074 {
1075         struct radeon_cs_chunk *relocs_chunk;
1076         struct radeon_cs_packet p3reloc;
1077         unsigned idx;
1078         int r;
1079
1080         if (p->chunk_relocs_idx == -1) {
1081                 DRM_ERROR("No relocation chunk !\n");
1082                 return -EINVAL;
1083         }
1084         *cs_reloc = NULL;
1085         relocs_chunk = &p->chunks[p->chunk_relocs_idx];
1086         r = evergreen_cs_packet_parse(p, &p3reloc, p->idx);
1087         if (r) {
1088                 return r;
1089         }
1090         p->idx += p3reloc.count + 2;
1091         if (p3reloc.type != PACKET_TYPE3 || p3reloc.opcode != PACKET3_NOP) {
1092                 DRM_ERROR("No packet3 for relocation for packet at %d.\n",
1093                           p3reloc.idx);
1094                 return -EINVAL;
1095         }
1096         idx = radeon_get_ib_value(p, p3reloc.idx + 1);
1097         if (idx >= relocs_chunk->length_dw) {
1098                 DRM_ERROR("Relocs at %d after relocations chunk end %d !\n",
1099                           idx, relocs_chunk->length_dw);
1100                 return -EINVAL;
1101         }
1102         /* FIXME: we assume reloc size is 4 dwords */
1103         *cs_reloc = p->relocs_ptr[(idx / 4)];
1104         return 0;
1105 }
1106
1107 /**
1108  * evergreen_cs_packet_next_is_pkt3_nop() - test if the next packet is NOP
1109  * @p:          structure holding the parser context.
1110  *
1111  * Check if the next packet is a relocation packet3.
1112  **/
1113 static bool evergreen_cs_packet_next_is_pkt3_nop(struct radeon_cs_parser *p)
1114 {
1115         struct radeon_cs_packet p3reloc;
1116         int r;
1117
1118         r = evergreen_cs_packet_parse(p, &p3reloc, p->idx);
1119         if (r) {
1120                 return false;
1121         }
1122         if (p3reloc.type != PACKET_TYPE3 || p3reloc.opcode != PACKET3_NOP) {
1123                 return false;
1124         }
1125         return true;
1126 }
1127
1128 /**
1129  * evergreen_cs_packet_next_vline() - parse userspace VLINE packet
1130  * @parser:             parser structure holding parsing context.
1131  *
1132  * Userspace sends a special sequence for VLINE waits.
1133  * PACKET0 - VLINE_START_END + value
1134  * PACKET3 - WAIT_REG_MEM poll vline status reg
1135  * RELOC (P3) - crtc_id in reloc.
1136  *
1137  * This function parses this and relocates the VLINE START END
1138  * and WAIT_REG_MEM packets to the correct crtc.
1139  * It also detects a switched off crtc and nulls out the
1140  * wait in that case.
1141  */
1142 static int evergreen_cs_packet_parse_vline(struct radeon_cs_parser *p)
1143 {
1144         struct drm_mode_object *obj;
1145         struct drm_crtc *crtc;
1146         struct radeon_crtc *radeon_crtc;
1147         struct radeon_cs_packet p3reloc, wait_reg_mem;
1148         int crtc_id;
1149         int r;
1150         uint32_t header, h_idx, reg, wait_reg_mem_info;
1151         volatile uint32_t *ib;
1152
1153         ib = p->ib.ptr;
1154
1155         /* parse the WAIT_REG_MEM */
1156         r = evergreen_cs_packet_parse(p, &wait_reg_mem, p->idx);
1157         if (r)
1158                 return r;
1159
1160         /* check its a WAIT_REG_MEM */
1161         if (wait_reg_mem.type != PACKET_TYPE3 ||
1162             wait_reg_mem.opcode != PACKET3_WAIT_REG_MEM) {
1163                 DRM_ERROR("vline wait missing WAIT_REG_MEM segment\n");
1164                 return -EINVAL;
1165         }
1166
1167         wait_reg_mem_info = radeon_get_ib_value(p, wait_reg_mem.idx + 1);
1168         /* bit 4 is reg (0) or mem (1) */
1169         if (wait_reg_mem_info & 0x10) {
1170                 DRM_ERROR("vline WAIT_REG_MEM waiting on MEM rather than REG\n");
1171                 return -EINVAL;
1172         }
1173         /* waiting for value to be equal */
1174         if ((wait_reg_mem_info & 0x7) != 0x3) {
1175                 DRM_ERROR("vline WAIT_REG_MEM function not equal\n");
1176                 return -EINVAL;
1177         }
1178         if ((radeon_get_ib_value(p, wait_reg_mem.idx + 2) << 2) != EVERGREEN_VLINE_STATUS) {
1179                 DRM_ERROR("vline WAIT_REG_MEM bad reg\n");
1180                 return -EINVAL;
1181         }
1182
1183         if (radeon_get_ib_value(p, wait_reg_mem.idx + 5) != EVERGREEN_VLINE_STAT) {
1184                 DRM_ERROR("vline WAIT_REG_MEM bad bit mask\n");
1185                 return -EINVAL;
1186         }
1187
1188         /* jump over the NOP */
1189         r = evergreen_cs_packet_parse(p, &p3reloc, p->idx + wait_reg_mem.count + 2);
1190         if (r)
1191                 return r;
1192
1193         h_idx = p->idx - 2;
1194         p->idx += wait_reg_mem.count + 2;
1195         p->idx += p3reloc.count + 2;
1196
1197         header = radeon_get_ib_value(p, h_idx);
1198         crtc_id = radeon_get_ib_value(p, h_idx + 2 + 7 + 1);
1199         reg = CP_PACKET0_GET_REG(header);
1200         obj = drm_mode_object_find(p->rdev->ddev, crtc_id, DRM_MODE_OBJECT_CRTC);
1201         if (!obj) {
1202                 DRM_ERROR("cannot find crtc %d\n", crtc_id);
1203                 return -EINVAL;
1204         }
1205         crtc = obj_to_crtc(obj);
1206         radeon_crtc = to_radeon_crtc(crtc);
1207         crtc_id = radeon_crtc->crtc_id;
1208
1209         if (!crtc->enabled) {
1210                 /* if the CRTC isn't enabled - we need to nop out the WAIT_REG_MEM */
1211                 ib[h_idx + 2] = PACKET2(0);
1212                 ib[h_idx + 3] = PACKET2(0);
1213                 ib[h_idx + 4] = PACKET2(0);
1214                 ib[h_idx + 5] = PACKET2(0);
1215                 ib[h_idx + 6] = PACKET2(0);
1216                 ib[h_idx + 7] = PACKET2(0);
1217                 ib[h_idx + 8] = PACKET2(0);
1218         } else {
1219                 switch (reg) {
1220                 case EVERGREEN_VLINE_START_END:
1221                         header &= ~R600_CP_PACKET0_REG_MASK;
1222                         header |= (EVERGREEN_VLINE_START_END + radeon_crtc->crtc_offset) >> 2;
1223                         ib[h_idx] = header;
1224                         ib[h_idx + 4] = (EVERGREEN_VLINE_STATUS + radeon_crtc->crtc_offset) >> 2;
1225                         break;
1226                 default:
1227                         DRM_ERROR("unknown crtc reloc\n");
1228                         return -EINVAL;
1229                 }
1230         }
1231         return 0;
1232 }
1233
1234 static int evergreen_packet0_check(struct radeon_cs_parser *p,
1235                                    struct radeon_cs_packet *pkt,
1236                                    unsigned idx, unsigned reg)
1237 {
1238         int r;
1239
1240         switch (reg) {
1241         case EVERGREEN_VLINE_START_END:
1242                 r = evergreen_cs_packet_parse_vline(p);
1243                 if (r) {
1244                         DRM_ERROR("No reloc for ib[%d]=0x%04X\n",
1245                                         idx, reg);
1246                         return r;
1247                 }
1248                 break;
1249         default:
1250                 DRM_ERROR("Forbidden register 0x%04X in cs at %d\n",
1251                        reg, idx);
1252                 return -EINVAL;
1253         }
1254         return 0;
1255 }
1256
1257 static int evergreen_cs_parse_packet0(struct radeon_cs_parser *p,
1258                                       struct radeon_cs_packet *pkt)
1259 {
1260         unsigned reg, i;
1261         unsigned idx;
1262         int r;
1263
1264         idx = pkt->idx + 1;
1265         reg = pkt->reg;
1266         for (i = 0; i <= pkt->count; i++, idx++, reg += 4) {
1267                 r = evergreen_packet0_check(p, pkt, idx, reg);
1268                 if (r) {
1269                         return r;
1270                 }
1271         }
1272         return 0;
1273 }
1274
1275 /**
1276  * evergreen_cs_check_reg() - check if register is authorized or not
1277  * @parser: parser structure holding parsing context
1278  * @reg: register we are testing
1279  * @idx: index into the cs buffer
1280  *
1281  * This function will test against evergreen_reg_safe_bm and return 0
1282  * if register is safe. If register is not flag as safe this function
1283  * will test it against a list of register needind special handling.
1284  */
1285 static int evergreen_cs_check_reg(struct radeon_cs_parser *p, u32 reg, u32 idx)
1286 {
1287         struct evergreen_cs_track *track = (struct evergreen_cs_track *)p->track;
1288         struct radeon_cs_reloc *reloc;
1289         u32 last_reg;
1290         u32 m, i, tmp, *ib;
1291         int r;
1292
1293         if (p->rdev->family >= CHIP_CAYMAN)
1294                 last_reg = DRM_ARRAY_SIZE(cayman_reg_safe_bm);
1295         else
1296                 last_reg = DRM_ARRAY_SIZE(evergreen_reg_safe_bm);
1297
1298         i = (reg >> 7);
1299         if (i >= last_reg) {
1300                 dev_warn(p->dev, "forbidden register 0x%08x at %d\n", reg, idx);
1301                 return -EINVAL;
1302         }
1303         m = 1 << ((reg >> 2) & 31);
1304         if (p->rdev->family >= CHIP_CAYMAN) {
1305                 if (!(cayman_reg_safe_bm[i] & m))
1306                         return 0;
1307         } else {
1308                 if (!(evergreen_reg_safe_bm[i] & m))
1309                         return 0;
1310         }
1311         ib = p->ib.ptr;
1312         switch (reg) {
1313         /* force following reg to 0 in an attempt to disable out buffer
1314          * which will need us to better understand how it works to perform
1315          * security check on it (Jerome)
1316          */
1317         case SQ_ESGS_RING_SIZE:
1318         case SQ_GSVS_RING_SIZE:
1319         case SQ_ESTMP_RING_SIZE:
1320         case SQ_GSTMP_RING_SIZE:
1321         case SQ_HSTMP_RING_SIZE:
1322         case SQ_LSTMP_RING_SIZE:
1323         case SQ_PSTMP_RING_SIZE:
1324         case SQ_VSTMP_RING_SIZE:
1325         case SQ_ESGS_RING_ITEMSIZE:
1326         case SQ_ESTMP_RING_ITEMSIZE:
1327         case SQ_GSTMP_RING_ITEMSIZE:
1328         case SQ_GSVS_RING_ITEMSIZE:
1329         case SQ_GS_VERT_ITEMSIZE:
1330         case SQ_GS_VERT_ITEMSIZE_1:
1331         case SQ_GS_VERT_ITEMSIZE_2:
1332         case SQ_GS_VERT_ITEMSIZE_3:
1333         case SQ_GSVS_RING_OFFSET_1:
1334         case SQ_GSVS_RING_OFFSET_2:
1335         case SQ_GSVS_RING_OFFSET_3:
1336         case SQ_HSTMP_RING_ITEMSIZE:
1337         case SQ_LSTMP_RING_ITEMSIZE:
1338         case SQ_PSTMP_RING_ITEMSIZE:
1339         case SQ_VSTMP_RING_ITEMSIZE:
1340         case VGT_TF_RING_SIZE:
1341                 /* get value to populate the IB don't remove */
1342                 /*tmp =radeon_get_ib_value(p, idx);
1343                   ib[idx] = 0;*/
1344                 break;
1345         case SQ_ESGS_RING_BASE:
1346         case SQ_GSVS_RING_BASE:
1347         case SQ_ESTMP_RING_BASE:
1348         case SQ_GSTMP_RING_BASE:
1349         case SQ_HSTMP_RING_BASE:
1350         case SQ_LSTMP_RING_BASE:
1351         case SQ_PSTMP_RING_BASE:
1352         case SQ_VSTMP_RING_BASE:
1353                 r = evergreen_cs_packet_next_reloc(p, &reloc);
1354                 if (r) {
1355                         dev_warn(p->dev, "bad SET_CONTEXT_REG "
1356                                         "0x%04X\n", reg);
1357                         return -EINVAL;
1358                 }
1359                 ib[idx] += (u32)((reloc->lobj.gpu_offset >> 8) & 0xffffffff);
1360                 break;
1361         case DB_DEPTH_CONTROL:
1362                 track->db_depth_control = radeon_get_ib_value(p, idx);
1363                 track->db_dirty = true;
1364                 break;
1365         case CAYMAN_DB_EQAA:
1366                 if (p->rdev->family < CHIP_CAYMAN) {
1367                         dev_warn(p->dev, "bad SET_CONTEXT_REG "
1368                                  "0x%04X\n", reg);
1369                         return -EINVAL;
1370                 }
1371                 break;
1372         case CAYMAN_DB_DEPTH_INFO:
1373                 if (p->rdev->family < CHIP_CAYMAN) {
1374                         dev_warn(p->dev, "bad SET_CONTEXT_REG "
1375                                  "0x%04X\n", reg);
1376                         return -EINVAL;
1377                 }
1378                 break;
1379         case DB_Z_INFO:
1380                 track->db_z_info = radeon_get_ib_value(p, idx);
1381                 if (!(p->cs_flags & RADEON_CS_KEEP_TILING_FLAGS)) {
1382                         r = evergreen_cs_packet_next_reloc(p, &reloc);
1383                         if (r) {
1384                                 dev_warn(p->dev, "bad SET_CONTEXT_REG "
1385                                                 "0x%04X\n", reg);
1386                                 return -EINVAL;
1387                         }
1388                         ib[idx] &= ~Z_ARRAY_MODE(0xf);
1389                         track->db_z_info &= ~Z_ARRAY_MODE(0xf);
1390                         ib[idx] |= Z_ARRAY_MODE(evergreen_cs_get_aray_mode(reloc->lobj.tiling_flags));
1391                         track->db_z_info |= Z_ARRAY_MODE(evergreen_cs_get_aray_mode(reloc->lobj.tiling_flags));
1392                         if (reloc->lobj.tiling_flags & RADEON_TILING_MACRO) {
1393                                 unsigned bankw, bankh, mtaspect, tile_split;
1394
1395                                 evergreen_tiling_fields(reloc->lobj.tiling_flags,
1396                                                         &bankw, &bankh, &mtaspect,
1397                                                         &tile_split);
1398                                 ib[idx] |= DB_NUM_BANKS(evergreen_cs_get_num_banks(track->nbanks));
1399                                 ib[idx] |= DB_TILE_SPLIT(tile_split) |
1400                                                 DB_BANK_WIDTH(bankw) |
1401                                                 DB_BANK_HEIGHT(bankh) |
1402                                                 DB_MACRO_TILE_ASPECT(mtaspect);
1403                         }
1404                 }
1405                 track->db_dirty = true;
1406                 break;
1407         case DB_STENCIL_INFO:
1408                 track->db_s_info = radeon_get_ib_value(p, idx);
1409                 track->db_dirty = true;
1410                 break;
1411         case DB_DEPTH_VIEW:
1412                 track->db_depth_view = radeon_get_ib_value(p, idx);
1413                 track->db_dirty = true;
1414                 break;
1415         case DB_DEPTH_SIZE:
1416                 track->db_depth_size = radeon_get_ib_value(p, idx);
1417                 track->db_dirty = true;
1418                 break;
1419         case R_02805C_DB_DEPTH_SLICE:
1420                 track->db_depth_slice = radeon_get_ib_value(p, idx);
1421                 track->db_dirty = true;
1422                 break;
1423         case DB_Z_READ_BASE:
1424                 r = evergreen_cs_packet_next_reloc(p, &reloc);
1425                 if (r) {
1426                         dev_warn(p->dev, "bad SET_CONTEXT_REG "
1427                                         "0x%04X\n", reg);
1428                         return -EINVAL;
1429                 }
1430                 track->db_z_read_offset = radeon_get_ib_value(p, idx);
1431                 ib[idx] += (u32)((reloc->lobj.gpu_offset >> 8) & 0xffffffff);
1432                 track->db_z_read_bo = reloc->robj;
1433                 track->db_dirty = true;
1434                 break;
1435         case DB_Z_WRITE_BASE:
1436                 r = evergreen_cs_packet_next_reloc(p, &reloc);
1437                 if (r) {
1438                         dev_warn(p->dev, "bad SET_CONTEXT_REG "
1439                                         "0x%04X\n", reg);
1440                         return -EINVAL;
1441                 }
1442                 track->db_z_write_offset = radeon_get_ib_value(p, idx);
1443                 ib[idx] += (u32)((reloc->lobj.gpu_offset >> 8) & 0xffffffff);
1444                 track->db_z_write_bo = reloc->robj;
1445                 track->db_dirty = true;
1446                 break;
1447         case DB_STENCIL_READ_BASE:
1448                 r = evergreen_cs_packet_next_reloc(p, &reloc);
1449                 if (r) {
1450                         dev_warn(p->dev, "bad SET_CONTEXT_REG "
1451                                         "0x%04X\n", reg);
1452                         return -EINVAL;
1453                 }
1454                 track->db_s_read_offset = radeon_get_ib_value(p, idx);
1455                 ib[idx] += (u32)((reloc->lobj.gpu_offset >> 8) & 0xffffffff);
1456                 track->db_s_read_bo = reloc->robj;
1457                 track->db_dirty = true;
1458                 break;
1459         case DB_STENCIL_WRITE_BASE:
1460                 r = evergreen_cs_packet_next_reloc(p, &reloc);
1461                 if (r) {
1462                         dev_warn(p->dev, "bad SET_CONTEXT_REG "
1463                                         "0x%04X\n", reg);
1464                         return -EINVAL;
1465                 }
1466                 track->db_s_write_offset = radeon_get_ib_value(p, idx);
1467                 ib[idx] += (u32)((reloc->lobj.gpu_offset >> 8) & 0xffffffff);
1468                 track->db_s_write_bo = reloc->robj;
1469                 track->db_dirty = true;
1470                 break;
1471         case VGT_STRMOUT_CONFIG:
1472                 track->vgt_strmout_config = radeon_get_ib_value(p, idx);
1473                 track->streamout_dirty = true;
1474                 break;
1475         case VGT_STRMOUT_BUFFER_CONFIG:
1476                 track->vgt_strmout_buffer_config = radeon_get_ib_value(p, idx);
1477                 track->streamout_dirty = true;
1478                 break;
1479         case VGT_STRMOUT_BUFFER_BASE_0:
1480         case VGT_STRMOUT_BUFFER_BASE_1:
1481         case VGT_STRMOUT_BUFFER_BASE_2:
1482         case VGT_STRMOUT_BUFFER_BASE_3:
1483                 r = evergreen_cs_packet_next_reloc(p, &reloc);
1484                 if (r) {
1485                         dev_warn(p->dev, "bad SET_CONTEXT_REG "
1486                                         "0x%04X\n", reg);
1487                         return -EINVAL;
1488                 }
1489                 tmp = (reg - VGT_STRMOUT_BUFFER_BASE_0) / 16;
1490                 track->vgt_strmout_bo_offset[tmp] = radeon_get_ib_value(p, idx) << 8;
1491                 ib[idx] += (u32)((reloc->lobj.gpu_offset >> 8) & 0xffffffff);
1492                 track->vgt_strmout_bo[tmp] = reloc->robj;
1493                 track->streamout_dirty = true;
1494                 break;
1495         case VGT_STRMOUT_BUFFER_SIZE_0:
1496         case VGT_STRMOUT_BUFFER_SIZE_1:
1497         case VGT_STRMOUT_BUFFER_SIZE_2:
1498         case VGT_STRMOUT_BUFFER_SIZE_3:
1499                 tmp = (reg - VGT_STRMOUT_BUFFER_SIZE_0) / 16;
1500                 /* size in register is DWs, convert to bytes */
1501                 track->vgt_strmout_size[tmp] = radeon_get_ib_value(p, idx) * 4;
1502                 track->streamout_dirty = true;
1503                 break;
1504         case CP_COHER_BASE:
1505                 r = evergreen_cs_packet_next_reloc(p, &reloc);
1506                 if (r) {
1507                         dev_warn(p->dev, "missing reloc for CP_COHER_BASE "
1508                                         "0x%04X\n", reg);
1509                         return -EINVAL;
1510                 }
1511                 ib[idx] += (u32)((reloc->lobj.gpu_offset >> 8) & 0xffffffff);
1512         case CB_TARGET_MASK:
1513                 track->cb_target_mask = radeon_get_ib_value(p, idx);
1514                 track->cb_dirty = true;
1515                 break;
1516         case CB_SHADER_MASK:
1517                 track->cb_shader_mask = radeon_get_ib_value(p, idx);
1518                 track->cb_dirty = true;
1519                 break;
1520         case PA_SC_AA_CONFIG:
1521                 if (p->rdev->family >= CHIP_CAYMAN) {
1522                         dev_warn(p->dev, "bad SET_CONTEXT_REG "
1523                                  "0x%04X\n", reg);
1524                         return -EINVAL;
1525                 }
1526                 tmp = radeon_get_ib_value(p, idx) & MSAA_NUM_SAMPLES_MASK;
1527                 track->nsamples = 1 << tmp;
1528                 break;
1529         case CAYMAN_PA_SC_AA_CONFIG:
1530                 if (p->rdev->family < CHIP_CAYMAN) {
1531                         dev_warn(p->dev, "bad SET_CONTEXT_REG "
1532                                  "0x%04X\n", reg);
1533                         return -EINVAL;
1534                 }
1535                 tmp = radeon_get_ib_value(p, idx) & CAYMAN_MSAA_NUM_SAMPLES_MASK;
1536                 track->nsamples = 1 << tmp;
1537                 break;
1538         case CB_COLOR0_VIEW:
1539         case CB_COLOR1_VIEW:
1540         case CB_COLOR2_VIEW:
1541         case CB_COLOR3_VIEW:
1542         case CB_COLOR4_VIEW:
1543         case CB_COLOR5_VIEW:
1544         case CB_COLOR6_VIEW:
1545         case CB_COLOR7_VIEW:
1546                 tmp = (reg - CB_COLOR0_VIEW) / 0x3c;
1547                 track->cb_color_view[tmp] = radeon_get_ib_value(p, idx);
1548                 track->cb_dirty = true;
1549                 break;
1550         case CB_COLOR8_VIEW:
1551         case CB_COLOR9_VIEW:
1552         case CB_COLOR10_VIEW:
1553         case CB_COLOR11_VIEW:
1554                 tmp = ((reg - CB_COLOR8_VIEW) / 0x1c) + 8;
1555                 track->cb_color_view[tmp] = radeon_get_ib_value(p, idx);
1556                 track->cb_dirty = true;
1557                 break;
1558         case CB_COLOR0_INFO:
1559         case CB_COLOR1_INFO:
1560         case CB_COLOR2_INFO:
1561         case CB_COLOR3_INFO:
1562         case CB_COLOR4_INFO:
1563         case CB_COLOR5_INFO:
1564         case CB_COLOR6_INFO:
1565         case CB_COLOR7_INFO:
1566                 tmp = (reg - CB_COLOR0_INFO) / 0x3c;
1567                 track->cb_color_info[tmp] = radeon_get_ib_value(p, idx);
1568                 if (!(p->cs_flags & RADEON_CS_KEEP_TILING_FLAGS)) {
1569                         r = evergreen_cs_packet_next_reloc(p, &reloc);
1570                         if (r) {
1571                                 dev_warn(p->dev, "bad SET_CONTEXT_REG "
1572                                                 "0x%04X\n", reg);
1573                                 return -EINVAL;
1574                         }
1575                         ib[idx] |= CB_ARRAY_MODE(evergreen_cs_get_aray_mode(reloc->lobj.tiling_flags));
1576                         track->cb_color_info[tmp] |= CB_ARRAY_MODE(evergreen_cs_get_aray_mode(reloc->lobj.tiling_flags));
1577                 }
1578                 track->cb_dirty = true;
1579                 break;
1580         case CB_COLOR8_INFO:
1581         case CB_COLOR9_INFO:
1582         case CB_COLOR10_INFO:
1583         case CB_COLOR11_INFO:
1584                 tmp = ((reg - CB_COLOR8_INFO) / 0x1c) + 8;
1585                 track->cb_color_info[tmp] = radeon_get_ib_value(p, idx);
1586                 if (!(p->cs_flags & RADEON_CS_KEEP_TILING_FLAGS)) {
1587                         r = evergreen_cs_packet_next_reloc(p, &reloc);
1588                         if (r) {
1589                                 dev_warn(p->dev, "bad SET_CONTEXT_REG "
1590                                                 "0x%04X\n", reg);
1591                                 return -EINVAL;
1592                         }
1593                         ib[idx] |= CB_ARRAY_MODE(evergreen_cs_get_aray_mode(reloc->lobj.tiling_flags));
1594                         track->cb_color_info[tmp] |= CB_ARRAY_MODE(evergreen_cs_get_aray_mode(reloc->lobj.tiling_flags));
1595                 }
1596                 track->cb_dirty = true;
1597                 break;
1598         case CB_COLOR0_PITCH:
1599         case CB_COLOR1_PITCH:
1600         case CB_COLOR2_PITCH:
1601         case CB_COLOR3_PITCH:
1602         case CB_COLOR4_PITCH:
1603         case CB_COLOR5_PITCH:
1604         case CB_COLOR6_PITCH:
1605         case CB_COLOR7_PITCH:
1606                 tmp = (reg - CB_COLOR0_PITCH) / 0x3c;
1607                 track->cb_color_pitch[tmp] = radeon_get_ib_value(p, idx);
1608                 track->cb_dirty = true;
1609                 break;
1610         case CB_COLOR8_PITCH:
1611         case CB_COLOR9_PITCH:
1612         case CB_COLOR10_PITCH:
1613         case CB_COLOR11_PITCH:
1614                 tmp = ((reg - CB_COLOR8_PITCH) / 0x1c) + 8;
1615                 track->cb_color_pitch[tmp] = radeon_get_ib_value(p, idx);
1616                 track->cb_dirty = true;
1617                 break;
1618         case CB_COLOR0_SLICE:
1619         case CB_COLOR1_SLICE:
1620         case CB_COLOR2_SLICE:
1621         case CB_COLOR3_SLICE:
1622         case CB_COLOR4_SLICE:
1623         case CB_COLOR5_SLICE:
1624         case CB_COLOR6_SLICE:
1625         case CB_COLOR7_SLICE:
1626                 tmp = (reg - CB_COLOR0_SLICE) / 0x3c;
1627                 track->cb_color_slice[tmp] = radeon_get_ib_value(p, idx);
1628                 track->cb_color_slice_idx[tmp] = idx;
1629                 track->cb_dirty = true;
1630                 break;
1631         case CB_COLOR8_SLICE:
1632         case CB_COLOR9_SLICE:
1633         case CB_COLOR10_SLICE:
1634         case CB_COLOR11_SLICE:
1635                 tmp = ((reg - CB_COLOR8_SLICE) / 0x1c) + 8;
1636                 track->cb_color_slice[tmp] = radeon_get_ib_value(p, idx);
1637                 track->cb_color_slice_idx[tmp] = idx;
1638                 track->cb_dirty = true;
1639                 break;
1640         case CB_COLOR0_ATTRIB:
1641         case CB_COLOR1_ATTRIB:
1642         case CB_COLOR2_ATTRIB:
1643         case CB_COLOR3_ATTRIB:
1644         case CB_COLOR4_ATTRIB:
1645         case CB_COLOR5_ATTRIB:
1646         case CB_COLOR6_ATTRIB:
1647         case CB_COLOR7_ATTRIB:
1648                 r = evergreen_cs_packet_next_reloc(p, &reloc);
1649                 if (r) {
1650                         dev_warn(p->dev, "bad SET_CONTEXT_REG "
1651                                         "0x%04X\n", reg);
1652                         return -EINVAL;
1653                 }
1654                 if (!(p->cs_flags & RADEON_CS_KEEP_TILING_FLAGS)) {
1655                         if (reloc->lobj.tiling_flags & RADEON_TILING_MACRO) {
1656                                 unsigned bankw, bankh, mtaspect, tile_split;
1657
1658                                 evergreen_tiling_fields(reloc->lobj.tiling_flags,
1659                                                         &bankw, &bankh, &mtaspect,
1660                                                         &tile_split);
1661                                 ib[idx] |= CB_NUM_BANKS(evergreen_cs_get_num_banks(track->nbanks));
1662                                 ib[idx] |= CB_TILE_SPLIT(tile_split) |
1663                                            CB_BANK_WIDTH(bankw) |
1664                                            CB_BANK_HEIGHT(bankh) |
1665                                            CB_MACRO_TILE_ASPECT(mtaspect);
1666                         }
1667                 }
1668                 tmp = ((reg - CB_COLOR0_ATTRIB) / 0x3c);
1669                 track->cb_color_attrib[tmp] = ib[idx];
1670                 track->cb_dirty = true;
1671                 break;
1672         case CB_COLOR8_ATTRIB:
1673         case CB_COLOR9_ATTRIB:
1674         case CB_COLOR10_ATTRIB:
1675         case CB_COLOR11_ATTRIB:
1676                 r = evergreen_cs_packet_next_reloc(p, &reloc);
1677                 if (r) {
1678                         dev_warn(p->dev, "bad SET_CONTEXT_REG "
1679                                         "0x%04X\n", reg);
1680                         return -EINVAL;
1681                 }
1682                 if (!(p->cs_flags & RADEON_CS_KEEP_TILING_FLAGS)) {
1683                         if (reloc->lobj.tiling_flags & RADEON_TILING_MACRO) {
1684                                 unsigned bankw, bankh, mtaspect, tile_split;
1685
1686                                 evergreen_tiling_fields(reloc->lobj.tiling_flags,
1687                                                         &bankw, &bankh, &mtaspect,
1688                                                         &tile_split);
1689                                 ib[idx] |= CB_NUM_BANKS(evergreen_cs_get_num_banks(track->nbanks));
1690                                 ib[idx] |= CB_TILE_SPLIT(tile_split) |
1691                                            CB_BANK_WIDTH(bankw) |
1692                                            CB_BANK_HEIGHT(bankh) |
1693                                            CB_MACRO_TILE_ASPECT(mtaspect);
1694                         }
1695                 }
1696                 tmp = ((reg - CB_COLOR8_ATTRIB) / 0x1c) + 8;
1697                 track->cb_color_attrib[tmp] = ib[idx];
1698                 track->cb_dirty = true;
1699                 break;
1700         case CB_COLOR0_FMASK:
1701         case CB_COLOR1_FMASK:
1702         case CB_COLOR2_FMASK:
1703         case CB_COLOR3_FMASK:
1704         case CB_COLOR4_FMASK:
1705         case CB_COLOR5_FMASK:
1706         case CB_COLOR6_FMASK:
1707         case CB_COLOR7_FMASK:
1708                 tmp = (reg - CB_COLOR0_FMASK) / 0x3c;
1709                 r = evergreen_cs_packet_next_reloc(p, &reloc);
1710                 if (r) {
1711                         dev_err(p->dev, "bad SET_CONTEXT_REG 0x%04X\n", reg);
1712                         return -EINVAL;
1713                 }
1714                 ib[idx] += (u32)((reloc->lobj.gpu_offset >> 8) & 0xffffffff);
1715                 track->cb_color_fmask_bo[tmp] = reloc->robj;
1716                 break;
1717         case CB_COLOR0_CMASK:
1718         case CB_COLOR1_CMASK:
1719         case CB_COLOR2_CMASK:
1720         case CB_COLOR3_CMASK:
1721         case CB_COLOR4_CMASK:
1722         case CB_COLOR5_CMASK:
1723         case CB_COLOR6_CMASK:
1724         case CB_COLOR7_CMASK:
1725                 tmp = (reg - CB_COLOR0_CMASK) / 0x3c;
1726                 r = evergreen_cs_packet_next_reloc(p, &reloc);
1727                 if (r) {
1728                         dev_err(p->dev, "bad SET_CONTEXT_REG 0x%04X\n", reg);
1729                         return -EINVAL;
1730                 }
1731                 ib[idx] += (u32)((reloc->lobj.gpu_offset >> 8) & 0xffffffff);
1732                 track->cb_color_cmask_bo[tmp] = reloc->robj;
1733                 break;
1734         case CB_COLOR0_FMASK_SLICE:
1735         case CB_COLOR1_FMASK_SLICE:
1736         case CB_COLOR2_FMASK_SLICE:
1737         case CB_COLOR3_FMASK_SLICE:
1738         case CB_COLOR4_FMASK_SLICE:
1739         case CB_COLOR5_FMASK_SLICE:
1740         case CB_COLOR6_FMASK_SLICE:
1741         case CB_COLOR7_FMASK_SLICE:
1742                 tmp = (reg - CB_COLOR0_FMASK_SLICE) / 0x3c;
1743                 track->cb_color_fmask_slice[tmp] = radeon_get_ib_value(p, idx);
1744                 break;
1745         case CB_COLOR0_CMASK_SLICE:
1746         case CB_COLOR1_CMASK_SLICE:
1747         case CB_COLOR2_CMASK_SLICE:
1748         case CB_COLOR3_CMASK_SLICE:
1749         case CB_COLOR4_CMASK_SLICE:
1750         case CB_COLOR5_CMASK_SLICE:
1751         case CB_COLOR6_CMASK_SLICE:
1752         case CB_COLOR7_CMASK_SLICE:
1753                 tmp = (reg - CB_COLOR0_CMASK_SLICE) / 0x3c;
1754                 track->cb_color_cmask_slice[tmp] = radeon_get_ib_value(p, idx);
1755                 break;
1756         case CB_COLOR0_BASE:
1757         case CB_COLOR1_BASE:
1758         case CB_COLOR2_BASE:
1759         case CB_COLOR3_BASE:
1760         case CB_COLOR4_BASE:
1761         case CB_COLOR5_BASE:
1762         case CB_COLOR6_BASE:
1763         case CB_COLOR7_BASE:
1764                 r = evergreen_cs_packet_next_reloc(p, &reloc);
1765                 if (r) {
1766                         dev_warn(p->dev, "bad SET_CONTEXT_REG "
1767                                         "0x%04X\n", reg);
1768                         return -EINVAL;
1769                 }
1770                 tmp = (reg - CB_COLOR0_BASE) / 0x3c;
1771                 track->cb_color_bo_offset[tmp] = radeon_get_ib_value(p, idx);
1772                 ib[idx] += (u32)((reloc->lobj.gpu_offset >> 8) & 0xffffffff);
1773                 track->cb_color_bo[tmp] = reloc->robj;
1774                 track->cb_dirty = true;
1775                 break;
1776         case CB_COLOR8_BASE:
1777         case CB_COLOR9_BASE:
1778         case CB_COLOR10_BASE:
1779         case CB_COLOR11_BASE:
1780                 r = evergreen_cs_packet_next_reloc(p, &reloc);
1781                 if (r) {
1782                         dev_warn(p->dev, "bad SET_CONTEXT_REG "
1783                                         "0x%04X\n", reg);
1784                         return -EINVAL;
1785                 }
1786                 tmp = ((reg - CB_COLOR8_BASE) / 0x1c) + 8;
1787                 track->cb_color_bo_offset[tmp] = radeon_get_ib_value(p, idx);
1788                 ib[idx] += (u32)((reloc->lobj.gpu_offset >> 8) & 0xffffffff);
1789                 track->cb_color_bo[tmp] = reloc->robj;
1790                 track->cb_dirty = true;
1791                 break;
1792         case DB_HTILE_DATA_BASE:
1793                 r = evergreen_cs_packet_next_reloc(p, &reloc);
1794                 if (r) {
1795                         dev_warn(p->dev, "bad SET_CONTEXT_REG "
1796                                         "0x%04X\n", reg);
1797                         return -EINVAL;
1798                 }
1799                 track->htile_offset = radeon_get_ib_value(p, idx);
1800                 ib[idx] += (u32)((reloc->lobj.gpu_offset >> 8) & 0xffffffff);
1801                 track->htile_bo = reloc->robj;
1802                 track->db_dirty = true;
1803                 break;
1804         case DB_HTILE_SURFACE:
1805                 /* 8x8 only */
1806                 track->htile_surface = radeon_get_ib_value(p, idx);
1807                 /* force 8x8 htile width and height */
1808                 ib[idx] |= 3;
1809                 track->db_dirty = true;
1810                 break;
1811         case CB_IMMED0_BASE:
1812         case CB_IMMED1_BASE:
1813         case CB_IMMED2_BASE:
1814         case CB_IMMED3_BASE:
1815         case CB_IMMED4_BASE:
1816         case CB_IMMED5_BASE:
1817         case CB_IMMED6_BASE:
1818         case CB_IMMED7_BASE:
1819         case CB_IMMED8_BASE:
1820         case CB_IMMED9_BASE:
1821         case CB_IMMED10_BASE:
1822         case CB_IMMED11_BASE:
1823         case SQ_PGM_START_FS:
1824         case SQ_PGM_START_ES:
1825         case SQ_PGM_START_VS:
1826         case SQ_PGM_START_GS:
1827         case SQ_PGM_START_PS:
1828         case SQ_PGM_START_HS:
1829         case SQ_PGM_START_LS:
1830         case SQ_CONST_MEM_BASE:
1831         case SQ_ALU_CONST_CACHE_GS_0:
1832         case SQ_ALU_CONST_CACHE_GS_1:
1833         case SQ_ALU_CONST_CACHE_GS_2:
1834         case SQ_ALU_CONST_CACHE_GS_3:
1835         case SQ_ALU_CONST_CACHE_GS_4:
1836         case SQ_ALU_CONST_CACHE_GS_5:
1837         case SQ_ALU_CONST_CACHE_GS_6:
1838         case SQ_ALU_CONST_CACHE_GS_7:
1839         case SQ_ALU_CONST_CACHE_GS_8:
1840         case SQ_ALU_CONST_CACHE_GS_9:
1841         case SQ_ALU_CONST_CACHE_GS_10:
1842         case SQ_ALU_CONST_CACHE_GS_11:
1843         case SQ_ALU_CONST_CACHE_GS_12:
1844         case SQ_ALU_CONST_CACHE_GS_13:
1845         case SQ_ALU_CONST_CACHE_GS_14:
1846         case SQ_ALU_CONST_CACHE_GS_15:
1847         case SQ_ALU_CONST_CACHE_PS_0:
1848         case SQ_ALU_CONST_CACHE_PS_1:
1849         case SQ_ALU_CONST_CACHE_PS_2:
1850         case SQ_ALU_CONST_CACHE_PS_3:
1851         case SQ_ALU_CONST_CACHE_PS_4:
1852         case SQ_ALU_CONST_CACHE_PS_5:
1853         case SQ_ALU_CONST_CACHE_PS_6:
1854         case SQ_ALU_CONST_CACHE_PS_7:
1855         case SQ_ALU_CONST_CACHE_PS_8:
1856         case SQ_ALU_CONST_CACHE_PS_9:
1857         case SQ_ALU_CONST_CACHE_PS_10:
1858         case SQ_ALU_CONST_CACHE_PS_11:
1859         case SQ_ALU_CONST_CACHE_PS_12:
1860         case SQ_ALU_CONST_CACHE_PS_13:
1861         case SQ_ALU_CONST_CACHE_PS_14:
1862         case SQ_ALU_CONST_CACHE_PS_15:
1863         case SQ_ALU_CONST_CACHE_VS_0:
1864         case SQ_ALU_CONST_CACHE_VS_1:
1865         case SQ_ALU_CONST_CACHE_VS_2:
1866         case SQ_ALU_CONST_CACHE_VS_3:
1867         case SQ_ALU_CONST_CACHE_VS_4:
1868         case SQ_ALU_CONST_CACHE_VS_5:
1869         case SQ_ALU_CONST_CACHE_VS_6:
1870         case SQ_ALU_CONST_CACHE_VS_7:
1871         case SQ_ALU_CONST_CACHE_VS_8:
1872         case SQ_ALU_CONST_CACHE_VS_9:
1873         case SQ_ALU_CONST_CACHE_VS_10:
1874         case SQ_ALU_CONST_CACHE_VS_11:
1875         case SQ_ALU_CONST_CACHE_VS_12:
1876         case SQ_ALU_CONST_CACHE_VS_13:
1877         case SQ_ALU_CONST_CACHE_VS_14:
1878         case SQ_ALU_CONST_CACHE_VS_15:
1879         case SQ_ALU_CONST_CACHE_HS_0:
1880         case SQ_ALU_CONST_CACHE_HS_1:
1881         case SQ_ALU_CONST_CACHE_HS_2:
1882         case SQ_ALU_CONST_CACHE_HS_3:
1883         case SQ_ALU_CONST_CACHE_HS_4:
1884         case SQ_ALU_CONST_CACHE_HS_5:
1885         case SQ_ALU_CONST_CACHE_HS_6:
1886         case SQ_ALU_CONST_CACHE_HS_7:
1887         case SQ_ALU_CONST_CACHE_HS_8:
1888         case SQ_ALU_CONST_CACHE_HS_9:
1889         case SQ_ALU_CONST_CACHE_HS_10:
1890         case SQ_ALU_CONST_CACHE_HS_11:
1891         case SQ_ALU_CONST_CACHE_HS_12:
1892         case SQ_ALU_CONST_CACHE_HS_13:
1893         case SQ_ALU_CONST_CACHE_HS_14:
1894         case SQ_ALU_CONST_CACHE_HS_15:
1895         case SQ_ALU_CONST_CACHE_LS_0:
1896         case SQ_ALU_CONST_CACHE_LS_1:
1897         case SQ_ALU_CONST_CACHE_LS_2:
1898         case SQ_ALU_CONST_CACHE_LS_3:
1899         case SQ_ALU_CONST_CACHE_LS_4:
1900         case SQ_ALU_CONST_CACHE_LS_5:
1901         case SQ_ALU_CONST_CACHE_LS_6:
1902         case SQ_ALU_CONST_CACHE_LS_7:
1903         case SQ_ALU_CONST_CACHE_LS_8:
1904         case SQ_ALU_CONST_CACHE_LS_9:
1905         case SQ_ALU_CONST_CACHE_LS_10:
1906         case SQ_ALU_CONST_CACHE_LS_11:
1907         case SQ_ALU_CONST_CACHE_LS_12:
1908         case SQ_ALU_CONST_CACHE_LS_13:
1909         case SQ_ALU_CONST_CACHE_LS_14:
1910         case SQ_ALU_CONST_CACHE_LS_15:
1911                 r = evergreen_cs_packet_next_reloc(p, &reloc);
1912                 if (r) {
1913                         dev_warn(p->dev, "bad SET_CONTEXT_REG "
1914                                         "0x%04X\n", reg);
1915                         return -EINVAL;
1916                 }
1917                 ib[idx] += (u32)((reloc->lobj.gpu_offset >> 8) & 0xffffffff);
1918                 break;
1919         case SX_MEMORY_EXPORT_BASE:
1920                 if (p->rdev->family >= CHIP_CAYMAN) {
1921                         dev_warn(p->dev, "bad SET_CONFIG_REG "
1922                                  "0x%04X\n", reg);
1923                         return -EINVAL;
1924                 }
1925                 r = evergreen_cs_packet_next_reloc(p, &reloc);
1926                 if (r) {
1927                         dev_warn(p->dev, "bad SET_CONFIG_REG "
1928                                         "0x%04X\n", reg);
1929                         return -EINVAL;
1930                 }
1931                 ib[idx] += (u32)((reloc->lobj.gpu_offset >> 8) & 0xffffffff);
1932                 break;
1933         case CAYMAN_SX_SCATTER_EXPORT_BASE:
1934                 if (p->rdev->family < CHIP_CAYMAN) {
1935                         dev_warn(p->dev, "bad SET_CONTEXT_REG "
1936                                  "0x%04X\n", reg);
1937                         return -EINVAL;
1938                 }
1939                 r = evergreen_cs_packet_next_reloc(p, &reloc);
1940                 if (r) {
1941                         dev_warn(p->dev, "bad SET_CONTEXT_REG "
1942                                         "0x%04X\n", reg);
1943                         return -EINVAL;
1944                 }
1945                 ib[idx] += (u32)((reloc->lobj.gpu_offset >> 8) & 0xffffffff);
1946                 break;
1947         case SX_MISC:
1948                 track->sx_misc_kill_all_prims = (radeon_get_ib_value(p, idx) & 0x1) != 0;
1949                 break;
1950         default:
1951                 dev_warn(p->dev, "forbidden register 0x%08x at %d\n", reg, idx);
1952                 return -EINVAL;
1953         }
1954         return 0;
1955 }
1956
1957 static bool evergreen_is_safe_reg(struct radeon_cs_parser *p, u32 reg, u32 idx)
1958 {
1959         u32 last_reg, m, i;
1960
1961         if (p->rdev->family >= CHIP_CAYMAN)
1962                 last_reg = DRM_ARRAY_SIZE(cayman_reg_safe_bm);
1963         else
1964                 last_reg = DRM_ARRAY_SIZE(evergreen_reg_safe_bm);
1965
1966         i = (reg >> 7);
1967         if (i >= last_reg) {
1968                 dev_warn(p->dev, "forbidden register 0x%08x at %d\n", reg, idx);
1969                 return false;
1970         }
1971         m = 1 << ((reg >> 2) & 31);
1972         if (p->rdev->family >= CHIP_CAYMAN) {
1973                 if (!(cayman_reg_safe_bm[i] & m))
1974                         return true;
1975         } else {
1976                 if (!(evergreen_reg_safe_bm[i] & m))
1977                         return true;
1978         }
1979         dev_warn(p->dev, "forbidden register 0x%08x at %d\n", reg, idx);
1980         return false;
1981 }
1982
1983 static int evergreen_packet3_check(struct radeon_cs_parser *p,
1984                                    struct radeon_cs_packet *pkt)
1985 {
1986         struct radeon_cs_reloc *reloc;
1987         struct evergreen_cs_track *track;
1988         volatile u32 *ib;
1989         unsigned idx;
1990         unsigned i;
1991         unsigned start_reg, end_reg, reg;
1992         int r;
1993         u32 idx_value;
1994
1995         track = (struct evergreen_cs_track *)p->track;
1996         ib = p->ib.ptr;
1997         idx = pkt->idx + 1;
1998         idx_value = radeon_get_ib_value(p, idx);
1999
2000         switch (pkt->opcode) {
2001         case PACKET3_SET_PREDICATION:
2002         {
2003                 int pred_op;
2004                 int tmp;
2005                 uint64_t offset;
2006
2007                 if (pkt->count != 1) {
2008                         DRM_ERROR("bad SET PREDICATION\n");
2009                         return -EINVAL;
2010                 }
2011
2012                 tmp = radeon_get_ib_value(p, idx + 1);
2013                 pred_op = (tmp >> 16) & 0x7;
2014
2015                 /* for the clear predicate operation */
2016                 if (pred_op == 0)
2017                         return 0;
2018
2019                 if (pred_op > 2) {
2020                         DRM_ERROR("bad SET PREDICATION operation %d\n", pred_op);
2021                         return -EINVAL;
2022                 }
2023
2024                 r = evergreen_cs_packet_next_reloc(p, &reloc);
2025                 if (r) {
2026                         DRM_ERROR("bad SET PREDICATION\n");
2027                         return -EINVAL;
2028                 }
2029
2030                 offset = reloc->lobj.gpu_offset +
2031                          (idx_value & 0xfffffff0) +
2032                          ((u64)(tmp & 0xff) << 32);
2033
2034                 ib[idx + 0] = offset;
2035                 ib[idx + 1] = (tmp & 0xffffff00) | (upper_32_bits(offset) & 0xff);
2036         }
2037         break;
2038         case PACKET3_CONTEXT_CONTROL:
2039                 if (pkt->count != 1) {
2040                         DRM_ERROR("bad CONTEXT_CONTROL\n");
2041                         return -EINVAL;
2042                 }
2043                 break;
2044         case PACKET3_INDEX_TYPE:
2045         case PACKET3_NUM_INSTANCES:
2046         case PACKET3_CLEAR_STATE:
2047                 if (pkt->count) {
2048                         DRM_ERROR("bad INDEX_TYPE/NUM_INSTANCES/CLEAR_STATE\n");
2049                         return -EINVAL;
2050                 }
2051                 break;
2052         case CAYMAN_PACKET3_DEALLOC_STATE:
2053                 if (p->rdev->family < CHIP_CAYMAN) {
2054                         DRM_ERROR("bad PACKET3_DEALLOC_STATE\n");
2055                         return -EINVAL;
2056                 }
2057                 if (pkt->count) {
2058                         DRM_ERROR("bad INDEX_TYPE/NUM_INSTANCES/CLEAR_STATE\n");
2059                         return -EINVAL;
2060                 }
2061                 break;
2062         case PACKET3_INDEX_BASE:
2063         {
2064                 uint64_t offset;
2065
2066                 if (pkt->count != 1) {
2067                         DRM_ERROR("bad INDEX_BASE\n");
2068                         return -EINVAL;
2069                 }
2070                 r = evergreen_cs_packet_next_reloc(p, &reloc);
2071                 if (r) {
2072                         DRM_ERROR("bad INDEX_BASE\n");
2073                         return -EINVAL;
2074                 }
2075
2076                 offset = reloc->lobj.gpu_offset +
2077                          idx_value +
2078                          ((u64)(radeon_get_ib_value(p, idx+1) & 0xff) << 32);
2079
2080                 ib[idx+0] = offset;
2081                 ib[idx+1] = upper_32_bits(offset) & 0xff;
2082
2083                 r = evergreen_cs_track_check(p);
2084                 if (r) {
2085                         dev_warn(p->dev, "%s:%d invalid cmd stream\n", __func__, __LINE__);
2086                         return r;
2087                 }
2088                 break;
2089         }
2090         case PACKET3_DRAW_INDEX:
2091         {
2092                 uint64_t offset;
2093                 if (pkt->count != 3) {
2094                         DRM_ERROR("bad DRAW_INDEX\n");
2095                         return -EINVAL;
2096                 }
2097                 r = evergreen_cs_packet_next_reloc(p, &reloc);
2098                 if (r) {
2099                         DRM_ERROR("bad DRAW_INDEX\n");
2100                         return -EINVAL;
2101                 }
2102
2103                 offset = reloc->lobj.gpu_offset +
2104                          idx_value +
2105                          ((u64)(radeon_get_ib_value(p, idx+1) & 0xff) << 32);
2106
2107                 ib[idx+0] = offset;
2108                 ib[idx+1] = upper_32_bits(offset) & 0xff;
2109
2110                 r = evergreen_cs_track_check(p);
2111                 if (r) {
2112                         dev_warn(p->dev, "%s:%d invalid cmd stream\n", __func__, __LINE__);
2113                         return r;
2114                 }
2115                 break;
2116         }
2117         case PACKET3_DRAW_INDEX_2:
2118         {
2119                 uint64_t offset;
2120
2121                 if (pkt->count != 4) {
2122                         DRM_ERROR("bad DRAW_INDEX_2\n");
2123                         return -EINVAL;
2124                 }
2125                 r = evergreen_cs_packet_next_reloc(p, &reloc);
2126                 if (r) {
2127                         DRM_ERROR("bad DRAW_INDEX_2\n");
2128                         return -EINVAL;
2129                 }
2130
2131                 offset = reloc->lobj.gpu_offset +
2132                          radeon_get_ib_value(p, idx+1) +
2133                          ((u64)(radeon_get_ib_value(p, idx+2) & 0xff) << 32);
2134
2135                 ib[idx+1] = offset;
2136                 ib[idx+2] = upper_32_bits(offset) & 0xff;
2137
2138                 r = evergreen_cs_track_check(p);
2139                 if (r) {
2140                         dev_warn(p->dev, "%s:%d invalid cmd stream\n", __func__, __LINE__);
2141                         return r;
2142                 }
2143                 break;
2144         }
2145         case PACKET3_DRAW_INDEX_AUTO:
2146                 if (pkt->count != 1) {
2147                         DRM_ERROR("bad DRAW_INDEX_AUTO\n");
2148                         return -EINVAL;
2149                 }
2150                 r = evergreen_cs_track_check(p);
2151                 if (r) {
2152                         dev_warn(p->dev, "%s:%d invalid cmd stream %d\n", __func__, __LINE__, idx);
2153                         return r;
2154                 }
2155                 break;
2156         case PACKET3_DRAW_INDEX_MULTI_AUTO:
2157                 if (pkt->count != 2) {
2158                         DRM_ERROR("bad DRAW_INDEX_MULTI_AUTO\n");
2159                         return -EINVAL;
2160                 }
2161                 r = evergreen_cs_track_check(p);
2162                 if (r) {
2163                         dev_warn(p->dev, "%s:%d invalid cmd stream %d\n", __func__, __LINE__, idx);
2164                         return r;
2165                 }
2166                 break;
2167         case PACKET3_DRAW_INDEX_IMMD:
2168                 if (pkt->count < 2) {
2169                         DRM_ERROR("bad DRAW_INDEX_IMMD\n");
2170                         return -EINVAL;
2171                 }
2172                 r = evergreen_cs_track_check(p);
2173                 if (r) {
2174                         dev_warn(p->dev, "%s:%d invalid cmd stream\n", __func__, __LINE__);
2175                         return r;
2176                 }
2177                 break;
2178         case PACKET3_DRAW_INDEX_OFFSET:
2179                 if (pkt->count != 2) {
2180                         DRM_ERROR("bad DRAW_INDEX_OFFSET\n");
2181                         return -EINVAL;
2182                 }
2183                 r = evergreen_cs_track_check(p);
2184                 if (r) {
2185                         dev_warn(p->dev, "%s:%d invalid cmd stream\n", __func__, __LINE__);
2186                         return r;
2187                 }
2188                 break;
2189         case PACKET3_DRAW_INDEX_OFFSET_2:
2190                 if (pkt->count != 3) {
2191                         DRM_ERROR("bad DRAW_INDEX_OFFSET_2\n");
2192                         return -EINVAL;
2193                 }
2194                 r = evergreen_cs_track_check(p);
2195                 if (r) {
2196                         dev_warn(p->dev, "%s:%d invalid cmd stream\n", __func__, __LINE__);
2197                         return r;
2198                 }
2199                 break;
2200         case PACKET3_DISPATCH_DIRECT:
2201                 if (pkt->count != 3) {
2202                         DRM_ERROR("bad DISPATCH_DIRECT\n");
2203                         return -EINVAL;
2204                 }
2205                 r = evergreen_cs_track_check(p);
2206                 if (r) {
2207                         dev_warn(p->dev, "%s:%d invalid cmd stream %d\n", __func__, __LINE__, idx);
2208                         return r;
2209                 }
2210                 break;
2211         case PACKET3_DISPATCH_INDIRECT:
2212                 if (pkt->count != 1) {
2213                         DRM_ERROR("bad DISPATCH_INDIRECT\n");
2214                         return -EINVAL;
2215                 }
2216                 r = evergreen_cs_packet_next_reloc(p, &reloc);
2217                 if (r) {
2218                         DRM_ERROR("bad DISPATCH_INDIRECT\n");
2219                         return -EINVAL;
2220                 }
2221                 ib[idx+0] = idx_value + (u32)(reloc->lobj.gpu_offset & 0xffffffff);
2222                 r = evergreen_cs_track_check(p);
2223                 if (r) {
2224                         dev_warn(p->dev, "%s:%d invalid cmd stream\n", __func__, __LINE__);
2225                         return r;
2226                 }
2227                 break;
2228         case PACKET3_WAIT_REG_MEM:
2229                 if (pkt->count != 5) {
2230                         DRM_ERROR("bad WAIT_REG_MEM\n");
2231                         return -EINVAL;
2232                 }
2233                 /* bit 4 is reg (0) or mem (1) */
2234                 if (idx_value & 0x10) {
2235                         uint64_t offset;
2236
2237                         r = evergreen_cs_packet_next_reloc(p, &reloc);
2238                         if (r) {
2239                                 DRM_ERROR("bad WAIT_REG_MEM\n");
2240                                 return -EINVAL;
2241                         }
2242
2243                         offset = reloc->lobj.gpu_offset +
2244                                  (radeon_get_ib_value(p, idx+1) & 0xfffffffc) +
2245                                  ((u64)(radeon_get_ib_value(p, idx+2) & 0xff) << 32);
2246
2247                         ib[idx+1] = (ib[idx+1] & 0x3) | (offset & 0xfffffffc);
2248                         ib[idx+2] = upper_32_bits(offset) & 0xff;
2249                 }
2250                 break;
2251         case PACKET3_CP_DMA:
2252         {
2253                 u32 command, size, info;
2254                 u64 offset, tmp;
2255                 if (pkt->count != 4) {
2256                         DRM_ERROR("bad CP DMA\n");
2257                         return -EINVAL;
2258                 }
2259                 command = radeon_get_ib_value(p, idx+4);
2260                 size = command & 0x1fffff;
2261                 info = radeon_get_ib_value(p, idx+1);
2262                 if ((((info & 0x60000000) >> 29) != 0) || /* src = GDS or DATA */
2263                     (((info & 0x00300000) >> 20) != 0) || /* dst = GDS */
2264                     ((((info & 0x00300000) >> 20) == 0) &&
2265                      (command & PACKET3_CP_DMA_CMD_DAS)) || /* dst = register */
2266                     ((((info & 0x60000000) >> 29) == 0) &&
2267                      (command & PACKET3_CP_DMA_CMD_SAS))) { /* src = register */
2268                         /* non mem to mem copies requires dw aligned count */
2269                         if (size % 4) {
2270                                 DRM_ERROR("CP DMA command requires dw count alignment\n");
2271                                 return -EINVAL;
2272                         }
2273                 }
2274                 if (command & PACKET3_CP_DMA_CMD_SAS) {
2275                         /* src address space is register */
2276                         /* GDS is ok */
2277                         if (((info & 0x60000000) >> 29) != 1) {
2278                                 DRM_ERROR("CP DMA SAS not supported\n");
2279                                 return -EINVAL;
2280                         }
2281                 } else {
2282                         if (command & PACKET3_CP_DMA_CMD_SAIC) {
2283                                 DRM_ERROR("CP DMA SAIC only supported for registers\n");
2284                                 return -EINVAL;
2285                         }
2286                         /* src address space is memory */
2287                         if (((info & 0x60000000) >> 29) == 0) {
2288                                 r = evergreen_cs_packet_next_reloc(p, &reloc);
2289                                 if (r) {
2290                                         DRM_ERROR("bad CP DMA SRC\n");
2291                                         return -EINVAL;
2292                                 }
2293
2294                                 tmp = radeon_get_ib_value(p, idx) +
2295                                         ((u64)(radeon_get_ib_value(p, idx+1) & 0xff) << 32);
2296
2297                                 offset = reloc->lobj.gpu_offset + tmp;
2298
2299                                 if ((tmp + size) > radeon_bo_size(reloc->robj)) {
2300                                         dev_warn(p->dev, "CP DMA src buffer too small (%ju %lu)\n",
2301                                                  (uintmax_t)tmp + size, radeon_bo_size(reloc->robj));
2302                                         return -EINVAL;
2303                                 }
2304
2305                                 ib[idx] = offset;
2306                                 ib[idx+1] = (ib[idx+1] & 0xffffff00) | (upper_32_bits(offset) & 0xff);
2307                         } else if (((info & 0x60000000) >> 29) != 2) {
2308                                 DRM_ERROR("bad CP DMA SRC_SEL\n");
2309                                 return -EINVAL;
2310                         }
2311                 }
2312                 if (command & PACKET3_CP_DMA_CMD_DAS) {
2313                         /* dst address space is register */
2314                         /* GDS is ok */
2315                         if (((info & 0x00300000) >> 20) != 1) {
2316                                 DRM_ERROR("CP DMA DAS not supported\n");
2317                                 return -EINVAL;
2318                         }
2319                 } else {
2320                         /* dst address space is memory */
2321                         if (command & PACKET3_CP_DMA_CMD_DAIC) {
2322                                 DRM_ERROR("CP DMA DAIC only supported for registers\n");
2323                                 return -EINVAL;
2324                         }
2325                         if (((info & 0x00300000) >> 20) == 0) {
2326                                 r = evergreen_cs_packet_next_reloc(p, &reloc);
2327                                 if (r) {
2328                                         DRM_ERROR("bad CP DMA DST\n");
2329                                         return -EINVAL;
2330                                 }
2331
2332                                 tmp = radeon_get_ib_value(p, idx+2) +
2333                                         ((u64)(radeon_get_ib_value(p, idx+3) & 0xff) << 32);
2334
2335                                 offset = reloc->lobj.gpu_offset + tmp;
2336
2337                                 if ((tmp + size) > radeon_bo_size(reloc->robj)) {
2338                                         dev_warn(p->dev, "CP DMA dst buffer too small (%ju %lu)\n",
2339                                                  (uintmax_t)tmp + size, radeon_bo_size(reloc->robj));
2340                                         return -EINVAL;
2341                                 }
2342
2343                                 ib[idx+2] = offset;
2344                                 ib[idx+3] = upper_32_bits(offset) & 0xff;
2345                         } else {
2346                                 DRM_ERROR("bad CP DMA DST_SEL\n");
2347                                 return -EINVAL;
2348                         }
2349                 }
2350                 break;
2351         }
2352         case PACKET3_SURFACE_SYNC:
2353                 if (pkt->count != 3) {
2354                         DRM_ERROR("bad SURFACE_SYNC\n");
2355                         return -EINVAL;
2356                 }
2357                 /* 0xffffffff/0x0 is flush all cache flag */
2358                 if (radeon_get_ib_value(p, idx + 1) != 0xffffffff ||
2359                     radeon_get_ib_value(p, idx + 2) != 0) {
2360                         r = evergreen_cs_packet_next_reloc(p, &reloc);
2361                         if (r) {
2362                                 DRM_ERROR("bad SURFACE_SYNC\n");
2363                                 return -EINVAL;
2364                         }
2365                         ib[idx+2] += (u32)((reloc->lobj.gpu_offset >> 8) & 0xffffffff);
2366                 }
2367                 break;
2368         case PACKET3_EVENT_WRITE:
2369                 if (pkt->count != 2 && pkt->count != 0) {
2370                         DRM_ERROR("bad EVENT_WRITE\n");
2371                         return -EINVAL;
2372                 }
2373                 if (pkt->count) {
2374                         uint64_t offset;
2375
2376                         r = evergreen_cs_packet_next_reloc(p, &reloc);
2377                         if (r) {
2378                                 DRM_ERROR("bad EVENT_WRITE\n");
2379                                 return -EINVAL;
2380                         }
2381                         offset = reloc->lobj.gpu_offset +
2382                                  (radeon_get_ib_value(p, idx+1) & 0xfffffff8) +
2383                                  ((u64)(radeon_get_ib_value(p, idx+2) & 0xff) << 32);
2384
2385                         ib[idx+1] = offset & 0xfffffff8;
2386                         ib[idx+2] = upper_32_bits(offset) & 0xff;
2387                 }
2388                 break;
2389         case PACKET3_EVENT_WRITE_EOP:
2390         {
2391                 uint64_t offset;
2392
2393                 if (pkt->count != 4) {
2394                         DRM_ERROR("bad EVENT_WRITE_EOP\n");
2395                         return -EINVAL;
2396                 }
2397                 r = evergreen_cs_packet_next_reloc(p, &reloc);
2398                 if (r) {
2399                         DRM_ERROR("bad EVENT_WRITE_EOP\n");
2400                         return -EINVAL;
2401                 }
2402
2403                 offset = reloc->lobj.gpu_offset +
2404                          (radeon_get_ib_value(p, idx+1) & 0xfffffffc) +
2405                          ((u64)(radeon_get_ib_value(p, idx+2) & 0xff) << 32);
2406
2407                 ib[idx+1] = offset & 0xfffffffc;
2408                 ib[idx+2] = (ib[idx+2] & 0xffffff00) | (upper_32_bits(offset) & 0xff);
2409                 break;
2410         }
2411         case PACKET3_EVENT_WRITE_EOS:
2412         {
2413                 uint64_t offset;
2414
2415                 if (pkt->count != 3) {
2416                         DRM_ERROR("bad EVENT_WRITE_EOS\n");
2417                         return -EINVAL;
2418                 }
2419                 r = evergreen_cs_packet_next_reloc(p, &reloc);
2420                 if (r) {
2421                         DRM_ERROR("bad EVENT_WRITE_EOS\n");
2422                         return -EINVAL;
2423                 }
2424
2425                 offset = reloc->lobj.gpu_offset +
2426                          (radeon_get_ib_value(p, idx+1) & 0xfffffffc) +
2427                          ((u64)(radeon_get_ib_value(p, idx+2) & 0xff) << 32);
2428
2429                 ib[idx+1] = offset & 0xfffffffc;
2430                 ib[idx+2] = (ib[idx+2] & 0xffffff00) | (upper_32_bits(offset) & 0xff);
2431                 break;
2432         }
2433         case PACKET3_SET_CONFIG_REG:
2434                 start_reg = (idx_value << 2) + PACKET3_SET_CONFIG_REG_START;
2435                 end_reg = 4 * pkt->count + start_reg - 4;
2436                 if ((start_reg < PACKET3_SET_CONFIG_REG_START) ||
2437                     (start_reg >= PACKET3_SET_CONFIG_REG_END) ||
2438                     (end_reg >= PACKET3_SET_CONFIG_REG_END)) {
2439                         DRM_ERROR("bad PACKET3_SET_CONFIG_REG\n");
2440                         return -EINVAL;
2441                 }
2442                 for (i = 0; i < pkt->count; i++) {
2443                         reg = start_reg + (4 * i);
2444                         r = evergreen_cs_check_reg(p, reg, idx+1+i);
2445                         if (r)
2446                                 return r;
2447                 }
2448                 break;
2449         case PACKET3_SET_CONTEXT_REG:
2450                 start_reg = (idx_value << 2) + PACKET3_SET_CONTEXT_REG_START;
2451                 end_reg = 4 * pkt->count + start_reg - 4;
2452                 if ((start_reg < PACKET3_SET_CONTEXT_REG_START) ||
2453                     (start_reg >= PACKET3_SET_CONTEXT_REG_END) ||
2454                     (end_reg >= PACKET3_SET_CONTEXT_REG_END)) {
2455                         DRM_ERROR("bad PACKET3_SET_CONTEXT_REG\n");
2456                         return -EINVAL;
2457                 }
2458                 for (i = 0; i < pkt->count; i++) {
2459                         reg = start_reg + (4 * i);
2460                         r = evergreen_cs_check_reg(p, reg, idx+1+i);
2461                         if (r)
2462                                 return r;
2463                 }
2464                 break;
2465         case PACKET3_SET_RESOURCE:
2466                 if (pkt->count % 8) {
2467                         DRM_ERROR("bad SET_RESOURCE\n");
2468                         return -EINVAL;
2469                 }
2470                 start_reg = (idx_value << 2) + PACKET3_SET_RESOURCE_START;
2471                 end_reg = 4 * pkt->count + start_reg - 4;
2472                 if ((start_reg < PACKET3_SET_RESOURCE_START) ||
2473                     (start_reg >= PACKET3_SET_RESOURCE_END) ||
2474                     (end_reg >= PACKET3_SET_RESOURCE_END)) {
2475                         DRM_ERROR("bad SET_RESOURCE\n");
2476                         return -EINVAL;
2477                 }
2478                 for (i = 0; i < (pkt->count / 8); i++) {
2479                         struct radeon_bo *texture, *mipmap;
2480                         u32 toffset, moffset;
2481                         u32 size, offset, mip_address, tex_dim;
2482
2483                         switch (G__SQ_CONSTANT_TYPE(radeon_get_ib_value(p, idx+1+(i*8)+7))) {
2484                         case SQ_TEX_VTX_VALID_TEXTURE:
2485                                 /* tex base */
2486                                 r = evergreen_cs_packet_next_reloc(p, &reloc);
2487                                 if (r) {
2488                                         DRM_ERROR("bad SET_RESOURCE (tex)\n");
2489                                         return -EINVAL;
2490                                 }
2491                                 if (!(p->cs_flags & RADEON_CS_KEEP_TILING_FLAGS)) {
2492                                         ib[idx+1+(i*8)+1] |=
2493                                                 TEX_ARRAY_MODE(evergreen_cs_get_aray_mode(reloc->lobj.tiling_flags));
2494                                         if (reloc->lobj.tiling_flags & RADEON_TILING_MACRO) {
2495                                                 unsigned bankw, bankh, mtaspect, tile_split;
2496
2497                                                 evergreen_tiling_fields(reloc->lobj.tiling_flags,
2498                                                                         &bankw, &bankh, &mtaspect,
2499                                                                         &tile_split);
2500                                                 ib[idx+1+(i*8)+6] |= TEX_TILE_SPLIT(tile_split);
2501                                                 ib[idx+1+(i*8)+7] |=
2502                                                         TEX_BANK_WIDTH(bankw) |
2503                                                         TEX_BANK_HEIGHT(bankh) |
2504                                                         MACRO_TILE_ASPECT(mtaspect) |
2505                                                         TEX_NUM_BANKS(evergreen_cs_get_num_banks(track->nbanks));
2506                                         }
2507                                 }
2508                                 texture = reloc->robj;
2509                                 toffset = (u32)((reloc->lobj.gpu_offset >> 8) & 0xffffffff);
2510
2511                                 /* tex mip base */
2512                                 tex_dim = ib[idx+1+(i*8)+0] & 0x7;
2513                                 mip_address = ib[idx+1+(i*8)+3];
2514
2515                                 if ((tex_dim == SQ_TEX_DIM_2D_MSAA || tex_dim == SQ_TEX_DIM_2D_ARRAY_MSAA) &&
2516                                     !mip_address &&
2517                                     !evergreen_cs_packet_next_is_pkt3_nop(p)) {
2518                                         /* MIP_ADDRESS should point to FMASK for an MSAA texture.
2519                                          * It should be 0 if FMASK is disabled. */
2520                                         moffset = 0;
2521                                         mipmap = NULL;
2522                                 } else {
2523                                         r = evergreen_cs_packet_next_reloc(p, &reloc);
2524                                         if (r) {
2525                                                 DRM_ERROR("bad SET_RESOURCE (tex)\n");
2526                                                 return -EINVAL;
2527                                         }
2528                                         moffset = (u32)((reloc->lobj.gpu_offset >> 8) & 0xffffffff);
2529                                         mipmap = reloc->robj;
2530                                 }
2531
2532                                 r = evergreen_cs_track_validate_texture(p, texture, mipmap, idx+1+(i*8));
2533                                 if (r)
2534                                         return r;
2535                                 ib[idx+1+(i*8)+2] += toffset;
2536                                 ib[idx+1+(i*8)+3] += moffset;
2537                                 break;
2538                         case SQ_TEX_VTX_VALID_BUFFER:
2539                         {
2540                                 uint64_t offset64;
2541                                 /* vtx base */
2542                                 r = evergreen_cs_packet_next_reloc(p, &reloc);
2543                                 if (r) {
2544                                         DRM_ERROR("bad SET_RESOURCE (vtx)\n");
2545                                         return -EINVAL;
2546                                 }
2547                                 offset = radeon_get_ib_value(p, idx+1+(i*8)+0);
2548                                 size = radeon_get_ib_value(p, idx+1+(i*8)+1);
2549                                 if (p->rdev && (size + offset) > radeon_bo_size(reloc->robj)) {
2550                                         /* force size to size of the buffer */
2551                                         dev_warn(p->dev, "vbo resource seems too big for the bo\n");
2552                                         ib[idx+1+(i*8)+1] = radeon_bo_size(reloc->robj) - offset;
2553                                 }
2554
2555                                 offset64 = reloc->lobj.gpu_offset + offset;
2556                                 ib[idx+1+(i*8)+0] = offset64;
2557                                 ib[idx+1+(i*8)+2] = (ib[idx+1+(i*8)+2] & 0xffffff00) |
2558                                                     (upper_32_bits(offset64) & 0xff);
2559                                 break;
2560                         }
2561                         case SQ_TEX_VTX_INVALID_TEXTURE:
2562                         case SQ_TEX_VTX_INVALID_BUFFER:
2563                         default:
2564                                 DRM_ERROR("bad SET_RESOURCE\n");
2565                                 return -EINVAL;
2566                         }
2567                 }
2568                 break;
2569         case PACKET3_SET_ALU_CONST:
2570                 /* XXX fix me ALU const buffers only */
2571                 break;
2572         case PACKET3_SET_BOOL_CONST:
2573                 start_reg = (idx_value << 2) + PACKET3_SET_BOOL_CONST_START;
2574                 end_reg = 4 * pkt->count + start_reg - 4;
2575                 if ((start_reg < PACKET3_SET_BOOL_CONST_START) ||
2576                     (start_reg >= PACKET3_SET_BOOL_CONST_END) ||
2577                     (end_reg >= PACKET3_SET_BOOL_CONST_END)) {
2578                         DRM_ERROR("bad SET_BOOL_CONST\n");
2579                         return -EINVAL;
2580                 }
2581                 break;
2582         case PACKET3_SET_LOOP_CONST:
2583                 start_reg = (idx_value << 2) + PACKET3_SET_LOOP_CONST_START;
2584                 end_reg = 4 * pkt->count + start_reg - 4;
2585                 if ((start_reg < PACKET3_SET_LOOP_CONST_START) ||
2586                     (start_reg >= PACKET3_SET_LOOP_CONST_END) ||
2587                     (end_reg >= PACKET3_SET_LOOP_CONST_END)) {
2588                         DRM_ERROR("bad SET_LOOP_CONST\n");
2589                         return -EINVAL;
2590                 }
2591                 break;
2592         case PACKET3_SET_CTL_CONST:
2593                 start_reg = (idx_value << 2) + PACKET3_SET_CTL_CONST_START;
2594                 end_reg = 4 * pkt->count + start_reg - 4;
2595                 if ((start_reg < PACKET3_SET_CTL_CONST_START) ||
2596                     (start_reg >= PACKET3_SET_CTL_CONST_END) ||
2597                     (end_reg >= PACKET3_SET_CTL_CONST_END)) {
2598                         DRM_ERROR("bad SET_CTL_CONST\n");
2599                         return -EINVAL;
2600                 }
2601                 break;
2602         case PACKET3_SET_SAMPLER:
2603                 if (pkt->count % 3) {
2604                         DRM_ERROR("bad SET_SAMPLER\n");
2605                         return -EINVAL;
2606                 }
2607                 start_reg = (idx_value << 2) + PACKET3_SET_SAMPLER_START;
2608                 end_reg = 4 * pkt->count + start_reg - 4;
2609                 if ((start_reg < PACKET3_SET_SAMPLER_START) ||
2610                     (start_reg >= PACKET3_SET_SAMPLER_END) ||
2611                     (end_reg >= PACKET3_SET_SAMPLER_END)) {
2612                         DRM_ERROR("bad SET_SAMPLER\n");
2613                         return -EINVAL;
2614                 }
2615                 break;
2616         case PACKET3_STRMOUT_BUFFER_UPDATE:
2617                 if (pkt->count != 4) {
2618                         DRM_ERROR("bad STRMOUT_BUFFER_UPDATE (invalid count)\n");
2619                         return -EINVAL;
2620                 }
2621                 /* Updating memory at DST_ADDRESS. */
2622                 if (idx_value & 0x1) {
2623                         u64 offset;
2624                         r = evergreen_cs_packet_next_reloc(p, &reloc);
2625                         if (r) {
2626                                 DRM_ERROR("bad STRMOUT_BUFFER_UPDATE (missing dst reloc)\n");
2627                                 return -EINVAL;
2628                         }
2629                         offset = radeon_get_ib_value(p, idx+1);
2630                         offset += ((u64)(radeon_get_ib_value(p, idx+2) & 0xff)) << 32;
2631                         if ((offset + 4) > radeon_bo_size(reloc->robj)) {
2632                                 DRM_ERROR("bad STRMOUT_BUFFER_UPDATE dst bo too small: 0x%jx, 0x%lx\n",
2633                                           (uintmax_t)offset + 4, radeon_bo_size(reloc->robj));
2634                                 return -EINVAL;
2635                         }
2636                         offset += reloc->lobj.gpu_offset;
2637                         ib[idx+1] = offset;
2638                         ib[idx+2] = upper_32_bits(offset) & 0xff;
2639                 }
2640                 /* Reading data from SRC_ADDRESS. */
2641                 if (((idx_value >> 1) & 0x3) == 2) {
2642                         u64 offset;
2643                         r = evergreen_cs_packet_next_reloc(p, &reloc);
2644                         if (r) {
2645                                 DRM_ERROR("bad STRMOUT_BUFFER_UPDATE (missing src reloc)\n");
2646                                 return -EINVAL;
2647                         }
2648                         offset = radeon_get_ib_value(p, idx+3);
2649                         offset += ((u64)(radeon_get_ib_value(p, idx+4) & 0xff)) << 32;
2650                         if ((offset + 4) > radeon_bo_size(reloc->robj)) {
2651                                 DRM_ERROR("bad STRMOUT_BUFFER_UPDATE src bo too small: 0x%jx, 0x%lx\n",
2652                                           (uintmax_t)offset + 4, radeon_bo_size(reloc->robj));
2653                                 return -EINVAL;
2654                         }
2655                         offset += reloc->lobj.gpu_offset;
2656                         ib[idx+3] = offset;
2657                         ib[idx+4] = upper_32_bits(offset) & 0xff;
2658                 }
2659                 break;
2660         case PACKET3_MEM_WRITE:
2661         {
2662                 u64 offset;
2663
2664                 if (pkt->count != 3) {
2665                         DRM_ERROR("bad MEM_WRITE (invalid count)\n");
2666                         return -EINVAL;
2667                 }
2668                 r = evergreen_cs_packet_next_reloc(p, &reloc);
2669                 if (r) {
2670                         DRM_ERROR("bad MEM_WRITE (missing reloc)\n");
2671                         return -EINVAL;
2672                 }
2673                 offset = radeon_get_ib_value(p, idx+0);
2674                 offset += ((u64)(radeon_get_ib_value(p, idx+1) & 0xff)) << 32UL;
2675                 if (offset & 0x7) {
2676                         DRM_ERROR("bad MEM_WRITE (address not qwords aligned)\n");
2677                         return -EINVAL;
2678                 }
2679                 if ((offset + 8) > radeon_bo_size(reloc->robj)) {
2680                         DRM_ERROR("bad MEM_WRITE bo too small: 0x%jx, 0x%lx\n",
2681                                   (uintmax_t)offset + 8, radeon_bo_size(reloc->robj));
2682                         return -EINVAL;
2683                 }
2684                 offset += reloc->lobj.gpu_offset;
2685                 ib[idx+0] = offset;
2686                 ib[idx+1] = upper_32_bits(offset) & 0xff;
2687                 break;
2688         }
2689         case PACKET3_COPY_DW:
2690                 if (pkt->count != 4) {
2691                         DRM_ERROR("bad COPY_DW (invalid count)\n");
2692                         return -EINVAL;
2693                 }
2694                 if (idx_value & 0x1) {
2695                         u64 offset;
2696                         /* SRC is memory. */
2697                         r = evergreen_cs_packet_next_reloc(p, &reloc);
2698                         if (r) {
2699                                 DRM_ERROR("bad COPY_DW (missing src reloc)\n");
2700                                 return -EINVAL;
2701                         }
2702                         offset = radeon_get_ib_value(p, idx+1);
2703                         offset += ((u64)(radeon_get_ib_value(p, idx+2) & 0xff)) << 32;
2704                         if ((offset + 4) > radeon_bo_size(reloc->robj)) {
2705                                 DRM_ERROR("bad COPY_DW src bo too small: 0x%jx, 0x%lx\n",
2706                                           (uintmax_t)offset + 4, radeon_bo_size(reloc->robj));
2707                                 return -EINVAL;
2708                         }
2709                         offset += reloc->lobj.gpu_offset;
2710                         ib[idx+1] = offset;
2711                         ib[idx+2] = upper_32_bits(offset) & 0xff;
2712                 } else {
2713                         /* SRC is a reg. */
2714                         reg = radeon_get_ib_value(p, idx+1) << 2;
2715                         if (!evergreen_is_safe_reg(p, reg, idx+1))
2716                                 return -EINVAL;
2717                 }
2718                 if (idx_value & 0x2) {
2719                         u64 offset;
2720                         /* DST is memory. */
2721                         r = evergreen_cs_packet_next_reloc(p, &reloc);
2722                         if (r) {
2723                                 DRM_ERROR("bad COPY_DW (missing dst reloc)\n");
2724                                 return -EINVAL;
2725                         }
2726                         offset = radeon_get_ib_value(p, idx+3);
2727                         offset += ((u64)(radeon_get_ib_value(p, idx+4) & 0xff)) << 32;
2728                         if ((offset + 4) > radeon_bo_size(reloc->robj)) {
2729                                 DRM_ERROR("bad COPY_DW dst bo too small: 0x%jx, 0x%lx\n",
2730                                           (uintmax_t)offset + 4, radeon_bo_size(reloc->robj));
2731                                 return -EINVAL;
2732                         }
2733                         offset += reloc->lobj.gpu_offset;
2734                         ib[idx+3] = offset;
2735                         ib[idx+4] = upper_32_bits(offset) & 0xff;
2736                 } else {
2737                         /* DST is a reg. */
2738                         reg = radeon_get_ib_value(p, idx+3) << 2;
2739                         if (!evergreen_is_safe_reg(p, reg, idx+3))
2740                                 return -EINVAL;
2741                 }
2742                 break;
2743         case PACKET3_NOP:
2744                 break;
2745         default:
2746                 DRM_ERROR("Packet3 opcode %x not supported\n", pkt->opcode);
2747                 return -EINVAL;
2748         }
2749         return 0;
2750 }
2751
2752 int evergreen_cs_parse(struct radeon_cs_parser *p)
2753 {
2754         struct radeon_cs_packet pkt;
2755         struct evergreen_cs_track *track;
2756         u32 tmp;
2757         int r;
2758
2759         if (p->track == NULL) {
2760                 /* initialize tracker, we are in kms */
2761                 track = kmalloc(sizeof(*track), DRM_MEM_DRIVER,
2762                                 M_ZERO | M_WAITOK);
2763                 if (track == NULL)
2764                         return -ENOMEM;
2765                 evergreen_cs_track_init(track);
2766                 if (p->rdev->family >= CHIP_CAYMAN)
2767                         tmp = p->rdev->config.cayman.tile_config;
2768                 else
2769                         tmp = p->rdev->config.evergreen.tile_config;
2770
2771                 switch (tmp & 0xf) {
2772                 case 0:
2773                         track->npipes = 1;
2774                         break;
2775                 case 1:
2776                 default:
2777                         track->npipes = 2;
2778                         break;
2779                 case 2:
2780                         track->npipes = 4;
2781                         break;
2782                 case 3:
2783                         track->npipes = 8;
2784                         break;
2785                 }
2786
2787                 switch ((tmp & 0xf0) >> 4) {
2788                 case 0:
2789                         track->nbanks = 4;
2790                         break;
2791                 case 1:
2792                 default:
2793                         track->nbanks = 8;
2794                         break;
2795                 case 2:
2796                         track->nbanks = 16;
2797                         break;
2798                 }
2799
2800                 switch ((tmp & 0xf00) >> 8) {
2801                 case 0:
2802                         track->group_size = 256;
2803                         break;
2804                 case 1:
2805                 default:
2806                         track->group_size = 512;
2807                         break;
2808                 }
2809
2810                 switch ((tmp & 0xf000) >> 12) {
2811                 case 0:
2812                         track->row_size = 1;
2813                         break;
2814                 case 1:
2815                 default:
2816                         track->row_size = 2;
2817                         break;
2818                 case 2:
2819                         track->row_size = 4;
2820                         break;
2821                 }
2822
2823                 p->track = track;
2824         }
2825         do {
2826                 r = evergreen_cs_packet_parse(p, &pkt, p->idx);
2827                 if (r) {
2828                         drm_free(p->track, DRM_MEM_DRIVER);
2829                         p->track = NULL;
2830                         return r;
2831                 }
2832                 p->idx += pkt.count + 2;
2833                 switch (pkt.type) {
2834                 case PACKET_TYPE0:
2835                         r = evergreen_cs_parse_packet0(p, &pkt);
2836                         break;
2837                 case PACKET_TYPE2:
2838                         break;
2839                 case PACKET_TYPE3:
2840                         r = evergreen_packet3_check(p, &pkt);
2841                         break;
2842                 default:
2843                         DRM_ERROR("Unknown packet type %d !\n", pkt.type);
2844                         drm_free(p->track, DRM_MEM_DRIVER);
2845                         p->track = NULL;
2846                         return -EINVAL;
2847                 }
2848                 if (r) {
2849                         drm_free(p->track, DRM_MEM_DRIVER);
2850                         p->track = NULL;
2851                         return r;
2852                 }
2853         } while (p->idx < p->chunks[p->chunk_ib_idx].length_dw);
2854 #if 0
2855         for (r = 0; r < p->ib.length_dw; r++) {
2856                 DRM_INFO("%05d  0x%08X\n", r, p->ib.ptr[r]);
2857                 mdelay(1);
2858         }
2859 #endif
2860         drm_free(p->track, DRM_MEM_DRIVER);
2861         p->track = NULL;
2862         return 0;
2863 }
2864
2865 /*
2866  *  DMA
2867  */
2868
2869 #define GET_DMA_CMD(h) (((h) & 0xf0000000) >> 28)
2870 #define GET_DMA_COUNT(h) ((h) & 0x000fffff)
2871 #define GET_DMA_T(h) (((h) & 0x00800000) >> 23)
2872 #define GET_DMA_NEW(h) (((h) & 0x04000000) >> 26)
2873 #define GET_DMA_MISC(h) (((h) & 0x0700000) >> 20)
2874
2875 /**
2876  * evergreen_dma_cs_parse() - parse the DMA IB
2877  * @p:          parser structure holding parsing context.
2878  *
2879  * Parses the DMA IB from the CS ioctl and updates
2880  * the GPU addresses based on the reloc information and
2881  * checks for errors. (Evergreen-Cayman)
2882  * Returns 0 for success and an error on failure.
2883  **/
2884 int evergreen_dma_cs_parse(struct radeon_cs_parser *p)
2885 {
2886         struct radeon_cs_chunk *ib_chunk = &p->chunks[p->chunk_ib_idx];
2887         struct radeon_cs_reloc *src_reloc, *dst_reloc, *dst2_reloc;
2888         u32 header, cmd, count, tiled, new_cmd, misc;
2889         volatile u32 *ib = p->ib.ptr;
2890         u32 idx, idx_value;
2891         u64 src_offset, dst_offset, dst2_offset;
2892         int r;
2893
2894         do {
2895                 if (p->idx >= ib_chunk->length_dw) {
2896                         DRM_ERROR("Can not parse packet at %d after CS end %d !\n",
2897                                   p->idx, ib_chunk->length_dw);
2898                         return -EINVAL;
2899                 }
2900                 idx = p->idx;
2901                 header = radeon_get_ib_value(p, idx);
2902                 cmd = GET_DMA_CMD(header);
2903                 count = GET_DMA_COUNT(header);
2904                 tiled = GET_DMA_T(header);
2905                 new_cmd = GET_DMA_NEW(header);
2906                 misc = GET_DMA_MISC(header);
2907
2908                 switch (cmd) {
2909                 case DMA_PACKET_WRITE:
2910                         r = r600_dma_cs_next_reloc(p, &dst_reloc);
2911                         if (r) {
2912                                 DRM_ERROR("bad DMA_PACKET_WRITE\n");
2913                                 return -EINVAL;
2914                         }
2915                         if (tiled) {
2916                                 dst_offset = radeon_get_ib_value(p, idx+1);
2917                                 dst_offset <<= 8;
2918
2919                                 ib[idx+1] += (u32)(dst_reloc->lobj.gpu_offset >> 8);
2920                                 p->idx += count + 7;
2921                         } else {
2922                                 dst_offset = radeon_get_ib_value(p, idx+1);
2923                                 dst_offset |= ((u64)(radeon_get_ib_value(p, idx+2) & 0xff)) << 32;
2924
2925                                 ib[idx+1] += (u32)(dst_reloc->lobj.gpu_offset & 0xfffffffc);
2926                                 ib[idx+2] += upper_32_bits(dst_reloc->lobj.gpu_offset) & 0xff;
2927                                 p->idx += count + 3;
2928                         }
2929                         if ((dst_offset + (count * 4)) > radeon_bo_size(dst_reloc->robj)) {
2930                                 dev_warn(p->dev, "DMA write buffer too small (%ju %lu)\n",
2931                                          (uintmax_t)dst_offset, radeon_bo_size(dst_reloc->robj));
2932                                 return -EINVAL;
2933                         }
2934                         break;
2935                 case DMA_PACKET_COPY:
2936                         r = r600_dma_cs_next_reloc(p, &src_reloc);
2937                         if (r) {
2938                                 DRM_ERROR("bad DMA_PACKET_COPY\n");
2939                                 return -EINVAL;
2940                         }
2941                         r = r600_dma_cs_next_reloc(p, &dst_reloc);
2942                         if (r) {
2943                                 DRM_ERROR("bad DMA_PACKET_COPY\n");
2944                                 return -EINVAL;
2945                         }
2946                         if (tiled) {
2947                                 idx_value = radeon_get_ib_value(p, idx + 2);
2948                                 if (new_cmd) {
2949                                         switch (misc) {
2950                                         case 0:
2951                                                 /* L2T, frame to fields */
2952                                                 if (idx_value & (1 << 31)) {
2953                                                         DRM_ERROR("bad L2T, frame to fields DMA_PACKET_COPY\n");
2954                                                         return -EINVAL;
2955                                                 }
2956                                                 r = r600_dma_cs_next_reloc(p, &dst2_reloc);
2957                                                 if (r) {
2958                                                         DRM_ERROR("bad L2T, frame to fields DMA_PACKET_COPY\n");
2959                                                         return -EINVAL;
2960                                                 }
2961                                                 dst_offset = radeon_get_ib_value(p, idx+1);
2962                                                 dst_offset <<= 8;
2963                                                 dst2_offset = radeon_get_ib_value(p, idx+2);
2964                                                 dst2_offset <<= 8;
2965                                                 src_offset = radeon_get_ib_value(p, idx+8);
2966                                                 src_offset |= ((u64)(radeon_get_ib_value(p, idx+9) & 0xff)) << 32;
2967                                                 if ((src_offset + (count * 4)) > radeon_bo_size(src_reloc->robj)) {
2968                                                         dev_warn(p->dev, "DMA L2T, frame to fields src buffer too small (%ju %lu)\n",
2969                                                                  (uintmax_t)src_offset + (count * 4), radeon_bo_size(src_reloc->robj));
2970                                                         return -EINVAL;
2971                                                 }
2972                                                 if ((dst_offset + (count * 4)) > radeon_bo_size(dst_reloc->robj)) {
2973                                                         dev_warn(p->dev, "DMA L2T, frame to fields buffer too small (%ju %lu)\n",
2974                                                                  (uintmax_t)dst_offset + (count * 4), radeon_bo_size(dst_reloc->robj));
2975                                                         return -EINVAL;
2976                                                 }
2977                                                 if ((dst2_offset + (count * 4)) > radeon_bo_size(dst2_reloc->robj)) {
2978                                                         dev_warn(p->dev, "DMA L2T, frame to fields buffer too small (%ju %lu)\n",
2979                                                                  (uintmax_t)dst2_offset + (count * 4), radeon_bo_size(dst2_reloc->robj));
2980                                                         return -EINVAL;
2981                                                 }
2982                                                 ib[idx+1] += (u32)(dst_reloc->lobj.gpu_offset >> 8);
2983                                                 ib[idx+2] += (u32)(dst2_reloc->lobj.gpu_offset >> 8);
2984                                                 ib[idx+8] += (u32)(src_reloc->lobj.gpu_offset & 0xfffffffc);
2985                                                 ib[idx+9] += upper_32_bits(src_reloc->lobj.gpu_offset) & 0xff;
2986                                                 p->idx += 10;
2987                                                 break;
2988                                         case 1:
2989                                                 /* L2T, T2L partial */
2990                                                 if (p->family < CHIP_CAYMAN) {
2991                                                         DRM_ERROR("L2T, T2L Partial is cayman only !\n");
2992                                                         return -EINVAL;
2993                                                 }
2994                                                 /* detile bit */
2995                                                 if (idx_value & (1 << 31)) {
2996                                                         /* tiled src, linear dst */
2997                                                         ib[idx+1] += (u32)(src_reloc->lobj.gpu_offset >> 8);
2998
2999                                                         ib[idx+7] += (u32)(dst_reloc->lobj.gpu_offset & 0xfffffffc);
3000                                                         ib[idx+8] += upper_32_bits(dst_reloc->lobj.gpu_offset) & 0xff;
3001                                                 } else {
3002                                                         /* linear src, tiled dst */
3003                                                         ib[idx+7] += (u32)(src_reloc->lobj.gpu_offset & 0xfffffffc);
3004                                                         ib[idx+8] += upper_32_bits(src_reloc->lobj.gpu_offset) & 0xff;
3005
3006                                                         ib[idx+1] += (u32)(dst_reloc->lobj.gpu_offset >> 8);
3007                                                 }
3008                                                 p->idx += 12;
3009                                                 break;
3010                                         case 3:
3011                                                 /* L2T, broadcast */
3012                                                 if (idx_value & (1 << 31)) {
3013                                                         DRM_ERROR("bad L2T, broadcast DMA_PACKET_COPY\n");
3014                                                         return -EINVAL;
3015                                                 }
3016                                                 r = r600_dma_cs_next_reloc(p, &dst2_reloc);
3017                                                 if (r) {
3018                                                         DRM_ERROR("bad L2T, broadcast DMA_PACKET_COPY\n");
3019                                                         return -EINVAL;
3020                                                 }
3021                                                 dst_offset = radeon_get_ib_value(p, idx+1);
3022                                                 dst_offset <<= 8;
3023                                                 dst2_offset = radeon_get_ib_value(p, idx+2);
3024                                                 dst2_offset <<= 8;
3025                                                 src_offset = radeon_get_ib_value(p, idx+8);
3026                                                 src_offset |= ((u64)(radeon_get_ib_value(p, idx+9) & 0xff)) << 32;
3027                                                 if ((src_offset + (count * 4)) > radeon_bo_size(src_reloc->robj)) {
3028                                                         dev_warn(p->dev, "DMA L2T, broadcast src buffer too small (%ju %lu)\n",
3029                                                                  (uintmax_t)src_offset + (count * 4), radeon_bo_size(src_reloc->robj));
3030                                                         return -EINVAL;
3031                                                 }
3032                                                 if ((dst_offset + (count * 4)) > radeon_bo_size(dst_reloc->robj)) {
3033                                                         dev_warn(p->dev, "DMA L2T, broadcast dst buffer too small (%ju %lu)\n",
3034                                                                  (uintmax_t)dst_offset + (count * 4), radeon_bo_size(dst_reloc->robj));
3035                                                         return -EINVAL;
3036                                                 }
3037                                                 if ((dst2_offset + (count * 4)) > radeon_bo_size(dst2_reloc->robj)) {
3038                                                         dev_warn(p->dev, "DMA L2T, broadcast dst2 buffer too small (%ju %lu)\n",
3039                                                                  (uintmax_t)dst2_offset + (count * 4), radeon_bo_size(dst2_reloc->robj));
3040                                                         return -EINVAL;
3041                                                 }
3042                                                 ib[idx+1] += (u32)(dst_reloc->lobj.gpu_offset >> 8);
3043                                                 ib[idx+2] += (u32)(dst2_reloc->lobj.gpu_offset >> 8);
3044                                                 ib[idx+8] += (u32)(src_reloc->lobj.gpu_offset & 0xfffffffc);
3045                                                 ib[idx+9] += upper_32_bits(src_reloc->lobj.gpu_offset) & 0xff;
3046                                                 p->idx += 10;
3047                                                 break;
3048                                         case 4:
3049                                                 /* L2T, T2L */
3050                                                 /* detile bit */
3051                                                 if (idx_value & (1 << 31)) {
3052                                                         /* tiled src, linear dst */
3053                                                         src_offset = radeon_get_ib_value(p, idx+1);
3054                                                         src_offset <<= 8;
3055                                                         ib[idx+1] += (u32)(src_reloc->lobj.gpu_offset >> 8);
3056
3057                                                         dst_offset = radeon_get_ib_value(p, idx+7);
3058                                                         dst_offset |= ((u64)(radeon_get_ib_value(p, idx+8) & 0xff)) << 32;
3059                                                         ib[idx+7] += (u32)(dst_reloc->lobj.gpu_offset & 0xfffffffc);
3060                                                         ib[idx+8] += upper_32_bits(dst_reloc->lobj.gpu_offset) & 0xff;
3061                                                 } else {
3062                                                         /* linear src, tiled dst */
3063                                                         src_offset = radeon_get_ib_value(p, idx+7);
3064                                                         src_offset |= ((u64)(radeon_get_ib_value(p, idx+8) & 0xff)) << 32;
3065                                                         ib[idx+7] += (u32)(src_reloc->lobj.gpu_offset & 0xfffffffc);
3066                                                         ib[idx+8] += upper_32_bits(src_reloc->lobj.gpu_offset) & 0xff;
3067
3068                                                         dst_offset = radeon_get_ib_value(p, idx+1);
3069                                                         dst_offset <<= 8;
3070                                                         ib[idx+1] += (u32)(dst_reloc->lobj.gpu_offset >> 8);
3071                                                 }
3072                                                 if ((src_offset + (count * 4)) > radeon_bo_size(src_reloc->robj)) {
3073                                                         dev_warn(p->dev, "DMA L2T, T2L src buffer too small (%ju %lu)\n",
3074                                                                  (uintmax_t)src_offset + (count * 4), radeon_bo_size(src_reloc->robj));
3075                                                         return -EINVAL;
3076                                                 }
3077                                                 if ((dst_offset + (count * 4)) > radeon_bo_size(dst_reloc->robj)) {
3078                                                         dev_warn(p->dev, "DMA L2T, T2L dst buffer too small (%ju %lu)\n",
3079                                                                  (uintmax_t)dst_offset + (count * 4), radeon_bo_size(dst_reloc->robj));
3080                                                         return -EINVAL;
3081                                                 }
3082                                                 p->idx += 9;
3083                                                 break;
3084                                         case 5:
3085                                                 /* T2T partial */
3086                                                 if (p->family < CHIP_CAYMAN) {
3087                                                         DRM_ERROR("L2T, T2L Partial is cayman only !\n");
3088                                                         return -EINVAL;
3089                                                 }
3090                                                 ib[idx+1] += (u32)(src_reloc->lobj.gpu_offset >> 8);
3091                                                 ib[idx+4] += (u32)(dst_reloc->lobj.gpu_offset >> 8);
3092                                                 p->idx += 13;
3093                                                 break;
3094                                         case 7:
3095                                                 /* L2T, broadcast */
3096                                                 if (idx_value & (1 << 31)) {
3097                                                         DRM_ERROR("bad L2T, broadcast DMA_PACKET_COPY\n");
3098                                                         return -EINVAL;
3099                                                 }
3100                                                 r = r600_dma_cs_next_reloc(p, &dst2_reloc);
3101                                                 if (r) {
3102                                                         DRM_ERROR("bad L2T, broadcast DMA_PACKET_COPY\n");
3103                                                         return -EINVAL;
3104                                                 }
3105                                                 dst_offset = radeon_get_ib_value(p, idx+1);
3106                                                 dst_offset <<= 8;
3107                                                 dst2_offset = radeon_get_ib_value(p, idx+2);
3108                                                 dst2_offset <<= 8;
3109                                                 src_offset = radeon_get_ib_value(p, idx+8);
3110                                                 src_offset |= ((u64)(radeon_get_ib_value(p, idx+9) & 0xff)) << 32;
3111                                                 if ((src_offset + (count * 4)) > radeon_bo_size(src_reloc->robj)) {
3112                                                         dev_warn(p->dev, "DMA L2T, broadcast src buffer too small (%ju %lu)\n",
3113                                                                  (uintmax_t)src_offset + (count * 4), radeon_bo_size(src_reloc->robj));
3114                                                         return -EINVAL;
3115                                                 }
3116                                                 if ((dst_offset + (count * 4)) > radeon_bo_size(dst_reloc->robj)) {
3117                                                         dev_warn(p->dev, "DMA L2T, broadcast dst buffer too small (%ju %lu)\n",
3118                                                                  (uintmax_t)dst_offset + (count * 4), radeon_bo_size(dst_reloc->robj));
3119                                                         return -EINVAL;
3120                                                 }
3121                                                 if ((dst2_offset + (count * 4)) > radeon_bo_size(dst2_reloc->robj)) {
3122                                                         dev_warn(p->dev, "DMA L2T, broadcast dst2 buffer too small (%ju %lu)\n",
3123                                                                  (uintmax_t)dst2_offset + (count * 4), radeon_bo_size(dst2_reloc->robj));
3124                                                         return -EINVAL;
3125                                                 }
3126                                                 ib[idx+1] += (u32)(dst_reloc->lobj.gpu_offset >> 8);
3127                                                 ib[idx+2] += (u32)(dst2_reloc->lobj.gpu_offset >> 8);
3128                                                 ib[idx+8] += (u32)(src_reloc->lobj.gpu_offset & 0xfffffffc);
3129                                                 ib[idx+9] += upper_32_bits(src_reloc->lobj.gpu_offset) & 0xff;
3130                                                 p->idx += 10;
3131                                                 break;
3132                                         default:
3133                                                 DRM_ERROR("bad DMA_PACKET_COPY misc %u\n", misc);
3134                                                 return -EINVAL;
3135                                         }
3136                                 } else {
3137                                         switch (misc) {
3138                                         case 0:
3139                                                 /* detile bit */
3140                                                 if (idx_value & (1 << 31)) {
3141                                                         /* tiled src, linear dst */
3142                                                         src_offset = radeon_get_ib_value(p, idx+1);
3143                                                         src_offset <<= 8;
3144                                                         ib[idx+1] += (u32)(src_reloc->lobj.gpu_offset >> 8);
3145
3146                                                         dst_offset = radeon_get_ib_value(p, idx+7);
3147                                                         dst_offset |= ((u64)(radeon_get_ib_value(p, idx+8) & 0xff)) << 32;
3148                                                         ib[idx+7] += (u32)(dst_reloc->lobj.gpu_offset & 0xfffffffc);
3149                                                         ib[idx+8] += upper_32_bits(dst_reloc->lobj.gpu_offset) & 0xff;
3150                                                 } else {
3151                                                         /* linear src, tiled dst */
3152                                                         src_offset = radeon_get_ib_value(p, idx+7);
3153                                                         src_offset |= ((u64)(radeon_get_ib_value(p, idx+8) & 0xff)) << 32;
3154                                                         ib[idx+7] += (u32)(src_reloc->lobj.gpu_offset & 0xfffffffc);
3155                                                         ib[idx+8] += upper_32_bits(src_reloc->lobj.gpu_offset) & 0xff;
3156
3157                                                         dst_offset = radeon_get_ib_value(p, idx+1);
3158                                                         dst_offset <<= 8;
3159                                                         ib[idx+1] += (u32)(dst_reloc->lobj.gpu_offset >> 8);
3160                                                 }
3161                                                 if ((src_offset + (count * 4)) > radeon_bo_size(src_reloc->robj)) {
3162                                                         dev_warn(p->dev, "DMA L2T, broadcast src buffer too small (%ju %lu)\n",
3163                                                                  (uintmax_t)src_offset + (count * 4), radeon_bo_size(src_reloc->robj));
3164                                                         return -EINVAL;
3165                                                 }
3166                                                 if ((dst_offset + (count * 4)) > radeon_bo_size(dst_reloc->robj)) {
3167                                                         dev_warn(p->dev, "DMA L2T, broadcast dst buffer too small (%ju %lu)\n",
3168                                                                  (uintmax_t)dst_offset + (count * 4), radeon_bo_size(dst_reloc->robj));
3169                                                         return -EINVAL;
3170                                                 }
3171                                                 p->idx += 9;
3172                                                 break;
3173                                         default:
3174                                                 DRM_ERROR("bad DMA_PACKET_COPY misc %u\n", misc);
3175                                                 return -EINVAL;
3176                                         }
3177                                 }
3178                         } else {
3179                                 if (new_cmd) {
3180                                         switch (misc) {
3181                                         case 0:
3182                                                 /* L2L, byte */
3183                                                 src_offset = radeon_get_ib_value(p, idx+2);
3184                                                 src_offset |= ((u64)(radeon_get_ib_value(p, idx+4) & 0xff)) << 32;
3185                                                 dst_offset = radeon_get_ib_value(p, idx+1);
3186                                                 dst_offset |= ((u64)(radeon_get_ib_value(p, idx+3) & 0xff)) << 32;
3187                                                 if ((src_offset + count) > radeon_bo_size(src_reloc->robj)) {
3188                                                         dev_warn(p->dev, "DMA L2L, byte src buffer too small (%ju %lu)\n",
3189                                                                  (uintmax_t)src_offset + count, radeon_bo_size(src_reloc->robj));
3190                                                         return -EINVAL;
3191                                                 }
3192                                                 if ((dst_offset + count) > radeon_bo_size(dst_reloc->robj)) {
3193                                                         dev_warn(p->dev, "DMA L2L, byte dst buffer too small (%ju %lu)\n",
3194                                                                  (uintmax_t)dst_offset + count, radeon_bo_size(dst_reloc->robj));
3195                                                         return -EINVAL;
3196                                                 }
3197                                                 ib[idx+1] += (u32)(dst_reloc->lobj.gpu_offset & 0xffffffff);
3198                                                 ib[idx+2] += (u32)(src_reloc->lobj.gpu_offset & 0xffffffff);
3199                                                 ib[idx+3] += upper_32_bits(dst_reloc->lobj.gpu_offset) & 0xff;
3200                                                 ib[idx+4] += upper_32_bits(src_reloc->lobj.gpu_offset) & 0xff;
3201                                                 p->idx += 5;
3202                                                 break;
3203                                         case 1:
3204                                                 /* L2L, partial */
3205                                                 if (p->family < CHIP_CAYMAN) {
3206                                                         DRM_ERROR("L2L Partial is cayman only !\n");
3207                                                         return -EINVAL;
3208                                                 }
3209                                                 ib[idx+1] += (u32)(src_reloc->lobj.gpu_offset & 0xffffffff);
3210                                                 ib[idx+2] += upper_32_bits(src_reloc->lobj.gpu_offset) & 0xff;
3211                                                 ib[idx+4] += (u32)(dst_reloc->lobj.gpu_offset & 0xffffffff);
3212                                                 ib[idx+5] += upper_32_bits(dst_reloc->lobj.gpu_offset) & 0xff;
3213
3214                                                 p->idx += 9;
3215                                                 break;
3216                                         case 4:
3217                                                 /* L2L, dw, broadcast */
3218                                                 r = r600_dma_cs_next_reloc(p, &dst2_reloc);
3219                                                 if (r) {
3220                                                         DRM_ERROR("bad L2L, dw, broadcast DMA_PACKET_COPY\n");
3221                                                         return -EINVAL;
3222                                                 }
3223                                                 dst_offset = radeon_get_ib_value(p, idx+1);
3224                                                 dst_offset |= ((u64)(radeon_get_ib_value(p, idx+4) & 0xff)) << 32;
3225                                                 dst2_offset = radeon_get_ib_value(p, idx+2);
3226                                                 dst2_offset |= ((u64)(radeon_get_ib_value(p, idx+5) & 0xff)) << 32;
3227                                                 src_offset = radeon_get_ib_value(p, idx+3);
3228                                                 src_offset |= ((u64)(radeon_get_ib_value(p, idx+6) & 0xff)) << 32;
3229                                                 if ((src_offset + (count * 4)) > radeon_bo_size(src_reloc->robj)) {
3230                                                         dev_warn(p->dev, "DMA L2L, dw, broadcast src buffer too small (%ju %lu)\n",
3231                                                                  (uintmax_t)src_offset + (count * 4), radeon_bo_size(src_reloc->robj));
3232                                                         return -EINVAL;
3233                                                 }
3234                                                 if ((dst_offset + (count * 4)) > radeon_bo_size(dst_reloc->robj)) {
3235                                                         dev_warn(p->dev, "DMA L2L, dw, broadcast dst buffer too small (%ju %lu)\n",
3236                                                                  (uintmax_t)dst_offset + (count * 4), radeon_bo_size(dst_reloc->robj));
3237                                                         return -EINVAL;
3238                                                 }
3239                                                 if ((dst2_offset + (count * 4)) > radeon_bo_size(dst2_reloc->robj)) {
3240                                                         dev_warn(p->dev, "DMA L2L, dw, broadcast dst2 buffer too small (%ju %lu)\n",
3241                                                                  (uintmax_t)dst2_offset + (count * 4), radeon_bo_size(dst2_reloc->robj));
3242                                                         return -EINVAL;
3243                                                 }
3244                                                 ib[idx+1] += (u32)(dst_reloc->lobj.gpu_offset & 0xfffffffc);
3245                                                 ib[idx+2] += (u32)(dst2_reloc->lobj.gpu_offset & 0xfffffffc);
3246                                                 ib[idx+3] += (u32)(src_reloc->lobj.gpu_offset & 0xfffffffc);
3247                                                 ib[idx+4] += upper_32_bits(dst_reloc->lobj.gpu_offset) & 0xff;
3248                                                 ib[idx+5] += upper_32_bits(dst2_reloc->lobj.gpu_offset) & 0xff;
3249                                                 ib[idx+6] += upper_32_bits(src_reloc->lobj.gpu_offset) & 0xff;
3250                                                 p->idx += 7;
3251                                                 break;
3252                                         default:
3253                                                 DRM_ERROR("bad DMA_PACKET_COPY misc %u\n", misc);
3254                                                 return -EINVAL;
3255                                         }
3256                                 } else {
3257                                         /* L2L, dw */
3258                                         src_offset = radeon_get_ib_value(p, idx+2);
3259                                         src_offset |= ((u64)(radeon_get_ib_value(p, idx+4) & 0xff)) << 32;
3260                                         dst_offset = radeon_get_ib_value(p, idx+1);
3261                                         dst_offset |= ((u64)(radeon_get_ib_value(p, idx+3) & 0xff)) << 32;
3262                                         if ((src_offset + (count * 4)) > radeon_bo_size(src_reloc->robj)) {
3263                                                 dev_warn(p->dev, "DMA L2L, dw src buffer too small (%ju %lu)\n",
3264                                                          (uintmax_t)src_offset + (count * 4), radeon_bo_size(src_reloc->robj));
3265                                                 return -EINVAL;
3266                                         }
3267                                         if ((dst_offset + (count * 4)) > radeon_bo_size(dst_reloc->robj)) {
3268                                                 dev_warn(p->dev, "DMA L2L, dw dst buffer too small (%ju %lu)\n",
3269                                                          (uintmax_t)dst_offset + (count * 4), radeon_bo_size(dst_reloc->robj));
3270                                                 return -EINVAL;
3271                                         }
3272                                         ib[idx+1] += (u32)(dst_reloc->lobj.gpu_offset & 0xfffffffc);
3273                                         ib[idx+2] += (u32)(src_reloc->lobj.gpu_offset & 0xfffffffc);
3274                                         ib[idx+3] += upper_32_bits(dst_reloc->lobj.gpu_offset) & 0xff;
3275                                         ib[idx+4] += upper_32_bits(src_reloc->lobj.gpu_offset) & 0xff;
3276                                         p->idx += 5;
3277                                 }
3278                         }
3279                         break;
3280                 case DMA_PACKET_CONSTANT_FILL:
3281                         r = r600_dma_cs_next_reloc(p, &dst_reloc);
3282                         if (r) {
3283                                 DRM_ERROR("bad DMA_PACKET_CONSTANT_FILL\n");
3284                                 return -EINVAL;
3285                         }
3286                         dst_offset = radeon_get_ib_value(p, idx+1);
3287                         dst_offset |= ((u64)(radeon_get_ib_value(p, idx+3) & 0x00ff0000)) << 16;
3288                         if ((dst_offset + (count * 4)) > radeon_bo_size(dst_reloc->robj)) {
3289                                 dev_warn(p->dev, "DMA constant fill buffer too small (%ju %lu)\n",
3290                                          (uintmax_t)dst_offset, radeon_bo_size(dst_reloc->robj));
3291                                 return -EINVAL;
3292                         }
3293                         ib[idx+1] += (u32)(dst_reloc->lobj.gpu_offset & 0xfffffffc);
3294                         ib[idx+3] += (upper_32_bits(dst_reloc->lobj.gpu_offset) << 16) & 0x00ff0000;
3295                         p->idx += 4;
3296                         break;
3297                 case DMA_PACKET_NOP:
3298                         p->idx += 1;
3299                         break;
3300                 default:
3301                         DRM_ERROR("Unknown packet type %d at %d !\n", cmd, idx);
3302                         return -EINVAL;
3303                 }
3304         } while (p->idx < p->chunks[p->chunk_ib_idx].length_dw);
3305 #if 0
3306         for (r = 0; r < p->ib->length_dw; r++) {
3307                 DRM_INFO("%05d  0x%08X\n", r, p->ib.ptr[r]);
3308                 mdelay(1);
3309         }
3310 #endif
3311         return 0;
3312 }
3313
3314 /* vm parser */
3315 static bool evergreen_vm_reg_valid(u32 reg)
3316 {
3317         /* context regs are fine */
3318         if (reg >= 0x28000)
3319                 return true;
3320
3321         /* check config regs */
3322         switch (reg) {
3323         case WAIT_UNTIL:
3324         case GRBM_GFX_INDEX:
3325         case CP_STRMOUT_CNTL:
3326         case CP_COHER_CNTL:
3327         case CP_COHER_SIZE:
3328         case VGT_VTX_VECT_EJECT_REG:
3329         case VGT_CACHE_INVALIDATION:
3330         case VGT_GS_VERTEX_REUSE:
3331         case VGT_PRIMITIVE_TYPE:
3332         case VGT_INDEX_TYPE:
3333         case VGT_NUM_INDICES:
3334         case VGT_NUM_INSTANCES:
3335         case VGT_COMPUTE_DIM_X:
3336         case VGT_COMPUTE_DIM_Y:
3337         case VGT_COMPUTE_DIM_Z:
3338         case VGT_COMPUTE_START_X:
3339         case VGT_COMPUTE_START_Y:
3340         case VGT_COMPUTE_START_Z:
3341         case VGT_COMPUTE_INDEX:
3342         case VGT_COMPUTE_THREAD_GROUP_SIZE:
3343         case VGT_HS_OFFCHIP_PARAM:
3344         case PA_CL_ENHANCE:
3345         case PA_SU_LINE_STIPPLE_VALUE:
3346         case PA_SC_LINE_STIPPLE_STATE:
3347         case PA_SC_ENHANCE:
3348         case SQ_DYN_GPR_CNTL_PS_FLUSH_REQ:
3349         case SQ_DYN_GPR_SIMD_LOCK_EN:
3350         case SQ_CONFIG:
3351         case SQ_GPR_RESOURCE_MGMT_1:
3352         case SQ_GLOBAL_GPR_RESOURCE_MGMT_1:
3353         case SQ_GLOBAL_GPR_RESOURCE_MGMT_2:
3354         case SQ_CONST_MEM_BASE:
3355         case SQ_STATIC_THREAD_MGMT_1:
3356         case SQ_STATIC_THREAD_MGMT_2:
3357         case SQ_STATIC_THREAD_MGMT_3:
3358         case SPI_CONFIG_CNTL:
3359         case SPI_CONFIG_CNTL_1:
3360         case TA_CNTL_AUX:
3361         case DB_DEBUG:
3362         case DB_DEBUG2:
3363         case DB_DEBUG3:
3364         case DB_DEBUG4:
3365         case DB_WATERMARKS:
3366         case TD_PS_BORDER_COLOR_INDEX:
3367         case TD_PS_BORDER_COLOR_RED:
3368         case TD_PS_BORDER_COLOR_GREEN:
3369         case TD_PS_BORDER_COLOR_BLUE:
3370         case TD_PS_BORDER_COLOR_ALPHA:
3371         case TD_VS_BORDER_COLOR_INDEX:
3372         case TD_VS_BORDER_COLOR_RED:
3373         case TD_VS_BORDER_COLOR_GREEN:
3374         case TD_VS_BORDER_COLOR_BLUE:
3375         case TD_VS_BORDER_COLOR_ALPHA:
3376         case TD_GS_BORDER_COLOR_INDEX:
3377         case TD_GS_BORDER_COLOR_RED:
3378         case TD_GS_BORDER_COLOR_GREEN:
3379         case TD_GS_BORDER_COLOR_BLUE:
3380         case TD_GS_BORDER_COLOR_ALPHA:
3381         case TD_HS_BORDER_COLOR_INDEX:
3382         case TD_HS_BORDER_COLOR_RED:
3383         case TD_HS_BORDER_COLOR_GREEN:
3384         case TD_HS_BORDER_COLOR_BLUE:
3385         case TD_HS_BORDER_COLOR_ALPHA:
3386         case TD_LS_BORDER_COLOR_INDEX:
3387         case TD_LS_BORDER_COLOR_RED:
3388         case TD_LS_BORDER_COLOR_GREEN:
3389         case TD_LS_BORDER_COLOR_BLUE:
3390         case TD_LS_BORDER_COLOR_ALPHA:
3391         case TD_CS_BORDER_COLOR_INDEX:
3392         case TD_CS_BORDER_COLOR_RED:
3393         case TD_CS_BORDER_COLOR_GREEN:
3394         case TD_CS_BORDER_COLOR_BLUE:
3395         case TD_CS_BORDER_COLOR_ALPHA:
3396         case SQ_ESGS_RING_SIZE:
3397         case SQ_GSVS_RING_SIZE:
3398         case SQ_ESTMP_RING_SIZE:
3399         case SQ_GSTMP_RING_SIZE:
3400         case SQ_HSTMP_RING_SIZE:
3401         case SQ_LSTMP_RING_SIZE:
3402         case SQ_PSTMP_RING_SIZE:
3403         case SQ_VSTMP_RING_SIZE:
3404         case SQ_ESGS_RING_ITEMSIZE:
3405         case SQ_ESTMP_RING_ITEMSIZE:
3406         case SQ_GSTMP_RING_ITEMSIZE:
3407         case SQ_GSVS_RING_ITEMSIZE:
3408         case SQ_GS_VERT_ITEMSIZE:
3409         case SQ_GS_VERT_ITEMSIZE_1:
3410         case SQ_GS_VERT_ITEMSIZE_2:
3411         case SQ_GS_VERT_ITEMSIZE_3:
3412         case SQ_GSVS_RING_OFFSET_1:
3413         case SQ_GSVS_RING_OFFSET_2:
3414         case SQ_GSVS_RING_OFFSET_3:
3415         case SQ_HSTMP_RING_ITEMSIZE:
3416         case SQ_LSTMP_RING_ITEMSIZE:
3417         case SQ_PSTMP_RING_ITEMSIZE:
3418         case SQ_VSTMP_RING_ITEMSIZE:
3419         case VGT_TF_RING_SIZE:
3420         case SQ_ESGS_RING_BASE:
3421         case SQ_GSVS_RING_BASE:
3422         case SQ_ESTMP_RING_BASE:
3423         case SQ_GSTMP_RING_BASE:
3424         case SQ_HSTMP_RING_BASE:
3425         case SQ_LSTMP_RING_BASE:
3426         case SQ_PSTMP_RING_BASE:
3427         case SQ_VSTMP_RING_BASE:
3428         case CAYMAN_VGT_OFFCHIP_LDS_BASE:
3429         case CAYMAN_SQ_EX_ALLOC_TABLE_SLOTS:
3430                 return true;
3431         default:
3432                 DRM_ERROR("Invalid register 0x%x in CS\n", reg);
3433                 return false;
3434         }
3435 }
3436
3437 static int evergreen_vm_packet3_check(struct radeon_device *rdev,
3438                                       u32 *ib, struct radeon_cs_packet *pkt)
3439 {
3440         u32 idx = pkt->idx + 1;
3441         u32 idx_value = ib[idx];
3442         u32 start_reg, end_reg, reg, i;
3443         u32 command, info;
3444
3445         switch (pkt->opcode) {
3446         case PACKET3_NOP:
3447         case PACKET3_SET_BASE:
3448         case PACKET3_CLEAR_STATE:
3449         case PACKET3_INDEX_BUFFER_SIZE:
3450         case PACKET3_DISPATCH_DIRECT:
3451         case PACKET3_DISPATCH_INDIRECT:
3452         case PACKET3_MODE_CONTROL:
3453         case PACKET3_SET_PREDICATION:
3454         case PACKET3_COND_EXEC:
3455         case PACKET3_PRED_EXEC:
3456         case PACKET3_DRAW_INDIRECT:
3457         case PACKET3_DRAW_INDEX_INDIRECT:
3458         case PACKET3_INDEX_BASE:
3459         case PACKET3_DRAW_INDEX_2:
3460         case PACKET3_CONTEXT_CONTROL:
3461         case PACKET3_DRAW_INDEX_OFFSET:
3462         case PACKET3_INDEX_TYPE:
3463         case PACKET3_DRAW_INDEX:
3464         case PACKET3_DRAW_INDEX_AUTO:
3465         case PACKET3_DRAW_INDEX_IMMD:
3466         case PACKET3_NUM_INSTANCES:
3467         case PACKET3_DRAW_INDEX_MULTI_AUTO:
3468         case PACKET3_STRMOUT_BUFFER_UPDATE:
3469         case PACKET3_DRAW_INDEX_OFFSET_2:
3470         case PACKET3_DRAW_INDEX_MULTI_ELEMENT:
3471         case PACKET3_MPEG_INDEX:
3472         case PACKET3_WAIT_REG_MEM:
3473         case PACKET3_MEM_WRITE:
3474         case PACKET3_SURFACE_SYNC:
3475         case PACKET3_EVENT_WRITE:
3476         case PACKET3_EVENT_WRITE_EOP:
3477         case PACKET3_EVENT_WRITE_EOS:
3478         case PACKET3_SET_CONTEXT_REG:
3479         case PACKET3_SET_BOOL_CONST:
3480         case PACKET3_SET_LOOP_CONST:
3481         case PACKET3_SET_RESOURCE:
3482         case PACKET3_SET_SAMPLER:
3483         case PACKET3_SET_CTL_CONST:
3484         case PACKET3_SET_RESOURCE_OFFSET:
3485         case PACKET3_SET_CONTEXT_REG_INDIRECT:
3486         case PACKET3_SET_RESOURCE_INDIRECT:
3487         case CAYMAN_PACKET3_DEALLOC_STATE:
3488                 break;
3489         case PACKET3_COND_WRITE:
3490                 if (idx_value & 0x100) {
3491                         reg = ib[idx + 5] * 4;
3492                         if (!evergreen_vm_reg_valid(reg))
3493                                 return -EINVAL;
3494                 }
3495                 break;
3496         case PACKET3_COPY_DW:
3497                 if (idx_value & 0x2) {
3498                         reg = ib[idx + 3] * 4;
3499                         if (!evergreen_vm_reg_valid(reg))
3500                                 return -EINVAL;
3501                 }
3502                 break;
3503         case PACKET3_SET_CONFIG_REG:
3504                 start_reg = (idx_value << 2) + PACKET3_SET_CONFIG_REG_START;
3505                 end_reg = 4 * pkt->count + start_reg - 4;
3506                 if ((start_reg < PACKET3_SET_CONFIG_REG_START) ||
3507                     (start_reg >= PACKET3_SET_CONFIG_REG_END) ||
3508                     (end_reg >= PACKET3_SET_CONFIG_REG_END)) {
3509                         DRM_ERROR("bad PACKET3_SET_CONFIG_REG\n");
3510                         return -EINVAL;
3511                 }
3512                 for (i = 0; i < pkt->count; i++) {
3513                         reg = start_reg + (4 * i);
3514                         if (!evergreen_vm_reg_valid(reg))
3515                                 return -EINVAL;
3516                 }
3517                 break;
3518         case PACKET3_CP_DMA:
3519                 command = ib[idx + 4];
3520                 info = ib[idx + 1];
3521                 if ((((info & 0x60000000) >> 29) != 0) || /* src = GDS or DATA */
3522                     (((info & 0x00300000) >> 20) != 0) || /* dst = GDS */
3523                     ((((info & 0x00300000) >> 20) == 0) &&
3524                      (command & PACKET3_CP_DMA_CMD_DAS)) || /* dst = register */
3525                     ((((info & 0x60000000) >> 29) == 0) &&
3526                      (command & PACKET3_CP_DMA_CMD_SAS))) { /* src = register */
3527                         /* non mem to mem copies requires dw aligned count */
3528                         if ((command & 0x1fffff) % 4) {
3529                                 DRM_ERROR("CP DMA command requires dw count alignment\n");
3530                                 return -EINVAL;
3531                         }
3532                 }
3533                 if (command & PACKET3_CP_DMA_CMD_SAS) {
3534                         /* src address space is register */
3535                         if (((info & 0x60000000) >> 29) == 0) {
3536                                 start_reg = idx_value << 2;
3537                                 if (command & PACKET3_CP_DMA_CMD_SAIC) {
3538                                         reg = start_reg;
3539                                         if (!evergreen_vm_reg_valid(reg)) {
3540                                                 DRM_ERROR("CP DMA Bad SRC register\n");
3541                                                 return -EINVAL;
3542                                         }
3543                                 } else {
3544                                         for (i = 0; i < (command & 0x1fffff); i++) {
3545                                                 reg = start_reg + (4 * i);
3546                                                 if (!evergreen_vm_reg_valid(reg)) {
3547                                                         DRM_ERROR("CP DMA Bad SRC register\n");
3548                                                         return -EINVAL;
3549                                                 }
3550                                         }
3551                                 }
3552                         }
3553                 }
3554                 if (command & PACKET3_CP_DMA_CMD_DAS) {
3555                         /* dst address space is register */
3556                         if (((info & 0x00300000) >> 20) == 0) {
3557                                 start_reg = ib[idx + 2];
3558                                 if (command & PACKET3_CP_DMA_CMD_DAIC) {
3559                                         reg = start_reg;
3560                                         if (!evergreen_vm_reg_valid(reg)) {
3561                                                 DRM_ERROR("CP DMA Bad DST register\n");
3562                                                 return -EINVAL;
3563                                         }
3564                                 } else {
3565                                         for (i = 0; i < (command & 0x1fffff); i++) {
3566                                                 reg = start_reg + (4 * i);
3567                                                 if (!evergreen_vm_reg_valid(reg)) {
3568                                                         DRM_ERROR("CP DMA Bad DST register\n");
3569                                                         return -EINVAL;
3570                                                 }
3571                                         }
3572                                 }
3573                         }
3574                 }
3575                 break;
3576         default:
3577                 return -EINVAL;
3578         }
3579         return 0;
3580 }
3581
3582 int evergreen_ib_parse(struct radeon_device *rdev, struct radeon_ib *ib)
3583 {
3584         int ret = 0;
3585         u32 idx = 0;
3586         struct radeon_cs_packet pkt;
3587
3588         do {
3589                 pkt.idx = idx;
3590                 pkt.type = CP_PACKET_GET_TYPE(ib->ptr[idx]);
3591                 pkt.count = CP_PACKET_GET_COUNT(ib->ptr[idx]);
3592                 pkt.one_reg_wr = 0;
3593                 switch (pkt.type) {
3594                 case PACKET_TYPE0:
3595                         dev_err(rdev->dev, "Packet0 not allowed!\n");
3596                         ret = -EINVAL;
3597                         break;
3598                 case PACKET_TYPE2:
3599                         idx += 1;
3600                         break;
3601                 case PACKET_TYPE3:
3602                         pkt.opcode = CP_PACKET3_GET_OPCODE(ib->ptr[idx]);
3603                         ret = evergreen_vm_packet3_check(rdev, ib->ptr, &pkt);
3604                         idx += pkt.count + 2;
3605                         break;
3606                 default:
3607                         dev_err(rdev->dev, "Unknown packet type %d !\n", pkt.type);
3608                         ret = -EINVAL;
3609                         break;
3610                 }
3611                 if (ret)
3612                         break;
3613         } while (idx < ib->length_dw);
3614
3615         return ret;
3616 }
3617
3618 /**
3619  * evergreen_dma_ib_parse() - parse the DMA IB for VM
3620  * @rdev: radeon_device pointer
3621  * @ib: radeon_ib pointer
3622  *
3623  * Parses the DMA IB from the VM CS ioctl
3624  * checks for errors. (Cayman-SI)
3625  * Returns 0 for success and an error on failure.
3626  **/
3627 int evergreen_dma_ib_parse(struct radeon_device *rdev, struct radeon_ib *ib)
3628 {
3629         u32 idx = 0;
3630         u32 header, cmd, count, tiled, new_cmd, misc;
3631
3632         do {
3633                 header = ib->ptr[idx];
3634                 cmd = GET_DMA_CMD(header);
3635                 count = GET_DMA_COUNT(header);
3636                 tiled = GET_DMA_T(header);
3637                 new_cmd = GET_DMA_NEW(header);
3638                 misc = GET_DMA_MISC(header);
3639
3640                 switch (cmd) {
3641                 case DMA_PACKET_WRITE:
3642                         if (tiled)
3643                                 idx += count + 7;
3644                         else
3645                                 idx += count + 3;
3646                         break;
3647                 case DMA_PACKET_COPY:
3648                         if (tiled) {
3649                                 if (new_cmd) {
3650                                         switch (misc) {
3651                                         case 0:
3652                                                 /* L2T, frame to fields */
3653                                                 idx += 10;
3654                                                 break;
3655                                         case 1:
3656                                                 /* L2T, T2L partial */
3657                                                 idx += 12;
3658                                                 break;
3659                                         case 3:
3660                                                 /* L2T, broadcast */
3661                                                 idx += 10;
3662                                                 break;
3663                                         case 4:
3664                                                 /* L2T, T2L */
3665                                                 idx += 9;
3666                                                 break;
3667                                         case 5:
3668                                                 /* T2T partial */
3669                                                 idx += 13;
3670                                                 break;
3671                                         case 7:
3672                                                 /* L2T, broadcast */
3673                                                 idx += 10;
3674                                                 break;
3675                                         default:
3676                                                 DRM_ERROR("bad DMA_PACKET_COPY misc %u\n", misc);
3677                                                 return -EINVAL;
3678                                         }
3679                                 } else {
3680                                         switch (misc) {
3681                                         case 0:
3682                                                 idx += 9;
3683                                                 break;
3684                                         default:
3685                                                 DRM_ERROR("bad DMA_PACKET_COPY misc %u\n", misc);
3686                                                 return -EINVAL;
3687                                         }
3688                                 }
3689                         } else {
3690                                 if (new_cmd) {
3691                                         switch (misc) {
3692                                         case 0:
3693                                                 /* L2L, byte */
3694                                                 idx += 5;
3695                                                 break;
3696                                         case 1:
3697                                                 /* L2L, partial */
3698                                                 idx += 9;
3699                                                 break;
3700                                         case 4:
3701                                                 /* L2L, dw, broadcast */
3702                                                 idx += 7;
3703                                                 break;
3704                                         default:
3705                                                 DRM_ERROR("bad DMA_PACKET_COPY misc %u\n", misc);
3706                                                 return -EINVAL;
3707                                         }
3708                                 } else {
3709                                         /* L2L, dw */
3710                                         idx += 5;
3711                                 }
3712                         }
3713                         break;
3714                 case DMA_PACKET_CONSTANT_FILL:
3715                         idx += 4;
3716                         break;
3717                 case DMA_PACKET_NOP:
3718                         idx += 1;
3719                         break;
3720                 default:
3721                         DRM_ERROR("Unknown packet type %d at %d !\n", cmd, idx);
3722                         return -EINVAL;
3723                 }
3724         } while (idx < ib->length_dw);
3725
3726         return 0;
3727 }