Commit | Line | Data |
---|---|---|
414ed537 DA |
1 | /* r300_cmdbuf.c -- Command buffer emission for R300 -*- linux-c -*- |
2 | * | |
3 | * Copyright (C) The Weather Channel, Inc. 2002. | |
4 | * Copyright (C) 2004 Nicolai Haehnle. | |
5 | * All Rights Reserved. | |
6 | * | |
7 | * The Weather Channel (TM) funded Tungsten Graphics to develop the | |
8 | * initial release of the Radeon 8500 driver under the XFree86 license. | |
9 | * This notice must be preserved. | |
10 | * | |
11 | * Permission is hereby granted, free of charge, to any person obtaining a | |
12 | * copy of this software and associated documentation files (the "Software"), | |
13 | * to deal in the Software without restriction, including without limitation | |
14 | * the rights to use, copy, modify, merge, publish, distribute, sublicense, | |
15 | * and/or sell copies of the Software, and to permit persons to whom the | |
16 | * Software is furnished to do so, subject to the following conditions: | |
17 | * | |
18 | * The above copyright notice and this permission notice (including the next | |
19 | * paragraph) shall be included in all copies or substantial portions of the | |
20 | * Software. | |
21 | * | |
22 | * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR | |
23 | * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, | |
24 | * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL | |
25 | * PRECISION INSIGHT AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM, DAMAGES OR | |
26 | * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, | |
27 | * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER | |
28 | * DEALINGS IN THE SOFTWARE. | |
29 | * | |
30 | * Authors: | |
31 | * Nicolai Haehnle <prefect_@gmx.net> | |
32 | */ | |
33 | ||
34 | #include "drmP.h" | |
35 | #include "drm.h" | |
36 | #include "radeon_drm.h" | |
37 | #include "radeon_drv.h" | |
38 | #include "r300_reg.h" | |
39 | ||
414ed537 DA |
40 | #define R300_SIMULTANEOUS_CLIPRECTS 4 |
41 | ||
42 | /* Values for R300_RE_CLIPRECT_CNTL depending on the number of cliprects | |
43 | */ | |
44 | static const int r300_cliprect_cntl[4] = { | |
45 | 0xAAAA, | |
46 | 0xEEEE, | |
47 | 0xFEFE, | |
48 | 0xFFFE | |
49 | }; | |
50 | ||
414ed537 DA |
51 | /** |
52 | * Emit up to R300_SIMULTANEOUS_CLIPRECTS cliprects from the given command | |
53 | * buffer, starting with index n. | |
54 | */ | |
d985c108 DA |
55 | static int r300_emit_cliprects(drm_radeon_private_t *dev_priv, |
56 | drm_radeon_kcmd_buffer_t *cmdbuf, int n) | |
414ed537 DA |
57 | { |
58 | drm_clip_rect_t box; | |
59 | int nr; | |
60 | int i; | |
61 | RING_LOCALS; | |
62 | ||
63 | nr = cmdbuf->nbox - n; | |
64 | if (nr > R300_SIMULTANEOUS_CLIPRECTS) | |
65 | nr = R300_SIMULTANEOUS_CLIPRECTS; | |
66 | ||
67 | DRM_DEBUG("%i cliprects\n", nr); | |
68 | ||
69 | if (nr) { | |
b5e89ed5 DA |
70 | BEGIN_RING(6 + nr * 2); |
71 | OUT_RING(CP_PACKET0(R300_RE_CLIPRECT_TL_0, nr * 2 - 1)); | |
414ed537 | 72 | |
b5e89ed5 DA |
73 | for (i = 0; i < nr; ++i) { |
74 | if (DRM_COPY_FROM_USER_UNCHECKED | |
75 | (&box, &cmdbuf->boxes[n + i], sizeof(box))) { | |
414ed537 DA |
76 | DRM_ERROR("copy cliprect faulted\n"); |
77 | return DRM_ERR(EFAULT); | |
78 | } | |
79 | ||
b5e89ed5 DA |
80 | box.x1 = |
81 | (box.x1 + | |
82 | R300_CLIPRECT_OFFSET) & R300_CLIPRECT_MASK; | |
83 | box.y1 = | |
84 | (box.y1 + | |
85 | R300_CLIPRECT_OFFSET) & R300_CLIPRECT_MASK; | |
86 | box.x2 = | |
87 | (box.x2 + | |
88 | R300_CLIPRECT_OFFSET) & R300_CLIPRECT_MASK; | |
89 | box.y2 = | |
90 | (box.y2 + | |
91 | R300_CLIPRECT_OFFSET) & R300_CLIPRECT_MASK; | |
414ed537 DA |
92 | |
93 | OUT_RING((box.x1 << R300_CLIPRECT_X_SHIFT) | | |
b5e89ed5 | 94 | (box.y1 << R300_CLIPRECT_Y_SHIFT)); |
414ed537 | 95 | OUT_RING((box.x2 << R300_CLIPRECT_X_SHIFT) | |
b5e89ed5 | 96 | (box.y2 << R300_CLIPRECT_Y_SHIFT)); |
414ed537 DA |
97 | } |
98 | ||
b5e89ed5 | 99 | OUT_RING_REG(R300_RE_CLIPRECT_CNTL, r300_cliprect_cntl[nr - 1]); |
414ed537 DA |
100 | |
101 | /* TODO/SECURITY: Force scissors to a safe value, otherwise the | |
b5e89ed5 DA |
102 | * client might be able to trample over memory. |
103 | * The impact should be very limited, but I'd rather be safe than | |
104 | * sorry. | |
105 | */ | |
106 | OUT_RING(CP_PACKET0(R300_RE_SCISSORS_TL, 1)); | |
107 | OUT_RING(0); | |
108 | OUT_RING(R300_SCISSORS_X_MASK | R300_SCISSORS_Y_MASK); | |
414ed537 | 109 | ADVANCE_RING(); |
b5e89ed5 | 110 | } else { |
414ed537 DA |
111 | /* Why we allow zero cliprect rendering: |
112 | * There are some commands in a command buffer that must be submitted | |
113 | * even when there are no cliprects, e.g. DMA buffer discard | |
114 | * or state setting (though state setting could be avoided by | |
115 | * simulating a loss of context). | |
116 | * | |
117 | * Now since the cmdbuf interface is so chaotic right now (and is | |
118 | * bound to remain that way for a bit until things settle down), | |
119 | * it is basically impossible to filter out the commands that are | |
120 | * necessary and those that aren't. | |
121 | * | |
122 | * So I choose the safe way and don't do any filtering at all; | |
123 | * instead, I simply set up the engine so that all rendering | |
124 | * can't produce any fragments. | |
125 | */ | |
126 | BEGIN_RING(2); | |
b5e89ed5 | 127 | OUT_RING_REG(R300_RE_CLIPRECT_CNTL, 0); |
414ed537 | 128 | ADVANCE_RING(); |
b5e89ed5 | 129 | } |
414ed537 DA |
130 | |
131 | return 0; | |
132 | } | |
133 | ||
b3a83639 | 134 | static u8 r300_reg_flags[0x10000 >> 2]; |
414ed537 DA |
135 | |
136 | void r300_init_reg_flags(void) | |
137 | { | |
138 | int i; | |
b5e89ed5 DA |
139 | memset(r300_reg_flags, 0, 0x10000 >> 2); |
140 | #define ADD_RANGE_MARK(reg, count,mark) \ | |
414ed537 DA |
141 | for(i=((reg)>>2);i<((reg)>>2)+(count);i++)\ |
142 | r300_reg_flags[i]|=(mark); | |
b5e89ed5 DA |
143 | |
144 | #define MARK_SAFE 1 | |
145 | #define MARK_CHECK_OFFSET 2 | |
146 | ||
147 | #define ADD_RANGE(reg, count) ADD_RANGE_MARK(reg, count, MARK_SAFE) | |
414ed537 DA |
148 | |
149 | /* these match cmducs() command in r300_driver/r300/r300_cmdbuf.c */ | |
150 | ADD_RANGE(R300_SE_VPORT_XSCALE, 6); | |
151 | ADD_RANGE(0x2080, 1); | |
152 | ADD_RANGE(R300_SE_VTE_CNTL, 2); | |
153 | ADD_RANGE(0x2134, 2); | |
154 | ADD_RANGE(0x2140, 1); | |
155 | ADD_RANGE(R300_VAP_INPUT_CNTL_0, 2); | |
156 | ADD_RANGE(0x21DC, 1); | |
157 | ADD_RANGE(0x221C, 1); | |
158 | ADD_RANGE(0x2220, 4); | |
159 | ADD_RANGE(0x2288, 1); | |
160 | ADD_RANGE(R300_VAP_OUTPUT_VTX_FMT_0, 2); | |
161 | ADD_RANGE(R300_VAP_PVS_CNTL_1, 3); | |
162 | ADD_RANGE(R300_GB_ENABLE, 1); | |
163 | ADD_RANGE(R300_GB_MSPOS0, 5); | |
4e5e2e25 | 164 | ADD_RANGE(R300_TX_CNTL, 1); |
414ed537 DA |
165 | ADD_RANGE(R300_TX_ENABLE, 1); |
166 | ADD_RANGE(0x4200, 4); | |
167 | ADD_RANGE(0x4214, 1); | |
168 | ADD_RANGE(R300_RE_POINTSIZE, 1); | |
169 | ADD_RANGE(0x4230, 3); | |
170 | ADD_RANGE(R300_RE_LINE_CNT, 1); | |
171 | ADD_RANGE(0x4238, 1); | |
172 | ADD_RANGE(0x4260, 3); | |
173 | ADD_RANGE(0x4274, 4); | |
174 | ADD_RANGE(0x4288, 5); | |
175 | ADD_RANGE(0x42A0, 1); | |
176 | ADD_RANGE(R300_RE_ZBIAS_T_FACTOR, 4); | |
177 | ADD_RANGE(0x42B4, 1); | |
178 | ADD_RANGE(R300_RE_CULL_CNTL, 1); | |
179 | ADD_RANGE(0x42C0, 2); | |
180 | ADD_RANGE(R300_RS_CNTL_0, 2); | |
181 | ADD_RANGE(R300_RS_INTERP_0, 8); | |
182 | ADD_RANGE(R300_RS_ROUTE_0, 8); | |
183 | ADD_RANGE(0x43A4, 2); | |
184 | ADD_RANGE(0x43E8, 1); | |
185 | ADD_RANGE(R300_PFS_CNTL_0, 3); | |
186 | ADD_RANGE(R300_PFS_NODE_0, 4); | |
187 | ADD_RANGE(R300_PFS_TEXI_0, 64); | |
188 | ADD_RANGE(0x46A4, 5); | |
189 | ADD_RANGE(R300_PFS_INSTR0_0, 64); | |
190 | ADD_RANGE(R300_PFS_INSTR1_0, 64); | |
191 | ADD_RANGE(R300_PFS_INSTR2_0, 64); | |
192 | ADD_RANGE(R300_PFS_INSTR3_0, 64); | |
193 | ADD_RANGE(0x4BC0, 1); | |
194 | ADD_RANGE(0x4BC8, 3); | |
195 | ADD_RANGE(R300_PP_ALPHA_TEST, 2); | |
196 | ADD_RANGE(0x4BD8, 1); | |
197 | ADD_RANGE(R300_PFS_PARAM_0_X, 64); | |
198 | ADD_RANGE(0x4E00, 1); | |
199 | ADD_RANGE(R300_RB3D_CBLEND, 2); | |
200 | ADD_RANGE(R300_RB3D_COLORMASK, 1); | |
201 | ADD_RANGE(0x4E10, 3); | |
b5e89ed5 | 202 | ADD_RANGE_MARK(R300_RB3D_COLOROFFSET0, 1, MARK_CHECK_OFFSET); /* check offset */ |
414ed537 DA |
203 | ADD_RANGE(R300_RB3D_COLORPITCH0, 1); |
204 | ADD_RANGE(0x4E50, 9); | |
205 | ADD_RANGE(0x4E88, 1); | |
206 | ADD_RANGE(0x4EA0, 2); | |
207 | ADD_RANGE(R300_RB3D_ZSTENCIL_CNTL_0, 3); | |
208 | ADD_RANGE(0x4F10, 4); | |
b5e89ed5 DA |
209 | ADD_RANGE_MARK(R300_RB3D_DEPTHOFFSET, 1, MARK_CHECK_OFFSET); /* check offset */ |
210 | ADD_RANGE(R300_RB3D_DEPTHPITCH, 1); | |
414ed537 DA |
211 | ADD_RANGE(0x4F28, 1); |
212 | ADD_RANGE(0x4F30, 2); | |
213 | ADD_RANGE(0x4F44, 1); | |
214 | ADD_RANGE(0x4F54, 1); | |
215 | ||
216 | ADD_RANGE(R300_TX_FILTER_0, 16); | |
45f17100 | 217 | ADD_RANGE(R300_TX_FILTER1_0, 16); |
414ed537 DA |
218 | ADD_RANGE(R300_TX_SIZE_0, 16); |
219 | ADD_RANGE(R300_TX_FORMAT_0, 16); | |
d985c108 | 220 | ADD_RANGE(R300_TX_PITCH_0, 16); |
b5e89ed5 | 221 | /* Texture offset is dangerous and needs more checking */ |
414ed537 | 222 | ADD_RANGE_MARK(R300_TX_OFFSET_0, 16, MARK_CHECK_OFFSET); |
45f17100 | 223 | ADD_RANGE(R300_TX_CHROMA_KEY_0, 16); |
414ed537 DA |
224 | ADD_RANGE(R300_TX_BORDER_COLOR_0, 16); |
225 | ||
226 | /* Sporadic registers used as primitives are emitted */ | |
227 | ADD_RANGE(0x4f18, 1); | |
228 | ADD_RANGE(R300_RB3D_DSTCACHE_CTLSTAT, 1); | |
229 | ADD_RANGE(R300_VAP_INPUT_ROUTE_0_0, 8); | |
230 | ADD_RANGE(R300_VAP_INPUT_ROUTE_1_0, 8); | |
231 | ||
232 | } | |
233 | ||
b5e89ed5 | 234 | static __inline__ int r300_check_range(unsigned reg, int count) |
414ed537 DA |
235 | { |
236 | int i; | |
b5e89ed5 DA |
237 | if (reg & ~0xffff) |
238 | return -1; | |
239 | for (i = (reg >> 2); i < (reg >> 2) + count; i++) | |
240 | if (r300_reg_flags[i] != MARK_SAFE) | |
241 | return 1; | |
414ed537 DA |
242 | return 0; |
243 | } | |
244 | ||
d5ea702f DA |
245 | /* |
246 | * we expect offsets passed to the framebuffer to be either within video | |
247 | * memory or within AGP space | |
248 | */ | |
d985c108 | 249 | static __inline__ int r300_check_offset(drm_radeon_private_t *dev_priv, |
b5e89ed5 | 250 | u32 offset) |
414ed537 DA |
251 | { |
252 | /* we realy want to check against end of video aperture | |
b5e89ed5 DA |
253 | but this value is not being kept. |
254 | This code is correct for now (does the same thing as the | |
255 | code that sets MC_FB_LOCATION) in radeon_cp.c */ | |
d5ea702f DA |
256 | if (offset >= dev_priv->fb_location && |
257 | offset < (dev_priv->fb_location + dev_priv->fb_size)) | |
b5e89ed5 | 258 | return 0; |
d5ea702f DA |
259 | if (offset >= dev_priv->gart_vm_start && |
260 | offset < (dev_priv->gart_vm_start + dev_priv->gart_size)) | |
b5e89ed5 | 261 | return 0; |
414ed537 DA |
262 | return 1; |
263 | } | |
264 | ||
b5e89ed5 DA |
265 | static __inline__ int r300_emit_carefully_checked_packet0(drm_radeon_private_t * |
266 | dev_priv, | |
b3a83639 | 267 | drm_radeon_kcmd_buffer_t |
b5e89ed5 DA |
268 | * cmdbuf, |
269 | drm_r300_cmd_header_t | |
270 | header) | |
414ed537 DA |
271 | { |
272 | int reg; | |
273 | int sz; | |
274 | int i; | |
275 | int values[64]; | |
276 | RING_LOCALS; | |
277 | ||
278 | sz = header.packet0.count; | |
279 | reg = (header.packet0.reghi << 8) | header.packet0.reglo; | |
b5e89ed5 DA |
280 | |
281 | if ((sz > 64) || (sz < 0)) { | |
282 | DRM_ERROR | |
283 | ("Cannot emit more than 64 values at a time (reg=%04x sz=%d)\n", | |
284 | reg, sz); | |
414ed537 | 285 | return DRM_ERR(EINVAL); |
b5e89ed5 DA |
286 | } |
287 | for (i = 0; i < sz; i++) { | |
b3a83639 | 288 | values[i] = ((int *)cmdbuf->buf)[i]; |
b5e89ed5 | 289 | switch (r300_reg_flags[(reg >> 2) + i]) { |
414ed537 DA |
290 | case MARK_SAFE: |
291 | break; | |
292 | case MARK_CHECK_OFFSET: | |
b5e89ed5 DA |
293 | if (r300_check_offset(dev_priv, (u32) values[i])) { |
294 | DRM_ERROR | |
295 | ("Offset failed range check (reg=%04x sz=%d)\n", | |
296 | reg, sz); | |
414ed537 | 297 | return DRM_ERR(EINVAL); |
b5e89ed5 | 298 | } |
414ed537 DA |
299 | break; |
300 | default: | |
b5e89ed5 DA |
301 | DRM_ERROR("Register %04x failed check as flag=%02x\n", |
302 | reg + i * 4, r300_reg_flags[(reg >> 2) + i]); | |
414ed537 | 303 | return DRM_ERR(EINVAL); |
414ed537 | 304 | } |
b5e89ed5 DA |
305 | } |
306 | ||
307 | BEGIN_RING(1 + sz); | |
308 | OUT_RING(CP_PACKET0(reg, sz - 1)); | |
309 | OUT_RING_TABLE(values, sz); | |
414ed537 DA |
310 | ADVANCE_RING(); |
311 | ||
b5e89ed5 DA |
312 | cmdbuf->buf += sz * 4; |
313 | cmdbuf->bufsz -= sz * 4; | |
414ed537 DA |
314 | |
315 | return 0; | |
316 | } | |
317 | ||
318 | /** | |
319 | * Emits a packet0 setting arbitrary registers. | |
320 | * Called by r300_do_cp_cmdbuf. | |
321 | * | |
322 | * Note that checks are performed on contents and addresses of the registers | |
323 | */ | |
d985c108 DA |
324 | static __inline__ int r300_emit_packet0(drm_radeon_private_t *dev_priv, |
325 | drm_radeon_kcmd_buffer_t *cmdbuf, | |
b5e89ed5 | 326 | drm_r300_cmd_header_t header) |
414ed537 DA |
327 | { |
328 | int reg; | |
329 | int sz; | |
330 | RING_LOCALS; | |
331 | ||
332 | sz = header.packet0.count; | |
333 | reg = (header.packet0.reghi << 8) | header.packet0.reglo; | |
334 | ||
335 | if (!sz) | |
336 | return 0; | |
337 | ||
b5e89ed5 | 338 | if (sz * 4 > cmdbuf->bufsz) |
414ed537 | 339 | return DRM_ERR(EINVAL); |
b5e89ed5 DA |
340 | |
341 | if (reg + sz * 4 >= 0x10000) { | |
342 | DRM_ERROR("No such registers in hardware reg=%04x sz=%d\n", reg, | |
343 | sz); | |
414ed537 | 344 | return DRM_ERR(EINVAL); |
b5e89ed5 | 345 | } |
414ed537 | 346 | |
b5e89ed5 | 347 | if (r300_check_range(reg, sz)) { |
414ed537 | 348 | /* go and check everything */ |
b5e89ed5 DA |
349 | return r300_emit_carefully_checked_packet0(dev_priv, cmdbuf, |
350 | header); | |
351 | } | |
414ed537 DA |
352 | /* the rest of the data is safe to emit, whatever the values the user passed */ |
353 | ||
b5e89ed5 DA |
354 | BEGIN_RING(1 + sz); |
355 | OUT_RING(CP_PACKET0(reg, sz - 1)); | |
b3a83639 | 356 | OUT_RING_TABLE((int *)cmdbuf->buf, sz); |
414ed537 DA |
357 | ADVANCE_RING(); |
358 | ||
b5e89ed5 DA |
359 | cmdbuf->buf += sz * 4; |
360 | cmdbuf->bufsz -= sz * 4; | |
414ed537 DA |
361 | |
362 | return 0; | |
363 | } | |
364 | ||
414ed537 DA |
365 | /** |
366 | * Uploads user-supplied vertex program instructions or parameters onto | |
367 | * the graphics card. | |
368 | * Called by r300_do_cp_cmdbuf. | |
369 | */ | |
d985c108 DA |
370 | static __inline__ int r300_emit_vpu(drm_radeon_private_t *dev_priv, |
371 | drm_radeon_kcmd_buffer_t *cmdbuf, | |
414ed537 DA |
372 | drm_r300_cmd_header_t header) |
373 | { | |
374 | int sz; | |
375 | int addr; | |
376 | RING_LOCALS; | |
377 | ||
378 | sz = header.vpu.count; | |
379 | addr = (header.vpu.adrhi << 8) | header.vpu.adrlo; | |
380 | ||
381 | if (!sz) | |
382 | return 0; | |
b5e89ed5 | 383 | if (sz * 16 > cmdbuf->bufsz) |
414ed537 DA |
384 | return DRM_ERR(EINVAL); |
385 | ||
b5e89ed5 | 386 | BEGIN_RING(5 + sz * 4); |
414ed537 DA |
387 | /* Wait for VAP to come to senses.. */ |
388 | /* there is no need to emit it multiple times, (only once before VAP is programmed, | |
389 | but this optimization is for later */ | |
b5e89ed5 DA |
390 | OUT_RING_REG(R300_VAP_PVS_WAITIDLE, 0); |
391 | OUT_RING_REG(R300_VAP_PVS_UPLOAD_ADDRESS, addr); | |
392 | OUT_RING(CP_PACKET0_TABLE(R300_VAP_PVS_UPLOAD_DATA, sz * 4 - 1)); | |
b3a83639 | 393 | OUT_RING_TABLE((int *)cmdbuf->buf, sz * 4); |
414ed537 DA |
394 | |
395 | ADVANCE_RING(); | |
396 | ||
b5e89ed5 DA |
397 | cmdbuf->buf += sz * 16; |
398 | cmdbuf->bufsz -= sz * 16; | |
414ed537 DA |
399 | |
400 | return 0; | |
401 | } | |
402 | ||
414ed537 DA |
403 | /** |
404 | * Emit a clear packet from userspace. | |
405 | * Called by r300_emit_packet3. | |
406 | */ | |
d985c108 DA |
407 | static __inline__ int r300_emit_clear(drm_radeon_private_t *dev_priv, |
408 | drm_radeon_kcmd_buffer_t *cmdbuf) | |
414ed537 DA |
409 | { |
410 | RING_LOCALS; | |
411 | ||
b5e89ed5 | 412 | if (8 * 4 > cmdbuf->bufsz) |
414ed537 DA |
413 | return DRM_ERR(EINVAL); |
414 | ||
415 | BEGIN_RING(10); | |
b5e89ed5 DA |
416 | OUT_RING(CP_PACKET3(R200_3D_DRAW_IMMD_2, 8)); |
417 | OUT_RING(R300_PRIM_TYPE_POINT | R300_PRIM_WALK_RING | | |
418 | (1 << R300_PRIM_NUM_VERTICES_SHIFT)); | |
b3a83639 | 419 | OUT_RING_TABLE((int *)cmdbuf->buf, 8); |
414ed537 DA |
420 | ADVANCE_RING(); |
421 | ||
b5e89ed5 DA |
422 | cmdbuf->buf += 8 * 4; |
423 | cmdbuf->bufsz -= 8 * 4; | |
414ed537 DA |
424 | |
425 | return 0; | |
426 | } | |
427 | ||
d985c108 DA |
428 | static __inline__ int r300_emit_3d_load_vbpntr(drm_radeon_private_t *dev_priv, |
429 | drm_radeon_kcmd_buffer_t *cmdbuf, | |
b5e89ed5 | 430 | u32 header) |
414ed537 | 431 | { |
b5e89ed5 DA |
432 | int count, i, k; |
433 | #define MAX_ARRAY_PACKET 64 | |
414ed537 DA |
434 | u32 payload[MAX_ARRAY_PACKET]; |
435 | u32 narrays; | |
436 | RING_LOCALS; | |
437 | ||
b5e89ed5 DA |
438 | count = (header >> 16) & 0x3fff; |
439 | ||
440 | if ((count + 1) > MAX_ARRAY_PACKET) { | |
441 | DRM_ERROR("Too large payload in 3D_LOAD_VBPNTR (count=%d)\n", | |
442 | count); | |
414ed537 | 443 | return DRM_ERR(EINVAL); |
b5e89ed5 DA |
444 | } |
445 | memset(payload, 0, MAX_ARRAY_PACKET * 4); | |
446 | memcpy(payload, cmdbuf->buf + 4, (count + 1) * 4); | |
447 | ||
414ed537 | 448 | /* carefully check packet contents */ |
b5e89ed5 DA |
449 | |
450 | narrays = payload[0]; | |
451 | k = 0; | |
452 | i = 1; | |
453 | while ((k < narrays) && (i < (count + 1))) { | |
454 | i++; /* skip attribute field */ | |
455 | if (r300_check_offset(dev_priv, payload[i])) { | |
456 | DRM_ERROR | |
457 | ("Offset failed range check (k=%d i=%d) while processing 3D_LOAD_VBPNTR packet.\n", | |
458 | k, i); | |
414ed537 | 459 | return DRM_ERR(EINVAL); |
b5e89ed5 | 460 | } |
414ed537 DA |
461 | k++; |
462 | i++; | |
b5e89ed5 DA |
463 | if (k == narrays) |
464 | break; | |
414ed537 | 465 | /* have one more to process, they come in pairs */ |
b5e89ed5 DA |
466 | if (r300_check_offset(dev_priv, payload[i])) { |
467 | DRM_ERROR | |
468 | ("Offset failed range check (k=%d i=%d) while processing 3D_LOAD_VBPNTR packet.\n", | |
469 | k, i); | |
414ed537 | 470 | return DRM_ERR(EINVAL); |
414ed537 | 471 | } |
b5e89ed5 DA |
472 | k++; |
473 | i++; | |
474 | } | |
414ed537 | 475 | /* do the counts match what we expect ? */ |
b5e89ed5 DA |
476 | if ((k != narrays) || (i != (count + 1))) { |
477 | DRM_ERROR | |
478 | ("Malformed 3D_LOAD_VBPNTR packet (k=%d i=%d narrays=%d count+1=%d).\n", | |
479 | k, i, narrays, count + 1); | |
414ed537 | 480 | return DRM_ERR(EINVAL); |
b5e89ed5 | 481 | } |
414ed537 DA |
482 | |
483 | /* all clear, output packet */ | |
484 | ||
b5e89ed5 | 485 | BEGIN_RING(count + 2); |
414ed537 | 486 | OUT_RING(header); |
b5e89ed5 | 487 | OUT_RING_TABLE(payload, count + 1); |
414ed537 DA |
488 | ADVANCE_RING(); |
489 | ||
b5e89ed5 DA |
490 | cmdbuf->buf += (count + 2) * 4; |
491 | cmdbuf->bufsz -= (count + 2) * 4; | |
414ed537 DA |
492 | |
493 | return 0; | |
494 | } | |
d5ea702f | 495 | |
4e5e2e25 DA |
496 | static __inline__ int r300_emit_bitblt_multi(drm_radeon_private_t *dev_priv, |
497 | drm_radeon_kcmd_buffer_t *cmdbuf) | |
498 | { | |
499 | u32 *cmd = (u32 *) cmdbuf->buf; | |
500 | int count, ret; | |
501 | RING_LOCALS; | |
502 | ||
503 | count=(cmd[0]>>16) & 0x3fff; | |
504 | ||
505 | if (cmd[0] & 0x8000) { | |
506 | u32 offset; | |
507 | ||
508 | if (cmd[1] & (RADEON_GMC_SRC_PITCH_OFFSET_CNTL | |
509 | | RADEON_GMC_DST_PITCH_OFFSET_CNTL)) { | |
510 | offset = cmd[2] << 10; | |
511 | ret = r300_check_offset(dev_priv, offset); | |
73d72cff | 512 | if (ret) { |
4e5e2e25 DA |
513 | DRM_ERROR("Invalid bitblt first offset is %08X\n", offset); |
514 | return DRM_ERR(EINVAL); | |
515 | } | |
516 | } | |
517 | ||
518 | if ((cmd[1] & RADEON_GMC_SRC_PITCH_OFFSET_CNTL) && | |
519 | (cmd[1] & RADEON_GMC_DST_PITCH_OFFSET_CNTL)) { | |
520 | offset = cmd[3] << 10; | |
521 | ret = r300_check_offset(dev_priv, offset); | |
73d72cff | 522 | if (ret) { |
4e5e2e25 DA |
523 | DRM_ERROR("Invalid bitblt second offset is %08X\n", offset); |
524 | return DRM_ERR(EINVAL); | |
525 | } | |
526 | ||
527 | } | |
528 | } | |
529 | ||
530 | BEGIN_RING(count+2); | |
531 | OUT_RING(cmd[0]); | |
532 | OUT_RING_TABLE((int *)(cmdbuf->buf + 4), count + 1); | |
533 | ADVANCE_RING(); | |
534 | ||
535 | cmdbuf->buf += (count+2)*4; | |
536 | cmdbuf->bufsz -= (count+2)*4; | |
537 | ||
538 | return 0; | |
539 | } | |
414ed537 | 540 | |
d985c108 DA |
541 | static __inline__ int r300_emit_raw_packet3(drm_radeon_private_t *dev_priv, |
542 | drm_radeon_kcmd_buffer_t *cmdbuf) | |
414ed537 DA |
543 | { |
544 | u32 header; | |
545 | int count; | |
546 | RING_LOCALS; | |
547 | ||
548 | if (4 > cmdbuf->bufsz) | |
549 | return DRM_ERR(EINVAL); | |
550 | ||
b5e89ed5 | 551 | /* Fixme !! This simply emits a packet without much checking. |
414ed537 DA |
552 | We need to be smarter. */ |
553 | ||
554 | /* obtain first word - actual packet3 header */ | |
b3a83639 | 555 | header = *(u32 *) cmdbuf->buf; |
414ed537 DA |
556 | |
557 | /* Is it packet 3 ? */ | |
b5e89ed5 | 558 | if ((header >> 30) != 0x3) { |
414ed537 DA |
559 | DRM_ERROR("Not a packet3 header (0x%08x)\n", header); |
560 | return DRM_ERR(EINVAL); | |
b5e89ed5 | 561 | } |
414ed537 | 562 | |
b5e89ed5 | 563 | count = (header >> 16) & 0x3fff; |
414ed537 DA |
564 | |
565 | /* Check again now that we know how much data to expect */ | |
b5e89ed5 DA |
566 | if ((count + 2) * 4 > cmdbuf->bufsz) { |
567 | DRM_ERROR | |
568 | ("Expected packet3 of length %d but have only %d bytes left\n", | |
569 | (count + 2) * 4, cmdbuf->bufsz); | |
414ed537 | 570 | return DRM_ERR(EINVAL); |
b5e89ed5 | 571 | } |
414ed537 DA |
572 | |
573 | /* Is it a packet type we know about ? */ | |
b5e89ed5 DA |
574 | switch (header & 0xff00) { |
575 | case RADEON_3D_LOAD_VBPNTR: /* load vertex array pointers */ | |
414ed537 DA |
576 | return r300_emit_3d_load_vbpntr(dev_priv, cmdbuf, header); |
577 | ||
4e5e2e25 DA |
578 | case RADEON_CNTL_BITBLT_MULTI: |
579 | return r300_emit_bitblt_multi(dev_priv, cmdbuf); | |
580 | ||
b5e89ed5 DA |
581 | case RADEON_CP_3D_DRAW_IMMD_2: /* triggers drawing using in-packet vertex data */ |
582 | case RADEON_CP_3D_DRAW_VBUF_2: /* triggers drawing of vertex buffers setup elsewhere */ | |
583 | case RADEON_CP_3D_DRAW_INDX_2: /* triggers drawing using indices to vertex buffer */ | |
584 | case RADEON_CP_INDX_BUFFER: /* DRAW_INDX_2 without INDX_BUFFER seems to lock up the gpu */ | |
414ed537 DA |
585 | case RADEON_WAIT_FOR_IDLE: |
586 | case RADEON_CP_NOP: | |
587 | /* these packets are safe */ | |
588 | break; | |
589 | default: | |
590 | DRM_ERROR("Unknown packet3 header (0x%08x)\n", header); | |
591 | return DRM_ERR(EINVAL); | |
b5e89ed5 | 592 | } |
414ed537 | 593 | |
b5e89ed5 | 594 | BEGIN_RING(count + 2); |
414ed537 | 595 | OUT_RING(header); |
b3a83639 | 596 | OUT_RING_TABLE((int *)(cmdbuf->buf + 4), count + 1); |
414ed537 DA |
597 | ADVANCE_RING(); |
598 | ||
b5e89ed5 DA |
599 | cmdbuf->buf += (count + 2) * 4; |
600 | cmdbuf->bufsz -= (count + 2) * 4; | |
414ed537 DA |
601 | |
602 | return 0; | |
603 | } | |
604 | ||
414ed537 DA |
605 | /** |
606 | * Emit a rendering packet3 from userspace. | |
607 | * Called by r300_do_cp_cmdbuf. | |
608 | */ | |
d985c108 DA |
609 | static __inline__ int r300_emit_packet3(drm_radeon_private_t *dev_priv, |
610 | drm_radeon_kcmd_buffer_t *cmdbuf, | |
414ed537 DA |
611 | drm_r300_cmd_header_t header) |
612 | { | |
613 | int n; | |
614 | int ret; | |
b3a83639 | 615 | char *orig_buf = cmdbuf->buf; |
414ed537 DA |
616 | int orig_bufsz = cmdbuf->bufsz; |
617 | ||
618 | /* This is a do-while-loop so that we run the interior at least once, | |
619 | * even if cmdbuf->nbox is 0. Compare r300_emit_cliprects for rationale. | |
620 | */ | |
621 | n = 0; | |
622 | do { | |
623 | if (cmdbuf->nbox > R300_SIMULTANEOUS_CLIPRECTS) { | |
624 | ret = r300_emit_cliprects(dev_priv, cmdbuf, n); | |
625 | if (ret) | |
626 | return ret; | |
627 | ||
628 | cmdbuf->buf = orig_buf; | |
629 | cmdbuf->bufsz = orig_bufsz; | |
b5e89ed5 | 630 | } |
414ed537 | 631 | |
b5e89ed5 | 632 | switch (header.packet3.packet) { |
414ed537 DA |
633 | case R300_CMD_PACKET3_CLEAR: |
634 | DRM_DEBUG("R300_CMD_PACKET3_CLEAR\n"); | |
635 | ret = r300_emit_clear(dev_priv, cmdbuf); | |
636 | if (ret) { | |
637 | DRM_ERROR("r300_emit_clear failed\n"); | |
638 | return ret; | |
b5e89ed5 | 639 | } |
414ed537 DA |
640 | break; |
641 | ||
642 | case R300_CMD_PACKET3_RAW: | |
643 | DRM_DEBUG("R300_CMD_PACKET3_RAW\n"); | |
644 | ret = r300_emit_raw_packet3(dev_priv, cmdbuf); | |
645 | if (ret) { | |
646 | DRM_ERROR("r300_emit_raw_packet3 failed\n"); | |
647 | return ret; | |
b5e89ed5 | 648 | } |
414ed537 DA |
649 | break; |
650 | ||
651 | default: | |
652 | DRM_ERROR("bad packet3 type %i at %p\n", | |
b5e89ed5 DA |
653 | header.packet3.packet, |
654 | cmdbuf->buf - sizeof(header)); | |
414ed537 | 655 | return DRM_ERR(EINVAL); |
b5e89ed5 | 656 | } |
414ed537 DA |
657 | |
658 | n += R300_SIMULTANEOUS_CLIPRECTS; | |
b5e89ed5 | 659 | } while (n < cmdbuf->nbox); |
414ed537 DA |
660 | |
661 | return 0; | |
662 | } | |
663 | ||
664 | /* Some of the R300 chips seem to be extremely touchy about the two registers | |
665 | * that are configured in r300_pacify. | |
666 | * Among the worst offenders seems to be the R300 ND (0x4E44): When userspace | |
667 | * sends a command buffer that contains only state setting commands and a | |
668 | * vertex program/parameter upload sequence, this will eventually lead to a | |
669 | * lockup, unless the sequence is bracketed by calls to r300_pacify. | |
670 | * So we should take great care to *always* call r300_pacify before | |
671 | * *anything* 3D related, and again afterwards. This is what the | |
672 | * call bracket in r300_do_cp_cmdbuf is for. | |
673 | */ | |
674 | ||
675 | /** | |
676 | * Emit the sequence to pacify R300. | |
677 | */ | |
d985c108 | 678 | static __inline__ void r300_pacify(drm_radeon_private_t *dev_priv) |
414ed537 DA |
679 | { |
680 | RING_LOCALS; | |
681 | ||
682 | BEGIN_RING(6); | |
b5e89ed5 DA |
683 | OUT_RING(CP_PACKET0(R300_RB3D_DSTCACHE_CTLSTAT, 0)); |
684 | OUT_RING(0xa); | |
685 | OUT_RING(CP_PACKET0(0x4f18, 0)); | |
686 | OUT_RING(0x3); | |
687 | OUT_RING(CP_PACKET3(RADEON_CP_NOP, 0)); | |
688 | OUT_RING(0x0); | |
414ed537 DA |
689 | ADVANCE_RING(); |
690 | } | |
691 | ||
414ed537 DA |
692 | /** |
693 | * Called by r300_do_cp_cmdbuf to update the internal buffer age and state. | |
694 | * The actual age emit is done by r300_do_cp_cmdbuf, which is why you must | |
695 | * be careful about how this function is called. | |
696 | */ | |
697 | static void r300_discard_buffer(drm_device_t * dev, drm_buf_t * buf) | |
698 | { | |
699 | drm_radeon_private_t *dev_priv = dev->dev_private; | |
700 | drm_radeon_buf_priv_t *buf_priv = buf->dev_private; | |
701 | ||
702 | buf_priv->age = ++dev_priv->sarea_priv->last_dispatch; | |
703 | buf->pending = 1; | |
704 | buf->used = 0; | |
705 | } | |
706 | ||
414ed537 DA |
707 | /** |
708 | * Parses and validates a user-supplied command buffer and emits appropriate | |
709 | * commands on the DMA ring buffer. | |
710 | * Called by the ioctl handler function radeon_cp_cmdbuf. | |
711 | */ | |
d985c108 | 712 | int r300_do_cp_cmdbuf(drm_device_t *dev, |
b5e89ed5 | 713 | DRMFILE filp, |
d985c108 DA |
714 | drm_file_t *filp_priv, |
715 | drm_radeon_kcmd_buffer_t *cmdbuf) | |
414ed537 DA |
716 | { |
717 | drm_radeon_private_t *dev_priv = dev->dev_private; | |
b5e89ed5 DA |
718 | drm_device_dma_t *dma = dev->dma; |
719 | drm_buf_t *buf = NULL; | |
414ed537 DA |
720 | int emit_dispatch_age = 0; |
721 | int ret = 0; | |
722 | ||
723 | DRM_DEBUG("\n"); | |
724 | ||
725 | /* See the comment above r300_emit_begin3d for why this call must be here, | |
726 | * and what the cleanup gotos are for. */ | |
727 | r300_pacify(dev_priv); | |
728 | ||
729 | if (cmdbuf->nbox <= R300_SIMULTANEOUS_CLIPRECTS) { | |
730 | ret = r300_emit_cliprects(dev_priv, cmdbuf, 0); | |
731 | if (ret) | |
732 | goto cleanup; | |
b5e89ed5 | 733 | } |
414ed537 | 734 | |
b5e89ed5 | 735 | while (cmdbuf->bufsz >= sizeof(drm_r300_cmd_header_t)) { |
414ed537 DA |
736 | int idx; |
737 | drm_r300_cmd_header_t header; | |
738 | ||
739 | header.u = *(unsigned int *)cmdbuf->buf; | |
740 | ||
741 | cmdbuf->buf += sizeof(header); | |
742 | cmdbuf->bufsz -= sizeof(header); | |
743 | ||
b5e89ed5 DA |
744 | switch (header.header.cmd_type) { |
745 | case R300_CMD_PACKET0: | |
414ed537 DA |
746 | DRM_DEBUG("R300_CMD_PACKET0\n"); |
747 | ret = r300_emit_packet0(dev_priv, cmdbuf, header); | |
748 | if (ret) { | |
749 | DRM_ERROR("r300_emit_packet0 failed\n"); | |
750 | goto cleanup; | |
b5e89ed5 | 751 | } |
414ed537 DA |
752 | break; |
753 | ||
754 | case R300_CMD_VPU: | |
755 | DRM_DEBUG("R300_CMD_VPU\n"); | |
756 | ret = r300_emit_vpu(dev_priv, cmdbuf, header); | |
757 | if (ret) { | |
758 | DRM_ERROR("r300_emit_vpu failed\n"); | |
759 | goto cleanup; | |
b5e89ed5 | 760 | } |
414ed537 DA |
761 | break; |
762 | ||
763 | case R300_CMD_PACKET3: | |
764 | DRM_DEBUG("R300_CMD_PACKET3\n"); | |
765 | ret = r300_emit_packet3(dev_priv, cmdbuf, header); | |
766 | if (ret) { | |
767 | DRM_ERROR("r300_emit_packet3 failed\n"); | |
768 | goto cleanup; | |
b5e89ed5 | 769 | } |
414ed537 DA |
770 | break; |
771 | ||
772 | case R300_CMD_END3D: | |
773 | DRM_DEBUG("R300_CMD_END3D\n"); | |
b5e89ed5 DA |
774 | /* TODO: |
775 | Ideally userspace driver should not need to issue this call, | |
776 | i.e. the drm driver should issue it automatically and prevent | |
777 | lockups. | |
778 | ||
779 | In practice, we do not understand why this call is needed and what | |
780 | it does (except for some vague guesses that it has to do with cache | |
781 | coherence) and so the user space driver does it. | |
782 | ||
783 | Once we are sure which uses prevent lockups the code could be moved | |
784 | into the kernel and the userspace driver will not | |
785 | need to use this command. | |
786 | ||
787 | Note that issuing this command does not hurt anything | |
788 | except, possibly, performance */ | |
414ed537 DA |
789 | r300_pacify(dev_priv); |
790 | break; | |
791 | ||
792 | case R300_CMD_CP_DELAY: | |
793 | /* simple enough, we can do it here */ | |
794 | DRM_DEBUG("R300_CMD_CP_DELAY\n"); | |
795 | { | |
796 | int i; | |
797 | RING_LOCALS; | |
798 | ||
799 | BEGIN_RING(header.delay.count); | |
b5e89ed5 | 800 | for (i = 0; i < header.delay.count; i++) |
414ed537 DA |
801 | OUT_RING(RADEON_CP_PACKET2); |
802 | ADVANCE_RING(); | |
803 | } | |
804 | break; | |
805 | ||
806 | case R300_CMD_DMA_DISCARD: | |
807 | DRM_DEBUG("RADEON_CMD_DMA_DISCARD\n"); | |
b5e89ed5 DA |
808 | idx = header.dma.buf_idx; |
809 | if (idx < 0 || idx >= dma->buf_count) { | |
810 | DRM_ERROR("buffer index %d (of %d max)\n", | |
811 | idx, dma->buf_count - 1); | |
414ed537 | 812 | ret = DRM_ERR(EINVAL); |
414ed537 | 813 | goto cleanup; |
b5e89ed5 DA |
814 | } |
815 | ||
816 | buf = dma->buflist[idx]; | |
817 | if (buf->filp != filp || buf->pending) { | |
818 | DRM_ERROR("bad buffer %p %p %d\n", | |
819 | buf->filp, filp, buf->pending); | |
820 | ret = DRM_ERR(EINVAL); | |
821 | goto cleanup; | |
822 | } | |
414ed537 DA |
823 | |
824 | emit_dispatch_age = 1; | |
825 | r300_discard_buffer(dev, buf); | |
b5e89ed5 | 826 | break; |
414ed537 DA |
827 | |
828 | case R300_CMD_WAIT: | |
829 | /* simple enough, we can do it here */ | |
830 | DRM_DEBUG("R300_CMD_WAIT\n"); | |
b5e89ed5 DA |
831 | if (header.wait.flags == 0) |
832 | break; /* nothing to do */ | |
414ed537 DA |
833 | |
834 | { | |
835 | RING_LOCALS; | |
836 | ||
837 | BEGIN_RING(2); | |
b5e89ed5 DA |
838 | OUT_RING(CP_PACKET0(RADEON_WAIT_UNTIL, 0)); |
839 | OUT_RING((header.wait.flags & 0xf) << 14); | |
414ed537 DA |
840 | ADVANCE_RING(); |
841 | } | |
842 | break; | |
843 | ||
844 | default: | |
845 | DRM_ERROR("bad cmd_type %i at %p\n", | |
b5e89ed5 | 846 | header.header.cmd_type, |
414ed537 DA |
847 | cmdbuf->buf - sizeof(header)); |
848 | ret = DRM_ERR(EINVAL); | |
849 | goto cleanup; | |
b5e89ed5 | 850 | } |
414ed537 DA |
851 | } |
852 | ||
853 | DRM_DEBUG("END\n"); | |
854 | ||
b5e89ed5 | 855 | cleanup: |
414ed537 DA |
856 | r300_pacify(dev_priv); |
857 | ||
858 | /* We emit the vertex buffer age here, outside the pacifier "brackets" | |
859 | * for two reasons: | |
860 | * (1) This may coalesce multiple age emissions into a single one and | |
861 | * (2) more importantly, some chips lock up hard when scratch registers | |
862 | * are written inside the pacifier bracket. | |
863 | */ | |
864 | if (emit_dispatch_age) { | |
865 | RING_LOCALS; | |
866 | ||
867 | /* Emit the vertex buffer age */ | |
868 | BEGIN_RING(2); | |
869 | RADEON_DISPATCH_AGE(dev_priv->sarea_priv->last_dispatch); | |
870 | ADVANCE_RING(); | |
b5e89ed5 | 871 | } |
414ed537 DA |
872 | |
873 | COMMIT_RING(); | |
874 | ||
875 | return ret; | |
876 | } |