Pileus Git - ~andy/linux/blob - drivers/gpu/drm/vmwgfx/vmwgfx_surface.c

   1 /**************************************************************************
   2  *
   3  * Copyright © 2009-2012 VMware, Inc., Palo Alto, CA., USA
   4  * All Rights Reserved.
   5  *
   6  * Permission is hereby granted, free of charge, to any person obtaining a
   7  * copy of this software and associated documentation files (the
   8  * "Software"), to deal in the Software without restriction, including
   9  * without limitation the rights to use, copy, modify, merge, publish,
  10  * distribute, sub license, and/or sell copies of the Software, and to
  11  * permit persons to whom the Software is furnished to do so, subject to
  12  * the following conditions:
  13  *
  14  * The above copyright notice and this permission notice (including the
  15  * next paragraph) shall be included in all copies or substantial portions
  16  * of the Software.
  17  *
  18  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  19  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  20  * FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. IN NO EVENT SHALL
  21  * THE COPYRIGHT HOLDERS, AUTHORS AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM,
  22  * DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
  23  * OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
  24  * USE OR OTHER DEALINGS IN THE SOFTWARE.
  25  *
  26  **************************************************************************/
  27
  28 #include "vmwgfx_drv.h"
  29 #include "vmwgfx_resource_priv.h"
  30 #include <ttm/ttm_placement.h>
  31 #include "svga3d_surfacedefs.h"
  32
  33 /**
  34  * struct vmw_user_surface - User-space visible surface resource
  35  *
  36  * @base:           The TTM base object handling user-space visibility.
  37  * @srf:            The surface metadata.
  38  * @size:           TTM accounting size for the surface.
  39  */
  40 struct vmw_user_surface {
  41         struct ttm_prime_object prime;
  42         struct vmw_surface srf;
  43         uint32_t size;
  44 };
  45
  46 /**
  47  * struct vmw_surface_offset - Backing store mip level offset info
  48  *
  49  * @face:           Surface face.
  50  * @mip:            Mip level.
  51  * @bo_offset:      Offset into backing store of this mip level.
  52  *
  53  */
  54 struct vmw_surface_offset {
  55         uint32_t face;
  56         uint32_t mip;
  57         uint32_t bo_offset;
  58 };
  59
  60 static void vmw_user_surface_free(struct vmw_resource *res);
  61 static struct vmw_resource *
  62 vmw_user_surface_base_to_res(struct ttm_base_object *base);
  63 static int vmw_legacy_srf_bind(struct vmw_resource *res,
  64                                struct ttm_validate_buffer *val_buf);
  65 static int vmw_legacy_srf_unbind(struct vmw_resource *res,
  66                                  bool readback,
  67                                  struct ttm_validate_buffer *val_buf);
  68 static int vmw_legacy_srf_create(struct vmw_resource *res);
  69 static int vmw_legacy_srf_destroy(struct vmw_resource *res);
  70 static int vmw_gb_surface_create(struct vmw_resource *res);
  71 static int vmw_gb_surface_bind(struct vmw_resource *res,
  72                                struct ttm_validate_buffer *val_buf);
  73 static int vmw_gb_surface_unbind(struct vmw_resource *res,
  74                                  bool readback,
  75                                  struct ttm_validate_buffer *val_buf);
  76 static int vmw_gb_surface_destroy(struct vmw_resource *res);
  77
  78
  79 static const struct vmw_user_resource_conv user_surface_conv = {
  80         .object_type = VMW_RES_SURFACE,
  81         .base_obj_to_res = vmw_user_surface_base_to_res,
  82         .res_free = vmw_user_surface_free
  83 };
  84
  85 const struct vmw_user_resource_conv *user_surface_converter =
  86         &user_surface_conv;
  87
  88
  89 static uint64_t vmw_user_surface_size;
  90
  91 static const struct vmw_res_func vmw_legacy_surface_func = {
  92         .res_type = vmw_res_surface,
  93         .needs_backup = false,
  94         .may_evict = true,
  95         .type_name = "legacy surfaces",
  96         .backup_placement = &vmw_srf_placement,
  97         .create = &vmw_legacy_srf_create,
  98         .destroy = &vmw_legacy_srf_destroy,
  99         .bind = &vmw_legacy_srf_bind,
 100         .unbind = &vmw_legacy_srf_unbind
 101 };
 102
 103 static const struct vmw_res_func vmw_gb_surface_func = {
 104         .res_type = vmw_res_surface,
 105         .needs_backup = true,
 106         .may_evict = true,
 107         .type_name = "guest backed surfaces",
 108         .backup_placement = &vmw_mob_placement,
 109         .create = vmw_gb_surface_create,
 110         .destroy = vmw_gb_surface_destroy,
 111         .bind = vmw_gb_surface_bind,
 112         .unbind = vmw_gb_surface_unbind
 113 };
 114
 115 /**
 116  * struct vmw_surface_dma - SVGA3D DMA command
 117  */
 118 struct vmw_surface_dma {
 119         SVGA3dCmdHeader header;
 120         SVGA3dCmdSurfaceDMA body;
 121         SVGA3dCopyBox cb;
 122         SVGA3dCmdSurfaceDMASuffix suffix;
 123 };
 124
 125 /**
 126  * struct vmw_surface_define - SVGA3D Surface Define command
 127  */
 128 struct vmw_surface_define {
 129         SVGA3dCmdHeader header;
 130         SVGA3dCmdDefineSurface body;
 131 };
 132
 133 /**
 134  * struct vmw_surface_destroy - SVGA3D Surface Destroy command
 135  */
 136 struct vmw_surface_destroy {
 137         SVGA3dCmdHeader header;
 138         SVGA3dCmdDestroySurface body;
 139 };
 140
 141
 142 /**
 143  * vmw_surface_dma_size - Compute fifo size for a dma command.
 144  *
 145  * @srf: Pointer to a struct vmw_surface
 146  *
 147  * Computes the required size for a surface dma command for backup or
 148  * restoration of the surface represented by @srf.
 149  */
 150 static inline uint32_t vmw_surface_dma_size(const struct vmw_surface *srf)
 151 {
 152         return srf->num_sizes * sizeof(struct vmw_surface_dma);
 153 }
 154
 155
 156 /**
 157  * vmw_surface_define_size - Compute fifo size for a surface define command.
 158  *
 159  * @srf: Pointer to a struct vmw_surface
 160  *
 161  * Computes the required size for a surface define command for the definition
 162  * of the surface represented by @srf.
 163  */
 164 static inline uint32_t vmw_surface_define_size(const struct vmw_surface *srf)
 165 {
 166         return sizeof(struct vmw_surface_define) + srf->num_sizes *
 167                 sizeof(SVGA3dSize);
 168 }
 169
 170
 171 /**
 172  * vmw_surface_destroy_size - Compute fifo size for a surface destroy command.
 173  *
 174  * Computes the required size for a surface destroy command for the destruction
 175  * of a hw surface.
 176  */
 177 static inline uint32_t vmw_surface_destroy_size(void)
 178 {
 179         return sizeof(struct vmw_surface_destroy);
 180 }
 181
 182 /**
 183  * vmw_surface_destroy_encode - Encode a surface_destroy command.
 184  *
 185  * @id: The surface id
 186  * @cmd_space: Pointer to memory area in which the commands should be encoded.
 187  */
 188 static void vmw_surface_destroy_encode(uint32_t id,
 189                                        void *cmd_space)
 190 {
 191         struct vmw_surface_destroy *cmd = (struct vmw_surface_destroy *)
 192                 cmd_space;
 193
 194         cmd->header.id = SVGA_3D_CMD_SURFACE_DESTROY;
 195         cmd->header.size = sizeof(cmd->body);
 196         cmd->body.sid = id;
 197 }
 198
 199 /**
 200  * vmw_surface_define_encode - Encode a surface_define command.
 201  *
 202  * @srf: Pointer to a struct vmw_surface object.
 203  * @cmd_space: Pointer to memory area in which the commands should be encoded.
 204  */
 205 static void vmw_surface_define_encode(const struct vmw_surface *srf,
 206                                       void *cmd_space)
 207 {
 208         struct vmw_surface_define *cmd = (struct vmw_surface_define *)
 209                 cmd_space;
 210         struct drm_vmw_size *src_size;
 211         SVGA3dSize *cmd_size;
 212         uint32_t cmd_len;
 213         int i;
 214
 215         cmd_len = sizeof(cmd->body) + srf->num_sizes * sizeof(SVGA3dSize);
 216
 217         cmd->header.id = SVGA_3D_CMD_SURFACE_DEFINE;
 218         cmd->header.size = cmd_len;
 219         cmd->body.sid = srf->res.id;
 220         cmd->body.surfaceFlags = srf->flags;
 221         cmd->body.format = cpu_to_le32(srf->format);
 222         for (i = 0; i < DRM_VMW_MAX_SURFACE_FACES; ++i)
 223                 cmd->body.face[i].numMipLevels = srf->mip_levels[i];
 224
 225         cmd += 1;
 226         cmd_size = (SVGA3dSize *) cmd;
 227         src_size = srf->sizes;
 228
 229         for (i = 0; i < srf->num_sizes; ++i, cmd_size++, src_size++) {
 230                 cmd_size->width = src_size->width;
 231                 cmd_size->height = src_size->height;
 232                 cmd_size->depth = src_size->depth;
 233         }
 234 }
 235
 236 /**
 237  * vmw_surface_dma_encode - Encode a surface_dma command.
 238  *
 239  * @srf: Pointer to a struct vmw_surface object.
 240  * @cmd_space: Pointer to memory area in which the commands should be encoded.
 241  * @ptr: Pointer to an SVGAGuestPtr indicating where the surface contents
 242  * should be placed or read from.
 243  * @to_surface: Boolean whether to DMA to the surface or from the surface.
 244  */
 245 static void vmw_surface_dma_encode(struct vmw_surface *srf,
 246                                    void *cmd_space,
 247                                    const SVGAGuestPtr *ptr,
 248                                    bool to_surface)
 249 {
 250         uint32_t i;
 251         struct vmw_surface_dma *cmd = (struct vmw_surface_dma *)cmd_space;
 252         const struct svga3d_surface_desc *desc =
 253                 svga3dsurface_get_desc(srf->format);
 254
 255         for (i = 0; i < srf->num_sizes; ++i) {
 256                 SVGA3dCmdHeader *header = &cmd->header;
 257                 SVGA3dCmdSurfaceDMA *body = &cmd->body;
 258                 SVGA3dCopyBox *cb = &cmd->cb;
 259                 SVGA3dCmdSurfaceDMASuffix *suffix = &cmd->suffix;
 260                 const struct vmw_surface_offset *cur_offset = &srf->offsets[i];
 261                 const struct drm_vmw_size *cur_size = &srf->sizes[i];
 262
 263                 header->id = SVGA_3D_CMD_SURFACE_DMA;
 264                 header->size = sizeof(*body) + sizeof(*cb) + sizeof(*suffix);
 265
 266                 body->guest.ptr = *ptr;
 267                 body->guest.ptr.offset += cur_offset->bo_offset;
 268                 body->guest.pitch = svga3dsurface_calculate_pitch(desc,
 269                                                                   cur_size);
 270                 body->host.sid = srf->res.id;
 271                 body->host.face = cur_offset->face;
 272                 body->host.mipmap = cur_offset->mip;
 273                 body->transfer = ((to_surface) ?  SVGA3D_WRITE_HOST_VRAM :
 274                                   SVGA3D_READ_HOST_VRAM);
 275                 cb->x = 0;
 276                 cb->y = 0;
 277                 cb->z = 0;
 278                 cb->srcx = 0;
 279                 cb->srcy = 0;
 280                 cb->srcz = 0;
 281                 cb->w = cur_size->width;
 282                 cb->h = cur_size->height;
 283                 cb->d = cur_size->depth;
 284
 285                 suffix->suffixSize = sizeof(*suffix);
 286                 suffix->maximumOffset =
 287                         svga3dsurface_get_image_buffer_size(desc, cur_size,
 288                                                             body->guest.pitch);
 289                 suffix->flags.discard = 0;
 290                 suffix->flags.unsynchronized = 0;
 291                 suffix->flags.reserved = 0;
 292                 ++cmd;
 293         }
 294 };
 295
 296
 297 /**
 298  * vmw_hw_surface_destroy - destroy a Device surface
 299  *
 300  * @res:        Pointer to a struct vmw_resource embedded in a struct
 301  *              vmw_surface.
 302  *
 303  * Destroys a the device surface associated with a struct vmw_surface if
 304  * any, and adjusts accounting and resource count accordingly.
 305  */
 306 static void vmw_hw_surface_destroy(struct vmw_resource *res)
 307 {
 308
 309         struct vmw_private *dev_priv = res->dev_priv;
 310         struct vmw_surface *srf;
 311         void *cmd;
 312
 313         if (res->func->destroy == vmw_gb_surface_destroy) {
 314                 (void) vmw_gb_surface_destroy(res);
 315                 return;
 316         }
 317
 318         if (res->id != -1) {
 319
 320                 cmd = vmw_fifo_reserve(dev_priv, vmw_surface_destroy_size());
 321                 if (unlikely(cmd == NULL)) {
 322                         DRM_ERROR("Failed reserving FIFO space for surface "
 323                                   "destruction.\n");
 324                         return;
 325                 }
 326
 327                 vmw_surface_destroy_encode(res->id, cmd);
 328                 vmw_fifo_commit(dev_priv, vmw_surface_destroy_size());
 329
 330                 /*
 331                  * used_memory_size_atomic, or separate lock
 332                  * to avoid taking dev_priv::cmdbuf_mutex in
 333                  * the destroy path.
 334                  */
 335
 336                 mutex_lock(&dev_priv->cmdbuf_mutex);
 337                 srf = vmw_res_to_srf(res);
 338                 dev_priv->used_memory_size -= res->backup_size;
 339                 mutex_unlock(&dev_priv->cmdbuf_mutex);
 340         }
 341         vmw_3d_resource_dec(dev_priv, false);
 342 }
 343
 344 /**
 345  * vmw_legacy_srf_create - Create a device surface as part of the
 346  * resource validation process.
 347  *
 348  * @res: Pointer to a struct vmw_surface.
 349  *
 350  * If the surface doesn't have a hw id.
 351  *
 352  * Returns -EBUSY if there wasn't sufficient device resources to
 353  * complete the validation. Retry after freeing up resources.
 354  *
 355  * May return other errors if the kernel is out of guest resources.
 356  */
 357 static int vmw_legacy_srf_create(struct vmw_resource *res)
 358 {
 359         struct vmw_private *dev_priv = res->dev_priv;
 360         struct vmw_surface *srf;
 361         uint32_t submit_size;
 362         uint8_t *cmd;
 363         int ret;
 364
 365         if (likely(res->id != -1))
 366                 return 0;
 367
 368         srf = vmw_res_to_srf(res);
 369         if (unlikely(dev_priv->used_memory_size + res->backup_size >=
 370                      dev_priv->memory_size))
 371                 return -EBUSY;
 372
 373         /*
 374          * Alloc id for the resource.
 375          */
 376
 377         ret = vmw_resource_alloc_id(res);
 378         if (unlikely(ret != 0)) {
 379                 DRM_ERROR("Failed to allocate a surface id.\n");
 380                 goto out_no_id;
 381         }
 382
 383         if (unlikely(res->id >= SVGA3D_MAX_SURFACE_IDS)) {
 384                 ret = -EBUSY;
 385                 goto out_no_fifo;
 386         }
 387
 388         /*
 389          * Encode surface define- commands.
 390          */
 391
 392         submit_size = vmw_surface_define_size(srf);
 393         cmd = vmw_fifo_reserve(dev_priv, submit_size);
 394         if (unlikely(cmd == NULL)) {
 395                 DRM_ERROR("Failed reserving FIFO space for surface "
 396                           "creation.\n");
 397                 ret = -ENOMEM;
 398                 goto out_no_fifo;
 399         }
 400
 401         vmw_surface_define_encode(srf, cmd);
 402         vmw_fifo_commit(dev_priv, submit_size);
 403         /*
 404          * Surface memory usage accounting.
 405          */
 406
 407         dev_priv->used_memory_size += res->backup_size;
 408         return 0;
 409
 410 out_no_fifo:
 411         vmw_resource_release_id(res);
 412 out_no_id:
 413         return ret;
 414 }
 415
 416 /**
 417  * vmw_legacy_srf_dma - Copy backup data to or from a legacy surface.
 418  *
 419  * @res:            Pointer to a struct vmw_res embedded in a struct
 420  *                  vmw_surface.
 421  * @val_buf:        Pointer to a struct ttm_validate_buffer containing
 422  *                  information about the backup buffer.
 423  * @bind:           Boolean wether to DMA to the surface.
 424  *
 425  * Transfer backup data to or from a legacy surface as part of the
 426  * validation process.
 427  * May return other errors if the kernel is out of guest resources.
 428  * The backup buffer will be fenced or idle upon successful completion,
 429  * and if the surface needs persistent backup storage, the backup buffer
 430  * will also be returned reserved iff @bind is true.
 431  */
 432 static int vmw_legacy_srf_dma(struct vmw_resource *res,
 433                               struct ttm_validate_buffer *val_buf,
 434                               bool bind)
 435 {
 436         SVGAGuestPtr ptr;
 437         struct vmw_fence_obj *fence;
 438         uint32_t submit_size;
 439         struct vmw_surface *srf = vmw_res_to_srf(res);
 440         uint8_t *cmd;
 441         struct vmw_private *dev_priv = res->dev_priv;
 442
 443         BUG_ON(val_buf->bo == NULL);
 444
 445         submit_size = vmw_surface_dma_size(srf);
 446         cmd = vmw_fifo_reserve(dev_priv, submit_size);
 447         if (unlikely(cmd == NULL)) {
 448                 DRM_ERROR("Failed reserving FIFO space for surface "
 449                           "DMA.\n");
 450                 return -ENOMEM;
 451         }
 452         vmw_bo_get_guest_ptr(val_buf->bo, &ptr);
 453         vmw_surface_dma_encode(srf, cmd, &ptr, bind);
 454
 455         vmw_fifo_commit(dev_priv, submit_size);
 456
 457         /*
 458          * Create a fence object and fence the backup buffer.
 459          */
 460
 461         (void) vmw_execbuf_fence_commands(NULL, dev_priv,
 462                                           &fence, NULL);
 463
 464         vmw_fence_single_bo(val_buf->bo, fence);
 465
 466         if (likely(fence != NULL))
 467                 vmw_fence_obj_unreference(&fence);
 468
 469         return 0;
 470 }
 471
 472 /**
 473  * vmw_legacy_srf_bind - Perform a legacy surface bind as part of the
 474  *                       surface validation process.
 475  *
 476  * @res:            Pointer to a struct vmw_res embedded in a struct
 477  *                  vmw_surface.
 478  * @val_buf:        Pointer to a struct ttm_validate_buffer containing
 479  *                  information about the backup buffer.
 480  *
 481  * This function will copy backup data to the surface if the
 482  * backup buffer is dirty.
 483  */
 484 static int vmw_legacy_srf_bind(struct vmw_resource *res,
 485                                struct ttm_validate_buffer *val_buf)
 486 {
 487         if (!res->backup_dirty)
 488                 return 0;
 489
 490         return vmw_legacy_srf_dma(res, val_buf, true);
 491 }
 492
 493
 494 /**
 495  * vmw_legacy_srf_unbind - Perform a legacy surface unbind as part of the
 496  *                         surface eviction process.
 497  *
 498  * @res:            Pointer to a struct vmw_res embedded in a struct
 499  *                  vmw_surface.
 500  * @val_buf:        Pointer to a struct ttm_validate_buffer containing
 501  *                  information about the backup buffer.
 502  *
 503  * This function will copy backup data from the surface.
 504  */
 505 static int vmw_legacy_srf_unbind(struct vmw_resource *res,
 506                                  bool readback,
 507                                  struct ttm_validate_buffer *val_buf)
 508 {
 509         if (unlikely(readback))
 510                 return vmw_legacy_srf_dma(res, val_buf, false);
 511         return 0;
 512 }
 513
 514 /**
 515  * vmw_legacy_srf_destroy - Destroy a device surface as part of a
 516  *                          resource eviction process.
 517  *
 518  * @res:            Pointer to a struct vmw_res embedded in a struct
 519  *                  vmw_surface.
 520  */
 521 static int vmw_legacy_srf_destroy(struct vmw_resource *res)
 522 {
 523         struct vmw_private *dev_priv = res->dev_priv;
 524         uint32_t submit_size;
 525         uint8_t *cmd;
 526
 527         BUG_ON(res->id == -1);
 528
 529         /*
 530          * Encode the dma- and surface destroy commands.
 531          */
 532
 533         submit_size = vmw_surface_destroy_size();
 534         cmd = vmw_fifo_reserve(dev_priv, submit_size);
 535         if (unlikely(cmd == NULL)) {
 536                 DRM_ERROR("Failed reserving FIFO space for surface "
 537                           "eviction.\n");
 538                 return -ENOMEM;
 539         }
 540
 541         vmw_surface_destroy_encode(res->id, cmd);
 542         vmw_fifo_commit(dev_priv, submit_size);
 543
 544         /*
 545          * Surface memory usage accounting.
 546          */
 547
 548         dev_priv->used_memory_size -= res->backup_size;
 549
 550         /*
 551          * Release the surface ID.
 552          */
 553
 554         vmw_resource_release_id(res);
 555
 556         return 0;
 557 }
 558
 559
 560 /**
 561  * vmw_surface_init - initialize a struct vmw_surface
 562  *
 563  * @dev_priv:       Pointer to a device private struct.
 564  * @srf:            Pointer to the struct vmw_surface to initialize.
 565  * @res_free:       Pointer to a resource destructor used to free
 566  *                  the object.
 567  */
 568 static int vmw_surface_init(struct vmw_private *dev_priv,
 569                             struct vmw_surface *srf,
 570                             void (*res_free) (struct vmw_resource *res))
 571 {
 572         int ret;
 573         struct vmw_resource *res = &srf->res;
 574
 575         BUG_ON(res_free == NULL);
 576         if (!dev_priv->has_mob)
 577                 (void) vmw_3d_resource_inc(dev_priv, false);
 578         ret = vmw_resource_init(dev_priv, res, true, res_free,
 579                                 (dev_priv->has_mob) ? &vmw_gb_surface_func :
 580                                 &vmw_legacy_surface_func);
 581
 582         if (unlikely(ret != 0)) {
 583                 if (!dev_priv->has_mob)
 584                         vmw_3d_resource_dec(dev_priv, false);
 585                 res_free(res);
 586                 return ret;
 587         }
 588
 589         /*
 590          * The surface won't be visible to hardware until a
 591          * surface validate.
 592          */
 593
 594         vmw_resource_activate(res, vmw_hw_surface_destroy);
 595         return ret;
 596 }
 597
 598 /**
 599  * vmw_user_surface_base_to_res - TTM base object to resource converter for
 600  *                                user visible surfaces
 601  *
 602  * @base:           Pointer to a TTM base object
 603  *
 604  * Returns the struct vmw_resource embedded in a struct vmw_surface
 605  * for the user-visible object identified by the TTM base object @base.
 606  */
 607 static struct vmw_resource *
 608 vmw_user_surface_base_to_res(struct ttm_base_object *base)
 609 {
 610         return &(container_of(base, struct vmw_user_surface,
 611                               prime.base)->srf.res);
 612 }
 613
 614 /**
 615  * vmw_user_surface_free - User visible surface resource destructor
 616  *
 617  * @res:            A struct vmw_resource embedded in a struct vmw_surface.
 618  */
 619 static void vmw_user_surface_free(struct vmw_resource *res)
 620 {
 621         struct vmw_surface *srf = vmw_res_to_srf(res);
 622         struct vmw_user_surface *user_srf =
 623             container_of(srf, struct vmw_user_surface, srf);
 624         struct vmw_private *dev_priv = srf->res.dev_priv;
 625         uint32_t size = user_srf->size;
 626
 627         kfree(srf->offsets);
 628         kfree(srf->sizes);
 629         kfree(srf->snooper.image);
 630         ttm_prime_object_kfree(user_srf, prime);
 631         ttm_mem_global_free(vmw_mem_glob(dev_priv), size);
 632 }
 633
 634 /**
 635  * vmw_user_surface_free - User visible surface TTM base object destructor
 636  *
 637  * @p_base:         Pointer to a pointer to a TTM base object
 638  *                  embedded in a struct vmw_user_surface.
 639  *
 640  * Drops the base object's reference on its resource, and the
 641  * pointer pointed to by *p_base is set to NULL.
 642  */
 643 static void vmw_user_surface_base_release(struct ttm_base_object **p_base)
 644 {
 645         struct ttm_base_object *base = *p_base;
 646         struct vmw_user_surface *user_srf =
 647             container_of(base, struct vmw_user_surface, prime.base);
 648         struct vmw_resource *res = &user_srf->srf.res;
 649
 650         *p_base = NULL;
 651         vmw_resource_unreference(&res);
 652 }
 653
 654 /**
 655  * vmw_user_surface_destroy_ioctl - Ioctl function implementing
 656  *                                  the user surface destroy functionality.
 657  *
 658  * @dev:            Pointer to a struct drm_device.
 659  * @data:           Pointer to data copied from / to user-space.
 660  * @file_priv:      Pointer to a drm file private structure.
 661  */
 662 int vmw_surface_destroy_ioctl(struct drm_device *dev, void *data,
 663                               struct drm_file *file_priv)
 664 {
 665         struct drm_vmw_surface_arg *arg = (struct drm_vmw_surface_arg *)data;
 666         struct ttm_object_file *tfile = vmw_fpriv(file_priv)->tfile;
 667
 668         return ttm_ref_object_base_unref(tfile, arg->sid, TTM_REF_USAGE);
 669 }
 670
 671 /**
 672  * vmw_user_surface_define_ioctl - Ioctl function implementing
 673  *                                  the user surface define functionality.
 674  *
 675  * @dev:            Pointer to a struct drm_device.
 676  * @data:           Pointer to data copied from / to user-space.
 677  * @file_priv:      Pointer to a drm file private structure.
 678  */
 679 int vmw_surface_define_ioctl(struct drm_device *dev, void *data,
 680                              struct drm_file *file_priv)
 681 {
 682         struct vmw_private *dev_priv = vmw_priv(dev);
 683         struct vmw_user_surface *user_srf;
 684         struct vmw_surface *srf;
 685         struct vmw_resource *res;
 686         struct vmw_resource *tmp;
 687         union drm_vmw_surface_create_arg *arg =
 688             (union drm_vmw_surface_create_arg *)data;
 689         struct drm_vmw_surface_create_req *req = &arg->req;
 690         struct drm_vmw_surface_arg *rep = &arg->rep;
 691         struct ttm_object_file *tfile = vmw_fpriv(file_priv)->tfile;
 692         struct drm_vmw_size __user *user_sizes;
 693         int ret;
 694         int i, j;
 695         uint32_t cur_bo_offset;
 696         struct drm_vmw_size *cur_size;
 697         struct vmw_surface_offset *cur_offset;
 698         uint32_t num_sizes;
 699         uint32_t size;
 700         struct vmw_master *vmaster = vmw_master(file_priv->master);
 701         const struct svga3d_surface_desc *desc;
 702
 703         if (unlikely(vmw_user_surface_size == 0))
 704                 vmw_user_surface_size = ttm_round_pot(sizeof(*user_srf)) +
 705                         128;
 706
 707         num_sizes = 0;
 708         for (i = 0; i < DRM_VMW_MAX_SURFACE_FACES; ++i)
 709                 num_sizes += req->mip_levels[i];
 710
 711         if (num_sizes > DRM_VMW_MAX_SURFACE_FACES *
 712             DRM_VMW_MAX_MIP_LEVELS)
 713                 return -EINVAL;
 714
 715         size = vmw_user_surface_size + 128 +
 716                 ttm_round_pot(num_sizes * sizeof(struct drm_vmw_size)) +
 717                 ttm_round_pot(num_sizes * sizeof(struct vmw_surface_offset));
 718
 719
 720         desc = svga3dsurface_get_desc(req->format);
 721         if (unlikely(desc->block_desc == SVGA3DBLOCKDESC_NONE)) {
 722                 DRM_ERROR("Invalid surface format for surface creation.\n");
 723                 return -EINVAL;
 724         }
 725
 726         ret = ttm_read_lock(&vmaster->lock, true);
 727         if (unlikely(ret != 0))
 728                 return ret;
 729
 730         ret = ttm_mem_global_alloc(vmw_mem_glob(dev_priv),
 731                                    size, false, true);
 732         if (unlikely(ret != 0)) {
 733                 if (ret != -ERESTARTSYS)
 734                         DRM_ERROR("Out of graphics memory for surface"
 735                                   " creation.\n");
 736                 goto out_unlock;
 737         }
 738
 739         user_srf = kzalloc(sizeof(*user_srf), GFP_KERNEL);
 740         if (unlikely(user_srf == NULL)) {
 741                 ret = -ENOMEM;
 742                 goto out_no_user_srf;
 743         }
 744
 745         srf = &user_srf->srf;
 746         res = &srf->res;
 747
 748         srf->flags = req->flags;
 749         srf->format = req->format;
 750         srf->scanout = req->scanout;
 751
 752         memcpy(srf->mip_levels, req->mip_levels, sizeof(srf->mip_levels));
 753         srf->num_sizes = num_sizes;
 754         user_srf->size = size;
 755
 756         srf->sizes = kmalloc(srf->num_sizes * sizeof(*srf->sizes), GFP_KERNEL);
 757         if (unlikely(srf->sizes == NULL)) {
 758                 ret = -ENOMEM;
 759                 goto out_no_sizes;
 760         }
 761         srf->offsets = kmalloc(srf->num_sizes * sizeof(*srf->offsets),
 762                                GFP_KERNEL);
 763         if (unlikely(srf->sizes == NULL)) {
 764                 ret = -ENOMEM;
 765                 goto out_no_offsets;
 766         }
 767
 768         user_sizes = (struct drm_vmw_size __user *)(unsigned long)
 769             req->size_addr;
 770
 771         ret = copy_from_user(srf->sizes, user_sizes,
 772                              srf->num_sizes * sizeof(*srf->sizes));
 773         if (unlikely(ret != 0)) {
 774                 ret = -EFAULT;
 775                 goto out_no_copy;
 776         }
 777
 778         srf->base_size = *srf->sizes;
 779         srf->autogen_filter = SVGA3D_TEX_FILTER_NONE;
 780         srf->multisample_count = 0;
 781
 782         cur_bo_offset = 0;
 783         cur_offset = srf->offsets;
 784         cur_size = srf->sizes;
 785
 786         for (i = 0; i < DRM_VMW_MAX_SURFACE_FACES; ++i) {
 787                 for (j = 0; j < srf->mip_levels[i]; ++j) {
 788                         uint32_t stride = svga3dsurface_calculate_pitch
 789                                 (desc, cur_size);
 790
 791                         cur_offset->face = i;
 792                         cur_offset->mip = j;
 793                         cur_offset->bo_offset = cur_bo_offset;
 794                         cur_bo_offset += svga3dsurface_get_image_buffer_size
 795                                 (desc, cur_size, stride);
 796                         ++cur_offset;
 797                         ++cur_size;
 798                 }
 799         }
 800         res->backup_size = cur_bo_offset;
 801         if (srf->scanout &&
 802             srf->num_sizes == 1 &&
 803             srf->sizes[0].width == 64 &&
 804             srf->sizes[0].height == 64 &&
 805             srf->format == SVGA3D_A8R8G8B8) {
 806
 807                 srf->snooper.image = kmalloc(64 * 64 * 4, GFP_KERNEL);
 808                 /* clear the image */
 809                 if (srf->snooper.image) {
 810                         memset(srf->snooper.image, 0x00, 64 * 64 * 4);
 811                 } else {
 812                         DRM_ERROR("Failed to allocate cursor_image\n");
 813                         ret = -ENOMEM;
 814                         goto out_no_copy;
 815                 }
 816         } else {
 817                 srf->snooper.image = NULL;
 818         }
 819         srf->snooper.crtc = NULL;
 820
 821         user_srf->prime.base.shareable = false;
 822         user_srf->prime.base.tfile = NULL;
 823
 824         /**
 825          * From this point, the generic resource management functions
 826          * destroy the object on failure.
 827          */
 828
 829         ret = vmw_surface_init(dev_priv, srf, vmw_user_surface_free);
 830         if (unlikely(ret != 0))
 831                 goto out_unlock;
 832
 833         /*
 834          * A gb-aware client referencing a shared surface will
 835          * expect a backup buffer to be present.
 836          */
 837         if (dev_priv->has_mob && req->shareable) {
 838                 uint32_t backup_handle;
 839
 840                 ret = vmw_user_dmabuf_alloc(dev_priv, tfile,
 841                                             res->backup_size,
 842                                             true,
 843                                             &backup_handle,
 844                                             &res->backup);
 845                 if (unlikely(ret != 0)) {
 846                         vmw_resource_unreference(&res);
 847                         goto out_unlock;
 848                 }
 849         }
 850
 851         tmp = vmw_resource_reference(&srf->res);
 852         ret = ttm_prime_object_init(tfile, res->backup_size, &user_srf->prime,
 853                                     req->shareable, VMW_RES_SURFACE,
 854                                     &vmw_user_surface_base_release, NULL);
 855
 856         if (unlikely(ret != 0)) {
 857                 vmw_resource_unreference(&tmp);
 858                 vmw_resource_unreference(&res);
 859                 goto out_unlock;
 860         }
 861
 862         rep->sid = user_srf->prime.base.hash.key;
 863         vmw_resource_unreference(&res);
 864
 865         ttm_read_unlock(&vmaster->lock);
 866         return 0;
 867 out_no_copy:
 868         kfree(srf->offsets);
 869 out_no_offsets:
 870         kfree(srf->sizes);
 871 out_no_sizes:
 872         ttm_prime_object_kfree(user_srf, prime);
 873 out_no_user_srf:
 874         ttm_mem_global_free(vmw_mem_glob(dev_priv), size);
 875 out_unlock:
 876         ttm_read_unlock(&vmaster->lock);
 877         return ret;
 878 }
 879
 880 /**
 881  * vmw_user_surface_define_ioctl - Ioctl function implementing
 882  *                                  the user surface reference functionality.
 883  *
 884  * @dev:            Pointer to a struct drm_device.
 885  * @data:           Pointer to data copied from / to user-space.
 886  * @file_priv:      Pointer to a drm file private structure.
 887  */
 888 int vmw_surface_reference_ioctl(struct drm_device *dev, void *data,
 889                                 struct drm_file *file_priv)
 890 {
 891         struct vmw_private *dev_priv = vmw_priv(dev);
 892         union drm_vmw_surface_reference_arg *arg =
 893             (union drm_vmw_surface_reference_arg *)data;
 894         struct drm_vmw_surface_arg *req = &arg->req;
 895         struct drm_vmw_surface_create_req *rep = &arg->rep;
 896         struct ttm_object_file *tfile = vmw_fpriv(file_priv)->tfile;
 897         struct vmw_surface *srf;
 898         struct vmw_user_surface *user_srf;
 899         struct drm_vmw_size __user *user_sizes;
 900         struct ttm_base_object *base;
 901         int ret = -EINVAL;
 902
 903         base = ttm_base_object_lookup_for_ref(dev_priv->tdev, req->sid);
 904         if (unlikely(base == NULL)) {
 905                 DRM_ERROR("Could not find surface to reference.\n");
 906                 return -EINVAL;
 907         }
 908
 909         if (unlikely(ttm_base_object_type(base) != VMW_RES_SURFACE))
 910                 goto out_bad_resource;
 911
 912         user_srf = container_of(base, struct vmw_user_surface, prime.base);
 913         srf = &user_srf->srf;
 914
 915         ret = ttm_ref_object_add(tfile, &user_srf->prime.base,
 916                                  TTM_REF_USAGE, NULL);
 917         if (unlikely(ret != 0)) {
 918                 DRM_ERROR("Could not add a reference to a surface.\n");
 919                 goto out_no_reference;
 920         }
 921
 922         rep->flags = srf->flags;
 923         rep->format = srf->format;
 924         memcpy(rep->mip_levels, srf->mip_levels, sizeof(srf->mip_levels));
 925         user_sizes = (struct drm_vmw_size __user *)(unsigned long)
 926             rep->size_addr;
 927
 928         if (user_sizes)
 929                 ret = copy_to_user(user_sizes, &srf->base_size,
 930                                    sizeof(srf->base_size));
 931         if (unlikely(ret != 0)) {
 932                 DRM_ERROR("copy_to_user failed %p %u\n",
 933                           user_sizes, srf->num_sizes);
 934                 ret = -EFAULT;
 935         }
 936 out_bad_resource:
 937 out_no_reference:
 938         ttm_base_object_unref(&base);
 939
 940         return ret;
 941 }
 942
 943 /**
 944  * vmw_surface_define_encode - Encode a surface_define command.
 945  *
 946  * @srf: Pointer to a struct vmw_surface object.
 947  * @cmd_space: Pointer to memory area in which the commands should be encoded.
 948  */
 949 static int vmw_gb_surface_create(struct vmw_resource *res)
 950 {
 951         struct vmw_private *dev_priv = res->dev_priv;
 952         struct vmw_surface *srf = vmw_res_to_srf(res);
 953         uint32_t cmd_len, submit_len;
 954         int ret;
 955         struct {
 956                 SVGA3dCmdHeader header;
 957                 SVGA3dCmdDefineGBSurface body;
 958         } *cmd;
 959
 960         if (likely(res->id != -1))
 961                 return 0;
 962
 963         (void) vmw_3d_resource_inc(dev_priv, false);
 964         ret = vmw_resource_alloc_id(res);
 965         if (unlikely(ret != 0)) {
 966                 DRM_ERROR("Failed to allocate a surface id.\n");
 967                 goto out_no_id;
 968         }
 969
 970         if (unlikely(res->id >= VMWGFX_NUM_GB_SURFACE)) {
 971                 ret = -EBUSY;
 972                 goto out_no_fifo;
 973         }
 974
 975         cmd_len = sizeof(cmd->body);
 976         submit_len = sizeof(*cmd);
 977         cmd = vmw_fifo_reserve(dev_priv, submit_len);
 978         if (unlikely(cmd == NULL)) {
 979                 DRM_ERROR("Failed reserving FIFO space for surface "
 980                           "creation.\n");
 981                 ret = -ENOMEM;
 982                 goto out_no_fifo;
 983         }
 984
 985         cmd->header.id = SVGA_3D_CMD_DEFINE_GB_SURFACE;
 986         cmd->header.size = cmd_len;
 987         cmd->body.sid = srf->res.id;
 988         cmd->body.surfaceFlags = srf->flags;
 989         cmd->body.format = cpu_to_le32(srf->format);
 990         cmd->body.numMipLevels = srf->mip_levels[0];
 991         cmd->body.multisampleCount = srf->multisample_count;
 992         cmd->body.autogenFilter = srf->autogen_filter;
 993         cmd->body.size.width = srf->base_size.width;
 994         cmd->body.size.height = srf->base_size.height;
 995         cmd->body.size.depth = srf->base_size.depth;
 996         vmw_fifo_commit(dev_priv, submit_len);
 997
 998         return 0;
 999
1000 out_no_fifo:
1001         vmw_resource_release_id(res);
1002 out_no_id:
1003         vmw_3d_resource_dec(dev_priv, false);
1004         return ret;
1005 }
1006
1007
1008 static int vmw_gb_surface_bind(struct vmw_resource *res,
1009                                struct ttm_validate_buffer *val_buf)
1010 {
1011         struct vmw_private *dev_priv = res->dev_priv;
1012         struct {
1013                 SVGA3dCmdHeader header;
1014                 SVGA3dCmdBindGBSurface body;
1015         } *cmd1;
1016         struct {
1017                 SVGA3dCmdHeader header;
1018                 SVGA3dCmdUpdateGBSurface body;
1019         } *cmd2;
1020         uint32_t submit_size;
1021         struct ttm_buffer_object *bo = val_buf->bo;
1022
1023         BUG_ON(bo->mem.mem_type != VMW_PL_MOB);
1024
1025         submit_size = sizeof(*cmd1) + (res->backup_dirty ? sizeof(*cmd2) : 0);
1026
1027         cmd1 = vmw_fifo_reserve(dev_priv, submit_size);
1028         if (unlikely(cmd1 == NULL)) {
1029                 DRM_ERROR("Failed reserving FIFO space for surface "
1030                           "binding.\n");
1031                 return -ENOMEM;
1032         }
1033
1034         cmd1->header.id = SVGA_3D_CMD_BIND_GB_SURFACE;
1035         cmd1->header.size = sizeof(cmd1->body);
1036         cmd1->body.sid = res->id;
1037         cmd1->body.mobid = bo->mem.start;
1038         if (res->backup_dirty) {
1039                 cmd2 = (void *) &cmd1[1];
1040                 cmd2->header.id = SVGA_3D_CMD_UPDATE_GB_SURFACE;
1041                 cmd2->header.size = sizeof(cmd2->body);
1042                 cmd2->body.sid = res->id;
1043                 res->backup_dirty = false;
1044         }
1045         vmw_fifo_commit(dev_priv, submit_size);
1046
1047         return 0;
1048 }
1049
1050 static int vmw_gb_surface_unbind(struct vmw_resource *res,
1051                                  bool readback,
1052                                  struct ttm_validate_buffer *val_buf)
1053 {
1054         struct vmw_private *dev_priv = res->dev_priv;
1055         struct ttm_buffer_object *bo = val_buf->bo;
1056         struct vmw_fence_obj *fence;
1057
1058         struct {
1059                 SVGA3dCmdHeader header;
1060                 SVGA3dCmdReadbackGBSurface body;
1061         } *cmd1;
1062         struct {
1063                 SVGA3dCmdHeader header;
1064                 SVGA3dCmdInvalidateGBSurface body;
1065         } *cmd2;
1066         struct {
1067                 SVGA3dCmdHeader header;
1068                 SVGA3dCmdBindGBSurface body;
1069         } *cmd3;
1070         uint32_t submit_size;
1071         uint8_t *cmd;
1072
1073
1074         BUG_ON(bo->mem.mem_type != VMW_PL_MOB);
1075
1076         submit_size = sizeof(*cmd3) + (readback ? sizeof(*cmd1) : sizeof(*cmd2));
1077         cmd = vmw_fifo_reserve(dev_priv, submit_size);
1078         if (unlikely(cmd == NULL)) {
1079                 DRM_ERROR("Failed reserving FIFO space for surface "
1080                           "unbinding.\n");
1081                 return -ENOMEM;
1082         }
1083
1084         if (readback) {
1085                 cmd1 = (void *) cmd;
1086                 cmd1->header.id = SVGA_3D_CMD_READBACK_GB_SURFACE;
1087                 cmd1->header.size = sizeof(cmd1->body);
1088                 cmd1->body.sid = res->id;
1089                 cmd3 = (void *) &cmd1[1];
1090         } else {
1091                 cmd2 = (void *) cmd;
1092                 cmd2->header.id = SVGA_3D_CMD_INVALIDATE_GB_SURFACE;
1093                 cmd2->header.size = sizeof(cmd2->body);
1094                 cmd2->body.sid = res->id;
1095                 cmd3 = (void *) &cmd2[1];
1096         }
1097
1098         cmd3->header.id = SVGA_3D_CMD_BIND_GB_SURFACE;
1099         cmd3->header.size = sizeof(cmd3->body);
1100         cmd3->body.sid = res->id;
1101         cmd3->body.mobid = SVGA3D_INVALID_ID;
1102
1103         vmw_fifo_commit(dev_priv, submit_size);
1104
1105         /*
1106          * Create a fence object and fence the backup buffer.
1107          */
1108
1109         (void) vmw_execbuf_fence_commands(NULL, dev_priv,
1110                                           &fence, NULL);
1111
1112         vmw_fence_single_bo(val_buf->bo, fence);
1113
1114         if (likely(fence != NULL))
1115                 vmw_fence_obj_unreference(&fence);
1116
1117         return 0;
1118 }
1119
1120 static int vmw_gb_surface_destroy(struct vmw_resource *res)
1121 {
1122         struct vmw_private *dev_priv = res->dev_priv;
1123         struct {
1124                 SVGA3dCmdHeader header;
1125                 SVGA3dCmdDestroyGBSurface body;
1126         } *cmd;
1127
1128         if (likely(res->id == -1))
1129                 return 0;
1130
1131         mutex_lock(&dev_priv->binding_mutex);
1132         vmw_context_binding_res_list_scrub(&res->binding_head);
1133
1134         cmd = vmw_fifo_reserve(dev_priv, sizeof(*cmd));
1135         if (unlikely(cmd == NULL)) {
1136                 DRM_ERROR("Failed reserving FIFO space for surface "
1137                           "destruction.\n");
1138                 mutex_unlock(&dev_priv->binding_mutex);
1139                 return -ENOMEM;
1140         }
1141
1142         cmd->header.id = SVGA_3D_CMD_DESTROY_GB_SURFACE;
1143         cmd->header.size = sizeof(cmd->body);
1144         cmd->body.sid = res->id;
1145         vmw_fifo_commit(dev_priv, sizeof(*cmd));
1146         mutex_unlock(&dev_priv->binding_mutex);
1147         vmw_resource_release_id(res);
1148         vmw_3d_resource_dec(dev_priv, false);
1149
1150         return 0;
1151 }
1152
1153 /**
1154  * vmw_gb_surface_define_ioctl - Ioctl function implementing
1155  *                               the user surface define functionality.
1156  *
1157  * @dev:            Pointer to a struct drm_device.
1158  * @data:           Pointer to data copied from / to user-space.
1159  * @file_priv:      Pointer to a drm file private structure.
1160  */
1161 int vmw_gb_surface_define_ioctl(struct drm_device *dev, void *data,
1162                                 struct drm_file *file_priv)
1163 {
1164         struct vmw_private *dev_priv = vmw_priv(dev);
1165         struct vmw_user_surface *user_srf;
1166         struct vmw_surface *srf;
1167         struct vmw_resource *res;
1168         struct vmw_resource *tmp;
1169         union drm_vmw_gb_surface_create_arg *arg =
1170             (union drm_vmw_gb_surface_create_arg *)data;
1171         struct drm_vmw_gb_surface_create_req *req = &arg->req;
1172         struct drm_vmw_gb_surface_create_rep *rep = &arg->rep;
1173         struct ttm_object_file *tfile = vmw_fpriv(file_priv)->tfile;
1174         int ret;
1175         uint32_t size;
1176         struct vmw_master *vmaster = vmw_master(file_priv->master);
1177         const struct svga3d_surface_desc *desc;
1178         uint32_t backup_handle;
1179
1180         if (unlikely(vmw_user_surface_size == 0))
1181                 vmw_user_surface_size = ttm_round_pot(sizeof(*user_srf)) +
1182                         128;
1183
1184         size = vmw_user_surface_size + 128;
1185
1186         desc = svga3dsurface_get_desc(req->format);
1187         if (unlikely(desc->block_desc == SVGA3DBLOCKDESC_NONE)) {
1188                 DRM_ERROR("Invalid surface format for surface creation.\n");
1189                 return -EINVAL;
1190         }
1191
1192         ret = ttm_read_lock(&vmaster->lock, true);
1193         if (unlikely(ret != 0))
1194                 return ret;
1195
1196         ret = ttm_mem_global_alloc(vmw_mem_glob(dev_priv),
1197                                    size, false, true);
1198         if (unlikely(ret != 0)) {
1199                 if (ret != -ERESTARTSYS)
1200                         DRM_ERROR("Out of graphics memory for surface"
1201                                   " creation.\n");
1202                 goto out_unlock;
1203         }
1204
1205         user_srf = kzalloc(sizeof(*user_srf), GFP_KERNEL);
1206         if (unlikely(user_srf == NULL)) {
1207                 ret = -ENOMEM;
1208                 goto out_no_user_srf;
1209         }
1210
1211         srf = &user_srf->srf;
1212         res = &srf->res;
1213
1214         srf->flags = req->svga3d_flags;
1215         srf->format = req->format;
1216         srf->scanout = req->drm_surface_flags & drm_vmw_surface_flag_scanout;
1217         srf->mip_levels[0] = req->mip_levels;
1218         srf->num_sizes = 1;
1219         srf->sizes = NULL;
1220         srf->offsets = NULL;
1221         user_srf->size = size;
1222         srf->base_size = req->base_size;
1223         srf->autogen_filter = SVGA3D_TEX_FILTER_NONE;
1224         srf->multisample_count = req->multisample_count;
1225         res->backup_size = svga3dsurface_get_serialized_size
1226           (srf->format, srf->base_size, srf->mip_levels[0],
1227            srf->flags & SVGA3D_SURFACE_CUBEMAP);
1228
1229         user_srf->prime.base.shareable = false;
1230         user_srf->prime.base.tfile = NULL;
1231
1232         /**
1233          * From this point, the generic resource management functions
1234          * destroy the object on failure.
1235          */
1236
1237         ret = vmw_surface_init(dev_priv, srf, vmw_user_surface_free);
1238         if (unlikely(ret != 0))
1239                 goto out_unlock;
1240
1241         if (req->buffer_handle != SVGA3D_INVALID_ID) {
1242                 ret = vmw_user_dmabuf_lookup(tfile, req->buffer_handle,
1243                                              &res->backup);
1244         } else if (req->drm_surface_flags &
1245                    drm_vmw_surface_flag_create_buffer)
1246                 ret = vmw_user_dmabuf_alloc(dev_priv, tfile,
1247                                             res->backup_size,
1248                                             req->drm_surface_flags &
1249                                             drm_vmw_surface_flag_shareable,
1250                                             &backup_handle,
1251                                             &res->backup);
1252
1253         if (unlikely(ret != 0)) {
1254                 vmw_resource_unreference(&res);
1255                 goto out_unlock;
1256         }
1257
1258         tmp = vmw_resource_reference(&srf->res);
1259         ret = ttm_prime_object_init(tfile, res->backup_size, &user_srf->prime,
1260                                     req->drm_surface_flags &
1261                                     drm_vmw_surface_flag_shareable,
1262                                     VMW_RES_SURFACE,
1263                                     &vmw_user_surface_base_release, NULL);
1264
1265         if (unlikely(ret != 0)) {
1266                 vmw_resource_unreference(&tmp);
1267                 vmw_resource_unreference(&res);
1268                 goto out_unlock;
1269         }
1270
1271         rep->handle = user_srf->prime.base.hash.key;
1272         rep->backup_size = res->backup_size;
1273         if (res->backup) {
1274                 rep->buffer_map_handle =
1275                         drm_vma_node_offset_addr(&res->backup->base.vma_node);
1276                 rep->buffer_size = res->backup->base.num_pages * PAGE_SIZE;
1277                 rep->buffer_handle = backup_handle;
1278         } else {
1279                 rep->buffer_map_handle = 0;
1280                 rep->buffer_size = 0;
1281                 rep->buffer_handle = SVGA3D_INVALID_ID;
1282         }
1283
1284         vmw_resource_unreference(&res);
1285
1286         ttm_read_unlock(&vmaster->lock);
1287         return 0;
1288 out_no_user_srf:
1289         ttm_mem_global_free(vmw_mem_glob(dev_priv), size);
1290 out_unlock:
1291         ttm_read_unlock(&vmaster->lock);
1292         return ret;
1293 }
1294
1295 /**
1296  * vmw_gb_surface_reference_ioctl - Ioctl function implementing
1297  *                                  the user surface reference functionality.
1298  *
1299  * @dev:            Pointer to a struct drm_device.
1300  * @data:           Pointer to data copied from / to user-space.
1301  * @file_priv:      Pointer to a drm file private structure.
1302  */
1303 int vmw_gb_surface_reference_ioctl(struct drm_device *dev, void *data,
1304                                    struct drm_file *file_priv)
1305 {
1306         struct vmw_private *dev_priv = vmw_priv(dev);
1307         union drm_vmw_gb_surface_reference_arg *arg =
1308             (union drm_vmw_gb_surface_reference_arg *)data;
1309         struct drm_vmw_surface_arg *req = &arg->req;
1310         struct drm_vmw_gb_surface_ref_rep *rep = &arg->rep;
1311         struct ttm_object_file *tfile = vmw_fpriv(file_priv)->tfile;
1312         struct vmw_surface *srf;
1313         struct vmw_user_surface *user_srf;
1314         struct ttm_base_object *base;
1315         uint32_t backup_handle;
1316         int ret = -EINVAL;
1317
1318         base = ttm_base_object_lookup_for_ref(dev_priv->tdev, req->sid);
1319         if (unlikely(base == NULL)) {
1320                 DRM_ERROR("Could not find surface to reference.\n");
1321                 return -EINVAL;
1322         }
1323
1324         if (unlikely(ttm_base_object_type(base) != VMW_RES_SURFACE))
1325                 goto out_bad_resource;
1326
1327         user_srf = container_of(base, struct vmw_user_surface, prime.base);
1328         srf = &user_srf->srf;
1329         if (srf->res.backup == NULL) {
1330                 DRM_ERROR("Shared GB surface is missing a backup buffer.\n");
1331                 goto out_bad_resource;
1332         }
1333
1334         ret = ttm_ref_object_add(tfile, &user_srf->prime.base,
1335                                  TTM_REF_USAGE, NULL);
1336         if (unlikely(ret != 0)) {
1337                 DRM_ERROR("Could not add a reference to a GB surface.\n");
1338                 goto out_bad_resource;
1339         }
1340
1341         mutex_lock(&dev_priv->cmdbuf_mutex); /* Protect res->backup */
1342         ret = vmw_user_dmabuf_reference(tfile, srf->res.backup,
1343                                         &backup_handle);
1344         mutex_unlock(&dev_priv->cmdbuf_mutex);
1345
1346         if (unlikely(ret != 0)) {
1347                 DRM_ERROR("Could not add a reference to a GB surface "
1348                           "backup buffer.\n");
1349                 (void) ttm_ref_object_base_unref(vmw_fpriv(file_priv)->tfile,
1350                                                  req->sid,
1351                                                  TTM_REF_USAGE);
1352                 goto out_bad_resource;
1353         }
1354
1355         rep->creq.svga3d_flags = srf->flags;
1356         rep->creq.format = srf->format;
1357         rep->creq.mip_levels = srf->mip_levels[0];
1358         rep->creq.drm_surface_flags = 0;
1359         rep->creq.multisample_count = srf->multisample_count;
1360         rep->creq.autogen_filter = srf->autogen_filter;
1361         rep->creq.buffer_handle = backup_handle;
1362         rep->creq.base_size = srf->base_size;
1363         rep->crep.handle = user_srf->prime.base.hash.key;
1364         rep->crep.backup_size = srf->res.backup_size;
1365         rep->crep.buffer_handle = backup_handle;
1366         rep->crep.buffer_map_handle =
1367                 drm_vma_node_offset_addr(&srf->res.backup->base.vma_node);
1368         rep->crep.buffer_size = srf->res.backup->base.num_pages * PAGE_SIZE;
1369
1370 out_bad_resource:
1371         ttm_base_object_unref(&base);
1372
1373         return ret;
1374 }